diff --git a/API/APICallbackFunction.h b/API/APICallbackFunction.h
new file mode 100644
index 0000000..e5283b5
--- /dev/null
+++ b/API/APICallbackFunction.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef APICallbackFunction_h
+#define APICallbackFunction_h
+
+#include "APICast.h"
+#include "Error.h"
+#include "JSCallbackConstructor.h"
+#include "JSLock.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+struct APICallbackFunction {
+
+template <typename T> static EncodedJSValue JSC_HOST_CALL call(ExecState*);
+template <typename T> static EncodedJSValue JSC_HOST_CALL construct(ExecState*);
+
+};
+
+template <typename T>
+EncodedJSValue JSC_HOST_CALL APICallbackFunction::call(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSContextRef execRef = toRef(exec);
+    JSObjectRef functionRef = toRef(exec->jsCallee());
+    JSObjectRef thisObjRef = toRef(jsCast<JSObject*>(exec->thisValue().toThis(exec, NotStrictMode)));
+
+    int argumentCount = static_cast<int>(exec->argumentCount());
+    Vector<JSValueRef, 16> arguments;
+    arguments.reserveInitialCapacity(argumentCount);
+    for (int i = 0; i < argumentCount; i++)
+        arguments.uncheckedAppend(toRef(exec, exec->uncheckedArgument(i)));
+
+    JSValueRef exception = 0;
+    JSValueRef result;
+    {
+        JSLock::DropAllLocks dropAllLocks(exec);
+        result = jsCast<T*>(toJS(functionRef))->functionCallback()(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception);
+    }
+    if (exception)
+        throwException(exec, scope, toJS(exec, exception));
+
+    // result must be a valid JSValue.
+    if (!result)
+        return JSValue::encode(jsUndefined());
+
+    return JSValue::encode(toJS(exec, result));
+}
+
+template <typename T>
+EncodedJSValue JSC_HOST_CALL APICallbackFunction::construct(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* constructor = exec->jsCallee();
+    JSContextRef ctx = toRef(exec);
+    JSObjectRef constructorRef = toRef(constructor);
+
+    JSObjectCallAsConstructorCallback callback = jsCast<T*>(constructor)->constructCallback();
+    if (callback) {
+        size_t argumentCount = exec->argumentCount();
+        Vector<JSValueRef, 16> arguments;
+        arguments.reserveInitialCapacity(argumentCount);
+        for (size_t i = 0; i < argumentCount; ++i)
+            arguments.uncheckedAppend(toRef(exec, exec->uncheckedArgument(i)));
+
+        JSValueRef exception = 0;
+        JSObjectRef result;
+        {
+            JSLock::DropAllLocks dropAllLocks(exec);
+            result = callback(ctx, constructorRef, argumentCount, arguments.data(), &exception);
+        }
+        if (exception) {
+            throwException(exec, scope, toJS(exec, exception));
+            return JSValue::encode(toJS(exec, exception));
+        }
+        // result must be a valid JSValue.
+        if (!result)
+            return throwVMTypeError(exec, scope);
+        return JSValue::encode(toJS(result));
+    }
+    
+    return JSValue::encode(toJS(JSObjectMake(ctx, jsCast<JSCallbackConstructor*>(constructor)->classRef(), 0)));
+}
+
+} // namespace JSC
+
+#endif // APICallbackFunction_h
diff --git a/API/APICast.h b/API/APICast.h
new file mode 100644
index 0000000..8fe8d60
--- /dev/null
+++ b/API/APICast.h
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef APICast_h
+#define APICast_h
+
+#include "JSAPIValueWrapper.h"
+#include "JSCJSValue.h"
+#include "JSCJSValueInlines.h"
+#include "JSGlobalObject.h"
+
+namespace JSC {
+    class ExecState;
+    class PropertyNameArray;
+    class VM;
+    class JSObject;
+    class JSValue;
+}
+
+typedef const struct OpaqueJSContextGroup* JSContextGroupRef;
+typedef const struct OpaqueJSContext* JSContextRef;
+typedef struct OpaqueJSContext* JSGlobalContextRef;
+typedef struct OpaqueJSPropertyNameAccumulator* JSPropertyNameAccumulatorRef;
+typedef const struct OpaqueJSValue* JSValueRef;
+typedef struct OpaqueJSValue* JSObjectRef;
+
+/* Opaque typing convenience methods */
+
+inline JSC::ExecState* toJS(JSContextRef c)
+{
+    ASSERT(c);
+    return reinterpret_cast<JSC::ExecState*>(const_cast<OpaqueJSContext*>(c));
+}
+
+inline JSC::ExecState* toJS(JSGlobalContextRef c)
+{
+    ASSERT(c);
+    return reinterpret_cast<JSC::ExecState*>(c);
+}
+
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
+{
+    ASSERT_UNUSED(exec, exec);
+#if USE(JSVALUE32_64)
+    JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
+    if (!jsCell)
+        return JSC::jsNull();
+    JSC::JSValue result;
+    if (jsCell->isAPIValueWrapper())
+        result = JSC::jsCast<JSC::JSAPIValueWrapper*>(jsCell)->value();
+    else
+        result = jsCell;
+#else
+    JSC::JSValue result = JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#endif
+    if (!result)
+        return JSC::jsNull();
+    if (result.isCell())
+        RELEASE_ASSERT(result.asCell()->methodTable());
+    return result;
+}
+
+inline JSC::JSValue toJSForGC(JSC::ExecState* exec, JSValueRef v)
+{
+    ASSERT_UNUSED(exec, exec);
+#if USE(JSVALUE32_64)
+    JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
+    if (!jsCell)
+        return JSC::JSValue();
+    JSC::JSValue result = jsCell;
+#else
+    JSC::JSValue result = JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#endif
+    if (result && result.isCell())
+        RELEASE_ASSERT(result.asCell()->methodTable());
+    return result;
+}
+
+// Used in JSObjectGetPrivate as that may be called during finalization
+inline JSC::JSObject* uncheckedToJS(JSObjectRef o)
+{
+    return reinterpret_cast<JSC::JSObject*>(o);
+}
+
+inline JSC::JSObject* toJS(JSObjectRef o)
+{
+    JSC::JSObject* object = uncheckedToJS(o);
+    if (object)
+        RELEASE_ASSERT(object->methodTable());
+    return object;
+}
+
+inline JSC::PropertyNameArray* toJS(JSPropertyNameAccumulatorRef a)
+{
+    return reinterpret_cast<JSC::PropertyNameArray*>(a);
+}
+
+inline JSC::VM* toJS(JSContextGroupRef g)
+{
+    return reinterpret_cast<JSC::VM*>(const_cast<OpaqueJSContextGroup*>(g));
+}
+
+inline JSValueRef toRef(JSC::ExecState* exec, JSC::JSValue v)
+{
+    ASSERT(exec->vm().currentThreadIsHoldingAPILock());
+#if USE(JSVALUE32_64)
+    if (!v)
+        return 0;
+    if (!v.isCell())
+        return reinterpret_cast<JSValueRef>(JSC::jsAPIValueWrapper(exec, v).asCell());
+    return reinterpret_cast<JSValueRef>(v.asCell());
+#else
+    UNUSED_PARAM(exec);
+    return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(v));
+#endif
+}
+
+inline JSObjectRef toRef(JSC::JSObject* o)
+{
+    return reinterpret_cast<JSObjectRef>(o);
+}
+
+inline JSObjectRef toRef(const JSC::JSObject* o)
+{
+    return reinterpret_cast<JSObjectRef>(const_cast<JSC::JSObject*>(o));
+}
+
+inline JSContextRef toRef(JSC::ExecState* e)
+{
+    return reinterpret_cast<JSContextRef>(e);
+}
+
+inline JSGlobalContextRef toGlobalRef(JSC::ExecState* e)
+{
+    ASSERT(e == e->lexicalGlobalObject()->globalExec());
+    return reinterpret_cast<JSGlobalContextRef>(e);
+}
+
+inline JSPropertyNameAccumulatorRef toRef(JSC::PropertyNameArray* l)
+{
+    return reinterpret_cast<JSPropertyNameAccumulatorRef>(l);
+}
+
+inline JSContextGroupRef toRef(JSC::VM* g)
+{
+    return reinterpret_cast<JSContextGroupRef>(g);
+}
+
+#endif // APICast_h
diff --git a/API/APIUtils.h b/API/APIUtils.h
new file mode 100644
index 0000000..e2190c8
--- /dev/null
+++ b/API/APIUtils.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef APIUtils_h
+#define APIUtils_h
+
+#include "Exception.h"
+#include "JSCJSValue.h"
+#include "JSGlobalObjectInspectorController.h"
+#include "JSValueRef.h"
+
+enum class ExceptionStatus {
+    DidThrow,
+    DidNotThrow
+};
+
+inline ExceptionStatus handleExceptionIfNeeded(JSC::ExecState* exec, JSValueRef* returnedExceptionRef)
+{
+    JSC::VM& vm = exec->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    if (UNLIKELY(scope.exception())) {
+        JSC::Exception* exception = scope.exception();
+        if (returnedExceptionRef)
+            *returnedExceptionRef = toRef(exec, exception->value());
+        scope.clearException();
+#if ENABLE(REMOTE_INSPECTOR)
+        exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, exception);
+#endif
+        return ExceptionStatus::DidThrow;
+    }
+    return ExceptionStatus::DidNotThrow;
+}
+
+inline void setException(JSC::ExecState* exec, JSValueRef* returnedExceptionRef, JSC::JSValue exception)
+{
+    if (returnedExceptionRef)
+        *returnedExceptionRef = toRef(exec, exception);
+#if ENABLE(REMOTE_INSPECTOR)
+    exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, JSC::Exception::create(exec->vm(), exception));
+#endif
+}
+
+#endif /* APIUtils_h */
diff --git a/API/JSAPIWrapperObject.h b/API/JSAPIWrapperObject.h
new file mode 100644
index 0000000..14194b6
--- /dev/null
+++ b/API/JSAPIWrapperObject.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSAPIWrapperObject_h
+#define JSAPIWrapperObject_h
+
+#include "JSBase.h"
+#include "JSDestructibleObject.h"
+#include "WeakReferenceHarvester.h"
+
+#if JSC_OBJC_API_ENABLED
+
+namespace JSC {
+    
+class JSAPIWrapperObject : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+    
+    void finishCreation(VM&);
+    static void visitChildren(JSCell*, JSC::SlotVisitor&);
+    
+    void* wrappedObject() { return m_wrappedObject; }
+    void setWrappedObject(void*);
+
+protected:
+    JSAPIWrapperObject(VM&, Structure*);
+
+private:
+    void* m_wrappedObject;
+};
+
+} // namespace JSC
+
+#endif // JSC_OBJC_API_ENABLED
+
+#endif // JSAPIWrapperObject_h
diff --git a/API/JSAPIWrapperObject.mm b/API/JSAPIWrapperObject.mm
new file mode 100644
index 0000000..f301d3e
--- /dev/null
+++ b/API/JSAPIWrapperObject.mm
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSAPIWrapperObject.h"
+
+#include "JSCInlines.h"
+#include "JSCallbackObject.h"
+#include "JSVirtualMachineInternal.h"
+#include "Structure.h"
+#include <wtf/NeverDestroyed.h>
+
+#if JSC_OBJC_API_ENABLED
+
+class JSAPIWrapperObjectHandleOwner : public JSC::WeakHandleOwner {
+public:
+    void finalize(JSC::Handle<JSC::Unknown>, void*) override;
+    bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::SlotVisitor&) override;
+};
+
+static JSAPIWrapperObjectHandleOwner* jsAPIWrapperObjectHandleOwner()
+{
+    static NeverDestroyed<JSAPIWrapperObjectHandleOwner> jsWrapperObjectHandleOwner;
+    return &jsWrapperObjectHandleOwner.get();
+}
+
+void JSAPIWrapperObjectHandleOwner::finalize(JSC::Handle<JSC::Unknown> handle, void*)
+{
+    JSC::JSAPIWrapperObject* wrapperObject = static_cast<JSC::JSAPIWrapperObject*>(handle.get().asCell());
+    if (!wrapperObject->wrappedObject())
+        return;
+
+    JSC::Heap::heap(wrapperObject)->releaseSoon(adoptNS(static_cast<id>(wrapperObject->wrappedObject())));
+    JSC::WeakSet::deallocate(JSC::WeakImpl::asWeakImpl(handle.slot()));
+}
+
+bool JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handle, void*, JSC::SlotVisitor& visitor)
+{
+    JSC::JSAPIWrapperObject* wrapperObject = JSC::jsCast<JSC::JSAPIWrapperObject*>(handle.get().asCell());
+    // We use the JSGlobalObject when processing weak handles to prevent the situation where using
+    // the same Objective-C object in multiple global objects keeps all of the global objects alive.
+    if (!wrapperObject->wrappedObject())
+        return false;
+    return JSC::Heap::isMarked(wrapperObject->structure()->globalObject()) && visitor.containsOpaqueRoot(wrapperObject->wrappedObject());
+}
+
+namespace JSC {
+    
+template <> const ClassInfo JSCallbackObject<JSAPIWrapperObject>::s_info = { "JSAPIWrapperObject", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallbackObject) };
+
+template<> const bool JSCallbackObject<JSAPIWrapperObject>::needsDestruction = true;
+
+template <>
+Structure* JSCallbackObject<JSAPIWrapperObject>::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+{
+    return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), &s_info);
+}
+
+JSAPIWrapperObject::JSAPIWrapperObject(VM& vm, Structure* structure)
+    : Base(vm, structure)
+    , m_wrappedObject(0)
+{
+}
+
+void JSAPIWrapperObject::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    WeakSet::allocate(this, jsAPIWrapperObjectHandleOwner(), 0); // Balanced in JSAPIWrapperObjectHandleOwner::finalize.
+}
+    
+void JSAPIWrapperObject::setWrappedObject(void* wrappedObject)
+{
+    ASSERT(!m_wrappedObject);
+    m_wrappedObject = [static_cast<id>(wrappedObject) retain];
+}
+
+void JSAPIWrapperObject::visitChildren(JSCell* cell, JSC::SlotVisitor& visitor)
+{
+    JSAPIWrapperObject* thisObject = JSC::jsCast<JSAPIWrapperObject*>(cell);
+    Base::visitChildren(cell, visitor);
+
+    void* wrappedObject = thisObject->wrappedObject();
+    if (wrappedObject)
+        scanExternalObjectGraph(visitor.vm(), visitor, wrappedObject);
+}
+
+} // namespace JSC
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/JSBase.cpp b/API/JSBase.cpp
new file mode 100644
index 0000000..a3e2059
--- /dev/null
+++ b/API/JSBase.cpp
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2006, 2007, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSBase.h"
+#include "JSBasePrivate.h"
+
+#include "APICast.h"
+#include "CallFrame.h"
+#include "Completion.h"
+#include "Exception.h"
+#include "GCActivityCallback.h"
+#include "InitializeThreading.h"
+#include "JSGlobalObject.h"
+#include "JSLock.h"
+#include "JSObject.h"
+#include "OpaqueJSString.h"
+#include "JSCInlines.h"
+#include "SourceCode.h"
+#include <wtf/text/StringHash.h>
+
+#if ENABLE(REMOTE_INSPECTOR)
+#include "JSGlobalObjectInspectorController.h"
+#endif
+
+using namespace JSC;
+
+JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef thisObject, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* jsThisObject = toJS(thisObject);
+
+    startingLineNumber = std::max(1, startingLineNumber);
+
+    // evaluate sets "this" to the global object if it is NULL
+    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
+    SourceCode source = makeSource(script->string(), sourceURL ? sourceURL->string() : String(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
+
+    NakedPtr<Exception> evaluationException;
+    JSValue returnValue = profiledEvaluate(globalObject->globalExec(), ProfilingReason::API, source, jsThisObject, evaluationException);
+
+    if (evaluationException) {
+        if (exception)
+            *exception = toRef(exec, evaluationException->value());
+#if ENABLE(REMOTE_INSPECTOR)
+        // FIXME: If we have a debugger attached we could learn about ParseError exceptions through
+        // ScriptDebugServer::sourceParsed and this path could produce a duplicate warning. The
+        // Debugger path is currently ignored by inspector.
+        // NOTE: If we don't have a debugger, this SourceCode will be forever lost to the inspector.
+        // We could stash it in the inspector in case an inspector is ever opened.
+        globalObject->inspectorController().reportAPIException(exec, evaluationException);
+#endif
+        return 0;
+    }
+
+    if (returnValue)
+        return toRef(exec, returnValue);
+
+    // happens, for example, when the only statement is an empty (';') statement
+    return toRef(exec, jsUndefined());
+}
+
+bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    startingLineNumber = std::max(1, startingLineNumber);
+
+    SourceCode source = makeSource(script->string(), sourceURL ? sourceURL->string() : String(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
+    
+    JSValue syntaxException;
+    bool isValidSyntax = checkSyntax(exec->vmEntryGlobalObject()->globalExec(), source, &syntaxException);
+
+    if (!isValidSyntax) {
+        if (exception)
+            *exception = toRef(exec, syntaxException);
+#if ENABLE(REMOTE_INSPECTOR)
+        Exception* exception = Exception::create(exec->vm(), syntaxException);
+        exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, exception);
+#endif
+        return false;
+    }
+
+    return true;
+}
+
+void JSGarbageCollect(JSContextRef ctx)
+{
+    // We used to recommend passing NULL as an argument here, which caused the only heap to be collected.
+    // As there is no longer a shared heap, the previously recommended usage became a no-op (but the GC
+    // will happen when the context group is destroyed).
+    // Because the function argument was originally ignored, some clients may pass their released context here,
+    // in which case there is a risk of crashing if another thread performs GC on the same heap in between.
+    if (!ctx)
+        return;
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    exec->vm().heap.reportAbandonedObjectGraph();
+}
+
+void JSReportExtraMemoryCost(JSContextRef ctx, size_t size)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    exec->vm().heap.deprecatedReportExtraMemory(size);
+}
+
+extern "C" JS_EXPORT void JSSynchronousGarbageCollectForDebugging(JSContextRef);
+extern "C" JS_EXPORT void JSSynchronousEdenCollectForDebugging(JSContextRef);
+
+void JSSynchronousGarbageCollectForDebugging(JSContextRef ctx)
+{
+    if (!ctx)
+        return;
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    exec->vm().heap.collectAllGarbage();
+}
+
+void JSSynchronousEdenCollectForDebugging(JSContextRef ctx)
+{
+    if (!ctx)
+        return;
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    exec->vm().heap.collectSync(CollectionScope::Eden);
+}
+
+void JSDisableGCTimer(void)
+{
+    GCActivityCallback::s_shouldCreateGCTimer = false;
+}
+
+#if PLATFORM(IOS)
+// FIXME: Expose symbols to tell dyld where to find JavaScriptCore on older versions of
+// iOS (< 7.0). We should remove these symbols once we no longer need to support such
+// versions of iOS. See <rdar://problem/13696872> for more details.
+JS_EXPORT extern const char iosInstallName43 __asm("$ld$install_name$os4.3$/System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore");
+JS_EXPORT extern const char iosInstallName50 __asm("$ld$install_name$os5.0$/System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore");
+JS_EXPORT extern const char iosInstallName51 __asm("$ld$install_name$os5.1$/System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore");
+JS_EXPORT extern const char iosInstallName60 __asm("$ld$install_name$os6.0$/System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore");
+JS_EXPORT extern const char iosInstallName61 __asm("$ld$install_name$os6.1$/System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore");
+
+const char iosInstallName43 = 0;
+const char iosInstallName50 = 0;
+const char iosInstallName51 = 0;
+const char iosInstallName60 = 0;
+const char iosInstallName61 = 0;
+#endif
diff --git a/API/JSBase.h b/API/JSBase.h
new file mode 100644
index 0000000..bc85aca
--- /dev/null
+++ b/API/JSBase.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSBase_h
+#define JSBase_h
+
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
+
+#ifdef __OBJC__
+#import <Foundation/Foundation.h>
+#endif
+
+/* JavaScript engine interface */
+
+/*! @typedef JSContextGroupRef A group that associates JavaScript contexts with one another. Contexts in the same group may share and exchange JavaScript objects. */
+typedef const struct OpaqueJSContextGroup* JSContextGroupRef;
+
+/*! @typedef JSContextRef A JavaScript execution context. Holds the global object and other execution state. */
+typedef const struct OpaqueJSContext* JSContextRef;
+
+/*! @typedef JSGlobalContextRef A global JavaScript execution context. A JSGlobalContext is a JSContext. */
+typedef struct OpaqueJSContext* JSGlobalContextRef;
+
+/*! @typedef JSStringRef A UTF16 character buffer. The fundamental string representation in JavaScript. */
+typedef struct OpaqueJSString* JSStringRef;
+
+/*! @typedef JSClassRef A JavaScript class. Used with JSObjectMake to construct objects with custom behavior. */
+typedef struct OpaqueJSClass* JSClassRef;
+
+/*! @typedef JSPropertyNameArrayRef An array of JavaScript property names. */
+typedef struct OpaqueJSPropertyNameArray* JSPropertyNameArrayRef;
+
+/*! @typedef JSPropertyNameAccumulatorRef An ordered set used to collect the names of a JavaScript object's properties. */
+typedef struct OpaqueJSPropertyNameAccumulator* JSPropertyNameAccumulatorRef;
+
+/*! @typedef JSTypedArrayBytesDeallocator A function used to deallocate bytes passed to a Typed Array constructor. The function should take two arguments. The first is a pointer to the bytes that were originally passed to the Typed Array constructor. The second is a pointer to additional information desired at the time the bytes are to be freed. */
+typedef void (*JSTypedArrayBytesDeallocator)(void* bytes, void* deallocatorContext);
+
+/* JavaScript data types */
+
+/*! @typedef JSValueRef A JavaScript value. The base type for all JavaScript values, and polymorphic functions on them. */
+typedef const struct OpaqueJSValue* JSValueRef;
+
+/*! @typedef JSObjectRef A JavaScript object. A JSObject is a JSValue. */
+typedef struct OpaqueJSValue* JSObjectRef;
+
+/* JavaScript symbol exports */
+/* These rules should stay the same as in WebKit2/Shared/API/c/WKBase.h */
+
+#undef JS_EXPORT
+#if defined(JS_NO_EXPORT)
+#define JS_EXPORT
+#elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
+#define JS_EXPORT __attribute__((visibility("default")))
+#elif defined(WIN32) || defined(_WIN32) || defined(_WIN32_WCE) || defined(__CC_ARM) || defined(__ARMCC__)
+#if defined(BUILDING_JavaScriptCore) || defined(STATICALLY_LINKED_WITH_JavaScriptCore)
+#define JS_EXPORT __declspec(dllexport)
+#else
+#define JS_EXPORT __declspec(dllimport)
+#endif
+#else /* !defined(JS_NO_EXPORT) */
+#define JS_EXPORT
+#endif /* defined(JS_NO_EXPORT) */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Script Evaluation */
+
+/*!
+@function JSEvaluateScript
+@abstract Evaluates a string of JavaScript.
+@param ctx The execution context to use.
+@param script A JSString containing the script to evaluate.
+@param thisObject The object to use as "this," or NULL to use the global object as "this."
+@param sourceURL A JSString containing a URL for the script's source file. This is used by debuggers and when reporting exceptions. Pass NULL if you do not care to include source file information.
+@param startingLineNumber An integer value specifying the script's starting line number in the file located at sourceURL. This is only used when reporting exceptions. The value is one-based, so the first line is line 1 and invalid values are clamped to 1.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result The JSValue that results from evaluating script, or NULL if an exception is thrown.
+*/
+JS_EXPORT JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef thisObject, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception);
+
+/*!
+@function JSCheckScriptSyntax
+@abstract Checks for syntax errors in a string of JavaScript.
+@param ctx The execution context to use.
+@param script A JSString containing the script to check for syntax errors.
+@param sourceURL A JSString containing a URL for the script's source file. This is only used when reporting exceptions. Pass NULL if you do not care to include source file information in exceptions.
+@param startingLineNumber An integer value specifying the script's starting line number in the file located at sourceURL. This is only used when reporting exceptions. The value is one-based, so the first line is line 1 and invalid values are clamped to 1.
+@param exception A pointer to a JSValueRef in which to store a syntax error exception, if any. Pass NULL if you do not care to store a syntax error exception.
+@result true if the script is syntactically correct, otherwise false.
+*/
+JS_EXPORT bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception);
+
+/*!
+@function JSGarbageCollect
+@abstract Performs a JavaScript garbage collection.
+@param ctx The execution context to use.
+@discussion JavaScript values that are on the machine stack, in a register,
+ protected by JSValueProtect, set as the global object of an execution context,
+ or reachable from any such value will not be collected.
+
+ During JavaScript execution, you are not required to call this function; the
+ JavaScript engine will garbage collect as needed. JavaScript values created
+ within a context group are automatically destroyed when the last reference
+ to the context group is released.
+*/
+JS_EXPORT void JSGarbageCollect(JSContextRef ctx);
+
+#ifdef __cplusplus
+}
+#endif
+
+/* Enable the Objective-C API for platforms with a modern runtime. */
+#if !defined(JSC_OBJC_API_ENABLED)
+#define JSC_OBJC_API_ENABLED (defined(__clang__) && defined(__APPLE__) && ((defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && !defined(__i386__)) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)))
+#endif
+
+#endif /* JSBase_h */
diff --git a/API/JSBasePrivate.h b/API/JSBasePrivate.h
new file mode 100644
index 0000000..1375949
--- /dev/null
+++ b/API/JSBasePrivate.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2008 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSBasePrivate_h
+#define JSBasePrivate_h
+
+#include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/WebKitAvailability.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+@function
+@abstract Reports an object's non-GC memory payload to the garbage collector.
+@param ctx The execution context to use.
+@param size The payload's size, in bytes.
+@discussion Use this function to notify the garbage collector that a GC object
+owns a large non-GC memory region. Calling this function will encourage the
+garbage collector to collect soon, hoping to reclaim that large non-GC memory
+region.
+*/
+JS_EXPORT void JSReportExtraMemoryCost(JSContextRef ctx, size_t size) CF_AVAILABLE(10_6, 7_0);
+
+JS_EXPORT void JSDisableGCTimer(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSBasePrivate_h */
diff --git a/API/JSCTestRunnerUtils.cpp b/API/JSCTestRunnerUtils.cpp
new file mode 100644
index 0000000..d314c5d
--- /dev/null
+++ b/API/JSCTestRunnerUtils.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCTestRunnerUtils.h"
+
+#include "APICast.h"
+#include "JSCInlines.h"
+#include "TestRunnerUtils.h"
+
+namespace JSC {
+
+
+JSValueRef failNextNewCodeBlock(JSContextRef context)
+{
+    ExecState* exec= toJS(context);
+    JSLockHolder holder(exec);
+    return toRef(exec, failNextNewCodeBlock(exec));
+}
+
+JSValueRef numberOfDFGCompiles(JSContextRef context, JSValueRef theFunctionValueRef)
+{
+    ExecState* exec= toJS(context);
+    JSLockHolder holder(exec);
+    return toRef(exec, numberOfDFGCompiles(toJS(exec, theFunctionValueRef)));
+}
+
+JSValueRef setNeverInline(JSContextRef context, JSValueRef theFunctionValueRef)
+{
+    ExecState* exec= toJS(context);
+    JSLockHolder holder(exec);
+    return toRef(exec, setNeverInline(toJS(exec, theFunctionValueRef)));
+}
+
+JSValueRef setNeverOptimize(JSContextRef context, JSValueRef theFunctionValueRef)
+{
+    ExecState* exec= toJS(context);
+    JSLockHolder holder(exec);
+    return toRef(exec, setNeverOptimize(toJS(exec, theFunctionValueRef)));
+}
+
+} // namespace JSC
+
diff --git a/API/JSCTestRunnerUtils.h b/API/JSCTestRunnerUtils.h
new file mode 100644
index 0000000..c52da52
--- /dev/null
+++ b/API/JSCTestRunnerUtils.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCTestRunnerUtils_h
+#define JSCTestRunnerUtils_h
+
+#include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+
+namespace JSC {
+
+JS_EXPORT_PRIVATE JSValueRef failNextNewCodeBlock(JSContextRef);
+JS_EXPORT_PRIVATE JSValueRef numberOfDFGCompiles(JSContextRef, JSValueRef theFunction);
+JS_EXPORT_PRIVATE JSValueRef setNeverInline(JSContextRef, JSValueRef theFunction);
+JS_EXPORT_PRIVATE JSValueRef setNeverOptimize(JSContextRef, JSValueRef theFunction);
+
+} // namespace JSC
+
+#endif // JSCTestRunnerUtils_h
diff --git a/API/JSCallbackConstructor.cpp b/API/JSCallbackConstructor.cpp
new file mode 100644
index 0000000..5597c3e
--- /dev/null
+++ b/API/JSCallbackConstructor.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCallbackConstructor.h"
+
+#include "APICallbackFunction.h"
+#include "APICast.h"
+#include "Error.h"
+#include "JSGlobalObject.h"
+#include "JSLock.h"
+#include "ObjectPrototype.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSCallbackConstructor::s_info = { "CallbackConstructor", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallbackConstructor) };
+
+JSCallbackConstructor::JSCallbackConstructor(JSGlobalObject* globalObject, Structure* structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback)
+    : JSDestructibleObject(globalObject->vm(), structure)
+    , m_class(jsClass)
+    , m_callback(callback)
+{
+}
+
+void JSCallbackConstructor::finishCreation(JSGlobalObject* globalObject, JSClassRef jsClass)
+{
+    Base::finishCreation(globalObject->vm());
+    ASSERT(inherits(info()));
+    if (m_class)
+        JSClassRetain(jsClass);
+}
+
+JSCallbackConstructor::~JSCallbackConstructor()
+{
+    if (m_class)
+        JSClassRelease(m_class);
+}
+
+void JSCallbackConstructor::destroy(JSCell* cell)
+{
+    static_cast<JSCallbackConstructor*>(cell)->JSCallbackConstructor::~JSCallbackConstructor();
+}
+
+ConstructType JSCallbackConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = APICallbackFunction::construct<JSCallbackConstructor>;
+    return ConstructType::Host;
+}
+
+} // namespace JSC
diff --git a/API/JSCallbackConstructor.h b/API/JSCallbackConstructor.h
new file mode 100644
index 0000000..d730ad7
--- /dev/null
+++ b/API/JSCallbackConstructor.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCallbackConstructor_h
+#define JSCallbackConstructor_h
+
+#include "JSObjectRef.h"
+#include "runtime/JSDestructibleObject.h"
+
+namespace JSC {
+
+class JSCallbackConstructor : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | ImplementsHasInstance | ImplementsDefaultHasInstance;
+
+    static JSCallbackConstructor* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, JSClassRef classRef, JSObjectCallAsConstructorCallback callback) 
+    {
+        JSCallbackConstructor* constructor = new (NotNull, allocateCell<JSCallbackConstructor>(*exec->heap())) JSCallbackConstructor(globalObject, structure, classRef, callback);
+        constructor->finishCreation(globalObject, classRef);
+        return constructor;
+    }
+    
+    ~JSCallbackConstructor();
+    static void destroy(JSCell*);
+    JSClassRef classRef() const { return m_class; }
+    JSObjectCallAsConstructorCallback callback() const { return m_callback; }
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) 
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    JSCallbackConstructor(JSGlobalObject*, Structure*, JSClassRef, JSObjectCallAsConstructorCallback);
+    void finishCreation(JSGlobalObject*, JSClassRef);
+
+private:
+    friend struct APICallbackFunction;
+
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+
+    JSObjectCallAsConstructorCallback constructCallback() { return m_callback; }
+
+    JSClassRef m_class;
+    JSObjectCallAsConstructorCallback m_callback;
+};
+
+} // namespace JSC
+
+#endif // JSCallbackConstructor_h
diff --git a/API/JSCallbackFunction.cpp b/API/JSCallbackFunction.cpp
new file mode 100644
index 0000000..57333f5
--- /dev/null
+++ b/API/JSCallbackFunction.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2006, 2008, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCallbackFunction.h"
+
+#include "APICallbackFunction.h"
+#include "APICast.h"
+#include "CodeBlock.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "FunctionPrototype.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSLock.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSCallbackFunction);
+
+const ClassInfo JSCallbackFunction::s_info = { "CallbackFunction", &InternalFunction::s_info, 0, CREATE_METHOD_TABLE(JSCallbackFunction) };
+
+JSCallbackFunction::JSCallbackFunction(VM& vm, Structure* structure, JSObjectCallAsFunctionCallback callback)
+    : InternalFunction(vm, structure)
+    , m_callback(callback)
+{
+}
+
+void JSCallbackFunction::finishCreation(VM& vm, const String& name)
+{
+    Base::finishCreation(vm, name);
+    ASSERT(inherits(info()));
+}
+
+JSCallbackFunction* JSCallbackFunction::create(VM& vm, JSGlobalObject* globalObject, JSObjectCallAsFunctionCallback callback, const String& name)
+{
+    Structure* structure = globalObject->callbackFunctionStructure();
+    JSCallbackFunction* function = new (NotNull, allocateCell<JSCallbackFunction>(vm.heap)) JSCallbackFunction(vm, structure, callback);
+    function->finishCreation(vm, name);
+    return function;
+}
+
+CallType JSCallbackFunction::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = APICallbackFunction::call<JSCallbackFunction>;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/API/JSCallbackFunction.h b/API/JSCallbackFunction.h
new file mode 100644
index 0000000..a4fdd06
--- /dev/null
+++ b/API/JSCallbackFunction.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCallbackFunction_h
+#define JSCallbackFunction_h
+
+#include "InternalFunction.h"
+#include "JSObjectRef.h"
+
+namespace JSC {
+
+class JSCallbackFunction : public InternalFunction {
+    friend struct APICallbackFunction;
+public:
+    typedef InternalFunction Base;
+
+    static JSCallbackFunction* create(VM&, JSGlobalObject*, JSObjectCallAsFunctionCallback, const String& name);
+
+    DECLARE_INFO;
+    
+    // InternalFunction mish-mashes constructor and function behavior -- we should 
+    // refactor the code so this override isn't necessary
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) 
+    { 
+        return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+private:
+    JSCallbackFunction(VM&, Structure*, JSObjectCallAsFunctionCallback);
+    void finishCreation(VM&, const String& name);
+
+    static CallType getCallData(JSCell*, CallData&);
+
+    JSObjectCallAsFunctionCallback functionCallback() { return m_callback; }
+
+    JSObjectCallAsFunctionCallback m_callback;
+};
+
+} // namespace JSC
+
+#endif // JSCallbackFunction_h
diff --git a/API/JSCallbackObject.cpp b/API/JSCallbackObject.cpp
new file mode 100644
index 0000000..02b38fd
--- /dev/null
+++ b/API/JSCallbackObject.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCallbackObject.h"
+
+#include "Heap.h"
+#include "JSCInlines.h"
+#include <wtf/text/StringHash.h>
+
+namespace JSC {
+
+// Define the two types of JSCallbackObjects we support.
+template <> const ClassInfo JSCallbackObject<JSDestructibleObject>::s_info = { "CallbackObject", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallbackObject) };
+template <> const ClassInfo JSCallbackObject<JSGlobalObject>::s_info = { "CallbackGlobalObject", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallbackObject) };
+
+template<> const bool JSCallbackObject<JSDestructibleObject>::needsDestruction = true;
+template<> const bool JSCallbackObject<JSGlobalObject>::needsDestruction = false;
+
+template<>
+JSCallbackObject<JSGlobalObject>* JSCallbackObject<JSGlobalObject>::create(VM& vm, JSClassRef classRef, Structure* structure)
+{
+    JSCallbackObject<JSGlobalObject>* callbackObject = new (NotNull, allocateCell<JSCallbackObject<JSGlobalObject>>(vm.heap)) JSCallbackObject(vm, classRef, structure);
+    callbackObject->finishCreation(vm);
+    vm.heap.addFinalizer(callbackObject, destroy);
+    return callbackObject;
+}
+
+template <>
+Structure* JSCallbackObject<JSDestructibleObject>::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+{ 
+    return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), info()); 
+}
+    
+template <>
+Structure* JSCallbackObject<JSGlobalObject>::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+{ 
+    return Structure::create(vm, globalObject, proto, TypeInfo(GlobalObjectType, StructureFlags), info()); 
+}
+
+} // namespace JSC
diff --git a/API/JSCallbackObject.h b/API/JSCallbackObject.h
new file mode 100644
index 0000000..2525982
--- /dev/null
+++ b/API/JSCallbackObject.h
@@ -0,0 +1,243 @@
+/*
+ * Copyright (C) 2006-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCallbackObject_h
+#define JSCallbackObject_h
+
+#include "JSObjectRef.h"
+#include "JSValueRef.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+struct JSCallbackObjectData {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JSCallbackObjectData(void* privateData, JSClassRef jsClass)
+        : privateData(privateData)
+        , jsClass(jsClass)
+    {
+        JSClassRetain(jsClass);
+    }
+    
+    ~JSCallbackObjectData()
+    {
+        JSClassRelease(jsClass);
+    }
+    
+    JSValue getPrivateProperty(const Identifier& propertyName) const
+    {
+        if (!m_privateProperties)
+            return JSValue();
+        return m_privateProperties->getPrivateProperty(propertyName);
+    }
+    
+    void setPrivateProperty(VM& vm, JSCell* owner, const Identifier& propertyName, JSValue value)
+    {
+        if (!m_privateProperties)
+            m_privateProperties = std::make_unique<JSPrivatePropertyMap>();
+        m_privateProperties->setPrivateProperty(vm, owner, propertyName, value);
+    }
+    
+    void deletePrivateProperty(const Identifier& propertyName)
+    {
+        if (!m_privateProperties)
+            return;
+        m_privateProperties->deletePrivateProperty(propertyName);
+    }
+
+    void visitChildren(SlotVisitor& visitor)
+    {
+        JSPrivatePropertyMap* properties = m_privateProperties.get();
+        if (!properties)
+            return;
+        properties->visitChildren(visitor);
+    }
+
+    void* privateData;
+    JSClassRef jsClass;
+    struct JSPrivatePropertyMap {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        JSValue getPrivateProperty(const Identifier& propertyName) const
+        {
+            PrivatePropertyMap::const_iterator location = m_propertyMap.find(propertyName.impl());
+            if (location == m_propertyMap.end())
+                return JSValue();
+            return location->value.get();
+        }
+        
+        void setPrivateProperty(VM& vm, JSCell* owner, const Identifier& propertyName, JSValue value)
+        {
+            LockHolder locker(m_lock);
+            WriteBarrier<Unknown> empty;
+            m_propertyMap.add(propertyName.impl(), empty).iterator->value.set(vm, owner, value);
+        }
+        
+        void deletePrivateProperty(const Identifier& propertyName)
+        {
+            LockHolder locker(m_lock);
+            m_propertyMap.remove(propertyName.impl());
+        }
+
+        void visitChildren(SlotVisitor& visitor)
+        {
+            LockHolder locker(m_lock);
+            for (PrivatePropertyMap::iterator ptr = m_propertyMap.begin(); ptr != m_propertyMap.end(); ++ptr) {
+                if (ptr->value)
+                    visitor.append(ptr->value);
+            }
+        }
+
+    private:
+        typedef HashMap<RefPtr<UniquedStringImpl>, WriteBarrier<Unknown>, IdentifierRepHash> PrivatePropertyMap;
+        PrivatePropertyMap m_propertyMap;
+        Lock m_lock;
+    };
+    std::unique_ptr<JSPrivatePropertyMap> m_privateProperties;
+};
+
+    
+template <class Parent>
+class JSCallbackObject : public Parent {
+protected:
+    JSCallbackObject(ExecState*, Structure*, JSClassRef, void* data);
+    JSCallbackObject(VM&, JSClassRef, Structure*);
+
+    void finishCreation(ExecState*);
+    void finishCreation(VM&);
+
+public:
+    typedef Parent Base;
+    static const unsigned StructureFlags = Base::StructureFlags | ProhibitsPropertyCaching | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | ImplementsHasInstance | OverridesGetPropertyNames | TypeOfShouldCallGetCallData;
+
+    ~JSCallbackObject();
+
+    static JSCallbackObject* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, JSClassRef classRef, void* data)
+    {
+        ASSERT_UNUSED(globalObject, !structure->globalObject() || structure->globalObject() == globalObject);
+        JSCallbackObject* callbackObject = new (NotNull, allocateCell<JSCallbackObject>(*exec->heap())) JSCallbackObject(exec, structure, classRef, data);
+        callbackObject->finishCreation(exec);
+        return callbackObject;
+    }
+    static JSCallbackObject<Parent>* create(VM&, JSClassRef, Structure*);
+
+    static const bool needsDestruction;
+    static void destroy(JSCell* cell)
+    {
+        static_cast<JSCallbackObject*>(cell)->JSCallbackObject::~JSCallbackObject();
+    }
+
+    void setPrivate(void* data);
+    void* getPrivate();
+
+    // FIXME: We should fix the warnings for extern-template in JSObject template classes: https://bugs.webkit.org/show_bug.cgi?id=161979
+#if COMPILER(CLANG)
+#if __has_warning("-Wundefined-var-template")
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wundefined-var-template"
+#endif
+#endif
+    DECLARE_INFO;
+#if COMPILER(CLANG)
+#if __has_warning("-Wundefined-var-template")
+#pragma clang diagnostic pop
+#endif
+#endif
+
+    JSClassRef classRef() const { return m_callbackObjectData->jsClass; }
+    bool inherits(JSClassRef) const;
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+    
+    JSValue getPrivateProperty(const Identifier& propertyName) const
+    {
+        return m_callbackObjectData->getPrivateProperty(propertyName);
+    }
+    
+    void setPrivateProperty(VM& vm, const Identifier& propertyName, JSValue value)
+    {
+        m_callbackObjectData->setPrivateProperty(vm, this, propertyName, value);
+    }
+    
+    void deletePrivateProperty(const Identifier& propertyName)
+    {
+        m_callbackObjectData->deletePrivateProperty(propertyName);
+    }
+
+    using Parent::methodTable;
+
+private:
+    static String className(const JSObject*);
+
+    static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
+    
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool putByIndex(JSCell*, ExecState*, unsigned, JSValue, bool shouldThrow);
+
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned);
+
+    static bool customHasInstance(JSObject*, ExecState*, JSValue);
+
+    static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+
+    static void visitChildren(JSCell* cell, SlotVisitor& visitor)
+    {
+        JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(cell);
+        ASSERT_GC_OBJECT_INHERITS((static_cast<Parent*>(thisObject)), JSCallbackObject<Parent>::info());
+        Parent::visitChildren(thisObject, visitor);
+        thisObject->m_callbackObjectData->visitChildren(visitor);
+    }
+
+    void init(ExecState*);
+ 
+    static JSCallbackObject* asCallbackObject(JSValue);
+    static JSCallbackObject* asCallbackObject(EncodedJSValue);
+ 
+    static EncodedJSValue JSC_HOST_CALL call(ExecState*);
+    static EncodedJSValue JSC_HOST_CALL construct(ExecState*);
+   
+    JSValue getStaticValue(ExecState*, PropertyName);
+    static EncodedJSValue staticFunctionGetter(ExecState*, EncodedJSValue, PropertyName);
+    static EncodedJSValue callbackGetter(ExecState*, EncodedJSValue, PropertyName);
+
+    std::unique_ptr<JSCallbackObjectData> m_callbackObjectData;
+    const ClassInfo* m_classInfo;
+};
+
+} // namespace JSC
+
+// include the actual template class implementation
+#include "JSCallbackObjectFunctions.h"
+
+#endif // JSCallbackObject_h
diff --git a/API/JSCallbackObjectFunctions.h b/API/JSCallbackObjectFunctions.h
new file mode 100644
index 0000000..a525f5b
--- /dev/null
+++ b/API/JSCallbackObjectFunctions.h
@@ -0,0 +1,701 @@
+/*
+ * Copyright (C) 2006, 2008, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "APICast.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSCallbackFunction.h"
+#include "JSClassRef.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSLock.h"
+#include "JSObjectRef.h"
+#include "JSString.h"
+#include "JSStringRef.h"
+#include "OpaqueJSString.h"
+#include "PropertyNameArray.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+template <class Parent>
+inline JSCallbackObject<Parent>* JSCallbackObject<Parent>::asCallbackObject(JSValue value)
+{
+    ASSERT(asObject(value)->inherits(info()));
+    return jsCast<JSCallbackObject*>(asObject(value));
+}
+
+template <class Parent>
+inline JSCallbackObject<Parent>* JSCallbackObject<Parent>::asCallbackObject(EncodedJSValue value)
+{
+    ASSERT(asObject(JSValue::decode(value))->inherits(info()));
+    return jsCast<JSCallbackObject*>(asObject(JSValue::decode(value)));
+}
+
+template <class Parent>
+JSCallbackObject<Parent>::JSCallbackObject(ExecState* exec, Structure* structure, JSClassRef jsClass, void* data)
+    : Parent(exec->vm(), structure)
+    , m_callbackObjectData(std::make_unique<JSCallbackObjectData>(data, jsClass))
+{
+}
+
+// Global object constructor.
+// FIXME: Move this into a separate JSGlobalCallbackObject class derived from this one.
+template <class Parent>
+JSCallbackObject<Parent>::JSCallbackObject(VM& vm, JSClassRef jsClass, Structure* structure)
+    : Parent(vm, structure)
+    , m_callbackObjectData(std::make_unique<JSCallbackObjectData>(nullptr, jsClass))
+{
+}
+
+template <class Parent>
+JSCallbackObject<Parent>::~JSCallbackObject()
+{
+    VM* vm = this->HeapCell::vm();
+    vm->currentlyDestructingCallbackObject = this;
+    ASSERT(m_classInfo);
+    vm->currentlyDestructingCallbackObjectClassInfo = m_classInfo;
+    JSObjectRef thisRef = toRef(static_cast<JSObject*>(this));
+    for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (JSObjectFinalizeCallback finalize = jsClass->finalize)
+            finalize(thisRef);
+    }
+    vm->currentlyDestructingCallbackObject = nullptr;
+    vm->currentlyDestructingCallbackObjectClassInfo = nullptr;
+}
+    
+template <class Parent>
+void JSCallbackObject<Parent>::finishCreation(ExecState* exec)
+{
+    Base::finishCreation(exec->vm());
+    ASSERT(Parent::inherits(info()));
+    init(exec);
+}
+
+// This is just for Global object, so we can assume that Base::finishCreation is JSGlobalObject::finishCreation.
+template <class Parent>
+void JSCallbackObject<Parent>::finishCreation(VM& vm)
+{
+    ASSERT(Parent::inherits(info()));
+    ASSERT(Parent::isGlobalObject());
+    Base::finishCreation(vm);
+    init(jsCast<JSGlobalObject*>(this)->globalExec());
+}
+
+template <class Parent>
+void JSCallbackObject<Parent>::init(ExecState* exec)
+{
+    ASSERT(exec);
+    
+    Vector<JSObjectInitializeCallback, 16> initRoutines;
+    JSClassRef jsClass = classRef();
+    do {
+        if (JSObjectInitializeCallback initialize = jsClass->initialize)
+            initRoutines.append(initialize);
+    } while ((jsClass = jsClass->parentClass));
+    
+    // initialize from base to derived
+    for (int i = static_cast<int>(initRoutines.size()) - 1; i >= 0; i--) {
+        JSLock::DropAllLocks dropAllLocks(exec);
+        JSObjectInitializeCallback initialize = initRoutines[i];
+        initialize(toRef(exec), toRef(this));
+    }
+    
+    m_classInfo = this->classInfo();
+}
+
+template <class Parent>
+String JSCallbackObject<Parent>::className(const JSObject* object)
+{
+    const JSCallbackObject* thisObject = jsCast<const JSCallbackObject*>(object);
+    String thisClassName = thisObject->classRef()->className();
+    if (!thisClassName.isEmpty())
+        return thisClassName;
+    
+    return Parent::className(object);
+}
+
+template <class Parent>
+bool JSCallbackObject<Parent>::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(object);
+    JSContextRef ctx = toRef(exec);
+    JSObjectRef thisRef = toRef(thisObject);
+    RefPtr<OpaqueJSString> propertyNameRef;
+    
+    if (StringImpl* name = propertyName.uid()) {
+        for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+            // optional optimization to bypass getProperty in cases when we only need to know if the property exists
+            if (JSObjectHasPropertyCallback hasProperty = jsClass->hasProperty) {
+                if (!propertyNameRef)
+                    propertyNameRef = OpaqueJSString::create(name);
+                JSLock::DropAllLocks dropAllLocks(exec);
+                if (hasProperty(ctx, thisRef, propertyNameRef.get())) {
+                    slot.setCustom(thisObject, ReadOnly | DontEnum, callbackGetter);
+                    return true;
+                }
+            } else if (JSObjectGetPropertyCallback getProperty = jsClass->getProperty) {
+                if (!propertyNameRef)
+                    propertyNameRef = OpaqueJSString::create(name);
+                JSValueRef exception = 0;
+                JSValueRef value;
+                {
+                    JSLock::DropAllLocks dropAllLocks(exec);
+                    value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
+                }
+                if (exception) {
+                    throwException(exec, scope, toJS(exec, exception));
+                    slot.setValue(thisObject, ReadOnly | DontEnum, jsUndefined());
+                    return true;
+                }
+                if (value) {
+                    slot.setValue(thisObject, ReadOnly | DontEnum, toJS(exec, value));
+                    return true;
+                }
+            }
+            
+            if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
+                if (staticValues->contains(name)) {
+                    JSValue value = thisObject->getStaticValue(exec, propertyName);
+                    if (value) {
+                        slot.setValue(thisObject, ReadOnly | DontEnum, value);
+                        return true;
+                    }
+                }
+            }
+            
+            if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass->staticFunctions(exec)) {
+                if (staticFunctions->contains(name)) {
+                    slot.setCustom(thisObject, ReadOnly | DontEnum, staticFunctionGetter);
+                    return true;
+                }
+            }
+        }
+    }
+
+    return Parent::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+}
+
+template <class Parent>
+bool JSCallbackObject<Parent>::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    return object->methodTable()->getOwnPropertySlot(object, exec, Identifier::from(exec, propertyName), slot);
+}
+
+template <class Parent>
+JSValue JSCallbackObject<Parent>::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType hint)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    const JSCallbackObject* thisObject = jsCast<const JSCallbackObject*>(object);
+    JSContextRef ctx = toRef(exec);
+    JSObjectRef thisRef = toRef(thisObject);
+    ::JSType jsHint = hint == PreferString ? kJSTypeString : kJSTypeNumber;
+
+    for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (JSObjectConvertToTypeCallback convertToType = jsClass->convertToType) {
+            JSValueRef exception = 0;
+            JSValueRef result = convertToType(ctx, thisRef, jsHint, &exception);
+            if (exception) {
+                throwException(exec, scope, toJS(exec, exception));
+                return jsUndefined();
+            }
+            if (result)
+                return toJS(exec, result);
+        }
+    }
+    
+    return Parent::defaultValue(object, exec, hint);
+}
+
+template <class Parent>
+bool JSCallbackObject<Parent>::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(cell);
+    JSContextRef ctx = toRef(exec);
+    JSObjectRef thisRef = toRef(thisObject);
+    RefPtr<OpaqueJSString> propertyNameRef;
+    JSValueRef valueRef = toRef(exec, value);
+    
+    if (StringImpl* name = propertyName.uid()) {
+        for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+            if (JSObjectSetPropertyCallback setProperty = jsClass->setProperty) {
+                if (!propertyNameRef)
+                    propertyNameRef = OpaqueJSString::create(name);
+                JSValueRef exception = 0;
+                bool result;
+                {
+                    JSLock::DropAllLocks dropAllLocks(exec);
+                    result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
+                }
+                if (exception)
+                    throwException(exec, scope, toJS(exec, exception));
+                if (result || exception)
+                    return result;
+            }
+            
+            if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
+                if (StaticValueEntry* entry = staticValues->get(name)) {
+                    if (entry->attributes & kJSPropertyAttributeReadOnly)
+                        return false;
+                    if (JSObjectSetPropertyCallback setProperty = entry->setProperty) {
+                        JSValueRef exception = 0;
+                        bool result;
+                        {
+                            JSLock::DropAllLocks dropAllLocks(exec);
+                            result = setProperty(ctx, thisRef, entry->propertyNameRef.get(), valueRef, &exception);
+                        }
+                        if (exception)
+                            throwException(exec, scope, toJS(exec, exception));
+                        if (result || exception)
+                            return result;
+                    }
+                }
+            }
+            
+            if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass->staticFunctions(exec)) {
+                if (StaticFunctionEntry* entry = staticFunctions->get(name)) {
+                    PropertySlot getSlot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+                    if (Parent::getOwnPropertySlot(thisObject, exec, propertyName, getSlot))
+                        return Parent::put(thisObject, exec, propertyName, value, slot);
+                    if (entry->attributes & kJSPropertyAttributeReadOnly)
+                        return false;
+                    return thisObject->JSCallbackObject<Parent>::putDirect(vm, propertyName, value); // put as override property
+                }
+            }
+        }
+    }
+
+    return Parent::put(thisObject, exec, propertyName, value, slot);
+}
+
+template <class Parent>
+bool JSCallbackObject<Parent>::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyIndex, JSValue value, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(cell);
+    JSContextRef ctx = toRef(exec);
+    JSObjectRef thisRef = toRef(thisObject);
+    RefPtr<OpaqueJSString> propertyNameRef;
+    JSValueRef valueRef = toRef(exec, value);
+    Identifier propertyName = Identifier::from(exec, propertyIndex);
+
+    for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (JSObjectSetPropertyCallback setProperty = jsClass->setProperty) {
+            if (!propertyNameRef)
+                propertyNameRef = OpaqueJSString::create(propertyName.impl());
+            JSValueRef exception = 0;
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
+            }
+            if (exception)
+                throwException(exec, scope, toJS(exec, exception));
+            if (result || exception)
+                return result;
+        }
+
+        if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
+            if (StaticValueEntry* entry = staticValues->get(propertyName.impl())) {
+                if (entry->attributes & kJSPropertyAttributeReadOnly)
+                    return false;
+                if (JSObjectSetPropertyCallback setProperty = entry->setProperty) {
+                    JSValueRef exception = 0;
+                    bool result;
+                    {
+                        JSLock::DropAllLocks dropAllLocks(exec);
+                        result = setProperty(ctx, thisRef, entry->propertyNameRef.get(), valueRef, &exception);
+                    }
+                    if (exception)
+                        throwException(exec, scope, toJS(exec, exception));
+                    if (result || exception)
+                        return result;
+                }
+            }
+        }
+
+        if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass->staticFunctions(exec)) {
+            if (StaticFunctionEntry* entry = staticFunctions->get(propertyName.impl())) {
+                if (entry->attributes & kJSPropertyAttributeReadOnly)
+                    return false;
+                break;
+            }
+        }
+    }
+
+    return Parent::putByIndex(thisObject, exec, propertyIndex, value, shouldThrow);
+}
+
+template <class Parent>
+bool JSCallbackObject<Parent>::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(cell);
+    JSContextRef ctx = toRef(exec);
+    JSObjectRef thisRef = toRef(thisObject);
+    RefPtr<OpaqueJSString> propertyNameRef;
+    
+    if (StringImpl* name = propertyName.uid()) {
+        for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+            if (JSObjectDeletePropertyCallback deleteProperty = jsClass->deleteProperty) {
+                if (!propertyNameRef)
+                    propertyNameRef = OpaqueJSString::create(name);
+                JSValueRef exception = 0;
+                bool result;
+                {
+                    JSLock::DropAllLocks dropAllLocks(exec);
+                    result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
+                }
+                if (exception)
+                    throwException(exec, scope, toJS(exec, exception));
+                if (result || exception)
+                    return true;
+            }
+            
+            if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
+                if (StaticValueEntry* entry = staticValues->get(name)) {
+                    if (entry->attributes & kJSPropertyAttributeDontDelete)
+                        return false;
+                    return true;
+                }
+            }
+            
+            if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass->staticFunctions(exec)) {
+                if (StaticFunctionEntry* entry = staticFunctions->get(name)) {
+                    if (entry->attributes & kJSPropertyAttributeDontDelete)
+                        return false;
+                    return true;
+                }
+            }
+        }
+    }
+
+    return Parent::deleteProperty(thisObject, exec, propertyName);
+}
+
+template <class Parent>
+bool JSCallbackObject<Parent>::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned propertyName)
+{
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(cell);
+    return thisObject->methodTable()->deleteProperty(thisObject, exec, Identifier::from(exec, propertyName));
+}
+
+template <class Parent>
+ConstructType JSCallbackObject<Parent>::getConstructData(JSCell* cell, ConstructData& constructData)
+{
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(cell);
+    for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (jsClass->callAsConstructor) {
+            constructData.native.function = construct;
+            return ConstructType::Host;
+        }
+    }
+    return ConstructType::None;
+}
+
+template <class Parent>
+EncodedJSValue JSCallbackObject<Parent>::construct(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* constructor = exec->jsCallee();
+    JSContextRef execRef = toRef(exec);
+    JSObjectRef constructorRef = toRef(constructor);
+    
+    for (JSClassRef jsClass = jsCast<JSCallbackObject<Parent>*>(constructor)->classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (JSObjectCallAsConstructorCallback callAsConstructor = jsClass->callAsConstructor) {
+            size_t argumentCount = exec->argumentCount();
+            Vector<JSValueRef, 16> arguments;
+            arguments.reserveInitialCapacity(argumentCount);
+            for (size_t i = 0; i < argumentCount; ++i)
+                arguments.uncheckedAppend(toRef(exec, exec->uncheckedArgument(i)));
+            JSValueRef exception = 0;
+            JSObject* result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
+            }
+            if (exception)
+                throwException(exec, scope, toJS(exec, exception));
+            return JSValue::encode(result);
+        }
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED(); // getConstructData should prevent us from reaching here
+    return JSValue::encode(JSValue());
+}
+
+template <class Parent>
+bool JSCallbackObject<Parent>::customHasInstance(JSObject* object, ExecState* exec, JSValue value)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(object);
+    JSContextRef execRef = toRef(exec);
+    JSObjectRef thisRef = toRef(thisObject);
+    
+    for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (JSObjectHasInstanceCallback hasInstance = jsClass->hasInstance) {
+            JSValueRef valueRef = toRef(exec, value);
+            JSValueRef exception = 0;
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = hasInstance(execRef, thisRef, valueRef, &exception);
+            }
+            if (exception)
+                throwException(exec, scope, toJS(exec, exception));
+            return result;
+        }
+    }
+    return false;
+}
+
+template <class Parent>
+CallType JSCallbackObject<Parent>::getCallData(JSCell* cell, CallData& callData)
+{
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(cell);
+    for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (jsClass->callAsFunction) {
+            callData.native.function = call;
+            return CallType::Host;
+        }
+    }
+    return CallType::None;
+}
+
+template <class Parent>
+EncodedJSValue JSCallbackObject<Parent>::call(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSContextRef execRef = toRef(exec);
+    JSObjectRef functionRef = toRef(exec->jsCallee());
+    JSObjectRef thisObjRef = toRef(jsCast<JSObject*>(exec->thisValue().toThis(exec, NotStrictMode)));
+    
+    for (JSClassRef jsClass = jsCast<JSCallbackObject<Parent>*>(toJS(functionRef))->classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (JSObjectCallAsFunctionCallback callAsFunction = jsClass->callAsFunction) {
+            size_t argumentCount = exec->argumentCount();
+            Vector<JSValueRef, 16> arguments;
+            arguments.reserveInitialCapacity(argumentCount);
+            for (size_t i = 0; i < argumentCount; ++i)
+                arguments.uncheckedAppend(toRef(exec, exec->uncheckedArgument(i)));
+            JSValueRef exception = 0;
+            JSValue result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
+            }
+            if (exception)
+                throwException(exec, scope, toJS(exec, exception));
+            return JSValue::encode(result);
+        }
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED(); // getCallData should prevent us from reaching here
+    return JSValue::encode(JSValue());
+}
+
+template <class Parent>
+void JSCallbackObject<Parent>::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    JSCallbackObject* thisObject = jsCast<JSCallbackObject*>(object);
+    JSContextRef execRef = toRef(exec);
+    JSObjectRef thisRef = toRef(thisObject);
+    
+    for (JSClassRef jsClass = thisObject->classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (JSObjectGetPropertyNamesCallback getPropertyNames = jsClass->getPropertyNames) {
+            JSLock::DropAllLocks dropAllLocks(exec);
+            getPropertyNames(execRef, thisRef, toRef(&propertyNames));
+        }
+        
+        if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
+            typedef OpaqueJSClassStaticValuesTable::const_iterator iterator;
+            iterator end = staticValues->end();
+            for (iterator it = staticValues->begin(); it != end; ++it) {
+                StringImpl* name = it->key.get();
+                StaticValueEntry* entry = it->value.get();
+                if (entry->getProperty && (!(entry->attributes & kJSPropertyAttributeDontEnum) || mode.includeDontEnumProperties())) {
+                    ASSERT(!name->isSymbol());
+                    propertyNames.add(Identifier::fromString(exec, String(name)));
+                }
+            }
+        }
+        
+        if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass->staticFunctions(exec)) {
+            typedef OpaqueJSClassStaticFunctionsTable::const_iterator iterator;
+            iterator end = staticFunctions->end();
+            for (iterator it = staticFunctions->begin(); it != end; ++it) {
+                StringImpl* name = it->key.get();
+                StaticFunctionEntry* entry = it->value.get();
+                if (!(entry->attributes & kJSPropertyAttributeDontEnum) || mode.includeDontEnumProperties()) {
+                    ASSERT(!name->isSymbol());
+                    propertyNames.add(Identifier::fromString(exec, String(name)));
+                }
+            }
+        }
+    }
+    
+    Parent::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);
+}
+
+template <class Parent>
+void JSCallbackObject<Parent>::setPrivate(void* data)
+{
+    m_callbackObjectData->privateData = data;
+}
+
+template <class Parent>
+void* JSCallbackObject<Parent>::getPrivate()
+{
+    return m_callbackObjectData->privateData;
+}
+
+template <class Parent>
+bool JSCallbackObject<Parent>::inherits(JSClassRef c) const
+{
+    for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
+        if (jsClass == c)
+            return true;
+    }
+    return false;
+}
+
+template <class Parent>
+JSValue JSCallbackObject<Parent>::getStaticValue(ExecState* exec, PropertyName propertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObjectRef thisRef = toRef(this);
+    
+    if (StringImpl* name = propertyName.uid()) {
+        for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
+            if (OpaqueJSClassStaticValuesTable* staticValues = jsClass->staticValues(exec)) {
+                if (StaticValueEntry* entry = staticValues->get(name)) {
+                    if (JSObjectGetPropertyCallback getProperty = entry->getProperty) {
+                        JSValueRef exception = 0;
+                        JSValueRef value;
+                        {
+                            JSLock::DropAllLocks dropAllLocks(exec);
+                            value = getProperty(toRef(exec), thisRef, entry->propertyNameRef.get(), &exception);
+                        }
+                        if (exception) {
+                            throwException(exec, scope, toJS(exec, exception));
+                            return jsUndefined();
+                        }
+                        if (value)
+                            return toJS(exec, value);
+                    }
+                }
+            }
+        }
+    }
+
+    return JSValue();
+}
+
+template <class Parent>
+EncodedJSValue JSCallbackObject<Parent>::staticFunctionGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSCallbackObject* thisObj = asCallbackObject(thisValue);
+    
+    // Check for cached or override property.
+    PropertySlot slot2(thisObj, PropertySlot::InternalMethodType::VMInquiry);
+    if (Parent::getOwnPropertySlot(thisObj, exec, propertyName, slot2))
+        return JSValue::encode(slot2.getValue(exec, propertyName));
+
+    if (StringImpl* name = propertyName.uid()) {
+        for (JSClassRef jsClass = thisObj->classRef(); jsClass; jsClass = jsClass->parentClass) {
+            if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass->staticFunctions(exec)) {
+                if (StaticFunctionEntry* entry = staticFunctions->get(name)) {
+                    if (JSObjectCallAsFunctionCallback callAsFunction = entry->callAsFunction) {
+                        JSObject* o = JSCallbackFunction::create(vm, thisObj->globalObject(), callAsFunction, name);
+                        thisObj->putDirect(vm, propertyName, o, entry->attributes);
+                        return JSValue::encode(o);
+                    }
+                }
+            }
+        }
+    }
+
+    return JSValue::encode(throwException(exec, scope, createReferenceError(exec, ASCIILiteral("Static function property defined with NULL callAsFunction callback."))));
+}
+
+template <class Parent>
+EncodedJSValue JSCallbackObject<Parent>::callbackGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSCallbackObject* thisObj = asCallbackObject(thisValue);
+    
+    JSObjectRef thisRef = toRef(thisObj);
+    RefPtr<OpaqueJSString> propertyNameRef;
+    
+    if (StringImpl* name = propertyName.uid()) {
+        for (JSClassRef jsClass = thisObj->classRef(); jsClass; jsClass = jsClass->parentClass) {
+            if (JSObjectGetPropertyCallback getProperty = jsClass->getProperty) {
+                if (!propertyNameRef)
+                    propertyNameRef = OpaqueJSString::create(name);
+                JSValueRef exception = 0;
+                JSValueRef value;
+                {
+                    JSLock::DropAllLocks dropAllLocks(exec);
+                    value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
+                }
+                if (exception) {
+                    throwException(exec, scope, toJS(exec, exception));
+                    return JSValue::encode(jsUndefined());
+                }
+                if (value)
+                    return JSValue::encode(toJS(exec, value));
+            }
+        }
+    }
+
+    return JSValue::encode(throwException(exec, scope, createReferenceError(exec, ASCIILiteral("hasProperty callback returned true for a property that doesn't exist."))));
+}
+
+} // namespace JSC
diff --git a/API/JSClassRef.cpp b/API/JSClassRef.cpp
new file mode 100644
index 0000000..eb525f1
--- /dev/null
+++ b/API/JSClassRef.cpp
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSClassRef.h"
+
+#include "APICast.h"
+#include "Identifier.h"
+#include "InitializeThreading.h"
+#include "JSCallbackObject.h"
+#include "JSGlobalObject.h"
+#include "JSObjectRef.h"
+#include "ObjectPrototype.h"
+#include "JSCInlines.h"
+#include <wtf/text/StringHash.h>
+#include <wtf/unicode/UTF8.h>
+
+using namespace std;
+using namespace JSC;
+using namespace WTF::Unicode;
+
+const JSClassDefinition kJSClassDefinitionEmpty = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
+
+OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass* protoClass) 
+    : parentClass(definition->parentClass)
+    , prototypeClass(0)
+    , initialize(definition->initialize)
+    , finalize(definition->finalize)
+    , hasProperty(definition->hasProperty)
+    , getProperty(definition->getProperty)
+    , setProperty(definition->setProperty)
+    , deleteProperty(definition->deleteProperty)
+    , getPropertyNames(definition->getPropertyNames)
+    , callAsFunction(definition->callAsFunction)
+    , callAsConstructor(definition->callAsConstructor)
+    , hasInstance(definition->hasInstance)
+    , convertToType(definition->convertToType)
+    , m_className(String::fromUTF8(definition->className))
+{
+    initializeThreading();
+
+    if (const JSStaticValue* staticValue = definition->staticValues) {
+        m_staticValues = std::make_unique<OpaqueJSClassStaticValuesTable>();
+        while (staticValue->name) {
+            String valueName = String::fromUTF8(staticValue->name);
+            if (!valueName.isNull())
+                m_staticValues->set(valueName.impl(), std::make_unique<StaticValueEntry>(staticValue->getProperty, staticValue->setProperty, staticValue->attributes, valueName));
+            ++staticValue;
+        }
+    }
+
+    if (const JSStaticFunction* staticFunction = definition->staticFunctions) {
+        m_staticFunctions = std::make_unique<OpaqueJSClassStaticFunctionsTable>();
+        while (staticFunction->name) {
+            String functionName = String::fromUTF8(staticFunction->name);
+            if (!functionName.isNull())
+                m_staticFunctions->set(functionName.impl(), std::make_unique<StaticFunctionEntry>(staticFunction->callAsFunction, staticFunction->attributes));
+            ++staticFunction;
+        }
+    }
+        
+    if (protoClass)
+        prototypeClass = JSClassRetain(protoClass);
+}
+
+OpaqueJSClass::~OpaqueJSClass()
+{
+    // The empty string is shared across threads & is an identifier, in all other cases we should have done a deep copy in className(), below. 
+    ASSERT(!m_className.length() || !m_className.impl()->isAtomic());
+
+#ifndef NDEBUG
+    if (m_staticValues) {
+        OpaqueJSClassStaticValuesTable::const_iterator end = m_staticValues->end();
+        for (OpaqueJSClassStaticValuesTable::const_iterator it = m_staticValues->begin(); it != end; ++it)
+            ASSERT(!it->key->isAtomic());
+    }
+
+    if (m_staticFunctions) {
+        OpaqueJSClassStaticFunctionsTable::const_iterator end = m_staticFunctions->end();
+        for (OpaqueJSClassStaticFunctionsTable::const_iterator it = m_staticFunctions->begin(); it != end; ++it)
+            ASSERT(!it->key->isAtomic());
+    }
+#endif
+    
+    if (prototypeClass)
+        JSClassRelease(prototypeClass);
+}
+
+Ref<OpaqueJSClass> OpaqueJSClass::createNoAutomaticPrototype(const JSClassDefinition* definition)
+{
+    return adoptRef(*new OpaqueJSClass(definition, 0));
+}
+
+Ref<OpaqueJSClass> OpaqueJSClass::create(const JSClassDefinition* clientDefinition)
+{
+    JSClassDefinition definition = *clientDefinition; // Avoid modifying client copy.
+
+    JSClassDefinition protoDefinition = kJSClassDefinitionEmpty;
+    protoDefinition.finalize = 0;
+    swap(definition.staticFunctions, protoDefinition.staticFunctions); // Move static functions to the prototype.
+    
+    // We are supposed to use JSClassRetain/Release but since we know that we currently have
+    // the only reference to this class object we cheat and use a RefPtr instead.
+    RefPtr<OpaqueJSClass> protoClass = adoptRef(new OpaqueJSClass(&protoDefinition, 0));
+    return adoptRef(*new OpaqueJSClass(&definition, protoClass.get()));
+}
+
+OpaqueJSClassContextData::OpaqueJSClassContextData(JSC::VM&, OpaqueJSClass* jsClass)
+    : m_class(jsClass)
+{
+    if (jsClass->m_staticValues) {
+        staticValues = std::make_unique<OpaqueJSClassStaticValuesTable>();
+        OpaqueJSClassStaticValuesTable::const_iterator end = jsClass->m_staticValues->end();
+        for (OpaqueJSClassStaticValuesTable::const_iterator it = jsClass->m_staticValues->begin(); it != end; ++it) {
+            ASSERT(!it->key->isAtomic());
+            String valueName = it->key->isolatedCopy();
+            staticValues->add(valueName.impl(), std::make_unique<StaticValueEntry>(it->value->getProperty, it->value->setProperty, it->value->attributes, valueName));
+        }
+    }
+
+    if (jsClass->m_staticFunctions) {
+        staticFunctions = std::make_unique<OpaqueJSClassStaticFunctionsTable>();
+        OpaqueJSClassStaticFunctionsTable::const_iterator end = jsClass->m_staticFunctions->end();
+        for (OpaqueJSClassStaticFunctionsTable::const_iterator it = jsClass->m_staticFunctions->begin(); it != end; ++it) {
+            ASSERT(!it->key->isAtomic());
+            staticFunctions->add(it->key->isolatedCopy(), std::make_unique<StaticFunctionEntry>(it->value->callAsFunction, it->value->attributes));
+        }
+    }
+}
+
+OpaqueJSClassContextData& OpaqueJSClass::contextData(ExecState* exec)
+{
+    std::unique_ptr<OpaqueJSClassContextData>& contextData = exec->lexicalGlobalObject()->opaqueJSClassData().add(this, nullptr).iterator->value;
+    if (!contextData)
+        contextData = std::make_unique<OpaqueJSClassContextData>(exec->vm(), this);
+    return *contextData;
+}
+
+String OpaqueJSClass::className()
+{
+    // Make a deep copy, so that the caller has no chance to put the original into AtomicStringTable.
+    return m_className.isolatedCopy();
+}
+
+OpaqueJSClassStaticValuesTable* OpaqueJSClass::staticValues(JSC::ExecState* exec)
+{
+    return contextData(exec).staticValues.get();
+}
+
+OpaqueJSClassStaticFunctionsTable* OpaqueJSClass::staticFunctions(JSC::ExecState* exec)
+{
+    return contextData(exec).staticFunctions.get();
+}
+
+JSObject* OpaqueJSClass::prototype(ExecState* exec)
+{
+    /* Class (C++) and prototype (JS) inheritance are parallel, so:
+     *     (C++)      |        (JS)
+     *   ParentClass  |   ParentClassPrototype
+     *       ^        |          ^
+     *       |        |          |
+     *  DerivedClass  |  DerivedClassPrototype
+     */
+
+    if (!prototypeClass)
+        return 0;
+
+    OpaqueJSClassContextData& jsClassData = contextData(exec);
+
+    if (JSObject* prototype = jsClassData.cachedPrototype.get())
+        return prototype;
+
+    // Recursive, but should be good enough for our purposes
+    JSObject* prototype = JSCallbackObject<JSDestructibleObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction
+    if (parentClass) {
+        if (JSObject* parentPrototype = parentClass->prototype(exec))
+            prototype->setPrototypeDirect(exec->vm(), parentPrototype);
+    }
+
+    jsClassData.cachedPrototype = Weak<JSObject>(prototype);
+    return prototype;
+}
diff --git a/API/JSClassRef.h b/API/JSClassRef.h
new file mode 100644
index 0000000..fa024d3
--- /dev/null
+++ b/API/JSClassRef.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSClassRef_h
+#define JSClassRef_h
+
+#include "OpaqueJSString.h"
+#include "Protect.h"
+#include "Weak.h"
+#include <JavaScriptCore/JSObjectRef.h>
+#include <wtf/HashMap.h>
+#include <wtf/text/WTFString.h>
+
+struct StaticValueEntry {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    StaticValueEntry(JSObjectGetPropertyCallback _getProperty, JSObjectSetPropertyCallback _setProperty, JSPropertyAttributes _attributes, String& propertyName)
+    : getProperty(_getProperty), setProperty(_setProperty), attributes(_attributes), propertyNameRef(OpaqueJSString::create(propertyName))
+    {
+    }
+    
+    JSObjectGetPropertyCallback getProperty;
+    JSObjectSetPropertyCallback setProperty;
+    JSPropertyAttributes attributes;
+    RefPtr<OpaqueJSString> propertyNameRef;
+};
+
+struct StaticFunctionEntry {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    StaticFunctionEntry(JSObjectCallAsFunctionCallback _callAsFunction, JSPropertyAttributes _attributes)
+        : callAsFunction(_callAsFunction), attributes(_attributes)
+    {
+    }
+
+    JSObjectCallAsFunctionCallback callAsFunction;
+    JSPropertyAttributes attributes;
+};
+
+typedef HashMap<RefPtr<StringImpl>, std::unique_ptr<StaticValueEntry>> OpaqueJSClassStaticValuesTable;
+typedef HashMap<RefPtr<StringImpl>, std::unique_ptr<StaticFunctionEntry>> OpaqueJSClassStaticFunctionsTable;
+
+struct OpaqueJSClass;
+
+// An OpaqueJSClass (JSClass) is created without a context, so it can be used with any context, even across context groups.
+// This structure holds data members that vary across context groups.
+struct OpaqueJSClassContextData {
+    WTF_MAKE_NONCOPYABLE(OpaqueJSClassContextData); WTF_MAKE_FAST_ALLOCATED;
+public:
+    OpaqueJSClassContextData(JSC::VM&, OpaqueJSClass*);
+
+    // It is necessary to keep OpaqueJSClass alive because of the following rare scenario:
+    // 1. A class is created and used, so its context data is stored in VM hash map.
+    // 2. The class is released, and when all JS objects that use it are collected, OpaqueJSClass
+    // is deleted (that's the part prevented by this RefPtr).
+    // 3. Another class is created at the same address.
+    // 4. When it is used, the old context data is found in VM and used.
+    RefPtr<OpaqueJSClass> m_class;
+
+    std::unique_ptr<OpaqueJSClassStaticValuesTable> staticValues;
+    std::unique_ptr<OpaqueJSClassStaticFunctionsTable> staticFunctions;
+    JSC::Weak<JSC::JSObject> cachedPrototype;
+};
+
+struct OpaqueJSClass : public ThreadSafeRefCounted<OpaqueJSClass> {
+    static Ref<OpaqueJSClass> create(const JSClassDefinition*);
+    static Ref<OpaqueJSClass> createNoAutomaticPrototype(const JSClassDefinition*);
+    JS_EXPORT_PRIVATE ~OpaqueJSClass();
+    
+    String className();
+    OpaqueJSClassStaticValuesTable* staticValues(JSC::ExecState*);
+    OpaqueJSClassStaticFunctionsTable* staticFunctions(JSC::ExecState*);
+    JSC::JSObject* prototype(JSC::ExecState*);
+
+    OpaqueJSClass* parentClass;
+    OpaqueJSClass* prototypeClass;
+    
+    JSObjectInitializeCallback initialize;
+    JSObjectFinalizeCallback finalize;
+    JSObjectHasPropertyCallback hasProperty;
+    JSObjectGetPropertyCallback getProperty;
+    JSObjectSetPropertyCallback setProperty;
+    JSObjectDeletePropertyCallback deleteProperty;
+    JSObjectGetPropertyNamesCallback getPropertyNames;
+    JSObjectCallAsFunctionCallback callAsFunction;
+    JSObjectCallAsConstructorCallback callAsConstructor;
+    JSObjectHasInstanceCallback hasInstance;
+    JSObjectConvertToTypeCallback convertToType;
+
+private:
+    friend struct OpaqueJSClassContextData;
+
+    OpaqueJSClass();
+    OpaqueJSClass(const OpaqueJSClass&);
+    OpaqueJSClass(const JSClassDefinition*, OpaqueJSClass* protoClass);
+
+    OpaqueJSClassContextData& contextData(JSC::ExecState*);
+
+    // Strings in these data members should not be put into any AtomicStringTable.
+    String m_className;
+    std::unique_ptr<OpaqueJSClassStaticValuesTable> m_staticValues;
+    std::unique_ptr<OpaqueJSClassStaticFunctionsTable> m_staticFunctions;
+};
+
+#endif // JSClassRef_h
diff --git a/API/JSContext.h b/API/JSContext.h
new file mode 100644
index 0000000..194e352
--- /dev/null
+++ b/API/JSContext.h
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSContext_h
+#define JSContext_h
+
+#include <JavaScriptCore/JavaScript.h>
+#include <JavaScriptCore/WebKitAvailability.h>
+
+#if JSC_OBJC_API_ENABLED
+
+@class JSVirtualMachine, JSValue;
+
+/*!
+@interface
+@discussion A JSContext is a JavaScript execution environment. All
+ JavaScript execution takes place within a context, and all JavaScript values
+ are tied to a context.
+*/
+NS_CLASS_AVAILABLE(10_9, 7_0)
+@interface JSContext : NSObject
+
+/*!
+@methodgroup Creating New JSContexts
+*/
+/*!
+@method
+@abstract Create a JSContext.
+@result The new context.
+*/
+- (instancetype)init;
+
+/*!
+@method
+@abstract Create a JSContext in the specified virtual machine.
+@param virtualMachine The JSVirtualMachine in which the context will be created.
+@result The new context.
+*/
+- (instancetype)initWithVirtualMachine:(JSVirtualMachine *)virtualMachine;
+
+/*!
+@methodgroup Evaluating Scripts
+*/
+/*!
+@method
+@abstract Evaluate a string of JavaScript code.
+@param script A string containing the JavaScript code to evaluate.
+@result The last value generated by the script.
+*/
+- (JSValue *)evaluateScript:(NSString *)script;
+
+/*!
+@method
+@abstract Evaluate a string of JavaScript code, with a URL for the script's source file.
+@param script A string containing the JavaScript code to evaluate.
+@param sourceURL A URL for the script's source file. Used by debuggers and when reporting exceptions. This parameter is informative only: it does not change the behavior of the script.
+@result The last value generated by the script.
+*/
+- (JSValue *)evaluateScript:(NSString *)script withSourceURL:(NSURL *)sourceURL NS_AVAILABLE(10_10, 8_0);
+
+/*!
+@methodgroup Callback Accessors
+*/
+/*!
+@method
+@abstract Get the JSContext that is currently executing.
+@discussion This method may be called from within an Objective-C block or method invoked
+ as a callback from JavaScript to retrieve the callback's context. Outside of
+ a callback from JavaScript this method will return nil.
+@result The currently executing JSContext or nil if there isn't one.
+*/
++ (JSContext *)currentContext;
+
+/*!
+@method
+@abstract Get the JavaScript function that is currently executing.
+@discussion This method may be called from within an Objective-C block or method invoked
+ as a callback from JavaScript to retrieve the callback's context. Outside of
+ a callback from JavaScript this method will return nil.
+@result The currently executing JavaScript function or nil if there isn't one.
+*/
++ (JSValue *)currentCallee NS_AVAILABLE(10_10, 8_0);
+
+/*!
+@method
+@abstract Get the <code>this</code> value of the currently executing method.
+@discussion This method may be called from within an Objective-C block or method invoked
+ as a callback from JavaScript to retrieve the callback's this value. Outside
+ of a callback from JavaScript this method will return nil.
+@result The current <code>this</code> value or nil if there isn't one.
+*/
++ (JSValue *)currentThis;
+
+/*!
+@method
+@abstract Get the arguments to the current callback.
+@discussion This method may be called from within an Objective-C block or method invoked
+ as a callback from JavaScript to retrieve the callback's arguments, objects
+ in the returned array are instances of JSValue. Outside of a callback from
+ JavaScript this method will return nil.
+@result An NSArray of the arguments nil if there is no current callback.
+*/
++ (NSArray *)currentArguments;
+
+/*!
+@functiongroup Global Properties
+*/
+
+/*!
+@property
+@abstract Get the global object of the context.
+@discussion This method retrieves the global object of the JavaScript execution context.
+ Instances of JSContext originating from WebKit will return a reference to the
+ WindowProxy object.
+@result The global object.
+*/
+@property (readonly, strong) JSValue *globalObject;
+
+/*!
+@property
+@discussion The <code>exception</code> property may be used to throw an exception to JavaScript.
+ 
+ Before a callback is made from JavaScript to an Objective-C block or method,
+ the prior value of the exception property will be preserved and the property
+ will be set to nil. After the callback has completed the new value of the
+ exception property will be read, and prior value restored. If the new value
+ of exception is not nil, the callback will result in that value being thrown.
+ 
+ This property may also be used to check for uncaught exceptions arising from
+ API function calls (since the default behaviour of <code>exceptionHandler</code> is to
+ assign an uncaught exception to this property).
+*/
+@property (strong) JSValue *exception;
+
+/*!
+@property
+@discussion If a call to an API function results in an uncaught JavaScript exception, the
+ <code>exceptionHandler</code> block will be invoked. The default implementation for the
+ exception handler will store the exception to the exception property on
+ context. As a consequence the default behaviour is for uncaught exceptions
+ occurring within a callback from JavaScript to be rethrown upon return.
+ Setting this value to nil will cause all exceptions occurring
+ within a callback from JavaScript to be silently caught.
+*/
+@property (copy) void(^exceptionHandler)(JSContext *context, JSValue *exception);
+
+/*!
+@property
+@discussion All instances of JSContext are associated with a JSVirtualMachine.
+*/
+@property (readonly, strong) JSVirtualMachine *virtualMachine;
+
+/*!
+@property
+@discussion Name of the JSContext. Exposed when remote debugging the context.
+*/
+@property (copy) NSString *name NS_AVAILABLE(10_10, 8_0);
+
+@end
+
+/*!
+@category
+@discussion Instances of JSContext implement the following methods in order to enable
+ support for subscript access by key and index, for example:
+
+@textblock
+    JSContext *context;
+    JSValue *v = context[@"X"]; // Get value for "X" from the global object.
+    context[@"Y"] = v;          // Assign 'v' to "Y" on the global object.
+@/textblock
+
+ An object key passed as a subscript will be converted to a JavaScript value,
+ and then the value converted to a string used to resolve a property of the
+ global object.
+*/
+@interface JSContext (SubscriptSupport)
+
+/*!
+@method
+@abstract Get a particular property on the global object.
+@result The JSValue for the global object's property.
+*/
+- (JSValue *)objectForKeyedSubscript:(id)key;
+
+/*!
+@method
+@abstract Set a particular property on the global object.
+*/
+- (void)setObject:(id)object forKeyedSubscript:(NSObject <NSCopying> *)key;
+
+@end
+
+/*!
+@category
+@discussion These functions are for bridging between the C API and the Objective-C API.
+*/
+@interface JSContext (JSContextRefSupport)
+
+/*!
+@method
+@abstract Create a JSContext, wrapping its C API counterpart.
+@result The JSContext equivalent of the provided JSGlobalContextRef.
+*/
++ (JSContext *)contextWithJSGlobalContextRef:(JSGlobalContextRef)jsGlobalContextRef;
+
+/*!
+@property
+@abstract Get the C API counterpart wrapped by a JSContext.
+@result The C API equivalent of this JSContext.
+*/
+@property (readonly) JSGlobalContextRef JSGlobalContextRef;
+@end
+
+#endif
+
+#endif // JSContext_h
diff --git a/API/JSContext.mm b/API/JSContext.mm
new file mode 100644
index 0000000..3291622
--- /dev/null
+++ b/API/JSContext.mm
@@ -0,0 +1,354 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#import "APICast.h"
+#import "JSCInlines.h"
+#import "JSContextInternal.h"
+#import "JSContextPrivate.h"
+#import "JSContextRefInternal.h"
+#import "JSGlobalObject.h"
+#import "JSValueInternal.h"
+#import "JSVirtualMachineInternal.h"
+#import "JSWrapperMap.h"
+#import "JavaScriptCore.h"
+#import "ObjcRuntimeExtras.h"
+#import "StrongInlines.h"
+
+#if JSC_OBJC_API_ENABLED
+
+@implementation JSContext {
+    JSVirtualMachine *m_virtualMachine;
+    JSGlobalContextRef m_context;
+    JSWrapperMap *m_wrapperMap;
+    JSC::Strong<JSC::JSObject> m_exception;
+}
+
+@synthesize exceptionHandler;
+
+- (JSGlobalContextRef)JSGlobalContextRef
+{
+    return m_context;
+}
+
+- (instancetype)init
+{
+    return [self initWithVirtualMachine:[[[JSVirtualMachine alloc] init] autorelease]];
+}
+
+- (instancetype)initWithVirtualMachine:(JSVirtualMachine *)virtualMachine
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    m_virtualMachine = [virtualMachine retain];
+    m_context = JSGlobalContextCreateInGroup(getGroupFromVirtualMachine(virtualMachine), 0);
+    m_wrapperMap = [[JSWrapperMap alloc] initWithContext:self];
+
+    self.exceptionHandler = ^(JSContext *context, JSValue *exceptionValue) {
+        context.exception = exceptionValue;
+    };
+
+    [m_virtualMachine addContext:self forGlobalContextRef:m_context];
+
+    return self;
+}
+
+- (void)dealloc
+{
+    m_exception.clear();
+    [m_wrapperMap release];
+    JSGlobalContextRelease(m_context);
+    [m_virtualMachine release];
+    [self.exceptionHandler release];
+    [super dealloc];
+}
+
+- (JSValue *)evaluateScript:(NSString *)script
+{
+    return [self evaluateScript:script withSourceURL:nil];
+}
+
+- (JSValue *)evaluateScript:(NSString *)script withSourceURL:(NSURL *)sourceURL
+{
+    JSValueRef exceptionValue = nullptr;
+    JSStringRef scriptJS = JSStringCreateWithCFString((CFStringRef)script);
+    JSStringRef sourceURLJS = sourceURL ? JSStringCreateWithCFString((CFStringRef)[sourceURL absoluteString]) : nullptr;
+    JSValueRef result = JSEvaluateScript(m_context, scriptJS, nullptr, sourceURLJS, 0, &exceptionValue);
+    if (sourceURLJS)
+        JSStringRelease(sourceURLJS);
+    JSStringRelease(scriptJS);
+
+    if (exceptionValue)
+        return [self valueFromNotifyException:exceptionValue];
+
+    return [JSValue valueWithJSValueRef:result inContext:self];
+}
+
+- (void)setException:(JSValue *)value
+{
+    JSC::JSLockHolder locker(toJS(m_context));
+    if (value)
+        m_exception.set(toJS(m_context)->vm(), toJS(JSValueToObject(m_context, valueInternalValue(value), 0)));
+    else
+        m_exception.clear();
+}
+
+- (JSValue *)exception
+{
+    if (!m_exception)
+        return nil;
+    return [JSValue valueWithJSValueRef:toRef(m_exception.get()) inContext:self];
+}
+
+- (JSWrapperMap *)wrapperMap
+{
+    return m_wrapperMap;
+}
+
+- (JSValue *)globalObject
+{
+    return [JSValue valueWithJSValueRef:JSContextGetGlobalObject(m_context) inContext:self];
+}
+
++ (JSContext *)currentContext
+{
+    WTFThreadData& threadData = wtfThreadData();
+    CallbackData *entry = (CallbackData *)threadData.m_apiData;
+    return entry ? entry->context : nil;
+}
+
++ (JSValue *)currentThis
+{
+    WTFThreadData& threadData = wtfThreadData();
+    CallbackData *entry = (CallbackData *)threadData.m_apiData;
+    if (!entry)
+        return nil;
+    return [JSValue valueWithJSValueRef:entry->thisValue inContext:[JSContext currentContext]];
+}
+
++ (JSValue *)currentCallee
+{
+    WTFThreadData& threadData = wtfThreadData();
+    CallbackData *entry = (CallbackData *)threadData.m_apiData;
+    if (!entry)
+        return nil;
+    return [JSValue valueWithJSValueRef:entry->calleeValue inContext:[JSContext currentContext]];
+}
+
++ (NSArray *)currentArguments
+{
+    WTFThreadData& threadData = wtfThreadData();
+    CallbackData *entry = (CallbackData *)threadData.m_apiData;
+
+    if (!entry)
+        return nil;
+
+    if (!entry->currentArguments) {
+        JSContext *context = [JSContext currentContext];
+        size_t count = entry->argumentCount;
+        JSValue * argumentArray[count];
+        for (size_t i =0; i < count; ++i)
+            argumentArray[i] = [JSValue valueWithJSValueRef:entry->arguments[i] inContext:context];
+        entry->currentArguments = [[NSArray alloc] initWithObjects:argumentArray count:count];
+    }
+
+    return entry->currentArguments;
+}
+
+- (JSVirtualMachine *)virtualMachine
+{
+    return m_virtualMachine;
+}
+
+- (NSString *)name
+{
+    JSStringRef name = JSGlobalContextCopyName(m_context);
+    if (!name)
+        return nil;
+
+    return (NSString *)adoptCF(JSStringCopyCFString(kCFAllocatorDefault, name)).autorelease();
+}
+
+- (void)setName:(NSString *)name
+{
+    JSStringRef nameJS = name ? JSStringCreateWithCFString((CFStringRef)[[name copy] autorelease]) : nullptr;
+    JSGlobalContextSetName(m_context, nameJS);
+    if (nameJS)
+        JSStringRelease(nameJS);
+}
+
+- (BOOL)_remoteInspectionEnabled
+{
+    return JSGlobalContextGetRemoteInspectionEnabled(m_context);
+}
+
+- (void)_setRemoteInspectionEnabled:(BOOL)enabled
+{
+    JSGlobalContextSetRemoteInspectionEnabled(m_context, enabled);
+}
+
+- (BOOL)_includesNativeCallStackWhenReportingExceptions
+{
+    return JSGlobalContextGetIncludesNativeCallStackWhenReportingExceptions(m_context);
+}
+
+- (void)_setIncludesNativeCallStackWhenReportingExceptions:(BOOL)includeNativeCallStack
+{
+    JSGlobalContextSetIncludesNativeCallStackWhenReportingExceptions(m_context, includeNativeCallStack);
+}
+
+- (CFRunLoopRef)_debuggerRunLoop
+{
+    return JSGlobalContextGetDebuggerRunLoop(m_context);
+}
+
+- (void)_setDebuggerRunLoop:(CFRunLoopRef)runLoop
+{
+    JSGlobalContextSetDebuggerRunLoop(m_context, runLoop);
+}
+
+@end
+
+@implementation JSContext(SubscriptSupport)
+
+- (JSValue *)objectForKeyedSubscript:(id)key
+{
+    return [self globalObject][key];
+}
+
+- (void)setObject:(id)object forKeyedSubscript:(NSObject <NSCopying> *)key
+{
+    [self globalObject][key] = object;
+}
+
+@end
+
+@implementation JSContext (Internal)
+
+- (instancetype)initWithGlobalContextRef:(JSGlobalContextRef)context
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    JSC::JSGlobalObject* globalObject = toJS(context)->lexicalGlobalObject();
+    m_virtualMachine = [[JSVirtualMachine virtualMachineWithContextGroupRef:toRef(&globalObject->vm())] retain];
+    ASSERT(m_virtualMachine);
+    m_context = JSGlobalContextRetain(context);
+    m_wrapperMap = [[JSWrapperMap alloc] initWithContext:self];
+
+    self.exceptionHandler = ^(JSContext *context, JSValue *exceptionValue) {
+        context.exception = exceptionValue;
+    };
+
+    [m_virtualMachine addContext:self forGlobalContextRef:m_context];
+
+    return self;
+}
+
+- (void)notifyException:(JSValueRef)exceptionValue
+{
+    self.exceptionHandler(self, [JSValue valueWithJSValueRef:exceptionValue inContext:self]);
+}
+
+- (JSValue *)valueFromNotifyException:(JSValueRef)exceptionValue
+{
+    [self notifyException:exceptionValue];
+    return [JSValue valueWithUndefinedInContext:self];
+}
+
+- (BOOL)boolFromNotifyException:(JSValueRef)exceptionValue
+{
+    [self notifyException:exceptionValue];
+    return NO;
+}
+
+- (void)beginCallbackWithData:(CallbackData *)callbackData calleeValue:(JSValueRef)calleeValue thisValue:(JSValueRef)thisValue argumentCount:(size_t)argumentCount arguments:(const JSValueRef *)arguments
+{
+    WTFThreadData& threadData = wtfThreadData();
+    [self retain];
+    CallbackData *prevStack = (CallbackData *)threadData.m_apiData;
+    *callbackData = (CallbackData){ prevStack, self, [self.exception retain], calleeValue, thisValue, argumentCount, arguments, nil };
+    threadData.m_apiData = callbackData;
+    self.exception = nil;
+}
+
+- (void)endCallbackWithData:(CallbackData *)callbackData
+{
+    WTFThreadData& threadData = wtfThreadData();
+    self.exception = callbackData->preservedException;
+    [callbackData->preservedException release];
+    [callbackData->currentArguments release];
+    threadData.m_apiData = callbackData->next;
+    [self release];
+}
+
+- (JSValue *)wrapperForObjCObject:(id)object
+{
+    JSC::JSLockHolder locker(toJS(m_context));
+    return [m_wrapperMap jsWrapperForObject:object];
+}
+
+- (JSValue *)wrapperForJSObject:(JSValueRef)value
+{
+    JSC::JSLockHolder locker(toJS(m_context));
+    return [m_wrapperMap objcWrapperForJSValueRef:value];
+}
+
++ (JSContext *)contextWithJSGlobalContextRef:(JSGlobalContextRef)globalContext
+{
+    JSVirtualMachine *virtualMachine = [JSVirtualMachine virtualMachineWithContextGroupRef:toRef(&toJS(globalContext)->vm())];
+    JSContext *context = [virtualMachine contextForGlobalContextRef:globalContext];
+    if (!context)
+        context = [[[JSContext alloc] initWithGlobalContextRef:globalContext] autorelease];
+    return context;
+}
+
+@end
+
+WeakContextRef::WeakContextRef(JSContext *context)
+{
+    objc_initWeak(&m_weakContext, context);
+}
+
+WeakContextRef::~WeakContextRef()
+{
+    objc_destroyWeak(&m_weakContext);
+}
+
+JSContext * WeakContextRef::get()
+{
+    return objc_loadWeak(&m_weakContext);
+}
+
+void WeakContextRef::set(JSContext *context)
+{
+    objc_storeWeak(&m_weakContext, context);
+}
+
+#endif
diff --git a/API/JSContextInternal.h b/API/JSContextInternal.h
new file mode 100644
index 0000000..5308fbb
--- /dev/null
+++ b/API/JSContextInternal.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSContextInternal_h
+#define JSContextInternal_h
+
+#import <JavaScriptCore/JavaScriptCore.h>
+
+#if JSC_OBJC_API_ENABLED
+
+#import <JavaScriptCore/JSContext.h>
+
+struct CallbackData {
+    CallbackData *next;
+    JSContext *context;
+    JSValue *preservedException;
+    JSValueRef calleeValue;
+    JSValueRef thisValue;
+    size_t argumentCount;
+    const JSValueRef *arguments;
+    NSArray *currentArguments;
+};
+
+class WeakContextRef {
+public:
+    WeakContextRef(JSContext * = nil);
+    ~WeakContextRef();
+
+    JSContext * get();
+    void set(JSContext *);
+
+private:
+    JSContext *m_weakContext;
+};
+
+@class JSWrapperMap;
+
+@interface JSContext(Internal)
+
+- (id)initWithGlobalContextRef:(JSGlobalContextRef)context;
+
+- (void)notifyException:(JSValueRef)exception;
+- (JSValue *)valueFromNotifyException:(JSValueRef)exception;
+- (BOOL)boolFromNotifyException:(JSValueRef)exception;
+
+- (void)beginCallbackWithData:(CallbackData *)callbackData calleeValue:(JSValueRef)calleeValue thisValue:(JSValueRef)thisValue argumentCount:(size_t)argumentCount arguments:(const JSValueRef *)arguments;
+- (void)endCallbackWithData:(CallbackData *)callbackData;
+
+- (JSValue *)wrapperForObjCObject:(id)object;
+- (JSValue *)wrapperForJSObject:(JSValueRef)value;
+
+@property (readonly, retain) JSWrapperMap *wrapperMap;
+
+@end
+
+#endif
+
+#endif // JSContextInternal_h
diff --git a/API/JSContextPrivate.h b/API/JSContextPrivate.h
new file mode 100644
index 0000000..7d1d0cb
--- /dev/null
+++ b/API/JSContextPrivate.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSContextPrivate_h
+#define JSContextPrivate_h
+
+#if JSC_OBJC_API_ENABLED
+
+#import <JavaScriptCore/JSContext.h>
+
+@interface JSContext(Private)
+
+/*!
+@property
+@discussion Remote inspection setting of the JSContext. Default value is YES.
+*/
+@property (setter=_setRemoteInspectionEnabled:) BOOL _remoteInspectionEnabled NS_AVAILABLE(10_10, 8_0);
+
+/*!
+@property
+@discussion Set whether or not the native call stack is included when reporting exceptions. Default value is YES.
+*/
+@property (setter=_setIncludesNativeCallStackWhenReportingExceptions:) BOOL _includesNativeCallStackWhenReportingExceptions NS_AVAILABLE(10_10, 8_0);
+
+/*!
+@property
+@discussion Set the run loop the Web Inspector debugger should use when evaluating JavaScript in the JSContext.
+*/
+@property (setter=_setDebuggerRunLoop:) CFRunLoopRef _debuggerRunLoop NS_AVAILABLE(10_10, 8_0);
+
+@end
+
+#endif
+
+#endif // JSContextInternal_h
diff --git a/API/JSContextRef.cpp b/API/JSContextRef.cpp
new file mode 100644
index 0000000..13769df
--- /dev/null
+++ b/API/JSContextRef.cpp
@@ -0,0 +1,431 @@
+/*
+ * Copyright (C) 2006, 2007, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSContextRef.h"
+#include "JSContextRefInternal.h"
+
+#include "APICast.h"
+#include "CallFrame.h"
+#include "InitializeThreading.h"
+#include "JSCallbackObject.h"
+#include "JSClassRef.h"
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "SourceProvider.h"
+#include "StackVisitor.h"
+#include "Watchdog.h"
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringHash.h>
+
+#if ENABLE(REMOTE_INSPECTOR)
+#include "JSGlobalObjectDebuggable.h"
+#include "JSGlobalObjectInspectorController.h"
+#include "JSRemoteInspector.h"
+#endif
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "JSContextRefInspectorSupport.h"
+#endif
+
+#if OS(DARWIN)
+#include <mach-o/dyld.h>
+
+static const int32_t webkitFirstVersionWithConcurrentGlobalContexts = 0x2100500; // 528.5.0
+#endif
+
+using namespace JSC;
+
+// From the API's perspective, a context group remains alive iff
+//     (a) it has been JSContextGroupRetained
+//     OR
+//     (b) one of its contexts has been JSContextRetained
+
+JSContextGroupRef JSContextGroupCreate()
+{
+    initializeThreading();
+    return toRef(&VM::createContextGroup().leakRef());
+}
+
+JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group)
+{
+    toJS(group)->ref();
+    return group;
+}
+
+void JSContextGroupRelease(JSContextGroupRef group)
+{
+    VM& vm = *toJS(group);
+
+    JSLockHolder locker(&vm);
+    vm.deref();
+}
+
+static bool internalScriptTimeoutCallback(ExecState* exec, void* callbackPtr, void* callbackData)
+{
+    JSShouldTerminateCallback callback = reinterpret_cast<JSShouldTerminateCallback>(callbackPtr);
+    JSContextRef contextRef = toRef(exec);
+    ASSERT(callback);
+    return callback(contextRef, callbackData);
+}
+
+void JSContextGroupSetExecutionTimeLimit(JSContextGroupRef group, double limit, JSShouldTerminateCallback callback, void* callbackData)
+{
+    VM& vm = *toJS(group);
+    JSLockHolder locker(&vm);
+    Watchdog& watchdog = vm.ensureWatchdog();
+    if (callback) {
+        void* callbackPtr = reinterpret_cast<void*>(callback);
+        watchdog.setTimeLimit(std::chrono::duration_cast<std::chrono::microseconds>(std::chrono::duration<double>(limit)), internalScriptTimeoutCallback, callbackPtr, callbackData);
+    } else
+        watchdog.setTimeLimit(std::chrono::duration_cast<std::chrono::microseconds>(std::chrono::duration<double>(limit)));
+}
+
+void JSContextGroupClearExecutionTimeLimit(JSContextGroupRef group)
+{
+    VM& vm = *toJS(group);
+    JSLockHolder locker(&vm);
+    if (vm.watchdog())
+        vm.watchdog()->setTimeLimit(Watchdog::noTimeLimit);
+}
+
+// From the API's perspective, a global context remains alive iff it has been JSGlobalContextRetained.
+
+JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
+{
+    initializeThreading();
+
+#if OS(DARWIN)
+    // If the application was linked before JSGlobalContextCreate was changed to use a unique VM,
+    // we use a shared one for backwards compatibility.
+    if (NSVersionOfLinkTimeLibrary("JavaScriptCore") <= webkitFirstVersionWithConcurrentGlobalContexts) {
+        return JSGlobalContextCreateInGroup(toRef(&VM::sharedInstance()), globalObjectClass);
+    }
+#endif // OS(DARWIN)
+
+    return JSGlobalContextCreateInGroup(0, globalObjectClass);
+}
+
+JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClassRef globalObjectClass)
+{
+    initializeThreading();
+
+    RefPtr<VM> vm = group ? PassRefPtr<VM>(toJS(group)) : VM::createContextGroup();
+
+    JSLockHolder locker(vm.get());
+
+    if (!globalObjectClass) {
+        JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
+#if ENABLE(REMOTE_INSPECTOR)
+        if (JSRemoteInspectorGetInspectionEnabledByDefault())
+            globalObject->setRemoteDebuggingEnabled(true);
+#endif
+        return JSGlobalContextRetain(toGlobalRef(globalObject->globalExec()));
+    }
+
+    JSGlobalObject* globalObject = JSCallbackObject<JSGlobalObject>::create(*vm, globalObjectClass, JSCallbackObject<JSGlobalObject>::createStructure(*vm, 0, jsNull()));
+    ExecState* exec = globalObject->globalExec();
+    JSValue prototype = globalObjectClass->prototype(exec);
+    if (!prototype)
+        prototype = jsNull();
+    globalObject->resetPrototype(*vm, prototype);
+#if ENABLE(REMOTE_INSPECTOR)
+    if (JSRemoteInspectorGetInspectionEnabledByDefault())
+        globalObject->setRemoteDebuggingEnabled(true);
+#endif
+    return JSGlobalContextRetain(toGlobalRef(exec));
+}
+
+JSGlobalContextRef JSGlobalContextRetain(JSGlobalContextRef ctx)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    VM& vm = exec->vm();
+    gcProtect(exec->vmEntryGlobalObject());
+    vm.ref();
+    return ctx;
+}
+
+void JSGlobalContextRelease(JSGlobalContextRef ctx)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    VM& vm = exec->vm();
+    bool protectCountIsZero = Heap::heap(exec->vmEntryGlobalObject())->unprotect(exec->vmEntryGlobalObject());
+    if (protectCountIsZero)
+        vm.heap.reportAbandonedObjectGraph();
+    vm.deref();
+}
+
+JSObjectRef JSContextGetGlobalObject(JSContextRef ctx)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toRef(jsCast<JSObject*>(exec->lexicalGlobalObject()->methodTable()->toThis(exec->lexicalGlobalObject(), exec, NotStrictMode)));
+}
+
+JSContextGroupRef JSContextGetGroup(JSContextRef ctx)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    return toRef(&exec->vm());
+}
+
+JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toGlobalRef(exec->lexicalGlobalObject()->globalExec());
+}
+
+JSStringRef JSGlobalContextCopyName(JSGlobalContextRef ctx)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    String name = exec->vmEntryGlobalObject()->name();
+    if (name.isNull())
+        return 0;
+
+    return OpaqueJSString::create(name).leakRef();
+}
+
+void JSGlobalContextSetName(JSGlobalContextRef ctx, JSStringRef name)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    exec->vmEntryGlobalObject()->setName(name ? name->string() : String());
+}
+
+
+class BacktraceFunctor {
+public:
+    BacktraceFunctor(StringBuilder& builder, unsigned remainingCapacityForFrameCapture)
+        : m_builder(builder)
+        , m_remainingCapacityForFrameCapture(remainingCapacityForFrameCapture)
+    {
+    }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        if (m_remainingCapacityForFrameCapture) {
+            // If callee is unknown, but we've not added any frame yet, we should
+            // still add the frame, because something called us, and gave us arguments.
+            JSCell* callee = visitor->callee();
+            if (!callee && visitor->index())
+                return StackVisitor::Done;
+
+            StringBuilder& builder = m_builder;
+            if (!builder.isEmpty())
+                builder.append('\n');
+            builder.append('#');
+            builder.appendNumber(visitor->index());
+            builder.append(' ');
+            builder.append(visitor->functionName());
+            builder.appendLiteral("() at ");
+            builder.append(visitor->sourceURL());
+            if (visitor->hasLineAndColumnInfo()) {
+                builder.append(':');
+                unsigned lineNumber;
+                unsigned unusedColumn;
+                visitor->computeLineAndColumn(lineNumber, unusedColumn);
+                builder.appendNumber(lineNumber);
+            }
+
+            if (!callee)
+                return StackVisitor::Done;
+
+            m_remainingCapacityForFrameCapture--;
+            return StackVisitor::Continue;
+        }
+        return StackVisitor::Done;
+    }
+
+private:
+    StringBuilder& m_builder;
+    mutable unsigned m_remainingCapacityForFrameCapture;
+};
+
+JSStringRef JSContextCreateBacktrace(JSContextRef ctx, unsigned maxStackSize)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder lock(exec);
+    StringBuilder builder;
+    CallFrame* frame = exec->vm().topCallFrame;
+
+    ASSERT(maxStackSize);
+    BacktraceFunctor functor(builder, maxStackSize);
+    frame->iterate(functor);
+
+    return OpaqueJSString::create(builder.toString()).leakRef();
+}
+
+bool JSGlobalContextGetRemoteInspectionEnabled(JSGlobalContextRef ctx)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder lock(exec);
+
+    return exec->vmEntryGlobalObject()->remoteDebuggingEnabled();
+}
+
+void JSGlobalContextSetRemoteInspectionEnabled(JSGlobalContextRef ctx, bool enabled)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder lock(exec);
+
+    exec->vmEntryGlobalObject()->setRemoteDebuggingEnabled(enabled);
+}
+
+bool JSGlobalContextGetIncludesNativeCallStackWhenReportingExceptions(JSGlobalContextRef ctx)
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder lock(exec);
+
+    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
+    return globalObject->inspectorController().includesNativeCallStackWhenReportingExceptions();
+#else
+    UNUSED_PARAM(ctx);
+    return false;
+#endif
+}
+
+void JSGlobalContextSetIncludesNativeCallStackWhenReportingExceptions(JSGlobalContextRef ctx, bool includesNativeCallStack)
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder lock(exec);
+
+    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
+    globalObject->inspectorController().setIncludesNativeCallStackWhenReportingExceptions(includesNativeCallStack);
+#else
+    UNUSED_PARAM(ctx);
+    UNUSED_PARAM(includesNativeCallStack);
+#endif
+}
+
+#if USE(CF)
+CFRunLoopRef JSGlobalContextGetDebuggerRunLoop(JSGlobalContextRef ctx)
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder lock(exec);
+
+    return exec->vmEntryGlobalObject()->inspectorDebuggable().targetRunLoop();
+#else
+    UNUSED_PARAM(ctx);
+    return nullptr;
+#endif
+}
+
+void JSGlobalContextSetDebuggerRunLoop(JSGlobalContextRef ctx, CFRunLoopRef runLoop)
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder lock(exec);
+
+    exec->vmEntryGlobalObject()->inspectorDebuggable().setTargetRunLoop(runLoop);
+#else
+    UNUSED_PARAM(ctx);
+    UNUSED_PARAM(runLoop);
+#endif
+}
+#endif // USE(CF)
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+Inspector::AugmentableInspectorController* JSGlobalContextGetAugmentableInspectorController(JSGlobalContextRef ctx)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder lock(exec);
+
+    return &exec->vmEntryGlobalObject()->inspectorController();
+}
+#endif
diff --git a/API/JSContextRef.h b/API/JSContextRef.h
new file mode 100644
index 0000000..0c800bc
--- /dev/null
+++ b/API/JSContextRef.h
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSContextRef_h
+#define JSContextRef_h
+
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+#include <JavaScriptCore/WebKitAvailability.h>
+
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+@function
+@abstract Creates a JavaScript context group.
+@discussion A JSContextGroup associates JavaScript contexts with one another.
+ Contexts in the same group may share and exchange JavaScript objects. Sharing and/or exchanging
+ JavaScript objects between contexts in different groups will produce undefined behavior.
+ When objects from the same context group are used in multiple threads, explicit
+ synchronization is required.
+@result The created JSContextGroup.
+*/
+JS_EXPORT JSContextGroupRef JSContextGroupCreate(void) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+@function
+@abstract Retains a JavaScript context group.
+@param group The JSContextGroup to retain.
+@result A JSContextGroup that is the same as group.
+*/
+JS_EXPORT JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+@function
+@abstract Releases a JavaScript context group.
+@param group The JSContextGroup to release.
+*/
+JS_EXPORT void JSContextGroupRelease(JSContextGroupRef group) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+@function
+@abstract Creates a global JavaScript execution context.
+@discussion JSGlobalContextCreate allocates a global object and populates it with all the
+ built-in JavaScript objects, such as Object, Function, String, and Array.
+
+ In WebKit version 4.0 and later, the context is created in a unique context group.
+ Therefore, scripts may execute in it concurrently with scripts executing in other contexts.
+ However, you may not use values created in the context in other contexts.
+@param globalObjectClass The class to use when creating the global object. Pass 
+ NULL to use the default object class.
+@result A JSGlobalContext with a global object of class globalObjectClass.
+*/
+JS_EXPORT JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass) CF_AVAILABLE(10_5, 7_0);
+
+/*!
+@function
+@abstract Creates a global JavaScript execution context in the context group provided.
+@discussion JSGlobalContextCreateInGroup allocates a global object and populates it with
+ all the built-in JavaScript objects, such as Object, Function, String, and Array.
+@param globalObjectClass The class to use when creating the global object. Pass
+ NULL to use the default object class.
+@param group The context group to use. The created global context retains the group.
+ Pass NULL to create a unique group for the context.
+@result A JSGlobalContext with a global object of class globalObjectClass and a context
+ group equal to group.
+*/
+JS_EXPORT JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClassRef globalObjectClass) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+@function
+@abstract Retains a global JavaScript execution context.
+@param ctx The JSGlobalContext to retain.
+@result A JSGlobalContext that is the same as ctx.
+*/
+JS_EXPORT JSGlobalContextRef JSGlobalContextRetain(JSGlobalContextRef ctx);
+
+/*!
+@function
+@abstract Releases a global JavaScript execution context.
+@param ctx The JSGlobalContext to release.
+*/
+JS_EXPORT void JSGlobalContextRelease(JSGlobalContextRef ctx);
+
+/*!
+@function
+@abstract Gets the global object of a JavaScript execution context.
+@param ctx The JSContext whose global object you want to get.
+@result ctx's global object.
+*/
+JS_EXPORT JSObjectRef JSContextGetGlobalObject(JSContextRef ctx);
+
+/*!
+@function
+@abstract Gets the context group to which a JavaScript execution context belongs.
+@param ctx The JSContext whose group you want to get.
+@result ctx's group.
+*/
+JS_EXPORT JSContextGroupRef JSContextGetGroup(JSContextRef ctx) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+@function
+@abstract Gets the global context of a JavaScript execution context.
+@param ctx The JSContext whose global context you want to get.
+@result ctx's global context.
+*/
+JS_EXPORT JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx) CF_AVAILABLE(10_7, 7_0);
+
+/*!
+@function
+@abstract Gets a copy of the name of a context.
+@param ctx The JSGlobalContext whose name you want to get.
+@result The name for ctx.
+@discussion A JSGlobalContext's name is exposed for remote debugging to make it
+easier to identify the context you would like to attach to.
+*/
+JS_EXPORT JSStringRef JSGlobalContextCopyName(JSGlobalContextRef ctx) CF_AVAILABLE(10_10, 8_0);
+
+/*!
+@function
+@abstract Sets the remote debugging name for a context.
+@param ctx The JSGlobalContext that you want to name.
+@param name The remote debugging name to set on ctx.
+*/
+JS_EXPORT void JSGlobalContextSetName(JSGlobalContextRef ctx, JSStringRef name) CF_AVAILABLE(10_10, 8_0);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSContextRef_h */
diff --git a/API/JSContextRefInspectorSupport.h b/API/JSContextRefInspectorSupport.h
new file mode 100644
index 0000000..a09d828
--- /dev/null
+++ b/API/JSContextRefInspectorSupport.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSContextRefInspectorSupport_h
+#define JSContextRefInspectorSupport_h
+
+#ifndef __cplusplus
+#error Requires C++ Support.
+#endif
+
+#include <JavaScriptCore/JSContextRefPrivate.h>
+
+namespace Inspector {
+class AugmentableInspectorController;
+}
+
+extern "C" {
+JS_EXPORT Inspector::AugmentableInspectorController* JSGlobalContextGetAugmentableInspectorController(JSGlobalContextRef);
+}
+
+#endif // JSContextRefInspectorSupport_h
diff --git a/API/JSContextRefInternal.h b/API/JSContextRefInternal.h
new file mode 100644
index 0000000..79d7eb6
--- /dev/null
+++ b/API/JSContextRefInternal.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2014 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSContextRefInternal_h
+#define JSContextRefInternal_h
+
+#include "JSContextRefPrivate.h"
+
+#if USE(CF)
+#include <CoreFoundation/CFRunLoop.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if USE(CF)
+/*!
+@function
+@abstract Gets the run loop used by the Web Inspector debugger when evaluating JavaScript in this context.
+@param ctx The JSGlobalContext whose setting you want to get.
+*/
+JS_EXPORT CFRunLoopRef JSGlobalContextGetDebuggerRunLoop(JSGlobalContextRef ctx) CF_AVAILABLE(10_10, 8_0);
+
+/*!
+@function
+@abstract Sets the run loop used by the Web Inspector debugger when evaluating JavaScript in this context.
+@param ctx The JSGlobalContext that you want to change.
+@param runLoop The new value of the setting for the context.
+*/
+JS_EXPORT void JSGlobalContextSetDebuggerRunLoop(JSGlobalContextRef ctx, CFRunLoopRef runLoop) CF_AVAILABLE(10_10, 8_0);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSContextRefInternal_h
diff --git a/API/JSContextRefPrivate.h b/API/JSContextRefPrivate.h
new file mode 100644
index 0000000..19604ea
--- /dev/null
+++ b/API/JSContextRefPrivate.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSContextRefPrivate_h
+#define JSContextRefPrivate_h
+
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+#include <JavaScriptCore/WebKitAvailability.h>
+
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+@function
+@abstract Gets a Backtrace for the existing context
+@param ctx The JSContext whose backtrace you want to get
+@result A string containing the backtrace
+*/
+JS_EXPORT JSStringRef JSContextCreateBacktrace(JSContextRef ctx, unsigned maxStackSize) CF_AVAILABLE(10_6, 7_0);
+    
+
+/*! 
+@typedef JSShouldTerminateCallback
+@abstract The callback invoked when script execution has exceeded the allowed
+ time limit previously specified via JSContextGroupSetExecutionTimeLimit.
+@param ctx The execution context to use.
+@param context User specified context data previously passed to
+ JSContextGroupSetExecutionTimeLimit.
+@discussion If you named your function Callback, you would declare it like this:
+
+ bool Callback(JSContextRef ctx, void* context);
+
+ If you return true, the timed out script will terminate.
+ If you return false, the script will run for another period of the allowed
+ time limit specified via JSContextGroupSetExecutionTimeLimit.
+
+ Within this callback function, you may call JSContextGroupSetExecutionTimeLimit
+ to set a new time limit, or JSContextGroupClearExecutionTimeLimit to cancel the
+ timeout.
+*/
+typedef bool
+(*JSShouldTerminateCallback) (JSContextRef ctx, void* context);
+
+/*!
+@function
+@abstract Sets the script execution time limit.
+@param group The JavaScript context group that this time limit applies to.
+@param limit The time limit of allowed script execution time in seconds.
+@param callback The callback function that will be invoked when the time limit
+ has been reached. This will give you a chance to decide if you want to
+ terminate the script or not. If you pass a NULL callback, the script will be
+ terminated unconditionally when the time limit has been reached.
+@param context User data that you can provide to be passed back to you
+ in your callback.
+
+ In order to guarantee that the execution time limit will take effect, you will
+ need to call JSContextGroupSetExecutionTimeLimit before you start executing
+ any scripts.
+*/
+JS_EXPORT void JSContextGroupSetExecutionTimeLimit(JSContextGroupRef group, double limit, JSShouldTerminateCallback callback, void* context) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+@function
+@abstract Clears the script execution time limit.
+@param group The JavaScript context group that the time limit is cleared on.
+*/
+JS_EXPORT void JSContextGroupClearExecutionTimeLimit(JSContextGroupRef group) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+@function
+@abstract Gets a whether or not remote inspection is enabled on the context.
+@param ctx The JSGlobalContext whose setting you want to get.
+@result The value of the setting, true if remote inspection is enabled, otherwise false.
+@discussion Remote inspection is true by default.
+*/
+JS_EXPORT bool JSGlobalContextGetRemoteInspectionEnabled(JSGlobalContextRef ctx) CF_AVAILABLE(10_10, 8_0);
+
+/*!
+@function
+@abstract Sets the remote inspection setting for a context.
+@param ctx The JSGlobalContext that you want to change.
+@param enabled The new remote inspection enabled setting for the context.
+*/
+JS_EXPORT void JSGlobalContextSetRemoteInspectionEnabled(JSGlobalContextRef ctx, bool enabled) CF_AVAILABLE(10_10, 8_0);    
+
+/*!
+@function
+@abstract Gets the include native call stack when reporting exceptions setting for a context.
+@param ctx The JSGlobalContext whose setting you want to get.
+@result The value of the setting, true if remote inspection is enabled, otherwise false.
+@discussion This setting is true by default.
+*/
+JS_EXPORT bool JSGlobalContextGetIncludesNativeCallStackWhenReportingExceptions(JSGlobalContextRef ctx) CF_AVAILABLE(10_10, 8_0);
+
+/*!
+@function
+@abstract Sets the include native call stack when reporting exceptions setting for a context.
+@param ctx The JSGlobalContext that you want to change.
+@param includesNativeCallStack The new value of the setting for the context.
+*/
+JS_EXPORT void JSGlobalContextSetIncludesNativeCallStackWhenReportingExceptions(JSGlobalContextRef ctx, bool includesNativeCallStack) CF_AVAILABLE(10_10, 8_0);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSContextRefPrivate_h */
diff --git a/API/JSExport.h b/API/JSExport.h
new file mode 100644
index 0000000..b8a4849
--- /dev/null
+++ b/API/JSExport.h
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <JavaScriptCore/JavaScriptCore.h>
+
+#if JSC_OBJC_API_ENABLED
+
+/*!
+@protocol
+@abstract JSExport provides a declarative way to export Objective-C objects and
+ classes -- including properties, instance methods, class methods, and
+ initializers -- to JavaScript.
+
+@discussion When an Objective-C object is exported to JavaScript, a JavaScript
+ wrapper object is created.
+
+ In JavaScript, inheritance works via a chain of prototype objects.
+ For each Objective-C class in each JSContext, an object appropriate for use
+ as a prototype will be provided. For the class NSObject the prototype
+ will be the Object prototype. For all other Objective-C
+ classes a prototype will be created. The prototype for a given
+ Objective-C class will have its internal [Prototype] property set to point to
+ the prototype created for the Objective-C class's superclass. As such the
+ prototype chain for a JavaScript wrapper object will reflect the wrapped
+ Objective-C type's inheritance hierarchy.
+
+ JavaScriptCore also produces a constructor for each Objective-C class. The
+ constructor has a property named 'prototype' that references the prototype,
+ and the prototype has a property named 'constructor' that references the
+ constructor.
+
+ By default JavaScriptCore does not export any methods or properties from an
+ Objective-C class to JavaScript; however methods and properties may be exported
+ explicitly using JSExport. For each protocol that a class conforms to, if the
+ protocol incorporates the protocol JSExport, JavaScriptCore exports the methods
+ and properties in that protocol to JavaScript
+
+ For each exported instance method JavaScriptCore will assign a corresponding
+ JavaScript function to the prototype. For each exported Objective-C property
+ JavaScriptCore will assign a corresponding JavaScript accessor to the prototype.
+ For each exported class method JavaScriptCore will assign a corresponding
+ JavaScript function to the constructor. For example:
+
+<pre>
+@textblock
+    @protocol MyClassJavaScriptMethods <JSExport>
+    - (void)foo;
+    @end
+
+    @interface MyClass : NSObject <MyClassJavaScriptMethods>
+    - (void)foo;
+    - (void)bar;
+    @end
+@/textblock
+</pre>
+
+ Data properties that are created on the prototype or constructor objects have
+ the attributes: <code>writable:true</code>, <code>enumerable:false</code>, <code>configurable:true</code>. 
+ Accessor properties have the attributes: <code>enumerable:false</code> and <code>configurable:true</code>.
+
+ If an instance of <code>MyClass</code> is converted to a JavaScript value, the resulting
+ wrapper object will (via its prototype) export the method <code>foo</code> to JavaScript,
+ since the class conforms to the <code>MyClassJavaScriptMethods</code> protocol, and this
+ protocol incorporates <code>JSExport</code>. <code>bar</code> will not be exported.
+
+ JSExport supports properties, arguments, and return values of the following types:
+
+ Primitive numbers: signed values up to 32-bits convert using JSValue's
+ valueWithInt32/toInt32. Unsigned values up to 32-bits convert using JSValue's
+ valueWithUInt32/toUInt32. All other numeric values convert using JSValue's
+ valueWithDouble/toDouble.
+
+ BOOL: values convert using JSValue's valueWithBool/toBool.
+
+ id: values convert using JSValue's valueWithObject/toObject.
+
+ Objective-C instance pointers: Pointers convert using JSValue's
+ valueWithObjectOfClass/toObject.
+
+ C structs: C structs for CGPoint, NSRange, CGRect, and CGSize convert using
+ JSValue's appropriate methods. Other C structs are not supported.
+
+ Blocks: Blocks convert using JSValue's valueWithObject/toObject.
+
+ All objects that conform to JSExport convert to JavaScript wrapper objects,
+ even if they subclass classes that would otherwise behave differently. For
+ example, if a subclass of NSString conforms to JSExport, it converts to
+ JavaScript as a wrapper object rather than a JavaScript string.
+*/
+@protocol JSExport
+@end
+
+/*!
+@define
+@abstract Rename a selector when it's exported to JavaScript.
+@discussion When a selector that takes one or more arguments is converted to a JavaScript
+ property name, by default a property name will be generated by performing the
+ following conversion:
+
+  - All colons are removed from the selector
+
+  - Any lowercase letter that had followed a colon will be capitalized.
+
+ Under the default conversion a selector <code>doFoo:withBar:</code> will be exported as
+ <code>doFooWithBar</code>. The default conversion may be overriden using the JSExportAs
+ macro, for example to export a method <code>doFoo:withBar:</code> as <code>doFoo</code>:
+
+<pre>
+@textblock
+    @protocol MyClassJavaScriptMethods <JSExport>
+    JSExportAs(doFoo,
+    - (void)doFoo:(id)foo withBar:(id)bar
+    );
+    @end
+@/textblock
+</pre>
+
+ Note that the JSExport macro may only be applied to a selector that takes one
+ or more argument.
+*/
+#define JSExportAs(PropertyName, Selector) \
+    @optional Selector __JS_EXPORT_AS__##PropertyName:(id)argument; @required Selector
+
+#endif
diff --git a/API/JSManagedValue.h b/API/JSManagedValue.h
new file mode 100644
index 0000000..01073fa
--- /dev/null
+++ b/API/JSManagedValue.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSManagedValue_h
+#define JSManagedValue_h
+
+#import <JavaScriptCore/JSBase.h>
+#import <JavaScriptCore/WebKitAvailability.h>
+
+#if JSC_OBJC_API_ENABLED
+
+@class JSValue;
+@class JSContext;
+
+/*!
+@interface
+@discussion JSManagedValue represents a "conditionally retained" JSValue. 
+ "Conditionally retained" means that as long as the JSManagedValue's 
+ JSValue is reachable through the JavaScript object graph,
+ or through the Objective-C object graph reported to the JSVirtualMachine using
+ addManagedReference:withOwner:, the corresponding JSValue will 
+ be retained. However, if neither graph reaches the JSManagedValue, the 
+ corresponding JSValue will be released and set to nil.
+
+The primary use for a JSManagedValue is to store a JSValue in an Objective-C
+or Swift object that is exported to JavaScript. It is incorrect to store a JSValue
+in an object that is exported to JavaScript, since doing so creates a retain cycle.
+*/ 
+NS_CLASS_AVAILABLE(10_9, 7_0)
+@interface JSManagedValue : NSObject
+
+/*!
+@method
+@abstract Create a JSManagedValue from a JSValue.
+@result The new JSManagedValue.
+*/
++ (JSManagedValue *)managedValueWithValue:(JSValue *)value;
++ (JSManagedValue *)managedValueWithValue:(JSValue *)value andOwner:(id)owner NS_AVAILABLE(10_10, 8_0);
+
+/*!
+@method
+@abstract Create a JSManagedValue.
+@result The new JSManagedValue.
+*/
+- (instancetype)initWithValue:(JSValue *)value;
+
+/*!
+@property
+@abstract Get the JSValue from the JSManagedValue.
+@result The corresponding JSValue for this JSManagedValue or 
+ nil if the JSValue has been collected.
+*/
+@property (readonly, strong) JSValue *value;
+
+@end
+
+#endif // JSC_OBJC_API_ENABLED
+
+#endif // JSManagedValue_h
diff --git a/API/JSManagedValue.mm b/API/JSManagedValue.mm
new file mode 100644
index 0000000..038a682
--- /dev/null
+++ b/API/JSManagedValue.mm
@@ -0,0 +1,311 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#import "config.h"
+#import "JSManagedValue.h"
+
+#if JSC_OBJC_API_ENABLED
+
+#import "APICast.h"
+#import "Heap.h"
+#import "JSContextInternal.h"
+#import "JSValueInternal.h"
+#import "Weak.h"
+#import "WeakHandleOwner.h"
+#import "ObjcRuntimeExtras.h"
+#import "JSCInlines.h"
+#import <wtf/NeverDestroyed.h>
+#import <wtf/spi/cocoa/NSMapTableSPI.h>
+
+class JSManagedValueHandleOwner : public JSC::WeakHandleOwner {
+public:
+    void finalize(JSC::Handle<JSC::Unknown>, void* context) override;
+    bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::SlotVisitor&) override;
+};
+
+static JSManagedValueHandleOwner* managedValueHandleOwner()
+{
+    static NeverDestroyed<JSManagedValueHandleOwner> jsManagedValueHandleOwner;
+    return &jsManagedValueHandleOwner.get();
+}
+
+class WeakValueRef {
+public:
+    WeakValueRef()
+        : m_tag(NotSet)
+    {
+    }
+
+    ~WeakValueRef()
+    {
+        clear();
+    }
+
+    void clear()
+    {
+        switch (m_tag) {
+        case NotSet:
+            return;
+        case Primitive:
+            u.m_primitive = JSC::JSValue();
+            return;
+        case Object:
+            u.m_object.clear();
+            return;
+        case String:
+            u.m_string.clear();
+            return;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    bool isClear() const
+    {
+        switch (m_tag) {
+        case NotSet:
+            return true;
+        case Primitive:
+            return !u.m_primitive;
+        case Object:
+            return !u.m_object;
+        case String:
+            return !u.m_string;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    bool isSet() const { return m_tag != NotSet; }
+    bool isPrimitive() const { return m_tag == Primitive; }
+    bool isObject() const { return m_tag == Object; }
+    bool isString() const { return m_tag == String; }
+
+    void setPrimitive(JSC::JSValue primitive)
+    {
+        ASSERT(!isSet());
+        ASSERT(!u.m_primitive);
+        ASSERT(primitive.isPrimitive());
+        m_tag = Primitive;
+        u.m_primitive = primitive;
+    }
+
+    void setObject(JSC::JSObject* object, void* context)
+    {
+        ASSERT(!isSet());
+        ASSERT(!u.m_object);
+        m_tag = Object;
+        JSC::Weak<JSC::JSObject> weak(object, managedValueHandleOwner(), context);
+        u.m_object.swap(weak);
+    }
+
+    void setString(JSC::JSString* string, void* context)
+    {
+        ASSERT(!isSet());
+        ASSERT(!u.m_object);
+        m_tag = String;
+        JSC::Weak<JSC::JSString> weak(string, managedValueHandleOwner(), context);
+        u.m_string.swap(weak);
+    }
+
+    JSC::JSObject* object()
+    {
+        ASSERT(isObject());
+        return u.m_object.get();
+    }
+
+    JSC::JSValue primitive()
+    {
+        ASSERT(isPrimitive());
+        return u.m_primitive;
+    }
+
+    JSC::JSString* string()
+    {
+        ASSERT(isString());
+        return u.m_string.get();
+    }
+
+private:
+    enum WeakTypeTag { NotSet, Primitive, Object, String };
+    WeakTypeTag m_tag;
+    union WeakValueUnion {
+    public:
+        WeakValueUnion ()
+            : m_primitive(JSC::JSValue())
+        {
+        }
+
+        ~WeakValueUnion()
+        {
+            ASSERT(!m_primitive);
+        }
+
+        JSC::JSValue m_primitive;
+        JSC::Weak<JSC::JSObject> m_object;
+        JSC::Weak<JSC::JSString> m_string;
+    } u;
+};
+
+@implementation JSManagedValue {
+    JSC::Weak<JSC::JSGlobalObject> m_globalObject;
+    RefPtr<JSC::JSLock> m_lock;
+    WeakValueRef m_weakValue;
+    NSMapTable *m_owners;
+}
+
++ (JSManagedValue *)managedValueWithValue:(JSValue *)value
+{
+    return [[[self alloc] initWithValue:value] autorelease];
+}
+
++ (JSManagedValue *)managedValueWithValue:(JSValue *)value andOwner:(id)owner
+{
+    JSManagedValue *managedValue = [[self alloc] initWithValue:value];
+    [value.context.virtualMachine addManagedReference:managedValue withOwner:owner];
+    return [managedValue autorelease];
+}
+
+- (instancetype)init
+{
+    return [self initWithValue:nil];
+}
+
+- (instancetype)initWithValue:(JSValue *)value
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    
+    if (!value)
+        return self;
+
+    JSC::ExecState* exec = toJS([value.context JSGlobalContextRef]);
+    JSC::JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    JSC::Weak<JSC::JSGlobalObject> weak(globalObject, managedValueHandleOwner(), self);
+    m_globalObject.swap(weak);
+
+    m_lock = &exec->vm().apiLock();
+
+    NSPointerFunctionsOptions weakIDOptions = NSPointerFunctionsWeakMemory | NSPointerFunctionsObjectPersonality;
+    NSPointerFunctionsOptions integerOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsIntegerPersonality;
+    m_owners = [[NSMapTable alloc] initWithKeyOptions:weakIDOptions valueOptions:integerOptions capacity:1];
+
+    JSC::JSValue jsValue = toJS(exec, [value JSValueRef]);
+    if (jsValue.isObject())
+        m_weakValue.setObject(JSC::jsCast<JSC::JSObject*>(jsValue.asCell()), self);
+    else if (jsValue.isString())
+        m_weakValue.setString(JSC::jsCast<JSC::JSString*>(jsValue.asCell()), self);
+    else
+        m_weakValue.setPrimitive(jsValue);
+    return self;
+}
+
+- (void)dealloc
+{
+    JSVirtualMachine *virtualMachine = [[[self value] context] virtualMachine];
+    if (virtualMachine) {
+        NSMapTable *copy = [m_owners copy];
+        for (id owner in [copy keyEnumerator]) {
+            size_t count = reinterpret_cast<size_t>(NSMapGet(m_owners, owner));
+            while (count--)
+                [virtualMachine removeManagedReference:self withOwner:owner];
+        }
+        [copy release];
+    }
+
+    [self disconnectValue];
+    [m_owners release];
+    [super dealloc];
+}
+
+- (void)didAddOwner:(id)owner
+{
+    size_t count = reinterpret_cast<size_t>(NSMapGet(m_owners, owner));
+    NSMapInsert(m_owners, owner, reinterpret_cast<void*>(count + 1));
+}
+
+- (void)didRemoveOwner:(id)owner
+{
+    size_t count = reinterpret_cast<size_t>(NSMapGet(m_owners, owner));
+
+    if (!count)
+        return;
+
+    if (count == 1) {
+        NSMapRemove(m_owners, owner);
+        return;
+    }
+
+    NSMapInsert(m_owners, owner, reinterpret_cast<void*>(count - 1));
+}
+
+- (JSValue *)value
+{
+    WTF::Locker<JSC::JSLock> locker(m_lock.get());
+    if (!m_lock->vm())
+        return nil;
+
+    JSC::JSLockHolder apiLocker(m_lock->vm());
+    if (!m_globalObject)
+        return nil;
+    if (m_weakValue.isClear())
+        return nil;
+    JSC::ExecState* exec = m_globalObject->globalExec();
+    JSContext *context = [JSContext contextWithJSGlobalContextRef:toGlobalRef(exec)];
+    JSC::JSValue value;
+    if (m_weakValue.isPrimitive())
+        value = m_weakValue.primitive();
+    else if (m_weakValue.isString())
+        value = m_weakValue.string();
+    else
+        value = m_weakValue.object();
+    return [JSValue valueWithJSValueRef:toRef(exec, value) inContext:context];
+}
+
+- (void)disconnectValue
+{
+    m_globalObject.clear();
+    m_weakValue.clear();
+}
+
+@end
+
+@interface JSManagedValue (PrivateMethods)
+- (void)disconnectValue;
+@end
+
+bool JSManagedValueHandleOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::SlotVisitor& visitor)
+{
+    JSManagedValue *managedValue = static_cast<JSManagedValue *>(context);
+    return visitor.containsOpaqueRoot(managedValue);
+}
+
+void JSManagedValueHandleOwner::finalize(JSC::Handle<JSC::Unknown>, void* context)
+{
+    JSManagedValue *managedValue = static_cast<JSManagedValue *>(context);
+    [managedValue disconnectValue];
+}
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/JSManagedValueInternal.h b/API/JSManagedValueInternal.h
new file mode 100644
index 0000000..2443fe5
--- /dev/null
+++ b/API/JSManagedValueInternal.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSManagedValueInternal_h
+#define JSManagedValueInternal_h
+
+#import <JavaScriptCore/JSBase.h>
+
+#if JSC_OBJC_API_ENABLED
+
+@interface JSManagedValue(Internal)
+
+- (void)didAddOwner:(id)owner;
+- (void)didRemoveOwner:(id)owner;
+
+@end
+
+#endif // JSC_OBJC_API_ENABLED
+
+#endif // JSManagedValueInternal_h
diff --git a/API/JSObjectRef.cpp b/API/JSObjectRef.cpp
new file mode 100644
index 0000000..87e7c77
--- /dev/null
+++ b/API/JSObjectRef.cpp
@@ -0,0 +1,669 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Kelvin W Sherlock (ksherlock@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSObjectRef.h"
+#include "JSObjectRefPrivate.h"
+
+#include "APICast.h"
+#include "APIUtils.h"
+#include "DateConstructor.h"
+#include "ErrorConstructor.h"
+#include "Exception.h"
+#include "FunctionConstructor.h"
+#include "Identifier.h"
+#include "InitializeThreading.h"
+#include "JSAPIWrapperObject.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "JSCallbackConstructor.h"
+#include "JSCallbackFunction.h"
+#include "JSCallbackObject.h"
+#include "JSClassRef.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+#include "JSRetainPtr.h"
+#include "JSString.h"
+#include "JSValueRef.h"
+#include "ObjectConstructor.h"
+#include "ObjectPrototype.h"
+#include "PropertyNameArray.h"
+#include "RegExpConstructor.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+#include "JSGlobalObjectInspectorController.h"
+#endif
+
+using namespace JSC;
+
+JSClassRef JSClassCreate(const JSClassDefinition* definition)
+{
+    initializeThreading();
+    auto jsClass = (definition->attributes & kJSClassAttributeNoAutomaticPrototype)
+        ? OpaqueJSClass::createNoAutomaticPrototype(definition)
+        : OpaqueJSClass::create(definition);
+    
+    return &jsClass.leakRef();
+}
+
+JSClassRef JSClassRetain(JSClassRef jsClass)
+{
+    jsClass->ref();
+    return jsClass;
+}
+
+void JSClassRelease(JSClassRef jsClass)
+{
+    jsClass->deref();
+}
+
+JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    if (!jsClass)
+        return toRef(constructEmptyObject(exec));
+
+    JSCallbackObject<JSDestructibleObject>* object = JSCallbackObject<JSDestructibleObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), jsClass, data);
+    if (JSObject* prototype = jsClass->prototype(exec))
+        object->setPrototypeDirect(exec->vm(), prototype);
+
+    return toRef(object);
+}
+
+JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name, JSObjectCallAsFunctionCallback callAsFunction)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    return toRef(JSCallbackFunction::create(exec->vm(), exec->lexicalGlobalObject(), callAsFunction, name ? name->string() : ASCIILiteral("anonymous")));
+}
+
+JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObjectCallAsConstructorCallback callAsConstructor)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsPrototype = jsClass ? jsClass->prototype(exec) : 0;
+    if (!jsPrototype)
+        jsPrototype = exec->lexicalGlobalObject()->objectPrototype();
+
+    JSCallbackConstructor* constructor = JSCallbackConstructor::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackConstructorStructure(), jsClass, callAsConstructor);
+    constructor->putDirect(exec->vm(), exec->propertyNames().prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
+    return toRef(constructor);
+}
+
+JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned parameterCount, const JSStringRef parameterNames[], JSStringRef body, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    startingLineNumber = std::max(1, startingLineNumber);
+    Identifier nameID = name ? name->identifier(&exec->vm()) : Identifier::fromString(exec, "anonymous");
+    
+    MarkedArgumentBuffer args;
+    for (unsigned i = 0; i < parameterCount; i++)
+        args.append(jsString(exec, parameterNames[i]->string()));
+    args.append(jsString(exec, body->string()));
+
+    JSObject* result = constructFunction(exec, exec->lexicalGlobalObject(), args, nameID, sourceURL ? sourceURL->string() : String(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        result = 0;
+    return toRef(result);
+}
+
+JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* result;
+    if (argumentCount) {
+        MarkedArgumentBuffer argList;
+        for (size_t i = 0; i < argumentCount; ++i)
+            argList.append(toJS(exec, arguments[i]));
+
+        result = constructArray(exec, static_cast<ArrayAllocationProfile*>(0), argList);
+    } else
+        result = constructEmptyArray(exec, 0);
+
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        result = 0;
+
+    return toRef(result);
+}
+
+JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    MarkedArgumentBuffer argList;
+    for (size_t i = 0; i < argumentCount; ++i)
+        argList.append(toJS(exec, arguments[i]));
+
+    JSObject* result = constructDate(exec, exec->lexicalGlobalObject(), JSValue(), argList);
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        result = 0;
+
+    return toRef(result);
+}
+
+JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue message = argumentCount ? toJS(exec, arguments[0]) : jsUndefined();
+    Structure* errorStructure = exec->lexicalGlobalObject()->errorStructure();
+    JSObject* result = ErrorInstance::create(exec, errorStructure, message);
+
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        result = 0;
+
+    return toRef(result);
+}
+
+JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[],  JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    MarkedArgumentBuffer argList;
+    for (size_t i = 0; i < argumentCount; ++i)
+        argList.append(toJS(exec, arguments[i]));
+
+    JSObject* result = constructRegExp(exec, exec->lexicalGlobalObject(), argList);
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        result = 0;
+    
+    return toRef(result);
+}
+
+JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* jsObject = toJS(object); 
+    return toRef(exec, jsObject->getPrototypeDirect());
+}
+
+void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* jsObject = toJS(object);
+    JSValue jsValue = toJS(exec, value);
+
+    if (JSProxy* proxy = jsDynamicCast<JSProxy*>(jsObject)) {
+        if (JSGlobalObject* globalObject = jsDynamicCast<JSGlobalObject*>(proxy->target())) {
+            globalObject->resetPrototype(exec->vm(), jsValue.isObject() ? jsValue : jsNull());
+            return;
+        }
+        // Someday we might use proxies for something other than JSGlobalObjects, but today is not that day.
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    jsObject->setPrototype(exec->vm(), exec, jsValue.isObject() ? jsValue : jsNull());
+}
+
+bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* jsObject = toJS(object);
+    
+    return jsObject->hasProperty(exec, propertyName->identifier(&exec->vm()));
+}
+
+JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* jsObject = toJS(object);
+
+    JSValue jsValue = jsObject->get(exec, propertyName->identifier(&exec->vm()));
+    handleExceptionIfNeeded(exec, exception);
+    return toRef(exec, jsValue);
+}
+
+void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSPropertyAttributes attributes, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    JSObject* jsObject = toJS(object);
+    Identifier name(propertyName->identifier(&exec->vm()));
+    JSValue jsValue = toJS(exec, value);
+
+    bool doesNotHaveProperty = attributes && !jsObject->hasProperty(exec, name);
+    if (LIKELY(!scope.exception())) {
+        if (doesNotHaveProperty) {
+            PropertyDescriptor desc(jsValue, attributes);
+            jsObject->methodTable()->defineOwnProperty(jsObject, exec, name, desc, false);
+        } else {
+            PutPropertySlot slot(jsObject);
+            jsObject->methodTable()->put(jsObject, exec, name, jsValue, slot);
+        }
+    }
+    handleExceptionIfNeeded(exec, exception);
+}
+
+JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* jsObject = toJS(object);
+
+    JSValue jsValue = jsObject->get(exec, propertyIndex);
+    handleExceptionIfNeeded(exec, exception);
+    return toRef(exec, jsValue);
+}
+
+
+void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef value, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* jsObject = toJS(object);
+    JSValue jsValue = toJS(exec, value);
+    
+    jsObject->methodTable()->putByIndex(jsObject, exec, propertyIndex, jsValue, false);
+    handleExceptionIfNeeded(exec, exception);
+}
+
+bool JSObjectDeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSObject* jsObject = toJS(object);
+
+    bool result = jsObject->methodTable()->deleteProperty(jsObject, exec, propertyName->identifier(&exec->vm()));
+    handleExceptionIfNeeded(exec, exception);
+    return result;
+}
+
+// API objects have private properties, which may get accessed during destruction. This
+// helper lets us get the ClassInfo of an API object from a function that may get called
+// during destruction.
+static const ClassInfo* classInfoPrivate(JSObject* jsObject)
+{
+    VM* vm = jsObject->vm();
+    
+    if (vm->currentlyDestructingCallbackObject != jsObject)
+        return jsObject->classInfo();
+
+    return vm->currentlyDestructingCallbackObjectClassInfo;
+}
+
+void* JSObjectGetPrivate(JSObjectRef object)
+{
+    JSObject* jsObject = uncheckedToJS(object);
+
+    const ClassInfo* classInfo = classInfoPrivate(jsObject);
+    
+    // Get wrapped object if proxied
+    if (classInfo->isSubClassOf(JSProxy::info())) {
+        jsObject = static_cast<JSProxy*>(jsObject)->target();
+        classInfo = jsObject->classInfo();
+    }
+
+    if (classInfo->isSubClassOf(JSCallbackObject<JSGlobalObject>::info()))
+        return static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivate();
+    if (classInfo->isSubClassOf(JSCallbackObject<JSDestructibleObject>::info()))
+        return static_cast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->getPrivate();
+#if JSC_OBJC_API_ENABLED
+    if (classInfo->isSubClassOf(JSCallbackObject<JSAPIWrapperObject>::info()))
+        return static_cast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->getPrivate();
+#endif
+    
+    return 0;
+}
+
+bool JSObjectSetPrivate(JSObjectRef object, void* data)
+{
+    JSObject* jsObject = uncheckedToJS(object);
+
+    const ClassInfo* classInfo = classInfoPrivate(jsObject);
+    
+    // Get wrapped object if proxied
+    if (classInfo->isSubClassOf(JSProxy::info())) {
+        jsObject = static_cast<JSProxy*>(jsObject)->target();
+        classInfo = jsObject->classInfo();
+    }
+
+    if (classInfo->isSubClassOf(JSCallbackObject<JSGlobalObject>::info())) {
+        static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivate(data);
+        return true;
+    }
+    if (classInfo->isSubClassOf(JSCallbackObject<JSDestructibleObject>::info())) {
+        static_cast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivate(data);
+        return true;
+    }
+#if JSC_OBJC_API_ENABLED
+    if (classInfo->isSubClassOf(JSCallbackObject<JSAPIWrapperObject>::info())) {
+        static_cast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->setPrivate(data);
+        return true;
+    }
+#endif
+        
+    return false;
+}
+
+JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    JSObject* jsObject = toJS(object);
+    JSValue result;
+    Identifier name(propertyName->identifier(&exec->vm()));
+
+    // Get wrapped object if proxied
+    if (jsObject->inherits(JSProxy::info()))
+        jsObject = jsCast<JSProxy*>(jsObject)->target();
+
+    if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info()))
+        result = jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivateProperty(name);
+    else if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info()))
+        result = jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->getPrivateProperty(name);
+#if JSC_OBJC_API_ENABLED
+    else if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info()))
+        result = jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->getPrivateProperty(name);
+#endif
+    return toRef(exec, result);
+}
+
+bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    JSObject* jsObject = toJS(object);
+    JSValue jsValue = value ? toJS(exec, value) : JSValue();
+    Identifier name(propertyName->identifier(&exec->vm()));
+
+    // Get wrapped object if proxied
+    if (jsObject->inherits(JSProxy::info()))
+        jsObject = jsCast<JSProxy*>(jsObject)->target();
+
+    if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) {
+        jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
+        return true;
+    }
+    if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info())) {
+        jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
+        return true;
+    }
+#if JSC_OBJC_API_ENABLED
+    if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info())) {
+        jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
+        return true;
+    }
+#endif
+    return false;
+}
+
+bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    JSObject* jsObject = toJS(object);
+    Identifier name(propertyName->identifier(&exec->vm()));
+
+    // Get wrapped object if proxied
+    if (jsObject->inherits(JSProxy::info()))
+        jsObject = jsCast<JSProxy*>(jsObject)->target();
+
+    if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) {
+        jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+    if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info())) {
+        jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+#if JSC_OBJC_API_ENABLED
+    if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info())) {
+        jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->deletePrivateProperty(name);
+        return true;
+    }
+#endif
+    return false;
+}
+
+bool JSObjectIsFunction(JSContextRef ctx, JSObjectRef object)
+{
+    if (!object)
+        return false;
+    JSLockHolder locker(toJS(ctx));
+    CallData callData;
+    JSCell* cell = toJS(object);
+    return cell->methodTable()->getCallData(cell, callData) != CallType::None;
+}
+
+JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    if (!object)
+        return 0;
+
+    JSObject* jsObject = toJS(object);
+    JSObject* jsThisObject = toJS(thisObject);
+
+    if (!jsThisObject)
+        jsThisObject = exec->globalThisValue();
+
+    MarkedArgumentBuffer argList;
+    for (size_t i = 0; i < argumentCount; i++)
+        argList.append(toJS(exec, arguments[i]));
+
+    CallData callData;
+    CallType callType = jsObject->methodTable()->getCallData(jsObject, callData);
+    if (callType == CallType::None)
+        return 0;
+
+    JSValueRef result = toRef(exec, profiledCall(exec, ProfilingReason::API, jsObject, callType, callData, jsThisObject, argList));
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        result = 0;
+    return result;
+}
+
+bool JSObjectIsConstructor(JSContextRef, JSObjectRef object)
+{
+    if (!object)
+        return false;
+    JSObject* jsObject = toJS(object);
+    ConstructData constructData;
+    return jsObject->methodTable()->getConstructData(jsObject, constructData) != ConstructType::None;
+}
+
+JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    if (!object)
+        return 0;
+
+    JSObject* jsObject = toJS(object);
+
+    ConstructData constructData;
+    ConstructType constructType = jsObject->methodTable()->getConstructData(jsObject, constructData);
+    if (constructType == ConstructType::None)
+        return 0;
+
+    MarkedArgumentBuffer argList;
+    for (size_t i = 0; i < argumentCount; i++)
+        argList.append(toJS(exec, arguments[i]));
+
+    JSObjectRef result = toRef(profiledConstruct(exec, ProfilingReason::API, jsObject, constructType, constructData, argList));
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        result = 0;
+    return result;
+}
+
+struct OpaqueJSPropertyNameArray {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    OpaqueJSPropertyNameArray(VM* vm)
+        : refCount(0)
+        , vm(vm)
+    {
+    }
+    
+    unsigned refCount;
+    VM* vm;
+    Vector<JSRetainPtr<JSStringRef>> array;
+};
+
+JSPropertyNameArrayRef JSObjectCopyPropertyNames(JSContextRef ctx, JSObjectRef object)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    VM* vm = &exec->vm();
+
+    JSObject* jsObject = toJS(object);
+    JSPropertyNameArrayRef propertyNames = new OpaqueJSPropertyNameArray(vm);
+    PropertyNameArray array(vm, PropertyNameMode::Strings);
+    jsObject->methodTable()->getPropertyNames(jsObject, exec, array, EnumerationMode());
+
+    size_t size = array.size();
+    propertyNames->array.reserveInitialCapacity(size);
+    for (size_t i = 0; i < size; ++i)
+        propertyNames->array.uncheckedAppend(JSRetainPtr<JSStringRef>(Adopt, OpaqueJSString::create(array[i].string()).leakRef()));
+    
+    return JSPropertyNameArrayRetain(propertyNames);
+}
+
+JSPropertyNameArrayRef JSPropertyNameArrayRetain(JSPropertyNameArrayRef array)
+{
+    ++array->refCount;
+    return array;
+}
+
+void JSPropertyNameArrayRelease(JSPropertyNameArrayRef array)
+{
+    if (--array->refCount == 0) {
+        JSLockHolder locker(array->vm);
+        delete array;
+    }
+}
+
+size_t JSPropertyNameArrayGetCount(JSPropertyNameArrayRef array)
+{
+    return array->array.size();
+}
+
+JSStringRef JSPropertyNameArrayGetNameAtIndex(JSPropertyNameArrayRef array, size_t index)
+{
+    return array->array[static_cast<unsigned>(index)].get();
+}
+
+void JSPropertyNameAccumulatorAddName(JSPropertyNameAccumulatorRef array, JSStringRef propertyName)
+{
+    PropertyNameArray* propertyNames = toJS(array);
+    JSLockHolder locker(propertyNames->vm());
+    propertyNames->add(propertyName->identifier(propertyNames->vm()));
+}
diff --git a/API/JSObjectRef.h b/API/JSObjectRef.h
new file mode 100644
index 0000000..95d53b7
--- /dev/null
+++ b/API/JSObjectRef.h
@@ -0,0 +1,694 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Kelvin W Sherlock (ksherlock@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSObjectRef_h
+#define JSObjectRef_h
+
+#include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/JSValueRef.h>
+#include <JavaScriptCore/WebKitAvailability.h>
+
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
+#include <stddef.h> /* for size_t */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+@enum JSPropertyAttribute
+@constant kJSPropertyAttributeNone         Specifies that a property has no special attributes.
+@constant kJSPropertyAttributeReadOnly     Specifies that a property is read-only.
+@constant kJSPropertyAttributeDontEnum     Specifies that a property should not be enumerated by JSPropertyEnumerators and JavaScript for...in loops.
+@constant kJSPropertyAttributeDontDelete   Specifies that the delete operation should fail on a property.
+*/
+enum { 
+    kJSPropertyAttributeNone         = 0,
+    kJSPropertyAttributeReadOnly     = 1 << 1,
+    kJSPropertyAttributeDontEnum     = 1 << 2,
+    kJSPropertyAttributeDontDelete   = 1 << 3
+};
+
+/*! 
+@typedef JSPropertyAttributes
+@abstract A set of JSPropertyAttributes. Combine multiple attributes by logically ORing them together.
+*/
+typedef unsigned JSPropertyAttributes;
+
+/*!
+@enum JSClassAttribute
+@constant kJSClassAttributeNone Specifies that a class has no special attributes.
+@constant kJSClassAttributeNoAutomaticPrototype Specifies that a class should not automatically generate a shared prototype for its instance objects. Use kJSClassAttributeNoAutomaticPrototype in combination with JSObjectSetPrototype to manage prototypes manually.
+*/
+enum { 
+    kJSClassAttributeNone = 0,
+    kJSClassAttributeNoAutomaticPrototype = 1 << 1
+};
+
+/*! 
+@typedef JSClassAttributes
+@abstract A set of JSClassAttributes. Combine multiple attributes by logically ORing them together.
+*/
+typedef unsigned JSClassAttributes;
+
+/*! 
+@typedef JSObjectInitializeCallback
+@abstract The callback invoked when an object is first created.
+@param ctx The execution context to use.
+@param object The JSObject being created.
+@discussion If you named your function Initialize, you would declare it like this:
+
+void Initialize(JSContextRef ctx, JSObjectRef object);
+
+Unlike the other object callbacks, the initialize callback is called on the least
+derived class (the parent class) first, and the most derived class last.
+*/
+typedef void
+(*JSObjectInitializeCallback) (JSContextRef ctx, JSObjectRef object);
+
+/*! 
+@typedef JSObjectFinalizeCallback
+@abstract The callback invoked when an object is finalized (prepared for garbage collection). An object may be finalized on any thread.
+@param object The JSObject being finalized.
+@discussion If you named your function Finalize, you would declare it like this:
+
+void Finalize(JSObjectRef object);
+
+The finalize callback is called on the most derived class first, and the least 
+derived class (the parent class) last.
+
+You must not call any function that may cause a garbage collection or an allocation
+of a garbage collected object from within a JSObjectFinalizeCallback. This includes
+all functions that have a JSContextRef parameter.
+*/
+typedef void            
+(*JSObjectFinalizeCallback) (JSObjectRef object);
+
+/*! 
+@typedef JSObjectHasPropertyCallback
+@abstract The callback invoked when determining whether an object has a property.
+@param ctx The execution context to use.
+@param object The JSObject to search for the property.
+@param propertyName A JSString containing the name of the property look up.
+@result true if object has the property, otherwise false.
+@discussion If you named your function HasProperty, you would declare it like this:
+
+bool HasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+If this function returns false, the hasProperty request forwards to object's statically declared properties, then its parent class chain (which includes the default object class), then its prototype chain.
+
+This callback enables optimization in cases where only a property's existence needs to be known, not its value, and computing its value would be expensive.
+
+If this callback is NULL, the getProperty callback will be used to service hasProperty requests.
+*/
+typedef bool
+(*JSObjectHasPropertyCallback) (JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+/*! 
+@typedef JSObjectGetPropertyCallback
+@abstract The callback invoked when getting a property's value.
+@param ctx The execution context to use.
+@param object The JSObject to search for the property.
+@param propertyName A JSString containing the name of the property to get.
+@param exception A pointer to a JSValueRef in which to return an exception, if any.
+@result The property's value if object has the property, otherwise NULL.
+@discussion If you named your function GetProperty, you would declare it like this:
+
+JSValueRef GetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception);
+
+If this function returns NULL, the get request forwards to object's statically declared properties, then its parent class chain (which includes the default object class), then its prototype chain.
+*/
+typedef JSValueRef
+(*JSObjectGetPropertyCallback) (JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception);
+
+/*! 
+@typedef JSObjectSetPropertyCallback
+@abstract The callback invoked when setting a property's value.
+@param ctx The execution context to use.
+@param object The JSObject on which to set the property's value.
+@param propertyName A JSString containing the name of the property to set.
+@param value A JSValue to use as the property's value.
+@param exception A pointer to a JSValueRef in which to return an exception, if any.
+@result true if the property was set, otherwise false.
+@discussion If you named your function SetProperty, you would declare it like this:
+
+bool SetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception);
+
+If this function returns false, the set request forwards to object's statically declared properties, then its parent class chain (which includes the default object class).
+*/
+typedef bool
+(*JSObjectSetPropertyCallback) (JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception);
+
+/*! 
+@typedef JSObjectDeletePropertyCallback
+@abstract The callback invoked when deleting a property.
+@param ctx The execution context to use.
+@param object The JSObject in which to delete the property.
+@param propertyName A JSString containing the name of the property to delete.
+@param exception A pointer to a JSValueRef in which to return an exception, if any.
+@result true if propertyName was successfully deleted, otherwise false.
+@discussion If you named your function DeleteProperty, you would declare it like this:
+
+bool DeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception);
+
+If this function returns false, the delete request forwards to object's statically declared properties, then its parent class chain (which includes the default object class).
+*/
+typedef bool
+(*JSObjectDeletePropertyCallback) (JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception);
+
+/*! 
+@typedef JSObjectGetPropertyNamesCallback
+@abstract The callback invoked when collecting the names of an object's properties.
+@param ctx The execution context to use.
+@param object The JSObject whose property names are being collected.
+@param propertyNames A JavaScript property name accumulator in which to accumulate the names of object's properties.
+@discussion If you named your function GetPropertyNames, you would declare it like this:
+
+void GetPropertyNames(JSContextRef ctx, JSObjectRef object, JSPropertyNameAccumulatorRef propertyNames);
+
+Property name accumulators are used by JSObjectCopyPropertyNames and JavaScript for...in loops. 
+
+Use JSPropertyNameAccumulatorAddName to add property names to accumulator. A class's getPropertyNames callback only needs to provide the names of properties that the class vends through a custom getProperty or setProperty callback. Other properties, including statically declared properties, properties vended by other classes, and properties belonging to object's prototype, are added independently.
+*/
+typedef void
+(*JSObjectGetPropertyNamesCallback) (JSContextRef ctx, JSObjectRef object, JSPropertyNameAccumulatorRef propertyNames);
+
+/*! 
+@typedef JSObjectCallAsFunctionCallback
+@abstract The callback invoked when an object is called as a function.
+@param ctx The execution context to use.
+@param function A JSObject that is the function being called.
+@param thisObject A JSObject that is the 'this' variable in the function's scope.
+@param argumentCount An integer count of the number of arguments in arguments.
+@param arguments A JSValue array of the  arguments passed to the function.
+@param exception A pointer to a JSValueRef in which to return an exception, if any.
+@result A JSValue that is the function's return value.
+@discussion If you named your function CallAsFunction, you would declare it like this:
+
+JSValueRef CallAsFunction(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+
+If your callback were invoked by the JavaScript expression 'myObject.myFunction()', function would be set to myFunction, and thisObject would be set to myObject.
+
+If this callback is NULL, calling your object as a function will throw an exception.
+*/
+typedef JSValueRef 
+(*JSObjectCallAsFunctionCallback) (JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+
+/*! 
+@typedef JSObjectCallAsConstructorCallback
+@abstract The callback invoked when an object is used as a constructor in a 'new' expression.
+@param ctx The execution context to use.
+@param constructor A JSObject that is the constructor being called.
+@param argumentCount An integer count of the number of arguments in arguments.
+@param arguments A JSValue array of the  arguments passed to the function.
+@param exception A pointer to a JSValueRef in which to return an exception, if any.
+@result A JSObject that is the constructor's return value.
+@discussion If you named your function CallAsConstructor, you would declare it like this:
+
+JSObjectRef CallAsConstructor(JSContextRef ctx, JSObjectRef constructor, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+
+If your callback were invoked by the JavaScript expression 'new myConstructor()', constructor would be set to myConstructor.
+
+If this callback is NULL, using your object as a constructor in a 'new' expression will throw an exception.
+*/
+typedef JSObjectRef 
+(*JSObjectCallAsConstructorCallback) (JSContextRef ctx, JSObjectRef constructor, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+
+/*! 
+@typedef JSObjectHasInstanceCallback
+@abstract hasInstance The callback invoked when an object is used as the target of an 'instanceof' expression.
+@param ctx The execution context to use.
+@param constructor The JSObject that is the target of the 'instanceof' expression.
+@param possibleInstance The JSValue being tested to determine if it is an instance of constructor.
+@param exception A pointer to a JSValueRef in which to return an exception, if any.
+@result true if possibleInstance is an instance of constructor, otherwise false.
+@discussion If you named your function HasInstance, you would declare it like this:
+
+bool HasInstance(JSContextRef ctx, JSObjectRef constructor, JSValueRef possibleInstance, JSValueRef* exception);
+
+If your callback were invoked by the JavaScript expression 'someValue instanceof myObject', constructor would be set to myObject and possibleInstance would be set to someValue.
+
+If this callback is NULL, 'instanceof' expressions that target your object will return false.
+
+Standard JavaScript practice calls for objects that implement the callAsConstructor callback to implement the hasInstance callback as well.
+*/
+typedef bool 
+(*JSObjectHasInstanceCallback)  (JSContextRef ctx, JSObjectRef constructor, JSValueRef possibleInstance, JSValueRef* exception);
+
+/*! 
+@typedef JSObjectConvertToTypeCallback
+@abstract The callback invoked when converting an object to a particular JavaScript type.
+@param ctx The execution context to use.
+@param object The JSObject to convert.
+@param type A JSType specifying the JavaScript type to convert to.
+@param exception A pointer to a JSValueRef in which to return an exception, if any.
+@result The objects's converted value, or NULL if the object was not converted.
+@discussion If you named your function ConvertToType, you would declare it like this:
+
+JSValueRef ConvertToType(JSContextRef ctx, JSObjectRef object, JSType type, JSValueRef* exception);
+
+If this function returns false, the conversion request forwards to object's parent class chain (which includes the default object class).
+
+This function is only invoked when converting an object to number or string. An object converted to boolean is 'true.' An object converted to object is itself.
+*/
+typedef JSValueRef
+(*JSObjectConvertToTypeCallback) (JSContextRef ctx, JSObjectRef object, JSType type, JSValueRef* exception);
+
+/*! 
+@struct JSStaticValue
+@abstract This structure describes a statically declared value property.
+@field name A null-terminated UTF8 string containing the property's name.
+@field getProperty A JSObjectGetPropertyCallback to invoke when getting the property's value.
+@field setProperty A JSObjectSetPropertyCallback to invoke when setting the property's value. May be NULL if the ReadOnly attribute is set.
+@field attributes A logically ORed set of JSPropertyAttributes to give to the property.
+*/
+typedef struct {
+    const char* name;
+    JSObjectGetPropertyCallback getProperty;
+    JSObjectSetPropertyCallback setProperty;
+    JSPropertyAttributes attributes;
+} JSStaticValue;
+
+/*! 
+@struct JSStaticFunction
+@abstract This structure describes a statically declared function property.
+@field name A null-terminated UTF8 string containing the property's name.
+@field callAsFunction A JSObjectCallAsFunctionCallback to invoke when the property is called as a function.
+@field attributes A logically ORed set of JSPropertyAttributes to give to the property.
+*/
+typedef struct {
+    const char* name;
+    JSObjectCallAsFunctionCallback callAsFunction;
+    JSPropertyAttributes attributes;
+} JSStaticFunction;
+
+/*!
+@struct JSClassDefinition
+@abstract This structure contains properties and callbacks that define a type of object. All fields other than the version field are optional. Any pointer may be NULL.
+@field version The version number of this structure. The current version is 0.
+@field attributes A logically ORed set of JSClassAttributes to give to the class.
+@field className A null-terminated UTF8 string containing the class's name.
+@field parentClass A JSClass to set as the class's parent class. Pass NULL use the default object class.
+@field staticValues A JSStaticValue array containing the class's statically declared value properties. Pass NULL to specify no statically declared value properties. The array must be terminated by a JSStaticValue whose name field is NULL.
+@field staticFunctions A JSStaticFunction array containing the class's statically declared function properties. Pass NULL to specify no statically declared function properties. The array must be terminated by a JSStaticFunction whose name field is NULL.
+@field initialize The callback invoked when an object is first created. Use this callback to initialize the object.
+@field finalize The callback invoked when an object is finalized (prepared for garbage collection). Use this callback to release resources allocated for the object, and perform other cleanup.
+@field hasProperty The callback invoked when determining whether an object has a property. If this field is NULL, getProperty is called instead. The hasProperty callback enables optimization in cases where only a property's existence needs to be known, not its value, and computing its value is expensive. 
+@field getProperty The callback invoked when getting a property's value.
+@field setProperty The callback invoked when setting a property's value.
+@field deleteProperty The callback invoked when deleting a property.
+@field getPropertyNames The callback invoked when collecting the names of an object's properties.
+@field callAsFunction The callback invoked when an object is called as a function.
+@field hasInstance The callback invoked when an object is used as the target of an 'instanceof' expression.
+@field callAsConstructor The callback invoked when an object is used as a constructor in a 'new' expression.
+@field convertToType The callback invoked when converting an object to a particular JavaScript type.
+@discussion The staticValues and staticFunctions arrays are the simplest and most efficient means for vending custom properties. Statically declared properties autmatically service requests like getProperty, setProperty, and getPropertyNames. Property access callbacks are required only to implement unusual properties, like array indexes, whose names are not known at compile-time.
+
+If you named your getter function "GetX" and your setter function "SetX", you would declare a JSStaticValue array containing "X" like this:
+
+JSStaticValue StaticValueArray[] = {
+    { "X", GetX, SetX, kJSPropertyAttributeNone },
+    { 0, 0, 0, 0 }
+};
+
+Standard JavaScript practice calls for storing function objects in prototypes, so they can be shared. The default JSClass created by JSClassCreate follows this idiom, instantiating objects with a shared, automatically generating prototype containing the class's function objects. The kJSClassAttributeNoAutomaticPrototype attribute specifies that a JSClass should not automatically generate such a prototype. The resulting JSClass instantiates objects with the default object prototype, and gives each instance object its own copy of the class's function objects.
+
+A NULL callback specifies that the default object callback should substitute, except in the case of hasProperty, where it specifies that getProperty should substitute.
+*/
+typedef struct {
+    int                                 version; /* current (and only) version is 0 */
+    JSClassAttributes                   attributes;
+
+    const char*                         className;
+    JSClassRef                          parentClass;
+        
+    const JSStaticValue*                staticValues;
+    const JSStaticFunction*             staticFunctions;
+    
+    JSObjectInitializeCallback          initialize;
+    JSObjectFinalizeCallback            finalize;
+    JSObjectHasPropertyCallback         hasProperty;
+    JSObjectGetPropertyCallback         getProperty;
+    JSObjectSetPropertyCallback         setProperty;
+    JSObjectDeletePropertyCallback      deleteProperty;
+    JSObjectGetPropertyNamesCallback    getPropertyNames;
+    JSObjectCallAsFunctionCallback      callAsFunction;
+    JSObjectCallAsConstructorCallback   callAsConstructor;
+    JSObjectHasInstanceCallback         hasInstance;
+    JSObjectConvertToTypeCallback       convertToType;
+} JSClassDefinition;
+
+/*! 
+@const kJSClassDefinitionEmpty 
+@abstract A JSClassDefinition structure of the current version, filled with NULL pointers and having no attributes.
+@discussion Use this constant as a convenience when creating class definitions. For example, to create a class definition with only a finalize method:
+
+JSClassDefinition definition = kJSClassDefinitionEmpty;
+definition.finalize = Finalize;
+*/
+JS_EXPORT extern const JSClassDefinition kJSClassDefinitionEmpty;
+
+/*!
+@function
+@abstract Creates a JavaScript class suitable for use with JSObjectMake.
+@param definition A JSClassDefinition that defines the class.
+@result A JSClass with the given definition. Ownership follows the Create Rule.
+*/
+JS_EXPORT JSClassRef JSClassCreate(const JSClassDefinition* definition);
+
+/*!
+@function
+@abstract Retains a JavaScript class.
+@param jsClass The JSClass to retain.
+@result A JSClass that is the same as jsClass.
+*/
+JS_EXPORT JSClassRef JSClassRetain(JSClassRef jsClass);
+
+/*!
+@function
+@abstract Releases a JavaScript class.
+@param jsClass The JSClass to release.
+*/
+JS_EXPORT void JSClassRelease(JSClassRef jsClass);
+
+/*!
+@function
+@abstract Creates a JavaScript object.
+@param ctx The execution context to use.
+@param jsClass The JSClass to assign to the object. Pass NULL to use the default object class.
+@param data A void* to set as the object's private data. Pass NULL to specify no private data.
+@result A JSObject with the given class and private data.
+@discussion The default object class does not allocate storage for private data, so you must provide a non-NULL jsClass to JSObjectMake if you want your object to be able to store private data.
+
+data is set on the created object before the intialize methods in its class chain are called. This enables the initialize methods to retrieve and manipulate data through JSObjectGetPrivate.
+*/
+JS_EXPORT JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data);
+
+/*!
+@function
+@abstract Convenience method for creating a JavaScript function with a given callback as its implementation.
+@param ctx The execution context to use.
+@param name A JSString containing the function's name. This will be used when converting the function to string. Pass NULL to create an anonymous function.
+@param callAsFunction The JSObjectCallAsFunctionCallback to invoke when the function is called.
+@result A JSObject that is a function. The object's prototype will be the default function prototype.
+*/
+JS_EXPORT JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name, JSObjectCallAsFunctionCallback callAsFunction);
+
+/*!
+@function
+@abstract Convenience method for creating a JavaScript constructor.
+@param ctx The execution context to use.
+@param jsClass A JSClass that is the class your constructor will assign to the objects its constructs. jsClass will be used to set the constructor's .prototype property, and to evaluate 'instanceof' expressions. Pass NULL to use the default object class.
+@param callAsConstructor A JSObjectCallAsConstructorCallback to invoke when your constructor is used in a 'new' expression. Pass NULL to use the default object constructor.
+@result A JSObject that is a constructor. The object's prototype will be the default object prototype.
+@discussion The default object constructor takes no arguments and constructs an object of class jsClass with no private data.
+*/
+JS_EXPORT JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObjectCallAsConstructorCallback callAsConstructor);
+
+/*!
+ @function
+ @abstract Creates a JavaScript Array object.
+ @param ctx The execution context to use.
+ @param argumentCount An integer count of the number of arguments in arguments.
+ @param arguments A JSValue array of data to populate the Array with. Pass NULL if argumentCount is 0.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result A JSObject that is an Array.
+ @discussion The behavior of this function does not exactly match the behavior of the built-in Array constructor. Specifically, if one argument 
+ is supplied, this function returns an array with one element.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+ @function
+ @abstract Creates a JavaScript Date object, as if by invoking the built-in Date constructor.
+ @param ctx The execution context to use.
+ @param argumentCount An integer count of the number of arguments in arguments.
+ @param arguments A JSValue array of arguments to pass to the Date Constructor. Pass NULL if argumentCount is 0.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result A JSObject that is a Date.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+ @function
+ @abstract Creates a JavaScript Error object, as if by invoking the built-in Error constructor.
+ @param ctx The execution context to use.
+ @param argumentCount An integer count of the number of arguments in arguments.
+ @param arguments A JSValue array of arguments to pass to the Error Constructor. Pass NULL if argumentCount is 0.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result A JSObject that is a Error.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+ @function
+ @abstract Creates a JavaScript RegExp object, as if by invoking the built-in RegExp constructor.
+ @param ctx The execution context to use.
+ @param argumentCount An integer count of the number of arguments in arguments.
+ @param arguments A JSValue array of arguments to pass to the RegExp Constructor. Pass NULL if argumentCount is 0.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result A JSObject that is a RegExp.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) CF_AVAILABLE(10_6, 7_0);
+
+/*!
+@function
+@abstract Creates a function with a given script as its body.
+@param ctx The execution context to use.
+@param name A JSString containing the function's name. This will be used when converting the function to string. Pass NULL to create an anonymous function.
+@param parameterCount An integer count of the number of parameter names in parameterNames.
+@param parameterNames A JSString array containing the names of the function's parameters. Pass NULL if parameterCount is 0.
+@param body A JSString containing the script to use as the function's body.
+@param sourceURL A JSString containing a URL for the script's source file. This is only used when reporting exceptions. Pass NULL if you do not care to include source file information in exceptions.
+@param startingLineNumber An integer value specifying the script's starting line number in the file located at sourceURL. This is only used when reporting exceptions. The value is one-based, so the first line is line 1 and invalid values are clamped to 1.
+@param exception A pointer to a JSValueRef in which to store a syntax error exception, if any. Pass NULL if you do not care to store a syntax error exception.
+@result A JSObject that is a function, or NULL if either body or parameterNames contains a syntax error. The object's prototype will be the default function prototype.
+@discussion Use this method when you want to execute a script repeatedly, to avoid the cost of re-parsing the script before each execution.
+*/
+JS_EXPORT JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned parameterCount, const JSStringRef parameterNames[], JSStringRef body, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception);
+
+/*!
+@function
+@abstract Gets an object's prototype.
+@param ctx  The execution context to use.
+@param object A JSObject whose prototype you want to get.
+@result A JSValue that is the object's prototype.
+*/
+JS_EXPORT JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object);
+
+/*!
+@function
+@abstract Sets an object's prototype.
+@param ctx  The execution context to use.
+@param object The JSObject whose prototype you want to set.
+@param value A JSValue to set as the object's prototype.
+*/
+JS_EXPORT void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value);
+
+/*!
+@function
+@abstract Tests whether an object has a given property.
+@param object The JSObject to test.
+@param propertyName A JSString containing the property's name.
+@result true if the object has a property whose name matches propertyName, otherwise false.
+*/
+JS_EXPORT bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+/*!
+@function
+@abstract Gets a property from an object.
+@param ctx The execution context to use.
+@param object The JSObject whose property you want to get.
+@param propertyName A JSString containing the property's name.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result The property's value if object has the property, otherwise the undefined value.
+*/
+JS_EXPORT JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception);
+
+/*!
+@function
+@abstract Sets a property on an object.
+@param ctx The execution context to use.
+@param object The JSObject whose property you want to set.
+@param propertyName A JSString containing the property's name.
+@param value A JSValue to use as the property's value.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@param attributes A logically ORed set of JSPropertyAttributes to give to the property.
+*/
+JS_EXPORT void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSPropertyAttributes attributes, JSValueRef* exception);
+
+/*!
+@function
+@abstract Deletes a property from an object.
+@param ctx The execution context to use.
+@param object The JSObject whose property you want to delete.
+@param propertyName A JSString containing the property's name.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result true if the delete operation succeeds, otherwise false (for example, if the property has the kJSPropertyAttributeDontDelete attribute set).
+*/
+JS_EXPORT bool JSObjectDeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception);
+
+/*!
+@function
+@abstract Gets a property from an object by numeric index.
+@param ctx The execution context to use.
+@param object The JSObject whose property you want to get.
+@param propertyIndex An integer value that is the property's name.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result The property's value if object has the property, otherwise the undefined value.
+@discussion Calling JSObjectGetPropertyAtIndex is equivalent to calling JSObjectGetProperty with a string containing propertyIndex, but JSObjectGetPropertyAtIndex provides optimized access to numeric properties.
+*/
+JS_EXPORT JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef* exception);
+
+/*!
+@function
+@abstract Sets a property on an object by numeric index.
+@param ctx The execution context to use.
+@param object The JSObject whose property you want to set.
+@param propertyIndex The property's name as a number.
+@param value A JSValue to use as the property's value.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@discussion Calling JSObjectSetPropertyAtIndex is equivalent to calling JSObjectSetProperty with a string containing propertyIndex, but JSObjectSetPropertyAtIndex provides optimized access to numeric properties.
+*/
+JS_EXPORT void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned propertyIndex, JSValueRef value, JSValueRef* exception);
+
+/*!
+@function
+@abstract Gets an object's private data.
+@param object A JSObject whose private data you want to get.
+@result A void* that is the object's private data, if the object has private data, otherwise NULL.
+*/
+JS_EXPORT void* JSObjectGetPrivate(JSObjectRef object);
+
+/*!
+@function
+@abstract Sets a pointer to private data on an object.
+@param object The JSObject whose private data you want to set.
+@param data A void* to set as the object's private data.
+@result true if object can store private data, otherwise false.
+@discussion The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private data.
+*/
+JS_EXPORT bool JSObjectSetPrivate(JSObjectRef object, void* data);
+
+/*!
+@function
+@abstract Tests whether an object can be called as a function.
+@param ctx  The execution context to use.
+@param object The JSObject to test.
+@result true if the object can be called as a function, otherwise false.
+*/
+JS_EXPORT bool JSObjectIsFunction(JSContextRef ctx, JSObjectRef object);
+
+/*!
+@function
+@abstract Calls an object as a function.
+@param ctx The execution context to use.
+@param object The JSObject to call as a function.
+@param thisObject The object to use as "this," or NULL to use the global object as "this."
+@param argumentCount An integer count of the number of arguments in arguments.
+@param arguments A JSValue array of arguments to pass to the function. Pass NULL if argumentCount is 0.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result The JSValue that results from calling object as a function, or NULL if an exception is thrown or object is not a function.
+*/
+JS_EXPORT JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+
+/*!
+@function
+@abstract Tests whether an object can be called as a constructor.
+@param ctx  The execution context to use.
+@param object The JSObject to test.
+@result true if the object can be called as a constructor, otherwise false.
+*/
+JS_EXPORT bool JSObjectIsConstructor(JSContextRef ctx, JSObjectRef object);
+
+/*!
+@function
+@abstract Calls an object as a constructor.
+@param ctx The execution context to use.
+@param object The JSObject to call as a constructor.
+@param argumentCount An integer count of the number of arguments in arguments.
+@param arguments A JSValue array of arguments to pass to the constructor. Pass NULL if argumentCount is 0.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result The JSObject that results from calling object as a constructor, or NULL if an exception is thrown or object is not a constructor.
+*/
+JS_EXPORT JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+
+/*!
+@function
+@abstract Gets the names of an object's enumerable properties.
+@param ctx The execution context to use.
+@param object The object whose property names you want to get.
+@result A JSPropertyNameArray containing the names object's enumerable properties. Ownership follows the Create Rule.
+*/
+JS_EXPORT JSPropertyNameArrayRef JSObjectCopyPropertyNames(JSContextRef ctx, JSObjectRef object);
+
+/*!
+@function
+@abstract Retains a JavaScript property name array.
+@param array The JSPropertyNameArray to retain.
+@result A JSPropertyNameArray that is the same as array.
+*/
+JS_EXPORT JSPropertyNameArrayRef JSPropertyNameArrayRetain(JSPropertyNameArrayRef array);
+
+/*!
+@function
+@abstract Releases a JavaScript property name array.
+@param array The JSPropetyNameArray to release.
+*/
+JS_EXPORT void JSPropertyNameArrayRelease(JSPropertyNameArrayRef array);
+
+/*!
+@function
+@abstract Gets a count of the number of items in a JavaScript property name array.
+@param array The array from which to retrieve the count.
+@result An integer count of the number of names in array.
+*/
+JS_EXPORT size_t JSPropertyNameArrayGetCount(JSPropertyNameArrayRef array);
+
+/*!
+@function
+@abstract Gets a property name at a given index in a JavaScript property name array.
+@param array The array from which to retrieve the property name.
+@param index The index of the property name to retrieve.
+@result A JSStringRef containing the property name.
+*/
+JS_EXPORT JSStringRef JSPropertyNameArrayGetNameAtIndex(JSPropertyNameArrayRef array, size_t index);
+
+/*!
+@function
+@abstract Adds a property name to a JavaScript property name accumulator.
+@param accumulator The accumulator object to which to add the property name.
+@param propertyName The property name to add.
+*/
+JS_EXPORT void JSPropertyNameAccumulatorAddName(JSPropertyNameAccumulatorRef accumulator, JSStringRef propertyName);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSObjectRef_h */
diff --git a/API/JSObjectRefPrivate.h b/API/JSObjectRefPrivate.h
new file mode 100644
index 0000000..32e80ab
--- /dev/null
+++ b/API/JSObjectRefPrivate.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSObjectRefPrivate_h
+#define JSObjectRefPrivate_h
+
+#include <JavaScriptCore/JSObjectRef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+ @function
+ @abstract Sets a private property on an object.  This private property cannot be accessed from within JavaScript.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to set.
+ @param propertyName A JSString containing the property's name.
+ @param value A JSValue to use as the property's value.  This may be NULL.
+ @result true if object can store private data, otherwise false.
+ @discussion This API allows you to store JS values directly an object in a way that will be ensure that they are kept alive without exposing them to JavaScript code and without introducing the reference cycles that may occur when using JSValueProtect.
+
+ The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private properties.
+ */
+JS_EXPORT bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value);
+
+/*!
+ @function
+ @abstract Gets a private property from an object.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to get.
+ @param propertyName A JSString containing the property's name.
+ @result The property's value if object has the property, otherwise NULL.
+ */
+JS_EXPORT JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+/*!
+ @function
+ @abstract Deletes a private property from an object.
+ @param ctx The execution context to use.
+ @param object The JSObject whose private property you want to delete.
+ @param propertyName A JSString containing the property's name.
+ @result true if object can store private data, otherwise false.
+ @discussion The default object class does not allocate storage for private data. Only objects created with a non-NULL JSClass can store private data.
+ */
+JS_EXPORT bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSObjectRefPrivate_h
diff --git a/API/JSRemoteInspector.cpp b/API/JSRemoteInspector.cpp
new file mode 100644
index 0000000..faebc5d
--- /dev/null
+++ b/API/JSRemoteInspector.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSRemoteInspector.h"
+
+#include "JSGlobalObjectConsoleClient.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+#include "RemoteInspector.h"
+#endif
+
+using namespace Inspector;
+
+static bool remoteInspectionEnabledByDefault = true;
+
+void JSRemoteInspectorDisableAutoStart(void)
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    RemoteInspector::startDisabled();
+#endif
+}
+
+void JSRemoteInspectorStart(void)
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    RemoteInspector::singleton();
+#endif
+}
+
+void JSRemoteInspectorSetParentProcessInformation(pid_t pid, const UInt8* auditData, size_t auditLength)
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    RetainPtr<CFDataRef> auditDataRef = adoptCF(CFDataCreate(kCFAllocatorDefault, auditData, auditLength));
+    RemoteInspector::singleton().setParentProcessInformation(pid, auditDataRef);
+#else
+    UNUSED_PARAM(pid);
+    UNUSED_PARAM(auditData);
+    UNUSED_PARAM(auditLength);
+#endif
+}
+
+void JSRemoteInspectorSetLogToSystemConsole(bool logToSystemConsole)
+{
+    JSGlobalObjectConsoleClient::setLogToSystemConsole(logToSystemConsole);
+}
+
+bool JSRemoteInspectorGetInspectionEnabledByDefault(void)
+{
+    return remoteInspectionEnabledByDefault;
+}
+
+void JSRemoteInspectorSetInspectionEnabledByDefault(bool enabledByDefault)
+{
+    remoteInspectionEnabledByDefault = enabledByDefault;
+}
diff --git a/API/JSRemoteInspector.h b/API/JSRemoteInspector.h
new file mode 100644
index 0000000..2bde479
--- /dev/null
+++ b/API/JSRemoteInspector.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSRemoteInspector_h
+#define JSRemoteInspector_h
+
+#include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/WebKitAvailability.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+JS_EXPORT void JSRemoteInspectorDisableAutoStart(void) CF_AVAILABLE(10_11, 9_0);
+JS_EXPORT void JSRemoteInspectorStart(void) CF_AVAILABLE(10_11, 9_0);
+JS_EXPORT void JSRemoteInspectorSetParentProcessInformation(pid_t, const uint8_t* auditData, size_t auditLength) CF_AVAILABLE(10_11, 9_0);
+
+JS_EXPORT void JSRemoteInspectorSetLogToSystemConsole(bool) CF_AVAILABLE(10_11, 9_0);
+
+JS_EXPORT bool JSRemoteInspectorGetInspectionEnabledByDefault(void) CF_AVAILABLE(10_11, 9_0);
+JS_EXPORT void JSRemoteInspectorSetInspectionEnabledByDefault(bool) CF_AVAILABLE(10_11, 9_0);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSRemoteInspector_h */
diff --git a/API/JSRetainPtr.h b/API/JSRetainPtr.h
new file mode 100644
index 0000000..e400840
--- /dev/null
+++ b/API/JSRetainPtr.h
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2005, 2006, 2007, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSRetainPtr_h
+#define JSRetainPtr_h
+
+#include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <algorithm>
+
+inline void JSRetain(JSStringRef string) { JSStringRetain(string); }
+inline void JSRelease(JSStringRef string) { JSStringRelease(string); }
+inline void JSRetain(JSGlobalContextRef context) { JSGlobalContextRetain(context); }
+inline void JSRelease(JSGlobalContextRef context) { JSGlobalContextRelease(context); }
+
+enum AdoptTag { Adopt };
+
+template<typename T> class JSRetainPtr {
+public:
+    JSRetainPtr() : m_ptr(0) { }
+    JSRetainPtr(T ptr) : m_ptr(ptr) { if (ptr) JSRetain(ptr); }
+    JSRetainPtr(AdoptTag, T ptr) : m_ptr(ptr) { }
+    JSRetainPtr(const JSRetainPtr&);
+    template<typename U> JSRetainPtr(const JSRetainPtr<U>&);
+    ~JSRetainPtr();
+    
+    T get() const { return m_ptr; }
+    
+    void clear();
+    T leakRef();
+
+    T operator->() const { return m_ptr; }
+    
+    bool operator!() const { return !m_ptr; }
+    explicit operator bool() const { return m_ptr; }
+
+    JSRetainPtr& operator=(const JSRetainPtr&);
+    template<typename U> JSRetainPtr& operator=(const JSRetainPtr<U>&);
+    JSRetainPtr& operator=(T);
+    template<typename U> JSRetainPtr& operator=(U*);
+
+    void adopt(T);
+    
+    void swap(JSRetainPtr&);
+
+private:
+    T m_ptr;
+};
+
+inline JSRetainPtr<JSStringRef> adopt(JSStringRef o)
+{
+    return JSRetainPtr<JSStringRef>(Adopt, o);
+}
+
+inline JSRetainPtr<JSGlobalContextRef> adopt(JSGlobalContextRef o)
+{
+    return JSRetainPtr<JSGlobalContextRef>(Adopt, o);
+}
+
+template<typename T> inline JSRetainPtr<T>::JSRetainPtr(const JSRetainPtr& o)
+    : m_ptr(o.m_ptr)
+{
+    if (m_ptr)
+        JSRetain(m_ptr);
+}
+
+template<typename T> template<typename U> inline JSRetainPtr<T>::JSRetainPtr(const JSRetainPtr<U>& o)
+    : m_ptr(o.get())
+{
+    if (m_ptr)
+        JSRetain(m_ptr);
+}
+
+template<typename T> inline JSRetainPtr<T>::~JSRetainPtr()
+{
+    if (m_ptr)
+        JSRelease(m_ptr);
+}
+
+template<typename T> inline void JSRetainPtr<T>::clear()
+{
+    if (T ptr = m_ptr) {
+        m_ptr = 0;
+        JSRelease(ptr);
+    }
+}
+
+template<typename T> inline T JSRetainPtr<T>::leakRef()
+{
+    T ptr = m_ptr;
+    m_ptr = 0;
+    return ptr;
+}
+
+template<typename T> inline JSRetainPtr<T>& JSRetainPtr<T>::operator=(const JSRetainPtr<T>& o)
+{
+    T optr = o.get();
+    if (optr)
+        JSRetain(optr);
+    T ptr = m_ptr;
+    m_ptr = optr;
+    if (ptr)
+        JSRelease(ptr);
+    return *this;
+}
+
+template<typename T> template<typename U> inline JSRetainPtr<T>& JSRetainPtr<T>::operator=(const JSRetainPtr<U>& o)
+{
+    T optr = o.get();
+    if (optr)
+        JSRetain(optr);
+    T ptr = m_ptr;
+    m_ptr = optr;
+    if (ptr)
+        JSRelease(ptr);
+    return *this;
+}
+
+template<typename T> inline JSRetainPtr<T>& JSRetainPtr<T>::operator=(T optr)
+{
+    if (optr)
+        JSRetain(optr);
+    T ptr = m_ptr;
+    m_ptr = optr;
+    if (ptr)
+        JSRelease(ptr);
+    return *this;
+}
+
+template<typename T> inline void JSRetainPtr<T>::adopt(T optr)
+{
+    T ptr = m_ptr;
+    m_ptr = optr;
+    if (ptr)
+        JSRelease(ptr);
+}
+
+template<typename T> template<typename U> inline JSRetainPtr<T>& JSRetainPtr<T>::operator=(U* optr)
+{
+    if (optr)
+        JSRetain(optr);
+    T ptr = m_ptr;
+    m_ptr = optr;
+    if (ptr)
+        JSRelease(ptr);
+    return *this;
+}
+
+template<typename T> inline void JSRetainPtr<T>::swap(JSRetainPtr<T>& o)
+{
+    std::swap(m_ptr, o.m_ptr);
+}
+
+template<typename T> inline void swap(JSRetainPtr<T>& a, JSRetainPtr<T>& b)
+{
+    a.swap(b);
+}
+
+template<typename T, typename U> inline bool operator==(const JSRetainPtr<T>& a, const JSRetainPtr<U>& b)
+{ 
+    return a.get() == b.get(); 
+}
+
+template<typename T, typename U> inline bool operator==(const JSRetainPtr<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template<typename T, typename U> inline bool operator==(T* a, const JSRetainPtr<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template<typename T, typename U> inline bool operator!=(const JSRetainPtr<T>& a, const JSRetainPtr<U>& b)
+{ 
+    return a.get() != b.get(); 
+}
+
+template<typename T, typename U> inline bool operator!=(const JSRetainPtr<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template<typename T, typename U> inline bool operator!=(T* a, const JSRetainPtr<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+
+#endif // JSRetainPtr_h
diff --git a/API/JSScriptRef.cpp b/API/JSScriptRef.cpp
new file mode 100644
index 0000000..306e046
--- /dev/null
+++ b/API/JSScriptRef.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "APICast.h"
+#include "Completion.h"
+#include "Exception.h"
+#include "JSBasePrivate.h"
+#include "VM.h"
+#include "JSScriptRefPrivate.h"
+#include "OpaqueJSString.h"
+#include "JSCInlines.h"
+#include "Parser.h"
+#include "SourceCode.h"
+#include "SourceProvider.h"
+
+using namespace JSC;
+
+struct OpaqueJSScript : public SourceProvider {
+public:
+    static WTF::RefPtr<OpaqueJSScript> create(VM* vm, const String& url, int startingLineNumber, const String& source)
+    {
+        return WTF::adoptRef(*new OpaqueJSScript(vm, url, startingLineNumber, source));
+    }
+
+    unsigned hash() const override
+    {
+        return m_source.get().hash();
+    }
+
+    StringView source() const override
+    {
+        return m_source.get();
+    }
+
+    VM* vm() const { return m_vm; }
+
+private:
+    OpaqueJSScript(VM* vm, const String& url, int startingLineNumber, const String& source)
+        : SourceProvider(url, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()), SourceProviderSourceType::Program)
+        , m_vm(vm)
+        , m_source(source.isNull() ? *StringImpl::empty() : *source.impl())
+    {
+    }
+
+    virtual ~OpaqueJSScript() { }
+
+    VM* m_vm;
+    Ref<StringImpl> m_source;
+};
+
+static bool parseScript(VM* vm, const SourceCode& source, ParserError& error)
+{
+    return !!JSC::parse<JSC::ProgramNode>(
+        vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin,
+        JSParserStrictMode::NotStrict, JSParserScriptMode::Classic, SourceParseMode::ProgramMode, SuperBinding::NotNeeded,
+        error);
+}
+
+extern "C" {
+
+JSScriptRef JSScriptCreateReferencingImmortalASCIIText(JSContextGroupRef contextGroup, JSStringRef url, int startingLineNumber, const char* source, size_t length, JSStringRef* errorMessage, int* errorLine)
+{
+    VM* vm = toJS(contextGroup);
+    JSLockHolder locker(vm);
+    for (size_t i = 0; i < length; i++) {
+        if (!isASCII(source[i]))
+            return 0;
+    }
+
+    startingLineNumber = std::max(1, startingLineNumber);
+
+    auto result = OpaqueJSScript::create(vm, url ? url->string() : String(), startingLineNumber, String(StringImpl::createFromLiteral(source, length)));
+
+    ParserError error;
+    if (!parseScript(vm, SourceCode(result), error)) {
+        if (errorMessage)
+            *errorMessage = OpaqueJSString::create(error.message()).leakRef();
+        if (errorLine)
+            *errorLine = error.line();
+        return nullptr;
+    }
+
+    return result.leakRef();
+}
+
+JSScriptRef JSScriptCreateFromString(JSContextGroupRef contextGroup, JSStringRef url, int startingLineNumber, JSStringRef source, JSStringRef* errorMessage, int* errorLine)
+{
+    VM* vm = toJS(contextGroup);
+    JSLockHolder locker(vm);
+
+    startingLineNumber = std::max(1, startingLineNumber);
+
+    auto result = OpaqueJSScript::create(vm, url ? url->string() : String(), startingLineNumber, source->string());
+
+    ParserError error;
+    if (!parseScript(vm, SourceCode(result), error)) {
+        if (errorMessage)
+            *errorMessage = OpaqueJSString::create(error.message()).leakRef();
+        if (errorLine)
+            *errorLine = error.line();
+        return nullptr;
+    }
+
+    return result.leakRef();
+}
+
+void JSScriptRetain(JSScriptRef script)
+{
+    JSLockHolder locker(script->vm());
+    script->ref();
+}
+
+void JSScriptRelease(JSScriptRef script)
+{
+    JSLockHolder locker(script->vm());
+    script->deref();
+}
+
+JSValueRef JSScriptEvaluate(JSContextRef context, JSScriptRef script, JSValueRef thisValueRef, JSValueRef* exception)
+{
+    ExecState* exec = toJS(context);
+    JSLockHolder locker(exec);
+    if (script->vm() != &exec->vm()) {
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+    NakedPtr<Exception> internalException;
+    JSValue thisValue = thisValueRef ? toJS(exec, thisValueRef) : jsUndefined();
+    JSValue result = evaluate(exec, SourceCode(script), thisValue, internalException);
+    if (internalException) {
+        if (exception)
+            *exception = toRef(exec, internalException->value());
+        return 0;
+    }
+    ASSERT(result);
+    return toRef(exec, result);
+}
+
+}
diff --git a/API/JSScriptRefPrivate.h b/API/JSScriptRefPrivate.h
new file mode 100644
index 0000000..e6224ce
--- /dev/null
+++ b/API/JSScriptRefPrivate.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSScriptRefPrivate_h
+#define JSScriptRefPrivate_h
+
+#include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+
+/*! @typedef JSScriptRef A JavaScript script reference. */
+typedef struct OpaqueJSScript* JSScriptRef;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+ @function
+ @abstract Creates a script reference from an ascii string, without copying or taking ownership of the string
+ @param contextGroup The context group the script is to be used in.
+ @param url The source url to be reported in errors and exceptions.
+ @param startingLineNumber An integer value specifying the script's starting line number in the file located at sourceURL. This is only used when reporting exceptions. The value is one-based, so the first line is line 1 and invalid values are clamped to 1.
+ @param source The source string.  This is required to be pure ASCII and to never be deallocated.
+ @param length The length of the source string.
+ @param errorMessage A pointer to a JSStringRef in which to store the parse error message if the source is not valid. Pass NULL if you do not care to store an error message.
+ @param errorLine A pointer to an int in which to store the line number of a parser error. Pass NULL if you do not care to store an error line.
+ @result A JSScriptRef for the provided source, or NULL if any non-ASCII character is found in source or if the source is not a valid JavaScript program. Ownership follows the Create Rule.
+ @discussion Use this function to create a reusable script reference with a constant
+ buffer as the backing string.  The source string must outlive the global context.
+ */
+JS_EXPORT JSScriptRef JSScriptCreateReferencingImmortalASCIIText(JSContextGroupRef contextGroup, JSStringRef url, int startingLineNumber, const char* source, size_t length, JSStringRef* errorMessage, int* errorLine);
+
+/*!
+ @function
+ @abstract Creates a script reference from a string
+ @param contextGroup The context group the script is to be used in.
+ @param url The source url to be reported in errors and exceptions.
+ @param startingLineNumber An integer value specifying the script's starting line number in the file located at sourceURL. This is only used when reporting exceptions. The value is one-based, so the first line is line 1 and invalid values are clamped to 1.
+ @param source The source string.
+ @param errorMessage A pointer to a JSStringRef in which to store the parse error message if the source is not valid. Pass NULL if you do not care to store an error message.
+ @param errorLine A pointer to an int in which to store the line number of a parser error. Pass NULL if you do not care to store an error line.
+ @result A JSScriptRef for the provided source, or NULL is the source is not a valid JavaScript program.  Ownership follows the Create Rule.
+ */
+JS_EXPORT JSScriptRef JSScriptCreateFromString(JSContextGroupRef contextGroup, JSStringRef url, int startingLineNumber, JSStringRef source, JSStringRef* errorMessage, int* errorLine);
+
+/*!
+ @function
+ @abstract Retains a JavaScript script.
+ @param script The script to retain.
+ */
+JS_EXPORT void JSScriptRetain(JSScriptRef script);
+
+/*!
+ @function
+ @abstract Releases a JavaScript script.
+ @param script The script to release.
+ */
+JS_EXPORT void JSScriptRelease(JSScriptRef script);
+
+/*!
+ @function
+ @abstract Evaluates a JavaScript script.
+ @param ctx The execution context to use.
+ @param script The JSScript to evaluate.
+ @param thisValue The value to use as "this" when evaluating the script.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result The JSValue that results from evaluating script, or NULL if an exception is thrown.
+ */
+JS_EXPORT JSValueRef JSScriptEvaluate(JSContextRef ctx, JSScriptRef script, JSValueRef thisValue, JSValueRef* exception);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSScriptRefPrivate_h */
diff --git a/API/JSStringRef.cpp b/API/JSStringRef.cpp
new file mode 100644
index 0000000..c9b380c
--- /dev/null
+++ b/API/JSStringRef.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSStringRef.h"
+#include "JSStringRefPrivate.h"
+
+#include "InitializeThreading.h"
+#include "OpaqueJSString.h"
+#include <wtf/unicode/UTF8.h>
+
+using namespace JSC;
+using namespace WTF::Unicode;
+
+JSStringRef JSStringCreateWithCharacters(const JSChar* chars, size_t numChars)
+{
+    initializeThreading();
+    return &OpaqueJSString::create(chars, numChars).leakRef();
+}
+
+JSStringRef JSStringCreateWithUTF8CString(const char* string)
+{
+    initializeThreading();
+    if (string) {
+        size_t length = strlen(string);
+        Vector<UChar, 1024> buffer(length);
+        UChar* p = buffer.data();
+        bool sourceIsAllASCII;
+        const LChar* stringStart = reinterpret_cast<const LChar*>(string);
+        if (conversionOK == convertUTF8ToUTF16(&string, string + length, &p, p + length, &sourceIsAllASCII)) {
+            if (sourceIsAllASCII)
+                return &OpaqueJSString::create(stringStart, length).leakRef();
+            return &OpaqueJSString::create(buffer.data(), p - buffer.data()).leakRef();
+        }
+    }
+
+    return &OpaqueJSString::create().leakRef();
+}
+
+JSStringRef JSStringCreateWithCharactersNoCopy(const JSChar* chars, size_t numChars)
+{
+    initializeThreading();
+    return OpaqueJSString::create(StringImpl::createWithoutCopying(chars, numChars)).leakRef();
+}
+
+JSStringRef JSStringRetain(JSStringRef string)
+{
+    string->ref();
+    return string;
+}
+
+void JSStringRelease(JSStringRef string)
+{
+    string->deref();
+}
+
+size_t JSStringGetLength(JSStringRef string)
+{
+    if (!string)
+        return 0;
+    return string->length();
+}
+
+const JSChar* JSStringGetCharactersPtr(JSStringRef string)
+{
+    if (!string)
+        return nullptr;
+    return string->characters();
+}
+
+size_t JSStringGetMaximumUTF8CStringSize(JSStringRef string)
+{
+    // Any UTF8 character > 3 bytes encodes as a UTF16 surrogate pair.
+    return string->length() * 3 + 1; // + 1 for terminating '\0'
+}
+
+size_t JSStringGetUTF8CString(JSStringRef string, char* buffer, size_t bufferSize)
+{
+    if (!string || !buffer || !bufferSize)
+        return 0;
+
+    char* destination = buffer;
+    ConversionResult result;
+    if (string->is8Bit()) {
+        const LChar* source = string->characters8();
+        result = convertLatin1ToUTF8(&source, source + string->length(), &destination, destination + bufferSize - 1);
+    } else {
+        const UChar* source = string->characters16();
+        result = convertUTF16ToUTF8(&source, source + string->length(), &destination, destination + bufferSize - 1, true);
+    }
+
+    *destination++ = '\0';
+    if (result != conversionOK && result != targetExhausted)
+        return 0;
+
+    return destination - buffer;
+}
+
+bool JSStringIsEqual(JSStringRef a, JSStringRef b)
+{
+    return OpaqueJSString::equal(a, b);
+}
+
+bool JSStringIsEqualToUTF8CString(JSStringRef a, const char* b)
+{
+    JSStringRef bBuf = JSStringCreateWithUTF8CString(b);
+    bool result = JSStringIsEqual(a, bBuf);
+    JSStringRelease(bBuf);
+    
+    return result;
+}
diff --git a/API/JSStringRef.h b/API/JSStringRef.h
new file mode 100644
index 0000000..bc03ed7
--- /dev/null
+++ b/API/JSStringRef.h
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSStringRef_h
+#define JSStringRef_h
+
+#include <JavaScriptCore/JSValueRef.h>
+
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
+#include <stddef.h> /* for size_t */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#if !defined(_NATIVE_WCHAR_T_DEFINED) /* MSVC */ \
+    && (!defined(__WCHAR_MAX__) || (__WCHAR_MAX__ > 0xffffU)) /* ISO C/C++ */ \
+    && (!defined(WCHAR_MAX) || (WCHAR_MAX > 0xffffU)) /* RVCT */
+/*!
+@typedef JSChar
+@abstract A UTF-16 code unit. One, or a sequence of two, can encode any Unicode
+ character. As with all scalar types, endianness depends on the underlying
+ architecture.
+*/
+    typedef unsigned short JSChar;
+#else
+    typedef wchar_t JSChar;
+#endif
+
+/*!
+@function
+@abstract         Creates a JavaScript string from a buffer of Unicode characters.
+@param chars      The buffer of Unicode characters to copy into the new JSString.
+@param numChars   The number of characters to copy from the buffer pointed to by chars.
+@result           A JSString containing chars. Ownership follows the Create Rule.
+*/
+JS_EXPORT JSStringRef JSStringCreateWithCharacters(const JSChar* chars, size_t numChars);
+/*!
+@function
+@abstract         Creates a JavaScript string from a null-terminated UTF8 string.
+@param string     The null-terminated UTF8 string to copy into the new JSString.
+@result           A JSString containing string. Ownership follows the Create Rule.
+*/
+JS_EXPORT JSStringRef JSStringCreateWithUTF8CString(const char* string);
+
+/*!
+@function
+@abstract         Retains a JavaScript string.
+@param string     The JSString to retain.
+@result           A JSString that is the same as string.
+*/
+JS_EXPORT JSStringRef JSStringRetain(JSStringRef string);
+/*!
+@function
+@abstract         Releases a JavaScript string.
+@param string     The JSString to release.
+*/
+JS_EXPORT void JSStringRelease(JSStringRef string);
+
+/*!
+@function
+@abstract         Returns the number of Unicode characters in a JavaScript string.
+@param string     The JSString whose length (in Unicode characters) you want to know.
+@result           The number of Unicode characters stored in string.
+*/
+JS_EXPORT size_t JSStringGetLength(JSStringRef string);
+/*!
+@function
+@abstract         Returns a pointer to the Unicode character buffer that 
+ serves as the backing store for a JavaScript string.
+@param string     The JSString whose backing store you want to access.
+@result           A pointer to the Unicode character buffer that serves as string's 
+ backing store, which will be deallocated when string is deallocated.
+*/
+JS_EXPORT const JSChar* JSStringGetCharactersPtr(JSStringRef string);
+
+/*!
+@function
+@abstract Returns the maximum number of bytes a JavaScript string will 
+ take up if converted into a null-terminated UTF8 string.
+@param string The JSString whose maximum converted size (in bytes) you 
+ want to know.
+@result The maximum number of bytes that could be required to convert string into a 
+ null-terminated UTF8 string. The number of bytes that the conversion actually ends 
+ up requiring could be less than this, but never more.
+*/
+JS_EXPORT size_t JSStringGetMaximumUTF8CStringSize(JSStringRef string);
+/*!
+@function
+@abstract Converts a JavaScript string into a null-terminated UTF8 string, 
+ and copies the result into an external byte buffer.
+@param string The source JSString.
+@param buffer The destination byte buffer into which to copy a null-terminated 
+ UTF8 representation of string. On return, buffer contains a UTF8 string 
+ representation of string. If bufferSize is too small, buffer will contain only 
+ partial results. If buffer is not at least bufferSize bytes in size, 
+ behavior is undefined. 
+@param bufferSize The size of the external buffer in bytes.
+@result The number of bytes written into buffer (including the null-terminator byte).
+*/
+JS_EXPORT size_t JSStringGetUTF8CString(JSStringRef string, char* buffer, size_t bufferSize);
+
+/*!
+@function
+@abstract     Tests whether two JavaScript strings match.
+@param a      The first JSString to test.
+@param b      The second JSString to test.
+@result       true if the two strings match, otherwise false.
+*/
+JS_EXPORT bool JSStringIsEqual(JSStringRef a, JSStringRef b);
+/*!
+@function
+@abstract     Tests whether a JavaScript string matches a null-terminated UTF8 string.
+@param a      The JSString to test.
+@param b      The null-terminated UTF8 string to test.
+@result       true if the two strings match, otherwise false.
+*/
+JS_EXPORT bool JSStringIsEqualToUTF8CString(JSStringRef a, const char* b);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSStringRef_h */
diff --git a/API/JSStringRefBSTR.cpp b/API/JSStringRefBSTR.cpp
new file mode 100644
index 0000000..e900d24
--- /dev/null
+++ b/API/JSStringRefBSTR.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */ 
+
+#include "config.h"
+#include "JSStringRefBSTR.h"
+
+#include "JSStringRef.h"
+
+JSStringRef JSStringCreateWithBSTR(BSTR string)
+{
+    return JSStringCreateWithCharacters(string ? string : L"", string ? SysStringLen(string) : 0);
+}
+
+BSTR JSStringCopyBSTR(const JSStringRef string)
+{
+    return SysAllocStringLen(JSStringGetCharactersPtr(string), JSStringGetLength(string));
+}
diff --git a/API/JSStringRefBSTR.h b/API/JSStringRefBSTR.h
new file mode 100644
index 0000000..066c68d
--- /dev/null
+++ b/API/JSStringRefBSTR.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSStringRefBSTR_h
+#define JSStringRefBSTR_h
+
+#include "JSBase.h"
+
+#include <windows.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* COM convenience methods */
+
+/*!
+@function
+@abstract         Creates a JavaScript string from a BSTR.
+@param string     The BSTR to copy into the new JSString.
+@result           A JSString containing string. Ownership follows the Create Rule.
+*/
+JS_EXPORT JSStringRef JSStringCreateWithBSTR(const BSTR string);
+
+/*!
+@function
+@abstract         Creates a BSTR from a JavaScript string.
+@param string     The JSString to copy into the new BSTR.
+@result           A BSTR containing string. Ownership follows the Create Rule.
+*/
+JS_EXPORT BSTR JSStringCopyBSTR(const JSStringRef string);
+    
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSStringRefBSTR_h */
diff --git a/API/JSStringRefCF.cpp b/API/JSStringRefCF.cpp
new file mode 100644
index 0000000..0587259
--- /dev/null
+++ b/API/JSStringRefCF.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSStringRefCF.h"
+
+#include "APICast.h"
+#include "InitializeThreading.h"
+#include "JSCJSValue.h"
+#include "JSStringRef.h"
+#include "OpaqueJSString.h"
+#include <wtf/StdLibExtras.h>
+
+JSStringRef JSStringCreateWithCFString(CFStringRef string)
+{
+    JSC::initializeThreading();
+
+    // We cannot use CFIndex here since CFStringGetLength can return values larger than
+    // it can hold.  (<rdar://problem/6806478>)
+    size_t length = CFStringGetLength(string);
+    if (!length)
+        return &OpaqueJSString::create(reinterpret_cast<const LChar*>(""), 0).leakRef();
+
+    Vector<LChar, 1024> lcharBuffer(length);
+    CFIndex usedBufferLength;
+    CFIndex convertedSize = CFStringGetBytes(string, CFRangeMake(0, length), kCFStringEncodingISOLatin1, 0, false, lcharBuffer.data(), length, &usedBufferLength);
+    if (static_cast<size_t>(convertedSize) == length && static_cast<size_t>(usedBufferLength) == length)
+        return &OpaqueJSString::create(lcharBuffer.data(), length).leakRef();
+
+    auto buffer = std::make_unique<UniChar[]>(length);
+    CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());
+    static_assert(sizeof(UniChar) == sizeof(UChar), "UniChar and UChar must be same size");
+    return &OpaqueJSString::create(reinterpret_cast<UChar*>(buffer.get()), length).leakRef();
+}
+
+CFStringRef JSStringCopyCFString(CFAllocatorRef allocator, JSStringRef string)
+{
+    if (!string || !string->length())
+        return CFSTR("");
+
+    if (string->is8Bit())
+        return CFStringCreateWithBytes(allocator, reinterpret_cast<const UInt8*>(string->characters8()), string->length(), kCFStringEncodingISOLatin1, false);
+
+    return CFStringCreateWithCharacters(allocator, reinterpret_cast<const UniChar*>(string->characters16()), string->length());
+}
diff --git a/API/JSStringRefCF.h b/API/JSStringRefCF.h
new file mode 100644
index 0000000..1e210c7
--- /dev/null
+++ b/API/JSStringRefCF.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSStringRefCF_h
+#define JSStringRefCF_h
+
+#include "JSBase.h"
+#include <CoreFoundation/CoreFoundation.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* CFString convenience methods */
+
+/*!
+@function
+@abstract         Creates a JavaScript string from a CFString.
+@discussion       This function is optimized to take advantage of cases when 
+ CFStringGetCharactersPtr returns a valid pointer.
+@param string     The CFString to copy into the new JSString.
+@result           A JSString containing string. Ownership follows the Create Rule.
+*/
+JS_EXPORT JSStringRef JSStringCreateWithCFString(CFStringRef string);
+/*!
+@function
+@abstract         Creates a CFString from a JavaScript string.
+@param alloc      The alloc parameter to pass to CFStringCreate.
+@param string     The JSString to copy into the new CFString.
+@result           A CFString containing string. Ownership follows the Create Rule.
+*/
+JS_EXPORT CFStringRef JSStringCopyCFString(CFAllocatorRef alloc, JSStringRef string) CF_RETURNS_RETAINED;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSStringRefCF_h */
diff --git a/API/JSStringRefPrivate.h b/API/JSStringRefPrivate.h
new file mode 100644
index 0000000..f1db806
--- /dev/null
+++ b/API/JSStringRefPrivate.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSStringRefPrivate_h
+#define JSStringRefPrivate_h
+
+#include <JavaScriptCore/JSStringRef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+JS_EXPORT JSStringRef JSStringCreateWithCharactersNoCopy(const JSChar* chars, size_t numChars);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSStringRefPrivate_h */
diff --git a/API/JSTypedArray.cpp b/API/JSTypedArray.cpp
new file mode 100644
index 0000000..14883da
--- /dev/null
+++ b/API/JSTypedArray.cpp
@@ -0,0 +1,331 @@
+/*
+ * Copyright (C) 2015 Dominic Szablewski (dominic@phoboslab.org)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSTypedArray.h"
+
+#include "APICast.h"
+#include "APIUtils.h"
+#include "ClassInfo.h"
+#include "Error.h"
+#include "JSArrayBufferViewInlines.h"
+#include "JSCInlines.h"
+#include "JSDataView.h"
+#include "JSGenericTypedArrayViewInlines.h"
+#include "JSTypedArrays.h"
+#include "TypedArrayController.h"
+#include <wtf/RefPtr.h>
+
+using namespace JSC;
+
+// Helper functions.
+
+inline JSTypedArrayType toJSTypedArrayType(TypedArrayType type)
+{
+    switch (type) {
+    case JSC::TypeDataView:
+    case NotTypedArray:
+        return kJSTypedArrayTypeNone;
+    case TypeInt8:
+        return kJSTypedArrayTypeInt8Array;
+    case TypeUint8:
+        return kJSTypedArrayTypeUint8Array;
+    case TypeUint8Clamped:
+        return kJSTypedArrayTypeUint8ClampedArray;
+    case TypeInt16:
+        return kJSTypedArrayTypeInt16Array;
+    case TypeUint16:
+        return kJSTypedArrayTypeUint16Array;
+    case TypeInt32:
+        return kJSTypedArrayTypeInt32Array;
+    case TypeUint32:
+        return kJSTypedArrayTypeUint32Array;
+    case TypeFloat32:
+        return kJSTypedArrayTypeFloat32Array;
+    case TypeFloat64:
+        return kJSTypedArrayTypeFloat64Array;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+inline TypedArrayType toTypedArrayType(JSTypedArrayType type)
+{
+    switch (type) {
+    case kJSTypedArrayTypeArrayBuffer:
+    case kJSTypedArrayTypeNone:
+        return NotTypedArray;
+    case kJSTypedArrayTypeInt8Array:
+        return TypeInt8;
+    case kJSTypedArrayTypeUint8Array:
+        return TypeUint8;
+    case kJSTypedArrayTypeUint8ClampedArray:
+        return TypeUint8Clamped;
+    case kJSTypedArrayTypeInt16Array:
+        return TypeInt16;
+    case kJSTypedArrayTypeUint16Array:
+        return TypeUint16;
+    case kJSTypedArrayTypeInt32Array:
+        return TypeInt32;
+    case kJSTypedArrayTypeUint32Array:
+        return TypeUint32;
+    case kJSTypedArrayTypeFloat32Array:
+        return TypeFloat32;
+    case kJSTypedArrayTypeFloat64Array:
+        return TypeFloat64;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+static JSObject* createTypedArray(ExecState* exec, JSTypedArrayType type, RefPtr<ArrayBuffer>&& buffer, size_t offset, size_t length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    if (!buffer) {
+        throwOutOfMemoryError(exec, scope);
+        return nullptr;
+    }
+    switch (type) {
+    case kJSTypedArrayTypeInt8Array:
+        return JSInt8Array::create(exec, globalObject->typedArrayStructure(TypeInt8), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeInt16Array:
+        return JSInt16Array::create(exec, globalObject->typedArrayStructure(TypeInt16), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeInt32Array:
+        return JSInt32Array::create(exec, globalObject->typedArrayStructure(TypeInt32), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeUint8Array:
+        return JSUint8Array::create(exec, globalObject->typedArrayStructure(TypeUint8), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeUint8ClampedArray:
+        return JSUint8ClampedArray::create(exec, globalObject->typedArrayStructure(TypeUint8Clamped), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeUint16Array:
+        return JSUint16Array::create(exec, globalObject->typedArrayStructure(TypeUint16), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeUint32Array:
+        return JSUint32Array::create(exec, globalObject->typedArrayStructure(TypeUint32), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeFloat32Array:
+        return JSFloat32Array::create(exec, globalObject->typedArrayStructure(TypeFloat32), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeFloat64Array:
+        return JSFloat64Array::create(exec, globalObject->typedArrayStructure(TypeFloat64), WTFMove(buffer), offset, length);
+    case kJSTypedArrayTypeArrayBuffer:
+    case kJSTypedArrayTypeNone:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    return nullptr;
+}
+
+// Implementations of the API functions.
+
+JSTypedArrayType JSValueGetTypedArrayType(JSContextRef ctx, JSValueRef valueRef, JSValueRef*)
+{
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue value = toJS(exec, valueRef);
+    if (!value.isObject())
+        return kJSTypedArrayTypeNone;
+    JSObject* object = value.getObject();
+
+    if (jsDynamicCast<JSArrayBuffer*>(object))
+        return kJSTypedArrayTypeArrayBuffer;
+
+    return toJSTypedArrayType(object->classInfo()->typedArrayStorageType);
+}
+
+JSObjectRef JSObjectMakeTypedArray(JSContextRef ctx, JSTypedArrayType arrayType, size_t length, JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)
+        return nullptr;
+
+    unsigned elementByteSize = elementSize(toTypedArrayType(arrayType));
+
+    auto buffer = ArrayBuffer::tryCreate(length, elementByteSize);
+    JSObject* result = createTypedArray(exec, arrayType, WTFMove(buffer), 0, length);
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        return nullptr;
+    return toRef(result);
+}
+
+JSObjectRef JSObjectMakeTypedArrayWithBytesNoCopy(JSContextRef ctx, JSTypedArrayType arrayType, void* bytes, size_t length, JSTypedArrayBytesDeallocator destructor, void* destructorContext, JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)
+        return nullptr;
+
+    unsigned elementByteSize = elementSize(toTypedArrayType(arrayType));
+
+    RefPtr<ArrayBuffer> buffer = ArrayBuffer::createFromBytes(bytes, length, [=](void* p) {
+        if (destructor)
+            destructor(p, destructorContext);
+    });
+    JSObject* result = createTypedArray(exec, arrayType, WTFMove(buffer), 0, length / elementByteSize);
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        return nullptr;
+    return toRef(result);
+}
+
+JSObjectRef JSObjectMakeTypedArrayWithArrayBuffer(JSContextRef ctx, JSTypedArrayType arrayType, JSObjectRef jsBufferRef, JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)
+        return nullptr;
+
+    JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(toJS(jsBufferRef));
+    if (!jsBuffer) {
+        setException(exec, exception, createTypeError(exec, "JSObjectMakeTypedArrayWithArrayBuffer expects buffer to be an Array Buffer object"));
+        return nullptr;
+    }
+
+    RefPtr<ArrayBuffer> buffer = jsBuffer->impl();
+    unsigned elementByteSize = elementSize(toTypedArrayType(arrayType));
+
+    JSObject* result = createTypedArray(exec, arrayType, WTFMove(buffer), 0, buffer->byteLength() / elementByteSize);
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        return nullptr;
+    return toRef(result);
+}
+
+JSObjectRef JSObjectMakeTypedArrayWithArrayBufferAndOffset(JSContextRef ctx, JSTypedArrayType arrayType, JSObjectRef jsBufferRef, size_t offset, size_t length, JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)
+        return nullptr;
+
+    JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(toJS(jsBufferRef));
+    if (!jsBuffer) {
+        setException(exec, exception, createTypeError(exec, "JSObjectMakeTypedArrayWithArrayBuffer expects buffer to be an Array Buffer object"));
+        return nullptr;
+    }
+
+    JSObject* result = createTypedArray(exec, arrayType, jsBuffer->impl(), offset, length);
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        return nullptr;
+    return toRef(result);
+}
+
+void* JSObjectGetTypedArrayBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    JSObject* object = toJS(objectRef);
+
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object)) {
+        ArrayBuffer* buffer = typedArray->possiblySharedBuffer();
+        buffer->pinAndLock();
+        return buffer->data();
+    }
+    return nullptr;
+}
+
+size_t JSObjectGetTypedArrayLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)
+{
+    JSObject* object = toJS(objectRef);
+
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object))
+        return typedArray->length();
+
+    return 0;
+}
+
+size_t JSObjectGetTypedArrayByteLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)
+{
+    JSObject* object = toJS(objectRef);
+
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object))
+        return typedArray->length() * elementSize(typedArray->classInfo()->typedArrayStorageType);
+
+    return 0;
+}
+
+size_t JSObjectGetTypedArrayByteOffset(JSContextRef, JSObjectRef objectRef, JSValueRef*)
+{
+    JSObject* object = toJS(objectRef);
+
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object))
+        return typedArray->byteOffset();
+
+    return 0;
+}
+
+JSObjectRef JSObjectGetTypedArrayBuffer(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    JSObject* object = toJS(objectRef);
+
+    if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(object))
+        return toRef(exec->vm().m_typedArrayController->toJS(exec, typedArray->globalObject(), typedArray->possiblySharedBuffer()));
+
+    return nullptr;
+}
+
+JSObjectRef JSObjectMakeArrayBufferWithBytesNoCopy(JSContextRef ctx, void* bytes, size_t byteLength, JSTypedArrayBytesDeallocator bytesDeallocator, void* deallocatorContext, JSValueRef* exception)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    auto buffer = ArrayBuffer::createFromBytes(bytes, byteLength, [=](void* p) {
+        if (bytesDeallocator)
+            bytesDeallocator(p, deallocatorContext);
+    });
+
+    JSArrayBuffer* jsBuffer = JSArrayBuffer::create(exec->vm(), exec->lexicalGlobalObject()->arrayBufferStructure(ArrayBufferSharingMode::Default), WTFMove(buffer));
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        return nullptr;
+
+    return toRef(jsBuffer);
+}
+
+void* JSObjectGetArrayBufferBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)
+{
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    JSObject* object = toJS(objectRef);
+
+    if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(object)) {
+        ArrayBuffer* buffer = jsBuffer->impl();
+        buffer->pinAndLock();
+        return buffer->data();
+    }
+    return nullptr;
+}
+
+size_t JSObjectGetArrayBufferByteLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)
+{
+    JSObject* object = toJS(objectRef);
+
+    if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(object))
+        return jsBuffer->impl()->byteLength();
+    
+    return 0;
+}
diff --git a/API/JSTypedArray.h b/API/JSTypedArray.h
new file mode 100644
index 0000000..e23b76d
--- /dev/null
+++ b/API/JSTypedArray.h
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) 2015 Dominic Szablewski (dominic@phoboslab.org)
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSTypedArray_h
+#define JSTypedArray_h
+
+#include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/JSValueRef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// ------------- Typed Array functions --------------
+
+/*!
+ @function
+ @abstract           Creates a JavaScript Typed Array object with the given number of elements.
+ @param ctx          The execution context to use.
+ @param arrayType    A value identifying the type of array to create. If arrayType is kJSTypedArrayTypeNone or kJSTypedArrayTypeArrayBuffer then NULL will be returned.
+ @param length       The number of elements to be in the new Typed Array.
+ @param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result             A JSObjectRef that is a Typed Array with all elements set to zero or NULL if there was an error.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeTypedArray(JSContextRef ctx, JSTypedArrayType arrayType, size_t length, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract                 Creates a JavaScript Typed Array object from an existing pointer.
+ @param ctx                The execution context to use.
+ @param arrayType          A value identifying the type of array to create. If arrayType is kJSTypedArrayTypeNone or kJSTypedArrayTypeArrayBuffer then NULL will be returned.
+ @param bytes              A pointer to the byte buffer to be used as the backing store of the Typed Array object.
+ @param byteLength         The number of bytes pointed to by the parameter bytes.
+ @param bytesDeallocator   The allocator to use to deallocate the external buffer when the JSTypedArrayData object is deallocated.
+ @param deallocatorContext A pointer to pass back to the deallocator.
+ @param exception          A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result                   A JSObjectRef Typed Array whose backing store is the same as the one pointed to by bytes or NULL if there was an error.
+ @discussion               If an exception is thrown during this function the bytesDeallocator will always be called.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeTypedArrayWithBytesNoCopy(JSContextRef ctx, JSTypedArrayType arrayType, void* bytes, size_t byteLength, JSTypedArrayBytesDeallocator bytesDeallocator, void* deallocatorContext, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract           Creates a JavaScript Typed Array object from an existing JavaScript Array Buffer object.
+ @param ctx          The execution context to use.
+ @param arrayType    A value identifying the type of array to create. If arrayType is kJSTypedArrayTypeNone or kJSTypedArrayTypeArrayBuffer then NULL will be returned.
+ @param buffer       An Array Buffer object that should be used as the backing store for the created JavaScript Typed Array object.
+ @param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result             A JSObjectRef that is a Typed Array or NULL if there was an error. The backing store of the Typed Array will be buffer.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeTypedArrayWithArrayBuffer(JSContextRef ctx, JSTypedArrayType arrayType, JSObjectRef buffer, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract           Creates a JavaScript Typed Array object from an existing JavaScript Array Buffer object with the given offset and length.
+ @param ctx          The execution context to use.
+ @param arrayType    A value identifying the type of array to create. If arrayType is kJSTypedArrayTypeNone or kJSTypedArrayTypeArrayBuffer then NULL will be returned.
+ @param buffer       An Array Buffer object that should be used as the backing store for the created JavaScript Typed Array object.
+ @param byteOffset   The byte offset for the created Typed Array. byteOffset should aligned with the element size of arrayType.
+ @param length       The number of elements to include in the Typed Array.
+ @param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result             A JSObjectRef that is a Typed Array or NULL if there was an error. The backing store of the Typed Array will be buffer.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeTypedArrayWithArrayBufferAndOffset(JSContextRef ctx, JSTypedArrayType arrayType, JSObjectRef buffer, size_t byteOffset, size_t length, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract           Returns a temporary pointer to the backing store of a JavaScript Typed Array object.
+ @param ctx          The execution context to use.
+ @param object       The Typed Array object whose backing store pointer to return.
+ @param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result             A pointer to the raw data buffer that serves as object's backing store or NULL if object is not a Typed Array object.
+ @discussion         The pointer returned by this function is temporary and is not guaranteed to remain valid across JavaScriptCore API calls.
+ */
+JS_EXPORT void* JSObjectGetTypedArrayBytesPtr(JSContextRef ctx, JSObjectRef object, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract           Returns the length of a JavaScript Typed Array object.
+ @param ctx          The execution context to use.
+ @param object       The Typed Array object whose length to return.
+ @param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result             The length of the Typed Array object or 0 if the object is not a Typed Array object.
+ */
+JS_EXPORT size_t JSObjectGetTypedArrayLength(JSContextRef ctx, JSObjectRef object, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract           Returns the byte length of a JavaScript Typed Array object.
+ @param ctx          The execution context to use.
+ @param object       The Typed Array object whose byte length to return.
+ @param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result             The byte length of the Typed Array object or 0 if the object is not a Typed Array object.
+ */
+JS_EXPORT size_t JSObjectGetTypedArrayByteLength(JSContextRef ctx, JSObjectRef object, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract           Returns the byte offset of a JavaScript Typed Array object.
+ @param ctx          The execution context to use.
+ @param object       The Typed Array object whose byte offset to return.
+ @param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result             The byte offset of the Typed Array object or 0 if the object is not a Typed Array object.
+ */
+JS_EXPORT size_t JSObjectGetTypedArrayByteOffset(JSContextRef ctx, JSObjectRef object, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract           Returns the JavaScript Array Buffer object that is used as the backing of a JavaScript Typed Array object.
+ @param ctx          The execution context to use.
+ @param object       The JSObjectRef whose Typed Array type data pointer to obtain.
+ @param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result             A JSObjectRef with a JSTypedArrayType of kJSTypedArrayTypeArrayBuffer or NULL if object is not a Typed Array.
+ */
+JS_EXPORT JSObjectRef JSObjectGetTypedArrayBuffer(JSContextRef ctx, JSObjectRef object, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+// ------------- Array Buffer functions -------------
+
+/*!
+ @function
+ @abstract                 Creates a JavaScript Array Buffer object from an existing pointer.
+ @param ctx                The execution context to use.
+ @param bytes              A pointer to the byte buffer to be used as the backing store of the Typed Array object.
+ @param byteLength         The number of bytes pointed to by the parameter bytes.
+ @param bytesDeallocator   The allocator to use to deallocate the external buffer when the Typed Array data object is deallocated.
+ @param deallocatorContext A pointer to pass back to the deallocator.
+ @param exception          A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result                   A JSObjectRef Array Buffer whose backing store is the same as the one pointed to by bytes or NULL if there was an error.
+ @discussion               If an exception is thrown during this function the bytesDeallocator will always be called.
+ */
+JS_EXPORT JSObjectRef JSObjectMakeArrayBufferWithBytesNoCopy(JSContextRef ctx, void* bytes, size_t byteLength, JSTypedArrayBytesDeallocator bytesDeallocator, void* deallocatorContext, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract         Returns a pointer to the data buffer that serves as the backing store for a JavaScript Typed Array object.
+ @param object     The Array Buffer object whose internal backing store pointer to return.
+ @param exception  A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result           A pointer to the raw data buffer that serves as object's backing store or NULL if object is not an Array Buffer object.
+ @discussion       The pointer returned by this function is temporary and is not guaranteed to remain valid across JavaScriptCore API calls.
+ */
+JS_EXPORT void* JSObjectGetArrayBufferBytesPtr(JSContextRef ctx, JSObjectRef object, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/*!
+ @function
+ @abstract         Returns the number of bytes in a JavaScript data object.
+ @param ctx        The execution context to use.
+ @param object     The JS Arary Buffer object whose length in bytes to return.
+ @param exception  A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result           The number of bytes stored in the data object.
+ */
+JS_EXPORT size_t JSObjectGetArrayBufferByteLength(JSContextRef ctx, JSObjectRef object, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSTypedArray_h */
diff --git a/API/JSValue.h b/API/JSValue.h
new file mode 100644
index 0000000..1410dd7
--- /dev/null
+++ b/API/JSValue.h
@@ -0,0 +1,668 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSValue_h
+#define JSValue_h
+
+#if JSC_OBJC_API_ENABLED
+
+#import <CoreGraphics/CGGeometry.h>
+
+@class JSContext;
+
+/*!
+@interface
+@discussion A JSValue is a reference to a JavaScript value. Every JSValue
+ originates from a JSContext and holds a strong reference to it.
+ When a JSValue instance method creates a new JSValue, the new value
+ originates from the same JSContext.
+
+ All JSValues values also originate from a JSVirtualMachine
+ (available indirectly via the context property). It is an error to pass a
+ JSValue to a method or property of a JSValue or JSContext originating from a
+ different JSVirtualMachine. Doing so will raise an Objective-C exception.
+*/
+NS_CLASS_AVAILABLE(10_9, 7_0)
+@interface JSValue : NSObject
+
+/*!
+@property
+@abstract The JSContext that this value originates from.
+*/
+@property (readonly, strong) JSContext *context;
+
+/*!
+@methodgroup Creating JavaScript Values
+*/
+/*!
+@method
+@abstract Create a JSValue by converting an Objective-C object.
+@discussion The resulting JSValue retains the provided Objective-C object.
+@param value The Objective-C object to be converted.
+@result The new JSValue.
+*/
++ (JSValue *)valueWithObject:(id)value inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a JavaScript value from a BOOL primitive.
+@param context The JSContext in which the resulting JSValue will be created.
+@result The new JSValue representing the equivalent boolean value.
+*/
++ (JSValue *)valueWithBool:(BOOL)value inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a JavaScript value from a double primitive.
+@param context The JSContext in which the resulting JSValue will be created.
+@result The new JSValue representing the equivalent boolean value.
+*/
++ (JSValue *)valueWithDouble:(double)value inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a JavaScript value from an <code>int32_t</code> primitive.
+@param context The JSContext in which the resulting JSValue will be created.
+@result The new JSValue representing the equivalent boolean value.
+*/
++ (JSValue *)valueWithInt32:(int32_t)value inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a JavaScript value from a <code>uint32_t</code> primitive.
+@param context The JSContext in which the resulting JSValue will be created.
+@result The new JSValue representing the equivalent boolean value.
+*/
++ (JSValue *)valueWithUInt32:(uint32_t)value inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a new, empty JavaScript object.
+@param context The JSContext in which the resulting object will be created.
+@result The new JavaScript object.
+*/
++ (JSValue *)valueWithNewObjectInContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a new, empty JavaScript array.
+@param context The JSContext in which the resulting array will be created.
+@result The new JavaScript array.
+*/
++ (JSValue *)valueWithNewArrayInContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a new JavaScript regular expression object.
+@param pattern The regular expression pattern.
+@param flags The regular expression flags.
+@param context The JSContext in which the resulting regular expression object will be created.
+@result The new JavaScript regular expression object.
+*/
++ (JSValue *)valueWithNewRegularExpressionFromPattern:(NSString *)pattern flags:(NSString *)flags inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a new JavaScript error object.
+@param message The error message.
+@param context The JSContext in which the resulting error object will be created.
+@result The new JavaScript error object.
+*/
++ (JSValue *)valueWithNewErrorFromMessage:(NSString *)message inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create the JavaScript value <code>null</code>.
+@param context The JSContext to which the resulting JSValue belongs.
+@result The JSValue representing the JavaScript value <code>null</code>.
+*/
++ (JSValue *)valueWithNullInContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create the JavaScript value <code>undefined</code>.
+@param context The JSContext to which the resulting JSValue belongs.
+@result The JSValue representing the JavaScript value <code>undefined</code>.
+*/
++ (JSValue *)valueWithUndefinedInContext:(JSContext *)context;
+
+/*!
+@methodgroup Converting to Objective-C Types
+@discussion When converting between JavaScript values and Objective-C objects a copy is
+ performed. Values of types listed below are copied to the corresponding
+ types on conversion in each direction. For NSDictionaries, entries in the
+ dictionary that are keyed by strings are copied onto a JavaScript object.
+ For dictionaries and arrays, conversion is recursive, with the same object
+ conversion being applied to all entries in the collection.
+
+<pre>
+@textblock
+   Objective-C type  |   JavaScript type
+ --------------------+---------------------
+         nil         |     undefined
+        NSNull       |        null
+       NSString      |       string
+       NSNumber      |   number, boolean
+     NSDictionary    |   Object object
+       NSArray       |    Array object
+        NSDate       |     Date object
+       NSBlock (1)   |   Function object (1)
+          id (2)     |   Wrapper object (2)
+        Class (3)    | Constructor object (3)
+@/textblock
+</pre>
+
+ (1) Instances of NSBlock with supported arguments types will be presented to
+ JavaScript as a callable Function object. For more information on supported
+ argument types see JSExport.h. If a JavaScript Function originating from an
+ Objective-C block is converted back to an Objective-C object the block will
+ be returned. All other JavaScript functions will be converted in the same
+ manner as a JavaScript object of type Object.
+
+ (2) For Objective-C instances that do not derive from the set of types listed
+ above, a wrapper object to provide a retaining handle to the Objective-C
+ instance from JavaScript. For more information on these wrapper objects, see
+ JSExport.h. When a JavaScript wrapper object is converted back to Objective-C
+ the Objective-C instance being retained by the wrapper is returned.
+
+ (3) For Objective-C Class objects a constructor object containing exported
+ class methods will be returned. See JSExport.h for more information on
+ constructor objects.
+
+ For all methods taking arguments of type id, arguments will be converted
+ into a JavaScript value according to the above conversion.
+*/
+/*!
+@method
+@abstract Convert this JSValue to an Objective-C object.
+@discussion The JSValue is converted to an Objective-C object according 
+ to the conversion rules specified above.
+@result The Objective-C representation of this JSValue.
+*/
+- (id)toObject;
+
+/*!
+@method
+@abstract Convert a JSValue to an Objective-C object of a specific class.
+@discussion The JSValue is converted to an Objective-C object of the specified Class. 
+ If the result is not of the specified Class then <code>nil</code> will be returned.
+@result An Objective-C object of the specified Class or <code>nil</code>.
+*/
+- (id)toObjectOfClass:(Class)expectedClass;
+
+/*!
+@method
+@abstract Convert a JSValue to a boolean.
+@discussion The JSValue is converted to a boolean according to the rules specified 
+ by the JavaScript language.
+@result The boolean result of the conversion.
+*/
+- (BOOL)toBool;
+
+/*!
+@method
+@abstract Convert a JSValue to a double.
+@discussion The JSValue is converted to a number according to the rules specified 
+ by the JavaScript language.
+@result The double result of the conversion.
+*/
+- (double)toDouble;
+
+/*!
+@method
+@abstract Convert a JSValue to an <code>int32_t</code>.
+@discussion The JSValue is converted to an integer according to the rules specified 
+ by the JavaScript language.
+@result The <code>int32_t</code> result of the conversion.
+*/
+- (int32_t)toInt32;
+
+/*!
+@method
+@abstract Convert a JSValue to a <code>uint32_t</code>.
+@discussion The JSValue is converted to an integer according to the rules specified 
+ by the JavaScript language.
+@result The <code>uint32_t</code> result of the conversion.
+*/
+- (uint32_t)toUInt32;
+
+/*!
+@method
+@abstract Convert a JSValue to a NSNumber.
+@discussion If the JSValue represents a boolean, a NSNumber value of YES or NO 
+ will be returned. For all other types the value will be converted to a number according 
+ to the rules specified by the JavaScript language.
+@result The NSNumber result of the conversion.
+*/
+- (NSNumber *)toNumber;
+
+/*!
+@method
+@abstract Convert a JSValue to a NSString.
+@discussion The JSValue is converted to a string according to the rules specified 
+ by the JavaScript language.
+@result The NSString containing the result of the conversion.
+*/
+- (NSString *)toString;
+
+/*!
+@method
+@abstract Convert a JSValue to a NSDate.
+@discussion The value is converted to a number representing a time interval 
+ since 1970 which is then used to create a new NSDate instance.
+@result The NSDate created using the converted time interval.
+*/
+- (NSDate *)toDate;
+
+/*!
+@method
+@abstract Convert a JSValue to a NSArray.
+@discussion If the value is <code>null</code> or <code>undefined</code> then <code>nil</code> is returned.
+ If the value is not an object then a JavaScript TypeError will be thrown.
+ The property <code>length</code> is read from the object, converted to an unsigned
+ integer, and an NSArray of this size is allocated. Properties corresponding
+ to indicies within the array bounds will be copied to the array, with
+ JSValues converted to equivalent Objective-C objects as specified.
+@result The NSArray containing the recursively converted contents of the 
+ converted JavaScript array.
+*/
+- (NSArray *)toArray;
+
+/*!
+@method
+@abstract Convert a JSValue to a NSDictionary.
+@discussion If the value is <code>null</code> or <code>undefined</code> then <code>nil</code> is returned.
+ If the value is not an object then a JavaScript TypeError will be thrown.
+ All enumerable properties of the object are copied to the dictionary, with
+ JSValues converted to equivalent Objective-C objects as specified.
+@result The NSDictionary containing the recursively converted contents of
+ the converted JavaScript object.
+*/
+- (NSDictionary *)toDictionary;
+
+/*!
+@methodgroup Accessing Properties
+*/
+/*!
+@method
+@abstract Access a property of a JSValue.
+@result The JSValue for the requested property or the JSValue <code>undefined</code> 
+ if the property does not exist.
+*/
+- (JSValue *)valueForProperty:(NSString *)property;
+
+/*!
+@method
+@abstract Set a property on a JSValue.
+*/
+- (void)setValue:(id)value forProperty:(NSString *)property;
+
+/*!
+@method
+@abstract Delete a property from a JSValue.
+@result YES if deletion is successful, NO otherwise.
+*/
+- (BOOL)deleteProperty:(NSString *)property;
+
+/*!
+@method
+@abstract Check if a JSValue has a property.
+@discussion This method has the same function as the JavaScript operator <code>in</code>.
+@result Returns YES if property is present on the value.
+*/
+- (BOOL)hasProperty:(NSString *)property;
+
+/*!
+@method
+@abstract Define properties with custom descriptors on JSValues.
+@discussion This method may be used to create a data or accessor property on an object.
+ This method operates in accordance with the Object.defineProperty method in the 
+ JavaScript language.
+*/
+- (void)defineProperty:(NSString *)property descriptor:(id)descriptor;
+
+/*!
+@method
+@abstract Access an indexed (numerical) property on a JSValue.
+@result The JSValue for the property at the specified index. 
+ Returns the JavaScript value <code>undefined</code> if no property exists at that index. 
+*/
+- (JSValue *)valueAtIndex:(NSUInteger)index;
+
+/*!
+@method
+@abstract Set an indexed (numerical) property on a JSValue.
+@discussion For JSValues that are JavaScript arrays, indices greater than 
+ UINT_MAX - 1 will not affect the length of the array.
+*/
+- (void)setValue:(id)value atIndex:(NSUInteger)index;
+
+/*!
+@functiongroup Checking JavaScript Types
+*/
+
+/*!
+@property
+@abstract Check if a JSValue corresponds to the JavaScript value <code>undefined</code>.
+*/ 
+@property (readonly) BOOL isUndefined;
+
+/*!
+@property
+@abstract Check if a JSValue corresponds to the JavaScript value <code>null</code>.
+*/
+@property (readonly) BOOL isNull;
+
+/*!
+@property
+@abstract Check if a JSValue is a boolean.
+*/
+@property (readonly) BOOL isBoolean;
+
+/*!
+@property
+@abstract Check if a JSValue is a number.
+@discussion In JavaScript, there is no differentiation between types of numbers.
+ Semantically all numbers behave like doubles except in special cases like bit
+ operations. 
+*/
+@property (readonly) BOOL isNumber;
+
+/*!
+@property
+@abstract Check if a JSValue is a string.
+*/
+@property (readonly) BOOL isString;
+
+/*!
+@property
+@abstract Check if a JSValue is an object.
+*/
+@property (readonly) BOOL isObject;
+
+/*!
+@property
+@abstract Check if a JSValue is an array.
+*/ 
+@property (readonly) BOOL isArray NS_AVAILABLE(10_11, 9_0);
+
+/*!
+@property
+@abstract Check if a JSValue is a date.
+*/ 
+@property (readonly) BOOL isDate NS_AVAILABLE(10_11, 9_0);
+
+/*!
+@method
+@abstract Compare two JSValues using JavaScript's <code>===</code> operator.
+*/
+- (BOOL)isEqualToObject:(id)value;
+
+/*!
+@method
+@abstract Compare two JSValues using JavaScript's <code>==</code> operator.
+*/
+- (BOOL)isEqualWithTypeCoercionToObject:(id)value;
+
+/*!
+@method
+@abstract Check if a JSValue is an instance of another object.
+@discussion This method has the same function as the JavaScript operator <code>instanceof</code>.
+ If an object other than a JSValue is passed, it will first be converted according to
+ the aforementioned rules.
+*/
+- (BOOL)isInstanceOf:(id)value;
+
+/*!
+@methodgroup Calling Functions and Constructors
+*/
+/*!
+@method
+@abstract Invoke a JSValue as a function.
+@discussion In JavaScript, if a function doesn't explicitly return a value then it
+ implicitly returns the JavaScript value <code>undefined</code>.
+@param arguments The arguments to pass to the function.
+@result The return value of the function call. 
+*/
+- (JSValue *)callWithArguments:(NSArray *)arguments;
+
+/*!
+@method
+@abstract Invoke a JSValue as a constructor.
+@discussion This is equivalent to using the <code>new</code> syntax in JavaScript.
+@param arguments The arguments to pass to the constructor.
+@result The return value of the constructor call.
+*/
+- (JSValue *)constructWithArguments:(NSArray *)arguments;
+
+/*!
+@method
+@abstract Invoke a method on a JSValue.
+@discussion Accesses the property named <code>method</code> from this value and 
+ calls the resulting value as a function, passing this JSValue as the <code>this</code>
+ value along with the specified arguments.
+@param method The name of the method to be invoked.
+@param arguments The arguments to pass to the method.
+@result The return value of the method call.
+*/
+- (JSValue *)invokeMethod:(NSString *)method withArguments:(NSArray *)arguments;
+
+@end
+
+/*!
+@category
+@discussion Objective-C methods exported to JavaScript may have argument and/or return
+ values of struct types, provided that conversion to and from the struct is
+ supported by JSValue. Support is provided for any types where JSValue
+ contains both a class method <code>valueWith<Type>:inContext:</code>, and and instance
+ method <code>to<Type></code>- where the string <code><Type></code> in these selector names match,
+ with the first argument to the former being of the same struct type as the
+ return type of the latter.
+ Support is provided for structs of type CGPoint, NSRange, CGRect and CGSize.
+*/
+@interface JSValue (StructSupport)
+
+/*!
+@method
+@abstract Create a JSValue from a CGPoint.
+@result A newly allocated JavaScript object containing properties
+ named <code>x</code> and <code>y</code>, with values from the CGPoint.
+*/
++ (JSValue *)valueWithPoint:(CGPoint)point inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a JSValue from a NSRange.
+@result A newly allocated JavaScript object containing properties
+ named <code>location</code> and <code>length</code>, with values from the NSRange.
+*/
++ (JSValue *)valueWithRange:(NSRange)range inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract 
+Create a JSValue from a CGRect.
+@result A newly allocated JavaScript object containing properties
+ named <code>x</code>, <code>y</code>, <code>width</code>, and <code>height</code>, with values from the CGRect.
+*/
++ (JSValue *)valueWithRect:(CGRect)rect inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Create a JSValue from a CGSize.
+@result A newly allocated JavaScript object containing properties
+ named <code>width</code> and <code>height</code>, with values from the CGSize.
+*/
++ (JSValue *)valueWithSize:(CGSize)size inContext:(JSContext *)context;
+
+/*!
+@method
+@abstract Convert a JSValue to a CGPoint.
+@discussion Reads the properties named <code>x</code> and <code>y</code> from
+ this JSValue, and converts the results to double.
+@result The new CGPoint.
+*/
+- (CGPoint)toPoint;
+
+/*!
+@method
+@abstract Convert a JSValue to an NSRange.
+@discussion Reads the properties named <code>location</code> and
+ <code>length</code> from this JSValue and converts the results to double.
+@result The new NSRange.
+*/
+- (NSRange)toRange;
+
+/*!
+@method
+@abstract Convert a JSValue to a CGRect.
+@discussion Reads the properties named <code>x</code>, <code>y</code>, 
+ <code>width</code>, and <code>height</code> from this JSValue and converts the results to double.
+@result The new CGRect.
+*/
+- (CGRect)toRect;
+
+/*!
+@method
+@abstract Convert a JSValue to a CGSize.
+@discussion Reads the properties named <code>width</code> and
+ <code>height</code> from this JSValue and converts the results to double.
+@result The new CGSize.
+*/
+- (CGSize)toSize;
+
+@end
+
+/*!
+@category
+@discussion Instances of JSValue implement the following methods in order to enable
+ support for subscript access by key and index, for example:
+
+@textblock
+    JSValue *objectA, *objectB;
+    JSValue *v1 = object[@"X"]; // Get value for property "X" from 'object'.
+    JSValue *v2 = object[42];   // Get value for index 42 from 'object'.
+    object[@"Y"] = v1;          // Assign 'v1' to property "Y" of 'object'.
+    object[101] = v2;           // Assign 'v2' to index 101 of 'object'.
+@/textblock
+
+ An object key passed as a subscript will be converted to a JavaScript value,
+ and then the value converted to a string used as a property name.
+*/
+@interface JSValue (SubscriptSupport)
+
+- (JSValue *)objectForKeyedSubscript:(id)key;
+- (JSValue *)objectAtIndexedSubscript:(NSUInteger)index;
+- (void)setObject:(id)object forKeyedSubscript:(NSObject <NSCopying> *)key;
+- (void)setObject:(id)object atIndexedSubscript:(NSUInteger)index;
+
+@end
+
+/*!
+@category
+@discussion  These functions are for bridging between the C API and the Objective-C API.
+*/
+@interface JSValue (JSValueRefSupport)
+
+/*!
+@method
+@abstract Creates a JSValue, wrapping its C API counterpart.
+@result The Objective-C API equivalent of the specified JSValueRef.
+*/
++ (JSValue *)valueWithJSValueRef:(JSValueRef)value inContext:(JSContext *)context;
+
+/*!
+@property
+@abstract Returns the C API counterpart wrapped by a JSContext.
+@result The C API equivalent of this JSValue.
+*/
+@property (readonly) JSValueRef JSValueRef;
+@end
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+@group Property Descriptor Constants
+@discussion These keys may assist in creating a property descriptor for use with the
+ defineProperty method on JSValue.
+ Property descriptors must fit one of three descriptions:
+
+ Data Descriptor:
+  - A descriptor containing one or both of the keys <code>value</code> and <code>writable</code>,
+    and optionally containing one or both of the keys <code>enumerable</code> and
+    <code>configurable</code>. A data descriptor may not contain either the <code>get</code> or
+    <code>set</code> key.
+    A data descriptor may be used to create or modify the attributes of a
+    data property on an object (replacing any existing accessor property).
+
+ Accessor Descriptor:
+  - A descriptor containing one or both of the keys <code>get</code> and <code>set</code>, and
+    optionally containing one or both of the keys <code>enumerable</code> and
+    <code>configurable</code>. An accessor descriptor may not contain either the <code>value</code>
+    or <code>writable</code> key.
+    An accessor descriptor may be used to create or modify the attributes of
+    an accessor property on an object (replacing any existing data property).
+
+ Generic Descriptor:
+  - A descriptor containing one or both of the keys <code>enumerable</code> and
+    <code>configurable</code>. A generic descriptor may not contain any of the keys
+    <code>value</code>, <code>writable</code>, <code>get</code>, or <code>set</code>.
+    A generic descriptor may be used to modify the attributes of an existing
+    data or accessor property, or to create a new data property.
+*/
+/*!
+@const 
+*/
+JS_EXPORT extern NSString * const JSPropertyDescriptorWritableKey;
+/*!
+@const 
+*/
+JS_EXPORT extern NSString * const JSPropertyDescriptorEnumerableKey;
+/*!
+@const 
+*/
+JS_EXPORT extern NSString * const JSPropertyDescriptorConfigurableKey;
+/*!
+@const 
+*/
+JS_EXPORT extern NSString * const JSPropertyDescriptorValueKey;
+/*!
+@const 
+*/
+JS_EXPORT extern NSString * const JSPropertyDescriptorGetKey;
+/*!
+@const 
+*/
+JS_EXPORT extern NSString * const JSPropertyDescriptorSetKey;
+
+#ifdef __cplusplus
+} // extern "C"
+#endif
+
+#endif
+
+#endif // JSValue_h
diff --git a/API/JSValue.mm b/API/JSValue.mm
new file mode 100644
index 0000000..bab2862
--- /dev/null
+++ b/API/JSValue.mm
@@ -0,0 +1,1181 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#import "APICast.h"
+#import "DateInstance.h"
+#import "Error.h"
+#import "Exception.h"
+#import "JavaScriptCore.h"
+#import "JSContextInternal.h"
+#import "JSVirtualMachineInternal.h"
+#import "JSValueInternal.h"
+#import "JSWrapperMap.h"
+#import "ObjcRuntimeExtras.h"
+#import "JSCInlines.h"
+#import "JSCJSValue.h"
+#import "Strong.h"
+#import "StrongInlines.h"
+#import <wtf/HashMap.h>
+#import <wtf/HashSet.h>
+#import <wtf/Lock.h>
+#import <wtf/ObjcRuntimeExtras.h>
+#import <wtf/Vector.h>
+#import <wtf/text/WTFString.h>
+#import <wtf/text/StringHash.h>
+
+#if ENABLE(REMOTE_INSPECTOR)
+#import "CallFrame.h"
+#import "JSGlobalObject.h"
+#import "JSGlobalObjectInspectorController.h"
+#endif
+
+#if JSC_OBJC_API_ENABLED
+
+NSString * const JSPropertyDescriptorWritableKey = @"writable";
+NSString * const JSPropertyDescriptorEnumerableKey = @"enumerable";
+NSString * const JSPropertyDescriptorConfigurableKey = @"configurable";
+NSString * const JSPropertyDescriptorValueKey = @"value";
+NSString * const JSPropertyDescriptorGetKey = @"get";
+NSString * const JSPropertyDescriptorSetKey = @"set";
+
+@implementation JSValue {
+    JSValueRef m_value;
+}
+
+- (JSValueRef)JSValueRef
+{
+    return m_value;
+}
+
++ (JSValue *)valueWithObject:(id)value inContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:objectToValue(context, value) inContext:context];
+}
+
++ (JSValue *)valueWithBool:(BOOL)value inContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:JSValueMakeBoolean([context JSGlobalContextRef], value) inContext:context];
+}
+
++ (JSValue *)valueWithDouble:(double)value inContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:JSValueMakeNumber([context JSGlobalContextRef], value) inContext:context];
+}
+
++ (JSValue *)valueWithInt32:(int32_t)value inContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:JSValueMakeNumber([context JSGlobalContextRef], value) inContext:context];
+}
+
++ (JSValue *)valueWithUInt32:(uint32_t)value inContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:JSValueMakeNumber([context JSGlobalContextRef], value) inContext:context];
+}
+
++ (JSValue *)valueWithNewObjectInContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:JSObjectMake([context JSGlobalContextRef], 0, 0) inContext:context];
+}
+
++ (JSValue *)valueWithNewArrayInContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:JSObjectMakeArray([context JSGlobalContextRef], 0, NULL, 0) inContext:context];
+}
+
++ (JSValue *)valueWithNewRegularExpressionFromPattern:(NSString *)pattern flags:(NSString *)flags inContext:(JSContext *)context
+{
+    JSStringRef patternString = JSStringCreateWithCFString((CFStringRef)pattern);
+    JSStringRef flagsString = JSStringCreateWithCFString((CFStringRef)flags);
+    JSValueRef arguments[2] = { JSValueMakeString([context JSGlobalContextRef], patternString), JSValueMakeString([context JSGlobalContextRef], flagsString) };
+    JSStringRelease(patternString);
+    JSStringRelease(flagsString);
+
+    return [JSValue valueWithJSValueRef:JSObjectMakeRegExp([context JSGlobalContextRef], 2, arguments, 0) inContext:context];
+}
+
++ (JSValue *)valueWithNewErrorFromMessage:(NSString *)message inContext:(JSContext *)context
+{
+    JSStringRef string = JSStringCreateWithCFString((CFStringRef)message);
+    JSValueRef argument = JSValueMakeString([context JSGlobalContextRef], string);
+    JSStringRelease(string);
+
+    return [JSValue valueWithJSValueRef:JSObjectMakeError([context JSGlobalContextRef], 1, &argument, 0) inContext:context];
+}
+
++ (JSValue *)valueWithNullInContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:JSValueMakeNull([context JSGlobalContextRef]) inContext:context];
+}
+
++ (JSValue *)valueWithUndefinedInContext:(JSContext *)context
+{
+    return [JSValue valueWithJSValueRef:JSValueMakeUndefined([context JSGlobalContextRef]) inContext:context];
+}
+
+- (id)toObject
+{
+    return valueToObject(_context, m_value);
+}
+
+- (id)toObjectOfClass:(Class)expectedClass
+{
+    id result = [self toObject];
+    return [result isKindOfClass:expectedClass] ? result : nil;
+}
+
+- (BOOL)toBool
+{
+    return JSValueToBoolean([_context JSGlobalContextRef], m_value);
+}
+
+- (double)toDouble
+{
+    JSValueRef exception = 0;
+    double result = JSValueToNumber([_context JSGlobalContextRef], m_value, &exception);
+    if (exception) {
+        [_context notifyException:exception];
+        return std::numeric_limits<double>::quiet_NaN();
+    }
+
+    return result;
+}
+
+- (int32_t)toInt32
+{
+    return JSC::toInt32([self toDouble]);
+}
+
+- (uint32_t)toUInt32
+{
+    return JSC::toUInt32([self toDouble]);
+}
+
+- (NSNumber *)toNumber
+{
+    JSValueRef exception = 0;
+    id result = valueToNumber([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        [_context notifyException:exception];
+    return result;
+}
+
+- (NSString *)toString
+{
+    JSValueRef exception = 0;
+    id result = valueToString([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        [_context notifyException:exception];
+    return result;
+}
+
+- (NSDate *)toDate
+{
+    JSValueRef exception = 0;
+    id result = valueToDate([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        [_context notifyException:exception];
+    return result;
+}
+
+- (NSArray *)toArray
+{
+    JSValueRef exception = 0;
+    id result = valueToArray([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        [_context notifyException:exception];
+    return result;
+}
+
+- (NSDictionary *)toDictionary
+{
+    JSValueRef exception = 0;
+    id result = valueToDictionary([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        [_context notifyException:exception];
+    return result;
+}
+
+- (JSValue *)valueForProperty:(NSString *)propertyName
+{
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    JSStringRef name = JSStringCreateWithCFString((CFStringRef)propertyName);
+    JSValueRef result = JSObjectGetProperty([_context JSGlobalContextRef], object, name, &exception);
+    JSStringRelease(name);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    return [JSValue valueWithJSValueRef:result inContext:_context];
+}
+
+- (void)setValue:(id)value forProperty:(NSString *)propertyName
+{
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception) {
+        [_context notifyException:exception];
+        return;
+    }
+
+    JSStringRef name = JSStringCreateWithCFString((CFStringRef)propertyName);
+    JSObjectSetProperty([_context JSGlobalContextRef], object, name, objectToValue(_context, value), 0, &exception);
+    JSStringRelease(name);
+    if (exception) {
+        [_context notifyException:exception];
+        return;
+    }
+}
+
+- (BOOL)deleteProperty:(NSString *)propertyName
+{
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        return [_context boolFromNotifyException:exception];
+
+    JSStringRef name = JSStringCreateWithCFString((CFStringRef)propertyName);
+    BOOL result = JSObjectDeleteProperty([_context JSGlobalContextRef], object, name, &exception);
+    JSStringRelease(name);
+    if (exception)
+        return [_context boolFromNotifyException:exception];
+
+    return result;
+}
+
+- (BOOL)hasProperty:(NSString *)propertyName
+{
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        return [_context boolFromNotifyException:exception];
+
+    JSStringRef name = JSStringCreateWithCFString((CFStringRef)propertyName);
+    BOOL result = JSObjectHasProperty([_context JSGlobalContextRef], object, name);
+    JSStringRelease(name);
+    return result;
+}
+
+- (void)defineProperty:(NSString *)property descriptor:(id)descriptor
+{
+    [[_context globalObject][@"Object"] invokeMethod:@"defineProperty" withArguments:@[ self, property, descriptor ]];
+}
+
+- (JSValue *)valueAtIndex:(NSUInteger)index
+{
+    // Properties that are higher than an unsigned value can hold are converted to a double then inserted as a normal property.
+    // Indices that are bigger than the max allowed index size (UINT_MAX - 1) will be handled internally in get().
+    if (index != (unsigned)index)
+        return [self valueForProperty:[[JSValue valueWithDouble:index inContext:_context] toString]];
+
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    JSValueRef result = JSObjectGetPropertyAtIndex([_context JSGlobalContextRef], object, (unsigned)index, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    return [JSValue valueWithJSValueRef:result inContext:_context];
+}
+
+- (void)setValue:(id)value atIndex:(NSUInteger)index
+{
+    // Properties that are higher than an unsigned value can hold are converted to a double, then inserted as a normal property.
+    // Indices that are bigger than the max allowed index size (UINT_MAX - 1) will be handled internally in putByIndex().
+    if (index != (unsigned)index)
+        return [self setValue:value forProperty:[[JSValue valueWithDouble:index inContext:_context] toString]];
+
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception) {
+        [_context notifyException:exception];
+        return;
+    }
+
+    JSObjectSetPropertyAtIndex([_context JSGlobalContextRef], object, (unsigned)index, objectToValue(_context, value), &exception);
+    if (exception) {
+        [_context notifyException:exception];
+        return;
+    }
+}
+
+- (BOOL)isUndefined
+{
+    return JSValueIsUndefined([_context JSGlobalContextRef], m_value);
+}
+
+- (BOOL)isNull
+{
+    return JSValueIsNull([_context JSGlobalContextRef], m_value);
+}
+
+- (BOOL)isBoolean
+{
+    return JSValueIsBoolean([_context JSGlobalContextRef], m_value);
+}
+
+- (BOOL)isNumber
+{
+    return JSValueIsNumber([_context JSGlobalContextRef], m_value);
+}
+
+- (BOOL)isString
+{
+    return JSValueIsString([_context JSGlobalContextRef], m_value);
+}
+
+- (BOOL)isObject
+{
+    return JSValueIsObject([_context JSGlobalContextRef], m_value);
+}
+
+- (BOOL)isArray
+{
+    return JSValueIsArray([_context JSGlobalContextRef], m_value);
+}
+
+- (BOOL)isDate
+{
+    return JSValueIsDate([_context JSGlobalContextRef], m_value);
+}
+
+- (BOOL)isEqualToObject:(id)value
+{
+    return JSValueIsStrictEqual([_context JSGlobalContextRef], m_value, objectToValue(_context, value));
+}
+
+- (BOOL)isEqualWithTypeCoercionToObject:(id)value
+{
+    JSValueRef exception = 0;
+    BOOL result = JSValueIsEqual([_context JSGlobalContextRef], m_value, objectToValue(_context, value), &exception);
+    if (exception)
+        return [_context boolFromNotifyException:exception];
+
+    return result;
+}
+
+- (BOOL)isInstanceOf:(id)value
+{
+    JSValueRef exception = 0;
+    JSObjectRef constructor = JSValueToObject([_context JSGlobalContextRef], objectToValue(_context, value), &exception);
+    if (exception)
+        return [_context boolFromNotifyException:exception];
+
+    BOOL result = JSValueIsInstanceOfConstructor([_context JSGlobalContextRef], m_value, constructor, &exception);
+    if (exception)
+        return [_context boolFromNotifyException:exception];
+
+    return result;
+}
+
+- (JSValue *)callWithArguments:(NSArray *)argumentArray
+{
+    NSUInteger argumentCount = [argumentArray count];
+    JSValueRef arguments[argumentCount];
+    for (unsigned i = 0; i < argumentCount; ++i)
+        arguments[i] = objectToValue(_context, [argumentArray objectAtIndex:i]);
+
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    JSValueRef result = JSObjectCallAsFunction([_context JSGlobalContextRef], object, 0, argumentCount, arguments, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    return [JSValue valueWithJSValueRef:result inContext:_context];
+}
+
+- (JSValue *)constructWithArguments:(NSArray *)argumentArray
+{
+    NSUInteger argumentCount = [argumentArray count];
+    JSValueRef arguments[argumentCount];
+    for (unsigned i = 0; i < argumentCount; ++i)
+        arguments[i] = objectToValue(_context, [argumentArray objectAtIndex:i]);
+
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    JSObjectRef result = JSObjectCallAsConstructor([_context JSGlobalContextRef], object, argumentCount, arguments, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    return [JSValue valueWithJSValueRef:result inContext:_context];
+}
+
+- (JSValue *)invokeMethod:(NSString *)method withArguments:(NSArray *)arguments
+{
+    NSUInteger argumentCount = [arguments count];
+    JSValueRef argumentArray[argumentCount];
+    for (unsigned i = 0; i < argumentCount; ++i)
+        argumentArray[i] = objectToValue(_context, [arguments objectAtIndex:i]);
+
+    JSValueRef exception = 0;
+    JSObjectRef thisObject = JSValueToObject([_context JSGlobalContextRef], m_value, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    JSStringRef name = JSStringCreateWithCFString((CFStringRef)method);
+    JSValueRef function = JSObjectGetProperty([_context JSGlobalContextRef], thisObject, name, &exception);
+    JSStringRelease(name);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    JSObjectRef object = JSValueToObject([_context JSGlobalContextRef], function, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    JSValueRef result = JSObjectCallAsFunction([_context JSGlobalContextRef], object, thisObject, argumentCount, argumentArray, &exception);
+    if (exception)
+        return [_context valueFromNotifyException:exception];
+
+    return [JSValue valueWithJSValueRef:result inContext:_context];
+}
+
+@end
+
+@implementation JSValue(StructSupport)
+
+- (CGPoint)toPoint
+{
+    return (CGPoint){
+        static_cast<CGFloat>([self[@"x"] toDouble]),
+        static_cast<CGFloat>([self[@"y"] toDouble])
+    };
+}
+
+- (NSRange)toRange
+{
+    return (NSRange){
+        [[self[@"location"] toNumber] unsignedIntegerValue],
+        [[self[@"length"] toNumber] unsignedIntegerValue]
+    };
+}
+
+- (CGRect)toRect
+{
+    return (CGRect){
+        [self toPoint],
+        [self toSize]
+    };
+}
+
+- (CGSize)toSize
+{
+    return (CGSize){
+        static_cast<CGFloat>([self[@"width"] toDouble]),
+        static_cast<CGFloat>([self[@"height"] toDouble])
+    };
+}
+
++ (JSValue *)valueWithPoint:(CGPoint)point inContext:(JSContext *)context
+{
+    return [JSValue valueWithObject:@{
+        @"x":@(point.x),
+        @"y":@(point.y)
+    } inContext:context];
+}
+
++ (JSValue *)valueWithRange:(NSRange)range inContext:(JSContext *)context
+{
+    return [JSValue valueWithObject:@{
+        @"location":@(range.location),
+        @"length":@(range.length)
+    } inContext:context];
+}
+
++ (JSValue *)valueWithRect:(CGRect)rect inContext:(JSContext *)context
+{
+    return [JSValue valueWithObject:@{
+        @"x":@(rect.origin.x),
+        @"y":@(rect.origin.y),
+        @"width":@(rect.size.width),
+        @"height":@(rect.size.height)
+    } inContext:context];
+}
+
++ (JSValue *)valueWithSize:(CGSize)size inContext:(JSContext *)context
+{
+    return [JSValue valueWithObject:@{
+        @"width":@(size.width),
+        @"height":@(size.height)
+    } inContext:context];
+}
+
+@end
+
+@implementation JSValue(SubscriptSupport)
+
+- (JSValue *)objectForKeyedSubscript:(id)key
+{
+    if (![key isKindOfClass:[NSString class]]) {
+        key = [[JSValue valueWithObject:key inContext:_context] toString];
+        if (!key)
+            return [JSValue valueWithUndefinedInContext:_context];
+    }
+
+    return [self valueForProperty:(NSString *)key];
+}
+
+- (JSValue *)objectAtIndexedSubscript:(NSUInteger)index
+{
+    return [self valueAtIndex:index];
+}
+
+- (void)setObject:(id)object forKeyedSubscript:(NSObject <NSCopying> *)key
+{
+    if (![key isKindOfClass:[NSString class]]) {
+        key = [[JSValue valueWithObject:key inContext:_context] toString];
+        if (!key)
+            return;
+    }
+
+    [self setValue:object forProperty:(NSString *)key];
+}
+
+- (void)setObject:(id)object atIndexedSubscript:(NSUInteger)index
+{
+    [self setValue:object atIndex:index];
+}
+
+@end
+
+inline bool isDate(JSObjectRef object, JSGlobalContextRef context)
+{
+    JSC::JSLockHolder locker(toJS(context));
+    return toJS(object)->inherits(JSC::DateInstance::info());
+}
+
+inline bool isArray(JSObjectRef object, JSGlobalContextRef context)
+{
+    JSC::JSLockHolder locker(toJS(context));
+    return toJS(object)->inherits(JSC::JSArray::info());
+}
+
+@implementation JSValue(Internal)
+
+enum ConversionType {
+    ContainerNone,
+    ContainerArray,
+    ContainerDictionary
+};
+
+class JSContainerConvertor {
+public:
+    struct Task {
+        JSValueRef js;
+        id objc;
+        ConversionType type;
+    };
+
+    JSContainerConvertor(JSGlobalContextRef context)
+        : m_context(context)
+    {
+    }
+
+    id convert(JSValueRef property);
+    void add(Task);
+    Task take();
+    bool isWorkListEmpty() const { return !m_worklist.size(); }
+
+private:
+    JSGlobalContextRef m_context;
+    HashMap<JSValueRef, id> m_objectMap;
+    Vector<Task> m_worklist;
+    Vector<JSC::Strong<JSC::Unknown>> m_jsValues;
+};
+
+inline id JSContainerConvertor::convert(JSValueRef value)
+{
+    HashMap<JSValueRef, id>::iterator iter = m_objectMap.find(value);
+    if (iter != m_objectMap.end())
+        return iter->value;
+
+    Task result = valueToObjectWithoutCopy(m_context, value);
+    if (result.js)
+        add(result);
+    return result.objc;
+}
+
+void JSContainerConvertor::add(Task task)
+{
+    JSC::ExecState* exec = toJS(m_context);
+    m_jsValues.append(JSC::Strong<JSC::Unknown>(exec->vm(), toJSForGC(exec, task.js)));
+    m_objectMap.add(task.js, task.objc);
+    if (task.type != ContainerNone)
+        m_worklist.append(task);
+}
+
+JSContainerConvertor::Task JSContainerConvertor::take()
+{
+    ASSERT(!isWorkListEmpty());
+    Task last = m_worklist.last();
+    m_worklist.removeLast();
+    return last;
+}
+
+#if ENABLE(REMOTE_INSPECTOR)
+static void reportExceptionToInspector(JSGlobalContextRef context, JSC::JSValue exceptionValue)
+{
+    JSC::ExecState* exec = toJS(context);
+    JSC::Exception* exception = JSC::Exception::create(exec->vm(), exceptionValue);
+    exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, exception);
+}
+#endif
+
+static JSContainerConvertor::Task valueToObjectWithoutCopy(JSGlobalContextRef context, JSValueRef value)
+{
+    if (!JSValueIsObject(context, value)) {
+        id primitive;
+        if (JSValueIsBoolean(context, value))
+            primitive = JSValueToBoolean(context, value) ? @YES : @NO;
+        else if (JSValueIsNumber(context, value)) {
+            // Normalize the number, so it will unique correctly in the hash map -
+            // it's nicer not to leak this internal implementation detail!
+            value = JSValueMakeNumber(context, JSValueToNumber(context, value, 0));
+            primitive = [NSNumber numberWithDouble:JSValueToNumber(context, value, 0)];
+        } else if (JSValueIsString(context, value)) {
+            // Would be nice to unique strings, too.
+            JSStringRef jsstring = JSValueToStringCopy(context, value, 0);
+            NSString * stringNS = (NSString *)JSStringCopyCFString(kCFAllocatorDefault, jsstring);
+            JSStringRelease(jsstring);
+            primitive = [stringNS autorelease];
+        } else if (JSValueIsNull(context, value))
+            primitive = [NSNull null];
+        else {
+            ASSERT(JSValueIsUndefined(context, value));
+            primitive = nil;
+        }
+        return (JSContainerConvertor::Task){ value, primitive, ContainerNone };
+    }
+
+    JSObjectRef object = JSValueToObject(context, value, 0);
+
+    if (id wrapped = tryUnwrapObjcObject(context, object))
+        return (JSContainerConvertor::Task){ object, wrapped, ContainerNone };
+
+    if (isDate(object, context))
+        return (JSContainerConvertor::Task){ object, [NSDate dateWithTimeIntervalSince1970:JSValueToNumber(context, object, 0) / 1000.0], ContainerNone };
+
+    if (isArray(object, context))
+        return (JSContainerConvertor::Task){ object, [NSMutableArray array], ContainerArray };
+
+    return (JSContainerConvertor::Task){ object, [NSMutableDictionary dictionary], ContainerDictionary };
+}
+
+static id containerValueToObject(JSGlobalContextRef context, JSContainerConvertor::Task task)
+{
+    ASSERT(task.type != ContainerNone);
+    JSC::JSLockHolder locker(toJS(context));
+    JSContainerConvertor convertor(context);
+    convertor.add(task);
+    ASSERT(!convertor.isWorkListEmpty());
+    
+    do {
+        JSContainerConvertor::Task current = convertor.take();
+        ASSERT(JSValueIsObject(context, current.js));
+        JSObjectRef js = JSValueToObject(context, current.js, 0);
+
+        if (current.type == ContainerArray) {
+            ASSERT([current.objc isKindOfClass:[NSMutableArray class]]);
+            NSMutableArray *array = (NSMutableArray *)current.objc;
+        
+            JSStringRef lengthString = JSStringCreateWithUTF8CString("length");
+            unsigned length = JSC::toUInt32(JSValueToNumber(context, JSObjectGetProperty(context, js, lengthString, 0), 0));
+            JSStringRelease(lengthString);
+
+            for (unsigned i = 0; i < length; ++i) {
+                id objc = convertor.convert(JSObjectGetPropertyAtIndex(context, js, i, 0));
+                [array addObject:objc ? objc : [NSNull null]];
+            }
+        } else {
+            ASSERT([current.objc isKindOfClass:[NSMutableDictionary class]]);
+            NSMutableDictionary *dictionary = (NSMutableDictionary *)current.objc;
+
+            JSC::JSLockHolder locker(toJS(context));
+
+            JSPropertyNameArrayRef propertyNameArray = JSObjectCopyPropertyNames(context, js);
+            size_t length = JSPropertyNameArrayGetCount(propertyNameArray);
+
+            for (size_t i = 0; i < length; ++i) {
+                JSStringRef propertyName = JSPropertyNameArrayGetNameAtIndex(propertyNameArray, i);
+                if (id objc = convertor.convert(JSObjectGetProperty(context, js, propertyName, 0)))
+                    dictionary[[(NSString *)JSStringCopyCFString(kCFAllocatorDefault, propertyName) autorelease]] = objc;
+            }
+
+            JSPropertyNameArrayRelease(propertyNameArray);
+        }
+
+    } while (!convertor.isWorkListEmpty());
+
+    return task.objc;
+}
+
+id valueToObject(JSContext *context, JSValueRef value)
+{
+    JSContainerConvertor::Task result = valueToObjectWithoutCopy([context JSGlobalContextRef], value);
+    if (result.type == ContainerNone)
+        return result.objc;
+    return containerValueToObject([context JSGlobalContextRef], result);
+}
+
+id valueToNumber(JSGlobalContextRef context, JSValueRef value, JSValueRef* exception)
+{
+    ASSERT(!*exception);
+    if (id wrapped = tryUnwrapObjcObject(context, value)) {
+        if ([wrapped isKindOfClass:[NSNumber class]])
+            return wrapped;
+    }
+
+    if (JSValueIsBoolean(context, value))
+        return JSValueToBoolean(context, value) ? @YES : @NO;
+
+    double result = JSValueToNumber(context, value, exception);
+    return [NSNumber numberWithDouble:*exception ? std::numeric_limits<double>::quiet_NaN() : result];
+}
+
+id valueToString(JSGlobalContextRef context, JSValueRef value, JSValueRef* exception)
+{
+    ASSERT(!*exception);
+    if (id wrapped = tryUnwrapObjcObject(context, value)) {
+        if ([wrapped isKindOfClass:[NSString class]])
+            return wrapped;
+    }
+
+    JSStringRef jsstring = JSValueToStringCopy(context, value, exception);
+    if (*exception) {
+        ASSERT(!jsstring);
+        return nil;
+    }
+
+    RetainPtr<CFStringRef> stringCF = adoptCF(JSStringCopyCFString(kCFAllocatorDefault, jsstring));
+    JSStringRelease(jsstring);
+    return (NSString *)stringCF.autorelease();
+}
+
+id valueToDate(JSGlobalContextRef context, JSValueRef value, JSValueRef* exception)
+{
+    ASSERT(!*exception);
+    if (id wrapped = tryUnwrapObjcObject(context, value)) {
+        if ([wrapped isKindOfClass:[NSDate class]])
+            return wrapped;
+    }
+
+    double result = JSValueToNumber(context, value, exception) / 1000.0;
+    return *exception ? nil : [NSDate dateWithTimeIntervalSince1970:result];
+}
+
+id valueToArray(JSGlobalContextRef context, JSValueRef value, JSValueRef* exception)
+{
+    ASSERT(!*exception);
+    if (id wrapped = tryUnwrapObjcObject(context, value)) {
+        if ([wrapped isKindOfClass:[NSArray class]])
+            return wrapped;
+    }
+
+    if (JSValueIsObject(context, value))
+        return containerValueToObject(context, (JSContainerConvertor::Task){ value, [NSMutableArray array], ContainerArray});
+
+    JSC::JSLockHolder locker(toJS(context));
+    if (!(JSValueIsNull(context, value) || JSValueIsUndefined(context, value))) {
+        JSC::JSObject* exceptionObject = JSC::createTypeError(toJS(context), ASCIILiteral("Cannot convert primitive to NSArray"));
+        *exception = toRef(exceptionObject);
+#if ENABLE(REMOTE_INSPECTOR)
+        reportExceptionToInspector(context, exceptionObject);
+#endif
+    }
+    return nil;
+}
+
+id valueToDictionary(JSGlobalContextRef context, JSValueRef value, JSValueRef* exception)
+{
+    ASSERT(!*exception);
+    if (id wrapped = tryUnwrapObjcObject(context, value)) {
+        if ([wrapped isKindOfClass:[NSDictionary class]])
+            return wrapped;
+    }
+
+    if (JSValueIsObject(context, value))
+        return containerValueToObject(context, (JSContainerConvertor::Task){ value, [NSMutableDictionary dictionary], ContainerDictionary});
+
+    JSC::JSLockHolder locker(toJS(context));
+    if (!(JSValueIsNull(context, value) || JSValueIsUndefined(context, value))) {
+        JSC::JSObject* exceptionObject = JSC::createTypeError(toJS(context), ASCIILiteral("Cannot convert primitive to NSDictionary"));
+        *exception = toRef(exceptionObject);
+#if ENABLE(REMOTE_INSPECTOR)
+        reportExceptionToInspector(context, exceptionObject);
+#endif
+    }
+    return nil;
+}
+
+class ObjcContainerConvertor {
+public:
+    struct Task {
+        id objc;
+        JSValueRef js;
+        ConversionType type;
+    };
+
+    ObjcContainerConvertor(JSContext *context)
+        : m_context(context)
+    {
+    }
+
+    JSValueRef convert(id object);
+    void add(Task);
+    Task take();
+    bool isWorkListEmpty() const { return !m_worklist.size(); }
+
+private:
+    JSContext *m_context;
+    HashMap<id, JSValueRef> m_objectMap;
+    Vector<Task> m_worklist;
+    Vector<JSC::Strong<JSC::Unknown>> m_jsValues;
+};
+
+JSValueRef ObjcContainerConvertor::convert(id object)
+{
+    ASSERT(object);
+
+    auto it = m_objectMap.find(object);
+    if (it != m_objectMap.end())
+        return it->value;
+
+    ObjcContainerConvertor::Task task = objectToValueWithoutCopy(m_context, object);
+    add(task);
+    return task.js;
+}
+
+void ObjcContainerConvertor::add(ObjcContainerConvertor::Task task)
+{
+    JSC::ExecState* exec = toJS(m_context.JSGlobalContextRef);
+    m_jsValues.append(JSC::Strong<JSC::Unknown>(exec->vm(), toJSForGC(exec, task.js)));
+    m_objectMap.add(task.objc, task.js);
+    if (task.type != ContainerNone)
+        m_worklist.append(task);
+}
+
+ObjcContainerConvertor::Task ObjcContainerConvertor::take()
+{
+    ASSERT(!isWorkListEmpty());
+    Task last = m_worklist.last();
+    m_worklist.removeLast();
+    return last;
+}
+
+inline bool isNSBoolean(id object)
+{
+    ASSERT([@YES class] == [@NO class]);
+    ASSERT([@YES class] != [NSNumber class]);
+    ASSERT([[@YES class] isSubclassOfClass:[NSNumber class]]);
+    return [object isKindOfClass:[@YES class]];
+}
+
+static ObjcContainerConvertor::Task objectToValueWithoutCopy(JSContext *context, id object)
+{
+    JSGlobalContextRef contextRef = [context JSGlobalContextRef];
+
+    if (!object)
+        return (ObjcContainerConvertor::Task){ object, JSValueMakeUndefined(contextRef), ContainerNone };
+
+    if (!class_conformsToProtocol(object_getClass(object), getJSExportProtocol())) {
+        if ([object isKindOfClass:[NSArray class]])
+            return (ObjcContainerConvertor::Task){ object, JSObjectMakeArray(contextRef, 0, NULL, 0), ContainerArray };
+
+        if ([object isKindOfClass:[NSDictionary class]])
+            return (ObjcContainerConvertor::Task){ object, JSObjectMake(contextRef, 0, 0), ContainerDictionary };
+
+        if ([object isKindOfClass:[NSNull class]])
+            return (ObjcContainerConvertor::Task){ object, JSValueMakeNull(contextRef), ContainerNone };
+
+        if ([object isKindOfClass:[JSValue class]])
+            return (ObjcContainerConvertor::Task){ object, ((JSValue *)object)->m_value, ContainerNone };
+
+        if ([object isKindOfClass:[NSString class]]) {
+            JSStringRef string = JSStringCreateWithCFString((CFStringRef)object);
+            JSValueRef js = JSValueMakeString(contextRef, string);
+            JSStringRelease(string);
+            return (ObjcContainerConvertor::Task){ object, js, ContainerNone };
+        }
+
+        if ([object isKindOfClass:[NSNumber class]]) {
+            if (isNSBoolean(object))
+                return (ObjcContainerConvertor::Task){ object, JSValueMakeBoolean(contextRef, [object boolValue]), ContainerNone };
+            return (ObjcContainerConvertor::Task){ object, JSValueMakeNumber(contextRef, [object doubleValue]), ContainerNone };
+        }
+
+        if ([object isKindOfClass:[NSDate class]]) {
+            JSValueRef argument = JSValueMakeNumber(contextRef, [object timeIntervalSince1970] * 1000.0);
+            JSObjectRef result = JSObjectMakeDate(contextRef, 1, &argument, 0);
+            return (ObjcContainerConvertor::Task){ object, result, ContainerNone };
+        }
+
+        if ([object isKindOfClass:[JSManagedValue class]]) {
+            JSValue *value = [static_cast<JSManagedValue *>(object) value];
+            if (!value)
+                return (ObjcContainerConvertor::Task) { object, JSValueMakeUndefined(contextRef), ContainerNone };
+            return (ObjcContainerConvertor::Task){ object, value->m_value, ContainerNone };
+        }
+    }
+
+    return (ObjcContainerConvertor::Task){ object, valueInternalValue([context wrapperForObjCObject:object]), ContainerNone };
+}
+
+JSValueRef objectToValue(JSContext *context, id object)
+{
+    JSGlobalContextRef contextRef = [context JSGlobalContextRef];
+
+    ObjcContainerConvertor::Task task = objectToValueWithoutCopy(context, object);
+    if (task.type == ContainerNone)
+        return task.js;
+
+    JSC::JSLockHolder locker(toJS(contextRef));
+    ObjcContainerConvertor convertor(context);
+    convertor.add(task);
+    ASSERT(!convertor.isWorkListEmpty());
+
+    do {
+        ObjcContainerConvertor::Task current = convertor.take();
+        ASSERT(JSValueIsObject(contextRef, current.js));
+        JSObjectRef js = JSValueToObject(contextRef, current.js, 0);
+
+        if (current.type == ContainerArray) {
+            ASSERT([current.objc isKindOfClass:[NSArray class]]);
+            NSArray *array = (NSArray *)current.objc;
+            NSUInteger count = [array count];
+            for (NSUInteger index = 0; index < count; ++index)
+                JSObjectSetPropertyAtIndex(contextRef, js, index, convertor.convert([array objectAtIndex:index]), 0);
+        } else {
+            ASSERT(current.type == ContainerDictionary);
+            ASSERT([current.objc isKindOfClass:[NSDictionary class]]);
+            NSDictionary *dictionary = (NSDictionary *)current.objc;
+            for (id key in [dictionary keyEnumerator]) {
+                if ([key isKindOfClass:[NSString class]]) {
+                    JSStringRef propertyName = JSStringCreateWithCFString((CFStringRef)key);
+                    JSObjectSetProperty(contextRef, js, propertyName, convertor.convert([dictionary objectForKey:key]), 0, 0);
+                    JSStringRelease(propertyName);
+                }
+            }
+        }
+        
+    } while (!convertor.isWorkListEmpty());
+
+    return task.js;
+}
+
+JSValueRef valueInternalValue(JSValue * value)
+{
+    return value->m_value;
+}
+
++ (JSValue *)valueWithJSValueRef:(JSValueRef)value inContext:(JSContext *)context
+{
+    return [context wrapperForJSObject:value];
+}
+
+- (JSValue *)init
+{
+    return nil;
+}
+
+- (JSValue *)initWithValue:(JSValueRef)value inContext:(JSContext *)context
+{
+    if (!value || !context)
+        return nil;
+
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _context = [context retain];
+    m_value = value;
+    JSValueProtect([_context JSGlobalContextRef], m_value);
+    return self;
+}
+
+struct StructTagHandler {
+    SEL typeToValueSEL;
+    SEL valueToTypeSEL;
+};
+typedef HashMap<String, StructTagHandler> StructHandlers;
+
+static StructHandlers* createStructHandlerMap()
+{
+    StructHandlers* structHandlers = new StructHandlers();
+
+    size_t valueWithXinContextLength = strlen("valueWithX:inContext:");
+    size_t toXLength = strlen("toX");
+
+    // Step 1: find all valueWith<Foo>:inContext: class methods in JSValue.
+    forEachMethodInClass(object_getClass([JSValue class]), ^(Method method){
+        SEL selector = method_getName(method);
+        const char* name = sel_getName(selector);
+        size_t nameLength = strlen(name);
+        // Check for valueWith<Foo>:context:
+        if (nameLength < valueWithXinContextLength || memcmp(name, "valueWith", 9) || memcmp(name + nameLength - 11, ":inContext:", 11))
+            return;
+        // Check for [ id, SEL, <type>, <contextType> ]
+        if (method_getNumberOfArguments(method) != 4)
+            return;
+        char idType[3];
+        // Check 2nd argument type is "@"
+        char* secondType = method_copyArgumentType(method, 3);
+        if (strcmp(secondType, "@") != 0) {
+            free(secondType);
+            return;
+        }
+        free(secondType);
+        // Check result type is also "@"
+        method_getReturnType(method, idType, 3);
+        if (strcmp(idType, "@") != 0)
+            return;
+        char* type = method_copyArgumentType(method, 2);
+        structHandlers->add(StringImpl::create(type), (StructTagHandler){ selector, 0 });
+        free(type);
+    });
+
+    // Step 2: find all to<Foo> instance methods in JSValue.
+    forEachMethodInClass([JSValue class], ^(Method method){
+        SEL selector = method_getName(method);
+        const char* name = sel_getName(selector);
+        size_t nameLength = strlen(name);
+        // Check for to<Foo>
+        if (nameLength < toXLength || memcmp(name, "to", 2))
+            return;
+        // Check for [ id, SEL ]
+        if (method_getNumberOfArguments(method) != 2)
+            return;
+        // Try to find a matching valueWith<Foo>:context: method.
+        char* type = method_copyReturnType(method);
+
+        StructHandlers::iterator iter = structHandlers->find(type);
+        free(type);
+        if (iter == structHandlers->end())
+            return;
+        StructTagHandler& handler = iter->value;
+
+        // check that strlen(<foo>) == strlen(<Foo>)
+        const char* valueWithName = sel_getName(handler.typeToValueSEL);
+        size_t valueWithLength = strlen(valueWithName);
+        if (valueWithLength - valueWithXinContextLength != nameLength - toXLength)
+            return;
+        // Check that <Foo> == <Foo>
+        if (memcmp(valueWithName + 9, name + 2, nameLength - toXLength - 1))
+            return;
+        handler.valueToTypeSEL = selector;
+    });
+
+    // Step 3: clean up - remove entries where we found prospective valueWith<Foo>:inContext: conversions, but no matching to<Foo> methods.
+    typedef HashSet<String> RemoveSet;
+    RemoveSet removeSet;
+    for (StructHandlers::iterator iter = structHandlers->begin(); iter != structHandlers->end(); ++iter) {
+        StructTagHandler& handler = iter->value;
+        if (!handler.valueToTypeSEL)
+            removeSet.add(iter->key);
+    }
+
+    for (RemoveSet::iterator iter = removeSet.begin(); iter != removeSet.end(); ++iter)
+        structHandlers->remove(*iter);
+
+    return structHandlers;
+}
+
+static StructTagHandler* handerForStructTag(const char* encodedType)
+{
+    static StaticLock handerForStructTagLock;
+    LockHolder lockHolder(&handerForStructTagLock);
+
+    static StructHandlers* structHandlers = createStructHandlerMap();
+
+    StructHandlers::iterator iter = structHandlers->find(encodedType);
+    if (iter == structHandlers->end())
+        return 0;
+    return &iter->value;
+}
+
++ (SEL)selectorForStructToValue:(const char *)structTag
+{
+    StructTagHandler* handler = handerForStructTag(structTag);
+    return handler ? handler->typeToValueSEL : nil;
+}
+
++ (SEL)selectorForValueToStruct:(const char *)structTag
+{
+    StructTagHandler* handler = handerForStructTag(structTag);
+    return handler ? handler->valueToTypeSEL : nil;
+}
+
+- (void)dealloc
+{
+    JSValueUnprotect([_context JSGlobalContextRef], m_value);
+    [_context release];
+    _context = nil;
+    [super dealloc];
+}
+
+- (NSString *)description
+{
+    if (id wrapped = tryUnwrapObjcObject([_context JSGlobalContextRef], m_value))
+        return [wrapped description];
+    return [self toString];
+}
+
+NSInvocation *typeToValueInvocationFor(const char* encodedType)
+{
+    SEL selector = [JSValue selectorForStructToValue:encodedType];
+    if (!selector)
+        return 0;
+
+    const char* methodTypes = method_getTypeEncoding(class_getClassMethod([JSValue class], selector));
+    NSInvocation *invocation = [NSInvocation invocationWithMethodSignature:[NSMethodSignature signatureWithObjCTypes:methodTypes]];
+    [invocation setSelector:selector];
+    return invocation;
+}
+
+NSInvocation *valueToTypeInvocationFor(const char* encodedType)
+{
+    SEL selector = [JSValue selectorForValueToStruct:encodedType];
+    if (!selector)
+        return 0;
+
+    const char* methodTypes = method_getTypeEncoding(class_getInstanceMethod([JSValue class], selector));
+    NSInvocation *invocation = [NSInvocation invocationWithMethodSignature:[NSMethodSignature signatureWithObjCTypes:methodTypes]];
+    [invocation setSelector:selector];
+    return invocation;
+}
+
+@end
+
+#endif
diff --git a/API/JSValueInternal.h b/API/JSValueInternal.h
new file mode 100644
index 0000000..4f1a8f6
--- /dev/null
+++ b/API/JSValueInternal.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSValueInternal_h
+#define JSValueInternal_h
+
+#import <JavaScriptCore/JavaScriptCore.h>
+#import <JavaScriptCore/JSValue.h>
+
+#if JSC_OBJC_API_ENABLED
+
+@interface JSValue(Internal)
+
+JSValueRef valueInternalValue(JSValue *);
+
+- (JSValue *)initWithValue:(JSValueRef)value inContext:(JSContext *)context;
+
+JSValueRef objectToValue(JSContext *, id);
+id valueToObject(JSContext *, JSValueRef);
+id valueToNumber(JSGlobalContextRef, JSValueRef, JSValueRef* exception);
+id valueToString(JSGlobalContextRef, JSValueRef, JSValueRef* exception);
+id valueToDate(JSGlobalContextRef, JSValueRef, JSValueRef* exception);
+id valueToArray(JSGlobalContextRef, JSValueRef, JSValueRef* exception);
+id valueToDictionary(JSGlobalContextRef, JSValueRef, JSValueRef* exception);
+
++ (SEL)selectorForStructToValue:(const char *)structTag;
++ (SEL)selectorForValueToStruct:(const char *)structTag;
+
+@end
+
+NSInvocation *typeToValueInvocationFor(const char* encodedType);
+NSInvocation *valueToTypeInvocationFor(const char* encodedType);
+
+#endif
+
+#endif // JSValueInternal_h
diff --git a/API/JSValueRef.cpp b/API/JSValueRef.cpp
new file mode 100644
index 0000000..c27b7c3
--- /dev/null
+++ b/API/JSValueRef.cpp
@@ -0,0 +1,452 @@
+/*
+ * Copyright (C) 2006, 2007, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSValueRef.h"
+
+#include "APICast.h"
+#include "APIUtils.h"
+#include "DateInstance.h"
+#include "Exception.h"
+#include "JSAPIWrapperObject.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSCallbackObject.h"
+#include "JSGlobalObject.h"
+#include "JSONObject.h"
+#include "JSString.h"
+#include "LiteralParser.h"
+#include "Protect.h"
+#include <algorithm>
+#include <wtf/Assertions.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
+
+#if PLATFORM(MAC)
+#include <mach-o/dyld.h>
+#endif
+
+#if ENABLE(REMOTE_INSPECTOR)
+#include "JSGlobalObjectInspectorController.h"
+#endif
+
+using namespace JSC;
+
+#if PLATFORM(MAC)
+static bool evernoteHackNeeded()
+{
+    static const int32_t webkitLastVersionWithEvernoteHack = 35133959;
+    static bool hackNeeded = CFEqual(CFBundleGetIdentifier(CFBundleGetMainBundle()), CFSTR("com.evernote.Evernote"))
+        && NSVersionOfLinkTimeLibrary("JavaScriptCore") <= webkitLastVersionWithEvernoteHack;
+
+    return hackNeeded;
+}
+#endif
+
+::JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return kJSTypeUndefined;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJS(exec, value);
+
+    if (jsValue.isUndefined())
+        return kJSTypeUndefined;
+    if (jsValue.isNull())
+        return kJSTypeNull;
+    if (jsValue.isBoolean())
+        return kJSTypeBoolean;
+    if (jsValue.isNumber())
+        return kJSTypeNumber;
+    if (jsValue.isString())
+        return kJSTypeString;
+    ASSERT(jsValue.isObject());
+    return kJSTypeObject;
+}
+
+bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toJS(exec, value).isUndefined();
+}
+
+bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toJS(exec, value).isNull();
+}
+
+bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toJS(exec, value).isBoolean();
+}
+
+bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toJS(exec, value).isNumber();
+}
+
+bool JSValueIsString(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toJS(exec, value).isString();
+}
+
+bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toJS(exec, value).isObject();
+}
+
+bool JSValueIsArray(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toJS(exec, value).inherits(JSArray::info());
+}
+
+bool JSValueIsDate(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toJS(exec, value).inherits(DateInstance::info());
+}
+
+bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)
+{
+    if (!ctx || !jsClass) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    
+    if (JSObject* o = jsValue.getObject()) {
+        if (o->inherits(JSProxy::info()))
+            o = jsCast<JSProxy*>(o)->target();
+
+        if (o->inherits(JSCallbackObject<JSGlobalObject>::info()))
+            return jsCast<JSCallbackObject<JSGlobalObject>*>(o)->inherits(jsClass);
+        if (o->inherits(JSCallbackObject<JSDestructibleObject>::info()))
+            return jsCast<JSCallbackObject<JSDestructibleObject>*>(o)->inherits(jsClass);
+#if JSC_OBJC_API_ENABLED
+        if (o->inherits(JSCallbackObject<JSAPIWrapperObject>::info()))
+            return jsCast<JSCallbackObject<JSAPIWrapperObject>*>(o)->inherits(jsClass);
+#endif
+    }
+    return false;
+}
+
+bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsA = toJS(exec, a);
+    JSValue jsB = toJS(exec, b);
+
+    bool result = JSValue::equal(exec, jsA, jsB); // false if an exception is thrown
+    handleExceptionIfNeeded(exec, exception);
+    
+    return result;
+}
+
+bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsA = toJS(exec, a);
+    JSValue jsB = toJS(exec, b);
+
+    return JSValue::strictEqual(exec, jsA, jsB);
+}
+
+bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJS(exec, value);
+
+    JSObject* jsConstructor = toJS(constructor);
+    if (!jsConstructor->structure()->typeInfo().implementsHasInstance())
+        return false;
+    bool result = jsConstructor->hasInstance(exec, jsValue); // false if an exception is thrown
+    handleExceptionIfNeeded(exec, exception);
+    return result;
+}
+
+JSValueRef JSValueMakeUndefined(JSContextRef ctx)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toRef(exec, jsUndefined());
+}
+
+JSValueRef JSValueMakeNull(JSContextRef ctx)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toRef(exec, jsNull());
+}
+
+JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toRef(exec, jsBoolean(value));
+}
+
+JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toRef(exec, jsNumber(purifyNaN(value)));
+}
+
+JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    return toRef(exec, jsString(exec, string ? string->string() : String()));
+}
+
+JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    String str = string->string();
+    unsigned length = str.length();
+    if (!length || str.is8Bit()) {
+        LiteralParser<LChar> parser(exec, str.characters8(), length, StrictJSON);
+        return toRef(exec, parser.tryLiteralParse());
+    }
+    LiteralParser<UChar> parser(exec, str.characters16(), length, StrictJSON);
+    return toRef(exec, parser.tryLiteralParse());
+}
+
+JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef apiValue, unsigned indent, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    JSValue value = toJS(exec, apiValue);
+    String result = JSONStringify(exec, value, indent);
+    if (exception)
+        *exception = 0;
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        return 0;
+    return OpaqueJSString::create(result).leakRef();
+}
+
+bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.toBoolean(exec);
+}
+
+double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return PNaN;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJS(exec, value);
+
+    double number = jsValue.toNumber(exec);
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        number = PNaN;
+    return number;
+}
+
+JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    
+    auto stringRef(OpaqueJSString::create(jsValue.toWTFString(exec)));
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        stringRef = nullptr;
+    return stringRef.leakRef();
+}
+
+JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    
+    JSObjectRef objectRef = toRef(jsValue.toObject(exec));
+    if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
+        objectRef = 0;
+    return objectRef;
+}
+
+void JSValueProtect(JSContextRef ctx, JSValueRef value)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJSForGC(exec, value);
+    gcProtect(jsValue);
+}
+
+void JSValueUnprotect(JSContextRef ctx, JSValueRef value)
+{
+#if PLATFORM(MAC)
+    if ((!value || !ctx) && evernoteHackNeeded())
+        return;
+#endif
+
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+
+    JSValue jsValue = toJSForGC(exec, value);
+    gcUnprotect(jsValue);
+}
diff --git a/API/JSValueRef.h b/API/JSValueRef.h
new file mode 100644
index 0000000..9815de7
--- /dev/null
+++ b/API/JSValueRef.h
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSValueRef_h
+#define JSValueRef_h
+
+#include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/WebKitAvailability.h>
+
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
+
+/*!
+@enum JSType
+@abstract     A constant identifying the type of a JSValue.
+@constant     kJSTypeUndefined  The unique undefined value.
+@constant     kJSTypeNull       The unique null value.
+@constant     kJSTypeBoolean    A primitive boolean value, one of true or false.
+@constant     kJSTypeNumber     A primitive number value.
+@constant     kJSTypeString     A primitive string value.
+@constant     kJSTypeObject     An object value (meaning that this JSValueRef is a JSObjectRef).
+*/
+typedef enum {
+    kJSTypeUndefined,
+    kJSTypeNull,
+    kJSTypeBoolean,
+    kJSTypeNumber,
+    kJSTypeString,
+    kJSTypeObject
+} JSType;
+
+/*!
+ @enum JSTypedArrayType
+ @abstract     A constant identifying the Typed Array type of a JSObjectRef.
+ @constant     kJSTypedArrayTypeInt8Array            Int8Array
+ @constant     kJSTypedArrayTypeInt16Array           Int16Array
+ @constant     kJSTypedArrayTypeInt32Array           Int32Array
+ @constant     kJSTypedArrayTypeUint8Array           Uint8Array
+ @constant     kJSTypedArrayTypeUint8ClampedArray    Uint8ClampedArray
+ @constant     kJSTypedArrayTypeUint16Array          Uint16Array
+ @constant     kJSTypedArrayTypeUint32Array          Uint32Array
+ @constant     kJSTypedArrayTypeFloat32Array         Float32Array
+ @constant     kJSTypedArrayTypeFloat64Array         Float64Array
+ @constant     kJSTypedArrayTypeArrayBuffer          ArrayBuffer
+ @constant     kJSTypedArrayTypeNone                 Not a Typed Array
+
+ */
+typedef enum {
+    kJSTypedArrayTypeInt8Array,
+    kJSTypedArrayTypeInt16Array,
+    kJSTypedArrayTypeInt32Array,
+    kJSTypedArrayTypeUint8Array,
+    kJSTypedArrayTypeUint8ClampedArray,
+    kJSTypedArrayTypeUint16Array,
+    kJSTypedArrayTypeUint32Array,
+    kJSTypedArrayTypeFloat32Array,
+    kJSTypedArrayTypeFloat64Array,
+    kJSTypedArrayTypeArrayBuffer,
+    kJSTypedArrayTypeNone,
+} JSTypedArrayType CF_ENUM_AVAILABLE(10_12, 10_0);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+@function
+@abstract       Returns a JavaScript value's type.
+@param ctx  The execution context to use.
+@param value    The JSValue whose type you want to obtain.
+@result         A value of type JSType that identifies value's type.
+*/
+JS_EXPORT JSType JSValueGetType(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract       Tests whether a JavaScript value's type is the undefined type.
+@param ctx  The execution context to use.
+@param value    The JSValue to test.
+@result         true if value's type is the undefined type, otherwise false.
+*/
+JS_EXPORT bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract       Tests whether a JavaScript value's type is the null type.
+@param ctx  The execution context to use.
+@param value    The JSValue to test.
+@result         true if value's type is the null type, otherwise false.
+*/
+JS_EXPORT bool JSValueIsNull(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract       Tests whether a JavaScript value's type is the boolean type.
+@param ctx  The execution context to use.
+@param value    The JSValue to test.
+@result         true if value's type is the boolean type, otherwise false.
+*/
+JS_EXPORT bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract       Tests whether a JavaScript value's type is the number type.
+@param ctx  The execution context to use.
+@param value    The JSValue to test.
+@result         true if value's type is the number type, otherwise false.
+*/
+JS_EXPORT bool JSValueIsNumber(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract       Tests whether a JavaScript value's type is the string type.
+@param ctx  The execution context to use.
+@param value    The JSValue to test.
+@result         true if value's type is the string type, otherwise false.
+*/
+JS_EXPORT bool JSValueIsString(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract       Tests whether a JavaScript value's type is the object type.
+@param ctx  The execution context to use.
+@param value    The JSValue to test.
+@result         true if value's type is the object type, otherwise false.
+*/
+JS_EXPORT bool JSValueIsObject(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract Tests whether a JavaScript value is an object with a given class in its class chain.
+@param ctx The execution context to use.
+@param value The JSValue to test.
+@param jsClass The JSClass to test against.
+@result true if value is an object and has jsClass in its class chain, otherwise false.
+*/
+JS_EXPORT bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass);
+
+/*!
+@function
+@abstract       Tests whether a JavaScript value is an array.
+@param ctx      The execution context to use.
+@param value    The JSValue to test.
+@result         true if value is an array, otherwise false.
+*/
+JS_EXPORT bool JSValueIsArray(JSContextRef ctx, JSValueRef value) CF_AVAILABLE(10_11, 9_0);
+
+/*!
+@function
+@abstract       Tests whether a JavaScript value is a date.
+@param ctx      The execution context to use.
+@param value    The JSValue to test.
+@result         true if value is a date, otherwise false.
+*/
+JS_EXPORT bool JSValueIsDate(JSContextRef ctx, JSValueRef value) CF_AVAILABLE(10_11, 9_0);
+
+/*!
+@function
+@abstract           Returns a JavaScript value's Typed Array type.
+@param ctx          The execution context to use.
+@param value        The JSValue whose Typed Array type to return.
+@param exception    A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result             A value of type JSTypedArrayType that identifies value's Typed Array type, or kJSTypedArrayTypeNone if the value is not a Typed Array object.
+ */
+JS_EXPORT JSTypedArrayType JSValueGetTypedArrayType(JSContextRef ctx, JSValueRef value, JSValueRef* exception) CF_AVAILABLE(10_12, 10_0);
+
+/* Comparing values */
+
+/*!
+@function
+@abstract Tests whether two JavaScript values are equal, as compared by the JS == operator.
+@param ctx The execution context to use.
+@param a The first value to test.
+@param b The second value to test.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result true if the two values are equal, false if they are not equal or an exception is thrown.
+*/
+JS_EXPORT bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* exception);
+
+/*!
+@function
+@abstract       Tests whether two JavaScript values are strict equal, as compared by the JS === operator.
+@param ctx  The execution context to use.
+@param a        The first value to test.
+@param b        The second value to test.
+@result         true if the two values are strict equal, otherwise false.
+*/
+JS_EXPORT bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b);
+
+/*!
+@function
+@abstract Tests whether a JavaScript value is an object constructed by a given constructor, as compared by the JS instanceof operator.
+@param ctx The execution context to use.
+@param value The JSValue to test.
+@param constructor The constructor to test against.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result true if value is an object constructed by constructor, as compared by the JS instanceof operator, otherwise false.
+*/
+JS_EXPORT bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception);
+
+/* Creating values */
+
+/*!
+@function
+@abstract       Creates a JavaScript value of the undefined type.
+@param ctx  The execution context to use.
+@result         The unique undefined value.
+*/
+JS_EXPORT JSValueRef JSValueMakeUndefined(JSContextRef ctx);
+
+/*!
+@function
+@abstract       Creates a JavaScript value of the null type.
+@param ctx  The execution context to use.
+@result         The unique null value.
+*/
+JS_EXPORT JSValueRef JSValueMakeNull(JSContextRef ctx);
+
+/*!
+@function
+@abstract       Creates a JavaScript value of the boolean type.
+@param ctx  The execution context to use.
+@param boolean  The bool to assign to the newly created JSValue.
+@result         A JSValue of the boolean type, representing the value of boolean.
+*/
+JS_EXPORT JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool boolean);
+
+/*!
+@function
+@abstract       Creates a JavaScript value of the number type.
+@param ctx  The execution context to use.
+@param number   The double to assign to the newly created JSValue.
+@result         A JSValue of the number type, representing the value of number.
+*/
+JS_EXPORT JSValueRef JSValueMakeNumber(JSContextRef ctx, double number);
+
+/*!
+@function
+@abstract       Creates a JavaScript value of the string type.
+@param ctx  The execution context to use.
+@param string   The JSString to assign to the newly created JSValue. The
+ newly created JSValue retains string, and releases it upon garbage collection.
+@result         A JSValue of the string type, representing the value of string.
+*/
+JS_EXPORT JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string);
+
+/* Converting to and from JSON formatted strings */
+
+/*!
+ @function
+ @abstract       Creates a JavaScript value from a JSON formatted string.
+ @param ctx      The execution context to use.
+ @param string   The JSString containing the JSON string to be parsed.
+ @result         A JSValue containing the parsed value, or NULL if the input is invalid.
+ */
+JS_EXPORT JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string) CF_AVAILABLE(10_7, 7_0);
+
+/*!
+ @function
+ @abstract       Creates a JavaScript string containing the JSON serialized representation of a JS value.
+ @param ctx      The execution context to use.
+ @param value    The value to serialize.
+ @param indent   The number of spaces to indent when nesting.  If 0, the resulting JSON will not contains newlines.  The size of the indent is clamped to 10 spaces.
+ @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+ @result         A JSString with the result of serialization, or NULL if an exception is thrown.
+ */
+JS_EXPORT JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef value, unsigned indent, JSValueRef* exception) CF_AVAILABLE(10_7, 7_0);
+
+/* Converting to primitive values */
+
+/*!
+@function
+@abstract       Converts a JavaScript value to boolean and returns the resulting boolean.
+@param ctx  The execution context to use.
+@param value    The JSValue to convert.
+@result         The boolean result of conversion.
+*/
+JS_EXPORT bool JSValueToBoolean(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract       Converts a JavaScript value to number and returns the resulting number.
+@param ctx  The execution context to use.
+@param value    The JSValue to convert.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result         The numeric result of conversion, or NaN if an exception is thrown.
+*/
+JS_EXPORT double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception);
+
+/*!
+@function
+@abstract       Converts a JavaScript value to string and copies the result into a JavaScript string.
+@param ctx  The execution context to use.
+@param value    The JSValue to convert.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result         A JSString with the result of conversion, or NULL if an exception is thrown. Ownership follows the Create Rule.
+*/
+JS_EXPORT JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef* exception);
+
+/*!
+@function
+@abstract Converts a JavaScript value to object and returns the resulting object.
+@param ctx  The execution context to use.
+@param value    The JSValue to convert.
+@param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
+@result         The JSObject result of conversion, or NULL if an exception is thrown.
+*/
+JS_EXPORT JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exception);
+
+/* Garbage collection */
+/*!
+@function
+@abstract Protects a JavaScript value from garbage collection.
+@param ctx The execution context to use.
+@param value The JSValue to protect.
+@discussion Use this method when you want to store a JSValue in a global or on the heap, where the garbage collector will not be able to discover your reference to it.
+ 
+A value may be protected multiple times and must be unprotected an equal number of times before becoming eligible for garbage collection.
+*/
+JS_EXPORT void JSValueProtect(JSContextRef ctx, JSValueRef value);
+
+/*!
+@function
+@abstract       Unprotects a JavaScript value from garbage collection.
+@param ctx      The execution context to use.
+@param value    The JSValue to unprotect.
+@discussion     A value may be protected multiple times and must be unprotected an 
+ equal number of times before becoming eligible for garbage collection.
+*/
+JS_EXPORT void JSValueUnprotect(JSContextRef ctx, JSValueRef value);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSValueRef_h */
diff --git a/API/JSVirtualMachine.h b/API/JSVirtualMachine.h
new file mode 100644
index 0000000..ccf9264
--- /dev/null
+++ b/API/JSVirtualMachine.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <JavaScriptCore/JavaScriptCore.h>
+
+#if JSC_OBJC_API_ENABLED
+
+/*!
+@interface
+@discussion An instance of JSVirtualMachine represents a single JavaScript "object space"
+ or set of execution resources. Thread safety is supported by locking the
+ virtual machine, with concurrent JavaScript execution supported by allocating
+ separate instances of JSVirtualMachine.
+*/
+NS_CLASS_AVAILABLE(10_9, 7_0)
+@interface JSVirtualMachine : NSObject
+
+/*!
+@methodgroup Creating New Virtual Machines
+*/
+/*!
+@method
+@abstract Create a new JSVirtualMachine.
+*/
+- (instancetype)init;
+
+/*!
+@methodgroup Memory Management
+*/
+/*!
+@method
+@abstract Notify the JSVirtualMachine of an external object relationship.
+@discussion Allows clients of JSVirtualMachine to make the JavaScript runtime aware of 
+ arbitrary external Objective-C object graphs. The runtime can then use 
+ this information to retain any JavaScript values that are referenced 
+ from somewhere in said object graph.
+
+ For correct behavior clients must make their external object graphs 
+ reachable from within the JavaScript runtime. If an Objective-C object is 
+ reachable from within the JavaScript runtime, all managed references 
+ transitively reachable from it as recorded using
+ -addManagedReference:withOwner: will be scanned by the garbage collector.
+@param object The object that the owner points to.
+@param owner The object that owns the pointed to object.
+*/ 
+- (void)addManagedReference:(id)object withOwner:(id)owner;
+
+/*!
+@method
+@abstract Notify the JSVirtualMachine that a previous object relationship no longer exists.
+@discussion The JavaScript runtime will continue to scan any references that were
+ reported to it by -addManagedReference:withOwner: until those references are removed.
+@param object The object that was formerly owned.
+@param owner The former owner.
+*/
+- (void)removeManagedReference:(id)object withOwner:(id)owner;
+
+@end
+
+#endif
diff --git a/API/JSVirtualMachine.mm b/API/JSVirtualMachine.mm
new file mode 100644
index 0000000..2bbc043
--- /dev/null
+++ b/API/JSVirtualMachine.mm
@@ -0,0 +1,339 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#import "JavaScriptCore.h"
+
+#if JSC_OBJC_API_ENABLED
+
+#import "APICast.h"
+#import "JSManagedValueInternal.h"
+#import "JSVirtualMachine.h"
+#import "JSVirtualMachineInternal.h"
+#import "JSWrapperMap.h"
+#import "SigillCrashAnalyzer.h"
+#import "SlotVisitorInlines.h"
+#import <mutex>
+#import <wtf/Lock.h>
+#import <wtf/spi/cocoa/NSMapTableSPI.h>
+
+static NSMapTable *globalWrapperCache = 0;
+
+static StaticLock wrapperCacheMutex;
+
+static void initWrapperCache()
+{
+    ASSERT(!globalWrapperCache);
+    NSPointerFunctionsOptions keyOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsOpaquePersonality;
+    NSPointerFunctionsOptions valueOptions = NSPointerFunctionsWeakMemory | NSPointerFunctionsObjectPersonality;
+    globalWrapperCache = [[NSMapTable alloc] initWithKeyOptions:keyOptions valueOptions:valueOptions capacity:0];
+}
+
+static NSMapTable *wrapperCache()
+{
+    if (!globalWrapperCache)
+        initWrapperCache();
+    return globalWrapperCache;
+}
+
+@interface JSVMWrapperCache : NSObject
++ (void)addWrapper:(JSVirtualMachine *)wrapper forJSContextGroupRef:(JSContextGroupRef)group;
++ (JSVirtualMachine *)wrapperForJSContextGroupRef:(JSContextGroupRef)group;
+@end
+
+@implementation JSVMWrapperCache
+
++ (void)addWrapper:(JSVirtualMachine *)wrapper forJSContextGroupRef:(JSContextGroupRef)group
+{
+    std::lock_guard<StaticLock> lock(wrapperCacheMutex);
+    NSMapInsert(wrapperCache(), group, wrapper);
+}
+
++ (JSVirtualMachine *)wrapperForJSContextGroupRef:(JSContextGroupRef)group
+{
+    std::lock_guard<StaticLock> lock(wrapperCacheMutex);
+    return static_cast<JSVirtualMachine *>(NSMapGet(wrapperCache(), group));
+}
+
+@end
+
+@implementation JSVirtualMachine {
+    JSContextGroupRef m_group;
+    Lock m_externalDataMutex;
+    NSMapTable *m_contextCache;
+    NSMapTable *m_externalObjectGraph;
+    NSMapTable *m_externalRememberedSet;
+}
+
+- (instancetype)init
+{
+    JSContextGroupRef group = JSContextGroupCreate();
+    self = [self initWithContextGroupRef:group];
+    // The extra JSContextGroupRetain is balanced here.
+    JSContextGroupRelease(group);
+    return self;
+}
+
+- (instancetype)initWithContextGroupRef:(JSContextGroupRef)group
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    
+    m_group = JSContextGroupRetain(group);
+    
+    NSPointerFunctionsOptions keyOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsOpaquePersonality;
+    NSPointerFunctionsOptions valueOptions = NSPointerFunctionsWeakMemory | NSPointerFunctionsObjectPersonality;
+    m_contextCache = [[NSMapTable alloc] initWithKeyOptions:keyOptions valueOptions:valueOptions capacity:0];
+    
+    NSPointerFunctionsOptions weakIDOptions = NSPointerFunctionsWeakMemory | NSPointerFunctionsObjectPersonality;
+    NSPointerFunctionsOptions strongIDOptions = NSPointerFunctionsStrongMemory | NSPointerFunctionsObjectPersonality;
+    m_externalObjectGraph = [[NSMapTable alloc] initWithKeyOptions:weakIDOptions valueOptions:strongIDOptions capacity:0];
+
+    NSPointerFunctionsOptions integerOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsIntegerPersonality;
+    m_externalRememberedSet = [[NSMapTable alloc] initWithKeyOptions:weakIDOptions valueOptions:integerOptions capacity:0];
+   
+    [JSVMWrapperCache addWrapper:self forJSContextGroupRef:group];
+ 
+    return self;
+}
+
+- (void)dealloc
+{
+    JSContextGroupRelease(m_group);
+    [m_contextCache release];
+    [m_externalObjectGraph release];
+    [m_externalRememberedSet release];
+    [super dealloc];
+}
+
+static id getInternalObjcObject(id object)
+{
+    if ([object isKindOfClass:[JSManagedValue class]]) {
+        JSValue* value = [static_cast<JSManagedValue *>(object) value];
+        if (!value)
+            return nil;
+        id temp = tryUnwrapObjcObject([value.context JSGlobalContextRef], [value JSValueRef]);
+        if (temp)
+            return temp;
+        return object;
+    }
+    
+    if ([object isKindOfClass:[JSValue class]]) {
+        JSValue *value = static_cast<JSValue *>(object);
+        object = tryUnwrapObjcObject([value.context JSGlobalContextRef], [value JSValueRef]);
+    }
+
+    return object;
+}
+
+- (bool)isOldExternalObject:(id)object
+{
+    JSC::VM* vm = toJS(m_group);
+    return vm->heap.collectorSlotVisitor().containsOpaqueRoot(object);
+}
+
+- (void)addExternalRememberedObject:(id)object
+{
+    auto locker = holdLock(m_externalDataMutex);
+    ASSERT([self isOldExternalObject:object]);
+    [m_externalRememberedSet setObject:@YES forKey:object];
+}
+
+- (void)addManagedReference:(id)object withOwner:(id)owner
+{    
+    if ([object isKindOfClass:[JSManagedValue class]])
+        [object didAddOwner:owner];
+        
+    object = getInternalObjcObject(object);
+    owner = getInternalObjcObject(owner);
+    
+    if (!object || !owner)
+        return;
+    
+    JSC::JSLockHolder locker(toJS(m_group));
+    if ([self isOldExternalObject:owner] && ![self isOldExternalObject:object])
+        [self addExternalRememberedObject:owner];
+ 
+    auto externalDataMutexLocker = holdLock(m_externalDataMutex);
+    NSMapTable *ownedObjects = [m_externalObjectGraph objectForKey:owner];
+    if (!ownedObjects) {
+        NSPointerFunctionsOptions weakIDOptions = NSPointerFunctionsWeakMemory | NSPointerFunctionsObjectPersonality;
+        NSPointerFunctionsOptions integerOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsIntegerPersonality;
+        ownedObjects = [[NSMapTable alloc] initWithKeyOptions:weakIDOptions valueOptions:integerOptions capacity:1];
+
+        [m_externalObjectGraph setObject:ownedObjects forKey:owner];
+        [ownedObjects release];
+    }
+
+    size_t count = reinterpret_cast<size_t>(NSMapGet(ownedObjects, object));
+    NSMapInsert(ownedObjects, object, reinterpret_cast<void*>(count + 1));
+}
+
+- (void)removeManagedReference:(id)object withOwner:(id)owner
+{
+    if ([object isKindOfClass:[JSManagedValue class]])
+        [object didRemoveOwner:owner];
+
+    object = getInternalObjcObject(object);
+    owner = getInternalObjcObject(owner);
+    
+    if (!object || !owner)
+        return;
+    
+    JSC::JSLockHolder locker(toJS(m_group));
+    
+    auto externalDataMutexLocker = holdLock(m_externalDataMutex);
+    NSMapTable *ownedObjects = [m_externalObjectGraph objectForKey:owner];
+    if (!ownedObjects)
+        return;
+   
+    size_t count = reinterpret_cast<size_t>(NSMapGet(ownedObjects, object));
+    if (count > 1) {
+        NSMapInsert(ownedObjects, object, reinterpret_cast<void*>(count - 1));
+        return;
+    }
+    
+    if (count == 1)
+        NSMapRemove(ownedObjects, object);
+
+    if (![ownedObjects count]) {
+        [m_externalObjectGraph removeObjectForKey:owner];
+        [m_externalRememberedSet removeObjectForKey:owner];
+    }
+}
+
+- (void)enableSigillCrashAnalyzer
+{
+    JSC::enableSigillCrashAnalyzer();
+}
+
+@end
+
+@implementation JSVirtualMachine(Internal)
+
+JSContextGroupRef getGroupFromVirtualMachine(JSVirtualMachine *virtualMachine)
+{
+    return virtualMachine->m_group;
+}
+
++ (JSVirtualMachine *)virtualMachineWithContextGroupRef:(JSContextGroupRef)group
+{
+    JSVirtualMachine *virtualMachine = [JSVMWrapperCache wrapperForJSContextGroupRef:group];
+    if (!virtualMachine)
+        virtualMachine = [[[JSVirtualMachine alloc] initWithContextGroupRef:group] autorelease];
+    return virtualMachine;
+}
+
+- (JSContext *)contextForGlobalContextRef:(JSGlobalContextRef)globalContext
+{
+    return static_cast<JSContext *>(NSMapGet(m_contextCache, globalContext));
+}
+
+- (void)addContext:(JSContext *)wrapper forGlobalContextRef:(JSGlobalContextRef)globalContext
+{
+    NSMapInsert(m_contextCache, globalContext, wrapper);
+}
+
+- (Lock&)externalDataMutex
+{
+    return m_externalDataMutex;
+}
+
+- (NSMapTable *)externalObjectGraph
+{
+    return m_externalObjectGraph;
+}
+
+- (NSMapTable *)externalRememberedSet
+{
+    return m_externalRememberedSet;
+}
+
+@end
+
+static void scanExternalObjectGraph(JSC::VM& vm, JSC::SlotVisitor& visitor, void* root, bool lockAcquired)
+{
+    @autoreleasepool {
+        JSVirtualMachine *virtualMachine = [JSVMWrapperCache wrapperForJSContextGroupRef:toRef(&vm)];
+        if (!virtualMachine)
+            return;
+        NSMapTable *externalObjectGraph = [virtualMachine externalObjectGraph];
+        Lock& externalDataMutex = [virtualMachine externalDataMutex];
+        Vector<void*> stack;
+        stack.append(root);
+        while (!stack.isEmpty()) {
+            void* nextRoot = stack.last();
+            stack.removeLast();
+            if (visitor.containsOpaqueRootTriState(nextRoot) == TrueTriState)
+                continue;
+            visitor.addOpaqueRoot(nextRoot);
+
+            auto appendOwnedObjects = [&] {
+                NSMapTable *ownedObjects = [externalObjectGraph objectForKey:static_cast<id>(nextRoot)];
+                for (id ownedObject in ownedObjects)
+                    stack.append(static_cast<void*>(ownedObject));
+            };
+
+            if (lockAcquired)
+                appendOwnedObjects();
+            else {
+                auto locker = holdLock(externalDataMutex);
+                appendOwnedObjects();
+            }
+        }
+    }
+}
+
+void scanExternalObjectGraph(JSC::VM& vm, JSC::SlotVisitor& visitor, void* root)
+{
+    bool lockAcquired = false;
+    scanExternalObjectGraph(vm, visitor, root, lockAcquired);
+}
+
+void scanExternalRememberedSet(JSC::VM& vm, JSC::SlotVisitor& visitor)
+{
+    @autoreleasepool {
+        JSVirtualMachine *virtualMachine = [JSVMWrapperCache wrapperForJSContextGroupRef:toRef(&vm)];
+        if (!virtualMachine)
+            return;
+        Lock& externalDataMutex = [virtualMachine externalDataMutex];
+        auto locker = holdLock(externalDataMutex);
+        NSMapTable *externalObjectGraph = [virtualMachine externalObjectGraph];
+        NSMapTable *externalRememberedSet = [virtualMachine externalRememberedSet];
+        for (id key in externalRememberedSet) {
+            NSMapTable *ownedObjects = [externalObjectGraph objectForKey:key];
+            bool lockAcquired = true;
+            for (id ownedObject in ownedObjects)
+                scanExternalObjectGraph(vm, visitor, ownedObject, lockAcquired);
+        }
+        [externalRememberedSet removeAllObjects];
+    }
+
+    visitor.mergeIfNecessary();
+}
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/JSVirtualMachineInternal.h b/API/JSVirtualMachineInternal.h
new file mode 100644
index 0000000..5ca9a7f
--- /dev/null
+++ b/API/JSVirtualMachineInternal.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013, 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSVirtualMachineInternal_h
+#define JSVirtualMachineInternal_h
+
+#if JSC_OBJC_API_ENABLED
+
+#import <JavaScriptCore/JavaScriptCore.h>
+
+namespace JSC {
+class VM;
+class SlotVisitor;
+}
+
+#if defined(__OBJC__)
+@class NSMapTable;
+
+@interface JSVirtualMachine(Internal)
+
+JSContextGroupRef getGroupFromVirtualMachine(JSVirtualMachine *);
+
++ (JSVirtualMachine *)virtualMachineWithContextGroupRef:(JSContextGroupRef)group;
+
+- (JSContext *)contextForGlobalContextRef:(JSGlobalContextRef)globalContext;
+- (void)addContext:(JSContext *)wrapper forGlobalContextRef:(JSGlobalContextRef)globalContext;
+
+@end
+#endif // defined(__OBJC__)
+
+void scanExternalObjectGraph(JSC::VM&, JSC::SlotVisitor&, void* root);
+void scanExternalRememberedSet(JSC::VM&, JSC::SlotVisitor&);
+
+#endif // JSC_OBJC_API_ENABLED
+
+#endif // JSVirtualMachineInternal_h
diff --git a/API/JSVirtualMachinePrivate.h b/API/JSVirtualMachinePrivate.h
new file mode 100644
index 0000000..3e5fd42
--- /dev/null
+++ b/API/JSVirtualMachinePrivate.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSVirtualMachinePrivate_h
+#define JSVirtualMachinePrivate_h
+
+#if JSC_OBJC_API_ENABLED
+
+@interface JSVirtualMachine(Private)
+
+/*!
+ @method
+ @abstract Enables SIGILL crash analysis for all JSVirtualMachines.
+ @discussion Installs a SIGILL crash handler that will collect additional
+ non-user identifying information about the crash site via os_log_info.
+ */
+- (void)enableSigillCrashAnalyzer;
+
+@end
+
+#endif
+
+#endif // JSVirtualMachinePrivate_h
diff --git a/API/JSWeakObjectMapRefInternal.h b/API/JSWeakObjectMapRefInternal.h
new file mode 100644
index 0000000..9037947
--- /dev/null
+++ b/API/JSWeakObjectMapRefInternal.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSWeakObjectMapRefInternal_h
+#define JSWeakObjectMapRefInternal_h
+
+#include "WeakGCMap.h"
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+class JSObject;
+
+}
+
+typedef void (*JSWeakMapDestroyedCallback)(struct OpaqueJSWeakObjectMap*, void*);
+
+typedef JSC::WeakGCMap<void*, JSC::JSObject> WeakMapType;
+
+struct OpaqueJSWeakObjectMap : public RefCounted<OpaqueJSWeakObjectMap> {
+public:
+    static Ref<OpaqueJSWeakObjectMap> create(JSC::VM& vm, void* data, JSWeakMapDestroyedCallback callback)
+    {
+        return adoptRef(*new OpaqueJSWeakObjectMap(vm, data, callback));
+    }
+
+    WeakMapType& map() { return m_map; }
+    
+    ~OpaqueJSWeakObjectMap()
+    {
+        m_callback(this, m_data);
+    }
+
+private:
+    OpaqueJSWeakObjectMap(JSC::VM& vm, void* data, JSWeakMapDestroyedCallback callback)
+        : m_map(vm)
+        , m_data(data)
+        , m_callback(callback)
+    {
+    }
+    WeakMapType m_map;
+    void* m_data;
+    JSWeakMapDestroyedCallback m_callback;
+};
+
+
+#endif // JSWeakObjectMapInternal_h
diff --git a/API/JSWeakObjectMapRefPrivate.cpp b/API/JSWeakObjectMapRefPrivate.cpp
new file mode 100644
index 0000000..9b825b0
--- /dev/null
+++ b/API/JSWeakObjectMapRefPrivate.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWeakObjectMapRefPrivate.h"
+
+#include "APICast.h"
+#include "JSCJSValue.h"
+#include "JSCallbackObject.h"
+#include "JSWeakObjectMapRefInternal.h"
+#include "JSCInlines.h"
+#include "Weak.h"
+#include "WeakGCMapInlines.h"
+
+using namespace WTF;
+using namespace JSC;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+JSWeakObjectMapRef JSWeakObjectMapCreate(JSContextRef context, void* privateData, JSWeakMapDestroyedCallback callback)
+{
+    ExecState* exec = toJS(context);
+    JSLockHolder locker(exec);
+    RefPtr<OpaqueJSWeakObjectMap> map = OpaqueJSWeakObjectMap::create(exec->vm(), privateData, callback);
+    exec->lexicalGlobalObject()->registerWeakMap(map.get());
+    return map.get();
+}
+
+void JSWeakObjectMapSet(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSObjectRef object)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    JSObject* obj = toJS(object);
+    if (!obj)
+        return;
+    ASSERT(obj->inherits(JSProxy::info())
+        || obj->inherits(JSCallbackObject<JSGlobalObject>::info()) 
+        || obj->inherits(JSCallbackObject<JSDestructibleObject>::info()));
+    map->map().set(key, obj);
+}
+
+JSObjectRef JSWeakObjectMapGet(JSContextRef ctx, JSWeakObjectMapRef map, void* key)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    return toRef(jsCast<JSObject*>(map->map().get(key)));
+}
+
+void JSWeakObjectMapRemove(JSContextRef ctx, JSWeakObjectMapRef map, void* key)
+{
+    if (!ctx) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ExecState* exec = toJS(ctx);
+    JSLockHolder locker(exec);
+    map->map().remove(key);
+}
+
+// We need to keep this function in the build to keep the nightlies running.
+JS_EXPORT bool JSWeakObjectMapClear(JSContextRef, JSWeakObjectMapRef, void*, JSObjectRef);
+bool JSWeakObjectMapClear(JSContextRef, JSWeakObjectMapRef, void*, JSObjectRef)
+{
+    return true;
+}
+
+#ifdef __cplusplus
+}
+#endif
diff --git a/API/JSWeakObjectMapRefPrivate.h b/API/JSWeakObjectMapRefPrivate.h
new file mode 100644
index 0000000..a335e23
--- /dev/null
+++ b/API/JSWeakObjectMapRefPrivate.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSWeakObjectMapRefPrivate_h
+#define JSWeakObjectMapRefPrivate_h
+
+#include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+    
+/*! @typedef JSWeakObjectMapRef A weak map for storing JSObjectRefs */
+typedef struct OpaqueJSWeakObjectMap* JSWeakObjectMapRef;
+
+/*! 
+ @typedef JSWeakMapDestroyedCallback
+ @abstract The callback invoked when a JSWeakObjectMapRef is being destroyed.
+ @param map The map that is being destroyed.
+ @param data The private data (if any) that was associated with the map instance.
+ */
+typedef void (*JSWeakMapDestroyedCallback)(JSWeakObjectMapRef map, void* data);
+
+/*!
+ @function
+ @abstract Creates a weak value map that can be used to reference user defined objects without preventing them from being collected.
+ @param ctx The execution context to use.
+ @param data A void* to set as the map's private data. Pass NULL to specify no private data.
+ @param destructor A function to call when the weak map is destroyed.
+ @result A JSWeakObjectMapRef bound to the given context, data and destructor.
+ @discussion The JSWeakObjectMapRef can be used as a storage mechanism to hold custom JS objects without forcing those objects to
+ remain live as JSValueProtect would.
+ */
+JS_EXPORT JSWeakObjectMapRef JSWeakObjectMapCreate(JSContextRef ctx, void* data, JSWeakMapDestroyedCallback destructor);
+
+/*!
+ @function
+ @abstract Associates a JSObjectRef with the given key in a JSWeakObjectMap.
+ @param ctx The execution context to use.
+ @param map The map to operate on.
+ @param key The key to associate a weak reference with.
+ @param object The user defined object to associate with the key.
+ */
+JS_EXPORT void JSWeakObjectMapSet(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSObjectRef object);
+
+/*!
+ @function
+ @abstract Retrieves the JSObjectRef associated with a key.
+ @param ctx The execution context to use.
+ @param map The map to query.
+ @param key The key to search for.
+ @result Either the live object associated with the provided key, or NULL.
+ */
+JS_EXPORT JSObjectRef JSWeakObjectMapGet(JSContextRef ctx, JSWeakObjectMapRef map, void* key);
+
+/*!
+ @function
+ @abstract Removes the entry for the given key if the key is present, otherwise it has no effect.
+ @param ctx The execution context to use.
+ @param map The map to use.
+ @param key The key to remove.
+ */
+JS_EXPORT void JSWeakObjectMapRemove(JSContextRef ctx, JSWeakObjectMapRef map, void* key);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // JSWeakObjectMapPrivate_h
diff --git a/API/JSWrapperMap.h b/API/JSWrapperMap.h
new file mode 100644
index 0000000..c6aa1af
--- /dev/null
+++ b/API/JSWrapperMap.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <JavaScriptCore/JavaScriptCore.h>
+#import <JSValueInternal.h>
+#import <objc/objc-runtime.h>
+
+#if JSC_OBJC_API_ENABLED
+
+@interface JSWrapperMap : NSObject
+
+- (id)initWithContext:(JSContext *)context;
+
+- (JSValue *)jsWrapperForObject:(id)object;
+
+- (JSValue *)objcWrapperForJSValueRef:(JSValueRef)value;
+
+@end
+
+id tryUnwrapObjcObject(JSGlobalContextRef, JSValueRef);
+
+bool supportsInitMethodConstructors();
+Protocol *getJSExportProtocol();
+Class getNSBlockClass();
+
+#endif
diff --git a/API/JSWrapperMap.mm b/API/JSWrapperMap.mm
new file mode 100644
index 0000000..8046188
--- /dev/null
+++ b/API/JSWrapperMap.mm
@@ -0,0 +1,691 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#import "JavaScriptCore.h"
+
+#if JSC_OBJC_API_ENABLED
+#import "APICast.h"
+#import "JSAPIWrapperObject.h"
+#import "JSCInlines.h"
+#import "JSCallbackObject.h"
+#import "JSContextInternal.h"
+#import "JSWrapperMap.h"
+#import "ObjCCallbackFunction.h"
+#import "ObjcRuntimeExtras.h"
+#import "WeakGCMap.h"
+#import "WeakGCMapInlines.h"
+#import <wtf/Vector.h>
+#import <wtf/spi/cocoa/NSMapTableSPI.h>
+#import <wtf/spi/darwin/dyldSPI.h>
+
+#include <mach-o/dyld.h>
+
+#if PLATFORM(APPLETV)
+#else
+static const int32_t firstJavaScriptCoreVersionWithInitConstructorSupport = 0x21A0400; // 538.4.0
+#if PLATFORM(IOS)
+static const uint32_t firstSDKVersionWithInitConstructorSupport = DYLD_IOS_VERSION_10_0;
+#elif PLATFORM(MAC)
+static const uint32_t firstSDKVersionWithInitConstructorSupport = 0xA0A00; // OSX 10.10.0
+#endif
+#endif
+
+@class JSObjCClassInfo;
+
+@interface JSWrapperMap () 
+
+- (JSObjCClassInfo*)classInfoForClass:(Class)cls;
+
+@end
+
+// Default conversion of selectors to property names.
+// All semicolons are removed, lowercase letters following a semicolon are capitalized.
+static NSString *selectorToPropertyName(const char* start)
+{
+    // Use 'index' to check for colons, if there are none, this is easy!
+    const char* firstColon = strchr(start, ':');
+    if (!firstColon)
+        return [NSString stringWithUTF8String:start];
+
+    // 'header' is the length of string up to the first colon.
+    size_t header = firstColon - start;
+    // The new string needs to be long enough to hold 'header', plus the remainder of the string, excluding
+    // at least one ':', but including a '\0'. (This is conservative if there are more than one ':').
+    char* buffer = static_cast<char*>(malloc(header + strlen(firstColon + 1) + 1));
+    // Copy 'header' characters, set output to point to the end of this & input to point past the first ':'.
+    memcpy(buffer, start, header);
+    char* output = buffer + header;
+    const char* input = start + header + 1;
+
+    // On entry to the loop, we have already skipped over a ':' from the input.
+    while (true) {
+        char c;
+        // Skip over any additional ':'s. We'll leave c holding the next character after the
+        // last ':', and input pointing past c.
+        while ((c = *(input++)) == ':');
+        // Copy the character, converting to upper case if necessary.
+        // If the character we copy is '\0', then we're done!
+        if (!(*(output++) = toupper(c)))
+            goto done;
+        // Loop over characters other than ':'.
+        while ((c = *(input++)) != ':') {
+            // Copy the character.
+            // If the character we copy is '\0', then we're done!
+            if (!(*(output++) = c))
+                goto done;
+        }
+        // If we get here, we've consumed a ':' - wash, rinse, repeat.
+    }
+done:
+    NSString *result = [NSString stringWithUTF8String:buffer];
+    free(buffer);
+    return result;
+}
+
+static bool constructorHasInstance(JSContextRef ctx, JSObjectRef constructorRef, JSValueRef possibleInstance, JSValueRef*)
+{
+    JSC::ExecState* exec = toJS(ctx);
+    JSC::JSLockHolder locker(exec);
+
+    JSC::JSObject* constructor = toJS(constructorRef);
+    JSC::JSValue instance = toJS(exec, possibleInstance);
+    return JSC::JSObject::defaultHasInstance(exec, instance, constructor->get(exec, exec->propertyNames().prototype));
+}
+
+static JSC::JSObject* makeWrapper(JSContextRef ctx, JSClassRef jsClass, id wrappedObject)
+{
+    JSC::ExecState* exec = toJS(ctx);
+    JSC::JSLockHolder locker(exec);
+
+    ASSERT(jsClass);
+    JSC::JSCallbackObject<JSC::JSAPIWrapperObject>* object = JSC::JSCallbackObject<JSC::JSAPIWrapperObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->objcWrapperObjectStructure(), jsClass, 0);
+    object->setWrappedObject(wrappedObject);
+    if (JSC::JSObject* prototype = jsClass->prototype(exec))
+        object->setPrototypeDirect(exec->vm(), prototype);
+
+    return object;
+}
+
+// Make an object that is in all ways a completely vanilla JavaScript object,
+// other than that it has a native brand set that will be displayed by the default
+// Object.prototype.toString conversion.
+static JSC::JSObject *objectWithCustomBrand(JSContext *context, NSString *brand, Class cls = 0)
+{
+    JSClassDefinition definition;
+    definition = kJSClassDefinitionEmpty;
+    definition.className = [brand UTF8String];
+    JSClassRef classRef = JSClassCreate(&definition);
+    JSC::JSObject* result = makeWrapper([context JSGlobalContextRef], classRef, cls);
+    JSClassRelease(classRef);
+    return result;
+}
+
+static JSC::JSObject *constructorWithCustomBrand(JSContext *context, NSString *brand, Class cls)
+{
+    JSClassDefinition definition;
+    definition = kJSClassDefinitionEmpty;
+    definition.className = [brand UTF8String];
+    definition.hasInstance = constructorHasInstance;
+    JSClassRef classRef = JSClassCreate(&definition);
+    JSC::JSObject* result = makeWrapper([context JSGlobalContextRef], classRef, cls);
+    JSClassRelease(classRef);
+    return result;
+}
+
+// Look for @optional properties in the prototype containing a selector to property
+// name mapping, separated by a __JS_EXPORT_AS__ delimiter.
+static NSMutableDictionary *createRenameMap(Protocol *protocol, BOOL isInstanceMethod)
+{
+    NSMutableDictionary *renameMap = [[NSMutableDictionary alloc] init];
+
+    forEachMethodInProtocol(protocol, NO, isInstanceMethod, ^(SEL sel, const char*){
+        NSString *rename = @(sel_getName(sel));
+        NSRange range = [rename rangeOfString:@"__JS_EXPORT_AS__"];
+        if (range.location == NSNotFound)
+            return;
+        NSString *selector = [rename substringToIndex:range.location];
+        NSUInteger begin = range.location + range.length;
+        NSUInteger length = [rename length] - begin - 1;
+        NSString *name = [rename substringWithRange:(NSRange){ begin, length }];
+        renameMap[selector] = name;
+    });
+
+    return renameMap;
+}
+
+inline void putNonEnumerable(JSValue *base, NSString *propertyName, JSValue *value)
+{
+    [base defineProperty:propertyName descriptor:@{
+        JSPropertyDescriptorValueKey: value,
+        JSPropertyDescriptorWritableKey: @YES,
+        JSPropertyDescriptorEnumerableKey: @NO,
+        JSPropertyDescriptorConfigurableKey: @YES
+    }];
+}
+
+static bool isInitFamilyMethod(NSString *name)
+{
+    NSUInteger i = 0;
+
+    // Skip over initial underscores.
+    for (; i < [name length]; ++i) {
+        if ([name characterAtIndex:i] != '_')
+            break;
+    }
+
+    // Match 'init'.
+    NSUInteger initIndex = 0;
+    NSString* init = @"init";
+    for (; i < [name length] && initIndex < [init length]; ++i, ++initIndex) {
+        if ([name characterAtIndex:i] != [init characterAtIndex:initIndex])
+            return false;
+    }
+
+    // We didn't match all of 'init'.
+    if (initIndex < [init length])
+        return false;
+
+    // If we're at the end or the next character is a capital letter then this is an init-family selector.
+    return i == [name length] || [[NSCharacterSet uppercaseLetterCharacterSet] characterIsMember:[name characterAtIndex:i]]; 
+}
+
+static bool shouldSkipMethodWithName(NSString *name)
+{
+    // For clients that don't support init-based constructors just copy 
+    // over the init method as we would have before.
+    if (!supportsInitMethodConstructors())
+        return false;
+
+    // Skip over init family methods because we handle those specially 
+    // for the purposes of hooking up the constructor correctly.
+    return isInitFamilyMethod(name);
+}
+
+// This method will iterate over the set of required methods in the protocol, and:
+//  * Determine a property name (either via a renameMap or default conversion).
+//  * If an accessorMap is provided, and contains this name, store the method in the map.
+//  * Otherwise, if the object doesn't already contain a property with name, create it.
+static void copyMethodsToObject(JSContext *context, Class objcClass, Protocol *protocol, BOOL isInstanceMethod, JSValue *object, NSMutableDictionary *accessorMethods = nil)
+{
+    NSMutableDictionary *renameMap = createRenameMap(protocol, isInstanceMethod);
+
+    forEachMethodInProtocol(protocol, YES, isInstanceMethod, ^(SEL sel, const char* types){
+        const char* nameCStr = sel_getName(sel);
+        NSString *name = @(nameCStr);
+
+        if (shouldSkipMethodWithName(name))
+            return;
+
+        if (accessorMethods && accessorMethods[name]) {
+            JSObjectRef method = objCCallbackFunctionForMethod(context, objcClass, protocol, isInstanceMethod, sel, types);
+            if (!method)
+                return;
+            accessorMethods[name] = [JSValue valueWithJSValueRef:method inContext:context];
+        } else {
+            name = renameMap[name];
+            if (!name)
+                name = selectorToPropertyName(nameCStr);
+            if ([object hasProperty:name])
+                return;
+            JSObjectRef method = objCCallbackFunctionForMethod(context, objcClass, protocol, isInstanceMethod, sel, types);
+            if (method)
+                putNonEnumerable(object, name, [JSValue valueWithJSValueRef:method inContext:context]);
+        }
+    });
+
+    [renameMap release];
+}
+
+static bool parsePropertyAttributes(objc_property_t property, char*& getterName, char*& setterName)
+{
+    bool readonly = false;
+    unsigned attributeCount;
+    objc_property_attribute_t* attributes = property_copyAttributeList(property, &attributeCount);
+    if (attributeCount) {
+        for (unsigned i = 0; i < attributeCount; ++i) {
+            switch (*(attributes[i].name)) {
+            case 'G':
+                getterName = strdup(attributes[i].value);
+                break;
+            case 'S':
+                setterName = strdup(attributes[i].value);
+                break;
+            case 'R':
+                readonly = true;
+                break;
+            default:
+                break;
+            }
+        }
+        free(attributes);
+    }
+    return readonly;
+}
+
+static char* makeSetterName(const char* name)
+{
+    size_t nameLength = strlen(name);
+    char* setterName = (char*)malloc(nameLength + 5); // "set" Name ":\0"
+    setterName[0] = 's';
+    setterName[1] = 'e';
+    setterName[2] = 't';
+    setterName[3] = toupper(*name);
+    memcpy(setterName + 4, name + 1, nameLength - 1);
+    setterName[nameLength + 3] = ':';
+    setterName[nameLength + 4] = '\0';
+    return setterName;
+}
+
+static void copyPrototypeProperties(JSContext *context, Class objcClass, Protocol *protocol, JSValue *prototypeValue)
+{
+    // First gather propreties into this list, then handle the methods (capturing the accessor methods).
+    struct Property {
+        const char* name;
+        char* getterName;
+        char* setterName;
+    };
+    __block Vector<Property> propertyList;
+
+    // Map recording the methods used as getters/setters.
+    NSMutableDictionary *accessorMethods = [NSMutableDictionary dictionary];
+
+    // Useful value.
+    JSValue *undefined = [JSValue valueWithUndefinedInContext:context];
+
+    forEachPropertyInProtocol(protocol, ^(objc_property_t property){
+        char* getterName = 0;
+        char* setterName = 0;
+        bool readonly = parsePropertyAttributes(property, getterName, setterName);
+        const char* name = property_getName(property);
+
+        // Add the names of the getter & setter methods to 
+        if (!getterName)
+            getterName = strdup(name);
+        accessorMethods[@(getterName)] = undefined;
+        if (!readonly) {
+            if (!setterName)
+                setterName = makeSetterName(name);
+            accessorMethods[@(setterName)] = undefined;
+        }
+
+        // Add the properties to a list.
+        propertyList.append((Property){ name, getterName, setterName });
+    });
+
+    // Copy methods to the prototype, capturing accessors in the accessorMethods map.
+    copyMethodsToObject(context, objcClass, protocol, YES, prototypeValue, accessorMethods);
+
+    // Iterate the propertyList & generate accessor properties.
+    for (size_t i = 0; i < propertyList.size(); ++i) {
+        Property& property = propertyList[i];
+
+        JSValue *getter = accessorMethods[@(property.getterName)];
+        free(property.getterName);
+        ASSERT(![getter isUndefined]);
+
+        JSValue *setter = undefined;
+        if (property.setterName) {
+            setter = accessorMethods[@(property.setterName)];
+            free(property.setterName);
+            ASSERT(![setter isUndefined]);
+        }
+        
+        [prototypeValue defineProperty:@(property.name) descriptor:@{
+            JSPropertyDescriptorGetKey: getter,
+            JSPropertyDescriptorSetKey: setter,
+            JSPropertyDescriptorEnumerableKey: @NO,
+            JSPropertyDescriptorConfigurableKey: @YES
+        }];
+    }
+}
+
+@interface JSObjCClassInfo : NSObject {
+    JSContext *m_context;
+    Class m_class;
+    bool m_block;
+    JSClassRef m_classRef;
+    JSC::Weak<JSC::JSObject> m_prototype;
+    JSC::Weak<JSC::JSObject> m_constructor;
+}
+
+- (id)initWithContext:(JSContext *)context forClass:(Class)cls;
+- (JSC::JSObject *)wrapperForObject:(id)object;
+- (JSC::JSObject *)constructor;
+- (JSC::JSObject *)prototype;
+
+@end
+
+@implementation JSObjCClassInfo
+
+- (id)initWithContext:(JSContext *)context forClass:(Class)cls
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    const char* className = class_getName(cls);
+    m_context = context;
+    m_class = cls;
+    m_block = [cls isSubclassOfClass:getNSBlockClass()];
+    JSClassDefinition definition;
+    definition = kJSClassDefinitionEmpty;
+    definition.className = className;
+    m_classRef = JSClassCreate(&definition);
+
+    return self;
+}
+
+- (void)dealloc
+{
+    JSClassRelease(m_classRef);
+    [super dealloc];
+}
+
+static JSC::JSObject* allocateConstructorForCustomClass(JSContext *context, const char* className, Class cls)
+{
+    if (!supportsInitMethodConstructors())
+        return constructorWithCustomBrand(context, [NSString stringWithFormat:@"%sConstructor", className], cls);
+
+    // For each protocol that the class implements, gather all of the init family methods into a hash table.
+    __block HashMap<String, Protocol *> initTable;
+    Protocol *exportProtocol = getJSExportProtocol();
+    for (Class currentClass = cls; currentClass; currentClass = class_getSuperclass(currentClass)) {
+        forEachProtocolImplementingProtocol(currentClass, exportProtocol, ^(Protocol *protocol) {
+            forEachMethodInProtocol(protocol, YES, YES, ^(SEL selector, const char*) {
+                const char* name = sel_getName(selector);
+                if (!isInitFamilyMethod(@(name)))
+                    return;
+                initTable.set(name, protocol);
+            });
+        });
+    }
+
+    for (Class currentClass = cls; currentClass; currentClass = class_getSuperclass(currentClass)) {
+        __block unsigned numberOfInitsFound = 0;
+        __block SEL initMethod = 0;
+        __block Protocol *initProtocol = 0;
+        __block const char* types = 0;
+        forEachMethodInClass(currentClass, ^(Method method) {
+            SEL selector = method_getName(method);
+            const char* name = sel_getName(selector);
+            auto iter = initTable.find(name);
+
+            if (iter == initTable.end())
+                return;
+
+            numberOfInitsFound++;
+            initMethod = selector;
+            initProtocol = iter->value;
+            types = method_getTypeEncoding(method);
+        });
+
+        if (!numberOfInitsFound)
+            continue;
+
+        if (numberOfInitsFound > 1) {
+            NSLog(@"ERROR: Class %@ exported more than one init family method via JSExport. Class %@ will not have a callable JavaScript constructor function.", cls, cls);
+            break;
+        }
+
+        JSObjectRef method = objCCallbackFunctionForInit(context, cls, initProtocol, initMethod, types);
+        return toJS(method);
+    }
+    return constructorWithCustomBrand(context, [NSString stringWithFormat:@"%sConstructor", className], cls);
+}
+
+typedef std::pair<JSC::JSObject*, JSC::JSObject*> ConstructorPrototypePair;
+
+- (ConstructorPrototypePair)allocateConstructorAndPrototype
+{
+    JSObjCClassInfo* superClassInfo = [m_context.wrapperMap classInfoForClass:class_getSuperclass(m_class)];
+
+    ASSERT(!m_constructor || !m_prototype);
+    ASSERT((m_class == [NSObject class]) == !superClassInfo);
+
+    JSC::JSObject* jsPrototype = m_prototype.get();
+    JSC::JSObject* jsConstructor = m_constructor.get();
+
+    if (!superClassInfo) {
+        JSContextRef cContext = [m_context JSGlobalContextRef];
+        JSValue *constructor = m_context[@"Object"];
+        if (!jsConstructor)
+            jsConstructor = toJS(JSValueToObject(cContext, valueInternalValue(constructor), 0));
+
+        if (!jsPrototype) {
+            JSValue *prototype = constructor[@"prototype"];
+            jsPrototype = toJS(JSValueToObject(cContext, valueInternalValue(prototype), 0));
+        }
+    } else {
+        const char* className = class_getName(m_class);
+
+        // Create or grab the prototype/constructor pair.
+        if (!jsPrototype)
+            jsPrototype = objectWithCustomBrand(m_context, [NSString stringWithFormat:@"%sPrototype", className]);
+
+        if (!jsConstructor)
+            jsConstructor = allocateConstructorForCustomClass(m_context, className, m_class);
+
+        JSValue* prototype = [JSValue valueWithJSValueRef:toRef(jsPrototype) inContext:m_context];
+        JSValue* constructor = [JSValue valueWithJSValueRef:toRef(jsConstructor) inContext:m_context];
+        putNonEnumerable(prototype, @"constructor", constructor);
+        putNonEnumerable(constructor, @"prototype", prototype);
+
+        Protocol *exportProtocol = getJSExportProtocol();
+        forEachProtocolImplementingProtocol(m_class, exportProtocol, ^(Protocol *protocol){
+            copyPrototypeProperties(m_context, m_class, protocol, prototype);
+            copyMethodsToObject(m_context, m_class, protocol, NO, constructor);
+        });
+
+        // Set [Prototype].
+        JSC::JSObject* superClassPrototype = [superClassInfo prototype];
+        JSObjectSetPrototype([m_context JSGlobalContextRef], toRef(jsPrototype), toRef(superClassPrototype));
+    }
+
+    m_prototype = jsPrototype;
+    m_constructor = jsConstructor;
+    return ConstructorPrototypePair(jsConstructor, jsPrototype);
+}
+
+- (JSC::JSObject*)wrapperForObject:(id)object
+{
+    ASSERT([object isKindOfClass:m_class]);
+    ASSERT(m_block == [object isKindOfClass:getNSBlockClass()]);
+    if (m_block) {
+        if (JSObjectRef method = objCCallbackFunctionForBlock(m_context, object)) {
+            JSValue *constructor = [JSValue valueWithJSValueRef:method inContext:m_context];
+            JSValue *prototype = [JSValue valueWithNewObjectInContext:m_context];
+            putNonEnumerable(constructor, @"prototype", prototype);
+            putNonEnumerable(prototype, @"constructor", constructor);
+            return toJS(method);
+        }
+    }
+
+    JSC::JSObject* prototype = [self prototype];
+
+    JSC::JSObject* wrapper = makeWrapper([m_context JSGlobalContextRef], m_classRef, object);
+    JSObjectSetPrototype([m_context JSGlobalContextRef], toRef(wrapper), toRef(prototype));
+    return wrapper;
+}
+
+- (JSC::JSObject*)constructor
+{
+    JSC::JSObject* constructor = m_constructor.get();
+    if (!constructor)
+        constructor = [self allocateConstructorAndPrototype].first;
+    ASSERT(!!constructor);
+    return constructor;
+}
+
+- (JSC::JSObject*)prototype
+{
+    JSC::JSObject* prototype = m_prototype.get();
+    if (!prototype)
+        prototype = [self allocateConstructorAndPrototype].second;
+    ASSERT(!!prototype);
+    return prototype;
+}
+
+@end
+
+@implementation JSWrapperMap {
+    JSContext *m_context;
+    NSMutableDictionary *m_classMap;
+    std::unique_ptr<JSC::WeakGCMap<id, JSC::JSObject>> m_cachedJSWrappers;
+    NSMapTable *m_cachedObjCWrappers;
+}
+
+- (id)initWithContext:(JSContext *)context
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    NSPointerFunctionsOptions keyOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsOpaquePersonality;
+    NSPointerFunctionsOptions valueOptions = NSPointerFunctionsWeakMemory | NSPointerFunctionsObjectPersonality;
+    m_cachedObjCWrappers = [[NSMapTable alloc] initWithKeyOptions:keyOptions valueOptions:valueOptions capacity:0];
+
+    m_cachedJSWrappers = std::make_unique<JSC::WeakGCMap<id, JSC::JSObject>>(toJS([context JSGlobalContextRef])->vm());
+
+    m_context = context;
+    m_classMap = [[NSMutableDictionary alloc] init];
+    return self;
+}
+
+- (void)dealloc
+{
+    [m_cachedObjCWrappers release];
+    [m_classMap release];
+    [super dealloc];
+}
+
+- (JSObjCClassInfo*)classInfoForClass:(Class)cls
+{
+    if (!cls)
+        return nil;
+
+    // Check if we've already created a JSObjCClassInfo for this Class.
+    if (JSObjCClassInfo* classInfo = (JSObjCClassInfo*)m_classMap[cls])
+        return classInfo;
+
+    // Skip internal classes beginning with '_' - just copy link to the parent class's info.
+    if ('_' == *class_getName(cls))
+        return m_classMap[cls] = [self classInfoForClass:class_getSuperclass(cls)];
+
+    return m_classMap[cls] = [[[JSObjCClassInfo alloc] initWithContext:m_context forClass:cls] autorelease];
+}
+
+- (JSValue *)jsWrapperForObject:(id)object
+{
+    JSC::JSObject* jsWrapper = m_cachedJSWrappers->get(object);
+    if (jsWrapper)
+        return [JSValue valueWithJSValueRef:toRef(jsWrapper) inContext:m_context];
+
+    if (class_isMetaClass(object_getClass(object)))
+        jsWrapper = [[self classInfoForClass:(Class)object] constructor];
+    else {
+        JSObjCClassInfo* classInfo = [self classInfoForClass:[object class]];
+        jsWrapper = [classInfo wrapperForObject:object];
+    }
+
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=105891
+    // This general approach to wrapper caching is pretty effective, but there are a couple of problems:
+    // (1) For immortal objects JSValues will effectively leak and this results in error output being logged - we should avoid adding associated objects to immortal objects.
+    // (2) A long lived object may rack up many JSValues. When the contexts are released these will unprotect the associated JavaScript objects,
+    //     but still, would probably nicer if we made it so that only one associated object was required, broadcasting object dealloc.
+    m_cachedJSWrappers->set(object, jsWrapper);
+    return [JSValue valueWithJSValueRef:toRef(jsWrapper) inContext:m_context];
+}
+
+- (JSValue *)objcWrapperForJSValueRef:(JSValueRef)value
+{
+    JSValue *wrapper = static_cast<JSValue *>(NSMapGet(m_cachedObjCWrappers, value));
+    if (!wrapper) {
+        wrapper = [[[JSValue alloc] initWithValue:value inContext:m_context] autorelease];
+        NSMapInsert(m_cachedObjCWrappers, value, wrapper);
+    }
+    return wrapper;
+}
+
+@end
+
+id tryUnwrapObjcObject(JSGlobalContextRef context, JSValueRef value)
+{
+    if (!JSValueIsObject(context, value))
+        return nil;
+    JSValueRef exception = 0;
+    JSObjectRef object = JSValueToObject(context, value, &exception);
+    ASSERT(!exception);
+    JSC::JSLockHolder locker(toJS(context));
+    if (toJS(object)->inherits(JSC::JSCallbackObject<JSC::JSAPIWrapperObject>::info()))
+        return (id)JSC::jsCast<JSC::JSAPIWrapperObject*>(toJS(object))->wrappedObject();
+    if (id target = tryUnwrapConstructor(object))
+        return target;
+    return nil;
+}
+
+// This class ensures that the JSExport protocol is registered with the runtime.
+NS_ROOT_CLASS @interface JSExport <JSExport>
+@end
+@implementation JSExport
+@end
+
+bool supportsInitMethodConstructors()
+{
+#if PLATFORM(APPLETV)
+    // There are no old clients on Apple TV, so there's no need for backwards compatibility.
+    return true;
+#else
+    // First check to see the version of JavaScriptCore we directly linked against.
+    static int32_t versionOfLinkTimeJavaScriptCore = 0;
+    if (!versionOfLinkTimeJavaScriptCore)
+        versionOfLinkTimeJavaScriptCore = NSVersionOfLinkTimeLibrary("JavaScriptCore");
+    // Only do the link time version comparison if we linked directly with JavaScriptCore
+    if (versionOfLinkTimeJavaScriptCore != -1)
+        return versionOfLinkTimeJavaScriptCore >= firstJavaScriptCoreVersionWithInitConstructorSupport;
+
+    // If we didn't link directly with JavaScriptCore,
+    // base our check on what SDK was used to build the application.
+    static uint32_t programSDKVersion = 0;
+    if (!programSDKVersion)
+        programSDKVersion = dyld_get_program_sdk_version();
+
+    return programSDKVersion >= firstSDKVersionWithInitConstructorSupport;
+#endif
+}
+
+Protocol *getJSExportProtocol()
+{
+    static Protocol *protocol = objc_getProtocol("JSExport");
+    return protocol;
+}
+
+Class getNSBlockClass()
+{
+    static Class cls = objc_getClass("NSBlock");
+    return cls;
+}
+
+#endif
diff --git a/API/JavaScript.h b/API/JavaScript.h
new file mode 100644
index 0000000..251e393
--- /dev/null
+++ b/API/JavaScript.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2006 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Alp Toker <alp@atoker.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JavaScript_h
+#define JavaScript_h
+
+#include <JavaScriptCore/JSBase.h>
+#include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSStringRef.h>
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSTypedArray.h>
+#include <JavaScriptCore/JSValueRef.h>
+
+#endif /* JavaScript_h */
diff --git a/API/JavaScriptCore.h b/API/JavaScriptCore.h
new file mode 100644
index 0000000..b2fde1d
--- /dev/null
+++ b/API/JavaScriptCore.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JavaScriptCore_h
+#define JavaScriptCore_h
+
+#include <JavaScriptCore/JavaScript.h>
+#include <JavaScriptCore/JSStringRefCF.h>
+
+#if defined(__OBJC__) && JSC_OBJC_API_ENABLED
+
+#import "JSContext.h"
+#import "JSValue.h"
+#import "JSManagedValue.h"
+#import "JSVirtualMachine.h"
+#import "JSExport.h"
+
+#endif
+
+#endif /* JavaScriptCore_h */
diff --git a/API/ObjCCallbackFunction.h b/API/ObjCCallbackFunction.h
new file mode 100644
index 0000000..1c0995e
--- /dev/null
+++ b/API/ObjCCallbackFunction.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+#ifndef ObjCCallbackFunction_h
+#define ObjCCallbackFunction_h 
+
+#include <JavaScriptCore/JSBase.h>
+
+#if JSC_OBJC_API_ENABLED
+
+#import <JavaScriptCore/JSCallbackFunction.h>
+
+#if defined(__OBJC__)
+JSObjectRef objCCallbackFunctionForMethod(JSContext *, Class, Protocol *, BOOL isInstanceMethod, SEL, const char* types);
+JSObjectRef objCCallbackFunctionForBlock(JSContext *, id);
+JSObjectRef objCCallbackFunctionForInit(JSContext *, Class, Protocol *, SEL, const char* types);
+
+id tryUnwrapConstructor(JSObjectRef);
+#endif
+
+namespace JSC {
+
+class ObjCCallbackFunctionImpl;
+
+class ObjCCallbackFunction : public InternalFunction {
+    friend struct APICallbackFunction;
+public:
+    typedef InternalFunction Base;
+
+    static ObjCCallbackFunction* create(VM&, JSGlobalObject*, const String& name, std::unique_ptr<ObjCCallbackFunctionImpl>);
+    static void destroy(JSCell*);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    ObjCCallbackFunctionImpl* impl() const { return m_impl.get(); }
+
+protected:
+    ObjCCallbackFunction(VM&, Structure*, JSObjectCallAsFunctionCallback, JSObjectCallAsConstructorCallback, std::unique_ptr<ObjCCallbackFunctionImpl>);
+
+private:
+    static CallType getCallData(JSCell*, CallData&);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+
+    JSObjectCallAsFunctionCallback functionCallback() { return m_functionCallback; }
+    JSObjectCallAsConstructorCallback constructCallback() { return m_constructCallback; }
+
+    JSObjectCallAsFunctionCallback m_functionCallback;
+    JSObjectCallAsConstructorCallback m_constructCallback;
+    std::unique_ptr<ObjCCallbackFunctionImpl> m_impl;
+};
+
+} // namespace JSC
+
+#endif
+
+#endif // ObjCCallbackFunction_h 
diff --git a/API/ObjCCallbackFunction.mm b/API/ObjCCallbackFunction.mm
new file mode 100644
index 0000000..ffdc0d4
--- /dev/null
+++ b/API/ObjCCallbackFunction.mm
@@ -0,0 +1,728 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#import "JavaScriptCore.h"
+
+#if JSC_OBJC_API_ENABLED
+
+#import "APICallbackFunction.h"
+#import "APICast.h"
+#import "Error.h"
+#import "JSCell.h"
+#import "JSCInlines.h"
+#import "JSContextInternal.h"
+#import "JSWrapperMap.h"
+#import "JSValueInternal.h"
+#import "ObjCCallbackFunction.h"
+#import "ObjcRuntimeExtras.h"
+#import "StructureInlines.h"
+#import <objc/runtime.h>
+#import <wtf/RetainPtr.h>
+
+class CallbackArgument {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    virtual ~CallbackArgument();
+    virtual void set(NSInvocation *, NSInteger, JSContext *, JSValueRef, JSValueRef*) = 0;
+
+    std::unique_ptr<CallbackArgument> m_next;
+};
+
+CallbackArgument::~CallbackArgument()
+{
+}
+
+class CallbackArgumentBoolean : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef*) override
+    {
+        bool value = JSValueToBoolean([context JSGlobalContextRef], argument);
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+template<typename T>
+class CallbackArgumentInteger : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef* exception) override
+    {
+        T value = (T)JSC::toInt32(JSValueToNumber([context JSGlobalContextRef], argument, exception));
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+template<typename T>
+class CallbackArgumentDouble : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef* exception) override
+    {
+        T value = (T)JSValueToNumber([context JSGlobalContextRef], argument, exception);
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+class CallbackArgumentJSValue : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef*) override
+    {
+        JSValue *value = [JSValue valueWithJSValueRef:argument inContext:context];
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+class CallbackArgumentId : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef*) override
+    {
+        id value = valueToObject(context, argument);
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+class CallbackArgumentOfClass : public CallbackArgument {
+public:
+    CallbackArgumentOfClass(Class cls)
+        : m_class(cls)
+    {
+    }
+
+private:
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef* exception) override
+    {
+        JSGlobalContextRef contextRef = [context JSGlobalContextRef];
+
+        id object = tryUnwrapObjcObject(contextRef, argument);
+        if (object && [object isKindOfClass:m_class.get()]) {
+            [invocation setArgument:&object atIndex:argumentNumber];
+            return;
+        }
+
+        if (JSValueIsNull(contextRef, argument) || JSValueIsUndefined(contextRef, argument)) {
+            object = nil;
+            [invocation setArgument:&object atIndex:argumentNumber];
+            return;
+        }
+
+        *exception = toRef(JSC::createTypeError(toJS(contextRef), ASCIILiteral("Argument does not match Objective-C Class")));
+    }
+
+    RetainPtr<Class> m_class;
+};
+
+class CallbackArgumentNSNumber : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef* exception) override
+    {
+        id value = valueToNumber([context JSGlobalContextRef], argument, exception);
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+class CallbackArgumentNSString : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef* exception) override
+    {
+        id value = valueToString([context JSGlobalContextRef], argument, exception);
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+class CallbackArgumentNSDate : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef* exception) override
+    {
+        id value = valueToDate([context JSGlobalContextRef], argument, exception);
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+class CallbackArgumentNSArray : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef* exception) override
+    {
+        id value = valueToArray([context JSGlobalContextRef], argument, exception);
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+class CallbackArgumentNSDictionary : public CallbackArgument {
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef* exception) override
+    {
+        id value = valueToDictionary([context JSGlobalContextRef], argument, exception);
+        [invocation setArgument:&value atIndex:argumentNumber];
+    }
+};
+
+class CallbackArgumentStruct : public CallbackArgument {
+public:
+    CallbackArgumentStruct(NSInvocation *conversionInvocation, const char* encodedType)
+        : m_conversionInvocation(conversionInvocation)
+        , m_buffer(encodedType)
+    {
+    }
+    
+private:
+    void set(NSInvocation *invocation, NSInteger argumentNumber, JSContext *context, JSValueRef argument, JSValueRef*) override
+    {
+        JSValue *value = [JSValue valueWithJSValueRef:argument inContext:context];
+        [m_conversionInvocation invokeWithTarget:value];
+        [m_conversionInvocation getReturnValue:m_buffer];
+        [invocation setArgument:m_buffer atIndex:argumentNumber];
+    }
+
+    RetainPtr<NSInvocation> m_conversionInvocation;
+    StructBuffer m_buffer;
+};
+
+class ArgumentTypeDelegate {
+public:
+    typedef std::unique_ptr<CallbackArgument> ResultType;
+
+    template<typename T>
+    static ResultType typeInteger()
+    {
+        return std::make_unique<CallbackArgumentInteger<T>>();
+    }
+
+    template<typename T>
+    static ResultType typeDouble()
+    {
+        return std::make_unique<CallbackArgumentDouble<T>>();
+    }
+
+    static ResultType typeBool()
+    {
+        return std::make_unique<CallbackArgumentBoolean>();
+    }
+
+    static ResultType typeVoid()
+    {
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    static ResultType typeId()
+    {
+        return std::make_unique<CallbackArgumentId>();
+    }
+
+    static ResultType typeOfClass(const char* begin, const char* end)
+    {
+        StringRange copy(begin, end);
+        Class cls = objc_getClass(copy);
+        if (!cls)
+            return nullptr;
+
+        if (cls == [JSValue class])
+            return std::make_unique<CallbackArgumentJSValue>();
+        if (cls == [NSString class])
+            return std::make_unique<CallbackArgumentNSString>();
+        if (cls == [NSNumber class])
+            return std::make_unique<CallbackArgumentNSNumber>();
+        if (cls == [NSDate class])
+            return std::make_unique<CallbackArgumentNSDate>();
+        if (cls == [NSArray class])
+            return std::make_unique<CallbackArgumentNSArray>();
+        if (cls == [NSDictionary class])
+            return std::make_unique<CallbackArgumentNSDictionary>();
+
+        return std::make_unique<CallbackArgumentOfClass>(cls);
+    }
+
+    static ResultType typeBlock(const char*, const char*)
+    {
+        return nullptr;
+    }
+
+    static ResultType typeStruct(const char* begin, const char* end)
+    {
+        StringRange copy(begin, end);
+        if (NSInvocation *invocation = valueToTypeInvocationFor(copy))
+            return std::make_unique<CallbackArgumentStruct>(invocation, copy);
+        return nullptr;
+    }
+};
+
+class CallbackResult {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    virtual ~CallbackResult()
+    {
+    }
+
+    virtual JSValueRef get(NSInvocation *, JSContext *, JSValueRef*) = 0;
+};
+
+class CallbackResultVoid : public CallbackResult {
+    JSValueRef get(NSInvocation *, JSContext *context, JSValueRef*) override
+    {
+        return JSValueMakeUndefined([context JSGlobalContextRef]);
+    }
+};
+
+class CallbackResultId : public CallbackResult {
+    JSValueRef get(NSInvocation *invocation, JSContext *context, JSValueRef*) override
+    {
+        id value;
+        [invocation getReturnValue:&value];
+        return objectToValue(context, value);
+    }
+};
+
+template<typename T>
+class CallbackResultNumeric : public CallbackResult {
+    JSValueRef get(NSInvocation *invocation, JSContext *context, JSValueRef*) override
+    {
+        T value;
+        [invocation getReturnValue:&value];
+        return JSValueMakeNumber([context JSGlobalContextRef], value);
+    }
+};
+
+class CallbackResultBoolean : public CallbackResult {
+    JSValueRef get(NSInvocation *invocation, JSContext *context, JSValueRef*) override
+    {
+        bool value;
+        [invocation getReturnValue:&value];
+        return JSValueMakeBoolean([context JSGlobalContextRef], value);
+    }
+};
+
+class CallbackResultStruct : public CallbackResult {
+public:
+    CallbackResultStruct(NSInvocation *conversionInvocation, const char* encodedType)
+        : m_conversionInvocation(conversionInvocation)
+        , m_buffer(encodedType)
+    {
+    }
+    
+private:
+    JSValueRef get(NSInvocation *invocation, JSContext *context, JSValueRef*) override
+    {
+        [invocation getReturnValue:m_buffer];
+
+        [m_conversionInvocation setArgument:m_buffer atIndex:2];
+        [m_conversionInvocation setArgument:&context atIndex:3];
+        [m_conversionInvocation invokeWithTarget:[JSValue class]];
+
+        JSValue *value;
+        [m_conversionInvocation getReturnValue:&value];
+        return valueInternalValue(value);
+    }
+
+    RetainPtr<NSInvocation> m_conversionInvocation;
+    StructBuffer m_buffer;
+};
+
+class ResultTypeDelegate {
+public:
+    typedef std::unique_ptr<CallbackResult> ResultType;
+
+    template<typename T>
+    static ResultType typeInteger()
+    {
+        return std::make_unique<CallbackResultNumeric<T>>();
+    }
+
+    template<typename T>
+    static ResultType typeDouble()
+    {
+        return std::make_unique<CallbackResultNumeric<T>>();
+    }
+
+    static ResultType typeBool()
+    {
+        return std::make_unique<CallbackResultBoolean>();
+    }
+
+    static ResultType typeVoid()
+    {
+        return std::make_unique<CallbackResultVoid>();
+    }
+
+    static ResultType typeId()
+    {
+        return std::make_unique<CallbackResultId>();
+    }
+
+    static ResultType typeOfClass(const char*, const char*)
+    {
+        return std::make_unique<CallbackResultId>();
+    }
+
+    static ResultType typeBlock(const char*, const char*)
+    {
+        return std::make_unique<CallbackResultId>();
+    }
+
+    static ResultType typeStruct(const char* begin, const char* end)
+    {
+        StringRange copy(begin, end);
+        if (NSInvocation *invocation = typeToValueInvocationFor(copy))
+            return std::make_unique<CallbackResultStruct>(invocation, copy);
+        return nullptr;
+    }
+};
+
+enum CallbackType {
+    CallbackInitMethod,
+    CallbackInstanceMethod,
+    CallbackClassMethod,
+    CallbackBlock
+};
+
+namespace JSC {
+
+class ObjCCallbackFunctionImpl {
+public:
+    ObjCCallbackFunctionImpl(NSInvocation *invocation, CallbackType type, Class instanceClass, std::unique_ptr<CallbackArgument> arguments, std::unique_ptr<CallbackResult> result)
+        : m_type(type)
+        , m_instanceClass(instanceClass)
+        , m_invocation(invocation)
+        , m_arguments(WTFMove(arguments))
+        , m_result(WTFMove(result))
+    {
+        ASSERT((type != CallbackInstanceMethod && type != CallbackInitMethod) || instanceClass);
+    }
+
+    void destroy(Heap& heap)
+    {
+        // We need to explicitly release the target since we didn't call 
+        // -retainArguments on m_invocation (and we don't want to do so).
+        if (m_type == CallbackBlock || m_type == CallbackClassMethod)
+            heap.releaseSoon(adoptNS([m_invocation.get() target]));
+        m_instanceClass = nil;
+    }
+
+    JSValueRef call(JSContext *context, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+
+    id wrappedBlock()
+    {
+        return m_type == CallbackBlock ? [m_invocation target] : nil;
+    }
+
+    id wrappedConstructor()
+    {
+        switch (m_type) {
+        case CallbackBlock:
+            return [m_invocation target];
+        case CallbackInitMethod:
+            return m_instanceClass.get();
+        default:
+            return nil;
+        }
+    }
+
+    CallbackType type() const { return m_type; }
+
+    bool isConstructible()
+    {
+        return !!wrappedBlock() || m_type == CallbackInitMethod;
+    }
+
+    String name();
+
+private:
+    CallbackType m_type;
+    RetainPtr<Class> m_instanceClass;
+    RetainPtr<NSInvocation> m_invocation;
+    std::unique_ptr<CallbackArgument> m_arguments;
+    std::unique_ptr<CallbackResult> m_result;
+};
+
+static JSValueRef objCCallbackFunctionCallAsFunction(JSContextRef callerContext, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Retake the API lock - we need this for a few reasons:
+    // (1) We don't want to support the C-API's confusing drops-locks-once policy - should only drop locks if we can do so recursively.
+    // (2) We're calling some JSC internals that require us to be on the 'inside' - e.g. createTypeError.
+    // (3) We need to be locked (per context would be fine) against conflicting usage of the ObjCCallbackFunction's NSInvocation.
+    JSC::JSLockHolder locker(toJS(callerContext));
+
+    ObjCCallbackFunction* callback = static_cast<ObjCCallbackFunction*>(toJS(function));
+    ObjCCallbackFunctionImpl* impl = callback->impl();
+    JSContext *context = [JSContext contextWithJSGlobalContextRef:toGlobalRef(callback->globalObject()->globalExec())];
+
+    if (impl->type() == CallbackInitMethod) {
+        JSGlobalContextRef contextRef = [context JSGlobalContextRef];
+        *exception = toRef(JSC::createTypeError(toJS(contextRef), ASCIILiteral("Cannot call a class constructor without |new|")));
+        return JSValueMakeUndefined(contextRef);
+    }
+
+    CallbackData callbackData;
+    JSValueRef result;
+    @autoreleasepool {
+        [context beginCallbackWithData:&callbackData calleeValue:function thisValue:thisObject argumentCount:argumentCount arguments:arguments];
+        result = impl->call(context, thisObject, argumentCount, arguments, exception);
+        if (context.exception)
+            *exception = valueInternalValue(context.exception);
+        [context endCallbackWithData:&callbackData];
+    }
+    return result;
+}
+
+static JSObjectRef objCCallbackFunctionCallAsConstructor(JSContextRef callerContext, JSObjectRef constructor, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    JSC::JSLockHolder locker(toJS(callerContext));
+
+    ObjCCallbackFunction* callback = static_cast<ObjCCallbackFunction*>(toJS(constructor));
+    ObjCCallbackFunctionImpl* impl = callback->impl();
+    JSContext *context = [JSContext contextWithJSGlobalContextRef:toGlobalRef(toJS(callerContext)->lexicalGlobalObject()->globalExec())];
+
+    CallbackData callbackData;
+    JSValueRef result;
+    @autoreleasepool {
+        [context beginCallbackWithData:&callbackData calleeValue:constructor thisValue:nullptr argumentCount:argumentCount arguments:arguments];
+        result = impl->call(context, nullptr, argumentCount, arguments, exception);
+        if (context.exception)
+            *exception = valueInternalValue(context.exception);
+        [context endCallbackWithData:&callbackData];
+    }
+
+    JSGlobalContextRef contextRef = [context JSGlobalContextRef];
+    if (*exception)
+        return nullptr;
+
+    if (!JSValueIsObject(contextRef, result)) {
+        *exception = toRef(JSC::createTypeError(toJS(contextRef), ASCIILiteral("Objective-C blocks called as constructors must return an object.")));
+        return nullptr;
+    }
+    return (JSObjectRef)result;
+}
+
+const JSC::ClassInfo ObjCCallbackFunction::s_info = { "CallbackFunction", &Base::s_info, 0, CREATE_METHOD_TABLE(ObjCCallbackFunction) };
+
+ObjCCallbackFunction::ObjCCallbackFunction(JSC::VM& vm, JSC::Structure* structure, JSObjectCallAsFunctionCallback functionCallback, JSObjectCallAsConstructorCallback constructCallback, std::unique_ptr<ObjCCallbackFunctionImpl> impl)
+    : Base(vm, structure)
+    , m_functionCallback(functionCallback)
+    , m_constructCallback(constructCallback)
+    , m_impl(WTFMove(impl))
+{
+}
+
+ObjCCallbackFunction* ObjCCallbackFunction::create(JSC::VM& vm, JSC::JSGlobalObject* globalObject, const String& name, std::unique_ptr<ObjCCallbackFunctionImpl> impl)
+{
+    Structure* structure = globalObject->objcCallbackFunctionStructure();
+    ObjCCallbackFunction* function = new (NotNull, allocateCell<ObjCCallbackFunction>(vm.heap)) ObjCCallbackFunction(vm, structure, objCCallbackFunctionCallAsFunction, objCCallbackFunctionCallAsConstructor, WTFMove(impl));
+    function->finishCreation(vm, name);
+    return function;
+}
+
+void ObjCCallbackFunction::destroy(JSCell* cell)
+{
+    ObjCCallbackFunction& function = *jsCast<ObjCCallbackFunction*>(cell);
+    function.impl()->destroy(*Heap::heap(cell));
+    function.~ObjCCallbackFunction();
+}
+
+
+CallType ObjCCallbackFunction::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = APICallbackFunction::call<ObjCCallbackFunction>;
+    return CallType::Host;
+}
+
+ConstructType ObjCCallbackFunction::getConstructData(JSCell* cell, ConstructData& constructData)
+{
+    ObjCCallbackFunction* callback = jsCast<ObjCCallbackFunction*>(cell);
+    if (!callback->impl()->isConstructible())
+        return Base::getConstructData(cell, constructData);
+    constructData.native.function = APICallbackFunction::construct<ObjCCallbackFunction>;
+    return ConstructType::Host;
+}
+
+String ObjCCallbackFunctionImpl::name()
+{
+    if (m_type == CallbackInitMethod)
+        return class_getName(m_instanceClass.get());
+    // FIXME: Maybe we could support having the selector as the name of the non-init 
+    // functions to make it a bit more user-friendly from the JS side?
+    return "";
+}
+
+JSValueRef ObjCCallbackFunctionImpl::call(JSContext *context, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    JSGlobalContextRef contextRef = [context JSGlobalContextRef];
+
+    id target;
+    size_t firstArgument;
+    switch (m_type) {
+    case CallbackInitMethod: {
+        RELEASE_ASSERT(!thisObject);
+        target = [m_instanceClass alloc];
+        if (!target || ![target isKindOfClass:m_instanceClass.get()]) {
+            *exception = toRef(JSC::createTypeError(toJS(contextRef), ASCIILiteral("self type check failed for Objective-C instance method")));
+            return JSValueMakeUndefined(contextRef);
+        }
+        [m_invocation setTarget:target];
+        firstArgument = 2;
+        break;
+    }
+    case CallbackInstanceMethod: {
+        target = tryUnwrapObjcObject(contextRef, thisObject);
+        if (!target || ![target isKindOfClass:m_instanceClass.get()]) {
+            *exception = toRef(JSC::createTypeError(toJS(contextRef), ASCIILiteral("self type check failed for Objective-C instance method")));
+            return JSValueMakeUndefined(contextRef);
+        }
+        [m_invocation setTarget:target];
+        firstArgument = 2;
+        break;
+    }
+    case CallbackClassMethod:
+        firstArgument = 2;
+        break;
+    case CallbackBlock:
+        firstArgument = 1;
+    }
+
+    size_t argumentNumber = 0;
+    for (CallbackArgument* argument = m_arguments.get(); argument; argument = argument->m_next.get()) {
+        JSValueRef value = argumentNumber < argumentCount ? arguments[argumentNumber] : JSValueMakeUndefined(contextRef);
+        argument->set(m_invocation.get(), argumentNumber + firstArgument, context, value, exception);
+        if (*exception)
+            return JSValueMakeUndefined(contextRef);
+        ++argumentNumber;
+    }
+
+    [m_invocation invoke];
+
+    JSValueRef result = m_result->get(m_invocation.get(), context, exception);
+
+    // Balance our call to -alloc with a call to -autorelease. We have to do this after calling -init
+    // because init family methods are allowed to release the allocated object and return something 
+    // else in its place.
+    if (m_type == CallbackInitMethod) {
+        id objcResult = tryUnwrapObjcObject(contextRef, result);
+        if (objcResult)
+            [objcResult autorelease];
+    }
+
+    return result;
+}
+
+} // namespace JSC
+
+static bool blockSignatureContainsClass()
+{
+    static bool containsClass = ^{
+        id block = ^(NSString *string){ return string; };
+        return _Block_has_signature(block) && strstr(_Block_signature(block), "NSString");
+    }();
+    return containsClass;
+}
+
+static inline bool skipNumber(const char*& position)
+{
+    if (!isASCIIDigit(*position))
+        return false;
+    while (isASCIIDigit(*++position)) { }
+    return true;
+}
+
+static JSObjectRef objCCallbackFunctionForInvocation(JSContext *context, NSInvocation *invocation, CallbackType type, Class instanceClass, const char* signatureWithObjcClasses)
+{
+    if (!signatureWithObjcClasses)
+        return nullptr;
+
+    const char* position = signatureWithObjcClasses;
+
+    auto result = parseObjCType<ResultTypeDelegate>(position);
+    if (!result || !skipNumber(position))
+        return nullptr;
+
+    switch (type) {
+    case CallbackInitMethod:
+    case CallbackInstanceMethod:
+    case CallbackClassMethod:
+        // Methods are passed two implicit arguments - (id)self, and the selector.
+        if ('@' != *position++ || !skipNumber(position) || ':' != *position++ || !skipNumber(position))
+            return nullptr;
+        break;
+    case CallbackBlock:
+        // Blocks are passed one implicit argument - the block, of type "@?".
+        if (('@' != *position++) || ('?' != *position++) || !skipNumber(position))
+            return nullptr;
+        // Only allow arguments of type 'id' if the block signature contains the NS type information.
+        if ((!blockSignatureContainsClass() && strchr(position, '@')))
+            return nullptr;
+        break;
+    }
+
+    std::unique_ptr<CallbackArgument> arguments;
+    auto* nextArgument = &arguments;
+    unsigned argumentCount = 0;
+    while (*position) {
+        auto argument = parseObjCType<ArgumentTypeDelegate>(position);
+        if (!argument || !skipNumber(position))
+            return nullptr;
+
+        *nextArgument = WTFMove(argument);
+        nextArgument = &(*nextArgument)->m_next;
+        ++argumentCount;
+    }
+
+    JSC::ExecState* exec = toJS([context JSGlobalContextRef]);
+    JSC::JSLockHolder locker(exec);
+    auto impl = std::make_unique<JSC::ObjCCallbackFunctionImpl>(invocation, type, instanceClass, WTFMove(arguments), WTFMove(result));
+    const String& name = impl->name();
+    return toRef(JSC::ObjCCallbackFunction::create(exec->vm(), exec->lexicalGlobalObject(), name, WTFMove(impl)));
+}
+
+JSObjectRef objCCallbackFunctionForInit(JSContext *context, Class cls, Protocol *protocol, SEL sel, const char* types)
+{
+    NSInvocation *invocation = [NSInvocation invocationWithMethodSignature:[NSMethodSignature signatureWithObjCTypes:types]];
+    [invocation setSelector:sel];
+    return objCCallbackFunctionForInvocation(context, invocation, CallbackInitMethod, cls, _protocol_getMethodTypeEncoding(protocol, sel, YES, YES));
+}
+
+JSObjectRef objCCallbackFunctionForMethod(JSContext *context, Class cls, Protocol *protocol, BOOL isInstanceMethod, SEL sel, const char* types)
+{
+    NSInvocation *invocation = [NSInvocation invocationWithMethodSignature:[NSMethodSignature signatureWithObjCTypes:types]];
+    [invocation setSelector:sel];
+    // We need to retain the target Class because m_invocation doesn't retain it by default (and we don't want it to).
+    // FIXME: What releases it?
+    if (!isInstanceMethod)
+        [invocation setTarget:[cls retain]];
+    return objCCallbackFunctionForInvocation(context, invocation, isInstanceMethod ? CallbackInstanceMethod : CallbackClassMethod, isInstanceMethod ? cls : nil, _protocol_getMethodTypeEncoding(protocol, sel, YES, isInstanceMethod));
+}
+
+JSObjectRef objCCallbackFunctionForBlock(JSContext *context, id target)
+{
+    if (!_Block_has_signature(target))
+        return nullptr;
+    const char* signature = _Block_signature(target);
+    NSInvocation *invocation = [NSInvocation invocationWithMethodSignature:[NSMethodSignature signatureWithObjCTypes:signature]];
+
+    // We don't want to use -retainArguments because that leaks memory. Arguments 
+    // would be retained indefinitely between invocations of the callback.
+    // Additionally, we copy the target because we want the block to stick around
+    // until the ObjCCallbackFunctionImpl is destroyed.
+    [invocation setTarget:[target copy]];
+
+    return objCCallbackFunctionForInvocation(context, invocation, CallbackBlock, nil, signature);
+}
+
+id tryUnwrapConstructor(JSObjectRef object)
+{
+    if (!toJS(object)->inherits(JSC::ObjCCallbackFunction::info()))
+        return nil;
+    JSC::ObjCCallbackFunctionImpl* impl = static_cast<JSC::ObjCCallbackFunction*>(toJS(object))->impl();
+    if (!impl->isConstructible())
+        return nil;
+    return impl->wrappedConstructor();
+}
+
+#endif
diff --git a/API/ObjcRuntimeExtras.h b/API/ObjcRuntimeExtras.h
new file mode 100644
index 0000000..128df5c
--- /dev/null
+++ b/API/ObjcRuntimeExtras.h
@@ -0,0 +1,242 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import <objc/Protocol.h>
+#import <objc/runtime.h>
+#import <wtf/HashSet.h>
+#import <wtf/Vector.h>
+
+inline bool protocolImplementsProtocol(Protocol *candidate, Protocol *target)
+{
+    unsigned protocolProtocolsCount;
+    Protocol ** protocolProtocols = protocol_copyProtocolList(candidate, &protocolProtocolsCount);
+    for (unsigned i = 0; i < protocolProtocolsCount; ++i) {
+        if (protocol_isEqual(protocolProtocols[i], target)) {
+            free(protocolProtocols);
+            return true;
+        }
+    }
+    free(protocolProtocols);
+    return false;
+}
+
+inline void forEachProtocolImplementingProtocol(Class cls, Protocol *target, void (^callback)(Protocol *))
+{
+    ASSERT(cls);
+    ASSERT(target);
+
+    Vector<Protocol *> worklist;
+    HashSet<void*> visited;
+
+    // Initially fill the worklist with the Class's protocols.
+    unsigned protocolsCount;
+    Protocol ** protocols = class_copyProtocolList(cls, &protocolsCount);
+    worklist.append(protocols, protocolsCount);
+    free(protocols);
+
+    while (!worklist.isEmpty()) {
+        Protocol *protocol = worklist.last();
+        worklist.removeLast();
+
+        // Are we encountering this Protocol for the first time?
+        if (!visited.add(protocol).isNewEntry)
+            continue;
+
+        // If it implements the protocol, make the callback.
+        if (protocolImplementsProtocol(protocol, target))
+            callback(protocol);
+
+        // Add incorporated protocols to the worklist.
+        protocols = protocol_copyProtocolList(protocol, &protocolsCount);
+        worklist.append(protocols, protocolsCount);
+        free(protocols);
+    }
+}
+
+inline void forEachMethodInClass(Class cls, void (^callback)(Method))
+{
+    unsigned count;
+    Method* methods = class_copyMethodList(cls, &count);
+    for (unsigned i = 0; i < count; ++i)
+        callback(methods[i]);
+    free(methods);
+}
+
+inline void forEachMethodInProtocol(Protocol *protocol, BOOL isRequiredMethod, BOOL isInstanceMethod, void (^callback)(SEL, const char*))
+{
+    unsigned count;
+    struct objc_method_description* methods = protocol_copyMethodDescriptionList(protocol, isRequiredMethod, isInstanceMethod, &count);
+    for (unsigned i = 0; i < count; ++i)
+        callback(methods[i].name, methods[i].types);
+    free(methods);
+}
+
+inline void forEachPropertyInProtocol(Protocol *protocol, void (^callback)(objc_property_t))
+{
+    unsigned count;
+    objc_property_t* properties = protocol_copyPropertyList(protocol, &count);
+    for (unsigned i = 0; i < count; ++i)
+        callback(properties[i]);
+    free(properties);
+}
+
+template<char open, char close>
+void skipPair(const char*& position)
+{
+    size_t count = 1;
+    do {
+        char c = *position++;
+        if (!c)
+            @throw [NSException exceptionWithName:NSInternalInconsistencyException reason:@"Malformed type encoding" userInfo:nil];
+        if (c == open)
+            ++count;
+        else if (c == close)
+            --count;
+    } while (count);
+}
+
+class StringRange {
+    WTF_MAKE_NONCOPYABLE(StringRange);
+public:
+    StringRange(const char* begin, const char* end) : m_ptr(strndup(begin, end - begin)) { }
+    ~StringRange() { free(m_ptr); }
+    operator const char*() const { return m_ptr; }
+    const char* get() const { return m_ptr; }
+
+private:
+    char* m_ptr;
+};
+
+class StructBuffer {
+    WTF_MAKE_NONCOPYABLE(StructBuffer);
+public:
+    StructBuffer(const char* encodedType)
+    {
+        NSUInteger size, alignment;
+        NSGetSizeAndAlignment(encodedType, &size, &alignment);
+        --alignment;
+        m_allocation = static_cast<char*>(malloc(size + alignment));
+        m_buffer = reinterpret_cast<char*>((reinterpret_cast<intptr_t>(m_allocation) + alignment) & ~alignment);
+    }
+
+    ~StructBuffer() { free(m_allocation); }
+    operator void*() const { return m_buffer; }
+
+private:
+    void* m_allocation;
+    void* m_buffer;
+};
+
+template<typename DelegateType>
+typename DelegateType::ResultType parseObjCType(const char*& position)
+{
+    ASSERT(*position);
+
+    switch (*position++) {
+    case 'c':
+        return DelegateType::template typeInteger<char>();
+    case 'i':
+        return DelegateType::template typeInteger<int>();
+    case 's':
+        return DelegateType::template typeInteger<short>();
+    case 'l':
+        return DelegateType::template typeInteger<long>();
+    case 'q':
+        return DelegateType::template typeDouble<long long>();
+    case 'C':
+        return DelegateType::template typeInteger<unsigned char>();
+    case 'I':
+        return DelegateType::template typeInteger<unsigned>();
+    case 'S':
+        return DelegateType::template typeInteger<unsigned short>();
+    case 'L':
+        return DelegateType::template typeInteger<unsigned long>();
+    case 'Q':
+        return DelegateType::template typeDouble<unsigned long long>();
+    case 'f':
+        return DelegateType::template typeDouble<float>();
+    case 'd':
+        return DelegateType::template typeDouble<double>();
+    case 'B':
+        return DelegateType::typeBool();
+    case 'v':
+        return DelegateType::typeVoid();
+    
+    case '@': { // An object (whether statically typed or typed id)
+        if (position[0] == '?' && position[1] == '<') {
+            position += 2;
+            const char* begin = position;
+            skipPair<'<','>'>(position);
+            return DelegateType::typeBlock(begin, position - 1);
+        }
+
+        if (*position == '"') {
+            const char* begin = position + 1;
+            const char* protocolPosition = strchr(begin, '<');
+            const char* endOfType = strchr(begin, '"');
+            position = endOfType + 1;
+
+            // There's no protocol involved in this type, so just handle the class name.
+            if (!protocolPosition || protocolPosition > endOfType)
+                return DelegateType::typeOfClass(begin, endOfType);
+            // We skipped the class name and went straight to the protocol, so this is an id type.
+            if (begin == protocolPosition)
+                return DelegateType::typeId();
+            // We have a class name with a protocol. For now, ignore the protocol.
+            return DelegateType::typeOfClass(begin, protocolPosition);
+        }
+
+        return DelegateType::typeId();
+    }
+
+    case '{': { // {name=type...} A structure
+        const char* begin = position - 1;
+        skipPair<'{','}'>(position);
+        return DelegateType::typeStruct(begin, position);
+    }
+
+    // NOT supporting C strings, arrays, pointers, unions, bitfields, function pointers.
+    case '*': // A character string (char *)
+    case '[': // [array type] An array
+    case '(': // (name=type...) A union
+    case 'b': // bnum A bit field of num bits
+    case '^': // ^type A pointer to type
+    case '?': // An unknown type (among other things, this code is used for function pointers)
+    // NOT supporting Objective-C Class, SEL
+    case '#': // A class object (Class)
+    case ':': // A method selector (SEL)
+    default:
+        return nil;
+    }
+}
+
+extern "C" {
+    // Forward declare some Objective-C runtime internal methods that are not API.
+    const char *_protocol_getMethodTypeEncoding(Protocol *, SEL, BOOL isRequiredMethod, BOOL isInstanceMethod);
+    id objc_initWeak(id *, id);
+    void objc_destroyWeak(id *);
+    bool _Block_has_signature(void *);
+    const char * _Block_signature(void *);
+}
diff --git a/API/OpaqueJSString.cpp b/API/OpaqueJSString.cpp
new file mode 100644
index 0000000..07a79ad
--- /dev/null
+++ b/API/OpaqueJSString.cpp
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "OpaqueJSString.h"
+
+#include "CallFrame.h"
+#include "Identifier.h"
+#include "IdentifierInlines.h"
+#include "JSGlobalObject.h"
+#include <wtf/text/StringView.h>
+
+using namespace JSC;
+
+RefPtr<OpaqueJSString> OpaqueJSString::create(const String& string)
+{
+    if (string.isNull())
+        return nullptr;
+
+    return adoptRef(new OpaqueJSString(string));
+}
+
+OpaqueJSString::~OpaqueJSString()
+{
+    // m_characters is put in a local here to avoid an extra atomic load.
+    UChar* characters = m_characters;
+    if (!characters)
+        return;
+
+    if (!m_string.is8Bit() && m_string.characters16() == characters)
+        return;
+
+    fastFree(characters);
+}
+
+String OpaqueJSString::string() const
+{
+    // Return a copy of the wrapped string, because the caller may make it an Identifier.
+    return m_string.isolatedCopy();
+}
+
+Identifier OpaqueJSString::identifier(VM* vm) const
+{
+    if (m_string.isNull())
+        return Identifier();
+
+    if (m_string.isEmpty())
+        return Identifier(Identifier::EmptyIdentifier);
+
+    if (m_string.is8Bit())
+        return Identifier::fromString(vm, m_string.characters8(), m_string.length());
+
+    return Identifier::fromString(vm, m_string.characters16(), m_string.length());
+}
+
+const UChar* OpaqueJSString::characters()
+{
+    // m_characters is put in a local here to avoid an extra atomic load.
+    UChar* characters = m_characters;
+    if (characters)
+        return characters;
+
+    if (m_string.isNull())
+        return nullptr;
+
+    unsigned length = m_string.length();
+    UChar* newCharacters = static_cast<UChar*>(fastMalloc(length * sizeof(UChar)));
+    StringView(m_string).getCharactersWithUpconvert(newCharacters);
+
+    if (!m_characters.compare_exchange_strong(characters, newCharacters)) {
+        fastFree(newCharacters);
+        return characters;
+    }
+
+    return newCharacters;
+}
+
+bool OpaqueJSString::equal(const OpaqueJSString* a, const OpaqueJSString* b)
+{
+    if (a == b)
+        return true;
+
+    if (!a || !b)
+        return false;
+
+    return a->m_string == b->m_string;
+}
diff --git a/API/OpaqueJSString.h b/API/OpaqueJSString.h
new file mode 100644
index 0000000..208131b
--- /dev/null
+++ b/API/OpaqueJSString.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef OpaqueJSString_h
+#define OpaqueJSString_h
+
+#include <atomic>
+#include <wtf/ThreadSafeRefCounted.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+    class Identifier;
+    class VM;
+}
+
+struct OpaqueJSString : public ThreadSafeRefCounted<OpaqueJSString> {
+    static Ref<OpaqueJSString> create()
+    {
+        return adoptRef(*new OpaqueJSString);
+    }
+
+    static Ref<OpaqueJSString> create(const LChar* characters, unsigned length)
+    {
+        return adoptRef(*new OpaqueJSString(characters, length));
+    }
+
+    static Ref<OpaqueJSString> create(const UChar* characters, unsigned length)
+    {
+        return adoptRef(*new OpaqueJSString(characters, length));
+    }
+
+    JS_EXPORT_PRIVATE static RefPtr<OpaqueJSString> create(const String&);
+
+    JS_EXPORT_PRIVATE ~OpaqueJSString();
+
+    bool is8Bit() { return m_string.is8Bit(); }
+    const LChar* characters8() { return m_string.characters8(); }
+    const UChar* characters16() { return m_string.characters16(); }
+    unsigned length() { return m_string.length(); }
+
+    const UChar* characters();
+
+    JS_EXPORT_PRIVATE String string() const;
+    JSC::Identifier identifier(JSC::VM*) const;
+
+    static bool equal(const OpaqueJSString*, const OpaqueJSString*);
+
+private:
+    friend class WTF::ThreadSafeRefCounted<OpaqueJSString>;
+
+    OpaqueJSString()
+        : m_characters(nullptr)
+    {
+    }
+
+    OpaqueJSString(const String& string)
+        : m_string(string.isolatedCopy())
+        , m_characters(m_string.impl() && m_string.is8Bit() ? nullptr : const_cast<UChar*>(m_string.characters16()))
+    {
+    }
+
+    OpaqueJSString(const LChar* characters, unsigned length)
+        : m_string(characters, length)
+        , m_characters(nullptr)
+    {
+    }
+
+    OpaqueJSString(const UChar* characters, unsigned length)
+        : m_string(characters, length)
+        , m_characters(m_string.impl() && m_string.is8Bit() ? nullptr : const_cast<UChar*>(m_string.characters16()))
+    {
+    }
+
+    String m_string;
+
+    // This will be initialized on demand when characters() is called if the string needs up-conversion.
+    std::atomic<UChar*> m_characters;
+};
+
+#endif
diff --git a/API/WebKitAvailability.h b/API/WebKitAvailability.h
new file mode 100644
index 0000000..ab53183
--- /dev/null
+++ b/API/WebKitAvailability.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2008, 2009, 2010, 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __WebKitAvailability__
+#define __WebKitAvailability__
+
+#if defined(__APPLE__)
+
+#include <AvailabilityMacros.h>
+#include <CoreFoundation/CoreFoundation.h>
+
+#if !TARGET_OS_IPHONE && __MAC_OS_X_VERSION_MIN_REQUIRED < 101100
+/* To support availability macros that mention newer OS X versions when building on older OS X versions,
+   we provide our own definitions of the underlying macros that the availability macros expand to. We're
+   free to expand the macros as no-ops since frameworks built on older OS X versions only ship bundled with
+   an application rather than as part of the system.
+*/
+
+#ifndef __NSi_10_10 // Building from trunk rather than SDK.
+#define __NSi_10_10 introduced=10.0 // Use 10.0 to indicate that everything is available.
+#endif
+
+#ifndef __NSi_10_11 // Building from trunk rather than SDK.
+#define __NSi_10_11 introduced=10.0 // Use 10.0 to indicate that everything is available.
+#endif
+
+#ifndef __NSi_10_12 // Building from trunk rather than SDK.
+#define __NSi_10_12 introduced=10.0 // Use 10.0 to indicate that everything is available.
+#endif
+
+#ifndef __AVAILABILITY_INTERNAL__MAC_10_9
+#define __AVAILABILITY_INTERNAL__MAC_10_9
+#endif
+
+#ifndef __AVAILABILITY_INTERNAL__MAC_10_10
+#define __AVAILABILITY_INTERNAL__MAC_10_10
+#endif
+
+#ifndef AVAILABLE_MAC_OS_X_VERSION_10_9_AND_LATER
+#define AVAILABLE_MAC_OS_X_VERSION_10_9_AND_LATER
+#endif
+
+#ifndef AVAILABLE_MAC_OS_X_VERSION_10_10_AND_LATER
+#define AVAILABLE_MAC_OS_X_VERSION_10_10_AND_LATER
+#endif
+
+#endif /* __MAC_OS_X_VERSION_MIN_REQUIRED <= 101100 */
+
+#if defined(BUILDING_GTK__)
+#undef CF_AVAILABLE
+#define CF_AVAILABLE(_mac, _ios)
+#undef CF_ENUM_AVAILABLE
+#define CF_ENUM_AVAILABLE(_mac, _ios)
+#endif
+
+#else
+#define CF_AVAILABLE(_mac, _ios)
+#define CF_ENUM_AVAILABLE(_mac, _ios)
+#endif
+
+#endif /* __WebKitAvailability__ */
diff --git a/API/tests/CompareAndSwapTest.cpp b/API/tests/CompareAndSwapTest.cpp
new file mode 100644
index 0000000..e78086c
--- /dev/null
+++ b/API/tests/CompareAndSwapTest.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CompareAndSwapTest.h"
+
+#include <stdio.h>
+#include <wtf/Atomics.h>
+#include <wtf/Threading.h>
+
+class Bitmap {
+public:
+    Bitmap() { clearAll(); }
+
+    inline void clearAll();
+    inline bool concurrentTestAndSet(size_t n);
+    inline size_t numBits() const { return words * wordSize; }
+
+private:
+    static const size_t Size = 4096*10;
+
+    static const unsigned wordSize = sizeof(uint8_t) * 8;
+    static const unsigned words = (Size + wordSize - 1) / wordSize;
+    static const uint8_t one = 1;
+
+    uint8_t bits[words];
+};
+
+inline void Bitmap::clearAll()
+{
+    memset(&bits, 0, sizeof(bits));
+}
+
+inline bool Bitmap::concurrentTestAndSet(size_t n)
+{
+    uint8_t mask = one << (n % wordSize);
+    size_t index = n / wordSize;
+    uint8_t* wordPtr = &bits[index];
+    uint8_t oldValue;
+    do {
+        oldValue = *wordPtr;
+        if (oldValue & mask)
+            return true;
+    } while (!WTF::atomicCompareExchangeWeakRelaxed(wordPtr, oldValue, static_cast<uint8_t>(oldValue | mask)));
+    return false;
+}
+
+struct Data {
+    Bitmap* bitmap;
+    int id;
+    int numThreads;
+};
+
+static void setBitThreadFunc(void* p)
+{
+    Data* data = reinterpret_cast<Data*>(p);
+    Bitmap* bitmap = data->bitmap;
+    size_t numBits = bitmap->numBits();
+
+    // The computed start index here is heuristic that seems to maximize (anecdotally)
+    // the chance for the CAS issue to manifest.
+    size_t start = (numBits * (data->numThreads - data->id)) / data->numThreads;
+
+    printf("   started Thread %d\n", data->id);
+    for (size_t i = start; i < numBits; i++)
+        while (!bitmap->concurrentTestAndSet(i)) { }
+    for (size_t i = 0; i < start; i++)
+        while (!bitmap->concurrentTestAndSet(i)) { }
+
+    printf("   finished Thread %d\n", data->id);
+}
+
+void testCompareAndSwap()
+{
+    Bitmap bitmap;
+    const int numThreads = 5;
+    ThreadIdentifier threadIDs[numThreads];
+    Data data[numThreads];
+
+    WTF::initializeThreading();
+    
+    printf("Starting %d threads for CompareAndSwap test.  Test should complete without hanging.\n", numThreads);
+    for (int i = 0; i < numThreads; i++) {
+        data[i].bitmap = &bitmap;
+        data[i].id = i;
+        data[i].numThreads = numThreads;
+        std::function<void()> threadFunc = std::bind(setBitThreadFunc, &data[i]);
+        threadIDs[i] = createThread("setBitThreadFunc", threadFunc);
+    }
+
+    printf("Waiting for %d threads to join\n", numThreads);
+    for (int i = 0; i < numThreads; i++)
+        waitForThreadCompletion(threadIDs[i]);
+
+    printf("PASS: CompareAndSwap test completed without a hang\n");
+}
diff --git a/API/tests/CompareAndSwapTest.h b/API/tests/CompareAndSwapTest.h
new file mode 100644
index 0000000..4a1fc59
--- /dev/null
+++ b/API/tests/CompareAndSwapTest.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Regression test for webkit.org/b/142513 */
+void testCompareAndSwap();
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
diff --git a/API/tests/CurrentThisInsideBlockGetterTest.h b/API/tests/CurrentThisInsideBlockGetterTest.h
new file mode 100644
index 0000000..ab68f80
--- /dev/null
+++ b/API/tests/CurrentThisInsideBlockGetterTest.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <JavaScriptCore/JavaScriptCore.h>
+
+#if JSC_OBJC_API_ENABLED
+
+void currentThisInsideBlockGetterTest();
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/tests/CurrentThisInsideBlockGetterTest.mm b/API/tests/CurrentThisInsideBlockGetterTest.mm
new file mode 100644
index 0000000..5ec5420
--- /dev/null
+++ b/API/tests/CurrentThisInsideBlockGetterTest.mm
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "CurrentThisInsideBlockGetterTest.h"
+
+#if JSC_OBJC_API_ENABLED
+
+#import <Foundation/Foundation.h>
+#import <JavaScriptCore/JavaScriptCore.h>
+
+static JSObjectRef CallAsConstructor(JSContextRef ctx, JSObjectRef constructor, size_t, const JSValueRef[], JSValueRef*)
+{
+    JSObjectRef newObjectRef = NULL;
+    NSMutableDictionary *constructorPrivateProperties = (__bridge NSMutableDictionary *)(JSObjectGetPrivate(constructor));
+    NSDictionary *constructorDescriptor = constructorPrivateProperties[@"constructorDescriptor"];
+    newObjectRef = JSObjectMake(ctx, NULL, NULL);
+    NSDictionary *objectProperties = constructorDescriptor[@"objectProperties"];
+    
+    if (objectProperties) {
+        JSValue *newObject = [JSValue valueWithJSValueRef:newObjectRef inContext:[JSContext contextWithJSGlobalContextRef:JSContextGetGlobalContext(ctx)]];
+        for (NSString *objectProperty in objectProperties) {
+            [newObject defineProperty:objectProperty descriptor:objectProperties[objectProperty]];
+        }
+    }
+    
+    return newObjectRef;
+}
+
+static void ConstructorFinalize(JSObjectRef object)
+{
+    NSMutableDictionary *privateProperties = (__bridge NSMutableDictionary *)(JSObjectGetPrivate(object));
+    CFBridgingRelease((__bridge CFTypeRef)(privateProperties));
+    JSObjectSetPrivate(object, NULL);
+}
+
+static JSClassRef ConstructorClass(void)
+{
+    static JSClassRef constructorClass = NULL;
+    
+    if (constructorClass == NULL) {
+        JSClassDefinition classDefinition = kJSClassDefinitionEmpty;
+        classDefinition.className = "Constructor";
+        classDefinition.callAsConstructor = CallAsConstructor;
+        classDefinition.finalize = ConstructorFinalize;
+        constructorClass = JSClassCreate(&classDefinition);
+    }
+    
+    return constructorClass;
+}
+
+@interface JSValue (ConstructorCreation)
+
++ (JSValue *)valueWithConstructorDescriptor:(NSDictionary *)constructorDescriptor inContext:(JSContext *)context;
+
+@end
+
+@implementation JSValue (ConstructorCreation)
+
++ (JSValue *)valueWithConstructorDescriptor:(id)constructorDescriptor inContext:(JSContext *)context
+{
+    NSMutableDictionary *privateProperties = [@{ @"constructorDescriptor" : constructorDescriptor } mutableCopy];
+    JSGlobalContextRef ctx = [context JSGlobalContextRef];
+    JSObjectRef constructorRef = JSObjectMake(ctx, ConstructorClass(), (void *)CFBridgingRetain(privateProperties));
+    JSValue *constructor = [JSValue valueWithJSValueRef:constructorRef inContext:context];
+    return constructor;
+}
+
+@end
+
+@interface JSContext (ConstructorCreation)
+
+- (JSValue *)valueWithConstructorDescriptor:(NSDictionary *)constructorDescriptor;
+
+@end
+
+@implementation JSContext (ConstructorCreation)
+
+- (JSValue *)valueWithConstructorDescriptor:(id)constructorDescriptor
+{
+    return [JSValue valueWithConstructorDescriptor:constructorDescriptor inContext:self];
+}
+
+@end
+
+void currentThisInsideBlockGetterTest()
+{
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        
+        JSValue *myConstructor = [context valueWithConstructorDescriptor:@{
+            @"objectProperties" : @{
+                @"currentThis" : @{ JSPropertyDescriptorGetKey : ^{ return JSContext.currentThis; } },
+            },
+        }];
+        
+        JSValue *myObj1 = [myConstructor constructWithArguments:nil];
+        NSLog(@"myObj1.currentThis: %@", myObj1[@"currentThis"]);
+        JSValue *myObj2 = [myConstructor constructWithArguments:@[ @"bar" ]];
+        NSLog(@"myObj2.currentThis: %@", myObj2[@"currentThis"]);
+    }
+}
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/tests/CustomGlobalObjectClassTest.c b/API/tests/CustomGlobalObjectClassTest.c
new file mode 100644
index 0000000..62e6397
--- /dev/null
+++ b/API/tests/CustomGlobalObjectClassTest.c
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "CustomGlobalObjectClassTest.h"
+
+#include <JavaScriptCore/JSObjectRefPrivate.h>
+#include <JavaScriptCore/JavaScriptCore.h>
+#include <stdio.h>
+
+extern bool assertTrue(bool value, const char* message);
+
+static bool executedCallback = false;
+
+static JSValueRef jsDoSomething(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argc, const JSValueRef args[], JSValueRef* exception)
+{
+    (void)function;
+    (void)thisObject;
+    (void)argc;
+    (void)args;
+    (void)exception;
+    executedCallback = true;
+    return JSValueMakeNull(ctx);
+}
+
+static JSStaticFunction bridgedFunctions[] = {
+    {"doSomething", jsDoSomething, kJSPropertyAttributeDontDelete},
+    {0, 0, 0},
+};
+
+static JSClassRef bridgedObjectClass = NULL;
+static JSClassDefinition bridgedClassDef;
+
+static JSClassRef jsClassRef()
+{
+    if (!bridgedObjectClass) {
+        bridgedClassDef = kJSClassDefinitionEmpty;
+        bridgedClassDef.className = "BridgedObject";
+        bridgedClassDef.staticFunctions = bridgedFunctions;
+        bridgedObjectClass = JSClassCreate(&bridgedClassDef);
+    }
+    return bridgedObjectClass;
+}
+
+void customGlobalObjectClassTest()
+{
+    JSClassRef bridgedObjectJsClassRef = jsClassRef();
+    JSGlobalContextRef globalContext = JSGlobalContextCreate(bridgedObjectJsClassRef);
+    
+    JSObjectRef globalObj = JSContextGetGlobalObject(globalContext);
+    
+    JSPropertyNameArrayRef propertyNames = JSObjectCopyPropertyNames(globalContext, globalObj);
+    size_t propertyCount = JSPropertyNameArrayGetCount(propertyNames);
+    assertTrue(propertyCount == 1, "Property count == 1");
+    
+    JSStringRef propertyNameRef = JSPropertyNameArrayGetNameAtIndex(propertyNames, 0);
+    size_t propertyNameLength = JSStringGetLength(propertyNameRef);
+    size_t bufferSize = sizeof(char) * (propertyNameLength + 1);
+    char* buffer = (char*)malloc(bufferSize);
+    JSStringGetUTF8CString(propertyNameRef, buffer, bufferSize);
+    buffer[propertyNameLength] = '\0';
+    assertTrue(!strncmp(buffer, "doSomething", propertyNameLength), "First property name is doSomething");
+    free(buffer);
+    
+    bool hasMethod = JSObjectHasProperty(globalContext, globalObj, propertyNameRef);
+    assertTrue(hasMethod, "Property found by name");
+    
+    JSValueRef doSomethingProperty =
+    JSObjectGetProperty(globalContext, globalObj, propertyNameRef, NULL);
+    assertTrue(!JSValueIsUndefined(globalContext, doSomethingProperty), "Property is defined");
+    
+    bool globalObjectClassMatchesClassRef = JSValueIsObjectOfClass(globalContext, globalObj, bridgedObjectJsClassRef);
+    assertTrue(globalObjectClassMatchesClassRef, "Global object is the right class");
+    
+    JSStringRef script = JSStringCreateWithUTF8CString("doSomething();");
+    JSEvaluateScript(globalContext, script, NULL, NULL, 1, NULL);
+    JSStringRelease(script);
+
+    assertTrue(executedCallback, "Executed custom global object callback");
+}
+
+void globalObjectSetPrototypeTest()
+{
+    JSClassDefinition definition = kJSClassDefinitionEmpty;
+    definition.className = "Global";
+    JSClassRef global = JSClassCreate(&definition);
+    JSGlobalContextRef context = JSGlobalContextCreate(global);
+    JSObjectRef object = JSContextGetGlobalObject(context);
+
+    JSObjectRef above = JSObjectMake(context, 0, 0);
+    JSStringRef test = JSStringCreateWithUTF8CString("test");
+    JSValueRef value = JSValueMakeString(context, test);
+    JSObjectSetProperty(context, above, test, value, kJSPropertyAttributeDontEnum, 0);
+
+    JSObjectSetPrototype(context, object, above);
+    JSStringRef script = JSStringCreateWithUTF8CString("test === \"test\"");
+    JSValueRef result = JSEvaluateScript(context, script, 0, 0, 0, 0);
+
+    assertTrue(JSValueToBoolean(context, result), "test === \"test\"");
+
+    JSStringRelease(test);
+    JSStringRelease(script);
+}
+
+void globalObjectPrivatePropertyTest()
+{
+    JSClassDefinition definition = kJSClassDefinitionEmpty;
+    definition.className = "Global";
+    JSClassRef global = JSClassCreate(&definition);
+    JSGlobalContextRef context = JSGlobalContextCreate(global);
+    JSObjectRef globalObject = JSContextGetGlobalObject(context);
+
+    JSStringRef privateName = JSStringCreateWithUTF8CString("private");
+    JSValueRef privateValue = JSValueMakeString(context, privateName);
+    assertTrue(JSObjectSetPrivateProperty(context, globalObject, privateName, privateValue), "JSObjectSetPrivateProperty succeeded");
+    JSValueRef result = JSObjectGetPrivateProperty(context, globalObject, privateName);
+    assertTrue(JSValueIsStrictEqual(context, privateValue, result), "privateValue === \"private\"");
+
+    assertTrue(JSObjectDeletePrivateProperty(context, globalObject, privateName), "JSObjectDeletePrivateProperty succeeded");
+    result = JSObjectGetPrivateProperty(context, globalObject, privateName);
+    assertTrue(JSValueIsNull(context, result), "Deleted private property is indeed no longer present");
+
+    JSStringRelease(privateName);
+}
diff --git a/API/tests/CustomGlobalObjectClassTest.h b/API/tests/CustomGlobalObjectClassTest.h
new file mode 100644
index 0000000..3d2a520
--- /dev/null
+++ b/API/tests/CustomGlobalObjectClassTest.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+void customGlobalObjectClassTest(void);
+void globalObjectSetPrototypeTest(void);
+void globalObjectPrivatePropertyTest(void);
diff --git a/API/tests/DateTests.h b/API/tests/DateTests.h
new file mode 100644
index 0000000..eeb47a1
--- /dev/null
+++ b/API/tests/DateTests.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <JavaScriptCore/JavaScriptCore.h>
+
+#if JSC_OBJC_API_ENABLED
+
+void runDateTests();
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/tests/DateTests.mm b/API/tests/DateTests.mm
new file mode 100644
index 0000000..e2837a6
--- /dev/null
+++ b/API/tests/DateTests.mm
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "DateTests.h"
+#import <Foundation/Foundation.h>
+
+#if JSC_OBJC_API_ENABLED
+
+extern "C" void checkResult(NSString *description, bool passed);
+
+@interface DateTests : NSObject
++ (void) NSDateToJSDateTest;
++ (void) JSDateToNSDateTest;
++ (void) roundTripThroughJSDateTest;
++ (void) roundTripThroughObjCDateTest;
+@end
+
+static unsigned unitFlags = NSCalendarUnitSecond | NSCalendarUnitMinute | NSCalendarUnitHour | NSCalendarUnitDay | NSCalendarUnitMonth | NSCalendarUnitYear;
+
+@implementation DateTests
++ (void) NSDateToJSDateTest
+{
+    JSContext *context = [[JSContext alloc] init];
+    NSDate *now = [NSDate dateWithTimeIntervalSinceNow:0];
+    NSDateComponents *components = [[NSCalendar currentCalendar] components:unitFlags fromDate:now];
+    JSValue *jsNow = [JSValue valueWithObject:now inContext:context];
+    int year = [[jsNow invokeMethod:@"getFullYear" withArguments:@[]] toInt32];
+    // Months are 0-indexed for JavaScript Dates.
+    int month = [[jsNow invokeMethod:@"getMonth" withArguments:@[]] toInt32] + 1;
+    int day = [[jsNow invokeMethod:@"getDate" withArguments:@[]] toInt32];
+    int hour = [[jsNow invokeMethod:@"getHours" withArguments:@[]] toInt32];
+    int minute = [[jsNow invokeMethod:@"getMinutes" withArguments:@[]] toInt32];
+    int second = [[jsNow invokeMethod:@"getSeconds" withArguments:@[]] toInt32];
+
+    checkResult(@"NSDate to JS Date", year == [components year]
+        && month == [components month]
+        && day == [components day]
+        && hour == [components hour]
+        && minute == [components minute]
+        && second == [components second]);
+}
+
++ (void) JSDateToNSDateTest
+{
+    JSContext *context = [[JSContext alloc] init];
+    NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
+    [formatter setDateFormat:@"MMMM dd',' yyyy hh:mm:ss"];
+    NSDate *februaryFourth2014 = [formatter dateFromString:@"February 4, 2014 11:40:03"];
+    NSDateComponents *components = [[NSCalendar currentCalendar] components:unitFlags fromDate:februaryFourth2014];
+    // Months are 0-indexed for JavaScript Dates.
+    JSValue *jsDate = [context[@"Date"] constructWithArguments:@[@2014, @1, @4, @11, @40, @3]];
+    
+    int year = [[jsDate invokeMethod:@"getFullYear" withArguments:@[]] toInt32];
+    int month = [[jsDate invokeMethod:@"getMonth" withArguments:@[]] toInt32] + 1;
+    int day = [[jsDate invokeMethod:@"getDate" withArguments:@[]] toInt32];
+    int hour = [[jsDate invokeMethod:@"getHours" withArguments:@[]] toInt32];
+    int minute = [[jsDate invokeMethod:@"getMinutes" withArguments:@[]] toInt32];
+    int second = [[jsDate invokeMethod:@"getSeconds" withArguments:@[]] toInt32];
+
+    checkResult(@"JS Date to NSDate", year == [components year]
+        && month == [components month]
+        && day == [components day]
+        && hour == [components hour]
+        && minute == [components minute]
+        && second == [components second]);
+}
+
++ (void) roundTripThroughJSDateTest
+{
+    JSContext *context = [[JSContext alloc] init];
+    [context evaluateScript:@"function jsReturnDate(date) { return date; }"];
+    NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
+    [formatter setDateFormat:@"MMMM dd',' yyyy hh:mm:ss"];
+    NSDate *februaryFourth2014 = [formatter dateFromString:@"February 4, 2014 11:40:03"];
+    NSDateComponents *components = [[NSCalendar currentCalendar] components:unitFlags fromDate:februaryFourth2014];
+    
+    JSValue *roundTripThroughJS = [context[@"jsReturnDate"] callWithArguments:@[februaryFourth2014]];
+    int year = [[roundTripThroughJS invokeMethod:@"getFullYear" withArguments:@[]] toInt32];
+    // Months are 0-indexed for JavaScript Dates.
+    int month = [[roundTripThroughJS invokeMethod:@"getMonth" withArguments:@[]] toInt32] + 1;
+    int day = [[roundTripThroughJS invokeMethod:@"getDate" withArguments:@[]] toInt32];
+    int hour = [[roundTripThroughJS invokeMethod:@"getHours" withArguments:@[]] toInt32];
+    int minute = [[roundTripThroughJS invokeMethod:@"getMinutes" withArguments:@[]] toInt32];
+    int second = [[roundTripThroughJS invokeMethod:@"getSeconds" withArguments:@[]] toInt32];
+
+    checkResult(@"JS date round trip", year == [components year]
+        && month == [components month]
+        && day == [components day]
+        && hour == [components hour]
+        && minute == [components minute]
+        && second == [components second]);
+}
+
++ (void) roundTripThroughObjCDateTest
+{
+    JSContext *context = [[JSContext alloc] init];
+    context[@"objcReturnDate"] = ^(NSDate *date) {
+        return date;
+    };
+    [context evaluateScript:@"function test() {\
+        var date = new Date(2014, 1, 4, 11, 40, 3); \
+        var result = objcReturnDate(date); \
+        return date.getYear() === result.getYear() \
+            && date.getMonth() === result.getMonth() \
+            && date.getDate() === result.getDate() \
+            && date.getHours() === result.getHours() \
+            && date.getMinutes() === result.getMinutes() \
+            && date.getSeconds() === result.getSeconds() \
+            && date.getMilliseconds() === result.getMilliseconds();\
+    }"];
+    
+    checkResult(@"ObjC date round trip", [[context[@"test"] callWithArguments:@[]] toBool]);
+}
+
+@end
+
+void runDateTests()
+{
+    @autoreleasepool {
+        [DateTests NSDateToJSDateTest];
+        [DateTests JSDateToNSDateTest];
+        [DateTests roundTripThroughJSDateTest];
+        [DateTests roundTripThroughObjCDateTest];
+    }
+}
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/tests/ExecutionTimeLimitTest.cpp b/API/tests/ExecutionTimeLimitTest.cpp
new file mode 100644
index 0000000..d5e5324
--- /dev/null
+++ b/API/tests/ExecutionTimeLimitTest.cpp
@@ -0,0 +1,374 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ExecutionTimeLimitTest.h"
+
+#include "InitializeThreading.h"
+#include "JSContextRefPrivate.h"
+#include "JavaScriptCore.h"
+#include "Options.h"
+#include <chrono>
+#include <wtf/CurrentTime.h>
+#include <wtf/text/StringBuilder.h>
+
+using namespace std::chrono;
+using JSC::Options;
+
+static JSGlobalContextRef context = nullptr;
+
+static JSValueRef currentCPUTimeAsJSFunctionCallback(JSContextRef ctx, JSObjectRef functionObject, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(functionObject);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+    
+    ASSERT(JSContextGetGlobalContext(ctx) == context);
+    return JSValueMakeNumber(ctx, currentCPUTime().count() / 1000000.);
+}
+
+bool shouldTerminateCallbackWasCalled = false;
+static bool shouldTerminateCallback(JSContextRef, void*)
+{
+    shouldTerminateCallbackWasCalled = true;
+    return true;
+}
+
+bool cancelTerminateCallbackWasCalled = false;
+static bool cancelTerminateCallback(JSContextRef, void*)
+{
+    cancelTerminateCallbackWasCalled = true;
+    return false;
+}
+
+int extendTerminateCallbackCalled = 0;
+static bool extendTerminateCallback(JSContextRef ctx, void*)
+{
+    extendTerminateCallbackCalled++;
+    if (extendTerminateCallbackCalled == 1) {
+        JSContextGroupRef contextGroup = JSContextGetGroup(ctx);
+        JSContextGroupSetExecutionTimeLimit(contextGroup, .200f, extendTerminateCallback, 0);
+        return false;
+    }
+    return true;
+}
+
+struct TierOptions {
+    const char* tier;
+    unsigned timeLimitAdjustmentMillis;
+    const char* optionsStr;
+};
+
+static void testResetAfterTimeout(bool& failed)
+{
+    JSValueRef v = nullptr;
+    JSValueRef exception = nullptr;
+    const char* reentryScript = "100";
+    JSStringRef script = JSStringCreateWithUTF8CString(reentryScript);
+    v = JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+    if (exception) {
+        printf("FAIL: Watchdog timeout was not reset.\n");
+        failed = true;
+    } else if (!JSValueIsNumber(context, v) || JSValueToNumber(context, v, nullptr) != 100) {
+        printf("FAIL: Script result is not as expected.\n");
+        failed = true;
+    }
+}
+
+int testExecutionTimeLimit()
+{
+    static const TierOptions tierOptionsList[] = {
+        { "LLINT",    0,   "--useConcurrentJIT=false --useLLInt=true --useJIT=false" },
+        { "Baseline", 0,   "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=false" },
+        { "DFG",      0,   "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=true --useFTLJIT=false" },
+        { "FTL",      200, "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=true --useFTLJIT=true" },
+    };
+    
+    bool failed = false;
+
+    JSC::initializeThreading();
+    Options::initialize(); // Ensure options is initialized first.
+
+    for (auto tierOptions : tierOptionsList) {
+        StringBuilder savedOptionsBuilder;
+        Options::dumpAllOptionsInALine(savedOptionsBuilder);
+
+        Options::setOptions(tierOptions.optionsStr);
+        
+        unsigned tierAdjustmentMillis = tierOptions.timeLimitAdjustmentMillis;
+        double timeLimit;
+
+        context = JSGlobalContextCreateInGroup(nullptr, nullptr);
+
+        JSContextGroupRef contextGroup = JSContextGetGroup(context);
+        JSObjectRef globalObject = JSContextGetGlobalObject(context);
+        ASSERT(JSValueIsObject(context, globalObject));
+
+        JSValueRef exception = nullptr;
+
+        JSStringRef currentCPUTimeStr = JSStringCreateWithUTF8CString("currentCPUTime");
+        JSObjectRef currentCPUTimeFunction = JSObjectMakeFunctionWithCallback(context, currentCPUTimeStr, currentCPUTimeAsJSFunctionCallback);
+        JSObjectSetProperty(context, globalObject, currentCPUTimeStr, currentCPUTimeFunction, kJSPropertyAttributeNone, nullptr);
+        JSStringRelease(currentCPUTimeStr);
+        
+        /* Test script timeout: */
+        timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
+        JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, shouldTerminateCallback, 0);
+        {
+            unsigned timeAfterWatchdogShouldHaveFired = 300 + tierAdjustmentMillis;
+
+            StringBuilder scriptBuilder;
+            scriptBuilder.appendLiteral("function foo() { var startTime = currentCPUTime(); while (true) { for (var i = 0; i < 1000; i++); if (currentCPUTime() - startTime > ");
+            scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired / 1000.0);
+            scriptBuilder.appendLiteral(") break; } } foo();");
+
+            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
+            exception = nullptr;
+            shouldTerminateCallbackWasCalled = false;
+            auto startTime = currentCPUTime();
+            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+            auto endTime = currentCPUTime();
+
+            if (((endTime - startTime) < milliseconds(timeAfterWatchdogShouldHaveFired)) && shouldTerminateCallbackWasCalled)
+                printf("PASS: %s script timed out as expected.\n", tierOptions.tier);
+            else {
+                if ((endTime - startTime) >= milliseconds(timeAfterWatchdogShouldHaveFired))
+                    printf("FAIL: %s script did not time out as expected.\n", tierOptions.tier);
+                if (!shouldTerminateCallbackWasCalled)
+                    printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
+                failed = true;
+            }
+            
+            if (!exception) {
+                printf("FAIL: %s TerminatedExecutionException was not thrown.\n", tierOptions.tier);
+                failed = true;
+            }
+
+            testResetAfterTimeout(failed);
+        }
+
+        /* Test script timeout with tail calls: */
+        timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
+        JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, shouldTerminateCallback, 0);
+        {
+            unsigned timeAfterWatchdogShouldHaveFired = 300 + tierAdjustmentMillis;
+
+            StringBuilder scriptBuilder;
+            scriptBuilder.appendLiteral("var startTime = currentCPUTime();"
+                                 "function recurse(i) {"
+                                     "'use strict';"
+                                     "if (i % 1000 === 0) {"
+                                        "if (currentCPUTime() - startTime >");
+            scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired / 1000.0);
+            scriptBuilder.appendLiteral("       ) { return; }");
+            scriptBuilder.appendLiteral("    }");
+            scriptBuilder.appendLiteral("    return recurse(i + 1); }");
+            scriptBuilder.appendLiteral("recurse(0);");
+
+            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
+            exception = nullptr;
+            shouldTerminateCallbackWasCalled = false;
+            auto startTime = currentCPUTime();
+            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+            auto endTime = currentCPUTime();
+
+            if (((endTime - startTime) < milliseconds(timeAfterWatchdogShouldHaveFired)) && shouldTerminateCallbackWasCalled)
+                printf("PASS: %s script with infinite tail calls timed out as expected .\n", tierOptions.tier);
+            else {
+                if ((endTime - startTime) >= milliseconds(timeAfterWatchdogShouldHaveFired))
+                    printf("FAIL: %s script with infinite tail calls did not time out as expected.\n", tierOptions.tier);
+                if (!shouldTerminateCallbackWasCalled)
+                    printf("FAIL: %s script with infinite tail calls' timeout callback was not called.\n", tierOptions.tier);
+                failed = true;
+            }
+            
+            if (!exception) {
+                printf("FAIL: %s TerminatedExecutionException was not thrown.\n", tierOptions.tier);
+                failed = true;
+            }
+
+            testResetAfterTimeout(failed);
+        }
+
+        /* Test the script timeout's TerminatedExecutionException should NOT be catchable: */
+        timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
+        JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, shouldTerminateCallback, 0);
+        {
+            unsigned timeAfterWatchdogShouldHaveFired = 300 + tierAdjustmentMillis;
+            
+            StringBuilder scriptBuilder;
+            scriptBuilder.appendLiteral("function foo() { var startTime = currentCPUTime(); try { while (true) { for (var i = 0; i < 1000; i++); if (currentCPUTime() - startTime > ");
+            scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired / 1000.0);
+            scriptBuilder.appendLiteral(") break; } } catch(e) { } } foo();");
+
+            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
+            exception = nullptr;
+            shouldTerminateCallbackWasCalled = false;
+
+            auto startTime = currentCPUTime();
+            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+            auto endTime = currentCPUTime();
+            
+            if (((endTime - startTime) >= milliseconds(timeAfterWatchdogShouldHaveFired)) || !shouldTerminateCallbackWasCalled) {
+                if (!((endTime - startTime) < milliseconds(timeAfterWatchdogShouldHaveFired)))
+                    printf("FAIL: %s script did not time out as expected.\n", tierOptions.tier);
+                if (!shouldTerminateCallbackWasCalled)
+                    printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
+                failed = true;
+            }
+            
+            if (exception)
+                printf("PASS: %s TerminatedExecutionException was not catchable as expected.\n", tierOptions.tier);
+            else {
+                printf("FAIL: %s TerminatedExecutionException was caught.\n", tierOptions.tier);
+                failed = true;
+            }
+
+            testResetAfterTimeout(failed);
+        }
+        
+        /* Test script timeout with no callback: */
+        timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
+        JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, 0, 0);
+        {
+            unsigned timeAfterWatchdogShouldHaveFired = 300 + tierAdjustmentMillis;
+            
+            StringBuilder scriptBuilder;
+            scriptBuilder.appendLiteral("function foo() { var startTime = currentCPUTime(); while (true) { for (var i = 0; i < 1000; i++); if (currentCPUTime() - startTime > ");
+            scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired / 1000.0);
+            scriptBuilder.appendLiteral(") break; } } foo();");
+            
+            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
+            exception = nullptr;
+            shouldTerminateCallbackWasCalled = false;
+
+            auto startTime = currentCPUTime();
+            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+            auto endTime = currentCPUTime();
+            
+            if (((endTime - startTime) < milliseconds(timeAfterWatchdogShouldHaveFired)) && !shouldTerminateCallbackWasCalled)
+                printf("PASS: %s script timed out as expected when no callback is specified.\n", tierOptions.tier);
+            else {
+                if ((endTime - startTime) >= milliseconds(timeAfterWatchdogShouldHaveFired))
+                    printf("FAIL: %s script did not time out as expected when no callback is specified.\n", tierOptions.tier);
+                else
+                    printf("FAIL: %s script called stale callback function.\n", tierOptions.tier);
+                failed = true;
+            }
+            
+            if (!exception) {
+                printf("FAIL: %s TerminatedExecutionException was not thrown.\n", tierOptions.tier);
+                failed = true;
+            }
+
+            testResetAfterTimeout(failed);
+        }
+        
+        /* Test script timeout cancellation: */
+        timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
+        JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, cancelTerminateCallback, 0);
+        {
+            unsigned timeAfterWatchdogShouldHaveFired = 300 + tierAdjustmentMillis;
+            
+            StringBuilder scriptBuilder;
+            scriptBuilder.appendLiteral("function foo() { var startTime = currentCPUTime(); while (true) { for (var i = 0; i < 1000; i++); if (currentCPUTime() - startTime > ");
+            scriptBuilder.appendNumber(timeAfterWatchdogShouldHaveFired / 1000.0);
+            scriptBuilder.appendLiteral(") break; } } foo();");
+
+            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
+            exception = nullptr;
+            cancelTerminateCallbackWasCalled = false;
+
+            auto startTime = currentCPUTime();
+            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+            auto endTime = currentCPUTime();
+            
+            if (((endTime - startTime) >= milliseconds(timeAfterWatchdogShouldHaveFired)) && cancelTerminateCallbackWasCalled && !exception)
+                printf("PASS: %s script timeout was cancelled as expected.\n", tierOptions.tier);
+            else {
+                if (((endTime - startTime) < milliseconds(timeAfterWatchdogShouldHaveFired)) || exception)
+                    printf("FAIL: %s script timeout was not cancelled.\n", tierOptions.tier);
+                if (!cancelTerminateCallbackWasCalled)
+                    printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
+                failed = true;
+            }
+            
+            if (exception) {
+                printf("FAIL: %s Unexpected TerminatedExecutionException thrown.\n", tierOptions.tier);
+                failed = true;
+            }
+        }
+        
+        /* Test script timeout extension: */
+        timeLimit = (100 + tierAdjustmentMillis) / 1000.0;
+        JSContextGroupSetExecutionTimeLimit(contextGroup, timeLimit, extendTerminateCallback, 0);
+        {
+            unsigned timeBeforeExtendedDeadline = 250 + tierAdjustmentMillis;
+            unsigned timeAfterExtendedDeadline = 600 + tierAdjustmentMillis;
+            unsigned maxBusyLoopTime = 750 + tierAdjustmentMillis;
+
+            StringBuilder scriptBuilder;
+            scriptBuilder.appendLiteral("function foo() { var startTime = currentCPUTime(); while (true) { for (var i = 0; i < 1000; i++); if (currentCPUTime() - startTime > ");
+            scriptBuilder.appendNumber(maxBusyLoopTime / 1000.0); // in seconds.
+            scriptBuilder.appendLiteral(") break; } } foo();");
+
+            JSStringRef script = JSStringCreateWithUTF8CString(scriptBuilder.toString().utf8().data());
+            exception = nullptr;
+            extendTerminateCallbackCalled = 0;
+
+            auto startTime = currentCPUTime();
+            JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+            auto endTime = currentCPUTime();
+            auto deltaTime = endTime - startTime;
+            
+            if ((deltaTime >= milliseconds(timeBeforeExtendedDeadline)) && (deltaTime < milliseconds(timeAfterExtendedDeadline)) && (extendTerminateCallbackCalled == 2) && exception)
+                printf("PASS: %s script timeout was extended as expected.\n", tierOptions.tier);
+            else {
+                if (deltaTime < milliseconds(timeBeforeExtendedDeadline))
+                    printf("FAIL: %s script timeout was not extended as expected.\n", tierOptions.tier);
+                else if (deltaTime >= milliseconds(timeAfterExtendedDeadline))
+                    printf("FAIL: %s script did not timeout.\n", tierOptions.tier);
+                
+                if (extendTerminateCallbackCalled < 1)
+                    printf("FAIL: %s script timeout callback was not called.\n", tierOptions.tier);
+                if (extendTerminateCallbackCalled < 2)
+                    printf("FAIL: %s script timeout callback was not called after timeout extension.\n", tierOptions.tier);
+                
+                if (!exception)
+                    printf("FAIL: %s TerminatedExecutionException was not thrown during timeout extension test.\n", tierOptions.tier);
+                
+                failed = true;
+            }
+        }
+
+        JSGlobalContextRelease(context);
+
+        Options::setOptions(savedOptionsBuilder.toString().ascii().data());
+    }
+    
+    return failed;
+}
diff --git a/API/tests/ExecutionTimeLimitTest.h b/API/tests/ExecutionTimeLimitTest.h
new file mode 100644
index 0000000..2c937d0
--- /dev/null
+++ b/API/tests/ExecutionTimeLimitTest.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Returns 1 if failures were encountered.  Else, returns 0. */
+int testExecutionTimeLimit();
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
diff --git a/API/tests/FunctionOverridesTest.cpp b/API/tests/FunctionOverridesTest.cpp
new file mode 100644
index 0000000..a325f83
--- /dev/null
+++ b/API/tests/FunctionOverridesTest.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FunctionOverridesTest.h"
+
+#include "FunctionOverrides.h"
+#include "InitializeThreading.h"
+#include "JSContextRefPrivate.h"
+#include "JavaScriptCore.h"
+#include "Options.h"
+#include <string>
+
+using JSC::Options;
+
+int testFunctionOverrides()
+{
+    bool failed = false;
+
+    JSC::initializeThreading();
+    Options::initialize(); // Ensure options is initialized first.
+
+    const char* oldFunctionOverrides = Options::functionOverrides();
+    
+    Options::functionOverrides() = "testapi-function-overrides.js";
+    JSC::FunctionOverrides::reinstallOverrides();
+
+    JSGlobalContextRef context = JSGlobalContextCreateInGroup(nullptr, nullptr);
+
+    JSObjectRef globalObject = JSContextGetGlobalObject(context);
+    ASSERT_UNUSED(globalObject, JSValueIsObject(context, globalObject));
+
+    const char* scriptString =
+        "var str = '';" "\n"
+        "function f1() { /* Original f1 */ }" "\n"
+        "str += f1 + '\\n';" "\n"
+        "var f2 = function() {" "\n"
+        "    // Original f2" "\n"
+        "}" "\n"
+        "str += f2 + '\\n';" "\n"
+        "str += (function() { /* Original f3 */ }) + '\\n';" "\n"
+        "var f4Source = '/* Original f4 */'" "\n"
+        "var f4 =  new Function(f4Source);" "\n"
+        "str += f4 + '\\n';" "\n"
+        "\n"
+        "var expectedStr =" "\n"
+        "'function f1() { /* Overridden f1 */ }\\n"
+        "function () { /* Overridden f2 */ }\\n"
+        "function () { /* Overridden f3 */ }\\n"
+        "function anonymous() { /* Overridden f4 */ }\\n';"
+        "var result = (str == expectedStr);" "\n"
+        "result";
+
+    JSStringRef script = JSStringCreateWithUTF8CString(scriptString);
+    JSValueRef exception = nullptr;
+    JSValueRef resultRef = JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+
+    if (!JSValueIsBoolean(context, resultRef) || !JSValueToBoolean(context, resultRef))
+        failed = true;
+
+    JSGlobalContextRelease(context);
+    
+    JSC::Options::functionOverrides() = oldFunctionOverrides;
+    JSC::FunctionOverrides::reinstallOverrides();
+
+    printf("%s: function override tests.\n", failed ? "FAIL" : "PASS");
+
+    return failed;
+}
diff --git a/API/tests/FunctionOverridesTest.h b/API/tests/FunctionOverridesTest.h
new file mode 100644
index 0000000..16237e5
--- /dev/null
+++ b/API/tests/FunctionOverridesTest.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Returns 1 if failures were encountered.  Else, returns 0. */
+int testFunctionOverrides();
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
diff --git a/API/tests/GlobalContextWithFinalizerTest.cpp b/API/tests/GlobalContextWithFinalizerTest.cpp
new file mode 100644
index 0000000..0486a26
--- /dev/null
+++ b/API/tests/GlobalContextWithFinalizerTest.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GlobalContextWithFinalizerTest.h"
+
+#include "JavaScriptCore.h"
+
+static bool failed = true;
+
+static void finalize(JSObjectRef)
+{
+    failed = false;
+}
+
+int testGlobalContextWithFinalizer()
+{
+    JSClassDefinition def = kJSClassDefinitionEmpty;
+    def.className = "testClass";
+    def.finalize = finalize;
+    JSClassRef classRef = JSClassCreate(&def);
+    
+    JSGlobalContextRef ref = JSGlobalContextCreateInGroup(nullptr, classRef);
+    JSGlobalContextRelease(ref);
+    JSClassRelease(classRef);
+
+    if (failed)
+        printf("FAIL: JSGlobalContextRef did not call its JSClassRef finalizer.\n");
+    else
+        printf("PASS: JSGlobalContextRef called its JSClassRef finalizer as expected.\n");
+
+    return failed;
+}
diff --git a/API/tests/GlobalContextWithFinalizerTest.h b/API/tests/GlobalContextWithFinalizerTest.h
new file mode 100644
index 0000000..1961350
--- /dev/null
+++ b/API/tests/GlobalContextWithFinalizerTest.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSContextRefPrivate.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Returns 1 if failures were encountered.  Else, returns 0. */
+int testGlobalContextWithFinalizer();
+    
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
diff --git a/API/tests/JSExportTests.h b/API/tests/JSExportTests.h
new file mode 100644
index 0000000..9d501ee
--- /dev/null
+++ b/API/tests/JSExportTests.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <Foundation/Foundation.h>
+#import <JavaScriptCore/JavaScriptCore.h>
+
+#if JSC_OBJC_API_ENABLED
+
+void runJSExportTests();
+
+#endif // JSC_OBJC_API_ENABLED
+
diff --git a/API/tests/JSExportTests.mm b/API/tests/JSExportTests.mm
new file mode 100644
index 0000000..9d22e3f
--- /dev/null
+++ b/API/tests/JSExportTests.mm
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "JSExportTests.h"
+
+#import <objc/runtime.h>
+#import <objc/objc.h>
+
+#if JSC_OBJC_API_ENABLED
+
+extern "C" void checkResult(NSString *description, bool passed);
+
+@interface JSExportTests : NSObject
++ (void) exportInstanceMethodWithIdProtocolTest;
++ (void) exportInstanceMethodWithClassProtocolTest;
++ (void) exportDynamicallyGeneratedProtocolTest;
+@end
+
+@protocol TruthTeller
+- (BOOL) returnTrue;
+@end
+
+@interface TruthTeller : NSObject<TruthTeller>
+@end
+
+@implementation TruthTeller
+- (BOOL) returnTrue
+{
+    return true;
+}
+@end
+
+@protocol ExportMethodWithIdProtocol <JSExport>
+- (void) methodWithIdProtocol:(id<TruthTeller>)object;
+@end
+
+@interface ExportMethodWithIdProtocol : NSObject<ExportMethodWithIdProtocol>
+@end
+
+@implementation ExportMethodWithIdProtocol
+- (void) methodWithIdProtocol:(id<TruthTeller>)object
+{
+    checkResult(@"Exporting a method with id<protocol> in the type signature", [object returnTrue]);
+}
+@end
+
+@protocol ExportMethodWithClassProtocol <JSExport>
+- (void) methodWithClassProtocol:(NSObject<TruthTeller> *)object;
+@end
+
+@interface ExportMethodWithClassProtocol : NSObject<ExportMethodWithClassProtocol>
+@end
+
+@implementation ExportMethodWithClassProtocol
+- (void) methodWithClassProtocol:(NSObject<TruthTeller> *)object
+{
+    checkResult(@"Exporting a method with class<protocol> in the type signature", [object returnTrue]);
+}
+@end
+
+@implementation JSExportTests
++ (void) exportInstanceMethodWithIdProtocolTest
+{
+    JSContext *context = [[JSContext alloc] init];
+    context[@"ExportMethodWithIdProtocol"] = [ExportMethodWithIdProtocol class];
+    context[@"makeTestObject"] = ^{
+        return [[ExportMethodWithIdProtocol alloc] init];
+    };
+    context[@"opaqueObject"] = [[TruthTeller alloc] init];
+    [context evaluateScript:@"makeTestObject().methodWithIdProtocol(opaqueObject);"];
+    checkResult(@"Successfully exported instance method", !context.exception);
+}
+
++ (void) exportInstanceMethodWithClassProtocolTest
+{
+    JSContext *context = [[JSContext alloc] init];
+    context[@"ExportMethodWithClassProtocol"] = [ExportMethodWithClassProtocol class];
+    context[@"makeTestObject"] = ^{
+        return [[ExportMethodWithClassProtocol alloc] init];
+    };
+    context[@"opaqueObject"] = [[TruthTeller alloc] init];
+    [context evaluateScript:@"makeTestObject().methodWithClassProtocol(opaqueObject);"];
+    checkResult(@"Successfully exported instance method", !context.exception);
+}
+
++ (void) exportDynamicallyGeneratedProtocolTest
+{
+    JSContext *context = [[JSContext alloc] init];
+    Protocol *dynProtocol = objc_allocateProtocol("NSStringJSExport");
+    Protocol *jsExportProtocol = @protocol(JSExport);
+    protocol_addProtocol(dynProtocol, jsExportProtocol);
+    Method method = class_getInstanceMethod([NSString class], @selector(boolValue));
+    protocol_addMethodDescription(dynProtocol, @selector(boolValue), method_getTypeEncoding(method), YES, YES);
+    NSLog(@"type encoding = %s", method_getTypeEncoding(method));
+    protocol_addMethodDescription(dynProtocol, @selector(boolValue), "B@:", YES, YES);
+    objc_registerProtocol(dynProtocol);
+    class_addProtocol([NSString class], dynProtocol);
+    
+    context[@"NSString"] = [NSString class];
+    context[@"myString"] = @"YES";
+    JSValue *value = [context evaluateScript:@"myString.boolValue()"];
+    checkResult(@"Dynamically generated JSExport-ed protocols are ignored", [value isUndefined] && !!context.exception);
+}
+@end
+
+void runJSExportTests()
+{
+    @autoreleasepool {
+        [JSExportTests exportInstanceMethodWithIdProtocolTest];
+        [JSExportTests exportInstanceMethodWithClassProtocolTest];
+        [JSExportTests exportDynamicallyGeneratedProtocolTest];
+    }
+}
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/tests/JSNode.c b/API/tests/JSNode.c
new file mode 100644
index 0000000..d0a0dc3
--- /dev/null
+++ b/API/tests/JSNode.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include <wtf/Platform.h>
+
+#include "JSNode.h"
+#include "JSNodeList.h"
+#include "JSObjectRef.h"
+#include "JSStringRef.h"
+#include "JSValueRef.h"
+#include "Node.h"
+#include "NodeList.h"
+#include <wtf/Assertions.h>
+
+static JSValueRef JSNode_appendChild(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+
+    /* Example of throwing a type error for invalid values */
+    if (!JSValueIsObjectOfClass(context, thisObject, JSNode_class(context))) {
+        JSStringRef message = JSStringCreateWithUTF8CString("TypeError: appendChild can only be called on nodes");
+        *exception = JSValueMakeString(context, message);
+        JSStringRelease(message);
+    } else if (argumentCount < 1 || !JSValueIsObjectOfClass(context, arguments[0], JSNode_class(context))) {
+        JSStringRef message = JSStringCreateWithUTF8CString("TypeError: first argument to appendChild must be a node");
+        *exception = JSValueMakeString(context, message);
+        JSStringRelease(message);
+    } else {
+        Node* node = JSObjectGetPrivate(thisObject);
+        Node* child = JSObjectGetPrivate(JSValueToObject(context, arguments[0], NULL));
+
+        Node_appendChild(node, child);
+    }
+
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef JSNode_removeChild(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+
+    /* Example of ignoring invalid values */
+    if (argumentCount > 0) {
+        if (JSValueIsObjectOfClass(context, thisObject, JSNode_class(context))) {
+            if (JSValueIsObjectOfClass(context, arguments[0], JSNode_class(context))) {
+                Node* node = JSObjectGetPrivate(thisObject);
+                Node* child = JSObjectGetPrivate(JSValueToObject(context, arguments[0], exception));
+                
+                Node_removeChild(node, child);
+            }
+        }
+    }
+    
+    return JSValueMakeUndefined(context);
+}
+
+static JSValueRef JSNode_replaceChild(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+    
+    if (argumentCount > 1) {
+        if (JSValueIsObjectOfClass(context, thisObject, JSNode_class(context))) {
+            if (JSValueIsObjectOfClass(context, arguments[0], JSNode_class(context))) {
+                if (JSValueIsObjectOfClass(context, arguments[1], JSNode_class(context))) {
+                    Node* node = JSObjectGetPrivate(thisObject);
+                    Node* newChild = JSObjectGetPrivate(JSValueToObject(context, arguments[0], exception));
+                    Node* oldChild = JSObjectGetPrivate(JSValueToObject(context, arguments[1], exception));
+                    
+                    Node_replaceChild(node, newChild, oldChild);
+                }
+            }
+        }
+    }
+    
+    return JSValueMakeUndefined(context);
+}
+
+static JSStaticFunction JSNode_staticFunctions[] = {
+    { "appendChild", JSNode_appendChild, kJSPropertyAttributeDontDelete },
+    { "removeChild", JSNode_removeChild, kJSPropertyAttributeDontDelete },
+    { "replaceChild", JSNode_replaceChild, kJSPropertyAttributeDontDelete },
+    { 0, 0, 0 }
+};
+
+static JSValueRef JSNode_getNodeType(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(exception);
+
+    Node* node = JSObjectGetPrivate(object);
+    if (node) {
+        JSStringRef nodeType = JSStringCreateWithUTF8CString(node->nodeType);
+        JSValueRef value = JSValueMakeString(context, nodeType);
+        JSStringRelease(nodeType);
+        return value;
+    }
+    
+    return NULL;
+}
+
+static JSValueRef JSNode_getChildNodes(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(exception);
+
+    Node* node = JSObjectGetPrivate(thisObject);
+    ASSERT(node);
+    return JSNodeList_new(context, NodeList_new(node));
+}
+
+static JSValueRef JSNode_getFirstChild(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(exception);
+    
+    return JSValueMakeUndefined(context);
+}
+
+static JSStaticValue JSNode_staticValues[] = {
+    { "nodeType", JSNode_getNodeType, NULL, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
+    { "childNodes", JSNode_getChildNodes, NULL, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
+    { "firstChild", JSNode_getFirstChild, NULL, kJSPropertyAttributeDontDelete | kJSPropertyAttributeReadOnly },
+    { 0, 0, 0, 0 }
+};
+
+static void JSNode_initialize(JSContextRef context, JSObjectRef object)
+{
+    UNUSED_PARAM(context);
+
+    Node* node = JSObjectGetPrivate(object);
+    ASSERT(node);
+
+    Node_ref(node);
+}
+
+static void JSNode_finalize(JSObjectRef object)
+{
+    Node* node = JSObjectGetPrivate(object);
+    ASSERT(node);
+
+    Node_deref(node);
+}
+
+JSClassRef JSNode_class(JSContextRef context)
+{
+    UNUSED_PARAM(context);
+
+    static JSClassRef jsClass;
+    if (!jsClass) {
+        JSClassDefinition definition = kJSClassDefinitionEmpty;
+        definition.staticValues = JSNode_staticValues;
+        definition.staticFunctions = JSNode_staticFunctions;
+        definition.initialize = JSNode_initialize;
+        definition.finalize = JSNode_finalize;
+
+        jsClass = JSClassCreate(&definition);
+    }
+    return jsClass;
+}
+
+JSObjectRef JSNode_new(JSContextRef context, Node* node)
+{
+    return JSObjectMake(context, JSNode_class(context), node);
+}
+
+JSObjectRef JSNode_construct(JSContextRef context, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+
+    return JSNode_new(context, Node_new());
+}
diff --git a/API/tests/JSNode.h b/API/tests/JSNode.h
new file mode 100644
index 0000000..dc3e1ca
--- /dev/null
+++ b/API/tests/JSNode.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSBase.h"
+#include "Node.h"
+#include <stddef.h>
+
+extern JSObjectRef JSNode_new(JSContextRef context, Node* node);
+extern JSClassRef JSNode_class(JSContextRef context);
+extern JSObjectRef JSNode_construct(JSContextRef context, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
diff --git a/API/tests/JSNodeList.c b/API/tests/JSNodeList.c
new file mode 100644
index 0000000..f037e09
--- /dev/null
+++ b/API/tests/JSNodeList.c
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include <wtf/Platform.h>
+
+#include "JSNode.h"
+#include "JSNodeList.h"
+#include "JSObjectRef.h"
+#include "JSValueRef.h"
+#include <wtf/Assertions.h>
+
+static JSValueRef JSNodeList_item(JSContextRef context, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+
+    if (argumentCount > 0) {
+        NodeList* nodeList = JSObjectGetPrivate(thisObject);
+        ASSERT(nodeList);
+        Node* node = NodeList_item(nodeList, (unsigned)JSValueToNumber(context, arguments[0], exception));
+        if (node)
+            return JSNode_new(context, node);
+    }
+    
+    return JSValueMakeUndefined(context);
+}
+
+static JSStaticFunction JSNodeList_staticFunctions[] = {
+    { "item", JSNodeList_item, kJSPropertyAttributeDontDelete },
+    { 0, 0, 0 }
+};
+
+static JSValueRef JSNodeList_length(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(exception);
+    
+    NodeList* nodeList = JSObjectGetPrivate(thisObject);
+    ASSERT(nodeList);
+    return JSValueMakeNumber(context, NodeList_length(nodeList));
+}
+
+static JSStaticValue JSNodeList_staticValues[] = {
+    { "length", JSNodeList_length, NULL, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+    { 0, 0, 0, 0 }
+};
+
+static JSValueRef JSNodeList_getProperty(JSContextRef context, JSObjectRef thisObject, JSStringRef propertyName, JSValueRef* exception)
+{
+    NodeList* nodeList = JSObjectGetPrivate(thisObject);
+    ASSERT(nodeList);
+    double index = JSValueToNumber(context, JSValueMakeString(context, propertyName), exception);
+    unsigned uindex = (unsigned)index;
+    if (uindex == index) { /* false for NaN */
+        Node* node = NodeList_item(nodeList, uindex);
+        if (node)
+            return JSNode_new(context, node);
+    }
+    
+    return NULL;
+}
+
+static void JSNodeList_initialize(JSContextRef context, JSObjectRef thisObject)
+{
+    UNUSED_PARAM(context);
+
+    NodeList* nodeList = JSObjectGetPrivate(thisObject);
+    ASSERT(nodeList);
+    
+    NodeList_ref(nodeList);
+}
+
+static void JSNodeList_finalize(JSObjectRef thisObject)
+{
+    NodeList* nodeList = JSObjectGetPrivate(thisObject);
+    ASSERT(nodeList);
+
+    NodeList_deref(nodeList);
+}
+
+static JSClassRef JSNodeList_class(JSContextRef context)
+{
+    UNUSED_PARAM(context);
+
+    static JSClassRef jsClass;
+    if (!jsClass) {
+        JSClassDefinition definition = kJSClassDefinitionEmpty;
+        definition.staticValues = JSNodeList_staticValues;
+        definition.staticFunctions = JSNodeList_staticFunctions;
+        definition.getProperty = JSNodeList_getProperty;
+        definition.initialize = JSNodeList_initialize;
+        definition.finalize = JSNodeList_finalize;
+
+        jsClass = JSClassCreate(&definition);
+    }
+    
+    return jsClass;
+}
+
+JSObjectRef JSNodeList_new(JSContextRef context, NodeList* nodeList)
+{
+    return JSObjectMake(context, JSNodeList_class(context), nodeList);
+}
diff --git a/API/tests/JSNodeList.h b/API/tests/JSNodeList.h
new file mode 100644
index 0000000..c2d2bb9
--- /dev/null
+++ b/API/tests/JSNodeList.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSBase.h"
+#include "NodeList.h"
+
+extern JSObjectRef JSNodeList_new(JSContextRef, NodeList*);
diff --git a/API/tests/JSONParseTest.cpp b/API/tests/JSONParseTest.cpp
new file mode 100644
index 0000000..2797c3c
--- /dev/null
+++ b/API/tests/JSONParseTest.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSONParseTest.h"
+
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSONObject.h"
+#include "VM.h"
+#include <wtf/RefPtr.h>
+
+using namespace JSC;
+
+int testJSONParse()
+{
+    bool failed = false;
+
+    RefPtr<VM> vm = VM::create();
+
+    JSLockHolder locker(vm.get());
+    JSGlobalObject* globalObject = JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
+
+    ExecState* exec = globalObject->globalExec();
+    JSValue v0 = JSONParse(exec, "");
+    JSValue v1 = JSONParse(exec, "#$%^");
+    JSValue v2 = JSONParse(exec, String());
+    UChar emptyUCharArray[1] = { '\0' };
+    JSValue v3 = JSONParse(exec, String(emptyUCharArray, 0));
+    JSValue v4;
+    JSValue v5 = JSONParse(exec, "123");
+
+    failed = failed || (v0 != v1);
+    failed = failed || (v1 != v2);
+    failed = failed || (v2 != v3);
+    failed = failed || (v3 != v4);
+    failed = failed || (v4 == v5);
+
+    vm = nullptr;
+
+    if (failed)
+        printf("FAIL: JSONParse String test.\n");
+    else
+        printf("PASS: JSONParse String test.\n");
+
+    return failed;
+}
diff --git a/API/tests/JSONParseTest.h b/API/tests/JSONParseTest.h
new file mode 100644
index 0000000..13842f9
--- /dev/null
+++ b/API/tests/JSONParseTest.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+    
+int testJSONParse();
+    
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
diff --git a/API/tests/Node.c b/API/tests/Node.c
new file mode 100644
index 0000000..db687e9
--- /dev/null
+++ b/API/tests/Node.c
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "Node.h"
+#include <stddef.h>
+#include <stdlib.h>
+
+Node* Node_new(void)
+{
+    Node* node = (Node*)malloc(sizeof(Node));
+    node->refCount = 0;
+    node->nodeType = "Node";
+    node->childNodesTail = NULL;
+    
+    return node;
+}
+
+void Node_appendChild(Node* node, Node* child)
+{
+    Node_ref(child);
+    NodeLink* nodeLink = (NodeLink*)malloc(sizeof(NodeLink));
+    nodeLink->node = child;
+    nodeLink->prev = node->childNodesTail;
+    node->childNodesTail = nodeLink;
+}
+
+void Node_removeChild(Node* node, Node* child)
+{
+    /* Linear search from tail -- good enough for our purposes here */
+    NodeLink* current;
+    NodeLink** currentHandle;
+    for (currentHandle = &node->childNodesTail, current = *currentHandle; current; currentHandle = &current->prev, current = *currentHandle) {
+        if (current->node == child) {
+            Node_deref(current->node);
+            *currentHandle = current->prev;
+            free(current);
+            break;
+        }
+    }
+}
+
+void Node_replaceChild(Node* node, Node* newChild, Node* oldChild)
+{
+    /* Linear search from tail -- good enough for our purposes here */
+    NodeLink* current;
+    for (current = node->childNodesTail; current; current = current->prev) {
+        if (current->node == oldChild) {
+            Node_deref(current->node);
+            current->node = newChild;
+        }
+    }
+}
+
+void Node_ref(Node* node)
+{
+    ++node->refCount;
+}
+
+void Node_deref(Node* node)
+{
+    if (--node->refCount == 0)
+        free(node);
+}
diff --git a/API/tests/Node.h b/API/tests/Node.h
new file mode 100644
index 0000000..bdb1f2c
--- /dev/null
+++ b/API/tests/Node.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+typedef struct __Node Node;
+typedef struct __NodeLink NodeLink;
+
+struct __NodeLink {
+    Node* node;
+    NodeLink* prev;
+};
+
+struct __Node {
+    unsigned refCount;
+    const char* nodeType;
+    NodeLink* childNodesTail;
+};
+
+extern Node* Node_new(void);
+extern void Node_ref(Node* node);
+extern void Node_deref(Node* node);
+extern void Node_appendChild(Node* node, Node* child);
+extern void Node_removeChild(Node* node, Node* child);
+extern void Node_replaceChild(Node* node, Node* newChild, Node* oldChild);
diff --git a/API/tests/NodeList.c b/API/tests/NodeList.c
new file mode 100644
index 0000000..69f4cd5
--- /dev/null
+++ b/API/tests/NodeList.c
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "NodeList.h"
+
+#include <stdlib.h>
+
+extern NodeList* NodeList_new(Node* parentNode)
+{
+    Node_ref(parentNode);
+
+    NodeList* nodeList = (NodeList*)malloc(sizeof(NodeList));
+    nodeList->parentNode = parentNode;
+    nodeList->refCount = 0;
+    return nodeList;
+}
+
+extern unsigned NodeList_length(NodeList* nodeList)
+{
+    /* Linear count from tail -- good enough for our purposes here */
+    unsigned i = 0;
+    NodeLink* n = nodeList->parentNode->childNodesTail;
+    while (n) {
+        n = n->prev;
+        ++i;
+    }
+
+    return i;
+}
+
+extern Node* NodeList_item(NodeList* nodeList, unsigned index)
+{
+    unsigned length = NodeList_length(nodeList);
+    if (index >= length)
+        return NULL;
+
+    /* Linear search from tail -- good enough for our purposes here */
+    NodeLink* n = nodeList->parentNode->childNodesTail;
+    unsigned i = 0;
+    unsigned count = length - 1 - index;
+    while (i < count) {
+        ++i;
+        n = n->prev;
+    }
+    return n->node;
+}
+
+extern void NodeList_ref(NodeList* nodeList)
+{
+    ++nodeList->refCount;
+}
+
+extern void NodeList_deref(NodeList* nodeList)
+{
+    if (--nodeList->refCount == 0) {
+        Node_deref(nodeList->parentNode);
+        free(nodeList);
+    }
+}
diff --git a/API/tests/NodeList.h b/API/tests/NodeList.h
new file mode 100644
index 0000000..51163c2
--- /dev/null
+++ b/API/tests/NodeList.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Node.h"
+
+typedef struct {
+    unsigned refCount;
+    Node* parentNode;
+} NodeList;
+
+extern NodeList* NodeList_new(Node* parentNode);
+extern unsigned NodeList_length(NodeList*);
+extern Node* NodeList_item(NodeList*, unsigned);
+extern void NodeList_ref(NodeList*);
+extern void NodeList_deref(NodeList*);
diff --git a/API/tests/PingPongStackOverflowTest.cpp b/API/tests/PingPongStackOverflowTest.cpp
new file mode 100644
index 0000000..ef4b914
--- /dev/null
+++ b/API/tests/PingPongStackOverflowTest.cpp
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PingPongStackOverflowTest.h"
+
+#include "InitializeThreading.h"
+#include "JSContextRefPrivate.h"
+#include "JavaScriptCore.h"
+#include "Options.h"
+#include <wtf/text/StringBuilder.h>
+
+using JSC::Options;
+
+static JSGlobalContextRef context = nullptr;
+static int nativeRecursionCount = 0;
+
+static bool PingPongStackOverflowObject_hasInstance(JSContextRef context, JSObjectRef constructor, JSValueRef possibleValue, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(constructor);
+
+    JSStringRef hasInstanceName = JSStringCreateWithUTF8CString("hasInstance");
+    JSValueRef hasInstance = JSObjectGetProperty(context, constructor, hasInstanceName, exception);
+    JSStringRelease(hasInstanceName);
+    if (!hasInstance)
+        return false;
+
+    int countAtEntry = nativeRecursionCount++;
+
+    JSValueRef result = 0;
+    if (nativeRecursionCount < 100) {
+        JSObjectRef function = JSValueToObject(context, hasInstance, exception);
+        result = JSObjectCallAsFunction(context, function, constructor, 1, &possibleValue, exception);
+    } else {
+        StringBuilder builder;
+        builder.appendLiteral("dummy.valueOf([0]");
+        for (int i = 1; i < 35000; i++) {
+            builder.appendLiteral(", [");
+            builder.appendNumber(i);
+            builder.appendLiteral("]");
+        }
+        builder.appendLiteral(");");
+
+        JSStringRef script = JSStringCreateWithUTF8CString(builder.toString().utf8().data());
+        result = JSEvaluateScript(context, script, NULL, NULL, 1, exception);
+        JSStringRelease(script);
+    }
+
+    --nativeRecursionCount;
+    if (nativeRecursionCount != countAtEntry)
+        printf("    ERROR: PingPongStackOverflow test saw a recursion count mismatch\n");
+
+    return result && JSValueToBoolean(context, result);
+}
+
+JSClassDefinition PingPongStackOverflowObject_definition = {
+    0,
+    kJSClassAttributeNone,
+    
+    "PingPongStackOverflowObject",
+    NULL,
+    
+    NULL,
+    NULL,
+    
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    PingPongStackOverflowObject_hasInstance,
+    NULL,
+};
+
+static JSClassRef PingPongStackOverflowObject_class(JSContextRef context)
+{
+    UNUSED_PARAM(context);
+    
+    static JSClassRef jsClass;
+    if (!jsClass)
+        jsClass = JSClassCreate(&PingPongStackOverflowObject_definition);
+    
+    return jsClass;
+}
+
+// This tests tests a stack overflow on VM reentry into a JS function from a native function
+// after ping-pong'ing back and forth between JS and native functions multiple times.
+// This test should not hang or crash.
+int testPingPongStackOverflow()
+{
+    bool failed = false;
+
+    JSC::initializeThreading();
+    Options::initialize(); // Ensure options is initialized first.
+
+    auto origSoftReservedZoneSize = Options::softReservedZoneSize();
+    auto origReservedZoneSize = Options::reservedZoneSize();
+    auto origUseLLInt = Options::useLLInt();
+    auto origMaxPerThreadStackUsage = Options::maxPerThreadStackUsage();
+
+    Options::softReservedZoneSize() = 128 * KB;
+    Options::reservedZoneSize() = 64 * KB;
+#if ENABLE(JIT)
+    // Normally, we want to disable the LLINT to force the use of JITted code which is necessary for
+    // reproducing the regression in https://bugs.webkit.org/show_bug.cgi?id=148749. However, we only
+    // want to do this if the LLINT isn't the only available execution engine.
+    Options::useLLInt() = false;
+#endif
+
+    const char* scriptString =
+        "var count = 0;" \
+        "PingPongStackOverflowObject.hasInstance = function f() {" \
+        "    return (undefined instanceof PingPongStackOverflowObject);" \
+        "};" \
+        "PingPongStackOverflowObject.__proto__ = undefined;" \
+        "undefined instanceof PingPongStackOverflowObject;";
+
+    JSValueRef scriptResult = nullptr;
+    JSValueRef exception = nullptr;
+    JSStringRef script = JSStringCreateWithUTF8CString(scriptString);
+
+    nativeRecursionCount = 0;
+    context = JSGlobalContextCreateInGroup(nullptr, nullptr);
+
+    JSObjectRef globalObject = JSContextGetGlobalObject(context);
+    ASSERT(JSValueIsObject(context, globalObject));
+
+    JSObjectRef PingPongStackOverflowObject = JSObjectMake(context, PingPongStackOverflowObject_class(context), NULL);
+    JSStringRef PingPongStackOverflowObjectString = JSStringCreateWithUTF8CString("PingPongStackOverflowObject");
+    JSObjectSetProperty(context, globalObject, PingPongStackOverflowObjectString, PingPongStackOverflowObject, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(PingPongStackOverflowObjectString);
+
+    unsigned stackSize = 32 * KB;
+    Options::maxPerThreadStackUsage() = stackSize + Options::softReservedZoneSize();
+
+    exception = nullptr;
+    scriptResult = JSEvaluateScript(context, script, nullptr, nullptr, 1, &exception);
+
+    if (!exception) {
+        printf("FAIL: PingPongStackOverflowError not thrown in PingPongStackOverflow test\n");
+        failed = true;
+    } else if (nativeRecursionCount) {
+        printf("FAIL: Unbalanced native recursion count: %d in PingPongStackOverflow test\n", nativeRecursionCount);
+        failed = true;
+    } else {
+        printf("PASS: PingPongStackOverflow test.\n");
+    }
+
+    Options::softReservedZoneSize() = origSoftReservedZoneSize;
+    Options::reservedZoneSize() = origReservedZoneSize;
+    Options::useLLInt() = origUseLLInt;
+    Options::maxPerThreadStackUsage() = origMaxPerThreadStackUsage;
+
+    return failed;
+}
diff --git a/API/tests/PingPongStackOverflowTest.h b/API/tests/PingPongStackOverflowTest.h
new file mode 100644
index 0000000..a204669
--- /dev/null
+++ b/API/tests/PingPongStackOverflowTest.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int testPingPongStackOverflow();
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
diff --git a/API/tests/Regress141275.h b/API/tests/Regress141275.h
new file mode 100644
index 0000000..bf3492a
--- /dev/null
+++ b/API/tests/Regress141275.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <Foundation/Foundation.h>
+#import <JavaScriptCore/JavaScriptCore.h>
+
+#if JSC_OBJC_API_ENABLED
+
+void runRegress141275();
+
+#endif // JSC_OBJC_API_ENABLED
+
diff --git a/API/tests/Regress141275.mm b/API/tests/Regress141275.mm
new file mode 100644
index 0000000..18e186a
--- /dev/null
+++ b/API/tests/Regress141275.mm
@@ -0,0 +1,388 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "Regress141275.h"
+
+#import <Foundation/Foundation.h>
+#import <objc/objc.h>
+#import <objc/runtime.h>
+
+#if JSC_OBJC_API_ENABLED
+
+extern "C" void JSSynchronousGarbageCollectForDebugging(JSContextRef);
+
+extern int failed;
+
+static const NSUInteger scriptToEvaluate = 50;
+
+@interface JSTEvaluator : NSObject
+- (instancetype)initWithScript:(NSString*)script;
+
+- (void)insertSignPostWithCompletion:(void(^)(NSError* error))completionHandler;
+
+- (void)evaluateScript:(NSString*)script completion:(void(^)(NSError* error))completionHandler;
+- (void)evaluateBlock:(void(^)(JSContext* context))evaluationBlock completion:(void(^)(NSError* error))completionHandler;
+
+- (void)waitForTasksDoneAndReportResults;
+@end
+
+
+static const NSString* JSTEvaluatorThreadContextKey = @"JSTEvaluatorThreadContextKey";
+
+/*
+ * A JSTEvaluatorThreadContext is kept in the thread dictionary of threads used by JSEvaluator.
+ *
+ * This includes the run loop thread, and any threads used by _jsSourcePerformQueue to execute a task.
+ */
+@interface JSTEvaluatorThreadContext : NSObject
+@property (weak) JSTEvaluator* evaluator;
+@property (strong) JSContext* jsContext;
+@end
+
+@implementation JSTEvaluatorThreadContext
+@end
+
+
+/*!
+ * A JSTEvaluatorTask is a single task to be executed.
+ *
+ * JSTEvaluator keeps a list of pending tasks. The run loop thread is repsonsible for feeding pending tasks to the _jsSourcePerformQueue, while respecting sign posts.
+ */
+@interface JSTEvaluatorTask : NSObject
+
+@property (nonatomic, copy) void (^evaluateBlock)(JSContext* jsContext);
+@property (nonatomic, copy) void (^completionHandler)(NSError* error);
+@property (nonatomic, copy) NSError* error;
+
++ (instancetype)evaluatorTaskWithEvaluateBlock:(void (^)(JSContext*))block completionHandler:(void (^)(NSError* error))completionBlock;
+
+@end
+
+@implementation JSTEvaluatorTask
+
++ (instancetype)evaluatorTaskWithEvaluateBlock:(void (^)(JSContext*))evaluationBlock completionHandler:(void (^)(NSError* error))completionHandler
+{
+    JSTEvaluatorTask* task = [self new];
+    task.evaluateBlock = evaluationBlock;
+    task.completionHandler = completionHandler;
+    return task;
+}
+
+@end
+
+@implementation JSTEvaluator {
+    dispatch_queue_t _jsSourcePerformQueue;
+    dispatch_semaphore_t _allScriptsDone;
+    CFRunLoopRef _jsThreadRunLoop;
+    CFRunLoopSourceRef _jsThreadRunLoopSource;
+    JSContext* _jsContext;
+    NSMutableArray* __pendingTasks;
+}
+
+- (instancetype)init
+{
+    self = [super init];
+    if (self) {
+        _jsSourcePerformQueue = dispatch_queue_create("JSTEval", DISPATCH_QUEUE_CONCURRENT);
+
+        _allScriptsDone = dispatch_semaphore_create(0);
+
+        _jsContext = [JSContext new];
+        _jsContext.name = @"JSTEval";
+        __pendingTasks = [NSMutableArray new];
+
+        NSThread* jsThread = [[NSThread alloc] initWithTarget:self selector:@selector(_jsThreadMain) object:nil];
+        [jsThread setName:@"JSTEval"];
+        [jsThread start];
+
+    }
+    return self;
+}
+
+- (instancetype)initWithScript:(NSString*)script
+{
+    self = [self init];
+    if (self) {
+        __block NSError* scriptError = nil;
+        dispatch_semaphore_t dsema = dispatch_semaphore_create(0);
+        [self evaluateScript:script
+            completion:^(NSError* error) {
+                scriptError = error;
+                dispatch_semaphore_signal(dsema);
+            }];
+        dispatch_semaphore_wait(dsema, DISPATCH_TIME_FOREVER);
+    }
+    return self;
+}
+
+- (void)_accessPendingTasksWithBlock:(void(^)(NSMutableArray* pendingTasks))block
+{
+    @synchronized(self) {
+        block(__pendingTasks);
+        if (__pendingTasks.count > 0) {
+            if (_jsThreadRunLoop && _jsThreadRunLoopSource) {
+                CFRunLoopSourceSignal(_jsThreadRunLoopSource);
+                CFRunLoopWakeUp(_jsThreadRunLoop);
+            }
+        }
+    }
+}
+
+- (void)insertSignPostWithCompletion:(void(^)(NSError* error))completionHandler
+{
+    [self _accessPendingTasksWithBlock:^(NSMutableArray* pendingTasks) {
+        JSTEvaluatorTask* task = [JSTEvaluatorTask evaluatorTaskWithEvaluateBlock:nil
+            completionHandler:completionHandler];
+
+        [pendingTasks addObject:task];
+    }];
+}
+
+- (void)evaluateScript:(NSString*)script completion:(void(^)(NSError* error))completionHandler
+{
+    [self evaluateBlock:^(JSContext* context) {
+        [context evaluateScript:script];
+    } completion:completionHandler];
+}
+
+- (void)evaluateBlock:(void(^)(JSContext* context))evaluationBlock completion:(void(^)(NSError* error))completionHandler
+{
+    NSParameterAssert(evaluationBlock != nil);
+    [self _accessPendingTasksWithBlock:^(NSMutableArray* pendingTasks) {
+        JSTEvaluatorTask* task = [JSTEvaluatorTask evaluatorTaskWithEvaluateBlock:evaluationBlock
+            completionHandler:completionHandler];
+
+        [pendingTasks addObject:task];
+    }];
+}
+
+- (void)waitForTasksDoneAndReportResults
+{
+    NSString* passFailString = @"PASSED";
+
+    if (!dispatch_semaphore_wait(_allScriptsDone, dispatch_time(DISPATCH_TIME_NOW, 30 * NSEC_PER_SEC))) {
+        int totalScriptsRun = [_jsContext[@"counter"] toInt32];
+
+        if (totalScriptsRun != scriptToEvaluate) {
+            passFailString = @"FAILED";
+            failed = 1;
+        }
+
+        NSLog(@"  Ran a total of %d scripts: %@", totalScriptsRun, passFailString);
+    } else {
+        passFailString = @"FAILED";
+        failed = 1;
+        NSLog(@"  Error, timeout waiting for all tasks to complete: %@", passFailString);
+    }
+}
+
+static void __JSTRunLoopSourceScheduleCallBack(void* info, CFRunLoopRef rl, CFStringRef)
+{
+    @autoreleasepool {
+        [(__bridge JSTEvaluator*)info _sourceScheduledOnRunLoop:rl];
+    }
+}
+
+static void __JSTRunLoopSourcePerformCallBack(void* info )
+{
+    @autoreleasepool {
+        [(__bridge JSTEvaluator*)info _sourcePerform];
+    }
+}
+
+static void __JSTRunLoopSourceCancelCallBack(void* info, CFRunLoopRef rl, CFStringRef)
+{
+    @autoreleasepool {
+        [(__bridge JSTEvaluator*)info _sourceCanceledOnRunLoop:rl];
+    }
+}
+
+- (void)_jsThreadMain
+{
+    @autoreleasepool {
+        const CFIndex kRunLoopSourceContextVersion = 0;
+        CFRunLoopSourceContext sourceContext = {
+            kRunLoopSourceContextVersion, (__bridge void*)(self),
+            NULL, NULL, NULL, NULL, NULL,
+            __JSTRunLoopSourceScheduleCallBack,
+            __JSTRunLoopSourceCancelCallBack,
+            __JSTRunLoopSourcePerformCallBack
+        };
+
+        @synchronized(self) {
+            _jsThreadRunLoop = CFRunLoopGetCurrent();
+            CFRetain(_jsThreadRunLoop);
+
+            _jsThreadRunLoopSource = CFRunLoopSourceCreate(kCFAllocatorDefault, 0, &sourceContext);
+            CFRunLoopAddSource(_jsThreadRunLoop, _jsThreadRunLoopSource, kCFRunLoopDefaultMode);
+        }
+
+        CFRunLoopRun();
+
+        @synchronized(self) {
+            NSMutableDictionary* threadDict = [[NSThread currentThread] threadDictionary];
+            [threadDict removeObjectForKey:threadDict[JSTEvaluatorThreadContextKey]];
+
+            CFRelease(_jsThreadRunLoopSource);
+            _jsThreadRunLoopSource = NULL;
+
+            CFRelease(_jsThreadRunLoop);
+            _jsThreadRunLoop = NULL;
+
+            __pendingTasks = nil;
+        }
+    }
+}
+
+- (void)_sourceScheduledOnRunLoop:(CFRunLoopRef)runLoop
+{
+    UNUSED_PARAM(runLoop);
+    assert([[[NSThread currentThread] name] isEqualToString:@"JSTEval"]);
+
+    // Wake up the run loop in case requests were submitted prior to the
+    // run loop & run loop source getting created.
+    CFRunLoopSourceSignal(_jsThreadRunLoopSource);
+    CFRunLoopWakeUp(_jsThreadRunLoop);
+}
+
+- (void)_setupEvaluatorThreadContextIfNeeded
+{
+    NSMutableDictionary* threadDict = [[NSThread currentThread] threadDictionary];
+    JSTEvaluatorThreadContext* context = threadDict[JSTEvaluatorThreadContextKey];
+    // The evaluator may be other evualuator, or nil if this thread has not been used before. Eaither way take ownership.
+    if (context.evaluator != self) {
+        context = [JSTEvaluatorThreadContext new];
+        context.evaluator = self;
+        threadDict[JSTEvaluatorThreadContextKey] = context;
+    }
+}
+
+- (void)_callCompletionHandler:(void(^)(NSError* error))completionHandler ifNeededWithError:(NSError*)error
+{
+    if (completionHandler) {
+        dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
+            completionHandler(error);
+        });
+    }
+}
+
+- (void)_sourcePerform
+{
+    assert([[[NSThread currentThread] name] isEqualToString:@"JSTEval"]);
+
+    __block NSArray* tasks = nil;
+    [self _accessPendingTasksWithBlock:^(NSMutableArray* pendingTasks) {
+        // No signpost, take all tasks.
+        tasks = [pendingTasks copy];
+        [pendingTasks removeAllObjects];
+    }];
+
+    if (tasks.count > 0) {
+        for (JSTEvaluatorTask* task in tasks) {
+            dispatch_block_t block = ^{
+                NSError* error = nil;
+                if (task.evaluateBlock) {
+                    [self _setupEvaluatorThreadContextIfNeeded];
+                    task.evaluateBlock(_jsContext);
+                    if (_jsContext.exception) {
+                        NSLog(@"Did fail on JSContext: %@", _jsContext.name);
+                        NSDictionary* userInfo = @{ NSLocalizedDescriptionKey : [_jsContext.exception[@"message"] toString] };
+                        error = [NSError errorWithDomain:@"JSTEvaluator" code:1 userInfo:userInfo];
+                        _jsContext.exception = nil;
+                    }
+                }
+                [self _callCompletionHandler:task.completionHandler ifNeededWithError:error];
+            };
+
+            if (task.evaluateBlock)
+                dispatch_async(_jsSourcePerformQueue, block);
+            else
+                dispatch_barrier_async(_jsSourcePerformQueue, block);
+        }
+
+        dispatch_barrier_sync(_jsSourcePerformQueue, ^{
+            if ([_jsContext[@"counter"] toInt32] == scriptToEvaluate)
+                dispatch_semaphore_signal(_allScriptsDone);
+        });
+    }
+}
+
+- (void)_sourceCanceledOnRunLoop:(CFRunLoopRef)runLoop
+{
+    UNUSED_PARAM(runLoop);
+    assert([[[NSThread currentThread] name] isEqualToString:@"JSTEval"]);
+
+    @synchronized(self) {
+        assert(_jsThreadRunLoop);
+        assert(_jsThreadRunLoopSource);
+
+        CFRunLoopRemoveSource(_jsThreadRunLoop, _jsThreadRunLoopSource, kCFRunLoopDefaultMode);
+        CFRunLoopStop(_jsThreadRunLoop);
+    }
+}
+
+@end
+
+void runRegress141275()
+{
+    // Test that we can execute the same script from multiple threads with a shared context.
+    // See <https://webkit.org/b/141275>
+    NSLog(@"TEST: Testing multiple threads executing the same script with a shared context");
+
+    @autoreleasepool {
+        JSTEvaluator* evaluator = [[JSTEvaluator alloc] initWithScript:@"this['counter'] = 0;"];
+
+        void (^showErrorIfNeeded)(NSError* error) = ^(NSError* error) {
+            if (error) {
+                dispatch_async(dispatch_get_main_queue(), ^{
+                    NSLog(@"Error: %@", error);
+                });
+            }
+        };
+
+        [evaluator evaluateBlock:^(JSContext* context) {
+            JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+        } completion:showErrorIfNeeded];
+
+        [evaluator evaluateBlock:^(JSContext* context) {
+            context[@"wait"] = ^{
+                [NSThread sleepForTimeInterval:0.01];
+            };
+        } completion:^(NSError* error) {
+            if (error) {
+                dispatch_async(dispatch_get_main_queue(), ^{
+                    NSLog(@"Error: %@", error);
+                });
+            }
+            for (unsigned i = 0; i < scriptToEvaluate; i++)
+                [evaluator evaluateScript:@"this['counter']++; this['wait']();" completion:showErrorIfNeeded];
+        }];
+
+        [evaluator waitForTasksDoneAndReportResults];
+    }
+}
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/tests/Regress141809.h b/API/tests/Regress141809.h
new file mode 100644
index 0000000..43b099c
--- /dev/null
+++ b/API/tests/Regress141809.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <Foundation/Foundation.h>
+#import <JavaScriptCore/JavaScriptCore.h>
+
+#if JSC_OBJC_API_ENABLED
+
+void runRegress141809();
+
+#endif // JSC_OBJC_API_ENABLED
+
diff --git a/API/tests/Regress141809.mm b/API/tests/Regress141809.mm
new file mode 100644
index 0000000..16fd373
--- /dev/null
+++ b/API/tests/Regress141809.mm
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "Regress141809.h"
+
+#import <objc/objc.h>
+#import <objc/runtime.h>
+
+#if JSC_OBJC_API_ENABLED
+
+extern "C" void checkResult(NSString *description, bool passed);
+extern "C" void JSSynchronousGarbageCollectForDebugging(JSContextRef);
+
+@protocol TestClassAExports <JSExport>
+@end
+
+@interface TestClassA : NSObject<TestClassAExports>
+@end
+
+@implementation TestClassA
+@end
+
+@protocol TestClassBExports <JSExport>
+- (NSString *)name;
+@end
+
+@interface TestClassB : TestClassA <TestClassBExports>
+@end
+
+@implementation TestClassB
+- (NSString *)name
+{
+    return @"B";
+}
+@end
+
+@protocol TestClassCExports <JSExport>
+- (NSString *)name;
+@end
+
+@interface TestClassC : TestClassB <TestClassCExports>
+@end
+
+@implementation TestClassC
+- (NSString *)name
+{
+    return @"C";
+}
+@end
+
+void runRegress141809()
+{
+    // Test that the ObjC API can correctly re-construct the synthesized
+    // prototype and constructor of JS exported ObjC classes.
+    // See <https://webkit.org/b/141809>
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"print"] = ^(NSString* str) {
+            NSLog(@"%@", str);
+        };
+        
+        [context evaluateScript:@"function dumpPrototypes(obj) { \
+            var objDepth = 0; \
+            var currObj = obj; \
+            var objChain = ''; \
+            do { \
+                var propIndex = 0; \
+                var props = ''; \
+                Object.getOwnPropertyNames(currObj).forEach(function(val, idx, array) { \
+                    props += ((propIndex > 0 ? ', ' : '') + val); \
+                    propIndex++; \
+                }); \
+                var str = ''; \
+                if (!objDepth) \
+                    str += 'obj '; \
+                else { \
+                    for (i = 0; i < objDepth; i++) \
+                        str += ' '; \
+                    str += '--> proto '; \
+                } \
+                str += currObj; \
+                if (props) \
+                    str += (' with ' + propIndex + ' props: ' + props); \
+                print(str); \
+                objChain += (str + '\\n'); \
+                objDepth++; \
+                currObj = Object.getPrototypeOf(currObj); \
+            } while (currObj); \
+            return { objDepth: objDepth, objChain: objChain }; \
+        }"];
+        JSValue* dumpPrototypes = context[@"dumpPrototypes"];
+        
+        JSValue* resultBeforeGC = nil;
+        @autoreleasepool {
+            TestClassC* obj = [[TestClassC alloc] init];
+            resultBeforeGC = [dumpPrototypes callWithArguments:@[obj]];
+        }
+        
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+        
+        @autoreleasepool {
+            TestClassC* obj = [[TestClassC alloc] init];
+            JSValue* resultAfterGC = [dumpPrototypes callWithArguments:@[obj]];
+            checkResult(@"object and prototype chain depth is 5 deep", [resultAfterGC[@"objDepth"] toInt32] == 5);
+            checkResult(@"object and prototype chain depth before and after GC matches", [resultAfterGC[@"objDepth"] toInt32] == [resultBeforeGC[@"objDepth"] toInt32]);
+            checkResult(@"object and prototype chain before and after GC matches", [[resultAfterGC[@"objChain"] toString] isEqualToString:[resultBeforeGC[@"objChain"] toString]]);
+        }
+    }
+}
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/API/tests/TypedArrayCTest.cpp b/API/tests/TypedArrayCTest.cpp
new file mode 100644
index 0000000..8ec8cdd
--- /dev/null
+++ b/API/tests/TypedArrayCTest.cpp
@@ -0,0 +1,268 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TypedArrayCTest.h"
+
+#include "JavaScriptCore.h"
+#include <wtf/Assertions.h>
+
+extern "C" void JSSynchronousGarbageCollectForDebugging(JSContextRef);
+
+static void id(void*, void*) { }
+static void freePtr(void* ptr, void*)
+{
+    free(ptr);
+}
+
+static const unsigned numLengths = 3;
+
+static const unsigned lengths[numLengths] =
+{
+    0,
+    1,
+    10,
+};
+
+static const unsigned byteSizes[kJSTypedArrayTypeArrayBuffer] =
+{
+    1, // kJSTypedArrayTypeInt8Array
+    2, // kJSTypedArrayTypeInt16Array
+    4, // kJSTypedArrayTypeInt32Array
+    1, // kJSTypedArrayTypeUint8Array
+    1, // kJSTypedArrayTypeUint8ClampedArray
+    2, // kJSTypedArrayTypeUint16Array
+    4, // kJSTypedArrayTypeUint32Array
+    4, // kJSTypedArrayTypeFloat32Array
+    8, // kJSTypedArrayTypeFloat64Array
+};
+
+static const char* typeToString[kJSTypedArrayTypeArrayBuffer] =
+{
+    "kJSTypedArrayTypeInt8Array",
+    "kJSTypedArrayTypeInt16Array",
+    "kJSTypedArrayTypeInt32Array",
+    "kJSTypedArrayTypeUint8Array",
+    "kJSTypedArrayTypeUint8ClampedArray",
+    "kJSTypedArrayTypeUint16Array",
+    "kJSTypedArrayTypeUint32Array",
+    "kJSTypedArrayTypeFloat32Array",
+    "kJSTypedArrayTypeFloat64Array",
+};
+
+inline int unexpectedException(const char* name)
+{
+    fprintf(stderr, "%s FAILED: unexpected exception\n", name);
+    return 1;
+}
+
+static int assertEqualsAsNumber(JSGlobalContextRef context, JSValueRef value, double expectedValue)
+{
+    double number = JSValueToNumber(context, value, nullptr);
+    if (number != expectedValue && !(isnan(number) && isnan(expectedValue))) {
+        fprintf(stderr, "assertEqualsAsNumber FAILED: %p, %lf\n", value, expectedValue);
+        return 1;
+    }
+    return 0;
+}
+
+static int testAccess(JSGlobalContextRef context, JSObjectRef typedArray, JSTypedArrayType type, unsigned elementLength, void* expectedPtr = nullptr, JSObjectRef expectedBuffer = nullptr, unsigned expectedOffset = 0)
+{
+    JSValueRef exception = nullptr;
+    // Test typedArray basic functions.
+    JSTypedArrayType actualType = JSValueGetTypedArrayType(context, typedArray, &exception);
+    if (type != actualType || exception) {
+        fprintf(stderr, "TypedArray type FAILED: %p, got: %s, expected: %s\n", typedArray, typeToString[actualType], typeToString[type]);
+        return 1;
+    }
+
+    unsigned length = JSObjectGetTypedArrayLength(context, typedArray, &exception);
+    if (elementLength != length || exception) {
+        fprintf(stderr, "TypedArray length FAILED: %p (%s), got: %d, expected: %d\n", typedArray, typeToString[type], length, elementLength);
+        return 1;
+    }
+
+    unsigned byteLength = JSObjectGetTypedArrayByteLength(context, typedArray, &exception);
+    unsigned expectedLength = byteSizes[type] * elementLength;
+    if (byteLength != expectedLength || exception) {
+        fprintf(stderr, "TypedArray byteLength FAILED: %p (%s), got: %d, expected: %d\n", typedArray, typeToString[type], byteLength, expectedLength);
+        return 1;
+    }
+
+    unsigned offset = JSObjectGetTypedArrayByteOffset(context, typedArray, &exception);
+    if (expectedOffset != offset || exception) {
+        fprintf(stderr, "TypedArray byteOffset FAILED: %p (%s), got: %d, expected: %d\n", typedArray, typeToString[type], offset, expectedOffset);
+        return 1;
+    }
+
+    void* ptr = JSObjectGetTypedArrayBytesPtr(context, typedArray, &exception);
+    if (exception)
+        return unexpectedException("TypedArray get bytes ptr");
+
+    JSObjectRef buffer = JSObjectGetTypedArrayBuffer(context, typedArray, &exception);
+    if (exception)
+        return unexpectedException("TypedArray get buffer");
+
+    void* bufferPtr = JSObjectGetArrayBufferBytesPtr(context, buffer, &exception);
+    if (exception)
+        return unexpectedException("ArrayBuffer get bytes ptr");
+
+    if (bufferPtr != ptr) {
+        fprintf(stderr, "FAIL: TypedArray bytes ptr and ArrayBuffer byte ptr were not the same: %p (%s) TypedArray: %p, ArrayBuffer: %p\n", typedArray, typeToString[type], ptr, bufferPtr);
+        return 1;
+    }
+
+    if (expectedPtr && ptr != expectedPtr) {
+        fprintf(stderr, "FAIL: TypedArray bytes ptr and the ptr used to construct the array were not the same: %p (%s) TypedArray: %p, bytes ptr: %p\n", typedArray, typeToString[type], ptr, expectedPtr);
+        return 1;
+    }
+
+    if (expectedBuffer && expectedBuffer != buffer) {
+        fprintf(stderr, "FAIL: TypedArray buffer and the ArrayBuffer buffer used to construct the array were not the same: %p (%s) TypedArray buffer: %p, data: %p\n", typedArray, typeToString[type], buffer, expectedBuffer);
+        return 1;
+    }
+
+    return 0;
+}
+
+static int testConstructors(JSGlobalContextRef context, JSTypedArrayType type, unsigned length)
+{
+    int failed = 0;
+    JSValueRef exception = nullptr;
+    JSObjectRef typedArray;
+
+    // Test create with length.
+    typedArray = JSObjectMakeTypedArray(context, type, length, &exception);
+    failed = failed || exception || testAccess(context, typedArray, type, length);
+
+    void* ptr = calloc(length, byteSizes[type]); // This is to be freed by data
+    JSObjectRef data = JSObjectMakeArrayBufferWithBytesNoCopy(context, ptr, length * byteSizes[type], freePtr, nullptr, &exception);
+    failed = failed || exception;
+
+    // Test create with existing ptr.
+    typedArray = JSObjectMakeTypedArrayWithBytesNoCopy(context, type, ptr, length * byteSizes[type], id, nullptr, &exception);
+    failed = failed || exception || testAccess(context, typedArray, type, length, ptr);
+
+    // Test create with existing ArrayBuffer.
+    typedArray = JSObjectMakeTypedArrayWithArrayBuffer(context, type, data, &exception);
+    failed = failed || exception || testAccess(context, typedArray, type, length, ptr, data);
+
+    // Test create with existing ArrayBuffer and offset.
+    typedArray = JSObjectMakeTypedArrayWithArrayBufferAndOffset(context, type, data, 0, length, &exception);
+    failed = failed || exception || testAccess(context, typedArray, type, length, ptr, data);
+
+    typedArray = JSObjectMakeTypedArrayWithArrayBufferAndOffset(context, type, data, byteSizes[type], length-1, &exception);
+    if (!length)
+        failed = failed || !exception;
+    else
+        failed = failed || testAccess(context, typedArray, type, length-1, ptr, data, byteSizes[type]) || exception;
+
+    exception = nullptr;
+    typedArray = JSObjectMakeTypedArrayWithArrayBufferAndOffset(context, type, data, byteSizes[type], 3, &exception);
+    if (length < 2)
+        failed = failed || !exception;
+    else
+        failed = failed || testAccess(context, typedArray, type, 3, ptr, data, byteSizes[type]) || exception;
+
+    if (byteSizes[type] > 1) {
+        exception = nullptr;
+        typedArray = JSObjectMakeTypedArrayWithArrayBufferAndOffset(context, type, data, 1, length-1, &exception);
+        failed = failed || !exception;
+    }
+
+    typedArray = JSObjectMakeTypedArrayWithArrayBufferAndOffset(context, type, data, byteSizes[type], length, &exception);
+    failed = failed || !exception;
+
+    exception = nullptr;
+    typedArray = JSObjectMakeTypedArrayWithArrayBufferAndOffset(context, type, data, byteSizes[type], 0, &exception);
+    if (!length)
+        failed = failed || !exception;
+    else
+        failed = failed || testAccess(context, typedArray, type, 0, ptr, data, byteSizes[type]) || exception;
+
+    return failed;
+}
+
+template <typename Functor>
+static int forEachTypedArrayType(const Functor& functor)
+{
+    int failed = 0;
+    for (unsigned i = 0; i < kJSTypedArrayTypeArrayBuffer; i++)
+        failed = failed || functor(static_cast<JSTypedArrayType>(i));
+    return failed;
+}
+
+int testTypedArrayCAPI()
+{
+    int failed = 0;
+    JSGlobalContextRef context = JSGlobalContextCreate(nullptr);
+
+    failed = failed || forEachTypedArrayType([&](JSTypedArrayType type) {
+        int failed = 0;
+        for (unsigned i = 0; i < numLengths; i++)
+            failed = failed || testConstructors(context, type, lengths[i]);
+        return failed;
+    });
+
+    // Test making a typedArray from scratch length.
+    volatile JSObjectRef typedArray = JSObjectMakeTypedArray(context, kJSTypedArrayTypeUint32Array, 10, nullptr);
+    JSObjectRef data = JSObjectGetTypedArrayBuffer(context, typedArray, nullptr);
+    unsigned* buffer = static_cast<unsigned*>(JSObjectGetArrayBufferBytesPtr(context, data, nullptr));
+
+    ASSERT(JSObjectGetTypedArrayLength(context, typedArray, nullptr) == 10);
+
+    // Test buffer is connected to typedArray.
+    buffer[1] = 1;
+    JSValueRef v = JSObjectGetPropertyAtIndex(context, typedArray, 1, nullptr);
+    failed = failed || assertEqualsAsNumber(context, v, 1);
+
+    // Test passing a buffer from a new array to an old array
+    typedArray = JSObjectMakeTypedArrayWithBytesNoCopy(context, kJSTypedArrayTypeUint32Array, buffer, 40, id, nullptr, nullptr);
+    buffer = static_cast<unsigned*>(JSObjectGetTypedArrayBytesPtr(context, typedArray, nullptr));
+    ASSERT(buffer[1] == 1);
+    buffer[1] = 20;
+    ASSERT(((unsigned*)JSObjectGetArrayBufferBytesPtr(context, data, nullptr))[1] == 20);
+
+    // Test constructing with data and the data returned are the same even with an offset.
+    typedArray = JSObjectMakeTypedArrayWithArrayBufferAndOffset(context, kJSTypedArrayTypeUint32Array, data, 4, 9, nullptr);
+    failed = failed || assertEqualsAsNumber(context, JSObjectGetPropertyAtIndex(context, typedArray, 0, nullptr), 20);
+    ASSERT(data == JSObjectGetTypedArrayBuffer(context, typedArray, nullptr));
+
+    // Test attempting to allocate an array too big for memory.
+    forEachTypedArrayType([&](JSTypedArrayType type) {
+        JSValueRef exception = nullptr;
+        JSObjectMakeTypedArray(context, type, UINT_MAX, &exception);
+        return !exception;
+    });
+
+    JSGlobalContextRelease(context);
+
+    if (!failed)
+        printf("PASS: Typed Array C API Tests.\n");
+    else
+        printf("FAIL: Some Typed Array C API Tests failed.\n");
+
+    return failed;
+}
diff --git a/API/tests/TypedArrayCTest.h b/API/tests/TypedArrayCTest.h
new file mode 100644
index 0000000..dc66881
--- /dev/null
+++ b/API/tests/TypedArrayCTest.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int testTypedArrayCAPI(void);
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
diff --git a/API/tests/minidom.c b/API/tests/minidom.c
new file mode 100644
index 0000000..02b41a9
--- /dev/null
+++ b/API/tests/minidom.c
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include <wtf/Platform.h>
+
+#include "JSContextRef.h"
+#include "JSNode.h"
+#include "JSObjectRef.h"
+#include "JSStringRef.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <wtf/Assertions.h>
+
+static char* createStringWithContentsOfFile(const char* fileName);
+static JSValueRef print(JSContextRef context, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception);
+
+int main(int argc, char* argv[])
+{
+    const char *scriptPath = "minidom.js";
+    if (argc > 1) {
+        scriptPath = argv[1];
+    }
+    
+    JSGlobalContextRef context = JSGlobalContextCreateInGroup(NULL, NULL);
+    JSObjectRef globalObject = JSContextGetGlobalObject(context);
+    
+    JSStringRef printIString = JSStringCreateWithUTF8CString("print");
+    JSObjectSetProperty(context, globalObject, printIString, JSObjectMakeFunctionWithCallback(context, printIString, print), kJSPropertyAttributeNone, NULL);
+    JSStringRelease(printIString);
+    
+    JSStringRef node = JSStringCreateWithUTF8CString("Node");
+    JSObjectSetProperty(context, globalObject, node, JSObjectMakeConstructor(context, JSNode_class(context), JSNode_construct), kJSPropertyAttributeNone, NULL);
+    JSStringRelease(node);
+    
+    char* scriptUTF8 = createStringWithContentsOfFile(scriptPath);
+    JSStringRef script = JSStringCreateWithUTF8CString(scriptUTF8);
+    JSValueRef exception;
+    JSValueRef result = JSEvaluateScript(context, script, NULL, NULL, 1, &exception);
+    if (result)
+        printf("PASS: Test script executed successfully.\n");
+    else {
+        printf("FAIL: Test script threw exception:\n");
+        JSStringRef exceptionIString = JSValueToStringCopy(context, exception, NULL);
+        size_t exceptionUTF8Size = JSStringGetMaximumUTF8CStringSize(exceptionIString);
+        char* exceptionUTF8 = (char*)malloc(exceptionUTF8Size);
+        JSStringGetUTF8CString(exceptionIString, exceptionUTF8, exceptionUTF8Size);
+        printf("%s\n", exceptionUTF8);
+        free(exceptionUTF8);
+        JSStringRelease(exceptionIString);
+    }
+    JSStringRelease(script);
+    free(scriptUTF8);
+
+    globalObject = 0;
+    JSGlobalContextRelease(context);
+    printf("PASS: Program exited normally.\n");
+    return 0;
+}
+
+static JSValueRef print(JSContextRef context, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(thisObject);
+
+    if (argumentCount > 0) {
+        JSStringRef string = JSValueToStringCopy(context, arguments[0], exception);
+        size_t numChars = JSStringGetMaximumUTF8CStringSize(string);
+        char stringUTF8[numChars];
+        JSStringGetUTF8CString(string, stringUTF8, numChars);
+        printf("%s\n", stringUTF8);
+    }
+    
+    return JSValueMakeUndefined(context);
+}
+
+static char* createStringWithContentsOfFile(const char* fileName)
+{
+    char* buffer;
+    
+    size_t buffer_size = 0;
+    size_t buffer_capacity = 1024;
+    buffer = (char*)malloc(buffer_capacity);
+    
+    FILE* f = fopen(fileName, "r");
+    if (!f) {
+        fprintf(stderr, "Could not open file: %s\n", fileName);
+        free(buffer);
+        return 0;
+    }
+    
+    while (!feof(f) && !ferror(f)) {
+        buffer_size += fread(buffer + buffer_size, 1, buffer_capacity - buffer_size, f);
+        if (buffer_size == buffer_capacity) { /* guarantees space for trailing '\0' */
+            buffer_capacity *= 2;
+            buffer = (char*)realloc(buffer, buffer_capacity);
+            ASSERT(buffer);
+        }
+        
+        ASSERT(buffer_size < buffer_capacity);
+    }
+    fclose(f);
+    buffer[buffer_size] = '\0';
+    
+    return buffer;
+}
diff --git a/API/tests/minidom.html b/API/tests/minidom.html
new file mode 100644
index 0000000..7ea4747
--- /dev/null
+++ b/API/tests/minidom.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<script src="minidom.js"></script>
+</head>
+
+<body onload="test()">
+    <pre id='pre'></pre>
+</body>
+</html>
diff --git a/API/tests/minidom.js b/API/tests/minidom.js
new file mode 100644
index 0000000..85134d7
--- /dev/null
+++ b/API/tests/minidom.js
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+function shouldBe(a, b)
+{
+    var evalA;
+    try {
+        evalA = eval(a);
+    } catch(e) {
+        evalA = e;
+    }
+    
+    if (evalA == b || isNaN(evalA) && typeof evalA == 'number' && isNaN(b) && typeof b == 'number')
+        print("PASS: " + a + " should be " + b + " and is.", "green");
+    else
+        print("__FAIL__: " + a + " should be " + b + " but instead is " + evalA + ".", "red");
+}
+
+function test()
+{
+    print("Node is " + Node);
+    for (var p in Node)
+        print(p + ": " + Node[p]);
+    
+    node = new Node();
+    print("node is " + node);
+    for (var p in node)
+        print(p + ": " + node[p]);
+
+    child1 = new Node();
+    child2 = new Node();
+    child3 = new Node();
+    
+    node.appendChild(child1);
+    node.appendChild(child2);
+
+    var childNodes = node.childNodes;
+    
+    for (var i = 0; i < childNodes.length + 1; i++) {
+        print("item " + i + ": " + childNodes.item(i));
+    }
+    
+    for (var i = 0; i < childNodes.length + 1; i++) {
+        print(i + ": " + childNodes[i]);
+    }
+
+    node.removeChild(child1);
+    node.replaceChild(child3, child2);
+    
+    for (var i = 0; i < childNodes.length + 1; i++) {
+        print("item " + i + ": " + childNodes.item(i));
+    }
+
+    for (var i = 0; i < childNodes.length + 1; i++) {
+        print(i + ": " + childNodes[i]);
+    }
+
+    try {
+        node.appendChild(null);
+    } catch(e) {
+        print("caught: " + e);
+    }
+    
+    try {
+        var o = new Object();
+        o.appendChild = node.appendChild;
+        o.appendChild(node);
+    } catch(e) {
+        print("caught: " + e);
+    }
+    
+    try {
+        node.appendChild();
+    } catch(e) {
+        print("caught: " + e);
+    }
+    
+    oldNodeType = node.nodeType;
+    node.nodeType = 1;
+    shouldBe("node.nodeType", oldNodeType);
+    
+    shouldBe("node instanceof Node", true);
+    shouldBe("new Object() instanceof Node", false);
+    
+    print(Node);
+}
+
+test();
diff --git a/API/tests/testapi-function-overrides.js b/API/tests/testapi-function-overrides.js
new file mode 100644
index 0000000..363cced
--- /dev/null
+++ b/API/tests/testapi-function-overrides.js
@@ -0,0 +1,16 @@
+// testapi function overrides for testing.
+override %%%{ /* Original f1 */ }%%%
+with %%%{ /* Overridden f1 */ }%%%
+
+override #$%{
+    // Original f2
+}#$%
+with $$${ /* Overridden f2 */ }$$$
+
+override %%%{ /* Original f3 */ }%%%
+with %%%{ /* Overridden f3 */ }%%%
+
+override %%%{
+/* Original f4 */
+}%%%
+with %%%{ /* Overridden f4 */ }%%%
diff --git a/API/tests/testapi.c b/API/tests/testapi.c
new file mode 100644
index 0000000..b6c2451
--- /dev/null
+++ b/API/tests/testapi.c
@@ -0,0 +1,1989 @@
+/*
+ * Copyright (C) 2006, 2015-2016 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <wtf/Platform.h>
+
+#include "JavaScriptCore.h"
+#include "JSBasePrivate.h"
+#include "JSContextRefPrivate.h"
+#include "JSObjectRefPrivate.h"
+#include "JSScriptRefPrivate.h"
+#include "JSStringRefPrivate.h"
+#include <math.h>
+#define ASSERT_DISABLED 0
+#include <wtf/Assertions.h>
+
+#if OS(WINDOWS)
+#include <windows.h>
+#endif
+
+#include "CompareAndSwapTest.h"
+#include "CustomGlobalObjectClassTest.h"
+#include "ExecutionTimeLimitTest.h"
+#include "FunctionOverridesTest.h"
+#include "GlobalContextWithFinalizerTest.h"
+#include "JSONParseTest.h"
+#include "PingPongStackOverflowTest.h"
+#include "TypedArrayCTest.h"
+
+#if JSC_OBJC_API_ENABLED
+void testObjectiveCAPI(void);
+#endif
+
+bool assertTrue(bool value, const char* message);
+
+static JSGlobalContextRef context;
+int failed;
+static void assertEqualsAsBoolean(JSValueRef value, bool expectedValue)
+{
+    if (JSValueToBoolean(context, value) != expectedValue) {
+        fprintf(stderr, "assertEqualsAsBoolean failed: %p, %d\n", value, expectedValue);
+        failed = 1;
+    }
+}
+
+static void assertEqualsAsNumber(JSValueRef value, double expectedValue)
+{
+    double number = JSValueToNumber(context, value, NULL);
+
+    // FIXME <rdar://4668451> - On i386 the isnan(double) macro tries to map to the isnan(float) function,
+    // causing a build break with -Wshorten-64-to-32 enabled.  The issue is known by the appropriate team.
+    // After that's resolved, we can remove these casts
+    if (number != expectedValue && !(isnan((float)number) && isnan((float)expectedValue))) {
+        fprintf(stderr, "assertEqualsAsNumber failed: %p, %lf\n", value, expectedValue);
+        failed = 1;
+    }
+}
+
+static void assertEqualsAsUTF8String(JSValueRef value, const char* expectedValue)
+{
+    JSStringRef valueAsString = JSValueToStringCopy(context, value, NULL);
+
+    size_t jsSize = JSStringGetMaximumUTF8CStringSize(valueAsString);
+    char* jsBuffer = (char*)malloc(jsSize);
+    JSStringGetUTF8CString(valueAsString, jsBuffer, jsSize);
+
+    unsigned i;
+    for (i = 0; jsBuffer[i]; i++) {
+        if (jsBuffer[i] != expectedValue[i]) {
+            fprintf(stderr, "assertEqualsAsUTF8String failed at character %d: %c(%d) != %c(%d)\n", i, jsBuffer[i], jsBuffer[i], expectedValue[i], expectedValue[i]);
+            fprintf(stderr, "value: %s\n", jsBuffer);
+            fprintf(stderr, "expectedValue: %s\n", expectedValue);
+            failed = 1;
+        }
+    }
+
+    if (jsSize < strlen(jsBuffer) + 1) {
+        fprintf(stderr, "assertEqualsAsUTF8String failed: jsSize was too small\n");
+        failed = 1;
+    }
+
+    free(jsBuffer);
+    JSStringRelease(valueAsString);
+}
+
+static void assertEqualsAsCharactersPtr(JSValueRef value, const char* expectedValue)
+{
+    JSStringRef valueAsString = JSValueToStringCopy(context, value, NULL);
+
+    size_t jsLength = JSStringGetLength(valueAsString);
+    const JSChar* jsBuffer = JSStringGetCharactersPtr(valueAsString);
+
+    CFStringRef expectedValueAsCFString = CFStringCreateWithCString(kCFAllocatorDefault, 
+                                                                    expectedValue,
+                                                                    kCFStringEncodingUTF8);    
+    CFIndex cfLength = CFStringGetLength(expectedValueAsCFString);
+    UniChar* cfBuffer = (UniChar*)malloc(cfLength * sizeof(UniChar));
+    CFStringGetCharacters(expectedValueAsCFString, CFRangeMake(0, cfLength), cfBuffer);
+    CFRelease(expectedValueAsCFString);
+
+    if (memcmp(jsBuffer, cfBuffer, cfLength * sizeof(UniChar)) != 0) {
+        fprintf(stderr, "assertEqualsAsCharactersPtr failed: jsBuffer != cfBuffer\n");
+        failed = 1;
+    }
+    
+    if (jsLength != (size_t)cfLength) {
+#if OS(WINDOWS)
+        fprintf(stderr, "assertEqualsAsCharactersPtr failed: jsLength(%Iu) != cfLength(%Iu)\n", jsLength, (size_t)cfLength);
+#else
+        fprintf(stderr, "assertEqualsAsCharactersPtr failed: jsLength(%zu) != cfLength(%zu)\n", jsLength, (size_t)cfLength);
+#endif
+        failed = 1;
+    }
+
+    free(cfBuffer);
+    JSStringRelease(valueAsString);
+}
+
+static bool timeZoneIsPST()
+{
+    char timeZoneName[70];
+    struct tm gtm;
+    memset(&gtm, 0, sizeof(gtm));
+    strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+
+    return 0 == strcmp("PST", timeZoneName);
+}
+
+static JSValueRef jsGlobalValue; // non-stack value for testing JSValueProtect()
+
+/* MyObject pseudo-class */
+
+static bool MyObject_hasProperty(JSContextRef context, JSObjectRef object, JSStringRef propertyName)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "alwaysOne")
+        || JSStringIsEqualToUTF8CString(propertyName, "cantFind")
+        || JSStringIsEqualToUTF8CString(propertyName, "throwOnGet")
+        || JSStringIsEqualToUTF8CString(propertyName, "myPropertyName")
+        || JSStringIsEqualToUTF8CString(propertyName, "hasPropertyLie")
+        || JSStringIsEqualToUTF8CString(propertyName, "0")) {
+        return true;
+    }
+    
+    return false;
+}
+
+static JSValueRef MyObject_getProperty(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+    
+    if (JSStringIsEqualToUTF8CString(propertyName, "alwaysOne")) {
+        return JSValueMakeNumber(context, 1);
+    }
+    
+    if (JSStringIsEqualToUTF8CString(propertyName, "myPropertyName")) {
+        return JSValueMakeNumber(context, 1);
+    }
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "cantFind")) {
+        return JSValueMakeUndefined(context);
+    }
+    
+    if (JSStringIsEqualToUTF8CString(propertyName, "hasPropertyLie")) {
+        return 0;
+    }
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "throwOnGet")) {
+        return JSEvaluateScript(context, JSStringCreateWithUTF8CString("throw 'an exception'"), object, JSStringCreateWithUTF8CString("test script"), 1, exception);
+    }
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "0")) {
+        *exception = JSValueMakeNumber(context, 1);
+        return JSValueMakeNumber(context, 1);
+    }
+    
+    return JSValueMakeNull(context);
+}
+
+static bool MyObject_setProperty(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(value);
+    UNUSED_PARAM(exception);
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "cantSet"))
+        return true; // pretend we set the property in order to swallow it
+    
+    if (JSStringIsEqualToUTF8CString(propertyName, "throwOnSet")) {
+        JSEvaluateScript(context, JSStringCreateWithUTF8CString("throw 'an exception'"), object, JSStringCreateWithUTF8CString("test script"), 1, exception);
+    }
+    
+    return false;
+}
+
+static bool MyObject_deleteProperty(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+    
+    if (JSStringIsEqualToUTF8CString(propertyName, "cantDelete"))
+        return true;
+    
+    if (JSStringIsEqualToUTF8CString(propertyName, "throwOnDelete")) {
+        JSEvaluateScript(context, JSStringCreateWithUTF8CString("throw 'an exception'"), object, JSStringCreateWithUTF8CString("test script"), 1, exception);
+        return false;
+    }
+
+    return false;
+}
+
+static void MyObject_getPropertyNames(JSContextRef context, JSObjectRef object, JSPropertyNameAccumulatorRef propertyNames)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+    
+    JSStringRef propertyName;
+    
+    propertyName = JSStringCreateWithUTF8CString("alwaysOne");
+    JSPropertyNameAccumulatorAddName(propertyNames, propertyName);
+    JSStringRelease(propertyName);
+    
+    propertyName = JSStringCreateWithUTF8CString("myPropertyName");
+    JSPropertyNameAccumulatorAddName(propertyNames, propertyName);
+    JSStringRelease(propertyName);
+}
+
+static JSValueRef MyObject_callAsFunction(JSContextRef context, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(exception);
+
+    if (argumentCount > 0 && JSValueIsString(context, arguments[0]) && JSStringIsEqualToUTF8CString(JSValueToStringCopy(context, arguments[0], 0), "throwOnCall")) {
+        JSEvaluateScript(context, JSStringCreateWithUTF8CString("throw 'an exception'"), object, JSStringCreateWithUTF8CString("test script"), 1, exception);
+        return JSValueMakeUndefined(context);
+    }
+
+    if (argumentCount > 0 && JSValueIsStrictEqual(context, arguments[0], JSValueMakeNumber(context, 0)))
+        return JSValueMakeNumber(context, 1);
+    
+    return JSValueMakeUndefined(context);
+}
+
+static JSObjectRef MyObject_callAsConstructor(JSContextRef context, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+
+    if (argumentCount > 0 && JSValueIsString(context, arguments[0]) && JSStringIsEqualToUTF8CString(JSValueToStringCopy(context, arguments[0], 0), "throwOnConstruct")) {
+        JSEvaluateScript(context, JSStringCreateWithUTF8CString("throw 'an exception'"), object, JSStringCreateWithUTF8CString("test script"), 1, exception);
+        return object;
+    }
+
+    if (argumentCount > 0 && JSValueIsStrictEqual(context, arguments[0], JSValueMakeNumber(context, 0)))
+        return JSValueToObject(context, JSValueMakeNumber(context, 1), exception);
+    
+    return JSValueToObject(context, JSValueMakeNumber(context, 0), exception);
+}
+
+static bool MyObject_hasInstance(JSContextRef context, JSObjectRef constructor, JSValueRef possibleValue, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(constructor);
+
+    if (JSValueIsString(context, possibleValue) && JSStringIsEqualToUTF8CString(JSValueToStringCopy(context, possibleValue, 0), "throwOnHasInstance")) {
+        JSEvaluateScript(context, JSStringCreateWithUTF8CString("throw 'an exception'"), constructor, JSStringCreateWithUTF8CString("test script"), 1, exception);
+        return false;
+    }
+
+    JSStringRef numberString = JSStringCreateWithUTF8CString("Number");
+    JSObjectRef numberConstructor = JSValueToObject(context, JSObjectGetProperty(context, JSContextGetGlobalObject(context), numberString, exception), exception);
+    JSStringRelease(numberString);
+
+    return JSValueIsInstanceOfConstructor(context, possibleValue, numberConstructor, exception);
+}
+
+static JSValueRef MyObject_convertToType(JSContextRef context, JSObjectRef object, JSType type, JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(exception);
+    
+    switch (type) {
+    case kJSTypeNumber:
+        return JSValueMakeNumber(context, 1);
+    case kJSTypeString:
+        {
+            JSStringRef string = JSStringCreateWithUTF8CString("MyObjectAsString");
+            JSValueRef result = JSValueMakeString(context, string);
+            JSStringRelease(string);
+            return result;
+        }
+    default:
+        break;
+    }
+
+    // string conversion -- forward to default object class
+    return JSValueMakeNull(context);
+}
+
+static JSValueRef MyObject_convertToTypeWrapper(JSContextRef context, JSObjectRef object, JSType type, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(type);
+    UNUSED_PARAM(exception);
+    // Forward to default object class
+    return 0;
+}
+
+static bool MyObject_set_nullGetForwardSet(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
+{
+    UNUSED_PARAM(ctx);
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(value);
+    UNUSED_PARAM(exception);
+    return false; // Forward to parent class.
+}
+
+static JSStaticValue evilStaticValues[] = {
+    { "nullGetSet", 0, 0, kJSPropertyAttributeNone },
+    { "nullGetForwardSet", 0, MyObject_set_nullGetForwardSet, kJSPropertyAttributeNone },
+    { 0, 0, 0, 0 }
+};
+
+static JSStaticFunction evilStaticFunctions[] = {
+    { "nullCall", 0, kJSPropertyAttributeNone },
+    { 0, 0, 0 }
+};
+
+JSClassDefinition MyObject_definition = {
+    0,
+    kJSClassAttributeNone,
+    
+    "MyObject",
+    NULL,
+    
+    evilStaticValues,
+    evilStaticFunctions,
+    
+    NULL,
+    NULL,
+    MyObject_hasProperty,
+    MyObject_getProperty,
+    MyObject_setProperty,
+    MyObject_deleteProperty,
+    MyObject_getPropertyNames,
+    MyObject_callAsFunction,
+    MyObject_callAsConstructor,
+    MyObject_hasInstance,
+    MyObject_convertToType,
+};
+
+JSClassDefinition MyObject_convertToTypeWrapperDefinition = {
+    0,
+    kJSClassAttributeNone,
+    
+    "MyObject",
+    NULL,
+    
+    NULL,
+    NULL,
+    
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    MyObject_convertToTypeWrapper,
+};
+
+JSClassDefinition MyObject_nullWrapperDefinition = {
+    0,
+    kJSClassAttributeNone,
+    
+    "MyObject",
+    NULL,
+    
+    NULL,
+    NULL,
+    
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+};
+
+static JSClassRef MyObject_class(JSContextRef context)
+{
+    UNUSED_PARAM(context);
+
+    static JSClassRef jsClass;
+    if (!jsClass) {
+        JSClassRef baseClass = JSClassCreate(&MyObject_definition);
+        MyObject_convertToTypeWrapperDefinition.parentClass = baseClass;
+        JSClassRef wrapperClass = JSClassCreate(&MyObject_convertToTypeWrapperDefinition);
+        MyObject_nullWrapperDefinition.parentClass = wrapperClass;
+        jsClass = JSClassCreate(&MyObject_nullWrapperDefinition);
+    }
+
+    return jsClass;
+}
+
+static JSValueRef PropertyCatchalls_getProperty(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(exception);
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "x")) {
+        static size_t count;
+        if (count++ < 5)
+            return NULL;
+
+        // Swallow all .x gets after 5, returning null.
+        return JSValueMakeNull(context);
+    }
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "y")) {
+        static size_t count;
+        if (count++ < 5)
+            return NULL;
+
+        // Swallow all .y gets after 5, returning null.
+        return JSValueMakeNull(context);
+    }
+    
+    if (JSStringIsEqualToUTF8CString(propertyName, "z")) {
+        static size_t count;
+        if (count++ < 5)
+            return NULL;
+
+        // Swallow all .y gets after 5, returning null.
+        return JSValueMakeNull(context);
+    }
+
+    return NULL;
+}
+
+static bool PropertyCatchalls_setProperty(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(value);
+    UNUSED_PARAM(exception);
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "x")) {
+        static size_t count;
+        if (count++ < 5)
+            return false;
+
+        // Swallow all .x sets after 4.
+        return true;
+    }
+
+    if (JSStringIsEqualToUTF8CString(propertyName, "make_throw") || JSStringIsEqualToUTF8CString(propertyName, "0")) {
+        *exception = JSValueMakeNumber(context, 5);
+        return true;
+    }
+
+    return false;
+}
+
+static void PropertyCatchalls_getPropertyNames(JSContextRef context, JSObjectRef object, JSPropertyNameAccumulatorRef propertyNames)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(object);
+
+    static size_t count;
+    static const char* numbers[] = { "0", "1", "2", "3", "4", "5", "6", "7", "8", "9" };
+    
+    // Provide a property of a different name every time.
+    JSStringRef propertyName = JSStringCreateWithUTF8CString(numbers[count++ % 10]);
+    JSPropertyNameAccumulatorAddName(propertyNames, propertyName);
+    JSStringRelease(propertyName);
+}
+
+JSClassDefinition PropertyCatchalls_definition = {
+    0,
+    kJSClassAttributeNone,
+    
+    "PropertyCatchalls",
+    NULL,
+    
+    NULL,
+    NULL,
+    
+    NULL,
+    NULL,
+    NULL,
+    PropertyCatchalls_getProperty,
+    PropertyCatchalls_setProperty,
+    NULL,
+    PropertyCatchalls_getPropertyNames,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+};
+
+static JSClassRef PropertyCatchalls_class(JSContextRef context)
+{
+    UNUSED_PARAM(context);
+
+    static JSClassRef jsClass;
+    if (!jsClass)
+        jsClass = JSClassCreate(&PropertyCatchalls_definition);
+    
+    return jsClass;
+}
+
+static bool EvilExceptionObject_hasInstance(JSContextRef context, JSObjectRef constructor, JSValueRef possibleValue, JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(constructor);
+    
+    JSStringRef hasInstanceName = JSStringCreateWithUTF8CString("hasInstance");
+    JSValueRef hasInstance = JSObjectGetProperty(context, constructor, hasInstanceName, exception);
+    JSStringRelease(hasInstanceName);
+    if (!hasInstance)
+        return false;
+    JSObjectRef function = JSValueToObject(context, hasInstance, exception);
+    JSValueRef result = JSObjectCallAsFunction(context, function, constructor, 1, &possibleValue, exception);
+    return result && JSValueToBoolean(context, result);
+}
+
+static JSValueRef EvilExceptionObject_convertToType(JSContextRef context, JSObjectRef object, JSType type, JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(exception);
+    JSStringRef funcName;
+    switch (type) {
+    case kJSTypeNumber:
+        funcName = JSStringCreateWithUTF8CString("toNumber");
+        break;
+    case kJSTypeString:
+        funcName = JSStringCreateWithUTF8CString("toStringExplicit");
+        break;
+    default:
+        return JSValueMakeNull(context);
+    }
+    
+    JSValueRef func = JSObjectGetProperty(context, object, funcName, exception);
+    JSStringRelease(funcName);    
+    JSObjectRef function = JSValueToObject(context, func, exception);
+    if (!function)
+        return JSValueMakeNull(context);
+    JSValueRef value = JSObjectCallAsFunction(context, function, object, 0, NULL, exception);
+    if (!value) {
+        JSStringRef errorString = JSStringCreateWithUTF8CString("convertToType failed"); 
+        JSValueRef errorStringRef = JSValueMakeString(context, errorString);
+        JSStringRelease(errorString);
+        return errorStringRef;
+    }
+    return value;
+}
+
+JSClassDefinition EvilExceptionObject_definition = {
+    0,
+    kJSClassAttributeNone,
+
+    "EvilExceptionObject",
+    NULL,
+
+    NULL,
+    NULL,
+
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    EvilExceptionObject_hasInstance,
+    EvilExceptionObject_convertToType,
+};
+
+static JSClassRef EvilExceptionObject_class(JSContextRef context)
+{
+    UNUSED_PARAM(context);
+    
+    static JSClassRef jsClass;
+    if (!jsClass)
+        jsClass = JSClassCreate(&EvilExceptionObject_definition);
+    
+    return jsClass;
+}
+
+JSClassDefinition EmptyObject_definition = {
+    0,
+    kJSClassAttributeNone,
+    
+    NULL,
+    NULL,
+    
+    NULL,
+    NULL,
+    
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+};
+
+static JSClassRef EmptyObject_class(JSContextRef context)
+{
+    UNUSED_PARAM(context);
+    
+    static JSClassRef jsClass;
+    if (!jsClass)
+        jsClass = JSClassCreate(&EmptyObject_definition);
+    
+    return jsClass;
+}
+
+
+static JSValueRef Base_get(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(exception);
+
+    return JSValueMakeNumber(ctx, 1); // distinguish base get form derived get
+}
+
+static bool Base_set(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(value);
+
+    *exception = JSValueMakeNumber(ctx, 1); // distinguish base set from derived set
+    return true;
+}
+
+static JSValueRef Base_callAsFunction(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+    
+    return JSValueMakeNumber(ctx, 1); // distinguish base call from derived call
+}
+
+static JSValueRef Base_returnHardNull(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(ctx);
+    UNUSED_PARAM(function);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+    
+    return 0; // should convert to undefined!
+}
+
+static JSStaticFunction Base_staticFunctions[] = {
+    { "baseProtoDup", NULL, kJSPropertyAttributeNone },
+    { "baseProto", Base_callAsFunction, kJSPropertyAttributeNone },
+    { "baseHardNull", Base_returnHardNull, kJSPropertyAttributeNone },
+    { 0, 0, 0 }
+};
+
+static JSStaticValue Base_staticValues[] = {
+    { "baseDup", Base_get, Base_set, kJSPropertyAttributeNone },
+    { "baseOnly", Base_get, Base_set, kJSPropertyAttributeNone },
+    { 0, 0, 0, 0 }
+};
+
+static bool TestInitializeFinalize;
+static void Base_initialize(JSContextRef context, JSObjectRef object)
+{
+    UNUSED_PARAM(context);
+
+    if (TestInitializeFinalize) {
+        ASSERT((void*)1 == JSObjectGetPrivate(object));
+        JSObjectSetPrivate(object, (void*)2);
+    }
+}
+
+static unsigned Base_didFinalize;
+static void Base_finalize(JSObjectRef object)
+{
+    UNUSED_PARAM(object);
+    if (TestInitializeFinalize) {
+        ASSERT((void*)4 == JSObjectGetPrivate(object));
+        Base_didFinalize = true;
+    }
+}
+
+static JSClassRef Base_class(JSContextRef context)
+{
+    UNUSED_PARAM(context);
+
+    static JSClassRef jsClass;
+    if (!jsClass) {
+        JSClassDefinition definition = kJSClassDefinitionEmpty;
+        definition.staticValues = Base_staticValues;
+        definition.staticFunctions = Base_staticFunctions;
+        definition.initialize = Base_initialize;
+        definition.finalize = Base_finalize;
+        jsClass = JSClassCreate(&definition);
+    }
+    return jsClass;
+}
+
+static JSValueRef Derived_get(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(exception);
+
+    return JSValueMakeNumber(ctx, 2); // distinguish base get form derived get
+}
+
+static bool Derived_set(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
+{
+    UNUSED_PARAM(ctx);
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(value);
+
+    *exception = JSValueMakeNumber(ctx, 2); // distinguish base set from derived set
+    return true;
+}
+
+static JSValueRef Derived_callAsFunction(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+    
+    return JSValueMakeNumber(ctx, 2); // distinguish base call from derived call
+}
+
+static JSStaticFunction Derived_staticFunctions[] = {
+    { "protoOnly", Derived_callAsFunction, kJSPropertyAttributeNone },
+    { "protoDup", NULL, kJSPropertyAttributeNone },
+    { "baseProtoDup", Derived_callAsFunction, kJSPropertyAttributeNone },
+    { 0, 0, 0 }
+};
+
+static JSStaticValue Derived_staticValues[] = {
+    { "derivedOnly", Derived_get, Derived_set, kJSPropertyAttributeNone },
+    { "protoDup", Derived_get, Derived_set, kJSPropertyAttributeNone },
+    { "baseDup", Derived_get, Derived_set, kJSPropertyAttributeNone },
+    { 0, 0, 0, 0 }
+};
+
+static void Derived_initialize(JSContextRef context, JSObjectRef object)
+{
+    UNUSED_PARAM(context);
+
+    if (TestInitializeFinalize) {
+        ASSERT((void*)2 == JSObjectGetPrivate(object));
+        JSObjectSetPrivate(object, (void*)3);
+    }
+}
+
+static void Derived_finalize(JSObjectRef object)
+{
+    if (TestInitializeFinalize) {
+        ASSERT((void*)3 == JSObjectGetPrivate(object));
+        JSObjectSetPrivate(object, (void*)4);
+    }
+}
+
+static JSClassRef Derived_class(JSContextRef context)
+{
+    static JSClassRef jsClass;
+    if (!jsClass) {
+        JSClassDefinition definition = kJSClassDefinitionEmpty;
+        definition.parentClass = Base_class(context);
+        definition.staticValues = Derived_staticValues;
+        definition.staticFunctions = Derived_staticFunctions;
+        definition.initialize = Derived_initialize;
+        definition.finalize = Derived_finalize;
+        jsClass = JSClassCreate(&definition);
+    }
+    return jsClass;
+}
+
+static JSClassRef Derived2_class(JSContextRef context)
+{
+    static JSClassRef jsClass;
+    if (!jsClass) {
+        JSClassDefinition definition = kJSClassDefinitionEmpty;
+        definition.parentClass = Derived_class(context);
+        jsClass = JSClassCreate(&definition);
+    }
+    return jsClass;
+}
+
+static JSValueRef print_callAsFunction(JSContextRef ctx, JSObjectRef functionObject, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(functionObject);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(exception);
+
+    ASSERT(JSContextGetGlobalContext(ctx) == context);
+    
+    if (argumentCount > 0) {
+        JSStringRef string = JSValueToStringCopy(ctx, arguments[0], NULL);
+        size_t sizeUTF8 = JSStringGetMaximumUTF8CStringSize(string);
+        char* stringUTF8 = (char*)malloc(sizeUTF8);
+        JSStringGetUTF8CString(string, stringUTF8, sizeUTF8);
+        printf("%s\n", stringUTF8);
+        free(stringUTF8);
+        JSStringRelease(string);
+    }
+    
+    return JSValueMakeUndefined(ctx);
+}
+
+static JSObjectRef myConstructor_callAsConstructor(JSContextRef context, JSObjectRef constructorObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(constructorObject);
+    UNUSED_PARAM(exception);
+    
+    JSObjectRef result = JSObjectMake(context, NULL, NULL);
+    if (argumentCount > 0) {
+        JSStringRef value = JSStringCreateWithUTF8CString("value");
+        JSObjectSetProperty(context, result, value, arguments[0], kJSPropertyAttributeNone, NULL);
+        JSStringRelease(value);
+    }
+    
+    return result;
+}
+
+static JSObjectRef myBadConstructor_callAsConstructor(JSContextRef context, JSObjectRef constructorObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(context);
+    UNUSED_PARAM(constructorObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+    
+    return 0;
+}
+
+
+static void globalObject_initialize(JSContextRef context, JSObjectRef object)
+{
+    UNUSED_PARAM(object);
+    // Ensure that an execution context is passed in
+    ASSERT(context);
+
+    JSObjectRef globalObject = JSContextGetGlobalObject(context);
+    ASSERT(globalObject);
+
+    // Ensure that the standard global properties have been set on the global object
+    JSStringRef array = JSStringCreateWithUTF8CString("Array");
+    JSObjectRef arrayConstructor = JSValueToObject(context, JSObjectGetProperty(context, globalObject, array, NULL), NULL);
+    JSStringRelease(array);
+
+    UNUSED_PARAM(arrayConstructor);
+    ASSERT(arrayConstructor);
+}
+
+static JSValueRef globalObject_get(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(exception);
+
+    return JSValueMakeNumber(ctx, 3);
+}
+
+static bool globalObject_set(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSValueRef* exception)
+{
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(propertyName);
+    UNUSED_PARAM(value);
+
+    *exception = JSValueMakeNumber(ctx, 3);
+    return true;
+}
+
+static JSValueRef globalObject_call(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+
+    return JSValueMakeNumber(ctx, 3);
+}
+
+static JSValueRef functionGC(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    UNUSED_PARAM(exception);
+    JSGarbageCollect(context);
+    return JSValueMakeUndefined(context);
+}
+
+static JSStaticValue globalObject_staticValues[] = {
+    { "globalStaticValue", globalObject_get, globalObject_set, kJSPropertyAttributeNone },
+    { 0, 0, 0, 0 }
+};
+
+static JSStaticFunction globalObject_staticFunctions[] = {
+    { "globalStaticFunction", globalObject_call, kJSPropertyAttributeNone },
+    { "globalStaticFunction2", globalObject_call, kJSPropertyAttributeNone },
+    { "gc", functionGC, kJSPropertyAttributeNone },
+    { 0, 0, 0 }
+};
+
+static char* createStringWithContentsOfFile(const char* fileName);
+
+static void testInitializeFinalize()
+{
+    JSObjectRef o = JSObjectMake(context, Derived_class(context), (void*)1);
+    UNUSED_PARAM(o);
+    ASSERT(JSObjectGetPrivate(o) == (void*)3);
+}
+
+static JSValueRef jsNumberValue =  NULL;
+
+static JSObjectRef aHeapRef = NULL;
+
+static void makeGlobalNumberValue(JSContextRef context) {
+    JSValueRef v = JSValueMakeNumber(context, 420);
+    JSValueProtect(context, v);
+    jsNumberValue = v;
+    v = NULL;
+}
+
+bool assertTrue(bool value, const char* message)
+{
+    if (!value) {
+        if (message)
+            fprintf(stderr, "assertTrue failed: '%s'\n", message);
+        else
+            fprintf(stderr, "assertTrue failed.\n");
+        failed = 1;
+    }
+    return value;
+}
+
+static bool checkForCycleInPrototypeChain()
+{
+    bool result = true;
+    JSGlobalContextRef context = JSGlobalContextCreate(0);
+    JSObjectRef object1 = JSObjectMake(context, /* jsClass */ 0, /* data */ 0);
+    JSObjectRef object2 = JSObjectMake(context, /* jsClass */ 0, /* data */ 0);
+    JSObjectRef object3 = JSObjectMake(context, /* jsClass */ 0, /* data */ 0);
+
+    JSObjectSetPrototype(context, object1, JSValueMakeNull(context));
+    ASSERT(JSValueIsNull(context, JSObjectGetPrototype(context, object1)));
+
+    // object1 -> object1
+    JSObjectSetPrototype(context, object1, object1);
+    result &= assertTrue(JSValueIsNull(context, JSObjectGetPrototype(context, object1)), "It is possible to assign self as a prototype");
+
+    // object1 -> object2 -> object1
+    JSObjectSetPrototype(context, object2, object1);
+    ASSERT(JSValueIsStrictEqual(context, JSObjectGetPrototype(context, object2), object1));
+    JSObjectSetPrototype(context, object1, object2);
+    result &= assertTrue(JSValueIsNull(context, JSObjectGetPrototype(context, object1)), "It is possible to close a prototype chain cycle");
+
+    // object1 -> object2 -> object3 -> object1
+    JSObjectSetPrototype(context, object2, object3);
+    ASSERT(JSValueIsStrictEqual(context, JSObjectGetPrototype(context, object2), object3));
+    JSObjectSetPrototype(context, object1, object2);
+    ASSERT(JSValueIsStrictEqual(context, JSObjectGetPrototype(context, object1), object2));
+    JSObjectSetPrototype(context, object3, object1);
+    result &= assertTrue(!JSValueIsStrictEqual(context, JSObjectGetPrototype(context, object3), object1), "It is possible to close a prototype chain cycle");
+
+    JSValueRef exception;
+    JSStringRef code = JSStringCreateWithUTF8CString("o = { }; p = { }; o.__proto__ = p; p.__proto__ = o");
+    JSStringRef file = JSStringCreateWithUTF8CString("");
+    result &= assertTrue(!JSEvaluateScript(context, code, /* thisObject*/ 0, file, 1, &exception)
+                         , "An exception should be thrown");
+
+    JSStringRelease(code);
+    JSStringRelease(file);
+    JSGlobalContextRelease(context);
+    return result;
+}
+
+static JSValueRef valueToObjectExceptionCallAsFunction(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    JSValueRef jsUndefined = JSValueMakeUndefined(JSContextGetGlobalContext(ctx));
+    JSValueToObject(JSContextGetGlobalContext(ctx), jsUndefined, exception);
+    
+    return JSValueMakeUndefined(ctx);
+}
+static bool valueToObjectExceptionTest()
+{
+    JSGlobalContextRef testContext;
+    JSClassDefinition globalObjectClassDefinition = kJSClassDefinitionEmpty;
+    globalObjectClassDefinition.initialize = globalObject_initialize;
+    globalObjectClassDefinition.staticValues = globalObject_staticValues;
+    globalObjectClassDefinition.staticFunctions = globalObject_staticFunctions;
+    globalObjectClassDefinition.attributes = kJSClassAttributeNoAutomaticPrototype;
+    JSClassRef globalObjectClass = JSClassCreate(&globalObjectClassDefinition);
+    testContext = JSGlobalContextCreateInGroup(NULL, globalObjectClass);
+    JSObjectRef globalObject = JSContextGetGlobalObject(testContext);
+
+    JSStringRef valueToObject = JSStringCreateWithUTF8CString("valueToObject");
+    JSObjectRef valueToObjectFunction = JSObjectMakeFunctionWithCallback(testContext, valueToObject, valueToObjectExceptionCallAsFunction);
+    JSObjectSetProperty(testContext, globalObject, valueToObject, valueToObjectFunction, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(valueToObject);
+
+    JSStringRef test = JSStringCreateWithUTF8CString("valueToObject();");
+    JSEvaluateScript(testContext, test, NULL, NULL, 1, NULL);
+    
+    JSStringRelease(test);
+    JSClassRelease(globalObjectClass);
+    JSGlobalContextRelease(testContext);
+    
+    return true;
+}
+
+static bool globalContextNameTest()
+{
+    bool result = true;
+    JSGlobalContextRef context = JSGlobalContextCreate(0);
+
+    JSStringRef str = JSGlobalContextCopyName(context);
+    result &= assertTrue(!str, "Default context name is NULL");
+
+    JSStringRef name1 = JSStringCreateWithUTF8CString("name1");
+    JSStringRef name2 = JSStringCreateWithUTF8CString("name2");
+
+    JSGlobalContextSetName(context, name1);
+    JSStringRef fetchName1 = JSGlobalContextCopyName(context);
+    JSGlobalContextSetName(context, name2);
+    JSStringRef fetchName2 = JSGlobalContextCopyName(context);
+    JSGlobalContextSetName(context, NULL);
+    JSStringRef fetchName3 = JSGlobalContextCopyName(context);
+
+    result &= assertTrue(JSStringIsEqual(name1, fetchName1), "Unexpected Context name");
+    result &= assertTrue(JSStringIsEqual(name2, fetchName2), "Unexpected Context name");
+    result &= assertTrue(!JSStringIsEqual(fetchName1, fetchName2), "Unexpected Context name");
+    result &= assertTrue(!fetchName3, "Unexpected Context name");
+
+    JSStringRelease(name1);
+    JSStringRelease(name2);
+    JSStringRelease(fetchName1);
+    JSStringRelease(fetchName2);
+
+    return result;
+}
+
+static void checkConstnessInJSObjectNames()
+{
+    JSStaticFunction fun;
+    fun.name = "something";
+    JSStaticValue val;
+    val.name = "something";
+}
+
+int main(int argc, char* argv[])
+{
+#if OS(WINDOWS)
+    // Cygwin calls ::SetErrorMode(SEM_FAILCRITICALERRORS), which we will inherit. This is bad for
+    // testing/debugging, as it causes the post-mortem debugger not to be invoked. We reset the
+    // error mode here to work around Cygwin's behavior. See <http://webkit.org/b/55222>.
+    ::SetErrorMode(0);
+#endif
+
+    testCompareAndSwap();
+
+#if JSC_OBJC_API_ENABLED
+    testObjectiveCAPI();
+#endif
+
+    const char *scriptPath = "testapi.js";
+    if (argc > 1) {
+        scriptPath = argv[1];
+    }
+    
+    // Test garbage collection with a fresh context
+    context = JSGlobalContextCreateInGroup(NULL, NULL);
+    TestInitializeFinalize = true;
+    testInitializeFinalize();
+    JSGlobalContextRelease(context);
+    TestInitializeFinalize = false;
+
+    ASSERT(Base_didFinalize);
+
+    JSClassDefinition globalObjectClassDefinition = kJSClassDefinitionEmpty;
+    globalObjectClassDefinition.initialize = globalObject_initialize;
+    globalObjectClassDefinition.staticValues = globalObject_staticValues;
+    globalObjectClassDefinition.staticFunctions = globalObject_staticFunctions;
+    globalObjectClassDefinition.attributes = kJSClassAttributeNoAutomaticPrototype;
+    JSClassRef globalObjectClass = JSClassCreate(&globalObjectClassDefinition);
+    context = JSGlobalContextCreateInGroup(NULL, globalObjectClass);
+
+    JSContextGroupRef contextGroup = JSContextGetGroup(context);
+    
+    JSGlobalContextRetain(context);
+    JSGlobalContextRelease(context);
+    ASSERT(JSContextGetGlobalContext(context) == context);
+    
+    JSReportExtraMemoryCost(context, 0);
+    JSReportExtraMemoryCost(context, 1);
+    JSReportExtraMemoryCost(context, 1024);
+
+    JSObjectRef globalObject = JSContextGetGlobalObject(context);
+    ASSERT(JSValueIsObject(context, globalObject));
+    
+    JSValueRef jsUndefined = JSValueMakeUndefined(context);
+    JSValueRef jsNull = JSValueMakeNull(context);
+    JSValueRef jsTrue = JSValueMakeBoolean(context, true);
+    JSValueRef jsFalse = JSValueMakeBoolean(context, false);
+    JSValueRef jsZero = JSValueMakeNumber(context, 0);
+    JSValueRef jsOne = JSValueMakeNumber(context, 1);
+    JSValueRef jsOneThird = JSValueMakeNumber(context, 1.0 / 3.0);
+    JSObjectRef jsObjectNoProto = JSObjectMake(context, NULL, NULL);
+    JSObjectSetPrototype(context, jsObjectNoProto, JSValueMakeNull(context));
+
+    JSObjectSetPrivate(globalObject, (void*)123);
+    if (JSObjectGetPrivate(globalObject) != (void*)123) {
+        printf("FAIL: Didn't return private data when set by JSObjectSetPrivate().\n");
+        failed = 1;
+    } else
+        printf("PASS: returned private data when set by JSObjectSetPrivate().\n");
+
+    // FIXME: test funny utf8 characters
+    JSStringRef jsEmptyIString = JSStringCreateWithUTF8CString("");
+    JSValueRef jsEmptyString = JSValueMakeString(context, jsEmptyIString);
+    
+    JSStringRef jsOneIString = JSStringCreateWithUTF8CString("1");
+    JSValueRef jsOneString = JSValueMakeString(context, jsOneIString);
+
+    UniChar singleUniChar = 65; // Capital A
+    CFMutableStringRef cfString = 
+        CFStringCreateMutableWithExternalCharactersNoCopy(kCFAllocatorDefault,
+                                                          &singleUniChar,
+                                                          1,
+                                                          1,
+                                                          kCFAllocatorNull);
+
+    JSStringRef jsCFIString = JSStringCreateWithCFString(cfString);
+    JSValueRef jsCFString = JSValueMakeString(context, jsCFIString);
+    
+    CFStringRef cfEmptyString = CFStringCreateWithCString(kCFAllocatorDefault, "", kCFStringEncodingUTF8);
+    
+    JSStringRef jsCFEmptyIString = JSStringCreateWithCFString(cfEmptyString);
+    JSValueRef jsCFEmptyString = JSValueMakeString(context, jsCFEmptyIString);
+
+    CFIndex cfStringLength = CFStringGetLength(cfString);
+    UniChar* buffer = (UniChar*)malloc(cfStringLength * sizeof(UniChar));
+    CFStringGetCharacters(cfString, 
+                          CFRangeMake(0, cfStringLength), 
+                          buffer);
+    JSStringRef jsCFIStringWithCharacters = JSStringCreateWithCharacters((JSChar*)buffer, cfStringLength);
+    JSValueRef jsCFStringWithCharacters = JSValueMakeString(context, jsCFIStringWithCharacters);
+    
+    JSStringRef jsCFEmptyIStringWithCharacters = JSStringCreateWithCharacters((JSChar*)buffer, CFStringGetLength(cfEmptyString));
+    free(buffer);
+    JSValueRef jsCFEmptyStringWithCharacters = JSValueMakeString(context, jsCFEmptyIStringWithCharacters);
+
+    JSChar constantString[] = { 'H', 'e', 'l', 'l', 'o', };
+    JSStringRef constantStringRef = JSStringCreateWithCharactersNoCopy(constantString, sizeof(constantString) / sizeof(constantString[0]));
+    ASSERT(JSStringGetCharactersPtr(constantStringRef) == constantString);
+    JSStringRelease(constantStringRef);
+
+    ASSERT(JSValueGetType(context, NULL) == kJSTypeNull);
+    ASSERT(JSValueGetType(context, jsUndefined) == kJSTypeUndefined);
+    ASSERT(JSValueGetType(context, jsNull) == kJSTypeNull);
+    ASSERT(JSValueGetType(context, jsTrue) == kJSTypeBoolean);
+    ASSERT(JSValueGetType(context, jsFalse) == kJSTypeBoolean);
+    ASSERT(JSValueGetType(context, jsZero) == kJSTypeNumber);
+    ASSERT(JSValueGetType(context, jsOne) == kJSTypeNumber);
+    ASSERT(JSValueGetType(context, jsOneThird) == kJSTypeNumber);
+    ASSERT(JSValueGetType(context, jsEmptyString) == kJSTypeString);
+    ASSERT(JSValueGetType(context, jsOneString) == kJSTypeString);
+    ASSERT(JSValueGetType(context, jsCFString) == kJSTypeString);
+    ASSERT(JSValueGetType(context, jsCFStringWithCharacters) == kJSTypeString);
+    ASSERT(JSValueGetType(context, jsCFEmptyString) == kJSTypeString);
+    ASSERT(JSValueGetType(context, jsCFEmptyStringWithCharacters) == kJSTypeString);
+
+    ASSERT(!JSValueIsBoolean(context, NULL));
+    ASSERT(!JSValueIsObject(context, NULL));
+    ASSERT(!JSValueIsArray(context, NULL));
+    ASSERT(!JSValueIsDate(context, NULL));
+    ASSERT(!JSValueIsString(context, NULL));
+    ASSERT(!JSValueIsNumber(context, NULL));
+    ASSERT(!JSValueIsUndefined(context, NULL));
+    ASSERT(JSValueIsNull(context, NULL));
+    ASSERT(!JSObjectCallAsFunction(context, NULL, NULL, 0, NULL, NULL));
+    ASSERT(!JSObjectCallAsConstructor(context, NULL, 0, NULL, NULL));
+    ASSERT(!JSObjectIsConstructor(context, NULL));
+    ASSERT(!JSObjectIsFunction(context, NULL));
+
+    JSStringRef nullString = JSStringCreateWithUTF8CString(0);
+    const JSChar* characters = JSStringGetCharactersPtr(nullString);
+    if (characters) {
+        printf("FAIL: Didn't return null when accessing character pointer of a null String.\n");
+        failed = 1;
+    } else
+        printf("PASS: returned null when accessing character pointer of a null String.\n");
+
+    JSStringRef emptyString = JSStringCreateWithCFString(CFSTR(""));
+    characters = JSStringGetCharactersPtr(emptyString);
+    if (!characters) {
+        printf("FAIL: Returned null when accessing character pointer of an empty String.\n");
+        failed = 1;
+    } else
+        printf("PASS: returned empty when accessing character pointer of an empty String.\n");
+
+    size_t length = JSStringGetLength(nullString);
+    if (length) {
+        printf("FAIL: Didn't return 0 length for null String.\n");
+        failed = 1;
+    } else
+        printf("PASS: returned 0 length for null String.\n");
+    JSStringRelease(nullString);
+
+    length = JSStringGetLength(emptyString);
+    if (length) {
+        printf("FAIL: Didn't return 0 length for empty String.\n");
+        failed = 1;
+    } else
+        printf("PASS: returned 0 length for empty String.\n");
+    JSStringRelease(emptyString);
+
+    JSObjectRef propertyCatchalls = JSObjectMake(context, PropertyCatchalls_class(context), NULL);
+    JSStringRef propertyCatchallsString = JSStringCreateWithUTF8CString("PropertyCatchalls");
+    JSObjectSetProperty(context, globalObject, propertyCatchallsString, propertyCatchalls, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(propertyCatchallsString);
+
+    JSObjectRef myObject = JSObjectMake(context, MyObject_class(context), NULL);
+    JSStringRef myObjectIString = JSStringCreateWithUTF8CString("MyObject");
+    JSObjectSetProperty(context, globalObject, myObjectIString, myObject, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(myObjectIString);
+    
+    JSObjectRef EvilExceptionObject = JSObjectMake(context, EvilExceptionObject_class(context), NULL);
+    JSStringRef EvilExceptionObjectIString = JSStringCreateWithUTF8CString("EvilExceptionObject");
+    JSObjectSetProperty(context, globalObject, EvilExceptionObjectIString, EvilExceptionObject, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(EvilExceptionObjectIString);
+    
+    JSObjectRef EmptyObject = JSObjectMake(context, EmptyObject_class(context), NULL);
+    JSStringRef EmptyObjectIString = JSStringCreateWithUTF8CString("EmptyObject");
+    JSObjectSetProperty(context, globalObject, EmptyObjectIString, EmptyObject, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(EmptyObjectIString);
+    
+    JSStringRef lengthStr = JSStringCreateWithUTF8CString("length");
+    JSObjectRef aStackRef = JSObjectMakeArray(context, 0, 0, 0);
+    aHeapRef = aStackRef;
+    JSObjectSetProperty(context, aHeapRef, lengthStr, JSValueMakeNumber(context, 10), 0, 0);
+    JSStringRef privatePropertyName = JSStringCreateWithUTF8CString("privateProperty");
+    if (!JSObjectSetPrivateProperty(context, myObject, privatePropertyName, aHeapRef)) {
+        printf("FAIL: Could not set private property.\n");
+        failed = 1;
+    } else
+        printf("PASS: Set private property.\n");
+    aStackRef = 0;
+    if (JSObjectSetPrivateProperty(context, aHeapRef, privatePropertyName, aHeapRef)) {
+        printf("FAIL: JSObjectSetPrivateProperty should fail on non-API objects.\n");
+        failed = 1;
+    } else
+        printf("PASS: Did not allow JSObjectSetPrivateProperty on a non-API object.\n");
+    if (JSObjectGetPrivateProperty(context, myObject, privatePropertyName) != aHeapRef) {
+        printf("FAIL: Could not retrieve private property.\n");
+        failed = 1;
+    } else
+        printf("PASS: Retrieved private property.\n");
+    if (JSObjectGetPrivateProperty(context, aHeapRef, privatePropertyName)) {
+        printf("FAIL: JSObjectGetPrivateProperty should return NULL when called on a non-API object.\n");
+        failed = 1;
+    } else
+        printf("PASS: JSObjectGetPrivateProperty return NULL.\n");
+
+    if (JSObjectGetProperty(context, myObject, privatePropertyName, 0) == aHeapRef) {
+        printf("FAIL: Accessed private property through ordinary property lookup.\n");
+        failed = 1;
+    } else
+        printf("PASS: Cannot access private property through ordinary property lookup.\n");
+
+    JSGarbageCollect(context);
+
+    for (int i = 0; i < 10000; i++)
+        JSObjectMake(context, 0, 0);
+
+    aHeapRef = JSValueToObject(context, JSObjectGetPrivateProperty(context, myObject, privatePropertyName), 0);
+    if (JSValueToNumber(context, JSObjectGetProperty(context, aHeapRef, lengthStr, 0), 0) != 10) {
+        printf("FAIL: Private property has been collected.\n");
+        failed = 1;
+    } else
+        printf("PASS: Private property does not appear to have been collected.\n");
+    JSStringRelease(lengthStr);
+
+    if (!JSObjectSetPrivateProperty(context, myObject, privatePropertyName, 0)) {
+        printf("FAIL: Could not set private property to NULL.\n");
+        failed = 1;
+    } else
+        printf("PASS: Set private property to NULL.\n");
+    if (JSObjectGetPrivateProperty(context, myObject, privatePropertyName)) {
+        printf("FAIL: Could not retrieve private property.\n");
+        failed = 1;
+    } else
+        printf("PASS: Retrieved private property.\n");
+
+    JSStringRef nullJSON = JSStringCreateWithUTF8CString(0);
+    JSValueRef nullJSONObject = JSValueMakeFromJSONString(context, nullJSON);
+    if (nullJSONObject) {
+        printf("FAIL: Did not parse null String as JSON correctly\n");
+        failed = 1;
+    } else
+        printf("PASS: Parsed null String as JSON correctly.\n");
+    JSStringRelease(nullJSON);
+
+    JSStringRef validJSON = JSStringCreateWithUTF8CString("{\"aProperty\":true}");
+    JSValueRef jsonObject = JSValueMakeFromJSONString(context, validJSON);
+    JSStringRelease(validJSON);
+    if (!JSValueIsObject(context, jsonObject)) {
+        printf("FAIL: Did not parse valid JSON correctly\n");
+        failed = 1;
+    } else
+        printf("PASS: Parsed valid JSON string.\n");
+    JSStringRef propertyName = JSStringCreateWithUTF8CString("aProperty");
+    assertEqualsAsBoolean(JSObjectGetProperty(context, JSValueToObject(context, jsonObject, 0), propertyName, 0), true);
+    JSStringRelease(propertyName);
+    JSStringRef invalidJSON = JSStringCreateWithUTF8CString("fail!");
+    if (JSValueMakeFromJSONString(context, invalidJSON)) {
+        printf("FAIL: Should return null for invalid JSON data\n");
+        failed = 1;
+    } else
+        printf("PASS: Correctly returned null for invalid JSON data.\n");
+    JSValueRef exception;
+    JSStringRef str = JSValueCreateJSONString(context, jsonObject, 0, 0);
+    if (!JSStringIsEqualToUTF8CString(str, "{\"aProperty\":true}")) {
+        printf("FAIL: Did not correctly serialise with indent of 0.\n");
+        failed = 1;
+    } else
+        printf("PASS: Correctly serialised with indent of 0.\n");
+    JSStringRelease(str);
+
+    str = JSValueCreateJSONString(context, jsonObject, 4, 0);
+    if (!JSStringIsEqualToUTF8CString(str, "{\n    \"aProperty\": true\n}")) {
+        printf("FAIL: Did not correctly serialise with indent of 4.\n");
+        failed = 1;
+    } else
+        printf("PASS: Correctly serialised with indent of 4.\n");
+    JSStringRelease(str);
+
+    str = JSStringCreateWithUTF8CString("({get a(){ throw '';}})");
+    JSValueRef unstringifiableObj = JSEvaluateScript(context, str, NULL, NULL, 1, NULL);
+    JSStringRelease(str);
+    
+    str = JSValueCreateJSONString(context, unstringifiableObj, 4, 0);
+    if (str) {
+        printf("FAIL: Didn't return null when attempting to serialize unserializable value.\n");
+        JSStringRelease(str);
+        failed = 1;
+    } else
+        printf("PASS: returned null when attempting to serialize unserializable value.\n");
+    
+    str = JSValueCreateJSONString(context, unstringifiableObj, 4, &exception);
+    if (str) {
+        printf("FAIL: Didn't return null when attempting to serialize unserializable value.\n");
+        JSStringRelease(str);
+        failed = 1;
+    } else
+        printf("PASS: returned null when attempting to serialize unserializable value.\n");
+    if (!exception) {
+        printf("FAIL: Did not set exception on serialisation error\n");
+        failed = 1;
+    } else
+        printf("PASS: set exception on serialisation error\n");
+    // Conversions that throw exceptions
+    exception = NULL;
+    ASSERT(NULL == JSValueToObject(context, jsNull, &exception));
+    ASSERT(exception);
+    
+    exception = NULL;
+    // FIXME <rdar://4668451> - On i386 the isnan(double) macro tries to map to the isnan(float) function,
+    // causing a build break with -Wshorten-64-to-32 enabled.  The issue is known by the appropriate team.
+    // After that's resolved, we can remove these casts
+    ASSERT(isnan((float)JSValueToNumber(context, jsObjectNoProto, &exception)));
+    ASSERT(exception);
+
+    exception = NULL;
+    ASSERT(!JSValueToStringCopy(context, jsObjectNoProto, &exception));
+    ASSERT(exception);
+    
+    ASSERT(JSValueToBoolean(context, myObject));
+    
+    exception = NULL;
+    ASSERT(!JSValueIsEqual(context, jsObjectNoProto, JSValueMakeNumber(context, 1), &exception));
+    ASSERT(exception);
+    
+    exception = NULL;
+    JSObjectGetPropertyAtIndex(context, myObject, 0, &exception);
+    ASSERT(1 == JSValueToNumber(context, exception, NULL));
+
+    assertEqualsAsBoolean(jsUndefined, false);
+    assertEqualsAsBoolean(jsNull, false);
+    assertEqualsAsBoolean(jsTrue, true);
+    assertEqualsAsBoolean(jsFalse, false);
+    assertEqualsAsBoolean(jsZero, false);
+    assertEqualsAsBoolean(jsOne, true);
+    assertEqualsAsBoolean(jsOneThird, true);
+    assertEqualsAsBoolean(jsEmptyString, false);
+    assertEqualsAsBoolean(jsOneString, true);
+    assertEqualsAsBoolean(jsCFString, true);
+    assertEqualsAsBoolean(jsCFStringWithCharacters, true);
+    assertEqualsAsBoolean(jsCFEmptyString, false);
+    assertEqualsAsBoolean(jsCFEmptyStringWithCharacters, false);
+    
+    assertEqualsAsNumber(jsUndefined, nan(""));
+    assertEqualsAsNumber(jsNull, 0);
+    assertEqualsAsNumber(jsTrue, 1);
+    assertEqualsAsNumber(jsFalse, 0);
+    assertEqualsAsNumber(jsZero, 0);
+    assertEqualsAsNumber(jsOne, 1);
+    assertEqualsAsNumber(jsOneThird, 1.0 / 3.0);
+    assertEqualsAsNumber(jsEmptyString, 0);
+    assertEqualsAsNumber(jsOneString, 1);
+    assertEqualsAsNumber(jsCFString, nan(""));
+    assertEqualsAsNumber(jsCFStringWithCharacters, nan(""));
+    assertEqualsAsNumber(jsCFEmptyString, 0);
+    assertEqualsAsNumber(jsCFEmptyStringWithCharacters, 0);
+    ASSERT(sizeof(JSChar) == sizeof(UniChar));
+    
+    assertEqualsAsCharactersPtr(jsUndefined, "undefined");
+    assertEqualsAsCharactersPtr(jsNull, "null");
+    assertEqualsAsCharactersPtr(jsTrue, "true");
+    assertEqualsAsCharactersPtr(jsFalse, "false");
+    assertEqualsAsCharactersPtr(jsZero, "0");
+    assertEqualsAsCharactersPtr(jsOne, "1");
+    assertEqualsAsCharactersPtr(jsOneThird, "0.3333333333333333");
+    assertEqualsAsCharactersPtr(jsEmptyString, "");
+    assertEqualsAsCharactersPtr(jsOneString, "1");
+    assertEqualsAsCharactersPtr(jsCFString, "A");
+    assertEqualsAsCharactersPtr(jsCFStringWithCharacters, "A");
+    assertEqualsAsCharactersPtr(jsCFEmptyString, "");
+    assertEqualsAsCharactersPtr(jsCFEmptyStringWithCharacters, "");
+    
+    assertEqualsAsUTF8String(jsUndefined, "undefined");
+    assertEqualsAsUTF8String(jsNull, "null");
+    assertEqualsAsUTF8String(jsTrue, "true");
+    assertEqualsAsUTF8String(jsFalse, "false");
+    assertEqualsAsUTF8String(jsZero, "0");
+    assertEqualsAsUTF8String(jsOne, "1");
+    assertEqualsAsUTF8String(jsOneThird, "0.3333333333333333");
+    assertEqualsAsUTF8String(jsEmptyString, "");
+    assertEqualsAsUTF8String(jsOneString, "1");
+    assertEqualsAsUTF8String(jsCFString, "A");
+    assertEqualsAsUTF8String(jsCFStringWithCharacters, "A");
+    assertEqualsAsUTF8String(jsCFEmptyString, "");
+    assertEqualsAsUTF8String(jsCFEmptyStringWithCharacters, "");
+    
+    checkConstnessInJSObjectNames();
+    
+    ASSERT(JSValueIsStrictEqual(context, jsTrue, jsTrue));
+    ASSERT(!JSValueIsStrictEqual(context, jsOne, jsOneString));
+
+    ASSERT(JSValueIsEqual(context, jsOne, jsOneString, NULL));
+    ASSERT(!JSValueIsEqual(context, jsTrue, jsFalse, NULL));
+    
+    CFStringRef cfJSString = JSStringCopyCFString(kCFAllocatorDefault, jsCFIString);
+    CFStringRef cfJSEmptyString = JSStringCopyCFString(kCFAllocatorDefault, jsCFEmptyIString);
+    ASSERT(CFEqual(cfJSString, cfString));
+    ASSERT(CFEqual(cfJSEmptyString, cfEmptyString));
+    CFRelease(cfJSString);
+    CFRelease(cfJSEmptyString);
+
+    CFRelease(cfString);
+    CFRelease(cfEmptyString);
+    
+    jsGlobalValue = JSObjectMake(context, NULL, NULL);
+    makeGlobalNumberValue(context);
+    JSValueProtect(context, jsGlobalValue);
+    JSGarbageCollect(context);
+    ASSERT(JSValueIsObject(context, jsGlobalValue));
+    JSValueUnprotect(context, jsGlobalValue);
+    JSValueUnprotect(context, jsNumberValue);
+
+    JSStringRef goodSyntax = JSStringCreateWithUTF8CString("x = 1;");
+    const char* badSyntaxConstant = "x := 1;";
+    JSStringRef badSyntax = JSStringCreateWithUTF8CString(badSyntaxConstant);
+    ASSERT(JSCheckScriptSyntax(context, goodSyntax, NULL, 0, NULL));
+    ASSERT(!JSCheckScriptSyntax(context, badSyntax, NULL, 0, NULL));
+    ASSERT(!JSScriptCreateFromString(contextGroup, 0, 0, badSyntax, 0, 0));
+    ASSERT(!JSScriptCreateReferencingImmortalASCIIText(contextGroup, 0, 0, badSyntaxConstant, strlen(badSyntaxConstant), 0, 0));
+
+    JSValueRef result;
+    JSValueRef v;
+    JSObjectRef o;
+    JSStringRef string;
+
+    result = JSEvaluateScript(context, goodSyntax, NULL, NULL, 1, NULL);
+    ASSERT(result);
+    ASSERT(JSValueIsEqual(context, result, jsOne, NULL));
+
+    exception = NULL;
+    result = JSEvaluateScript(context, badSyntax, NULL, NULL, 1, &exception);
+    ASSERT(!result);
+    ASSERT(JSValueIsObject(context, exception));
+    
+    JSStringRef array = JSStringCreateWithUTF8CString("Array");
+    JSObjectRef arrayConstructor = JSValueToObject(context, JSObjectGetProperty(context, globalObject, array, NULL), NULL);
+    JSStringRelease(array);
+    result = JSObjectCallAsConstructor(context, arrayConstructor, 0, NULL, NULL);
+    ASSERT(result);
+    ASSERT(JSValueIsObject(context, result));
+    ASSERT(JSValueIsInstanceOfConstructor(context, result, arrayConstructor, NULL));
+    ASSERT(!JSValueIsInstanceOfConstructor(context, JSValueMakeNull(context), arrayConstructor, NULL));
+
+    o = JSValueToObject(context, result, NULL);
+    exception = NULL;
+    ASSERT(JSValueIsUndefined(context, JSObjectGetPropertyAtIndex(context, o, 0, &exception)));
+    ASSERT(!exception);
+    
+    JSObjectSetPropertyAtIndex(context, o, 0, JSValueMakeNumber(context, 1), &exception);
+    ASSERT(!exception);
+    
+    exception = NULL;
+    ASSERT(1 == JSValueToNumber(context, JSObjectGetPropertyAtIndex(context, o, 0, &exception), &exception));
+    ASSERT(!exception);
+
+    JSStringRef functionBody;
+    JSObjectRef function;
+    
+    exception = NULL;
+    functionBody = JSStringCreateWithUTF8CString("rreturn Array;");
+    JSStringRef line = JSStringCreateWithUTF8CString("line");
+    ASSERT(!JSObjectMakeFunction(context, NULL, 0, NULL, functionBody, NULL, 1, &exception));
+    ASSERT(JSValueIsObject(context, exception));
+    v = JSObjectGetProperty(context, JSValueToObject(context, exception, NULL), line, NULL);
+    assertEqualsAsNumber(v, 2);
+    JSStringRelease(functionBody);
+    JSStringRelease(line);
+
+    exception = NULL;
+    functionBody = JSStringCreateWithUTF8CString("rreturn Array;");
+    line = JSStringCreateWithUTF8CString("line");
+    ASSERT(!JSObjectMakeFunction(context, NULL, 0, NULL, functionBody, NULL, -42, &exception));
+    ASSERT(JSValueIsObject(context, exception));
+    v = JSObjectGetProperty(context, JSValueToObject(context, exception, NULL), line, NULL);
+    assertEqualsAsNumber(v, 2);
+    JSStringRelease(functionBody);
+    JSStringRelease(line);
+
+    exception = NULL;
+    functionBody = JSStringCreateWithUTF8CString("// Line one.\nrreturn Array;");
+    line = JSStringCreateWithUTF8CString("line");
+    ASSERT(!JSObjectMakeFunction(context, NULL, 0, NULL, functionBody, NULL, 1, &exception));
+    ASSERT(JSValueIsObject(context, exception));
+    v = JSObjectGetProperty(context, JSValueToObject(context, exception, NULL), line, NULL);
+    assertEqualsAsNumber(v, 3);
+    JSStringRelease(functionBody);
+    JSStringRelease(line);
+
+    exception = NULL;
+    functionBody = JSStringCreateWithUTF8CString("return Array;");
+    function = JSObjectMakeFunction(context, NULL, 0, NULL, functionBody, NULL, 1, &exception);
+    JSStringRelease(functionBody);
+    ASSERT(!exception);
+    ASSERT(JSObjectIsFunction(context, function));
+    v = JSObjectCallAsFunction(context, function, NULL, 0, NULL, NULL);
+    ASSERT(v);
+    ASSERT(JSValueIsEqual(context, v, arrayConstructor, NULL));
+    
+    exception = NULL;
+    function = JSObjectMakeFunction(context, NULL, 0, NULL, jsEmptyIString, NULL, 0, &exception);
+    ASSERT(!exception);
+    v = JSObjectCallAsFunction(context, function, NULL, 0, NULL, &exception);
+    ASSERT(v && !exception);
+    ASSERT(JSValueIsUndefined(context, v));
+    
+    exception = NULL;
+    v = NULL;
+    JSStringRef foo = JSStringCreateWithUTF8CString("foo");
+    JSStringRef argumentNames[] = { foo };
+    functionBody = JSStringCreateWithUTF8CString("return foo;");
+    function = JSObjectMakeFunction(context, foo, 1, argumentNames, functionBody, NULL, 1, &exception);
+    ASSERT(function && !exception);
+    JSValueRef arguments[] = { JSValueMakeNumber(context, 2) };
+    JSObjectCallAsFunction(context, function, NULL, 1, arguments, &exception);
+    JSStringRelease(foo);
+    JSStringRelease(functionBody);
+    
+    string = JSValueToStringCopy(context, function, NULL);
+    assertEqualsAsUTF8String(JSValueMakeString(context, string), "function foo(foo) {\nreturn foo;\n}");
+    JSStringRelease(string);
+
+    JSStringRef print = JSStringCreateWithUTF8CString("print");
+    JSObjectRef printFunction = JSObjectMakeFunctionWithCallback(context, print, print_callAsFunction);
+    JSObjectSetProperty(context, globalObject, print, printFunction, kJSPropertyAttributeNone, NULL); 
+    JSStringRelease(print);
+    
+    ASSERT(!JSObjectSetPrivate(printFunction, (void*)1));
+    ASSERT(!JSObjectGetPrivate(printFunction));
+
+    JSStringRef myConstructorIString = JSStringCreateWithUTF8CString("MyConstructor");
+    JSObjectRef myConstructor = JSObjectMakeConstructor(context, NULL, myConstructor_callAsConstructor);
+    JSObjectSetProperty(context, globalObject, myConstructorIString, myConstructor, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(myConstructorIString);
+    
+    JSStringRef myBadConstructorIString = JSStringCreateWithUTF8CString("MyBadConstructor");
+    JSObjectRef myBadConstructor = JSObjectMakeConstructor(context, NULL, myBadConstructor_callAsConstructor);
+    JSObjectSetProperty(context, globalObject, myBadConstructorIString, myBadConstructor, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(myBadConstructorIString);
+    
+    ASSERT(!JSObjectSetPrivate(myConstructor, (void*)1));
+    ASSERT(!JSObjectGetPrivate(myConstructor));
+    
+    string = JSStringCreateWithUTF8CString("Base");
+    JSObjectRef baseConstructor = JSObjectMakeConstructor(context, Base_class(context), NULL);
+    JSObjectSetProperty(context, globalObject, string, baseConstructor, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(string);
+    
+    string = JSStringCreateWithUTF8CString("Derived");
+    JSObjectRef derivedConstructor = JSObjectMakeConstructor(context, Derived_class(context), NULL);
+    JSObjectSetProperty(context, globalObject, string, derivedConstructor, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(string);
+    
+    string = JSStringCreateWithUTF8CString("Derived2");
+    JSObjectRef derived2Constructor = JSObjectMakeConstructor(context, Derived2_class(context), NULL);
+    JSObjectSetProperty(context, globalObject, string, derived2Constructor, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(string);
+
+    o = JSObjectMake(context, NULL, NULL);
+    JSObjectSetProperty(context, o, jsOneIString, JSValueMakeNumber(context, 1), kJSPropertyAttributeNone, NULL);
+    JSObjectSetProperty(context, o, jsCFIString,  JSValueMakeNumber(context, 1), kJSPropertyAttributeDontEnum, NULL);
+    JSPropertyNameArrayRef nameArray = JSObjectCopyPropertyNames(context, o);
+    size_t expectedCount = JSPropertyNameArrayGetCount(nameArray);
+    size_t count;
+    for (count = 0; count < expectedCount; ++count)
+        JSPropertyNameArrayGetNameAtIndex(nameArray, count);
+    JSPropertyNameArrayRelease(nameArray);
+    ASSERT(count == 1); // jsCFString should not be enumerated
+
+    JSValueRef argumentsArrayValues[] = { JSValueMakeNumber(context, 10), JSValueMakeNumber(context, 20) };
+    o = JSObjectMakeArray(context, sizeof(argumentsArrayValues) / sizeof(JSValueRef), argumentsArrayValues, NULL);
+    string = JSStringCreateWithUTF8CString("length");
+    v = JSObjectGetProperty(context, o, string, NULL);
+    assertEqualsAsNumber(v, 2);
+    v = JSObjectGetPropertyAtIndex(context, o, 0, NULL);
+    assertEqualsAsNumber(v, 10);
+    v = JSObjectGetPropertyAtIndex(context, o, 1, NULL);
+    assertEqualsAsNumber(v, 20);
+
+    o = JSObjectMakeArray(context, 0, NULL, NULL);
+    v = JSObjectGetProperty(context, o, string, NULL);
+    assertEqualsAsNumber(v, 0);
+    JSStringRelease(string);
+
+    JSValueRef argumentsDateValues[] = { JSValueMakeNumber(context, 0) };
+    o = JSObjectMakeDate(context, 1, argumentsDateValues, NULL);
+    if (timeZoneIsPST())
+        assertEqualsAsUTF8String(o, "Wed Dec 31 1969 16:00:00 GMT-0800 (PST)");
+
+    string = JSStringCreateWithUTF8CString("an error message");
+    JSValueRef argumentsErrorValues[] = { JSValueMakeString(context, string) };
+    o = JSObjectMakeError(context, 1, argumentsErrorValues, NULL);
+    assertEqualsAsUTF8String(o, "Error: an error message");
+    JSStringRelease(string);
+
+    string = JSStringCreateWithUTF8CString("foo");
+    JSStringRef string2 = JSStringCreateWithUTF8CString("gi");
+    JSValueRef argumentsRegExpValues[] = { JSValueMakeString(context, string), JSValueMakeString(context, string2) };
+    o = JSObjectMakeRegExp(context, 2, argumentsRegExpValues, NULL);
+    assertEqualsAsUTF8String(o, "/foo/gi");
+    JSStringRelease(string);
+    JSStringRelease(string2);
+
+    JSClassDefinition nullDefinition = kJSClassDefinitionEmpty;
+    nullDefinition.attributes = kJSClassAttributeNoAutomaticPrototype;
+    JSClassRef nullClass = JSClassCreate(&nullDefinition);
+    JSClassRelease(nullClass);
+    
+    nullDefinition = kJSClassDefinitionEmpty;
+    nullClass = JSClassCreate(&nullDefinition);
+    JSClassRelease(nullClass);
+
+    functionBody = JSStringCreateWithUTF8CString("return this;");
+    function = JSObjectMakeFunction(context, NULL, 0, NULL, functionBody, NULL, 1, NULL);
+    JSStringRelease(functionBody);
+    v = JSObjectCallAsFunction(context, function, NULL, 0, NULL, NULL);
+    ASSERT(JSValueIsEqual(context, v, globalObject, NULL));
+    v = JSObjectCallAsFunction(context, function, o, 0, NULL, NULL);
+    ASSERT(JSValueIsEqual(context, v, o, NULL));
+
+    functionBody = JSStringCreateWithUTF8CString("return eval(\"this\");");
+    function = JSObjectMakeFunction(context, NULL, 0, NULL, functionBody, NULL, 1, NULL);
+    JSStringRelease(functionBody);
+    v = JSObjectCallAsFunction(context, function, NULL, 0, NULL, NULL);
+    ASSERT(JSValueIsEqual(context, v, globalObject, NULL));
+    v = JSObjectCallAsFunction(context, function, o, 0, NULL, NULL);
+    ASSERT(JSValueIsEqual(context, v, o, NULL));
+
+    const char* thisScript = "this;";
+    JSStringRef script = JSStringCreateWithUTF8CString(thisScript);
+    v = JSEvaluateScript(context, script, NULL, NULL, 1, NULL);
+    ASSERT(JSValueIsEqual(context, v, globalObject, NULL));
+    v = JSEvaluateScript(context, script, o, NULL, 1, NULL);
+    ASSERT(JSValueIsEqual(context, v, o, NULL));
+    JSStringRelease(script);
+
+    JSScriptRef scriptObject = JSScriptCreateReferencingImmortalASCIIText(contextGroup, 0, 0, thisScript, strlen(thisScript), 0, 0);
+    v = JSScriptEvaluate(context, scriptObject, NULL, NULL);
+    ASSERT(JSValueIsEqual(context, v, globalObject, NULL));
+    v = JSScriptEvaluate(context, scriptObject, o, NULL);
+    ASSERT(JSValueIsEqual(context, v, o, NULL));
+    JSScriptRelease(scriptObject);
+
+    script = JSStringCreateWithUTF8CString("eval(this);");
+    v = JSEvaluateScript(context, script, NULL, NULL, 1, NULL);
+    ASSERT(JSValueIsEqual(context, v, globalObject, NULL));
+    v = JSEvaluateScript(context, script, o, NULL, 1, NULL);
+    ASSERT(JSValueIsEqual(context, v, o, NULL));
+    JSStringRelease(script);
+
+    script = JSStringCreateWithUTF8CString("[ ]");
+    v = JSEvaluateScript(context, script, NULL, NULL, 1, NULL);
+    ASSERT(JSValueIsArray(context, v));
+    JSStringRelease(script);
+
+    script = JSStringCreateWithUTF8CString("new Date");
+    v = JSEvaluateScript(context, script, NULL, NULL, 1, NULL);
+    ASSERT(JSValueIsDate(context, v));
+    JSStringRelease(script);
+
+    exception = NULL;
+    script = JSStringCreateWithUTF8CString("rreturn Array;");
+    JSStringRef sourceURL = JSStringCreateWithUTF8CString("file:///foo/bar.js");
+    JSStringRef sourceURLKey = JSStringCreateWithUTF8CString("sourceURL");
+    JSEvaluateScript(context, script, NULL, sourceURL, 1, &exception);
+    ASSERT(exception);
+    v = JSObjectGetProperty(context, JSValueToObject(context, exception, NULL), sourceURLKey, NULL);
+    assertEqualsAsUTF8String(v, "file:///foo/bar.js");
+    JSStringRelease(script);
+    JSStringRelease(sourceURL);
+    JSStringRelease(sourceURLKey);
+
+    // Verify that creating a constructor for a class with no static functions does not trigger
+    // an assert inside putDirect or lead to a crash during GC. <https://bugs.webkit.org/show_bug.cgi?id=25785>
+    nullDefinition = kJSClassDefinitionEmpty;
+    nullClass = JSClassCreate(&nullDefinition);
+    JSObjectMakeConstructor(context, nullClass, 0);
+    JSClassRelease(nullClass);
+
+    char* scriptUTF8 = createStringWithContentsOfFile(scriptPath);
+    if (!scriptUTF8) {
+        printf("FAIL: Test script could not be loaded.\n");
+        failed = 1;
+    } else {
+        JSStringRef url = JSStringCreateWithUTF8CString(scriptPath);
+        JSStringRef script = JSStringCreateWithUTF8CString(scriptUTF8);
+        JSStringRef errorMessage = 0;
+        int errorLine = 0;
+        JSScriptRef scriptObject = JSScriptCreateFromString(contextGroup, url, 1, script, &errorMessage, &errorLine);
+        ASSERT((!scriptObject) != (!errorMessage));
+        if (!scriptObject) {
+            printf("FAIL: Test script did not parse\n\t%s:%d\n\t", scriptPath, errorLine);
+            CFStringRef errorCF = JSStringCopyCFString(kCFAllocatorDefault, errorMessage);
+            CFShow(errorCF);
+            CFRelease(errorCF);
+            JSStringRelease(errorMessage);
+            failed = 1;
+        }
+
+        JSStringRelease(script);
+        exception = NULL;
+        result = scriptObject ? JSScriptEvaluate(context, scriptObject, 0, &exception) : 0;
+        if (result && JSValueIsUndefined(context, result))
+            printf("PASS: Test script executed successfully.\n");
+        else {
+            printf("FAIL: Test script returned unexpected value:\n");
+            JSStringRef exceptionIString = JSValueToStringCopy(context, exception, NULL);
+            CFStringRef exceptionCF = JSStringCopyCFString(kCFAllocatorDefault, exceptionIString);
+            CFShow(exceptionCF);
+            CFRelease(exceptionCF);
+            JSStringRelease(exceptionIString);
+            failed = 1;
+        }
+        JSScriptRelease(scriptObject);
+        free(scriptUTF8);
+    }
+
+    // Check Promise is not exposed.
+    {
+        JSObjectRef globalObject = JSContextGetGlobalObject(context);
+        {
+            JSStringRef promiseProperty = JSStringCreateWithUTF8CString("Promise");
+            ASSERT(JSObjectHasProperty(context, globalObject, promiseProperty));
+            JSStringRelease(promiseProperty);
+        }
+        {
+            JSStringRef script = JSStringCreateWithUTF8CString("typeof Promise");
+            JSStringRef function = JSStringCreateWithUTF8CString("function");
+            JSValueRef value = JSEvaluateScript(context, script, NULL, NULL, 1, NULL);
+            ASSERT(JSValueIsString(context, value));
+            JSStringRef valueAsString = JSValueToStringCopy(context, value, NULL);
+            ASSERT(JSStringIsEqual(valueAsString, function));
+            JSStringRelease(valueAsString);
+            JSStringRelease(function);
+            JSStringRelease(script);
+        }
+        printf("PASS: Promise is exposed under JSContext API.\n");
+    }
+
+    // Check microtasks.
+    {
+        JSGlobalContextRef context = JSGlobalContextCreateInGroup(NULL, NULL);
+        {
+            JSObjectRef globalObject = JSContextGetGlobalObject(context);
+            JSValueRef exception;
+            JSStringRef code = JSStringCreateWithUTF8CString("result = 0; Promise.resolve(42).then(function (value) { result = value; });");
+            JSStringRef file = JSStringCreateWithUTF8CString("");
+            assertTrue(JSEvaluateScript(context, code, globalObject, file, 1, &exception), "An exception should not be thrown");
+            JSStringRelease(code);
+            JSStringRelease(file);
+
+            JSStringRef resultProperty = JSStringCreateWithUTF8CString("result");
+            ASSERT(JSObjectHasProperty(context, globalObject, resultProperty));
+
+            JSValueRef resultValue = JSObjectGetProperty(context, globalObject, resultProperty, &exception);
+            assertEqualsAsNumber(resultValue, 42);
+            JSStringRelease(resultProperty);
+        }
+        JSGlobalContextRelease(context);
+    }
+
+    failed = testTypedArrayCAPI() || failed;
+    failed = testExecutionTimeLimit() || failed;
+    failed = testFunctionOverrides() || failed;
+    failed = testGlobalContextWithFinalizer() || failed;
+    failed = testPingPongStackOverflow() || failed;
+    failed = testJSONParse() || failed;
+
+    // Clear out local variables pointing at JSObjectRefs to allow their values to be collected
+    function = NULL;
+    v = NULL;
+    o = NULL;
+    globalObject = NULL;
+    myConstructor = NULL;
+
+    JSStringRelease(jsEmptyIString);
+    JSStringRelease(jsOneIString);
+    JSStringRelease(jsCFIString);
+    JSStringRelease(jsCFEmptyIString);
+    JSStringRelease(jsCFIStringWithCharacters);
+    JSStringRelease(jsCFEmptyIStringWithCharacters);
+    JSStringRelease(goodSyntax);
+    JSStringRelease(badSyntax);
+
+    JSGlobalContextRelease(context);
+    JSClassRelease(globalObjectClass);
+
+    // Test for an infinite prototype chain that used to be created. This test
+    // passes if the call to JSObjectHasProperty() does not hang.
+
+    JSClassDefinition prototypeLoopClassDefinition = kJSClassDefinitionEmpty;
+    prototypeLoopClassDefinition.staticFunctions = globalObject_staticFunctions;
+    JSClassRef prototypeLoopClass = JSClassCreate(&prototypeLoopClassDefinition);
+    JSGlobalContextRef prototypeLoopContext = JSGlobalContextCreateInGroup(NULL, prototypeLoopClass);
+
+    JSStringRef nameProperty = JSStringCreateWithUTF8CString("name");
+    JSObjectHasProperty(prototypeLoopContext, JSContextGetGlobalObject(prototypeLoopContext), nameProperty);
+
+    JSGlobalContextRelease(prototypeLoopContext);
+    JSClassRelease(prototypeLoopClass);
+
+    printf("PASS: Infinite prototype chain does not occur.\n");
+
+    if (checkForCycleInPrototypeChain())
+        printf("PASS: A cycle in a prototype chain can't be created.\n");
+    else {
+        printf("FAIL: A cycle in a prototype chain can be created.\n");
+        failed = true;
+    }
+    if (valueToObjectExceptionTest())
+        printf("PASS: throwException did not crash when handling an error with appendMessageToError set and no codeBlock available.\n");
+
+    if (globalContextNameTest())
+        printf("PASS: global context name behaves as expected.\n");
+
+    customGlobalObjectClassTest();
+    globalObjectSetPrototypeTest();
+    globalObjectPrivatePropertyTest();
+
+    if (failed) {
+        printf("FAIL: Some tests failed.\n");
+        return 1;
+    }
+
+    printf("PASS: Program exited normally.\n");
+    return 0;
+}
+
+static char* createStringWithContentsOfFile(const char* fileName)
+{
+    char* buffer;
+    
+    size_t buffer_size = 0;
+    size_t buffer_capacity = 1024;
+    buffer = (char*)malloc(buffer_capacity);
+    
+    FILE* f = fopen(fileName, "r");
+    if (!f) {
+        fprintf(stderr, "Could not open file: %s\n", fileName);
+        free(buffer);
+        return 0;
+    }
+    
+    while (!feof(f) && !ferror(f)) {
+        buffer_size += fread(buffer + buffer_size, 1, buffer_capacity - buffer_size, f);
+        if (buffer_size == buffer_capacity) { // guarantees space for trailing '\0'
+            buffer_capacity *= 2;
+            buffer = (char*)realloc(buffer, buffer_capacity);
+            ASSERT(buffer);
+        }
+        
+        ASSERT(buffer_size < buffer_capacity);
+    }
+    fclose(f);
+    buffer[buffer_size] = '\0';
+    
+    return buffer;
+}
+
+#if OS(WINDOWS)
+extern "C" __declspec(dllexport) int WINAPI dllLauncherEntryPoint(int argc, const char* argv[])
+{
+    return main(argc, const_cast<char**>(argv));
+}
+#endif
diff --git a/API/tests/testapi.js b/API/tests/testapi.js
new file mode 100644
index 0000000..88d3701
--- /dev/null
+++ b/API/tests/testapi.js
@@ -0,0 +1,307 @@
+/*
+ * Copyright (C) 2006 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function bludgeonArguments() { if (0) arguments; return function g() {} }
+h = bludgeonArguments();
+gc();
+
+var failed = false;
+function pass(msg)
+{
+    print("PASS: " + msg, "green");
+}
+
+function fail(msg)
+{
+    print("FAIL: " + msg, "red");
+    failed = true;
+}
+
+function shouldBe(a, b)
+{
+    var evalA;
+    try {
+        evalA = eval(a);
+    } catch(e) {
+        evalA = e;
+    }
+    
+    if (evalA == b || isNaN(evalA) && typeof evalA == 'number' && isNaN(b) && typeof b == 'number')
+        pass(a + " should be " + b + " and is.");
+    else
+        fail(a + " should be " + b + " but instead is " + evalA + ".");
+}
+
+function shouldThrow(a)
+{
+    var evalA;
+    try {
+        eval(a);
+    } catch(e) {
+        pass(a + " threw: " + e);
+        return;
+    }
+
+    fail(a + " did not throw an exception.");
+}
+
+function globalStaticFunction()
+{
+    return 4;
+}
+
+shouldBe("globalStaticValue", 3);
+shouldBe("globalStaticFunction()", 4);
+shouldBe("this.globalStaticFunction()", 4);
+
+function globalStaticFunction2() {
+    return 10;
+}
+shouldBe("globalStaticFunction2();", 10);
+this.globalStaticFunction2 = function() { return 20; }
+shouldBe("globalStaticFunction2();", 20);
+shouldBe("this.globalStaticFunction2();", 20);
+
+function iAmNotAStaticFunction() { return 10; }
+shouldBe("iAmNotAStaticFunction();", 10);
+this.iAmNotAStaticFunction = function() { return 20; }
+shouldBe("iAmNotAStaticFunction();", 20);
+
+shouldBe("typeof MyObject", "function"); // our object implements 'call'
+MyObject.cantFind = 1;
+shouldBe("MyObject.cantFind", undefined);
+MyObject.regularType = 1;
+shouldBe("MyObject.regularType", 1);
+MyObject.alwaysOne = 2;
+shouldBe("MyObject.alwaysOne", 1);
+MyObject.cantDelete = 1;
+delete MyObject.cantDelete;
+shouldBe("MyObject.cantDelete", 1);
+shouldBe("delete MyObject.throwOnDelete", "an exception");
+MyObject.cantSet = 1;
+shouldBe("MyObject.cantSet", undefined);
+shouldBe("MyObject.throwOnGet", "an exception");
+shouldBe("MyObject.throwOnSet = 5", "an exception");
+shouldBe("MyObject('throwOnCall')", "an exception");
+shouldBe("new MyObject('throwOnConstruct')", "an exception");
+shouldBe("'throwOnHasInstance' instanceof MyObject", "an exception");
+
+MyObject.nullGetForwardSet = 1;
+shouldBe("MyObject.nullGetForwardSet", 1);
+
+var foundMyPropertyName = false;
+var foundRegularType = false;
+for (var p in MyObject) {
+    if (p == "myPropertyName")
+        foundMyPropertyName = true;
+    if (p == "regularType")
+        foundRegularType = true;
+}
+
+if (foundMyPropertyName)
+    pass("MyObject.myPropertyName was enumerated");
+else
+    fail("MyObject.myPropertyName was not enumerated");
+
+if (foundRegularType)
+    pass("MyObject.regularType was enumerated");
+else
+    fail("MyObject.regularType was not enumerated");
+
+var alwaysOneDescriptor = Object.getOwnPropertyDescriptor(MyObject, "alwaysOne");
+shouldBe('typeof alwaysOneDescriptor', "object");
+shouldBe('alwaysOneDescriptor.value', MyObject.alwaysOne);
+shouldBe('alwaysOneDescriptor.configurable', true);
+shouldBe('alwaysOneDescriptor.enumerable', false); // Actually it is.
+var cantFindDescriptor = Object.getOwnPropertyDescriptor(MyObject, "cantFind");
+shouldBe('typeof cantFindDescriptor', "object");
+shouldBe('cantFindDescriptor.value', MyObject.cantFind);
+shouldBe('cantFindDescriptor.configurable', true);
+shouldBe('cantFindDescriptor.enumerable', false);
+try {
+    // If getOwnPropertyDescriptor() returned an access descriptor, this wouldn't throw.
+    Object.getOwnPropertyDescriptor(MyObject, "throwOnGet");
+} catch (e) {
+    pass("getting property descriptor of throwOnGet threw exception");
+}
+var myPropertyNameDescriptor = Object.getOwnPropertyDescriptor(MyObject, "myPropertyName");
+shouldBe('typeof myPropertyNameDescriptor', "object");
+shouldBe('myPropertyNameDescriptor.value', MyObject.myPropertyName);
+shouldBe('myPropertyNameDescriptor.configurable', true);
+shouldBe('myPropertyNameDescriptor.enumerable', false); // Actually it is.
+try {
+    // if getOwnPropertyDescriptor() returned an access descriptor, this wouldn't throw.
+    Object.getOwnPropertyDescriptor(MyObject, "hasPropertyLie");
+} catch (e) {
+    pass("getting property descriptor of hasPropertyLie threw exception");
+}
+shouldBe('Object.getOwnPropertyDescriptor(MyObject, "doesNotExist")', undefined);
+
+myObject = new MyObject();
+
+shouldBe("delete MyObject.regularType", true);
+shouldBe("MyObject.regularType", undefined);
+shouldBe("MyObject(0)", 1);
+shouldBe("MyObject()", undefined);
+shouldBe("typeof myObject", "object");
+shouldBe("MyObject ? 1 : 0", true); // toBoolean
+shouldBe("+MyObject", 1); // toNumber
+shouldBe("(Object.prototype.toString.call(MyObject))", "[object MyObject]"); // Object.prototype.toString
+shouldBe("(MyObject.toString())", "[object MyObject]"); // toString
+shouldBe("String(MyObject)", "MyObjectAsString"); // toString
+shouldBe("MyObject - 0", 1); // toNumber
+shouldBe("MyObject.valueOf()", 1); // valueOf
+
+shouldBe("typeof MyConstructor", "object");
+constructedObject = new MyConstructor(1);
+shouldBe("typeof constructedObject", "object");
+shouldBe("constructedObject.value", 1);
+shouldBe("myObject instanceof MyObject", true);
+shouldBe("(new Object()) instanceof MyObject", false);
+
+shouldThrow("new MyBadConstructor()");
+
+MyObject.nullGetSet = 1;
+shouldBe("MyObject.nullGetSet", 1);
+shouldThrow("MyObject.nullCall()");
+shouldThrow("MyObject.hasPropertyLie");
+
+derived = new Derived();
+
+shouldBe("derived instanceof Derived", true);
+shouldBe("derived instanceof Base", true);
+
+// base properties and functions return 1 when called/gotten; derived, 2
+shouldBe("derived.baseProtoDup()", 2);
+shouldBe("derived.baseProto()", 1);
+shouldBe("derived.baseDup", 2);
+shouldBe("derived.baseOnly", 1);
+shouldBe("derived.protoOnly()", 2);
+shouldBe("derived.protoDup", 2);
+shouldBe("derived.derivedOnly", 2)
+
+shouldBe("derived.baseHardNull()", undefined)
+
+// base properties throw 1 when set; derived, 2
+shouldBe("derived.baseDup = 0", 2);
+shouldBe("derived.baseOnly = 0", 1);
+shouldBe("derived.derivedOnly = 0", 2)
+shouldBe("derived.protoDup = 0", 2);
+
+derived2 = new Derived2();
+
+shouldBe("derived2 instanceof Derived2", true);
+shouldBe("derived2 instanceof Derived", true);
+shouldBe("derived2 instanceof Base", true);
+
+// base properties and functions return 1 when called/gotten; derived, 2
+shouldBe("derived2.baseProtoDup()", 2);
+shouldBe("derived2.baseProto()", 1);
+shouldBe("derived2.baseDup", 2);
+shouldBe("derived2.baseOnly", 1);
+shouldBe("derived2.protoOnly()", 2);
+shouldBe("derived2.protoDup", 2);
+shouldBe("derived2.derivedOnly", 2)
+
+// base properties throw 1 when set; derived, 2
+shouldBe("derived2.baseDup = 0", 2);
+shouldBe("derived2.baseOnly = 0", 1);
+shouldBe("derived2.derivedOnly = 0", 2)
+shouldBe("derived2.protoDup = 0", 2);
+
+shouldBe('Object.getOwnPropertyDescriptor(derived, "baseProto")', undefined);
+shouldBe('Object.getOwnPropertyDescriptor(derived, "baseProtoDup")', undefined);
+var baseDupDescriptor = Object.getOwnPropertyDescriptor(derived, "baseDup");
+shouldBe('typeof baseDupDescriptor', "object");
+shouldBe('baseDupDescriptor.value', derived.baseDup);
+shouldBe('baseDupDescriptor.configurable', true);
+shouldBe('baseDupDescriptor.enumerable', false);
+var baseOnlyDescriptor = Object.getOwnPropertyDescriptor(derived, "baseOnly");
+shouldBe('typeof baseOnlyDescriptor', "object");
+shouldBe('baseOnlyDescriptor.value', derived.baseOnly);
+shouldBe('baseOnlyDescriptor.configurable', true);
+shouldBe('baseOnlyDescriptor.enumerable', false);
+shouldBe('Object.getOwnPropertyDescriptor(derived, "protoOnly")', undefined);
+var protoDupDescriptor = Object.getOwnPropertyDescriptor(derived, "protoDup");
+shouldBe('typeof protoDupDescriptor', "object");
+shouldBe('protoDupDescriptor.value', derived.protoDup);
+shouldBe('protoDupDescriptor.configurable', true);
+shouldBe('protoDupDescriptor.enumerable', false);
+var derivedOnlyDescriptor = Object.getOwnPropertyDescriptor(derived, "derivedOnly");
+shouldBe('typeof derivedOnlyDescriptor', "object");
+shouldBe('derivedOnlyDescriptor.value', derived.derivedOnly);
+shouldBe('derivedOnlyDescriptor.configurable', true);
+shouldBe('derivedOnlyDescriptor.enumerable', false);
+
+shouldBe("undefined instanceof MyObject", false);
+EvilExceptionObject.hasInstance = function f() { return f(); };
+EvilExceptionObject.__proto__ = undefined;
+shouldThrow("undefined instanceof EvilExceptionObject");
+EvilExceptionObject.hasInstance = function () { return true; };
+shouldBe("undefined instanceof EvilExceptionObject", true);
+
+EvilExceptionObject.toNumber = function f() { return f(); }
+shouldThrow("EvilExceptionObject*5");
+EvilExceptionObject.toStringExplicit = function f() { return f(); }
+shouldThrow("String(EvilExceptionObject)");
+
+shouldBe("console", "[object Console]");
+shouldBe("typeof console.log", "function");
+
+shouldBe("EmptyObject", "[object CallbackObject]");
+
+for (var i = 0; i < 6; ++i)
+    PropertyCatchalls.x = i;
+shouldBe("PropertyCatchalls.x", 4);
+
+for (var i = 0; i < 6; ++i)
+    var x = PropertyCatchalls.x;
+shouldBe("x", null);
+var make_throw = 'make_throw';
+shouldThrow("PropertyCatchalls[make_throw]=1");
+make_throw = 0;
+shouldThrow("PropertyCatchalls[make_throw]=1");
+
+for (var i = 0; i < 10; ++i) {
+    for (var p in PropertyCatchalls) {
+        if (p == "x")
+            continue;
+        shouldBe("p", i % 10);
+        break;
+    }
+}
+
+PropertyCatchalls.__proto__ = { y: 1 };
+for (var i = 0; i < 6; ++i)
+    var y = PropertyCatchalls.y;
+shouldBe("y", null);
+
+var o = { __proto__: PropertyCatchalls };
+for (var i = 0; i < 6; ++i)
+    var z = PropertyCatchalls.z;
+shouldBe("z", null);
+
+if (failed)
+    throw "Some tests failed";
diff --git a/API/tests/testapi.mm b/API/tests/testapi.mm
new file mode 100644
index 0000000..bb69ad0
--- /dev/null
+++ b/API/tests/testapi.mm
@@ -0,0 +1,1523 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import <JavaScriptCore/JavaScriptCore.h>
+
+#import "CurrentThisInsideBlockGetterTest.h"
+#import "DateTests.h"
+#import "JSExportTests.h"
+#import "Regress141275.h"
+#import "Regress141809.h"
+
+#import <pthread.h>
+#import <vector>
+
+extern "C" void JSSynchronousGarbageCollectForDebugging(JSContextRef);
+extern "C" void JSSynchronousEdenCollectForDebugging(JSContextRef);
+
+extern "C" bool _Block_has_signature(id);
+extern "C" const char * _Block_signature(id);
+
+extern int failed;
+extern "C" void testObjectiveCAPI(void);
+extern "C" void checkResult(NSString *, bool);
+
+#if JSC_OBJC_API_ENABLED
+
+@interface UnexportedObject : NSObject
+@end
+
+@implementation UnexportedObject
+@end
+
+@protocol ParentObject <JSExport>
+@end
+
+@interface ParentObject : NSObject<ParentObject>
++ (NSString *)parentTest;
+@end
+
+@implementation ParentObject
++ (NSString *)parentTest
+{
+    return [self description];
+}
+@end
+
+@protocol TestObject <JSExport>
+- (id)init;
+@property int variable;
+@property (readonly) int six;
+@property CGPoint point;
++ (NSString *)classTest;
++ (NSString *)parentTest;
+- (NSString *)getString;
+JSExportAs(testArgumentTypes,
+- (NSString *)testArgumentTypesWithInt:(int)i double:(double)d boolean:(BOOL)b string:(NSString *)s number:(NSNumber *)n array:(NSArray *)a dictionary:(NSDictionary *)o
+);
+- (void)callback:(JSValue *)function;
+- (void)bogusCallback:(void(^)(int))function;
+@end
+
+@interface TestObject : ParentObject <TestObject>
+@property int six;
++ (id)testObject;
+@end
+
+@implementation TestObject
+@synthesize variable;
+@synthesize six;
+@synthesize point;
++ (id)testObject
+{
+    return [[TestObject alloc] init];
+}
++ (NSString *)classTest
+{
+    return @"classTest - okay";
+}
+- (NSString *)getString
+{
+    return @"42";
+}
+- (NSString *)testArgumentTypesWithInt:(int)i double:(double)d boolean:(BOOL)b string:(NSString *)s number:(NSNumber *)n array:(NSArray *)a dictionary:(NSDictionary *)o
+{
+    return [NSString stringWithFormat:@"%d,%g,%d,%@,%d,%@,%@", i, d, b==YES?true:false,s,[n intValue],a[1],o[@"x"]];
+}
+- (void)callback:(JSValue *)function
+{
+    [function callWithArguments:[NSArray arrayWithObject:[NSNumber numberWithInt:42]]];
+}
+- (void)bogusCallback:(void(^)(int))function
+{
+    function(42);
+}
+@end
+
+bool testXYZTested = false;
+
+@protocol TextXYZ <JSExport>
+- (id)initWithString:(NSString*)string;
+@property int x;
+@property (readonly) int y;
+@property (assign) JSValue *onclick;
+@property (assign) JSValue *weakOnclick;
+- (void)test:(NSString *)message;
+@end
+
+@interface TextXYZ : NSObject <TextXYZ>
+@property int x;
+@property int y;
+@property int z;
+- (void)click;
+@end
+
+@implementation TextXYZ {
+    JSManagedValue *m_weakOnclickHandler;
+    JSManagedValue *m_onclickHandler;
+}
+@synthesize x;
+@synthesize y;
+@synthesize z;
+- (id)initWithString:(NSString*)string
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    NSLog(@"%@", string);
+
+    return self;
+}
+- (void)test:(NSString *)message
+{
+    testXYZTested = [message isEqual:@"test"] && x == 13 & y == 4 && z == 5;
+}
+- (void)setWeakOnclick:(JSValue *)value
+{
+    m_weakOnclickHandler = [JSManagedValue managedValueWithValue:value];
+}
+
+- (void)setOnclick:(JSValue *)value
+{
+    m_onclickHandler = [JSManagedValue managedValueWithValue:value];
+    [value.context.virtualMachine addManagedReference:m_onclickHandler withOwner:self];
+}
+- (JSValue *)weakOnclick
+{
+    return [m_weakOnclickHandler value];
+}
+- (JSValue *)onclick
+{
+    return [m_onclickHandler value];
+}
+- (void)click
+{
+    if (!m_onclickHandler)
+        return;
+
+    JSValue *function = [m_onclickHandler value];
+    [function callWithArguments:[NSArray array]];
+}
+@end
+
+@class TinyDOMNode;
+
+@protocol TinyDOMNode <JSExport>
+- (void)appendChild:(TinyDOMNode *)child;
+- (NSUInteger)numberOfChildren;
+- (TinyDOMNode *)childAtIndex:(NSUInteger)index;
+- (void)removeChildAtIndex:(NSUInteger)index;
+@end
+
+@interface TinyDOMNode : NSObject<TinyDOMNode>
+@end
+
+@implementation TinyDOMNode {
+    NSMutableArray *m_children;
+    JSVirtualMachine *m_sharedVirtualMachine;
+}
+
+- (id)initWithVirtualMachine:(JSVirtualMachine *)virtualMachine
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    m_children = [[NSMutableArray alloc] initWithCapacity:0];
+    m_sharedVirtualMachine = virtualMachine;
+#if !__has_feature(objc_arc)
+    [m_sharedVirtualMachine retain];
+#endif
+
+    return self;
+}
+
+- (void)appendChild:(TinyDOMNode *)child
+{
+    [m_sharedVirtualMachine addManagedReference:child withOwner:self];
+    [m_children addObject:child];
+}
+
+- (NSUInteger)numberOfChildren
+{
+    return [m_children count];
+}
+
+- (TinyDOMNode *)childAtIndex:(NSUInteger)index
+{
+    if (index >= [m_children count])
+        return nil;
+    return [m_children objectAtIndex:index];
+}
+
+- (void)removeChildAtIndex:(NSUInteger)index
+{
+    if (index >= [m_children count])
+        return;
+    [m_sharedVirtualMachine removeManagedReference:[m_children objectAtIndex:index] withOwner:self];
+    [m_children removeObjectAtIndex:index];
+}
+
+@end
+
+@interface JSCollection : NSObject
+- (void)setValue:(JSValue *)value forKey:(NSString *)key;
+- (JSValue *)valueForKey:(NSString *)key;
+@end
+
+@implementation JSCollection {
+    NSMutableDictionary *_dict;
+}
+- (id)init
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _dict = [[NSMutableDictionary alloc] init];
+
+    return self;
+}
+
+- (void)setValue:(JSValue *)value forKey:(NSString *)key
+{
+    JSManagedValue *oldManagedValue = [_dict objectForKey:key];
+    if (oldManagedValue) {
+        JSValue* oldValue = [oldManagedValue value];
+        if (oldValue)
+            [oldValue.context.virtualMachine removeManagedReference:oldManagedValue withOwner:self];
+    }
+    JSManagedValue *managedValue = [JSManagedValue managedValueWithValue:value];
+    [value.context.virtualMachine addManagedReference:managedValue withOwner:self];
+    [_dict setObject:managedValue forKey:key];
+}
+
+- (JSValue *)valueForKey:(NSString *)key
+{
+    JSManagedValue *managedValue = [_dict objectForKey:key];
+    if (!managedValue)
+        return nil;
+    return [managedValue value];
+}
+@end
+
+@protocol InitA <JSExport>
+- (id)initWithA:(int)a;
+- (int)initialize;
+@end
+
+@protocol InitB <JSExport>
+- (id)initWithA:(int)a b:(int)b;
+@end
+
+@protocol InitC <JSExport>
+- (id)_init;
+@end
+
+@interface ClassA : NSObject<InitA>
+@end
+
+@interface ClassB : ClassA<InitB>
+@end
+
+@interface ClassC : ClassB<InitA, InitB>
+@end
+
+@interface ClassCPrime : ClassB<InitA, InitC>
+@end
+
+@interface ClassD : NSObject<InitA>
+- (id)initWithA:(int)a;
+@end
+
+@interface ClassE : ClassD
+- (id)initWithA:(int)a;
+@end
+
+@implementation ClassA {
+    int _a;
+}
+- (id)initWithA:(int)a
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _a = a;
+
+    return self;
+}
+- (int)initialize
+{
+    return 42;
+}
+@end
+
+@implementation ClassB {
+    int _b;
+}
+- (id)initWithA:(int)a b:(int)b
+{
+    self = [super initWithA:a];
+    if (!self)
+        return nil;
+
+    _b = b;
+
+    return self;
+}
+@end
+
+@implementation ClassC {
+    int _c;
+}
+- (id)initWithA:(int)a
+{
+    return [self initWithA:a b:0];
+}
+- (id)initWithA:(int)a b:(int)b
+{
+    self = [super initWithA:a b:b];
+    if (!self)
+        return nil;
+
+    _c = a + b;
+
+    return self;
+}
+@end
+
+@implementation ClassCPrime
+- (id)initWithA:(int)a
+{
+    self = [super initWithA:a b:0];
+    if (!self)
+        return nil;
+    return self;
+}
+- (id)_init
+{
+    return [self initWithA:42];
+}
+@end
+
+@implementation ClassD
+
+- (id)initWithA:(int)a
+{
+    self = nil;
+    return [[ClassE alloc] initWithA:a];
+}
+- (int)initialize
+{
+    return 0;
+}
+@end
+
+@implementation ClassE {
+    int _a;
+}
+
+- (id)initWithA:(int)a
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    _a = a;
+
+    return self;
+}
+@end
+
+static bool evilAllocationObjectWasDealloced = false;
+
+@interface EvilAllocationObject : NSObject
+- (JSValue *)doEvilThingsWithContext:(JSContext *)context;
+@end
+
+@implementation EvilAllocationObject {
+    JSContext *m_context;
+}
+- (id)initWithContext:(JSContext *)context
+{
+    self = [super init];
+    if (!self)
+        return nil;
+
+    m_context = context;
+
+    return self;
+}
+- (void)dealloc
+{
+    [self doEvilThingsWithContext:m_context];
+    evilAllocationObjectWasDealloced = true;
+#if !__has_feature(objc_arc)
+    [super dealloc];
+#endif
+}
+
+- (JSValue *)doEvilThingsWithContext:(JSContext *)context
+{
+    JSValue *result = [context evaluateScript:@" \
+        (function() { \
+            var a = []; \
+            var sum = 0; \
+            for (var i = 0; i < 10000; ++i) { \
+                sum += i; \
+                a[i] = sum; \
+            } \
+            return sum; \
+        })()"];
+
+    JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+    return result;
+}
+@end
+
+extern "C" void checkResult(NSString *description, bool passed)
+{
+    NSLog(@"TEST: \"%@\": %@", description, passed ? @"PASSED" : @"FAILED");
+    if (!passed)
+        failed = 1;
+}
+
+static bool blockSignatureContainsClass()
+{
+    static bool containsClass = ^{
+        id block = ^(NSString *string){ return string; };
+        return _Block_has_signature(block) && strstr(_Block_signature(block), "NSString");
+    }();
+    return containsClass;
+}
+
+static void* threadMain(void* contextPtr)
+{
+    JSContext *context = (__bridge JSContext*)contextPtr;
+
+    // Do something to enter the VM.
+    TestObject *testObject = [TestObject testObject];
+    context[@"testObject"] = testObject;
+    return nullptr;
+}
+
+static void* multiVMThreadMain(void* okPtr)
+{
+    bool& ok = *static_cast<bool*>(okPtr);
+    JSVirtualMachine *vm = [[JSVirtualMachine alloc] init];
+    JSContext* context = [[JSContext alloc] initWithVirtualMachine:vm];
+    [context evaluateScript:
+        @"var array = [{}];\n"
+         "for (var i = 0; i < 20; ++i) {\n"
+         "    var newArray = new Array(array.length * 2);\n"
+         "    for (var j = 0; j < newArray.length; ++j)\n"
+         "        newArray[j] = {parent: array[j / 2]};\n"
+         "    array = newArray;\n"
+         "}\n"];
+    if (context.exception) {
+        NSLog(@"Uncaught exception.\n");
+        ok = false;
+    }
+    if (![context.globalObject valueForProperty:@"array"].toObject) {
+        NSLog(@"Did not find \"array\" variable.\n");
+        ok = false;
+    }
+    JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+    return nullptr;
+}
+
+static void testObjectiveCAPIMain()
+{
+    @autoreleasepool {
+        JSVirtualMachine* vm = [[JSVirtualMachine alloc] init];
+        JSContext* context = [[JSContext alloc] initWithVirtualMachine:vm];
+        [context evaluateScript:@"bad"];
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *result = [context evaluateScript:@"2 + 2"];
+        checkResult(@"2 + 2", result.isNumber && [result toInt32] == 4);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        NSString *result = [NSString stringWithFormat:@"Two plus two is %@", [context evaluateScript:@"2 + 2"]];
+        checkResult(@"stringWithFormat", [result isEqual:@"Two plus two is 4"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"message"] = @"Hello";
+        JSValue *result = [context evaluateScript:@"message + ', World!'"];
+        checkResult(@"Hello, World!", result.isString && [result isEqualToObject:@"Hello, World!"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        checkResult(@"Promise is exposed", ![context[@"Promise"] isUndefined]);
+        JSValue *result = [context evaluateScript:@"typeof Promise"];
+        checkResult(@"typeof Promise is 'function'", result.isString && [result isEqualToObject:@"function"]);
+    }
+
+    @autoreleasepool {
+        JSVirtualMachine* vm = [[JSVirtualMachine alloc] init];
+        JSContext* context = [[JSContext alloc] initWithVirtualMachine:vm];
+        [context evaluateScript:@"result = 0; Promise.resolve(42).then(function (value) { result = value; });"];
+        checkResult(@"Microtask is drained", [context[@"result"]  isEqualToObject:@42]);
+    }
+
+    @autoreleasepool {
+        JSVirtualMachine* vm = [[JSVirtualMachine alloc] init];
+        JSContext* context = [[JSContext alloc] initWithVirtualMachine:vm];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        [context evaluateScript:@"result = 0; callbackResult = 0; Promise.resolve(42).then(function (value) { result = value; }); callbackResult = testObject.getString();"];
+        checkResult(@"Microtask is drained with same VM", [context[@"result"]  isEqualToObject:@42] && [context[@"callbackResult"] isEqualToObject:@"42"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *result = [context evaluateScript:@"({ x:42 })"];
+        checkResult(@"({ x:42 })", result.isObject && [result[@"x"] isEqualToObject:@42]);
+        id obj = [result toObject];
+        checkResult(@"Check dictionary literal", [obj isKindOfClass:[NSDictionary class]]);
+        id num = (NSDictionary *)obj[@"x"];
+        checkResult(@"Check numeric literal", [num isKindOfClass:[NSNumber class]]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *result = [context evaluateScript:@"[ ]"];
+        checkResult(@"[ ]", result.isArray);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *result = [context evaluateScript:@"new Date"];
+        checkResult(@"new Date", result.isDate);
+    }
+
+    @autoreleasepool {
+        JSCollection* myPrivateProperties = [[JSCollection alloc] init];
+
+        @autoreleasepool {
+            JSContext* context = [[JSContext alloc] init];
+            TestObject* rootObject = [TestObject testObject];
+            context[@"root"] = rootObject;
+            [context.virtualMachine addManagedReference:myPrivateProperties withOwner:rootObject];
+            [myPrivateProperties setValue:[JSValue valueWithBool:true inContext:context] forKey:@"is_ham"];
+            [myPrivateProperties setValue:[JSValue valueWithObject:@"hello!" inContext:context] forKey:@"message"];
+            [myPrivateProperties setValue:[JSValue valueWithInt32:42 inContext:context] forKey:@"my_number"];
+            [myPrivateProperties setValue:[JSValue valueWithNullInContext:context] forKey:@"definitely_null"];
+            [myPrivateProperties setValue:[JSValue valueWithUndefinedInContext:context] forKey:@"not_sure_if_undefined"];
+
+            JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+
+            JSValue *isHam = [myPrivateProperties valueForKey:@"is_ham"];
+            JSValue *message = [myPrivateProperties valueForKey:@"message"];
+            JSValue *myNumber = [myPrivateProperties valueForKey:@"my_number"];
+            JSValue *definitelyNull = [myPrivateProperties valueForKey:@"definitely_null"];
+            JSValue *notSureIfUndefined = [myPrivateProperties valueForKey:@"not_sure_if_undefined"];
+            checkResult(@"is_ham is true", isHam.isBoolean && [isHam toBool]);
+            checkResult(@"message is hello!", message.isString && [@"hello!" isEqualToString:[message toString]]);
+            checkResult(@"my_number is 42", myNumber.isNumber && [myNumber toInt32] == 42);
+            checkResult(@"definitely_null is null", definitelyNull.isNull);
+            checkResult(@"not_sure_if_undefined is undefined", notSureIfUndefined.isUndefined);
+        }
+
+        checkResult(@"is_ham is nil", ![myPrivateProperties valueForKey:@"is_ham"]);
+        checkResult(@"message is nil", ![myPrivateProperties valueForKey:@"message"]);
+        checkResult(@"my_number is 42", ![myPrivateProperties valueForKey:@"my_number"]);
+        checkResult(@"definitely_null is null", ![myPrivateProperties valueForKey:@"definitely_null"]);
+        checkResult(@"not_sure_if_undefined is undefined", ![myPrivateProperties valueForKey:@"not_sure_if_undefined"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *message = [JSValue valueWithObject:@"hello" inContext:context];
+        TestObject *rootObject = [TestObject testObject];
+        JSCollection *collection = [[JSCollection alloc] init];
+        context[@"root"] = rootObject;
+        @autoreleasepool {
+            JSValue *jsCollection = [JSValue valueWithObject:collection inContext:context];
+            JSManagedValue *weakCollection = [JSManagedValue managedValueWithValue:jsCollection andOwner:rootObject];
+            [context.virtualMachine addManagedReference:weakCollection withOwner:message];
+            JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+        }
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        __block int result;
+        context[@"blockCallback"] = ^(int value){
+            result = value;
+        };
+        [context evaluateScript:@"blockCallback(42)"];
+        checkResult(@"blockCallback", result == 42);
+    }
+
+    if (blockSignatureContainsClass()) {
+        @autoreleasepool {
+            JSContext *context = [[JSContext alloc] init];
+            __block bool result = false;
+            context[@"blockCallback"] = ^(NSString *value){
+                result = [@"42" isEqualToString:value] == YES;
+            };
+            [context evaluateScript:@"blockCallback(42)"];
+            checkResult(@"blockCallback(NSString *)", result);
+        }
+    } else
+        NSLog(@"Skipping 'blockCallback(NSString *)' test case");
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        checkResult(@"!context.exception", !context.exception);
+        [context evaluateScript:@"!@#$%^&*() THIS IS NOT VALID JAVASCRIPT SYNTAX !@#$%^&*()"];
+        checkResult(@"context.exception", context.exception);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        __block bool caught = false;
+        context.exceptionHandler = ^(JSContext *context, JSValue *exception) {
+            (void)context;
+            (void)exception;
+            caught = true;
+        };
+        [context evaluateScript:@"!@#$%^&*() THIS IS NOT VALID JAVASCRIPT SYNTAX !@#$%^&*()"];
+        checkResult(@"JSContext.exceptionHandler", caught);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        __block int expectedExceptionLineNumber = 1;
+        __block bool sawExpectedExceptionLineNumber = false;
+        context.exceptionHandler = ^(JSContext *, JSValue *exception) {
+            sawExpectedExceptionLineNumber = [exception[@"line"] toInt32] == expectedExceptionLineNumber;
+        };
+        [context evaluateScript:@"!@#$%^&*() THIS IS NOT VALID JAVASCRIPT SYNTAX !@#$%^&*()"];
+        checkResult(@"evaluteScript exception on line 1", sawExpectedExceptionLineNumber);
+
+        expectedExceptionLineNumber = 2;
+        sawExpectedExceptionLineNumber = false;
+        [context evaluateScript:@"// Line 1\n!@#$%^&*() THIS IS NOT VALID JAVASCRIPT SYNTAX !@#$%^&*()"];
+        checkResult(@"evaluteScript exception on line 2", sawExpectedExceptionLineNumber);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        __block bool emptyExceptionSourceURL = false;
+        context.exceptionHandler = ^(JSContext *, JSValue *exception) {
+            emptyExceptionSourceURL = exception[@"sourceURL"].isUndefined;
+        };
+        [context evaluateScript:@"!@#$%^&*() THIS IS NOT VALID JAVASCRIPT SYNTAX !@#$%^&*()"];
+        checkResult(@"evaluteScript: exception has no sourceURL", emptyExceptionSourceURL);
+
+        __block NSString *exceptionSourceURL = nil;
+        context.exceptionHandler = ^(JSContext *, JSValue *exception) {
+            exceptionSourceURL = [exception[@"sourceURL"] toString];
+        };
+        NSURL *url = [NSURL fileURLWithPath:@"/foo/bar.js"];
+        [context evaluateScript:@"!@#$%^&*() THIS IS NOT VALID JAVASCRIPT SYNTAX !@#$%^&*()" withSourceURL:url];
+        checkResult(@"evaluateScript:withSourceURL: exception has expected sourceURL", [exceptionSourceURL isEqualToString:[url absoluteString]]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"callback"] = ^{
+            JSContext *context = [JSContext currentContext];
+            context.exception = [JSValue valueWithNewErrorFromMessage:@"Something went wrong." inContext:context];
+        };
+        JSValue *result = [context evaluateScript:@"var result; try { callback(); } catch (e) { result = 'Caught exception'; }"];
+        checkResult(@"Explicit throw in callback - was caught by JavaScript", [result isEqualToObject:@"Caught exception"]);
+        checkResult(@"Explicit throw in callback - not thrown to Objective-C", !context.exception);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"callback"] = ^{
+            JSContext *context = [JSContext currentContext];
+            [context evaluateScript:@"!@#$%^&*() THIS IS NOT VALID JAVASCRIPT SYNTAX !@#$%^&*()"];
+        };
+        JSValue *result = [context evaluateScript:@"var result; try { callback(); } catch (e) { result = 'Caught exception'; }"];
+        checkResult(@"Implicit throw in callback - was caught by JavaScript", [result isEqualToObject:@"Caught exception"]);
+        checkResult(@"Implicit throw in callback - not thrown to Objective-C", !context.exception);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        [context evaluateScript:
+            @"function sum(array) { \
+                var result = 0; \
+                for (var i in array) \
+                    result += array[i]; \
+                return result; \
+            }"];
+        JSValue *array = [JSValue valueWithObject:@[@13, @2, @7] inContext:context];
+        JSValue *sumFunction = context[@"sum"];
+        JSValue *result = [sumFunction callWithArguments:@[ array ]];
+        checkResult(@"sum([13, 2, 7])", [result toInt32] == 22);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *mulAddFunction = [context evaluateScript:
+            @"(function(array, object) { \
+                var result = []; \
+                for (var i in array) \
+                    result.push(array[i] * object.x + object.y); \
+                return result; \
+            })"];
+        JSValue *result = [mulAddFunction callWithArguments:@[ @[ @2, @4, @8 ], @{ @"x":@0.5, @"y":@42 } ]];
+        checkResult(@"mulAddFunction", result.isObject && [[result toString] isEqual:@"43,44,46"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];        
+        JSValue *array = [JSValue valueWithNewArrayInContext:context];
+        checkResult(@"arrayLengthEmpty", [[array[@"length"] toNumber] unsignedIntegerValue] == 0);
+        JSValue *value1 = [JSValue valueWithInt32:42 inContext:context];
+        JSValue *value2 = [JSValue valueWithInt32:24 inContext:context];
+        NSUInteger lowIndex = 5;
+        NSUInteger maxLength = UINT_MAX;
+
+        [array setValue:value1 atIndex:lowIndex];
+        checkResult(@"array.length after put to low index", [[array[@"length"] toNumber] unsignedIntegerValue] == (lowIndex + 1));
+
+        [array setValue:value1 atIndex:(maxLength - 1)];
+        checkResult(@"array.length after put to maxLength - 1", [[array[@"length"] toNumber] unsignedIntegerValue] == maxLength);
+
+        [array setValue:value2 atIndex:maxLength];
+        checkResult(@"array.length after put to maxLength", [[array[@"length"] toNumber] unsignedIntegerValue] == maxLength);
+
+        [array setValue:value2 atIndex:(maxLength + 1)];
+        checkResult(@"array.length after put to maxLength + 1", [[array[@"length"] toNumber] unsignedIntegerValue] == maxLength);
+
+        if (sizeof(NSUInteger) == 8)
+            checkResult(@"valueAtIndex:0 is undefined", [array valueAtIndex:0].isUndefined);
+        else
+            checkResult(@"valueAtIndex:0", [[array valueAtIndex:0] toInt32] == 24);
+        checkResult(@"valueAtIndex:lowIndex", [[array valueAtIndex:lowIndex] toInt32] == 42);
+        checkResult(@"valueAtIndex:maxLength - 1", [[array valueAtIndex:(maxLength - 1)] toInt32] == 42);
+        checkResult(@"valueAtIndex:maxLength", [[array valueAtIndex:maxLength] toInt32] == 24);
+        checkResult(@"valueAtIndex:maxLength + 1", [[array valueAtIndex:(maxLength + 1)] toInt32] == 24);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *object = [JSValue valueWithNewObjectInContext:context];
+
+        object[@"point"] = @{ @"x":@1, @"y":@2 };
+        object[@"point"][@"x"] = @3;
+        CGPoint point = [object[@"point"] toPoint];
+        checkResult(@"toPoint", point.x == 3 && point.y == 2);
+
+        object[@{ @"toString":^{ return @"foo"; } }] = @"bar";
+        checkResult(@"toString in object literal used as subscript", [[object[@"foo"] toString] isEqual:@"bar"]);
+
+        object[[@"foobar" substringToIndex:3]] = @"bar";
+        checkResult(@"substring used as subscript", [[object[@"foo"] toString] isEqual:@"bar"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TextXYZ *testXYZ = [[TextXYZ alloc] init];
+        context[@"testXYZ"] = testXYZ;
+        testXYZ.x = 3;
+        testXYZ.y = 4;
+        testXYZ.z = 5;
+        [context evaluateScript:@"testXYZ.x = 13; testXYZ.y = 14;"];
+        [context evaluateScript:@"testXYZ.test('test')"];
+        checkResult(@"TextXYZ - testXYZTested", testXYZTested);
+        JSValue *result = [context evaluateScript:@"testXYZ.x + ',' + testXYZ.y + ',' + testXYZ.z"];
+        checkResult(@"TextXYZ - result", [result isEqualToObject:@"13,4,undefined"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        [context[@"Object"][@"prototype"] defineProperty:@"getterProperty" descriptor:@{
+            JSPropertyDescriptorGetKey:^{
+                return [JSContext currentThis][@"x"];
+            }
+        }];
+        JSValue *object = [JSValue valueWithObject:@{ @"x":@101 } inContext:context];
+        int result = [object [@"getterProperty"] toInt32];
+        checkResult(@"getterProperty", result == 101);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"concatenate"] = ^{
+            NSArray *arguments = [JSContext currentArguments];
+            if (![arguments count])
+                return @"";
+            NSString *message = [arguments[0] description];
+            for (NSUInteger index = 1; index < [arguments count]; ++index)
+                message = [NSString stringWithFormat:@"%@ %@", message, arguments[index]];
+            return message;
+        };
+        JSValue *result = [context evaluateScript:@"concatenate('Hello,', 'World!')"];
+        checkResult(@"concatenate", [result isEqualToObject:@"Hello, World!"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"foo"] = @YES;
+        checkResult(@"@YES is boolean", [context[@"foo"] isBoolean]);
+        JSValue *result = [context evaluateScript:@"typeof foo"];
+        checkResult(@"@YES is boolean", [result isEqualToObject:@"boolean"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *result = [context evaluateScript:@"String(console)"];
+        checkResult(@"String(console)", [result isEqualToObject:@"[object Console]"]);
+        result = [context evaluateScript:@"typeof console.log"];
+        checkResult(@"typeof console.log", [result isEqualToObject:@"function"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        JSValue *result = [context evaluateScript:@"String(testObject)"];
+        checkResult(@"String(testObject)", [result isEqualToObject:@"[object TestObject]"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        JSValue *result = [context evaluateScript:@"String(testObject.__proto__)"];
+        checkResult(@"String(testObject.__proto__)", [result isEqualToObject:@"[object TestObjectPrototype]"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"TestObject"] = [TestObject class];
+        JSValue *result = [context evaluateScript:@"String(TestObject)"];
+        checkResult(@"String(TestObject)", [result isEqualToObject:@"function TestObject() {\n    [native code]\n}"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue* value = [JSValue valueWithObject:[TestObject class] inContext:context];
+        checkResult(@"[value toObject] == [TestObject class]", [value toObject] == [TestObject class]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"TestObject"] = [TestObject class];
+        JSValue *result = [context evaluateScript:@"TestObject.parentTest()"];
+        checkResult(@"TestObject.parentTest()", [result isEqualToObject:@"TestObject"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObjectA"] = testObject;
+        context[@"testObjectB"] = testObject;
+        JSValue *result = [context evaluateScript:@"testObjectA == testObjectB"];
+        checkResult(@"testObjectA == testObjectB", result.isBoolean && [result toBool]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        testObject.point = (CGPoint){3,4};
+        JSValue *result = [context evaluateScript:@"var result = JSON.stringify(testObject.point); testObject.point = {x:12,y:14}; result"];
+        checkResult(@"testObject.point - result", [result isEqualToObject:@"{\"x\":3,\"y\":4}"]);
+        checkResult(@"testObject.point - {x:12,y:14}", testObject.point.x == 12 && testObject.point.y == 14);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        testObject.six = 6;
+        context[@"testObject"] = testObject;
+        context[@"mul"] = ^(int x, int y){ return x * y; };
+        JSValue *result = [context evaluateScript:@"mul(testObject.six, 7)"];
+        checkResult(@"mul(testObject.six, 7)", result.isNumber && [result toInt32] == 42);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        context[@"testObject"][@"variable"] = @4;
+        [context evaluateScript:@"++testObject.variable"];
+        checkResult(@"++testObject.variable", testObject.variable == 5);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"point"] = @{ @"x":@6, @"y":@7 };
+        JSValue *result = [context evaluateScript:@"point.x + ',' + point.y"];
+        checkResult(@"point.x + ',' + point.y", [result isEqualToObject:@"6,7"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"point"] = @{ @"x":@6, @"y":@7 };
+        JSValue *result = [context evaluateScript:@"point.x + ',' + point.y"];
+        checkResult(@"point.x + ',' + point.y", [result isEqualToObject:@"6,7"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        JSValue *result = [context evaluateScript:@"testObject.getString()"];
+        checkResult(@"testObject.getString()", result.isString && [result toInt32] == 42);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        JSValue *result = [context evaluateScript:@"testObject.testArgumentTypes(101,0.5,true,'foo',666,[false,'bar',false],{x:'baz'})"];
+        checkResult(@"testObject.testArgumentTypes", [result isEqualToObject:@"101,0.5,1,foo,666,bar,baz"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        JSValue *result = [context evaluateScript:@"testObject.getString.call(testObject)"];
+        checkResult(@"testObject.getString.call(testObject)", result.isString && [result toInt32] == 42);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        checkResult(@"testObject.getString.call({}) pre", !context.exception);
+        [context evaluateScript:@"testObject.getString.call({})"];
+        checkResult(@"testObject.getString.call({}) post", context.exception);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject* testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        JSValue *result = [context evaluateScript:@"var result = 0; testObject.callback(function(x){ result = x; }); result"];
+        checkResult(@"testObject.callback", result.isNumber && [result toInt32] == 42);
+        result = [context evaluateScript:@"testObject.bogusCallback"];
+        checkResult(@"testObject.bogusCallback == undefined", result.isUndefined);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject *testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        JSValue *result = [context evaluateScript:@"Function.prototype.toString.call(testObject.callback)"];
+        checkResult(@"Function.prototype.toString", !context.exception && !result.isUndefined);
+    }
+
+    @autoreleasepool {
+        JSContext *context1 = [[JSContext alloc] init];
+        JSContext *context2 = [[JSContext alloc] initWithVirtualMachine:context1.virtualMachine];
+        JSValue *value = [JSValue valueWithDouble:42 inContext:context2];
+        context1[@"passValueBetweenContexts"] = value;
+        JSValue *result = [context1 evaluateScript:@"passValueBetweenContexts"];
+        checkResult(@"[value isEqualToObject:result]", [value isEqualToObject:result]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"handleTheDictionary"] = ^(NSDictionary *dict) {
+            NSDictionary *expectedDict = @{
+                @"foo" : [NSNumber numberWithInt:1],
+                @"bar" : @{
+                    @"baz": [NSNumber numberWithInt:2]
+                }
+            };
+            checkResult(@"recursively convert nested dictionaries", [dict isEqualToDictionary:expectedDict]);
+        };
+        [context evaluateScript:@"var myDict = { \
+            'foo': 1, \
+            'bar': {'baz': 2} \
+        }; \
+        handleTheDictionary(myDict);"];
+
+        context[@"handleTheArray"] = ^(NSArray *array) {
+            NSArray *expectedArray = @[@"foo", @"bar", @[@"baz"]];
+            checkResult(@"recursively convert nested arrays", [array isEqualToArray:expectedArray]);
+        };
+        [context evaluateScript:@"var myArray = ['foo', 'bar', ['baz']]; handleTheArray(myArray);"];
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject *testObject = [TestObject testObject];
+        @autoreleasepool {
+            context[@"testObject"] = testObject;
+            [context evaluateScript:@"var constructor = Object.getPrototypeOf(testObject).constructor; constructor.prototype = undefined;"];
+            [context evaluateScript:@"testObject = undefined"];
+        }
+        
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+
+        @autoreleasepool {
+            context[@"testObject"] = testObject;
+        }
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TextXYZ *testXYZ = [[TextXYZ alloc] init];
+
+        @autoreleasepool {
+            context[@"testXYZ"] = testXYZ;
+
+            [context evaluateScript:@" \
+                didClick = false; \
+                testXYZ.onclick = function() { \
+                    didClick = true; \
+                }; \
+                 \
+                testXYZ.weakOnclick = function() { \
+                    return 'foo'; \
+                }; \
+            "];
+        }
+
+        @autoreleasepool {
+            [testXYZ click];
+            JSValue *result = [context evaluateScript:@"didClick"];
+            checkResult(@"Event handler onclick", [result toBool]);
+        }
+
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+
+        @autoreleasepool {
+            JSValue *result = [context evaluateScript:@"testXYZ.onclick"];
+            checkResult(@"onclick still around after GC", !(result.isNull || result.isUndefined));
+        }
+
+
+        @autoreleasepool {
+            JSValue *result = [context evaluateScript:@"testXYZ.weakOnclick"];
+            checkResult(@"weakOnclick not around after GC", result.isNull || result.isUndefined);
+        }
+
+        @autoreleasepool {
+            [context evaluateScript:@" \
+                didClick = false; \
+                testXYZ = null; \
+            "];
+        }
+
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+
+        @autoreleasepool {
+            [testXYZ click];
+            JSValue *result = [context evaluateScript:@"didClick"];
+            checkResult(@"Event handler onclick doesn't fire", ![result toBool]);
+        }
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TinyDOMNode *root = [[TinyDOMNode alloc] initWithVirtualMachine:context.virtualMachine];
+        TinyDOMNode *lastNode = root;
+        for (NSUInteger i = 0; i < 3; i++) {
+            TinyDOMNode *newNode = [[TinyDOMNode alloc] initWithVirtualMachine:context.virtualMachine];
+            [lastNode appendChild:newNode];
+            lastNode = newNode;
+        }
+
+        @autoreleasepool {
+            context[@"root"] = root;
+            context[@"getLastNodeInChain"] = ^(TinyDOMNode *head){
+                TinyDOMNode *lastNode = nil;
+                while (head) {
+                    lastNode = head;
+                    head = [lastNode childAtIndex:0];
+                }
+                return lastNode;
+            };
+            [context evaluateScript:@"getLastNodeInChain(root).myCustomProperty = 42;"];
+        }
+
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+
+        JSValue *myCustomProperty = [context evaluateScript:@"getLastNodeInChain(root).myCustomProperty"];
+        checkResult(@"My custom property == 42", myCustomProperty.isNumber && [myCustomProperty toInt32] == 42);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TinyDOMNode *root = [[TinyDOMNode alloc] initWithVirtualMachine:context.virtualMachine];
+        TinyDOMNode *lastNode = root;
+        for (NSUInteger i = 0; i < 3; i++) {
+            TinyDOMNode *newNode = [[TinyDOMNode alloc] initWithVirtualMachine:context.virtualMachine];
+            [lastNode appendChild:newNode];
+            lastNode = newNode;
+        }
+
+        @autoreleasepool {
+            context[@"root"] = root;
+            context[@"getLastNodeInChain"] = ^(TinyDOMNode *head){
+                TinyDOMNode *lastNode = nil;
+                while (head) {
+                    lastNode = head;
+                    head = [lastNode childAtIndex:0];
+                }
+                return lastNode;
+            };
+            [context evaluateScript:@"getLastNodeInChain(root).myCustomProperty = 42;"];
+
+            [root appendChild:[root childAtIndex:0]];
+            [root removeChildAtIndex:0];
+        }
+
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+
+        JSValue *myCustomProperty = [context evaluateScript:@"getLastNodeInChain(root).myCustomProperty"];
+        checkResult(@"duplicate calls to addManagedReference don't cause things to die", myCustomProperty.isNumber && [myCustomProperty toInt32] == 42);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        JSValue *o = [JSValue valueWithNewObjectInContext:context];
+        o[@"foo"] = @"foo";
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+
+        checkResult(@"JSValue correctly protected its internal value", [[o[@"foo"] toString] isEqualToString:@"foo"]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject *testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        [context evaluateScript:@"testObject.__lookupGetter__('variable').call({})"];
+        checkResult(@"Make sure we throw an exception when calling getter on incorrect |this|", context.exception);
+    }
+
+    @autoreleasepool {
+        static const unsigned count = 100;
+        NSMutableArray *array = [NSMutableArray arrayWithCapacity:count];
+        JSContext *context = [[JSContext alloc] init];
+        @autoreleasepool {
+            for (unsigned i = 0; i < count; ++i) {
+                JSValue *object = [JSValue valueWithNewObjectInContext:context];
+                JSManagedValue *managedObject = [JSManagedValue managedValueWithValue:object];
+                [array addObject:managedObject];
+            }
+        }
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+        for (unsigned i = 0; i < count; ++i)
+            [context.virtualMachine addManagedReference:array[i] withOwner:array];
+    }
+
+    @autoreleasepool {
+        TestObject *testObject = [TestObject testObject];
+        JSManagedValue *managedTestObject;
+        @autoreleasepool {
+            JSContext *context = [[JSContext alloc] init];
+            context[@"testObject"] = testObject;
+            managedTestObject = [JSManagedValue managedValueWithValue:context[@"testObject"]];
+            [context.virtualMachine addManagedReference:managedTestObject withOwner:testObject];
+        }
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        TestObject *testObject = [TestObject testObject];
+        context[@"testObject"] = testObject;
+        JSManagedValue *managedValue = nil;
+        @autoreleasepool {
+            JSValue *object = [JSValue valueWithNewObjectInContext:context];
+            managedValue = [JSManagedValue managedValueWithValue:object andOwner:testObject];
+            [context.virtualMachine addManagedReference:managedValue withOwner:testObject];
+        }
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"MyClass"] = ^{
+            JSValue *newThis = [JSValue valueWithNewObjectInContext:[JSContext currentContext]];
+            JSGlobalContextRef contextRef = [[JSContext currentContext] JSGlobalContextRef];
+            JSObjectRef newThisRef = JSValueToObject(contextRef, [newThis JSValueRef], NULL);
+            JSObjectSetPrototype(contextRef, newThisRef, [[JSContext currentContext][@"MyClass"][@"prototype"] JSValueRef]);
+            return newThis;
+        };
+
+        context[@"MyOtherClass"] = ^{
+            JSValue *newThis = [JSValue valueWithNewObjectInContext:[JSContext currentContext]];
+            JSGlobalContextRef contextRef = [[JSContext currentContext] JSGlobalContextRef];
+            JSObjectRef newThisRef = JSValueToObject(contextRef, [newThis JSValueRef], NULL);
+            JSObjectSetPrototype(contextRef, newThisRef, [[JSContext currentContext][@"MyOtherClass"][@"prototype"] JSValueRef]);
+            return newThis;
+        };
+
+        context.exceptionHandler = ^(JSContext *context, JSValue *exception) {
+            NSLog(@"EXCEPTION: %@", [exception toString]);
+            context.exception = nil;
+        };
+
+        JSValue *constructor1 = context[@"MyClass"];
+        JSValue *constructor2 = context[@"MyOtherClass"];
+
+        JSValue *value1 = [context evaluateScript:@"new MyClass()"];
+        checkResult(@"value1 instanceof MyClass", [value1 isInstanceOf:constructor1]);
+        checkResult(@"!(value1 instanceof MyOtherClass)", ![value1 isInstanceOf:constructor2]);
+        checkResult(@"MyClass.prototype.constructor === MyClass", [[context evaluateScript:@"MyClass.prototype.constructor === MyClass"] toBool]);
+        checkResult(@"MyClass instanceof Function", [[context evaluateScript:@"MyClass instanceof Function"] toBool]);
+
+        JSValue *value2 = [context evaluateScript:@"new MyOtherClass()"];
+        checkResult(@"value2 instanceof MyOtherClass", [value2 isInstanceOf:constructor2]);
+        checkResult(@"!(value2 instanceof MyClass)", ![value2 isInstanceOf:constructor1]);
+        checkResult(@"MyOtherClass.prototype.constructor === MyOtherClass", [[context evaluateScript:@"MyOtherClass.prototype.constructor === MyOtherClass"] toBool]);
+        checkResult(@"MyOtherClass instanceof Function", [[context evaluateScript:@"MyOtherClass instanceof Function"] toBool]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"MyClass"] = ^{
+            NSLog(@"I'm intentionally not returning anything.");
+        };
+        JSValue *result = [context evaluateScript:@"new MyClass()"];
+        checkResult(@"result === undefined", result.isUndefined);
+        checkResult(@"exception.message is correct'", context.exception 
+            && [@"Objective-C blocks called as constructors must return an object." isEqualToString:[context.exception[@"message"] toString]]);
+    }
+
+    @autoreleasepool {
+        checkResult(@"[JSContext currentThis] == nil outside of callback", ![JSContext currentThis]);
+        checkResult(@"[JSContext currentArguments] == nil outside of callback", ![JSContext currentArguments]);
+        if ([JSContext currentCallee])
+            checkResult(@"[JSContext currentCallee] == nil outside of callback", ![JSContext currentCallee]);
+    }
+
+    if ([JSContext currentCallee]) {
+        @autoreleasepool {
+            JSContext *context = [[JSContext alloc] init];
+            context[@"testFunction"] = ^{
+                checkResult(@"testFunction.foo === 42", [[JSContext currentCallee][@"foo"] toInt32] == 42);
+            };
+            context[@"testFunction"][@"foo"] = @42;
+            [context[@"testFunction"] callWithArguments:nil];
+
+            context[@"TestConstructor"] = ^{
+                JSValue *newThis = [JSValue valueWithNewObjectInContext:[JSContext currentContext]];
+                JSGlobalContextRef contextRef = [[JSContext currentContext] JSGlobalContextRef];
+                JSObjectRef newThisRef = JSValueToObject(contextRef, [newThis JSValueRef], NULL);
+                JSObjectSetPrototype(contextRef, newThisRef, [[JSContext currentCallee][@"prototype"] JSValueRef]);
+                return newThis;
+            };
+            checkResult(@"(new TestConstructor) instanceof TestConstructor", [context evaluateScript:@"(new TestConstructor) instanceof TestConstructor"]);
+        }
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"TestObject"] = [TestObject class];
+        JSValue *testObject = [context evaluateScript:@"(new TestObject())"];
+        checkResult(@"testObject instanceof TestObject", [testObject isInstanceOf:context[@"TestObject"]]);
+
+        context[@"TextXYZ"] = [TextXYZ class];
+        JSValue *textObject = [context evaluateScript:@"(new TextXYZ(\"Called TextXYZ constructor!\"))"];
+        checkResult(@"textObject instanceof TextXYZ", [textObject isInstanceOf:context[@"TextXYZ"]]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"ClassA"] = [ClassA class];
+        context[@"ClassB"] = [ClassB class];
+        context[@"ClassC"] = [ClassC class]; // Should print error message about too many inits found.
+        context[@"ClassCPrime"] = [ClassCPrime class]; // Ditto.
+
+        JSValue *a = [context evaluateScript:@"(new ClassA(42))"];
+        checkResult(@"a instanceof ClassA", [a isInstanceOf:context[@"ClassA"]]);
+        checkResult(@"a.initialize() is callable", [[a invokeMethod:@"initialize" withArguments:@[]] toInt32] == 42);
+
+        JSValue *b = [context evaluateScript:@"(new ClassB(42, 53))"];
+        checkResult(@"b instanceof ClassB", [b isInstanceOf:context[@"ClassB"]]);
+
+        JSValue *canConstructClassC = [context evaluateScript:@"(function() { \
+            try { \
+                (new ClassC(1, 2)); \
+                return true; \
+            } catch(e) { \
+                return false; \
+            } \
+        })()"];
+        checkResult(@"shouldn't be able to construct ClassC", ![canConstructClassC toBool]);
+
+        JSValue *canConstructClassCPrime = [context evaluateScript:@"(function() { \
+            try { \
+                (new ClassCPrime(1)); \
+                return true; \
+            } catch(e) { \
+                return false; \
+            } \
+        })()"];
+        checkResult(@"shouldn't be able to construct ClassCPrime", ![canConstructClassCPrime toBool]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"ClassA"] = [ClassA class];
+        context.exceptionHandler = ^(JSContext *context, JSValue *exception) {
+            NSLog(@"%@", [exception toString]);
+            context.exception = exception;
+        };
+
+        checkResult(@"ObjC Constructor without 'new' pre", !context.exception);
+        [context evaluateScript:@"ClassA(42)"];
+        checkResult(@"ObjC Constructor without 'new' post", context.exception);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"ClassD"] = [ClassD class];
+        context[@"ClassE"] = [ClassE class];
+       
+        JSValue *d = [context evaluateScript:@"(new ClassD())"];
+        checkResult(@"Returning instance of ClassE from ClassD's init has correct class", [d isInstanceOf:context[@"ClassE"]]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        while (!evilAllocationObjectWasDealloced) {
+            @autoreleasepool {
+                EvilAllocationObject *evilObject = [[EvilAllocationObject alloc] initWithContext:context];
+                context[@"evilObject"] = evilObject;
+                context[@"evilObject"] = nil;
+            }
+        }
+        checkResult(@"EvilAllocationObject was successfully dealloced without crashing", evilAllocationObjectWasDealloced);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        checkResult(@"default context.name is nil", context.name == nil);
+        NSString *name1 = @"Name1";
+        NSString *name2 = @"Name2";
+        context.name = name1;
+        NSString *fetchedName1 = context.name;
+        context.name = name2;
+        NSString *fetchedName2 = context.name;
+        context.name = nil;
+        NSString *fetchedName3 = context.name;
+        checkResult(@"fetched context.name was expected", [fetchedName1 isEqualToString:name1]);
+        checkResult(@"fetched context.name was expected", [fetchedName2 isEqualToString:name2]);
+        checkResult(@"fetched context.name was expected", ![fetchedName1 isEqualToString:fetchedName2]);
+        checkResult(@"fetched context.name was expected", fetchedName3 == nil);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        context[@"UnexportedObject"] = [UnexportedObject class];
+        context[@"makeObject"] = ^{
+            return [[UnexportedObject alloc] init];
+        };
+        JSValue *result = [context evaluateScript:@"(makeObject() instanceof UnexportedObject)"];
+        checkResult(@"makeObject() instanceof UnexportedObject", result.isBoolean && [result toBool]);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        [[JSValue valueWithInt32:42 inContext:context] toDictionary];
+        [[JSValue valueWithInt32:42 inContext:context] toArray];
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+
+        // Create the root, make it reachable from JS, and force an EdenCollection
+        // so that we scan the external object graph.
+        TestObject *root = [TestObject testObject];
+        @autoreleasepool {
+            context[@"root"] = root;
+        }
+        JSSynchronousEdenCollectForDebugging([context JSGlobalContextRef]);
+
+        // Create a new Obj-C object only reachable via the external object graph
+        // through the object we already scanned during the EdenCollection.
+        TestObject *child = [TestObject testObject];
+        [context.virtualMachine addManagedReference:child withOwner:root];
+
+        // Create a new managed JSValue that will only be kept alive if we properly rescan
+        // the external object graph.
+        JSManagedValue *managedJSObject = nil;
+        @autoreleasepool {
+            JSValue *jsObject = [JSValue valueWithObject:@"hello" inContext:context];
+            managedJSObject = [JSManagedValue managedValueWithValue:jsObject];
+            [context.virtualMachine addManagedReference:managedJSObject withOwner:child];
+        }
+
+        // Force another EdenCollection. It should rescan the new part of the external object graph.
+        JSSynchronousEdenCollectForDebugging([context JSGlobalContextRef]);
+        
+        // Check that the managed JSValue is still alive.
+        checkResult(@"EdenCollection doesn't reclaim new managed values", [managedJSObject value] != nil);
+    }
+
+    @autoreleasepool {
+        JSContext *context = [[JSContext alloc] init];
+        
+        pthread_t threadID;
+        pthread_create(&threadID, NULL, &threadMain, (__bridge void*)context);
+        pthread_join(threadID, nullptr);
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+
+        checkResult(@"Did not crash after entering the VM from another thread", true);
+    }
+    
+    @autoreleasepool {
+        std::vector<pthread_t> threads;
+        bool ok = true;
+        for (unsigned i = 0; i < 5; ++i) {
+            pthread_t threadID;
+            pthread_create(&threadID, nullptr, multiVMThreadMain, &ok);
+            threads.push_back(threadID);
+        }
+
+        for (pthread_t thread : threads)
+            pthread_join(thread, nullptr);
+
+        checkResult(@"Ran code in five concurrent VMs that GC'd", ok);
+    }
+    
+    currentThisInsideBlockGetterTest();
+    runDateTests();
+    runJSExportTests();
+    runRegress141275();
+    runRegress141809();
+}
+
+@protocol NumberProtocol <JSExport>
+
+@property (nonatomic) NSInteger number;
+
+@end
+
+@interface NumberObject : NSObject <NumberProtocol>
+
+@property (nonatomic) NSInteger number;
+
+@end
+
+@implementation NumberObject
+
+@end
+
+// Check that negative NSIntegers retain the correct value when passed into JS code.
+static void checkNegativeNSIntegers()
+{
+    NumberObject *container = [[NumberObject alloc] init];
+    container.number = -1;
+    JSContext *context = [[JSContext alloc] init];
+    context[@"container"] = container;
+    NSString *jsID = @"var getContainerNumber = function() { return container.number }";
+    [context evaluateScript:jsID];
+    JSValue *jsFunction = context[@"getContainerNumber"];
+    JSValue *result = [jsFunction callWithArguments:@[]];
+    
+    checkResult(@"Negative number maintained its original value", [[result toString] isEqualToString:@"-1"]);
+}
+
+void testObjectiveCAPI()
+{
+    NSLog(@"Testing Objective-C API");
+    checkNegativeNSIntegers();
+    testObjectiveCAPIMain();
+}
+
+#else
+
+void testObjectiveCAPI()
+{
+}
+
+#endif // JSC_OBJC_API_ENABLED
diff --git a/AUTHORS b/AUTHORS
new file mode 100644
index 0000000..e50da8c
--- /dev/null
+++ b/AUTHORS
@@ -0,0 +1,2 @@
+Harri Porten (porten@kde.org)
+Peter Kelly (pmk@post.com)
diff --git a/CMakeLists.txt b/CMakeLists.txt
new file mode 100644
index 0000000..968545c
--- /dev/null
+++ b/CMakeLists.txt
@@ -0,0 +1,1524 @@
+cmake_minimum_required(VERSION 2.8.12)
+include(WebKitCommon)
+set_property(DIRECTORY . PROPERTY FOLDER "JavaScriptCore")
+
+set(JavaScriptCore_INCLUDE_DIRECTORIES
+    "${CMAKE_BINARY_DIR}"
+    "${JAVASCRIPTCORE_DIR}"
+    "${JAVASCRIPTCORE_DIR}/.."
+    "${JAVASCRIPTCORE_DIR}/API"
+    "${JAVASCRIPTCORE_DIR}/ForwardingHeaders"
+    "${JAVASCRIPTCORE_DIR}/assembler"
+    "${JAVASCRIPTCORE_DIR}/b3"
+    "${JAVASCRIPTCORE_DIR}/b3/air"
+    "${JAVASCRIPTCORE_DIR}/bindings"
+    "${JAVASCRIPTCORE_DIR}/builtins"
+    "${JAVASCRIPTCORE_DIR}/bytecode"
+    "${JAVASCRIPTCORE_DIR}/bytecompiler"
+    "${JAVASCRIPTCORE_DIR}/dfg"
+    "${JAVASCRIPTCORE_DIR}/disassembler"
+    "${JAVASCRIPTCORE_DIR}/disassembler/udis86"
+    "${JAVASCRIPTCORE_DIR}/disassembler/arm64"
+    "${JAVASCRIPTCORE_DIR}/domjit"
+    "${JAVASCRIPTCORE_DIR}/ftl"
+    "${JAVASCRIPTCORE_DIR}/heap"
+    "${JAVASCRIPTCORE_DIR}/debugger"
+    "${JAVASCRIPTCORE_DIR}/inspector"
+    "${JAVASCRIPTCORE_DIR}/inspector/agents"
+    "${JAVASCRIPTCORE_DIR}/inspector/augmentable"
+    "${JAVASCRIPTCORE_DIR}/inspector/remote"
+    "${JAVASCRIPTCORE_DIR}/interpreter"
+    "${JAVASCRIPTCORE_DIR}/jit"
+    "${JAVASCRIPTCORE_DIR}/llint"
+    "${JAVASCRIPTCORE_DIR}/parser"
+    "${JAVASCRIPTCORE_DIR}/profiler"
+    "${JAVASCRIPTCORE_DIR}/replay"
+    "${JAVASCRIPTCORE_DIR}/runtime"
+    "${JAVASCRIPTCORE_DIR}/tools"
+    "${JAVASCRIPTCORE_DIR}/wasm"
+    "${JAVASCRIPTCORE_DIR}/wasm/js"
+    "${JAVASCRIPTCORE_DIR}/yarr"
+    "${DERIVED_SOURCES_DIR}/ForwardingHeaders"
+    "${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}"
+    "${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector"
+)
+
+set(JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
+    "${ICU_INCLUDE_DIRS}"
+)
+
+set(JavaScriptCore_SOURCES
+    API/JSBase.cpp
+    API/JSCTestRunnerUtils.cpp
+    API/JSCallbackConstructor.cpp
+    API/JSCallbackFunction.cpp
+    API/JSCallbackObject.cpp
+    API/JSClassRef.cpp
+    API/JSContextRef.cpp
+    API/JSObjectRef.cpp
+    API/JSTypedArray.cpp
+    API/JSScriptRef.cpp
+    API/JSStringRef.cpp
+    API/JSValueRef.cpp
+    API/JSWeakObjectMapRefPrivate.cpp
+    API/OpaqueJSString.cpp
+
+    assembler/ARMAssembler.cpp
+    assembler/LinkBuffer.cpp
+    assembler/MacroAssembler.cpp
+    assembler/MacroAssemblerARM.cpp
+    assembler/MacroAssemblerARMv7.cpp
+    assembler/MacroAssemblerCodeRef.cpp
+    assembler/MacroAssemblerPrinter.cpp
+    assembler/MacroAssemblerX86Common.cpp
+
+    b3/air/AirAllocateStack.cpp
+    b3/air/AirArg.cpp
+    b3/air/AirBasicBlock.cpp
+    b3/air/AirCCallSpecial.cpp
+    b3/air/AirCCallingConvention.cpp
+    b3/air/AirCode.cpp
+    b3/air/AirCustom.cpp
+    b3/air/AirDumpAsJS.cpp
+    b3/air/AirEliminateDeadCode.cpp
+    b3/air/AirEmitShuffle.cpp
+    b3/air/AirFixObviousSpills.cpp
+    b3/air/AirFixPartialRegisterStalls.cpp
+    b3/air/AirGenerate.cpp
+    b3/air/AirGenerated.cpp
+    b3/air/AirHandleCalleeSaves.cpp
+    b3/air/AirInsertionSet.cpp
+    b3/air/AirInst.cpp
+    b3/air/AirIteratedRegisterCoalescing.cpp
+    b3/air/AirKind.cpp
+    b3/air/AirLogRegisterPressure.cpp
+    b3/air/AirLowerAfterRegAlloc.cpp
+    b3/air/AirLowerEntrySwitch.cpp
+    b3/air/AirLowerMacros.cpp
+    b3/air/AirOptimizeBlockOrder.cpp
+    b3/air/AirPadInterference.cpp
+    b3/air/AirPhaseScope.cpp
+    b3/air/AirReportUsedRegisters.cpp
+    b3/air/AirSimplifyCFG.cpp
+    b3/air/AirSpecial.cpp
+    b3/air/AirSpillEverything.cpp
+    b3/air/AirStackSlot.cpp
+    b3/air/AirStackSlotKind.cpp
+    b3/air/AirTmp.cpp
+    b3/air/AirTmpWidth.cpp
+    b3/air/AirValidate.cpp
+
+    b3/B3ArgumentRegValue.cpp
+    b3/B3BasicBlock.cpp
+    b3/B3BlockInsertionSet.cpp
+    b3/B3BreakCriticalEdges.cpp
+    b3/B3CCallValue.cpp
+    b3/B3CaseCollection.cpp
+    b3/B3CheckSpecial.cpp
+    b3/B3CheckValue.cpp
+    b3/B3Common.cpp
+    b3/B3Commutativity.cpp
+    b3/B3Compile.cpp
+    b3/B3Compilation.cpp
+    b3/B3Const32Value.cpp
+    b3/B3Const64Value.cpp
+    b3/B3ConstDoubleValue.cpp
+    b3/B3ConstFloatValue.cpp
+    b3/B3ConstrainedValue.cpp
+    b3/B3DataSection.cpp
+    b3/B3DuplicateTails.cpp
+    b3/B3Effects.cpp
+    b3/B3EliminateCommonSubexpressions.cpp
+    b3/B3FenceValue.cpp
+    b3/B3FixSSA.cpp
+    b3/B3FoldPathConstants.cpp
+    b3/B3FrequencyClass.cpp
+    b3/B3Generate.cpp
+    b3/B3HeapRange.cpp
+    b3/B3InferSwitches.cpp
+    b3/B3InsertionSet.cpp
+    b3/B3Kind.cpp
+    b3/B3LegalizeMemoryOffsets.cpp
+    b3/B3LowerMacros.cpp
+    b3/B3LowerMacrosAfterOptimizations.cpp
+    b3/B3LowerToAir.cpp
+    b3/B3MathExtras.cpp
+    b3/B3MemoryValue.cpp
+    b3/B3MoveConstants.cpp
+    b3/B3OpaqueByproducts.cpp
+    b3/B3Opcode.cpp
+    b3/B3Origin.cpp
+    b3/B3OriginDump.cpp
+    b3/B3PatchpointSpecial.cpp
+    b3/B3PatchpointValue.cpp
+    b3/B3PhaseScope.cpp
+    b3/B3PhiChildren.cpp
+    b3/B3Procedure.cpp
+    b3/B3PureCSE.cpp
+    b3/B3ReduceDoubleToFloat.cpp
+    b3/B3ReduceStrength.cpp
+    b3/B3SSACalculator.cpp
+    b3/B3SlotBaseValue.cpp
+    b3/B3StackmapGenerationParams.cpp
+    b3/B3StackmapSpecial.cpp
+    b3/B3StackmapValue.cpp
+    b3/B3StackSlot.cpp
+    b3/B3SwitchCase.cpp
+    b3/B3SwitchValue.cpp
+    b3/B3TimingScope.cpp
+    b3/B3Type.cpp
+    b3/B3UpsilonValue.cpp
+    b3/B3UseCounts.cpp
+    b3/B3Validate.cpp
+    b3/B3Value.cpp
+    b3/B3ValueKey.cpp
+    b3/B3ValueRep.cpp
+    b3/B3Variable.cpp
+    b3/B3VariableValue.cpp
+    b3/B3WasmAddressValue.cpp
+    b3/B3WasmBoundsCheckValue.cpp
+
+    bindings/ScriptFunctionCall.cpp
+    bindings/ScriptObject.cpp
+    bindings/ScriptValue.cpp
+
+    builtins/BuiltinExecutables.cpp
+    builtins/BuiltinExecutableCreator.cpp
+
+    bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp
+    bytecode/ArithProfile.cpp
+    bytecode/ArrayAllocationProfile.cpp
+    bytecode/ArrayProfile.cpp
+    bytecode/BytecodeBasicBlock.cpp
+    bytecode/BytecodeGeneratorification.cpp
+    bytecode/BytecodeIntrinsicRegistry.cpp
+    bytecode/BytecodeLivenessAnalysis.cpp
+    bytecode/BytecodeRewriter.cpp
+    bytecode/CallEdge.cpp
+    bytecode/CallLinkInfo.cpp
+    bytecode/CallLinkStatus.cpp
+    bytecode/CallMode.cpp
+    bytecode/CallVariant.cpp
+    bytecode/CodeBlock.cpp
+    bytecode/CodeBlockHash.cpp
+    bytecode/CodeBlockJettisoningWatchpoint.cpp
+    bytecode/CodeOrigin.cpp
+    bytecode/CodeType.cpp
+    bytecode/ComplexGetStatus.cpp
+    bytecode/DFGExitProfile.cpp
+    bytecode/DOMJITAccessCasePatchpointParams.cpp
+    bytecode/DataFormat.cpp
+    bytecode/DeferredCompilationCallback.cpp
+    bytecode/DeferredSourceDump.cpp
+    bytecode/DirectEvalCodeCache.cpp
+    bytecode/EvalCodeBlock.cpp
+    bytecode/ExecutionCounter.cpp
+    bytecode/ExitKind.cpp
+    bytecode/ExitingJITType.cpp
+    bytecode/FunctionCodeBlock.cpp
+    bytecode/GetByIdStatus.cpp
+    bytecode/GetByIdVariant.cpp
+    bytecode/InlineAccess.cpp
+    bytecode/InlineCallFrame.cpp
+    bytecode/InlineCallFrameSet.cpp
+    bytecode/JumpTable.cpp
+    bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
+    bytecode/LazyOperandValueProfile.cpp
+    bytecode/MethodOfGettingAValueProfile.cpp
+    bytecode/ModuleProgramCodeBlock.cpp
+    bytecode/ObjectPropertyCondition.cpp
+    bytecode/ObjectPropertyConditionSet.cpp
+    bytecode/Opcode.cpp
+    bytecode/PolymorphicAccess.cpp
+    bytecode/PreciseJumpTargets.cpp
+    bytecode/ProgramCodeBlock.cpp
+    bytecode/PropertyCondition.cpp
+    bytecode/PutByIdFlags.cpp
+    bytecode/PutByIdStatus.cpp
+    bytecode/PutByIdVariant.cpp
+    bytecode/ReduceWhitespace.cpp
+    bytecode/SpecialPointer.cpp
+    bytecode/SpeculatedType.cpp
+    bytecode/StructureSet.cpp
+    bytecode/StructureStubClearingWatchpoint.cpp
+    bytecode/StructureStubInfo.cpp
+    bytecode/SuperSampler.cpp
+    bytecode/ToThisStatus.cpp
+    bytecode/TrackedReferences.cpp
+    bytecode/UnlinkedCodeBlock.cpp
+    bytecode/UnlinkedEvalCodeBlock.cpp
+    bytecode/UnlinkedFunctionCodeBlock.cpp
+    bytecode/UnlinkedFunctionExecutable.cpp
+    bytecode/UnlinkedInstructionStream.cpp
+    bytecode/UnlinkedModuleProgramCodeBlock.cpp
+    bytecode/UnlinkedProgramCodeBlock.cpp
+    bytecode/ValueRecovery.cpp
+    bytecode/VariableWriteFireDetail.cpp
+    bytecode/VirtualRegister.cpp
+    bytecode/Watchpoint.cpp
+
+    bytecompiler/BytecodeGenerator.cpp
+    bytecompiler/NodesCodegen.cpp
+
+    debugger/Debugger.cpp
+    debugger/DebuggerCallFrame.cpp
+    debugger/DebuggerLocation.cpp
+    debugger/DebuggerParseData.cpp
+    debugger/DebuggerScope.cpp
+
+    dfg/DFGAbstractHeap.cpp
+    dfg/DFGAbstractValue.cpp
+    dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp
+    dfg/DFGAdaptiveStructureWatchpoint.cpp
+    dfg/DFGArgumentsEliminationPhase.cpp
+    dfg/DFGArgumentsUtilities.cpp
+    dfg/DFGArithMode.cpp
+    dfg/DFGArrayMode.cpp
+    dfg/DFGAtTailAbstractState.cpp
+    dfg/DFGAvailability.cpp
+    dfg/DFGAvailabilityMap.cpp
+    dfg/DFGBackwardsPropagationPhase.cpp
+    dfg/DFGBasicBlock.cpp
+    dfg/DFGBlockInsertionSet.cpp
+    dfg/DFGBlockSet.cpp
+    dfg/DFGByteCodeParser.cpp
+    dfg/DFGCFAPhase.cpp
+    dfg/DFGCFGSimplificationPhase.cpp
+    dfg/DFGCPSRethreadingPhase.cpp
+    dfg/DFGCSEPhase.cpp
+    dfg/DFGCapabilities.cpp
+    dfg/DFGCleanUpPhase.cpp
+    dfg/DFGClobberSet.cpp
+    dfg/DFGClobberize.cpp
+    dfg/DFGClobbersExitState.cpp
+    dfg/DFGCombinedLiveness.cpp
+    dfg/DFGCommon.cpp
+    dfg/DFGCommonData.cpp
+    dfg/DFGCompilationKey.cpp
+    dfg/DFGCompilationMode.cpp
+    dfg/DFGConstantFoldingPhase.cpp
+    dfg/DFGConstantHoistingPhase.cpp
+    dfg/DFGCriticalEdgeBreakingPhase.cpp
+    dfg/DFGDCEPhase.cpp
+    dfg/DFGDOMJITPatchpointParams.cpp
+    dfg/DFGDesiredIdentifiers.cpp
+    dfg/DFGDesiredTransitions.cpp
+    dfg/DFGDesiredWatchpoints.cpp
+    dfg/DFGDesiredWeakReferences.cpp
+    dfg/DFGDisassembler.cpp
+    dfg/DFGDoesGC.cpp
+    dfg/DFGDriver.cpp
+    dfg/DFGEdge.cpp
+    dfg/DFGEpoch.cpp
+    dfg/DFGFailedFinalizer.cpp
+    dfg/DFGFinalizer.cpp
+    dfg/DFGFixupPhase.cpp
+    dfg/DFGFlowIndexing.cpp
+    dfg/DFGFlushFormat.cpp
+    dfg/DFGFlushedAt.cpp
+    dfg/DFGLiveCatchVariablePreservationPhase.cpp
+    dfg/DFGFrozenValue.cpp
+    dfg/DFGGraph.cpp
+    dfg/DFGGraphSafepoint.cpp
+    dfg/DFGHeapLocation.cpp
+    dfg/DFGInPlaceAbstractState.cpp
+    dfg/DFGInferredTypeCheck.cpp
+    dfg/DFGInsertionSet.cpp
+    dfg/DFGIntegerCheckCombiningPhase.cpp
+    dfg/DFGIntegerRangeOptimizationPhase.cpp
+    dfg/DFGInvalidationPointInjectionPhase.cpp
+    dfg/DFGJITCode.cpp
+    dfg/DFGJITCompiler.cpp
+    dfg/DFGJITFinalizer.cpp
+    dfg/DFGJumpReplacement.cpp
+    dfg/DFGLICMPhase.cpp
+    dfg/DFGLazyJSValue.cpp
+    dfg/DFGLazyNode.cpp
+    dfg/DFGLivenessAnalysisPhase.cpp
+    dfg/DFGLongLivedState.cpp
+    dfg/DFGLoopPreHeaderCreationPhase.cpp
+    dfg/DFGMaximalFlushInsertionPhase.cpp
+    dfg/DFGMayExit.cpp
+    dfg/DFGMinifiedGraph.cpp
+    dfg/DFGMinifiedNode.cpp
+    dfg/DFGMovHintRemovalPhase.cpp
+    dfg/DFGMultiGetByOffsetData.cpp
+    dfg/DFGNaturalLoops.cpp
+    dfg/DFGNode.cpp
+    dfg/DFGNodeAbstractValuePair.cpp
+    dfg/DFGNodeFlags.cpp
+    dfg/DFGNodeFlowProjection.cpp
+    dfg/DFGNodeOrigin.cpp
+    dfg/DFGOSRAvailabilityAnalysisPhase.cpp
+    dfg/DFGOSREntry.cpp
+    dfg/DFGOSREntrypointCreationPhase.cpp
+    dfg/DFGOSRExit.cpp
+    dfg/DFGOSRExitBase.cpp
+    dfg/DFGOSRExitCompiler.cpp
+    dfg/DFGOSRExitCompiler32_64.cpp
+    dfg/DFGOSRExitCompiler64.cpp
+    dfg/DFGOSRExitCompilerCommon.cpp
+    dfg/DFGOSRExitFuzz.cpp
+    dfg/DFGOSRExitJumpPlaceholder.cpp
+    dfg/DFGOSRExitPreparation.cpp
+    dfg/DFGObjectAllocationSinkingPhase.cpp
+    dfg/DFGObjectMaterializationData.cpp
+    dfg/DFGOperations.cpp
+    dfg/DFGPhantomInsertionPhase.cpp
+    dfg/DFGPhase.cpp
+    dfg/DFGPhiChildren.cpp
+    dfg/DFGPlan.cpp
+    dfg/DFGPrePostNumbering.cpp
+    dfg/DFGPredictionInjectionPhase.cpp
+    dfg/DFGPredictionPropagationPhase.cpp
+    dfg/DFGPromotedHeapLocation.cpp
+    dfg/DFGPureValue.cpp
+    dfg/DFGPutStackSinkingPhase.cpp
+    dfg/DFGRegisteredStructureSet.cpp
+    dfg/DFGSSACalculator.cpp
+    dfg/DFGSSAConversionPhase.cpp
+    dfg/DFGSSALoweringPhase.cpp
+    dfg/DFGSafepoint.cpp
+    dfg/DFGSpeculativeJIT.cpp
+    dfg/DFGSpeculativeJIT32_64.cpp
+    dfg/DFGSpeculativeJIT64.cpp
+    dfg/DFGStackLayoutPhase.cpp
+    dfg/DFGStaticExecutionCountEstimationPhase.cpp
+    dfg/DFGStoreBarrierClusteringPhase.cpp
+    dfg/DFGStoreBarrierInsertionPhase.cpp
+    dfg/DFGStrengthReductionPhase.cpp
+    dfg/DFGStructureAbstractValue.cpp
+    dfg/DFGThreadData.cpp
+    dfg/DFGThunks.cpp
+    dfg/DFGTierUpCheckInjectionPhase.cpp
+    dfg/DFGToFTLDeferredCompilationCallback.cpp
+    dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp
+    dfg/DFGTransition.cpp
+    dfg/DFGTypeCheckHoistingPhase.cpp
+    dfg/DFGUnificationPhase.cpp
+    dfg/DFGUseKind.cpp
+    dfg/DFGValidate.cpp
+    dfg/DFGValueSource.cpp
+    dfg/DFGValueStrength.cpp
+    dfg/DFGVarargsForwardingPhase.cpp
+    dfg/DFGVariableAccessData.cpp
+    dfg/DFGVariableAccessDataDump.cpp
+    dfg/DFGVariableEvent.cpp
+    dfg/DFGVariableEventStream.cpp
+    dfg/DFGVirtualRegisterAllocationPhase.cpp
+    dfg/DFGWatchpointCollectionPhase.cpp
+    dfg/DFGWorklist.cpp
+
+    disassembler/ARM64Disassembler.cpp
+    disassembler/ARMLLVMDisassembler.cpp
+    disassembler/ARMv7Disassembler.cpp
+    disassembler/Disassembler.cpp
+    disassembler/UDis86Disassembler.cpp
+    disassembler/X86Disassembler.cpp
+
+    disassembler/ARM64/A64DOpcode.cpp
+
+    disassembler/ARMv7/ARMv7DOpcode.cpp
+
+    disassembler/udis86/udis86.c
+    disassembler/udis86/udis86_decode.c
+    disassembler/udis86/udis86_itab_holder.c
+    disassembler/udis86/udis86_syn-att.c
+    disassembler/udis86/udis86_syn-intel.c
+    disassembler/udis86/udis86_syn.c
+
+    domjit/DOMJITAbstractHeap.cpp
+    domjit/DOMJITHeapRange.cpp
+
+    ftl/FTLAbstractHeap.cpp
+    ftl/FTLAbstractHeapRepository.cpp
+    ftl/FTLAvailableRecovery.cpp
+    ftl/FTLCapabilities.cpp
+    ftl/FTLCommonValues.cpp
+    ftl/FTLCompile.cpp
+    ftl/FTLDOMJITPatchpointParams.cpp
+    ftl/FTLExceptionTarget.cpp
+    ftl/FTLExitArgument.cpp
+    ftl/FTLExitArgumentForOperand.cpp
+    ftl/FTLExitPropertyValue.cpp
+    ftl/FTLExitTimeObjectMaterialization.cpp
+    ftl/FTLExitValue.cpp
+    ftl/FTLFail.cpp
+    ftl/FTLForOSREntryJITCode.cpp
+    ftl/FTLJITCode.cpp
+    ftl/FTLJITFinalizer.cpp
+    ftl/FTLLazySlowPath.cpp
+    ftl/FTLLink.cpp
+    ftl/FTLLocation.cpp
+    ftl/FTLLowerDFGToB3.cpp
+    ftl/FTLOSREntry.cpp
+    ftl/FTLOSRExit.cpp
+    ftl/FTLOSRExitCompiler.cpp
+    ftl/FTLOSRExitHandle.cpp
+    ftl/FTLOperations.cpp
+    ftl/FTLOutput.cpp
+    ftl/FTLPatchpointExceptionHandle.cpp
+    ftl/FTLRecoveryOpcode.cpp
+    ftl/FTLSaveRestore.cpp
+    ftl/FTLSlowPathCall.cpp
+    ftl/FTLSlowPathCallKey.cpp
+    ftl/FTLState.cpp
+    ftl/FTLThunks.cpp
+    ftl/FTLValueRange.cpp
+
+    heap/AllocatorAttributes.cpp
+    heap/CellContainer.cpp
+    heap/CodeBlockSet.cpp
+    heap/CollectionScope.cpp
+    heap/ConservativeRoots.cpp
+    heap/DeferGC.cpp
+    heap/DestructionMode.cpp
+    heap/EdenGCActivityCallback.cpp
+    heap/FullGCActivityCallback.cpp
+    heap/FreeList.cpp
+    heap/GCActivityCallback.cpp
+    heap/GCLogging.cpp
+    heap/HandleSet.cpp
+    heap/HandleStack.cpp
+    heap/Heap.cpp
+    heap/HeapCell.cpp
+    heap/HeapHelperPool.cpp
+    heap/HeapProfiler.cpp
+    heap/HeapSnapshot.cpp
+    heap/HeapSnapshotBuilder.cpp
+    heap/HeapStatistics.cpp
+    heap/HeapTimer.cpp
+    heap/HeapVerifier.cpp
+    heap/IncrementalSweeper.cpp
+    heap/JITStubRoutineSet.cpp
+    heap/LargeAllocation.cpp
+    heap/LiveObjectList.cpp
+    heap/MachineStackMarker.cpp
+    heap/MarkStack.cpp
+    heap/MarkedAllocator.cpp
+    heap/MarkedBlock.cpp
+    heap/MarkedSpace.cpp
+    heap/MarkingConstraint.cpp
+    heap/MarkingConstraintSet.cpp
+    heap/MutatorScheduler.cpp
+    heap/MutatorState.cpp
+    heap/SlotVisitor.cpp
+    heap/SpaceTimeMutatorScheduler.cpp
+    heap/StochasticSpaceTimeMutatorScheduler.cpp
+    heap/StopIfNecessaryTimer.cpp
+    heap/Subspace.cpp
+    heap/SynchronousStopTheWorldMutatorScheduler.cpp
+    heap/VisitRaceKey.cpp
+    heap/Weak.cpp
+    heap/WeakBlock.cpp
+    heap/WeakHandleOwner.cpp
+    heap/WeakSet.cpp
+    heap/WriteBarrierSupport.cpp
+
+    inspector/AsyncStackTrace.cpp
+    inspector/ConsoleMessage.cpp
+    inspector/ContentSearchUtilities.cpp
+    inspector/EventLoop.cpp
+    inspector/IdentifiersFactory.cpp
+    inspector/InjectedScript.cpp
+    inspector/InjectedScriptBase.cpp
+    inspector/InjectedScriptHost.cpp
+    inspector/InjectedScriptManager.cpp
+    inspector/InjectedScriptModule.cpp
+    inspector/InspectorAgentRegistry.cpp
+    inspector/InspectorFrontendRouter.cpp
+    inspector/InspectorBackendDispatcher.cpp
+    inspector/InspectorValues.cpp
+    inspector/JSGlobalObjectConsoleClient.cpp
+    inspector/JSGlobalObjectInspectorController.cpp
+    inspector/JSGlobalObjectScriptDebugServer.cpp
+    inspector/JSInjectedScriptHost.cpp
+    inspector/JSInjectedScriptHostPrototype.cpp
+    inspector/JSJavaScriptCallFrame.cpp
+    inspector/JSJavaScriptCallFramePrototype.cpp
+    inspector/JavaScriptCallFrame.cpp
+    inspector/PerGlobalObjectWrapperWorld.cpp
+    inspector/ScriptArguments.cpp
+    inspector/ScriptCallFrame.cpp
+    inspector/ScriptCallStack.cpp
+    inspector/ScriptCallStackFactory.cpp
+    inspector/ScriptDebugServer.cpp
+
+    inspector/agents/InspectorAgent.cpp
+    inspector/agents/InspectorConsoleAgent.cpp
+    inspector/agents/InspectorDebuggerAgent.cpp
+    inspector/agents/InspectorHeapAgent.cpp
+    inspector/agents/InspectorRuntimeAgent.cpp
+    inspector/agents/InspectorScriptProfilerAgent.cpp
+    inspector/agents/JSGlobalObjectConsoleAgent.cpp
+    inspector/agents/JSGlobalObjectDebuggerAgent.cpp
+    inspector/agents/JSGlobalObjectRuntimeAgent.cpp
+
+    interpreter/AbstractPC.cpp
+    interpreter/CLoopStack.cpp
+    interpreter/CallFrame.cpp
+    interpreter/Interpreter.cpp
+    interpreter/ProtoCallFrame.cpp
+    interpreter/ShadowChicken.cpp
+    interpreter/StackVisitor.cpp
+
+    jit/AssemblyHelpers.cpp
+    jit/BinarySwitch.cpp
+    jit/CCallHelpers.cpp
+    jit/CachedRecovery.cpp
+    jit/CallFrameShuffleData.cpp
+    jit/CallFrameShuffler.cpp
+    jit/CallFrameShuffler32_64.cpp
+    jit/CallFrameShuffler64.cpp
+    jit/ExecutableAllocationFuzz.cpp
+    jit/ExecutableAllocator.cpp
+    jit/ExecutableAllocatorFixedVMPool.cpp
+    jit/GCAwareJITStubRoutine.cpp
+    jit/GPRInfo.cpp
+    jit/HostCallReturnValue.cpp
+    jit/ICStats.cpp
+    jit/IntrinsicEmitter.cpp
+    jit/JIT.cpp
+    jit/JITAddGenerator.cpp
+    jit/JITArithmetic.cpp
+    jit/JITArithmetic32_64.cpp
+    jit/JITBitAndGenerator.cpp
+    jit/JITBitOrGenerator.cpp
+    jit/JITBitXorGenerator.cpp
+    jit/JITCall.cpp
+    jit/JITCall32_64.cpp
+    jit/JITCode.cpp
+    jit/JITDisassembler.cpp
+    jit/JITDivGenerator.cpp
+    jit/JITExceptions.cpp
+    jit/JITInlineCacheGenerator.cpp
+    jit/JITLeftShiftGenerator.cpp
+    jit/JITMulGenerator.cpp
+    jit/JITNegGenerator.cpp
+    jit/JITOpcodes.cpp
+    jit/JITOpcodes32_64.cpp
+    jit/JITOperations.cpp
+    jit/JITPropertyAccess.cpp
+    jit/JITPropertyAccess32_64.cpp
+    jit/JITRightShiftGenerator.cpp
+    jit/JITStubRoutine.cpp
+    jit/JITSubGenerator.cpp
+    jit/JITThunks.cpp
+    jit/JITToDFGDeferredCompilationCallback.cpp
+    jit/JITWorklist.cpp
+    jit/PCToCodeOriginMap.cpp
+    jit/PolymorphicCallStubRoutine.cpp
+    jit/Reg.cpp
+    jit/RegisterAtOffset.cpp
+    jit/RegisterAtOffsetList.cpp
+    jit/RegisterSet.cpp
+    jit/Repatch.cpp
+    jit/ScratchRegisterAllocator.cpp
+    jit/SetupVarargsFrame.cpp
+    jit/TagRegistersMode.cpp
+    jit/TempRegisterSet.cpp
+    jit/ThunkGenerators.cpp
+
+    llint/LLIntCLoop.cpp
+    llint/LLIntData.cpp
+    llint/LLIntEntrypoint.cpp
+    llint/LLIntExceptions.cpp
+    llint/LLIntSlowPaths.cpp
+    llint/LLIntThunks.cpp
+    llint/LowLevelInterpreter.cpp
+
+    parser/Lexer.cpp
+    parser/ModuleAnalyzer.cpp
+    parser/Nodes.cpp
+    parser/NodesAnalyzeModule.cpp
+    parser/Parser.cpp
+    parser/ParserArena.cpp
+    parser/SourceProvider.cpp
+    parser/SourceProviderCache.cpp
+    parser/UnlinkedSourceCode.cpp
+    parser/VariableEnvironment.cpp
+
+    profiler/ProfilerBytecode.cpp
+    profiler/ProfilerBytecodeSequence.cpp
+    profiler/ProfilerBytecodes.cpp
+    profiler/ProfilerCompilation.cpp
+    profiler/ProfilerCompilationKind.cpp
+    profiler/ProfilerCompiledBytecode.cpp
+    profiler/ProfilerDatabase.cpp
+    profiler/ProfilerEvent.cpp
+    profiler/ProfilerJettisonReason.cpp
+    profiler/ProfilerOSRExit.cpp
+    profiler/ProfilerOSRExitSite.cpp
+    profiler/ProfilerOrigin.cpp
+    profiler/ProfilerOriginStack.cpp
+    profiler/ProfilerProfiledBytecodes.cpp
+    profiler/ProfilerUID.cpp
+
+    runtime/AbstractModuleRecord.cpp
+    runtime/ArgList.cpp
+    runtime/ArrayBuffer.cpp
+    runtime/ArrayBufferNeuteringWatchpoint.cpp
+    runtime/ArrayBufferView.cpp
+    runtime/ArrayConstructor.cpp
+    runtime/ArrayConventions.cpp
+    runtime/ArrayIteratorAdaptiveWatchpoint.cpp
+    runtime/ArrayIteratorPrototype.cpp
+    runtime/ArrayPrototype.cpp
+    runtime/AtomicsObject.cpp
+    runtime/AsyncFunctionConstructor.cpp
+    runtime/AsyncFunctionPrototype.cpp
+    runtime/BasicBlockLocation.cpp
+    runtime/BooleanConstructor.cpp
+    runtime/BooleanObject.cpp
+    runtime/BooleanPrototype.cpp
+    runtime/CallData.cpp
+    runtime/CatchScope.cpp
+    runtime/ClonedArguments.cpp
+    runtime/CodeCache.cpp
+    runtime/CodeSpecializationKind.cpp
+    runtime/CommonIdentifiers.cpp
+    runtime/CommonSlowPaths.cpp
+    runtime/CommonSlowPathsExceptions.cpp
+    runtime/CompilationResult.cpp
+    runtime/Completion.cpp
+    runtime/ConsoleClient.cpp
+    runtime/ConsoleObject.cpp
+    runtime/ConstantMode.cpp
+    runtime/ConstructData.cpp
+    runtime/ControlFlowProfiler.cpp
+    runtime/CustomGetterSetter.cpp
+    runtime/DataView.cpp
+    runtime/DateConstructor.cpp
+    runtime/DateConversion.cpp
+    runtime/DateInstance.cpp
+    runtime/DatePrototype.cpp
+    runtime/DirectArguments.cpp
+    runtime/DirectArgumentsOffset.cpp
+    runtime/DirectEvalExecutable.cpp
+    runtime/DumpContext.cpp
+    runtime/ECMAScriptSpecInternalFunctions.cpp
+    runtime/Error.cpp
+    runtime/ErrorConstructor.cpp
+    runtime/ErrorHandlingScope.cpp
+    runtime/ErrorInstance.cpp
+    runtime/ErrorPrototype.cpp
+    runtime/EvalExecutable.cpp
+    runtime/Exception.cpp
+    runtime/ExceptionEventLocation.cpp
+    runtime/ExceptionFuzz.cpp
+    runtime/ExceptionHelpers.cpp
+    runtime/ExceptionScope.cpp
+    runtime/ExecutableBase.cpp
+    runtime/FunctionConstructor.cpp
+    runtime/FunctionExecutable.cpp
+    runtime/FunctionExecutableDump.cpp
+    runtime/FunctionHasExecutedCache.cpp
+    runtime/FunctionPrototype.cpp
+    runtime/FunctionRareData.cpp
+    runtime/GeneratorFunctionConstructor.cpp
+    runtime/GeneratorFunctionPrototype.cpp
+    runtime/GeneratorPrototype.cpp
+    runtime/GetterSetter.cpp
+    runtime/HashMapImpl.cpp
+    runtime/Identifier.cpp
+    runtime/IndexingType.cpp
+    runtime/IndirectEvalExecutable.cpp
+    runtime/InferredType.cpp
+    runtime/InferredTypeTable.cpp
+    runtime/InferredValue.cpp
+    runtime/InitializeThreading.cpp
+    runtime/InspectorInstrumentationObject.cpp
+    runtime/InternalFunction.cpp
+    runtime/IntlCollator.cpp
+    runtime/IntlCollatorConstructor.cpp
+    runtime/IntlCollatorPrototype.cpp
+    runtime/IntlDateTimeFormat.cpp
+    runtime/IntlDateTimeFormatConstructor.cpp
+    runtime/IntlDateTimeFormatPrototype.cpp
+    runtime/IntlNumberFormat.cpp
+    runtime/IntlNumberFormatConstructor.cpp
+    runtime/IntlNumberFormatPrototype.cpp
+    runtime/IntlObject.cpp
+    runtime/IteratorOperations.cpp
+    runtime/IteratorPrototype.cpp
+    runtime/JSAPIValueWrapper.cpp
+    runtime/JSArray.cpp
+    runtime/JSArrayBuffer.cpp
+    runtime/JSArrayBufferConstructor.cpp
+    runtime/JSArrayBufferPrototype.cpp
+    runtime/JSArrayBufferView.cpp
+    runtime/JSAsyncFunction.cpp
+    runtime/JSBoundFunction.cpp
+    runtime/JSCJSValue.cpp
+    runtime/JSCallee.cpp
+    runtime/JSCell.cpp
+    runtime/JSCustomGetterSetterFunction.cpp
+    runtime/JSDataView.cpp
+    runtime/JSDataViewPrototype.cpp
+    runtime/JSDateMath.cpp
+    runtime/JSDestructibleObjectSubspace.cpp
+    runtime/JSEnvironmentRecord.cpp
+    runtime/JSFixedArray.cpp
+    runtime/JSFunction.cpp
+    runtime/JSGeneratorFunction.cpp
+    runtime/JSGlobalLexicalEnvironment.cpp
+    runtime/JSGlobalObject.cpp
+    runtime/JSGlobalObjectDebuggable.cpp
+    runtime/JSGlobalObjectFunctions.cpp
+    runtime/JSInternalPromise.cpp
+    runtime/JSInternalPromiseConstructor.cpp
+    runtime/JSInternalPromiseDeferred.cpp
+    runtime/JSInternalPromisePrototype.cpp
+    runtime/JSJob.cpp
+    runtime/JSLexicalEnvironment.cpp
+    runtime/JSLock.cpp
+    runtime/JSMap.cpp
+    runtime/JSMapIterator.cpp
+    runtime/JSModuleEnvironment.cpp
+    runtime/JSModuleLoader.cpp
+    runtime/JSModuleNamespaceObject.cpp
+    runtime/JSModuleRecord.cpp
+    runtime/JSNativeStdFunction.cpp
+    runtime/JSONObject.cpp
+    runtime/JSObject.cpp
+    runtime/JSPromise.cpp
+    runtime/JSPromiseConstructor.cpp
+    runtime/JSPromiseDeferred.cpp
+    runtime/JSPromisePrototype.cpp
+    runtime/JSPropertyNameEnumerator.cpp
+    runtime/JSPropertyNameIterator.cpp
+    runtime/JSProxy.cpp
+    runtime/JSScope.cpp
+    runtime/JSSegmentedVariableObject.cpp
+    runtime/JSSet.cpp
+    runtime/JSSetIterator.cpp
+    runtime/JSString.cpp
+    runtime/JSStringIterator.cpp
+    runtime/JSStringJoiner.cpp
+    runtime/JSStringSubspace.cpp
+    runtime/JSSymbolTableObject.cpp
+    runtime/JSTemplateRegistryKey.cpp
+    runtime/JSTypedArrayConstructors.cpp
+    runtime/JSTypedArrayPrototypes.cpp
+    runtime/JSTypedArrayViewConstructor.cpp
+    runtime/JSTypedArrayViewPrototype.cpp
+    runtime/JSTypedArrays.cpp
+    runtime/JSWeakMap.cpp
+    runtime/JSWeakSet.cpp
+    runtime/JSWithScope.cpp
+    runtime/JSWrapperObject.cpp
+    runtime/LazyClassStructure.cpp
+    runtime/LiteralParser.cpp
+    runtime/Lookup.cpp
+    runtime/MapBase.cpp
+    runtime/MapConstructor.cpp
+    runtime/MapIteratorPrototype.cpp
+    runtime/MapPrototype.cpp
+    runtime/MatchResult.cpp
+    runtime/MathCommon.cpp
+    runtime/MathObject.cpp
+    runtime/MemoryStatistics.cpp
+    runtime/ModuleLoaderPrototype.cpp
+    runtime/ModuleProgramExecutable.cpp
+    runtime/NativeErrorConstructor.cpp
+    runtime/NativeErrorPrototype.cpp
+    runtime/NativeExecutable.cpp
+    runtime/NativeStdFunctionCell.cpp
+    runtime/NullGetterFunction.cpp
+    runtime/NullSetterFunction.cpp
+    runtime/NumberConstructor.cpp
+    runtime/NumberObject.cpp
+    runtime/NumberPrototype.cpp
+    runtime/ObjectConstructor.cpp
+    runtime/ObjectPrototype.cpp
+    runtime/Operations.cpp
+    runtime/Options.cpp
+    runtime/ProgramExecutable.cpp
+    runtime/PropertyDescriptor.cpp
+    runtime/PropertySlot.cpp
+    runtime/PropertyTable.cpp
+    runtime/PrototypeMap.cpp
+    runtime/ProxyConstructor.cpp
+    runtime/ProxyObject.cpp
+    runtime/ProxyRevoke.cpp
+    runtime/ReflectObject.cpp
+    runtime/RegExp.cpp
+    runtime/RegExpCache.cpp
+    runtime/RegExpCachedResult.cpp
+    runtime/RegExpConstructor.cpp
+    runtime/RegExpMatchesArray.cpp
+    runtime/RegExpObject.cpp
+    runtime/RegExpPrototype.cpp
+    runtime/RuntimeType.cpp
+    runtime/SamplingCounter.cpp
+    runtime/SamplingProfiler.cpp
+    runtime/ScopeOffset.cpp
+    runtime/ScopedArguments.cpp
+    runtime/ScopedArgumentsTable.cpp
+    runtime/ScriptExecutable.cpp
+    runtime/SetConstructor.cpp
+    runtime/SetIteratorPrototype.cpp
+    runtime/SetPrototype.cpp
+    runtime/SimpleTypedArrayController.cpp
+    runtime/SmallStrings.cpp
+    runtime/SparseArrayValueMap.cpp
+    runtime/StackFrame.cpp
+    runtime/StrictEvalActivation.cpp
+    runtime/StringConstructor.cpp
+    runtime/StringIteratorPrototype.cpp
+    runtime/StringObject.cpp
+    runtime/StringPrototype.cpp
+    runtime/StringRecursionChecker.cpp
+    runtime/Structure.cpp
+    runtime/StructureChain.cpp
+    runtime/StructureIDTable.cpp
+    runtime/StructureRareData.cpp
+    runtime/Symbol.cpp
+    runtime/SymbolConstructor.cpp
+    runtime/SymbolObject.cpp
+    runtime/SymbolPrototype.cpp
+    runtime/SymbolTable.cpp
+    runtime/TemplateRegistry.cpp
+    runtime/TemplateRegistryKey.cpp
+    runtime/TemplateRegistryKeyTable.cpp
+    runtime/TestRunnerUtils.cpp
+    runtime/ThrowScope.cpp
+    runtime/TypeLocationCache.cpp
+    runtime/TypeProfiler.cpp
+    runtime/TypeProfilerLog.cpp
+    runtime/TypeSet.cpp
+    runtime/TypedArrayController.cpp
+    runtime/TypedArrayType.cpp
+    runtime/TypeofType.cpp
+    runtime/VM.cpp
+    runtime/VMEntryScope.cpp
+    runtime/VarOffset.cpp
+    runtime/Watchdog.cpp
+    runtime/WeakMapConstructor.cpp
+    runtime/WeakMapData.cpp
+    runtime/WeakMapPrototype.cpp
+    runtime/WeakSetConstructor.cpp
+    runtime/WeakSetPrototype.cpp
+
+    tools/CodeProfile.cpp
+    tools/CodeProfiling.cpp
+    tools/FunctionOverrides.cpp
+    tools/FunctionWhitelist.cpp
+    tools/JSDollarVM.cpp
+    tools/JSDollarVMPrototype.cpp
+    tools/SigillCrashAnalyzer.cpp
+    tools/VMInspector.cpp
+
+    wasm/JSWebAssembly.cpp
+    wasm/WasmB3IRGenerator.cpp
+    wasm/WasmBinding.cpp
+    wasm/WasmCallingConvention.cpp
+    wasm/WasmFormat.cpp
+    wasm/WasmMemory.cpp
+    wasm/WasmMemoryInformation.cpp
+    wasm/WasmModuleParser.cpp
+    wasm/WasmPlan.cpp
+    wasm/WasmValidate.cpp
+
+    wasm/js/JSWebAssemblyCallee.cpp
+    wasm/js/JSWebAssemblyCompileError.cpp
+    wasm/js/JSWebAssemblyInstance.cpp
+    wasm/js/JSWebAssemblyMemory.cpp
+    wasm/js/JSWebAssemblyModule.cpp
+    wasm/js/JSWebAssemblyRuntimeError.cpp
+    wasm/js/JSWebAssemblyTable.cpp
+    wasm/js/WebAssemblyCompileErrorConstructor.cpp
+    wasm/js/WebAssemblyCompileErrorPrototype.cpp
+    wasm/js/WebAssemblyFunction.cpp
+    wasm/js/WebAssemblyInstanceConstructor.cpp
+    wasm/js/WebAssemblyInstancePrototype.cpp
+    wasm/js/WebAssemblyMemoryConstructor.cpp
+    wasm/js/WebAssemblyMemoryPrototype.cpp
+    wasm/js/WebAssemblyModuleConstructor.cpp
+    wasm/js/WebAssemblyModulePrototype.cpp
+    wasm/js/WebAssemblyModuleRecord.cpp
+    wasm/js/WebAssemblyPrototype.cpp
+    wasm/js/WebAssemblyRuntimeErrorConstructor.cpp
+    wasm/js/WebAssemblyRuntimeErrorPrototype.cpp
+    wasm/js/WebAssemblyTableConstructor.cpp
+    wasm/js/WebAssemblyTablePrototype.cpp
+    wasm/js/WebAssemblyToJSCallee.cpp
+
+    yarr/RegularExpression.cpp
+    yarr/YarrCanonicalizeUCS2.cpp
+    yarr/YarrInterpreter.cpp
+    yarr/YarrJIT.cpp
+    yarr/YarrPattern.cpp
+    yarr/YarrSyntaxChecker.cpp
+)
+
+# Extra flags for compile sources can go here.
+if (NOT MSVC)
+    set_source_files_properties(runtime/ProxyObject.cpp PROPERTIES COMPILE_FLAGS -fno-optimize-sibling-calls)
+else ()
+    # FIXME: Investigate if we need to set a similar flag on Windows.
+endif ()
+
+set(JavaScriptCore_OBJECT_LUT_SOURCES
+    runtime/ArrayConstructor.cpp
+    runtime/ArrayIteratorPrototype.cpp
+    runtime/BooleanPrototype.cpp
+    runtime/DateConstructor.cpp
+    runtime/DatePrototype.cpp
+    runtime/ErrorPrototype.cpp
+    runtime/GeneratorPrototype.cpp
+    runtime/InspectorInstrumentationObject.cpp
+    runtime/IntlCollatorConstructor.cpp
+    runtime/IntlCollatorPrototype.cpp
+    runtime/IntlDateTimeFormatConstructor.cpp
+    runtime/IntlDateTimeFormatPrototype.cpp
+    runtime/IntlNumberFormatConstructor.cpp
+    runtime/IntlNumberFormatPrototype.cpp
+    runtime/JSDataViewPrototype.cpp
+    runtime/JSGlobalObject.cpp
+    runtime/JSInternalPromiseConstructor.cpp
+    runtime/JSONObject.cpp
+    runtime/JSPromiseConstructor.cpp
+    runtime/JSPromisePrototype.cpp
+    runtime/MapPrototype.cpp
+    runtime/ModuleLoaderPrototype.cpp
+    runtime/NumberConstructor.cpp
+    runtime/NumberPrototype.cpp
+    runtime/ObjectConstructor.cpp
+    runtime/ReflectObject.cpp
+    runtime/RegExpConstructor.cpp
+    runtime/RegExpPrototype.cpp
+    runtime/SetPrototype.cpp
+    runtime/StringConstructor.cpp
+    runtime/StringIteratorPrototype.cpp
+    runtime/StringPrototype.cpp
+    runtime/SymbolConstructor.cpp
+    runtime/SymbolPrototype.cpp
+
+    wasm/js/WebAssemblyCompileErrorConstructor.cpp
+    wasm/js/WebAssemblyCompileErrorPrototype.cpp
+    wasm/js/WebAssemblyInstanceConstructor.cpp
+    wasm/js/WebAssemblyInstancePrototype.cpp
+    wasm/js/WebAssemblyMemoryConstructor.cpp
+    wasm/js/WebAssemblyMemoryPrototype.cpp
+    wasm/js/WebAssemblyModuleConstructor.cpp
+    wasm/js/WebAssemblyModulePrototype.cpp
+    wasm/js/WebAssemblyPrototype.cpp
+    wasm/js/WebAssemblyRuntimeErrorConstructor.cpp
+    wasm/js/WebAssemblyRuntimeErrorPrototype.cpp
+    wasm/js/WebAssemblyTableConstructor.cpp
+    wasm/js/WebAssemblyTablePrototype.cpp
+)
+
+set(JavaScriptCore_LIBRARIES
+    WTF${DEBUG_SUFFIX}
+    ${ICU_I18N_LIBRARIES}
+    ${LLVM_LIBRARIES}
+)
+
+set(JavaScriptCore_SCRIPTS_SOURCES_DIR "${JAVASCRIPTCORE_DIR}/Scripts")
+
+# Globbing relies on the fact that generator-specific file names are prefixed with their directory.
+# Top-level scripts should have a file extension, since they are invoked during the build.
+
+set(JavaScriptCore_SCRIPTS_SOURCES_PATHS
+    ${JavaScriptCore_SCRIPTS_SOURCES_DIR}/*.pl
+    ${JavaScriptCore_SCRIPTS_SOURCES_DIR}/*.py
+    ${JavaScriptCore_SCRIPTS_SOURCES_DIR}/builtins/builtins*.py
+)
+
+# Force JavaScriptCore to run scripts from the same staging path as WebCore.
+set(JavaScriptCore_SCRIPTS_DIR "${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore/Scripts")
+
+file(MAKE_DIRECTORY ${JavaScriptCore_SCRIPTS_DIR})
+
+# The directory flattening performed below mirrors what the Mac port does with private headers.
+
+file(GLOB JavaScriptCore_SCRIPTS_SOURCES ${JavaScriptCore_SCRIPTS_SOURCES_PATHS})
+
+foreach (_file ${JavaScriptCore_SCRIPTS_SOURCES})
+    get_filename_component(_script "${_file}" NAME)
+    add_custom_command(
+        OUTPUT ${JavaScriptCore_SCRIPTS_DIR}/${_script}
+        MAIN_DEPENDENCY ${_file}
+        WORKING_DIRECTORY ${DERIVED_SOURCES_DIR}
+        COMMAND ${CMAKE_COMMAND} -E copy_if_different ${_file} ${JavaScriptCore_SCRIPTS_DIR}/${_script}
+        VERBATIM)
+    list(APPEND JavaScriptCore_SCRIPTS ${JavaScriptCore_SCRIPTS_DIR}/${_script})
+endforeach ()
+
+set(UDIS_GEN_DEP
+    disassembler/udis86/ud_opcode.py
+)
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/udis86_itab.c ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/udis86_itab.h
+    DEPENDS ${UDIS_GEN_DEP}
+    WORKING_DIRECTORY ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}
+    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/disassembler/udis86/ud_itab.py ${JAVASCRIPTCORE_DIR}/disassembler/udis86/optable.xml ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}
+    VERBATIM)
+
+list(APPEND JavaScriptCore_HEADERS
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/udis86_itab.h
+)
+
+set(LLINT_ASM
+    llint/LowLevelInterpreter.asm
+    llint/LowLevelInterpreter32_64.asm
+    llint/LowLevelInterpreter64.asm
+)
+
+set(OFFLINE_ASM
+    offlineasm/arm.rb
+    offlineasm/arm64.rb
+    offlineasm/ast.rb
+    offlineasm/backends.rb
+    offlineasm/cloop.rb
+    offlineasm/config.rb
+    offlineasm/instructions.rb
+    offlineasm/mips.rb
+    offlineasm/offsets.rb
+    offlineasm/opt.rb
+    offlineasm/parser.rb
+    offlineasm/registers.rb
+    offlineasm/risc.rb
+    offlineasm/self_hash.rb
+    offlineasm/settings.rb
+    offlineasm/sh4.rb
+    offlineasm/transform.rb
+    offlineasm/x86.rb
+)
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InitBytecodes.asm
+    MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/generate-bytecode-files
+    DEPENDS ${JAVASCRIPTCORE_DIR}/generate-bytecode-files bytecode/BytecodeList.json
+    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/generate-bytecode-files --bytecodes_h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h --init_bytecodes_asm ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InitBytecodes.asm ${JAVASCRIPTCORE_DIR}/bytecode/BytecodeList.json
+    VERBATIM)
+
+list(APPEND JavaScriptCore_HEADERS
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h
+)
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntDesiredOffsets.h
+    MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/offlineasm/generate_offset_extractor.rb
+    DEPENDS ${LLINT_ASM} ${OFFLINE_ASM} ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InitBytecodes.asm
+    COMMAND ${RUBY_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/offlineasm/generate_offset_extractor.rb -I${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/ ${JAVASCRIPTCORE_DIR}/llint/LowLevelInterpreter.asm ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntDesiredOffsets.h
+    VERBATIM)
+
+# We add the header files directly to the ADD_EXECUTABLE call instead of setting the
+# OBJECT_DEPENDS property in LLIntOffsetsExtractor.cpp because generate_offset_extractor.rb and
+# generate-bytecode-files may not regenerate the .h files in case the hash it calculates does not change.
+# In this case, if some of the dependencies specified in the ADD_CUSTOM_COMMANDs above have
+# changed the command will always be called because the mtime of the .h files will
+# always be older than that of their dependencies.
+# Additionally, setting the OBJECT_DEPENDS property will make the .h files a Makefile
+# dependency of both LLIntOffsetsExtractor and LLIntOffsetsExtractor.cpp, so the command will
+# actually be run multiple times!
+add_executable(LLIntOffsetsExtractor
+    ${JAVASCRIPTCORE_DIR}/llint/LLIntOffsetsExtractor.cpp
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntDesiredOffsets.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h
+)
+target_link_libraries(LLIntOffsetsExtractor WTF)
+
+# The build system will execute asm.rb every time LLIntOffsetsExtractor's mtime is newer than
+# LLIntAssembly.h's mtime. The problem we have here is: asm.rb has some built-in optimization
+# that generates a checksum of the LLIntOffsetsExtractor binary, if the checksum of the new
+# LLIntOffsetsExtractor matches, no output is generated. To make this target consistent and avoid
+# running this command for every build, we artificially update LLIntAssembly.h's mtime (using touch)
+# after every asm.rb run.
+if (MSVC)
+    set(LLIntOutput LowLevelInterpreterWin.asm)
+    set(OFFLINE_ASM_ARGS --assembler=MASM)
+else ()
+    set(LLIntOutput LLIntAssembly.h)
+endif ()
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/${LLIntOutput}
+    MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/offlineasm/asm.rb
+    DEPENDS LLIntOffsetsExtractor ${LLINT_ASM} ${OFFLINE_ASM} ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InitBytecodes.asm
+    COMMAND ${RUBY_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/offlineasm/asm.rb -I${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/ ${JAVASCRIPTCORE_DIR}/llint/LowLevelInterpreter.asm $<TARGET_FILE:LLIntOffsetsExtractor> ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/${LLIntOutput} ${OFFLINE_ASM_ARGS}
+    COMMAND ${CMAKE_COMMAND} -E touch_nocreate ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/${LLIntOutput}
+    WORKING_DIRECTORY ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}
+    VERBATIM)
+
+# The explanation for not making LLIntAssembly.h part of the OBJECT_DEPENDS property of some of
+# the .cpp files below is similar to the one in the previous comment. However, since these .cpp
+# files are used to build JavaScriptCore itself, we can just add LLIntAssembly.h to JSC_HEADERS
+# since it is used in the add_library() call at the end of this file.
+if (MSVC)
+    enable_language(ASM_MASM)
+    list(APPEND JavaScriptCore_SOURCES
+        ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.asm
+    )
+    # Win32 needs /safeseh with assembly, but Win64 does not.
+    if (CMAKE_SIZEOF_VOID_P EQUAL 4)
+        set_source_files_properties(${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LowLevelInterpreterWin.asm
+            PROPERTIES COMPILE_FLAGS  "/safeseh"
+        )
+    endif ()
+else ()
+    list(APPEND JavaScriptCore_HEADERS
+        ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntAssembly.h
+    )
+endif ()
+
+# WebAssembly generator
+
+macro(GENERATE_PYTHON _generator _input _output)
+    add_custom_command(
+        OUTPUT ${_output}
+        MAIN_DEPENDENCY ${_generator}
+        DEPENDS ${_input}
+        COMMAND ${PYTHON_EXECUTABLE} ${_generator} ${_input} ${_output}
+        VERBATIM)
+    list(APPEND JavaScriptCore_HEADERS ${_output})
+    ADD_SOURCE_DEPENDENCIES(${_input} ${_output})
+endmacro()
+GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmOpsHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmOps.h)
+GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmValidateInlinesHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmValidateInlines.h)
+GENERATE_PYTHON(${CMAKE_CURRENT_SOURCE_DIR}/wasm/generateWasmB3IRGeneratorInlinesHeader.py ${CMAKE_CURRENT_SOURCE_DIR}/wasm/wasm.json ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/WasmB3IRGeneratorInlines.h)
+
+# LUT generator
+
+set(HASH_LUT_GENERATOR ${CMAKE_CURRENT_SOURCE_DIR}/create_hash_table)
+macro(GENERATE_HASH_LUT _input _output)
+    add_custom_command(
+        OUTPUT ${_output}
+        MAIN_DEPENDENCY ${HASH_LUT_GENERATOR}
+        DEPENDS ${_input}
+        COMMAND ${PERL_EXECUTABLE} ${HASH_LUT_GENERATOR} ${_input} > ${_output}
+        VERBATIM)
+    list(APPEND JavaScriptCore_HEADERS ${_output})
+    ADD_SOURCE_DEPENDENCIES(${_input} ${_output})
+endmacro()
+
+# GENERATOR 1-A: LUT creator
+
+foreach (_file ${JavaScriptCore_OBJECT_LUT_SOURCES})
+    get_filename_component(_name ${_file} NAME_WE)
+    GENERATE_HASH_LUT(${CMAKE_CURRENT_SOURCE_DIR}/${_file} ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/${_name}.lut.h)
+endforeach ()
+
+set(JavaScriptCore_FORWARDING_HEADERS_DIRECTORIES
+    API
+    assembler
+    bindings
+    builtins
+    bytecode
+    debugger
+    dfg
+    disassembler
+    domjit
+    heap
+    inspector
+    interpreter
+    jit
+    llint
+    parser
+    profiler
+    replay
+    runtime
+    yarr
+
+    collector/handles
+
+    inspector/agents
+    inspector/augmentable
+    inspector/remote
+)
+
+# GENERATOR 1-B: particular LUT creator (for 1 file only)
+GENERATE_HASH_LUT(${CMAKE_CURRENT_SOURCE_DIR}/parser/Keywords.table ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Lexer.lut.h)
+
+#GENERATOR: "RegExpJitTables.h": tables used by Yarr
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h
+    MAIN_DEPENDENCY ${CMAKE_CURRENT_SOURCE_DIR}/create_regex_tables
+    COMMAND ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/create_regex_tables > ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h
+    VERBATIM)
+ADD_SOURCE_DEPENDENCIES(${CMAKE_CURRENT_SOURCE_DIR}/yarr/YarrPattern.cpp ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/RegExpJitTables.h)
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/YarrCanonicalizeUnicode.cpp
+    MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/generateYarrCanonicalizeUnicode
+    DEPENDS ${JAVASCRIPTCORE_DIR}/ucd/CaseFolding.txt
+    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/generateYarrCanonicalizeUnicode ${JAVASCRIPTCORE_DIR}/ucd/CaseFolding.txt ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/YarrCanonicalizeUnicode.cpp
+    VERBATIM)
+
+list(APPEND JavaScriptCore_SOURCES
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/YarrCanonicalizeUnicode.cpp
+)
+
+#GENERATOR: "KeywordLookup.h": keyword decision tree used by the lexer
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/KeywordLookup.h
+    MAIN_DEPENDENCY ${CMAKE_CURRENT_SOURCE_DIR}/KeywordLookupGenerator.py
+    DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/parser/Keywords.table
+    COMMAND ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/KeywordLookupGenerator.py ${CMAKE_CURRENT_SOURCE_DIR}/parser/Keywords.table > ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/KeywordLookup.h
+    VERBATIM)
+ADD_SOURCE_DEPENDENCIES(${CMAKE_CURRENT_SOURCE_DIR}/parser/Lexer.cpp ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/KeywordLookup.h)
+
+
+# Inspector Interfaces
+
+set(JavaScriptCore_INSPECTOR_SCRIPTS_DIR "${JAVASCRIPTCORE_DIR}/inspector/scripts")
+
+set(JavaScriptCore_INSPECTOR_PROTOCOL_SCRIPTS
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/generate-inspector-protocol-bindings.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/cpp_generator.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/cpp_generator_templates.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generate_js_backend_commands.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generate_cpp_backend_dispatcher_header.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generate_cpp_backend_dispatcher_implementation.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generate_cpp_frontend_dispatcher_header.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generate_cpp_frontend_dispatcher_implementation.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generate_cpp_protocol_types_header.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generate_cpp_protocol_types_implementation.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generator.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/generator_templates.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/__init__.py
+    ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/codegen/models.py
+)
+
+set(JavaScriptCore_INSPECTOR_DOMAINS
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/ApplicationCache.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/CSS.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Console.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/DOM.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/DOMDebugger.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/DOMStorage.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Database.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Debugger.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/GenericTypes.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Heap.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Inspector.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/LayerTree.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Network.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/OverlayTypes.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Page.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Runtime.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/ScriptProfiler.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Timeline.json
+    ${JAVASCRIPTCORE_DIR}/inspector/protocol/Worker.json
+)
+
+if (ENABLE_INDEXED_DATABASE)
+    list(APPEND JavaScriptCore_INSPECTOR_DOMAINS
+        ${JAVASCRIPTCORE_DIR}/inspector/protocol/IndexedDB.json
+    )
+endif ()
+
+if (ENABLE_RESOURCE_USAGE)
+    list(APPEND JavaScriptCore_INSPECTOR_DOMAINS
+        ${JAVASCRIPTCORE_DIR}/inspector/protocol/Memory.json
+    )
+endif ()
+
+if (ENABLE_WEB_REPLAY)
+    list(APPEND JavaScriptCore_INSPECTOR_DOMAINS
+        ${JAVASCRIPTCORE_DIR}/inspector/protocol/Replay.json
+    )
+endif ()
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/CombinedDomains.json
+    MAIN_DEPENDENCY ${JavaScriptCore_SCRIPTS_DIR}/generate-combined-inspector-json.py
+    DEPENDS ${JavaScriptCore_INSPECTOR_DOMAINS}
+    COMMAND ${PYTHON_EXECUTABLE} ${JavaScriptCore_SCRIPTS_DIR}/generate-combined-inspector-json.py ${JavaScriptCore_INSPECTOR_DOMAINS} > ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/CombinedDomains.json
+    VERBATIM)
+
+# Inspector Backend Dispatchers, Frontend Dispatchers, Type Builders
+file(MAKE_DIRECTORY ${DERIVED_SOURCES_WEBINSPECTORUI_DIR}/UserInterface/Protocol)
+file(MAKE_DIRECTORY ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector)
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorBackendDispatchers.cpp
+           ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorBackendDispatchers.h
+           ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorFrontendDispatchers.cpp
+           ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorFrontendDispatchers.h
+           ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorProtocolObjects.cpp
+           ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorProtocolObjects.h
+           ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorBackendCommands.js
+    MAIN_DEPENDENCY ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/CombinedDomains.json
+    DEPENDS ${JavaScriptCore_INSPECTOR_PROTOCOL_SCRIPTS}
+    COMMAND ${PYTHON_EXECUTABLE} ${JavaScriptCore_INSPECTOR_SCRIPTS_DIR}/generate-inspector-protocol-bindings.py --outputDir "${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector" --framework JavaScriptCore ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/CombinedDomains.json
+    VERBATIM)
+
+# JSCBuiltins
+
+set(BUILTINS_GENERATOR_SCRIPTS
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generator.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_model.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_templates.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generate_combined_header.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generate_combined_implementation.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generate_separate_header.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generate_separate_implementation.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generate_wrapper_header.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generate_wrapper_implementation.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generate_internals_wrapper_header.py
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins_generate_internals_wrapper_implementation.py
+    ${JavaScriptCore_SCRIPTS_DIR}/generate-js-builtins.py
+    ${JavaScriptCore_SCRIPTS_DIR}/lazywriter.py
+)
+
+set(JavaScriptCore_BUILTINS_SOURCES
+    ${JAVASCRIPTCORE_DIR}/builtins/ArrayConstructor.js
+    ${JAVASCRIPTCORE_DIR}/builtins/ArrayIteratorPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/ArrayPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/AsyncFunctionPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/DatePrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/FunctionPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/GeneratorPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/GlobalObject.js
+    ${JAVASCRIPTCORE_DIR}/builtins/GlobalOperations.js
+    ${JAVASCRIPTCORE_DIR}/builtins/InspectorInstrumentationObject.js
+    ${JAVASCRIPTCORE_DIR}/builtins/InternalPromiseConstructor.js
+    ${JAVASCRIPTCORE_DIR}/builtins/IteratorHelpers.js
+    ${JAVASCRIPTCORE_DIR}/builtins/IteratorPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/MapPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/ModuleLoaderPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/NumberConstructor.js
+    ${JAVASCRIPTCORE_DIR}/builtins/NumberPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/ObjectConstructor.js
+    ${JAVASCRIPTCORE_DIR}/builtins/PromiseConstructor.js
+    ${JAVASCRIPTCORE_DIR}/builtins/PromiseOperations.js
+    ${JAVASCRIPTCORE_DIR}/builtins/PromisePrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/ReflectObject.js
+    ${JAVASCRIPTCORE_DIR}/builtins/RegExpPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/SetPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/StringConstructor.js
+    ${JAVASCRIPTCORE_DIR}/builtins/StringIteratorPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/StringPrototype.js
+    ${JAVASCRIPTCORE_DIR}/builtins/TypedArrayConstructor.js
+    ${JAVASCRIPTCORE_DIR}/builtins/TypedArrayPrototype.js
+)
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/AirOpcode.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/AirOpcodeGenerated.h
+    MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/b3/air/AirOpcode.opcodes
+    DEPENDS ${JAVASCRIPTCORE_DIR}/b3/air/opcode_generator.rb
+    COMMAND ${RUBY_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/b3/air/opcode_generator.rb ${JAVASCRIPTCORE_DIR}/b3/air/AirOpcode.opcodes VERBATIM
+    WORKING_DIRECTORY ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}
+)
+
+list(APPEND JavaScriptCore_SOURCES
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/AirOpcode.h
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/AirOpcodeGenerated.h
+)
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSCBuiltins.cpp ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSCBuiltins.h
+    MAIN_DEPENDENCY ${JavaScriptCore_SCRIPTS_DIR}/generate-js-builtins.py
+    DEPENDS ${JavaScriptCore_BUILTINS_SOURCES} ${BUILTINS_GENERATOR_SCRIPTS}
+    COMMAND ${PYTHON_EXECUTABLE} ${JavaScriptCore_SCRIPTS_DIR}/generate-js-builtins.py --framework JavaScriptCore --output-directory ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR} --combined ${JavaScriptCore_BUILTINS_SOURCES}
+    VERBATIM)
+
+list(APPEND JavaScriptCore_SOURCES
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorBackendDispatchers.cpp
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorFrontendDispatchers.cpp
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorProtocolObjects.cpp
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSCBuiltins.cpp
+)
+
+list(APPEND JavaScriptCore_HEADERS
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorBackendDispatchers.h
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorFrontendDispatchers.h
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorProtocolObjects.h
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSCBuiltins.h
+)
+
+add_custom_command(
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InjectedScriptSource.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InjectedScriptSource.min.js
+    MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/inspector/InjectedScriptSource.js
+    DEPENDS ${JavaScriptCore_SCRIPTS_DIR}/xxd.pl ${JavaScriptCore_SCRIPTS_DIR}/jsmin.py
+    COMMAND ${CMAKE_COMMAND} -E echo "//# sourceURL=__InjectedScript_InjectedScriptSource.js" > ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InjectedScriptSource.min.js
+    COMMAND ${PYTHON_EXECUTABLE} ${JavaScriptCore_SCRIPTS_DIR}/jsmin.py < ${JAVASCRIPTCORE_DIR}/inspector/InjectedScriptSource.js >> ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InjectedScriptSource.min.js
+    COMMAND ${PERL_EXECUTABLE} ${JavaScriptCore_SCRIPTS_DIR}/xxd.pl InjectedScriptSource_js ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InjectedScriptSource.min.js ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InjectedScriptSource.h
+    VERBATIM)
+
+list(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InjectedScriptSource.h)
+
+# Web Replay inputs generator
+if (ENABLE_WEB_REPLAY)
+    set(JavaScript_WEB_REPLAY_INPUTS ${CMAKE_CURRENT_SOURCE_DIR}/replay/JSInputs.json)
+    add_custom_command(
+        OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSReplayInputs.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSReplayInputs.cpp
+        MAIN_DEPENDENCY ${CMAKE_CURRENT_SOURCE_DIR}/replay/scripts/CodeGeneratorReplayInputs.py
+        DEPENDS ${JavaScript_WEB_REPLAY_INPUTS}
+        COMMAND ${PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/replay/scripts/CodeGeneratorReplayInputs.py --outputDir ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/ --framework JavaScriptCore ${JavaScript_WEB_REPLAY_INPUTS}
+        VERBATIM)
+
+    list(APPEND JavaScriptCore_SOURCES
+        replay/EncodedValue.cpp
+        ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSReplayInputs.cpp
+    )
+    list(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/JSReplayInputs.h)
+endif ()
+
+if (WTF_CPU_ARM)
+elseif (WTF_CPU_ARM64)
+elseif (WTF_CPU_HPPA)
+elseif (WTF_CPU_PPC)
+elseif (WTF_CPU_PPC64)
+elseif (WTF_CPU_PPC64LE)
+elseif (WTF_CPU_S390)
+elseif (WTF_CPU_S390X)
+elseif (WTF_CPU_MIPS)
+elseif (WTF_CPU_SH4)
+elseif (WTF_CPU_X86)
+elseif (WTF_CPU_X86_64)
+    if (MSVC AND ENABLE_JIT)
+        add_custom_command(
+            OUTPUT ${DERIVED_SOURCES_DIR}/JITStubsMSVC64.obj
+            MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/jit/JITStubsMSVC64.asm
+            COMMAND ml64 -nologo -c -Fo ${DERIVED_SOURCES_DIR}/JITStubsMSVC64.obj ${JAVASCRIPTCORE_DIR}/jit/JITStubsMSVC64.asm
+            VERBATIM)
+
+        list(APPEND JavaScriptCore_SOURCES ${DERIVED_SOURCES_DIR}/JITStubsMSVC64.obj)
+    endif ()
+else ()
+    message(FATAL_ERROR "Unknown CPU")
+endif ()
+
+
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
+
+WEBKIT_CREATE_FORWARDING_HEADERS(JavaScriptCore DIRECTORIES ${JavaScriptCore_FORWARDING_HEADERS_DIRECTORIES} FILES ${JavaScriptCore_FORWARDING_HEADERS_FILES})
+
+target_include_directories(LLIntOffsetsExtractor PRIVATE ${JavaScriptCore_INCLUDE_DIRECTORIES})
+
+add_subdirectory(shell)
+
+WEBKIT_WRAP_SOURCELIST(${JavaScriptCore_SOURCES})
+WEBKIT_FRAMEWORK(JavaScriptCore)
+
+if (NOT "${PORT}" STREQUAL "Mac")
+    if (${JavaScriptCore_LIBRARY_TYPE} STREQUAL "SHARED")
+        POPULATE_LIBRARY_VERSION(JAVASCRIPTCORE)
+        set_target_properties(JavaScriptCore PROPERTIES VERSION ${JAVASCRIPTCORE_VERSION} SOVERSION ${JAVASCRIPTCORE_VERSION_MAJOR})
+        install(TARGETS JavaScriptCore DESTINATION "${LIB_INSTALL_DIR}")
+    endif ()
+endif ()
+
+# Force staging of shared scripts, even if they aren't directly used to build JavaScriptCore.
+
+add_custom_target(stageSharedScripts DEPENDS ${JavaScriptCore_SCRIPTS})
+add_dependencies(JavaScriptCore stageSharedScripts)
+
+if (MSVC)
+    add_custom_command(
+        TARGET JavaScriptCore
+        PRE_BUILD
+        COMMAND ${PERL_EXECUTABLE} ${WEBKIT_LIBRARIES_DIR}/tools/scripts/auto-version.pl ${DERIVED_SOURCES_DIR}
+        VERBATIM)
+
+    add_custom_command(
+        TARGET JavaScriptCore
+        POST_BUILD
+        COMMAND ${PERL_EXECUTABLE} ${WEBKIT_LIBRARIES_DIR}/tools/scripts/version-stamp.pl ${DERIVED_SOURCES_DIR} $<TARGET_FILE:JavaScriptCore>
+        VERBATIM)
+endif ()
diff --git a/COPYING.LIB b/COPYING.LIB
new file mode 100644
index 0000000..87c4a33
--- /dev/null
+++ b/COPYING.LIB
@@ -0,0 +1,488 @@
+
+
+NOTE! The LGPL below is copyrighted by the Free Software Foundation, but 
+the instance of code that it refers to (the kde libraries) are copyrighted 
+by the authors who actually wrote it.
+				   
+---------------------------------------------------------------------------
+		  GNU LIBRARY GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1991 Free Software Foundation, Inc.
+                    51 Franklin Street, Fifth Floor
+                    Boston, MA 02110-1301, USA.
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the library GPL.  It is
+ numbered 2 because it goes with version 2 of the ordinary GPL.]
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Library General Public License, applies to some
+specially designated Free Software Foundation software, and to any
+other libraries whose authors decide to use it.  You can use it for
+your libraries, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if
+you distribute copies of the library, or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link a program with the library, you must provide
+complete object files to the recipients so that they can relink them
+with the library, after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  Our method of protecting your rights has two steps: (1) copyright
+the library, and (2) offer you this license which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  Also, for each distributor's protection, we want to make certain
+that everyone understands that there is no warranty for this free
+library.  If the library is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original
+version, so that any problems introduced by others will not reflect on
+the original authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that companies distributing free
+software will individually obtain patent licenses, thus in effect
+transforming the program into proprietary software.  To prevent this,
+we have made it clear that any patent must be licensed for everyone's
+free use or not licensed at all.
+
+  Most GNU software, including some libraries, is covered by the ordinary
+GNU General Public License, which was designed for utility programs.  This
+license, the GNU Library General Public License, applies to certain
+designated libraries.  This license is quite different from the ordinary
+one; be sure to read it in full, and don't assume that anything in it is
+the same as in the ordinary license.
+
+  The reason we have a separate public license for some libraries is that
+they blur the distinction we usually make between modifying or adding to a
+program and simply using it.  Linking a program with a library, without
+changing the library, is in some sense simply using the library, and is
+analogous to running a utility program or application program.  However, in
+a textual and legal sense, the linked executable is a combined work, a
+derivative of the original library, and the ordinary General Public License
+treats it as such.
+
+  Because of this blurred distinction, using the ordinary General
+Public License for libraries did not effectively promote software
+sharing, because most developers did not use the libraries.  We
+concluded that weaker conditions might promote sharing better.
+
+  However, unrestricted linking of non-free programs would deprive the
+users of those programs of all benefit from the free status of the
+libraries themselves.  This Library General Public License is intended to
+permit developers of non-free programs to use free libraries, while
+preserving your freedom as a user of such programs to change the free
+libraries that are incorporated in them.  (We have not seen how to achieve
+this as regards changes in header files, but we have achieved it as regards
+changes in the actual functions of the Library.)  The hope is that this
+will lead to faster development of free libraries.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, while the latter only
+works together with the library.
+
+  Note that it is possible for a library to be covered by the ordinary
+General Public License rather than by this special one.
+
+		  GNU LIBRARY GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library which
+contains a notice placed by the copyright holder or other authorized
+party saying it may be distributed under the terms of this Library
+General Public License (also called "this License").  Each licensee is
+addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+  
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also compile or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    c) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    d) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the source code distributed need not include anything that is normally
+distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Library General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+			    NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
diff --git a/ChangeLog b/ChangeLog
new file mode 100644
index 0000000..6f8959c
--- /dev/null
+++ b/ChangeLog
@@ -0,0 +1,26467 @@
+2017-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        verifyEdges should not run in release
+        <rdar://problem/30537798>
+
+        Reviewed by Keith Miller and Mark Lam.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2017-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Disable concurrent GC A:B testing.
+
+        * runtime/Options.h:
+
+2017-02-17  JF Bastien  <jfbastien@apple.com>
+
+        A/B test concurrent GC
+        https://bugs.webkit.org/show_bug.cgi?id=168453
+        <rdar://problem/30553220>
+
+        Reviewed by Phil Pizlo.
+
+        The concurrent GC may be causing more crashes, but it's hard to
+        tell. A/B test this by setting it off for 50% of users, based on
+        the UUID which crash tracer generates. From this we can look at
+        crashes and figure out whether the concurrent GC was on or off,
+        and derive whether fewer crashes occur when it's off.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2017-02-21  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212692. rdar://problem/30475767
+
+    2017-02-20  Mark Lam  <mark.lam@apple.com>
+
+            [Re-landing] CachedCall should let GC know to keep its arguments alive.
+            https://bugs.webkit.org/show_bug.cgi?id=168567
+            <rdar://problem/30475767>
+
+            Reviewed by Saam Barati.
+
+            We fix this by having CachedCall use a MarkedArgumentBuffer to store its
+            arguments instead of a Vector.
+
+            Also declared CachedCall, MarkedArgumentBuffer, and ProtoCallFrame as
+            WTF_FORBID_HEAP_ALLOCATION because they rely on being stack allocated for
+            correctness.
+
+            Update: the original patch has a bug in MarkedArgumentBuffer::expandCapacity()
+            where it was copying and calling addMarkSet() on values in m_buffer beyond m_size
+            (up to m_capacity).  As a result, depending on the pre-existing values in
+            m_inlineBuffer, this may result in a computed Heap pointer that is wrong, and
+            subsequently, manifest as a crash.  This is likely to be the cause of the PLT
+            regression.
+
+            I don't have a new test for this fix because the issue relies on sufficiently bad
+            values randomly showing up in m_inlineBuffer when we do an ensureCapacity() which
+            calls expandCapacity().
+
+            * interpreter/CachedCall.h:
+            (JSC::CachedCall::CachedCall):
+            (JSC::CachedCall::call):
+            (JSC::CachedCall::clearArguments):
+            (JSC::CachedCall::appendArgument):
+            (JSC::CachedCall::setArgument): Deleted.
+            * interpreter/CallFrame.h:
+            (JSC::ExecState::emptyList):
+            * interpreter/Interpreter.cpp:
+            (JSC::Interpreter::prepareForRepeatCall):
+            * interpreter/Interpreter.h:
+            * interpreter/ProtoCallFrame.h:
+            * runtime/ArgList.cpp:
+            (JSC::MarkedArgumentBuffer::slowEnsureCapacity):
+            (JSC::MarkedArgumentBuffer::expandCapacity):
+            (JSC::MarkedArgumentBuffer::slowAppend):
+            * runtime/ArgList.h:
+            (JSC::MarkedArgumentBuffer::append):
+            (JSC::MarkedArgumentBuffer::ensureCapacity):
+            * runtime/StringPrototype.cpp:
+            (JSC::replaceUsingRegExpSearch):
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+
+2017-02-20  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Rollout r212660. rdar://problem/30553220
+
+2017-02-20  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Rollout r212646. rdar://problem/30475767
+
+2017-02-17  Matthew Hanson  <matthew_hanson@apple.com>
+
+        A/B test concurrent GC
+        https://bugs.webkit.org/show_bug.cgi?id=168453
+        <rdar://problem/30553220>
+
+        Landed on behalf of JF Bastien.
+
+        Reviewed by Alexey Proskuryakov.
+
+        The concurrent GC may be causing more crashes, but it's hard to
+        tell. A/B test this by setting it off for 50% of users, based on
+        the UUID which crash tracer generates. From this we can look at
+        crashes and figure out whether the concurrent GC was on or off,
+        and derive whether fewer crashes occur when it's off.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2017-02-20  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212618. rdar://problem/30475767
+
+    2017-02-19  Mark Lam  <mark.lam@apple.com>
+
+            CachedCall should let GC know to keep its arguments alive.
+            https://bugs.webkit.org/show_bug.cgi?id=168567
+            <rdar://problem/30475767>
+
+            Reviewed by Saam Barati.
+
+            We fix this by having CachedCall use a MarkedArgumentBuffer to store its
+            arguments instead of a Vector.
+
+            Also declared CachedCall, MarkedArgumentBuffer, and ProtoCallFrame as
+            WTF_FORBID_HEAP_ALLOCATION because they rely on being stack allocated for
+            correctness.
+
+            * interpreter/CachedCall.h:
+            (JSC::CachedCall::CachedCall):
+            (JSC::CachedCall::call):
+            (JSC::CachedCall::clearArguments):
+            (JSC::CachedCall::appendArgument):
+            (JSC::CachedCall::setArgument): Deleted.
+            * interpreter/CallFrame.h:
+            (JSC::ExecState::emptyList):
+            * interpreter/Interpreter.cpp:
+            (JSC::Interpreter::prepareForRepeatCall):
+            * interpreter/Interpreter.h:
+            * interpreter/ProtoCallFrame.h:
+            * runtime/ArgList.cpp:
+            (JSC::MarkedArgumentBuffer::expandCapacity):
+            * runtime/ArgList.h:
+            (JSC::MarkedArgumentBuffer::ensureCapacity):
+            * runtime/StringPrototype.cpp:
+            (JSC::replaceUsingRegExpSearch):
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+
+2017-02-17  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212177. rdar://problem/30205880
+
+    2017-02-10  Saam Barati  <sbarati@apple.com>
+
+            Object allocation sinking phase doesn't properly handle control flow when emitting a PutHint of a materialized object into a PromotedHeapLocation of a still sunken object
+            https://bugs.webkit.org/show_bug.cgi?id=168140
+            <rdar://problem/30205880>
+
+            Reviewed by Filip Pizlo.
+
+            This patch fixes a bug in allocation sinking phase where
+            we don't properly handle control flow when materializing
+            an object and also PutHinting that materialization into
+            a still sunken object. We were performing the PutHint
+            for the materialization at the point of materialization,
+            however, we may have materialized along both edges
+            of a control flow diamond, in which case, we need to
+            also PutHint at the join point. Consider this program:
+
+            ```
+            bb#0:
+            b: PhantomActivation()
+            a: PhantomNewFunction()
+            c: PutHint(@a, @b, ActivationLoc)
+            Branch(#1, #2)
+
+            bb#1:
+            d: MaterializeActivation()
+            e: PutHint(@a, @d, ActivationLoc)
+            f: Upsilon(@d, ^p)
+            Jump(#3)
+
+            bb#2:
+            g: MaterializeActivation()
+            h: PutHint(@a, @g, ActivationLoc)
+            i: Upsilon(@d, ^p)
+            Jump(#3)
+
+            bb#3:
+            p: Phi()
+            // What is PromotedHeapLocation(@a, ActivationLoc) here?
+            // What would we do if we exited?
+            ```
+            Before this patch, we didn't perform a PutHint of the Phi.
+            However, we need to, otherwise when exit, we won't know
+            the value of PromotedHeapLocation(@a, ActivationLoc)
+
+            The program we need then, for correctness, is this:
+            ```
+            bb#0:
+            b: PhantomActivation()
+            a: PhantomNewFunction()
+            c: PutHint(@a, @b, ActivationLoc)
+            Branch(#1, #2)
+
+            bb#1:
+            d: MaterializeActivation()
+            e: PutHint(@a, @d, ActivationLoc)
+            f: Upsilon(@d, ^p)
+            Jump(#3)
+
+            bb#2:
+            g: MaterializeActivation()
+            h: PutHint(@a, @g, ActivationLoc)
+            i: Upsilon(@d, ^p)
+            Jump(#3)
+
+            bb#3:
+            p: Phi()
+            j: PutHint(@a, @p, ActivationLoc)
+            ```
+
+            This patch makes it so that we emit the necessary PutHint at node `j`.
+            I've also added more validation to the OSRAvailabilityAnalysisPhase
+            to catch this problem during validation.
+
+            * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+            (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+            * dfg/DFGObjectAllocationSinkingPhase.cpp:
+            * ftl/FTLOperations.cpp:
+            (JSC::FTL::operationMaterializeObjectInOSR):
+
+2017-02-17  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212035. rdar://problem/30433204
+
+    2017-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+            SharedArrayBuffer does not need to be in the transfer list
+            https://bugs.webkit.org/show_bug.cgi?id=168079
+
+            Reviewed by Geoffrey Garen and Keith Miller.
+
+            Exposes a simple shareWith() API for when you know you want to share the contents of
+            a shared buffer. Also a useful explicit operator bool.
+
+            * runtime/ArrayBuffer.cpp:
+            (JSC::ArrayBuffer::shareWith):
+            * runtime/ArrayBuffer.h:
+            (JSC::ArrayBufferContents::operator bool):
+
+2017-02-17  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212146. rdar://problem/28656664
+
+    2017-02-10  Mark Lam  <mark.lam@apple.com>
+
+            StructureStubInfo::considerCaching() should write barrier its owner CodeBlock when buffering a new Structure.
+            https://bugs.webkit.org/show_bug.cgi?id=168137
+            <rdar://problem/28656664>
+
+            Reviewed by Filip Pizlo.
+
+            If we're adding a new structure to StructureStubInfo's bufferedStructures, we
+            should write barrier the StubInfo's owner CodeBlock because that structure may be
+            collected during the next GC.  Write barrier-ing the owner CodeBlock ensures that
+            CodeBlock::finalizeBaselineJITInlineCaches() is called on it during the GC,
+            which, in turn, gives the StructureStubInfo the opportunity to filter out the
+            dead structure.
+
+            * bytecode/StructureStubInfo.h:
+            (JSC::StructureStubInfo::considerCaching):
+            * jit/JITOperations.cpp:
+
+2017-02-16  Keith Miller  <keith_miller@apple.com>
+
+        Fix merge issue with r212085 (rdar://problem/29939864).
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::callerGetter):
+
+2017-02-12  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r211609.
+
+    2017-02-02  Mark Lam  <mark.lam@apple.com>
+
+            Add a SIGILL crash analyzer to make debugging SIGILLs easier.
+            https://bugs.webkit.org/show_bug.cgi?id=167714
+            <rdar://problem/30318237>
+
+            Not reviewed.
+
+            Build fix for CLOOP build.
+
+            * tools/VMInspector.cpp:
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212022. rdar://problem/30198083
+
+    2017-02-09  Mark Lam  <mark.lam@apple.com>
+
+            B3::Procedure::deleteOrphans() should neutralize upsilons with dead phis.
+            https://bugs.webkit.org/show_bug.cgi?id=167437
+            <rdar://problem/30198083>
+
+            Reviewed by Filip Pizlo.
+
+            * b3/B3Procedure.cpp:
+            (JSC::B3::Procedure::deleteOrphans):
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212021. rdar://problem/30149432
+
+    2017-02-09  Saam Barati  <sbarati@apple.com>
+
+            Sloppy mode: We don't properly hoist functions names "arguments" when we have a non-simple parameter list
+            https://bugs.webkit.org/show_bug.cgi?id=167319
+            <rdar://problem/30149432>
+
+            Reviewed by Mark Lam.
+
+            When hoisting a function inside sloppy mode, we were assuming all "var"s are inside
+            what we call the "var" SymbolTableEntry. This was almost true, execpt for "arguments",
+            which has sufficiently weird behavior. "arguments" can be visible to the default
+            parameter expressions inside a function, therefore can't go inside the "var"
+            SymbolTableEntry since the parameter SymbolTableEntry comes before the "var"
+            SymbolTableEntry in the scope chain.  Therefore, if we hoist a function named
+            "arguments", then we must also look for that variable inside the parameter scope
+            stack entry.
+
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary):
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212019. rdar://problem/30128133
+
+    2017-02-09  Mark Lam  <mark.lam@apple.com>
+
+            Fix max length check in ArrayPrototype.js' concatSlowPath().
+            https://bugs.webkit.org/show_bug.cgi?id=167270
+            <rdar://problem/30128133>
+
+            Reviewed by Filip Pizlo.
+
+            1. Fixed concatSlowPath() to ensure that the result array length does not exceed
+               @MAX_ARRAY_INDEX.  The old code was checking against @MAX_SAFE_INTEGER in some
+               cases, but this is overly permissive.
+
+            2. Changed concatSlowPath() to throw a RangeError instead of a TypeError to be
+               consistent with the C++ runtime functions in JSArray.cpp.
+
+            3. Changed the RangeError message in concatSlowPath() and JSArray.cpp to "Length
+               exceeded the maximum array length" when the error is that the result length
+               exceeds MAX_ARRAY_INDEX.  We do this for 2 reasons:
+               a. "Length exceeded the maximum array length" is more informative than
+                  "Invalid array length".
+               b. We want to use the same string consistently for the same error.
+
+               There are still 2 places in JSArray.cpp that still throws a RangeError with
+               message "Invalid array length".  In those cases, the error is not necessarily
+               due to the result length exceeding MAX_ARRAY_INDEX, but is due to attempting to
+               set a length value that is not an integer that fits in MAX_ARRAY_INDEX e.g.
+               an attempt to set a fractional length value.  Hence, "Invalid array length" is
+               appropriate for those cases.
+
+            4. Fixed JSArray::appendMemcpy() to handle overflows when computing the result
+               array length.
+
+            * builtins/ArrayPrototype.js:
+            (concatSlowPath):
+            * bytecode/BytecodeIntrinsicRegistry.cpp:
+            (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+            * bytecode/BytecodeIntrinsicRegistry.h:
+            * runtime/ArrayPrototype.cpp:
+            (JSC::concatAppendOne):
+            (JSC::arrayProtoPrivateFuncAppendMemcpy):
+            * runtime/JSArray.cpp:
+            (JSC::JSArray::appendMemcpy):
+            (JSC::JSArray::push):
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212015. rdar://problem/30054759
+
+    2017-02-09  Mark Lam  <mark.lam@apple.com>
+
+            Constructed object's global object should be the global object of the constructor.
+            https://bugs.webkit.org/show_bug.cgi?id=167121
+            <rdar://problem/30054759>
+
+            Reviewed by Filip Pizlo and Geoffrey Garen.
+
+            The realm (i.e. globalObject) of any object should be the same as the constructor
+            that instantiated the object.  Changed PrototypeMap::createEmptyStructure() to
+            be passed the correct globalObject to use instead of assuming it's the same one
+            as the prototype object.
+
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::finishCreation):
+            * bytecode/InternalFunctionAllocationProfile.h:
+            (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
+            * bytecode/ObjectAllocationProfile.h:
+            (JSC::ObjectAllocationProfile::initialize):
+            * runtime/FunctionRareData.cpp:
+            (JSC::FunctionRareData::initializeObjectAllocationProfile):
+            * runtime/FunctionRareData.h:
+            (JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase):
+            * runtime/InternalFunction.cpp:
+            (JSC::InternalFunction::createSubclassStructure):
+            * runtime/IteratorOperations.cpp:
+            (JSC::createIteratorResultObjectStructure):
+            * runtime/JSBoundFunction.cpp:
+            (JSC::getBoundFunctionStructure):
+            * runtime/JSFunction.cpp:
+            (JSC::JSFunction::allocateAndInitializeRareData):
+            (JSC::JSFunction::initializeRareData):
+            * runtime/JSGlobalObject.cpp:
+            (JSC::JSGlobalObject::init):
+            * runtime/JSProxy.cpp:
+            (JSC::JSProxy::setTarget):
+            * runtime/ObjectConstructor.h:
+            (JSC::constructEmptyObject):
+            * runtime/PrototypeMap.cpp:
+            (JSC::PrototypeMap::createEmptyStructure):
+            (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
+            (JSC::PrototypeMap::emptyObjectStructureForPrototype):
+            (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
+            * runtime/PrototypeMap.h:
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r212009. rdar://problem/29939864
+
+    2017-02-09  Keith Miller  <keith_miller@apple.com>
+
+            We should not allow Function.caller to be used on native functions
+            https://bugs.webkit.org/show_bug.cgi?id=165628
+
+            Reviewed by Mark Lam.
+
+            Also remove unneeded dynamic cast.
+
+            * runtime/JSFunction.cpp:
+            (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
+            (JSC::JSFunction::callerGetter):
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211622. rdar://problem/30116072
+
+    2017-02-02  Andreas Kling  <akling@apple.com>
+
+            [Mac] In-process memory pressure monitor for WebContent processes AKA websam
+            <https://webkit.org/b/167491>
+            <rdar://problem/30116072>
+
+            Reviewed by Antti Koivisto.
+
+            Remove the sloppy "max live heap size" mechanism from JSC in favor of the new
+            WebCore-side memory footprint monitor.
+
+            * heap/Heap.cpp:
+            (JSC::Heap::updateAllocationLimits):
+            (JSC::Heap::didExceedMaxLiveSize): Deleted.
+            * heap/Heap.h:
+            (JSC::Heap::setMaxLiveSize): Deleted.
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211896. rdar://problem/29754721
+
+    2017-02-08  Saam Barati  <sbarati@apple.com>
+
+            Air IRC might spill a terminal that produces a value after the terminal
+            https://bugs.webkit.org/show_bug.cgi?id=167919
+            <rdar://problem/29754721>
+
+            Reviewed by Filip Pizlo.
+
+            IRC may spill a value-producing terminal (a patchpoint can be a value-producing terminal).
+            It used to do this by placing the spill *after* the terminal. This produces an invalid
+            graph because no instructions are allowed after the terminal.
+
+            I fixed this bug by having a cleanup pass over the IR after IRC is done.
+            The pass detects this problem, and fixes it by moving the spill into the
+            successors. However, it is careful to detect when the edge to the
+            successor is a critical edge. If the value-producing patchpoint is
+            the only predecessor of the successor, it just moves the spill
+            code to the beginning of the successor. Otherwise, it's a critical
+            edge and it breaks it by adding a block that does the spilling then
+            jumps to the successor.
+
+            * b3/air/AirInsertionSet.cpp:
+            * b3/air/AirInsertionSet.h:
+            (JSC::B3::Air::InsertionSet::insertInsts):
+            * b3/air/AirIteratedRegisterCoalescing.cpp:
+            * b3/testb3.cpp:
+            (JSC::B3::testTerminalPatchpointThatNeedsToBeSpilled):
+            (JSC::B3::testTerminalPatchpointThatNeedsToBeSpilled2):
+            (JSC::B3::run):
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211642. rdar://problem/29542720
+
+    2017-02-03  Saam Barati  <sbarati@apple.com>
+
+            When OSR entering to the baseline JIT from the LLInt for a ProgramCodeBlock we can skip compiling a lot of the program
+            https://bugs.webkit.org/show_bug.cgi?id=167725
+            <rdar://problem/30339082>
+
+            Reviewed by Michael Saboff.
+
+            We often want to baseline compile ProgramCode once we hit a loop in the LLInt.
+            However, some programs execute a non-trivial amount of code before the loop.
+            This code can never be executed again because ProgramCodeBlocks never run more
+            than once. We're wasting time and memory by compiling code that is unreachable
+            from the OSR entry destination. This patch fixes this by only compiling code
+            that is reachable from the OSR entry destination.
+
+            This is a speedup on Kraken/ai-astar for devices with limited CPUs (I've been
+            testing on devices with 2 CPUs). On ai-astar, we were spending 50-100ms compiling
+            a huge ProgramCodeBlock in the baseline JIT where the majority of the code
+            would never execute. If this compilation was kicked off on the main thread,
+            then we'd be stalled for a long time. If it were started on the baseline JITs
+            background compilation thread, we'd still waste 50-100ms in that thread, causing
+            all other baseline compilations to happen on the main thread.
+
+            * interpreter/Interpreter.cpp:
+            (JSC::Interpreter::executeProgram):
+            * interpreter/Interpreter.h:
+            * jit/JIT.cpp:
+            (JSC::JIT::JIT):
+            (JSC::JIT::privateCompileMainPass):
+            * jit/JIT.h:
+            (JSC::JIT::compile):
+            * jit/JITWorklist.cpp:
+            (JSC::JITWorklist::Plan::Plan):
+            (JSC::JITWorklist::Plan::compileNow):
+            (JSC::JITWorklist::compileLater):
+            (JSC::JITWorklist::compileNow):
+            * jit/JITWorklist.h:
+            * llint/LLIntSlowPaths.cpp:
+            (JSC::LLInt::jitCompileAndSetHeuristics):
+            (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+            * runtime/Completion.cpp:
+            (JSC::evaluate):
+
+2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211603. rdar://problem/30318237
+
+    2017-02-02  Mark Lam  <mark.lam@apple.com>
+
+            Add a SIGILL crash analyzer to make debugging SIGILLs easier.
+            https://bugs.webkit.org/show_bug.cgi?id=167714
+            <rdar://problem/30318237>
+
+            Reviewed by Filip Pizlo.
+
+            The current implementation is only for X86_64 and ARM64 on OS(DARWIN).  The
+            analyzer is not enabled for all other ports.
+
+            * CMakeLists.txt:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * API/JSVirtualMachine.mm:
+            * assembler/ARM64Assembler.h:
+            (JSC::ARM64Assembler::illegalInstruction):
+            * assembler/MacroAssemblerARM64.h:
+            (JSC::MacroAssemblerARM64::illegalInstruction):
+            * assembler/MacroAssemblerX86Common.h:
+            (JSC::MacroAssemblerX86Common::illegalInstruction):
+            * assembler/X86Assembler.h:
+            (JSC::X86Assembler::illegalInstruction):
+            * heap/Heap.cpp:
+            (JSC::Heap::forEachCodeBlockIgnoringJITPlansImpl):
+            * heap/Heap.h:
+            * heap/HeapInlines.h:
+            (JSC::Heap::forEachCodeBlockIgnoringJITPlans):
+            * runtime/Options.cpp:
+            (JSC::Options::isAvailable):
+            (JSC::recomputeDependentOptions):
+            * runtime/Options.h:
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            (JSC::VM::~VM):
+            * runtime/VM.h:
+            * tools/SigillCrashAnalyzer.cpp: Added.
+            (JSC::SignalContext::SignalContext):
+            (JSC::SignalContext::dump):
+            (JSC::handleCrash):
+            (JSC::initializeCrashHandler):
+            (JSC::ensureSigillCrashAnalyzer):
+            (JSC::SigillCrashAnalyzer::analyze):
+            (JSC::SigillCrashAnalyzer::dumpCodeBlock):
+            * tools/SigillCrashAnalyzer.h: Added.
+            * tools/VMInspector.cpp: Added.
+            (JSC::VMInspector::instance):
+            (JSC::VMInspector::add):
+            (JSC::VMInspector::remove):
+            (JSC::ensureIsSafeToLock):
+            * tools/VMInspector.h: Added.
+            (JSC::VMInspector::iterate):
+
+2017-02-06  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211666. rdar://problem/30167791
+
+    2017-02-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+            Unreviewed rollout of r211486, r211629.
+
+            Original change is not ideal and is causing issues.
+
+            * inspector/agents/InspectorHeapAgent.cpp:
+            (Inspector::SendGarbageCollectionEventsTask::SendGarbageCollectionEventsTask):
+            * runtime/InitializeThreading.cpp:
+            (JSC::initializeThreading):
+
+2017-02-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211630. rdar://problem/30318237
+
+    2017-02-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+            [cmake] Unreviewed AArch64 buildfix after r211603.
+            https://bugs.webkit.org/show_bug.cgi?id=167714
+
+            * CMakeLists.txt:
+
+2017-02-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211658. rdar://problem/29144126
+
+    2017-02-03  JF Bastien  <jfbastien@apple.com>
+
+            OSR entry: delay outer-loop compilation when at inner-loop
+            https://bugs.webkit.org/show_bug.cgi?id=167149
+
+            Reviewed by Filip Pizlo.
+
+            r211224 and r211461 were reverted because they caused massive
+            kraken/ai-astar regressions. This patch instead does the
+            minimally-disruptive change to fix the original bug as described
+            below, but omits extra tuning and refactoring which I had
+            before. I'll commit tuning and refactoring separately, if this
+            sticks. This patch is therefore very minimal, and layers carefully
+            on top of the complex spaghetti-logic. The only change it makes is
+            that it uses triggers to indicate to outer loops that they should
+            compile, which fixes the immediate bug and seems roughly perf
+            neutral (maybe a small gain on kraken sometimes, other times a
+            small regression as would be expected from slightly compiling
+            later). As opposed to r211461 this patch doesn't unconditionally
+            unset the trigger because it prevents further DFG executions from
+            entering. It therefore makes the trigger a tri-state enum class:
+            don't trigger, compilation done, start compilation. Only "start
+            compilation" gets reset to "don't trigger". "Compilation done"
+            does not (unless there's a problem compiling, then it gets set
+            back to "don't trigger").
+
+            As of https://bugs.webkit.org/show_bug.cgi?id=155217 OSR
+            compilation can be kicked off for an entry into an outer-loop,
+            while executing an inner-loop. This is desirable because often the
+            codegen from an inner-entry isn't as good as the codegen from an
+            outer-entry, but execution from an inner-loop is often pretty hot
+            and likely to kick off compilation. This approach provided nice
+            speedups on Kraken because we'd select to enter to the outer-loop
+            very reliably, which reduces variability (the inner-loop was
+            selected roughly 1/5 times from my unscientific measurements).
+
+            When compilation starts we take a snapshot of the JSValues at the
+            current execution state using OSR's recovery mechanism. These
+            values are passed to the compiler and are used as way to perform
+            type profiling, and could be used to observe cell types as well as
+            to perform predictions such as through constant propagation.
+
+            It's therefore desired to enter from the outer-loop when we can,
+            but we need to be executing from that location to capture the
+            right JSValues, otherwise we're confusing the compiler and giving
+            it inaccurate JSValues which can lead it to predict the wrong
+            things, leading to suboptimal code or recompilation due to
+            misprediction, or in super-corner-cases a crash.
+
+            DFG tier-up was added here:
+            https://bugs.webkit.org/show_bug.cgi?id=112838
+
+            * dfg/DFGJITCode.h:
+            * dfg/DFGJITCompiler.cpp:
+            (JSC::DFG::JITCompiler::JITCompiler):
+            * dfg/DFGOperations.cpp:
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+            (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback):
+            (JSC::DFG::Ref<ToFTLForOSREntryDeferredCompilationCallback>ToFTLForOSREntryDeferredCompilationCallback::create):
+            (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+            (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
+            * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h:
+
+2017-02-02  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211486. rdar://problem/30167791
+
+    2017-02-01  Joseph Pecoraro  <pecoraro@apple.com>
+
+            Web Inspector: Use guaranteed RunLoop instead of RunLoop::current for dispatching inspector GC event
+            https://bugs.webkit.org/show_bug.cgi?id=167683
+            <rdar://problem/30167791>
+
+            Reviewed by Timothy Hatcher.
+
+            * inspector/agents/InspectorHeapAgent.cpp:
+            (Inspector::SendGarbageCollectionEventsTask::SendGarbageCollectionEventsTask):
+            Use RunLoop::main instead of RunLoop::current which may go away.
+
+            * runtime/InitializeThreading.cpp:
+            (JSC::initializeThreading):
+            Ensure RunLoop::main is initialized when using JSC APIs.
+
+2017-02-02  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211463. rdar://problem/30296879
+
+    2017-01-31  Filip Pizlo  <fpizlo@apple.com>
+
+            Make verifyEdge a RELEASE_ASSERT
+            <rdar://problem/30296879>
+
+            Rubber stamped by Saam Barati.
+
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2017-01-31  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211385. rdar://problem/29738502
+
+    2017-01-30  Matt Baker  <mattbaker@apple.com>
+
+            Web Inspector: Need some limit on Async Call Stacks for async loops (rAF loops)
+            https://bugs.webkit.org/show_bug.cgi?id=165633
+            <rdar://problem/29738502>
+
+            Reviewed by Joseph Pecoraro.
+
+            This patch limits the memory used by the Inspector backend to store async
+            stack trace data.
+
+            Asynchronous stack traces are stored as a disjoint set of parent pointer
+            trees. Tree nodes represent asynchronous operations, and hold a copy of
+            the stack trace at the time the operation was scheduled. Each tree can
+            be regarded as a set of stack traces, stored as singly linked lists that
+            share part of their structure (specifically their tails). Traces belonging
+            to the same tree will at least share a common root. A stack trace begins
+            at a leaf node and follows the chain of parent pointers to the root of
+            of the tree. Leaf nodes always contain pending asynchronous calls.
+
+            When an asynchronous operation is scheduled with requestAnimationFrame,
+            setInterval, etc, a node is created containing the current call stack and
+            some bookkeeping data for the operation. An unique identifier comprised
+            of an operation type and callback identifier is mapped to the node. If
+            scheduling the callback was itself the result of an asynchronous call,
+            the node becomes a child of the node associated with that call, otherwise
+            it becomes the root of a new tree.
+
+            A node is either `pending`, `active`, `dispatched`, or `canceled`. Nodes
+            start out as pending. After a callback for a pending node is dispatched
+            the node is marked as such, unless it is a repeating callback such as
+            setInterval, in which case it remains pending. Once a node is no longer
+            pending it is removed, as long as it has no children. Since nodes are
+            reference counted, it is a property of the stack trace tree that nodes
+            that are no longer pending and have no children pointing to them will be
+            automatically pruned from the tree.
+
+            If an async operation is canceled (e.g. cancelTimeout), the associated
+            node is marked as such. If the callback is not being dispatched at the
+            time, and has no children, it is removed.
+
+            Because async operations can be chained indefinitely, stack traces are
+            limited to a maximum depth. The depth of a stack trace is equal to the
+            sum of the depths of its nodes, with a node's depth equal to the number
+            of frames in its associated call stack. For any stack trace,
+
+                S = { sퟶ, sퟷ, …, s푘 }, with endpoints sퟶ, s푘
+                depth(S) = depth(sퟶ) + depth(sퟷ) + … + depth(s푘)
+
+            A stack trace is truncated when it exceeds the maximum depth. Truncation
+            occurs on node boundaries, not call frames, consequently the maximum depth
+            is more of a target than a guarantee:
+
+                d = maximum stack trace depth
+                for all S, depth(S) ≤ d + depth(s푘)
+
+            Because nodes can belong to multiple stack traces, it may be necessary
+            to clone the tail of a stack trace being truncated to prevent other traces
+            from being effected.
+
+            * CMakeLists.txt:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * inspector/AsyncStackTrace.cpp: Added.
+            (Inspector::AsyncStackTrace::create):
+            (Inspector::AsyncStackTrace::AsyncStackTrace):
+            (Inspector::AsyncStackTrace::~AsyncStackTrace):
+            (Inspector::AsyncStackTrace::isPending):
+            (Inspector::AsyncStackTrace::isLocked):
+            (Inspector::AsyncStackTrace::willDispatchAsyncCall):
+            (Inspector::AsyncStackTrace::didDispatchAsyncCall):
+            (Inspector::AsyncStackTrace::didCancelAsyncCall):
+            (Inspector::AsyncStackTrace::buildInspectorObject):
+            (Inspector::AsyncStackTrace::truncate):
+            (Inspector::AsyncStackTrace::remove):
+            * inspector/AsyncStackTrace.h:
+            * inspector/agents/InspectorDebuggerAgent.cpp:
+            (Inspector::InspectorDebuggerAgent::didScheduleAsyncCall):
+            (Inspector::InspectorDebuggerAgent::didCancelAsyncCall):
+            (Inspector::InspectorDebuggerAgent::willDispatchAsyncCall):
+            (Inspector::InspectorDebuggerAgent::didDispatchAsyncCall):
+            (Inspector::InspectorDebuggerAgent::didPause):
+            (Inspector::InspectorDebuggerAgent::clearAsyncStackTraceData):
+            (Inspector::InspectorDebuggerAgent::buildAsyncStackTrace): Deleted.
+            (Inspector::InspectorDebuggerAgent::refAsyncCallData): Deleted.
+            (Inspector::InspectorDebuggerAgent::derefAsyncCallData): Deleted.
+            * inspector/agents/InspectorDebuggerAgent.h:
+            * inspector/protocol/Console.json:
+
+2017-01-31  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211300. rdar://problem/30135571
+
+    2017-01-27  Filip Pizlo  <fpizlo@apple.com>
+
+            scanExternalRememberedSet needs to mergeIfNecessary
+            https://bugs.webkit.org/show_bug.cgi?id=167523
+
+            Reviewed by Keith Miller.
+
+            The protocol for opaque roots is that if you add to them outside of draining, then you need to call
+            mergeIfNecessary.
+
+            This means that every MarkingConstraint that adds opaque roots needs to mergeIfNecessary after.
+
+            scanExternalRememberedSet transitively calls addOpaqueRoot, is called from a MarkingConstraint, and
+            was missing a call to mergeIfNecessary. This fixes it.
+
+            * API/JSVirtualMachine.mm:
+            (scanExternalRememberedSet):
+
+2017-01-27  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211194. rdar://problem/30201008
+
+    2017-01-25  Filip Pizlo  <fpizlo@apple.com>
+
+            jsc.cpp should have the $.agent stuff for testing SAB
+            https://bugs.webkit.org/show_bug.cgi?id=167431
+
+            Reviewed by Saam Barati.
+
+            This adds some stuff that the SAB branch of test262 needs. None of this is exposed except for our
+            own tests and the SAB branch of test262. We now pass all of the Atomics tests in the SAB branch
+            of test262.
+
+            * jsc.cpp:
+            (Message::releaseContents):
+            (Message::index):
+            (GlobalObject::finishCreation):
+            (GlobalObject::addFunction):
+            (Message::Message):
+            (Message::~Message):
+            (Worker::Worker):
+            (Worker::~Worker):
+            (Worker::send):
+            (Worker::receive):
+            (Worker::current):
+            (Worker::currentWorker):
+            (Workers::Workers):
+            (Workers::~Workers):
+            (Workers::broadcast):
+            (Workers::report):
+            (Workers::tryGetReport):
+            (Workers::getReport):
+            (Workers::singleton):
+            (functionDollarCreateRealm):
+            (functionDollarDetachArrayBuffer):
+            (functionDollarEvalScript):
+            (functionDollarAgentStart):
+            (functionDollarAgentReceiveBroadcast):
+            (functionDollarAgentReport):
+            (functionDollarAgentSleep):
+            (functionDollarAgentBroadcast):
+            (functionDollarAgentGetReport):
+            (functionWaitForReport):
+            (checkException):
+            (runWithScripts):
+            (runJSC):
+            (jscmain):
+            * runtime/JSArrayBuffer.h:
+
+2017-01-27  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Rollout r211258. rdar://problem/29144126
+
+2017-01-27  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211237. rdar://problem/30179506
+
+    2017-01-26  Saam Barati  <sbarati@apple.com>
+
+            Harden how the compiler references GC objects
+            https://bugs.webkit.org/show_bug.cgi?id=167277
+            <rdar://problem/30179506>
+
+            Reviewed by Filip Pizlo.
+
+            Since r210971, the DFG/FTL will flash safepoints before
+            each phase. This means that there are more opportunities for
+            a GC to happen while the compiler is running. Because of this,
+            the compiler must keep track of all the heap pointers that are part
+            of the Graph data structure. To accomplish this, I've designed
+            a new type called RegisteredStructure that can only be constructed
+            after the Graph becomes aware of its underlying Structure*. I
+            designed this new type to have the type system in C++ help us catch
+            errors where we're not informing the graph/plan of a heap pointer.
+            I've made it a compile error to create an OpInfo with a pointer
+            T* where T inherits from HeapCell. This encourages an OpInfo
+            to be created with either a FrozenValue* or a RegisteredStructure.
+            I've added similar compile time assertions for TrustedImmPtr in DFG::SpeculativeJIT
+            and FTL::Output::constIntPtr. These static asserts don't save us from all bad
+            programs because there are ways to write code that's incorrect that compiles,
+            but the new types do help us ensure that the most obvious way of writing the
+            code is correct.
+
+            The reason this patch is so big is that I've strung RegisteredStructure and
+            RegisteredStructureSet through the entire DFG/FTL.
+
+            * CMakeLists.txt:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::determineLiveness):
+            * bytecode/StructureSet.cpp:
+            (JSC::StructureSet::filter): Deleted.
+            (JSC::StructureSet::filterArrayModes): Deleted.
+            (JSC::StructureSet::speculationFromStructures): Deleted.
+            (JSC::StructureSet::arrayModesFromStructures): Deleted.
+            (JSC::StructureSet::validateReferences): Deleted.
+            * bytecode/StructureSet.h:
+            * dfg/DFGAbstractInterpreter.h:
+            (JSC::DFG::AbstractInterpreter::filter):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::booleanResult):
+            (JSC::DFG::isToThisAnIdentity):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::filter):
+            * dfg/DFGAbstractValue.cpp:
+            (JSC::DFG::AbstractValue::set):
+            (JSC::DFG::AbstractValue::setType):
+            (JSC::DFG::AbstractValue::mergeOSREntryValue):
+            (JSC::DFG::AbstractValue::filter):
+            (JSC::DFG::AbstractValue::changeStructure):
+            (JSC::DFG::AbstractValue::contains):
+            * dfg/DFGAbstractValue.h:
+            (JSC::DFG::AbstractValue::observeTransition):
+            (JSC::DFG::AbstractValue::TransitionObserver::TransitionObserver):
+            * dfg/DFGArgumentsEliminationPhase.cpp:
+            * dfg/DFGArrayMode.cpp:
+            (JSC::DFG::ArrayMode::alreadyChecked):
+            * dfg/DFGArrayifySlowPathGenerator.h:
+            (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+            (JSC::DFG::ByteCodeParser::load):
+            (JSC::DFG::ByteCodeParser::handleGetById):
+            (JSC::DFG::ByteCodeParser::handlePutById):
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+            * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+            (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator):
+            (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
+            * dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:
+            (JSC::DFG::CallCreateDirectArgumentsSlowPathGenerator::CallCreateDirectArgumentsSlowPathGenerator):
+            * dfg/DFGCommonData.cpp:
+            (JSC::DFG::CommonData::notifyCompilingStructureTransition):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
+            (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+            * dfg/DFGDesiredWeakReferences.cpp:
+            (JSC::DFG::DesiredWeakReferences::reallyAdd):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::checkArray):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::Graph):
+            (JSC::DFG::Graph::dump):
+            (JSC::DFG::Graph::tryGetConstantProperty):
+            (JSC::DFG::Graph::inferredValueForProperty):
+            (JSC::DFG::Graph::visitChildren):
+            (JSC::DFG::Graph::freeze):
+            (JSC::DFG::Graph::registerStructure):
+            (JSC::DFG::Graph::assertIsRegistered):
+            * dfg/DFGGraph.h:
+            (JSC::DFG::Graph::registerStructure):
+            (JSC::DFG::Graph::addStructureSet):
+            * dfg/DFGJITCompiler.h:
+            (JSC::DFG::JITCompiler::branchWeakStructure):
+            * dfg/DFGMultiGetByOffsetData.cpp:
+            (JSC::DFG::MultiGetByOffsetCase::dumpInContext):
+            * dfg/DFGMultiGetByOffsetData.h:
+            (JSC::DFG::MultiGetByOffsetCase::MultiGetByOffsetCase):
+            (JSC::DFG::MultiGetByOffsetCase::set):
+            * dfg/DFGNode.cpp:
+            (JSC::DFG::Node::convertToPutStructureHint):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::convertToCheckStructure):
+            (JSC::DFG::Node::structureSet):
+            (JSC::DFG::Node::structure):
+            (JSC::DFG::Node::OpInfoWrapper::OpInfoWrapper):
+            (JSC::DFG::Node::OpInfoWrapper::operator=):
+            (JSC::DFG::Node::OpInfoWrapper::asRegisteredStructure):
+            * dfg/DFGObjectAllocationSinkingPhase.cpp:
+            * dfg/DFGOpInfo.h:
+            (JSC::DFG::OpInfo::OpInfo):
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl):
+            (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+            * dfg/DFGRegisteredStructure.h: Added.
+            (JSC::DFG::RegisteredStructure::get):
+            (JSC::DFG::RegisteredStructure::operator->):
+            (JSC::DFG::RegisteredStructure::operator==):
+            (JSC::DFG::RegisteredStructure::operator!=):
+            (JSC::DFG::RegisteredStructure::operator bool):
+            (JSC::DFG::RegisteredStructure::RegisteredStructure):
+            (JSC::DFG::RegisteredStructure::createPrivate):
+            * dfg/DFGRegisteredStructureSet.cpp: Added.
+            (JSC::DFG::RegisteredStructureSet::filter):
+            (JSC::DFG::RegisteredStructureSet::filterArrayModes):
+            (JSC::DFG::RegisteredStructureSet::speculationFromStructures):
+            (JSC::DFG::RegisteredStructureSet::arrayModesFromStructures):
+            (JSC::DFG::RegisteredStructureSet::validateReferences):
+            * dfg/DFGRegisteredStructureSet.h: Added.
+            (JSC::DFG::RegisteredStructureSet::RegisteredStructureSet):
+            (JSC::DFG::RegisteredStructureSet::onlyStructure):
+            (JSC::DFG::RegisteredStructureSet::toStructureSet):
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+            (JSC::DFG::SpeculativeJIT::emitGetCallee):
+            (JSC::DFG::SpeculativeJIT::silentFill):
+            (JSC::DFG::SpeculativeJIT::checkArray):
+            (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+            (JSC::DFG::SpeculativeJIT::compileFromCharCode):
+            (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+            (JSC::DFG::compileClampDoubleToByte):
+            (JSC::DFG::SpeculativeJIT::compileMakeRope):
+            (JSC::DFG::SpeculativeJIT::compileArithRounding):
+            (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
+            (JSC::DFG::SpeculativeJIT::compileNewFunction):
+            (JSC::DFG::SpeculativeJIT::compileCreateActivation):
+            (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
+            (JSC::DFG::SpeculativeJIT::compileCreateScopedArguments):
+            (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):
+            (JSC::DFG::SpeculativeJIT::compileSpread):
+            (JSC::DFG::SpeculativeJIT::compileArraySlice):
+            (JSC::DFG::SpeculativeJIT::compileTypeOf):
+            (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+            (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+            (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOnCell):
+            (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+            (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
+            (JSC::DFG::SpeculativeJIT::compileMaterializeNewObject):
+            * dfg/DFGSpeculativeJIT.h:
+            (JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
+            (JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPointer):
+            (JSC::DFG::SpeculativeJIT::TrustedImmPtr::operator MacroAssembler::TrustedImmPtr):
+            (JSC::DFG::SpeculativeJIT::TrustedImmPtr::asIntptr):
+            (JSC::DFG::SpeculativeJIT::callOperation):
+            (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject):
+            (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
+            (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
+            (JSC::DFG::SpeculativeJIT::emitCall):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+            (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+            (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+            (JSC::DFG::SpeculativeJIT::compile):
+            (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
+            (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
+            (JSC::DFG::SpeculativeJIT::emitCall):
+            (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+            (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+            (JSC::DFG::SpeculativeJIT::compile):
+            (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+            * dfg/DFGStrengthReductionPhase.cpp:
+            (JSC::DFG::StrengthReductionPhase::handleNode):
+            * dfg/DFGStructureAbstractValue.cpp:
+            (JSC::DFG::StructureAbstractValue::assertIsRegistered):
+            (JSC::DFG::StructureAbstractValue::clobber):
+            (JSC::DFG::StructureAbstractValue::observeTransition):
+            (JSC::DFG::StructureAbstractValue::observeTransitions):
+            (JSC::DFG::StructureAbstractValue::add):
+            (JSC::DFG::StructureAbstractValue::merge):
+            (JSC::DFG::StructureAbstractValue::mergeNotTop):
+            (JSC::DFG::StructureAbstractValue::filter):
+            (JSC::DFG::StructureAbstractValue::filterSlow):
+            (JSC::DFG::StructureAbstractValue::filterClassInfoSlow):
+            (JSC::DFG::StructureAbstractValue::contains):
+            (JSC::DFG::StructureAbstractValue::isSubsetOf):
+            (JSC::DFG::StructureAbstractValue::isSupersetOf):
+            (JSC::DFG::StructureAbstractValue::overlaps):
+            (JSC::DFG::StructureAbstractValue::isSubClassOf):
+            (JSC::DFG::StructureAbstractValue::dumpInContext):
+            * dfg/DFGStructureAbstractValue.h:
+            (JSC::DFG::StructureAbstractValue::StructureAbstractValue):
+            (JSC::DFG::StructureAbstractValue::operator=):
+            (JSC::DFG::StructureAbstractValue::set):
+            (JSC::DFG::StructureAbstractValue::toStructureSet):
+            (JSC::DFG::StructureAbstractValue::at):
+            (JSC::DFG::StructureAbstractValue::operator[]):
+            (JSC::DFG::StructureAbstractValue::onlyStructure):
+            * dfg/DFGStructureRegistrationPhase.cpp:
+            (JSC::DFG::StructureRegistrationPhase::StructureRegistrationPhase): Deleted.
+            (JSC::DFG::StructureRegistrationPhase::run): Deleted.
+            (JSC::DFG::StructureRegistrationPhase::registerStructures): Deleted.
+            (JSC::DFG::StructureRegistrationPhase::registerStructure): Deleted.
+            (JSC::DFG::StructureRegistrationPhase::assertAreRegistered): Deleted.
+            (JSC::DFG::StructureRegistrationPhase::assertIsRegistered): Deleted.
+            (JSC::DFG::performStructureRegistration): Deleted.
+            * dfg/DFGStructureRegistrationPhase.h:
+            * dfg/DFGTransition.cpp:
+            (JSC::DFG::Transition::dumpInContext):
+            * dfg/DFGTransition.h:
+            (JSC::DFG::Transition::Transition):
+            * dfg/DFGTypeCheckHoistingPhase.cpp:
+            (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheck):
+            (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheckAccountingForArrayMode):
+            * dfg/DFGValidate.cpp:
+            * ftl/FTLLowerDFGToB3.cpp:
+            (JSC::FTL::DFG::LowerDFGToB3::lower):
+            (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
+            (JSC::FTL::DFG::LowerDFGToB3::compileCheckStructure):
+            (JSC::FTL::DFG::LowerDFGToB3::compilePutStructure):
+            (JSC::FTL::DFG::LowerDFGToB3::compileArraySlice):
+            (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
+            (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
+            (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewArray):
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayBuffer):
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+            (JSC::FTL::DFG::LowerDFGToB3::compileAllocatePropertyStorage):
+            (JSC::FTL::DFG::LowerDFGToB3::compileReallocatePropertyStorage):
+            (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
+            (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
+            (JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucket):
+            (JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
+            (JSC::FTL::DFG::LowerDFGToB3::compileCheckStructureImmediate):
+            (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+            (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
+            (JSC::FTL::DFG::LowerDFGToB3::compileLogShadowChickenTail):
+            (JSC::FTL::DFG::LowerDFGToB3::checkStructure):
+            (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateUninitializedContiguousJSArray):
+            (JSC::FTL::DFG::LowerDFGToB3::boolify):
+            (JSC::FTL::DFG::LowerDFGToB3::equalNullOrUndefined):
+            (JSC::FTL::DFG::LowerDFGToB3::lowCell):
+            (JSC::FTL::DFG::LowerDFGToB3::speculateStringObjectForStructureID):
+            (JSC::FTL::DFG::LowerDFGToB3::weakPointer):
+            (JSC::FTL::DFG::LowerDFGToB3::frozenPointer):
+            (JSC::FTL::DFG::LowerDFGToB3::weakStructureID):
+            (JSC::FTL::DFG::LowerDFGToB3::weakStructure):
+            (JSC::FTL::DFG::LowerDFGToB3::crash):
+            * ftl/FTLOutput.h:
+            (JSC::FTL::Output::weakPointer):
+            (JSC::FTL::Output::constIntPtr):
+
+2017-01-27  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211246. rdar://problem/29916672
+
+    2017-01-26  Mark Lam  <mark.lam@apple.com>
+
+            Fix missing exception check in genericTypedArrayViewProtoFuncSet().
+            https://bugs.webkit.org/show_bug.cgi?id=166812
+            <rdar://problem/29916672>
+
+            Reviewed by Saam Barati.
+
+            * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+            (JSC::genericTypedArrayViewProtoFuncSet):
+
+2017-01-26  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211224. rdar://problem/29144126
+
+    2017-01-26  JF Bastien  <jfbastien@apple.com>
+
+            OSR entry: delay outer-loop compilation when at inner-loop
+            https://bugs.webkit.org/show_bug.cgi?id=167149
+
+            Reviewed by Filip Pizlo.
+
+            As of https://bugs.webkit.org/show_bug.cgi?id=155217 OSR
+            compilation can be kicked off for an entry into an outer-loop,
+            while executing an inner-loop. This is desirable because often the
+            codegen from an inner-entry isn't as good as the codegen from an
+            outer-entry, but execution from an inner-loop is often pretty hot
+            and likely to kick off compilation. This approach provided nice
+            speedups on Kraken because we'd select to enter to the outer-loop
+            very reliably, which reduces variability (the inner-loop was
+            selected roughly 1/5 times from my unscientific measurements).
+
+            When compilation starts we take a snapshot of the JSValues at the
+            current execution state using OSR's recovery mechanism. These
+            values are passed to the compiler and are used as way to perform
+            type profiling, and could be used to observe cell types as well as
+            to perform predictions such as through constant propagation.
+
+            It's therefore desired to enter from the outer-loop when we can,
+            but we need to be executing from that location to capture the
+            right JSValues, otherwise we're confusing the compiler and giving
+            it inaccurate JSValues which can lead it to predict the wrong
+            things, leading to suboptimal code or recompilation due to
+            misprediction, or in super-corner-cases a crash.
+
+            These effects are pretty hard to measure: Fil points out that
+            marsalis-osr-entry really needs mustHandleValues (the JSValues
+            from the point of execution) because right now it just happens to
+            correctly guess int32. I tried removing mustHandleValues entirely
+            and saw no slowdowns, but our benchmarks probably aren't
+            sufficient to reliably find issues, sometimes because we happen to
+            have sufficient mitigations.
+
+            DFG tier-up was added here:
+            https://bugs.webkit.org/show_bug.cgi?id=112838
+
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * dfg/DFGJITCode.h:
+            * dfg/DFGJITCompiler.cpp:
+            (JSC::DFG::JITCompiler::JITCompiler):
+            * dfg/DFGOSREntry.cpp:
+            (JSC::DFG::prepareOSREntry):
+            * dfg/DFGOSREntry.h:
+            (JSC::DFG::prepareOSREntry):
+            * dfg/DFGOperations.cpp:
+            * dfg/DFGOperations.h:
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGTierUpEntryTrigger.h: Copied from Source/JavaScriptCore/ftl/FTLOSREntry.h.
+            * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+            (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback):
+            (JSC::DFG::Ref<ToFTLForOSREntryDeferredCompilationCallback>ToFTLForOSREntryDeferredCompilationCallback::create):
+            (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+            (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
+            * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h:
+            * ftl/FTLOSREntry.cpp:
+            (JSC::FTL::prepareOSREntry):
+            * ftl/FTLOSREntry.h:
+            * jit/JITOperations.cpp:
+
+2017-01-26  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211167. rdar://problem/30192652
+
+    2017-01-25  Filip Pizlo  <fpizlo@apple.com>
+
+            ARM/ARM64 stress/atomics-store-return.js fails
+            <rdar://problem/30192652>
+
+            Reviewed by Michael Saboff.
+
+            The problem was relying on double->int casts for anything. We need to use toInt32().
+
+            * runtime/AtomicsObject.cpp:
+            (JSC::atomicsFuncCompareExchange):
+            (JSC::atomicsFuncExchange):
+            (JSC::atomicsFuncStore):
+
+2017-01-26  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211180. rdar://problem/30156092
+
+    2017-01-25  Matthew Hanson  <matthew_hanson@apple.com>
+
+            Merge r211124. rdar://problem/30156092
+
+        2017-01-24  Michael Saboff  <msaboff@apple.com>
+
+                InferredTypeTable entry manipulation is not TOCTOU race safe
+                https://bugs.webkit.org/show_bug.cgi?id=167344
+
+                Reviewed by Filip Pizlo.
+
+                Made the accesses to table values safe from Time of Check,
+                Time of Use races with local temporary values.
+
+                Fixed point that we set an entry in the table to access the
+                current table entry instead of using the local entry.  In that case,
+                we reload the now changed entry.
+
+                * runtime/InferredTypeTable.cpp:
+                (JSC::InferredTypeTable::visitChildren):
+                (JSC::InferredTypeTable::get):
+                (JSC::InferredTypeTable::willStoreValue):
+                (JSC::InferredTypeTable::makeTop):
+
+2017-01-25  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Rollout r211180.
+
+2017-01-25  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211129. rdar://problem/30178458
+
+    2017-01-24  Filip Pizlo  <fpizlo@apple.com>
+
+            Atomics.store should return the int-converted value according to toInteger
+            https://bugs.webkit.org/show_bug.cgi?id=167399
+
+            Reviewed by Saam Barati.
+
+            I keep getting this wrong, but I think I've finally done it right. What we want is for
+            Atomics.store to return the value it was passed after toInteger, which doesn't clip the value to
+            any kind of range. It does get truncated to double.
+
+            This changes the code to pass those "integers" as doubles. It doesn't matter that this is slow,
+            since all of these code paths are slow due to their need to check everything. We'll take care of
+            that by making them intrinsic later.
+
+            * runtime/AtomicsObject.cpp:
+            (JSC::atomicsFuncAdd):
+            (JSC::atomicsFuncAnd):
+            (JSC::atomicsFuncCompareExchange):
+            (JSC::atomicsFuncExchange):
+            (JSC::atomicsFuncLoad):
+            (JSC::atomicsFuncOr):
+            (JSC::atomicsFuncStore):
+            (JSC::atomicsFuncSub):
+            (JSC::atomicsFuncXor):
+
+2017-01-25  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211122. rdar://problem/30177808
+
+    2017-01-24  Filip Pizlo  <fpizlo@apple.com>
+
+            Atomics.store should return the int-converted value, not the value that it stored
+            https://bugs.webkit.org/show_bug.cgi?id=167395
+
+            Reviewed by Saam Barati.
+
+            Previously the code was based around passing a lambda that operated over the native type of the
+            operation (so for example int8_t if we were doing things to Int8Arrays). But to support this
+            behavior of store, we need it to be able to control how it converts its result to JSValue and it
+            needs to see its argument as an int32_t. It turns out that it's easy for all of the functions in
+            AtomicsObject.cpp to also adopt this protocol since the conversion to JSValue is just jsNumber()
+            from the native type in those cases, and the conversion from int32_t is done for free in
+            std::atomic.
+
+            * runtime/AtomicsObject.cpp:
+            (JSC::atomicsFuncAdd):
+            (JSC::atomicsFuncAnd):
+            (JSC::atomicsFuncCompareExchange):
+            (JSC::atomicsFuncExchange):
+            (JSC::atomicsFuncLoad):
+            (JSC::atomicsFuncOr):
+            (JSC::atomicsFuncStore):
+            (JSC::atomicsFuncSub):
+            (JSC::atomicsFuncXor):
+
+2017-01-25  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211113. rdar://problem/30174692
+
+    2017-01-24  Filip Pizlo  <fpizlo@apple.com>
+
+            -0 is a valid array index and AtomicsObject should know this
+            https://bugs.webkit.org/show_bug.cgi?id=167386
+
+            Reviewed by Mark Lam.
+
+            * runtime/AtomicsObject.cpp: The bug title really says it all.
+
+2017-01-25  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211111. rdar://problem/30173375
+
+    2017-01-24  Filip Pizlo  <fpizlo@apple.com>
+
+            Enable the stochastic space-time scheduler on the larger multicores
+            https://bugs.webkit.org/show_bug.cgi?id=167382
+            <rdar://problem/30173375>
+
+            Rubber stamped by Saam Barati
+
+            This looks like a 1.3% JetStream speed-up thanks to a 28% splay-latency improvement. This new
+            scheduler seems to prevent all of the same pathologies as the old one prevented. But instead of
+            periodically suspending the mutator, this new one will only suspend after an iteration of the
+            constraint fixpoint. The length of that suspension length is random with the distribution being
+            governed by mutatorUtilization. Once resumed, the mutator gets to run unimpeded until draining
+            stalls.
+
+            I'm enabling it on platforms as I benchmark those platforms. It's possible that we will want to
+            use a different scheduler on different platforms.
+
+            * runtime/Options.cpp:
+            (JSC::overrideDefaults):
+
+2017-01-25  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211124. rdar://problem/30156092
+
+    2017-01-24  Michael Saboff  <msaboff@apple.com>
+
+            InferredTypeTable entry manipulation is not TOCTOU race safe
+            https://bugs.webkit.org/show_bug.cgi?id=167344
+
+            Reviewed by Filip Pizlo.
+
+            Made the accesses to table values safe from Time of Check,
+            Time of Use races with local temporary values.
+
+            Fixed point that we set an entry in the table to access the
+            current table entry instead of using the local entry.  In that case,
+            we reload the now changed entry.
+
+            * runtime/InferredTypeTable.cpp:
+            (JSC::InferredTypeTable::visitChildren):
+            (JSC::InferredTypeTable::get):
+            (JSC::InferredTypeTable::willStoreValue):
+            (JSC::InferredTypeTable::makeTop):
+
+2017-01-25  Dean Jackson  <dino@apple.com>
+
+        Disable Variation fonts on this branch.
+        <rdar://problem/30085249>
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211070. rdar://problem/30121809
+
+    2017-01-23  Saam Barati  <sbarati@apple.com>
+
+            https://bugs.webkit.org/show_bug.cgi?id=167247
+            JSC: operationSpreadGeneric uses the wrong global object for the builtin function and slow_path_spread consults the wrong global object to prove if the iterator protocol is unobservable
+            <rdar://problem/30121809>
+
+            Reviewed by Filip Pizlo.
+
+            There were two bugs in the different tiers with respect to how
+            spread handled global objects.
+
+            The first was in the LLInt/baseline inside slow_path_spread:
+
+            We consulted the lexical global object instead of the thing we're
+            spreading's global object to determine if the array iterator protocol
+            is unobservable. This is wrong if the incoming array is from a different
+            global object. We must consult the incoming array's global object
+            to determine if it can be spread using the fast path.
+
+            The second was in operationSpreadGeneric in the DFG/FTL:
+
+            We were always using the incoming array's global object, even
+            when going down the slow path. This is wrong because we were
+            fetching the builtin iteration function helper from the incoming
+            array's global object, which meant that if the iterator function
+            were to throw an exception, it could leak objects from a different
+            global object. We should be executing the iterator function with
+            the lexical global object.
+
+            * dfg/DFGOperations.cpp:
+            * jsc.cpp:
+            (GlobalObject::finishCreation):
+            (functionGlobalObjectForObject):
+            * runtime/CommonSlowPaths.cpp:
+            (JSC::SLOW_PATH_DECL):
+            * runtime/JSArray.h:
+            * runtime/JSArrayInlines.h:
+            (JSC::JSArray::isIteratorProtocolFastAndNonObservable):
+
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211069. rdar://problem/30173274
+
+    2017-01-22  Filip Pizlo  <fpizlo@apple.com>
+
+            Land the stochastic space-time scheduler disabled
+            https://bugs.webkit.org/show_bug.cgi?id=167249
+
+            Reviewed by Saam Barati.
+
+            The space-time scheduler is pretty weird. It uses a periodic scheduler where the next period is
+            simply determined by an integer multiple of time since when the scheduler last snapped phase. It
+            snaps phase after constraint solving. Both the snapping of the phase after constraint solving and
+            the periodicity appear to be necessary for good performance. For example, if the space-time
+            scheduler decided that it was in the resume part of the phase just by virtue of having just
+            resumed, then it would be empirically worse than our scheduler which asks "what time is it?" to
+            decide whether it should be suspended or resumed even if it just suspended or resumed. I've spent
+            a lot of time wondering why these two features are essential, and I think I found a reason.
+
+            What's happening is that sometimes the GC has an overrun and its increment takes longer than it
+            should have. The current scheduler forgives overruns when constraint solving, which seems to
+            make sense because it cannot control whether constraint solving runs with the mutator resumed or
+            suspended. It has to be suspended currently. Snapping phase after constraint solving accomplishes
+            this. What's more surprising is how important it is to manage deadline misses during draining.
+            The relevant kind of deadline miss is when doing mutator-suspended draining to catch up to the
+            retreating wavefront. Deadline misses while doing this can happen systematically in some
+            workloads, like JetStream/hash-map and some test in Speedometer. It's because they have some
+            ginormous object and it takes like ~3ms+-1.5ms just to scan it. The space-time scheduler's use
+            of time to decide what to do saves the day here: after the deadline miss, the scheduler will
+            initially realize that it missed its deadline to resume the mutator. But as soon as it does this
+            it asks: "based on current time since phase snap, what should I do?". In the case of a deadline
+            miss, this question is essentially a weighted coin flip because of the high noise in the amount
+            of time that it takes to do things in the GC. If you overrun, you will probably overrun by
+            multiple milliseconds, which is enough that where you land in the space-time scheduler's timeline
+            is random. The likelihood that you land in the "resume mutator" part of the timeline has a
+            probability that is roughly the same as what the space-time scheduler calls mutator utilization.
+            This is a super weird property. I did not intend for it to have this property, but it appears to
+            be the most important property of this scheduler.
+
+            Based on this, it seems that the fact that the space-time scheduler could suspend the mutator
+            before draining runs out of work doesn't accomplish anything. As soon as you resume the
+            mutator, you have a retreating wavefront to worry about. But if the collector is happily scanning
+            things then it's almost certain that the collector will outpace the mutator. Also, anything that
+            the mutator asks us to revisit is deferred anyway.
+
+            In the past I've tried to replace the scheduler in one patch and this turned out to be annoying
+            because even a poorly conceived scheduler should be iterated on. This patch lands a new scheduler
+            called the StochasticSpaceTime scheduler. It replaces two of the known-good features of the old
+            scheduler: (1) it forgives constraint pauses and (2) after deadline overrun its choice is random,
+            weighted by the mutator utilization target. Unlike the old scheduler, this one will only suspend
+            the mutator when the draining terminates, but it may pause for any amount of time after an
+            iteration of constraint solving. It computes the targetPause by measuring constraint solving time
+            and multiplying by the pauseScale (0.3 by default). If smaller then minimumPause (0.3ms by
+            default), then it uses minimumPause instead. The stochastic scheduler will then definitely do at
+            least targetPause worth of suspended draining after the constraint solving iteration, and then
+            it will decide whether or not to do another one at random. The probability that it will choose to
+            resume is exactly mutatorUtilization, which is computed exactly as before. Therefore, the
+            probability of resumption starts at 0.7 and goes down as memory usage rises. Conversely, the
+            probability that we will stay suspended starts at 0.3 and goes up from there.
+
+            This new scheduler looks like it might be a 25% improvement on splay-latency. It also looks like
+            a small progression on hash-map. Hash-map is a great test of one of the worst cases of retreating
+            wavefront, since it is repeatedly storing to a ginormous array. This array is sure to take a
+            while to scan, and to complete, the GC must be smart enough to visit any new objects it finds
+            while scanning the array immediately after scanning that array. This new scheduler means that
+            after scanning the array, the probability that you will scan whatever you found in it starts at
+            0.3 and rises as the program allocates. It's sure to be 0.3, and not 0.3^k, because after the
+            wavefront stops advancing, the only object on the mark stack after a constraint iteration will be
+            that array. Since there is sure to be a 0.3ms or longer pause, the GC will be sure to start
+            visiting this object. The GC can then complete if it just allows enough time after this to scan
+            whatever new objects it finds. If scanning the array overruns the deadline (and it almost
+            certainly will) then the probability that the GC keeps the mutator suspended is simply
+            1 - mutatorUtilization.
+
+            This scheduler is disabled by default. You can enable it with
+            --useStochasticMutatorScheduler=true.
+
+            * CMakeLists.txt:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * heap/Heap.cpp:
+            (JSC::Heap::Heap):
+            (JSC::Heap::markToFixpoint):
+            * heap/Heap.h:
+            * heap/MarkingConstraintSet.cpp:
+            (JSC::MarkingConstraintSet::didStartMarking):
+            (JSC::MarkingConstraintSet::executeConvergenceImpl):
+            (JSC::MarkingConstraintSet::resetStats): Deleted.
+            (JSC::MarkingConstraintSet::executeBootstrap): Deleted.
+            * heap/MarkingConstraintSet.h:
+            * heap/MutatorScheduler.cpp:
+            (JSC::MutatorScheduler::didReachTermination):
+            (JSC::MutatorScheduler::synchronousDrainingDidStall):
+            * heap/MutatorScheduler.h:
+            * heap/SlotVisitor.cpp:
+            (JSC::SlotVisitor::didReachTermination):
+            (JSC::SlotVisitor::drainFromShared):
+            * heap/StochasticSpaceTimeMutatorScheduler.cpp: Added.
+            (JSC::StochasticSpaceTimeMutatorScheduler::Snapshot::Snapshot):
+            (JSC::StochasticSpaceTimeMutatorScheduler::Snapshot::now):
+            (JSC::StochasticSpaceTimeMutatorScheduler::Snapshot::bytesAllocatedThisCycle):
+            (JSC::StochasticSpaceTimeMutatorScheduler::StochasticSpaceTimeMutatorScheduler):
+            (JSC::StochasticSpaceTimeMutatorScheduler::~StochasticSpaceTimeMutatorScheduler):
+            (JSC::StochasticSpaceTimeMutatorScheduler::state):
+            (JSC::StochasticSpaceTimeMutatorScheduler::beginCollection):
+            (JSC::StochasticSpaceTimeMutatorScheduler::didStop):
+            (JSC::StochasticSpaceTimeMutatorScheduler::willResume):
+            (JSC::StochasticSpaceTimeMutatorScheduler::didReachTermination):
+            (JSC::StochasticSpaceTimeMutatorScheduler::didExecuteConstraints):
+            (JSC::StochasticSpaceTimeMutatorScheduler::synchronousDrainingDidStall):
+            (JSC::StochasticSpaceTimeMutatorScheduler::timeToStop):
+            (JSC::StochasticSpaceTimeMutatorScheduler::timeToResume):
+            (JSC::StochasticSpaceTimeMutatorScheduler::log):
+            (JSC::StochasticSpaceTimeMutatorScheduler::endCollection):
+            (JSC::StochasticSpaceTimeMutatorScheduler::setResumeTime):
+            (JSC::StochasticSpaceTimeMutatorScheduler::bytesAllocatedThisCycleImpl):
+            (JSC::StochasticSpaceTimeMutatorScheduler::bytesSinceBeginningOfCycle):
+            (JSC::StochasticSpaceTimeMutatorScheduler::maxHeadroom):
+            (JSC::StochasticSpaceTimeMutatorScheduler::headroomFullness):
+            (JSC::StochasticSpaceTimeMutatorScheduler::mutatorUtilization):
+            * heap/StochasticSpaceTimeMutatorScheduler.h: Added.
+            * runtime/Options.cpp:
+            (JSC::overrideDefaults):
+            * runtime/Options.h:
+
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211065. rdar://problem/29784295
+
+    2017-01-23  Filip Pizlo  <fpizlo@apple.com>
+
+            SharedArrayBuffer plus WebGL should not equal CRASH
+            https://bugs.webkit.org/show_bug.cgi?id=167329
+
+            Reviewed by Saam Barati.
+
+            DOM unwrapping methods should return null rather than crashing. The code expects an
+            unshared buffer, so we should return null when it's shared. The caller can then decide
+            if they like null or not.
+
+            * runtime/JSArrayBufferViewInlines.h:
+            (JSC::JSArrayBufferView::toWrapped):
+
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r211043. rdar://problem/30134434
+
+    2017-01-23  Michael Saboff  <msaboff@apple.com>
+
+            IntlObject uses JSArray::tryCreateUninitialized in an unsafe way
+            https://bugs.webkit.org/show_bug.cgi?id=167288
+
+            Reviewed by Filip Pizlo.
+
+            Refactored the following "create" methods into a "tryCreate" method and a
+            "create" wrapper: JSArray::create(), Butterfly::create() and
+            createArrayButterfly().
+
+            Changed IntlObject.cpp to use JSArray::tryCreate() as it is simpler to use
+            by not requiring the caller to be GC savey.  The performance benefits of
+            tryCreateUninitialized() are not needed by the IntlObject c++ code.
+
+            Did not add a new test as the bug caused LayoutTests/js/intl.html to fail
+            reliably with the JSC option values scribbleFreeCells=true,
+            collectContinuously=true and JSC_useGenerationalGC=false.
+
+            * runtime/Butterfly.h:
+            * runtime/ButterflyInlines.h:
+            (JSC::Butterfly::tryCreate): Added.
+            (JSC::Butterfly::create):
+            * runtime/IntlObject.cpp:
+            (JSC::canonicalizeLocaleList):
+            (JSC::lookupSupportedLocales):
+            (JSC::intlObjectFuncGetCanonicalLocales):
+            * runtime/JSArray.h:
+            (JSC::createContiguousArrayButterfly): Deleted.
+            (JSC::tryCreateArrayButterfly): Added.
+            (JSC::createArrayButterfly):
+            (JSC::JSArray::tryCreate): Added.
+            (JSC::JSArray::create):
+
+2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210971. rdar://problem/30115838
+
+    2017-01-20  Saam Barati  <sbarati@apple.com>
+
+            We should flash a safepoint before each DFG/FTL phase
+            https://bugs.webkit.org/show_bug.cgi?id=167234
+
+            Reviewed by Filip Pizlo.
+
+            The recent GC changes caused us to regress Kraken because of a
+            longstanding issue that happened to be hit with higher frequency because
+            of a change in timing between when a particular GC was happening and
+            when a particular FTL compilation was happening. The regression is caused
+            by the GC was waiting for a large function to make it through the DFG portion
+            of an FTL compilation. This was taking 20ms-30ms and started happened during a
+            particular test with much higher frequency.
+
+            This means that anytime the GC waits for this compilation, the test ran at least
+            ~20ms slower because the GC waits for the compiler threads the mutator is stopped.
+
+            It's good that we have such an easily reproducible case of this performance
+            issue because it will effect many real JS programs, especially ones with
+            large functions that get hot.
+
+            The most straight forward solution to fix this is to flash a safepoint before
+            each phase, allowing the GC to suspend the compiler if needed. In my testing,
+            this progresses Kraken in the browser, and doesn't regress anything else. This
+            solution also makes the most sense. I did some analysis on the compilation time
+            of this function that took ~20-30ms to pass through the DFG phases, and
+            the phase times were mostly evenly distributed. Some took longer than others,
+            but no phase was longer than 3ms. Most were in the 0.25ms to 1.5ms range.
+
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl):
+            * dfg/DFGSafepoint.cpp:
+            (JSC::DFG::Safepoint::begin):
+            * runtime/Options.h:
+
+2017-01-20  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210949. rdar://problem/30108531
+
+    2017-01-19  Chris Dumez  <cdumez@apple.com>
+
+            iterable<> should be enabled on WK1
+            https://bugs.webkit.org/show_bug.cgi?id=167221
+            <rdar://problem/30108531>
+
+            Reviewed by Youenn Fablet.
+
+            * runtime/CommonIdentifiers.h:
+
+2017-01-20  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210947. rdar://problem/30108809
+
+    2017-01-19  Filip Pizlo  <fpizlo@apple.com>
+
+            Structure::pin() needs to be called while holding a lock
+            https://bugs.webkit.org/show_bug.cgi?id=167220
+
+            Reviewed by Saam Barati.
+
+            Imagine this race: the mutator calls pin() and the collector calls visitChildren(),
+            on the same Structure at the same time. In trunk pin() does not require a lock to be
+            held and it doesn't grab any locks. Meanwhile visitChildren() grabs the lock, checks
+            if the structure is pinned, and if not, it removes it by overwriting with zero. Now
+            imagine how this plays out when pin() runs. Since pin() grabs no locks, it is
+            irrelevant that visitChildren() grabs any locks. So, visitChildren() might check if
+            the table is pinned before pin() pins it, and then clear the table after it was
+            already pinned.
+
+            The problem here is that pin() should be holding a lock. We could either make pin()
+            grab that lock by itself, or what this patch does is makes the caller grab the lock.
+            This is great because it means that sometimes we don't have to introduce any new
+            locking.
+
+            This fixes a materializePropertyTable() checkOffsetConsistency() crash that happens
+            very rarely, but I was able to get it to reproduce with run-webkit-tests and
+            aggressive GC settings.
+
+            * runtime/ConcurrentJSLock.h:
+            * runtime/Structure.cpp:
+            (JSC::Structure::materializePropertyTable):
+            (JSC::Structure::changePrototypeTransition):
+            (JSC::Structure::attributeChangeTransition):
+            (JSC::Structure::toDictionaryTransition):
+            (JSC::Structure::nonPropertyTransition):
+            (JSC::Structure::pin):
+            (JSC::Structure::pinForCaching):
+            (JSC::Structure::add):
+            * runtime/Structure.h:
+            * runtime/StructureInlines.h:
+            (JSC::Structure::checkOffsetConsistency):
+            (JSC::Structure::add):
+            (JSC::Structure::addPropertyWithoutTransition):
+
+2017-01-20  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210935. rdar://problem/30101860
+
+    2017-01-19  Filip Pizlo  <fpizlo@apple.com>
+
+            The mutator needs to fire a barrier after memmoving stuff around in an object that the GC scans
+            https://bugs.webkit.org/show_bug.cgi?id=167208
+
+            Reviewed by Saam Barati.
+
+            It used to be that if you moved a value from one place to another in the same object
+            then there is no need for a barrier because the generational GC would have no need to
+            know that some old object still continues to refer to the same other old object.
+
+            But the concurrent GC might scan that object as the mutator moves pointers around in
+            it. If the ordering is right, this could mean that the collector never sees some of
+            those pointers. This can be fixed by adding a barrier.
+
+            This fixes the most obvious cases I found. There may be more and I'll continue to
+            audit. Most of the other memmove users seem to already use some kind of synchronization
+            to prevent this. For example, this can also be fixed by just holding the cell lock
+            around the memmove since we're dealing with indexing storage and the GC reads that
+            under the cell lock.
+
+            * runtime/JSArray.cpp:
+            (JSC::JSArray::shiftCountWithAnyIndexingType):
+            (JSC::JSArray::unshiftCountWithAnyIndexingType):
+
+2017-01-18  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210858. rdar://problem/30069096
+
+    2017-01-18  Filip Pizlo  <fpizlo@apple.com>
+
+            JSObjectSetPrivate should not use jsCast<>
+            rdar://problem/30069096
+
+            Reviewed by Keith Miller.
+
+            * API/JSObjectRef.cpp:
+            (JSObjectSetPrivate):
+
+2017-01-18  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210844. rdar://problem/29993906
+
+    2017-01-16  Filip Pizlo  <fpizlo@apple.com>
+
+            Make opaque root scanning truly constraint-based
+            https://bugs.webkit.org/show_bug.cgi?id=165760
+
+            Reviewed by Geoffrey Garen.
+
+            We have bugs when visitChildren() changes its mind about what opaque root to add, since
+            we don't have barriers on opaque roots. This supposedly once worked for generational GC,
+            and I started adding more barriers to support concurrent GC. But I think that the real
+            bug here is that we want the JSObject->OpaqueRoot to be evaluated as a constraint that
+            participates in the fixpoint. I like to think of this as an *output* constraint, because it
+            is concerned with outgoing edges in the heap from the object that registered the constraint.
+            An *input* constraint is like what Weak<> does when deciding whether the thing it points to
+            should be live.
+
+            Whether or not an object has output constraints depends on its type. So, we want the GC to
+            have a feature where we rapidly call some function on all marked objects of some type.
+
+            It's easy to rapidly scan all marked objects in a MarkedBlock. So, we want to allocate all
+            objects that have output constraints in their own MarkedBlocks and we want to track the set
+            of MarkedBlocks with output constraints.
+
+            This patch makes it easy to have clients of JSC's internal C++ APIs create a Subspace - like
+            what we used to call MarkedSpace::Subspace but now it's in the JSC namespace - which is
+            a collection of objects that you can easily scan during GC from a MarkingConstraint. It's
+            now possible for internal C++ API clients to register their own MarkingConstraints. The DOM
+            now uses this to create two Subspaces (more on why two below) and it calls
+            JSCell::visitOutputConstraints() on all of the marked objects in those subspaces using a new
+            MarkingConstraint. That MarkingConstraint uses a new style of volatility, called
+            SeldomGreyed, which is like GreyedByExecution except it is opportunistically not executed
+            as roots in the hopes that their sole execution will be the snapshot-at-the-end. I also
+            converted the CodeBlock rescan constraint to SeldomGreyed, since that's also an output
+            constraint.
+
+            This patch also uses Subspace for something pretty obvious: knowing how to call the
+            destructor. Subspaces can specialize the sweep for their way of invoking destructors. We
+            have the following subspaces:
+
+            - auxiliary
+            - cell
+            - destructibleCell - for JSCell subclasses that have destructors and StructureIsImmortal
+            - stringSpace - inlines ~JSString into the sweep, making string allocation 7% faster
+            - destructibleObjectSpace - for JSDestructibleObject subclasses
+
+            And WebCore adds:
+
+            - outputConstraint - for JSDOMObjects that have a visitAdditionalChildren
+            - globalObjectOutputConstraint - for JSDOMGlobalObjects that have a visitAdditionalChildren,
+              since JSDOMGlobalObjects are not JSDestructibleObjects
+
+            The Subspace for a type is selected by saying JSC::subspaceFor<Type>(vm). This calls
+            Type::subspaceFor<Type>(vm). This allows cell classes to override subspaceFor<> and it
+            allows any subspaceFor<> implementation to query static flags in the type. This is how
+            JSCell::subspaceFor<> can select either cellSpace or destructibleCellSpace.
+
+            This patch is mostly about:
+
+            - Moving MarkedSpace::Subspace out of MarkedSpace and making it a nice class with a nice
+              API. Almost all of its functionality is just taken out of MarkedSpace.
+            - Converting users of the old API for allocating objects and getting MarkedAllocators, like
+              heap.allocatorForObjectWithoutDestructor() and its friends. That would now say
+              vm.cellSpace.allocatorFor().
+
+            Altogether, this means that we only have a small regression on Dromaeo. The regression is
+            due to the fact that we scan output constraints. Before the Subspace optimizations (see
+            r209766, which was rolled out in r209812), this regression on Dromaeo/jslib was 2x but after
+            the optimizations in this patch it's only 1.12x. Note that Dromaeo/jslib creats gigabytes of
+            DOM nodes. Compared to web pages, this is a very extreme synthetic microbenchmark. Still, we
+            like optimizing these because we don't want to presume what web pages will look like.
+
+            The use of Subspaces to specialize destructors happened not because it's super necessary but
+            because I wanted to introduce a single unified way of communicating to the GC how to treat
+            different types. Any Subspace feature that allowed us to collect some types together would
+            have to be mindful of the destructorness of objects. I could have turned this into a
+            liability where each Subspace has two subsubspaces - one for destructor objects and one for
+            non-destructor objects, which would have allowed me to keep the old sweep specialization
+            code. Just days prior, mlam wanted to do something that was hard because of that old sweep
+            specializer, so I decided to take the opportunity to fix the sweep specializer while also
+            making Subspace be the one true way of teaching the GC about types. To validate that this
+            actually does things, I added a JSStringSubspace and a test that shows that this is a 7%
+            string allocation progression.
+
+            In bug 167066, I'm getting rid of the rest of the code in JSC that would special-case for
+            JSDestructibleObject vs StructureIsImmortal by using the GC's DestructionMode. After that,
+            Subspace will be only mechanism by which JSC uses the GC to encode types.
+
+            Prior to this change, having multiple MarkedSpace::Subspaces would have been expensive
+            because they create a bunch of MarkedAllocators upfront. We now have the ability to create
+            MarkedAllocators lazily. We create them on the first allocation from that size class or when
+            a JIT asks for the MarkedAllocator. The concurrent JITs can ask for MarkedAllocators because
+            their creation is under a lock.
+
+            On my machine, this might be a 1.1% JetStream speed-up with 87% confidence and it might be
+            a 0.4% PLT3 slow-down with 92% confidence. Note that 0.4% on PLT3 is the level of systematic
+            error on PLT3 on my computer: I've seen definite 0.4% speed-ups and slow-downs that were not
+            confirmed by any bot. Let's see what the bots say.
+
+            * CMakeLists.txt:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/ObjectAllocationProfile.h:
+            (JSC::ObjectAllocationProfile::initialize):
+            * bytecode/PolymorphicAccess.cpp:
+            (JSC::AccessCase::generateImpl):
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+            (JSC::DFG::SpeculativeJIT::compileMakeRope):
+            (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+            (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+            (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+            (JSC::DFG::SpeculativeJIT::emitAllocateButterfly):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * ftl/FTLAbstractHeapRepository.h:
+            * ftl/FTLLowerDFGToB3.cpp:
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+            (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
+            (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+            (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+            (JSC::FTL::DFG::LowerDFGToB3::allocatorForSize):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+            * heap/AllocatorAttributes.h:
+            (JSC::AllocatorAttributes::AllocatorAttributes):
+            * heap/ConstraintVolatility.h: Added.
+            (WTF::printInternal):
+            * heap/GCActivityCallback.cpp:
+            * heap/Heap.cpp:
+            (JSC::Heap::Heap):
+            (JSC::Heap::lastChanceToFinalize):
+            (JSC::Heap::markToFixpoint):
+            (JSC::Heap::updateObjectCounts):
+            (JSC::Heap::collectAllGarbage):
+            (JSC::Heap::collectInThread):
+            (JSC::Heap::stopTheWorld):
+            (JSC::Heap::updateAllocationLimits):
+            (JSC::Heap::bytesVisited):
+            (JSC::Heap::addCoreConstraints):
+            (JSC::Heap::addMarkingConstraint):
+            (JSC::Heap::notifyIsSafeToCollect):
+            (JSC::Heap::preventCollection):
+            (JSC::Heap::allowCollection):
+            (JSC::Heap::setMutatorShouldBeFenced):
+            (JSC::Heap::buildConstraintSet): Deleted.
+            (JSC::Heap::writeBarrierOpaqueRootSlow): Deleted.
+            (JSC::Heap::addMutatorShouldBeFencedCache): Deleted.
+            * heap/Heap.h:
+            (JSC::Heap::mutatorExecutionVersion):
+            (JSC::Heap::numOpaqueRoots):
+            (JSC::Heap::vm): Deleted.
+            (JSC::Heap::subspaceForObjectWithoutDestructor): Deleted.
+            (JSC::Heap::subspaceForObjectDestructor): Deleted.
+            (JSC::Heap::subspaceForAuxiliaryData): Deleted.
+            (JSC::Heap::allocatorForObjectWithoutDestructor): Deleted.
+            (JSC::Heap::allocatorForObjectWithDestructor): Deleted.
+            (JSC::Heap::allocatorForAuxiliaryData): Deleted.
+            * heap/HeapInlines.h:
+            (JSC::Heap::vm):
+            (JSC::Heap::allocateWithDestructor): Deleted.
+            (JSC::Heap::allocateWithoutDestructor): Deleted.
+            (JSC::Heap::allocateObjectOfType): Deleted.
+            (JSC::Heap::subspaceForObjectOfType): Deleted.
+            (JSC::Heap::allocatorForObjectOfType): Deleted.
+            (JSC::Heap::allocateAuxiliary): Deleted.
+            (JSC::Heap::tryAllocateAuxiliary): Deleted.
+            (JSC::Heap::tryReallocateAuxiliary): Deleted.
+            (JSC::Heap::ascribeOwner): Deleted.
+            (JSC::Heap::writeBarrierOpaqueRoot): Deleted.
+            * heap/LargeAllocation.cpp:
+            (JSC::LargeAllocation::tryCreate):
+            (JSC::LargeAllocation::LargeAllocation):
+            (JSC::LargeAllocation::~LargeAllocation):
+            (JSC::LargeAllocation::sweep):
+            * heap/LargeAllocation.h:
+            * heap/MarkedAllocator.cpp:
+            (JSC::MarkedAllocator::MarkedAllocator):
+            (JSC::MarkedAllocator::tryAllocateWithoutCollecting):
+            (JSC::MarkedAllocator::tryAllocateIn):
+            (JSC::MarkedAllocator::allocateSlowCaseImpl):
+            (JSC::MarkedAllocator::tryAllocateBlock):
+            (JSC::MarkedAllocator::shrink):
+            (JSC::MarkedAllocator::markedSpace):
+            * heap/MarkedAllocator.h:
+            (JSC::MarkedAllocator::nextAllocatorInSubspace):
+            (JSC::MarkedAllocator::setNextAllocatorInSubspace):
+            (JSC::MarkedAllocator::subspace):
+            (JSC::MarkedAllocator::tryAllocate): Deleted.
+            (JSC::MarkedAllocator::allocate): Deleted.
+            (JSC::MarkedAllocator::forEachBlock): Deleted.
+            * heap/MarkedAllocatorInlines.h: Added.
+            (JSC::MarkedAllocator::tryAllocate):
+            (JSC::MarkedAllocator::allocate):
+            (JSC::MarkedAllocator::forEachBlock):
+            (JSC::MarkedAllocator::forEachNotEmptyBlock):
+            * heap/MarkedBlock.cpp:
+            (JSC::MarkedBlock::Handle::subspace):
+            (JSC::MarkedBlock::Handle::sweep):
+            (JSC::MarkedBlock::Handle::specializedSweep): Deleted.
+            (JSC::MarkedBlock::Handle::sweepHelperSelectScribbleMode): Deleted.
+            (JSC::MarkedBlock::Handle::sweepHelperSelectEmptyMode): Deleted.
+            (JSC::MarkedBlock::Handle::sweepHelperSelectHasNewlyAllocated): Deleted.
+            (JSC::MarkedBlock::Handle::sweepHelperSelectSweepMode): Deleted.
+            (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode): Deleted.
+            * heap/MarkedBlock.h:
+            (JSC::MarkedBlock::Handle::visitWeakSet):
+            * heap/MarkedBlockInlines.h:
+            (JSC::MarkedBlock::Handle::isNewlyAllocatedStale):
+            (JSC::MarkedBlock::Handle::hasAnyNewlyAllocated):
+            (JSC::MarkedBlock::heap):
+            (JSC::MarkedBlock::space):
+            (JSC::MarkedBlock::Handle::space):
+            (JSC::MarkedBlock::Handle::specializedSweep):
+            (JSC::MarkedBlock::Handle::finishSweepKnowingSubspace):
+            (JSC::MarkedBlock::Handle::sweepDestructionMode):
+            (JSC::MarkedBlock::Handle::emptyMode):
+            (JSC::MarkedBlock::Handle::scribbleMode):
+            (JSC::MarkedBlock::Handle::newlyAllocatedMode):
+            (JSC::MarkedBlock::Handle::marksMode):
+            (JSC::MarkedBlock::Handle::forEachMarkedCell):
+            * heap/MarkedSpace.cpp:
+            (JSC::MarkedSpace::initializeSizeClassForStepSize):
+            (JSC::MarkedSpace::MarkedSpace):
+            (JSC::MarkedSpace::lastChanceToFinalize):
+            (JSC::MarkedSpace::addMarkedAllocator):
+            (JSC::MarkedSpace::allocate): Deleted.
+            (JSC::MarkedSpace::tryAllocate): Deleted.
+            (JSC::MarkedSpace::allocateLarge): Deleted.
+            (JSC::MarkedSpace::tryAllocateLarge): Deleted.
+            * heap/MarkedSpace.h:
+            (JSC::MarkedSpace::heap):
+            (JSC::MarkedSpace::allocatorLock):
+            (JSC::MarkedSpace::subspaceForObjectsWithDestructor): Deleted.
+            (JSC::MarkedSpace::subspaceForObjectsWithoutDestructor): Deleted.
+            (JSC::MarkedSpace::subspaceForAuxiliaryData): Deleted.
+            (JSC::MarkedSpace::allocatorFor): Deleted.
+            (JSC::MarkedSpace::destructorAllocatorFor): Deleted.
+            (JSC::MarkedSpace::auxiliaryAllocatorFor): Deleted.
+            (JSC::MarkedSpace::allocateWithoutDestructor): Deleted.
+            (JSC::MarkedSpace::allocateWithDestructor): Deleted.
+            (JSC::MarkedSpace::allocateAuxiliary): Deleted.
+            (JSC::MarkedSpace::tryAllocateAuxiliary): Deleted.
+            (JSC::MarkedSpace::forEachSubspace): Deleted.
+            * heap/MarkingConstraint.cpp:
+            (JSC::MarkingConstraint::MarkingConstraint):
+            * heap/MarkingConstraint.h:
+            (JSC::MarkingConstraint::volatility):
+            * heap/MarkingConstraintSet.cpp:
+            (JSC::MarkingConstraintSet::resetStats):
+            (JSC::MarkingConstraintSet::add):
+            (JSC::MarkingConstraintSet::executeConvergenceImpl):
+            * heap/MarkingConstraintSet.h:
+            * heap/SlotVisitor.cpp:
+            (JSC::SlotVisitor::visitChildren):
+            (JSC::SlotVisitor::visitAsConstraint):
+            (JSC::SlotVisitor::drain):
+            (JSC::SlotVisitor::addOpaqueRoot):
+            (JSC::SlotVisitor::mergeIfNecessary):
+            (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary): Deleted.
+            * heap/SlotVisitor.h:
+            (JSC::SlotVisitor::setIgnoreNewOpaqueRoots):
+            * heap/SlotVisitorInlines.h:
+            (JSC::SlotVisitor::reportExtraMemoryVisited):
+            (JSC::SlotVisitor::reportExternalMemoryVisited):
+            * heap/Subspace.cpp: Added.
+            (JSC::Subspace::Subspace):
+            (JSC::Subspace::~Subspace):
+            (JSC::Subspace::finishSweep):
+            (JSC::Subspace::destroy):
+            (JSC::Subspace::allocate):
+            (JSC::Subspace::tryAllocate):
+            (JSC::Subspace::allocatorForSlow):
+            (JSC::Subspace::allocateSlow):
+            (JSC::Subspace::tryAllocateSlow):
+            * heap/Subspace.h: Added.
+            (JSC::Subspace::tryAllocatorFor):
+            (JSC::Subspace::allocatorFor):
+            * heap/SubspaceInlines.h: Added.
+            (JSC::Subspace::forEachMarkedBlock):
+            (JSC::Subspace::forEachNotEmptyMarkedBlock):
+            (JSC::Subspace::forEachLargeAllocation):
+            (JSC::Subspace::forEachMarkedCell):
+            * heap/WeakBlock.cpp:
+            (JSC::WeakBlock::specializedVisit):
+            * heap/WeakBlock.h:
+            * heap/WeakSet.h:
+            (JSC::WeakSet::visit):
+            * jit/AssemblyHelpers.h:
+            (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
+            (JSC::AssemblyHelpers::emitAllocateVariableSized):
+            (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
+            * jit/JITOpcodes.cpp:
+            (JSC::JIT::emit_op_new_object):
+            * jsc.cpp:
+            * runtime/ButterflyInlines.h:
+            (JSC::Butterfly::createUninitialized):
+            (JSC::Butterfly::growArrayRight):
+            * runtime/ClassInfo.h:
+            * runtime/ClonedArguments.cpp:
+            (JSC::ClonedArguments::createEmpty):
+            * runtime/DirectArguments.cpp:
+            (JSC::DirectArguments::overrideThings):
+            * runtime/GenericArgumentsInlines.h:
+            (JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
+            * runtime/HashMapImpl.h:
+            (JSC::HashMapBuffer::create):
+            * runtime/JSArray.cpp:
+            (JSC::JSArray::tryCreateUninitialized):
+            (JSC::JSArray::unshiftCountSlowCase):
+            * runtime/JSArrayBufferView.cpp:
+            (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+            * runtime/JSCell.h:
+            (JSC::subspaceFor):
+            * runtime/JSCellInlines.h:
+            (JSC::JSCell::visitOutputConstraints):
+            (JSC::JSCell::subspaceFor):
+            (JSC::allocateCell):
+            * runtime/JSDestructibleObject.h:
+            (JSC::JSDestructibleObject::subspaceFor):
+            * runtime/JSDestructibleObjectSubspace.cpp: Added.
+            (JSC::JSDestructibleObjectSubspace::JSDestructibleObjectSubspace):
+            (JSC::JSDestructibleObjectSubspace::~JSDestructibleObjectSubspace):
+            (JSC::JSDestructibleObjectSubspace::finishSweep):
+            (JSC::JSDestructibleObjectSubspace::destroy):
+            * runtime/JSDestructibleObjectSubspace.h: Added.
+            * runtime/JSObject.h:
+            (JSC::JSObject::JSObject):
+            * runtime/JSObjectInlines.h:
+            * runtime/JSSegmentedVariableObject.h:
+            * runtime/JSString.h:
+            (JSC::JSString::subspaceFor):
+            * runtime/JSStringSubspace.cpp: Added.
+            (JSC::JSStringSubspace::JSStringSubspace):
+            (JSC::JSStringSubspace::~JSStringSubspace):
+            (JSC::JSStringSubspace::finishSweep):
+            (JSC::JSStringSubspace::destroy):
+            * runtime/JSStringSubspace.h: Added.
+            * runtime/RegExpMatchesArray.h:
+            (JSC::tryCreateUninitializedRegExpMatchesArray):
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+
+2017-01-18  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210829. rdar://problem/30044439
+
+    2017-01-16  Filip Pizlo  <fpizlo@apple.com>
+
+            JSCell::classInfo() shouldn't have a bunch of mitigations for being called during destruction
+            https://bugs.webkit.org/show_bug.cgi?id=167066
+
+            Reviewed by Keith Miller and Michael Saboff.
+
+            This reduces the size of JSCell::classInfo() by half and removes some checks that
+            this function previously had to do in case it was called from destructors.
+
+            I changed all of the destructors so that they don't call JSCell::classInfo() and I
+            added an assertion to JSCell::classInfo() to catch cases where someone called it
+            from a destructor accidentally.
+
+            This means that we only have one place in destruction that needs to know the class:
+            the sweeper's call to the destructor.
+
+            One of the trickiest outcomes of this is the need to support inherits() tests in
+            JSObjectGetPrivate(), when it is called from the destructor callback on the object
+            being destructed. JSObjectGetPrivate() is undefined behavior anyway if you use it
+            on any dead-but-not-destructed object other than the one being destructed right
+            now. The purpose of the inherits() tests is to distinguish between different kinds
+            of CallbackObjects, which may have different kinds of base classes. I think that
+            this was always subtly wrong - for example, if the object being destructed is a
+            JSGlobalObject then it's not a DestructibleObject, is not in a destructor block,
+            but does not have an immortal Structure - so classInfo() is not valid. This fixes
+            the issue by having ~JSCallbackObject know its classInfo. It now stashes its
+            classInfo in VM so that JSObjectGetPrivate can use that classInfo if it detects
+            that it's being used on a currently-destructing object.
+
+            That was the only really weird part of this patch. The rest is mostly removing
+            illegal uses of jsCast<> in destructors. There were a few other genuine uses of
+            classInfo() but they were in code that already knew how to get its classInfo()
+            using other means:
+
+            - You can still say structure()->classInfo(), and I use this form in code that
+              knows that its StructureIsImmortal.
+
+            - You can use this->classInfo() if it's overridden, like in subclasses of
+              JSDestructibleObject.
+
+            Rolling this back in because I think I fixed the crashes.
+
+            * API/JSAPIWrapperObject.mm:
+            (JSAPIWrapperObjectHandleOwner::finalize):
+            * API/JSCallbackObject.h:
+            * API/JSCallbackObjectFunctions.h:
+            (JSC::JSCallbackObject<Parent>::~JSCallbackObject):
+            (JSC::JSCallbackObject<Parent>::init):
+            * API/JSObjectRef.cpp:
+            (classInfoPrivate):
+            (JSObjectGetPrivate):
+            (JSObjectSetPrivate):
+            * bytecode/EvalCodeBlock.cpp:
+            (JSC::EvalCodeBlock::destroy):
+            * bytecode/FunctionCodeBlock.cpp:
+            (JSC::FunctionCodeBlock::destroy):
+            * bytecode/ModuleProgramCodeBlock.cpp:
+            (JSC::ModuleProgramCodeBlock::destroy):
+            * bytecode/ProgramCodeBlock.cpp:
+            (JSC::ProgramCodeBlock::destroy):
+            * bytecode/UnlinkedEvalCodeBlock.cpp:
+            (JSC::UnlinkedEvalCodeBlock::destroy):
+            * bytecode/UnlinkedFunctionCodeBlock.cpp:
+            (JSC::UnlinkedFunctionCodeBlock::destroy):
+            * bytecode/UnlinkedFunctionExecutable.cpp:
+            (JSC::UnlinkedFunctionExecutable::destroy):
+            * bytecode/UnlinkedModuleProgramCodeBlock.cpp:
+            (JSC::UnlinkedModuleProgramCodeBlock::destroy):
+            * bytecode/UnlinkedProgramCodeBlock.cpp:
+            (JSC::UnlinkedProgramCodeBlock::destroy):
+            * heap/CodeBlockSet.cpp:
+            (JSC::CodeBlockSet::lastChanceToFinalize):
+            (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+            * heap/MarkedAllocator.cpp:
+            (JSC::MarkedAllocator::allocateSlowCaseImpl):
+            * heap/MarkedBlock.cpp:
+            (JSC::MarkedBlock::Handle::sweep):
+            * jit/JITThunks.cpp:
+            (JSC::JITThunks::finalize):
+            * runtime/AbstractModuleRecord.cpp:
+            (JSC::AbstractModuleRecord::destroy):
+            * runtime/ExecutableBase.cpp:
+            (JSC::ExecutableBase::clearCode):
+            * runtime/JSCellInlines.h:
+            (JSC::JSCell::classInfo):
+            (JSC::JSCell::callDestructor):
+            * runtime/JSLock.h:
+            (JSC::JSLock::ownerThread):
+            * runtime/JSModuleNamespaceObject.cpp:
+            (JSC::JSModuleNamespaceObject::destroy):
+            * runtime/JSModuleRecord.cpp:
+            (JSC::JSModuleRecord::destroy):
+            * runtime/JSPropertyNameEnumerator.cpp:
+            (JSC::JSPropertyNameEnumerator::destroy):
+            * runtime/JSSegmentedVariableObject.h:
+            * runtime/SymbolTable.cpp:
+            (JSC::SymbolTable::destroy):
+            * runtime/VM.h:
+            * wasm/js/JSWebAssemblyCallee.cpp:
+            (JSC::JSWebAssemblyCallee::destroy):
+            * wasm/js/WebAssemblyModuleRecord.cpp:
+            (JSC::WebAssemblyModuleRecord::destroy):
+            * wasm/js/WebAssemblyToJSCallee.cpp:
+            (JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
+            (JSC::WebAssemblyToJSCallee::destroy):
+
+2017-01-18  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210745. rdar://problem/30019309
+
+    2017-01-13  Saam Barati  <sbarati@apple.com>
+
+            Initialize the ArraySpecies watchpoint as Clear and transition to IsWatched once slice is called for the first time
+            https://bugs.webkit.org/show_bug.cgi?id=167017
+            <rdar://problem/30019309>
+
+            Reviewed by Keith Miller and Filip Pizlo.
+
+            This patch is to reverse the JSBench regression from r210695.
+
+            The new state diagram for the array species watchpoint is as
+            follows:
+
+            1. On GlobalObject construction, it starts life out as ClearWatchpoint.
+            2. When slice is called for the first time, we observe the state
+            of the world, and either transition it to IsWatched if we were able
+            to set up the object property conditions, or to IsInvalidated if we
+            were not.
+            3. The DFG compiler will now only lower slice as an intrinsic if
+            it observed the speciesWatchpoint.state() as IsWatched.
+            4. The IsWatched => IsInvalidated transition happens only when
+            one of the object property condition watchpoints fire.
+
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+            * runtime/ArrayPrototype.cpp:
+            (JSC::speciesWatchpointIsValid):
+            (JSC::speciesConstructArray):
+            (JSC::arrayProtoPrivateFuncConcatMemcpy):
+            (JSC::ArrayPrototype::tryInitializeSpeciesWatchpoint):
+            (JSC::ArrayPrototype::initializeSpeciesWatchpoint): Deleted.
+            * runtime/ArrayPrototype.h:
+            * runtime/JSGlobalObject.cpp:
+            (JSC::JSGlobalObject::JSGlobalObject):
+            (JSC::JSGlobalObject::init):
+
+2017-01-18  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210695. rdar://problem/29913445
+
+    2017-01-12  Saam Barati  <sbarati@apple.com>
+
+            Add a slice intrinsic to the DFG/FTL
+            https://bugs.webkit.org/show_bug.cgi?id=166707
+            <rdar://problem/29913445>
+
+            Reviewed by Filip Pizlo.
+
+            The gist of this patch is to inline Array.prototype.slice
+            into the DFG/FTL. The implementation in the DFG-backend
+            and FTLLowerDFGToB3 is just a straight forward implementation
+            of what the C function is doing. The more interesting bits
+            of this patch are setting up the proper watchpoints and conditions
+            in the executing code to prove that its safe to skip all of the
+            observable JS actions that Array.prototype.slice normally does.
+
+            We perform the following proofs:
+            1. Array.prototype.constructor has not changed (via a watchpoint).
+            2. That Array.prototype.constructor[Symbol.species] has not changed (via a watchpoint).
+            3. The global object is not having a bad time.
+            4. The array that is being sliced has an original array structure.
+            5. Array.prototype/Object.prototype have not transitioned.
+
+            Conditions 1, 2, and 3 are strictly required.
+
+            4 is ensuring a couple things:
+            1. That a "constructor" property hasn't been added to the array
+            we're slicing since we're supposed to perform a Get(array, "constructor").
+            2. That we're not slicing an instance of a subclass of Array.
+
+            We could relax 4.1 in the future if we find other ways to test if
+            the incoming array hasn't changed the "constructor" property. We
+            would probably use TryGetById to do this.
+
+            I'm seeing a 5% speedup on crypto-pbkdf2 and often a 1% speedup on
+            the total benchmark (the results are sometimes noisy).
+
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+            * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+            (JSC::DFG::CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator):
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            * dfg/DFGDoesGC.cpp:
+            (JSC::DFG::doesGC):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            * dfg/DFGNodeType.h:
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::compileArraySlice):
+            (JSC::DFG::SpeculativeJIT::emitAllocateButterfly):
+            * dfg/DFGSpeculativeJIT.h:
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            (JSC::DFG::SpeculativeJIT::emitInitializeButterfly):
+            (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            (JSC::DFG::SpeculativeJIT::emitInitializeButterfly):
+            (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+            * ftl/FTLAbstractHeapRepository.h:
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLLowerDFGToB3.cpp:
+            (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+            (JSC::FTL::DFG::LowerDFGToB3::compileArraySlice):
+            (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+            (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+            (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
+            (JSC::FTL::DFG::LowerDFGToB3::storeStructure):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+            (JSC::FTL::DFG::LowerDFGToB3::allocateUninitializedContiguousJSArray):
+            * jit/AssemblyHelpers.cpp:
+            (JSC::AssemblyHelpers::emitLoadStructure):
+            * runtime/ArrayPrototype.cpp:
+            (JSC::ArrayPrototype::finishCreation):
+            (JSC::speciesWatchpointIsValid):
+            (JSC::speciesConstructArray):
+            (JSC::arrayProtoFuncSlice):
+            (JSC::arrayProtoPrivateFuncConcatMemcpy):
+            (JSC::ArrayPrototype::initializeSpeciesWatchpoint):
+            (JSC::ArrayPrototypeAdaptiveInferredPropertyWatchpoint::handleFire):
+            (JSC::speciesWatchpointsValid): Deleted.
+            (JSC::ArrayPrototype::attemptToInitializeSpeciesWatchpoint): Deleted.
+            * runtime/ArrayPrototype.h:
+            (JSC::ArrayPrototype::speciesWatchpointStatus): Deleted.
+            (): Deleted.
+            * runtime/Intrinsic.h:
+            * runtime/JSGlobalObject.cpp:
+            (JSC::JSGlobalObject::JSGlobalObject):
+            (JSC::JSGlobalObject::init):
+            * runtime/JSGlobalObject.h:
+            (JSC::JSGlobalObject::arraySpeciesWatchpoint):
+            * runtime/Structure.h:
+
+2017-01-18  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210837. rdar://problem/29432371
+
+    2017-01-17  Michael Saboff  <msaboff@apple.com>
+
+            Nested parenthesized regular expressions with non-zero minimum counts appear to hang and use lots of memory
+            https://bugs.webkit.org/show_bug.cgi?id=167125
+
+            Reviewed by Filip Pizlo.
+
+            Changed Yarr to handle nested parenthesized subexpressions where the minimum count is
+            not 0 directly in the Yarr interpreter.  Previously we'd factor an expression like
+            (a|b)+ into (a|b)(a|b)* with special handling for captures.  This factoring was done
+            using a deep copy that doubled the size of the resulting expresion for each nested
+            parenthesized subexpression.  Now the Yarr interpreter can directly process a regexp
+            like (a|b){2,42}.
+
+            The parser will allow one level of nested, non-zero minimum, counted parenthesis using
+            the old copy method.  After one level, it will generate parenthesis terms with a non-zero
+            minimum.   Such an expression wasn't handled by the Yarr JIT before the change, so this
+            change isn't a performance regression.
+
+            Added a minimum count to the YarrPattern and ByteTerm classes, and then factored that
+            minimum into the interpreter.  A non-zero minimum is only handled by the Yarr interpreter.
+            If the Yarr JIT see such a term, it punts back to the interpreter.
+
+            * yarr/YarrInterpreter.cpp:
+            (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+            (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+            (JSC::Yarr::Interpreter::matchCharacterClass):
+            (JSC::Yarr::Interpreter::backtrackCharacterClass):
+            (JSC::Yarr::Interpreter::matchBackReference):
+            (JSC::Yarr::Interpreter::backtrackBackReference):
+            (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+            (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+            (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+            (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+            (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
+            (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
+            (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
+            (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
+            (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
+            (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
+            (JSC::Yarr::Interpreter::matchParentheses):
+            (JSC::Yarr::Interpreter::backtrackParentheses):
+            (JSC::Yarr::Interpreter::matchDisjunction):
+            (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+            (JSC::Yarr::ByteCompiler::atomCharacterClass):
+            (JSC::Yarr::ByteCompiler::atomBackReference):
+            (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+            (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+            (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+            (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+            (JSC::Yarr::ByteCompiler::emitDisjunction):
+            * yarr/YarrInterpreter.h:
+            (JSC::Yarr::ByteTerm::ByteTerm):
+            * yarr/YarrJIT.cpp:
+            (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+            (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+            (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+            (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+            (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+            (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+            (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+            (JSC::Yarr::YarrGenerator::generateTerm):
+            (JSC::Yarr::YarrGenerator::backtrackTerm):
+            (JSC::Yarr::YarrGenerator::generate):
+            (JSC::Yarr::YarrGenerator::backtrack):
+            (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
+            * yarr/YarrPattern.cpp:
+            (JSC::Yarr::YarrPatternConstructor::copyTerm):
+            (JSC::Yarr::YarrPatternConstructor::quantifyAtom):
+            (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
+            (JSC::Yarr::YarrPattern::YarrPattern):
+            * yarr/YarrPattern.h:
+            (JSC::Yarr::PatternTerm::PatternTerm):
+            (JSC::Yarr::PatternTerm::quantify):
+            (JSC::Yarr::YarrPattern::reset):
+
+2017-01-13  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210694. rdar://problem/29983526
+
+    2017-01-12  Saam Barati  <sbarati@apple.com>
+
+            Concurrent GC has a bug where we would detect a race but fail to rescan the object
+            https://bugs.webkit.org/show_bug.cgi?id=166960
+            <rdar://problem/29983526>
+
+            Reviewed by Filip Pizlo and Mark Lam.
+
+            We have code like this in JSC:
+
+            ```
+            Butterfly* butterfly = allocateMoreOutOfLineStorage(vm, oldOutOfLineCapacity, newOutOfLineCapacity);
+            nukeStructureAndSetButterfly(vm, structureID, butterfly);
+            structure->setLastOffset(newLastOffset);
+            WTF::storeStoreFence();
+            setStructureIDDirectly(structureID);
+            ```
+
+            Note that the collector could detect a race here, which sometimes
+            incorrectly caused us to not visit the object again.
+
+            Mutator Thread: M, Collector Thread: C, assuming sequential consistency via
+            proper barriers:
+
+            M: allocate new butterfly
+            M: Set nuked structure ID
+            M: Set butterfly (this does a barrier)
+            C: Start scanning O
+            C: load structure ID
+            C: See it's nuked and bail, (we used to rely on a write barrier to rescan).
+
+            We sometimes never rescanned here because we were calling
+            setStructureIDDirectly which doesn't do a write barrier.
+            (Note, the places that do this but call setStructure were
+            OK because setStructure will perform a write barrier.)
+
+            (This same issue also existed in places where the collector thread
+            detected races for Structure::m_offset, but places that changed
+            Structure::m_offset didn't perform a write barrier on the object
+            after changing its Structure's m_offset.)
+
+            To prevent such code from requiring every call site to perform
+            a write barrier on the object, I've changed the collector code
+            to keep a stack of cells to be revisited due to races. This stack
+            is then consulted when we do marking. Because such races are rare,
+            we have a single stack on Heap that is guarded by a lock.
+
+            * heap/Heap.cpp:
+            (JSC::Heap::Heap):
+            (JSC::Heap::~Heap):
+            (JSC::Heap::markToFixpoint):
+            (JSC::Heap::endMarking):
+            (JSC::Heap::buildConstraintSet):
+            (JSC::Heap::addToRaceMarkStack):
+            * heap/Heap.h:
+            (JSC::Heap::collectorSlotVisitor):
+            (JSC::Heap::mutatorMarkStack): Deleted.
+            * heap/SlotVisitor.cpp:
+            (JSC::SlotVisitor::didRace):
+            * heap/SlotVisitor.h:
+            (JSC::SlotVisitor::didRace):
+            (JSC::SlotVisitor::didNotRace): Deleted.
+            * heap/SlotVisitorInlines.h:
+            (JSC::SlotVisitor::didNotRace): Deleted.
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::visitButterfly):
+            (JSC::JSObject::visitButterflyImpl):
+            * runtime/JSObjectInlines.h:
+            (JSC::JSObject::prepareToPutDirectWithoutTransition):
+            * runtime/Structure.cpp:
+            (JSC::Structure::flattenDictionaryStructure):
+
+2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210609. rdar://problem/27896585
+
+    2017-01-11  Andreas Kling  <akling@apple.com>
+
+            Crash when WebCore's GC heap grows way too large.
+            <https://webkit.org/b/166875>
+            <rdar://problem/27896585>
+
+            Reviewed by Mark Lam.
+
+            Add a simple API to JSC::Heap that allows setting a hard limit on the amount
+            of live bytes. If this is exceeded, we crash with a recognizable signature.
+            By default there is no limit.
+
+            * heap/Heap.cpp:
+            (JSC::Heap::didExceedMaxLiveSize):
+            (JSC::Heap::updateAllocationLimits):
+            * heap/Heap.h:
+            (JSC::Heap::setMaxLiveSize):
+
+2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210565. rdar://problem/29942167
+
+    2017-01-09  Filip Pizlo  <fpizlo@apple.com>
+
+            Streamline the GC barrier slowpath
+            https://bugs.webkit.org/show_bug.cgi?id=166878
+
+            Reviewed by Geoffrey Garen and Saam Barati.
+
+            This implements two optimizations to the barrier:
+
+            - Removes the write barrier buffer. This was just overhead.
+
+            - Teaches the slow path how to white an object that was black but unmarked, ensuring that
+              we don't take slow path for this object again.
+
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
+            * ftl/FTLLowerDFGToB3.cpp:
+            (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
+            * heap/CellState.h:
+            * heap/Heap.cpp:
+            (JSC::Heap::Heap):
+            (JSC::Heap::markToFixpoint):
+            (JSC::Heap::addToRememberedSet):
+            (JSC::Heap::stopTheWorld):
+            (JSC::Heap::writeBarrierSlowPath):
+            (JSC::Heap::buildConstraintSet):
+            (JSC::Heap::flushWriteBarrierBuffer): Deleted.
+            * heap/Heap.h:
+            (JSC::Heap::writeBarrierBuffer): Deleted.
+            * heap/SlotVisitor.cpp:
+            (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+            (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+            (JSC::SlotVisitor::appendToMarkStack):
+            (JSC::SlotVisitor::visitChildren):
+            * heap/WriteBarrierBuffer.cpp: Removed.
+            * heap/WriteBarrierBuffer.h: Removed.
+            * jit/JITOperations.cpp:
+            * jit/JITOperations.h:
+            * runtime/JSCellInlines.h:
+            (JSC::JSCell::JSCell):
+            * runtime/StructureIDBlob.h:
+            (JSC::StructureIDBlob::StructureIDBlob):
+
+2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210563. rdar://problem/29940224
+
+    2017-01-10  Mark Lam  <mark.lam@apple.com>
+
+            Property setters should not be called for bound arguments list entries.
+            https://bugs.webkit.org/show_bug.cgi?id=165631
+
+            Reviewed by Filip Pizlo.
+
+            * builtins/FunctionPrototype.js:
+            (bind):
+            - use @putByValDirect to set the bound arguments so that we don't consult the
+              prototype chain for setters.
+
+            * runtime/IntlDateTimeFormatPrototype.cpp:
+            (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+            * runtime/IntlNumberFormatPrototype.cpp:
+            (JSC::IntlNumberFormatPrototypeGetterFormat):
+            - no need to create a bound arguments array because these bound functions binds
+              no arguments according to the spec.
+
+2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210553. rdar://problem/29941356
+
+    2017-01-09  Filip Pizlo  <fpizlo@apple.com>
+
+            JSArray has some object scanning races
+            https://bugs.webkit.org/show_bug.cgi?id=166874
+
+            Reviewed by Mark Lam.
+
+            This fixes two separate bugs, both of which I detected by running
+            array-splice-contiguous.js in extreme anger:
+
+            1) Some of the paths of shifting and unshifting were not grabbing the internal cell
+               lock. This was causing the array storage scan to crash, even though it was well
+               synchronized (the scan does hold the lock). The fix is just to hold the lock anywhere
+               that memmoves the innards of the butterfly.
+
+            2) Out of line property scanning was synchronized using double collect snapshot. Array
+               storage scanning was synchronized using locks. But what if array storage
+               transformations messed up the out of line properties? It turns out that we actually
+               need to hoist the array storage scanner's locking up into the double collect
+               snapshot.
+
+            I don't know how to write a test that does any better of a job of catching this than
+            array-splice-contiguous.js.
+
+            * heap/DeferGC.h: Make DisallowGC usable even if NDEBUG.
+            * runtime/JSArray.cpp:
+            (JSC::JSArray::unshiftCountSlowCase):
+            (JSC::JSArray::shiftCountWithArrayStorage):
+            (JSC::JSArray::unshiftCountWithArrayStorage):
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::visitButterflyImpl):
+
+2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210530. rdar://problem/29909896
+
+    2017-01-09  Filip Pizlo  <fpizlo@apple.com>
+
+            Unreviewed, fix cloop.
+
+            * dfg/DFGPlanInlines.h:
+
+2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210521. rdar://problem/29909896
+
+    2017-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+            Make the collector's fixpoint smart about scheduling work
+            https://bugs.webkit.org/show_bug.cgi?id=165910
+
+            Reviewed by Keith Miller.
+
+            Prior to this change, every time the GC would run any constraints in markToFixpoint, it
+            would run all of the constraints. It would always run them in the same order. That means
+            that so long as any one constraint was generating new work, we'd pay the price of all
+            constraints. This is usually OK because most constraints are cheap but it artificially
+            inflates the cost of slow constraints - especially ones that are expensive but usually
+            generate no new work.
+
+            This patch redoes how the GC runs constraints by applying ideas from data flow analysis.
+            The GC now builds a MarkingConstraintSet when it boots up, and this contains all of the
+            constraints as well as some meta-data about them. Now, markToFixpoint just calls into
+            MarkingConstraintSet to execute constraints. Because constraint execution and scheduling
+            need to be aware of each other, I rewrote markToFixpoint in such a way that it's more
+            obvious how the GC goes between constraint solving, marking with stopped mutator, and
+            marking with resumed mutator. This also changes the scheduler API in such a way that a
+            synchronous stop-the-world collection no longer needs to do fake stop/resume - instead we
+            just swap the space-time scheduler for the stop-the-world scheduler.
+
+            This is a big streamlining of the GC. This is a speed-up in GC-heavy tests because we
+            now execute most constraints exactly twice regardless of how many total fixpoint
+            iterations we do. Now, when we run out of marking work, the constraint solver will just
+            run the constraint that is most likely to generate new visiting work, and if it does
+            generate work, then the GC now goes back to marking. Before, it would run *all*
+            constraints and then go back to marking. The constraint solver is armed with three
+            information signals that it uses to sort the constraints in order of descending likelihood
+            to generate new marking work. Then it runs them in that order until it there is new
+            marking work. The signals are:
+
+            1) Whether the constraint is greyed by marking or execution. We call this the volatility
+               of the constraint. For example, weak reference constraints have GreyedByMarking as
+               their volatility because they are most likely to have something to say after we've done
+               some marking. On the other hand, conservative roots have GreyedByExecution as their
+               volatility because they will give new information anytime we let the mutator run. The
+               constraint solver will only run GreyedByExecution constraints as roots and after the
+               GreyedByMarking constraints go silent. This ensures that we don't try to scan
+               conservative roots every time we need to re-run weak references and vice-versa.
+
+               Another way to look at it is that the constraint solver tries to predict if the
+               wavefront is advancing or retreating. The wavefront is almost certainly advancing so
+               long as the mark stacks are non-empty or so long as at least one of the GreyedByMarking
+               constraints is still producing work. Otherwise the wavefront is almost certainly
+               retreating. It's most profitable to run GreyedByMarking constraints when the wavefront
+               is advancing, and most profitable to run GreyedByExecution constraints when the
+               wavefront is retreating.
+
+               We use the predicted wavefront direction and the volatility of constraints as a
+               first-order signal of constraint profitability.
+
+            2) How much visiting work was created the last time the constraint ran. The solver
+               remembers the lastVisitCount, and uses it to predict how much work the constraint will
+               generate next time. In practice this means we will keep re-running the one interesting
+               constraint until it shuts up.
+
+            3) Optional work predictors for some constraints. The constraint that shuffles the mutator
+               mark stack into the main SlotVisitor's mutator mark stack always knows exactly how much
+               work it will create.
+
+               The sum of (2) and (3) are used as a second-order signal of constraint profitability.
+
+            The constraint solver will always run all of the GreyedByExecution constraints at GC
+            start, since these double as the GC's roots. The constraint solver will always run all of
+            the GreyedByMarking constraints the first time that marking stalls. Other than that, the
+            solver will keep running constraints, sorted according to their likelihood to create work,
+            until either work is created or we run out of constraints to run. GC termination happens
+            when we run out of constraints to run.
+
+            This new infrastructure means that we have a much better chance of dealing with worst-case
+            DOM pathologies. If we can intelligently factor different evil DOM things into different
+            constraints with the right work predictions then this could reduce the cost of those DOM
+            things by a factor of N where N is the number of fixpoint iterations the GC typically
+            does. N is usually around 5-6 even for simple heaps.
+
+            My perf measurements say:
+
+            PLT3: 0.02% faster with 5.3% confidence.
+            JetStream: 0.15% faster with 17% confidence.
+            Speedometer: 0.58% faster with 82% confidence.
+
+            Here are the details from JetStream:
+
+            splay: 1.02173x faster with 0.996841 confidence
+            splay-latency: 1.0617x faster with 0.987462 confidence
+            towers.c: 1.01852x faster with 0.92128 confidence
+            crypto-md5: 1.06058x faster with 0.482363 confidence
+            score: 1.00152x faster with 0.16892 confidence
+
+            I think that Speedometer is legitimately benefiting from this change based on looking at
+            --logGC=true output. We are now spending less time reexecuting expensive constraints. I
+            think that JetStream/splay is also benefiting, because although the constraints it sees
+            are cheap, it spends 30% of its time in GC so even small improvements matter.
+
+            * CMakeLists.txt:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::markCodeBlocks): Deleted.
+            (JSC::DFG::Plan::rememberCodeBlocks): Deleted.
+            * dfg/DFGPlan.h:
+            * dfg/DFGPlanInlines.h: Added.
+            (JSC::DFG::Plan::iterateCodeBlocksForGC):
+            * dfg/DFGWorklist.cpp:
+            (JSC::DFG::Worklist::markCodeBlocks): Deleted.
+            (JSC::DFG::Worklist::rememberCodeBlocks): Deleted.
+            (JSC::DFG::rememberCodeBlocks): Deleted.
+            * dfg/DFGWorklist.h:
+            * dfg/DFGWorklistInlines.h: Added.
+            (JSC::DFG::iterateCodeBlocksForGC):
+            (JSC::DFG::Worklist::iterateCodeBlocksForGC):
+            * heap/CodeBlockSet.cpp:
+            (JSC::CodeBlockSet::writeBarrierCurrentlyExecuting): Deleted.
+            * heap/CodeBlockSet.h:
+            (JSC::CodeBlockSet::iterate): Deleted.
+            * heap/CodeBlockSetInlines.h:
+            (JSC::CodeBlockSet::iterate):
+            (JSC::CodeBlockSet::iterateCurrentlyExecuting):
+            * heap/Heap.cpp:
+            (JSC::Heap::Heap):
+            (JSC::Heap::iterateExecutingAndCompilingCodeBlocks):
+            (JSC::Heap::iterateExecutingAndCompilingCodeBlocksWithoutHoldingLocks):
+            (JSC::Heap::assertSharedMarkStacksEmpty):
+            (JSC::Heap::markToFixpoint):
+            (JSC::Heap::endMarking):
+            (JSC::Heap::collectInThread):
+            (JSC::Heap::stopIfNecessarySlow):
+            (JSC::Heap::acquireAccessSlow):
+            (JSC::Heap::collectIfNecessaryOrDefer):
+            (JSC::Heap::buildConstraintSet):
+            (JSC::Heap::notifyIsSafeToCollect):
+            (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope): Deleted.
+            (JSC::Heap::ResumeTheWorldScope::~ResumeTheWorldScope): Deleted.
+            (JSC::Heap::harvestWeakReferences): Deleted.
+            (JSC::Heap::visitConservativeRoots): Deleted.
+            (JSC::Heap::visitCompilerWorklistWeakReferences): Deleted.
+            * heap/Heap.h:
+            * heap/MarkingConstraint.cpp: Added.
+            (JSC::MarkingConstraint::MarkingConstraint):
+            (JSC::MarkingConstraint::~MarkingConstraint):
+            (JSC::MarkingConstraint::resetStats):
+            (JSC::MarkingConstraint::execute):
+            * heap/MarkingConstraint.h: Added.
+            (JSC::MarkingConstraint::index):
+            (JSC::MarkingConstraint::abbreviatedName):
+            (JSC::MarkingConstraint::name):
+            (JSC::MarkingConstraint::lastVisitCount):
+            (JSC::MarkingConstraint::quickWorkEstimate):
+            (JSC::MarkingConstraint::workEstimate):
+            (JSC::MarkingConstraint::volatility):
+            * heap/MarkingConstraintSet.cpp: Added.
+            (JSC::MarkingConstraintSet::ExecutionContext::ExecutionContext):
+            (JSC::MarkingConstraintSet::ExecutionContext::didVisitSomething):
+            (JSC::MarkingConstraintSet::ExecutionContext::shouldTimeOut):
+            (JSC::MarkingConstraintSet::ExecutionContext::drain):
+            (JSC::MarkingConstraintSet::ExecutionContext::didExecute):
+            (JSC::MarkingConstraintSet::ExecutionContext::execute):
+            (JSC::MarkingConstraintSet::MarkingConstraintSet):
+            (JSC::MarkingConstraintSet::~MarkingConstraintSet):
+            (JSC::MarkingConstraintSet::resetStats):
+            (JSC::MarkingConstraintSet::add):
+            (JSC::MarkingConstraintSet::executeBootstrap):
+            (JSC::MarkingConstraintSet::executeConvergence):
+            (JSC::MarkingConstraintSet::isWavefrontAdvancing):
+            (JSC::MarkingConstraintSet::executeConvergenceImpl):
+            (JSC::MarkingConstraintSet::executeAll):
+            * heap/MarkingConstraintSet.h: Added.
+            (JSC::MarkingConstraintSet::isWavefrontRetreating):
+            * heap/MutatorScheduler.cpp: Added.
+            (JSC::MutatorScheduler::MutatorScheduler):
+            (JSC::MutatorScheduler::~MutatorScheduler):
+            (JSC::MutatorScheduler::didStop):
+            (JSC::MutatorScheduler::willResume):
+            (JSC::MutatorScheduler::didExecuteConstraints):
+            (JSC::MutatorScheduler::log):
+            (JSC::MutatorScheduler::shouldStop):
+            (JSC::MutatorScheduler::shouldResume):
+            * heap/MutatorScheduler.h: Added.
+            * heap/OpaqueRootSet.h:
+            (JSC::OpaqueRootSet::add):
+            * heap/SlotVisitor.cpp:
+            (JSC::SlotVisitor::visitAsConstraint):
+            (JSC::SlotVisitor::drain):
+            (JSC::SlotVisitor::didReachTermination):
+            (JSC::SlotVisitor::hasWork):
+            (JSC::SlotVisitor::drainFromShared):
+            (JSC::SlotVisitor::drainInParallelPassively):
+            (JSC::SlotVisitor::addOpaqueRoot):
+            * heap/SlotVisitor.h:
+            (JSC::SlotVisitor::addToVisitCount):
+            * heap/SpaceTimeMutatorScheduler.cpp: Copied from Source/JavaScriptCore/heap/SpaceTimeScheduler.cpp.
+            (JSC::SpaceTimeMutatorScheduler::Snapshot::Snapshot):
+            (JSC::SpaceTimeMutatorScheduler::Snapshot::now):
+            (JSC::SpaceTimeMutatorScheduler::Snapshot::bytesAllocatedThisCycle):
+            (JSC::SpaceTimeMutatorScheduler::SpaceTimeMutatorScheduler):
+            (JSC::SpaceTimeMutatorScheduler::~SpaceTimeMutatorScheduler):
+            (JSC::SpaceTimeMutatorScheduler::state):
+            (JSC::SpaceTimeMutatorScheduler::beginCollection):
+            (JSC::SpaceTimeMutatorScheduler::didStop):
+            (JSC::SpaceTimeMutatorScheduler::willResume):
+            (JSC::SpaceTimeMutatorScheduler::didExecuteConstraints):
+            (JSC::SpaceTimeMutatorScheduler::timeToStop):
+            (JSC::SpaceTimeMutatorScheduler::timeToResume):
+            (JSC::SpaceTimeMutatorScheduler::log):
+            (JSC::SpaceTimeMutatorScheduler::endCollection):
+            (JSC::SpaceTimeMutatorScheduler::bytesAllocatedThisCycleImpl):
+            (JSC::SpaceTimeMutatorScheduler::bytesSinceBeginningOfCycle):
+            (JSC::SpaceTimeMutatorScheduler::maxHeadroom):
+            (JSC::SpaceTimeMutatorScheduler::headroomFullness):
+            (JSC::SpaceTimeMutatorScheduler::mutatorUtilization):
+            (JSC::SpaceTimeMutatorScheduler::collectorUtilization):
+            (JSC::SpaceTimeMutatorScheduler::elapsedInPeriod):
+            (JSC::SpaceTimeMutatorScheduler::phase):
+            (JSC::SpaceTimeMutatorScheduler::shouldBeResumed):
+            (JSC::SpaceTimeScheduler::Decision::targetMutatorUtilization): Deleted.
+            (JSC::SpaceTimeScheduler::Decision::targetCollectorUtilization): Deleted.
+            (JSC::SpaceTimeScheduler::Decision::elapsedInPeriod): Deleted.
+            (JSC::SpaceTimeScheduler::Decision::phase): Deleted.
+            (JSC::SpaceTimeScheduler::Decision::shouldBeResumed): Deleted.
+            (JSC::SpaceTimeScheduler::Decision::timeToResume): Deleted.
+            (JSC::SpaceTimeScheduler::Decision::timeToStop): Deleted.
+            (JSC::SpaceTimeScheduler::SpaceTimeScheduler): Deleted.
+            (JSC::SpaceTimeScheduler::snapPhase): Deleted.
+            (JSC::SpaceTimeScheduler::currentDecision): Deleted.
+            * heap/SpaceTimeMutatorScheduler.h: Copied from Source/JavaScriptCore/heap/SpaceTimeScheduler.h.
+            (JSC::SpaceTimeScheduler::Decision::operator bool): Deleted.
+            * heap/SpaceTimeScheduler.cpp: Removed.
+            * heap/SpaceTimeScheduler.h: Removed.
+            * heap/SynchronousStopTheWorldMutatorScheduler.cpp: Added.
+            (JSC::SynchronousStopTheWorldMutatorScheduler::SynchronousStopTheWorldMutatorScheduler):
+            (JSC::SynchronousStopTheWorldMutatorScheduler::~SynchronousStopTheWorldMutatorScheduler):
+            (JSC::SynchronousStopTheWorldMutatorScheduler::state):
+            (JSC::SynchronousStopTheWorldMutatorScheduler::beginCollection):
+            (JSC::SynchronousStopTheWorldMutatorScheduler::timeToStop):
+            (JSC::SynchronousStopTheWorldMutatorScheduler::timeToResume):
+            (JSC::SynchronousStopTheWorldMutatorScheduler::endCollection):
+            * heap/SynchronousStopTheWorldMutatorScheduler.h: Added.
+            * heap/VisitingTimeout.h: Added.
+            (JSC::VisitingTimeout::VisitingTimeout):
+            (JSC::VisitingTimeout::visitCount):
+            (JSC::VisitingTimeout::didVisitSomething):
+            (JSC::VisitingTimeout::shouldTimeOut):
+            * runtime/Options.h:
+
+2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210457. rdar://problem/27330808
+
+    2017-01-06  Michael Saboff  <msaboff@apple.com>
+
+            @putByValDirect in Array.of and Array.from overwrites non-writable/configurable properties
+            https://bugs.webkit.org/show_bug.cgi?id=153486
+
+            Reviewed by Saam Barati.
+
+            Moved read only check in putDirect() to all paths.
+
+            * runtime/SparseArrayValueMap.cpp:
+            (JSC::SparseArrayValueMap::putDirect):
+
+2017-01-11  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210451. rdar://problem/29909812
+
+    2016-12-30  Filip Pizlo  <fpizlo@apple.com>
+
+            DeferGC::~DeferGC should be super cheap
+            https://bugs.webkit.org/show_bug.cgi?id=166626
+
+            Reviewed by Saam Barati.
+
+            Right now, ~DeferGC requires running the collector's full collectIfNecessaryOrDefer()
+            hook, which is super big. Normally, that hook would only be called from GC slow paths,
+            so it ought to be possible to add complex logic to it. It benefits the GC algorithm to
+            make that code smart, not necessarily fast.
+
+            The right thing for it to do is to have ~DeferGC check a boolean to see if
+            collectIfNecessaryOrDefer() had previously deferred anything, and only call it if that
+            is true. That's what this patch does.
+
+            Unfortunately, this means that we lose the collectAccordingToDeferGCProbability mode,
+            which we used for two tests. Since I could only see two tests that used this mode, I
+            felt that it was better to enhance the GC than to keep the tests. I filed bug 166627 to
+            bring back something like that mode.
+
+            Although this patch does make some paths faster, its real goal is to ensure that bug
+            165963 can add more logic to collectIfNecessaryOrDefer() without introducing a big
+            regression. Until then, I wouldn't be surprised if this patch was a progression, but I'm
+            not betting on it.
+
+            * heap/Heap.cpp:
+            (JSC::Heap::collectIfNecessaryOrDefer):
+            (JSC::Heap::decrementDeferralDepthAndGCIfNeededSlow):
+            (JSC::Heap::canCollect): Deleted.
+            (JSC::Heap::shouldCollectHeuristic): Deleted.
+            (JSC::Heap::shouldCollect): Deleted.
+            (JSC::Heap::collectAccordingToDeferGCProbability): Deleted.
+            (JSC::Heap::decrementDeferralDepthAndGCIfNeeded): Deleted.
+            * heap/Heap.h:
+            * heap/HeapInlines.h:
+            (JSC::Heap::incrementDeferralDepth):
+            (JSC::Heap::decrementDeferralDepth):
+            (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
+            (JSC::Heap::mayNeedToStop):
+            (JSC::Heap::stopIfNecessary):
+            * runtime/Options.h:
+
+2017-01-11  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210398. rdar://problem/29229439
+
+    2017-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+            AutomaticThread timeout shutdown leaves a small window where notify() would think that the thread is still running
+            https://bugs.webkit.org/show_bug.cgi?id=166742
+
+            Reviewed by Geoffrey Garen.
+
+            Update to new AutomaticThread API.
+
+            * dfg/DFGWorklist.cpp:
+
+2017-01-10  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Rollout r210336. rdar://problem/29912353
+
+2017-01-09  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r210458. rdar://problem/29911919
+
+    2017-01-06  Mark Lam  <mark.lam@apple.com>
+
+            The ObjC API's JSVirtualMachine's map tables need to be guarded by a lock.
+            https://bugs.webkit.org/show_bug.cgi?id=166778
+            <rdar://problem/29761198>
+
+            Reviewed by Filip Pizlo.
+
+            Now that we have a concurrent GC, access to JSVirtualMachine's
+            m_externalObjectGraph and m_externalRememberedSet need to be guarded by a lock
+            since both the GC marker thread and the mutator thread may access them at the
+            same time.
+
+            * API/JSVirtualMachine.mm:
+            (-[JSVirtualMachine addExternalRememberedObject:]):
+            (-[JSVirtualMachine addManagedReference:withOwner:]):
+            (-[JSVirtualMachine removeManagedReference:withOwner:]):
+            (-[JSVirtualMachine externalDataMutex]):
+            (scanExternalObjectGraph):
+            (scanExternalRememberedSet):
+
+            * API/JSVirtualMachineInternal.h:
+            - Deleted externalObjectGraph method.  There's no need to expose this.
+
+2017-01-06  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Revert the following merges as part of disabling Web Assembly. rdar://problem/29890343
+
+        rdar://problem/29735737
+        rdar://problem/29747874
+        rdar://problem/29758107
+        rdar://problem/29759741
+        rdar://problem/29760322
+        rdar://problem/29760326
+        rdar://problem/29760386
+        rdar://problem/29760621
+        rdar://problem/29762017
+        rdar://problem/29782821
+        rdar://problem/29782833
+        rdar://problem/29784532
+        rdar://problem/29791695
+        rdar://problem/29793220
+        rdar://problem/29793949
+        rdar://problem/29795709
+        rdar://problem/29803676
+        rdar://problem/29814999
+        rdar://problem/29815000
+        rdar://problem/29841541
+        rdar://problem/29844107
+        rdar://problem/29856455
+
+2017-01-06  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Disable WebAssembly. rdar://problem/29890343
+
+        Landed on behalf of JF Bastien.
+
+        * runtime/Options.h:
+
+2017-01-06  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210276. rdar://problem/28867002
+
+    2017-01-04  Saam Barati  <sbarati@apple.com>
+
+            We don't properly handle exceptions inside the nativeCallTrampoline macro in the LLInt
+            https://bugs.webkit.org/show_bug.cgi?id=163720
+
+            Reviewed by Mark Lam.
+
+            In the LLInt, we were incorrectly doing the exception check after the call.
+            Before the exception check, we were unwinding to our caller's
+            frame under the assumption that our caller was always a JS frame.
+            This is incorrect, however, because our caller might be a C frame.
+            One way that it can be a C frame is when C calls to JS, and JS tail
+            calls to native. This patch fixes this bug by doing unwinding from
+            the native callee's frame instead of its callers.
+
+            * llint/LowLevelInterpreter32_64.asm:
+            * llint/LowLevelInterpreter64.asm:
+
+2017-01-06  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210259. rdar://problem/29856455
+
+    2017-01-03  JF Bastien  <jfbastien@apple.com>
+
+            REGRESSION (r210244): Release JSC Stress test failure: wasm.yaml/wasm/js-api/wasm-to-wasm.js.default-wasm
+            https://bugs.webkit.org/show_bug.cgi?id=166669
+            <rdar://problem/29856455>
+
+            Reviewed by Saam Barati.
+
+            Bug #165282 added wasm -> wasm calls, but caused crashes in
+            release builds because the pinned registers are also callee-saved
+            and were being clobbered. B3 didn't see itself clobbering them
+            when no memory was used, and therefore omitted a restore.
+
+            This was causing the C++ code in callWebAssemblyFunction to crash
+            because $r12 was 0, and it expected it to have its value prior to
+            the call.
+
+            * wasm/WasmB3IRGenerator.cpp:
+            (JSC::Wasm::createJSToWasmWrapper):
+
+2017-01-06  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210221. rdar://problem/29449474
+
+    2017-01-01  Jeff Miller  <jeffm@apple.com>
+
+            Update user-visible copyright strings to include 2017
+            https://bugs.webkit.org/show_bug.cgi?id=166278
+
+            Reviewed by Dan Bernstein.
+
+            * Info.plist:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210282. rdar://problem/29760326
+
+    2017-01-04  JF Bastien  <jfbastien@apple.com>
+
+            WebAssembly JS API: add Module.sections
+            https://bugs.webkit.org/show_bug.cgi?id=165159
+            <rdar://problem/29760326>
+
+            Reviewed by Mark Lam.
+
+            As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodulecustomsections
+
+            This was added for Emscripten, and is likely to be used soon.
+
+            * wasm/WasmFormat.h: custom sections are just name + bytes
+            * wasm/WasmModuleParser.cpp: parse them, instead of skipping over
+            * wasm/WasmModuleParser.h:
+            * wasm/js/WebAssemblyModulePrototype.cpp: construct the Array of
+            ArrayBuffer as described in the spec
+            (JSC::webAssemblyModuleProtoCustomSections):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210229. rdar://problem/29760322
+
+    2017-01-02  JF Bastien  <jfbastien@apple.com>
+
+            WebAssembly: handle and optimize wasm export → wasm import calls
+            https://bugs.webkit.org/show_bug.cgi?id=165282
+
+            Reviewed by Saam Barati.
+
+              - Add a new JSType for WebAssemblyFunction, and use it when creating its
+                structure. This will is used to quickly detect from wasm whether the import
+                call is to another wasm module, or whether it's to JS.
+              - Generate two stubs from the import stub generator: one for wasm->JS and one
+                for wasm -> wasm. This is done at Module time. Which is called will only be
+                known at Instance time, once we've received the import object. We want to
+                avoid codegen at Instance time, so having both around is great.
+              - Restore the WebAssembly global state (VM top Instance, and pinned registers)
+                after call / call_indirect, and in the JS->wasm entry stub.
+              - Pinned registers are now a global thing, not per-Memory, because the wasm ->
+                wasm stubs are generated at Module time where we don't really have enough
+                information to do the right thing (doing so would generate too much code).
+
+            * CMakeLists.txt:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * runtime/JSType.h: add WebAssemblyFunctionType as a JSType
+            * wasm/WasmB3IRGenerator.cpp: significantly rework how calls which
+            could be external work, and how we save / restore global state:
+            VM's top Instance, and pinned registers
+            (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+            (JSC::Wasm::getMemoryBaseAndSize):
+            (JSC::Wasm::restoreWebAssemblyGlobalState):
+            (JSC::Wasm::createJSToWasmWrapper):
+            (JSC::Wasm::parseAndCompile):
+            * wasm/WasmB3IRGenerator.h:
+            * wasm/WasmBinding.cpp:
+            (JSC::Wasm::materializeImportJSCell):
+            (JSC::Wasm::wasmToJS):
+            (JSC::Wasm::wasmToWasm): the main goal of this patch was adding this function
+            (JSC::Wasm::exitStubGenerator):
+            * wasm/WasmBinding.h:
+            * wasm/WasmFormat.h: Get rid of much of the function index space:
+            we already have all of its information elsewhere, and as-is it
+            provides no extra efficiency.
+            (JSC::Wasm::ModuleInformation::functionIndexSpaceSize):
+            (JSC::Wasm::ModuleInformation::isImportedFunctionFromFunctionIndexSpace):
+            (JSC::Wasm::ModuleInformation::signatureIndexFromFunctionIndexSpace):
+            * wasm/WasmFunctionParser.h:
+            (JSC::Wasm::FunctionParser<Context>::FunctionParser):
+            * wasm/WasmMemory.cpp: Add some logging.
+            (JSC::Wasm::Memory::dump): this was nice when debugging
+            (JSC::Wasm::Memory::makeString):
+            (JSC::Wasm::Memory::Memory):
+            (JSC::Wasm::Memory::~Memory):
+            (JSC::Wasm::Memory::grow):
+            * wasm/WasmMemory.h: don't use extra indirection, it wasn't
+            needed. Reorder some of the fields which are looked up at runtime
+            so they're more cache-friendly.
+            (JSC::Wasm::Memory::Memory):
+            (JSC::Wasm::Memory::mode):
+            (JSC::Wasm::Memory::offsetOfSize):
+            * wasm/WasmMemoryInformation.cpp: Pinned registers are now a
+            global thing for all of JSC, not a per-Memory thing
+            anymore. wasm->wasm calls are more complex otherwise: they have to
+            figure out how to bridge between the caller and callee's
+            special-snowflake pinning.
+            (JSC::Wasm::PinnedRegisterInfo::get):
+            (JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
+            (JSC::Wasm::MemoryInformation::MemoryInformation):
+            * wasm/WasmMemoryInformation.h:
+            * wasm/WasmModuleParser.cpp:
+            * wasm/WasmModuleParser.h:
+            * wasm/WasmPageCount.cpp: Copied from Source/JavaScriptCore/wasm/WasmBinding.h.
+            (JSC::Wasm::PageCount::dump): nice for debugging
+            * wasm/WasmPageCount.h:
+            * wasm/WasmPlan.cpp:
+            (JSC::Wasm::Plan::parseAndValidateModule):
+            (JSC::Wasm::Plan::run):
+            * wasm/WasmPlan.h:
+            (JSC::Wasm::Plan::takeWasmExitStubs):
+            * wasm/WasmSignature.cpp:
+            (JSC::Wasm::Signature::toString):
+            (JSC::Wasm::Signature::dump):
+            * wasm/WasmSignature.h:
+            * wasm/WasmValidate.cpp:
+            (JSC::Wasm::validateFunction):
+            * wasm/WasmValidate.h:
+            * wasm/js/JSWebAssemblyInstance.h:
+            (JSC::JSWebAssemblyInstance::offsetOfTable):
+            (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
+            (JSC::JSWebAssemblyInstance::offsetOfImportFunction):
+            * wasm/js/JSWebAssemblyMemory.cpp:
+            (JSC::JSWebAssemblyMemory::create):
+            (JSC::JSWebAssemblyMemory::JSWebAssemblyMemory):
+            (JSC::JSWebAssemblyMemory::buffer):
+            (JSC::JSWebAssemblyMemory::grow):
+            * wasm/js/JSWebAssemblyMemory.h:
+            (JSC::JSWebAssemblyMemory::memory):
+            (JSC::JSWebAssemblyMemory::offsetOfMemory):
+            (JSC::JSWebAssemblyMemory::offsetOfSize):
+            * wasm/js/JSWebAssemblyModule.cpp:
+            (JSC::JSWebAssemblyModule::create):
+            (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
+            * wasm/js/JSWebAssemblyModule.h:
+            (JSC::JSWebAssemblyModule::signatureIndexFromFunctionIndexSpace):
+            (JSC::JSWebAssemblyModule::functionImportCount):
+            * wasm/js/WebAssemblyFunction.cpp:
+            (JSC::callWebAssemblyFunction):
+            (JSC::WebAssemblyFunction::create):
+            (JSC::WebAssemblyFunction::createStructure):
+            (JSC::WebAssemblyFunction::WebAssemblyFunction):
+            (JSC::WebAssemblyFunction::finishCreation):
+            * wasm/js/WebAssemblyFunction.h:
+            (JSC::WebAssemblyFunction::wasmEntrypoint):
+            (JSC::WebAssemblyFunction::offsetOfInstance):
+            (JSC::WebAssemblyFunction::offsetOfWasmEntryPointCode):
+            * wasm/js/WebAssemblyInstanceConstructor.cpp:
+            (JSC::constructJSWebAssemblyInstance): always start with a dummy
+            memory, so wasm->wasm calls don't need to null-check
+            * wasm/js/WebAssemblyMemoryConstructor.cpp:
+            (JSC::constructJSWebAssemblyMemory):
+            * wasm/js/WebAssemblyModuleConstructor.cpp:
+            (JSC::WebAssemblyModuleConstructor::createModule):
+            * wasm/js/WebAssemblyModuleRecord.cpp:
+            (JSC::WebAssemblyModuleRecord::link):
+            (JSC::WebAssemblyModuleRecord::evaluate):
+            * wasm/js/WebAssemblyModuleRecord.h:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210202. rdar://problem/29803676
+
+    2016-12-28  Saam Barati  <sbarati@apple.com>
+
+            Unreviewed. Fix jsc.cpp build error.
+
+            * jsc.cpp:
+            (functionTestWasmModuleFunctions):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210201. rdar://problem/29803676
+
+    2016-12-28  Saam Barati  <sbarati@apple.com>
+
+            WebAssembly: Implement grow_memory and current_memory
+            https://bugs.webkit.org/show_bug.cgi?id=166448
+            <rdar://problem/29803676>
+
+            Reviewed by Keith Miller.
+
+            This patch implements grow_memory, current_memory, and WebAssembly.prototype.grow.
+            See relevant spec texts here:
+
+            https://github.com/WebAssembly/design/blob/master/Semantics.md#linear-memory-accesses
+            https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymemoryprototypegrow
+
+            I also fix a couple miscellaneous bugs:
+
+            1. Data section now understands full init_exprs.
+            2. parseVarUint1 no longer has a bug where we allow values larger than 1 if
+            their bottom 8 bits are zero.
+
+            Since the JS API can now grow memory, we need to make calling an import
+            and call_indirect refresh the base memory register and the size registers.
+
+            * jsc.cpp:
+            (functionTestWasmModuleFunctions):
+            * runtime/Options.h:
+            * runtime/VM.h:
+            * wasm/WasmB3IRGenerator.cpp:
+            (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+            (JSC::Wasm::reloadPinnedRegisters):
+            (JSC::Wasm::B3IRGenerator::emitReloadPinnedRegisters):
+            (JSC::Wasm::createJSToWasmWrapper):
+            (JSC::Wasm::parseAndCompile):
+            * wasm/WasmFormat.cpp:
+            (JSC::Wasm::Segment::create):
+            * wasm/WasmFormat.h:
+            (JSC::Wasm::I32InitExpr::I32InitExpr):
+            (JSC::Wasm::I32InitExpr::globalImport):
+            (JSC::Wasm::I32InitExpr::constValue):
+            (JSC::Wasm::I32InitExpr::isConst):
+            (JSC::Wasm::I32InitExpr::isGlobalImport):
+            (JSC::Wasm::I32InitExpr::globalImportIndex):
+            (JSC::Wasm::Segment::byte):
+            (JSC::Wasm::ModuleInformation::importFunctionCount):
+            (JSC::Wasm::ModuleInformation::hasMemory):
+            * wasm/WasmFunctionParser.h:
+            * wasm/WasmMemory.cpp:
+            (JSC::Wasm::Memory::Memory):
+            (JSC::Wasm::Memory::grow):
+            * wasm/WasmMemory.h:
+            (JSC::Wasm::Memory::size):
+            (JSC::Wasm::Memory::sizeInPages):
+            (JSC::Wasm::Memory::offsetOfMemory):
+            (JSC::Wasm::Memory::isValid): Deleted.
+            (JSC::Wasm::Memory::grow): Deleted.
+            * wasm/WasmModuleParser.cpp:
+            (JSC::Wasm::makeI32InitExpr):
+            * wasm/WasmModuleParser.h:
+            * wasm/WasmPageCount.h:
+            (JSC::Wasm::PageCount::bytes):
+            (JSC::Wasm::PageCount::pageCount):
+            (JSC::Wasm::PageCount::fromBytes):
+            (JSC::Wasm::PageCount::operator+):
+            * wasm/WasmParser.h:
+            (JSC::Wasm::Parser<SuccessType>::parseVarUInt1):
+            * wasm/WasmValidate.cpp:
+            * wasm/js/JSWebAssemblyInstance.h:
+            (JSC::JSWebAssemblyInstance::offsetOfMemory):
+            * wasm/js/JSWebAssemblyMemory.cpp:
+            (JSC::JSWebAssemblyMemory::~JSWebAssemblyMemory):
+            (JSC::JSWebAssemblyMemory::grow):
+            * wasm/js/JSWebAssemblyMemory.h:
+            (JSC::JSWebAssemblyMemory::offsetOfMemory):
+            * wasm/js/JSWebAssemblyModule.h:
+            (JSC::JSWebAssemblyModule::functionImportCount):
+            (JSC::JSWebAssemblyModule::jsEntrypointCalleeFromFunctionIndexSpace):
+            (JSC::JSWebAssemblyModule::wasmEntrypointCalleeFromFunctionIndexSpace):
+            (JSC::JSWebAssemblyModule::importCount): Deleted.
+            * wasm/js/WebAssemblyFunction.cpp:
+            (JSC::callWebAssemblyFunction):
+            * wasm/js/WebAssemblyInstanceConstructor.cpp:
+            (JSC::constructJSWebAssemblyInstance):
+            * wasm/js/WebAssemblyMemoryConstructor.cpp:
+            (JSC::constructJSWebAssemblyMemory):
+            * wasm/js/WebAssemblyMemoryPrototype.cpp:
+            (JSC::getMemory):
+            (JSC::webAssemblyMemoryProtoFuncBuffer):
+            (JSC::webAssemblyMemoryProtoFuncGrow):
+            * wasm/js/WebAssemblyModuleRecord.cpp:
+            (JSC::WebAssemblyModuleRecord::link):
+            (JSC::dataSegmentFail):
+            (JSC::WebAssemblyModuleRecord::evaluate):
+            * wasm/wasm.json:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210073. rdar://problem/29762017
+
+    2016-12-21  JF Bastien  <jfbastien@apple.com>
+
+            WebAssembly JS API: cleanup & pass VM around to {Compile/Runtime}Error
+            https://bugs.webkit.org/show_bug.cgi?id=166295
+            <rdar://problem/29762017>
+
+            Reviewed by Mark Lam.
+
+            Rename the create* functions, and pass VM around, as suggested for
+            LinkError in #165805.
+
+            At the same time, use the default source appender when
+            constructing these error types, which gives a nice map back to the
+            original source as part of the error message. This is clearer when
+            using the current frame, so add that as well.
+
+            * jit/ThunkGenerators.cpp:
+            (JSC::throwExceptionFromWasmThunkGenerator):
+            * wasm/js/JSWebAssemblyCompileError.cpp:
+            (JSC::JSWebAssemblyCompileError::create):
+            (JSC::createJSWebAssemblyCompileError):
+            (JSC::createWebAssemblyCompileError): Deleted.
+            * wasm/js/JSWebAssemblyCompileError.h:
+            (JSC::JSWebAssemblyCompileError::create):
+            * wasm/js/JSWebAssemblyRuntimeError.cpp:
+            (JSC::JSWebAssemblyRuntimeError::create):
+            * wasm/js/JSWebAssemblyRuntimeError.h:
+            (JSC::JSWebAssemblyRuntimeError::create):
+            * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
+            (JSC::constructJSWebAssemblyCompileError):
+            * wasm/js/WebAssemblyModuleConstructor.cpp:
+            (JSC::WebAssemblyModuleConstructor::createModule):
+            * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
+            (JSC::constructJSWebAssemblyRuntimeError):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210244. rdar://problem/29844107
+
+    2017-01-03  JF Bastien  <jfbastien@apple.com>
+
+            WebAssembly JS API: check and test in-call / out-call values
+            https://bugs.webkit.org/show_bug.cgi?id=164876
+            <rdar://problem/29844107>
+
+            Reviewed by Saam Barati.
+
+            * wasm/WasmBinding.cpp:
+            (JSC::Wasm::wasmToJs): fix the wasm -> JS call coercions for f32 /
+            f64 which the assotiated tests inadvertently tripped on: the
+            previous code wasn't correctly performing JSValue boxing for
+            "double" values. This change is slightly involved because it
+            requires two scratch registers to materialize the
+            `DoubleEncodeOffset` value. This change therefore reorganizes the
+            code to first generate traps, then handle all integers (freeing
+            all GPRs), and then all the floating-point values.
+            * wasm/js/WebAssemblyFunction.cpp:
+            (JSC::callWebAssemblyFunction): Implement the defined semantics
+            for mismatched arities when JS calls wasm:
+            https://github.com/WebAssembly/design/blob/master/JS.md#exported-function-exotic-objects
+              - i32 is 0, f32 / f64 are NaN.
+              - wasm functions which return "void" are "undefined" in JS.
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210228. rdar://problem/29841541
+
+    2017-01-02  Saam Barati  <sbarati@apple.com>
+
+            WebAssembly: Some loads don't take into account the offset
+            https://bugs.webkit.org/show_bug.cgi?id=166616
+            <rdar://problem/29841541>
+
+            Reviewed by Keith Miller.
+
+            * wasm/WasmB3IRGenerator.cpp:
+            (JSC::Wasm::B3IRGenerator::emitLoadOp):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210203. rdar://problem/29815000
+
+    2016-12-28  Saam Barati  <sbarati@apple.com>
+
+            WebAssembly: Don't allow duplicate export names
+            https://bugs.webkit.org/show_bug.cgi?id=166490
+            <rdar://problem/29815000>
+
+            Reviewed by Keith Miller.
+
+            * wasm/WasmModuleParser.cpp:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210137. rdar://problem/29760386
+
+    2016-12-23  Keith Miller  <keith_miller@apple.com>
+
+            WebAssembly: trap on bad division.
+            https://bugs.webkit.org/show_bug.cgi?id=164786
+
+            Reviewed by Mark Lam.
+
+            This patch adds traps for division / modulo by zero and for
+            division by int_min / -1.
+
+            * wasm/WasmB3IRGenerator.cpp:
+            (JSC::Wasm::B3IRGenerator::emitChecksForModOrDiv):
+            * wasm/WasmExceptionType.h:
+            * wasm/WasmPlan.cpp:
+            (JSC::Wasm::Plan::run):
+            * wasm/wasm.json:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210127. rdar://problem/29795709
+
+    2016-12-22  Keith Miller  <keith_miller@apple.com>
+
+            WebAssembly: Make spec-tests/f32.wast.js and spec-tests/f64.wast.js pass
+            https://bugs.webkit.org/show_bug.cgi?id=166447
+
+            Reviewed by Saam Barati.
+
+            We needed to treat -0.0 < 0.0 for floating point min/max. For min,
+            the algorithm works because if a == b then a and b are not NaNs so
+            either they are the same or they are some zero. When we or a and b
+            either we get the same number back or we get -0.0. Similarly for
+            max we use an and and the sign bit gets dropped if one is 0.0 and
+            the other is -0.0, otherwise, we get the same number back.
+
+            * wasm/wasm.json:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210126. rdar://problem/29793949
+
+    2016-12-22  Saam Barati  <sbarati@apple.com>
+
+            WebAssembly: Make calling Wasm functions that returns or takes an i64 as a parameter an early exception
+            https://bugs.webkit.org/show_bug.cgi?id=166437
+            <rdar://problem/29793949>
+
+            Reviewed by Keith Miller.
+
+            This patch makes it so that we throw an exception before we do
+            anything else if we call a wasm function that either takes an
+            i64 as an argument or returns an i64.
+
+            * wasm/js/WebAssemblyFunction.cpp:
+            (JSC::callWebAssemblyFunction):
+            (JSC::WebAssemblyFunction::WebAssemblyFunction):
+            (JSC::WebAssemblyFunction::call): Deleted.
+            * wasm/js/WebAssemblyFunction.h:
+            (JSC::WebAssemblyFunction::signatureIndex):
+            (JSC::WebAssemblyFunction::jsEntrypoint):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210115. rdar://problem/29793220
+
+    2016-12-22  Saam Barati  <sbarati@apple.com>
+
+            WebAssembly: Make the spec-tests/address.wast.js test pass
+            https://bugs.webkit.org/show_bug.cgi?id=166429
+            <rdar://problem/29793220>
+
+            Reviewed by Keith Miller.
+
+            Right now, provably out of bound loads/stores (given a load/store's constant
+            offset) are not a validation error. However, we were failing to catch uint32_t
+            overflows in release builds (we did have a debug assertion). To fix this,
+            I now detect when uint32_t addition will overflow, and instead of emitting
+            a normal load/store, I emit code that throws an out of bounds memory exception.
+
+            * wasm/WasmB3IRGenerator.cpp:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210111. rdar://problem/29791695
+
+    2016-12-22  Keith Miller  <keith_miller@apple.com>
+
+            WebAssembly: The validator should not allow unused stack entries at the end of a block
+            https://bugs.webkit.org/show_bug.cgi?id=166411
+
+            Reviewed by Saam Barati.
+
+            This patch also cleans up some of the verbose mode logging.
+
+            * wasm/WasmB3IRGenerator.cpp:
+            (JSC::Wasm::dumpExpressionStack):
+            (JSC::Wasm::B3IRGenerator::dump):
+            * wasm/WasmFunctionParser.h:
+            * wasm/WasmValidate.cpp:
+            (JSC::Wasm::dumpExpressionStack):
+            (JSC::Wasm::Validate::dump):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210102. rdar://problem/29784532
+
+    2016-12-22  Saam Barati  <sbarati@apple.com>
+
+            WebAssembly: Make the spec-tests/start.wast.js test pass
+            https://bugs.webkit.org/show_bug.cgi?id=166416
+            <rdar://problem/29784532>
+
+            Reviewed by Yusuke Suzuki.
+
+            To make the test run, I had to fix two bugs:
+
+            1. We weren't properly finding the start function. There was code
+            that would try to find the start function from the list of *exported*
+            functions. This is wrong; the start function is an index into the
+            function index space, which is the space for *imports* and *local*
+            functions. So the code was just wrong in this respect, and I've
+            fixed it do the right thing. We weren't sure if this was originally
+            allowed or not in the spec, but it has been decided that it is allowed
+            and the spec-tests test for it: https://github.com/WebAssembly/design/issues/896
+
+            2. We were emitting a breakpoint for Unreachable. Instead of crashing,
+            this opcode needs to throw an exception when executing.
+
+            * wasm/WasmB3IRGenerator.cpp:
+            * wasm/WasmExceptionType.h:
+            * wasm/js/WebAssemblyModuleRecord.cpp:
+            (JSC::WebAssemblyModuleRecord::link):
+            (JSC::WebAssemblyModuleRecord::evaluate):
+            * wasm/js/WebAssemblyModuleRecord.h:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210091. rdar://problem/29782833
+
+    2016-12-21  Keith Miller  <keith_miller@apple.com>
+
+            WebAssembly: Fix decode floating point constants in unreachable code
+            https://bugs.webkit.org/show_bug.cgi?id=166400
+
+            Reviewed by Saam Barati.
+
+            We decoded these as variable length but they should be fixed length.
+
+            * wasm/WasmFunctionParser.h:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210090. rdar://problem/29782821
+
+    2016-12-21  Keith Miller  <keith_miller@apple.com>
+
+            WebAssembly: Allow br, br_if, and br_table to act as a return
+            https://bugs.webkit.org/show_bug.cgi?id=166393
+
+            Reviewed by Saam Barati.
+
+            This patch allows br, br_if, and br_table to treat branching to
+            the size of the control stack to act as a return. This change was
+            made by adding a new block type to the wasm function parser,
+            TopLevel. Adding this new block eliminates a lot of the special
+            case code we had in the parser previously. The only special case
+            we need is when the end opcode is parsed from the top level.  The
+            B3 IR generator needs to automatically emit a return at that
+            point.
+
+            Also, this patch adds the function number to validation errors
+            in the function parser. The current error message is not helpful
+            otherwise.
+
+            * wasm/WasmB3IRGenerator.cpp:
+            (JSC::Wasm::B3IRGenerator::ControlData::dump):
+            (JSC::Wasm::B3IRGenerator::addTopLevel):
+            * wasm/WasmFunctionParser.h:
+            * wasm/WasmPlan.cpp:
+            (JSC::Wasm::Plan::parseAndValidateModule):
+            (JSC::Wasm::Plan::run):
+            * wasm/WasmValidate.cpp:
+            (JSC::Wasm::Validate::ControlData::dump):
+            (JSC::Wasm::Validate::Validate):
+            (JSC::Wasm::Validate::addTopLevel):
+            (JSC::Wasm::validateFunction):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210047. rdar://problem/29758107
+
+    2016-12-20  Saam Barati  <sbarati@apple.com>
+
+            WebAssembly: We should compile wasm functions in parallel
+            https://bugs.webkit.org/show_bug.cgi?id=165993
+
+            Reviewed by Keith Miller.
+
+            This patch adds a very simple parallel compiler for Wasm code.
+            This patch speeds up compiling the Unity headless benchmark by
+            slightly more than 4x on my MBP. To make this safe, I perform
+            all linking on the main thread. I also had to change some code
+            inside Wasmb3IRGenerator to be thread safe.
+
+            * b3/air/AirCustom.h:
+            (JSC::B3::Air::WasmBoundsCheckCustom::generate):
+            * b3/air/AirGenerationContext.h:
+            * wasm/WasmB3IRGenerator.cpp:
+            (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+            (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
+            (JSC::Wasm::createJSToWasmWrapper):
+            (JSC::Wasm::parseAndCompile):
+            * wasm/WasmB3IRGenerator.h:
+            * wasm/WasmCallingConvention.h:
+            (JSC::Wasm::CallingConvention::setupFrameInPrologue):
+            * wasm/WasmPlan.cpp:
+            (JSC::Wasm::Plan::parseAndValidateModule):
+            (JSC::Wasm::Plan::run):
+            * wasm/WasmPlan.h:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210038. rdar://problem/29759741
+
+    2016-12-20  JF Bastien  <jfbastien@apple.com>
+
+            WebAssembly: construct 32-bit encodedJSValue properly
+            https://bugs.webkit.org/show_bug.cgi?id=166199
+
+            Reviewed by Mark Lam.
+
+            Constructing an encodedJSValue using `{ }` yields the wrong value
+            on 32-bit platforms. WebAssembly doesn't currently target 32-bit
+            platforms, but we may as well get it right.
+
+            * wasm/JSWebAssembly.cpp:
+            (JSC::webAssemblyCompileFunc):
+            (JSC::webAssemblyValidateFunc):
+            * wasm/js/JSWebAssemblyHelpers.h:
+            (JSC::toNonWrappingUint32):
+            * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
+            (JSC::constructJSWebAssemblyCompileError):
+            * wasm/js/WebAssemblyFunction.cpp:
+            (JSC::callWebAssemblyFunction):
+            * wasm/js/WebAssemblyInstanceConstructor.cpp:
+            (JSC::constructJSWebAssemblyInstance):
+            * wasm/js/WebAssemblyMemoryConstructor.cpp:
+            (JSC::constructJSWebAssemblyMemory):
+            * wasm/js/WebAssemblyModuleConstructor.cpp:
+            (JSC::constructJSWebAssemblyModule):
+            * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
+            (JSC::constructJSWebAssemblyRuntimeError):
+            * wasm/js/WebAssemblyTableConstructor.cpp:
+            (JSC::constructJSWebAssemblyTable):
+            * wasm/js/WebAssemblyTablePrototype.cpp:
+            (JSC::webAssemblyTableProtoFuncLength):
+            (JSC::webAssemblyTableProtoFuncGrow):
+            (JSC::webAssemblyTableProtoFuncGet):
+            (JSC::webAssemblyTableProtoFuncSet):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210026. rdar://problem/29735737
+
+    2016-12-20  JF Bastien  <jfbastien@apple.com>
+
+            WebAssembly: unique function signatures
+            https://bugs.webkit.org/show_bug.cgi?id=165957
+            <rdar://problem/29735737>
+
+            Reviewed by Saam Barati.
+
+            Signatures in a Module's Type section can be duplicated, we
+            therefore need to unique them so that call_indirect only needs to
+            do a single integer compare to check that a callee's Signature is
+            the same as the Signature declared at the call site. Without
+            uniquing we'd either trap when duplicate Signatures are used, or
+            we'd need to do multiple comparisons. This patch makes that narrow
+            usecase function correctly.
+
+            There's further complication when calling from wasm to
+            wasm, in which case the Signatures must also match. Such
+            cross-instance calls will be improved in bug #165282, but this
+            patch sets the groundwork for it:
+
+            - Signatures are now owned by SignatureInformation which lives on
+              VM, and is shared by all Modules.
+            - When parsing a Module, a Signature is created for every Type
+              entry, and then uniqued by SignatureInformation's adopt
+              method. Duplicate Signatures are dropped and the previous
+              SignatureIndex is returned, new Signatures are adopted and a new
+              SignatureIndex is created.
+            - The SignatureIndex values are monotonic. 0 is used to represent
+              invalid indices, which trap. This can only occur through Table.
+            - SignatureInformation is used while generating code to map a
+              SignatureIndex back to the Signature* when return / argument
+              information is needed. This is a simple lookup into a Vector. It
+              isn't used at runtime.
+            - These Signatures live forever on VM because the bookkeeping
+              likely isn't worth it. We may want to empty things out if all
+              Modules die, this is tracked in bug #166037.
+            - We can further improve things by bit-packing SignatureIndex with
+              Code*, which is tracked by bug #165511.
+
+            * CMakeLists.txt:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * runtime/VM.h: wasm signatures are uniqued here, but aren't accessed frequently (only during parsing) so indirection is fine
+            * wasm/WasmB3IRGenerator.cpp: use SignatureIndex instead of Signature* when appropriate, and when still using Signature* do so with its new API
+            (JSC::Wasm::createJSToWasmWrapper):
+            (JSC::Wasm::parseAndCompile):
+            * wasm/WasmBinding.cpp:
+            (JSC::Wasm::importStubGenerator): use SignatureIndex
+            * wasm/WasmBinding.h:
+            * wasm/WasmCallingConvention.h:
+            (JSC::Wasm::CallingConvention::loadArguments):
+            * wasm/WasmFormat.cpp: drive-by move of alloc/free functions to the implementation file, allows the .h file to drop an FastMalloc.h
+            (JSC::Wasm::Segment::create):
+            (JSC::Wasm::Segment::destroy):
+            (JSC::Wasm::Segment::createPtr):
+            * wasm/WasmFormat.h: move Signature to its own file
+            (JSC::Wasm::CallableFunction::CallableFunction):
+            * wasm/WasmFunctionParser.h:
+            (JSC::Wasm::FunctionParser<Context>::FunctionParser):
+            * wasm/WasmModuleParser.cpp:
+            * wasm/WasmModuleParser.h:
+            (JSC::Wasm::ModuleParser::ModuleParser):
+            * wasm/WasmParser.h:
+            (JSC::Wasm::Parser<SuccessType>::Parser):
+            * wasm/WasmPlan.cpp:
+            (JSC::Wasm::Plan::parseAndValidateModule):
+            (JSC::Wasm::Plan::run):
+            * wasm/WasmSignature.cpp: Added.
+            (JSC::Wasm::Signature::dump):
+            (JSC::Wasm::Signature::hash):
+            (JSC::Wasm::Signature::create):
+            (JSC::Wasm::Signature::createInvalid):
+            (JSC::Wasm::Signature::destroy):
+            (JSC::Wasm::SignatureInformation::~SignatureInformation):
+            (JSC::Wasm::SignatureInformation::adopt):
+            (JSC::Wasm::SignatureInformation::get):
+            * wasm/WasmSignature.h: Added.
+            (JSC::Wasm::Signature::Signature):
+            (JSC::Wasm::Signature::storage):
+            (JSC::Wasm::Signature::allocatedSize):
+            (JSC::Wasm::Signature::returnType):
+            (JSC::Wasm::Signature::returnCount):
+            (JSC::Wasm::Signature::argumentCount):
+            (JSC::Wasm::Signature::argument):
+            (JSC::Wasm::Signature::operator==):
+            (JSC::Wasm::SignatureHash::empty):
+            (JSC::Wasm::SignatureHash::deleted):
+            (JSC::Wasm::SignatureHash::SignatureHash):
+            (JSC::Wasm::SignatureHash::operator==):
+            (JSC::Wasm::SignatureHash::equal):
+            (JSC::Wasm::SignatureHash::hash):
+            (JSC::Wasm::SignatureHash::isHashTableDeletedValue):
+            * wasm/WasmValidate.cpp:
+            (JSC::Wasm::validateFunction):
+            * wasm/WasmValidate.h:
+            * wasm/js/JSWebAssemblyInstance.cpp:
+            (JSC::JSWebAssemblyInstance::create):
+            * wasm/js/JSWebAssemblyModule.h:
+            (JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
+            * wasm/js/JSWebAssemblyTable.cpp:
+            (JSC::JSWebAssemblyTable::JSWebAssemblyTable):
+            (JSC::JSWebAssemblyTable::clearFunction):
+            (JSC::JSWebAssemblyTable::setFunction):
+            * wasm/js/WebAssemblyFunction.cpp:
+            (JSC::callWebAssemblyFunction):
+            (JSC::WebAssemblyFunction::call):
+            (JSC::WebAssemblyFunction::create):
+            (JSC::WebAssemblyFunction::WebAssemblyFunction):
+            (JSC::WebAssemblyFunction::finishCreation):
+            * wasm/js/WebAssemblyFunction.h:
+            (JSC::WebAssemblyFunction::signatureIndex):
+            * wasm/js/WebAssemblyModuleRecord.cpp:
+            (JSC::WebAssemblyModuleRecord::link):
+            (JSC::WebAssemblyModuleRecord::evaluate):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r209979. rdar://problem/29735737
+
+    2016-12-18  Saam Barati  <sbarati@apple.com>
+
+            WebAssembly: Implement the WebAssembly.compile and WebAssembly.validate
+            https://bugs.webkit.org/show_bug.cgi?id=165936
+
+            Reviewed by Mark Lam.
+
+            The APIs are documented here:
+            - https://github.com/WebAssembly/design/blob/master/JS.md#webassemblycompile
+            - https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyvalidate
+
+            * wasm/JSWebAssembly.cpp:
+            (JSC::webAssemblyCompileFunc):
+            (JSC::webAssemblyValidateFunc):
+            (JSC::JSWebAssembly::finishCreation):
+            * wasm/WasmPlan.cpp:
+            (JSC::Wasm::Plan::parseAndValidateModule):
+            (JSC::Wasm::Plan::run):
+            * wasm/WasmPlan.h:
+            * wasm/js/JSWebAssemblyHelpers.h:
+            (JSC::getWasmBufferFromValue):
+            * wasm/js/WebAssemblyModuleConstructor.cpp:
+            (JSC::constructJSWebAssemblyModule):
+            (JSC::callJSWebAssemblyModule):
+            (JSC::WebAssemblyModuleConstructor::createModule):
+            * wasm/js/WebAssemblyModuleConstructor.h:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210359. rdar://problem/29882478
+
+    2017-01-05  Per Arne Vollan  <pvollan@apple.com>
+
+            [Win] Compile error.
+            https://bugs.webkit.org/show_bug.cgi?id=166726
+
+            Reviewed by Alex Christensen.
+
+            Add include folder.
+
+            * CMakeLists.txt:
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r210028. rdar://problem/29747874
+
+    2016-12-20  JF Bastien  <jfbastien@apple.com>
+
+            WebAssembly API: implement WebAssembly.LinkError
+            https://bugs.webkit.org/show_bug.cgi?id=165805
+            <rdar://problem/29747874>
+
+            Reviewed by Mark Lam.
+
+            As described here: https://github.com/WebAssembly/design/pull/901
+            Some TypeError and RangeError are now converted to WebAssembly.LinkError.
+
+            * CMakeLists.txt: add files
+            * DerivedSources.make: add autoget .lut.h files
+            * JavaScriptCore.xcodeproj/project.pbxproj: add files
+            * builtins/BuiltinNames.h: new name LinkError
+            * runtime/JSGlobalObject.h: auto-register LinkError using existing macro magic
+            * wasm/JSWebAssembly.h: make the new includes available
+            * wasm/js/JSWebAssemblyLinkError.cpp: Copied from Source/JavaScriptCore/wasm/JSWebAssemblyCompileError.cpp.
+            (JSC::JSWebAssemblyLinkError::create):
+            (JSC::JSWebAssemblyLinkError::JSWebAssemblyLinkError):
+            (JSC::createWebAssemblyLinkError):
+            * wasm/js/JSWebAssemblyLinkError.h: Copied from Source/JavaScriptCore/wasm/JSWebAssemblyCompileError.h.
+            (JSC::JSWebAssemblyLinkError::create):
+            * wasm/js/WebAssemblyInstanceConstructor.cpp: update as per spec change
+            (JSC::constructJSWebAssemblyInstance):
+            * wasm/js/WebAssemblyLinkErrorConstructor.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyCompileErrorConstructor.cpp.
+            (JSC::constructJSWebAssemblyLinkError):
+            (JSC::callJSWebAssemblyLinkError):
+            (JSC::WebAssemblyLinkErrorConstructor::create):
+            (JSC::WebAssemblyLinkErrorConstructor::createStructure):
+            (JSC::WebAssemblyLinkErrorConstructor::finishCreation):
+            (JSC::WebAssemblyLinkErrorConstructor::WebAssemblyLinkErrorConstructor):
+            (JSC::WebAssemblyLinkErrorConstructor::getConstructData):
+            (JSC::WebAssemblyLinkErrorConstructor::getCallData):
+            * wasm/js/WebAssemblyLinkErrorConstructor.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyCompileErrorConstructor.h.
+            * wasm/js/WebAssemblyLinkErrorPrototype.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyCompileErrorPrototypr.cpp.
+            (JSC::WebAssemblyLinkErrorPrototype::create):
+            (JSC::WebAssemblyLinkErrorPrototype::createStructure):
+            (JSC::WebAssemblyLinkErrorPrototype::finishCreation):
+            (JSC::WebAssemblyLinkErrorPrototype::WebAssemblyLinkErrorPrototype):
+            * wasm/js/WebAssemblyLinkErrorPrototype.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyCompileErrorPrototypr.h.
+            * wasm/js/WebAssemblyModuleRecord.cpp: update as per spec change
+            (JSC::dataSegmentFail):
+            (JSC::WebAssemblyModuleRecord::evaluate):
+
+2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>
+
+        Merge r209998. rdar://problem/29554366
+
+    2016-12-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+            Web Inspector: Assertion seen in InspectorDebuggerAgent::refAsyncCallData with Inspector open
+            https://bugs.webkit.org/show_bug.cgi?id=166034
+            <rdar://problem/29554366>
+
+            Reviewed by Brian Burg.
+
+            * inspector/agents/InspectorDebuggerAgent.cpp:
+            (Inspector::InspectorDebuggerAgent::refAsyncCallData):
+            Remove assertion. This assert can happen if the currently executing callback
+            was just explicitly cancelled by script. Existing code already handles if
+            no async data was found for the given identifier.
+
+2016-12-19  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r210010.
+
+    2016-12-19  Mark Lam  <mark.lam@apple.com>
+
+            Rolling out r209974 and r209952. They break some websites in mysterious ways. Step 2: Rollout r209952.
+            https://bugs.webkit.org/show_bug.cgi?id=166049
+
+            Not reviewed.
+
+            * bytecode/HandlerInfo.h:
+            (JSC::HandlerInfoBase::typeName):
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::generate):
+            (JSC::BytecodeGenerator::BytecodeGenerator):
+            (JSC::BytecodeGenerator::emitReturn):
+            (JSC::BytecodeGenerator::pushFinallyControlFlowScope):
+            (JSC::BytecodeGenerator::pushIteratorCloseControlFlowScope):
+            (JSC::BytecodeGenerator::popFinallyControlFlowScope):
+            (JSC::BytecodeGenerator::popIteratorCloseControlFlowScope):
+            (JSC::BytecodeGenerator::emitComplexPopScopes):
+            (JSC::BytecodeGenerator::emitPopScopes):
+            (JSC::BytecodeGenerator::pushTry):
+            (JSC::BytecodeGenerator::popTryAndEmitCatch):
+            (JSC::BytecodeGenerator::labelScopeDepth):
+            (JSC::BytecodeGenerator::pushLocalControlFlowScope):
+            (JSC::BytecodeGenerator::popLocalControlFlowScope):
+            (JSC::BytecodeGenerator::emitEnumeration):
+            (JSC::BytecodeGenerator::emitYield):
+            (JSC::BytecodeGenerator::emitDelegateYield):
+            (JSC::BytecodeGenerator::popTry): Deleted.
+            (JSC::BytecodeGenerator::emitCatch): Deleted.
+            (JSC::BytecodeGenerator::restoreScopeRegister): Deleted.
+            (JSC::BytecodeGenerator::labelScopeDepthToLexicalScopeIndex): Deleted.
+            (JSC::BytecodeGenerator::emitIsNumber): Deleted.
+            (JSC::BytecodeGenerator::emitJumpViaFinallyIfNeeded): Deleted.
+            (JSC::BytecodeGenerator::emitReturnViaFinallyIfNeeded): Deleted.
+            (JSC::BytecodeGenerator::emitFinallyCompletion): Deleted.
+            (JSC::BytecodeGenerator::allocateFinallyRegisters): Deleted.
+            (JSC::BytecodeGenerator::releaseFinallyRegisters): Deleted.
+            (JSC::BytecodeGenerator::emitCompareFinallyActionAndJumpIf): Deleted.
+            * bytecompiler/BytecodeGenerator.h:
+            (JSC::BytecodeGenerator::isInFinallyBlock):
+            (JSC::FinallyJump::FinallyJump): Deleted.
+            (JSC::FinallyContext::FinallyContext): Deleted.
+            (JSC::FinallyContext::outerContext): Deleted.
+            (JSC::FinallyContext::finallyLabel): Deleted.
+            (JSC::FinallyContext::depth): Deleted.
+            (JSC::FinallyContext::numberOfBreaksOrContinues): Deleted.
+            (JSC::FinallyContext::incNumberOfBreaksOrContinues): Deleted.
+            (JSC::FinallyContext::handlesReturns): Deleted.
+            (JSC::FinallyContext::setHandlesReturns): Deleted.
+            (JSC::FinallyContext::registerJump): Deleted.
+            (JSC::FinallyContext::numberOfJumps): Deleted.
+            (JSC::FinallyContext::jumps): Deleted.
+            (JSC::ControlFlowScope::ControlFlowScope): Deleted.
+            (JSC::ControlFlowScope::isLabelScope): Deleted.
+            (JSC::ControlFlowScope::isFinallyScope): Deleted.
+            (JSC::BytecodeGenerator::currentLexicalScopeIndex): Deleted.
+            (JSC::BytecodeGenerator::FinallyRegistersScope::FinallyRegistersScope): Deleted.
+            (JSC::BytecodeGenerator::FinallyRegistersScope::~FinallyRegistersScope): Deleted.
+            (JSC::BytecodeGenerator::finallyActionRegister): Deleted.
+            (JSC::BytecodeGenerator::finallyReturnValueRegister): Deleted.
+            (JSC::BytecodeGenerator::emitSetFinallyActionToNormalCompletion): Deleted.
+            (JSC::BytecodeGenerator::emitSetFinallyActionToReturnCompletion): Deleted.
+            (JSC::BytecodeGenerator::emitSetFinallyActionToJumpID): Deleted.
+            (JSC::BytecodeGenerator::emitSetFinallyReturnValueRegister): Deleted.
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNormalCompletion): Deleted.
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotJump): Deleted.
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsReturnCompletion): Deleted.
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotReturnCompletion): Deleted.
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotThrowCompletion): Deleted.
+            (JSC::BytecodeGenerator::emitJumpIfCompletionTypeIsThrow): Deleted.
+            (JSC::BytecodeGenerator::bytecodeOffsetToJumpID): Deleted.
+            * bytecompiler/NodesCodegen.cpp:
+            (JSC::ContinueNode::emitBytecode):
+            (JSC::BreakNode::emitBytecode):
+            (JSC::ReturnNode::emitBytecode):
+            (JSC::TryNode::emitBytecode):
+
+2016-12-19  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r210007.
+
+    2016-12-19  Mark Lam  <mark.lam@apple.com>
+
+            Rolling out r209974 and r209952. They break some websites in mysterious ways. Step 1: Rollout r209974.
+            https://bugs.webkit.org/show_bug.cgi?id=166049
+
+            Not reviewed.
+
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::emitEnumeration):
+            (JSC::BytecodeGenerator::emitJumpViaFinallyIfNeeded):
+            (JSC::BytecodeGenerator::emitReturnViaFinallyIfNeeded):
+            (JSC::BytecodeGenerator::emitFinallyCompletion):
+            (JSC::BytecodeGenerator::allocateFinallyRegisters):
+            (JSC::BytecodeGenerator::releaseFinallyRegisters):
+            (JSC::BytecodeGenerator::emitCompareFinallyActionAndJumpIf):
+            (JSC::BytecodeGenerator::allocateCompletionRecordRegisters): Deleted.
+            (JSC::BytecodeGenerator::releaseCompletionRecordRegisters): Deleted.
+            (JSC::BytecodeGenerator::emitJumpIfCompletionType): Deleted.
+            * bytecompiler/BytecodeGenerator.h:
+            (JSC::FinallyJump::FinallyJump):
+            (JSC::FinallyContext::registerJump):
+            (JSC::BytecodeGenerator::FinallyRegistersScope::FinallyRegistersScope):
+            (JSC::BytecodeGenerator::FinallyRegistersScope::~FinallyRegistersScope):
+            (JSC::BytecodeGenerator::finallyActionRegister):
+            (JSC::BytecodeGenerator::finallyReturnValueRegister):
+            (JSC::BytecodeGenerator::emitSetFinallyActionToNormalCompletion):
+            (JSC::BytecodeGenerator::emitSetFinallyActionToReturnCompletion):
+            (JSC::BytecodeGenerator::emitSetFinallyActionToJumpID):
+            (JSC::BytecodeGenerator::emitSetFinallyReturnValueRegister):
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNormalCompletion):
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotJump):
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsReturnCompletion):
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotReturnCompletion):
+            (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotThrowCompletion):
+            (JSC::BytecodeGenerator::emitJumpIfCompletionTypeIsThrow):
+            (JSC::BytecodeGenerator::bytecodeOffsetToJumpID):
+            (JSC::bytecodeOffsetToJumpID): Deleted.
+            (JSC::BytecodeGenerator::CompletionRecordScope::CompletionRecordScope): Deleted.
+            (JSC::BytecodeGenerator::CompletionRecordScope::~CompletionRecordScope): Deleted.
+            (JSC::BytecodeGenerator::completionTypeRegister): Deleted.
+            (JSC::BytecodeGenerator::completionValueRegister): Deleted.
+            (JSC::BytecodeGenerator::emitSetCompletionType): Deleted.
+            (JSC::BytecodeGenerator::emitSetCompletionValue): Deleted.
+            * bytecompiler/NodesCodegen.cpp:
+            (JSC::TryNode::emitBytecode):
+
+2016-12-19  Dean Jackson  <dino@apple.com>
+
+        Merge another patch for rdar://problem/29466493.
+
+    2016-12-19  Dean Jackson  <dino@apple.com>
+
+            Disable some features on the safari-603-branch.
+            <rdar://problem/29466493>
+
+            * Configurations/FeatureDefines.xcconfig:
+
+2016-12-19  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge patch for rdar://problem/29466493.
+
+    2016-12-19  Dean Jackson  <dino@apple.com>
+
+            Disable some features on the safari-603-branch.
+            <rdar://problem/29466493>
+
+            - Force the default state of experimental features to off.
+            - Move some experimental features that should be enabled on this
+              branch into the general feature list, so they can't be disabled.
+            - Disable some features that are not ready.
+
+            * Configurations/FeatureDefines.xcconfig:
+
+2016-12-18  Mark Lam  <mark.lam@apple.com>
+
+        Rename finallyActionRegister to completionTypeRegister and only store int JSValues in it.
+        https://bugs.webkit.org/show_bug.cgi?id=165979
+
+        Reviewed by Saam Barati.
+
+        This patch makes it so that we only store int JSValues in the finallyActionRegister
+        thereby making type prediction on this register more successful for JITs.  In so
+        doing, we are able to get some additional benefits:
+
+        1. Renamed the following:
+           FinallyRegistersScope => CompletionRecordScope
+           finallyActionRegister => completionTypeRegister
+           finallyReturnValueRegister => completionValueRegister
+
+           These new names are more in line with the ES spec, which describes these
+           values as the completion record and its type and value properties.
+           https://tc39.github.io/ecma262/#sec-completion-record-specification-type
+
+        2. We now think of the Break and Continue jumpIDs as encodings of CompletionType
+           (in our implementation of completion type).  As a result, we only need one of
+           each of the emitter methods for getting, setting, and compare-and-jump on the
+           completion type.  The code using these methods also reads much clearer now.  
+
+        3. Finally blocks' op_catch should now always pop the caught Exception object into
+           the completionValueRegister instead of the completionTypeRegister (formerly
+           finallyActionRegister). 
+
+        Also removed the restoreScopeRegister() call in the IteratorClose catch block
+        because that is an implementation specific synthesized catch block, and we
+        can guarantee that it never needs to resolve any symbols from the scope.  Hence,
+        there is no need to restore the scope register.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::emitJumpViaFinallyIfNeeded):
+        (JSC::BytecodeGenerator::emitReturnViaFinallyIfNeeded):
+        (JSC::BytecodeGenerator::emitFinallyCompletion):
+        (JSC::BytecodeGenerator::allocateCompletionRecordRegisters):
+        (JSC::BytecodeGenerator::releaseCompletionRecordRegisters):
+        (JSC::BytecodeGenerator::emitJumpIfCompletionType):
+        (JSC::BytecodeGenerator::allocateFinallyRegisters): Deleted.
+        (JSC::BytecodeGenerator::releaseFinallyRegisters): Deleted.
+        (JSC::BytecodeGenerator::emitCompareFinallyActionAndJumpIf): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::bytecodeOffsetToJumpID):
+        (JSC::FinallyJump::FinallyJump):
+        (JSC::FinallyContext::registerJump):
+        (JSC::BytecodeGenerator::CompletionRecordScope::CompletionRecordScope):
+        (JSC::BytecodeGenerator::CompletionRecordScope::~CompletionRecordScope):
+        (JSC::BytecodeGenerator::completionTypeRegister):
+        (JSC::BytecodeGenerator::completionValueRegister):
+        (JSC::BytecodeGenerator::emitSetCompletionType):
+        (JSC::BytecodeGenerator::emitSetCompletionValue):
+        (JSC::BytecodeGenerator::FinallyRegistersScope::FinallyRegistersScope): Deleted.
+        (JSC::BytecodeGenerator::FinallyRegistersScope::~FinallyRegistersScope): Deleted.
+        (JSC::BytecodeGenerator::finallyActionRegister): Deleted.
+        (JSC::BytecodeGenerator::finallyReturnValueRegister): Deleted.
+        (JSC::BytecodeGenerator::emitSetFinallyActionToNormalCompletion): Deleted.
+        (JSC::BytecodeGenerator::emitSetFinallyActionToReturnCompletion): Deleted.
+        (JSC::BytecodeGenerator::emitSetFinallyActionToJumpID): Deleted.
+        (JSC::BytecodeGenerator::emitSetFinallyReturnValueRegister): Deleted.
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNormalCompletion): Deleted.
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotJump): Deleted.
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsReturnCompletion): Deleted.
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotReturnCompletion): Deleted.
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotThrowCompletion): Deleted.
+        (JSC::BytecodeGenerator::emitJumpIfCompletionTypeIsThrow): Deleted.
+        (JSC::BytecodeGenerator::bytecodeOffsetToJumpID): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+
+2016-12-17  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly: WasmB3IRGenerator uses WarmAny as a ValueRep but expects the incoming value to be a register
+        https://bugs.webkit.org/show_bug.cgi?id=165989
+
+        Reviewed by Mark Lam.
+
+        The input should be constrained to a register to match what
+        the patchpoint code expects.
+
+        * wasm/WasmB3IRGenerator.cpp:
+
+2016-12-17  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly: Change a RELEASE_ASSERT_NOT_REACHED to a jit.breakpoint() for now to allow us to run some wasm benchmarks
+        https://bugs.webkit.org/show_bug.cgi?id=165990
+
+        Reviewed by Mark Lam.
+
+        * wasm/WasmBinding.cpp:
+        (JSC::Wasm::importStubGenerator):
+
+2016-12-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSContext Inspector: Avoid some possible exceptions inspecting a JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=165986
+        <rdar://problem/29551379>
+
+        Reviewed by Matt Baker.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype.processProperties):
+        Prefer String.prototype.endsWith now that it is available.
+
+        (InjectedScript.prototype._describe):
+        Prefer Function.prototype.toString for converting functions to String.
+        Previously we were doing String(f) which would to Symbol.toPrimitive
+        conversion which seems unnecessary here.
+
+2016-12-16  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        Unreviewed, fix GCC 6 build failure after r209952
+
+        Return false, not nullptr, in function returning bool.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpViaFinallyIfNeeded):
+
+2016-12-16  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly: We still have some incorrect parsing productions inside unreachable code
+        https://bugs.webkit.org/show_bug.cgi?id=165981
+
+        Reviewed by Keith Miller.
+
+        This hardens our parsing for CallIndirect and Loop/Block/If to be exactly like their reachable variant.
+        
+        It also fixes a more nefarious bug in which we were decoding an extra varuint32
+        for Br/BrIf inside unreachable code.
+
+        * wasm/WasmFunctionParser.h:
+
+2016-12-16  Filip Pizlo  <fpizlo@apple.com>
+
+        CellState should have members with accurate names
+        https://bugs.webkit.org/show_bug.cgi?id=165969
+
+        Reviewed by Mark Lam.
+        
+        This once again renames the members in CellState. I wanted to convey the following
+        pieces of information in the names:
+        
+        - What does the state mean for Generational GC?
+        - What does the state mean for Concurrent GC?
+        - Does the state guarantee what it means, or is there some contingency?
+        
+        The names I came up with are:
+        
+        PossiblyOldOrBlack: An object in this state may be old, or may be black, depending on
+            other things. If the mark bit is set then the object is either black or being
+            blackened as we speak. It's going to survive the GC, so it will be old, but may be
+            new now. In between GCs, objects in this state are definitely old. If the mark bit
+            is not set, then the object is actually old and white.
+        
+        DefinitelyNewAndWhite: The object was just allocated so it is white (not marked) and
+            new.
+        
+        DefinitelyGrey: The object is definitely grey - it will be rescanned in the future. It
+            may be new or old depending on other things.
+
+        * heap/CellState.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::writeBarrierSlowPath):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::visitChildren):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::JSCell):
+        * runtime/StructureIDBlob.h:
+        (JSC::StructureIDBlob::StructureIDBlob):
+
+2016-12-16  Saam Barati  <sbarati@apple.com>
+
+        B3::DoubleToFloatReduction will accidentally convince itself it converted a Phi from Double to Float and then convert uses of that Phi into a use of FloatToDouble(@Phi)
+        https://bugs.webkit.org/show_bug.cgi?id=165946
+
+        Reviewed by Keith Miller.
+
+        This was happening because the phase will convert some Phi nodes
+        from Double to Float. However, one place that did this conversion
+        forgot to first check if the Phi was already a Float. If it's already
+        a Float, a later part of the phase will be buggy if the phase claims that it has
+        converted it from Double->Float. The reason is that at the end of the
+        phase, we'll look for all uses of former Double Phi nodes and make them
+        be a use of ConvertFloatToDouble on the Phi, instead of a use of the Phi itself.
+        This is clearly wrong if the Phi were Float to begin with (and
+        therefore, the uses were Float uses to begin with).
+
+        * b3/B3ReduceDoubleToFloat.cpp:
+        * b3/testb3.cpp:
+        (JSC::B3::testReduceFloatToDoubleValidates):
+        (JSC::B3::run):
+
+2016-12-16  Mark Lam  <mark.lam@apple.com>
+
+        De-duplicate finally blocks.
+        https://bugs.webkit.org/show_bug.cgi?id=160168
+
+        Reviewed by Keith Miller.
+
+        JS execution can arrive at a finally block when there are abrupt completions from
+        its try or catch block.  The abrupt completion types include Break,
+        Continue, Return, and Throw.  The non-abrupt completion type is called Normal
+        (i.e. the case of a try block falling through to the finally block).
+
+        Previously, we enable each of these paths for abrupt completion (except for Throw)
+        to run the finally block code by duplicating the finally block code at each of
+        the sites that trigger those completions.  This patch fixes the implementation so
+        that each of these abrupt completions will set a finallyActionRegister (plus a
+        finallyReturnValueRegister for CompletionType::Return) and then jump to the
+        relevant finally blocks, and continue to thread through subsequent outer finally
+        blocks until execution reaches the outermost finally block that the completion
+        type dictates.  We no longer duplicate the finally block code.
+
+        The implementation details:
+        1. We allocate a pair of finallyActionRegister and finallyReturnValueRegister
+           just before entering the outermost try-catch-finally scope.
+
+           On allocating the registers, we set them to the empty JSValue.  This serves
+           to set the completion type to CompletionType::Normal (see (2) below).
+
+        2. The finallyActionRegister serves 2 purpose:
+           a. indicates the CompletionType that triggered entry into the finally block.
+
+              This is how we encode the completion type in the finallyActionRegister:
+              1. CompletionType::Normal
+                 - finallyActionRegister is set to the empty JSValue.
+              2. CompletionType::Break
+                 - finallyActionRegister is set to the int jumpID for the site of the break statement.
+              3. CompletionType::Continue
+                 - finallyActionRegister is set to the int jumpID for the site of the continue statement.
+              4. CompletionType::Return
+                 - finallyActionRegister is set to CompletionType::Return as an int JSValue.
+                 - finallyReturnValueRegister is set to the value to be returned. 
+              5. CompletionType::Throw
+                 - finallyActionRegister is set to the exception object that was caught by the finally block.
+
+              Hence, if the finallyActionRegister can either be:
+              1. empty i.e. we're handling CompletionType::Normal.
+              2. an int JSValue i.e. we're handling CompletionType::Break, Continue, or Return.
+              3. an object i.e. we're handling CompletionType::Throw.
+
+           b. stores the exception caught in the finally block if we're handing
+              CompletionType::Throw.
+
+        3. Each finally block will have 2 entries:
+           a. the entry via throw.
+           b. the normal entry.
+
+           The entry via throw is recorded in the codeBlock's exception table, and can
+           only be jumped to by the VM's exception handling mechanism.
+
+           The normal entry is recorded in a FinallyContext (at bytecode generation time
+           only) and is jumped to when we want enter the finally block due any of the
+           other CompletionTypes.
+
+        4. CompletionType::Normal
+           ======================
+           We encounter this when falling through from a try or catch block to the finally block.  
+           
+           For the try block case, since finallyActionRegister is set to Normal by default,
+           there's nothing more that needs to be done.
+
+           For the catch block case, since we entered the catch block with an exception,
+           finallyActionRegister may be set to Throw.  We'll need to set it to Normal
+           before jumping to the finally block's normal entry.
+
+           CompletionType::Break
+           =====================
+           When we emit bytecode for the BreakNode, we check if we have any FinallyContexts
+           that we need to service before jumping to the breakTarget.  If we do, then:
+           a. we'll register a jumpID along with the breakTarget with the outermost FinallyContext.
+           b. we'll also increment the numberOfBreaksOrContinues count in each FinallyContext
+              from the innermost to the outermost.
+           c. instead of emitting bytecode to jump to the breakTarget, we:
+              1. emit bytecode to set finallyActionRegister to the jumpID.
+              b. emit bytecode to jump to the normal entry of the innermost finally block.
+
+           Each finally block will take care of cascading to the next outer finally block
+           as needed (see (5) below).
+
+           CompletionType::Continue
+           ========================
+           Since continues and breaks work the same way (i.e. with a jump), we handle this
+           exactly the same way as CompletionType::Break, except that we use the
+           continueTarget instead of the breakTarget.
+
+           CompletionType::Return
+           ======================
+           When we emit bytecode for the ReturnNode, we check if we have any FinallyContexts
+           at all on the m_controlFlowScopeStack.
+
+           If so, then instead of emitting op_ret, we:
+              1. emit bytecode to set finallyActionRegister to the CompletionType::Return.
+              1. emit bytecode to move the return value into finallyReturnValueRegister.
+              2. emit bytecode to jump to the normal entry of the innermost finally block.
+
+           Each finally block will take care of cascading to the next outer finally block
+           as needed (see (5) below).
+
+           CompletionType::Throw
+           ======================
+           The op_catch of a finally block will always store the caught exception object
+           in the finallyActionRegister.  This means we're handling CompletionType::Throw
+           (see (2) above).
+
+        5. What happens in each finally block?
+           ==================================
+           Only the finally block's entry via throw will have an op_catch that catches the
+           pending exception (and stores it in the finallyActionRegister).  This throw
+           entry then falls through to the normal entry.
+
+           The finally block's normal entry will restore the scope of the finally block
+           and proceed to execute its code.
+
+           At the end of the finally block (see emitFinallyCompletion()), the finally
+           block will check the finallyActionRegister for each completion type in the
+           following order:
+           
+           a. CompletionType::Normal: jump to the code after the finally block as
+              designated by a normalCompletion label.
+
+           b. CompletionType::Break and Continue:
+              If the FinallyContext for this block has registered FinallyJumps, we'll
+              check for the jumpIDs against the finallyActionRegister.  If the jumpID
+              matches, jump to the corresponding jumpTarget.
+
+              If no jumpIDs match but the FinallyContext's numberOfBreaksOrContinues is
+              greater than the number of registered FinallyJumps, then this means that
+              we have a Break or Continue that needs to be handled by an outer finally
+              block.  In that case, jump to the outer finally block's normal entry.
+              
+           c. CompletionType::Return:
+              If this finally block is not the outermost and finallyActionRegister contains
+              CompletionType::Return, then jump to the outer finally block's normal entry.
+
+              Otherwise, if this finally block is the outermost and finallyActionRegister
+              contains CompletionType::Return, then execute op_ret and return the value
+              in finallyReturnValueRegister.
+
+           d. CompletionType::Throw:
+              If we're not handling any of the above cases, then just throw the
+              finallyActionRegister which contains the exception to re-throw.
+
+        6. restoreScopeRegister()
+        
+           Since the needed scope objects are always stored in a local, we can restore
+           the scope register by simply moving from that local instead of going through
+           op_get_parent_scope.
+
+        7. m_controlFlowScopeStack needs to be a SegmentedVector instead of a Vector.
+           This makes it easier to keep a pointer to the FinallyContext on that stack,
+           and not have to worry about the vector being realloc'ed due to resizing. 
+
+        Performance appears to be neutral both on ES6SampleBench (run via cli) and the
+        JSC benchmarks.
+
+        Relevant spec references:
+        https://tc39.github.io/ecma262/#sec-completion-record-specification-type
+        https://tc39.github.io/ecma262/#sec-try-statement-runtime-semantics-evaluation
+
+        * bytecode/HandlerInfo.h:
+        (JSC::HandlerInfoBase::typeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::pushFinallyControlFlowScope):
+        (JSC::BytecodeGenerator::popFinallyControlFlowScope):
+        (JSC::BytecodeGenerator::allocateAndEmitScope):
+        (JSC::BytecodeGenerator::pushTry):
+        (JSC::BytecodeGenerator::popTry):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::restoreScopeRegister):
+        (JSC::BytecodeGenerator::labelScopeDepthToLexicalScopeIndex):
+        (JSC::BytecodeGenerator::labelScopeDepth):
+        (JSC::BytecodeGenerator::pushLocalControlFlowScope):
+        (JSC::BytecodeGenerator::popLocalControlFlowScope):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::emitIsNumber):
+        (JSC::BytecodeGenerator::emitYield):
+        (JSC::BytecodeGenerator::emitDelegateYield):
+        (JSC::BytecodeGenerator::emitJumpViaFinallyIfNeeded):
+        (JSC::BytecodeGenerator::emitReturnViaFinallyIfNeeded):
+        (JSC::BytecodeGenerator::emitFinallyCompletion):
+        (JSC::BytecodeGenerator::allocateFinallyRegisters):
+        (JSC::BytecodeGenerator::releaseFinallyRegisters):
+        (JSC::BytecodeGenerator::emitCompareFinallyActionAndJumpIf):
+        (JSC::BytecodeGenerator::pushIteratorCloseControlFlowScope): Deleted.
+        (JSC::BytecodeGenerator::popIteratorCloseControlFlowScope): Deleted.
+        (JSC::BytecodeGenerator::emitComplexPopScopes): Deleted.
+        (JSC::BytecodeGenerator::emitPopScopes): Deleted.
+        (JSC::BytecodeGenerator::popTryAndEmitCatch): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::FinallyJump::FinallyJump):
+        (JSC::FinallyContext::FinallyContext):
+        (JSC::FinallyContext::outerContext):
+        (JSC::FinallyContext::finallyLabel):
+        (JSC::FinallyContext::depth):
+        (JSC::FinallyContext::numberOfBreaksOrContinues):
+        (JSC::FinallyContext::incNumberOfBreaksOrContinues):
+        (JSC::FinallyContext::handlesReturns):
+        (JSC::FinallyContext::setHandlesReturns):
+        (JSC::FinallyContext::registerJump):
+        (JSC::FinallyContext::numberOfJumps):
+        (JSC::FinallyContext::jumps):
+        (JSC::ControlFlowScope::ControlFlowScope):
+        (JSC::ControlFlowScope::isLabelScope):
+        (JSC::ControlFlowScope::isFinallyScope):
+        (JSC::BytecodeGenerator::currentLexicalScopeIndex):
+        (JSC::BytecodeGenerator::FinallyRegistersScope::FinallyRegistersScope):
+        (JSC::BytecodeGenerator::FinallyRegistersScope::~FinallyRegistersScope):
+        (JSC::BytecodeGenerator::finallyActionRegister):
+        (JSC::BytecodeGenerator::finallyReturnValueRegister):
+        (JSC::BytecodeGenerator::emitSetFinallyActionToNormalCompletion):
+        (JSC::BytecodeGenerator::emitSetFinallyActionToReturnCompletion):
+        (JSC::BytecodeGenerator::emitSetFinallyActionToJumpID):
+        (JSC::BytecodeGenerator::emitSetFinallyReturnValueRegister):
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNormalCompletion):
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotJump):
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsReturnCompletion):
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotReturnCompletion):
+        (JSC::BytecodeGenerator::emitJumpIfFinallyActionIsNotThrowCompletion):
+        (JSC::BytecodeGenerator::emitJumpIfCompletionTypeIsThrow):
+        (JSC::BytecodeGenerator::bytecodeOffsetToJumpID):
+        (JSC::BytecodeGenerator::isInFinallyBlock): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+
+2016-12-16  Keith Miller  <keith_miller@apple.com>
+
+        Add missing cases to parseUnreachableExpression and cleanup FunctionParser
+        https://bugs.webkit.org/show_bug.cgi?id=165966
+
+        Reviewed by Saam Barati.
+
+        This patch adds a number of missing cases to the Wasm FunctionParser's unreachable
+        code decoder. It also, removes unneeded OpType namespaces where they were not
+        needed and has the unary / binary macros cover all the cases rather than
+        just the simple cases.
+
+        * wasm/WasmFunctionParser.h:
+
+2016-12-16  Mark Lam  <mark.lam@apple.com>
+
+        Add predecessor info to dumps from JSC_dumpBytecodeLivenessResults=true.
+        https://bugs.webkit.org/show_bug.cgi?id=165958
+
+        Reviewed by Saam Barati.
+
+        Also:
+        1. refactored the code to use a common lambda function to dump FastBitVectors.
+        2. list successors by their block index instead of pointers.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::BytecodeLivenessAnalysis::dumpResults):
+
+2016-12-16  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly: WasmB3IRGenerator should throw exceptions instead of crash
+        https://bugs.webkit.org/show_bug.cgi?id=165834
+
+        Reviewed by Keith Miller.
+
+        This patch generalizes how we throw exceptions in the Wasm::B3IRGenerator.
+        There are still places where we need to throw exceptions and we don't, but
+        this patch removes most of those places inside the IR generator. There are
+        still a few places we need to throw exceptions inside the IR generator, like
+        div/mod by 0. Those will be done in a separate patch. Also, there are
+        still some stubs we need to throw exceptions from; those will also be
+        done in a separate patch.
+
+        All exceptions thrown from Wasm share a common stub. The ABI for the stub
+        is to move the Wasm::ExceptionType into argGPR1 and jump to the stub.
+        The stub will then throw an exception with an error message tailored
+        to the particular Wasm::ExceptionType failure.
+
+        This patch also refactors B3::Compilation. Before, B3::Compilation(VM, Procedure)
+        constructor would compile a B3 function. This patch makes B3::Compilation a simple 
+        tuple that keeps the necessary bits of B3 function alive in order to be runnable.
+        There is a new function that actually does the compilation for you. It is:
+        Compilation B3::compile(VM&, Procedure&)
+        The reason for this change is that I'm now using B3::Compilation(CodeRef, OpaqueByproducts)
+        constructor in Wasm code. It is weird to have a class both have a
+        constructor that instantiates the tuple, and another that performs the
+        compilation and then instantiates the tuple. It's more straight
+        forward if Compilation's job wasn't to actually do the compilation
+        but just to hold the necessary bits to keep a compiled B3 alive.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Compilation.cpp:
+        (JSC::B3::Compilation::Compilation):
+        * b3/B3Compilation.h:
+        * b3/B3Compile.cpp: Added.
+        (JSC::B3::compile):
+        * b3/B3Compile.h: Added.
+        * b3/testb3.cpp:
+        (JSC::B3::compile):
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromWasmThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::B3IRGenerator::emitExceptionCheck):
+        (JSC::Wasm::createJSToWasmWrapper):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmExceptionType.h: Added.
+        (JSC::Wasm::errorMessageForExceptionType):
+
+2016-12-16  Keith Miller  <keith_miller@apple.com>
+
+        i64.eqz should use an Int64 zero
+        https://bugs.webkit.org/show_bug.cgi?id=165942
+
+        Reviewed by Mark Lam.
+
+        This patch fixes i64.eqz, which was using an Int32 zero
+        for the comparison previously. This patch also, adds
+        printing opcodes names in verbose mode.
+
+        * wasm/WasmFunctionParser.h:
+        * wasm/generateWasmOpsHeader.py:
+        * wasm/wasm.json:
+
+2016-12-15  Darin Adler  <darin@apple.com>
+
+        Use asString instead of toWTFString, toString, or getString when we already checked isString
+        https://bugs.webkit.org/show_bug.cgi?id=165895
+
+        Reviewed by Yusuke Suzuki.
+
+        Once we have called isString, we should always use asString and value rather than using
+        functions that have to deal with non-JSString objects. This leads to slightly fewer branches,
+        slightly less reference count churn, since the string is stored right inside the JSString,
+        and obviates the need for exception handling.
+
+        * bindings/ScriptValue.cpp:
+        (Inspector::jsToInspectorValue): Use asString/value instead of getString.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationMapHash): Call jsMapHash with its new arguments.
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension): Use asString/value instead
+        of toWTFString.
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension): Ditto.
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::getPreview): Use asString/tryGetValue, instead of the
+        peculiar getString(nullptr) that was here before.
+        * jsc.cpp:
+        (functionGetGetterSetter): Use asString/toIdentifier instead of the much less efficient
+        toWTFString/Identifier::fromString.
+        (functionIsRope): Use asString instead of jsCast<JSString*>; same thing, but we should
+        prefer the asString function, since it exists.
+        (functionFindTypeForExpression): Use asString/value instead of getString.
+        (functionHasBasicBlockExecuted): Ditto.
+        (functionBasicBlockExecutionCount): Ditto.
+        (functionCreateBuiltin): Use asString/value instead of toWTFString and removed
+        unneeded RETURN_IF_EXCEPTION.
+        (valueWithTypeOfWasmValue): Use asString instead of jsCast<String*>.
+        (box): Ditto.
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate): Use asString/values instead of getString.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue): Tweaked formatting.
+
+        * runtime/HashMapImpl.h:
+        (JSC::jsMapHash): Changed this function to use asString/value.
+
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContextAssumingStructure): Use asString instead of
+        jsCast<JSString*>.
+        (JSC::JSValue::dumpForBacktrace): Ditto.
+        * runtime/JSCJSValueInlines.h:
+        (JSC::toPreferredPrimitiveType): Ditto.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval): Use asString/value instead of toWTFString.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::destroy): Streamlined by removing local variable.
+        (JSC::JSString::estimatedSize): Use asString instead of jsCast<JSString*>.
+        (JSC::JSString::visitChildren): Ditto.
+        (JSC::JSString::toThis): Ditto.
+        * runtime/JSString.h:
+        (JSC::JSValue::toString): Ditto.
+        (JSC::JSValue::toStringOrNull): Ditto.
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncValueOf): Ditto.
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString): Ditto.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncRepeatCharacter): Ditto.
+        (JSC::stringProtoFuncSubstr): Ditto.
+        (JSC::builtinStringSubstrInternal): Simplified assertion by removing local variable.
+
+2016-12-15  Keith Miller  <keith_miller@apple.com>
+
+        Fix validation of non-void if blocks with no else
+        https://bugs.webkit.org/show_bug.cgi?id=165938
+
+        Reviewed by Saam Barati.
+
+        We should not have been allowing non-void if-blocks that don't
+        have an else. Since this causes a value to be placed on the
+        stack that only appears under some control flow and not another.
+
+        * wasm/WasmValidate.cpp:
+
+2016-12-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of HeapRootVisitor and make SlotVisitor less painful to use
+        https://bugs.webkit.org/show_bug.cgi?id=165911
+
+        Reviewed by Geoffrey Garen.
+        
+        Previously we had two ways of adding a raw pointer to the GC's mark stack:
+        
+        - SlotVisitor::appendUnbarrieredXYZ() methods
+        - HeapRootVisitor::visit() methods
+        
+        HeapRootVisitor existed only to prevent you from calling its non-WriteBarrier<> methods
+        unless you had permission. But SlotVisitor would let you do it anyway, because that was
+        a lot more practical.
+        
+        I think that we should just have one way to do it. This removes HeapRootVisitor. It
+        also renames appendUnbarrieredXYZ to appendUnbarriered, and it removes the use of extra
+        indirection (so you now pass const WriteBarrier<>& instead of WriteBarrier<>*).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Scripts/builtins/builtins_templates.py:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitWeakly):
+        (JSC::CodeBlock::visitChildren):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::determineLiveness):
+        (JSC::CodeBlock::visitOSRExitTargets):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC::CodeBlock::stronglyVisitWeakReferences):
+        * bytecode/DirectEvalCodeCache.cpp:
+        (JSC::DirectEvalCodeCache::visitAggregate):
+        * bytecode/InternalFunctionAllocationProfile.h:
+        (JSC::InternalFunctionAllocationProfile::visitAggregate):
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::visitAggregate):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::propagateTransitions):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::visitChildren):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::visitChildren):
+        * dfg/DFGDesiredTransitions.cpp:
+        (JSC::DFG::DesiredTransition::visitChildren):
+        * dfg/DFGDesiredWeakReferences.cpp:
+        (JSC::DFG::DesiredWeakReferences::visitChildren):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::visitChildren):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::markCodeBlocks):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        * heap/HandleSet.cpp:
+        (JSC::HandleSet::visitStrongHandles):
+        * heap/HandleSet.h:
+        * heap/HandleStack.cpp:
+        (JSC::HandleStack::visit):
+        * heap/HandleStack.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markToFixpoint):
+        * heap/Heap.h:
+        * heap/HeapRootVisitor.h: Removed.
+        * heap/LargeAllocation.cpp:
+        (JSC::LargeAllocation::visitWeakSet):
+        * heap/LargeAllocation.h:
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::Handle::visitWeakSet):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::visitWeakSets):
+        * heap/MarkedSpace.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendUnbarriered):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::appendUnbarriered):
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::appendHidden):
+        (JSC::SlotVisitor::appendValues):
+        (JSC::SlotVisitor::appendValuesHidden):
+        (JSC::SlotVisitor::appendUnbarrieredPointer): Deleted.
+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyPointer): Deleted.
+        (JSC::SlotVisitor::appendUnbarrieredValue): Deleted.
+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyValue): Deleted.
+        (JSC::SlotVisitor::appendUnbarrieredWeak): Deleted.
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::specializedVisit):
+        (JSC::WeakBlock::visit):
+        * heap/WeakBlock.h:
+        * heap/WeakSet.h:
+        (JSC::WeakSet::visit):
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::visitChildren):
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::MarkingGCAwareJITStubRoutine::markRequiredObjectsInternal):
+        * jit/PolymorphicCallStubRoutine.cpp:
+        (JSC::PolymorphicCallStubRoutine::markRequiredObjectsInternal):
+        * jsc.cpp:
+        (WTF::Element::visitChildren):
+        (WTF::ImpureGetter::visitChildren):
+        (WTF::SimpleObject::visitChildren):
+        * runtime/AbstractModuleRecord.cpp:
+        (JSC::AbstractModuleRecord::visitChildren):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/ArgList.h:
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::visitChildren):
+        * runtime/DirectArguments.cpp:
+        (JSC::DirectArguments::visitChildren):
+        * runtime/EvalExecutable.cpp:
+        (JSC::EvalExecutable::visitChildren):
+        * runtime/Exception.cpp:
+        (JSC::Exception::visitChildren):
+        * runtime/FunctionExecutable.cpp:
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/FunctionRareData.cpp:
+        (JSC::FunctionRareData::visitChildren):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/HashMapImpl.cpp:
+        (JSC::HashMapBucket<Data>::visitChildren):
+        (JSC::HashMapImpl<HashMapBucket>::visitChildren):
+        * runtime/InferredTypeTable.cpp:
+        (JSC::InferredTypeTable::visitChildren):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::visitChildren):
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::visitChildren):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::IntlCollatorConstructor::visitChildren):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::visitChildren):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::IntlDateTimeFormatConstructor::visitChildren):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::visitChildren):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::IntlNumberFormatConstructor::visitChildren):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSCallee.cpp:
+        (JSC::JSCallee::visitChildren):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::visitChildren):
+        * runtime/JSCustomGetterSetterFunction.cpp:
+        (JSC::JSCustomGetterSetterFunction::visitChildren):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::visitChildren):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::visitChildren):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::visitChildren):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::visitChildren):
+        * runtime/JSNativeStdFunction.cpp:
+        (JSC::JSNativeStdFunction::visitChildren):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterflyImpl):
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::visitChildren):
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::visitChildren):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::visitChildren):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::visitChildren):
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::visitChildren):
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::visitChildren):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::visitFibers):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::visitChildren):
+        * runtime/JSWeakMap.cpp:
+        (JSC::JSWeakMap::visitChildren):
+        * runtime/JSWeakSet.cpp:
+        (JSC::JSWeakSet::visitChildren):
+        * runtime/JSWithScope.cpp:
+        (JSC::JSWithScope::visitChildren):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/LazyClassStructure.cpp:
+        (JSC::LazyClassStructure::visit):
+        * runtime/LazyPropertyInlines.h:
+        (JSC::ElementType>::visit):
+        * runtime/MapBase.cpp:
+        (JSC::MapBase<HashMapBucketType>::visitChildren):
+        * runtime/ModuleProgramExecutable.cpp:
+        (JSC::ModuleProgramExecutable::visitChildren):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/ProgramExecutable.cpp:
+        (JSC::ProgramExecutable::visitChildren):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyRevoke.cpp:
+        (JSC::ProxyRevoke::visitChildren):
+        * runtime/RegExpCachedResult.cpp:
+        (JSC::RegExpCachedResult::visitChildren):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildren):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::visitChildren):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::visit):
+        * runtime/ScopedArguments.cpp:
+        (JSC::ScopedArguments::visitChildren):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::visitStrongReferences):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::visitChildren):
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+        (JSC::Structure::markIfCheap):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::visitChildren):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::visitChildren):
+        * runtime/TypeProfilerLog.cpp:
+        (JSC::TypeProfilerLog::visit):
+        * runtime/WeakMapData.cpp:
+        (JSC::WeakMapData::DeadKeyCleaner::visitWeakReferences):
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::visitChildren):
+        * wasm/js/JSWebAssemblyMemory.cpp:
+        (JSC::JSWebAssemblyMemory::visitChildren):
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::visitChildren):
+        * wasm/js/JSWebAssemblyTable.cpp:
+        (JSC::JSWebAssemblyTable::visitChildren):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::WebAssemblyFunction::visitChildren):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::visitChildren):
+
+2016-12-15  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Sort Xcode project files
+        https://bugs.webkit.org/show_bug.cgi?id=165937
+
+        Reviewed by Simon Fraser.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2016-12-15  Keith Miller  <keith_miller@apple.com>
+
+        Wasm should not create empty unlinked callsites
+        https://bugs.webkit.org/show_bug.cgi?id=165933
+
+        Reviewed by Mark Lam.
+
+        Wasm would create holes in the unlinked callsite vector if B3 was able to
+        eliminate the callsite.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addCall):
+
+2016-12-15  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: improve compilation error messages
+        https://bugs.webkit.org/show_bug.cgi?id=163919
+
+        Reviewed by Saam Barati.
+
+        The error handling messages were underwhelming because most
+        locations merely returned `false` on failure. This patch uses
+        std::expected to denote that failure isn't expected. Doing this
+        makes it almost impossible to mess up the code: either a function
+        returns a result (or a partial result for internal helpers) or an
+        error. We're not synchronizing the error string with the m_failed
+        bool anymore, and the caller will abort if they try to get a
+        result but the outcome was an error.
+
+        This also shortens the code significantly using macros, while also
+        judiciously preventing inlining of error handling code and biasing
+        towards success using UNLIKELY. This means that the generated code
+        should be more efficient (no string formatting on success, and
+        regalloc can avoid these unlikely paths).
+
+        The patch adds a few missing checks as well, especially related to
+        count limits and memory allocation failure.
+
+        As a follow-up I'd like to improve WTF::makeString further, so it
+        does coercions to string and understands ADL as I did in this
+        patch.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::fail):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmB3IRGenerator.h:
+        * wasm/WasmFormat.h:
+        (JSC::Wasm::isValidExternalKind):
+        (JSC::Wasm::makeString):
+        * wasm/WasmFunctionParser.h:
+        * wasm/WasmModuleParser.cpp:
+        * wasm/WasmModuleParser.h:
+        * wasm/WasmParser.h:
+        (JSC::Wasm::FailureHelper::makeString):
+        (JSC::Wasm::Parser::fail):
+        (JSC::Wasm::Parser<SuccessType>::Parser):
+        (JSC::Wasm::Parser<SuccessType>::consumeCharacter):
+        (JSC::Wasm::Parser<SuccessType>::consumeString):
+        (JSC::Wasm::Parser<SuccessType>::consumeUTF8String):
+        (JSC::Wasm::Parser<SuccessType>::parseVarUInt32):
+        (JSC::Wasm::Parser<SuccessType>::parseVarUInt64):
+        (JSC::Wasm::Parser<SuccessType>::parseVarInt32):
+        (JSC::Wasm::Parser<SuccessType>::parseVarInt64):
+        (JSC::Wasm::Parser<SuccessType>::parseUInt32):
+        (JSC::Wasm::Parser<SuccessType>::parseUInt64):
+        (JSC::Wasm::Parser<SuccessType>::parseUInt8):
+        (JSC::Wasm::Parser<SuccessType>::parseInt7):
+        (JSC::Wasm::Parser<SuccessType>::parseUInt7):
+        (JSC::Wasm::Parser<SuccessType>::parseVarUInt1):
+        (JSC::Wasm::Parser<SuccessType>::parseResultType):
+        (JSC::Wasm::Parser<SuccessType>::parseValueType):
+        (JSC::Wasm::Parser<SuccessType>::parseExternalKind):
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::run):
+        * wasm/WasmSections.h:
+        (JSC::Wasm::isValidSection):
+        (JSC::Wasm::validateOrder):
+        (JSC::Wasm::makeString):
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::fail):
+        (JSC::Wasm::Validate::addUnreachable):
+        (JSC::Wasm::validateFunction):
+        * wasm/WasmValidate.h:
+        * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
+        * wasm/generateWasmOpsHeader.py:
+        * wasm/generateWasmValidateInlinesHeader.py:
+        (loadMacro):
+        (storeMacro):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::link):
+
+2016-12-15  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly API: improve data section errors, initialize after Element
+        https://bugs.webkit.org/show_bug.cgi?id=165733
+
+        Reviewed by Keith Miller.
+
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseData): Data section without Memory section or import is a validation error
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::dataSegmentFail):
+        (JSC::WebAssemblyModuleRecord::evaluate): tighten checks (though the spec isn't fully baked), and move after Element initialization
+
+2016-12-15  Keith Miller  <keith_miller@apple.com>
+
+        Turn on WebAssembly by default
+        https://bugs.webkit.org/show_bug.cgi?id=165918
+
+        Reviewed by Saam Barati.
+
+        * runtime/Options.h:
+
+2016-12-15  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Added missing override and final specifiers
+        https://bugs.webkit.org/show_bug.cgi?id=165903
+
+        Reviewed by Darin Adler.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * jsc.cpp:
+        * parser/Nodes.h:
+
+2016-12-15  Chris Dumez  <cdumez@apple.com>
+
+        Harden JSObject::getOwnPropertyDescriptor()
+        https://bugs.webkit.org/show_bug.cgi?id=165908
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+
+2016-12-15  Keith Miller  <keith_miller@apple.com>
+
+        Fix 64-bit shift family Wasm opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=165902
+
+        Reviewed by Geoffrey Garen.
+
+        The Int64 versions of the shift family B3 opcodes take an Int32
+        for the shift value. Wasm, however, takes an i64, so we need to
+        Trunc the shift value. Also, this fixes a bug where shr_u mapped
+        to signed shift and shr_s mapped to the unsigned shift.
+
+        * wasm/wasm.json:
+
+2016-12-14  Keith Miller  <keith_miller@apple.com>
+
+        Wasm should decode constants correctly
+        https://bugs.webkit.org/show_bug.cgi?id=165886
+
+        Reviewed by Saam Barati.
+
+        This patch fixes how we decode the constant part of i32, i64, f32,
+        and f64.const opcodes.
+
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/wasm.json:
+
+2016-12-14  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly: Add various low hanging fruit that will allow us to run the LLVM torture tests in Wasm
+        https://bugs.webkit.org/show_bug.cgi?id=165883
+
+        Reviewed by Keith Miller.
+
+        This patch implements some low hanging fruit:
+        - Exporting Table
+        - Exporting Memory
+        - Load16 with zero extension to both 32 and 64 bit values.
+        - Fixes Unreachable to emit code that will prevent B3 from having a validation error.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addUnreachable):
+        (JSC::Wasm::sizeOfLoadOp):
+        (JSC::Wasm::B3IRGenerator::emitLoadOp):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseExport):
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::addUnreachable):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::finishCreation):
+        (JSC::WebAssemblyModuleRecord::link):
+
+2016-12-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Update ModuleLoader code by using the latest builtin primitives
+        https://bugs.webkit.org/show_bug.cgi?id=165851
+
+        Reviewed by Sam Weinig.
+
+        Update the module loader code,
+
+        1. Use @globalPrivate for the utilities, instead of setting them as the member of ModuleLoader.
+        2. Use @putByValDirect instead of @push. @push is user-observable since it uses Set() operation
+           and it can be observed by defining indexed setters in Array.prototype.
+
+        * builtins/ModuleLoaderPrototype.js:
+        (ensureRegistered):
+        (fulfillFetch):
+        (commitInstantiated):
+        (requestFetch):
+        (requestSatisfy):
+        (setStateToMax): Deleted.
+        (newRegistryEntry): Deleted.
+        * runtime/ModuleLoaderPrototype.cpp:
+
+2016-12-14  Michael Saboff  <msaboff@apple.com>
+
+        The stress GC bot crashes in JavaScriptCore beneath ShadowChicken::update and Inspector::jsToInspectorValue
+        https://bugs.webkit.org/show_bug.cgi?id=165871
+
+        Reviewed by Mark Lam.
+
+        This fixes two issues with the VM watch dog timer firing in a worker.
+
+        The first issue has to do with bytecode ordering.  Prior to this change, the first few opcodes
+        generated when the watch dog is enabled are:
+                op_enter
+                op_watchdog
+                op_get_scope
+        When the watchdog fires, the function will get an exception at op_watchdog.  In processing that exception,
+        we'll try to update the ShadowChicken shadow stack.  That update assumes that if there is a scope 
+        VirtualRegister allocated, then the slot contains a valid JSScope.  With the current bytecode ordering,
+        this is not true at op_watchdog as op_enter will put JSUndefined in the scope slot.  It isn't until the
+        op_get_scope gets processed that we'll have a valid scope in the slot.  The fix for this issue is to 
+        ensure that op_get_scope happens before the op_watchdog.
+
+        The second issue is that ScriptFunctionCall::call() will not tell its caller that a terminated
+        execution exception happened.  Instead call() returns an empty JSValue.  InjectedScript::wrapCallFrames()
+        wasn't checking for an empty JSValue, but was passing it to another function.  Added a short circuit
+        return when call returns an empty JSValue.
+
+        Added <https://bugs.webkit.org/show_bug.cgi?id=165875> to fix other callers of ScriptFunctionCall::call()
+        to check for an empty JSValue return value.
+        Also tracked with <rdar://problem/29671015>.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitEnter):
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::wrapCallFrames):
+
+2016-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DirectTailCall implementation needs to tell the shuffler what to put into the ArgumentCount explicitly
+        https://bugs.webkit.org/show_bug.cgi?id=165882
+
+        Reviewed by Mark Lam.
+        
+        The CallFrameShuffler was assuming that the ArgumentCount that it should store into the
+        callee frame is simply the size of the args vector.
+        
+        That's not true for DirectTailCall, which will pad the args vector with undefined if we
+        are optimizing an arity mismatch. We need to pass the ArgumentCount explicitly in this
+        case.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
+        * jit/CallFrameShuffleData.h:
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::CallFrameShuffler):
+        (JSC::CallFrameShuffler::prepareAny):
+        * jit/CallFrameShuffler.h:
+        (JSC::CallFrameShuffler::snapshot):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2016-12-14  Keith Miller  <keith_miller@apple.com>
+
+        WebAssembly JS API: implement Global
+        https://bugs.webkit.org/show_bug.cgi?id=164133
+
+        Reviewed by Saam Barati.
+
+        This patch adds support for globals. It handles imports, exports
+        and internal globals. In the MVP only internal globals are allowed
+        to be mutable. This means we can store a C-array of 64-bit slots
+        off the instance holding them. When globals are exported to JS
+        they are done so as numbers. This means that i64 globals cannot be
+        imported or exported.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::B3IRGenerator::getGlobal):
+        (JSC::Wasm::B3IRGenerator::setGlobal):
+        (JSC::Wasm::B3IRGenerator::addCallIndirect):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmFormat.h:
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseImport):
+        (JSC::Wasm::ModuleParser::parseGlobal):
+        (JSC::Wasm::ModuleParser::parseExport):
+        (JSC::Wasm::ModuleParser::parseElement):
+        (JSC::Wasm::ModuleParser::parseInitExpr):
+        (JSC::Wasm::ModuleParser::parseGlobalType):
+        (JSC::Wasm::ModuleParser::parseData):
+        * wasm/WasmModuleParser.h:
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::parseVarInt32):
+        (JSC::Wasm::Parser::parseVarInt64):
+        (JSC::Wasm::Parser::parseUInt64):
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::hasMemory):
+        (JSC::Wasm::Validate::Validate):
+        (JSC::Wasm::Validate::getGlobal):
+        (JSC::Wasm::Validate::setGlobal):
+        (JSC::Wasm::validateFunction):
+        * wasm/generateWasmOpsHeader.py:
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::create):
+        (JSC::JSWebAssemblyInstance::finishCreation):
+        (JSC::JSWebAssemblyInstance::visitChildren):
+        * wasm/js/JSWebAssemblyInstance.h:
+        (JSC::JSWebAssemblyInstance::loadI32Global):
+        (JSC::JSWebAssemblyInstance::loadI64Global):
+        (JSC::JSWebAssemblyInstance::loadF32Global):
+        (JSC::JSWebAssemblyInstance::loadF64Global):
+        (JSC::JSWebAssemblyInstance::setGlobal):
+        (JSC::JSWebAssemblyInstance::offsetOfGlobals):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::finishCreation):
+        (JSC::WebAssemblyModuleRecord::link):
+
+2016-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, re-enable concurrent GC on ARM64 now that the most likely culprit of the memory
+        regressions is fixed. Lets see what the bots think!
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Devices with fewer cores should use a more aggressive GC schedule by default
+        https://bugs.webkit.org/show_bug.cgi?id=165859
+
+        Reviewed by Mark Lam.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markToFixpoint): Log when we have an unexpected delay in wake-up.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::drainInParallelPassively): Don't drain passively if there aren't many cores.
+        * runtime/Options.cpp:
+        (JSC::overrideDefaults): Change the heuristics if we have fewer cores.
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+
+2016-12-14  Mark Lam  <mark.lam@apple.com>
+
+        BytecodeBasicBlock::computeImpl() should not keep iterating blocks if all jump targets have already been found.
+        https://bugs.webkit.org/show_bug.cgi?id=165820
+
+        Reviewed by Saam Barati.
+
+        Currently, if an opcode is a branch type opcode, BytecodeBasicBlock::computeImpl()
+        will iterate over all basic blocks looking for the block containing the jump
+        target, and it will continue to do this even when all the jump targets have been
+        found.  This is wasted work, and all the more so given that most branch type
+        opcodes only have a single jump target.
+
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::BytecodeBasicBlock::computeImpl):
+
+2016-12-14  Gavin Barraclough  <barraclough@apple.com>
+
+        MarkedBlock::marksConveyLivenessDuringMarking should take into account collection scope
+        https://bugs.webkit.org/show_bug.cgi?id=165741
+
+        Unreviewed, re-landing this with fix (revert erroneous change to Options).
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CellContainer.cpp: Added.
+        (JSC::CellContainer::isNewlyAllocated):
+        * heap/CellContainer.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::dumpBits):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::forEachBitVector):
+        (JSC::MarkedAllocator::forEachBitVectorWithName):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::tryCreate):
+        (JSC::MarkedBlock::Handle::~Handle):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::Handle::specializedSweep):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode):
+        (JSC::MarkedBlock::Handle::stopAllocating):
+        (JSC::MarkedBlock::Handle::resumeAllocating):
+        (JSC::MarkedBlock::aboutToMarkSlow):
+        (JSC::MarkedBlock::Handle::didConsumeFreeList):
+        (JSC::MarkedBlock::Handle::dumpState):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::markingVersion):
+        (JSC::MarkedBlock::isMarkedRaw):
+        (JSC::MarkedBlock::isMarked):
+        * heap/MarkedBlockInlines.h:
+        (JSC::MarkedBlock::marksConveyLivenessDuringMarking):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+        * runtime/StructureIDTable.h:
+        (JSC::StructureIDTable::size):
+        (JSC::StructureIDTable::get):
+
+2016-12-14  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r209766.
+
+        Regressed Dromaeo JSLib by ~50%
+
+        Reverted changeset:
+
+        "Make opaque root scanning truly constraint-based"
+        https://bugs.webkit.org/show_bug.cgi?id=165760
+        http://trac.webkit.org/changeset/209766
+
+2016-12-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r209795.
+        https://bugs.webkit.org/show_bug.cgi?id=165853
+
+        rolled out the wrong revision (Requested by pizlo on #webkit).
+
+        Reverted changeset:
+
+        "MarkedBlock::marksConveyLivenessDuringMarking should take
+        into account collection scope"
+        https://bugs.webkit.org/show_bug.cgi?id=165741
+        http://trac.webkit.org/changeset/209795
+
+2016-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, disable concurrent GC on ARM while we investigate a memory use regression.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-12-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Use JSValue::toWTFString instead of calling toString(exec) and value(exec)
+        https://bugs.webkit.org/show_bug.cgi?id=165795
+
+        Reviewed by Saam Barati.
+
+        In old days, we frequently use the idiom like, `value.toString(exec)->value(exec)` to
+        get WTFString from the given JSValue. But now, we have better function, `toWTFString`.
+        `toWTFString` does not create intermediate JSString objects, then reduce unnecessary
+        allocations.
+
+        This patch mechanically replaces `value.toString(exec)->value(exec)` with `toWTFString(exec)`.
+
+        * API/JSValueRef.cpp:
+        (JSValueToStringCopy):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::ScriptValue::toString):
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::extractSourceInformationFromException):
+        * runtime/ConsoleObject.cpp:
+        (JSC::valueToStringWithUndefinedOrNullCheck):
+        (JSC::valueOrDefaultLabelString):
+        * runtime/DateConstructor.cpp:
+        (JSC::dateParse):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::sanitizedToString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/InspectorInstrumentationObject.cpp:
+        (JSC::inspectorInstrumentationObjectLog):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::fetch):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpCreate):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::replaceUsingStringSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::stringProtoFuncNormalize):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionPrint):
+        * wasm/js/JSWebAssemblyCompileError.h:
+        (JSC::JSWebAssemblyCompileError::create):
+        * wasm/js/JSWebAssemblyRuntimeError.h:
+        (JSC::JSWebAssemblyRuntimeError::create):
+
+2016-12-14  Gavin Barraclough  <barraclough@apple.com>
+
+        MarkedBlock::marksConveyLivenessDuringMarking should take into account collection scope
+        https://bugs.webkit.org/show_bug.cgi?id=165741
+
+        Unreviewed rollout due to performance regression.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CellContainer.cpp: Removed.
+        * heap/CellContainer.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::dumpBits):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::forEachBitVector):
+        (JSC::MarkedAllocator::forEachBitVectorWithName):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::tryCreate):
+        (JSC::MarkedBlock::Handle::~Handle):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::Handle::specializedSweep):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode):
+        (JSC::MarkedBlock::Handle::stopAllocating):
+        (JSC::MarkedBlock::Handle::resumeAllocating):
+        (JSC::MarkedBlock::aboutToMarkSlow):
+        (JSC::MarkedBlock::Handle::didConsumeFreeList):
+        (JSC::MarkedBlock::Handle::dumpState): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::markingVersion): Deleted.
+        (JSC::MarkedBlock::isMarkedRaw): Deleted.
+        * heap/MarkedBlockInlines.h:
+        (JSC::MarkedBlock::marksConveyLivenessDuringMarking):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+        * runtime/Options.h:
+        * runtime/StructureIDTable.h:
+        (JSC::StructureIDTable::get):
+        (JSC::StructureIDTable::size): Deleted.
+
+2016-12-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r209792.
+        https://bugs.webkit.org/show_bug.cgi?id=165841
+
+        Cause build failures (Requested by yusukesuzuki on #webkit).
+
+        Reverted changeset:
+
+        "Use JSValue::toWTFString instead of calling toString(exec)
+        and value(exec)"
+        https://bugs.webkit.org/show_bug.cgi?id=165795
+        http://trac.webkit.org/changeset/209792
+
+2016-12-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Use JSValue::toWTFString instead of calling toString(exec) and value(exec)
+        https://bugs.webkit.org/show_bug.cgi?id=165795
+
+        Reviewed by Saam Barati.
+
+        In old days, we frequently use the idiom like, `value.toString(exec)->value(exec)` to
+        get WTFString from the given JSValue. But now, we have better function, `toWTFString`.
+        `toWTFString` does not create intermediate JSString objects, then reduce unnecessary
+        allocations.
+
+        This patch mechanically replaces `value.toString(exec)->value(exec)` with `toWTFString(exec)`.
+
+        * API/JSValueRef.cpp:
+        (JSValueToStringCopy):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::ScriptValue::toString):
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::extractSourceInformationFromException):
+        * runtime/ConsoleObject.cpp:
+        (JSC::valueToStringWithUndefinedOrNullCheck):
+        (JSC::valueOrDefaultLabelString):
+        * runtime/DateConstructor.cpp:
+        (JSC::dateParse):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::sanitizedToString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/InspectorInstrumentationObject.cpp:
+        (JSC::inspectorInstrumentationObjectLog):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toWTFStringSlowCase):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::fetch):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpCreate):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::replaceUsingStringSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::stringProtoFuncNormalize):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionPrint):
+        * wasm/js/JSWebAssemblyCompileError.h:
+        (JSC::JSWebAssemblyCompileError::create):
+        * wasm/js/JSWebAssemblyRuntimeError.h:
+        (JSC::JSWebAssemblyRuntimeError::create):
+
+2016-12-13  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly: implement the elements section
+        https://bugs.webkit.org/show_bug.cgi?id=165715
+
+        Reviewed by Keith Miller.
+
+        This is a straight forward implementation of the Element
+        section in the Wasm spec:
+        https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#element-section
+        
+        There are a few ambiguities I encountered when implementing this, so I've
+        filed bugs against the Wasm design repo, and corresponding bugzilla bugs
+        for us to address after they've been discussed by the various Wasm folks:
+        - https://bugs.webkit.org/show_bug.cgi?id=165827
+        - https://bugs.webkit.org/show_bug.cgi?id=165826
+        - https://bugs.webkit.org/show_bug.cgi?id=165825
+
+        * wasm/WasmFormat.h:
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseElement):
+        (JSC::Wasm::ModuleParser::parseInitExpr):
+        (JSC::Wasm::ModuleParser::parseData):
+        * wasm/WasmModuleParser.h:
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::evaluate):
+
+2016-12-13  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r209544.
+
+        Looks like r209489 did not cause the performance regression
+        after all
+
+        Reverted changeset:
+
+        "Unreviewed, rolling out r209489."
+        https://bugs.webkit.org/show_bug.cgi?id=165550
+        http://trac.webkit.org/changeset/209544
+
+2016-12-13  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly: implement the table section and table import
+        https://bugs.webkit.org/show_bug.cgi?id=165716
+
+        Reviewed by Keith Miller.
+
+        This patch implements the Table space for wasm:
+        https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#table-section
+
+        It only implements defining and importing a table. The bulk
+        of this patch is implementing the various wasm Table prototype
+        methods and the underlying Table object:
+        https://github.com/WebAssembly/design/blob/master/JS.md#webassemblytable-constructor
+
+        This patch also fixes a bug in our implementation with call_indirect.
+        We initially implemented call_indirect as a way to call functions that
+        are imported or defined in the module. This was the wrong
+        interpretation of the spec. Instead, call_indirect can only index into
+        the table index space.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::B3IRGenerator::addCallIndirect):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmFormat.h:
+        (JSC::Wasm::TableInformation::TableInformation):
+        (JSC::Wasm::TableInformation::operator bool):
+        (JSC::Wasm::TableInformation::isImport):
+        (JSC::Wasm::TableInformation::initial):
+        (JSC::Wasm::TableInformation::maximum):
+        (JSC::Wasm::CallableFunction::CallableFunction):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseImport):
+        (JSC::Wasm::ModuleParser::parseResizableLimits):
+        (JSC::Wasm::ModuleParser::parseTableHelper):
+        (JSC::Wasm::ModuleParser::parseTable):
+        (JSC::Wasm::ModuleParser::parseMemoryHelper):
+        (JSC::Wasm::ModuleParser::parseExport):
+        * wasm/WasmModuleParser.h:
+        * wasm/js/JSWebAssemblyHelpers.h: Added.
+        (JSC::toNonWrappingUint32):
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::visitChildren):
+        * wasm/js/JSWebAssemblyInstance.h:
+        (JSC::JSWebAssemblyInstance::table):
+        (JSC::JSWebAssemblyInstance::setTable):
+        (JSC::JSWebAssemblyInstance::offsetOfTable):
+        * wasm/js/JSWebAssemblyTable.cpp:
+        (JSC::JSWebAssemblyTable::create):
+        (JSC::JSWebAssemblyTable::JSWebAssemblyTable):
+        (JSC::JSWebAssemblyTable::visitChildren):
+        (JSC::JSWebAssemblyTable::grow):
+        (JSC::JSWebAssemblyTable::clearFunction):
+        (JSC::JSWebAssemblyTable::setFunction):
+        * wasm/js/JSWebAssemblyTable.h:
+        (JSC::JSWebAssemblyTable::maximum):
+        (JSC::JSWebAssemblyTable::size):
+        (JSC::JSWebAssemblyTable::getFunction):
+        (JSC::JSWebAssemblyTable::offsetOfSize):
+        (JSC::JSWebAssemblyTable::offsetOfFunctions):
+        (JSC::JSWebAssemblyTable::isValidSize):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::WebAssemblyFunction::call):
+        (JSC::WebAssemblyFunction::create):
+        (JSC::WebAssemblyFunction::visitChildren):
+        (JSC::WebAssemblyFunction::finishCreation):
+        * wasm/js/WebAssemblyFunction.h:
+        (JSC::WebAssemblyFunction::signature):
+        (JSC::WebAssemblyFunction::wasmEntrypoint):
+        (JSC::WebAssemblyFunction::webAssemblyCallee): Deleted.
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance):
+        * wasm/js/WebAssemblyMemoryConstructor.cpp:
+        (JSC::constructJSWebAssemblyMemory):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::finishCreation):
+        (JSC::WebAssemblyModuleRecord::link):
+        * wasm/js/WebAssemblyTableConstructor.cpp:
+        (JSC::constructJSWebAssemblyTable):
+        * wasm/js/WebAssemblyTablePrototype.cpp:
+        (JSC::getTable):
+        (JSC::webAssemblyTableProtoFuncLength):
+        (JSC::webAssemblyTableProtoFuncGrow):
+        (JSC::webAssemblyTableProtoFuncGet):
+        (JSC::webAssemblyTableProtoFuncSet):
+        (JSC::WebAssemblyTablePrototype::create):
+        (JSC::WebAssemblyTablePrototype::finishCreation):
+        * wasm/js/WebAssemblyTablePrototype.h:
+
+2016-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Add null checks to opaque root APIs.
+
+        Rubber stamped by Saam Barati. 
+
+        If we got a crash report about null in the opaque root HashSet, we would probably not
+        celebrate how great it is that we found out about a new race - instead we would probably
+        be annoyed that null wasn't just silently ignored.
+
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::addOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRootTriState):
+
+2016-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Make opaque root scanning truly constraint-based
+        https://bugs.webkit.org/show_bug.cgi?id=165760
+
+        Reviewed by Saam Barati.
+        
+        We have bugs when visitChildren() changes its mind about what opaque root to add, since
+        we don't have barriers on opaque roots. This supposedly once worked for generational GC,
+        and I started adding more barriers to support concurrent GC. But I think that the real
+        bug here is that we want the JSObject->OpaqueRoot to be evaluated as a constraint that
+        participates in the fixpoint. A constraint is different from the normal visiting in that
+        the GC will not wait for a barrier to rescan the object.
+        
+        So, it's now possible for any visitChildren() method to become a constraint by calling
+        slotVisitor.rescanAsConstraint(). Because opaque roots are constraints, addOpaqueRoot()
+        does rescanAsConstraint() for you.
+        
+        The constraint set is simply a HashSet<JSCell*> that accumulates with every
+        rescanAsConstraint() call and is only cleared at the start of full GC. This trivially
+        resolves most classes of GC bugs that would have arisen from opaque roots being changed
+        in a way that the GC did not anticipate.
+        
+        Looks like this is perf-neutral.
+        
+        * heap/Heap.cpp:
+        (JSC::Heap::markToFixpoint):
+        (JSC::Heap::setMutatorShouldBeFenced):
+        (JSC::Heap::writeBarrierOpaqueRootSlow): Deleted.
+        (JSC::Heap::addMutatorShouldBeFencedCache): Deleted.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::writeBarrierOpaqueRoot): Deleted.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::visitWeakSets):
+        * heap/MarkedSpace.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::visitChildren):
+        (JSC::SlotVisitor::visitSubsequently):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::addOpaqueRoot):
+        (JSC::SlotVisitor::rescanAsConstraint):
+        (JSC::SlotVisitor::mergeIfNecessary):
+        (JSC::SlotVisitor::mergeOpaqueRootsAndConstraints):
+        (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary): Deleted.
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExtraMemoryVisited):
+        (JSC::SlotVisitor::reportExternalMemoryVisited):
+        (JSC::SlotVisitor::didNotRace):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::specializedVisit):
+        (JSC::WeakBlock::visit):
+        * heap/WeakBlock.h:
+        * heap/WeakSet.h:
+        (JSC::WeakSet::visit):
+
+2016-12-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r209725.
+        https://bugs.webkit.org/show_bug.cgi?id=165811
+
+        "Broke ARMv7 builds" (Requested by msaboff on #webkit).
+
+        Reverted changeset:
+
+        "REGRESSION(r209653): speedometer crashes making virtual slow
+        path tailcalls"
+        https://bugs.webkit.org/show_bug.cgi?id=165748
+        http://trac.webkit.org/changeset/209725
+
+2016-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, revert the collectorPermittedIdleRatio back to 0 because of 100MB
+        regression on membuster. Also, it didn't seem to help perf.
+
+        * runtime/Options.h:
+
+2016-12-13  JF Bastien  <jfbastien@apple.com>
+
+        [WTF] Turn tryMakeString(), makeString() into variadic templates
+        https://bugs.webkit.org/show_bug.cgi?id=147142
+
+        Reviewed by Mark Lam.
+
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString): remove WTF:: prefix, it isn't needed anymore
+        * runtime/Lookup.cpp:
+        (JSC::reifyStaticAccessor): remove WTF:: prefix, it isn't needed anymore
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString): remove WTF:: prefix, it isn't needed anymore
+
+2016-12-12  Mark Lam  <mark.lam@apple.com>
+
+        Rename BytecodeGenerator's ControlFlowContext to ControlFlowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=165777
+
+        Reviewed by Keith Miller.
+
+        The existing code sometimes refer to ControlFlowContext (and associated references)
+        as context, and sometimes as scope.  Let's be consistent and always call it a scope.
+
+        Also renamed push/popScopedControlFlowContext() to push/popLocalControlFlowScope()
+        because these are only used when we inc/dec the m_localScopeDepth.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::initializeVarLexicalEnvironment):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::popLexicalScopeInternal):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitPopWithScope):
+        (JSC::BytecodeGenerator::pushFinallyControlFlowScope):
+        (JSC::BytecodeGenerator::pushIteratorCloseControlFlowScope):
+        (JSC::BytecodeGenerator::popFinallyControlFlowScope):
+        (JSC::BytecodeGenerator::popIteratorCloseControlFlowScope):
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::emitPopScopes):
+        (JSC::BytecodeGenerator::pushLocalControlFlowScope):
+        (JSC::BytecodeGenerator::popLocalControlFlowScope):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::pushFinallyContext): Deleted.
+        (JSC::BytecodeGenerator::pushIteratorCloseContext): Deleted.
+        (JSC::BytecodeGenerator::popFinallyContext): Deleted.
+        (JSC::BytecodeGenerator::popIteratorCloseContext): Deleted.
+        (JSC::BytecodeGenerator::pushScopedControlFlowContext): Deleted.
+        (JSC::BytecodeGenerator::popScopedControlFlowContext): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+
+2016-12-12  Filip Pizlo  <fpizlo@apple.com>
+
+        GC scheduler should avoid consecutive pauses
+        https://bugs.webkit.org/show_bug.cgi?id=165758
+
+        Reviewed by Michael Saboff.
+        
+        This factors out the scheduler from lambdas in Heap::markToFixpoint to an actual class.
+        It's called the SpaceTimeScheduler because it is a linear controller that ties the
+        amount of time you spend on things to the amount of space you are using.
+        
+        This patch uses this refactoring to fix a bug where the GC would pause even though we
+        still had time during a mutator timeslice. This is a 15% improvement on
+        JetStream/splay-latency. Seems neutral on everything else. However, it's not at all
+        clear if this is the right policy or not since retreating wavefront can sometimes be so
+        sensitive to scheduling decisions. For this reason, there is a tunable option that lets
+        you decide how long the GC will sit idle before the start of its timeslice.
+        
+        So, we can revert this policy change in this patch without reverting the patch.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::markToFixpoint):
+        * heap/Heap.h:
+        * heap/SpaceTimeScheduler.cpp: Added.
+        (JSC::SpaceTimeScheduler::Decision::targetMutatorUtilization):
+        (JSC::SpaceTimeScheduler::Decision::targetCollectorUtilization):
+        (JSC::SpaceTimeScheduler::Decision::elapsedInPeriod):
+        (JSC::SpaceTimeScheduler::Decision::phase):
+        (JSC::SpaceTimeScheduler::Decision::shouldBeResumed):
+        (JSC::SpaceTimeScheduler::Decision::timeToResume):
+        (JSC::SpaceTimeScheduler::Decision::timeToStop):
+        (JSC::SpaceTimeScheduler::SpaceTimeScheduler):
+        (JSC::SpaceTimeScheduler::snapPhase):
+        (JSC::SpaceTimeScheduler::currentDecision):
+        * heap/SpaceTimeScheduler.h: Added.
+        (JSC::SpaceTimeScheduler::Decision::Decision):
+        (JSC::SpaceTimeScheduler::Decision::operator bool):
+        * runtime/Options.h:
+
+2016-12-12  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r209653): speedometer crashes making virtual slow path tailcalls
+        https://bugs.webkit.org/show_bug.cgi?id=165748
+
+        Reviewed by Filip Pizlo.
+
+        The virtual slow path for tailcalls always passes arguments on the stack.
+        The fix here is to link to the stack argument entrypoint instead of a register
+        argument entrypoint.
+
+        While fixing this bug, I found that we weren't clearing the code origin when
+        shuffling the call frame for a register argument tailcall.
+
+        Also rolling back in r209653, r209654, r209663, and r209673.
+
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::prepareAny):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualThunkFor):
+
+2016-12-12  Mark Lam  <mark.lam@apple.com>
+
+        Rename BytecodeGenerator's m_symbolTableStack to m_lexicalScopeStack.
+        https://bugs.webkit.org/show_bug.cgi?id=165768
+
+        Reviewed by Saam Barati.
+
+        The lexical scope in "m_lexicalScopeStack" here refers to a pair of { } in the
+        source code that bounds the scope of variables.
+
+        There are 4 places in the code where we call m_symbolTableStack.append() to
+        append a new stack entry.  In only 3 of the 4 cases, a symbol table is provided
+        in the new stack entry.  In all 4 cases, a scope register is provided in the new
+        stack entry.
+
+        Also, 3 of the 4 functions that appends an entry to this stack are named:
+        1. initializeVarLexicalEnvironment()
+        2. pushLexicalScopeInternal()
+        3. emitPushWithScope()
+
+        The 4th function is the BytecodeGenerator constructor where it pushes the scope
+        for a module environment.
+
+        Based on these details, m_lexicalScopeStack is a better name for this stack than
+        m_symbolTableStack.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::initializeVarLexicalEnvironment):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::initializeBlockScopedFunctions):
+        (JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary):
+        (JSC::BytecodeGenerator::popLexicalScopeInternal):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::resolveType):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitPopWithScope):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::pushIteratorCloseContext):
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        * bytecompiler/BytecodeGenerator.h:
+
+2016-12-12  Saam Barati  <sbarati@apple.com>
+
+        Unreviewed. Try to fix the cloop build.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::calleeSaveRegisters):
+        * interpreter/StackVisitor.h:
+
+2016-12-12  Michael Saboff  <msaboff@apple.com>
+
+        FTL: Dumping disassembly requires that code origin is set when making polymorphic tail calls.
+        https://bugs.webkit.org/show_bug.cgi?id=165747
+
+        Reviewed by Filip Pizlo.
+
+        Setting the code origin needs to be done for both the fast and slow path as we might need
+        it when linking a polymorphic or virtual call stub.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
+
+2016-12-11  Saam Barati  <sbarati@apple.com>
+
+        Unreviewed. Try to fix the linux build.
+
+        * runtime/StackFrame.h:
+
+2016-12-11  Saam Barati  <sbarati@apple.com>
+
+        We should be able to throw exceptions from Wasm code and when Wasm frames are on the stack
+        https://bugs.webkit.org/show_bug.cgi?id=165429
+
+        Reviewed by Keith Miller.
+
+        This patch teaches the stack walking runtime about wasm.
+        To do this, I taught StackVisitor that a callee is not
+        always an object.
+
+        To be able to unwind callee save registers properly, I've given
+        JSWebAssemblyCallee a list of RegisterAtOffsetList for the callee
+        saves that B3 saved in the prologue. Also, because we have two
+        B3Compilations per wasm function, one for wasm entrypoint, and
+        one for the JS entrypoint, I needed to create a callee for each
+        because they each might spill callee save registers.
+
+        I also fixed a bug inside the Wasm::Memory constructor where we
+        were trying to mmap the same number of bytes even after the first
+        mmap failed. We should start by trying to mmap the maximum bytes,
+        and if that fails, fall back to the specified initial bytes. However,
+        the code was just mmapping the maximum twice. I've fixed that and
+        also added a RELEASE_ASSERT_NOT_REACHED() for when the second mmap
+        fails along with a FIXME to throw an OOM error.
+
+        There was a second bug I fixed where JSModuleRecord was calling
+        visitWeak on its CallLinkInfos inside ::visitChldren(). It needs
+        to do this after marking. I changed JSModuleRecord to do what
+        CodeBlock does and call visitWeak on its CallLinkInfos inside
+        an UnconditionalFinalizer.
+
+        * API/JSContextRef.cpp:
+        (BacktraceFunctor::operator()):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStackFromException):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::vmEntryGlobalObject):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callee):
+        * interpreter/Interpreter.cpp:
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
+        * interpreter/Interpreter.h:
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::update):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::StackVisitor):
+        (JSC::StackVisitor::readFrame):
+        (JSC::StackVisitor::readNonInlinedFrame):
+        (JSC::StackVisitor::readInlinedFrame):
+        (JSC::StackVisitor::Frame::isWasmFrame):
+        (JSC::StackVisitor::Frame::codeType):
+        (JSC::StackVisitor::Frame::calleeSaveRegisters):
+        (JSC::StackVisitor::Frame::functionName):
+        (JSC::StackVisitor::Frame::sourceURL):
+        (JSC::StackVisitor::Frame::toString):
+        (JSC::StackVisitor::Frame::hasLineAndColumnInfo):
+        (JSC::StackVisitor::Frame::setToEnd):
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::Frame::callee):
+        (JSC::StackVisitor::Frame::isNativeFrame):
+        (JSC::StackVisitor::Frame::isJSFrame): Deleted.
+        * jsc.cpp:
+        (callWasmFunction):
+        (functionTestWasmModuleFunctions):
+        * runtime/Error.cpp:
+        (JSC::addErrorInfoAndGetBytecodeOffset):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::isAnyWasmCallee):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveArgumentsFunctor::operator()):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        * runtime/StackFrame.cpp:
+        (JSC::StackFrame::sourceID):
+        (JSC::StackFrame::sourceURL):
+        (JSC::StackFrame::functionName):
+        (JSC::StackFrame::computeLineAndColumn):
+        (JSC::StackFrame::toString):
+        * runtime/StackFrame.h:
+        (JSC::StackFrame::StackFrame):
+        (JSC::StackFrame::hasLineAndColumnInfo):
+        (JSC::StackFrame::hasBytecodeOffset):
+        (JSC::StackFrame::bytecodeOffset):
+        (JSC::StackFrame::isNative): Deleted.
+        * runtime/VM.h:
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::createJSToWasmWrapper):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmCallingConvention.h:
+        (JSC::Wasm::CallingConvention::setupFrameInPrologue):
+        * wasm/WasmFormat.h:
+        * wasm/WasmMemory.cpp:
+        (JSC::Wasm::Memory::Memory):
+        * wasm/WasmMemory.h:
+        (JSC::Wasm::Memory::isValid):
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::run):
+        (JSC::Wasm::Plan::initializeCallees):
+        * wasm/WasmPlan.h:
+        (JSC::Wasm::Plan::jsToWasmEntryPointForFunction): Deleted.
+        * wasm/js/JSWebAssemblyCallee.cpp:
+        (JSC::JSWebAssemblyCallee::finishCreation):
+        * wasm/js/JSWebAssemblyCallee.h:
+        (JSC::JSWebAssemblyCallee::create):
+        (JSC::JSWebAssemblyCallee::entrypoint):
+        (JSC::JSWebAssemblyCallee::calleeSaveRegisters):
+        (JSC::JSWebAssemblyCallee::jsToWasmEntryPoint): Deleted.
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
+        (JSC::JSWebAssemblyModule::visitChildren):
+        (JSC::JSWebAssemblyModule::UnconditionalFinalizer::finalizeUnconditionally):
+        * wasm/js/JSWebAssemblyModule.h:
+        (JSC::JSWebAssemblyModule::jsEntrypointCalleeFromFunctionIndexSpace):
+        (JSC::JSWebAssemblyModule::wasmEntrypointCalleeFromFunctionIndexSpace):
+        (JSC::JSWebAssemblyModule::setJSEntrypointCallee):
+        (JSC::JSWebAssemblyModule::setWasmEntrypointCallee):
+        (JSC::JSWebAssemblyModule::allocationSize):
+        (JSC::JSWebAssemblyModule::calleeFromFunctionIndexSpace): Deleted.
+        * wasm/js/JSWebAssemblyRuntimeError.h:
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::WebAssemblyFunction::call):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance):
+        * wasm/js/WebAssemblyMemoryConstructor.cpp:
+        (JSC::constructJSWebAssemblyMemory):
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::link):
+
+2016-12-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Re-enable concurrent GC.
+
+        Rubber stampted by Saam Barati.
+        
+        This change actually landed in r209692 by accident.
+
+        * runtime/Options.h:
+
+2016-12-10  Filip Pizlo  <fpizlo@apple.com>
+
+        MarkedBlock::marksConveyLivenessDuringMarking should take into account collection scope
+        https://bugs.webkit.org/show_bug.cgi?id=165741
+
+        Reviewed by Saam Barati.
+        
+        MarkedBlock::marksConveyLivenessDuringMarking thought that the off-by-one marking
+        version indicated liveness during any collection when it's just during full collection.
+        One of its users - MarkedBlock::sweep - knew this and had a special case, but the other
+        one - MarkedBlock::isLive - didn't. So, I moved the special case into
+        marksConveyLivenessDuringMarking.
+        
+        Also, this cleans up some remaining bitvector races.
+        
+        To find this bug, I significantly strengthened our assertions.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CellContainer.cpp: Added.
+        (JSC::CellContainer::isNewlyAllocated):
+        * heap/CellContainer.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::dumpBits):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::forEachBitVector):
+        (JSC::MarkedAllocator::forEachBitVectorWithName):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::tryCreate):
+        (JSC::MarkedBlock::Handle::~Handle):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::Handle::specializedSweep):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode):
+        (JSC::MarkedBlock::Handle::stopAllocating):
+        (JSC::MarkedBlock::Handle::resumeAllocating):
+        (JSC::MarkedBlock::aboutToMarkSlow):
+        (JSC::MarkedBlock::Handle::didConsumeFreeList):
+        (JSC::MarkedBlock::Handle::dumpState):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::markingVersion):
+        (JSC::MarkedBlock::isMarkedRaw):
+        (JSC::MarkedBlock::isMarked):
+        * heap/MarkedBlockInlines.h:
+        (JSC::MarkedBlock::marksConveyLivenessDuringMarking):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/StructureIDTable.h:
+        (JSC::StructureIDTable::size):
+        (JSC::StructureIDTable::get):
+
+2016-12-10  Filip Pizlo  <fpizlo@apple.com>
+
+        The DOM should have an advancing wavefront opaque root barrier
+        https://bugs.webkit.org/show_bug.cgi?id=165712
+
+        Reviewed by Yusuke Suzuki.
+        
+        This exposes the ability to fire an advancing wavefront barrier on opaque roots. It also
+        gives clients the ability to maintain their own cache of whether that barrier needs to
+        be enabled.
+        
+        The DOM uses this to enable a very cheap barrier on the DOM. This is neutral on
+        Speedometer and fixes another concurrent GC crash.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::beginMarking):
+        (JSC::Heap::endMarking):
+        (JSC::Heap::writeBarrierOpaqueRootSlow):
+        (JSC::Heap::addMutatorShouldBeFencedCache):
+        (JSC::Heap::setMutatorShouldBeFenced):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::writeBarrierOpaqueRoot):
+
+2016-12-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r209653, r209654, r209663, and
+        r209673.
+        https://bugs.webkit.org/show_bug.cgi?id=165739
+
+        speedometer crashes (Requested by pizlo on #webkit).
+
+        Reverted changesets:
+
+        "JSVALUE64: Pass arguments in platform argument registers when
+        making JavaScript calls"
+        https://bugs.webkit.org/show_bug.cgi?id=160355
+        http://trac.webkit.org/changeset/209653
+
+        "Unreviewed build fix for 32 bit builds."
+        http://trac.webkit.org/changeset/209654
+
+        "Unreviewed build fix for the CLOOP after r209653"
+        http://trac.webkit.org/changeset/209663
+
+        "REGRESSION(r209653) Crash in CallFrameShuffler::snapshot()"
+        https://bugs.webkit.org/show_bug.cgi?id=165728
+        http://trac.webkit.org/changeset/209673
+
+2016-12-10  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r209653) Crash in CallFrameShuffler::snapshot()
+        https://bugs.webkit.org/show_bug.cgi?id=165728
+
+        Reviewed by Filip Pizlo.
+
+        It can be the case that a JSValueReg's CachedRecovery is the source for mutliple
+        GPRs. We only store the CachedRecovery in one slot of m_newRegisters to simplify
+        the recovery process. This is also done for the case where the recovery source
+        and destination are the same GPR.
+
+        In light of this change, snapshot needs to be taught that one CacheRecovery is
+        the source for multiple registers.  This is done by using a two step process.
+        First find all the argument CachedRecovery's and create a vector mapping all of
+        the target GPRs and the source recovery.  Then use that vector to get the
+        recovery for each register.
+
+        * jit/CallFrameShuffler.h:
+        (JSC::CallFrameShuffler::snapshot):
+
+2016-12-10  Keith Miller  <keith_miller@apple.com>
+
+        Fix indirect_call if the result type is used.
+        https://bugs.webkit.org/show_bug.cgi?id=165727
+
+        Reviewed by Michael Saboff.
+
+        The patchpoint for indirect_call assumed that the callee would be
+        in params[0]. This is not the case, however, if the callee returns
+        a value.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addCallIndirect):
+
+2016-12-10  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [cmake] Include WTF, JSC, and WebCore headers automatically to targers using them
+        https://bugs.webkit.org/show_bug.cgi?id=165686
+
+        Reviewed by Michael Catanzaro.
+
+        This change reduces duplication of include path lists between modules,
+        and reduces future need for fixes like r209605 (broken build because of
+        WebCore header suddenly becoming used in WebKit2).
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake:
+        * PlatformGTK.cmake:
+        * PlatformJSCOnly.cmake:
+        * PlatformMac.cmake:
+
+2016-12-10  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix for the CLOOP after r209653
+
+        * jit/GPRInfo.h:
+        Provided a definition for NUMBER_OF_JS_FUNCTION_ARGUMENT_REGISTERS when the JIT is disabled.
+        * jit/JITEntryPoints.h:
+        Removed #if ENABLE(JIT) protection around contents.
+
+2016-12-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Module namespace object behaves like immutable prototype exotic object
+        https://bugs.webkit.org/show_bug.cgi?id=165598
+
+        Reviewed by Mark Lam.
+
+        In the latest ECMA262 draft, the module namespace object behaves like immutable prototype exotic object.
+        https://tc39.github.io/ecma262/#sec-module-namespace-exotic-objects-setprototypeof-v
+
+        * runtime/JSModuleNamespaceObject.h:
+
+2016-12-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION(r208791): Assertion in testb3
+        https://bugs.webkit.org/show_bug.cgi?id=165651
+
+        Reviewed by Saam Barati.
+
+        Accidentally we always use edx/rdx for the result of UDiv/UMod.
+        But it is incorrect. We should use eax/rax for the result of UDiv.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lowerX86UDiv):
+
+2016-12-09  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix for 32 bit builds.
+
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::MinifiedNode::argumentIndex): Added a static_cast<unsigned>().
+
+2016-12-09  Michael Saboff  <msaboff@apple.com>
+
+        JSVALUE64: Pass arguments in platform argument registers when making JavaScript calls
+        https://bugs.webkit.org/show_bug.cgi?id=160355
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements passing JavaScript function arguments in registers for 64 bit platforms.
+
+        The implemented convention follows the ABI conventions for the associated platform.
+        The first two arguments are the callee and argument count, the rest of the argument registers
+        contain "this" and following argument until all platform argument registers are exhausted.
+        Arguments beyond what fit in registers are placed on the stack in the same location as
+        before this patch.
+
+        For X86-64 non-Windows platforms, there are 6 argument registers specified in the related ABI.
+        ARM64 has had argument registers.  This allows for 4 or 6 parameter values to be placed in
+        registers on these respective platforms.  This patch doesn't implement passing arguments in
+        registers for 32 bit platform, since most platforms have at most 4 argument registers
+        specified and 32 bit platforms use two 32 bit registers/memory locations to store one JSValue.
+
+        The call frame on the stack in unchanged in format and the arguments that are passed in
+        registers use the corresponding call frame location as a spill location. Arguments can
+        also be passed on the stack. The LLInt, baseline JIT'ed code as well as the initial entry
+        from C++ code base arguments on the stack. DFG s and FTL generated code pass arguments
+        via registers. All callees can accept arguments either in registers or on the stack.
+        The callee is responsible for moving argument to its preferred location.
+
+        The multiple entry points to JavaSCript code is now handled via the JITEntryPoints class and
+        related code.  That class now has entries for StackArgsArityCheckNotRequired,
+        StackArgsMustCheckArity and for platforms that support registers arguments,
+        RegisterArgsArityCheckNotRequired, RegisterArgsMustCheckArity as well as and additional
+        RegisterArgsPossibleExtraArgs entry point when extra registers argument are passed.
+        This last case is needed to spill those extra arguments to the corresponding call frame
+        slots.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3ArgumentRegValue.h:
+        * b3/B3Validate.cpp:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::setUpCall):
+        (JSC::CallLinkInfo::argumentsLocation):
+        (JSC::CallLinkInfo::argumentsInRegisters):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+        (JSC::DFG::CPSRethreadingPhase::specialCaseArguments):
+        (JSC::DFG::CPSRethreadingPhase::computeIsFlushed):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::initArgumentRegisterValue):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::needsFlushedThis):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInt32):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::compileEntry): Deleted.
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addJSDirectCall):
+        (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord):
+        (JSC::DFG::JITCompiler::JSDirectCallRecord::hasSlowCall):
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::JITFinalizer):
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp:
+        (JSC::DFG::LiveCatchVariablePreservationPhase::handleBlock):
+        * dfg/DFGMaximalFlushInsertionPhase.cpp:
+        (JSC::DFG::MaximalFlushInsertionPhase::treatRegularBlock):
+        (JSC::DFG::MaximalFlushInsertionPhase::treatRootBlock):
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGMinifiedNode.cpp:
+        (JSC::DFG::MinifiedNode::fromNode):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::hasVariableAccessData):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::accessesStack):
+        (JSC::DFG::Node::setVariableAccessData):
+        (JSC::DFG::Node::hasArgumentRegisterIndex):
+        (JSC::DFG::Node::argumentRegisterIndex):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::iterator::unlock):
+        (JSC::DFG::RegisterBank::unlockAtIndex):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::clearGenerationInfo):
+        (JSC::DFG::dumpRegisterInfo):
+        (JSC::DFG::SpeculativeJIT::dump):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::setupArgumentRegistersForEntry):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::allocate):
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::generationInfoFromVirtualRegister):
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        (JSC::DFG::JSValueOperand::gprUseSpecific):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrEntryThunkGenerator):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::allocateRegister):
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::~JITCode):
+        (JSC::FTL::JITCode::initializeEntrypointThunk):
+        (JSC::FTL::JITCode::setEntryFor):
+        (JSC::FTL::JITCode::addressForCall):
+        (JSC::FTL::JITCode::executableAddressAtOffset):
+        (JSC::FTL::JITCode::initializeAddressForCall): Deleted.
+        (JSC::FTL::JITCode::initializeArityCheckEntrypoint): Deleted.
+        * ftl/FTLJITCode.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetArgumentRegister):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::argumentRegister):
+        (JSC::FTL::Output::argumentRegisterInt32):
+        * ftl/FTLOutput.h:
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::update):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitDumbVirtualCall):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::spillArgumentRegistersToFrameBeforePrologue):
+        (JSC::AssemblyHelpers::spillArgumentRegistersToFrame):
+        (JSC::AssemblyHelpers::fillArgumentRegistersFromFrameBeforePrologue):
+        (JSC::AssemblyHelpers::emitPutArgumentToCallFrameBeforePrologue):
+        (JSC::AssemblyHelpers::emitPutArgumentToCallFrame):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeaderBeforePrologue):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameArgumentBeforePrologue):
+        (JSC::AssemblyHelpers::emitGetPayloadFromCallFrameHeaderBeforePrologue):
+        (JSC::AssemblyHelpers::incrementCounter):
+        * jit/CachedRecovery.cpp:
+        (JSC::CachedRecovery::addTargetJSValueRegs):
+        * jit/CachedRecovery.h:
+        (JSC::CachedRecovery::gprTargets):
+        (JSC::CachedRecovery::setWantedFPR):
+        (JSC::CachedRecovery::wantedJSValueRegs):
+        (JSC::CachedRecovery::setWantedJSValueRegs): Deleted.
+        * jit/CallFrameShuffleData.h:
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::CallFrameShuffler):
+        (JSC::CallFrameShuffler::dump):
+        (JSC::CallFrameShuffler::tryWrites):
+        (JSC::CallFrameShuffler::prepareAny):
+        * jit/CallFrameShuffler.h:
+        (JSC::CallFrameShuffler::snapshot):
+        (JSC::CallFrameShuffler::addNew):
+        (JSC::CallFrameShuffler::initDangerFrontier):
+        (JSC::CallFrameShuffler::updateDangerFrontier):
+        (JSC::CallFrameShuffler::findDangerFrontierFrom):
+        * jit/CallFrameShuffler64.cpp:
+        (JSC::CallFrameShuffler::emitDisplace):
+        * jit/GPRInfo.h:
+        (JSC::JSValueRegs::operator==):
+        (JSC::JSValueRegs::operator!=):
+        (JSC::GPRInfo::toArgumentIndex):
+        (JSC::argumentRegisterFor):
+        (JSC::argumentRegisterForCallee):
+        (JSC::argumentRegisterForArgumentCount):
+        (JSC::argumentRegisterIndexForJSFunctionArgument):
+        (JSC::jsFunctionArgumentForArgumentRegister):
+        (JSC::argumentRegisterForFunctionArgument):
+        (JSC::numberOfRegisterArgumentsFor):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        (JSC::JIT::link):
+        (JSC::JIT::compileCTINativeCall): Deleted.
+        * jit/JIT.h:
+        (JSC::JIT::compileNativeCallEntryPoints):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        (JSC::DirectJITCode::DirectJITCode):
+        (JSC::DirectJITCode::initializeEntryPoints):
+        (JSC::DirectJITCode::addressForCall):
+        (JSC::NativeJITCode::addressForCall):
+        (JSC::DirectJITCode::initializeCodeRef): Deleted.
+        * jit/JITCode.h:
+        (JSC::JITCode::executableAddress): Deleted.
+        * jit/JITEntryPoints.h: Added.
+        (JSC::JITEntryPoints::JITEntryPoints):
+        (JSC::JITEntryPoints::entryFor):
+        (JSC::JITEntryPoints::setEntryFor):
+        (JSC::JITEntryPoints::offsetOfEntryFor):
+        (JSC::JITEntryPoints::registerEntryTypeForArgumentCount):
+        (JSC::JITEntryPoints::registerEntryTypeForArgumentType):
+        (JSC::JITEntryPoints::clearEntries):
+        (JSC::JITEntryPoints::operator=):
+        (JSC::JITEntryPointsWithRef::JITEntryPointsWithRef):
+        (JSC::JITEntryPointsWithRef::codeRef):
+        (JSC::argumentsLocationFor):
+        (JSC::registerEntryPointTypeFor):
+        (JSC::entryPointTypeFor):
+        (JSC::thunkEntryPointTypeFor):
+        (JSC::JITJSCallThunkEntryPointsWithRef::JITJSCallThunkEntryPointsWithRef):
+        (JSC::JITJSCallThunkEntryPointsWithRef::entryFor):
+        (JSC::JITJSCallThunkEntryPointsWithRef::setEntryFor):
+        (JSC::JITJSCallThunkEntryPointsWithRef::offsetOfEntryFor):
+        (JSC::JITJSCallThunkEntryPointsWithRef::clearEntries):
+        (JSC::JITJSCallThunkEntryPointsWithRef::codeRef):
+        (JSC::JITJSCallThunkEntryPointsWithRef::operator=):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileJITEntryNativeCall):
+        (JSC::JIT::privateCompileCTINativeCall): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileJITEntryNativeCall):
+        (JSC::JIT::privateCompileCTINativeCall): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::jitEntryNativeCall):
+        (JSC::JITThunks::jitEntryNativeConstruct):
+        (JSC::JITThunks::jitEntryStub):
+        (JSC::JITThunks::jitCallThunkEntryStub):
+        (JSC::JITThunks::hostFunctionStub):
+        (JSC::JITThunks::ctiNativeCall): Deleted.
+        (JSC::JITThunks::ctiNativeConstruct): Deleted.
+        * jit/JITThunks.h:
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfNotInt32):
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::argumentRegisters):
+        * jit/RegisterSet.h:
+        * jit/Repatch.cpp:
+        (JSC::linkSlowFor):
+        (JSC::revertCall):
+        (JSC::unlinkFor):
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::checkJSStringArgument):
+        (JSC::SpecializedThunkJIT::linkFailureHere):
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerator.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::createRegisterArgumentsSpillEntry):
+        (JSC::slowPathFor):
+        (JSC::linkCallThunkGenerator):
+        (JSC::linkDirectCallThunkGenerator):
+        (JSC::linkPolymorphicCallThunkGenerator):
+        (JSC::virtualThunkFor):
+        (JSC::nativeForGenerator):
+        (JSC::nativeCallGenerator):
+        (JSC::nativeTailCallGenerator):
+        (JSC::nativeTailCallWithoutSavedTagsGenerator):
+        (JSC::nativeConstructGenerator):
+        (JSC::stringCharLoadRegCall):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::clz32ThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::truncThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::imulThunkGenerator):
+        (JSC::randomThunkGenerator):
+        (JSC::boundThisNoArgsFunctionCallGenerator):
+        * jit/ThunkGenerators.h:
+        * jsc.cpp:
+        (jscmain):
+        * llint/LLIntEntrypoint.cpp:
+        (JSC::LLInt::setFunctionEntrypoint):
+        (JSC::LLInt::setEvalEntrypoint):
+        (JSC::LLInt::setProgramEntrypoint):
+        (JSC::LLInt::setModuleProgramEntrypoint):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::setUpCall):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::generateThunkWithJumpTo):
+        (JSC::LLInt::functionForRegisterCallEntryThunkGenerator):
+        (JSC::LLInt::functionForStackCallEntryThunkGenerator):
+        (JSC::LLInt::functionForRegisterConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForStackConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForRegisterCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForStackCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForRegisterConstructArityCheckThunkGenerator):
+        (JSC::LLInt::functionForStackConstructArityCheckThunkGenerator):
+        (JSC::LLInt::functionForCallEntryThunkGenerator): Deleted.
+        (JSC::LLInt::functionForConstructEntryThunkGenerator): Deleted.
+        (JSC::LLInt::functionForCallArityCheckThunkGenerator): Deleted.
+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator): Deleted.
+        * llint/LLIntThunks.h:
+        * runtime/ArityCheckMode.h:
+        * runtime/ExecutableBase.cpp:
+        (JSC::ExecutableBase::clearCode):
+        * runtime/ExecutableBase.h:
+        (JSC::ExecutableBase::entrypointFor):
+        (JSC::ExecutableBase::offsetOfEntryFor):
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor): Deleted.
+        * runtime/JSBoundFunction.cpp:
+        (JSC::boundThisNoArgsFunctionCall):
+        * runtime/NativeExecutable.cpp:
+        (JSC::NativeExecutable::finishCreation):
+        * runtime/ScriptExecutable.cpp:
+        (JSC::ScriptExecutable::installCode):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::thunkGeneratorForIntrinsic):
+        (JSC::VM::clearCounters):
+        (JSC::VM::dumpCounters):
+        * runtime/VM.h:
+        (JSC::VM::getJITEntryStub):
+        (JSC::VM::getJITCallThunkEntryStub):
+        (JSC::VM::addressOfCounter):
+        (JSC::VM::counterFor):
+        * wasm/WasmBinding.cpp:
+        (JSC::Wasm::importStubGenerator):
+
+2016-12-09  Keith Miller  <keith_miller@apple.com>
+
+        Wasm should support call_indirect
+        https://bugs.webkit.org/show_bug.cgi?id=165718
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds support for call_indirect. The basic framework for
+        an indirect call is that the module holds a buffer containing a
+        stub for each function in the index space. Whenever a function
+        needs to do an indirect call it gets a index into that table. In
+        order to ensure call_indirect is calling a valid function the
+        functionIndexSpace also needs a pointer to a canonicalized
+        signature. When making an indirect call, we first check the index
+        is in range, then check the signature matches the value we were given.
+
+        This patch also differentiates between FunctionIndexSpaces and
+        ImmutableFunctionIndexSpaces. Since we don't know the size of the
+        FunctionIndexSpace when we start parsing we need to be able to
+        resize the IndexSpace. However, once we have finished parsing all
+        the sections we want to prevent an relocation of the function
+        index space pointer.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::B3IRGenerator::addCall):
+        (JSC::Wasm::B3IRGenerator::addCallIndirect):
+        (JSC::Wasm::createJSToWasmWrapper):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmB3IRGenerator.h:
+        * wasm/WasmCallingConvention.h:
+        (JSC::Wasm::CallingConvention::setupCall):
+        * wasm/WasmFormat.h:
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser::setErrorMessage):
+        (JSC::Wasm::FunctionParser<Context>::FunctionParser):
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::run):
+        * wasm/WasmPlan.h:
+        (JSC::Wasm::Plan::takeFunctionIndexSpace):
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::addCallIndirect):
+        (JSC::Wasm::validateFunction):
+        * wasm/WasmValidate.h:
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::create):
+        (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
+        * wasm/js/JSWebAssemblyModule.h:
+        (JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
+        (JSC::JSWebAssemblyModule::offsetOfFunctionIndexSpace):
+
+2016-12-09  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: implement data section
+        https://bugs.webkit.org/show_bug.cgi?id=165696
+
+        Reviewed by Keith Miller.
+
+        As specified in https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#data-section
+        Note that some of the interesting corner cases are ill-defined by the spec: https://github.com/WebAssembly/design/issues/897
+
+        * wasm/WasmFormat.h: segments are what represent sections of memory to initialize (similar to ELF's non-zero intializer data / rodata)
+        (JSC::Wasm::Segment::make):
+        (JSC::Wasm::Segment::destroy):
+        (JSC::Wasm::Segment::byte):
+        (JSC::Wasm::Segment::makePtr):
+        * wasm/WasmModuleParser.cpp: parse the data section, and prevent a few overflows if a user passes in UINT_MAX (the loops would overflow)
+        (JSC::Wasm::ModuleParser::parseType):
+        (JSC::Wasm::ModuleParser::parseImport):
+        (JSC::Wasm::ModuleParser::parseFunction):
+        (JSC::Wasm::ModuleParser::parseExport):
+        (JSC::Wasm::ModuleParser::parseCode):
+        (JSC::Wasm::ModuleParser::parseData):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::evaluate): the only sensible time to initialize the data section is after linking, but before calling start, I test for this but the spec isn't clear it's correct yet
+
+2016-12-09  Karim H  <karim@karhm.com>
+
+        It is okay to turn undefined into null because we are producing values for a
+        JSON representation (InspectorValue) and JSON has a `null` value and no
+        `undefined` value.
+        https://bugs.webkit.org/show_bug.cgi?id=165506
+
+        Reviewed by Darin Adler.
+
+        * bindings/ScriptValue.cpp:
+        (Inspector::jsToInspectorValue):
+
+2016-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r209554-209571): stress/poly-setter-combo crashing
+        https://bugs.webkit.org/show_bug.cgi?id=165669
+
+        Reviewed by Geoffrey Garen.
+        
+        We now rely on objects being zero-filled in a bunch of places, not just concurrent GC.
+        So, we need 32-bit to do it too.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+
+2016-12-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Annotate MediaStream and WebRTC idl with EnabledAtRuntime flag
+        https://bugs.webkit.org/show_bug.cgi?id=165251
+
+        Reviewed by Dean Jackson.
+
+        Based on a patch by Dr Alex Gouaillard <agouaillard@gmail.com>
+
+        * runtime/CommonIdentifiers.h: Add WebRTC and MediaStream identifiers.
+
+2016-12-09  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly JS API: implement start function
+        https://bugs.webkit.org/show_bug.cgi?id=165150
+
+        Reviewed by Saam Barati.
+
+        * wasm/WasmFormat.h: pass the start function around
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseTable): mark unreachable code
+        (JSC::Wasm::ModuleParser::parseGlobal): mark unreachable code
+        (JSC::Wasm::ModuleParser::parseStart): mark unreachable code
+        (JSC::Wasm::ModuleParser::parseElement): mark unreachable code
+        (JSC::Wasm::ModuleParser::parseData): mark unreachable code
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction): NFC: call the new function below
+        (JSC::WebAssemblyFunction::call): separate this out so that the start function can use it
+        * wasm/js/WebAssemblyFunction.h:
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::visitChildren): visit the start function
+        (JSC::WebAssemblyModuleRecord::link): handle start function
+        (JSC::WebAssemblyModuleRecord::evaluate): call the start function, if present
+        * wasm/js/WebAssemblyModuleRecord.h:
+
+2016-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        GC might be forced to look at a nuked object due to ordering of AllocatePropertyStorage, MaterializeNewObject, and PutStructure
+        https://bugs.webkit.org/show_bug.cgi?id=165672
+
+        Reviewed by Geoffrey Garen.
+        
+        We need to make sure that the shady stuff in a property put happens after the
+        PutByOffset, since the PutByOffset is the place where we materialize. More generally, we
+        should strive to not have any fenceposts between Nodes where a GC would be illegal.
+        
+        This gets us most of the way there by separating NukeStructureAndSetButterfly from
+        [Re]AllocatePropertyStorage. A transitioning put will now look something like:
+        
+            GetButterfly
+            ReallocatePropertyStorage
+            PutByOffset
+            NukeStructureAndSetButterfly
+            PutStructure
+        
+        Previously the structure would get nuked by ReallocatePropertyStorage, so if we placed
+        an object materialization just after it (before the PutByOffset) then any GC that
+        completed at that safepoint would encounter an unresolved visit race due to seeing a
+        nuked structure. We cannot have nuked structures at safepoints, and this change makes
+        sure that we don't - at least until someone tries to sink to the PutStructure. We will
+        eventually have to create a combined SetStructureAndButterfly node, but we don't need it
+        yet.
+        
+        This also fixes a goof where the DFG's AllocatePropertyStorage was nulling the structure
+        instead of nuking it. This could easily have caused many crashes in GC.
+        
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp:
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileNukeStructureAndSetButterfly):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNukeStructureAndSetButterfly):
+        (JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h: Fix a bug - make it possible to turn on concurrent GC optionally again.
+
+2016-12-09  Chris Dumez  <cdumez@apple.com>
+
+        Inline JSCell::toObject()
+        https://bugs.webkit.org/show_bug.cgi?id=165679
+
+        Reviewed by Geoffrey Garen.
+
+        Inline JSCell::toObject() as it shows on Speedometer profiles.
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toObjectSlow):
+        (JSC::JSCell::toObject): Deleted.
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::toObject):
+
+2016-12-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Deploy OrdinalNumber in JSC::SourceCode
+        https://bugs.webkit.org/show_bug.cgi?id=165687
+
+        Reviewed by Michael Saboff.
+
+        We have a lot of confusion between 1-based and 0-based counting in line
+        and column numbers. Let's use OrdinalNumber to clear up the confusion.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::link):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::functionDetails):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::setCode):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::firstLine):
+        (JSC::SourceCode::startColumn):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
+        * runtime/ScriptExecutable.h:
+        (JSC::ScriptExecutable::firstLine):
+        (JSC::ScriptExecutable::startColumn):
+        * tools/CodeProfile.h:
+        (JSC::CodeProfile::CodeProfile):
+
+2016-12-09  Saam Barati  <sbarati@apple.com>
+
+        WebAssembly JS API: implement importing and defining Memory
+        https://bugs.webkit.org/show_bug.cgi?id=164134
+
+        Reviewed by Keith Miller.
+
+        This patch implements the WebAssembly.Memory object. It refactors
+        the code to now associate a Memory with the instance instead of
+        the Module.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (functionTestWasmModuleFunctions):
+        * runtime/VM.h:
+        * shell/CMakeLists.txt:
+        * testWasm.cpp: Removed.
+        This has bitrotted. I'm removing it.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::sizeOfLoadOp):
+        (JSC::Wasm::createJSToWasmWrapper):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmB3IRGenerator.h:
+        * wasm/WasmFormat.cpp:
+        (JSC::Wasm::ModuleInformation::~ModuleInformation): Deleted.
+        * wasm/WasmFormat.h:
+        * wasm/WasmMemory.cpp:
+        (JSC::Wasm::Memory::Memory):
+        * wasm/WasmMemory.h:
+        (JSC::Wasm::Memory::size):
+        (JSC::Wasm::Memory::initial):
+        (JSC::Wasm::Memory::maximum):
+        (JSC::Wasm::Memory::pinnedRegisters): Deleted.
+        * wasm/WasmMemoryInformation.cpp: Added.
+        (JSC::Wasm::MemoryInformation::MemoryInformation):
+        * wasm/WasmMemoryInformation.h: Added.
+        (JSC::Wasm::MemoryInformation::MemoryInformation):
+        (JSC::Wasm::MemoryInformation::pinnedRegisters):
+        (JSC::Wasm::MemoryInformation::initial):
+        (JSC::Wasm::MemoryInformation::maximum):
+        (JSC::Wasm::MemoryInformation::isImport):
+        (JSC::Wasm::MemoryInformation::operator bool):
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseImport):
+        (JSC::Wasm::ModuleParser::parseMemoryHelper):
+        (JSC::Wasm::ModuleParser::parseMemory):
+        (JSC::Wasm::ModuleParser::parseExport):
+        * wasm/WasmModuleParser.h:
+        * wasm/WasmPageCount.h: Added. Implement a new way of describing Wasm
+        pages and then asking for how many bytes a quantity of pages is. This
+        class also makes it clear when we're talking about bytes or pages.
+
+        (JSC::Wasm::PageCount::PageCount):
+        (JSC::Wasm::PageCount::bytes):
+        (JSC::Wasm::PageCount::isValid):
+        (JSC::Wasm::PageCount::max):
+        (JSC::Wasm::PageCount::operator bool):
+        (JSC::Wasm::PageCount::operator<):
+        (JSC::Wasm::PageCount::operator>):
+        (JSC::Wasm::PageCount::operator>=):
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::run):
+        * wasm/WasmPlan.h:
+        (JSC::Wasm::Plan::memory): Deleted.
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::hasMemory):
+        (JSC::Wasm::Validate::Validate):
+        (JSC::Wasm::validateFunction):
+        * wasm/WasmValidate.h:
+        * wasm/generateWasmValidateInlinesHeader.py:
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::visitChildren):
+        * wasm/js/JSWebAssemblyInstance.h:
+        (JSC::JSWebAssemblyInstance::memory):
+        (JSC::JSWebAssemblyInstance::setMemory):
+        (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
+        (JSC::JSWebAssemblyInstance::allocationSize):
+        * wasm/js/JSWebAssemblyMemory.cpp:
+        (JSC::JSWebAssemblyMemory::create):
+        (JSC::JSWebAssemblyMemory::JSWebAssemblyMemory):
+        (JSC::JSWebAssemblyMemory::buffer):
+        (JSC::JSWebAssemblyMemory::visitChildren):
+        * wasm/js/JSWebAssemblyMemory.h:
+        (JSC::JSWebAssemblyMemory::memory):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        Handle importing and creating of memory according
+        to the spec. This also does the needed validation
+        of making sure the memory defined in the module
+        is compatible with the imported memory.
+
+        (JSC::constructJSWebAssemblyInstance):
+        * wasm/js/WebAssemblyMemoryConstructor.cpp:
+        (JSC::constructJSWebAssemblyMemory):
+        (JSC::callJSWebAssemblyMemory):
+        * wasm/js/WebAssemblyMemoryPrototype.cpp:
+        (JSC::webAssemblyMemoryProtoFuncBuffer):
+        (JSC::WebAssemblyMemoryPrototype::create):
+        (JSC::WebAssemblyMemoryPrototype::finishCreation):
+        * wasm/js/WebAssemblyMemoryPrototype.h:
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::finishCreation):
+        (JSC::WebAssemblyModuleRecord::link):
+
+2016-12-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Some resources fetched via Fetch API do not have data
+        https://bugs.webkit.org/show_bug.cgi?id=165230
+        <rdar://problem/29449220>
+
+        Reviewed by Alex Christensen.
+
+        * inspector/protocol/Page.json:
+        Add new Fetch Page.ResourceType.
+
+2016-12-09  Geoffrey Garen  <ggaren@apple.com>
+
+        TextPosition and OrdinalNumber should be more like idiomatic numbers
+        https://bugs.webkit.org/show_bug.cgi?id=165678
+
+        Reviewed by Filip Pizlo.
+
+        Adopt default constructor.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::OpaqueJSScript):
+        * jsc.cpp:
+        (functionCheckModuleSyntax):
+        * parser/SourceCode.h:
+        (JSC::makeSource):
+        * parser/SourceProvider.h:
+        (JSC::StringSourceProvider::create):
+        (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+
+2016-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, disable concurrent GC for real.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, disable concurrent GC while crashes get investigated.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        JSSegmentedVariableObject should keep its state private
+
+        Rubber stamped by Michael Saboff.
+        
+        Its state fields were protected for no reason. They really should be private because
+        you have to know to obey a particular concurrency protocol when accessing them.
+
+        * runtime/JSSegmentedVariableObject.h:
+
+2016-12-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed ARM buildfix after 209570.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::or32): Added.
+
+2016-12-08  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: JSC::link* shouldn't need a CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=165591
+
+        Reviewed by Keith Miller.
+
+        Allow linking without a CodeBlock, which WebAssembly's wasm -> JS stubs does. This needs to work for polymorphic and virtual calls. This patch adds corresponding tests for this.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::shouldDumpDisassemblyFor): don't look at the tier option if there isn't a CodeBlock, only look at the global one. This is a WebAssembly function, so the tier information is irrelevant.
+        * jit/Repatch.cpp:
+        (JSC::isWebAssemblyToJSCallee): this is used in the link* functions below
+        (JSC::linkFor):
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        * runtime/Options.h: add an option to change the maximum number of polymorphic calls in stubs from wasm to JS, which will come in handy when we try to tune performance or try merging some of the WebAssembly stubs
+        * wasm/WasmBinding.cpp:
+        (JSC::Wasm::importStubGenerator): remove the breakpoint since the code now works
+        * wasm/js/WebAssemblyToJSCallee.h:
+
+2016-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        MultiPutByOffset should get a barrier if it transitions
+        https://bugs.webkit.org/show_bug.cgi?id=165646
+
+        Reviewed by Keith Miller.
+        
+        Previously, if we knew that we were storing a non-cell but we needed to transition, we
+        would fail to add the barrier but the FTL's lowering expected the barrier to be there.
+        
+        Strictly, we need to "consider" the barrier on MultiPutByOffset if the value is
+        possibly a cell or if the MultiPutByOffset may transition. Then "considering" the
+        barrier implies checking if the base is possibly old.
+        
+        But because the barrier is so cheap anyway, this patch implements something safer: we
+        just consider the barrier on MultiPutByOffset unconditionally, which opts it out of any
+        barrier optimizations other than those based on the predicted state of the base. Those
+        optimizations are already sound - for example they use doesGC() to detect safepoints
+        and that function correctly predicts when MultiPutByOffset could GC.
+        
+        Because the barrier optimizations are only a very small speed-up, I think it's great to
+        fix bugs by weakening the optimizer without cleverness.
+
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::assertValidCell):
+
+2016-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Enable concurrent GC on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=165643
+
+        Reviewed by Saam Barati.
+
+        It looks stable enough to enable.
+
+        * assembler/CPU.h:
+        (JSC::useGCFences): Deleted.
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::mutatorFence):
+        (JSC::AssemblyHelpers::storeButterfly):
+        (JSC::AssemblyHelpers::nukeStructureAndStoreButterfly):
+        (JSC::AssemblyHelpers::emitInitializeInlineStorage):
+        (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Disable collectContinuously if not useConcurrentGC
+
+        Rubber stamped by Geoffrey Garen.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop build.
+
+        * runtime/JSObject.h:
+
+2016-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Concurrent GC should be stable enough to land enabled on X86_64
+        https://bugs.webkit.org/show_bug.cgi?id=164990
+
+        Reviewed by Geoffrey Garen.
+        
+        This fixes a ton of performance and correctness bugs revealed by getting the concurrent GC to
+        be stable enough to land enabled.
+        
+        I had to redo the JSObject::visitChildren concurrency protocol again. This time I think it's
+        even more correct than ever!
+        
+        This is an enormous win on JetStream/splay-latency and Octane/SplayLatency. It looks to be
+        mostly neutral on everything else, though Speedometer is showing statistically weak signs of a
+        slight regression.
+
+        * API/JSAPIWrapperObject.mm: Added locking.
+        (JSC::JSAPIWrapperObject::visitChildren):
+        * API/JSCallbackObject.h: Added locking.
+        (JSC::JSCallbackObjectData::visitChildren):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): This had a TOCTOU race on shouldJettisonDueToOldAge.
+        (JSC::EvalCodeCache::visitAggregate): Moved to EvalCodeCache.cpp.
+        * bytecode/DirectEvalCodeCache.cpp: Added. Outlined some functions and made them use locks.
+        (JSC::DirectEvalCodeCache::setSlow):
+        (JSC::DirectEvalCodeCache::clear):
+        (JSC::DirectEvalCodeCache::visitAggregate):
+        * bytecode/DirectEvalCodeCache.h:
+        (JSC::DirectEvalCodeCache::set):
+        (JSC::DirectEvalCodeCache::clear): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp: Added locking.
+        (JSC::UnlinkedCodeBlock::visitChildren):
+        (JSC::UnlinkedCodeBlock::setInstructions):
+        (JSC::UnlinkedCodeBlock::shrinkToFit):
+        * bytecode/UnlinkedCodeBlock.h: Added locking.
+        (JSC::UnlinkedCodeBlock::addRegExp):
+        (JSC::UnlinkedCodeBlock::addConstant):
+        (JSC::UnlinkedCodeBlock::addFunctionDecl):
+        (JSC::UnlinkedCodeBlock::addFunctionExpr):
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary):
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+        * debugger/Debugger.cpp: Use the right delete API.
+        (JSC::Debugger::recompileAllJSFunctions):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Fix a pre-existing bug in ToFunction constant folding.
+        * dfg/DFGClobberize.h: Add support for nuking.
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp: Add support for nuking.
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGFixupPhase.cpp: Add support for nuking.
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::indexForChecks):
+        (JSC::DFG::FixupPhase::originForCheck):
+        (JSC::DFG::FixupPhase::speculateForBarrier):
+        (JSC::DFG::FixupPhase::insertCheck):
+        (JSC::DFG::FixupPhase::fixupChecksInBlock):
+        * dfg/DFGSpeculativeJIT.cpp: Add support for nuking.
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * ftl/FTLLowerDFGToB3.cpp: Add support for nuking.
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
+        (JSC::FTL::DFG::LowerDFGToB3::nukeStructureAndSetButterfly):
+        (JSC::FTL::DFG::LowerDFGToB3::setButterfly): Deleted.
+        * heap/CodeBlockSet.cpp: We need to be more careful about the CodeBlockSet workflow during GC, since we will allocate CodeBlocks in eden while collecting.
+        (JSC::CodeBlockSet::clearMarksForFullCollection):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        * heap/Heap.cpp: Added code to measure max pauses. Added a better collectContinuously mode.
+        (JSC::Heap::lastChanceToFinalize): Stop the collectContinuously thread.
+        (JSC::Heap::harvestWeakReferences): Inline SlotVisitor::harvestWeakReferences.
+        (JSC::Heap::finalizeUnconditionalFinalizers): Inline SlotVisitor::finalizeUnconditionalReferences.
+        (JSC::Heap::markToFixpoint): We need to do some MarkedSpace stuff before every conservative scan, rather than just at the start of marking, so we now call prepareForConservativeScan() before each conservative scan. Also call a less-parallel version of drainInParallel when the mutator is running.
+        (JSC::Heap::collectInThread): Inline Heap::prepareForAllocation().
+        (JSC::Heap::stopIfNecessarySlow): We need to be more careful about ensuring that we run finalization before and after stopping. Also, we should sanitize stack when stopping the world.
+        (JSC::Heap::acquireAccessSlow): Add some optional debug prints.
+        (JSC::Heap::handleNeedFinalize): Assert that we are running this when the world is not stopped.
+        (JSC::Heap::finalize): Remove the old collectContinuously code.
+        (JSC::Heap::requestCollection): We don't need to sanitize stack here anymore.
+        (JSC::Heap::notifyIsSafeToCollect): Start the collectContinuously thread. It will request collection 1 KHz.
+        (JSC::Heap::prepareForAllocation): Deleted.
+        (JSC::Heap::preventCollection): Prevent any new concurrent GCs from being initiated.
+        (JSC::Heap::allowCollection):
+        (JSC::Heap::forEachSlotVisitor): Allows us to safely iterate slot visitors.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::writeBarrier): If the 'to' cell is not NewWhite then it could be AnthraciteOrBlack. During a full collection, objects may be AnthraciteOrBlack from a previous GC. Turns out, we don't benefit from this optimization so we can just kill it.
+        * heap/HeapSnapshotBuilder.cpp:
+        (JSC::HeapSnapshotBuilder::buildSnapshot): This needs to use PreventCollectionScope to ensure snapshot soundness.
+        * heap/ListableHandler.h:
+        (JSC::ListableHandler::isOnList): Useful helper.
+        * heap/LockDuringMarking.h:
+        (JSC::lockDuringMarking): It's a locker that only locks while we're marking.
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::addBlock): Hold the bitvector lock while resizing.
+        * heap/MarkedBlock.cpp: Hold the bitvector lock while accessing the bitvectors while the mutator is running.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::prepareForConservativeScan): We used to do this in prepareForMarking, but we need to do it before each conservative scan not just before marking.
+        (JSC::MarkedSpace::prepareForMarking): Remove the logic moved to prepareForConservativeScan.
+        * heap/MarkedSpace.h:
+        * heap/PreventCollectionScope.h: Added.
+        * heap/SlotVisitor.cpp: Refactored drainFromShared so that we can write a similar function called drainInParallelPassively.
+        (JSC::SlotVisitor::updateMutatorIsStopped): Update whether we can use "fast" scanning.
+        (JSC::SlotVisitor::mutatorIsStoppedIsUpToDate):
+        (JSC::SlotVisitor::didReachTermination):
+        (JSC::SlotVisitor::hasWork):
+        (JSC::SlotVisitor::drain): This now uses the rightToRun lock to allow the main GC thread to safepoint the workers.
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::drainInParallelPassively): This runs marking with one fewer threads than normal. It's useful for when we have resumed the mutator, since then the mutator has a better chance of getting on a core.
+        (JSC::SlotVisitor::addWeakReferenceHarvester):
+        (JSC::SlotVisitor::addUnconditionalFinalizer):
+        (JSC::SlotVisitor::harvestWeakReferences): Deleted.
+        (JSC::SlotVisitor::finalizeUnconditionalFinalizers): Deleted.
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h: Outline stuff.
+        (JSC::SlotVisitor::addWeakReferenceHarvester): Deleted.
+        (JSC::SlotVisitor::addUnconditionalFinalizer): Deleted.
+        * runtime/InferredType.cpp: This needed thread safety.
+        (JSC::InferredType::visitChildren): This needs to keep its structure finalizer alive until it runs.
+        (JSC::InferredType::set):
+        (JSC::InferredType::InferredStructureFinalizer::finalizeUnconditionally):
+        * runtime/InferredType.h:
+        * runtime/InferredValue.cpp: This needed thread safety.
+        (JSC::InferredValue::visitChildren):
+        (JSC::InferredValue::ValueCleanup::finalizeUnconditionally):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCountSlowCase): Update to use new butterfly API.
+        (JSC::JSArray::unshiftCountWithArrayStorage): Update to use new butterfly API.
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::visitChildren): Thread safety.
+        * runtime/JSCell.h:
+        (JSC::JSCell::setStructureIDDirectly): This is used for nuking the structure.
+        (JSC::JSCell::InternalLocker::InternalLocker): Deleted. The cell is now the lock.
+        (JSC::JSCell::InternalLocker::~InternalLocker): Deleted. The cell is now the lock.
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::structure): Clean this up.
+        (JSC::JSCell::lock): The cell is now the lock.
+        (JSC::JSCell::tryLock):
+        (JSC::JSCell::unlock):
+        (JSC::JSCell::isLocked):
+        (JSC::JSCell::lockInternalLock): Deleted.
+        (JSC::JSCell::unlockInternalLock): Deleted.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren): Thread safety.
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren): Thread safety.
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory): Thread safety.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markAuxiliaryAndVisitOutOfLineProperties): Factor out this "easy" step of butterfly visiting.
+        (JSC::JSObject::visitButterfly): Make this achieve 100% precision about structure-butterfly relationships. This relies on the mutator "nuking" the structure prior to "locked" structure-butterfly transitions.
+        (JSC::JSObject::visitChildren): Use the new, nicer API.
+        (JSC::JSFinalObject::visitChildren): Use the new, nicer API.
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists): Use the new butterfly API.
+        (JSC::JSObject::createInitialUndecided): Use the new butterfly API.
+        (JSC::JSObject::createInitialInt32): Use the new butterfly API.
+        (JSC::JSObject::createInitialDouble): Use the new butterfly API.
+        (JSC::JSObject::createInitialContiguous): Use the new butterfly API.
+        (JSC::JSObject::createArrayStorage): Use the new butterfly API.
+        (JSC::JSObject::convertUndecidedToContiguous): Use the new butterfly API.
+        (JSC::JSObject::convertUndecidedToArrayStorage): Use the new butterfly API.
+        (JSC::JSObject::convertInt32ToArrayStorage): Use the new butterfly API.
+        (JSC::JSObject::convertDoubleToContiguous): Use the new butterfly API.
+        (JSC::JSObject::convertDoubleToArrayStorage): Use the new butterfly API.
+        (JSC::JSObject::convertContiguousToArrayStorage): Use the new butterfly API.
+        (JSC::JSObject::increaseVectorLength): Use the new butterfly API.
+        (JSC::JSObject::shiftButterflyAfterFlattening): Use the new butterfly API.
+        * runtime/JSObject.h:
+        (JSC::JSObject::setButterfly): This now does all of the fences. Only use this when you are not also transitioning the structure or the structure's lastOffset.
+        (JSC::JSObject::nukeStructureAndSetButterfly): Use this when doing locked structure-butterfly transitions.
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putDirectWithoutTransition): Use the newly factored out API.
+        (JSC::JSObject::prepareToPutDirectWithoutTransition): Factor this out!
+        (JSC::JSObject::putDirectInternal): Use the newly factored out API.
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::finishCreation): Locks!
+        (JSC::JSPropertyNameEnumerator::visitChildren): Locks!
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::visitChildren): Locks!
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren): Thread safety.
+        * runtime/ModuleProgramExecutable.cpp:
+        (JSC::ModuleProgramExecutable::visitChildren): Thread safety.
+        * runtime/Options.cpp: For now we disable concurrent GC on not-X86_64.
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h: Change the default max GC parallelism to 8. I don't know why it was still 7.
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::stackTracesAsJSON): This needs to defer GC before grabbing its lock.
+        * runtime/SparseArrayValueMap.cpp: This needed thread safety.
+        (JSC::SparseArrayValueMap::add):
+        (JSC::SparseArrayValueMap::remove):
+        (JSC::SparseArrayValueMap::visitChildren):
+        * runtime/SparseArrayValueMap.h:
+        * runtime/Structure.cpp: This had a race between addNewPropertyTransition and visitChildren.
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyTable):
+        (JSC::Structure::addNewPropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::add): Help out with nuking support - the m_offset needs to play along.
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h: Make some useful things public - like the notion of a lastOffset.
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren): Thread safety!
+        * runtime/StructureChain.h: Thread safety!
+        * runtime/StructureIDTable.cpp:
+        (JSC::StructureIDTable::allocateID): Ensure that we don't get nuked IDs.
+        * runtime/StructureIDTable.h: Add the notion of a nuked ID! It's a bit that the runtime never sees except during specific shady actions like locked structure-butterfly transitions. "Nuking" tells the GC to steer clear and rescan once we fire the barrier.
+        (JSC::nukedStructureIDBit):
+        (JSC::nuke):
+        (JSC::isNuked):
+        (JSC::decontaminate):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::hasIndexingHeader): Better API.
+        (JSC::Structure::add):
+        * runtime/VM.cpp: Better GC interaction.
+        (JSC::VM::ensureWatchdog):
+        (JSC::VM::deleteAllLinkedCode):
+        (JSC::VM::deleteAllCode):
+        * runtime/VM.h:
+        (JSC::VM::getStructure): Why wasn't this always an API!
+        * runtime/WebAssemblyExecutable.cpp:
+        (JSC::WebAssemblyExecutable::visitChildren): Thread safety.
+
+2016-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Enable SharedArrayBuffer, remove the flag
+        https://bugs.webkit.org/show_bug.cgi?id=165614
+
+        Rubber stamped by Geoffrey Garen.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/RuntimeFlags.h:
+
+2016-12-08  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly JS API: wire up Instance imports
+        https://bugs.webkit.org/show_bug.cgi?id=165118
+
+        Reviewed by Saam Barati.
+
+        Change a bunch of the WebAssembly object model, and pipe the
+        necessary changes to be able to call JS imports from
+        WebAssembly. This will make it easier to call_indirect, and
+        unblock many other missing features.
+
+        As a follow-up I need to teach JSC::linkFor to live without a
+        CodeBlock: wasm doesn't have one and the IC patching is sad. We'll
+        switch on the callee (or its type?) and then use that as the owner
+        (because the callee is alive if the instance is alive, ditto
+        module, and module owns the CallLinkInfo).
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callee): give access to the callee as a JSCell
+        * jit/RegisterSet.cpp: dead code from previous WebAssembly implementation
+        * jsc.cpp:
+        (callWasmFunction):
+        (functionTestWasmModuleFunctions):
+        * runtime/JSCellInlines.h:
+        (JSC::ExecState::vm): check callee instead of jsCallee: wasm only has a JSCell and not a JSObject
+        * runtime/VM.cpp:
+        (JSC::VM::VM): store the "top" WebAssembly.Instance on entry to WebAssembly (and restore the previous one on exit)
+        * runtime/VM.h:
+        * testWasm.cpp:
+        (runWasmTests):
+        * wasm/JSWebAssembly.h:
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator): pass unlinked calls around to shorten their lifetime: they're ony needed until the Plan is done
+        (JSC::Wasm::B3IRGenerator::addCall):
+        (JSC::Wasm::createJSToWasmWrapper):
+        (JSC::Wasm::parseAndCompile): also pass in the function index space, so that imports can be signature-checked along with internal functions
+        * wasm/WasmB3IRGenerator.h:
+        * wasm/WasmBinding.cpp: Added.
+        (JSC::Wasm::importStubGenerator): stubs from wasm to JS
+        * wasm/WasmBinding.h: Copied from Source/JavaScriptCore/wasm/WasmValidate.h.
+        * wasm/WasmCallingConvention.h:
+        (JSC::Wasm::CallingConvention::setupFrameInPrologue):
+        * wasm/WasmFormat.h: fix the object model
+        (JSC::Wasm::CallableFunction::CallableFunction):
+        * wasm/WasmFunctionParser.h: simplify some of the failure condition checks
+        (JSC::Wasm::FunctionParser<Context>::FunctionParser): need function index space, not just internal functions
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmModuleParser.cpp: early-create some of the structures which will be needed later
+        (JSC::Wasm::ModuleParser::parseImport):
+        (JSC::Wasm::ModuleParser::parseFunction):
+        (JSC::Wasm::ModuleParser::parseMemory):
+        (JSC::Wasm::ModuleParser::parseExport):
+        (JSC::Wasm::ModuleParser::parseCode):
+        * wasm/WasmModuleParser.h:
+        (JSC::Wasm::ModuleParser::functionIndexSpace):
+        (JSC::Wasm::ModuleParser::functionLocations):
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::consumeUTF8String):
+        * wasm/WasmPlan.cpp: pass around the wasm objects at the right time, reducing their lifetime and making it easier to pass them around when needed
+        (JSC::Wasm::Plan::run):
+        (JSC::Wasm::Plan::initializeCallees):
+        * wasm/WasmPlan.h:
+        (JSC::Wasm::Plan::exports):
+        (JSC::Wasm::Plan::internalFunctionCount):
+        (JSC::Wasm::Plan::jsToWasmEntryPointForFunction):
+        (JSC::Wasm::Plan::takeModuleInformation):
+        (JSC::Wasm::Plan::takeCallLinkInfos):
+        (JSC::Wasm::Plan::takeWasmToJSStubs):
+        (JSC::Wasm::Plan::takeFunctionIndexSpace):
+        * wasm/WasmValidate.cpp: check function index space instead of only internal functions
+        (JSC::Wasm::Validate::addCall):
+        (JSC::Wasm::validateFunction):
+        * wasm/WasmValidate.h:
+        * wasm/js/JSWebAssemblyCallee.cpp:
+        (JSC::JSWebAssemblyCallee::finishCreation):
+        * wasm/js/JSWebAssemblyCallee.h:
+        (JSC::JSWebAssemblyCallee::create):
+        (JSC::JSWebAssemblyCallee::jsToWasmEntryPoint):
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::create):
+        (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
+        (JSC::JSWebAssemblyInstance::visitChildren):
+        * wasm/js/JSWebAssemblyInstance.h: hold the import functions off the end of the Instance
+        (JSC::JSWebAssemblyInstance::importFunction):
+        (JSC::JSWebAssemblyInstance::importFunctions):
+        (JSC::JSWebAssemblyInstance::setImportFunction):
+        (JSC::JSWebAssemblyInstance::offsetOfImportFunctions):
+        (JSC::JSWebAssemblyInstance::offsetOfImportFunction):
+        (JSC::JSWebAssemblyInstance::allocationSize):
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::create):
+        (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
+        (JSC::JSWebAssemblyModule::visitChildren):
+        * wasm/js/JSWebAssemblyModule.h: hold the link call info, the import function stubs, and the function index space
+        (JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
+        (JSC::JSWebAssemblyModule::importCount):
+        (JSC::JSWebAssemblyModule::calleeFromFunctionIndexSpace):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction): set top Instance on VM
+        * wasm/js/WebAssemblyFunction.h:
+        (JSC::WebAssemblyFunction::instance):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance): handle function imports
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule): generate the stubs for import functions
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::link):
+        * wasm/js/WebAssemblyToJSCallee.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp.
+        (JSC::WebAssemblyToJSCallee::create): dummy JSCell singleton which lives on the VM, and is put as the callee in the import stub's frame to identified it when unwinding
+        (JSC::WebAssemblyToJSCallee::createStructure):
+        (JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
+        (JSC::WebAssemblyToJSCallee::finishCreation):
+        (JSC::WebAssemblyToJSCallee::destroy):
+        * wasm/js/WebAssemblyToJSCallee.h: Copied from Source/JavaScriptCore/wasm/WasmB3IRGenerator.h.
+
+2016-12-08  Mark Lam  <mark.lam@apple.com>
+
+        Enable JSC restricted options by default in the jsc shell.
+        https://bugs.webkit.org/show_bug.cgi?id=165615
+
+        Reviewed by Keith Miller.
+
+        The jsc shell is only used for debugging and development testing.  We should
+        allow it to use restricted options like JSC_useDollarVM even for release builds.
+
+        * jsc.cpp:
+        (jscmain):
+        * runtime/Options.cpp:
+        (JSC::Options::enableRestrictedOptions):
+        (JSC::Options::isAvailable):
+        (JSC::allowRestrictedOptions): Deleted.
+        * runtime/Options.h:
+
+2016-12-08  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r209489.
+
+        Likely caused large regressions on JetStream, Sunspider and
+        Speedometer
+
+        Reverted changeset:
+
+        "Add system trace points for JavaScript VM entry/exit"
+        https://bugs.webkit.org/show_bug.cgi?id=165550
+        http://trac.webkit.org/changeset/209489
+
+2016-12-08  Keith Miller  <keith_miller@apple.com>
+
+        Move LEB tests to API tests
+        https://bugs.webkit.org/show_bug.cgi?id=165586
+
+        Reviewed by Saam Barati.
+
+        Delete old stuff.
+
+        * testWasm.cpp:
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        (main):
+        (runLEBTests): Deleted.
+
+2016-12-07  JF Bastien  <jfbastien@apple.com>
+
+        Cleanup WebAssembly's RETURN_IF_EXCEPTION
+        https://bugs.webkit.org/show_bug.cgi?id=165595
+
+        Reviewed by Filip Pizlo.
+
+        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
+        (JSC::constructJSWebAssemblyCompileError):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction):
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
+        (JSC::constructJSWebAssemblyRuntimeError):
+
+2016-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Renamed SourceCode members to match their accessor names
+        https://bugs.webkit.org/show_bug.cgi?id=165573
+
+        Reviewed by Keith Miller.
+
+        startChar => startOffset
+        endChar => endOffset
+
+        * parser/UnlinkedSourceCode.h:
+        (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
+        (JSC::UnlinkedSourceCode::view):
+        (JSC::UnlinkedSourceCode::startOffset):
+        (JSC::UnlinkedSourceCode::endOffset):
+        (JSC::UnlinkedSourceCode::length):
+
+2016-12-07  Keith Miller  <keith_miller@apple.com>
+
+        Add more missing trivial wasm ops.
+        https://bugs.webkit.org/show_bug.cgi?id=165564
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds the nop, drop, and tee_local opcodes.
+        It also fixes an issue where we were not generating
+        the proper enums for the grow_memory and current_memory
+        opcodes.
+
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/generateWasmOpsHeader.py:
+
+2016-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Renamed source => parentSource
+        https://bugs.webkit.org/show_bug.cgi?id=165570
+
+        Reviewed by Keith Miller.
+
+        For less confuse.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+
+2016-12-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Drop translate phase in module loader
+        https://bugs.webkit.org/show_bug.cgi?id=164861
+
+        Reviewed by Saam Barati.
+
+        Originally, this "translate" phase was introduced to the module loader.
+        However, recent rework discussion[1] starts dropping this phase.
+        And this "translate" phase is meaningless in the browser side module loader
+        since this phase originally mimics the node.js's translation hook (like,
+        transpiling CoffeeScript source to JavaScript).
+
+        This "translate" phase is not necessary for the exposed HTML5
+        <script type="module"> tag right now. Once the module loader pipeline is
+        redefined and specified, we need to update the current loader anyway.
+        So dropping "translate" phase right now is OK.
+
+        This a bit simplifies the current module loader pipeline.
+
+        [1]: https://github.com/whatwg/loader/issues/147
+
+        * builtins/ModuleLoaderPrototype.js:
+        (newRegistryEntry):
+        (fulfillFetch):
+        (requestFetch):
+        (requestInstantiate):
+        (provide):
+        (fulfillTranslate): Deleted.
+        (requestTranslate): Deleted.
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * jsc.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::translate): Deleted.
+        * runtime/JSModuleLoader.h:
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeInstantiate):
+        (JSC::moduleLoaderPrototypeTranslate): Deleted.
+
+2016-12-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add ability to distinguish if a Script was parsed as a module
+        https://bugs.webkit.org/show_bug.cgi?id=164900
+        <rdar://problem/29323817>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        * inspector/protocol/Debugger.json:
+        Add an optional event parameter to distinguish if a script was a module or not.
+
+2016-12-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Add system trace points for JavaScript VM entry/exit
+        https://bugs.webkit.org/show_bug.cgi?id=165550
+
+        Reviewed by Tim Horton.
+
+        Add trace points for entry/exit into/out of the JS VM.
+
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::~VMEntryScope):
+
+2016-12-06  Keith Miller  <keith_miller@apple.com>
+
+        Add support for truncation operators
+        https://bugs.webkit.org/show_bug.cgi?id=165519
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds initial support for truncation operators. The current patch
+        does range based out of bounds checking, in the future we should use system
+        register flags on ARM and other tricks on X86 improve the performance of
+        these opcodes.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARM64::truncateDoubleToInt64):
+        (JSC::MacroAssemblerARM64::truncateDoubleToUint64):
+        (JSC::MacroAssemblerARM64::truncateFloatToInt32):
+        (JSC::MacroAssemblerARM64::truncateFloatToUint32):
+        (JSC::MacroAssemblerARM64::truncateFloatToInt64):
+        (JSC::MacroAssemblerARM64::truncateFloatToUint64):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::truncateFloatToInt32):
+        (JSC::MacroAssemblerX86Common::truncateDoubleToUint32): Deleted.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::truncateDoubleToUint32):
+        (JSC::MacroAssemblerX86_64::truncateDoubleToInt64):
+        (JSC::MacroAssemblerX86_64::truncateDoubleToUint64):
+        (JSC::MacroAssemblerX86_64::truncateFloatToUint32):
+        (JSC::MacroAssemblerX86_64::truncateFloatToInt64):
+        (JSC::MacroAssemblerX86_64::truncateFloatToUint64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cvttss2si_rr):
+        (JSC::X86Assembler::cvttss2siq_rr):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncSF32>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32TruncUF32>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncSF32>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64TruncUF32>):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+
+2016-12-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused and mostly untested Page domain commands and events
+        https://bugs.webkit.org/show_bug.cgi?id=165507
+
+        Reviewed by Brian Burg.
+
+        Remove unused and unsupported commands and events.
+
+          - Page.setDocumentContent
+          - Page.getScriptExecutionStatus
+          - Page.setScriptExecutionDisabled
+          - Page.handleJavaScriptDialog
+          - Page.javascriptDialogOpening
+          - Page.javascriptDialogClosed
+          - Page.scriptsEnabled
+
+        * inspector/protocol/Page.json:
+
+2016-12-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Merge PromiseReactions
+        https://bugs.webkit.org/show_bug.cgi?id=165526
+
+        Reviewed by Sam Weinig.
+
+        Our promise implementation has two arrays per Promise; promiseFulfillReactions and promiseRejectReactions.
+        And everytime we call `promise.then`, we create two promise reactions for fullfill and reject.
+        However, these two reactions and the arrays for reactions can be merged into one array and one reaction.
+        It reduces the unnecessary object allocations.
+
+        No behavior change.
+
+        * builtins/BuiltinNames.h:
+        * builtins/PromiseOperations.js:
+        (globalPrivate.newPromiseReaction):
+        (globalPrivate.triggerPromiseReactions):
+        (globalPrivate.rejectPromise):
+        (globalPrivate.fulfillPromise):
+        (globalPrivate.promiseReactionJob):
+        (globalPrivate.initializePromise):
+        * builtins/PromisePrototype.js:
+        (then):
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::finishCreation):
+
+2016-12-06  Mark Lam  <mark.lam@apple.com>
+
+        GetByID IC is wrongly unwrapping the global proxy this value for getter/setters.
+        https://bugs.webkit.org/show_bug.cgi?id=165401
+
+        Reviewed by Saam Barati.
+
+        When the this value for a property access is the JS global and that property
+        access is via a GetterSetter, the underlying getter / setter functions would
+        expect the this value they receive to be the JSProxy instance instead of the
+        JSGlobalObject.  This is consistent with how the LLINT and runtime code behaves.
+        The IC code should behave the same way.
+
+        Also added some ASSERTs to document invariants in the code, and help detect
+        bugs sooner if the code gets changed in a way that breaks those invariants in
+        the future.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+
+2016-12-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        DumpRenderTree ASSERT in JSC::ExecutableBase::isHostFunction seen on bots
+        https://bugs.webkit.org/show_bug.cgi?id=165497
+        <rdar://problem/29538973>
+
+        Reviewed by Saam Barati.
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        Defer collection when extracting and processing the samples to avoid
+        any objects held by the samples from getting collected while processing.
+        This is because while processing we call into functions that can
+        allocate and we must prevent those functions from syncing with the
+        GC thread which may collect other sample data yet to be processed.
+
+2016-12-06  Alexey Proskuryakov  <ap@apple.com>
+
+        Correct SDKROOT values in xcconfig files
+        https://bugs.webkit.org/show_bug.cgi?id=165487
+        rdar://problem/29539209
+
+        Reviewed by Dan Bernstein.
+
+        Fix suggested by Dan Bernstein.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2016-12-06  Saam Barati  <sbarati@apple.com>
+
+        Remove old Wasm object model
+        https://bugs.webkit.org/show_bug.cgi?id=165481
+
+        Reviewed by Keith Miller and Mark Lam.
+
+        It's confusing to see code that consults both the old
+        Wasm object model alongside the new one. The old object
+        model is not a thing, and it's not being used. Let's
+        remove it now to prevent further confusion.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeLLIntInlineCaches):
+        (JSC::CodeBlock::replacement):
+        (JSC::CodeBlock::computeCapabilityLevel):
+        (JSC::CodeBlock::updateAllPredictions):
+        * bytecode/CodeBlock.h:
+        * bytecode/WebAssemblyCodeBlock.cpp: Removed.
+        * bytecode/WebAssemblyCodeBlock.h: Removed.
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::isSupportedForInlining):
+        * interpreter/Interpreter.cpp:
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::isWebAssemblyExecutable): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * runtime/ExecutableBase.cpp:
+        (JSC::ExecutableBase::clearCode):
+        * runtime/ExecutableBase.h:
+        (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::isBuiltinFunction):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * runtime/WebAssemblyExecutable.cpp: Removed.
+        * runtime/WebAssemblyExecutable.h: Removed.
+
+2016-12-06  JF Bastien  <jfbastien@apple.com>
+
+        PureNaN: fix typo
+        https://bugs.webkit.org/show_bug.cgi?id=165493
+
+        Reviewed by Mark Lam.
+
+        * runtime/PureNaN.h:
+
+2016-12-06  Mark Lam  <mark.lam@apple.com>
+
+        Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=165227
+        <rdar://problem/29442665>
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        - This is where we check for immutable prototype exotic objects and refuse to set
+          the prototype if needed.
+          See https://tc39.github.io/ecma262/#sec-immutable-prototype-exotic-objects.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::isImmutablePrototypeExoticObject):
+        * runtime/Structure.h:
+        - Add flag for declaring immutable prototype exotic objects.
+
+        * runtime/ObjectPrototype.h:
+        - Declare that Object.prototype is an immutable prototype exotic object.
+          See https://tc39.github.io/ecma262/#sec-properties-of-the-object-prototype-object.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        - Use better error messages.
+
+2016-12-04  Darin Adler  <darin@apple.com>
+
+        Use ASCIICType more, and improve it a little bit
+        https://bugs.webkit.org/show_bug.cgi?id=165360
+
+        Reviewed by Sam Weinig.
+
+        * inspector/InspectorValues.cpp:
+        (Inspector::readHexDigits): Use isASCIIHexDigit.
+        (Inspector::hextoInt): Deleted.
+        (decodeString): Use toASCIIHexValue.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseDigit): Use isASCIIDigit, isASCIIUpper, and isASCIILower.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow): Use isASCIIDigit.
+
+2016-12-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Add storeFence support for ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=164733
+
+        Reviewed by Saam Barati.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::dmbISHST): Added.
+        * assembler/ARMv7Assembler.h: Typo fixed, DMB has only T1 encoding.
+        (JSC::ARMv7Assembler::dmbSY):
+        (JSC::ARMv7Assembler::dmbISHST): Added.
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::storeFence):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::storeFence):
+
+2016-12-05  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: remove ASSERT from InspectorDebuggerAgent::derefAsyncCallData
+        https://bugs.webkit.org/show_bug.cgi?id=165413
+        <rdar://problem/29517587>
+
+        Reviewed by Brian Burg.
+
+        DOMTimer::removeById can call into InspectorInstrumentation with an
+        invalid identifier, so don't assert that async call data exists.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::derefAsyncCallData):
+
+2016-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a bug in my last patch.
+
+        Unreviewed.
+
+        * bytecode/UnlinkedFunctionExecutable.h: Restore the conversion to
+        one-based counting.
+
+2016-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Moved start and end column linking into helper functions
+        https://bugs.webkit.org/show_bug.cgi?id=165422
+
+        Reviewed by Sam Weinig.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::link):
+        * bytecode/UnlinkedFunctionExecutable.h:
+
+2016-12-05  Mark Lam  <mark.lam@apple.com>
+
+        Fix JSC files so that we can build a release build with NDEBUG #undef'ed.
+        https://bugs.webkit.org/show_bug.cgi?id=165409
+
+        Reviewed by Keith Miller.
+
+        This allows us to run a release build with DEBUG ASSERTs enabled.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        * bytecode/UnlinkedEvalCodeBlock.cpp:
+        * bytecode/UnlinkedFunctionCodeBlock.cpp:
+        * bytecode/UnlinkedModuleProgramCodeBlock.cpp:
+        * bytecode/UnlinkedProgramCodeBlock.cpp:
+        * runtime/EvalExecutable.cpp:
+
+2016-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Renamed source => parentSource
+        https://bugs.webkit.org/show_bug.cgi?id=165419
+
+        Reviewed by Saam Barati.
+
+        This should help clarify that a FunctionExecutable holds the source
+        code to its *parent* scope, and not its own SourceCode.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutable):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::link):
+        * bytecode/UnlinkedFunctionExecutable.h:
+
+2016-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        ScriptExecutable should not contain a copy of firstLine and startColumn
+        https://bugs.webkit.org/show_bug.cgi?id=165415
+
+        Reviewed by Keith Miller.
+
+        We already have this data in SourceCode.
+
+        It's super confusing to have two copies of this data, where one is
+        allowed to mutate. In reality, your line and column number never change.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::link):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
+        * runtime/CodeCache.h:
+        (JSC::generateUnlinkedCodeBlock):
+        * runtime/FunctionExecutable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/FunctionExecutable.h:
+        * runtime/ScriptExecutable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/ScriptExecutable.h:
+        (JSC::ScriptExecutable::firstLine):
+        (JSC::ScriptExecutable::startColumn):
+        (JSC::ScriptExecutable::recordParse):
+
+2016-12-05  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] report unexpected token when "async" is followed by identifier 
+        https://bugs.webkit.org/show_bug.cgi?id=165091
+
+        Reviewed by Mark Lam.
+
+        Report a SyntaxError, in order to report correct error in contexts
+        an async ArrowFunction cannot occur. Also corrects errors in comment
+        describing JSTokenType bitfield, which was added in r209293.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/ParserTokens.h:
+
+2016-12-05  Keith Miller  <keith_miller@apple.com>
+
+        Add Wasm i64 to i32 conversion.
+        https://bugs.webkit.org/show_bug.cgi?id=165378
+
+        Reviewed by Filip Pizlo.
+
+        It turns out the wrap operation is just B3's Trunc.
+
+        * wasm/wasm.json:
+
+2016-12-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(r208985): SafariForWebKitDevelopment Symbol Not Found looking for method with WTF::Optional
+        https://bugs.webkit.org/show_bug.cgi?id=165351
+
+        Reviewed by Yusuke Suzuki.
+
+        Some versions of Safari expect:
+
+            Inspector::BackendDispatcher::reportProtocolError(WTF::Optional<long>, Inspector::BackendDispatcher::CommonErrorCode, WTF::String const&)
+        
+        Which we had updated to use std::optional. Expose a version with the original
+        Symbol for these Safaris. This stub will just call through to the new version.
+
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::reportProtocolError):
+        * inspector/InspectorBackendDispatcher.h:
+
+2016-12-05  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Add __STDC_FORMAT_MACROS before inttypes.h is included
+        https://bugs.webkit.org/show_bug.cgi?id=165374
+
+        We need formatting macros like PRIu64 to be available in all places where
+        inttypes.h header is used. All these usages get inttypes.h definitions
+        via wtf/Assertions.h header, except SQLiteFileSystem.cpp where formatting
+        macros are not used anymore since r185129.
+
+        This patch fixes multiple build errors with MinGW and reduces number of
+        independent __STDC_FORMAT_MACROS uses in the code base.
+
+        Reviewed by Darin Adler.
+
+        * disassembler/ARM64/A64DOpcode.cpp: Removed __STDC_FORMAT_MACROS
+        because it is obtained via Assertions.h now
+        * disassembler/ARM64Disassembler.cpp: Ditto.
+
+2016-12-04  Keith Miller  <keith_miller@apple.com>
+
+        Add support for Wasm ctz and popcnt
+        https://bugs.webkit.org/show_bug.cgi?id=165369
+
+        Reviewed by Saam Barati.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::countTrailingZeros32):
+        (JSC::MacroAssemblerARM64::countTrailingZeros64):
+        * assembler/MacroAssemblerX86Common.cpp:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::countTrailingZeros32):
+        (JSC::MacroAssemblerX86Common::supportsBMI1):
+        (JSC::MacroAssemblerX86Common::ctzAfterBsf):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::countTrailingZeros64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::tzcnt_rr):
+        (JSC::X86Assembler::tzcntq_rr):
+        (JSC::X86Assembler::bsf_rr):
+        (JSC::X86Assembler::bsfq_rr):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Ctz>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Ctz>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+
+2016-12-04  Saam Barati  <sbarati@apple.com>
+
+        We should have a Wasm callee
+        https://bugs.webkit.org/show_bug.cgi?id=165163
+
+        Reviewed by Keith Miller.
+
+        This patch adds JSWebAssemblyCallee and stores it into the
+        callee slot in the call frame as part of the prologue of a
+        wasm function. This is the first step in implementing
+        unwinding from/through wasm frames. We will use the callee
+        to identify that a machine frame belongs to wasm code.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (callWasmFunction):
+        (functionTestWasmModuleFunctions):
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * wasm/JSWebAssembly.h:
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmCallingConvention.h:
+        (JSC::Wasm::CallingConvention::setupFrameInPrologue):
+        * wasm/WasmFormat.h:
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::initializeCallees):
+        * wasm/WasmPlan.h:
+        (JSC::Wasm::Plan::compiledFunction):
+        (JSC::Wasm::Plan::getCompiledFunctions): Deleted.
+        * wasm/js/JSWebAssemblyCallee.cpp: Added.
+        (JSC::JSWebAssemblyCallee::JSWebAssemblyCallee):
+        (JSC::JSWebAssemblyCallee::finishCreation):
+        (JSC::JSWebAssemblyCallee::destroy):
+        * wasm/js/JSWebAssemblyCallee.h: Added.
+        (JSC::JSWebAssemblyCallee::create):
+        (JSC::JSWebAssemblyCallee::createStructure):
+        (JSC::JSWebAssemblyCallee::jsEntryPoint):
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::create):
+        (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
+        (JSC::JSWebAssemblyModule::visitChildren):
+        * wasm/js/JSWebAssemblyModule.h:
+        (JSC::JSWebAssemblyModule::moduleInformation):
+        (JSC::JSWebAssemblyModule::callee):
+        (JSC::JSWebAssemblyModule::callees):
+        (JSC::JSWebAssemblyModule::offsetOfCallees):
+        (JSC::JSWebAssemblyModule::allocationSize):
+        (JSC::JSWebAssemblyModule::compiledFunctions): Deleted.
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction):
+        (JSC::WebAssemblyFunction::create):
+        (JSC::WebAssemblyFunction::visitChildren):
+        (JSC::WebAssemblyFunction::finishCreation):
+        * wasm/js/WebAssemblyFunction.h:
+        (JSC::WebAssemblyFunction::webAssemblyCallee):
+        (JSC::WebAssemblyFunction::instance):
+        (JSC::WebAssemblyFunction::signature):
+        (JSC::CallableWebAssemblyFunction::CallableWebAssemblyFunction): Deleted.
+        (JSC::WebAssemblyFunction::webAssemblyFunctionCell): Deleted.
+        * wasm/js/WebAssemblyFunctionCell.cpp:
+        (JSC::WebAssemblyFunctionCell::create): Deleted.
+        (JSC::WebAssemblyFunctionCell::WebAssemblyFunctionCell): Deleted.
+        (JSC::WebAssemblyFunctionCell::destroy): Deleted.
+        (JSC::WebAssemblyFunctionCell::createStructure): Deleted.
+        * wasm/js/WebAssemblyFunctionCell.h:
+        (JSC::WebAssemblyFunctionCell::function): Deleted.
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::link):
+
+2016-12-04  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: Assertion Failures breakpoint should respect global Breakpoints enabled setting
+        https://bugs.webkit.org/show_bug.cgi?id=165277
+        <rdar://problem/29467098>
+
+        Reviewed by Mark Lam.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
+        Check that breakpoints are active before pausing.
+
+2016-12-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Refactor SymbolImpl layout
+        https://bugs.webkit.org/show_bug.cgi?id=165247
+
+        Reviewed by Darin Adler.
+
+        Use SymbolImpl::{create, createNullSymbol} instead.
+
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+
+2016-12-03  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: update binary format to 0xD version
+        https://bugs.webkit.org/show_bug.cgi?id=165345
+
+        Reviewed by Keith Miller.
+
+        As described in the following PR: https://github.com/WebAssembly/design/pull/836
+        Originally committed in r209175, reverted in r209242, and fixed in r209284.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::B3IRGenerator::zeroForType):
+        (JSC::Wasm::B3IRGenerator::addConstant):
+        (JSC::Wasm::createJSWrapper):
+        * wasm/WasmCallingConvention.h:
+        (JSC::Wasm::CallingConvention::marshallArgument):
+        * wasm/WasmFormat.cpp:
+        (JSC::Wasm::toString): Deleted.
+        * wasm/WasmFormat.h:
+        (JSC::Wasm::isValueType):
+        (JSC::Wasm::toB3Type): Deleted.
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parse):
+        (JSC::Wasm::ModuleParser::parseType):
+        * wasm/WasmModuleParser.h:
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::parseResultType):
+        * wasm/generateWasm.py:
+        (Wasm.__init__):
+        * wasm/generateWasmOpsHeader.py:
+        (cppMacro):
+        (typeMacroizer):
+        (opcodeMacroizer):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction):
+        * wasm/wasm.json:
+
+2016-12-02  Keith Miller  <keith_miller@apple.com>
+
+        Add Wasm copysign
+        https://bugs.webkit.org/show_bug.cgi?id=165355
+
+        Reviewed by Filip Pizlo.
+
+        This patch also makes two other important changes:
+
+        1) allows for i64 constants in the B3 generator language.
+        2) Fixes a bug with F64ConvertUI64 where the operation returned a Float instead
+           of a Double in B3.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
+        * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
+        (CodeGenerator.generateOpcode):
+        (generateConstCode):
+        (generateI32ConstCode): Deleted.
+        * wasm/wasm.json:
+
+2016-12-03  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r209298.
+        https://bugs.webkit.org/show_bug.cgi?id=165359
+
+        broke the build (Requested by smfr on #webkit).
+
+        Reverted changeset:
+
+        "Add Wasm copysign"
+        https://bugs.webkit.org/show_bug.cgi?id=165355
+        http://trac.webkit.org/changeset/209298
+
+2016-12-02  Keith Miller  <keith_miller@apple.com>
+
+        Add Wasm copysign
+        https://bugs.webkit.org/show_bug.cgi?id=165355
+
+        Reviewed by Filip Pizlo.
+
+        This patch also makes two other important changes:
+
+        1) allows for i64 constants in the B3 generator language.
+        2) Fixes a bug with F64ConvertUI64 where the operation returned a Float instead
+           of a Double in B3.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
+        * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
+        (CodeGenerator.generateOpcode):
+        (generateConstCode):
+        (generateI32ConstCode): Deleted.
+        * wasm/wasm.json:
+
+2016-12-02  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, fix git having a breakdown over trying to reland a rollout.
+
+2016-12-02  Keith Miller  <keith_miller@apple.com>
+
+        Add Wasm floating point nearest and trunc
+        https://bugs.webkit.org/show_bug.cgi?id=165339
+
+        Reviewed by Saam Barati.
+
+        This patch also allows any wasm primitive type to be passed as a
+        string.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::nearestIntDouble):
+        (JSC::MacroAssemblerARM64::nearestIntFloat):
+        (JSC::MacroAssemblerARM64::truncDouble):
+        (JSC::MacroAssemblerARM64::truncFloat):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::nearestIntDouble):
+        (JSC::MacroAssemblerX86Common::nearestIntFloat):
+        * jsc.cpp:
+        (box):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+
+2016-12-02  Caitlin Potter  <caitp@igalia.com>
+
+[JSC] add additional bit to JSTokenType bitfield
+        https://bugs.webkit.org/show_bug.cgi?id=165091
+
+        Reviewed by Geoffrey Garen.
+
+        Avoid overflow which causes keyword tokens to be treated as unary
+        tokens now that "async" is tokenized as a keyword, by granting an
+        additional 64 bits to be occupied by token IDs.
+
+        * parser/ParserTokens.h:
+
+2016-12-02  Andy Estes  <aestes@apple.com>
+
+        [Cocoa] Adopt the PRODUCT_BUNDLE_IDENTIFIER build setting
+        https://bugs.webkit.org/show_bug.cgi?id=164492
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/JavaScriptCore.xcconfig: Set PRODUCT_BUNDLE_IDENTIFIER to
+        com.apple.$(PRODUCT_NAME:rfc1034identifier).
+        * Info.plist: Changed CFBundleIdentifier's value from com.apple.${PRODUCT_NAME} to
+        ${PRODUCT_BUNDLE_IDENTIFIER}.
+
+2016-12-02  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: mark WasmOps.h as private
+        https://bugs.webkit.org/show_bug.cgi?id=165335
+
+        Reviewed by Mark Lam.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: WasmOps.h will be used by non-JSC and should therefore be private
+
+2016-12-02  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r209275 and r209276.
+        https://bugs.webkit.org/show_bug.cgi?id=165348
+
+        "broke the arm build" (Requested by keith_miller on #webkit).
+
+        Reverted changesets:
+
+        "Add Wasm floating point nearest and trunc"
+        https://bugs.webkit.org/show_bug.cgi?id=165339
+        http://trac.webkit.org/changeset/209275
+
+        "Unreviewed, forgot to change instruction after renaming."
+        http://trac.webkit.org/changeset/209276
+
+2016-12-02  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, forgot to change instruction after renaming.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::nearestIntDouble):
+        (JSC::MacroAssemblerARM64::nearestIntFloat):
+
+2016-12-02  Keith Miller  <keith_miller@apple.com>
+
+        Add Wasm floating point nearest and trunc
+        https://bugs.webkit.org/show_bug.cgi?id=165339
+
+        Reviewed by Filip Pizlo.
+
+        This patch also allows any wasm primitive type to be passed as a
+        string.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::nearestIntDouble):
+        (JSC::MacroAssemblerARM64::nearestIntFloat):
+        (JSC::MacroAssemblerARM64::truncDouble):
+        (JSC::MacroAssemblerARM64::truncFloat):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::nearestIntDouble):
+        (JSC::MacroAssemblerX86Common::nearestIntFloat):
+        * jsc.cpp:
+        (box):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Nearest>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Nearest>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F64Trunc>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32Trunc>):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+
+2016-12-02  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: revert patch causing odd breakage
+        https://bugs.webkit.org/show_bug.cgi?id=165308
+
+        Unreviewed.
+
+        Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
+        ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
+
+        It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
+        (JSC::Wasm::B3IRGenerator::zeroForType):
+        (JSC::Wasm::B3IRGenerator::addConstant):
+        (JSC::Wasm::createJSWrapper):
+        * wasm/WasmCallingConvention.h:
+        (JSC::Wasm::CallingConvention::marshallArgument):
+        * wasm/WasmFormat.cpp:
+        (JSC::Wasm::toString):
+        * wasm/WasmFormat.h:
+        (JSC::Wasm::toB3Type):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parse):
+        (JSC::Wasm::ModuleParser::parseType):
+        * wasm/WasmModuleParser.h:
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::parseResultType):
+        * wasm/generateWasm.py:
+        (Wasm.__init__):
+        * wasm/generateWasmOpsHeader.py:
+        (cppMacro):
+        (opcodeMacroizer):
+        (typeMacroizer): Deleted.
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction):
+        * wasm/wasm.json:
+
+2016-12-01  Brian Burg  <bburg@apple.com>
+
+        Remote Inspector: fix weird typo in generated ObjC protocol type initializer implementations
+        https://bugs.webkit.org/show_bug.cgi?id=165295
+        <rdar://problem/29427778>
+
+        Reviewed by Joseph Pecoraro.
+
+        Remove a stray semicolon appended after custom initializer signatures.
+        This is a syntax error when building with less lenient compiler warnings.
+
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-12-01  Saam Barati  <sbarati@apple.com>
+
+        Rename CallFrame::callee() to CallFrame::jsCallee()
+        https://bugs.webkit.org/show_bug.cgi?id=165293
+
+        Reviewed by Keith Miller.
+
+        Wasm will soon have its own Callee that doesn't derive
+        from JSObject, but derives from JSCell. I want to introduce
+        a new function like:
+        ```
+        CalleeBase* CallFrame::callee()
+        ```
+        
+        once we have a Wasm callee. It only makes sense to name that
+        function callee() and rename the current one turn to:
+        ```
+        JSObject* CallFrame::jsCallee()
+        ```
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call):
+        (JSC::APICallbackFunction::construct):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::construct):
+        (JSC::JSCallbackObject<Parent>::call):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::scope):
+        (JSC::DebuggerCallFrame::type):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::friendlyFunctionName):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::jsCallee):
+        (JSC::ExecState::callee): Deleted.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::notifyDebuggerOfUnwinding):
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::update):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::readNonInlinedFrame):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/AsyncFunctionConstructor.cpp:
+        (JSC::callAsyncFunctionConstructor):
+        (JSC::constructAsyncFunctionConstructor):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructWithBooleanConstructor):
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createWithInlineFrame):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructWithDateConstructor):
+        * runtime/DirectArguments.cpp:
+        (JSC::DirectArguments::createByCopying):
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        (JSC::Interpreter::callErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructWithFunctionConstructor):
+        (JSC::callFunctionConstructor):
+        * runtime/GeneratorFunctionConstructor.cpp:
+        (JSC::callGeneratorFunctionConstructor):
+        (JSC::constructGeneratorFunctionConstructor):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::initializeCollator):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        (JSC::callIntlCollator):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        (JSC::callIntlDateTimeFormat):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        (JSC::callIntlNumberFormat):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlObject.cpp:
+        (JSC::canonicalizeLocaleList):
+        (JSC::defaultLocale):
+        (JSC::lookupSupportedLocales):
+        (JSC::intlObjectFuncGetCanonicalLocales):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::boundThisNoArgsFunctionCall):
+        (JSC::boundFunctionCall):
+        (JSC::boundThisNoArgsFunctionConstruct):
+        (JSC::boundFunctionConstruct):
+        * runtime/JSCellInlines.h:
+        (JSC::ExecState::vm):
+        * runtime/JSCustomGetterSetterFunction.cpp:
+        (JSC::JSCustomGetterSetterFunction::customGetterSetterFunctionCall):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSInternalPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::createPair):
+        (JSC::JSMapIterator::clone):
+        * runtime/JSNativeStdFunction.cpp:
+        (JSC::runStdFunction):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::clone):
+        * runtime/JSScope.h:
+        (JSC::ExecState::lexicalGlobalObject):
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::createPair):
+        (JSC::JSSetIterator::clone):
+        * runtime/JSStringIterator.cpp:
+        (JSC::JSStringIterator::clone):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MapPrototype.cpp:
+        (JSC::mapProtoFuncValues):
+        (JSC::mapProtoFuncEntries):
+        (JSC::mapProtoFuncKeys):
+        (JSC::privateFuncMapIterator):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor):
+        (JSC::Interpreter::callNativeErrorConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        * runtime/ProxyRevoke.cpp:
+        (JSC::performProxyRevoke):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructWithRegExpConstructor):
+        (JSC::callRegExpConstructor):
+        * runtime/ScopedArguments.cpp:
+        (JSC::ScopedArguments::createByCopying):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/SetPrototype.cpp:
+        (JSC::setProtoFuncValues):
+        (JSC::setProtoFuncEntries):
+        (JSC::privateFuncSetIterator):
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncIterator):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::constructWeakSet):
+        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
+        (JSC::constructJSWebAssemblyCompileError):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction):
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule):
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
+        (JSC::constructJSWebAssemblyRuntimeError):
+
+2016-12-01  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: generated code should use a framework-style import for *ProtocolArrayConversions.h
+        https://bugs.webkit.org/show_bug.cgi?id=165281
+        <rdar://problem/29427778>
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
+        (ObjCProtocolTypeConversionsHeaderGenerator.generate_output):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        SourceCodeKey should use unlinked source code
+        https://bugs.webkit.org/show_bug.cgi?id=165286
+
+        Reviewed by Saam Barati.
+
+        This patch splits out UnlinkedSourceCode from SourceCode, and deploys
+        UnlinkedSourceCode in SourceCodeKey.
+
+        It's misleading to store SourceCode in SourceCodeKey because SourceCode
+        has an absolute location whereas unlinked cached code has no location.
+
+        I plan to deploy UnlinkedSourceCode in more places, to indicate code
+        that has no absolute location.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/SourceCode.cpp:
+        (JSC::UnlinkedSourceCode::toUTF8):
+        (JSC::SourceCode::toUTF8): Deleted.
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::startColumn):
+        (JSC::SourceCode::isHashTableDeletedValue): Deleted.
+        (JSC::SourceCode::hash): Deleted.
+        (JSC::SourceCode::view): Deleted.
+        (JSC::SourceCode::providerID): Deleted.
+        (JSC::SourceCode::isNull): Deleted.
+        (JSC::SourceCode::provider): Deleted.
+        (JSC::SourceCode::startOffset): Deleted.
+        (JSC::SourceCode::endOffset): Deleted.
+        (JSC::SourceCode::length): Deleted. Move a bunch of stuff in to a new
+        base class, UnlinkedSourceCode.
+
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeKey::SourceCodeKey): Use UnlinkedSourceCode since code
+        in the cache has no location.
+
+        * parser/UnlinkedSourceCode.h: Copied from Source/JavaScriptCore/parser/SourceCode.h.
+        (JSC::UnlinkedSourceCode::UnlinkedSourceCode):
+        (JSC::UnlinkedSourceCode::provider):
+        (JSC::SourceCode::SourceCode): Deleted.
+        (JSC::SourceCode::isHashTableDeletedValue): Deleted.
+        (JSC::SourceCode::hash): Deleted.
+        (JSC::SourceCode::view): Deleted.
+        (JSC::SourceCode::providerID): Deleted.
+        (JSC::SourceCode::isNull): Deleted.
+        (JSC::SourceCode::provider): Deleted.
+        (JSC::SourceCode::firstLine): Deleted.
+        (JSC::SourceCode::startColumn): Deleted.
+        (JSC::SourceCode::startOffset): Deleted.
+        (JSC::SourceCode::endOffset): Deleted.
+        (JSC::SourceCode::length): Deleted.
+        (JSC::makeSource): Deleted.
+        (JSC::SourceCode::subExpression): Deleted.
+
+        * runtime/CodeCache.h: Use UnlinkedSourceCode in the cache.
+
+2016-12-01  Keith Miller  <keith_miller@apple.com>
+
+        Add wasm int to floating point opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=165252
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds support for the Wasm integral type => floating point
+        type conversion opcodes. Most of these were already supported by B3
+        however there was no support for uint64 to float/double. Unfortunately,
+        AFAIK x86_64 does not have a single instruction that performs this
+        conversion. Since there is a signed conversion instruction on x86 we
+        use that for all uint64s that don't have the top bit set. If they do have
+        the top bit set we need to divide by 2 (rounding up) then convert the number
+        with the signed conversion then double the result.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::convertUInt64ToDouble):
+        (JSC::MacroAssemblerX86_64::convertUInt64ToFloat):
+        * jsc.cpp:
+        (valueWithTypeOfWasmValue):
+        (box):
+        (functionTestWasmModuleFunctions):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addOp<F64ConvertUI64>):
+        (JSC::Wasm::B3IRGenerator::addOp<OpType::F32ConvertUI64>):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/wasm.json:
+
+2016-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Renamed EvalCodeCache => DirectEvalCodeCache
+        https://bugs.webkit.org/show_bug.cgi?id=165271
+
+        Reviewed by Saam Barati.
+
+        We only use this cache for DirectEval, not IndirectEval.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::DirectEvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC::EvalCodeCache::visitAggregate): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::directEvalCodeCache):
+        (JSC::CodeBlock::evalCodeCache): Deleted.
+        * bytecode/DirectEvalCodeCache.h: Copied from Source/JavaScriptCore/bytecode/EvalCodeCache.h.
+        (JSC::EvalCodeCache::CacheKey::CacheKey): Deleted.
+        (JSC::EvalCodeCache::CacheKey::hash): Deleted.
+        (JSC::EvalCodeCache::CacheKey::isEmptyValue): Deleted.
+        (JSC::EvalCodeCache::CacheKey::operator==): Deleted.
+        (JSC::EvalCodeCache::CacheKey::isHashTableDeletedValue): Deleted.
+        (JSC::EvalCodeCache::CacheKey::Hash::hash): Deleted.
+        (JSC::EvalCodeCache::CacheKey::Hash::equal): Deleted.
+        (JSC::EvalCodeCache::tryGet): Deleted.
+        (JSC::EvalCodeCache::set): Deleted.
+        (JSC::EvalCodeCache::isEmpty): Deleted.
+        (JSC::EvalCodeCache::clear): Deleted.
+        * bytecode/EvalCodeCache.h: Removed.
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * runtime/DirectEvalExecutable.cpp:
+        (JSC::DirectEvalExecutable::create):
+
+2016-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed some unnecessary indirection in code generation
+        https://bugs.webkit.org/show_bug.cgi?id=165264
+
+        Reviewed by Keith Miller.
+
+        There's no need to route through JSGlobalObject when producing code --
+        it just made the code harder to read.
+
+        This patch moves functions from JSGlobalObject to their singleton
+        call sites.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getUnlinkedEvalCodeBlock):
+        (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock): Deleted.
+        * runtime/CodeCache.h:
+        * runtime/DirectEvalExecutable.cpp:
+        (JSC::DirectEvalExecutable::create):
+        * runtime/IndirectEvalExecutable.cpp:
+        (JSC::IndirectEvalExecutable::create):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock): Deleted.
+        (JSC::JSGlobalObject::createLocalEvalCodeBlock): Deleted.
+        (JSC::JSGlobalObject::createGlobalEvalCodeBlock): Deleted.
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock): Deleted.
+        * runtime/JSGlobalObject.h:
+        * runtime/ModuleProgramExecutable.cpp:
+        (JSC::ModuleProgramExecutable::create):
+        * runtime/ProgramExecutable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/ProgramExecutable.h:
+
+2016-11-30  Darin Adler  <darin@apple.com>
+
+        Roll out StringBuilder changes from the previous patch.
+        They were a slowdown on a Kraken JSON test.
+
+        * runtime/JSONObject.cpp:
+        Roll out changes from below.
+
+2016-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Specifying same module entry point multiple times cause TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=164858
+
+        Reviewed by Saam Barati.
+
+        Allow importing the same module multiple times. Previously, when specifying the same
+        module in the <script type="module" src="here">, it throws TypeError.
+
+        * builtins/ModuleLoaderPrototype.js:
+        (requestFetch):
+        (requestTranslate):
+        (requestInstantiate):
+        (requestSatisfy):
+
+2016-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        WebAssembly JS API: export a module namespace object instead of a module environment
+        https://bugs.webkit.org/show_bug.cgi?id=165121
+
+        Reviewed by Saam Barati.
+
+        This patch setup AbstractModuleRecord further for WebAssemblyModuleRecord.
+        For exported entries in a wasm instance, we set up exported entries for
+        AbstractModuleRecord. This allows us to export WASM exported functions in
+        the module handling code.
+
+        Since the exported entries in the abstract module record are correctly
+        instantiated, the module namespace object for WASM module also starts
+        working correctly. So we start exposing the module namespace object
+        as `instance.exports` instead of the module environment object.
+
+        And we move SourceCode, lexicalVariables, and declaredVariables fields to
+        JSModuleRecord since they are related to JS source code (in the spec words,
+        they are related to the source text module record).
+
+        * runtime/AbstractModuleRecord.cpp:
+        (JSC::AbstractModuleRecord::AbstractModuleRecord):
+        * runtime/AbstractModuleRecord.h:
+        (JSC::AbstractModuleRecord::sourceCode): Deleted.
+        (JSC::AbstractModuleRecord::declaredVariables): Deleted.
+        (JSC::AbstractModuleRecord::lexicalVariables): Deleted.
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::JSModuleRecord):
+        * runtime/JSModuleRecord.h:
+        (JSC::JSModuleRecord::sourceCode):
+        (JSC::JSModuleRecord::declaredVariables):
+        (JSC::JSModuleRecord::lexicalVariables):
+        * wasm/WasmFormat.cpp:
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::finishCreation):
+        * wasm/js/WebAssemblyFunction.cpp:
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::create):
+        (JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):
+        (JSC::WebAssemblyModuleRecord::finishCreation):
+        WebAssemblyModuleRecord::link should perform linking things.
+        So allocating exported entries should be done here.
+        (JSC::WebAssemblyModuleRecord::link):
+        * wasm/js/WebAssemblyModuleRecord.h:
+
+2016-11-30  Mark Lam  <mark.lam@apple.com>
+
+        TypeInfo::OutOfLineTypeFlags should be 16 bits in size.
+        https://bugs.webkit.org/show_bug.cgi?id=165224
+
+        Reviewed by Saam Barati.
+
+        There's no reason for OutOfLineTypeFlags to be constraint to 8 bits since the
+        space is available to us.  Making OutOfLineTypeFlags 16 bits brings TypeInfo up
+        to 32 bits in size from the current 24 bits.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2016-11-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION: inspector/sampling-profiler/* LayoutTests are flaky timeouts
+        https://bugs.webkit.org/show_bug.cgi?id=164388
+        <rdar://problem/29101555>
+
+        Reviewed by Saam Barati.
+
+        There was a possibility of a deadlock between the main thread and the GC thread
+        with the SamplingProfiler lock when Inspector is processing samples to send to
+        the frontend. The Inspector (main thread) was holding the SamplingProfiler lock
+        while processing samples, which runs JavaScript that could trigger a GC, and
+        GC then tries to acquire the SamplingProfiler lock to process unprocessed samples.
+
+        A simple solution here is to tighten the bounds of when Inspector holds the
+        SamplingProfiler lock. It only needs the lock when extracting samples from
+        the SamplingProfiler. It doesn't need to hold the lock for processing those
+        samples, which is what can run script and cause a GC.
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        Tighten bounds of this lock to only where it is needed.
+
+2016-11-30  Mark Lam  <mark.lam@apple.com>
+
+        Proxy is not allowed in the global prototype chain.
+        https://bugs.webkit.org/show_bug.cgi?id=165205
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/ProgramExecutable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        - We'll now throw a TypeError if we detect a Proxy in the global prototype chain.
+
+2016-11-30  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r209112.
+        https://bugs.webkit.org/show_bug.cgi?id=165208
+
+        "It regressed Octane/Raytrace and JetStream" (Requested by
+        saamyjoon on #webkit).
+
+        Reverted changeset:
+
+        "We should support CreateThis in the FTL"
+        https://bugs.webkit.org/show_bug.cgi?id=164904
+        http://trac.webkit.org/changeset/209112
+
+2016-11-30  Darin Adler  <darin@apple.com>
+
+        Streamline and speed up tokenizer and segmented string classes
+        https://bugs.webkit.org/show_bug.cgi?id=165003
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue): Use viewWithUnderlyingString when calling
+        StringBuilder::appendQuotedJSONString, since it now takes a StringView and there is
+        no benefit in creating a String for that function if one doesn't already exist.
+
+2016-11-29  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly JS API: improve Instance
+        https://bugs.webkit.org/show_bug.cgi?id=164757
+
+        Reviewed by Keith Miller.
+
+        An Instance's `exports` property wasn't populated with exports.
+
+        According to the spec [0], `exports` should present itself as a WebAssembly
+        Module Record. In order to do this we need to split JSModuleRecord into
+        AbstractModuleRecord (without the `link` and `evaluate` functions), and
+        JSModuleRecord (which implements link and evaluate). We can then have a separate
+        WebAssemblyModuleRecord which shares most of the implementation.
+
+        `exports` then maps function names to WebAssemblyFunction and
+        WebAssemblyFunctionCell, which call into the B3-generated WebAssembly code.
+
+        A follow-up patch will do imports.
+
+        A few things of note:
+
+         - Use Identifier instead of String. They get uniqued, we need them for the JSModuleNamespaceObject. This is safe because JSWebAssemblyModule creation is on the main thread.
+         - JSWebAssemblyInstance needs to refer to the JSWebAssemblyModule used to create it, because the module owns the code, identifiers, etc. The world would be very sad if it got GC'd.
+         - Instance.exports shouldn't use putWithoutTransition because it affects all Structures, whereas here each instance needs its own exports.
+         - Expose the compiled functions, and pipe them to the InstanceConstructor. Start moving things around to split JSModuleRecord out into JS and WebAssembly parts.
+
+          [0]: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-constructor
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/AbstractModuleRecord.cpp: Copied from Source/JavaScriptCore/runtime/JSModuleRecord.cpp, which I split in two
+        (JSC::AbstractModuleRecord::AbstractModuleRecord):
+        (JSC::AbstractModuleRecord::destroy):
+        (JSC::AbstractModuleRecord::finishCreation):
+        (JSC::AbstractModuleRecord::visitChildren):
+        (JSC::AbstractModuleRecord::appendRequestedModule):
+        (JSC::AbstractModuleRecord::addStarExportEntry):
+        (JSC::AbstractModuleRecord::addImportEntry):
+        (JSC::AbstractModuleRecord::addExportEntry):
+        (JSC::identifierToJSValue):
+        (JSC::AbstractModuleRecord::hostResolveImportedModule):
+        (JSC::AbstractModuleRecord::ResolveQuery::ResolveQuery):
+        (JSC::AbstractModuleRecord::ResolveQuery::isEmptyValue):
+        (JSC::AbstractModuleRecord::ResolveQuery::isDeletedValue):
+        (JSC::AbstractModuleRecord::ResolveQuery::Hash::hash):
+        (JSC::AbstractModuleRecord::ResolveQuery::Hash::equal):
+        (JSC::AbstractModuleRecord::cacheResolution):
+        (JSC::getExportedNames):
+        (JSC::AbstractModuleRecord::getModuleNamespace):
+        (JSC::printableName):
+        (JSC::AbstractModuleRecord::dump):
+        * runtime/AbstractModuleRecord.h: Copied from Source/JavaScriptCore/runtime/JSModuleRecord.h.
+        (JSC::AbstractModuleRecord::ImportEntry::isNamespace):
+        (JSC::AbstractModuleRecord::sourceCode):
+        (JSC::AbstractModuleRecord::moduleKey):
+        (JSC::AbstractModuleRecord::requestedModules):
+        (JSC::AbstractModuleRecord::exportEntries):
+        (JSC::AbstractModuleRecord::importEntries):
+        (JSC::AbstractModuleRecord::starExportEntries):
+        (JSC::AbstractModuleRecord::declaredVariables):
+        (JSC::AbstractModuleRecord::lexicalVariables):
+        (JSC::AbstractModuleRecord::moduleEnvironment):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::webAssemblyModuleRecordStructure):
+        (JSC::JSGlobalObject::webAssemblyFunctionStructure):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::create):
+        (JSC::JSModuleEnvironment::finishCreation):
+        (JSC::JSModuleEnvironment::getOwnPropertySlot):
+        (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
+        (JSC::JSModuleEnvironment::put):
+        (JSC::JSModuleEnvironment::deleteProperty):
+        * runtime/JSModuleEnvironment.h:
+        (JSC::JSModuleEnvironment::create):
+        (JSC::JSModuleEnvironment::offsetOfModuleRecord):
+        (JSC::JSModuleEnvironment::allocationSize):
+        (JSC::JSModuleEnvironment::moduleRecord):
+        (JSC::JSModuleEnvironment::moduleRecordSlot):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::finishCreation):
+        (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
+        * runtime/JSModuleNamespaceObject.h:
+        (JSC::JSModuleNamespaceObject::create):
+        (JSC::JSModuleNamespaceObject::moduleRecord):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::createStructure):
+        (JSC::JSModuleRecord::create):
+        (JSC::JSModuleRecord::JSModuleRecord):
+        (JSC::JSModuleRecord::destroy):
+        (JSC::JSModuleRecord::finishCreation):
+        (JSC::JSModuleRecord::visitChildren):
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        * runtime/JSModuleRecord.h:
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        (JSC::JSScope::collectClosureVariablesUnderTDZ):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * wasm/JSWebAssembly.h:
+        * wasm/WasmFormat.h: use Identifier instead of String
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parse):
+        (JSC::Wasm::ModuleParser::parseType):
+        (JSC::Wasm::ModuleParser::parseImport): fix off-by-one
+        (JSC::Wasm::ModuleParser::parseFunction):
+        (JSC::Wasm::ModuleParser::parseExport):
+        * wasm/WasmModuleParser.h:
+        (JSC::Wasm::ModuleParser::ModuleParser):
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::run):
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::create):
+        (JSC::JSWebAssemblyInstance::finishCreation):
+        (JSC::JSWebAssemblyInstance::visitChildren):
+        * wasm/js/JSWebAssemblyInstance.h:
+        (JSC::JSWebAssemblyInstance::module):
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::create):
+        (JSC::JSWebAssemblyModule::finishCreation):
+        (JSC::JSWebAssemblyModule::visitChildren):
+        * wasm/js/JSWebAssemblyModule.h:
+        (JSC::JSWebAssemblyModule::moduleInformation):
+        (JSC::JSWebAssemblyModule::compiledFunctions):
+        (JSC::JSWebAssemblyModule::exportSymbolTable):
+        * wasm/js/WebAssemblyFunction.cpp: Added.
+        (JSC::callWebAssemblyFunction):
+        (JSC::WebAssemblyFunction::create):
+        (JSC::WebAssemblyFunction::createStructure):
+        (JSC::WebAssemblyFunction::WebAssemblyFunction):
+        (JSC::WebAssemblyFunction::visitChildren):
+        (JSC::WebAssemblyFunction::finishCreation):
+        * wasm/js/WebAssemblyFunction.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h.
+        (JSC::CallableWebAssemblyFunction::CallableWebAssemblyFunction):
+        (JSC::WebAssemblyFunction::webAssemblyFunctionCell):
+        * wasm/js/WebAssemblyFunctionCell.cpp: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h.
+        (JSC::WebAssemblyFunctionCell::create):
+        (JSC::WebAssemblyFunctionCell::WebAssemblyFunctionCell):
+        (JSC::WebAssemblyFunctionCell::destroy):
+        (JSC::WebAssemblyFunctionCell::createStructure):
+        * wasm/js/WebAssemblyFunctionCell.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h.
+        (JSC::WebAssemblyFunctionCell::function):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance):
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule):
+        * wasm/js/WebAssemblyModuleRecord.cpp: Added.
+        (JSC::WebAssemblyModuleRecord::createStructure):
+        (JSC::WebAssemblyModuleRecord::create):
+        (JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):
+        (JSC::WebAssemblyModuleRecord::destroy):
+        (JSC::WebAssemblyModuleRecord::finishCreation):
+        (JSC::WebAssemblyModuleRecord::visitChildren):
+        (JSC::WebAssemblyModuleRecord::link):
+        (JSC::WebAssemblyModuleRecord::evaluate):
+        * wasm/js/WebAssemblyModuleRecord.h: Copied from Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h.
+
+2016-11-29  Saam Barati  <sbarati@apple.com>
+
+        We should be able optimize the pattern where we spread a function's rest parameter to another call
+        https://bugs.webkit.org/show_bug.cgi?id=163865
+
+        Reviewed by Filip Pizlo.
+
+        This patch optimizes the following patterns to prevent both the allocation
+        of the rest parameter, and the execution of the iterator protocol:
+        
+        ```
+        function foo(...args) {
+            let arr = [...args];
+        }
+        
+        and
+        
+        function foo(...args) {
+            bar(...args);
+        }
+        ```
+        
+        To do this, I've extended the arguments elimination phase to reason
+        about Spread and NewArrayWithSpread. I've added two new nodes, PhantomSpread
+        and PhantomNewArrayWithSpread. PhantomSpread is only allowed over rest
+        parameters that don't escape. If the rest parameter *does* escape, we can't
+        convert the spread into a phantom because it would not be sound w.r.t JS
+        semantics because we would be reading from the call frame even though
+        the rest array may have changed.
+        
+        Note that NewArrayWithSpread also understands what to do when one of its
+        arguments is PhantomSpread(@PhantomCreateRest) even if it itself is escaped.
+        
+        PhantomNewArrayWithSpread is only allowed over a series of
+        PhantomSpread(@PhantomCreateRest) nodes. Like with PhantomSpread, PhantomNewArrayWithSpread
+        is only allowed if none of its arguments that are being spread are escaped
+        and if it itself is not escaped.
+        
+        Because there is a dependency between a node being a candidate and
+        the escaped state of the node's children, I've extended the notion
+        of escaping a node inside the arguments elimination phase. Now, when
+        any node is escaped, we must consider all other candidates that are may
+        now no longer be valid.
+        
+        For example:
+        
+        ```
+        function foo(...args) {
+            escape(args);
+            bar(...args);
+        }
+        ```
+        
+        In the above program, we don't know if the function call to escape()
+        modifies args, therefore, the spread can not become phantom because
+        the execution of the spread may not be as simple as reading the
+        arguments from the call frame.
+        
+        Unfortunately, the arguments elimination phase does not consider control
+        flow when doing its escape analysis. It would be good to integrate this
+        phase with the object allocation sinking phase. To see why, consider
+        an example where we don't eliminate the spread and allocation of the rest
+        parameter even though we could:
+        
+        ```
+        function foo(rareCondition, ...args) {
+            bar(...args);
+            if (rareCondition)
+                baz(args);
+        }
+        ```
+        
+        There are only a few users of the PhantomSpread and PhantomNewArrayWithSpread
+        nodes. PhantomSpread is only used by PhantomNewArrayWithSpread and NewArrayWithSpread.
+        PhantomNewArrayWithSpread is only used by ForwardVarargs and the various
+        *Call*ForwardVarargs nodes. The users of these phantoms know how to produce
+        what the phantom node would have produced. For example, NewArrayWithSpread
+        knows how to produce the values that would have been produced by PhantomSpread(@PhantomCreateRest)
+        by directly reading from the call frame.
+        
+        This patch is a 6% speedup on my MBP on ES6SampleBench.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tryAppendLea):
+        * b3/B3ValueRep.h:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKillsInBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasConstant):
+        (JSC::DFG::Node::constant):
+        (JSC::DFG::Node::bitVector):
+        (JSC::DFG::Node::isPhantomAllocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::LocalOSRAvailabilityCalculator):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGPromotedHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargsSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::getSpreadLengthFromInlineCallFrame):
+        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargsWithSpread):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationPopulateObjectInOSR):
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetupVarargsFrameFastCase):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionMaxArguments):
+        * runtime/JSFixedArray.h:
+        (JSC::JSFixedArray::createFromArray):
+
+2016-11-29  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r209058 and r209074.
+        https://bugs.webkit.org/show_bug.cgi?id=165188
+
+        These changes caused API test StringBuilderTest.Equal to crash
+        and/or fail. (Requested by ryanhaddad on #webkit).
+
+        Reverted changesets:
+
+        "Streamline and speed up tokenizer and segmented string
+        classes"
+        https://bugs.webkit.org/show_bug.cgi?id=165003
+        http://trac.webkit.org/changeset/209058
+
+        "REGRESSION (r209058): API test StringBuilderTest.Equal
+        crashing"
+        https://bugs.webkit.org/show_bug.cgi?id=165142
+        http://trac.webkit.org/changeset/209074
+
+2016-11-29  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] always wrap AwaitExpression operand in a new Promise
+        https://bugs.webkit.org/show_bug.cgi?id=165181
+
+        Reviewed by Yusuke Suzuki.
+
+        Ensure operand of AwaitExpression is wrapped in a new Promise by
+        explicitly creating a new Promise Capability and invoking its
+        resolve callback. This avoids the specified short-circuit for
+        Promise.resolve().
+
+        * builtins/AsyncFunctionPrototype.js:
+        (globalPrivate.asyncFunctionResume):
+
+2016-11-29  Saam Barati  <sbarati@apple.com>
+
+        We should support CreateThis in the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=164904
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateThis):
+        (JSC::FTL::DFG::LowerDFGToB3::storeStructure):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
+        * runtime/Structure.h:
+
+2016-11-29  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/RegExp* files.
+        https://bugs.webkit.org/show_bug.cgi?id=165054
+
+        Reviewed by Saam Barati.
+
+        Also replaced returning JSValue() with returning { }.
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::toFlags):
+        (JSC::regExpCreate):
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::defineOwnProperty):
+        (JSC::collectMatches):
+        (JSC::RegExpObject::matchGlobal):
+        * runtime/RegExpObjectInlines.h:
+        (JSC::getRegExpObjectLastIndexAsUnsigned):
+        (JSC::RegExpObject::execInline):
+        (JSC::RegExpObject::matchInline):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::flagsString):
+        (JSC::regExpProtoFuncToString):
+        (JSC::regExpProtoFuncSplitFast):
+
+2016-11-29  Andy Estes  <aestes@apple.com>
+
+        [Cocoa] Enable two clang warnings recommended by Xcode
+        https://bugs.webkit.org/show_bug.cgi?id=164498
+
+        Reviewed by Mark Lam.
+
+        * Configurations/Base.xcconfig: Enabled CLANG_WARN_INFINITE_RECURSION and CLANG_WARN_SUSPICIOUS_MOVE.
+
+2016-11-29  Keith Miller  <keith_miller@apple.com>
+
+        Add simple way to implement Wasm ops that require more than one B3 opcode
+        https://bugs.webkit.org/show_bug.cgi?id=165129
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds a simple way to show the B3IRGenerator opcode script how
+        to generate code for Wasm opcodes that do not have a one to one mapping.
+        The syntax is pretty simple right now. There are only three things one
+        can use as of this patch (although more things might be added in the future)
+        1) Wasm opcode arguments: These are referred to as @<argument_number>. For example,
+           I32.sub would map to Sub(@0, @1).
+        2) 32-bit int constants: These are reffered to as i32(<value>). For example, i32.inc
+           would map to Add(@0, i32(1))
+        3) B3 opcodes: These are referred to as the B3 opcode name followed by the B3Value's constructor
+           arguments. A value may take the result of another value as an argument. For example, you can do
+           Div(Mul(@0, Add(@0, i32(1))), i32(2)) if there was a b3 opcode that computed the sum from 1 to n.
+
+        These scripts are used to implement Wasm's eqz and floating point max/min opcodes. This patch
+        also adds missing support for the Wasm Neg opcodes.
+
+        * jsc.cpp:
+        (box):
+        (functionTestWasmModuleFunctions):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::toB3Op): Deleted.
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseBody):
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseType):
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::parseUInt8):
+        (JSC::Wasm::Parser::parseValueType):
+        * wasm/generateWasmB3IRGeneratorInlinesHeader.py:
+        (Source):
+        (Source.__init__):
+        (read):
+        (lex):
+        (CodeGenerator):
+        (CodeGenerator.__init__):
+        (CodeGenerator.advance):
+        (CodeGenerator.token):
+        (CodeGenerator.parseError):
+        (CodeGenerator.consume):
+        (CodeGenerator.generateParameters):
+        (CodeGenerator.generateOpcode):
+        (CodeGenerator.generate):
+        (temp):
+        (generateB3OpCode):
+        (generateI32ConstCode):
+        (generateB3Code):
+        (generateSimpleCode):
+        * wasm/wasm.json:
+
+2016-11-29  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in ProxyConstructor.cpp and ProxyObject.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165053
+
+        Reviewed by Saam Barati.
+
+        Also replaced returning JSValue() with returning { }.
+
+        * runtime/ProxyConstructor.cpp:
+        (JSC::constructProxyObject):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::structureForTarget):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        (JSC::ProxyObject::performPut):
+        (JSC::ProxyObject::putByIndexCommon):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+
+2016-11-28  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: Debugger should have an option for showing asynchronous call stacks
+        https://bugs.webkit.org/show_bug.cgi?id=163230
+        <rdar://problem/28698683>
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/ScriptCallFrame.cpp:
+        (Inspector::ScriptCallFrame::isNative):
+        Encapsulate check for native code source URL.
+
+        * inspector/ScriptCallFrame.h:
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::firstNonNativeCallFrame):
+        (Inspector::ScriptCallStack::buildInspectorArray):
+        * inspector/ScriptCallStack.h:
+        Replace use of Console::StackTrace with Array<Console::CallFrame>.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::disable):
+        (Inspector::InspectorDebuggerAgent::setAsyncStackTraceDepth):
+        Set number of async frames to store (including boundary frames).
+        A value of zero disables recording of async call stacks.
+
+        (Inspector::InspectorDebuggerAgent::buildAsyncStackTrace):
+        Helper function for building a linked list StackTraces.
+        (Inspector::InspectorDebuggerAgent::didScheduleAsyncCall):
+        Store a call stack for the script that scheduled the async call.
+        If the call repeats (e.g. setInterval), the starting reference count is
+        set to 1. This ensures that dereffing after dispatch won't clear the stack.
+        If another async call is currently being dispatched, increment the
+        AsyncCallData reference count for that call.
+
+        (Inspector::InspectorDebuggerAgent::didCancelAsyncCall):
+        Decrement the reference count for the canceled call.
+
+        (Inspector::InspectorDebuggerAgent::willDispatchAsyncCall):
+        Set the identifier for the async callback currently being dispatched,
+        so that if the debugger pauses during dispatch a stack trace can be
+        associated with the pause location. If an async call is already being
+        dispatched, which could be the case when a script schedules an async
+        call in a nested runloop, do nothing.
+
+        (Inspector::InspectorDebuggerAgent::didDispatchAsyncCall):
+        Decrement the reference count for the canceled call.
+        (Inspector::InspectorDebuggerAgent::didPause):
+        If a stored stack trace exists for this location, convert to a protocol
+        object and send to the frontend.
+
+        (Inspector::InspectorDebuggerAgent::didClearGlobalObject):
+        (Inspector::InspectorDebuggerAgent::clearAsyncStackTraceData):
+        (Inspector::InspectorDebuggerAgent::refAsyncCallData):
+        Increment AsyncCallData reference count.
+        (Inspector::InspectorDebuggerAgent::derefAsyncCallData):
+        Decrement AsyncCallData reference count. If zero, deref its parent
+        (if it exists) and remove the AsyncCallData entry.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+
+        * inspector/protocol/Console.json:
+        * inspector/protocol/Network.json:
+        Replace use of Console.StackTrace with array of Console.CallFrame.
+
+        * inspector/protocol/Debugger.json:
+        New protocol command and event data.
+
+2016-11-28  Darin Adler  <darin@apple.com>
+
+        Streamline and speed up tokenizer and segmented string classes
+        https://bugs.webkit.org/show_bug.cgi?id=165003
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue): Use viewWithUnderlyingString when calling
+        StringBuilder::appendQuotedJSONString, since it now takes a StringView and there is
+        no benefit in creating a String for that function if one doesn't already exist.
+
+2016-11-21  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/Intl* files.
+        https://bugs.webkit.org/show_bug.cgi?id=165014
+
+        Reviewed by Saam Barati.
+
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototypeFuncResolvedOptions):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatFuncFormatDateTime):
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatFuncFormatNumber):
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObject.cpp:
+        (JSC::lookupSupportedLocales):
+        * runtime/IntlObjectInlines.h:
+        (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in IteratorOperations.h.
+        https://bugs.webkit.org/show_bug.cgi?id=165015
+
+        Reviewed by Saam Barati.
+
+        * runtime/IteratorOperations.h:
+        (JSC::forEachInIterable):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in JSArray* files.
+        https://bugs.webkit.org/show_bug.cgi?id=165016
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::put):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::put):
+        (JSC::JSArrayBuffer::defineOwnProperty):
+        * runtime/JSArrayInlines.h:
+        (JSC::getLength):
+        (JSC::toLength):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in JSDataView.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165020
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::put):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in JSFunction.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165021
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/JSGenericTypedArrayView* files.
+        https://bugs.webkit.org/show_bug.cgi?id=165022
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::set):
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/Operations.cpp/h.
+        https://bugs.webkit.org/show_bug.cgi?id=165046
+
+        Reviewed by Saam Barati.
+
+        Also switched to using returning { } instead of JSValue().
+
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        (JSC::jsIsObjectTypeOrNull):
+        * runtime/Operations.h:
+        (JSC::jsStringFromRegisterArray):
+        (JSC::jsStringFromArguments):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in JSScope.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165047
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in JSTypedArrayViewPrototype.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165049
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncSort):
+        (JSC::typedArrayViewProtoFuncSet):
+        (JSC::typedArrayViewProtoFuncCopyWithin):
+        (JSC::typedArrayViewProtoFuncIncludes):
+        (JSC::typedArrayViewProtoFuncLastIndexOf):
+        (JSC::typedArrayViewProtoFuncIndexOf):
+        (JSC::typedArrayViewProtoFuncJoin):
+        (JSC::typedArrayViewProtoGetterFuncBuffer):
+        (JSC::typedArrayViewProtoGetterFuncLength):
+        (JSC::typedArrayViewProtoGetterFuncByteLength):
+        (JSC::typedArrayViewProtoGetterFuncByteOffset):
+        (JSC::typedArrayViewProtoFuncReverse):
+        (JSC::typedArrayViewPrivateFuncSubarrayCreate):
+        (JSC::typedArrayViewProtoFuncSlice):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/Map* files.
+        https://bugs.webkit.org/show_bug.cgi?id=165050
+
+        Reviewed by Saam Barati.
+
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/MapPrototype.cpp:
+        (JSC::privateFuncMapIteratorNext):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in more miscellaneous files.
+        https://bugs.webkit.org/show_bug.cgi?id=165102
+
+        Reviewed by Saam Barati.
+
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/Weak* files.
+        https://bugs.webkit.org/show_bug.cgi?id=165096
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::protoFuncWeakMapSet):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::constructWeakSet):
+        * runtime/WeakSetPrototype.cpp:
+        (JSC::protoFuncWeakSetAdd):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/String* files.
+        https://bugs.webkit.org/show_bug.cgi?id=165067
+
+        Reviewed by Saam Barati.
+
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCodePoint):
+        (JSC::constructWithStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::StringObject::putByIndex):
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::replaceUsingStringSearch):
+        (JSC::repeatCharacter):
+        (JSC::replace):
+        (JSC::stringProtoFuncReplaceUsingStringSearch):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCodePointAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::splitStringByOneCharacterImpl):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::toLocaleCase):
+        (JSC::trimString):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::stringProtoFuncIterator):
+        (JSC::normalize):
+        (JSC::stringProtoFuncNormalize):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in ObjectConstructor.cpp and ObjectPrototype.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165051
+
+        Reviewed by Saam Barati.
+
+        Also,
+        1. Replaced returning JSValue() with returning { }.
+        2. Replaced uses of exec->propertyNames() with vm.propertyNames.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyDescriptors):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorGetOwnPropertySymbols):
+        (JSC::objectConstructorKeys):
+        (JSC::ownEnumerablePropertyKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::defineProperties):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        (JSC::setIntegrityLevel):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::ownPropertyKeys):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+
+2016-11-26  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in miscellaneous files.
+        https://bugs.webkit.org/show_bug.cgi?id=165055
+
+        Reviewed by Saam Barati.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncIMul):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+        (JSC::moduleLoaderPrototypeRequestedModules):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototypeFuncNext):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayEntry::put):
+        * runtime/TemplateRegistry.cpp:
+        (JSC::TemplateRegistry::getTemplateObject):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in ReflectObject.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165066
+
+        Reviewed by Saam Barati.
+
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectConstruct):
+        (JSC::reflectObjectDefineProperty):
+        (JSC::reflectObjectEnumerate):
+        (JSC::reflectObjectGet):
+        (JSC::reflectObjectGetOwnPropertyDescriptor):
+        (JSC::reflectObjectGetPrototypeOf):
+        (JSC::reflectObjectOwnKeys):
+        (JSC::reflectObjectSet):
+
+2016-11-24  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in ArrayConstructor.cpp and ArrayPrototype.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=164972
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::putLength):
+        (JSC::speciesWatchpointsValid):
+        (JSC::speciesConstructArray):
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::slowJoin):
+        (JSC::fastJoin):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        (JSC::concatAppendOne):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        (JSC::ArrayPrototype::attemptToInitializeSpeciesWatchpoint):
+
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in LLIntSlowPaths.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=164969
+
+        Reviewed by Geoffrey Garen.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::setUpCall):
+        (JSC::LLInt::varargsSetup):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2016-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [WTF] Import std::optional reference implementation as WTF::Optional
+        https://bugs.webkit.org/show_bug.cgi?id=164199
+
+        Reviewed by Saam Barati and Sam Weinig.
+
+        Previous WTF::Optional::operator= is not compatible to std::optional::operator=.
+        std::optional::emplace has the same semantics to the previous one.
+        So we change the code to use it.
+
+        * Scripts/builtins/builtins_templates.py:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
+        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::commuteCompareToZeroIntoTest):
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::forEachArg):
+        (JSC::B3::CheckSpecial::shouldTryAliasingDef):
+        * b3/B3CheckSpecial.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::scaleForShl):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::tryAppendLea):
+        * b3/B3Opcode.cpp:
+        (JSC::B3::invertedCompare):
+        * b3/B3Opcode.h:
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::forEachArg):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        * b3/B3StackmapSpecial.h:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::invertedCompare):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isValidScale):
+        (JSC::B3::Air::Arg::isValidAddrForm):
+        (JSC::B3::Air::Arg::isValidIndexForm):
+        (JSC::B3::Air::Arg::isValidForm):
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::PatchCustom::shouldTryAliasingDef):
+        * b3/air/AirFixObviousSpills.cpp:
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::shouldTryAliasingDef):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirSpecial.cpp:
+        (JSC::B3::Air::Special::shouldTryAliasingDef):
+        * b3/air/AirSpecial.h:
+        * bytecode/BytecodeGeneratorification.cpp:
+        (JSC::BytecodeGeneratorification::storageForGeneratorLocal):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::findPC):
+        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex):
+        * bytecode/CodeBlock.h:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::link):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitPutConstantProperty):
+        (JSC::ObjectPatternNode::bindValue):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::resolveBreakpoint):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::currentPosition):
+        * debugger/DebuggerParseData.cpp:
+        (JSC::DebuggerPausePositions::breakpointLocationForLineColumn):
+        * debugger/DebuggerParseData.h:
+        * debugger/ScriptProfilingScope.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::findPC):
+        * dfg/DFGJITCode.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::generate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        (JSC::DFG::SpeculativeJIT::emitUntypedBitOp):
+        (JSC::DFG::SpeculativeJIT::emitUntypedRightShiftBitOp):
+        (JSC::DFG::SpeculativeJIT::compileMathIC):
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::findPC):
+        * ftl/FTLJITCode.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAsync):
+        (JSC::Heap::collectSync):
+        (JSC::Heap::collectInThread):
+        (JSC::Heap::requestCollection):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::shouldDoFullCollection):
+        * heap/Heap.h:
+        (JSC::Heap::collectionScope):
+        * heap/HeapSnapshot.cpp:
+        (JSC::HeapSnapshot::nodeForCell):
+        (JSC::HeapSnapshot::nodeForObjectIdentifier):
+        * heap/HeapSnapshot.h:
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::dispatch):
+        (Inspector::BackendDispatcher::sendPendingErrors):
+        (Inspector::BackendDispatcher::reportProtocolError):
+        * inspector/InspectorBackendDispatcher.h:
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::nodeForHeapObjectIdentifier):
+        (Inspector::InspectorHeapAgent::getPreview):
+        (Inspector::InspectorHeapAgent::getRemoteObject):
+        * inspector/agents/InspectorHeapAgent.h:
+        * inspector/remote/RemoteConnectionToTarget.h:
+        * inspector/remote/RemoteConnectionToTarget.mm:
+        (Inspector::RemoteConnectionToTarget::targetIdentifier):
+        (Inspector::RemoteConnectionToTarget::setup):
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::updateClientCapabilities):
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
+        (_generate_declarations_for_enum_conversion_methods):
+        (_generate_declarations_for_enum_conversion_methods.return_type_with_export_macro):
+        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
+        (CppProtocolTypesImplementationGenerator._generate_enum_conversion_methods_for_domain.generate_conversion_method_body):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * jit/JITCode.h:
+        (JSC::JITCode::findPC):
+        * jit/JITDivGenerator.cpp:
+        (JSC::JITDivGenerator::generateFastPath):
+        * jit/JITOperations.cpp:
+        * jit/PCToCodeOriginMap.cpp:
+        (JSC::PCToCodeOriginMap::findPC):
+        * jit/PCToCodeOriginMap.h:
+        * jsc.cpp:
+        (WTF::RuntimeArray::getOwnPropertySlot):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::exportVariable):
+        * runtime/ConcurrentJSLock.h:
+        (JSC::ConcurrentJSLocker::ConcurrentJSLocker):
+        * runtime/DefinePropertyAttributes.h:
+        (JSC::DefinePropertyAttributes::writable):
+        (JSC::DefinePropertyAttributes::configurable):
+        (JSC::DefinePropertyAttributes::enumerable):
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::getOwnPropertySlot):
+        (JSC::GenericArguments<Type>::put):
+        (JSC::GenericArguments<Type>::deleteProperty):
+        (JSC::GenericArguments<Type>::defineOwnProperty):
+        * runtime/HasOwnPropertyCache.h:
+        (JSC::HasOwnPropertyCache::get):
+        * runtime/HashMapImpl.h:
+        (JSC::concurrentJSMapHash):
+        * runtime/Identifier.h:
+        (JSC::parseIndex):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toNumberFromPrimitive):
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSCJSValue.h:
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValueWithoutCoercion):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
+        (JSC::JSGenericTypedArrayView<Adaptor>::put):
+        * runtime/JSModuleRecord.cpp:
+        * runtime/JSModuleRecord.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::putDirectMayBeIndex):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::putOwnDataPropertyMayBeIndex):
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putInline):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        * runtime/MathCommon.h:
+        (JSC::safeReciprocalForDivByConst):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        * runtime/PropertyDescriptor.h:
+        (JSC::toPropertyDescriptor):
+        * runtime/PropertyName.h:
+        (JSC::parseIndex):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::isStringOwnProperty):
+        (JSC::StringObject::deleteProperty):
+        * runtime/ToNativeFromValue.h:
+        (JSC::toNativeFromValueWithoutCoercion):
+        * runtime/TypedArrayAdaptors.h:
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32WithoutCoercion):
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
+        (JSC::FloatTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
+        (JSC::FloatTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
+        (JSC::Uint8ClampedAdaptor::toNativeFromInt32WithoutCoercion):
+        (JSC::Uint8ClampedAdaptor::toNativeFromDoubleWithoutCoercion):
+
+2016-11-26  Sam Weinig  <sam@webkit.org>
+
+        Convert IntersectionObserver over to using RuntimeEnabledFeatures so it can be properly excluded from script
+        https://bugs.webkit.org/show_bug.cgi?id=164965
+
+        Reviewed by Simon Fraser.
+
+        * runtime/CommonIdentifiers.h:
+        Add identifiers needed for RuntimeEnabledFeatures.
+
+2016-11-23  Zan Dobersek  <zdobersek@igalia.com>
+
+        Remove ENABLE_ASSEMBLER_WX_EXCLUSIVE code
+        https://bugs.webkit.org/show_bug.cgi?id=165027
+
+        Reviewed by Darin Adler.
+
+        Remove the code guarded with ENABLE(ASSEMBLER_WX_EXCLUSIVE).
+        No port enables this and the guarded code doesn't build at all,
+        so it's safe to say it's abandoned.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::initializeAllocator):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::reprotectRegion): Deleted.
+
+2016-11-18  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in JSC profiler files.
+        https://bugs.webkit.org/show_bug.cgi?id=164971
+
+        Reviewed by Saam Barati.
+
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::addSequenceProperties):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::toJS):
+        (JSC::Profiler::Database::toJSON):
+        * profiler/ProfilerOSRExitSite.cpp:
+        (JSC::Profiler::OSRExitSite::toJS):
+        * profiler/ProfilerOriginStack.cpp:
+        (JSC::Profiler::OriginStack::toJS):
+
+2016-11-22  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in JSONObject.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165025
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        (JSC::JSONStringify):
+
+2016-11-21  Mark Lam  <mark.lam@apple.com>
+
+        Removed an extra space character at the end of line.
+
+        Not reviewed.
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toNumber):
+
+2016-11-21  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in FunctionConstructor.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165011
+
+        Reviewed by Saam Barati.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+
+2016-11-21  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in GetterSetter.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165013
+
+        Reviewed by Saam Barati.
+
+        * runtime/GetterSetter.cpp:
+        (JSC::callGetter):
+        (JSC::callSetter):
+
+2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
+        https://bugs.webkit.org/show_bug.cgi?id=164898
+
+        Reviewed by Darin Adler.
+
+        The callsite object (JSArray) of tagged template literal is managed by WeakGCMap since
+        same tagged template literal need to return an identical object.
+        The problem is that we used TemplateRegistryKey as the key of the WeakGCMap. WeakGCMap
+        can prune its entries in the collector thread. At that time, this TemplateRegistryKey
+        is deallocated. Since it includes String (and then, StringImpl), we accidentally call
+        ref(), deref() and StringImpl::destroy() in the different thread from the main thread
+        while this TemplateRegistryKey is allocated in the main thread.
+
+        Instead, we use TemplateRegistryKey* as the key of WeakGCMap. Then, to keep its liveness
+        while the entry of the WeakGCMap is alive, the callsite object has the reference to
+        the JSTemplateRegistryKey. And it holds Ref<TemplateRegistryKey>.
+
+        And now we need to lookup WeakGCMap with TemplateRegistryKey*. To do so, we create
+        interning system for TemplateRegistryKey. It is similar to AtomicStringTable and
+        SymbolRegistry. TemplateRegistryKey is allocated from this table. This table atomize the
+        TemplateRegistryKey. So we can use the pointer comparison between TemplateRegistryKey.
+        It allows us to lookup the entry from WeakGCMap by TemplateRegistryKey*.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinNames.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant):
+        (JSC::BytecodeGenerator::emitGetTemplateObject):
+        * bytecompiler/BytecodeGenerator.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::getTemplateObject):
+        * runtime/JSTemplateRegistryKey.cpp:
+        (JSC::JSTemplateRegistryKey::JSTemplateRegistryKey):
+        (JSC::JSTemplateRegistryKey::create):
+        * runtime/JSTemplateRegistryKey.h:
+        * runtime/TemplateRegistry.cpp:
+        (JSC::TemplateRegistry::getTemplateObject):
+        * runtime/TemplateRegistry.h:
+        * runtime/TemplateRegistryKey.cpp: Copied from Source/JavaScriptCore/runtime/TemplateRegistry.h.
+        (JSC::TemplateRegistryKey::~TemplateRegistryKey):
+        * runtime/TemplateRegistryKey.h:
+        (JSC::TemplateRegistryKey::calculateHash):
+        (JSC::TemplateRegistryKey::create):
+        (JSC::TemplateRegistryKey::TemplateRegistryKey):
+        * runtime/TemplateRegistryKeyTable.cpp: Added.
+        (JSC::TemplateRegistryKeyTranslator::hash):
+        (JSC::TemplateRegistryKeyTranslator::equal):
+        (JSC::TemplateRegistryKeyTranslator::translate):
+        (JSC::TemplateRegistryKeyTable::~TemplateRegistryKeyTable):
+        (JSC::TemplateRegistryKeyTable::createKey):
+        (JSC::TemplateRegistryKeyTable::unregister):
+        * runtime/TemplateRegistryKeyTable.h: Copied from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
+        (JSC::TemplateRegistryKeyTable::KeyHash::hash):
+        (JSC::TemplateRegistryKeyTable::KeyHash::equal):
+        * runtime/VM.h:
+        (JSC::VM::templateRegistryKeyTable):
+
+2016-11-21  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/Error* files.
+        https://bugs.webkit.org/show_bug.cgi?id=164998
+
+        Reviewed by Darin Adler.
+
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+
+2016-11-21  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in *Executable.cpp files.
+        https://bugs.webkit.org/show_bug.cgi?id=164996
+
+        Reviewed by Darin Adler.
+
+        * runtime/DirectEvalExecutable.cpp:
+        (JSC::DirectEvalExecutable::create):
+        * runtime/IndirectEvalExecutable.cpp:
+        (JSC::IndirectEvalExecutable::create):
+        * runtime/ProgramExecutable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/ScriptExecutable.cpp:
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+
+2016-11-20  Zan Dobersek  <zdobersek@igalia.com>
+
+        [EncryptedMedia] Make EME API runtime-enabled
+        https://bugs.webkit.org/show_bug.cgi?id=164927
+
+        Reviewed by Jer Noble.
+
+        * runtime/CommonIdentifiers.h: Add the necessary identifiers.
+
+2016-11-20  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in ConstructData.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=164976
+
+        Reviewed by Darin Adler.
+
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+
+2016-11-20  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in CommonSlowPaths.cpp/h.
+        https://bugs.webkit.org/show_bug.cgi?id=164975
+
+        Reviewed by Darin Adler.
+
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+
+2016-11-20  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in DateConstructor.cpp and DatePrototype.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=164995
+
+        Reviewed by Darin Adler.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::millisecondsFromComponents):
+        (JSC::constructDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToPrimitiveSymbol):
+
+2016-11-20  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] speed up parsing of async functions
+        https://bugs.webkit.org/show_bug.cgi?id=164808
+
+        Reviewed by Yusuke Suzuki.
+
+        Minor adjustments to Parser in order to mitigate slowdown with async
+        function parsing enabled:
+
+          - Tokenize "async" as a keyword
+          - Perform less branching in various areas of the Parser
+
+        * parser/Keywords.table:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::maybeParseAsyncFunctionDeclarationStatement):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::createResolveAndUseVariable):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        (JSC::Parser<LexerType>::printUnexpectedTokenText):
+        * parser/Parser.h:
+        (JSC::isAnyContextualKeyword):
+        (JSC::isIdentifierOrAnyContextualKeyword):
+        (JSC::isSafeContextualKeyword):
+        (JSC::Parser::matchSpecIdentifier):
+        * parser/ParserTokens.h:
+        * runtime/CommonIdentifiers.h:
+
+2016-11-19  Mark Lam  <mark.lam@apple.com>
+
+        Add --timeoutMultiplier option to allow some tests more time to run.
+        https://bugs.webkit.org/show_bug.cgi?id=164951
+
+        Reviewed by Yusuke Suzuki.
+
+        * jsc.cpp:
+        (timeoutThreadMain):
+        - Modified to factor in a timeout multiplier that can adjust the timeout duration.
+        (startTimeoutThreadIfNeeded):
+        - Moved the code that starts the timeout thread here from main() so that we can
+        call it after command line args have been parsed instead.
+        (main):
+        - Deleted old timeout thread starting code.
+        (CommandLine::parseArguments):
+        - Added parsing of the --timeoutMultiplier option.
+        (jscmain):
+        - Start the timeout thread if needed after we've parsed the command line args.
+
+2016-11-19  Mark Lam  <mark.lam@apple.com>
+
+        Fix missing exception checks in JSC inspector files.
+        https://bugs.webkit.org/show_bug.cgi?id=164959
+
+        Reviewed by Saam Barati.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        (Inspector::JSInjectedScriptHost::weakMapEntries):
+        (Inspector::JSInjectedScriptHost::weakSetEntries):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::scopeDescriptions):
+
+2016-11-18  Mark Lam  <mark.lam@apple.com>
+
+        Fix missing exception checks in DFGOperations.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=164958
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGOperations.cpp:
+
+2016-11-18  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in ShadowChicken.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=164966
+
+        Reviewed by Saam Barati.
+
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::functionsOnStack):
+
+2016-11-18  Jeremy Jones  <jeremyj@apple.com>
+
+        Add runtime flag to enable pointer lock. Enable pointer lock feature for mac.
+        https://bugs.webkit.org/show_bug.cgi?id=163801
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+
+2016-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Concurrent GC should be able to run splay in debug mode and earley/raytrace in release mode with no perf regression
+        https://bugs.webkit.org/show_bug.cgi?id=164282
+
+        Reviewed by Geoffrey Garen and Oliver Hunt.
+        
+        The two three remaining bugs were:
+
+        - Improper ordering inside putDirectWithoutTransition() and friends. We need to make sure
+          that the GC doesn't see the store to Structure::m_offset until we've resized the butterfly.
+          That proved a bit tricky. On the other hand, this means that we could probably remove the
+          requirement that the GC holds the Structure lock in some cases. I haven't removed that lock
+          yet because I still think it might protect some weird cases, and it doesn't seem to cost us
+          anything.
+        
+        - CodeBlock's GC strategy needed to be made thread-safe (visitWeakly, visitChildren, and
+          their friends now hold locks) and incremental-safe (we need to update predictions in the
+          finalizer to make sure we clear anything that was put into a value profile towards the end
+          of GC).
+        
+        - The GC timeslicing scheduler needed to be made a bit more aggressive to deal with
+          generational workloads like earley, raytrace, and CDjs. Once I got those benchmarks to run,
+          I found that they would do many useless iterations of GC because they wouldn't pause long
+          enough after rescanning weak references and roots. I added a bunch of knobs for forcing a
+          pause. In the end, I realized that I could get the desired effect by putting a ceiling on
+          mutator utilization. We want the GC to finish quickly if it is possible to do so, even if
+          the amount of allocation that the mutator had done is low. Having a utilization ceiling
+          seems to accomplish this for benchmarks with trivial heaps (earley and raytrace) as well as
+          huge heaps (like CDjs in its "large" configuration).
+        
+        This preserves splay performance, makes the concurrent GC more stable, and makes the
+        concurrent GC not a perf regression on earley or raytrace. It seems to give us great CDjs
+        performance as well, but this is still hard to tell because we crash a lot in that benchmark.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitWeakly):
+        (JSC::CodeBlock::visitChildren):
+        (JSC::CodeBlock::shouldVisitStrongly):
+        (JSC::CodeBlock::shouldJettisonDueToOldAge):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::determineLiveness):
+        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences):
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally):
+        (JSC::CodeBlock::visitOSRExitTargets):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC::CodeBlock::stronglyVisitWeakReferences):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        * heap/Heap.cpp:
+        (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
+        (JSC::Heap::markToFixpoint):
+        (JSC::Heap::beginMarking):
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::collectInThread):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::mutatorFence):
+        * heap/MarkedBlock.cpp:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::finishCreation):
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectInternal):
+        * runtime/Options.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::add):
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::add):
+
+2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Generator functions should have a displayable name when shown in stack traces
+        https://bugs.webkit.org/show_bug.cgi?id=164844
+        <rdar://problem/29300697>
+
+        Reviewed by Yusuke Suzuki.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createGeneratorFunctionBody):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGeneratorFunctionBody):
+        New way to create a generator function with an inferred name.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
+        * parser/Parser.h:
+        Pass on the name of the generator wrapper function so we can
+        use it on the inner generator function.
+
+2016-11-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Add an experimental API to find elements across shadow boundaries
+        https://bugs.webkit.org/show_bug.cgi?id=164851
+        <rdar://problem/28220092>
+
+        Reviewed by Sam Weinig.
+
+        * runtime/CommonIdentifiers.h:
+
+2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Drop arguments.caller
+        https://bugs.webkit.org/show_bug.cgi?id=164859
+
+        Reviewed by Saam Barati.
+
+        Originally, some JavaScript engine has `arguments.caller` property.
+        But it easily causes some information leaks and it becomes obstacles
+        for secure ECMAScript (SES). In ES5, we make it deprecated in strict
+        mode. To do so, we explicitly set "caller" getter throwing TypeError
+        to arguments in strict mode.
+
+        But now, there is no modern engine which supports `arguments.caller`
+        in sloppy mode. So the original compatibility problem is gone and
+        "caller" getter in the strict mode arguments becomes meaningless.
+
+        ES2017 drops this from the spec. In this patch, we also drop this
+        `arguments.caller` in strict mode support.
+
+        Note that Function#caller is still alive.
+
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        (JSC::ClonedArguments::put):
+        (JSC::ClonedArguments::deleteProperty):
+        (JSC::ClonedArguments::defineOwnProperty):
+        (JSC::ClonedArguments::materializeSpecials):
+
+2016-11-17  Mark Lam  <mark.lam@apple.com>
+
+        Inlining should be disallowed when JSC_alwaysUseShadowChicken=true.
+        https://bugs.webkit.org/show_bug.cgi?id=164893
+        <rdar://problem/29146436>
+
+        Reviewed by Saam Barati.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-11-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Speculatively disable eager object zero-fill on not-x86 to let the bots decide if that's a problem
+        https://bugs.webkit.org/show_bug.cgi?id=164885
+
+        Reviewed by Mark Lam.
+        
+        This adds a useGCFences() function that we use to guard all eager object zero-fill and the
+        related fences. It currently returns true only on x86().
+        
+        The goal here is to get the bots to tell us if this code is responsible for perf issues on
+        any non-x86 platforms. We have a few different paths that we can pursue if this turns out
+        to be the case. Eager zero-fill is merely the easiest way to optimize out some fences, but
+        we could get rid of it and instead teach B3 how to think about fences.
+
+        * assembler/CPU.h:
+        (JSC::useGCFences):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
+        (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::mutatorFence):
+        (JSC::AssemblyHelpers::storeButterfly):
+        (JSC::AssemblyHelpers::emitInitializeInlineStorage):
+        (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
+
+2016-11-17  Keith Miller  <keith_miller@apple.com>
+
+        Add rotate to Wasm
+        https://bugs.webkit.org/show_bug.cgi?id=164871
+
+        Reviewed by Filip Pizlo.
+
+        Add rotate left and rotate right to Wasm. These directly map to B3 opcodes.
+        This also moves arm specific transformations of rotate left to lower macros
+        after optimization. It's a bad idea to have platform specific canonicalizations
+        in reduce strength since other optimizations may not be aware of it.
+
+        Add a bug to do pure CSE after lower macros after optimization since we want to
+        clean up RotL(value, Neg(Neg(shift))).
+
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3LowerMacrosAfterOptimizations.cpp:
+        * b3/B3ReduceStrength.cpp:
+        * wasm/wasm.json:
+
+2016-11-17  Keith Miller  <keith_miller@apple.com>
+
+        Add sqrt to Wasm
+        https://bugs.webkit.org/show_bug.cgi?id=164877
+
+        Reviewed by Mark Lam.
+
+        B3 already has a Sqrt opcode we just need to map Wasm to it.
+
+        * wasm/wasm.json:
+
+2016-11-17  Keith Miller  <keith_miller@apple.com>
+
+        Add support for rotate in B3 and the relevant assemblers
+        https://bugs.webkit.org/show_bug.cgi?id=164869
+
+        Reviewed by Geoffrey Garen.
+
+        This patch runs RotR and RotL (rotate right and left respectively)
+        through B3 and B3's assemblers. One thing of note is that ARM64 does
+        not support rotate left instead it allows negative right rotations.
+
+        This patch also fixes a theoretical bug in the assembler where
+        on X86 doing someShiftOp(reg, edx) would instead shift the shift
+        amount by the value. Additionally, this patch refactors some
+        of the X86 assembler to use templates when deciding how to format
+        the appropriate shift instruction.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::rotateRight32):
+        (JSC::MacroAssemblerARM64::rotateRight64):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::rotateRight32):
+        (JSC::MacroAssemblerX86Common::rotateLeft32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::lshift64):
+        (JSC::MacroAssemblerX86_64::rshift64):
+        (JSC::MacroAssemblerX86_64::urshift64):
+        (JSC::MacroAssemblerX86_64::rotateRight64):
+        (JSC::MacroAssemblerX86_64::rotateLeft64):
+        (JSC::MacroAssemblerX86_64::or64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::xorq_rm):
+        (JSC::X86Assembler::shiftInstruction32):
+        (JSC::X86Assembler::sarl_i8r):
+        (JSC::X86Assembler::shrl_i8r):
+        (JSC::X86Assembler::shll_i8r):
+        (JSC::X86Assembler::rorl_i8r):
+        (JSC::X86Assembler::rorl_CLr):
+        (JSC::X86Assembler::roll_i8r):
+        (JSC::X86Assembler::roll_CLr):
+        (JSC::X86Assembler::shiftInstruction64):
+        (JSC::X86Assembler::sarq_CLr):
+        (JSC::X86Assembler::sarq_i8r):
+        (JSC::X86Assembler::shrq_i8r):
+        (JSC::X86Assembler::shlq_i8r):
+        (JSC::X86Assembler::rorq_i8r):
+        (JSC::X86Assembler::rorq_CLr):
+        (JSC::X86Assembler::rolq_i8r):
+        (JSC::X86Assembler::rolq_CLr):
+        * b3/B3Common.h:
+        (JSC::B3::rotateRight):
+        (JSC::B3::rotateLeft):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::rotRConstant):
+        (JSC::B3::Const32Value::rotLConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::rotRConstant):
+        (JSC::B3::Const64Value::rotLConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::rotRConstant):
+        (JSC::B3::Value::rotLConstant):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::materialize):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::isRotateRight32Valid):
+        (JSC::B3::Air::isRotateLeft32Valid):
+        (JSC::B3::Air::isRotateRight64Valid):
+        (JSC::B3::Air::isRotateLeft64Valid):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testRotR):
+        (JSC::B3::testRotL):
+        (JSC::B3::testRotRWithImmShift):
+        (JSC::B3::testRotLWithImmShift):
+        (JSC::B3::run):
+
+2016-11-17  Saam Barati  <sbarati@apple.com>
+
+        Remove async/await compile time flag and enable tests
+        https://bugs.webkit.org/show_bug.cgi?id=164828
+        <rdar://problem/28639334>
+
+        Reviewed by Yusuke Suzuki.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        (JSC::Parser<LexerType>::parseUnaryExpression):
+
+2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] WTF::TemporaryChange with WTF::SetForScope
+        https://bugs.webkit.org/show_bug.cgi?id=164761
+
+        Reviewed by Saam Barati.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/SetForScope.h: Removed.
+        * debugger/Debugger.cpp:
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::dispatch):
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionLog):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionSound):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe):
+        (Inspector::ScriptDebugServer::sourceParsed):
+        (Inspector::ScriptDebugServer::dispatchFunctionToListeners):
+        * parser/Parser.cpp:
+
+2016-11-16  Mark Lam  <mark.lam@apple.com>
+
+        ExceptionFuzz needs to placate exception check verification before overwriting a thrown exception.
+        https://bugs.webkit.org/show_bug.cgi?id=164843
+
+        Reviewed by Keith Miller.
+
+        The ThrowScope will check for unchecked simulated exceptions before throwing a
+        new exception.  This ensures that we don't quietly overwrite a pending exception
+        (which should never happen, with the only exception being to rethrow the same
+        exception).  However, ExceptionFuzz works by intentionally throwing its own
+        exception even when one may already exist thereby potentially overwriting an
+        existing exception.  This is ok for ExceptionFuzz testing, but we need to placate
+        the exception check verifier before ExceptionFuzz throws its own exception.
+
+        * runtime/ExceptionFuzz.cpp:
+        (JSC::doExceptionFuzzing):
+
+2016-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        UnlinkedCodeBlock should not have a starting line number
+        https://bugs.webkit.org/show_bug.cgi?id=164838
+
+        Reviewed by Mark Lam.
+
+        Here's how the starting line number in UnlinkedCodeBlock used to work:
+
+        (1) Assign the source code starting line number to the parser starting
+        line number.
+
+        (2) Assign (1) to the AST.
+
+        (3) Subtract (1) from (2) and assign to UnlinkedCodeBlock.
+
+        Then, when linking:
+
+        (4) Add (3) to (1).
+
+        This was an awesome no-op.
+
+        Generally, unlinked code is code that is not tied to any particular
+        web page or resource. So, it's inappropriate to think of it having a
+        starting line number.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::recordParse):
+        (JSC::UnlinkedCodeBlock::hasCapturedVariables):
+        (JSC::UnlinkedCodeBlock::firstLine): Deleted.
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
+        * runtime/CodeCache.h:
+        (JSC::generateUnlinkedCodeBlock):
+
+2016-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6][WebCore] Change ES6_MODULES compile time flag to runtime flag
+        https://bugs.webkit.org/show_bug.cgi?id=164827
+
+        Reviewed by Ryosuke Niwa.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out r208811. It's not sound.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
+        (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
+        (JSC::FTL::DFG::LowerDFGToB3::splatWordsIfMutatorIsFenced): Deleted.
+
+2016-11-16  Keith Miller  <keith_miller@apple.com>
+
+        Wasm function parser should use template functions for each binary and unary opcode
+        https://bugs.webkit.org/show_bug.cgi?id=164835
+
+        Reviewed by Mark Lam.
+
+        This patch changes the wasm function parser to call into a template specialization
+        for each binary/unary opcode. This change makes it easier to have custom implementations
+        of various opcodes. It is also, in theory a speedup since it does not require switching
+        on the opcode twice.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * wasm/WasmB3IRGenerator.cpp:
+        (): Deleted.
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::binaryCase):
+        (JSC::Wasm::FunctionParser<Context>::unaryCase):
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmValidate.cpp:
+        * wasm/generateWasm.py:
+        (isBinary):
+        (isSimple):
+        * wasm/generateWasmB3IRGeneratorInlinesHeader.py: Added.
+        (generateSimpleCode):
+        * wasm/generateWasmOpsHeader.py:
+        (opcodeMacroizer):
+        * wasm/generateWasmValidateInlinesHeader.py:
+
+2016-11-16  Mark Lam  <mark.lam@apple.com>
+
+        ExceptionFuzz functions should use its client's ThrowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=164834
+
+        Reviewed by Geoffrey Garen.
+
+        This is because ExceptionFuzz's purpose is to throw exceptions from its client at
+        exception check sites.  Using the client's ThrowScope solves 2 problems:
+
+        1. If ExceptionFuzz instantiates its own ThrowScope, the simulated throw will be
+           mis-attributed to ExceptionFuzz when it should be attributed to its client.
+
+        2. One way exception scope verification works is by having ThrowScopes assert
+           that there are no unchecked simulated exceptions when the ThrowScope is
+           instantiated.  However, ExceptionFuzz necessarily works by inserting
+           doExceptionFuzzingIfEnabled() in between a ThrowScope that simulated a throw
+           and an exception check.  If we declare a ThrowScope in ExceptionFuzz's code,
+           we will be instantiating the ThrowScope between the point where a simulated
+           throw occurs and where the needed exception check can occur.  Hence, having
+           ExceptionFuzz instantiate its own ThrowScope will fail exception scope
+           verification every time.
+
+        Changing ExceptionFuzz to use its client's ThrowScope resolves both problems.
+
+        Also fixed the THROW() macro in CommonSlowPaths.cpp to use the ThrowScope that
+        already exists in every slow path function instead of creating a new one.
+
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/ExceptionFuzz.cpp:
+        (JSC::doExceptionFuzzing):
+        * runtime/ExceptionFuzz.h:
+        (JSC::doExceptionFuzzingIfEnabled):
+
+2016-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Slight Octane regression from concurrent GC's eager object zero-fill
+        https://bugs.webkit.org/show_bug.cgi?id=164823
+
+        Reviewed by Geoffrey Garen.
+        
+        During concurrent GC, we need to eagerly zero-fill objects we allocate prior to
+        executing the end-of-allocation fence. This causes some regressions. This is an attempt
+        to fix those regressions by making them conditional on whether the mutator is fenced.
+        
+        This is a slight speed-up on raytrace and boyer, and hopefully it will fix the
+        regression.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::splatWordsIfMutatorIsFenced):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
+        (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
+
+2016-11-16  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope checking in JSGlobalObject.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=164831
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        - Use a CatchScope here because we don't ever expect JSGlobalObject initialization
+          to fail with errors.
+        (JSC::JSGlobalObject::put):
+        - Fix exception check requirements.
+
+2016-11-16  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, ARM build fix.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::lowerX86Div):
+        (JSC::B3::Air::LowerToAir::lowerX86UDiv):
+
+2016-11-15  Mark Lam  <mark.lam@apple.com>
+
+        Make JSC test functions more robust.
+        https://bugs.webkit.org/show_bug.cgi?id=164807
+
+        Reviewed by Keith Miller.
+
+        * jsc.cpp:
+        (functionGetHiddenValue):
+        (functionSetHiddenValue):
+
+2016-11-15  Keith Miller  <keith_miller@apple.com>
+
+        B3 should support UDiv/UMod
+        https://bugs.webkit.org/show_bug.cgi?id=164811
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds support for UDiv and UMod in B3. Many of the magic number
+        cases have been ommited for now since they are unlikely to happen in wasm
+        code. Most wasm code we will see is generated via llvm, which has more
+        robust versions of what we would do anyway. Additionally, this patch
+        links the new opcodes up to the wasm parser.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::uDiv32):
+        (JSC::MacroAssemblerARM64::uDiv64):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::x86UDiv32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::x86UDiv64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::divq_r):
+        * b3/B3Common.h:
+        (JSC::B3::chillUDiv):
+        (JSC::B3::chillUMod):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::uDivConstant):
+        (JSC::B3::Const32Value::uModConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::uDivConstant):
+        (JSC::B3::Const64Value::uModConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3LowerMacros.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::lowerX86UDiv):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::uDivConstant):
+        (JSC::B3::Value::uModConstant):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::materialize):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::isX86UDiv32Valid):
+        (JSC::B3::Air::isX86UDiv64Valid):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testUDivArgsInt32):
+        (JSC::B3::testUDivArgsInt64):
+        (JSC::B3::testUModArgsInt32):
+        (JSC::B3::testUModArgsInt64):
+        (JSC::B3::run):
+        * wasm/wasm.json:
+
+2016-11-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Preview other CSS @media in browser window (print)
+        https://bugs.webkit.org/show_bug.cgi?id=13530
+        <rdar://problem/5712928>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Page.json:
+        Update to preferred JSON style.
+
+2016-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, revert renaming useConcurrentJIT to useConcurrentJS.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        * jit/JITWorklist.cpp:
+        (JSC::JITWorklist::compileLater):
+        (JSC::JITWorklist::compileNow):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+        * runtime/WriteBarrierInlines.h:
+        (JSC::WriteBarrierBase<T>::set):
+        (JSC::WriteBarrierBase<Unknown>::set):
+
+2016-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Debugging and other tools should not disable the code cache
+        https://bugs.webkit.org/show_bug.cgi?id=164802
+
+        Reviewed by Mark Lam.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode): Updated for interface
+        change.
+
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeFlags::SourceCodeFlags):
+        (JSC::SourceCodeFlags::bits):
+        (JSC::SourceCodeKey::SourceCodeKey): Treat debugging and other tools
+        as part of our key so that we can cache code while using tools. Be sure
+        to include these bits in our hash function so you don't get storms of
+        collisions as you open and close the Web Inspector.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
+        (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable): Treat tools as
+        a part of our key instead of as a reason to disable caching.
+
+        * runtime/CodeCache.h:
+
+2016-11-15  Mark Lam  <mark.lam@apple.com>
+
+        Remove JSString::SafeView and replace its uses with StringViewWithUnderlyingString.
+        https://bugs.webkit.org/show_bug.cgi?id=164777
+
+        Reviewed by Geoffrey Garen.
+
+        JSString::SafeView no longer achieves its intended goal to make it easier to
+        handle strings safely.  Its clients still need to do explicit exception checks in
+        order to be correct.  We'll remove it and replace its uses with
+        StringViewWithUnderlyingString instead which serves to gets the a StringView
+        (which is what we really wanted from SafeView) and keeps the backing String alive
+        while the view is in use.
+
+        Also added some missing exception checks.
+
+        * jsc.cpp:
+        (printInternal):
+        (functionDebug):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorFuncCompare):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::toStringView):
+        (JSC::globalFuncParseFloat):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/JSString.h:
+        (JSC::JSString::SafeView::is8Bit): Deleted.
+        (JSC::JSString::SafeView::length): Deleted.
+        (JSC::JSString::SafeView::SafeView): Deleted.
+        (JSC::JSString::SafeView::get): Deleted.
+        (JSC::JSString::view): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncRepeatCharacter):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncNormalize):
+
+2016-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, remove bogus assertion.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markToFixpoint):
+
+2016-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        [mac-wk1 debug] ASSERTION FAILED: thisObject->m_propertyTableUnsafe
+        https://bugs.webkit.org/show_bug.cgi?id=162986
+
+        Reviewed by Saam Barati.
+        
+        This assertion is wrong for concurrent GC anyway, so this removes it.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+
+2016-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename CONCURRENT_JIT/ConcurrentJIT to CONCURRENT_JS/ConcurrentJS
+        https://bugs.webkit.org/show_bug.cgi?id=164791
+
+        Reviewed by Geoffrey Garen.
+        
+        Just renaming.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        (JSC::ArrayProfile::briefDescription):
+        (JSC::ArrayProfile::briefDescriptionWithoutUpdating):
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::observedArrayModes):
+        (JSC::ArrayProfile::mayInterceptIndexedAccesses):
+        (JSC::ArrayProfile::mayStoreToHole):
+        (JSC::ArrayProfile::outOfBounds):
+        (JSC::ArrayProfile::usesOriginalArrayStructures):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeExitSiteData):
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+        (JSC::CallLinkStatus::computeDFGStatuses):
+        * bytecode/CallLinkStatus.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpValueProfiling):
+        (JSC::CodeBlock::dumpArrayProfiling):
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::setConstantRegisters):
+        (JSC::CodeBlock::getStubInfoMap):
+        (JSC::CodeBlock::getCallLinkInfoMap):
+        (JSC::CodeBlock::getByValInfoMap):
+        (JSC::CodeBlock::addStubInfo):
+        (JSC::CodeBlock::addByValInfo):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::resetJITData):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::getArrayProfile):
+        (JSC::CodeBlock::addArrayProfile):
+        (JSC::CodeBlock::getOrAddArrayProfile):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        (JSC::CodeBlock::updateAllArrayPredictions):
+        (JSC::CodeBlock::nameForRegister):
+        (JSC::CodeBlock::livenessAnalysisSlow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::hasExitSite):
+        (JSC::CodeBlock::livenessAnalysis):
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::ExitProfile::add):
+        (JSC::DFG::ExitProfile::hasExitSite):
+        (JSC::DFG::QueryableExitProfile::initialize):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::ExitProfile::hasExitSite):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::hasExitSite):
+        (JSC::GetByIdStatus::computeFor):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
+        (JSC::CompressedLazyOperandValueProfileHolder::add):
+        (JSC::LazyOperandValueProfileParser::initialize):
+        (JSC::LazyOperandValueProfileParser::prediction):
+        * bytecode/LazyOperandValueProfile.h:
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        (JSC::MethodOfGettingAValueProfile::emitReportValue):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::hasExitSite):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.h:
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        (JSC::StructureStubClearingWatchpoint::fireInternal):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::briefDescription):
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::withSpeculationFromProfile):
+        (JSC::DFG::ArrayMode::withProfile):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetConstantClosureVar):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        * jit/JITInlines.h:
+        (JSC::JIT::chooseArrayMode):
+        * jit/JITOperations.cpp:
+        (JSC::tryGetByValOptimize):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByValWithCachedId):
+        (JSC::JIT::privateCompilePutByValWithCachedId):
+        * jit/JITWorklist.cpp:
+        (JSC::JITWorklist::compileLater):
+        (JSC::JITWorklist::compileNow):
+        * jit/Repatch.cpp:
+        (JSC::repatchGetByID):
+        (JSC::repatchPutByID):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setupGetByIdPrototypeCache):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
+        * runtime/ConcurrentJITLock.h: Removed.
+        * runtime/ConcurrentJSLock.h: Copied from Source/JavaScriptCore/runtime/ConcurrentJITLock.h.
+        (JSC::ConcurrentJSLockerBase::ConcurrentJSLockerBase):
+        (JSC::ConcurrentJSLockerBase::~ConcurrentJSLockerBase):
+        (JSC::GCSafeConcurrentJSLocker::GCSafeConcurrentJSLocker):
+        (JSC::GCSafeConcurrentJSLocker::~GCSafeConcurrentJSLocker):
+        (JSC::ConcurrentJSLocker::ConcurrentJSLocker):
+        (JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase): Deleted.
+        (JSC::ConcurrentJITLockerBase::~ConcurrentJITLockerBase): Deleted.
+        (JSC::ConcurrentJITLockerBase::unlockEarly): Deleted.
+        (JSC::GCSafeConcurrentJITLocker::GCSafeConcurrentJITLocker): Deleted.
+        (JSC::GCSafeConcurrentJITLocker::~GCSafeConcurrentJITLocker): Deleted.
+        (JSC::ConcurrentJITLocker::ConcurrentJITLocker): Deleted.
+        * runtime/InferredType.cpp:
+        (JSC::InferredType::canWatch):
+        (JSC::InferredType::addWatchpoint):
+        (JSC::InferredType::willStoreValueSlow):
+        (JSC::InferredType::makeTopSlow):
+        (JSC::InferredType::set):
+        (JSC::InferredType::removeStructure):
+        * runtime/InferredType.h:
+        * runtime/InferredTypeTable.cpp:
+        (JSC::InferredTypeTable::visitChildren):
+        (JSC::InferredTypeTable::get):
+        (JSC::InferredTypeTable::willStoreValue):
+        (JSC::InferredTypeTable::makeTop):
+        * runtime/InferredTypeTable.h:
+        * runtime/JSEnvironmentRecord.cpp:
+        (JSC::JSEnvironmentRecord::heapSnapshot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::shiftButterflyAfterFlattening):
+        * runtime/JSObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectInternal):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        (JSC::JSScope::collectClosureVariablesUnderTDZ):
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::findVariableIndex):
+        (JSC::JSSegmentedVariableObject::addVariables):
+        (JSC::JSSegmentedVariableObject::heapSnapshot):
+        * runtime/JSSegmentedVariableObject.h:
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+        * runtime/ProgramExecutable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::matchConcurrently):
+        (JSC::RegExp::compileMatchOnly):
+        (JSC::RegExp::deleteCode):
+        * runtime/RegExp.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyTable):
+        (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
+        (JSC::Structure::addNewPropertyTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::ensurePropertyReplacementWatchpointSet):
+        (JSC::Structure::add):
+        (JSC::Structure::remove):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::propertyReplacementWatchpointSet):
+        (JSC::Structure::add):
+        (JSC::Structure::remove):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::visitChildren):
+        (JSC::SymbolTable::localToEntry):
+        (JSC::SymbolTable::entryFor):
+        (JSC::SymbolTable::prepareForTypeProfiling):
+        (JSC::SymbolTable::uniqueIDForVariable):
+        (JSC::SymbolTable::uniqueIDForOffset):
+        (JSC::SymbolTable::globalTypeSetForOffset):
+        (JSC::SymbolTable::globalTypeSetForVariable):
+        * runtime/SymbolTable.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::TypeSet::invalidateCache):
+        * runtime/TypeSet.h:
+        (JSC::TypeSet::structureSet):
+        * runtime/VM.h:
+        * runtime/WriteBarrierInlines.h:
+        (JSC::WriteBarrierBase<T>::set):
+        (JSC::WriteBarrierBase<Unknown>::set):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::byteCompile):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+
+2016-11-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused and untested Page.setTouchEmulationEnabled command
+        https://bugs.webkit.org/show_bug.cgi?id=164793
+
+        Reviewed by Matt Baker.
+
+        * inspector/protocol/Page.json:
+
+2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, build fix for Windows debug build after r208738
+        https://bugs.webkit.org/show_bug.cgi?id=164727
+
+        This static member variable can be touched outside of the JSC project
+        since inlined MacroAssembler member functions read / write it.
+        So it should be exported.
+
+        * assembler/MacroAssemblerX86Common.h:
+
+2016-11-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: inspector/worker/debugger-pause.html fails on WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=164787
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        Clear this DebuggerAgent state when we resume.
+
+2016-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to disable concurrent GC timeslicing
+        https://bugs.webkit.org/show_bug.cgi?id=164788
+
+        Reviewed by Saam Barati.
+        
+        Collector timeslicing means that the collector will try to pause once every 2ms. This is
+        great because it throttles the mutator and prevents it from outpacing the collector. But
+        it reduces some of the efficacy of the collectContinuously=true configuration: while
+        it's great that collecting continuously means that the collector will also pause more
+        frequently and so it will test the pausing code, it also means that the collector will
+        spend less time running concurrently. The primary purpose of collectContinuously is to
+        maximize the amount of time that the collector is running concurrently to the mutator to
+        maximize the likelihood that a race will cause a detectable error.
+        
+        This adds an option to disable collector timeslicing (useCollectorTimeslicing=false).
+        The idea is that we will usually use this in conjunction with collectContinuously=true
+        to find race conditions during marking, but we can also use the two options
+        independently to focus our testing on other things.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markToFixpoint):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::drainInParallel): We should have added this helper ages ago.
+        * heap/SlotVisitor.h:
+        * runtime/Options.h:
+
+2016-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        The concurrent GC should have a timeslicing controller
+        https://bugs.webkit.org/show_bug.cgi?id=164783
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds a simple control system for deciding when the collector should let the mutator run
+        and when it should stop the mutator. We definitely have to stop the mutator during certain
+        collector phases, but during marking - which takes the most time - we can go either way.
+        Normally we want to let the mutator run, but if the heap size starts to grow then we have to
+        stop the mutator just to make sure it doesn't get too far ahead of the collector. That could
+        lead to memory exhaustion, so it's better to just stop in that case.
+        
+        The controller tries to never stop the mutator for longer than short timeslices. It slices on
+        a 2ms period (configurable via Options). The amount of that period that the collector spends
+        with the mutator stopped is determined by the fraction of the collector's concurrent headroom
+        that has been allocated over. The headroom is currently configured at 50% of what was
+        allocated before the collector started.
+        
+        This moves a bunch of parameters into Options so that it's easier to play with different
+        configurations.
+        
+        I tried these different values for the period:
+        
+        1ms: 30% worse than 2ms on splay-latency.
+        2ms: best score on splay-latency: the tick time above the 99.5% percentile is <2ms.
+        3ms: 40% worse than 2ms on splay-latency.
+        4ms: 40% worse than 2ms on splay-latency.
+        
+        I also tried 100% headroom as an alternate to 50% and found it to be a worse.
+        
+        This patch is a 2x improvement on splay-latency with the default parameters and concurrent GC
+        enabled. Prior to this change, the GC didn't have a good bound on its pause times, which
+        would cause these problems. Concurrent GC is now 5.6x better on splay-latency than no
+        concurrent GC.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
+        (JSC::Heap::markToFixpoint):
+        (JSC::Heap::collectInThread):
+        * runtime/Options.h:
+
+2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, build fix for CLoop after r208738
+        https://bugs.webkit.org/show_bug.cgi?id=164727
+
+        * jsc.cpp:
+        (WTF::DOMJITFunctionObject::unsafeFunction):
+        (WTF::DOMJITFunctionObject::finishCreation):
+
+2016-11-15  Mark Lam  <mark.lam@apple.com>
+
+        The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
+        https://bugs.webkit.org/show_bug.cgi?id=164781
+        <rdar://problem/28418590>
+
+        Reviewed by Geoffrey Garen and Michael Saboff.
+
+        * jsc.cpp:
+        (functionSetImpureGetterDelegate):
+
+2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
+        https://bugs.webkit.org/show_bug.cgi?id=164727
+
+        Reviewed by Filip Pizlo.
+
+        While CallDOMGetter can use macro assembler scratch registers, we previiously
+        assumed that CheckDOM code generator does not use macro assembler scratch registers.
+        It is currently true in x86 environment. But it is not true in the other environments.
+
+        We should not limit DOMJIT::Patchpoint's functionality in such a way. We should allow
+        arbitrary macro assembler operations inside the DOMJIT::Patchpoint. This patch allows
+        CheckDOM to use macro assembler scratch registers.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
+        * jsc.cpp:
+        (WTF::DOMJITFunctionObject::DOMJITFunctionObject):
+        (WTF::DOMJITFunctionObject::createStructure):
+        (WTF::DOMJITFunctionObject::create):
+        (WTF::DOMJITFunctionObject::unsafeFunction):
+        (WTF::DOMJITFunctionObject::safeFunction):
+        (WTF::DOMJITFunctionObject::checkDOMJITNode):
+        (WTF::DOMJITFunctionObject::finishCreation):
+        (GlobalObject::finishCreation):
+        (functionCreateDOMJITFunctionObject):
+
+2016-11-14  Geoffrey Garen  <ggaren@apple.com>
+
+        CodeCache should stop pretending to cache builtins
+        https://bugs.webkit.org/show_bug.cgi?id=164750
+
+        Reviewed by Saam Barati.
+
+        We were passing JSParserBuiltinMode to all CodeCache functions, but the
+        passed-in value was always NotBuiltin.
+
+        Let's stop passing it.
+
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeFlags::SourceCodeFlags):
+        (JSC::SourceCodeKey::SourceCodeKey):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getUnlinkedGlobalCodeBlock):
+        (JSC::CodeCache::getUnlinkedProgramCodeBlock):
+        (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock):
+        (JSC::CodeCache::getUnlinkedModuleProgramCodeBlock):
+        (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
+        * runtime/CodeCache.h:
+        (JSC::generateUnlinkedCodeBlock):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createLocalEvalCodeBlock):
+        (JSC::JSGlobalObject::createGlobalEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+
+2016-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r208711-r208722): ASSERTION FAILED: hasInlineStorage()
+        https://bugs.webkit.org/show_bug.cgi?id=164775
+
+        Reviewed by Mark Lam and Keith Miller.
+        
+        We were calling inlineStorage() which asserts that inline storage is not empty. But we
+        were calling it in a context where it could be empty and that's fine. So, we now call
+        inlineStorageUnsafe().
+
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::JSFinalObject):
+
+2016-11-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Unreviewed buildfix after r208720.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::storeFence): Stub function copied from MacroAssemblerARMv7.h.
+
+2016-11-14  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] do not reference AwaitExpression Promises in async function Promise chain
+        https://bugs.webkit.org/show_bug.cgi?id=164753
+
+        Reviewed by Yusuke Suzuki.
+
+        Previously, long-running async functions which contained many AwaitExpressions
+        would allocate and retain references to intermediate Promise objects for each `await`,
+        resulting in a memory leak.
+
+        To mitigate this leak, a reference to the original Promise (and its resolve and reject
+        functions) associated with the async function are kept, and passed to each call to
+        @asyncFunctionResume, while intermediate Promises are discarded. This is done by adding
+        a new Register to the BytecodeGenerator to hold the PromiseCapability object associated
+        with an async function wrapper. The capability is used to reject the Promise if an
+        exception is thrown during parameter initialization, and is used to store the resulting
+        value once the async function has terminated.
+
+        * builtins/AsyncFunctionPrototype.js:
+        (globalPrivate.asyncFunctionResume):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::promiseCapabilityRegister):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionNode::emitBytecode):
+
+2016-11-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Worker debugging should pause all targets and view call frames in all targets
+        https://bugs.webkit.org/show_bug.cgi?id=164305
+        <rdar://problem/29056192>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._propertyDescriptors):
+        Accessing __proto__ does a ToThis(...) conversion on the receiver.
+        In the case of GlobalObjects (such as WorkerGlobalScope when paused)
+        this would return undefined and throw an exception. We can use
+        Object.getPrototypeOf to avoid that conversion and possible error.
+
+        * inspector/protocol/Debugger.json:
+        Provide a new way to effectively `resume` + `pause` immediately.
+        This must be implemented on the backend to correctly synchronize
+        the resuming and pausing.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::continueUntilNextRunLoop):
+        Treat this as `resume` and `pause`. Resume now, and trigger
+        a pause if the VM becomes idle and we didn't pause before then
+        (such as hitting a breakpoint after we resumed).
+
+        (Inspector::InspectorDebuggerAgent::pause):
+        (Inspector::InspectorDebuggerAgent::resume):
+        (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (Inspector::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        Clean up and correct pause on next statement logic.
+
+        (Inspector::InspectorDebuggerAgent::registerIdleHandler):
+        (Inspector::InspectorDebuggerAgent::willStepAndMayBecomeIdle):
+        (Inspector::InspectorDebuggerAgent::didBecomeIdle):
+        (Inspector::InspectorDebuggerAgent::didBecomeIdleAfterStepping): Deleted.
+        The idle handler may now also trigger a pause in the case
+        where continueUntilNextRunLoop resumed and wants to pause.
+
+        (Inspector::InspectorDebuggerAgent::didPause):
+        Eliminate the useless didPause. The DOMDebugger was keeping track
+        of its own state that was worse then the state in DebuggerAgent.
+
+2016-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop.
+
+        * runtime/JSCellInlines.h:
+
+2016-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        The GC should be optionally concurrent and disabled by default
+        https://bugs.webkit.org/show_bug.cgi?id=164454
+
+        Reviewed by Geoffrey Garen.
+        
+        This started out as a patch to have the GC scan the stack at the end, and then the
+        outage happened and I decided to pick a more aggresive target: give the GC a concurrent
+        mode that can be enabled at runtime, and whose only effect is that it turns on the
+        ResumeTheWorldScope. This gives our GC a really intuitive workflow: by default, the GC
+        thread is running solo with the world stopped and the parallel markers converged and
+        waiting. We have a parallel work scope to enable the parallel markers and now we have a
+        ResumeTheWorldScope that will optionally resume the world and then stop it again.
+        
+        It's easy to make a concurrent GC that always instantly crashes. I can't promise that
+        this one won't do that when you run it. I set a specific goal: I wanted to do >10
+        concurrent GCs in debug mode with generations, optimizing JITs, and parallel marking
+        disabled.
+        
+        To reach this milestone, I needed to do a bunch of stuff:
+        
+        - The mutator needs a separate mark stack for the barrier, since it will mutate this
+          stack concurrently to the collector's slot visitors.
+        
+        - The use of CellState to indicate whether an object is being scanned the first time or
+          a subsequent time was racy. It fails spectacularly when a barrier is fired at the same
+          time as visitChildren is running or if the barrier runs at the same time as the GC
+          marks the same object. So, I split SlotVisitor's mark stacks. It's now the case that
+          you know why you're being scanned by looking at which stack you came off of.
+        
+        - All of root marking must be in the collector fixpoint. I renamed markRoots to
+          markToFixpoint. They say concurrency is hard, but the collector looks more intuitive
+          this way. We never gained anything from forcing people to make a choice between
+          scanning something in the fixpoint versus outside of it. Because root scanning is
+          cheap, we can afford to do it repeatedly, which means all root scanning can now do
+          constraint-based marking (like: I'll mark you if that thing is marked).
+        
+        - JSObject::visitChildren's scanning of the butterfly raced with property additions,
+          indexed storage transitions and resizing, and a bunch of miscellaneous dirty butterfly
+          reshaping functions - like the one that flattens a dictionary and some sneaky
+          ArrayStorage transformations. Many of these can be fixed by using store-store fences
+          in the mutator and load-load fences in the collector. I've adopted the rule that the
+          collector must always see either a butterfly and structure that match or a newer
+          butterfly with an older structure, where their age is just one transition apart. This
+          can be achieved with fences. For the cases where it breaks down, I added a lock to
+          every JSCell. This is a full-fledged WTF lock that we sneak into two available bits in
+          the indexingType. See the WTF ChangeLog for details.
+          
+          The mutator fencing rules are as follows:
+          
+          - Store-store fence before and after setting the butterfly.
+          - Store-store fence before setting structure if you had changed the shape of the
+            butterfly.
+          - Store-store fence after initializing all fields in an allocation.
+        
+        - A dictionary Structure can change in strange ways while the GC is trying to scan it.
+          So, JSObject::visitChildren will now grab the object's structure's lock if the
+          object's structure is a dictionary. Dictionary structures are 1:1 with their object,
+          so this does not reduce GC parallelism (super unlikely that the GC will simultaneously
+          scan an object from two threads).
+        
+        - The GC can blow away a Structure's property table at any time. As a small consolation,
+          it's now holding the Structure's lock when it does so. But there was tons of code in
+          Structure that uses DeferGC to prevent the GC from blowing away the property table.
+          This doesn't work with concurrent GC, since DeferGC only means that the GC won't run
+          its safepoint (i.e. stop-the-world code) in the DeferGC region. It will still do
+          marking and it was the Structure::visitChildren that would delete the table. It turns
+          out that Structure's reliance on the property table not being deleted was the product
+          of code rot. We already had functions that would materialize the table on demand. We
+          were simply making the mistake of saying:
+          
+              structure->materializePropertyMap();
+              ...
+              structure->propertyTable()->things
+          
+          Instead of saying:
+          
+              PropertyTable* table = structure->ensurePropertyTable();
+              ...
+              table->things
+          
+          Switching the code to use the latter idiom allowed me to simplify the code a lot while
+          fixing the race.
+        
+        - The LLInt's get_by_val handling was broken because the indexing shape constants were
+          wrong. Once I started putting more things into the IndexingType, that started causing
+          crashes for me. So I fixed LLInt. That turned out to be a lot of work, since that code
+          had rotted in subtle ways.
+        
+        This is a speed-up in SunSpider, probably because of the LLInt fix. This is neutral on
+        Octane and Kraken. It's a smaller slow-down on LongSpider, but I think we can ignore
+        that (we don't view LongSpider as an official benchmark). By default, the concurrent GC
+        is disabled: in all of the places where it would have resumed the world to run marking
+        concurrently to the mutator, it will just skip the resume step. When you enable
+        concurrent GC (--useConcurrentGC=true), it can sometimes run Octane/splay to completion.
+        It seems to perform quite well: on my machine, it improves both splay-throughput and
+        splay-latency. It's probably unstable for other programs.
+
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine isOldExternalObject:]):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::storeFence):
+        * bytecode/InlineAccess.cpp:
+        (JSC::InlineAccess::dumpCacheSizesAndCrash):
+        (JSC::InlineAccess::generateSelfPropertyAccess):
+        (JSC::InlineAccess::generateArrayLength):
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::offsetOfInlineCapacity):
+        (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
+        (JSC::ObjectAllocationProfile::initialize):
+        (JSC::ObjectAllocationProfile::inlineCapacity):
+        (JSC::ObjectAllocationProfile::clear):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateWithGuard):
+        (JSC::AccessCase::generateImpl):
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::markCodeBlocks):
+        (JSC::DFG::Plan::rememberCodeBlocks):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
+        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
+        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
+        (JSC::DFG::SpeculativeJIT::compileSpread):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileNewStringObject):
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::markCodeBlocks):
+        (JSC::DFG::Worklist::rememberCodeBlocks):
+        (JSC::DFG::markCodeBlocks):
+        (JSC::DFG::completeAllPlansForVM):
+        (JSC::DFG::rememberCodeBlocks):
+        * dfg/DFGWorklist.h:
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        (JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::~JITCode):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutStructure):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayBuffer):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToB3::splatWords):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::isArrayType):
+        (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
+        (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
+        (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::signExt32ToPtr):
+        (JSC::FTL::Output::fence):
+        * ftl/FTLOutput.h:
+        * heap/CellState.h:
+        * heap/GCSegmentedArray.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::ResumeTheWorldScope::ResumeTheWorldScope):
+        (JSC::Heap::ResumeTheWorldScope::~ResumeTheWorldScope):
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::harvestWeakReferences):
+        (JSC::Heap::finalizeUnconditionalFinalizers):
+        (JSC::Heap::completeAllJITPlans):
+        (JSC::Heap::markToFixpoint):
+        (JSC::Heap::gatherStackRoots):
+        (JSC::Heap::beginMarking):
+        (JSC::Heap::visitConservativeRoots):
+        (JSC::Heap::visitCompilerWorklistWeakReferences):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::endMarking):
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::collectInThread):
+        (JSC::Heap::stopTheWorld):
+        (JSC::Heap::resumeTheWorld):
+        (JSC::Heap::setGCDidJIT):
+        (JSC::Heap::setNeedFinalize):
+        (JSC::Heap::setMutatorWaiting):
+        (JSC::Heap::clearMutatorWaiting):
+        (JSC::Heap::finalize):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        (JSC::Heap::writeBarrierSlowPath):
+        (JSC::Heap::canCollect):
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::reportExternalMemoryVisited):
+        (JSC::Heap::notifyIsSafeToCollect):
+        (JSC::Heap::markRoots): Deleted.
+        (JSC::Heap::visitExternalRememberedSet): Deleted.
+        (JSC::Heap::visitSmallStrings): Deleted.
+        (JSC::Heap::visitProtectedObjects): Deleted.
+        (JSC::Heap::visitArgumentBuffers): Deleted.
+        (JSC::Heap::visitException): Deleted.
+        (JSC::Heap::visitStrongHandles): Deleted.
+        (JSC::Heap::visitHandleStack): Deleted.
+        (JSC::Heap::visitSamplingProfiler): Deleted.
+        (JSC::Heap::visitTypeProfiler): Deleted.
+        (JSC::Heap::visitShadowChicken): Deleted.
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines): Deleted.
+        (JSC::Heap::visitWeakHandles): Deleted.
+        (JSC::Heap::flushOldStructureIDTables): Deleted.
+        (JSC::Heap::stopAllocation): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::collectorSlotVisitor):
+        (JSC::Heap::mutatorMarkStack):
+        (JSC::Heap::mutatorShouldBeFenced):
+        (JSC::Heap::addressOfMutatorShouldBeFenced):
+        (JSC::Heap::slotVisitor): Deleted.
+        (JSC::Heap::notifyIsSafeToCollect): Deleted.
+        (JSC::Heap::barrierShouldBeFenced): Deleted.
+        (JSC::Heap::addressOfBarrierShouldBeFenced): Deleted.
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::transferTo):
+        * heap/MarkStack.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateIn):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::Handle::specializedSweep):
+        (JSC::MarkedBlock::Handle::sweep):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode):
+        (JSC::MarkedBlock::Handle::stopAllocating):
+        (JSC::MarkedBlock::Handle::resumeAllocating):
+        (JSC::MarkedBlock::aboutToMarkSlow):
+        (JSC::MarkedBlock::Handle::didConsumeFreeList):
+        (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor): Deleted.
+        (JSC::SetNewlyAllocatedFunctor::operator()): Deleted.
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::resumeAllocating):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::~SlotVisitor):
+        (JSC::SlotVisitor::reset):
+        (JSC::SlotVisitor::clearMarkStacks):
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::appendToMutatorMarkStack):
+        (JSC::SlotVisitor::visitChildren):
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::containsOpaqueRoot):
+        (JSC::SlotVisitor::donateAndDrain):
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        (JSC::SlotVisitor::dump):
+        (JSC::SlotVisitor::clearMarkStack): Deleted.
+        (JSC::SlotVisitor::opaqueRootCount): Deleted.
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::collectorMarkStack):
+        (JSC::SlotVisitor::mutatorMarkStack):
+        (JSC::SlotVisitor::isEmpty):
+        (JSC::SlotVisitor::bytesVisited):
+        (JSC::SlotVisitor::markStack): Deleted.
+        (JSC::SlotVisitor::bytesCopied): Deleted.
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExtraMemoryVisited):
+        (JSC::SlotVisitor::reportExternalMemoryVisited):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
+        (JSC::AssemblyHelpers::barrierStoreLoadFence):
+        (JSC::AssemblyHelpers::mutatorFence):
+        (JSC::AssemblyHelpers::storeButterfly):
+        (JSC::AssemblyHelpers::jumpIfMutatorFenceNotNeeded):
+        (JSC::AssemblyHelpers::emitInitializeInlineStorage):
+        (JSC::AssemblyHelpers::emitInitializeOutOfLineStorage):
+        (JSC::AssemblyHelpers::jumpIfBarrierStoreLoadFenceNotNeeded): Deleted.
+        * jit/JITInlines.h:
+        (JSC::JIT::emitArrayProfilingSiteWithCell):
+        * jit/JITOperations.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emit_op_put_to_arguments):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::create):
+        (JSC::Butterfly::createOrGrowPropertyStorage):
+        * runtime/ConcurrentJITLock.h:
+        (JSC::GCSafeConcurrentJITLocker::NoDefer::NoDefer): Deleted.
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::getOwnPropertySlotByIndex):
+        (JSC::GenericArguments<Type>::putByIndex):
+        * runtime/IndexingType.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        * runtime/JSCell.h:
+        (JSC::JSCell::InternalLocker::InternalLocker):
+        (JSC::JSCell::InternalLocker::~InternalLocker):
+        (JSC::JSCell::atomicCompareExchangeCellStateWeakRelaxed):
+        (JSC::JSCell::atomicCompareExchangeCellStateStrong):
+        (JSC::JSCell::indexingTypeAndMiscOffset):
+        (JSC::JSCell::indexingTypeOffset): Deleted.
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::JSCell):
+        (JSC::JSCell::finishCreation):
+        (JSC::JSCell::indexingTypeAndMisc):
+        (JSC::JSCell::indexingType):
+        (JSC::JSCell::setStructure):
+        (JSC::JSCell::callDestructor):
+        (JSC::JSCell::lockInternalLock):
+        (JSC::JSCell::unlockInternalLock):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSFinalObject::visitChildren):
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::reallocateAndShrinkButterfly):
+        (JSC::JSObject::allocateMoreOutOfLineStorage):
+        (JSC::JSObject::shiftButterflyAfterFlattening):
+        (JSC::JSObject::growOutOfLineStorage): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSObject::setButterfly):
+        (JSC::JSObject::getOwnNonIndexPropertySlot):
+        (JSC::JSObject::fillCustomGetterPropertySlot):
+        (JSC::JSObject::getOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::setStructureAndButterfly): Deleted.
+        (JSC::JSObject::setButterflyWithoutChangingStructure): Deleted.
+        (JSC::JSObject::putDirectInternal): Deleted.
+        (JSC::JSObject::putDirectWithoutTransition): Deleted.
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getNonIndexPropertySlot):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectInternal):
+        * runtime/Options.h:
+        * runtime/SparseArrayValueMap.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::findStructuresAndMapForMaterialization):
+        (JSC::Structure::materializePropertyTable):
+        (JSC::Structure::addNewPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::pin):
+        (JSC::Structure::pinForCaching):
+        (JSC::Structure::willStoreValueSlow):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::add):
+        (JSC::Structure::remove):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        (JSC::Structure::visitChildren):
+        (JSC::Structure::materializePropertyMap): Deleted.
+        (JSC::Structure::addPropertyWithoutTransition): Deleted.
+        (JSC::Structure::removePropertyWithoutTransition): Deleted.
+        (JSC::Structure::copyPropertyTable): Deleted.
+        (JSC::Structure::createPropertyMap): Deleted.
+        (JSC::PropertyTable::checkConsistency): Deleted.
+        (JSC::Structure::checkConsistency): Deleted.
+        * runtime/Structure.h:
+        * runtime/StructureIDBlob.h:
+        (JSC::StructureIDBlob::StructureIDBlob):
+        (JSC::StructureIDBlob::indexingTypeIncludingHistory):
+        (JSC::StructureIDBlob::setIndexingTypeIncludingHistory):
+        (JSC::StructureIDBlob::indexingTypeIncludingHistoryOffset):
+        (JSC::StructureIDBlob::indexingType): Deleted.
+        (JSC::StructureIDBlob::setIndexingType): Deleted.
+        (JSC::StructureIDBlob::indexingTypeOffset): Deleted.
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+        (JSC::Structure::checkOffsetConsistency):
+        (JSC::Structure::checkConsistency):
+        (JSC::Structure::add):
+        (JSC::Structure::remove):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::setPropertyTable):
+        (JSC::Structure::putWillGrowOutOfLineStorage): Deleted.
+        (JSC::Structure::propertyTable): Deleted.
+        (JSC::Structure::suggestedNewOutOfLineStorageCapacity): Deleted.
+
+2016-11-14  Keith Miller  <keith_miller@apple.com>
+
+        Add Wasm select
+        https://bugs.webkit.org/show_bug.cgi?id=164743
+
+        Reviewed by Saam Barati.
+
+        Also, this patch fixes an issue with the jsc.cpp test harness where negative numbers would be sign extended
+        when they shouldn't be.
+
+        * jsc.cpp:
+        (box):
+        * wasm/WasmB3IRGenerator.cpp:
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::addSelect):
+
+2016-11-11  Geoffrey Garen  <ggaren@apple.com>
+
+        JSC should distinguish between local and global eval
+        https://bugs.webkit.org/show_bug.cgi?id=164628
+
+        Reviewed by Saam Barati.
+
+        Local use of the 'eval' keyword and invocation of the global window.eval
+        function are distinct operations in JavaScript.
+
+        This patch splits out LocalEvalExecutable vs GlobalEvalExecutable in
+        order to help distinguish these operations in code.
+
+        Our code used to do some silly things for lack of distinguishing these
+        cases. For example, it would double cache local eval in CodeCache and
+        EvalCodeCache. This made CodeCache seem more complicated than it really
+        was.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added some files.
+
+        * bytecode/CodeBlock.h:
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::set):
+        (JSC::EvalCodeCache::getSlow): Deleted. Moved code generation out of
+        the cache to avoid tight coupling. Now the cache just caches.
+
+        * bytecode/UnlinkedEvalCodeBlock.h:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        * bytecode/UnlinkedModuleProgramCodeBlock.h:
+        * bytecode/UnlinkedProgramCodeBlock.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluateWithScopeExtension): Updated for interface
+        changes.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::eval): Moved code generation here so the cache didn't need to build
+        it in.
+
+        * llint/LLIntOffsetsExtractor.cpp:
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getUnlinkedGlobalCodeBlock): No need to check for TDZ
+        variables any more. We only cache global programs, and global variable
+        access always does TDZ checks.
+
+        (JSC::CodeCache::getUnlinkedProgramCodeBlock):
+        (JSC::CodeCache::getUnlinkedGlobalEvalCodeBlock):
+        (JSC::CodeCache::getUnlinkedModuleProgramCodeBlock):
+        (JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):
+
+        (JSC::CodeCache::CodeCache): Deleted.
+        (JSC::CodeCache::~CodeCache): Deleted.
+        (JSC::CodeCache::getGlobalCodeBlock): Deleted.
+        (JSC::CodeCache::getProgramCodeBlock): Deleted.
+        (JSC::CodeCache::getEvalCodeBlock): Deleted.
+        (JSC::CodeCache::getModuleProgramCodeBlock): Deleted.
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Deleted.
+
+        * runtime/CodeCache.h:
+        (JSC::CodeCache::clear):
+        (JSC::generateUnlinkedCodeBlock): Moved unlinked code block creation
+        out of the CodeCache class and into a stand-alone function because
+        we need it for local eval, which does not live in CodeCache.
+
+        * runtime/EvalExecutable.cpp:
+        (JSC::EvalExecutable::create): Deleted.
+        * runtime/EvalExecutable.h:
+        (): Deleted.
+        * runtime/GlobalEvalExecutable.cpp: Added.
+        (JSC::GlobalEvalExecutable::create):
+        (JSC::GlobalEvalExecutable::GlobalEvalExecutable):
+        * runtime/GlobalEvalExecutable.h: Added.
+        * runtime/LocalEvalExecutable.cpp: Added.
+        (JSC::LocalEvalExecutable::create):
+        (JSC::LocalEvalExecutable::LocalEvalExecutable):
+        * runtime/LocalEvalExecutable.h: Added. Split out Local vs Global
+        EvalExecutable classes to distinguish these operations in code. The key
+        difference is that LocalEvalExecutable does not live in the CodeCache
+        and only lives in the EvalCodeCache.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createLocalEvalCodeBlock):
+        (JSC::JSGlobalObject::createGlobalEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock): Deleted.
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::collectClosureVariablesUnderTDZ):
+        (JSC::JSScope::collectVariablesUnderTDZ): Deleted. We don't include
+        global lexical variables in our concept of TDZ scopes anymore. Global
+        variable access always does TDZ checks unconditionally. So, only closure
+        scope accesses give specific consideration to TDZ checks.
+
+        * runtime/JSScope.h:
+
+2016-11-14  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
+        https://bugs.webkit.org/show_bug.cgi?id=164037
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch introduces new_async_func / new_async_func_exp into DFG and FTL,
+        in much the same capacity that https://trac.webkit.org/changeset/194216 added
+        DFG / FTL support for generators: by adding new DFG nodes (NewAsyncFunction and
+        PhantomNewAsyncFunction), rather than extending the existing NewFunction node type.
+
+        Like NewFunction and PhantomNewFunction, and the Generator variants, allocation of
+        async wrapper functions may be deferred or eliminated during the allocation sinking
+        phase.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp:
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomNewFunction):
+        (JSC::DFG::Node::convertToPhantomNewAsyncFunction):
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::isFunctionAllocation):
+        (JSC::DFG::Node::isPhantomFunctionAllocation):
+        (JSC::DFG::Node::isPhantomAllocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGValidate.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationPopulateObjectInOSR):
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::asyncFunctionPrototype):
+        (JSC::JSGlobalObject::asyncFunctionStructure):
+        (JSC::JSGlobalObject::lazyAsyncFunctionStructure): Deleted.
+        (JSC::JSGlobalObject::asyncFunctionPrototypeConcurrently): Deleted.
+        (JSC::JSGlobalObject::asyncFunctionStructureConcurrently): Deleted.
+
+2016-11-14  Mark Lam  <mark.lam@apple.com>
+
+        Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
+        https://bugs.webkit.org/show_bug.cgi?id=164701
+        <rdar://problem/27462104>
+
+        Reviewed by Darin Adler.
+
+        The characters8(), characters16(), and operator[] in JSString::SafeView converts
+        the underlying JSString to a StringView via get(), and then uses the StringView
+        without first checking if an exception was thrown during the conversion.  This is
+        unsafe because the conversion may have failed.
+        
+        Instead, we should remove these 3 convenience methods, and make the caller
+        explicitly call get() and do the appropriate exception checks before using the
+        StringView.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::toStringView):
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::toSafeView): Deleted.
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/JSString.h:
+        (JSC::JSString::SafeView::length):
+        (JSC::JSString::SafeView::characters8): Deleted.
+        (JSC::JSString::SafeView::characters16): Deleted.
+        (JSC::JSString::SafeView::operator[]): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncRepeatCharacter):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncNormalize):
+
+2016-11-14  Mark Lam  <mark.lam@apple.com>
+
+        RegExpObject::exec/match should handle errors gracefully.
+        https://bugs.webkit.org/show_bug.cgi?id=155145
+        <rdar://problem/27435934>
+
+        Reviewed by Keith Miller.
+
+        1. Added some missing exception checks to RegExpObject::execInline() and
+           RegExpObject::matchInline().
+        2. Updated related code to work with ExceptionScope verification requirements.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/RegExpObjectInlines.h:
+        (JSC::RegExpObject::execInline):
+        (JSC::RegExpObject::matchInline):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTestFast):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncMatchFast):
+
+2016-11-13  Mark Lam  <mark.lam@apple.com>
+
+        Add debugging facility to limit the max single allocation size.
+        https://bugs.webkit.org/show_bug.cgi?id=164681
+
+        Reviewed by Keith Miller.
+
+        Added JSC option to set FastMalloc's maxSingleAllocationSize for testing purposes.
+        This option is only available on Debug builds.
+
+        * runtime/Options.cpp:
+        (JSC::Options::isAvailable):
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2016-11-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Follow-up fix to r208639.
+
+        Unreviewed fix. This is a straightfoward change where I forgot to
+        switch from uncheckedArgument() to argument() in once case after
+        dropping an argumentCount check. All other cases do this properly.
+        This addresses an ASSERT seen on the bots running tests.
+
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::setData):
+
+2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: DataView with explicit undefined byteLength should be the same as it not being present
+        https://bugs.webkit.org/show_bug.cgi?id=164453
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayView):
+        Handle the special case of DataView construction with an undefined byteLength value.
+
+2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: DataView get methods should allow for missing offset, set methods should allow for missing value
+        https://bugs.webkit.org/show_bug.cgi?id=164451
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        Missing offset is still valid and will be coerced to 0.
+
+        (JSC::setData):
+        Missing value is still valid and will be coerced to 0.
+
+2016-11-11  Saam Barati  <sbarati@apple.com>
+
+        We should have a more concise way of determining when we're varargs calling a function using rest parameters
+        https://bugs.webkit.org/show_bug.cgi?id=164258
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch adds two new bytecodes and DFG nodes for the following code patterns:
+
+        ```
+        foo(a, b, ...c)
+        let x = [a, b, ...c];
+        ```
+
+        To do this, I've introduced two new bytecode operations (and their
+        corresponding DFG nodes):
+
+        op_spread and op_new_array_with_spread.
+
+        op_spread takes a single input and performs the ES6 iteration protocol on it.
+        It returns the result of doing the spread inside a new class I've
+        made called JSFixedArray. JSFixedArray is a cell with a single 'size'
+        field and a buffer of values allocated inline in the cell. Abstracting
+        the protocol into a single node is good because it will make IR analysis
+        in the future much simpler. For now, it's also good because it allows
+        us to create fast paths for array iteration (which is quite common).
+        This fast path allows us to emit really good code for array iteration
+        inside the DFG/FTL.
+
+        op_new_array_with_spread is a variable argument bytecode that also
+        has a bit vector associated with it. The bit vector indicates if
+        any particular argument is to be spread or not. Arguments that
+        are spread are known to be JSFixedArray because we must emit an
+        op_spread before op_new_array_with_spread consumes the value.
+        For example, for this array:
+        [a, b, ...c, d, ...e]
+        we will have this bit vector:
+        [0, 0, 1, 0, 1]
+
+        The reason I've chosen this IR is that it will make eliminating
+        a rest allocation for this type of code much easier:
+
+        ```
+        function foo(...args) {
+            return bar(a, b, ...args);
+        }
+        ```
+
+        It will be easier to analyze the IR now that the operations
+        will be described at a high level.
+
+        This patch is an ~8% speedup on ES6SampleBench on my MBP.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/IteratorHelpers.js: Added.
+        (performIteration):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/ObjectPropertyConditionSet.cpp:
+        (JSC::generateConditionForSelfEquivalence):
+        * bytecode/ObjectPropertyConditionSet.h:
+        * bytecode/TrackedReferences.cpp:
+        (JSC::TrackedReferences::check):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::bitVectors):
+        (JSC::UnlinkedCodeBlock::bitVector):
+        (JSC::UnlinkedCodeBlock::addBitVector):
+        (JSC::UnlinkedCodeBlock::shrinkToFit):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArrayWithSpread):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::watchHavingABadTime):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isWatchingArrayIteratorProtocolWatchpoint):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::bitVector):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSpread):
+        (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
+        (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array_with_spread):
+        (JSC::JIT::emit_op_spread):
+        * jit/JITOperations.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/ArrayIteratorAdaptiveWatchpoint.cpp: Added.
+        (JSC::ArrayIteratorAdaptiveWatchpoint::ArrayIteratorAdaptiveWatchpoint):
+        (JSC::ArrayIteratorAdaptiveWatchpoint::handleFire):
+        * runtime/ArrayIteratorAdaptiveWatchpoint.h: Added.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/IteratorOperations.h:
+        (JSC::forEachInIterable):
+        * runtime/JSCInlines.h:
+        * runtime/JSFixedArray.cpp: Added.
+        (JSC::JSFixedArray::visitChildren):
+        * runtime/JSFixedArray.h: Added.
+        (JSC::JSFixedArray::createStructure):
+        (JSC::JSFixedArray::createFromArray):
+        (JSC::JSFixedArray::get):
+        (JSC::JSFixedArray::buffer):
+        (JSC::JSFixedArray::size):
+        (JSC::JSFixedArray::offsetOfSize):
+        (JSC::JSFixedArray::offsetOfData):
+        (JSC::JSFixedArray::create):
+        (JSC::JSFixedArray::JSFixedArray):
+        (JSC::JSFixedArray::allocationSize):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::objectPrototypeIsSane): Deleted.
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane): Deleted.
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrayIteratorProtocolWatchpoint):
+        (JSC::JSGlobalObject::iteratorProtocolFunction):
+        * runtime/JSGlobalObjectInlines.h: Added.
+        (JSC::JSGlobalObject::objectPrototypeIsSane):
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        (JSC::JSGlobalObject::isArrayIteratorProtocolFastAndNonObservable):
+        * runtime/JSType.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-11-11  Keith Miller  <keith_miller@apple.com>
+
+        Move Wasm tests to JS
+        https://bugs.webkit.org/show_bug.cgi?id=164611
+
+        Reviewed by Geoffrey Garen.
+
+        This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
+        ommited tests were earliest tests, which tested trivial things, like adding two
+        constants. Some tests are ommited for other reasons, however. These are:
+
+        1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
+        Tests that would validate the memory of the module once wasm was done with it since that's
+        not really possible in JS.
+
+        In order to make such a translation easier this patch also adds some features to the JS
+        testing api:
+
+        1) Blocks can now be done lexically by adding a lambda as the last argument of the block
+        opcode. For example one can do:
+            ...
+            .Block("i32", b => b.I32Const(1) )
+
+        and the nested lambda will automatically have an end attached.
+
+        2) The JS testing api can now handle inline signature types.
+
+        3) Relocate some code to make it easier to follow and prevent 44 space indentation.
+
+        4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
+        wasm.json without being remapped.
+
+        5) Add support for Memory and Function sections to the Builder.
+
+        6) Add support for local variables.
+
+        On the JSC side, we needed to expose a new function to validate the compiled wasm code
+        behaves the way we expect. At least until the JS Wasm API is finished. The new validation
+        function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
+        number of functions in the blob and tests for each of those functions.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (box):
+        (callWasmFunction):
+        (functionTestWasmModuleFunctions):
+        * testWasm.cpp:
+        (checkPlan):
+        (runWasmTests):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parse):
+        (JSC::Wasm::FunctionParser<Context>::parseBody):
+        (JSC::Wasm::FunctionParser<Context>::parseBlock): Deleted.
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseMemory):
+        (JSC::Wasm::ModuleParser::parseExport):
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::Plan):
+        (JSC::Wasm::Plan::run):
+        * wasm/WasmPlan.h:
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule):
+
+2016-11-11  Saam Barati  <sbarati@apple.com>
+
+        Unreviewed try to fix windows build after https://bugs.webkit.org/show_bug.cgi?id=164650
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2016-11-11  Saam Barati  <sbarati@apple.com>
+
+        We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
+        https://bugs.webkit.org/show_bug.cgi?id=164650
+
+        Reviewed by Geoffrey Garen.
+
+        Some code was incorrectly holding a lock when recursively calling
+        back into the bytecode parser's via inlining a put_by_val as a put_by_id.
+        This can cause a deadlock if the inlinee CodeBlock is something we're
+        already holding a lock for. I've changed the range of the lock holder
+        to be as narrow as possible.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2016-11-11  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r208584.
+
+        Seems to have regressed Speedometer by 1% on Mac
+
+        Reverted changeset:
+
+        "We should have a more concise way of determining when we're
+        varargs calling a function using rest parameters"
+        https://bugs.webkit.org/show_bug.cgi?id=164258
+        http://trac.webkit.org/changeset/208584
+
+2016-11-11  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r208117 and r208160.
+
+        Regressed Speedometer by >1.5%
+
+        Reverted changesets:
+
+        "We should have a way of profiling when a get_by_id is pure
+        and to emit a PureGetById in the DFG/FTL"
+        https://bugs.webkit.org/show_bug.cgi?id=163305
+        http://trac.webkit.org/changeset/208117
+
+        "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
+        out"
+        https://bugs.webkit.org/show_bug.cgi?id=164227
+        http://trac.webkit.org/changeset/208160
+
+2016-11-11  Saam Barati  <sbarati@apple.com>
+
+        We should have a more concise way of determining when we're varargs calling a function using rest parameters
+        https://bugs.webkit.org/show_bug.cgi?id=164258
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch adds two new bytecodes and DFG nodes for the following code patterns:
+
+        ```
+        foo(a, b, ...c)
+        let x = [a, b, ...c];
+        ```
+
+        To do this, I've introduced two new bytecode operations (and their
+        corresponding DFG nodes):
+
+        op_spread and op_new_array_with_spread.
+
+        op_spread takes a single input and performs the ES6 iteration protocol on it.
+        It returns the result of doing the spread inside a new class I've
+        made called JSFixedArray. JSFixedArray is a cell with a single 'size'
+        field and a buffer of values allocated inline in the cell. Abstracting
+        the protocol into a single node is good because it will make IR analysis
+        in the future much simpler. For now, it's also good because it allows
+        us to create fast paths for array iteration (which is quite common).
+        This fast path allows us to emit really good code for array iteration
+        inside the DFG/FTL.
+
+        op_new_array_with_spread is a variable argument bytecode that also
+        has a bit vector associated with it. The bit vector indicates if
+        any particular argument is to be spread or not. Arguments that
+        are spread are known to be JSFixedArray because we must emit an
+        op_spread before op_new_array_with_spread consumes the value.
+        For example, for this array:
+        [a, b, ...c, d, ...e]
+        we will have this bit vector:
+        [0, 0, 1, 0, 1]
+
+        The reason I've chosen this IR is that it will make eliminating
+        a rest allocation for this type of code much easier:
+
+        ```
+        function foo(...args) {
+            return bar(a, b, ...args);
+        }
+        ```
+
+        It will be easier to analyze the IR now that the operations
+        will be described at a high level.
+
+        This patch is an ~8% speedup on ES6SampleBench on my MBP.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/IteratorHelpers.js: Added.
+        (performIteration):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/ObjectPropertyConditionSet.cpp:
+        (JSC::generateConditionForSelfEquivalence):
+        * bytecode/ObjectPropertyConditionSet.h:
+        * bytecode/TrackedReferences.cpp:
+        (JSC::TrackedReferences::check):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::bitVectors):
+        (JSC::UnlinkedCodeBlock::bitVector):
+        (JSC::UnlinkedCodeBlock::addBitVector):
+        (JSC::UnlinkedCodeBlock::shrinkToFit):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArrayWithSpread):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::watchHavingABadTime):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isWatchingArrayIteratorProtocolWatchpoint):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::bitVector):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSpread):
+        (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSpread):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
+        (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array_with_spread):
+        (JSC::JIT::emit_op_spread):
+        * jit/JITOperations.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/ArrayIteratorAdaptiveWatchpoint.cpp: Added.
+        (JSC::ArrayIteratorAdaptiveWatchpoint::ArrayIteratorAdaptiveWatchpoint):
+        (JSC::ArrayIteratorAdaptiveWatchpoint::handleFire):
+        * runtime/ArrayIteratorAdaptiveWatchpoint.h: Added.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/IteratorOperations.h:
+        (JSC::forEachInIterable):
+        * runtime/JSCInlines.h:
+        * runtime/JSFixedArray.cpp: Added.
+        (JSC::JSFixedArray::visitChildren):
+        * runtime/JSFixedArray.h: Added.
+        (JSC::JSFixedArray::createStructure):
+        (JSC::JSFixedArray::createFromArray):
+        (JSC::JSFixedArray::get):
+        (JSC::JSFixedArray::buffer):
+        (JSC::JSFixedArray::size):
+        (JSC::JSFixedArray::offsetOfSize):
+        (JSC::JSFixedArray::offsetOfData):
+        (JSC::JSFixedArray::create):
+        (JSC::JSFixedArray::JSFixedArray):
+        (JSC::JSFixedArray::allocationSize):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::objectPrototypeIsSane): Deleted.
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane): Deleted.
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrayIteratorProtocolWatchpoint):
+        (JSC::JSGlobalObject::iteratorProtocolFunction):
+        * runtime/JSGlobalObjectInlines.h: Added.
+        (JSC::JSGlobalObject::objectPrototypeIsSane):
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        (JSC::JSGlobalObject::isArrayIteratorProtocolFastAndNonObservable):
+        * runtime/JSType.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-11-10  JF Bastien  <jfbastien@apple.com>
+
+        ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
+        https://bugs.webkit.org/show_bug.cgi?id=164597
+
+        Reviewed by Keith Miller.
+
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::parseVarUInt32): move closer to other parsers
+        (JSC::Wasm::Parser::parseVarUInt64): move closer to other parsers
+
+2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
+        https://bugs.webkit.org/show_bug.cgi?id=164450
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::toIndex):
+        Introduce a method for toIndex, which is used by DataView and TypedArrays
+        to convert an argument to a number with the possibility of throwing
+        RangeErrors for negative values. We also throw RangeErrors for large
+        values, because wherever this is used we expect an unsigned.
+
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        Use toIndex instead of toUint32 where required.
+
+2016-11-10  Mark Lam  <mark.lam@apple.com>
+
+        A few bits of minor code clean up.
+        https://bugs.webkit.org/show_bug.cgi?id=164523
+
+        Reviewed by Yusuke Suzuki.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::dump):
+        - Insert a space to make the dump more legible.
+
+        * runtime/Options.h:
+        - Fixed some typos.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplaceUsingRegExp):
+        (JSC::stringProtoFuncReplaceUsingStringSearch):
+        - Use the VM& that is already available.
+
+2016-11-10  Mark Lam  <mark.lam@apple.com>
+
+        Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
+        https://bugs.webkit.org/show_bug.cgi?id=164600
+        <rdar://problem/28828676>
+
+        Reviewed by Filip Pizlo.
+
+        Currently, Graph::methodOfGettingAValueProfileFor() assumes that the operand DFG
+        node that it is provided with always has a different origin than the node that is
+        using that operand.  For example, in a DFG graph that looks like this:
+
+            a: ...
+            b: ArithAdd(@a, ...)
+
+        ... when emitting speculation checks on @a for the ArithAdd node at @b,
+        Graph::methodOfGettingAValueProfileFor() is passed @a, and expects @a's to
+        originate from a different bytecode than @b.  The intent here is to get the
+        profile for @a so that the OSR exit ramp for @b can update @a's profile with the
+        observed result type from @a so that future type prediction on incoming args for
+        the ArithAdd node can take this into consideration.
+
+        However, op_negate can be compiled into the following series of nodes:
+
+            a: ...
+            b: BooleanToNumber(@a)
+            c: DoubleRep(@b)
+            d: ArithNegate(@c)
+
+        All 3 nodes @b, @c, and @d maps to the same op_negate bytecode i.e. they have the
+        same origin.  When the speculativeJIT emits a speculationCheck for DoubleRep, it
+        calls Graph::methodOfGettingAValueProfileFor() to get the ArithProfile for the
+        BooleanToNumber node.  But because all 3 nodes have the same origin,
+        Graph::methodOfGettingAValueProfileFor() erroneously returns the ArithProfile for
+        the op_negate.  Subsequently, the OSR exit ramp will modify the ArithProfile of
+        the op_negate and corrupt its profile.  Instead, what the OSR exit ramp should be
+        doing is update the ArithProfile of op_negate's operand i.e. BooleanToNumber's
+        operand @a in this case.
+
+        The fix is to always pass the current node we're generating code for (in addition
+        to the operand node) to Graph::methodOfGettingAValueProfileFor().  This way, we
+        know the profile is valid if and only if the current node and its operand node
+        does not have the same origin.
+
+        In this patch, we also fixed the following:
+        1. Teach Graph::methodOfGettingAValueProfileFor() to get the profile for
+           BooleanToNumber's operand if the operand node it is given is BooleanToNumber.
+        2. Change JITCompiler::appendExceptionHandlingOSRExit() to explicitly pass an
+           empty MethodOfGettingAValueProfile().  It was implicitly doing this before.
+        3. Change SpeculativeJIT::emitInvalidationPoint() to pass an empty
+           MethodOfGettingAValueProfile().  It has no child node.  Hence, it doesn't
+           make sense to call Graph::methodOfGettingAValueProfileFor() for a child node
+           that does not exist.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::appendOSRExitDescriptor):
+
+2016-11-10  Aaron Chu  <aaron_chu@apple.com>
+
+        Web Inspector: AXI: clarify button roles (e.g. toggle or popup button)
+        https://bugs.webkit.org/show_bug.cgi?id=130726
+        <rdar://problem/16420420>
+
+        Reviewed by Brian Burg.
+
+        Add the isPopupButton flag to the AccessibilityProperties type.
+
+        * inspector/protocol/DOM.json:
+
+2016-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Unreviewed buildfix after r208450.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load8SignedExtendTo32): Added.
+
+2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
+        https://bugs.webkit.org/show_bug.cgi?id=164502
+
+        Reviewed by Saam Barati.
+
+        In many builtin functions, we use `arguments` to just get optional parameters.
+        While FTL argument elimination can drop `arguments` allocations, it leaves
+        the allocations in LLInt, Baseline, and DFG. And we found that DFG compiled
+        Array#map is heavily used in ES6SampleBench/Basic. And it always creates
+        a meaningless ClonedArguments.
+
+        Using ES6 default parameter here is not a solution. It increases the number
+        of parameters of the CodeBlock (not `function.length`). And the optional
+        parameters in Array.prototype.xxx methods are not typically passed. For
+        example, we typically do not pass `thisArg` to `Array.prototype.map` function.
+        In this case, the arity check frequently fails. It requires the additional C
+        call to fixup arguments and it becomes pure overhead.
+
+        To solve this problem, this patch introduces a new bytecode intrinsic @argument().
+        This offers the way to retrieve the argument value without increasing the
+        arity of the function. And if the argument is not passed (out of bounds), it
+        just returns `undefined`. The semantics of this intrinsic is the same to the C++
+        ExecState::argument(). This operation does not require `arguments` object. And we
+        can drop the `argument` references even in lower 3 tiers.
+
+        We implement op_get_argument for this intrinsic. And later this will be converted
+        to DFG GetArgument node. All the tiers handles this feature.
+
+        This patch improves ES6SampleBench/Basic 13.8% in steady state. And in summary,
+        it improves 4.5%.
+
+        In the future, we can improve the implementation of the default parameters.
+        Currently, the default parameter always increases the arity of the function. So
+        if you do not pass the argument, the arity check fails. But since it is the default
+        parameter, it is likely that we don't pass the argument. Using op_get_argument to
+        implement the default parameter can decrease the case in which the arity check
+        frequently fails. And it can change the builtin implementation to use the ES6
+        default parameters instead of using the special @argument() intrinsic in the future.
+        And at that case, the user code also receives the benefit.
+
+        ES6SampleBench/Basic.
+            Baseline:
+                Running... Basic ( 1  to go)
+                firstIteration:     39.38 ms +- 4.48 ms
+                averageWorstCase:   20.79 ms +- 0.96 ms
+                steadyState:        1959.22 ms +- 65.55 ms
+
+            Patched:
+                Running... Basic ( 1  to go)
+                firstIteration:     37.85 ms +- 4.09 ms
+                averageWorstCase:   18.60 ms +- 0.76 ms
+                steadyState:        1721.89 ms +- 57.58 ms
+
+        All summary.
+            Baseline:
+                summary:            164.34 ms +- 5.01 ms
+            Patched:
+                summary:            157.26 ms +- 5.96 ms
+
+        * builtins/ArrayConstructor.js:
+        * builtins/ArrayPrototype.js:
+        (reduce):
+        (reduceRight):
+        (every):
+        (forEach):
+        (filter):
+        (map):
+        (some):
+        (fill):
+        (find):
+        (findIndex):
+        (includes):
+        (copyWithin):
+        * builtins/DatePrototype.js:
+        (toLocaleString):
+        (toLocaleDateString):
+        (toLocaleTimeString):
+        * builtins/MapPrototype.js:
+        (forEach):
+        * builtins/NumberPrototype.js:
+        (toLocaleString):
+        * builtins/SetPrototype.js:
+        (forEach):
+        * builtins/StringPrototype.js:
+        (padStart):
+        (padEnd):
+        (localeCompare):
+        * builtins/TypedArrayConstructor.js:
+        * builtins/TypedArrayPrototype.js:
+        (every):
+        (fill):
+        (find):
+        (findIndex):
+        (forEach):
+        (some):
+        (reduce):
+        (reduceRight):
+        (map):
+        (filter):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finishCreation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetArgument):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_argument):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasArgumentIndex):
+        (JSC::DFG::Node::argumentIndex):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetArgument):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetArgument):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_argument):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_argument):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2016-11-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: DebuggerManager.Event.Resumed introduces test flakiness
+        https://bugs.webkit.org/show_bug.cgi?id=161951
+        <rdar://problem/28295767>
+
+        Reviewed by Brian Burg.
+
+        This removes an ambiguity in the protocol when stepping through
+        JavaScript. Previously, when paused and issuing a Debugger.step*
+        command the frontend would always receive a Debugger.resumed event and
+        then, maybe, a Debugger.paused event indicating we paused again (after
+        stepping). However, this ambiguity means that the frontend needs to
+        wait for a short period of time to determine if we really resumed
+        or not. And even still that decision may be incorrect if the step
+        takes a sufficiently long period of time.
+
+        The new approach removes this ambiguity. Now, in response to a
+        Debugger.step* command the backend MUST send a single Debugger.paused
+        event or Debugger.resumed event. Now the frontend knows that the
+        next Debugger event it receives after issuing the step command is
+        the result (stepped and paused, or stepped and resumed).
+
+        To make resuming consistent in all cases, a Debugger.resume command
+        will always respond with a Debugger.resumed event.
+
+        Finally, Debugger.continueToLocation is treated like a "big step"
+        in cases where we can resolve the location. If we can't resolve the
+        location it is treated as a resume, maintaining the old behavior.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::stepOver):
+        (Inspector::InspectorDebuggerAgent::stepInto):
+        (Inspector::InspectorDebuggerAgent::stepOut):
+        (Inspector::InspectorDebuggerAgent::willStepAndMayBecomeIdle):
+        (Inspector::InspectorDebuggerAgent::didBecomeIdleAfterStepping):
+        When stepping register a VM exit observer so that we can issue
+        a Debugger.resumed event if the step caused us to exit the VM.
+
+        (Inspector::InspectorDebuggerAgent::resume):
+        Set a flag to issue a Debugger.resumed event once we break out
+        of the nested run loop.
+
+        (Inspector::InspectorDebuggerAgent::didPause):
+        We are issuing Debugger.paused so clear the state to indicate that
+        we no longer need to issue Debugger.resumed event, we have paused.
+
+        (Inspector::InspectorDebuggerAgent::didContinue):
+        Only issue the Debugger.resumed event if needed (explicitly asked
+        to resume).
+
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
+        All places that do continueProgram should be audited. In error cases,
+        if we are paused and continue we should remember to send Debugger.resumed.
+
+        * inspector/protocol/Debugger.json:
+        Clarify in the protocol description the contract of these methods.
+
+2016-11-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Associate Worker Resources with the Worker and not the Page
+        https://bugs.webkit.org/show_bug.cgi?id=164342
+        <rdar://problem/29075775>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Network.json:
+        * inspector/protocol/Page.json:
+        Associate Resource data with a target.
+
+2016-11-09  Keith Miller  <keith_miller@apple.com>
+
+        jsc CLI should work with the remote inspector
+        https://bugs.webkit.org/show_bug.cgi?id=164569
+
+        Reviewed by Joseph Pecoraro.
+
+        This patch enables using the remote inspector on the jsc CLI.
+        In order to use the remote inspector, jsc users need to pass an option.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+        (runJSC):
+
+2016-11-09  Saam Barati  <sbarati@apple.com>
+
+        Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
+        https://bugs.webkit.org/show_bug.cgi?id=164464
+        <rdar://problem/29131452>
+
+        Reviewed by Darin Adler.
+
+        We were incorrectly matching this pattern inside the bytecode parser
+        to return NaN. Instead, we must return:
+          Infinity for Math.min()
+         -Infinity for Math.max()
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+
+2016-11-09  Saam Barati  <sbarati@apple.com>
+
+        TypeProfiler and running GC collection on another thread don't play nicely with each other
+        https://bugs.webkit.org/show_bug.cgi?id=164441
+        <rdar://problem/29132174>
+
+        Reviewed by Geoffrey Garen.
+
+        This fix here is simple: we now treat the type profiler log as a GC root.
+        GC will make sure that we mark any values/structures that are in the log.
+        It's easy to reason about the correctness of this, and it also solves
+        the problem that we were clearing the log on the GC thread. Clearing the
+        log on the GC thread was a problem because when we clear the log, we may
+        allocate, which we're not allowed to do from the GC thread.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::visitTypeProfiler):
+        (JSC::Heap::collectInThread):
+        * heap/Heap.h:
+        * runtime/TypeProfilerLog.cpp:
+        (JSC::TypeProfilerLog::processLogEntries):
+        (JSC::TypeProfilerLog::visit):
+        * runtime/TypeProfilerLog.h:
+
+2016-11-09  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: Silence noisy warning
+        https://bugs.webkit.org/show_bug.cgi?id=164459
+
+        Reviewed by Yusuke Suzuki.
+
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::Plan):
+
+2016-11-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] The implementation of 8 bit operation in MacroAssembler should care about uint8_t / int8_t
+        https://bugs.webkit.org/show_bug.cgi?id=164432
+
+        Reviewed by Michael Saboff.
+
+        Except for X86, our supported MacroAssemblers do not have native 8bit instructions.
+        It means that all the 8bit instructions are converted to 32bit operations by using
+        scratch registers. For example, ARM64 branch8 implementation is the following.
+
+            Jump branch8(RelationCondition cord, Address left, TrustedImm32 right)
+            {
+                TrustedImm32 right8(static_cast<int8_t>(right.m_value));
+                load8(left, getCachedMemoryTempRegisterIDAndInvalidate());
+                return branch32(cone, memoryTempRegister, right8);
+            }
+
+        The problem is that we exclusively use zero-extended load instruction (load8). Even
+        for signed RelationConditions, we do not perform sign extension. It makes signed
+        operations with negative numbers incorrect! Consider the |left| address holds `-1`
+        in int8_t form. However load8 will load it as 255 into 32bit register. On the other hand,
+        |right| will be sign extended. If you pass 0 as |right| and LessThan condition, this
+        branch8 should jump based on the answer of `-1 < 0`. But the current MacroAssembler
+        performs `255 < 0` in int32_t context and returns the incorrect result.
+
+        We should follow the x86 model. So we should select the appropriate load operation and masking
+        operation based on the RelationCondition. This patch introduces mask8OnCondition and load8OnCondition.
+        And we use them in 8bit operations including branch8, branchTest8, compare8, and test8.
+
+        We intentionally do not change anything on x86 assembler since it has the native signed 8bit operations.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::isSigned):
+        (JSC::MacroAssembler::isUnsigned):
+        (JSC::MacroAssembler::branchTest8):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branchTest8):
+        (JSC::MacroAssemblerARM::compare8):
+        (JSC::MacroAssemblerARM::test8):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
+        (JSC::MacroAssemblerARM64::branch8):
+        (JSC::MacroAssemblerARM64::branchTest8):
+        (JSC::MacroAssemblerARM64::compare8):
+        (JSC::MacroAssemblerARM64::test8):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::compare8):
+        (JSC::MacroAssemblerARMv7::test8):
+        * assembler/MacroAssemblerHelpers.h: Added.
+        (JSC::MacroAssemblerHelpers::isSigned):
+        (JSC::MacroAssemblerHelpers::isUnsigned):
+        (JSC::MacroAssemblerHelpers::mask8OnCondition):
+        (JSC::MacroAssemblerHelpers::load8OnCondition):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branch8):
+        (JSC::MacroAssemblerMIPS::compare8):
+        (JSC::MacroAssemblerMIPS::branchTest8):
+        (JSC::MacroAssemblerMIPS::test8):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchTest8):
+        (JSC::MacroAssemblerSH4::branch8):
+        (JSC::MacroAssemblerSH4::compare8):
+        (JSC::MacroAssemblerSH4::test8):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branch8):
+
+2016-11-08  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: date-format-tofte.js is super slow
+        https://bugs.webkit.org/show_bug.cgi?id=164499
+
+        Reviewed by Sam Weinig.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::CacheKey::operator==): Use character comparison,
+        not pointer comparison. (This function was always wrong, but I started
+        calling it in more places.)
+
+2016-11-08  Saam Barati  <sbarati@apple.com>
+
+        REGRESSION: Crashes in StringImpl destructor during GC when clearing the HasOwnPropertyCache
+        https://bugs.webkit.org/show_bug.cgi?id=164433
+
+        Reviewed by Mark Lam.
+
+        Clearing the HasOwnPropertyCache will call deref() on the StringImpls
+        in the cache. We were doing this from the collector thread, which is
+        not allowed. It must be done from the mutator thread. We now clear the
+        cache in Heap::finalize() which happens before the mutator begins
+        executing JS after a collection happens.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectInThread):
+        (JSC::Heap::finalize):
+
+2016-11-05  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Fixed compilation of LLInt with MinGW
+        https://bugs.webkit.org/show_bug.cgi?id=164449
+
+        Reviewed by Michael Catanzaro.
+
+        MinGW uses LLIntAssembly.h with GNU assembler syntax, just like GCC on
+        other platforms.
+
+        * llint/LowLevelInterpreter.cpp: Include LLIntAssembly.h with
+        appropriate preamble.
+
+2016-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        WTF::ParkingLot should stop using std::chrono because std::chrono::duration casts are prone to overflows
+        https://bugs.webkit.org/show_bug.cgi?id=152045
+
+        Reviewed by Andy Estes.
+        
+        Probably the nicest example of why this patch is a good idea is the change in
+        AtomicsObject.cpp.
+
+        * jit/ICStats.cpp:
+        (JSC::ICStats::ICStats):
+        * runtime/AtomicsObject.cpp:
+        (JSC::atomicsFuncWait):
+
+2016-11-04  JF Bastien  <jfbastien@apple.com>
+
+        testWASM should be very sad if no options are provided
+        https://bugs.webkit.org/show_bug.cgi?id=164444
+
+        Reviewed by Saam Barati.
+
+        Detect missing or invalid options on the command line.
+
+        * testWasm.cpp:
+        (CommandLine::parseArguments):
+
+2016-11-04  Mark Lam  <mark.lam@apple.com>
+
+        Error description code should be able to handle Symbol values.
+        https://bugs.webkit.org/show_bug.cgi?id=164436
+        <rdar://problem/29115583>
+
+        Reviewed by Filip Pizlo and Saam Barati.
+
+        Previously, we try to toString() the Symbol value, resulting in it throwing an
+        exception in errorDescriptionForValue() which breaks the invariant that
+        errorDescriptionForValue() should not throw.
+
+        We fixed this by making errorDescriptionForValue() aware of the Symbol type, and
+        not so a toString() on Symbol values.  Also fixed notAFunctionSourceAppender()
+        to build a nicer message for Symbol values.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue):
+        (JSC::notAFunctionSourceAppender):
+
+2016-11-02  Geoffrey Garen  <ggaren@apple.com>
+
+        EvalCodeCache should not give up in strict mode and other cases
+        https://bugs.webkit.org/show_bug.cgi?id=164357
+
+        Reviewed by Michael Saboff.
+
+        EvalCodeCache gives up in non-trivial cases because generated eval code
+        can't soundly migrate from, for example, a let scope to a non-let scope.
+        The number of cases has grown over time.
+
+        Instead, let's cache eval code based on the location of the call to
+        eval(). That way, we never relocate the code, and it's sound to make
+        normal assumptions about our surrounding scope.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::CacheKey::CacheKey): Use CallSiteIndex to uniquely
+        identify the location of our call to eval().
+
+        (JSC::EvalCodeCache::CacheKey::hash):
+        (JSC::EvalCodeCache::CacheKey::operator==):
+        (JSC::EvalCodeCache::CacheKey::Hash::equal): Use CallSiteIndex instead
+        of lots of other flags.
+
+        (JSC::EvalCodeCache::tryGet): No need to include details that are implied
+        by our CallSiteIndex.
+
+        (JSC::EvalCodeCache::getSlow): No need to skip caching in complex
+        situations. We promise we'll never relocate the cached code.
+
+        (JSC::EvalCodeCache::isCacheableScope): Deleted.
+        (JSC::EvalCodeCache::isCacheable): Deleted.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::eval): Pass through a CallSiteIndex to uniquely identify this call
+        to eval().
+
+2016-11-04  Keith Miller  <keith_miller@apple.com>
+
+        Add support for Wasm br_table
+        https://bugs.webkit.org/show_bug.cgi?id=164429
+
+        Reviewed by Michael Saboff.
+
+        This patch adds support for Wasm br_table. The Wasm br_table
+        opcode essentially directly maps to B3's switch opcode.
+
+        There are also three other minor changes:
+        1) all non-argument locals should be initialized to zero at function entry.
+        2) add new setErrorMessage member to WasmFunctionParser.h
+        3) return does not decode an extra immediate anymore.
+
+        * testWasm.cpp:
+        (runWasmTests):
+        * wasm/WasmB3IRGenerator.cpp:
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser::setErrorMessage):
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
+        (JSC::Wasm::FunctionParser<Context>::popExpressionStack):
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::checkBranchTarget):
+        (JSC::Wasm::Validate::addBranch):
+        (JSC::Wasm::Validate::addSwitch):
+
+2016-11-04  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly JS API: implement more sections
+        https://bugs.webkit.org/show_bug.cgi?id=164023
+
+        Reviewed by Keith Miller.
+
+        On the JSC side:
+
+         - Put in parser stubs for all WebAssembly sections.
+         - Parse Import, Export sections.
+         - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
+         - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
+         - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
+         - Remove all remainders of polyfill-prototype-1, and update license.
+         - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
+
+        On the Builder.js testing side:
+
+         - Implement Type, Import (function only), Export (function only) sections.
+         - Check section order and uniqueness.
+         - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
+         - Allow re-exporting an import.
+
+        * CMakeLists.txt: missing auto-genration
+        * JavaScriptCore.xcodeproj/project.pbxproj: merge conflict
+        * testWasm.cpp: update for API changes, no functional change
+        (checkPlan):
+        (runWasmTests):
+        * wasm/WasmFormat.cpp: add a dtor which requires extra headers which I'd rather not include in WasmFormat.h
+        (JSC::Wasm::ModuleInformation::~ModuleInformation):
+        * wasm/WasmFormat.h: Add External, Import, Functioninformation, Export, ModuleInformation, CompiledFunction, and remove obsolete stuff which was a holdover from the first implementation (all that code is now gone, so remove its license)
+        (JSC::Wasm::External::isValid):
+        * wasm/WasmModuleParser.cpp: simplify some, make names consistent with the WebAssembly section names, check memory allocations so they can fail early
+        (JSC::Wasm::ModuleParser::parse):
+        (JSC::Wasm::ModuleParser::parseType):
+        (JSC::Wasm::ModuleParser::parseImport):
+        (JSC::Wasm::ModuleParser::parseFunction):
+        (JSC::Wasm::ModuleParser::parseTable):
+        (JSC::Wasm::ModuleParser::parseMemory):
+        (JSC::Wasm::ModuleParser::parseGlobal):
+        (JSC::Wasm::ModuleParser::parseExport):
+        (JSC::Wasm::ModuleParser::parseStart):
+        (JSC::Wasm::ModuleParser::parseElement):
+        (JSC::Wasm::ModuleParser::parseCode): avoid overflow through function size.
+        (JSC::Wasm::ModuleParser::parseData):
+        * wasm/WasmModuleParser.h:
+        (JSC::Wasm::ModuleParser::moduleInformation):
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::consumeUTF8String): add as required by spec
+        (JSC::Wasm::Parser::parseExternalKind): add as per spec
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::Plan): fix some ownership, improve some error messages
+        * wasm/WasmPlan.h: fix some ownership
+        (JSC::Wasm::Plan::getModuleInformation):
+        (JSC::Wasm::Plan::getMemory):
+        (JSC::Wasm::Plan::compiledFunctionCount):
+        (JSC::Wasm::Plan::compiledFunction):
+        (JSC::Wasm::Plan::getCompiledFunctions):
+        * wasm/WasmSections.h: macroize with description, so that error messages are super pretty. This could be auto-generated.
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::create): take module information
+        (JSC::JSWebAssemblyModule::JSWebAssemblyModule): ditto
+        * wasm/js/JSWebAssemblyModule.h:
+        (JSC::JSWebAssemblyModule::moduleInformation):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance): check that modules with imports are instantiated with an import object, as per spec. This needs to be tested.
+        * wasm/js/WebAssemblyMemoryConstructor.cpp:
+        (JSC::constructJSWebAssemblyMemory):
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule):
+        * wasm/js/WebAssemblyTableConstructor.cpp:
+        (JSC::constructJSWebAssemblyTable):
+
+2016-11-03  Mark Lam  <mark.lam@apple.com>
+
+        ClonedArguments need to also support haveABadTime mode.
+        https://bugs.webkit.org/show_bug.cgi?id=164200
+        <rdar://problem/27211336>
+
+        Reviewed by Geoffrey Garen.
+
+        For those who are not familiar with the parlance, "have a bad time" in the VM
+        means that Object.prototype has been modified in such a way that we can no longer
+        trivially do indexed property accesses without consulting the Object.prototype.
+        This defeats JIT indexed put optimizations, and hence, makes the VM "have a
+        bad time".
+
+        Once the VM enters haveABadTime mode, all existing objects are converted to use
+        slow put storage.  Thereafter, JSArrays are always created with slow put storage.
+        JSObjects are always created with a blank indexing type.  When a new indexed
+        property is put into the new object, its indexing type will be converted to the
+        slow put array indexing type just before we perform the put operation.  This is
+        how we ensure that the objects will also use slow put storage.
+
+        However, ClonedArguments is an object which was previously created unconditionally
+        to use contiguous storage.  Subsequently, if we try to call Object.preventExtensions()
+        on that ClonedArguments object, Object.preventExtensions() will:
+        1. make the ClonedArguments enter dictionary indexing mode, which means it will
+        2. first ensure that the ClonedArguments is using slow put array storage via
+           JSObject::ensureArrayStorageSlow().
+
+        However, JSObject::ensureArrayStorageSlow() expects that we never see an object
+        with contiguous storage once we're in haveABadTime mode.  Our ClonedArguments
+        object did not obey this invariant.
+
+        The fix is to make the ClonedArguments factories create objects that use slow put
+        array storage when in haveABadTime mode.  This means:
+
+        1. JSGlobalObject::haveABadTime() now changes m_clonedArgumentsStructure to use
+           its slow put version.
+
+           Also the caching of the slow put version of m_regExpMatchesArrayStructure,
+           because we only need to create it when we are having a bad time. 
+
+        2. The ClonedArguments factories now allocates a butterfly with slow put array
+           storage if we're in haveABadTime mode.
+
+           Also added some assertions in ClonedArguments' factory methods to ensure that
+           the created object has the slow put indexing type when it needsSlowPutIndexing().
+
+        3. DFGFixupPhase now watches the havingABadTimeWatchpoint because ClonedArguments'
+           structure will change when having a bad time.
+
+        4. DFGArgumentEliminationPhase and DFGVarargsForwardingPhase need not be changed
+           because it is still valid to eliminate the creation of the arguments object
+           even having a bad time, as long as the arguments object does not escape.
+
+        5. The DFGAbstractInterpreterInlines now checks for haveABadTime, and sets the
+           predicted type to be SpecObject.
+
+        Note: this issue does not apply to DirectArguments and ScopedArguments because
+        they use a blank indexing type (just like JSObject).
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::dump):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createEmpty):
+        (JSC::ClonedArguments::createWithInlineFrame):
+        (JSC::ClonedArguments::createWithMachineFrame):
+        (JSC::ClonedArguments::createByCopyingFrom):
+        (JSC::ClonedArguments::createStructure):
+        (JSC::ClonedArguments::createSlowPutStructure):
+        * runtime/ClonedArguments.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::haveABadTime):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+
+2016-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG plays fast and loose with the shadow values of a Phi
+        https://bugs.webkit.org/show_bug.cgi?id=164309
+
+        Reviewed by Saam Barati.
+        
+        Oh boy, what an embarrassing mistake! The style of SSA I like to use avoids block/value
+        tuples as parameters of a Phi, thereby simplifying CFG transformations and making Phi largely
+        not a special case for most compiler transforms. It does this by introducing another value
+        called Upsilon, which stores a value into some Phi.
+        
+        B3 uses this also. The easiest way to understand what Upsilon/Phi behave like is to look at
+        the B3->Air lowering. Air is not SSA - it has Tmps that you can assign to and use as many
+        times as you like. B3 allocates one Tmp per Value, and an extra "phiTmp" for Phis, so that
+        Phis get two Tmps total. Upsilon stores the value into the phiTmp of the Phi, while Phi moves
+        the value from its phiTmp to its tmp.
+        
+        This is necessary to support scenarios like this:
+        
+            a: Phi()
+            b: Upsilon(@x, ^a)
+            c: Use(@a)
+        
+        Here, we want @c to see @a's value before @b. That's a very basic requirement of SSA: that
+        the a value (like @a) doesn't change during its lifetime.
+        
+        Unfortunately, DFG's liveness analysis, abstract interpreter, and integer range optimization
+        all failed to correctly model Upsilon/Phi this way. They would assume that it's accurate to
+        model the Upsilon as storing into the Phi directly.
+        
+        Because DFG does flow analysis over SSA, making it correct means enabling it to speak of the
+        shadow value. This change addresses this problem by introducing the concept of a
+        NodeFlowProjection. This is a key that lets us speak of both a Node's primary value and its
+        optional "shadow" value. Liveness, AI, and integer range are now keyed by NodeFlowProjection
+        rather than Node*. Conceptually this turns out to be a very simple change, but it does touch
+        a good amount of code.
+        
+        This looks to be perf-neutral.
+
+        Rolled back in after fixing the debug build.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::TmpLivenessAdapter::numIndices):
+        (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
+        (JSC::B3::Air::RegLivenessAdapter::numIndices):
+        (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
+        (JSC::B3::Air::TmpLivenessAdapter::maxIndex): Deleted.
+        (JSC::B3::Air::StackSlotLivenessAdapter::maxIndex): Deleted.
+        (JSC::B3::Air::RegLivenessAdapter::maxIndex): Deleted.
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::forNode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
+        * dfg/DFGAtTailAbstractState.cpp:
+        (JSC::DFG::AtTailAbstractState::createValueForNode):
+        (JSC::DFG::AtTailAbstractState::forNode):
+        * dfg/DFGAtTailAbstractState.h:
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGCombinedLiveness.cpp:
+        (JSC::DFG::liveNodesAtHead):
+        * dfg/DFGCombinedLiveness.h:
+        * dfg/DFGFlowIndexing.cpp: Added.
+        (JSC::DFG::FlowIndexing::FlowIndexing):
+        (JSC::DFG::FlowIndexing::~FlowIndexing):
+        (JSC::DFG::FlowIndexing::recompute):
+        * dfg/DFGFlowIndexing.h: Added.
+        (JSC::DFG::FlowIndexing::graph):
+        (JSC::DFG::FlowIndexing::numIndices):
+        (JSC::DFG::FlowIndexing::index):
+        (JSC::DFG::FlowIndexing::shadowIndex):
+        (JSC::DFG::FlowIndexing::nodeProjection):
+        * dfg/DFGFlowMap.h: Added.
+        (JSC::DFG::FlowMap::FlowMap):
+        (JSC::DFG::FlowMap::resize):
+        (JSC::DFG::FlowMap::graph):
+        (JSC::DFG::FlowMap::at):
+        (JSC::DFG::FlowMap::atShadow):
+        (WTF::printInternal):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::abstractValuesCache): Deleted.
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::InPlaceAbstractState):
+        (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
+        (JSC::DFG::setLiveValues):
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+        (JSC::DFG::InPlaceAbstractState::merge):
+        * dfg/DFGInPlaceAbstractState.h:
+        (JSC::DFG::InPlaceAbstractState::createValueForNode):
+        (JSC::DFG::InPlaceAbstractState::forNode):
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
+        (JSC::DFG::LivenessAnalysisPhase::run):
+        (JSC::DFG::LivenessAnalysisPhase::processBlock):
+        (JSC::DFG::LivenessAnalysisPhase::addChildUse): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::NodeComparator::operator()):
+        (JSC::DFG::nodeListDump):
+        (JSC::DFG::nodeMapDump):
+        (JSC::DFG::nodeValuePairListDump):
+        (JSC::DFG::nodeComparator): Deleted.
+        * dfg/DFGNodeAbstractValuePair.cpp: Added.
+        (JSC::DFG::NodeAbstractValuePair::dump):
+        * dfg/DFGNodeAbstractValuePair.h: Added.
+        (JSC::DFG::NodeAbstractValuePair::NodeAbstractValuePair):
+        * dfg/DFGNodeFlowProjection.cpp: Added.
+        (JSC::DFG::NodeFlowProjection::dump):
+        * dfg/DFGNodeFlowProjection.h: Added.
+        (JSC::DFG::NodeFlowProjection::NodeFlowProjection):
+        (JSC::DFG::NodeFlowProjection::operator bool):
+        (JSC::DFG::NodeFlowProjection::kind):
+        (JSC::DFG::NodeFlowProjection::node):
+        (JSC::DFG::NodeFlowProjection::operator*):
+        (JSC::DFG::NodeFlowProjection::operator->):
+        (JSC::DFG::NodeFlowProjection::hash):
+        (JSC::DFG::NodeFlowProjection::operator==):
+        (JSC::DFG::NodeFlowProjection::operator!=):
+        (JSC::DFG::NodeFlowProjection::operator<):
+        (JSC::DFG::NodeFlowProjection::operator>):
+        (JSC::DFG::NodeFlowProjection::operator<=):
+        (JSC::DFG::NodeFlowProjection::operator>=):
+        (JSC::DFG::NodeFlowProjection::isHashTableDeletedValue):
+        (JSC::DFG::NodeFlowProjection::isStillValid):
+        (JSC::DFG::NodeFlowProjection::forEach):
+        (JSC::DFG::NodeFlowProjectionHash::hash):
+        (JSC::DFG::NodeFlowProjectionHash::equal):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+
+2016-11-03  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r208364.
+        https://bugs.webkit.org/show_bug.cgi?id=164402
+
+        broke the build (Requested by smfr on #webkit).
+
+        Reverted changeset:
+
+        "DFG plays fast and loose with the shadow values of a Phi"
+        https://bugs.webkit.org/show_bug.cgi?id=164309
+        http://trac.webkit.org/changeset/208364
+
+2016-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG plays fast and loose with the shadow values of a Phi
+        https://bugs.webkit.org/show_bug.cgi?id=164309
+
+        Reviewed by Saam Barati.
+        
+        Oh boy, what an embarrassing mistake! The style of SSA I like to use avoids block/value
+        tuples as parameters of a Phi, thereby simplifying CFG transformations and making Phi largely
+        not a special case for most compiler transforms. It does this by introducing another value
+        called Upsilon, which stores a value into some Phi.
+        
+        B3 uses this also. The easiest way to understand what Upsilon/Phi behave like is to look at
+        the B3->Air lowering. Air is not SSA - it has Tmps that you can assign to and use as many
+        times as you like. B3 allocates one Tmp per Value, and an extra "phiTmp" for Phis, so that
+        Phis get two Tmps total. Upsilon stores the value into the phiTmp of the Phi, while Phi moves
+        the value from its phiTmp to its tmp.
+        
+        This is necessary to support scenarios like this:
+        
+            a: Phi()
+            b: Upsilon(@x, ^a)
+            c: Use(@a)
+        
+        Here, we want @c to see @a's value before @b. That's a very basic requirement of SSA: that
+        the a value (like @a) doesn't change during its lifetime.
+        
+        Unfortunately, DFG's liveness analysis, abstract interpreter, and integer range optimization
+        all failed to correctly model Upsilon/Phi this way. They would assume that it's accurate to
+        model the Upsilon as storing into the Phi directly.
+        
+        Because DFG does flow analysis over SSA, making it correct means enabling it to speak of the
+        shadow value. This change addresses this problem by introducing the concept of a
+        NodeFlowProjection. This is a key that lets us speak of both a Node's primary value and its
+        optional "shadow" value. Liveness, AI, and integer range are now keyed by NodeFlowProjection
+        rather than Node*. Conceptually this turns out to be a very simple change, but it does touch
+        a good amount of code.
+        
+        This looks to be perf-neutral.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::TmpLivenessAdapter::numIndices):
+        (JSC::B3::Air::StackSlotLivenessAdapter::numIndices):
+        (JSC::B3::Air::RegLivenessAdapter::numIndices):
+        (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
+        (JSC::B3::Air::TmpLivenessAdapter::maxIndex): Deleted.
+        (JSC::B3::Air::StackSlotLivenessAdapter::maxIndex): Deleted.
+        (JSC::B3::Air::RegLivenessAdapter::maxIndex): Deleted.
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::forNode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
+        * dfg/DFGAtTailAbstractState.cpp:
+        (JSC::DFG::AtTailAbstractState::createValueForNode):
+        (JSC::DFG::AtTailAbstractState::forNode):
+        * dfg/DFGAtTailAbstractState.h:
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGCombinedLiveness.cpp:
+        (JSC::DFG::liveNodesAtHead):
+        * dfg/DFGCombinedLiveness.h:
+        * dfg/DFGFlowIndexing.cpp: Added.
+        (JSC::DFG::FlowIndexing::FlowIndexing):
+        (JSC::DFG::FlowIndexing::~FlowIndexing):
+        (JSC::DFG::FlowIndexing::recompute):
+        * dfg/DFGFlowIndexing.h: Added.
+        (JSC::DFG::FlowIndexing::graph):
+        (JSC::DFG::FlowIndexing::numIndices):
+        (JSC::DFG::FlowIndexing::index):
+        (JSC::DFG::FlowIndexing::shadowIndex):
+        (JSC::DFG::FlowIndexing::nodeProjection):
+        * dfg/DFGFlowMap.h: Added.
+        (JSC::DFG::FlowMap::FlowMap):
+        (JSC::DFG::FlowMap::resize):
+        (JSC::DFG::FlowMap::graph):
+        (JSC::DFG::FlowMap::at):
+        (JSC::DFG::FlowMap::atShadow):
+        (WTF::printInternal):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::abstractValuesCache): Deleted.
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::InPlaceAbstractState):
+        (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
+        (JSC::DFG::setLiveValues):
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+        (JSC::DFG::InPlaceAbstractState::merge):
+        * dfg/DFGInPlaceAbstractState.h:
+        (JSC::DFG::InPlaceAbstractState::createValueForNode):
+        (JSC::DFG::InPlaceAbstractState::forNode):
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
+        (JSC::DFG::LivenessAnalysisPhase::run):
+        (JSC::DFG::LivenessAnalysisPhase::processBlock):
+        (JSC::DFG::LivenessAnalysisPhase::addChildUse): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::NodeComparator::operator()):
+        (JSC::DFG::nodeListDump):
+        (JSC::DFG::nodeMapDump):
+        (JSC::DFG::nodeValuePairListDump):
+        (JSC::DFG::nodeComparator): Deleted.
+        * dfg/DFGNodeAbstractValuePair.cpp: Added.
+        (JSC::DFG::NodeAbstractValuePair::dump):
+        * dfg/DFGNodeAbstractValuePair.h: Added.
+        (JSC::DFG::NodeAbstractValuePair::NodeAbstractValuePair):
+        * dfg/DFGNodeFlowProjection.cpp: Added.
+        (JSC::DFG::NodeFlowProjection::dump):
+        * dfg/DFGNodeFlowProjection.h: Added.
+        (JSC::DFG::NodeFlowProjection::NodeFlowProjection):
+        (JSC::DFG::NodeFlowProjection::operator bool):
+        (JSC::DFG::NodeFlowProjection::kind):
+        (JSC::DFG::NodeFlowProjection::node):
+        (JSC::DFG::NodeFlowProjection::operator*):
+        (JSC::DFG::NodeFlowProjection::operator->):
+        (JSC::DFG::NodeFlowProjection::hash):
+        (JSC::DFG::NodeFlowProjection::operator==):
+        (JSC::DFG::NodeFlowProjection::operator!=):
+        (JSC::DFG::NodeFlowProjection::operator<):
+        (JSC::DFG::NodeFlowProjection::operator>):
+        (JSC::DFG::NodeFlowProjection::operator<=):
+        (JSC::DFG::NodeFlowProjection::operator>=):
+        (JSC::DFG::NodeFlowProjection::isHashTableDeletedValue):
+        (JSC::DFG::NodeFlowProjection::isStillValid):
+        (JSC::DFG::NodeFlowProjection::forEach):
+        (JSC::DFG::NodeFlowProjectionHash::hash):
+        (JSC::DFG::NodeFlowProjectionHash::equal):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+
+2016-11-03  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, changelog fix due to failed git rebase..
+
+2016-11-03  Keith Miller  <keith_miller@apple.com>
+
+        Wasm starts a new stack whenever it adds a new block and has return types for blocks.
+        https://bugs.webkit.org/show_bug.cgi?id=164100
+
+        Reviewed by Saam Barati.
+
+        This patch overhauls much of the Wasm function parser, validator, and B3 IR generator
+        to work with block return types. In Wasm, blocks can act as expressions and have a
+        return value. Most of the control flow operators needed to be rewritten in order to
+        support this feature. To enable return types the function parser needed to be able
+        to save and restore the expression stack from previous blocks, which is done via the
+        control stack.
+
+        This patch also removes the lazy continuation block system added previously. It's
+        not clear if there would be any performance win from such a system. There are likely
+        many other things with orders of magnitude more impact on B3 IR generation. The
+        complexity cost of such a system is not worth the effort without sufficient evidence
+        otherwise.
+
+        * testWasm.cpp:
+        (runWasmTests):
+        * wasm/WasmB3IRGenerator.cpp:
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseBlock):
+        (JSC::Wasm::FunctionParser<Context>::addReturn):
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
+        (JSC::Wasm::FunctionParser<Context>::popExpressionStack):
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::ControlData::hasNonVoidSignature):
+        (JSC::Wasm::Validate::addElse):
+        (JSC::Wasm::Validate::addElseToUnreachable):
+        (JSC::Wasm::Validate::addBranch):
+        (JSC::Wasm::Validate::endBlock):
+        (JSC::Wasm::Validate::addEndToUnreachable):
+        (JSC::Wasm::Validate::dump):
+        (JSC::Wasm::validateFunction):
+        (JSC::Wasm::Validate::isContinuationReachable): Deleted.
+
+2016-11-03  Saam Barati  <sbarati@apple.com>
+
+        Asking for a value profile prediction should be defensive against not finding a value profile
+        https://bugs.webkit.org/show_bug.cgi?id=164306
+
+        Reviewed by Mark Lam.
+
+        Currently, the code that calls CodeBlock::valueProfilePredictionForBytecodeOffset
+        in the DFG assumes it will always be at a value producing node. However, this isn't
+        true if we tail call from an inlined setter. When we're at a tail call, we try
+        to find the first caller that isn't a tail call to see what value the
+        tail_call produces. If we inline a setter, however, we will end up finding
+        the put_by_id as our first non-tail-called "caller", and that won't have a
+        value profile associated with it since it's not a value producing node.
+        CodeBlock::valueProfilePredictionForBytecodeOffset should be defensive
+        against finding a null value profile.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+
+2016-11-02  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, fix CLoop build after r208320.
+        https://bugs.webkit.org/show_bug.cgi?id=162980
+
+        Add required forward declarations.
+
+        * domjit/DOMJITHeapRange.cpp:
+        * domjit/DOMJITSignature.h:
+        * runtime/VM.h:
+
+2016-11-02  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Add DOMJIT::Signature
+        https://bugs.webkit.org/show_bug.cgi?id=162980
+
+        Reviewed by Saam Barati and Sam Weinig.
+
+        This patch introduces a new mechanism called DOMJIT::Signature. We can annotate the function with DOMJIT::Signature.
+        DOMJIT::Signature has type information of that function. And it also maintains the effect of the function and the
+        pointer to the unsafe function. The unsafe function means the function without type and argument count checks.
+        By using these information, we can separate type and argument count checks from the function. And we can emit
+        these things as DFG checks and convert the function call itself to CallDOM node. CallDOM node can call the unsafe
+        function directly without any checks. Furthermore, this CallDOM node can represent its own clobberizing rules based
+        on DOMJIT::Effect maintained by DOMJIT::Signature. It allows us to make opaque Call node to a CallDOM node that
+        merely reads some part of heap. These changes (1) can drop duplicate type checks in DFG, (2) offer ability to move
+        CallDOM node to somewhere, and (3) track more detailed heap reads and writes of CallDOM nodes.
+
+        We first emit Call node with DOMJIT::Signature in DFGByteCodeParser. And in the fixup phase, we attempt to lower
+        Call node to CallDOM node with checks & edge filters. This is because we do not know the type predictions in
+        DFGByteCodeParser phase. If we always emit CallDOM node in DFGByteCodeParser, if we evaluate `div.getAttribute(true)`
+        thingy, the Uncountable OSR exits repeatedly happen because AI figures out the abstract value is cleared.
+
+        Currently, DOMJIT signature only allows the types that can reside in GPR. This is because the types of the unsafe
+        function arguments are represented as the sequence of void*. In the future, we will extend to accept other types like
+        float, double etc.
+
+        We annotate several functions in Element. In particular, we annotate Element::getAttribute. This allows us to perform
+        LICM in Dromaeo dom-attr test. In the Dromaeo dom-attr getAttribute test, we can see 32x improvement. (134974.8 v.s. 4203.4)
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallVariant.h:
+        (JSC::CallVariant::functionExecutable):
+        (JSC::CallVariant::nativeExecutable):
+        (JSC::CallVariant::signatureFor):
+        * bytecode/SpeculatedType.h:
+        (JSC::isNotStringSpeculation):
+        (JSC::isNotInt32Speculation):
+        (JSC::isNotBooleanSpeculation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleDOMJITCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeCallDOM):
+        (JSC::DFG::FixupPhase::fixupCheckDOM):
+        (JSC::DFG::FixupPhase::fixupCallDOM):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToCallDOM):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::shouldSpeculateNotInt32):
+        (JSC::DFG::Node::shouldSpeculateNotBoolean):
+        (JSC::DFG::Node::shouldSpeculateNotString):
+        (JSC::DFG::Node::hasSignature):
+        (JSC::DFG::Node::signature):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCallDOM):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * domjit/DOMJITEffect.h:
+        (JSC::DOMJIT::Effect::Effect):
+        (JSC::DOMJIT::Effect::forWrite):
+        (JSC::DOMJIT::Effect::forRead):
+        (JSC::DOMJIT::Effect::forReadWrite):
+        (JSC::DOMJIT::Effect::forPure):
+        (JSC::DOMJIT::Effect::forDef):
+        (JSC::DOMJIT::Effect::mustGenerate):
+        In clang, we cannot make this Effect constructor constexpr if we use Optional<HeapRange>.
+        So we use HeapRange::top() for Nullopt def now.
+
+        * domjit/DOMJITHeapRange.h:
+        (JSC::DOMJIT::HeapRange::fromRaw):
+        (JSC::DOMJIT::HeapRange::operator bool):
+        (JSC::DOMJIT::HeapRange::operator==):
+        (JSC::DOMJIT::HeapRange::operator!=):
+        (JSC::DOMJIT::HeapRange::fromConstant):
+        * domjit/DOMJITSignature.h: Copied from Source/JavaScriptCore/domjit/DOMJITEffect.h.
+        (JSC::DOMJIT::Signature::Signature):
+        (JSC::DOMJIT::Signature::argumentCount):
+        (JSC::DOMJIT::Signature::checkDOM):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
+        * jit/JITOperations.h:
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        * runtime/JSFunction.h:
+        * runtime/JSNativeStdFunction.cpp:
+        (JSC::JSNativeStdFunction::create):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectNativeFunction):
+        * runtime/JSObject.h:
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::functionLength):
+        (JSC::HashTableValue::signature):
+        (JSC::reifyStaticProperty):
+        * runtime/NativeExecutable.cpp:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        * runtime/NativeExecutable.h:
+        * runtime/PropertySlot.h:
+        * runtime/VM.cpp:
+        (JSC::VM::getHostFunction):
+        * runtime/VM.h:
+
+2016-11-02  Andreas Kling  <akling@apple.com>
+
+        MarkedSpace should have specialized size classes for popular engine objects.
+        <https://webkit.org/b/164345>
+
+        Reviewed by Filip Pizlo.
+
+        The MarkedSpace size classes were recently reworked to minimize wasted space
+        at the end of MarkedBlocks.
+
+        However, we know that some specific objects will be allocated in very high volume.
+        Adding specialized size classes for those object sizes achieves greater utilization
+        since we're basically guaranteed to allocate them all the time.
+
+        Inject specialized size classes for these four objects:
+
+            - FunctionCodeBlock
+                560 bytes instead of 624
+                28 per block instead of 26 (+2)
+
+            - FunctionExecutable
+                176 bytes instead of 224
+                92 per block instead of 72 (+20)
+
+            - UnlinkedFunctionCodeBlock
+                256 bytes instead of 320
+                63 per block instead of 50 (+13)
+
+            - UnlinkedFunctionExecutable
+                192 bytes instead of 224
+                84 per block instead of 72 (+12)
+
+        * heap/MarkedSpace.cpp:
+
+2016-11-02  Geoffrey Garen  <ggaren@apple.com>
+
+        One file per class for UnlinkedCodeBlock.h/.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=164348
+
+        Reviewed by Saam Barati.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/FunctionCodeBlock.h:
+        * bytecode/ModuleProgramCodeBlock.h:
+        * bytecode/ProgramCodeBlock.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
+        * bytecode/UnlinkedEvalCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
+        (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
+        (JSC::dumpLineColumnEntry): Deleted.
+        (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
+        (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::instructions): Deleted.
+        (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::applyModification): Deleted.
+        * bytecode/UnlinkedEvalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
+        (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
+        (JSC::UnlinkedSimpleJumpTable::add): Deleted.
+        (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
+        (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
+        (JSC::UnlinkedCodeBlock::usesEval): Deleted.
+        (JSC::UnlinkedCodeBlock::parseMode): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
+        (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
+        (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addParameter): Deleted.
+        (JSC::UnlinkedCodeBlock::numParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
+        (JSC::UnlinkedCodeBlock::regexp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
+        (JSC::UnlinkedCodeBlock::superBinding): Deleted.
+        (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+        (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
+        (JSC::UnlinkedCodeBlock::codeType): Deleted.
+        (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
+        (JSC::UnlinkedCodeBlock::recordParse): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
+        (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
+        (JSC::UnlinkedCodeBlock::firstLine): Deleted.
+        (JSC::UnlinkedCodeBlock::lineCount): Deleted.
+        (JSC::UnlinkedCodeBlock::startColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::endColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
+        * bytecode/UnlinkedFunctionCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
+        (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
+        (JSC::dumpLineColumnEntry): Deleted.
+        (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
+        (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::instructions): Deleted.
+        (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::applyModification): Deleted.
+        * bytecode/UnlinkedFunctionCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
+        (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
+        (JSC::UnlinkedSimpleJumpTable::add): Deleted.
+        (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
+        (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
+        (JSC::UnlinkedCodeBlock::usesEval): Deleted.
+        (JSC::UnlinkedCodeBlock::parseMode): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
+        (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
+        (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addParameter): Deleted.
+        (JSC::UnlinkedCodeBlock::numParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
+        (JSC::UnlinkedCodeBlock::regexp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
+        (JSC::UnlinkedCodeBlock::superBinding): Deleted.
+        (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+        (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
+        (JSC::UnlinkedCodeBlock::codeType): Deleted.
+        (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
+        (JSC::UnlinkedCodeBlock::recordParse): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
+        (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
+        (JSC::UnlinkedCodeBlock::firstLine): Deleted.
+        (JSC::UnlinkedCodeBlock::lineCount): Deleted.
+        (JSC::UnlinkedCodeBlock::startColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::endColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::destroy):
+        * bytecode/UnlinkedGlobalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock):
+        (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
+        (JSC::UnlinkedSimpleJumpTable::add): Deleted.
+        (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
+        (): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
+        (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
+        (JSC::UnlinkedCodeBlock::usesEval): Deleted.
+        (JSC::UnlinkedCodeBlock::parseMode): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
+        (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
+        (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addParameter): Deleted.
+        (JSC::UnlinkedCodeBlock::numParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
+        (JSC::UnlinkedCodeBlock::regexp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
+        (JSC::UnlinkedCodeBlock::superBinding): Deleted.
+        (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+        (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
+        (JSC::UnlinkedCodeBlock::codeType): Deleted.
+        (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
+        (JSC::UnlinkedCodeBlock::recordParse): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
+        (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
+        (JSC::UnlinkedCodeBlock::firstLine): Deleted.
+        (JSC::UnlinkedCodeBlock::lineCount): Deleted.
+        (JSC::UnlinkedCodeBlock::startColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::endColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
+        * bytecode/UnlinkedModuleProgramCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
+        (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
+        (JSC::dumpLineColumnEntry): Deleted.
+        (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
+        (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::instructions): Deleted.
+        (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::applyModification): Deleted.
+        * bytecode/UnlinkedModuleProgramCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
+        (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
+        (JSC::UnlinkedSimpleJumpTable::add): Deleted.
+        (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
+        (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
+        (JSC::UnlinkedCodeBlock::usesEval): Deleted.
+        (JSC::UnlinkedCodeBlock::parseMode): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
+        (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
+        (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addParameter): Deleted.
+        (JSC::UnlinkedCodeBlock::numParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
+        (JSC::UnlinkedCodeBlock::regexp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
+        (JSC::UnlinkedCodeBlock::superBinding): Deleted.
+        (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+        (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
+        (JSC::UnlinkedCodeBlock::codeType): Deleted.
+        (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
+        (JSC::UnlinkedCodeBlock::recordParse): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
+        (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
+        (JSC::UnlinkedCodeBlock::firstLine): Deleted.
+        (JSC::UnlinkedCodeBlock::lineCount): Deleted.
+        (JSC::UnlinkedCodeBlock::startColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::endColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
+        * bytecode/UnlinkedProgramCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::estimatedSize): Deleted.
+        (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
+        (JSC::dumpLineColumnEntry): Deleted.
+        (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
+        (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
+        (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::instructions): Deleted.
+        (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::handlerForIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::applyModification): Deleted.
+        * bytecode/UnlinkedProgramCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
+        (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
+        (JSC::UnlinkedSimpleJumpTable::add): Deleted.
+        (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
+        (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
+        (JSC::UnlinkedCodeBlock::usesEval): Deleted.
+        (JSC::UnlinkedCodeBlock::parseMode): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::derivedContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::evalContextType): Deleted.
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext): Deleted.
+        (JSC::UnlinkedCodeBlock::isClassContext): Deleted.
+        (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addParameter): Deleted.
+        (JSC::UnlinkedCodeBlock::numParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
+        (JSC::UnlinkedCodeBlock::regexp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
+        (JSC::UnlinkedCodeBlock::superBinding): Deleted.
+        (JSC::UnlinkedCodeBlock::scriptMode): Deleted.
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+        (JSC::UnlinkedCodeBlock::numCalleeLocals): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
+        (JSC::UnlinkedCodeBlock::codeType): Deleted.
+        (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
+        (JSC::UnlinkedCodeBlock::recordParse): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::sourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective): Deleted.
+        (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
+        (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
+        (JSC::UnlinkedCodeBlock::firstLine): Deleted.
+        (JSC::UnlinkedCodeBlock::lineCount): Deleted.
+        (JSC::UnlinkedCodeBlock::startColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::endColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::UnlinkedCodeBlock::didOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::setDidOptimize): Deleted.
+        (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        * runtime/CodeCache.cpp:
+        * runtime/EvalExecutable.h:
+        * runtime/JSModuleRecord.cpp:
+
+2016-11-02  Saam Barati  <sbarati@apple.com>
+
+        Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=164301
+
+        Reviewed by Geoffrey Garen.
+
+        We weren't taking into account indexed properties on the __proto__
+        of the rest parameter. This made the code for doing out of bound
+        accesses incorrect since it just assumed it's safe for the result of
+        an out of bound access to be undefined. This broke the semantics
+        of JS code when there was an indexed property on the Array.prototype
+        or Object.prototype.
+
+        This patch makes sure we set up the proper watchpoints for making
+        sure out of bound accesses are safe to return undefined.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+
+2016-11-02  Geoffrey Garen  <ggaren@apple.com>
+
+        One file per class for CodeBlock.h/.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=164343
+
+        Reviewed by Andreas Kling.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallLinkInfo.cpp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::FunctionCodeBlock::destroy): Deleted.
+        (JSC::WebAssemblyCodeBlock::destroy): Deleted.
+        (JSC::ProgramCodeBlock::destroy): Deleted.
+        (JSC::ModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::EvalCodeBlock::destroy): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::GlobalCodeBlock::GlobalCodeBlock): Deleted.
+        (JSC::ProgramCodeBlock::create): Deleted.
+        (JSC::ProgramCodeBlock::createStructure): Deleted.
+        (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
+        (JSC::ModuleProgramCodeBlock::create): Deleted.
+        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::create): Deleted.
+        (JSC::EvalCodeBlock::createStructure): Deleted.
+        (JSC::EvalCodeBlock::variable): Deleted.
+        (JSC::EvalCodeBlock::numVariables): Deleted.
+        (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock): Deleted.
+        (JSC::FunctionCodeBlock::create): Deleted.
+        (JSC::FunctionCodeBlock::createStructure): Deleted.
+        (JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.
+        (JSC::WebAssemblyCodeBlock::create): Deleted.
+        (JSC::WebAssemblyCodeBlock::createStructure): Deleted.
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock): Deleted.
+        (JSC::ScriptExecutable::forEachCodeBlock): Deleted.
+        * bytecode/EvalCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/CodeBlock.cpp.
+        (JSC::FunctionCodeBlock::destroy): Deleted.
+        (JSC::WebAssemblyCodeBlock::destroy): Deleted.
+        (JSC::ProgramCodeBlock::destroy): Deleted.
+        (JSC::ModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::CodeBlock::inferredName): Deleted.
+        (JSC::CodeBlock::hasHash): Deleted.
+        (JSC::CodeBlock::isSafeToComputeHash): Deleted.
+        (JSC::CodeBlock::hash): Deleted.
+        (JSC::CodeBlock::sourceCodeForTools): Deleted.
+        (JSC::CodeBlock::sourceCodeOnOneLine): Deleted.
+        (JSC::CodeBlock::hashAsStringIfPossible): Deleted.
+        (JSC::CodeBlock::dumpAssumingJITType): Deleted.
+        (JSC::CodeBlock::dump): Deleted.
+        (JSC::idName): Deleted.
+        (JSC::CodeBlock::registerName): Deleted.
+        (JSC::CodeBlock::constantName): Deleted.
+        (JSC::regexpToSourceString): Deleted.
+        (JSC::regexpName): Deleted.
+        (JSC::debugHookName): Deleted.
+        (JSC::CodeBlock::printUnaryOp): Deleted.
+        (JSC::CodeBlock::printBinaryOp): Deleted.
+        (JSC::CodeBlock::printConditionalJump): Deleted.
+        (JSC::CodeBlock::printGetByIdOp): Deleted.
+        (JSC::dumpStructure): Deleted.
+        (JSC::dumpChain): Deleted.
+        (JSC::CodeBlock::printGetByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printCallOp): Deleted.
+        (JSC::CodeBlock::printPutByIdOp): Deleted.
+        (JSC::CodeBlock::dumpSource): Deleted.
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        (JSC::CodeBlock::dumpExceptionHandlers): Deleted.
+        (JSC::CodeBlock::beginDumpProfiling): Deleted.
+        (JSC::CodeBlock::dumpValueProfiling): Deleted.
+        (JSC::CodeBlock::dumpArrayProfiling): Deleted.
+        (JSC::CodeBlock::dumpRareCaseProfile): Deleted.
+        (JSC::CodeBlock::dumpArithProfile): Deleted.
+        (JSC::CodeBlock::printLocationAndOp): Deleted.
+        (JSC::CodeBlock::printLocationOpAndRegisterOperand): Deleted.
+        (JSC::sizeInBytes): Deleted.
+        (JSC::CodeBlock::CodeBlock): Deleted.
+        (JSC::CodeBlock::finishCreation): Deleted.
+        (JSC::CodeBlock::~CodeBlock): Deleted.
+        (JSC::CodeBlock::setConstantRegisters): Deleted.
+        (JSC::CodeBlock::setAlternative): Deleted.
+        (JSC::CodeBlock::setNumParameters): Deleted.
+        (JSC::EvalCodeCache::visitAggregate): Deleted.
+        (JSC::CodeBlock::specialOSREntryBlockOrNull): Deleted.
+        (JSC::CodeBlock::visitWeakly): Deleted.
+        (JSC::CodeBlock::estimatedSize): Deleted.
+        (JSC::CodeBlock::visitChildren): Deleted.
+        (JSC::CodeBlock::shouldVisitStrongly): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference): Deleted.
+        (JSC::timeToLive): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToOldAge): Deleted.
+        (JSC::shouldMarkTransition): Deleted.
+        (JSC::CodeBlock::propagateTransitions): Deleted.
+        (JSC::CodeBlock::determineLiveness): Deleted.
+        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
+        (JSC::CodeBlock::clearLLIntGetByIdCache): Deleted.
+        (JSC::CodeBlock::finalizeLLIntInlineCaches): Deleted.
+        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
+        (JSC::CodeBlock::getStubInfoMap): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoMap): Deleted.
+        (JSC::CodeBlock::getByValInfoMap): Deleted.
+        (JSC::CodeBlock::addStubInfo): Deleted.
+        (JSC::CodeBlock::addJITAddIC): Deleted.
+        (JSC::CodeBlock::addJITMulIC): Deleted.
+        (JSC::CodeBlock::addJITSubIC): Deleted.
+        (JSC::CodeBlock::addJITNegIC): Deleted.
+        (JSC::CodeBlock::findStubInfo): Deleted.
+        (JSC::CodeBlock::addByValInfo): Deleted.
+        (JSC::CodeBlock::addCallLinkInfo): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): Deleted.
+        (JSC::CodeBlock::resetJITData): Deleted.
+        (JSC::CodeBlock::visitOSRExitTargets): Deleted.
+        (JSC::CodeBlock::stronglyVisitStrongReferences): Deleted.
+        (JSC::CodeBlock::stronglyVisitWeakReferences): Deleted.
+        (JSC::CodeBlock::baselineAlternative): Deleted.
+        (JSC::CodeBlock::baselineVersion): Deleted.
+        (JSC::CodeBlock::hasOptimizedReplacement): Deleted.
+        (JSC::CodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::handlerForIndex): Deleted.
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex): Deleted.
+        (JSC::CodeBlock::removeExceptionHandlerForCallSite): Deleted.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::columnNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::hasOpDebugForLineAndColumn): Deleted.
+        (JSC::CodeBlock::shrinkToFit): Deleted.
+        (JSC::CodeBlock::linkIncomingCall): Deleted.
+        (JSC::CodeBlock::linkIncomingPolymorphicCall): Deleted.
+        (JSC::CodeBlock::unlinkIncomingCalls): Deleted.
+        (JSC::CodeBlock::newReplacement): Deleted.
+        (JSC::CodeBlock::replacement): Deleted.
+        (JSC::CodeBlock::computeCapabilityLevel): Deleted.
+        (JSC::CodeBlock::jettison): Deleted.
+        (JSC::CodeBlock::globalObjectFor): Deleted.
+        (JSC::RecursionCheckFunctor::RecursionCheckFunctor): Deleted.
+        (JSC::RecursionCheckFunctor::operator()): Deleted.
+        (JSC::RecursionCheckFunctor::didRecurse): Deleted.
+        (JSC::CodeBlock::noticeIncomingCall): Deleted.
+        (JSC::CodeBlock::reoptimizationRetryCounter): Deleted.
+        (JSC::CodeBlock::setCalleeSaveRegisters): Deleted.
+        (JSC::roundCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::countReoptimization): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::codeTypeThresholdMultiplier): Deleted.
+        (JSC::CodeBlock::optimizationThresholdScalingFactor): Deleted.
+        (JSC::clipThreshold): Deleted.
+        (JSC::CodeBlock::adjustedCounterValue): Deleted.
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached): Deleted.
+        (JSC::CodeBlock::optimizeNextInvocation): Deleted.
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeAfterLongWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeSoon): Deleted.
+        (JSC::CodeBlock::forceOptimizationSlowPathConcurrently): Deleted.
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult): Deleted.
+        (JSC::CodeBlock::adjustedExitCountThreshold): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimization): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeNow): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow): Deleted.
+        (JSC::CodeBlock::getArrayProfile): Deleted.
+        (JSC::CodeBlock::addArrayProfile): Deleted.
+        (JSC::CodeBlock::getOrAddArrayProfile): Deleted.
+        (JSC::CodeBlock::codeOrigins): Deleted.
+        (JSC::CodeBlock::numberOfDFGIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): Deleted.
+        (JSC::CodeBlock::updateAllValueProfilePredictions): Deleted.
+        (JSC::CodeBlock::updateAllArrayPredictions): Deleted.
+        (JSC::CodeBlock::updateAllPredictions): Deleted.
+        (JSC::CodeBlock::shouldOptimizeNow): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::dumpValueProfiles): Deleted.
+        (JSC::CodeBlock::frameRegisterCount): Deleted.
+        (JSC::CodeBlock::stackPointerOffset): Deleted.
+        (JSC::CodeBlock::predictedMachineCodeSize): Deleted.
+        (JSC::CodeBlock::usesOpcode): Deleted.
+        (JSC::CodeBlock::nameForRegister): Deleted.
+        (JSC::CodeBlock::valueProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::validate): Deleted.
+        (JSC::CodeBlock::beginValidationDidFail): Deleted.
+        (JSC::CodeBlock::endValidationDidFail): Deleted.
+        (JSC::CodeBlock::addBreakpoint): Deleted.
+        (JSC::CodeBlock::setSteppingMode): Deleted.
+        (JSC::CodeBlock::addRareCaseProfile): Deleted.
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForPC): Deleted.
+        (JSC::CodeBlock::couldTakeSpecialFastCase): Deleted.
+        (JSC::CodeBlock::capabilityLevel): Deleted.
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler): Deleted.
+        (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
+        (JSC::CodeBlock::findPC): Deleted.
+        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex): Deleted.
+        (JSC::CodeBlock::thresholdForJIT): Deleted.
+        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
+        (JSC::CodeBlock::jitSoon): Deleted.
+        (JSC::CodeBlock::dumpMathICStats): Deleted.
+        (JSC::CodeBlock::livenessAnalysisSlow): Deleted.
+        * bytecode/EvalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/CodeBlock.h.
+        (): Deleted.
+        (JSC::CodeBlock::unlinkedCodeBlock): Deleted.
+        (JSC::CodeBlock::numParameters): Deleted.
+        (JSC::CodeBlock::numCalleeLocals): Deleted.
+        (JSC::CodeBlock::addressOfNumParameters): Deleted.
+        (JSC::CodeBlock::offsetOfNumParameters): Deleted.
+        (JSC::CodeBlock::alternative): Deleted.
+        (JSC::CodeBlock::forEachRelatedCodeBlock): Deleted.
+        (JSC::CodeBlock::specializationKind): Deleted.
+        (JSC::CodeBlock::isStrictMode): Deleted.
+        (JSC::CodeBlock::ecmaMode): Deleted.
+        (JSC::CodeBlock::isKnownNotImmediate): Deleted.
+        (JSC::CodeBlock::isTemporaryRegisterIndex): Deleted.
+        (JSC::CodeBlock::stubInfoBegin): Deleted.
+        (JSC::CodeBlock::stubInfoEnd): Deleted.
+        (JSC::CodeBlock::callLinkInfosBegin): Deleted.
+        (JSC::CodeBlock::callLinkInfosEnd): Deleted.
+        (JSC::CodeBlock::setJITCodeMap): Deleted.
+        (JSC::CodeBlock::jitCodeMap): Deleted.
+        (JSC::CodeBlock::bytecodeOffset): Deleted.
+        (JSC::CodeBlock::numberOfInstructions): Deleted.
+        (JSC::CodeBlock::instructions): Deleted.
+        (JSC::CodeBlock::instructionCount): Deleted.
+        (JSC::CodeBlock::setJITCode): Deleted.
+        (JSC::CodeBlock::jitCode): Deleted.
+        (JSC::CodeBlock::jitCodeOffset): Deleted.
+        (JSC::CodeBlock::jitType): Deleted.
+        (JSC::CodeBlock::hasBaselineJITProfiling): Deleted.
+        (JSC::CodeBlock::capabilityLevelState): Deleted.
+        (JSC::CodeBlock::ownerExecutable): Deleted.
+        (JSC::CodeBlock::ownerScriptExecutable): Deleted.
+        (JSC::CodeBlock::vm): Deleted.
+        (JSC::CodeBlock::setThisRegister): Deleted.
+        (JSC::CodeBlock::thisRegister): Deleted.
+        (JSC::CodeBlock::usesEval): Deleted.
+        (JSC::CodeBlock::setScopeRegister): Deleted.
+        (JSC::CodeBlock::scopeRegister): Deleted.
+        (JSC::CodeBlock::codeType): Deleted.
+        (JSC::CodeBlock::putByIdContext): Deleted.
+        (JSC::CodeBlock::source): Deleted.
+        (JSC::CodeBlock::sourceOffset): Deleted.
+        (JSC::CodeBlock::firstLineColumnOffset): Deleted.
+        (JSC::CodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::CodeBlock::jumpTarget): Deleted.
+        (JSC::CodeBlock::numberOfArgumentValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfileForArgument): Deleted.
+        (JSC::CodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfile): Deleted.
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::totalNumberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::getFromAllValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfRareCaseProfiles): Deleted.
+        (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
+        (JSC::CodeBlock::couldTakeSlowCase): Deleted.
+        (JSC::CodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::CodeBlock::arrayProfiles): Deleted.
+        (JSC::CodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::CodeBlock::exceptionHandler): Deleted.
+        (JSC::CodeBlock::hasExpressionInfo): Deleted.
+        (JSC::CodeBlock::hasCodeOrigins): Deleted.
+        (JSC::CodeBlock::canGetCodeOrigin): Deleted.
+        (JSC::CodeBlock::codeOrigin): Deleted.
+        (JSC::CodeBlock::addFrequentExitSite): Deleted.
+        (JSC::CodeBlock::hasExitSite): Deleted.
+        (JSC::CodeBlock::exitProfile): Deleted.
+        (JSC::CodeBlock::lazyOperandValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::constants): Deleted.
+        (JSC::CodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::addConstant): Deleted.
+        (JSC::CodeBlock::addConstantLazily): Deleted.
+        (JSC::CodeBlock::constantRegister): Deleted.
+        (JSC::CodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::CodeBlock::getConstant): Deleted.
+        (JSC::CodeBlock::constantSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::functionDecl): Deleted.
+        (JSC::CodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::CodeBlock::functionExpr): Deleted.
+        (JSC::CodeBlock::regexp): Deleted.
+        (JSC::CodeBlock::numberOfConstantBuffers): Deleted.
+        (JSC::CodeBlock::addConstantBuffer): Deleted.
+        (JSC::CodeBlock::constantBufferAsVector): Deleted.
+        (JSC::CodeBlock::constantBuffer): Deleted.
+        (JSC::CodeBlock::heap): Deleted.
+        (JSC::CodeBlock::globalObject): Deleted.
+        (JSC::CodeBlock::livenessAnalysis): Deleted.
+        (JSC::CodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::switchJumpTable): Deleted.
+        (JSC::CodeBlock::clearSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::evalCodeCache): Deleted.
+        (JSC::CodeBlock::checkIfJITThresholdReached): Deleted.
+        (JSC::CodeBlock::dontJITAnytimeSoon): Deleted.
+        (JSC::CodeBlock::llintExecuteCounter): Deleted.
+        (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
+        (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount): Deleted.
+        (JSC::CodeBlock::jitExecuteCounter): Deleted.
+        (JSC::CodeBlock::optimizationDelayCounter): Deleted.
+        (JSC::CodeBlock::osrExitCounter): Deleted.
+        (JSC::CodeBlock::countOSRExit): Deleted.
+        (JSC::CodeBlock::addressOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::offsetOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::calleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::hasDebuggerRequests): Deleted.
+        (JSC::CodeBlock::debuggerRequestsAddress): Deleted.
+        (JSC::CodeBlock::removeBreakpoint): Deleted.
+        (JSC::CodeBlock::clearDebuggerRequests): Deleted.
+        (JSC::CodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::CodeBlock::clearExceptionHandlers): Deleted.
+        (JSC::CodeBlock::appendExceptionHandler): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::replaceConstant): Deleted.
+        (JSC::CodeBlock::timeSinceCreation): Deleted.
+        (JSC::CodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::GlobalCodeBlock::GlobalCodeBlock): Deleted.
+        (JSC::ProgramCodeBlock::create): Deleted.
+        (JSC::ProgramCodeBlock::createStructure): Deleted.
+        (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
+        (JSC::ModuleProgramCodeBlock::create): Deleted.
+        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
+        (JSC::FunctionCodeBlock::create): Deleted.
+        (JSC::FunctionCodeBlock::createStructure): Deleted.
+        (JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.
+        (JSC::WebAssemblyCodeBlock::create): Deleted.
+        (JSC::WebAssemblyCodeBlock::createStructure): Deleted.
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock): Deleted.
+        (JSC::ExecState::r): Deleted.
+        (JSC::ExecState::uncheckedR): Deleted.
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
+        (JSC::ScriptExecutable::forEachCodeBlock): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * bytecode/FunctionCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/CodeBlock.cpp.
+        (JSC::WebAssemblyCodeBlock::destroy): Deleted.
+        (JSC::ProgramCodeBlock::destroy): Deleted.
+        (JSC::ModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::EvalCodeBlock::destroy): Deleted.
+        (JSC::CodeBlock::inferredName): Deleted.
+        (JSC::CodeBlock::hasHash): Deleted.
+        (JSC::CodeBlock::isSafeToComputeHash): Deleted.
+        (JSC::CodeBlock::hash): Deleted.
+        (JSC::CodeBlock::sourceCodeForTools): Deleted.
+        (JSC::CodeBlock::sourceCodeOnOneLine): Deleted.
+        (JSC::CodeBlock::hashAsStringIfPossible): Deleted.
+        (JSC::CodeBlock::dumpAssumingJITType): Deleted.
+        (JSC::CodeBlock::dump): Deleted.
+        (JSC::idName): Deleted.
+        (JSC::CodeBlock::registerName): Deleted.
+        (JSC::CodeBlock::constantName): Deleted.
+        (JSC::regexpToSourceString): Deleted.
+        (JSC::regexpName): Deleted.
+        (JSC::debugHookName): Deleted.
+        (JSC::CodeBlock::printUnaryOp): Deleted.
+        (JSC::CodeBlock::printBinaryOp): Deleted.
+        (JSC::CodeBlock::printConditionalJump): Deleted.
+        (JSC::CodeBlock::printGetByIdOp): Deleted.
+        (JSC::dumpStructure): Deleted.
+        (JSC::dumpChain): Deleted.
+        (JSC::CodeBlock::printGetByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printCallOp): Deleted.
+        (JSC::CodeBlock::printPutByIdOp): Deleted.
+        (JSC::CodeBlock::dumpSource): Deleted.
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        (JSC::CodeBlock::dumpExceptionHandlers): Deleted.
+        (JSC::CodeBlock::beginDumpProfiling): Deleted.
+        (JSC::CodeBlock::dumpValueProfiling): Deleted.
+        (JSC::CodeBlock::dumpArrayProfiling): Deleted.
+        (JSC::CodeBlock::dumpRareCaseProfile): Deleted.
+        (JSC::CodeBlock::dumpArithProfile): Deleted.
+        (JSC::CodeBlock::printLocationAndOp): Deleted.
+        (JSC::CodeBlock::printLocationOpAndRegisterOperand): Deleted.
+        (JSC::sizeInBytes): Deleted.
+        (JSC::CodeBlock::CodeBlock): Deleted.
+        (JSC::CodeBlock::finishCreation): Deleted.
+        (JSC::CodeBlock::~CodeBlock): Deleted.
+        (JSC::CodeBlock::setConstantRegisters): Deleted.
+        (JSC::CodeBlock::setAlternative): Deleted.
+        (JSC::CodeBlock::setNumParameters): Deleted.
+        (JSC::EvalCodeCache::visitAggregate): Deleted.
+        (JSC::CodeBlock::specialOSREntryBlockOrNull): Deleted.
+        (JSC::CodeBlock::visitWeakly): Deleted.
+        (JSC::CodeBlock::estimatedSize): Deleted.
+        (JSC::CodeBlock::visitChildren): Deleted.
+        (JSC::CodeBlock::shouldVisitStrongly): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference): Deleted.
+        (JSC::timeToLive): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToOldAge): Deleted.
+        (JSC::shouldMarkTransition): Deleted.
+        (JSC::CodeBlock::propagateTransitions): Deleted.
+        (JSC::CodeBlock::determineLiveness): Deleted.
+        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
+        (JSC::CodeBlock::clearLLIntGetByIdCache): Deleted.
+        (JSC::CodeBlock::finalizeLLIntInlineCaches): Deleted.
+        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
+        (JSC::CodeBlock::getStubInfoMap): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoMap): Deleted.
+        (JSC::CodeBlock::getByValInfoMap): Deleted.
+        (JSC::CodeBlock::addStubInfo): Deleted.
+        (JSC::CodeBlock::addJITAddIC): Deleted.
+        (JSC::CodeBlock::addJITMulIC): Deleted.
+        (JSC::CodeBlock::addJITSubIC): Deleted.
+        (JSC::CodeBlock::addJITNegIC): Deleted.
+        (JSC::CodeBlock::findStubInfo): Deleted.
+        (JSC::CodeBlock::addByValInfo): Deleted.
+        (JSC::CodeBlock::addCallLinkInfo): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): Deleted.
+        (JSC::CodeBlock::resetJITData): Deleted.
+        (JSC::CodeBlock::visitOSRExitTargets): Deleted.
+        (JSC::CodeBlock::stronglyVisitStrongReferences): Deleted.
+        (JSC::CodeBlock::stronglyVisitWeakReferences): Deleted.
+        (JSC::CodeBlock::baselineAlternative): Deleted.
+        (JSC::CodeBlock::baselineVersion): Deleted.
+        (JSC::CodeBlock::hasOptimizedReplacement): Deleted.
+        (JSC::CodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::handlerForIndex): Deleted.
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex): Deleted.
+        (JSC::CodeBlock::removeExceptionHandlerForCallSite): Deleted.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::columnNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::hasOpDebugForLineAndColumn): Deleted.
+        (JSC::CodeBlock::shrinkToFit): Deleted.
+        (JSC::CodeBlock::linkIncomingCall): Deleted.
+        (JSC::CodeBlock::linkIncomingPolymorphicCall): Deleted.
+        (JSC::CodeBlock::unlinkIncomingCalls): Deleted.
+        (JSC::CodeBlock::newReplacement): Deleted.
+        (JSC::CodeBlock::replacement): Deleted.
+        (JSC::CodeBlock::computeCapabilityLevel): Deleted.
+        (JSC::CodeBlock::jettison): Deleted.
+        (JSC::CodeBlock::globalObjectFor): Deleted.
+        (JSC::RecursionCheckFunctor::RecursionCheckFunctor): Deleted.
+        (JSC::RecursionCheckFunctor::operator()): Deleted.
+        (JSC::RecursionCheckFunctor::didRecurse): Deleted.
+        (JSC::CodeBlock::noticeIncomingCall): Deleted.
+        (JSC::CodeBlock::reoptimizationRetryCounter): Deleted.
+        (JSC::CodeBlock::setCalleeSaveRegisters): Deleted.
+        (JSC::roundCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::countReoptimization): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::codeTypeThresholdMultiplier): Deleted.
+        (JSC::CodeBlock::optimizationThresholdScalingFactor): Deleted.
+        (JSC::clipThreshold): Deleted.
+        (JSC::CodeBlock::adjustedCounterValue): Deleted.
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached): Deleted.
+        (JSC::CodeBlock::optimizeNextInvocation): Deleted.
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeAfterLongWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeSoon): Deleted.
+        (JSC::CodeBlock::forceOptimizationSlowPathConcurrently): Deleted.
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult): Deleted.
+        (JSC::CodeBlock::adjustedExitCountThreshold): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimization): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeNow): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow): Deleted.
+        (JSC::CodeBlock::getArrayProfile): Deleted.
+        (JSC::CodeBlock::addArrayProfile): Deleted.
+        (JSC::CodeBlock::getOrAddArrayProfile): Deleted.
+        (JSC::CodeBlock::codeOrigins): Deleted.
+        (JSC::CodeBlock::numberOfDFGIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): Deleted.
+        (JSC::CodeBlock::updateAllValueProfilePredictions): Deleted.
+        (JSC::CodeBlock::updateAllArrayPredictions): Deleted.
+        (JSC::CodeBlock::updateAllPredictions): Deleted.
+        (JSC::CodeBlock::shouldOptimizeNow): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::dumpValueProfiles): Deleted.
+        (JSC::CodeBlock::frameRegisterCount): Deleted.
+        (JSC::CodeBlock::stackPointerOffset): Deleted.
+        (JSC::CodeBlock::predictedMachineCodeSize): Deleted.
+        (JSC::CodeBlock::usesOpcode): Deleted.
+        (JSC::CodeBlock::nameForRegister): Deleted.
+        (JSC::CodeBlock::valueProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::validate): Deleted.
+        (JSC::CodeBlock::beginValidationDidFail): Deleted.
+        (JSC::CodeBlock::endValidationDidFail): Deleted.
+        (JSC::CodeBlock::addBreakpoint): Deleted.
+        (JSC::CodeBlock::setSteppingMode): Deleted.
+        (JSC::CodeBlock::addRareCaseProfile): Deleted.
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForPC): Deleted.
+        (JSC::CodeBlock::couldTakeSpecialFastCase): Deleted.
+        (JSC::CodeBlock::capabilityLevel): Deleted.
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler): Deleted.
+        (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
+        (JSC::CodeBlock::findPC): Deleted.
+        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex): Deleted.
+        (JSC::CodeBlock::thresholdForJIT): Deleted.
+        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
+        (JSC::CodeBlock::jitSoon): Deleted.
+        (JSC::CodeBlock::dumpMathICStats): Deleted.
+        (JSC::CodeBlock::livenessAnalysisSlow): Deleted.
+        * bytecode/FunctionCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/CodeBlock.h.
+        (): Deleted.
+        (JSC::CodeBlock::unlinkedCodeBlock): Deleted.
+        (JSC::CodeBlock::numParameters): Deleted.
+        (JSC::CodeBlock::numCalleeLocals): Deleted.
+        (JSC::CodeBlock::addressOfNumParameters): Deleted.
+        (JSC::CodeBlock::offsetOfNumParameters): Deleted.
+        (JSC::CodeBlock::alternative): Deleted.
+        (JSC::CodeBlock::forEachRelatedCodeBlock): Deleted.
+        (JSC::CodeBlock::specializationKind): Deleted.
+        (JSC::CodeBlock::isStrictMode): Deleted.
+        (JSC::CodeBlock::ecmaMode): Deleted.
+        (JSC::CodeBlock::isKnownNotImmediate): Deleted.
+        (JSC::CodeBlock::isTemporaryRegisterIndex): Deleted.
+        (JSC::CodeBlock::stubInfoBegin): Deleted.
+        (JSC::CodeBlock::stubInfoEnd): Deleted.
+        (JSC::CodeBlock::callLinkInfosBegin): Deleted.
+        (JSC::CodeBlock::callLinkInfosEnd): Deleted.
+        (JSC::CodeBlock::setJITCodeMap): Deleted.
+        (JSC::CodeBlock::jitCodeMap): Deleted.
+        (JSC::CodeBlock::bytecodeOffset): Deleted.
+        (JSC::CodeBlock::numberOfInstructions): Deleted.
+        (JSC::CodeBlock::instructions): Deleted.
+        (JSC::CodeBlock::instructionCount): Deleted.
+        (JSC::CodeBlock::setJITCode): Deleted.
+        (JSC::CodeBlock::jitCode): Deleted.
+        (JSC::CodeBlock::jitCodeOffset): Deleted.
+        (JSC::CodeBlock::jitType): Deleted.
+        (JSC::CodeBlock::hasBaselineJITProfiling): Deleted.
+        (JSC::CodeBlock::capabilityLevelState): Deleted.
+        (JSC::CodeBlock::ownerExecutable): Deleted.
+        (JSC::CodeBlock::ownerScriptExecutable): Deleted.
+        (JSC::CodeBlock::vm): Deleted.
+        (JSC::CodeBlock::setThisRegister): Deleted.
+        (JSC::CodeBlock::thisRegister): Deleted.
+        (JSC::CodeBlock::usesEval): Deleted.
+        (JSC::CodeBlock::setScopeRegister): Deleted.
+        (JSC::CodeBlock::scopeRegister): Deleted.
+        (JSC::CodeBlock::codeType): Deleted.
+        (JSC::CodeBlock::putByIdContext): Deleted.
+        (JSC::CodeBlock::source): Deleted.
+        (JSC::CodeBlock::sourceOffset): Deleted.
+        (JSC::CodeBlock::firstLineColumnOffset): Deleted.
+        (JSC::CodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::CodeBlock::jumpTarget): Deleted.
+        (JSC::CodeBlock::numberOfArgumentValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfileForArgument): Deleted.
+        (JSC::CodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfile): Deleted.
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::totalNumberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::getFromAllValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfRareCaseProfiles): Deleted.
+        (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
+        (JSC::CodeBlock::couldTakeSlowCase): Deleted.
+        (JSC::CodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::CodeBlock::arrayProfiles): Deleted.
+        (JSC::CodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::CodeBlock::exceptionHandler): Deleted.
+        (JSC::CodeBlock::hasExpressionInfo): Deleted.
+        (JSC::CodeBlock::hasCodeOrigins): Deleted.
+        (JSC::CodeBlock::canGetCodeOrigin): Deleted.
+        (JSC::CodeBlock::codeOrigin): Deleted.
+        (JSC::CodeBlock::addFrequentExitSite): Deleted.
+        (JSC::CodeBlock::hasExitSite): Deleted.
+        (JSC::CodeBlock::exitProfile): Deleted.
+        (JSC::CodeBlock::lazyOperandValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::constants): Deleted.
+        (JSC::CodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::addConstant): Deleted.
+        (JSC::CodeBlock::addConstantLazily): Deleted.
+        (JSC::CodeBlock::constantRegister): Deleted.
+        (JSC::CodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::CodeBlock::getConstant): Deleted.
+        (JSC::CodeBlock::constantSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::functionDecl): Deleted.
+        (JSC::CodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::CodeBlock::functionExpr): Deleted.
+        (JSC::CodeBlock::regexp): Deleted.
+        (JSC::CodeBlock::numberOfConstantBuffers): Deleted.
+        (JSC::CodeBlock::addConstantBuffer): Deleted.
+        (JSC::CodeBlock::constantBufferAsVector): Deleted.
+        (JSC::CodeBlock::constantBuffer): Deleted.
+        (JSC::CodeBlock::heap): Deleted.
+        (JSC::CodeBlock::globalObject): Deleted.
+        (JSC::CodeBlock::livenessAnalysis): Deleted.
+        (JSC::CodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::switchJumpTable): Deleted.
+        (JSC::CodeBlock::clearSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::evalCodeCache): Deleted.
+        (JSC::CodeBlock::checkIfJITThresholdReached): Deleted.
+        (JSC::CodeBlock::dontJITAnytimeSoon): Deleted.
+        (JSC::CodeBlock::llintExecuteCounter): Deleted.
+        (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
+        (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount): Deleted.
+        (JSC::CodeBlock::jitExecuteCounter): Deleted.
+        (JSC::CodeBlock::optimizationDelayCounter): Deleted.
+        (JSC::CodeBlock::osrExitCounter): Deleted.
+        (JSC::CodeBlock::countOSRExit): Deleted.
+        (JSC::CodeBlock::addressOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::offsetOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::calleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::hasDebuggerRequests): Deleted.
+        (JSC::CodeBlock::debuggerRequestsAddress): Deleted.
+        (JSC::CodeBlock::removeBreakpoint): Deleted.
+        (JSC::CodeBlock::clearDebuggerRequests): Deleted.
+        (JSC::CodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::CodeBlock::clearExceptionHandlers): Deleted.
+        (JSC::CodeBlock::appendExceptionHandler): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::replaceConstant): Deleted.
+        (JSC::CodeBlock::timeSinceCreation): Deleted.
+        (JSC::CodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::GlobalCodeBlock::GlobalCodeBlock): Deleted.
+        (JSC::ProgramCodeBlock::create): Deleted.
+        (JSC::ProgramCodeBlock::createStructure): Deleted.
+        (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
+        (JSC::ModuleProgramCodeBlock::create): Deleted.
+        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::create): Deleted.
+        (JSC::EvalCodeBlock::createStructure): Deleted.
+        (JSC::EvalCodeBlock::variable): Deleted.
+        (JSC::EvalCodeBlock::numVariables): Deleted.
+        (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock): Deleted.
+        (JSC::WebAssemblyCodeBlock::create): Deleted.
+        (JSC::WebAssemblyCodeBlock::createStructure): Deleted.
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock): Deleted.
+        (JSC::ExecState::r): Deleted.
+        (JSC::ExecState::uncheckedR): Deleted.
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
+        (JSC::ScriptExecutable::forEachCodeBlock): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * bytecode/GlobalCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/CodeBlock.h.
+        (): Deleted.
+        (JSC::CodeBlock::unlinkedCodeBlock): Deleted.
+        (JSC::CodeBlock::numParameters): Deleted.
+        (JSC::CodeBlock::numCalleeLocals): Deleted.
+        (JSC::CodeBlock::addressOfNumParameters): Deleted.
+        (JSC::CodeBlock::offsetOfNumParameters): Deleted.
+        (JSC::CodeBlock::alternative): Deleted.
+        (JSC::CodeBlock::forEachRelatedCodeBlock): Deleted.
+        (JSC::CodeBlock::specializationKind): Deleted.
+        (JSC::CodeBlock::isStrictMode): Deleted.
+        (JSC::CodeBlock::ecmaMode): Deleted.
+        (JSC::CodeBlock::isKnownNotImmediate): Deleted.
+        (JSC::CodeBlock::isTemporaryRegisterIndex): Deleted.
+        (JSC::CodeBlock::stubInfoBegin): Deleted.
+        (JSC::CodeBlock::stubInfoEnd): Deleted.
+        (JSC::CodeBlock::callLinkInfosBegin): Deleted.
+        (JSC::CodeBlock::callLinkInfosEnd): Deleted.
+        (JSC::CodeBlock::setJITCodeMap): Deleted.
+        (JSC::CodeBlock::jitCodeMap): Deleted.
+        (JSC::CodeBlock::bytecodeOffset): Deleted.
+        (JSC::CodeBlock::numberOfInstructions): Deleted.
+        (JSC::CodeBlock::instructions): Deleted.
+        (JSC::CodeBlock::instructionCount): Deleted.
+        (JSC::CodeBlock::setJITCode): Deleted.
+        (JSC::CodeBlock::jitCode): Deleted.
+        (JSC::CodeBlock::jitCodeOffset): Deleted.
+        (JSC::CodeBlock::jitType): Deleted.
+        (JSC::CodeBlock::hasBaselineJITProfiling): Deleted.
+        (JSC::CodeBlock::capabilityLevelState): Deleted.
+        (JSC::CodeBlock::ownerExecutable): Deleted.
+        (JSC::CodeBlock::ownerScriptExecutable): Deleted.
+        (JSC::CodeBlock::vm): Deleted.
+        (JSC::CodeBlock::setThisRegister): Deleted.
+        (JSC::CodeBlock::thisRegister): Deleted.
+        (JSC::CodeBlock::usesEval): Deleted.
+        (JSC::CodeBlock::setScopeRegister): Deleted.
+        (JSC::CodeBlock::scopeRegister): Deleted.
+        (JSC::CodeBlock::codeType): Deleted.
+        (JSC::CodeBlock::putByIdContext): Deleted.
+        (JSC::CodeBlock::source): Deleted.
+        (JSC::CodeBlock::sourceOffset): Deleted.
+        (JSC::CodeBlock::firstLineColumnOffset): Deleted.
+        (JSC::CodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::CodeBlock::jumpTarget): Deleted.
+        (JSC::CodeBlock::numberOfArgumentValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfileForArgument): Deleted.
+        (JSC::CodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfile): Deleted.
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::totalNumberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::getFromAllValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfRareCaseProfiles): Deleted.
+        (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
+        (JSC::CodeBlock::couldTakeSlowCase): Deleted.
+        (JSC::CodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::CodeBlock::arrayProfiles): Deleted.
+        (JSC::CodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::CodeBlock::exceptionHandler): Deleted.
+        (JSC::CodeBlock::hasExpressionInfo): Deleted.
+        (JSC::CodeBlock::hasCodeOrigins): Deleted.
+        (JSC::CodeBlock::canGetCodeOrigin): Deleted.
+        (JSC::CodeBlock::codeOrigin): Deleted.
+        (JSC::CodeBlock::addFrequentExitSite): Deleted.
+        (JSC::CodeBlock::hasExitSite): Deleted.
+        (JSC::CodeBlock::exitProfile): Deleted.
+        (JSC::CodeBlock::lazyOperandValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::constants): Deleted.
+        (JSC::CodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::addConstant): Deleted.
+        (JSC::CodeBlock::addConstantLazily): Deleted.
+        (JSC::CodeBlock::constantRegister): Deleted.
+        (JSC::CodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::CodeBlock::getConstant): Deleted.
+        (JSC::CodeBlock::constantSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::functionDecl): Deleted.
+        (JSC::CodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::CodeBlock::functionExpr): Deleted.
+        (JSC::CodeBlock::regexp): Deleted.
+        (JSC::CodeBlock::numberOfConstantBuffers): Deleted.
+        (JSC::CodeBlock::addConstantBuffer): Deleted.
+        (JSC::CodeBlock::constantBufferAsVector): Deleted.
+        (JSC::CodeBlock::constantBuffer): Deleted.
+        (JSC::CodeBlock::heap): Deleted.
+        (JSC::CodeBlock::globalObject): Deleted.
+        (JSC::CodeBlock::livenessAnalysis): Deleted.
+        (JSC::CodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::switchJumpTable): Deleted.
+        (JSC::CodeBlock::clearSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::evalCodeCache): Deleted.
+        (JSC::CodeBlock::checkIfJITThresholdReached): Deleted.
+        (JSC::CodeBlock::dontJITAnytimeSoon): Deleted.
+        (JSC::CodeBlock::llintExecuteCounter): Deleted.
+        (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
+        (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount): Deleted.
+        (JSC::CodeBlock::jitExecuteCounter): Deleted.
+        (JSC::CodeBlock::optimizationDelayCounter): Deleted.
+        (JSC::CodeBlock::osrExitCounter): Deleted.
+        (JSC::CodeBlock::countOSRExit): Deleted.
+        (JSC::CodeBlock::addressOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::offsetOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::calleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::hasDebuggerRequests): Deleted.
+        (JSC::CodeBlock::debuggerRequestsAddress): Deleted.
+        (JSC::CodeBlock::removeBreakpoint): Deleted.
+        (JSC::CodeBlock::clearDebuggerRequests): Deleted.
+        (JSC::CodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::CodeBlock::clearExceptionHandlers): Deleted.
+        (JSC::CodeBlock::appendExceptionHandler): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::replaceConstant): Deleted.
+        (JSC::CodeBlock::timeSinceCreation): Deleted.
+        (JSC::CodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::ProgramCodeBlock::create): Deleted.
+        (JSC::ProgramCodeBlock::createStructure): Deleted.
+        (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
+        (JSC::ModuleProgramCodeBlock::create): Deleted.
+        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::create): Deleted.
+        (JSC::EvalCodeBlock::createStructure): Deleted.
+        (JSC::EvalCodeBlock::variable): Deleted.
+        (JSC::EvalCodeBlock::numVariables): Deleted.
+        (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock): Deleted.
+        (JSC::FunctionCodeBlock::create): Deleted.
+        (JSC::FunctionCodeBlock::createStructure): Deleted.
+        (JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.
+        (JSC::WebAssemblyCodeBlock::create): Deleted.
+        (JSC::WebAssemblyCodeBlock::createStructure): Deleted.
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock): Deleted.
+        (JSC::ExecState::r): Deleted.
+        (JSC::ExecState::uncheckedR): Deleted.
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
+        (JSC::ScriptExecutable::forEachCodeBlock): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * bytecode/ModuleProgramCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/CodeBlock.cpp.
+        (JSC::FunctionCodeBlock::destroy): Deleted.
+        (JSC::WebAssemblyCodeBlock::destroy): Deleted.
+        (JSC::ProgramCodeBlock::destroy): Deleted.
+        (JSC::EvalCodeBlock::destroy): Deleted.
+        (JSC::CodeBlock::inferredName): Deleted.
+        (JSC::CodeBlock::hasHash): Deleted.
+        (JSC::CodeBlock::isSafeToComputeHash): Deleted.
+        (JSC::CodeBlock::hash): Deleted.
+        (JSC::CodeBlock::sourceCodeForTools): Deleted.
+        (JSC::CodeBlock::sourceCodeOnOneLine): Deleted.
+        (JSC::CodeBlock::hashAsStringIfPossible): Deleted.
+        (JSC::CodeBlock::dumpAssumingJITType): Deleted.
+        (JSC::CodeBlock::dump): Deleted.
+        (JSC::idName): Deleted.
+        (JSC::CodeBlock::registerName): Deleted.
+        (JSC::CodeBlock::constantName): Deleted.
+        (JSC::regexpToSourceString): Deleted.
+        (JSC::regexpName): Deleted.
+        (JSC::debugHookName): Deleted.
+        (JSC::CodeBlock::printUnaryOp): Deleted.
+        (JSC::CodeBlock::printBinaryOp): Deleted.
+        (JSC::CodeBlock::printConditionalJump): Deleted.
+        (JSC::CodeBlock::printGetByIdOp): Deleted.
+        (JSC::dumpStructure): Deleted.
+        (JSC::dumpChain): Deleted.
+        (JSC::CodeBlock::printGetByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printCallOp): Deleted.
+        (JSC::CodeBlock::printPutByIdOp): Deleted.
+        (JSC::CodeBlock::dumpSource): Deleted.
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        (JSC::CodeBlock::dumpExceptionHandlers): Deleted.
+        (JSC::CodeBlock::beginDumpProfiling): Deleted.
+        (JSC::CodeBlock::dumpValueProfiling): Deleted.
+        (JSC::CodeBlock::dumpArrayProfiling): Deleted.
+        (JSC::CodeBlock::dumpRareCaseProfile): Deleted.
+        (JSC::CodeBlock::dumpArithProfile): Deleted.
+        (JSC::CodeBlock::printLocationAndOp): Deleted.
+        (JSC::CodeBlock::printLocationOpAndRegisterOperand): Deleted.
+        (JSC::sizeInBytes): Deleted.
+        (JSC::CodeBlock::CodeBlock): Deleted.
+        (JSC::CodeBlock::finishCreation): Deleted.
+        (JSC::CodeBlock::~CodeBlock): Deleted.
+        (JSC::CodeBlock::setConstantRegisters): Deleted.
+        (JSC::CodeBlock::setAlternative): Deleted.
+        (JSC::CodeBlock::setNumParameters): Deleted.
+        (JSC::EvalCodeCache::visitAggregate): Deleted.
+        (JSC::CodeBlock::specialOSREntryBlockOrNull): Deleted.
+        (JSC::CodeBlock::visitWeakly): Deleted.
+        (JSC::CodeBlock::estimatedSize): Deleted.
+        (JSC::CodeBlock::visitChildren): Deleted.
+        (JSC::CodeBlock::shouldVisitStrongly): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference): Deleted.
+        (JSC::timeToLive): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToOldAge): Deleted.
+        (JSC::shouldMarkTransition): Deleted.
+        (JSC::CodeBlock::propagateTransitions): Deleted.
+        (JSC::CodeBlock::determineLiveness): Deleted.
+        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
+        (JSC::CodeBlock::clearLLIntGetByIdCache): Deleted.
+        (JSC::CodeBlock::finalizeLLIntInlineCaches): Deleted.
+        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
+        (JSC::CodeBlock::getStubInfoMap): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoMap): Deleted.
+        (JSC::CodeBlock::getByValInfoMap): Deleted.
+        (JSC::CodeBlock::addStubInfo): Deleted.
+        (JSC::CodeBlock::addJITAddIC): Deleted.
+        (JSC::CodeBlock::addJITMulIC): Deleted.
+        (JSC::CodeBlock::addJITSubIC): Deleted.
+        (JSC::CodeBlock::addJITNegIC): Deleted.
+        (JSC::CodeBlock::findStubInfo): Deleted.
+        (JSC::CodeBlock::addByValInfo): Deleted.
+        (JSC::CodeBlock::addCallLinkInfo): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): Deleted.
+        (JSC::CodeBlock::resetJITData): Deleted.
+        (JSC::CodeBlock::visitOSRExitTargets): Deleted.
+        (JSC::CodeBlock::stronglyVisitStrongReferences): Deleted.
+        (JSC::CodeBlock::stronglyVisitWeakReferences): Deleted.
+        (JSC::CodeBlock::baselineAlternative): Deleted.
+        (JSC::CodeBlock::baselineVersion): Deleted.
+        (JSC::CodeBlock::hasOptimizedReplacement): Deleted.
+        (JSC::CodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::handlerForIndex): Deleted.
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex): Deleted.
+        (JSC::CodeBlock::removeExceptionHandlerForCallSite): Deleted.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::columnNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::hasOpDebugForLineAndColumn): Deleted.
+        (JSC::CodeBlock::shrinkToFit): Deleted.
+        (JSC::CodeBlock::linkIncomingCall): Deleted.
+        (JSC::CodeBlock::linkIncomingPolymorphicCall): Deleted.
+        (JSC::CodeBlock::unlinkIncomingCalls): Deleted.
+        (JSC::CodeBlock::newReplacement): Deleted.
+        (JSC::CodeBlock::replacement): Deleted.
+        (JSC::CodeBlock::computeCapabilityLevel): Deleted.
+        (JSC::CodeBlock::jettison): Deleted.
+        (JSC::CodeBlock::globalObjectFor): Deleted.
+        (JSC::RecursionCheckFunctor::RecursionCheckFunctor): Deleted.
+        (JSC::RecursionCheckFunctor::operator()): Deleted.
+        (JSC::RecursionCheckFunctor::didRecurse): Deleted.
+        (JSC::CodeBlock::noticeIncomingCall): Deleted.
+        (JSC::CodeBlock::reoptimizationRetryCounter): Deleted.
+        (JSC::CodeBlock::setCalleeSaveRegisters): Deleted.
+        (JSC::roundCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::countReoptimization): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::codeTypeThresholdMultiplier): Deleted.
+        (JSC::CodeBlock::optimizationThresholdScalingFactor): Deleted.
+        (JSC::clipThreshold): Deleted.
+        (JSC::CodeBlock::adjustedCounterValue): Deleted.
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached): Deleted.
+        (JSC::CodeBlock::optimizeNextInvocation): Deleted.
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeAfterLongWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeSoon): Deleted.
+        (JSC::CodeBlock::forceOptimizationSlowPathConcurrently): Deleted.
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult): Deleted.
+        (JSC::CodeBlock::adjustedExitCountThreshold): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimization): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeNow): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow): Deleted.
+        (JSC::CodeBlock::getArrayProfile): Deleted.
+        (JSC::CodeBlock::addArrayProfile): Deleted.
+        (JSC::CodeBlock::getOrAddArrayProfile): Deleted.
+        (JSC::CodeBlock::codeOrigins): Deleted.
+        (JSC::CodeBlock::numberOfDFGIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): Deleted.
+        (JSC::CodeBlock::updateAllValueProfilePredictions): Deleted.
+        (JSC::CodeBlock::updateAllArrayPredictions): Deleted.
+        (JSC::CodeBlock::updateAllPredictions): Deleted.
+        (JSC::CodeBlock::shouldOptimizeNow): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::dumpValueProfiles): Deleted.
+        (JSC::CodeBlock::frameRegisterCount): Deleted.
+        (JSC::CodeBlock::stackPointerOffset): Deleted.
+        (JSC::CodeBlock::predictedMachineCodeSize): Deleted.
+        (JSC::CodeBlock::usesOpcode): Deleted.
+        (JSC::CodeBlock::nameForRegister): Deleted.
+        (JSC::CodeBlock::valueProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::validate): Deleted.
+        (JSC::CodeBlock::beginValidationDidFail): Deleted.
+        (JSC::CodeBlock::endValidationDidFail): Deleted.
+        (JSC::CodeBlock::addBreakpoint): Deleted.
+        (JSC::CodeBlock::setSteppingMode): Deleted.
+        (JSC::CodeBlock::addRareCaseProfile): Deleted.
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForPC): Deleted.
+        (JSC::CodeBlock::couldTakeSpecialFastCase): Deleted.
+        (JSC::CodeBlock::capabilityLevel): Deleted.
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler): Deleted.
+        (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
+        (JSC::CodeBlock::findPC): Deleted.
+        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex): Deleted.
+        (JSC::CodeBlock::thresholdForJIT): Deleted.
+        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
+        (JSC::CodeBlock::jitSoon): Deleted.
+        (JSC::CodeBlock::dumpMathICStats): Deleted.
+        (JSC::CodeBlock::livenessAnalysisSlow): Deleted.
+        * bytecode/ModuleProgramCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/CodeBlock.h.
+        (): Deleted.
+        (JSC::CodeBlock::unlinkedCodeBlock): Deleted.
+        (JSC::CodeBlock::numParameters): Deleted.
+        (JSC::CodeBlock::numCalleeLocals): Deleted.
+        (JSC::CodeBlock::addressOfNumParameters): Deleted.
+        (JSC::CodeBlock::offsetOfNumParameters): Deleted.
+        (JSC::CodeBlock::alternative): Deleted.
+        (JSC::CodeBlock::forEachRelatedCodeBlock): Deleted.
+        (JSC::CodeBlock::specializationKind): Deleted.
+        (JSC::CodeBlock::isStrictMode): Deleted.
+        (JSC::CodeBlock::ecmaMode): Deleted.
+        (JSC::CodeBlock::isKnownNotImmediate): Deleted.
+        (JSC::CodeBlock::isTemporaryRegisterIndex): Deleted.
+        (JSC::CodeBlock::stubInfoBegin): Deleted.
+        (JSC::CodeBlock::stubInfoEnd): Deleted.
+        (JSC::CodeBlock::callLinkInfosBegin): Deleted.
+        (JSC::CodeBlock::callLinkInfosEnd): Deleted.
+        (JSC::CodeBlock::setJITCodeMap): Deleted.
+        (JSC::CodeBlock::jitCodeMap): Deleted.
+        (JSC::CodeBlock::bytecodeOffset): Deleted.
+        (JSC::CodeBlock::numberOfInstructions): Deleted.
+        (JSC::CodeBlock::instructions): Deleted.
+        (JSC::CodeBlock::instructionCount): Deleted.
+        (JSC::CodeBlock::setJITCode): Deleted.
+        (JSC::CodeBlock::jitCode): Deleted.
+        (JSC::CodeBlock::jitCodeOffset): Deleted.
+        (JSC::CodeBlock::jitType): Deleted.
+        (JSC::CodeBlock::hasBaselineJITProfiling): Deleted.
+        (JSC::CodeBlock::capabilityLevelState): Deleted.
+        (JSC::CodeBlock::ownerExecutable): Deleted.
+        (JSC::CodeBlock::ownerScriptExecutable): Deleted.
+        (JSC::CodeBlock::vm): Deleted.
+        (JSC::CodeBlock::setThisRegister): Deleted.
+        (JSC::CodeBlock::thisRegister): Deleted.
+        (JSC::CodeBlock::usesEval): Deleted.
+        (JSC::CodeBlock::setScopeRegister): Deleted.
+        (JSC::CodeBlock::scopeRegister): Deleted.
+        (JSC::CodeBlock::codeType): Deleted.
+        (JSC::CodeBlock::putByIdContext): Deleted.
+        (JSC::CodeBlock::source): Deleted.
+        (JSC::CodeBlock::sourceOffset): Deleted.
+        (JSC::CodeBlock::firstLineColumnOffset): Deleted.
+        (JSC::CodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::CodeBlock::jumpTarget): Deleted.
+        (JSC::CodeBlock::numberOfArgumentValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfileForArgument): Deleted.
+        (JSC::CodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfile): Deleted.
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::totalNumberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::getFromAllValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfRareCaseProfiles): Deleted.
+        (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
+        (JSC::CodeBlock::couldTakeSlowCase): Deleted.
+        (JSC::CodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::CodeBlock::arrayProfiles): Deleted.
+        (JSC::CodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::CodeBlock::exceptionHandler): Deleted.
+        (JSC::CodeBlock::hasExpressionInfo): Deleted.
+        (JSC::CodeBlock::hasCodeOrigins): Deleted.
+        (JSC::CodeBlock::canGetCodeOrigin): Deleted.
+        (JSC::CodeBlock::codeOrigin): Deleted.
+        (JSC::CodeBlock::addFrequentExitSite): Deleted.
+        (JSC::CodeBlock::hasExitSite): Deleted.
+        (JSC::CodeBlock::exitProfile): Deleted.
+        (JSC::CodeBlock::lazyOperandValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::constants): Deleted.
+        (JSC::CodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::addConstant): Deleted.
+        (JSC::CodeBlock::addConstantLazily): Deleted.
+        (JSC::CodeBlock::constantRegister): Deleted.
+        (JSC::CodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::CodeBlock::getConstant): Deleted.
+        (JSC::CodeBlock::constantSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::functionDecl): Deleted.
+        (JSC::CodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::CodeBlock::functionExpr): Deleted.
+        (JSC::CodeBlock::regexp): Deleted.
+        (JSC::CodeBlock::numberOfConstantBuffers): Deleted.
+        (JSC::CodeBlock::addConstantBuffer): Deleted.
+        (JSC::CodeBlock::constantBufferAsVector): Deleted.
+        (JSC::CodeBlock::constantBuffer): Deleted.
+        (JSC::CodeBlock::heap): Deleted.
+        (JSC::CodeBlock::globalObject): Deleted.
+        (JSC::CodeBlock::livenessAnalysis): Deleted.
+        (JSC::CodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::switchJumpTable): Deleted.
+        (JSC::CodeBlock::clearSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::evalCodeCache): Deleted.
+        (JSC::CodeBlock::checkIfJITThresholdReached): Deleted.
+        (JSC::CodeBlock::dontJITAnytimeSoon): Deleted.
+        (JSC::CodeBlock::llintExecuteCounter): Deleted.
+        (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
+        (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount): Deleted.
+        (JSC::CodeBlock::jitExecuteCounter): Deleted.
+        (JSC::CodeBlock::optimizationDelayCounter): Deleted.
+        (JSC::CodeBlock::osrExitCounter): Deleted.
+        (JSC::CodeBlock::countOSRExit): Deleted.
+        (JSC::CodeBlock::addressOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::offsetOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::calleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::hasDebuggerRequests): Deleted.
+        (JSC::CodeBlock::debuggerRequestsAddress): Deleted.
+        (JSC::CodeBlock::removeBreakpoint): Deleted.
+        (JSC::CodeBlock::clearDebuggerRequests): Deleted.
+        (JSC::CodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::CodeBlock::clearExceptionHandlers): Deleted.
+        (JSC::CodeBlock::appendExceptionHandler): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::replaceConstant): Deleted.
+        (JSC::CodeBlock::timeSinceCreation): Deleted.
+        (JSC::CodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::GlobalCodeBlock::GlobalCodeBlock): Deleted.
+        (JSC::ProgramCodeBlock::create): Deleted.
+        (JSC::ProgramCodeBlock::createStructure): Deleted.
+        (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::create): Deleted.
+        (JSC::EvalCodeBlock::createStructure): Deleted.
+        (JSC::EvalCodeBlock::variable): Deleted.
+        (JSC::EvalCodeBlock::numVariables): Deleted.
+        (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock): Deleted.
+        (JSC::FunctionCodeBlock::create): Deleted.
+        (JSC::FunctionCodeBlock::createStructure): Deleted.
+        (JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.
+        (JSC::WebAssemblyCodeBlock::create): Deleted.
+        (JSC::WebAssemblyCodeBlock::createStructure): Deleted.
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock): Deleted.
+        (JSC::ExecState::r): Deleted.
+        (JSC::ExecState::uncheckedR): Deleted.
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
+        (JSC::ScriptExecutable::forEachCodeBlock): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * bytecode/ProgramCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/CodeBlock.cpp.
+        (JSC::FunctionCodeBlock::destroy): Deleted.
+        (JSC::WebAssemblyCodeBlock::destroy): Deleted.
+        (JSC::ModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::EvalCodeBlock::destroy): Deleted.
+        (JSC::CodeBlock::inferredName): Deleted.
+        (JSC::CodeBlock::hasHash): Deleted.
+        (JSC::CodeBlock::isSafeToComputeHash): Deleted.
+        (JSC::CodeBlock::hash): Deleted.
+        (JSC::CodeBlock::sourceCodeForTools): Deleted.
+        (JSC::CodeBlock::sourceCodeOnOneLine): Deleted.
+        (JSC::CodeBlock::hashAsStringIfPossible): Deleted.
+        (JSC::CodeBlock::dumpAssumingJITType): Deleted.
+        (JSC::CodeBlock::dump): Deleted.
+        (JSC::idName): Deleted.
+        (JSC::CodeBlock::registerName): Deleted.
+        (JSC::CodeBlock::constantName): Deleted.
+        (JSC::regexpToSourceString): Deleted.
+        (JSC::regexpName): Deleted.
+        (JSC::debugHookName): Deleted.
+        (JSC::CodeBlock::printUnaryOp): Deleted.
+        (JSC::CodeBlock::printBinaryOp): Deleted.
+        (JSC::CodeBlock::printConditionalJump): Deleted.
+        (JSC::CodeBlock::printGetByIdOp): Deleted.
+        (JSC::dumpStructure): Deleted.
+        (JSC::dumpChain): Deleted.
+        (JSC::CodeBlock::printGetByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printCallOp): Deleted.
+        (JSC::CodeBlock::printPutByIdOp): Deleted.
+        (JSC::CodeBlock::dumpSource): Deleted.
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        (JSC::CodeBlock::dumpExceptionHandlers): Deleted.
+        (JSC::CodeBlock::beginDumpProfiling): Deleted.
+        (JSC::CodeBlock::dumpValueProfiling): Deleted.
+        (JSC::CodeBlock::dumpArrayProfiling): Deleted.
+        (JSC::CodeBlock::dumpRareCaseProfile): Deleted.
+        (JSC::CodeBlock::dumpArithProfile): Deleted.
+        (JSC::CodeBlock::printLocationAndOp): Deleted.
+        (JSC::CodeBlock::printLocationOpAndRegisterOperand): Deleted.
+        (JSC::sizeInBytes): Deleted.
+        (JSC::CodeBlock::CodeBlock): Deleted.
+        (JSC::CodeBlock::finishCreation): Deleted.
+        (JSC::CodeBlock::~CodeBlock): Deleted.
+        (JSC::CodeBlock::setConstantRegisters): Deleted.
+        (JSC::CodeBlock::setAlternative): Deleted.
+        (JSC::CodeBlock::setNumParameters): Deleted.
+        (JSC::EvalCodeCache::visitAggregate): Deleted.
+        (JSC::CodeBlock::specialOSREntryBlockOrNull): Deleted.
+        (JSC::CodeBlock::visitWeakly): Deleted.
+        (JSC::CodeBlock::estimatedSize): Deleted.
+        (JSC::CodeBlock::visitChildren): Deleted.
+        (JSC::CodeBlock::shouldVisitStrongly): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference): Deleted.
+        (JSC::timeToLive): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToOldAge): Deleted.
+        (JSC::shouldMarkTransition): Deleted.
+        (JSC::CodeBlock::propagateTransitions): Deleted.
+        (JSC::CodeBlock::determineLiveness): Deleted.
+        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
+        (JSC::CodeBlock::clearLLIntGetByIdCache): Deleted.
+        (JSC::CodeBlock::finalizeLLIntInlineCaches): Deleted.
+        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
+        (JSC::CodeBlock::getStubInfoMap): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoMap): Deleted.
+        (JSC::CodeBlock::getByValInfoMap): Deleted.
+        (JSC::CodeBlock::addStubInfo): Deleted.
+        (JSC::CodeBlock::addJITAddIC): Deleted.
+        (JSC::CodeBlock::addJITMulIC): Deleted.
+        (JSC::CodeBlock::addJITSubIC): Deleted.
+        (JSC::CodeBlock::addJITNegIC): Deleted.
+        (JSC::CodeBlock::findStubInfo): Deleted.
+        (JSC::CodeBlock::addByValInfo): Deleted.
+        (JSC::CodeBlock::addCallLinkInfo): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): Deleted.
+        (JSC::CodeBlock::resetJITData): Deleted.
+        (JSC::CodeBlock::visitOSRExitTargets): Deleted.
+        (JSC::CodeBlock::stronglyVisitStrongReferences): Deleted.
+        (JSC::CodeBlock::stronglyVisitWeakReferences): Deleted.
+        (JSC::CodeBlock::baselineAlternative): Deleted.
+        (JSC::CodeBlock::baselineVersion): Deleted.
+        (JSC::CodeBlock::hasOptimizedReplacement): Deleted.
+        (JSC::CodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::handlerForIndex): Deleted.
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex): Deleted.
+        (JSC::CodeBlock::removeExceptionHandlerForCallSite): Deleted.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::columnNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::hasOpDebugForLineAndColumn): Deleted.
+        (JSC::CodeBlock::shrinkToFit): Deleted.
+        (JSC::CodeBlock::linkIncomingCall): Deleted.
+        (JSC::CodeBlock::linkIncomingPolymorphicCall): Deleted.
+        (JSC::CodeBlock::unlinkIncomingCalls): Deleted.
+        (JSC::CodeBlock::newReplacement): Deleted.
+        (JSC::CodeBlock::replacement): Deleted.
+        (JSC::CodeBlock::computeCapabilityLevel): Deleted.
+        (JSC::CodeBlock::jettison): Deleted.
+        (JSC::CodeBlock::globalObjectFor): Deleted.
+        (JSC::RecursionCheckFunctor::RecursionCheckFunctor): Deleted.
+        (JSC::RecursionCheckFunctor::operator()): Deleted.
+        (JSC::RecursionCheckFunctor::didRecurse): Deleted.
+        (JSC::CodeBlock::noticeIncomingCall): Deleted.
+        (JSC::CodeBlock::reoptimizationRetryCounter): Deleted.
+        (JSC::CodeBlock::setCalleeSaveRegisters): Deleted.
+        (JSC::roundCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::countReoptimization): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::codeTypeThresholdMultiplier): Deleted.
+        (JSC::CodeBlock::optimizationThresholdScalingFactor): Deleted.
+        (JSC::clipThreshold): Deleted.
+        (JSC::CodeBlock::adjustedCounterValue): Deleted.
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached): Deleted.
+        (JSC::CodeBlock::optimizeNextInvocation): Deleted.
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeAfterLongWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeSoon): Deleted.
+        (JSC::CodeBlock::forceOptimizationSlowPathConcurrently): Deleted.
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult): Deleted.
+        (JSC::CodeBlock::adjustedExitCountThreshold): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimization): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeNow): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow): Deleted.
+        (JSC::CodeBlock::getArrayProfile): Deleted.
+        (JSC::CodeBlock::addArrayProfile): Deleted.
+        (JSC::CodeBlock::getOrAddArrayProfile): Deleted.
+        (JSC::CodeBlock::codeOrigins): Deleted.
+        (JSC::CodeBlock::numberOfDFGIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): Deleted.
+        (JSC::CodeBlock::updateAllValueProfilePredictions): Deleted.
+        (JSC::CodeBlock::updateAllArrayPredictions): Deleted.
+        (JSC::CodeBlock::updateAllPredictions): Deleted.
+        (JSC::CodeBlock::shouldOptimizeNow): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::dumpValueProfiles): Deleted.
+        (JSC::CodeBlock::frameRegisterCount): Deleted.
+        (JSC::CodeBlock::stackPointerOffset): Deleted.
+        (JSC::CodeBlock::predictedMachineCodeSize): Deleted.
+        (JSC::CodeBlock::usesOpcode): Deleted.
+        (JSC::CodeBlock::nameForRegister): Deleted.
+        (JSC::CodeBlock::valueProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::validate): Deleted.
+        (JSC::CodeBlock::beginValidationDidFail): Deleted.
+        (JSC::CodeBlock::endValidationDidFail): Deleted.
+        (JSC::CodeBlock::addBreakpoint): Deleted.
+        (JSC::CodeBlock::setSteppingMode): Deleted.
+        (JSC::CodeBlock::addRareCaseProfile): Deleted.
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForPC): Deleted.
+        (JSC::CodeBlock::couldTakeSpecialFastCase): Deleted.
+        (JSC::CodeBlock::capabilityLevel): Deleted.
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler): Deleted.
+        (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
+        (JSC::CodeBlock::findPC): Deleted.
+        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex): Deleted.
+        (JSC::CodeBlock::thresholdForJIT): Deleted.
+        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
+        (JSC::CodeBlock::jitSoon): Deleted.
+        (JSC::CodeBlock::dumpMathICStats): Deleted.
+        (JSC::CodeBlock::livenessAnalysisSlow): Deleted.
+        * bytecode/ProgramCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/CodeBlock.h.
+        (): Deleted.
+        (JSC::CodeBlock::unlinkedCodeBlock): Deleted.
+        (JSC::CodeBlock::numParameters): Deleted.
+        (JSC::CodeBlock::numCalleeLocals): Deleted.
+        (JSC::CodeBlock::addressOfNumParameters): Deleted.
+        (JSC::CodeBlock::offsetOfNumParameters): Deleted.
+        (JSC::CodeBlock::alternative): Deleted.
+        (JSC::CodeBlock::forEachRelatedCodeBlock): Deleted.
+        (JSC::CodeBlock::specializationKind): Deleted.
+        (JSC::CodeBlock::isStrictMode): Deleted.
+        (JSC::CodeBlock::ecmaMode): Deleted.
+        (JSC::CodeBlock::isKnownNotImmediate): Deleted.
+        (JSC::CodeBlock::isTemporaryRegisterIndex): Deleted.
+        (JSC::CodeBlock::stubInfoBegin): Deleted.
+        (JSC::CodeBlock::stubInfoEnd): Deleted.
+        (JSC::CodeBlock::callLinkInfosBegin): Deleted.
+        (JSC::CodeBlock::callLinkInfosEnd): Deleted.
+        (JSC::CodeBlock::setJITCodeMap): Deleted.
+        (JSC::CodeBlock::jitCodeMap): Deleted.
+        (JSC::CodeBlock::bytecodeOffset): Deleted.
+        (JSC::CodeBlock::numberOfInstructions): Deleted.
+        (JSC::CodeBlock::instructions): Deleted.
+        (JSC::CodeBlock::instructionCount): Deleted.
+        (JSC::CodeBlock::setJITCode): Deleted.
+        (JSC::CodeBlock::jitCode): Deleted.
+        (JSC::CodeBlock::jitCodeOffset): Deleted.
+        (JSC::CodeBlock::jitType): Deleted.
+        (JSC::CodeBlock::hasBaselineJITProfiling): Deleted.
+        (JSC::CodeBlock::capabilityLevelState): Deleted.
+        (JSC::CodeBlock::ownerExecutable): Deleted.
+        (JSC::CodeBlock::ownerScriptExecutable): Deleted.
+        (JSC::CodeBlock::vm): Deleted.
+        (JSC::CodeBlock::setThisRegister): Deleted.
+        (JSC::CodeBlock::thisRegister): Deleted.
+        (JSC::CodeBlock::usesEval): Deleted.
+        (JSC::CodeBlock::setScopeRegister): Deleted.
+        (JSC::CodeBlock::scopeRegister): Deleted.
+        (JSC::CodeBlock::codeType): Deleted.
+        (JSC::CodeBlock::putByIdContext): Deleted.
+        (JSC::CodeBlock::source): Deleted.
+        (JSC::CodeBlock::sourceOffset): Deleted.
+        (JSC::CodeBlock::firstLineColumnOffset): Deleted.
+        (JSC::CodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::CodeBlock::jumpTarget): Deleted.
+        (JSC::CodeBlock::numberOfArgumentValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfileForArgument): Deleted.
+        (JSC::CodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfile): Deleted.
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::totalNumberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::getFromAllValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfRareCaseProfiles): Deleted.
+        (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
+        (JSC::CodeBlock::couldTakeSlowCase): Deleted.
+        (JSC::CodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::CodeBlock::arrayProfiles): Deleted.
+        (JSC::CodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::CodeBlock::exceptionHandler): Deleted.
+        (JSC::CodeBlock::hasExpressionInfo): Deleted.
+        (JSC::CodeBlock::hasCodeOrigins): Deleted.
+        (JSC::CodeBlock::canGetCodeOrigin): Deleted.
+        (JSC::CodeBlock::codeOrigin): Deleted.
+        (JSC::CodeBlock::addFrequentExitSite): Deleted.
+        (JSC::CodeBlock::hasExitSite): Deleted.
+        (JSC::CodeBlock::exitProfile): Deleted.
+        (JSC::CodeBlock::lazyOperandValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::constants): Deleted.
+        (JSC::CodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::addConstant): Deleted.
+        (JSC::CodeBlock::addConstantLazily): Deleted.
+        (JSC::CodeBlock::constantRegister): Deleted.
+        (JSC::CodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::CodeBlock::getConstant): Deleted.
+        (JSC::CodeBlock::constantSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::functionDecl): Deleted.
+        (JSC::CodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::CodeBlock::functionExpr): Deleted.
+        (JSC::CodeBlock::regexp): Deleted.
+        (JSC::CodeBlock::numberOfConstantBuffers): Deleted.
+        (JSC::CodeBlock::addConstantBuffer): Deleted.
+        (JSC::CodeBlock::constantBufferAsVector): Deleted.
+        (JSC::CodeBlock::constantBuffer): Deleted.
+        (JSC::CodeBlock::heap): Deleted.
+        (JSC::CodeBlock::globalObject): Deleted.
+        (JSC::CodeBlock::livenessAnalysis): Deleted.
+        (JSC::CodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::switchJumpTable): Deleted.
+        (JSC::CodeBlock::clearSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::evalCodeCache): Deleted.
+        (JSC::CodeBlock::checkIfJITThresholdReached): Deleted.
+        (JSC::CodeBlock::dontJITAnytimeSoon): Deleted.
+        (JSC::CodeBlock::llintExecuteCounter): Deleted.
+        (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
+        (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount): Deleted.
+        (JSC::CodeBlock::jitExecuteCounter): Deleted.
+        (JSC::CodeBlock::optimizationDelayCounter): Deleted.
+        (JSC::CodeBlock::osrExitCounter): Deleted.
+        (JSC::CodeBlock::countOSRExit): Deleted.
+        (JSC::CodeBlock::addressOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::offsetOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::calleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::hasDebuggerRequests): Deleted.
+        (JSC::CodeBlock::debuggerRequestsAddress): Deleted.
+        (JSC::CodeBlock::removeBreakpoint): Deleted.
+        (JSC::CodeBlock::clearDebuggerRequests): Deleted.
+        (JSC::CodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::CodeBlock::clearExceptionHandlers): Deleted.
+        (JSC::CodeBlock::appendExceptionHandler): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::replaceConstant): Deleted.
+        (JSC::CodeBlock::timeSinceCreation): Deleted.
+        (JSC::CodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::GlobalCodeBlock::GlobalCodeBlock): Deleted.
+        (JSC::ModuleProgramCodeBlock::create): Deleted.
+        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::create): Deleted.
+        (JSC::EvalCodeBlock::createStructure): Deleted.
+        (JSC::EvalCodeBlock::variable): Deleted.
+        (JSC::EvalCodeBlock::numVariables): Deleted.
+        (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock): Deleted.
+        (JSC::FunctionCodeBlock::create): Deleted.
+        (JSC::FunctionCodeBlock::createStructure): Deleted.
+        (JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.
+        (JSC::WebAssemblyCodeBlock::create): Deleted.
+        (JSC::WebAssemblyCodeBlock::createStructure): Deleted.
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock): Deleted.
+        (JSC::ExecState::r): Deleted.
+        (JSC::ExecState::uncheckedR): Deleted.
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
+        (JSC::ScriptExecutable::forEachCodeBlock): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * bytecode/WebAssemblyCodeBlock.cpp: Copied from Source/JavaScriptCore/bytecode/CodeBlock.cpp.
+        (JSC::FunctionCodeBlock::destroy): Deleted.
+        (JSC::ProgramCodeBlock::destroy): Deleted.
+        (JSC::ModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::EvalCodeBlock::destroy): Deleted.
+        (JSC::CodeBlock::inferredName): Deleted.
+        (JSC::CodeBlock::hasHash): Deleted.
+        (JSC::CodeBlock::isSafeToComputeHash): Deleted.
+        (JSC::CodeBlock::hash): Deleted.
+        (JSC::CodeBlock::sourceCodeForTools): Deleted.
+        (JSC::CodeBlock::sourceCodeOnOneLine): Deleted.
+        (JSC::CodeBlock::hashAsStringIfPossible): Deleted.
+        (JSC::CodeBlock::dumpAssumingJITType): Deleted.
+        (JSC::CodeBlock::dump): Deleted.
+        (JSC::idName): Deleted.
+        (JSC::CodeBlock::registerName): Deleted.
+        (JSC::CodeBlock::constantName): Deleted.
+        (JSC::regexpToSourceString): Deleted.
+        (JSC::regexpName): Deleted.
+        (JSC::debugHookName): Deleted.
+        (JSC::CodeBlock::printUnaryOp): Deleted.
+        (JSC::CodeBlock::printBinaryOp): Deleted.
+        (JSC::CodeBlock::printConditionalJump): Deleted.
+        (JSC::CodeBlock::printGetByIdOp): Deleted.
+        (JSC::dumpStructure): Deleted.
+        (JSC::dumpChain): Deleted.
+        (JSC::CodeBlock::printGetByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
+        (JSC::CodeBlock::printCallOp): Deleted.
+        (JSC::CodeBlock::printPutByIdOp): Deleted.
+        (JSC::CodeBlock::dumpSource): Deleted.
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        (JSC::CodeBlock::dumpExceptionHandlers): Deleted.
+        (JSC::CodeBlock::beginDumpProfiling): Deleted.
+        (JSC::CodeBlock::dumpValueProfiling): Deleted.
+        (JSC::CodeBlock::dumpArrayProfiling): Deleted.
+        (JSC::CodeBlock::dumpRareCaseProfile): Deleted.
+        (JSC::CodeBlock::dumpArithProfile): Deleted.
+        (JSC::CodeBlock::printLocationAndOp): Deleted.
+        (JSC::CodeBlock::printLocationOpAndRegisterOperand): Deleted.
+        (JSC::sizeInBytes): Deleted.
+        (JSC::CodeBlock::CodeBlock): Deleted.
+        (JSC::CodeBlock::finishCreation): Deleted.
+        (JSC::CodeBlock::~CodeBlock): Deleted.
+        (JSC::CodeBlock::setConstantRegisters): Deleted.
+        (JSC::CodeBlock::setAlternative): Deleted.
+        (JSC::CodeBlock::setNumParameters): Deleted.
+        (JSC::EvalCodeCache::visitAggregate): Deleted.
+        (JSC::CodeBlock::specialOSREntryBlockOrNull): Deleted.
+        (JSC::CodeBlock::visitWeakly): Deleted.
+        (JSC::CodeBlock::estimatedSize): Deleted.
+        (JSC::CodeBlock::visitChildren): Deleted.
+        (JSC::CodeBlock::shouldVisitStrongly): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference): Deleted.
+        (JSC::timeToLive): Deleted.
+        (JSC::CodeBlock::shouldJettisonDueToOldAge): Deleted.
+        (JSC::shouldMarkTransition): Deleted.
+        (JSC::CodeBlock::propagateTransitions): Deleted.
+        (JSC::CodeBlock::determineLiveness): Deleted.
+        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
+        (JSC::CodeBlock::clearLLIntGetByIdCache): Deleted.
+        (JSC::CodeBlock::finalizeLLIntInlineCaches): Deleted.
+        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Deleted.
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
+        (JSC::CodeBlock::getStubInfoMap): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoMap): Deleted.
+        (JSC::CodeBlock::getByValInfoMap): Deleted.
+        (JSC::CodeBlock::addStubInfo): Deleted.
+        (JSC::CodeBlock::addJITAddIC): Deleted.
+        (JSC::CodeBlock::addJITMulIC): Deleted.
+        (JSC::CodeBlock::addJITSubIC): Deleted.
+        (JSC::CodeBlock::addJITNegIC): Deleted.
+        (JSC::CodeBlock::findStubInfo): Deleted.
+        (JSC::CodeBlock::addByValInfo): Deleted.
+        (JSC::CodeBlock::addCallLinkInfo): Deleted.
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex): Deleted.
+        (JSC::CodeBlock::resetJITData): Deleted.
+        (JSC::CodeBlock::visitOSRExitTargets): Deleted.
+        (JSC::CodeBlock::stronglyVisitStrongReferences): Deleted.
+        (JSC::CodeBlock::stronglyVisitWeakReferences): Deleted.
+        (JSC::CodeBlock::baselineAlternative): Deleted.
+        (JSC::CodeBlock::baselineVersion): Deleted.
+        (JSC::CodeBlock::hasOptimizedReplacement): Deleted.
+        (JSC::CodeBlock::handlerForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::handlerForIndex): Deleted.
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex): Deleted.
+        (JSC::CodeBlock::removeExceptionHandlerForCallSite): Deleted.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::columnNumberForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::hasOpDebugForLineAndColumn): Deleted.
+        (JSC::CodeBlock::shrinkToFit): Deleted.
+        (JSC::CodeBlock::linkIncomingCall): Deleted.
+        (JSC::CodeBlock::linkIncomingPolymorphicCall): Deleted.
+        (JSC::CodeBlock::unlinkIncomingCalls): Deleted.
+        (JSC::CodeBlock::newReplacement): Deleted.
+        (JSC::CodeBlock::replacement): Deleted.
+        (JSC::CodeBlock::computeCapabilityLevel): Deleted.
+        (JSC::CodeBlock::jettison): Deleted.
+        (JSC::CodeBlock::globalObjectFor): Deleted.
+        (JSC::RecursionCheckFunctor::RecursionCheckFunctor): Deleted.
+        (JSC::RecursionCheckFunctor::operator()): Deleted.
+        (JSC::RecursionCheckFunctor::didRecurse): Deleted.
+        (JSC::CodeBlock::noticeIncomingCall): Deleted.
+        (JSC::CodeBlock::reoptimizationRetryCounter): Deleted.
+        (JSC::CodeBlock::setCalleeSaveRegisters): Deleted.
+        (JSC::roundCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::countReoptimization): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::codeTypeThresholdMultiplier): Deleted.
+        (JSC::CodeBlock::optimizationThresholdScalingFactor): Deleted.
+        (JSC::clipThreshold): Deleted.
+        (JSC::CodeBlock::adjustedCounterValue): Deleted.
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached): Deleted.
+        (JSC::CodeBlock::optimizeNextInvocation): Deleted.
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeAfterLongWarmUp): Deleted.
+        (JSC::CodeBlock::optimizeSoon): Deleted.
+        (JSC::CodeBlock::forceOptimizationSlowPathConcurrently): Deleted.
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult): Deleted.
+        (JSC::CodeBlock::adjustedExitCountThreshold): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimization): Deleted.
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeNow): Deleted.
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow): Deleted.
+        (JSC::CodeBlock::getArrayProfile): Deleted.
+        (JSC::CodeBlock::addArrayProfile): Deleted.
+        (JSC::CodeBlock::getOrAddArrayProfile): Deleted.
+        (JSC::CodeBlock::codeOrigins): Deleted.
+        (JSC::CodeBlock::numberOfDFGIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): Deleted.
+        (JSC::CodeBlock::updateAllValueProfilePredictions): Deleted.
+        (JSC::CodeBlock::updateAllArrayPredictions): Deleted.
+        (JSC::CodeBlock::updateAllPredictions): Deleted.
+        (JSC::CodeBlock::shouldOptimizeNow): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::dumpValueProfiles): Deleted.
+        (JSC::CodeBlock::frameRegisterCount): Deleted.
+        (JSC::CodeBlock::stackPointerOffset): Deleted.
+        (JSC::CodeBlock::predictedMachineCodeSize): Deleted.
+        (JSC::CodeBlock::usesOpcode): Deleted.
+        (JSC::CodeBlock::nameForRegister): Deleted.
+        (JSC::CodeBlock::valueProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::validate): Deleted.
+        (JSC::CodeBlock::beginValidationDidFail): Deleted.
+        (JSC::CodeBlock::endValidationDidFail): Deleted.
+        (JSC::CodeBlock::addBreakpoint): Deleted.
+        (JSC::CodeBlock::setSteppingMode): Deleted.
+        (JSC::CodeBlock::addRareCaseProfile): Deleted.
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::arithProfileForPC): Deleted.
+        (JSC::CodeBlock::couldTakeSpecialFastCase): Deleted.
+        (JSC::CodeBlock::capabilityLevel): Deleted.
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler): Deleted.
+        (JSC::CodeBlock::setPCToCodeOriginMap): Deleted.
+        (JSC::CodeBlock::findPC): Deleted.
+        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex): Deleted.
+        (JSC::CodeBlock::thresholdForJIT): Deleted.
+        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
+        (JSC::CodeBlock::jitSoon): Deleted.
+        (JSC::CodeBlock::dumpMathICStats): Deleted.
+        (JSC::CodeBlock::livenessAnalysisSlow): Deleted.
+        * bytecode/WebAssemblyCodeBlock.h: Copied from Source/JavaScriptCore/bytecode/CodeBlock.h.
+        (): Deleted.
+        (JSC::CodeBlock::unlinkedCodeBlock): Deleted.
+        (JSC::CodeBlock::numParameters): Deleted.
+        (JSC::CodeBlock::numCalleeLocals): Deleted.
+        (JSC::CodeBlock::addressOfNumParameters): Deleted.
+        (JSC::CodeBlock::offsetOfNumParameters): Deleted.
+        (JSC::CodeBlock::alternative): Deleted.
+        (JSC::CodeBlock::forEachRelatedCodeBlock): Deleted.
+        (JSC::CodeBlock::specializationKind): Deleted.
+        (JSC::CodeBlock::isStrictMode): Deleted.
+        (JSC::CodeBlock::ecmaMode): Deleted.
+        (JSC::CodeBlock::isKnownNotImmediate): Deleted.
+        (JSC::CodeBlock::isTemporaryRegisterIndex): Deleted.
+        (JSC::CodeBlock::stubInfoBegin): Deleted.
+        (JSC::CodeBlock::stubInfoEnd): Deleted.
+        (JSC::CodeBlock::callLinkInfosBegin): Deleted.
+        (JSC::CodeBlock::callLinkInfosEnd): Deleted.
+        (JSC::CodeBlock::setJITCodeMap): Deleted.
+        (JSC::CodeBlock::jitCodeMap): Deleted.
+        (JSC::CodeBlock::bytecodeOffset): Deleted.
+        (JSC::CodeBlock::numberOfInstructions): Deleted.
+        (JSC::CodeBlock::instructions): Deleted.
+        (JSC::CodeBlock::instructionCount): Deleted.
+        (JSC::CodeBlock::setJITCode): Deleted.
+        (JSC::CodeBlock::jitCode): Deleted.
+        (JSC::CodeBlock::jitCodeOffset): Deleted.
+        (JSC::CodeBlock::jitType): Deleted.
+        (JSC::CodeBlock::hasBaselineJITProfiling): Deleted.
+        (JSC::CodeBlock::capabilityLevelState): Deleted.
+        (JSC::CodeBlock::ownerExecutable): Deleted.
+        (JSC::CodeBlock::ownerScriptExecutable): Deleted.
+        (JSC::CodeBlock::vm): Deleted.
+        (JSC::CodeBlock::setThisRegister): Deleted.
+        (JSC::CodeBlock::thisRegister): Deleted.
+        (JSC::CodeBlock::usesEval): Deleted.
+        (JSC::CodeBlock::setScopeRegister): Deleted.
+        (JSC::CodeBlock::scopeRegister): Deleted.
+        (JSC::CodeBlock::codeType): Deleted.
+        (JSC::CodeBlock::putByIdContext): Deleted.
+        (JSC::CodeBlock::source): Deleted.
+        (JSC::CodeBlock::sourceOffset): Deleted.
+        (JSC::CodeBlock::firstLineColumnOffset): Deleted.
+        (JSC::CodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::CodeBlock::jumpTarget): Deleted.
+        (JSC::CodeBlock::numberOfArgumentValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfileForArgument): Deleted.
+        (JSC::CodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::valueProfile): Deleted.
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::totalNumberOfValueProfiles): Deleted.
+        (JSC::CodeBlock::getFromAllValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfRareCaseProfiles): Deleted.
+        (JSC::CodeBlock::likelyToTakeSlowCase): Deleted.
+        (JSC::CodeBlock::couldTakeSlowCase): Deleted.
+        (JSC::CodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::CodeBlock::arrayProfiles): Deleted.
+        (JSC::CodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::CodeBlock::exceptionHandler): Deleted.
+        (JSC::CodeBlock::hasExpressionInfo): Deleted.
+        (JSC::CodeBlock::hasCodeOrigins): Deleted.
+        (JSC::CodeBlock::canGetCodeOrigin): Deleted.
+        (JSC::CodeBlock::codeOrigin): Deleted.
+        (JSC::CodeBlock::addFrequentExitSite): Deleted.
+        (JSC::CodeBlock::hasExitSite): Deleted.
+        (JSC::CodeBlock::exitProfile): Deleted.
+        (JSC::CodeBlock::lazyOperandValueProfiles): Deleted.
+        (JSC::CodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::CodeBlock::identifier): Deleted.
+        (JSC::CodeBlock::constants): Deleted.
+        (JSC::CodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::addConstant): Deleted.
+        (JSC::CodeBlock::addConstantLazily): Deleted.
+        (JSC::CodeBlock::constantRegister): Deleted.
+        (JSC::CodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::CodeBlock::getConstant): Deleted.
+        (JSC::CodeBlock::constantSourceCodeRepresentation): Deleted.
+        (JSC::CodeBlock::functionDecl): Deleted.
+        (JSC::CodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::CodeBlock::functionExpr): Deleted.
+        (JSC::CodeBlock::regexp): Deleted.
+        (JSC::CodeBlock::numberOfConstantBuffers): Deleted.
+        (JSC::CodeBlock::addConstantBuffer): Deleted.
+        (JSC::CodeBlock::constantBufferAsVector): Deleted.
+        (JSC::CodeBlock::constantBuffer): Deleted.
+        (JSC::CodeBlock::heap): Deleted.
+        (JSC::CodeBlock::globalObject): Deleted.
+        (JSC::CodeBlock::livenessAnalysis): Deleted.
+        (JSC::CodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::switchJumpTable): Deleted.
+        (JSC::CodeBlock::clearSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::CodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::CodeBlock::evalCodeCache): Deleted.
+        (JSC::CodeBlock::checkIfJITThresholdReached): Deleted.
+        (JSC::CodeBlock::dontJITAnytimeSoon): Deleted.
+        (JSC::CodeBlock::llintExecuteCounter): Deleted.
+        (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
+        (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::addressOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecuteCounter): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold): Deleted.
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount): Deleted.
+        (JSC::CodeBlock::jitExecuteCounter): Deleted.
+        (JSC::CodeBlock::optimizationDelayCounter): Deleted.
+        (JSC::CodeBlock::osrExitCounter): Deleted.
+        (JSC::CodeBlock::countOSRExit): Deleted.
+        (JSC::CodeBlock::addressOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::offsetOfOSRExitCounter): Deleted.
+        (JSC::CodeBlock::calleeSaveRegisters): Deleted.
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters): Deleted.
+        (JSC::CodeBlock::optimizeAfterWarmUp): Deleted.
+        (JSC::CodeBlock::numberOfDFGCompiles): Deleted.
+        (JSC::CodeBlock::hasDebuggerRequests): Deleted.
+        (JSC::CodeBlock::debuggerRequestsAddress): Deleted.
+        (JSC::CodeBlock::removeBreakpoint): Deleted.
+        (JSC::CodeBlock::clearDebuggerRequests): Deleted.
+        (JSC::CodeBlock::wasCompiledWithDebuggingOpcodes): Deleted.
+        (JSC::CodeBlock::clearExceptionHandlers): Deleted.
+        (JSC::CodeBlock::appendExceptionHandler): Deleted.
+        (JSC::CodeBlock::tallyFrequentExitSites): Deleted.
+        (JSC::CodeBlock::replaceConstant): Deleted.
+        (JSC::CodeBlock::timeSinceCreation): Deleted.
+        (JSC::CodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::GlobalCodeBlock::GlobalCodeBlock): Deleted.
+        (JSC::ProgramCodeBlock::create): Deleted.
+        (JSC::ProgramCodeBlock::createStructure): Deleted.
+        (JSC::ProgramCodeBlock::ProgramCodeBlock): Deleted.
+        (JSC::ModuleProgramCodeBlock::create): Deleted.
+        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::create): Deleted.
+        (JSC::EvalCodeBlock::createStructure): Deleted.
+        (JSC::EvalCodeBlock::variable): Deleted.
+        (JSC::EvalCodeBlock::numVariables): Deleted.
+        (JSC::EvalCodeBlock::EvalCodeBlock): Deleted.
+        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock): Deleted.
+        (JSC::FunctionCodeBlock::create): Deleted.
+        (JSC::FunctionCodeBlock::createStructure): Deleted.
+        (JSC::FunctionCodeBlock::FunctionCodeBlock): Deleted.
+        (JSC::ExecState::r): Deleted.
+        (JSC::ExecState::uncheckedR): Deleted.
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
+        (JSC::ScriptExecutable::forEachCodeBlock): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        * interpreter/Interpreter.cpp:
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * runtime/CommonSlowPaths.h:
+        * runtime/EvalExecutable.cpp:
+        * runtime/ExecutableBase.cpp:
+        * runtime/FunctionExecutable.cpp:
+        * runtime/FunctionExecutableDump.cpp:
+        * runtime/ModuleProgramExecutable.cpp:
+        * runtime/ProgramExecutable.cpp:
+        * runtime/ScriptExecutable.cpp:
+        * runtime/ScriptExecutable.h:
+        * runtime/TestRunnerUtils.cpp:
+        * runtime/VM.cpp:
+        * runtime/WebAssemblyExecutable.cpp:
+        * tools/JSDollarVMPrototype.cpp:
+
+2016-11-01  Sam Weinig  <sam@webkit.org>
+
+        [WebIDL] Move interfaces and typed arrays over to JSDOMConvert
+        https://bugs.webkit.org/show_bug.cgi?id=164256
+
+        Reviewed by Alex Christensen.
+
+        * runtime/JSArrayBuffer.h:
+        (JSC::JSArrayBuffer::toWrapped):
+        Change return type to ArrayBuffer* to match WebCore's expectation.
+
+2016-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        The GC should be in a thread
+        https://bugs.webkit.org/show_bug.cgi?id=163562
+
+        Reviewed by Geoffrey Garen and Andreas Kling.
+        
+        In a concurrent GC, the work of collecting happens on a separate thread. This patch
+        implements this, and schedules the thread the way that a concurrent GC thread would be
+        scheduled. But, the GC isn't actually concurrent yet because it calls stopTheWorld() before
+        doing anything and calls resumeTheWorld() after it's done with everything. The next step will
+        be to make it really concurrent by basically calling stopTheWorld()/resumeTheWorld() around
+        bounded snippets of work while making most of the work happen with the world running. Our GC
+        will probably always have stop-the-world phases because the semantics of JSC weak references
+        call for it.
+        
+        This implements concurrent GC scheduling. This means that there is no longer a
+        Heap::collect() API. Instead, you can call collectAsync() which makes sure that a GC is
+        scheduled (it will do nothing if one is scheduled or ongoing) or you can call collectSync()
+        to schedule a GC and wait for it to happen. I made our debugging stuff call collectSync().
+        It should be a goal to never call collectSync() except for debugging or benchmark harness
+        hacks.
+        
+        The collector thread is an AutomaticThread, so it won't linger when not in use. It works on
+        a ticket-based system, like you would see at the DMV. A ticket is a 64-bit integer. There are
+        two ticket counters: last granted and last served. When you request a collection, last
+        granted is incremented and its new value given to you. When a collection completes, last
+        served is incremented. collectSync() waits until last served catches up to what last granted
+        had been at the time you requested a GC. This means that if you request a sync GC in the
+        middle of an async GC, you will wait for that async GC to finish and then you will request
+        and wait for your sync GC.
+        
+        The synchronization between the collector thread and the main threads is complex. The
+        collector thread needs to be able to ask the main thread to stop. It needs to be able to do
+        some post-GC clean-up, like the synchronous CodeBlock and LargeAllocation sweeps, on the main
+        thread. The collector needs to be able to ask the main thread to execute a cross-modifying
+        code fence before running any JIT code, since the GC might aid the JIT worklist and run JIT
+        finalization. It's possible for the GC to want the main thread to run something at the same
+        time that the main thread wants to wait for the GC. The main thread needs to be able to run
+        non-JSC stuff without causing the GC to completely stall. The main thread needs to be able
+        to query its own state (is there a request to stop?) and change it (running JSC versus not)
+        quickly, since this may happen on hot paths. This kind of intertwined system of requests,
+        notifications, and state changes requires a combination of lock-free algorithms and waiting.
+        So, this is all implemented using a Atomic<unsigned> Heap::m_worldState, which has bits to
+        represent things being requested by the collector and the heap access state of the mutator. I
+        am borrowing a lot of terms that I've seen in other VMs that I've worked on. Here's what they
+        mean:
+        
+        - Stop the world: make sure that either the mutator is not running, or that it's not running
+          code that could mess with the heap.
+        
+        - Heap access: the mutator is said to have heap access if it could mess with the heap.
+        
+        If you stop the world and the mutator doesn't have heap access, all you're doing is making
+        sure that it will block when it tries to acquire heap access. This means that our GC is
+        already fully concurrent in cases where the GC is requested while the mutator has no heap
+        access. This probably won't happen, but if it did then it should just work. Usually, stopping
+        the world means that we state our shouldStop request with m_worldState, and a future call
+        to Heap::stopIfNecessary() will go to slow path and stop. The act of stopping or waiting to
+        acquire heap access is managed by using ParkingLot API directly on m_worldState. This works
+        out great because it would be very awkward to get the same functionality using locks and
+        condition variables, since we want stopIfNecessary/acquireAccess/requestAccess fast paths
+        that are single atomic instructions (load/CAS/CAS, respectively). The mutator will call these
+        things frequently. Currently we have Heap::stopIfNecessary() polling on every allocator slow
+        path, but we may want to make it even more frequent than that.
+        
+        Currently only JSC API clients benefit from the heap access optimization. The DOM forces us
+        to assume that heap access is permanently on, since DOM manipulation doesn't always hold the
+        JSLock. We could still allow the GC to proceed when the runloop is idle by having the GC put
+        a task on the runloop that just calls stopIfNecessary().
+        
+        This is perf neutral. The only behavior change that clients ought to observe is that marking
+        and the weak fixpoint happen on a separate thread. Marking was already parallel so it already
+        handled multiple threads, but now it _never_ runs on the main thread. The weak fixpoint
+        needed some help to be able to run on another thread - mostly because there was some code in
+        IndexedDB that was using thread specifics in the weak fixpoint.
+
+        * API/JSBase.cpp:
+        (JSSynchronousEdenCollectForDebugging):
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue initWithValue:]):
+        * heap/EdenGCActivityCallback.cpp:
+        (JSC::EdenGCActivityCallback::doCollection):
+        * heap/FullGCActivityCallback.cpp:
+        (JSC::FullGCActivityCallback::doCollection):
+        * heap/Heap.cpp:
+        (JSC::Heap::Thread::Thread):
+        (JSC::Heap::Heap):
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::gatherStackRoots):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collectAsync):
+        (JSC::Heap::collectSync):
+        (JSC::Heap::shouldCollectInThread):
+        (JSC::Heap::collectInThread):
+        (JSC::Heap::stopTheWorld):
+        (JSC::Heap::resumeTheWorld):
+        (JSC::Heap::stopIfNecessarySlow):
+        (JSC::Heap::acquireAccessSlow):
+        (JSC::Heap::releaseAccessSlow):
+        (JSC::Heap::handleDidJIT):
+        (JSC::Heap::handleNeedFinalize):
+        (JSC::Heap::setDidJIT):
+        (JSC::Heap::setNeedFinalize):
+        (JSC::Heap::waitWhileNeedFinalize):
+        (JSC::Heap::finalize):
+        (JSC::Heap::requestCollection):
+        (JSC::Heap::waitForCollection):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::canCollect):
+        (JSC::Heap::shouldCollectHeuristic):
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        (JSC::Heap::collectAccordingToDeferGCProbability):
+        (JSC::Heap::collect): Deleted.
+        (JSC::Heap::collectWithoutAnySweep): Deleted.
+        (JSC::Heap::collectImpl): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::ReleaseAccessScope::ReleaseAccessScope):
+        (JSC::Heap::ReleaseAccessScope::~ReleaseAccessScope):
+        * heap/HeapInlines.h:
+        (JSC::Heap::acquireAccess):
+        (JSC::Heap::releaseAccess):
+        (JSC::Heap::stopIfNecessary):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherConservativeRoots):
+        (JSC::MachineThreads::gatherFromCurrentThread): Deleted.
+        * heap/MachineStackMarker.h:
+        * jit/JITWorklist.cpp:
+        (JSC::JITWorklist::completeAllForVM):
+        * jit/JITWorklist.h:
+        * jsc.cpp:
+        (functionFullGC):
+        (functionEdenGC):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::didAcquireLock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::willReleaseLock):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::edenGC):
+
+2016-11-02  Michael Saboff  <msaboff@apple.com>
+
+        Crash beneath SlotVisitor::drain @ cooksillustrated.com
+        https://bugs.webkit.org/show_bug.cgi?id=164304
+
+        Reviewed by Mark Lam.
+
+        Added back write barrier for the base cell of put-by_id in the LLInt when the structure is
+        changed.  Also removed the unused macro "storeStructureWithTypeInfo".
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2016-11-02  Keith Miller  <keith_miller@apple.com>
+
+        We should not pop from an empty stack in the Wasm function parser.
+        https://bugs.webkit.org/show_bug.cgi?id=164275
+
+        Reviewed by Filip Pizlo.
+
+        This patch prevents an issue in the wasm parser where we might
+        accidentially pop from the expression stack without if there
+        are no entries. It also fixes a similar issue with else
+        blocks where a user might try to put an else on the top level
+        of a function.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        (JSC::Wasm::FunctionParser<Context>::popExpressionStack):
+        * wasm/WasmValidate.cpp:
+        (JSC::Wasm::Validate::setErrorMessage):
+
+2016-11-02  Romain Bellessort  <romain.bellessort@crf.canon.fr>
+
+        [Readable Streams API] Enable creation of ReadableByteStreamController
+        https://bugs.webkit.org/show_bug.cgi?id=164014
+
+        Reviewed by Youenn Fablet.
+
+        Added flag for the byte stream part of Readable Streams API.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-11-02  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Copy build results to AAS 'Program Files' folder.
+        https://bugs.webkit.org/show_bug.cgi?id=164273
+
+        Reviewed by Brent Fulgham.
+
+        The preferred location for the binaries is the AAS 'Program Files' folder.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj:
+
+2016-11-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove CUSTOM_ELEMENTS build flag
+        https://bugs.webkit.org/show_bug.cgi?id=164267
+
+        Reviewed by Antti Koivisto.
+
+        Removed the build flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-11-01  Keith Miller  <keith_miller@apple.com>
+
+        Add a WASM function validator.
+        https://bugs.webkit.org/show_bug.cgi?id=161707
+
+        Reviewed by Saam Barati.
+
+        This is a new template specialization of the Wasm FunctionParser class.  Instead of having
+        the FunctionParser track what B3 values each stack entry refers to the validator has each
+        entry refer to the type of the stack entry. Additionally, the control stack tracks what type
+        of block the object is and what the result type of the block is. The validation functions
+        for unary, binary, and memory operations are autogenerated by the
+        generateWasmValidateInlinesHeader.py script.
+
+        There are still a couple issue with validating that will be addressed in follow-up patches.
+        1) We need to handle result types from basic blocks. https://bugs.webkit.org/show_bug.cgi?id=164100
+        2) We need to handle popping things from stacks when they don't exist. https://bugs.webkit.org/show_bug.cgi?id=164275
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * testWasm.cpp:
+        (runWasmTests):
+        * wasm/WasmB3IRGenerator.cpp:
+        * wasm/WasmFormat.cpp: Added.
+        (JSC::Wasm::toString):
+        * wasm/WasmFormat.h:
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::Plan):
+        * wasm/WasmValidate.cpp: Added.
+        (JSC::Wasm::Validate::ControlData::ControlData):
+        (JSC::Wasm::Validate::ControlData::dump):
+        (JSC::Wasm::Validate::ControlData::type):
+        (JSC::Wasm::Validate::ControlData::signature):
+        (JSC::Wasm::Validate::addConstant):
+        (JSC::Wasm::Validate::isContinuationReachable):
+        (JSC::Wasm::Validate::errorMessage):
+        (JSC::Wasm::Validate::Validate):
+        (JSC::Wasm::Validate::addArguments):
+        (JSC::Wasm::Validate::addLocal):
+        (JSC::Wasm::Validate::getLocal):
+        (JSC::Wasm::Validate::setLocal):
+        (JSC::Wasm::Validate::addBlock):
+        (JSC::Wasm::Validate::addLoop):
+        (JSC::Wasm::Validate::addIf):
+        (JSC::Wasm::Validate::addElse):
+        (JSC::Wasm::Validate::addReturn):
+        (JSC::Wasm::Validate::addBranch):
+        (JSC::Wasm::Validate::endBlock):
+        (JSC::Wasm::Validate::addCall):
+        (JSC::Wasm::Validate::unify):
+        (JSC::Wasm::Validate::dump):
+        (JSC::Wasm::validateFunction):
+        * wasm/WasmValidate.h: Added.
+        * wasm/generateWasmValidateInlinesHeader.py: Added.
+        (cppType):
+        (toCpp):
+        (unaryMacro):
+        (binaryMacro):
+        (loadMacro):
+        (storeMacro):
+
+2016-11-01  Saam Barati  <sbarati@apple.com>
+
+        We should be able to eliminate rest parameter allocations
+        https://bugs.webkit.org/show_bug.cgi?id=163925
+
+        Reviewed by Filip Pizlo.
+
+        This is the first step towards eliminating rest parameter
+        allocations when they're spread to other function calls:
+        `function foo(...args) { bar(...args); }`
+        
+        This patch simply removes the allocation for rest parameter
+        allocations using the same escape analysis that is performed
+        in the argument elimination phase. I've added a new rule to
+        the phase to make sure that CheckStructure doesn't count as
+        an escape for an allocation since this often shows up in code
+        like this:
+        
+        ```
+        function foo(...args) {
+            let r = [];
+            for (let i = 0; i < args.length; i++)
+                r.push(args[i]);
+            return r;
+        }
+        ```
+        
+        The above program now entirely eliminates the allocation for args
+        compiled in the FTL. Programs like this also eliminate the allocation
+        for args:
+        
+        ```
+        function foo(...args) { return [args.length, args[0]]; }
+        
+        function bar(...args) { return someOtherFunction.apply(null, args); }
+        ```
+        
+        This patch extends the arguments elimination phase to understand
+        the concept that we may want to forward arguments, or get from
+        the arguments region, starting at some offset. The offset is the
+        number of names parameter before the rest parameter. For example:
+        
+        ```
+        function foo(a, b, ...args) { return bar.apply(null, args); }
+        ```
+        
+        Will forward arguments starting at the *third* argument.
+        Our arguments forwarding code already had the notion of starting
+        from some offset, however, I found bugs in that code. I extended
+        it to work properly for rest parameters with arbitrary skip offsets.
+        
+        And this program:
+        ```
+        function foo(...args) {
+            let r = [];
+            for (let i = 0; i < args.length; i++)
+                r.push(args[i]);
+            return r;
+        }
+        ```
+        
+        Knows to perform the GetMyArgumentByVal* with an offset of 3
+        inside the loop. To make this work, I taught GetMyArgumentByVal 
+        and GetMyArgumentByValOutOfBounds to take an offset representing
+        the number of arguments to skip.
+        
+        This patch is a ~20% speedup on microbenchmarks.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGArgumentsUtilities.cpp:
+        (JSC::DFG::emitCodeToGetArgumentsArrayLength):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasConstant):
+        (JSC::DFG::Node::constant):
+        (JSC::DFG::Node::isPhantomAllocation):
+        (JSC::DFG::Node::numberOfArgumentsToSkip):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateRest):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGValidate.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::getArgumentsStart):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationPopulateObjectInOSR):
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetVarargsFrame):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::restParameterStructure):
+
+2016-11-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Lots of stderr logging in JSManagedValue
+        https://bugs.webkit.org/show_bug.cgi?id=164279
+        <rdar://problem/28949886>
+
+        Reviewed by Filip Pizlo.
+
+        Revert an accidental change in <https://trac.webkit.org/changeset/205462>.
+
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue initWithValue:]):
+
+2016-11-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r208208 and r208210.
+        https://bugs.webkit.org/show_bug.cgi?id=164276
+
+        This change caused 28 JSC test failures. (Requested by
+        ryanhaddad on #webkit).
+
+        Reverted changesets:
+
+        "We should be able to eliminate rest parameter allocations"
+        https://bugs.webkit.org/show_bug.cgi?id=163925
+        http://trac.webkit.org/changeset/208208
+
+        "Fix the EFL build."
+        http://trac.webkit.org/changeset/208210
+
+2016-11-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Web Inspector: Add the support for custom elements
+        https://bugs.webkit.org/show_bug.cgi?id=164266
+        <rdar://problem/29038883>
+
+        Reviewed by Joseph Pecoraro.
+
+        Added customElementState of type CustomElementState to reflect the custom element state on each DOM node
+        along with customElementStateChanged which fires when the custom element state changes.
+
+        * inspector/protocol/DOM.json:
+
+2016-10-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the EFL build.
+
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+
+2016-10-29  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should support SharedArrayBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=163986
+
+        Reviewed by Keith Miller.
+        
+        This implements https://tc39.github.io/ecmascript_sharedmem/shmem.html.
+        
+        There is now a new SharedArrayBuffer type. In the JS runtime, which includes typed array
+        types, the SharedArrayBuffer is a drop-in replacement for ArrayBuffer, even though they are
+        distinct types (new SharedArrayBuffer() instanceof ArrayBuffer == false and vice versa). The
+        DOM will not recognize SharedArrayBuffer, or any typed array that wraps it, to ensure safety.
+        This matches what other browsers intend to do, see
+        https://github.com/tc39/ecmascript_sharedmem/issues/38. API is provided for the DOM to opt
+        into SharedArrayBuffer. One notable place is postMessage, which will share the
+        SharedArrayBuffer's underlying data storage with other workers. This creates a pool of shared
+        memory that the workers can use to talk to each other.
+        
+        There is also an Atomics object in global scope, which exposes sequentially consistent atomic
+        operations: add, and, compareExchange, exchange, load, or, store, sub, and xor. Additionally
+        it exposes a Atomics.isLockFree utility, which takes a byte amount and returns true or false.
+        Also there is Atomics.wake/wait, which neatly map to ParkingLot.
+        
+        Accesses to typed arrays that wrap SharedArrayBuffer are optimized by JSC the same way as
+        always. I believe that DFG and B3 already obey the following memory model, which I believe is
+        a bit weaker than Cambridge and a bit stronger than what is being proposed for
+        SharedArrayBuffer. To predict a program's behavior under the B3 memory model, imagine the
+        space of all possible programs that would result from running an optimizer that adversarially
+        follows B3's transformation rules. B3 transformations are correct if the newly created
+        program is equivalent to the old one, assuming that any opaque effect in IR (like the reads
+        and writes of a patchpoint/call/fence) could perform any load/store that satisfies the
+        B3::Effects summary. Opaque effects are a way of describing an infinite set of programs: any
+        program that only does the effects summarized in B3::Effects belongs to the set. For example,
+        this prevents motion of operations across fences since fences are summarized as opaque
+        effects that could read or write memory. This rule alone is not enough, because it leaves the
+        door open for turning an atomic operation (like a load) into a non-atomic one (like a load
+        followed by a store of the same value back to the same location or multiple loads). This is
+        not an optimization that either our compiler or the CPU would want to do. One way to think of
+        what exactly is forbidden is that B3 transformations that mess with memory accesses can only
+        reorder them or remove them. This means that for any execution of the untransformed program,
+        the corresponding execution of the transformed program (i.e. with the same input arguments
+        and the same programs filled in for the opaque effects) must have the same loads and stores,
+        with some removed and some reordered. This is a fairly simple mental model that B3 and DFG
+        already follow and it's based on existing abstractions for the infinite set of programs
+        inside an opaque effect (DFG's AbstractHeaps and B3's Effects).
+        
+        This patch makes all atomics operations intrinsic, but the DFG doesn't know about any of them
+        yet. That's covered by bug 164108.
+        
+        This ought to be perf-neutral, but I am still running tests to confirm this. I'm also still
+        writing new tests to cover all of the Atomics functionality and the behavior of SAB objects.
+
+        * API/JSTypedArray.cpp:
+        (JSObjectGetTypedArrayBytesPtr):
+        (JSObjectGetTypedArrayBuffer):
+        (JSObjectMakeArrayBufferWithBytesNoCopy):
+        * API/tests/CompareAndSwapTest.cpp:
+        (Bitmap::concurrentTestAndSet):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGDesiredWatchpoints.cpp:
+        (JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):
+        * heap/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::reportExternalMemoryVisited):
+        * jsc.cpp:
+        (functionTransferArrayBuffer):
+        * runtime/ArrayBuffer.cpp:
+        (JSC::SharedArrayBufferContents::SharedArrayBufferContents):
+        (JSC::SharedArrayBufferContents::~SharedArrayBufferContents):
+        (JSC::ArrayBufferContents::ArrayBufferContents):
+        (JSC::ArrayBufferContents::operator=):
+        (JSC::ArrayBufferContents::~ArrayBufferContents):
+        (JSC::ArrayBufferContents::clear):
+        (JSC::ArrayBufferContents::destroy):
+        (JSC::ArrayBufferContents::reset):
+        (JSC::ArrayBufferContents::tryAllocate):
+        (JSC::ArrayBufferContents::makeShared):
+        (JSC::ArrayBufferContents::transferTo):
+        (JSC::ArrayBufferContents::copyTo):
+        (JSC::ArrayBufferContents::shareWith):
+        (JSC::ArrayBuffer::create):
+        (JSC::ArrayBuffer::createAdopted):
+        (JSC::ArrayBuffer::createFromBytes):
+        (JSC::ArrayBuffer::tryCreate):
+        (JSC::ArrayBuffer::createUninitialized):
+        (JSC::ArrayBuffer::tryCreateUninitialized):
+        (JSC::ArrayBuffer::createInternal):
+        (JSC::ArrayBuffer::ArrayBuffer):
+        (JSC::ArrayBuffer::slice):
+        (JSC::ArrayBuffer::sliceImpl):
+        (JSC::ArrayBuffer::makeShared):
+        (JSC::ArrayBuffer::setSharingMode):
+        (JSC::ArrayBuffer::transferTo):
+        (JSC::ArrayBuffer::transfer): Deleted.
+        * runtime/ArrayBuffer.h:
+        (JSC::arrayBufferSharingModeName):
+        (JSC::SharedArrayBufferContents::data):
+        (JSC::ArrayBufferContents::data):
+        (JSC::ArrayBufferContents::sizeInBytes):
+        (JSC::ArrayBufferContents::isShared):
+        (JSC::ArrayBuffer::sharingMode):
+        (JSC::ArrayBuffer::isShared):
+        (JSC::ArrayBuffer::gcSizeEstimateInBytes):
+        (JSC::arrayBufferDestructorNull): Deleted.
+        (JSC::arrayBufferDestructorDefault): Deleted.
+        (JSC::ArrayBufferContents::ArrayBufferContents): Deleted.
+        (JSC::ArrayBufferContents::transfer): Deleted.
+        (JSC::ArrayBufferContents::copyTo): Deleted.
+        (JSC::ArrayBuffer::create): Deleted.
+        (JSC::ArrayBuffer::createAdopted): Deleted.
+        (JSC::ArrayBuffer::createFromBytes): Deleted.
+        (JSC::ArrayBuffer::tryCreate): Deleted.
+        (JSC::ArrayBuffer::createUninitialized): Deleted.
+        (JSC::ArrayBuffer::tryCreateUninitialized): Deleted.
+        (JSC::ArrayBuffer::createInternal): Deleted.
+        (JSC::ArrayBuffer::ArrayBuffer): Deleted.
+        (JSC::ArrayBuffer::slice): Deleted.
+        (JSC::ArrayBuffer::sliceImpl): Deleted.
+        (JSC::ArrayBufferContents::tryAllocate): Deleted.
+        (JSC::ArrayBufferContents::~ArrayBufferContents): Deleted.
+        * runtime/ArrayBufferSharingMode.h: Added.
+        * runtime/ArrayBufferView.h:
+        (JSC::ArrayBufferView::possiblySharedBuffer):
+        (JSC::ArrayBufferView::unsharedBuffer):
+        (JSC::ArrayBufferView::isShared):
+        (JSC::ArrayBufferView::buffer): Deleted.
+        * runtime/AtomicsObject.cpp: Added.
+        (JSC::AtomicsObject::AtomicsObject):
+        (JSC::AtomicsObject::create):
+        (JSC::AtomicsObject::createStructure):
+        (JSC::AtomicsObject::finishCreation):
+        (JSC::atomicsFuncAdd):
+        (JSC::atomicsFuncAnd):
+        (JSC::atomicsFuncCompareExchange):
+        (JSC::atomicsFuncExchange):
+        (JSC::atomicsFuncIsLockFree):
+        (JSC::atomicsFuncLoad):
+        (JSC::atomicsFuncOr):
+        (JSC::atomicsFuncStore):
+        (JSC::atomicsFuncSub):
+        (JSC::atomicsFuncWait):
+        (JSC::atomicsFuncWake):
+        (JSC::atomicsFuncXor):
+        * runtime/AtomicsObject.h: Added.
+        * runtime/CommonIdentifiers.h:
+        * runtime/DataView.cpp:
+        (JSC::DataView::wrap):
+        * runtime/GenericTypedArrayViewInlines.h:
+        (JSC::GenericTypedArrayView<Adaptor>::subarray):
+        * runtime/Intrinsic.h:
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::finishCreation):
+        (JSC::JSArrayBuffer::isShared):
+        (JSC::JSArrayBuffer::sharingMode):
+        * runtime/JSArrayBuffer.h:
+        (JSC::toPossiblySharedArrayBuffer):
+        (JSC::toUnsharedArrayBuffer):
+        (JSC::JSArrayBuffer::toWrapped):
+        (JSC::toArrayBuffer): Deleted.
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::JSArrayBufferConstructor):
+        (JSC::JSArrayBufferConstructor::finishCreation):
+        (JSC::JSArrayBufferConstructor::create):
+        (JSC::constructArrayBuffer):
+        * runtime/JSArrayBufferConstructor.h:
+        (JSC::JSArrayBufferConstructor::sharingMode):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        (JSC::JSArrayBufferPrototype::JSArrayBufferPrototype):
+        (JSC::JSArrayBufferPrototype::finishCreation):
+        (JSC::JSArrayBufferPrototype::create):
+        * runtime/JSArrayBufferPrototype.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::finishCreation):
+        (JSC::JSArrayBufferView::visitChildren):
+        (JSC::JSArrayBufferView::unsharedBuffer):
+        (JSC::JSArrayBufferView::unsharedJSBuffer):
+        (JSC::JSArrayBufferView::possiblySharedJSBuffer):
+        (JSC::JSArrayBufferView::neuter):
+        (JSC::JSArrayBufferView::toWrapped): Deleted.
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::jsBuffer): Deleted.
+        * runtime/JSArrayBufferViewInlines.h:
+        (JSC::JSArrayBufferView::isShared):
+        (JSC::JSArrayBufferView::possiblySharedBuffer):
+        (JSC::JSArrayBufferView::possiblySharedImpl):
+        (JSC::JSArrayBufferView::unsharedImpl):
+        (JSC::JSArrayBufferView::byteOffset):
+        (JSC::JSArrayBufferView::toWrapped):
+        (JSC::JSArrayBufferView::buffer): Deleted.
+        (JSC::JSArrayBufferView::impl): Deleted.
+        (JSC::JSArrayBufferView::neuter): Deleted.
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::possiblySharedTypedImpl):
+        (JSC::JSDataView::unsharedTypedImpl):
+        (JSC::JSDataView::getTypedArrayImpl):
+        (JSC::JSDataView::typedImpl): Deleted.
+        * runtime/JSDataView.h:
+        (JSC::JSDataView::possiblySharedBuffer):
+        (JSC::JSDataView::unsharedBuffer):
+        (JSC::JSDataView::buffer): Deleted.
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::dataViewProtoGetterBuffer):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::toPossiblySharedNativeTypedView):
+        (JSC::toUnsharedNativeTypedView):
+        (JSC::JSGenericTypedArrayView<Adaptor>::toWrapped):
+        (JSC::JSGenericTypedArrayView::typedImpl): Deleted.
+        (JSC::toNativeTypedView): Deleted.
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::create):
+        (JSC::JSGenericTypedArrayView<Adaptor>::possiblySharedTypedImpl):
+        (JSC::JSGenericTypedArrayView<Adaptor>::unsharedTypedImpl):
+        (JSC::JSGenericTypedArrayView<Adaptor>::getTypedArrayImpl):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoGetterFuncBuffer):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::createAtomicsProperty):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrayBufferPrototype):
+        (JSC::JSGlobalObject::arrayBufferStructure):
+        * runtime/MathObject.cpp:
+        * runtime/RuntimeFlags.h:
+        * runtime/SimpleTypedArrayController.cpp:
+        (JSC::SimpleTypedArrayController::toJS):
+        * runtime/TypedArrayType.h:
+        (JSC::typedArrayTypeForType):
+
+2016-10-31  Saam Barati  <sbarati@apple.com>
+
+        We should be able to eliminate rest parameter allocations
+        https://bugs.webkit.org/show_bug.cgi?id=163925
+
+        Reviewed by Filip Pizlo.
+
+        This is the first step towards eliminating rest parameter
+        allocations when they're spread to other function calls:
+        `function foo(...args) { bar(...args); }`
+        
+        This patch simply removes the allocation for rest parameter
+        allocations using the same escape analysis that is performed
+        in the argument elimination phase. I've added a new rule to
+        the phase to make sure that CheckStructure doesn't count as
+        an escape for an allocation since this often shows up in code
+        like this:
+        
+        ```
+        function foo(...args) {
+            let r = [];
+            for (let i = 0; i < args.length; i++)
+                r.push(args[i]);
+            return r;
+        }
+        ```
+        
+        The above program now entirely eliminates the allocation for args
+        compiled in the FTL. Programs like this also eliminate the allocation
+        for args:
+        
+        ```
+        function foo(...args) { return [args.length, args[0]]; }
+        
+        function bar(...args) { return someOtherFunction.apply(null, args); }
+        ```
+        
+        This patch extends the arguments elimination phase to understand
+        the concept that we may want to forward arguments, or get from
+        the arguments region, starting at some offset. The offset is the
+        number of names parameter before the rest parameter. For example:
+        
+        ```
+        function foo(a, b, ...args) { return bar.apply(null, args); }
+        ```
+        
+        Will forward arguments starting at the *third* argument.
+        Our arguments forwarding code already had the notion of starting
+        from some offset, however, I found bugs in that code. I extended
+        it to work properly for rest parameters with arbitrary skip offsets.
+        
+        And this program:
+        ```
+        function foo(...args) {
+            let r = [];
+            for (let i = 0; i < args.length; i++)
+                r.push(args[i]);
+            return r;
+        }
+        ```
+        
+        Knows to perform the GetMyArgumentByVal* with an offset of 3
+        inside the loop. To make this work, I taught GetMyArgumentByVal 
+        and GetMyArgumentByValOutOfBounds to take an offset representing
+        the number of arguments to skip.
+        
+        This patch is a ~20% speedup on microbenchmarks.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGArgumentsUtilities.cpp:
+        (JSC::DFG::emitCodeToGetArgumentsArrayLength):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasConstant):
+        (JSC::DFG::Node::constant):
+        (JSC::DFG::Node::isPhantomAllocation):
+        (JSC::DFG::Node::numberOfArgumentsToSkip):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateRest):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGValidate.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::getArgumentsStart):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationPopulateObjectInOSR):
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetVarargsFrame):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::restParameterStructure):
+
+2016-10-31  Mark Lam  <mark.lam@apple.com>
+
+        Add $vm.codeBlockFor() debugging utility.
+        https://bugs.webkit.org/show_bug.cgi?id=164192
+
+        Reviewed by Saam Barati.
+
+        Sometimes, while debugging, it would be nice if we can get the codeBlock info for
+        a function.  Amongst other uses, this is useful for checking what optimization
+        level the function is currently at.  With $vm.codeBlockFor(), we can now do this.
+        For example, when JS_useDollarVM=true:
+
+            print("test's codeBlock = " + $vm.codeBlockFor(test)); // prints function test's codeBlock.
+
+        Also added some comments to clarify some pre-existing code.
+
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionCodeBlockForFrame):
+        (JSC::codeBlockFromArg):
+        (JSC::functionCodeBlockFor):
+        (JSC::JSDollarVMPrototype::finishCreation):
+
+2016-10-31  Saam Barati  <sbarati@apple.com>
+
+        GetByOffset rule is has incorrect assumptions inside arguments elimination phase
+        https://bugs.webkit.org/show_bug.cgi?id=164239
+        <rdar://problem/29032041>
+
+        Reviewed by Keith Miller.
+
+        The rule for GetByOffset assumes that a child will always be transformed before 
+        the user of a child is by assuming its child will already be a phantom allocation.
+        This will almost certainly be true because of how we generate bytecode for
+        arguments allocation and how traversal of the graph works using blocksInNaturalOrder.
+        However, there is no guarantee that blocksInNaturalOrder must first traverse a
+        block's dominator before the block being dominated. Since it's unlikely that this
+        bug will ever be seen by real code, this fix is mostly for maintaining good hygiene.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+
+2016-10-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Implement IntersectionObserver
+        https://bugs.webkit.org/show_bug.cgi?id=159475
+
+        Reviewed by Ryosuke Niwa.
+
+        Add ENABLE_INTERSECTION_OBSERVER, enabled by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-10-31  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Provide an opportunity to clear ScriptValues associated with debugged target
+        https://bugs.webkit.org/show_bug.cgi?id=164167
+        <rdar://problem/29010148>
+
+        Reviewed by Mark Lam.
+
+        * inspector/InspectorAgentBase.h:
+        (Inspector::InspectorAgentBase::discardValues):
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::AgentRegistry::~AgentRegistry):
+        (Inspector::AgentRegistry::discardValues):
+        * inspector/InspectorAgentRegistry.h:
+        New standard agent method to allow the agent to discard values.
+
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::discardValues):
+        Discard ScriptValues in ConsoleMessages.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed):
+        Global object is going away, discard values.
+
+2016-10-31  Keith Miller  <keith_miller@apple.com>
+
+        autogenerated files from wasm.json should be in derived sources.
+        https://bugs.webkit.org/show_bug.cgi?id=164152
+
+        Reviewed by Filip Pizlo.
+
+        Add two new python scripts to the build. These scripts do what the
+        old js script in JSTests did. Previously, changes to wasm.json needed
+        to be manually reflected in WasmOps.h. This patch will auto-build from
+        the json file. That system was unsustainable, especially as future patches
+        will likely add more autogenerated files. The generated header files are
+        identical other than the comment at the top and the order of the opcodes.
+        I believe ordering difference just has to do with the iteration order for
+        sets.
+
+        * DerivedSources.make:
+        * wasm/WasmOps.h: Removed.
+        * wasm/generateWasm.py: Added.
+        (Wasm):
+        (Wasm.__init__):
+        (opcodeIterator):
+        (toCpp):
+        (isNormal):
+        (isUnary):
+        (isBinary):
+        * wasm/generateWasmOpsHeader.py: Added.
+        (cppMacro):
+        (opcodeMacroizer):
+        (ceilDiv):
+        (bitSet):
+        (BinaryOpType):
+        (UnaryOpType):
+        (LoadOpType):
+        (StoreOpType):
+        * wasm/wasm.json: Added.
+
+2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
+        https://bugs.webkit.org/show_bug.cgi?id=164123
+
+        Reviewed by Mark Lam.
+
+        When JSON.stringify encounter the undefined value, the result depends
+        on the context. If it is produced under the object property context, we ignore
+        that property. On the other hand, if it is produced under the array element
+        context, we produce "null".
+
+        For example,
+            // https://tc39.github.io/ecma262/#sec-serializejsonobject section 8.b.
+            // Skip the property that value is undefined.
+            JSON.stringify({ value: undefined });  // => "{}"
+
+            // https://tc39.github.io/ecma262/#sec-serializejsonarray section 8.b.
+            // Write "null" when the element is undefined.
+            JSON.stringify([undefined]);           // => "[null]"
+
+        At that time, we decide the context based on the `holder->inherits(JSArray::info())`.
+        But it is not correct since we have a holder that creates the array element context
+        but it is not JSArray subtype. ES6 Proxy to an array is one example. In that case,
+        `isArray(exec, proxy)` returns `true`, but `inherits(JSArray::info())` returns false.
+        Since we already have this `isArray()` value in Stringifier::Holder, we should reuse
+        this here. And this is the correct behavior in the ES6 spec.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::isArray):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::Holder):
+        (JSC::Stringifier::Holder::appendNextProperty):
+
+2016-10-29  Saam Barati  <sbarati@apple.com>
+
+        We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
+        https://bugs.webkit.org/show_bug.cgi?id=163305
+
+        Reviewed by Keith Miller.
+
+        This creates a new GetById node in the DFG called PureGetById. We emit a
+        PureGetById when we profile that a get_by_id in the baseline never does
+        side effects. PureGetById speculates on the fact that it won't do side
+        effects. If it realizes that it must perform side effects, it will perform
+        the side effect, but also invalidate the CodeBlock that compiled it,
+        which will cause us to exit once we return back to the compiled code.
+        This allows us to have stricter clobberize rules for PureGetById which
+        model how getOwnPropertySlot(VMInquiry) behaves. This means that PureGetByIds
+        can be CSEd with each other, and that other things are more likely to
+        be CSEd around a PureGetById. To profile if a get_by_id does side
+        effects, I've added an extra bit into StructureStubInfo that we write
+        to when performing a get_by_id slow path call. If we notice that we
+        never do effects, inside the ByteCodeParser, we will emit a PureGetById
+        instead of a GetById.
+
+        To justify the performance benefit of this patch, I ran the suite of
+        benchmarks with useAccessInlining=false. This meant that we don't compile
+        any (Multi)GetByOffset/(Multi)PutByOffset. This was just to try to see if
+        this patch is worth anything at all in a world where we emit many
+        PureGetByIds. Running the benchmarks under this mode showed a 3.5% octane
+        improvement and a 15% kraken improvement. However, when running benchmarks
+        with useAccessInlining=true (the default JSC state), this patch is neutral.
+        I think the main reason for this is that the DFG is good at knowing when to
+        emit (Multi)GetByOffset, and most benchmarks that would benefit from
+        PureGetById are already emitting (Multi)GetByOffset. However, PureGetById can be
+        profitable when we encounter code that is too polymorphic for (Multi)GetByOffset.
+        It's reasonable to expect that JS code in the wild will fall into this use
+        case even though it might not be represented in some of the major JS benchmarks.
+        I wrote some microbenchmarks to demonstrate the benefits of PureGetById CSE,
+        and they were 30% (eliminating a few PureGetById from an add expression)
+        to 10x faster (eliminating a PureGetById in a loop).
+
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::reset):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::canBecomeGetArrayLength):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToGetByOffset):
+        (JSC::DFG::Node::convertToMultiGetByOffset):
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileTryGetById):
+        (JSC::DFG::SpeculativeJIT::compilePureGetById):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        * jit/JITOperations.cpp:
+        (JSC::pureGetByIdCommon):
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_try_get_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_try_get_by_id):
+        * jit/Repatch.cpp:
+        (JSC::appropriateOptimizingGetByIdFunction):
+        (JSC::appropriateGenericGetByIdFunction):
+        (JSC::tryCacheGetByID):
+        * jit/Repatch.h:
+        * profiler/ProfilerJettisonReason.cpp:
+        (WTF::printInternal):
+        * profiler/ProfilerJettisonReason.h:
+
+2016-10-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Breakpoints not working in scripts with unicode characters
+        https://bugs.webkit.org/show_bug.cgi?id=164172
+        <rdar://problem/28895862>
+
+        Reviewed by Ryosuke Niwa.
+
+        * parser/Parser.h:
+        (JSC::parse):
+        Ensure we pass the debuggerParseData struct to get populated in the
+        non 8bit string case!
+
+2016-10-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Include identifier name in CallDOMGetter to dump it
+        https://bugs.webkit.org/show_bug.cgi?id=164161
+
+        Reviewed by Mark Lam.
+
+        This patch adds an identifier number to CallDOMGetterData and use it when dumping the data.
+        CallDOMGetter did not include identifier. It made CallDOMGetter super hard to debug when dumping DFG graph.
+
+        The dump becomes like this.
+
+            CallDOMGetter(Cell:@21, JS|MustGen|UseAsOther, Nonboolint32, id0{customGetter}, domJIT = 0x42f8a0, R:World, W:Heap, Exits, ClobbersExit, bc#15)  predicting Nonboolint32
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+
+2016-10-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Rename CallDOM to CallDOMGetter
+        https://bugs.webkit.org/show_bug.cgi?id=164157
+
+        Reviewed by Keith Miller.
+
+        Rename CallDOM to CallDOMGetter to represent that
+        this is used for DOMJIT getter explicitly.
+        CallDOM will be used for DOM functions (like element.getAttribute()) later.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::emitDOMJITGetter):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::blessCallDOMGetter):
+        (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
+        (JSC::DFG::blessCallDOM): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasCallDOMGetterData):
+        (JSC::DFG::Node::callDOMGetterData):
+        (JSC::DFG::Node::hasCallDOMData): Deleted.
+        (JSC::DFG::Node::callDOMData): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCallDOMGetter):
+        (JSC::DFG::SpeculativeJIT::compileCallDOM): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * domjit/DOMJITCallDOMGetterPatchpoint.h: Renamed from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h.
+        (JSC::DOMJIT::CallDOMGetterPatchpoint::create):
+        * domjit/DOMJITGetterSetter.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM): Deleted.
+        * jsc.cpp:
+
+2016-10-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, build fix in CLoop builds after r208063.
+
+        Include required headers.
+
+        * parser/Parser.h:
+        * runtime/Completion.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+
+2016-10-28  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Update reference files for builtins generator tests after r208063.
+
+        Unreviewed test gardening.
+
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
+        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+
+2016-10-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Add wasm/js directory to JSC include directories in CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=164145
+
+        Reviewed by Michael Catanzaro.
+
+        Attempt to fix CMake ports. We include a file under wasm/js.
+        But we didn't add it to JSC include directories.
+
+        * CMakeLists.txt:
+
+2016-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        One file per class for Executable.h/.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=164099
+
+        Reviewed by Saam Barati.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Scripts/builtins/builtins_generate_combined_implementation.py:
+        (BuiltinsCombinedImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generate_separate_implementation.py:
+        (BuiltinsSeparateImplementationGenerator.generate_secondary_header_includes):
+        * builtins/BuiltinExecutables.cpp:
+        * bytecode/CallVariant.h:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::ScriptExecutable::prepareForExecution):
+        * bytecode/CodeOrigin.cpp:
+        * bytecode/EvalCodeCache.h:
+        * bytecode/InlineCallFrame.cpp:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        * bytecompiler/StaticPropertyAnalysis.h:
+        * debugger/DebuggerLocation.cpp:
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGOSRExitPreparation.cpp:
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        * interpreter/StackVisitor.cpp:
+        * jit/JITThunks.cpp:
+        * jit/JITToDFGDeferredCompilationCallback.cpp:
+        * jit/SpecializedThunkJIT.h:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * parser/Parser.h:
+        * runtime/CallData.cpp:
+        * runtime/ConstructData.cpp:
+        * runtime/EvalExecutable.cpp: Copied from Source/JavaScriptCore/runtime/Executable.cpp.
+        (JSC::ExecutableBase::destroy): Deleted.
+        (JSC::ExecutableBase::clearCode): Deleted.
+        (JSC::NativeExecutable::create): Deleted.
+        (JSC::NativeExecutable::destroy): Deleted.
+        (JSC::NativeExecutable::createStructure): Deleted.
+        (JSC::NativeExecutable::finishCreation): Deleted.
+        (JSC::NativeExecutable::NativeExecutable): Deleted.
+        (JSC::ScriptExecutable::ScriptExecutable): Deleted.
+        (JSC::ScriptExecutable::destroy): Deleted.
+        (JSC::ScriptExecutable::installCode): Deleted.
+        (JSC::ScriptExecutable::newCodeBlockFor): Deleted.
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor): Deleted.
+        (JSC::setupLLInt): Deleted.
+        (JSC::setupJIT): Deleted.
+        (JSC::ScriptExecutable::prepareForExecutionImpl): Deleted.
+        (JSC::ProgramExecutable::ProgramExecutable): Deleted.
+        (JSC::ProgramExecutable::destroy): Deleted.
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable): Deleted.
+        (JSC::ModuleProgramExecutable::create): Deleted.
+        (JSC::ModuleProgramExecutable::destroy): Deleted.
+        (JSC::FunctionExecutable::FunctionExecutable): Deleted.
+        (JSC::FunctionExecutable::finishCreation): Deleted.
+        (JSC::FunctionExecutable::destroy): Deleted.
+        (JSC::samplingDescription): Deleted.
+        (JSC::ProgramExecutable::checkSyntax): Deleted.
+        (JSC::ProgramExecutable::initializeGlobalProperties): Deleted.
+        (JSC::ProgramExecutable::visitChildren): Deleted.
+        (JSC::ModuleProgramExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::baselineCodeBlockFor): Deleted.
+        (JSC::FunctionExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::fromGlobalCode): Deleted.
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable): Deleted.
+        (JSC::WebAssemblyExecutable::destroy): Deleted.
+        (JSC::WebAssemblyExecutable::visitChildren): Deleted.
+        (JSC::ExecutableBase::dump): Deleted.
+        (JSC::ExecutableBase::hashFor): Deleted.
+        (JSC::NativeExecutable::hashFor): Deleted.
+        (JSC::ScriptExecutable::hashFor): Deleted.
+        * runtime/EvalExecutable.h: Copied from Source/JavaScriptCore/runtime/Executable.h.
+        (JSC::isCall): Deleted.
+        (JSC::ExecutableBase::ExecutableBase): Deleted.
+        (JSC::ExecutableBase::finishCreation): Deleted.
+        (JSC::ExecutableBase::isEvalExecutable): Deleted.
+        (JSC::ExecutableBase::isFunctionExecutable): Deleted.
+        (JSC::ExecutableBase::isProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isModuleProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isHostFunction): Deleted.
+        (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
+        (JSC::ExecutableBase::createStructure): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeFor): Deleted.
+        (JSC::ExecutableBase::entrypointFor): Deleted.
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor): Deleted.
+        (JSC::ExecutableBase::offsetOfNumParametersFor): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::hasJITCodeFor): Deleted.
+        (JSC::ExecutableBase::intrinsic): Deleted.
+        (JSC::ExecutableBase::intrinsicFor): Deleted.
+        (JSC::ScriptExecutable::source): Deleted.
+        (JSC::ScriptExecutable::sourceID): Deleted.
+        (JSC::ScriptExecutable::sourceURL): Deleted.
+        (JSC::ScriptExecutable::firstLine): Deleted.
+        (JSC::ScriptExecutable::setOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::hasOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::overrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::lastLine): Deleted.
+        (JSC::ScriptExecutable::startColumn): Deleted.
+        (JSC::ScriptExecutable::endColumn): Deleted.
+        (JSC::ScriptExecutable::typeProfilingStartOffset): Deleted.
+        (JSC::ScriptExecutable::typeProfilingEndOffset): Deleted.
+        (JSC::ScriptExecutable::usesEval): Deleted.
+        (JSC::ScriptExecutable::usesArguments): Deleted.
+        (JSC::ScriptExecutable::isArrowFunctionContext): Deleted.
+        (JSC::ScriptExecutable::isStrictMode): Deleted.
+        (JSC::ScriptExecutable::derivedContextType): Deleted.
+        (JSC::ScriptExecutable::evalContextType): Deleted.
+        (JSC::ScriptExecutable::ecmaMode): Deleted.
+        (JSC::ScriptExecutable::setNeverInline): Deleted.
+        (JSC::ScriptExecutable::setNeverOptimize): Deleted.
+        (JSC::ScriptExecutable::setNeverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::setDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::setCanUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::neverInline): Deleted.
+        (JSC::ScriptExecutable::neverOptimize): Deleted.
+        (JSC::ScriptExecutable::neverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::didTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::isInliningCandidate): Deleted.
+        (JSC::ScriptExecutable::isOkToOptimize): Deleted.
+        (JSC::ScriptExecutable::canUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::features): Deleted.
+        (JSC::ScriptExecutable::recordParse): Deleted.
+        (JSC::ScriptExecutable::finishCreation): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * runtime/Executable.cpp: Removed.
+        * runtime/Executable.h: Removed.
+        * runtime/ExecutableBase.cpp: Copied from Source/JavaScriptCore/runtime/Executable.cpp.
+        (JSC::NativeExecutable::create): Deleted.
+        (JSC::NativeExecutable::destroy): Deleted.
+        (JSC::NativeExecutable::createStructure): Deleted.
+        (JSC::NativeExecutable::finishCreation): Deleted.
+        (JSC::NativeExecutable::NativeExecutable): Deleted.
+        (JSC::ScriptExecutable::ScriptExecutable): Deleted.
+        (JSC::ScriptExecutable::destroy): Deleted.
+        (JSC::ScriptExecutable::installCode): Deleted.
+        (JSC::ScriptExecutable::newCodeBlockFor): Deleted.
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor): Deleted.
+        (JSC::setupLLInt): Deleted.
+        (JSC::setupJIT): Deleted.
+        (JSC::ScriptExecutable::prepareForExecutionImpl): Deleted.
+        (JSC::EvalExecutable::create): Deleted.
+        (JSC::EvalExecutable::EvalExecutable): Deleted.
+        (JSC::EvalExecutable::destroy): Deleted.
+        (JSC::ProgramExecutable::ProgramExecutable): Deleted.
+        (JSC::ProgramExecutable::destroy): Deleted.
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable): Deleted.
+        (JSC::ModuleProgramExecutable::create): Deleted.
+        (JSC::ModuleProgramExecutable::destroy): Deleted.
+        (JSC::FunctionExecutable::FunctionExecutable): Deleted.
+        (JSC::FunctionExecutable::finishCreation): Deleted.
+        (JSC::FunctionExecutable::destroy): Deleted.
+        (JSC::samplingDescription): Deleted.
+        (JSC::EvalExecutable::visitChildren): Deleted.
+        (JSC::ProgramExecutable::checkSyntax): Deleted.
+        (JSC::ProgramExecutable::initializeGlobalProperties): Deleted.
+        (JSC::ProgramExecutable::visitChildren): Deleted.
+        (JSC::ModuleProgramExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::baselineCodeBlockFor): Deleted.
+        (JSC::FunctionExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::fromGlobalCode): Deleted.
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable): Deleted.
+        (JSC::WebAssemblyExecutable::destroy): Deleted.
+        (JSC::WebAssemblyExecutable::visitChildren): Deleted.
+        (JSC::NativeExecutable::hashFor): Deleted.
+        (JSC::ScriptExecutable::hashFor): Deleted.
+        * runtime/ExecutableBase.h: Copied from Source/JavaScriptCore/runtime/Executable.h.
+        (JSC::ScriptExecutable::source): Deleted.
+        (JSC::ScriptExecutable::sourceID): Deleted.
+        (JSC::ScriptExecutable::sourceURL): Deleted.
+        (JSC::ScriptExecutable::firstLine): Deleted.
+        (JSC::ScriptExecutable::setOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::hasOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::overrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::lastLine): Deleted.
+        (JSC::ScriptExecutable::startColumn): Deleted.
+        (JSC::ScriptExecutable::endColumn): Deleted.
+        (JSC::ScriptExecutable::typeProfilingStartOffset): Deleted.
+        (JSC::ScriptExecutable::typeProfilingEndOffset): Deleted.
+        (JSC::ScriptExecutable::usesEval): Deleted.
+        (JSC::ScriptExecutable::usesArguments): Deleted.
+        (JSC::ScriptExecutable::isArrowFunctionContext): Deleted.
+        (JSC::ScriptExecutable::isStrictMode): Deleted.
+        (JSC::ScriptExecutable::derivedContextType): Deleted.
+        (JSC::ScriptExecutable::evalContextType): Deleted.
+        (JSC::ScriptExecutable::ecmaMode): Deleted.
+        (JSC::ScriptExecutable::setNeverInline): Deleted.
+        (JSC::ScriptExecutable::setNeverOptimize): Deleted.
+        (JSC::ScriptExecutable::setNeverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::setDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::setCanUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::neverInline): Deleted.
+        (JSC::ScriptExecutable::neverOptimize): Deleted.
+        (JSC::ScriptExecutable::neverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::didTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::isInliningCandidate): Deleted.
+        (JSC::ScriptExecutable::isOkToOptimize): Deleted.
+        (JSC::ScriptExecutable::canUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::features): Deleted.
+        (JSC::ScriptExecutable::recordParse): Deleted.
+        (JSC::ScriptExecutable::finishCreation): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * runtime/FunctionExecutable.cpp: Copied from Source/JavaScriptCore/runtime/Executable.cpp.
+        (JSC::ExecutableBase::destroy): Deleted.
+        (JSC::ExecutableBase::clearCode): Deleted.
+        (JSC::NativeExecutable::create): Deleted.
+        (JSC::NativeExecutable::destroy): Deleted.
+        (JSC::NativeExecutable::createStructure): Deleted.
+        (JSC::NativeExecutable::finishCreation): Deleted.
+        (JSC::NativeExecutable::NativeExecutable): Deleted.
+        (JSC::ScriptExecutable::ScriptExecutable): Deleted.
+        (JSC::ScriptExecutable::destroy): Deleted.
+        (JSC::ScriptExecutable::installCode): Deleted.
+        (JSC::ScriptExecutable::newCodeBlockFor): Deleted.
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor): Deleted.
+        (JSC::setupLLInt): Deleted.
+        (JSC::setupJIT): Deleted.
+        (JSC::ScriptExecutable::prepareForExecutionImpl): Deleted.
+        (JSC::EvalExecutable::create): Deleted.
+        (JSC::EvalExecutable::EvalExecutable): Deleted.
+        (JSC::EvalExecutable::destroy): Deleted.
+        (JSC::ProgramExecutable::ProgramExecutable): Deleted.
+        (JSC::ProgramExecutable::destroy): Deleted.
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable): Deleted.
+        (JSC::ModuleProgramExecutable::create): Deleted.
+        (JSC::ModuleProgramExecutable::destroy): Deleted.
+        (JSC::samplingDescription): Deleted.
+        (JSC::EvalExecutable::visitChildren): Deleted.
+        (JSC::ProgramExecutable::checkSyntax): Deleted.
+        (JSC::ProgramExecutable::initializeGlobalProperties): Deleted.
+        (JSC::ProgramExecutable::visitChildren): Deleted.
+        (JSC::ModuleProgramExecutable::visitChildren): Deleted.
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable): Deleted.
+        (JSC::WebAssemblyExecutable::destroy): Deleted.
+        (JSC::WebAssemblyExecutable::visitChildren): Deleted.
+        (JSC::ExecutableBase::dump): Deleted.
+        (JSC::ExecutableBase::hashFor): Deleted.
+        (JSC::NativeExecutable::hashFor): Deleted.
+        (JSC::ScriptExecutable::hashFor): Deleted.
+        * runtime/FunctionExecutable.h: Copied from Source/JavaScriptCore/runtime/Executable.h.
+        (JSC::isCall): Deleted.
+        (JSC::ExecutableBase::ExecutableBase): Deleted.
+        (JSC::ExecutableBase::finishCreation): Deleted.
+        (JSC::ExecutableBase::isEvalExecutable): Deleted.
+        (JSC::ExecutableBase::isFunctionExecutable): Deleted.
+        (JSC::ExecutableBase::isProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isModuleProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isHostFunction): Deleted.
+        (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
+        (JSC::ExecutableBase::createStructure): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeFor): Deleted.
+        (JSC::ExecutableBase::entrypointFor): Deleted.
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor): Deleted.
+        (JSC::ExecutableBase::offsetOfNumParametersFor): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::hasJITCodeFor): Deleted.
+        (JSC::ExecutableBase::intrinsic): Deleted.
+        (JSC::ExecutableBase::intrinsicFor): Deleted.
+        (JSC::ScriptExecutable::source): Deleted.
+        (JSC::ScriptExecutable::sourceID): Deleted.
+        (JSC::ScriptExecutable::sourceURL): Deleted.
+        (JSC::ScriptExecutable::firstLine): Deleted.
+        (JSC::ScriptExecutable::setOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::hasOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::overrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::lastLine): Deleted.
+        (JSC::ScriptExecutable::startColumn): Deleted.
+        (JSC::ScriptExecutable::endColumn): Deleted.
+        (JSC::ScriptExecutable::typeProfilingStartOffset): Deleted.
+        (JSC::ScriptExecutable::typeProfilingEndOffset): Deleted.
+        (JSC::ScriptExecutable::usesEval): Deleted.
+        (JSC::ScriptExecutable::usesArguments): Deleted.
+        (JSC::ScriptExecutable::isArrowFunctionContext): Deleted.
+        (JSC::ScriptExecutable::isStrictMode): Deleted.
+        (JSC::ScriptExecutable::derivedContextType): Deleted.
+        (JSC::ScriptExecutable::evalContextType): Deleted.
+        (JSC::ScriptExecutable::ecmaMode): Deleted.
+        (JSC::ScriptExecutable::setNeverInline): Deleted.
+        (JSC::ScriptExecutable::setNeverOptimize): Deleted.
+        (JSC::ScriptExecutable::setNeverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::setDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::setCanUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::neverInline): Deleted.
+        (JSC::ScriptExecutable::neverOptimize): Deleted.
+        (JSC::ScriptExecutable::neverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::didTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::isInliningCandidate): Deleted.
+        (JSC::ScriptExecutable::isOkToOptimize): Deleted.
+        (JSC::ScriptExecutable::canUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::features): Deleted.
+        (JSC::ScriptExecutable::recordParse): Deleted.
+        (JSC::ScriptExecutable::finishCreation): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * runtime/FunctionExecutableDump.h:
+        * runtime/JSArray.cpp:
+        * runtime/JSFunctionInlines.h:
+        * runtime/JSModuleRecord.cpp:
+        * runtime/JSObject.cpp:
+        * runtime/Lookup.cpp:
+        * runtime/ModuleProgramExecutable.cpp: Copied from Source/JavaScriptCore/runtime/Executable.cpp.
+        (JSC::ExecutableBase::destroy): Deleted.
+        (JSC::ExecutableBase::clearCode): Deleted.
+        (JSC::NativeExecutable::create): Deleted.
+        (JSC::NativeExecutable::destroy): Deleted.
+        (JSC::NativeExecutable::createStructure): Deleted.
+        (JSC::NativeExecutable::finishCreation): Deleted.
+        (JSC::NativeExecutable::NativeExecutable): Deleted.
+        (JSC::ScriptExecutable::ScriptExecutable): Deleted.
+        (JSC::ScriptExecutable::destroy): Deleted.
+        (JSC::ScriptExecutable::installCode): Deleted.
+        (JSC::ScriptExecutable::newCodeBlockFor): Deleted.
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor): Deleted.
+        (JSC::setupLLInt): Deleted.
+        (JSC::setupJIT): Deleted.
+        (JSC::ScriptExecutable::prepareForExecutionImpl): Deleted.
+        (JSC::EvalExecutable::create): Deleted.
+        (JSC::EvalExecutable::EvalExecutable): Deleted.
+        (JSC::EvalExecutable::destroy): Deleted.
+        (JSC::ProgramExecutable::ProgramExecutable): Deleted.
+        (JSC::ProgramExecutable::destroy): Deleted.
+        (JSC::FunctionExecutable::FunctionExecutable): Deleted.
+        (JSC::FunctionExecutable::finishCreation): Deleted.
+        (JSC::FunctionExecutable::destroy): Deleted.
+        (JSC::samplingDescription): Deleted.
+        (JSC::EvalExecutable::visitChildren): Deleted.
+        (JSC::ProgramExecutable::checkSyntax): Deleted.
+        (JSC::ProgramExecutable::initializeGlobalProperties): Deleted.
+        (JSC::ProgramExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::baselineCodeBlockFor): Deleted.
+        (JSC::FunctionExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::fromGlobalCode): Deleted.
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable): Deleted.
+        (JSC::WebAssemblyExecutable::destroy): Deleted.
+        (JSC::WebAssemblyExecutable::visitChildren): Deleted.
+        (JSC::ExecutableBase::dump): Deleted.
+        (JSC::ExecutableBase::hashFor): Deleted.
+        (JSC::NativeExecutable::hashFor): Deleted.
+        (JSC::ScriptExecutable::hashFor): Deleted.
+        * runtime/ModuleProgramExecutable.h: Copied from Source/JavaScriptCore/runtime/Executable.h.
+        (JSC::isCall): Deleted.
+        (JSC::ExecutableBase::ExecutableBase): Deleted.
+        (JSC::ExecutableBase::finishCreation): Deleted.
+        (JSC::ExecutableBase::isEvalExecutable): Deleted.
+        (JSC::ExecutableBase::isFunctionExecutable): Deleted.
+        (JSC::ExecutableBase::isProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isModuleProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isHostFunction): Deleted.
+        (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
+        (JSC::ExecutableBase::createStructure): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeFor): Deleted.
+        (JSC::ExecutableBase::entrypointFor): Deleted.
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor): Deleted.
+        (JSC::ExecutableBase::offsetOfNumParametersFor): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::hasJITCodeFor): Deleted.
+        (JSC::ExecutableBase::intrinsic): Deleted.
+        (JSC::ExecutableBase::intrinsicFor): Deleted.
+        (JSC::ScriptExecutable::source): Deleted.
+        (JSC::ScriptExecutable::sourceID): Deleted.
+        (JSC::ScriptExecutable::sourceURL): Deleted.
+        (JSC::ScriptExecutable::firstLine): Deleted.
+        (JSC::ScriptExecutable::setOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::hasOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::overrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::lastLine): Deleted.
+        (JSC::ScriptExecutable::startColumn): Deleted.
+        (JSC::ScriptExecutable::endColumn): Deleted.
+        (JSC::ScriptExecutable::typeProfilingStartOffset): Deleted.
+        (JSC::ScriptExecutable::typeProfilingEndOffset): Deleted.
+        (JSC::ScriptExecutable::usesEval): Deleted.
+        (JSC::ScriptExecutable::usesArguments): Deleted.
+        (JSC::ScriptExecutable::isArrowFunctionContext): Deleted.
+        (JSC::ScriptExecutable::isStrictMode): Deleted.
+        (JSC::ScriptExecutable::derivedContextType): Deleted.
+        (JSC::ScriptExecutable::evalContextType): Deleted.
+        (JSC::ScriptExecutable::ecmaMode): Deleted.
+        (JSC::ScriptExecutable::setNeverInline): Deleted.
+        (JSC::ScriptExecutable::setNeverOptimize): Deleted.
+        (JSC::ScriptExecutable::setNeverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::setDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::setCanUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::neverInline): Deleted.
+        (JSC::ScriptExecutable::neverOptimize): Deleted.
+        (JSC::ScriptExecutable::neverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::didTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::isInliningCandidate): Deleted.
+        (JSC::ScriptExecutable::isOkToOptimize): Deleted.
+        (JSC::ScriptExecutable::canUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::features): Deleted.
+        (JSC::ScriptExecutable::recordParse): Deleted.
+        (JSC::ScriptExecutable::finishCreation): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * runtime/NativeExecutable.cpp: Copied from Source/JavaScriptCore/runtime/Executable.cpp.
+        (JSC::ExecutableBase::destroy): Deleted.
+        (JSC::ExecutableBase::clearCode): Deleted.
+        (JSC::ScriptExecutable::ScriptExecutable): Deleted.
+        (JSC::ScriptExecutable::destroy): Deleted.
+        (JSC::ScriptExecutable::installCode): Deleted.
+        (JSC::ScriptExecutable::newCodeBlockFor): Deleted.
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor): Deleted.
+        (JSC::setupLLInt): Deleted.
+        (JSC::setupJIT): Deleted.
+        (JSC::ScriptExecutable::prepareForExecutionImpl): Deleted.
+        (JSC::EvalExecutable::create): Deleted.
+        (JSC::EvalExecutable::EvalExecutable): Deleted.
+        (JSC::EvalExecutable::destroy): Deleted.
+        (JSC::ProgramExecutable::ProgramExecutable): Deleted.
+        (JSC::ProgramExecutable::destroy): Deleted.
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable): Deleted.
+        (JSC::ModuleProgramExecutable::create): Deleted.
+        (JSC::ModuleProgramExecutable::destroy): Deleted.
+        (JSC::FunctionExecutable::FunctionExecutable): Deleted.
+        (JSC::FunctionExecutable::finishCreation): Deleted.
+        (JSC::FunctionExecutable::destroy): Deleted.
+        (JSC::samplingDescription): Deleted.
+        (JSC::EvalExecutable::visitChildren): Deleted.
+        (JSC::ProgramExecutable::checkSyntax): Deleted.
+        (JSC::ProgramExecutable::initializeGlobalProperties): Deleted.
+        (JSC::ProgramExecutable::visitChildren): Deleted.
+        (JSC::ModuleProgramExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::baselineCodeBlockFor): Deleted.
+        (JSC::FunctionExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::fromGlobalCode): Deleted.
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable): Deleted.
+        (JSC::WebAssemblyExecutable::destroy): Deleted.
+        (JSC::WebAssemblyExecutable::visitChildren): Deleted.
+        (JSC::ExecutableBase::dump): Deleted.
+        (JSC::ExecutableBase::hashFor): Deleted.
+        (JSC::ScriptExecutable::hashFor): Deleted.
+        * runtime/NativeExecutable.h: Copied from Source/JavaScriptCore/runtime/Executable.h.
+        (JSC::isCall): Deleted.
+        (JSC::ExecutableBase::ExecutableBase): Deleted.
+        (JSC::ExecutableBase::finishCreation): Deleted.
+        (JSC::ExecutableBase::isEvalExecutable): Deleted.
+        (JSC::ExecutableBase::isFunctionExecutable): Deleted.
+        (JSC::ExecutableBase::isProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isModuleProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isHostFunction): Deleted.
+        (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
+        (JSC::ExecutableBase::createStructure): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeFor): Deleted.
+        (JSC::ExecutableBase::entrypointFor): Deleted.
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor): Deleted.
+        (JSC::ExecutableBase::offsetOfNumParametersFor): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::hasJITCodeFor): Deleted.
+        (JSC::ExecutableBase::intrinsic): Deleted.
+        (JSC::ExecutableBase::intrinsicFor): Deleted.
+        (JSC::ScriptExecutable::source): Deleted.
+        (JSC::ScriptExecutable::sourceID): Deleted.
+        (JSC::ScriptExecutable::sourceURL): Deleted.
+        (JSC::ScriptExecutable::firstLine): Deleted.
+        (JSC::ScriptExecutable::setOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::hasOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::overrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::lastLine): Deleted.
+        (JSC::ScriptExecutable::startColumn): Deleted.
+        (JSC::ScriptExecutable::endColumn): Deleted.
+        (JSC::ScriptExecutable::typeProfilingStartOffset): Deleted.
+        (JSC::ScriptExecutable::typeProfilingEndOffset): Deleted.
+        (JSC::ScriptExecutable::usesEval): Deleted.
+        (JSC::ScriptExecutable::usesArguments): Deleted.
+        (JSC::ScriptExecutable::isArrowFunctionContext): Deleted.
+        (JSC::ScriptExecutable::isStrictMode): Deleted.
+        (JSC::ScriptExecutable::derivedContextType): Deleted.
+        (JSC::ScriptExecutable::evalContextType): Deleted.
+        (JSC::ScriptExecutable::ecmaMode): Deleted.
+        (JSC::ScriptExecutable::setNeverInline): Deleted.
+        (JSC::ScriptExecutable::setNeverOptimize): Deleted.
+        (JSC::ScriptExecutable::setNeverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::setDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::setCanUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::neverInline): Deleted.
+        (JSC::ScriptExecutable::neverOptimize): Deleted.
+        (JSC::ScriptExecutable::neverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::didTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::isInliningCandidate): Deleted.
+        (JSC::ScriptExecutable::isOkToOptimize): Deleted.
+        (JSC::ScriptExecutable::canUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::features): Deleted.
+        (JSC::ScriptExecutable::recordParse): Deleted.
+        (JSC::ScriptExecutable::finishCreation): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * runtime/ProgramExecutable.cpp: Copied from Source/JavaScriptCore/runtime/Executable.cpp.
+        (JSC::ExecutableBase::destroy): Deleted.
+        (JSC::ExecutableBase::clearCode): Deleted.
+        (JSC::NativeExecutable::create): Deleted.
+        (JSC::NativeExecutable::destroy): Deleted.
+        (JSC::NativeExecutable::createStructure): Deleted.
+        (JSC::NativeExecutable::finishCreation): Deleted.
+        (JSC::NativeExecutable::NativeExecutable): Deleted.
+        (JSC::ScriptExecutable::ScriptExecutable): Deleted.
+        (JSC::ScriptExecutable::destroy): Deleted.
+        (JSC::ScriptExecutable::installCode): Deleted.
+        (JSC::ScriptExecutable::newCodeBlockFor): Deleted.
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor): Deleted.
+        (JSC::setupLLInt): Deleted.
+        (JSC::setupJIT): Deleted.
+        (JSC::ScriptExecutable::prepareForExecutionImpl): Deleted.
+        (JSC::EvalExecutable::create): Deleted.
+        (JSC::EvalExecutable::EvalExecutable): Deleted.
+        (JSC::EvalExecutable::destroy): Deleted.
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable): Deleted.
+        (JSC::ModuleProgramExecutable::create): Deleted.
+        (JSC::ModuleProgramExecutable::destroy): Deleted.
+        (JSC::FunctionExecutable::FunctionExecutable): Deleted.
+        (JSC::FunctionExecutable::finishCreation): Deleted.
+        (JSC::FunctionExecutable::destroy): Deleted.
+        (JSC::samplingDescription): Deleted.
+        (JSC::EvalExecutable::visitChildren): Deleted.
+        (JSC::ModuleProgramExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::baselineCodeBlockFor): Deleted.
+        (JSC::FunctionExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::fromGlobalCode): Deleted.
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable): Deleted.
+        (JSC::WebAssemblyExecutable::destroy): Deleted.
+        (JSC::WebAssemblyExecutable::visitChildren): Deleted.
+        (JSC::ExecutableBase::dump): Deleted.
+        (JSC::ExecutableBase::hashFor): Deleted.
+        (JSC::NativeExecutable::hashFor): Deleted.
+        (JSC::ScriptExecutable::hashFor): Deleted.
+        * runtime/ProgramExecutable.h: Copied from Source/JavaScriptCore/runtime/Executable.h.
+        (JSC::isCall): Deleted.
+        (JSC::ExecutableBase::ExecutableBase): Deleted.
+        (JSC::ExecutableBase::finishCreation): Deleted.
+        (JSC::ExecutableBase::isEvalExecutable): Deleted.
+        (JSC::ExecutableBase::isFunctionExecutable): Deleted.
+        (JSC::ExecutableBase::isProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isModuleProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isHostFunction): Deleted.
+        (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
+        (JSC::ExecutableBase::createStructure): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeFor): Deleted.
+        (JSC::ExecutableBase::entrypointFor): Deleted.
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor): Deleted.
+        (JSC::ExecutableBase::offsetOfNumParametersFor): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::hasJITCodeFor): Deleted.
+        (JSC::ExecutableBase::intrinsic): Deleted.
+        (JSC::ExecutableBase::intrinsicFor): Deleted.
+        (JSC::ScriptExecutable::source): Deleted.
+        (JSC::ScriptExecutable::sourceID): Deleted.
+        (JSC::ScriptExecutable::sourceURL): Deleted.
+        (JSC::ScriptExecutable::firstLine): Deleted.
+        (JSC::ScriptExecutable::setOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::hasOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::overrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::lastLine): Deleted.
+        (JSC::ScriptExecutable::startColumn): Deleted.
+        (JSC::ScriptExecutable::endColumn): Deleted.
+        (JSC::ScriptExecutable::typeProfilingStartOffset): Deleted.
+        (JSC::ScriptExecutable::typeProfilingEndOffset): Deleted.
+        (JSC::ScriptExecutable::usesEval): Deleted.
+        (JSC::ScriptExecutable::usesArguments): Deleted.
+        (JSC::ScriptExecutable::isArrowFunctionContext): Deleted.
+        (JSC::ScriptExecutable::isStrictMode): Deleted.
+        (JSC::ScriptExecutable::derivedContextType): Deleted.
+        (JSC::ScriptExecutable::evalContextType): Deleted.
+        (JSC::ScriptExecutable::ecmaMode): Deleted.
+        (JSC::ScriptExecutable::setNeverInline): Deleted.
+        (JSC::ScriptExecutable::setNeverOptimize): Deleted.
+        (JSC::ScriptExecutable::setNeverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::setDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::setCanUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::neverInline): Deleted.
+        (JSC::ScriptExecutable::neverOptimize): Deleted.
+        (JSC::ScriptExecutable::neverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::didTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::isInliningCandidate): Deleted.
+        (JSC::ScriptExecutable::isOkToOptimize): Deleted.
+        (JSC::ScriptExecutable::canUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::features): Deleted.
+        (JSC::ScriptExecutable::recordParse): Deleted.
+        (JSC::ScriptExecutable::finishCreation): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * runtime/SamplingProfiler.cpp:
+        * runtime/ScriptExecutable.cpp: Copied from Source/JavaScriptCore/runtime/Executable.cpp.
+        (JSC::ExecutableBase::destroy): Deleted.
+        (JSC::ExecutableBase::clearCode): Deleted.
+        (JSC::NativeExecutable::create): Deleted.
+        (JSC::NativeExecutable::destroy): Deleted.
+        (JSC::NativeExecutable::createStructure): Deleted.
+        (JSC::NativeExecutable::finishCreation): Deleted.
+        (JSC::NativeExecutable::NativeExecutable): Deleted.
+        (JSC::EvalExecutable::create): Deleted.
+        (JSC::EvalExecutable::EvalExecutable): Deleted.
+        (JSC::EvalExecutable::destroy): Deleted.
+        (JSC::ProgramExecutable::ProgramExecutable): Deleted.
+        (JSC::ProgramExecutable::destroy): Deleted.
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable): Deleted.
+        (JSC::ModuleProgramExecutable::create): Deleted.
+        (JSC::ModuleProgramExecutable::destroy): Deleted.
+        (JSC::FunctionExecutable::FunctionExecutable): Deleted.
+        (JSC::FunctionExecutable::finishCreation): Deleted.
+        (JSC::FunctionExecutable::destroy): Deleted.
+        (JSC::samplingDescription): Deleted.
+        (JSC::EvalExecutable::visitChildren): Deleted.
+        (JSC::ProgramExecutable::checkSyntax): Deleted.
+        (JSC::ProgramExecutable::initializeGlobalProperties): Deleted.
+        (JSC::ProgramExecutable::visitChildren): Deleted.
+        (JSC::ModuleProgramExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::baselineCodeBlockFor): Deleted.
+        (JSC::FunctionExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::fromGlobalCode): Deleted.
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable): Deleted.
+        (JSC::WebAssemblyExecutable::destroy): Deleted.
+        (JSC::WebAssemblyExecutable::visitChildren): Deleted.
+        (JSC::ExecutableBase::dump): Deleted.
+        (JSC::ExecutableBase::hashFor): Deleted.
+        (JSC::NativeExecutable::hashFor): Deleted.
+        * runtime/ScriptExecutable.h: Copied from Source/JavaScriptCore/runtime/Executable.h.
+        (): Deleted.
+        (JSC::isCall): Deleted.
+        (JSC::ExecutableBase::ExecutableBase): Deleted.
+        (JSC::ExecutableBase::finishCreation): Deleted.
+        (JSC::ExecutableBase::isEvalExecutable): Deleted.
+        (JSC::ExecutableBase::isFunctionExecutable): Deleted.
+        (JSC::ExecutableBase::isProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isModuleProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isHostFunction): Deleted.
+        (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
+        (JSC::ExecutableBase::createStructure): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeFor): Deleted.
+        (JSC::ExecutableBase::entrypointFor): Deleted.
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor): Deleted.
+        (JSC::ExecutableBase::offsetOfNumParametersFor): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::hasJITCodeFor): Deleted.
+        (JSC::ExecutableBase::intrinsic): Deleted.
+        (JSC::ExecutableBase::intrinsicFor): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+        * runtime/StringConstructor.cpp:
+        * runtime/StringPrototype.cpp:
+        * runtime/WebAssemblyExecutable.cpp: Copied from Source/JavaScriptCore/runtime/Executable.cpp.
+        (JSC::ExecutableBase::destroy): Deleted.
+        (JSC::ExecutableBase::clearCode): Deleted.
+        (JSC::NativeExecutable::create): Deleted.
+        (JSC::NativeExecutable::destroy): Deleted.
+        (JSC::NativeExecutable::createStructure): Deleted.
+        (JSC::NativeExecutable::finishCreation): Deleted.
+        (JSC::NativeExecutable::NativeExecutable): Deleted.
+        (JSC::ScriptExecutable::ScriptExecutable): Deleted.
+        (JSC::ScriptExecutable::destroy): Deleted.
+        (JSC::ScriptExecutable::installCode): Deleted.
+        (JSC::ScriptExecutable::newCodeBlockFor): Deleted.
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor): Deleted.
+        (JSC::setupLLInt): Deleted.
+        (JSC::setupJIT): Deleted.
+        (JSC::ScriptExecutable::prepareForExecutionImpl): Deleted.
+        (JSC::EvalExecutable::create): Deleted.
+        (JSC::EvalExecutable::EvalExecutable): Deleted.
+        (JSC::EvalExecutable::destroy): Deleted.
+        (JSC::ProgramExecutable::ProgramExecutable): Deleted.
+        (JSC::ProgramExecutable::destroy): Deleted.
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable): Deleted.
+        (JSC::ModuleProgramExecutable::create): Deleted.
+        (JSC::ModuleProgramExecutable::destroy): Deleted.
+        (JSC::FunctionExecutable::FunctionExecutable): Deleted.
+        (JSC::FunctionExecutable::finishCreation): Deleted.
+        (JSC::FunctionExecutable::destroy): Deleted.
+        (JSC::samplingDescription): Deleted.
+        (JSC::EvalExecutable::visitChildren): Deleted.
+        (JSC::ProgramExecutable::checkSyntax): Deleted.
+        (JSC::ProgramExecutable::initializeGlobalProperties): Deleted.
+        (JSC::ProgramExecutable::visitChildren): Deleted.
+        (JSC::ModuleProgramExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::baselineCodeBlockFor): Deleted.
+        (JSC::FunctionExecutable::visitChildren): Deleted.
+        (JSC::FunctionExecutable::fromGlobalCode): Deleted.
+        (JSC::ExecutableBase::dump): Deleted.
+        (JSC::ExecutableBase::hashFor): Deleted.
+        (JSC::NativeExecutable::hashFor): Deleted.
+        (JSC::ScriptExecutable::hashFor): Deleted.
+        * runtime/WebAssemblyExecutable.h: Copied from Source/JavaScriptCore/runtime/Executable.h.
+        (JSC::isCall): Deleted.
+        (JSC::ExecutableBase::ExecutableBase): Deleted.
+        (JSC::ExecutableBase::finishCreation): Deleted.
+        (JSC::ExecutableBase::isEvalExecutable): Deleted.
+        (JSC::ExecutableBase::isFunctionExecutable): Deleted.
+        (JSC::ExecutableBase::isProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isModuleProgramExecutable): Deleted.
+        (JSC::ExecutableBase::isHostFunction): Deleted.
+        (JSC::ExecutableBase::isWebAssemblyExecutable): Deleted.
+        (JSC::ExecutableBase::createStructure): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::generatedJITCodeFor): Deleted.
+        (JSC::ExecutableBase::entrypointFor): Deleted.
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor): Deleted.
+        (JSC::ExecutableBase::offsetOfNumParametersFor): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForCall): Deleted.
+        (JSC::ExecutableBase::hasJITCodeForConstruct): Deleted.
+        (JSC::ExecutableBase::hasJITCodeFor): Deleted.
+        (JSC::ExecutableBase::intrinsic): Deleted.
+        (JSC::ExecutableBase::intrinsicFor): Deleted.
+        (JSC::ScriptExecutable::source): Deleted.
+        (JSC::ScriptExecutable::sourceID): Deleted.
+        (JSC::ScriptExecutable::sourceURL): Deleted.
+        (JSC::ScriptExecutable::firstLine): Deleted.
+        (JSC::ScriptExecutable::setOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::hasOverrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::overrideLineNumber): Deleted.
+        (JSC::ScriptExecutable::lastLine): Deleted.
+        (JSC::ScriptExecutable::startColumn): Deleted.
+        (JSC::ScriptExecutable::endColumn): Deleted.
+        (JSC::ScriptExecutable::typeProfilingStartOffset): Deleted.
+        (JSC::ScriptExecutable::typeProfilingEndOffset): Deleted.
+        (JSC::ScriptExecutable::usesEval): Deleted.
+        (JSC::ScriptExecutable::usesArguments): Deleted.
+        (JSC::ScriptExecutable::isArrowFunctionContext): Deleted.
+        (JSC::ScriptExecutable::isStrictMode): Deleted.
+        (JSC::ScriptExecutable::derivedContextType): Deleted.
+        (JSC::ScriptExecutable::evalContextType): Deleted.
+        (JSC::ScriptExecutable::ecmaMode): Deleted.
+        (JSC::ScriptExecutable::setNeverInline): Deleted.
+        (JSC::ScriptExecutable::setNeverOptimize): Deleted.
+        (JSC::ScriptExecutable::setNeverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::setDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::setCanUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::neverInline): Deleted.
+        (JSC::ScriptExecutable::neverOptimize): Deleted.
+        (JSC::ScriptExecutable::neverFTLOptimize): Deleted.
+        (JSC::ScriptExecutable::didTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::isInliningCandidate): Deleted.
+        (JSC::ScriptExecutable::isOkToOptimize): Deleted.
+        (JSC::ScriptExecutable::canUseOSRExitFuzzing): Deleted.
+        (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop): Deleted.
+        (JSC::ScriptExecutable::features): Deleted.
+        (JSC::ScriptExecutable::recordParse): Deleted.
+        (JSC::ScriptExecutable::finishCreation): Deleted.
+        (JSC::ScriptExecutable::prepareForExecution): Deleted.
+
+2016-10-20  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] implement runtime for async functions
+        https://bugs.webkit.org/show_bug.cgi?id=163760
+
+        Reviewed by Yusuke Suzuki.
+
+        Async functions generate bytecode equivalent to the following, which is
+        highly dependent on the Generator implementation:
+
+        ```
+        // Before translation:
+        async function asyncfn() {}
+
+        // After translation:
+        function asyncfn() {
+            let generator = {
+                @generatorNext: function(@generator, @generatorState, @generatorValue, @generatorResumeMode, @generatorFrameState) {
+                    // Body of async function
+                },
+                @generatorState: 0,
+                @generatorThis: this,
+                @generatorFrameState: <frame state>,
+            };
+            return @asyncFunctionResume(generator, undefined, GeneratorResumeMode::NormalMode);
+        }
+        ```
+
+        Await Expressions are equivalent to non-delegating Yield expressions, and emit identical bytecode.
+
+        There are some caveats to be addressed later:
+
+        1) the `op_to_this` is always performed, whether it's used or not, like normal generators. (https://bugs.webkit.org/show_bug.cgi?id=151586)
+
+        2) for async arrow functions, the home object is always stored on the "body" function, regardless of whether it's needed or
+        not, for the same reason as #1 (and should also be fixed as part of https://bugs.webkit.org/show_bug.cgi?id=151586)
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/AsyncFunctionPrototype.js: Added.
+        (asyncFunctionResume):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::isArrowFunction):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionExpressionCommon):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionNode::emitBytecode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncCommon):
+        (JSC::JIT::emit_op_new_async_func):
+        (JSC::JIT::emitNewFuncExprCommon):
+        (JSC::JIT::emit_op_new_async_func_exp):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseAsyncFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Scope::setSourceParseMode):
+        * parser/ParserModes.h:
+        (JSC::isGeneratorOrAsyncFunctionBodyParseMode):
+        (JSC::isGeneratorOrAsyncFunctionWrapperParseMode):
+        * runtime/AsyncFunctionConstructor.cpp: Added.
+        (JSC::AsyncFunctionConstructor::AsyncFunctionConstructor):
+        (JSC::AsyncFunctionConstructor::finishCreation):
+        (JSC::callAsyncFunctionConstructor):
+        (JSC::constructAsyncFunctionConstructor):
+        (JSC::AsyncFunctionConstructor::getCallData):
+        (JSC::AsyncFunctionConstructor::getConstructData):
+        * runtime/AsyncFunctionConstructor.h: Added.
+        (JSC::AsyncFunctionConstructor::create):
+        (JSC::AsyncFunctionConstructor::createStructure):
+        * runtime/AsyncFunctionPrototype.cpp: Added.
+        (JSC::AsyncFunctionPrototype::AsyncFunctionPrototype):
+        (JSC::AsyncFunctionPrototype::finishCreation):
+        * runtime/AsyncFunctionPrototype.h: Added.
+        (JSC::AsyncFunctionPrototype::create):
+        (JSC::AsyncFunctionPrototype::createStructure):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSAsyncFunction.cpp: Added.
+        (JSC::JSAsyncFunction::JSAsyncFunction):
+        (JSC::JSAsyncFunction::createImpl):
+        (JSC::JSAsyncFunction::create):
+        (JSC::JSAsyncFunction::createWithInvalidatedReallocationWatchpoint):
+        * runtime/JSAsyncFunction.h: Added.
+        (JSC::JSAsyncFunction::allocationSize):
+        (JSC::JSAsyncFunction::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::lazyAsyncFunctionStructure):
+        (JSC::JSGlobalObject::asyncFunctionPrototype):
+        (JSC::JSGlobalObject::asyncFunctionPrototypeConcurrently):
+        (JSC::JSGlobalObject::asyncFunctionStructure):
+        (JSC::JSGlobalObject::asyncFunctionStructureConcurrently):
+
+2016-10-27  Mark Lam  <mark.lam@apple.com>
+
+        JSFunction::put() should not allow caching of lazily reified properties.
+        https://bugs.webkit.org/show_bug.cgi?id=164081
+
+        Reviewed by Geoffrey Garen.
+
+        It is incorrect for JSFunction::put() to return PutPropertySlots that indicates
+        that its lazily reified properties (e.g. .caller, and .arguments) are cacheable.
+        The reason for this is:
+
+        1. Currently, a cacheable put may only consist of the following types of put
+           operations:
+           a. putting a new property at an offset in the object storage.
+           b. changing the value of an existing property at an offset in the object storage.
+           c. invoking the setter for a property at an offset in the object storage.
+
+           Returning a PutPropertySlot that indicates the property is cacheable means that
+           the property put must be one of the above operations.
+
+           For lazily reified properties, JSFunction::put() implements complex conditional
+           behavior that is different than the set of cacheable put operations above.
+           Hence, it should not claim that the property put is cacheable.
+
+        2. Cacheable puts are cached on the original structure of the object before the
+           put operation.
+
+           Reifying a lazy property will trigger a structure transition.  Even though
+           subsequent puts to such a property may be cacheable after the structure
+           transition, it is incorrect to indicate that the property put is cacheable
+           because the caching is on the original structure, not the new transitioned
+           structure.
+
+        Also fixed some missing exception checks.
+
+        * jit/JITOperations.cpp:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::reifyLazyPropertyIfNeeded):
+        (JSC::JSFunction::reifyBoundNameIfNeeded):
+        * runtime/JSFunction.h:
+
+2016-10-27  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] forbid lexical redeclaration of generator formal parameters
+        https://bugs.webkit.org/show_bug.cgi?id=163930
+
+        Reviewed by Yusuke Suzuki.
+
+        Also forbids "arguments" and "eval" as generator argument names in strict mode.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::declareRestOrNormalParameter):
+        * parser/Parser.h:
+        (JSC::Parser::declareVariable):
+        (JSC::Parser::hasDeclaredParameter):
+        (JSC::Parser::isValidStrictMode):
+
+2016-10-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Include ConsoleAgent in Workers - real console.log support
+        https://bugs.webkit.org/show_bug.cgi?id=163844
+        <rdar://problem/28903328>
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/Worker.json:
+
+2016-10-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Introduce Page WorkerAgent and Worker InspectorController
+        https://bugs.webkit.org/show_bug.cgi?id=163817
+        <rdar://problem/28899063>
+
+        Reviewed by Brian Burg.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * inspector/protocol/Worker.json: Added.
+        New Worker domain.
+
+2016-10-26  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly API: implement Instance
+
+        As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
+
+         - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
+         - Construct a basic Instance with a Module.
+         - Handle second argument (importObject) of WebAssembly.Instance.
+         - Add reference text from the spec to WebAssembly.Module's code.
+         - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
+
+        The implementation isn't complete yet: it relies on further work for which I've filed bugs.
+
+        WebAssembly API: implement Instance
+        https://bugs.webkit.org/show_bug.cgi?id=163998
+
+        Reviewed by Keith Miller.
+
+        * wasm/WasmPlan.h:
+        (JSC::Wasm::Plan::getFunctions): allow transfering state out
+        (JSC::Wasm::Plan::getMemory): allow transfering state out
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        (JSC::JSWebAssemblyInstance::create):
+        (JSC::JSWebAssemblyInstance::finishCreation): set the ModuleNamespaceObject, and expose it as "exports"
+        (JSC::JSWebAssemblyInstance::visitChildren): visit the ModuleNamespaceObject child
+        * wasm/js/JSWebAssemblyInstance.h:
+        * wasm/js/JSWebAssemblyModule.cpp:
+        (JSC::JSWebAssemblyModule::create):
+        (JSC::JSWebAssemblyModule::JSWebAssemblyModule): move in the compiled functions and the memory
+        * wasm/js/JSWebAssemblyModule.h:
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::constructJSWebAssemblyInstance): take the Module, extract the Plan's results, and create the (empty for now) ModuleNamespaceObject
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule): add a few comments from the spec, and pass out the Plan's results
+
+2016-10-26  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: remove unused bool return value from FrontendChannel::sendMessageToFrontend
+        https://bugs.webkit.org/show_bug.cgi?id=164046
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/InspectorFrontendChannel.h:
+        * inspector/remote/RemoteConnectionToTarget.h:
+        * inspector/remote/RemoteConnectionToTarget.mm:
+        (Inspector::RemoteConnectionToTarget::sendMessageToFrontend):
+
+2016-10-26  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: remove now-dead JSWasmModule
+        https://bugs.webkit.org/show_bug.cgi?id=164044
+
+        Reviewed by Keith Miller.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Executable.cpp:
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable):
+        (JSC::WebAssemblyExecutable::visitChildren):
+        * runtime/Executable.h:
+        * wasm/JSWasmModule.cpp: Removed.
+        * wasm/JSWasmModule.h: Removed.
+        * wasm/WasmModuleParser.cpp:
+
+2016-10-26  Mark Lam  <mark.lam@apple.com>
+
+        JSGenericTypedArrayView::set() should check for exceptions.
+        https://bugs.webkit.org/show_bug.cgi?id=164007
+        <rdar://problem/28853775>
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::set):
+
+2016-10-25  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Tell IDL result type to DFG to drop type checks in AI
+        https://bugs.webkit.org/show_bug.cgi?id=163900
+
+        Reviewed by Sam Weinig.
+
+        The IDL tells the conservative result type. While we use the heap prediction
+        for prediction propagation phase in DOMJIT getter (it is offered by get_by_id!),
+        we leverage the type told by IDL to produce the abstract value with the proven type
+        in AI. It effectively drops unnecessary type checks followed by CallDOM operations.
+
+        For example, when you write the code like,
+
+            if (node.nodeType === 9) {
+                // document.
+            }
+
+        Previously, we inserted a Int32 check for the result of node.nodeType.
+        It is dropped now.
+
+        We annotate the DOMJIT getter in jsc.cpp to ensure that the unnecessary type checks
+        are correctly dropped when executing JSTests/stress/domjit-getter.js.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * domjit/DOMJITGetterSetter.h:
+        (JSC::DOMJIT::GetterSetter::GetterSetter):
+        (JSC::DOMJIT::GetterSetter::resultType):
+        * jsc.cpp:
+        (WTF::DOMJITGetter::DOMJITNodeDOMJIT::DOMJITNodeDOMJIT):
+        (WTF::DOMJITGetterComplex::DOMJITNodeDOMJIT::DOMJITNodeDOMJIT):
+
+2016-10-25  Mark Lam  <mark.lam@apple.com>
+
+        String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
+        https://bugs.webkit.org/show_bug.cgi?id=163996
+        <rdar://problem/28263117>
+
+        Reviewed by Geoffrey Garen.
+
+        String.prototype.replace() uses a Vector internally for bookkeeping work.
+        Currently, if this vector gets too big, we just crash on allocation failure.
+        While this is correct behavior, it is not too friendly.
+
+        We now detect the imminent failure, and throw a OutOfMemoryError instead.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::removeUsingRegExpSearch):
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
+        (JSC::stringProtoFuncReplaceUsingRegExp):
+
+2016-10-25  Mark Lam  <mark.lam@apple.com>
+
+        Rename the reject() helper function to something more meaningful.
+        https://bugs.webkit.org/show_bug.cgi?id=163549
+
+        Reviewed by Saam Barati.
+
+        We'll rename reject() to typeError().  The intuition behind this is that all the
+        clients that uses this function will return typeError(..., shouldThrow, ...).
+        In a sense, they are returning a "type" of TypeError (which happened to be the
+        value false).  In addition, it may also throw a JS TypeError if the shouldThrow
+        parameter is true.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/GetterSetter.cpp:
+        (JSC::callSetter):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::setLengthWithArrayStorage):
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::put):
+        (JSC::JSArrayBuffer::defineOwnProperty):
+        * runtime/JSArrayBufferView.cpp:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::put):
+        (JSC::JSDataView::defineOwnProperty):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
+        * runtime/JSObject.cpp:
+        (JSC::ordinarySetSlow):
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::validateAndApplyPropertyDescriptor):
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putInline):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setPrototype):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::defineOwnProperty):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        * runtime/Reject.h: Removed.
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayEntry::put):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::StringObject::putByIndex):
+        * runtime/TypeError.h: Copied from Source/JavaScriptCore/runtime/Reject.h.
+        (JSC::typeError):
+        (JSC::reject): Deleted.
+
+2016-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        HeapTimer should not hardcode all of its subclasses and USE(CF) shouldn't be a bizarre special case
+        https://bugs.webkit.org/show_bug.cgi?id=163947
+
+        Reviewed by Geoffrey Garen.
+
+        I want to introduce another HeapTimer. Prior to this change, that would have meant writing
+        exact copies of that timer's logic for each platform that has a HeapTimer (CF, GLIB, and
+        EFL). That logic would in turn be a duplicate of the logic already present in
+        IncrementalSweeper and GCActivityCallback: all of the subclasses of HeapTimer have their
+        own code for scheduling timers, so a new subclass would have to duplicate that code. Then,
+        to add insult to injury, the USE(CF) version of HeapTimer would have to have an extra case
+        for that new subclass since it doesn't use virtual methods effectively.
+
+        This changes HeapTimer on USE(CF) to know to get its runloop from Heap and to use virtual
+        methods effectively so that it doesn't have to know about all of its subclasses.
+
+        This also moves IncrementalSweeper's code for scheduling timers into HeapTimer. This means
+        that future subclasses of HeapTimer could simply use that logic.
+
+        This keeps changes to GCActivityCallback to a minimum. It still has a lot of
+        platform-specific code and I'm not sure that this code can be trivially deduplicated since
+        that code has more quirks. That's fine for now, since I mainly just need a sane way of
+        creating new timers that use IncrementalSweeper-like scheduling logic.
+
+        * heap/EdenGCActivityCallback.cpp:
+        * heap/EdenGCActivityCallback.h:
+        * heap/FullGCActivityCallback.cpp:
+        * heap/FullGCActivityCallback.h:
+        * heap/GCActivityCallback.cpp:
+        (JSC::GCActivityCallback::GCActivityCallback):
+        * heap/GCActivityCallback.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        * heap/Heap.h:
+        (JSC::Heap::runLoop):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::HeapTimer):
+        (JSC::HeapTimer::setRunLoop):
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::timerDidFire):
+        (JSC::HeapTimer::scheduleTimer):
+        (JSC::HeapTimer::cancelTimer):
+        (JSC::retainAPILock): Deleted.
+        (JSC::releaseAPILock): Deleted.
+        * heap/HeapTimer.h:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::scheduleTimer):
+        (JSC::IncrementalSweeper::cancelTimer): Deleted.
+        * heap/IncrementalSweeper.h:
+
+2016-10-25  JF Bastien  <jfbastien@apple.com>
+
+        Remove redundant argument count check
+
+        Indexing argument out of bounds already returns jsUndefined().
+
+        Remove redundant argument count check
+        https://bugs.webkit.org/show_bug.cgi?id=163957
+
+        Reviewed by Keith Miller.
+
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        (JSC::Interpreter::callErrorConstructor):
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
+        (JSC::constructJSWebAssemblyRuntimeError):
+
+2016-10-25  Mark Lam  <mark.lam@apple.com>
+
+        Add ThrowScope::release() calls at all call sites of jsMakeNontrivialString().
+        https://bugs.webkit.org/show_bug.cgi?id=163990
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+
+2016-10-25  Mark Lam  <mark.lam@apple.com>
+
+        JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
+        https://bugs.webkit.org/show_bug.cgi?id=163937
+        <rdar://problem/28642990>
+
+        Reviewed by Geoffrey Garen.
+
+        JSStringJoiner::joinedLength() was previously limiting it to UINT_MAX.  This is
+        inconsistent with other parts of string code which expects a max length of INT_MAX.
+        This is now fixed.
+
+        Also fixed jsMakeNontrivialString() to ensure that the resultant string length
+        is valid.  It was previously allowing lengths greater than INT_MAX.  This was
+        caught by the new assertion in JSString::setLength().
+
+        There are already pre-existing assertions in various JSString::finishCreation()
+        which do RELEASE_ASSERTs on the string length.  To be consistent, I'm making the
+        assertion in JSString::setLength() a RELEASE_ASSERT.  If this proves to be a
+        performance issue, I'll change this to a debug ASSERT later.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeInternal8):
+        (JSC::JSRopeString::resolveRopeInternal8NoSubstring):
+        (JSC::JSRopeString::resolveRopeInternal16):
+        (JSC::JSRopeString::resolveRopeInternal16NoSubstring):
+        (JSC::JSRopeString::resolveRopeToAtomicString):
+        (JSC::JSRopeString::resolveRopeToExistingAtomicString):
+        (JSC::JSRopeString::resolveRope):
+        (JSC::JSRopeString::resolveRopeSlowCase8):
+        (JSC::JSRopeString::resolveRopeSlowCase):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::finishCreation):
+        (JSC::JSString::length):
+        (JSC::JSString::isValidLength):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::canGetIndex):
+        (JSC::JSString::setLength):
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::JSRopeString::unsafeView):
+        (JSC::JSRopeString::viewWithUnderlyingString):
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::joinedLength):
+
+2016-10-25  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: fix unknown section name handling, and check for section size overflow
+        https://bugs.webkit.org/show_bug.cgi?id=163959
+
+        See: https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#high-level-structure
+
+        Name length and name are already included in the payload length.
+
+        Reviewed by Filip Pizlo.
+
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parse):
+
+2016-10-25  Christopher Reid  <Christopher.Reid@am.sony.com>
+
+        jsc.cpp is leaking memory allocated by readline in runInteractive
+        https://bugs.webkit.org/show_bug.cgi?id=163958
+
+        According to http://web.mit.edu/gnu/doc/html/rlman_2.html,
+        "The line readline returns is allocated with malloc ();
+        you should free () the line when you are done with it."
+        The memory allocated by readline is not being freed when it should.
+
+        Reviewed by Mark Lam.
+
+        * jsc.cpp:
+
+2016-10-25  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [cmake] Check if jscLib and WebKitGUID targets exist before using them
+        https://bugs.webkit.org/show_bug.cgi?id=163945
+
+        Reviewed by Alex Christensen.
+
+        Currently these targets are used under WIN32 condition, however they
+        are defined in PlatformWin.cmake, causing CMake warnings if port
+        supports WIN32 but does not use PlatformWin.cmake
+
+        * shell/CMakeLists.txt:
+
+2016-10-25  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly JS API: implement Module
+
+        This implementation allows us to:
+         - Syncrhonously create a WebAssembly.Module with a typed array.
+         - Creates a compilation plan.
+         - Parse the Module and creates corresponding code.
+         - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
+           failure.
+
+        Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
+
+        For now the implementation discards the generated code.
+
+        The next steps will be:
+         - Expose a Module's exports.
+         - Implement WebAssembly.Instance, which allows instantiating and running a
+           compiled Module.
+         - Beef up the testing infrastructure under JSTests/wasm so that more complex
+           modules can be created and tested (instead of writing the bits by hand).
+
+        This patch also:
+         - Adds assert.instanceof in assert.js.
+         - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
+           Vector, to avoid copying when invoked synchronously.
+         - Remove useless Structure from some of the wasm constructors: they're already
+           on the JSGlobalObject, visited properly and all.
+         - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
+           was exactly at end of file.
+
+         [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
+
+        WebAssembly JS API: implement Module
+        https://bugs.webkit.org/show_bug.cgi?id=163903
+
+        Reviewed by Keith Miller.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::defaultSourceAppender): make this public so that WebAssembly can use it: it generates those fancy (evaluating '...') messages at the end
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): remove the useless Structure from the WebAssembly objects (it's already in this file, no need to hold two references and visit them twice)
+        * testWasm.cpp:
+        (runWasmTests): update API
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::parseAndCompile): use updated API
+        * wasm/WasmB3IRGenerator.h:
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::FunctionParser): use updated API
+        (JSC::Wasm::FunctionParser<Context>::parseExpression): use updated API
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parse): generate error messages
+        * wasm/WasmModuleParser.h:
+        (JSC::Wasm::ModuleParser::ModuleParser):
+        (JSC::Wasm::ModuleParser::failed):
+        (JSC::Wasm::ModuleParser::errorMessage):
+        (JSC::Wasm::ModuleParser::functionInformation):
+        (JSC::Wasm::ModuleParser::memory):
+        * wasm/WasmParser.h: use update non-public API
+        (JSC::Wasm::Parser::parseVarUInt32):
+        (JSC::Wasm::Parser::parseVarUInt64):
+        (JSC::Wasm::Parser::source):
+        (JSC::Wasm::Parser::length):
+        (JSC::Wasm::Parser::Parser):
+        (JSC::Wasm::Parser::consumeCharacter):
+        (JSC::Wasm::Parser::consumeString):
+        (JSC::Wasm::Parser::parseUInt32):
+        (JSC::Wasm::Parser::parseUInt7):
+        * wasm/WasmPlan.cpp:
+        (JSC::Wasm::Plan::Plan):
+        (JSC::Wasm::Plan::~Plan):
+        * wasm/WasmPlan.h:
+        (JSC::Wasm::Plan::failed):
+        (JSC::Wasm::Plan::errorMessage):
+        (JSC::Wasm::Plan::resultSize):
+        (JSC::Wasm::Plan::result):
+        (JSC::Wasm::Plan::memory):
+        * wasm/js/JSWebAssemblyCompileError.cpp:
+        (JSC::createWebAssemblyCompileError): makes it easier to throw a WebAssembly.CompileError from Module
+        * wasm/js/JSWebAssemblyCompileError.h:
+        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
+        (JSC::WebAssemblyCompileErrorConstructor::create):
+        (JSC::WebAssemblyCompileErrorConstructor::finishCreation):
+        * wasm/js/WebAssemblyCompileErrorConstructor.h:
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::WebAssemblyInstanceConstructor::create):
+        (JSC::WebAssemblyInstanceConstructor::finishCreation):
+        (JSC::WebAssemblyInstanceConstructor::visitChildren):
+        * wasm/js/WebAssemblyInstanceConstructor.h:
+        * wasm/js/WebAssemblyMemoryConstructor.cpp:
+        (JSC::WebAssemblyMemoryConstructor::create):
+        (JSC::WebAssemblyMemoryConstructor::finishCreation):
+        (JSC::WebAssemblyMemoryConstructor::visitChildren):
+        * wasm/js/WebAssemblyMemoryConstructor.h:
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::constructJSWebAssemblyModule):
+        (JSC::WebAssemblyModuleConstructor::create):
+        (JSC::WebAssemblyModuleConstructor::finishCreation):
+        (JSC::WebAssemblyModuleConstructor::visitChildren):
+        * wasm/js/WebAssemblyModuleConstructor.h:
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
+        (JSC::WebAssemblyRuntimeErrorConstructor::create):
+        (JSC::WebAssemblyRuntimeErrorConstructor::finishCreation):
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.h:
+        * wasm/js/WebAssemblyTableConstructor.cpp:
+        (JSC::WebAssemblyTableConstructor::create):
+        (JSC::WebAssemblyTableConstructor::finishCreation):
+        (JSC::WebAssemblyTableConstructor::visitChildren):
+        * wasm/js/WebAssemblyTableConstructor.h:
+
+2016-10-25  Keith Miller  <keith_miller@apple.com>
+
+        Add trivial Wasm conversion opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=163950
+
+        Reviewed by Filip Pizlo.
+
+        This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
+        those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
+        become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
+        be added via patchpoints in a later patch.
+
+        * wasm/WasmB3IRGenerator.cpp:
+        * wasm/WasmOps.h:
+        (JSC::Wasm::isSimple):
+
+2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Arrow functions with concise bodies cannot return regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=163162
+
+        Reviewed by Filip Pizlo.
+
+        When we encounter the RegExp in the parser, we first scan it as / or /=.
+        And if / or /= is parsed under the primary expression context, we rescan it
+        as RegExp. However, we did not update the token record information. So the
+        token record still says "I'm / or /=".
+
+        When we parse the string "() => /hello/", the last token becomes "/", which is
+        the first character of the RegExp, instead of "/hello/". Since the arrow
+        function parsing utilizes the end offset of the last token, we accidentally
+        recognize the range of the above arrow function as "() => /".
+
+        In this patch, we update the token when rescanning under the RegExp context.
+        This logic is similar to parsing Tail Template Literal token.
+
+        We also refine the error message for regular expression literals. And since
+        the REGEXP token is now introduced, the other error messages using that token
+        are improved too.
+
+        Currently, unterminated error messages can be seen in Parser.cpp. However,
+        these messages cannot be shown to users if the lexer has m_error. So these
+        code is meaningless. I'll move these tokenizing errors to the lexer in the
+        subsequent patch[1].
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=163928
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::fillTokenInfo):
+        (JSC::Lexer<T>::lex):
+        (JSC::Lexer<T>::scanRegExp):
+        (JSC::Lexer<T>::scanTrailingTemplateString):
+        (JSC::Lexer<T>::skipRegExp): Deleted.
+        * parser/Lexer.h:
+        (JSC::Lexer::getToken):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::Parser::getToken):
+        * parser/ParserTokens.h:
+
+2016-10-24  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] CMake build type is not set.
+        https://bugs.webkit.org/show_bug.cgi?id=163917
+
+        Reviewed by Alex Christensen.
+
+        The CMAKE_BUILD_TYPE variable should be set to Debug or Release.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj:
+
+2016-10-24  Chris Dumez  <cdumez@apple.com>
+
+        Reduce special handling for typed arrays in JSDOMConvert.h
+        https://bugs.webkit.org/show_bug.cgi?id=163907
+
+        Reviewed by Sam Weinig.
+
+        Reduce special handling for typed arrays in JSDOMConvert.h by adding a toWrapped() static
+        function on JSGenericTypedArrayView, similarly to other wrapper types.
+
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::typedImpl):
+        (JSC::JSGenericTypedArrayView<Adaptor>::toWrapped):
+
+2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT][DFG] CallDOM never writes Stack
+        https://bugs.webkit.org/show_bug.cgi?id=163926
+
+        Reviewed by Filip Pizlo and Saam Barati.
+
+        There is no way to write(Stack) in CallDOM.
+        This worst case (the most clobbering case) scenario
+        should be aligned to the one of Call, read(World) and write(Heap).
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2016-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Add a way for DOMJIT::Patchpoint to express effects
+        https://bugs.webkit.org/show_bug.cgi?id=163657
+
+        Reviewed by Saam Barati.
+
+        This patch introduces DOMJIT::Effect. It describes the side effects of
+        the DOMJIT::CallDOMPatchpoint. DOMJIT::CallDOMPatchpoint can use this
+        feature to teach the compilers about the effects. And the compilers
+        will perform CSE based on the reported effects.
+
+        As the same to B3's HeapRange, the effects are represented as a pair of
+        integers. [begin, end) pair will represents the range of the abstract
+        heap. We encode the abstract heap hierarchy into these pairs. Like,
+
+                                Root: [0, 32)
+                 Child1: [0, 20)             Child2: [20, 32)
+        Child11: [0, 4) Child12: [4, 20)
+
+        This simplifies the representation of the abstract heap. And WebCore
+        just tells pairs of integers and it does not tell any detailed hierarchy.
+        So, DFG and FTL can optimize DOM operations without deep knowledge of
+        the DOM abstract heap hierarchy. For example, WebCore will tell that
+        firstChild will read Node_firstChild abstract heap. But this information
+        is encoded to the pair and DFG does not know the details. But still
+        DFG can understand the abstract heap hierarchy and can query whether the
+        given abstract heap overlaps with some abstract heap.
+
+        The heap range told by the WebCore is represented as DOMJIT::HeapRange.
+        DFG will handle this under the DOMState abstract heap. DOMJIT::HeapRange
+        is stored in DFG::AbstractHeap's Payload. We maintain the hierarchy by
+        DOMJIT::HeapRange in the DOMState abstract heap. We add a necessary
+        handling in DFG's AbstractHeap and ClobberSet.
+
+        And we also introduce DOMStateLoc for HeapLocation. It is combined with
+        DOMState AbstractHeap with DOMJIT::HeapRange. For example, we can
+        represent Node.firstChild as `read(DOMState:Node_firstChild)` and
+        `def(HeapLocation(node, DOMState:Node_firstChild))` thingy. This allows us
+        to perform CSE onto DOM getters that will read some of DOM heap!
+
+        For simplicity, we convert CallDOM from NodeVarArgs to the normal one.
+        CallDOM is now just used for DOMJIT getter. So its children is at most 2.
+        It may have either 1 or 2 children. If the global object is required
+        by CallDOMPatchpoint, it has 2 children. And we changed the order of
+        the children to further simplify the code. Before this change, the order
+        is 1: globalObject 2: base. After this patch, the order becomes 1: base,
+        and 2: globalObject. And the child2 may not exists if the global object
+        is not required. We changed all the existing DOMJIT patchpoint to this
+        form.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::emitDOMJITGetter):
+        * dfg/DFGAbstractHeap.cpp:
+        (JSC::DFG::AbstractHeap::dump):
+        * dfg/DFGAbstractHeap.h:
+        (JSC::DFG::AbstractHeap::isStrictSubtypeOf):
+        (JSC::DFG::AbstractHeap::overlaps):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::blessCallDOM):
+        (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
+        * dfg/DFGClobberSet.cpp:
+        (JSC::DFG::ClobberSet::overlaps):
+        * dfg/DFGClobberSet.h:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCallDOMData):
+        (JSC::DFG::Node::callDOMData):
+        (JSC::DFG::Node::hasCallDOMPatchpoint): Deleted.
+        (JSC::DFG::Node::callDOMPatchpoint): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCallDOM):
+        * domjit/DOMJITAbstractHeap.cpp: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h.
+        (JSC::DOMJIT::AbstractHeap::compute):
+        (JSC::DOMJIT::AbstractHeap::dump):
+        (JSC::DOMJIT::AbstractHeap::shallowDump):
+        (JSC::DOMJIT::AbstractHeap::deepDump):
+        * domjit/DOMJITAbstractHeap.h: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h.
+        (JSC::DOMJIT::AbstractHeap::AbstractHeap):
+        (JSC::DOMJIT::AbstractHeap::setParent):
+        (JSC::DOMJIT::AbstractHeap::isRoot):
+        (JSC::DOMJIT::AbstractHeap::isComputed):
+        (JSC::DOMJIT::AbstractHeap::range):
+        * domjit/DOMJITCallDOMPatchpoint.h:
+        * domjit/DOMJITEffect.h: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h.
+        (JSC::DOMJIT::Effect::forReadWrite):
+        (JSC::DOMJIT::Effect::forPure):
+        (JSC::DOMJIT::Effect::forDef):
+        (JSC::DOMJIT::Effect::mustGenerate):
+        * domjit/DOMJITHeapRange.cpp: Copied from Source/JavaScriptCore/domjit/DOMJITCallDOMPatchpoint.h.
+        (JSC::DOMJIT::HeapRange::dump):
+        * domjit/DOMJITHeapRange.h: Added.
+        (JSC::DOMJIT::HeapRange::HeapRange):
+        (JSC::DOMJIT::HeapRange::fromRaw):
+        (JSC::DOMJIT::HeapRange::begin):
+        (JSC::DOMJIT::HeapRange::end):
+        (JSC::DOMJIT::HeapRange::rawRepresentation):
+        (JSC::DOMJIT::HeapRange::operator bool):
+        (JSC::DOMJIT::HeapRange::operator==):
+        (JSC::DOMJIT::HeapRange::top):
+        (JSC::DOMJIT::HeapRange::none):
+        (JSC::DOMJIT::HeapRange::isStrictSubtypeOf):
+        (JSC::DOMJIT::HeapRange::isSubtypeOf):
+        (JSC::DOMJIT::HeapRange::overlaps):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
+        * jsc.cpp:
+
+2016-10-24  Alex Christensen  <achristensen@webkit.org>
+
+        JSONParse should not crash with null Strings
+        https://bugs.webkit.org/show_bug.cgi?id=163918
+        <rdar://problem/28834095>
+
+        Reviewed by Michael Saboff.
+
+        When JSONParse is called with a null String, it calls String::is8bit, which dereferences a null pointer.
+        This is happening with new work in the Fetch API, but callers of JSONParse should not have to check
+        if the String is null.
+
+        * API/tests/JSONParseTest.cpp: Added.
+        (testJSONParse):
+        * API/tests/JSONParseTest.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        Test parsing null Strings.  They should have the same result as parsing empty Strings.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONParse):
+        Check for null Strings.
+        * shell/PlatformWin.cmake:
+
+2016-10-24  Devin Rousso  <dcrousso+webkit@gmail.com>
+
+        Web Inspector: Scope chain shouldn't show empty Closure sections
+        https://bugs.webkit.org/show_bug.cgi?id=152348
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/InjectedScriptSource.js:
+        (isEmptyObject):
+        (InjectedScript.CallFrameProxy._createScopeJson):
+        If the scope object has no properties, set empty to true.
+
+        * inspector/protocol/Debugger.json:
+        Added empty property to Scope type.
+
+2016-10-24  Keith Miller  <keith_miller@apple.com>
+
+        Wasm should support floating point operations.
+        https://bugs.webkit.org/show_bug.cgi?id=163770
+
+        Reviewed by Michael Saboff.
+
+        Since we now have a Double => Float Trunc in B3, we can now support calls in Wasm
+        that take floating point arguments. This patch also enables most of the Wasm
+        floating point operations, as the associated B3 opcode has been linked via wasm.json.
+        If there is no direct mapping to a B3 opcode the Wasm is not yet implemented. This
+        patch also fixes a bug in calls where the arguments would be reversed.
+
+        * testWasm.cpp:
+        (cast):
+        (invoke):
+        (boxf):
+        (boxd):
+        (runWasmTests):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::createJSWrapper):
+        * wasm/WasmCallingConvention.h:
+        (JSC::Wasm::CallingConvention::loadArguments):
+        (JSC::Wasm::CallingConvention::setupCall):
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
+        * wasm/WasmOps.h:
+
+2016-10-24  Mark Lam  <mark.lam@apple.com>
+
+        Dumping of op_negate bytecode is broken.
+        https://bugs.webkit.org/show_bug.cgi?id=163896
+
+        Reviewed by Darin Adler.
+
+        It thinks the bytecode consists of only 3 machine words, when it consists of 4.
+        This is now fixed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+
+2016-10-24  Youenn Fablet  <youenn@apple.com>
+
+        Activate WEB_RTC compilation flags for Mac bots
+        https://bugs.webkit.org/show_bug.cgi?id=163886
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-10-23  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed. Build fix for Clang and libstdc++ configurations.
+
+        * b3/testb3.cpp:
+        (JSC::B3::testAbsArgWithEffectfulDoubleConversion): Explicitly cast the
+        float-typed return value of fabs(float) to double in order to avoid
+        ambiguous calls to isIdentical().
+        (JSC::B3::testSqrtArgWithEffectfulDoubleConversion): Ditto for sqrt(float).
+
+2016-10-22  Chris Dumez  <cdumez@apple.com>
+
+        WebGLRenderingContextBase.bufferData() should use a union instead of overloading
+        https://bugs.webkit.org/show_bug.cgi?id=163795
+
+        Reviewed by Darin Adler.
+
+        * runtime/ArrayBufferView.h:
+        (JSC::ArrayBufferView::data):
+        Add a data() method which aliases baseAddress() to align the API with
+        ArrayBuffer and reduce special handling at call sites.
+
+        * runtime/JSArrayBuffer.h:
+        (JSC::toArrayBuffer):
+        (JSC::JSArrayBuffer::toWrapped):
+        Add toWrapped() method similarly with WebCore wrapper types to
+        reduce special handling of JSArrayBuffer type.
+
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::toWrapped):
+        * runtime/JSArrayBufferView.h:
+        Add toWrapped() method similarly with WebCore wrapper types to
+        reduce special handling of JSArrayBufferView type.
+
+2016-10-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Slow and big Heap methods should not be inline
+        https://bugs.webkit.org/show_bug.cgi?id=163802
+
+        Reviewed by Keith Miller.
+
+        JSC often suffers from the inline cargo cult, and Heap is a prime example. This outlines a
+        bunch of Heap methods that are either already very big, or call out-of-line methods, or call
+        very big methods, or are not called often enough for inlining to matter.
+
+        This simplifies concurrent GC work because I'm so tired of recompiling the world when I touch
+        one of these methods.
+
+        This looks to be perf-neutral.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isCurrentThreadBusy):
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::reportExternalMemoryVisited):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        (JSC::Heap::collectAccordingToDeferGCProbability):
+        (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
+        (JSC::Heap::registerWeakGCMap):
+        (JSC::Heap::unregisterWeakGCMap):
+        (JSC::Heap::didAllocateBlock):
+        (JSC::Heap::didFreeBlock):
+        * heap/HeapInlines.h:
+        (JSC::Heap::shouldCollect): Deleted.
+        (JSC::Heap::isCurrentThreadBusy): Deleted.
+        (JSC::Heap::reportExtraMemoryVisited): Deleted.
+        (JSC::Heap::reportExternalMemoryVisited): Deleted.
+        (JSC::Heap::collectIfNecessaryOrDefer): Deleted.
+        (JSC::Heap::collectAccordingToDeferGCProbability): Deleted.
+        (JSC::Heap::decrementDeferralDepthAndGCIfNeeded): Deleted.
+        (JSC::Heap::registerWeakGCMap): Deleted.
+        (JSC::Heap::unregisterWeakGCMap): Deleted.
+        (JSC::Heap::didAllocateBlock): Deleted.
+        (JSC::Heap::didFreeBlock): Deleted.
+
+2016-10-21  Saam Barati  <sbarati@apple.com>
+
+        SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
+        https://bugs.webkit.org/show_bug.cgi?id=163622
+
+        Reviewed by Yusuke Suzuki.
+
+        We were passing in DontSpill in the Untyped:child1() case, which caused us
+        not to spill the base register. This is obviously wrong because the
+        DFG's register allocator expected the base to still be in the register
+        that it allocated for it after the TryGetById node executed.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileTryGetById):
+
+2016-10-21  Keith Miller  <keith_miller@apple.com>
+
+        Expand Trunc in B3 to support Double to Float
+        https://bugs.webkit.org/show_bug.cgi?id=163809
+
+        Reviewed by Geoffrey Garen.
+
+        This feature is useful for passing floating point arguments via registers.
+        Currently, ArgumentRegValue returns a the full 64-bit register. Thus, we
+        need a way to indicate to B3 that we only want the low 32-bits.
+
+        * b3/B3Common.h:
+        (JSC::B3::isIdentical):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::typeFor):
+        * b3/testb3.cpp:
+        (JSC::B3::testAddFPRArgsFloat):
+        (JSC::B3::testCeilArgWithEffectfulDoubleConversion):
+        (JSC::B3::testFloorArgWithEffectfulDoubleConversion):
+        (JSC::B3::testDoubleProducerPhiToFloatConversionWithDoubleConsumer):
+        (JSC::B3::run):
+
+2016-10-21  Keith Miller  <keith_miller@apple.com>
+
+        Rename WASM to Wasm
+        https://bugs.webkit.org/show_bug.cgi?id=163796
+
+        Rubber stamped by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * Configurations/ToolExecutable.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * llint/LLIntThunks.cpp:
+        (JSC::vmEntryToWasm):
+        (JSC::vmEntryToWASM): Deleted.
+        * llint/LLIntThunks.h:
+        * runtime/Executable.cpp:
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable):
+        * runtime/Executable.h:
+        * shell/CMakeLists.txt:
+        * testWASM.cpp:
+        (runWASMTests): Deleted.
+        * testWasm.cpp: Renamed from Source/JavaScriptCore/testWASM.cpp.
+        (CommandLine::CommandLine):
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        (runLEBTests):
+        (invoke):
+        (box):
+        (runWasmTests):
+        (main):
+        * wasm/JSWASMModule.cpp:
+        (JSC::JSWASMModule::JSWASMModule): Deleted.
+        (JSC::JSWASMModule::destroy): Deleted.
+        (JSC::JSWASMModule::visitChildren): Deleted.
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::create): Deleted.
+        (JSC::JSWASMModule::createStructure): Deleted.
+        (JSC::JSWASMModule::i32Constants): Deleted.
+        (JSC::JSWASMModule::f32Constants): Deleted.
+        (JSC::JSWASMModule::f64Constants): Deleted.
+        (JSC::JSWASMModule::signatures): Deleted.
+        (JSC::JSWASMModule::functionImports): Deleted.
+        (JSC::JSWASMModule::functionImportSignatures): Deleted.
+        (JSC::JSWASMModule::globalVariableTypes): Deleted.
+        (JSC::JSWASMModule::functionDeclarations): Deleted.
+        (JSC::JSWASMModule::functionPointerTables): Deleted.
+        (JSC::JSWASMModule::arrayBuffer): Deleted.
+        (JSC::JSWASMModule::functions): Deleted.
+        (JSC::JSWASMModule::functionStartOffsetsInSource): Deleted.
+        (JSC::JSWASMModule::functionStackHeights): Deleted.
+        (JSC::JSWASMModule::globalVariables): Deleted.
+        (JSC::JSWASMModule::importedFunctions): Deleted.
+        * wasm/JSWasmModule.cpp: Renamed from Source/JavaScriptCore/wasm/JSWASMModule.cpp.
+        (JSC::JSWasmModule::JSWasmModule):
+        (JSC::JSWasmModule::destroy):
+        (JSC::JSWasmModule::visitChildren):
+        * wasm/JSWasmModule.h: Renamed from Source/JavaScriptCore/wasm/JSWASMModule.h.
+        (JSC::JSWasmModule::create):
+        (JSC::JSWasmModule::createStructure):
+        (JSC::JSWasmModule::i32Constants):
+        (JSC::JSWasmModule::f32Constants):
+        (JSC::JSWasmModule::f64Constants):
+        (JSC::JSWasmModule::signatures):
+        (JSC::JSWasmModule::functionImports):
+        (JSC::JSWasmModule::functionImportSignatures):
+        (JSC::JSWasmModule::globalVariableTypes):
+        (JSC::JSWasmModule::functionDeclarations):
+        (JSC::JSWasmModule::functionPointerTables):
+        (JSC::JSWasmModule::arrayBuffer):
+        (JSC::JSWasmModule::functions):
+        (JSC::JSWasmModule::functionStartOffsetsInSource):
+        (JSC::JSWasmModule::functionStackHeights):
+        (JSC::JSWasmModule::globalVariables):
+        (JSC::JSWasmModule::importedFunctions):
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::createJSWrapper): Deleted.
+        (JSC::WASM::parseAndCompile): Deleted.
+        * wasm/WASMCallingConvention.cpp:
+        (JSC::WASM::jscCallingConvention): Deleted.
+        (JSC::WASM::wasmCallingConvention): Deleted.
+        * wasm/WASMCallingConvention.h:
+        (JSC::WASM::CallingConvention::CallingConvention): Deleted.
+        (JSC::WASM::CallingConvention::marshallArgumentImpl): Deleted.
+        (JSC::WASM::CallingConvention::marshallArgument): Deleted.
+        (JSC::WASM::CallingConvention::loadArguments): Deleted.
+        (JSC::WASM::CallingConvention::setupCall): Deleted.
+        (JSC::WASM::nextJSCOffset): Deleted.
+        * wasm/WASMFormat.h:
+        (JSC::WASM::toB3Type): Deleted.
+        (JSC::WASM::isValueType): Deleted.
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::FunctionParser): Deleted.
+        (JSC::WASM::FunctionParser<Context>::parse): Deleted.
+        (JSC::WASM::FunctionParser<Context>::parseBlock): Deleted.
+        (JSC::WASM::FunctionParser<Context>::parseExpression): Deleted.
+        (JSC::WASM::FunctionParser<Context>::parseUnreachableExpression): Deleted.
+        * wasm/WASMMemory.cpp:
+        (JSC::WASM::Memory::Memory): Deleted.
+        * wasm/WASMMemory.h:
+        (JSC::WASM::Memory::~Memory): Deleted.
+        (JSC::WASM::Memory::memory): Deleted.
+        (JSC::WASM::Memory::size): Deleted.
+        (JSC::WASM::Memory::pinnedRegisters): Deleted.
+        (JSC::WASM::Memory::mode): Deleted.
+        (JSC::WASM::Memory::grow): Deleted.
+        (JSC::WASM::Memory::offsetOfSize): Deleted.
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASM::ModuleParser::parse): Deleted.
+        (JSC::WASM::ModuleParser::parseMemory): Deleted.
+        (JSC::WASM::ModuleParser::parseFunctionTypes): Deleted.
+        (JSC::WASM::ModuleParser::parseFunctionSignatures): Deleted.
+        (JSC::WASM::ModuleParser::parseFunctionDefinitions): Deleted.
+        * wasm/WASMModuleParser.h:
+        (JSC::WASM::ModuleParser::ModuleParser): Deleted.
+        (JSC::WASM::ModuleParser::functionInformation): Deleted.
+        (JSC::WASM::ModuleParser::memory): Deleted.
+        * wasm/WASMOps.h:
+        (JSC::WASM::isValidOpType): Deleted.
+        (JSC::WASM::isControlOp): Deleted.
+        * wasm/WASMParser.h:
+        (JSC::WASM::Parser::parseVarUInt32): Deleted.
+        (JSC::WASM::Parser::parseVarUInt64): Deleted.
+        (JSC::WASM::Parser::Parser): Deleted.
+        (JSC::WASM::Parser::consumeCharacter): Deleted.
+        (JSC::WASM::Parser::consumeString): Deleted.
+        (JSC::WASM::Parser::parseUInt32): Deleted.
+        (JSC::WASM::Parser::parseUInt7): Deleted.
+        (JSC::WASM::Parser::parseVarUInt1): Deleted.
+        (JSC::WASM::Parser::parseValueType): Deleted.
+        * wasm/WASMPlan.cpp:
+        (JSC::WASM::Plan::Plan): Deleted.
+        * wasm/WASMSections.h:
+        (JSC::WASM::Sections::validateOrder): Deleted.
+        * wasm/WasmB3IRGenerator.cpp: Renamed from Source/JavaScriptCore/wasm/WASMB3IRGenerator.cpp.
+        (dumpProcedure):
+        (JSC::Wasm::createJSWrapper):
+        (JSC::Wasm::parseAndCompile):
+        * wasm/WasmB3IRGenerator.h: Renamed from Source/JavaScriptCore/wasm/WASMB3IRGenerator.h.
+        * wasm/WasmCallingConvention.cpp: Renamed from Source/JavaScriptCore/wasm/WASMCallingConvention.cpp.
+        (JSC::Wasm::jscCallingConvention):
+        (JSC::Wasm::wasmCallingConvention):
+        * wasm/WasmCallingConvention.h: Renamed from Source/JavaScriptCore/wasm/WASMCallingConvention.h.
+        (JSC::Wasm::CallingConvention::CallingConvention):
+        (JSC::Wasm::CallingConvention::marshallArgumentImpl):
+        (JSC::Wasm::CallingConvention::marshallArgument):
+        (JSC::Wasm::CallingConvention::loadArguments):
+        (JSC::Wasm::CallingConvention::setupCall):
+        (JSC::Wasm::nextJSCOffset):
+        * wasm/WasmFormat.h: Renamed from Source/JavaScriptCore/wasm/WASMFormat.h.
+        (JSC::Wasm::toB3Type):
+        (JSC::Wasm::isValueType):
+        * wasm/WasmFunctionParser.h: Renamed from Source/JavaScriptCore/wasm/WASMFunctionParser.h.
+        (JSC::Wasm::FunctionParser<Context>::FunctionParser):
+        (JSC::Wasm::FunctionParser<Context>::parse):
+        (JSC::Wasm::FunctionParser<Context>::parseBlock):
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
+        * wasm/WasmMemory.cpp: Renamed from Source/JavaScriptCore/wasm/WASMMemory.cpp.
+        (JSC::Wasm::Memory::Memory):
+        * wasm/WasmMemory.h: Renamed from Source/JavaScriptCore/wasm/WASMMemory.h.
+        (JSC::Wasm::Memory::~Memory):
+        (JSC::Wasm::Memory::memory):
+        (JSC::Wasm::Memory::size):
+        (JSC::Wasm::Memory::pinnedRegisters):
+        (JSC::Wasm::Memory::mode):
+        (JSC::Wasm::Memory::grow):
+        (JSC::Wasm::Memory::offsetOfSize):
+        * wasm/WasmModuleParser.cpp: Renamed from Source/JavaScriptCore/wasm/WASMModuleParser.cpp.
+        (JSC::Wasm::ModuleParser::parse):
+        (JSC::Wasm::ModuleParser::parseMemory):
+        (JSC::Wasm::ModuleParser::parseFunctionTypes):
+        (JSC::Wasm::ModuleParser::parseFunctionSignatures):
+        (JSC::Wasm::ModuleParser::parseFunctionDefinitions):
+        * wasm/WasmModuleParser.h: Renamed from Source/JavaScriptCore/wasm/WASMModuleParser.h.
+        (JSC::Wasm::ModuleParser::ModuleParser):
+        (JSC::Wasm::ModuleParser::functionInformation):
+        (JSC::Wasm::ModuleParser::memory):
+        * wasm/WasmOps.h: Renamed from Source/JavaScriptCore/wasm/WASMOps.h.
+        (JSC::Wasm::isValidOpType):
+        (JSC::Wasm::isControlOp):
+        * wasm/WasmParser.h: Renamed from Source/JavaScriptCore/wasm/WASMParser.h.
+        (JSC::Wasm::Parser::parseVarUInt32):
+        (JSC::Wasm::Parser::parseVarUInt64):
+        (JSC::Wasm::Parser::Parser):
+        (JSC::Wasm::Parser::consumeCharacter):
+        (JSC::Wasm::Parser::consumeString):
+        (JSC::Wasm::Parser::parseUInt32):
+        (JSC::Wasm::Parser::parseUInt7):
+        (JSC::Wasm::Parser::parseVarUInt1):
+        (JSC::Wasm::Parser::parseValueType):
+        * wasm/WasmPlan.cpp: Renamed from Source/JavaScriptCore/wasm/WASMPlan.cpp.
+        (JSC::Wasm::Plan::Plan):
+        * wasm/WasmPlan.h: Renamed from Source/JavaScriptCore/wasm/WASMPlan.h.
+        * wasm/WasmSections.h: Renamed from Source/JavaScriptCore/wasm/WASMSections.h.
+        (JSC::Wasm::Sections::validateOrder):
+
+2016-10-21  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] don't crash when arguments to `new Function()` produce unexpected AST
+        https://bugs.webkit.org/show_bug.cgi?id=163748
+
+        Reviewed by Mark Lam.
+
+        The ASSERT(statement); and ASSERT(funcDecl); lines are removed, replaced with blocks
+        to report a generic Parser error message. These lines are only possible to be reached
+        if the input string produced an unexpected AST, which previously could be used to crash
+        the process via ASSERT failure.
+
+        The node type assertions are left in the tree, as it should be impossible for a top-level
+        `{` to produce anything other than a Block node. If the node turns out not to be a Block,
+        it indicates that the (C++) caller of this function (E.g in FunctionConstructor.cpp), is
+        doing something incorrect. Similarly, it should be impossible for the `funcDecl` node to
+        be anything other than a function declaration given the conventions of the caller of this
+        function.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+
+2016-10-20  Keith Miller  <keith_miller@apple.com>
+
+        Add support for WASM calls
+        https://bugs.webkit.org/show_bug.cgi?id=161727
+
+        Reviewed by Filip Pizlo and Michael Saboff.
+
+        Add support for WASM calls. Since most of the work for this was already done when we added
+        WASM Memory, this is mostly just cleanup work.  The main interesting part of this patch is
+        how we link calls to other WASM functions in the same module. Since a WASM callee may not
+        have been compiled by the time the current function has started compilation we don't know
+        what address we need to call to.  For each callsite in the compiling function, WASM
+        remembers the CodeLocationCall and the target function index. Once all WASM functions are
+        compiled, each callsite is linked to the appropriate entrypoint.
+
+        * testWASM.cpp:
+        (runWASMTests):
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::createJSWrapper):
+        (JSC::WASM::parseAndCompile):
+        * wasm/WASMB3IRGenerator.h:
+        * wasm/WASMCallingConvention.cpp:
+        (JSC::WASM::jscCallingConvention):
+        (JSC::WASM::wasmCallingConvention):
+        * wasm/WASMCallingConvention.h:
+        (JSC::WASM::CallingConvention::CallingConvention):
+        (JSC::WASM::CallingConvention::marshallArgumentImpl):
+        (JSC::WASM::CallingConvention::marshallArgument):
+        (JSC::WASM::CallingConvention::loadArguments):
+        (JSC::WASM::CallingConvention::setupCall):
+        (JSC::WASM::CallingConvention::iterate): Deleted.
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::FunctionParser):
+        (JSC::WASM::FunctionParser<Context>::parseBlock):
+        (JSC::WASM::FunctionParser<Context>::parseExpression):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASM::ModuleParser::parse):
+        * wasm/WASMOps.h:
+        * wasm/WASMParser.h:
+        (JSC::WASM::Parser::parseVarUInt32):
+        (JSC::WASM::Parser::parseVarUInt64):
+        * wasm/WASMPlan.cpp:
+        (JSC::WASM::Plan::Plan):
+
+2016-10-21  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Implement InputEvent.getTargetRanges() for the input events spec
+        https://bugs.webkit.org/show_bug.cgi?id=162947
+        <rdar://problem/28853079>
+
+        Reviewed by Darin Adler.
+
+        Boilerplate change to add a runtime guard for InputEvents-related IDL interfaces. See WebCore ChangeLog entry
+        for more details.
+
+        * runtime/CommonIdentifiers.h:
+
+2016-10-20  Zan Dobersek  <zdobersek@igalia.com>
+
+        Fix JSC cast-align compiler warnings on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=163744
+
+        Reviewed by Mark Lam.
+
+        Use the reinterpret_cast_ptr workaround in a few places where
+        the cast alignment warning is being thrown by the GCC compiler
+        when compiling for the ARMv7 architecture.
+
+        * heap/Heap.cpp:
+        (JSC::Zombify::visit):
+        * heap/HeapCell.h:
+        (JSC::HeapCell::zap):
+        (JSC::HeapCell::isZapped):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::Handle::specializedSweep):
+
+2016-10-20  Filip Pizlo  <fpizlo@apple.com>
+
+        The tracking of the coarse-grain Heap state (allocating or not, collector or not, eden vs full) should respect the orthogonality between allocating and collecting
+        https://bugs.webkit.org/show_bug.cgi?id=163738
+
+        Reviewed by Geoffrey Garen.
+
+        We need to know if we're currently in an allocation slow path, so that code can assert that
+        it's not being used from inside a destructor that runs during a sweep. We need to know if
+        we're currently collecting, because some code behaves differently during collection, and
+        other code wants to assert that it's not being used from inside a visitChildren method that
+        runs during marking. If we are collecting, we need to know if it's an eden collection or a
+        full collection. If we are requesting a collection, we need to know if we're requesting an
+        eden collection, a full collection, or any kind of collection.
+
+        Prior to this change, you would reason about all of these things using the HeapOperation. It
+        had the following states: NoOperation, Allocation, FullCollection, EdenCollection, and
+        AnyCollection. NoOperation versus Allocation was primarily for asserting that sweep didn't
+        call arbitrary JS. FullCollection versus EdenCollection was about describing generations. We
+        would even use HeapOperation in places where we knew that it could only be either Full or
+        Eden, because we just needed a variable to tell us which generation we were talking about.
+        It was all very confusing.
+
+        Where it completely breaks down is the fact that a concurrent GC has two logical threads, the
+        mutator and the collector, which can change state independently. The mutator can be
+        allocating. It can also be doing some work to help the GC. That's three states: running,
+        allocating, or helping GC. At the same time, the GC thread could either be running or not,
+        and if it's running, it could be a full collection or an eden collection. Because the mutator
+        and collector can run at the same time, it means that if we used one enum, we would need nine
+        states: every combination of mutator running, allocating, or helping GC, crossed with
+        collector not running, running eden, or running full. So, this change decouples mutator state
+        from collector state and uses two separate fields with two different types.
+
+        Mutator state is described using MutatorState, which can be either MutatorState::Running,
+        MutatorState::Allocating, or MutatorState::HelpingGC.
+
+        Collector state is described using Optional<CollectionScope>. CollectionScope describes how
+        big the scope of the collection is, and it can be either CollectionScope::Eden or
+        CollectionScope::Full. If the Optional is Nullopt, it means that we are not collecting. This
+        way, you can treat collectionScope as a boolean (an Optional is true iff it's engaged). You
+        can pass around just a CollectionScope if you know that you must be collecting and you just
+        want to know about the generation. Also, we can use Nullopt in methods that request
+        collection, which those methods take to mean that they can run any kind of collection (the
+        old AnyCollection).
+
+        Another use of HeapOperation was to answer questions about whether the caller is running as
+        part of the GC or as part of the mutator. Optional<CollectionScope> does not answer this,
+        since code that runs in the mutator while the mutator is not HelpingGC at the same time as
+        the collector is running should run as if it was part of the mutator not as if it was part of
+        the GC. MutatorState is needed to answer this question, but it doesn't tell the whole story
+        since code that runs in the collector thread at the same time as the mutator is running
+        should run as if it was part of the GC not as if it was part of the mutator. So, we need to
+        know if we're on the collector thread or the mutator thread. We already have a WTF facility
+        for this, which answers if a thread is a GC thread. But we already use this to answer a
+        stronger question: are we part of the parallel GC helpers? Some functions in the GC, like
+        mark bit queries, will work fine in a concurrent collector thread so long as there is no
+        parallel marking. So, this change also changes WTF's mayBeGCThread to tell what kind of GC
+        thread we may be: either GCThreadType::Main or GCThreadType::Helper. The parallel GC safety
+        checks look for GCThreadType::Helper. The "should I run as mutator" query can now be answered
+        by checking with mayBeGCThread, which returns Optional<GCThreadType>; if engaged, then run as
+        GC, else run as GC if MutatorState is HelpingGC, else run as mutator.
+
+        This doesn't change the way that the GC behaves, but it does change how the GC represents a
+        fundamental piece of state. So, it's a big change. It should be perf-neutral (still testing).
+
+        * API/JSBase.cpp:
+        (JSSynchronousEdenCollectForDebugging):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+        * dfg/DFGWorklist.cpp:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * heap/AllocatingScope.h: Added.
+        (JSC::AllocatingScope::AllocatingScope):
+        (JSC::AllocatingScope::~AllocatingScope):
+        * heap/AllocationScope.h: Removed.
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        * heap/CodeBlockSet.h:
+        * heap/CollectionScope.cpp: Added.
+        (JSC::collectionScopeName):
+        (WTF::printInternal):
+        * heap/CollectionScope.h: Added.
+        * heap/EdenGCActivityCallback.cpp:
+        (JSC::EdenGCActivityCallback::doCollection):
+        * heap/FullGCActivityCallback.cpp:
+        (JSC::FullGCActivityCallback::doCollection):
+        * heap/GCTypeMap.h:
+        (JSC::GCTypeMap::operator[]):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::beginMarking):
+        (JSC::Heap::visitSmallStrings):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::deleteAllCodeBlocks):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::collectWithoutAnySweep):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        (JSC::Heap::pruneStaleEntriesFromWeakGCMaps):
+        (JSC::Heap::notifyIncrementalSweeper):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::isValidAllocation):
+        (JSC::Heap::shouldDoFullCollection):
+        * heap/Heap.h:
+        (JSC::Heap::mutatorState):
+        (JSC::Heap::collectionScope):
+        (JSC::Heap::operationInProgress): Deleted.
+        * heap/HeapInlines.h:
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isCurrentThreadBusy):
+        (JSC::Heap::isMarked):
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::reportExternalMemoryVisited):
+        (JSC::Heap::collectAccordingToDeferGCProbability):
+        (JSC::Heap::isBusy): Deleted.
+        (JSC::Heap::isCollecting): Deleted.
+        * heap/HeapObserver.h:
+        * heap/HeapOperation.cpp: Removed.
+        * heap/HeapOperation.h: Removed.
+        * heap/HeapVerifier.cpp:
+        (JSC::HeapVerifier::initializeGCCycle):
+        (JSC::HeapVerifier::reportObject):
+        (JSC::HeapVerifier::collectionTypeName): Deleted.
+        * heap/HeapVerifier.h:
+        (JSC::HeapVerifier::GCCycle::collectionTypeName): Deleted.
+        * heap/HelpingGCScope.h: Added.
+        (JSC::HelpingGCScope::HelpingGCScope):
+        (JSC::HelpingGCScope::~HelpingGCScope):
+        * heap/LargeAllocation.cpp:
+        (JSC::LargeAllocation::flip):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::doTestCollectionsIfNeeded):
+        (JSC::MarkedAllocator::allocateSlowCaseImpl):
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::prepareForAllocation):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        (JSC::MarkedSpace::prepareForMarking):
+        (JSC::MarkedSpace::beginMarking):
+        (JSC::MarkedSpace::snapshotUnswept):
+        * heap/MutatorState.cpp: Added.
+        (WTF::printInternal):
+        * heap/MutatorState.h: Added.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::didStartMarking):
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::protocolTypeForHeapOperation):
+        (Inspector::InspectorHeapAgent::didGarbageCollect):
+        * inspector/agents/InspectorHeapAgent.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jsc.cpp:
+        (functionFullGC):
+        (functionEdenGC):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        (JSC::loadAndEvaluateModule):
+        (JSC::loadModule):
+        (JSC::linkAndEvaluateModule):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::needsToBeVisited):
+        * runtime/VM.h:
+        (JSC::VM::isCollectorBusyOnCurrentThread):
+        (JSC::VM::isCollectorBusy): Deleted.
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::edenGC):
+
+2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
+        https://bugs.webkit.org/show_bug.cgi?id=163761
+
+        Reviewed by Keith Miller.
+
+        When we call a function in the following form,
+
+            var charAt = String.prototype.charAt;
+            charAt();  // |this| becomes the global object.
+
+        we should see |this| as undefined/null. In StringPrototype.cpp,
+        we use IsEnvironmentRecord type info flag to check whther the
+        given |this| is an environment record.
+        However, type info flag is precious thing and only StringPrototype.cpp
+        uses IsEnvironmentRecord. In addition to that, JSType should
+        already knows whether the given object is an environment record.
+        So IsEnvironmentRecord type info flag should be dropped.
+
+        This patch adds a new JSType, StrictEvalActivation. And we add a new
+        method JSObject::isEnvironmentRecord(). This method uses JSType to
+        return the result. And we drop IsEnvironmentRecord type info flag.
+        This patch makes a room for putting one bit flag to the out of line
+        type info flag. Previously, it is already exhausted.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/JSObject.h:
+        (JSC::JSObject::isStrictEvalActivation):
+        (JSC::JSObject::isEnvironmentRecord):
+        * runtime/JSSymbolTableObject.h:
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::newImpurePropertyFiresWatchpoints):
+        (JSC::TypeInfo::isEnvironmentRecord): Deleted.
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::checkObjectCoercible):
+
+2016-10-20  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly API: implement exception constructors properly
+
+         - Rename WebAssemblyObject to JSWebAssembly for consistency.
+         - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
+           use it to register JSWebAssembly's function properties through auto-generated
+           .lut.h, instead of manually.
+         - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
+         - Register WebAssembly's constructors from the global object, and hold a
+           reference to their structure and prototype so that invoking the constructor
+           can use the structure directly from the global object.
+         - Add a prototype base field to global object creation. Previous ones all had
+           Object's prototype as their base, but WebAssembly's error constructors have
+           Error as their base.
+         - Test for the error object's correctness.
+         - Add missing #if ENABLE(WEBASSEMBLY)
+
+        WebAssembly API: implement exception constructors properly
+        https://bugs.webkit.org/show_bug.cgi?id=163699
+
+        Reviewed by Keith Miller.
+
+        * CMakeLists.txt: rename WebAssemblyObject -> JSWebAssembly; add a .lut.h file
+        * DerivedSources.make: new .lut.h file
+        * JavaScriptCore.xcodeproj/project.pbxproj: ditto
+        * runtime/JSGlobalObject.cpp: new prototypeBase macro
+        (JSC::JSGlobalObject::init): register WebAssembly constructors here
+        (JSC::JSGlobalObject::visitChildren): use the macro to visit
+        * runtime/JSGlobalObject.h: declare the WebAssembly constructor macro
+        * wasm/JSWebAssembly.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::JSWebAssembly::create):
+        (JSC::JSWebAssembly::createStructure):
+        (JSC::JSWebAssembly::finishCreation):
+        (JSC::JSWebAssembly::JSWebAssembly):
+        * wasm/JSWebAssembly.h: Renamed from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/WebAssemblyObject.cpp: Removed.
+        * wasm/js/JSWebAssemblyCompileError.cpp:
+        * wasm/js/JSWebAssemblyCompileError.h:
+        (JSC::JSWebAssemblyCompileError::create): string convenience
+        * wasm/js/JSWebAssemblyInstance.cpp:
+        * wasm/js/JSWebAssemblyInstance.h:
+        * wasm/js/JSWebAssemblyMemory.cpp:
+        * wasm/js/JSWebAssemblyMemory.h:
+        * wasm/js/JSWebAssemblyModule.cpp:
+        * wasm/js/JSWebAssemblyModule.h:
+        * wasm/js/JSWebAssemblyRuntimeError.cpp:
+        * wasm/js/JSWebAssemblyRuntimeError.h:
+        (JSC::JSWebAssemblyRuntimeError::create): string convenience
+        * wasm/js/JSWebAssemblyTable.cpp:
+        * wasm/js/JSWebAssemblyTable.h:
+        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
+        (JSC::constructJSWebAssemblyCompileError):don't throw, create the object
+        (JSC::WebAssemblyCompileErrorConstructor::finishCreation):no need for the structure, it's on the global object
+        * wasm/js/WebAssemblyCompileErrorConstructor.h:
+        * wasm/js/WebAssemblyCompileErrorPrototype.cpp:
+        * wasm/js/WebAssemblyCompileErrorPrototype.h:
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        * wasm/js/WebAssemblyInstanceConstructor.h:
+        * wasm/js/WebAssemblyInstancePrototype.cpp:
+        * wasm/js/WebAssemblyInstancePrototype.h:
+        * wasm/js/WebAssemblyMemoryConstructor.cpp:
+        * wasm/js/WebAssemblyMemoryConstructor.h:
+        * wasm/js/WebAssemblyMemoryPrototype.cpp:
+        * wasm/js/WebAssemblyMemoryPrototype.h:
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        * wasm/js/WebAssemblyModuleConstructor.h:
+        * wasm/js/WebAssemblyModulePrototype.cpp:
+        * wasm/js/WebAssemblyModulePrototype.h:
+        * wasm/js/WebAssemblyPrototype.cpp: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorPrototype.cpp.
+        (JSC::webAssemblyFunctionValidate):
+        (JSC::webAssemblyFunctionCompile):
+        (JSC::WebAssemblyPrototype::create):
+        (JSC::WebAssemblyPrototype::createStructure):
+        (JSC::WebAssemblyPrototype::finishCreation):
+        (JSC::WebAssemblyPrototype::WebAssemblyPrototype):
+        * wasm/js/WebAssemblyPrototype.h: Copied from Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.h.
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
+        (JSC::constructJSWebAssemblyRuntimeError):don't throw, create the object
+        (JSC::WebAssemblyRuntimeErrorConstructor::finishCreation):no need for the structure, it's on the global object
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.h:
+        * wasm/js/WebAssemblyRuntimeErrorPrototype.cpp:
+        * wasm/js/WebAssemblyRuntimeErrorPrototype.h:
+        * wasm/js/WebAssemblyTableConstructor.cpp:
+        * wasm/js/WebAssemblyTableConstructor.h:
+        * wasm/js/WebAssemblyTablePrototype.cpp:
+        * wasm/js/WebAssemblyTablePrototype.h:
+
+2016-10-19  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [macOS] [iOS] Disable variation fonts on macOS El Capitan and iOS 9
+        https://bugs.webkit.org/show_bug.cgi?id=163374
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-10-20  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] disallow references to `await` in AsyncFunction formal parameters
+        https://bugs.webkit.org/show_bug.cgi?id=163694
+
+        Reviewed by Saam Barati.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+
+2016-10-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Move InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero to out of line type info flags
+        https://bugs.webkit.org/show_bug.cgi?id=163716
+
+        Reviewed by Saam Barati.
+
+        We found that all the accesses to the InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero flag is
+        done through the Structure. There is no user that accesses this flag in the cell inlined member. And JIT
+        code does not access it directly. That means that we can move this flag from inlined flags to out of line
+        flags. This patch moves it to the out of line flags. And make one bit empty in inlined flags. Later this
+        new empty flag will be used by megamorphic DOMJIT implementation.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::hasStaticPropertyTable):
+        (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero):
+
+2016-10-20  Keith Miller  <keith_miller@apple.com>
+
+        Invalid assertion in arguments elimination
+        https://bugs.webkit.org/show_bug.cgi?id=163740
+        <rdar://problem/27911462>
+
+        Reviewed by Michael Saboff.
+
+        The DFGFTL's arguments elimination phase incorrectly asserted that a GetFromArguments' first
+        child would always be a CreateDirectArguments.  While we only create the
+        op_get_from_arguments bytecode pointing to a create_direct_arguments, its possible for a
+        number of reasons that a DFG GetFromArguments may not point to a CreateDirectArguments. For
+        example, if we are OSR entering in some function with direct arguments the
+        CreateDirectArguments node might become ExtractOSREntryLocals.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+
+2016-10-20  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
+        https://bugs.webkit.org/show_bug.cgi?id=163714
+
+        Reviewed by Mark Lam.
+
+        According to CreateDynamicFunction() (https://tc39.github.io/ecma262/#sec-createdynamicfunction),
+        non-normal functions are not constructors. Previously, dynamically created functions would always
+        be constructible, and so it was possible to evaluate `new  (function*() {}.constructor())`,
+        and have it return an Iterator object.
+
+        This change selects a dynamically created function's ConstructAbility based on its parse mode instead.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+
+2016-10-19  JF Bastien  <jfbastien@apple.com>
+
+        create_hash_table: allow empty tables
+
+        The Windows build was broken by because I added empty tables and Windows insists that empty tables are horrible. Put in dummy entries in that case.
+
+        create_hash_table: allow empty tables
+        https://bugs.webkit.org/show_bug.cgi?id=163701
+
+        Reviewed by Keith Miller.
+
+        * create_hash_table:
+
+2016-10-19  JF Bastien  <jfbastien@apple.com>
+
+        JavaScript WebAssembly API: baby steps
+
+         - Expand WebAssembly constructors into their own files. This requires a lot of
+           boilerplate, as well as adding the .lut.h files. All of the
+           JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
+           currently the same between the 4 specified WebAssembly constructors. It'll be
+           easy to implement individual functions on constructed objects as per the
+           spec, and have each of these files diverge. The error constructors are also
+           similar, except that their instance derives from ErrorInstance.
+         - Use constructor macro when initializing the global object.
+         - Dramatically improve testing of the WebAssembly API by checking for
+           properties specified in the spec [*].
+         - Clean up assert.js' exception testing.
+         - Fix a copy-paste bug in wasm.json: floating-point const return values were
+           swapped.
+
+        [*] https://github.com/WebAssembly/design/blob/master/JS.md
+
+        Implement more of the JavaScript WebAssembly API
+        https://bugs.webkit.org/show_bug.cgi?id=163571
+
+        Reviewed by Keith Miller.
+
+        * CMakeLists.txt: add .lut.h generation
+        * DerivedSources.make: ditto
+        * JavaScriptCore.xcodeproj/project.pbxproj: add .lut.h generation and all the new files
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): use macro to list all constructors
+        * wasm/WebAssemblyObject.cpp: unboilerplate, all constructors into their own files
+        * wasm/WebAssemblyObject.h: ditto
+        * wasm/js/JSWebAssemblyCompileError.cpp: Added.
+        (JSC::JSWebAssemblyCompileError::create):
+        (JSC::JSWebAssemblyCompileError::createStructure):
+        (JSC::JSWebAssemblyCompileError::JSWebAssemblyCompileError):
+        (JSC::JSWebAssemblyCompileError::finishCreation):
+        (JSC::JSWebAssemblyCompileError::destroy):
+        (JSC::JSWebAssemblyCompileError::visitChildren):
+        * wasm/js/JSWebAssemblyCompileError.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/JSWebAssemblyInstance.cpp: Added.
+        (JSC::JSWebAssemblyInstance::create):
+        (JSC::JSWebAssemblyInstance::createStructure):
+        (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance):
+        (JSC::JSWebAssemblyInstance::finishCreation):
+        (JSC::JSWebAssemblyInstance::destroy):
+        (JSC::JSWebAssemblyInstance::visitChildren):
+        * wasm/js/JSWebAssemblyInstance.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/JSWebAssemblyMemory.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::JSWebAssemblyMemory::create):
+        (JSC::JSWebAssemblyMemory::createStructure):
+        (JSC::JSWebAssemblyMemory::JSWebAssemblyMemory):
+        (JSC::JSWebAssemblyMemory::finishCreation):
+        (JSC::JSWebAssemblyMemory::destroy):
+        (JSC::JSWebAssemblyMemory::visitChildren):
+        * wasm/js/JSWebAssemblyMemory.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/JSWebAssemblyModule.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::JSWebAssemblyModule::create):
+        (JSC::JSWebAssemblyModule::createStructure):
+        (JSC::JSWebAssemblyModule::JSWebAssemblyModule):
+        (JSC::JSWebAssemblyModule::finishCreation):
+        (JSC::JSWebAssemblyModule::destroy):
+        (JSC::JSWebAssemblyModule::visitChildren):
+        * wasm/js/JSWebAssemblyModule.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/JSWebAssemblyRuntimeError.cpp: Added.
+        (JSC::JSWebAssemblyRuntimeError::create):
+        (JSC::JSWebAssemblyRuntimeError::createStructure):
+        (JSC::JSWebAssemblyRuntimeError::JSWebAssemblyRuntimeError):
+        (JSC::JSWebAssemblyRuntimeError::finishCreation):
+        (JSC::JSWebAssemblyRuntimeError::destroy):
+        (JSC::JSWebAssemblyRuntimeError::visitChildren):
+        * wasm/js/JSWebAssemblyRuntimeError.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/JSWebAssemblyTable.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::JSWebAssemblyTable::create):
+        (JSC::JSWebAssemblyTable::createStructure):
+        (JSC::JSWebAssemblyTable::JSWebAssemblyTable):
+        (JSC::JSWebAssemblyTable::finishCreation):
+        (JSC::JSWebAssemblyTable::destroy):
+        (JSC::JSWebAssemblyTable::visitChildren):
+        * wasm/js/JSWebAssemblyTable.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/WebAssemblyCompileErrorConstructor.cpp: Added.
+        (JSC::constructJSWebAssemblyCompileError):
+        (JSC::callJSWebAssemblyCompileError):
+        (JSC::WebAssemblyCompileErrorConstructor::create):
+        (JSC::WebAssemblyCompileErrorConstructor::createStructure):
+        (JSC::WebAssemblyCompileErrorConstructor::finishCreation):
+        (JSC::WebAssemblyCompileErrorConstructor::WebAssemblyCompileErrorConstructor):
+        (JSC::WebAssemblyCompileErrorConstructor::getConstructData):
+        (JSC::WebAssemblyCompileErrorConstructor::getCallData):
+        (JSC::WebAssemblyCompileErrorConstructor::visitChildren):
+        * wasm/js/WebAssemblyCompileErrorConstructor.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyCompileErrorConstructor::CompileErrorStructure):
+        * wasm/js/WebAssemblyCompileErrorPrototype.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyCompileErrorPrototype::create):
+        (JSC::WebAssemblyCompileErrorPrototype::createStructure):
+        (JSC::WebAssemblyCompileErrorPrototype::finishCreation):
+        (JSC::WebAssemblyCompileErrorPrototype::WebAssemblyCompileErrorPrototype):
+        * wasm/js/WebAssemblyCompileErrorPrototype.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/WebAssemblyInstanceConstructor.cpp: Added.
+        (JSC::constructJSWebAssemblyInstance):
+        (JSC::callJSWebAssemblyInstance):
+        (JSC::WebAssemblyInstanceConstructor::create):
+        (JSC::WebAssemblyInstanceConstructor::createStructure):
+        (JSC::WebAssemblyInstanceConstructor::finishCreation):
+        (JSC::WebAssemblyInstanceConstructor::WebAssemblyInstanceConstructor):
+        (JSC::WebAssemblyInstanceConstructor::getConstructData):
+        (JSC::WebAssemblyInstanceConstructor::getCallData):
+        (JSC::WebAssemblyInstanceConstructor::visitChildren):
+        * wasm/js/WebAssemblyInstanceConstructor.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyInstanceConstructor::InstanceStructure):
+        * wasm/js/WebAssemblyInstancePrototype.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyInstancePrototype::create):
+        (JSC::WebAssemblyInstancePrototype::createStructure):
+        (JSC::WebAssemblyInstancePrototype::finishCreation):
+        (JSC::WebAssemblyInstancePrototype::WebAssemblyInstancePrototype):
+        * wasm/js/WebAssemblyInstancePrototype.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/WebAssemblyMemoryConstructor.cpp: Added.
+        (JSC::constructJSWebAssemblyMemory):
+        (JSC::callJSWebAssemblyMemory):
+        (JSC::WebAssemblyMemoryConstructor::create):
+        (JSC::WebAssemblyMemoryConstructor::createStructure):
+        (JSC::WebAssemblyMemoryConstructor::finishCreation):
+        (JSC::WebAssemblyMemoryConstructor::WebAssemblyMemoryConstructor):
+        (JSC::WebAssemblyMemoryConstructor::getConstructData):
+        (JSC::WebAssemblyMemoryConstructor::getCallData):
+        (JSC::WebAssemblyMemoryConstructor::visitChildren):
+        * wasm/js/WebAssemblyMemoryConstructor.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyMemoryConstructor::MemoryStructure):
+        * wasm/js/WebAssemblyMemoryPrototype.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyMemoryPrototype::create):
+        (JSC::WebAssemblyMemoryPrototype::createStructure):
+        (JSC::WebAssemblyMemoryPrototype::finishCreation):
+        (JSC::WebAssemblyMemoryPrototype::WebAssemblyMemoryPrototype):
+        * wasm/js/WebAssemblyMemoryPrototype.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/WebAssemblyModuleConstructor.cpp: Added.
+        (JSC::constructJSWebAssemblyModule):
+        (JSC::callJSWebAssemblyModule):
+        (JSC::WebAssemblyModuleConstructor::create):
+        (JSC::WebAssemblyModuleConstructor::createStructure):
+        (JSC::WebAssemblyModuleConstructor::finishCreation):
+        (JSC::WebAssemblyModuleConstructor::WebAssemblyModuleConstructor):
+        (JSC::WebAssemblyModuleConstructor::getConstructData):
+        (JSC::WebAssemblyModuleConstructor::getCallData):
+        (JSC::WebAssemblyModuleConstructor::visitChildren):
+        * wasm/js/WebAssemblyModuleConstructor.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyModuleConstructor::ModuleStructure):
+        * wasm/js/WebAssemblyModulePrototype.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyModulePrototype::create):
+        (JSC::WebAssemblyModulePrototype::createStructure):
+        (JSC::WebAssemblyModulePrototype::finishCreation):
+        (JSC::WebAssemblyModulePrototype::WebAssemblyModulePrototype):
+        * wasm/js/WebAssemblyModulePrototype.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp: Added.
+        (JSC::constructJSWebAssemblyRuntimeError):
+        (JSC::callJSWebAssemblyRuntimeError):
+        (JSC::WebAssemblyRuntimeErrorConstructor::create):
+        (JSC::WebAssemblyRuntimeErrorConstructor::createStructure):
+        (JSC::WebAssemblyRuntimeErrorConstructor::finishCreation):
+        (JSC::WebAssemblyRuntimeErrorConstructor::WebAssemblyRuntimeErrorConstructor):
+        (JSC::WebAssemblyRuntimeErrorConstructor::getConstructData):
+        (JSC::WebAssemblyRuntimeErrorConstructor::getCallData):
+        (JSC::WebAssemblyRuntimeErrorConstructor::visitChildren):
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyRuntimeErrorConstructor::RuntimeErrorStructure):
+        * wasm/js/WebAssemblyRuntimeErrorPrototype.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyRuntimeErrorPrototype::create):
+        (JSC::WebAssemblyRuntimeErrorPrototype::createStructure):
+        (JSC::WebAssemblyRuntimeErrorPrototype::finishCreation):
+        (JSC::WebAssemblyRuntimeErrorPrototype::WebAssemblyRuntimeErrorPrototype):
+        * wasm/js/WebAssemblyRuntimeErrorPrototype.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        * wasm/js/WebAssemblyTableConstructor.cpp: Added.
+        (JSC::constructJSWebAssemblyTable):
+        (JSC::callJSWebAssemblyTable):
+        (JSC::WebAssemblyTableConstructor::create):
+        (JSC::WebAssemblyTableConstructor::createStructure):
+        (JSC::WebAssemblyTableConstructor::finishCreation):
+        (JSC::WebAssemblyTableConstructor::WebAssemblyTableConstructor):
+        (JSC::WebAssemblyTableConstructor::getConstructData):
+        (JSC::WebAssemblyTableConstructor::getCallData):
+        (JSC::WebAssemblyTableConstructor::visitChildren):
+        * wasm/js/WebAssemblyTableConstructor.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyTableConstructor::TableStructure):
+        * wasm/js/WebAssemblyTablePrototype.cpp: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+        (JSC::WebAssemblyTablePrototype::create):
+        (JSC::WebAssemblyTablePrototype::createStructure):
+        (JSC::WebAssemblyTablePrototype::finishCreation):
+        (JSC::WebAssemblyTablePrototype::WebAssemblyTablePrototype):
+        * wasm/js/WebAssemblyTablePrototype.h: Copied from Source/JavaScriptCore/wasm/WebAssemblyObject.h.
+
+2016-10-19  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] forbid "use strict" directive in generator functions with non-simple parameters
+        https://bugs.webkit.org/show_bug.cgi?id=163683
+
+        Reviewed by Geoffrey Garen.
+
+        Because generator functions and async functions both have an implicit
+        inner function whose arguments are inherited from its parent, "use strict"
+        directives within these functions did not yield a SyntaxError.
+
+        Now, the correct syntax error is reported, fixing several test262 failures
+        for generators and async functions.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+
+2016-10-19  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Unreviewed, rolling out r207557.
+
+        This change caused animations/font-variations tests to time
+        out on pre-Sierra Macs.
+
+        Reverted changeset:
+
+        "[macOS] [iOS] Disable variation fonts on macOS El Capitan and
+        iOS 9"
+        https://bugs.webkit.org/show_bug.cgi?id=163374
+        http://trac.webkit.org/changeset/207557
+
+2016-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should use AutomaticThread
+        https://bugs.webkit.org/show_bug.cgi?id=163686
+
+        Reviewed by Geoffrey Garen.
+
+        Change the JITWorklist to use AutomaticThread, so that the Baseline JIT's concurrent
+        compiler thread shuts down automatically after inactivity.
+
+        With this change, all of JSC's threads shut down automatically. If you run splay for a few
+        seconds (which fires up all threads - compiler and GC) and then go to sleep for a second,
+        you'll see that the only threads left are the main thread and the bmalloc thread.
+
+        * jit/JITWorklist.cpp:
+        (JSC::JITWorklist::Thread::Thread):
+        (JSC::JITWorklist::JITWorklist):
+        (JSC::JITWorklist::completeAllForVM):
+        (JSC::JITWorklist::poll):
+        (JSC::JITWorklist::compileLater):
+        (JSC::JITWorklist::compileNow):
+        (JSC::JITWorklist::finalizePlans):
+        (JSC::JITWorklist::runThread): Deleted.
+        * jit/JITWorklist.h:
+
+2016-10-19  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [macOS] [iOS] Disable variation fonts on macOS El Capitan and iOS 9
+        https://bugs.webkit.org/show_bug.cgi?id=163374
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-10-19  Aaron Chu  <aaron_chu@apple.com>
+
+        Web Inspector: AXI: expose computed tree node and heading level
+        https://bugs.webkit.org/show_bug.cgi?id=130825
+        <rdar://problem/16442349>
+
+        Reviewed by Joseph Pecoraro.
+
+        Exposing two new accessibility properties: Heading Level and Hierarchical Level.
+
+        * inspector/protocol/DOM.json:
+
+2016-10-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG worklist should use AutomaticThread
+        https://bugs.webkit.org/show_bug.cgi?id=163615
+
+        Reviewed by Mark Lam.
+
+        AutomaticThread is a new feature in WTF that allows you to easily create worker threads that
+        shut down automatically. This changes DFG::Worklist to use AutomaticThread, so that its
+        threads shut down automatically, too. This has the potential to save a lot of memory.
+
+        This required some improvements to AutomaticThread: Worklist likes to be able to keep state
+        around for the whole lifetime of a thread, and so it likes knowing when threads are born and
+        when they die. I added virtual methods for that. Also, Worklist uses notifyOne() so I added
+        that, too.
+
+        This looks to be perf-neutral.
+
+        * dfg/DFGThreadData.cpp:
+        (JSC::DFG::ThreadData::ThreadData):
+        * dfg/DFGThreadData.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::ThreadBody::ThreadBody):
+        (JSC::DFG::Worklist::Worklist):
+        (JSC::DFG::Worklist::~Worklist):
+        (JSC::DFG::Worklist::finishCreation):
+        (JSC::DFG::Worklist::isActiveForVM):
+        (JSC::DFG::Worklist::enqueue):
+        (JSC::DFG::Worklist::compilationState):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::rememberCodeBlocks):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::Worklist::removeDeadPlans):
+        (JSC::DFG::Worklist::removeNonCompilingPlansForVM):
+        (JSC::DFG::Worklist::queueLength):
+        (JSC::DFG::Worklist::dump):
+        (JSC::DFG::Worklist::runThread): Deleted.
+        (JSC::DFG::Worklist::threadFunction): Deleted.
+        * dfg/DFGWorklist.h:
+
+2016-10-19  Dan Bernstein  <mitz@apple.com>
+
+        [Xcode] JavaScriptCore fails to build when CLANG_WARN_DOCUMENTATION_COMMENTS is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=163642
+
+        Reviewed by Darin Adler.
+
+        * API/JSClassRef.cpp: Removed a bad headerdoc comment inside an implementation file.
+        * API/JSContext.h: Changed @methodgroup to @functiongroup, because the compiler requires the
+          former to be followed by a method (and we have a property), but not the latter. Changed
+          a couple of instances of “method” to “@method”. Removed empty @param entries.
+        * API/JSContextRefInternal.h: Named a parameter referenced in a @param entry.
+        * API/JSContextRefPrivate.h: Ditto.
+        * API/JSManagedValue.h: Removed empty @param entries.
+        * API/JSObjectRef.h: Corrected parameter name in @param entry.
+        * API/JSTypedArray.h: Ditto.
+        * API/JSValue.h: Removed empty @param entries, changed @methodgroup to @functiongroup, and
+          changed @method to @property where appropriate. Removed empty @param entries.
+        * API/JSValueRef.h: Named a parameter referenced in a @param entry.
+        * API/JSWeakObjectMapRefPrivate.h: Ditto.
+        * Configurations/Base.xcconfig: Enabled CLANG_WARN_DOCUMENTATION_COMMENTS. Made the compiler
+          treat the icu headers as system headers, to stop it from emitting warnings about headers
+          we don’t want to change.
+        * Configurations/ToolExecutable.xcconfig: Made the compiler treat the icu headers as system
+          headers.
+
+2016-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed ARM buildfix after r207475.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::relinkJumpToNop):
+
+2016-10-18  Mark Lam  <mark.lam@apple.com>
+
+        Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
+        https://bugs.webkit.org/show_bug.cgi?id=154377
+        <rdar://problem/27330808>
+
+        Reviewed by Filip Pizlo and Saam Barati.
+
+        In a scenario where we cache the __proto__ accessors in global variables, and
+        later explicitly invoke those accessors as functions, the spec for Function Calls
+        (see https://tc39.github.io/ecma262/#sec-function-calls) states that the function
+        ref value is of type Reference, and base of ref is an Environment Record.  Then,
+        it follows that the thisValue should be set to refEnv.WithBaseObject()
+        (see section 4.b.ii of 12.3.4.1 at
+        https://tc39.github.io/ecma262/#sec-function-calls-runtime-semantics-evaluation).
+
+        refEnv in this case is the environment record that the cached accessors were
+        found in i.e. the global object.  The WithBaseObject() of the global object is
+        undefined (see details about WithBaseObject at
+        https://tc39.github.io/ecma262/#sec-environment-records).
+
+        Hence, the __proto__ accessors should see a thisValue of undefined, and throw
+        TypeErrors.  See https://tc39.github.io/ecma262/#sec-get-object.prototype.__proto__,
+        https://tc39.github.io/ecma262/#sec-set-object.prototype.__proto__,
+        https://tc39.github.io/ecma262/#sec-toobject, and
+        https://tc39.github.io/ecma262/#sec-requireobjectcoercible.
+
+        In JSC's implementation, the callee needs to do a ToThis operation on the
+        incoming "this" argument in order to get the specified thisValue.  The
+        implementations of the __proto__ accessors were not doing this correctly.  This
+        has now been fixed.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+
+2016-10-18  Sam Weinig  <sam@webkit.org>
+
+        Replace std::experimental::variant with WTF::Variant (or similar)
+        https://bugs.webkit.org/show_bug.cgi?id=163626
+
+        Reviewed by Chris Dumez.
+
+        Rename std::experimental::variant, Variant. Move helpers get/holds_alternative/etc.
+        into the WTF namespace.
+
+        * domjit/DOMJITReg.h:
+        (JSC::DOMJIT::Reg::gpr):
+        (JSC::DOMJIT::Reg::fpr):
+        (JSC::DOMJIT::Reg::jsValueRegs):
+
+2016-10-18  Keith Miller  <keith_miller@apple.com>
+
+        GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
+        https://bugs.webkit.org/show_bug.cgi?id=163629
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch fixes a bug in the DFG when attempt to convert a
+        GetByVal into a GetById. While converting the GetByVal, during
+        handleGetById in the Bytecode parser, we would mistakenly use the
+        opcode length of op_get_by_id rather than op_get_by_val. This causes
+        the new basic block we create to point to the wrong offset. In the
+        added test this will cause us to infinite loop.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2016-10-18  Dean Jackson  <dino@apple.com>
+
+        Remove CSS_SHAPES feature definition. This should always be on.
+        https://bugs.webkit.org/show_bug.cgi?id=163628
+        <rdar://problem/28834613>
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-10-18  Michael Saboff  <msaboff@apple.com>
+
+        Add JSC option to show time spent in each optimization phase
+        https://bugs.webkit.org/show_bug.cgi?id=163617
+
+        Reviewed by Saam Barati.
+
+        Added reportDFGPhaseTimes option.  This outputs one line per phase similar to
+            Phase CPS rethreading took 0.2661 ms
+
+        One line is output for each phase run.
+
+        * dfg/DFGPhase.h:
+        (JSC::DFG::runAndLog):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2016-10-18  Filip Pizlo  <fpizlo@apple.com>
+
+        WTF should make it easier to create threads that die automatically after inactivity
+        https://bugs.webkit.org/show_bug.cgi?id=163576
+
+        Reviewed by Andreas Kling.
+
+        Added a sleepSeconds() function, which made it easier for me to test this change.
+
+        The WTF changes in this patch change how the JSC GC manages threads: the GC threads will now
+        shut down automatically after 1 second of inactivity. Maybe this will save some memory.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionSleepSeconds):
+
+2016-10-18  Keith Miller  <keith_miller@apple.com>
+
+        Cleanup Wasm memory.
+        https://bugs.webkit.org/show_bug.cgi?id=163601
+
+        Reviewed by Saam Barati.
+
+        There were a couple of issues with the original Wasm memory patch.
+        This is a follow-up patch to fix those issues.
+
+        * wasm/WASMMemory.cpp:
+        (JSC::WASM::Memory::Memory):
+        * wasm/WASMMemory.h:
+
+2016-10-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
+        https://bugs.webkit.org/show_bug.cgi?id=163371
+
+        Reviewed by Geoffrey Garen and Saam Barati.
+
+        This adds a new kind of call inline cache for when the DFG can prove what the callee
+        executable is. In those cases, we can skip some of the things that the traditional call IC
+        would do:
+
+        - No need to check who the callee is.
+        - No need to do arity checks.
+
+        This case isn't as simple as just emitting a call instruction since the callee may not be
+        compiled at the time that the caller is compiled. So, we need lazy resolution. Also, the
+        callee may be jettisoned independently of the caller, so we need to be able to revert the
+        call to an unlinked state. This means that we need almost all of the things that
+        CallLinkInfo has. CallLinkInfo already knows about different kinds of calls. This patch
+        teaches it about new "Direct" call types.
+
+        The direct non-tail call IC looks like this:
+
+                set up arguments
+            FastPath:
+                call _SlowPath
+                lea -FrameSize(%rbp), %rsp
+
+            SlowPath:
+                pop
+                call operationLinkDirectCall
+                check exception
+                jmp FastPath
+
+        The job of operationLinkDirectCall is to link the fast path's call entrypoint of the callee.
+        This means that in steady state, a call is just that: a call. There are no extra branches or
+        checks.
+
+        The direct tail call IC is a bit more complicated because the act of setting up arguments
+        destroys our frame, which would prevent us from being able to throw an exception if we
+        failed to compile the callee. So, direct tail call ICs look like this:
+
+                jmp _SlowPath
+            FastPath:
+                set up arguments
+                jmp 0 // patch to jump to callee
+
+            SlowPath:
+                silent spill
+                call operationLinkDirectCall
+                silent fill
+                check exception
+                jmp FastPath
+
+        The jmp to the slow path is patched to be a fall-through jmp when we link the call.
+
+        Direct calls mean less code at call sites, fewer checks on the steady state call fast path,
+        and no need for arity fixup. This looks like a slight speed-up (~0.8%) on both Octane and
+        AsmBench.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::relinkJumpToNop):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::relinkJumpToNop):
+        (JSC::ARMv7Assembler::relinkJump): Deleted.
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::repatchJumpToNop):
+        (JSC::AbstractMacroAssembler::repatchJump): Deleted.
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::relinkJumpToNop):
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::callReturnLocation):
+        (JSC::CallLinkInfo::patchableJump):
+        (JSC::CallLinkInfo::hotPathBegin):
+        (JSC::CallLinkInfo::slowPathStart):
+        (JSC::CallLinkInfo::setCallee):
+        (JSC::CallLinkInfo::clearCallee):
+        (JSC::CallLinkInfo::callee):
+        (JSC::CallLinkInfo::setCodeBlock):
+        (JSC::CallLinkInfo::clearCodeBlock):
+        (JSC::CallLinkInfo::codeBlock):
+        (JSC::CallLinkInfo::setLastSeenCallee):
+        (JSC::CallLinkInfo::clearLastSeenCallee):
+        (JSC::CallLinkInfo::lastSeenCallee):
+        (JSC::CallLinkInfo::haveLastSeenCallee):
+        (JSC::CallLinkInfo::setExecutableDuringCompilation):
+        (JSC::CallLinkInfo::executable):
+        (JSC::CallLinkInfo::setMaxNumArguments):
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::specializationKindFor):
+        (JSC::CallLinkInfo::callModeFor):
+        (JSC::CallLinkInfo::isDirect):
+        (JSC::CallLinkInfo::nearCallMode):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::CallLinkInfo::setCallLocations):
+        (JSC::CallLinkInfo::addressOfMaxNumArguments):
+        (JSC::CallLinkInfo::maxNumArguments):
+        (JSC::CallLinkInfo::isTailCall): Deleted.
+        (JSC::CallLinkInfo::setUpCallFromFTL): Deleted.
+        (JSC::CallLinkInfo::callReturnLocation): Deleted.
+        (JSC::CallLinkInfo::hotPathBegin): Deleted.
+        (JSC::CallLinkInfo::callee): Deleted.
+        (JSC::CallLinkInfo::setLastSeenCallee): Deleted.
+        (JSC::CallLinkInfo::clearLastSeenCallee): Deleted.
+        (JSC::CallLinkInfo::lastSeenCallee): Deleted.
+        (JSC::CallLinkInfo::haveLastSeenCallee): Deleted.
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeDFGStatuses):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::forEachReg):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::findTerminal):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::parameterSlotsForArgCount):
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeToSuccessors):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addJSDirectCall):
+        (JSC::DFG::JITCompiler::addJSDirectTailCall):
+        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
+        (JSC::DFG::JITCompiler::JSDirectCallRecord::JSDirectCallRecord):
+        (JSC::DFG::JITCompiler::JSDirectTailCallRecord::JSDirectTailCallRecord):
+        (JSC::DFG::JITCompiler::currentJSCallIndex): Deleted.
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToDirectCall):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isTerminal):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasCellOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::link):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/Repatch.cpp:
+        (JSC::linkDirectFor):
+        (JSC::revertCall):
+        * jit/Repatch.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::prepareForExecution):
+        * runtime/Options.h:
+
+2016-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Not emit exception case if it is not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=163589
+
+        Reviewed by Sam Weinig.
+
+        We should not emit exception case if we do not use the slow path calls.
+        For example, nodeType accessor does not use the slow path calls.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::emitDOMJITGetter):
+
+2016-10-18  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] ES6 Method functions should not have prototype
+        https://bugs.webkit.org/show_bug.cgi?id=162530
+
+        Reviewed by Saam Barati.
+
+        ECMA-262 only adds "prototype" properties to specific syntactic function forms.
+        Specific items which do not contain "prototype" include (most) built-in functions (such as Math.pow),
+        MethodDefinitions which are not either class "constructor" methods or GeneratorMethods, AsyncFunctions,
+        and ArrowFunctions.
+
+        For details, see the following spec text, and the difference between GeneratorMethod evaluation and
+        the evaluation of other MethodDefinition forms.
+
+        - https://tc39.github.io/ecma262/#sec-method-definitions-runtime-semantics-propertydefinitionevaluation
+        - https://tc39.github.io/ecma262/#sec-arrow-function-definitions-runtime-semantics-evaluation
+        - https://tc39.github.io/ecmascript-asyncawait/#async-function-instances
+        - https://tc39.github.io/ecma262/#sec-generator-function-definitions-runtime-semantics-propertydefinitionevaluation
+
+
+        * runtime/Executable.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::deleteProperty):
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * runtime/Executable.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncThrowTypeErrorArgumentsCalleeAndCaller):
+
+2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Use NativeCallFrameTracer for operations used for DOMJIT slow calls
+        https://bugs.webkit.org/show_bug.cgi?id=163586
+
+        Reviewed by Saam Barati.
+
+        C functions called from the DOMJIT slow path calls should use NativeCallFrameTracer.
+        This fixes the debug assertion caused in r207427.
+
+        * bytecode/DOMJITAccessCasePatchpointParams.cpp:
+        (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
+        (JSC::DOMJITAccessCasePatchpointParams::emitSlowPathCalls):
+        * bytecode/DOMJITAccessCasePatchpointParams.h:
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::emitDOMJITGetter):
+        * jsc.cpp:
+        (WTF::DOMJITGetter::DOMJITNodeDOMJIT::slowCall):
+        (WTF::DOMJITGetterComplex::DOMJITNodeDOMJIT::slowCall):
+
+2016-10-17  Keith Miller  <keith_miller@apple.com>
+
+        Add support for WASM Memory.
+        https://bugs.webkit.org/show_bug.cgi?id=161710
+
+        Reviewed by Geoffrey Garen.
+
+        This patch add initial support for WASM memory operations. First,
+        it adds the concept of a WASM Module memory management object.
+        This object currently mmaps a 32-bit address space for WASM use,
+        although it marks all the memory outside the current breakpoint as
+        PROT_NONE. For now, we do a range check on each store and load. In
+        the future, we should change this to be an signal handler that
+        checks what module the program trapped in.
+
+        Additionally, this patch changes the way that our temporary tests
+        call into WASM code. There is now a true "thunk" that relocates
+        arguments and calls into WASM. This thunk does not tail call
+        because we use pinned values to memory base-pointer and
+        size. We use the new B3 pinned register api to pin the values.
+
+        * CMakeLists.txt:
+        * Configurations/ToolExecutable.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * testWASM.cpp:
+        (runWASMTests):
+        (main):
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::createJSWrapper):
+        (JSC::WASM::parseAndCompile):
+        * wasm/WASMB3IRGenerator.h:
+        * wasm/WASMCallingConvention.h:
+        (JSC::WASM::CallingConvention::iterate):
+        (JSC::WASM::CallingConvention::setupCall):
+        (JSC::WASM::nextJSCOffset):
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::parseExpression):
+        * wasm/WASMMemory.cpp: Copied from Source/JavaScriptCore/wasm/WASMPlan.cpp.
+        (JSC::WASM::Memory::Memory):
+        * wasm/WASMMemory.h: Copied from Source/JavaScriptCore/wasm/WASMModuleParser.h.
+        (JSC::WASM::Memory::~Memory):
+        (JSC::WASM::Memory::memory):
+        (JSC::WASM::Memory::size):
+        (JSC::WASM::Memory::pinnedRegisters):
+        (JSC::WASM::Memory::mode):
+        (JSC::WASM::Memory::growMemory):
+        (JSC::WASM::Memory::offsetOfSize):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASM::ModuleParser::parse):
+        (JSC::WASM::ModuleParser::parseMemory):
+        * wasm/WASMModuleParser.h:
+        (JSC::WASM::ModuleParser::functionInformation):
+        (JSC::WASM::ModuleParser::memory):
+        * wasm/WASMOps.h:
+        * wasm/WASMPlan.cpp:
+        (JSC::WASM::Plan::Plan):
+        * wasm/WASMPlan.h:
+        * wasm/WASMSections.h:
+
+2016-10-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add toggles for debugger pauses at console.assert failures
+        https://bugs.webkit.org/show_bug.cgi?id=139542
+        <rdar://problem/19281600>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::disable):
+        (Inspector::InspectorDebuggerAgent::setPauseOnAssertions):
+        Toggle pause on assertions state. Default is disabled,
+        and disable it when frontends disconnect.
+
+        (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
+        Instead of using the PauseOnAllExceptions state, use this
+        new state specific to assertions.
+
+        * inspector/protocol/Debugger.json:
+        New protocol method to toggle pausing on assertions.
+
+2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT][JSC] Add Option::useDOMJIT
+        https://bugs.webkit.org/show_bug.cgi?id=163457
+
+        Reviewed by Saam Barati.
+
+        Add an option to switch the DOMJIT optimization.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2016-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Air::IRC doesn't need to have a special-case for uncolored Tmps since they all get colored
+        https://bugs.webkit.org/show_bug.cgi?id=163548
+        <rdar://problem/28804381>
+
+        Reviewed by Geoffrey Garen.
+
+        Before r207408, IRC had a mode where it would silently assign the first assignable register (so
+        %rax, %xmm0, etc) to any tmp that was not colorable due to a pathological interference fencepost.
+        We reason about interference at instruction boundaries. This means that if you have, for example,
+        an instruction that clobbers all registers late followed by an instruction that has an early def
+        in the same register file, then the early def will not be colorable because it interferes with
+        all registers. This already happens in our tests, but IRC silently returns the first assignable
+        register to such tmps. For some reason the resulting code works OK - probably because this tends
+        to only be hit by fuzzing, which may not then stress that code enough to shake out the register
+        corruption. Also, this can only happen for floating point registers, so it's hard to get an
+        exciting crash. The worst case is that your numbers get all messed up.
+
+        This change fixes the issue:
+
+        - IRC will now crash if it can't color a tmp.
+
+        - IRC doesn't crash on our tests anymore because I added a padInterference() utility that works
+          around the interference problem by inserting Nops to pad between those instructions where
+          conflating their early and late actions into one interference fencepost could create an
+          uncolorable graph.
+
+        See https://bugs.webkit.org/show_bug.cgi?id=163548#c2 for a detailed discussion of how the
+        problem can arise.
+
+        This problem almost made me want to abandon our use of interference at instruction boundaries,
+        and introduce something more comprehensive, like interference at various stages of an
+        instruction's execution. The reason why I didn't do this is that this problem only arises in well
+        confined corner cases: you need an instruction that does a late use or def followed by an
+        instruction that does an early def. Register clobbers count as defs for this equation.
+        Fortunately, early defs are rare, and even when they do happen, you still need the previous
+        instruction to have a late something. Late uses are rare and many instructions don't have defs at
+        all, which means that it's actually pretty common for an instruction to not have anything late.
+        This means that the padInterference() strategy is ideal: our algorithms stay simple because they
+        only have to worry about interference at boundaries, and we rarely insert any Nops in
+        padInterference() so the IR stays nice and compact. Those Nops get removed by any phase that does
+        DCE, which includes eliminateDeadCode(), allocateStack(), and reportUsedRegisters(). In practice
+        allocateStack() kills them.
+
+        This also finally refactors our passing of RegisterSet to pass it by value, since it's small
+        enough that we're not gaining anything by using references. On x86, RegisterSet ought to be
+        smaller than a pointer.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::extraClobberedRegs):
+        (JSC::B3::StackmapSpecial::extraEarlyClobberedRegs):
+        * b3/B3StackmapSpecial.h:
+        * b3/air/AirCCallSpecial.cpp:
+        (JSC::B3::Air::CCallSpecial::extraEarlyClobberedRegs):
+        (JSC::B3::Air::CCallSpecial::extraClobberedRegs):
+        * b3/air/AirCCallSpecial.h:
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::extraClobberedRegs):
+        (JSC::B3::Air::Inst::extraEarlyClobberedRegs):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+        * b3/air/AirPadInterference.cpp: Added.
+        (JSC::B3::Air::padInterference):
+        * b3/air/AirPadInterference.h: Added.
+        * b3/air/AirSpecial.h:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::isEmpty):
+
+2016-10-17  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly JS API: implement basic stub
+
+        Implement the global WebAssembly JavaScript object, and its constructor +
+        function properties as described in:
+          https://github.com/WebAssembly/design/blob/master/JS.md
+
+        These don't do anything at the moment, the parent bug will take care of adding
+        more functionality and associated tests.
+
+        WebAssembly JS API: implement basic stub
+        https://bugs.webkit.org/show_bug.cgi?id=163404
+
+        Reviewed by Keith Miller.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinNames.h: register the new WebAssembly object's name and its constructor properties
+        * jsc.cpp: remove useless include
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): add the WebAssembly global object and its constructor properties, but only if the JSC option enables it
+        * runtime/Options.h: add the useWebAssembly (alias: enableWebAssembly) option, defaulting to false
+        * wasm/WebAssemblyObject.cpp: Added.
+        (JSC::WebAssemblyObject::create): boilerplate
+        (JSC::WebAssemblyObject::createStructure): boilerplate
+        (JSC::WebAssemblyObject::finishCreation): boilerplate
+        (JSC::WebAssemblyObject::WebAssemblyObject): boilerplate
+        (JSC::wasmObjectFuncvalidate): auto-throws for now
+        (JSC::wasmObjectFunccompile): auto-throws for now
+        * wasm/WebAssemblyObject.h: Added.
+
+2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, build fix after r207428
+        https://bugs.webkit.org/show_bug.cgi?id=163223
+
+        Previous build fix r207428 broke all the builds.
+
+        * bytecode/PolymorphicAccess.h:
+
+2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, build fix for GTK and Windows
+        https://bugs.webkit.org/show_bug.cgi?id=163223
+
+        Attempt to fix build failures in GTK port and Windows port.
+
+        * bytecode/PolymorphicAccess.cpp:
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessGenerationState::SpillState::SpillState):
+
+2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Use DOMJIT::Patchpoint in IC
+        https://bugs.webkit.org/show_bug.cgi?id=163223
+
+        Reviewed by Saam Barati.
+
+        This patch uses DOMJIT::Patchpoint to inline DOM accesses even in IC!
+        It is useful for Baseline JIT cases and GetById cases in DFG and FTL.
+        In AccessCase, we construct the environment that allows DOMJIT::Patchpoint
+        to emit code and make DOMJIT accessors inlined in IC.
+
+        To allow DOMJIT::Patchpoint to emit code, we create a mechanism to emit calls
+        required in DOMJIT::Patchpoint. This system is useful when we create the super-
+        polymorphic support[1] later. And inlining mechanism is useful even after
+        introducing super-polymorphic support since it can work even after we fire the
+        watchpoint for super-polymorphic handling.
+
+        This patch improves Dromaeo dom-traverse 8% (263.95 runs/s v.s. 244.07 runs/s).
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=163226
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/DOMJITAccessCasePatchpointParams.cpp: Added.
+        (JSC::SlowPathCallGeneratorWithArguments::SlowPathCallGeneratorWithArguments):
+        (JSC::SlowPathCallGeneratorWithArguments::generateImpl):
+        (JSC::DOMJITAccessCasePatchpointParams::emitSlowPathCalls):
+        * bytecode/DOMJITAccessCasePatchpointParams.h: Copied from Source/JavaScriptCore/ftl/FTLDOMJITPatchpointParams.h.
+        (JSC::DOMJITAccessCasePatchpointParams::DOMJITAccessCasePatchpointParams):
+        (JSC::DOMJITAccessCasePatchpointParams::SlowPathCallGenerator::~SlowPathCallGenerator):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::liveRegistersForCall):
+        (JSC::AccessGenerationState::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        (JSC::calleeSaveRegisters):
+        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
+        (JSC::AccessGenerationState::restoreLiveRegistersFromStackForCallWithThrownException):
+        (JSC::AccessGenerationState::restoreLiveRegistersFromStackForCall):
+        (JSC::AccessGenerationState::callSiteIndexForExceptionHandlingOrOriginal):
+        (JSC::AccessGenerationState::originalExceptionHandler):
+        (JSC::AccessCase::generateImpl):
+        (JSC::AccessCase::emitDOMJITGetter):
+        (JSC::PolymorphicAccess::regenerate):
+        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCall): Deleted.
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessGenerationState::SpillState::isEmpty):
+        (JSC::AccessGenerationState::setSpillStateForJSGetterSetter):
+        (JSC::AccessGenerationState::spillStateForJSGetterSetter):
+        (JSC::AccessGenerationState::liveRegistersForCall): Deleted.
+        (JSC::AccessGenerationState::numberOfStackBytesUsedForRegisterPreservation): Deleted.
+        (JSC::AccessGenerationState::liveRegistersToPreserveAtExceptionHandlingCallSite): Deleted.
+        * dfg/DFGDOMJITPatchpointParams.cpp:
+        * dfg/DFGDOMJITPatchpointParams.h:
+        * domjit/DOMJITPatchpoint.h:
+        * domjit/DOMJITPatchpointParams.h:
+        (JSC::DOMJIT::PatchpointParams::addSlowPathCall):
+        * ftl/FTLDOMJITPatchpointParams.cpp:
+        * ftl/FTLDOMJITPatchpointParams.h:
+        * jsc.cpp:
+        (WTF::DOMJITNode::checkDOMJITNode):
+        (WTF::DOMJITGetterComplex::DOMJITGetterComplex):
+        (WTF::DOMJITGetterComplex::createStructure):
+        (WTF::DOMJITGetterComplex::create):
+        (WTF::DOMJITGetterComplex::DOMJITNodeDOMJIT::DOMJITNodeDOMJIT):
+        (WTF::DOMJITGetterComplex::domJITNodeGetterSetter):
+        (WTF::DOMJITGetterComplex::finishCreation):
+        (WTF::DOMJITGetterComplex::functionEnableException):
+        (WTF::DOMJITGetterComplex::customGetter):
+        (GlobalObject::finishCreation):
+        (functionCreateDOMJITGetterComplexObject):
+
+2016-10-17  Saam Barati  <sbarati@apple.com>
+
+        Build fix for HasOwnPropertyCache::Entry caused slowdown by introducing a constructor that doesn't use move semantics for the RefPtr<UniquedStringImpl> parameter
+        https://bugs.webkit.org/show_bug.cgi?id=163490
+
+        Reviewed by Darin Adler.
+
+        * runtime/HasOwnPropertyCache.h:
+        (JSC::HasOwnPropertyCache::Entry::Entry):
+        (JSC::HasOwnPropertyCache::tryAdd):
+
+2016-10-17  Mark Lam  <mark.lam@apple.com>
+
+        Use the reject() helper function for conditionally throwing TypeErrors.
+        https://bugs.webkit.org/show_bug.cgi?id=163491
+
+        Reviewed by Filip Pizlo.
+
+        In some places where we may conditionally throw a TypeError (e.g. when in strict
+        mode), we already use the reject() helper function to conditionally throw the
+        TypeError.  Doing so makes the code mode compact.  This patch applies this idiom
+        consistently in all places that throws TypeError where appropriate.
+
+        This patch also does the following:
+        1. Make the reject() helper function take an ASCIILiteral instead of a const char*
+           because we always pass it a literal string anyway.
+        2. Change the reject helper() to take a ThrowScope&.  This allows the thrown
+           error to be attributed to its caller.
+        3. When an error message string is instantiated repeatedly in more than 1 place,
+           create a common copy of that literal string in JSObject.cpp (if one doesn't
+           already exist) and use that common string in all those places.
+        4. Since I was auditing call sites of throwTypeError() to check if they should be
+           using the reject() helper instead, I also fixed those up to pass the error
+           message as an ASCIILiteral where appropriate.
+        5. In functions that I touched, change the code to not recompute the VM& when it
+           is already available.
+
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncReverse):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/GetterSetter.cpp:
+        (JSC::callSetter):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::pop):
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::put):
+        (JSC::JSArrayBuffer::defineOwnProperty):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::put):
+        (JSC::JSDataView::defineOwnProperty):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndex):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::defineOwnProperty):
+        * runtime/JSObject.cpp:
+        (JSC::ordinarySetSlow):
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::validateAndApplyPropertyDescriptor):
+        * runtime/JSObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putInline):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setPrototype):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::defineOwnProperty):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        * runtime/Reject.h:
+        (JSC::reject):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayEntry::put):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::StringObject::putByIndex):
+        * runtime/SymbolConstructor.cpp:
+        (JSC::symbolConstructorKeyFor):
+
+2016-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Air::IRC needs to place all Tmps on some worklist, even if they have no interference edges
+        https://bugs.webkit.org/show_bug.cgi?id=163509
+
+        Reviewed by Mark Lam.
+
+        The worklist building function in IRC skips temporaries that have no degree. This doesn't appear
+        to be necessary. This has been there since the original IRC commit. It hasn't caused bugs because
+        ordinarily, the only way to have a tmp with no degree is to not have any mention of that tmp. But
+        while working on bug 163371, I hit a crazy corner case where a temporary would have no
+        interference edges (i.e. no degree). Here's how it happens:
+
+        A spill tmp from a previous iteration of IRC may have no degree: imagine a tmp that is live
+        everywhere and interferes with everyone, but has one use like:
+
+        Move %ourTmp, %someOtherTmp
+
+        Where there are no other tmps live.  After spill conversion, this may look like:
+
+        Move (ourSpill), %newTmp
+        Move %newTmp, %someOtherTmp
+
+        Of course, we'd rather not get this kind of spill code but it's totally possible because we now
+        have a bunch of random conditions under which we won't slap the spill address directly into the
+        Move.
+
+        After this happens, assuming that the only thing live was %someOtherTmp, we will have zero degree
+        for %newTmp because the Move is coalescable and does not contribute to interference.
+
+        Then, we might coalesce %someOtherTmp with %newTmp.  Once this happens, if we make the %newTmp be
+        the master, we're in deep trouble because %newTmp is not on any worklist.
+
+        I don't know how to reproduce this except through the patch in bug 163371. Removing the two lines
+        of code that skipped no-degree tmps causes no regressions, and resolves the problem I was having.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+
+2016-10-15  Mark Lam  <mark.lam@apple.com>
+
+        Add a $vm.getpid() method.
+        https://bugs.webkit.org/show_bug.cgi?id=163493
+
+        Reviewed by Saam Barati.
+
+        This is especially useful when we need to know the pid of an instance of jsc in
+        the foreground that we're trying to attach a debugger to while the JSC tests are
+        running in the background with a gazillion other jsc processes live at the same
+        time.
+
+        Currently, $vm.getpid() is only supported on non-Windows platforms.
+        According to https://msdn.microsoft.com/en-us/library/ms235372.aspx, getpid() is
+        deprecated.  According to https://msdn.microsoft.com/en-us/library/t2y34y40.aspx,
+        _getpid() cannot be used in applications that execute in the Windows Runtime.
+
+        Since this is only a debugging tool and is not a required feature, I'll defer
+        the Windows implementation of this function till the time when someone actually
+        needs it.
+
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionGetPID):
+        (JSC::JSDollarVMPrototype::finishCreation):
+
+2016-10-15  Saam Barati  <sbarati@apple.com>
+
+        Assertion failed under operationToLowerCase with a rope with zero length
+        https://bugs.webkit.org/show_bug.cgi?id=163314
+
+        Reviewed by Mark Lam.
+
+        There are some ways to get JSC to create empty rope strings. ToLowerCase
+        inside the DFG/FTL goes to the slow path when the argument is a rope.
+        operationToLowerCase was calling into a WTF string function that
+        assumed we are passing it a this value that has non-zero length.
+        However, we were calling it with a string that did have zero length.
+        To fix this, we make operationToLowerCase return the empty JSString
+        if it is going to make a string with zero length.
+
+        * dfg/DFGOperations.cpp:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionIsRope):
+
+2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] op_negate should with any type
+        https://bugs.webkit.org/show_bug.cgi?id=162587
+
+        Reviewed by Saam Barati.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        ArithNegate is quite simple. If the input is double, the output
+        is double. The other cases are set from the LLInt slow case.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        Tweak a bit the IntegerRangeOptimizationPhase when simplifying
+        ArithAbs to ArithNegate.
+        We should not do the conversion if the target nodes OSR Exits
+        on different input than the source node.
+
+        In particular, Checked ArithNegate exits on zero while
+        ArithAbs has not problem with it.
+        Unchecked ArithAbs() do not OSR Exit on INT_MIN, ArithNeg
+        should not either.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileMathIC):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMathIC):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
+
+        * jit/JITNegGenerator.cpp:
+        (JSC::JITNegGenerator::generateFastPath):
+        * jit/JITOperations.cpp:
+        Add result profiling in baseline to have types we can use
+        in DFG and FTL.
+
+2016-10-14  Keith Miller  <keith_miller@apple.com>
+
+        B3 needs a special WasmAddress Opcode
+        https://bugs.webkit.org/show_bug.cgi?id=163394
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds support for WasmAddress. WasmAddress will be used by
+        Wasm to compute the address of a memory operation from the pinned
+        base pointer. WasmAddress takes an IntPtr so we can avoid emitting
+        unnecessary Move32s in Air. This could happen in the following case:
+
+        @ptr = Trunc(...)
+        WasmAddress(@ptr, pinnedGPR)
+        ...
+        PatchPoint(...) // Do Wasm call
+        WasmAddress(@ptr, pinnedGPR)
+        ...
+
+        In this case we will not be able to CSE the WasmAddresses since the
+        call writes to pinnedGPR. Thus if WasmAddress took an Int32 we would need
+        to emit an extra Move32 at the second WasmAddress to ensure it saw a proper
+        32-bit value. If Wasm ensures that there there is a leading ZExt32 then
+        the duplicated moves become unnecessary.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        * b3/B3WasmAddressValue.cpp: Added.
+        (JSC::B3::WasmAddressValue::~WasmAddressValue):
+        (JSC::B3::WasmAddressValue::dumpMeta):
+        (JSC::B3::WasmAddressValue::cloneImpl):
+        (JSC::B3::WasmAddressValue::WasmAddressValue):
+        * b3/B3WasmAddressValue.h: Added.
+        * b3/testb3.cpp:
+        (JSC::B3::testWasmAddress):
+        (JSC::B3::run):
+
+2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: @isConstructor incorrectly thinks Math.cos is a constructor
+        https://bugs.webkit.org/show_bug.cgi?id=163437
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getConstructData):
+        By default, Host JSFunctions are not constructable. They get
+        the default callHostFunctionAsConstructor native constructor.
+        When getting construct data we can return ConstructType::None
+        in these cases instead of indicating it might be constructable
+        and later throwing an exception when construction is attempted.
+
+2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Unreviewed, rolling out r207322.
+
+        This change caused JSC test failures
+
+        Reverted changeset:
+
+        "Fix Array.prototype.splice ES6 compliance."
+        https://bugs.webkit.org/show_bug.cgi?id=163372
+        http://trac.webkit.org/changeset/207322
+
+2016-10-14  Mark Lam  <mark.lam@apple.com>
+
+        JSON.parse should not modify frozen objects.
+        https://bugs.webkit.org/show_bug.cgi?id=163430
+
+        Reviewed by Saam Barati.
+
+        The ES6 spec for JSON.parse (https://tc39.github.io/ecma262/#sec-json.parse and
+        https://tc39.github.io/ecma262/#sec-internalizejsonproperty) states that it uses
+        CreateDataProperty() (https://tc39.github.io/ecma262/#sec-createdataproperty) to
+        set values returned by a reviver.  The spec for CreateDataPropertyOrThrow states:
+
+        "This abstract operation creates a property whose attributes are set to the same
+        defaults used for properties created by the ECMAScript language assignment
+        operator. Normally, the property will not already exist. If it does exist and is
+        not configurable or if O is not extensible, [[DefineOwnProperty]] will return
+        false."
+
+        Note: CreateDataProperty() will not throw a TypeError.
+
+        Since the properties of frozen objects are not extensible, not configurable, and
+        not writeable, JSON.parse should fail to write to any frozen objects.  Similarly,
+        JSON.parse should fail to delete properties in frozen objects.
+
+        In JSON.parse(), we previously write to array elements using the form of
+        putDirectIndex() that uses mode PutDirectIndexLikePutDirect.  This makes it so
+        that the write (i.e. put) is always successful.  We've now fixed this to use
+        PutDirectIndexShouldNotThrow mode instead, which will fail to put the element if
+        the array is not writeable.
+
+        Also changed Walker::walk() to use the version of methodTable() that takes a VM&
+        since the VM& is already available.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+
+2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: Failure with RegExp.prototype.compile when pattern is undefined
+        https://bugs.webkit.org/show_bug.cgi?id=163431
+
+        Reviewed by Yusuke Suzuki.
+
+        If pattern is undefined let P be the empty String.
+        https://tc39.github.io/ecma262/#sec-regexpinitialize
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+
+2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=163426
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode):
+        It matters where emitExpressionInfo is called since it gathers
+        info about where we are in the instruction stream. We need to
+        emit it before the bytecode that we want to associate the data
+        with. In this case, before the getById / getByVal.
+
+2016-10-13  Mark Lam  <mark.lam@apple.com>
+
+        Fix Array.prototype.splice ES6 compliance.
+        https://bugs.webkit.org/show_bug.cgi?id=163372
+
+        Reviewed by Geoffrey Garen and Yusuke Suzuki.
+
+        Our Array.prototype.splice implementation neglected to set length on the result
+        array (step 12 of https://tc39.github.io/ecma262/#sec-array.prototype.splice) in
+        a certain code path.  This is now fixed.
+
+        I'm deferring the implementation of step 8 till later because it requires more
+        careful consideration and the fix is of a lesser value (and therefore, of less
+        urgency).  See https://bugs.webkit.org/show_bug.cgi?id=163417
+
+        Also added some needed exception checks and assertions.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+
+2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Stepping highlight for dot/bracket expressions in if statements highlights subset of the expression
+        https://bugs.webkit.org/show_bug.cgi?id=163378
+        <rdar://problem/28749376>
+
+        Reviewed by Saam Barati.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        Since each expression builds on the previous, always keep the starting
+        location the first location.
+
+2016-10-13  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win64] Compile fix.
+        https://bugs.webkit.org/show_bug.cgi?id=163384
+
+        Reviewed by Brent Fulgham.
+
+        Fix use of potentially uninitialized variable.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-10-12  Chris Dumez  <cdumez@apple.com>
+
+        [Web IDL] Drop support for legacy [ConstructorConditional=*]
+        https://bugs.webkit.org/show_bug.cgi?id=163368
+
+        Reviewed by Ryosuke Niwa.
+
+        Drop ENABLE_DOM4_EVENTS_CONSTRUCTOR compiler flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-10-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: step-into `console.log(o)` should not step through inspector javascript
+        https://bugs.webkit.org/show_bug.cgi?id=161656
+        <rdar://problem/28181123>
+
+        Reviewed by Timothy Hatcher.
+
+        * debugger/Debugger.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::pauseIfNeeded):
+        If the Script is blacklisted skip checking if we need to pause.
+
+        (JSC::Debugger::isBlacklisted):
+        (JSC::Debugger::addToBlacklist):
+        (JSC::Debugger::clearBlacklist):
+        Add the ability to add a Script to a blacklist. Currently the blacklist
+        only prevents pausing in the Script.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::isWebKitInjectedScript):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        Always add Internal InjectedScripts to the Debugger's blacklist.
+
+        (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
+        Clear blacklists when clearing debugger state.
+
+2016-10-12  Keith Miller  <keith_miller@apple.com>
+
+        B3 needs a special WasmBoundsCheck Opcode
+        https://bugs.webkit.org/show_bug.cgi?id=163246
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds a new Opcode, WasmBoundsCheck, as well as a B3::Value subclass for it,
+        WasmBoundsCheckValue. WasmBoundsCheckValue takes three pieces of information. The first is
+        the Int32 pointer value used to be used by the Load.  Next is the pinned register. The
+        pinned register must be pinned by calling proc.setPinned() prior to compiling the
+        Procedure. Lastly, the WasmBoundsCheckValue takes an offset. The WasmBoundsCheckValue is
+        will then emit code that side-exits if the Int64 sum of the offset and pointer is greater
+        than or equal to the value in the pinnedRegister. Instead of taking a generator for each
+        value like Check/Patchpoint, WasmBoundsCheck gets its generator directly off Air::Code. In
+        Air this patch adds a new Custom opcode, WasmBoundsCheck.
+
+        In the future we should add WasmBoundsCheck to CSE so it can eliminate redundant bounds
+        checks. At the first cut, we can remove any WasmBoundsCheck dominated by another
+        WasmBoundsCheck with the same pointer and pinnedGPR, and a larger offset.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::setWasmBoundsCheckGenerator):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::setWasmBoundsCheckGenerator):
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::typeFor):
+        * b3/B3WasmBoundsCheckValue.cpp: Added.
+        (JSC::B3::WasmBoundsCheckValue::~WasmBoundsCheckValue):
+        (JSC::B3::WasmBoundsCheckValue::WasmBoundsCheckValue):
+        (JSC::B3::WasmBoundsCheckValue::dumpMeta):
+        * b3/B3WasmBoundsCheckValue.h: Added.
+        (JSC::B3::WasmBoundsCheckValue::accepts):
+        (JSC::B3::WasmBoundsCheckValue::pinnedGPR):
+        (JSC::B3::WasmBoundsCheckValue::offset):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::setWasmBoundsCheckGenerator):
+        (JSC::B3::Air::Code::wasmBoundsCheckGenerator):
+        * b3/air/AirCustom.cpp:
+        (JSC::B3::Air::WasmBoundsCheckCustom::isValidForm):
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::WasmBoundsCheckCustom::forEachArg):
+        (JSC::B3::Air::WasmBoundsCheckCustom::isValidFormStatic):
+        (JSC::B3::Air::WasmBoundsCheckCustom::admitsStack):
+        (JSC::B3::Air::WasmBoundsCheckCustom::isTerminal):
+        (JSC::B3::Air::WasmBoundsCheckCustom::hasNonArgNonControlEffects):
+        (JSC::B3::Air::WasmBoundsCheckCustom::generate):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testWasmBoundsCheck):
+        (JSC::B3::run):
+
+2016-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        The blackening of CellState is a bad way of tracking if the object is being marked for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=163343
+
+        Reviewed by Mark Lam.
+
+        When I first added the concept of NewGrey/OldGrey, I had the SlotVisitor store the old cell
+        state in itself, so that it could use it to decide what to do for reportExtraMemoryVisited().
+
+        Then I changed it in a recent commit, because I wanted the freedom to have SlotVisitor visit
+        multiple objects in tandem. But I never ended up using this capability. Still, I liked the
+        new way better: instead of the SlotVisitor rembemering the state-before-blackening, we would
+        make the object's state reflect whether it was black for the first time or not. That seemed
+        convenient.
+
+        Unfortunately it's wrong. After we blacken the object, a concurrent barrier could instantly
+        grey it. Then we would forget that we are visiting this object for the first time.
+        Subsequent visits will think that they are not the first. So, we will fail to do the right
+        thing in reportExtraMemoryVisited().
+
+        So, this reverts that change. This is a little more than just a revert, though. I've changed
+        the terminology a bit. For example, I got tired of reading Black and having to remind myself
+        that it really means that the object has begun being visited, instead of the more strict
+        meaning that implies that it has already been visited. We want to say that it's Black or
+        currently being scanned. I'm going to adopt Siebert's term for this: Anthracite [1]. So, our
+        black CellState is now called AnthraciteOrBlack.
+
+        [1] https://pdfs.semanticscholar.org/7ae4/633265aead1f8835cf7966e179d02c2c8a4b.pdf
+
+        * heap/CellState.h:
+        (JSC::isBlack): Deleted.
+        (JSC::blacken): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::writeBarrierSlowPath):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::reportExternalMemoryVisited):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::visitChildren):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExtraMemoryVisited):
+        (JSC::SlotVisitor::reportExternalMemoryVisited):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+
+2016-10-12  Mark Lam  <mark.lam@apple.com>
+
+        Rename variables in arrayProtoFuncSplice() to match names in the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=163354
+
+        Reviewed by Saam Barati.
+
+        This will make it easier to see whether the code matches the spec or not.
+        Ref: https://tc39.github.io/ecma262/#sec-array.prototype.splice
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+
+2016-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT][JSC] Explore the way to embed nodeType into JSC::JSType in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=163245
+
+        Reviewed by Filip Pizlo.
+
+        We reserve the highest bit of JSC::JSType for extensions outside JSC.
+        JSC does not use JSType bits so many: only 52 types are defined.
+
+        And we extend CallDOM patchpoint to claim that it does not require a global object.
+        This global object is used to generate a DOM wrapper. However, nodeType does not require
+        it since it just returns integer. In the future, we will extend CallDOM to claim
+        its result type. And we can decide this `requireGlobalObject` condition automatically
+        according to the result type.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCheckDOMPatchpoint):
+        (JSC::DFG::Node::checkDOMPatchpoint):
+        (JSC::DFG::Node::hasCallDOMPatchpoint):
+        (JSC::DFG::Node::callDOMPatchpoint):
+        (JSC::DFG::Node::hasDOMJIT): Deleted.
+        (JSC::DFG::Node::domJIT): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCallDOM):
+        (JSC::DFG::SpeculativeJIT::compileCheckDOM):
+        * domjit/DOMJITCallDOMPatchpoint.h: Copied from Source/JavaScriptCore/domjit/DOMJITGetterSetter.h.
+        (JSC::DOMJIT::CallDOMPatchpoint::create):
+        * domjit/DOMJITGetterSetter.h:
+        * domjit/DOMJITPatchpoint.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
+        * jsc.cpp:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/JSType.h:
+
+2016-10-12  Keith Miller  <keith_miller@apple.com>
+
+        Handle non-function, non-undefined comparator in Array.prototype.sort
+        https://bugs.webkit.org/show_bug.cgi?id=163085
+
+        Reviewed by Yusuke Suzuki.
+
+        * builtins/ArrayPrototype.js:
+        (sort.comparatorSort):
+        (sort.stringSort):
+        (sort):
+
+2016-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r207179): ASSERTION FAILED: node.cell != previousCell
+        https://bugs.webkit.org/show_bug.cgi?id=163337
+
+        Reviewed by Mark Lam.
+
+        It turns out that HeapSnapshot was not down with revisiting. The concurrent GC is going to be
+        built around the idea that we can revisit objects many times. This means that any action that
+        should only take place once per object must check the object's state. This fixes the snapshot
+        code to do this.
+
+        While writing this code, I realized that we're actually doing this check incorrectly, so I
+        filed bug 163343. That bug requires a race, so we aren't going to see it yet.
+
+        * heap/HeapSnapshot.cpp:
+        (JSC::HeapSnapshot::finalize):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::visitChildren):
+
+2016-10-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Improve support for logging Proxy objects in console
+        https://bugs.webkit.org/show_bug.cgi?id=163323
+        <rdar://problem/28432553>
+
+        Reviewed by Timothy Hatcher.
+
+        This is based off of similiar patches in Blink for Proxy handling.
+
+        * bindings/ScriptValue.cpp:
+        (Deprecated::ScriptValue::isEqual):
+        Use strict equality. This is the intent, and it prevents the possibility of triggering
+        primitive conversion on objects in previous ConsoleMessage argument lists.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._propertyDescriptors):
+        Bail if the object is a Proxy.
+
+        (InjectedScript.prototype._describe):
+        Provide a friendlier name, "Proxy" instead of "ProxyObject".
+
+        (InjectedScript.RemoteObject):
+        When generating a preview for a Proxy object, generate it from the final target
+        and mark it as lossy so that the object can always be expanded to get the internal
+        target/handler properties.
+
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        New subtype for Proxy objects.
+
+        (Inspector::JSInjectedScriptHost::proxyTargetValue):
+        Resolve the final target value for a Proxy.
+
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionProxyTargetValue):
+        Add the new method.
+
+        * inspector/ScriptArguments.cpp:
+        (Inspector::ScriptArguments::getFirstArgumentAsString):
+        Avoid triggering Proxy traps on a Proxy object when getting a quick
+        string description for ConsoleMessages.
+
+        * inspector/protocol/Runtime.json:
+        Add new "proxy" subtype.
+
+2016-10-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Emit DebugHooks uniformly with pause locations instead of having separate pause locations and op_debug emits
+        https://bugs.webkit.org/show_bug.cgi?id=162809
+
+        Reviewed by Geoffrey Garen.
+
+        Change how BytecodeGeneration emits debug hooks to be more consistent.
+        Previously most nodes individually generated their own debug hook
+        and we asserted that it matched a breakpoint location identified
+        by the parser. This could get out of sync, or nodes could forget to
+        emit debug hooks expected by the parser.
+
+        With this change, we always check and emit a debug hook for any
+        node. The default behavior is for BytecodeGenerator::emitNode
+        to emit the debug hook when emitting the node itself. This covers
+        the majority of cases (statements).
+
+        There are a few exceptions where we continue to need to customize
+        emitting debug hooks:
+
+            1. Nodes with emitBytecodeInConditionContext
+                - non-Expression nodes customize how they emit their children
+                - constants conditions may emit nothing, but we had recorded a breakpoint location so emit a debug hook
+                - always emit one debug hook in case we recorded a breakpoint location, but avoid emitting multiple
+                  in nodes which may call up to the ExpressionNode::emitBytecodeInConditionContext base impl.
+            2. Specialized Debug Hooks
+                - such as hooks for Program start/end, debugger statements, etc.
+            3. Debug Hooks in for..of / for..in that don't correspond to re-emitting nodes
+                - such as pausing on the assignment expression inside these loops
+
+        The majority of nodes no longer have custom emits.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInTailPosition):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        By default, when emitting a node check if we should also emit an op_debug for it.
+        This default DebugHook is WillExecuteStatement, which is a normal pause point.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConstantNode::emitBytecodeInConditionContext):
+        (JSC::LogicalNotNode::emitBytecodeInConditionContext):
+        (JSC::BinaryOpNode::emitBytecodeInConditionContext):
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext):
+        The parser would have generated a pause location for these conditions
+        no matter what constant folding and re-writing these nodes may perform.
+        So, when emitting these nodes in condition context check if they need
+        emit their own debug hook.
+
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::DeclarationStatement::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        No longer need to custom emit debug hooks. The default emitNode will handle these.
+
+        (JSC::ForInNode::emitBytecode):
+        Include extra debug hooks the user expects to return back to the assignment
+        expression in the loop header before starting the body again. The same is done
+        for for..of with emitEnumeration.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createExportDefaultDeclaration):
+        (JSC::ASTBuilder::createExportLocalDeclaration):
+        These are no longer needed to fake-satisfy assertions. We never wanted to
+        emit debug hooks for these inner statements because the export statement
+        will already have the debug hooks.
+
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createForOfLoop):
+        Include the correct location where the declaration starts.
+
+        (JSC::ASTBuilder::breakpointLocation):
+        Simplify to a general implementation for Node.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createForOfLoop):
+        Ignore the new extra parameter.
+
+        * parser/Nodes.h:
+        (JSC::Node::needsDebugHook):
+        (JSC::Node::setNeedsDebugHook):
+        (JSC::ExpressionNode::needsDebugHook): Deleted.
+        (JSC::ExpressionNode::setNeedsDebugHook): Deleted.
+        (JSC::StatementNode::isEmptyStatement): Deleted.
+        (JSC::StatementNode::needsDebugHook): Deleted.
+        (JSC::StatementNode::setNeedsDebugHook): Deleted.
+        Move debug hook logic into the base Node class.
+
+        (JSC::StatementNode::isDebuggerStatement):
+        Provide a way to distinguish a debugger statement.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseForStatement):
+        Provide the location before the declaration starts.
+
+2016-10-12  Mark Lam  <mark.lam@apple.com>
+
+        Array.prototype.slice should not modify frozen objects.
+        https://bugs.webkit.org/show_bug.cgi?id=163338
+
+        Reviewed by Filip Pizlo.
+
+        1. The ES6 spec for Array.prototype.slice
+           (https://tc39.github.io/ecma262/#sec-array.prototype.slice) states that it uses
+           the CreateDataPropertyOrThrow()
+           (https://tc39.github.io/ecma262/#sec-createdatapropertyorthrow) to add items to
+           the result array.  The spec for CreateDataPropertyOrThrow states:
+
+           "This abstract operation creates a property whose attributes are set to the
+           same defaults used for properties created by the ECMAScript language assignment
+           operator. Normally, the property will not already exist. If it does exist and
+           is not configurable or if O is not extensible, [[DefineOwnProperty]] will
+           return false causing this operation to throw a TypeError exception."
+
+        2. Array.prototype.slice also uses a Set function
+           (https://tc39.github.io/ecma262/#sec-set-o-p-v-throw) to set the "length"
+           property and passes true for the Throw argument.  Ultimately, it ends up
+           calling the OrdinarySet function
+           (https://tc39.github.io/ecma262/#sec-ordinaryset) that will fail if the
+           property is not writable.  This failure should result in a TypeError being
+           thrown in Set.
+
+           Since the properties of frozen objects are not extensible, not configurable,
+           and not writeable, Array.prototype.slice should fail to write to the result
+           array if it is frozen.
+
+        If the source array being sliced has 1 or more elements, (1) will take effect
+        when we try to set the element in the non-writeable result obj.
+        If the source array being sliced has 0 elements, we will not set any elements and
+        (1) will not trigger.  Subsequently, (2) will take effect when we will try to
+        set the length of the result obj.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putLength):
+        (JSC::setLength):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+
+2016-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove JITWriteBarrier.h
+        https://bugs.webkit.org/show_bug.cgi?id=163334
+
+        Reviewed by Mark Lam.
+
+        I guess that the idea of JITWriteBarrier was to make sure that if you slap some heap pointer
+        bits into machine code, then you better execute a barrier on the code block. But it's a
+        complicated piece of code, and I can never remember how it quite works. These days it looks
+        vestigial, particularly since only the CallLinkInfo patchable callee immediate uses it. It's
+        not really necessary to have something like this, since our convention is that any pointer
+        stored in machine code must always be shadowed in the GC heap. I think that convention has
+        won by overwhelming majority, so we should finally remove JITWriteBarrier.
+
+        A practical outcome of this change is that it makes it easier to implement DirectCall ICs,
+        which will have to store the callee in the CallLinkInfo but not in the machine code.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::setCallee):
+        (JSC::CallLinkInfo::clearCallee):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::setCallee): Deleted.
+        (JSC::CallLinkInfo::clearCallee): Deleted.
+        * heap/SlotVisitor.h:
+        * jit/JITWriteBarrier.h: Removed.
+
+2016-10-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix for GCC 4.9 after r207186.
+        https://bugs.webkit.org/show_bug.cgi?id=163255
+
+        * runtime/HasOwnPropertyCache.h:
+        (JSC::HasOwnPropertyCache::Entry::Entry):
+
+2016-10-11  Saam Barati  <sbarati@apple.com>
+
+        HasOwnPropertyCache needs to ref the UniquedStringImpls it sees
+        https://bugs.webkit.org/show_bug.cgi?id=163255
+
+        Reviewed by Geoffrey Garen.
+
+        The cache needs to be responsible for ensuring that things
+        in the cache stay alive. Before, it wasn't doing this, and
+        that was wrong.
+
+        * runtime/HasOwnPropertyCache.h:
+        (JSC::HasOwnPropertyCache::Entry::operator=):
+        (JSC::HasOwnPropertyCache::operator delete):
+        (JSC::HasOwnPropertyCache::create):
+        (JSC::HasOwnPropertyCache::get):
+        (JSC::HasOwnPropertyCache::tryAdd):
+        (JSC::HasOwnPropertyCache::clear):
+        (JSC::HasOwnPropertyCache::zeroBuffer):
+
+2016-10-06  Filip Pizlo  <fpizlo@apple.com>
+
+        MarkedBlock should know what objects are live during marking
+        https://bugs.webkit.org/show_bug.cgi?id=162309
+
+        Reviewed by Geoffrey Garen.
+
+        It used to be that we would forget which objects are live the moment we started collection.
+        That's because the flip at the beginning clears all mark bits.
+
+        But we already have a facility for tracking objects that are live-but-not-marked. It's called
+        newlyAllocated. So, instead of clearing mark bits, we want to just transfer them to
+        newlyAllocated. Then we want to clear all newlyAllocated after GC.
+
+        This implements such an approach, along with a versioning optimization for newlyAllocated.
+        Instead of walking the whole heap to clear newlyAllocated bits at the end of the GC, we bump
+        the newlyAllocatedVersion, which causes MarkedBlock to treat newlyAllocated as if it was
+        clear.
+
+        We could have even avoided allocating newlyAllocated in most cases, since empirically most
+        blocks are either completely empty or completely full. An earlier version of this patch did
+        this, but it was not better than this patch. In fact, it seemed to actually be worse for PLT
+        and membuster.
+
+        To validate this change, we now run the conservative scan after the beginMarking flip. And it
+        totally works!
+
+        This is a huge step towards concurrent GC. It means that we ought to be able to run the
+        allocator while marking. Since we already separately made it possible to run the barrier
+        while marking, this means that we're pretty much ready for some serious concurrency action.
+
+        This appears to be perf-neutral and space-neutral.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlockSet::mark): Deleted.
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::writeBarrierCurrentlyExecuting):
+        (JSC::CodeBlockSet::clearCurrentlyExecuting):
+        (JSC::CodeBlockSet::writeBarrierCurrentlyExecutingCodeBlocks): Deleted.
+        * heap/CodeBlockSet.h:
+        * heap/CodeBlockSetInlines.h: Added.
+        (JSC::CodeBlockSet::mark):
+        * heap/ConservativeRoots.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::beginMarking):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::writeBarrierCurrentlyExecutingCodeBlocks):
+        (JSC::Heap::clearCurrentlyExecutingCodeBlocks):
+        * heap/Heap.h:
+        * heap/HeapUtil.h:
+        (JSC::HeapUtil::findGCObjectPointersForMarking):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::isPagedOut):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::Handle::Handle):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectHasNewlyAllocated):
+        (JSC::MarkedBlock::Handle::stopAllocating):
+        (JSC::MarkedBlock::Handle::lastChanceToFinalize):
+        (JSC::MarkedBlock::Handle::resumeAllocating):
+        (JSC::MarkedBlock::aboutToMarkSlow):
+        (JSC::MarkedBlock::Handle::resetAllocated):
+        (JSC::MarkedBlock::resetMarks):
+        (JSC::MarkedBlock::setNeedsDestruction):
+        (JSC::MarkedBlock::Handle::didAddToAllocator):
+        (JSC::MarkedBlock::Handle::isLive):
+        (JSC::MarkedBlock::Handle::isLiveCell):
+        (JSC::MarkedBlock::clearMarks): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::Handle::newlyAllocatedVersion):
+        (JSC::MarkedBlock::Handle::hasAnyNewlyAllocated): Deleted.
+        (JSC::MarkedBlock::Handle::clearNewlyAllocated): Deleted.
+        * heap/MarkedBlockInlines.h:
+        (JSC::MarkedBlock::Handle::cellsPerBlock):
+        (JSC::MarkedBlock::Handle::isLive):
+        (JSC::MarkedBlock::Handle::isLiveCell):
+        (JSC::MarkedBlock::Handle::isNewlyAllocatedStale):
+        (JSC::MarkedBlock::Handle::hasAnyNewlyAllocatedWithSweep):
+        (JSC::MarkedBlock::Handle::hasAnyNewlyAllocated):
+        (JSC::MarkedBlock::heap):
+        (JSC::MarkedBlock::space):
+        (JSC::MarkedBlock::Handle::space):
+        (JSC::MarkedBlock::resetMarkingVersion): Deleted.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::beginMarking):
+        (JSC::MarkedSpace::endMarking):
+        (JSC::MarkedSpace::clearNewlyAllocated): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::nextVersion):
+        (JSC::MarkedSpace::newlyAllocatedVersion):
+        (JSC::MarkedSpace::markingVersion): Deleted.
+        * runtime/SamplingProfiler.cpp:
+
+2016-10-11  Mark Lam  <mark.lam@apple.com>
+
+        Array.prototype.concat should not modify frozen objects.
+        https://bugs.webkit.org/show_bug.cgi?id=163302
+
+        Reviewed by Filip Pizlo.
+
+        The ES6 spec for Array.prototype.concat states that it uses the
+        CreateDataPropertyOrThrow() to add items to the result array.  The spec for
+        CreateDataPropertyOrThrow states:
+
+        "This abstract operation creates a property whose attributes are set to the same
+        defaults used for properties created by the ECMAScript language assignment
+        operator. Normally, the property will not already exist. If it does exist and is
+        not configurable or if O is not extensible, [[DefineOwnProperty]] will return
+        false causing this operation to throw a TypeError exception."
+
+        Since the properties of frozen objects are not extensible, not configurable, and
+        not writable, Array.prototype.concat should fail to write to the result array if
+        it is frozen.
+
+        Ref: https://tc39.github.io/ecma262/#sec-array.prototype.concat,
+        https://tc39.github.io/ecma262/#sec-createdatapropertyorthrow, and
+        https://tc39.github.io/ecma262/#sec-createdataproperty.
+
+        The fix consists of 2 parts:
+        1. moveElement() should use the PutDirectIndexShouldThrow mode when invoking
+           putDirectIndex(), and
+        2. SparseArrayValueMap::putDirect() should check for the case where the property
+           is read only.
+
+        (2) ensures that we don't write into a non-writable property.
+        (1) ensures that we throw a TypeError for attempts to write to a non-writeable
+        property.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::moveElements):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putDirect):
+
+2016-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] DOMJIT::Patchpoint should have a way to receive constant folded arguments
+        https://bugs.webkit.org/show_bug.cgi?id=163224
+
+        Reviewed by Filip Pizlo.
+
+        We use the GetGlobalObject DFG node to retrieve a global object from a DOM node.
+        This global object is necessary to check whether the world is normal before entering
+        the fast path of looking up the DOM wrapper cache.
+        We can sometimes constant-fold this GetGlobalObject. For example, if we performed
+        CheckStructure, the structure can offer the information about the possible result
+        of GetGlobalObject. By using this constant-folded global object, we can drop some
+        checks.
+
+        This patch introduces the way to tell the constant-folded values to DOMJIT::Patchpoint.
+        We pass DOMJIT::Value instead of DOMJIT::Reg as a parameter of DOMJIT::PatchpointParams.
+        This DOMJIT::Value is a pair of DOMJIT::Reg and JSValue. If the given parameter has a
+        constant value, this JSValue is filled with it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGDOMJITPatchpointParams.h:
+        (JSC::DFG::DOMJITPatchpointParams::DOMJITPatchpointParams):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCallDOM):
+        (JSC::DFG::SpeculativeJIT::compileCheckDOM):
+        * domjit/DOMJITPatchpointParams.h:
+        (JSC::DOMJIT::PatchpointParams::at):
+        (JSC::DOMJIT::PatchpointParams::operator[]):
+        (JSC::DOMJIT::PatchpointParams::PatchpointParams):
+        * domjit/DOMJITValue.h: Copied from Source/JavaScriptCore/dfg/DFGDOMJITPatchpointParams.h.
+        (JSC::DOMJIT::Value::Value):
+        (JSC::DOMJIT::Value::isGPR):
+        (JSC::DOMJIT::Value::isFPR):
+        (JSC::DOMJIT::Value::isJSValueRegs):
+        (JSC::DOMJIT::Value::gpr):
+        (JSC::DOMJIT::Value::fpr):
+        (JSC::DOMJIT::Value::jsValueRegs):
+        (JSC::DOMJIT::Value::reg):
+        (JSC::DOMJIT::Value::value):
+        * ftl/FTLDOMJITPatchpointParams.h:
+        (JSC::FTL::DOMJITPatchpointParams::DOMJITPatchpointParams):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
+
+2016-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Air should be able to replace constant materializations with adds
+        https://bugs.webkit.org/show_bug.cgi?id=162749
+
+        Reviewed by Yusuke Suzuki.
+
+        We have a lot of defenses against emitting code that materializes huge contants. But if we do
+        end up with such code in the backend, it's better to convert those materializations into add
+        instructions by checking if other registers are known to contain nearby constants. That's
+        what this patch does.
+
+        * b3/air/AirFixObviousSpills.cpp:
+        * b3/testb3.cpp:
+
+2016-10-11  Filip Pizlo  <fpizlo@apple.com>
+
+        B3->Air lowering needs the same defenses in effectiveAddr() that it has in tryAppendLea()
+        https://bugs.webkit.org/show_bug.cgi?id=163264
+
+        Reviewed by Mark Lam.
+
+        When writing the lea patch (r207039), I was very careful about how I convert a Shl into a
+        BaseIndex scale. But I forgot to check if the older code for creating BaseIndexes for
+        effectiveAddr() got this right. It turns out that the older code missed the <<32 corner
+        case.
+
+        It's sad that the two paths can't share all of their code, but it's somewhat inevitable due
+        to how matching an address and matching a lea have to do very different things. Matching a
+        lea means creating an instruction that is distinct from other instructions to do multiple
+        math operations at once. Matching an address means making some instruction do extra work
+        for free. Also, address matching can take advantage of the fact that the offset is already
+        associated with the memory operation by strength reduction - lea matching can't do this; it
+        has to figure out Add(@value, $const) on its own. This change makes the situation slightly
+        more sane by adding a scaleForShl() helper that handles this weird case. It's based on the
+        new Shl handling from r207039, and exposes it as an API for effectiveAddr() to use.
+
+        The testLoadBaseIndexShift32() used to crash. I don't think that this case affects JS
+        content, since <<32 is such a bizarre outlier. I don't think we even have a path along
+        which the FTL would emit a 64-bit <<32. It probably won't even affect WebAssembly since
+        that uses 32-bit pointers, so we won't see 64-bit <<32 in effectiveAddr() there.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::scaleForShl):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::tryAppendLea):
+        (JSC::B3::Air::LowerToAir::crossesInterference): Deleted.
+        * b3/testb3.cpp:
+        (JSC::B3::testLoadBaseIndexShift2):
+        (JSC::B3::testLoadBaseIndexShift32):
+        (JSC::B3::run):
+
+2016-10-11  Saam Barati  <sbarati@apple.com>
+
+        ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
+        https://bugs.webkit.org/show_bug.cgi?id=163182
+
+        Reviewed by Filip Pizlo.
+
+        This code pattern shows up in Dromaeo, so it's worth optimizing for.
+        This might also show up in real world JS code due to inlining and other
+        types of constant folding.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::getValue):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+
+2016-10-10  Zan Dobersek  <zdobersek@igalia.com>
+
+        Add ENABLE_ENCRYPTED_MEDIA configuration option
+        https://bugs.webkit.org/show_bug.cgi?id=163219
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Add the ENABLE_ENCRYPTED_MEDIA configuration option. It will be used
+        to enable or disable the new EME implementation at build-time.
+
+2016-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        B3->Air lowering should be able to emit complex leas on x86
+        https://bugs.webkit.org/show_bug.cgi?id=163234
+
+        Reviewed by Saam Barati.
+
+        This adds comprehensive support for emitting lea on x86.
+
+        When adding this, I found that it was useful to also finally add more reassociation. That
+        reduces the amount of patterns that the instruction selector has to deal with.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::lea32):
+        (JSC::MacroAssembler::lea64):
+        (JSC::MacroAssembler::lea): Deleted.
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::commitInternal):
+        (JSC::B3::Air::LowerToAir::tryAppendLea):
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::createSelect): Deleted.
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::isRepresentableAs):
+        (JSC::B3::Value::representableAs): Deleted.
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp: Lots of tests for lea and reassociation.
+
+2016-10-10  Mark Lam  <mark.lam@apple.com>
+
+        Change ArrayPrototype.cpp's putLength() and setLength() to take a VM& so that we can use vm.propertyNames.
+        https://bugs.webkit.org/show_bug.cgi?id=163260
+
+        Reviewed by Saam Barati.
+
+        In all cases where we call these, we already have the VM& anyway.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putLength):
+        (JSC::setLength):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+
+2016-10-10  Mark Lam  <mark.lam@apple.com>
+
+        Rename the StrictModeReadonlyPropertyWriteError string to ReadonlyPropertyWriteError.
+        https://bugs.webkit.org/show_bug.cgi?id=163239
+
+        Reviewed by Filip Pizlo.
+
+        This string is also used for reporting the same error in cases which have nothing
+        to do with strict mode.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/GetterSetter.cpp:
+        (JSC::callSetter):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::pop):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::put):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::put):
+        (JSC::JSModuleNamespaceObject::putByIndex):
+        * runtime/JSObject.cpp:
+        (JSC::ordinarySetSlow):
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        * runtime/JSObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putInline):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayEntry::put):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::StringObject::putByIndex):
+
+2016-10-10  Saam Barati  <sbarati@apple.com>
+
+        compileCheckStringIdent in the FTL is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=163215
+
+        Reviewed by Mark Lam and Filip Pizlo.
+
+        lowStringIdent() returns the StringImpl pointer. The compileCheckStringIdent()
+        was treating its return value as the actual JSString. This is wrong.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckStringIdent):
+
+2016-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Implement Node accessors in DOMJIT
+        https://bugs.webkit.org/show_bug.cgi?id=163005
+
+        Reviewed by Filip Pizlo.
+
+        Add some helper methods and offsetOfXXX for JSC::Weak since it is used
+        for DOM wrapper caching.
+
+        And make DOMJIT::Patchpoint in FTL closer to one in DFG. We add resultConstraint
+        to avoid the situation that the same register is allocated to child and result.
+
+        We also extend DOMJIT::Patchpoint to tell useTagTypeNumberRegister / useTagMaskRegister.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * domjit/DOMJITSlowPathCalls.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
+        * heap/WeakImpl.h:
+        (JSC::WeakImpl::offsetOfJSValue):
+        (JSC::WeakImpl::offsetOfWeakHandleOwner):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::boxCell):
+        (JSC::AssemblyHelpers::boxInt32): Deleted.
+        * jit/JITOperations.h:
+
+2016-10-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Air should expose API for pinning registers
+        https://bugs.webkit.org/show_bug.cgi?id=163175
+
+        Reviewed by Keith Miller.
+
+        You can now call Procedure::pinRegister(), or Code::pinRegister(), and it will make this
+        register behave as follows:
+
+        - B3 and Air will emit no code that modifies the value in this register, except if that
+          happens via a Patchpoint or stackmap constraint (i.e. the user explicitly asked for it).
+        - B3 and Air will allow others to modify the register. For example, if the register is not
+          callee-save, then the compiler knows that the register's value will be trashed by any
+          C-style call.
+        - Air will be happy to emit code that reads from this register, including coalescing tmps
+          with it, so longer as there is no interference (i.e. no chance of the register's value
+          changing). For example, if we went back to having pinned tag registers, we would tell B3
+          to use them by (1) excluding them from any clobber set (easy, since they're callee save)
+          and (2) emitting ArgumentReg to grab their value. There's a test that does this.
+
+        This is accomplished by taking regsInPriorityOrder() and making it a method of Code. Air
+        already used this API when choosing registers in register allocation. Code now also vends a
+        mutableRegs() set, which is derived from regsInPriorityOrder(), that can quickly tell you if
+        a register can be mutated. Doing it this way means that most of this is a purely mechanical
+        change. The calls to mutableRegs() are the places where we had to change logic:
+
+        - The register allocators needs to know that coalescing with a precolored pinned tmp is free.
+        - The callee-save handler needs to know that we're not supposed to save/restore pinned
+          registers.
+
+        Note that in this scheme, pinned registers are simply registers that do not appear in
+        regsInPriorityOrder(). This means, for example, that we will now say that FP is pinned. So,
+        this means that you can also pin registers by calling setRegsInPriorityOrder() and passing a
+        vector that excludes some registers. More generally, this means that clients can now tweak
+        the register allocator's register preferences, since the ordering in that list reflects the
+        order in which the allocator will try registers.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::pinRegister):
+        * b3/B3Procedure.h:
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::Code):
+        (JSC::B3::Air::Code::setRegsInPriorityOrder):
+        (JSC::B3::Air::Code::pinRegister):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::regsInPriorityOrder):
+        (JSC::B3::Air::Code::mutableRegs):
+        (JSC::B3::Air::Code::isPinned):
+        (JSC::B3::Air::Code::regsInPriorityOrderImpl):
+        (JSC::B3::Air::Code::proc): Deleted.
+        * b3/air/AirEmitShuffle.cpp:
+        (JSC::B3::Air::emitShuffle):
+        * b3/air/AirEmitShuffle.h:
+        * b3/air/AirHandleCalleeSaves.cpp:
+        (JSC::B3::Air::handleCalleeSaves):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirLowerAfterRegAlloc.cpp:
+        (JSC::B3::Air::lowerAfterRegAlloc):
+        * b3/air/AirRegisterPriority.cpp: Removed.
+        * b3/air/AirRegisterPriority.h: Removed.
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/air/testair.cpp:
+        (JSC::B3::Air::testShuffleBroadcastAllRegs):
+        (JSC::B3::Air::testShuffleShiftAllRegs):
+        (JSC::B3::Air::testShuffleRotateAllRegs):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegs):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegs64):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegsMixedWidth):
+        (JSC::B3::Air::testShuffleRotateMemoryAllRegs64):
+        (JSC::B3::Air::testShuffleRotateMemoryAllRegsMixedWidth):
+        * b3/testb3.cpp:
+        (JSC::B3::testPinRegisters):
+        (JSC::B3::run):
+        * jit/RegisterSet.h:
+
+2016-10-08  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should know about mutable pinned registers
+        https://bugs.webkit.org/show_bug.cgi?id=163172
+
+        Reviewed by Keith Miller.
+
+        If we have mutable pinned registers then we need to know which operations mutate them. At
+        first I considered making this into a heap range thing, but I think that this would be very
+        confusing. Also, in the future, we might want to make Effects track register sets of
+        clobbered registers (see bug 163173).
+
+        * b3/B3Effects.cpp:
+        (JSC::B3::Effects::interferes):
+        (JSC::B3::Effects::operator==):
+        (JSC::B3::Effects::dump):
+        * b3/B3Effects.h:
+        (JSC::B3::Effects::forCall):
+        (JSC::B3::Effects::mustExecute):
+
+2016-10-08  Saam Barati  <sbarati@apple.com>
+
+        HasIndexedProperty clobberize rule is wrong for Array::ForceOSRExit
+        https://bugs.webkit.org/show_bug.cgi?id=159942
+        <rdar://problem/27328836>
+
+        Reviewed by Filip Pizlo.
+
+        When HasIndexedProperty has a ForceOSRExit array mode, it should
+        report to write to side state, like the ForceOSRExit node, and the
+        other nodes with ForceOSRExit array mode.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2016-10-07  Mark Lam  <mark.lam@apple.com>
+
+        Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
+        https://bugs.webkit.org/show_bug.cgi?id=163160
+
+        Reviewed by Saam Barati.
+
+        See https://tc39.github.io/ecma262/#sec-object.freeze,
+        https://tc39.github.io/ecma262/#sec-object.seal, and
+        https://tc39.github.io/ecma262/#sec-setintegritylevel.  We need to call
+        preventExtensions first before proceeding to freeze / seal the object.  If
+        preventExtensions fails, we should throw a TypeError.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::setIntegrityLevel):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+
+2016-10-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Support slow path call
+        https://bugs.webkit.org/show_bug.cgi?id=162978
+
+        Reviewed by Saam Barati.
+
+        One of the most important features required in DOMJIT::Patchpoint is slow path calls.
+        DOM operation typically returns DOMWrapper object. At that time, if wrapper cache hits, we can go
+        to the fast path. However, if we cannot use the cache, we need to go to the slow path to call toJS function.
+        At that time, slow path call functionality is necessary.
+
+        This patch expose DOMJIT::PatchpointParams::addSlowPathCall. We can request slow path call code generation
+        through this interface. DOMJIT::PatchpointParams automatically leverages appropriate slow path call systems
+        in each tier. In DFG, we use slow path call system. In FTL, we implement slow path call by using addLatePath
+        to construct slow path call. But these details are completely hidden by DOMJIT::PatchpointParams. Users can
+        just use addSlowPathCall.
+
+        Since DFG and FTL slow path call systems are implemented in variadic templates, directly using this means
+        that we need to expose core part of DFG and FTL. For example, DFG::SpeculativeJIT need to be exposed in
+        such a design. That is too bad. Instead, we use magical macro in DOMJITSlowPathCalls.h. We can list up the
+        call signatures in DOMJIT_SLOW_PATH_CALLS. DOMJIT uses these signatures to generate an interface to request
+        slow path calls inside DFG and FTL instead of exposing everything.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGCommon.h:
+        * dfg/DFGDOMJITPatchpointParams.cpp: Copied from Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h.
+        (JSC::DFG::dispatch):
+        * dfg/DFGDOMJITPatchpointParams.h: Copied from Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h.
+        (JSC::DFG::DOMJITPatchpointParams::DOMJITPatchpointParams):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCallDOM):
+        (JSC::DFG::SpeculativeJIT::compileCheckDOM):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::extractResult): Deleted.
+        * domjit/DOMJITPatchpointParams.h:
+        (JSC::DOMJIT::PatchpointParams::addSlowPathCall):
+        * domjit/DOMJITSlowPathCalls.h: Copied from Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h.
+        * ftl/FTLDOMJITPatchpointParams.cpp: Added.
+        (JSC::FTL::dispatch):
+        * ftl/FTLDOMJITPatchpointParams.h: Copied from Source/JavaScriptCore/domjit/DOMJITPatchpointParams.h.
+        (JSC::FTL::DOMJITPatchpointParams::DOMJITPatchpointParams):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
+        * jit/GPRInfo.h:
+        (JSC::extractResult):
+        * jsc.cpp:
+
+2016-10-06  Saam Barati  <sbarati@apple.com>
+
+        HasOwnPropertyCache flattening dictionaries is causing insane memory usage with the uBlock Safari extension
+        https://bugs.webkit.org/show_bug.cgi?id=163091
+
+        Reviewed by Mark Lam.
+
+        I'm investigating a real fix for this in:
+        https://bugs.webkit.org/show_bug.cgi?id=163092
+        However, it's best to get this out of trunk for now.
+
+        * runtime/HasOwnPropertyCache.h:
+        (JSC::HasOwnPropertyCache::tryAdd):
+
+2016-10-06  Keith Miller  <keith_miller@apple.com>
+
+        getInternalObjcObject should validate the JSManagedObject's value.
+        https://bugs.webkit.org/show_bug.cgi?id=162985
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, if, for instance, the JSManagedObject's weak value had been
+        cleared we would call tryUnwrapObjcObject with a nil context and value.
+        This triggered assertions failures as those functions expect their inputs
+        to be valid.
+
+        * API/JSVirtualMachine.mm:
+        (getInternalObjcObject):
+
+2016-10-06  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: RemoteInspector should cache client capabilities for off-main thread usage
+        https://bugs.webkit.org/show_bug.cgi?id=163039
+        <rdar://problem/28571460>
+
+        Reviewed by Timothy Hatcher.
+
+        The fix in r206797 was incorrect because listings are always pushed out on the XPC connection queue.
+        Instead of delaying the listing needlessly, RemoteInspector should cache the capabilities of its
+        client while on the main thread, then use the cached struct data on the XPC connection queue rather
+        than directly accessing m_client. This is similar to how RemoteConnectionToTarget marshalls listing
+        information from arbitrary queues into m_targetListingMap, which can then be read from any queue.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::updateClientCapabilities): Cache the capabilities.
+        (Inspector::RemoteInspector::setRemoteInspectorClient):
+        Re-cache the capabilities. Scope the lock to avoid reentrant locking.
+
+        (Inspector::RemoteInspector::clientCapabilitiesDidChange): Cache the capabilities.
+        (Inspector::RemoteInspector::pushListingsNow): Use cached client capabilities.
+        (Inspector::RemoteInspector::receivedGetListingMessage): Revert the change in r206797.
+        (Inspector::RemoteInspector::receivedAutomationSessionRequestMessage):
+
+2016-10-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [WebCore][JSC] Use new @throwTypeError and @throwRangeError intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=163001
+
+        Reviewed by Keith Miller.
+
+        Previously, the argument of @throwXXXError intrinsics must be string literal.
+        But it is error-prone restriction. This patch relaxes the restriction to accept
+        arbitrary values. To keep emitted bytecode small, if the argument is string literal,
+        we generate the same bytecode as before. If the argument is not string literal,
+        we evaluate it and perform to_string before passing to throw_static_error.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitThrowStaticError):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Add @throwXXXError bytecode intrinsic
+        https://bugs.webkit.org/show_bug.cgi?id=162995
+
+        Reviewed by Saam Barati.
+
+        Builtin JS code need to check arguments carefully since it is somewhat standard library for JS.
+        So bunch of `throw new @TypeError("...")` exists while usual code does not have so many.
+        However the above code bloats 32 instructions per site, enlarges the size of bytecodes of builtins,
+        and prevent us from inlining. We should have a way to reduce this size.
+
+        Fortunately, we already have such a opcode: op_throw_static_error. In this patch,
+        1. We extends op_throw_static_error to throw arbitrary errors. Previously, only TypeError and ReferenceError are allowed.
+           We can embed ErrorType enum in op_throw_static_error to throw any types of errors.
+        2. We introduce several new bytecode intrinsics, `@throwTypeError("...")`, `@throwRangeError("...")`,
+           and `@throwOutOfMemoryError()`. And use it inside builtin JS instead of `throw new @TypeError("...")` thingy.
+        3. DFG Node for throw_static_error is incorrectly named as "ThrowReferenceError". This patch renames it to "ThrowStaticError".
+
+        * builtins/ArrayConstructor.js:
+        * builtins/ArrayIteratorPrototype.js:
+        (next):
+        * builtins/ArrayPrototype.js:
+        (values):
+        (keys):
+        (entries):
+        (reduce):
+        (reduceRight):
+        (every):
+        (forEach):
+        (filter):
+        (map):
+        (some):
+        (fill):
+        (find):
+        (findIndex):
+        (includes):
+        (sort):
+        (concatSlowPath):
+        (copyWithin):
+        * builtins/DatePrototype.js:
+        (toLocaleString.toDateTimeOptionsAnyAll):
+        (toLocaleString):
+        (toLocaleDateString.toDateTimeOptionsDateDate):
+        (toLocaleDateString):
+        (toLocaleTimeString.toDateTimeOptionsTimeTime):
+        (toLocaleTimeString):
+        * builtins/FunctionPrototype.js:
+        (bind):
+        * builtins/GeneratorPrototype.js:
+        (globalPrivate.generatorResume):
+        * builtins/GlobalOperations.js:
+        (globalPrivate.speciesConstructor):
+        * builtins/MapPrototype.js:
+        (forEach):
+        * builtins/ModuleLoaderPrototype.js:
+        (provide):
+        * builtins/ObjectConstructor.js:
+        (values):
+        (entries):
+        (assign):
+        * builtins/PromiseConstructor.js:
+        (race):
+        (reject):
+        (resolve):
+        * builtins/PromiseOperations.js:
+        (globalPrivate.newPromiseCapability.executor):
+        (globalPrivate.newPromiseCapability):
+        (globalPrivate.initializePromise):
+        * builtins/PromisePrototype.js:
+        * builtins/ReflectObject.js:
+        (apply):
+        (deleteProperty):
+        (has):
+        * builtins/RegExpPrototype.js:
+        (globalPrivate.regExpExec):
+        (match):
+        (replace):
+        (search):
+        (split):
+        (intrinsic.RegExpTestIntrinsic.test):
+        * builtins/SetPrototype.js:
+        (forEach):
+        * builtins/StringConstructor.js:
+        (raw):
+        * builtins/StringIteratorPrototype.js:
+        (next):
+        * builtins/StringPrototype.js:
+        (match):
+        (globalPrivate.repeatSlowPath):
+        (repeat):
+        (padStart):
+        (padEnd):
+        (intrinsic.StringPrototypeReplaceIntrinsic.replace):
+        (localeCompare):
+        (search):
+        (split):
+        * builtins/TypedArrayConstructor.js:
+        (of):
+        (from):
+        * builtins/TypedArrayPrototype.js:
+        (globalPrivate.typedArraySpeciesConstructor):
+        (every):
+        (find):
+        (findIndex):
+        (forEach):
+        (some):
+        (subarray):
+        (reduce):
+        (reduceRight):
+        (map):
+        (filter):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitThrowStaticError):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitThrowTypeError):
+        (JSC::BytecodeGenerator::emitThrowRangeError):
+        (JSC::BytecodeGenerator::emitThrowOutOfMemoryError):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwOutOfMemoryError):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw_static_error):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_throw_static_error): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Deleted.
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (WTF::printInternal):
+        * runtime/Error.h:
+
+2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, attempt to fix CLoop build after r206846
+        https://bugs.webkit.org/show_bug.cgi?id=162941
+
+        Attempt to fix CLoop build part 2. r206847 was not valid.
+
+        * jsc.cpp:
+
+2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, build fix after r206846
+        https://bugs.webkit.org/show_bug.cgi?id=162941
+
+        DOMJIT::Patchpoint part should be guarded by ENABLE(JIT).
+
+        * jsc.cpp:
+
+2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Add initial CheckDOM and CallDOM implementations
+        https://bugs.webkit.org/show_bug.cgi?id=162941
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements a prototype of DOMJIT accelerated getter.
+        We add two new DFG nodes, CheckDOM and CallDOM.
+
+        CheckDOM is used to filter inappropriate |this| object for DOM getter. Its functionality
+        is equivalent to jsDynamicCast's Check. You can use like "CheckDOM, @1, JSNode::info()",
+        and this CheckDOM incurs a BadType exit if the class of the given @1 is not a subclass of
+        JSNode::info().
+
+        CallDOM is used to emit actual DOM operations. It takes GlobalObject and checked DOM
+        object. And it returns JSValue as its result.
+
+        Both CheckDOM and CallDOM can take a DOMJIT::Patchpoint. This is somewhat code snippet
+        generator, and is injectable to DFG and FTL. DFG and FTL set up registers correctly
+        according to DOMJIT::Patchpoint's requirement and invoke this patchpoint generator to emit code.
+        While CallDOM always requires a patchpoint, ideally CheckDOM does not require it since
+        isSubclassOf check can be implemented in DFG / FTL side. However, some classes have a
+        faster way to query isSubclassOf. For example, JSNode in WebCore introduces a special
+        JSType to optimize this query. CheckDOM's patchpoint gives us a chance to emit special
+        faster code for such a case.
+
+        By leveraging above nodes, we can construct DOMJIT accelerated getter. When DFG recognizes the
+        given getter call is CustomGetter and it has DOMJIT::GetterSetter information, DFG emits the above nodes.
+        We implemented a prototype in jsc.cpp shell as DOMJITGetter to test the functionality.
+
+        Notes about the future extensions.
+
+        1. Currently, we do not allow CallDOM to emit any function calls. This will be extended by
+           adding `addSlowPathCall` functionality to DOMJIT::Patchpoint later. Interesting thing is that
+           we need to create an abstraction over DFG slow path call and FTL slow path call!
+
+        2. CheckDOM is not handled in DFGTypeCheckHoistingPhase yet. And we have a chance to merge several CheckDOM into one.
+           For example, given CheckDOM A and CheckDOM B to the same target. If A is subclass of B, we can merge them to CheckDOM A.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Effects.h:
+        (JSC::B3::Effects::forCheck):
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        (JSC::GetByIdStatus::makesCalls):
+        (JSC::GetByIdStatus::dump):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::isCustom):
+        (JSC::GetByIdStatus::takesSlowPath):
+        (JSC::GetByIdStatus::isSimple): Deleted.
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromClassInfo):
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::filterClassInfo):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterClassInfo):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::filterClassInfo):
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleDOMJITGetter):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasDOMJIT):
+        (JSC::DFG::Node::domJIT):
+        (JSC::DFG::Node::hasClassInfo):
+        (JSC::DFG::Node::classInfo):
+        (JSC::DFG::Node::OpInfoWrapper::OpInfoWrapper):
+        (JSC::DFG::Node::OpInfoWrapper::operator=):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOpInfo.h:
+        (JSC::DFG::OpInfo::OpInfo):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::allocateTemporaryRegistersForPatchpoint):
+        (JSC::DFG::SpeculativeJIT::compileCallDOM):
+        (JSC::DFG::SpeculativeJIT::compileCheckDOM):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureAbstractValue.cpp:
+        (JSC::DFG::StructureAbstractValue::filterClassInfoSlow):
+        (JSC::DFG::StructureAbstractValue::isSubClassOf):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::filterClassInfo):
+        (JSC::DFG::StructureAbstractValue::filter): Deleted.
+        * domjit/DOMJITPatchpointParams.h: Copied from Source/JavaScriptCore/dfg/DFGOpInfo.h.
+        (JSC::DOMJIT::PatchpointParams::~PatchpointParams):
+        (JSC::DOMJIT::PatchpointParams::size):
+        (JSC::DOMJIT::PatchpointParams::at):
+        (JSC::DOMJIT::PatchpointParams::operator[]):
+        (JSC::DOMJIT::PatchpointParams::gpScratch):
+        (JSC::DOMJIT::PatchpointParams::fpScratch):
+        (JSC::DOMJIT::PatchpointParams::PatchpointParams):
+        * domjit/DOMJITReg.h: Added.
+        (JSC::DOMJIT::Reg::Reg):
+        (JSC::DOMJIT::Reg::isGPR):
+        (JSC::DOMJIT::Reg::isFPR):
+        (JSC::DOMJIT::Reg::isJSValueRegs):
+        (JSC::DOMJIT::Reg::gpr):
+        (JSC::DOMJIT::Reg::fpr):
+        (JSC::DOMJIT::Reg::jsValueRegs):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckDOM):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallDOM):
+        (JSC::FTL::DFG::LowerDFGToB3::compileUnreachable): Deleted.
+        * jit/AssemblyHelpers.h:
+        * jsc.cpp:
+        (WTF::DOMJITNode::DOMJITNode):
+        (WTF::DOMJITNode::createStructure):
+        (WTF::DOMJITNode::create):
+        (WTF::DOMJITNode::value):
+        (WTF::DOMJITNode::offsetOfValue):
+        (WTF::DOMJITGetter::DOMJITGetter):
+        (WTF::DOMJITGetter::createStructure):
+        (WTF::DOMJITGetter::create):
+        (WTF::DOMJITGetter::DOMJITNodeDOMJIT::DOMJITNodeDOMJIT):
+        (WTF::DOMJITGetter::domJITNodeGetterSetter):
+        (WTF::DOMJITGetter::finishCreation):
+        (WTF::DOMJITGetter::customGetter):
+        (GlobalObject::finishCreation):
+        (functionCreateDOMJITNodeObject):
+        (functionCreateDOMJITGetterObject):
+
+2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Do not construct Simple GetByIdStatus against self-custom-accessor case
+        https://bugs.webkit.org/show_bug.cgi?id=162993
+
+        Reviewed by Filip Pizlo.
+
+        We accidentally created a Simple GetByIdStatus against self-custom-accessor case: the object has own custom accessor property and get_by_id hits.
+        If we returned such a result, the GetById will be turned to GetByOffset and it looks up incorrect thing like CustomGetterSetter object.
+        We do not hit this bug before since maybe there is no object that has own custom-accessor and this custom-accessor does not raise an error.
+        For example, "Node.prototype" has "firstChild" custom accessor. But since "Node.prototype" itself does not have Node::info(), "Node.prototype.firstChild"
+        access always raises an error. I guess all the custom accessors follow this pattern. This bug is uncovered when testing DOMJIT (This bug causes crash and
+        it can occur even if we disabled DOMJIT).
+
+        But such a assumption is not guaranteed. In this patch, we fix this by not returning Simple GetById.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        (JSC::GetByIdStatus::computeFor):
+
+2016-10-05  Saam Barati  <sbarati@apple.com>
+
+        PCToCodeOriginMap builder should use labelIgnoringWatchpoints() inside the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=162936
+
+        Reviewed by Michael Saboff.
+
+        label() may insert nops because of an InvalidationPoint. It does that
+        because we don't want code that comes after an InvalidationPoint that isn't
+        effected by the invalidation point to be overwritten if we fire the
+        InvalidationPoint. PCToCodeOriginMap just grabs labels to build
+        a mapping, it never emits code that actually jumps to those labels.
+        Therefore, it should never cause us to emit nops.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+
+2016-10-05  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Put variation fonts work behind a compile-time flag
+        https://bugs.webkit.org/show_bug.cgi?id=162949
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-10-05  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement Intl.getCanonicalLocales
+        https://bugs.webkit.org/show_bug.cgi?id=162768
+
+        Reviewed by Benjamin Poulain.
+
+        Implement Intl.getCanonicalLocales from ECMA 402 (3rd edition)
+        http://ecma-international.org/ecma-402/3.0/index.html#sec-intl.getcanonicallocales
+
+        Reuse canonicalizeLocaleList and copy the results into a new JSArray.
+
+        * runtime/IntlObject.cpp:
+        (JSC::IntlObject::finishCreation):
+        (JSC::intlObjectFuncGetCanonicalLocales):
+
+2016-10-05  Michael Saboff  <msaboff@apple.com>
+
+        Bad ASSERT in ClonedArguments::createByCopyingFrom()
+        https://bugs.webkit.org/show_bug.cgi?id=162988
+
+        Reviewed by Keith Miller.
+
+        Removed bogus assert.
+
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createByCopyingFrom):
+
+2016-10-05  Zan Dobersek  <zdobersek@igalia.com>
+
+        Rename ENABLE_ENCRYPTED_MEDIA_V2 to ENABLE_LEGACY_ENCRYPTED_MEDIA
+        https://bugs.webkit.org/show_bug.cgi?id=162903
+
+        Reviewed by Alex Christensen.
+
+        Rename build guards for the remaining implementation of the legacy EME API
+        to ENABLE_LEGACY_ENCRYPTED_MEDIA. This will allow for the future implementation
+        of the near-finished API to be guarded with the simple ENABLE_ENCRYPTED_MEDIA guards.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-10-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        ARM EABI buildfix after r206778
+        https://bugs.webkit.org/show_bug.cgi?id=162964
+
+        Unreviewed trivial fix.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2016-10-04  Saam Barati  <sbarati@apple.com>
+
+        String.prototype.toLowerCase should be a DFG/FTL intrinsic
+        https://bugs.webkit.org/show_bug.cgi?id=162887
+
+        Reviewed by Filip Pizlo and Yusuke Suzuki.
+
+        This patch makes ToLowerCase an intrinsic in the DFG/FTL. On the fast
+        path, the intrinsic will loop over an 8-bit string ensuring it's already
+        lower case, and simply return the string. In the slow path, it'll call
+        into C code to make a new string.
+
+        This is a 7-8% speedup on ES6SampleBench/Basic.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileToLowerCase):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToLowerCase):
+        * jit/JITOperations.h:
+        * runtime/Intrinsic.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2016-10-04  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: don't synchronously send a listing message if we might need to query _WKAutomationDelegate
+        https://bugs.webkit.org/show_bug.cgi?id=162810
+        <rdar://problem/28571460>
+
+        Reviewed by Timothy Hatcher.
+
+        We shouldn't ever access the _WKAutomationDelegate through RemoteInspector::Client methods
+        off of the main thread, because it could cause problems. This happens when we pushListingsNow()
+        in response to a WIRApplicationGetListingMessage XPC message. In this case, just use
+        pushListingsSoon() since it dispatches on the correct (main) queue to gather listing information.
+
+        This may induce a slight update delay when first connecting to the UIProcess through RemoteInspector,
+        but this is at most 200ms and will coalesce with other updates that happen when UIProcess gets set up.
+
+        There are no other code paths through RemoteInspector (for UIProcess) that could cause a call
+        to pushListingsNow(), so this only needs to be changed in the XPC message handler.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::receivedGetListingMessage):
+
+2016-10-04  JF Bastien  <jfbastien@apple.com>
+
+        WebAssembly: handle a few corner cases
+        https://bugs.webkit.org/show_bug.cgi?id=162884
+
+        Reviewed by Keith Miller.
+
+        * wasm/JSWASMModule.cpp: missing include broke cmake build
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::parseBlock): check op is valid
+        (JSC::WASM::FunctionParser<Context>::parseExpression): switch covers all cases
+        * wasm/WASMOps.h:
+        (JSC::WASM::isValidOpType): op is valid
+        * wasm/WASMParser.h:
+        (JSC::WASM::Parser::consumeString): avoid str[i] being one-past-the-end
+        (JSC::WASM::Parser::parseUInt32): shift math around to avoid overflow
+
+2016-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION (r206778): Release JSC test ChakraCore.yaml/ChakraCore/test/Error/validate_line_column.js.default failing
+        https://bugs.webkit.org/show_bug.cgi?id=162937
+
+        Reviewed by Saam Barati.
+
+        We dropped expression info accidentally at r206777.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallDefineProperty):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitPutConstantProperty):
+        (JSC::ClassExprNode::emitBytecode):
+
+2016-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DOMJIT] Introduce DOMJIT::GetterSetter to tell JIT information
+        https://bugs.webkit.org/show_bug.cgi?id=162916
+
+        Reviewed by Filip Pizlo.
+
+        In this patch, we introduce DOMJIT::GetterSetter.
+        This class maintains information required to emit JIT code in DFG and FTL.
+        DOMJIT::GetterSetter has 2 virtual functions: checkDOM and callDOM.
+        These functions can return a DOMJIT::Patchpoint that allows us to inject
+        appropriate machine code during DFG and FTL phases. DFG and FTL will invoke
+        these functions to get a patchpoint. And this patchpoint will be used to
+        emit code corresponding to CheckDOM and CallDOM DFG nodes, which will be added
+        in subsqeunt patch.
+
+        We propagate DOMJIT::GetterSetter through PropertySlot, AccessCase, GetByIdVariant,
+        and GetByIdStatus along with CustomGetter to teach DFG that this custom access
+        code has a chance to be inlined with this DOMJIT::GetterSetter information.
+        Instead of propagating CustomGetterSetter holding DOMJIT::GetterSetter and CustomGetter,
+        we propagate CustomGetter and DOMJIT::GetterSetter. This is because of the current
+        CustomGetterSetter design that we reify CustomGetterSetters only when we need to reify
+        all the properties. This design allows us to avoid frequent CustomGetterSetter allocations
+        and structure transitions.
+
+        Currently, domJIT field is always nullptr since there is no DOMJITAttribute user.
+        When we add this, we will add code handling this DOMJIT::GetterSetter in DFG::ByteCodeParser.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::GetByIdVariant):
+        (JSC::GetByIdVariant::operator=):
+        (JSC::GetByIdVariant::attemptToMerge):
+        (JSC::GetByIdVariant::dumpInContext):
+        * bytecode/GetByIdVariant.h:
+        (JSC::GetByIdVariant::domJIT):
+        (JSC::GetByIdVariant::intrinsic): Deleted.
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::get):
+        (JSC::AccessCase::clone):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::domJIT):
+        (JSC::AccessCase::RareData::RareData):
+        * dfg/DFGNode.h:
+        * domjit/DOMJITGetterSetter.h: Added.
+        (JSC::DOMJIT::GetterSetter::GetterSetter):
+        (JSC::DOMJIT::GetterSetter::~GetterSetter):
+        (JSC::DOMJIT::GetterSetter::getter):
+        (JSC::DOMJIT::GetterSetter::setter):
+        (JSC::DOMJIT::GetterSetter::thisClassInfo):
+        * domjit/DOMJITPatchpoint.h: Added.
+        (JSC::DOMJIT::Patchpoint::create):
+        (JSC::DOMJIT::Patchpoint::setGenerator):
+        (JSC::DOMJIT::Patchpoint::generator):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        * runtime/CustomGetterSetter.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::fillCustomGetterPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::domJIT):
+        (JSC::getStaticPropertySlotFromTable):
+        (JSC::putEntry):
+        (JSC::reifyStaticProperty):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::domJIT):
+        (JSC::PropertySlot::setCacheableCustom):
+
+2016-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Add a new byte code op_define_property instead of calling defineProperty
+        https://bugs.webkit.org/show_bug.cgi?id=162108
+
+        Reviewed by Saam Barati.
+
+        To construct ES6 class, we emitted bytecode that performs the following operations.
+
+            1. construct a new object
+            2. put "configurable", "enumerable" etc. fields
+            3. call "defineProperty" function
+
+        However, this approach has problems. Every time we define a class method, we need to create
+        a new object to represent property descriptor. This can be removed if we can introduce
+        a special bytecode or special function.
+
+        This patch introduces new bytecodes, op_define_data_property and op_define_accessor_property.
+        Instead of taking an object, they takes several registers to avoid object allocations.
+        We're planning to use this bytecode to implement Object.defineProperty in builtin JS next.
+        This allows us to leverage object allocation sinking. And it also gives us a chance to use
+        faster ::get and ::hasProperty in JS.
+
+        Originally, I attempted to create one bytecode, op_define_property. However, it takes too many
+        children in DFG and uses so many registers in DFG. This leads tricky program in 32bit platforms.
+        Furthermore, it does not fit to the number of x64 argument registers. So instead, we introduce
+        two bytecodes.
+
+        And for op_define_accessor_property, we perform CellUse edge filter to getter and setter children.
+        This edge filter makes us possible to use SpeculateCellOperand and reduce the number of used registers
+        in comparison with JSValueOperand. To make children Cells even if we do not specify some accessors (for
+        example, { get: func, set: null } case), we fill registers with special throwTypeErrorFunction.
+        The attributes bitset keep information like "This property descriptor only has getter slot".
+
+        In these two bytecodes, we take attributes (configurable, enumerable, writable, hasGetter etc.) as
+        register instead of embedding constant int value because we will use these bytecodes to implement
+        Object.defineProperty next. In Object.defineProperty case, an attributes are not statically defined
+        at bytecode compiling time.
+
+        Run ES6SampleBench/Air 20 times. The result shows ~2% performance improvement.
+
+        Baseline:
+            firstIteration:     84.05 ms +- 4.37 ms
+            averageWorstCase:   40.54 ms +- 2.81 ms
+            steadyState:        3317.49 ms +- 48.25 ms
+            summary:            223.51 ms +- 5.07 ms
+
+        Patched:
+            firstIteration:     84.46 ms +- 4.22 ms
+            averageWorstCase:   41.48 ms +- 2.33 ms
+            steadyState:        3253.48 ms +- 29.31 ms
+            summary:            224.40 ms +- 4.72 ms
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/SpecialPointer.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitMoveLinkTimeConstant):
+        (JSC::BytecodeGenerator::emitCallDefineProperty):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitPutConstantProperty):
+        (JSC::BitwiseNotNode::emitBytecode):
+        (JSC::ClassExprNode::emitBytecode):
+        (JSC::ObjectPatternNode::bindValue):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDefineDataProperty):
+        (JSC::DFG::SpeculativeJIT::compileDefineAccessorProperty):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDefineDataProperty):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDefineAccessorProperty):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByValWithThis): Deleted.
+        * jit/CCallHelpers.cpp:
+        (JSC::CCallHelpers::setupFourStubArgsGPR): Deleted.
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupFourStubArgsGPR):
+        (JSC::CCallHelpers::setupFiveStubArgsGPR):
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        (JSC::CCallHelpers::setupStubArgsGPR):
+        (JSC::CCallHelpers::prepareForTailCallSlow): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_define_data_property):
+        (JSC::JIT::emit_op_define_accessor_property):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/DefinePropertyAttributes.h: Added.
+        (JSC::DefinePropertyAttributes::DefinePropertyAttributes):
+        (JSC::DefinePropertyAttributes::rawRepresentation):
+        (JSC::DefinePropertyAttributes::hasValue):
+        (JSC::DefinePropertyAttributes::setValue):
+        (JSC::DefinePropertyAttributes::hasGet):
+        (JSC::DefinePropertyAttributes::setGet):
+        (JSC::DefinePropertyAttributes::hasSet):
+        (JSC::DefinePropertyAttributes::setSet):
+        (JSC::DefinePropertyAttributes::writable):
+        (JSC::DefinePropertyAttributes::configurable):
+        (JSC::DefinePropertyAttributes::enumerable):
+        (JSC::DefinePropertyAttributes::setWritable):
+        (JSC::DefinePropertyAttributes::setConfigurable):
+        (JSC::DefinePropertyAttributes::setEnumerable):
+        (JSC::DefinePropertyAttributes::fillWithTriState):
+        (JSC::DefinePropertyAttributes::extractTriState):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::throwTypeErrorFunction):
+        (JSC::JSGlobalObject::definePropertyFunction): Deleted.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::addDefineProperty): Deleted.
+        * runtime/ObjectConstructor.h:
+        * runtime/PropertyDescriptor.h:
+        (JSC::toPropertyDescriptor):
+
+2016-10-04  Saam Barati  <sbarati@apple.com>
+
+        Follow up fix to GetMapBucket and MapHash speculating on child node types.
+        To fix this, on 32-bit platforms, we do not speculate on the child
+        type since we just call into C code for these nodes.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2016-10-03  Saam Barati  <sbarati@apple.com>
+
+        GetMapBucket node should speculate on the type of its 'key' child
+        https://bugs.webkit.org/show_bug.cgi?id=161638
+
+        Reviewed by Filip Pizlo.
+
+        This eliminates type-check branches when we've already
+        proven the type of the incoming key. Also, it reduces
+        the branches we emit when type checking the bucket's key.
+
+        This is a 2-3% speedup on ES6SampleBench/Basic.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucket):
+
+2016-10-03  Christopher Reid  <Christopher.Reid@am.sony.com>
+
+        Offline asm should not output masm assembly when using a x86_64 asm backend
+        https://bugs.webkit.org/show_bug.cgi?id=162705
+
+        When cross compiling on windows to Clang, masm was being generated simply because
+        the os was windows. This change adds a command line parameter --assembler=MASM
+        to set the output assembly to masm.
+        The functions isGCC and isCompilingToWindows were removed as they are no longer called.
+
+        Reviewed by Mark Lam.
+
+        * CMakeLists.txt:
+        * offlineasm/asm.rb:
+        * offlineasm/x86.rb:
+
+2016-10-03  JF Bastien  <jfbastien@apple.com>
+
+        Auto-generate WASMOps.h, share with testing JSON file
+        https://bugs.webkit.org/show_bug.cgi?id=162870
+
+        Reviewed by Keith Miller.
+
+        Add a few new opcodes, but keep this mostly as-is for now. I want
+        to generate smarter code but will do so in a later update to
+        reduce disruption.
+
+        * wasm/WASMOps.h: auto-generated from ./JSTests/stress/wasm/to-c++.js
+
+2016-10-03  Michael Saboff  <msaboff@apple.com>
+
+        Creating pcToOriginMap in FTL shouldn't insert unnecessary NOPs
+        https://bugs.webkit.org/show_bug.cgi?id=162879
+
+        Reviewed by Filip Pizlo.
+
+        If there is a recent watchpoint label, using MacroAssembler::label() will pad
+        the instruction stream with NOPs to provide space for a jump.  This changes
+        Air::generate() to use labelIgnoringWatchpoints() to create pcToOriginMap
+        entries to eliminate unneccesary NOPs.
+
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/testb3.cpp:
+        (JSC::B3::testPCOriginMapDoesntInsertNops): New test.
+        (JSC::B3::run):
+
+2016-10-03  Saam Barati  <sbarati@apple.com>
+
+        MapHash should speculate on the type of its child node
+        https://bugs.webkit.org/show_bug.cgi?id=161922
+
+        Reviewed by Filip Pizlo.
+
+        This allows us to remove runtime type checks when we've already
+        proven the type of the incoming value.
+
+        This is a 2-3% speedup on ES6SampleBench/Basic.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::wangsInt64Hash):
+        (JSC::FTL::DFG::LowerDFGToB3::mapHashString):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
+
+2016-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 trapping memory accesses should be documented
+        https://bugs.webkit.org/show_bug.cgi?id=162845
+
+        Reviewed by Geoffrey Garen.
+
+        While writing some documentation, I found some small holes in the code.
+
+        * b3/B3Effects.cpp:
+        (JSC::B3::Effects::operator==): Need this to write tests.
+        (JSC::B3::Effects::operator!=): Need this to write tests.
+        * b3/B3Effects.h:
+        * b3/B3HeapRange.h:
+        * b3/B3MemoryValue.cpp:
+        (JSC::B3::MemoryValue::dumpMeta): Sometimes the heap range dump won't show you the memory value's actual range. This makes the dump show you the actual range in that case.
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects): While documenting this, I remembered that trapping also has to imply reading top. I fixed this.
+        * b3/testb3.cpp:
+        (JSC::B3::testTrappingLoad): Added checks for the effects of trapping loads.
+        (JSC::B3::testTrappingStore): Added checks for the effects of trapping stores.
+        (JSC::B3::testMoveConstants): Made this not crash with validation.
+
+2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
+        https://bugs.webkit.org/show_bug.cgi?id=162849
+
+        Reviewed by Geoffrey Garen.
+
+        Since GeneratorFunction is not constructible, GeneratorFunction.prototype does not have "constructor" property.
+
+            function* generatorFunction() { }
+            generatorFunction.prototype.constructor // undefined
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+
+2016-10-03  Nicolas Breidinger  <Nicolas.Breidinger@sony.com>
+
+        JSStringRef should define JSChar without platform checks
+        https://bugs.webkit.org/show_bug.cgi?id=162808
+
+        Reviewed by Mark Lam.
+
+        * API/JSStringRef.h:
+
+2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Align attributes of Generator related properties to spec
+        https://bugs.webkit.org/show_bug.cgi?id=162839
+
+        Reviewed by Saam Barati.
+
+        This patch fixes attributes of Generator related properties.
+        These fixes are covered by test262.
+
+        * runtime/GeneratorFunctionConstructor.cpp:
+        (JSC::GeneratorFunctionConstructor::finishCreation):
+        * runtime/GeneratorFunctionConstructor.h:
+        * runtime/GeneratorFunctionPrototype.cpp:
+        (JSC::GeneratorFunctionPrototype::finishCreation):
+        * runtime/GeneratorFunctionPrototype.h:
+        * runtime/GeneratorPrototype.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
+2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] GeneratorFunction constructor should instantiate generator function
+        https://bugs.webkit.org/show_bug.cgi?id=162838
+
+        Reviewed by Saam Barati.
+
+        GeneratorFunction's constructor should return an instance of JSGeneratorFunction
+        instead of JSFunction. In this patch, we fix the following 2 things.
+
+        1. GeneratorFunction constructor should use JSGeneratorFunction
+
+            Previously, we used JSFunction to construct a result. It's wrong. We use JSGeneratorFunction.
+
+        2. Pass newTarget into GeneratorFunction constructor to make it subclassible
+
+            We did not leverage newTarget when using GeneratorFunction constructor.
+            Using it correctly to create the subclass Structure and making GeneratorFunction subclassible.
+
+        Test262 test covers (1), but (2) is not covered. We add tests that covers both to stress tests.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/GeneratorFunctionConstructor.cpp:
+        (JSC::constructGeneratorFunctionConstructor):
+        * runtime/JSGeneratorFunction.cpp:
+        (JSC::JSGeneratorFunction::JSGeneratorFunction):
+        (JSC::JSGeneratorFunction::createImpl):
+        (JSC::JSGeneratorFunction::create):
+        (JSC::JSGeneratorFunction::createWithInvalidatedReallocationWatchpoint):
+        * runtime/JSGeneratorFunction.h:
+
+2016-10-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of isMarkedOrNewlyAllocated
+        https://bugs.webkit.org/show_bug.cgi?id=162842
+
+        Reviewed by Dan Bernstein.
+
+        This function has become dead code. This change removes it.
+
+        * heap/CellContainer.h:
+        * heap/CellContainerInlines.h:
+        (JSC::CellContainer::isMarkedOrNewlyAllocated): Deleted.
+        * heap/LargeAllocation.h:
+        (JSC::LargeAllocation::isLive):
+        (JSC::LargeAllocation::isMarkedOrNewlyAllocated): Deleted.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated): Deleted.
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated): Deleted.
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated): Deleted.
+
+2016-10-01  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Rename DebugHookID to DebugHookType
+        https://bugs.webkit.org/show_bug.cgi?id=162820
+
+        Reviewed by Alex Christensen.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::debugHookName):
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2016-09-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Stepping to a line with an autoContinue breakpoint should still pause
+        https://bugs.webkit.org/show_bug.cgi?id=161712
+        <rdar://problem/28193970>
+
+        Reviewed by Brian Burg.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::pauseIfNeeded):
+        If we stepped to an auto-continue breakpoint we should continue
+        stepping, not just continue.
+
+2016-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should support trapping memory accesses
+        https://bugs.webkit.org/show_bug.cgi?id=162689
+
+        Reviewed by Geoffrey Garen.
+
+        This adds a traps flag to B3::Kind. It also makes B3::Kind work more like Air::Kind, in the
+        sense that it's a bag of distinct bits - it doesn't need to be a union unless we get enough
+        things that it would make a difference.
+
+        The only analysis that needs to know about traps is effects. It now knows that traps implies
+        sideExits, which means that this turns off DCE. The only optimization that needs to know
+        about traps is eliminateCommonSubexpressions(), which needs to pessimize its store
+        elimination if the store traps.
+
+        The hard part of this change is teaching the instruction selector to faithfully carry the
+        traps flag down to Air. I got this to work by making ArgPromise a non-copyable object that
+        knows whether you've used it in an instruction. It knows when you call consume(). If you do
+        this then ArgPromise cannot be destructed without first passing your inst through it. This,
+        along with a few other hacks, means that all of the load-op and load-op-store fusions
+        correctly carry the trap bit: if any of the B3 loads or stores involved traps then you get
+        traps in Air.
+
+        This framework also sets us up to do bug 162688, since the ArgPromise::inst() hook is
+        powerful enough to allow wrapping the instruction with a Patch.
+
+        I added some tests to testb3 that verify that optimizations are appropriately inhibited and
+        that the traps flag survives until the bitter end of Air.
+
+        * b3/B3EliminateCommonSubexpressions.cpp:
+        * b3/B3Kind.cpp:
+        (JSC::B3::Kind::dump):
+        * b3/B3Kind.h:
+        (JSC::B3::Kind::Kind):
+        (JSC::B3::Kind::hasExtraBits):
+        (JSC::B3::Kind::isChill):
+        (JSC::B3::Kind::setIsChill):
+        (JSC::B3::Kind::hasTraps):
+        (JSC::B3::Kind::traps):
+        (JSC::B3::Kind::setTraps):
+        (JSC::B3::Kind::operator==):
+        (JSC::B3::Kind::hash):
+        (JSC::B3::trapping):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::ArgPromise::swap):
+        (JSC::B3::Air::LowerToAir::ArgPromise::ArgPromise):
+        (JSC::B3::Air::LowerToAir::ArgPromise::operator=):
+        (JSC::B3::Air::LowerToAir::ArgPromise::~ArgPromise):
+        (JSC::B3::Air::LowerToAir::ArgPromise::setTraps):
+        (JSC::B3::Air::LowerToAir::ArgPromise::consume):
+        (JSC::B3::Air::LowerToAir::ArgPromise::inst):
+        (JSC::B3::Air::LowerToAir::trappingInst):
+        (JSC::B3::Air::LowerToAir::loadPromiseAnyOpcode):
+        (JSC::B3::Air::LowerToAir::appendUnOp):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreUnOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::appendStore):
+        (JSC::B3::Air::LowerToAir::append):
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        (JSC::B3::Air::LowerToAir::createBranch):
+        (JSC::B3::Air::LowerToAir::createCompare):
+        (JSC::B3::Air::LowerToAir::createSelect):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        * b3/B3Value.h:
+        * b3/air/AirCode.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testTrappingLoad):
+        (JSC::B3::testTrappingStore):
+        (JSC::B3::testTrappingLoadAddStore):
+        (JSC::B3::testTrappingLoadDCE):
+        (JSC::B3::testTrappingStoreElimination):
+        (JSC::B3::run):
+
+2016-09-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Stepping over/out of a function sometimes resumes instead of taking you to caller
+        https://bugs.webkit.org/show_bug.cgi?id=162802
+        <rdar://problem/28569982>
+
+        Reviewed by Mark Lam.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::stepOverStatement):
+        (JSC::Debugger::stepOutOfFunction):
+        Enable stepping mode when we start stepping.
+
+2016-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::moveConstants should be able to edit code to minimize the number of constants
+        https://bugs.webkit.org/show_bug.cgi?id=162764
+
+        Reviewed by Saam Barati.
+
+        There are some interesting cases where we can reduce the number of constant materializations if
+        we teach moveConstants() how to edit code. The two examples that this patch supports are:
+
+            - Loads and stores from a constant pointer. Since loads and stores get an offset for free
+              and the instruction selector is really good at handling it, and since we can query Air to
+              see what kinds of offsets are legal, we can sometimes avoid using a constant pointer that
+              is specific to the absolute address of that load and instead pick some other constant
+              that is within offset distance of ours.
+
+            - Add and Sub by a constant (x + c, x - c). Since x + c = x - -c and x - c = x + -c, we can
+              flip Add to Sub or vice versa if the negated constant is available.
+
+        This change makes moveConstants() pick the most dominant constant that works for an value. In
+        the case of memory accesses, it uses Air::Arg::isValidAddrForm() to work out what other
+        constants would work. In the case of Add/Sub, it simply looks for the negated constant. This
+        should result in something like a minimal number of constants since these rules always pick the
+        most dominant constant that works - so if an Add's constant is already most dominant then
+        nothing changes, but if the negated one is more dominant then it becomes a Sub.
+
+        This is a 0.5% speed-up on LongSpider and neutral elsewhere. It's a speed-up because the
+        absolute address thing reduces the number of address materializations that we have to do, while
+        the add/sub thing prevents us from having to materialize 0x1000000000000 to box doubles.
+        However, this may introduce a pathology, which I've filed a bug for: bug 162796.
+
+        * b3/B3MoveConstants.cpp:
+        * b3/B3MoveConstants.h:
+        * b3/B3UseCounts.h:
+        * b3/air/AirFixObviousSpills.cpp:
+        * b3/testb3.cpp:
+        (JSC::B3::testMoveConstants):
+        (JSC::B3::run):
+
+2016-09-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix modules tests after r206653 handle breakpoint locations in import/export statements
+        https://bugs.webkit.org/show_bug.cgi?id=162807
+
+        Reviewed by Mark Lam.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createExportDefaultDeclaration):
+        (JSC::ASTBuilder::createExportLocalDeclaration):
+        Don't record an extra breakpoint location for the statement
+        within an export statement.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseModuleSourceElements):
+        Record a pause location for import/export statements.
+
+2016-09-30  Mark Lam  <mark.lam@apple.com>
+
+        Remove the dumping of the stack back trace in VM::verifyExceptionCheckNeedIsSatisfied().
+        https://bugs.webkit.org/show_bug.cgi?id=162797
+
+        Reviewed by Geoffrey Garen.
+
+        This is because the RELEASE_ASSERT() that follows immediately after will also
+        dump the stack back trace.  Hence, the first dump will be redundant.
+
+        Also removed an extra space in the dataLog output.
+
+        * runtime/VM.cpp:
+        (JSC::VM::verifyExceptionCheckNeedIsSatisfied):
+
+2016-09-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Stepping through `a(); b(); c();` it is unclear where we are and what is about to execute
+        https://bugs.webkit.org/show_bug.cgi?id=161658
+        <rdar://problem/28181254>
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        Updated pause location for unary expressions.
+
+2016-09-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Breakpoints on blank lines or comments don't break
+        https://bugs.webkit.org/show_bug.cgi?id=9885
+        <rdar://problem/6134406>
+
+        Reviewed by Mark Lam.
+
+        This change introduces a way to perform a Debugger Parse of a script.
+        This debugger parse gathers a list of breakpoint locations, which
+        the backend uses to resolve breakpoint locations that came from the
+        Inspector frontend to the exact location we would actually pause.
+        We gather this information from the parser so that we can eagerly
+        get this information without requiring the code to have executed (the
+        real op_debugs are generated during bytecode generation when code
+        is actually evaluated).
+
+        If an input location was on a line with whitespace or a comment, the
+        resolved breakpoint location would be before the next statement that
+        will be executed. That may be the next line, or even later. We also
+        update our policy when setting breakpoints on and around function
+        statements to better match user expectations.
+
+        For example, when resolving breakpoints in:
+
+            1.  // Comment
+            2.  before;
+            3.
+            4.  function foo() {
+            5.      inside;
+            6.  }
+            7.
+            8.  after;
+
+        A breakpoint on line 1, a comment, resolves to line 2 the next
+        statement that will execute.
+
+        A breakpoint on line 3 or 7, empty lines, resolves to line 8 the next
+        statement that will execute. This skips past the definition of foo,
+        just like stepping would have done. The creation of foo would have
+        been hoisted, which would have happened before execution of the
+        other statements.
+
+        A breakpoint on line 4, a function signature, resolves to line 5,
+        inside the function. Users would expect to pause inside of a function
+        when setting a breakpoint on that function's name or opening brace.
+
+        A breakpoint on line 6, a function's closing brace, resolves to
+        line 6. The debugger will pause whenever execution leaves foo due to
+        a return and not an exception. This matches stepping behavior. An
+        explicit or implicit return (the implicit return undefined) will
+        pause on the closing brace as we leave the function, giving users
+        an opportunity to inspect the final state before leaving.
+
+        --
+
+        At this point, op_debug's are still emitted at custom locations during
+        bytecode generation of other statements / expressions. In order to
+        ensure the generated op_debugs correspond to locations the Parser
+        determined were breakpoint locations, the Parser sets a "needs debug
+        hook" flag on the nodes it will use for breakpoint locations, and
+        we assert during bytecode generation that op_debugs are only emitted
+        for nodes that were marked as needing debug hooks.
+
+        This still leaves open the possibility that the Parser will mark
+        some nodes that get missed during bytecode generation, so we might
+        fail to emit some op_debugs. The next step will be eliminating the
+        custom emitDebugHooks spread across StatementNode and ExpressionNode
+        subclasses, and instead always generating op_debugs whenever we
+        emit a flagged node.
+
+        --
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        New DebuggerParseData files.
+
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::OpaqueJSScript):
+        * jsc.cpp:
+        (functionCheckModuleSyntax):
+        * parser/SourceCode.h:
+        (JSC::makeSource):
+        * parser/SourceProvider.cpp:
+        (JSC::SourceProvider::SourceProvider):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::sourceType):
+        (JSC::StringSourceProvider::create):
+        (JSC::StringSourceProvider::StringSourceProvider):
+        (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
+        (JSC::SourceProvider::startPosition): Deleted.
+        Add a new type on SourceProvider to distinguish if its script was
+        intended to be a Script, Module, or WebAssembly. This information
+        will be needed to know how to best parse this file when the
+        debugger decides to lazily parse.
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable):
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+        ASSERT the SourceProvider type matches the executable type we are
+        creating for it.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::breakpointLocation):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+        When gathering breakpoint positions, get the position from the
+        current node. In the SyntaxChecker, return an invalid position.
+
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::needsDebugHook):
+        (JSC::ExpressionNode::setNeedsDebugHook):
+        (JSC::StatementNode::needsDebugHook):
+        (JSC::StatementNode::setNeedsDebugHook):
+        When gathering breakpoint positions, mark the node as needing
+        a debug hook. For now we assert op_debugs generated must come
+        from these nodes. Later we should just generate op_debugs for
+        these nodes.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseDoWhileStatement):
+        (JSC::Parser<LexerType>::parseWhileStatement):
+        (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
+        (JSC::Parser<LexerType>::parseForStatement):
+        (JSC::Parser<LexerType>::parseWithStatement):
+        (JSC::Parser<LexerType>::parseSwitchStatement):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseIfStatement):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::parse):
+        Add an optional DebuggerParseData struct to the Parser. When available
+        the Parser will gather debugger data, and parse all functions with the
+        ASTBuilder instead of SyntaxChecking inner functions.
+
+        * debugger/DebuggerParseData.cpp: Added.
+        (JSC::DebuggerPausePositions::breakpointLocationForLineColumn):
+        (JSC::DebuggerPausePositions::sort):
+        (JSC::gatherDebuggerParseData):
+        (JSC::gatherDebuggerParseDataForSource):
+        * debugger/DebuggerParseData.h: Copied from Source/JavaScriptCore/debugger/DebuggerPrimitives.h.
+        (JSC::DebuggerPausePositions::DebuggerPausePositions):
+        (JSC::DebuggerPausePositions::appendPause):
+        (JSC::DebuggerPausePositions::appendEntry):
+        (JSC::DebuggerPausePositions::appendLeave):
+        The DebuggerParseData struct currently only contains a list of pause positions.
+        Once populated it can resolve an input location to a pause position.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::DeclarationStatement::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        Emit op_debugs for the nodes themselves. Assert when we do that the
+        Parser had marked them as needing a debug hook.
+
+        * debugger/Breakpoint.h:
+        (JSC::Breakpoint::Breakpoint):
+        A breakpoint may be resolved or unresolved. Debugger::resolveBreakpoint
+        must be used to resolve the breakpoint. Most methods now require a
+        resolved breakpoint.
+
+        * debugger/Debugger.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::detach):
+        (JSC::Debugger::toggleBreakpoint):
+        (JSC::Debugger::debuggerParseData):
+        (JSC::Debugger::resolveBreakpoint):
+        (JSC::Debugger::setBreakpoint):
+        (JSC::Debugger::clearParsedData):
+        Provide a public method to resolve a breakpoint location in a script.
+        This will gather debugger parse data for the script if none is available.
+        Ensure clients have resolved a breakpoint before attempting to set it.
+        Currently we allow only a single breakpoint at a location. This may
+        need to change if multiple breakpoints resolve to the same location
+        but have different actions.
+
+        * inspector/ScriptDebugListener.h:
+        ScriptDebugServer::Script is effectively duplicating most of the data from
+        a SourceProvider. We should eliminate this and just use SourceProvider.
+
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::setBreakpointActions):
+        (Inspector::ScriptDebugServer::removeBreakpointActions):
+        (Inspector::ScriptDebugServer::getActionsForBreakpoint):
+        (Inspector::ScriptDebugServer::clearBreakpointActions):
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction):
+        (Inspector::ScriptDebugServer::dispatchDidParseSource):
+        (Inspector::ScriptDebugServer::handleBreakpointHit):
+        (Inspector::ScriptDebugServer::setBreakpoint): Deleted.
+        (Inspector::ScriptDebugServer::removeBreakpoint): Deleted.
+        (Inspector::ScriptDebugServer::clearBreakpoints): Deleted.
+        * inspector/ScriptDebugServer.h:
+        Reduce ScriptDebugServer's involvement in breakpoints to just handling
+        breakpoint actions. Eventually we should eliminate it alltogether and
+        fold breakpoint logic into Debugger or DebugAgent.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::buildDebuggerLocation):
+        (Inspector::parseLocation):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::didSetBreakpoint):
+        (Inspector::InspectorDebuggerAgent::resolveBreakpoint):
+        (Inspector::InspectorDebuggerAgent::removeBreakpoint):
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
+        The Inspector can set breakpoints in multiple ways.
+        Ensure that once we have the Script that we always
+        resolve the breakpoint location before setting the
+        breakpoint. The different paths are:
+
+        - setBreakpoint(scriptId, location)
+          - Here we know the SourceProvider by its SourceID
+            - resolve and set
+
+        - setBreakpointByURL(url, location)
+          - Search for existing Scripts that match the URL
+            - resolve in each and set
+          - When new Scripts are parsed that match the URL
+            - resolve and set
+
+
+2016-09-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Stepping out of a function finishes the line that called it.
+        https://bugs.webkit.org/show_bug.cgi?id=155325
+        <rdar://problem/25094578>
+
+        Reviewed by Mark Lam.
+
+        Also addresses:
+        <https://webkit.org/b/161721> Web Inspector: Stepping all the way through program should not cause a pause on the next program that executes
+        <https://webkit.org/b/161716> Web Inspector: Stepping into a function / program should not require stepping to the first statement
+
+        This change introduces a new op_debug hook: WillExecuteExpression.
+        Currently this new hook is only used for pausing at function calls.
+        We may decide to add it to other places later where pausing with
+        finer granularity then statements (or lines) if useful.
+
+        This updates the location and behavior of some of the existing debug
+        hooks, to be more consistent and useful if the exact location of the
+        pause is displayed. For example, in control flow statements like
+        `if` and `while`, the pause location is the expression itself that
+        will be evaluated, not the location of the `if` or `while` keyword.
+        For example:
+
+            if (|condition)
+            while (|condition)
+
+        Finally, this change gets rid of some unnecessary / useless pause
+        locations such as on entering a function and on entering a program.
+        These pauses are not needed because if there is a statement, we
+        would pause before the statement and it is equivalent. We continue
+        to pause when leaving a function via stepping by uniformly jumping
+        to the closing brace of the function. This gives users a chance
+        to observe state before leaving the function.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::debugHookName):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::dumpLineColumnEntry):
+        Logging strings for the new debug hook.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallInTailPosition):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        (JSC::BytecodeGenerator::emitCallForwardArgumentsInTailPosition):
+        (JSC::BytecodeGenerator::emitCallDefineProperty):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitGetTemplateObject):
+        (JSC::BytecodeGenerator::emitIteratorNext):
+        (JSC::BytecodeGenerator::emitIteratorNextWithValue):
+        (JSC::BytecodeGenerator::emitIteratorClose):
+        (JSC::BytecodeGenerator::emitDelegateYield):
+        All emitCall variants now take an enum to decide whether or not to
+        emit the WillExecuteExpression debug hook.
+
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        In the two real implementations, actually decide to emit the debug
+        hook or not based on the parameter.
+
+        (JSC::BytecodeGenerator::emitEnumeration):
+        This is shared looping code used by for..of iteration of iterables.
+        When used by ForOfNode, we want to emit a pause location during
+        iteration.
+
+        (JSC::BytecodeGenerator::emitWillLeaveCallFrameDebugHook):
+        This is shared call frame leave code to emit a consistent pause
+        location when leaving a function.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_tailCallForwardArguments):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::TaggedTemplateNode::emitBytecode):
+        (JSC::ArrayPatternNode::bindValue):
+        All tail position calls are the function calls that we want to emit
+        debug hooks for. All non-tail call calls appear to be internal
+        implementation details, and these should not have the debug hook.
+
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        Make the pause location consistent at the expression.
+
+        (JSC::DoWhileNode::emitBytecode):
+        Make the pause location consistent at the expression.
+        Remove the errant pause at the do's '}' when entering the do block.
+
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        Make the pause location consistent at expressions.
+        Also allow stepping to the traditional for loop's
+        update expression, which was previously not possible.
+
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        Make the pause location when leaving a function consistently be the
+        function's closing brace. The two cases are stepping through a return
+        statement, or the implicit return undefined at the end of a function.
+
+        (JSC::LabelNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        Remove unnecessary pauses that add no value, as they contain a
+        statement and we will then pause at that statement.
+
+        * parser/Nodes.h:
+        (JSC::StatementNode::isFunctionNode):
+        (JSC::StatementNode::isForOfNode):
+        (JSC::EnumerationNode::lexpr):
+        (JSC::ForOfNode::isForOfNode):
+        New virtual methods to distinguish different nodes.
+
+        * debugger/Debugger.h:
+        Rename m_pauseAtNextStatement to m_pauseAtNextOpportunity.
+        This is the finest granularity of stepping, and it can be
+        pausing at a location that is not a statement.
+        Introduce state to properly handle step out and stepping
+        when there are multiple expressions in a statement.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::setPauseOnNextStatement):
+        (JSC::Debugger::breakProgram):
+        (JSC::Debugger::continueProgram):
+        (JSC::Debugger::stepIntoStatement):
+        (JSC::Debugger::exception):
+        (JSC::Debugger::didReachBreakpoint):
+
+        Use new variable names, and clarify if we should attempt
+        to pause or not.
+
+        (JSC::Debugger::stepOutOfFunction):
+        Set a new state to indicate a step out action.
+
+        (JSC::Debugger::updateCallFrame):
+        (JSC::Debugger::updateCallFrameAndPauseIfNeeded): Deleted.
+        (JSC::Debugger::updateCallFrameInternal):
+        (JSC::Debugger::pauseIfNeeded):
+        Allow updateCallFrame to either attempt a pause or not.
+
+        (JSC::Debugger::atStatement):
+        Attempt pause and reset the at first expression flag.
+
+        (JSC::Debugger::atExpression):
+        Attempt a pause when not stepping over. Also skip
+        the first expression pause, since that would be
+        equivalent to when we paused for the expression.
+
+        (JSC::Debugger::callEvent):
+        Do not pause when entering a function.
+
+        (JSC::Debugger::returnEvent):
+        Attempt pause when leaving a function.
+        If the user did a step-over and is leaving the
+        function, then behave like step-out.
+
+        (JSC::Debugger::unwindEvent):
+        Behave like return except don't change any
+        pausing states. If we needed to pause the
+        Debugger::exception will have handled it.
+
+        (JSC::Debugger::willExecuteProgram):
+        Do not pause when entering a program.
+
+        (JSC::Debugger::didExecuteProgram):
+        Attempt pause when leaving a program that has a caller.
+        This can be useful for exiting an eval(...) program.
+        Otherwise treat this like return, and step-over out
+        of the program should behave like step-out. We use
+        pause at next opportunity because there may be extra
+        callframes we do not know about.
+        When the program doesn't have a parent, clear all
+        our state so we don't errantly pause on the next
+        JavaScript microtask that gets executed.
+
+        (JSC::Debugger::clearNextPauseState):
+        Helper to clear all of the pause states now that
+        it happens in a couple places.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::notifyDebuggerOfUnwinding):
+        Treat unwinding slightly differently from returning.
+        We will not want to pause when unwinding callframes.
+
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        New debug hook.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::stepInto):
+        (Inspector::InspectorDebuggerAgent::didPause):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        Remove unnecessary stepInto code notification for listeners.
+        The listeners are never notified if the debugger resumes,
+        so whatever state they were setting by this is going to
+        get out of date.
+
+2016-09-30  Saam Barati  <sbarati@apple.com>
+
+        Arrow functions should not allow duplicate parameter names
+        https://bugs.webkit.org/show_bug.cgi?id=162741
+
+        Reviewed by Filip Pizlo.
+
+        This patch makes parsing arrow function parameters throw
+        a syntax error when there are duplicate parameter names.
+        It also starts to make some syntax errors for arrow functions
+        better, however, this is trickier than it seems since we need
+        to choose between two parsing productions when we decide to
+        throw a syntax error. I'm going to work on this problem
+        in another patch specifically devoted to making the error
+        messages better for parsing arrow functions:
+        https://bugs.webkit.org/show_bug.cgi?id=162794
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        * parser/Parser.h:
+
+2016-09-30  Mark Lam  <mark.lam@apple.com>
+
+        Use topVMEntryFrame to determine whether to skip the re-throw of a simulated throw.
+        https://bugs.webkit.org/show_bug.cgi?id=162793
+
+        Reviewed by Saam Barati.
+
+        Change the ThrowScope destructor to use topVMEntryFrame (instead of topCallFrame)
+        in the determination of whether to skip the re-throw of a simulated throw.  This
+        is needed because the topCallFrame is not updated in operationConstructArityCheck()
+        (and does not need to be), whereas topVMEntryFrame is always updated properly.
+        Hence, we should just switch to using the more reliable topVMEntryFrame instead.
+
+        This issue was discovered by existing JSC tests when exception check validation
+        is enabled.
+
+        * runtime/ThrowScope.cpp:
+        (JSC::ThrowScope::~ThrowScope):
+
+2016-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        64-bit LLInt needs to have a concurrency-aware barrier
+        https://bugs.webkit.org/show_bug.cgi?id=162790
+
+        Reviewed by Mark Lam.
+
+        In a concurrent GC the barrier definitely has to be after the store, not before it.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2016-09-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Air should have a way of expressing additional instruction flags
+        https://bugs.webkit.org/show_bug.cgi?id=162699
+
+        Reviewed by Mark Lam.
+
+        This follows a similar change in B3 (r206595) and replaces Air::Opcode with Air::Kind,
+        which holds onto the opcode and some additional flags. Because Air is an orthogonal ISA
+        (the opcode tells you what the operation does but each operand is allowed to also contain
+        effectively instructions for what to do to read or write that operand), the flags are
+        meant to be orthogonal to opcode. This allows us to say things like Add32<Trap>, which
+        makes sense if any of the operands to the Add32 are addresses.
+
+        To demonstrate the flags facility this partly adds a trap flag to Air. B3 doesn't use it
+        yet, but I made sure that Air respects it. Basically that means blocking DCE when the flag
+        is set, by making it imply hasNonArgNonControlEffects.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::Air::numB3Args):
+        (JSC::B3::CheckSpecial::Key::Key):
+        (JSC::B3::CheckSpecial::Key::dump):
+        (JSC::B3::CheckSpecial::CheckSpecial):
+        (JSC::B3::CheckSpecial::hiddenBranch):
+        (JSC::B3::CheckSpecial::forEachArg):
+        (JSC::B3::CheckSpecial::generate):
+        (JSC::B3::CheckSpecial::dumpImpl):
+        (JSC::B3::CheckSpecial::deepDumpImpl):
+        * b3/B3CheckSpecial.h:
+        (JSC::B3::CheckSpecial::Key::Key):
+        (JSC::B3::CheckSpecial::Key::operator==):
+        (JSC::B3::CheckSpecial::Key::kind):
+        (JSC::B3::CheckSpecial::Key::hash):
+        (JSC::B3::CheckSpecial::Key::opcode): Deleted.
+        * b3/B3Kind.cpp:
+        (JSC::B3::Kind::dump):
+        * b3/air/AirDumpAsJS.cpp:
+        (JSC::B3::Air::dumpAsJS):
+        * b3/air/AirFixObviousSpills.cpp:
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirHandleCalleeSaves.cpp:
+        (JSC::B3::Air::handleCalleeSaves):
+        * b3/air/AirInst.cpp:
+        (JSC::B3::Air::Inst::jsHash):
+        (JSC::B3::Air::Inst::dump):
+        * b3/air/AirInst.h:
+        (JSC::B3::Air::Inst::Inst):
+        (JSC::B3::Air::Inst::kind):
+        (JSC::B3::Air::Inst::operator bool):
+        (JSC::B3::Air::Inst::opcode): Deleted.
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::extraClobberedRegs):
+        (JSC::B3::Air::Inst::extraEarlyClobberedRegs):
+        (JSC::B3::Air::Inst::forEachDefWithExtraClobberedRegs):
+        (JSC::B3::Air::Inst::reportUsedRegisters):
+        (JSC::B3::Air::Inst::shouldTryAliasingDef):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirKind.cpp: Added.
+        (JSC::B3::Air::Kind::dump):
+        * b3/air/AirKind.h: Added.
+        (JSC::B3::Air::Kind::Kind):
+        (JSC::B3::Air::Kind::operator==):
+        (JSC::B3::Air::Kind::operator!=):
+        (JSC::B3::Air::Kind::hash):
+        (JSC::B3::Air::Kind::operator bool):
+        * b3/air/AirLowerAfterRegAlloc.cpp:
+        (JSC::B3::Air::lowerAfterRegAlloc):
+        * b3/air/AirLowerEntrySwitch.cpp:
+        (JSC::B3::Air::lowerEntrySwitch):
+        * b3/air/AirLowerMacros.cpp:
+        (JSC::B3::Air::lowerMacros):
+        * b3/air/AirOptimizeBlockOrder.cpp:
+        (JSC::B3::Air::optimizeBlockOrder):
+        * b3/air/AirReportUsedRegisters.cpp:
+        (JSC::B3::Air::reportUsedRegisters):
+        * b3/air/AirSimplifyCFG.cpp:
+        (JSC::B3::Air::simplifyCFG):
+        * b3/air/AirTmpWidth.cpp:
+        (JSC::B3::Air::TmpWidth::recompute):
+        * b3/air/AirUseCounts.h:
+        (JSC::B3::Air::UseCounts::UseCounts):
+        * b3/air/AirValidate.cpp:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (JSC::B3::testTernarySubInstructionSelection):
+        (JSC::B3::testBranchBitAndImmFusion):
+
+2016-09-29  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r206555): It made Dromaeo/jslib-style-jquery.html crash
+        https://bugs.webkit.org/show_bug.cgi?id=162721
+
+        Reviewed by Keith Miller.
+
+        The put_by_id-in-put_by_val optimization had the write barrier in the wrong place and
+        incorrectly filtered on value instead of base.
+
+        No reduced test case. You really need to run Dromaeo/jslib to catch it. I love Dromaeo's
+        ability to catch GC bugs.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitPutByValWithCachedId):
+
+2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Arrow functions do not infer name from computed property but normal functions do
+        https://bugs.webkit.org/show_bug.cgi?id=162720
+
+        Reviewed by Saam Barati.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitSetFunctionNameIfNeeded):
+        Set function name on arrow functions as well.
+
+2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: class and function names should be inferred in assignment
+        https://bugs.webkit.org/show_bug.cgi?id=146262
+
+        Reviewed by Saam Barati.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::appendParameter):
+        (JSC::ASTBuilder::appendArrayPatternEntry):
+        (JSC::ASTBuilder::appendObjectPatternEntry):
+        (JSC::ASTBuilder::tryInferFunctionNameInPattern):
+        Assign names to default value functions and classes in destructuring.
+
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::makeAssignNode):
+        Assign names to both normal and arrow functions.
+
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isBaseFuncExprNode):
+        Both functions and arrow functions infer name, they both extend
+        this base so give the base an is check.
+
+2016-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 opcodes should leave room for flags
+        https://bugs.webkit.org/show_bug.cgi?id=162692
+
+        Reviewed by Keith Miller.
+
+        It used to be that the main thing that determined what a Value did was the opcode. The
+        Opcode was how you knew what subclass of Value you had. The opcode told you what the Value
+        actually did. This change replaces Opcode with Kind, which is a tuple of opcode and other
+        stuff.
+
+        Opcodes are great, and that's how most compilers work. But opcodes are one-dimensional. Here
+        is how this manifests. Say you have an opcode, like Load. You will be happy if your IR has
+        one Load opcode. But then, you might add Load8S/Load8Z/Load16S/Load16Z opcodes, as we have
+        done in B3. B3 has one dimension of Load opcodes, which determines something like the C type
+        of the load. But in the very near future, we will want to add two more dimensions to Loads:
+
+        - A flag to say if the load traps.
+        - A flag to say if the load has acquire semantics.
+
+        Mapping these three dimensions (type, trap, acquire) onto the one-dimensional Opcode space
+        would create mayham: Load8S, Load8STrap, Load8SAcquire, Load8STrapAcquire, Load8Z,
+        Load8ZTrap, etc.
+
+        This happens in other parts of the IR. For example, we have a dimension of arithmetic
+        operations: add, sub, mul, div, mod, etc. Then we have the chill flag. But since opcodes
+        are one-dimensional, that means having ChillDiv and ChillMod, and tons of places in the
+        compiler that case on both Div and ChillDiv, or case on both Mod and ChillMod, since they
+        are only interested in the kind of arithmetic being done and not the chillness.
+
+        Though the examples all involve bits (chill or not, trapping or not, etc), I can imagine
+        other properties that behave more like small enums, like if we fill out more memory ordering
+        modes other than just "acquire? yes/no". There will eventually have to be something like a
+        std::memory_order associated with memory accesses.
+
+        One approach to this problem is to have a Value subclass that contains fields with the meta
+        data. I don't like this for two reasons:
+
+        - In bug 162688, I want to make trapping memory accesses have stackmaps. This means that a
+          trapping memory access would have a different Value subclass than a non-trapping memory
+          access. So, this meta-data needs to channel into ValueType::accepts(). Currently that
+          takes Opcode and nothing else.
+
+        - Compiler IRs are all about making common tasks easy. If it becomes commonplace for opcodes
+          to require a custom Value subclass just for a bit then that's not very easy.
+
+        This change addresses this problem by making the compiler pass around Kinds rather than
+        Opcodes. A Kind contains an Opcode as well as any number of opcode-specific bits. This
+        change demonstrates how Kind should be used by converting chillness to it. Kind has
+        hasIsChill(), isChill(), and setIsChill() methods. hasIsChill() is true only for Div and
+        Mod. setIsChill() asserts if !hasIsChill(). If you want to create a Chill Div, you say
+        chill(Div). IR dumps will print it like this:
+
+            Int32 @38 = Div<Chill>(@36, @37, DFG:@24, ControlDependent)
+
+        Where "Div<Chill>" is how a Kind that hasExtraBits() dumps itself. If a Kind does not
+        hasExtraBits() (the normal case) then it dumps like a normal Opcode (without the "<>").
+
+        I replaced many uses of Opcode with Kind. New code has to be mindful that Opcode may not be
+        the right way to summarize what a value does, and so in many cases it's better to carry
+        around a Kind instead - especially if you will use it to stamp out new Values. Opcode is no
+        longer sufficient to perform a dynamic Value cast, since that code now uses Kind. ValueKey
+        now wants a Kind instead of an Opcode. All Value constructors now take Kind instead of
+        Opcode. But most opcodes don't get any extra Kind bits, and so the code that operates on
+        those opcodes is largely unchanged.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3ArgumentRegValue.h:
+        * b3/B3CCallValue.h:
+        * b3/B3CheckValue.cpp:
+        (JSC::B3::CheckValue::convertToAdd):
+        (JSC::B3::CheckValue::CheckValue):
+        * b3/B3CheckValue.h:
+        (JSC::B3::CheckValue::accepts):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ConstFloatValue.h:
+        * b3/B3FenceValue.h:
+        * b3/B3Kind.cpp: Added.
+        (JSC::B3::Kind::dump):
+        * b3/B3Kind.h: Added.
+        (JSC::B3::Kind::Kind):
+        (JSC::B3::Kind::opcode):
+        (JSC::B3::Kind::setOpcode):
+        (JSC::B3::Kind::hasExtraBits):
+        (JSC::B3::Kind::hasIsChill):
+        (JSC::B3::Kind::isChill):
+        (JSC::B3::Kind::setIsChill):
+        (JSC::B3::Kind::operator==):
+        (JSC::B3::Kind::operator!=):
+        (JSC::B3::Kind::hash):
+        (JSC::B3::Kind::isHashTableDeletedValue):
+        (JSC::B3::chill):
+        (JSC::B3::KindHash::hash):
+        (JSC::B3::KindHash::equal):
+        * b3/B3LowerMacros.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3MemoryValue.h:
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3PatchpointValue.h:
+        (JSC::B3::PatchpointValue::accepts):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3SlotBaseValue.h:
+        * b3/B3StackmapValue.cpp:
+        (JSC::B3::StackmapValue::StackmapValue):
+        * b3/B3StackmapValue.h:
+        * b3/B3SwitchValue.h:
+        (JSC::B3::SwitchValue::accepts):
+        * b3/B3UpsilonValue.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::dump):
+        (JSC::B3::Value::deepDump):
+        (JSC::B3::Value::invertedCompare):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        (JSC::B3::Value::badKind):
+        (JSC::B3::Value::badOpcode): Deleted.
+        * b3/B3Value.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::as):
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::dump):
+        (JSC::B3::ValueKey::materialize):
+        * b3/B3ValueKey.h:
+        (JSC::B3::ValueKey::ValueKey):
+        (JSC::B3::ValueKey::kind):
+        (JSC::B3::ValueKey::opcode):
+        (JSC::B3::ValueKey::operator==):
+        (JSC::B3::ValueKey::hash):
+        * b3/B3ValueKeyInlines.h:
+        (JSC::B3::ValueKey::ValueKey):
+        * b3/B3VariableValue.cpp:
+        (JSC::B3::VariableValue::VariableValue):
+        * b3/B3VariableValue.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testChillDiv):
+        (JSC::B3::testChillDivTwice):
+        (JSC::B3::testChillDiv64):
+        (JSC::B3::testChillModArg):
+        (JSC::B3::testChillModArgs):
+        (JSC::B3::testChillModImms):
+        (JSC::B3::testChillModArg32):
+        (JSC::B3::testChillModArgs32):
+        (JSC::B3::testChillModImms32):
+        (JSC::B3::testSwitchChillDiv):
+        (JSC::B3::testEntrySwitchWithCommonPaths):
+        (JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::chillDiv):
+        (JSC::FTL::Output::chillMod):
+
+2016-09-29  Saam Barati  <sbarati@apple.com>
+
+        We don't properly propagate non-simple-parameter-list when parsing a setter
+        https://bugs.webkit.org/show_bug.cgi?id=160483
+
+        Reviewed by Joseph Pecoraro.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+
+2016-09-28  Saam Barati  <sbarati@apple.com>
+
+        stringProtoFuncRepeatCharacter will return `null` when it should not
+        https://bugs.webkit.org/show_bug.cgi?id=161944
+
+        Reviewed by Yusuke Suzuki.
+
+        stringProtoFuncRepeatCharacter was expecting its second argument
+        to always be a boxed integer. This is not correct. The DFG may decide
+        to represent a particular value as a double instead of integer. This
+        function needs to have correct behavior when its second argument is
+        a boxed double. I also added an assertion stating that the second argument
+        is always a number. We can guarantee this since it's only called from
+        builtins.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncRepeatCharacter):
+
+2016-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        The write barrier should be down with TSO
+        https://bugs.webkit.org/show_bug.cgi?id=162316
+
+        Reviewed by Geoffrey Garen.
+
+        This makes our write barrier behave correctly when it races with the collector. The
+        collector wants to do this when visiting:
+
+            object->cellState = black
+            visit(object)
+
+        The mutator wants to do this when storing:
+
+            object->property = newValue
+            if (object->cellState == black)
+                remember(object)
+
+        Prior to this change, this didn't work right because the compiler would sometimes place
+        barriers before the store to the property and because the mutator did not have adequate
+        fences.
+
+        Prior to this change, the DFG and FTL would emit this:
+
+            if (object->cellState == black)
+                remember(object)
+            object->property = newValue
+
+        Which is wrong, because the object could start being scanned just after the cellState
+        check, at which point the store would be lost. We need to confirm that the state was not
+        black *after* the store! This change was harder than you'd expect: placing the barrier
+        after the store broke B3's ability to do its super crazy ninja CSE on some store-load
+        redundancies. Because the B3 CSE has some moves that the DFG CSE lacks, the DFG CSE's
+        ability to ignore barriers didn't help. I fixed this by having the FTL convey precise
+        heap ranges for the patchpoint corresponding to the barrier slow path. It reads the world
+        (because of the store-load fence) and it writes only cellState (because the B3 heap ranges
+        don't have any way to represent any of the GC's other state, which means that B3 does not
+        have to worry about aliasing with any of that).
+
+        The collector already uses a store-load fence on x86 just after setting the cellState and
+        before visiting the object. The mutator needs to do the same. But we cannot put a
+        store-load fence of any kind before store barriers, because that causes enormous slow
+        downs. In the worst case, Octane/richards slowed down by 90%! That's crazy! However, the
+        overall slow downs were small enough (0-15% on benchmark suite aggregates) that it would be
+        reasonable if the slow down only happened while the GC was running. Then, the concurrent GC
+        would lift throughput-while-collecting from 0% of peak to 85% of peak. This changes the
+        barrier so that it looks like this:
+
+            if (object->cellState <= heap.sneakyBlackThreshold)
+                slowPath(object)
+
+        Where sneakyBlackThreshold is the normal blackThreshold when we're not collecting, or a
+        tautoligical threshold (that makes everything look black) when we are collecting. This
+        turns out to not be any more expensive than the barrier in tip of tree when the GC is not
+        running, or a 0-15% slow-down when it is "running". (Of course we don't run the GC
+        concurrently yet. I still have more work to do.) The slowPath() does some extra work to
+        check if we are concurrently collecting; if so, it does a fence and rechecks if the object
+        really did need that barrier.
+
+        This also reintroduces elimination of redundant store barriers, which was lost in the last
+        store barrier change. We can only do it when there is no possibility of GC, exit, or
+        exceptions between the two store barriers. We could remove the exit/exception limitation if
+        we taught OSR exit how to buffer store barriers, which is an insane thing to do considering
+        that I've never been able to detect a win from redundant store barrier elimination. I just
+        want us to have it for stupidly obvious situations, like a tight sequence of stores to the
+        same object. This same optimization also sometimes strength-reduces the store barrier so
+        that it uses a constant black threshold rather than the sneaky one, thereby saving one
+        load.
+
+        Even with all of those optimizations, I still had problems with barrier cost. I found that one
+        of the benchmarks that was being hit particularly hard was JetStream/regexp-2010. Fortunately
+        that benchmark does most of its barriers in a tight C++ loop in RegExpMatchesArray.h. When we
+        know what we're doing, we can defer GC around a bunch of object initializations and then remove
+        all of the barriers between any of the objects allocated within the deferral. Unfortunately,
+        our GC deferral mechanism isn't really performant enough to make this be a worthwhile
+        optimization. The most efficient version of such an optimization that I could come up with was
+        to have a DeferralContext object that houses a boolean that is false by default, but the GC
+        writes true into it if it would have wanted to GC. You thread a pointer to the deferralContext
+        through all of your allocations. This kind of mechanism has the overhead of a zero
+        initialization on the stack on entry and a zero check on exit. This is probably even efficient
+        enough that we could start thinking about having the DFG use it, for example if we found a
+        bounded-time section of code with a lot of barriers and entry/exit sites that aren't totally
+        wacky. This optimization took this patch from 0.68% JetStream regressed to neutral, according
+        to my latest data.
+
+        Finally, an earlier version of this change put the store-load fence in B3 IR, so I ended up
+        adding FTLOutput support for it and AbstractHeapRepository magic for decorating the heaps.
+        I think we might as well keep that, it'll be useful.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branch32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branch32):
+        (JSC::MacroAssemblerX86_64::branch64): Deleted.
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp:
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isStoreBarrier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
+        (JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer): Deleted.
+        (JSC::DFG::SpeculativeJIT::writeBarrier): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileBaseValueStoreBarrier): Deleted.
+        (JSC::DFG::SpeculativeJIT::writeBarrier): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileBaseValueStoreBarrier): Deleted.
+        (JSC::DFG::SpeculativeJIT::writeBarrier): Deleted.
+        * dfg/DFGStoreBarrierClusteringPhase.cpp: Added.
+        (JSC::DFG::performStoreBarrierClustering):
+        * dfg/DFGStoreBarrierClusteringPhase.h: Added.
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGStoreBarrierInsertionPhase.h:
+        * ftl/FTLAbstractHeap.h:
+        (JSC::FTL::AbsoluteAbstractHeap::at):
+        (JSC::FTL::AbsoluteAbstractHeap::operator[]):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::decorateFenceRead):
+        (JSC::FTL::AbstractHeapRepository::decorateFenceWrite):
+        (JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStoreBarrier):
+        (JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
+        (JSC::FTL::DFG::LowerDFGToB3::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::fence):
+        (JSC::FTL::Output::absolute):
+        * ftl/FTLOutput.h:
+        * heap/CellState.h:
+        (JSC::isWithinThreshold):
+        (JSC::isBlack):
+        * heap/Heap.cpp:
+        (JSC::Heap::writeBarrierSlowPath):
+        * heap/Heap.h:
+        (JSC::Heap::barrierShouldBeFenced):
+        (JSC::Heap::addressOfBarrierShouldBeFenced):
+        (JSC::Heap::sneakyBlackThreshold):
+        (JSC::Heap::addressOfSneakyBlackThreshold):
+        * heap/HeapInlines.h:
+        (JSC::Heap::writeBarrier):
+        (JSC::Heap::writeBarrierWithoutFence):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::jumpIfIsRememberedOrInEdenWithoutFence):
+        (JSC::AssemblyHelpers::sneakyJumpIfIsRememberedOrInEden):
+        (JSC::AssemblyHelpers::jumpIfIsRememberedOrInEden):
+        (JSC::AssemblyHelpers::storeBarrierStoreLoadFence):
+        (JSC::AssemblyHelpers::jumpIfStoreBarrierStoreLoadFenceNotNeeded):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitWriteBarrier):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        * llint/LowLevelInterpreter.asm:
+        * offlineasm/x86.rb:
+        * runtime/Options.h:
+
+2016-09-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Improve useCodeCache Option description string.
+
+        * runtime/Options.h:
+        Address late review comments and clarify description.
+
+2016-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Optimize B3->Air lowering of Fence on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=162342
+
+        Reviewed by Geoffrey Garen.
+
+        This gives us comprehensive support for standalone fences on x86 and ARM. The changes are as
+        follows:
+
+        - Sets in stone the rule that the heaps of a B3::Fence tell you what the fence protects. If the
+          fence reads, it protects motion of stores. If the fence writes, it protects motion of loads.
+          This allows us to express for example load-load fences in a portable way: on x86 they will just
+          block B3 optimizations and emit no code, while on ARM you will get some fence.
+
+        - Adds comprehensive support for WTF-style fences in the ARM assembler. I simplified it just a bit
+          to match what B3, the main client, knows. There are three fences: MemoryFence, StoreFence, and
+          LoadFence. On x86, MemoryFence is ortop while StoreFence and LoadFence emit no code. On ARM64,
+          MemoryFence and LoadFence are dmb ish while StoreFence is dmb ishst.
+
+        - Tests! To test this, I needed to teach the disassembler how to disassemble dmb ish and dmb
+          ishst. I think that the canonical way to do it would be to create a group for dmb and then teach
+          that group how to decode the operands. But I don't actually know what are all of the ways of
+          encoding dmb, so I'd rather that unrecognized encodings fall through to the ".long blah"
+          bailout. So, this creates explicit matching rules for "dmb ish" and "dmb ishst", which is the
+          most conservative thing we can do.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::dmbISH):
+        (JSC::ARM64Assembler::dmbISHST):
+        (JSC::ARM64Assembler::dmbSY): Deleted.
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::memoryFence):
+        (JSC::MacroAssemblerARM64::storeFence):
+        (JSC::MacroAssemblerARM64::loadFence):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::storeFence):
+        (JSC::MacroAssemblerX86Common::loadFence):
+        * b3/B3FenceValue.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testMemoryFence):
+        (JSC::B3::testStoreFence):
+        (JSC::B3::testLoadFence):
+        (JSC::B3::run):
+        (JSC::B3::testX86MFence): Deleted.
+        (JSC::B3::testX86CompilerFence): Deleted.
+        * disassembler/ARM64/A64DOpcode.cpp:
+        (JSC::ARM64Disassembler::A64DOpcodeDmbIsh::format):
+        (JSC::ARM64Disassembler::A64DOpcodeDmbIshSt::format):
+        * disassembler/ARM64/A64DOpcode.h:
+        (JSC::ARM64Disassembler::A64DOpcodeDmbIsh::opName):
+        (JSC::ARM64Disassembler::A64DOpcodeDmbIshSt::opName):
+
+2016-09-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Adopt #pragma once in some generated resources
+        https://bugs.webkit.org/show_bug.cgi?id=162666
+
+        Reviewed by Alex Christensen.
+
+        * Scripts/builtins/builtins_generate_combined_header.py:
+        * Scripts/builtins/builtins_generate_internals_wrapper_header.py:
+        * Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
+        * Scripts/builtins/builtins_generate_separate_header.py:
+        * Scripts/builtins/builtins_generate_wrapper_header.py:
+        * Scripts/builtins/builtins_generate_wrapper_implementation.py:
+        Remove headerGuard attribute unused by templates.
+
+        * Scripts/tests/builtins/expected/JavaScriptCore-Operations.Promise-Combined.js-result: Removed.
+        No such test exists. It was likely renamed.
+
+        * generate-bytecode-files:
+        Simplify header guard output.
+
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
+        (ObjCBackendDispatcherHeaderGenerator.generate_output):
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Generator.generate_header):
+        * replay/scripts/CodeGeneratorReplayInputsTemplates.py:
+        Simplify header guard output.
+
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.h:
+        Rebaseline.
+
+2016-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Store-load fences should be a lot cheaper on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=162461
+
+        Rubber stamped by Keith Miller.
+
+        It turns out that they are already cheap enough, so this change just make us use them.
+
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::visitChildren):
+
+2016-09-28  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Unreviewed, rolling out r206522.
+
+        Roll r206506 back in since the build fix landed in r206521
+
+        Reverted changeset:
+
+        "Unreviewed, rolling out r206506."
+        https://bugs.webkit.org/show_bug.cgi?id=162682
+        http://trac.webkit.org/changeset/206522
+
+2016-09-28  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r206506.
+        https://bugs.webkit.org/show_bug.cgi?id=162682
+
+        Broke the Windows and WinCairo builds. (Requested by
+        ryanhaddad on #webkit).
+
+        Reverted changeset:
+
+        "Adopt #pragma once in JavaScriptCore"
+        https://bugs.webkit.org/show_bug.cgi?id=162664
+        http://trac.webkit.org/changeset/206506
+
+2016-09-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Adopt #pragma once in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=162664
+
+        Reviewed by Saam Barati.
+
+        * **/**.h:
+        Adopt pragma once in all but API headers and generated headers.
+        Include some namespace closing comments for consistency.
+
+2016-09-27  JF Bastien  <jfbastien@apple.com>
+
+        Missing Atomics.h include in MarkedBlock.h
+        https://bugs.webkit.org/show_bug.cgi?id=162648
+
+        Missing include from my previous patch.
+
+        Reviewed by Yusuke Suzuki.
+
+        * heap/MarkedBlock.h:
+
+2016-09-27  Mark Lam  <mark.lam@apple.com>
+
+        createError() and JSObject::calculatedClassName() should not throw any exceptions.
+        https://bugs.webkit.org/show_bug.cgi?id=162637
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        - assert that errorDescriptionForValue() did not throw an exception.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+        - the code already ensures that we always return a non-null String.  Just need to
+          make sure that it catches its own exceptions.
+
+2016-09-27  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=162644
+
+        Reviewed by Keith Miller.
+
+        If you forget to update the predecessors of your successors, then bad things will happen if you
+        do something that requires accurate predecessors for correctness. lowerMacros() uses
+        BlockInsertionSet, which relies on accurate predecessors.
+
+        * b3/B3LowerMacros.cpp:
+
+2016-09-27  JF Bastien  <jfbastien@apple.com>
+
+        Speed up Heap::isMarkedConcurrently
+        https://bugs.webkit.org/show_bug.cgi?id=162095
+
+        Reviewed by Filip Pizlo.
+
+        Speed up isMarkedConcurrently by using WTF::consumeLoad.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::areMarksStale):
+        (JSC::MarkedBlock::areMarksStaleWithDependency):
+        (JSC::MarkedBlock::isMarkedConcurrently): do away with the load-load fence
+
+2016-09-27  Mark Lam  <mark.lam@apple.com>
+
+        Add some needed CatchScopes in code that should not throw.
+        https://bugs.webkit.org/show_bug.cgi?id=162584
+
+        Reviewed by Keith Miller.
+
+        Re-landing minus the jsc.cpp and ExceptionHelpers.cpp changes.  I'll address
+        those in a subsequent patch if the need manifests again in my testing.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        - This function already handles exceptions in its own way.  We're honoring this
+          contract and catching exceptions and passing it to the handler.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::notifyDebuggerOfUnwinding):
+        - The debugger should not be throwing any exceptions.
+
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::save):
+        - If an exception was thrown while saving the database, there's nothing we can
+          really do about it anyway.  Just fail nicely and return false.  This is in line
+          with existing error checking code in Database::save() that returns false if
+          it's not able to open the file to save to.
+
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::finishCreation):
+        - The existing code already RELEASE_ASSERT that no exception was thrown.
+          Hence, it's appropriate to use a CatchScope here.
+
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
+        - The sampling profiler is doing a VMInquiry get here.  It should never throw an
+          exception.  Hence, we'll just use a CatchScope and assert accordingly.
+
+2016-09-27  Jer Noble  <jer.noble@apple.com>
+
+        Remove deprecated ENCRYPTED_MEDIA implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=161010
+
+        Reviewed by Eric Carlson.
+
+        Remove ENABLE_ENCRYPTED_MEDIA.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-09-27  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        [GTK] Install binaries to pkglibexecdir rather than bindir
+        https://bugs.webkit.org/show_bug.cgi?id=162602
+
+        Reviewed by Carlos Garcia Campos.
+
+        Install jsc shell to LIBEXEC_INSTALL_DIR rather than EXEC_INSTALL_DIR.
+
+        Note these locations are the same on non-GTK ports.
+
+        * shell/CMakeLists.txt:
+
+2016-09-26  Sam Weinig  <sam@webkit.org>
+
+        Make DFGSlowPathGenerator a bit more variadic
+        https://bugs.webkit.org/show_bug.cgi?id=162378
+
+        Reviewed by Filip Pizlo.
+
+        Make the subclass of CallSlowPathGenerator that takes arguments variadic
+        so it can take any number of arguments. Also updates the slowPathCall helper
+        function to be variadic. I had to move the spill mode and exception check
+        requirement parameters to before the arguments since the variadic arguments
+        must be at the end. As a convenience, I added an overload of slowPathCall that
+        doesn't take spill mode and exception check requirement parameters.
+
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::CallResultAndArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndArgumentsSlowPathGenerator::unpackAndGenerate):
+        (JSC::DFG::slowPathCall):
+        (JSC::DFG::CallResultAndNoArgumentsSlowPathGenerator::CallResultAndNoArgumentsSlowPathGenerator): Deleted.
+        (JSC::DFG::CallResultAndOneArgumentSlowPathGenerator::CallResultAndOneArgumentSlowPathGenerator): Deleted.
+        (JSC::DFG::CallResultAndTwoArgumentsSlowPathGenerator::CallResultAndTwoArgumentsSlowPathGenerator): Deleted.
+        (JSC::DFG::CallResultAndThreeArgumentsSlowPathGenerator::CallResultAndThreeArgumentsSlowPathGenerator): Deleted.
+        (JSC::DFG::CallResultAndFourArgumentsSlowPathGenerator::CallResultAndFourArgumentsSlowPathGenerator): Deleted.
+        (JSC::DFG::CallResultAndFourArgumentsSlowPathGenerator::generateInternal): Deleted.
+        (JSC::DFG::CallResultAndFiveArgumentsSlowPathGenerator::CallResultAndFiveArgumentsSlowPathGenerator): Deleted.
+        (JSC::DFG::CallResultAndFiveArgumentsSlowPathGenerator::generateInternal): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileNotifyWrite):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+
+2016-09-26  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r206405.
+        https://bugs.webkit.org/show_bug.cgi?id=162588
+
+        This change caused LayoutTest crashes. (Requested by
+        ryanhaddad on #webkit).
+
+        Reverted changeset:
+
+        "Add some needed CatchScopes in code that should not throw."
+        https://bugs.webkit.org/show_bug.cgi?id=162584
+        http://trac.webkit.org/changeset/206405
+
+2016-09-26  Mark Lam  <mark.lam@apple.com>
+
+        Add some needed CatchScopes in code that should not throw.
+        https://bugs.webkit.org/show_bug.cgi?id=162584
+
+        Reviewed by Keith Miller.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        - This function already handles exceptions in its own way.  We're honoring this
+          contract and catching exceptions and passing it to the handler.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::notifyDebuggerOfUnwinding):
+        - The debugger should not be throwing any exceptions.
+
+        * jsc.cpp:
+        (runJSC):
+        - the buck stops here.  There's no reason an exception should propagate past here.
+
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::save):
+        - If an exception was thrown while saving the database, there's nothing we can
+          really do about it anyway.  Just fail nicely and return false.  This is in line
+          with existing error checking code in Database::save() that returns false if
+          it's not able to open the file to save to.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        - If we're not able to stringify the error value, then we'll just use the
+          provided message as the error string.  It doesn't make sense to have the
+          Error factory throw an exception that shadows the intended exception that the
+          client probably wants to throw (assuming that that's why the client is creating
+          this Error object).
+
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::finishCreation):
+        - The existing code already RELEASE_ASSERT that no exception was thrown.
+          Hence, it's appropriate to use a CatchScope here.
+
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
+        - The sampling profiler is doing a VMInquiry get here.  It should never throw an
+          exception.  Hence, we'll just use a CatchScope and assert accordingly.
+
+2016-09-26  Mark Lam  <mark.lam@apple.com>
+
+        Exception unwinding code should use a CatchScope instead of a ThrowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=162583
+
+        Reviewed by Geoffrey Garen.
+
+        This is because the exception unwinding code does not throw an exception.
+        It only inspects the thrown exception and passes it to the appropriate handler.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwind):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+
+2016-09-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Add an Option to disable the CodeCache
+        https://bugs.webkit.org/show_bug.cgi?id=162579
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        Do not use the cache if the Option is disabled.
+
+        * runtime/Options.h:
+        New option to not use the code cache.
+
+2016-09-26  Daniel Bates  <dabates@apple.com>
+
+        Rename IOS_TEXT_AUTOSIZING to TEXT_AUTOSIZING
+        https://bugs.webkit.org/show_bug.cgi?id=162365
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-09-26  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Shrink the Math inline caches some more
+        https://bugs.webkit.org/show_bug.cgi?id=162485
+
+        Reviewed by Saam Barati.
+
+        This patch applies some lessons learnt from op_negate
+        to shrink the generated asm of the previous 3 inline
+        caches.
+
+        In order of importance:
+        -We do not need to pass the pointer to ArithProfile
+         on the slow path. We can just get the profile out
+         of the Math IC.
+         This saves us from materializing a 64bits value
+         in a register before the call on the slow path.
+        -We can remove a bunch of mov by setting up the registers
+         in the way the slow path needs them.
+         The slow path makes a function calls with the input
+         as second and third arguments, and return the result in
+         the "return register". By using those as target when
+         loading/storing from the stack, we remove 3 mov per slow path.
+        -When performing integer add, we can set the result directly in
+         the output register if that does not trashes one of the input
+         register. This removes one mov per integer add.
+
+        The inline cache average sizes on Sunspider change as follow:
+        -Adds: 147.573099->131.555556 (~10%)
+        -Muls: 186.882353->170.991597 (~8%)
+        -Subs: 139.127907->121.523256 (~12%)
+
+        * jit/JIT.h:
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateInline):
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitMathICFast):
+        (JSC::JIT::emitMathICSlow):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+
+2016-09-26  Mark Lam  <mark.lam@apple.com>
+
+        Added RETURN_IF_EXCEPTION() macro and use it for exception checks.
+        https://bugs.webkit.org/show_bug.cgi?id=162521
+
+        Reviewed by Saam Barati.
+
+        Also, where possible, if the return type is JSValue, changed the returned value
+        (on exception) to the empty JSValue (instead of sometimes jsUndefined, jsNull,
+        or the thrown exception value).
+
+        There are a few places where I had to continue to return the previously returned
+        value (instead of the empty JSValue) in order for tests to pass.  This is needed
+        because there are missing exception checks that will need to be added before I
+        can change those to return the empty JSValue too.  Identifying all the places
+        where those checks need to be added is beyond the scope of this patch.  I will
+        work on adding missing exception checks in a subsequent patch.
+
+        In this patch, there is one missing exception check in replaceUsingRegExpSearch()
+        that was easily identified, and is necessary so that Interpreter::execute()
+        functions can return JSValue.  I've added this missing check.
+
+        This patch has passed the JSC and layout tests.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        (Inspector::JSInjectedScriptHost::weakMapEntries):
+        (Inspector::JSInjectedScriptHost::weakSetEntries):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::sizeOfVarargs):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::functionsOnStack):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * jsc.cpp:
+        (WTF::ImpureGetter::getOwnPropertySlot):
+        (functionRun):
+        (functionRunString):
+        (functionLoad):
+        (functionLoadString):
+        (functionReadFile):
+        (functionCheckSyntax):
+        (functionSetRandomSeed):
+        (functionLoadModule):
+        (functionCreateBuiltin):
+        (functionCheckModuleSyntax):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::addSequenceProperties):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::toJS):
+        * profiler/ProfilerOSRExitSite.cpp:
+        (JSC::Profiler::OSRExitSite::toJS):
+        * profiler/ProfilerOriginStack.cpp:
+        (JSC::Profiler::OriginStack::toJS):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::slowJoin):
+        (JSC::fastJoin):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        (JSC::moveElements):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructWithBooleanConstructor):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/Completion.cpp:
+        (JSC::loadAndEvaluateModule):
+        (JSC::loadModule):
+        * runtime/ConsoleObject.cpp:
+        (JSC::consoleProtoFuncAssert):
+        (JSC::consoleProtoFuncProfile):
+        (JSC::consoleProtoFuncProfileEnd):
+        (JSC::consoleProtoFuncTakeHeapSnapshot):
+        (JSC::consoleProtoFuncTime):
+        (JSC::consoleProtoFuncTimeEnd):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToPrimitiveSymbol):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::sanitizedToString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionScope.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::copyToArguments):
+        * runtime/GetterSetter.cpp:
+        (JSC::callGetter):
+        * runtime/HashMapImpl.h:
+        (JSC::jsMapHash):
+        (JSC::HashMapImpl::finishCreation):
+        (JSC::HashMapImpl::findBucket):
+        (JSC::HashMapImpl::add):
+        (JSC::HashMapImpl::rehash):
+        * runtime/InspectorInstrumentationObject.cpp:
+        (JSC::inspectorInstrumentationObjectLog):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::initializeCollator):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorFuncCompare):
+        (JSC::IntlCollatorPrototypeGetterCompare):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::toDateTimeOptionsAnyDate):
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatFuncFormatDateTime):
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatFuncFormatNumber):
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        * runtime/IntlObject.cpp:
+        (JSC::intlBooleanOption):
+        (JSC::intlStringOption):
+        (JSC::intlNumberOption):
+        (JSC::canonicalizeLocaleList):
+        (JSC::supportedLocales):
+        * runtime/IntlObjectInlines.h:
+        (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
+        * runtime/IteratorOperations.cpp:
+        (JSC::iteratorNext):
+        (JSC::iteratorStep):
+        (JSC::iteratorClose):
+        (JSC::iteratorForIterable):
+        * runtime/IteratorOperations.h:
+        (JSC::forEachInIterable):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSArrayInlines.h:
+        (JSC::getLength):
+        (JSC::toLength):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::getBoundFunctionStructure):
+        (JSC::JSBoundFunction::create):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::toPreferredPrimitiveType):
+        (JSC::JSValue::getPropertySlot):
+        (JSC::JSValue::equalSlowCaseInline):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::setFunctionName):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndex):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncIncludes):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        (JSC::constructArrayNegativeIndexed):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        * runtime/JSObject.cpp:
+        (JSC::ordinarySetSlow):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::callToPrimitiveFunction):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::JSObject::getGenericPropertyNames):
+        (JSC::JSObject::getMethod):
+        * runtime/JSObjectInlines.h:
+        (JSC::createListFromArrayLike):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getNonIndexPropertySlot):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::create):
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::propertyNameEnumerator):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSScope.cpp:
+        (JSC::isUnscopable):
+        * runtime/JSString.cpp:
+        (JSC::JSString::equalSlowCase):
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::join):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        * runtime/MapBase.h:
+        (JSC::MapBase::finishCreation):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncClz32):
+        (JSC::mathProtoFuncHypot):
+        (JSC::mathProtoFuncIMul):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+        (JSC::moduleLoaderPrototypeRequestedModules):
+        (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyDescriptors):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorGetOwnPropertySymbols):
+        (JSC::objectConstructorKeys):
+        (JSC::ownEnumerablePropertyKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::defineProperties):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+        (JSC::ownPropertyKeys):
+        * runtime/ObjectConstructor.h:
+        (JSC::constructObjectFromPropertyDescriptor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::slowGetterSetter):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::makeRevocableProxy):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::performPut):
+        (JSC::ProxyObject::putByIndexCommon):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectConstruct):
+        (JSC::reflectObjectDefineProperty):
+        (JSC::reflectObjectGet):
+        (JSC::reflectObjectGetOwnPropertyDescriptor):
+        (JSC::reflectObjectIsExtensible):
+        (JSC::reflectObjectPreventExtensions):
+        (JSC::reflectObjectSet):
+        (JSC::reflectObjectSetPrototypeOf):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::toFlags):
+        (JSC::regExpCreate):
+        (JSC::constructRegExp):
+        * runtime/RegExpConstructor.h:
+        (JSC::isRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::collectMatches):
+        (JSC::RegExpObject::matchGlobal):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::flagsString):
+        (JSC::regExpProtoFuncToString):
+        (JSC::regExpProtoGetterFlags):
+        (JSC::regExpProtoFuncSearchFast):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCodePoint):
+        (JSC::constructWithStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
+        (JSC::replaceUsingStringSearch):
+        (JSC::replace):
+        (JSC::stringProtoFuncReplaceUsingRegExp):
+        (JSC::stringProtoFuncReplaceUsingStringSearch):
+        (JSC::stringProtoFuncCodePointAt):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::toLocaleCase):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringIncludesImpl):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::stringProtoFuncNormalize):
+        * runtime/SymbolConstructor.cpp:
+        (JSC::symbolConstructorFor):
+        * runtime/TemplateRegistry.cpp:
+        (JSC::TemplateRegistry::getTemplateObject):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::constructWeakSet):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionPrint):
+
+2016-09-26  Don Olmstead  <don.olmstead@am.sony.com>
+
+        [JSC] Allow fixedExecutableMemoryPoolSize to be set during build
+        https://bugs.webkit.org/show_bug.cgi?id=162514
+
+        Reviewed by Mark Lam.
+
+        * jit/ExecutableAllocator.h:
+
+== Rolled over to ChangeLog-2016-09-26 ==
diff --git a/ChangeLog-2002-12-03 b/ChangeLog-2002-12-03
new file mode 100644
index 0000000..bd63777
--- /dev/null
+++ b/ChangeLog-2002-12-03
@@ -0,0 +1,2271 @@
+2002-12-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by: Darin Adler
+
+	- fixed Deployment build.
+	
+        * kjs/dtoa.cpp: Work around warnings.
+
+2002-12-03  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3114790 - Gamespot reviews pages badly mis-rendering
+	because floating point numbers format wide
+
+	Reviewed by: David Hyatt
+	
+	* kjs/dtoa.cpp: Imported float <--> string conversion routines
+	from David M. Gay. I changed this to fix warnings and avoid
+	colliding with names of standard library functions.
+        * kjs/dtoa.h: Added a header I made up for dtoa.cpp
+        * kjs/ustring.cpp:
+        (UString::from): Use new double to string routine (kjs_strtod).
+        (UString::toDouble): Use new string to double routine (kjs_dtoa).
+        * JavaScriptCore.pbproj/project.pbxproj: Added new files
+
+2002-11-27  John Sullivan  <sullivan@apple.com>
+
+        * kjs/collector.cpp:
+	removed puts("COLLECT") leftover debugging spam that was
+	buggin' gramps
+
+=== Alexander-34 ===
+
+2002-11-26  Maciej Stachowiak  <mjs@apple.com>
+
+	Change ActivationImp to be allocated via the garbage collector
+	again instead of on the stack. This fixes the following four
+	regressions but sadly it causes a 6% performance hit. It's
+	probably possibly to reduce the hit a bit by being smarter about
+	inlining and the way the marking list variant is implemented, but
+	I'll look into that later.
+
+	- fixed 3111500 - REGRESSION: crash in "KJS::ScopeChain::mark()" on www.posci.com
+	- fixed 3111145 - REGRESSION: reproducible crash in KJS hashtable lookup at time.com
+	- fixed 3110897 - REGRESSION: javascript crasher on http://bmwgallery.tripod.com/
+	- fixed 3109987 - REGRESSION: Reproducible crash in KJS ObjectImp at live365.com
+	
+	Also:
+	
+	- improved DEBUG_COLLECTOR mode a bit by never giving memory back
+	to the system.
+	
+        * kjs/collector.cpp:
+        * kjs/context.h:
+        * kjs/function.cpp:
+        (ActivationImp::ActivationImp):
+        (ActivationImp::mark):
+        (ActivationImp::createArgumentsObject):
+        * kjs/function.h:
+        * kjs/internal.cpp:
+        (ContextImp::ContextImp):
+        (ContextImp::mark):
+        * kjs/list.cpp:
+        * kjs/list.h:
+        * kjs/value.cpp:
+        (Value::Value):
+
+2002-11-26  Darin Adler  <darin@apple.com>
+
+        * kjs/property_map.cpp:
+	(PropertyMap::save): Look at the attributes the same way in the single hash entry
+	case as in the actual hash table case. Change the rule for which attributes to save
+	to "attributes that don't have the ReadOnly, DontEnum, or Function bit set".
+        Also fix bug where saving an empty property map would leave the count set to the old value.
+
+2002-11-26  Richard Williamson   <rjw@apple.com>
+
+        Remove debugging code.  Could be cause of performance regresssion.
+        * kjs/nodes.cpp:
+        (FunctionCallNode::evaluate):
+
+        Restire attributes correctly.
+        * kjs/property_map.cpp:
+
+2002-11-25  Richard Williamson   <rjw@apple.com>
+
+        Use delete[] (not delete) operator to delete array.
+        
+        * kjs/property_map.cpp:
+
+2002-11-25  Richard Williamson   <rjw@apple.com>
+
+        Added debugging info.  Fixed property map save function.
+        
+        * kjs/nodes.cpp:
+        (FunctionCallNode::evaluate):
+        * kjs/property_map.cpp:
+
+2002-11-25  Richard Williamson   <rjw@apple.com>
+
+        Changes for back/forward.  Currently disabled.
+
+        * kjs/property_map.cpp:
+        * kjs/property_map.h:
+
+2002-11-25  Darin Adler  <darin@apple.com>
+
+        * kjs/property_map.cpp: Rearrange code a little bit and tweak indentation.
+	This might provide a tiny speedup because we don't look at the single entry
+	any more in cases where the _table pointer is non-0.
+
+2002-11-24  Darin Adler  <darin@apple.com>
+
+	- changed ScopeChain to not ref each item in the chain, and use
+        marking instead; gains 1% on JavaScript iBench
+
+        * kjs/context.h: Return chain by reference.
+        * kjs/internal.cpp: (ContextImp::mark): Mark the scope chain.
+        * kjs/interpreter.cpp: (Context::scopeChain): Return chain by reference.
+        * kjs/interpreter.h: Make some Context methods inline.
+        * kjs/nodes.cpp:
+        (ThisNode::evaluate): Get at ContextImp directly.
+        (ResolveNode::evaluateReference): Ditto.
+        (VarDeclNode::evaluate): Ditto.
+        (VarDeclNode::processVarDecls): Ditto.
+        (FuncDeclNode::processFuncDecl): Pass ScopeChain directly to avoid copying.
+        (FuncExprNode::evaluate): Ditto.
+        * kjs/object.cpp: Make scope and setScope inline.
+        * kjs/object.h: Make scope return a chain by reference. Make scope and
+	setScope both be inline. Use a normal ScopeChain instead of NoRefScopeChain
+	since they are now one and the same.
+        * kjs/scope_chain.cpp: Remove all the code to ref and deref objects.
+	Merge NoRefScopeChain in with ScopeChain since they both work this way now.
+        * kjs/scope_chain.h: Remove NoRefScopeChain and simplify the ref counts.
+	Make more functions inline.
+
+2002-11-24  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3098356 - Hard hang on movie search at www.movietickets.com
+	
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): When doing a regexp replacement that
+	results in an empty match, always move on to the next character
+	after doing the replacement. The previous code would hit an
+	infinite loop if an initial empty match was replaced with the
+	empty string.
+
+2002-11-24  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3095446 - Crash on AppleScript page due to very long argument list
+	
+        * kjs/grammar.y: Don't try to construct the argument list in the
+	right order, since that blows out the parser stack.
+	* kjs/nodes.cpp:
+        (ArgumentsNode::ArgumentsNode): Instead reverse the argument list
+	here.
+        * kjs/nodes.h: Make ArgumentsNode a friend of ArgumentListNode.
+        * kjs/grammar.cpp: Updated from grammar.y.
+
+2002-11-23  Maciej Stachowiak  <mjs@apple.com>
+
+	- completed Darin's mostly-fix for 3037795 - Resource use
+	increases when accessing very high index value in array
+
+	The two missing pieces were handling sparse properties when
+	shrinking the array, and when sorting. Thse are now both taken
+	care of.
+	
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::put):
+        (ArrayInstanceImp::deleteProperty):
+        (ArrayInstanceImp::resizeStorage):
+        (ArrayInstanceImp::setLength):
+        (ArrayInstanceImp::sort):
+        (ArrayInstanceImp::pushUndefinedObjectsToEnd):
+        * kjs/identifier.h:
+        * kjs/object.h:
+        * kjs/property_map.cpp:
+        * kjs/property_map.h:
+        * kjs/reference_list.cpp:
+        (ReferenceList::append):
+        (ReferenceList::length):
+        * kjs/reference_list.h:
+        * kjs/ustring.cpp:
+        (UString::toUInt32):
+        * kjs/ustring.h:
+
+2002-11-23  Maciej Stachowiak  <mjs@apple.com>
+
+	Numerous collector changes for a net gain of 3% on JS ibench:
+
+	- Replaced per-block bitmap with free list.
+	- Increased number of empty blocks kept around to 2.
+	- Doubled block size.
+	- When scanning heap in collector, skip scanning the rest of a
+	block as soon as we see as many live cells as the the number of
+	used cells it had originally.
+
+	Also the following collector changes unrelated to performance:
+
+	- Made constants `const int' instead of `static const int'.
+	- Miscellaneous code cleanup.
+		
+        * kjs/collector.cpp:
+
+	- Added debugging mode enabled by defining DEBUG_GC which asserts
+	when a destroyed ValueImp
+
+        * kjs/internal.cpp:
+        (ContextImp::mark):
+        * kjs/value.cpp:
+        (Value::Value):
+        * kjs/value.h:
+	* kjs/config.h:
+	
+2002-11-22  Darin Adler  <darin@apple.com>
+
+	- replaced List class with a vector rather than a linked list, changed it
+	to use a pool of instances instead of all the nodes allocated off of the
+	heap; gives 10% gain on iBench
+
+        * kjs/list.h: Complete rewrite.
+        * kjs/list.cpp: Ditto.
+
+        * kjs/array_object.cpp: (compareWithCompareFunctionForQSort): Go back to
+	doing a clear and two appends here. Fast with the new list implementation.
+
+        * kjs/collector.h: Remove _COLLECTOR hack and just make rootObjectClasses
+	return a const void *.
+        * kjs/collector.cpp: Remove _COLLECTOR hack, and various other minor tweaks.
+
+2002-11-22  Darin Adler  <darin@apple.com>
+
+	- prepare to reimplement KJS::List; move to its own file, add statistics
+
+        * kjs/function_object.cpp: (FunctionProtoFuncImp::call): Use new copyTail()
+	function rather than copy() and removeFirst().
+
+        * kjs/identifier.cpp: Add statistics, off by default.
+        * kjs/property_map.cpp: Add statistics, off by default.
+
+        * kjs/list.cpp: Added. Moved code here. To be rewritten.
+        * kjs/list.h: Added. Moved interface here. To be rewritten.
+
+        * kjs/types.cpp: Removed.
+        * kjs/types.h: Now just an empty header that includes other headers.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Add new files, rearrange.
+
+2002-11-22  Maciej Stachowiak  <mjs@apple.com>
+
+	- reduce cell size to 56 bytes from 64, now that nearly all
+	objects fit in that size. .5% speed gain and probably some
+	footprint gain.
+	
+        * kjs/collector.cpp: Change CELL_SIZE from 64 to 56.
+
+2002-11-22  Darin Adler  <darin@apple.com>
+
+	- change ScopeChain to be a singly linked list shares tails, gives 11% gain on iBench
+
+        * kjs/context.h:
+        (ContextImp::pushScope): Make inline, use push instead of prepend, and pass imp pointer.
+        (ContextImp::popScope): Make inline, use pop instead of removeFirst.
+        * kjs/function.cpp: (DeclaredFunctionImp::DeclaredFunctionImp): No need to copy.
+        * kjs/function_object.cpp: (FunctionObjectImp::construct): Use push instead of
+	prepend, and pass imp pointer.
+        * kjs/internal.cpp: (ContextImp::ContextImp): Use clear, push instead of prepend,
+	and pass imp pointers.
+        * kjs/nodes.cpp: (ResolveNode::evaluateReference): Use isEmpty, pop, and top instead
+	of ScopeChainIterator.
+        * kjs/object.h: Change _scope to be a NoRefScopeChain.
+        * kjs/object.cpp: No need to initialize _scope any more, since it's not a NoRefScopeChain.
+
+        * kjs/scope_chain.h: Rewrite, different implementation and interface.
+        * kjs/scope_chain.cpp: More of the same.
+
+2002-11-22  Maciej Stachowiak  <mjs@apple.com>
+
+	- a simple change for .4% gain on ibench - instead of unmarking
+	all objects at the start of collection, instead unmark as part of
+	the sweep phase
+	
+        * kjs/collector.cpp:
+        (Collector::collect): Remove separate unmarking pass and instead
+	unmark the objects that don't get collected during the sweep
+	phase.
+
+2002-11-21  Darin Adler  <darin@apple.com>
+
+	- stop garbage collecting the ActivationImp objects, gets 3% on iBench
+	- pave the way to separate the argument lists from scope chains
+
+        * kjs/context.h: Added. Moved ContextImp here so it can use things defined
+	in function.h
+
+        * kjs/scope_chain.h: Added. Starting as a copy of List, to be improved.
+        * kjs/scope_chain.cpp: Added. Starting as a copy of List, to be improved.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Rearranged things, added context.h.
+
+        * kjs/function.cpp:
+        (FunctionImp::call): Pass InterpreterImp, not ExecState, to ContextImp.
+        (DeclaredFunctionImp::DeclaredFunctionImp): List -> ScopeChain.
+        (ActivationImp::createArgumentsObject): ArgumentList -> List.
+        (GlobalFuncImp::call): Pass InterpreterImp, not an ExecState, to ContextImp.
+        * kjs/function.h: List -> ScopeChain.
+        * kjs/function_object.cpp: (FunctionObjectImp::construct): List -> ScopeChain.
+        * kjs/internal.cpp:
+        (ContextImp::ContextImp): Set the context in the interpreter.
+        (ContextImp::~ContextImp): Set the context in the interpreter to the caller.
+        (ContextImp::mark): Mark all the activation objects.
+        (InterpreterImp::InterpreterImp): Initialize context to 0.
+        (InterpreterImp::mark): Mark the top context.
+        (InterpreterImp::evaluate): Pass InterpreterImp to ContextImp.
+        * kjs/internal.h: Move ContextImp to its own header. Add setContext to InterpreterImp.
+        * kjs/interpreter.cpp: (Context::scopeChain): List -> ScopeChain.
+        * kjs/interpreter.h: List -> ScopeChain.
+        * kjs/nodes.cpp:
+        (ResolveNode::evaluateReference): List -> ScopeChain.
+        (FuncDeclNode::processFuncDecl): List -> ScopeChain.
+        (FuncExprNode::evaluate): List -> ScopeChain.
+        * kjs/object.cpp: List -> ScopeChain.
+        * kjs/object.h: List -> ScopeChain.
+
+        * kjs/types.h: Remove needsMarking features from List.
+        * kjs/types.cpp: Ditto.
+
+2002-11-21  Maciej Stachowiak  <mjs@apple.com>
+
+	- reduced the size of PropertyMap by storing sizes and such in the
+	dynamically allocated part of the object to reduce the size of
+	ObjectImp - .5% speed improvement on JS iBench.
+	
+        * kjs/property_map.cpp:
+        * kjs/property_map.h:
+
+2002-11-21  Maciej Stachowiak  <mjs@apple.com>
+
+        * Makefile.am: Pass symroots for this tree to pbxbuild.
+
+=== Alexander-33 ===
+
+2002-11-21  Darin Adler  <darin@apple.com>
+
+        * kjs/property_map.cpp: More assertions.
+
+2002-11-21  Darin Adler  <darin@apple.com>
+
+        * kjs/property_map.cpp: Turn that consistency check back off.
+
+2002-11-21  Darin Adler  <darin@apple.com>
+
+	- someone somewhere must be defining a macro named check, causing a compile failure in WebCore
+
+	Rename check() to checkConsistency().
+
+        * kjs/property_map.h: Rename.
+        * kjs/property_map.cpp: Yes, rename.
+
+2002-11-21  Darin Adler  <darin@apple.com>
+
+	- add self-check to property map in hopes of finding the cnet.com bug
+
+        * kjs/property_map.h: Add check() function.
+        * kjs/property_map.cpp: Add the checking, controlled by DO_CONSISTENCY_CHECK.
+
+	 - fixed UChar interface so it's not so slow in debug builds
+
+        * kjs/ustring.h: Nothing in UChar needs to be private.
+
+        * kjs/function.cpp: (GlobalFuncImp::call):
+        * kjs/function_object.cpp: (FunctionObjectImp::construct):
+        * kjs/identifier.cpp:
+        * kjs/lexer.cpp: (Lexer::setCode), (Lexer::shift):
+        * kjs/lookup.cpp: (keysMatch):
+        * kjs/ustring.cpp: (UString::Rep::computeHash), (KJS::compare):
+	Use the "uc" field instead of the "unicode()" inline function.
+
+2002-11-21  Darin Adler  <darin@apple.com>
+
+	- fixed a null-dereference I ran into while trying to reproduce bug 3107351
+
+        * kjs/function.h: Change ActivationImp constructor to take context parameter.
+        * kjs/function.cpp: (ActivationImp::ActivationImp): Take context parameter,
+	not execution state parameter.
+
+        * kjs/internal.cpp: (ContextImp::ContextImp): Initialize activation object
+	from context, not execution state, because the new context is not yet in the
+	execution state.
+
+2002-11-20  Darin Adler  <darin@apple.com>
+
+	- added a feature for Richard to use in his back/forward cache
+
+        * kjs/object.h: Added save/restoreProperties.
+        * kjs/property_map.h: Here too.
+        * kjs/property_map.cpp: Here too.
+
+2002-11-20  Darin Adler  <darin@apple.com>
+
+	- created argument list objects only on demand for a 7.5% speedup
+
+        * kjs/function.h: Change ActivationImp around.
+        * kjs/function.cpp:
+        (FunctionImp::call): Pass a pointer to the arguments list to avoid ref/unref.
+        (FunctionImp::get): Get the function pointer from the context directly,
+	not the activation object.
+        (ArgumentsImp::ArgumentsImp): Add an overload that takes no arguments.
+        (ActivationImp::ActivationImp): Store a context pointer and an arguments object pointer.
+        (ActivationImp::get): Special case for arguments, create it and return it.
+        (ActivationImp::put): Special case for arguments, can't be set.
+        (ActivationImp::hasProperty): Special case for arguments, return true.
+        (ActivationImp::deleteProperty): Special case for arguments, refuse to delete.
+        (ActivationImp::mark): Mark the arguments object.
+        (ActivationImp::createArgumentsObject): Do the work of actually creating it.
+        (GlobalFuncImp::call): Use stack-based objects for the ContextImp and ExecState.
+
+        * kjs/internal.h: Keep function and arguments pointer in the context.
+        * kjs/internal.cpp:
+        (ContextImp::ContextImp): Don't pass in the func and args when making an ActivationImp.
+        (InterpreterImp::evaluate): Use stack-based objects here.
+
+        * kjs/types.h: Add ArgumentList as a synonym for List, soon to be separate.
+
+2002-11-20  Maciej Stachowiak  <mjs@apple.com>
+
+	Reduced the size of ValueImp by 8 bytes for a .5% speedup.
+	
+        * kjs/value.h: Removed destructed flag. Made refcount and flag 16
+	bits each.
+        * kjs/value.cpp:
+        (ValueImp::~ValueImp): Don't set destructed flag.
+
+2002-11-20  Darin Adler  <darin@apple.com>
+
+        * kjs/types.cpp: Keep ref count for the whole lists of nodes.
+	Doesn't speed things up much, less than 1%.
+
+2002-11-20  Maciej Stachowiak  <mjs@apple.com>
+
+        * kjs/collector.cpp:
+        (Collector::allocate): Clear the flags on newly allocated objects.
+
+2002-11-20  Darin Adler  <darin@apple.com>
+
+	- oops, checked in big regression instead of 5% speedup
+
+        * kjs/function.cpp: (ActivationImp::ActivationImp): Make a marking
+	list, not a refing list.
+
+	- a cut at the sparse array implementation
+
+        * kjs/array_instance.h: Keep storageLength separate from length.
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::ArrayInstanceImp): Start with storageLength == length.
+        (ArrayInstanceImp::get): Check against storage length.
+        (ArrayInstanceImp::put): Ditto.
+        (ArrayInstanceImp::hasProperty): Ditto.
+        (ArrayInstanceImp::deleteProperty): Ditto.
+        (ArrayInstanceImp::setLength): Only enlarge storage length up to a cutoff.
+        (ArrayInstanceImp::mark): Use storageLength.
+        (ArrayInstanceImp::pushUndefinedObjectsToEnd): Added FIXME.
+
+2002-11-20  Darin Adler  <darin@apple.com>
+
+	- decrease ref/deref -- 5% speedup in iBench
+
+        * JavaScriptCore.pbproj/project.pbxproj: Added array_instance.h
+        * kjs/array_instance.h: Added so it can be shared by function.h.
+
+        * kjs/array_object.cpp:
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        * kjs/bool_object.h:
+        * kjs/collector.cpp:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        * kjs/error_object.cpp:
+        * kjs/function.cpp:
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/math_object.cpp:
+        * kjs/nodes.cpp:
+        * kjs/number_object.cpp:
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        * kjs/property_map.cpp:
+        * kjs/reference.cpp:
+        * kjs/reference.h:
+        * kjs/regexp_object.cpp:
+        * kjs/string_object.cpp:
+        * kjs/string_object.h:
+        * kjs/value.cpp:
+        * kjs/value.h:
+	Switched lots of interfaces so they don't require ref/deref.
+
+2002-11-20  Maciej Stachowiak  <mjs@apple.com>
+
+	Fixed the two most obvious problems with the new GC for another 6%
+	improvement.
+	
+        * kjs/collector.cpp:
+        (Collector::allocate): Don't bother doing the bit tests on a bitmap word if
+	all it's bits are on.
+        (Collector::collect): Track memoryFull boolean.
+        * kjs/collector.h: Inlined outOfMemory since it was showing up on profiles.
+
+2002-11-20  Maciej Stachowiak  <mjs@apple.com>
+
+	Rewrote garbage collector to make blocks of actual memory instead
+	of blocks of pointers. 7% improvement on JavaScript
+	iBench. There's still lots of room to tune the new GC, this is
+	just my first cut.
+	
+        * kjs/collector.cpp:
+        (Collector::allocate):
+        (Collector::collect):
+        (Collector::size):
+        (Collector::outOfMemory):
+        (Collector::finalCheck):
+        (Collector::numGCNotAllowedObjects):
+        (Collector::numReferencedObjects):
+        (Collector::liveObjectClasses):
+        * kjs/collector.h:
+        * kjs/function.cpp:
+        (ActivationImp::ActivationImp):
+        * kjs/function.h:
+
+2002-11-20  Darin Adler  <darin@apple.com>
+
+	- on the road to killing ActivationImp
+
+        * kjs/function.h: Add get/put to FunctionImp. Remove argumentsObject() from
+	ActivationImp. Add function() to ActivationImp.
+        * kjs/function.cpp:
+        (FunctionImp::FunctionImp): No arguments property.
+        (FunctionImp::call): No need to set up the arguments property.
+        (FunctionImp::parameterString): Remove ** strangeness.
+        (FunctionImp::processParameters): Ditto.
+        (FunctionImp::get): Added, handles arguments and length properties.
+        (FunctionImp::put): Ditto.
+        (FunctionImp::hasProperty): Ditto.
+        (FunctionImp::deleteProperty): Ditto.
+        (ActivationImp::ActivationImp): Store a function pointer so we can find it
+	in the context.
+
+        * kjs/function_object.cpp: (FunctionObjectImp::construct): No need to set up
+	arguments property.
+        * kjs/nodes.cpp: (FuncExprNode::evaluate): No need to set up length property.
+
+        * kjs/internal.h: Return ObjectImp * for activation object.
+
+        * kjs/interpreter.h: Remove stray declaration of ExecStateImp.
+
+2002-11-20  Darin Adler  <darin@apple.com>
+
+	- add a couple of list operations to avoid clearing lists so much during sorting; gives 1.5% iBench
+
+        * kjs/types.h: Added replaceFirst/replaceLast.
+        * kjs/types.cpp: (List::replaceFirst), (List::replaceLast): Added.
+
+        * kjs/array_object.cpp: (compareWithCompareFunctionForQSort): Use replaceFirst/replaceLast.
+
+        * kjs/property_map.cpp: Put in an ifdef so I can re-add/remove the single entry to see if
+	it has outlived its usefulness. (It hasn't yet.)
+
+2002-11-20  Darin Adler  <darin@apple.com>
+
+	- atomic identifiers; gives another 6.5% in the iBench suite
+
+        * kjs/identifier.h: Did the real thing.
+        * kjs/identifier.cpp: Ditto.
+
+        * kjs/property_map.h: _tableSizeHashMask -> _tableSizeMask
+        * kjs/property_map.cpp: The above, plus take advantage of comparing
+	by pointer instead of by comparing bytes.
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- a few more globals for often-used property names
+	- conversion to Identifier from UString must now be explicit
+
+        * kjs/error_object.cpp:
+        * kjs/function.cpp:
+        * kjs/function_object.cpp:
+        * kjs/identifier.cpp:
+        * kjs/identifier.h:
+        * kjs/lexer.cpp:
+        * kjs/nodes.cpp:
+        * kjs/number_object.cpp:
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/string_object.cpp:
+        * kjs/testkjs.cpp:
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- another step towards atomic identifiers; storing hash in the string rep. gives about
+	a 1.5% speedup in the JavaScript iBench
+
+        * kjs/ustring.h: Add a hash field to UString::Rep.
+        * kjs/ustring.cpp:
+        (UString::Rep::create): Set hash to uninitialized value.
+        (UString::Rep::destroy): Do the deleting in her, and call Identifier if needed.
+        (UString::Rep::computeHash): Added.
+        (UString::append): Set hash to 0 when modifying the string in place.
+        (UString::operator=): Ditto.
+
+        * kjs/property_map.cpp: Use the hash from UString.
+
+        * kjs/identifier.h: Added aboutToDestroyUStringRep.
+        * kjs/identifier.cpp: (Identifier::aboutToDestroyUStringRep): Added.
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- next step towards atomic identifiers; Identifier is no longer derived from UString
+
+        * kjs/identifier.h: Remove base class and add _ustring member.
+        * kjs/identifier.cpp: Add null and an == that works with const char *.
+        * kjs/property_map.cpp: Get rep through _ustring.
+
+        * kjs/function.cpp: (FunctionImp::parameterString): Call ustring().
+        * kjs/function_object.cpp: (FunctionProtoFuncImp::call): Ditto.
+        * kjs/nodes.cpp:
+        (PropertyNode::evaluate): Ditto.
+        (VarDeclNode::evaluate): Ditto.
+        (ForInNode::execute): Ditto.
+        * kjs/nodes2string.cpp: (SourceStream::operator<<): Add overload for Identifier.
+        * kjs/reference.cpp: (Reference::getValue): Call ustring().
+        * kjs/regexp_object.cpp: (RegExpObjectImp::get): Call ustring().
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- fixed memory trasher
+
+        * kjs/ustring.cpp: (UString::from): Fix "end of buffer" computation.
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- a first step towards atomic identifiers in JavaScript
+
+	Most places that work with identifiers now use Identifier
+	instead of UString.
+
+        * kjs/identifier.cpp: Added.
+        * kjs/identifier.h: Added.
+        * JavaScriptCore.pbproj/project.pbxproj: Added files.
+
+        * kjs/array_object.cpp:
+        * kjs/array_object.h:
+        * kjs/completion.cpp:
+        * kjs/completion.h:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        * kjs/function.cpp:
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        * kjs/grammar.cpp:
+        * kjs/grammar.cpp.h:
+        * kjs/grammar.h:
+        * kjs/grammar.y:
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/lexer.cpp:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/math_object.cpp:
+        * kjs/math_object.h:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/number_object.cpp:
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/property_map.cpp:
+        * kjs/property_map.h:
+        * kjs/reference.cpp:
+        * kjs/reference.h:
+        * kjs/regexp_object.cpp:
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        * kjs/string_object.h:
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- fix hash function and key comparison for the other kind of hash table; yields 3%
+
+        * kjs/lookup.cpp:
+        (keysMatch): Added.
+        (Lookup::findEntry): Don't allocate and convert to ASCII just to search.
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- another hash table fix; yields a 2% improvement on iBench JavaScript
+
+        * kjs/property_map.cpp: A few more places where we use & instead of %.
+
+	- some List changes that don't affect speed yet
+
+        * kjs/types.cpp:
+        (List::prependList): Tighten up a tiny bit.
+        (List::copy): Use prependList.
+        * kjs/types.h: Remove appendList and globalClear.
+
+        * kjs/interpreter.cpp: (Interpreter::finalCheck): Remove List::globalClear().
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- fixed 3105026 -- REGRESSION: DHTML menus are broken all over the place
+
+        * kjs/types.cpp: (List::prepend): Fix backwards links in new node.
+
+2002-11-19  Darin Adler  <darin@apple.com>
+
+	- a fix that gives another 1.5% on the iBench JavaScript test
+
+        * kjs/ustring.cpp: (UString::from): Stop using sprintf to format integers.
+
+2002-11-18  Darin Adler  <darin@apple.com>
+
+	- reduced the creation of Value objects and hoisted the property map
+        into Object for another gain of about 6%
+
+        * JavaScriptCore.pbproj/project.pbxproj: Made property_map.h public.
+        * kjs/array_object.cpp:
+        (compareWithCompareFunctionForQSort): Don't wrap the ValueImp * in a Value
+	just to add it to a list.
+        (ArrayProtoFuncImp::call): Pass the globalObject directly so we don't have
+	to ref/deref.
+        * kjs/function.cpp:
+        (FunctionImp::call): Use a reference for the global object to avoid ref/deref.
+        (GlobalFuncImp::call): Ditto.
+        * kjs/internal.cpp:
+        (BooleanImp::toObject): Put the object directly into the list, don't create a Value.
+        (StringImp::toObject): Ditto.
+        (NumberImp::toObject): Ditto.
+        (InterpreterImp::evaluate): Use a reference for the global object.
+        * kjs/internal.h: Return a reference for the global object.
+        * kjs/interpreter.cpp: (Interpreter::globalObject): Ditto.
+        * kjs/interpreter.h: Ditto.
+        * kjs/object.cpp: Use _prop directly in the object, not a separate pointer.
+        * kjs/object.h: Ditto.
+        * kjs/types.cpp: Added List methods that work directly with ValueImp.
+        (List::append): Added a ValueImp version.
+        (List::prepend): Ditto.
+        (List::appendList): Work directly with the ValueImp's.
+        (List::prependList): Ditto.
+        (List::copy): Use appendList.
+        (List::empty): Use a shared global List.
+        * kjs/types.h: Update for above changes.
+
+2002-11-18  Darin Adler  <darin@apple.com>
+
+        * kjs/property_map.cpp: Oops, copyright goes to Apple, not me.
+        * kjs/property_map.h: Ditto.
+
+2002-11-18  Darin Adler  <darin@apple.com>
+
+	- property and string improvements giving a 7% or so improvement in JavaScript iBench
+
+        * kjs/property_map.h: Rewrite to use a hash table.
+        * kjs/property_map.cpp: Ditto.
+
+        * kjs/string_object.h:
+        * kjs/string_object.cpp:
+        (StringInstanceImp::StringInstanceImp): Construct a string with the right value
+	instead of putting the string in later.
+        (StringInstanceImp::get): Get the length from the string, not a separate property.
+        (StringInstanceImp::put): Ignore attempts to set length, since we don't put it in
+	the property map.
+        (StringInstanceImp::hasProperty): Return true for length.
+        (StringInstanceImp::deleteProperty): Return false for length.
+        (StringObjectImp::construct): Call new StringInstanceImp constructor. Don't try
+	to set a length property.
+
+        * kjs/ustring.h: Make the rep deref know how to deallocate the rep.
+        * kjs/ustring.cpp:
+        (UString::release): Move the real work to the rep's deref, since the hash table
+	now uses the rep directly.
+
+        * kjs/object.h: Remove unused field.
+
+2002-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+	Change List to completely avoid going through the GC
+	allocator. 3.6% performance improvement on JavaScript iBench.
+	
+        * kjs/internal.cpp:
+        (InterpreterImp::mark): Don't mark the empty list.
+
+	For all the methods below I basically lifted the ListImp version
+	up to the List method with minor tweaks.
+	
+        * kjs/types.cpp:
+        (ListIterator::ListIterator):
+        (List::List):
+        (List::operator=):
+        (List::~List):
+        (List::mark):
+        (List::append):
+        (List::prepend):
+        (List::appendList):
+        (List::prependList):
+        (List::removeFirst):
+        (List::removeLast):
+        (List::remove):
+        (List::clear):
+        (List::clearInternal):
+        (List::copy):
+        (List::begin):
+        (List::end):
+        (List::isEmpty):
+        (List::size):
+        (List::at):
+        (List::operator[]):
+        (List::empty):
+        (List::erase):
+        (List::refAll):
+        (List::derefAll):
+        (List::swap):
+        (List::globalClear):
+        * kjs/types.h:
+
+2002-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+	Fixed a horrible leak introduced with my last change that
+	somehow did not show up on my machine.
+
+        * kjs/types.cpp:
+        (List::List): Mark ListImp as GC allowed.
+
+2002-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+	Another step towards the List conversion: stop inheriting from Value.
+	
+        * kjs/types.cpp:
+        (ListIterator::ListIterator):
+        (List::List):
+        (List::operator=):
+        (List::~List):
+        (List::mark):
+        (List::append):
+        (List::prepend):
+        (List::appendList):
+        (List::prependList):
+        (List::removeFirst):
+        (List::removeLast):
+        (List::remove):
+        (List::clear):
+        (List::copy):
+        (List::begin):
+        (List::end):
+        (List::isEmpty):
+        (List::size):
+        (List::at):
+        (List::operator[]):
+        * kjs/types.h:
+
+2002-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+	Partway to removing Value from List. Created a marking List
+	variant, used it in place of ListImp.
+	
+        * kjs/internal.h: Removed List stuff.
+        * kjs/internal.cpp:
+        (InterpreterImp::mark): Call appropriate List method to do marking of
+	empty ListImp.
+        * kjs/object.h:
+        * kjs/object.cpp: Use marking List instead of ListImp *.
+        * kjs/types.h:
+        * kjs/types.cpp:
+        (List::List): New boolean needsMarking parameter. 
+        (List::operator=): Perform trickery related to needsMarking.
+        (List::~List): Likewise.
+        (List::mark): Mark the ListImp.
+        (List::markEmptyList):
+	(ListImp::*): Moved here fron internal.cpp, they will be
+	integrated into the relevant List methods soon.
+
+2002-11-18  Darin Adler  <darin@apple.com>
+
+	- another string constant discovered that can be optimized
+
+        * kjs/object.h: Add a property name constant for "__proto__".
+        * kjs/object.cpp: Define it.
+	(ObjectImp::get): Use it.
+	(ObjectImp::hasProperty): Use it.
+
+	- prepare to turn PropertyMap into a hash table
+
+        * kjs/object.cpp:
+	(ObjectImp::mark): Use the new PropertyMap::mark().
+	(ObjectImp::put): Use the new overload of PropertyMap::get().
+	(ObjectImp::deleteProperty): Use the new overload of PropertyMap::get().
+	(ObjectImp::propList): Use PropertyMap::addEnumerablesToReferenceList().
+
+        * kjs/property_map.h: Remove PropertyMapNode and make all node-related methods private.
+	Add mark(), a new overload of get() that returns attributes, a clear() that takes no attributes,
+	and addEnumerablesToReferenceList().
+        * kjs/property_map.cpp:
+	(PropertyMap::get): Added new overload.
+	(PropertyMap::clear): Added new overload.
+	(PropertyMap::mark): Added.
+	(PropertyMap::addEnumerablesToReferenceList): Added.
+
+        * kjs/ustring.h: Added a hash function.
+        * kjs/ustring.cpp: (KJS::hash): Added.
+
+2002-11-18  Darin Adler  <darin@apple.com>
+
+	- simplified the ExecState class, which was showing up in profiles
+        
+        Sped up JavaScript iBench by 6%.
+
+        * kjs/interpreter.h: Removed the level of indirection, and made it all inline.
+        * kjs/interpreter.cpp: Removed ExecState implementation from here altogether.
+
+	- fixed an oversight in my sort speedup
+
+        * kjs/array_object.h: Add pushUndefinedObjectsToEnd.
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::sort): Call pushUndefinedObjectsToEnd.
+        (ArrayInstanceImp::pushUndefinedObjectsToEnd): Added.
+	Pushes all undefined to the end of the array.
+
+2002-11-18  Darin Adler  <darin@apple.com>
+
+	- fix worst speed problems on the sort page of the iBench JavaScript test
+
+	Sped up JavaScript iBench by 70%, the sort page by 88%.
+
+        * kjs/array_object.h: Add array-specific sort functions.
+        * kjs/array_object.cpp:
+        (compareByStringForQSort): Added.
+        (ArrayInstanceImp::sort): Added.
+        (compareWithCompareFunctionForQSort): Added.
+        (ArrayProtoFuncImp::call): Use ArrayInstanceImp::sort if the object being
+	sorted is actually an array.
+
+        * kjs/object.h: Add argumentsPropertyName.
+        * kjs/object.cpp: Add argumentsPropertyName.
+        * kjs/function.cpp:
+        (FunctionImp::FunctionImp): Use argumentsPropertyName to avoid making a UString.
+        (FunctionImp::call): Ditto.
+        (ActivationImp::ActivationImp): Ditto.
+        * kjs/function_object.cpp: (FunctionObjectImp::construct): Ditto.
+
+        * kjs/ustring.h: Added compare function for -1/0/+1 comparison.
+        * kjs/ustring.cpp: (KJS::compare): Added.
+
+2002-11-18  Maciej Stachowiak  <mjs@apple.com>
+
+	Change ArgumentListNode operations to be iterative instead of
+	recursive. This probably fixes 3095446 (Crash in
+	KJS::ArgumentListNode::ref()) but I can't reproduce it myself so
+	I'm not 100% sure. I think the original bug was a stack overflow
+	and this change would remove that possibility.
+	
+        * kjs/nodes.cpp:
+        (ArgumentListNode::ref): Make iterative.
+        (ArgumentListNode::deref): Make iterative.
+        (ArgumentListNode::evaluateList): Make iterative.
+
+=== Alexander-32 ===
+
+2002-11-14  Darin Adler  <darin@apple.com>
+
+	- fixed 3101243 -- excite passes date that can't be parsed, results in bogus date at top right corner
+
+        * kjs/date_object.cpp: (KJS::KRFCDate_parseDate): Handle errors from strtol
+	by checking errno. Check the "string in a haystack" to be sure it's a multiple
+	of 3. Add case that allows year to be after time.
+
+2002-11-14  Darin Adler  <darin@apple.com>
+
+	- fixed 3101191 -- REGRESSION: Hang loading excite.com
+
+        * kjs/date_object.cpp:
+        (mktimeUsingCF): Pick an arbitrary cutoff of 3000, and return -1 if the
+	year passed in is that big so we don't infinite loop. Also validate the
+	rest of the date with CFGregorianDateIsValid. 
+        (DateProtoFuncImp::call): Handle a -1 result from mktime.
+        (DateObjectImp::construct): Check for NaN before calling mktime, and also
+	handle a -1 result from mktime.
+        (DateObjectFuncImp::call): Check for NaN before calling mktime, and also
+	handle a -1 result from mktime.
+
+2002-11-13  Darin Adler  <darin@apple.com>
+
+	- fixed 3099930 -- dates/times without time zones are parsed as UTC by kjs,
+	local time by other browsers
+
+        * kjs/date_object.cpp:
+        (DateProtoFuncImp::call): Handle the NaN case better, like Mozilla and OmniWeb.
+        (DateObjectFuncImp::call): Return NaN rather than Undefined() for bad dates.
+        (KJS::parseDate): Return NaN rather than Undefined() or 0 for bad dates.
+        (KJS::KRFCDate_parseDate): Return -1 rather than 0 for bad dates.
+	Assume local time if no time zone is passed. Don't return 1 if we parse 0.
+
+2002-11-13  Darin Adler  <darin@apple.com>
+
+        - fixed 3073230 -- JavaScript time calls do I/O by lstat()ing /etc/localtime
+
+        * kjs/date_object.cpp:
+        (formatDate): Added.
+        (formatTime): Added.
+        (formatLocaleDate): Added.
+        (formatLocaleTime): Added.
+        (DateProtoFuncImp::call): Changed to use the above functions instead of
+	using strftime.
+
+2002-11-08  Darin Adler  <darin@apple.com>
+
+        * kjs/date_object.cpp:
+        (ctimeUsingCF): Added.
+        (timeUsingCF): Added.
+
+2002-11-07  Darin Adler  <darin@apple.com>
+
+        * kjs/date_object.cpp: (mktimeUsingCF): Fix storage leak.
+
+2002-11-07  Maciej Stachowiak  <mjs@apple.com>
+
+	- partial fix to 3073230 - JavaScript time calls do I/O by
+	lastat()ing /etc/localtime
+	
+        * kjs/date_object.cpp:
+        (mktimeUsingCF): Implementation of mktime using CF.
+
+=== Alexander-31 ===
+
+2002-11-01  Darin Adler  <darin@apple.com>
+
+        * kjs/object.cpp: Make the same change Maciej just did, but to the
+	other constructor right next to the one he changed.
+
+2002-10-31  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3082660 - REGRESSION: one ListImp leaks opening/closing nearly empty web page
+	
+        * kjs/object.cpp: Set gc allowed on freshly created ListImp, since
+	there is no List wrapper for it.
+
+2002-10-31  Darin Adler  <darin@apple.com>
+
+        * kjs/grammar.y: Fix the APPLE_CHANGES thing here too.
+        * kjs/grammar.cpp: Regenerated this file.
+
+=== Alexander-30 ===
+
+2002-10-30  Darin Adler  <darin@apple.com>
+
+	- fixed 3073230 -- Alex is doing file I/O when executing JavaScript by asking for localtime
+
+	I fixed this by using Core Foundation time functions instead.
+
+        * kjs/date_object.cpp:
+        (tmUsingCF): Function that uses Core Foundation to get the time and then puts it into
+	a tm struct.
+        (gmtimeUsingCF): Function used instead of gmtime (used a macro to make the substitution).
+        (localtimeUsingCF): Function used instead of localtime (used a macro to make the substitution).
+
+2002-10-26  Darin Adler  <darin@apple.com>
+
+	- changed to use #if APPLE_CHANGES and #if !APPLE_CHANGES consistently
+
+	We no longer do #ifdef APPLE_CHANGES or #ifndef APPLE_CHANGES.
+
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/grammar.cpp:
+        * kjs/internal.cpp:
+        * kjs/ustring.h:
+
+2002-10-25  Darin Adler  <darin@apple.com>
+
+	- fixed 3038011 -- drop-down menu hierarchy broken at yahoo new acct page
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::call):
+	Fix bug calling concat on an empty array. The old code tried to
+	optimize in a way that would prevent appending any arrays until
+	at least one element was in the destination array. So if you were
+	concatenating a non-empty array into an empty array, you got an empty array.
+
+=== Alexander-29 ===
+
+=== Alexander-28 ===
+
+2002-10-10  Darin Adler  <darin@apple.com>
+
+	- fixed 3072643 -- infinite loop in JavaScript code at walgreens.com
+
+	The problem is that "xxx".indexOf("", 1) needs to return 1, but we
+	were returning 0.
+
+        * kjs/ustring.cpp:
+        (UString::find): Return pos, not 0, when the search string is empty.
+        (UString::rfind): Make sure that pos is not past the end of the string,
+	taking into account the search string; fixes a potential read off the end
+	of the buffer. Also return pos, not 0, when the search string is empty.
+
+=== Alexander-27 ===
+
+2002-10-07  Darin Adler  <darin@apple.com>
+
+	Fixed absurdly high memory usage when looking at pages that use a lot of JavaScript.
+
+        * kjs/collector.cpp:
+        (Collector::allocate): Implement a new policy of doing a garbage collect every 1000
+	allocations. The old policy was both complicated and misguided.
+        (Collector::collect): Zero out the "number of allocations since last collect".
+
+2002-10-06  Darin Adler  <darin@apple.com>
+
+	I noticed some broken lists at mapblast.com and tracked it down to this.
+
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::put): Don't truncate the list; only extend the length if
+	it's not already long enough.
+        (ArrayProtoFuncImp::call): Fix some ifdef'd code so it compiles if you turn
+	the ifdefs on.
+
+2002-10-04  Darin Adler  <darin@apple.com>
+
+        Fixed problems parsing numbers that are larger than a long with parseInt.
+
+        * kjs/config.h: Define HAVE_FUNC_STRTOLL.
+        * kjs/function.cpp: (GlobalFuncImp::call):
+	Change parseInt to use strtoll if available.
+
+=== Alexander-26 ===
+
+2002-09-27  Darin Adler  <darin@apple.com>
+
+	- fixed 3033969 -- repro crash (infinite recursion in JavaScript)
+	clicking on "screens" option at fsv.sf.net
+
+        * kjs/object.h: Change recursion limit to 100 levels rather than 1000.
+
+=== Alexander-25 ===
+
+2002-09-26  Darin Adler  <darin@apple.com>
+
+	Fix the infinity problem Dave worked around. We didn't have the
+	configuration flags set right to make infinity work. Setting those
+	properly made everything work without changes to min and max.
+
+        * kjs/config.h: Define HAVE_FUNC_ISINF, HAVE_STRING_H, and
+	also WORDS_BIGENDIAN (if on ppc).
+
+        * kjs/math_object.cpp: (MathFuncImp::call): Roll out min and max
+	changes from yesterday.
+
+2002-09-25  David Hyatt  <hyatt@apple.com>
+
+	Fix the impls of min/max to not use +inf/-inf when you have
+	arguments.  Technically there's still a bug here for the no
+	argument case, probably caused by a screwup when +inf/-inf are
+	converted to doubles.
+	
+        * kjs/math_object.cpp:
+        (MathFuncImp::call):
+
+2002-09-25  Darin Adler  <darin@apple.com>
+
+	- fixed 3057964 -- JS problem performing MD5 script embedded in yahoo login page
+
+        * kjs/simple_number.h: Fix incorrect check for sign bit that was munging numbers
+	in the range 0x10000000 to 0x1FFFFFFF.
+
+=== Alexander-24 ===
+
+=== Alexander-22 ===
+
+2002-09-05  Maciej Stachowiak  <mjs@apple.com>
+
+	First baby step towards moving List away from garbage collection.
+	
+        * kjs/types.h: Add needsMarking boolean and make List inherit from
+	Value privately instead of publicly.
+
+2002-08-30  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Allowed the new Project Builder to put in
+	encodings for each file.
+
+=== Alexander-21 ===
+
+=== Alexander-20 ===
+
+2002-08-20  Darin Adler  <darin@apple.com>
+
+	Three small changes to things that showed up in the sample.
+
+	5% speed increase on cvs-js-performance test.
+	
+        * kjs/simple_number.h: Check if double is an integer with d == (double)(int)d
+	instead of remainder(d, 1) == 0, saving a function call each time.
+
+        * kjs/ustring.cpp:
+        (UString::find): Compare the first character before calling memcmp for the rest.
+        (UString::rfind): Ditto.
+        (KJS::operator==): Don't do a strlen before starting to compare the characters.
+
+2002-08-20  Maciej Stachowiak  <mjs@apple.com>
+
+        * kjs/object.cpp: Don't reference other ValueImps in the
+	destructor, they may have already been destroyed, and will have
+	GC_ALLOWED set already in any case.
+
+2002-08-19  Maciej Stachowiak  <mjs@apple.com>
+
+	Fixed the bug that made sony.com menus come out wrong and made
+	aa.com crash (Radar 3027762).
+	
+	Mode most methods inline.
+	
+        * kjs/completion.cpp:
+        * kjs/completion.h:
+
+2002-08-19  Maciej Stachowiak  <mjs@apple.com>
+
+	Maintain stack of old "arguments" property values for functions
+	implicitly on the system stack instead of explicitly in the
+	FunctionImp. This eliminates only a trivial number of GC
+	allocations (less than 200) but eliminates one of the two cases
+	where a ListImp * is stored directly, paving the way to separate
+	List from Value.
+	
+        * kjs/function.h: Remove argStack, pushArgs and popArgs.
+        * kjs/function.cpp:
+        (FunctionImp::FunctionImp): Don't initalize argStack.
+        (FunctionImp::~FunctionImp): Remove comment about argStack.
+        (FunctionImp::mark): Don't mark the argStack.
+        (FunctionImp::call): Save old "arguments" property in a Value,
+	where it will be GC-protected, rather than keeping a list, and
+	restore the old value when done executing.
+
+2002-08-18  Darin Adler  <darin@apple.com>
+
+        * kjs/internal.cpp: (KJS::printInfo): Remove one more CompletionType
+	that Maciej missed.
+
+2002-08-18  Maciej Stachowiak  <mjs@apple.com>
+
+	Remove stray references to CompletionType and CompletionImp.
+	
+        * kjs/completion.h:
+        * kjs/object.cpp:
+        * kjs/value.h:
+
+2002-08-18  Maciej Stachowiak  <mjs@apple.com>
+
+	Separated Completion from Value and made it a pure stack
+	object. This removed another 160,000 of the remaining 580,000
+	garbage collected object allocations.
+
+	6% speed increase on cvs-js-performance test.
+	
+        * kjs/completion.cpp: Added. New implementation that doesn't
+	require a ValueImp *.
+        (Completion::Completion):
+        (Completion::complType):
+        (Completion::value):
+        (Completion::target):
+        (Completion::isValueCompletion):
+        * kjs/completion.h: Added.
+        * kjs/function.cpp:
+	(GlobalFuncImp::call): Removed some (apparently mistaken) uses of
+	Completion as a Value.
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/types.cpp: Removed Completion stuff.
+        * kjs/types.h: Removed Completion stuff.
+        * JavaScriptCore.pbproj/project.pbxproj: Added new header.
+
+2002-08-16  Darin Adler  <darin@apple.com>
+
+	Fix the Development build.
+
+        * kjs/object.cpp: Take out a use of ReferenceType.
+
+        * kjs/ustring.h: Added a bit more inlining.
+        * kjs/ustring.cpp: Moved the function out of here.
+
+2002-08-16  Maciej Stachowiak  <mjs@apple.com>
+
+	Final step of the Reference change. Completely separate Reference
+	from Value, and eliminate ReferenceImp.
+
+	18% speedup on cvs-js-performance test.
+
+        * kjs/internal.cpp, kjs/internal.h: Remove ReferenceImp.
+        * kjs/nodes.cpp:
+        (Node::evaluateReference): Use Reference::makeValueReference(),
+	not ConstReference.
+        * kjs/reference.cpp:
+        (Reference::Reference): New implementation, handles both regular
+	and value references.
+        (Reference::makeValueReference): Incorporate functionality of ConstReference
+	into this class.
+        (Reference::getBase): New implementation (incorporates error vase
+	for value references).
+	(Reference::getPropertyName): New implementation (incorporates error case
+	for value references).
+        (Reference::putValue): New implementation (incorporates error case
+	for value references).
+        (Reference::deleteValue): New implementation (incorporates error case
+	for value references).
+        (Reference::getValue): New implementation (incorporates special case
+	for value references).
+        (Reference::isMutable): New implementation.
+	* kjs/reference.h: New implementation that merges ReferenceImp
+	into the stack object.
+        * kjs/value.h, kjs/value.cpp: Removed all reference-related method.
+
+2002-08-16  Darin Adler  <darin@apple.com>
+
+	- fixed 3026184 -- Hang going to http://aa.com/ while executing JavaScript
+
+        * kjs/simple_number.h: (SimpleNumber::value): Fixed conversion to a negative
+	number. The technique of using division was no good. Instead, or in the sign
+	bits as needed.
+
+2002-08-16  Maciej Stachowiak  <mjs@apple.com>
+
+        * kjs/reference_list.h: Must include headers with "", not
+	<>. D'oh!
+
+2002-08-16  Maciej Stachowiak  <mjs@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Install reference.h and
+	reference_list.h so WebCore compiles (duh).
+
+2002-08-16  Maciej Stachowiak  <mjs@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/nodes.cpp:
+        (Node::evaluateReference):
+        * kjs/reference.cpp:
+        (Reference::Reference):
+        (Reference::makeValueReference):
+        (Reference::getBase):
+        (Reference::getPropertyName):
+        (Reference::getValue):
+        (Reference::putValue):
+        (Reference::deleteValue):
+        (Reference::isMutable):
+        * kjs/reference.h:
+        * kjs/reference_list.h:
+        * kjs/value.cpp:
+        (ValueImp::dispatchToUInt32):
+        * kjs/value.h:
+
+2002-08-16  Maciej Stachowiak  <mjs@apple.com>
+
+	Next step: reimplement ReferenceList from scratch, and store it as
+	an actual Reference object, so ReferenceList no longer depends on
+	Reference being a Value or having a ReferenceImp. A resizing
+	vector might be even better the way this is used.
+
+	Also moved Reference to its own header and implementation file in
+	preparation for reimplementing it.
+	
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * kjs/nodes.cpp:
+        (ForInNode::execute):
+        * kjs/reference.cpp: Added.
+        (Reference::Reference):
+        (Reference::dynamicCast):
+        (ConstReference::ConstReference):
+        * kjs/reference.h: Added.
+        * kjs/reference_list.cpp: Added.
+        (ReferenceList::ReferenceList):
+        (ReferenceList::operator=):
+        (ReferenceList::swap):
+        (ReferenceList::append):
+        (ReferenceList::~ReferenceList):
+        (ReferenceList::begin):
+        (ReferenceList::end):
+        (ReferenceListIterator::ReferenceListIterator):
+        (ReferenceListIterator::operator!=):
+        (ReferenceListIterator::operator->):
+        (ReferenceListIterator::operator++):
+        * kjs/reference_list.h:
+        * kjs/types.cpp:
+        * kjs/types.h:
+
+2002-08-16  Maciej Stachowiak  <mjs@apple.com>
+
+	Fix Development build - some NDEBUG code had to be changed for the
+	Value/Reference split.
+	
+        * kjs/internal.cpp:
+        (KJS::printInfo):
+        * kjs/nodes.cpp:
+        (FunctionCallNode::evaluate):
+
+2002-08-16  Maciej Stachowiak  <mjs@apple.com>
+
+        * kjs/reference_list.h: Added file I forgot to check in last time.
+
+2002-08-15  Maciej Stachowiak  <mjs@apple.com>
+
+	Phase 1 of optimization to stop allocating references through the
+	collector. This step clearly splits evaluating to a reference and
+	evaluating to a value, and moves all of the reference-specific
+	operations from Value to Reference. A special ConstReference class
+	helps out for the one case where you need special reference
+	operations if the result is a reference, and not otherwise.
+
+	Also, Reference now inherits privately from Value, and there is a
+	new ReferenceList class that inherits privately from List, so the
+	uses of Reference and Value are now completely orthogonal. This
+	means that as the next step, their implementations can be
+	completely disentangled.
+	
+	This step has no actual performance impact.
+	
+        * kjs/collector.cpp:
+        (Collector::collect):
+        * kjs/nodes.cpp:
+        (Node::evaluateReference):
+        (ResolveNode::evaluate):
+        (ResolveNode::evaluateReference):
+        (ElementNode::evaluate):
+        (PropertyValueNode::evaluate):
+        (AccessorNode1::evaluate):
+        (AccessorNode1::evaluateReference):
+        (AccessorNode2::evaluate):
+        (AccessorNode2::evaluateReference):
+        (ArgumentListNode::evaluateList):
+        (NewExprNode::evaluate):
+        (FunctionCallNode::evaluate):
+        (PostfixNode::evaluate):
+        (DeleteNode::evaluate):
+        (VoidNode::evaluate):
+        (TypeOfNode::evaluate):
+        (PrefixNode::evaluate):
+        (UnaryPlusNode::evaluate):
+        (NegateNode::evaluate):
+        (BitwiseNotNode::evaluate):
+        (LogicalNotNode::evaluate):
+        (MultNode::evaluate):
+        (AddNode::evaluate):
+        (ShiftNode::evaluate):
+        (RelationalNode::evaluate):
+        (EqualNode::evaluate):
+        (BitOperNode::evaluate):
+        (BinaryLogicalNode::evaluate):
+        (ConditionalNode::evaluate):
+        (AssignNode::evaluate):
+        (CommaNode::evaluate):
+        (VarDeclNode::evaluate):
+        (ExprStatementNode::execute):
+        (IfNode::execute):
+        (DoWhileNode::execute):
+        (WhileNode::execute):
+        (ForNode::execute):
+        (ForInNode::execute):
+        (ReturnNode::execute):
+        (WithNode::execute):
+        (CaseClauseNode::evaluate):
+        (SwitchNode::execute):
+        (ThrowNode::execute):
+        * kjs/nodes.h:
+        * kjs/types.cpp:
+        (ConstReference::ConstReference):
+        * kjs/types.h:
+        * kjs/value.h:
+
+2002-08-15  Darin Adler  <darin@apple.com>
+
+	Tweaks and small bug fixes to Maciej's excellent new fixnum optimization.
+	Also updated or removed comments that call it "fixnum" instead of "simple number".
+
+        * kjs/simple_number.h: Change constant names so they don't SHOUT the way macro
+	names do. Added constants for shift, min, and max. Fixed off-by-1 error that
+	prevented us from using the extreme values on either end. Base the range of
+	numbers on a fixed 32 bits constant rather than the size of a long, because
+	code elsewhere depends on positive numbers fitting into both "unsigned" and
+	"UInt32" while assuming it doesn't need to check; we can easily change this
+	later. Used int types rather than long for essentially the same reason.
+	Fixed the value-extraction function so it will work for negative numbers even
+        if the shift is logical, not arithmetic, by using division instead.
+	Renamed functions to be quite terse since they are inside a class.
+
+        * kjs/value.h:
+        * kjs/value.cpp:
+        (ValueImp::dispatchToObject): Call NumberImp::toObject in a "non-virtual"
+	way rather than repeating the code here.
+        (ValueImp::dispatchToUInt32): Handle the negative number case correctly.
+        (ValueImp::dispatchGetBase): Call ValueImp::getBase in a "non-virtual"
+	way rather than repeating the code here.
+        (ValueImp::dispatchGetPropertyName): Call ValueImp::getPropertyName in a
+	"non-virtual" way rather than repeating the code here.
+        (ValueImp::dispatchPutValue): Call ValueImp::putValue in a "non-virtual"
+	way rather than repeating the code here.
+        (ValueImp::dispatchDeleteValue): Call ValueImp::deleteValue in a "non-virtual"
+	way rather than repeating the code here.
+        (Number::Number): Fixed a bug where the double-based constructor was casting
+	to long, so wouldn't do the "remainder" check.
+
+=== Alexander-19 ===
+
+=== Alexander-18 ===
+
+2002-08-15  Maciej Stachowiak  <mjs@apple.com>
+
+	Phase 2 of fixnum optimization. Store any integral number that
+	will fit in two bits less than a long inside the ValueImp *
+	itself, thus avoiding the need to deal with the garbage collector
+	at all for these types. Such numbers comprised .5 million of the
+	1.7 million ValueImps created during the cvs-js-performance test,
+	so traffic through the garbage collector should be
+
+	20% improvement on cvs-js-performance. This may also show up on
+	cvs-base, but I did not compare and I am too lazy to make clean in
+	WebCore yet again. 
+
+	This also significantly reduces memory footprint on
+	JavaScript-heavy pages. Size after going through
+	cvs-js-performance suite is now 22MB to 17.5MB.
+	
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * kjs/simple_number.h: Added. Some inline static methods for handling
+	simple numbers that are stored in the pointer.
+        * kjs/ustring.h:
+        * kjs/ustring.cpp:
+        (UString::from): Added new overload for long.
+        * kjs/value.cpp:
+        (ValueImp::marked): Add special case for simple numbers.
+        (ValueImp::setGcAllowed): Likewise.
+	(ValueImp::toInteger): Call dispatch version of
+	toUInt32(unsigned&), not the real method.
+        (ValueImp::toInt32): Likewise.
+        (ValueImp::toUInt32): Likewise.
+        (ValueImp::toUInt16): Likewise.
+        (ValueImp::dispatchType): Add special case for simple numbers.
+        (ValueImp::dispatchToPrimitive): Likewise.
+        (ValueImp::dispatchToBoolean): Likewise.
+        (ValueImp::dispatchToNumber): Likewise.
+        (ValueImp::dispatchToString): Likewise.
+        (ValueImp::dispatchToObject): Likewise.
+        (ValueImp::dispatchToUInt32): Likewise.
+        (ValueImp::dispatchGetBase): Likewise.
+        (ValueImp::dispatchGetPropertyName): Likewise.
+        (ValueImp::dispatchPutValue): Likewise.
+        (ValueImp::dispatchDeleteValue): Likewise.
+        (Number::Number): Create a simple number instead of a full-blown
+	ValueImp when possible.
+        (Number::value): Likewise.
+        * kjs/value.h:
+
+2002-08-15  Maciej Stachowiak  <mjs@apple.com>
+
+	Phase one of the "fixnum" optimization (storing small enough
+	integers in the pointer). This just paves the way for the change
+	by making all the virtual functions of ValueImp private and adding
+	non-virtual dispatchers which can call the virtual function or
+	handle fixnums specially.
+
+	Also, I marked every place that should need a special case with a
+	FIXNUM comment.
+	
+        * kjs/bool_object.cpp:
+        (BooleanObjectImp::construct): Call dispatch method not the real method.
+        * kjs/internal.h: Make toUInt32 private to make sure no one calls it directly
+	on a NumberImp*.
+        * kjs/nodes.cpp:
+        (ForInNode::execute): Call dispatch method not the real method.
+        * kjs/object.cpp:
+	(ObjectImp::propList): Call dispatch method not the real method.
+        * kjs/object.h:
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): Call dispatch method not the real method.
+        (StringObjectImp::construct): Call dispatch method not the real method.
+        * kjs/value.h:
+        * kjs/value.cpp:
+        (ValueImp::marked): Put a comment about required FIXNUM change.
+        (ValueImp::setGcAllowed): Likewise.
+        (ValueImp::dispatchType): Just call the virtual method for now.
+        (ValueImp::dispatchToPrimitive): Likewise.
+        (ValueImp::dispatchToBoolean): Likewise.
+        (ValueImp::dispatchToNumber): Likewise.
+        (ValueImp::dispatchToString): Likewise.
+        (ValueImp::dispatchToObject): Likewise.
+        (ValueImp::dispatchToUInt32): Likewise.
+        (ValueImp::dispatchGetBase): Likewise.
+        (ValueImp::dispatchGetPropertyName): Likewise.
+        (ValueImp::dispatchGetValue): Likewise.
+        (ValueImp::dispatchPutValue): Likewise.
+        (ValueImp::dispatchDeleteValue): Likewise.
+
+2002-08-14  Darin Adler  <darin@apple.com>
+
+	Another pass of tweaks, including one bug fix.
+
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::ArrayInstanceImp): Use malloc, not new.
+        (ArrayInstanceImp::get): Use a local variable so we don't rely on the optimizer
+	to avoid indexing twice.
+        (ArrayInstanceImp::hasProperty): Use a local variable, and also check against
+	UndefinedImp::staticUndefined rather than doing type() != UndefinedType.
+
+2002-08-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Simplified array handling by using NULL to represent empty cells
+	instead of the Undefined object, so we can use calloc, realloc and
+	memset instead of loops. Inspired by a suggestion of Darin's.
+
+	* kjs/array_object.cpp:
+        (ArrayInstanceImp::ArrayInstanceImp):
+        (ArrayInstanceImp::~ArrayInstanceImp):
+        (ArrayInstanceImp::get):
+        (ArrayInstanceImp::hasProperty):
+        (ArrayInstanceImp::deleteProperty):
+        (ArrayInstanceImp::setLength):
+        (ArrayInstanceImp::mark):
+
+2002-08-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Fix major JavaScript memory leak. run-plt says cvs-base improved
+	by 2% and cvs-js-performance improved by 7%. However, this was
+	within the possible noise level in each case.
+        
+	The fix was to store ValueImp *'s in the array instead of Value
+	objects, since the Value wrapper will keep a ref and make the
+	object immortal.
+
+	* kjs/array_object.cpp:
+        (ArrayInstanceImp::ArrayInstanceImp):
+        (ArrayInstanceImp::get):
+        (ArrayInstanceImp::put):
+        (ArrayInstanceImp::hasProperty):
+        (ArrayInstanceImp::deleteProperty):
+        (ArrayInstanceImp::setLength):
+        (ArrayInstanceImp::mark):
+        * kjs/array_object.h:
+
+2002-08-13  Maciej Stachowiak  <mjs@apple.com>
+
+	Add the ability to determine the classes of live JavaScript
+	objects, to help with leak fixing.
+
+        * kjs/collector.h, kjs/collector.cpp:
+        (Collector::liveObjectClasses):
+
+2002-08-13  Maciej Stachowiak  <mjs@apple.com>
+
+	Small speed improvement. 3% faster on cvs-js-performance, no
+	measurable change on cvs-static-urls.
+	
+        * kjs/collector.cpp:
+        (Collector::collect): Combine 3 loops over all objects into one,
+	to reduce flat time and improve locality of reference.
+
+2002-08-12  Darin Adler  <darin@apple.com>
+
+	Speed improvements. 19% faster on cvs-js-performance, 1% on cvs-static-urls.
+
+	Use global string objects for length and other common property names rather
+	than constantly making and destroying them. Use integer versions of get() and
+	other related calls rather than always making a string.
+
+	Also get rid of many unneeded constructors, destructors, copy constructors, and
+	assignment operators. And make some functions non-virtual.
+
+        * kjs/internal.h:
+        * kjs/internal.cpp:
+        (NumberImp::toUInt32): Implement.
+        (ReferenceImp::ReferenceImp): Special case for numeric property names.
+        (ReferenceImp::getPropertyName): Moved guts here from ValueImp. Handle numeric case.
+        (ReferenceImp::getValue): Moved guts here from ValueImp. Handle numeric case.
+        (ReferenceImp::putValue): Moved guts here from ValueImp. Handle numeric case.
+        (ReferenceImp::deleteValue): Added. Handle numeric case.
+
+        * kjs/array_object.h:
+        * kjs/array_object.cpp: All-new array implementation that stores the elements
+	in a C++ array rather than in a property map.
+        (ArrayInstanceImp::ArrayInstanceImp): Allocate the C++ array.
+        (ArrayInstanceImp::~ArrayInstanceImp): Delete the C++ array.
+        (ArrayInstanceImp::get): Implement both the old version and the new overload that
+	takes an unsigned index for speed.
+        (ArrayInstanceImp::put): Implement both the old version and the new overload that
+	takes an unsigned index for speed.
+        (ArrayInstanceImp::hasProperty): Implement both the old version and the new overload that
+	takes an unsigned index for speed.
+        (ArrayInstanceImp::deleteProperty): Implement both the old version and the new overload that
+	takes an unsigned index for speed.
+        (ArrayInstanceImp::setLength): Added. Used by the above to resize the array.
+        (ArrayInstanceImp::mark): Mark the elements of the array too.
+        (ArrayPrototypeImp::ArrayPrototypeImp): Pass the length to the array instance constructor.
+
+        * kjs/bool_object.cpp:
+        * kjs/date_object.cpp:
+        * kjs/error_object.cpp:
+        * kjs/function.cpp:
+        * kjs/function_object.cpp:
+        * kjs/math_object.cpp:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/number_object.cpp:
+        * kjs/object_object.cpp:
+        * kjs/regexp_object.cpp:
+        * kjs/string_object.cpp:
+
+        * kjs/nodes2string.cpp: (SourceStream::operator<<): Add a special case for char now that
+	you can't create a UString from a char implicitly.
+
+        * kjs/object.h:
+        * kjs/object.cpp:
+        (ObjectImp::get): Call through to the string version if the numeric version is not implemented.
+        (ObjectImp::put): Call through to the string version if the numeric version is not implemented.
+        (ObjectImp::hasProperty): Call through to the string version if the numeric version is not implemented.
+        (ObjectImp::deleteProperty): Call through to the string version if the numeric version is not implemented.
+
+        * kjs/types.h:
+        * kjs/types.cpp:
+        (Reference::Reference): Added constructors for the numeric property name case.
+
+        * kjs/ustring.h: Made the constructor that turns a character into a string be explicit so we
+	don't get numbers that turn themselves into strings.
+        * kjs/ustring.cpp:
+        (UString::UString): Detect the empty string case, and use a shared empty string.
+        (UString::find): Add an overload for single character finds.
+        (UString::rfind): Add an overload for single character finds.
+        (KJS::operator==): Fix bug where it would call strlen(0) if the first string was not null.
+	Also handle non-ASCII characters consistently with the rest of the code by casting to unsigned char
+	just in case.
+
+        * kjs/value.h: Make ValueImp and all subclasses non-copyable and non-assignable.
+        * kjs/value.cpp:
+        (ValueImp::toUInt32): New interface, mainly useful so we can detect array indices and not turn
+	them into strings and back.
+        (ValueImp::toInteger): Use the new toUInt32. Probably can use more improvement.
+        (ValueImp::toInt32): Use the new toUInt32. Probably can use more improvement.
+        (ValueImp::toUInt16): Use the new toUInt32. Probably can use more improvement.
+        (ValueImp::getBase): Remove handling of the Reference case. That's in ReferenceImp now.
+        (ValueImp::getPropertyName): Remove handling of the Reference case. That's in ReferenceImp now.
+        (ValueImp::getValue): Remove handling of the Reference case. That's in ReferenceImp now.
+        (ValueImp::putValue): Remove handling of the Reference case. That's in ReferenceImp now.
+        (ValueImp::deleteValue): Added. Used so we can do delete the same way we do put.
+
+=== Alexander-17 ===
+
+2002-08-09  Darin Adler  <darin@apple.com>
+
+	Some string speedups. Makes sony.com cached 11% faster on Development, but
+        the improvement for Deployment should be greater.
+
+        * kjs/ustring.h: Made it possible for UChar objects to be uninitialized, which
+	gives a speed boost. Inlined CString's +=, UString's destructor, +=, and +.
+        * kjs/ustring.cpp:
+        (UString::UString): Optimize const char * version, which showed up
+	heavily in performance analysis. Added new two-UString version, which
+	makes the + operator fast. 
+        (UString::ascii): Remove thread safety changes. Change static buffer to remember
+	its size, and to always be at least 4096 bytes long; that way we never have to
+	reallocate unless it's for a long string. Also make code to extract the characters
+	significantly faster by getting rid of two pointer dereferences per character.
+        (UString::is8Bit): Avoid one pointer dereference per character.
+        (UString::toDouble): Use ascii() instead of cstring() to avoid copying the string.
+
+        * kjs/collector.cpp: Remove unneeded APPLE_CHANGES.
+        * kjs/regexp.cpp: Remove ifdefs around some APPLE_CHANGES that we
+	want to keep, because they just fix warnings.
+        * kjs/value.h: Remove obsolete APPLE_CHANGES comment.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Project Builder decided
+	to move a line around in the file.
+
+2002-08-09  Maciej Stachowiak  <mjs@apple.com>
+
+	Fix my last change to actually call the versions of the lock functions
+	that are recursive and initialize as needed.
+	
+        * kjs/internal.cpp:
+        (InterpreterImp::InterpreterImp):
+        (InterpreterImp::clear):
+        (InterpreterImp::evaluate):
+
+2002-08-09  Maciej Stachowiak  <mjs@apple.com>
+
+        - fixed 2948835 - JavaScriptCore locking is too fine grained, makes it too slow
+
+	* kjs/collector.cpp:
+        (Collector::allocate):
+        (Collector::collect):
+        (Collector::finalCheck):
+        (Collector::numInterpreters):
+        (Collector::numGCNotAllowedObjects):
+        (Collector::numReferencedObjects):
+        * kjs/collector.h:
+        * kjs/internal.cpp:
+        (initializeInterpreterLock):
+        (lockInterpreter):
+        (unlockInterpreter):
+        (Parser::parse):
+        (InterpreterImp::InterpreterImp):
+        (InterpreterImp::clear):
+        (InterpreterImp::evaluate):
+        * kjs/value.cpp:
+        (ValueImp::ValueImp):
+        (ValueImp::setGcAllowed):
+
+=== milestone 0.5 ===
+
+=== Alexander-16 ===
+
+2002-08-05  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3007072 - need to be able to build fat
+	
+        * JavaScriptCore.pbproj/project.pbxproj: Fixed DeploymentFat build.
+
+=== Alexander-15 ===
+
+2002-07-25  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Add DeploymentFat build style.
+
+=== Alexander-14 ===
+
+2002-07-21  Darin Adler  <darin@apple.com>
+
+        * kjs/*: Roll KDE 3.0.2 changes in. Also switch to not using APPLE_CHANGES
+	for some of the changes that we definitely want to contribute upstream.
+
+2002-07-21  Maciej Stachowiak  <mjs@apple.com>
+
+        * Makefile.am: Remove products from symroots on `make clean'.
+
+=== Alexander-13 ===
+
+2002-07-13  Darin Adler  <darin@apple.com>
+
+        * Makefile.am: Don't use embed.am any more.
+        * JavaScriptCore.pbproj/project.pbxproj: Use embed-into-alex instead
+	of make embed.
+
+2002-07-12  Darin Adler  <darin@apple.com>
+
+        * kjs/ustring.h: Since <sys/types.h> includes ushort and uint now, had
+	to change the includes here to be compatible with that.
+
+2002-07-11  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: To make the build of
+	WebCore work without using -I to peek at JavaScriptCore sources,
+	made all the Public sources Private so they are all in one directory.
+	Also, made lookup.h be Private.
+
+=== Alexander-11 ===
+
+=== Alexander-10 ===
+
+2002-06-25  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Re-add -Wmissing-format-attribute.
+
+=== Alexander-9 ===
+
+2002-06-19  Kenneth Kocienda  <kocienda@apple.com>
+
+        I just played alchemical voodoo games with the linker to 
+        make all our frameworks and Alexander prebound.
+
+	* JavaScriptCore.pbproj/project.pbxproj
+
+2002-06-15  Darin Adler  <darin@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Removed explicit PFE_FILE_C_DIALECTS now that
+	Project Builder handles this automatically. Removed explicit USE_GCC3 since that's implicit
+	now. Also, since this project is all C++, only use WARNING_CFLAGS with flags that are appropriate
+	for C++; don't bother breaking out C vs. C++.
+
+	* kjs/collector.cpp: Now that the system warning is fixed, use PTHREAD_MUTEX_INITIALIZER and
+	PTHREAD_COND_INITIALIZER.
+	* kjs/internal.cpp: Use PTHREAD_MUTEX_INITIALIZER.
+	* kjs/ustring.cpp: Use PTHREAD_ONCE_INIT.
+
+2002-06-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Made Development build mode mean what Unoptimized used to mean. Removed Unoptimized build mode. 
+        Added a Mixed build mode which does what Deployment used to. All this to fix:
+        
+        Radar 2955367 - Change default build style to "Unoptimized"
+        
+	* JavaScriptCore.pbproj/project.pbxproj:
+
+2002-06-12  Darin Adler  <darin@apple.com>
+
+	* kjs/nodes.cpp: (Node::finalCheck): A bit of APPLE_CHANGES so we
+	can compile with KJS_DEBUG_MEM defined if we want to.
+
+2002-06-10  Darin Adler  <darin@apple.com>
+
+	Merged in changes from KDE 3.0.1.
+
+	* kjs/collector.cpp:
+	* kjs/date_object.cpp:
+	* kjs/function.cpp:
+	* kjs/internal.cpp:
+	* kjs/lookup.h:
+	* kjs/object.cpp:
+	* kjs/operations.cpp:
+	* kjs/regexp.cpp:
+	* kjs/regexp_object.cpp:
+	* kjs/regexp_object.h:
+	* kjs/string_object.cpp:
+	* kjs/testkjs.cpp:
+	* kjs/ustring.cpp:
+	* kjs/value.cpp:
+	* kjs/value.h:
+	Do the merge, and add APPLE_CHANGES as needed to make things compile.
+
+	* kjs/date_object.lut.h: Re-generated.
+
+2002-06-07  Darin Adler  <darin@apple.com>
+
+	* Makefile.am: Use new shared "embed.am" file so we don't need four copies of
+	the embedding rules for WebFoundation, JavaScriptCore, WebCore, and WebKit.
+
+2002-06-07  Darin Adler  <darin@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Don't use any warning flags for C that won't work
+	for C++, because PFE uses the C warning flags on a C++ compile.
+
+=== Alexander-8 ===
+
+2002-06-06  Darin Adler  <darin@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Update warning flags for compatibility
+	with new C++.
+
+2002-06-05  Darin Adler  <darin@apple.com>
+
+	Fix problem seen as build failure on Jersey.
+
+	* Makefile.am: JavaScriptCore-stamp needs to be a dependency, not a
+	source file, because it doesn't have a corresponding object file.
+	Making it a dependency causes things to compile in the right order.
+
+2002-06-04  Darin Adler  <darin@apple.com>
+
+	Improve the speed of the JavaScript string append operation by growing
+	the capacity so we don't need to reallocate the string every time.
+
+	Also fix script execution so it doesn't use recursion to advance from
+	one statement to the next, using iteration instead.
+
+	* Makefile.am: Stop using BUILT_SOURCES to build JavaScriptCore-stamp,
+	because this causes the Project Builder project to build *before* the
+	subdir. Intead, use an all-am rule in a way more similar to all our
+	other directories.
+
+	* kjs/grammar.y: Link the SourceElementsNode in the opposite direction,
+	so we can walk the list and execute each element instead of using
+	recursion to reverse the list.
+	* kjs/grammar.cpp: Check in new generated file.
+
+	* kjs/nodes.cpp:
+	(SourceElementsNode::execute):
+	(SourceElementsNode::processFuncDecl):
+	(SourceElementsNode::processVarDecls):
+	Use loops instead of recursion.
+
+	* kjs/ustring.h: Don't initialize all UChar objects to 0. This was
+	wasting a *huge* amount of time.
+	* kjs/ustring.cpp:
+	(UString::Rep::create): Add a "capacity" along with the length.
+	(UString::append): Include 50% extra capacity when appending.
+	(UString::operator=): Reuse the buffer if possible rather than
+	always creating a new one.
+
+2002-06-02  Darin Adler  <darin@apple.com>
+
+	* COPYING.LIB: Fix line endings. It was using CRs.
+
+2002-05-31  Darin Adler  <darin@apple.com>
+
+	* Makefile.am:
+	* kjs/Makefile.am:
+	Slight improvements to rules that touch stamp files.
+
+2002-05-28  Maciej Stachowiak  <mjs@apple.com>
+
+	* THANKS: Demangled.
+
+=== Alexander-7 ===
+
+2002-05-24  Maciej Stachowiak  <mjs@apple.com>
+
+	Added license and acknowledgements.
+
+	* AUTHORS: Added.
+	* COPYING.LIB: Added.
+	* THANKS: Added.
+
+=== 0.3 ===
+
+=== Alexander-6 ===
+
+=== Alexander-5 ===
+
+=== Alexander-4 ===
+
+=== JavaScriptCore-5 ===
+
+2002-05-21  Maciej Stachowiak  <mjs@apple.com>
+
+	Reviewed by: Richard Williamson
+
+	Fixed Radar 2928775 - Sherlock crashes sitting in stocks channel
+
+	* kjs/internal.cpp:
+	(InterpreterImp::InterpreterImp): Set the interp pointer earlier,
+	in case garbage collection takes place while creating the global
+	values.
+
+2002-05-15  Darin Adler  <darin@apple.com>
+
+	Reviewed by: Maciej Stachowiak
+	
+	* Makefile.am:
+	Use all-am and clean-am instead of all and clean because it's better and
+	to make "make check" at the top level work right.
+
+2002-05-13  Darin Adler  <darin@apple.com>
+
+	Reviewed by: Maciej Stachowiak
+
+	* kjs/value.h: Fix comment typos.
+
+=== JavaScriptCore-4 ===
+
+2002-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+	Reviewed by: Ken Kocienda and Darin Adler
+
+	Fixed the following bug:
+
+	Radar 2890573 - JavaScriptCore needs to be thread-safe
+
+	Actually this is only a weak form of thread-safety - you can safely
+	use different interpreters from different threads at the same
+	time. If you try to use a single interpreter object from multiple
+	threads, you need to provide your own locking.
+
+	* kjs/collector.h, kjs/collector.cpp:
+	(Collector::lock, Collector::unlock): Trivial implementation of a
+	recursive mutex.
+	(Collector::allocate): Lock around the body of this function.
+	(Collector::collect): Likewise.
+	(Collector::finalCheck): Likewise.
+	(Collector::numInterpreters): Likewise.
+	(Collector::numGCNotAllowedObjects): Likewise.
+	(Collector::numReferencedObjects): Likewise.
+	* kjs/internal.cpp:
+	(Parser::parse): use a mutex to lock around the whole parse, since
+	it uses a bunch of global state.
+	(InterpreterImp::InterpreterImp): Grab the Collector lock here,
+	both the mutually exclude calls to the body of this function, and
+	to protect the s_hook static member which the collector pokes at.
+	(InterpreterImp::clear): Likewise.
+	* kjs/ustring.cpp:
+	(statBufferKeyCleanup, statBufferKeyInit, UString::ascii): Convert
+	use of static variable
+	* kjs/value.cpp:
+	(ValueImp::ValueImp, ValueImp::mark, ValueImp::marked,
+	ValueImp::setGcAllowed): Grab the GC lock around any flag changes.
+
+=== Alexander-3 ===
+
+2002-05-08  Darin Adler  <darin@apple.com>
+
+	* kjs/collector.h:
+	* kjs/collector.cpp:
+	(Collector::numInterpreters):
+	(Collector::numGCNotAllowedObjects):
+	(Collector::numReferencedObjects):
+	Add three new functions so we can see a bit more about leaking JavaScriptCore.
+
+2002-05-06  Darin Adler  <darin@apple.com>
+
+	* JavaScriptCorePrefix.h: Added.
+	* JavaScriptCore.pbproj/project.pbxproj: Use PFE precompiling.
+	Also switch from xNDEBUG to NDEBUG.
+
+=== Alexander 0.3c2 (v1) ===
+
+2002-04-18  Darin Adler  <darin@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Oops. Take out -Wstrict-prototypes, put back
+	-Wmissing-prototypes.
+
+2002-04-18  Darin Adler  <darin@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Take out -Wmissing-prototypes
+	because system headers are triggering it when we don't have
+	precompiled headers on.
+
+2002-04-18  Darin Adler  <darin@apple.com>
+
+	Reviewed by Maciej
+
+	* JavaScriptCore.pbproj/project.pbxproj: Turn on gcc3 and the same set of warnings
+	as in the rest of Labyrinth (see top level ChangeLog for details).
+
+2002-04-17  Maciej Stachowiak  <mjs@apple.com>
+
+	Reviewed by: Darin Adler  <darin@apple.com>
+
+	* kjs/testkjs.cpp: Don't include <iostream.h> to avoid gcc3
+	warning.
+
+2002-04-15  Darin Adler  <darin@apple.com>
+
+	Reviwed by: Maciej Stachowiak  <mjs@apple.com>
+
+	* kjs/internal.cpp:
+	* kjs/property_map.cpp:
+	* kjs/ustring.h:
+	Removed some unneeded <config.h> includes so we are more similar
+	to the real KDE sources.
+
+2002-04-15  Darin Adler  <darin@apple.com>
+
+	Reviwed by: Maciej Stachowiak  <mjs@apple.com>
+
+	Merged changes from KDE 3.0 final and did some build fixes.
+
+	* JavaScriptCore.pbproj/project.pbxproj: Added nodes2string.cpp.
+
+	* kjs/grammar.*: Regenerated.
+	* kjs/*.lut.h: Regenerated.
+
+2002-04-08  Darin Adler  <darin@apple.com>
+
+	Reviwed by: Maciej Stachowiak  <mjs@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Re-added -Wno-format-y2k.
+
+2002-04-04  Darin Adler  <darin@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Add an Unoptimized build
+	style: exactly like Development except without the -O.
+
+2002-04-03  Darin Adler  <darin@apple.com>
+
+	* kjs/Makefile.am: Gratuitous cleanup.
+
+2002-04-02  Darin Adler  <darin@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Update flags as I did for
+	WebFoundation.
+
+2002-04-02  Maciej Stachowiak  <mjs@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Pass -Wno-format-y2k so
+	the project builds with gcc3.
+	
+	* kjs/nodes.cpp: Avoid including an obsolete header to avoid
+	warning with gcc3.
+
+2002-04-02  Darin Adler  <darin@apple.com>
+
+	* kjs/property_map.cpp: (PropertyMap::~PropertyMap): Deallocate the
+        map by calling clear so we don't leak the entire map.
+
+2002-04-02  Darin Adler  <darin@apple.com>
+
+	* kjs/internal.cpp: (InterpreterImp::globalClear): Add code to
+        deallocate and null out emptyList, because once the last interpreter
+        is destroyed there's nothing to keep it from being garbage collected.
+
+2002-04-01  Darin Adler  <darin@apple.com>
+
+        Got rid of KWQDef.h because it's dangerous to have two files with
+        the same name and different contents.
+
+	* JavaScriptCore.pbproj/project.pbxproj:
+	* kjs/KWQDef.h: Removed.
+	* kjs/ustring.h: Defines unsigned int types inline now.
+
+2002-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+	Fixed Radar 2891272 (JavaScript crashes loading quicktime.com and
+	apple.com)
+
+	* kjs/object.cpp: (ObjectImp::~ObjectImp): Don't call setGCAlloc
+	on object internals pointed to, because they may have already been
+	collected by the time this object is collected, and in that case
+	we would corrupt the malloc arena.
+
+	* Makefile.am: Make the stamp file depend on all the sources and
+	headers so the framework gets rebuilt properly.
+
+	* JavaScriptCore.pbproj/project.pbxproj: Some random numbers moved
+	around. No idea what I really changed.
+
+2002-03-30  Darin Adler  <darin@apple.com>
+
+	* kjs/grammar.y: Took out Id tag so we won't constantly need to
+        update grammar.cpp.
+	* kjs/grammar.cpp: Regenerated without Id tag.
+
+	* .cvsignore: Ignore some additional autogenerated files.
+	* kjs/.cvsignore: Ignore some additional autogenerated files.
+
+2002-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+	* JavaScriptCore.pbproj/project.pbxproj: Install some of the
+	headers.
+
+2002-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+	Converted JavaScriptCore to build with Project Builder, in
+	preparation for B&I submission.
+
+	* English.lproj/InfoPlist.strings: Added.
+	* JavaScriptCore.pbproj/.cvsignore: Added.
+	* JavaScriptCore.pbproj/project.pbxproj: Added.
+	
+	* .cvsignore: Update the set of ignored things.
+
+	* Makefile.am: Hand off to PB for the main build, but still handle
+	the generated files and the test program.
+
+	* kjs/Makefile.am: Don't build anything except the generated
+	source files.
+
+	* kjs/KWQDef.h, kjs/config.h: Added minimal versions of these
+	files to get kjs to build.
+
+	Check in all the genrated files, since Project Builder isn't up to
+	the task of handling built sources:
+	
+	* kjs/array_object.lut.h: Added.
+	* kjs/date_object.lut.h: Added.
+	* kjs/grammar.cpp: Added.
+	* kjs/grammar.cpp.h: Added.
+	* kjs/grammar.h: Added.
+	* kjs/lexer.lut.h: Added.
+	* kjs/math_object.lut.h: Added.
+	* kjs/number_object.lut.h: Added.
+	* kjs/string_object.lut.h: Added.
+
+	* kjs/.cvsignore: Update set of ignored things.
+
+2002-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+	* kjs/kjs-test.chk: Update output for new test results.
+
+2002-03-26  Maciej Stachowiak  <mjs@apple.com>
+
+	Set up kjs to build by itself into libJavaScriptCore.dylib.
+	
+	* .cvsignore: Added.
+	* Makefile.am: Added.
+	* dummy.cpp: Added.
+	* kjs/.cvsignore: Added.
diff --git a/ChangeLog-2003-10-25 b/ChangeLog-2003-10-25
new file mode 100644
index 0000000..7127d32
--- /dev/null
+++ b/ChangeLog-2003-10-25
@@ -0,0 +1,1483 @@
+=== Safari-111 ===
+
+2003-10-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Fix broken build.
+
+        * kjs/simple_number.h:
+
+2003-10-22  Maciej Stachowiak  <mjs@apple.com>
+
+	Merged 64-bit compilation fixes, and fixes for handling negative 0
+	from upstream kjs.
+	
+        * kjs/internal.cpp:
+        * kjs/simple_number.h:
+        (KJS::SimpleNumber): fixed constants; added negZero constant. 
+        (KJS::SimpleNumber::is): adjusted to use long and not int.
+        (KJS::SimpleNumber::value): ditto.
+	(KJS::SimpleNumber::fits): ditto; also don't allow -0 to fit, so
+	we don't lose the distinction between -0 and +0.
+        (KJS::SimpleNumber::make): adjusted to use long.
+
+2003-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        - fixed 3367015 -- interdependent variable declarations in for loop don't work (they go backwards)
+
+        * kjs/nodes.h: (KJS::ForNode::ForNode): Add a new overload of the constructor for when the
+        first parameter is a variable declaration list. Call reverseList as we do in other constructors
+        that take lists that are built backwards.
+        * kjs/nodes.cpp: (ForNode::reverseList): Added. New helper function.
+
+=== Safari-110 ===
+
+=== Safari-109 ===
+
+2003-10-06  Darin Adler  <darin@apple.com>
+
+        * kjs/create_hash_table: Remove stray semicolon.
+
+        * kjs/array_object.lut.h:
+        * kjs/date_object.lut.h:
+        * kjs/lexer.lut.h:
+        * kjs/math_object.lut.h:
+        * kjs/number_object.lut.h:
+        * kjs/string_object.lut.h:
+        Regenerated.
+
+=== Safari-108 ===
+
+2003-10-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        - fixed 3441656 -- constructor bad for objs created w/ function as prototype (www.moock.org/asdg/codedepot)
+
+        * kjs/nodes.cpp: (FuncDeclNode::processFuncDecl): Set up the constructor as
+        as specified in the JavaScript spec. We were already doing this right in the
+        other place we make functions.
+
+2003-09-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        Rolled in Harri Porten's change to accept non-breaking space in JavaScript.
+
+        * kjs/lexer.cpp: (Lexer::isWhiteSpace): Accept 00A0 as "whitespace".
+
+2003-09-25  Maciej Stachowiak  <mjs@apple.com>
+
+	Roll out build system change since it did not actually work. :-(
+	
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * Makefile.am:
+
+2003-09-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Don't hack install name. Instead
+	of embedding into Safari, embed into WebKit as sub-umbrella.
+        * Makefile.am: Don't forget to rebuild if the user removes
+	JavaScript.framework from symroots manually.
+
+=== Safari-107 ===
+
+2003-09-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        - fixed 3421107 -- some dates that other browsers can parse can't be parsed by KJS's Date.parse()
+
+        * kjs/date_object.cpp: (KJS::KRFCDate_parseDate): Added code to be more strict about month names,
+        to allow a time zone after date even if the date omits the time, and to understand AM and PM.
+
+2003-09-22  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Rename Mixed build style to OptimizedWithSymbols.
+
+2003-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        * kjs/config.h: Added HAVE_SYS_PARAM_H, since KJS does look for this header, and we do
+        indeed have it. Just something I noticed in passing while cleaning up configure.in.
+
+2003-09-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        - fixed 3419380 -- JavaScript Date.getTimezoneOffset is off by one hour (during daylight savings)
+
+        * kjs/date_object.cpp: (DateProtoFuncImp::call): The daylight savings correction
+        in here was incorrect. Perhaps I should have corrected it for the non-BSD case too,
+        but I'm not sure the issue is the same.
+
+2003-09-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/date_object.cpp: Removed our CF-based implementations of gmtime, localtime,
+        mktime, timegm, and time, since they no longer have the slow "hit the filesystem
+        every time" behavior.
+
+=== Safari-100 ===
+
+=== Safari-99 ===
+
+=== Safari-98 ===
+
+=== Safari-97 ===
+
+=== Safari-96 ===
+
+2003-08-27  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John
+
+	- fixed rdar://problem/3397316 - sherlock crash: KJS::Collector::allocate(unsigned long)
+	
+	* kjs/internal.cpp:
+        (InterpreterImp::InterpreterImp): Hold the lock a bit longer, so
+	the call to initGlobalObject is covered.
+
+=== Safari-95 ===
+
+2003-08-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+        - fixed 3098350 -- opt. params to date methods are ignored (can't set end date in Exchange/Outlook web cal.)
+
+        * kjs/date_object.cpp: (DateProtoFuncImp::call): Added code to handle the optional parameters.
+        Strangely, the table of functions already had the right number of parameters listed, but the
+        code to look at the parameter values was missing.
+
+=== Safari-94 ===
+
+2003-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed 3247528 -- encodeURI missing from JavaScriptCore (needed by Crystal Reports)
+        - fixed 3381297 -- escape method does not escape the null character
+        - fixed 3381299 -- escape method produces incorrect escape sequences ala WinIE, rather than correct ala Gecko
+        - fixed 3381303 -- unescape method treats escape sequences as Latin-1 ala WinIE rather than as UTF-8 ala Gecko
+        - fixed 3381304 -- unescape method garbles strings with bad escape sequences in them
+
+        * kjs/function.h: Added constants for decodeURI, decodeURIComponent, encodeURI, and
+        encodeURIComponent.
+        * kjs/function.cpp:
+        (encode): Added. New helper function for escape, encodeURI, and encodeURIComponent.
+        (decode): Added. New helper function for unescape, decodeURI, and decodeURIComponent.
+        (GlobalFuncImp::call): Added decodeURI, decodeURIComponent, encodeURI, and encodeURIComponent 
+        implementations. Changed escape and unescape to use new helper functions, which fixes
+        the four problems above.
+
+        * kjs/internal.cpp: (InterpreterImp::initGlobalObject): Add decodeURI, decodeURIComponent,
+        encodeURI, and encodeURIComponent to the global object.
+
+        * kjs/ustring.h: Added a length to the CString class so it can hold strings with null
+        characters in them, not just null-terminated strings. This allows a null character from
+        a UString to survive the process of UTF-16 to UTF-8 decoding. Added overloads to
+        UString::append, UString::UTF8String, UTF8SequenceLength, decodeUTF8Sequence,
+        convertUTF16OffsetsToUTF8Offsets, and convertUTF8OffsetsToUTF16Offsets.
+        
+        * kjs/ustring.cpp:
+        (CString::CString): Set up the length properly in all the constructors. Also add a new
+        constructor that takes a length.
+        (CString::append): Use and set the length properly.
+        (CString::operator=): Use and set the length properly.
+        (operator==): Use and the length and memcmp instead of strcmp.
+        (UString::append): Added new overloads for const char * and for a single string to make
+        it more efficient to build up a UString from pieces. The old way, a UString was created
+        and destroyed each time you appended.
+        (UTF8SequenceLength): New. Helper for decoding UTF-8.
+        (decodeUTF8Sequence): New. Helper for decoding UTF-8.
+        (UString::UTF8String): New. Decodes from UTF-16 to UTF-8. Same as the function that
+        was in regexp.cpp, except has proper handling for UTF-16 surrogates.
+        (compareStringOffsets): Moved from regexp.cpp.
+        (createSortedOffsetsArray): Moved from regexp.cpp.
+        (convertUTF16OffsetsToUTF8Offsets): New. Converts UTF-16 offsets to UTF-8 offsets, given
+        a UTF-8 string. Same as the function that was in regexp.cpp, except has proper handling
+        for UTF-16 surrogates.
+        (convertUTF8OffsetsToUTF16Offsets): New. Converts UTF-8 offsets to UTF-16 offsets, given
+        a UTF-8 string. Same as the function that was in regexp.cpp, except has proper handling
+        for UTF-16 surrogates.
+
+        - fixed 3381296 -- regular expression matches with UTF-16 surrogates will treat sequences as two characters
+
+        * kjs/regexp.cpp:
+        (RegExp::RegExp): Use the new UString::UTF8String function instead a function in this file.
+        (RegExp::match): Use the new convertUTF16OffsetsToUTF8Offsets (and the corresponding
+        reverse) instead of convertCharacterOffsetsToUTF8ByteOffsets in this file.
+
+=== Safari-93 ===
+
+2003-08-14  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by John. 
+
+        * JavaScriptCore.pbproj/project.pbxproj: deleted JavaScriptCore.order from the project.
+
+2003-08-14  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by John. 
+
+        * JavaScriptCore.order: Removed.  We now link to the order file at /AppleInternal/OrderFiles.
+        * JavaScriptCore.pbproj/project.pbxproj: change sectorder flag to point to /AppleInternal/OrderFiles/JavaScriptCore.order
+
+=== JavaScriptCore-92.1 ===
+
+2003-08-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fixed 3365527 -- subscripting JavaScript strings does not work (leads to hang at www.newmagna.com.au)
+
+        The JavaScript specification says nothing about this, but other browsers seem to give
+        read-only access to the characters in a string as if the string was an array of characters.
+
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::get): Update to use a public toArrayIndex function instead of our own getArrayIndex
+        function, so we can share with string.
+        (ArrayInstanceImp::put): Ditto.
+        (ArrayInstanceImp::hasProperty): Ditto.
+        (ArrayInstanceImp::setLength): Ditto.
+
+        * kjs/ustring.h: Add toArrayIndex.
+        * kjs/ustring.cpp: (UString::toArrayIndex): Added. Implements the rule from array.
+        * kjs/identifier.h: Add a forwarding function so we can use toArrayIndex.
+
+        * kjs/string_object.cpp:
+        (StringInstanceImp::get): Return a single character string if the property name is an array index.
+        (StringInstanceImp::hasProperty): Return true for property names that are suitable array indices.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Let Xcode be Xcode.
+
+=== Safari-92 ===
+
+2003-08-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+	- fixed 3366975 - repro hang in KJS::Value::Value entering text at eil.com
+	
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): When doing a match against a regexp
+	with the global flag set, make sure to return null rather than an
+	empty array when there is no match. This is what other browsers do.
+
+2003-08-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        * kjs/list.cpp:
+	(List::copyTail): Test for loop termination with < instead of !=,
+	since i starts at 1 but size could be 0. Do the same for the other
+	loop for consistency's sake.
+	
+2003-08-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+	- fixed 3222621 - Cryptic "anonymous function hack" messages in console (10.2.4)
+	
+        * kjs/lexer.cpp:
+        (Lexer::lex): Remove useless debug spew.
+
+=== Safari-91 ===
+
+2003-07-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        - fixed problem where some JavaScriptCore symbols had no namespace or prefix
+
+        * kjs/grammar.y: Added a define for yylloc to make it use the kjs prefix.
+        This is the same thing done for the rest of the symbols automatically by yacc,
+        but for some reason it's not done for yyloc. Also make automatic() function static.
+        * kjs/grammar.cpp: Regenerated.
+        * kjs/lexer.cpp: Use kjsyylloc instead of yyloc.
+
+        * pcre/pcre.h: Add defines to prepend kjs prefixes for all the PCRE functions.
+
+2003-07-30  Darin Adler  <darin@apple.com>
+
+        * Makefile.am: Include the subdirectory with the PCRE code in it.
+
+2003-07-30  John Sullivan  <sullivan@apple.com>
+
+	- JavaScriptCore part of fix for 3284525 -- AutoFill fills in 
+	only e-mail address field of New Account form on Apple Store Japan
+
+        Reviewed by Darin
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+	Mark pcre.h as a Private header
+
+2003-07-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Richard.
+
+	- fixed 3240814 - LEAK: 120 byte leak in JavaScript parser in Sherlock Movies channel
+	
+        * kjs/internal.cpp:
+        (Parser::parse): ref() and deref() the program node, to make sure to clean up properly,
+	before deleting it.
+        (InterpreterImp::checkSyntax): Likewise.
+
+=== Safari-90 ===
+
+2003-07-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+	Remove -seg_addr_table_filename to fix build.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+2003-07-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+	- fixed 3330344 - Please change allowable client to "JavaScriptGlue" from "JSGlue"
+
+        * JavaScriptCore.pbproj/project.pbxproj: Changed allowable client
+	to "JavaScriptGlue"
+
+2003-07-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - do some improvements Maciej suggested while reviewing the array index change
+
+        * kjs/array_object.cpp:
+        (getArrayIndex): Return a flag to say whether the index was value separately, to avoid
+        in-band signalling.
+        (ArrayInstanceImp::get): Update for new getArrayIndex parameters.
+        (ArrayInstanceImp::put): Ditto.
+        (ArrayInstanceImp::hasProperty): Ditto.
+        (ArrayInstanceImp::setLength): Ditto.
+        
+        * kjs/ustring.cpp: (UString::toStrictUInt32): Check for overflow in a way that avoids doing
+        a divide every time through the loop. But note that it adds an extra branch to the loop.
+        I wonder which is worse.
+
+2003-07-12  Darin Adler  <darin@apple.com>
+
+        Fixed broken build.
+
+        * kjs/identifier.h: Add toULong back. It's still used in WebCore (and maybe in JavaScriptGlue,
+        for all I know).
+
+2003-07-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        - fixed 3272777 -- array object indices treated as integers by Safari, but as strings in other web browsers
+
+        JavaScriptCore did not implement the proper rule for what an array index is.
+
+        * kjs/array_object.cpp:
+        (getArrayIndex): Added. Implements the rule from the specification, which also provides a handy
+        "not an array index" value of 2^32-1.
+        (ArrayInstanceImp::get): Use getArrayIndex.
+        (ArrayInstanceImp::put): Ditto.
+        (ArrayInstanceImp::hasProperty): Ditto.
+        (ArrayInstanceImp::setLength): Ditto.
+
+        * kjs/identifier.h: Removed now-unused toULong, and added toStrictUInt32, in both cases forwarding
+        functions that forward to UString.
+
+        * kjs/ustring.h: Added toStringUInt32.
+        * kjs/ustring.cpp: (UString::toStrictUInt32): Added. Converts a string to a 32-bit unsigned integer,
+        and rejects any string that does not exactly match the way the integer would be formatted on output.
+        This is the rule documented in the ECMA language standard.
+
+=== Safari-89 ===
+
+2003-07-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+	- fixed 3302021 - v74 and v85 hang with http://e-www.motorola.com/
+
+	The crux of this was saving and restoring the prototype objects
+	for all the standard types when saving and restoring for the page
+	cache.
+	
+        * kjs/internal.cpp:
+        (InterpreterImp::saveBuiltins):
+        (InterpreterImp::restoreBuiltins):
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        (Interpreter::saveBuiltins):
+        (Interpreter::restoreBuiltins):
+        (SavedBuiltins::SavedBuiltins):
+        (SavedBuiltins::~SavedBuiltins):
+        * kjs/interpreter.h:
+        * kjs/property_map.cpp:
+
+2003-07-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+	- fixed 3295916 - b/c JavaScriptCore and WebCore are installing in wrong location, private headers are public
+
+        * WebCore.pbproj/project.pbxproj: Install in WebKit.framework/Versions/A/Frameworks.
+
+=== Safari-88 ===
+
+2003-07-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+	- fixed 3096961 - JavaScriptCore should link only to what it uses, shouldn't drag in Cocoa.framework
+
+        * JavaScriptCore.pbproj/project.pbxproj: Don't link Cocoa.framework;
+	just pull in CoreFoundation and CoreServices.
+        * kjs/date_object.cpp: Include CoreServices.h instead of Carbon.h
+	(the stuff we want is in CarbonCore).
+
+2003-06-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - improved the property map sorting technique so that the indices
+          are separate for each property map, and also preserve the ordering
+          when property maps are saved and restored
+
+        * kjs/property_map.cpp:
+        (PropertyMap::put): Don't bother setting the index for _singleEntry, since there's
+        no need to sort a single entry. Use the per-table lastIndexUsed instead of a global.
+        (PropertyMap::expand): Don't use the index (uninitialized now) out of a _singleEntry
+        when putting it in a newly-created map; just use 0. Compute a value for the new map's
+        lastIndexUsed as we walk through the elements we are adding to it (using the same old
+        indices from the old map).
+
+=== Safari-85.1 ===
+
+=== Safari-85 ===
+
+2003-06-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+	- fixed 3178438 -- return elements in order of addition in for..in loop (other browsers seem to)
+	- fixed 3292067 -- REGRESSION (64-65): albertsons.com "Shop A to Z" menus are not sorted alphabetically
+
+        * kjs/property_map.h: Add index field to hash table entry and index parameter to insert function.
+        * kjs/property_map.cpp:
+        (PropertyMap::put): Set an index for new map entries to an ever-increasing number based on a global.
+        (PropertyMap::insert): Take an index parameter.
+        (PropertyMap::expand): Preserve the indices as we rehash the table.
+        (comparePropertyMapEntryIndices): Added. Compares two property map entries by index.
+        (PropertyMap::addEnumerablesToReferenceList): Sort the proprty map entries by index before adding
+        them to the reference list.
+
+=== Safari-84 ===
+
+2003-06-10  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by john.
+
+        * JavaScriptCore.order: new order file for 1.0
+
+=== Safari-83 ===
+
+2003-06-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+	- fixed 3224031 -- can't search at rakuten.co.jp b/c of extra characters inserted by regexp replace (8-bit char)
+
+        Use PCRE UTF-8 regular expressions instead of just chopping off high bytes.
+
+        * kjs/regexp.h: Redo field names, remove some unused stuff.
+        * kjs/regexp.cpp:
+        (convertToUTF8): Added.
+        (compareStringOffsets): Added.
+        (createSortedOffsetsArray): Added.
+        (convertCharacterOffsetsToUTF8ByteOffsets): Added.
+        (convertUTF8ByteOffsetsToCharacterOffsets): Added.
+        (RegExp::RegExp): Set the PCRE_UTF8 flag, and convert the UString to UTF-8 instead of
+        using ascii() on it.
+        (RegExp::~RegExp): Remove unneeded if statement (pcre_free is 0-tolerant as free is).
+        (RegExp::match): Convert the UString to UTF-8 and convert the character offsets to and
+        from UTF-8 byte offsets. Also do fixes for the "no offset vector" case so we get the
+        correct position and matched string.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Add a PCRE header that was missing before.
+
+=== Safari-82 ===
+
+=== Safari-81 ===
+
+2003-05-21  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by john 
+	- fixed 3234553: Safari and its frameworks should link using order files
+
+        * JavaScriptCore.order: Added.
+        * JavaScriptCore.pbproj/project.pbxproj: set SECTORDER_FLAGS = -sectorder __TEXT __text JavaScriptCore.order
+
+=== Safari-80 ===
+
+2003-05-19  Maciej Stachowiak  <mjs@apple.com>
+
+	- fixed 3261096 - Make WebKit an umbrella framework
+	
+        * JavaScriptCore.pbproj/project.pbxproj: In a B&I build, compile as a
+	sub-umbrella of WebKit.
+
+2003-05-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+	- fixed 3254063 - REGRESSION: hang in KJS PropertyMap with many items in iDisk pictures folder
+
+        * kjs/property_map.cpp:
+	(PropertyMap::expand): Fixed to maintain key count properly - otherwise the hashtable
+	could get completely full, resulting in disaster.
+	(PropertyMap::checkConsistency): Fixed compilation. Fixed to know about deleted
+	sentinel. Fixed to search with double-hashing instead of linear probing.
+	
+=== Safari-79 ===
+
+2003-05-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Chris.
+
+	- fixed 3259673 - REGRESSION: marvel.com thinks I don't have the flash plugin any more
+
+        * kjs/nodes.cpp:
+        (ContinueNode::execute): Return a Continue completion, not a Break
+	completion, in the normal non-exception case.
+
+2003-05-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+	- fixed 3254484 - Add a way to print JavaScript exceptions to the console via the debug menu
+	- improved JavaScript error message format
+	
+        * kjs/error_object.cpp:
+        (ErrorProtoFuncImp::call): Include line number in toString output.
+        * kjs/internal.cpp:
+        (Parser::parse): Remove redundant fprintf.
+        * kjs/interpreter.cpp:
+        (Interpreter::evaluate): Log if the flag is on. Include filename in log output.
+        (Interpreter::shouldPrintExceptions): Check the global flag.
+        (Interpreter::setShouldPrintExceptions): Set the global flag.
+        * kjs/interpreter.h:
+        * kjs/nodes.cpp:
+        (Node::throwError): Add variants that include value and expression or label in format.
+        (NewExprNode::evaluate): Improve error message.
+        (FunctionCallNode::evaluate): Improve error message.
+        (RelationalNode::evaluate): Improve error message.
+        (ContinueNode::execute): Improve error message.
+        (BreakNode::execute): Improve error message.
+        (LabelNode::execute): Improve error message.
+        * kjs/nodes.h:
+
+=== Safari-78 ===
+
+2003-05-07  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by darin.
+	
+	- modify the Mixed build style to build optimized with symbols
+        
+	* JavaScriptCore.pbproj/project.pbxproj:  removed OPTIMIZATION_CFLAGS
+
+2003-05-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Don.
+
+	- fixed 3239961 - www.phiffer.com doesn't work; uses "var top; top = n;"
+	
+        * kjs/nodes.cpp:
+        (VarDeclNode::evaluate): Check if the property exists with
+	getDirect() instead of hasProperty().
+
+=== Safari-77 ===
+
+2003-04-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+	- fixed 2959353 -- eliminate globally initialized objects from JavaScriptCore
+
+        * JavaScriptCore.pbproj/project.pbxproj: Added fpconst.cpp.
+        * kjs/fpconst.cpp: Added. Defines KJS::NaN and KJS::Inf in a way that does not require a
+        framework init routine.
+
+        * kjs/identifier.h: Use a new KJS_IDENTIFIER_EACH_GLOBAL macro so we can do things to
+        the entire set of identifiers easily. Also added an init function that sets up these globals
+        in a way that does not require a framework init routine.
+        * kjs/identifier.cpp: (Identifier::init): Initialize the property ane globals in a way that
+        does not require a framework init routine.
+
+        * kjs/internal.cpp: (InterpreterImp::initGlobalObject): Call Identifier::init.
+        
+        * kjs/ustring.h: Remove UChar::null and UString::null, and add UString::null(). We can't have
+        a global object of a class that has a constructor if we want to avoid framework init routines,
+        and luckily very little code relies on these.
+        * kjs/ustring.cpp:
+        (UCharReference::ref): Use our own global specific to this function rather than returning
+        UChar::null when past the end of the string. This is dangerous because if the caller modifies
+        it, that affects what all subsequent callers will see.
+        (UString::Rep::create): Added assertions.
+        (UString::UString): Got rid of code here that used to set up UString::null.
+        (UString::null): Added. Returns a global null string, and can be used in some of the places
+        where we used to use the UString::null global.
+        (UString::operator[]): Fixed case where this used to return UChar::null to return '\0' instead.
+
+        * kjs/regexp.cpp: (RegExp::match): Change uses of UString::null to UString::null().
+
+2003-04-25  Darin Adler  <darin@apple.com>
+
+	- fixed 3241344 -- REGRESSION: top of page missing on wired.com and cnn.com
+
+        Caused by the ResolveNode speedup. Roll it out until I can figure out why.
+
+        * kjs/nodes.cpp: (ResolveNode::evaluate): Go back to using evaluateReference.
+
+2003-04-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - a couple improvements that give a 6.6% speedup on iBench JavaScript
+
+        * kjs/nodes.cpp: (ResolveNode::evaluate): Don't use evaluateReference.
+        
+        * kjs/object.cpp: (ObjectImp::get): Do the prototype work with the ValueImp, not a wrapper.
+        Contributes a tiny bit to the speedup, but cleaner anyway.
+        (ObjectImp::hasProperty): Same thing here.
+
+2003-04-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - move from linear probing to double hashing, gives an 0.7% speedup in iBench JavaScript
+
+        * kjs/property_map.h: Remove the hash function.
+        * kjs/property_map.cpp: Added statistics for rehashes and removes.
+        Moved from linear probing to double hashing, using the hash modulo
+        (table size minus one) plus one for the probing distance.
+
+        * kjs/ustring.h: Use unsigned instead of int for hash function result.
+
+=== Safari-75 ===
+
+2003-04-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+	Improved List pool for 3% speed improvement on cvs-js-ibench
+
+        * kjs/list.cpp: Replaced the roving cursor with a free list and
+	raised the high water mark to 384.
+
+2003-04-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Don.
+
+	- JavaScriptCore part of fix for 3158769 - JavaScript triggers not as async as they used to be
+
+	Added a way to get the current interpreter lock count, so Sherlock
+	can unlock the interpreter inside JS method implementations that
+	spend a long time waiting for I/O, allowing more efficient
+	multi-threaded operation.
+
+        * kjs/internal.cpp:
+        (lockInterpreter):
+        (unlockInterpreter):
+        (InterpreterImp::lock):
+        (InterpreterImp::lockCount):
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        (Interpreter::lockCount):
+        * kjs/interpreter.h:
+
+=== Safari-73 ===
+
+=== Safari-72 ===
+
+=== Safari-71 ===
+
+2003-03-31  Darin Adler  <darin@apple.com>
+
+        * English.lproj/InfoPlist.strings: Changed "1.0 Beta" to "1.0 Beta 2".
+        * JavaScriptCore.pbproj/project.pbxproj: Changed "1.0 Beta" to "1.0 Beta 2".
+
+=== Safari-69 ===
+
+2003-03-24  Trey Matteson  <trey@apple.com>
+
+	Pass -seg_addr_table_filename <FILENAME> to ld.  This makes our frameworks in
+	SYMROOT actually work for symbol resolution because they will have the correct
+	prebinding address.  It also fixes obscure B&I problems with prebinding
+	reported by Matt Reda.
+
+	Note the reason all this is tricky for our projects is that we have a different
+	install location for Jaguar and Panther.  The purpose of this arg is to declare
+	at link time our eventual location, which allows the prebinding address to be
+	found in /AppleInternal/Developer/seg_addr_table.  We use a funky back-tick
+	expression within OTHER_LDFLAGS to get a conditional value depending on the
+	build train we are in.
+
+	This can all go away once we only build on Panther and don't embed the
+	frameworks inside the Safari.app wrapper.
+
+ 	In addition I fixed the OTHER_LDFLAGS settings in our build styles to be
+	additive instead of overriding, so we have the args we used for B&I in force
+	when building outside of B&I.
+
+	Reviewed by Maciej.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+=== Safari-68 ===
+
+2003-03-16  Trey Matteson  <trey@apple.com>
+
+	3198135 - need to fix our projects so SYMROOT is not stripped
+
+	Tweaked stripping options:  B&I build does not COPY_PHASE_STRIP.
+	Deployment build still does.
+	We strip manually as part of the install that we do ourselves.
+
+        Reviewed by Maciej.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+=== Safari-67 ===
+
+=== Safari-66 ===
+
+2003-03-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+	- fixed 3193099 -- date parsing can't handle the time zone format that date formatting produces
+
+        * kjs/date_object.cpp: (KJS::KRFCDate_parseDate): Allow a "GMT" prefix before the time zone offset.
+
+=== Safari-65 ===
+
+2003-03-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - got rid of some framework initialization (working on bug 2959353)
+
+        * kjs/identifier.h: Turn Identifier:null into Identifier:null().
+        * kjs/identifier.cpp: Removed Identifier:null and added Identifier:null().
+
+        * kjs/internal.cpp: Made NaN_Bytes and Inf_Bytes const.
+
+        * kjs/completion.h: Use Identifier:null() instead of Identifier:null.
+        * kjs/function.h: Ditto.
+        * kjs/function_object.cpp: (FunctionObjectImp::construct): Ditto.
+        * kjs/nodes.cpp: (FuncExprNode::evaluate): Use Identifier:null() instead of Identifier:null.
+
+2003-03-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Trey.
+
+	- fixed 3158833 - ebay prefs page is so slow, it seems like a hang.
+
+	92% speed improvement on ebay prefs page.
+	1% speed improvement on js-ibench and js-performance plt suites.
+	
+	There were a couple of problems with the identifier hash table that
+	I fixed:
+	
+        * kjs/identifier.cpp:
+	(void Identifier::remove): Adjust the shrink threshold to avoid
+	constantly growing and shrinking.
+        * kjs/ustring.cpp:
+        (UString::Rep::computeHash): Use a better hash function that
+	avoids collisions for obvious data sets.
+
+=== Safari-64 ===
+
+=== Safari-63 ===
+
+2003-02-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+	- fixed 3156705 - REGRESSION: javascript menus improperly placed at umich.edu store
+
+        * kjs/nodes.cpp:
+        (StatListNode::execute): If the first statement's completion is
+	not normal, return immediately.
+
+2003-02-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed 3142355 -- nil-deref in CFTimeZoneCopyAbbreviation
+
+        The real problem wasn't with the current time zone, but with the UTC time zone.
+        The poor sod had a broken /usr/share/zoneinfo directory, with a 0-byte-long UTC file.
+
+        * kjs/date_object.cpp: (UTCTimeZone): Use CFTimeZoneCreateWithTimeIntervalFromGMT(NULL, 0.0)
+        to get the universal time zone instead of getting it by name.
+
+=== Safari-62 ===
+
+2003-02-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Trey and Ken.
+
+        - fixed 3142355 -- nil-deref in CFTimeZoneCopyAbbreviation
+
+        Although I can't reproduce this bug, it seems that it's caused by CFTimeZoneCopyDefault returning NULL.
+        I'm almost certain that the UTC time zone will be created successfully in this case, so I'll just use that.
+
+        * kjs/date_object.cpp:
+        (UTCTimeZone): Added. Gets the UTC time zone (once in a global).
+        (CopyLocalTimeZone): Added. Gets the local time zone, but falls back to UTC.
+        (gmtimeUsingCF): Use UTCTimeZone.
+        (localtimeUsingCF): Use CopyLocalTimeZone.
+        (mktimeUsingCF): Use CopyLocalTimeZone.
+        (timegmUsingCF): Use UTCTimeZone.
+
+2003-02-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        - fixed 3145442 -- toString(16) is not working, causing non-ASCII characters in mac.com homepage to be munged
+
+        * kjs/number_object.cpp: (NumberProtoFuncImp::call): Add handling for toString with a radix other than
+        10 passed as an argument.
+
+2003-02-11  Trey Matteson  <trey@apple.com>
+
+	Set -seg1addr in our build styles, but not for the B&I build.
+	This makes our SYMROOTS from B&I usable to determine symbols from crash
+	logs from the field.
+	Also nuked DeploymentFat build style.
+
+        Reviewed by Ken.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+2003-02-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Updated to build the framework
+	standalone instead of embedded when doing a B&I build for Panther.
+
+=== Safari-55 ===
+
+2003-01-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+        * kjs/scope_chain.cpp: Rolled out the fix to bug 3137084.
+        It caused a massive storage leak, and probably didn't even fix the bug.
+
+2003-01-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+	- fixed 3157318 -- hang at time zone page after clicking on map at www.time.gov
+
+        * kjs/date_object.cpp: (KJS::KRFCDate_parseDate): Allow a comma after the day.
+        Given how this code is structured, it allows commas in unwanted contexts too, but
+        that's almost certainly harmless.
+
+2003-01-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed 3144918 -- Can't drill down multiple levels of categories when selling on ebay
+        if first item in list is chosen
+        
+        The bug was caused by having array values in the property map past the storageLength cutoff
+        in an array object; those values would not be seen when you do a get.
+
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::put): Implement a new rule for resizing the storage that is independent
+        of the length. The old rule would sometimes make the storage very big if you added two elements
+        in a row that both had large, but consecutive indexes. This eliminates any cases where we
+        make sparse entries in the property map below the sparse array cutoff.
+        (ArrayInstanceImp::resizeStorage): Don't ever make storage size bigger than the cutoff unless
+        the caller specifically requests it.
+        (ArrayInstanceImp::setLength): Change this so it only makes the storage smaller, never larger.
+        We will actually enlarge the storage when putting elements in.
+
+2003-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/Makefile.am: Add dependencies so the .lut.h files get rebuilt if the script changes.
+
+=== Safari-54 ===
+
+2003-01-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+	- fixed 3137084 -- Many non-reproducible crashers in ContextImp::mark / ScopeChain::mark
+
+        * kjs/scope_chain.cpp: (ScopeChain::push): Add assertion.
+        (ScopeChain::release): Fix while loop so that it decrements refCount of the first node in
+        the chain too.
+
+2003-01-21  Darin Adler  <darin@apple.com>
+
+        - correct our copyrights to 2003; copyright is based on year of publication, not year worked on
+
+2003-01-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+	- made minor tweaks to work better with Mozilla's JavaScript tests.
+
+        * kjs/testkjs.cpp:
+        (VersionFunctionImp::call): Implemented 
+        (main): Ignore files named -f (hack to match -f <filename syntax
+	that moz JavaScript tests expect). Also use return code 3 instead
+	of 1 for uncaught exception.
+
+2003-01-16  Darin Adler  <darin@apple.com>
+
+        * kjs/number_object.cpp: (NumberObjectImp::construct):
+	Fix build, remove stray space.
+
+2003-01-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+	- rolled in a change from the KJS folks
+
+        * kjs/number_object.h: Use ObjectImp *, not Object, for the proto.
+        * kjs/number_object.cpp:
+        (NumberInstanceImp::NumberInstanceImp): Use ObjectImp *, not Object, for the proto.
+        (NumberPrototypeImp::NumberPrototypeImp): Pass ObjectImp.
+        (NumberObjectImp::construct): Use ObjectImp.
+
+=== Safari-52 ===
+
+2003-01-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+	- rolled in a change from the KJS folks
+
+	Fixes a bug where the date functions would not accept non-strings.
+	And provides a bit of a speedup.
+
+        * kjs/date_object.h: Change parameter type for parseDate.
+        * kjs/date_object.cpp:
+        (DateObjectFuncImp::call): Always call toString, don't check the type.
+        (KJS::parseDate): Take a UString parameter, not a String parameter.
+
+2003-01-13  Darin Adler  <darin@apple.com>
+
+        * kjs/ustring.h: Fix spelling of occurrence.
+
+2003-01-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+	- turned more recursion into iteration, and fixed some backwards stuff
+
+        * kjs/grammar.y: Use the normal idiom for CaseClauses and FormalParameterList
+	rather than using append().
+        * kjs/grammar.cpp: Regenerated.
+
+        * kjs/nodes.h: Change ClauseListNode and ParameterNode to use the normal idiom,
+	and got rid of append methods. Also added friend declarations and calls to reverseList().
+        * kjs/nodes.cpp:
+        (StatListNode::ref): Iteration, not recursion.
+        (StatListNode::deref): Iteration, not recursion.
+        (StatListNode::execute): Iteration, not recursion.
+        (StatListNode::processVarDecls): Iteration, not recursion.
+        (CaseClauseNode::reverseList): Added.
+        (ClauseListNode::ref): Iteration, not recursion.
+        (ClauseListNode::deref): Iteration, not recursion.
+        (ClauseListNode::processVarDecls): Iteration, not recursion.
+        (CaseBlockNode::reverseLists): Added.
+        (ParameterNode::ref): Iteration, not recursion.
+        (ParameterNode::deref): Iteration, not recursion.
+        (FuncDeclNode::reverseParameterList): Added.
+        (FuncExprNode::reverseParameterList): Added.
+        (SourceElementsNode::ref): Iteration, not recursion.
+        (SourceElementsNode::deref): Iteration, not recursion.
+        (SourceElementsNode::execute): Use variable name of n to match other functions.
+        (SourceElementsNode::processFuncDecl): Ditto.
+        (SourceElementsNode::processVarDecls): Ditto.
+
+        * kjs/nodes2string.cpp:
+        (SourceStream::operator<<): Used a switch statement for a bit of added clarity.
+        (ElementNode::streamTo): Iteration, not recursion.
+        (PropertyValueNode::streamTo): Iteration, not recursion.
+        (ArgumentListNode::streamTo): Iteration, not recursion.
+        (StatListNode::streamTo): Iteration, not recursion, and fixed order.
+        (VarDeclListNode::streamTo): Iteration, not recursion.
+        (ClauseListNode::streamTo): Used for statement to match other functions.
+        (CaseBlockNode::streamTo): Used for statement to match other functions.
+        (ParameterNode::streamTo): Iteration, not recursion.
+        (SourceElementsNode::streamTo): Iteration, not recursion, and fixed order that has been
+	backwards since I changed how this works in nodes.cpp.
+
+2003-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+	- changes inspired by things I noticed reviewing diffs vs. KDE when preparing the tarball
+
+        * kjs/function.cpp: (GlobalFuncImp::call): Use strtol when strtoll is
+	not available. Do #ifndef NDEBUG, not #if !NDEBUG.
+        * kjs/function.h: Do #ifndef NDEBUG, not #if !NDEBUG.
+        * kjs/internal.cpp:
+        (InterpreterImp::initGlobalObject): Do #ifndef NDEBUG, not #if !NDEBUG.
+        (KJS::printInfo): Remove case for ListType and remove default case that just
+	ends up suppressing the "missing case" warning and does no good.
+        * kjs/interpreter.cpp: (Interpreter::evaluate): Do #ifndef NDEBUG, not #if !NDEBUG.
+        * kjs/nodes.cpp:
+        (Node::finalCheck): Fix accidentally-deleted code in an ifdef we never compile.
+        (FunctionCallNode::evaluate): Remove bogus XXX comment. Maciej put this comment in,
+        and together we determined it's not needed.
+        (TypeOfNode::evaluate): Ditto.
+        * kjs/object.cpp: Remove assert that refers to ListType.
+        * kjs/value.h: Remove ListType.
+
+2003-01-09  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Add the year 2003, remove CFBundleIconFile,
+	bump marketing version to 0.8.1 and version to 52u to keep up with the branch,
+	remove CFHumanReadableCopyright, remove NSPrincipalClass.
+
+        * English.lproj/InfoPlist.strings: Updated to match above changes.
+
+2003-01-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by no one cause I'm just changing copyright strings.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Added non-Apple copyrights to
+	copyright strings.
+        * English.lproj/InfoPlist.strings: Likewise.
+
+2003-01-05  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Fix "Apple Compupter" typo.
+	Remove unneeded CFBundleLongVersionString we don't use anywhere else.
+
+2003-01-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+	- fixed 3138213 -- browser hangs trying to open Apple travel site
+
+        * kjs/date_object.cpp: (timetUsingCF): Check for very-negative year numbers too.
+
+=== Alexander-48 ===
+
+=== Alexander-47 ===
+
+2002-12-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Don and Maciej.
+
+	- follow-on to my fix for 3134693 that fixes one more case of recursion and simplifies further
+
+        * kjs/grammar.y: Remove SourceElementNode and just use a StatementNode instead.
+	Reverse SourceElements rule so the recursive rule comes first as in the original
+	KJS code (avoids actual parser recursion).
+
+        * kjs/grammar.cpp: Regenerated.
+        * kjs/grammar.cpp.h: Regenerated.
+        * kjs/grammar.h: Regenerated.
+
+        * kjs/nodes.h: Make processFuncDecl a virtual function in StatementNode so that we can
+	use a StatementNode instead of a SourceElementNode. Add a call to reverseList in BlockNode
+	to correct the order of the linked list in SourceElementsNode, to replace the technique
+	where we reversed it in the parser. Remove SourceElementNode class, and make the element in
+	SourceElementsNode be a StatementNode instead.
+        * kjs/nodes.cpp: Remove SourceElementNode code.
+        (StatementNode::processFuncDecl): Added empty function.
+        (BlockNode::reverseList): Added. Used to make the SourceElements list ordered correctly.
+        * kjs/nodes2string.cpp: Remove SourceElementNode code.
+
+=== Alexander-46 ===
+
+2002-12-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Gramps and Ken.
+	Checked in by Ken.
+
+	- fixed 3134693 -- carsdirect.com crash on used car search, due to large JavaScript array
+
+	The parser was using recursion to handle many types of lists.
+	This meant that we crashed out of stack space when any of the lists were extra big.
+	I applied the same sort of fix we had already applied a while back for argument lists for
+	all the other types of lists, including the list of ElementNode that was the reason for
+	the crash reported here.
+
+        * kjs/grammar.y: Removed ElisionNode altogether and just use a count.
+	Use specific node types for PropertyNameAndValueList and PropertyName.
+
+        * kjs/grammar.cpp: Regenerated.
+        * kjs/grammar.cpp.h: Regenerated.
+        * kjs/grammar.h: Regenerated.
+
+        * kjs/nodes.h: Elide "ElisionNode", changing objects to keep elision counts instead.
+	Make the ObjectLiteralNode list field be PropertyValueNode, not just Node.
+	Make PropertyValueNode fields have specific types. Add new reverse list functions, calls
+	to those functions in the constructors, and friend declarations as needed so the class
+	that holds the head of a list can reverse the list during parsing.
+        * kjs/nodes.cpp:
+        (ElementNode::ref): Use iteration instead of recursion. Also elide "elision".
+        (ElementNode::deref): Ditto.
+        (ElementNode::evaluate): Use iteration instead of recursion, taking advantage of
+	the fact that the linked list is reversed. Also use the elision count rather than
+	an elision list.
+        (ArrayNode::reverseElementList): Reverse the list so we can iterate normally.
+        (ArrayNode::ref): Elide "elision".
+        (ArrayNode::deref): Ditto.
+        (ArrayNode::evaluate): Use elision count instead of elision list.
+        (ObjectLiteralNode::reverseList): Reverse the list so we can iterate normally.
+        (PropertyValueNode::ref): Use iteration instead of recursion.
+        (PropertyValueNode::deref): Use iteration instead of recursion.
+        (PropertyValueNode::evaluate): Use iteration instead of recursion, taking advantage
+	of the fact that the linked list is reversed.
+        (ArgumentListNode::ref): Change code to match the other similar cases we had to revise.
+        (ArgumentListNode::deref): Ditto.
+        (ArgumentListNode::evaluateList): Ditto.
+        (ArgumentsNode::reverseList): Ditto.
+        (VarDeclListNode::ref): Use iteration instead of recursion.
+        (VarDeclListNode::deref): Ditto.
+        (VarDeclListNode::evaluate): Use iteration instead of recursion, taking advantage
+	of the fact that the linked list is reversed.
+        (VarDeclListNode::processVarDecls): Ditto.
+        (VarStatementNode::reverseList): Reverse the list so we can iterate normally.
+        (FunctionBodyNode::FunctionBodyNode): Use BlockNode as the base class, removing
+	most of the FunctionBodyNode class.
+
+        * kjs/nodes2string.cpp:
+        (ElementNode::streamTo): Update for using a count for elision, and reverse linking.
+        (ArrayNode::streamTo): Update for using a count for elision.
+        (PropertyValueNode::streamTo): Update for reverse linking.
+        (ArgumentListNode::streamTo): Update for reverse linking. This has been wrong for
+	a while, since we added the reverse a long time ago.
+        (VarDeclListNode::streamTo): Update for reverse linking.
+        (ParameterNode::streamTo): Update for reverse linking.
+
+=== Alexander-45 ===
+
+2002-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Don and John.
+
+	- fixed 3134449 -- Date.UTC returns NaN (invalid date)
+
+	Did more testing of the date functions and made them behave like the other browsers.
+	There were three problems:
+
+            1) We did a validity check that other browsers don't do (hence the NaN).
+            2) We treated passed-in dates as local time even in Date.UTC (hence a wrong result
+               once I fixed the NaN).
+            3) The results of ToUTCString (and ToGMTString) weren't formatted quite the same
+	       as other browsers.
+
+	Also found a couple of silly but unrelated coding mistakes.
+
+        * kjs/date_object.cpp:
+        (timetUsingCF): Added. Has the guts of mktimeUsingCF, but without the CFGregorianDateIsValid
+        check. Other browsers accept invalid dates. Also takes a time zone parameter.
+        (mktimeUsingCF): Calls timetUsingCF with the current time zone.
+        (timegmUsingCF): Calls timetUsingCF with the UTC time zone.
+        (formatDate): Remove the includeComma flag.
+        (formatDateUTCVariant): Added. For use instead of formatDate with the includeComma flag.
+	Puts the day before the month name.
+        (DateProtoFuncImp::call): Use the new formatDateUTCVariant for ToGMTString and ToUTCString.
+	Without this change the date didn't match other browsers.
+        (DateObjectImp::DateObjectImp): Use UTCPropertyName. Somehow I declared this and didn't use
+	it before.
+        (DateObjectImp::construct): Pass -1 for is_dst literally instead of using invalidDate.
+	Changing this to invalidDate was just a mistake (although no real difference in compiled
+	code since invalidDate is just -1).
+        (DateObjectFuncImp::call): Call timegm for the UTC case instead of mktime.
+
+=== Alexander-44 ===
+
+=== Alexander-43 ===
+
+2002-12-20  Trey Matteson  <trey@apple.com>
+
+	We now build with symbols the B&I.  Deployment builds are without symbols,
+	so it is easy to generate a non-huge app as a one-off.
+
+        Reviewed by Darin
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+=== Alexander-42 ===
+
+=== Alexander-41 ===
+
+=== Alexander-40 ===
+
+2002-12-18  Maciej Stachowiak  <mjs@apple.com>
+
+	Reviewed by John.
+
+	- fixed 3131171 - Change Alex versions to satisfy both marketing and B&I requirements
+	
+        * English.lproj/InfoPlist.strings:
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+2002-12-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Trey.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Removed signature.
+
+=== Alexander-39 ===
+
+=== Alexander-38 ===
+
+2002-12-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Don and Maciej.
+
+	- fixed 3129115 -- need Apple copyright added to open source documents
+
+	* tons of files: Added our copyright to files we modified, and updated all to standard format.
+
+	- other changes
+
+        * JavaScriptCore.pbproj/project.pbxproj: Set MACOSX_DEPLOYMENT_TARGET to 10.2.
+	Also removed completion.cpp.
+        * kjs/completion.cpp: Removed.
+        * kjs/completion.h: Made the Completion constructor inline.
+
+        * kjs/grammar.y: Removed an obsolete "pretend ifdef". No need to put these in APPLE_CHANGES now.
+
+=== Alexander-37 ===
+
+=== JavaScriptCore-37u2 ===
+
+2002-12-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Bump version to 37u2.
+
+2002-12-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Make dtoa.h visible as an SPI so I can
+	use it inside QString.
+
+2002-12-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+	- further corrections to number printing.
+
+        * kjs/ustring.cpp:
+        (UString::from): Make number printing match the ECMA standard
+	algorithm.
+
+2002-12-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dave.
+
+	- fix toString() conversion for numbers less than 1. Negative
+	exponents are still wrong though (things like 1E-34).
+ 
+        * kjs/ustring.cpp:
+	(UString::from): Don't print empty string for numbers less than 1,
+	and remember to add extra 0s after the decimal for negative
+	decimal positions.
+	
+=== Alexander-37u1 ===
+
+=== Alexander-36 ===
+
+2002-12-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+	- fixed 3056449 - can't select state at tucows.com
+
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+	(ArrayInstanceImp::propList): Add numeric proprties that are in
+	special storage.
+        * kjs/array_object.h:
+        * kjs/object.h: Make propList a virtual method.
+
+2002-12-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Don.
+
+	- Add kjsprint global function in Development build for ease of	debugging.
+	- Print uncaught JavaScript exceptions to the console in Development.
+	- Improve wording of exception error messages.
+	
+        * kjs/function.cpp:
+        (GlobalFuncImp::call):
+        * kjs/function.h:
+        * kjs/internal.cpp:
+        (InterpreterImp::initGlobalObject):
+        * kjs/interpreter.cpp:
+        (Interpreter::evaluate):
+        * kjs/nodes.cpp:
+        (NewExprNode::evaluate):
+        (FunctionCallNode::evaluate):
+        (RelationalNode::evaluate):
+
+2002-12-10  John Sullivan  <sullivan@apple.com>
+
+	Fixed more "Alexander"s that were lurking in places I forgot 
+	to look before.
+
+        Reviewed by Darin
+
+        * Makefile.am:
+	"rm -rf $(SYMROOTS)/Safari.app/Frameworks/JavaScriptCore.framework"
+
+2002-12-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Bump versions to 0.8 and 35u.
+	* English.lproj/InfoPlist.strings: In here too.
+
+2002-12-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+	- fixed 3059637 - all articles missing at excite.com sports page
+	- fixed 3065903 - most of content missing at excite.com news page
+
+	These bugs both came up because a JavaScript function has a var
+	declaration that collides with a function parameter name.
+	
+        * kjs/nodes.cpp:
+        (VarDeclNode::processVarDecls): Don't set the property to
+	undefined if a property with that name is already set on the
+	global object. Otherwise we may clobber function parameters with
+	undefined even before hitting a possible var initializer.
+
+2002-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by: Darin Adler
+
+	- made framework embedding work correctly with buildit
+
+        * JavaScriptCore.pbproj/project.pbxproj: Give framework a relative
+	install path, don't install it the normal way, and copy it
+	manually to /AppleInternal/Library/Frameworks if installing.
+
+=== Alexander-35 ===
+
+2002-12-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by: Richard Williamson
+
+	Added explicit lock/unlock methods so Sherlock can grab the
+	interpreter lock as needed.
+	
+	- partially addressed 3084320 - JavaScriptCore crash
+	
+        * kjs/internal.cpp:
+        (InterpreterImp::InterpreterImp):
+        (InterpreterImp::lock):
+        (InterpreterImp::unlock):
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        (Interpreter::lock):
+        (Interpreter::unlock):
+        * kjs/interpreter.h:
+
+2002-12-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by: Darin Adler
+
+	Set things up so JavaScriptCore builds in PCRE and uses it for
+	regular expressions. This fixes many form validation bugs:
+
+	- fixed 3103197 - javascript at fidelity.com rejects valid input
+	- fixed 2942552 - form validation at weather.com fails
+	- fixed 3079752 - js always reports textarea is empty
+	- fixed 3079719 - covad.com "check availalbility" fails
+	
+        * Makefile.am: Add pcre subdir.
+        * kjs/config.h: define HAVE_PCREPOSIX to true.
+	* kjs/regexp.h: Don't include pcreposix.h since nothing from there
+	is used.
+	* pcre/.cvsignore: Added.
+        * pcre/ChangeLog: Removed.
+        * pcre/INSTALL: Removed.
+        * pcre/Makefile.am: Added.
+        * pcre/Makefile.in: Removed.
+        * pcre/NEWS: Removed.
+        * pcre/NON-UNIX-USE: Removed.
+        * pcre/README: Removed.
+        * pcre/chartables.c: Added.
+        * pcre/config.guess: Removed.
+        * pcre/config.in: Removed.
+        * pcre/config.sub: Removed.
+        * pcre/configure: Removed.
+        * pcre/configure.in: Removed.
+        * pcre/dll.mk: Removed.
+        * pcre/doc/Tech.Notes: Removed.
+        * pcre/doc/pcre.3: Removed.
+        * pcre/doc/pcre.html: Removed.
+        * pcre/doc/pcre.txt: Removed.
+        * pcre/doc/pcregrep.1: Removed.
+        * pcre/doc/pcregrep.html: Removed.
+        * pcre/doc/pcregrep.txt: Removed.
+        * pcre/doc/pcreposix.3: Removed.
+        * pcre/doc/pcreposix.html: Removed.
+        * pcre/doc/pcreposix.txt: Removed.
+        * pcre/doc/pcretest.1: Removed.
+        * pcre/doc/pcretest.html: Removed.
+        * pcre/doc/pcretest.txt: Removed.
+        * pcre/doc/perltest.txt: Removed.
+        * pcre/install-sh: Removed.
+        * pcre/ltmain.sh: Removed.
+        * pcre/pcre-config.h: Added.
+        * pcre/pcre-config.in: Removed.
+        * pcre/internal.h: Include pcre-config.h instead of config.h
+        * pcre/pcre.c:
+        (ord2utf8): Fix warnings.
+        (pcre_compile): Fix warnings.
+        * pcre/pcre.def: Removed.
+        * pcre/pcre.h: Added.
+        * pcre/pcre.in: Removed.
+        * JavaScriptCore.pbproj/project.pbxproj: Added pcre files to build.
+        * JavaScriptCorePrefix.h: Guard c++ headers with #ifdef __cplusplus.
+
+2002-12-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by: Richard Williamson
+
+        * pcre/doc/*: Added.
+        * pcre/testdata/*: Added.
+
+2002-12-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by: Darin Adler
+
+	- imported PCRE 3.9 into the tree; this isn't actually compiled or
+	used yet.
+
+        * pcre/*: Added.
+
+== Rolled over to ChangeLog-2002-12-03 ==
diff --git a/ChangeLog-2007-10-14 b/ChangeLog-2007-10-14
new file mode 100644
index 0000000..693f966
--- /dev/null
+++ b/ChangeLog-2007-10-14
@@ -0,0 +1,26221 @@
+=== Start merge of feature-branch 2007-10-12 ===
+
+2007-10-11  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Eric Seidel.
+        
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=15076
+        "deg2rad has multiple definitions"
+        
+        Define deg2rad, rad2deg, deg2grad, grad2deg, rad2grad, grad2rad
+        These are used through WebKit.
+        
+        Change based on original patch by Rob Buis.
+
+        * wtf/MathExtras.h:
+        (deg2rad):
+        (rad2deg):
+        (deg2grad):
+        (grad2deg):
+        (rad2grad):
+        (grad2rad):
+
+2007-10-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+        
+        - fix assertion failures on quit.
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction): Dynamically alocate function-scope static
+        UStrings to avoid the static destructor getting called later.
+        * kjs/lookup.h: Dynamically alocate function-scope static
+        Identifiers to avoid the static destructor getting called later.
+
+2007-10-07  Ed Schouten  <ed@fxq.nl>
+
+        Reviewed and landed by Alexey Proskuryakov.
+
+        Add PLATFORM(FREEBSD), so we can fix the build on FreeBSD-like
+        systems by including <pthread_np.h>. Also fix some (disabled)
+        regcomp()/regexec() code; it seems some variable names have
+        changed.
+
+        * kjs/config.h:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        * wtf/Platform.h:
+
+2007-10-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=10370
+        RegExp fails to match non-ASCII characters against [\S\s]
+
+        Test: fast/js/regexp-negative-special-characters.html
+
+        * pcre/pcre_compile.c:
+        (compile_branch): Adjust opcode and bitmap as necessary to include (or exclude)
+        character codes >255. Fix suggested by Philip Hazel.
+
+        * pcre/pcre_exec.c:
+        (match): Merged fix for PCRE bug 580 (\S\S vs. \S{2}).
+
+        * tests/mozilla/expected.html: One test was fixed.
+        * pcre/MERGING: Added information about this fix.
+
+2007-10-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - skip extra hash lookup and avoid converting char* to UString for 19% speedup on CK JS array test 
+        http://bugs.webkit.org/show_bug.cgi?id=15350
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction): Implement the two mentioned optimizations.
+
+2007-10-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark.
+        
+        - Efficiently handle regexp property identifiers for 19% speedup on Celtic Kane regexp test
+        http://bugs.webkit.org/show_bug.cgi?id=15337
+
+        * kjs/CommonIdentifiers.h:
+        * kjs/regexp_object.cpp:
+        (RegExpProtoFunc::callAsFunction):
+        (RegExpObjectImp::arrayOfMatches):
+        (RegExpObjectImp::construct):
+
+2007-10-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark.
+        
+        - Cache global prorotypes more efficiently for 10% speedup on CK AJAX benchmark
+        http://bugs.webkit.org/show_bug.cgi?id=15335
+
+        * kjs/lookup.h:
+
+2007-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark.
+
+        Enable Experimental SVG features by default when building from Xcode
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2007-09-29  Rob Buis  <buis@kde.org>
+
+        Reviewed by Adam.
+
+        http://bugs.webkit.org/show_bug.cgi?id=13472
+        Misparsing date in javascript leads to year value of -1
+        http://bugs.webkit.org/show_bug.cgi?id=14176
+        Some date values not handled consistently with IE/Firefox
+
+        Allow an optional comma between month and year, and year and time.
+
+        * kjs/date_object.cpp:
+        (KJS::parseDate):
+
+2007-07-11  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Mark.
+
+        Forwardport the hash table fix from CodeGeneratorJS.pm to create_hash_table.
+        Reran run-jsc-tests, couldn't find any regressions. Suggested by Darin.
+
+        * kjs/create_hash_table:
+
+2007-06-25  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej.
+        
+        Use intHash to hash floats and doubles too.
+
+        * ChangeLog:
+        * wtf/HashFunctions.h:
+        (WTF::FloatHash::hash):
+        (WTF::FloatHash::equal):
+        (WTF::):
+        * wtf/HashTraits.h:
+        (WTF::FloatHashTraits::emptyValue):
+        (WTF::FloatHashTraits::deletedValue):
+        (WTF::):
+
+=== End merge of feature-branch 2007-10-12 ===
+
+2007-10-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fix for <rdar://problem/5488678>.  Disable debugging symbols in production builds for 10.4
+        PowerPC to prevent a huge STABS section from being generated.
+
+        * Configurations/Base.xcconfig:
+
+2007-10-08  George Staikos  <staikos@kde.org>
+
+        Reviewed by Adam Roben.
+
+        Fix Qt build on Win32.
+
+        * kjs/testkjs.cpp:
+        (main):
+
+2007-10-10  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Lars.
+
+        Fix compilation using gcc 4.3. Header files have been reorganized and as a result some extra
+        includes are needed for INT_MAX, std::auto_ptr and the like.
+
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/lexer.cpp:
+        * kjs/scope_chain.cpp:
+        * kjs/ustring.cpp:
+        * wtf/Vector.h:
+
+2007-10-09  Lars Knoll  <lars@trolltech.com>
+
+        Reviewed by Simon.
+
+        fix the invokation of slots with return types. Add a JSLock around the conversion from QVariant to JSValue.
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::invokeMethod):
+        * bindings/qt/qt_runtime.cpp:
+        (KJS::Bindings::convertValueToQVariant):
+        (KJS::Bindings::convertQVariantToValue):
+
+2007-10-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added JSObject::removeDirect, to support the fix for 
+        <rdar://problem/5522487> REGRESSION: With JavaScript disabled, any 
+        page load causes a crash in PropertyMap::put
+
+        * kjs/object.cpp:
+        (KJS::JSObject::removeDirect):
+        * kjs/object.h:
+
+2007-10-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver.
+
+        Switch to default level of debugging symbols to resolve <rdar://problem/5488678>.
+        The "full" level appears to offer no observable benefits even though the documentation
+        suggests it be used for dead code stripping.  This should also decrease link times.
+
+        * Configurations/Base.xcconfig:
+
+2007-10-03  Lars Knoll  <lars@trolltech.com>
+
+        Reviewed by Rob.
+
+        Fix a stupid bug in Unicode::toUpper/toLower.
+        Fixes all three test failures in the JavaScriptCore test
+        suite.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+
+2007-10-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam.
+
+        - add support for GDI objects to OwnPtr; I plan to use this
+          to fix some GDI handle leaks
+
+        * kjs/grammar.y: Change parser to avoid macros that conflict
+        with macros defined in Windows system headers: THIS, DELETE,
+        VOID, IN, and CONST. This is needed because OwnPtr.h will now
+        include <windows.h>.
+        * kjs/keywords.table: Ditto.
+
+        * wtf/OwnPtr.h: For PLATFORM(WIN), add support so that OwnPtr can be
+        a GDI handle, and it will call DeleteObject. Also change to use the
+        RemovePointer technique used by RetainPtr, so you can say OwnPtr<HBITMAP>
+        rather than having to pass in the type pointed to by HBITMAP.
+
+        * wtf/OwnPtrWin.cpp: Added.
+        (WebCore::deleteOwnedPtr): Put this in a separate file so that we
+        don't have to include <windows.h> in OwnPtr.h.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added OwnPtrWin.cpp.
+
+2007-09-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark.
+
+        -Fix http://bugs.webkit.org/show_bug.cgi?id=13226.
+        Remove Bakefiles from svn.
+
+        * JavaScriptCoreSources.bkl: Removed.
+        * jscore.bkl: Removed.
+
+2007-09-27  Kevin Decker  <kdecker@apple.com>
+
+        Rubber stamped by John Sullivan.
+
+        <rdar://problem/5493093>
+        
+        * JavaScriptCore.order: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj: We're changing from using an order file built by
+         another team to using one we actually check into our project repository. Linker settings for
+         Symbol Ordering Flags have been updated accordingly.
+
+2007-09-26  Adam Roben  <aroben@apple.com>
+
+        Make testkjs delay-load WebKit.dll so WebKitInitializer can work its magic
+
+        Rubberstamped by Anders.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2007-09-25  Adam Roben  <aroben@apple.com>
+
+        Make testkjs delay-load its dependencies
+
+        This lets WebKitInitializer re-route the dependencies to be loaded out
+        of the Safari installation directory.
+
+        Rubberstamped by Sam.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2007-09-25  David Kilzer  <ddkilzer@webkit.org>
+
+        Reviewed by Adam.
+
+        - Fix http://bugs.webkit.org/show_bug.cgi?id=14885
+          LGPL'ed files contain incorrect FSF address
+
+        * COPYING.LIB:
+        * bindings/testbindings.cpp:
+        * kjs/AllInOneFile.cpp:
+        * kjs/DateMath.cpp:
+        * kjs/PropertyNameArray.cpp:
+        * kjs/PropertyNameArray.h:
+        * kjs/config.h:
+
+2007-09-25  Sam Weinig  <sam@webkit.org>
+
+        Fix location for build products for Debug_Internal.
+
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2007-09-25  Adam Roben  <aroben@apple.com>
+
+        Make testkjs use WebKitInitializer
+
+        Reviewed by Sam.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add WebKitInitializer and
+        make testkjs depend on it.
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj: Link against
+        WebKitInitializer.lib.
+        * kjs/testkjs.cpp:
+        (main): Call initializeWebKit.
+
+2007-09-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        - Continued to update project files to not use Edit and Continue for Debug Information since it doesn't work and breaks some functionality.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2007-09-21  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        - Updated project files to not use Edit and Continue for Debug Information since it doesn't work and breaks some functionality.
+
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2007-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber stamped by Adam.
+
+        Renamed files from *Gdk to *Gtk (see #14732) using the
+        work of Juan A. Suarez Romero as a base.
+
+        GDK -> GTK 
+
+        * JavaScriptCore.pri:
+        * kjs/testkjs.pro:
+        * pcre/dftables.pro:
+        * wtf/Platform.h: PLATFORM(GDK) to PLATFORM(GTK)
+
+2007-09-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15250
+        <rdar://problem/5496942> REGRESSION: Reproducible crash in Safari when evaluating script in Drosera console (15250)
+
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction): Null-check thisObj before passing it to interpreterForGlobalObject.
+
+2007-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber stamped by Adam.
+
+        Make the guard/#if use the same name (ENABLE_FTPDIR) as the #define. This follows
+        the ENABLE_ICONDATABASE example from a couple of lines above.
+
+        * wtf/Platform.h:
+
+2007-09-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej.
+
+        <rdar://problem/5487107> NULL dereference crash in FastMallocZone::enumerate when running leaks against Safari
+
+        Storing remote pointers to their local equivalents in mapped memory was leading to the local pointer being
+        interpreted as a remote pointer.  This caused a crash when using the result of mapping this invalid remote pointer.
+        The fix is to follow the pattern used elsewhere in FastMallocZone by always doing the mapping after reading and
+        never storing the mapped pointer.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::FastMallocZone::enumerate):
+
+2007-09-15  Darin Adler  <darin@apple.com>
+
+        - fix Mac build
+
+        * JavaScriptCore.exp: Export WTFLogVerbose.
+
+2007-09-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        - Copy JSRetainPtr to include folder.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2007-09-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix GDK build.
+
+        * wtf/MathExtras.h:
+        (wtf_random_init):
+
+2007-09-12  Geoff Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/5429064> 141885 Safari JavaScript: Math.random() slightly less randomly distributed than on Safari / Mac
+
+        Math.random was skewed slightly upward because it assumed that RAND_MAX was outside the range of
+        values that rand() might return. This problem was particularly pronounced on Windows because
+        the range of values returned by rand() on Windows is 2^16 smaller than the range of values
+        return by rand() on Mac.
+        
+        Fixed by accounting for RAND_MAX return values. Also, switched Windows over to rand_s, which has
+        a range that's equal to rand()'s range on Mac.
+        
+        * kjs/config.h:
+
+        * kjs/math_object.cpp:
+        (MathFuncImp::callAsFunction): Use the new new thing.
+
+        * wtf/MathExtras.h: Platform abstraction for random numbers, to cover over differences on Windows.
+        (wtf_random_init):
+        (wtf_random):
+
+2007-09-13  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej.
+        
+        Small addition to previous path to cover
+        http://bugs.webkit.org/show_bug.cgi?id=11399
+        window.eval runs in the global scope of the calling window
+        
+        Switch variable scope as well.
+
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction):
+
+2007-09-12  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Geoff, Maciej.
+        
+        Fix <rdar://problem/5445058>
+        REGRESSION: Unable to upload picture to eBay auction due to domain security check
+        
+        eBay uses window.eval() between windows. In Firefox window.eval() switches execution
+        and security context to the target window, something WebKit did not do. With WebKit
+        security tightening in r24781, this broke picture uploads.
+        
+        Fix by making WebKit switch context in window.eval().
+        
+        * kjs/Context.cpp:
+        (KJS::Context::Context):
+        (KJS::Context::~Context):
+        * kjs/context.h:
+        Save and restore interpreter context independently from calling context.
+        
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction):
+        If eval is called for global object different than current one, switch execution context
+        to that object and push it to scope.
+
+2007-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/5478717> JSStringCreateWithCFString leaks when passed a zero length CFStringRef
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString): Special case the zero length string and remove the
+        UTF16 optimized path since it will always leak due to the fact that we won't be 
+        able to free the backing store that the CFStringRef provides.
+
+2007-09-10  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5456224> CrashTracer: [USER] 2 crashes in Toast Titanium at com.apple.CoreServices.CarbonCore: CSMemDisposePtr + 37
+
+        Removed the implementation of these malloc zone functions. We do not have the ability to 
+        check if a pointer is valid or not, so we can't correctly implement them. The system free 
+        does not fail if you pass in a bad pointer.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::FastMallocZone::size):
+        (WTF::FastMallocZone::zoneMalloc):
+        (WTF::FastMallocZone::zoneCalloc):
+        (WTF::FastMallocZone::zoneFree):
+        (WTF::FastMallocZone::zoneRealloc):
+
+2007-09-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        - fix crash seen on Windows release builds
+
+        * wtf/FastMalloc.cpp: Change pthread_getspecific optimization to be done only
+        on the DARWIN platform. Also correct a couple reinterpret_cast that should be
+        static_cast instead.
+
+2007-09-06  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Maciej.
+
+        - Moved JSRetainPtr to the API.
+
+        * API/JSRetainPtr.h: Copied from kjs/JSRetainPtr.h.
+        (JSRetain):
+        (JSRelease):
+        (JSRetainPtr::JSRetainPtr):
+        (JSRetainPtr::~JSRetainPtr):
+        (JSRetainPtr::get):
+        (JSRetainPtr::releaseRef):
+        (JSRetainPtr::operator->):
+        (JSRetainPtr::operator!):
+        (JSRetainPtr::operator UnspecifiedBoolType):
+        (::operator):
+        (::adopt):
+        (::swap):
+        (swap):
+        (operator==):
+        (operator!=):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/JSRetainPtr.h: Removed.
+
+2007-09-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - Remove single-threaded optimization for FastMalloc. 
+        
+        It does not appear to help anywhere but Mac OS X on PPC, due to
+        pthread_getspecific being slow there. On Intel, removing the
+        optimization results in a ~1.5% PLT speedup, a ~1-5% JS iBench
+        speedup, and a ~1.5% HTML iBench speedup. On PPC this change is a
+        speedup on some benchmarks, a slight hit on others.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/collector.cpp:
+        (KJS::Collector::registerThread):
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::GetCache):
+        (WTF::TCMalloc_ThreadCache::GetCacheIfPresent):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        (WTF::do_malloc):
+        * wtf/FastMallocInternal.h: Removed.
+
+2007-09-05  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam, Sam, Darin.
+
+        - Created a JSRetainPtr specifically for JSStringRefs so they can be automatically refed and derefed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/JSRetainPtr.h: Copied from wtf/RetainPtr.h.
+        (KJS::JSRetain):
+        (KJS::JSRelease):
+        (KJS::):
+        (KJS::JSRetainPtr::JSRetainPtr):
+        (KJS::JSRetainPtr::~JSRetainPtr):
+        (KJS::JSRetainPtr::get):
+        (KJS::JSRetainPtr::releaseRef):
+        (KJS::JSRetainPtr::operator->):
+        (KJS::JSRetainPtr::operator UnspecifiedBoolType):
+        (KJS::::operator):
+        (KJS::::adopt):
+        (KJS::::swap):
+        (KJS::swap):
+        (KJS::operator==):
+        (KJS::operator!=):
+
+2007-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed Qt build fix.
+
+        * wtf/unicode/qt4/UnicodeQt4.h: Fix the constness of the src argument to toUpper to prevent build failures.
+
+2007-09-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Back out accidentally committed change.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/collector.cpp:
+        (KJS::Collector::registerThread):
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSetIsMultiThreaded):
+        (WTF::TCMalloc_ThreadCache::GetCache):
+        (WTF::TCMalloc_ThreadCache::GetCacheIfPresent):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        (WTF::do_malloc):
+        * wtf/FastMallocInternal.h: Added.
+
+2007-09-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - Added Vector::appendRange(), which appends to a vector based on a given start and end iterator
+        - Added keys() and values() functions to HashMap iterators, which give keys-only and values-only iterators
+        
+        Together, these allow easy copying of a set, or the keys or values of a map, into a Vector. Examples:
+        
+        HashMap<int, int> map;
+        HashSet<int> set;
+        Vector<int> vec;
+        // ...
+        vec.appendRange(set.begin(), set.end());
+        vec.appendRange(map.begin().keys(), map.end().keys());
+        vec.appendRange(map.begin().values(), map.end().values());
+
+        This also allows for a slightly nicer syntax when iterating a map. Instead of saying 
+        (*it)->first, you can say *it.values(). Similarly for keys. Example:
+        
+        HashMap<int, int>::const_iterator end = map.end();
+        for (HashMap<int, int>::const_iterator it = map.begin(); it != end; ++it)
+        printf(" [%d => %d]", *it.keys(), *it.values());
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/HashIterators.h: Added.
+        (WTF::):
+        (WTF::HashTableConstKeysIterator::HashTableConstKeysIterator):
+        (WTF::HashTableConstKeysIterator::get):
+        (WTF::HashTableConstKeysIterator::operator*):
+        (WTF::HashTableConstKeysIterator::operator->):
+        (WTF::HashTableConstKeysIterator::operator++):
+        (WTF::HashTableConstValuesIterator::HashTableConstValuesIterator):
+        (WTF::HashTableConstValuesIterator::get):
+        (WTF::HashTableConstValuesIterator::operator*):
+        (WTF::HashTableConstValuesIterator::operator->):
+        (WTF::HashTableConstValuesIterator::operator++):
+        (WTF::HashTableKeysIterator::HashTableKeysIterator):
+        (WTF::HashTableKeysIterator::get):
+        (WTF::HashTableKeysIterator::operator*):
+        (WTF::HashTableKeysIterator::operator->):
+        (WTF::HashTableKeysIterator::operator++):
+        (WTF::HashTableKeysIterator::operator HashTableConstKeysIterator<HashTableType, KeyType, MappedType>):
+        (WTF::HashTableValuesIterator::HashTableValuesIterator):
+        (WTF::HashTableValuesIterator::get):
+        (WTF::HashTableValuesIterator::operator*):
+        (WTF::HashTableValuesIterator::operator->):
+        (WTF::HashTableValuesIterator::operator++):
+        (WTF::HashTableValuesIterator::operator HashTableConstValuesIterator<HashTableType, KeyType, MappedType>):
+        (WTF::operator==):
+        (WTF::operator!=):
+        * wtf/HashTable.h:
+        * wtf/Vector.h:
+        (WTF::::appendRange):
+
+2007-09-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - Remove single-threaded optimization for FastMalloc. 
+        
+        It does not appear to help anywhere but Mac OS X on PPC, due to
+        pthread_getspecific being slow there. On Intel, removing the
+        optimization results in a 1% PLT speedup, a 2% JS iBench speedup,
+        and no measurable effect on HTML iBench (maybe a slight speedup).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/collector.cpp:
+        (KJS::Collector::registerThread):
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::GetCache):
+        (WTF::TCMalloc_ThreadCache::GetCacheIfPresent):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        (WTF::do_malloc):
+        * wtf/FastMallocInternal.h: Removed.
+
+2007-09-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/5452164> Production build with in symbols directory has no debug info
+
+        Enable debug symbol generation on all build configurations.  Production builds are stripped
+        of symbols by Xcode during deployment post-processing.
+
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-08-30  Riku Voipio  <riku.voipio@iki.fi>
+
+        Reviewed by Dave Kilzer.
+
+        Better ARM defines.
+
+        * kjs/ustring.h: Update comments to reflect the change and update test
+        to fit changes to Platform.h.
+        * wtf/Platform.h: Forced packing is only needed on oldabi ARM.
+        Set middle-endian floats only for little-endian oldabi ARM.
+        Set big-endian define for big-endian ARM.
+
+2007-08-29  Ryan Leavengood <leavengood@gmail.com>
+
+        Reviewed by Maciej.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15043
+        - posix_memalign takes a void** as its first parameter. My port makes use of this function call.
+
+        * kjs/collector.cpp:
+        (KJS::allocateBlock):
+
+2007-08-26  Darin Adler  <darin@apple.com>
+
+        - quick follow on to that last check-in
+
+        * API/JSCallbackObject.cpp: (KJS::JSCallbackObject::JSCallbackObject):
+        Need to initialize m_class to 0.
+
+2007-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/4949002> JSGlobalContextCreate can cause crashes because it passes a NULL JSContextRef to the globalObjectClass's initialize callback
+
+        JSCallbackObject now tracks whether it was constructed with a null ExecState.  This will happen when the object is being used as the global object,
+        as the Interpreter needs to be created after the global object.  In this situation the initialization is deferred until after the Interpreter's
+        ExecState is available to be passed down to the initialize callbacks.
+
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::init): Track whether we successfully initialized.
+        (KJS::JSCallbackObject::initializeIfNeeded): Attempt to initialize with the new ExecState.
+        * API/JSCallbackObject.h:
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Initialize the JSCallbackObject with the Interpreter's ExecState.
+        * API/testapi.c:
+        (testInitializeOfGlobalObjectClassHasNonNullContext):
+        (main): Verify that the context passed to the initialize callback is non-null.
+
+2007-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5438496> JSGlobalContextCreate crashes when passed a custom class
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Specify jsNull() as the prototype and let Interpreter's constructor fix it up to point at builtinObjectPrototype().
+        * API/testapi.c:
+        (main): Use an instance of a custom class as the global object to ensure the code path is exercised in the test.
+
+2007-08-26  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Mark Rowe and David Kilzer.
+
+        Fix build failure on arm.
+
+        * wtf/Platform.h: Also test if __arm__ is defined.
+
+2007-08-25  Peter Kasting <pkasting@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Part 3 of http://bugs.webkit.org/show_bug.cgi?id=14967
+        Bug 14967: Reduce wtf::Vector::operator[]() overloads
+
+        * wtf/Vector.h:
+        (WTF::Vector::operator[]): Only provide versions of operator[] that takes a size_t argument.
+
+2007-08-25  Peter Kasting <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Part 2 of http://bugs.webkit.org/show_bug.cgi?id=14967.
+        Eliminate all remaining implicit conversions of wtf::Vector<T> to T*.  Where code was
+        previously checking that the Vector's data pointer was non-NULL, check !Vector::isEmpty()
+        instead.
+
+        * wtf/Vector.h:
+        (WTF::Vector::data):
+
+2007-08-16  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff and Adam.
+
+        - Changing stack depth to 500 (from 100 on mac and win) to help out some apps specifically gmail.  <rdar://problem/3590522> JavaScript call stack limit of 99 is too small for some applications; needs to be closer to 500 (4045)
+
+        * kjs/object.cpp:
+
+2007-08-15  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin.
+        
+        http://bugs.webkit.org/show_bug.cgi?id=14967 part 1 - Eliminate most implicit
+        conversions of wtf::Vector<T> to T* by explicitly calling .data()
+
+        * API/JSCallbackConstructor.cpp:
+        (KJS::JSCallbackConstructor::construct):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::callAsFunction):
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::construct):
+        (KJS::JSCallbackObject::callAsFunction):
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::invokeMethod):
+        (KJS::Bindings::CInstance::invokeDefaultMethod):
+        * kjs/number_object.cpp:
+        (integer_part_noexp):
+        (char_sequence):
+        * kjs/ustring.cpp:
+        (KJS::UString::UTF8String):
+
+2007-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - fix <rdar://problem/5410570> Global initializer introduced by use of std::numeric_limits in r24919
+
+        * kjs/ustring.cpp:
+        (KJS::overflowIndicator): Turned into a function.
+        (KJS::maxUChars): Ditto.
+        (KJS::allocChars): Use the functions.
+        (KJS::reallocChars): Ditto.
+        (KJS::UString::expandedSize): Ditto.
+
+2007-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=14931
+          <rdar://problem/5403816> JavaScript regular expression non-participating capturing parentheses
+          fail in 3 different ways
+
+        Test: fast/js/regexp-non-capturing-groups.html
+
+        * kjs/string_object.cpp:
+        (KJS::replace): Add missing code to handle undefined backreferences; before we'd get the empty string
+        instead of a JavaScript "undefined" value.
+        (KJS::StringProtoFunc::callAsFunction): Implemented backreference support for split.
+        * pcre/pcre_exec.c: (match): Made backreferences to undefined groups match the empty string instead
+        of always failing. Only in JAVASCRIPT mode.
+
+        * tests/mozilla/expected.html: Add a new expected test success, since this fixed one test result.
+
+2007-08-10  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Adam.
+
+        <rdar://problem/5394449> Stop using some Carbon UI APIs for 64 bit
+
+        Disable the NPAPI for 64-bit on Mac OS X.
+
+        * Configurations/JavaScriptCore.xcconfig: Use the 64-bit export file.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Create a 64-bit export file
+        that filters out the NPN fnctions.
+        * bindings/NP_jsobject.cpp: #ifdef out this for 64-bit on Mac OS X
+        * bindings/NP_jsobject.h: Ditto.
+        * bindings/c/c_class.cpp: Ditto.
+        * bindings/c/c_class.h: Ditto.
+        * bindings/c/c_instance.cpp: Ditto.
+        * bindings/c/c_instance.h: Ditto.
+        * bindings/c/c_runtime.cpp: Ditto.
+        * bindings/c/c_runtime.h: Ditto.
+        * bindings/c/c_utility.cpp: Ditto.
+        * bindings/c/c_utility.h: Ditto.
+        * bindings/npapi.h: Ditto.
+        * bindings/npruntime.cpp: Ditto.
+        * bindings/npruntime.h: Ditto.
+        * bindings/npruntime_impl.h: Ditto.
+        * bindings/npruntime_priv.h: Ditto.
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createBindingForLanguageInstance):
+         don't creat an NPObject on Mac OS X in 64-bit.
+
+2007-08-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Antti.
+
+        <rdar://problem/5400709> Versioning in debug and release builds should include minor and tiny version before +
+
+        * Configurations/Version.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add a shell script phase to make to dependency between
+        Version.xcconfig and Info.plist explicit to Xcode.
+
+2007-08-08  George Staikos  <staikos@kde.org>
+
+        Make it compile with Qt again.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toUpper):
+
+2007-08-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver.
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=14897
+        Decompilation of double negation fails and produces invalid or incorrect code
+
+        Test: fast/js/function-decompilation-operators.html
+
+        * kjs/nodes2string.cpp:
+        (UnaryPlusNode::streamTo): Put space after unary operator.  Matches Firefox.
+        (NegateNode::streamTo): Diito.
+        (MultNode::streamTo): Put spaces around binary operator.  Matches Firefox.
+        (AddNode::streamTo): Ditto.
+
+2007-08-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele.
+
+        - fix <rdar://problem/5383104> REGRESSION: XHR.responseText is null instead of empty string
+          in http/tests/xmlhttprequest/zero-length-response.html
+
+        The new code to handle out of memory conditions was turning a "" into a null string.
+
+        * kjs/ustring.h: Removed UCharReference, which has long been obsolete and unused.
+        Removed copyForWriting, which was only used for the upper/lowercasing code and for
+        UCharReference.
+        * kjs/ustring.cpp:
+        (KJS::allocChars): Removed special case that made this fail (return 0) when passed 0.
+        Instead assert that we're not passed 0. Also added an overflow check for two reasons:
+        1) for sizes that aren't checked this prevents us from allocating a buffer that's too
+        small, and 2) for sizes where we overflowed in the expandedSize function and returned
+        overflowIndicator, it guarantees we fail.
+        (KJS::reallocChars): Ditto.
+        (KJS::UString::expandedSize): Return a large number, overflowIndicator, rather than 0
+        for cases where we overflow.
+        (KJS::UString::spliceSubstringsWithSeparators): Added a special case for empty string so
+        we don't call allocChars with a length of 0.
+        (KJS::UString::operator=): Added special characters for both 0 and empty string so we
+        match the behavior of the constructor. This avoids calling allocChars with a length of 0
+        and making a null string rather than an empty string in that case, and also matches the
+        pattern used in the rest of the functions.
+        (KJS::UString::operator[]): Made the return value const so code that tries to use the
+        operator to modify the string will fail.
+
+        * kjs/string_object.cpp: (KJS::StringProtoFunc::callAsFunction): Rewrote uppercasing and
+        lowercasing functions so they don't need copyForWriting any more -- it wasn't really doing
+        any good for optimization purposes. Instead use a Vector and releaseBuffer.
+
+        * wtf/unicode/icu/UnicodeIcu.h: Eliminate one of the versions of toLower/toUpper -- we now
+        only need the version where both a source and destination buffer is passed in, not the one
+        that works in place.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+2007-08-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver.
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=14891
+        Decompilation of try block immediately following "else" fails
+
+        Test: fast/js/toString-try-else.html
+
+        * kjs/nodes2string.cpp:
+        (TryNode::streamTo): Add newline before "try".
+
+2007-08-07  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej.
+
+        <rdar://problem/5388774> REGRESSION: Hang occurs after clicking "Attach a file " link in a new .Mac message
+
+        Attempting to acquire the JSLock inside CollectorHeap::forceLock can lead to a deadlock if the thread currently
+        holding the lock is waiting on the thread that is forking.  It is not considered safe to use system frameworks
+        after a fork without first execing[*] so it is not particularly important to ensure that the collector and
+        fastMalloc allocators are unlocked in the child process.  If the child process wishes to use JavaScriptCore it
+        should exec after forking like it would to use any other system framework.
+        [*]: <http://lists.apple.com/archives/Cocoa-dev/2005/Jan/msg00676.html>
+
+        * kjs/CollectorHeapIntrospector.cpp: Remove forceLock and forceUnlock implementations.
+        * kjs/CollectorHeapIntrospector.h: Stub out forceLock and forceUnlock methods.
+        * wtf/FastMalloc.cpp: Ditto.
+
+2007-08-06  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Geoff.
+
+        * kjs/ustring.h: Added an assertion which would have helped us find the
+        previous bug more easily.
+
+2007-08-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - fix <rdar://problem/5387589> 9A514: Quartz Composer crash on launch in KJS::jsString
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Turn NULL for sourceURL into UString::null(), just as JSObjectMakeFunction already does.
+        (JSCheckScriptSyntax): Ditto.
+
+2007-08-06  Matt Lilek  <pewtermoose@gmail.com>
+
+        Not reviewed, build fix.
+
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFunc::callAsFunction):
+
+2007-08-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix <rdar://problem/5371862> crash in Dashcode due to Quartz Composer JavaScript garbage collector reentrancy
+
+        * API/JSBase.cpp: (JSGarbageCollect): Don't call collector() if isBusy() returns true.
+
+        * kjs/collector.h: Added isBusy(), removed the unused return value from collect()
+        * kjs/collector.cpp: Added an "operation in progress" flag to the allocator.
+        (KJS::Collector::allocate): Call abort() if an operation is already in progress. Set the new flag instead
+        of using the debug-only GCLock.
+        (KJS::Collector::collect): Ditto.
+        (KJS::Collector::isBusy): Added.
+
+2007-08-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin and Adam.
+        
+        <rdar://problem/5368990> REGRESSION: newsgator.com sign-on 6x slower than Safari 3 beta due to GC changes (14808)
+
+        * kjs/string_object.cpp:
+        (KJS::replace): if the string didn't change (very common in some cases) reuse the original string value.
+        (KJS::StringProtoFunc::callAsFunction): Pass in the StringImp* when replacing, not just the UString.
+        * kjs/string_object.h:
+        (KJS::StringInstance::internalValue): covariant override to return StringImp for convenience
+
+2007-08-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/5385145> r24843 introduces a crash on calling fork() (14878)
+        http://bugs.webkit.org/show_bug.cgi?id=14878
+
+        Provide no-op functions for all members of the malloc_zone_t and malloc_introspection_t structures that we
+        register to avoid crashes in system code that assumes they will be non-null.
+
+        * kjs/CollectorHeapIntrospector.cpp:
+        (KJS::CollectorHeapIntrospector::CollectorHeapIntrospector):
+        (KJS::CollectorHeapIntrospector::forceLock): Grab the lock.
+        (KJS::CollectorHeapIntrospector::forceUnlock): Release the lock.
+        * kjs/CollectorHeapIntrospector.h:
+        (KJS::CollectorHeapIntrospector::goodSize):
+        (KJS::CollectorHeapIntrospector::check):
+        (KJS::CollectorHeapIntrospector::print):
+        (KJS::CollectorHeapIntrospector::log):
+        (KJS::CollectorHeapIntrospector::statistics):
+        (KJS::CollectorHeapIntrospector::size):
+        (KJS::CollectorHeapIntrospector::zoneMalloc):
+        (KJS::CollectorHeapIntrospector::zoneCalloc):
+        (KJS::CollectorHeapIntrospector::zoneFree):
+        * wtf/FastMalloc.cpp:
+        (WTF::FastMallocZone::goodSize):
+        (WTF::FastMallocZone::check):
+        (WTF::FastMallocZone::print):
+        (WTF::FastMallocZone::log):
+        (WTF::FastMallocZone::forceLock): Grab the TCMalloc locks.
+        (WTF::FastMallocZone::forceUnlock): Release the TCMalloc locks.
+        (WTF::FastMallocZone::FastMallocZone):
+
+2007-08-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders.
+
+        * pcre/pcre_compile.c: Remove non-ASCII character from a comment.
+
+2007-08-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/4212199> 'leaks' reports false leaks in WebKit (because the WTF allocator uses mmap?)
+
+        Implement malloc zone introspection routines to allow leaks, heap, and friends to request information
+        about specific memory regions that were allocated by FastMalloc or the JavaScriptCore collector.
+
+        This requires tool-side support before the regions will be displayed.  The addition of that support is
+        tracked by <rdar://problems/5353057&5353060>.
+
+        * JavaScriptCore.exp: Export the two variables that are used by leaks to introspect the allocators.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp:
+        * kjs/CollectorHeapIntrospector.cpp: Added.
+        (KJS::):
+        (KJS::CollectorHeapIntrospector::init): 
+        (KJS::CollectorHeapIntrospector::CollectorHeapIntrospector): Create and register our zone with the system.
+        (KJS::CollectorHeapIntrospector::enumerate): Iterate over the CollectorBlocks that are in use and report them to the caller as being used.
+        * kjs/CollectorHeapIntrospector.h: Added.
+        (KJS::CollectorHeapIntrospector::size): Return zero to indicate the specified pointer does not belong to this zone.
+        * kjs/collector.cpp:
+        (KJS::Collector::registerThread): Register the CollectorHeapIntrospector with the system when the first thread is registered with the collector.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::GetDescriptorEnsureSafe):
+        (WTF::TCMalloc_ThreadCache_FreeList::enumerateFreeObjects): Enumerate the objects on the free list.
+        (WTF::TCMalloc_ThreadCache::enumerateFreeObjects): Ditto.
+        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Ditto.
+        (WTF::TCMalloc_ThreadCache::InitModule): Register the FastMallocZone with the system when initializing TCMalloc.
+        (WTF::FreeObjectFinder::FreeObjectFinder):
+        (WTF::FreeObjectFinder::visit): Add an object to the free list.
+        (WTF::FreeObjectFinder::isFreeObject):
+        (WTF::FreeObjectFinder::freeObjectCount):
+        (WTF::FreeObjectFinder::findFreeObjects): Find the free objects within a thread cache or free list.
+        (WTF::PageMapFreeObjectFinder::PageMapFreeObjectFinder): Find the free objects within a TC_PageMap.
+        (WTF::PageMapFreeObjectFinder::visit): Called once per allocated span.  Record whether the span or any subobjects are free.
+        (WTF::PageMapMemoryUsageRecorder::PageMapMemoryUsageRecorder):
+        (WTF::PageMapMemoryUsageRecorder::visit): Called once per allocated span.  Report the range of memory as being allocated, and the span or
+        its subobjects as being used if they do not appear on the free list.
+        (WTF::FastMallocZone::enumerate): Map the key remote TCMalloc data structures into our address space.  We then locate all free memory ranges
+        before reporting the other ranges as being in use.
+        (WTF::FastMallocZone::size): Determine whether the given pointer originates from within our allocation zone.  If so,
+        we return its allocation size.
+        (WTF::FastMallocZone::zoneMalloc):
+        (WTF::FastMallocZone::zoneCalloc):
+        (WTF::FastMallocZone::zoneFree):
+        (WTF::FastMallocZone::zoneRealloc):
+        (WTF::):
+        (WTF::FastMallocZone::FastMallocZone): Create and register our zone with the system.
+        (WTF::FastMallocZone::init):
+        * wtf/MallocZoneSupport.h: Added.
+        (WTF::RemoteMemoryReader::RemoteMemoryReader): A helper class to ease the process of mapping memory in a different process into
+        our local address space
+        (WTF::RemoteMemoryReader::operator()):
+        * wtf/TCPageMap.h:
+        (TCMalloc_PageMap2::visit): Walk over the heap and visit each allocated span.
+        (TCMalloc_PageMap3::visit): Ditto.
+
+2007-08-02  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::expandedSize):  Use std::numeric_limits<size_t>::max() rather than the non-portable SIZE_T_MAX.
+
+2007-08-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej.
+
+        <rdar://problem/5352887> "Out of memory" error during repeated JS string concatenation leaks hundreds of MBs of RAM
+
+        A call to fastRealloc was failing which lead to UString::expandCapacity leaking the buffer it was trying to reallocate.
+        It also resulted in the underlying UString::rep having both a null baseString and buf field, which meant that attempting
+        to access the contents of the string after the failed memory reallocation would crash.
+
+        A third issue is that expandedSize size was calculating the new length in a way that led to an integer overflow occurring.
+        Attempting to allocate a string more than 190,000,000 characters long would fail a the integer overflow would lead to a
+        memory allocation of around 3.6GB being attempted rather than the expected 390MB.  Sizes that would lead to an overflow
+        are now  returned as zero and callers are updated to treat this as though the memory allocation has failed.
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction): Check whether the append failed and raise an "Out of memory" exception if it did.
+        * kjs/ustring.cpp:
+        (KJS::allocChars): Wrapper around fastMalloc that takes a length in characters.  It will return 0 when asked to allocate a zero-length buffer.
+        (KJS::reallocChars): Wrapper around fastRealloc that takes a length in characters.  It will return 0 when asked to allocate a zero-length buffer.
+        (KJS::UString::expandedSize): Split the size calculation in two and guard against overflow during each step.
+        (KJS::UString::expandCapacity): Don't leak r->buf if reallocation fails.  Instead free the memory and use the null representation.
+        (KJS::UString::expandPreCapacity): If fastMalloc fails then use the null representation rather than crashing in memcpy.
+        (KJS::UString::UString): If calls to expandCapacity, expandPreCapacity or fastMalloc fail then use the null representation rather than crashing in memcpy.
+        (KJS::UString::append): Ditto.
+        (KJS::UString::operator=): Ditto.
+        * kjs/ustring.h: Change return type of expandedSize from int to size_t.
+
+2007-08-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin McCullough.
+
+        - fix <rdar://problem/5375186> pointers to pieces of class definition passed to JSClassCreate should all be const
+
+        * API/JSObjectRef.h: Added const.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass): Added const.
+        (OpaqueJSClass::create): Added const.
+        * API/JSObjectRef.cpp:
+        (JSClassCreate): Added const.
+
+2007-08-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Build mod: Fix sln to match configs in vcproj.
+        
+        Reviewed by Adam.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+
+2007-07-30  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars.
+
+        Removed the __BUILDING_QT ifdef in JSStringRef.h and changed UChar for the Qt build to use wchar_t on Windows.
+
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Always define JSChar to be unsigned short for the Qt builds, to ensure compatibility with UChar.
+
+        * API/JSStringRef.h:
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Fix compilation with Qt on Windows with MingW: Implemented currentThreadStackBase() for this platform.
+
+        * kjs/collector.cpp:
+        (KJS::currentThreadStackBase):
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Fix compilation with Qt on Windows with MingW: The MingW headers do not provide a prototype for a reentrant version of localtime. But since we don't use multiple threads for the Qt build we can use the plain localtime() function.
+
+        * kjs/DateMath.cpp:
+        (KJS::getDSTOffsetSimple):
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Use $(MOVE) instead of mv to eliminated the shell dependency and replaced the long shell line to call bison and modify the css grammar file with a few lines of portable perl code.
+
+        * JavaScriptCore.pri:
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Implemented currentTime() in the interpreter by using QDateTime, so that we don't need timeGetTime() on Windows and therefore also don't need to link against Winmm.dll.
+
+        * kjs/interpreter.cpp:
+        (KJS::getCurrentTime):
+        * kjs/testkjs.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Replace the use of snprintf with QByteArray to compile under msvc 2005 express.
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::stringValue):
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Don't use pthread.h unless thread support is enabled.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::registerAsMainThread):
+        (KJS::onMainThread):
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Removed TCSystemMalloc from the Qt build, it's not necessary it seems.
+
+        * JavaScriptCore.pri:
+
+2007-07-27  Simon Hausmann  <hausmann@kde.org>
+
+        Done with and reviewed by Lars and Zack.
+
+        Added os-win32 to the include search path for the Qt windows build in order to provide the fake stdint.h header file.
+
+        * JavaScriptCore.pri:
+
+2007-07-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark.
+
+        - follow-up to previous change
+        
+        * kjs/ustring.cpp:
+        (KJS::UString::operator=): Make sure to reset the length when
+        replacing the buffer contents for a single-owned string.
+
+2007-07-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - JavaScriptCore part of fix for <rdar://problem/5300291> Optimize GC to reclaim big, temporary objects (like XMLHttpRequest.responseXML) quickly
+        
+        Also, as a side effect of optimizations included in this patch:
+        - 7% speedup on JavaScript iBench
+        - 4% speedup on "Celtic Kane" JS benchmark
+        
+        The basic idea is explained in a big comment in collector.cpp. When unusually 
+        large objecs are allocated, we push the next GC closer on the assumption that
+        most objects are short-lived.
+        
+        I also did the following two optimizations in the course of tuning
+        this not to be a performance regression:
+
+        1) Change UString::Rep to hold a self-pointer as the baseString in
+        the unshared case, instead of a null pointer; this removes a
+        number of null checks in hot code because many places already
+        wanted to use the rep itself or the baseString as appropriate.
+        
+        2) Avoid creating duplicate StringImpls when creating a
+        StringInstance (the object wrapper for a JS string) or calling
+        their methods. Since a temporary wrapper object is made every time
+        a string method is called, this resulted in two useless extra
+        StringImpls being allocated for no reason whenever a String method
+        was invoked on a string value. Now we bypass those.
+        
+        * kjs/collector.cpp:
+        (KJS::):
+        (KJS::Collector::recordExtraCost): Basics of the extra cost mechanism.
+        (KJS::Collector::allocate): ditto
+        (KJS::Collector::collect): ditto
+        * kjs/collector.h:
+        (KJS::Collector::reportExtraMemoryCost): ditto
+        * kjs/array_object.cpp:
+        (ArrayInstance::ArrayInstance): record extra cost
+        * kjs/internal.cpp:
+        (KJS::StringImp::toObject): don't create a whole new StringImpl just
+        to be the internal value of a StringInstance! StringImpls are immutable
+        so there's no point tot his.
+        * kjs/internal.h:
+        (KJS::StringImp::StringImp): report extra cost
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::StringInstance): new version that takes a StringImp
+        (KJS::StringProtoFunc::callAsFunction): don't create a whole new StringImpl
+        just to convert self to string! we already have one in the internal value
+        * kjs/string_object.h: report extra cost        
+        * kjs/ustring.cpp: All changes to handle baseString being self instead of null in the 
+        unshared case.
+        (KJS::):
+        (KJS::UString::Rep::create):
+        (KJS::UString::Rep::destroy):
+        (KJS::UString::usedCapacity):
+        (KJS::UString::usedPreCapacity):
+        (KJS::UString::expandCapacity):
+        (KJS::UString::expandPreCapacity):
+        (KJS::UString::UString):
+        (KJS::UString::append):
+        (KJS::UString::operator=):
+        (KJS::UString::copyForWriting):
+        * kjs/ustring.h:
+        (KJS::UString::Rep::baseIsSelf): new method, now that baseString is
+        self instead of null in the unshared case we can't just null check.
+        (KJS::UString::Rep::data): adjusted as mentioned above
+        (KJS::UString::cost): new method to compute the cost for a UString, for
+        use by StringImpl.
+
+        * kjs/value.cpp:
+        (KJS::jsString): style fixups.
+        (KJS::jsOwnedString): new method, use this for strings allocated from UStrings
+        held by the parse tree. Tracking their cost as part of string cost is pointless,
+        because garbage collecting them will not actually free the relevant string buffer.
+        * kjs/value.h: prototyped jsOwnedString.
+        * kjs/nodes.cpp:
+        (StringNode::evaluate): use jsOwnedString as appropriate
+        (RegExpNode::evaluate): ditto
+        (PropertyNameNode::evaluate): ditto
+        (ForInNode::execute): ditto
+        
+        * JavaScriptCore.exp: Exported some new symbols.
+
+2007-07-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/5121461> REGRESSION: Unable to load JigZone puzzle
+        
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::createNative):
+        
+        Call RootObject::gcProtect on the global object, thereby putting it in the
+        "protect count" set which is used for checking if a native handle is valid.
+        
+2007-07-23  Darin Adler  <darin@apple.com>
+
+        * pcre/pcre_compile.c: Roll back a tiny accidental change in the unused !JAVASCRIPT
+        side of an #ifdef. This has no effect when using PCRE in JAVASCRIPT mode as we do,
+        but seems worth rolling back.
+
+2007-07-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix remaining problems with Window shadowing
+
+        * kjs/nodes.cpp:
+        (VarDeclNode::evaluate): Tweak the special case a little.
+
+2007-07-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix Window shadowing regressions caused by the previous commit.
+
+        * kjs/nodes.cpp:
+        (VarDeclNode::evaluate): Handle the case of global scope specially.
+
+2007-07-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        -fixed <rdar://problem/5353293> REGRESSION (r24287): 1% i-Bench JS slowdown from JavaScript compatibility fix (14719)
+        http://bugs.webkit.org/show_bug.cgi?id=14719
+        
+        My fix for this actually resulted in JS iBench being 1% faster than before the regression
+        and the Celtic Kane benchmark being 5% faster than before the regression.
+        
+        * kjs/nodes.cpp:
+        (VarDeclNode::handleSlowCase): factored out the slow code path to be out of line.
+        (VarDeclNode::evaluate): I did a couple of things:
+        (1) Don't check if the variable is already declared by looking for the property in
+        the variable object, that code path was dead code.
+        (2) Special-case the common case where the top of the scope and the variable object
+        are the same; in that case the variable must always be in the variable object.
+        (3) Don't return a jsString() of the variable name, nothing uses the return value
+        from this node types evaluate method.
+        * kjs/nodes.h:
+
+2007-07-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        - fix <rdar://problem/5126394> REGRESSION: Crash after clicking back button in test application (13250)
+          http://bugs.webkit.org/show_bug.cgi?id=13250
+
+        * bindings/objc/objc_utility.mm: (KJS::Bindings::convertObjcValueToValue):
+        If the object returns 0 for _imp, convert that to "undefined", since callers
+        can't cope with a JSValue of 0.
+
+2007-07-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=10880 | <rdar://problem/5335694>
+        REGRESSION: JavaScript menu doesn't appear on pricepoint.com (14595)
+        
+        Though the ECMA spec says auto-semicolon insertion should not occur
+        without a newline or '}', Firefox treats do-while specially, and the
+        library used by pricepoint.com requires that special treatment.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/grammar.y:
+
+2007-07-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix <rdar://problem/5345440> PCRE computes wrong length for expressions with quantifiers
+          on named recursion or subexpressions
+
+        It's challenging to implement proper preflighting for compiling these advanced features.
+        But we don't want them in the JavaScript engine anyway.
+
+        Turned off the following features of PCRE (some of these are simply parsed and not implemented):
+
+            \C \E \G \L \N \P \Q \U \X \Z
+            \e \l \p \u \z
+            [::] [..] [==]
+            (?#) (?<=) (?<!) (?>)
+            (?C) (?P) (?R)
+            (?0) (and 1-9)
+            (?imsxUX)
+
+        Added the following:
+
+            \u \v
+
+        Because of \v, the js1_2/regexp/special_characters.js test now passes.
+
+        To be conservative, I left some features that JavaScript doesn't want, such as
+        \012 and \x{2013}, in place. We can revisit these later; they're not directly-enough
+        related to avoiding the incorrect preflighting.
+
+        I also didn't try to remove unused opcodes and remove code from the execution engine.
+        That could save code size and speed things up a bit, but it would require more changes.
+
+        * kjs/regexp.h:
+        * kjs/regexp.cpp: (KJS::RegExp::RegExp): Remove the sanitizePattern workaround for
+        lack of \u support, since the PCRE code now has \u support.
+
+        * pcre/pcre-config.h: Set JAVASCRIPT to 1.
+        * pcre/pcre_internal.h: Added ESC_v.
+
+        * pcre/pcre_compile.c: Added a different escape table for when JAVASCRIPT is set that
+        omits all the escapes we don't want interpreted and includes '\v'.
+        (check_escape): Put !JAVASCRIPT around the code for '\l', '\L', '\N', '\u', and '\U',
+        and added code to handle '\u2013' inside JAVASCRIPT.
+        (compile_branch): Put !JAVASCRIPT if around all the code implementing the features we
+        don't want.
+        (pcre_compile2): Ditto.
+
+        * tests/mozilla/expected.html: Updated since js1_2/regexp/special_characters.js now
+        passes.
+
+2007-07-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/5345432> PCRE computes length wrong for expressions such as "[**]"
+
+        Test: fast/js/regexp-charclass-crash.html
+
+        * pcre/pcre_compile.c: (pcre_compile2): Fix the preflight code that calls
+        check_posix_syntax to match the actual regular expression compilation code;
+        before it was missing the check of the first character.
+
+2007-07-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark.
+
+        Define __BUILDING_GDK when building for Gdk to fix building testkjs on OSX.
+
+        * JavaScriptCore.pri:
+
+2007-07-18  Simon Hausmann  <hausmann@kde.org>
+
+        * Fix the Qt build, call dftables from the right directory.
+
+        Reviewed by Adam Treat.
+
+        * pcre/pcre.pri:
+
+2007-07-18  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Zack.
+
+        Don't call gcc directly when building the dftables tool but use a separate .pro file for the Qt build.
+
+        * pcre/dftables.pro: Added.
+        * pcre/pcre.pri:
+
+2007-07-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin, Maciej, and Adam.
+
+        Fixes <http://bugs.webkit.org/show_bug.cgi?id=9697>,
+              the failure of ecma/GlobalObject/15.1.2.2-2.js,
+              the failure of ecma/LexicalConventions/7.7.3-1.js,
+              and most of the failures of tests in ecma/TypeConversion/9.3.1-3.js.
+
+        Bug 9697: parseInt results may be inaccurate for numbers greater than 2^53
+
+        This patch also fixes similar issues in the lexer and UString::toDouble().
+
+        * kjs/function.cpp:
+        (KJS::parseIntOverflow):
+        (KJS::parseInt):
+        * kjs/function.h:
+        * kjs/lexer.cpp:
+        (KJS::Lexer::lex):
+        * kjs/ustring.cpp:
+        (KJS::UString::toDouble):
+        * tests/mozilla/expected.html:
+
+2007-07-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver.
+
+        Turn off -Wshorten-64-to-32 warning for 64-bit builds.
+
+        * Configurations/Base.xcconfig:
+
+2007-07-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Initial check-in for <rdar://problem/3154486> - Supporting FTP directory listings in the browser
+
+        * wtf/Platform.h: Add ENABLE_FTPDIR feature to handle building on platforms that don't have the
+          proper network-layer support
+
+2007-07-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Fixes http://bugs.webkit.org/show_bug.cgi?id=13517,
+              http://bugs.webkit.org/show_bug.cgi?id=14237, and
+              the failure of test js1_5/Scope/regress-185485.js
+
+        Bug 13517: DOM Exception 8 in finance.aol.com sub-page
+        Bug 14237: Javascript "var" statement interprets initialization in the topmost function scope
+
+        * kjs/nodes.cpp:
+        (VarDeclNode::evaluate):
+        * tests/mozilla/expected.html:
+
+2007-07-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Mitz.
+
+        http://bugs.webkit.org/show_bug.cgi?id=14596
+        Fix JSC compilation with KJS_VERBOSE.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::passInParameters):
+
+2007-07-11  George Staikos  <staikos@kde.org>
+
+        Make it compile.
+
+        * ForwardingHeaders: Added.
+        * ForwardingHeaders/JavaScriptCore: Added.
+        * ForwardingHeaders/JavaScriptCore/APICast.h: Added.
+        * ForwardingHeaders/JavaScriptCore/JSBase.h: Added.
+        * ForwardingHeaders/JavaScriptCore/JSContextRef.h: Added.
+        * ForwardingHeaders/JavaScriptCore/JSLock.h: Added.
+        * ForwardingHeaders/JavaScriptCore/JSObjectRef.h: Added.
+        * ForwardingHeaders/JavaScriptCore/JSStringRef.h: Added.
+        * ForwardingHeaders/JavaScriptCore/JSStringRefCF.h: Added.
+        * ForwardingHeaders/JavaScriptCore/JSValueRef.h: Added.
+        * ForwardingHeaders/JavaScriptCore/JavaScriptCore.h: Added.
+
+2007-07-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin.
+
+        As of http://bugs.webkit.org/show_bug.cgi?id=14527 move the
+        WebCore/ForwardingHeader/JavaScriptCore to JavaScriptCore
+
+        * ForwardingHeaders: Added.
+        * ForwardingHeaders/JavaScriptCore: Copied from WebCore/ForwardingHeaders/JavaScriptCore.
+
+2007-07-11  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Mark.
+
+        Forwardport the hash table fix from CodeGeneratorJS.pm to create_hash_table.
+        Reran run-jsc-tests, couldn't find any regressions. Suggested by Darin.
+
+        * kjs/create_hash_table:
+
+2007-07-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - JavaScriptCore part of fix for: <rdar://problem/5295734> Repro crash closing tab/window @ maps.google.com in WTF::HashSet<KJS::RuntimeObjectImp*, WTF::PtrHash<KJS::RuntimeObjectImp*>, WTF::HashTraits<KJS::RuntimeObjectImp*> >::add + 11
+        
+        * JavaScriptCore.exp: Added needed export.
+
+2007-07-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Antti.
+
+        - <rdar://problem/5311093> JavaScriptCore fails to build with strict-aliasing warnings
+        
+        * Configurations/Base.xcconfig: Re-enable -Wstrict-aliasing
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::getJNIEnv): Type-pun via a union instead of a pointer cast.
+        * wtf/HashMap.h:
+        (WTF::): Instead of doing type-punned assignments via pointer cast, do one of three things:
+        (1) assign directly w/o cast if storage type matches real type; (2) assign using cast
+        via union if type does not need reffing; (3) copy with memcpy and ref/deref manually if type
+        needs reffing. This is ok peref-wise because memcpy of a constant length gets optomized.
+        HashTraits are now expected to make ref()/deref() take the storage type, not the true type.
+        * wtf/HashSet.h:
+        (WTF::): Same basic idea.
+        * wtf/HashTable.h:
+        (WTF::): Added Assigner template for use by HashMap/HashSet. Change RefCounter to call ref()
+        and deref() via storage type, avoiding the need to
+        type-pun.
+        (WTF::RefCounter::ref): ditto
+        (WTF::RefCounter::deref): ditto
+        * wtf/HashTraits.h:
+        (WTF::): Change ref() and deref() for RefPtr HashTraits to take the storage type; cast
+        via union to pointer type.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init): Changed from constructor to init function so this can go in a union.
+        (WTF::): redefine pageheap macro in terms of getPageHeap().
+        (WTF::getPageHeap): new inline function, helper for pageheap macro. This hides the cast in a union.
+        (WTF::TCMalloc_ThreadCache::InitModule): Call init() instead of using placement new to initialize page
+        heap.
+        * wtf/TCPageMap.h:
+        (TCMalloc_PageMap1::init): Changed from constructor to init function.
+        (TCMalloc_PageMap2::init): ditto
+        (TCMalloc_PageMap3::init): ditto
+
+
+2007-07-06  George Staikos  <staikos@kde.org>
+
+        Reviewed by Maciej.
+
+        Switch USE(ICONDATABASE) to ENABLE(ICONDATABASE)
+
+        * wtf/Platform.h:
+
+2007-07-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin.
+
+        Eleventh round of fixes for implicit 64-32 bit conversion errors.
+        <rdar://problem/5292262>
+
+        - Fixes a real bug where where we were setting long long and unsigned long long
+          values to a long field.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+
+2007-07-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Tenth round of fixes for implicit 64-32 bit conversion errors.
+        <rdar://problem/5292262>
+
+        - Add explicit casts.
+
+        * kjs/dtoa.cpp:
+        (Bigint::):
+
+2007-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Kevin McCullough.
+
+        Fourth round of fixes for implicit 64-32 bit conversion errors.
+        <rdar://problem/5292262>
+
+        Add custom piDouble and piFloat constants to use instead of M_PI.
+
+        * kjs/math_object.cpp:
+        (MathObjectImp::getValueProperty):
+        * wtf/MathExtras.h:
+        (wtf_atan2):
+
+2007-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin.
+
+        Second pass at fixing implicit 64-32 bit conversion errors.
+        <rdar://problem/5292262>
+
+        - Add a toFloat() method to JSValue for float conversion.
+
+        * JavaScriptCore.exp:
+        * kjs/value.cpp:
+        (KJS::JSValue::toFloat):
+        * kjs/value.h:
+
+2007-06-27  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        - <rdar://problem/5271937> REGRESSION: Apparent WebKit JavaScript memory smasher when submitting comment to iWeb site (crashes in kjs_pcre_compile2)
+        - Correctly evaluate the return value of _pcre_ucp_findchar.
+
+        * pcre/pcre_compile.c:
+        (compile_branch):
+        * pcre/pcre_exec.c:
+        (match):
+
+2007-06-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin.
+
+        First pass at fixing implicit 64-32 bit conversion errors.
+        <rdar://problem/5292262>
+
+        - Add 'f' suffix where necessary.
+
+        * kjs/testkjs.cpp:
+        (StopWatch::getElapsedMS):
+
+2007-06-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed <rdar://problem/5296627> JSGarbageCollect headerdoc suggests that 
+        using JavaScriptCore requires leaking memory
+
+        * API/JSBase.h: Changed documentation to explain that you can pass NULL
+        to JSGarbageCollect.
+
+2007-06-26  Adam Treat  <adam@staikos.net>
+
+        Reviewed by Adam Roben.
+
+        Make the SQLite icon database optional.
+
+        * wtf/Platform.h:
+
+2007-06-15  George Staikos  <staikos@kde.org>
+
+        More missing files for Qt.
+
+        * JavaScriptCore.pri:
+        * kjs/testkjs.pro:
+
+2007-06-15  George Staikos  <staikos@kde.org>
+
+        Another Qt build fix.
+
+        * JavaScriptCore.pri:
+        * kjs/testkjs.pro:
+
+2007-06-15  George Staikos  <staikos@kde.org>
+
+        Fixing Qt build.
+
+        * JavaScriptCore.pri:
+
+2007-06-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Mitz.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=14244
+        Bug 14244: Data corruption when using a replace() callback function with data containing "$"
+
+        * kjs/string_object.cpp:
+        (KJS::replace):  When 'replacement' is a function, do not replace $n placeholders in its return value.
+        This matches the behaviour described in ECMA 262 3rd Ed section 15.5.4.1, and as implemented in Firefox.
+
+2007-06-14  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+        
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::canPut):
+
+2007-06-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5103077> 
+        Crash at _NPN_ReleaseObject when quitting page at http://eshop.macsales.com/shop/ModBook
+        
+        <rdar://problem/5183692>
+        http://bugs.webkit.org/show_bug.cgi?id=13547
+        REGRESSION: Crash in _NPN_ReleaseObject when closing Safari on nba.com (13547)
+        
+        <rdar://problem/5261499>
+        CrashTracer: [USER] 75 crashes in Safari at com.apple.JavaScriptCore: KJS::Bindings::CInstance::~CInstance + 40
+        
+        Have the root object track all live instances of RuntimeObjectImp. When invalidating 
+        the root object, also invalidate all live runtime objects by zeroing out their instance ivar.
+        This prevents instances from outliving their plug-ins which lead to crashes.
+        
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant):
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::convertValueToJObject):
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::convertValueToJValue):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::callAsFunction):
+        * bindings/runtime_array.cpp:
+        (RuntimeArray::RuntimeArray):
+        * bindings/runtime_array.h:
+        (KJS::RuntimeArray::getConcreteArray):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::callAsFunction):
+        * bindings/runtime_method.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::~RuntimeObjectImp):
+        (RuntimeObjectImp::invalidate):
+        (RuntimeObjectImp::fallbackObjectGetter):
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::methodGetter):
+        (RuntimeObjectImp::getOwnPropertySlot):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+        (RuntimeObjectImp::defaultValue):
+        (RuntimeObjectImp::implementsCall):
+        (RuntimeObjectImp::callAsFunction):
+        (RuntimeObjectImp::getPropertyNames):
+        (RuntimeObjectImp::throwInvalidAccessError):
+        * bindings/runtime_object.h:
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::RootObject::invalidate):
+        (KJS::Bindings::RootObject::addRuntimeObject):
+        (KJS::Bindings::RootObject::removeRuntimeObject):
+        * bindings/runtime_root.h:
+
+2007-06-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Mitz.
+
+        <rdar://problem/5244948>
+        Safari keeps on complaining about slow script playing NBC TV video (14133)
+
+        http://bugs.webkit.org/show_bug.cgi?id=14133
+        Runaway JavaScript timer fires when spinning around in Google Maps street view
+
+        Make sure to start and stop the timeout checker around calls to JS.
+        
+        * bindings/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+
+2007-06-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=14132
+          array sort with > 10000 elements sets elements > 10000 undefined
+
+        Test: fast/js/sort-large-array.html
+
+        * kjs/array_instance.h: Replaced pushUndefinedObjectsToEnd with
+        compactForSorting, and removed ExecState parameters.
+
+        * kjs/array_object.cpp:
+        (ArrayInstance::sort): Changed to call compactForSorting.
+        (ArrayInstance::compactForSorting): Do the get and delete of the
+        properties directly on the property map instead of using public
+        calls from JSObject. The public calls would just read the undefined
+        values from the compacted sort results array!
+
+2007-06-13  George Staikos  <staikos@kde.org>
+
+        Reviewed by Lars.
+
+        Fix Mac OS X build after last checkin.
+
+        * wtf/FastMalloc.h:
+
+2007-06-14  Lars Knoll <lars@trolltech.com>
+
+        Reviewed by Maciej.
+
+        Disable FastMalloc for the Qt build and make sure we
+        don't reimplement the global new/delete operators
+        when using the system malloc.
+
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/Platform.h:
+
+2007-06-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Make sure that bindings instances get correct root objects.
+        
+        * JavaScriptCore.exp:
+        * bindings/NP_jsobject.cpp:
+        (listFromVariantArgs):
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_SetProperty):
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::invokeMethod):
+        (KJS::Bindings::CInstance::invokeDefaultMethod):
+        * bindings/c/c_runtime.cpp:
+        (KJS::Bindings::CField::valueFromInstance):
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertNPVariantToValue):
+        * bindings/c/c_utility.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (ObjcArray::valueAt):
+        * bindings/objc/objc_utility.h:
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/runtime.h:
+
+2007-06-13  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Lars.
+
+        * kjs/testkjs.pro: WebKitQt is now called QtWebKit.
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Another build fix.
+        
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::invokeMethod):
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Move the notion of field type to the JNI runtime since that's the only 
+        one that was actually using it.
+        
+        * bindings/c/c_runtime.h:
+        (KJS::Bindings::CField::CField):
+        * bindings/jni/jni_runtime.h:
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        * bindings/qt/qt_runtime.h:
+        * bindings/runtime.h:
+        * bindings/runtime_method.cpp:
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+        
+        * bindings/qt/qt_class.cpp:
+        (KJS::Bindings::QtClass::methodsNamed):
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::invokeMethod):
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver.
+        
+        Get rid of the MethodList class and use a good ol' Vector instead.
+
+        * bindings/c/c_class.cpp:
+        (KJS::Bindings::CClass::methodsNamed):
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::invokeMethod):
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::methodsNamed):
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::callAsFunction):
+        * bindings/runtime.cpp:
+        * bindings/runtime.h:
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::lengthGetter):
+        (RuntimeMethod::callAsFunction):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::getOwnPropertySlot):
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Make RuntimeMethod's method list a pointer so that the object size doesn't
+        grow beyond 32 bytes when we later will replace MethodList with a Vector.
+        
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::RuntimeMethod):
+        (RuntimeMethod::lengthGetter):
+        (RuntimeMethod::callAsFunction):
+        * bindings/runtime_method.h:
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Get rid of the Parameter class.
+        
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaMethod::signature):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaParameter::JavaParameter):
+        (KJS::Bindings::JavaParameter::~JavaParameter):
+        (KJS::Bindings::JavaParameter::type):
+        (KJS::Bindings::JavaMethod::parameterAt):
+        (KJS::Bindings::JavaMethod::numParameters):
+        * bindings/runtime.h:
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+        
+        * bindings/qt/qt_class.h:
+
+2007-06-12  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * bindings/objc/objc_runtime.h:
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Get rid of Constructor and its only subclass JavaConstructor.
+        
+        * bindings/c/c_class.h:
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_runtime.cpp:
+        * bindings/jni/jni_runtime.h:
+        * bindings/objc/objc_class.h:
+        * bindings/runtime.h:
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Use RetainPtr throughout the bindings code.
+        
+        * bindings/objc/objc_class.h:
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::ObjcClass):
+        (KJS::Bindings::ObjcClass::methodsNamed):
+        (KJS::Bindings::ObjcClass::fieldNamed):
+        * bindings/objc/objc_instance.h:
+        (KJS::Bindings::ObjcInstance::getObject):
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::~ObjcInstance):
+        (ObjcInstance::implementsCall):
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::defaultValue):
+        * bindings/objc/objc_runtime.h:
+        (KJS::Bindings::ObjcMethod::setJavaScriptName):
+        (KJS::Bindings::ObjcMethod::javaScriptName):
+        (KJS::Bindings::ObjcArray::getObjcArray):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::name):
+        (ObjcArray::ObjcArray):
+        (ObjcArray::setValueAt):
+        (ObjcArray::valueAt):
+        (ObjcArray::getLength):
+        * wtf/RetainPtr.h:
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Maciej.
+
+        Have JSCell inherit from Noncopyable.
+        
+        * bindings/objc/objc_runtime.h:
+        * bindings/runtime_object.h:
+        * kjs/value.h:
+
+2007-06-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin and Maciej.
+
+        More cleanup. Use our Noncopyable WTF class, add a root object member
+        to the Array class.
+        
+        * bindings/c/c_class.h:
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaArray::JavaArray):
+        * bindings/jni/jni_runtime.h:
+        * bindings/objc/objc_class.h:
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcArray::ObjcArray):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Array::Array):
+        (KJS::Bindings::Array::~Array):
+        * bindings/runtime.h:
+        * bindings/runtime_object.h:
+        * bindings/runtime_root.h:
+
+2007-06-08  Zack Rusin  <zrusin@trolltech.com>
+
+        Fix the Qt build
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::QtInstance):
+        * bindings/qt/qt_instance.h:
+
+2007-06-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Get rid of Instance::setRootObject and pass the root object to the instance constructor instead.
+        
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::CInstance):
+        * bindings/c/c_instance.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::JavaInstance):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::convertJObjectToValue):
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::Instance):
+        (KJS::Bindings::Instance::createBindingForLanguageInstance):
+        * bindings/runtime.h:
+
+2007-06-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam.
+
+        Don't use a JavaInstance to store the field when all we want to do is to keep the field
+        from being garbage collected. Instead, use a JObjectWrapper.
+        
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::JavaField):
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaField::JavaField):
+        (KJS::Bindings::JavaField::operator=):
+
+2007-05-30  Alp Toker  <alp.toker@collabora.co.uk>
+
+        Reviewed by Brady.
+
+        Enable logging in the Gdk port.
+        http://bugs.webkit.org/show_bug.cgi?id=13936
+
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h: Add WTFLogVerbose which also logs
+        the file, line number and function.
+
+2007-05-30  Mark Rowe  <mrowe@apple.com>
+
+        Mac build fix.  Update #include.
+
+        * API/JSCallbackFunction.h:
+
+2007-05-30  Luciano Montanaro  <mikelima@cirulla.net>
+
+        Reviewed by Maciej.
+
+        - cross-port Harri Porten's commits 636099 and 636108 from KJS: 
+        "publish a class anyway public already" and "class is being used from
+        outside for quite some time" in preparation for further syncronizations
+
+        * kjs/context.h:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        * kjs/function.h:
+        (KJS::):
+        (KJS::InternalFunctionImp::classInfo):
+        (KJS::InternalFunctionImp::functionName):
+        * kjs/function_object.h:
+        * kjs/internal.h:
+        * kjs/lookup.h:
+        (KJS::getStaticPropertySlot):
+        (KJS::getStaticFunctionSlot):
+        (KJS::getStaticValueSlot):
+        * kjs/object_object.h:
+
+2007-05-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cleanup function and fix to match comparison API.
+
+        * kjs/string_object.cpp:
+        (KJS::substituteBackreferences):
+        (KJS::localeCompare):
+
+2007-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Slight clarification to an exception message.
+
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::put):
+
+2007-05-27  Holger Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        * wtf/Platform.h: Move Gdk up to allow building WebKit/Gdk on Darwin
+
+2007-05-27  Darin Adler  <darin@apple.com>
+
+        - fix a couple ifdefs that said WIN instead of WIN_OS
+
+        * kjs/collector.cpp:
+        (KJS::allocateBlock): WIN -> WIN_OS
+        (KJS::freeBlock): Ditto.
+
+2007-05-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin.
+
+        Patch for http://bugs.webkit.org/show_bug.cgi?id=13854
+        Port of commit 667785 from kjs
+
+        - special case calling String.localeCompare() with no parameters to return 0.
+
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFunc::callAsFunction):
+
+2007-05-25  Kimmo Kinnunen  <kimmok@iki.fi>
+
+        Reviewed by Darin.
+
+        - Fix for http://bugs.webkit.org/show_bug.cgi?id=13456
+        REGRESSION: setTimeout "arguments" object gets shadowed by a local variable
+
+        - Add a explicit check for arguments. Previously check was done with getDirect,
+        but since the arguments is created on-demand in ActivationImp, it doesn't
+        show up in the test. 'arguments' should always be in the VarDeclNode's
+        evaluation scope.
+
+        * kjs/nodes.cpp:
+        (VarDeclNode::evaluate): Additional check if the var decl identifier is 'arguments'
+
+2007-05-25  George Staikos  <staikos@kde.org>
+
+        Reviewed by Maciej.
+
+        - Use COMPILER(GCC), not PLATFORM(GCC) - as Platform.h defines
+
+        * wtf/FastMalloc.h:
+
+2007-05-25  Kimmo Kinnunen  <kimmok@iki.fi>
+
+        Reviewed by Darin.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=13623 (Decompilation of function
+          doesn't compile with "++(x,y)")
+        - Create the error node based on the actual node, not the node inside
+          parenthesis
+        - Fix applies to postfix, prefix and typeof operators
+        - Produces run-time ReferenceError like other non-lvalue assignments etc.
+
+        * kjs/grammar.y: Create {Prefix,Postfix}ErrorNode based on the actual node,
+        not the based on the node returned by "nodeInsideAllParens()". Same for
+        TypeOfValueNode.
+
+2007-05-25  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Zack.
+
+        Fix crash in Qt JavaScript bindings when the arguments used on the Qt side are not
+        registered with QMetaType.
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::invokeMethod):
+        * bindings/qt/qt_runtime.cpp:
+
+2007-05-24  Luciano Montanaro  <mikelima@cirulla.net>
+
+        Reviewed by Darin
+
+        Patch for http://bugs.webkit.org/show_bug.cgi?id=13855
+        Port patch 666176 to JavaScriptCore
+
+        - Renamed JSValue::downcast() to JSValue::asCell() which makes the
+        function meaning cleaner. It's modeled after Harri Porten change in 
+        KDE trunk.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::protect):
+        (KJS::Collector::unprotect):
+        (KJS::Collector::collectOnMainThreadOnly):
+        * kjs/object.h:
+        (KJS::JSValue::isObject):
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFunc::callAsFunction):
+        * kjs/value.h:
+        (KJS::JSValue::asCell):
+        (KJS::JSValue::isNumber):
+        (KJS::JSValue::isString):
+        (KJS::JSValue::isObject):
+        (KJS::JSValue::getNumber):
+        (KJS::JSValue::getString):
+        (KJS::JSValue::getObject):
+        (KJS::JSValue::getUInt32):
+        (KJS::JSValue::mark):
+        (KJS::JSValue::marked):
+        (KJS::JSValue::type):
+        (KJS::JSValue::toPrimitive):
+        (KJS::JSValue::toBoolean):
+        (KJS::JSValue::toNumber):
+        (KJS::JSValue::toString):
+        (KJS::JSValue::toObject):
+
+2007-05-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        * kjs/testkjs.pro: Make the Gdk port link to icu
+
+2007-05-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adele Peterson.
+        
+        It helps if you swap the right variable.
+
+        * wtf/HashSet.h:
+        (WTF::::operator):
+
+2007-05-15  Lars Knoll <lars@trolltech.com>
+
+        Reviewed by Zack
+
+        Extend the QObject JavaScript bindings to work for slots with
+        arguments.
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::invokeMethod):
+
+2007-05-14  Kimmo Kinnunen  <kimmok@iki.fi>
+
+        Reviewed by Darin.
+
+        - Fixes http://bugs.webkit.org/show_bug.cgi?id=13622 (Decompiler
+          omits trailing comma in array literal)
+
+         * kjs/nodes2string.cpp:
+         (ArrayNode::streamTo): print extra ',' in case there was elision
+         commas (check opt member var) and array elements present
+         in the array expression
+
+2007-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Added HashMap::swap and HashSet::swap. WebCore now uses HashSet::swap.
+        I figured while I was in the neighborhood I might as well add HashMap::swap,
+        too.
+
+        * wtf/HashMap.h:
+        (WTF::::operator):
+        (WTF::::swap):
+        * wtf/HashSet.h:
+        (WTF::::operator):
+        (WTF::::swap):
+
+2007-05-11  Kimmo Kinnunen  <kimmok@iki.fi>
+
+        Reviewed by Darin.
+
+        - Fix for bug http://bugs.webkit.org/show_bug.cgi?id=13620
+          Bogus decompilation of "for (var j = 1 in [])"
+        - ForInNode toString()'ed to syntax error if there was var decl
+          and initializer
+        - ForNode toStringed()'ed lost 'var ' if it was present
+
+        * kjs/nodes2string.cpp:
+        (VarDeclListNode::streamTo): Print "var " here
+        (VarStatementNode::streamTo): Don't print "var " here
+        (ForNode::streamTo): Remove TODO comment, VarDeclListNode will
+        stream the "var "
+        (ForInNode::streamTo): ForIn initializer is printed by VarDeclNode
+
+2007-05-11  Kimmo Kinnunen  <kimmok@iki.fi>
+
+        Reviewed by Darin.
+
+        - Fixes http://bugs.webkit.org/show_bug.cgi?id=10878
+          (Incorrect decompilation for "4..x")
+        - Group numbers in dotted expressions in toString() output, so we
+          avoid the 4.x constructs  when the original input is 4..x.
+          4..x means the same as 4. .x or (4).x or Number(4).x
+
+        * kjs/nodes2string.cpp:
+        (KJS::SourceStream::):
+        Add boolean flag to indicate that if next item is a number, it should be grouped.
+        Add new formatting enum which turns on the boolean flag.
+        (KJS::SourceStream::SourceStream): Added. Initialize the flag.
+        (SourceStream::operator<<): Added. New overloaded operator with double value as parameter.
+        (NumberNode::streamTo): Use the double operator
+        (ArrayNode::streamTo):
+        (DotAccessorNode::streamTo):
+        (FunctionCallDotNode::streamTo):
+        (FunctionCallParenDotNode::streamTo):
+        (PostfixDotNode::streamTo):
+        (DeleteDotNode::streamTo):
+        (PrefixDotNode::streamTo):
+        (AssignDotNode::streamTo): Use the new formatting enum to turn on the grouping flag.
+
+2007-05-10  Lars Knoll <lars@trolltech.com>
+
+        Reviewed by Zack
+
+        Fix our last three test failures in the JavaScript
+        tests.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+
+2007-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed #includes of JSStringRefCF.h and use of CF datatypes. I think I 
+        misunderstood this issue before.
+
+        * API/JavaScriptCore.h: #include JSStringRefCF.h. Platforms that don't
+        want this behavior can just #include individual headers, instead of the
+        umbrella framework header. But we definitely want Mac OS X clients to
+        get the #include of JSStringRefCF.h "for free."
+        * API/minidom.c: Don't #include JSStringRefCF.h. (Don't need to #include
+        JavaScriptCore.h, either.)
+        * API/testapi.c: Don't #include JSStringRefCF.h. Do use CF datatypes
+        regardless of whether __APPLE__ is defined. Platforms that don't support
+        CF just shouldn't compile this file.
+        (main):
+
+2007-05-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by mjs.
+        
+        http://bugs.webkit.org/show_bug.cgi?id=6985
+        Cyclic __proto__ values cause WebKit to hang
+
+        * kjs/object.cpp:
+        (KJS::JSObject::put): do a cycle check before setting __proto__
+
+2007-05-08  Kimmo Kinnunen  <kimmok@iki.fi>
+
+        Reviewed by darin.  Landed by eseidel.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=10880 (Do..while loop gains 
+        a semicolon each time it is toStringed)
+        Grammar in Ecma-66262, 12.6: "do Statement while ( Expression );"
+        EmptyStatement was created after every do..while(expr) which
+        had semicolon at the end.
+
+        * kjs/grammar.y: Require semicolon at the end of do..while
+
+2007-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix -- this time for sure.
+        
+        APICast.h, being private, ends up in a different folder than JSValueRef.h,
+        so we can't include one from the other using "". Instead, just forward
+        declare the relevant data types.
+
+        * API/APICast.h:
+
+2007-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export APICast.h for WebCore and WebKit.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-05-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=12821
+          <rdar://problem/5007921> Number.toExponential doesn't work for negative numbers
+
+        * kjs/number_object.cpp: (NumberProtoFunc::callAsFunction):
+        Added a call to fabs before calling log10.
+
+2007-05-03  Holger Freyther <freyther@kde.org>
+
+        Reviewed by Zack, landed by Simon.
+        This is bugzilla bug 13499.
+
+        * JavaScriptCore.pri: Place Qt into the qt-port scope
+        * bindings/testbindings.pro: Place Qt into the qt-port scope
+        * kjs/testkjs.pro: Place Qt into the qt-port scope
+        * pcre/pcre.pri: Place Qt into the qt-port scope
+
+2007-05-02  David Harrison  <harrison@apple.com>
+
+        Reviewed by Antti.
+
+        <rdar://problem/5174862> Crash resulting from DeprecatedString::insert()
+
+        Added insertion support for more than one value.
+        
+        * wtf/Vector.h:
+        (WTF::::insert):
+        Added support for inserting multiple values.
+        
+        (WTF::::prepend):
+        New. Insert at the start of vectors. Convenient for vectors used as strings.
+
+2007-05-01  Jungshik Shin  <jungshik.shin@gmail.com>
+
+        Reviewed by Alexey.
+
+        - get rid of non-ASCII lteral characters : suppress compiler warnings
+        http://bugs.webkit.org/show_bug.cgi?id=13551
+         
+        * kjs/testkjs.cpp:
+        * pcre/pcre_compile.c:
+
+2007-04-28  Jungshik Shin  <jungshik.shin@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        - Replace copyright sign in Latin-1 (0xA9) with '(C)'
+        http://bugs.webkit.org/show_bug.cgi?id=13531
+
+        * bindings/npruntime.h:
+    
+2007-04-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix <rdar://problem/5154144> Hamachi test fails: assertion failure in ListHashSet
+
+        Test: fast/forms/add-remove-form-elements-stress-test.html
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetNodeAllocator::ListHashSetNodeAllocator): Initialize
+        m_isDoneWithInitialFreeList to false.
+        (WTF::ListHashSetNodeAllocator::allocate): Added assertions based on a debug-only
+        m_isAllocated flag that make sure we don't allocate a block that's already allocated.
+        These assertions helped pinpoint the bug. Set m_isDoneWithInitialFreeList when we
+        allocate the last block of the initial free list. Once we're done with the initial
+        free list, turn off the rule that says that the next node in the pool after the last
+        node in the free list is also free. This rule works because any free nodes are added
+        to the head of the free list, so a node that hasn't been allocated even once is always
+        at the tail of the free list and all the nodes after it also haven't been allocated
+        even once. But it doesn't work any longer once the entire pool has been used at least
+        once, because there's nothing special about the last node on the free list any more.
+        (WTF::ListHashSetNodeAllocator::deallocate): Set the node's m_isAllocated to false.
+        (WTF::ListHashSetNodeAllocator::pastPool): Added. Used above.
+        (WTF::ListHashSetNodeAllocator::inPool): Changed to use the pastPool function.
+        (WTF::ListHashSetNode::ListHashSetNode): Initialize m_isAllocated to true.
+        (WTF::ListHashSetNode::operator new): Removed variable name for unused size
+        parameter.
+        (WTF::ListHashSetNode::destroy): Changed to call the destructor rather than
+        delete -- this gets rid of the need to define an operator delete.
+
+2007-04-27  Christopher Brichford  <chrisb@adobe.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix for: Bug 13211: Move JavaScriptCore mac project files for apollo port
+        http://bugs.webkit.org/show_bug.cgi?id=13211
+
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore.Debug.xcconfig: Added.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore.Release.xcconfig: Added.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore.xcconfig: Added.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore.xcodeproj/project.pbxproj: Added.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.Debug.xcconfig: Removed.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.Release.xcconfig: Removed.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.xcconfig: Removed.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj: Removed.
+
+2007-04-27  Holger Freyther <freyther@kde.org>
+
+        Reviewed by Maciej.
+
+        Remove unmaintained CMake build system.
+
+        * CMakeLists.txt: Removed.
+        * pcre/CMakeLists.txt: Removed.
+
+2007-04-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Improve dependencies in Xcode project
+        by marking dftables as a dependency of Generate Derived Sources rather than of
+        JavaScriptCore itself.
+
+2007-04-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix -- added #includes that we used to get implicitly through
+        JSStringRef.h.
+
+        * API/JSNode.c:
+        * API/JSNodeList.c:
+        * API/minidom.c:
+        * API/testapi.c:
+
+2007-04-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak, Adam Roben.
+        
+        Fixed 
+        <rdar://problem/4885130> Remove #include of JSStringRefCF.h from JSStringRef.h
+        <rdar://problem/4885123> JavaScriptCore is not cross-platform -- JSStringRef.h references CF datatypes
+
+        * API/JSStringRef.h: Removed #include -- no clients need it anymore.
+
+2007-04-25  David Kilzer  <ddkilzer@apple.com>
+
+        Reviewed by Maciej.
+
+        Add assertions for debug builds.
+
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::lock): Assert the return value of pthread_mutex_lock() in debug builds.
+        (KJS::JSLock::unlock): Assert the return value of pthread_mutex_unlock() in debug builds.
+
+2007-04-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Anders.
+        
+        - fix build problems
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Disable warning that
+        gives often downright incorrect results based on guessing what will happen in 64-bit.
+
+2007-04-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - tweak the allocator for a small speedup -- Shark showed this was a win, but I can't
+          measure an improvement right now, but it's also clear these changes do no harm
+
+        * wtf/FastMalloc.cpp:
+        (WTF::LgFloor): Use ALWAYS_INLINE here; in testing I did a while back this was necessary
+        to get this single-instruction function to be inlined.
+        (WTF::SizeClass): Use ALWAYS_INLINE here too for the same reason. Also change the special
+        case for a size of 0 to work without a branch for a bit of extra speed.
+        (WTF::ByteSizeForClass): Use ALWAYS_INLINE here too for the same reason.
+
+2007-04-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - use custom calling convention for everything in nodes.cpp on intel gcc for 1.5% speed boost
+
+        Nearly all functions in nodes.cpp were marked up to use the
+        regparm(3) calling convention under GCC for x86, since this is
+        faster and they are all guaranteed to be called only internally to
+        kjs.
+        
+        The only exception is destructors, since delete doesn't know how to use a custom calling convention.
+        
+        * kjs/nodes.cpp:
+        (dotExprDoesNotAllowCallsString):
+        * kjs/nodes.h:
+        (KJS::Node::):
+        (KJS::StatementNode::):
+        (KJS::NullNode::):
+        (KJS::BooleanNode::):
+        (KJS::NumberNode::):
+        (KJS::StringNode::):
+        (KJS::RegExpNode::):
+        (KJS::ThisNode::):
+        (KJS::ResolveNode::):
+        (KJS::GroupNode::):
+        (KJS::ElementNode::):
+        (KJS::ArrayNode::):
+        (KJS::PropertyNameNode::):
+        (KJS::PropertyNode::):
+        (KJS::PropertyListNode::):
+        (KJS::ObjectLiteralNode::):
+        (KJS::BracketAccessorNode::):
+        (KJS::DotAccessorNode::):
+        (KJS::ArgumentListNode::):
+        (KJS::ArgumentsNode::):
+        (KJS::NewExprNode::):
+        (KJS::FunctionCallValueNode::):
+        (KJS::FunctionCallResolveNode::):
+        (KJS::FunctionCallBracketNode::):
+        (KJS::FunctionCallParenBracketNode::):
+        (KJS::FunctionCallDotNode::):
+        (KJS::FunctionCallParenDotNode::):
+        (KJS::PostfixResolveNode::):
+        (KJS::PostfixBracketNode::):
+        (KJS::PostfixDotNode::):
+        (KJS::PostfixErrorNode::):
+        (KJS::DeleteResolveNode::):
+        (KJS::DeleteBracketNode::):
+        (KJS::DeleteDotNode::):
+        (KJS::DeleteValueNode::):
+        (KJS::VoidNode::):
+        (KJS::TypeOfResolveNode::):
+        (KJS::TypeOfValueNode::):
+        (KJS::PrefixResolveNode::):
+        (KJS::PrefixBracketNode::):
+        (KJS::PrefixDotNode::):
+        (KJS::PrefixErrorNode::):
+        (KJS::UnaryPlusNode::):
+        (KJS::NegateNode::):
+        (KJS::BitwiseNotNode::):
+        (KJS::LogicalNotNode::):
+        (KJS::MultNode::):
+        (KJS::AddNode::):
+        (KJS::ShiftNode::):
+        (KJS::RelationalNode::):
+        (KJS::EqualNode::):
+        (KJS::BitOperNode::):
+        (KJS::BinaryLogicalNode::):
+        (KJS::ConditionalNode::):
+        (KJS::AssignResolveNode::):
+        (KJS::AssignBracketNode::):
+        (KJS::AssignDotNode::):
+        (KJS::AssignErrorNode::):
+        (KJS::CommaNode::):
+        (KJS::AssignExprNode::):
+        (KJS::VarDeclListNode::):
+        (KJS::VarStatementNode::):
+        (KJS::EmptyStatementNode::):
+        (KJS::ExprStatementNode::):
+        (KJS::IfNode::):
+        (KJS::DoWhileNode::):
+        (KJS::WhileNode::):
+        (KJS::ForNode::):
+        (KJS::ContinueNode::):
+        (KJS::BreakNode::):
+        (KJS::ReturnNode::):
+        (KJS::WithNode::):
+        (KJS::LabelNode::):
+        (KJS::ThrowNode::):
+        (KJS::TryNode::):
+        (KJS::ParameterNode::):
+        (KJS::Parameter::):
+        (KJS::FunctionBodyNode::):
+        (KJS::FuncExprNode::):
+        (KJS::FuncDeclNode::):
+        (KJS::SourceElementsNode::):
+        (KJS::CaseClauseNode::):
+        (KJS::ClauseListNode::):
+        (KJS::SwitchNode::):
+
+2007-04-24  Oliver Hunt  <oliver@apple.com>
+
+        GTK Build fix, ::findEntry->KJS::findEntry
+
+        * kjs/lookup.cpp:
+        (KJS::Lookup::findEntry):
+        (KJS::Lookup::find):
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - compile most of JavaScriptCore as one file for 4% JS iBench speed improvement 
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add AllInOneFile.cpp, and remove files it includes
+        from the build.
+        * kjs/AllInOneFile.cpp: Added.
+        * kjs/dtoa.cpp: Renamed CONST to CONST_ to avoid conflict.
+        (Bigint::):
+        (Bigint::nrv_alloc):
+        * kjs/lookup.cpp: Use "namspace KJS { ... }" instead of "using namespace KJS;" 
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        * kjs/collector.h: Fix struct/class mismatch.
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - raise ALLOCATIONS_PER_COLLECTION to 4000, for 3.7% iBench speed improvement
+         
+        Now that the cell size is smaller and the block size is bigger, we can fit 4000 objects in
+        the two spare cells the collector is willing to keep around, so collect a bit less often.
+        
+        * kjs/collector.cpp:
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin and Geoff.
+        
+        - move mark and collectOnMainThreadOnly bits into separate bitmaps
+        
+        This saves 4 bytes per cell, allowing shrink of cell size to 32,
+        which leads to a .8% speed improvement on iBench.
+        
+        This is only feasible because of all the previous changes on the branch.
+
+        * kjs/collector.cpp:
+        (KJS::allocateBlock): Adjust for some renames of constants. 
+        (KJS::Collector::markStackObjectsConservatively): Now that cells are 32 bytes (64 
+        bytes on 64-bit) the cell alignment check can be made much more strict, and also
+        obsoletes the need for a % sizeof(CollectorCell) check. Also, we can mask off the low
+        bits of the pointer to have a potential block pointer to look for.
+        (KJS::Collector::collectOnMainThreadOnly): Use bitmap.
+        (KJS::Collector::markMainThreadOnlyObjects): Use bitmap.
+        (KJS::Collector::collect): When sweeping, use bitmaps directly to find mark bits.
+        * kjs/collector.h:
+        (KJS::): Move needed constants and type declarations here.
+        (KJS::CollectorBitmap::get): Bit twiddling to get a bitmap value.
+        (KJS::CollectorBitmap::set): Bit twiddling to set a bitmap bit to true.
+        (KJS::CollectorBitmap::clear): Bit twiddling to set a bitmap bit to false.
+        (KJS::CollectorBitmap::clearAll): Clear whole bitmap at one go.
+        (KJS::Collector::cellBlock): New operation, compute the block pointer for
+        a cell by masking off low bits.
+        (KJS::Collector::cellOffset): New operation, compute the cell offset for a
+        cell by masking off high bits and dividing (actually a shift).
+        (KJS::Collector::isCellMarked): Check mark bit in bitmap
+        (KJS::Collector::markCell): Set mark bit in bitmap.
+        * kjs/value.h:
+        (KJS::JSCell::JSCell): No more bits.
+        (KJS::JSCell::marked): Let collector handle it.
+        (KJS::JSCell::mark): Let collector handle it.
+
+2007-04-23  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+        
+        * kjs/regexp_object.h:
+        RegExpObjectImpPrivate is a struct, not a class.
+        
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - shrink FunctionImp / DeclaredFunctionImp by 4 bytes, by moving parameter list to function body
+        
+        I reconciled this with a similar change in KDE kjs by Maks Orlovich <maksim@kde.org>.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::FunctionImp::passInParameters):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::FunctionImp::getParameterName):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (FunctionProtoFunc::callAsFunction):
+        (FunctionObjectImp::construct):
+        * kjs/nodes.cpp:
+        (FunctionBodyNode::addParam):
+        (FunctionBodyNode::paramString):
+        (FuncDeclNode::addParams):
+        (FuncDeclNode::processFuncDecl):
+        (FuncExprNode::addParams):
+        (FuncExprNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::Parameter::Parameter):
+        (KJS::FunctionBodyNode::numParams):
+        (KJS::FunctionBodyNode::paramName):
+        (KJS::FunctionBodyNode::parameters):
+        (KJS::FuncExprNode::FuncExprNode):
+        (KJS::FuncDeclNode::FuncDeclNode):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Disable 64-bit warnings because
+        they handle size_t badly.
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+ 
+        Reviewed by Darin.
+
+        - shrink RegexpObjectImp by 4 bytes
+        
+        Somewhat inexplicably, this seems to be a .33% speedup on JS iBench.
+        
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpObjectImpPrivate::RegExpObjectImpPrivate):
+        (RegExpObjectImp::RegExpObjectImp):
+        (RegExpObjectImp::performMatch):
+        (RegExpObjectImp::arrayOfMatches):
+        (RegExpObjectImp::getBackref):
+        (RegExpObjectImp::getLastMatch):
+        (RegExpObjectImp::getLastParen):
+        (RegExpObjectImp::getLeftContext):
+        (RegExpObjectImp::getRightContext):
+        (RegExpObjectImp::getValueProperty):
+        (RegExpObjectImp::putValueProperty):
+        * kjs/regexp_object.h:
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - change to 1-bit bitfields instead of 8-bit, this turns out to lead to a .51% speedup on JS iBench
+        
+        The 1-bit bitfields are actually faster than just plain bools, at least on Intel (go figure).
+
+        * kjs/property_map.h:
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+       
+        - shrink ArrayInstance objects by 4 bytes
+        http://bugs.webkit.org/show_bug.cgi?id=13386
+        
+        I did this by storing the capacity before the beginning of the storage array. It turns out
+        it is rarely needed and is by definition 0 when the storage array is null.
+ 
+        * kjs/array_instance.h:
+        (KJS::ArrayInstance::capacity): Get it from the secret stash
+        * kjs/array_object.cpp:
+        (allocateStorage): New function to encapsulate allocating the storage with extra space ahead
+        for the capacity.
+        (reallocateStorage): ditto for realloc
+        (ArrayInstance::ArrayInstance):
+        (ArrayInstance::~ArrayInstance):
+        (ArrayInstance::resizeStorage):
+
+2007-04-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix <rdar://problem/4840688> REGRESSION (r10588, r10621): JavaScript won't parse
+          modifications of non-references (breaks 300themovie.warnerbros.com, fedex.com)
+
+        Despite the ECMAScript specification's claim that you can treat these as syntax
+        errors, doing so creates some website incompatibilities. So this patch turns them back
+        into evaluation errors instead.
+
+        Test: fast/js/modify-non-references.html
+
+        * kjs/grammar.y: Change makeAssignNode, makePrefixNode, and makePostfixNode so that they
+        never fail to parse. Update rules that use them. Fix a little bit of indenting. Use
+        new PostfixErrorNode, PrefixErrorNode, and AssignErrorNode classes.
+
+        * kjs/nodes.h: Added an overload of throwError that takes a char* argument.
+        Replaced setExceptionDetailsIfNeeded and debugExceptionIfNeeded with handleException,
+        which does both. Added PostfixErrorNode, PrefixErrorNode, and AssignErrorNode classes.
+
+        * kjs/nodes.cpp: Changed exception macros to use handleException; simpler and smaller
+        code size than the two functions that we used before.
+        (Node::throwError): Added the overload mentioned above.
+        (Node::handleException): Added. Contains the code from both setExceptionDetailsIfNeeded
+        and debugExceptionIfNeeded.
+        (PostfixErrorNode::evaluate): Added. Throws an exception.
+        (PrefixErrorNode::evaluate): Ditto.
+        (AssignErrorNode::evaluate): Ditto.
+        (ThrowNode::execute): Call handleException instead of debugExceptionIfNeeded; this
+        effectively adds a call to setExceptionDetailsIfNeeded, which may help with getting
+        the correct file and line number for these exceptions.
+
+        * kjs/nodes2string.cpp:
+        (PostfixErrorNode::streamTo): Added.
+        (PrefixErrorNode::streamTo): Added.
+        (AssignErrorNode::streamTo): Added.
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - fix test failures / crashes on PPC
+
+        * kjs/property_map.h: Make the bool fields explicitly 8-bit bitfields, since bool is a full
+        word there otherwise :-(
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - fix more test case failures
+
+        * bindings/runtime_array.cpp:
+        (RuntimeArray::RuntimeArray): inherit from JSObject instead of ArrayInstance; it turns
+        out that this class only needs the prototype and classInfo from ArrayInstance, not the
+        actual class itself, and it was too big otherwise.
+        (RuntimeArray::getOwnPropertySlot):
+        * bindings/runtime_array.h:
+
+2007-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - fix some test failures
+
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::RuntimeMethod): inherit from InternalFunctionImp instead of FunctionImpl,
+        otherwise this is too big
+        (RuntimeMethod::getOwnPropertySlot):
+        * bindings/runtime_method.h:
+
+2007-04-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - discard the arguments List for an ActivationImp when the corresponding Context is destroyed (1.7% speedup)
+        http://bugs.webkit.org/show_bug.cgi?id=13385
+
+        Based an idea by Christopher E. Hyde <C.Hyde@parableuk.force9.co.uk>. His patch to do 
+        this also had many other List changes and I found this much simpler subset of the changes
+        was actually a hair faster.
+        
+        This optimization is valid because the arguments list is only kept around to
+        lazily make the arguments object. If it's not made by the time the function
+        exits, it never will be, since any function that captures the continuation will
+        have its own local arguments variable in scope.
+        
+        Besides the 1.7% speed improvement, it shrinks List by 4 bytes
+        (which in turn shrinks ActivationImp by 4 bytes).
+        
+        * kjs/Context.cpp:
+        (KJS::Context::~Context): Clear the activation's arguments list.
+        * kjs/function.cpp:
+        (KJS::ActivationImp::ActivationImp): Adjusted for list changes.
+        (KJS::ActivationImp::mark): No need to mark, lists are always protected (this doesn't
+        cause a ref-cycle for reasons stated above).
+        (KJS::ActivationImp::createArgumentsObject): Clear arguments list.
+        * kjs/function.h:
+        * kjs/list.cpp:
+        (KJS::List::List): No more needsMarking boolean
+        (KJS::List::operator=): ditto
+        * kjs/list.h:
+        (KJS::List::List): ditto
+        (KJS::List::reset): ditto
+        (KJS::List::deref): ditto
+
+2007-04-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - shrink PropertyMap by 8 bytes and therefore shrink CELL_SIZE to 40 (for 32-bit; 
+        similar shrinkage for 64-bit)
+        http://bugs.webkit.org/show_bug.cgi?id=13384
+
+        Inspired by similar changes by Christopher E. Hyde <C.Hyde@parableuk.force9.co.uk>
+        done in the kjs-tweaks branch of KDE's kjs. However, this version is somewhat 
+        cleaner style-wise and avoids some of the negative speed impact (at least on gcc/x86) 
+        of his version.
+        
+        This is nearly a wash performance-wise, maybe a slight slowdown, but worth doing
+        to eventually reach cell size 32.
+        
+        * kjs/collector.cpp:
+        (KJS::):
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::~PropertyMap):
+        (KJS::PropertyMap::clear):
+        (KJS::PropertyMap::get):
+        (KJS::PropertyMap::getLocation):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::insert):
+        (KJS::PropertyMap::expand):
+        (KJS::PropertyMap::rehash):
+        (KJS::PropertyMap::remove):
+        (KJS::PropertyMap::mark):
+        (KJS::PropertyMap::containsGettersOrSetters):
+        (KJS::PropertyMap::getEnumerablePropertyNames):
+        (KJS::PropertyMap::getSparseArrayPropertyNames):
+        (KJS::PropertyMap::save):
+        (KJS::PropertyMap::checkConsistency):
+        * kjs/property_map.h:
+        (KJS::PropertyMap::hasGetterSetterProperties):
+        (KJS::PropertyMap::setHasGetterSetterProperties):
+        (KJS::PropertyMap::):
+        (KJS::PropertyMap::PropertyMap):
+
+2007-04-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - change blocks to 64k in size, and use various platform-specific calls to allocate at 64k-aligned addresses
+        http://bugs.webkit.org/show_bug.cgi?id=13383
+        
+        * kjs/collector.cpp:
+        (KJS::allocateBlock): New function to allocate 64k of 64k-aligned memory
+        (KJS::freeBlock): Corresponding free
+        (KJS::Collector::allocate):
+        (KJS::Collector::collect):
+
+2007-04-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin and Geoff.
+        
+        - remove the concept of oversize objects, now that there aren't any (for now
+        only enforced with an assert).
+        http://bugs.webkit.org/show_bug.cgi?id=13382
+
+        This change is a .66% speedup on JS iBench for 32-bit platforms, probably much more
+        for 64-bit since it finally gives a reasonable cell size, but I did not test that.
+        
+        * kjs/collector.cpp:
+        (KJS::): Use different cell size for 32-bit and 64-bit, now that there is no
+        oversize allocation.
+        (KJS::Collector::allocate): Remove oversize allocator.
+        (KJS::Collector::markStackObjectsConservatively): Don't check oversize objects.
+        (KJS::Collector::markMainThreadOnlyObjects): Ditto.
+        (KJS::Collector::collect): Ditto.
+
+2007-04-21  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Adam.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=13428
+          REGRESSION (r20973-r20976): Failing ecma/Array/15.4.4.5-3.js
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=13429
+          REGRESSION (r20973-r20976): Crashing in fast/dom/plugin-attributes-enumeration.html
+
+        * kjs/array_object.cpp:
+        (ArrayInstance::sort): Free the old storage, not the new one.
+
+2007-04-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        - fix build problem with last change - -O3 complains more about uninitialized variables
+        
+        * pcre/pcre_compile.c:
+        (compile_branch):
+        (pcre_compile2):
+
+2007-04-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - <rdar://problem/5149915> use mergesort when possible, since it leads to fewer compares (2% JS iBench speedup)
+
+        * kjs/array_object.cpp:
+        (ArrayInstance::sort): Use mergesort(3) on platforms that have it, since it tends
+        to do fewer compares than qsort; but avoid it very on large arrays since it uses extra
+        memory. Also added comments identifying possibly even better sorting algorithms
+        for sort by string value and sort by compare function.
+        * kjs/config.h:
+
+2007-04-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - bump optimization flags up to -O3 for 1% JS iBench speed improvement 
+
+        * Configurations/Base.xcconfig:
+
+2007-04-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej.
+
+        Fix bogus optimisation in the generic pthread code path.
+
+        * kjs/collector.cpp:
+        (KJS::currentThreadStackBase):
+
+2007-04-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders.
+
+        Improve FreeBSD compatibility, as suggested by Alexander Botero-Lowry.
+
+        * kjs/collector.cpp:
+        (KJS::currentThreadStackBase): FreeBSD requires that pthread_attr_t's are
+        initialized via pthread_attr_init before being used in any context.
+
+2007-04-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=13401
+        Bug 13401: Reproducible crash calling myArray.sort(compareFn) from within
+        a sort comparison function
+
+        * kjs/array_object.cpp:
+        (ArrayInstance::sort): Save/restore the static variables around calls to qsort
+        to ensure nested calls to ArrayInstance::sort behave correctly.
+
+2007-04-12  Deneb Meketa  <dmeketa@adobe.com>
+
+        Reviewed by Darin Adler.
+
+        http://bugs.webkit.org/show_bug.cgi?id=13029
+        rdar://problem/4994849
+        Bug 13029: Permit NPAPI plug-ins to see HTTP response headers.
+        This doesn't actually change JavaScriptCore, but that's where npapi.h is.
+
+        * bindings/npapi.h:
+        Add headers member to NPStream struct.  Also increase NP_VERSION_MINOR to 18.
+        Increasing to >= 17 allows plug-ins to safely detect whether to look for
+        NPStream::headers.  Increasing from 17 to 18 reflects presence of NPObject
+        enumeration, which was added in a prior patch, and which has been agreed to
+        constitute version 18 by the plugin-futures list.  Also add other missing
+        bits of npapi.h to catch up from 14 to 18.  This includes features that are
+        not implemented in WebKit, but those are safely stubbed.
+
+2007-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Fixed last check-in to print in release builds, too.
+
+        * kjs/collector.cpp:
+        (KJS::getPlatformThreadRegisters):
+
+2007-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John Sullivan, Darin Adler.
+        
+        Fixed <rdar://problem/5121899> JavaScript garbage collection leads to 
+        later crash under Rosetta (should abort or leak instead?)
+        
+        Log an error message and crash if the kernel reports failure during GC.
+        We decided to do this instead of just leaking because we don't want people
+        to get the mistaken impression that running in Rosetta is a supported
+        configurtion.
+        
+        The CRASH macro will also hook into CrashReporter, which will tell us if 
+        many (any?) users run into this issue.
+
+        * kjs/collector.cpp:
+        (KJS::getPlatformThreadRegisters):
+
+2007-04-06  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by darin.
+
+        Coverity fix. Coverity says:
+        "Event var_deref_model: Variable "sourceRanges" tracked as NULL was passed to a
+        function that dereferences it"
+
+        * kjs/string_object.cpp:
+        (KJS::replace):
+
+2007-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Adele Peterson.
+
+        * kjs/ExecState.h: Removed obsolete forward/friend declaration of 
+        RuntimeMethodImp.
+
+2007-04-05  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by darin.
+
+        Coverity fix. Coverity says:
+        "Event check_after_deref: Pointer "dateString" dereferenced before NULL check"
+
+        * kjs/date_object.cpp:
+        (KJS::parseDate):
+
+2007-04-05  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by darin.
+
+        Coverity fix. Coverity says:
+        "Event check_after_deref: Pointer "re" dereferenced before NULL check"
+
+        * pcre/pcre_study.c:
+        (pcre_study):
+
+2007-04-05  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by darin.
+
+        Coverity fixes. Coverity says:
+        "Event leaked_storage: Returned without freeing storage "buffer""
+        and:
+        "Event leaked_storage: Returned without freeing storage "script""
+
+        * kjs/testkjs.cpp:
+        (doIt):
+        (createStringWithContentsOfFile):
+
+2007-04-05  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by darin.
+
+        Coverity fix: in single-threaded case currentThreadIsMainThread is always true
+        so the code in if (!currentThreadIsMainThread) cannot possibly be reached
+        and Coverity complains about dead code.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+
+=== Safari-5522.6 ===
+
+2007-04-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam.
+
+        - Testing a post-commit hook.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2007-04-03  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam.
+
+        <rdar://problem/5107534>
+        http://bugs.webkit.org/show_bug.cgi?id=13265
+        REGRESSION: Crash in KJS::Bindings::convertValueToNPVariant
+        
+        * bindings/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        Return false if the object isn't a function. Set the return value to undefined by default
+        (to match Firefox).
+        
+2007-03-30  Anders Carlsson <andersca@apple.com>
+
+        Build fix.
+        
+        * bindings/NP_jsobject.cpp:
+        (_NPN_Enumerate):
+
+2007-03-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Implement _NPN_Enumerate support.
+        
+        * JavaScriptCore.exp:
+        * bindings/NP_jsobject.cpp:
+        (_NPN_Enumerate):
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::getPropertyNames):
+        * bindings/c/c_instance.h:
+        * bindings/npapi.h:
+        * bindings/npruntime.h:
+        * bindings/npruntime_impl.h:
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::getPropertyNames):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::getPropertyNames):
+        * bindings/runtime_object.h:
+        (KJS::RuntimeObjectImp::getInternalInstance):
+
+2007-03-28  Jeff Walden  <jwalden+code@mit.edu>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=12963
+        Fix some inconsistencies in the Mozilla JS Array extras implementations
+        with respect to the Mozilla implementation:
+
+          - holes in arrays should be skipped, not treated as undefined,
+            by all such methods
+          - an element with value undefined is not a hole
+          - Array.prototype.forEach should return undefined
+
+        * kjs/array_object.cpp:
+        (ArrayInstance::getOwnPropertySlot):
+        (ArrayProtoFunc::callAsFunction):
+
+2007-03-27  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        Call JSObject:call for native JavaScript objects.
+
+2007-03-26  David Carson  <dacarson@gmail.com>
+
+        Reviewed by Darin, landed by Anders.
+
+        Fix for: REGRESSION (r19559): Java applet crash
+        http://bugs.webkit.org/show_bug.cgi?id=13142
+        <rdar://problem/5080340>
+
+        The previous fix http://bugs.webkit.org/show_bug.cgi?id=12636 
+        introduced new JNIType to enum in jni_utility.h This is a 
+        problem on the Mac as it seems that the JNIType enum is also
+        used in the JVM, it is used to specify the return type in
+        jni_objc.mm
+        Corrected the fix by moving type to the end, and changing
+        jni_objc.mm to convert the new type to an old compatible
+        type.
+
+        * bindings/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall):
+        * bindings/jni/jni_utility.h:
+
+2007-03-26  Christopher Brichford  <chrisb@adobe.com>
+
+        Reviewed/landed by Adam.
+
+        Bug 13198: Move build settings from project file to xcconfig file for apollo
+        port JSCore
+        http://bugs.webkit.org/show_bug.cgi?id=13198
+
+        - Moving build settings from xcode project file to xcconfig files.
+
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.Debug.xcconfig:
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.Release.xcconfig:
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.xcconfig:
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-03-26  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Anders and Maciej aand Geoff (oh my!)
+        
+        Since CFTypeRef is really void*, a RetainPtr couldn't be used. 
+        RefType was "void", which doesn't actually exist as a type.
+        Since RefType only existed for operator*(), and since that operator
+        doesn't make any sense for RetainPtr, I removed them!
+
+        * kjs/nodes.cpp: Touch this to force a rebuild and (hopefully) help the
+          compiler with dependencies
+        * wtf/RetainPtr.h: Nuke RefType and operator*()
+
+2007-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Touched a file to (hopefully) help the compiler with RetainPtr dependencies.
+
+        * kjs/nodes.cpp:
+        (Node::deref):
+
+2007-03-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam
+
+        Whoops, RetainPtr should be in the WTF namespace
+
+        * wtf/RetainPtr.h:
+
+2007-03-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam
+        
+        <rdar://problem/5086210> - Move RetainPtr to WTF
+
+        * wtf/RetainPtr.h: Added
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add it to the project file
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto
+
+
+2007-03-23  Christopher Brichford  <chrisb@adobe.com>
+
+        Reviewed/landed by Adam.
+
+        Bug 13175: Make apollo mac project files for JavaScriptCore actually
+        build something
+        http://bugs.webkit.org/show_bug.cgi?id=13175
+
+        - Changing apollo mac project files for JavaScriptCore such that they actually build
+        JavaScriptCore source code.
+
+        * JavaScriptCore.apolloproj/ForwardingSources/grammar.cpp: Added.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.xcconfig:
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-03-24  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin.
+
+        * Configurations/JavaScriptCore.xcconfig: Remove unnecessary INFOPLIST_PREPROCESS.
+
+2007-03-22  Christopher Brichford  <chrisb@adobe.com>
+
+        Reviewed/landed by Adam.
+
+        Bug 13164: Initial version of mac JavaScriptCore project files for
+        apollo port 
+        http://bugs.webkit.org/show_bug.cgi?id=13164
+
+        - Adding mac project files for apollo port of JavaScriptCore. Currently project
+        just builds dftables.
+
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.Debug.xcconfig: Added.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.Release.xcconfig: Added.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.xcconfig: Added.
+        * JavaScriptCore.apolloproj/mac/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj: Added.
+
+2007-03-21  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5076599> JavaScriptCore has a weak export (vtable for KJS::JSCell)
+
+        * JavaScriptCore.exp: Remove __ZTVN3KJS6JSCellE.
+
+2007-03-21  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Geoff.
+
+        * API/JSStringRef.cpp: (JSStringIsEqual): Added JSLock.
+
+2007-03-21  Zack Rusin  <zrusin@trolltech.com>
+
+        Fix the compile when USE(MULTIPLE_THREADS) isn't
+        defined
+
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::currentThreadIsHoldingLock):
+
+2007-03-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff and Adam.
+        
+        - make USE(MULTIPLE_THREADS) support more portable
+        http://bugs.webkit.org/show_bug.cgi?id=13069
+        
+        - fixed a threadsafety bug discovered by testing this
+        
+        - enhanced threadsafety assertions in collector
+
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::~JSCallbackObject): This destructor can't
+        DropAllLocks around the finalize callback, because it gets called
+        from garbage collection and we can't let other threads collect!
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::currentThreadIsHoldingLock): Added new function
+        to allow stronger assertions than just that the lock is held
+        by some thread (you can now assert that the current thread is
+        holding it, given the new JSLock design).
+        * kjs/JSLock.h:
+        * kjs/collector.cpp: Refactored for portability plus added some
+        stronger assertions.
+        (KJS::Collector::allocate):
+        (KJS::currentThreadStackBase):
+        (KJS::Collector::registerAsMainThread):
+        (KJS::onMainThread):
+        (KJS::PlatformThread::PlatformThread):
+        (KJS::getCurrentPlatformThread):
+        (KJS::Collector::Thread::Thread):
+        (KJS::destroyRegisteredThread):
+        (KJS::Collector::registerThread):
+        (KJS::Collector::markCurrentThreadConservatively):
+        (KJS::suspendThread):
+        (KJS::resumeThread):
+        (KJS::getPlatformThreadRegisters):
+        (KJS::otherThreadStackPointer):
+        (KJS::otherThreadStackBase):
+        (KJS::Collector::markOtherThreadConservatively):
+        (KJS::Collector::markStackObjectsConservatively):
+        (KJS::Collector::protect):
+        (KJS::Collector::unprotect):
+        (KJS::Collector::collectOnMainThreadOnly):
+        (KJS::Collector::markMainThreadOnlyObjects):
+        (KJS::Collector::collect):
+        * kjs/collector.h:
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSetIsMultiThreaded):
+        * wtf/FastMallocInternal.h:
+        * wtf/Platform.h:
+
+2007-03-19  Darin Adler  <darin@apple.com>
+
+        * kjs/value.h: Roll ~JSValue change out. It was causing problems. I'll do it right later.
+
+2007-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed <rdar://problem/5073380> REGRESSION: Crash occurs at WTF::fastFree() 
+        when reloading liveconnect page (applet)
+        
+        Best to use free when you use malloc, especially when malloc and delete
+        use completely different libraries.
+
+        * bindings/jni/jni_runtime.cpp:
+        (JavaMethod::~JavaMethod):
+
+2007-03-19  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Maciej.
+
+        Really set Xcode editor to use 4 space indentation (http://webkit.org/coding/coding-style.html)
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-03-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - Changed list size threshold to 5 based on testing.
+
+        I was testing the i-Bench JavaScript with the list statistics
+        dumping on, and discovered that there were many 5-element lists.
+        The fast case for lists was for 4 elements and fewer. By changing
+        the threshold to 5 elements we get a measurable speedup. I believe
+        this will help real web pages too, not just the benchmark.
+
+        * kjs/list.cpp: Change constant from 4 to 5.
+
+2007-03-19  Darin Adler  <darin@apple.com>
+
+        * kjs/value.h: Oops, fix build.
+
+2007-03-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - remove ~JSValue; tiny low-risk performance boost
+
+        * kjs/value.h: Remove unneeded empty virtual destructor from JSValue.
+        The only class derived from JSValue is JSCell and it already has a
+        virtual destructor. Declaring an empty constructor in JSValue had one
+        good effect: it marked the destructor private, making it a compile
+        time error to try to destroy a JSValue; but that's not a likely
+        mistake for someone to make. It had two bad effects: (1) it caused gcc,
+        at least, to generate code to fix up the virtual table pointer to
+        point to the JSValue version of the virtual table inside the destructor
+        of all classes derived from JSValue directly or indirectly; (2) it
+        caused JSValue to be a polymorphic class so required a virtual table for
+        it. It's cleaner to not have either of those.
+
+2007-03-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark.
+        
+        - avoid static construction (and global variable access) in a smarter, more portable way,
+        to later enable MUTLI_THREAD mode to work on other platforms and compilers.
+        
+        * kjs/CommonIdentifiers.cpp: Added. New class to hold all the shared identifiers.
+        (KJS::CommonIdentifiers::CommonIdentifiers):
+        (KJS::CommonIdentifiers::shared):
+        * kjs/CommonIdentifiers.h: Added.
+
+        * kjs/ExecState.h:
+        (KJS::ExecState::propertyNames): Hand the CommonIdentifiers instance here for easy access.
+        (KJS::ExecState::ExecState):
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        * CMakeLists.txt:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * bindings/runtime_array.cpp:
+        (RuntimeArray::getOwnPropertySlot):
+        (RuntimeArray::put):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::getOwnPropertySlot):
+        * kjs/array_object.cpp:
+        (ArrayInstance::getOwnPropertySlot):
+        (ArrayInstance::put):
+        (ArrayInstance::deleteProperty):
+        (ArrayProtoFunc::ArrayProtoFunc):
+        (ArrayProtoFunc::callAsFunction):
+        (ArrayObjectImp::ArrayObjectImp):
+        * kjs/bool_object.cpp:
+        (BooleanPrototype::BooleanPrototype):
+        (BooleanProtoFunc::BooleanProtoFunc):
+        (BooleanProtoFunc::callAsFunction):
+        (BooleanObjectImp::BooleanObjectImp):
+        * kjs/completion.h:
+        (KJS::Completion::Completion):
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFunc::DateProtoFunc):
+        (KJS::DateObjectImp::DateObjectImp):
+        (KJS::DateObjectFuncImp::DateObjectFuncImp):
+        * kjs/error_object.cpp:
+        (ErrorPrototype::ErrorPrototype):
+        (ErrorProtoFunc::ErrorProtoFunc):
+        (ErrorProtoFunc::callAsFunction):
+        (ErrorObjectImp::ErrorObjectImp):
+        (ErrorObjectImp::construct):
+        (NativeErrorPrototype::NativeErrorPrototype):
+        (NativeErrorImp::NativeErrorImp):
+        (NativeErrorImp::construct):
+        (NativeErrorImp::callAsFunction):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::getOwnPropertySlot):
+        (KJS::FunctionImp::put):
+        (KJS::FunctionImp::deleteProperty):
+        (KJS::FunctionImp::getParameterName):
+        (KJS::DeclaredFunctionImp::construct):
+        (KJS::IndexToNameMap::unMap):
+        (KJS::Arguments::Arguments):
+        (KJS::ActivationImp::getOwnPropertySlot):
+        (KJS::ActivationImp::deleteProperty):
+        (KJS::GlobalFuncImp::GlobalFuncImp):
+        * kjs/function_object.cpp:
+        (FunctionPrototype::FunctionPrototype):
+        (FunctionProtoFunc::FunctionProtoFunc):
+        (FunctionProtoFunc::callAsFunction):
+        (FunctionObjectImp::FunctionObjectImp):
+        (FunctionObjectImp::construct):
+        * kjs/grammar.y:
+        * kjs/identifier.cpp:
+        * kjs/identifier.h:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::init):
+        (KJS::Interpreter::initGlobalObject):
+        * kjs/interpreter.h:
+        * kjs/lookup.h:
+        * kjs/math_object.cpp:
+        (MathFuncImp::MathFuncImp):
+        * kjs/nodes.cpp:
+        (ArrayNode::evaluate):
+        (FuncDeclNode::processFuncDecl):
+        (FuncExprNode::evaluate):
+        * kjs/number_object.cpp:
+        (NumberPrototype::NumberPrototype):
+        (NumberProtoFunc::NumberProtoFunc):
+        (NumberObjectImp::NumberObjectImp):
+        * kjs/object.cpp:
+        (KJS::JSObject::put):
+        (KJS::JSObject::defaultValue):
+        (KJS::JSObject::hasInstance):
+        * kjs/object.h:
+        (KJS::JSObject::getOwnPropertySlot):
+        * kjs/object_object.cpp:
+        (ObjectPrototype::ObjectPrototype):
+        (ObjectProtoFunc::ObjectProtoFunc):
+        (ObjectObjectImp::ObjectObjectImp):
+        * kjs/regexp_object.cpp:
+        (RegExpPrototype::RegExpPrototype):
+        (RegExpProtoFunc::RegExpProtoFunc):
+        (RegExpObjectImp::RegExpObjectImp):
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::getOwnPropertySlot):
+        (KJS::StringInstance::put):
+        (KJS::StringInstance::deleteProperty):
+        (KJS::StringPrototype::StringPrototype):
+        (KJS::StringProtoFunc::StringProtoFunc):
+        (KJS::StringProtoFunc::callAsFunction):
+        (KJS::StringObjectImp::StringObjectImp):
+        (KJS::StringObjectFuncImp::StringObjectFuncImp):
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::TestFunctionImp):
+
+2007-03-18  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Mark Rowe
+        
+        Set Xcode editor to use 4 space indentation (http://webkit.org/coding/coding-style.html) 
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-03-19  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Brady.
+
+        Update references to bugzilla.opendarwin.org with bugs.webkit.org.
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertUTF8ToUTF16):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        * kjs/grammar.y:
+        * kjs/keywords.table:
+        * kjs/lexer.cpp:
+        (KJS::Lexer::shift):
+
+2007-03-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Exposed some extra toUInt32 functionality, as part of the fix for
+        REGRESSION: Incomplete document.all implementation breaks abtelectronics.com 
+        (Style Change Through JavaScript Blanks Content)
+
+        * JavaScriptCore.exp:
+        * kjs/identifier.h:
+        (KJS::Identifier::toUInt32):
+
+2007-03-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed duplicate export name.
+        
+        * JavaScriptCore.exp:
+
+2007-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed <rdar://problem/5064964> Repro ASSERT failure in JS Bindings when 
+        closing window @ lowtrades.bptrade.com
+        
+        Unfortunately, the bindings depend on UString and Identifier as string 
+        representations. So, they need to acquire the JSLock when doing something
+        that will ref/deref their strings.
+
+        Layout tests, the original site, and Java, Flash, and Quicktime on the 
+        web work. No leaks reported. No automated test for this because testing 
+        the Java bindings, like math, is hard.
+        
+        * bindings/runtime.h: Made Noncopyable, just to be sure.
+        
+        * bindings/c/c_class.cpp: 
+        (KJS::Bindings::CClass::~CClass): Acquire the JSLock and explicitly clear the keys
+        in our hashtable, since they're UString::Reps, and ref/deref aren't thread-safe.
+        (KJS::Bindings::CClass::methodsNamed): Also acquire the JSLock when adding
+        keys to the table, since the table ref's them.
+        (KJS::Bindings::CClass::fieldNamed): ditto.
+
+        * bindings/c/c_utility.cpp: Removed dead function.
+        (KJS::Bindings::convertValueToNPVariant): Acquire the JSLock because doing
+        it recursively is pretty cheap, and it's just too confusing to tell whether
+        all our callers do it for us.
+        (KJS::Bindings::convertNPVariantToValue): ditto
+        * bindings/c/c_utility.h:
+
+        * bindings/jni/jni_class.cpp: Same deal as c_class.cpp.
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+
+        * bindings/jni/jni_instance.cpp: Same deal as c_utility.cpp.
+        (JavaInstance::stringValue):
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::convertValueToJObject):
+
+        * bindings/jni/jni_runtime.cpp:
+        (JavaMethod::~JavaMethod): Moved from header, for clarity.
+        (appendClassName): Made this static, so the set of callers is known, and
+        we can assert that we hold the JSLock. Also changed it to take a UString
+        reference, which makes the calling code simpler.
+        (JavaMethod::signature): Store the ASCII value we care about instead of
+        a UString, since UString is so much more hassle. Hold the JSLock while
+        building up the temporary UString.
+
+        * bindings/jni/jni_runtime.h: Nixed dead code in JavaMethod.
+        (KJS::Bindings::JavaString::JavaString): Hold a UString::Rep instead of
+        a UString, so we can acquire the JSLock and explicitly release it.
+        (KJS::Bindings::JavaString::_commonInit):
+        (KJS::Bindings::JavaString::~JavaString):
+        (KJS::Bindings::JavaString::UTF8String):
+        (KJS::Bindings::JavaString::uchars):
+        (KJS::Bindings::JavaString::length):
+        (KJS::Bindings::JavaString::ustring):
+
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::convertArrayInstanceToJavaArray): Made this static, so 
+        the set of callers is known, and we can assert that we hold the JSLock. 
+        (KJS::Bindings::convertValueToJValue): Acquire the JSLock because doing
+        it recursively is pretty cheap, and it's just too confusing to tell whether
+        all our callers do it for us.
+
+        * bindings/objc/objc_runtime.h: Nixed some dead code.
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertNSStringToString): Same drill as above.
+
+2007-03-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        http://bugs.webkit.org/show_bug.cgi?id=13105
+        REGRESSION: an exception raised when calculating base value of a dot expression is not returned
+
+        Test: fast/js/dot-node-base-exception.html
+
+        * kjs/nodes.cpp:
+        (FunctionCallDotNode::evaluate): Added the necessary KJS_CHECKEXCEPTIONVALUE.
+
+2007-03-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2007-03-17  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Made Version.xcconfig smarter when building for different configurations.
+        Now uses the 522+ OpenSource version for Debug and Release, while using the
+        full 522.4 version for Production builds. The system prefix is also computed
+        based on the current system, so 4522.4 on Tiger and 5522.4 on Leopard.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2007-03-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed.
+        
+        - build fix
+
+        * wtf/TCSystemAlloc.cpp:
+
+2007-03-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff and Steve.
+        
+        - fix some portability issues with TCMalloc.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * kjs/config.h:
+        * wtf/FastMalloc.cpp:
+        (WTF::SizeClass):
+        (WTF::InitSizeClasses):
+        (WTF::TCMalloc_PageHeap::Split):
+        (WTF::TCMalloc_PageHeap::RegisterSizeClass):
+        (WTF::TCMalloc_Central_FreeList::length):
+        (WTF::TCMalloc_ThreadCache::InitTSD):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        * wtf/TCSpinLock.h:
+        * wtf/TCSystemAlloc.cpp:
+        (TryVirtualAlloc):
+        (TCMalloc_SystemAlloc):
+
+2007-03-15  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by John.
+
+        * Factored out most of our common build settings into .xcconfig files. Anything that was common in
+          each build configuration was factored out into the shared .xcconfig file.
+        * Adds a Version.xcconfig file to define the current framework version, to be used in other places.
+        * Use the new $(BUNDLE_VERSION) (defined in Version.xcconfig) in the preprocessed Info.plist.
+        * Use the versions defined in Version.xcconfig to set $(DYLIB_CURRENT_VERSION).
+
+        * Configurations/Base.xcconfig: Added.
+        * Configurations/DebugRelease.xcconfig: Added.
+        * Configurations/JavaScriptCore.xcconfig: Added.
+        * Configurations/Version.xcconfig: Added.
+        * Info.plist:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-03-16  Shrikant Gangoda  <shrikant.gangoda@celunite.com>
+
+        Gdk build fix.
+
+        * kjs/DateMath.cpp:  gettimeofday comes from <sys/time.h> on Linux.
+
+2007-03-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by .
+
+        - Fixed one more build breakage
+
+        * kjs/date_object.cpp:
+        (KJS::formatLocaleDate):
+
+2007-03-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by .
+
+        - Fixed a build breakage.
+
+        * kjs/DateMath.cpp:
+        * kjs/date_object.cpp:
+        (KJS::formatLocaleDate):
+        (KJS::DateObjectImp::construct):
+
+2007-03-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        - rdar://problem/5045720
+        - DST changes in US affect JavaScript date calculations (12975)
+        This fix was to ensure we properly test for the new changes to DST in the US.
+        Also this fixes when we apply DST, now we correctly map most past years to current
+        DST rules.  We still have a small issue with years before 1900 or after 2100.
+        rdar://problem/5055038
+
+        * kjs/DateMath.cpp: Fix DST to match spec better.
+        (KJS::getCurrentUTCTime):
+        (KJS::mimimumYearForDST):
+        (KJS::maximumYearForDST):
+        (KJS::equivalentYearForDST):
+        (KJS::getDSTOffset):
+        * kjs/DateMath.h: Consolodated common funtionality.
+        * kjs/date_object.cpp: Consolodated common functionality.
+        (KJS::formatLocaleDate):
+        (KJS::DateObjectImp::construct):
+        * tests/mozilla/ecma/jsref.js: Added functions for finding the correct days when DST starts and ends.
+        * tests/mozilla/ecma/shell.js: Added back in the old DST functions for ease of merging with mozilla if needed.
+        * tests/mozilla/ecma_2/jsref.js: Added functions for finding the correct days when DST starts and ends.
+        * tests/mozilla/ecma_3/Date/shell.js: Added functions for finding the correct days when DST starts and ends.
+        * tests/mozilla/expected.html: Updated to show all date tests passing.
+
+=== Safari-5522.4 ===
+
+2007-03-13  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by .
+
+        - Adding expected failures until the are truly fixed. 
+        - rdar://problem/5060302
+
+        * tests/mozilla/expected.html:
+
+2007-03-12  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by .
+
+        - Actually update tests for new DST rules.
+
+        * tests/mozilla/ecma/Date/15.9.3.1-1.js:
+        * tests/mozilla/ecma/Date/15.9.3.1-2.js:
+        * tests/mozilla/ecma/Date/15.9.3.1-3.js:
+        * tests/mozilla/ecma/Date/15.9.3.1-4.js:
+        * tests/mozilla/ecma/Date/15.9.3.1-5.js:
+        * tests/mozilla/ecma/Date/15.9.3.2-1.js:
+        * tests/mozilla/ecma/Date/15.9.3.2-2.js:
+        * tests/mozilla/ecma/Date/15.9.3.2-3.js:
+        * tests/mozilla/ecma/Date/15.9.3.2-4.js:
+        * tests/mozilla/ecma/Date/15.9.3.2-5.js:
+        * tests/mozilla/ecma/Date/15.9.3.8-1.js:
+        * tests/mozilla/ecma/Date/15.9.3.8-2.js:
+        * tests/mozilla/ecma/Date/15.9.3.8-3.js:
+        * tests/mozilla/ecma/Date/15.9.3.8-4.js:
+        * tests/mozilla/ecma/Date/15.9.3.8-5.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-1.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-10.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-11.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-12.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-13.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-2.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-3.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-4.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-5.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-6.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-7.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-8.js:
+        * tests/mozilla/ecma/Date/15.9.5.10-9.js:
+        * tests/mozilla/ecma/jsref.js:
+        * tests/mozilla/ecma_2/jsref.js:
+        * tests/mozilla/ecma_3/Date/shell.js:
+
+2007-03-12  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by .
+
+        - Update tests for new DST rules.
+
+        * tests/mozilla/ecma/shell.js:
+
+2007-03-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/4681051> Installer crashes in KJS::Collector::
+        markOtherThreadConservatively(KJS::Collector::Thread*) trying to install 
+        iLife 06 using Rosetta on an Intel Machine
+        
+        The problem was that our thread-specific data destructor would modify the
+        list of active JavaScript threads without holding the JSLock, corrupting
+        the list. Corruption was especially likely if one JavaScript thread exited 
+        while another was starting up.
+
+        * JavaScriptCore.exp:
+        * kjs/JSLock.cpp: Don't conflate locking the JSLock with registering a
+        thread, since the thread-specific data destructor needs to lock
+        without registering a thread. Instead, treat thread registration as a
+        part of the convenience of the JSLock object, and whittle down JSLock::lock()
+        to just the bits that actually do the locking.
+        (KJS::JSLock::lock):
+        (KJS::JSLock::registerThread):
+        * kjs/JSLock.h: Updated comments to mention the new behavior above, and
+        other recent changes.
+        (KJS::JSLock::JSLock):
+        * kjs/collector.cpp:
+        (KJS::destroyRegisteredThread): Lock here.
+        (KJS::Collector::registerThread): To match, assert that we're locked here.
+
+2007-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/4587763> PAC file: lock inversion between QT and 
+        JSCore causes a hang @ www.panoramas.dk
+        
+        With a PAC file, run-webkit-tests --threaded passes, the reported site
+        works, and all the Quicktime/JavaScript and Flash/JavaScript examples
+        I found through Google work, too.
+        
+        Any time JavaScript causes arbitrary non-JavaScript code to execute, it 
+        risks deadlock, because that code may block, trying to acquire a lock 
+        owned by a thread that is waiting to execute JavaScript. In this case,
+        the thread was a networking thread that was waiting to interpret a PAC file.
+        
+        Because non-JavaScript code may execute in response to, well, anything,
+        a perfect solution to this problem is impossible. I've implemented an
+        optimistic solution, instead: JavaScript will drop its lock whenever it
+        makes a direct call to non-JavaScript code through a bridging/plug-in API,
+        but will blissfully ignore the indirect ways it may cause non-JavaScript 
+        code to run (resizing a window, for example). 
+        
+        Unfortunately, this solution introduces significant locking overhead in 
+        the bridging APIs. I don't see a way around that.
+
+        This patch includes some distinct bug fixes I saw along the way:
+        
+        * bindings/objc/objc_instance.mm: Fixed a bug where a nested begin() call
+        would leak its autorelease pool, because it would NULL out _pool without
+        draining it.
+
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::methodGetter): Don't copy an Identifier to ASCII only
+        to turn around and make an Identifier from the ASCII. In an earlier 
+        version of this patch, the copy caused an assertion failure. Now it's 
+        just unnecessary work.
+        (RuntimeObjectImp::getOwnPropertySlot): ditto
+
+        * bindings/objc/objc_instance.h: Removed overrides of setVAlueOfField and
+        getValueOfField, because they did exactly what the base class versions did.
+        Removed overrides of Noncopyable declarations for the same reason.
+
+        * bindings/runtime.h: Inherit from Noncopyable instead of rolling our own.
+        * bindings/c/c_instance.h: ditto
+
+        And the actual patch:
+        
+        * API/JSCallbackConstructor.cpp: Drop all locks when calling out to C.
+        (KJS::JSCallbackConstructor::construct):
+        * API/JSCallbackFunction.cpp: ditto
+        (KJS::JSCallbackFunction::callAsFunction):
+        * API/JSCallbackObject.cpp: ditto
+        (KJS::JSCallbackObject::init):
+        (KJS::JSCallbackObject::~JSCallbackObject):
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::construct):
+        (KJS::JSCallbackObject::hasInstance):
+        (KJS::JSCallbackObject::callAsFunction):
+        (KJS::JSCallbackObject::getPropertyNames):
+        (KJS::JSCallbackObject::toNumber):
+        (KJS::JSCallbackObject::toString):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::callbackGetter):
+        
+        * bindings/c/c_instance.cpp: Drop all locks when calling out to C.
+        (KJS::Bindings::CInstance::invokeMethod):
+        (KJS::Bindings::CInstance::invokeDefaultMethod):
+        * bindings/c/c_runtime.cpp: Drop all locks when calling out to C.
+        (KJS::Bindings::CField::valueFromInstance):
+        (KJS::Bindings::CField::setValueToInstance):
+        * bindings/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall): Drop all locks when calling out to Java.
+
+        * bindings/objc/objc_instance.mm: The changes here are to accomodate the
+        fact that C++ unwinding of DropAllLocks goes crazy when you put it inside
+        a @try block. I moved all JavaScript stuff outside of the @try blocks, and 
+        then prefixed the whole blocks with DropAllLocks objects. This required some
+        supporting changes in other functions, which now acquire the JSLock for
+        themselves, intead of relying on their callers to do so.
+        (ObjcInstance::end):
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bindings/objc/objc_runtime.mm: Same as above, except I didn't want to
+        change throwError to acquire the JSLock for itself.
+        (ObjcField::valueFromInstance):
+        (ObjcField::setValueToInstance):
+        * bindings/objc/objc_utility.mm: Supporting changes mentioned above.
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+
+        * kjs/JSLock.cpp: 
+        (1) Fixed DropAllLocks to behave as advertised, and drop the JSLock only 
+        if the current thread actually acquired it in the first place. This is 
+        important because WebKit needs to ensure that the JSLock has been 
+        dropped before it makes a plug-in call, even though it doesn't know if 
+        the current thread actually acquired the JSLock. (We don't want WebKit
+        to accidentally drop a lock belonging to *another thread*.)
+        (2) Used the new per-thread code written for (1) to make recursive calls
+        to JSLock very cheap. JSLock now knows to call pthread_mutext_lock/ 
+        pthread_mutext_unlock only at nesting level 0.
+        (KJS::createDidLockJSMutex):
+        (KJS::JSLock::lock):
+        (KJS::JSLock::unlock):
+        (KJS::DropAllLocks::DropAllLocks):
+        (KJS::DropAllLocks::~DropAllLocks):
+        (KJS::JSLock::lockCount):
+        * kjs/JSLock.h: Don't duplicate Noncopyable.
+        (KJS::JSLock::~JSLock):
+
+        * wtf/Assertions.h: Blind attempt at helping the Windows build.
+
+2007-03-08  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=13018
+        Bug 13018: allow embedders to override the definition of CRASH.
+
+        * wtf/Assertions.h: make it possible to override CRASH.
+
+2007-03-07  Huan Ren  <huanr@chromium.org>
+
+        Reviewed by Maciej.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=12535
+        Bug 12535: Stack-optimizing compilers can trick GC into freeing in-use objects
+
+        * kjs/internal.cpp:
+        (KJS::StringImp::toObject): Copy val onto the stack so it is not subject to garbage collection.
+
+2007-03-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix for non-multiple-thread folks.
+        
+        Use a shared global in the non-multiple-thread case.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::isForbidden):
+        (WTF::fastMallocForbid):
+        (WTF::fastMallocAllow):
+
+2007-03-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed ASSERT failure I just introduced.
+        
+        Made the fastMalloc isForbidden flag per thread. (Oops!) We expect that
+        other threads will malloc while we're marking -- we just want to prevent
+        our own marking from malloc'ing.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::initializeIsForbiddenKey):
+        (WTF::isForbidden):
+        (WTF::fastMallocForbid):
+        (WTF::fastMallocAllow):
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::fastRealloc):
+        (WTF::do_malloc):
+
+2007-03-07  Shrikant Gangoda  <shrikant.gangoda@celunite.com>
+
+        Reviewed by Maciej.
+
+        http://bugs.webkit.org/show_bug.cgi?id=12997
+
+        Wrap pthread-specific assertion in #if USE(MULTIPLE_THREADS).
+
+        * kjs/collector.cpp:
+        (KJS::Collector::markMainThreadOnlyObjects):
+
+2007-03-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed <rdar://problem/4576242> | http://bugs.webkit.org/show_bug.cgi?id=12586
+        PAC file: malloc deadlock sometimes causes a hang @ www.apple.com/pro/profiles/ (12586)
+        
+        This is a modified version of r14752 on the branch.
+        
+        These changes just add debugging functionality. They ASSERT that we don't 
+        malloc during the mark phase of a garbage collection, which can cause a
+        deadlock.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocForbid):
+        (WTF::fastMallocAllow):
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::fastRealloc):
+        (WTF::do_malloc):
+        * wtf/FastMalloc.h:
+
+2007-03-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed all known crashers exposed by run-webkit-tests --threaded. This covers:
+
+        <rdar://problem/4565394> | http://bugs.webkit.org/show_bug.cgi?id=12585 
+            PAC file: after closing a window that contains macworld.com, new window 
+            crashes (KJS::PropertyMap::mark()) (12585)
+        <rdar://problem/4571215> | http://bugs.webkit.org/show_bug.cgi?id=9211
+            PAC file: Crash occurs when clicking on the navigation tabs at http://www.businessweek.com/ (9211)
+        <rdar://problem/4557926> 
+            PAC file: Crash occurs when attempting to view image in slideshow mode 
+            at http://d.smugmug.com/gallery/581716 ( KJS::IfNode::execute (KJS::
+            ExecState*) + 312) if you use a PAC file
+
+        (1) Added some missing JSLocks, along with related ASSERTs.
+        
+        (2) Fully implemented support for objects that can only be garbage collected
+        on the main thread. So far, only WebCore uses this. We can add it to API
+        later if we learn that it's needed. 
+        
+        The implementation uses a "main thread only" flag inside each object. When 
+        collecting on a secondary thread, the Collector does an extra pass through 
+        the heap to mark all flagged objects before sweeping. This solution makes
+        the common case -- flag lots of objects, but never collect on a secondary 
+        thread -- very fast, even though the uncommon case of garbage collecting
+        on a secondary thread isn't as fast as it could be. I left some notes 
+        about how to speed it up, if we ever care.
+        
+        For posterity, here are some things I learned about GC while investigating:
+        
+        * Each collect must either mark or delete every heap object. "Zombie" 
+        objects, which are neither marked nor deleted, raise these issues:
+
+            * On the next pass, the conservative marking algorithm might mark a 
+            zombie, causing it to mark freed objects.
+
+            * The client might try to use a zombie, which would seem live because 
+            its finalizer had not yet run.
+
+        * A collect on the main thread is free to delete any object. Presumably, 
+        objects allocated on secondary threads have thread-safe finalizers.
+
+        * A collect on a secondary thread must not delete thread-unsafe objects.
+
+        * The mark function must be thread-safe.
+        
+        Line by line comments:
+
+        * API/JSObjectRef.h: Added comment specifying that the finalize callback 
+        may run on any thread.
+
+        * JavaScriptCore.exp: Nothing to see here.
+
+        * bindings/npruntime.cpp:
+        (_NPN_GetStringIdentifier): Added JSLock.
+
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::~ObjcInstance): Use an autorelease pool. The other callers 
+        to CFRelease needed one, too, but they were dead code, so I removed them 
+        instead. (This fixes a leak seen while running run-webkit-tests --threaded,
+        although I don't think it's specifically a threading issue.) 
+        
+        * kjs/collector.cpp:
+        (KJS::Collector::collectOnMainThreadOnly): New function. Tells the collector
+        to collect a value only if it's collecting on the main thread.
+        (KJS::Collector::markMainThreadOnlyObjects): New function. Scans the heap
+        for "main thread only" objects and marks them.
+
+        * kjs/date_object.cpp: 
+        (KJS::DateObjectImp::DateObjectImp): To make the new ASSERTs happy, allocate 
+        our globals on the heap, avoiding a seemingly unsafe destructor call at 
+        program exit time.
+        * kjs/function_object.cpp:
+        (FunctionPrototype::FunctionPrototype): ditto
+
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::mark): Removed boolean parameter, which was an incomplete
+        and arguably hackish way to implement markMainThreadOnlyObjects() inside WebCore.
+        * kjs/interpreter.h:
+
+        * kjs/identifier.cpp:
+        (KJS::identifierTable): Added some ASSERTs to check for thread safety 
+        problems.
+
+        * kjs/list.cpp: Added some ASSERTs to check for thread safety problems.
+        (KJS::allocateListImp):
+        (KJS::List::release):
+        (KJS::List::append):
+        (KJS::List::empty): Make the new ASSERTs happy.
+
+        * kjs/object.h:
+        (KJS::JSObject::JSObject): "m_destructorIsThreadSafe" => "m_collectOnMainThreadOnly".
+        I removed the constructor parameter because m_collectOnMainThreadOnly,
+        like m_marked, is a Collector bit, so only the Collector should set or get it.
+
+        * kjs/object_object.cpp:
+        (ObjectPrototype::ObjectPrototype): Make the ASSERTs happy.
+        * kjs/regexp_object.cpp:
+        (RegExpPrototype::RegExpPrototype): ditto
+
+        * kjs/ustring.cpp: Added some ASSERTs to check for thread safety problems.
+        (KJS::UCharReference::ref): 
+        (KJS::UString::Rep::createCopying):
+        (KJS::UString::Rep::create):
+        (KJS::UString::Rep::destroy):
+        (KJS::UString::null): Make the new ASSERTs happy.
+        * kjs/ustring.h:
+        (KJS::UString::Rep::ref): Added some ASSERTs to check for thread safety problems.
+        (KJS::UString::Rep::deref):
+
+        * kjs/value.h:
+        (KJS::JSCell::JSCell):
+
+2007-03-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        2% speedup on super accurate JS iBench.
+
+        (KJS::Collector::collect): Removed anti-optimization to call
+        pthread_is_threaded_np() before calling pthread_main_np(). Almost all 
+        apps have more than one thread, so the extra call is actually worse.
+        Interestingly, even the single-threaded testkjs shows a speed gain
+        from removing the pthread_is_threaded_np() short-circuit. Not sure why.
+
+2007-03-04  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=12950
+          Assertions.cpp should not #define macros that are already defined
+
+        * wtf/Assertions.cpp: Don't #define WINVER and _WIN32_WINNT if they
+        are already defined.
+
+2007-03-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Anders.
+        
+        Add unsigned int hash traits (matches existing unsigned long version)
+
+        * wtf/HashTraits.h:
+        (WTF::):
+
+2007-03-02  Adam Roben  <aroben@apple.com>
+
+        Reviewed by Kevin M.
+
+        Try to fix the Qt build.
+
+        * kjs/DateMath.cpp:
+        (KJS::msToGregorianDateTime): Removed unnecessary "struct" keyword.
+        * kjs/DateMath.h: Moved forward declarations to the top of the file
+        before they are used.
+        * kjs/date_object.cpp:
+        (KJS::formatLocaleDate): Changed to take a const GregorianDateTime&
+        since GregorianDateTime is Noncopyable.
+
+2007-03-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin McCullough.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=12867
+          REGRESSION: BenchJS test 7 (dates) is 220% slower than in Safari 2.0.4
+
+        * kjs/DateMath.h: Marked GregorianDateTime as noncopyable, since it has a non-trivial
+        destructor and not the correspoding copy constructor or assignment operator.
+        Changed the GregorianDateTime constructor to use member initialization syntax.
+        Fixed the destructor to use the array delete operator, since timeZone is an array.
+
+        * kjs/DateMath.cpp:
+        (KJS::daysInYear): Changed to call isLeapYear so the rule is not repeated twice.
+        (KJS::getUTCOffset): Added caching on PLATFORM(DARWIN), since we can rely on the
+        notify_check function and "com.apple.system.timezone" to let us know when the
+        offset has changed.
+
+2007-02-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Follow-up to fixing http://bugs.webkit.org/show_bug.cgi?id=12659 | <rdar://problem/4954306>
+        JS objects not collected after closing window @ ebay.com/maps.google.com
+        
+        Changed Interpreter cache of global constructors and prototypes from
+        ProtectedPtrs to bare, marked pointers. ProtectedPtrs are inefficient,
+        and they increase the risk of reference cycles. Also, Darin said something
+        about ProtectedPtrs giving him warts.
+        
+        Also changed data members to precise types from generic JSObject*'s.
+        
+        Layout tests and JS tests pass.
+
+        * kjs/SavedBuiltins.h:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::init):
+        (KJS::Interpreter::~Interpreter):
+        (KJS::Interpreter::initGlobalObject): Moved Identifier::init() call to
+        constructor, for clarity.
+        (KJS::Interpreter::mark):
+        * kjs/interpreter.h:
+
+2007-02-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=12659 | <rdar://problem/4954306>
+        JS objects not collected after closing window @ ebay.com/maps.google.com
+
+        Don't GC in the Interpreter destructor. For that to work, the Interpreter
+        would have to NULL out all of its ProtectedPtrs before calling collect(). But 
+        we've decided that we don't want things to work that way, anyway. We want the
+        client to be in charge of manual GC so that it can optimize cases when
+        it will be destroying many interpreters at once
+        (e.g., http://bugs.webkit.org/show_bug.cgi?id=12900).
+        
+        Also removed Interpreter::collect() because it was redundant with 
+        Collector::collect().
+
+        * JavaScriptCore.exp:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::~Interpreter):
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction):
+
+2007-02-26  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Rename *_SUPPORT defines to ENABLE_*.
+
+        * jscore.bkl:
+
+2007-02-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Lars.
+        
+        - <rdar://problem/5021698> Disable experimental SVG features (12883)
+
+        * wtf/Platform.h: Add ENABLE() macro similar to HAVE() and USE(), to
+        allow nicer handling of optional WebKit features.
+
+2007-02-22  George Staikos  <staikos@kde.org>
+
+        Reviewed by Lars.
+
+        Add return values
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+
+2007-02-22  Oscar Cwajbaum  <public@oscarc.net>
+
+        Reviewed by Maciej.
+
+        Fix ARM-specific alignment problem in FastMalloc
+        http://bugs.webkit.org/show_bug.cgi?id=12841
+
+        * wtf/FastMalloc.cpp:
+        Modify how pageheap_memory is declared to ensure proper alignment
+        on architectures such as ARM
+
+2007-02-20  Zack Rusin  <zrusin@trolltech.com>
+
+        Reviewed by Lars
+
+        Make sure that non-void methods always return something.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+
+2007-02-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Adam Roben.
+
+        Fix cases where MSVC-specific code was identified as Win32 platform
+        code. (as it should be compiled for e.g. wx port when using MSVC too)
+        
+        * wtf/Assertions.h: 
+        * wtf/MathExtras.h:
+        * wtf/StringExtras.h:
+        changed PLATFORM(WIN) sections to COMPILER(MSVC) as necessary
+
+2007-02-17  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Fix crashes on ARM due to different struct packing. Based on a patch
+        by Mike Emmel.
+        * kjs/ustring.cpp: compile-time assert to make sure sizeof(UChar) == 2
+        * kjs/ustring.h: pack UChar struct to ensure that sizeof(UChar) == 2
+        * wtf/Assertions.h: add COMPILE_ASSERT macro for compile-time assertions
+
+2007-02-16  George Staikos  <staikos@kde.org>
+
+        Reviewed by Maciej.
+
+        Fix uninitialized variable
+
+        * bindings/testbindings.cpp:
+        (myAllocate):
+
+2007-02-16  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Mitz.
+
+        http://bugs.webkit.org/show_bug.cgi?id=12788
+        REGRESSION: Going back one page in history has a noticeable delay
+        
+        Um...if all elements in two vectors are equal, then I guess we could say that
+        the two vectors are equal too.
+        
+        * wtf/Vector.h:
+        (WTF::):
+
+2007-02-14  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+
+        Add new canCompareWithMemcmp vector trait and use it to determine whether
+        operator== can use memcmp.
+        
+        * wtf/Vector.h:
+        (WTF::):
+        (WTF::VectorTypeOperations::compare):
+        (WTF::operator==):
+        * wtf/VectorTraits.h:
+        (WTF::):
+
+2007-02-13  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin
+        
+        Tweaked vector a bit
+
+        * wtf/Vector.h:
+        (WTF::operator==):
+
+2007-02-13  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin.
+
+        - fix for http://bugs.webkit.org/show_bug.cgi?id=12750
+          Vector operator== was not defined correctly. It returned void,
+          did not accept const Vectors, and used an int instead of size_t. 
+
+        * wtf/Vector.h: fixed comparison operators
+        (WTF::operator==):
+        (WTF::operator!=):
+
+2007-02-10  David Carson  <dacarson@gmail.com>
+
+        Reviewed by Maciej.
+
+        - fix for http://bugs.webkit.org/show_bug.cgi?id=12636
+        Corrected the generation of method signatures when the parameter
+        is an Array. 
+        Added support for converting a Javascript array to a Java array.
+
+        * bindings/jni/jni_utility.h: added new type for array, array_type
+        * bindings/jni/jni_runtime.cpp: add support for new array type
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        (JavaMethod::JavaMethod):
+        (JavaMethod::signature):
+        * bindings/jni/jni_utility.cpp: add support for new array type
+        (KJS::Bindings::callJNIMethod):
+        (KJS::Bindings::callJNIStaticMethod):
+        (KJS::Bindings::callJNIMethodIDA):
+        (KJS::Bindings::JNITypeFromClassName):
+        (KJS::Bindings::signatureFromPrimitiveType):
+        (KJS::Bindings::JNITypeFromPrimitiveType):
+        (KJS::Bindings::getJNIField):
+        (KJS::Bindings::convertArrayInstanceToJavaArray): new method
+        converts the Javascript array to the requested Java array.
+        (KJS::Bindings::convertValueToJValue):
+
+2007-02-08  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/4930614>
+        Safari complains about "Slow Script" if GMail is left open and machine is busy
+        
+        <rdar://problem/4649516>
+        Turn off slow script dialog or crank up time that makes it come up
+        
+        <rdar://problem/4963589>
+        Slow script warning is displayed after closing of PROMPT or PRINT dialog
+        
+        Re-do the way script timeouts are handled. No longer use a unix timer that sends signals. Instead, add a 
+        tick count and increment it in loop bodies. If the tick count reaches a threshold, do a timeout check. If the total time executing
+        is higher than the timeout value, (possibly) interrupt the script. The timeout checker also adjusts the threshold dynamically
+        to prevent doing the timeout check too often.
+         
+        * JavaScriptCore.exp:
+        Remove pause and resume calls.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Add winmm.lib.
+
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::init):
+        (KJS::Interpreter::~Interpreter):
+        (KJS::Interpreter::startTimeoutCheck):
+        (KJS::Interpreter::stopTimeoutCheck):
+        (KJS::Interpreter::resetTimeoutCheck):
+        (KJS::getCurrentTime):
+        (KJS::Interpreter::checkTimeout):
+        * kjs/interpreter.h:
+        (KJS::Interpreter::timedOut):
+        * kjs/nodes.cpp:
+        (DoWhileNode::execute):
+        (WhileNode::execute):
+        (ForNode::execute):
+
+2007-02-07  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Reenable testkjs.
+
+2007-02-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - another build fix; this time for sure
+
+        * pcre/pcre_exec.c: (match):
+        The compiler caught an incorrect use of the othercase variable across
+        a call to RMATCH in character repeat processing. Local variables can
+        change in the crazy NO_RECURSE mode that we use, so we instead need
+        the value in othercase to be in one of the special stack frame variables.
+        Added a new stack frame variable for this purpose named repeat_othercase.
+        Also noted a similar error in the non-UTF-16 side of the #ifdef, but
+        didn't try to fix that one. Also removed a SUPPORT_UCP #ifdef from the
+        PCRE_UTF16 side; that code doesn't work without the Unicde properties
+        table, and we don't try to use it that way.
+
+2007-02-06  Steve Falkenburg  <sfalken@apple.com>
+
+        Disable testkjs in sln until we figure out mysterious compiler warning.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+
+2007-02-06  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix by ggaren
+
+        * pcre/pcre_exec.c:
+        (match):
+
+2007-02-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix <rdar://problem/4979089> PCRE should avoid setjmp/longjmp even when compiler
+          is not GCC
+
+        Added a new code path that's slower and way uglier but doesn't rely on GCC's
+        computed gotos.
+
+        * pcre/pcre_exec.c: Added a numeric parameter to the RMATCH function. It must be
+        different at every RMATCH call site. Changed the non-GCC NO_RECURSE version of
+        the macro to use a label incorporating the number. Changed the RRETURN macro to
+        use a goto instead of longjmp.
+        (match): Added a different number at each callsite, using a perl script for the
+        first-time task. Going forward it should be easy to maintain by hand. Added a
+        switch statement at the bottom of the function. We'll get compile time errors
+        if we have anything in the switch statement that's never used in an RMATCH,
+        but errors in the other direction are silent except at runtime.
+
+2007-02-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+        - fix <rdar://problem/4687840> 9A241: JavaScript RegExp 25-30x slower than on 10.4.7
+
+        I used Shark to figure out what to do. The test case is now 15% faster than with
+        stock Safari. Some other regular expression cases might still be a few % slower
+        than before, but the >10x slowdown is now completely gone.
+
+        1) Fix slowness caused by setjmp/longjmp by using computed goto instead.
+
+        Use GCC extensions - locally declared labels, labels as values, and computed goto -
+        instead of using setjmp/longjmp to implemement non-recursive version of the regular
+        expression system. We could probably make this even faster if we reduced the use
+        of malloc a bit too.
+
+        2) Fix slowness caused by allocating heapframe objects by allocating the first
+           16 of them from the stack.
+
+        3) Speed up use of malloc and free in PCRE by making it use fastMalloc and fastFree.
+
+        4) Speed up the test case by adding a special case to a UString function.
+
+        5) Made a small improvement to the innermost hottest loop of match by hoisting
+           the conversion from int to pcre_uchar out of the loop.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Compile FastMallocPCRE.cpp, and don't
+        compile pcre_globals.c.
+
+        * wtf/FastMallocPCRE.cpp: Added. A copy of pcre_globals.c that uses FastMalloc.h.
+        This is better than code that sets the PCRE allocation globals because by doing it
+        this way there's guaranteed to be no problem with order of initialization.
+
+        * kjs/ustring.cpp: (KJS::UString::spliceSubstringsWithSeparators): Add a fast
+        special case when this is called for only one subrange and no seaprators. This
+        was happening a lot in the test case and it seems quite reasonable to optimize this.
+
+        * pcre/pcre_exec.c: Create a copy of the RMATCH and RRETURN macros that use goto
+        instead of setjmp/longjmp. Change code that calls pcre_stack_malloc to first use
+        storage on the stack inside the match function.
+        (match): Move initialization of utf8 up a couple lines to avoid "possibly used
+        uninitialized" warning. Use a local variable so we compare with pcre_uchar instead
+        of with int inside the inner "find a character" loop.
+
+2007-02-03  George Staikos  <staikos@kde.org>
+
+        Reviewed by Alexey.
+
+        -1 is not a valid point.  We can't handle anything > 0xffff anyway.
+        Fixes crash on cases like eval("x");
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::category):
+
+2007-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - fix copying and assigning a ListHashSet
+
+        No test because the code path with bugs I am fixing is not used yet.
+
+        * wtf/ListHashSet.h: Tweaked ListHashSetNodeAllocator a little bit for clarity.
+        Changed m_allocator to be an OwnPtr instead of doing an explicit delete.
+        Fixed bug in copy constructor where we'd have an uninitialized m_allocator.
+        Fixed bug in assignment operator where it would swap only the hash table, and
+        not the head, tail, and allocator pointers.
+
+2007-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Use WTFLog instead of fprintf for logging KJS::Node leaks.
+
+        * kjs/nodes.cpp:
+        (NodeCounter::~NodeCounter): Changed count to unsigned, updated
+        to match style guidelines.
+
+2007-02-02  Maciej Stachowiak  <mjs@apple.com>
+
+        - not reviewed, build fix
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetNodeAllocator::ListHashSetNodeAllocator): ummm, use union correctly
+
+2007-02-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - use a custom allocator for ListHashSet, to fix ~1% perf regression using it for form control
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetNodeAllocator::ListHashSetNodeAllocator):
+        (WTF::ListHashSetNodeAllocator::allocate):
+        (WTF::ListHashSetNodeAllocator::deallocate):
+        (WTF::ListHashSetNode::operator new):
+        (WTF::ListHashSetNode::operator delete):
+        (WTF::ListHashSetNode::destroy):
+        (WTF::ListHashSetTranslator::translate):
+        (WTF::::ListHashSet):
+        (WTF::::~ListHashSet):
+        (WTF::::add):
+        (WTF::::unlinkAndDelete):
+        (WTF::::deleteAllNodes):
+
+2007-01-31  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam.
+        
+        - fix sporadic crash
+
+        * wtf/ListHashSet.h:
+        (WTF::::remove): remove before deleting
+
+2007-01-31  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark with help from Lars.
+        
+        - added new ListHashSet class, which combines a hashtable and a linked list to provide a set
+        that keeps elements in inserted order
+        
+        This is to assist in fixing the following:
+        <rdar://problem/4751164> REGRESSION: Safari places text on incorrect button when returning to a page via back [10541]
+        http://bugs.webkit.org/show_bug.cgi?id=10541
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/HashTable.h:
+        (WTF::HashTable::find):
+        (WTF::HashTable::contains):
+        (WTF::::find):
+        (WTF::::contains):
+        * wtf/ListHashSet.h: Added.
+        (WTF::ListHashSetNode::ListHashSetNode):
+        (WTF::ListHashSetNodeHashFunctions::hash):
+        (WTF::ListHashSetNodeHashFunctions::equal):
+        (WTF::ListHashSetIterator::ListHashSetIterator):
+        (WTF::ListHashSetIterator::get):
+        (WTF::ListHashSetIterator::operator*):
+        (WTF::ListHashSetIterator::operator->):
+        (WTF::ListHashSetIterator::operator++):
+        (WTF::ListHashSetIterator::operator--):
+        (WTF::ListHashSetIterator::operator==):
+        (WTF::ListHashSetIterator::operator!=):
+        (WTF::ListHashSetIterator::operator const_iterator):
+        (WTF::ListHashSetIterator::node):
+        (WTF::ListHashSetConstIterator::ListHashSetConstIterator):
+        (WTF::ListHashSetConstIterator::get):
+        (WTF::ListHashSetConstIterator::operator*):
+        (WTF::ListHashSetConstIterator::operator->):
+        (WTF::ListHashSetConstIterator::operator++):
+        (WTF::ListHashSetConstIterator::operator--):
+        (WTF::ListHashSetConstIterator::operator==):
+        (WTF::ListHashSetConstIterator::operator!=):
+        (WTF::ListHashSetConstIterator::node):
+        (WTF::ListHashSetTranslator::hash):
+        (WTF::ListHashSetTranslator::equal):
+        (WTF::ListHashSetTranslator::translate):
+        (WTF::::ListHashSet):
+        (WTF::::operator):
+        (WTF::::~ListHashSet):
+        (WTF::::size):
+        (WTF::::capacity):
+        (WTF::::isEmpty):
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::find):
+        (WTF::::contains):
+        (WTF::::add):
+        (WTF::::remove):
+        (WTF::::clear):
+        (WTF::::unlinkAndDelete):
+        (WTF::::appendNode):
+        (WTF::::deleteAllNodes):
+        (WTF::::makeIterator):
+        (WTF::::makeConstIterator):
+        (WTF::deleteAllValues):
+
+2007-01-30  Darin Adler  <darin@apple.com>
+
+        * kjs/DateMath.cpp: Fix license header to reflect LGPL as the first license
+        mentioned. We still mention the option of using under MPL or GPL since some
+        of this code came from the Mozilla project with those license terms.
+
+2007-01-30  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Zack.
+
+        Turned JavaScriptCore from a separate library into an includable
+        project, to combine it all into libWebKitQt.
+
+        * JavaScriptCore.pri: Added.
+        * JavaScriptCore.pro: Removed.
+        * kjs/testkjs.pro:
+
+2007-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fixed <rdar://problem/4485644> REGRESSION: JavaScriptCore has init routines
+        
+        The TCMalloc module now initializes, if needed, inside GetCache() and 
+        fastMallocSetIsMultiThreaded(). We leverage the same synchronization 
+        technique used for enabling / disabling the single-threaded optimization 
+        to synchronize initialization of the library without requiring a lock 
+        for every malloc.
+        
+        1,251 runs of tcmalloc_unittest, 2 runs of a custom, massively multi-threaded 
+        tcmalloc_unittest, and my custom version of the PLT show no regressions.
+        Super-accurate JS iBench reports a .24% regression, which is right at the
+        limit of its error range, so I'm declaring victory.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSetIsMultiThreaded): Initialize, if needed. (InitModule()
+        checks the "if needed" part.)
+        (WTF::TCMalloc_ThreadCache::GetCache): Restored original TCMalloc code
+        inside #ifdef, for posterity. Added new initialization logic.
+        (WTF::TCMalloc_ThreadCache::InitModule): Call InitTSD(), since we don't
+        have a static initializer to call it for us, now. This means that fastMalloc
+        is not usable as a general libc allocator, but it never was, and if it were
+        the general libc allocator, we wouldn't be here in the first place, so whatever.
+        (WTF::TCMalloc_ThreadCache::InitTSD): Don't try to take the pageheap_lock, 
+        since InitModule already has it.
+
+2007-01-29  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Geoff and Oliver.
+
+        - rdar://problem/4955561
+        - missusing JavaScript shouldn't crash webkit.  Now it doesn't, in this case.
+
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::callAsFunction):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::callAsFunction):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::callAsFunction):
+
+2007-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        First step in fixing <rdar://problem/4485644> REGRESSION: JavaScriptCore 
+        has init routines
+        
+        Don't rely on a static initializer to store the main thread's ID (which
+        we would use to detect allocations on secondary threads). Instead, require 
+        the caller to notify fastMalloc if it might allocate on a secondary thread.
+        
+        Also fixed what seemed like a race condition in do_malloc.
+        
+        tcmalloc_unittest and my custom versions of JS iBench and PLT show no
+        regressions.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSetIsMultiThreaded): 
+        (1) Renamed from "fastMallocRegisterThread", which was a misleading name because 
+        not all threads need to register with fastMalloc -- only secondary threads 
+        need to, and only for the purpose of disabling its single-threaded optimization. 
+
+        (2) Use the pageheap_lock instead of a custom one, since we need to synchronize
+        with the read of isMultiThreaded inside CreateCacheIfNecessary. This is a new
+        requirement, now that we can't guarantee that the first call to CreateCacheIfNecessary
+        will occur on the main thread at init time, before any other threads have been created.
+
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        (WTF::do_malloc): Reverted WTF change only to call GetCache() if size <= kMaxSize.
+        The WTF code would read phinited without holding the pageheap_lock, which
+        seemed like a race condition. Regardless, calling GetCache reduces the number 
+        of code paths to module initialization, which will help in writing the 
+        final fix for this bug.
+
+2007-01-28  David Kilzer  <ddkilzer@webkit.org>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=9815
+          JavaScript TypeError loading Dean Edwards' JS compressor/obfuscator
+
+        Creating a function using 'new Function()' was not setting its prototype with the
+        same flags as 'function() { }'.
+
+        Test: fast/js/function-prototype.html
+
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct): Change flags from DontEnum|DontDelete|ReadOnly to
+        Internal|DontDelete to match FuncDeclNode::processFuncDecl() and
+        FuncExprNode::evaluate() in kjs/nodes.cpp.
+
+2007-01-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Added some missing JSLocks, which might fix <rdar://problem/4889707>.
+
+        We need to lock whenever we might allocate memory because our FastMalloc
+        implementation requires clients to register their threads, which we do
+        through JSLock. 
+        
+        We also need to lock whenever modifying ref-counts because they're not 
+        thread-safe.
+
+        * API/JSObjectRef.cpp:
+        (JSClassCreate): Allocates memory
+        (JSClassRetain): Modifies a ref-count
+        (JSClassRelease): Modifies a ref-count
+        (JSPropertyNameArrayRetain): Modifies a ref-count
+        (JSPropertyNameArrayRelease): Modifies a ref-count
+        * API/JSStringRef.cpp:
+        (JSStringRetain): Modifies a ref-count
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor): Might allocate memory if an exception
+        is thrown.
+
+2007-01-27  Lars Knoll <lars@trolltech.com>
+
+        Fix the Qt build.
+
+        * bindings/qt/qt_instance.h:
+
+2007-01-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed <rdar://problem/4608404> WebScriptObject's _rootObject lack 
+        of ownership policy causes crashes (e.g., in Dashcode)
+        
+        The old model for RootObject ownership was either to (1) leak them or (2) assign
+        them to a single owner -- the WebCore::Frame -- which would destroy them 
+        when it believed that all of its plug-ins had unloaded.
+        
+        This model was broken because of (1) and also because plug-ins are not the only 
+        RootObject clients. All Bindings clients are RootObjects clients, including 
+        applications, which outlive any particular WebCore::Frame.
+        
+        The new model for RootObject ownership is to reference-count them, with a
+        throw-back to the old model: The WebCore::Frame tracks the RootObjects
+        it creates, and invalidates them when it believes that all of its plug-ins 
+        have unloaded.
+        
+        We maintain this throw-back to avoid plug-in leaks, particularly from Java.
+        Java is completely broken when it comes to releasing JavaScript objects. 
+        Comments in our code allege that Java does not always call finalize when 
+        collecting objects. Moreoever, my own testing reveals that, when Java does 
+        notify JavaScript of a finalize, the data it provides is totally bogus.
+        
+        This setup is far from ideal, but I don't think we can do better without
+        completely rewriting the bindings code, and possibly part of the Java
+        plug-in / VM.
+        
+        Layout tests pass. No additional leaks reported. WebCore/manual-tests/*liveconnect*
+        and a few LiveConnect demos on the web also run without a hitch.
+        
+        const RootObject* => RootObject*, since we need to ref/deref
+        
+        * bindings/NP_jsobject.cpp:
+        (jsDeallocate): deref our RootObjects. Also unprotect or JSObject, instead
+        of just relying on the RootObject to do it for us when it's invalidated.
+        (_isSafeScript): Check RootObject validity.
+        (_NPN_CreateScriptObject): ditto
+        (_NPN_Invoke): ditto
+        (_NPN_Evaluate): ditto
+        (_NPN_GetProperty): ditto
+        (_NPN_SetProperty): ditto
+        (_NPN_RemoveProperty): ditto
+        (_NPN_HasProperty): ditto
+        (_NPN_HasMethod): ditto
+        (_NPN_SetException): ditto
+
+        * bindings/runtime_root.cpp: 
+        Revived bit-rotted LIAR LIAR LIAR comment.
+        
+        LOOK: Added support for invalidating RootObjects without deleting them, 
+        which is the main goal of this patch. 
+
+        Moved protect counting into the RootObject class, to emphasize that 
+        the RootObject protects the JSObject, and unprotects it upon being invalidated.
+            addNativeReference => RootObject::gcProtect
+            removeNativeReference => RootObject::gcUnprotect
+            ProtectCountSet::contains => RootObject::gcIsProtected
+            
+        I know we'll all be sad to see the word "native" go.
+        
+        * bindings/runtime_root.h: Added ref-counting support to RootObject, with
+        all the standard accoutrements.
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant): If we can't find a valid RootObject,
+        return void instead of just leaking.
+
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::JavaInstance): Don't take a RootObject in our constructor;
+        be like other Instances and require the caller to call setRootObject. This
+        reduces the number of ownership code paths.
+        (JavaInstance::invokeMethod): Check RootObject for validity.
+        * bindings/jni/jni_instance.h: Removed private no-arg constructor. Having
+        an arg constructor accomplishes the same thing.
+
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::invoke): No need to call findProtectCountSet, because finalize()
+        checks for RootObject validity.
+        (JavaJSObject::JavaJSObject): check RootObject for validity
+        (JavaJSObject::call): ditto
+        (JavaJSObject::eval): ditto
+        (JavaJSObject::getMember): ditto
+        (JavaJSObject::setMember): ditto
+        (JavaJSObject::removeMember): ditto
+        (JavaJSObject::getSlot): ditto
+        (JavaJSObject::setSlot): ditto
+        (JavaJSObject::toString): ditto
+        (JavaJSObject::finalize): ditto
+        (JavaJSObject::createNative): No need to tell the RootObject to protect 
+        the global object, since the RootObject already owns the interpreter.
+
+        * bindings/jni/jni_runtime.cpp:
+        (JavaArray::JavaArray): Removed copy construcutor becaue it was unused.
+        Dead code is dangerous code.
+
+        * bindings/objc/objc_runtime.mm: Added WebUndefined protocol. Previous use
+        of WebScriptObject was bogus, because WebUndefined is not a subclass of
+        WebScriptObject.
+        (convertValueToObjcObject): If we can't find a valid RootObject,
+        return nil instead of just leaking.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue): If we can't find a valid RootObject,
+        return nil instead of just leaking.
+
+2007-01-27  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Maciej.
+        
+        Fix for Repeated string concatenation results in OOM crash
+        http://bugs.webkit.org/show_bug.cgi?id=11131
+
+        * kjs/operations.cpp:
+        (KJS::add): Throw exception if string addition result is null
+        * kjs/ustring.cpp:
+        (KJS::UString::UString): Don't call memcpy when malloc failed
+
+2007-01-25  Jan Kraemer  <camel@gmx.de>
+
+        Reviewed by Maciej
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=12382
+
+        Fix crash on architectures with 32 bit ints and
+        64 bit longs (For example Linux on AMD64)
+
+        * kjs/dtoa.cpp: #define Long int as suggested in comment
+
+2007-01-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed up #include order for style. No review necessary.
+
+        * API/JSStringRef.cpp:
+
+2007-01-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Copy JSStringRefCF, in case anybody wants to use it. (I just added
+        it recently.)
+
+2007-01-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, trivial property change.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: remove svn:mime-type
+        property which made this binary.
+
+2007-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin.
+
+        * Info.plist: Update copyright string.
+
+2007-01-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Changed to /usr/sbin/sysctl
+        so we don't rely on people's paths.
+
+2007-01-23  Alice Liu  <alice.liu@apple.com>
+
+        release build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Copy APICasts.h
+
+2007-01-23  Geoffrey Garen  <ggaren@apple.com>
+
+        build fix
+
+        * API/JSStringRef.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-01-24  Mark Rowe  <mrowe@apple.com>
+
+        Build fix for DumpRenderTree.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make JSStringRefCF.h public so it's copied into built framework.
+
+2007-01-23  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Copy APICasts.h
+
+2007-01-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed <rdar://problem/4885131> Move CFString function declarations from 
+        JSStringRef.h to JSStringRefCF.h
+        
+        Also removed remaining API FIXMEs and changed them into Radars.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass): Added Radar numbers for UTF8 conversion.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Replaced FIXME for NULL JSContextRef with Radar number.
+
+        * API/JSObjectRef.h: Removed FIXME, which is unprofessional in a public header.
+
+        * API/JSStringRef.cpp: Moved CF related implementations to JSStringRefCF.cpp.
+        (JSStringCreateWithUTF8CString): Replaced FIXME with Radar number.
+        * API/JSStringRef.h: Moved CF related declarations to JSStringRefCF.h. Added
+        #include of JSStringRefCF.h as a stopgap until clients start #including
+        it as needed by themselves.
+
+        * API/JSStringRefCF.cpp: Added.
+        (JSStringCreateWithCFString):
+        (JSStringCopyCFString): Replaced JSChar cast with UniChar cast, which is 
+        more appropriate for a CF call.
+        * API/JSStringRefCF.h: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-01-18  Sanjay Madhav  <sanjay12@gmail.com>
+
+        Reviewed by Darin.
+
+        Add JavaScriptCore define to help with tracing of when objects are marked.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::mark):
+
+2007-01-18  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Zack.
+
+        * JavaScriptCore.pro: Remove generated files on make clean.
+        * pcre/pcre.pri:
+
+2007-01-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        http://bugs.webkit.org/show_bug.cgi?id=12268
+        Give object prototypes their own names
+
+        * kjs/lookup.h: Append "Prototype" to ClassName in KJS_IMPLEMENT_PROTOTYPE.
+
+2007-01-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Added re-entrency checking to GC allocation and collection. It is an error
+        to allocate or collect from within a collection. We've had at least one 
+        case of each bug in the past.
+        
+        Added a comment to the API header, explaining that API clients must not
+        make this mistake, either.
+        
+        Layout tests and JS tests pass.
+
+        * API/JSObjectRef.h:
+        * kjs/collector.cpp:
+        (KJS::GCLock::GCLock):
+        (KJS::GCLock::~GCLock):
+        (KJS::Collector::allocate):
+        (KJS::Collector::collect):
+
+2007-01-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Mitz.
+
+        Minor fixes to JavaScript pretty-printing.
+
+        * JavaScriptCore.exp:
+        * kjs/Parser.cpp:
+        (KJS::Parser::prettyPrint): Return line number and error message if parsing fails.
+        * kjs/Parser.h:
+        * kjs/nodes2string.cpp:
+        (ElementNode::streamTo): Include comma delimiters in array literals.
+        (PropertyNameNode::streamTo): Quote property names in object literals to handle the case when the property name is not a valid identifier.
+        * kjs/testkjs.cpp:
+        (doIt): Print any errors encountered while pretty-printing.
+
+2007-01-12  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+
+        * wtf/HashTraits.h:
+        Add hash traits for unsigned long and unsigned long long.
+
+2007-01-12  Geoffrey Garen  <ggaren@apple.com>
+
+        RS by Brady Eidson.
+        
+        Rolling back in r18786 with leaks fixed, and these renames slightly reworked:
+
+        Because they can return 0:
+        rootObjectForImp => findRootObject (overloaded for JSObject* and Interpreter*)
+        rootObjectForInterpreter => findRootObject (ditto)
+        findReferenceSet => findProtectCountSet
+
+2007-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        RS by Brady Eidson.
+        
+        Rolling out r18786 because it caused leaks.
+
+2007-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Even more cleanup in preparation for fixing <rdar://problem/4608404> 
+        WebScriptObject's _executionContext lack of ownership policy causes 
+        crashes (e.g., in Dashcode)
+        
+        Layout tests pass.
+        
+        Renames:
+            ReferencesSet | ProtectCounts => ProtectCountSet (because it's a typename for a set of GC protect counts)
+            ReferencesByRootMap => RootObjectMap (because RootObjectToProtectCountSetMap would have been confusing)
+            pv => protectedValues
+            rootObjectForImp => getRootObject (overloaded for JSObject* and Interpreter*)
+            rootObjectForInterpreter => getRootObject (ditto)
+            findReferenceSet => getProtectCountSet
+            imp => jsObject
+        
+        (KJS::Bindings::getRootObjectMap): Changed to take advantage of built-in
+        facility for initializing static variables.
+
+        (KJS::Bindings::getProtectCountSet):
+        (KJS::Bindings::destroyProtectCountSet): Added. Helps encapsulate the fact
+        that getting a ProtectCountSet entails adding a RootObject to a hash table,
+        and destroying one entails the reverse.
+
+        (KJS::Bindings::getRootObject): Removed spurious NULL check.
+        
+        (KJS::Bindings::findReferenceSet): Renamed. Changed to use getRootObject()
+        instead of iterating on its own.
+
+        (KJS::Bindings::addNativeReference): Changed to use an early return instead
+        of indenting the whole function.
+        (KJS::Bindings::removeNativeReference): Ditto.
+
+2007-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Even more cleanup in preparation for fixing <rdar://problem/4608404> 
+        WebScriptObject's _executionContext lack of ownership policy causes 
+        crashes (e.g., in Dashcode)
+        
+        Layout tests pass.
+        
+        Renames:
+            findRootObjectForNativeHandleFunction => createRootObject
+            FindRootObjectForNativeHandleFunctionPtr => CreateRootObjectFunction
+            
+        Also removed unnecessary use of "Bindings::" prefix.
+
+        * JavaScriptCore.exp:
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::createNative):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::RootObject::setCreateRootObject):
+        * bindings/runtime_root.h:
+        (KJS::Bindings::RootObject::createRootObject):
+
+2007-01-11  George Staikos  <staikos@kde.org>
+
+        Reviewed by Maciej
+
+        Appears to be Mac specific right now.
+
+        * kjs/config.h:
+
+2007-01-10  Lars Knoll <lars@trolltech.com>
+
+        Reviewed by Zack
+
+        Use the new functionality in Qt 4.3, to make
+        the methods closer compliant with the Unicode
+        spec.
+
+        Keep the old code so that it still compiles against
+        Qt 4.2.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isFormatChar):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::umemcasecmp):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+
+2007-01-09  Darin Adler  <darin@apple.com>
+
+        - update 2007 Apple copyright for the new company name
+
+        * kjs/DateMath.cpp:
+
+2007-01-09  Darin Adler  <darin@apple.com>
+
+        - fix build
+
+        * kjs/string_object.cpp: (KJS::StringProtoFunc::callAsFunction):
+        Actually compile it this time.
+
+2007-01-09  Darin Adler  <darin@apple.com>
+
+        - fix build
+
+        * kjs/string_object.cpp: (KJS::StringProtoFunc::callAsFunction):
+        Change types.
+
+2007-01-09  Darin Adler  <darin@apple.com>
+
+        - fix build on platforms where Unicode::UChar is != uint16_t
+
+        * kjs/string_object.cpp: (KJS::StringProtoFunc::callAsFunction):
+        Change types.
+
+2007-01-09  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Darin.
+
+        - changes for http://bugs.webkit.org/show_bug.cgi?id=11078
+          Forms Don't Submit (ASP Pages)
+
+        * JavaScriptCore.exp:
+        * kjs/value.cpp:
+        (KJS::JSValue::toInt32): Folded toInt32Inline into this method, which was its
+        only caller.
+        (KJS::JSValue::toUInt32): Added a variant that reports if the conversion has
+        succeeded.
+        * kjs/value.h:
+
+2007-01-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=12174
+          improve Unicode use (less WTF::Unicode:: prefix, centralized character names)
+
+        * wtf/unicode/icu/UnicodeIcu.h: Change parameter and return types
+        to UChar32 and UChar. Removed unneeded type casts and added some
+        const to functions that lacked it. Removed WTF::Unicode::memcmp.
+        (WTF::Unicode::umemcasecmp): Renamed from strcasecmp since this
+        doesn't work on 0-terminated strings as the str functions do.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+        - got rid of namespace prefixes from most uses of WTF::Unicode
+
+        * kjs/function.cpp:
+        (KJS::isStrWhiteSpace):
+        (KJS::escapeStringForPrettyPrinting):
+        * kjs/lexer.cpp:
+        (KJS::Lexer::isWhiteSpace):
+        (KJS::Lexer::isIdentStart):
+        (KJS::Lexer::isIdentPart):
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFunc::callAsFunction):
+
+2007-01-07  David Kilzer  <ddkilzer@webkit.org>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=11917
+          setlocale() can return null
+
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFunc::callAsFunction): Removed dead code.
+
+2007-01-07  David Carson  <dacarson@gmail.com>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=12100
+          JNI bindings should be available to non-Mac platforms that have JNI
+
+        Change JNI so that it is not wrapped in the PLATFORM(MAC) ifdef, enabling
+        other platforms who have JNI to use it.
+
+        * bindings/jni/jni_instance.h:  
+          Removed unnecessary include of <CoreFoundation/CoreFoundation.h>
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::setJavaVM):
+        * bindings/jni/jni_utility.h:
+          Added new method for clients to set the JavaVM
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createBindingForLanguageInstance):
+          Changed code to utilize new #if HAVE(JNI)
+        * kjs/config.h:
+          Added new #define for JNI, ie HAVE_JNI
+
+2007-01-07  David Carson  <dacarson@gmail.com>
+
+        Reviewed by Darin.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=11431
+        ARM platform has some byte alignment issues
+
+        Fix for NaN being 4 bytes and it must start on a byte boundary
+        for ARM architectures.
+
+        * kjs/fpconst.cpp:
+        (KJS::):
+
+2007-01-04  David Kilzer  <ddkilzer@webkit.org>
+
+        Reviewed by Kevin McCullough.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=12070
+          REGRESSION: KJS::getUTCOffset() caches UTC offset but ignores time zone changes
+
+        * kjs/DateMath.cpp:
+        (KJS::getUTCOffset): Don't cache UTC offset.
+
+2007-01-02  Darin Adler  <darin@apple.com>
+
+        - minor tweak (hope this doesn't re-break Windows)
+
+        * pcre/pcre_compile.c: Removed use of const pcre_uchar const * -- Mitz probably
+        meant const pcre_uchar *const, but I think we can do without the explicit const here.
+
+        * pcre/pcre_internal.h: Re-enabled warning C4114.
+
+2007-01-02  David Kilzer  <ddkilzer@webkit.org>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        The MSVC compiler requires variables to be declared at the top of the enclosing block in C source.
+
+        Disable this warning to prevent MSVC from complaining about the 'const pcre_uchar const *' type:
+        warning C4114: same type qualifier used more than once
+
+        * pcre/pcre_compile.c:
+        (pcre_compile2): Moved variable declarations to top of their respective enclosing blocks.
+        * pcre/pcre_internal.h: Added pragma to disable compiler warning.
+
+2007-01-01  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=11849
+          REGRESSION (r18182): Google Calendar is broken (a regular expression containing a null character is not parsed correctly)
+
+        Modified pcre_compile() (and the functions that it calls) to work with patterns
+        containing null characters.
+
+        Covered by JavaScriptCore tests ecma_3/RegExp/octal-002.js and ecma_3/RegExp/regress-85721.js
+
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Changed to not null-terminate the pattern string and instead
+        pass its length to pcre_compile.
+        * pcre/pcre.h:
+        * pcre/pcre_compile.c:
+        (check_escape):
+        (get_ucp):
+        (is_counted_repeat):
+        (check_posix_syntax):
+        (compile_branch):
+        (compile_regex):
+        (pcre_compile): Added a parameter specifying the length of the pattern, which
+        is no longer required to be null-terminated and may contain null characters. 
+        (pcre_compile2):
+        * pcre/pcre_internal.h:
+        * tests/mozilla/expected.html: Updated for the two tests that this patch
+        fixes. Also updated failing results for ecma_3/RegExp/regress-100199.js
+        which were not updated after bug 6257 was fixed.
+
+2007-01-01  David Kilzer  <ddkilzer@webkit.org>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=12057
+          REGRESSION: JavaScript Date Is One Day In The Future in GMT time zone
+
+        Because Mac OS X returns geographically and historically accurate time zone information,
+        converting Jan 02, 1970 12:00:00 AM to local time then subtracting 24 hours did not work
+        in GMT (London - England) since it was in BST (+0100) all year in 1970[1].  Instead, the
+        UTC offset is calculated by converting Jan 01, 2000 12:00:00 AM to local time then
+        subtracting that from the same date in UTC.
+
+        [1] http://en.wikipedia.org/wiki/British_Summer_Time
+
+        * kjs/DateMath.cpp:
+        (KJS::getUTCOffset): Updated UTC offset calculation.
+        (KJS::getDSTOffset): Improved comment.
+
+2006-12-31  David Kilzer  <ddkilzer@webkit.org>
+
+        Reviewed by Geoff.
+
+        Update embedded pcre library from version 6.2 to 6.4.  Changes from pcre 6.2 to 6.3
+        did not include any files in JavaScriptCore/pcre.
+
+        All changes include renaming EXPORT to PCRE_EXPORT, renaming of ucp_findchar() to
+        _pcre_ucp_findchar(), or comment changes.  Additional changes noted below.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Updated source file list.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Renamed pcre_printint.c to pcre_printint.src
+        and changed it from a source file to a header file.
+        * JavaScriptCoreSources.bkl: Updated source file list.
+        * pcre/CMakeLists.txt: Updated source file list.
+        * pcre/pcre-config.h:
+        * pcre/pcre.h: Updated version.
+        * pcre/pcre.pri: Updated source file list.
+        * pcre/pcre_compile.c: Include pcre_printint.src #if DEBUG.
+        (pcre_compile2):
+        * pcre/pcre_config.c:
+        * pcre/pcre_exec.c:
+        (match):
+        * pcre/pcre_fullinfo.c:
+        * pcre/pcre_info.c:
+        * pcre/pcre_internal.h: Added header guard.  Removed export of _pcre_printint().
+        * pcre/pcre_ord2utf8.c:
+        * pcre/pcre_printint.c: Renamed to pcre_printint.src.
+        * pcre/pcre_printint.src: Added.  Renamed _pcre_printint() to pcre_printint().
+        * pcre/pcre_refcount.c:
+        * pcre/pcre_study.c:
+        * pcre/pcre_tables.c:
+        * pcre/pcre_try_flipped.c:
+        * pcre/pcre_ucp_findchar.c: Added contents of ucp_findchar.c.
+        * pcre/pcre_version.c:
+        * pcre/pcre_xclass.c:
+        (_pcre_xclass):
+        * pcre/ucp.h: Removed export of ucp_findchar().
+        * pcre/ucp_findchar.c: Removed.  Contents moved to pcre_ucp_findchar.c.
+
+2006-12-29  David Kilzer  <ddkilzer@webkit.org>
+
+        Reviewed by Geoff.
+
+        Update embedded pcre library from version 6.1 to 6.2.  From the pcre ChangeLog:
+
+        3. Added "b" to the 2nd argument of fopen() in dftables.c, for non-Unix-like
+           operating environments where this matters.
+
+        5. Named capturing subpatterns were not being correctly counted when a pattern
+           was compiled. This caused two problems: (a) If there were more than 100
+           such subpatterns, the calculation of the memory needed for the whole
+           compiled pattern went wrong, leading to an overflow error. (b) Numerical
+           back references of the form \12, where the number was greater than 9, were
+           not recognized as back references, even though there were sufficient
+           previous subpatterns.
+
+        * pcre/dftables.c: Item 3.
+        (main):
+        * pcre/pcre.h: Updated version.
+        * pcre/pcre_compile.c: Item 5.
+        (read_repeat_counts):
+        (pcre_compile2):
+
+2006-12-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Brian Dash... err... Mark Rowe.
+
+        More cleanup in preparation for fixing <rdar://problem/4608404> 
+        WebScriptObject's _executionContext lack of ownership policy causes 
+        crashes (e.g., in Dashcode)
+        
+        The key change here is to RootObject::RootObject().
+        
+        * JavaScriptCore.exp:
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant): Changed to use new constructor.
+
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::createNative): Changed to use new constructor. Replaced
+        large 'if' followed by default condition with "if !" and explicit default
+        condition.
+
+        * bindings/objc/objc_runtime.mm:
+        (convertValueToObjcObject): Changed to use new constructor.
+
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::RootObject::destroy): "removeAllNativeReferences" => "destroy"
+        because this function actually destroys the RootObject.
+
+        * bindings/runtime_root.h: Changed Interpreter* to RefPtr<Interpreter>
+        to prevent a RootObject from holding a stale Interperter*.
+        
+        (KJS::Bindings::RootObject::RootObject): Changed constructor to take an 
+        Interpreter*, since it's pointless to create a RootObject without one.
+        Removed setRootObjectImp() and rootObjectImp() because they were just
+        a confusing way of setting and getting the Interpreter's global object.
+
+        (KJS::Bindings::RootObject::nativeHandle): "_nativeHandle" => "m_nativeHandle"
+        (KJS::Bindings::RootObject::interpreter): "_interpreter" => "m_interpreter"
+
+2006-12-28  George Staikos  <staikos@kde.org>
+
+        Reviewed by Olliej.
+
+        * bindings/qt/qt_instance.cpp: build
+        (KJS::Bindings::QtInstance::QtInstance):
+
+2006-12-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        More cleanup. Layout tests pass.
+        
+        Use a helper function to initialize and access WebUndefined and WebScriptObject.
+
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (KJS::Bindings::webScriptObjectClass):
+        (KJS::Bindings::webUndefinedClass):
+        (convertValueToObjcObject):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+
+2006-12-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Brady Eidson.
+        
+        Some cleanup in preparation for fixing <rdar://problem/4608404> 
+        WebScriptObject's _executionContext lack of ownership policy causes 
+        crashes (e.g., in Dashcode)
+        
+        I'm just trying to make heads or tails of this baffling code.
+        
+        Renamed "root" | "execContext" | "executionContext" => "rootObject", because
+        that's the object's (admittedly vague) type name.
+        
+        * bindings/runtime.cpp: Removed createLanguageInstanceForValue
+        because I'll give you a dollar if you can explain to me what it actually did.
+        
+        * bindings/runtime_root.cpp: Put everything in the KJS::Bindings namespace,
+        removing the KJS::Bindings prefix from individual functions and datatypes.
+        This matches the header and eliminates a lot of syntax cruft.
+        
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant): Replaced use of createLanguageInstanceForValue
+        with call to _NPN_CreateScriptObject because that's what createLanguageInstanceForValue
+        actually did (but don't ask me for that dollar now; that's cheating.)
+
+        * bindings/objc/objc_utility.h:
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue): Removed. Its only purpose was 
+        to call a single function for WebKit, which WebKit can do on its own.
+
+        * kjs/interpreter.h: Removed rtti() because it was unused, and this class
+        is scheduled for demolition anyway.
+        
+        * kjs/interpreter.cpp: Removed createLanguageInstanceForValue because it had
+        nothing to do with the Interpreter, and nothing makes Chuck Norris more mad
+        than a function whose sole purpose is to call another function of the same
+        name. (Really, I asked him.)
+
+2006-12-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Some cleanup in preparation for fixing <rdar://problem/4740328> Safari 
+        crash on quit in _NPN_ReleaseObject from KJS::Bindings::CInstance::~CInstance
+
+        * bindings/c/c_instance.cpp:
+        * bindings/c/c_instance.h: Removed unused copy constructor and assignment
+        operator. They made tracking data flow more difficult. Unused code is also 
+        dangerous because it can succumb to bit rot with the stealth of a Ninja.
+        
+        Replaced #include with forward declaration to reduce header dependency.
+        
+        * bindings/npruntime.cpp: Sorted #includes.
+        (_NPN_GetStringIdentifier): Replaced assert with ASSERT.
+        (_NPN_GetStringIdentifiers): ditto
+        (_NPN_ReleaseVariantValue): ditto
+        (_NPN_CreateObject): ditto
+        (_NPN_RetainObject): ditto
+        (_NPN_ReleaseObject): ditto
+        (_NPN_DeallocateObject): ditto
+
+2006-12-20  Anders Carlsson  <acarlsson@apple.com>
+
+        * kjs/string_object.cpp:
+        (localeCompare):
+        Another speculative Win32 fix.
+
+2006-12-20  Anders Carlsson  <acarlsson@apple.com>
+
+        * kjs/string_object.cpp:
+        (localeCompare):
+        Speculative Win32 fix.
+
+2006-12-20  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/4235733>
+        <http://bugs.webkit.org/?show_bug.cgi?id=10193>
+        support String.localeCompare.
+        
+        Implement localeCompare.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/string_object.cpp:
+        (localeCompare):
+        (StringProtoFunc::callAsFunction):
+        * kjs/string_object.h:
+        (KJS::StringProtoFunc::):
+
+2006-12-20  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: use GCC 4.0 for all the other test targets
+
+2006-12-20  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/4871613> JavaScriptCore-421.31's dftables target needs to override default compiler and use gcc-4.0
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-12-20  Lars Knoll <lars@trolltech.com>
+
+        Reviewed by David Hyatt
+
+        Added support to bind QObject's to 
+        JavaScript.
+
+        * JavaScriptCore.pro:
+        * bindings/qt/qt_class.cpp: Added.
+        (KJS::Bindings::QtClass::QtClass):
+        (KJS::Bindings::QtClass::~QtClass):
+        (KJS::Bindings::QtClass::classForObject):
+        (KJS::Bindings::QtClass::name):
+        (KJS::Bindings::QtClass::methodsNamed):
+        (KJS::Bindings::QtClass::fieldNamed):
+        * bindings/qt/qt_class.h: Added.
+        (KJS::Bindings::QtClass::constructorAt):
+        (KJS::Bindings::QtClass::numConstructors):
+        * bindings/qt/qt_instance.cpp: Added.
+        (KJS::Bindings::QtInstance::QtInstance):
+        (KJS::Bindings::QtInstance::~QtInstance):
+        (KJS::Bindings::QtInstance::operator=):
+        (KJS::Bindings::QtInstance::getClass):
+        (KJS::Bindings::QtInstance::begin):
+        (KJS::Bindings::QtInstance::end):
+        (KJS::Bindings::QtInstance::implementsCall):
+        (KJS::Bindings::QtInstance::invokeMethod):
+        (KJS::Bindings::QtInstance::invokeDefaultMethod):
+        (KJS::Bindings::QtInstance::defaultValue):
+        (KJS::Bindings::QtInstance::stringValue):
+        (KJS::Bindings::QtInstance::numberValue):
+        (KJS::Bindings::QtInstance::booleanValue):
+        (KJS::Bindings::QtInstance::valueOf):
+        * bindings/qt/qt_instance.h: Added.
+        (KJS::Bindings::QtInstance::getObject):
+        * bindings/qt/qt_runtime.cpp: Added.
+        (KJS::Bindings::convertValueToQVariant):
+        (KJS::Bindings::convertQVariantToValue):
+        (KJS::Bindings::QtField::name):
+        (KJS::Bindings::QtField::valueFromInstance):
+        (KJS::Bindings::QtField::setValueToInstance):
+        * bindings/qt/qt_runtime.h: Added.
+        (KJS::Bindings::QtField::QtField):
+        (KJS::Bindings::QtField::type):
+        (KJS::Bindings::QtMethod::QtMethod):
+        (KJS::Bindings::QtMethod::name):
+        (KJS::Bindings::QtMethod::numParameters):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createBindingForLanguageInstance):
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::):
+        * bindings/testbindings.pro: Added.
+        * bindings/testqtbindings.cpp: Added.
+        (MyObject::MyObject):
+        (MyObject::setTestString):
+        (MyObject::setTestInt):
+        (MyObject::testString):
+        (MyObject::testInt):
+        (MyObject::foo):
+        (Global::className):
+        (main):
+
+2006-12-19  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+
+        Add -p option to testkjs which pretty prints the files instead of executing them.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/Parser.cpp:
+        (KJS::Parser::prettyPrint):
+        * kjs/Parser.h:
+        * kjs/testkjs.cpp:
+        (doIt):
+
+2006-12-19  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Lou
+        
+        Removed unneccessary "else"
+
+        * wtf/Assertions.cpp:
+
+2006-12-19  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/4891774> Local WebCore/WebBrowser builds fail in 9A328 due to warning about ObjC-2.0 language features
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-12-17  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Zack.
+
+        * kjs/testkjs.pro: Oops, make it also build on machines other than
+        mine :)
+
+2006-12-17  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Rob Buis.
+
+        * kjs/testkjs.pro: Added .pro file to build testkjs.
+
+2006-12-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Rob.
+
+        A deleted object was accessed to prepare RegExp construction error messages.
+
+        * kjs/regexp_object.cpp:
+        (RegExpObjectImp::construct): Wrap the RegExp into an OwnPtr.
+
+2006-12-16  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Alexey.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=11814
+          REGRESSION(r18098): Find does not work with capital letters
+
+        Test: editing/execCommand/findString-3.html
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::foldCase): Changed to not return an error if the result fits
+        in the buffer without a null terminator.
+
+2006-12-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Anders.
+        
+        - added equality and inequality operations for HashMap and Vector, useful for comparing more complex types
+
+        * wtf/HashMap.h:
+        (WTF::operator==):
+        (WTF::operator!=):
+        * wtf/Vector.h:
+        (WTF::operator==):
+        (WTF::operator!=):
+
+2006-12-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff. Based on a patch by Maks Orlovich.
+
+        http://bugs.webkit.org/show_bug.cgi?id=6257
+        Throw errors on invalid expressions (KJS merge)
+
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        (KJS::RegExp::~RegExp):
+        (KJS::RegExp::match):
+        * kjs/regexp.h:
+        (KJS::RegExp::flags):
+        (KJS::RegExp::isValid):
+        (KJS::RegExp::errorMessage):
+        (KJS::RegExp::subPatterns):
+        Remember and report RegExp construction failures. Renamed data members not to start with underscores.
+
+        * kjs/regexp_object.cpp:
+        (RegExpObjectImp::construct): Raise an exception if RegExp construction fails.
+        (RegExpObjectImp::callAsFunction): Removed an obsolete comment.
+
+        * tests/mozilla/ecma_3/RegExp/regress-119909.js: Reduced the number of nested parentheses to 
+        a value supported by PCRE.
+
+2006-12-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=9673
+        Add support for window.atob() and window.btoa()
+
+        * JavaScriptCore.exp: Export UString::is8Bit().
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added StringExtras.h as 
+        a private header.
+
+2006-12-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Let Xcode update this
+        (I think Hyatt is using an old Xcode).
+
+2006-12-11  David Hyatt  <hyatt@apple.com>
+
+        Fix the failing layout test.  Just remove Unicode::isSpace and
+        revert StringImpl to do the same thing it was doing before.
+
+        Reviewed by darin
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2006-12-09  George Staikos  <staikos@kde.org>
+
+        Reviewed by Zack.
+
+        Fix bison again on qmake build.
+
+        * JavaScriptCore.pro:
+
+2006-12-09  Lars Knoll <lars@trolltech.com>
+
+        Reviewed by Zack
+
+        Make it possible to build WebKit with qmake.
+
+        * JavaScriptCore.pro: Added.
+        * kjs/kjs.pro: Removed.
+        * pcre/pcre.pri: Added.
+
+2006-12-09  Zack Rusin  <zack@kde.org>
+
+        Fixing the compilation with platform kde after the icu changes.
+
+        * CMakeLists.txt:
+
+2006-12-09  Adam Roben  <aroben@apple.com>
+
+        Reviewed by Darin.
+
+        Some updates in reaction to r18098.
+
+        * wtf/unicode/icu/UnicodeIcu.h: Use !! to convert UBool to bool in all
+        cases.
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isUpper):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2006-12-09  George Staikos  <staikos@kde.org>
+
+        Patch by Lars Knoll, comment out ICU dependency on Qt platform (unused code).
+
+        Reviewed by Darin.
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertUTF8ToUTF16):
+
+2006-12-08  David Hyatt  <hyatt@apple.com>
+
+        Land the new ICU abstraction layer.  Patch by Lars.
+
+        Reviewed by me
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Platform.h:
+        * wtf/unicode/UnicodeCategory.h: Removed.
+        * wtf/unicode/UnicodeDecomposition.h: Removed.
+        * wtf/unicode/UnicodeDirection.h: Removed.
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::category):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::strcasecmp):
+        (WTF::Unicode::memset):
+        * wtf/unicode/qt4/UnicodeQt4.cpp: Removed.
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::strcasecmp):
+        (WTF::Unicode::memset):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+
+=== Safari-521.32 ===
+
+2006-12-08  Adam Roben  <aroben@apple.com>
+
+        Reviewed by Anders.
+
+        This is a mo' better fix for ensuring we don't use macro definitions
+        of min/max.
+
+        * kjs/config.h:
+        * wtf/Vector.h:
+
+2006-12-07  Kevin Fyure  <digdog@macports.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=11545
+        Disable the testcases do not follow the ECMA-262v3 specification.
+        
+        * tests/mozilla/expected.html: Update Results.
+        * tests/mozilla/js1_2/String/concat.js:
+        4 tests disabled. The result of concat Array object is not followinig
+        ECMA 15.5.4.6
+        * tests/mozilla/js1_2/function/Number.js:
+        1 test disabled. The result of Array object to Number object conversion 
+        is not following ECMA 9.3. And the test was duplicated in 
+        ecma/TypeConversion/9.3-1.js
+        * tests/mozilla/js1_2/function/String.js:
+        2 tests disabled. The result of Object/Array object to String object 
+        conversion is not following ECMA 15.5.1.1 and ECMA 9.8
+
+2006-11-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver.
+        
+        Move WTF from JavaScriptCore project into a new WTF project.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add WTF.vcproj to sln
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Remove WTF source files
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added.
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj: Add dependency on WTF.lib
+
+2006-11-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Fixed up garbage collection at window close time.
+
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::~Interpreter): Garbage collect here, since
+        destroying the interpreter frees the global object and 
+        therefore creates a lot of garbage.
+
+2006-11-20  W. Andy Carrel  <wac@google.com>
+
+        Reviewed by Maciej.
+
+        http://bugs.webkit.org/show_bug.cgi?id=11501
+        REGRESSION: \u no longer escapes metacharacters in RegExps
+        http://bugs.webkit.org/show_bug.cgi?id=11502
+        Serializing RegExps doesn't preserve Unicode escapes
+
+        * kjs/lexer.cpp:
+        (Lexer::Lexer):
+        (Lexer::setCode):
+        (Lexer::shift):
+        (Lexer::scanRegExp):
+        Push \u parsing back down into the RegExp object rather than in the
+        parser. This backs out r17354 in favor of a new fix that better 
+        matches the behavior of other browsers.
+
+        * kjs/lexer.h:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        (KJS::sanitizePattern):
+        (KJS::isHexDigit):
+        (KJS::convertHex):
+        (KJS::convertUnicode):
+        * kjs/regexp.h:
+        Translate \u escaped unicode characters for the benefit of pcre.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::append):
+        Fix failure to increment length on the first UChar appended to a 
+        UString that was copy-on-write.
+
+        * tests/mozilla/ecma_2/RegExp/properties-001.js:
+        Adjust tests back to the uniform standards.
+
+2006-11-20  Samuel Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej.
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=11647
+        Fix Win32 build
+
+        * kjs/config.h: define NOMINMAX instead of min/max
+        as themselves.
+        * wtf/Vector.h: put back hack to ensure that min/max
+        are not defined as macros.
+
+2006-11-19  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Zack.
+
+        http://bugs.webkit.org/show_bug.cgi?id=11649
+        Fix CMake Qt-only build without KDE CMake files
+
+        * CMakeLists.txt:
+        * pcre/CMakeLists.txt:
+
+2006-11-17  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Adam.
+
+        Make sure that we always use std::min and std::max instead of macros.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * kjs/config.h:
+        * wtf/Vector.h:
+
+=== Safari-521.31 ===
+
+2006-11-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Added project-wide setting to disable Microsoft's made-up deprecation 
+        warnings related to std:: functions. (Doesn't have any affect yet,
+        since we currently disable all deprecation warnings.)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2006-11-12  Mark Rowe  <bdash@webkit.org>
+
+        Reviewed by Mitz.
+
+        Clean up of JavaScriptCore bakefiles.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2006-11-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        http://bugs.webkit.org/show_bug.cgi?id=11508
+        Undisable some warnings for JSImmediate.h
+
+        Fix suggested by Don Gibson.
+
+        * kjs/JSImmediate.h:
+        Re-enable all MSVC warnings, move the remaining runtime checks
+        to compile-time.
+
+2006-11-10  Zalan Bujtas  <zalan.bujtas@nokia.com>
+
+        Reviewed by Maciej.
+
+        Added s60/symbian platform defines.
+        http://bugs.webkit.org/show_bug.cgi?id=11540
+
+        * wtf/Platform.h:
+
+=== Safari-521.30 ===
+
+2006-11-08  Ada Chan  <adachan@apple.com>
+
+        Reviewed by darin.
+        
+        Added a method to delete all the keys in a HashMap.
+
+        * wtf/HashMap.h:
+        (WTF::deleteAllPairFirsts):
+        (WTF::deleteAllKeys):
+
+2006-11-07  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        Initialize cachedPrototype to 0.
+
+2006-11-06  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by Maciej.
+
+        Remove warning about garbage after #else. #else clause applies for all
+        non-mac platforms, not only win.
+
+        * kjs/date_object.cpp:
+
+2006-11-06  Mark Rowe  <bdash@webkit.org>
+
+        Reviewed by the wonderful Mitz Pettel.
+
+        http://bugs.webkit.org/show_bug.cgi?id=11524
+        Bug 11524: REGRESSION(r9842): Array.prototype.join should use ToString operator rather than calling toString on each element
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction): Use ToString operator on each element rather than calling their toString method.
+
+2006-11-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build
+
+        * kjs/JSImmediate.h:
+
+2006-11-03  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=11504
+        Fix warnings on non 32 bit platforms
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::NanAsBits):
+        (KJS::JSImmediate::oneAsBits):
+        Rewrite in a way that moves runtime checks to compile-time.
+
+        (KJS::):
+        (KJS::JSImmediate::fromDouble):
+        (KJS::JSImmediate::toDouble):
+
+2006-11-02  George Staikos <staikos@kde.org>
+
+        Reviewed by Maciej.
+
+        * collector.cpp:
+        Remove a deprecated pthreads call.
+
+2006-11-02  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Maciej, landed by Anders.
+
+        * CMakeLists.txt:
+        Make KDE support optional.
+
+2006-11-01  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Brady.
+
+        - Fixes many JavaScriptCore tests in other timezones.  The root problem is that on mac localtime() returns historically accurate information for DST, but the JavaScript spec explicitly states to not take into account historical information but rather to interpolate from valid years.
+
+        * kjs/DateMath.cpp:
+        (KJS::equivalentYearForDST):
+        (KJS::getDSTOffsetSimple):
+        (KJS::getDSTOffset):
+
+2006-10-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=11477
+        REGRESSION: GMail crashes in KJS::FunctionImp::callerGetter
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::argumentsGetter): Removed unnecessary braces.
+        (KJS::FunctionImp::callerGetter): More logical NULL checking.
+
+2006-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Adding definition for PLATFORM(CI)
+
+        * wtf/Platform.h:
+
+2006-10-31  Vladimir Olexa  <vladimir.olexa@gmail.com>
+
+        Reviewed by Geoff.
+
+        http://bugs.webkit.org/show_bug.cgi?id=4166
+        Function object does not support caller property
+
+        Test: fast/js/caller-property.html
+
+        * kjs/function.cpp: 
+        (KJS::FunctionImp::callerGetter): added
+        (KJS::FunctionImp::getOwnPropertySlot): added if statement to handle callerGetter()
+        * kjs/function.h: added callerGetter() declaration
+        * kjs/identifier.h: added caller property macro
+        * tests/mozilla/expected.html: 
+
+2006-10-30  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Adam.
+
+        - Fix some timezone issues and JavaScriptCore date tests.  Addresses bugzilla 4930.
+
+        * kjs/DateMath.h:
+        (KJS::GregorianDateTime::GregorianDateTime): Here's the fix, to add parenthesis for order of precedence.
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFunc::callAsFunction): 
+        (KJS::DateObjectImp::construct): memset not needed as GregorianDateTime initializes itself.
+
+2006-10-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        * kjs/SavedBuiltins.h: Added needed include.
+        * wtf/OwnPtr.h: (WTF::OwnPtr::set): Fixed mistake in assertion.
+
+2006-10-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - renamed PassRefPtr::release to releaseRef to make it clearer that
+          it's the counterpart of adoptRef, and to make it harder to confuse
+          it with the safer-to-use RefPtr::release
+
+        * kjs/identifier.cpp:
+        (KJS::CStringTranslator::translate):
+        (KJS::UCharBufferTranslator::translate):
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::create):
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::PassRefPtr):
+        (WTF::PassRefPtr::~PassRefPtr):
+        (WTF::PassRefPtr::get):
+        (WTF::PassRefPtr::releaseRef):
+        (WTF::PassRefPtr::operator->):
+        (WTF::PassRefPtr::operator=):
+        (WTF::adoptRef):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::RefPtr::operator=):
+
+2006-10-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Steve.
+
+        * kjs/grammar.y: Add definitions of YYMALLOC and YYFREE to fix
+        a warning some people see (not sure why others don't see it).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/grammarWrapper.cpp: Touch
+        this file to force it to re-build grammar.cpp.
+
+2006-10-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - made changes so the code compiles with the highest warning level
+          under MSVC (disabling some warnings, making some code fixes)
+
+        * API/JSCallbackConstructor.cpp:
+        (KJS::JSCallbackConstructor::construct):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::callAsFunction):
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::init):
+        (KJS::JSCallbackObject::construct):
+        (KJS::JSCallbackObject::callAsFunction):
+        * API/JSObjectRef.cpp:
+        (JSPropertyNameArrayGetNameAtIndex):
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertUTF8ToUTF16):
+        (KJS::Bindings::coerceValueToNPVariantStringType):
+        (KJS::Bindings::convertValueToNPVariant):
+        * kjs/DateMath.h:
+        (KJS::GregorianDateTime::GregorianDateTime):
+        * kjs/ExecState.h:
+        (KJS::ExecState::hadException):
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::fromDouble):
+        (KJS::JSImmediate::toDouble):
+        (KJS::JSImmediate::NanAsBits):
+        (KJS::JSImmediate::oneAsBits):
+        * kjs/Parser.h:
+        * kjs/PropertyNameArray.h:
+        (KJS::PropertyNameArray::size):
+        * kjs/array_object.cpp:
+        (ArrayObjectImp::callAsFunction):
+        * kjs/bool_object.cpp:
+        (BooleanObjectImp::callAsFunction):
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+        (KJS::Collector::markCurrentThreadConservatively):
+        (KJS::Collector::collect):
+        * kjs/completion.h:
+        (KJS::Completion::isValueCompletion):
+        * kjs/date_object.cpp:
+        (KJS::findMonth):
+        * kjs/debugger.cpp:
+        (Debugger::sourceParsed):
+        (Debugger::sourceUnused):
+        (Debugger::exception):
+        (Debugger::atStatement):
+        (Debugger::callEvent):
+        (Debugger::returnEvent):
+        * kjs/dtoa.cpp:
+        * kjs/error_object.cpp:
+        (ErrorObjectImp::callAsFunction):
+        (NativeErrorImp::callAsFunction):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::processVarDecls):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function_object.cpp:
+        (FunctionPrototype::callAsFunction):
+        * kjs/grammar.y:
+        * kjs/identifier.cpp:
+        (KJS::CStringTranslator::translate):
+        (KJS::Identifier::add):
+        * kjs/internal.h:
+        * kjs/lexer.cpp:
+        (Lexer::lex):
+        (Lexer::isIdentStart):
+        (Lexer::isIdentPart):
+        (isDecimalDigit):
+        (Lexer::isHexDigit):
+        (Lexer::isOctalDigit):
+        (Lexer::matchPunctuator):
+        (Lexer::singleEscape):
+        (Lexer::convertOctal):
+        (Lexer::convertHex):
+        (Lexer::convertUnicode):
+        (Lexer::record8):
+        * kjs/lexer.h:
+        * kjs/math_object.cpp:
+        (MathFuncImp::callAsFunction):
+        * kjs/number_object.cpp:
+        (integer_part_noexp):
+        (intPow10):
+        (NumberProtoFunc::callAsFunction):
+        (NumberObjectImp::callAsFunction):
+        * kjs/object.cpp:
+        (KJS::JSObject::deleteProperty):
+        (KJS::JSObject::callAsFunction):
+        (KJS::JSObject::toBoolean):
+        (KJS::JSObject::toObject):
+        * kjs/object.h:
+        (KJS::JSObject::getPropertySlot):
+        * kjs/property_map.cpp:
+        (KJS::isValid):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::insert):
+        (KJS::PropertyMap::containsGettersOrSetters):
+        * kjs/property_map.h:
+        (KJS::PropertyMap::hasGetterSetterProperties):
+        * kjs/property_slot.h:
+        * kjs/string_object.cpp:
+        (StringInstance::getPropertyNames):
+        (StringObjectImp::callAsFunction):
+        (StringObjectFuncImp::callAsFunction):
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::computeHash):
+        (KJS::UString::UString):
+        (KJS::UString::from):
+        (KJS::UString::append):
+        (KJS::UString::ascii):
+        (KJS::UString::operator=):
+        (KJS::UString::find):
+        (KJS::UString::rfind):
+        * kjs/ustring.h:
+        (KJS::UChar::high):
+        (KJS::UChar::low):
+        (KJS::UCharReference::low):
+        (KJS::UCharReference::high):
+        * kjs/value.cpp:
+        (KJS::JSValue::toUInt16):
+        * kjs/value.h:
+        * pcre/pcre_compile.c:
+        (get_othercase_range):
+        * pcre/pcre_exec.c:
+        (match):
+        * pcre/pcre_internal.h:
+        * wtf/HashFunctions.h:
+        (WTF::intHash):
+        (WTF::PtrHash::hash):
+        * wtf/MathExtras.h:
+        (isnan):
+        (lround):
+        (lroundf):
+        * wtf/StringExtras.h:
+        (strncasecmp):
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isPrintableChar):
+
+2006-10-26  W. Andy Carrel  <wac@google.com>
+
+        Reviewed by Maciej.
+
+        - Fix http://bugs.webkit.org/show_bug.cgi?id=7445 /
+          <rdar://problem/4614195> (and 7253 / <rdar://4694011>) by changing
+          inline regexps so that they can have \u escaped Unicode sequences and
+          still work properly.
+
+        * kjs/lexer.cpp:
+        (Lexer::Lexer): 
+        (Lexer::setCode):
+        (Lexer::shift): Looking ahead one additional character for the benefit
+        of scanRegExp
+        (Lexer::scanRegExp): Change code to support unicode escapes in inline 
+        regexps.
+        * kjs/lexer.h: Extra lookahead added.
+
+=== Safari-521.29 ===
+
+2006-10-26  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Darin.
+
+        Fix build with older gcc 3.3.4.
+
+        * kjs/DateMath.cpp: Remove inline prefix.
+        (KJS::equivalentYearForDST):
+
+2006-10-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+        - fix iteration of properties of string objects (found because of a warning
+          emitted by the MSVC compiler)
+
+        * kjs/string_object.cpp: (StringInstance::getPropertyNames): Change code that
+        wants to format a number as a string to use UString::from. Before it was using
+        the UString constructor that makes a string from a character!
+
+        * kjs/ustring.h:
+        * kjs/ustring.cpp: Remove the dangerous and not all that helpful UString(char)
+        constructor.
+
+        * kjs/grammar.y: Change code to not depend on the UString(char) constructor.
+        This is potentially more efficient anyway because we could overload the + operator
+        some day to handle char* directly instead of creating a UString.
+
+        * kjs/nodes2string.cpp: (SourceStream::operator<<): Change code to not depend on
+        the UString(char) constructor.
+
+2006-10-25  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Steve (rubber stamp).
+
+        - Link against your local build of JavaScriptCore.lib first, this fixes some errors on release builds of testkjs.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2006-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Lou.
+        
+        Removed duplicate symbol declaration.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/grammar.y:
+
+2006-10-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Build config change
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2006-10-24  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Brady.
+
+        - Fixes a date formatting issue on win.  Specifically strftime cannot handle some ranges of time so we shift time call strftime and then manipulate the returned string, if needed.
+
+        * kjs/date_object.cpp:
+        (KJS::):
+        (KJS::formatLocaleDate):
+        (KJS::DateProtoFunc::callAsFunction):
+
+2006-10-23  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by 
+
+       - Build fix
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/grammar.y:
+
+2006-10-23  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Maciej.
+
+        - Makes the toTM function an operator.  Was going to piggy back on a patch but the patch needs more work.
+
+        * kjs/DateMath.cpp:
+        (KJS::equivalentYearForDST):
+        * kjs/DateMath.h:
+        (KJS::GregorianDateTime::operator tm):
+        * kjs/date_object.cpp:
+        (KJS::formatTime):
+        (KJS::DateProtoFunc::callAsFunction):
+
+2006-10-23  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Maciej.
+
+       - Fixes two regressions on win.  Both are stack overflows. For one the number of recursions is capped at 100, and for the other, nested parenthesis pairs are not evaluated (since they would evaluate to whatever is in them anyway).
+
+        * kjs/grammar.y:
+        * kjs/object.cpp:
+
+2006-10-21  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam.
+        
+        Add minimal compatibility with MSVCRT leak checker
+
+        * wtf/FastMalloc.h:
+
+2006-10-23  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Geof.
+
+        - Sets the lowercase range correctly in the test and consolidates a variable to make the test more readable.
+
+       * tests/mozilla/ecma/String/15.5.4.11-2.js:
+
+2006-10-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=11377
+          swap(Vector, Vector) should be O(1) instead of O(n)
+
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::swap): Added.
+        (WTF::Vector::swap): Added.
+        (WTF::swap): Added overload that takes two Vector objects.
+
+2006-10-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=11376
+          build scripts should invoke make with "-j" option for multiple processors
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Pass -j `sysctl -n hw.ncpu` to make.
+
+2006-10-19  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Geof.
+
+        Changed test to make us pass Georgian case changing for Unicode 4.0 and 5.0.  This incorporates changes from the 1.4 revision of the same mozilla test.
+        On Tiger we are still using Unicode 4.0 but on win and Leopard we are using Unicode 5.0, so this test currently allows for either answer.
+
+        * tests/mozilla/ecma/String/15.5.4.11-2.js:
+
+2006-10-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - remove vestiges of KXMLCore name (former name of WTF).
+
+        * wtf/Assertions.h:
+        * wtf/FastMalloc.h:
+        (operator new):
+        (operator delete):
+        (operator new[]):
+        (operator delete[]):
+        * wtf/FastMallocInternal.h:
+        * wtf/Forward.h:
+        * wtf/GetPtr.h:
+        * wtf/HashCountedSet.h:
+        * wtf/HashFunctions.h:
+        * wtf/HashMap.h:
+        * wtf/HashSet.h:
+        * wtf/HashTable.h:
+        * wtf/HashTraits.h:
+        * wtf/ListRefPtr.h:
+        * wtf/MathExtras.h:
+        * wtf/Noncopyable.h:
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/PassRefPtr.h:
+        * wtf/Platform.h:
+        * wtf/RefPtr.h:
+        * wtf/StringExtras.h:
+        (snprintf):
+        * wtf/UnusedParam.h:
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+
+2006-10-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Maciej.
+        
+        Adjust include paths
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2006-10-17  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Darin.
+
+        Fixed a date issue where the UTC offset was not set in win.
+
+        * kjs/DateMath.cpp:
+        (KJS::getDSTOffsetSimple):
+        (KJS::getDSTOffset):
+        (KJS::msToGregorianDateTime):
+        * kjs/DateMath.h:
+        (KJS::):
+        (KJS::GregorianDateTime::GregorianDateTime):
+
+2006-10-17  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Brady.
+
+        Fixes a JavaScriptCore math issue on win.
+
+        * kjs/math_object.cpp:
+        (MathFuncImp::callAsFunction):
+        * wtf/MathExtras.h:
+        (wtf_atan2):
+
+2006-10-16  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geof.
+
+        Removed unecessary global specifiers.
+
+        * kjs/math_object.cpp:
+        (MathFuncImp::callAsFunction):
+
+2006-10-16  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by John.
+
+        Fixes a compile order issue for testkjs on win.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2006-10-15  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by Anders.
+
+        Remove junk (as gcc calls it) after #else clause.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::do_free):
+
+2006-10-14  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by Maciej.
+
+        Define KXMLCORE_USE_CURL for platforms that wish to use CURL as
+        networking, and set it for GDK build
+
+        * wtf/Platform.h:
+
+2006-10-13  Brett Wilson  <brettw@google.com>
+
+        Reviewed by Kevin McCullough.
+
+        Fixes http://bugs.webkit.org/show_bug.cgi?id=11283
+        Fixes Qt/Linux and Windows build
+
+        * kjs/DateMath.cpp:
+        * kjs/DateMath.h:
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFunc::callAsFunction):
+
+2006-10-13  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Adam, Geoff, Darin.
+
+       Fixed displaying the UTC offset and time zone string, as well as renamed the GregorianDateTime structure and clean up. 
+
+        * ChangeLog:
+        * kjs/DateMath.cpp:
+        (KJS::getUTCOffset):
+        (KJS::getDSTOffsetSimple):
+        (KJS::gregorianDateTimeToMS):
+        (KJS::msToGregorianDateTime):
+        * kjs/DateMath.h:
+        (KJS::GregorianDateTime::GregorianDateTime):
+        (KJS::GregorianDateTime::~GregorianDateTime):
+        (KJS::GregorianDateTime::toTM):
+        * kjs/date_object.cpp:
+        (KJS::gmtoffset):
+        (KJS::formatDate):
+        (KJS::formatDateUTCVariant):
+        (KJS::formatTime):
+        (KJS::fillStructuresUsingTimeArgs):
+        (KJS::fillStructuresUsingDateArgs):
+        (KJS::DateInstance::getTime):
+        (KJS::DateInstance::getUTCTime):
+        (KJS::DateProtoFunc::callAsFunction):
+        (KJS::DateObjectImp::construct):
+        (KJS::DateObjectImp::callAsFunction):
+        (KJS::DateObjectFuncImp::callAsFunction):
+        (KJS::parseDate):
+        * kjs/date_object.h:
+
+2006-10-13  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Adam.
+
+        Gets JavaScripCore tests running on windows.
+
+        * Scripts/run-javascriptcore-tests:
+        * Scripts/webkitdirs.pm:
+
+2006-10-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        Removed JSObjectMakeWithPrototype, clarified some comments. We really
+        don't want people to manage their own prototypes, so we don't want an
+        extra function in the API devoted to just that. People can still manage
+        their own prototypes if they really want by using JSObjectSetPrototype.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::createNoAutomaticPrototype):
+        (OpaqueJSClass::create):
+        * API/JSClassRef.h:
+        * API/JSObjectRef.cpp:
+        (JSClassCreate):
+        (JSObjectMake):
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+
+2006-10-12  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Adam.
+
+        Build breakage fix
+
+        * kjs/DateMath.cpp:
+        (KJS::msToTM):
+        * kjs/date_object.cpp:
+        (KJS::gmtoffset):
+
+2006-10-11  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Geoff.
+
+        Added our own tm struct to have a consistent set of fields, which lets us display the DST offset and timezone strings correctly.  Also there is some code cleanup.
+
+        * kjs/DateMath.cpp:
+        (KJS::timeToMS):
+        (KJS::getUTCOffset):
+        (KJS::getDSTOffsetSimple):
+        (KJS::dateToMS):
+        (KJS::msToTM):
+        (KJS::tmToKJStm):
+        (KJS::KJStmToTm):
+        * kjs/DateMath.h:
+        * kjs/date_object.cpp: 
+        (KJS::gmtoffset): 
+        (KJS::formatTime): 
+        (KJS::DateProtoFunc::callAsFunction): 
+        (KJS::DateObjectImp::construct):
+        (KJS::DateObjectImp::callAsFunction):
+        (KJS::DateObjectFuncImp::callAsFunction):
+        (KJS::parseDate):
+        * kjs/date_object.h:
+
+2006-10-09  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by Geoff.
+
+        Improve gdk build compiler flags (show warning, no rtti and exceptions).
+
+        * jscore.bkl:
+
+2006-10-06  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Brady.
+
+        DST and TimeZones were wrong in some cases, specifically on some of the dates where DST changes.
+
+        * kjs/DateMath.cpp:
+        (KJS::equivalentYearForDST):
+        (KJS::getUTCOffset):
+        (KJS::getDSTOffsetSimple):
+        (KJS::getDSTOffset):
+        (KJS::dateToMseconds):
+        (KJS::msToTM):
+        * kjs/DateMath.h:
+        * kjs/date_object.cpp:
+        (KJS::gmtoffset):
+
+2006-10-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin McCullough.
+
+        * wtf/Assertions.cpp: Fix build when _DEBUG is not defined.
+
+2006-10-04  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Adam.
+
+        - Removed an unnecessary assert that was stopping many pages.  tm_gmtoff was not set for UTC time in mozilla but is always set for us.
+
+        * kjs/DateMath.cpp:
+        (KJS::getUTCOffset):
+        (KJS::msToTM):
+        * kjs/date_object.cpp:
+        (KJS::gmtoffset):
+        (KJS::formatTime):
+
+2006-10-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch by Darin and me, reviewed by Maciej.
+
+        Fixed <rdar://problem/4518397> REGRESSION(?): Oft-seen but unrepro crash 
+              in JavaScript garbage collection (KJS::Collector::collect())
+               <rdar://problem/4752492> Crash in KJS::collect
+              
+        The issue here was allocating one garbage-collected object in the midst 
+        of allocating a second garbage-collected object. In such a case, the
+        zeroIfFree word lies.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+        (KJS::Collector::collect):
+
+2006-10-04  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Adam.
+
+        - Layout test fix
+
+        * kjs/DateMath.cpp:
+        (KJS::dateToDayInYear): accept and correctly handle negative months
+
+2006-10-05  Kevin McCullough  <KMcCullough@apple.com>
+
+       build fix
+
+        * kjs/DateMath.cpp:
+        (KJS::dateToDayInYear):
+
+2006-10-05  Mark Rowe  <bdash@webkit.org>
+
+        Reviewed by maculloch.
+
+        Gdk build fix.
+
+        * JavaScriptCoreSources.bkl: Add DateMath.cpp to file list.
+
+2006-10-05  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by aroben
+
+        - build fix
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-10-04  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Mitz.
+
+        Fix Qt/Linux build by adding DateMath.cpp to compilation.
+
+        * CMakeLists.txt: Also replace tabs with spaces.
+
+2006-10-04  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by DethBakin.
+
+        - Apparently the build bot uses an older version of XCode which warns about conversions and the newest version does not.  I hope this fixes the build but I cann't be sure on my system.
+
+        * kjs/DateMath.cpp:
+        (KJS::msToYear):
+        (KJS::dayInYear):
+        (KJS::dateToDayInYear):
+
+2006-10-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam.
+
+        * wtf/Assertions.cpp: Changed assertion formatting to omit the "======"
+        lines so you can see more assertions in less space. Also improved format
+        of file/line information so it works with more development environments.
+
+2006-10-04  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Tim H.
+
+        - The build machine is more sensitive about automatic conversions.  These fixes exp
+licitly cast or change the input and return types of functions to avoid conversions.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/DateMath.cpp:
+        (KJS::):
+        (KJS::msToDays):
+        (KJS::msToYear):
+        (KJS::dayInYear):
+        (KJS::monthToDayInYear):
+        (KJS::dateToDayInYear):
+        (KJS::getDSTOffsetSimple):
+        (KJS::getDSTOffset):
+        (KJS::dateToMseconds):
+        (KJS::msToTM):
+
+2006-10-04  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by GGaren
+
+        - This is a big makeover for our Date implemenetation.  This solves many platform specific issues, specifically dates before 1970, and simplifies some ugly code.  The purpose of this was to get us to pass many of the JavaScriptCore tests on windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/DateMath.cpp: Added.
+        (KJS::):
+        (KJS::daysInYear):
+        (KJS::daysFrom1970ToYear):
+        (KJS::msFrom1970ToYear):
+        (KJS::msToDays):
+        (KJS::msToYear):
+        (KJS::isLeapYear):
+        (KJS::isInLeapYear):
+        (KJS::dayInYear):
+        (KJS::msToMilliseconds):
+        (KJS::msToWeekDay):
+        (KJS::msToSeconds):
+        (KJS::msToMinutes):
+        (KJS::msToHours):
+        (KJS::msToMonth):
+        (KJS::msToDayInMonth):
+        (KJS::monthToDayInYear):
+        (KJS::timeToMseconds):
+        (KJS::dateToDayInYear):
+        (KJS::equivalentYearForDST):
+        (KJS::getUTCOffset):
+        (KJS::getDSTOffsetSimple):
+        (KJS::getDSTOffset):
+        (KJS::localTimeToUTC):
+        (KJS::UTCToLocalTime):
+        (KJS::dateToMseconds):
+        (KJS::msToTM):
+        (KJS::isDST):
+        * kjs/DateMath.h: Added.
+        (KJS::):
+        * kjs/date_object.cpp:
+        (KJS::gmtoffset):
+        (KJS::formatTime):
+        (KJS::DateInstance::getTime):
+        (KJS::DateInstance::getUTCTime):
+        (KJS::DateProtoFunc::callAsFunction):
+        (KJS::DateObjectImp::construct):
+        (KJS::DateObjectFuncImp::callAsFunction):
+        (KJS::parseDate):
+        * kjs/testkjs.cpp:
+        * os-win32/stdint.h:
+
+2006-10-02  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed/landed by Adam.
+
+        Build testkjs on Qt/Linux.
+
+        * CMakeLists.txt:
+
+2006-10-02  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by eseidel.  Landed by eseidel.
+
+        Fix win32 build, which has no inttypes.h
+
+        * wtf/Assertions.h:
+
+2006-10-02  Nikolas Zimmermann <zimmermann@kde.org>
+
+        Reviewed by eseidel & mjs.  Landed by eseidel.
+
+        Fix Qt/Linux build with older gcc 3.3.4.
+        http://bugs.webkit.org/show_bug.cgi?id=11116
+ 
+        * kjs/lookup.h: Move cacheGlobalObject into KJS namespace.
+        (KJS::cacheGlobalObject): Also remove GCC_ROOT_NS_HACK.
+        * wtf/Assertions.h: Include inttypes.h for uintptr_t.
+
+2006-09-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Maciej.
+        
+        Use $(ConfigSuffix) set via vsprops files to add _debug
+        to end of debug filenames.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/debug.vsprops: Added.
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
+        * JavaScriptCore.vcproj/release.vsprops: Added.
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2006-09-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alice.
+
+        - support for change that should fix <rdar://problem/4733044>
+          REGRESSION: XML iBench shows 10% perf. regression (copying
+          strings while decoding)
+
+        * wtf/Vector.h: Changed VectorBuffer so that the general case
+        contains an instance of the 0 case, since deriving from it
+        was violating the Liskov Substitution Principle.
+        (WTF::VectorBuffer::releaseBuffer): Added. Releases the buffer so it can
+        be adopted by another data structure that uses the FastMalloc.h allocator.
+        Returns 0 if the internal buffer was being used.
+        (WTF::Vector::releaseBuffer): Added. Releases the buffer as above or creates
+        a new one in the case where the internal buffer was being used.
+
+2006-09-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - change garbage collection to happen at increments proportional to number of live objects, not always
+        every 1000 allocations
+
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+
+2006-09-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mitz.
+
+        - fixed REGRESSION (r16606): javascriptCore Crash on website load
+        
+        Plus style fixes.
+        
+            - fixed some possible off-by-one bugs
+            - use indexing, not iterators, for Vectors
+            - store Vector by pointer instead of by value to avoid blowing out FunctionImp size
+        
+        * kjs/function.cpp:
+        (KJS::FunctionImp::addParameter):
+        (KJS::FunctionImp::parameterString):
+        (KJS::FunctionImp::processParameters):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::FunctionImp::getParameterName):
+        * kjs/function.h:
+
+2006-09-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Maciej.
+        
+        More build tweaks
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/dstroot-to-sdk.cmd: Removed.
+
+2006-09-27  John Sullivan  <sullivan@apple.com>
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::getParameterName):
+        removed assertion that displeased gcc 4.0.1 (build 5420):
+        ASSERT(static_cast<size_t>(index) == index);
+
+2006-09-27  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by GGaren.
+
+        Cleanup of previous fix which was to address Radar: 4752492
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::addParameter):
+        (KJS::FunctionImp::parameterString):
+        (KJS::FunctionImp::processParameters):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::FunctionImp::getParameterName):
+        * kjs/function.h:
+
+2006-09-27  Kevin McCullough  <KMcCullough@apple.com>
+
+        Reviewed by Adele.
+
+        Fixes a GC stack overflow crash.
+        The change is to move from a linked list implementation of Parameters to a Vector.
+        The problem with the linked list is that each one creates it's own stack frame when being destroyed and in extreme cases this caused the stack to overflow. 
+
+        * kjs/function.cpp:
+        (KJS::Parameter::Parameter):
+        (KJS::FunctionImp::addParameter):
+        (KJS::FunctionImp::parameterString):
+        (KJS::FunctionImp::processParameters):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::FunctionImp::getParameterName):
+        * kjs/function.h:
+
+2006-09-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix last path fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2006-09-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Set path before build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2006-09-27  Sean Gies  <seangies@apple.com>
+
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Debug config should link to debug runtime.
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj: Debug config should link to debug runtime.
+
+2006-09-27  Don Melton  <gramps@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Changed line ending from DOS to UNIX format so it doesn't die running
+        on my machine. ;)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+
+2006-09-23  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Maciej.
+
+        http://bugs.webkit.org/show_bug.cgi?id=10183
+        REGRESSION: obfuscated JS decoding breaks because of soft hyphen removal
+        (Fanfiction.net author pages not listing stories)
+
+        Rolled out the fix for bug 4139.
+
+        * kjs/lexer.cpp:
+        (Lexer::setCode):
+        (Lexer::shift):
+        * tests/mozilla/ecma/Array/15.4.5.1-1.js:
+        * tests/mozilla/expected.html:
+
+2006-09-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2006-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alice.
+
+        * wtf/Vector.h: Add an append that takes a pointer and length.
+        Generalize the existing Vector append to work on vectors with
+        any value for inlineCapacity. Change the append algorithm so
+        it doesn't check capacity each time through the loop.
+
+2006-09-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix release build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2006-09-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Updated to include the right path.
+        * wtf/FastMalloc.h: #include Platform.h, since we use Platform macros.
+
+=== Safari-521.27 ===
+
+2006-09-20  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        * wtf/MathExtras.h:
+        Get rid of lrint.
+
+2006-09-20  Sean Gies  <seangies@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        * wtf/Assertions.cpp: Debug messages should go into debugger console.
+
+2006-09-20  David Hyatt  <hyatt@apple.com>
+
+        Add an implementation of lrint for Win32.
+
+        Reviewed by anders
+
+        * wtf/MathExtras.h:
+        (lrint):
+
+2006-09-15  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by Adam.
+
+        http://bugs.webkit.org/show_bug.cgi?id=10864
+        Bug 10864: Linux\GDK build fixes
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2006-09-15  Adam Roben  <aroben@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+
+2006-09-15  Anders Carlsson  <acarlsson@apple.com>
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Fix the release build.
+
+2006-09-15  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Steve.
+
+        Add JavaScriptCore API to the build.
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObject.cpp:
+        * API/JSClassRef.cpp:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSStringRef.cpp:
+        * API/JSValueRef.cpp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * os-win32/stdbool.h: Added.
+
+2006-09-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Ada.
+        
+        Build tweaks (doing JavaScriptCore now since it doesn't have
+        dependencies).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * JavaScriptCore.vcproj/JavaScriptCore/dstroot-to-sdk.cmd: Added.
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2006-09-11  Brady Eidson  <beidson@apple.com>
+
+        Build fix - I think Tim's last checkin wasn't tested on Tiger, possibly.  I simply
+        commented out the undefined constants until he can have a chance to make the right call
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::objcValueTypeForType): Commented out undefined symbols
+
+2006-09-11  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Tim O. and Darin.
+
+        Add support for more method signatures affecting ObjC methods called from JavaScript:
+        - Added unsigned types and long long.
+        - Allow methods that use const, oneway, bycopy and byref type modifiers.
+
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        * bindings/objc/objc_utility.h:
+        (KJS::Bindings::):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+        (KJS::Bindings::objcValueTypeForType):
+
+2006-09-05  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Tim O.
+
+        <rdar://problem/4715840> SEL is not char*
+
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::methodsNamed): use sel_getName instead of a char* cast.
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::callAsFunction): ditto
+
+2006-09-03  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Tim H.
+
+        http://bugs.webkit.org/show_bug.cgi?id=10693
+        Convert JavaScript arrays to AppleScript lists
+
+        * JavaScriptCore.exp: Export ArrayInstance::info and ArrayInstance::getItem().
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstance::getItem): Added a method to access array items from C++.
+
+2006-09-02  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed by Tim H.
+
+        Bug 10454: Unix bakefile fixes
+        http://bugs.webkit.org/show_bug.cgi?id=10454
+
+        * JavaScriptCoreSources.bkl:
+
+2006-09-01  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by hyatt.  Landed by eseidel.
+
+        Fix build on Linux.
+
+        * pcre/CMakeLists.txt: Add wtf/ include.
+
+2006-09-01  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed and landed by ap.
+
+        Fix build on Linux (C89 without gcc extensions enabled).
+
+        * pcre/pcre_internal.h: Use C style comments.
+        * wtf/Assertions.h: Use C style comments.
+        * wtf/Platform.h: Use C style comments.
+
+2006-09-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
+
+2006-08-31  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+        
+        Add new portability functions to MathExtras.h and add StringExtras.h which is for
+        string portability functions.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * bindings/c/c_instance.cpp:
+        * kjs/date_object.cpp:
+        * wtf/MathExtras.h:
+        (copysign):
+        (isfinite):
+        * wtf/StringExtras.h: Added.
+        (snprintf):
+        (strncasecmp):
+
+2006-08-31  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Tim H.
+        
+        Fix Windows build.
+        
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
+        * pcre/pcre_internal.h:
+
+2006-08-31  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Geoff.
+
+        Band-aid fix for PCRE to compile for ppc64 and x86_64 now that
+        we use -Wshorten-64-to-32. Adds an INT_CAST macro that ASSERTs
+        the value <= INT_MAX.
+
+        I filed <rdar://problem/4712064> to track the need to verify
+        PCRE's 64-bit compliance.
+
+        * pcre/pcre_compile.c:
+        (complete_callout):
+        (compile_branch):
+        (compile_regex):
+        (pcre_compile2):
+        * pcre/pcre_exec.c:
+        (match):
+        (pcre_exec):
+        * pcre/pcre_get.c:
+        (pcre_get_substring_list):
+        * pcre/pcre_internal.h:
+        * pcre/pcre_tables.c:
+        * pcre/pcre_try_flipped.c:
+        (_pcre_try_flipped):
+
+2006-08-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - add WTF::getPtr, a function template that makes it possible to write
+          generic code that gets a raw pointer out of any of our pointer types
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/GetPtr.h: Added.
+        * wtf/ListRefPtr.h: (WTF::getPtr): Added.
+        * wtf/OwnArrayPtr.h: (WTF::getPtr): Added.
+        * wtf/OwnPtr.h: (WTF::getPtr): Added.
+        * wtf/PassRefPtr.h: (WTF::getPtr): Added.
+        * wtf/RefPtr.h: (WTF::getPtr): Added.
+
+2006-08-29  waylonis  <waylonis@google.com>
+
+        Reviewed, tweaked by ggaren.
+
+        - Added storage and accessor functions for ExecState as a fix for
+          http://bugs.webkit.org/show_bug.cgi?id=10114
+        
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        * kjs/ExecState.h:
+        * kjs/context.h:
+        (KJS::Context::setExecState):
+        (KJS::Context::execState):
+
+2006-08-30  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Tim H.
+
+        Commit KDE related tweaks, to be able to
+        differentiate between a Qt-only or a KDE build.
+
+        * CMakeLists.txt: Install wtf-unity library.
+        * wtf/Platform.h: Add define for the KDE platform.
+
+2006-08-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        * kjs/list.h: Use explicit in constructor (as appropriate).
+
+2006-08-24  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed, tweaked and landed by ap
+
+        http://bugs.webkit.org/show_bug.cgi?id=10467
+        WebKit should have Qt platform support (Part II)
+
+        * CMakeLists.txt: Adjust to Anders' build fixes.
+        * wtf/Platform.h: Fix define for the Qt platform (we don't use/need Cairo.)
+
+2006-08-23  David Hyatt  <hyatt@apple.com>
+
+        Fix Platform.h to include #defines for graphics features.
+
+        Reviewed by darin
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * wtf/Platform.h:
+
+2006-08-23  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+
+        Make the bindings compile without CoreFoundation.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * bindings/c/c_instance.cpp:
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertUTF8ToUTF16):
+        * bindings/npapi.h:
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createBindingForLanguageInstance):
+        (KJS::Bindings::Instance::createLanguageInstanceForValue):
+        * bindings/runtime_root.cpp:
+        * bindings/runtime_root.h:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::createLanguageInstanceForValue):
+        * kjs/interpreter.h:
+
+2006-08-22  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+
+        Move the npruntime code over to using HashMap and the runtime_root code over to using 
+        HashMap and HashCountedSet.
+        
+        * bindings/NP_jsobject.cpp:
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::identifierFromNPIdentifier):
+        * bindings/c/c_utility.h:
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::invoke):
+        * bindings/npruntime.cpp:
+        (getStringIdentifierMap):
+        (getIntIdentifierMap):
+        (_NPN_GetStringIdentifier):
+        (_NPN_GetIntIdentifier):
+        * bindings/runtime_root.cpp:
+        (getReferencesByRootMap):
+        (getReferencesSet):
+        (KJS::Bindings::findReferenceSet):
+        (KJS::Bindings::rootForImp):
+        (KJS::Bindings::rootForInterpreter):
+        (KJS::Bindings::addNativeReference):
+        (KJS::Bindings::removeNativeReference):
+        (RootObject::removeAllNativeReferences):
+        * bindings/runtime_root.h:
+
+2006-08-22  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+        
+        Switch over the NPAPI and Java bindings to using HashMaps instead of dictionaries.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/c/c_class.cpp:
+        (KJS::Bindings::CClass::CClass):
+        (KJS::Bindings::CClass::~CClass):
+        (KJS::Bindings::CClass::classForIsA):
+        (KJS::Bindings::CClass::methodsNamed):
+        (KJS::Bindings::CClass::fieldNamed):
+        * bindings/c/c_class.h:
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        (JavaClass::methodsNamed):
+        (JavaClass::fieldNamed):
+        * bindings/jni/jni_class.h:
+        * bindings/objc/objc_class.h:
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::deleteMethod):
+        (KJS::Bindings::deleteField):
+        (KJS::Bindings::):
+        (KJS::Bindings::ObjcClass::methodsNamed):
+        (KJS::Bindings::ObjcClass::fieldNamed):
+        * bindings/runtime.cpp:
+        * bindings/runtime.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::getOwnPropertySlot):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+
+2006-08-21  Vladimir Olexa  <vladimir.olexa@gmail.com>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=6252
+        JavaScript 1.6 Array.lastIndexOf
+
+        Test: fast/js/array-lastIndexOf.html
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction): Added a LastIndexOf case.
+        * kjs/array_object.h:
+        (KJS::ArrayProtoFunc::): Added LastIndexOf to enum.
+        * tests/mozilla/expected.html: Two more tests now pass.
+
+2006-08-20  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Maciej. Landed by rwlbuis.
+
+        Fixes parts of: http://bugs.webkit.org/show_bug.cgi?id=10463
+        WebKit should have Qt platform support
+
+        Removing obsolete QConstString/QString constructors in kjs code.
+
+        * kjs/identifier.h:
+        * kjs/ustring.h:
+
+2006-08-17  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Maciej. Landed by rwlbuis.
+
+        Fixes: http://bugs.webkit.org/show_bug.cgi?id=10463
+        WTF Changes needed for Qt platform code.
+
+        * wtf/Platform.h:
+        * wtf/unicode/UnicodeDecomposition.h: Added.
+        (WTF::Unicode::):
+        * wtf/unicode/UnicodeDirection.h: Added.
+        (WTF::Unicode::):
+        * wtf/unicode/qt4/UnicodeQt4.cpp: Added.
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+        (WTF::Unicode::decomposition):
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::compare):
+
+2006-08-17  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric. Landed by rwlbuis.
+
+        Fixes: http://bugs.webkit.org/show_bug.cgi?id=10464
+        Offer a cmake build system for Qt platform.
+
+        * CMakeLists.txt: Added.
+        * pcre/CMakeLists.txt: Added.
+
+2006-08-17  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Maciej.
+
+        * bindings/npapi.h:
+        Fix ifdef.
+
+2006-08-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by mjs.
+        
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * wtf/Assertions.h:
+
+2006-08-15  Mark Rowe  <opendarwin.org@bdash.net.nz>
+
+        Reviewed by Tim H.
+
+        Build fix:  DWARF and -gfull are incompatible with symbol separation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-08-15  Mark Rowe  <opendarwin.org@bdash.net.nz>
+
+        Reviewed by Tim H.
+
+        http://bugs.webkit.org/show_bug.cgi?id=10394
+        Bug 10394: WebKit Release and Production configurations should enable dead code stripping
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-08-15  Mark Rowe  <opendarwin.org@bdash.net.nz>
+
+        Reviewed by Tim H.
+
+        http://bugs.webkit.org/show_bug.cgi?id=10384
+        Bug 10384: Switch to DWARF for Release configuration
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-08-13  Maks Orlovich  <maksim@kde.org>
+
+        Reviewed (and tweaked a little) by Maciej.
+        
+        - shrank the size of JSObject by 8 bytes and made the corresponding reduction to the cell size, resulting
+        in a 1.2% speed improvement on JS iBench (and probably overall memory savings).
+
+        This was done by removing _scope and _internalValue data members
+        from JSObject and moving them only to the subclasses that actually
+        make use of them.
+        
+        * kjs/object.cpp: 
+        (KJS::JSObject::mark): No need to mark scope or internal value here.
+        * kjs/object.h:
+        (KJS::JSObject::JSObject): Don't initialize them.
+        * kjs/JSWrapperObject.cpp: Added. New base class for object types that
+        wrap primitive values (Number, String, Boolean, Date).
+        (KJS::JSWrapperObject::mark): 
+        * kjs/JSWrapperObject.h: Added.
+        (KJS::JSWrapperObject::JSWrapperObject):
+        (KJS::JSWrapperObject::internalValue):
+        (KJS::JSWrapperObject::setInternalValue):
+        * kjs/array_object.cpp:
+        (ArrayPrototype::ArrayPrototype): Don't set useless internal value.
+        * kjs/bool_object.cpp:
+        (BooleanInstance::BooleanInstance): Inherit from JSWrapperObject.
+        (BooleanProtoFunc::callAsFunction): Fixed to account for fact that not all
+        JSObjects have an internal value.
+        (BooleanObjectImp::construct): ditto.
+        * kjs/bool_object.h:
+        * kjs/collector.cpp: Lowered cell size to 48.
+        (KJS::Collector::allocate): meaningless whitespace change
+        * kjs/date_object.cpp:
+        (KJS::DateInstance::DateInstance): Inherit from JSWrapperObject.
+        (KJS::DateProtoFunc::callAsFunction): adjusted for move of internalValue
+        (KJS::DateObjectImp::construct): ditto
+        * kjs/date_object.h:
+        * kjs/error_object.cpp:
+        (ErrorPrototype::ErrorPrototype): don't set internal value
+        * kjs/function.cpp: move _scope and related handling here
+        (KJS::FunctionImp::mark): mark scope
+        * kjs/function.h:
+        (KJS::FunctionImp::scope): moved here from JSObject
+        (KJS::FunctionImp::setScope): ditto
+        * kjs/number_object.cpp:
+        (NumberInstance::NumberInstance): inherit from JSWrapperObject
+        (NumberProtoFunc::callAsFunction): adjusted
+        (NumberObjectImp::construct): adjusted
+        * kjs/number_object.h: shring RegExp-related objects a little
+        * kjs/regexp_object.cpp:
+        (RegExpPrototype::RegExpPrototype): Adjust for size tweaks
+        (RegExpObjectImp::RegExpObjectImp): ditto
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (StringInstance::StringInstance): inherit from JSWrapperObject
+        (StringProtoFunc::callAsFunction): adjusted
+        * kjs/string_object.h:
+        * JavaScriptCore.exp: Exported new methods as needed.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new files to build.
+
+2006-08-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Geoff's rubber stamp
+
+        Fix a build break on Intel hardware causes by adapting stricter
+        compiler warnings (-Wshorten-64-to-32)
+
+        * API/testapi.c:
+        (assertEqualsAsNumber): manually cast some doubles to floats
+        (main): ditto
+
+2006-08-04  Sam Weinig  <sam.weinig@gmail.com>
+
+        Reviewed by Darin.
+
+        - patch for http://bugs.webkit.org/show_bug.cgi?id=10192
+          Make WebCore (and friends) compile with -Wshorten-64-to-32
+
+          * Adds -Wshorten-64-to-32 flag to Xcode project.
+          * Adds explicit casts where OK.
+
+        * API/JSNodeList.c:
+        (JSNodeList_item):
+        (JSNodeList_getProperty):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-08-04  Adam Roben  <aroben@apple.com>
+
+        Reviewed by Anders.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Convert
+        spaces to tabs
+
+2006-08-03  Sam Weinig  <sam.weinig@gmail.com>
+
+        Reviewed by Darin.
+
+        - patch for http://bugs.webkit.org/show_bug.cgi?id=10176
+          Make WebCore compile with -Wundef
+
+          * Adds -Wundef flag to Xcode project
+          * Converts #ifs to #ifdef and #ifndefs where needed.
+          * Added #define YYMAXDEPTH 10000 in kjs/grammar.y
+            to fix a warning from within Bison.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        * bindings/npapi.h:
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::methodsNamed):
+        (KJS::Bindings::ObjcClass::fieldNamed):
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcMethod::getMethodSignature):
+        (ObjcField::name):
+        (ObjcField::type):
+        * kjs/grammar.y:
+        * kjs/identifier.h:
+
+2006-08-03  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by John Sullivan.
+
+       * wtf/HashSet.h:
+        (WTF::::operator):
+        Return *this in operator=
+
+2006-08-03  Adam Roben  <aroben@apple.com>
+
+        Reviewed by Anders.
+
+        - Fixed Windows build
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * wtf/MathExtras.h: Implement inline versions of these functions
+        (nextafter):
+        (nextafterf):
+
+2006-08-02  Adam Roben  <aroben@apple.com>
+
+        Reviewed by Darin.
+
+        - Fixed build
+
+        * kjs/date_object.cpp:
+        (KJS::formatTime):
+
+2006-07-29  Darin Adler  <darin@apple.com>
+
+        - Removed tabs from these source files that still had them.
+          We don't use them; that way source files look fine in editors
+          that have tabs set to 8 spaces or to 4 spaces.
+        - Removed allow-tabs Subversion property from the files too.
+
+        * bindings/NP_jsobject.cpp:
+        * bindings/c/c_utility.cpp:
+        * bindings/jni/jni_runtime.cpp:
+        * bindings/jni/jni_utility.cpp:
+        * bindings/objc/objc_utility.mm:
+        * bindings/runtime.cpp:
+        * bindings/runtime_method.cpp:
+        * bindings/testbindings.cpp:
+        * bindings/testbindings.mm:
+        * kjs/date_object.cpp:
+        * kjs/function.cpp:
+        * kjs/list.cpp:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/string_object.cpp:
+        * kjs/ustring.cpp:
+
+2006-07-29  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/expected.html: Update test results now that regress-185165.js
+        is succeeding. I suspect Anders fix for bug 4620655 is the reason.
+
+2006-07-29  Sam Weinig  <sam.weinig@gmail.com>
+
+        Reviewed by Darin.
+
+        - patch for http://bugs.webkit.org/show_bug.cgi?id=10080
+          Adopt pedantic changes from the Unity project to improve 
+          cross-compiler compatibility
+
+          Changes include:
+          * Removing trailing semicolon from namespace braces.
+          * Removing trailing comma from last enum declaration.
+          * Updating to match style guidelines.
+          * Adding missing newline to the end of the file.
+          * Turning on gcc warning for missing newline at the end of a source file
+            (GCC_WARN_ABOUT_MISSING_NEWLINE in Xcode, -Wnewline in gcc).
+          * Alphabetical sorting of Xcode source list files. 
+          * Replace use of non-portable variable-size array with Vector.
+          * Use C-style comments instead of C++ comments in files that might
+            be included by either C or C++ files.
+
+        * API/JSCallbackConstructor.cpp:
+        (KJS::JSCallbackConstructor::construct):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::callAsFunction):
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::construct):
+        (KJS::JSCallbackObject::callAsFunction):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCorePrefix.h:
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::fieldNamed):
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::JavaInstance):
+        (JavaInstance::valueOf):
+        * bindings/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaParameter::JavaParameter):
+        (JavaArray::JavaArray):
+        * bindings/jni/jni_runtime.h:
+        * bindings/jni/jni_utility.h:
+        * bindings/objc/objc_instance.h:
+        * bindings/runtime_array.h:
+        * kjs/collector.h:
+        * kjs/config.h:
+        * kjs/ustring.cpp:
+        * wtf/Platform.h:
+
+2006-07-29  Mike Emmel  <mike.emmel@gmail.com>
+
+        Reviewed by Darin.
+
+        - fixes for Linux build
+
+        * JavaScriptCoreSources.bkl: Added new files to build, kjs/PropertyNameArray.cpp
+        and kjs/testkjs.cpp, and removed old files.
+
+2006-07-24  Dan Waylonis  <waylonis@google.com>
+
+        Reviewed and tweaked a bit by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=9902
+          jsNull and NSNull not properly converted between JS and ObjC
+
+        * bindings/objc/objc_utility.mm: (KJS::Bindings::convertObjcValueToValue):
+        Added case for converting NSNull to jsNull.
+
+2006-07-24  Rob Buis  <buis@kde.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=4258
+        Date().toString() only includes GMT offset, not timezone string
+
+        Use the info in tm_zone to append timezone abbreviation
+        to Date().toString().
+
+        * kjs/date_object.cpp:
+        (KJS::formatTime):
+
+2006-07-24  Rob Buis  <buis@kde.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=5257
+        setYear() does not match FireFox/IE behavior
+
+        Make sure the right values end up in tm_year.
+
+        * kjs/date_object.cpp:
+        (KJS::formatTime):
+
+2006-07-23  Mark Rowe  <opendarwin.org@bdash.net.nz>
+
+        Reviewed by Maciej.
+
+        Bug 9686: [Drosera] Need the ability to break into Drosera on Javascript exceptions
+        http://bugs.webkit.org/show_bug.cgi?id=9686
+
+        JavaScriptCore portion of the fix.
+
+        * JavaScriptCore.exp: Update symbol for change in argument type.
+        * kjs/debugger.cpp:
+        (Debugger::detach): Clear map of recent exceptions.
+        (Debugger::hasHandledException): Track the most recent exception
+        thrown by an interpreter.
+        (Debugger::exception): Change exception argument to a JSValue.
+        * kjs/debugger.h:
+        * kjs/nodes.cpp:
+        (Node::debugExceptionIfNeeded): Notify the debugger of an exception
+        if it hasn't seen it before.
+        (ThrowNode::execute): Notify the debugger that an exception is being thrown.
+        * kjs/nodes.h:
+
+    2006-07-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch by Eric Albert, reviewed by Darin and me.
+        
+        - Fixed <rdar://problem/4645931> JavaScriptCore stack-scanning code 
+        crashes (Collector::markStackObjectsConservatively)
+        
+        * bindings/jni/jni_jsobject.cpp: On 64bit systems, jint is a long, not an
+        int.
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        * kjs/collector.cpp:
+        (KJS::Collector::markCurrentThreadConservatively): Use a pointer instead of
+        an int as 'dummy,' because on LP64 systems, an int is not pointer-aligned,
+        and we want to scan the stack for pointers.
+        * JavaScriptCore.xcodeproj/project.pbxproj: After a tense cease-fire, the 
+        XCode war has started up again!
+
+=== Safari-521.20 ===
+
+2006-07-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/4507265> REGRESSION: overlays don't work on HousingMaps.com (Google Maps-based site)
+
+        - Added support for strings that masquerade as undefined. Currently used
+        by WebCore to implement undetectable style.filter.
+        
+        The name is a little long, but it's only used in one line of code, so I
+        thought clarity should win over brevity.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/object.h:
+        * kjs/string_object.h:
+        (KJS::StringInstanceThatMasqueradesAsUndefined::StringInstanceThatMasqueradesAsUndefined):
+        (KJS::StringInstanceThatMasqueradesAsUndefined::masqueradeAsUndefined):
+        (KJS::StringInstanceThatMasqueradesAsUndefined::toBoolean):
+
+=== Safari-521.19 ===
+
+2006-07-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix the build
+
+        * kjs/function.cpp:
+        (KJS::escapeStringForPrettyPrinting):
+
+2006-07-19  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/4620655> REGRESSION(10.4.7-10.5): preview button for a blogger.com post doesn't work
+        
+        * kjs/nodes2string.cpp:
+        (StringNode::streamTo):
+        Return the escaped string.
+        
+        (RegExpNode::streamTo):
+        Use the correct syntax.
+        
+        * kjs/function.cpp:
+        (KJS::escapeStringForPrettyPrinting):
+        * kjs/function.h:
+        Add escape function which escapes a string for pretty-printing so it can be parsed again.
+        
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isPrintableChar):
+        New function.
+
+2006-07-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adele Peterson.
+        
+        <rdar://problem/4589530> REGRESSION: null character in JS string causes parse error (works in Tiger and in other browsers)
+
+        * kjs/lexer.cpp:
+        (Lexer::shift):
+        (Lexer::lex):
+        (Lexer::record16):
+        (Lexer::scanRegExp):
+        * kjs/lexer.h:
+
+2006-07-18  Tim Omernick  <timo@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Removed a misleading comment; we recently added support for the NPNVPluginElementNPObject
+        variable.
+
+        * bindings/npapi.h:
+
+=== Safari-521.18 ===
+
+2006-07-18  Timothy Hatcher  <timothy@apple.com>
+
+        Made the following headers public:
+
+        * JavaScriptCore.h
+        * JSBase.h
+        * JSContextRef.h
+        * JSObjectRef.h
+        * JSStringRef.h
+        * JSValueRef.h
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Added automatic prototype creation for classes.
+        
+        A class stores a weak reference to a prototype, which is cleared when
+        the prototype is garbage collected, to avoid a reference cycle.
+        
+        We now have an attributes field in JSClassDefinition, that currently is
+        used only to override automatic prototype creation when you want to manage your
+        own prototypes, but can be extended in the future for other nefarious purposes.
+        
+        Similarly, we have JSObjectMake and JSObjectMakeWithPrototype, the latter
+        allowing you to manage your own prototypes.
+        
+        JSObjectMakeConstructor is more interesting now, able to make a constructor
+        on your behalf if you just give it a class.
+        
+        - Removed bogus old code from minidom.js.
+        
+        - Tweaked the headerdocs.
+        
+        - Added more GC testing, which caught some leaks, and tested more funny 
+        edge cases in lookup, which caught a lookup bug. Removed some testing 
+        we used to do with MyObject because it was redundant with the new, cool 
+        stuff.
+        
+        While fixing the lookup bug I retracted this change:
+        
+            "If a static setProperty callback returns 'false', to indicate that the
+            property was not set, we no longer forward the set request up the class
+            chain, because that's almost certainly not what the programmer expected."
+
+        Returning false when setting a static property is a little silly, but you can see
+        it being useful when shadowing a base class's static properties, and, regardless
+        of usefullness, this is the defined behavior of the setProperty callback.
+        
+        - Plus a little ASCII art, for the kids.
+
+2006-07-17  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Maciej.
+
+        <rdar://problem/4634874> WebScriptObject and WebUndefined are no longer defined by WebKit
+
+        Moves WebScriptObject and WebUndefined up to WebCore.
+        This change does create an upwards-dependancy on WebScriptObject existing
+        in the loaded process, but this code path in JavaScriptCore does not get used
+        unless it is through WebKit/WebCore. Moving all of the binding code out of
+        JavaScriptCore might make sense in the future.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/objc/WebScriptObject.h: Replaced.
+        * bindings/objc/WebScriptObject.mm: Removed.
+        * bindings/objc/WebScriptObjectPrivate.h: Removed.
+        * bindings/objc/objc_class.h:
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::~ObjcInstance):
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (convertValueToObjcObject):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+        (KJS::Bindings::createObjcInstanceForValue):
+
+2006-07-17  Darin Adler  <darin@apple.com>
+
+        * API/JSBase.h: Fix comment formatting where things used to be lined up but
+        are now ragged. Got rid of spaces that attempted to line things up.
+        * API/JSObjectRef.h: Ditto. Also add missing periods for a couple of comments.
+
+2006-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Removed the exception parameter from the initialize callback and, by extension,
+        JSObjectMake. We have never had a need for exceptions when iniitializing,
+        so the parameter seemed likely to "get in the way." 
+        
+        Also, an exception in JavaScript is thrown in response to input -- 
+        "invalid URL", "index not a number", etc., so it's the job of the 
+        constructor function, not the initialize method, to throw.
+        
+        If initialize *really* wants to throw, it can communicate the throw to
+        the constructor through the constructed object's private data (e.g., set
+        it to NULL, signaling to the consntructor that initialization failed.)
+        
+        - Added JSObjectMakeWithData, which enables a constructor to set private
+        data on an object *before* it has been initialized. That way, the initialize
+        methods can properly operate on the data. 
+
+        * API/JSNode.c: Moved ref into the initialize method, for better encapsulation,
+        now that it's possible.
+        * API/JSNodeList.c: ditto
+        * API/minidom.c:
+        (main): Do more aggressive garbage collection to test ref/deref and 
+        initialize/finalize.
+        * API/minidom.js: store childNodes in a temporary so it doesn't get re-created
+        like a thousand times. This makes debugging ref/deref easier
+
+2006-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Changed the initialize callback to run from least derived class (parent
+        class) to most derived class. This enables C++ style initialization,
+        and derived class overriding of member data.
+        
+        - Added excpetion propopgation to JSObjectMake, to support initialize
+        exceptions, and generally round out our policy of making function
+        signatures as long as possible.
+
+        * API/JSCallbackObject.h: Use ExecState instead of ContextRef, cuz we're
+        in C++ land now.
+
+2006-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Changed JSObjectMakeConstructor to JSObjectMakeConstructorWithCallback,
+        to match JSObjectMakeFunctionWithCallback.
+        
+        - Added prototype parameter, so the generated constructor
+        automatically works with hasInstance / instanceof
+        
+        - Moved hasInstance implementation from InternalFunctionImp to JSObject
+        so that subclasses can inherit it without inheriting function-related baggage.
+        More refactoring here would be good, but this seems like a good short-term
+        solution.
+
+        (KJS::JSCallbackFunction::implementsHasInstance): override and return false,
+        because callback functions aren't constructors.
+
+2006-07-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - add a JSContextRef parameter to all JSValueRef, JSObjectRef, and JSContextRef operations;
+        except JSObject{Get,Set}PrivateData which can be assumed to be simple pure accessors.
+        
+        Also renamed the parameter "context" to "ctx" because it makes the code read better with this pervasive
+        but usually uninteresting parameter.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        * API/JSBase.h:
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::JSCallbackObject):
+        (KJS::JSCallbackObject::init):
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::toNumber):
+        (KJS::JSCallbackObject::toString):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        (JSGlobalContextRetain):
+        (JSGlobalContextRelease):
+        (JSContextGetGlobalObject):
+        * API/JSContextRef.h:
+        * API/JSNode.c:
+        (JSNodePrototype_appendChild):
+        (JSNodePrototype_removeChild):
+        (JSNodePrototype_replaceChild):
+        (JSNode_getNodeType):
+        (JSNode_getFirstChild):
+        (JSNode_prototype):
+        * API/JSNodeList.c:
+        (JSNodeListPrototype_item):
+        (JSNodeList_length):
+        (JSNodeList_getProperty):
+        (JSNodeList_prototype):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        (JSObjectIsConstructor):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        * API/JSObjectRef.h:
+        * API/JSStringRef.cpp:
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/JSValueRef.h:
+        * API/minidom.c:
+        (print):
+        * API/testapi.c:
+        (MyObject_getProperty):
+        (MyObject_deleteProperty):
+        (MyObject_callAsFunction):
+        (MyObject_callAsConstructor):
+        (MyObject_convertToType):
+        (print_callAsFunction):
+        (main):
+
+2006-07-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Approved by Maciej, RS by Beth.
+        
+        JSObjectMakeFunction -> JSObjectMakeFunctionWithCallback
+        JSObjectMakeFunctionWithBody -> JSObjectMakeFunction
+        
+        because the latter is more common, and more fundamental, than the former.
+
+        * API/APICast.h:
+        (toJS):
+        * API/JSBase.h:
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::getPropertyNames):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClass::~OpaqueJSClass):
+        * API/JSClassRef.h:
+        * API/JSObjectRef.cpp:
+        (JSClassCreate):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeFunction):
+        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray):
+        (JSObjectCopyPropertyNames):
+        * API/JSObjectRef.h:
+        * API/minidom.c:
+        (main):
+        * API/testapi.c:
+        (main):
+        * ChangeLog:
+        * JavaScriptCore.exp:
+
+2006-07-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Laughed at by Beth.
+        
+        Replace __JS with OpaqueJS because the former, while used by CF, is
+        a prefix that's triply-reserved by the compiler. (_* is reserved in global 
+        names, _[A-Z] is reserved in all names, and __ is reserved in all names 
+        in C++.)
+        
+        Opaque is an alternative used by other Mac OS X framewokrs.
+
+        * API/APICast.h:
+        (toJS):
+        * API/JSBase.h:
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::getPropertyNames):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClass::~OpaqueJSClass):
+        * API/JSClassRef.h:
+        * API/JSObjectRef.cpp:
+        (JSClassCreate):
+        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray):
+        (JSObjectCopyPropertyNames):
+
+2006-07-16  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Added some recently added files, removed some recently removed.
+
+2006-07-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Change getProperty* to return undefined, rather than NULL, for missing
+        properties, since that's what the spec says. Also added exception out
+        parameters to the *Index functions, because they can call through to the
+        regular functions, which can throw for custom objects.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectGetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (main):
+
+2006-07-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Properly document and handle NULL callbacks for static properties. We
+        throw an exception in any case other than a ReadOnly property with a NULL
+        setProperty callback, because a NULL callback almost certainly indicates 
+        a programming error. Also throw an exception if hasProperty returns true
+        for a property that getProperty can't get.
+        
+        - If a static setProperty callback returns 'false', to indicate that the
+        property was not set, we no longer forward the set request up the class
+        chain, because that's almost certainly not what the programmer expected.
+
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::staticFunctionGetter):
+        (KJS::JSCallbackObject::callbackGetter):
+        * API/JSObjectRef.h:
+        * API/minidom.js:
+        * API/testapi.c:
+        (MyObject_hasProperty):
+        * API/testapi.js:
+
+2006-07-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Added names to functions.
+        
+        - Removed GetPrivate/SetPrivate from callbackFunctions and callbackConstructors.
+        The private data idiom is that a JS object stores its native implementation
+        as private data. For functions and constructors, the native implementation is nothing
+        more than the callback they already store, so supporting private data, too,
+        confuses the idiom. If you *really* want, you can still create a custom 
+        function with private data.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::JSCallbackFunction):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeFunctionWithBody):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        * API/JSObjectRef.h:
+        * API/minidom.c:
+        (main):
+        * API/testapi.c:
+        (main):
+
+2006-07-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - switch property lists to be vector+set of Identifiers instead of list of References
+        
+        This has the following benefits:
+        
+        - no duplicates in property lists
+        - simplifies API calls
+        - probably more efficient, since linked list is gone
+        - entirely removed Reference, ReferenceList and ProtectedReference types from the API
+
+        * kjs/PropertyNameArray.cpp: Added.
+        (KJS::PropertyNameArray::add): Check set, if not already there, add to
+        vector.
+        * kjs/PropertyNameArray.h: Added.
+        (KJS::PropertyNameArray::PropertyNameArray): Newly added type, combines
+        a set and a vector to make a unique but ordered list of identifiers.
+        (KJS::PropertyNameArray::begin): ditto
+        (KJS::PropertyNameArray::end): ditto
+        (KJS::PropertyNameArray::size): ditto
+        (KJS::PropertyNameArray::operator[]): ditto
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstance::getPropertyNames): renamed from getPropertyList, updated
+        for PropertyNameArray
+        (ArrayInstance::setLength): updated for PropertyNameArray
+        (ArrayInstance::pushUndefinedObjectsToEnd): ditto
+        * kjs/nodes.cpp:
+        (ForInNode::execute): updated for PropertyNameArray
+        * kjs/nodes.h:
+        * kjs/object.cpp:
+        (KJS::JSObject::getPropertyNames): renamed from getPropertyList, updated
+        for PropertyNameArray
+        * kjs/object.h:
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::getEnumerablePropertyNames): updated for PropertyNameArray
+        (KJS::PropertyMap::getSparseArrayPropertyNames): ditto
+        * kjs/property_map.h:
+        * kjs/protected_reference.h: Removed.
+        * kjs/reference.cpp: Removed.
+        * kjs/reference.h: Removed.
+        * kjs/reference_list.cpp: Removed.
+        * kjs/reference_list.h: Removed.
+        * kjs/scope_chain.cpp:
+        (KJS::ScopeChain::print): Use PropertyNamesArray instead of ReferenceList.
+        * kjs/string_object.cpp:
+        (StringInstance::getPropertyNames): Updated for new approach.
+        * kjs/string_object.h:
+        * kjs/ustring.h:
+        * API/APICast.h:
+        (toJS): Added overload for PropertyNameAccumulatorRef / PropertyNameArray*
+        (toRef): ditto
+        * API/JSBase.h:
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::getPropertyNames): Fixed for new API.
+        * API/JSCallbackObject.h:
+        * API/JSObjectRef.cpp:
+        (__JSPropertyNameArray::__JSPropertyNameArray): Type used for a publicly vended
+        JSPropertyNameArrayRef.
+        (JSObjectCopyPropertyNames): New API call - renamed / refactored from 
+        JSObjectCreatePropertyList
+        (JSPropertyNameArrayRetain): new retain call for JSPropertyNameArray.
+        (JSPropertyNameArrayRelease): new release call for - " -.
+        (JSPropertyNameArrayGetCount): Instead of having to use a stateful enumerator you
+        can now get the count and items in any order.
+        (JSPropertyNameArrayGetNameAtIndex): See above.
+        (JSPropertyNameAccumulatorAddName): What you add properties to is now an opaque 
+        accumulator object.
+        * API/JSObjectRef.h: Prototyped new functions, removed old ones
+        * JavaScriptCore.exp: Updated exported symbols.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new files, removed old.
+        * API/testapi.c:
+        (MyObject_getPropertyNames): Renamed / fixed callback to fit new paradigm.
+        (main): Updated for new API.
+
+2006-07-15  Darin Adler  <darin@apple.com>
+
+        - oops, missed a few more arrays that had to be const
+
+        * API/JSNode.c:
+        (JSNodePrototype_appendChild): Added const.
+        (JSNodePrototype_removeChild): Ditto.
+        (JSNodePrototype_replaceChild): Ditto.
+        (JSNode_construct): Ditto.
+        * API/JSNodeList.c:
+        (JSNodeListPrototype_item): Ditto.
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithBody): Ditto.
+        (JSObjectCallAsFunction): Ditto.
+        (JSObjectCallAsConstructor): Ditto.
+        * API/minidom.c:
+        (print): Ditto.
+        * API/testapi.c:
+        (MyObject_callAsFunction): Ditto.
+        (MyObject_callAsConstructor): Ditto.
+        (print_callAsFunction): Ditto.
+        (myConstructor_callAsConstructor): Ditto.
+
+2006-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        * API/JSNode.h: Made an array parameter const.
+        * API/JSObjectRef.h: Made array parameters const. Fixed a comment.
+
+2006-07-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - JSObjectMakeFunctionWithBody includes a function name and named parameters now.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithBody):
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (assertEqualsAsUTF8String): More informative failure reporting.
+        (main): Test more function cases.
+
+2006-07-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+
+        - Moved the arguments passed to JSClassCreate into a single structure,
+        called JSClassDefinition. This will enable easier structure 
+        migration/versioning in the future, if necessary.
+        
+        - Added support for class names.
+        
+        - kJSClassDefinitionNull replaces kJSObjectCallbacksNone.
+        
+        - JSClass is becoming a fairly complex struct, so I migrated all of its
+        implementation other than reference counting to the sruct.
+        
+        - Also moved JSClass* functions in the API to JSObjectRef.cpp, since they're
+        declared in JSObjectRef.h
+        
+        - Also added some more informative explanation to the class structure doc.
+        
+2006-07-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=8395
+          <rdar://problem/4613467>
+          REGRESSION: RegEx seems broken for hex escaped non breaking space
+
+        Test: fast/js/regexp-extended-characters-more.html
+
+        * pcre/pcre_exec.c:
+        (match): Got rid of utf16Length local variable to guarantee there's no
+        extra stack usage in recursive calls. Fixed two places in the PCRE_UTF16
+        code that were using the length variable, which is the UTF-8 length of
+        a character in the pattern, to move in the UTF-16 subject string. Instead
+        they hardcode lengths of 1 and 2 since the code already handles BMP
+        characters and surrogate pairs separately. Also fixed some DPRINTF so
+        I could compile with DEBUG on.
+        (pcre_exec): Changed a place that was checking for multibyte characters
+        in the subject string to use ISMIDCHAR. Instead it was using hardcoded
+        logic that was right for UTF-8 but wrong for UTF-16.
+
+        * pcre/pcre_compile.c: (pcre_compile2): Fixed a DPRINTF so I could compile
+        with DEBUG on.
+
+2006-07-14  Geoffrey Garen  <ggaren@apple.com>
+
+        RS by Maciej.
+        
+        Global replace in the API of argc/argv with argumentCount/arguments.
+
+2006-07-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Finalized exception handling in the API.
+        
+        setProperty can throw because it throws for built-in arrays. getProperty
+        and deleteProperty can throw because setProperty can throw and we want
+        to be consistent, and also because they seem like "actions." callAsFunction,
+        callAsConstructor, and hasInstance can throw, because they caan throw for
+        all built-ins.
+        
+        toBoolean can't throw because it's defined that way in the spec.
+        
+        - Documented that toBoolean and toObject can't be overridden by custom 
+        objects because they're defined that way in the spec.
+
+=== Safari-521.17 ===
+
+2006-07-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Implemented ref-counting of JSContexts by splitting into two datatypes:
+        JSGlobalContext, which you can create/retain/release, and JSContext, which
+        you can't.
+        
+        Internally, you retain a JSGlobalContext/ExecState by retaining its
+        interpreter, which, in the case of a global ExecState, owns it.
+        
+        - Also made ~Interpreter() protected to catch places where Interpreter
+        is manually deleted. (Can't make it private because some crazy fool
+        decided it would be a good idea to subclass Interpreter in other frameworks.
+        I pity da fool.)
+
+        * API/APICast.h: 
+        (toJS): Added cast for new JSGlobalContext
+        * API/JSStringRef.h: Changed vague "you must" language to more specific
+        (but, ultimately, equally vague) "behavior is undefined if you don't" 
+        language.
+        (KJS::Interpreter::Interpreter): Factored more common initialization into
+        init()
+        * kjs/interpreter.h:
+        (KJS::Interpreter::ref): new
+        (KJS::Interpreter::deref): new
+        (KJS::Interpreter::refCount): new
+        * kjs/testkjs.cpp: 
+        (doIt): Ref-count the interpreter.
+
+2006-07-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - removed bool return value from JSObjectSetProperty, since it is inefficient and
+        also doesn't work quite right
+        - added JSObjectGetPropertyAtIndex and JSObjectSetPropertyAtIndex
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty): Removed return value and canPut stuff.
+        (JSObjectGetPropertyAtIndex): Added.
+        (JSObjectSetPropertyAtIndex): Added.
+        * API/JSObjectRef.h: Prototyped and documented new functions.
+
+2006-07-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth.
+        
+        Moved JSCheckScriptSyntax, JSEvaluateScript, and JSGarbageCollect into
+        JSBase.h/.cpp. They don't belong in the value-specific or context-specific 
+        files because they're not part of the value or context implementations.
+
+        * API/JSBase.h:
+        * API/JSContextRef.cpp:
+        (JSContextGetGlobalObject):
+        * API/JSContextRef.h:
+        * API/JSValueRef.cpp:
+        (JSValueUnprotect):
+        * API/JSValueRef.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-07-13  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Maciej.
+
+        Moved JavaScriptCore to be a public framework.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-07-13  Mark Rowe  <opendarwin.org@bdash.net.nz>
+
+        Reviewed by Geoffrey.
+
+        http://bugs.webkit.org/show_bug.cgi?id=9742
+        Bug 9742: REGRESSION: WebKit hangs when loading <http://www.vtbook.com>
+
+        * kjs/value.h:
+        (KJS::JSValue::getUInt32): Only types tagged as numeric can be converted to UInt32.
+
+2006-07-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Pleasing to Maciej.
+        
+        - Renamed JSEvaluate -> JSEvaluateScript, JSCheckSyntax -> JSCheckScriptSyntax
+        - Added exception out parameters to JSValueTo* and JSValueIsEqual because
+        they can throw
+        - Removed JSObjectGetDescription because it's useless and vague, and 
+        JSValueToString/JSValueIsObjectOfClass do a better job, anyway
+        - Clarified comments about "IsFunction/Constructor" to indicate that they
+        are true of all functions/constructors, not just those created by JSObjectMake*
+
+2006-07-12  Geoffrey Garen  <ggaren@apple.com>
+
+        RS by Beth.
+        
+        Finished previously approved JSInternalString -> JSString conversion 
+        by renaming the files.
+
+        * API/JSCallbackObject.cpp:
+        * API/JSInternalStringRef.cpp: Removed.
+        * API/JSInternalStringRef.h: Removed.
+        * API/JSStringRef.cpp: Added.
+        * API/JSStringRef.h: Added.
+        * API/JavaScriptCore.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-07-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Removed context and exception parameters from JSObjectGetPropertyEnumerator,
+        removing the spurious use of ExecState inside JavaScriptCore that made
+        us think this was necessary in the first place.
+
+        (StringInstance::getPropertyList): Use getString instead of toString because
+        we know we're dealing with a string -- we put it there in the first place.
+        While we're at it, store the string's size instead of retrieving it each time 
+        through the loop, to avoid the unnecessary killing of puppies.
+        * kjs/string_object.h:
+
+2006-07-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - add handling of hasInstance callback for API objects
+
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::implementsHasInstance): Check if callback is present.
+        (KJS::JSCallbackObject::hasInstance): Invoke appropriate callback.
+        * API/JSCallbackObject.h:
+        * API/JSClassRef.cpp:
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (MyObject_hasInstance): Test case; should match what construct would do.
+        * API/testapi.js:
+
+2006-07-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Implemented a vast number of renames and comment clarifications 
+        suggested during API review.
+        
+        JSInternalString -> JSString
+        JS*Make -> JSValueMake*, JSObjectMake*
+        JSTypeCode -> JSType
+        JSValueIsInstanceOf -> JSValueIsInstanceOfConstructor (reads strangely well in client code)
+        JSGC*Protect -> JSValue*Protect
+        JS*Callback -> JSObject*Callback
+        JSGetPropertyListCallback -> JSObjectAddPropertiesToListCallback
+        JSPropertyEnumeratorGetNext -> JSPropertyEnumeratorGetNextName
+        JSString* -> 
+            JSStringCreateWithUTF8CString, JSStringGetUTF8CString,
+            JSStringGetMaximumUTF8CStringSize JSStringIsEqualToUTF8CString, 
+            JSStringCreateWithCFString, JSStringCopyCFString, JSStringCreateWithCharacters.
+        
+        - Changed functions taking a JSValue out arg and returning a bool indicating
+        whether it was set to simply return a JSValue or NULL.
+        
+        - Removed JSStringGetCharacters because it's more documentation than code,
+        and it's just a glorified memcpy built on existing API functionality.
+        
+        - Moved standard library includes into the headers that actually require them.
+        
+        - Standardized use of the phrase "Create Rule."
+        
+        - Removed JSLock from make functions that don't allocate.
+        
+        - Added exception handling to JSValueToBoolean, since we now allow
+        callback objects to throw exceptions upon converting to boolean.
+        
+        - Renamed JSGCCollect to JSGarbageCollect.
+
+2006-07-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+        
+        - Changed public header includes to the <JavaScriptCore/ style.
+        - Changed instances of 'buffer' to 'string' since we decided on
+        JSInternalString instead of JSStringBuffer.
+
+        * API/JSContextRef.h:
+        * API/JSInternalStringRef.cpp:
+        (JSStringMake):
+        (JSInternalStringRetain):
+        (JSInternalStringRelease):
+        (JSValueCopyStringValue):
+        (JSInternalStringGetLength):
+        (JSInternalStringGetCharactersPtr):
+        (JSInternalStringGetCharacters):
+        (JSInternalStringGetMaxLengthUTF8):
+        (JSInternalStringGetCharactersUTF8):
+        (CFStringCreateWithJSInternalString):
+        * API/JSInternalStringRef.h:
+        * API/JSNode.c:
+        (JSNodePrototype_appendChild):
+        (JSNode_getNodeType):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.h:
+        * API/JavaScriptCore.h:
+        * API/minidom.c:
+        (main):
+        (print):
+        * API/testapi.c:
+        (MyObject_getPropertyList):
+        (myConstructor_callAsConstructor):
+        (main): I noticed that we were prematurely releasing some string buffers,
+        so I moved their release calls to the end of main(). I got rid of 'Buf' in *Buf
+        (sometimes changing to 'IString', when necessary to differentiate a variable) 
+        to match the buffer->string change.
+
+=== Safari-521.16 ===
+
+2006-07-10  Darin Adler  <darin@apple.com>
+
+        * kjs/value.cpp: (KJS::JSValue::toInt32Inline): Added inline keyword one more place.
+        Just in case.
+
+2006-07-10  Darin Adler  <darin@apple.com>
+
+        - fix the release build
+
+        * kjs/value.h:
+        * kjs/value.cpp:
+        (KJS::JSValue::toInt32Inline): Move the code here to an inline.
+        (KJS::JSValue::toInt32): Call the inline from both overloaded toInt32 functions.
+
+2006-07-10  David Kilzer  <ddkilzer@kilzer.net>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=9179
+          Implement select.options.add() method
+
+        * JavaScriptCore.exp: Added overloaded KJS::JSValue::toInt32() method.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Altered attributes metadata for
+        kjs/value.h to make it available as a forwarded header.
+        * kjs/lookup.h:
+        (KJS::lookupPut): Extracted a lookupPut() method from the existing lookupPut() method.
+        The new method returns a boolean value if no entry is found in the lookup table.
+        * kjs/value.cpp:
+        (KJS::JSValue::toInt32): Overloaded toInt32() method with boolean "Ok" argument.
+        * kjs/value.h: Ditto.
+
+2006-07-10  Geoffrey Garen  <ggaren@apple.com>
+
+        No review necessary. Removed bogus file I accidentally checked in before.
+
+        * API/JSInternalSringRef.h: Removed.
+
+2006-07-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+        
+        Added exception out parameter to API object callbacks, removed semi-bogus
+        JSContext(.*)Exception functions.
+        
+        To make these calls syntactically simple, I added an exceptionSlot()
+        method to the ExecState class, which provides a JSValue** slot in which to 
+        store a JSValue* exception.
+
+        * API/APICast.h:
+        (toRef):
+        * API/JSCallbackConstructor.cpp:
+        (KJS::JSCallbackConstructor::construct):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::callAsFunction):
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::init):
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::construct):
+        (KJS::JSCallbackObject::callAsFunction):
+        (KJS::JSCallbackObject::getPropertyList):
+        (KJS::JSCallbackObject::toBoolean):
+        (KJS::JSCallbackObject::toNumber):
+        (KJS::JSCallbackObject::toString):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::callbackGetter):
+        * API/JSContextRef.cpp:
+        (JSCheckSyntax):
+        * API/JSContextRef.h:
+        * API/JSNode.c:
+        (JSNodePrototype_appendChild):
+        (JSNodePrototype_removeChild):
+        (JSNodePrototype_replaceChild):
+        (JSNode_getNodeType):
+        (JSNode_getChildNodes):
+        (JSNode_getFirstChild):
+        (JSNode_construct):
+        * API/JSNode.h:
+        * API/JSNodeList.c:
+        (JSNodeListPrototype_item):
+        (JSNodeList_length):
+        (JSNodeList_getProperty):
+        * API/JSObjectRef.h:
+        * API/minidom.c:
+        (print):
+        * API/testapi.c:
+        (MyObject_initialize):
+        (MyObject_hasProperty):
+        (MyObject_getProperty):
+        (MyObject_setProperty):
+        (MyObject_deleteProperty):
+        (MyObject_getPropertyList):
+        (MyObject_callAsFunction):
+        (MyObject_callAsConstructor):
+        (MyObject_convertToType):
+        (print_callAsFunction):
+        (myConstructor_callAsConstructor):
+        (main):
+        * JavaScriptCore.exp:
+        * kjs/ExecState.h:
+        (KJS::ExecState::exceptionHandle):
+
+2006-07-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        Improved type safety by implementing opaque JSValue/JSObject typing through 
+        abuse of 'const', not void*. Also fixed an alarming number of bugs
+        exposed by this new type safety.
+        
+        I made one design change in JavaScriptCore, which is that the JSObject
+        constructor should take a JSValue* as its prototype argument, not a JSObject*,
+        since we allow the prototype to be any JSValue*, including jsNull(), for
+        example.
+        
+        * API/APICast.h:
+        (toJS):
+        * API/JSBase.h:
+        * API/JSCallbackConstructor.cpp:
+        (KJS::JSCallbackConstructor::construct):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::callAsFunction):
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::JSCallbackObject):
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::construct):
+        (KJS::JSCallbackObject::callAsFunction):
+        (KJS::JSCallbackObject::staticFunctionGetter):
+        * API/JSCallbackObject.h:
+        * API/JSContextRef.cpp:
+        (JSEvaluate):
+        * API/JSNode.c:
+        (JSNodePrototype_appendChild):
+        (JSNodePrototype_removeChild):
+        (JSNodePrototype_replaceChild):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSFunctionMakeWithBody):
+        (JSObjectGetProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (main):
+        * ChangeLog:
+        * kjs/object.h:
+        (KJS::JSObject::JSObject):
+
+2006-07-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Approved by Maciej, Darin.
+        
+        Renamed JSStringBufferRef to JSInternalStringRef. "Internal string" means the 
+        JavaScript engine's internal string representation, which is the most 
+        low-level and efficient representation to use when interfacing with JavaScript.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.h:
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::callbackGetter):
+        * API/JSContextRef.cpp:
+        (JSEvaluate):
+        (JSCheckSyntax):
+        * API/JSContextRef.h:
+        * API/JSInternalStringRef.cpp: Added.
+        (JSStringMake):
+        (JSInternalStringCreate):
+        (JSInternalStringCreateUTF8):
+        (JSInternalStringRetain):
+        (JSInternalStringRelease):
+        (JSValueCopyStringValue):
+        (JSInternalStringGetLength):
+        (JSInternalStringGetCharactersPtr):
+        (JSInternalStringGetCharacters):
+        (JSInternalStringGetMaxLengthUTF8):
+        (JSInternalStringGetCharactersUTF8):
+        (JSInternalStringIsEqual):
+        (JSInternalStringIsEqualUTF8):
+        (JSInternalStringCreateCF):
+        (CFStringCreateWithJSInternalString):
+        * API/JSInternalStringRef.h: Added.
+        * API/JSNode.c:
+        (JSNodePrototype_appendChild):
+        (JSNode_getNodeType):
+        (JSNode_getChildNodes):
+        (JSNode_getFirstChild):
+        * API/JSNodeList.c:
+        (JSNodeList_length):
+        (JSNodeList_getProperty):
+        * API/JSObjectRef.cpp:
+        (JSFunctionMakeWithBody):
+        (JSObjectGetDescription):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        (JSPropertyEnumeratorGetNext):
+        (JSPropertyListAdd):
+        * API/JSObjectRef.h:
+        * API/JSStringBufferRef.cpp: Removed.
+        * API/JSStringBufferRef.h: Removed.
+        * API/JSValueRef.h:
+        * API/JavaScriptCore.h:
+        * API/minidom.c:
+        (main):
+        (print):
+        * API/testapi.c:
+        (assertEqualsAsUTF8String):
+        (assertEqualsAsCharactersPtr):
+        (assertEqualsAsCharacters):
+        (MyObject_hasProperty):
+        (MyObject_getProperty):
+        (MyObject_setProperty):
+        (MyObject_deleteProperty):
+        (MyObject_getPropertyList):
+        (print_callAsFunction):
+        (myConstructor_callAsConstructor):
+        (main):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-07-08  Tim Omernick  <timo@apple.com>
+
+        Reviewed by Maciej.
+
+        Added an OpenGL drawing model to the Netscape Plug-in API.
+
+        * bindings/npapi.h:
+
+2006-07-08  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Maciej.
+
+        Moved KJS_GetCreatedJavaVMs to jni_utility.cpp.
+        Switched KJS_GetCreatedJavaVMs over to use dlopen and dlsym
+        now that NSAddImage, NSLookupSymbolInImage and NSAddressOfSymbol
+        are deprecated in Leopard.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::KJS_GetCreatedJavaVMs):
+        * bindings/softlinking.c: Removed.
+        * bindings/softlinking.h: Removed.
+
+2006-07-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders.
+        
+        - Make JSObjectGetProperty return a JSValue or NULL, like JSEvaluate does.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectGetProperty):
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (main):
+
+2006-07-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Style change -- no review necessary.
+        
+        Use 0 instead of NULL in API .cpp files, to match our style guidelines.
+
+        * API/JSContextRef.cpp:
+        (JSEvaluate):
+        * API/JSObjectRef.cpp:
+        (JSFunctionMakeWithBody):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueToObject):
+
+2006-07-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by TimO.
+
+        - Added ability to pass NULL for thisObject when calling JSObjectCallAsFunction,
+        to match JSEvaluate.
+        
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (main):
+
+=== Safari-521.15 ===
+
+2006-07-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Standardized which functions take a JSContext as an argument. The rule is:
+        if you might execute JavaScript, you take a JSContext, otherwise you don't.
+        
+        The FIXME in JSObjectRef.h requires refactoring some parts of Interpreter,
+        but not API changes, so I'm putting it off until later.
+
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::JSCallbackObject):
+        (KJS::JSCallbackObject::init):
+        * API/JSCallbackObject.h:
+        * API/JSContextRef.cpp:
+        (JSContextCreate):
+        * API/JSContextRef.h:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSPropertyEnumeratorGetNext):
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (MyObject_initialize):
+        (main):
+        * JavaScriptCore.exp:
+        * kjs/array_object.cpp:
+        (ArrayInstance::setLength):
+        (ArrayInstance::pushUndefinedObjectsToEnd):
+        * kjs/nodes.cpp:
+        (ForInNode::execute):
+        * kjs/reference.cpp:
+        (KJS::Reference::getPropertyName):
+        (KJS::Reference::getValue):
+        * kjs/reference.h:
+        * kjs/scope_chain.cpp:
+        (KJS::ScopeChain::print):
+
+2006-07-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        More API action.
+        
+        - Headerdoc finished
+
+        Semantic Changes:
+        - Added a JSContextRef argument to many functions, because you need a 
+        JSContextRef for doing virtually anything. I expect to add this argument
+        to even more functions in a future patch.
+        
+        - Removed the globalObjectPrototype argument to JSContextCreate because
+        you can't create an object until you have a context, so it's impossible
+        to pass a prototype object to JSContextCreate. That's OK because (1) there's
+        no reason to give the global object a prototype and (2) if you really want
+        to, you can just use a separate call to JSObjectSetPrototype.
+        
+        - Removed the JSClassRef argument to JSClassCreate because it was unnecessary,
+        and you need to be able to make the global object's class before you've
+        created a JSContext.
+        
+        - Added an optional exception parameter to JSFunctionMakeWithBody because anything
+        less would be uncivilized.
+        
+        - Made the return value parameter to JSObjectGetProperty optional to match
+        all other return value parameters in the API.
+        
+        - Made JSObjectSetPrivate/JSObjectGetPrivate work on JSCallbackFunctions
+        and JSCallbackConstructors. You could use an abstract base class or strategic
+        placement of m_privateData in the class structure to implement this, but 
+        the former seemed like overkill, and the latter seemed too dangerous.
+        
+        - Fixed a bug where JSPropertyEnumeratorGetNext would skip the first property.
+
+        Cosmetic Changes:
+        - Reversed the logic of the JSChar #ifdef to avoid confusing headerdoc
+        
+        - Removed function names from @function declarations because headeroc
+        can parse them automatically, and I wanted to rule out manual mismatch.
+
+        - Changed Error::create to take a const UString& instead of a UString*
+        because it was looking at me funny.
+        
+        - Renamed JSStringBufferCreateWithCFString to JSStringBufferCreateCF
+        because the latter is more concise and it matches JSStringBufferCreateUTF8.
+        
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::getPropertyList):
+        (KJS::JSCallbackObject::toBoolean):
+        (KJS::JSCallbackObject::toNumber):
+        (KJS::JSCallbackObject::toString):
+        * API/JSClassRef.cpp:
+        (JSClassCreate):
+        * API/JSContextRef.cpp:
+        (JSContextCreate):
+        (JSContextSetException):
+        * API/JSContextRef.h:
+        * API/JSNode.c:
+        (JSNodePrototype_class):
+        (JSNode_class):
+        * API/JSNodeList.c:
+        (JSNodeListPrototype_class):
+        (JSNodeList_class):
+        * API/JSObjectRef.cpp:
+        (JSObjectGetProperty):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSPropertyEnumeratorGetNext):
+        * API/JSObjectRef.h:
+        * API/JSStringBufferRef.cpp:
+        (JSStringBufferCreateCF):
+        * API/JSStringBufferRef.h:
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOf):
+        * API/JSValueRef.h:
+        * API/minidom.c:
+        (main):
+        * API/minidom.js:
+        * API/testapi.c:
+        (MyObject_hasProperty):
+        (MyObject_setProperty):
+        (MyObject_deleteProperty):
+        (MyObject_getPropertyList):
+        (MyObject_convertToType):
+        (MyObject_class):
+        (main):
+        * JavaScriptCore.exp:
+
+2006-07-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John.
+        
+        - Fixed a few crashes resulting from NULL parameters to JSClassCreate.
+
+        * API/JSClassRef.cpp:
+        (JSClassCreate):
+        (JSClassRelease):
+        * API/testapi.c: Added test for NULL parameters.
+        (main):
+
+2006-07-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John, mocked by Darin.
+        
+        - Changed JSEvaluate to take a JSObjectRef instead of a JSValueRef as
+        "this," since "this" must be an object.
+
+        * API/JSContextRef.cpp:
+        (JSEvaluate):
+        * API/JSContextRef.h:
+
+2006-07-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John.
+        
+        - More headerdoc
+
+        * API/JSBase.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-07-05  Geoffrey Garen  <ggaren@apple.com>
+
+        RS by Beth.
+        
+        Renamed JSCharBufferRef, which was universally unpopular, to JSStringBufferRef,
+        which, hopefully, will be less unpopular.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.h:
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::callbackGetter):
+        * API/JSCharBufferRef.cpp: Removed.
+        * API/JSCharBufferRef.h: Removed.
+        * API/JSContextRef.cpp:
+        (JSEvaluate):
+        (JSCheckSyntax):
+        * API/JSContextRef.h:
+        * API/JSNode.c:
+        (JSNodePrototype_appendChild):
+        (JSNode_getNodeType):
+        (JSNode_getChildNodes):
+        (JSNode_getFirstChild):
+        * API/JSNodeList.c:
+        (JSNodeList_length):
+        (JSNodeList_getProperty):
+        * API/JSObjectRef.cpp:
+        (JSFunctionMakeWithBody):
+        (JSObjectGetDescription):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        (JSPropertyEnumeratorGetNext):
+        (JSPropertyListAdd):
+        * API/JSObjectRef.h:
+        * API/JSStringBufferRef.cpp: Added.
+        (JSStringMake):
+        (JSStringBufferCreate):
+        (JSStringBufferCreateUTF8):
+        (JSStringBufferRetain):
+        (JSStringBufferRelease):
+        (JSValueCopyStringValue):
+        (JSStringBufferGetLength):
+        (JSStringBufferGetCharactersPtr):
+        (JSStringBufferGetCharacters):
+        (JSStringBufferGetMaxLengthUTF8):
+        (JSStringBufferGetCharactersUTF8):
+        (JSStringBufferIsEqual):
+        (JSStringBufferIsEqualUTF8):
+        (JSStringBufferCreateWithCFString):
+        (CFStringCreateWithJSStringBuffer):
+        * API/JSStringBufferRef.h: Added.
+        * API/JSValueRef.h:
+        * API/JavaScriptCore.h:
+        * API/minidom.c:
+        (main):
+        (print):
+        * API/testapi.c:
+        (assertEqualsAsUTF8String):
+        (assertEqualsAsCharactersPtr):
+        (assertEqualsAsCharacters):
+        (MyObject_hasProperty):
+        (MyObject_getProperty):
+        (MyObject_setProperty):
+        (MyObject_deleteProperty):
+        (MyObject_getPropertyList):
+        (print_callAsFunction):
+        (myConstructor_callAsConstructor):
+        (main):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-07-05  Geoffrey Garen  <ggaren@apple.com>
+
+        RS by Beth.
+        
+        Moved some code around for more logical file separation.
+
+        * API/JSBase.h:
+        * API/JSContextRef.h:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        (JSValueToObject):
+        * API/JSValueRef.h:
+
+2006-07-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        Implemented JSFunctionMakeWithBody, which parses a script as a function body
+        in the global scope, and returns the resulting anonymous function.
+        
+        I also removed private data from JSCallbackFunction. It never worked,
+        since JSCallbackFunction doesn't inherit from JSCallbackObject.
+
+        * API/JSCallbackConstructor.cpp: Removed.
+        * API/JSCallbackConstructor.h: Removed.
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::JSCallbackFunction):
+        (KJS::JSCallbackFunction::implementsConstruct):
+        (KJS::JSCallbackFunction::construct):
+        (KJS::JSCallbackFunction::implementsCall):
+        (KJS::JSCallbackFunction::callAsFunction):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        (KJS::JSCallbackObject::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSFunctionMake):
+        (JSFunctionMakeWithCallbacks):
+        * API/JSObjectRef.h:
+        * API/JSValueRef.h:
+        * API/minidom.c:
+        (main):
+        * API/testapi.c:
+        (main):
+        * JavaScriptCore.exp: Programmatically added all symbols exported by
+        API object files, and sorted results
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-07-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+
+        - Return syntax error in JSCheckSyntax through a JSValueRef* exception
+        argument
+        
+        * API/JSBase.h:
+        * API/JSContextRef.cpp:
+        (JSCheckSyntax):
+        * API/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::checkSyntax):
+        * kjs/interpreter.h:
+
+2006-07-04  Darin Adler  <darin@apple.com>
+
+        - fixed build
+
+        * wtf/MathExtras.h: Oops. Added missing #endif.
+
+2006-07-04  Bjoern Graf  <bjoern.graf@gmail.com>
+
+        Reviewed by Maciej.
+        Tweaked a bit by Darin.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=9678
+          work around MSVCRT's fmod function returning NaN for fmod(x, infinity) instead of x
+
+        * wtf/MathExtras.h: Added include of <float.h>.
+        (isinf): Fix to return false for NAN.
+        (wtf_fmod): Added. An inline that works around the bug.
+
+        * kjs/nodes.cpp:
+        * kjs/number_object.cpp:
+        * kjs/operations.cpp:
+        * kjs/value.cpp:
+        Added includes of MathExtras.h to all files using fmod.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Let Xcode 2.3 have its way with
+        the project.
+
+2006-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+        
+        - Refined value conversions in the API:
+            - failed toNumber returns NaN
+            - failed toObject returns NULL
+            - failed toString returns empty string
+        
+        - Refined excpetion handling in the API:
+            - failed value conversions do not throw exceptions
+            - uncaught exceptions in JSEvaluate, JSObjectCallAsFunction, and 
+              JSObjectCallAsConstructor are returned through a JSValueRef* exception
+              argument
+            - removed JSContextHasException, because JSContextGetException does
+              the same job
+            
+        * API/JSBase.h:
+        * API/JSCharBufferRef.cpp:
+        (JSValueCopyStringValue):
+        * API/JSContextRef.cpp:
+        (JSEvaluate):
+        * API/JSContextRef.h:
+        * API/JSNodeList.c: Added test code demonstrating how you would use
+        toNumber, and why you probably don't need toUInt32, etc.
+        (JSNodeListPrototype_item):
+        (JSNodeList_getProperty):
+        * API/JSObjectRef.cpp:
+        (JSValueToObject):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSObjectRef.h:
+        * API/JSValueRef.cpp:
+        (JSValueToNumber):
+        * API/JSValueRef.h:
+        * API/minidom.c:
+        (main):
+        * API/testapi.c:
+        (main): Added tests for new rules, and call to JSGCProtect to fix Intel 
+        crash
+        * JavaScriptCore.exp:
+
+2006-07-03  Darin Adler  <darin@apple.com>
+
+        - Rolled out HashMap implementation of NPRuntime, at least temporarily.
+
+        Fixes hang in the bindings section of layout tests seen on the
+        buildbot.
+
+        This code was using HashMap<const char*, PrivateIdentifier*>.
+        But that hashes based on pointer identity, not string value.
+        The default hash for any pointer type is to hash based on the pointer.
+        And WTF doesn't currently have a string hash for char*.
+        We'll need to fix that before re-landing this patch.
+
+        (Formatting was also incorrect -- extra spaces in parentheses.)
+
+        * bindings/npruntime.cpp: Rolled out last change.
+
+2006-07-02  Justin Haygood  <jhaygood@spsu.edu>
+
+        Reviewed, tweaked, landed by ggaren.
+
+        - Port NPRuntime from CFDictionary to HashMap.
+
+        * bindings/npruntime.cpp:
+        (getStringIdentifierDictionary):
+        (getIntIdentifierDictionary):
+        (_NPN_GetStringIdentifier):
+        (_NPN_GetIntIdentifier):
+        * bindings/npruntime.h:
+
+2006-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adele.
+        
+        - Fixed <rdar://problem/4611197> REGRESSION: Liveconnect with Java test 
+        fails at http://www-sor.inria.fr/~dedieu/notes/liveconnect/simple_example.html
+
+        * JavaScriptCore.exp: Export symbols used by liveconnect
+
+2006-06-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Phase 2 in the JS API.
+        
+        - Added support for specifying static tables of values -- this should
+        obviate the need for using complicated callbacks for most lookups.
+        
+        -  API objects are now created with classes (JSClassRef) -- in order to support
+        static values, and in order to prevent API objects from storing their
+        data inline, and thus falling into the oversized (read: slow and prone to
+        giving Maciej the frowny face) heap.
+        
+        - Added two specialized JSObject subclasses -- JSCallbackFunction and JSCallbackConstructor -- 
+        to allow JSFunctionMake and JSConstructorMake to continue to work with
+        the new class model. Another solution to this problem would be to create
+        a custom class object for each function and constructor you make. This
+        solution is more code but also more efficient.
+        
+        - Substantially beefed up the minidom example to demonstrate and test a
+        lot of these techniques. Its output is still pretty haphazard, though.
+        
+        - Gave the <kjs/ preface to some includes -- I'm told this matters to
+        building on some versions of Linux.
+        
+        - Implemented JSValueIsInstanceOf and JSValueIsObjectOfClass
+        
+        - Removed GetDescription callback. Something in the class datastructure
+        should take care of this.
+
+        * API/JSBase.h:
+        * API/JSCallbackConstructor.cpp: Added.
+        (KJS::):
+        (KJS::JSCallbackConstructor::JSCallbackConstructor):
+        (KJS::JSCallbackConstructor::implementsConstruct):
+        (KJS::JSCallbackConstructor::construct):
+        (KJS::JSCallbackConstructor::setPrivate):
+        (KJS::JSCallbackConstructor::getPrivate):
+        * API/JSCallbackConstructor.h: Added.
+        (KJS::JSCallbackConstructor::classInfo):
+        * API/JSCallbackFunction.cpp: Added.
+        (KJS::):
+        (KJS::JSCallbackFunction::JSCallbackFunction):
+        (KJS::JSCallbackFunction::implementsCall):
+        (KJS::JSCallbackFunction::callAsFunction):
+        (KJS::JSCallbackFunction::setPrivate):
+        (KJS::JSCallbackFunction::getPrivate):
+        * API/JSCallbackFunction.h: Added.
+        (KJS::JSCallbackFunction::classInfo):
+        * API/JSCallbackObject.cpp:
+        (KJS::):
+        (KJS::JSCallbackObject::JSCallbackObject):
+        (KJS::JSCallbackObject::init):
+        (KJS::JSCallbackObject::~JSCallbackObject):
+        (KJS::JSCallbackObject::className):
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::implementsConstruct):
+        (KJS::JSCallbackObject::construct):
+        (KJS::JSCallbackObject::implementsCall):
+        (KJS::JSCallbackObject::callAsFunction):
+        (KJS::JSCallbackObject::getPropertyList):
+        (KJS::JSCallbackObject::toBoolean):
+        (KJS::JSCallbackObject::toNumber):
+        (KJS::JSCallbackObject::toString):
+        (KJS::JSCallbackObject::inherits):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::staticFunctionGetter):
+        (KJS::JSCallbackObject::callbackGetter):
+        * API/JSCallbackObject.h:
+        * API/JSCharBufferRef.cpp:
+        * API/JSClassRef.cpp: Added.
+        (JSClassCreate):
+        (JSClassRetain):
+        (JSClassRelease):
+        * API/JSClassRef.h: Added.
+        (StaticValueEntry::StaticValueEntry):
+        (StaticFunctionEntry::StaticFunctionEntry):
+        (__JSClass::__JSClass):
+        * API/JSContextRef.cpp:
+        (JSContextCreate):
+        (JSEvaluate):
+        * API/JSContextRef.h:
+        * API/JSNode.c: Added.
+        (JSNodePrototype_appendChild):
+        (JSNodePrototype_removeChild):
+        (JSNodePrototype_replaceChild):
+        (JSNodePrototype_class):
+        (JSNode_getNodeType):
+        (JSNode_getChildNodes):
+        (JSNode_getFirstChild):
+        (JSNode_finalize):
+        (JSNode_class):
+        (JSNode_prototype):
+        (JSNode_new):
+        (JSNode_construct):
+        * API/JSNode.h: Added.
+        * API/JSNodeList.c: Added.
+        (JSNodeListPrototype_item):
+        (JSNodeListPrototype_class):
+        (JSNodeList_length):
+        (JSNodeList_getProperty):
+        (JSNodeList_finalize):
+        (JSNodeList_class):
+        (JSNodeList_prototype):
+        (JSNodeList_new):
+        * API/JSNodeList.h: Added.
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSFunctionMake):
+        (JSConstructorMake):
+        (__JSPropertyEnumerator::__JSPropertyEnumerator):
+        (JSObjectCreatePropertyEnumerator):
+        (JSPropertyEnumeratorGetNext):
+        (JSPropertyEnumeratorRetain):
+        (JSPropertyEnumeratorRelease):
+        * API/JSObjectRef.h:
+        (__JSObjectCallbacks::):
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass):
+        (JSValueIsInstanceOf):
+        * API/JSValueRef.h:
+        * API/Node.c: Added.
+        (Node_new):
+        (Node_appendChild):
+        (Node_removeChild):
+        (Node_replaceChild):
+        (Node_ref):
+        (Node_deref):
+        * API/Node.h: Added.
+        * API/NodeList.c: Added.
+        (NodeList_new):
+        (NodeList_length):
+        (NodeList_item):
+        (NodeList_ref):
+        (NodeList_deref):
+        * API/NodeList.h: Added.
+        * API/minidom.c:
+        (main):
+        (print):
+        (createStringWithContentsOfFile):
+        * API/minidom.js:
+        * API/testapi.c:
+        (assertEqualsAsCharacters):
+        (MyObject_getProperty):
+        (MyObject_class):
+        (myConstructor_callAsConstructor):
+        (main):
+        * API/testapi.js:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-06-26  Kevin Ollivier  <kevino@theolliviers.com>
+        
+        Reviewed and tweaked by Darin.
+
+        - Compile fixes for wx port / gcc 4.0.2
+
+        * kjs/array_object.cpp:
+        Added missing headers. 
+
+        * kjs/ExecState.h:
+        gcc needs class prototypes before defining those classes as friend classes
+
+2006-06-30  Mike Emmel  <mike.emmel@gmail.com>
+
+        Reviewed by Darin.
+
+        Compilation fixes for Linux/Gdk.
+
+        * JavaScriptCore/kjs/interpreter.cpp: added include of signal.h
+        * JavaScriptCore/kjs/ExecState.h: added missing class declaration 
+        * JavaScriptCore/kjs/ExecState.cpp: case wrong on include of context.h 
+        * JavaScriptCore/JavaScriptCoreSources.bkl: added Context.cpp and ExecState.cpp
+
+=== Safari-521.14 ===
+
+2006-06-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - add headerdoc comments to some of the new JS API headers
+
+        * API/JSBase.h:
+        * API/JSValueRef.h:
+
+2006-06-28  Timothy Hatcher  <timothy@apple.com>
+
+        Prefer the Stabs debugging symbols format until DWARF bugs are fixed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-06-27  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Tim O.
+
+        <rdar://problem/4448350> Deprecated ObjC language API used in JavaScriptCore, WebCore, WebKit and WebBrowser
+
+        Switch to the new ObjC 2 API, ifdefed the old code around OBJC_API_VERSION so it still works on Tiger.
+        Removed the use of the old stringWithCString, switched to the new Tiger version that accepts an encoding.
+        Lots of code style cleanup.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/objc/objc_class.h:
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::~ObjcClass):
+        (KJS::Bindings::_createClassesByIsAIfNecessary):
+        (KJS::Bindings::ObjcClass::classForIsA):
+        (KJS::Bindings::ObjcClass::name):
+        (KJS::Bindings::ObjcClass::methodsNamed):
+        (KJS::Bindings::ObjcClass::fieldNamed):
+        (KJS::Bindings::ObjcClass::fallbackObject):
+        * bindings/objc/objc_header.h:
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::~ObjcInstance):
+        (ObjcInstance::operator=):
+        (ObjcInstance::begin):
+        (ObjcInstance::end):
+        (ObjcInstance::getClass):
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfField):
+        (ObjcInstance::supportsSetValueOfUndefinedField):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfField):
+        (ObjcInstance::getValueOfUndefinedField):
+        (ObjcInstance::defaultValue):
+        (ObjcInstance::stringValue):
+        (ObjcInstance::numberValue):
+        (ObjcInstance::booleanValue):
+        (ObjcInstance::valueOf):
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcMethod::ObjcMethod):
+        (ObjcMethod::name):
+        (ObjcMethod::getMethodSignature):
+        (ObjcMethod::setJavaScriptName):
+        (ObjcField::name):
+        (ObjcField::type):
+        (ObjcField::valueFromInstance):
+        (convertValueToObjcObject):
+        (ObjcField::setValueToInstance):
+        (ObjcArray::operator=):
+        (ObjcArray::setValueAt):
+        (ObjcArray::valueAt):
+        (ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        (ObjcFallbackObjectImp::callAsFunction):
+        (ObjcFallbackObjectImp::defaultValue):
+
+2006-06-28  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+
+        http://bugs.webkit.org/show_bug.cgi?id=8636
+        REGRESSION: JavaScript access to Java applet causes hang (_webViewURL not implemented)
+
+        * bindings/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall):
+        Just pass nil as the calling URL. This will cause the Java plugin to use the URL of the page
+        containing the applet (which is what we used to do).
+
+2006-06-27  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/4406785> Add an export file to TOT JavaScriptCore like the Safari-2-0-branch
+
+        * JavaScriptCore.exp: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adele.
+        
+        - Added JSConstructorMake to match JSFunctionMake, along with test code.
+        
+        [ I checked in the ChangeLog before without the actual files. ]
+
+        * API/JSObjectRef.cpp:
+        (JSConstructorMake):
+        * API/JSObjectRef.h:
+        * API/testapi.c:
+        (myConstructor_callAsConstructor):
+        (main):
+        * API/testapi.js:
+        * ChangeLog:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Moved testapi.c to the testapi
+        target -- this was an oversight in my earlier check-in.
+
+2006-06-25  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin.
+
+        Bug 9574: Drosera should show inline scripts within the original HTML
+        http://bugs.webkit.org/show_bug.cgi?id=9574
+
+        Pass the starting line number and error message to the debugger.
+
+        * kjs/debugger.cpp:
+        (Debugger::sourceParsed):
+        * kjs/debugger.h:
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+
+2006-06-24  Alexey Proskuryakov  <ap@nypop.com>
+
+        Rubber-stamped by Eric.
+
+        Add a -h (do not follow symlinks) option to ln in derived sources build script (without it,
+        a symlink was created inside the source directory on second build).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-06-24  David Kilzer  <ddkilzer@kilzer.net>
+
+        Reviewed by Timothy.
+
+        * Info.plist: Fixed copyright to include 2003-2006.
+
+2006-06-24  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=9418
+        WebKit will not build when Space exists in path
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Enclose search paths in quotes; create symlinks to 
+        avoid passing paths with spaces to make.
+
+2006-06-23  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin.
+
+        Adding more operator[] overloads for long and short types.
+
+        * wtf/Vector.h:
+        (WTF::Vector::operator[]):
+
+=== JavaScriptCore-521.13 ===
+
+2006-06-22  Alexey Proskuryakov  <ap@nypop.com>
+
+        Build fix.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=9539
+        Another case error preventing build
+
+        * API/JSObjectRef.cpp: Changed "identifier.h" to "Identifier.h"
+        
+2006-06-22  David Kilzer  <ddkilzer@kilzer.net>
+
+        Build fix.
+
+        http://bugs.webkit.org/show_bug.cgi?id=9539
+        Another case error preventing build
+
+        * API/APICast.h: Changed "UString.h" to "ustring.h".
+
+2006-06-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed release build, fixed accidental infinite recursion due to
+        last minute global replace gone awry.
+        
+        * API/APICast.h:
+        (toRef):
+        * API/testapi.c:
+        (assertEqualsAsBoolean):
+        (assertEqualsAsNumber):
+        (assertEqualsAsUTF8String):
+        (assertEqualsAsCharactersPtr):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-06-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders.
+        
+        - First cut at C API to JavaScript. Includes a unit test, 'testapi.c', 
+        and the outline of a test app, 'minidom.c'.
+        
+        Includes one change to JSC internals: Rename propList to getPropertyList and have it
+        take its target property list by reference so that subclasses can
+        add properties to the list before calling through to their superclasses.
+        
+        Also, I just ran prepare-ChangeLog in about 10 seconds, and I would like
+        to give a shout-out to that.
+        
+        * API/APICast.h: Added.
+        (toJS):
+        (toRef):
+        * API/JSBase.h: Added.
+        * API/JSCallbackObject.cpp: Added.
+        (KJS::):
+        (KJS::JSCallbackObject::JSCallbackObject):
+        (KJS::JSCallbackObject::~JSCallbackObject):
+        (KJS::JSCallbackObject::className):
+        (KJS::JSCallbackObject::getOwnPropertySlot):
+        (KJS::JSCallbackObject::put):
+        (KJS::JSCallbackObject::deleteProperty):
+        (KJS::JSCallbackObject::implementsConstruct):
+        (KJS::JSCallbackObject::construct):
+        (KJS::JSCallbackObject::implementsCall):
+        (KJS::JSCallbackObject::callAsFunction):
+        (KJS::JSCallbackObject::getPropertyList):
+        (KJS::JSCallbackObject::toBoolean):
+        (KJS::JSCallbackObject::toNumber):
+        (KJS::JSCallbackObject::toString):
+        (KJS::JSCallbackObject::setPrivate):
+        (KJS::JSCallbackObject::getPrivate):
+        (KJS::JSCallbackObject::cachedValueGetter):
+        (KJS::JSCallbackObject::callbackGetter):
+        * API/JSCallbackObject.h: Added.
+        (KJS::JSCallbackObject::classInfo):
+        * API/JSCharBufferRef.cpp: Added.
+        (JSStringMake):
+        (JSCharBufferCreate):
+        (JSCharBufferCreateUTF8):
+        (JSCharBufferRetain):
+        (JSCharBufferRelease):
+        (JSValueCopyStringValue):
+        (JSCharBufferGetLength):
+        (JSCharBufferGetCharactersPtr):
+        (JSCharBufferGetCharacters):
+        (JSCharBufferGetMaxLengthUTF8):
+        (JSCharBufferGetCharactersUTF8):
+        (JSCharBufferIsEqual):
+        (JSCharBufferIsEqualUTF8):
+        (JSCharBufferCreateWithCFString):
+        (CFStringCreateWithJSCharBuffer):
+        * API/JSCharBufferRef.h: Added.
+        * API/JSContextRef.cpp: Added.
+        (JSContextCreate):
+        (JSContextDestroy):
+        (JSContextGetGlobalObject):
+        (JSEvaluate):
+        (JSCheckSyntax):
+        (JSContextHasException):
+        (JSContextGetException):
+        (JSContextClearException):
+        (JSContextSetException):
+        * API/JSContextRef.h: Added.
+        * API/JSObjectRef.cpp: Added.
+        (JSValueToObject):
+        (JSObjectMake):
+        (JSFunctionMake):
+        (JSObjectGetDescription):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        (JSObjectIsConstructor):
+        (JSObjectCallAsConstructor):
+        (__JSPropertyListEnumerator::__JSPropertyListEnumerator):
+        (JSObjectCreatePropertyEnumerator):
+        (JSPropertyEnumeratorGetNext):
+        (JSPropertyEnumeratorRetain):
+        (JSPropertyEnumeratorRelease):
+        (JSPropertyListAdd):
+        * API/JSObjectRef.h: Added.
+        * API/JSValueRef.cpp: Added.
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSUndefinedMake):
+        (JSNullMake):
+        (JSBooleanMake):
+        (JSNumberMake):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSGCProtect):
+        (JSGCUnprotect):
+        (JSGCCollect):
+        * API/JSValueRef.h: Added.
+        * API/JavaScriptCore.h: Added.
+        * API/minidom.c: Added.
+        (main):
+        * API/minidom.html: Added.
+        * API/minidom.js: Added.
+        * API/testapi.c: Added.
+        (assertEqualsAsBoolean):
+        (assertEqualsAsNumber):
+        (assertEqualsAsUTF8String):
+        (assertEqualsAsCharactersPtr):
+        (assertEqualsAsCharacters):
+        (MyObject_initialize):
+        (MyObject_copyDescription):
+        (MyObject_hasProperty):
+        (MyObject_getProperty):
+        (MyObject_setProperty):
+        (MyObject_deleteProperty):
+        (MyObject_getPropertyList):
+        (MyObject_callAsFunction):
+        (MyObject_callAsConstructor):
+        (MyObject_convertToType):
+        (MyObject_finalize):
+        (print_callAsFunction):
+        (main):
+        (createStringWithContentsOfFile):
+        * API/testapi.js: Added.
+        * ChangeLog:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/npruntime_impl.h:
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstance::getPropertyList):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+        * kjs/nodes.cpp:
+        (ForInNode::execute):
+        * kjs/object.cpp:
+        (KJS::JSObject::put):
+        (KJS::JSObject::canPut):
+        (KJS::JSObject::deleteProperty):
+        (KJS::JSObject::propertyIsEnumerable):
+        (KJS::JSObject::getPropertyAttributes):
+        (KJS::JSObject::getPropertyList):
+        * kjs/object.h:
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::get):
+        * kjs/property_map.h:
+        * kjs/scope_chain.cpp:
+        (KJS::ScopeChain::print):
+        * kjs/string_object.cpp:
+        (StringInstance::getPropertyList):
+        * kjs/string_object.h:
+        * kjs/ustring.h:
+        (KJS::UString::Rep::ref):
+
+2006-06-20  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Geoff.
+
+        Make sure we clear the exception before returning so
+        that future calls will not fail because of an earlier
+        exception state. Assert on entry that the WebScriptObject
+        is working with an ExecState that dose not have an exception. 
+        Document that evaluateWebScript and callWebScriptMethod return
+        WebUndefined when an exception is thrown.
+
+        * bindings/objc/WebScriptObject.h:
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+
+2006-06-19  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by John.
+
+        * kjs/interpreter.cpp:
+        (KJS::TimeoutChecker::pauseTimeoutCheck):
+        (KJS::TimeoutChecker::resumeTimeoutCheck):
+        Fix argument order in setitimer calls.
+
+2006-06-18  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+
+        * kjs/interpreter.cpp:
+        (KJS::TimeoutChecker::pauseTimeoutCheck):
+        Do nothing if the timeout check hasn't been started.
+        
+        (KJS::TimeoutChecker::resumeTimeoutCheck):
+        Do nothing if the timeout check hasn't been started.
+        Use the right signal handler when unblocking.
+        
+        (KJS::Interpreter::handleTimeout):
+        pause/resume the timeout check around the call to
+        shouldInterruptScript().
+        
+2006-06-16  Ben Goodger <beng@google.com>
+        
+        Reviewed by Maciej
+
+        http://bugs.webkit.org/show_bug.cgi?id=9491
+        Windows build breaks in interpreter.cpp 
+
+        * kjs/interpreter.cpp
+        (KJS::TimeoutChecker::pauseTimeoutCheck):
+        (KJS::TimeoutChecker::resumeTimeoutCheck):
+        Make sure to only assert equality with s_executingInterpreter when it 
+        is being used (i.e. when HAVE(SYS_TIME_H) == true)
+
+2006-06-17  David Kilzer  <ddkilzer@kilzer.net>
+
+        Reviewed by darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=9477
+        REGRESSION: fast/dom/replaceChild.html crashes on WebKit ToT in debug build
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction): Refetch the debugger after executing the function
+        in case the WebFrame it was running in has since been destroyed.
+
+2006-06-17  David Kilzer  <ddkilzer@kilzer.net>
+
+        Reviewed by ggaren.
+
+        http://bugs.webkit.org/show_bug.cgi?id=9476
+        REGRESSION: Reproducible crash after closing window after viewing
+        css2.1/t0803-c5501-imrgn-t-00-b-ag.html
+
+        * kjs/debugger.cpp:
+        (Debugger::detach): Call setDebugger(0) for all interpreters removed from
+        the 'attached to a debugger' list.
+
+2006-06-17  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Maciej and Geoff.
+
+        http://bugs.webkit.org/show_bug.cgi?id=7080
+        Provide some way to stop a JavaScript infinite loop
+        
+        * kjs/completion.h:
+        (KJS::):
+        Add Interrupted completion type.
+        
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::GlobalFuncImp::callAsFunction):
+        Only set the exception on the new ExecState if the current one has had one.
+        
+        * kjs/interpreter.cpp:
+        (KJS::TimeoutChecker::startTimeoutCheck):
+        (KJS::TimeoutChecker::stopTimeoutCheck):
+        (KJS::TimeoutChecker::alarmHandler):
+        (KJS::TimeoutChecker::pauseTimeoutCheck):
+        (KJS::TimeoutChecker::resumeTimeoutCheck):
+        New TimeoutChecker class which handles setting Interpreter::m_timedOut flag after a given
+        period of time. This currently only works on Unix platforms where setitimer and signals are used.
+        
+        (KJS::Interpreter::Interpreter):
+        Initialize new member variables.
+        
+        (KJS::Interpreter::~Interpreter):
+        Destroy the timeout checker.
+        
+        (KJS::Interpreter::startTimeoutCheck):
+        (KJS::Interpreter::stopTimeoutCheck):
+        (KJS::Interpreter::pauseTimeoutCheck):
+        (KJS::Interpreter::resumeTimeoutCheck):
+        Call the timeout checker.
+        
+        (KJS::Interpreter::handleTimeout):
+        Called on timeout. Resets the m_timedOut flag and calls shouldInterruptScript.
+        
+        * kjs/interpreter.h:
+        (KJS::Interpreter::setTimeoutTime):
+        New function for setting the timeout time.
+        
+        (KJS::Interpreter::shouldInterruptScript):
+        New function. The idea is that this should be overridden by subclasses in order to for example
+        pop up a dialog asking the user if the script should be interrupted.
+        
+        (KJS::Interpreter::checkTimeout):
+        New function which checks the m_timedOut flag and calls handleTimeout if it's set.
+        
+        * kjs/nodes.cpp:
+        (DoWhileNode::execute):
+        (WhileNode::execute):
+        (ForNode::execute):
+        Call Interpreter::checkTimeout after each iteration of the loop.
+
+2006-06-15  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Geoff and Darin.
+        
+        Prefer the DWARF debugging symbols format for use in Xcode 2.3.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-06-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth.
+        
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=9438
+        Someone broke ToT: cannot build
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/runtime_root.h: Changed "Interpreter.h" to "interpreter.h"
+
+2006-06-12  Geoffrey Garen  <ggaren@apple.com>
+
+        build fix
+        
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject throwException:]): Restore assignment I accidentally
+        deleted in previous commit
+
+2006-06-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by TimO, Maciej.
+        
+        - Merged InterpreterImp code into Interpreter, which implements
+        all interpreter functionality now. This is part of my continuing quest
+        to create an external notion of JS "execution context" that is unified and simple --
+        something to replace the mix of Context, ContextImp, ExecState, Interpreter,
+        InterpreterImp, and JSRun.
+        
+        All tests pass. Leaks test has not regressed from its baseline ~207 leaks
+        with ~3460 leaked nodes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/NP_jsobject.cpp:
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject throwException:]):
+        * bindings/runtime_root.cpp:
+        * bindings/runtime_root.h:
+        * kjs/Context.cpp:
+        (KJS::Context::Context):
+        * kjs/ExecState.cpp: Added.
+        (KJS::ExecState::lexicalInterpreter):
+        * kjs/ExecState.h: Added.
+        (KJS::ExecState::dynamicInterpreter):
+        * kjs/SavedBuiltins.h: Added.
+        * kjs/bool_object.cpp:
+        (BooleanPrototype::BooleanPrototype):
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        (KJS::Collector::numInterpreters):
+        * kjs/context.h:
+        * kjs/debugger.cpp:
+        (Debugger::attach):
+        (Debugger::detach):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        (KJS::interpreterMap):
+        (KJS::Interpreter::Interpreter):
+        (KJS::Interpreter::init):
+        (KJS::Interpreter::~Interpreter):
+        (KJS::Interpreter::globalObject):
+        (KJS::Interpreter::initGlobalObject):
+        (KJS::Interpreter::globalExec):
+        (KJS::Interpreter::checkSyntax):
+        (KJS::Interpreter::evaluate):
+        (KJS::Interpreter::builtinObject):
+        (KJS::Interpreter::builtinFunction):
+        (KJS::Interpreter::builtinArray):
+        (KJS::Interpreter::builtinBoolean):
+        (KJS::Interpreter::builtinString):
+        (KJS::Interpreter::builtinNumber):
+        (KJS::Interpreter::builtinDate):
+        (KJS::Interpreter::builtinRegExp):
+        (KJS::Interpreter::builtinError):
+        (KJS::Interpreter::builtinObjectPrototype):
+        (KJS::Interpreter::builtinFunctionPrototype):
+        (KJS::Interpreter::builtinArrayPrototype):
+        (KJS::Interpreter::builtinBooleanPrototype):
+        (KJS::Interpreter::builtinStringPrototype):
+        (KJS::Interpreter::builtinNumberPrototype):
+        (KJS::Interpreter::builtinDatePrototype):
+        (KJS::Interpreter::builtinRegExpPrototype):
+        (KJS::Interpreter::builtinErrorPrototype):
+        (KJS::Interpreter::builtinEvalError):
+        (KJS::Interpreter::builtinRangeError):
+        (KJS::Interpreter::builtinReferenceError):
+        (KJS::Interpreter::builtinSyntaxError):
+        (KJS::Interpreter::builtinTypeError):
+        (KJS::Interpreter::builtinURIError):
+        (KJS::Interpreter::builtinEvalErrorPrototype):
+        (KJS::Interpreter::builtinRangeErrorPrototype):
+        (KJS::Interpreter::builtinReferenceErrorPrototype):
+        (KJS::Interpreter::builtinSyntaxErrorPrototype):
+        (KJS::Interpreter::builtinTypeErrorPrototype):
+        (KJS::Interpreter::builtinURIErrorPrototype):
+        (KJS::Interpreter::mark):
+        (KJS::Interpreter::interpreterWithGlobalObject):
+        (KJS::Interpreter::saveBuiltins):
+        (KJS::Interpreter::restoreBuiltins):
+        * kjs/interpreter.h:
+        (KJS::Interpreter::setCompatMode):
+        (KJS::Interpreter::compatMode):
+        (KJS::Interpreter::firstInterpreter):
+        (KJS::Interpreter::nextInterpreter):
+        (KJS::Interpreter::prevInterpreter):
+        (KJS::Interpreter::debugger):
+        (KJS::Interpreter::setDebugger):
+        (KJS::Interpreter::setContext):
+        (KJS::Interpreter::context):
+        * kjs/nodes.cpp:
+        (StatementNode::hitStatement):
+        (RegExpNode::evaluate):
+        * kjs/protect.h:
+
+2006-06-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - Have *.lut.h files #include lookup.h to eliminate surprising header
+        include order dependency.
+
+        * DerivedSources.make:
+        * kjs/array_object.cpp:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        (KJS::DateProtoFunc::):
+        * kjs/lexer.cpp:
+        * kjs/math_object.cpp:
+        * kjs/number_object.cpp:
+        * kjs/regexp_object.cpp:
+        * kjs/string_object.cpp:
+
+2006-06-10  Geoffrey Garen  <ggaren@apple.com>
+
+        - http://bugs.webkit.org/show_bug.cgi?id=8515
+        Linux porting compile bug
+        
+        Fix by Mike Emmel, Reviewed by Darin.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+        * wtf/Platform.h:
+
+2006-06-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix -- I think :).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/context.h:
+
+2006-06-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric (yay!).
+        
+        - Removed Context wrapper for ContextImp, renamed ContextImp to Context,
+        split Context into its own file -- Context.cpp -- renamed _var to m_var,
+        change ' *' to '* '.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/Context.cpp: Added.
+        (KJS::Context::Context):
+        (KJS::Context::~Context):
+        (KJS::Context::mark):
+        * kjs/context.h:
+        (KJS::Context::scopeChain):
+        (KJS::Context::variableObject):
+        (KJS::Context::setVariableObject):
+        (KJS::Context::thisValue):
+        (KJS::Context::callingContext):
+        (KJS::Context::activationObject):
+        (KJS::Context::currentBody):
+        (KJS::Context::function):
+        (KJS::Context::arguments):
+        (KJS::Context::pushScope):
+        (KJS::Context::seenLabels):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::FunctionImp::processParameters):
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::evaluate):
+        * kjs/internal.h:
+        (KJS::InterpreterImp::setContext):
+        (KJS::InterpreterImp::context):
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        (KJS::ExecState::context):
+        (KJS::ExecState::ExecState):
+        * kjs/nodes.cpp:
+        (currentSourceId):
+        (currentSourceURL):
+        (ThisNode::evaluate):
+        (ResolveNode::evaluate):
+        (FunctionCallResolveNode::evaluate):
+        (PostfixResolveNode::evaluate):
+        (DeleteResolveNode::evaluate):
+        (TypeOfResolveNode::evaluate):
+        (PrefixResolveNode::evaluate):
+        (AssignResolveNode::evaluate):
+        (VarDeclNode::evaluate):
+        (VarDeclNode::processVarDecls):
+        (DoWhileNode::execute):
+        (WhileNode::execute):
+        (ForNode::execute):
+        (ForInNode::execute):
+        (ContinueNode::execute):
+        (BreakNode::execute):
+        (ReturnNode::execute):
+        (WithNode::execute):
+        (SwitchNode::execute):
+        (LabelNode::execute):
+        (TryNode::execute):
+        (FuncDeclNode::processFuncDecl):
+        (FuncExprNode::evaluate):
+
+2006-06-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed API directory I prematurely/accidentally added.
+
+        * API: Removed.
+
+2006-06-05  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed and landed by Geoff.
+
+        - fix a regression in ecma_3/String/regress-104375.js
+
+        * kjs/string_object.cpp:
+        (substituteBackreferences): If a 2-digit back reference is out of range,
+        parse it as a 1-digit reference (followed by the other digit). This matches
+        Firefox's behavior.
+
+2006-06-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed By Maciej.
+        Darin already reviewed this change on the branch. See <rdar://problem/4317701>.
+        
+        - Fixed <rdar://problem/4291345> PCRE overflow in Safari JavaScriptCore
+
+        No test case because there's no behavior change.
+        
+        * pcre/pcre_compile.c:
+        (read_repeat_counts): Check for integer overflow / out of bounds
+
+2006-06-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by aliu.
+
+        - Changed CString length from int to size_t. We sould probably do this
+        for UString, too. (Darin, if you're reading this: Maciej said so.)
+        
+        * kjs/function.cpp:
+        (KJS::encode):
+        * kjs/ustring.cpp:
+        (KJS::CString::CString):
+        (KJS::operator==):
+        * kjs/ustring.h:
+        (KJS::CString::size):
+
+2006-06-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+        
+        - http://bugs.webkit.org/show_bug.cgi?id=9304
+        Minor cleanup in JavaScriptCore
+
+        * kjs/value.h: Removed redundant declarations
+
+2006-06-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - changed deleteAllValues so it can work on "const" collections
+          Deleting the values affects the values, not the pointers in the
+          collection, so it's legitimate to do it to a const collection,
+          and a case of that actually came up in the XPath code.
+
+        * wtf/HashMap.h:
+        (WTF::deleteAllPairSeconds): Use const iterators.
+        (WTF::deleteAllValues): Take const HashMap reference as a parameter.
+        * wtf/HashSet.h:
+        (WTF::deleteAllValues): Take const HashSet reference as a parameter,
+        and use const iterators.
+        * wtf/Vector.h:
+        (WTF::deleteAllValues): Take const Vector reference as a parameter.
+
+        - added more functions that are present in <math.h> on some platforms,
+          but not on others; moved here from various files in WebCore
+
+        * wtf/MathExtras.h:
+        (isinf): Added.
+        (isnan): Added.
+        (lround): Added.
+        (lroundf): Tweaked.
+        (round): Added.
+        (roundf): Tweaked.
+        (signbit): Added.
+
+2006-06-02  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by ggaren.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=9234
+          Implement $&, $' and $` replacement codes in String.prototype.replace
+
+        Test: fast/js/string-replace-3.html
+
+        * kjs/string_object.cpp:
+        (substituteBackreferences): Added support for $& (matched substring),
+        $` (everything preceding matched substring), $' (everything following
+        matched substring) and 2-digit back references, and cleaned up a little.
+
+2006-06-02 Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin.
+
+        Set incremental linking to no. This seems to fix a build problem I was seeing
+        where dftables couldn't find a dll. 
+
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
+
+2006-05-26  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fixes/tweaks
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+=== JavaScriptCore-521.11 ===
+
+2006-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by mjs.
+        
+        - JSC half of fix for <rdar://problem/4557926> TOT REGRESSSION: Crash
+        occurs when attempting to view image in slideshow mode at
+        http://d.smugmug.com/gallery/581716 ( KJS::IfNode::execute
+        (KJS::ExecState*) + 312)
+
+        On alternate threads, DOMObjects remain in the
+        ScriptInterpreter's cache because they're not collected. So, they
+        need an opportunity to mark their children.
+        
+        I'm not particularly happy with this solution because it fails to
+        resolve many outstanding issues with the DOM object cache. Since none
+        of those issues is a crasher or a serious compatibility concern,
+        and since the behavior of other browsers is not much to go on in this
+        case, I've filed <rdar://problem/4561439> about that, and I'm moving on 
+        with my life.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::mark):
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::mark):
+        * kjs/interpreter.h:
+
+=== JavaScriptCore-521.10 ===
+
+2006-05-22  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Eric, Kevin and Geoff.
+
+        Merge open source build fixes. <rdar://problem/4555500>
+
+        * kjs/collector.cpp: look at the rsp register in x86_64 
+        (KJS::Collector::markOtherThreadConservatively):
+        * wtf/Platform.h: add x86_64 to the platform list
+
+2006-05-19  Anders Carlsson  <acarlsson@apple.com>
+
+        Reviewed by Geoff.
+
+        http://bugs.webkit.org/show_bug.cgi?id=8993
+        Support function declaration in case statements
+        
+        * kjs/grammar.y: Get rid of StatementList and use SourceElements instead.
+        
+        * kjs/nodes.cpp:
+        (CaseClauseNode::evalStatements):
+        (CaseClauseNode::processVarDecls):
+        (CaseClauseNode::processFuncDecl):
+        (ClauseListNode::processFuncDecl):
+        (CaseBlockNode::processFuncDecl):
+        (SwitchNode::processFuncDecl):
+        * kjs/nodes.h:
+        (KJS::CaseClauseNode::CaseClauseNode):
+        (KJS::ClauseListNode::ClauseListNode):
+        (KJS::ClauseListNode::getClause):
+        (KJS::ClauseListNode::getNext):
+        (KJS::ClauseListNode::releaseNext):
+        (KJS::SwitchNode::SwitchNode):
+        Add processFuncDecl for the relevant nodes.        
+
+        * kjs/nodes2string.cpp:
+        (CaseClauseNode::streamTo):
+        next got renamed to source.
+
+2006-05-17  George Staikos <staikos@kde.org>
+
+        Reviewed by Maciej, Alexey, and Eric.
+
+        * pcre/pcre_compile.c:
+        * pcre/pcre_get.c:
+        * pcre/pcre_exec.c:
+        * wtf/UnusedParam.h:
+        Use /**/ in .c files to compile with non-C99 and non-GCC compilers.
+
+        * kjs/testkjs.cpp:
+        Change include to <wtf/HashTraits.h> from "HashTraits.h" to avoid -I
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        Use correct parentheses and correct mask for utf-32 support.
+
+2006-05-17  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=8870
+        Crash typing in Yahoo auto-complete widget.
+
+        Test: fast/js/regexp-stack-overflow.html
+
+        * pcre/pcre-config.h: Define NO_RECURSE.
+
+2006-05-16  George Staikos <staikos@kde.org>
+
+        Reviewed by Maciej.
+
+        Fix some warnings and strict compilation errors.
+
+        * kjs/nodes.cpp: 
+        * kjs/value.cpp: 
+
+2006-05-15  Alexey Proskuryakov  <ap@nypop.com>
+
+        * make-generated-sources.sh: Changed to be executable and removed
+        text in the file generated by "svn diff".
+
+2006-05-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+
+        - Fixed <rdar://problem/4534904> please do not treat "debugger" as
+        a reserved word while parsing JavaScript (and other ECMA reserved
+        words) 
+
+        AKA 
+
+        http://bugs.webkit.org/show_bug.cgi?id=6179 
+        We treat "char" as a reserved word in JavaScript and firefox/IE do
+        not
+
+        (1) I unreserved most of the spec's "future reserved words" because 
+        they're not reserved in IE or FF. (Most, but not all, because IE
+        somewhat randomly *does* reserve a few of them.)
+        (2) I made 'debugger' a legitimate statement that acts like an empty
+        statement because FF and IE support it.
+        
+        * kjs/grammar.y:
+        * kjs/keywords.table:
+
+2006-05-15  Tim Omernick  <timo@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Part of <rdar://problem/4466508> Add 64-bit support to the Netscape Plugin API
+
+        Added to the Netscape Plugin API the concept of "plugin drawing models".  The drawing model
+        determines the kind of graphics context created by the browser for the plugin, as well as 
+        the Mac types of various Netscape Plugin API data structures.
+
+        There is a drawing model to represent the old QuickDraw-based API.  It is used by default
+        if QuickDraw is available on the system, unless the plugin specifies another drawing model.
+
+        The big change is the addition of the CoreGraphics drawing model.  A plugin may request this
+        drawing model to obtain access to a CGContextRef for drawing, instead of a QuickDraw CGrafPtr.
+
+        * bindings/npapi.h:
+        Define NP_NO_QUICKDRAW when compiling 64-bit; there is no 64-bit QuickDraw.
+        Added NPNVpluginDrawingModel, NPNVsupportsQuickDrawBool, and NPNVsupportsCoreGraphicsBool
+        variables.
+        Added NPDrawingModel enumeration.  Currently the only drawing models are QuickDraw and
+        CoreGraphics.
+        NPRegion's type now depends on the drawing model specified by the plugin.
+        NP_Port is now only defined when QuickDraw is available.
+        Added NP_CGContext, which is the type of the NPWindow's "window" member in CoreGraphics mode.
+
+2006-05-13  Kevin M. Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin, landed by ap.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=8528
+          Bakefiles (and generated Makefiles) for wx and gdk ports
+
+        * make-generated-sources.sh: 
+        Added script to configure environment to run DerivedSources.make
+        
+        * JavaScriptCoreSources.bkl:
+        Added JavaScriptCore sources list for Bakefile.
+        
+        * jscore.bkl:
+        Bakefile used to generate JavaScriptCore project files 
+        (currently only used by wx and gdk ports)
+
+2006-05-09  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix Windows build.
+        Minor fixes to WTF headers.
+        
+        Reviewed by kevin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Fix include dirs, paths to files. 
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj: Fix include dirs.
+        * wtf/Assertions.h: include Platform.h to get definition for COMPILER()
+        * wtf/Vector.h: include FastMalloc.h for definition of fastMalloc, fastFree
+
+2006-05-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Anders.
+        
+        - renamed kxmlcore to wtf
+        
+        kxmlcore --> wtf
+        KXMLCore --> WTF
+        KXC --> WTF
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/c/c_instance.cpp:
+        * bindings/objc/WebScriptObject.mm:
+        * kjs/JSImmediate.h:
+        * kjs/Parser.cpp:
+        * kjs/Parser.h:
+        * kjs/array_object.cpp:
+        * kjs/collector.cpp:
+        (KJS::Collector::registerThread):
+        * kjs/collector.h:
+        * kjs/config.h:
+        * kjs/function.cpp:
+        (KJS::isStrWhiteSpace):
+        * kjs/function.h:
+        * kjs/identifier.cpp:
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/lexer.cpp:
+        (Lexer::shift):
+        (Lexer::isWhiteSpace):
+        (Lexer::isIdentStart):
+        (Lexer::isIdentPart):
+        * kjs/lookup.cpp:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/number_object.cpp:
+        * kjs/object.h:
+        * kjs/property_map.cpp:
+        * kjs/property_map.h:
+        * kjs/string_object.cpp:
+        (StringProtoFunc::callAsFunction):
+        * kjs/testkjs.cpp:
+        (testIsInteger):
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        * kxmlcore: Removed.
+        * kxmlcore/AlwaysInline.h: Removed.
+        * kxmlcore/Assertions.cpp: Removed.
+        * kxmlcore/Assertions.h: Removed.
+        * kxmlcore/FastMalloc.cpp: Removed.
+        * kxmlcore/FastMalloc.h: Removed.
+        * kxmlcore/FastMallocInternal.h: Removed.
+        * kxmlcore/Forward.h: Removed.
+        * kxmlcore/HashCountedSet.h: Removed.
+        * kxmlcore/HashFunctions.h: Removed.
+        * kxmlcore/HashMap.h: Removed.
+        * kxmlcore/HashSet.h: Removed.
+        * kxmlcore/HashTable.cpp: Removed.
+        * kxmlcore/HashTable.h: Removed.
+        * kxmlcore/HashTraits.h: Removed.
+        * kxmlcore/ListRefPtr.h: Removed.
+        * kxmlcore/Noncopyable.h: Removed.
+        * kxmlcore/OwnArrayPtr.h: Removed.
+        * kxmlcore/OwnPtr.h: Removed.
+        * kxmlcore/PassRefPtr.h: Removed.
+        * kxmlcore/Platform.h: Removed.
+        * kxmlcore/RefPtr.h: Removed.
+        * kxmlcore/TCPageMap.h: Removed.
+        * kxmlcore/TCSpinLock.h: Removed.
+        * kxmlcore/TCSystemAlloc.cpp: Removed.
+        * kxmlcore/TCSystemAlloc.h: Removed.
+        * kxmlcore/UnusedParam.h: Removed.
+        * kxmlcore/Vector.h: Removed.
+        * kxmlcore/VectorTraits.h: Removed.
+        * kxmlcore/unicode: Removed.
+        * kxmlcore/unicode/Unicode.h: Removed.
+        * kxmlcore/unicode/UnicodeCategory.h: Removed.
+        * kxmlcore/unicode/icu: Removed.
+        * kxmlcore/unicode/icu/UnicodeIcu.h: Removed.
+        * kxmlcore/unicode/posix: Removed.
+        * kxmlcore/unicode/qt3: Removed.
+        * kxmlcore/unicode/qt4: Removed.
+        * kxmlcore/unicode/qt4/UnicodeQt4.h: Removed.
+        * pcre/pcre_get.c:
+        * wtf: Added.
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::Scavenge):
+        (WTF::do_malloc):
+        (WTF::do_free):
+        (WTF::TCMallocGuard::TCMallocGuard):
+        (WTF::malloc):
+        (WTF::free):
+        (WTF::calloc):
+        (WTF::cfree):
+        (WTF::realloc):
+        * wtf/FastMalloc.h:
+        * wtf/FastMallocInternal.h:
+        * wtf/Forward.h:
+        * wtf/HashCountedSet.h:
+        * wtf/HashFunctions.h:
+        * wtf/HashMap.h:
+        * wtf/HashSet.h:
+        * wtf/HashTable.cpp:
+        * wtf/HashTable.h:
+        * wtf/HashTraits.h:
+        * wtf/ListRefPtr.h:
+        * wtf/Noncopyable.h:
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/PassRefPtr.h:
+        * wtf/RefPtr.h:
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemAlloc):
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        * wtf/unicode/UnicodeCategory.h:
+        * wtf/unicode/icu/UnicodeIcu.h:
+
+2006-05-08  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Tim O.
+
+        * bindings/npapi.h: do not define #pragma options align=mac68k if we are 64-bit
+
+2006-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed and landed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=8765
+        Random crashes on TOT since the form state change
+        
+        I haven't figured out how to construct a test for this, but this does seem to fix the
+        problem; Mitz mentioned that a double-destroy was occurring in these functions.
+        
+        * kxmlcore/HashMap.h: (KXMLCore::HashMap::remove): Use RefCounter::deref instead of calling
+        ~ValueType, because ~ValueType often results in a double-destroy, since the HashTable also
+        destroys the element based on the storage type. The RefCounter template correctly does work
+        only in cases where ValueType and ValueStorageType differ and this class is what's used
+        elsewhere for the same purpose; I somehow missed this case when optimizing HashMap.
+        * kxmlcore/HashSet.h: (KXMLCore::HashSet::remove): Ditto.
+        
+2006-05-05  Darin Adler  <darin@apple.com>
+
+        - http://bugs.webkit.org/show_bug.cgi?id=8722
+          IE compatibility fix in date parsing
+
+        * kjs/date_object.cpp: (KJS::parseDate): Merged change that George Staikos provided
+        from KDE 3.4.3 branch that allows day values of 0 and values that are > 1000.
+
+2006-05-04  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        http://bugs.webkit.org/show_bug.cgi?id=8734
+        Would like a Vector::append that takes another Vector
+        
+        * kxmlcore/Vector.h:
+        (KXMLCore::::append):
+        New function that takes another array.
+
+2006-05-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by eric.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: set NDEBUG for release build
+        * kxmlcore/FastMalloc.cpp: Prevent USE_SYSTEM_MALLOC from being defined twice
+
+2006-05-02  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        * kxmlcore/HashMap.h:
+        (KXMLCore::::operator):
+        Return *this
+
+2006-05-01  Tim Omernick  <timo@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/4476875> Support printing for embedded Netscape plugins
+
+        * bindings/npapi.h:
+        Fixed struct alignment problem in our npapi.h.  Structs must be 68k-aligned on both pre-Mac OS X
+        and Mac OS X systems, as this is what plugins expect.
+
+2006-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Maciej.
+        
+        <rdar://problem/4308243> 8F36 Regression: crash in malloc_consolidate if you use a .PAC file
+
+        The original fix missed the oversized cell case. Added a test for "currentThreadIsMainThread || 
+        imp->m_destructorIsThreadSafe" where we collect oversized cells.
+
+        We don't have a way to test PAC files yet, so there's no test attached.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect): test the thread when we collect oversized cells
+
+2006-05-01  Tim Omernick  <timo@apple.com>
+
+        Reviewed by Adele.
+
+        <rdar://problem/4526114> REGRESSION (two days ago): LOG() just prints @ for NSObject substitutions
+
+        * kxmlcore/Assertions.cpp:
+        Changed sense of strstr("%@") check.  I already made the same fix to the WebBrowser assertions.
+
+2006-04-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by kdecker
+        
+        Actually apply the change that was reviewed insted of checking it in with an #if 0 (oops).
+
+        * kjs/testkjs.cpp:
+        (main): Suppress C runtime alerts
+
+2006-04-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by kdecker
+
+        Suppress error reporting dialog that blocks Javascript tests from completing.
+        
+        Real error is due to an overflow in the date/time handling functions that needs
+        to be addressed, but this will prevent the hang running the Javascript tests
+        on the build bot (along with the related changes).
+        
+        * kjs/testkjs.cpp:
+        (main): Suppress C runtime alerts
+
+2006-04-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej
+
+        - Minor fixups I discovered while working on the autogenerator.
+        
+        * kjs/lookup.cpp:
+        (findEntry): ASSERT that size is not 0, because otherwise we'll % by 0,
+        compute a garbage address, and possibly crash.
+        * kjs/lookup.h:
+        (cacheGlobalObject): Don't enumerate cached objects -- ideally, they
+        would be hidden entirely.
+
+2006-04-21  Kevin M. Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=8507
+          Compilation fixes for building on gcc 4.0.2, and without precomp headers
+
+        * kjs/operations.h:
+        * kxmlcore/Assertions.cpp:
+        * kxmlcore/FastMalloc.cpp:
+        Added necessary headers to resolve compilation issues when not using
+        precompiled headers.
+        
+        * kjs/value.h: Declare the JSCell class before friend declaration  
+        to resolve compilation issues with gcc 4.0.2.
+        
+        * kxmlcore/Platform.h: Set Unicode support to use ICU on platforms
+        other than KDE (previously only defined for Win and Mac OS)
+                
+2006-04-18  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by ggaren.
+
+        Fix "new Function()" to correctly use lexical scoping.
+        Add ScopeChain::print() function for debugging.
+        <rdar://problem/4067864> REGRESSION (125-407): JavaScript failure on PeopleSoft REN Server
+
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/scope_chain.cpp:
+        (KJS::ScopeChain::print):
+        * kjs/scope_chain.h:
+
+2006-04-14  James G. Speth  <speth@end.com>
+
+        Reviewed by Timothy.
+
+        Bug 8389: support for Cocoa bindings - binding an NSTreeController to the WebView's DOM
+        http://bugs.webkit.org/show_bug.cgi?id=8389
+
+        Adds a category to WebScriptObject with array accessors for KVC/KVO.
+
+        If super valueForKey: fails it will call valueForUndefinedKey:, which is
+        important because it causes the right behavior to happen with bindings using
+        the "Raises for Not Applicable Keys" flag and the "Not Applicable Placeholder"
+
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject count]):
+        (-[WebScriptObject objectAtIndex:]):
+        (-[WebUndefined description]): return "undefined"
+
+2006-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::initGlobalObject): Add the built-in object
+        prototype to the end of the global object's prototype chain instead of
+        just blowing away its existing prototype. We need to do this because
+        the window object has a meaningful prototype now.
+
+2006-04-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - fix testkjs to not show false-positive KJS::Node leaks in debug builds
+
+        * kjs/testkjs.cpp:
+        (doIt):
+        (kjsmain):
+
+2006-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+
+        Minor code cleanup -- passes all the JS tests.
+
+        * kjs/object_object.cpp:
+        (ObjectObjectImp::construct):
+        (ObjectObjectImp::callAsFunction):
+
+2006-04-11  Darin Adler  <darin@apple.com>
+
+        - another attempt to fix Windows build -- Vector in Forward.h was not working
+
+        * kxmlcore/Forward.h: Remove Vector.
+        * kxmlcore/Vector.h: Add back default arguments, remove include of
+        Forward.h.
+
+2006-04-11  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build -- HashForward.h was not working
+
+        * kxmlcore/HashForward.h: Removed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Remove HashForward.h.
+        * kjs/collector.h: Remove use of HashForward.h.
+        * kxmlcore/HashCountedSet.h: Remove include of HashForward.h, restore
+        default arguments.
+        * kxmlcore/HashMap.h: Ditto.
+        * kxmlcore/HashSet.h: Ditto.
+
+2006-04-11  David Harrison  <harrison@apple.com>
+
+        Reviewed by Darin.
+
+        - fixed clean build, broken by Darin's check-in
+
+        * kjs/date_object.cpp: Add needed include of lookup.h.
+        * kjs/regexp_object.cpp: Move include of .lut.h file below other includes.
+
+2006-04-10  Darin Adler  <darin@apple.com>
+
+        Rubber-stamped by John Sullivan.
+
+        - switched from a shell script to a makefile for generated files
+        - removed lots of unneeded includes
+        - added new Forward.h and HashForward.h headers that allow compiling with
+          fewer unneeded templates
+
+        * DerivedSources.make: Added.
+        * generate-derived-sources: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new files, changed to use
+        DerivedSources.make.
+
+        * kxmlcore/Forward.h: Added.
+        * kxmlcore/HashForward.h: Added.
+
+        * kxmlcore/HashCountedSet.h: Include HashForward for default args.
+        * kxmlcore/HashMap.h: Ditto.
+        * kxmlcore/HashSet.h: Ditto.
+
+        * kjs/object.h:
+        * kjs/object.cpp:
+        Moved KJS_MAX_STACK into the .cpp file.
+
+        * bindings/NP_jsobject.cpp:
+        * bindings/c/c_instance.h:
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_runtime.h:
+        * bindings/jni/jni_utility.h:
+        * bindings/objc/WebScriptObject.mm:
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/objc/objc_class.h:
+        * bindings/objc/objc_class.mm:
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        * bindings/objc/objc_runtime.mm:
+        * bindings/objc/objc_utility.mm:
+        * bindings/runtime.h:
+        * bindings/runtime_array.cpp:
+        * bindings/runtime_array.h:
+        * bindings/runtime_method.cpp:
+        * bindings/runtime_method.h:
+        * bindings/runtime_object.cpp:
+        * bindings/runtime_root.h:
+        * kjs/JSImmediate.cpp:
+        * kjs/Parser.h:
+        * kjs/array_object.cpp:
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        * kjs/bool_object.h:
+        * kjs/collector.h:
+        * kjs/context.h:
+        * kjs/debugger.cpp:
+        * kjs/error_object.h:
+        * kjs/function_object.h:
+        * kjs/internal.h:
+        * kjs/lexer.cpp:
+        * kjs/math_object.cpp:
+        * kjs/math_object.h:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/number_object.cpp:
+        * kjs/number_object.h:
+        * kjs/object_object.cpp:
+        * kjs/operations.cpp:
+        * kjs/protected_reference.h:
+        * kjs/reference.h:
+        * kjs/reference_list.h:
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        * kjs/string_object.h:
+        * kjs/testkjs.cpp:
+        * kjs/value.cpp:
+        * kjs/value.h:
+        * kxmlcore/HashTable.h:
+        * kxmlcore/ListRefPtr.h:
+        * kxmlcore/TCPageMap.h:
+        * kxmlcore/Vector.h:
+        Removed unneeded header includes.
+
+2006-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by eric.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=8284
+        prevent unnecessary entries in the "nodes with extra refs" hash table
+
+        This patch switches manually RefPtr exchange with use of
+        RefPtr::release to ensure that a node's ref count never tops 1
+        (in the normal case).
+
+        * kjs/nodes.cpp:
+        (BlockNode::BlockNode):
+        (CaseBlockNode::CaseBlockNode):
+        * kjs/nodes.h:
+        (KJS::ArrayNode::ArrayNode):
+        (KJS::ObjectLiteralNode::ObjectLiteralNode):
+        (KJS::ArgumentsNode::ArgumentsNode):
+        (KJS::VarStatementNode::VarStatementNode):
+        (KJS::ForNode::ForNode):
+        (KJS::CaseClauseNode::CaseClauseNode):
+        (KJS::FuncExprNode::FuncExprNode):
+        (KJS::FuncDeclNode::FuncDeclNode):
+
+2006-04-08  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        One more attempt - use reinterpret_cast, rather than static_cast.
+
+2006-04-08  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        An attempt to fix Win32 build - ICU uses wchar_t on Windows, so we need a type cast.
+
+        * kxmlcore/unicode/icu/UnicodeIcu.h:
+        (KXMLCore::Unicode::toLower):
+        (KXMLCore::Unicode::toUpper):
+
+2006-04-08  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=8264
+        toLowerCase and toUpperCase don't honor special mappings
+
+        Test: fast/js/string-capitalization.html
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added KXMLCore::Unicode headers to the project.
+        * icu/unicode/putil.h: Added (copied from WebCore).
+        * icu/unicode/uiter.h: Ditto.
+        * icu/unicode/ustring.h: Ditto.
+        * kjs/string_object.cpp:
+        (StringProtoFunc::callAsFunction): Use the new KXMLCore::Unicode::toUpper() and toLower().
+        * kjs/ustring.cpp: Removed unused (and evil) UChar::toLower() and toUpper().
+        * kjs/ustring.h: Ditto.
+
+        * kxmlcore/unicode/Unicode.h: Corrected capitalization of the word Unicode.
+        * kxmlcore/unicode/UnicodeCategory.h: Renamed include guard macro to match file name.
+
+        * kxmlcore/unicode/icu/UnicodeIcu.h:
+        (KXMLCore::Unicode::toLower): Work on strings, not individual characters. Use ICU root locale.
+        (KXMLCore::Unicode::toUpper): Ditto.
+        (KXMLCore::Unicode::isFormatChar): Use int32_t, which can hold a complete code point.
+        (KXMLCore::Unicode::isSeparatorSpace): Ditto.
+        (KXMLCore::Unicode::category): Ditto.
+        * kxmlcore/unicode/qt4/UnicodeQt4.h:
+        (KXMLCore::Unicode::toLower): Work on strings, not individual characters.
+        (KXMLCore::Unicode::toUpper): Ditto.
+        (KXMLCore::Unicode::isFormatChar): Use int32_t, which can hold a complete code point.
+        (KXMLCore::Unicode::isSeparatorSpace): Ditto.
+        (KXMLCore::Unicode::category): Ditto.
+
+        * tests/mozilla/ecma/String/15.5.4.12-1.js: Corrected expected results.
+        * tests/mozilla/ecma/String/15.5.4.12-5.js: Corrected expected results.
+
+2006-04-05  Darin Adler  <darin@apple.com>
+
+        - attempt to fix Windows build
+
+        * kxmlcore/HashMap.h: (KXMLCore::HashMap::remove): Use (*it). instead of it->.
+        * kxmlcore/HashSet.h: (KXMLCore::HashSet::remove): Ditto.
+
+2006-04-05  Darin Adler  <darin@apple.com>
+
+        - attempt to fix Windows build
+
+        * os-win32/stdint.h: Add int8_t, uint8_t, int64_t.
+
+2006-04-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix memory leak introduced by the previous change
+
+        * kxmlcore/HashTable.h: Specialize NeedsRef so that it correctly returns true when
+        the value in question is a pair where one of the pair needs a ref and the other
+        of the pair does not.
+
+2006-04-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - JavaScriptCore part of fix for http://bugs.webkit.org/show_bug.cgi?id=8049
+          StringImpl hash traits deleted value creates an init routine for WebCore
+          <rdar://problem/4442248> REGRESSION: WebCore has init routines (8049)
+
+        Change HashMap and HashSet implementation so they fold various types together.
+        This allows us to implement maps and sets that use RefPtr<WebCore::StringImpl>
+        and WebCore::String in terms of the underlying raw pointer type, and hence use
+        -1 for the deleted value.
+
+        * kxmlcore/HashTraits.h: Added a new type to HashTraits, StorageTraits, which is a
+        type to be used when storing a value that has the same layout as the type itself.
+        This is used only for non-key cases. In the case of keys, the hash function must also
+        be considered. Moved emptyValue out of GenericHashTraitsBase into GenericHashTraits.
+        Added a new bool to HashTraits, needsRef, which indicates whether the type needs
+        explicit reference counting. If the type itself has needsRef true, but the storage
+        type has needsRef false, then the HashSet or HashMap has to handle the reference
+        counting explicitly. Added hash trait specializations for all signed integer values
+        that give -1 as the deleted value. Gave all integers StorageTraits of the canonical
+        integer type of the same size so int and long will share code. Gave all pointers and
+        RefPtrs StorageTraits of the appropriately sized integer type. Removed redundant
+        TraitType and emptyValue definitions in the pointer specialization for HashTraits.
+        Added PairBaseHashTraits, which doesn't try to set up needsDestruction and deletedValue.
+        Useful for types where we don't want to force the existence of deletedValue, such as
+        the type of a pair in a HashMap which is not the actual storage type. Removed an
+        unneeded parameter from the DeletedValueAssigner template. Added HashKeyStorageTraits
+        template, which determines what type can be used to store a given hash key type with
+        a given hash function, and specialized it for pointers and RefPtr so that pointer
+        hash tables share an underlying HashTable that uses IntHash.
+
+        * kxmlcore/HashTable.h: Added HashTableConstIteratorAdapter, HashTableIteratorAdapter,
+        NeedsRef, RefCountManagerBase, RefCountManager, HashTableRefCountManagerBase, and
+        HashTableRefCountManager. All are used by both HashSet and HashMap to handle hash
+        tables where the type stored is not the same as the real value type.
+        
+        * kxmlcore/HashFunctions.h: Added a new struct named IntTypes that finds an
+        integer type given a sizeof value. Renamed pointerHash to intHash and made it
+        use overloading and take integer parameters. Added an IntHash struct which is
+        a hash function that works for integers. Changed PtrHash to call IntHash with
+        an appropriately sized integer. Made IntHash the default hash function for
+        many integer types. Made PtrHash the default hash function for RefPtr as well
+        as for raw pointers.
+
+        * kxmlcore/HashSet.h: Changed implementation to use a separate "storage type"
+        derived from the new traits. The HashTable will use the storage type and all
+        necessary translation and ref/deref is done at the HashSet level. Also reorganized
+        the file so that the HashSet is at the top and has no inline implementation inside
+        it so it's easy to read the interface to HashSet.
+
+        * kxmlcore/HashMap.h: Changed implementation to use a separate "storage type"
+        derived from the new traits. The HashTable will use the storage type and all
+        necessary translation and ref/deref is done at the HashMap level. Also reorganized
+        the file so that the HashMap is at the top and has no inline implementation inside
+        it so it's easy to read the interface to HashMap.
+
+        * kxmlcore/HashMapPtrSpec.h: Removed. Superceded by optimizations in HashMap itself.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Remove HashMapPtrSpec.h, resort files,
+        and also remove some unnecessary build settings from the aggregate target that
+        generates derived sources.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+
+2006-04-04  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin.
+
+        The Debug and Release frameworks are now built with install paths relative to the build products directory.
+        This removes the need for other projects to build with -framework WebCore and -framework JavaScriptCore. 
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-04-04  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by ggaren.
+
+        Fix win32 build.
+        Disable ASSERT redefinition warnings for now.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+        * kxmlcore/Assertions.h:
+
+2006-04-04  Bjrn Graf  <bjoern.graf@gmail.com>
+
+        Reviewed by ggaren & darin.  Landed by eseidel.
+
+        Integrate CURL version of gettimeofday
+        http://bugs.webkit.org/show_bug.cgi?id=7399
+        Disable crash report dialogs for testkjs.exe in Release mode
+        http://bugs.webkit.org/show_bug.cgi?id=8113
+
+        * kjs/testkjs.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+        (StopWatch::getElapsedMS):
+        (main):
+        (kjsmain):
+
+2006-04-04  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        * kjs/number_object.cpp:
+        (NumberProtoFunc::callAsFunction): remove trunc() to fix win32.
+
+2006-03-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - fixed "toPrecision sometimes messes up the last digit on intel Macs"
+        http://bugs.webkit.org/show_bug.cgi?id=7748
+
+        * kjs/number_object.cpp:
+        (intPow10): Compute integer powers of 10 using exponentiation by squaring.
+        (NumberProtoFunc::callAsFunction): Use intPow10(n) in place of all pow(10.0, n),
+        plus a bit of refactoring.
+
+2006-04-03  Darin Adler  <darin@apple.com>
+
+        - tweak config.h and Platform.h to try to get buildbot working
+          (making some small changes at the same time)
+
+        * kjs/config.h: Removed now-unneeded HAVE_ICU.
+        * kxmlcore/Platform.h: Tweak how platform gets set up. Move all the
+        USE stuff to the end.
+
+2006-04-03  George Staikos   <staikos@opensource.apple.com>
+
+        Reviewed by Maciej.
+
+        Fix Win32 build breakage from previous commit, remove unused forward.
+
+2006-04-03  George Staikos   <staikos@opensource.apple.com>
+
+        Reviewed by Maciej.
+
+        Implement a unicode abstraction layer to make JavaScriptCore much more
+        easily ported to other platforms without having to take in libicu.  Also
+        makes the unicode related code easier to understand.
+
+2006-04-03  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Adele.
+
+        Fixes <rdar://problem/4498338> JavaScriptCore fails to compile for ppc64
+        Other 64 bit build fixes.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::markOtherThreadConservatively): test for __DARWIN_UNIX03 and use __r1
+        * kjs/dtoa.cpp:
+        (Bigint::): cast PRIVATE_mem to unsigned to prevent warning
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::getJavaVM): cast jniError to long to prevent format warning
+        (KJS::Bindings::getJNIEnv): cast jniError to long to prevent format warning
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::addNativeReference): cast CFDictionaryGetValue to unsigned long to prevent warning
+        (KJS::Bindings::removeNativeReference): cast CFDictionaryGetValue to unsigned long to prevent warning
+
+2006-03-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - <rdar://problem/4395622> API: WebScriptObject.h incorrectly reports that -isSelectorExcludedFromWebScript returns NO by default
+
+        * bindings/objc/WebScriptObject.h: Fixed comment.
+
+2006-03-31  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        A bit more code cleanup.
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant):
+        * bindings/objc/objc_runtime.mm:
+        (convertValueToObjcObject):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/interpreter.cpp:
+        (KJS::ExecState::lexicalInterpreter):
+        * kjs/interpreter.h:
+        * kjs/operations.cpp:
+        (KJS::equal):
+
+2006-03-30  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by anders.
+
+        Small code-style update.
+
+        * kjs/operations.cpp:
+        (KJS::isNaN):
+        (KJS::isInf):
+        (KJS::isPosInf):
+        (KJS::isNegInf):
+        (KJS::equal):
+        (KJS::strictEqual):
+        (KJS::relation):
+        (KJS::maxInt):
+        (KJS::minInt):
+        (KJS::add):
+        (KJS::mult):
+
+2006-03-31  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        Make sure the GetterSetterImp objects are marked as well.
+        
+        * kjs/internal.cpp:
+        (KJS::GetterSetterImp::mark):
+        Call JSCell::mark().
+
+2006-03-30  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by ggaren.
+
+        * kjs/nodes.h: Some various small style fixes.
+
+2006-03-30  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by ggaren.
+
+        Clean-up style issues in node.h, remove redundant initializations.
+
+        * kjs/nodes.h:
+        (KJS::StatementNode::evaluate):
+        (KJS::ArrayNode::ArrayNode):
+        (KJS::ObjectLiteralNode::ObjectLiteralNode):
+        (KJS::ArgumentsNode::ArgumentsNode):
+        (KJS::NewExprNode::NewExprNode):
+        (KJS::CaseClauseNode::CaseClauseNode):
+        (KJS::FuncDeclNode::FuncDeclNode):
+
+2006-03-30  Tim Omernick  <timo@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/4212626> REGRESSION: LIVECONNECT: JavaScript type for Java Strings is function,
+        not object
+
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::implementsCall):
+        New method.  Returns false by default.  Concrete subclasses can override this return true when
+        the bound object may be called as a function.
+        (KJS::Bindings::Instance::invokeDefaultMethod):
+        Since bound objects are no longer treated as functions by default, we can return jsUndefined()
+        here instead of in concrete subclasses that decide not to implement the default method
+        functionality.
+
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::implementsCall):
+        Don't assume that the bound object is a function; instead, let the object instance decide whether
+        it is callable.
+
+        * bindings/c/c_instance.h:
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::implementsCall):
+        The object is callable if its class has an invokeDefault function.
+
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::implementsCall):
+        The object is callable if the ObjC instance responds to -invokeDefaultMethodWithArguments:.
+
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_instance.cpp:
+        Moved bogus invokeDefaultMethod() to superclass.
+
+2006-03-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        - JavaScriptCore side of fix for <rdar://problem/4308243> 8F36 
+        Regression: crash in malloc_consolidate if you use a .PAC file
+
+        The crash was a result of threaded deallocation of thread-unsafe
+        objects. Pure JS objects are thread-safe because all JS execution
+        is synchronized through JSLock. However, JS objects that wrap WebCore 
+        objects are thread-unsafe because JS and WebCore execution are not 
+        synchronized.  That unsafety comes into play when the collector 
+        deallocates a JS object that wraps a WebCore object, thus causing the 
+        WebCore object to be deallocated.
+
+        The solution here is to have each JSCell know whether it is safe to
+        collect on a non-main thread, and to avoid collecting unsafe cells
+        when on a non-main thread.
+
+        We don't have a way to test PAC files yet, so there's no test
+        attached to this patch.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        (1) Added the test "currentThreadIsMainThread || 
+        imp->m_destructorIsThreadSafe". 
+
+        * kjs/protect.h:
+        (KJS::gcProtectNullTolerant):
+        (KJS::gcUnprotectNullTolerant):
+        * kjs/value.h:
+        (KJS::JSCell::JSCell): The bools here must be bitfields, otherwise
+        m_destructorIsThreadSafe becomes another whole word, ruining the
+        collector optimizations we've made based on the size of a JSObject.
+        * kxmlcore/FastMalloc.cpp:
+        (KXMLCore::currentThreadIsMainThread):
+        (KXMLCore::fastMallocRegisterThread):
+        * kxmlcore/FastMalloc.h:
+
+2006-03-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - change some code that resulted in init routines on Mac OS X -- if the framework has
+          init routines it will use memory and slow down applications that link with WebKit
+          even in cases where those applications don't use WebKit
+
+        * kjs/date_object.cpp: Changed constants that were derived by multiplying other constants
+        to use immediate numbers instead. Apparently, double constant expressions of the type we
+        had here are evaluated at load time.
+
+        * kjs/list.cpp: Can't use OwnArrayPtr in ListImp because of the global instances of
+        ListImp, so go back to using a plain old pointer.
+        (KJS::List::List): Set overflow to 0 when initializing ListImp.
+        (KJS::List::release): Replace a clear call with a delete and explicit set to 0.
+        (KJS::List::append): Use raw pointers, and do a delete [] instead of finessing it with
+        a swap of OwnArrayPtr.
+        (KJS::List::copyFrom): Remove now-unneeded get().
+        (KJS::List::copyTail): Ditto.
+
+        * kjs/ustring.cpp: Changed UString::Rep::empty initializer a bit so that it doesn't get
+        a static initializer routine. Had to get rid of one level of constant to get the compiler
+        to understand it could initialize without any code.
+
+        - added a build step that checks for init routines
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Deleted now-unused custom build rule that
+        was replaced by the generate-derived-sources script a while back. Added a custom build
+        phase that invokes the check-for-global-initializers script.
+
+2006-03-28  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Eric.
+
+        fixes <rdar://problem/4458539> Unable to include Security(public) and WebKit(private) headers
+
+        * bindings/npapi.h: added #defines after the #ifndefs
+
+2006-03-27  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Anders.
+        
+        - fixed <rdar://problem/4489745> REGRESSION: Safari crashes at to display http://www.lgphilips-lcd.com/
+
+        * kjs/nodes.cpp:
+        (Node::deref): take into account the case where the extra refcount table was never created
+
+2006-03-23  David Carson <dacarson@gmail.com>
+
+        Reviewed by Darin.
+        
+        - JSObject in LiveConnect not working.
+        http://bugs.webkit.org/show_bug.cgi?id=7917
+
+        * bindings/jni_jsobject.cpp:
+        (JavaJSObject::convertJObjectToValue): Was trying to retrieve the native pointer from the wrong base
+        class, and the GetFieldID was using the wrong signature.
+
+2006-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix buildbot
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Change target name to JavaScriptCore (it was "include"!?).
+        Also add -Y 3 option for linker.
+
+2006-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=7726
+          REGRESSION: orbitz calendar fails (JavaScript function serialization/parsing)
+
+        * kjs/object.h: Take function name, as well as source URL and line number, when
+        using the special overloaded construct for making functions.
+        * kjs/object.cpp: (KJS::JSObject::construct): Ditto.
+        * kjs/function_object.h: Ditto.
+        * kjs/function_object.cpp: (FunctionObjectImp::construct): Pass a name when
+        constructing the function rather than null. Use "anonymous" when making a
+        function using the default function constructor.
+
+        * kjs/nodes2string.cpp: (FuncDeclNode::streamTo): Put a line break just before
+        a function declaration.
+
+        - unrelated fix
+
+        * kxmlcore/HashMapPtrSpec.h: Add missing needed friend declaration.
+
+2006-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=7805
+          LEAK: method name leaks in KJS::Bindings::CInstance::invokeMethod
+
+        * bindings/c/c_utility.h: Remove NPN_UTF16FromString declaration (not implemented).
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant): Use DOUBLE_TO_NPVARIANT,
+        BOOLEAN_TO_NPVARIANT, VOID_TO_NPVARIANT, NULL_TO_NPVARIANT, and
+        OBJECT_TO_NPVARIANT. In the case of OBJECT, call _NPN_RetainObject in
+        one case and remove a _NPN_ReleaseObject in another because this
+        should return a retained value.
+        (KJS::Bindings::convertNPVariantToValue): Use NPVARIANT_TO_BOOLEAN,
+        NPVARIANT_TO_INT32, and NPVARIANT_TO_DOUBLE.
+
+        * bindings/c/c_runtime.h: Removed implementations of CMethod::name and
+        CField::name that called _NPN_UTF8FromIdentifier and hence leaked.
+        * bindings/c/c_runtime.cpp:
+        (KJS::Bindings::CMethod::name): Added. Returns the string from inside the
+        method object.
+        (KJS::Bindings::CField::name): Added. Returns the string from inside the
+        field object.
+        (KJS::Bindings::CField::valueFromInstance): Added call to _NPN_ReleaseVariantValue
+        on the result of getProperty after using it to fix a storage leak.
+        (KJS::Bindings::CField::setValueToInstance): Added call to _NPN_ReleaseVariantValue
+        after pasing a value to setProperty now that the conversion function does a retain.
+
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::invokeMethod): Changed to use Vector for a local
+        stack buffer. Removed special case for NPVARIANT_IS_VOID because the
+        convertNPVariantToValue function handles that properly.
+        (KJS::Bindings::CInstance::invokeDefaultMethod): Ditto.
+
+        * bindings/NP_jsobject.h: Formatting changes only.
+        * bindings/NP_jsobject.cpp:
+        (jsDeallocate): Changed parameter type so we don't need a function cast.
+        (_NPN_InvokeDefault): Use VOID_TO_NPVARIANT.
+        (_NPN_Invoke): Use NULL_TO_NPVARIANT and VOID_TO_NPVARIANT.
+        (_NPN_Evaluate): Use VOID_TO_NPVARIANT.
+        (_NPN_GetProperty): Use NULL_TO_NPVARIANT and VOID_TO_NPVARIANT.
+
+        * bindings/c/c_class.cpp: Formatting changes only.
+        * bindings/c/c_class.h: Formatting changes only.
+
+        * bindings/npruntime_priv.h: Removed obsolete and now-unused functions:
+        NPN_VariantIsVoid, NPN_VariantIsNull, NPN_VariantIsUndefined,
+        NPN_VariantIsBool, NPN_VariantIsInt32, NPN_VariantIsDouble,
+        NPN_VariantIsString, NPN_VariantIsObject, NPN_VariantToBool,
+        NPN_VariantToInt32, NPN_VariantToDouble, NPN_VariantToString,
+        NPN_VariantToStringCopy, NPN_VariantToObject, NPN_InitializeVariantAsVoid,
+        NPN_InitializeVariantAsNull, NPN_InitializeVariantAsUndefined,
+        NPN_InitializeVariantWithBool, NPN_InitializeVariantWithInt32,
+        NPN_InitializeVariantWithDouble, NPN_InitializeVariantWithString,
+        NPN_InitializeVariantWithObject, and NPN_InitializeVariantWithVariant.
+        * bindings/npruntime.cpp:
+        (getIntIdentifierDictionary): Don't bother creating custom callbacks for the
+        integer dictionary since the default behavior is fine for integers.
+
+2006-03-23  Mark Rowe  <opendarwin.org@bdash.net.nz>
+
+        Reviewed and landed by Maciej.
+
+        - WebKit no longer builds with bison 2.1
+        http://bugs.webkit.org/show_bug.cgi?id=7923
+
+        * generate-derived-sources:  Handle generated header named either grammar.cpp.h
+        or grammar.hpp.
+
+2006-03-22  Maciej Stachowiak  <mjs@apple.com>
+
+        - fix the build
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-03-21  Maciej Stachowiak  <mjs@apple.com>
+
+        * kjs/generate-derived-sources: Set executable property.
+
+2006-03-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        Ensure that generated source dependencies are handled properly, as follows:
+        
+        - Made an external script that generates the sources into a
+          DerivedSources dir in the build products directory.
+        - Added a new build target that builds all the generated sources
+          if needed. Sadly it has to be a target, not a phase for Xcode to notice changes.
+        - Added the DerivedSources dir in question to the include path.
+        - Added the new DerivedSources dir and its contents to the project as build-relative.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/generate-derived-sources: Added. Based on the windows version - maybe someday they
+        can share more.
+
+2006-03-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - fixed "charAt layout test fails on intel macs; some NaNs are printed as -NaN"
+        http://bugs.webkit.org/show_bug.cgi?id=7745
+
+        * kjs/ustring.cpp:
+        (KJS::UString::from): Use "NaN" for all NaN values, regardless of sign.
+
+2006-03-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - tweaks to my change to redo KJS::Node refcounting
+
+        * kjs/nodes.cpp:
+        (Node::ref):
+        (Node::deref):
+        (Node::refcount):
+        (Node::clearNewNodes):
+        * kjs/nodes.h:
+
+2006-03-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed Vector so that you can pass a reference to something in the vector
+          to the append or insert functions
+
+        * kxmlcore/Vector.h:
+        (KXMLCore::Vector::expandCapacity): Added new overloads that take a pointer to adjust
+        and return the adjusted value of the pointer.
+        (KXMLCore::Vector::append): Pass a pointer when expanding the vector, and use it when
+        adding the new element. Makes the case where the element moves when the vector
+        is expanded work.
+        (KXMLCore::Vector::insert): Ditto.
+
+2006-03-15  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by adele.
+
+        Build fix.
+
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFunc::callAsFunction): use size() not "len()"
+
+2006-03-15  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        Fix CString copy constructor, fixes Date.parse("") on Win32.
+
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFunc::callAsFunction):
+        * kjs/ustring.cpp:
+        (KJS::CString::CString):
+        (KJS::CString::operator=):
+
+2006-03-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Anders.
+        
+        - KJS::Node and KJS::StatementNode are bigger than they need to be
+        http://bugs.webkit.org/show_bug.cgi?id=7775
+
+        The memory usage of Node was reduced by 2 machine words per node:
+
+        - sourceURL was removed and only kept on FunctionBodyNode. The
+        source URL can only be distinct per function or top-level program node, 
+        and you always have one.
+        
+        - refcount was removed and kept in a separate hashtable when
+        greater than 1. newNodes set represents floating nodes with
+        refcount of 0. This helps because almost all nodes have a refcount of 1
+        for almost all of their lifetime.
+        
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::RuntimeMethod): Pass null body, added FIXME.
+        * kjs/Parser.cpp:
+        (KJS::clearNewNodes): New nodes are tracked in nodes.cpp now, but still clear
+        them at the appropriate time.
+        * kjs/context.h:
+        (KJS::ContextImp::currentBody): added; used to retrieve source URL and sid
+        for current code.
+        (KJS::ContextImp::pushIteration): moved here from LabelStack
+        (KJS::ContextImp::popIteration): ditto
+        (KJS::ContextImp::inIteration): ditto
+        (KJS::ContextImp::pushSwitch): ditto
+        (KJS::ContextImp::popSwitch): ditto
+        (KJS::ContextImp::inSwitch): ditto
+        * kjs/function.cpp:
+        (KJS::FunctionImp::FunctionImp): Add FunctionBodyNode* parameter.
+        (KJS::FunctionImp::callAsFunction): Pass body to ContextImp.
+        (KJS::FunctionImp::argumentsGetter): _context renamed to m_context.
+        (KJS::DeclaredFunctionImp::DeclaredFunctionImp): Pass body to superclass
+        constructor.
+        (KJS::GlobalFuncImp::callAsFunction): Pass progNode as body for ContextImp in
+        eval.
+        * kjs/function.h: Move body field from DeclaredFunctionImp to
+        FunctionImp.
+        * kjs/grammar.y: Change DBG; statements no longer have a sourceid.
+        * kjs/internal.cpp:
+        (KJS::ContextImp::ContextImp): Initialize new m_currentBody, m_iterationDepth
+        and m_switchDepth data members. New FunctionBodyNode* parameter - the
+        function body provides source URL and SourceId.
+        (KJS::InterpreterImp::mark): Use exception() function, not _exception directly.
+        (KJS::InterpreterImp::evaluate): Pass progNode to ContextImp constructor
+        to use as the body.
+        * kjs/internal.h:
+        (KJS::LabelStack::LabelStack): Remove iteration depth and switch depth;
+        statement label stacks don't need these and it bloats their size. Put them
+        in the ContextImp instead.
+        * kjs/interpreter.cpp:
+        (KJS::ExecState::lexicalInterpreter): Renamed _context to m_context.
+        * kjs/interpreter.h:
+        (KJS::ExecState::dynamicInterpreter): Renamed _context to m_context.
+        (KJS::ExecState::context): ditto
+        (KJS::ExecState::setException): Renamed _exception to m_exception
+        (KJS::ExecState::clearException): ditto
+        (KJS::ExecState::exception): ditto
+        (KJS::ExecState::hadException): ditto
+        (KJS::ExecState::ExecState): ditto both above renames
+        * kjs/nodes.cpp:
+        (Node::Node): Removed initialization of line, source URL and refcount. Add to
+        local newNodes set instead of involving parser.
+        (Node::ref): Instead of managing refcount directly, story refcount over 1 in a
+        HashCountedSet, and keep a separate HashSet of "floating" nodes with refcount
+        0.
+        (Node::deref): ditto
+        (Node::refcount): ditto
+        (Node::clearNewNodes): Destroy anything left in the new nodes set.
+        (currentSourceId): Inline helper to get sourceId from function body via context.
+        (currentSourceURL): ditto for sourceURL.
+        (Node::createErrorCompletion): use new helper
+        (Node::throwError): ditto
+        (Node::setExceptionDetailsIfNeeded): ditto
+        (StatementNode::StatementNode): remove initialization of l0 and sid, rename
+        l1 to m_lastLine.
+        (StatementNode::setLoc): Set own m_lastLine and Node's m_line.
+        (StatementNode::hitStatement): Get sid, first line, last line in the proper new ways.
+        (StatListNode::StatListNode): updated for setLoc changes
+        (BlockNode::BlockNode): ditto
+        (DoWhileNode::execute): excpect iteraton counts on ContextImp, not LabelStack
+        (WhileNode::execute): ditto
+        (ForNode::execute): ditto
+        (ForInNode::execute): ditto
+        (ContinueNode::execute): excpect inIteration on ContextImp, not LabelStack
+        (BreakNode::execute): excpect inIteration and inSwitch on ContextImp, not LabelStack
+        (SwitchNode::execute): expect switch counts on ContextImp, not LabelStack
+        (FunctionBodyNode::FunctionBodyNode): update for new setLoc
+        (FunctionBodyNode::processFuncDecl): reindent
+        (SourceElementsNode::SourceElementsNode): update for new setLoc
+        * kjs/nodes.h:
+        (KJS::Node::lineNo): Renamed _line to m_line
+        (KJS::StatementNode::firstLine): Use lineNo()
+        (KJS::StatementNode::lastLine): Renamed l1 to m_lastLine
+        (KJS::FunctionBodyNode::sourceId): added
+        (KJS::FunctionBodyNode::sourceURL): added
+        * kjs/testkjs.cpp:
+
+2006-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        - Fixed <rdar://problem/4478239> string sort puts "closed" before 
+        "close"
+
+        Reviewed by Eric.
+
+        * kjs/ustring.cpp:
+        (KJS::compare): Inverted a < in order to treat the longer string as > 
+        the shorter string.
+
+2006-03-12  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=7708
+        REGRESSION: Flash callback to JavaScript function not working.
+
+        Test: plugins/invoke.html
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertUTF8ToUTF16): Return a correct string length.
+
+2006-03-08  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by darin.
+
+        Partially fix JS on win32 by fixing hash table generation.
+
+        * kjs/create_hash_table: limit << results to 32 bits.
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction):
+
+2006-03-07  Darin Adler  <darin@apple.com>
+
+        * kxmlcore/Vector.h: Quick fix to try to get Windows compiling again.
+
+2006-03-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=7655
+          unwanted output while running layout tests
+
+        * kjs/lexer.cpp: (Lexer::lex): Turn off the "yylex: ERROR" message.
+        * kjs/regexp.cpp: (KJS::RegExp::RegExp): Remove the code to log errors from PCRE
+        to standard output. I think we should arrange for the error text to be in JavaScript
+        exceptions instead at some point.
+        * kxmlcore/Vector.h: Add a check for overflow so that we'll abort if we pass a
+        too-large size rather than allocating a buffer smaller than requested.
+
+2006-03-06  David Carson <dacarson@gmail.com>
+
+        Reviewed by Darin, landed by ap.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=7582
+        c_utility.cpp contains CFString OS X platform-dependent code; should use ICU
+
+        Tested with test case from:
+        http://bugs.webkit.org/show_bug.cgi?id=5163
+
+        * bindings/c_utility.cpp
+        (convertUTF8ToUTF16): Changed to using Unicode converter from ICU, and manual Latin-1 conversion.
+        * icu/unicode/ucnv.h: Copied from WebCore.
+        * icu/unicode/ucnv_err.h: Ditto.
+        * icu/unicode/uenum.h: Ditto.
+
+2006-03-05  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Updated.
+
+2006-03-06  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Fix suggested by Alexey Proskuryakov <ap@nypop.com>, reviewed by Maciej and Hyatt.
+        
+        - fix http://bugs.webkit.org/show_bug.cgi?id=7601
+          REGRESSION (r13089): Reproducible crash dereferencing a deallocated element on google image search
+
+        * kxmlcore/Platform.h: Corrected the define to enable USE(MULTIPLE_THREADS) on Mac OS X.
+
+2006-03-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=7616
+          get all references to KJS::Node out of internal.h
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated for file changes.
+
+        * kjs/Parser.cpp: Added.
+        * kjs/Parser.h: Added.
+
+        * kjs/internal.cpp: Removed the Parser class.
+        * kjs/internal.h: Ditto. Also removed unnecessary declarations of classes
+        not used in this header.
+
+        * kjs/nodes.h: Added an include of "Parser.h".
+        * kjs/function.h: Added a declaration of FunctionBodyNode.
+
+2006-03-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej.
+
+        - JSC support for the fix for <rdar://problem/4467143> JavaScript 
+        enumeration of HTML element properties skips DOM node properties
+
+        * kjs/lookup.h: 
+        (1) Added the KJS_DEFINE_PROTOTYPE_WITH_PROTOTYPE macro. The 
+        class definiton macro needs to know about the prototype's prototype so 
+        that the class constructor properly sets it. 
+        (2) Removed the KJS_IMPLEMENT_PROTOTYPE_WITH_PARENT macro. The class
+        implementation macro does not need to know about the prototype's
+        prototype, since getOwnPropertySlot should only look in the current 
+        object's property map, and not its prototype's.
+
+2006-03-05  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Eric, landed by ap.
+        
+        - Remove unused breakpoint bool from StatementNodes. No test provided as
+        there is no functionality change.
+
+        * kjs/nodes.cpp:
+        (StatementNode::StatementNode):
+        * kjs/nodes.h:
+
+2006-03-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        - Fixed <rdar://problem/4465598> REGRESSION (TOT): Crash occurs at 
+        http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)
+
+        This regression was caused by my fix for 4448098. I failed to account for the
+        deleted entry sentinel in the mehtod that saves the contents of a property map to 
+        the back/forward cache.
+
+        Manual test in WebCore/manual-tests/property-map-save-crash.html
+
+        * kjs/property_map.cpp:
+        (KJS::deletedSentinel): Use 1 instead of -1 to facilitate an easy bit mask
+        (KJS::isValid): New function: checks if a key is null or the deleted sentinel
+        (KJS::PropertyMap::~PropertyMap): Fixed up the branch logic here for readability
+        and a slight performance win
+        (KJS::PropertyMap::clear):
+        (KJS::PropertyMap::rehash):
+        (KJS::PropertyMap::addSparseArrayPropertiesToReferenceList):
+        (KJS::PropertyMap::save): Check keys with isValid()
+
+2006-03-02  Maciej Stachowiak  <mjs@apple.com>
+
+        - now fix mac build again
+
+        * kjs/identifier.cpp:
+
+2006-03-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Anders and Eric.
+
+        - add fpconst.cpp to win32 build, it is now needed
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * kjs/fpconst.cpp:
+
+2006-03-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - fix windows build, broken by my last patch
+
+        * kjs/JSImmediate.cpp:
+        * kjs/identifier.cpp:
+        * kxmlcore/FastMalloc.cpp:
+        * kxmlcore/Platform.h:
+
+2006-03-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - Set up new prototype macros and avoid using #if without defined() in JSC
+        
+        Added new PLATFORM macros and related, to make sure #if's all check if relevant macros
+        are defined, and to separate core OS-level dependencies from operating environment
+        dependencies so you can, e.g., build KDE on Mac or Windows.
+
+        * kxmlcore/Platform.h: Added.
+
+        - deploy them everywhere in JavaScriptCore
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::convertValueToJValue):
+        * bindings/objc/WebScriptObject.mm:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::end):
+        * bindings/softlinking.h:
+        * bindings/testbindings.mm:
+        (main):
+        * kjs/JSLock.cpp:
+        * kjs/collector.cpp:
+        (KJS::Collector::markCurrentThreadConservatively):
+        (KJS::Collector::markOtherThreadConservatively):
+        (KJS::Collector::markStackObjectsConservatively):
+        * kjs/config.h:
+        * kjs/date_object.cpp:
+        (gmtoffset):
+        (KJS::formatTime):
+        (KJS::DateProtoFunc::callAsFunction):
+        (KJS::DateObjectImp::construct):
+        (KJS::makeTime):
+        * kjs/dtoa.cpp:
+        * kjs/fpconst.cpp:
+        (KJS::sizeof):
+        (KJS::):
+        * kjs/grammar.y:
+        * kjs/identifier.cpp:
+        * kjs/internal.cpp:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+        (KJS::Interpreter::createLanguageInstanceForValue):
+        * kjs/interpreter.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/math_object.cpp:
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/operations.cpp:
+        (KJS::isNaN):
+        (KJS::isInf):
+        (KJS::isPosInf):
+        (KJS::isNegInf):
+        * kjs/operations.h:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        (KJS::RegExp::~RegExp):
+        (KJS::RegExp::match):
+        * kjs/regexp.h:
+        * kjs/testkjs.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+        (StopWatch::getElapsedMS):
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        * kxmlcore/AlwaysInline.h:
+        * kxmlcore/Assertions.cpp:
+        * kxmlcore/Assertions.h:
+        * kxmlcore/FastMalloc.cpp:
+        (KXMLCore::):
+        * kxmlcore/FastMalloc.h:
+        * kxmlcore/FastMallocInternal.h:
+        * kxmlcore/HashTable.h:
+        * kxmlcore/TCPageMap.h:
+        * kxmlcore/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * kxmlcore/TCSystemAlloc.cpp:
+        (TCMalloc_SystemAlloc):
+        * os-win32/stdint.h:
+
+2006-02-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        - Fixed <rdar://problem/4448098> Switch PropertyMap deleted entry 
+        placeholder to -1 from UString::Rep::null
+
+        This turned out to be only a small speedup (.12%). That's within the 
+        margin of error for super accurate JS iBench, but Shark confirms the 
+        same, so I think it's worth landing.
+
+        FYI, I also confirmed that the single entry optimization in 
+        PropertyMap is a 3.2% speedup.
+
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::~PropertyMap):
+        (KJS::PropertyMap::clear):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::insert):
+        (KJS::PropertyMap::rehash):
+        (KJS::PropertyMap::remove):
+        (KJS::PropertyMap::addSparseArrayPropertiesToReferenceList):
+        (KJS::PropertyMap::checkConsistency):
+        * kjs/property_map.h:
+        (KJS::PropertyMap::deletedSentinel):
+
+2006-02-27  Eric Seidel  <eseidel@apple.com>
+
+        Rubber-stamped by darin.
+
+        Remove fpconst.cpp, unused on win32 and the cause of linker warnings.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2006-02-27  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        Fix Assertions.cpp to compile on win32.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * kxmlcore/Assertions.cpp:
+
+2006-02-27  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        Made Assertions.cpp platform independent.
+        Moved mac-specific logging logic up into WebCore.
+        http://bugs.webkit.org/show_bug.cgi?id=7503
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kxmlcore/Assertions.cpp: Added.
+        * kxmlcore/Assertions.h:
+        * kxmlcore/Assertions.mm: Removed.
+
+2006-02-27  Darin Adler  <darin@apple.com>
+
+        - fixed Mac Debug build, there was an unused parameter
+
+        * kxmlcore/FastMalloc.cpp: (KXMLCore::fastMallocRegisterThread):
+        Remove parameter name.
+
+        * kjs/debugger.h: Fixed comment.
+
+2006-02-27  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by darin.
+
+        * kxmlcore/Vector.h:
+        (KXMLCore::deleteAllValues): fix unused variable warning
+
+2006-02-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - Turn off -Wno-unused-param for JavaScriptCore and get rid of unused params
+        http://bugs.webkit.org/show_bug.cgi?id=7384
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/NP_jsobject.cpp:
+        (jsAllocate):
+        (_NPN_InvokeDefault):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        * bindings/c/c_class.h:
+        (KJS::Bindings::CClass::constructorAt):
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertNPVariantToValue):
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::methodsNamed):
+        (JavaClass::fieldNamed):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeDefaultMethod):
+        * bindings/jni/jni_jsobject.cpp:
+        * bindings/jni/jni_objc.mm:
+        (-[NSObject KJS::Bindings::]):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebUndefined allocWithZone:]):
+        (-[WebUndefined initWithCoder:]):
+        (-[WebUndefined encodeWithCoder:]):
+        (-[WebUndefined copyWithZone:]):
+        * bindings/objc/objc_class.h:
+        (KJS::Bindings::ObjcClass::constructorAt):
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::methodsNamed):
+        (KJS::Bindings::ObjcClass::fallbackObject):
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::getValueOfUndefinedField):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::getOwnPropertySlot):
+        (ObjcFallbackObjectImp::put):
+        (ObjcFallbackObjectImp::canPut):
+        (ObjcFallbackObjectImp::deleteProperty):
+        (ObjcFallbackObjectImp::toBoolean):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createLanguageInstanceForValue):
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::getValueOfUndefinedField):
+        (KJS::Bindings::Instance::setValueOfUndefinedField):
+        * bindings/runtime_array.cpp:
+        (RuntimeArray::lengthGetter):
+        (RuntimeArray::indexGetter):
+        (RuntimeArray::put):
+        (RuntimeArray::deleteProperty):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::lengthGetter):
+        (RuntimeMethod::execute):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::fallbackObjectGetter):
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::methodGetter):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+        (RuntimeObjectImp::deleteProperty):
+        (RuntimeObjectImp::defaultValue):
+        (RuntimeObjectImp::callAsFunction):
+        * bindings/runtime_root.cpp:
+        (performJavaScriptAccess):
+        * kjs/array_object.cpp:
+        (ArrayInstance::lengthGetter):
+        (ArrayInstance::getOwnPropertySlot):
+        (ArrayPrototype::ArrayPrototype):
+        (ArrayPrototype::getOwnPropertySlot):
+        * kjs/bool_object.cpp:
+        (BooleanObjectImp::BooleanObjectImp):
+        * kjs/date_object.cpp:
+        (KJS::DateObjectFuncImp::DateObjectFuncImp):
+        (KJS::DateObjectFuncImp::callAsFunction):
+        * kjs/error_object.cpp:
+        (ErrorObjectImp::ErrorObjectImp):
+        (NativeErrorPrototype::NativeErrorPrototype):
+        (NativeErrorImp::NativeErrorImp):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::Arguments::mappedIndexGetter):
+        (KJS::ActivationImp::argumentsGetter):
+        (KJS::ActivationImp::put):
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::FunctionObjectImp):
+        * kjs/internal.cpp:
+        (KJS::GetterSetterImp::toPrimitive):
+        (KJS::GetterSetterImp::toBoolean):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+        * kjs/interpreter.h:
+        (KJS::Interpreter::isGlobalObject):
+        (KJS::Interpreter::interpreterForGlobalObject):
+        (KJS::Interpreter::isSafeScript):
+        * kjs/lexer.cpp:
+        (Lexer::makeIdentifier):
+        (Lexer::makeUString):
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter):
+        (KJS::staticValueGetter):
+        * kjs/nodes.cpp:
+        (StatementNode::processFuncDecl):
+        (PropertyNode::evaluate):
+        (PropertyNameNode::evaluate):
+        * kjs/number_object.cpp:
+        (NumberObjectImp::NumberObjectImp):
+        (NumberObjectImp::getOwnPropertySlot):
+        * kjs/object.cpp:
+        (KJS::JSObject::defineGetter):
+        (KJS::JSObject::defineSetter):
+        (KJS::JSObject::hasInstance):
+        (KJS::JSObject::propertyIsEnumerable):
+        * kjs/object_object.cpp:
+        (ObjectObjectImp::ObjectObjectImp):
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::undefinedGetter):
+        (KJS::PropertySlot::functionGetter):
+        * kjs/reference.cpp:
+        (KJS::Reference::getPropertyName):
+        * kjs/reference_list.cpp:
+        (ReferenceListIterator::operator++):
+        * kjs/regexp_object.cpp:
+        (RegExpObjectImp::RegExpObjectImp):
+        (RegExpObjectImp::getValueProperty):
+        (RegExpObjectImp::putValueProperty):
+        * kjs/string_object.cpp:
+        (StringInstance::lengthGetter):
+        (StringInstance::indexGetter):
+        (StringPrototype::StringPrototype):
+        * kxmlcore/Assertions.mm:
+        * kxmlcore/FastMalloc.cpp:
+        (KXMLCore::TCMalloc_PageHeap::CheckList):
+        * kxmlcore/HashTable.h:
+        (KXMLCore::HashTableConstIterator::checkValidity):
+        (KXMLCore::IdentityHashTranslator::translate):
+        * pcre/pcre_get.c:
+        (pcre_get_stringnumber):
+
+2006-02-23  Darin Adler  <darin@apple.com>
+
+        - try to fix buildbot failure
+
+        * bindings/c/c_utility.cpp: Touch this file, which seems to not have been
+        recompiled after additional inlining was introduced (Xcode bug?).
+
+2006-02-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin, Maciej.
+
+        - Inline some functions suggested by Shark. 2.9% speedup on super
+        accurate JS iBench.
+
+        http://bugs.webkit.org/show_bug.cgi?id=7411
+        <rdar://problem/4448116>
+
+        * kjs/nodes.h:
+        (KJS::ArgumentsNode::evaluateList):
+        * kjs/object.cpp:
+        * kjs/object.h:
+        (KJS::ScopeChain::release):
+        (KJS::JSObject::toPrimitive):
+        * kjs/scope_chain.cpp:
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        (KJS::UString::toArrayIndex):
+        * kjs/value.cpp:
+        * kjs/value.h:
+        (KJS::JSValue::toObject):
+        * kxmlcore/FastMalloc.cpp:
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::Push):
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::Pop):
+
+2006-02-21  Eric Seidel  <eseidel@apple.com>
+
+        Added *.user to ignore list.
+
+2006-02-21  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by ggaren.
+
+        Add grammarWrapper.cpp to work around visual studio bug plaguing buildbot.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/grammarWrapper.cpp: Added.
+
+2006-02-21  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by ggaren.
+
+        * kjs/testkjs.cpp: #if out timeval code on win32
+
+2006-02-21  Michael Emmel  <mike.emmel@gmail.com>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=7397
+          TCPageMap.h would not compile for me because string.h was missing
+
+        * kxmlcore/TCPageMap.h: Added <string.h> include.
+
+2006-02-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=7404
+          remove a bunch of extra implementsCall overrides
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Sorted files.
+
+        * kjs/internal.h: Made InternalFunctionImp::callAsFunction pure virtual so that
+        we'll get a compile error if some derived class neglects to implement it.
+
+        * kjs/function.cpp: (KJS::FunctionImp::FunctionImp): Remove unneeded initialization
+        of param, which is an OwnPtr so it gets initialized by default.
+
+        * bindings/runtime_method.cpp:
+        * bindings/runtime_method.h:
+        * kjs/array_object.cpp:
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        * kjs/bool_object.h:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        * kjs/error_object.cpp:
+        * kjs/error_object.h:
+        * kjs/function.cpp:
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        * kjs/function_object.h:
+        * kjs/math_object.cpp:
+        * kjs/math_object.h:
+        * kjs/number_object.cpp:
+        * kjs/number_object.h:
+        * kjs/object_object.cpp:
+        * kjs/object_object.h:
+        * kjs/regexp_object.cpp:
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        * kjs/string_object.h:
+        Removed many rendundant implementations of implementsCall from subclasses of
+        InternalFunctionImp.
+
+2006-02-21  Darin Adler  <darin@apple.com>
+
+        - fixed build
+
+        * kjs/internal.cpp: (KJS::InternalFunctionImp::implementsCall):
+        Oops, fixed name.
+
+2006-02-21  Darin Adler  <darin@apple.com>
+
+        Change suggested by Mitz.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=7402
+          REGRESSION: Methods do not execute
+
+        * kjs/internal.h: Add implementsHasCall to InternalFunctionImp.
+        * kjs/internal.cpp: (KJS::InternalFunctionImp::implementsHasCall):
+        Return true. All the classes derived from InternalFunctionImp need
+        to return true from this -- later we can remove all the extra
+        implementations too.
+
+2006-02-21  Maciej Stachowiak  <mjs@apple.com>
+
+        - fix build breakage caused by last-minute change to my patch
+
+        * kjs/lookup.h:
+
+2006-02-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff and Darin.
+        
+        Patch from Maks Orlovich, based on work by David Faure, hand-applied and 
+        significantly reworked by me.
+        
+        - Patch: give internal function names (KJS merge)
+        http://bugs.webkit.org/show_bug.cgi?id=6279
+
+        * tests/mozilla/expected.html: Updated for newly fixed test.
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::ArrayProtoFunc):
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        (BooleanPrototype::BooleanPrototype):
+        (BooleanProtoFunc::BooleanProtoFunc):
+        * kjs/bool_object.h:
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFunc::DateProtoFunc):
+        (KJS::DateObjectImp::DateObjectImp):
+        (KJS::DateObjectFuncImp::DateObjectFuncImp):
+        * kjs/error_object.cpp:
+        (ErrorPrototype::ErrorPrototype):
+        (ErrorProtoFunc::ErrorProtoFunc):
+        * kjs/error_object.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::FunctionImp):
+        (KJS::GlobalFuncImp::GlobalFuncImp):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (FunctionPrototype::FunctionPrototype):
+        (FunctionProtoFunc::FunctionProtoFunc):
+        (FunctionProtoFunc::callAsFunction):
+        * kjs/function_object.h:
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::initGlobalObject):
+        (KJS::InternalFunctionImp::InternalFunctionImp):
+        * kjs/internal.h:
+        (KJS::InternalFunctionImp::functionName):
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter):
+        (KJS::HashEntryFunction::HashEntryFunction):
+        (KJS::HashEntryFunction::implementsCall):
+        (KJS::HashEntryFunction::toBoolean):
+        (KJS::HashEntryFunction::implementsHasInstance):
+        (KJS::HashEntryFunction::hasInstance):
+        * kjs/math_object.cpp:
+        (MathFuncImp::MathFuncImp):
+        * kjs/math_object.h:
+        * kjs/number_object.cpp:
+        (NumberPrototype::NumberPrototype):
+        (NumberProtoFunc::NumberProtoFunc):
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        (KJS::JSObject::putDirectFunction):
+        (KJS::Error::create):
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        (ObjectPrototype::ObjectPrototype):
+        (ObjectProtoFunc::ObjectProtoFunc):
+        * kjs/object_object.h:
+        * kjs/regexp_object.cpp:
+        (RegExpPrototype::RegExpPrototype):
+        (RegExpProtoFunc::RegExpProtoFunc):
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (StringProtoFunc::StringProtoFunc):
+        (StringObjectImp::StringObjectImp):
+        (StringObjectFuncImp::StringObjectFuncImp):
+        * kjs/string_object.h:
+        
+2006-02-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin, with help from Eric, Maciej.
+
+        - More changes to support super-accurate JS iBench. Doesn't work on 
+        Windows. (Doesn't break Windows, either.) I've filed 
+        [http://bugs.webkit.org/show_bug.cgi?id=7399] about that. 
+
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate): Print line numbers with exception output
+        * kjs/testkjs.cpp: Changed " *" to "* " because Eric says that's the 
+        way we roll with .cpp files.
+        (StopWatch::StopWatch): New class. Provides microsecond-accurate 
+        timings.
+        (StopWatch::~StopWatch):
+        (StopWatch::start):
+        (StopWatch::stop):
+        (StopWatch::getElapsedMS):
+        (TestFunctionImp::callAsFunction): Added missing return statement. 
+        Fixed up "run" to use refactored helper functions. Removed bogus 
+        return statement from "quit" case. Made "print" output to stdout 
+        instead of stderr because that makes more sense, and PERL handles 
+        stdout better.
+        (main): Factored out KXMLCore unit tests. Removed custom exception 
+        printing code because the interpreter prints exceptions for you. Added 
+        a "delete" call for the GlobalImp we allocate.
+        (testIsInteger): New function, result of refacotring.
+        (createStringWithContentsOfFile): New function, result of refactoring. 
+        Renamed "code" to "buffer" to match factored-out-ness.
+
+2006-02-20  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by hyatt.
+
+        Fix "Copy ICU DLLs..." phase.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+
+2006-02-19  Darin Adler  <darin@apple.com>
+
+        - renamed ERROR to LOG_ERROR to fix build
+          presumably Maciej had this change and forgot to land it
+
+        * kjs/collector.cpp: Removed now-unneeded #undef ERROR.
+        * kxmlcore/Assertions.h: Renamed ERROR to LOG_ERROR.
+        * kxmlcore/FastMalloc.cpp: Changed MESSAGE macro to use LOG_ERROR.
+
+2006-02-18  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Test: fast/js/toString-exception.html
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=7343
+          REGRESSION: fast/js/toString-overrides.html fails when run multiple times
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction): Remove the object from the visited elements set before
+        returning an error.
+
+2006-02-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=7345
+          add insert and remove to KXMLCore::Vector
+
+        * kxmlcore/Vector.h: Added "moveOverlapping", which is used in both
+        insert and remove to slide elements within the vector. Also added
+        "insert" and "remove" functions.
+
+2006-02-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John.
+
+        - Fixed <rdar://problem/4448534> TOT REGRESSION: crash in KJS::
+        Bindings::Instance::deref when leaving page @ gigaom.com
+
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::~CInstance): Since we cache the class object
+        globally, we shouldn't delete it, so don't.
+
+2006-02-16  Timothy Hatcher  <timothy@apple.com>
+
+        Added -Wno-deprecated-declarations to all the ObjC binding files to prevent deprecation
+        warnings. Using <rdar://problem/4448350> to track this.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/objc/objc_jsobject.h: Removed empty file.
+        * bindings/objc/objc_jsobject.mm: Removed empty file.
+
+2006-02-16  Tim Omernick  <timo@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/4428609> Flash Player 8.0.22 can crash Safari (and WebKit apps) with
+        javascript disabled (7015)
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_CreateNoScriptObject):
+        Returns an NPObject which is not bound to a JavaScript object.  This kind of NPObject
+        can be given to a plugin as the "window script object" when JavaScript is disabled.
+        The object has a custom NPClass, NPNoScriptObjectClass, which has no defined methods.
+        Because of this, none of the NPN_* functions called by the plugin on this "no script
+        object" will cause entry into JavaScript code.
+        (_NPN_InvokeDefault):
+        Make sure the NPVariant is filled before returning from this function.  This never
+        mattered before because we never reached this case, having only created NPObjects of
+        the class NPScriptObjectClass.
+        (_NPN_Invoke):
+        ditto
+        (_NPN_Evaluate):
+        ditto
+        (_NPN_GetProperty):
+        ditto
+
+        * bindings/NP_jsobject.h:
+        Declared _NPN_CreateNoScriptObject().
+
+2006-02-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by me, change by Peter Kuemmel.
+
+        * kjs/operations.cpp: (KJS::isNegInf): Fix Windows code, which was
+        checking for positive infinity (rolling in fix from KDE side).
+
+2006-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej, Eric.
+
+        - JavaScriptCore half of fix for <rdar://problem/4176077> CrashTracer: 6569
+        crashes in DashboardClient at com.apple.JavaScriptCore:
+        KJS::Bindings::ObjcFallbackObjectImp::type()
+
+        WebCore and JavaScriptCore weren't sharing Instance objects very
+        nicely. I made them use RefPtrs, and sent them to bed without dessert.
+
+        * bindings/jni/jni_instance.cpp: Made _instance a RefPtr
+        (JavaInstance::~JavaInstance):
+        (JObjectWrapper::JObjectWrapper):
+        * bindings/jni/jni_instance.h:
+        (KJS::Bindings::JObjectWrapper::ref):
+        (KJS::Bindings::JObjectWrapper::deref):
+        * bindings/jni/jni_runtime.cpp: Made _array a RefPtr
+        (JavaArray::~JavaArray):
+        (JavaArray::JavaArray):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaArray::operator=):
+        * bindings/objc/objc_runtime.h:
+        - Prohibited copying because that would muss the ref count.
+        - Prohibited construction without instance because an instance wrapper
+        without an instance is almost certainly a bug.
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::Instance):
+        (KJS::Bindings::Instance::createBindingForLanguageInstance):
+        (KJS::Bindings::Instance::createRuntimeObject):
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::ref):
+        (KJS::Bindings::Instance::deref):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::fallbackObjectGetter):
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::methodGetter):
+        (RuntimeObjectImp::getOwnPropertySlot):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+        * bindings/runtime_object.h: 
+        - Removed ownsInstance data member because RefPtr takes care of 
+        instance lifetime now. 
+        - Prohibited copying because that would muss the ref count.
+        - Prohibited construction without instance because an instance wrapper
+        without an instance is almost certainly a bug.
+        (KJS::RuntimeObjectImp::getInternalInstance):
+
+2006-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John.
+
+        - Applied the 4330457 change to CClass and ObjcClass as well.
+
+        Once plugins work in DumpRenderTree, running run-webkit-tests --leaks
+        will catch this. 
+
+        This change isn't as critical because CClass and ObjcClass objects get 
+        cached globally and never deleted, but it's good practice, in case we 
+        ever do decide to delete CClass and ObjcClass objects.
+
+        This change requires prohibiting copying, because we don't do any 
+        intelligent ref-counting -- when a Class is destroyed, it destroys its 
+        methods and fields unconditionally. (Java classes already prohibited
+        copying.)
+
+        * bindings/c/c_class.cpp:
+        - Merged _commonInit and _commonDelete into constructor and destructor.
+        (CClass::CClass):
+        (CClass::~CClass):
+        (CClass::methodsNamed): Added delete callbacks
+        (CClass::fieldNamed): Added delete callbacks
+        * bindings/c/c_class.h: Prohibited copying
+        * bindings/c/c_instance.cpp: 
+        (KJS::Bindings::CInstance::getClass): Changed to use the preferred 
+        class factory method, to take advantage of the global cache.
+
+        [ Repeated changes applied to CClass for ObjcClass: ]
+
+        * bindings/objc/objc_class.h: 
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::ObjcClass):
+        (KJS::Bindings::ObjcClass::~ObjcClass):
+        (KJS::Bindings::ObjcClass::methodsNamed):
+        (KJS::Bindings::ObjcClass::fieldNamed):
+        * bindings/objc/objc_runtime.h:
+        (KJS::Bindings::ObjcMethod::ObjcMethod): Initialized uninitialized
+        variable to prevent bad CFRelease.
+        (KJS::Bindings::ObjcMethod::~ObjcMethod): Removed erroneous ';' from
+        if statement to prevent bad CFRelease.
+        * bindings/objc/objc_runtime.cpp: Changed to use the preferred
+        ObjectStructPtr, for clarity.
+
+2006-02-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John.
+
+        - Fixed <rdar://problem/4330457> CrashTracer: [REGRESSION] 3763 crashes
+        in Safari at com.apple.JavaScriptCore: KJS::Bindings::JavaInstance::
+        getClass const + 56
+
+        Once plugins work in DumpRenderTree, running run-webkit-tests --leaks
+        will catch this. 
+
+        This was a memory leak in the bindings code. The leak was so extreme
+        that it would cause Safari or the JVM to abort from lack of memory.
+        Upon construction, Class objects create field and method objects, 
+        storing them in CFDictionaries. The bug was that upon destruction, the 
+        class objects released the dictionaries but didn't destroy the stored 
+        objects.
+
+        The fix is to supply CFDictionary callbacks for destroying the values
+        added to the dictionary. 
+        
+        * bindings/jni/jni_class.cpp: 
+        (JavaClass::JavaClass): Added delete callbacks
+        * bindings/runtime.cpp: Added definitions for delete callbacks
+        (KJS::Bindings::deleteMethodList):
+        (KJS::Bindings::deleteMethod):
+        (KJS::Bindings::deleteField):
+        * bindings/runtime.h: Added declarations for delete callbacks
+
+2006-02-14  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Justin.
+
+        Fixed <rdar://problem/4415050> STD: WebCore build steps use echo -n, which will change
+        behavior due to POSIX version of sh
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: removed the use of echo -n, replaced with printf ""
+
+2006-02-13   Dave Hyatt <hyatt@apple.com>
+
+        Fix Win32 bustage in JavaScriptCore.
+
+        Reviewed by darin
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Add JSImmediate to the Win32 project.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::fromDouble):
+        (KJS::JSImmediate::toDouble):
+        (KJS::JSImmediate::NanAsBits):
+        (KJS::JSImmediate::oneAsBits):
+        Win32 needs explicit returns after abort() for non-void functions.
+
+        * kjs/testkjs.cpp:
+        (run):
+        Win32 catches a bug in testkjs!  The "return 2" should actually
+        have been a return false.
+
+        * kjs/value.h:
+        The extern decls of NaN and Inf need to be const.
+
+=== JavaScriptCore-521.7 ===
+
+2006-02-13  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin.
+
+        Replaced the old NS_DURING exception blocking with @try/@catch.
+
+        * JavaScriptCorePrefix.h: undef try and catch to workaround a C++ conflict
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (ObjcField::setValueToInstance):
+        (ObjcArray::setValueAt):
+        (ObjcArray::valueAt):
+
+2006-02-13  Darin Adler  <darin@apple.com>
+
+        - fix a couple problems building on Windows, based on requests
+          from Krzysztof Kowalczyk <kkowalczyk@gmail.com>
+
+        * kjs/JSImmediate.h: Change code using non-standard u_int32/64_t types
+        to the standard uint32/64_t. Also removed curious "isIEEE()" function
+        that checked the sizes of some types (and type sizes alone don't tell you if
+        the floating point conforms to the IEEE-standard). Added missing include
+        of <stdint.h>.
+
+        * kjs/property_slot.h: Added missing include of <assert.h>.
+
+2006-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by darin.
+
+        Cleaned up testkjs, added new "run" functionality to allow scripting 
+        tests from within JS. ("run" is a part of my new super-accurate
+        JS iBench.)
+
+        No regressions in run-javascriptcore-tests.
+
+        * kjs/testkjs.cpp:
+        (GlobalImp::className):
+        (TestFunctionImp::):
+        (TestFunctionImp::callAsFunction):
+        (main):
+        (run):
+
+2006-02-11  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        - improve fix for http://bugs.webkit.org/show_bug.cgi?id=5163
+        RealPlayer.GetTitle() Crashes Safari/Dashboard
+
+        * bindings/c/c_utility.cpp: (KJS::Bindings::convertUTF8ToUTF16):
+        Use kCFStringEncodingISOLatin1 rather than kCFStringEncodingWindowsLatin1, 
+        because the latter encoding has holes, and conversion can still fail.
+
+2006-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        - Inlined RefPtr assignment operators. .7% performance win on 
+        super-accurate JS iBench.
+
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::::operator):
+
+2006-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        No review needed, just a build fix. This time for sure.
+
+        * kjs/JSType.h:
+
+2006-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by eric.
+        
+        - Fixed build. As it goes without saying, I will not mention that I
+        blame Kevin.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/JSImmediate.cpp:
+        (KJS::JSImmediate::toObject):
+
+2006-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by mjs.
+
+        - Fixed <rdar://problem/4343730> Should switch ConstantValues (null, 
+        undefined, true, false) from JS objects to immediate values similar to
+        SimpleNumber
+
+        2.0% performance gain on my new super-accurate version of JS iBench.
+        (I promise to land a version of it soon.)
+
+        The gist of the change:
+        (1) The SimpleNumber class (simple_number.h) is now the JSImmediate
+        class (JSImmediate.h/.cpp), and it handles not only numbers but also 
+        null, undefined, true, and false. 
+        (2) JSImmediate provides convenience methods for the bit masking
+        necessary to encode and decode immediate values.
+        (3) ConstantValues, BooleanImp, NullImp, and UndefinedImp are gone.
+        (4) JSCell no longer implements functions like getBoolean, because
+        only a JSImmediate can be a boolean.
+        (5) JSImmediate no longer uses ALWAYS_INLINE because there's no need,
+        and ALWAYS_INLINE is a non-portable option of last resort.
+        (6) Type is now JSType, and it resides in its own file, JSType.h.
+        Since I was there, I did some header include sorting as part of this
+        change.
+
+        The rest pretty much explains itself.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed simple_number.h,
+        added JSImmediate.h/.cpp.
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::defaultValue):
+        * bindings/c/c_instance.h:
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::defaultValue):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::convertValueToJObject):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originExecutionContext:executionContext:]):
+        Standardized calls to use getXXX instead of hand-rolling JSValue 
+        functionality.
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::getValueOfUndefinedField):
+        (ObjcInstance::defaultValue):
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::type):
+        (ObjcFallbackObjectImp::defaultValue):
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::getValueOfUndefinedField):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::defaultValue):
+        * bindings/runtime_object.h:
+        * kjs/JSImmediate.h: Added.
+        (KJS::JSImmediate::isImmediate):
+        (KJS::JSImmediate::isNumber):
+        (KJS::JSImmediate::isBoolean):
+        (KJS::JSImmediate::isUndefinedOrNull):
+        (KJS::JSImmediate::fromDouble):
+        (KJS::JSImmediate::toDouble):
+        (KJS::JSImmediate::toBoolean):
+        (KJS::JSImmediate::trueImmediate):
+        (KJS::JSImmediate::falseImmediate):
+        (KJS::JSImmediate::NaNImmediate):
+        (KJS::JSImmediate::undefinedImmediate):
+        (KJS::JSImmediate::nullImmediate):
+        (KJS::JSImmediate::tag):
+        (KJS::JSImmediate::unTag):
+        (KJS::JSImmediate::getTag):
+        (KJS::JSImmediate::):
+        (KJS::JSImmediate::isIEEE):
+        (KJS::JSImmediate::is32bit):
+        (KJS::JSImmediate::is64bit):
+        (KJS::JSImmediate::NanAsBits):
+        (KJS::JSImmediate::zeroAsBits):
+        (KJS::JSImmediate::oneAsBits):
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::lock): Removed hack-o-rama to initialize ConstantValues.
+        * kjs/JSType.h: Added.
+        * kjs/collector.cpp:
+        (KJS::Collector::protect):
+        (KJS::Collector::unprotect):
+        (KJS::Collector::collect):
+        * kjs/internal.cpp:
+        (KJS::StringImp::toPrimitive):
+        (KJS::NumberImp::toPrimitive):
+        (KJS::NumberImp::toBoolean):
+        (KJS::GetterSetterImp::toPrimitive):
+        * kjs/internal.h:
+        (KJS::StringImp::type):
+        (KJS::NumberImp::type):
+        * kjs/object.cpp:
+        (KJS::JSObject::type):
+        (KJS::tryGetAndCallProperty): Replaced "Are you one of the six things
+        I'm looking for?" test with "Are you not the one thing I'm not looking
+        for" test.
+        (KJS::JSObject::defaultValue):
+        (KJS::JSObject::toPrimitive):
+        * kjs/object.h:
+        (KJS::GetterSetterImp::type):
+        (KJS::JSValue::isObject):
+        * kjs/operations.cpp:
+        (KJS::equal):
+        (KJS::strictEqual):
+        (KJS::add):
+        * kjs/reference.cpp:
+        (KJS::Reference::deleteValue):
+        * kjs/simple_number.h: Removed.
+        * kjs/string_object.cpp:
+        (StringInstance::getOwnPropertySlot): fixed indentation
+        * kjs/value.cpp:
+        (KJS::JSValue::toObject):
+        (KJS::jsNumberCell): New function to quarantine a PIC branch -- allows
+        us to inline jsNumber without adding PIC branches to callers.
+        * kjs/value.h:
+        (KJS::jsUndefined):
+        (KJS::jsNull):
+        (KJS::jsNaN):
+        (KJS::jsBoolean):
+        (KJS::jsNumber):
+        (KJS::JSValue::downcast):
+        (KJS::JSValue::isUndefinedOrNull):
+        (KJS::JSValue::isBoolean):
+        (KJS::JSValue::isNumber):
+        (KJS::JSValue::isString):
+        (KJS::JSValue::isObject):
+        (KJS::JSValue::getBoolean):
+        (KJS::JSValue::getNumber):
+        (KJS::JSValue::getString):
+        (KJS::JSValue::getObject):
+        (KJS::JSValue::getUInt32):
+        (KJS::JSValue::mark): Replaced !JSImmediate::is() test with assertion,
+        resulting in a slight performance gain. Callers should always check
+        !marked() before calling mark(), so it's impossible to call mark on
+        a JSImmediate.
+        (KJS::JSValue::marked):
+        (KJS::JSValue::type):
+        (KJS::JSValue::toPrimitive):
+        (KJS::JSValue::toBoolean):
+        (KJS::JSValue::toNumber):
+        (KJS::JSValue::toString):
+
+2006-02-06  Eric Seidel  <eseidel@apple.com>
+
+        Add svn:ignore properties for visual studio internals.
+
+2006-02-06  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        - Refactor DateInstance to provide direct access to data. Several WIN32 modifications.
+        http://bugs.webkit.org/show_bug.cgi?id=7107
+
+        - No tests added - only changed functionality on WIN32, which should be covered by 
+        existing tests.
+
+        * kjs/date_object.cpp:
+        (gmtoffset): On WIN32, use the recommended global (_timezone rather than timezone).
+        Updated comments. 
+        (KJS::timeZoneOffset): Removed, was basically the same as the above.
+        (KJS::formatTime): Pass an UTC flag - UTC/local cannot be correctly selected on
+        Windows based on struct tm itself.
+        (KJS::DateInstance::getTime): Added.
+        (KJS::DateInstance::getUTCTime): Added.
+        (KJS::millisecondsToTM): Factored out from DateProtoFunc::callAsFunction().
+        (KJS::DateObjectImp::callAsFunction): Use the new parameter to formatTime().
+        (KJS::DateProtoFunc::callAsFunction): Updated for the other changes. The code for
+        GetTimezoneOffset was incorrect on WIN32 - _daylight global has nothing to do
+        with daylight savings time being in effect.
+
+        * kjs/date_object.h: Added prototypes for new functions.
+
+2006-02-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Anders.
+        
+        - fixed ~1100 KJS::Node leaked on layout tests
+        http://bugs.webkit.org/show_bug.cgi?id=7097
+
+        * kjs/internal.cpp:
+        (KJS::Parser::noteNodeCycle):
+        (KJS::Parser::removeNodeCycle):
+        (KJS::clearNewNodes):
+        * kjs/internal.h:
+        * kjs/nodes.cpp:
+        (ElementNode::breakCycle):
+        (PropertyListNode::breakCycle):
+        (ArgumentListNode::breakCycle):
+        (StatListNode::StatListNode):
+        (StatListNode::breakCycle):
+        (VarDeclListNode::breakCycle):
+        (BlockNode::BlockNode):
+        (ClauseListNode::breakCycle):
+        (CaseBlockNode::CaseBlockNode):
+        (ParameterNode::breakCycle):
+        (SourceElementsNode::SourceElementsNode):
+        (SourceElementsNode::breakCycle):
+        * kjs/nodes.h:
+        (KJS::Node::breakCycle):
+        (KJS::ElementNode::ElementNode):
+        (KJS::ArrayNode::ArrayNode):
+        (KJS::PropertyListNode::PropertyListNode):
+        (KJS::ObjectLiteralNode::ObjectLiteralNode):
+        (KJS::ArgumentListNode::ArgumentListNode):
+        (KJS::ArgumentsNode::ArgumentsNode):
+        (KJS::VarDeclListNode::VarDeclListNode):
+        (KJS::VarStatementNode::VarStatementNode):
+        (KJS::ForNode::ForNode):
+        (KJS::CaseClauseNode::CaseClauseNode):
+        (KJS::ClauseListNode::ClauseListNode):
+        (KJS::ParameterNode::ParameterNode):
+        (KJS::FuncExprNode::FuncExprNode):
+        (KJS::FuncDeclNode::FuncDeclNode):
+
+2006-02-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Hyatt.
+        
+        - fix default traits for classes to make sure default constructors get called
+
+        * kxmlcore/VectorTraits.h:
+        (KXMLCore::):
+
+2006-02-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=5210
+          REGRESSION: for/in loop with var changes global variable instead of making local
+
+        Test: fast/js/for-in-var-scope.html
+
+        * kjs/nodes.cpp:
+        (valueForReadModifyAssignment): Use ALWAYS_INLINE macro.
+        (ForInNode::execute): Break out of the scope chain loop once we find and set the
+        loop variable. We don't want to set multiple loop variables.
+        (ForInNode::processVarDecls): Process the declaration of the loop variable.
+
+        - other cleanup
+
+        * kjs/object.cpp: (KJS::tryGetAndCallProperty): Use ALWAYS_INLINE macro.
+        * kxmlcore/FastMalloc.cpp: Change to use ALWAYS_INLINE macro from AlwaysInline.h
+        instead of defining it here a second time.
+
+2006-02-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Hyatt.
+        
+        - change JavaScript collector statistics calls to use HashCountedSet instead
+        of CFSet; other misc cleanup
+        http://bugs.webkit.org/show_bug.cgi?id=7072
+        
+        * kjs/collector.cpp:
+        (KJS::Collector::numProtectedObjects): renamed from numReferencedObjects
+        (KJS::typeName):
+        (KJS::Collector::rootObjectTypeCounts): renamed from rootObjectClasses,
+        use HashSet
+        * kjs/collector.h:
+        (KJS::Collector::isOutOfMemory): Renamed from outOfMemory.
+        * kjs/nodes.cpp:
+
+2006-02-03  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Justin.
+
+        Renamed configuration names to Debug, Release and Production.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-02-02  George Staikos <staikos@opensource.apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/lookup.h: Fix compile, merged from KDE.
+
+2006-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=7005
+          add Noncopyable, OwnPtr, OwnArrayPtr to KXMLCore
+
+        * kxmlcore/Noncopyable.h: Added.
+        * kxmlcore/OwnArrayPtr.h: Added.
+        * kxmlcore/OwnPtr.h: Added.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new files.
+
+        * kjs/function.h:
+        * kjs/function.cpp: Use OwnPtr for Parameter pointers.
+
+        * kjs/internal.h: Use Noncopyable for LabelStack.
+
+        * kjs/list.cpp: Use OwnArrayPtr for overflow.
+
+        * kjs/property_map.h:
+        * kjs/property_map.cpp: Use OwnArrayPtr for SavedProperties.
+        Use Vector for some stack buffers.
+
+        * kjs/regexp_object.h:
+        * kjs/regexp_object.cpp: Use OwnArrayPtr for lastOvector.
+
+2006-01-31  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - fixed leak of hundreds of thousands of JS parser nodes on the layout tests, and added an exit counter
+        that would catch them
+
+        * kjs/nodes.cpp:
+        (NodeCounter::~NodeCounter): Added debug-only node counter.
+        (Node::Node):
+        (Node::~Node):
+        * kxmlcore/VectorTraits.h: Simple classes like RefPtr do in fact need destruction.
+
+2006-01-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - added deleteAllValues for HashSet as well as HashMap
+        - fixed conversion from const_iterator to iterator, which I broke a while back
+
+        * kxmlcore/HashMap.h: Updated copyright date.
+        * kxmlcore/HashSet.h: (KXMLCore::deleteAllValues): Added.
+        * kxmlcore/HashTable.h: (KXMLCore::HashTableIterator::operator const_iterator): Added.
+
+2006-01-31  Tim Omernick  <timo@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertUTF8ToUTF16):
+        Fixed an invalid assertion that UTF8Chars is not NULL.  It is valid for it to be NULL as long as
+        UTF8Length is 0.
+        This fixes an assertion failure on TOT at <http://www.musicindiaonline.com/p/x/tJO0OOBME9.As1NMvHdW/>,
+        where JavaScript is getting a NULL string back from some call on the Real Player plugin.
+
+2006-01-30  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Darin.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=6907
+        REGRESSION: United.com menus messed up due to document.all/MSIE sniff
+        
+        * kjs/nodes.cpp:
+        (typeStringForValue):
+        Return "undefined" if the given object should masquerade as undefined.
+        
+        * kjs/object.h:
+        (KJS::JSObject::masqueradeAsUndefined):
+        Rename from isEqualToNull.
+        
+        * kjs/operations.cpp:
+        (KJS::equal):
+        Update for name change.
+
+2006-01-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - properly define Vector assignment operator; the private version was accidentally left
+        in, and the template version is not enough to replace the default
+
+        * kxmlcore/Vector.h:
+        (KXMLCore::Vector::operator=):
+
+2006-01-29  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by darin.
+
+        Fix the build by applying a GCC-specific namespace hack.
+
+        * kjs/lookup.h:
+
+2006-01-29  Eric Seidel <eseidel@apple.com>
+
+        Reviewed by hyatt.
+
+        Fix build on Win32.
+
+        * kjs/lookup.h: fixed ::cacheGlobalObject
+        * kxmlcore/Vector.h:
+        (KXMLCore::Vector::operator[]): use unsigned long
+
+2006-01-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        * kxmlcore/Vector.h:
+        (KXMLCore::Vector::operator[]): Add unsigned overload
+
+2006-01-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=6895
+          include exception names in JavaScript form of DOM exception
+
+        * khtml/ecma/kjs_binding.cpp: (KJS::setDOMException): Include the name of the
+        exception in the error message.
+
+2006-01-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - miscellaneous Vector improvements
+
+        * kxmlcore/Vector.h:
+        (KXMLCore::Vector::at): Add range-checking asserts.
+        (KXMLCore::Vector::first): Added as a convenience.
+        (KXMLCore::Vector::last): Convenience for stack-style use.
+        (KXMLCore::Vector::removeLast): ditto
+
+2006-01-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6870
+          REGRESSION: JavaScript Date constructor won't accept another Date object
+
+        Test: fast/js/date-constructor.html
+
+        * kjs/date_object.cpp: (KJS::DateObjectImp::construct):
+        Added a special case for constructing one date from another (to avoid losing
+        milliseconds, which are not in the text form, to match Firefox), and changed
+        the base code to convert to primitive before checking for string to match
+        the standard. Also corrected a couple silly things in the "construct from
+        current time" code path (removed a floor that does no good, and changed
+        the constant used to convert microseconds to milliseconds to be a 1000
+        rather than "msPerSecond").
+
+2006-01-28  Darin Adler  <darin@apple.com>
+
+        * kjs/create_hash_table: Added missing license.
+
+2006-01-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        - added a Vector class
+        http://bugs.webkit.org/show_bug.cgi?id=6894
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/internal.cpp:
+        (KJS::Parser::saveNewNode): Apply Vector.
+        (KJS::clearNewNodes): ditto
+        * kjs/number_object.cpp:
+        (integer_part_noexp): ditto
+        (char_sequence): ditto
+        * kjs/ustring.cpp:
+        (KJS::UString::UTF8String): ditto
+        * kxmlcore/HashMap.h:
+        (KXMLCore::deleteAllValues): Tweaked this to only apply to HashMap,
+        other versions are useful for other containers.
+        * kxmlcore/Vector.h: Added. Implemented a Vector class, which should
+        be usable for all Array/QVector style purposes, and also as a stack buffer
+        with oversize handling. Also some helper classes to make vector operations
+        as efficient as possible for POD types and for simple non-PODs like RefPtr.
+        (KXMLCore::):
+        (KXMLCore::VectorTypeOperations::destruct):
+        (KXMLCore::VectorTypeOperations::initialize):
+        (KXMLCore::VectorTypeOperations::move):
+        (KXMLCore::VectorTypeOperations::uninitializedCopy):
+        (KXMLCore::VectorTypeOperations::uninitializedFill):
+        (KXMLCore::VectorBuffer::VectorBuffer):
+        (KXMLCore::VectorBuffer::~VectorBuffer):
+        (KXMLCore::VectorBuffer::deallocateBuffer):
+        (KXMLCore::VectorBuffer::inlineBuffer):
+        (KXMLCore::Vector::Vector):
+        (KXMLCore::Vector::~Vector):
+        (KXMLCore::Vector::size):
+        (KXMLCore::Vector::capacity):
+        (KXMLCore::Vector::isEmpty):
+        (KXMLCore::Vector::at):
+        (KXMLCore::Vector::operator[]):
+        (KXMLCore::Vector::data):
+        (KXMLCore::Vector::operator T*):
+        (KXMLCore::Vector::operator const T*):
+        (KXMLCore::Vector::begin):
+        (KXMLCore::Vector::end):
+        (KXMLCore::Vector::clear):
+        (KXMLCore::Vector::fill):
+        (KXMLCore::Vector::operator=):
+        (KXMLCore::::Vector):
+        (KXMLCore::::operator):
+        (KXMLCore::::fill):
+        (KXMLCore::::expandCapacity):
+        (KXMLCore::::resize):
+        (KXMLCore::::reserveCapacity):
+        (KXMLCore::::append):
+        (KXMLCore::deleteAllValues):
+        * kxmlcore/VectorTraits.h: Added.
+        (KXMLCore::VectorTraits): Traits to enable making Vector efficient for
+        simple types.
+
+2006-01-28  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=5163
+        RealPlayer.GetTitle() Crashes Safari/Dashboard
+
+        * bindings/c/c_utility.cpp: (KJS::Bindings::convertUTF8ToUTF16):
+        Fallback to kCFStringEncodingWindowsLatin1 if the passed buffer is not valid UTF-8, preventing crashes.
+
+2006-01-25  George Staikos <staikos@opensource.apple.com>
+
+        Reviewed by Darin.
+
+        * kxmlcore/HashFunctions.h: Merge build fix from KDE.
+
+2006-01-25  Darin Adler  <darin@apple.com>
+
+        - removed an unused source file
+
+        * kjs/pointer_hash.h: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed reference to pointer_hash.h.
+
+2006-01-23  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6737
+        KJS_DEFINE_PROTOTYPE should work outside of the KJS namespace
+        
+        * kjs/lookup.h:
+        Prefix all KJS types with KJS:: in KJS_DEFINE_PROTOTYPE.
+        
+        (cacheGlobalObject):
+        Move this out of the KJS namespace.
+
+2006-01-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - renamed PointerHash to PtrHash
+        - made PtrHash the default hash function for int and pointer types that aren't further specialized
+        - added an AtomicStringImpl class to make it easier and more typesafe to identity hash atomic strings
+        - did appropriate consequent cleanup (very few places now need to declare a hash function)
+        http://bugs.webkit.org/show_bug.cgi?id=6752
+        
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction): no need to mention PointerHash
+        * kjs/collector.cpp: ditto
+        * kjs/identifier.cpp:
+        (KXMLCore::): declare DefaultHash the new way
+        * kjs/internal.cpp: no need to mention PointerHash
+        * kjs/ustring.h:
+        * kxmlcore/HashCountedSet.h: change how we get the default hash to make it
+        easier to specialize on PtrHash
+        * kxmlcore/HashFunctions.h:
+        (KXMLCore::): renamed PointerHash to PtrHash; changed DefaultHash so that it has
+        a Hash typedef rather than being a hash function class itself; declared DefaultHash
+        for int and partializy specialized for pointer types
+        * kxmlcore/HashMapPtrSpec.h:
+        (KXMLCore::PtrHashIteratorAdapter::PtrHashIteratorAdapter): Slight tweaks for new
+        way of handling pointer hash
+        (KXMLCore::PtrHashConstIteratorAdapter::PtrHashConstIteratorAdapter): ditto
+        (KXMLCore::): ditto
+        * kxmlcore/HashMap.h: ditto
+        * kxmlcore/HashSet.h: ditto
+
+2006-01-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Tim Omernick.
+        
+        - use classes instead of free functions for extractors, this better matches how other
+        things work and should avoid the need for hacky workarounds on other compilers
+        http://bugs.webkit.org/show_bug.cgi?id=6748
+
+        * kjs/array_object.cpp:
+        * kjs/identifier.cpp:
+        * kjs/internal.cpp:
+        * kxmlcore/HashMap.h:
+        (KXMLCore::PairFirstExtractor::extract):
+        * kxmlcore/HashMapPtrSpec.h:
+        (KXMLCore::):
+        * kxmlcore/HashSet.h:
+        (KXMLCore::IdentityExtractor::extract):
+        * kxmlcore/HashTable.h:
+        (KXMLCore::addIterator):
+        (KXMLCore::removeIterator):
+        (KXMLCore::HashTable::add):
+        (KXMLCore::HashTable::isEmptyBucket):
+        (KXMLCore::HashTable::isDeletedBucket):
+        (KXMLCore::HashTable::HashTable):
+        (KXMLCore::HashTable::lookup):
+        (KXMLCore::HashTable::add):
+        (KXMLCore::HashTable::reinsert):
+        (KXMLCore::HashTable::find):
+        (KXMLCore::HashTable::contains):
+        (KXMLCore::HashTable::remove):
+        (KXMLCore::HashTable::allocateTable):
+        (KXMLCore::HashTable::deallocateTable):
+        (KXMLCore::HashTable::expand):
+        (KXMLCore::HashTable::rehash):
+        (KXMLCore::HashTable::clear):
+        (KXMLCore::HashTable::swap):
+        (KXMLCore::HashTable::operator):
+        (KXMLCore::HashTable::checkTableConsistency):
+        (KXMLCore::HashTable::checkTableConsistencyExceptSize):
+        (KXMLCore::HashTable::invalidateIterators):
+
+2006-01-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Tim Hatcher.
+        
+        - renamed inert() operation on HashSet, HashCountedSet and HashTable to add()
+        for consistency with HashMap
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction):
+        * kjs/collector.cpp:
+        (KJS::Collector::protect):
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add):
+        * kxmlcore/HashCountedSet.h:
+        (KXMLCore::::add):
+        * kxmlcore/HashMap.h:
+        (KXMLCore::::inlineAdd):
+        * kxmlcore/HashSet.h:
+        (KXMLCore::::add):
+        * kxmlcore/HashTable.h:
+        (KXMLCore::HashTable::add):
+        (KXMLCore::::add):
+        (KXMLCore::::HashTable):
+
+2006-01-23  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by thatcher
+        
+        Turned on -O2 for B&I build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-01-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Tim Hatcher.
+        
+        - it's "Franklin Street", not "Franklin Steet"
+
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        * kjs/bool_object.h:
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/completion.h:
+        * kjs/context.h:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        * kjs/debugger.cpp:
+        * kjs/debugger.h:
+        * kjs/dtoa.h:
+        * kjs/error_object.cpp:
+        * kjs/error_object.h:
+        * kjs/function.cpp:
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        * kjs/function_object.h:
+        * kjs/grammar.y:
+        * kjs/identifier.cpp:
+        * kjs/identifier.h:
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/lexer.cpp:
+        * kjs/lexer.h:
+        * kjs/list.cpp:
+        * kjs/list.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/math_object.cpp:
+        * kjs/math_object.h:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        * kjs/number_object.cpp:
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        * kjs/object_object.h:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/property_map.cpp:
+        * kjs/property_map.h:
+        * kjs/property_slot.cpp:
+        * kjs/property_slot.h:
+        * kjs/reference.cpp:
+        * kjs/reference.h:
+        * kjs/reference_list.cpp:
+        * kjs/reference_list.h:
+        * kjs/regexp.cpp:
+        * kjs/regexp.h:
+        * kjs/regexp_object.cpp:
+        * kjs/regexp_object.h:
+        * kjs/scope_chain.cpp:
+        * kjs/scope_chain.h:
+        * kjs/simple_number.h:
+        * kjs/string_object.cpp:
+        * kjs/string_object.h:
+        * kjs/testkjs.cpp:
+        * kjs/types.h:
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        * kjs/value.cpp:
+        * kjs/value.h:
+        * kxmlcore/AlwaysInline.h:
+        * kxmlcore/ListRefPtr.h:
+        * kxmlcore/PassRefPtr.h:
+        * kxmlcore/RefPtr.h:
+
+2006-01-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - change needed for fix to http://bugs.webkit.org/show_bug.cgi?id=6617
+          REGRESSION: Crash in cloneChildNodes when clicking element
+
+        * kxmlcore/PassRefPtr.h: Fix assignment operator from RefPtr of a different
+        type by calling get() instead of going directly at m_ptr.
+        * kxmlcore/RefPtr.h: Ditto.
+
+        - other changes
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Xcode decided to change this file.
+        It's just a resorted list of keys in a dictionary.
+
+        * kjs/fpconst.cpp: Wrap this file in #if __APPLE__ since the alternate version
+        in internal.cpp is in #if !__APPLE__. This file is to give us the "no init
+        routine" property we want to have on OS X.
+
+2006-01-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - Set up Page class and invert Frame / WebCoreFrameBridge ownership
+        http://bugs.webkit.org/show_bug.cgi?id=6577
+
+        * kjs/interpreter.h: make globalExec virtual so ScriptInterpreter can 
+        override it
+
+2006-01-23  George Staikos <staikos@opensource.apple.com>
+
+        Reviewed by Maciej and Darin.
+
+        * kxmlcore/Assertions.h: This file only works with __APPLE__ right now
+        * kjs/interpreter.cpp: ditto
+        * kjs/simple_number.h: Add assert.h and remove from config.h
+        * kjs/array_object.cpp: Use relative paths for kxmlcore includes
+        * kjs/testkjs.cpp: Use relative paths for kxmlcore includes
+
+2006-01-23  George Staikos <staikos@opensource.apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/config.h: unbreak preprocessor change
+
+2006-01-23  George Staikos <staikos@opensource.apple.com>
+
+        Approved by Maciej and Darin.
+
+        * kjs/:
+        * kxmlcore/:
+             Update FSF address in license to make merging easier
+
+2006-01-22  George Staikos <staikos@opensource.apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/collector.cpp: merge major speedup from KDE on Linux
+                             patch by Maks Orlovich, bug #6145
+                             Also unify cpu detection
+        * kjs/config.h: define simpler CPU macros
+
+2006-01-22  George Staikos <staikos@opensource.apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/collector.cpp: merge FreeBSD compile fix from KDE
+                             -> requires build magic for use
+
+2006-01-21  George Staikos <staikos@opensource.apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/nodes2string.cpp
+        * kjs/operations.h
+        * kjs/debugger.h
+          Fix pedantic compile with some gcc versions (Merge from KDE)
+
+        * kjs/create_hash_table:
+          Fix build with Perl 5.8.0 (Merge from KDE)
+
+2006-01-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Hyatt.
+
+        - hash table fixes needed for my WebCore changes
+
+        * kxmlcore/HashTable.h: (KXMLCore::HashTableConstIterator::operator=):
+        Added a missing return statement.
+
+        * kxmlcore/HashTraits.h: Fix traits so they work properly for classes where you
+        can't instantiate with a 0 by using traits rather than ? : to select the default
+        emtpy value of hash table keys.
+
+        - small cleanup of "runtime" code left over from recent JavaScript crash fix
+
+        * bindings/runtime_root.h:
+        (KJS::Bindings::RootObject::RootObject): No explicit initialization of _imp needed
+        since it's now a ProtectedPtr.
+        (KJS::Bindings::RootObject::setRootObjectImp): Remove old code that relied on the
+        fact that _imp was 0 and replaced with use of ProtectedPtr.
+        (KJS::Bindings::RootObject::rootObjectImp): Updated since _imp is a ProtectedPtr.
+
+2006-01-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=6611
+          add assertions to check correct use of hash table iterators
+
+        * kxmlcore/HashTable.h:
+        (KXMLCore::addIterator): Added. Helper function that adds an iterator to the list
+        maintained by the specified hash table.
+        (KXMLCore::removeIterator): Added. Helper function that removes an iterator from
+        the list maintained by the hash table it's in.
+        (KXMLCore::HashTableConstIterator::HashTableConstIterator): Added a HashTable
+        parameter, ignored when not debugging. Call addIterator.
+        (KXMLCore::HashTableConstIterator::~HashTableConstIterator):
+        (KXMLCore::HashTableConstIterator::operator=): Call removeIterator.
+        (KXMLCore::HashTableConstIterator::operator*): Call checkValidity.
+        (KXMLCore::HashTableConstIterator::operator->): Ditto.
+        (KXMLCore::HashTableConstIterator::operator++): Ditto.
+        (KXMLCore::HashTableConstIterator::operator==): Ditto.
+        (KXMLCore::HashTableConstIterator::operator!=): Ditto.
+        (KXMLCore::HashTableConstIterator::checkValidity): Checks that the hash table
+        pointer is not 0 and if there are two iterators that both point at the same table.
+        (KXMLCore::HashTableIterator::HashTableIterator): Changed to use the const iterator
+        as an implementation detail, to avoid having two separate iterator implementations.
+        (KXMLCore::HashTableIterator::operator*): Ditto.
+        (KXMLCore::HashTableIterator::operator->): Ditto.
+        (KXMLCore::HashTableIterator::operator++): Ditto.
+        (KXMLCore::HashTableIterator::operator==): Ditto.
+        (KXMLCore::HashTableIterator::operator!=): Ditto.
+        (KXMLCore::HashTable::HashTable): Initialize pointer to head of iterators list.
+        (KXMLCore::HashTable::~HashTable): Added call to invalidateIterators.
+        (KXMLCore::HashTable::makeIterator): Pass this pointer.
+        (KXMLCore::HashTable::makeConstIterator): Ditto.
+        (KXMLCore::HashTable::insert): Call invalidateIterators, since this is a public
+        entry point that modifies the hash table.
+        (KXMLCore::HashTable::remove): Ditto.
+        (KXMLCore::HashTable::clear): Ditto.
+        (KXMLCore::HashTable::swap): Ditto.
+        (KXMLCore::HashTable::invalidateIterators): Added. Walks the iterators list and
+        clears out the table, next, and previous pointers in all of them, and then clears
+        the head so we have an empty list.
+        (KXMLCore::addIterator): Added. Adds the iterator the the linked list in the
+        passed-in table, and points the iterator at the table.
+        (KXMLCore::removeIterator): Added. Removes the iterator from the linked list in
+        the passed-in table.
+
+        * kxmlcore/HashTraits.h: A bit of tweaking and formatting.
+
+2006-01-17  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by eric
+        
+        Deployment builds now use -O2
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2006-01-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6610
+          change RefPtr so that it works when deref ends up deleting the RefPtr
+
+        * kxmlcore/PassRefPtr.h: Always set m_ptr before calling deref.
+        * kxmlcore/RefPtr.h: Ditto.
+
+2006-01-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by darin.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=6322
+        DateProtoFuncImp::callAsFunction can crash due to lack of type checking
+
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFunc::callAsFunction): Type check calls to all methods. 
+        This matches section 15.9.5 in the spec.
+
+2006-01-16  Tim Omernick  <timo@apple.com>
+
+        Reviewed by John Sullivan.
+
+        JavaScriptCore part of <rdar://problem/4211707> NPAPI ref count behavior differs with Mozilla
+
+        * bindings/npruntime.cpp:
+        (_NPN_ReleaseObject):
+        Refactored part of this function out into _NPN_DeallocateObject.
+        (_NPN_DeallocateObject):
+        Forcibly deallocates the passed object, even if its refcount is
+        greater than zero.
+        
+        * bindings/npruntime_impl.h:
+        Declared _NPN_DeallocateObject().
+
+2006-01-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix problem with ++, ==, and != on const iterators in
+          HashMaps that are using the pointer specialization
+
+        * kxmlcore/HashMapPtrSpec.h:
+        (KXMLCore::PointerHashConstIteratorAdapter::operator++): Change type to const_iterator.
+        (KXMLCore::PointerHashConstIteratorAdapter::operator==): Ditto.
+        (KXMLCore::PointerHashConstIteratorAdapter::operator!=): Ditto.
+
+2006-01-15  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Anders.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6561
+        run-javascriptcore-tests doesn't work
+
+        * JavaScriptCore/tests/mozilla/Getopt/Mixed.pm: 
+        Changed revision number to 1.8 (broken by svn migration).
+
+2006-01-14  David Kilzer  <ddkilzer@kilzer.net>
+
+        Reviewed and landed by Anders.
+
+        * kjs/create_hash_table: Fixed comment typo.
+
+2006-01-13  Maks Orlovich   <maksim@kde.org>
+
+        Mostly merging work by Peter Kelly. Reviewed by Maciej, landed by ap.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6261
+        Misc. array object fixes from KJS
+
+        * kjs/array_object.cpp: Don't treat 2^32-1 as a real array index property.
+        (ArrayInstance::getOwnPropertySlot): Ditto.
+        (ArrayInstance::deleteProperty): Ditto.
+        (ArrayInstance::put): Ditto.
+        (ArrayInstance::propList): Added a FIXME comment.
+        (ArrayInstance::put): Throw exception on trying to set invalid array length.
+        (ArrayProtoFunc::callAsFunction): Do not use a separator argument when doing toString/toLocalString.
+        * kjs/array_object.h: Added MAX_ARRAY_INDEX.
+
+2006-01-13  Darin Adler  <darin@apple.com>
+
+        - Replaced tabs with spaces in source files that had less than 10 lines with tabs.
+        - Set allow-tabs Subversion property in source files that have more than 10 lines with tabs.
+
+2006-01-13  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Eric.
+
+        * kjs/create_hash_table:
+        Use correct size variables.
+
+2006-01-13  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Darin.
+
+        * kjs/create_hash_table:
+        Don't create an empty entry array, instead add a entry with all fields
+        set to null and set the hash table size to 1.
+        
+        * kjs/lookup.cpp:
+        (findEntry):
+        Remove the hash table size check
+
+2006-01-12  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6494
+        Crash when assigning a new function to a DOMParser object
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Move lookup.cpp before lookup.h
+        
+        * kjs/lookup.cpp:
+        (findEntry):
+        If the hash table is empty, return 0 early.
+
+2006-01-12  George Staikos <staikos@kde.org>
+
+        Reviewed by Darin.
+
+        * kjs/interpreter.cpp:
+        * kjs/testkjs.cpp:
+        * kjs/interpreter.h:
+        Add helper to interpreter to call the collector in order to facilitate
+        visibility rules in KDE.
+
+2006-01-12  George Staikos <staikos@kde.org>
+
+        Reviewed by Maciej.
+
+        * kjs/kjs.pro: Updates to build the whole thing on Linux at least.
+
+        * kxmlcore/HashTable.h: Add missing assert.h
+
+2006-01-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6505
+          retire APPLE_CHANGES from JavaScriptCore
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed both
+        APPLE_CHANGES and HAVE_CONFIG_H from all targets.
+
+        * README: Removed. This had obsolete information in it
+        and it wasn't clear what to replace it with.
+
+        * kjs/collector.h: Removed an APPLE_CHANGES if around something
+        that's not really platform-specific (although it does use a
+        platform-specific API at the moment).
+        * kjs/collector.cpp: Removed a mistaken comment.
+
+        * kjs/grammar.y:
+        * kjs/internal.cpp:
+        * kjs/object.h:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/ustring.h:
+        Use __APPLE__ instead of APPLE_CHANGES for code that should be
+        used only on Mac OS X.
+
+        * kjs/interpreter.cpp: Removed APPLE_CHANGES ifdef around the include
+        of the runtime.h header. Even though that header isn't needed at the
+        moment on platforms other than Mac OS X, the conditional stuff should
+        be in the header itself, not in this one client.
+
+        * kjs/math_object.cpp: (MathFuncImp::callAsFunction): Removed some
+        code inside APPLE_CHANGES. I'm pretty sure this code isn't needed on
+        any platform where pow is implemented corrrectly according to the IEEE
+        standard. If it is needed on some, we can add it back with an appropriate
+        #if for the platforms where it is needed.
+
+2006-01-12  Justin Haygood  <justin@xiondigital.net>
+
+        Reviewed, tweaked, and landed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6416
+          lexer.cpp, grammar.y protect include of config.h with "HAVE_CONFIG_H"
+
+        * kjs/dtoa.cpp: Removed HAVE_CONFIG_H, changed config.h to use
+        quotes instead of angle brackets. Moved dtoa.h include to the top.
+        Changed system header includes to use angle brackets instead of quotes.
+        * kjs/grammar.y: Removed HAVE_CONFIG_H, changed config.h to use
+        quotes instead of angle brackets.
+        * kjs/lexer.cpp: Removed HAVE_CONFIG_H, changed config.h to use
+        quotes instead of angle brackets. Moved lexer.h include to the top.
+        * kjs/ustring.cpp: Removed HAVE_CONFIG_H, changed config.h to use
+        quotes instead of angle brackets. Moved ustring.h include to the top.
+
+2006-01-12  George Staikos <staikos@kde.org>
+
+        Reviewed by Maciej
+
+        - Import initial QMake file.  Doesn't fully work yet.
+
+2006-01-11  Ricci Adams  <ricciadams@apple.com>
+
+        Reviewed by Maciej and Darin, landed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=5939
+          final comma in javascript object prevents parsing
+
+        * kjs/grammar.y: Added rule to allow trailing comma in
+        object construction.
+
+2006-01-11  Ricci Adams  <ricciadams@apple.com>
+
+        Reviewed by Geoff, landed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=5308
+          Number.toFixed doesn't include leading 0
+
+        * kjs/number_object.cpp: (NumberProtoFunc::callAsFunction):
+        Fixed a "<" that should have been a "<=".
+
+2006-01-11  Ricci Adams  <ricciadams@apple.com>
+
+        Reviewed by Geoff, landed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=5307
+          Number.toFixed doesn't round 0.5 up
+
+        * kjs/number_object.cpp: (NumberProtoFunc::callAsFunction):
+        Fixed a ">" that should have been a ">=".
+
+2006-01-11  Justin Haygood  <justin@xiondigital.net>
+
+        Reviewed and landed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6486
+          JavaScriptCore should use system malloc on Windows
+
+        * kjs/config.h: Add USE_SYSTEM_MALLOC to the Win32 section.
+
+2006-01-10  Darin Adler  <darin@apple.com>
+
+        * Makefile: Took out unneeded "export" line.
+        * <many-files>: Changed a lot of flags (cleared bogus executable bits, set
+          MIME types, other small corrections).
+
+2006-01-09  Darin Adler  <darin@apple.com>
+
+        * Makefile.am: Removed.
+
+2006-01-07  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+        
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6373
+        REGRESSION: JavaScript hang when comparing large array to null
+        
+        * kjs/object.h:
+        (KJS::JSObject::isEqualToNull):
+        Add new function which returns true if an object should be treated as null when
+        doing comparisons.
+        
+        * kjs/operations.cpp:
+        (KJS::equal):
+        Use isEqualToNull.
+
+2006-01-07  Alexey Proskuryakov  <ap@nypop.com>
+
+        Reviewed by Maciej.
+
+        - Fix WebCore development build
+        http://bugs.webkit.org/show_bug.cgi?id=6408
+
+        * kxmlcore/Assertions.h: Use __VA_ARGS__ in variadic macros.
+
+2006-01-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - miscellaneous changes for 4% speedup on the JavaScript iBench
+        http://bugs.webkit.org/show_bug.cgi?id=6396
+        
+        Changes mostly thanks to Maks Orlovich, tweaked a little by me.
+
+        * kjs/create_hash_table: Use the same hash as the one used by Identifier.
+        * kjs/function.cpp:
+        (KJS::FunctionImp::processParameters): Use the new List::copyFrom
+        (KJS::ActivationImp::ActivationImp): track variable while iterating
+        * kjs/internal.cpp:
+        (KJS::StringImp::toObject): create StringInstance directly
+        * kjs/list.cpp:
+        (KJS::List::copy): implement in terms of copyFrom
+        (KJS::List::copyFrom): more efficient way to copy in another list
+        * kjs/list.h:
+        * kjs/lookup.cpp:
+        (keysMatch): updated to work with identifier hash
+        (findEntry): ditto
+        (Lookup::findEntry): ditto
+        (Lookup::find): ditto
+        * kjs/lookup.h:
+
+2006-01-06  Maciej Stachowiak  <mjs@apple.com>
+
+        - fix development build failure from the previous checkin
+
+        * kjs/function.cpp:
+        (KJS::ActivationImp::put): Use prototype() accessor in assert.
+
+2006-01-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - fix remaining performance regression from Getter/Setter change
+        http://bugs.webkit.org/show_bug.cgi?id=6249
+
+        - Activation objects should not have __proto__ property
+        http://bugs.webkit.org/show_bug.cgi?id=6395
+
+        * kjs/function.cpp:
+        (KJS::ActivationImp::getOwnPropertySlot): Implement directly, thus
+        skipping getter/setter handling and __proto__ handling, as well
+        as inlining needed superclass stuff.
+        (KJS::ActivationImp::put): Implement directly, skipping getter/setter,
+        __proto__, and do canPut directly in PropertyMap::put since there's no
+        static property table either.
+        * kjs/function.h:
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::put): Allow optionally inlining canPut check.
+        * kjs/property_map.h:
+
+2006-01-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch by kimmo.t.kinnunen@nokia.com, reviewed by darin, tweaked by me.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=4921
+        \u escape sequences in JavaScript identifiers
+
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/lexer.cpp:
+        (Lexer::shift):
+        (Lexer::lex):
+        (Lexer::isWhiteSpace):
+        (Lexer::isLineTerminator):
+        (Lexer::isIdentStart):
+        (Lexer::isIdentPart):
+        (isDecimalDigit):
+        (Lexer::scanRegExp):
+        * kjs/lexer.h:
+        (KJS::Lexer::):
+
+        * tests/mozilla/expected.html: Updated test results.
+
+2005-12-30  Maciej Stachowiak  <mjs@apple.com>
+
+        No review, just test result update.
+
+        * tests/mozilla/expected.html: Updated for newly passing test from recent fixes.
+
+2005-12-30  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        - Fix http://bugs.webkit.org/show_bug.cgi?id=6298
+        Getter setter test is failing
+                
+        * kjs/object.cpp:
+        (KJS::JSObject::put):
+        Rework the getter setter part. We now walk the prototype chain, checking for
+        getter/setter properties and only take the slow path if any are found. 
+
+2005-12-30  Maks Orlovich <maksim@kde.org>
+
+        Reviewed and committed by Maciej.
+
+        - Handle negative, FP numbers with non-10 radix in toString
+        http://bugs.webkit.org/show_bug.cgi?id=6259
+
+        (Merged from KJS, original work by Harri Porten)
+        
+        * kjs/number_object.cpp:
+        (NumberProtoFunc::callAsFunction): rewrote Number.toString(radix) to work with  
+        negative numbers, floating point and very large numbers.
+
+2005-12-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch by Maks Orlovich, reviewed and landed by me.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=6267
+        Fix Number.prototype.toFixed/toExponential(undefined)
+
+        * kjs/number_object.cpp:
+        (NumberProtoFunc::callAsFunction):
+
+2005-12-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch by Maks Orlovich, Reviewed and landed by me.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=6266
+        Minor object naming updates (to match Mozilla, KJS)
+
+        * kjs/number_object.cpp:
+        * kjs/regexp_object.cpp:
+
+2005-12-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch by Maks Orlovich, reviewed by mjs.
+
+        This has 2 very minor fixes, covered by KJS testsuite:    
+        1. Enumerates string indices in property list (with the same bug as array    
+           object has in corresponding code). This is a mozilla emulation thing. 
+        2. Permits properties with integer names in prototypes to be found    
+
+        * kjs/string_object.cpp:
+        (StringInstance::getOwnPropertySlot):
+        (StringInstanceImp::propList):
+        * kjs/string_object.h:
+
+2005-12-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by mjs.
+
+        - Fixed <rdar://problem/4364705> run-javascriptcore-tests crashes in 
+        KJS::BlockNode::deref 
+        AKA 
+        http://bugs.webkit.org/show_bug.cgi?id=6233
+        Reproducible stack-overflow crash in ~RefPtr<T> due to RefPtr<T> use in 
+        linked lists
+
+        This patch does four things: 
+        (1) Standardizes all our linked list nodes to use "next" as their next 
+        pointers. 
+        (2) Creates the ListRefPtr<T> class, a subclass of RefPtr<T> specialized
+        to iteratively deref "next" pointers.
+        (3) Standardizes our linked list nodes to use ListRefPtr<T> and 
+        implement the releaseNext() function used by ~ListRefPtr<T>().
+        (4) Adds to RefPtr<T> the release() method used by releaseNext().
+
+        - Modified existing mozilla test to ensure it would make deployment 
+        builds crash as well.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/nodes.cpp:
+        (ElementNode::evaluate):
+        (PropertyListNode::evaluate):
+        (ArgumentListNode::evaluateList):
+        (StatListNode::StatListNode):
+        (StatListNode::execute):
+        (StatListNode::processVarDecls):
+        (VarDeclListNode::evaluate):
+        (VarDeclListNode::processVarDecls):
+        (VarStatementNode::execute):
+        (VarStatementNode::processVarDecls):
+        (BlockNode::BlockNode):
+        (CaseClauseNode::evalStatements):
+        (CaseClauseNode::processVarDecls):
+        (ClauseListNode::processVarDecls):
+        (CaseBlockNode::CaseBlockNode):
+        (CaseBlockNode::evalBlock):
+        (SourceElementsNode::SourceElementsNode):
+        (SourceElementsNode::execute):
+        (SourceElementsNode::processFuncDecl):
+        (SourceElementsNode::processVarDecls):
+        * kjs/nodes.h:
+        (KJS::ElementNode::ElementNode):
+        (KJS::ElementNode::releaseNext):
+        (KJS::ArrayNode::ArrayNode):
+        (KJS::PropertyListNode::PropertyListNode):
+        (KJS::PropertyListNode::releaseNext):
+        (KJS::ObjectLiteralNode::ObjectLiteralNode):
+        (KJS::ArgumentListNode::ArgumentListNode):
+        (KJS::ArgumentListNode::releaseNext):
+        (KJS::ArgumentsNode::ArgumentsNode):
+        (KJS::StatListNode::releaseNext):
+        (KJS::VarDeclListNode::VarDeclListNode):
+        (KJS::VarDeclListNode::releaseNext):
+        (KJS::VarStatementNode::VarStatementNode):
+        (KJS::ForNode::ForNode):
+        (KJS::CaseClauseNode::CaseClauseNode):
+        (KJS::ClauseListNode::ClauseListNode):
+        (KJS::ClauseListNode::getClause):
+        (KJS::ClauseListNode::getNext):
+        (KJS::ClauseListNode::releaseNext):
+        (KJS::ParameterNode::ParameterNode):
+        (KJS::ParameterNode::releaseNext):
+        (KJS::SourceElementsNode::releaseNext):
+        * kjs/nodes2string.cpp:
+        (ElementNode::streamTo):
+        (PropertyListNode::streamTo):
+        (ArgumentListNode::streamTo):
+        (StatListNode::streamTo):
+        (VarDeclListNode::streamTo):
+        (VarStatementNode::streamTo):
+        (CaseClauseNode::streamTo):
+        (ClauseListNode::streamTo):
+        (CaseBlockNode::streamTo):
+        (SourceElementsNode::streamTo):
+        * kxmlcore/ListRefPtr.h: Added.
+        (KXMLCore::ListRefPtr::ListRefPtr):
+        (KXMLCore::ListRefPtr::~ListRefPtr):
+        (KXMLCore::ListRefPtr::operator=):
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::RefPtr::release):
+
+2005-12-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by mjs.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=4026
+        Math.random() not seeded.
+
+        Added call to sranddev() -- it executes the first time a process
+        calls Math.random().
+
+        * kjs/math_object.cpp:
+        (MathFuncImp::callAsFunction):
+
+2005-12-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by darin.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=6265
+        Name change regression: Java doesn't know what JavaJSObject is
+
+        Changed strings passed to Java back to original "JSObject".
+
+        * bindings/jni/jni_jsobject.cpp:
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+
+2005-12-28  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        - The JSC part of http://bugs.webkit.org/show_bug.cgi?id=6268
+        Add undetectable document.all
+        
+        * kjs/operations.cpp:
+        (KJS::equal):
+        When comparing an object with null or undefined, call toPrimitive with 
+        NullType as the preferred type.
+
+2005-12-27  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Darin.
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction):
+        Implement filter and map. Also, make the existing
+        array iteration functions not invoke the callback for
+        non-existing properties, just as Mozilla does now.
+        
+        * kjs/array_object.h:
+        (KJS::ArrayProtoFunc::):
+        Add filter and map.
+        
+        * tests/mozilla/expected.html:
+        Update, two 1.6 tests now pass.
+
+2005-12-27  Maciej Stachowiak  <mjs@apple.com>
+
+        - updated test results for new JS 1.6 tests
+
+        * tests/mozilla/expected.html:
+
+2005-12-27  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        Add Mozilla JS 1.6 tests.
+        
+        * tests/mozilla/js1_6/Array/browser.js: Added.
+        * tests/mozilla/js1_6/Array/regress-290592.js: Added.
+        * tests/mozilla/js1_6/Array/regress-304828.js: Added.
+        * tests/mozilla/js1_6/Array/regress-305002.js: Added.
+        * tests/mozilla/js1_6/Array/regress-310425-01.js: Added.
+        * tests/mozilla/js1_6/Array/regress-310425-02.js: Added.
+        * tests/mozilla/js1_6/Array/regress-320887.js: Added.
+        * tests/mozilla/js1_6/Array/shell.js: Added.
+        * tests/mozilla/js1_6/README: Added.
+        * tests/mozilla/js1_6/Regress/browser.js: Added.
+        * tests/mozilla/js1_6/Regress/regress-301574.js: Added.
+        * tests/mozilla/js1_6/Regress/regress-309242.js: Added.
+        * tests/mozilla/js1_6/Regress/regress-311157-01.js: Added.
+        * tests/mozilla/js1_6/Regress/regress-311157-02.js: Added.
+        * tests/mozilla/js1_6/Regress/regress-314887.js: Added.
+        * tests/mozilla/js1_6/Regress/regress-320172.js: Added.
+        * tests/mozilla/js1_6/Regress/shell.js: Added.
+        * tests/mozilla/js1_6/String/browser.js: Added.
+        * tests/mozilla/js1_6/String/regress-306591.js: Added.
+        * tests/mozilla/js1_6/String/shell.js: Added.
+        * tests/mozilla/js1_6/browser.js: Added.
+        * tests/mozilla/js1_6/shell.js: Added.
+        * tests/mozilla/js1_6/template.js: Added.
+
+2005-12-27  Maks Orlovich <maksim@kde.org>
+
+        Reviewed and landed by Maciej.
+
+        - fixed 6234: Can delete array index property incorrectly.
+        http://bugs.webkit.org/show_bug.cgi?id=6234
+
+        * kjs/array_object.cpp:
+        (ArrayInstance::deleteProperty): use toArrayIndex instead of toUInt32 when
+        looking for array properties.
+
+2005-12-27  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Maciej.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::defineSetter):
+        Remove duplicate call to putDirect.
+
+2005-12-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin and Geoff.
+
+        Changes by me and Anders.
+
+        - mostly fixed REGRESSION: 5-10% performance regression on JS iBench from getter/setter change
+        http://bugs.webkit.org/show_bug.cgi?id=6083
+
+        - also fixed some warnings reported by -Winline
+        
+        * JavaScriptCorePrefix.h: Move new and delete definitions higher so there
+        aren't conflicts with use in standard C++ headers
+        * kjs/object.cpp:
+        (KJS::throwSetterError): Moved this piece of put into a seprate function
+        to avoid the PIC branch.
+        (KJS::JSObject::put): Use hasGetterSetterProperties to avoid expensive stuff
+        when not needed. Also use GetterSetter properties attribute.
+        (KJS::JSObject::deleteProperty): Recompute whether any properties are getter/setter
+        properties any more, if this one was one.
+        (KJS::JSObject::defineGetter): Let the PropertyMap know that it has getter/setter
+        properties now (and use the new attribute).
+        (KJS::JSObject::defineSetter): Ditto.
+        (KJS::JSObject::fillGetterPropertySlot): Out-of-line helper for getOwnPropertySlot,
+        to avoid global variable access in the hot code path.
+        * kjs/object.h:
+        (KJS::): Added GetterSetter attribute.
+        (KJS::JSCell::isObject): Moved lower to be after inline methods it uses.
+        (KJS::JSValue::isObject): ditto
+        (KJS::JSObject::getOwnPropertySlot): try to avoid impact of getters and setters
+        as much as possible in the case where they are not being used
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::containsGettersOrSetters): New method to help with this
+        * kjs/property_map.h:
+        (KJS::PropertyMap::hasGetterSetterProperties): Ditto
+        (KJS::PropertyMap::setHasGetterSetterProperties): Ditto
+        (KJS::PropertyMap::PropertyMap): Added a crazy hack to store the
+        global "has getter/setter properties" flag in the property map
+        single entry, to avoid making objects any bigger.
+        * kjs/value.h: Moved some things to object.h to make -Winline happier
+
+2005-12-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric and Dave Hyatt.
+
+        - make even const PassRefPtrs give transfer of ownership semantics
+        http://bugs.webkit.org/show_bug.cgi?id=6238
+        
+        This is a somewhat cheesy change. Having to use PassRefPtr_Ref creates ambiguities
+        in assignment and copy construction. And this makes life way easier and removes
+        the need for pass(). It is not really correct, but we pretty much never need a real
+        const PassRefPtr, and this takes care of things for PassRefPtr temporaries.
+        
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add): No more need for pass()
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::addSparseArrayPropertiesToReferenceList): No more need for pass()
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::create): Use adoptRef
+        (KJS::UString::UString): No more need for pass
+        (KJS::UString::append): No more need for pass
+        (KJS::UString::substr): No more need for pass
+        * kxmlcore/PassRefPtr.h: made m_ptr mutable (ugh)
+        (KXMLCore::PassRefPtr::PassRefPtr): Take a const PassRefPtr reference
+        (KXMLCore::PassRefPtr::release): Made this a const method (ugh)
+        (KXMLCore::PassRefPtr::operator=): clean up appropriately
+        (KXMLCore::adoptRef): Added this to use instead of PassRefPtr<T>::adopt, I think
+        it makes the behavior more clear and it is less verbose.
+        (KXMLCore::static_pointer_cast): use adoptRef
+        (KXMLCore::const_pointer_cast): use adoptRef
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::RefPtr::RefPtr): take const PassRefPtr&
+        (KXMLCore::PassRefPtr::operator=): take const PassRefPtr&
+
+2005-12-25  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        Unbreak HashTableConstIterator++ by returning const_iterator
+
+        * kxmlcore/HashTable.h:
+        (KXMLCore::HashTableConstIterator::operator++): use const_iterator
+
+2005-12-25  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        Un-break HashTable copy constructor.
+
+        * kxmlcore/HashTable.h:
+        (KXMLCore::::HashTable): use const_iterator instead
+
+2005-12-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - fixed "HashMap does not work with const pointer keys or values"
+        http://bugs.webkit.org/show_bug.cgi?id=6222
+        
+        * kxmlcore/HashMapPtrSpec.h:
+        (KXMLCore::HashMap): In all methods, explicitly cast all pointers
+        to void * before passing to internal implementation. Use C-style
+        casts instead of new-style casts, because the real solution would
+        require a combo of reinterpret_cast anc const_cast.
+
+
+2005-12-23  Maciej Stachowiak  <mjs@apple.com>
+
+        - this time for sure
+
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::::swap):
+
+2005-12-22  Maciej Stachowiak  <mjs@apple.com>
+
+        - fix build problem from last commit.
+
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::::swap):
+
+2005-12-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - Make HashMap/HashSet support non-POD types
+        http://bugs.webkit.org/show_bug.cgi?id=5332
+
+        The changes for support are relatively simple, but I also made extensive changes to
+        avoid copying, so that there isn't refcount thrash when you put RefPtrs into a HashMap.
+
+        * kxmlcore/HashTable.h:
+        (KXMLCore::swap): specialize swap for pairs, to swap elements individually,
+        so that excess copies can be avoided.
+        (KXMLCore::Mover::move): Template function to either copy or swap, used
+        when transferring elements from old table to new.
+        (KXMLCore::IdentityHashTranslator::hash): The old "converting lookup" templates
+        that took two or three function parameters now take a class parameter, this is
+        the class used to do a normal lookup.
+        (KXMLCore::IdentityHashTranslator::equal): Ditto.
+        (KXMLCore::IdentityHashTranslator::translate): Ditto. Translate now takes a reference
+        to write into instead of returning a value to avoid redundant copies.
+        (KXMLCore::HashTable::~HashTable): Use deallocateTable instead of freeing directly.
+        (KXMLCore::HashTable::insert): Based on HashTranslator now instead of separate
+        functions. Added a FIXME about a remaining rare excess copy.
+        (KXMLCore::HashTable::isEmptyBucket): Use KeyTraits directly instead of unwrapping
+        the key from Traits, to avoid creating and destroying pair, which copies.
+        (KXMLCore::HashTable::isDeletedBucket): ditto
+        (KXMLCore::HashTable::lookup): Use HashTranslator now instead of separate functions.
+        (KXMLCore::HashTable::initializeBucket): Renamed from emptyBucket. Use placement new to
+        work right for non-POD types.
+        (KXMLCore::HashTable::deleteBucket): Use assignDeleted to avoid excess copies.
+        (KXMLCore::HashTable::reinsert): use Mover template to copy or swap as appropriate
+        (KXMLCore::HashTable::allocateTable): Initialize every bucket if calloc won't do.
+        (KXMLCore::HashTable::deallocateTable): Destruct every bucket if needed.
+        (KXMLCore::HashTable::rehash): Avoid copy before reinserting, so that swap can do its magic.
+        (KXMLCore::HashTable::clear): use deallocateTable instead of freeing directly.
+        (KXMLCore::HashTable::HashTable): be more dumb when copying to ensure that non-POD types
+        work right
+        * kxmlcore/HashFunctions.h:
+        (KXMLCore::PointerHash): Specialize PointerHash for RefPtr
+        * kxmlcore/HashMap.h:
+        (KXMLCore::extractFirst): Return a reference not a full object to avoid
+        copies.
+        (KXMLCore::HashMapTranslator::hash): Use a special translator for insertion
+        to defer making the pair as long as possible, thus avoiding needless copies.
+        (KXMLCore::HashMapTranslator::equal): ditto
+        (KXMLCore::HashMapTranslator::translate): ditto
+        (KXMLCore::::inlineAdd): Shared by set and add to insert using HashMapTranslator
+        (KXMLCore::::set): Use inlineAdd
+        (KXMLCore::::add): Use inlineAdd
+        * kxmlcore/HashMapPtrSpec.h:
+        (KXMLCore::): Pass KeyTraits along
+        * kxmlcore/HashSet.h:
+        (KXMLCore::identityExtract): Return a reference not a full object to avoid copies.
+        (KXMLCore::HashSetTranslatorAdapter::hash): Redo adapter stuff to work with
+        the new HashTranslator approach.
+        (KXMLCore::HashSetTranslatorAdapter::equal): ditto
+        (KXMLCore::HashSetTranslatorAdapter::translate): ditto
+        (KXMLCore::::insert): ditto
+        * kxmlcore/HashTraits.h:
+        (KXMLCore::GenericHashTraits): This is intended be used as a base class for
+        customized traits: sensible defaults.
+        (KXMLCore::): Use it a bunch
+        (KXMLCore::assignDeleted): template function to allow pairs to be assigned the
+        deleted value w/o excess copies.
+        (KXMLCore::PairHashTraits::emptyValue): Updated
+        (KXMLCore::PairHashTraits::deletedValue): Updated
+        (KXMLCore::PairHashTraits::assignDeletedValue): part of assignDeleted hack
+        (KXMLCore::DeletedValueAssigner::assignDeletedValue): Use template magic
+        to either use use deletedValue or assignDeletedValue for the cases where we care.
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::RefPtr::swap): Added swap method.
+        (KXMLCore::swap): Added swap free function.
+        * kjs/identifier.cpp:
+        (KJS::CStringTranslator::hash): Use new HashTranslator class approach to
+        alternate type based insertion.
+        (KJS::CStringTranslator::equal): ditto
+        (KJS::CStringTranslator::translate): ditto
+        (KJS::Identifier::add): ditto
+        (KJS::UCharBufferTranslator::hash): ditto
+        (KJS::UCharBufferTranslator::equal): ditto
+        (KJS::UCharBufferTranslator::translate): ditto
+
+        - irrelevant change:
+        
+        * kjs/array_object.cpp:
+        (ArrayProtoFunc::callAsFunction): Removed a stray space.
+
+2005-12-22  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Eric and Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6196
+        Would like to be able to define prototypes in headers
+        
+        * kjs/lookup.h:
+        Move ClassName from KJS_DECLARE_PROTOTYPE to KJS_IMPLEMENT_PROTOTYPE.
+        Also, namespace all macros by prefixing them with KJS_. 
+
+2005-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=6191
+          RefPtr/PassRefPtr have a leak issue, operator== issues
+
+        * kxmlcore/PassRefPtr.h:
+        (KXMLCore::PassRefPtr::PassRefPtr): Remove non-template constructor that takes RefPtr
+        since the constructor template that takes RefPtr should be sufficient. Add a constructor
+        template that takes PassRefPtr&.
+        (KXMLCore::PassRefPtr::adopt): Use PassRefPtr_Ref to avoid setting pointer first to
+        0 and then to the pointer.
+        (KXMLCore::PassRefPtr::operator=): Added template versions that take PassRefPtr& and
+        RefPtr parameters.
+        (KXMLCore::PassRefPtr::operator PassRefPtr<U>): Changed to fix leak -- old version
+        would release and then ref.
+        (KXMLCore::operator==): Make templates have two parameters so you can mix types.
+        Also remove unneeded const in raw pointer versions.
+        (KXMLCore::operator!=): Ditto.
+
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::RefPtr::RefPtr): Add constructor template that takes PassRefPtr.
+        (KXMLCore::RefPtr::operator=): Add assignment operator templates that take
+        RefPtr and PassRefPtr.
+        (KXMLCore::operator==): Make templates have two parameters so you can mix types.
+        Also remove unneeded const in raw pointer versions.
+        (KXMLCore::operator!=): Ditto.
+
+2005-12-21  Timothy Hatcher  <timothy@apple.com>
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+          Set tab width to 8, indent width to 4 and uses tabs to false per file.
+
+2005-12-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        Removed evil hack for determining if a type is an integer, replaced
+        with template metaprogramming.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Set tab size to 2 for
+        testkjs.cpp
+        * kjs/testkjs.cpp:
+        (main): Inserted asserts to test IsInteger. FIXME: Move these to
+        KXMLCore unit tests directory when we create one.
+        * kxmlcore/HashTraits.h:
+        (KXMLCore::): Added IsInteger class for querying types.
+
+2005-12-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - made ALWAYS_INLINE declare things inline as well as __attribute__((always_inline))
+        http://bugs.webkit.org/show_bug.cgi?id=6159
+
+        * kxmlcore/AlwaysInline.h:
+
+2005-12-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - fixed a leak in the assignment operator from PassRefPtr to RefPtr
+        http://bugs.webkit.org/show_bug.cgi?id=6158
+
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::RefPtr::operator=):
+
+        - fix problem with PassRefPtr that darin spotted - it lacked a copy constructor
+        and therefore was using the default one, which can lead to excess derefs
+
+        I fixed this by adding a copy constructor from non-const
+        reference, and by adding a template pass() function that you have
+        to use when raw pointer or RefPtr are passed where PassRefPtr is
+        expected.
+
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add): Changed to have PassRefPtr return type and
+        pass() the results.
+        * kjs/identifier.h:
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::addSparseArrayPropertiesToReferenceList): Use pass()
+        where required.
+        * kjs/ustring.cpp:
+        (KJS::UString::UString): Use pass() as needed.
+        (KJS::UString::append): ditto
+        (KJS::UString::substr): ditto
+        * kjs/ustring.h:
+        (KJS::UString::UString): Use initializer instead of assignment
+        * kxmlcore/PassRefPtr.h:
+        (KXMLCore::PassRefPtr::PassRefPtr): Added copy constructor
+        (KXMLCore::pass): new template function to make it convenient to pass
+        a PassRefPtr
+
+2005-12-19  Geoffrey Garen  <ggaren@apple.com>
+  
+        Reviewed by Maciej.
+
+        Fixed <rdar://problem/4370397> Missing return statement in
+        JSMethodNameToObjcMethodName.
+
+        JSMethodNameToObjcMethodName had a check for a name being too long, but
+        the check was missing a return statement.
+
+        A lot of this code was confusing and some of it was wrong, so I fixed
+        it up, added some asserts to catch this type of bug in the future, 
+        changed some comments, and renamed some variables.
+
+        The two advantages of the new algorithm are (1) It makes writing past
+        the end of the buffer virtually impossible because the test on the main
+        loop is "while (not past end of buffer)" and (2) It's twice as fast
+        because it doesn't call strlen. (There's no need to call strlen when
+        we're walking the string ourselves.) 
+        
+        methodsNamed also supports arbitrary-length method names now. Just in 
+        case the AppKit folks start getting REALLY verbose...
+
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::methodsNamed):
+        * bindings/objc/objc_utility.h:
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::JSMethodNameToObjcMethodName):
+
+2005-12-19  Darin Adler  <darin@apple.com>
+
+        Originally done by both George Staikos and Alexey Proskuryakov.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=5706
+          Sharedptr dependency can be removed
+
+        Our coding guidelines say "use 0 instead of NULL" and both RefPtr and
+        PassRefPtr were using NULL, which required including a header that
+        defines NULL.
+
+        * kxmlcore/PassRefPtr.h:
+        (KXMLCore::PassRefPtr::PassRefPtr): Use 0 instead of NULL.
+        (KXMLCore::PassRefPtr::operator!): Use ! instead of == NULL.
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::RefPtr::RefPtr): Use 0 instead of NULL.
+        (KXMLCore::RefPtr::operator!): Use ! instead of == NULL.
+        Also did some reformatting.
+
+2005-12-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen and Eric Seidel.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=4923
+          stop using <ostream> in WebCore, eliminating the <cmath> troubles it causes
+
+        * kjs/simple_number.h: Removed many unnecessary includes, including
+        the <cmath> one to work around GCC library header bugs. We may have to
+        add some includes elsewhere for platforms other than OS X, since our
+        prefix header takes care of some things.
+
+        * kxmlcore/AlwaysInline.h: Added. Now clients that don't include
+        simple_number.h can still get the ALWAYS_INLINE macro.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added AlwaysInline.h.
+
+        * bindings/NP_jsobject.h: Removed a lot of unnecessary includes
+        and removed C-specific stuff from this C++-only header.
+        * bindings/jni/jni_jsobject.h: Removed a lot of unnecessary includes
+        and did some reformatting.
+        * bindings/objc/objc_runtime.h:  Removed an unnecessary include.
+        * bindings/runtime.h: Removed some unneeded includes. Reformatted.
+        * bindings/runtime.cpp: Updated to compile with header changes,
+        including a lot of reformatting.
+        * bindings/runtime_object.h: Removed an unnecessary include.
+
+2005-12-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff and Adele
+
+        - replaced custom Identifier hashtable with HashSet
+
+        * kjs/identifier.cpp:
+        (KXMLCore::):
+        (KJS::identifierTable):
+        (KJS::Identifier::equal):
+        (KJS::hash):
+        (KJS::equal):
+        (KJS::convert):
+        (KJS::Identifier::add):
+        (KJS::Identifier::remove):
+        * kjs/identifier.h:
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::initGlobalObject):
+
+2005-12-18  Justin Haygood  <justin@xiondigital.net>
+
+        Reviewed, tweaked, and landed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=5227
+          Array indexOf() extension for JavaScript 1.5 Core
+
+        * kjs/array_object.h:
+        * kjs/array_object.cpp: (ArrayProtoFunc::callAsFunction): Added implementation of indexOf.
+
+2005-12-18  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Darin and Geoffrey.
+
+        - fix for <http://bugs.webkit.org/show_bug.cgi?id=4000>
+        Object.prototype is missing isPrototypeOf
+        
+        * kjs/object_object.cpp:
+        (ObjectPrototype::ObjectPrototype):
+        Add isPrototypeOf to object prototype.
+        
+        (ObjectProtoFunc::callAsFunction):
+        Implement isPrototypeOf
+        
+        * kjs/object_object.h:
+        (KJS::ObjectProtoFunc::):
+        Add id for isPrototypeOf.
+
+2005-12-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=6119
+        split() function ignores case insensitive modifier.
+
+        Glossary:
+        RegExpImp: The C++ object you get when JavaScript executes
+                   "new RegExp()".
+        RegExp:    A C++ wrapper object that performs regular expression
+                   matching on behalf of a RegExpImp.
+
+        Instead of unnecessarily constructing a RegExp which (wrongly) lacks
+        any modifiers, String.split() now uses the RegExp built in to the 
+        RegExpImp passed to it, which has the right modifiers already.
+
+        I also cleaned up other bits of the string code to standardized how
+        we handle RegExpImp arguments.
+
+        * ChangeLog:
+        * kjs/string_object.cpp:
+        (replace):
+        (StringProtoFunc::callAsFunction):
+
+2005-12-16  David Hyatt  <hyatt@apple.com>
+
+        Remove unused RefPtr constructors that can create an ambiguity in ustring on some platforms.
+        
+        Reviewed by mjs
+
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::RefPtr::RefPtr):
+
+2005-12-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=5688
+          speed up JavaScript parsing by not creating a UString just to parse
+
+        * kjs/internal.h:
+        * kjs/internal.cpp: (KJS::InterpreterImp::evaluate): Change to take a character pointer
+        and length rather than a UString.
+
+        * kjs/interpreter.h:
+        * kjs/interpreter.cpp: (Interpreter::evaluate): Ditto.
+
+        * kjs/protect.h: Remove uneeded "convert to bool" operator since we already have a
+        "convert to raw pointer" operator in this class.
+
+=== Safari-521~5 ===
+
+2005-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Updated test results to match Anders's last fix.
+
+        * tests/mozilla/expected.html:
+
+2005-12-13  Anders Carlsson  <andersca@mac.com>
+
+        * ChangeLog: Add titles for my bugzilla bugs.
+
+2005-12-13  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Darin.
+
+        - Fixes <http://bugs.webkit.org/show_bug.cgi?id=6041>
+        Support property getters and setters.
+        
+        * bindings/runtime_array.cpp:
+        (RuntimeArray::lengthGetter):
+        (RuntimeArray::indexGetter):
+        * bindings/runtime_array.h:
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::lengthGetter):
+        * bindings/runtime_method.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::fallbackObjectGetter):
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::methodGetter):
+        * bindings/runtime_object.h:
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstance::lengthGetter):
+        (getProperty):
+        Update for changes to PropertySlot::getValue and
+        PropertySlot::GetValueFunc.
+        
+        * kjs/collector.cpp:
+        (KJS::className):
+        Handle GetterSetterType.
+        
+        * kjs/function.cpp:
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::Arguments::mappedIndexGetter):
+        (KJS::ActivationImp::argumentsGetter):
+        * kjs/function.h:
+        Update for changes to PropertySlot::getValue and
+        PropertySlot::GetValueFunc.
+        
+        * kjs/grammar.y:
+        Rework grammar parts for get set declarations directly
+        in the object literal.
+        
+        * kjs/internal.cpp:
+        (KJS::GetterSetterImp::mark):
+        (KJS::GetterSetterImp::toPrimitive):
+        (KJS::GetterSetterImp::toBoolean):
+        (KJS::GetterSetterImp::toNumber):
+        (KJS::GetterSetterImp::toString):
+        (KJS::GetterSetterImp::toObject):
+        Add type conversion functions. These aren't meant to be called.
+        
+        (KJS::printInfo):
+        Handle GetterSetterType.
+        
+        * kjs/lookup.h:        
+        (KJS::staticFunctionGetter):
+        (KJS::staticValueGetter):
+        Update for changes to PropertySlot::GetValueFunc.
+        
+        * kjs/nodes.cpp:
+        Refactor they way properties nodes are implemented.
+        We now have a PropertyListNode which is a list of PropertyNodes.
+        Each PropertyNode has a name (which is a PropertyNameNode) and an associated
+        value node. PropertyNodes can be of different types. The Constant type is the
+        old constant declaration and the Getter and Setter types are for property getters
+        and setters.
+        (ResolveNode::evaluate):
+        Update for changes to PropertySlot::getValue.
+        
+        (PropertyListNode::evaluate):
+        Go through all property nodes and set them on the newly created object. If the
+        property nodes are of type Getter or Setter, define getters and setters. Otherwise,
+        just add the properties like before.
+        
+        (PropertyNode::evaluate):
+        This should never be called directly.
+        
+        (PropertyNameNode::evaluate):
+        Rename from PropertyNode::evaluate.
+        
+        (FunctionCallResolveNode::evaluate):
+        (FunctionCallBracketNode::evaluate):
+        (FunctionCallDotNode::evaluate):
+        (PostfixResolveNode::evaluate):
+        (PostfixBracketNode::evaluate):
+        (PostfixDotNode::evaluate):
+        (TypeOfResolveNode::evaluate):
+        (PrefixResolveNode::evaluate):
+        (PrefixBracketNode::evaluate):
+        (PrefixDotNode::evaluate):
+        (AssignResolveNode::evaluate):
+        (AssignDotNode::evaluate):
+        (AssignBracketNode::evaluate):
+        Update for changes to PropertySlot::getValue.
+        
+        * kjs/nodes.h:
+        (KJS::PropertyNameNode::PropertyNameNode):
+        Rename from PropertyNode.
+        
+        (KJS::PropertyNode::):
+        (KJS::PropertyNode::PropertyNode):
+        New class, representing a single property.
+        
+        (KJS::PropertyListNode::PropertyListNode):
+        Rename from PropertyValueNode.
+        
+        (KJS::FuncExprNode::FuncExprNode):
+        Put ParameterNode parameter last, and make it optional.
+        
+        (KJS::ObjectLiteralNode::ObjectLiteralNode):
+        Use a PropertyListNode here now.
+        
+        * kjs/nodes2string.cpp:
+        (PropertyListNode::streamTo):
+        Iterate through all property nodes.
+        
+        (PropertyNode::streamTo):
+        Print out the name and value. Doesn't handle getters and setters currently.
+        
+        (PropertyNameNode::streamTo):
+        Rename from PropertyNode::streamTo.
+        
+        * kjs/object.cpp:
+        (KJS::JSObject::get):
+        Update for changes to PropertySlot::getValue.
+        
+        (KJS::JSObject::put):
+        If the property already exists and has a Setter, invoke
+        the setter function instead of setting the property directly.
+        
+        (KJS::JSObject::defineGetter):
+        (KJS::JSObject::defineSetter):
+        New functions for defining property getters and setters on the object.
+        
+        * kjs/object.h:
+        (KJS::GetterSetterImp::type):
+        (KJS::GetterSetterImp::GetterSetterImp):
+        (KJS::GetterSetterImp::getGetter):
+        (KJS::GetterSetterImp::setGetter):
+        (KJS::GetterSetterImp::getSetter):
+        (KJS::GetterSetterImp::setSetter):
+        New class for properties which have getters and setters defined.
+        This class is only used internally and should never be seen from the outside.
+        
+        (KJS::JSObject::getOwnPropertySlot):
+         If the property is a getter, call setGetterSlot on the property slot.
+         
+        * kjs/object_object.cpp:
+        (ObjectPrototype::ObjectPrototype):
+        Add __defineGetter__, __defineSetter, __lookupGetter__, __lookupSetter__
+        to prototype.
+        
+        (ObjectProtoFunc::callAsFunction):
+        Implement handlers for new functions.
+        
+        * kjs/object_object.h:
+        (KJS::ObjectProtoFunc::):
+        Add ids for new functions.
+        
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::undefinedGetter):
+        Update for changes to PropertySlot::GetValueFunc.
+        
+        (KJS::PropertySlot::functionGetter):
+        Call the function getter object and return its value.
+        
+        * kjs/property_slot.h:
+        (KJS::PropertySlot::getValue):
+        Add a new argument which is the original object that
+        getPropertySlot was called on.
+        
+        (KJS::PropertySlot::setGetterSlot):
+        (KJS::PropertySlot::):
+        New function which sets a getter slot. When getValue is called on a 
+        getter slot, the getter function object is invoked.
+        
+        * kjs/string_object.cpp:
+        (StringInstance::lengthGetter):
+        (StringInstance::indexGetter):
+        * kjs/string_object.h:
+        Update for changes to PropertySlot::GetValueFunc.
+        
+        * kjs/value.h:
+        (KJS::):
+        Add GetterSetterType and make GetterSetterImp a friend class of JSCell.
+
+2005-12-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - added a new HashCountedSet class for the common pattern of mapping items to counts that can change
+        
+        * kxmlcore/HashCountedSet.h: Added.
+        (KXMLCore::HashCountedSet::*): Implemented, on top of HashMap.
+        * kxmlcore/HashMap.h:
+        (KXMLCore::HashMap::add): New method - does not replace existing value if key already present
+        but otherwise like set().
+        (KXMLCore::HashMap::set): Improved comments.
+        * kxmlcore/HashMapPtrSpec.h:
+        (KXMLCore::HashMap::add): Added to specializations too.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add new  file.
+        * kxmlcore/HashFunctions.h: Added include of stdint.h
+        
+        - replaced the custom hashtable for values protected from GC with HashCountedSet
+
+        * kjs/collector.cpp:
+        (KJS::Collector::protect): Moved code here from ProtectedValues::increaseProtectCount
+        since the code is so simple now.
+        (KJS::Collector::unprotect): Ditto for ProtectedValues::decreaseProtectCount.
+        (KJS::Collector::markProtectedObjects): Updated for new way of doing things, now
+        simpler and safer.
+        (KJS::Collector::numReferencedObjects): ditto
+        (KJS::Collector::rootObjectClasses): ditto
+        * kjs/collector.h: Added protect and unprotect static methods
+        * kjs/protect.h:
+        (KJS::gcProtect): Updated for removal of ProtectedValues class
+        (KJS::gcUnprotect): likewise
+        * kjs/protected_values.cpp: Removed.
+        * kjs/protected_values.h: Removed.
+
+2005-12-10  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Maciej.
+
+        - did long-promised KJS renaming:
+        
+            ValueImp -> JSValue
+            ObjectImp -> JSObject
+            AllocatedValueImp -> JSCell
+        
+        A renaming to get a class out of the way
+        
+            KJS::Bindings::JSObject -> JavaJSObject
+ 
+        and some other "imp-reduction" renaming
+        
+            *InstanceImp -> *Instance
+            *ProtoFuncImp -> *ProtoFunc
+            *PrototypeImp -> *Prototype
+            ArgumentsImp -> Arguments
+            RuntimeArrayImp -> RuntimeArray
+            RuntimeMethodImp -> RuntimeMethod
+
+        * most files and functions
+
+2005-12-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - eliminated the old Undefined(), Null(), Boolean(), Number(), and String()
+
+        Code now uses jsUndefined(), jsNull(), jsBoolean(), jsNumber(), and jsString().
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_Evaluate):
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::invokeMethod):
+        (KJS::Bindings::CInstance::invokeDefaultMethod):
+        * bindings/c/c_runtime.cpp:
+        (CField::valueFromInstance):
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertNPVariantToValue):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        (JavaInstance::invokeDefaultMethod):
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::eval):
+        (JSObject::convertJObjectToValue):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaArray::convertJObjectToArray):
+        (JavaField::valueFromInstance):
+        (JavaArray::valueAt):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (ObjcFallbackObjectImp::callAsFunction):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertNSStringToString):
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/runtime.h:
+        (KJS::Bindings::Class::fallbackObject):
+        (KJS::Bindings::Instance::getValueOfUndefinedField):
+        (KJS::Bindings::Instance::valueOf):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::lengthGetter):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::lengthGetter):
+        (RuntimeMethodImp::callAsFunction):
+        (RuntimeMethodImp::execute):
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::lengthGetter):
+        (CompareWithCompareFunctionArguments::CompareWithCompareFunctionArguments):
+        (ArrayPrototypeImp::ArrayPrototypeImp):
+        (ArrayProtoFuncImp::ArrayProtoFuncImp):
+        (ArrayProtoFuncImp::callAsFunction):
+        (ArrayObjectImp::ArrayObjectImp):
+        * kjs/bool_object.cpp:
+        (BooleanPrototypeImp::BooleanPrototypeImp):
+        (BooleanProtoFuncImp::callAsFunction):
+        (BooleanObjectImp::BooleanObjectImp):
+        (BooleanObjectImp::callAsFunction):
+        * kjs/error_object.cpp:
+        (ErrorPrototypeImp::ErrorPrototypeImp):
+        (ErrorProtoFuncImp::ErrorProtoFuncImp):
+        (ErrorProtoFuncImp::callAsFunction):
+        (ErrorObjectImp::ErrorObjectImp):
+        (NativeErrorImp::NativeErrorImp):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::FunctionImp::processParameters):
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::DeclaredFunctionImp::execute):
+        (KJS::encode):
+        (KJS::decode):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function_object.cpp:
+        (FunctionPrototypeImp::FunctionPrototypeImp):
+        (FunctionPrototypeImp::callAsFunction):
+        (FunctionProtoFuncImp::callAsFunction):
+        (FunctionObjectImp::FunctionObjectImp):
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::initGlobalObject):
+        * kjs/interpreter.h:
+        * kjs/lookup.h:
+        * kjs/math_object.cpp:
+        (MathObjectImp::getValueProperty):
+        (MathFuncImp::callAsFunction):
+        * kjs/nodes.cpp:
+        (Node::setExceptionDetailsIfNeeded):
+        (NullNode::evaluate):
+        (PropertyNode::evaluate):
+        (FunctionCallBracketNode::evaluate):
+        (FunctionCallDotNode::evaluate):
+        (PostfixBracketNode::evaluate):
+        (PostfixDotNode::evaluate):
+        (VoidNode::evaluate):
+        (PrefixBracketNode::evaluate):
+        (PrefixDotNode::evaluate):
+        (ShiftNode::evaluate):
+        (valueForReadModifyAssignment):
+        (AssignDotNode::evaluate):
+        (AssignBracketNode::evaluate):
+        (VarDeclNode::evaluate):
+        (VarDeclNode::processVarDecls):
+        (VarDeclListNode::evaluate):
+        (ReturnNode::execute):
+        (CaseClauseNode::evalStatements):
+        (ParameterNode::evaluate):
+        (FuncDeclNode::processFuncDecl):
+        * kjs/nodes.h:
+        (KJS::StatementNode::evaluate):
+        * kjs/number_object.cpp:
+        (NumberPrototypeImp::NumberPrototypeImp):
+        (NumberProtoFuncImp::callAsFunction):
+        (NumberObjectImp::NumberObjectImp):
+        (NumberObjectImp::getValueProperty):
+        (NumberObjectImp::callAsFunction):
+        * kjs/object.cpp:
+        (KJS::ObjectImp::get):
+        (KJS::Error::create):
+        * kjs/object_object.cpp:
+        (ObjectPrototypeImp::ObjectPrototypeImp):
+        (ObjectProtoFuncImp::callAsFunction):
+        (ObjectObjectImp::ObjectObjectImp):
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::undefinedGetter):
+        * kjs/regexp_object.cpp:
+        (RegExpPrototypeImp::RegExpPrototypeImp):
+        (RegExpProtoFuncImp::callAsFunction):
+        (RegExpObjectImp::RegExpObjectImp):
+        (RegExpObjectImp::arrayOfMatches):
+        (RegExpObjectImp::getBackref):
+        (RegExpObjectImp::getLastMatch):
+        (RegExpObjectImp::getLastParen):
+        (RegExpObjectImp::getLeftContext):
+        (RegExpObjectImp::getRightContext):
+        (RegExpObjectImp::getValueProperty):
+        (RegExpObjectImp::construct):
+        * kjs/string_object.cpp:
+        (StringInstanceImp::StringInstanceImp):
+        (StringPrototypeImp::StringPrototypeImp):
+        (replace):
+        (StringProtoFuncImp::callAsFunction):
+        (StringObjectImp::StringObjectImp):
+        (StringObjectImp::callAsFunction):
+        (StringObjectFuncImp::StringObjectFuncImp):
+        (StringObjectFuncImp::callAsFunction):
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction):
+        (VersionFunctionImp::callAsFunction):
+        * kjs/value.h:
+
+2005-12-10  Oliver Hunt  <ojh16@student.canterbury.ac.nz>
+
+        Reviewed by Maciej, landed by Darin.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=3539
+          Array join and toString methods do not support circular references
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::callAsFunction):
+        Added set of visited objects -- don't recurse if item is already in the set.
+
+2005-12-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        - fix major memory leak and resultant slowdown on JavaScript iBench from
+        my PassRefPtr changes
+        
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::create): I forgot to change one of the two overloads to create
+        with a refcount of 0 instead of 1 (the smart pointer then bumps it. But instead of
+        changing it, I changed both to start with a refcounter of 1 and use PassRefPtr::adopt
+        to adopt the initial refcount, this may be a hair more efficient.
+
+        - made the assignment operators for smart pointers inline because Shark said so
+        
+        * kxmlcore/PassRefPtr.h:
+        (KXMLCore::::operator=):
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::::operator=):
+
+2005-12-06  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Darin.
+
+        - fix build when using gcc 4
+                
+        * kjs/ustring.h:
+        Make Rep public.
+
+        * kxmlcore/PassRefPtr.h:
+        (KXMLCore::::operator):
+        Fix a typo.
+
+2005-12-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - add PassRefPtr, a smart pointer class that works in conjunction
+        with RefPtr but has transfer-of-ownership semantics
+        - apply RefPtr and PassRefPtr to UString
+        - cleaned up UString a little so that it doesn't need to have so many friend classes
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add):
+        * kjs/identifier.h:
+        (KJS::Identifier::Identifier):
+        (KJS::Identifier::equal):
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::get):
+        (KJS::PropertyMap::getLocation):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::remove):
+        * kjs/ustring.cpp:
+        (KJS::UCharReference::operator=):
+        (KJS::UCharReference::ref):
+        (KJS::UString::Rep::createCopying):
+        (KJS::UString::Rep::create):
+        (KJS::UString::usedCapacity):
+        (KJS::UString::usedPreCapacity):
+        (KJS::UString::expandCapacity):
+        (KJS::UString::expandPreCapacity):
+        (KJS::UString::UString):
+        (KJS::UString::spliceSubstringsWithSeparators):
+        (KJS::UString::append):
+        (KJS::UString::operator=):
+        (KJS::UString::toStrictUInt32):
+        (KJS::UString::substr):
+        (KJS::UString::copyForWriting):
+        (KJS::operator==):
+        * kjs/ustring.h:
+        (KJS::UString::UString):
+        (KJS::UString::~UString):
+        (KJS::UString::data):
+        (KJS::UString::isNull):
+        (KJS::UString::isEmpty):
+        (KJS::UString::size):
+        (KJS::UString::rep):
+        * kxmlcore/RefPtr.h:
+        (KXMLCore::RefPtr::RefPtr):
+        (KXMLCore::RefPtr::operator*):
+        (KXMLCore::::operator):
+        (KXMLCore::operator==):
+        (KXMLCore::operator!=):
+        (KXMLCore::static_pointer_cast):
+        (KXMLCore::const_pointer_cast):
+
+2005-12-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Update test results to match Anders's last checkin.
+
+        * tests/mozilla/expected.html:
+
+2005-12-04  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Geoffrey.
+
+        - Fixes <http://bugs.webkit.org/show_bug.cgi?id=3999>
+        Object.prototype is missing propertyIsEnumerable
+        
+        * kjs/object.cpp:
+        (KJS::ObjectImp::canPut):
+        Refactor to use getPropertyAttributes.
+
+        (KJS::ObjectImp::propertyIsEnumerable):
+        New function which checks if a property is enumerable.
+
+        (KJS::ObjectImp::getPropertyAttributes):
+        * kjs/object.h:
+        Add getPropertyAttributes and propertyIsEnumerable.
+
+        * kjs/object_object.cpp:
+        (ObjectPrototypeImp::ObjectPrototypeImp):
+        (ObjectProtoFuncImp::callAsFunction):
+        * kjs/object_object.h:
+        (KJS::ObjectProtoFuncImp::):
+        Add propertyIsEnumerable to the Object prototype.
+
+2005-12-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - removed deprecated reset, isNull and nonNull methods
+
+        * kxmlcore/RefPtr.h:
+
+2005-12-01  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Darin.
+
+        - Fixes <http://bugs.webkit.org/show_bug.cgi?id=3382>
+        nodes2strings.cpp fails to print left expression of ForInNode when 'var' is not used
+        
+        Patch by Mark Rowe.
+
+        * kjs/nodes2string.cpp:
+        (ForInNode::streamTo):
+        Add lexpr if there's no varDecl.
+
+2005-12-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Eric.
+
+        - renamed SharedPtr to RefPtr via script
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/internal.cpp:
+        (KJS::Parser::parse):
+        (KJS::InterpreterImp::checkSyntax):
+        (KJS::InterpreterImp::evaluate):
+        * kjs/internal.h:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        (KJS::SourceStream::operator<<):
+        * kjs/protect.h:
+        * kxmlcore/RefPtr.h: Added.
+        (KXMLCore::RefPtr::RefPtr):
+        (KXMLCore::RefPtr::~RefPtr):
+        (KXMLCore::RefPtr::isNull):
+        (KXMLCore::RefPtr::notNull):
+        (KXMLCore::RefPtr::reset):
+        (KXMLCore::RefPtr::get):
+        (KXMLCore::RefPtr::operator*):
+        (KXMLCore::RefPtr::operator->):
+        (KXMLCore::RefPtr::operator!):
+        (KXMLCore::RefPtr::operator UnspecifiedBoolType):
+        (KXMLCore::::operator):
+        (KXMLCore::operator==):
+        (KXMLCore::operator!=):
+        (KXMLCore::static_pointer_cast):
+        (KXMLCore::const_pointer_cast):
+        * kxmlcore/SharedPtr.h: Removed.
+
+2005-11-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - change idiom used for implicit bool conversion of smart pointers, because the old one gives weird error messages sometimes
+
+        * kjs/protect.h:
+        (KJS::ProtectedPtr::operator UnspecifiedBoolType):
+        * kxmlcore/SharedPtr.h:
+        (KXMLCore::SharedPtr::operator UnspecifiedBoolType):
+
+2005-11-29  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by ggaren.  Committed by eseidel.
+
+        Date conversion to local time gets the DST flag wrong sometimes
+        http://bugs.webkit.org/show_bug.cgi?id=5514
+
+        * kjs/date_object.cpp:
+        (KJS::isTime_tSigned):
+        (KJS::DateProtoFuncImp::callAsFunction):
+
+2005-11-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Eric.
+
+        - renamed InterpreterLock to JSLock
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_SetException):
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::call):
+        (JSObject::eval):
+        (JSObject::getMember):
+        (JSObject::setMember):
+        (JSObject::removeMember):
+        (JSObject::getSlot):
+        (JSObject::setSlot):
+        (JSObject::toString):
+        (JSObject::convertJObjectToValue):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originExecutionContext:executionContext:]):
+        * bindings/runtime.cpp:
+        (Instance::createRuntimeObject):
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::addNativeReference):
+        (KJS::Bindings::removeNativeReference):
+        (RootObject::removeAllNativeReferences):
+        * bindings/runtime_root.h:
+        (KJS::Bindings::RootObject::~RootObject):
+        (KJS::Bindings::RootObject::setRootObjectImp):
+        * bindings/testbindings.cpp:
+        (main):
+        * bindings/testbindings.mm:
+        (main):
+        * kjs/JSLock.cpp:
+        (KJS::initializeJSLock):
+        (KJS::JSLock::lock):
+        (KJS::JSLock::unlock):
+        (KJS::JSLock::lockCount):
+        (KJS::JSLock::DropAllLocks::DropAllLocks):
+        (KJS::JSLock::DropAllLocks::~DropAllLocks):
+        * kjs/JSLock.h:
+        (KJS::JSLock::JSLock):
+        (KJS::JSLock::~JSLock):
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+        (KJS::Collector::collect):
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::InterpreterImp):
+        (KJS::InterpreterImp::clear):
+        (KJS::InterpreterImp::checkSyntax):
+        (KJS::InterpreterImp::evaluate):
+        * kjs/interpreter.cpp:
+        (Interpreter::evaluate):
+        * kjs/protect.h:
+        (KJS::::ProtectedPtr):
+        (KJS::::~ProtectedPtr):
+        (KJS::::operator):
+        * kjs/protected_reference.h:
+        (KJS::ProtectedReference::ProtectedReference):
+        (KJS::ProtectedReference::~ProtectedReference):
+        (KJS::ProtectedReference::operator=):
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::getProtectCount):
+        (KJS::ProtectedValues::increaseProtectCount):
+        (KJS::ProtectedValues::decreaseProtectCount):
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction):
+        (main):
+
+2005-11-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by eseidel.  Committed by eseidel.
+
+        Inline ScopeChain functions for speed.
+        http://bugs.webkit.org/show_bug.cgi?id=5687
+
+        * kjs/object.h:
+        (KJS::ScopeChain::mark):
+        * kjs/scope_chain.cpp:
+        * kjs/scope_chain.h:
+        (KJS::ScopeChain::ref):
+        (KJS::ScopeChain::operator=):
+        (KJS::ScopeChain::bottom):
+        (KJS::ScopeChain::push):
+        (KJS::ScopeChain::pop):
+
+2005-11-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/4139620> Seed: WebKit: hang when sending XMLHttpRequest if automatic proxy config is used
+
+        Also factored locking code completely into a separate class, and
+        added a convenient packaged way to temporarily drop locks.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/JSLock.cpp: Added.
+        (KJS::initializeInterpreterLock):
+        (KJS::InterpreterLock::lock):
+        (KJS::InterpreterLock::unlock):
+        (KJS::InterpreterLock::lockCount):
+        (KJS::InterpreterLock::DropAllLocks::DropAllLocks):
+        (KJS::InterpreterLock::DropAllLocks::~DropAllLocks):
+        * kjs/JSLock.h: Added.
+        (KJS::InterpreterLock::InterpreterLock):
+        (KJS::InterpreterLock::~InterpreterLock):
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/protect.h:
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction):
+
+2005-11-21  Eric Seidel  <eseidel@apple.com>
+
+        Rubber-stamped by hyatt.
+        
+        Removed JavaScriptCore+SVG target.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2005-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by mjs.
+        
+        - Fixed <rdar://problem/4342216> Installer crash in 
+          KJS::ValueImp::marked() when garbage collector runs inside call to 
+          ConstantValues::init()
+          
+        I took responsibility for initializing and marking ConstantValues away 
+        from InterpreterImp, since it's possible to reference such a value 
+        before any interpreter has been created and after the last interpreter 
+        has been destroyed.
+
+        InterpreterImp::lock now initializes ConstantValues. It's a good
+        place for the initialization because you have to call it before
+        creating any objects. Since ::lock can be called more than once,
+        I added a check in ConstantValues::init to ensure that it executes 
+        only once.
+
+        Collector:collect is now responsible for marking ConstantValues.
+
+        We no longer clear the ConstantValues since we can't guarantee that no 
+        one has a reference to them.
+
+        FIXME: This is hackery. The long-term plan is to make ConstantValues
+        use immediate values that require no initialization.
+
+        * ChangeLog:
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::InterpreterImp):
+        (KJS::InterpreterImp::lock):
+        (KJS::InterpreterImp::clear):
+        (KJS::InterpreterImp::mark):
+        * kjs/internal.h:
+        * kjs/value.cpp:
+        (KJS::ConstantValues::initIfNeeded):
+        * kjs/value.h:
+
+2005-11-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        This patch fixes some naughty naughty code -- 5 crashes and 2 
+        may-go-haywire-in-the-futures.
+        
+        One such crash is <rdar://problem/4247330> 8C46 Crash with with 
+        incomplete parameter list to webScript object function.
+        
+        I replaced early returns from within NS_DURINGs with calls to
+        NS_VALUERETURN because the doc says, "You cannot use goto or 
+        return to exit an exception handling domain -- errors will result."
+        
+        I replaced hard-coded analyses of -[NSMethodSignature 
+        methodReturnType] with more abstracted alternatives, since
+        the documentation says "This encoding is implementation-specific, 
+        so applications should use it with caution," and then emits an
+        evil cackle.
+        
+        I removed the early return in the case where a JavaScript caller
+        supplies an insufficient number of arguments, because the right
+        thing to do in such a case is to use JavaScript's defined behavior
+        of supplying "undefined" for any missing arguments.
+        
+        I also changed ObjcInstance::invokeMethod so that it no longer
+        deletes the method passed to it. It doesn't create the method,
+        so it shouldn't delete it. A friend of mine named
+        KERNEL_PROTECTION_FAILURE agrees with me on this point.
+        
+        Finally, I changed an assert(true) to assert(false) because
+        all the other asserts were making fun of it.
+
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+
+2005-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=5571
+          REGRESSION (412.5-TOT): duplicated words/sentences at 
+          shakespeer.sourceforge.net
+
+        Our UTF16-modified PCRE didn't work with extended character classes
+        (classes involving characters > 255) because it used the GETCHARINC
+        macro to read through them. In UTF16 mode, GETCHARINC expects UTF16 
+        input, but PCRE encodes character classes in UTF8 regardless of the
+        input mode of the subject string.
+
+        The fix is to explicitly define GETUTF8CHARINC, and to use it,
+        rather than GETCHARINC, when reading extended character classes. 
+        
+        In UTF8 mode, we simply define GETCHARINC to be GETUTF8CHARINC.
+
+        * pcre/pcre_internal.h:
+        * pcre/pcre_xclass.c:
+        (_pcre_xclass):
+
+2005-11-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch by Mitz Pettel, reviewed by Maciej.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=5357
+          REGRESSION: Scriptable plugin hides properties of OBJECT element
+
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::fallbackObject):
+
+2005-11-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=5409
+        slice() testcase doesn't pass
+
+        Modified String.slice to deal with funky values.
+        Updated test results. We now pass <js1_2/String/slice.js>.
+
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::callAsFunction):
+        * tests/mozilla/expected.html:
+
+2005-11-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        * kxmlcore/HashSet.h: Fixed case of "hashfunctions.h" -- needs to be "HashFunctions.h".
+
+2005-11-03  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin and Vicki.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+          Change to use $(SYSTEM_LIBRARY_DIR) consistently and place
+          $(NEXT_ROOT) in a few spots to make build-root work.
+
+2005-11-03  Geoffrey Garen  <ggaren@apple.com>
+
+        - Updated JavaScriptCore test results to reflect recent fixes.
+
+        * tests/mozilla/expected.html:
+
+2005-11-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by darin.
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=5602
+          REGRESSION: RegExp("[^\\s$]+", "g") returns extra matches
+
+        We now update lastIndex relative to the start of the last match,
+        rather than the start of the last search. We used to assume that
+        the two were equal, but that is not the case when a pattern
+        matches at a character after the first in the string.
+
+        * kjs/regexp_object.cpp:
+        (RegExpProtoFuncImp::callAsFunction):
+
+2005-10-24  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Darin Adler. Code changes by Alexey Proskuryakov.
+        
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4931
+        Unicode format characters (Cf) should be removed from JavaScript source
+
+        * kjs/lexer.cpp:
+        include <unicode/uchar.h>
+        (Lexer::Lexer):
+        use KJS::UChar instead of UChar to avoid ambiguity caused by new include
+        (Lexer::setCode):
+        ditto; also, use shift(4) to skip first 4 chars to take advantage of new
+        logic there.
+        (Lexer::shift):
+        skip chars of type U_FORMAT_CHAR
+        (Lexer::convertUnicode):
+        use KJS::UChar instead of UChar to avoid ambiguity caused by new include
+        (Lexer::record16):
+        ditto
+        (Lexer::makeIdentifier):
+        ditto
+        (Lexer::makeUString):
+        ditto
+        
+        * tests/mozilla/ecma/Array/15.4.5.1-1.js:
+        updated to skip soft hyphens
+
+2005-10-24  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Darin Adler. Code changes by George Staikos/Geoff Garen.
+        
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4142
+        Date object does not always adjust daylight savings correctly
+
+        * kjs/date_object.cpp:
+        (KJS::makeTime):
+        Fix the case where a time change crosses the daylight savings start/end dates.
+
+2005-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff. Code changes by Darin.
+
+        - some micro-optimizations to FastMalloc to reduce math and branches.
+
+        * kxmlcore/FastMalloc.cpp:
+        (KXMLCore::TCMalloc_Central_FreeList::Populate):
+        (KXMLCore::fastMallocRegisterThread):
+        (KXMLCore::TCMalloc_ThreadCache::GetCache):
+        (KXMLCore::TCMalloc_ThreadCache::GetCacheIfPresent):
+
+2005-10-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reverted fix for this bug, because it was part of a time range that caused a performance
+        regression:
+        
+        <rdar://problem/4260481> Remove Reference type from JavaScriptCore
+
+2005-10-15  Darin Adler  <darin@apple.com>
+
+        * kxmlcore/HashTable.cpp: Fixed build failure (said hashtable.h instead of HashTable.h).
+
+2005-10-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Style changes recommended by Darin.
+        
+        Changed to camelCase, changed ValueImp* to ValueImp *.
+
+        * kjs/simple_number.h:
+        (KJS::SimpleNumber::make):
+        (KJS::SimpleNumber::value):
+
+2005-10-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Added regexp_object.lut.h build phase from JavaScriptCore
+        to JavaScriptCore+SVG.
+
+        Reviewed by mitz.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2005-10-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed build bustage from last checkin (stray characters
+        in the project file).
+
+        Reviewed by mitz.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2005-10-11  Geoffrey Garen  <ggaren@apple.com>
+
+        New JavaScriptCore test results to reflect the last change.
+
+        * tests/mozilla/expected.html:
+
+2005-10-10  Geoffrey Garen  <ggaren@apple.com>
+
+        - Implemented caching of match state inside the global RegExp object
+          (lastParen, leftContext, rightContext, lastMatch, input).
+
+          exec(), test(), match(), search(), and replace() now dipatch regular
+          expression matching through the RegExp object's performMatch function, 
+          to facilitate caching. This replaces registerRegexp and 
+          setSubPatterns.
+        
+        - Implemented the special '$' aliases (e.g. RegExp.input aliases to 
+          RegExp.$_).
+
+        - Moved support for backreferences into the new static hash table
+          used for other special RegExp properties. Truncated backreferences
+          at $9 to match IE, FF, and the "What's New in Netscape 1.2?" doc.
+          (String.replace still supports double-digit backreferences.)
+
+        - Tweaked RegExp.prototype.exec to handle ginormous values in lastIndex.
+
+        Fixes 11 -- count em, 11 -- JavaScriptCore tests.
+
+        * fast/js/regexp-caching-expected.txt: Added.
+        * fast/js/regexp-caching.html: Added.
+
+        Reviewed by mjs.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added regexp_object.lut.h
+        * kjs/create_hash_table: Tweaked to allow for more exotic characters.
+                                 We now rely on the compiler to catch illegal
+                                 identifiers.
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        * kjs/regexp_object.cpp:
+        (RegExpProtoFuncImp::callAsFunction):
+        (RegExpObjectImp::RegExpObjectImp):
+        (RegExpObjectImp::performMatch):
+        (RegExpObjectImp::arrayOfMatches):
+        (RegExpObjectImp::backrefGetter):
+        (RegExpObjectImp::getLastMatch):
+        (RegExpObjectImp::getLastParen):
+        (RegExpObjectImp::getLeftContext):
+        (RegExpObjectImp::getRightContext):
+        (RegExpObjectImp::getOwnPropertySlot):
+        (RegExpObjectImp::getValueProperty):
+        (RegExpObjectImp::put):
+        (RegExpObjectImp::putValueProperty):
+        * kjs/regexp_object.h:
+        (KJS::RegExpObjectImp::):
+        * kjs/string_object.cpp:
+        (substituteBackreferences):
+        (replace):
+        (StringProtoFuncImp::callAsFunction):
+
+2005-10-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej; some changes done after review.
+
+        - fixed <rdar://problem/4092064> hanging loading page; rte.ie (works in IE and Firefox)
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=5280
+          Date.setMonth fails with negative values
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=5154
+          JSC should switch to _r variants of unix time/date functions
+        - fixed a few possible overflow cases
+
+        Retested all tests to be sure nothing broke; added layout test for bug 5280.
+
+        * kjs/config.h: Removed TIME_WITH_SYS_TIME define. Also set HAVE_SYS_TIMEB_H
+        for the __APPLE__ case (the latter is accurate but irrelevant).
+
+        * kjs/date_object.h: Reformatted. Removed unnecessary include of "function_object.h".
+        Moved declarations of helper classes and functions into the cpp file.
+
+        * kjs/date_object.cpp: Removed code at top to define macros to use CoreFoundation instead of
+        POSIX date functions.
+        (KJS::styleFromArgString): Tweaked to return early instead of using a variable.
+        (KJS::formatLocaleDate): Tweaked to check for undefined rather than checking argument count.
+        (KJS::formatDate): Made parameter const.
+        (KJS::formatDateUTCVariant): Ditto.
+        (KJS::formatTime): Ditto.
+        (KJS::DateProtoFuncImp::callAsFunction): Use gmtime_r and localtime_r instead of gmtime and
+        localtime.
+        (KJS::DateObjectImp::callAsFunction): Use localtime_r instead of localtime.
+        (KJS::ymdhmsToSeconds): Renamed from ymdhms_to_seconds. Changed computation to avoid possible
+        overflow if year is an extremely large or small number.
+        (KJS::makeTime): Removed code to move large month numbers from tm_mon to tm_year; this was
+        to accomodate CFGregorianDate, which is no longer used (and didn't handle negative values).
+        (KJS::parseDate): Renamed from KRFCDate_parseDate; changed to return a value in milliseconds
+        rather than in seconds. Reformatted the code. Changed to use UTF8String() instead of ascii(),
+        since ascii() is not thread safe. Changed some variables back from int to long to avoid
+        trouble if the result of strtol does not fit in an int (64-bit issue only).
+
+2005-10-08  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Geoff.
+        Tweaked and landed by Darin.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=5266
+          Support parenthesized comments in Date.parse()
+
+        * kjs/date_object.cpp:
+        (KJS::skipSpacesAndComments): Take a pointer, and advance it past spaces,
+        and also past anything enclosed in parentheses.
+        (KJS::KRFCDate_parseDate): Use skipSpacesAndComments wherever we formerly had
+        code to skip spaces.
+
+2005-10-08  Justin Haygood  <justin@xiondigital.net>
+
+        Reviewed, tweaked, and landed by Darin.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=5189
+          pcre_exec.c fails to compile using MSVC
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=5190
+          KJS config.h adjustment for Win32
+        
+        * kjs/config.h: Make sure HAVE_MMAP and HAVE_SBRK are off for Win32.
+        Turn HAVE_ERRNO_H on for Mac OS X. Sort defines so they are easy to compare
+        with each other. Remove #undef of DEBUG_COLLECTOR.
+        * pcre/pcre_exec.c: (match): Work around strange MSVC complaint by splitting
+        the definition of a local variable into a separate declaration and
+        initialization.
+
+2005-10-05  Geoffrey Garen  <ggaren@apple.com>
+ 
+        - Darin and I rewrote our implementation of the SimpleNumber class
+          to store number bit patterns in their floating point formats.
+ 
+        My tweaks reviewed by Darin.
+        
+        ~1% speedup on JS iBench.
+        
+        * kjs/internal.h: removed obsolete jsNumber declarations.
+        * kjs/math_object.cpp:
+        (MathFuncImp::callAsFunction): changed KJS::isNaN to isNaN
+        * kjs/nodes.cpp:
+        (PostfixResolveNode::evaluate): removed obsolete knownToBeInteger
+        (PostfixBracketNode::evaluate): ditto
+        (PostfixDotNode::evaluate): ditto
+        (PrefixResolveNode::evaluate): ditto
+        (PrefixBracketNode::evaluate): ditto
+        (PrefixDotNode::evaluate): ditto
+        (NegateNode::evaluate): ditto
+        (valueForReadModifyAssignment): ditto
+        * kjs/number_object.cpp: removed obsolete comment
+        * kjs/operations.cpp:
+        (KJS::equal): removed unnecessary isNaN checks
+        (KJS::strictEqual): ditto
+        (KJS::add): removed obsolete knownToBeInteger
+        (KJS::mult): ditto
+        * kjs/operations.h: removed include of "value.h" to prevent circular reference
+        * kjs/simple_number.h: removed unnecessary #includes
+        (KJS::SimpleNumber::make): see above
+        (KJS::SimpleNumber::is): ditto
+        (KJS::SimpleNumber::value): ditto
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::callAsFunction): changed KJS::isNaN to isNaN
+        * kjs/ustring.cpp: removed unnecessary isNaN check
+        (KJS::UString::toUInt32): ditto
+        * kjs/value.cpp:
+        (KJS::jsNumber): removed obsolete jsNumber definitions
+        (KJS::ConstantValues::init): NaN is no longer a ConstantValue
+        (KJS::ConstantValues::clear): ditto
+        (KJS::ConstantValues::mark): ditto
+        * kjs/value.h: removed obsolete knownToBeInteger
+        (KJS::jsNaN): now returns a SimpleNumber
+        (KJS::ValueImp::getUInt32): changed to account for NaN being a SimpleNumber
+        (KJS::ValueImp::toBoolean): ditto
+        (KJS::ValueImp::toString): changed to account for +/- 0.0
+        (KJS::jsZero): changed to reflect that SimpleNumber::make takes a double
+        (KJS::jsOne): ditto
+        (KJS::jsTwo): ditto
+        (KJS::Number): removed obsolete non-double constructor declarations
+
+2005-10-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - fixed <rdar://problem/4260481> Remove Reference type from JavaScriptCore
+
+        Also fixed some bugs with for..in enumeration while I was at it. object
+        properties now come before prototype properties and duplicates
+        between object and prototype are listed only once.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/IdentifierSequencedSet.cpp: Added.
+        (KJS::IdentifierSequencedSet::IdentifierSequencedSet):
+        (KJS::IdentifierSequencedSet::deallocateVector):
+        (KJS::IdentifierSequencedSet::~IdentifierSequencedSet):
+        (KJS::IdentifierSequencedSet::insert):
+        * kjs/IdentifierSequencedSet.h: Added.
+        (KJS::IdentifierSequencedSetIterator::IdentifierSequencedSetIterator):
+        (KJS::IdentifierSequencedSetIterator::operator*):
+        (KJS::IdentifierSequencedSetIterator::operator->):
+        (KJS::IdentifierSequencedSetIterator::operator++):
+        (KJS::IdentifierSequencedSetIterator::operator==):
+        (KJS::IdentifierSequencedSetIterator::operator!=):
+        (KJS::IdentifierSequencedSet::begin):
+        (KJS::IdentifierSequencedSet::end):
+        (KJS::IdentifierSequencedSet::size):
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::getPropertyNames):
+        (ArrayInstanceImp::setLength):
+        (ArrayInstanceImp::pushUndefinedObjectsToEnd):
+        * kjs/nodes.cpp:
+        (ForInNode::execute):
+        * kjs/nodes.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::getPropertyNames):
+        * kjs/object.h:
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::getEnumerablePropertyNames):
+        (KJS::PropertyMap::getSparseArrayPropertyNames):
+        * kjs/property_map.h:
+        * kjs/protect.h:
+        * kjs/protected_reference.h: Removed.
+        * kjs/reference.cpp: Removed.
+        * kjs/reference.h: Removed.
+        * kjs/reference_list.cpp: Removed.
+        * kjs/reference_list.h: Removed.
+        * kjs/ustring.h:
+        (KJS::UString::impl):
+        * kxmlcore/HashSet.h:
+
+2005-10-04  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        Code cleanup, which resulted in a small win on iBench.
+
+        * kjs/object.cpp:
+        (KJS::tryGetAndCallProperty): new static inline
+        (KJS::ObjectImp::defaultValue): code cleanup
+
+2005-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from George Staikos <staikos@kde.org>, reviewed and tweaked a bit by me.
+
+        - more Linux build fixes
+        
+        * kjs/operations.cpp:
+        * kxmlcore/FastMalloc.h:
+        * kxmlcore/TCSystemAlloc.cpp:
+        (TCMalloc_SystemAlloc):
+
+2005-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from George Staikos <staikos@kde.org>, reviewed and tweaked a bit by me.
+
+        http://bugs.webkit.org/show_bug.cgi?id=5174
+        Add support for compiling on Linux (likely to help for other POSIX systems too)
+
+        * kjs/collector.cpp:
+        (KJS::Collector::markCurrentThreadConservatively):
+        (KJS::Collector::markOtherThreadConservatively):
+        * kjs/config.h:
+        * kjs/date_object.cpp:
+        (KJS::formatDate):
+        (KJS::formatDateUTCVariant):
+        (KJS::formatTime):
+        (KJS::timeZoneOffset):
+        (KJS::DateProtoFuncImp::callAsFunction):
+        (KJS::DateObjectImp::construct):
+        (KJS::DateObjectImp::callAsFunction):
+        (KJS::makeTime):
+        * kjs/identifier.cpp:
+        * kjs/internal.cpp:
+        (KJS::initializeInterpreterLock):
+        (KJS::lockInterpreter):
+        (KJS::unlockInterpreter):
+        (KJS::UndefinedImp::toPrimitive):
+        (KJS::UndefinedImp::toBoolean):
+        (KJS::UndefinedImp::toNumber):
+        (KJS::UndefinedImp::toString):
+        (KJS::NullImp::toPrimitive):
+        (KJS::NullImp::toBoolean):
+        (KJS::NullImp::toNumber):
+        (KJS::NullImp::toString):
+        (KJS::BooleanImp::toPrimitive):
+        (KJS::BooleanImp::toBoolean):
+        (KJS::BooleanImp::toNumber):
+        (KJS::BooleanImp::toString):
+        (KJS::StringImp::toPrimitive):
+        (KJS::StringImp::toBoolean):
+        (KJS::StringImp::toNumber):
+        (KJS::StringImp::toString):
+        * kjs/internal.h:
+        * kjs/protected_values.cpp:
+
+2005-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        - fix Development build after last checkin
+
+        * kxmlcore/FastMalloc.cpp:
+        (KXMLCore::fastMallocRegisterThread):
+
+2005-10-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/4283967> REGRESSION: 3% regression on PLT from new FastMalloc
+        http://bugs.webkit.org/show_bug.cgi?id=5243
+        
+        A number of optimizations to the new threadsafe malloc that make it actually as fast
+        as dlmalloc (I measured wrong before) and as memory-efficient as the system malloc.
+
+        - use fastMalloc for everything - it now gets applied to all new/delete allocations
+        via a private inline operator new that is now included into every file via config.h.
+
+        - tweaked some of the numeric parameters for size classes and amount of wasted memory
+        allowed per allocation - this saves on memory use and consequently improves speed.
+
+        - so long as the allocator is not being used on background threads, get the per-thread
+        cache from a global variable instead of from pthread_getspecific, since the latter is slow.
+
+        - inline more functions, and force the ones GCC refuses to inline with 
+        attribute(always_inline), nearly all of these have one call site so inlining them has 
+        to be a win.
+
+        - use some tricks to calculate allocation size more efficiently and fewer times for small
+        allocations, to avoid hitting the huge size table array.
+
+        - avoid hitting the per-thread cache on code paths that don't need it.
+
+        - implement inline assembly version of spinlock for PowerPC (was already done for x86)
+
+        * bindings/NP_jsobject.cpp:
+        * bindings/c/c_class.cpp:
+        * bindings/c/c_instance.cpp:
+        * bindings/c/c_runtime.cpp:
+        * bindings/c/c_utility.cpp:
+        * bindings/jni/jni_class.cpp:
+        * bindings/jni/jni_instance.cpp:
+        * bindings/jni/jni_jsobject.cpp:
+        * bindings/jni/jni_objc.mm:
+        * bindings/jni/jni_runtime.cpp:
+        * bindings/jni/jni_utility.cpp:
+        * bindings/npruntime.cpp:
+        * bindings/objc/WebScriptObject.mm:
+        * bindings/objc/objc_class.mm:
+        * bindings/objc/objc_instance.mm:
+        * bindings/objc/objc_runtime.mm:
+        * bindings/objc/objc_utility.mm:
+        * bindings/runtime.cpp:
+        * bindings/runtime_array.cpp:
+        * bindings/runtime_method.cpp:
+        * bindings/runtime_object.cpp:
+        * bindings/runtime_root.cpp:
+        * bindings/testbindings.cpp:
+        * bindings/testbindings.mm:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::ArrayInstanceImp):
+        (ArrayInstanceImp::~ArrayInstanceImp):
+        (ArrayInstanceImp::resizeStorage):
+        * kjs/bool_object.cpp:
+        * kjs/collector.cpp:
+        (KJS::Collector::registerThread):
+        * kjs/config.h:
+        * kjs/debugger.cpp:
+        * kjs/error_object.cpp:
+        * kjs/function.cpp:
+        * kjs/function_object.cpp:
+        * kjs/identifier.cpp:
+        (KJS::Identifier::rehash):
+        * kjs/internal.cpp:
+        (KJS::Parser::saveNewNode):
+        (KJS::clearNewNodes):
+        * kjs/interpreter.cpp:
+        * kjs/lexer.cpp:
+        (Lexer::doneParsing):
+        (Lexer::makeIdentifier):
+        (Lexer::makeUString):
+        * kjs/list.cpp:
+        * kjs/math_object.cpp:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        * kjs/number_object.cpp:
+        (integer_part_noexp):
+        (char_sequence):
+        * kjs/object.cpp:
+        * kjs/object_object.cpp:
+        * kjs/property_map.cpp:
+        * kjs/property_slot.cpp:
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::rehash):
+        * kjs/reference.cpp:
+        * kjs/reference_list.cpp:
+        * kjs/regexp.cpp:
+        * kjs/regexp_object.cpp:
+        * kjs/scope_chain.cpp:
+        * kjs/scope_chain.h:
+        * kjs/string_object.cpp:
+        * kjs/testkjs.cpp:
+        * kjs/ustring.h:
+        * kjs/value.cpp:
+        * kxmlcore/Assertions.mm:
+        * kxmlcore/FastMalloc.cpp:
+        (KXMLCore::InitSizeClasses):
+        (KXMLCore::DLL_IsEmpty):
+        (KXMLCore::DLL_Prepend):
+        (KXMLCore::TCMalloc_Central_FreeList::Insert):
+        (KXMLCore::TCMalloc_Central_FreeList::Remove):
+        (KXMLCore::TCMalloc_Central_FreeList::Populate):
+        (KXMLCore::TCMalloc_ThreadCache::Allocate):
+        (KXMLCore::TCMalloc_ThreadCache::FetchFromCentralCache):
+        (KXMLCore::fastMallocRegisterThread):
+        (KXMLCore::TCMalloc_ThreadCache::GetCache):
+        (KXMLCore::TCMalloc_ThreadCache::GetCacheIfPresent):
+        (KXMLCore::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        (KXMLCore::do_malloc):
+        (KXMLCore::do_free):
+        (KXMLCore::realloc):
+        * kxmlcore/FastMalloc.h:
+        (operator new):
+        (operator delete):
+        (operator new[]):
+        (operator delete[]):
+        * kxmlcore/HashTable.cpp:
+        * kxmlcore/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * kxmlcore/TCSystemAlloc.cpp:
+
+2005-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        - Second cut at fixing <rdar://problem/4275206> Denver Regression: Seed: 
+          Past Editions of Opinions display "NAN/Undefined" for www.washingtonpost.com
+                
+        Reviewed by john.
+
+        * kjs/date_object.cpp:
+        (KJS::KRFCDate_parseDate): Intead of creating a timezone when one isn't specified,
+        just rely on the fallback logic, which will do it for you. Also, return invalidDate
+        if the date includes trailing garbage. (Somewhat accidentally, the timezone logic
+        used to catch trailing garbage.)
+
+        Added test case to fast/js/date-parse-test.html.
+
+2005-09-29  Eric Seidel  <eseidel@apple.com>
+        Fix from Mitz Pettel <opendarwin.org@mitzpettel.com>
+
+        Reviewed by darin.
+
+        Fix JSC memory smasher in TOT.
+        http://bugs.webkit.org/show_bug.cgi?id=5176
+
+        * pcre/pcre_exec.c:
+        (match):
+
+2005-09-29  Eric Seidel  <eseidel@apple.com>
+        Fix from Mitz Pettel <opendarwin.org@mitzpettel.com>
+
+        Reviewed by mjs.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Build fix for JSC+SVG after 5161.
+        http://bugs.webkit.org/show_bug.cgi?id=5179
+
+2005-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        - Fixed <rdar://problem/4275206> Denver Regression: Seed: Past Editions of Opinions display 
+          "NAN/Undefined" for www.washingtonpost.com
+          
+        Reviewed by darin.
+
+        * kjs/date_object.cpp:
+        (KJS::KRFCDate_parseDate): If the timezone isn't specified, rather than returning
+        invalidDate, substitute the local timezone. This matches the behavior of FF/IE.
+
+2005-09-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from George Staikos, reviewed by me.
+
+        - fixed some compile issues on Linux
+        
+        * kjs/property_slot.h:
+        * kjs/simple_number.h:
+
+2005-09-27  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - move HashMap/HashSet code down to JavaScriptCore
+        http://bugs.webkit.org/show_bug.cgi?id=5161
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/internal.cpp:
+        (KJS::interpreterMap): Function that fetches the interpreter map on demand. 
+        (KJS::InterpreterImp::InterpreterImp): Replace use of InterpreterMap
+        class with an appropriate HashMap.
+        (KJS::InterpreterImp::clear): ditto
+        (KJS::InterpreterImp::interpreterWithGlobalObject): ditto
+        * kjs/interpreter_map.cpp: Removed.
+        * kjs/interpreter_map.h: Removed.
+
+        The HashMap/HashSet code (copied and slightly tweaked from WebCore)
+        
+        * kxmlcore/HashFunctions.h: Added.
+        (KXMLCore::4):
+        (KXMLCore::8):
+        (KXMLCore::):
+        (KXMLCore::PointerHash::hash):
+        (KXMLCore::PointerHash::equal):
+        * kxmlcore/HashMap.h: Added.
+        (KXMLCore::extractFirst):
+        (KXMLCore::HashMap::HashMap):
+        (KXMLCore::::size):
+        (KXMLCore::::capacity):
+        (KXMLCore::::isEmpty):
+        (KXMLCore::::begin):
+        (KXMLCore::::end):
+        (KXMLCore::::find):
+        (KXMLCore::::contains):
+        (KXMLCore::::set):
+        (KXMLCore::::get):
+        (KXMLCore::::remove):
+        (KXMLCore::::clear):
+        (KXMLCore::deleteAllValues):
+        * kxmlcore/HashMapPtrSpec.h: Added.
+        (KXMLCore::PointerHashIteratorAdapter::PointerHashIteratorAdapter):
+        (KXMLCore::PointerHashIteratorAdapter::operator*):
+        (KXMLCore::PointerHashIteratorAdapter::operator->):
+        (KXMLCore::PointerHashIteratorAdapter::operator++):
+        (KXMLCore::PointerHashIteratorAdapter::operator==):
+        (KXMLCore::PointerHashIteratorAdapter::operator!=):
+        (KXMLCore::PointerHashConstIteratorAdapter::PointerHashConstIteratorAdapter):
+        (KXMLCore::PointerHashConstIteratorAdapter::operator*):
+        (KXMLCore::PointerHashConstIteratorAdapter::operator->):
+        (KXMLCore::PointerHashConstIteratorAdapter::operator++):
+        (KXMLCore::PointerHashConstIteratorAdapter::operator==):
+        (KXMLCore::PointerHashConstIteratorAdapter::operator!=):
+        (KXMLCore::):
+        * kxmlcore/HashSet.h: Added.
+        (KXMLCore::identityExtract):
+        (KXMLCore::convertAdapter):
+        (KXMLCore::HashSet::HashSet):
+        (KXMLCore::::size):
+        (KXMLCore::::capacity):
+        (KXMLCore::::isEmpty):
+        (KXMLCore::::begin):
+        (KXMLCore::::end):
+        (KXMLCore::::find):
+        (KXMLCore::::contains):
+        (KXMLCore::::insert):
+        (KXMLCore::::remove):
+        (KXMLCore::::clear):
+        * kxmlcore/HashTable.cpp: Added.
+        (KXMLCore::HashTableStats::~HashTableStats):
+        (KXMLCore::HashTableStats::recordCollisionAtCount):
+        * kxmlcore/HashTable.h: Added.
+        (KXMLCore::HashTableIterator::skipEmptyBuckets):
+        (KXMLCore::HashTableIterator::HashTableIterator):
+        (KXMLCore::HashTableIterator::operator*):
+        (KXMLCore::HashTableIterator::operator->):
+        (KXMLCore::HashTableIterator::operator++):
+        (KXMLCore::HashTableIterator::operator==):
+        (KXMLCore::HashTableIterator::operator!=):
+        (KXMLCore::HashTableConstIterator::HashTableConstIterator):
+        (KXMLCore::HashTableConstIterator::operator*):
+        (KXMLCore::HashTableConstIterator::operator->):
+        (KXMLCore::HashTableConstIterator::skipEmptyBuckets):
+        (KXMLCore::HashTableConstIterator::operator++):
+        (KXMLCore::HashTableConstIterator::operator==):
+        (KXMLCore::HashTableConstIterator::operator!=):
+        (KXMLCore::HashTable::HashTable):
+        (KXMLCore::HashTable::~HashTable):
+        (KXMLCore::HashTable::begin):
+        (KXMLCore::HashTable::end):
+        (KXMLCore::HashTable::size):
+        (KXMLCore::HashTable::capacity):
+        (KXMLCore::HashTable::insert):
+        (KXMLCore::HashTable::isEmptyBucket):
+        (KXMLCore::HashTable::isDeletedBucket):
+        (KXMLCore::HashTable::isEmptyOrDeletedBucket):
+        (KXMLCore::HashTable::hash):
+        (KXMLCore::HashTable::equal):
+        (KXMLCore::HashTable::identityConvert):
+        (KXMLCore::HashTable::extractKey):
+        (KXMLCore::HashTable::lookup):
+        (KXMLCore::HashTable::shouldExpand):
+        (KXMLCore::HashTable::mustRehashInPlace):
+        (KXMLCore::HashTable::shouldShrink):
+        (KXMLCore::HashTable::shrink):
+        (KXMLCore::HashTable::clearBucket):
+        (KXMLCore::HashTable::deleteBucket):
+        (KXMLCore::HashTable::makeLookupResult):
+        (KXMLCore::HashTable::makeIterator):
+        (KXMLCore::HashTable::makeConstIterator):
+        (KXMLCore::::lookup):
+        (KXMLCore::::insert):
+        (KXMLCore::::reinsert):
+        (KXMLCore::::find):
+        (KXMLCore::::contains):
+        (KXMLCore::::remove):
+        (KXMLCore::::allocateTable):
+        (KXMLCore::::expand):
+        (KXMLCore::::rehash):
+        (KXMLCore::::clear):
+        (KXMLCore::::HashTable):
+        (KXMLCore::::swap):
+        (KXMLCore::::operator):
+        (KXMLCore::::checkTableConsistency):
+        (KXMLCore::::checkTableConsistencyExceptSize):
+        * kxmlcore/HashTraits.h: Added.
+        (KXMLCore::HashTraits::emptyValue):
+        (KXMLCore::):
+        (KXMLCore::PairHashTraits::emptyValue):
+        (KXMLCore::PairHashTraits::deletedValue):
+
+2005-09-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - update grammar to fix conflicts; fixes one of our test cases
+          because it resolves the relationship between function expressions
+          and declarations in the way required by the ECMA specification
+
+        * kjs/grammar.y: Added lots of new grammar rules so we have no conflicts.
+        A new set of rules for "no bracket or function at start of expression" and
+        another set of rules for "no in anywhere in expression". Also simplified the
+        handling of try to use only a single node and used operator precedence to
+        get rid of the conflict in handling of if and else. Also used a macro to
+        streamline the handling of automatic semicolons and changed parenthesis
+        handling to use a virtual function.
+
+        * kjs/nodes.h: Added nodeInsideAllParens, removed unused abortStatement.
+        (KJS::TryNode::TryNode): Updated to hold catch and finally blocks directly instead
+        of using a special node for each.
+        * kjs/nodes.cpp:
+        (Node::createErrorCompletion): Added. Used instead of throwError when creating errors
+        that should not be in a completion rather than an ExecState.
+        (Node::throwUndefinedVariableError): Added. Sets source location unlike the call it
+        replaces.
+        (Node::nodeInsideAllParens): Added.
+        (GroupNode::nodeInsideAllParens): Added.
+        (StatListNode::execute): Removed code to move exceptions into completion objects;
+        that's now done solely by the KJS_CHECKEXCEPTION macro.
+        (TryNode::execute): Include execution of catch and finally here rather than using
+        separate nodes.
+        (FuncDeclNode::execute): Moved here, no longer inline.
+        * kjs/nodes2string.cpp:
+        (TryNode::streamTo): Updated for change.
+        (FuncDeclNode::streamTo): Ditto.
+        (FuncExprNode::streamTo): Ditto.
+
+        * kjs/kjs-test: Removed. Was part of "make check".
+        * kjs/kjs-test.chk: Ditto.
+        * kjs/test.js: Ditto.
+
+        * tests/mozilla/expected.html: Updated because one more test succeeds.
+
+2005-09-27  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Maciej.
+
+        Changed ints to size_t where appropriate.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+        (KJS::Collector::markStackObjectsConservatively):
+        (KJS::Collector::collect):
+        (KJS::Collector::size):
+        (KJS::Collector::numInterpreters):
+        (KJS::Collector::numGCNotAllowedObjects):
+        (KJS::Collector::numReferencedObjects):
+        * kjs/collector.h:
+
+2005-09-27  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by kevin.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: fix after malloc changes.
+
+2005-09-27  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        * kjs/nodes.cpp:
+        (FuncExprNode::evaluate): Now sets .constructor properly.
+        Test cases added to WebCore/layout-tests.
+        http://bugs.webkit.org/show_bug.cgi?id=3537
+
+2005-09-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        - replace dlmalloc with tcmalloc
+        http://bugs.webkit.org/show_bug.cgi?id=5145
+
+        I also moved SharedPtr and the assertion code from WebCore into a
+        new kxmlcore directory.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+        (KJS::Collector::collect):
+        * kjs/config.h:
+        * kjs/fast_malloc.cpp: Removed.
+        * kjs/fast_malloc.h: Removed.
+        * kjs/function.cpp:
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add):
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::~PropertyMap):
+        (KJS::PropertyMap::rehash):
+        * kjs/scope_chain.h:
+        * kjs/shared_ptr.h: Removed.
+        * kjs/string_object.cpp:
+        (StringObjectFuncImp::callAsFunction):
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::createCopying):
+        (KJS::UString::Rep::destroy):
+        (KJS::UString::expandCapacity):
+        (KJS::UString::expandPreCapacity):
+        (KJS::UString::UString):
+        (KJS::UString::spliceSubstringsWithSeparators):
+        (KJS::UString::append):
+        (KJS::UString::operator=):
+        (KJS::UString::detach):
+        * kjs/ustring.h:
+        * kxmlcore/Assertions.h: Added.
+        * kxmlcore/Assertions.mm: Added.
+        * kxmlcore/FastMalloc.cpp: Added.
+        (KXMLCore::LgFloor):
+        (KXMLCore::SizeClass):
+        (KXMLCore::ByteSizeForClass):
+        (KXMLCore::InitSizeClasses):
+        (KXMLCore::MetaDataAlloc):
+        (KXMLCore::PageHeapAllocator::Init):
+        (KXMLCore::PageHeapAllocator::New):
+        (KXMLCore::PageHeapAllocator::Delete):
+        (KXMLCore::PageHeapAllocator::inuse):
+        (KXMLCore::pages):
+        (KXMLCore::AllocationSize):
+        (KXMLCore::Event):
+        (KXMLCore::NewSpan):
+        (KXMLCore::DeleteSpan):
+        (KXMLCore::DLL_Init):
+        (KXMLCore::DLL_Remove):
+        (KXMLCore::DLL_IsEmpty):
+        (KXMLCore::DLL_Length):
+        (KXMLCore::DLL_Print):
+        (KXMLCore::DLL_Prepend):
+        (KXMLCore::DLL_InsertOrdered):
+        (KXMLCore::):
+        (KXMLCore::TCMalloc_PageHeap::GetDescriptor):
+        (KXMLCore::TCMalloc_PageHeap::SystemBytes):
+        (KXMLCore::TCMalloc_PageHeap::FreeBytes):
+        (KXMLCore::TCMalloc_PageHeap::RecordSpan):
+        (KXMLCore::TCMalloc_PageHeap::TCMalloc_PageHeap):
+        (KXMLCore::TCMalloc_PageHeap::New):
+        (KXMLCore::TCMalloc_PageHeap::Split):
+        (KXMLCore::TCMalloc_PageHeap::Carve):
+        (KXMLCore::TCMalloc_PageHeap::Delete):
+        (KXMLCore::TCMalloc_PageHeap::RegisterSizeClass):
+        (KXMLCore::TCMalloc_PageHeap::Dump):
+        (KXMLCore::TCMalloc_PageHeap::GrowHeap):
+        (KXMLCore::TCMalloc_PageHeap::Check):
+        (KXMLCore::TCMalloc_PageHeap::CheckList):
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::Init):
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::length):
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::empty):
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::lowwatermark):
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::clear_lowwatermark):
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::Push):
+        (KXMLCore::TCMalloc_ThreadCache_FreeList::Pop):
+        (KXMLCore::TCMalloc_ThreadCache::freelist_length):
+        (KXMLCore::TCMalloc_ThreadCache::Size):
+        (KXMLCore::TCMalloc_Central_FreeList::length):
+        (KXMLCore::TCMalloc_Central_FreeList::Init):
+        (KXMLCore::TCMalloc_Central_FreeList::Insert):
+        (KXMLCore::TCMalloc_Central_FreeList::Remove):
+        (KXMLCore::TCMalloc_Central_FreeList::Populate):
+        (KXMLCore::TCMalloc_ThreadCache::SampleAllocation):
+        (KXMLCore::TCMalloc_ThreadCache::Init):
+        (KXMLCore::TCMalloc_ThreadCache::Cleanup):
+        (KXMLCore::TCMalloc_ThreadCache::Allocate):
+        (KXMLCore::TCMalloc_ThreadCache::Deallocate):
+        (KXMLCore::TCMalloc_ThreadCache::FetchFromCentralCache):
+        (KXMLCore::TCMalloc_ThreadCache::ReleaseToCentralCache):
+        (KXMLCore::TCMalloc_ThreadCache::Scavenge):
+        (KXMLCore::TCMalloc_ThreadCache::GetCache):
+        (KXMLCore::TCMalloc_ThreadCache::GetCacheIfPresent):
+        (KXMLCore::TCMalloc_ThreadCache::PickNextSample):
+        (KXMLCore::TCMalloc_ThreadCache::InitModule):
+        (KXMLCore::TCMalloc_ThreadCache::InitTSD):
+        (KXMLCore::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        (KXMLCore::TCMalloc_ThreadCache::DeleteCache):
+        (KXMLCore::TCMalloc_ThreadCache::RecomputeThreadCacheSize):
+        (KXMLCore::TCMalloc_ThreadCache::Print):
+        (KXMLCore::ExtractStats):
+        (KXMLCore::DumpStats):
+        (KXMLCore::PrintStats):
+        (KXMLCore::DumpStackTraces):
+        (KXMLCore::TCMallocImplementation::GetStats):
+        (KXMLCore::TCMallocImplementation::ReadStackTraces):
+        (KXMLCore::TCMallocImplementation::GetNumericProperty):
+        (KXMLCore::TCMallocImplementation::SetNumericProperty):
+        (KXMLCore::DoSampledAllocation):
+        (KXMLCore::do_malloc):
+        (KXMLCore::do_free):
+        (KXMLCore::do_memalign):
+        (KXMLCore::TCMallocGuard::TCMallocGuard):
+        (KXMLCore::TCMallocGuard::~TCMallocGuard):
+        (KXMLCore::malloc):
+        (KXMLCore::free):
+        (KXMLCore::calloc):
+        (KXMLCore::cfree):
+        (KXMLCore::realloc):
+        (KXMLCore::memalign):
+        (KXMLCore::posix_memalign):
+        (KXMLCore::valloc):
+        (KXMLCore::pvalloc):
+        (KXMLCore::malloc_stats):
+        (KXMLCore::mallopt):
+        (KXMLCore::mallinfo):
+        * kxmlcore/FastMalloc.h: Added.
+        (KXMLCore::FastAllocated::operator new):
+        (KXMLCore::FastAllocated::operator delete):
+        (KXMLCore::FastAllocated::operator new[]):
+        (KXMLCore::FastAllocated::operator delete[]):
+        * kxmlcore/SharedPtr.h: Added.
+        (KXMLCore::SharedPtr::SharedPtr):
+        (KXMLCore::SharedPtr::~SharedPtr):
+        (KXMLCore::SharedPtr::isNull):
+        (KXMLCore::SharedPtr::notNull):
+        (KXMLCore::SharedPtr::reset):
+        (KXMLCore::SharedPtr::get):
+        (KXMLCore::SharedPtr::operator*):
+        (KXMLCore::SharedPtr::operator->):
+        (KXMLCore::SharedPtr::operator!):
+        (KXMLCore::SharedPtr::operator bool):
+        (KXMLCore::::operator):
+        (KXMLCore::operator==):
+        (KXMLCore::operator!=):
+        (KXMLCore::static_pointer_cast):
+        (KXMLCore::const_pointer_cast):
+        * kxmlcore/TCPageMap.h: Added.
+        (TCMalloc_PageMap1::TCMalloc_PageMap1):
+        (TCMalloc_PageMap1::Ensure):
+        (TCMalloc_PageMap1::get):
+        (TCMalloc_PageMap1::set):
+        (TCMalloc_PageMap2::TCMalloc_PageMap2):
+        (TCMalloc_PageMap2::get):
+        (TCMalloc_PageMap2::set):
+        (TCMalloc_PageMap2::Ensure):
+        (TCMalloc_PageMap3::NewNode):
+        (TCMalloc_PageMap3::TCMalloc_PageMap3):
+        (TCMalloc_PageMap3::get):
+        (TCMalloc_PageMap3::set):
+        (TCMalloc_PageMap3::Ensure):
+        * kxmlcore/TCSpinLock.h: Added.
+        (TCMalloc_SpinLock::Init):
+        (TCMalloc_SpinLock::Finalize):
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        (TCMalloc_SpinLockHolder::TCMalloc_SpinLockHolder):
+        (TCMalloc_SpinLockHolder::~TCMalloc_SpinLockHolder):
+        * kxmlcore/TCSystemAlloc.cpp: Added.
+        (TrySbrk):
+        (TryMmap):
+        (TryDevMem):
+        (TCMalloc_SystemAlloc):
+        * kxmlcore/TCSystemAlloc.h: Added.
+
+2005-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/4260479> Finish deploying PropertySlot in the interpreter
+        http://bugs.webkit.org/show_bug.cgi?id=5112
+        
+        Convert postfix, prefix, delete, prefix, and for..in expressions to use
+        PropertySlot-based lookup instead of evaluateReference.
+
+        3% speedup on JS iBench.
+
+        Fixed two of the JS tests:
+        * tests/mozilla/expected.html:
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (PostfixResolveNode::evaluate):
+        (PostfixBracketNode::evaluate):
+        (PostfixDotNode::evaluate):
+        (DeleteResolveNode::evaluate):
+        (DeleteBracketNode::evaluate):
+        (DeleteDotNode::evaluate):
+        (DeleteValueNode::evaluate):
+        (typeStringForValue):
+        (TypeOfResolveNode::evaluate):
+        (TypeOfValueNode::evaluate):
+        (PrefixResolveNode::evaluate):
+        (PrefixBracketNode::evaluate):
+        (PrefixDotNode::evaluate):
+        (ForInNode::execute):
+        * kjs/nodes.h:
+        (KJS::PostfixResolveNode::PostfixResolveNode):
+        (KJS::PostfixBracketNode::PostfixBracketNode):
+        (KJS::PostfixDotNode::PostfixDotNode):
+        (KJS::DeleteResolveNode::DeleteResolveNode):
+        (KJS::DeleteBracketNode::DeleteBracketNode):
+        (KJS::DeleteDotNode::DeleteDotNode):
+        (KJS::DeleteValueNode::DeleteValueNode):
+        (KJS::TypeOfResolveNode::TypeOfResolveNode):
+        (KJS::TypeOfValueNode::TypeOfValueNode):
+        (KJS::PrefixResolveNode::PrefixResolveNode):
+        (KJS::PrefixBracketNode::PrefixBracketNode):
+        (KJS::PrefixDotNode::PrefixDotNode):
+        * kjs/nodes2string.cpp:
+        (PostfixResolveNode::streamTo):
+        (PostfixBracketNode::streamTo):
+        (PostfixDotNode::streamTo):
+        (DeleteResolveNode::streamTo):
+        (DeleteBracketNode::streamTo):
+        (DeleteDotNode::streamTo):
+        (DeleteValueNode::streamTo):
+        (TypeOfValueNode::streamTo):
+        (TypeOfResolveNode::streamTo):
+        (PrefixResolveNode::streamTo):
+        (PrefixBracketNode::streamTo):
+        (PrefixDotNode::streamTo):
+        * kjs/reference.cpp:
+        (KJS::Reference::Reference):
+        (KJS::Reference::getPropertyName):
+        (KJS::Reference::getValue):
+        (KJS::Reference::deleteValue):
+        * kjs/reference.h:
+
+2005-09-23  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed and landed by Darin.
+
+        - a Windows-specific file
+
+        * os-win32/stdint.h: Added. We plan to remove dependency on the <stdint.h> types,
+        and if we do so, we will remove this file.
+
+2005-09-22  Geoffrey Garen  <ggaren@apple.com>
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=5053
+        Need to restore int/long changes to simple_number.h
+        
+        Reviewed by darin and mjs.
+
+        * kjs/simple_number.h: changed enums to indenpendent constants to clarify types
+        (KJS::isNegativeZero): changed to static function - no reason to export
+        (KJS::SimpleNumber::rightShiftSignExtended): new function for clarity
+        (KJS::SimpleNumber::make): specified cast as reinterpret_cast
+        (KJS::SimpleNumber::is): changed to use uintptr_t for portability
+        (KJS::SimpleNumber::value): changed to use uintptr_t and rightShiftSignExtended
+        (KJS::SimpleNumber::fits): inverted tests - probably only a performance win for double
+        (KJS::SimpleNumber::integerFits): ditto
+
+2005-09-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff and partly by Darin.
+
+        - fixed http://bugs.webkit.org/post_bug.cgi
+        (Reduce conflicts in JavaScriptCore grammar)
+
+        This change gets us down from over 200 shift/reduce and 45 reduce/reduce to
+        9 shift/reduce and 45 reduce/reduce.
+
+        * kjs/grammar.y:
+        * kjs/grammar_types.h: Removed.
+        * kjs/lexer.cpp:
+        * kjs/nodes.h:
+        (KJS::Node::isGroupNode):
+        (KJS::Node::isLocation):
+        (KJS::Node::isResolveNode):
+        (KJS::Node::isBracketAccessorNode):
+        (KJS::Node::isDotAccessorNode):
+        (KJS::ResolveNode::isLocation):
+        (KJS::ResolveNode::isResolveNode):
+        (KJS::ResolveNode::identifier):
+        (KJS::GroupNode::isGroupNode):
+        (KJS::GroupNode::leafNode):
+        (KJS::BracketAccessorNode::isLocation):
+        (KJS::BracketAccessorNode::isBracketAccessorNode):
+        (KJS::BracketAccessorNode::base):
+        (KJS::BracketAccessorNode::subscript):
+        (KJS::DotAccessorNode::isLocation):
+        (KJS::DotAccessorNode::isDotAccessorNode):
+        (KJS::DotAccessorNode::base):
+        (KJS::DotAccessorNode::identifier):
+        (KJS::FuncExprNode::FuncExprNode):
+        (KJS::FuncExprNode::identifier):
+        (KJS::FuncDeclNode::FuncDeclNode):
+        (KJS::FuncDeclNode::execute):
+
+2005-09-20  Geoffrey Garen  <ggaren@apple.com>
+
+        - Oops. The 4263434 change was only appropriate on the branch. Rolling out.
+        
+        Reviewed by eric.
+        
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::mark):
+
+2005-09-20  Geoffrey Garen  <ggaren@apple.com>
+
+        - More changes needed to fix <rdar://problem/4214783> 8F29 REGRESSION(Denver/Chardonnay):
+          kjs_fast_malloc crash due to lack of locking on multiple threads (seen selecting volumes in
+          the installer)
+          
+        Added InterpreterLocks in some places in the bindings we missed before.
+        
+        Reviewed by john.
+
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::addNativeReference):
+        (KJS::Bindings::removeNativeReference):
+        (RootObject::removeAllNativeReferences):
+        * bindings/runtime_root.h:
+        (KJS::Bindings::RootObject::~RootObject):
+        (KJS::Bindings::RootObject::setRootObjectImp):
+
+2005-09-20  Geoffrey Garen  <ggaren@apple.com>
+
+        - Fixed <rdar://problem/4263434> <rdar://problem/4263434> Denver 8F29 Regression:
+          KJS::InterpreterImp::mark() crash
+          
+        Fix by mjs, review by me.
+
+        * kjs/internal.cpp:
+        (KJS::InterpreterImp::mark): Added a null check on globExec in case a
+        garbage collection occurs inside InterpreterImp::globalInit (called
+        from InterpreterImp::InterpreterImp), at which point globExec has not yet been initialized.
+
+2005-09-20  Geoffrey Garen  <ggaren@apple.com>
+
+        - Rolled in fix for http://bugs.webkit.org/show_bug.cgi?id=4892
+          Date constructor has problems with months larger than 11
+
+        Test cases added:
+
+        * layout-tests/fast/js/date-big-constructor-expected.txt: Added.
+        * layout-tests/fast/js/date-big-constructor.html: Added.
+
+        Reviewed by darin.
+
+        * kjs/date_object.cpp:
+        (KJS::fillStructuresUsingDateArgs):
+        (KJS::makeTime):
+
+2005-09-19  Geoffrey Garen  <ggaren@apple.com>
+
+        - Fixed http://bugs.webkit.org/show_bug.cgi?id=5028
+          9 layout tests fail following the change from long to int
+          
+        - Rolled out changes to simple_number.h, and added fits(long long) 
+          and SimpleNumber::fits(unsigned long long) to the old system.
+        
+        Reviewed by mjs.
+
+        * kjs/simple_number.h:
+        (KJS::SimpleNumber::):
+        (KJS::SimpleNumber::value):
+        (KJS::SimpleNumber::fits):
+        (KJS::SimpleNumber::integerFits):
+        (KJS::SimpleNumber::make):
+
+2005-09-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+
+        - fixed <rdar://problem/4214783> REGRESSION: kjs_fast_malloc crash due to lack of locking on multiple threads (seen selecting volumes in the installer)
+
+        Make sure to lock using the InterpreterLock class in all places that need it
+        (including anything that uses the collector, the parser, the protect count hash table,
+        and anything that allocates via fast_malloc).
+
+        Also added assertions to ensure that the locking rules are followed for the relevant
+        resources.
+
+        * Makefile.am:
+        * bindings/NP_jsobject.cpp:
+        (identifierFromNPIdentifier):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_SetException):
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::call):
+        (JSObject::eval):
+        (JSObject::getMember):
+        (JSObject::setMember):
+        (JSObject::removeMember):
+        (JSObject::getSlot):
+        (JSObject::setSlot):
+        (JSObject::toString):
+        (JSObject::convertJObjectToValue):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:KJS::originExecutionContext:Bindings::executionContext:Bindings::]):
+        * bindings/runtime.cpp:
+        (Instance::createRuntimeObject):
+        * bindings/runtime_root.h:
+        * bindings/testbindings.cpp:
+        (main):
+        * bindings/testbindings.mm:
+        (main):
+        * kjs/fast_malloc.cpp:
+        (KJS::kjs_fast_malloc):
+        (KJS::kjs_fast_calloc):
+        (KJS::kjs_fast_free):
+        (KJS::kjs_fast_realloc):
+        * kjs/fast_malloc.h:
+        * kjs/identifier.h:
+        * kjs/internal.cpp:
+        (InterpreterImp::InterpreterImp):
+        (InterpreterImp::clear):
+        (InterpreterImp::mark):
+        (InterpreterImp::checkSyntax):
+        (InterpreterImp::evaluate):
+        * kjs/internal.h:
+        (KJS::InterpreterImp::globalObject):
+        * kjs/interpreter.cpp:
+        (Interpreter::evaluate):
+        * kjs/interpreter.h:
+        (KJS::InterpreterLock::InterpreterLock):
+        (KJS::InterpreterLock::~InterpreterLock):
+        * kjs/nodes.h:
+        * kjs/protect.h:
+        (KJS::ProtectedValue::ProtectedValue):
+        (KJS::ProtectedValue::~ProtectedValue):
+        (KJS::ProtectedValue::operator=):
+        (KJS::ProtectedObject::ProtectedObject):
+        (KJS::ProtectedObject::~ProtectedObject):
+        (KJS::ProtectedObject::operator=):
+        (KJS::ProtectedReference::ProtectedReference):
+        (KJS::ProtectedReference::~ProtectedReference):
+        (KJS::ProtectedReference::operator=):
+        * kjs/protected_object.h:
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::getProtectCount):
+        (KJS::ProtectedValues::increaseProtectCount):
+        (KJS::ProtectedValues::decreaseProtectCount):
+        * kjs/string_object.cpp:
+        (StringObjectImp::StringObjectImp):
+        * kjs/testkjs.cpp:
+        (main):
+
+2005-09-16  Adele Peterson  <adele@apple.com>
+
+        Change by Darin, reviewed by me and Maciej.
+
+        Fixes http://bugs.webkit.org/show_bug.cgi?id=4547
+        use int instead of long for 32-bit (to prepare for LP64 compiling)
+
+        * bindings/c/c_class.h:
+        (KJS::Bindings::CClass::constructorAt):
+        (KJS::Bindings::CClass::numConstructors):
+        * bindings/c/c_runtime.h:
+        (KJS::Bindings::CMethod::numParameters):
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        * bindings/jni/jni_class.h:
+        (KJS::Bindings::JavaClass::constructorAt):
+        (KJS::Bindings::JavaClass::numConstructors):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::convertJObjectToValue):
+        (JSObject::listFromJArray):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaConstructor::_commonCopy):
+        (KJS::Bindings::JavaConstructor::parameterAt):
+        (KJS::Bindings::JavaConstructor::numParameters):
+        (KJS::Bindings::JavaMethod::_commonCopy):
+        (KJS::Bindings::JavaMethod::parameterAt):
+        (KJS::Bindings::JavaMethod::numParameters):
+        * bindings/npapi.h:
+        * bindings/objc/WebScriptObject.mm:
+        (listFromNSArray):
+        * bindings/objc/objc_class.h:
+        (KJS::Bindings::ObjcClass::constructorAt):
+        (KJS::Bindings::ObjcClass::numConstructors):
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcMethod::numParameters):
+        * bindings/runtime.h:
+        * kjs/identifier.h:
+        * kjs/internal.h:
+        * kjs/property_slot.h:
+        (KJS::PropertySlot::setCustomIndex):
+        (KJS::PropertySlot::index):
+        (KJS::PropertySlot::):
+        * kjs/regexp_object.cpp:
+        (RegExpObjectImp::backrefGetter):
+        (RegExpObjectImp::getOwnPropertySlot):
+        * kjs/simple_number.h:
+        (KJS::SimpleNumber::):
+        (KJS::SimpleNumber::value):
+        (KJS::SimpleNumber::fits):
+        (KJS::SimpleNumber::integerFits):
+        (KJS::SimpleNumber::make):
+        * kjs/string_object.cpp:
+        (substituteBackreferences):
+        * kjs/ustring.cpp:
+        (KJS::UString::from):
+        (KJS::UString::toUInt32):
+        (KJS::UString::find):
+        (KJS::UString::rfind):
+        * kjs/ustring.h:
+        * kjs/value.cpp:
+        (KJS::jsNumber):
+        * kjs/value.h:
+
+2005-09-11  Eric Seidel  <eseidel@apple.com>
+
+        No review requested, build fix affects only SVG.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Fixed JSC+SVG
+        Fixed JavaScriptCore+SVG after PCRE 6.1 merger.
+        http://bugs.webkit.org/show_bug.cgi?id=4932
+
+2005-09-10  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed and landed by Darin.
+
+        * Makefile.vc: Added.
+        * README-Win32.txt: Added.
+
+2005-09-10  Darin Adler  <darin@apple.com>
+
+        - fixed compilation for WebCore (another try)
+
+        * kjs/simple_number.h: Added more "using" lines.
+
+2005-09-10  Darin Adler  <darin@apple.com>
+
+        - fixed compilation for WebCore
+
+        * kjs/simple_number.h: Have to include <cmath> here to work around a bug in the GCC
+        standard C++ library headers.
+
+2005-09-10  Darin Adler  <darin@apple.com>
+
+        Windows changes by Krzysztof Kowalczyk <kkowalczyk@gmail.com>.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4870
+          win portability: fix IS_NEGATIVE_ZERO macro in simple_number.h
+
+        * kjs/simple_number.h:
+        (KJS::isNegativeZero): Added. Inline function. Has a case for Windows that
+        uses _fpclass and a case for other platforms that uses signbit.
+        (KJS::SimpleNumber::fits): Use inline isNegativeZero instead of macro IS_NEGATIVE_ZERO.
+
+        * kjs/internal.cpp: Remove definition of now-unneeded negZero global.
+
+        * kjs/value.cpp: Touched the file because Xcode didn't know it needed to
+        recompile it.
+
+        - improved test engine
+
+        * tests/mozilla/jsDriver.pl: Sort tests in numeric order instead of using
+        a plain-ASCII sort; now test 33 will be after test 5 in any given set of
+        numbered tests.
+
+2005-09-08  Darin Adler  <darin@apple.com>
+
+        - fixed overloaded versions of throwError so that they substitute *all* 
+          expected parameters into the message string -- some versions used to
+          skip parameters, resulting in "%s" being printed in the error message.
+        
+        Reviewed by Geoff.
+
+        * kjs/nodes.h: Updated declarations to use "const &" and not to name parameters
+        * kjs/nodes.cpp: (Node::throwError): Updated to match above and add one missing
+        call to substitute.
+
+2005-09-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - updated to PCRE 6.1
+
+        The original PCRE 6.1 sources are checked into the tree with the tag
+        "pcre-6-1" for reference. What we're checking in right now is the original
+        plus our changes to make it support UTF-16 and at least one other tweak
+        (vertical tab considered whitespace). Our work to get our changes was
+        done on "pcre-6-1-branch", with an anchor at "pcre-6-1-anchor" so you can
+        see the evolution of the UTF-16 changes.
+        
+        Note also that there was one small change made here that's not on the branch
+        in pcre_compile.c.
+
+        * Info.plist: Updated the part of the copyright message that's about PCRE.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new PCRE source files,
+        removed obsolete ones.
+
+        * pcre/AUTHORS: Updated to PCRE 6.1. Includes credits for Apple's UTF-16
+        changes, but not the credits for Google's C++ wrapper, since we don't include that.
+        * pcre/COPYING: Updated to PCRE 6.1.
+        * pcre/LICENCE: Ditto.
+        * pcre/dftables.c: Ditto.
+        * pcre/pcre-config.h: Ditto.
+        * pcre/pcre.h: Ditto.
+
+        * pcre/pcre_compile.c: Added for PCRE 6.1.
+        * pcre/pcre_config.c: Ditto.
+        * pcre/pcre_exec.c: Ditto.
+        * pcre/pcre_fullinfo.c: Ditto.
+        * pcre/pcre_get.c: Ditto.
+        * pcre/pcre_globals.c: Ditto.
+        * pcre/pcre_info.c: Ditto.
+        * pcre/pcre_internal.h: Ditto.
+        * pcre/pcre_maketables.c: Ditto.
+        * pcre/pcre_ord2utf8.c: Ditto.
+        * pcre/pcre_printint.c: Ditto.
+        * pcre/pcre_refcount.c: Ditto.
+        * pcre/pcre_study.c: Ditto.
+        * pcre/pcre_tables.c: Ditto.
+        * pcre/pcre_try_flipped.c: Ditto.
+        * pcre/pcre_ucp_findchar.c: Ditto.
+        * pcre/pcre_version.c: Ditto.
+        * pcre/pcre_xclass.c: Ditto.
+        * pcre/ucp.h: Ditto.
+        * pcre/ucp_findchar.c: Ditto.
+        * pcre/ucpinternal.h: Ditto.
+        * pcre/ucptable.c: Ditto.
+
+        * pcre/get.c: Removed.
+        * pcre/internal.h: Removed.
+        * pcre/maketables.c: Removed.
+        * pcre/pcre.c: Removed.
+        * pcre/study.c: Removed.
+
+2005-09-07  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed http://bugs.webkit.org/show_bug.cgi?id=4781
+        Date.setMonth fails with big values due to overflow
+
+        Reviewed by darin.
+
+        * kjs/date_object.cpp:
+        (timetUsingCF): for consistency, changed return statement to invalidDate instead of LONG_MAX
+        (KJS::fillStructuresUsingTimeArgs): modified for readability
+        (KJS::fillStructuresUsingDateArgs): new function analogous to fillStructuresUsingTimeArgs
+        (KJS::DateProtoFuncImp::callAsFunction): modified to use fillStructuresUsingDateArgs
+        (KJS::DateObjectImp::construct): moved variable declaration to proper scope
+        (KJS::DateObjectFuncImp::callAsFunction): moved variable declaration to proper scope
+
+2005-09-07  Geoffrey Garen  <ggaren@apple.com>
+        -updated expected test results to reflect fix for 
+        http://bugs.webkit.org/show_bug.cgi?id=4698
+        kjs does not allow named functions in function expressions
+ 
+        * tests/mozilla/expected.html:
+
+2005-09-04  Darin Adler  <darin@apple.com>
+
+        * kjs/identifier.cpp: Fix comment, add missing include.
+        (Follow-on to changes from yesterday.)
+
+2005-09-03  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed, tweaked and landed by Darin.
+
+        - another try at some of the Windows compilation fixes
+          should fix these bugs: 4546, 4831, 4834, 4643, 4830, 4832, 4833, 4835
+
+        * kjs/collector.cpp: Add missing <setjmp.h> include.
+        * kjs/date_object.cpp: Fix broken copysign macro.
+        * kjs/dtoa.cpp: Move macro definitions down after all header includes.
+        * kjs/fast_malloc.cpp: Add missing <assert.h> and <stddef.h> includes.
+        * kjs/function.cpp: Remove broken isxdigit definition.
+        * kjs/grammar.y: Add a missing semicolon (and remove an excess one).
+        * kjs/identifier.cpp: Turn off AVOID_STATIC_CONSTRUCTORS because the placement new syntax
+        doesn't seem to work in Visual C++ (I'm surprised to hear that, by the way).
+        * kjs/value.h: Made ValueImp's destructor virtual because otherwise pointers to ValueImp
+        on the stack aren't right for garbage collection on Windows (don't think it works that
+        way with gcc's virtual table scheme, but it's a harmless change).
+
+2005-09-03  Krzysztof Kowalczyk  <kkowalczyk@gmail.com>
+
+        Reviewed, tweaked and landed by Darin.
+
+        - some Windows compilation fixes, hoping to fix the problems reported in these bugs:
+          4627, 4629, 4630, 4631, 4632, 4633, 4634, 4635, 4636, 4637, 4639, 4640, 4641, 4644, 4645
+
+        * kjs/collector.cpp: Include <windows.h> on WIN32. Put thread-related code inside
+        KJS_MULTIPLE_THREADS #if directives.
+        (KJS::Collector::markCurrentThreadConservatively): Use NT_TIB to find the stack base on Win32.
+
+        * kjs/config.h: Define HAVE_SYS_TIMEB_H for Win32.
+
+        * kjs/date_object.cpp: Add include of <limits.h>. Add definitions of strncasecmp, isfinite, and
+        copysign for Win32.
+        (KJS::KRFCDate_parseDate): Move "errno = 0" line down closer to the first call to strol -- I believe
+        that on Win32 there's some other call before that setting errno.
+
+        * kjs/date_object.h: Remove unneeded include of <sys/time.h>.
+
+        * kjs/dtoa.cpp: Add an undef of strtod, needed on Win32.
+
+        * kjs/fast_malloc.cpp: Put #if !WIN32 around some customization that's not appropriate on Win32.
+        (KJS::region_list_append): Add a missing cast so this Win32-specific function compiles in C++.
+        (KJS::sbrk): Change parameter type to match the declaration.
+
+        * kjs/function.cpp: (isxdigit): Define a locale-independent isxdigit on Win32.
+
+        * kjs/function.h: Remove unneeded friend class Function for FunctionImp.
+
+        * kjs/identifier.cpp: Took out the APPLE_CHANGES from around the AVOID_STATIC_CONSTRUCTORS
+        define. We ultimately intend to phase out APPLE_CHANGES entirely. Also fix the
+        non-AVOID_STATIC_CONSTRUCTORS code path.
+
+        * kjs/internal.cpp: Remove uneeded include of <strings.h>, which was confused with <string.h>!
+        Add a Win32 implementation of copysign. Put the threads code inside KJS_MULTIPLE_THREADS.
+
+        * kjs/internal.h: Define a KJS_MULTIPLE_THREADS macro on non-Win32 only. Later we can make this
+        specific to Mac OS X if we like.
+
+        * kjs/interpreter_map.cpp: Add missing include of <stdlib.h>.
+
+        * kjs/list.cpp:
+        (KJS::ListImp::markValues): Use std::min instead of MIN.
+        (KJS::List::copy): Ditto.
+        (KJS::List::copyTail): Ditto.
+
+        * kjs/math_object.cpp: (signbit): Add a Win32 implementation of signbit.
+
+        * kjs/nodes.cpp: (Node::finalCheck): Use unsigned instead of uint.
+        Put the use of always_inline inside __GNUC__.
+
+        * kjs/number_object.cpp: (NumberProtoFuncImp::callAsFunction): Use "10.0" instead of "10"
+        inside all the calls to pow to avoid ambiguity caused by overloading of pow on Win32, seen
+        when passing an int rather than a double or float.
+
+        * kjs/operations.cpp:
+        (KJS::isInf): Add Win32 implementation.
+        (KJS::isPosInf): Add Win32 implementation.
+        (KJS::isNegInf): Add Win32 implementation.
+
+        * kjs/regexp.cpp: Use unsigned instead of uint.
+        * kjs/regexp.h: Ditto.
+        * kjs/regexp_object.cpp: Ditto.
+        * kjs/regexp_object.h: Ditto.
+
+2005-09-02  Beth Dakin  <bdakin@apple.com>
+
+        Fix for <rdar://problem/4235531> Denver Regression: Safari crash in KWQStringData::makeUnicode
+        The other half of the fix is in WebCore.
+
+        Fix written by Maciej and Darin.
+        Reviewed by me/Maciej
+
+        As Maciej said in Radar: These problems was caused by a conflict between some of our custom 
+        allocators, causing them to return null. Symptom is typically a null pointer dereference in 
+        a place where it might be expected an allocation has just occurred.
+
+        * kjs/fast_malloc.cpp: Added #define for MORECORE_CONTIGUOUS, MORECORE_CANNOT_TRIM, 
+                               and MALLOC_FAILURE_ACTION.
+
+2005-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        -rolled in fix for http://bugs.webkit.org/show_bug.cgi?id=4698
+        kjs does not allow named functions in function expressions
+        
+        Fix by Arthur Langereis.
+        
+        Reviewed by darin.
+        
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (FuncExprNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::FuncExprNode::FuncExprNode):
+
+        Test cases added:
+
+        * layout-tests/fast/js/named-function-expression-expected.txt: Added.
+        * layout-tests/fast/js/named-function-expression.html: Added.
+        
+2005-08-31  Justin Haygood  <justin@xiondigital.net>
+
+        Reviewed, tweaked, and landed by Darin.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4085
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4087
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4096
+          Some fixes for compiling on windows.
+
+        * kjs/config.h: Added a WIN32 case in here, with suitable defines.
+        (To be tweaked as necessary.)
+        * kjs/function.cpp: Took out APPLE_CHANGES around use of ICU.
+        * kjs/operations.cpp: Removed some bogus code that always set HAVE_FLOAT_H.
+
+2005-08-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4758
+          unify SharedPtr in WebCore and JavaScriptCore
+
+        * kjs/shared_ptr.h: Updated namespace to KXMLCore instead of kxhmlcore.
+        Made a few small improvements to use local variables a bit more and added
+        an "operator int" to reduce the chance that we'll convert a SharedPtr to
+        an int by accident. Also made the == operators normal functions rather than
+        friend functions, added a couple of comemnts.
+
+        * kjs/function.h: Updated for namespace change.
+        * kjs/function.cpp: Ditto.
+        * kjs/function_object.cpp: Ditto.
+        * kjs/internal.h: Ditto.
+        * kjs/internal.cpp: Ditto.
+        * kjs/nodes.h: Ditto.
+        * kjs/nodes2string.cpp: Ditto.
+
+2005-08-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        <rdar://problem/4224911> many many leaks in kjsyyparse with malformed Javascript        
+
+        Record all nodes that are created during parsing, and delete any
+        that are left floating with a refcount of 0.
+        
+        * kjs/internal.cpp:
+        (KJS::Parser::saveNewNode):
+        (KJS::clearNewNodes):
+        (KJS::Parser::parse):
+        * kjs/internal.h:
+        * kjs/nodes.cpp:
+        (Node::Node):
+        * kjs/nodes.h:
+        (KJS::Node::refcount):
+
+2005-08-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        - fixed <rdar://problem/4232452> many many leaks in kjsyyparse on some well-formed JavaScript (can repro on sony.com, webkit tests)
+        
+        Fixed by changing the refcounting scheme for nodes. Instead of each node implementing a custom ref and
+        deref for all its children (and being responsible for deleting them), nodes use a smart pointer to
+        hold their children, and smart pointers are used outside the node tree as well. This change mostly
+        removes code.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/function.cpp:
+        (KJS::DeclaredFunctionImp::DeclaredFunctionImp):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/grammar.y:
+        * kjs/internal.cpp:
+        (KJS::Parser::parse):
+        (KJS::Parser::accept):
+        (KJS::InterpreterImp::checkSyntax):
+        (KJS::InterpreterImp::evaluate):
+        * kjs/internal.h:
+        * kjs/nodes.cpp:
+        (Node::Node):
+        (Node::~Node):
+        (ElementNode::evaluate):
+        (PropertyValueNode::evaluate):
+        (ArgumentListNode::evaluateList):
+        (NewExprNode::evaluate):
+        (FunctionCallValueNode::evaluate):
+        (FunctionCallBracketNode::evaluate):
+        (FunctionCallDotNode::evaluate):
+        (RelationalNode::evaluate):
+        (StatListNode::execute):
+        (StatListNode::processVarDecls):
+        (VarDeclListNode::evaluate):
+        (VarDeclListNode::processVarDecls):
+        (ForInNode::ForInNode):
+        (ClauseListNode::processVarDecls):
+        (CaseBlockNode::evalBlock):
+        (FuncDeclNode::processFuncDecl):
+        (FuncExprNode::evaluate):
+        (SourceElementsNode::execute):
+        (SourceElementsNode::processFuncDecl):
+        (SourceElementsNode::processVarDecls):
+        * kjs/nodes.h:
+        (KJS::Node::ref):
+        (KJS::Node::deref):
+        (KJS::NumberNode::NumberNode):
+        (KJS::GroupNode::GroupNode):
+        (KJS::ElementNode::ElementNode):
+        (KJS::ArrayNode::ArrayNode):
+        (KJS::PropertyValueNode::PropertyValueNode):
+        (KJS::ObjectLiteralNode::ObjectLiteralNode):
+        (KJS::BracketAccessorNode::BracketAccessorNode):
+        (KJS::DotAccessorNode::DotAccessorNode):
+        (KJS::ArgumentListNode::ArgumentListNode):
+        (KJS::ArgumentsNode::ArgumentsNode):
+        (KJS::NewExprNode::NewExprNode):
+        (KJS::FunctionCallValueNode::FunctionCallValueNode):
+        (KJS::FunctionCallResolveNode::FunctionCallResolveNode):
+        (KJS::FunctionCallBracketNode::FunctionCallBracketNode):
+        (KJS::FunctionCallDotNode::FunctionCallDotNode):
+        (KJS::PostfixNode::PostfixNode):
+        (KJS::DeleteNode::DeleteNode):
+        (KJS::VoidNode::VoidNode):
+        (KJS::TypeOfNode::TypeOfNode):
+        (KJS::PrefixNode::PrefixNode):
+        (KJS::UnaryPlusNode::UnaryPlusNode):
+        (KJS::NegateNode::NegateNode):
+        (KJS::BitwiseNotNode::BitwiseNotNode):
+        (KJS::LogicalNotNode::LogicalNotNode):
+        (KJS::MultNode::MultNode):
+        (KJS::AddNode::AddNode):
+        (KJS::ShiftNode::ShiftNode):
+        (KJS::RelationalNode::RelationalNode):
+        (KJS::EqualNode::EqualNode):
+        (KJS::BitOperNode::BitOperNode):
+        (KJS::BinaryLogicalNode::BinaryLogicalNode):
+        (KJS::ConditionalNode::ConditionalNode):
+        (KJS::AssignResolveNode::AssignResolveNode):
+        (KJS::AssignBracketNode::AssignBracketNode):
+        (KJS::AssignDotNode::AssignDotNode):
+        (KJS::CommaNode::CommaNode):
+        (KJS::AssignExprNode::AssignExprNode):
+        (KJS::VarDeclListNode::VarDeclListNode):
+        (KJS::VarStatementNode::VarStatementNode):
+        (KJS::ExprStatementNode::ExprStatementNode):
+        (KJS::IfNode::IfNode):
+        (KJS::DoWhileNode::DoWhileNode):
+        (KJS::WhileNode::WhileNode):
+        (KJS::ForNode::ForNode):
+        (KJS::ReturnNode::ReturnNode):
+        (KJS::WithNode::WithNode):
+        (KJS::CaseClauseNode::CaseClauseNode):
+        (KJS::ClauseListNode::ClauseListNode):
+        (KJS::ClauseListNode::clause):
+        (KJS::ClauseListNode::next):
+        (KJS::SwitchNode::SwitchNode):
+        (KJS::LabelNode::LabelNode):
+        (KJS::ThrowNode::ThrowNode):
+        (KJS::CatchNode::CatchNode):
+        (KJS::FinallyNode::FinallyNode):
+        (KJS::TryNode::TryNode):
+        (KJS::ParameterNode::ParameterNode):
+        (KJS::ParameterNode::nextParam):
+        (KJS::FuncDeclNode::FuncDeclNode):
+        (KJS::FuncExprNode::FuncExprNode):
+        * kjs/nodes2string.cpp:
+        (KJS::SourceStream::operator<<):
+        (ElementNode::streamTo):
+        (PropertyValueNode::streamTo):
+        (ArgumentListNode::streamTo):
+        (StatListNode::streamTo):
+        (VarDeclListNode::streamTo):
+        (CaseBlockNode::streamTo):
+        (ParameterNode::streamTo):
+        (SourceElementsNode::streamTo):
+        * kjs/shared_ptr.h: Added.
+        (kxmlcore::SharedPtr::SharedPtr):
+        (kxmlcore::SharedPtr::~SharedPtr):
+        (kxmlcore::SharedPtr::isNull):
+        (kxmlcore::SharedPtr::notNull):
+        (kxmlcore::SharedPtr::reset):
+        (kxmlcore::SharedPtr::get):
+        (kxmlcore::SharedPtr::operator*):
+        (kxmlcore::SharedPtr::operator->):
+        (kxmlcore::SharedPtr::operator!):
+        (kxmlcore::SharedPtr::operator bool):
+        (kxmlcore::SharedPtr::operator==):
+        (kxmlcore::::operator):
+        (kxmlcore::operator!=):
+        (kxmlcore::static_pointer_cast):
+        (kxmlcore::const_pointer_cast):
+
+2005-08-26  Geoff Garen  <ggaren@apple.com>
+
+        Reviewed by John.
+        Landed by Darin.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4664
+          TOT Crash from backwards null check in WebScriptObject.mm
+
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originExecutionContext:executionContext:]):
+        Remove bogus !.
+
+2005-08-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - rename KJS::UString::string() to KJS::UString::domString()
+        - rename KJS::Identifier::string() to KJS::Identifier::domString()
+
+        * kjs/identifier.h: Renamed.
+        * kjs/ustring.h: Ditto.
+
+2005-08-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4435
+          speed up JavaScript by tweaking the Identifier class
+
+        * kjs/identifier.h: Add a new global nullIdentifier and make Identifier::null a function
+        that returns it.
+        * kjs/identifier.cpp: (KJS::Identifier::init): Initialize a global for the null identifier
+        as well as all the other globals for special identifiers.
+
+        * kjs/ustring.h: (KJS::UString::UString): Make this empty constructor inline.
+        * kjs/ustring.cpp: Remove the old non-inline version.
+
+2005-08-19  Mitz Pettel  <opendarwin.org@mitzpettel.com>
+
+        Reviewed by Maciej.
+        Revised and landed by Darin.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4474
+          REGRESSION: Crash when using in-place operator on uninitialized array element
+
+        * kjs/nodes.cpp:
+        (AssignResolveNode::evaluate): Remove unneeded "isSet" assertion.
+        (AssignBracketNode::evaluate): Replace code that tested "isSet" with code that
+        tests the return value of getPropertySlot.
+
+        * kjs/property_slot.h: Removed unneeded "isSet" function. Property slots are
+        either uninitialized or set. There's no "initialized and not set" state.
+
+2005-08-18  Adele Peterson  <adele@apple.com>
+
+        Checked "Inline Functions Hidden" box
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2005-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fixed crash in one of the JavaScript tests (introduced by my throwError change)
+
+        * kjs/nodes.cpp: (Node::setExceptionDetailsIfNeeded): Check if the exception is an
+        object before setting the file and line number properties on it. Something to think
+        about in the future -- do we really want to do this on any object that's thrown?
+        How about limiting it to error objects that were created by the JavaScript engine?
+
+        - changed kjs_fast_malloc so we don't have two conflicting versions of the same function
+
+        * kjs/fast_malloc.h: Took out all the ifdefs from this header.
+        * kjs/fast_malloc.cpp: Added non-NDEBUG versions of the functions that just call
+        the system malloc, and put the NDEBUG versions in an #else.
+
+2005-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - clean up exported symbols that are not in a "KJS" namespace
+
+        * bindings/NP_jsobject.cpp: (identiferFromNPIdentifier): Marked this function static
+        so it no longer has external linkage.
+        * bindings/c/c_utility.h: Put all this stuff inside the KJS namespace.
+        * bindings/c/c_utility.cpp: Also marked some globals static so they don't have external
+        linkage; not as important given the namespace.
+        * bindings/npruntime.cpp: Marked functions static so they no longer have internal linkage.
+        Also removed unused _NPN_SetExceptionWithUTF8 function (not in header, had C++ linkage!).
+
+        * bindings/jni/jni_utility.cpp: (KJS::Bindings::getJavaVM): Call KJS_GetCreatedJavaVMs
+        using the soft linking header, instead of calling the JNI call. This allows processes
+        to link both JavaScriptCore and JavaVM without a symbol conflict.
+        * bindings/softlinking.c:
+        (loadFramework): Marked this function static so it no longer has external linkage.
+        (getFunctionPointer): Ditto.
+        (KJS_GetCreatedJavaVMs): Renamed this so it has a KJS prefix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added softlinking.h.
+        * bindings/softlinking.h: Added.
+
+        * kjs/nodes2string.cpp: (streamAssignmentOperatorTo): Marked this function static so it
+        no longer has external linkage.
+
+2005-08-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4437
+          clean up error creation with new throwError function
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_SetException):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject _initializeWithObjectImp:originExecutionContext:executionContext:]):
+        (-[WebScriptObject _initWithObjectImp:originExecutionContext:executionContext:]):
+        (+[WebScriptObject throwException:]):
+        (-[WebScriptObject setException:]):
+        (+[WebScriptObject _convertValueToObjcValue:originExecutionContext:executionContext:]):
+        * bindings/objc/objc_class.h:
+        (KJS::Bindings::ObjcClass::~ObjcClass):
+        (KJS::Bindings::ObjcClass::ObjcClass):
+        (KJS::Bindings::ObjcClass::operator=):
+        (KJS::Bindings::ObjcClass::constructorAt):
+        (KJS::Bindings::ObjcClass::numConstructors):
+        * bindings/objc/objc_header.h:
+        * bindings/objc/objc_runtime.h:
+        (KJS::Bindings::ObjcField::~ObjcField):
+        (KJS::Bindings::ObjcField::ObjcField):
+        (KJS::Bindings::ObjcField::operator=):
+        (KJS::Bindings::ObjcMethod::ObjcMethod):
+        (KJS::Bindings::ObjcMethod::~ObjcMethod):
+        (KJS::Bindings::ObjcMethod::operator=):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (ObjcField::setValueToInstance):
+        (ObjcArray::setValueAt):
+        (ObjcArray::valueAt):
+        * bindings/objc/objc_utility.h:
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::JSMethodNameToObjCMethodName):
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertNSStringToString):
+        (KJS::Bindings::convertObjcValueToValue):
+        (KJS::Bindings::objcValueTypeForType):
+        (KJS::Bindings::createObjcInstanceForValue):
+        (KJS::Bindings::throwError):
+        * bindings/runtime.h:
+        (KJS::Bindings::Parameter::~Parameter):
+        (KJS::Bindings::Method::~Method):
+        (KJS::Bindings::Instance::Instance):
+        (KJS::Bindings::Instance::begin):
+        (KJS::Bindings::Instance::end):
+        (KJS::Bindings::Instance::getValueOfUndefinedField):
+        (KJS::Bindings::Instance::supportsSetValueOfUndefinedField):
+        (KJS::Bindings::Instance::setValueOfUndefinedField):
+        (KJS::Bindings::Instance::valueOf):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::put):
+        * bindings/runtime_object.h:
+        (KJS::RuntimeObjectImp::setInternalInstance):
+        (KJS::RuntimeObjectImp::getInternalInstance):
+        * kjs/array_object.cpp:
+        (getProperty):
+        (ArrayProtoFuncImp::callAsFunction):
+        (ArrayObjectImp::construct):
+        * kjs/bool_object.cpp:
+        (BooleanProtoFuncImp::callAsFunction):
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFuncImp::callAsFunction):
+        * kjs/function.cpp:
+        (KJS::decode):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function_object.cpp:
+        (FunctionProtoFuncImp::callAsFunction):
+        (FunctionObjectImp::construct):
+        * kjs/internal.cpp:
+        (KJS::UndefinedImp::toObject):
+        (KJS::NullImp::toObject):
+        (KJS::InterpreterImp::evaluate):
+        (KJS::InternalFunctionImp::hasInstance):
+        * kjs/nodes.cpp:
+        (Node::throwError):
+        (substitute):
+        (Node::setExceptionDetailsIfNeeded):
+        (undefinedVariableError):
+        (ProgramNode::ProgramNode):
+        * kjs/number_object.cpp:
+        (NumberProtoFuncImp::callAsFunction):
+        * kjs/object.cpp:
+        (KJS::ObjectImp::call):
+        (KJS::ObjectImp::defaultValue):
+        (KJS::Error::create):
+        (KJS::throwError):
+        * kjs/object.h:
+        (KJS::ObjectImp::clearProperties):
+        (KJS::ObjectImp::getPropertySlot):
+        (KJS::ObjectImp::getOwnPropertySlot):
+        * kjs/object_object.cpp:
+        (ObjectProtoFuncImp::callAsFunction):
+        * kjs/reference.cpp:
+        (KJS::Reference::getBase):
+        (KJS::Reference::getValue):
+        (KJS::Reference::putValue):
+        (KJS::Reference::deleteValue):
+        * kjs/regexp_object.cpp:
+        (RegExpProtoFuncImp::callAsFunction):
+        (RegExpObjectImp::construct):
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::callAsFunction):
+
+2005-08-15  Anders Carlsson  <andersca@mac.com>
+
+        Reviewed by Darin.
+
+        * tests/mozilla/ecma_3/Date/15.9.5.5.js:
+        Remove the code which tests that Date.toLocaleString should be parsable
+        by Date.parse. That is not true according to the spec.
+
+2005-08-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        * kjs/collector.cpp: (KJS::Collector::allocate): Use a local instead of a global in one
+        more place; slight speedup.
+
+2005-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed crash observed on one of the Apple-only layout tests
+
+        * kjs/property_map.cpp: (KJS::PropertyMap::mark): Change code to understand that deleted
+        entries have a value of NULL, so the deleted sentinel count doesn't need to be included
+        in the count of things to mark since we're ignoring the keys.
+
+2005-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4421
+          speed up JavaScript by inlining some label stack functions
+
+        * kjs/internal.h: Removed the copy constructor and assignment operator for LabelStack.
+        They were unused, and the implementations had bugs; I removed them rather than fixing them.
+        Also removed the clear function, since that was only needed to help the assignment operator
+        share code with the destructor, and was not efficient enough for the destructor.
+        (KJS::LabelStack::~LabelStack): Made this inline. Also used an efficient implementation
+        that's nice and fast when the stack is empty, better than the old clear() function which
+        used to keep updating and refetching "tos" each time through the loop.
+        (KJS::LabelStack::pop): Made this inline.
+
+        * kjs/internal.cpp: Deleted the now-inline functions and the obsolete functions. Also
+        deleted a commented-out line of code.
+
+2005-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4419
+          speed up JavaScript by improving KJS::List
+
+        my measurements show an improvement of 1% on iBench JavaScript
+
+        * kjs/list.cpp: Rearrange list to make the values and free list share the same storage,
+        which saves 4 bytes per list. Also remove the pointers used only on the heap from the
+        lists that are in the pool, which saves 8 bytes per list. Moving the free list pointer
+        closer to the start of the list object also speeds up access to the free list. New
+        "HeapListImp" struct is used only for the lists on the heap.
+        (KJS::List::markProtectedLists): Shadowed global variable in local and updated for the
+        new terminology ("heap" instead of "outside pool").
+        (KJS::allocateListImp): Updated for new terminology.
+        (KJS::List::release): Moved the code from deallocateListImp in here -- it wasn't being
+        inlined and didn't need to be in a separate function.
+
+2005-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4417
+          speed up JavaScript with some small changes to the property map code
+
+        my measurements show an improvement of 2% on iBench JavaScript
+
+        * kjs/property_map.h: (KJS::PropertyMap::PropertyMap): Made the default constructor inline.
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::~PropertyMap): Changed loop to exit early once we know we've processed
+        all the hash table entries, based on the count.
+        (KJS::PropertyMap::mark): Ditto.
+
+        * kjs/object.h: Made an arbitrary change here to force recompiling so we pick up changes to
+        property_map.h. Works around what seems to be an Xcode header dependency bug.
+
+2005-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4416
+          speed up JavaScript with some improvements to the garbage collector
+
+        my measurements show an improvement of 2% on iBench JavaScript
+
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate): Use local variables to shadow globals instead of repeatedly
+        going at global variables. Tighten up loop implementations to make the common case fast.
+        (KJS::Collector::markStackObjectsConservatively): Use local variables to shadow globals.
+        Used a goto to eliminate a boolean since it was showing up in the profile.
+        (KJS::Collector::markProtectedObjects): Iterate through the table using pointer rather
+        than an index since the profile showed that generating better code.
+        (KJS::Collector::collect): Added a special case for blocks where all cells are used,
+        Use local variables to shadow globals. Eliminated a boolean by computing it another
+        way (checking to see if the number of live objects changed). Also used local variables
+        to shadow fields in the current cell when sweeping.
+        (KJS::Collector::numReferencedObjects): Use AllocatedValueImp instead of ValueImp
+        in one place -- means we get faster versions of various functions that don't worry
+        about SimpleNumber.
+        (KJS::className): Ditto.
+        (KJS::Collector::rootObjectClasses): Ditto.
+
+2005-08-14  Darin Adler  <darin@apple.com>
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4344
+          REGRESSION: JavaScript crash when going back from viewing a thread (NULL protoype)
+
+        * kjs/error_object.cpp: (NativeErrorImp::NativeErrorImp): Set proto in a more
+        straightforward way. The old code set the proto to 0 and then to the correct value.
+        This showed up as a "false positive" when searching for places that set prototype
+        to NULL/0 so I fixed it.
+
+        * kjs/function_object.cpp: (FunctionPrototypeImp::FunctionPrototypeImp): Change to
+        not pass an explicit "0" to the base class (InternalFunctionImp) constructor.
+
+        * kjs/internal.h: Added a default constructor for InternalFunctionImp.
+        * kjs/internal.cpp: (KJS::InternalFunctionImp::InternalFunctionImp): Added the
+        default constructor (empty body, just calls base class's default constructor).
+
+        * kjs/object.h:
+        (KJS::ObjectImp::ObjectImp): Add an assertion to catch NULL prototypes earlier
+        in Development builds.
+        (KJS::ObjectImp::setPrototype): Ditto.
+
+2005-08-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        - two simple speed improvements for a 3% speed gain
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj: turn on -fstrict-aliasing
+
+        * kjs/scope_chain.h:
+        (KJS::ScopeChainIterator::ScopeChainIterator): Add a scope chain iterator
+        so you can walk a scope chain without having to make a copy that you then mutate.
+        (KJS::ScopeChainIterator::operator*): standard iterator operation
+        (KJS::ScopeChainIterator::operator->): ditto
+        (KJS::ScopeChainIterator::operator++): ditto
+        (KJS::ScopeChainIterator::operator==): ditto
+        (KJS::ScopeChainIterator::operator!=): ditto
+        (KJS::ScopeChain::begin): Iterator for the top of the scope chain
+        (KJS::ScopeChain::end): Iterator for one past the bottom (i.e. null)
+        * kjs/nodes.cpp:
+        (ResolveNode::evaluate): Use scope chain iterator instead of copying
+        a scope chain and then modifying the copy
+        (ResolveNode::evaluateReference): ditto
+        (FunctionCallResolveNode::evaluate): ditto
+        (AssignResolveNode::evaluate): ditto
+
+2005-08-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from Anders Carlsson, reviewed by me.
+
+        * kjs/nodes.h: Fix build breakage.
+
+2005-08-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by hyatt.
+
+        - refactor function calls, 3% speedup on JS iBench.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (Node::throwError): Added new useful variants.
+        (FunctionCallValueNode::evaluate): New node to handle calls on expressions
+        that are strictly values, not references.
+        (FunctionCallValueNode::ref):  ditto
+        (FunctionCallValueNode::deref): ditto
+        (FunctionCallResolveNode::evaluate): New node to handle calls on identifier
+        expressions, so that they are looked up in the scope chain.
+        (FunctionCallResolveNode::ref): ditto
+        (FunctionCallResolveNode::deref): ditto
+        (FunctionCallBracketNode::evaluate): New node to handle calls on bracket
+        dereferences, so that the expression before brackets is used as the this
+        object.
+        (FunctionCallBracketNode::ref): ditto
+        (FunctionCallBracketNode::deref): ditto
+        (FunctionCallDotNode::evaluate): New node to handle calls on dot
+        dereferences, so that the expression before the dot is used as the this
+        object.
+        (FunctionCallDotNode::ref): ditto
+        (FunctionCallDotNode::deref): ditto
+        (dotExprNotAnObjectString): helper function to avoid global variable access.
+        (dotExprDoesNotAllowCallsString): ditto
+        * kjs/nodes.h: Declared new classes.
+        * kjs/nodes2string.cpp:
+        (FunctionCallValueNode::streamTo): Added - serializes the appropriate function call
+        (FunctionCallResolveNode::streamTo): ditto
+        (FunctionCallBracketNode::streamTo): ditto
+        (FunctionCallParenBracketNode::streamTo): ditto
+        (FunctionCallDotNode::streamTo): ditto
+        (FunctionCallParenDotNode::streamTo): ditto
+        * kjs/object.h:
+        (KJS::ObjectImp::isActivation): Change how activation objects are
+        detected in the scope chain, a virtual function is cheaper than the
+        old inheritance test.
+        * kjs/function.h:
+        (KJS::ActivationImp::isActivation): Ditto.
+
+2005-08-11  Maciej Stachowiak  <mjs@apple.com>
+
+        - added missing file from earlier checkin
+
+        * kjs/grammar_types.h: Added.
+        (KJS::makeNodePair):
+        (KJS::makeNodeWithIdent):
+
+2005-08-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+
+        * kjs/date_object.cpp:
+        (timetUsingCF): Fix one of the date tests my making the CF version of mktime
+        have the same quirk about the DST field as the real mktime.
+        * tests/mozilla/expected.html: Updated for newly fixed test.
+
+2005-08-11  Maciej Stachowiak  <mjs@apple.com>
+
+        - updated for one of the tests that Darin incidentally fixed.
+
+        * tests/mozilla/expected.html:
+
+2005-08-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+
+        Refactor assignment grammar to avoid Reference type, and to later
+        be able to take advantage of writeable PropertySlots, when those
+        are added. I also fixed a minor bug, turning a function to a
+        string lost parentheses, I made sure they are printed at least
+        where semantically significant.
+        
+        Test cases: see WebCore
+        
+        * kjs/grammar.y: Change grammar so that assignment expressions are parsed
+        directly to nodes that know how to set the kind of location being assigned, instead
+        of having a generic assign node that counts on evaluateReference.
+        * kjs/lexer.cpp: Include grammar_types.h.
+        * kjs/nodes.cpp:
+        (BracketAccessorNode): Renamed from AccessorNode1 for clarity.
+        (DotAccessorNode): Renamed from AccessorNode2 for clarity.
+        (combineForAssignment): Inline function for doing the proper kind of
+        operation for various update assignments like += or *=.
+        (AssignResolveNode): Node that handles assignment to a bare identifier.
+        (AssignDotNode): Node that handles assignments of the form EXPR . IDENT = EXPR
+        (AssignBracketNode): EXPR [ IDENT ] = EXPR
+        * kjs/nodes.h: Updated for declarations/renames of new classes.
+        * kjs/nodes2string.cpp:
+        (GroupNode::streamTo): Fixed to print parens around the expression.
+        (BracketAccessorNode::streamTo): Renamed.
+        (DotAccessorNode::streamTo): Renamed.
+        (AssignResolveNode::streamTo): Added.
+        (AssignBracketNode::streamTo): Added.
+        (AssignDotNode::streamTo): Added.
+        (streamAssignmentOperatorTo): helper function for the above
+        * kjs/property_slot.h:
+        (KJS::PropertySlot::isSet): Made this const.
+
+2005-08-10  Adele Peterson  <adele@apple.com>
+
+        Bumping version to 420+
+
+        * Info.plist:
+
+2005-08-10  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed <rdar://problem/4151132> REGRESSION: Some applet liveconnect calls 
+        throws privilege exception.
+        
+        Reviewed by richard and mjs.
+
+        -I removed the global static JavaClass cache, since it violated Java
+        security to cache classes between websites and applets.
+        
+        * bindings/jni/jni_class.cpp: 
+            -removed global static cache dictionary
+            -instance constructor and destructor now do the work that used to 
+            be done by static factory methods
+            -removed obsolete functions
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bindings/jni/jni_class.h:
+            -removed obsolete function declarations
+            -made copying private since it's unused and it's also not clear
+            excatly how copying would work with Java security
+            -made default construction private since it's meaningless
+        * bindings/jni/jni_instance.cpp:
+            -removed obsolete functions
+        (JavaInstance::~JavaInstance):
+        (JavaInstance::getClass):
+        * bindings/jni/jni_instance.h:
+           -made copying private since it's unused and it's also not clear
+            excatly how copying would work with Java security
+            -made default construction private since it's meaningless
+
+2005-08-08  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed crash caused by fix for http://bugs.webkit.org/show_bug.cgi?id=4313
+        
+        - exceptionDescription now gets explicitly initialized to NULL in all
+        the places listed below -- our wrapper classes used to take care of this 
+        automagically
+        
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+
+2005-08-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4325
+          Mozilla Date tests have an unnecessary loop that runs 1970 times before each test
+
+        * tests/mozilla/ecma/shell.js: Added TIME_YEAR_0 constant.
+
+        * tests/mozilla/ecma/Date/15.9.5.10-1.js: Removed the loop and changed code to use the constant.
+        * tests/mozilla/ecma/Date/15.9.5.10-10.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-11.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-12.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-13.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-2.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-3.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-4.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-5.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-6.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-7.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-8.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.10-9.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.11-2.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.12-1.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.12-2.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.12-3.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.12-4.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.12-5.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.12-6.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.12-7.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.12-8.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.13-2.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.13-8.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.14.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.15.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.16.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.17.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.18.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.19.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.20.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.21-1.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.21-2.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.21-3.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.21-4.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.21-5.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.21-6.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.21-7.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.21-8.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.22-1.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.22-2.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.22-3.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.22-4.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.22-5.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.22-6.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.22-7.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.22-8.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.23-4.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.23-5.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.23-6.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.23-7.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.23-8.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.23-9.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.5.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.6.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.7.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.8.js: Ditto.
+        * tests/mozilla/ecma/Date/15.9.5.9.js: Ditto.
+
+2005-08-08  Darin Adler  <darin@apple.com>
+
+        - forgot to delete an obsolete file
+
+        * kjs/object_wrapper.h: Deleted.
+
+2005-08-07  Darin Adler  <darin@apple.com>
+
+        - fixed two problems compiling with gcc 4.0
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::callAsFunction): Initialized a
+        variable to quiet an erroneous warning.
+        * kjs/date_object.cpp: (KJS::makeTime): Removed extraneous KJS:: prefix.
+
+2005-08-07  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Maciej.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4313
+          eliminate KJS::Value and KJS::Object smart pointer wrappers (for simplicity and speed)
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed object_wrapper.h.
+
+        Global replaces and other wonderful stuff.
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_HasMethod):
+        (_NPN_SetException):
+        * bindings/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::CInstance):
+        (KJS::Bindings::CInstance::invokeMethod):
+        (KJS::Bindings::CInstance::invokeDefaultMethod):
+        (KJS::Bindings::CInstance::defaultValue):
+        (KJS::Bindings::CInstance::stringValue):
+        (KJS::Bindings::CInstance::numberValue):
+        (KJS::Bindings::CInstance::booleanValue):
+        (KJS::Bindings::CInstance::valueOf):
+        * bindings/c/c_instance.h:
+        * bindings/c/c_runtime.cpp:
+        (CField::valueFromInstance):
+        (CField::setValueToInstance):
+        * bindings/c/c_runtime.h:
+        * bindings/c/c_utility.cpp:
+        (convertNPStringToUTF16):
+        (convertUTF8ToUTF16):
+        (coerceValueToNPVariantStringType):
+        (convertValueToNPVariant):
+        (convertNPVariantToValue):
+        * bindings/c/c_utility.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        (JavaInstance::numberValue):
+        (JavaInstance::booleanValue):
+        (JavaInstance::invokeMethod):
+        (JavaInstance::invokeDefaultMethod):
+        (JavaInstance::defaultValue):
+        (JavaInstance::valueOf):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::invoke):
+        (JSObject::call):
+        (JSObject::eval):
+        (JSObject::getMember):
+        (JSObject::getSlot):
+        (JSObject::toString):
+        (JSObject::convertValueToJObject):
+        (JSObject::convertJObjectToValue):
+        (JSObject::listFromJArray):
+        * bindings/jni/jni_jsobject.h:
+        * bindings/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaArray::convertJObjectToArray):
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        (JavaArray::setValueAt):
+        (JavaArray::valueAt):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaString::ustring):
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::getJavaVM):
+        (KJS::Bindings::getJNIEnv):
+        (KJS::Bindings::getMethodID):
+        (KJS::Bindings::callJNIVoidMethod):
+        (KJS::Bindings::callJNIObjectMethod):
+        (KJS::Bindings::callJNIBooleanMethod):
+        (KJS::Bindings::callJNIStaticBooleanMethod):
+        (KJS::Bindings::callJNIByteMethod):
+        (KJS::Bindings::callJNICharMethod):
+        (KJS::Bindings::callJNIShortMethod):
+        (KJS::Bindings::callJNIIntMethod):
+        (KJS::Bindings::callJNILongMethod):
+        (KJS::Bindings::callJNIFloatMethod):
+        (KJS::Bindings::callJNIDoubleMethod):
+        (KJS::Bindings::callJNIVoidMethodA):
+        (KJS::Bindings::callJNIObjectMethodA):
+        (KJS::Bindings::callJNIByteMethodA):
+        (KJS::Bindings::callJNICharMethodA):
+        (KJS::Bindings::callJNIShortMethodA):
+        (KJS::Bindings::callJNIIntMethodA):
+        (KJS::Bindings::callJNILongMethodA):
+        (KJS::Bindings::callJNIFloatMethodA):
+        (KJS::Bindings::callJNIDoubleMethodA):
+        (KJS::Bindings::callJNIBooleanMethodA):
+        (KJS::Bindings::callJNIVoidMethodIDA):
+        (KJS::Bindings::callJNIObjectMethodIDA):
+        (KJS::Bindings::callJNIByteMethodIDA):
+        (KJS::Bindings::callJNICharMethodIDA):
+        (KJS::Bindings::callJNIShortMethodIDA):
+        (KJS::Bindings::callJNIIntMethodIDA):
+        (KJS::Bindings::callJNILongMethodIDA):
+        (KJS::Bindings::callJNIFloatMethodIDA):
+        (KJS::Bindings::callJNIDoubleMethodIDA):
+        (KJS::Bindings::callJNIBooleanMethodIDA):
+        (KJS::Bindings::getCharactersFromJString):
+        (KJS::Bindings::releaseCharactersForJString):
+        (KJS::Bindings::getCharactersFromJStringInEnv):
+        (KJS::Bindings::releaseCharactersForJStringInEnv):
+        (KJS::Bindings::getUCharactersFromJStringInEnv):
+        (KJS::Bindings::releaseUCharactersForJStringInEnv):
+        (KJS::Bindings::JNITypeFromClassName):
+        (KJS::Bindings::signatureFromPrimitiveType):
+        (KJS::Bindings::JNITypeFromPrimitiveType):
+        (KJS::Bindings::getJNIField):
+        (KJS::Bindings::convertValueToJValue):
+        * bindings/jni/jni_utility.h:
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject _initializeWithObjectImp:originExecutionContext:Bindings::executionContext:Bindings::]):
+        (-[WebScriptObject _initWithObjectImp:originExecutionContext:Bindings::executionContext:Bindings::]):
+        (-[WebScriptObject _imp]):
+        (-[WebScriptObject _executionContext]):
+        (-[WebScriptObject _setExecutionContext:]):
+        (-[WebScriptObject _originExecutionContext]):
+        (-[WebScriptObject _setOriginExecutionContext:]):
+        (+[WebScriptObject throwException:]):
+        (listFromNSArray):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setException:]):
+        (+[WebScriptObject _convertValueToObjcValue:originExecutionContext:executionContext:Bindings::]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/objc/objc_class.h:
+        * bindings/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::fallbackObject):
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfField):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfField):
+        (ObjcInstance::getValueOfUndefinedField):
+        (ObjcInstance::defaultValue):
+        (ObjcInstance::stringValue):
+        (ObjcInstance::numberValue):
+        (ObjcInstance::booleanValue):
+        (ObjcInstance::valueOf):
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (convertValueToObjcObject):
+        (ObjcField::setValueToInstance):
+        (ObjcArray::setValueAt):
+        (ObjcArray::valueAt):
+        (ObjcFallbackObjectImp::put):
+        (ObjcFallbackObjectImp::callAsFunction):
+        (ObjcFallbackObjectImp::defaultValue):
+        * bindings/objc/objc_utility.h:
+        * bindings/objc/objc_utility.mm:
+        (Bindings::JSMethodNameToObjCMethodName):
+        (Bindings::convertValueToObjcValue):
+        (Bindings::convertNSStringToString):
+        (Bindings::convertObjcValueToValue):
+        (Bindings::objcValueTypeForType):
+        (Bindings::createObjcInstanceForValue):
+        * bindings/runtime.cpp:
+        (Instance::getValueOfField):
+        (Instance::setValueOfField):
+        (Instance::createRuntimeObject):
+        (Instance::createLanguageInstanceForValue):
+        * bindings/runtime.h:
+        (KJS::Bindings::Constructor::~Constructor):
+        (KJS::Bindings::Field::~Field):
+        (KJS::Bindings::MethodList::MethodList):
+        (KJS::Bindings::Class::fallbackObject):
+        (KJS::Bindings::Class::~Class):
+        (KJS::Bindings::Instance::Instance):
+        (KJS::Bindings::Instance::getValueOfUndefinedField):
+        (KJS::Bindings::Instance::supportsSetValueOfUndefinedField):
+        (KJS::Bindings::Instance::setValueOfUndefinedField):
+        (KJS::Bindings::Instance::valueOf):
+        (KJS::Bindings::Instance::setExecutionContext):
+        (KJS::Bindings::Instance::~Instance):
+        (KJS::Bindings::Array::~Array):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::RuntimeArrayImp):
+        (RuntimeArrayImp::lengthGetter):
+        (RuntimeArrayImp::indexGetter):
+        (RuntimeArrayImp::put):
+        * bindings/runtime_array.h:
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::lengthGetter):
+        (RuntimeMethodImp::callAsFunction):
+        * bindings/runtime_method.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::fallbackObjectGetter):
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::methodGetter):
+        (RuntimeObjectImp::getOwnPropertySlot):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::defaultValue):
+        (RuntimeObjectImp::callAsFunction):
+        * bindings/runtime_object.h:
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::ArrayInstanceImp):
+        (ArrayInstanceImp::lengthGetter):
+        (ArrayInstanceImp::getOwnPropertySlot):
+        (ArrayInstanceImp::put):
+        (ArrayInstanceImp::propList):
+        (ArrayInstanceImp::setLength):
+        (compareByStringForQSort):
+        (compareWithCompareFunctionForQSort):
+        (ArrayInstanceImp::sort):
+        (ArrayInstanceImp::pushUndefinedObjectsToEnd):
+        (ArrayPrototypeImp::ArrayPrototypeImp):
+        (ArrayProtoFuncImp::ArrayProtoFuncImp):
+        (ArrayProtoFuncImp::callAsFunction):
+        (ArrayObjectImp::ArrayObjectImp):
+        (ArrayObjectImp::construct):
+        (ArrayObjectImp::callAsFunction):
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        (BooleanPrototypeImp::BooleanPrototypeImp):
+        (BooleanProtoFuncImp::BooleanProtoFuncImp):
+        (BooleanProtoFuncImp::callAsFunction):
+        (BooleanObjectImp::BooleanObjectImp):
+        (BooleanObjectImp::construct):
+        (BooleanObjectImp::callAsFunction):
+        * kjs/bool_object.h:
+        * kjs/collector.cpp:
+        (KJS::Collector::markStackObjectsConservatively):
+        (KJS::Collector::collect):
+        (KJS::className):
+        * kjs/completion.h:
+        (KJS::Completion::Completion):
+        (KJS::Completion::value):
+        (KJS::Completion::isValueCompletion):
+        * kjs/context.h:
+        (KJS::ContextImp::variableObject):
+        (KJS::ContextImp::setVariableObject):
+        (KJS::ContextImp::thisValue):
+        (KJS::ContextImp::activationObject):
+        (KJS::ContextImp::pushScope):
+        * kjs/date_object.cpp:
+        (formatLocaleDate):
+        (KJS::timeFromArgs):
+        (KJS::DatePrototypeImp::DatePrototypeImp):
+        (KJS::DateProtoFuncImp::DateProtoFuncImp):
+        (KJS::DateProtoFuncImp::callAsFunction):
+        (KJS::DateObjectImp::DateObjectImp):
+        (KJS::DateObjectImp::construct):
+        (KJS::DateObjectImp::callAsFunction):
+        (KJS::DateObjectFuncImp::DateObjectFuncImp):
+        (KJS::DateObjectFuncImp::callAsFunction):
+        (KJS::parseDate):
+        (KJS::KRFCDate_parseDate):
+        (KJS::timeClip):
+        * kjs/date_object.h:
+        * kjs/debugger.cpp:
+        (Debugger::exception):
+        (Debugger::callEvent):
+        (Debugger::returnEvent):
+        * kjs/debugger.h:
+        * kjs/error_object.cpp:
+        (ErrorPrototypeImp::ErrorPrototypeImp):
+        (ErrorProtoFuncImp::ErrorProtoFuncImp):
+        (ErrorProtoFuncImp::callAsFunction):
+        (ErrorObjectImp::ErrorObjectImp):
+        (ErrorObjectImp::construct):
+        (ErrorObjectImp::callAsFunction):
+        (NativeErrorPrototypeImp::NativeErrorPrototypeImp):
+        (NativeErrorImp::NativeErrorImp):
+        (NativeErrorImp::construct):
+        (NativeErrorImp::callAsFunction):
+        * kjs/error_object.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::FunctionImp):
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::FunctionImp::processParameters):
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::FunctionImp::put):
+        (KJS::DeclaredFunctionImp::DeclaredFunctionImp):
+        (KJS::DeclaredFunctionImp::construct):
+        (KJS::ArgumentsImp::ArgumentsImp):
+        (KJS::ArgumentsImp::mappedIndexGetter):
+        (KJS::ArgumentsImp::put):
+        (KJS::ActivationImp::argumentsGetter):
+        (KJS::GlobalFuncImp::GlobalFuncImp):
+        (KJS::encode):
+        (KJS::decode):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (FunctionPrototypeImp::FunctionPrototypeImp):
+        (FunctionPrototypeImp::callAsFunction):
+        (FunctionProtoFuncImp::FunctionProtoFuncImp):
+        (FunctionProtoFuncImp::callAsFunction):
+        (FunctionObjectImp::FunctionObjectImp):
+        (FunctionObjectImp::construct):
+        (FunctionObjectImp::callAsFunction):
+        * kjs/function_object.h:
+        * kjs/internal.cpp:
+        (KJS::UndefinedImp::toPrimitive):
+        (KJS::UndefinedImp::toObject):
+        (KJS::NullImp::toPrimitive):
+        (KJS::NullImp::toObject):
+        (KJS::BooleanImp::toPrimitive):
+        (KJS::BooleanImp::toObject):
+        (KJS::StringImp::toPrimitive):
+        (KJS::StringImp::toObject):
+        (KJS::NumberImp::toPrimitive):
+        (KJS::NumberImp::toObject):
+        (KJS::NumberImp::getUInt32):
+        (KJS::LabelStack::push):
+        (KJS::ContextImp::ContextImp):
+        (KJS::InterpreterImp::globalInit):
+        (KJS::InterpreterImp::globalClear):
+        (KJS::InterpreterImp::InterpreterImp):
+        (KJS::InterpreterImp::initGlobalObject):
+        (KJS::InterpreterImp::clear):
+        (KJS::InterpreterImp::mark):
+        (KJS::InterpreterImp::evaluate):
+        (KJS::InternalFunctionImp::hasInstance):
+        (KJS::roundValue):
+        (KJS::printInfo):
+        * kjs/internal.h:
+        (KJS::InterpreterImp::builtinObject):
+        (KJS::InterpreterImp::builtinFunction):
+        (KJS::InterpreterImp::builtinArray):
+        (KJS::InterpreterImp::builtinBoolean):
+        (KJS::InterpreterImp::builtinString):
+        (KJS::InterpreterImp::builtinNumber):
+        (KJS::InterpreterImp::builtinDate):
+        (KJS::InterpreterImp::builtinRegExp):
+        (KJS::InterpreterImp::builtinError):
+        (KJS::InterpreterImp::builtinObjectPrototype):
+        (KJS::InterpreterImp::builtinFunctionPrototype):
+        (KJS::InterpreterImp::builtinArrayPrototype):
+        (KJS::InterpreterImp::builtinBooleanPrototype):
+        (KJS::InterpreterImp::builtinStringPrototype):
+        (KJS::InterpreterImp::builtinNumberPrototype):
+        (KJS::InterpreterImp::builtinDatePrototype):
+        (KJS::InterpreterImp::builtinRegExpPrototype):
+        (KJS::InterpreterImp::builtinErrorPrototype):
+        (KJS::InterpreterImp::builtinEvalError):
+        (KJS::InterpreterImp::builtinRangeError):
+        (KJS::InterpreterImp::builtinReferenceError):
+        (KJS::InterpreterImp::builtinSyntaxError):
+        (KJS::InterpreterImp::builtinTypeError):
+        (KJS::InterpreterImp::builtinURIError):
+        (KJS::InterpreterImp::builtinEvalErrorPrototype):
+        (KJS::InterpreterImp::builtinRangeErrorPrototype):
+        (KJS::InterpreterImp::builtinReferenceErrorPrototype):
+        (KJS::InterpreterImp::builtinSyntaxErrorPrototype):
+        (KJS::InterpreterImp::builtinTypeErrorPrototype):
+        (KJS::InterpreterImp::builtinURIErrorPrototype):
+        * kjs/interpreter.cpp:
+        (Context::variableObject):
+        (Context::thisValue):
+        (Interpreter::Interpreter):
+        (Interpreter::globalObject):
+        (Interpreter::evaluate):
+        (Interpreter::builtinObject):
+        (Interpreter::builtinFunction):
+        (Interpreter::builtinArray):
+        (Interpreter::builtinBoolean):
+        (Interpreter::builtinString):
+        (Interpreter::builtinNumber):
+        (Interpreter::builtinDate):
+        (Interpreter::builtinRegExp):
+        (Interpreter::builtinError):
+        (Interpreter::builtinObjectPrototype):
+        (Interpreter::builtinFunctionPrototype):
+        (Interpreter::builtinArrayPrototype):
+        (Interpreter::builtinBooleanPrototype):
+        (Interpreter::builtinStringPrototype):
+        (Interpreter::builtinNumberPrototype):
+        (Interpreter::builtinDatePrototype):
+        (Interpreter::builtinRegExpPrototype):
+        (Interpreter::builtinErrorPrototype):
+        (Interpreter::builtinEvalError):
+        (Interpreter::builtinRangeError):
+        (Interpreter::builtinReferenceError):
+        (Interpreter::builtinSyntaxError):
+        (Interpreter::builtinTypeError):
+        (Interpreter::builtinURIError):
+        (Interpreter::builtinEvalErrorPrototype):
+        (Interpreter::builtinRangeErrorPrototype):
+        (Interpreter::builtinReferenceErrorPrototype):
+        (Interpreter::builtinSyntaxErrorPrototype):
+        (Interpreter::builtinTypeErrorPrototype):
+        (Interpreter::builtinURIErrorPrototype):
+        (Interpreter::createLanguageInstanceForValue):
+        * kjs/interpreter.h:
+        (KJS::Interpreter::isGlobalObject):
+        (KJS::ExecState::setException):
+        (KJS::ExecState::clearException):
+        (KJS::ExecState::exception):
+        (KJS::ExecState::hadException):
+        (KJS::ExecState::ExecState):
+        * kjs/list.cpp:
+        (KJS::List::at):
+        * kjs/list.h:
+        (KJS::List::operator[]):
+        (KJS::ListIterator::operator->):
+        (KJS::ListIterator::operator*):
+        (KJS::ListIterator::operator++):
+        (KJS::ListIterator::operator--):
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter):
+        (KJS::staticValueGetter):
+        (KJS::lookupPut):
+        (KJS::cacheGlobalObject):
+        * kjs/math_object.cpp:
+        (MathObjectImp::getValueProperty):
+        (MathFuncImp::MathFuncImp):
+        (MathFuncImp::callAsFunction):
+        * kjs/math_object.h:
+        * kjs/nodes.cpp:
+        (Node::evaluateReference):
+        (Node::throwError):
+        (Node::setExceptionDetailsIfNeeded):
+        (NullNode::evaluate):
+        (BooleanNode::evaluate):
+        (NumberNode::evaluate):
+        (StringNode::evaluate):
+        (RegExpNode::evaluate):
+        (ThisNode::evaluate):
+        (ResolveNode::evaluate):
+        (ResolveNode::evaluateReference):
+        (GroupNode::evaluate):
+        (ElementNode::evaluate):
+        (ArrayNode::evaluate):
+        (ObjectLiteralNode::evaluate):
+        (PropertyValueNode::evaluate):
+        (PropertyNode::evaluate):
+        (AccessorNode1::evaluate):
+        (AccessorNode1::evaluateReference):
+        (AccessorNode2::evaluate):
+        (AccessorNode2::evaluateReference):
+        (ArgumentListNode::evaluate):
+        (ArgumentListNode::evaluateList):
+        (ArgumentsNode::evaluate):
+        (NewExprNode::evaluate):
+        (FunctionCallNode::evaluate):
+        (PostfixNode::evaluate):
+        (DeleteNode::evaluate):
+        (VoidNode::evaluate):
+        (TypeOfNode::evaluate):
+        (PrefixNode::evaluate):
+        (UnaryPlusNode::evaluate):
+        (NegateNode::evaluate):
+        (BitwiseNotNode::evaluate):
+        (LogicalNotNode::evaluate):
+        (MultNode::evaluate):
+        (AddNode::evaluate):
+        (ShiftNode::evaluate):
+        (RelationalNode::evaluate):
+        (EqualNode::evaluate):
+        (BitOperNode::evaluate):
+        (BinaryLogicalNode::evaluate):
+        (ConditionalNode::evaluate):
+        (AssignNode::evaluate):
+        (CommaNode::evaluate):
+        (StatListNode::execute):
+        (AssignExprNode::evaluate):
+        (VarDeclNode::evaluate):
+        (VarDeclNode::processVarDecls):
+        (VarDeclListNode::evaluate):
+        (ExprStatementNode::execute):
+        (IfNode::execute):
+        (DoWhileNode::execute):
+        (WhileNode::execute):
+        (ForNode::execute):
+        (ForInNode::execute):
+        (ContinueNode::execute):
+        (BreakNode::execute):
+        (ReturnNode::execute):
+        (WithNode::execute):
+        (CaseClauseNode::evaluate):
+        (ClauseListNode::evaluate):
+        (CaseBlockNode::evaluate):
+        (CaseBlockNode::evalBlock):
+        (SwitchNode::execute):
+        (ThrowNode::execute):
+        (CatchNode::execute):
+        (TryNode::execute):
+        (ParameterNode::evaluate):
+        (FuncDeclNode::processFuncDecl):
+        (FuncExprNode::evaluate):
+        (SourceElementsNode::execute):
+        * kjs/nodes.h:
+        (KJS::StatementNode::evaluate):
+        * kjs/number_object.cpp:
+        (NumberPrototypeImp::NumberPrototypeImp):
+        (NumberProtoFuncImp::NumberProtoFuncImp):
+        (NumberProtoFuncImp::callAsFunction):
+        (NumberObjectImp::NumberObjectImp):
+        (NumberObjectImp::getValueProperty):
+        (NumberObjectImp::construct):
+        (NumberObjectImp::callAsFunction):
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::call):
+        (KJS::ObjectImp::mark):
+        (KJS::ObjectImp::classInfo):
+        (KJS::ObjectImp::get):
+        (KJS::ObjectImp::getProperty):
+        (KJS::ObjectImp::getPropertySlot):
+        (KJS::ObjectImp::put):
+        (KJS::ObjectImp::hasOwnProperty):
+        (KJS::ObjectImp::defaultValue):
+        (KJS::ObjectImp::findPropertyHashEntry):
+        (KJS::ObjectImp::construct):
+        (KJS::ObjectImp::callAsFunction):
+        (KJS::ObjectImp::hasInstance):
+        (KJS::ObjectImp::propList):
+        (KJS::ObjectImp::toPrimitive):
+        (KJS::ObjectImp::toNumber):
+        (KJS::ObjectImp::toString):
+        (KJS::ObjectImp::toObject):
+        (KJS::ObjectImp::putDirect):
+        (KJS::Error::create):
+        (KJS::error):
+        * kjs/object.h:
+        (KJS::):
+        (KJS::ObjectImp::getPropertySlot):
+        (KJS::AllocatedValueImp::isObject):
+        (KJS::ObjectImp::ObjectImp):
+        (KJS::ObjectImp::internalValue):
+        (KJS::ObjectImp::setInternalValue):
+        (KJS::ObjectImp::prototype):
+        (KJS::ObjectImp::setPrototype):
+        (KJS::ObjectImp::inherits):
+        * kjs/object_object.cpp:
+        (ObjectPrototypeImp::ObjectPrototypeImp):
+        (ObjectProtoFuncImp::ObjectProtoFuncImp):
+        (ObjectProtoFuncImp::callAsFunction):
+        (ObjectObjectImp::ObjectObjectImp):
+        (ObjectObjectImp::construct):
+        (ObjectObjectImp::callAsFunction):
+        * kjs/object_object.h:
+        * kjs/operations.cpp:
+        (KJS::equal):
+        (KJS::strictEqual):
+        (KJS::relation):
+        (KJS::add):
+        (KJS::mult):
+        * kjs/operations.h:
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::mark):
+        (KJS::PropertyMap::addEnumerablesToReferenceList):
+        (KJS::PropertyMap::addSparseArrayPropertiesToReferenceList):
+        (KJS::PropertyMap::save):
+        (KJS::PropertyMap::restore):
+        * kjs/property_map.h:
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::undefinedGetter):
+        * kjs/property_slot.h:
+        (KJS::PropertySlot::getValue):
+        * kjs/protect.h:
+        (KJS::gcUnprotectNullTolerant):
+        (KJS::ProtectedValue::ProtectedValue):
+        (KJS::ProtectedValue::~ProtectedValue):
+        (KJS::ProtectedValue::operator=):
+        (KJS::ProtectedValue::operator ValueImp *):
+        (KJS::ProtectedValue::operator->):
+        * kjs/protected_object.h:
+        (KJS::ProtectedObject::ProtectedObject):
+        (KJS::ProtectedObject::operator=):
+        (KJS::ProtectedObject::operator ValueImp *):
+        (KJS::ProtectedObject::operator ObjectImp *):
+        (KJS::ProtectedObject::operator->):
+        (KJS::ProtectedReference::ProtectedReference):
+        (KJS::ProtectedReference::~ProtectedReference):
+        (KJS::ProtectedReference::operator=):
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::getProtectCount):
+        (KJS::ProtectedValues::increaseProtectCount):
+        (KJS::ProtectedValues::insert):
+        (KJS::ProtectedValues::decreaseProtectCount):
+        * kjs/protected_values.h:
+        * kjs/reference.cpp:
+        (KJS::Reference::Reference):
+        (KJS::Reference::makeValueReference):
+        (KJS::Reference::getBase):
+        (KJS::Reference::getValue):
+        (KJS::Reference::putValue):
+        (KJS::Reference::deleteValue):
+        * kjs/reference.h:
+        (KJS::Reference::baseIfMutable):
+        * kjs/regexp_object.cpp:
+        (RegExpPrototypeImp::RegExpPrototypeImp):
+        (RegExpProtoFuncImp::RegExpProtoFuncImp):
+        (RegExpProtoFuncImp::callAsFunction):
+        (RegExpObjectImp::RegExpObjectImp):
+        (RegExpObjectImp::arrayOfMatches):
+        (RegExpObjectImp::backrefGetter):
+        (RegExpObjectImp::construct):
+        (RegExpObjectImp::callAsFunction):
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (StringInstanceImp::lengthGetter):
+        (StringInstanceImp::indexGetter):
+        (StringInstanceImp::getOwnPropertySlot):
+        (StringInstanceImp::put):
+        (StringPrototypeImp::StringPrototypeImp):
+        (StringProtoFuncImp::StringProtoFuncImp):
+        (regExpIsGlobal):
+        (replace):
+        (StringProtoFuncImp::callAsFunction):
+        (StringObjectImp::StringObjectImp):
+        (StringObjectImp::construct):
+        (StringObjectImp::callAsFunction):
+        (StringObjectFuncImp::StringObjectFuncImp):
+        (StringObjectFuncImp::callAsFunction):
+        * kjs/string_object.h:
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction):
+        (VersionFunctionImp::callAsFunction):
+        (main):
+        * kjs/value.cpp:
+        (KJS::AllocatedValueImp::operator new):
+        (KJS::AllocatedValueImp::getUInt32):
+        (KJS::ValueImp::toInteger):
+        (KJS::ValueImp::toInt32):
+        (KJS::ValueImp::toUInt32):
+        (KJS::ValueImp::toUInt16):
+        (KJS::ValueImp::toObject):
+        (KJS::AllocatedValueImp::getBoolean):
+        (KJS::AllocatedValueImp::getNumber):
+        (KJS::AllocatedValueImp::getString):
+        (KJS::AllocatedValueImp::getObject):
+        (KJS::jsString):
+        (KJS::jsNumber):
+        (KJS::ConstantValues::init):
+        (KJS::ConstantValues::clear):
+        (KJS::ConstantValues::mark):
+        * kjs/value.h:
+        (KJS::):
+        (KJS::jsUndefined):
+        (KJS::jsNull):
+        (KJS::jsBoolean):
+        (KJS::jsNaN):
+        (KJS::ValueImp::ValueImp):
+        (KJS::ValueImp::~ValueImp):
+        (KJS::AllocatedValueImp::AllocatedValueImp):
+        (KJS::AllocatedValueImp::~AllocatedValueImp):
+        (KJS::AllocatedValueImp::isBoolean):
+        (KJS::AllocatedValueImp::isNumber):
+        (KJS::AllocatedValueImp::isString):
+        (KJS::AllocatedValueImp::isObject):
+        (KJS::AllocatedValueImp::marked):
+        (KJS::AllocatedValueImp::mark):
+        (KJS::ValueImp::downcast):
+        (KJS::ValueImp::isUndefined):
+        (KJS::ValueImp::isNull):
+        (KJS::ValueImp::isUndefinedOrNull):
+        (KJS::ValueImp::isBoolean):
+        (KJS::ValueImp::isNumber):
+        (KJS::ValueImp::isString):
+        (KJS::ValueImp::isObject):
+        (KJS::ValueImp::getBoolean):
+        (KJS::ValueImp::getNumber):
+        (KJS::ValueImp::getString):
+        (KJS::ValueImp::getObject):
+        (KJS::ValueImp::getUInt32):
+        (KJS::ValueImp::mark):
+        (KJS::ValueImp::marked):
+        (KJS::ValueImp::type):
+        (KJS::ValueImp::toPrimitive):
+        (KJS::ValueImp::toBoolean):
+        (KJS::ValueImp::toNumber):
+        (KJS::ValueImp::toString):
+        (KJS::jsZero):
+        (KJS::jsOne):
+        (KJS::jsTwo):
+        (KJS::Undefined):
+        (KJS::Null):
+        (KJS::Boolean):
+        (KJS::Number):
+        (KJS::String):
+
+2005-08-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        Change over to the new PropertySlot mechanism for property
+        lookup. This allows the elimination of hasOwnProperty
+        methods. Also did some of the performance tuning enabled by this
+        (but not yet all the possible improvements for function calls,
+        assignment, ++, and so forth). And also much code cleanup.
+
+        Net result is about a 2% speedup on the JS iBench.
+        
+        Also redid Geoff's fix for the chrashing applet by avoiding a NULL
+        prototype in the bindings code and using the default of Null()
+        instead.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        (ObjcFallbackObjectImp::getOwnPropertySlot):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::lengthGetter):
+        (RuntimeArrayImp::indexGetter):
+        (RuntimeArrayImp::getOwnPropertySlot):
+        * bindings/runtime_array.h:
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::lengthGetter):
+        (RuntimeMethodImp::getOwnPropertySlot):
+        * bindings/runtime_method.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::fallbackObjectGetter):
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::methodGetter):
+        (RuntimeObjectImp::getOwnPropertySlot):
+        * bindings/runtime_object.h:
+        * bindings/runtime_root.h:
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::lengthGetter):
+        (ArrayInstanceImp::getOwnPropertySlot):
+        (ArrayPrototypeImp::getOwnPropertySlot):
+        * kjs/array_object.h:
+        * kjs/date_object.cpp:
+        (DatePrototypeImp::getOwnPropertySlot):
+        * kjs/date_object.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::FunctionImp::getOwnPropertySlot):
+        (KJS::FunctionImp::put):
+        (KJS::FunctionImp::deleteProperty):
+        (KJS::ArgumentsImp::mappedIndexGetter):
+        (KJS::ArgumentsImp::getOwnPropertySlot):
+        (KJS::ActivationImp::argumentsGetter):
+        (KJS::ActivationImp::getArgumentsGetter):
+        (KJS::ActivationImp::getOwnPropertySlot):
+        (KJS::ActivationImp::deleteProperty):
+        * kjs/function.h:
+        * kjs/internal.cpp:
+        (InterpreterImp::InterpreterImp):
+        (InterpreterImp::initGlobalObject):
+        (InterpreterImp::~InterpreterImp):
+        (InterpreterImp::evaluate):
+        * kjs/internal.h:
+        (KJS::InterpreterImp::globalExec):
+        * kjs/interpreter.cpp:
+        (Interpreter::Interpreter):
+        (Interpreter::createLanguageInstanceForValue):
+        * kjs/interpreter.h:
+        (KJS::Interpreter::argumentsIdentifier):
+        (KJS::Interpreter::specialPrototypeIdentifier):
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter):
+        (KJS::staticValueGetter):
+        (KJS::getStaticPropertySlot):
+        (KJS::getStaticFunctionSlot):
+        (KJS::getStaticValueSlot):
+        * kjs/math_object.cpp:
+        (MathObjectImp::getOwnPropertySlot):
+        * kjs/math_object.h:
+        * kjs/nodes.cpp:
+        (ResolveNode::evaluate):
+        (ResolveNode::evaluateReference):
+        (AccessorNode1::evaluate):
+        (AccessorNode2::evaluate):
+        * kjs/number_object.cpp:
+        (NumberObjectImp::getOwnPropertySlot):
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::get):
+        (KJS::ObjectImp::getProperty):
+        (KJS::ObjectImp::getPropertySlot):
+        (KJS::ObjectImp::getOwnPropertySlot):
+        (KJS::ObjectImp::put):
+        (KJS::ObjectImp::hasProperty):
+        (KJS::ObjectImp::hasOwnProperty):
+        * kjs/object.h:
+        (KJS::ObjectImp::getDirectLocation):
+        (KJS::ObjectImp::getPropertySlot):
+        (KJS::ObjectImp::getOwnPropertySlot):
+        * kjs/object_wrapper.h: Added.
+        (KJS::):
+        (KJS::Object::Object):
+        (KJS::Object::operator ObjectImp *):
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::getLocation):
+        * kjs/property_map.h:
+        * kjs/property_slot.cpp: Added.
+        (KJS::PropertySlot::undefinedGetter):
+        * kjs/property_slot.h: Added.
+        (KJS::PropertySlot::isSet):
+        (KJS::PropertySlot::getValue):
+        (KJS::PropertySlot::setValueSlot):
+        (KJS::PropertySlot::setStaticEntry):
+        (KJS::PropertySlot::setCustom):
+        (KJS::PropertySlot::setCustomIndex):
+        (KJS::PropertySlot::setUndefined):
+        (KJS::PropertySlot::slotBase):
+        (KJS::PropertySlot::staticEntry):
+        (KJS::PropertySlot::index):
+        (KJS::PropertySlot::):
+        * kjs/protect.h:
+        * kjs/protected_object.h: Added.
+        (KJS::ProtectedObject::ProtectedObject):
+        (KJS::ProtectedObject::~ProtectedObject):
+        (KJS::ProtectedObject::operator=):
+        (KJS::ProtectedReference::ProtectedReference):
+        (KJS::ProtectedReference::~ProtectedReference):
+        (KJS::ProtectedReference::operator=):
+        * kjs/reference.h:
+        * kjs/reference_list.cpp:
+        * kjs/regexp_object.cpp:
+        (RegExpObjectImp::backrefGetter):
+        (RegExpObjectImp::getOwnPropertySlot):
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (StringInstanceImp::lengthGetter):
+        (StringInstanceImp::indexGetter):
+        (StringInstanceImp::getOwnPropertySlot):
+        (StringPrototypeImp::getOwnPropertySlot):
+        * kjs/string_object.h:
+
+2005-08-05  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Unchecked 'statics are thread safe' option.
+
+2005-08-05  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed <rdar://problem/4207220> REGRESSION (DENVER): Crash occurs 
+        after clicking on Hangman applet
+
+        Reviewed by darin.
+
+        * kjs/object.cpp:
+        (KJS::ObjectImp::hasProperty): added check for null prototype.
+
+        FIXME: The long-term plan is to make runtime objects use JS Null()
+        instead of null pointers, which will allow us to eliminate null
+        checks, improving performance.
+
+2005-08-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix by darin, reviewed by me.
+        
+        - rolled in fix for: <rdar://problem/4161606> JavaScript regular 
+        expressions with certain ranges of Unicode characters cause a crash
+
+        Test cases added:
+
+        * layout-tests/fast/js/regexp-big-unicode-ranges-expected.txt: Added.
+        * layout-tests/fast/js/regexp-big-unicode-ranges.html: Added.
+
+        * pcre/pcre.c:
+        (compile_branch): added checks for characters > 255
+
+2005-08-04  Maciej Stachowiak  <mjs@apple.com>
+
+        - updated expected test results now that we no longer exlude the
+        date tests (apparently this was overlooked)
+
+        * tests/mozilla/expected.html:
+
+2005-07-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - remove uses of Mac-OS-X-specific MAX macro
+        - remove one of the many excess "APPLE_CHANGES" ifdefs
+
+        * kjs/collector.cpp: (KJS::Collector::allocate): Use std::max instead of MAX.
+        * kjs/property_map.cpp: (KJS::PropertyMap::rehash): Ditto.
+        * kjs/ustring.cpp:
+        (KJS::UChar::toLower): Take out non-ICU code path.
+        (KJS::UChar::toUpper): Ditto.
+        (KJS::UString::spliceSubstringsWithSeparators): Use std::max instead of MAX.
+
+2005-07-27  Geoffrey Garen  <ggaren@apple.com>
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4147
+        Array.toString() and toLocaleString() improvements from KDE KJS
+        (rolled in KDE changes)
+
+        Test cases added:
+
+        * layout-tests/fast/js/toString-overrides-expected.txt: Added.
+        * layout-tests/fast/js/toString-overrides.html: Added.
+        
+        * kjs/array_object.cpp:
+        (ArrayProtoFuncImp::call):
+
+2005-07-27  Maciej Stachowiak  <mjs@apple.com>
+
+        Changes by Michael Kahl, reviewed by me.
+
+        - fixed <rdar://problem/4194278> Need better debugging support in JavaScriptCore
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/debugger.cpp:
+        (KJS::AttachedInterpreter::AttachedInterpreter):
+        (KJS::AttachedInterpreter::~AttachedInterpreter):
+        (Debugger::~Debugger):
+        (Debugger::attach):
+        (Debugger::detach):
+        (Debugger::sourceParsed):
+        * kjs/debugger.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::call):
+        (KJS::GlobalFuncImp::call):
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/grammar.y:
+        * kjs/internal.cpp:
+        (Parser::parse):
+        (InterpreterImp::evaluate):
+        * kjs/internal.h:
+        (KJS::InterpreterImp::setDebugger):
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        (KJS::Interpreter::imp):
+        * kjs/nodes.cpp:
+
+2005-07-27  Geoffrey Garen  <ggaren@apple.com>
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=3381
+        Date.prototype.setDate() incorrect for values >=128
+        
+        - Test cases added:
+
+        * layout-tests/fast/js/date-big-setdate-expected.txt: Added.
+        * layout-tests/fast/js/date-big-setdate.html: Added.
+
+        Reviewed by darin.
+
+        * kjs/date_object.cpp:
+        (DateProtoFuncImp::call):
+
+2005-07-27  Geoffrey Garen  <ggaren@apple.com>
+
+        -rolled in patch by Carsten Guenther <cguenther@gmail.com>
+        for http://bugs.webkit.org/show_bug.cgi?id=3759
+        Date object enhancements
+        
+        Test cases added:
+
+        * layout-tests/fast/js/date-preserve-milliseconds-expected.txt: Added.
+        * layout-tests/fast/js/date-preserve-milliseconds.html: Added.
+
+        Reviewed by darin.
+
+        * kjs/date_object.cpp:
+        (timeFromArgs):
+        (DateProtoFuncImp::call):
+        (DateObjectImp::construct):
+        (DateObjectFuncImp::call):
+        (KJS::makeTime):
+        * kjs/date_object.h:
+        * tests/mozilla/expected.html:
+
+2005-07-26  Justin Garcia  <justin.garcia@apple.com>
+
+        Added a forward declaration to fix gcc4 build error
+
+        * kjs/function.h:
+
+2005-07-25  Geoffrey Garen  <ggaren@apple.com>
+        - fixed mistake in my last checkin -- the expected results included
+        results from a patch that hasn't landed yet.
+        
+        * tests/mozilla/expected.html:
+
+2005-07-25  Maciej Stachowiak  <mjs@apple.com>
+
+        - fix mistake in last change that leads to assertion failure in the Development build
+
+        * kjs/lookup.h:
+        (KJS::lookupGetOwnValue):
+
+2005-07-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=4124
+        (change JavaScript property access to avoid double lookup)
+
+        - 10% speedup on JavaScript iBench
+        - 5% speedup on 24fun BenchJS benchmark
+
+        Changed all get methods to getOwnProperty - they are no longer
+        responsible for prototype lookup, and determine if the property
+        was found as a side efect. 
+
+        get() is now a nonvirtual ObjectImp method which calls the virtual
+        getOwnProperty and walks the prototype chain. A few selected
+        methods were inlined.
+
+        Changed ResolveNode::evaluate plus some other places to use
+        getProperty which does get() and hasProperty() in one lookup.
+
+        Also miscellaneous code cleanup.
+        
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        (ObjcFallbackObjectImp::getOwnProperty):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::RuntimeArrayImp):
+        (RuntimeArrayImp::getOwnProperty):
+        * bindings/runtime_array.h:
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::getOwnProperty):
+        * bindings/runtime_method.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::getOwnProperty):
+        * bindings/runtime_object.h:
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::getOwnProperty):
+        (ArrayPrototypeImp::getOwnProperty):
+        (ArrayProtoFuncImp::call):
+        * kjs/array_object.h:
+        * kjs/date_object.cpp:
+        (DatePrototypeImp::getOwnProperty):
+        * kjs/date_object.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::getOwnProperty):
+        (KJS::ArgumentsImp::getOwnProperty):
+        (KJS::ActivationImp::getOwnProperty):
+        * kjs/function.h:
+        * kjs/lookup.h:
+        (KJS::lookupGetOwnProperty):
+        (KJS::lookupGetOwnFunction):
+        (KJS::lookupGetOwnValue):
+        * kjs/math_object.cpp:
+        (MathObjectImp::getOwnProperty):
+        (MathObjectImp::getValueProperty):
+        * kjs/math_object.h:
+        * kjs/nodes.cpp:
+        (ResolveNode::evaluate):
+        * kjs/number_object.cpp:
+        (NumberObjectImp::getOwnProperty):
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::get):
+        (KJS::ObjectImp::getOwnProperty):
+        (KJS::ObjectImp::getProperty):
+        * kjs/object.h:
+        (KJS::ObjectImp::getProperty):
+        (KJS::ObjectImp::getOwnProperty):
+        * kjs/object_object.cpp:
+        (ObjectProtoFuncImp::call):
+        * kjs/regexp_object.cpp:
+        (RegExpObjectImp::getOwnProperty):
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (StringInstanceImp::getOwnProperty):
+        (StringPrototypeImp::getOwnProperty):
+        * kjs/string_object.h:
+
+2005-07-25  Geoffrey Garen  <ggaren@apple.com>
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=3971
+        JS test suite depends on JS 1.2 behavior
+        
+        Reviewed by darin.
+
+        * tests/mozilla/js1_2/Array/tostring_1.js: now tests only for JS 1.5 behavior
+        * tests/mozilla/js1_2/Array/tostring_2.js: ditto
+        * tests/mozilla/expected.html:
+
+2005-07-24  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by kevin.
+
+        Fixes make clean problem introduced in xcode2.1 transition
+
+        * Makefile.am:
+
+2005-07-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by darin.
+
+        * kjs/date_object.cpp: DatePrototypeImp now identifies itself as a
+        child class of DateInstanceImp -- this enables calls to Date.ValueOf().
+        
+        fixes: ecma/Date/15.9.5.js (once we enable the date tests).
+
+2005-07-22  Geoffrey Garen  <ggaren@apple.com>
+
+        
+        Reviewed by darin.
+
+        * tests/mozilla/jsDriver.pl: now takes the path to testkjs as a command-line argument
+        * tests/mozilla/run-mozilla-tests: Removed.
+
+2005-07-21  Geoffrey Garen  <ggaren@apple.com>
+
+        * JavaScriptCore.xcodeproj/.cvsignore: Added.
+
+2005-07-21  Geoffrey Garen  <ggaren@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Removed.
+        * JavaScriptCore.xcodeproj/ggaren.pbxuser: Added.
+        * JavaScriptCore.xcodeproj/ggaren.perspective: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added.
+        * Makefile.am:
+
+2005-07-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from Trey Matteson <trey@usa.net>, reviewed by me.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=3956
+        some of WebKit builds with symbols, some doesn't
+        
+        * JavaScriptCore.pbproj/project.pbxproj: Generate symbols even for
+        Deployment.
+
+2005-07-19  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed http://bugs.webkit.org/show_bug.cgi?id=3991
+        JSC doesn't implement Array.prototype.toLocaleString()
+
+        -test failure: ecma_3/Array/15.4.4.3-1.js
+
+        Reviewed by mjs.
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFuncImp::call): now searches for toString and
+        toLocaleString overrides in the array's elements
+
+        * tests/mozilla/expected.html: failures are under 100! woohoo!
+
+2005-07-19  Darin Adler  <darin@apple.com>
+
+        - fixed the build
+
+        * kjs/lookup.h: (KJS::lookupPut): Remove bogus const; was preventing WebCore from
+        compiling (not sure why this didn't affect my other build machine).
+
+        - one other tiny tweak (so sue me)
+
+        * bindings/runtime_root.cpp: Remove unneeded declaration.
+
+2005-07-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - eliminated try wrappers for get/put/call since we don't use C++ exceptions any more
+
+        * kjs/lookup.h: Changed tryCall in IMPLEMENT_PROTOFUNC here to call. It doesn't make
+        sense for this macro to use the name tryCall anyway, since that's specific to how
+        WebCore used this, so this is good anyway. On the other hand, it might be a problem
+        for KDOM or KSVG, in which case we'll need another macro for them, since JavaScriptCore
+        should presumably not have the C++ exception support.
+
+2005-07-18  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed http://bugs.webkit.org/show_bug.cgi?id=4008
+        Error objects report incorrect length
+        
+        Reviewed by darin.
+
+        * kjs/error_object.cpp: Error objects now include a length property
+        (ErrorObjectImp::ErrorObjectImp):
+
+        * tests/mozilla/expected.html: updated expected results to reflect fix
+        * tests/mozilla/js1_5/Exceptions/regress-123002.js: test now expects 
+        ecma compliant results
+
+2005-07-15  Geoffrey Garen  <ggaren@apple.com>
+
+        -rolled in KDE fixes for http://bugs.webkit.org/show_bug.cgi?id=3601
+        Error instance type info
+        
+        Reviewed by mjs.
+
+        * kjs/error_object.cpp:
+        - Created ErrorInstanceImp class for Error() objects. 
+        - Changed parent object for Native Errors to "Function" (matches
+        ECMA spec).
+        (ErrorInstanceImp::ErrorInstanceImp):
+        (ErrorProtoFuncImp::call):
+        (ErrorObjectImp::construct):
+        (NativeErrorImp::construct):
+
+        * kjs/error_object.h:
+        (KJS::ErrorInstanceImp::classInfo):
+        * kjs/object.h: made comment more informative about ClassInfo
+
+        * tests/mozilla/expected.html:
+
+2005-07-14  Geoffrey Garen  <ggaren@apple.com>
+
+        - fixed: JS test suite expects an out of memory error
+        that our memory efficiency avoids
+        
+        Reviewed by mjs.
+
+        * tests/mozilla/js1_5/Array/regress-157652.js:
+        test now expects normal execution
+        
+        * tests/mozilla/expected.html:
+
+2005-07-14  Geoffrey Garen  <ggaren@apple.com>
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=4006
+        testkjs doesn't implement gc()
+        
+        - test failure:
+        ecma_3/Function/regress-104584.js
+        
+        Reviewed by mjs.
+
+        * kjs/interpreter.cpp:
+        (Interpreter::finalCheck): removed misleading while && comment
+
+        * kjs/testkjs.cpp: added "gc" function to global object
+        (TestFunctionImp::):
+        (TestFunctionImp::call):
+        (main):
+
+        * tests/mozilla/expected.html:
+
+2005-07-14  Geoffrey Garen  <ggaren@apple.com>
+
+        -rolled in patches for http://bugs.webkit.org/show_bug.cgi?id=3945
+        [PATCH] Safe merges of comments and other trivialities from KDE's kjs
+        
+        -patch by Martijn Klingens <klingens@kde.org>
+        
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        * kjs/bool_object.h:
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/completion.h:
+        * kjs/context.h:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        * kjs/debugger.cpp:
+        * kjs/debugger.h:
+        * kjs/dtoa.h:
+        * kjs/error_object.cpp:
+        * kjs/error_object.h:
+        * kjs/function.cpp:
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        * kjs/function_object.h:
+        * kjs/grammar.y:
+        * kjs/identifier.cpp:
+        * kjs/identifier.h:
+        * kjs/internal.cpp:
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/interpreter_map.cpp:
+        * kjs/interpreter_map.h:
+        * kjs/lexer.cpp:
+        * kjs/lexer.h:
+        * kjs/list.cpp:
+        * kjs/list.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/math_object.cpp:
+        * kjs/math_object.h:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        * kjs/number_object.cpp:
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        * kjs/object_object.h:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/property_map.cpp:
+        * kjs/property_map.h:
+        * kjs/reference.cpp:
+        * kjs/reference.h:
+        * kjs/reference_list.cpp:
+        * kjs/reference_list.h:
+        * kjs/regexp.cpp:
+        * kjs/regexp.h:
+        * kjs/regexp_object.cpp:
+        * kjs/regexp_object.h:
+        * kjs/scope_chain.cpp:
+        * kjs/scope_chain.h:
+        * kjs/simple_number.h:
+        * kjs/string_object.cpp:
+        * kjs/string_object.h:
+        * kjs/testkjs.cpp:
+        * kjs/types.h:
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        * kjs/value.cpp:
+        * kjs/value.h:
+
+2005-07-14  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed http://bugs.webkit.org/show_bug.cgi?id=3970
+        throw statements fail inside eval statements
+        
+        Reviewed by mjs.
+
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::call):
+        Big change since I fixed the tabbing. The important part is:
+        if (c.complType() == Throw)
+          exec->setException(c.value());
+
+        * kjs/nodes.cpp:
+        (ThrowNode::execute): removed duplicate KJS_CHECKEXCEPTION
+        (TryNode::execute): 
+        try now clears the exception state before the finally block executes,
+        and checks the state after the block executes, so that exceptions in
+        finally code get caught.
+
+        * tests/mozilla/expected.html:
+
+2005-07-14  Geoffrey Garen  <ggaren@apple.com>
+        
+        -landed fix for http://bugs.webkit.org/show_bug.cgi?id=3412
+        Object.prototype is missing toLocaleString
+
+        - patch by Mark Rowe (bdash) <opendarwin.org@bdash.net.nz>
+        
+        -layout test info in webcore changelog
+
+        Reviewed by mjs.
+
+        * kjs/object_object.cpp:
+        (ObjectPrototypeImp::ObjectPrototypeImp):
+        (ObjectProtoFuncImp::call):
+        * kjs/object_object.h:
+        (KJS::ObjectProtoFuncImp::):
+
+2005-07-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by mjs.
+
+        * kjs/function.cpp:
+        (KJS::IndexToNameMap::operator[]): fixed infinite recursion
+        bug in last checkin
+
+2005-07-12  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed http://bugs.webkit.org/show_bug.cgi?id=3881
+        arguments object should share values with function parameters
+
+        Reviewed by mjs.
+
+        ArgumentsImp now uses a simple hash lookup to share values
+        with the activation object.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::getParameterName):
+        (KJS::IndexToNameMap::IndexToNameMap):
+        (KJS::IndexToNameMap::~IndexToNameMap):
+        (KJS::IndexToNameMap::isMapped):
+        (KJS::IndexToNameMap::unMap):
+        (KJS::IndexToNameMap::operator[]):
+        (KJS::ArgumentsImp::ArgumentsImp):
+        (KJS::ArgumentsImp::mark):
+        (KJS::ArgumentsImp::get):
+        (KJS::ArgumentsImp::put):
+        (KJS::ArgumentsImp::deleteProperty):
+        (KJS::ArgumentsImp::hasOwnProperty):
+        (KJS::ActivationImp::createArgumentsObject):
+        * kjs/function.h:
+        * tests/mozilla/expected.html: updated results
+
+2005-07-09  Maciej Stachowiak  <mjs@apple.com>
+
+        - backing out my earlier collector change, it causes a performance regression in TOT
+
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+
+2005-07-08  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs/hyatt (only in concept).
+
+        * JavaScriptCore.pbproj/project.pbxproj: Added JavaScriptCore+SVG
+        Turns on RTTI support for JavaScriptCore.framework when
+        building the JavaScriptCore+SVG target.  This is needed as
+        kdom (part of WebCore+SVG) requires RTTI for the time being.
+
+2005-07-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by hyatt.
+
+        - When there are many live objects, GC less often, to try to make
+        GC cost proportional to garbage, not proportional to total memory used.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+
+2005-07-08  Vicki Murley  <vicki@apple.com>
+
+        Fix from Carsten Guenther, reviewed by Maciej
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=3644 (Error string representation)
+
+        Switch from "-" to ":" in error strings.
+
+        * kjs/error_object.cpp:
+        (ErrorProtoFuncImp::call):
+        * tests/mozilla/expected.html:
+
+2005-07-08  Geoffrey Garen  <ggaren@apple.com>
+
+        -rolled in patch for http://bugs.webkit.org/show_bug.cgi?id=3878
+        arguments object should be an object not an array
+
+        Reviewed by mjs.
+
+        * kjs/function.cpp:
+        (KJS::ArgumentsImp::ArgumentsImp): now manually handles initialization
+        we used to get for free by inheriting from ArrayInstanceImp
+        * kjs/function.h: ArgumentsImp now inherits from ObjectImp
+        * tests/mozilla/expected.html: updated expected test results
+
+2005-07-07  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by mjs.
+
+        * kjs/grammar.y: removed #define YYMAXDEPTH 0 for bison 2.0
+        http://bugs.webkit.org/show_bug.cgi?id=3882
+
+2005-07-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Original patch from Mark Rowe <opendarwin.org@bdash.net.nz>, reviewed by me.
+        Fixes to patch by me, reviewed by John Sullivan.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=3293
+
+        Test cases added:
+        * tests/mozilla/expected.html: Two tests newly pass.
+
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::hasOwnProperty):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::hasOwnProperty):
+        * bindings/runtime_array.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::hasOwnProperty):
+        * bindings/runtime_object.h:
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::hasOwnProperty):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::hasOwnProperty):
+        (KJS::ActivationImp::hasOwnProperty):
+        * kjs/function.h:
+        * kjs/lookup.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::hasProperty):
+        (KJS::ObjectImp::hasOwnProperty):
+        * kjs/object.h:
+        (KJS::Object::hasOwnProperty):
+        * kjs/object_object.cpp:
+        (ObjectPrototypeImp::ObjectPrototypeImp):
+        (ObjectProtoFuncImp::call):
+        * kjs/object_object.h:
+        (KJS::ObjectProtoFuncImp::):
+        * kjs/string_object.cpp:
+        (StringInstanceImp::hasOwnProperty):
+        * kjs/string_object.h:
+
+2005-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        -landed patch by Eric Seidel <macdome@opendarwin.org>
+        
+        -for http://bugs.webkit.org/show_bug.cgi?id=3657
+        GroundWork:  Moving some functions from khtml->jsc following kjs TOT
+        
+        - no layout test necessary yet - only groundwork
+
+        Reviewed by darin.
+
+        * kjs/lookup.h:
+        (KJS::cacheGlobalObject):
+
+2005-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        -landed patch by Carsten Guenther <cguenther@gmail.com>
+
+        -fixes http://bugs.webkit.org/show_bug.cgi?id=3477
+        some US-centric date formats not parsed by JavaScript (clock at news8austin.com)
+
+        -relevant tests:
+               mozilla/ecma_3/Date/15.9.5.5.js 
+               layout-tests/fast/js/date-parse-test.html
+
+        Reviewed by darin.
+
+        * kjs/date_object.cpp:
+        (formatLocaleDate):
+        (day):
+        (dayFromYear):
+        (daysInYear):
+        (timeFromYear):
+        (yearFromTime):
+        (weekDay):
+        (timeZoneOffset):
+        (DateProtoFuncImp::call):
+        (DateObjectImp::construct):
+        (KJS::parseDate):
+        (ymdhms_to_seconds):
+        (KJS::makeTime):
+        (findMonth):
+        (KJS::KRFCDate_parseDate):
+        * kjs/date_object.h:
+        * tests/mozilla/expected.html: updated expected results to reflect fix
+
+2005-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed <rdar://problem/4168186> JavaScript fails to throw exceptions 
+        for invalid return statements
+        
+        relevant tests:
+            ecma/Statements/12.9-1-n.js
+            ecma_2/Exceptions/lexical-052.js
+            ecma_2/Exceptions/statement-009.js
+
+        Reviewed by sullivan.
+
+        * kjs/nodes.cpp:
+        (ReturnNode::execute): now throws exception if return is not inside
+        a function.
+
+        * tests/mozilla/expected.html: updated to reflect fix
+
+2005-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by sullivan.
+
+        * tests/mozilla/expected.html: Updated test results for last fix.
+
+2005-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        -fixed <rdar://problem/4168161> JavaScript fails to throw an exception 
+        for invalid function calls
+        
+        Reviewed by sullivan.
+
+        Relevant mozilla test: ecma_3/Exceptions/regress-95101.js 
+
+        * kjs/nodes.cpp:
+        (FunctionCallNode::evaluate): evaluate now checks for an exception
+        after resolving a function name (in case the function is undefined)
+
+2005-07-01  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by darin.
+
+        * kjs/interpreter.h:
+        (KJS::Context::curStmtFirstLine): stub for compatibility with KDE
+        * kjs/value.h:
+        (KJS::Value::isValid): compatibility with KDE
+        http://bugs.webkit.org/show_bug.cgi?id=3687
+
+2005-07-01  Eric Seidel  <eseidel@apple.com>
+
+        Reviewed by darin.
+
+        * kjs/create_hash_table: rolled in changes from KDE, including
+        -n <namespace> support from KDOM and support for newer comments
+        http://bugs.webkit.org/show_bug.cgi?id=3771
+
+2005-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        -rolled in KDE fix to <rdar://problem/4167660> JavaScript fails to 
+        throw exceptions for invalid break/continue statements
+
+        No layout tests because it's already covered by the Mozilla suite
+
+        Reviewed by mjs.
+
+        * kjs/internal.h: LabelStack now tracks where you are relative to
+        switch and iteration (loop) statements
+        
+        (KJS::LabelStack::LabelStack):
+        (KJS::LabelStack::pushIteration):
+        (KJS::LabelStack::popIteration):
+        (KJS::LabelStack::inIteration):
+        (KJS::LabelStack::pushSwitch):
+        (KJS::LabelStack::popSwitch):
+        (KJS::LabelStack::inSwitch):
+
+        * kjs/nodes.cpp: 
+        These files were updated to use the new LabelStack:
+        (DoWhileNode::execute): 
+        (WhileNode::execute):
+        (ForNode::execute):
+        (ForInNode::execute):
+        (SwitchNode::execute):
+        
+        These files were updated to throw exceptions for invalid
+        break/continue statements:
+        (BreakNode::execute): 
+        (ContinueNode::execute):
+
+        * tests/mozilla/expected.html: Updated expected results to reflect fix
+
+2005-06-30  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by rjw.
+
+        fixed: <rdar://problem/4166838> failed assertion in`Interpreter::lockCount() > 0
+
+        no layout test added; this is in the bindings code.
+
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:KJS::originExecutionContext:Bindings::executionContext:Bindings::]): make sure to lock and unlock the interpreter around allocations. 
+
+2005-06-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch by Francisco Tolmasky <tolmasky@gmail.com>
+
+        - fixes http://bugs.webkit.org/show_bug.cgi?id=3667
+        Core JavaScript 1.5 Reference:Objects:Array:forEach
+
+        See WebCore Changelog for layout tests added.
+
+        Reviewed by darin.
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFuncImp::call):
+        * kjs/array_object.h:
+        (KJS::ArrayProtoFuncImp::):
+
+2005-06-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch contributed by Oliver Hunt <ojh16@student.canterbury.ac.nz>
+
+        -fixed http://bugs.webkit.org/show_bug.cgi?id=3743
+        Incorrect error message given for certain calls
+
+        See WebCore Changelog for layout test added.
+
+        Reviewed by mjs.
+
+        * kjs/object.cpp:
+        (KJS::ObjectImp::defaultValue):
+
+2005-06-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolling out date patch from 6-28-05 because it breaks 
+        fast/js/date-parse-test
+
+        * kjs/date_object.cpp:
+        (formatLocaleDate):
+        (DateProtoFuncImp::call):
+        (DateObjectImp::construct):
+        (KJS::parseDate):
+        (ymdhms_to_seconds):
+        (isSpaceOrTab):
+        (KJS::KRFCDate_parseDate):
+        * kjs/date_object.h:
+        * tests/mozilla/expected.html:
+
+2005-06-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin.
+
+        -fixes http://bugs.webkit.org/show_bug.cgi?id=3750
+        build fails with KJS_VERBOSE set
+
+        * kjs/nodes.cpp: changed debug print statement to use UString
+        (VarDeclNode::evaluate):
+        * kjs/reference.cpp: ditto
+        (KJS::Reference::putValue):
+
+2005-06-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Patch contributed by Carsten Guenther <cguenther@gmail.com>.
+
+        -fixes http://bugs.webkit.org/show_bug.cgi?id=3477
+        some US-centric date formats not parsed by JavaScript (clock at news8austin.com)
+
+        Reviewed by darin.
+
+        * kjs/date_object.cpp:
+        (formatLocaleDate):
+        (day):
+        (dayFromYear):
+        (daysInYear):
+        (timeFromYear):
+        (yearFromTime):
+        (weekDay):
+        (timeZoneOffset):
+        (DateProtoFuncImp::call):
+        (DateObjectImp::construct):
+        (KJS::parseDate):
+        (ymdhms_to_seconds):
+        (KJS::makeTime):
+        (findMonth):
+        (KJS::KRFCDate_parseDate):
+        * kjs/date_object.h:
+        * tests/mozilla/expected.html: updated expected test results to reflect fix
+
+2005-06-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - replace hash functions  with better ones
+
+        * JavaScriptCore.pbproj/project.pbxproj: Add new file to build.
+        * kjs/interpreter_map.cpp:
+        (KJS::InterpreterMap::computeHash): Use shared pointer hash.
+        * kjs/pointer_hash.h: Added.
+        (KJS::pointerHash): Pointer hash based on 32-bit mix and 64-bit mix hashes.
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::computeHash): Use shared pointer hash.
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::computeHash): Use SuperFastHash algorithm.
+
+2005-06-22  Darin Adler  <darin@apple.com>
+
+        Change by Anders Carlsson.
+        Reviewed by me.
+
+        - fixed <http://bugs.webkit.org/show_bug.cgi?id=3294>
+          String.prototype.replace() fails with function as second param
+
+        * kjs/string_object.cpp: (replace): Added code to handle functions.
+
+        * tests/mozilla/expected.html: Updated since ecma_3/RegExp/regress-209067.js is fixed now.
+
+        * tests/mozilla/run-mozilla-tests: Fix a minor coding style issue that leads to a warning each
+        time we run the tests.
+
+2005-06-21  Adele Peterson  <adele@apple.com>
+
+        rolling out fix for http://bugs.webkit.org/show_bug.cgi?id=3293, since it caused layout test failures.
+        fast/forms/element-by-name
+        fast/loader/loadInProgress
+
+        * ChangeLog:
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::hasProperty):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::hasProperty):
+        * bindings/runtime_array.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::hasProperty):
+        * bindings/runtime_object.h:
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::hasProperty):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::hasProperty):
+        (KJS::ActivationImp::hasProperty):
+        * kjs/function.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::hasProperty):
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        (ObjectPrototypeImp::ObjectPrototypeImp):
+        (ObjectProtoFuncImp::call):
+        * kjs/object_object.h:
+        (KJS::ObjectProtoFuncImp::):
+        * kjs/string_object.cpp:
+        (StringInstanceImp::hasProperty):
+        * kjs/string_object.h:
+        * tests/mozilla/expected.html:
+
+2005-06-21  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Switched to a build rule rather than a build phase for
+        .y files -- this gets rid of the problem where modifying the .y file would not cause sufficient
+        compilation.
+
+        * kjs/grammar_wrapper.cpp: Removed.
+
+2005-06-21  Adele Peterson  <adele@apple.com>
+
+        Patch from Anders Carlsson <andersca@mac.com>, reviewed by Darin.
+
+        Fixed: <http://bugs.webkit.org/show_bug.cgi?id=3450>
+        <rdar://problem/3881901> String.replace() method not working when regex pattern contains {n, m}
+
+        * pcre/pcre.c: (pcre_compile): Remember the last char length so it can be subtracted correctly if needed.
+
+2005-06-21  Geoffrey Garen  <ggaren@apple.com>
+
+        - fixed <rdar://problem/4155532> 'delete' succeeds on functions
+        - fixed <rdar://problem/4155049> javascript function named as "opener" doesn't get called because of window.opener property
+        
+        Reviewed by cblu.
+
+        * kjs/nodes.cpp:
+        (FuncDeclNode::processFuncDecl): Functions now have DontDelete and Internal attributes set when appropriate.
+
+        Test cases:
+        * tests/mozilla/expected.html: Updated for one new success.
+        - see also test case added in WebCore.
+
+2005-06-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin(first pass) and Hyatt.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=3576
+        (roll in support for "const" keyword from KDE tree)
+        - make processVarDecls handle deletability of variables declared
+        in an eval block the same as evaluate would
+        - make eval() call processVarDecls - needed to match mozilla and
+        to make the second change testable
+
+        I started with the KDE implementation of const but I ended up changing it a bit
+        to avoid the use of a global variable. Now instead of the global variable it distinguishes
+        const and var at the grammar level so the appropriate node can know the right kind of
+        declaration.
+
+        Test cases:
+        * tests/mozilla/expected.html: Updated for one new test that is
+        failing - we used to bail on it entirely because it checks for
+        const support before starting.
+        - see also test cases added in WebCore
+
+        * kjs/grammar.y: Add rules for const declarations.
+        * kjs/keywords.table: Add const keyword.
+        * kjs/nodes.cpp:
+        (VarDeclNode::VarDeclNode): Add parameter.
+        (VarDeclNode::evaluate): Add const support.
+        (VarDeclNode::processVarDecls): Add const support.
+        (VarStatementNode::execute): Irrelevant change.
+        (ForInNode::ForInNode): Tell our variable node that it's a variable.
+        * kjs/nodes.h:
+        (KJS::VarDeclNode::): Add declaration of type enum, extra constructor parameter.
+        (KJS::VarStatementNode::VarStatementNode): Irrelevant change.
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::call): Process var decls before evaluating.
+
+2005-06-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from Mark Rowe <opendarwin.org@bdash.net.nz>, reviewed by me.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=3293
+        
+        Test cases added: 
+        * tests/mozilla/expected.html: Updated for two fixed tests.
+        - also added a layout test
+
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::hasOwnProperty):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::hasOwnProperty):
+        * bindings/runtime_array.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::hasOwnProperty):
+        * bindings/runtime_object.h:
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::hasOwnProperty):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::hasOwnProperty):
+        (KJS::ActivationImp::hasOwnProperty):
+        * kjs/function.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::hasProperty):
+        (KJS::ObjectImp::hasOwnProperty):
+        * kjs/object.h:
+        (KJS::Object::hasOwnProperty):
+        * kjs/object_object.cpp:
+        (ObjectPrototypeImp::ObjectPrototypeImp):
+        (ObjectProtoFuncImp::call):
+        * kjs/object_object.h:
+        (KJS::ObjectProtoFuncImp::):
+        * kjs/string_object.cpp:
+        (StringInstanceImp::hasOwnProperty):
+        * kjs/string_object.h:
+
+2005-06-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        * pcre/get.c: (pcre_get_substring): Fix some computations so this works for UTF-16.
+        This is unused in the current JavaScriptCore, but still good to fix.
+
+2005-06-18  Darin Adler  <darin@apple.com>
+
+        Change by Finlay Dobbie.
+        Reviewed by me.
+
+        - fixed <http://bugs.webkit.org/show_bug.cgi?id=3331>
+          10.3.9 Build Failure: NSString may not respond to `+stringWithCString:encoding:'
+
+        * bindings/objc/WebScriptObject.mm: (-[WebScriptObject stringRepresentation]):
+        Undo change we did a while back to work around the gcc 3.3 compiler error.
+        It no longer seems to happen, and the workaround code was 10.4-specific.
+
+2005-06-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed: <rdar://problem/4151759> 'delete' fails on variables declared inside 'eval' statements.
+
+        Reviewed by cblu.
+
+        * kjs/context.h:
+        (KJS::ContextImp::codeType): Added code type accessor for execution context objects.
+        * kjs/internal.cpp:
+        (ContextImp::ContextImp): Reflects change to ContextImp::codeType.
+        * kjs/nodes.cpp:
+        (VarDeclNode::evaluate): Added separate code path for variable declarations inside 'eval' statements.
+        * tests/mozilla/expected.html: Updated expected test results to reflect fix.
+
+2005-06-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Updated expected.html to reflect fix to <rdar://problem/4147745>.
+
+        Reviewed by cblu.
+
+        * tests/mozilla/expected.html:
+
+2005-06-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed: <rdar://problem/4147745> JavaScript discards locally defined "arguments" property
+
+        No layout tests added because this change fixes existing tests:
+        ecma/ExecutionContexts/10.1.6.js
+        ecma_3/Function/regress-94506.js
+        js1_4/Functions/function-001.js
+
+        Reviewed by cblu.
+
+        * kjs/function.cpp:
+        (KJS::ActivationImp::get): get now checks for an "arguments" property defined in the local variable object
+        before trying to return the built-in arguments array.
+        
+        * kjs/function.h: ActivationImp::put no longer overrides ObjectImp::put
+
+2005-06-10  Darin Adler  <darin@apple.com>
+
+        Change by Mark Rowe <opendarwin.org@bdash.net.nz>.
+        Reviewed by me.
+
+        - further improvements to exception file/line number fix
+
+        * kjs/nodes.h: Added setExceptionDetailsIfNeeded function.
+        * kjs/nodes.cpp: Updated macros to call the new setExceptionDetailsIfNeeded function.
+        (Node::setExceptionDetailsIfNeeded): Added.
+
+2005-06-09  Darin Adler  <darin@apple.com>
+
+        Change by Mark Rowe <opendarwin.org@bdash.net.nz>
+        Reviewed by me.
+
+        * kjs/nodes.cpp: Get rid of unneeded this->.
+
+2005-06-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Change by Mark Rowe <opendarwin.org@bdash.net.nz>
+        Reviewed by me.
+
+        - fixed http://bugs.webkit.org/show_bug.cgi?id=3327
+        (Exception When Setting Style to Invalid Value Lacks Line/File Information)
+
+        * kjs/nodes.cpp: Include source file and line number when making exception in
+        KJS_CHECKEXCEPTIONVALUE.
+
+2005-06-07  Darin Adler  <darin@apple.com>
+
+        Change by Toby Peterson <toby@opendarwin.org>.
+        Reviewed by me.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Allow bison 2.0, which generates the file
+        with a different name.
+
+2005-06-07  Darin Adler  <darin@apple.com>
+
+        Change by Toby Peterson <toby@opendarwin.org>.
+        Reviewed by me.
+
+        * kjs/grammar.y: Remove bogus extra line from grammar.y. Toby got this change from KDE KJS.
+
+2005-06-06  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/run-mozilla-tests: Wrote a perl version of this so we don't require
+        the "jst" tool to run the tests.
+
+2005-06-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - add libicu headers
+
+        * JavaScriptCore.pbproj/project.pbxproj: Added icu directory to header search path.
+
+        * icu/README: Added.
+        * icu/unicode/platform.h: Added.
+        * icu/unicode/uchar.h: Added.
+        * icu/unicode/uconfig.h: Added.
+        * icu/unicode/umachine.h: Added.
+        * icu/unicode/urename.h: Added.
+        * icu/unicode/utf.h: Added.
+        * icu/unicode/utf16.h: Added.
+        * icu/unicode/utf8.h: Added.
+        * icu/unicode/utf_old.h: Added.
+        * icu/unicode/utypes.h: Added.
+        * icu/unicode/uversion.h: Added.
+
+2005-05-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+        
+        - turned off exceptions and RTTI; seems to cut JavaScriptCore code size by about 22%
+
+        * JavaScriptCore.pbproj/project.pbxproj: Turn off exceptions and RTTI for both
+        the framework and testkjs tool.
+
+2005-05-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - got rid of code that depended on RTTI
+
+        * kjs/collector.cpp:
+        (KJS::className): Added. Gets class name in a KJS way, rather than a C++ RTTI way.
+        (KJS::Collector::rootObjectClasses): Use className instead of typeid names.
+
+2005-05-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix a failure seen in the Mozilla JavaScript tests where a live object was garbage-collected
+          when the only reference to it was in an argList on the stack
+
+        * kjs/list.h: Moved the operator= function into the .cpp file since it's too big to be
+        a good choice to inline.
+        * kjs/list.cpp: (KJS::List::operator=): Moved this formerly-inline function into a separate
+        file and added missing code to update valueRefCount. It's the latter that fixes the bug.
+
+2005-05-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele.
+
+        - fixed issues preventing us from compiling with newer versions of gcc 4.0
+
+        * kjs/ustring.cpp:
+        (KJS::operator==): Remove redundant and illegal KJS:: prefix on this function's definition.
+        (KJS::operator<): Ditto.
+        (KJS::compare): Ditto.
+
+2005-05-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+        - turn on conservative GC unconditionally and start on SPI changes to
+          eliminate the now-unneeded smart pointers since we don't ref count any more
+
+        * kjs/value.h: Removed macros to turn conservative GC on and off.
+        Removed ref and deref functions.
+        (KJS::ValueImp::ValueImp): Removed non-conservative-GC code path.
+        (KJS::ValueImp::isUndefined): Added. New SPI to make it easier to deal with ValueImp directly.
+        (KJS::ValueImp::isNull): Ditto.
+        (KJS::ValueImp::isBoolean): Ditto.
+        (KJS::ValueImp::isNumber): Ditto.
+        (KJS::ValueImp::isString): Ditto.
+        (KJS::ValueImp::isObject): Ditto.
+        (KJS::Value::Value): Removed non-conservative-GC code path and made constructor no
+        longer explicit so we can quietly create Value wrappers from ValueImp *; inexpensive with
+        conservative GC and eases the transition.
+        (KJS::Value::operator ValueImp *): Added. Quietly creates ValueImp * from Value.
+        (KJS::ValueImp::marked): Removed non-conservative-GC code path.
+
+        * kjs/value.cpp:
+        (KJS::ValueImp::mark): Removed non-conservative-GC code path.
+        (KJS::ValueImp::isUndefinedOrNull): Added. New SPI to make it easier to deal with ValueImp directly.
+        (KJS::ValueImp::isBoolean): Ditto.
+        (KJS::ValueImp::isNumber): Ditto.
+        (KJS::ValueImp::isString): Ditto.
+        (KJS::ValueImp::asString): Ditto.
+        (KJS::ValueImp::isObject): Ditto.
+        (KJS::undefined): Ditto.
+        (KJS::null): Ditto.
+        (KJS::boolean): Ditto.
+        (KJS::string): Ditto.
+        (KJS::zero): Ditto.
+        (KJS::one): Ditto.
+        (KJS::two): Ditto.
+        (KJS::number): Ditto.
+
+        * kjs/object.h: Made constructor no longer explicit so we can quietly create Object
+        wrappers from ObjectImp *; inexpensive with conservative GC and eases the transition.
+        (KJS::Object::operator ObjectImp *): Added. Quietly creates ObjectImp * from Object.
+        (KJS::ValueImp::isObject): Added. Implementation of new object-related ValueImp function.
+        (KJS::ValueImp::asObject): Ditto.
+
+        * kjs/object.cpp:
+        (KJS::ObjectImp::setInternalValue): Remove non-conservative-GC code path.
+        (KJS::ObjectImp::putDirect): Ditto.
+        (KJS::error): Added. Function in the new SPI style to create an error object.
+
+        * kjs/internal.h: Added the new number-constructing functions as friends of NumberImp.
+        There may be a more elegant way to do this later; what's important now is the new SPI.
+
+        * kjs/collector.h:  Remove non-conservative-GC code path and also take out some
+        unneeded APPLE_CHANGES.
+
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::addNativeReference): Remove non-conservative-GC code path.
+        (KJS::Bindings::removeNativeReference): Ditto.
+        (RootObject::removeAllNativeReferences): Ditto.
+        * bindings/runtime_root.h:
+        (KJS::Bindings::RootObject::~RootObject): Ditto.
+        (KJS::Bindings::RootObject::setRootObjectImp): Ditto.
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate): Ditto.
+        (KJS::Collector::collect): Ditto.
+        (KJS::Collector::numGCNotAllowedObjects): Ditto.
+        (KJS::Collector::numReferencedObjects): Ditto.
+        (KJS::Collector::rootObjectClasses): Ditto.
+        * kjs/internal.cpp:
+        (NumberImp::create): Ditto.
+        (InterpreterImp::globalInit): Ditto.
+        (InterpreterImp::globalClear): Ditto.
+        * kjs/list.cpp:
+        (KJS::List::markProtectedLists): Ditto.
+        (KJS::List::clear): Ditto.
+        (KJS::List::append): Ditto.
+        * kjs/list.h:
+        (KJS::List::List): Ditto.
+        (KJS::List::deref): Ditto.
+        (KJS::List::operator=): Ditto.
+        * kjs/protect.h:
+        (KJS::gcProtect): Ditto.
+        (KJS::gcUnprotect): Ditto.
+
+2005-05-09  Chris Blumenberg  <cblu@apple.com>
+
+        Workaround gcc 3.3 internal compiler errors.
+
+        Reviewed by darin.
+
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject stringRepresentation]): call [NSString stringWithCString:encoding] rather than using @""
+
+2005-05-09  Darin Adler  <darin@apple.com>
+
+        * Makefile.am: Don't set up PBXIntermediatesDirectory explicitly;
+        Not needed to make builds work, spews undesirable error messages too.
+
+2005-05-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - make building multiple trees with make work better
+
+        * Makefile.am: Set up Xcode build directory before invoking xcodebuild.
+
+2005-05-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/4086570> Crash in JavaScriptCore with RSS Visualizer
+        
+        * kjs/internal.cpp:
+        (InterpreterImp::mark): mark staticNaN, it is usually protected by the Number
+        prototype but there is a small window where it can get collected.
+
+2005-05-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - another gcc-4.0-related fix
+
+        * bindings/runtime_root.h: Take off extra namespace prefixes that apparently cause problems
+        compiling with gcc 4.0, although I have not observed the problems.
+
+2005-05-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fixed build rules to match other projects
+
+        * JavaScriptCore.pbproj/project.pbxproj: Set deployment target to 10.3 in the build styles.
+        When built without a build style (by Apple B&I) we want to get the target from the
+        environment. But when built with a build style (by Safari engineers and others), we want
+        to use 10.3.
+
+        * Makefile.am: Took out extra parameters that make command-line building different from
+        Xcode building. Now that this is fixed, you should not get a full rebuild if you switch
+        from command line to Xcode or back.
+
+2005-05-04  Maciej Stachowiak  <mjs@apple.com>
+
+        - revert presumably accidental change to mozilla JS test expected results, this
+        was making the tests fail.
+
+        * tests/mozilla/expected.html:
+
+2005-05-03  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/4102644> Crash in LiveConnect below KJS::Bindings::JavaInstance::stringValue() const
+
+        Correctly handle accessing nil objects from a Java object array.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_runtime.cpp:
+        (JavaArray::valueAt):
+
+2005-05-01  Darin Adler  <darin@apple.com>
+
+        - move to Xcode native targets and stop checking in generated files
+
+        * JavaScriptCore.pbproj/project.pbxproj: Updated to use native targets and generate all the generated
+        files, so we don't have to check them in any more.
+        * Info.plist: Added. Native targets use a separate file for this.
+
+        * Makefile.am: Removed pcre and kjs SUBDIRS. Also removed code that deleted the embedded copy of this
+        framework, since we haven't been embedding it for some time.
+
+        * kjs/grammar_wrapper.cpp: Added. Shell used to compile grammar.cpp since we can't add a generated file
+        easily to the list of files to be compiled.
+
+        * kjs/.cvsignore: Removed.
+        * kjs/Makefile.am: Removed.
+        * kjs/array_object.lut.h: Removed.
+        * kjs/date_object.lut.h: Removed.
+        * kjs/grammar.cpp: Removed.
+        * kjs/grammar.cpp.h: Removed.
+        * kjs/grammar.h: Removed.
+        * kjs/lexer.lut.h: Removed.
+        * kjs/math_object.lut.h: Removed.
+        * kjs/number_object.lut.h: Removed.
+        * kjs/string_object.lut.h: Removed.
+        * pcre/.cvsignore: Removed.
+        * pcre/Makefile.am: Removed.
+        * pcre/chartables.c: Removed.
+
+2005-04-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Harrison.
+
+        - fixed problems preventing us from compiling with gcc 4.0
+
+        * JavaScriptCore.pbproj/project.pbxproj: Removed -Wmissing-prototypes from
+        WARNING_CPLUSPLUSFLAGS since it's now a C-only warning.
+
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::getSlot): Changed some %d to %ld where the parameters where long ints.
+        (JSObject::setSlot): Ditto.
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::getJavaVM): Ditto.
+        (KJS::Bindings::getJNIEnv): Ditto.
+        * bindings/objc/objc_utility.mm: Fixed include of <JavascriptCore/internal.h> that needed the
+        letter "S" capitalized.
+        * kjs/bool_object.cpp: (BooleanProtoFuncImp::call): Rearranged how this function returns to
+        avoid incorrect gcc 4.0 warning.
+        * kjs/collector.cpp: (KJS::Collector::markStackObjectsConservatively): Changed code to check
+        the alignment of the passed-in pointers to only require pointer-level alignment, not 8-byte alignment.
+        Prevents a crash on garbage collect when compiled with gcc 4.0.
+        * kjs/nodes.cpp:
+        (WhileNode::execute): Added a redundant return after an infinite loop to work around incorrect gcc 4.0 warning.
+        (ForNode::execute): Ditto.
+        (SwitchNode::execute):Rearranged how this function returns to avoid incorrect gcc 4.0 warning.
+        (LabelNode::execute): Ditto.
+        * kjs/string_object.cpp: (replace): Ditto.
+
+2005-04-26  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/4098713> Scripting API is incompatible with Mozilla
+        
+        We were incompatible with Mozilla's implementation of the scripting APIs in
+        two ways:
+
+        Their NPN_SetException has the following signature:
+
+            void NPN_SetException(NPObject *npobj, const NPUTF8 *message);
+
+        ours has:
+
+            void NPN_SetException (NPObject * npobj, const NPString *message);
+
+        Also, they expect the string returned from NPN_UTF8FromIdentifier() to be freed by caller.
+        We do not.
+
+        I changed both behaviors to match Mozilla.
+
+        Reviewed by Chris.
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_SetException):
+        * bindings/npruntime.cpp:
+        (_NPN_UTF8FromIdentifier):
+        (_NPN_IntFromIdentifier):
+        (_NPN_SetExceptionWithUTF8):
+        * bindings/npruntime.h:
+        * bindings/npruntime_impl.h:
+
+2005-04-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Chris.
+
+        <rdar://problem/4092136> reproducible crash in KJS::kjs_fast_realloc loading maps.google.com
+        
+        * kjs/string_object.cpp:
+        (StringObjectFuncImp::call): Allocate adopted ustring buffer properly.
+
+2005-04-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/ustring.cpp: (KJS::UString::UTF8String): Fix off-by-one error in surrogate pair logic.
+
+2005-04-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+        - fixed <rdar://problem/4090046> JavaScript throw statement causes parse error when no semicolon is present
+
+        * kjs/grammar.y: Added an additional rule for throw like the ones we have for all the other semicolon rules.
+        Not sure why we missed this one earlier.
+
+        * kjs/grammar.cpp: Regenerated.
+
+=== JavaScriptCore-412.1 ===
+
+2005-04-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - speedups, total 12% on JavaScript iBench
+
+        I ran the benchmark under Shark and followed its advice a lot, mainly.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate): Take out special case for 0; costing speed but unexercised.
+        Use numLiveObjectsAtLastCollect instead of numAllocationsSinceLastCollect so we don't
+        have to bump it each time we call allocate. Put numLiveObjects into a local variable to
+        cut down on global variable accesses. Make "next" cell pointer be a byte offset rather
+        than a pointer so we don't need a special case for NULL. Allow freeList to point to some
+        bogus item when the entire block is full rather than going out of our way to make it
+        point to NULL.
+        (KJS::Collector::markProtectedObjects): Get table size and pointer into locals outside
+        the loop to avoid re-loading them over and over again.
+        (KJS::Collector::collect): Put numLiveObjects into a local variable to cut down on global
+        variable accesses. Make "next" cell pointer be a byte offset as above. Put numLiveObjects
+        into a local variable to cut down on global variable accesses. Set numLiveObjectsAtLastCollect
+        rather than numAllocationsSinceLastCollect.
+        (KJS::Collector::numReferencedObjects): Get table size and pointer into locals outside
+        the loop to avoid re-loading them over and over again.
+        (KJS::Collector::rootObjectClasses): Ditto.
+
+        * kjs/internal.h: Make Value be a friend of NumberImp so it can construct number objects
+        directly, avoiding the conversion from Number to Value.
+
+        * kjs/internal.cpp: (StringImp::toObject): Don't use Object::dynamicCast, because we know
+        the thing is an object and we don't want to do all the extra work; just cast directly.
+
+        * kjs/list.cpp: (KJS::List::List): Construct valueRefCount in a way that avoids the need for
+        a branch -- in the hot case this just meant avoiding checking a variable we just set to false.
+
+        * kjs/lookup.cpp: (keysMatch): Marked this inline.
+
+        * kjs/nodes.cpp: Disabled KJS_BREAKPOINT, to avoid calling hitStatement all the time.
+        (BooleanNode::evaluate): Make a Value directly, rather than making a Boolean which is converted
+        into a Value.
+        (NumberNode::evaluate): Ditto.
+        (StringNode::evaluate): Ditto.
+        (ArrayNode::evaluate): Ditto.
+        (FunctionCallNode::evaluate): Use new inline baseIfMutable to avoid unnecessary getBase function.
+        Also just use a pointer for func, rather than an Object.
+        (PostfixNode::evaluate): Change code so that it doesn't make an excess Number, and so that it
+        passes a "known to be integer" boolean in, often avoiding a conversion from floating point to
+        integer and back.
+        (DeleteNode::evaluate): Make a Value directly.
+        (TypeOfNode::evaluate): Use new inline baseIfMutable and make Value directly.
+        (PrefixNode::evaluate): Change code so that it doesn't make an excess Number, and so that it
+        passes a "known to be integer" boolean in, often avoiding a conversion from floating point to
+        integer and back.
+        (UnaryPlusNode::evaluate): Make a Value directly.
+        (NegateNode::evaluate): Change code so that it doesn't make an excess Number, and so that it
+        passes a "known to be integer" boolean in, often avoiding a conversion from floating point to
+        integer and back.
+        (BitwiseNotNode::evaluate): Make a Value directly.
+        (LogicalNotNode::evaluate): Ditto.
+        (ShiftNode::evaluate): Don't convert to a double before making a Value.
+        (RelationalNode::evaluate): Make a Value directly.
+        (EqualNode::evaluate): Ditto.
+        (BitOperNode::evaluate): Ditto.
+        (AssignNode::evaluate): Make a Value directly. Change code so that it passes a "known to be integer"
+        boolean in, often avoiding a conversion from floating point to integer and back.
+        (VarDeclNode::evaluate): Make a Value directly.
+        (ForNode::execute): Remove unused local variable.
+
+        * kjs/operations.h:
+        (KJS::isNaN): Inlined.
+        (KJS::isInf): Ditto.
+        (KJS::isPosInf): Ditto.
+        (KJS::isNegInf): Ditto.
+
+        * kjs/operations.cpp: Change isNaN, isInf, isPosInf, and isNegInf to be inlines.
+        (KJS::equal): Rewrite to avoid creating values and recursing back into the function.
+        (KJS::relation): Rearranged code so that we don't need explicit isNaN checks.
+        (KJS::add): Changed code to make Value directly, and so that it passes a "known to be integer"
+        boolean in, often avoiding a conversion from floating point to integer and back.
+        (KJS::mult): Ditto.
+
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::~PropertyMap): Get size and entries pointer outside loop to avoid
+        re-getting them inside the loop.
+        (KJS::PropertyMap::clear): Ditto. Clear value pointer in addition to key, so we can just
+        look at the value pointer in the mark function.
+        (KJS::PropertyMap::get): Get sizeMask and entries pointer outside loop to avoid
+        re-getting them inside the loop.
+        (KJS::PropertyMap::put): Ditto.
+        (KJS::PropertyMap::insert): Ditto.
+        (KJS::PropertyMap::remove): Ditto.
+        (KJS::PropertyMap::mark): Get size and entries pointer outside loop to avoid
+        re-getting them inside the loop. Don't bother checking key for 0, since we already have
+        to check value for 0. (Also had to change clear() to set value to 0.)
+        (KJS::PropertyMap::addEnumerablesToReferenceList): Get size and entries pointer outside
+        loop to avoid re-getting them inside the loop.
+        (KJS::PropertyMap::addSparseArrayPropertiesToReferenceList): Ditto.
+        (KJS::PropertyMap::save): Ditto.
+
+        - other changes
+
+        * kjs/protected_values.h: Remove unneeded class name qualifiers.
+
+        * kjs/reference.h:
+        (KJS::Reference::baseIfMutable): New inline function: replaces isMutable().
+        (KJS::Reference::Reference): Inlined.
+        * kjs/reference.cpp:
+        (KJS::Reference::getValue): Rewrite to not use getBase.
+        (KJS::Reference::putValue): Ditto.
+        (KJS::Reference::deleteValue): Dittol
+
+        * kjs/simple_number.h:
+        (KJS::SimpleNumber::integerFits): Added. For use when the parameter is known to be integral.
+
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): Create the number without first converting
+        to double in various cases that involve integers.
+
+        * kjs/ustring.h:
+        (KJS::UString::attach): Inlined.
+        (KJS::UString::release): Inlined.
+        * kjs/ustring.cpp:
+        (KJS::UString::find): Get first character outside the loop instead of re-fetching it each time.
+
+        * kjs/value.cpp:
+        (Value::Value): Added overloads for all the various specific types of values, so you don't have
+        to convert from, say, Number to Value, just to create one.
+        (Number::Number): Added an overload that takes a boolean to indicate the number is already
+        known to be an integer.
+
+        * kjs/value.h: Added more Value constructors, added a version of toNumber that returns
+        a boolean to indicate if the number is known to be an integer (because it was a "simple number").
+        (KJS::ValueImp::marked): Inlined.
+        (KJS::ValueImp::dispatchType): Inlined.
+        (KJS::ValueImp::dispatchToPrimitive): Inlined.
+        (KJS::ValueImp::dispatchToBoolean): Inlined.
+        (KJS::ValueImp::dispatchToNumber): Inlined.
+        (KJS::ValueImp::dispatchToString): Inlined.
+        (KJS::ValueImp::dispatchToUInt32): Inlined.
+
+2005-04-14  Maciej Stachowiak  <mjs@apple.com>
+
+        - make fast_malloc.h a private header, not project
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+2005-04-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Richard.
+
+        <rdar://problem/4089734> JavaScript iBench can be sped up ~10% with custom allocator
+
+        - use custom single-threaded malloc for all non-GC JavaScriptCore
+        allocations, for a 9.1% speedup on JavaScript iBench
+        
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate): Use dlmalloc to allocate the collector blocks.
+        (KJS::Collector::collect): And dlfree to free it.
+        * kjs/fast_malloc.cpp: Added, just the standard dlmalloc here.
+        * kjs/fast_malloc.h: Added. Declarations for the functions. Also added a handy
+        macro to give a class custom operator new/delete
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add): Use dlmalloc/dlfree.
+        * kjs/nodes.h: make nodes KJS_FAST_ALLOCATED.
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::~PropertyMap): Use dlmalloc/dlfree.
+        (KJS::PropertyMap::rehash): ditto
+        * kjs/scope_chain.h:
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::createCopying): New named constructor that copies a passed-in
+        buffer, to hide allocation details from webcore.
+        (KJS::UString::UString): use createCopying when appropriate.
+        (KJS::UString::Rep::destroy): Use dlmalloc/dlfree.
+        (KJS::UString::expandedSize): likewise
+        (KJS::UString::expandCapacity): likewise
+        (KJS::UString::expandPreCapacity): likewise
+        (KJS::UString::spliceSubstringsWithSeparators): likewise
+        (KJS::UString::append): likewise
+        (KJS::UString::operator=): likewise
+        (KJS::UString::detach): likewise
+        * kjs/ustring.h: make UString and UString::Rep KJS_FAST_ALLOCATED.
+
+2005-04-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        <rdar://problem/4086819> Avoid using protect count hash table so much for 5.6% JS iBench speedup
+
+        - Avoid using protected values hash for the two most common cases
+        - Bump up ListImp high water mark, new testing shows 508 ListImps are
+        created during JS iBench.
+
+        Net result is a 5.6% speedup on JavaScript iBench
+        
+        * kjs/collector.cpp:
+        (KJS::Collector::collect): mark protected lists as appropriate.
+        * kjs/context.h:
+        * kjs/list.cpp:
+        (KJS::ListImp::markValues): Moved implementation from List::markValues
+        (KJS::List::markProtectedLists): Implemented - scan pool and overflow
+        list.
+        (KJS::allocateListImp): link lists outside the pool into a separate
+        doubly linked list to be able to mark protected lists
+        (KJS::deallocateListImp): do the corresponding delinking
+        (KJS::List::derefValues): do nothing in conservative GC mode
+        (KJS::List::refValues): do nothing in conservative GC mode
+        (KJS::List::markValues): call ListImp version
+        (KJS::List::append):
+        * kjs/list.h:
+
+=== Safari-412 ===
+
+=== Safari-411 ===
+
+=== Safari-410 ===
+
+=== Safari-409 ===
+
+=== Safari-408 ===
+
+=== Safari-407 ===
+
+2005-03-16  Jens Alfke  <jens@apple.com>
+
+        Reviewed by Kevin.
+
+        Fix for <rdar://problem/4025212> "REGRESSION (163-164): search not performed correctly; united.com"
+        JavaScript unescape("") was returning a messed-up String object that appeared identical to an empty string, but would in some cases act as 'null' when passed to native functions, in this case the Option() constructor.
+        In the implementation of unescape, the UString holding the result was not initialized to "", so it started out as a null string. If nothing was appended to it, it remained null, resulting in a JavaScript String object with some bad behaviors (namely, converting it to a DOMStringImpl results in a NULL pointer.)
+        Darin says this regression occurred when we replaced our own implementation of unescape() with code from KJS.
+
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::call):
+
+2005-03-15  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/4053276> WebScripting protocol in WebKit cannot convert Boolean in Javascript to BOOL in Objective-C
+
+        Added JavaScript boolean to type that can be converted to
+        ObjC scalar parameters.
+
+        Reviewed by Ken Kocienda.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+
+=== Safari-406 ===
+
+=== Safari-405 ===
+
+=== Safari-403 ===
+
+=== Safari-402 ===
+
+=== Safari-401 ===
+
+=== Safari-400 ===
+
+=== Safari-188 ===
+
+2005-02-21  Darin Adler  <darin@apple.com>
+
+        * kjs/date_object.cpp: (timetUsingCF): Fixed indenting.
+
+2005-02-17  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/4003251> Safari crashed at www.icelandair.com in LiveConnect code converting a Java object to a string
+
+        Added nil check.
+
+        Reviewed by John Sullivan.
+
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+
+=== Safari-187 ===
+
+2005-02-11  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3985118> DOM objects not being marshaled on JS->native calls
+
+        Re-factored how 'native' wrappers for JS objects are created.  The interpreter now
+        creates these wrappers.  The WebCore subclass of the interpreter now overrides
+        createLanguageInstanceForValue() and creates a DOM ObjC wrapper for DOM objects.
+
+        Reviewed by Ken.
+
+        * bindings/c/c_utility.cpp:
+        (convertValueToNPVariant):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+        (JavaArray::valueAt):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject _setExecutionContext:KJS::Bindings::]):
+        (+[WebScriptObject _convertValueToObjcValue:KJS::originExecutionContext:Bindings::executionContext:Bindings::]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/objc/objc_utility.h:
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertObjcValueToValue):
+        (KJS::Bindings::createObjcInstanceForValue):
+        * bindings/runtime.cpp:
+        (Instance::createBindingForLanguageInstance):
+        (Instance::createRuntimeObject):
+        (Instance::createLanguageInstanceForValue):
+        * bindings/runtime.h:
+        * kjs/interpreter.cpp:
+        (Interpreter::createLanguageInstanceForValue):
+        * kjs/interpreter.h:
+
+=== Safari-186 ===
+
+2005-02-10  Darin Adler  <darin@apple.com>
+
+        "Reviewed" by Richard (he told me the file was obsolete).
+
+        - got rid of an obsolete file
+
+        * bindings/npsap.h: Removed.
+
+=== Safari-185 ===
+
+=== Safari-183 ===
+
+2005-02-03  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3972905> CrashTracer: ...36 crashes at com.apple.WebCore: khtml::CSSStyleSelector::applyDeclarations + 120
+
+        Revert to old (and correct) behavior of returning runtime object
+        when passed as a parameter, rather than it's corresponding DOM
+        object.
+
+        Reviewed by Chris.
+
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:KJS::originExecutionContext:Bindings::executionContext:Bindings::]):
+
+=== Safari-182 ===
+
+2005-01-28  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3980389> JavaScript bindings access incorrect runtime object
+
+        Only use special 'back door' property to get the runtime object if thisObj isn't
+        already a runtime object.
+
+        <gratuitous> Cleaned up a couple of strcmp on ClassInfo name.  Used == on
+        ClassInfo pointer instead.
+
+        Reviewed by Chris.
+
+        * bindings/c/c_utility.cpp:
+        (convertValueToNPVariant):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:KJS::originExecutionContext:Bindings::executionContext:Bindings::]):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::call):
+
+=== Safari-181 ===
+
+2005-01-26  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3972522> (179-180) 40% slowdown on iBench JavaScript test
+
+        I added a member variable to ObjectImp.  This changed it's size and consequently
+        hampered the optimizations built into the garbage collector.  Objects no longer
+        fit within the allocators cell size, and thus allocation fell back to a slower
+        allocator.
+
+        As a result of this fix I also dramatically cleaned up how runtime objects are
+        accessed.  The path mostly *removes* code.
+        
+        Reviewed by Chris.
+
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::call):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+        (RuntimeObjectImp::hasProperty):
+        (RuntimeObjectImp::defaultValue):
+        * bindings/runtime_object.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::ObjectImp):
+        * kjs/object.h:
+
+2005-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by me, changes by Han Ming Ong.
+
+        - <rdar://problem/3964302> SWB: A few files need to be updated to be compilable under GCC 4.0
+
+        * bindings/objc/WebScriptObjectPrivate.h: Make members public.
+        * kjs/lookup.h: Change "value.h" to "object.h" because we need KJS::Object to compile a template.
+
+2005-01-20  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3964634> undefined property value from binding seems to evaluate to true in an if statement
+
+        The comprehensive fix for this problem requires new API, as described in 3965326.  However,
+        given that we can't add new API at this point, the 'ObjcFallbackObjectImp' will behave
+        like and Undefined object if  invokeUndefinedMethodFromWebScript:withArguments: isn't
+        implemented on the bound object.
+
+        Reviewed by Chris.
+
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::type):
+        (ObjcFallbackObjectImp::implementsCall):
+        (ObjcFallbackObjectImp::toBoolean):
+        * bindings/testbindings.mm:
+        (+[MyFirstInterface isSelectorExcludedFromWebScript:]):
+        (+[MyFirstInterface isKeyExcludedFromWebScript:]):
+
+=== Safari-180 ===
+
+2005-01-19  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3853676> Browser Crash when accessing CCWeb Progress Page - KJS::Bindings::convertValueToJValue
+
+        Fixed the following problems with LiveConnect that are demonstrated by the application
+        described in 3853676.
+
+        1.  If a nil object is passed in an array from Java to JavaScript we will crash.
+        2.  We sometimes will incorrectly attempt to access a generic JavaScript as a Java runtime object wrapper.
+        3.  We will sometimes fail to find the correct static method ID.
+
+        Reviewed by Maciej.
+
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::convertJObjectToValue):
+        (JSObject::listFromJArray):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::getMethodID):
+        (KJS::Bindings::convertValueToJValue):
+        * bindings/runtime_array.h:
+
+2005-01-18  Richard Williamson   <rjw@apple.com>
+
+        Fixed several issues all arising from analysis of plugin detection code at ifilm.com:
+
+        Fixed <rdar://problem/3958592> can't script plug-ins if plug-in is invoked with <object> element instead of <embed>
+        Fixed <rdar://problem/3958597> <object> elements with IDs do not show up as named properties of the document
+        Fixed <rdar://problem/3960973> DOM objects for plugin elements are not accessible
+        Fixed <rdar://problem/3958601> need an additional class ID in WebCore for the Real plug-in
+
+        We now support accessing scriptable plugin objects that are specified with <applet>, <embed>, or <object>
+        tags.  Also, if any of these elements are named they can be accessed from the document or window objects.
+        Finally, DOM methods are properties will be forwarded appropriately for the plugin's root scriptable object.
+
+        Reviewed by Chris.
+
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::supportsSetValueOfUndefinedField):
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::supportsSetValueOfUndefinedField):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+        (RuntimeObjectImp::hasProperty):
+        (RuntimeObjectImp::defaultValue):
+        * bindings/runtime_object.h:
+        (KJS::RuntimeObjectImp::fallbackObject):
+        * kjs/object.cpp:
+        (KJS::ObjectImp::ObjectImp):
+        * kjs/object.h:
+        (KJS::ObjectImp::forwardingScriptMessage):
+        (KJS::ObjectImp::setForwardingScriptMessage):
+
+2005-01-18  Richard Williamson   <rjw@apple.com>
+
+        Back out a change that was incorrectly committed yesterday.
+
+        Reviewed by Chris.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+
+2005-01-17  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3753030> Need to ensure same origin for plugin binding invocations (origin security rules)
+
+        Keep track of originating execution context and target execution
+        context for native JS object wrappers, and perform appropriate
+        security checks.
+
+        Reviewed by David Harrison.
+
+        * bindings/NP_jsobject.cpp:
+        (_isSafeScript):
+        (_NPN_CreateScriptObject):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_SetException):
+        * bindings/NP_jsobject.h:
+        * bindings/c/c_instance.cpp:
+        (CInstance::CInstance):
+        (CInstance::stringValue):
+        * bindings/c/c_instance.h:
+        * bindings/c/c_utility.cpp:
+        (convertValueToNPVariant):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::JavaInstance):
+        (JavaInstance::valueOf):
+        * bindings/jni/jni_instance.h:
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject _initializeWithObjectImp:KJS::originExecutionContext:Bindings::executionContext:Bindings::]):
+        (-[WebScriptObject _initWithObjectImp:KJS::originExecutionContext:Bindings::executionContext:Bindings::]):
+        (-[WebScriptObject KJS::Bindings::]):
+        (-[WebScriptObject _setOriginExecutionContext:KJS::Bindings::]):
+        (-[WebScriptObject _isSafeScript]):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:KJS::originExecutionContext:Bindings::executionContext:Bindings::]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_runtime.mm:
+        (convertValueToObjcObject):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        * bindings/runtime.cpp:
+        (Instance::Instance):
+        (Instance::operator=):
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::Instance):
+        (KJS::Bindings::Instance::setExecutionContext):
+        (KJS::Bindings::Instance::executionContext):
+        * bindings/runtime_root.cpp:
+        (RootObject::setInterpreter):
+        * bindings/runtime_root.h:
+        * kjs/interpreter.h:
+        (KJS::Interpreter::isGlobalObject):
+        (KJS::Interpreter::interpreterForGlobalObject):
+        (KJS::Interpreter::isSafeScript):
+
+=== Safari-179 ===
+
+2005-01-13  Vicki Murley <vicki@apple.com>
+
+        Reviewed by Adele.
+
+        - fix <rdar://problem/3946836> Safari about box lists 2004 instead of 2005
+ 
+        * JavaScriptCore.pbproj/project.pbxproj: bump "2004" to "2005"
+
+2005-01-12  Richard Williamson   <rjw@apple.com>
+
+        Avoid additional work on dealloc by adding early out to
+        removeNativeReference().  (This will save time on dealloc
+        for all ObjC DOM objects.)
+
+        Reviewed by Darin.
+
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::removeNativeReference):
+
+2005-01-12  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3923356> REGRESSION: Java/JavaScript security checks working incorrectly
+
+        We were always returning the first "root" object for all runtime
+        objects.  Changed 0 in loop to i, the index.
+
+        Reviewed by David Harrison.
+
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::rootForImp):
+
+2005-01-11  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3887930> Must use new Java plug-in API to get/set fields so exception handling works (fixes many LiveConnect crashes)
+
+        Use the new dispatching API to invoke JNI, rather than calling JNI
+        directly.
+
+        Reviewed by David Harrison.
+
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        * bindings/jni/jni_runtime.h:
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::convertValueToJValue):
+
+=== Safari-178 ===
+
+=== Safari-177 ===
+
+=== Safari-176 ===
+
+2004-12-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Kevin.
+
+        <rdar://problem/3926869> Opening caches window after running PLT causes crash
+        
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::getProtectCount): Don't include simple numbers in
+        the protected value table.
+        (KJS::ProtectedValues::increaseProtectCount): Ditto.
+        (KJS::ProtectedValues::decreaseProtectCount): Ditto.
+
+2004-12-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed <rdar://problem/3920764> Unimplemented String methods toLocaleLowerCase and toLocaleUpperCase
+
+        * kjs/string_object.h: Added toLocaleLowerCase and toLocaleUpperCase.
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): Made locale versions be synonmyms for the
+        non-locale-specific versions.
+        * kjs/string_object.lut.h: Regenerated.
+
+2004-12-14  Richard Williamson   <rjw@apple.com>
+
+        Pass URL of plugin view when call into JNI.
+
+        Reviewed by Chris.
+
+        * bindings/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall):
+
+2004-12-13  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3827799> repro. crash with IBM Rational ClearCase Web under Safari (Java/LiveConnect-related)
+
+        Add support for calling static Java methods from JavaScript.
+
+        Reviewed by Maciej.
+
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaMethod::isStatic):
+        * bindings/jni/jni_utility.cpp:
+        (callJNIStaticMethod):
+        (KJS::Bindings::callJNIBooleanMethod):
+        (KJS::Bindings::callJNIStaticBooleanMethod):
+        * bindings/jni/jni_utility.h:
+
+2004-12-13  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3887767> LiveConnect doesn't propagate Java exceptions back to JavaScript (prevents security suite from running)
+
+        Reviewed by John.
+
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall):
+        * bindings/jni/jni_runtime.h:
+        * bindings/jni/jni_utility.h:
+
+=== Safari-175 ===
+
+2004-12-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/3908017> REGRESSION (172-173): assertion in ObjectImp::construct trying to create JS error (24hourfitness.com)
+
+        The fix was to implement copy constructor and assignment operator,
+        the ones that worked on the base class did not replace the
+        defaults apparently!
+        
+        * kjs/protect.h:
+        (KJS::ProtectedValue::ProtectedValue):
+        (KJS::ProtectedValue::operator=):
+        (KJS::ProtectedObject::ProtectedObject):
+        (KJS::ProtectedObject::operator=):
+        
+        Also fixed a bug in the GC test mode that compares the results of
+        the old collector and the new collector.
+
+        * kjs/value.cpp:
+        (ValueImp::mark):
+
+=== Safari-173 ===
+
+2004-11-23  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3890385> field and method cache incorrectly capped (c bindings)
+
+        Reviewed by Ken.
+
+        * bindings/c/c_class.cpp:
+        (CClass::_commonInit):
+
+2004-11-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+        <rdar://problem/3889696> Enable conservative garbage collection for JavaScript
+        
+        * kjs/collector.cpp:
+        (KJS::Collector::Thread::Thread):
+        (KJS::destroyRegisteredThread):
+        (KJS::initializeRegisteredThreadKey):
+        (KJS::Collector::registerThread):
+        (KJS::Collector::markStackObjectsConservatively):
+        (KJS::Collector::markCurrentThreadConservatively):
+        (KJS::Collector::markOtherThreadConservatively):
+        * kjs/collector.h:
+        * kjs/internal.cpp:
+        (lockInterpreter):
+        * kjs/value.h:
+
+=== Safari-172 ===
+
+2004-11-15  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3880561> Default string value of ObjC object in JS should be [obj description].
+
+        Reviewed by Hyatt.
+
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::stringValue):
+        * bindings/objc/objc_utility.h:
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertNSStringToString):
+        (KJS::Bindings::convertObjcValueToValue):
+
+=== Safari-171 ===
+
+2004-11-09  Chris Blumenberg  <cblu@apple.com>
+
+        Fixed: <rdar://problem/3872724> soft link against JavaVM to save ~2MB RSHRD
+
+        Reviewed by rjw.
+
+        * ChangeLog:
+        * JavaScriptCore.pbproj/project.pbxproj: don't link against JavaVM
+        * bindings/softlinking.c: Added.
+        (loadFramework): new
+        (getFunctionPointer): new
+        (JNI_GetCreatedJavaVMs): load JavaVM if not already loaded, get _JNI_GetCreatedJavaVMs symbol if we don't already have it, call JNI_GetCreatedJavaVMs
+
+=== Safari-170 ===
+
+2004-11-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        - fixed <rdar://problem/3865365> since -[WebScriptObject dealloc] does not call [super dealloc], the build will fail due to a warning
+        - fixed behavior so that [[WebScriptObject alloc] initWithCoder:] doesn't leak WebUndefined instances
+          and incidentally so that [[WebScriptObject alloc] init] returns the single shared instance rather
+          than allocating a new one
+
+        * bindings/objc/WebScriptObject.mm: Removed some stray semicolons.
+        (+[WebUndefined allocWithZone:]): Made this the common bottleneck that returns the single instance
+        of WebUndefined, since it's the single method that normally allocates new instances. Calls super to
+        actually allocate only the very first time it's called.
+        (-[WebUndefined initWithCoder:]): Simplified to just return self (no reason to re-lookup the single
+        shared instance since there can be only one).
+        (-[WebUndefined copyWithZone:]): Ditto.
+        (-[WebUndefined retain]): Ditto.
+        (-[WebUndefined retainCount]): Use UINT_MAX constant here (matches usage in NSObject.m for retain count
+        of class).
+        (-[WebUndefined autorelease]): Simplified to just return self (see above).
+        (-[WebUndefined copy]): No need to override this since it just turns around and calls copyWithZone:.
+        (-[WebUndefined dealloc]): Added an assertion since this method should never be called. Also added
+        a call to [super dealloc] after return; to make the new -Wdealloc-check compiler happy (fixing the
+        bug mentioned above).
+        (+[WebUndefined undefined]): Reimplemented; calls allocWithZone:NULL to get to the shared instance.
+        No need to call init, since that's a no-op for this class.
+
+2004-11-03  David Harrison  <harrison@apple.com>
+
+        Reviewed by Darin.
+        
+        Eliminate the use of a marker file to determine how to build.
+
+        * .cvsignore:
+        * Makefile.am:
+
+2004-11-01  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3861469> Latest Real player crashes Safari on some sites.
+
+        Reviewed by Ken.
+
+        * bindings/c/c_instance.cpp:
+        (CInstance::invokeMethod):
+        (CInstance::invokeDefaultMethod):
+        Initialize out parameters to void type.
+
+        * bindings/c/c_runtime.cpp:
+        (CField::valueFromInstance):
+        (CField::setValueToInstance):
+        Initialize out parameters to void type.
+        Also added additional checks to protect against classes that 
+        don't implement all functions.
+
+2004-11-01  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3861257> WebUndefined should be returned for undefined values
+
+        Reviewed by John.
+
+        * ChangeLog:
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:KJS::root:Bindings::]):
+        Added additional conversion Undefined -> WebUndefined.
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertObjcValueToValue):
+        Added additional conversion WebUndefined -> Undefined.
+
+2004-11-01  Darin Adler  <darin@apple.com>
+
+        - fixed <rdar://problem/3855573> Remove reference to "WebScriptMethods" from WebScriptObject.h comments
+
+        * bindings/objc/WebScriptObject.h: Removed unneeded #ifdef protection for multiple includes (since
+        this is an Objective-C header and we use #import for those). Fixed comments as requested in the bug
+        report to match the contents of the file.
+
+=== Safari-169 ===
+
+=== Safari-168 ===
+
+2004-10-22  Ken Kocienda  <kocienda@apple.com>
+
+        Reviewed by me
+
+        * JavaScriptCore.pbproj/project.pbxproj:  
+        Add GCC_ENABLE_OBJC_GC and GCC_FAST_OBJC_DISPATCH flags.
+
+=== Safari-167 ===
+
+2004-10-13  Richard Williamson   <rjw@apple.com>
+
+        Moved boolean checks prior to NSNumber checks.  booleans are
+        NSNumbers.
+
+        Follow on to <rdar://problem/3821515> binding layer needs to convert NSNumber-bools to js type boolean not number.
+
+        Reviewed by John.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertObjcValueToValue):
+
+2004-10-12  Richard Williamson   <rjw@apple.com>
+
+        Fixed access to DOM object via WebScriptObject API.
+        The execution context for DOM objects wasn't being found.
+        <rdar://problem/3831372> The valueForKey method for @"offsetLeft" on a paragraph element causes a crash.
+
+        Reviewed by Chris.
+
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject KJS::Bindings::]):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+
+2004-10-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin.
+
+        - fixed <rdar://problem/3804661> REGRESSION: JavaScriptCore framework now has two init routines
+
+        * bindings/NP_jsobject.cpp: Fixed unnecessarily-complex globals set up that was
+        creating an init routine.
+
+        * kjs/ustring.cpp: Changed around the UString::Rep::empty construction to not
+        require a global constructor that creates an init routine.
+
+2004-10-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin.
+
+        - fixed <rdar://problem/3822618> REGRESSION (164-165): expedia.com's popup help doesn't work
+
+        * kjs/reference.cpp: (Reference::putValue): Change so that references not found in any object
+        work with the window object of the page the function is in, not the page of the caller. This
+        is what all other browsers do. This code was hidden before by the "everything is defined on
+        window object" hack in WebCore.
+
+2004-10-07  Richard Williamson   <rjw@apple.com>
+
+        Added simple JavaScript call tracing.  Very useful for
+        debugging complex pages.
+
+        Tracing is only available in development builds and is
+        enabled by:
+
+        (gdb) set traceJavaScript = 1
+
+        or programatically
+
+        setTraceJavaScript(true)
+
+        Function, args, and return values are printed to console.  Very
+        verbose.
+
+        Reviewed by Ken.
+
+        * kjs/function_object.cpp:
+        (FunctionProtoFuncImp::call):
+        * kjs/object.cpp:
+        (KJS::Object::call):
+
+=== Safari-166 ===
+
+2004-10-05  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3819234> NPN_SetException (and throwException:) isn't implemented
+
+        Reviewed by Chris.
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_SetException):
+        * bindings/npruntime.cpp:
+        (_NPN_SetExceptionWithUTF8):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject throwException:]):
+        * kjs/internal.h:
+        (KJS::InterpreterImp::context):
+
+2004-10-05  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3821515> binding layer needs to convert NSNumber-bools to js type boolean not number
+
+        Reviewed by Ken.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertObjcValueToValue):
+
+2004-10-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        - rolled in a fix the KDE folks did for the operations that generate HTML fragments
+
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): Added quote marks to generated HTML.
+
+        - rolled out an old workaround we don't need any more
+
+        * JavaScriptCore.pbproj/project.pbxproj: Remove -Wno-long-double because the <math.h> issue that
+        required it is no longer there.
+
+2004-09-30  Richard Williamson  <rjw@apple.com>
+
+        Fixed <rdar://problem/3821215> NPN hasMethod and hasProperty functions should take NPObjects, not NPClass
+
+        Reviewed by Chris.
+
+        * bindings/NP_jsobject.cpp:
+        (_NPN_GetProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        * bindings/c/c_class.cpp:
+        (CClass::methodsNamed):
+        (CClass::fieldNamed):
+        * bindings/c/c_class.h:
+        * bindings/c/c_instance.cpp:
+        (CInstance::invokeMethod):
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::methodsNamed):
+        * bindings/jni/jni_class.h:
+        * bindings/npruntime.h:
+        * bindings/objc/objc_class.h:
+        * bindings/objc/objc_class.mm:
+        (ObjcClass::methodsNamed):
+        * bindings/runtime.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::hasProperty):
+
+2004-09-29  Chris Blumenberg  <cblu@apple.com>
+
+        Prepended underscores to NPN methods so that when the QT plug-in loads these symbols, it uses the non-underscore versions in WebKit. Without this, the QT plug-in was failing to load when launching Safari from the command-line.
+
+        Reviewed by rjw.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_jsobject.cpp:
+        (_NPN_CreateScriptObject):
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        * bindings/c/c_class.cpp:
+        (CClass::methodsNamed):
+        (CClass::fieldNamed):
+        * bindings/c/c_instance.cpp:
+        (CInstance::CInstance):
+        (CInstance::~CInstance):
+        (CInstance::operator=):
+        (CInstance::invokeMethod):
+        (CInstance::invokeDefaultMethod):
+        * bindings/c/c_runtime.cpp:
+        * bindings/c/c_runtime.h:
+        (KJS::Bindings::CField::name):
+        (KJS::Bindings::CMethod::name):
+        * bindings/npruntime.cpp:
+        (_NPN_GetStringIdentifier):
+        (_NPN_GetStringIdentifiers):
+        (_NPN_GetIntIdentifier):
+        (_NPN_IdentifierIsString):
+        (_NPN_UTF8FromIdentifier):
+        (_NPN_IntFromIdentifier):
+        (NPN_InitializeVariantWithObject):
+        (_NPN_ReleaseVariantValue):
+        (_NPN_CreateObject):
+        (_NPN_RetainObject):
+        (_NPN_ReleaseObject):
+        (_NPN_SetExceptionWithUTF8):
+        (_NPN_SetException):
+
+2004-09-26  Darin Adler  <darin@apple.com>
+
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): Remove strange use of high() and
+        low() to get Unicode value of character, and just use unicode().
+
+2004-09-26  Darin Adler  <darin@apple.com>
+
+        - refine charAt/charCodeAt fix slightly
+
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): Treat undefined the same was as an
+        omitted parameter, as we do everywhere else, and as other browsers do here.
+
+2004-09-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin.
+
+        - fixed <rdar://problem/3816097> REGRESSION: mailblocks, and presumably many other pages, failing because variable not found
+
+        * kjs/internal.cpp: (InterpreterImp::evaluate): Process variable declarations before executing
+        the program. We were doing this properly for functions, but not entire programs.
+
+        - fixed <rdar://problem/3814706> REGRESSION: text fields in mailblocks wizards do not accept keystrokes due to use of charCodeAt()
+
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): Changed the implementation of charAt
+        and charCodeAt to treat a missing parameter as an index of 0, rather than an invalid index.
+
+        * tests/mozilla/expected.html: Update for two tests that now pass with these changes.
+
+=== Safari-165 ===
+
+=== Safari-164 ===
+
+2004-09-14  Richard Williamson   <rjw@apple.com>
+
+        1.  Add class parameter to object allocation function.  This is somewhat redundant, given that
+        the allocation function is in the class function vector, but people wanted to use the same
+        allocation function for different classes.
+        
+        2.  Renamed NPN_Class to NPN_Invoke to match the name in the function vector.
+        
+        3.  Add support for a default function on an object.  This is a feature that ActiveX supports,
+        and will allow JavaScript code to be written that will look exactly the same for both ActiveX
+        plugins and Netscape or WebKit plugins.  There are implementations included for the 'C' and
+        'Objective-C' bindings.
+        
+        There bugs are covered by
+        
+        <rdar://problem/3776343> Support for default functions in the JavaScript bindings
+        <rdar://problem/3779186> NPN_Call needs to be renamed to NPN_Invoke
+        <rdar://problem/3674754> Need to implement latest npruntime.h
+
+        Reviewed by John.
+
+        * bindings/NP_jsobject.cpp:
+        (jsAllocate):
+        (NPN_InvokeDefault):
+        (NPN_Invoke):
+        * bindings/c/c_class.cpp:
+        * bindings/c/c_instance.cpp:
+        (CInstance::CInstance):
+        (CInstance::operator=):
+        (CInstance::invokeMethod):
+        (CInstance::invokeDefaultMethod):
+        * bindings/c/c_instance.h:
+        * bindings/c/c_runtime.cpp:
+        * bindings/c/c_runtime.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeDefaultMethod):
+        * bindings/jni/jni_instance.h:
+        * bindings/npruntime.cpp:
+        (NPN_CreateObject):
+        * bindings/npruntime.h:
+        * bindings/objc/WebScriptObject.h:
+        * bindings/objc/objc_class.mm:
+        (ObjcClass::fallbackObject):
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeDefaultMethod):
+        * bindings/objc/objc_runtime.h:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        (ObjcFallbackObjectImp::get):
+        (ObjcFallbackObjectImp::put):
+        (ObjcFallbackObjectImp::canPut):
+        (ObjcFallbackObjectImp::implementsCall):
+        (ObjcFallbackObjectImp::call):
+        (ObjcFallbackObjectImp::hasProperty):
+        (ObjcFallbackObjectImp::deleteProperty):
+        (ObjcFallbackObjectImp::defaultValue):
+        * bindings/runtime.h:
+        (KJS::Bindings::Class::fallbackObject):
+        (KJS::Bindings::Instance::getValueOfUndefinedField):
+        (KJS::Bindings::Instance::setValueOfUndefinedField):
+        (KJS::Bindings::Instance::valueOf):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::implementsCall):
+        (RuntimeObjectImp::call):
+        * bindings/runtime_object.h:
+
+2004-09-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/3794735> Gmail- sending a very long message with Safari is so slow it seems like a hang
+        
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): Replaced implementation of replace()
+        method with function below...
+        (replace): In order to avoid excessive allocation and copying,
+        figure out the ranges of the original string and replacement
+        strings to be assembled, instead of constantly creating new
+        strings at each substitution. The old behavior is basically O(N^2)
+        for a global replace on a pattern that matches many places in the
+        string.
+        (regExpIsGlobal): Helper function for the above.
+        (expandSourceRanges): ditto
+        (pushSourceRange): ditto
+        (expandReplacements): ditto
+        (pushReplacement): ditto
+        * kjs/ustring.cpp:
+        (KJS::UString::spliceSubstringsWithSeparators): New method that
+        pieces together substring ranges of this string together with
+        specified separators, all at one go.
+        * kjs/ustring.h:
+        (KJS::UString::Range::Range): Added new helper class to represent
+        substring choices.
+
+2004-09-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - fixed <rdar://problem/3800315> encode-URI-test layout test is failing
+        
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::call): Make sure to escape null
+        characters. This is a bug in the new code that made part of the
+        test fail.
+
+2004-09-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin and Maciej.
+
+        - new function to support fix for DIG bug in WebCore
+
+        * kjs/scope_chain.h: Added new push function that pushes another entire scope chain.
+        * kjs/scope_chain.cpp: (KJS::ScopeChain::push): Ditto.
+
+2004-09-12  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/expected.html: Updated test results for 3 more tests that pass with the new version
+        of escape and unescape.
+
+2004-09-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed <rdar://problem/3798209> any non-ASCII characters are garbled in the result of toLocaleString
+
+        * kjs/date_object.cpp:
+        (formatLocaleDate): Replaced two old functions that used LongDateTime with this one new function that
+        uses CFDateFormatter.
+        (DateProtoFuncImp::call): Call the new formatLocaleDate instead of both formatLocaleDate and formatLocaleTime.
+
+2004-09-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Richard.
+
+        <rdar://problem/3493140> REGRESSION (85-100): cedille displays %-escaped in JavaScript message at hotmail.com
+
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::call): Replace our escape() and unescape() implementations with
+        ones from KDE KJS, which have the proper latin-1 behavior to match Win IE.
+        * kjs/lexer.cpp:
+        (Lexer::isHexDigit): Made static and non-const.
+        * kjs/lexer.h:
+
+=== Safari-163 ===
+
+2004-09-06  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj: Bump MACOSX_DEPLOYMENT_TARGET to 10.3.
+
+=== Safari-162 ===
+
+2004-09-01  Richard Williamson   <rjw@apple.com>
+
+        Add pid to exception messages (to help debug dashboard clients).
+
+        Reviewed by Chris.
+
+        * kjs/interpreter.cpp:
+        (Interpreter::evaluate):
+
+=== Safari-161 ===
+
+2004-08-20  Richard Williamson   <rjw@apple.com>
+
+        Implemented new JNI abstraction.  We no longer invoke Java methods
+        directly with JNI, rather we call into the plugin.  This allows the
+        plugin to dispatch the call to the appropriate VM thread.  This
+        change should (will?) fix a whole class of threading related problems with
+        the Java VM.
+
+        Reviewed by Hyatt.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/c/c_instance.h:
+        (KJS::Bindings::CInstance::setExecutionContext):
+        (KJS::Bindings::CInstance::executionContext):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::JavaInstance):
+        (JavaInstance::invokeMethod):
+        (JavaInstance::setExecutionContext):
+        (JavaInstance::executionContext):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::convertJObjectToValue):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::JavaField):
+        (JavaArray::convertJObjectToArray):
+        (JavaField::valueFromInstance):
+        (JavaArray::JavaArray):
+        (JavaArray::valueAt):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaArray::operator=):
+        (KJS::Bindings::JavaArray::executionContext):
+        * bindings/jni/jni_utility.h:
+        * bindings/objc/objc_instance.h:
+        (KJS::Bindings::ObjcInstance::setExecutionContext):
+        (KJS::Bindings::ObjcInstance::executionContext):
+        * bindings/runtime.cpp:
+        (Instance::createBindingForLanguageInstance):
+        * bindings/runtime.h:
+        * bindings/runtime_root.h:
+        (KJS::Bindings::RootObject::nativeHandle):
+
+=== Safari-158 ===
+
+2004-08-19  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by John.
+
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::put): initialize deletedElementIndex to zero, to make the compiler happy
+
+2004-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele.
+
+        - fixed <rdar://problem/3746676> SAP WebDynpro app hangs inside JavaScript property map hash table code (deleted sentinel problem)
+
+        * kjs/property_map.h: Added some private functions.
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::clear): Set sentinelCount to 0.
+        (KJS::PropertyMap::put): Complete search for the element before choosing to use the deleted-element sentinel.
+        Also keep sentinel count up to date when we destroy a sentinel by overwriting with a new added element.
+        (KJS::PropertyMap::expand): Added. Calls rehash with a size 2x the old size, or 16.
+        (KJS::PropertyMap::rehash): Added. Refactored the rehash code into a separate function.
+        (KJS::PropertyMap::remove): Add one to sentinelCount, and rehash if 1/4 or more of the elements are
+        deleted-element sentinels.
+        (KJS::PropertyMap::checkConsistency): Check the sentinelCount.
+
+2004-08-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Code change by Eric Albert, reviewd by me.
+
+        <rdar://problem/3571960> washingtonpost.com claims I don't have cookies enabled and won't let me read articles
+
+        * kjs/date_object.cpp:
+        (timetUsingCF): Clamp time to LONG_MAX (getting rid of time_t
+        entirely would be even better, but is not required to fix this bug.
+
+=== Safari-157 ===
+
+2004-08-16  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3581092> cash in KJS::Bindings::JSObject::eval at tcvetantcvetkov.com
+
+        Adds bullet proofing to protect against evaluation of bogus JS in all the flavors of bindings (Java, C, and ObjC).
+
+        Reviewed by Chris.
+
+        * bindings/NP_jsobject.cpp:
+        (NPN_Evaluate):
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::eval):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject evaluateWebScript:]):
+
+2004-08-15  Richard Williamson   <rjw@apple.com>
+
+        More updates to np headers.  Implemented new NPN functions.
+
+        Reviewed by Darin.
+
+        * bindings/NP_jsobject.cpp:
+        (NPN_HasProperty):
+        (NPN_HasMethod):
+        * bindings/npapi.h:
+        * bindings/npruntime.h:
+
+2004-08-13  Darin Adler  <darin@apple.com>
+
+        - fix build so we can compile again
+
+        * bindings/npapi.h: Added. Richard forgot to check this in. The one I'm checking in here
+        is good enough so that we can compile, but it's only a stopgap measure, because I think
+        Richard has a newer one he wants to check in.
+
+2004-08-12  Richard Williamson   <rjw@apple.com>
+
+        Bring npruntime.h and friends closer to compliance with
+        latest spec.
+
+        Reviewed by Maciej.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_jsobject.cpp:
+        (jsAllocate):
+        (_NPN_CreateScriptObject):
+        (NPN_Call):
+        (NPN_Evaluate):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        * bindings/NP_jsobject.h:
+        * bindings/c/c_instance.cpp:
+        (CInstance::invokeMethod):
+        * bindings/c/c_utility.cpp:
+        (convertNPVariantToValue):
+        * bindings/npruntime.cpp:
+        (NPN_IdentifierIsString):
+        (NPN_VariantIsVoid):
+        (NPN_VariantIsNull):
+        (NPN_VariantIsUndefined):
+        (NPN_VariantIsBool):
+        (NPN_VariantIsInt32):
+        (NPN_VariantIsDouble):
+        (NPN_VariantIsString):
+        (NPN_VariantIsObject):
+        (NPN_VariantToBool):
+        (NPN_VariantToString):
+        (NPN_VariantToInt32):
+        (NPN_VariantToDouble):
+        (NPN_VariantToObject):
+        (NPN_InitializeVariantAsVoid):
+        (NPN_InitializeVariantAsNull):
+        (NPN_InitializeVariantAsUndefined):
+        (NPN_InitializeVariantWithBool):
+        (NPN_InitializeVariantWithInt32):
+        (NPN_InitializeVariantWithDouble):
+        (NPN_InitializeVariantWithString):
+        (NPN_InitializeVariantWithStringCopy):
+        (NPN_InitializeVariantWithObject):
+        (NPN_InitializeVariantWithVariant):
+        (NPN_ReleaseVariantValue):
+        (NPN_CreateObject):
+        * bindings/npruntime.h:
+        (_NPString::):
+        (_NPString::_NPVariant::):
+        * bindings/npruntime_priv.h: Added.
+
+2004-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele.
+
+        - fixed 3 problems with parse functions that I just wrote, fixing 3 more Mozilla JavaScript tests
+
+        * kjs/function.cpp:
+        (KJS::parseDigit): Fix typo, 'Z' instead of 'z', that prevented lowercase hex digits from working.
+        (KJS::parseInt): Add octal support. Specification says it's optional, but I guess not.
+        (KJS::parseFloat): Fix check for "0x" in parseFloat to return 0 rather than NaN. Also add code
+        to skip leading "+" or "-".
+
+=== Safari-156 ===
+
+2004-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        - fixed 43 Mozilla JavaScript tests
+
+        * kjs/date_object.h: Change parseDate and timeClip to take and return doubles.
+        * kjs/date_object.cpp:
+        (DateObjectImp::construct): Change to use a timeClip function that takes and returns a double rather
+        than constructing a number object to pass to it.
+        (DateObjectFuncImp::call): Change to use a parseDate function that returns a double.
+        (KJS::parseDate): Change to return a double instead of creating the Number object here.
+        (KJS::timeClip): Implement this as specified in the language standard.
+
+        * kjs/error_object.cpp: (NativeErrorImp::NativeErrorImp): Set the DontDelete, ReadOnly, and DontEnum
+        flags on the prototype property.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::get): Return null rather than undefined for arguments when the function is not
+        currently in scope.
+        (KJS::isStrWhiteSpace): Added. Matches specification for StrWhiteSpace. Could move it to some utility
+        file later.
+        (KJS::parseDigit): Added. Helper function for parseInt.
+        (KJS::parseInt): Added. Integer parser that puts result in a double so we're not limited to what
+        strtoll can handle. Also matches standard more closely.
+        (KJS::parseFloat): Added. Handles "0x" properly and passes flag to make empty string turn into NaN
+        instead of 0.
+        (KJS::GlobalFuncImp::call): Use the new parseInt and parseFloat.
+
+        * kjs/function_object.cpp: (FunctionPrototypeImp::FunctionPrototypeImp): Add a length property.
+
+        * kjs/lexer.h: Added error flag and sawError() function for detecting errors.
+        * kjs/lexer.cpp:
+        (Lexer::setCode): Clear error state.
+        (Lexer::lex): Set error state if the lexer encounters an error
+
+        * kjs/internal.cpp:
+        (NumberImp::toString): Roll in change from KDE version to special case 0 so we handle -0 correctly.
+        (Parser::parse): Use new lexer error method so those errors are treated like parser errors.
+
+        * kjs/math_object.cpp: (MathFuncImp::call): Change min and max to treat -0 as less than +0.
+        Change round to round values between -0.5 and -0 to -0 instead of +0.
+
+        * kjs/nodes.h: Add evaluateReference function to GroupNode.
+        * kjs/nodes.cpp: (GroupNode::evaluateReference): Pass references through groups (parenthesized
+        expressions) properly so that expressions like "delete (x.y)" work. Before, the parentheses
+        would change x.y into a value that can't be deleted as a side effect.
+
+        * kjs/string_object.cpp: Change parameter count for indexOf and lastIndexOf from 2 to 1 to match
+        the specification.
+
+        * kjs/testkjs.cpp: Rolled in changes from KDE to add a "quit" function to the test tool and
+        get rid of the fixed size limit for code.
+
+        * kjs/ustring.cpp: (KJS::UString::substr): Added optimized case for substr(0, length) so it just
+        returns the string without creating a new Rep, since I'm using substr in a place where it will
+        often be passed a 0.
+
+        * tests/mozilla/ecma/String/15.5.4.11-1.js: Fixed one wrong entry in the Unicode table I added to
+        the other day that was making a couple tests fail.
+        * tests/mozilla/ecma/String/15.5.4.12-1.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-2.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-3.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-4.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-5.js: Ditto.
+
+        * kjs/string_object.lut.h: Regenerated.
+
+2004-08-11  Darin Adler  <darin@apple.com>
+
+        - fixed a tiny problem with the UTF-16 PCRE check-in
+
+        * pcre/maketables.c: (pcre_maketables): Fix mistake in table-generating code that sometimes caused
+        the ctype_meta flag to get set in items that should not have it.
+
+        * pcre/chartables.c: Regenerated.
+
+2004-08-10  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3674747> Need to implement invokeUndefinedMethodFromWebScript:withArguments:
+
+        The following WebScripting methods are now supported on bound
+        objects:
+
+        - (id)invokeUndefinedMethodFromWebScript:(NSString *)name withArguments:(NSArray *)args;
+        - (void)setValue:(id)value forUndefinedKey:(NSString *)key
+        - (id)valueForUndefinedKey:(NSString *)key
+
+        Reviewed by Chris.
+
+        * bindings/c/c_class.cpp:
+        (CClass::fieldNamed):
+        * bindings/c/c_class.h:
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::fieldNamed):
+        * bindings/jni/jni_class.h:
+        * bindings/objc/objc_class.h:
+        (KJS::Bindings::ObjcClass::isa):
+        * bindings/objc/objc_class.mm:
+        (ObjcClass::methodsNamed):
+        (ObjcClass::fieldNamed):
+        (ObjcClass::fallbackObject):
+        * bindings/objc/objc_instance.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::setValueOfField):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bindings/objc/objc_runtime.h:
+        (KJS::Bindings::ObjcField::~ObjcField):
+        (KJS::Bindings::ObjcField::ObjcField):
+        (KJS::Bindings::ObjcField::operator=):
+        (KJS::Bindings::FallbackObjectImp::classInfo):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::ObjcField):
+        (ObjcField::name):
+        (ObjcField::type):
+        (ObjcField::valueFromInstance):
+        (ObjcField::setValueToInstance):
+        (FallbackObjectImp::FallbackObjectImp):
+        (FallbackObjectImp::get):
+        (FallbackObjectImp::put):
+        (FallbackObjectImp::canPut):
+        (FallbackObjectImp::implementsCall):
+        (FallbackObjectImp::call):
+        (FallbackObjectImp::hasProperty):
+        (FallbackObjectImp::deleteProperty):
+        (FallbackObjectImp::defaultValue):
+        * bindings/runtime.h:
+        (KJS::Bindings::Class::fallbackObject):
+        (KJS::Bindings::Instance::getValueOfUndefinedField):
+        (KJS::Bindings::Instance::setValueOfUndefinedField):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+        (RuntimeObjectImp::hasProperty):
+        * bindings/testbindings.mm:
+        (-[MyFirstInterface valueForUndefinedKey:]):
+        (-[MyFirstInterface setValue:forUndefinedKey:]):
+
+2004-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        - switch PCRE to do UTF-16 directly instead of converting to/from UTF-8 for speed
+
+        * pcre/pcre.h: Added PCRE_UTF16 switch, set to 1. Added pcre_char typedef, which is char
+        or uint16_t depending on the mode, and used appropriate in the 7 public functions
+        that need to use it.
+        * pcre/pcre.c: Add UTF-16 support to all functions.
+        * pcre/study.c: Ditto.
+
+        * pcre/internal.h: Added ichar typedef, which is unsigned char or uint16_t depending on
+        the mode. Changed declarations to use symbolic constants and typedefs so we size
+        things to ichar when needed.
+
+        * pcre/maketables.c: (pcre_maketables): Change code to make tables that are
+        sized to 16-bit characters instead of 8-bit.
+
+        * pcre/get.c:
+        (pcre_copy_substring): Use pcre_char instead of char.
+        (pcre_get_substring_list): Ditto.
+        (pcre_free_substring_list): Ditto.
+        (pcre_get_substring): Ditto.
+        (pcre_free_substring): Ditto.
+
+        * pcre/dftables.c: (main): Used a bit more const, and use ICHAR sizes instead
+        of hard-coding 8-bit table sizes.
+
+        * pcre/chartables.c: Regenerated.
+
+        * kjs/ustring.h: Remove functions that convert UTF-16 to/from UTF-8 offsets.
+        * kjs/ustring.cpp: Change the shared empty string to have a unicode pointer that
+        is not null. The null string still has a null pointer. This prevents us from
+        passing a null through to the regular expression engine (which results in a null
+        error even when the string length is 0).
+
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Null-terminate the pattern and pass it.
+        (KJS::RegExp::match): Use the 16-bit string directly, no need to convert to UTF-8.
+
+2004-08-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed 28 Mozilla JavaScript tests
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::call): Check for undefined rather than
+        checking the number of arguments for the join method.
+
+        * kjs/lexer.cpp: (Lexer::lex): Parse hexadecimal and octal constants in doubles rather
+        than integers, so we aren't limited to 32 bits.
+
+        * kjs/math_object.cpp: (MathFuncImp::call): Get rid of many unneeded special cases in
+        the implementation of the pow operation. Also simplied a case that was handling positive
+        and negative infinity separately.
+
+        * kjs/nodes.cpp: (ShiftNode::evaluate): Keep the result of shifts in a double instead of
+        putting them in a long, so that unsigned shift will work properly.
+
+        * kjs/number_object.cpp: Add the DontDelete and ReadOnly flags to the numeric constants.
+
+        * kjs/operations.cpp:
+        (KJS::isPosInf): Added an implementation inside APPLE_CHANGES that does not depend on the
+        sign of isinf; our isinf function returns +1 even for negative infinity.
+        (KJS::isNegInf): And again.
+        (KJS::relation): Put in a nice simple implementation of comparison inside APPLE_CHANGES.
+        Our floating point already handles the various infinity cases correctly.
+
+        * kjs/regexp_object.cpp:
+        (RegExpProtoFuncImp::call): Add missing return before Null() in Exec method.
+        (RegExpObjectImp::arrayOfMatches): Put undefined rather than an empty string into the
+        array in cases where we did not match.
+        (RegExpObjectImp::construct): Set the DontDelete, ReadOnly, and DontEnum flags for
+        "global", "ignoreCase", "multiline", and "source".
+
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): For the match method, turn a null
+        string into undefined rather than an empty string. For the slice method, handle an
+        undefined parameter for the limit properly as decribed in the specification, and add
+        the limit to one case that didn't have the limit at all. For the methods that generate
+        HTML strings, use lowercase tags instead of uppercase.
+
+        * kjs/ustring.cpp:
+        (KJS::UChar::toLower): Use u_tolower from the ICU library.
+        (KJS::UChar::toUpper): Use u_toupper from the ICU library.
+        (KJS::UString::append): Fix some math that caused a buffer overflow.
+        (KJS::convertUTF16OffsetsToUTF8Offsets): Ignore negative numbers (-1 is used as a special
+        flag) rather than converting them all to 0.
+        (KJS::convertUTF8OffsetsToUTF16Offsets): Ditto.
+
+        * tests/mozilla/jsDriver.pl: Fixed the relative links to point to our actual test files.
+
+        * tests/mozilla/ecma/String/15.5.4.11-1.js: Fixed the Unicode table in this test to match
+        the Unicode specification in a few cases where it was wrong before.
+        * tests/mozilla/ecma/String/15.5.4.11-2.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.11-3.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.11-5.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.11-6.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-1.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-2.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-3.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-4.js: Ditto.
+        * tests/mozilla/ecma/String/15.5.4.12-5.js: Ditto.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Link to libicu.
+
+        * kjs/number_object.lut.h: Regenerated.
+
+2004-08-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed <rdar://problem/3753467> REGRESSION (137-138): reproducible buffer overrun in UString manipulation code
+
+        * kjs/ustring.cpp: (KJS::UString::append): Fix incorrect size computation. Without it
+        we get a buffer overflow.
+
+=== Safari-155 ===
+
+2004-08-05  Richard Williamson   <rjw@apple.com>
+
+        Fixed part of 3674747.  The QT guys need this for feature freeze.
+
+        This patch implements support for the
+
+        - (id)invokeUndefinedMethodFromWebScript:(NSString *)name withArguments:(NSArray *)args
+
+        method of objects bound to JavaScript.
+
+        Reviewed by John.
+
+        * ChangeLog:
+        * bindings/objc/objc_class.mm:
+        (ObjcClass::methodsNamed):
+        (ObjcClass::fieldNamed):
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        * bindings/objc/objc_runtime.h:
+        (KJS::Bindings::ObjcMethod::~ObjcMethod):
+        (KJS::Bindings::ObjcMethod::isFallbackMethod):
+        (KJS::Bindings::ObjcMethod::javaScriptName):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcMethod::ObjcMethod):
+        (ObjcMethod::getMethodSignature):
+        (ObjcMethod::setJavaScriptName):
+        * bindings/testbindings.mm:
+
+2004-08-04  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by mjs.
+ 
+        - fix <rdar://problem/3649789> SAP WebGUI has problems loading first page because of parse error        
+
+        * kjs/lexer.cpp:
+        (Lexer::lex): if the current character is a '\' and the next character is a line terminator,
+        go to the next line and continue parsing the string (instead of failing).  This matches 
+        behavior in Mac IE and Mozilla.
+
+2004-08-03  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Darin.
+
+        Rolled in changes from the latest KJS sources that support additional 
+        Number.prototype functions. 
+
+        Specifically this patch covers the follow parts of the ECMA 3 spec:
+        15.7.4.5, 15.7.4.6, and 15.7.4.7 
+        
+        Fixes:
+        <rdar://problem/3663716> missing Number.toFixed (and toPrecision, toExponential)
+        <rdar://problem/3749492> missing Number.toPrecision prototype implementation
+        <rdar://problem/3749591> missing Number.toExponential prototype implementation
+
+        * kjs/identifier.h: Added toFixed, toPrecision, and toExponential to the
+        list of supported identifiers (a macro).
+        * kjs/number_object.cpp: Implemented support for toFixed(), toPrecision(),
+        and toExponential(). 
+        (NumberPrototypeImp::NumberPrototypeImp):
+        (NumberProtoFuncImp::call):
+        * kjs/number_object.h: Added property names for toFixed, toPrecision,
+        and toExponential. 
+        (KJS::NumberProtoFuncImp::):
+        * tests/mozilla/expected.html: Update results.
+
+2004-08-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        - added support for copying RegExp objects so 7 more Mozilla regexp tests pass
+
+        * kjs/regexp_object.cpp: (RegExpObjectImp::construct): Check for case where
+        we are supposed to just copy the regular expression object, and do so.
+        Also tighten up arguments check to handle case where an actual "undefined"
+        is passed rather than just omitting an argument.
+
+        * tests/mozilla/expected.html: Update results.
+
+2004-08-02  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/.cvsignore: Added.
+        * tests/mozilla/expected.html: Update results.
+
+2004-08-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        - fixed RegExp.toString so 3 more Mozilla regexp tests pass
+
+        * kjs/regexp_object.cpp: (RegExpProtoFuncImp::call):
+        Append the flags here so more tests paseed.
+
+2004-08-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        - fixed a couple things making 5 Mozilla regexp tests pass
+
+        * kjs/regexp_object.cpp: (RegExpProtoFuncImp::call): Implement toString
+        for the prototype.
+        (RegExpObjectImp::construct): Fix bug where the string "undefined" would
+        be used as the flags string when no parameter was passed.
+
+        * kjs/regexp_object.h: (KJS::RegExpPrototypeImp::classInfo):
+        Added a class info object for RegExp prototype so it can return
+        a string instead of raising an exception when converting to a string.
+
+        * tests/mozilla/expected.html: Update results.
+
+2004-08-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin.
+
+        - fix crashes in mozilla tests due to mishandling NaN
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::call): Rerranged range checks after
+        calls to toInteger so that NaN will get turned into something that fits in an integer.
+        These were the ones John already fixed, but his fix used isnan and the new fix is
+        more efficient.
+
+        * kjs/number_object.cpp: (NumberProtoFuncImp::call): Rearranged radix range checks
+        after a call to toInteger to handle NaN properly. Also removed separate check
+        for undefined that's not needed.
+
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): More of the same kinds of changes
+        as in the above two files, but for a lot more functions. Also changed one place with
+        an explicit check for undefined to instead just check isNaN.
+
+        * tests/mozilla/run-mozilla-tests: Changed to invoke jst using $SYMROOTS for people
+        like me who don't keep $SYMROOTS in their $PATH.
+
+=== Safari-154 ===
+
+=== Safari-153 ===
+
+2004-07-26  Kevin Decker  <kdecker@apple.com>
+
+        Changes done by Darin, reviewed by Kevin.
+
+        - changed testkjs to build in Xcode rather than from Makefile
+
+        * .cvsignore: Removed obsolete files from this list.
+        * Makefile.am: Removed code to build testkjs; we do this in Xcode now.
+        Changed to build target "All" rather than default target. This makes us
+        build the testkjs test tool.
+        * dummy.cpp: Removed.
+        * kjs/.cvsignore: Removed obsolete files from this list, including
+        the testkjs tool, which is now built in the symroots directory.
+        * kjs/testkjs.cpp: Added copyright notice that was missing, since we have
+        changed this file. Also this has the nice side effect of causing the tool
+        to be rebuilt in the new location even if there are no other changes in
+        your tree when you check this out.
+        * tests/mozilla/run-mozilla-tests: Invoke perl explicitly so this works
+        without setting the execute bit on jsDriver.pl.
+
+2004-07-22  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Darin
+        
+        Fixed <rdar://problem/3682340> (error console does not include source urls or line numbers of event exceptions). 
+
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/function_object.h:
+        * kjs/object.cpp:
+        (KJS::ObjectImp::construct):
+        * kjs/object.h:
+        (KJS::Object::construct):
+
+2004-07-21  Darin Adler  <darin@apple.com>
+
+        * bindings/npruntime.h: Fixed typo.
+
+2004-07-19  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Maciej.
+        
+        - bulletproofed array.slice() against NAN arguments. Harri noticed this
+        vulnerability in my patch for 3714644
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFuncImp::call):
+        handle NAN parameters passed to slice() by clamping to 0 and length.
+
+2004-07-19  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3733349.  Prevent Java applet callbacks into JavaScript after applet
+        has been destroyed.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::invoke):
+        (JSObject::JSObject):
+
+2004-07-16  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Maciej.
+        
+        - fixed <rdar://problem/3714644> REGRESSION (125.8-146): bugzilla submit link 
+        hangs browser with javascript
+
+        * kjs/array_object.cpp:
+        (ArrayProtoFuncImp::call):
+        Check for undefined type for args[0] the same way we were already checking
+        for args[1]. In this case, args was zero-length, but we were treating
+        args[0] like an integer anyway. Resulted in some code looping from a NAN
+        value to 4, taking approximately forever.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        version wars
+        
+=== Safari-152 ===
+
+2004-07-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        <rdar://problem/3711474>: (REGRESSION (125-146): JavaScript 'toString(16)' is broken)
+        <rdar://problem/3644873>: (REGRESSION (125-140u): secondary list doesn't fill in at Southwest.com)
+
+        * kjs/number_object.cpp:
+        (NumberProtoFuncImp::call): Initialize radix from dradix, not from itself!
+
+2004-07-13  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by kocienda.
+
+        - made testkjs and JavaScriptCore a subtarget of 'All'
+        - testkjs now builds in $SYMROOTS
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+=== Safari-151 ===
+
+2004-06-24  Chris Blumenberg  <cblu@apple.com>
+
+        Ignore .mode1 files in JavaScriptCore.pbproj
+
+        Reviewed by kocienda.
+
+        * JavaScriptCore.pbproj/.cvsignore:
+
+2004-06-23  Richard Williamson   <rjw@apple.com>
+
+        Implemented changes for latest npruntime.h.
+        
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_jsobject.cpp:
+        (listFromVariantArgs):
+        (identiferFromNPIdentifier):
+        (_NPN_CreateScriptObject):
+        (NPN_Call):
+        (NPN_Evaluate):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        * bindings/NP_jsobject.h:
+        * bindings/c/c_class.cpp:
+        (CClass::methodsNamed):
+        (CClass::fieldNamed):
+        * bindings/c/c_instance.cpp:
+        (CInstance::invokeMethod):
+        * bindings/c/c_utility.cpp:
+        (convertNPVariantToValue):
+        * bindings/c/c_utility.h:
+        * bindings/npruntime.cpp:
+        (stringIdentifierEqual):
+        (stringIdentifierHash):
+        (getStringIdentifierDictionary):
+        (intIdentifierEqual):
+        (intIdentifierHash):
+        (getIntIdentifierDictionary):
+        (NPN_GetStringIdentifier):
+        (NPN_GetStringIdentifiers):
+        (NPN_GetIntIdentifier):
+        (NPN_IdentifierIsString):
+        (NPN_UTF8FromIdentifier):
+        (NPN_VariantToInt32):
+        (NPN_VariantToDouble):
+        (NPN_SetException):
+        * bindings/npruntime.h:
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:KJS::root:Bindings::]):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::~RuntimeObjectImp):
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::rootForInterpreter):
+        * bindings/testbindings.cpp:
+        (initializeIdentifiers):
+        (logMessage):
+        (setDoubleValue):
+        (setIntValue):
+        (setBooleanValue):
+
+=== JavaScriptCore-146.1 ===
+
+2004-06-16  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3702287> Crash returning nil from bound ObjC
+
+        This turned out to be a show stopper for Dashboard.  Accessing a nil
+        ObjC property from JS caused a crash.  Similar to the problem
+        3696112 fixed below.
+        
+        Reviewed by Trey.
+
+        * bindings/objc/objc_runtime.mm:
+        (KJS::Bindings::ObjcField::valueFromInstance):
+
+=== Safari-146 ===
+
+2004-06-16  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3696112>: nil from an Objective-C class seems to get wrapped as a JavaScript proxy that will not print.
+
+        This turned out to be a show stopper for Dashboard.  We now
+        return Undefined() when nil is returned from a ObjC method
+        that returns an object type.
+        
+        Reviewed by Maciej.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertObjcValueToValue):
+
+=== Safari-145 ===
+
+2004-06-15  Richard Williamson   <rjw@apple.com>
+
+        Fixed <rdar://problem/3695875>: Objective-C instances that are exported to JavaScript are too promiscuous
+
+        No longer need to check respondsToSelector: for
+        isSelectorExcludedFromWebScript: and isKeyExcludedFromWebScript:
+        because these now have a default implementation on NSObject.
+
+        Reviewed by Trey.
+
+        * bindings/objc/objc_class.mm:
+        (ObjcClass::methodsNamed):
+        (ObjcClass::fieldNamed):
+
+2004-06-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed some things for GC that Patrick missed, or that happened after the branch
+
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject dealloc]): Moved removeNativeReference call here from private object.
+        (-[WebScriptObject finalize]): Added.
+
+        - added some missing nil checks
+
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance): Check for nil.
+        (ObjcInstance::~ObjcInstance): Check for nil.
+        (ObjcInstance::operator=): Check for nil.
+
+2004-06-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by me, code changes by Patrick Beard.
+
+        - fixed <rdar://problem/3671507>: (WebKit should adopt GC changes and compile with GC enabled)
+
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance): Use CFRetain instead of retain.
+        (ObjcInstance::~ObjcInstance): Use CFRelease instead of release.
+        (ObjcInstance::operator=): More of the same.
+        (ObjcInstance::end): Use [pool drain] if compiling on Tiger.
+
+        * bindings/objc/objc_runtime.mm:
+        (ObjcArray::ObjcArray): Use CFRetain instead of retain.
+        (ObjcArray::~ObjcArray): Use CFRelease instead of release.
+        (ObjcArray::operator=): More of the same.
+
+        * bindings/testbindings.mm: Fixed incorrect license.
+        (main): Use [pool drain] if compiling on Tiger.
+
+=== Safari-144 ===
+
+2004-06-10  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by John.
+
+        * kjs/lexer.cpp: 
+        (Lexer::setCode):
+            - fixed <rdar://problem/3682398>: (error console line numbers are offset by 1)
+        * kjs/lexer.h:
+        (KJS::Lexer::lineNo):
+            - fixed <rdar://problem/3682398>: (error console line numbers are offset by 1)
+
+=== JavaScriptCore-143.2 ===
+
+2004-06-07  Darin Adler  <darin@apple.com>
+
+        - fixed <rdar://problem/3682489>: (JavaScriptGlue no longer compiles because Interpreter::evaluate parameters changed)
+
+        * kjs/interpreter.h: Added an overload to make JavaScriptGlue compile.
+        * kjs/interpreter.cpp: (KJS::Interpreter::evaluate): Implemented the overload.
+
+=== JavaScriptCore-143.1 ===
+
+2004-06-04  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Darin
+        
+        - fixed <rdar://problem/3680594>
+
+        * kjs/object.cpp:
+        (KJS::Error::create):
+
+=== Safari-143 ===
+
+2004-06-04  Darin Adler  <darin@apple.com>
+
+        * kjs/testkjs.cpp: (main): Fix build breakage by adding URL and line number parameters.
+
+2004-06-04  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Dave.
+
+        - ObjC bindings do not (yet) pass along sourceurl or line numbers
+        - we don't have a way as of yet to accomidate line numbers and urls for dynamic javascript
+        - changed the wording of an error message
+        - the lexer, parser, and interpreter have been made "sourceURL aware"
+        - stored the url into Error
+         
+        * bindings/NP_jsobject.cpp:
+        (NPN_Evaluate):
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::eval):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject evaluateWebScript:]):
+        * kjs/function.cpp:
+        (GlobalFuncImp::call):
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/internal.cpp:
+        (Parser::parse):
+        (InterpreterImp::checkSyntax):
+        (InterpreterImp::evaluate):
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        (Interpreter::evaluate):
+        * kjs/interpreter.h:
+        * kjs/lexer.cpp:
+        (Lexer::setCode):
+        * kjs/lexer.h:
+        (KJS::Lexer::sourceURL):
+        * kjs/nodes.cpp:
+        (Node::Node):
+        (Node::throwError):
+        (FunctionCallNode::evaluate):
+        * kjs/nodes.h:
+        * kjs/object.cpp:
+        (KJS::Error::create):
+        * kjs/object.h:
+
+2004-06-04  Richard Williamson   <rjw@apple.com>
+
+        Fixed crash when attempting to access properties on nil
+        object.
+        
+        Reviewed by John.
+
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::getClass):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        * bindings/testM.js:
+        * bindings/testbindings.mm:
+        (-[MyFirstInterface getString]):
+
+2004-05-27  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Ken.
+
+        -revised generated error message content
+        
+        * kjs/error_object.cpp:
+        (ErrorProtoFuncImp::call):
+        * kjs/internal.cpp:
+        (Parser::parse):
+        * kjs/object.cpp:
+        (KJS::Error::create):
+
+=== Safari-142 ===
+
+2004-05-27  Richard Williamson   <rjw@apple.com>
+
+        Renamed WebScriptMethods to WebScripting based on feedback from Nancy.
+
+        Reviewed by Chris.
+
+        * bindings/objc/WebScriptObject.h:
+
+2004-05-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - moved to new symlink technique for embedding frameworks
+
+        * JavaScriptCore.pbproj/project.pbxproj: Get rid of embed-frameworks build step
+        because we don't need it any more.
+
+2004-05-24  Richard Williamson   <rjw@apple.com>
+
+        Changed RuntimeArrayImp to inherit from ArrayInstanceImp and
+        fixed ClassInfo to correctly reflect inheritance.  This is required
+        because of the runtime checks in JSC for arrays, i.e. in
+        the Function objects apply method.
+
+        Reviewed by Ken.
+
+        * bindings/jni/jni_runtime.cpp:
+        (JavaArray::convertJObjectToArray):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::RuntimeArrayImp):
+        * bindings/runtime_array.h:
+        * bindings/testM.js: Added.
+        * bindings/testbindings.mm:
+        (+[MyFirstInterface webScriptNameForSelector:]):
+        (-[MyFirstInterface logMessages:]):
+        (-[MyFirstInterface logMessage:prefix:]):
+        (-[MyFirstInterface callJSObject::]):
+
+2004-05-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed <rdar://problem/3664260>: (JS needs to listen to timezone change notifications)
+
+        * kjs/date_object.cpp: (CopyLocalTimeZone): As per Chris Kane and Jordan Hubbard, use <notify.h>
+        with a hardcoded string of "com.apple.system.timezone", and do CFTimeZoneResetSystem since
+        CoreFoundation doesn't do this itself. Turns out this affects the default time zone as long as
+        it hasn't been set explicitly.
+
+=== Safari-141 ===
+
+2004-05-20  Richard Williamson   <rjw@apple.com>
+
+        Implemented WebScriptObject/DOM wrapper voodoo.  DOM wrappers
+        can now be referenced like any other WebScriptObject, meaning
+        you can do JS operations on them.
+
+        All added implementation of finalizeForWebScript.
+
+        Reviewed by Ken.
+
+        * bindings/objc/WebScriptObject.h:
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject _initializeWithObjectImp:KJS::root:Bindings::]):
+        (-[WebScriptObject _initWithObjectImp:KJS::root:Bindings::]):
+        (-[WebScriptObject KJS::]):
+        (-[WebScriptObject dealloc]):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::~ObjcInstance):
+
+2004-05-19  Richard Williamson   <rjw@apple.com>
+
+        Removed extraneous tabs that were added (by XCode?).
+
+        * bindings/objc/WebScriptObject.h:
+
+2004-05-19  Darin Adler  <darin@apple.com>
+
+        - fixed headers with licenses mangled by Xcode auto-indenting
+
+        * bindings/jni/jni_jsobject.cpp:
+        * bindings/jni/jni_jsobject.h:
+        * bindings/runtime_array.h:
+        * bindings/runtime_root.cpp:
+        * bindings/runtime_root.h:
+
+2004-05-18  Richard Williamson   <rjw@apple.com>
+
+        Added exception logging.  Also check for exception and
+        set results as appropriate.
+
+        Reviewed by Maciej (partially reviewed).
+
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+
+2004-05-18  Richard Williamson   <rjw@apple.com>
+
+        Finsished implementing support for windowScriptObject.
+        Had to make WebScriptObjectPrivate.h accessible from
+        WebCore.
+
+        Reviewed by Maciej.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/objc/WebScriptObjectPrivate.h:
+
+2004-05-18  Richard Williamson   <rjw@apple.com>
+
+        Use KVC to set/get values instead of directly accessing
+        ivars.
+
+        Reviewed by Maciej.
+
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (+[WebScriptObject _convertValueToObjcValue:KJS::root:Bindings::]):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (convertValueToObjcObject):
+        (ObjcField::setValueToInstance):
+
+2004-05-17  Richard Williamson   <rjw@apple.com>
+
+        Implemented new API for WebScriptObject.
+
+        Fixed <rdar://problem/3657145>: (objc to javascript method calls do not cause updates.)
+        Fixed <rdar://problem/3654887>: (Update to JSC to refer to new JSObject LiveConnect object)  (w/ help from Vicki)
+
+        Reviewed by Hyatt.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/c/c_instance.cpp:
+        (CInstance::invokeMethod):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::convertValueToJObject):
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::getJNIField):
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject _initWithObjectImp:KJS::root:Bindings::]):
+        (-[WebScriptObject KJS::]):
+        (-[WebScriptObject dealloc]):
+        (+[WebScriptObject throwException:]):
+        (listFromNSArray):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (+[WebScriptObject _convertValueToObjcValue:KJS::root:Bindings::]):
+        (+[WebUndefined undefined]):
+        (-[WebUndefined initWithCoder:]):
+        (-[WebUndefined encodeWithCoder:]):
+        (-[WebUndefined copyWithZone:]):
+        (-[WebUndefined retain]):
+        (-[WebUndefined release]):
+        (-[WebUndefined retainCount]):
+        (-[WebUndefined autorelease]):
+        (-[WebUndefined dealloc]):
+        (-[WebUndefined copy]):
+        (-[WebUndefined replacementObjectForPortCoder:]):
+        * bindings/objc/WebScriptObjectPrivate.h: Added.
+        * bindings/objc/objc_class.mm:
+        (ObjcClass::methodsNamed):
+        (ObjcClass::fieldNamed):
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        * bindings/objc/objc_jsobject.h:
+        * bindings/objc/objc_jsobject.mm:
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::JSMethodNameToObjCMethodName):
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/runtime.cpp:
+        (Instance::setDidExecuteFunction):
+        (Instance::didExecuteFunction):
+        (Instance::setValueOfField):
+        * bindings/runtime.h:
+        * bindings/testbindings.mm:
+        (+[MyFirstInterface webScriptNameForSelector:]):
+        (-[MyFirstInterface callJSObject::]):
+
+2004-05-14  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by mjs.
+ 
+        <rdar://problem/3642427>: framework marketing number should be 2.0 for DoubleBarrel release
+
+        * JavaScriptCore.pbproj/project.pbxproj: change CFBundleShortVersionString to 2.0
+
+=== Safari-140 ===
+
+2004-05-13  Richard Williamson   <rjw@apple.com>
+
+        Fixed indentation.
+
+        Reviewed by Chris.
+
+        * ChangeLog:
+        * bindings/objc/WebScriptObject.h:
+
+2004-05-13  Richard Williamson   <rjw@apple.com>
+
+        Approved API changes.  Currently unimplemented.
+
+        Reviewed by Chris.
+
+        * ChangeLog:
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/objc/WebScriptObject.h: Added.
+        * bindings/objc/WebScriptObject.mm: Added.
+        (+[WebScriptObject throwException:]):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject stringRepresentation]):
+        (+[WebUndefined undefined]):
+        (-[WebUndefined initWithCoder:]):
+        (-[WebUndefined encodeWithCoder:]):
+        (-[WebUndefined copyWithZone:]):
+
+2004-05-07  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by darin.
+
+        Turn off GC since it uses ppc only instructions (which breaks 
+        the B&I build).   
+    
+        * kjs/value.h: set USE_CONSERVATIVE_GC to 0
+
+=== Safari-139 ===
+
+2004-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - add -funroll-loops=16 compiler option for approx .5% speedup on
+        HTML iBench and .5-1% speedup on JS iBench.
+        
+        * JavaScriptCore.pbproj/project.pbxproj:
+
+2004-04-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        Enable full conservative GC mode in addition to test mode. When
+        conservative GC is enabled, we now get an 11% speed improvement on
+        the iBench. Also fix some spots I missed before.
+
+        Specific noteworth changes:
+        
+        * kjs/collector.cpp:
+        (KJS::Collector::markStackObjectsConservatively): Check possible
+        cell pointers for 8-byte aligment and verify they are not 0.
+
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::increaseProtectCount): Move null-tolerance from here...
+        (KJS::ProtectedValues::decreaseProtectCount): ...and here...
+        * kjs/protect.h:
+        (KJS::gcProtectNullTolerant): ...to here...
+        (KJS::gcUnprotectNullTolerant): ...and here, because not all callers need the null
+        tolerance, and doing the check is expensive.
+
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::computeHash): Replace hash function with a much faster one
+        that is still very good.
+
+        * kjs/protect.h:
+        (KJS::gcProtect):
+        (KJS::gcUnprotect):
+        (KJS::ProtectedValue::ProtectedValue):
+        (KJS::ProtectedValue::~ProtectedValue):
+        (KJS::ProtectedValue::operator=):
+        (KJS::ProtectedObject::ProtectedObject):
+        (KJS::ProtectedObject::~ProtectedObject):
+        (KJS::ProtectedObject::operator=):
+        (KJS::ProtectedReference::ProtectedReference):
+        (KJS::ProtectedReference::~ProtectedReference):
+        (KJS::ProtectedReference::operator=):
+        * kjs/protected_values.cpp:
+        (KJS::ProtectedValues::getProtectCount):
+        (KJS::ProtectedValues::increaseProtectCount):
+        (KJS::ProtectedValues::decreaseProtectCount):
+        (KJS::ProtectedValues::computeHash):
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::addNativeReference):
+        (KJS::Bindings::removeNativeReference):
+        (RootObject::removeAllNativeReferences):
+        * bindings/runtime_root.h:
+        (KJS::Bindings::RootObject::~RootObject):
+        (KJS::Bindings::RootObject::setRootObjectImp):
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+        (KJS::Collector::collect):
+        * kjs/collector.h:
+        * kjs/internal.cpp:
+        (NumberImp::create):
+        (InterpreterImp::globalInit):
+        (InterpreterImp::globalClear):
+        (InterpreterImp::mark):
+        * kjs/list.cpp:
+        (KJS::List::derefValues):
+        (KJS::List::refValues):
+        (KJS::List::append):
+        * kjs/object.cpp:
+        (KJS::ObjectImp::setInternalValue):
+        (KJS::ObjectImp::putDirect):
+        * kjs/value.cpp:
+        (ValueImp::mark):
+        (ValueImp::marked):
+        * kjs/value.h:
+        (KJS::ValueImp::ValueImp):
+        (KJS::ValueImp::~ValueImp):
+        (KJS::ValueImp::):
+        (KJS::Value::Value):
+        (KJS::Value::~Value):
+        (KJS::Value::operator=):
+
+2004-04-30  Richard Williamson   <rjw@apple.com>
+
+        Asking an NSInvocation for it's return value when return type
+        is void throws an exception.  Added check for void return types
+        to avoid this exception.
+
+        Reviewed by Ken.
+
+        * bindings/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+
+2004-04-29  Richard Williamson   <rjw@apple.com>
+
+        Fixed several bad problems with the ObjC bindings.  In particular, conversion
+        to/from JavaScriptObject (soon to be WebScriptObject) was completely broken.
+
+        Reviewed by Chris.
+
+        * bindings/objc/objc_jsobject.h:
+        * bindings/objc/objc_jsobject.mm:
+        (-[JavaScriptObject initWithObjectImp:KJS::root:Bindings::]):
+        (-[JavaScriptObject KJS::]):
+        (+[JavaScriptObject _convertValueToObjcValue:KJS::root:Bindings::]):
+        (-[JavaScriptObject call:arguments:]):
+        (-[JavaScriptObject evaluate:]):
+        (-[JavaScriptObject getMember:]):
+        (-[JavaScriptObject getSlot:]):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (ObjcField::setValueToInstance):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/runtime.h:
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::rootForInterpreter):
+        (KJS::Bindings::addNativeReference):
+        (KJS::Bindings::removeNativeReference):
+        * bindings/runtime_root.h:
+        * bindings/testbindings.mm:
+        (-[MyFirstInterface logMessage:]):
+        (-[MyFirstInterface setJSObject:]):
+        (-[MyFirstInterface callJSObject::]):
+
+2004-04-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        * kjs/ustring.cpp: (KJS::UString::append): Fix one case that was allocating a buffer
+        that is 2x too big.
+
+2004-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        Implementation of conservative GC, based partly on code from
+        Darin. It's turned off for now, so it shouldn't have any effect on
+        the normal build.
+        
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * kjs/collector.cpp:
+        (KJS::Collector::markStackObjectsConservatively):
+        (KJS::Collector::markProtectedObjects):
+        (KJS::Collector::collect):
+        * kjs/collector.h:
+        * kjs/protect.h:
+        (KJS::gcProtect):
+        (KJS::gcUnprotect):
+        * kjs/protected_values.cpp: Added.
+        (KJS::ProtectedValues::getProtectCount):
+        (KJS::ProtectedValues::increaseProtectCount):
+        (KJS::ProtectedValues::insert):
+        (KJS::ProtectedValues::decreaseProtectCount):
+        (KJS::ProtectedValues::expand):
+        (KJS::ProtectedValues::shrink):
+        (KJS::ProtectedValues::rehash):
+        (KJS::ProtectedValues::computeHash):
+        * kjs/protected_values.h: Added.
+        * kjs/value.cpp:
+        (ValueImp::useConservativeMark):
+        (ValueImp::mark):
+        (ValueImp::marked):
+        * kjs/value.h:
+        (KJS::ValueImp::):
+
+=== Safari-138 ===
+
+2004-04-22  Richard Williamson   <rjw@apple.com>
+
+        Fixed build snafu (re-declaration of NPBool in npruntime.h and
+        npapi.h).
+
+        * bindings/npruntime.h:
+
+2004-04-22  Richard Williamson   <rjw@apple.com>
+
+        Updated plugin binding API to reflect latest revision from
+        working group.
+        
+        Biggest change is the introduction of NPVariant used to represent
+        value types.  NPVariant replaces the use of NPObject for the
+        exchange of values between scripting environment and native code.
+
+        Reviewed by John.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_jsobject.cpp:
+        (identiferFromNPIdentifier):
+        (NPN_Call):
+        (NPN_Evaluate):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_ToString):
+        (NPN_GetPropertyAtIndex):
+        (NPN_SetPropertyAtIndex):
+        * bindings/c/c_class.cpp:
+        (CClass::methodsNamed):
+        (CClass::fieldNamed):
+        * bindings/c/c_instance.cpp:
+        (CInstance::invokeMethod):
+        (CInstance::defaultValue):
+        * bindings/c/c_runtime.cpp:
+        (CField::valueFromInstance):
+        (CField::setValueToInstance):
+        * bindings/c/c_utility.cpp:
+        (convertNPStringToUTF16):
+        (convertUTF8ToUTF16):
+        (coerceValueToNPVariantStringType):
+        (convertValueToNPVariant):
+        (convertNPVariantToValue):
+        * bindings/c/c_utility.h:
+        * bindings/npruntime.cpp:
+        (NPN_GetIdentifier):
+        (NPN_GetIdentifiers):
+        (NPN_UTF8FromIdentifier):
+        (NPN_VariantIsVoid):
+        (NPN_VariantIsNull):
+        (NPN_VariantIsUndefined):
+        (NPN_VariantIsBool):
+        (NPN_VariantIsInt32):
+        (NPN_VariantIsDouble):
+        (NPN_VariantIsString):
+        (NPN_VariantIsObject):
+        (NPN_VariantToBool):
+        (NPN_VariantToString):
+        (NPN_VariantToInt32):
+        (NPN_VariantToDouble):
+        (NPN_VariantToObject):
+        (NPN_InitializeVariantAsVoid):
+        (NPN_InitializeVariantAsNull):
+        (NPN_InitializeVariantAsUndefined):
+        (NPN_InitializeVariantWithBool):
+        (NPN_InitializeVariantWithInt32):
+        (NPN_InitializeVariantWithDouble):
+        (NPN_InitializeVariantWithString):
+        (NPN_InitializeVariantWithStringCopy):
+        (NPN_InitializeVariantWithObject):
+        (NPN_InitializeVariantWithVariant):
+        (NPN_ReleaseVariantValue):
+        (NPN_CreateObject):
+        (NPN_RetainObject):
+        (NPN_ReleaseObject):
+        (NPN_IsKindOfClass):
+        (NPN_SetExceptionWithUTF8):
+        (NPN_SetException):
+        * bindings/npruntime.h:
+        (_NPString::):
+        (_NPString::_NPVariant::):
+        * bindings/testbindings.cpp:
+        (logMessage):
+        (setDoubleValue):
+        (setIntValue):
+        (setStringValue):
+        (setBooleanValue):
+        (getDoubleValue):
+        (getIntValue):
+        (getStringValue):
+        (getBooleanValue):
+        (myGetProperty):
+        (mySetProperty):
+        (myInvoke):
+        (myAllocate):
+
+2004-04-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed <rdar://problem/3627473>: "REGRESSION (125-137): memory trasher in UString::append, causing many different crashes"
+
+        * kjs/ustring.cpp:
+        (KJS::UString::expandCapacity): Fix sizeof(UChar *) that should be sizeof(UChar).
+        Was resulting in a buffer 2x the needed size.
+        (KJS::UString::expandPreCapacity): Ditto.
+        (KJS::UString::append): Fix malloc that is missing a sizeof(UChar).
+
+2004-04-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        Preliminary change for conservative GC. Create "protected"
+        subclasses to GC-protect objects when on heap, since we will soon
+        remove the built-in refcounting of the normal wrapper classes. Use
+        them where needed.
+        
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * kjs/context.h:
+        * kjs/internal.h:
+        (KJS::InterpreterImp::globalObject):
+        * kjs/interpreter.h:
+        * kjs/property_map.cpp:
+        * kjs/reference.h:
+        * kjs/reference_list.cpp:
+
+2004-04-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dave.
+
+        Optimize prepend using the shared substring optimization. Also,
+        limit the applicability of shared append and shared prepend. If
+        you overdo it, it does more harm than good, because you create a
+        bunch of strings that are disqualified from future shared
+        append/prepend, for not much immediate savings in allocate/copy
+        expense.
+        
+        * kjs/ustring.cpp:
+        (KJS::):
+        (KJS::UString::Rep::create):
+        (KJS::UString::expandedSize):
+        (KJS::UString::usedPreCapacity):
+        (KJS::UString::expandCapacity):
+        (KJS::UString::expandPreCapacity):
+        (KJS::UString::UString):
+        (KJS::UString::append):
+        (KJS::UString::operator=):
+        * kjs/ustring.h:
+        (KJS::UString::Rep::data):
+
+2004-04-16  Maciej Stachowiak  <mjs@apple.com>
+        Reviewed by Richard.
+
+        No more need for Completion or Reference to privately inherit from
+        Value, none of the superclass functionality is used.
+
+        * kjs/completion.h:
+        * kjs/reference.h:
+
+=== Safari-137 ===
+
+2004-04-16  Richard Williamson   <rjw@apple.com>
+
+        Added interpreter lock protection around object creation.
+
+        Reviewed by Chris.
+
+        * bindings/runtime.cpp:
+        (Instance::createRuntimeObject):
+
+2004-04-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+        Another JavaScript speed improvement: use the mechanism from
+        string append optimization to make taking a substring fast, again
+        sharing the buffer.
+
+        A further 22% improvement on the 24fun string speed test.
+        
+        * kjs/ustring.cpp:
+        (KJS::):
+        (KJS::UString::Rep::create):
+        (KJS::UString::UString):
+        (KJS::UString::append):
+        (KJS::UString::operator=):
+        (KJS::UString::substr):
+        * kjs/ustring.h:
+        (KJS::UString::Rep::data):
+
+2004-04-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - fixed <rdar://problem/3600695>: String manipulation in JavaScript 24fun test is very slow (slow)
+        - fixed <rdar://problem/3600691>: Table generation test is really slow
+        - fixed <rdar://problem/3600661>: 24fun date test is really slow
+
+        80% speedup on the string test, lesser speedups on the other two.
+        
+        Two different optimizations here:
+
+        1) Avoid large overhead of scanning strings to see if they are all
+        ASCII before numeric conversion.
+        
+        * kjs/nodes.cpp:
+        (AssignNode::evaluate): Don't convert to integer until we know for
+        sure the operation will need it. Attempting to convert strings to
+        numbers is a waste when they are being appended with +=.
+
+        2) Avoid huge cost of appending strings.
+
+        This is done by allowing multiple strings to share a buffer but
+        actually use different ranges of it. The first time a string is
+        appended to, we start leaving at least 10% extra space in the
+        buffer, so doing N appends to the same string takes O(log N)
+        mallocs instead of O(N).
+        
+        * kjs/identifier.cpp:
+        (KJS::Identifier::equal):
+        (KJS::Identifier::add):
+        * kjs/ustring.cpp:
+        (KJS::):
+        (KJS::UCharReference::operator=):
+        (KJS::UCharReference::ref):
+        (KJS::UString::Rep::create):
+        (KJS::UString::Rep::destroy):
+        (KJS::UString::expandedSize):
+        (KJS::UString::usedCapacity):
+        (KJS::UString::expandCapacity):
+        (KJS::UString::UString):
+        (KJS::UString::null):
+        (KJS::UString::append):
+        (KJS::UString::operator=):
+        (KJS::UString::toStrictUInt32):
+        (KJS::UString::detach):
+        (KJS::KJS::operator==):
+        * kjs/ustring.h:
+        (KJS::UString::Rep::data):
+        (KJS::UString::Rep::hash):
+
+2004-04-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        - fix deployment build by avoiding deployment-only warning.
+
+        * kjs/scope_chain.cpp:
+        (KJS::ScopeChain::bottom):
+
+2004-04-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        Changed things so that newly created objects get a prototype based
+        on the scope chain of the current function, rather than the
+        interpreter that started execution. This fixes the following bugs:
+        
+        <rdar://problem/3368523>: ARCH: wrong prototype used to create new objects (hang on lookup.atomica.com)
+        <rdar://problem/3559173>: ARCH: Cannot scan using a HP Jetdirect product (JS object prototypes bind incorrectly)
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * kjs/array_object.cpp:
+        (CompareWithCompareFunctionArguments::CompareWithCompareFunctionArguments):
+        (ArrayProtoFuncImp::ArrayProtoFuncImp):
+        (ArrayProtoFuncImp::call):
+        (ArrayObjectImp::construct):
+        * kjs/bool_object.cpp:
+        (BooleanObjectImp::construct):
+        * kjs/date_object.cpp:
+        (DateProtoFuncImp::DateProtoFuncImp):
+        (DateProtoFuncImp::call):
+        (DateObjectImp::construct):
+        * kjs/error_object.cpp:
+        (ErrorObjectImp::construct):
+        * kjs/function.cpp:
+        (FunctionImp::FunctionImp):
+        (FunctionImp::call):
+        (DeclaredFunctionImp::construct):
+        (ArgumentsImp::ArgumentsImp):
+        (GlobalFuncImp::call):
+        * kjs/function_object.cpp:
+        (FunctionProtoFuncImp::call):
+        (FunctionObjectImp::construct):
+        * kjs/internal.cpp:
+        (BooleanImp::toObject):
+        (StringImp::toObject):
+        (NumberImp::toObject):
+        (InterpreterImp::InterpreterImp):
+        (InterpreterImp::clear):
+        (InterpreterImp::interpreterWithGlobalObject):
+        * kjs/internal.h:
+        * kjs/interpreter.cpp:
+        (ExecState::lexicalInterpreter):
+        * kjs/interpreter.h:
+        (KJS::ExecState::dynamicInterpreter):
+        (KJS::ExecState::interpreter):
+        * kjs/math_object.cpp:
+        (MathFuncImp::MathFuncImp):
+        * kjs/nodes.cpp:
+        (StatementNode::hitStatement):
+        (StatementNode::abortStatement):
+        (RegExpNode::evaluate):
+        (ElementNode::evaluate):
+        (ArrayNode::evaluate):
+        (ObjectLiteralNode::evaluate):
+        (PropertyValueNode::evaluate):
+        (FunctionCallNode::evaluate):
+        (FuncDeclNode::processFuncDecl):
+        (FuncExprNode::evaluate):
+        * kjs/number_object.cpp:
+        (NumberObjectImp::construct):
+        * kjs/object.cpp:
+        (KJS::ObjectImp::defaultValue):
+        (KJS::Error::create):
+        * kjs/object_object.cpp:
+        (ObjectObjectImp::construct):
+        * kjs/reference.cpp:
+        (Reference::putValue):
+        * kjs/regexp_object.cpp:
+        (RegExpProtoFuncImp::call):
+        (RegExpObjectImp::arrayOfMatches):
+        (RegExpObjectImp::construct):
+        * kjs/scope_chain.cpp:
+        (KJS::ScopeChain::bottom):
+        * kjs/scope_chain.h:
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::StringProtoFuncImp):
+        (StringProtoFuncImp::call):
+        (StringObjectImp::construct):
+
+=== Safari-136 ===
+
+=== Safari-135 ===
+
+2004-03-31  Richard Williamson   <rjw@apple.com>
+
+        Tedious renames based on feedback from plugin-futures list.
+        NP_ functions are renamed with NPN_ prefix.
+        Types prefix renamed from NP_ to NP.
+        NPN_CreateStringWithUTF8 and NPN_SetExceptionWithUTF8 now take a length, optionally -1 if string is null terminated. 
+        
+        No review because this was just a renaming patch.
+
+        * bindings/NP_jsobject.cpp:
+        (listFromNPArray):
+        (jsAllocate):
+        (identiferFromNPIdentifier):
+        (NPN_Call):
+        (NPN_Evaluate):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        (NPN_ToString):
+        (NPN_GetPropertyAtIndex):
+        (NPN_SetPropertyAtIndex):
+        * bindings/NP_jsobject.h:
+        * bindings/c/c_class.cpp:
+        (CClass::_commonInit):
+        (CClass::classForIsA):
+        (CClass::CClass):
+        (CClass::methodsNamed):
+        (CClass::fieldNamed):
+        * bindings/c/c_class.h:
+        * bindings/c/c_instance.cpp:
+        (CInstance::CInstance):
+        (CInstance::~CInstance):
+        (CInstance::operator=):
+        (CInstance::invokeMethod):
+        (CInstance::defaultValue):
+        * bindings/c/c_instance.h:
+        (KJS::Bindings::CInstance::getObject):
+        * bindings/c/c_runtime.cpp:
+        (CField::valueFromInstance):
+        (CField::setValueToInstance):
+        * bindings/c/c_runtime.h:
+        (KJS::Bindings::CField::CField):
+        (KJS::Bindings::CField::name):
+        (KJS::Bindings::CMethod::CMethod):
+        (KJS::Bindings::CMethod::name):
+        * bindings/c/c_utility.cpp:
+        (coerceValueToNPString):
+        (convertValueToNPValueType):
+        (convertNPValueTypeToValue):
+        * bindings/c/c_utility.h:
+        * bindings/npruntime.cpp:
+        (NPN_IdentifierFromUTF8):
+        (NPN_IsValidIdentifier):
+        (NPN_GetIdentifiers):
+        (NPN_UTF8FromIdentifier):
+        (NPN_CreateObject):
+        (NPN_RetainObject):
+        (NPN_ReleaseObject):
+        (NPN_IsKindOfClass):
+        (NPN_SetExceptionWithUTF8):
+        (NPN_SetException):
+        (numberAllocate):
+        (NPN_CreateNumberWithInt):
+        (NPN_CreateNumberWithFloat):
+        (NPN_CreateNumberWithDouble):
+        (NPN_IntFromNumber):
+        (NPN_FloatFromNumber):
+        (NPN_DoubleFromNumber):
+        (stringAllocate):
+        (NPN_CreateStringWithUTF8):
+        (NPN_CreateStringWithUTF16):
+        (NPN_DeallocateUTF8):
+        (NPN_UTF8FromString):
+        (NPN_UTF16FromString):
+        (NPN_StringLength):
+        (booleanAllocate):
+        (NPN_CreateBoolean):
+        (NPN_BoolFromBoolean):
+        (nullAllocate):
+        (NPN_GetNull):
+        (undefinedAllocate):
+        (NPN_GetUndefined):
+        (arrayAllocate):
+        (arrayDeallocate):
+        (NPN_CreateArray):
+        (NPN_CreateArrayV):
+        (NPN_ObjectAtIndex):
+        * bindings/npruntime.h:
+        * bindings/runtime.cpp:
+        (Instance::createBindingForLanguageInstance):
+        * bindings/testbindings.cpp:
+        (initializeIdentifiers):
+        (myHasProperty):
+        (myHasMethod):
+        (myGetProperty):
+        (mySetProperty):
+        (logMessage):
+        (setDoubleValue):
+        (setIntValue):
+        (setStringValue):
+        (setBooleanValue):
+        (getDoubleValue):
+        (getIntValue):
+        (getStringValue):
+        (getBooleanValue):
+        (myInvoke):
+        (myAllocate):
+        (myInvalidate):
+        (myDeallocate):
+        (main):
+
+2004-03-31  Richard Williamson   <rjw@apple.com>
+
+        Changed references to NP_runtime.h to npruntime.h
+        
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_jsobject.h:
+        * bindings/c/c_class.h:
+        * bindings/c/c_instance.h:
+        * bindings/c/c_runtime.h:
+        * bindings/c/c_utility.h:
+        * bindings/npruntime.cpp:
+
+2004-03-31  Richard Williamson   <rjw@apple.com>
+
+        Renamed NP_runtime.h to npruntime.h to match Netscape SDK.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_jsobject.h:
+        * bindings/npruntime.cpp:
+
+=== Safari-134 ===
+
+2004-03-23  Richard Williamson   <rjw@apple.com>
+
+        Added implementation of KJS::Value <-> NP_Object conversion functions.
+        Augmented test program for 'C' bindings.
+        Added asserts and parameter checking to all public API.        
+
+        Reviewed by Ken.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_jsobject.cpp:
+        (NP_ToString):
+        * bindings/NP_jsobject.h: Added.
+        * bindings/NP_runtime.cpp:
+        (NP_IdentifierFromUTF8):
+        (NP_IsValidIdentifier):
+        (NP_GetIdentifiers):
+        (NP_CreateObject):
+        (NP_RetainObject):
+        (NP_ReleaseObject):
+        (NP_IsKindOfClass):
+        (NP_SetExceptionWithUTF8):
+        (NP_SetException):
+        (NP_IntFromNumber):
+        (NP_FloatFromNumber):
+        (NP_DoubleFromNumber):
+        (NP_CreateStringWithUTF8):
+        (NP_CreateStringWithUTF16):
+        (NP_DeallocateUTF8):
+        (NP_UTF8FromString):
+        (NP_UTF16FromString):
+        (NP_StringLength):
+        (NP_BoolFromBoolean):
+        * bindings/NP_runtime.h:
+        * bindings/c/c_instance.cpp:
+        (CInstance::invokeMethod):
+        * bindings/c/c_utility.cpp:
+        (coerceValueToNPString):
+        (convertValueToNPValueType):
+        (convertNPValueTypeToValue):
+        * bindings/c/c_utility.h:
+        * bindings/test.js:
+        * bindings/testC.js: Added.
+        * bindings/testbindings.cpp:
+        (logMessage):
+        (setDoubleValue):
+        (setIntValue):
+        (setStringValue):
+        (setBooleanValue):
+        (getDoubleValue):
+        (getIntValue):
+        (getStringValue):
+        (getBooleanValue):
+        (myInterfaceInvoke):
+        (myInterfaceAllocate):
+
+=== Safari-133 ===
+
+2004-03-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Ken.
+
+        - fixed problem with methods like setUTCHour
+
+        * kjs/date_object.cpp: (DateProtoFuncImp::call): Fix conversion back to time_t to use the appropriate
+        GMT vs. local time function based on the utc flag.
+
+2004-03-17  Richard Williamson   <rjw@apple.com>
+
+        Added a context parameter to result callbacks use by JavaScriptObject functions.  This was a change requested by Eric Carlson on the QT plugin team.
+
+        Reviewed by Ken.
+
+        * bindings/NP_jsobject.cpp:
+        (NP_Call):
+        (NP_Evaluate):
+        (NP_GetProperty):
+        (NP_ToString):
+        (NP_GetPropertyAtIndex):
+        * bindings/NP_runtime.h:
+
+2004-03-16  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3590169.  Regression (crash) caused by the switch to MethodLists.  Crash when attempting to invoke a method from JavaScript to Java that is not implemented.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::methodsNamed):
+
+2004-03-15  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3570854.  Don't attempt to convert Null to strings.  We
+        were incorrectly converting to "Null".
+
+        Actually fixed by Scott Kovatch.
+
+        Reviewed by Richard.
+
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::convertValueToJValue):
+
+=== Safari-132 ===
+
+2004-03-11  Richard Williamson   <rjw@apple.com>
+
+        Stitched together the NP stuff to our language independent
+        JavaScript binding stuff.  Very close to being done.
+        
+        Added program to test C bindings (and NP stuff).  Just tests
+        properties.  Will add methods and JavaScript access, etc.
+
+        Updated Makefile.am to account for new bindings/c directory.
+
+        Change NP_UTF8 from "const char *" to "char" to allow for
+        declarations like "const NP_UTF8 *" and "NP_UTF8 *".  Ditto
+        for NP_UTF16.
+
+        Added NP_IsValidIdentifier().
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * Makefile.am:
+        * bindings/NP_jsobject.cpp:
+        (identiferFromNPIdentifier):
+        (NP_Evaluate):
+        * bindings/NP_runtime.cpp:
+        (NP_IdentifierFromUTF8):
+        (NP_IsValidIdentifier):
+        (NP_GetIdentifiers):
+        (NP_UTF8FromIdentifier):
+        (NP_SetExceptionWithUTF8):
+        (NP_SetException):
+        (NP_CreateStringWithUTF8):
+        (NP_CreateStringWithUTF16):
+        (NP_UTF8FromString):
+        (NP_UTF16FromString):
+        * bindings/NP_runtime.h:
+        * bindings/c/c_class.cpp: Added.
+        (CClass::_commonDelete):
+        (CClass::_commonCopy):
+        (CClass::_commonInit):
+        (_createClassesByIsAIfNecessary):
+        (CClass::classForIsA):
+        (CClass::CClass):
+        (CClass::name):
+        (CClass::methodsNamed):
+        (CClass::fieldNamed):
+        * bindings/c/c_class.h: Added.
+        (KJS::Bindings::CClass::~CClass):
+        (KJS::Bindings::CClass::CClass):
+        (KJS::Bindings::CClass::operator=):
+        (KJS::Bindings::CClass::constructorAt):
+        (KJS::Bindings::CClass::numConstructors):
+        * bindings/c/c_instance.cpp: Added.
+        (CInstance::CInstance):
+        (CInstance::~CInstance):
+        (CInstance::operator=):
+        (CInstance::getClass):
+        (CInstance::begin):
+        (CInstance::end):
+        (CInstance::invokeMethod):
+        (CInstance::defaultValue):
+        (CInstance::stringValue):
+        (CInstance::numberValue):
+        (CInstance::booleanValue):
+        (CInstance::valueOf):
+        * bindings/c/c_instance.h: Added.
+        (KJS::Bindings::CInstance::getObject):
+        * bindings/c/c_runtime.cpp: Added.
+        (CField::valueFromInstance):
+        (CField::setValueToInstance):
+        * bindings/c/c_runtime.h: Added.
+        (KJS::Bindings::CField::CField):
+        (KJS::Bindings::CField::name):
+        (KJS::Bindings::CField::type):
+        (KJS::Bindings::CMethod::CMethod):
+        (KJS::Bindings::CMethod::name):
+        (KJS::Bindings::CMethod::numParameters):
+        * bindings/c/c_utility.cpp: Added.
+        (coerceValueToNPValueType):
+        (convertValueToNPValueType):
+        (convertNPValueTypeToValue):
+        * bindings/c/c_utility.h: Added.
+        * bindings/make_testbindings:
+        * bindings/runtime.cpp:
+        (Instance::createBindingForLanguageInstance):
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::):
+        * bindings/testbindings.cpp: Added.
+        (initializeIdentifiers):
+        (myInterfaceHasProperty):
+        (myInterfaceHasMethod):
+        (myInterfaceGetProperty):
+        (myInterfaceSetProperty):
+        (myInterfaceInvoke):
+        (myInterfaceAllocate):
+        (myInterfaceInvalidate):
+        (myInterfaceDeallocate):
+        (GlobalImp::className):
+        (readJavaScriptFromFile):
+        (main):
+
+2004-03-10  Richard Williamson   <rjw@apple.com>
+
+        Made changes to support new asychronous approach to calls from
+        plugin to JavaScript
+
+        Reviewed by Chris.
+
+        * bindings/NP_jsobject.cpp:
+        (NP_Call):
+        (NP_Evaluate):
+        (NP_GetProperty):
+        (NP_ToString):
+        (NP_GetPropertyAtIndex):
+        * bindings/NP_runtime.h:
+        * bindings/make_testbindings:
+        * bindings/runtime.cpp:
+        (Instance::createBindingForLanguageInstance):
+
+2004-03-10  Richard Williamson   <rjw@apple.com>
+
+        Updated header to include proposed changes from
+        plugin-futures list.  Calls from plugin to JavaScript
+        are now asynchronous.
+
+        Reviewed by Chris.
+
+        * bindings/NP_runtime.h:
+
+=== Safari-131 ===
+
+2004-03-04  Richard Williamson   <rjw@apple.com>
+
+        Implementation of NP_JavaScriptObject.  This is the 'C' class
+        that wraps a JavaScript object.
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_jsobject.cpp: Added.
+        (coerceValueToNPValueType):
+        (convertValueToNPValueType):
+        (convertNPValueTypeToValue):
+        (listFromNPArray):
+        (jsAllocate):
+        (jsDeallocate):
+        (identiferFromNPIdentifier):
+        (NP_Call):
+        (NP_Evaluate):
+        (NP_GetProperty):
+        (NP_SetProperty):
+        (NP_RemoveProperty):
+        (NP_ToString):
+        (NP_GetPropertyAtIndex):
+        (NP_SetPropertyAtIndex):
+        * bindings/NP_runtime.cpp:
+        (NP_ObjectAtIndex):
+        * bindings/NP_runtime.h:
+        * bindings/runtime_object.h:
+
+2004-03-04  Richard Williamson   <rjw@apple.com>
+
+        Added NP_Array implementation.  
+
+        Changed NP_Boolean to just depend on two static instances, no
+        space is required for values.
+
+        Reviewed by Chris.
+
+        * bindings/NP_runtime.cpp:
+        (NP_CreateBoolean):
+        (NP_BoolFromBoolean):
+        (arrayAllocate):
+        (arrayDeallocate):
+        (NP_CreateArray):
+        (NP_CreateArrayV):
+        (NP_ObjectAtIndex):
+        * bindings/NP_runtime.h:
+
+2004-03-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Vicki.
+
+        * English.lproj/InfoPlist.strings: Removed. No need to localize the version and
+        copyright string, and that's all that was in here.
+        * JavaScriptCore.pbproj/project.pbxproj: Removed InfoPlist.strings from build.
+
+2004-03-03  Richard Williamson   <rjw@apple.com>
+
+        More 'C' binding implementation.  Fleshed out all the
+        'primitive' data types.
+
+        Reviewed by Chris.
+
+        * bindings/NP_runtime.cpp:
+        (NP_ReleaseObject):
+        (numberAllocate):
+        (stringAllocate):
+        (stringDeallocate):
+        (NP_CreateStringWithUTF8):
+        (NP_CreateStringWithUTF16):
+        (NP_UTF8FromString):
+        (NP_UTF16FromString):
+        (NP_StringLength):
+        (booleanAllocate):
+        (booleanDeallocate):
+        (NP_CreateBoolean):
+        (NP_BoolFromBoolean):
+        (nullAllocate):
+        (nullDeallocate):
+        (NP_GetNull):
+        (undefinedAllocate):
+        (undefinedDeallocate):
+        (NP_GetUndefined):
+        * bindings/NP_runtime.h:
+
+2004-03-03  Richard Williamson   <rjw@apple.com>
+
+        More 'C' binding implementation.
+
+        Reviewed by Chris.
+
+        * bindings/NP_runtime.cpp:
+        (identifierEqual):
+        (identifierHash):
+        (getIdentifierDictionary):
+        (NP_IdentifierFromUTF8):
+        (NP_UTF8FromIdentifier):
+        (NP_CreateObject):
+        (NP_ReleaseObject):
+        (NP_IsKindOfClass):
+        (numberCreate):
+        (NP_CreateNumberWithInt):
+        (NP_CreateNumberWithFloat):
+        (NP_CreateNumberWithDouble):
+        (NP_IntFromNumber):
+        (NP_FloatFromNumber):
+        (NP_DoubleFromNumber):
+        * bindings/NP_runtime.h:
+
+2004-03-02  Richard Williamson   <rjw@apple.com>
+
+        Removed retain/release from NP_Class.  Classes will not be allowed to implement their
+        own customer retain/release scheme.
+
+        Reviewed by Chris.
+
+        * bindings/NP_runtime.cpp:
+        (NP_RetainObject):
+        (NP_ReleaseObject):
+        * bindings/NP_runtime.h:
+
+2004-03-02  Richard Williamson   <rjw@apple.com>
+
+        C binding API.  Partial implementation.
+
+        Completed ObjectiveC bindings (not based on the C API).  These will re-implemented over the C binding API, but I wanted to get this code in the tree.
+
+        Factored root object reference counting scheme.  It is now useful independent
+        of LiveConnect.
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/NP_runtime.cpp: Added.
+        (NP_IdentifierFromUTF8):
+        (NP_GetIdentifiers):
+        (NP_UTF8FromIdentifier):
+        (NP_CreateObject):
+        (NP_RetainObject):
+        (NP_ReleaseObject):
+        (NP_IsKindOfClass):
+        (NP_SetException):
+        (NP_Call):
+        (NP_Evaluate):
+        (NP_GetProperty):
+        (NP_SetProperty):
+        (NP_RemoveProperty):
+        (NP_ToString):
+        (NP_GetPropertyAtIndex):
+        (NP_SetPropertyAtIndex):
+        (NP_CreateNumberWithInt):
+        (NP_CreateNumberWithFloat):
+        (NP_CreateNumberWithDouble):
+        (NP_IntFromNumber):
+        (NP_FloatFromNumber):
+        (NP_DoubleFromNumber):
+        (NP_CreateStringWithUTF8):
+        (NP_CreateStringWithUTF16):
+        (NP_UTF8FromString):
+        (NP_UTF16FromString):
+        (NP_CreateBoolean):
+        (NP_BoolFromBoolean):
+        (NP_GetNull):
+        (NP_GetUndefined):
+        (NP_CreateArray):
+        (NP_CreateArrayV):
+        (NP_ObjectAtIndex):
+        * bindings/NP_runtime.h: Added.
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::invoke):
+        (JSObject::finalize):
+        (JSObject::createNative):
+        (JSObject::convertValueToJObject):
+        * bindings/jni/jni_jsobject.h:
+        * bindings/objc/objc_jsobject.h:
+        * bindings/objc/objc_jsobject.mm:
+        (rootForView):
+        (windowJavaScriptObject):
+        (-[JavaScriptObject initWithObjectImp:KJS::root:Bindings::]):
+        (-[JavaScriptObject dealloc]):
+        (-[JavaScriptObject _convertValueToObjcValue:KJS::]):
+        (-[JavaScriptObject call:arguments:]):
+        (-[JavaScriptObject evaluate:]):
+        (-[JavaScriptObject getMember:]):
+        (-[JavaScriptObject setMember:value:]):
+        (-[JavaScriptObject removeMember:]):
+        (-[JavaScriptObject toString]):
+        (-[JavaScriptObject getSlot:]):
+        (-[JavaScriptObject setSlot:value:]):
+        * bindings/objc/objc_utility.h:
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        * bindings/runtime_root.cpp: Added.
+        (getReferencesByRootDictionary):
+        (getReferencesDictionary):
+        (KJS::Bindings::findReferenceDictionary):
+        (KJS::Bindings::rootForImp):
+        (KJS::Bindings::addNativeReference):
+        (KJS::Bindings::removeNativeReference):
+        (completedJavaScriptAccess):
+        (initializeJavaScriptAccessLock):
+        (lockJavaScriptAccess):
+        (unlockJavaScriptAccess):
+        (RootObject::dispatchToJavaScriptThread):
+        (performJavaScriptAccess):
+        (RootObject::setFindRootObjectForNativeHandleFunction):
+        (RootObject::removeAllNativeReferences):
+        * bindings/runtime_root.h: Added.
+        (KJS::Bindings::RootObject::RootObject):
+        (KJS::Bindings::RootObject::~RootObject):
+        (KJS::Bindings::RootObject::setRootObjectImp):
+        (KJS::Bindings::RootObject::rootObjectImp):
+        (KJS::Bindings::RootObject::setInterpreter):
+        (KJS::Bindings::RootObject::interpreter):
+        (KJS::Bindings::RootObject::findRootObjectForNativeHandleFunction):
+        (KJS::Bindings::RootObject::runLoop):
+        (KJS::Bindings::RootObject::performJavaScriptSource):
+
+=== Safari-130 ===
+
+=== Safari-129 ===
+
+2004-02-18  Richard Williamson   <rjw@apple.com>
+
+        Added NSNumber/Number conversion.
+
+        Removed some unnecessary KJS:: namespace specifiers.
+
+        Reviewed by Ken.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/runtime_array.h:
+
+2004-02-18  Richard Williamson   <rjw@apple.com>
+
+        Added support for export NSArrays.
+
+        Updated valueAt() to take an ExecState so we can throw
+        JS exceptions.
+
+        Implemented excludeSelectorFromJavaScript: in ObjcClass.  This allows
+        ObjectiveC classes to control the visibility of their methods in 
+        JavaScript.
+
+        Reviewed by Ken.
+
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+        (JavaArray::valueAt):
+        * bindings/jni/jni_runtime.h:
+        * bindings/objc/objc_class.mm:
+        (ObjcClass::methodsNamed):
+        * bindings/objc/objc_runtime.h:
+        (KJS::Bindings::ObjcArray::getObjcArray):
+        * bindings/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (ObjcField::setValueToInstance):
+        (ObjcArray::ObjcArray):
+        (ObjcArray::~ObjcArray):
+        (ObjcArray::operator=):
+        (ObjcArray::setValueAt):
+        (ObjcArray::valueAt):
+        (ObjcArray::getLength):
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/runtime.cpp:
+        (Instance::getValueOfField):
+        * bindings/runtime.h:
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::get):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+
+2004-02-17  Richard Williamson   <rjw@apple.com>
+
+        Added String <-> NSString conversion.
+        Added tests of String <-> NSString conversion to test program.
+
+        Reviewed by Chris.
+
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+        * bindings/test.js:
+        * bindings/testbindings.mm:
+        (-[MyFirstInterface getString]):
+
+2004-02-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Tweak build styles a bit, fixing OptimizedWithSymbols,
+        and removing redundant settings of things that match defaults in other build styles.
+
+2004-02-13  Richard Williamson   <rjw@apple.com>
+
+        Work towards the JavaScript ObjC bindings.  The bindings now work for 
+        simple scalar types.  testbindings.mm is an illustration of how the 
+        bindings work.
+
+        Reviewed by Ken.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * Makefile.am:
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::methodsNamed):
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaMethod::returnType):
+        * bindings/make_testbindings: Added.
+        * bindings/objc/objc_class.h: Added.
+        (KJS::Bindings::ObjcClass::~ObjcClass):
+        (KJS::Bindings::ObjcClass::ObjcClass):
+        (KJS::Bindings::ObjcClass::operator=):
+        (KJS::Bindings::ObjcClass::constructorAt):
+        (KJS::Bindings::ObjcClass::numConstructors):
+        * bindings/objc/objc_class.mm: Added.
+        (ObjcClass::_commonDelete):
+        (ObjcClass::_commonCopy):
+        (ObjcClass::_commonInit):
+        (_createClassesByIsAIfNecessary):
+        (ObjcClass::classForIsA):
+        (ObjcClass::ObjcClass):
+        (ObjcClass::name):
+        (ObjcClass::methodsNamed):
+        (ObjcClass::fieldNamed):
+        * bindings/objc/objc_header.h: Added.
+        * bindings/objc/objc_instance.h: Added.
+        (KJS::Bindings::ObjcInstance::getObject):
+        * bindings/objc/objc_instance.mm: Added.
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::~ObjcInstance):
+        (ObjcInstance::operator=):
+        (ObjcInstance::begin):
+        (ObjcInstance::end):
+        (ObjcInstance::getClass):
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::defaultValue):
+        (ObjcInstance::stringValue):
+        (ObjcInstance::numberValue):
+        (ObjcInstance::booleanValue):
+        (ObjcInstance::valueOf):
+        * bindings/objc/objc_jsobject.h: Added.
+        * bindings/objc/objc_jsobject.mm: Added.
+        * bindings/objc/objc_runtime.h:
+        (KJS::Bindings::ObjcField::~ObjcField):
+        (KJS::Bindings::ObjcField::ObjcField):
+        (KJS::Bindings::ObjcField::operator=):
+        (KJS::Bindings::ObjcMethod::ObjcMethod):
+        (KJS::Bindings::ObjcMethod::~ObjcMethod):
+        (KJS::Bindings::ObjcMethod::operator=):
+        * bindings/objc/objc_runtime.mm: Added.
+        (ObjcMethod::ObjcMethod):
+        (ObjcMethod::name):
+        (ObjcMethod::numParameters):
+        (ObjcMethod::getMethodSignature):
+        (ObjcField::ObjcField):
+        (ObjcField::name):
+        (ObjcField::type):
+        (ObjcField::valueFromInstance):
+        (ObjcField::setValueToInstance):
+        * bindings/objc/objc_utility.h: Added.
+        (KJS::Bindings::):
+        * bindings/objc/objc_utility.mm: Added.
+        (KJS::Bindings::JSMethodNameToObjCMethodName):
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertObjcValueToValue):
+        (KJS::Bindings::objcValueTypeForType):
+        * bindings/runtime.cpp:
+        (MethodList::MethodList):
+        (MethodList::operator=):
+        (Instance::setValueOfField):
+        (Instance::createBindingForLanguageInstance):
+        (Instance::createRuntimeObject):
+        * bindings/runtime.h:
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::RuntimeMethodImp):
+        (RuntimeMethodImp::get):
+        (RuntimeMethodImp::call):
+        * bindings/runtime_method.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::hasProperty):
+        * bindings/test.js: Added.
+        * bindings/testbindings.mm: Added.
+        (-[MySecondInterface init]):
+        (-[MyFirstInterface init]):
+        (-[MyFirstInterface dealloc]):
+        (+[MyFirstInterface JavaScriptNameForSelector:]):
+        (-[MyFirstInterface getInt]):
+        (-[MyFirstInterface setInt:]):
+        (-[MyFirstInterface getMySecondInterface]):
+        (-[MyFirstInterface logMessage:]):
+        (GlobalImp::className):
+        (readJavaScriptFromFile):
+        (main):
+
+=== Safari-128 ===
+
+2004-02-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave.
+
+        - fixed things seen in the profile, for a total speedup of 4% on cvs-base (including changes across all projects)
+
+        * JavaScriptCorePrefix.h: Add a workaround for a bug in our system headers that prevents the <ctype.h>
+        macros from working right in C++ code that uses the <cctype> header.
+
+        * kjs/ustring.cpp:
+        (KJS::inlineUTF8SequenceLengthNonASCII): Added.
+        (KJS::UTF8SequenceLengthNonASCII): Added.
+        (KJS::inlineUTF8SequenceLength): Added.
+        (KJS::UTF8SequenceLength): Calls inlineUTF8SequenceLengthNonASCII now.
+        (KJS::decodeUTF8Sequence): Use new inlineUTF8SequenceLengthNonASCII; faster for ASCII.
+        (KJS::createSortedOffsetsArray): Add special case for 1, 2, and 3 offsets, so we don't do qsort for those.
+        (KJS::convertUTF16OffsetsToUTF8Offsets): Use new inlineUTF8SequenceLengthNonASCII; faster for ASCII.
+        (KJS::convertUTF8OffsetsToUTF16Offsets): Use new inlineUTF8SequenceLengthNonASCII; faster for ASCII.
+
+        - fixed the test program so it won't hit the interpreter lock assertion
+
+        * kjs/testkjs.cpp: (main): Just lock around the whole thing, since the test is singly threaded.
+
+=== Safari-127 ===
+
+2004-02-06  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3550242 and 3546977.  The first diff prevents an assert from firing.  The second diff prevents a JavaScript exception, caused be an invalid conversion, which has a downstream consequence of preventing a valid conversion.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_jsobject.cpp:
+        (JSObject::toString):
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::convertValueToJValue):
+
+2004-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed <rdar://problem/3546613>: array of negative size leads to crash (test page at oscar.the-rileys.net)
+
+        * kjs/array_object.cpp:
+        (ArrayInstanceImp::ArrayInstanceImp): If the length is greater than 10,000, don't allocate an array until
+        we start putting values in. This prevents new Array(2147483647) from causing trouble.
+        (ArrayObjectImp::construct): Check number as described in specification, and raise a range error if the
+        number is out of range. This prevents new Array(-1) from causing trouble.
+
+        - fixed <rdar://problem/3545756>: Math.round screws up on numbers bigger than 2^31 (incorrect results on HP-35 calculator page)
+
+        * kjs/math_object.cpp: (MathFuncImp::call): Change implementation to be much simpler and not involve
+        casting to int. Results now match those in other browsers.
+
+2004-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed <rdar://problem/3519285>: integer operations on large negative numbers yield bad results (discovered with "HTMLCrypt")
+        - fixed other related overflow issues
+
+        * kjs/value.h: Changed return types of toInteger, toInt32, toUInt32, and toUInt16.
+        * kjs/value.cpp:
+        (ValueImp::toInteger): Change to return a double, since this operation, from the ECMA specification,
+        must not restrict values to the range of a particular integer type.
+        (ValueImp::toInt32): Used a sized integer type for the result of this function, and also added
+        proper handling for negative results from fmod.
+        (ValueImp::toUInt32): Ditto.
+        (ValueImp::toUInt16): Ditto.
+        (ValueImp::dispatchToUInt32): Changed result type from unsigned to uint32_t.
+
+        * kjs/array_object.cpp: (ArrayProtoFuncImp::call): Use a double instead of an int to handle
+        out-of-integer-range values better in the slice function.
+        * kjs/internal.cpp: (KJS::roundValue): Streamline the function, handling NAN and infinity properly.
+        * kjs/number_object.cpp: (NumberProtoFuncImp::call): Use a double instead of an int to handle
+        out-of-integer-range values better in the toString function.
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): Use a double instead of an int to handle
+        out-of-integer-range values better in the charAt, charCodeAt, indexOf, lastIndexOf, slice,
+        and substr functions.
+
+=== Safari-126 ===
+
+2004-01-30  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3542044.  Create KJS::String using UString constructor instead of passing UTF8 string to char* constructor.
+
+        Reviewed by Darin.
+
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+
+2004-01-26  Darin Adler  <darin@apple.com>
+
+        * Makefile.am: Switch from pbxbuild to xcodebuild.
+
+2004-01-22  Richard Williamson   <rjw@apple.com>
+
+        Added stubs for ObjC language binding to JavaScript.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/jni/jni_runtime.h:
+        * bindings/objc/objc_runtime.h: Added.
+        (KJS::Bindings::ObjcParameter::ObjcParameter):
+        (KJS::Bindings::ObjcParameter::~ObjcParameter):
+        (KJS::Bindings::ObjcParameter::operator=):
+        (KJS::Bindings::ObjcParameter::type):
+        (KJS::Bindings::ObjcConstructor::ObjcConstructor):
+        (KJS::Bindings::ObjcConstructor::~ObjcConstructor):
+        (KJS::Bindings::ObjcConstructor::_commonCopy):
+        (KJS::Bindings::ObjcConstructor::operator=):
+        (KJS::Bindings::ObjcConstructor::value):
+        (KJS::Bindings::ObjcConstructor::parameterAt):
+        (KJS::Bindings::ObjcConstructor::numParameters):
+        (KJS::Bindings::ObjcField::ObjcField):
+        (KJS::Bindings::ObjcField::~ObjcField):
+        * bindings/runtime.h:
+
+2004-01-22  Richard Williamson   <rjw@apple.com>
+
+        Simplified JavaString by using UString as backing store.  This
+        revealed a bug in CString's assignment operator which I fixed.
+
+        Removed some dead code.
+ 
+        Reviewed by John.
+
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaString::JavaString):
+        (KJS::Bindings::JavaString::_commonInit):
+        (KJS::Bindings::JavaString::UTF8String):
+        (KJS::Bindings::JavaString::uchars):
+        (KJS::Bindings::JavaString::length):
+        (KJS::Bindings::JavaString::ustring):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::RuntimeObjectImp):
+        * bindings/runtime_object.h:
+        * kjs/ustring.cpp:
+        (KJS::CString::CString):
+        (KJS::CString::operator=):
+
+=== Safari-125 ===
+
+=== Safari-124 ===
+
+2004-01-16  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3525853.  We weren't handling mapping to overloaded Java
+        methods very well.  Even though this is undefined the other
+        browsers support it.  Also fixed a bug with returning arrays
+        from Java functions.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::_commonInit):
+        (JavaClass::methodsNamed):
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaArray::convertJObjectToArray):
+        (JavaField::valueFromInstance):
+        (JavaMethod::signature):
+        (JavaArray::valueAt):
+        * bindings/jni/jni_runtime.h:
+        * bindings/jni_jsobject.cpp:
+        (JSObject::call):
+        (JSObject::convertJObjectToValue):
+        * bindings/runtime.cpp:
+        (MethodList::addMethod):
+        (MethodList::length):
+        (MethodList::methodAt):
+        (MethodList::~MethodList):
+        * bindings/runtime.h:
+        (KJS::Bindings::MethodList::MethodList):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::RuntimeMethodImp):
+        (RuntimeMethodImp::get):
+        (RuntimeMethodImp::call):
+        * bindings/runtime_method.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::hasProperty):
+
+2004-01-16  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3531229.  Another place that needs the  Push/PopLocalFrame
+        protection implemented for 3530401.
+
+        Reviewed by John.
+
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::call):
+
+2004-01-15  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3530401.  JNI doesn't cleanup local refs created on the
+        main thread.   IMO this is a bad bug in our JMI implementation.
+
+        To work-around the problem I explicitly delete all local refs.
+        Further, I've added Push/PopLocalFrame calls to catch any refs
+        that I may have missed.  This will guarantee that we don't leak
+        any Java references.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::_commonInit):
+        (JavaClass::JavaClass):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::begin):
+        (JavaInstance::end):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaConstructor::JavaConstructor):
+        (JavaMethod::JavaMethod):
+        * bindings/jni_jsobject.cpp:
+        (JSObject::listFromJArray):
+        * bindings/runtime.h:
+        (KJS::Bindings::Instance::begin):
+        (KJS::Bindings::Instance::end):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+        (RuntimeObjectImp::hasProperty):
+        (RuntimeObjectImp::defaultValue):
+
+2004-01-15  Vicki Murley  <vicki@apple.com>
+
+        Reviewed by Darin.
+
+        * JavaScriptCore.pbproj/project.pbxproj: Update copyright date to 2004.
+
+2004-01-14  Richard Williamson   <rjw@apple.com>
+        
+        Fixed 3529466.  With recent changes to Java plugin we must no
+        longer call DeleteLocalRef().  Not a problem, it was an optimization anyway.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_instance.cpp:
+        (JObjectWrapper::JObjectWrapper):
+
+=== Safari-122 ===
+
+2004-01-14  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3529010.
+
+        Finalize may be called on an JSObject after we've already remove all our references.  The assert in this case is firing because we've received a finalize call from Java for an instance that we no longer know about.  The fix is to check in finalize that we're getting a call on an instance that we still care about.
+
+        Reviewed by John.
+
+        * bindings/jni_jsobject.cpp:
+        (addJavaReference):
+        (removeJavaReference):
+        (RootObject::removeAllJavaReferencesForRoot):
+        (JSObject::invoke):
+
+2004-01-13  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3528324. 
+
+        The run loop that is used to execute JavaScript (in practice, always the main run loop) is held in a class variable.  It is set and retained once and should not be released.  Unfortunately is it being released when the 'root' object on a LiveConnect applet is released.  This has the symptom of eventually causing an deallocation of the main run loop!  Usually after about 5 instantiations/destructions of a LiveConnect applet.  The CFRelease of the run loop was removed.
+
+        Reviewed by Hyatt.
+
+        * bindings/jni_jsobject.h:
+        (KJS::Bindings::RootObject::~RootObject):
+
+=== Safari-121 ===
+
+=== Safari-120 ===
+
+2004-01-06  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3521814.  Finalize messages weren't being dispatched!
+
+        Reviewed by John.
+
+        * bindings/jni_jsobject.cpp:
+        (JSObject::invoke):
+
+2004-01-05  Richard Williamson   <rjw@apple.com>
+
+        Added cache of JNI method IDs to minimize allocations.  This mitigates the problem
+        described by 3515579.
+
+        Also cleanup up logging of Java exceptions.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::classForInstance):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::JavaInstance):
+        (JavaInstance::getClass):
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        (JObjectWrapper::~JObjectWrapper):
+        * bindings/jni/jni_instance.h:
+        (KJS::Bindings::JavaInstance::operator=):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod):
+        (JavaMethod::methodID):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaMethod::JavaMethod):
+        * bindings/jni/jni_utility.cpp:
+        (callJNIMethod):
+        (callJNIMethodIDA):
+        (callJNIMethodA):
+        (KJS::Bindings::getMethodID):
+        (KJS::Bindings::callJNIVoidMethodIDA):
+        (KJS::Bindings::callJNIObjectMethodIDA):
+        (KJS::Bindings::callJNIByteMethodIDA):
+        (KJS::Bindings::callJNICharMethodIDA):
+        (KJS::Bindings::callJNIShortMethodIDA):
+        (KJS::Bindings::callJNIIntMethodIDA):
+        (KJS::Bindings::callJNILongMethodIDA):
+        (KJS::Bindings::callJNIFloatMethodIDA):
+        (KJS::Bindings::callJNIDoubleMethodIDA):
+        (KJS::Bindings::callJNIBooleanMethodIDA):
+        (KJS::Bindings::getCharactersFromJStringInEnv):
+        (KJS::Bindings::getUCharactersFromJStringInEnv):
+        (KJS::Bindings::getJNIField):
+        * bindings/jni/jni_utility.h:
+
+l2003-12-23  John Sullivan  <sullivan@apple.com>
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        Xcode version wars, harmless
+
+2003-12-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by John (concept, not code, which is just the old code coming back).
+
+        - fixed 3518092: REGRESSION (100-119): getting NaN instead of HH:MM times
+
+        * kjs/date_object.cpp: Added back our CF-based implementations of gmtime, localtime,
+        mktime, timegm, and time, because mktime, at least, won't handle a year of 0.
+
+2003-12-19  Richard Williamson   <rjw@apple.com>
+
+        Fixed 3515597.  When an error occurs we need
+        to make sure result values are zeroed.
+
+        Cleaned up logs by adding a newline.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::getJavaVM):
+        (KJS::Bindings::getJNIEnv):
+        (callJNIMethod):
+        (callJNIMethodA):
+        (KJS::Bindings::getJNIField):
+        * bindings/jni_jsobject.cpp:
+        (JSObject::convertValueToJObject):
+
+=== Safari-119 ===
+
+2003-12-17  Richard Williamson   <rjw@apple.com>
+
+        Ensure that all the symbols we export are in the KJS
+        namespace (3512245).
+
+        Also renamed JavaString.characters() to JavaString.UTF8String()
+        for enhanced clarity.
+
+        Added some sanity checking to constructor of JObjectWrapper.
+
+        Reviewed by Dave.
+
+        * ChangeLog:
+        * bindings/jni/jni_class.cpp:
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        (JObjectWrapper::JObjectWrapper):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaParameter::JavaParameter):
+        (JavaField::JavaField):
+        (JavaMethod::JavaMethod):
+        (JavaMethod::signature):
+        * bindings/jni/jni_runtime.h:
+        (KJS::Bindings::JavaString::ascii):
+        (KJS::Bindings::JavaString::UTF8String):
+        (KJS::Bindings::JavaString::JavaString):
+        (KJS::Bindings::JavaString::_commonInit):
+        (KJS::Bindings::JavaString::uchars):
+        (KJS::Bindings::JavaString::length):
+        (KJS::Bindings::JavaString::ustring):
+        (KJS::Bindings::JavaParameter::type):
+        (KJS::Bindings::JavaField::name):
+        (KJS::Bindings::JavaField::type):
+        (KJS::Bindings::JavaMethod::name):
+        (KJS::Bindings::JavaMethod::returnType):
+        * bindings/jni/jni_utility.cpp:
+        (KJS::Bindings::getJavaVM):
+        (KJS::Bindings::getJNIEnv):
+        (KJS::Bindings::callJNIVoidMethod):
+        (KJS::Bindings::callJNIObjectMethod):
+        (KJS::Bindings::callJNIBooleanMethod):
+        (KJS::Bindings::callJNIByteMethod):
+        (KJS::Bindings::callJNICharMethod):
+        (KJS::Bindings::callJNIShortMethod):
+        (KJS::Bindings::callJNIIntMethod):
+        (KJS::Bindings::callJNILongMethod):
+        (KJS::Bindings::callJNIFloatMethod):
+        (KJS::Bindings::callJNIDoubleMethod):
+        (KJS::Bindings::callJNIVoidMethodA):
+        (KJS::Bindings::callJNIObjectMethodA):
+        (KJS::Bindings::callJNIByteMethodA):
+        (KJS::Bindings::callJNICharMethodA):
+        (KJS::Bindings::callJNIShortMethodA):
+        (KJS::Bindings::callJNIIntMethodA):
+        (KJS::Bindings::callJNILongMethodA):
+        (KJS::Bindings::callJNIFloatMethodA):
+        (KJS::Bindings::callJNIDoubleMethodA):
+        (KJS::Bindings::callJNIBooleanMethodA):
+        (KJS::Bindings::getCharactersFromJString):
+        (KJS::Bindings::releaseCharactersForJString):
+        (KJS::Bindings::getCharactersFromJStringInEnv):
+        (KJS::Bindings::releaseCharactersForJStringInEnv):
+        (KJS::Bindings::getUCharactersFromJStringInEnv):
+        (KJS::Bindings::releaseUCharactersForJStringInEnv):
+        (KJS::Bindings::JNITypeFromClassName):
+        (KJS::Bindings::signatureFromPrimitiveType):
+        (KJS::Bindings::JNITypeFromPrimitiveType):
+        (KJS::Bindings::getJNIField):
+        (KJS::Bindings::convertValueToJValue):
+        * bindings/jni/jni_utility.h:
+        * bindings/jni_jsobject.cpp:
+        (KJS::Bindings::JSObject::invoke):
+        (KJS::Bindings::JSObject::JSObject):
+        (KJS::Bindings::JSObject::call):
+        (KJS::Bindings::JSObject::eval):
+        (KJS::Bindings::JSObject::getMember):
+        (KJS::Bindings::JSObject::setMember):
+        (KJS::Bindings::JSObject::removeMember):
+        (KJS::Bindings::JSObject::getSlot):
+        (KJS::Bindings::JSObject::setSlot):
+        (KJS::Bindings::JSObject::toString):
+        (KJS::Bindings::JSObject::finalize):
+        (KJS::Bindings::JSObject::createNative):
+        (KJS::Bindings::JSObject::convertValueToJObject):
+        (KJS::Bindings::JSObject::convertJObjectToValue):
+        (KJS::Bindings::JSObject::listFromJArray):
+        * bindings/jni_jsobject.h:
+        * bindings/runtime.cpp:
+        * bindings/runtime.h:
+        * bindings/runtime_method.cpp:
+        * bindings/runtime_method.h:
+
+=== Safari-118 ===
+
+2003-12-16  Richard Williamson   <rjw@apple.com>
+
+        Ack!  More assertions.  Lock ALL entry points into the interpreter!
+        (3511733).
+
+        Reviewed by Ken.
+
+        * bindings/jni_jsobject.cpp:
+        (Bindings::JSObject::call):
+        (Bindings::JSObject::eval):
+        (Bindings::JSObject::getMember):
+        (Bindings::JSObject::setMember):
+        (Bindings::JSObject::removeMember):
+        (Bindings::JSObject::getSlot):
+        (Bindings::JSObject::setSlot):
+        (Bindings::JSObject::convertJObjectToValue):
+
+2003-12-15  Richard Williamson   <rjw@apple.com>
+
+        Fixed a couple of snafus and removed some logging.
+
+        Reviewed by Maciej.
+
+        * bindings/jni_jsobject.cpp:
+        (Bindings::performJavaScriptAccess):
+        (Bindings::completedJavaScriptAccess):
+        (Bindings::dispatchToJavaScriptThread):
+        Removed some annoying JS_LOG clutter.
+
+        (Bindings::RootObject::removeAllJavaReferencesForRoot):
+        Fixed allocation of key buffer that was called after it was needed.
+
+        (Bindings::JSObject::invoke):
+        (Bindings::JSObject::JSObject):
+        (Bindings::JSObject::getMember):
+        (Bindings::JSObject::getSlot):
+        Added additional interpreter locks around getMember and getSlot. 
+        These functions may cause allocation of JS impls.  
+
+2003-12-15  Richard Williamson   <rjw@apple.com>
+
+        args weren't passed to 'call' invocation.  d'oh.
+        lock interpreter when we create instances of JS impls.        
+
+        Reviewed by Maciej.
+
+        * bindings/jni_jsobject.cpp:
+        (Bindings::JSObject::call):
+        (Bindings::JSObject::eval):
+        (Bindings::JSObject::getMember):
+        (Bindings::JSObject::setMember):
+        (Bindings::JSObject::getSlot):
+        (Bindings::JSObject::convertValueToJObject):
+        (Bindings::JSObject::convertJObjectToValue):
+        (Bindings::JSObject::listFromJArray):
+        * bindings/jni_jsobject.h:
+
+2003-12-15  Richard Williamson   <rjw@apple.com>
+
+        Last piece of LiveConnect!  This checkin adds implementation
+        of the Java to JavaScript object conversion functions.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_utility.cpp:
+        * bindings/jni/jni_utility.h:
+        * bindings/jni_jsobject.cpp:
+        (Bindings::JSObject::invoke):
+        (Bindings::JSObject::call):
+        (Bindings::JSObject::eval):
+        (Bindings::JSObject::getMember):
+        (Bindings::JSObject::setMember):
+        (Bindings::JSObject::getSlot):
+        (Bindings::JSObject::setSlot):
+        (Bindings::JSObject::createNative):
+        (Bindings::JSObject::convertValueToJObject):
+        (Bindings::JSObject::convertJObjectToValue):
+        (Bindings::JSObject::listFromJArray):
+        * bindings/jni_jsobject.h:
+        (Bindings::):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::get):
+        (RuntimeMethodImp::codeType):
+        (RuntimeMethodImp::execute):
+
+2003-12-12  Richard Williamson   <rjw@apple.com>
+
+        Added implementation of stubs in JSObject.  All that
+        remains is a couple of simple conversion functions stubs and
+        we're done with LiveConnect.  Also, changed string passing to
+        JS to use uchars instead of chars.  
+
+        Reviewed by Maciej.
+
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaString::JavaString):
+        (Bindings::JavaString::_commonInit):
+        (Bindings::JavaString::_commonCopy):
+        (Bindings::JavaString::_commonDelete):
+        (Bindings::JavaString::~JavaString):
+        (Bindings::JavaString::operator=):
+        (Bindings::JavaString::uchars):
+        (Bindings::JavaString::length):
+        (Bindings::JavaString::ustring):
+        * bindings/jni/jni_utility.cpp:
+        (getUCharactersFromJStringInEnv):
+        (releaseUCharactersForJStringInEnv):
+        (convertValueToJObject):
+        (convertJObjectToValue):
+        * bindings/jni/jni_utility.h:
+        * bindings/jni_jsobject.cpp:
+        (Bindings::JSObject::invoke):
+        (Bindings::JSObject::call):
+        (Bindings::JSObject::eval):
+        (Bindings::JSObject::getMember):
+        (Bindings::JSObject::setMember):
+        (Bindings::JSObject::removeMember):
+        (Bindings::JSObject::getSlot):
+        (Bindings::JSObject::setSlot):
+        * bindings/jni_jsobject.h:
+
+2003-12-12  Richard Williamson   <rjw@apple.com>
+
+        Ensure that all calls from Java into JavaScript are
+        performed on a designated thread (the main thread).
+
+        Reviewed by Ken.
+
+        * bindings/jni_jsobject.cpp:
+        (isJavaScriptThread):
+        (rootForImp):
+        (Bindings::performJavaScriptAccess):
+        (Bindings::completedJavaScriptAccess):
+        (Bindings::initializeJavaScriptAccessLock):
+        (Bindings::lockJavaScriptAccess):
+        (Bindings::unlockJavaScriptAccess):
+        (Bindings::dispatchToJavaScriptThread):
+        (Bindings::RootObject::setFindRootObjectForNativeHandleFunction):
+        (Bindings::RootObject::removeAllJavaReferencesForRoot):
+        (Bindings::JSObject::invoke):
+        (Bindings::JSObject::JSObject):
+        (Bindings::JSObject::call):
+        (Bindings::JSObject::eval):
+        (Bindings::JSObject::getMember):
+        (Bindings::JSObject::setMember):
+        (Bindings::JSObject::removeMember):
+        (Bindings::JSObject::getSlot):
+        (Bindings::JSObject::setSlot):
+        (Bindings::JSObject::toString):
+        (Bindings::JSObject::finalize):
+        (Bindings::JSObject::getWindow):
+        * bindings/jni_jsobject.h:
+        (Bindings::RootObject::~RootObject):
+        (Bindings::RootObject::findRootObjectForNativeHandleFunction):
+        (Bindings::RootObject::runLoop):
+        (Bindings::RootObject::performJavaScriptSource):
+        (Bindings::):
+
+2003-12-11  Richard Williamson   <rjw@apple.com>
+
+        Added support for calling a JavaScript function from
+        Java.  Right now this only works for void func(void)
+        functions, but the conversion of args and return values
+        will come shortly.
+
+        Cleaned up and verified reference counting scheme, and
+        dereferencing of vended JavaScript objects when applet is
+        destroyed (actually when part is destroyed).
+        
+        Removed link hack for testkjs now that the Java folks think
+        they have a solution for the 1.4.2 JavaVM link problem.  Although
+        Greg B. thinks his solution may cause problems for the 1.3.1
+        version of the VM!?!
+
+        Reviewed by Ken.
+
+        * Makefile.am:
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaString::JavaString):
+        * bindings/jni/jni_utility.cpp:
+        (convertValueToJValue):
+        (convertValueToJObject):
+        (listFromJArray):
+        * bindings/jni/jni_utility.h:
+        * bindings/jni_jsobject.cpp:
+        (KJS_setFindRootObjectForNativeHandleFunction):
+        (KJS_findRootObjectForNativeHandleFunction):
+        (getReferencesByRootDictionary):
+        (getReferencesDictionary):
+        (findReferenceDictionary):
+        (rootForImp):
+        (addJavaReference):
+        (removeJavaReference):
+        * bindings/jni_jsobject.h:
+        (Bindings::RootObject::RootObject):
+        (Bindings::RootObject::~RootObject):
+        (Bindings::RootObject::setRootObjectImp):
+        (Bindings::RootObject::rootObjectImp):
+        (Bindings::RootObject::setInterpreter):
+        (Bindings::RootObject::interpreter):
+
+=== Safari-117 ===
+
+2003-12-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed regression in JavaScript tests reported by the KDE guys
+        - fixed 3506345: REGRESSION (115-116): VIP: chordfind.com no longer displays chords
+
+        * kjs/ustring.h: Add tolerateEmptyString parameter to toDouble and toULong.
+        * kjs/ustring.cpp:
+        (KJS::UString::toDouble): Separate the "tolerant" parameter into two separate ones:
+        tolerateTrailingJunk and tolerateEmptyString. Add new overloads; better for code size
+        and binary compatibility than default parameter values.
+        (KJS::UString::toULong): Pass tolerateEmptyString down to toDouble. Add new overload.
+
+        * kjs/string_object.cpp: (StringProtoFuncImp::call): Pass false for the new
+        "tolerate empty string" parameter.
+
+2003-12-10  Richard Williamson   <rjw@apple.com>
+
+        Added code to manage reference counting of JavaScript
+        objects passed to Java.   Also added implementation of
+        KJS_JSCreateNativeJSObject.  This is the function that
+        provides the root object to Java (KJS::Window).
+
+        Reviewed by Hyatt.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/jni_jsobject.cpp:
+        (KJS_setFindObjectForNativeHandleFunction):
+        (KJS_findObjectForNativeHandleFunction):
+        (getReferencesByOwnerDictionary):
+        (getReferencesDictionary):
+        (findReferenceDictionary):
+        (addJavaReference):
+        (removeJavaReference):
+        (removeAllJavaReferencesForOwner):
+        * bindings/jni_jsobject.h:
+
+2003-12-09  Richard Williamson   <rjw@apple.com>
+
+        LiveConnect stubs that correspond to the native methods
+        on JSObject.  These will be called from the new Java plugin
+        when an instance of JSObject is instantiated and messaged.
+        When these are implemented the Java will be able to originate
+        calls into JavaScript.
+
+        Also a temporary work-around added to Makefile.am to solve
+        a link problem.  The 1.4.2 JavaVM accidentally links against
+        libobjc.  This call a failure linking testkjs.  Mike Hay is
+        working with someone to fix the problem (3505587).
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * Makefile.am:
+        * bindings/jni_jsobject.cpp: Added.
+        (KJS_JSCreateNativeJSObject):
+        (KJS_JSObject_JSFinalize):
+        (KJS_JSObject_JSObjectCall):
+        (KJS_JSObject_JSObjectEval):
+        (KJS_JSObject_JSObjectGetMember):
+        (KJS_JSObject_JSObjectSetMember):
+        (KJS_JSObject_JSObjectRemoveMember):
+        (KJS_JSObject_JSObjectGetSlot):
+        (KJS_JSObject_JSObjectSetSlot):
+        (KJS_JSObject_JSObjectToString):
+        * bindings/jni_jsobject.h: Added.
+
+2003-12-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        <rdar://problem/3505183>: JavaScriptCore should assert that interpreter is locked in collector
+
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate): Assert that interpreter lock count is not 0.
+        (KJS::Collector::collect): likewise
+
+2003-12-08  Richard Williamson   <rjw@apple.com>
+
+        LiveConnect:  The last piece of the JavaScript side of the
+        LiveConnect implementation.  This change adds support for
+        setting/getting values from Java arrays in JavaScript.
+
+        Reviewed by John.
+
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::JavaField):
+        (convertJObjectToArray):
+        (JavaArray::JavaArray):
+        (JavaArray::~JavaArray):
+        (JavaArray::setValueAt):
+        (JavaArray::valueAt):
+        (JavaArray::getLength):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaArray::operator=):
+        (Bindings::JavaArray::javaArray):
+        * bindings/jni/jni_utility.cpp:
+        (JNITypeFromPrimitiveType):
+        (convertValueToJValue):
+        * bindings/jni/jni_utility.h:
+        * bindings/runtime.h:
+        * bindings/runtime_array.cpp:
+        (RuntimeArrayImp::RuntimeArrayImp):
+        (RuntimeArrayImp::~RuntimeArrayImp):
+        (RuntimeArrayImp::get):
+        (RuntimeArrayImp::put):
+        (RuntimeArrayImp::hasProperty):
+        * bindings/runtime_array.h:
+        (KJS::RuntimeArrayImp::getLength):
+        (KJS::RuntimeArrayImp::getConcreteArray):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::canPut):
+        (RuntimeObjectImp::hasProperty):
+
+2003-12-05  Richard Williamson   <rjw@apple.com>
+
+        LiveConnect:  Part 1 of supporting JS bindings to
+        native language arrays.
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::JavaField):
+        (convertJObjectToArray):
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        * bindings/jni/jni_runtime.h:
+        * bindings/runtime.cpp:
+        (Instance::setValueOfField):
+        * bindings/runtime.h:
+        (Bindings::Array::~Array):
+
+2003-12-04  Richard Williamson   <rjw@apple.com>
+
+        LiveConnect:  Moved defaultValue into concrete implementation because
+        more intelligent conversion can be perform with knowledge
+        of the class of the original instance.
+
+        Reviewed by Chris.
+
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::isNumberClass):
+        (JavaClass::isBooleanClass):
+        (JavaClass::isStringClass):
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::defaultValue):
+        (JavaInstance::valueOf):
+        * bindings/jni/jni_instance.h:
+        (Bindings::JavaInstance::javaInstance):
+        * bindings/runtime.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::defaultValue):
+
+2003-12-04  Richard Williamson   <rjw@apple.com>
+
+        LiveConnect:  Added support for setting the value of Java
+        fields.
+
+        Reviewed by Chris.
+
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaParameter::JavaParameter):
+        (JavaField::JavaField):
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        (JavaMethod::JavaMethod):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaField::getJNIType):
+        * bindings/jni/jni_utility.cpp:
+        (JNITypeFromClassName):
+        (convertValueToJValue):
+        * bindings/jni/jni_utility.h:
+        * bindings/runtime.cpp:
+        (Instance::setValueOfField):
+        * bindings/runtime.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::defaultValue):
+
+2003-12-04  Richard Williamson   <rjw@apple.com>
+
+        Added support for string conversions.
+        Changed various JavaString member variables to be inline.
+        Implemented defaultValue for context relevant type coercion.
+
+        Reviewed by Chris.
+
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::setClassName):
+        (JavaClass::classForInstance):
+        * bindings/jni/jni_class.h:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        (JavaInstance::numberValue):
+        (JavaInstance::booleanValue):
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaParameter::JavaParameter):
+        (JavaField::JavaField):
+        (JavaMethod::JavaMethod):
+        (appendClassName):
+        (JavaMethod::signature):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaString::JavaString):
+        (Bindings::JavaString::~JavaString):
+        (Bindings::JavaString::operator=):
+        (Bindings::JavaString::characters):
+        (Bindings::JavaParameter::JavaParameter):
+        (Bindings::JavaParameter::~JavaParameter):
+        (Bindings::JavaParameter::operator=):
+        (Bindings::JavaParameter::type):
+        (Bindings::JavaField::JavaField):
+        (Bindings::JavaField::~JavaField):
+        (Bindings::JavaField::operator=):
+        (Bindings::JavaField::name):
+        (Bindings::JavaField::type):
+        (Bindings::JavaMethod::JavaMethod):
+        (Bindings::JavaMethod::_commonDelete):
+        (Bindings::JavaMethod::name):
+        (Bindings::JavaMethod::returnType):
+        * bindings/jni/jni_utility.cpp:
+        (convertValueToJValue):
+        * bindings/runtime.h:
+        (Bindings::Instance::valueOf):
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::call):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::defaultValue):
+        * bindings/runtime_object.h:
+        (KJS::RuntimeObjectImp::classInfo):
+
+=== Safari-116 ===
+
+2003-12-03  Richard Williamson   <rjw@apple.com>
+
+        LiveConnect:  Added support for parameter passing to Java and conversion
+        of return values.
+
+        Reviewed by Chris.
+
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaParameter::JavaParameter):
+        (JavaMethod::JavaMethod):
+        (JavaMethod::signature):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaParameter::JavaParameter):
+        (Bindings::JavaParameter::operator=):
+        (Bindings::JavaParameter::getJNIType):
+        * bindings/jni/jni_utility.cpp:
+        (callJNIBooleanMethodA):
+        (convertValueToJValue):
+        * bindings/jni/jni_utility.h:
+        * bindings/runtime.h:
+        * bindings/runtime_method.cpp:
+        (RuntimeMethodImp::call):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+
+2003-12-02  Richard Williamson   <rjw@apple.com>
+
+        Added support for calling simple methods in Java from JavaScript.
+        (void return and no parameters).  Yay, LiveConnect lives.
+
+        Still need write argument and return value conversion code.
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::getClass):
+        (JavaInstance::invokeMethod):
+        * bindings/jni/jni_instance.h:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod):
+        (JavaMethod::signature):
+        (JavaMethod::JNIReturnType):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaMethod::_commonDelete):
+        (Bindings::JavaMethod::_commonCopy):
+        (Bindings::JavaMethod::name):
+        * bindings/jni/jni_utility.cpp:
+        (signatureFromPrimitiveType):
+        * bindings/jni/jni_utility.h:
+        * bindings/runtime.h:
+        * bindings/runtime_method.cpp: Added.
+        (RuntimeMethodImp::RuntimeMethodImp):
+        (RuntimeMethodImp::~RuntimeMethodImp):
+        (RuntimeMethodImp::get):
+        (RuntimeMethodImp::implementsCall):
+        (RuntimeMethodImp::call):
+        (RuntimeMethodImp::codeType):
+        (RuntimeMethodImp::execute):
+        * bindings/runtime_method.h: Added.
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::get):
+        * bindings/runtime_object.h:
+        * kjs/function.cpp:
+        (FunctionImp::FunctionImp):
+        * kjs/interpreter.h:
+
+2003-12-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fixed 3493799: JavaScript string.replace expands $ if it's the last character in replacement string
+
+        * kjs/ustring.cpp: (KJS::UString::toDouble): Fix backwards handling of the "tolerant" boolean.
+        This indirectly caused the string.replace bug.
+
+2003-12-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Merged patches from Harri Porten and David Faure to fix:
+
+        <rdar://problem/3497643>: reproducible crash printing self-referential array
+        
+        * kjs/array_object.cpp:
+        (ArrayProtoFuncImp::call): Break out of the loop if an exception was thrown.
+        * kjs/nodes.cpp:
+        (FunctionCallNode::evaluate): Move function call depth check from here...
+        * kjs/object.cpp:
+        (KJS::Object::call): ...to here.
+        * kjs/object.h: Un-inline Object::call now that it does more.
+
+2003-12-01  Richard Williamson   <rjw@apple.com>
+
+        Fixed mistake in method signatures used to get boolean and integer fields.
+
+        Reviewed by Chris.
+
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+
+2003-12-01  Richard Williamson   <rjw@apple.com>
+
+Fixed parameter passing to applet.  Child elements are NOT valid in setStyle().  So we now create the widget before needed with createWidgetIfNecessary.  This either happens when doing the first layout, or when JavaScript first references the applet element.
+
+Fixed early delete of the the main applet instance.  When the JS collector cleaned up the last JS object referring to the applet instance we were deleting the java instance.  This caused the applet instance cached on the applet element to be invalid.  The applet instance is the only Java object not to be cleaned up by the JS collector.
+
+Added support for getting at Java object fields.
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * Makefile.am:
+        * bindings/jni/jni_instance.cpp:
+        (JObjectWrapper::JObjectWrapper):
+        * bindings/jni/jni_instance.h:
+        (Bindings::JObjectWrapper::~JObjectWrapper):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::~RuntimeObjectImp):
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::deleteProperty):
+        * bindings/runtime_object.h:
+
+=== Safari-115 ===
+
+2003-11-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from Harri Porten, reviewed by me.
+
+        - fixed 3491712 - String slice with negative arguments does not offset from end of string
+        
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): Handle negative arguments as offsets from end by
+        adding length and clamping to [0,length-1].
+
+2003-11-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from Harri Porten, reviewed by me.
+
+        - fixed 3491709 - using Function.apply with a primitive type as the arg list causes crash
+        
+        * kjs/function_object.cpp:
+        (FunctionProtoFuncImp::call): Nest parentheses properly.
+
+2003-11-20  Richard Williamson   <rjw@apple.com>
+
+        More LiveConnect stuff.  Primitive Java fields are now
+        accessible from JavaScript!  Yay!
+
+        Reviewed by Maciej.
+
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::methodNamed):
+        (JavaClass::fieldNamed):
+        * bindings/jni/jni_class.h:
+        (Bindings::JavaClass::_commonDelete):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::JavaInstance):
+        (JavaInstance::~JavaInstance):
+        (JavaInstance::getClass):
+        * bindings/jni/jni_instance.h:
+        (Bindings::JavaInstance::javaInstance):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaField::JavaField):
+        (JavaField::valueFromInstance):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaField::JavaField):
+        (Bindings::JavaField::~JavaField):
+        (Bindings::JavaField::operator=):
+        * bindings/jni/jni_utility.cpp:
+        (callJNIMethod):
+        (callJNIMethodA):
+        (callJNIVoidMethod):
+        (callJNIObjectMethod):
+        (callJNIBooleanMethod):
+        (callJNIByteMethod):
+        (callJNICharMethod):
+        (callJNIShortMethod):
+        (callJNIIntMethod):
+        (callJNILongMethod):
+        (callJNIFloatMethod):
+        (callJNIDoubleMethod):
+        (callJNIVoidMethodA):
+        (callJNIObjectMethodA):
+        (callJNIByteMethodA):
+        (callJNICharMethodA):
+        (callJNIShortMethodA):
+        (callJNIIntMethodA):
+        (callJNILongMethodA):
+        (callJNIFloatMethodA):
+        (callJNIDoubleMethodA):
+        (releaseCharactersForJStringInEnv):
+        (primitiveTypeFromClassName):
+        (getJNIField):
+        * bindings/jni/jni_utility.h:
+        * bindings/runtime.cpp:
+        (Instance::createBindingForLanguageInstance):
+        (Instance::getValueOfField):
+        * bindings/runtime.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::get):
+
+2003-11-20  Richard Williamson   <rjw@apple.com>
+
+        More LiveConnect stuff.
+
+        Reviewed by Chris.
+
+        * bindings/jni/jni_class.cpp:
+        (JavaClass::classForName):
+        (JavaClass::classForInstance):
+        * bindings/jni/jni_instance.cpp:
+        (JavaInstance::getValueOfField):
+        * bindings/jni/jni_instance.h:
+        (Bindings::JObjectWrapper::JObjectWrapper):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaConstructor::~JavaConstructor):
+        (Bindings::JavaConstructor::operator=):
+        (Bindings::JavaMethod::JavaMethod):
+        (Bindings::JavaMethod::_commonDelete):
+        (Bindings::JavaMethod::signature):
+        * bindings/jni/jni_utility.cpp:
+        (getJNIEnv):
+        (attachToJavaVM):
+        * bindings/jni/jni_utility.h:
+        * bindings/runtime.h:
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::~RuntimeObjectImp):
+        (RuntimeObjectImp::get):
+        * bindings/runtime_object.h:
+
+2003-11-19  Richard Williamson   <rjw@apple.com>
+
+        More LiveConnect stuff.
+
+        Reviewed by Ken.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/jni/jni_class.cpp: Added.
+        (JavaClass::_commonInit):
+        (JavaClass::JavaClass):
+        (_createClassesByNameIfNecessary):
+        (JavaClass::classForName):
+        (JavaClass::classForInstance):
+        (JavaClass::methodNamed):
+        (JavaClass::fieldNamed):
+        * bindings/jni/jni_class.h: Added.
+        (Bindings::JavaClass::_commonDelete):
+        (Bindings::JavaClass::~JavaClass):
+        (Bindings::JavaClass::_commonCopy):
+        (Bindings::JavaClass::JavaClass):
+        (Bindings::JavaClass::operator=):
+        (Bindings::JavaClass::name):
+        (Bindings::JavaClass::constructorAt):
+        (Bindings::JavaClass::numConstructors):
+        * bindings/jni/jni_instance.cpp: Added.
+        (JavaInstance::JavaInstance):
+        (JavaInstance::~JavaInstance):
+        * bindings/jni/jni_instance.h: Added.
+        (Bindings::JObjectWrapper::JObjectWrapper):
+        (Bindings::JObjectWrapper::~JObjectWrapper):
+        (Bindings::JObjectWrapper::ref):
+        (Bindings::JObjectWrapper::deref):
+        (Bindings::JavaInstance::getClass):
+        (Bindings::JavaInstance::operator=):
+        * bindings/jni/jni_runtime.cpp:
+        (JavaMethod::JavaMethod):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaString::JavaString):
+        (Bindings::JavaString::~JavaString):
+        (Bindings::JavaString::operator=):
+        * bindings/jni/jni_utility.cpp:
+        (getJavaVM):
+        (getJNIEnv):
+        (getCharactersFromJString):
+        (releaseCharactersForJString):
+        (getCharactersFromJStringInEnv):
+        (releaseCharactersForJStringInEnv):
+        * bindings/jni/jni_utility.h:
+        * bindings/runtime.cpp:
+        (Instance::createBindingForLanguageInstance):
+        * bindings/runtime.h:
+        (Bindings::Instance::):
+
+2003-11-18  Richard Williamson   <rjw@apple.com>
+
+        More live connect stubs.  We're getting close.
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * bindings/jni/jni_runtime.cpp:
+        (JavaClass::JavaClass):
+        (JavaInstance::JavaInstance):
+        (JavaInstance::~JavaInstance):
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaConstructor::value):
+        (Bindings::JavaField::value):
+        (Bindings::JavaMethod::value):
+        (Bindings::JavaClass::_commonDelete):
+        (Bindings::JavaClass::_commonCopy):
+        (Bindings::JavaClass::methodNamed):
+        (Bindings::JavaClass::fieldNamed):
+        (Bindings::JavaInstance::getClass):
+        * bindings/runtime.cpp: Added.
+        * bindings/runtime.h:
+        (Bindings::Instance::~Instance):
+        * bindings/runtime_object.cpp: Added.
+        (RuntimeObjectImp::classInfo):
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::get):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::canPut):
+        (RuntimeObjectImp::hasProperty):
+        (RuntimeObjectImp::deleteProperty):
+        (RuntimeObjectImp::defaultValue):
+        (RuntimeObjectImp::_initializeClassInfoFromInstance):
+        * bindings/runtime_object.h: Added.
+        (KJS::RuntimeObjectImp::setInternalInstance):
+        (KJS::RuntimeObjectImp::getInternalInstance):
+        * kjs/object.cpp:
+        (KJS::ObjectImp::get):
+        (KJS::ObjectImp::hasProperty):
+        * kjs/value.h:
+        (KJS::):
+
+2003-11-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from Harri, reviewed by me.
+
+        - fixed 3487375 - backwards array slice causes infinite loop
+        
+        * kjs/array_object.cpp:
+        (ArrayProtoFuncImp::call):
+
+2003-11-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Patch from Harri Porten reviewed by me.
+
+        - fixed 3487371 - operator precedence for bitwise or, xor and and is wrong
+
+        * kjs/grammar.y: Correct the precedence.
+
+2003-11-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        - fixed 3483829 - JavaScriptCore needs workaround to compile on Merlot
+        
+        * JavaScriptCore.pbproj/project.pbxproj: Add -Wno-long-double to
+        warning flags.
+
+=== Safari-114 ===
+
+2003-11-13  Richard Williamson   <rjw@apple.com>
+
+        Factored common code between copy constructor and assignment operator.
+
+        Reviewed by Chris.
+
+        * ChangeLog:
+        * bindings/jni/jni_runtime.h:
+        (Bindings::JavaConstructor::_commonCopy):
+        (Bindings::JavaConstructor::JavaConstructor):
+        (Bindings::JavaConstructor::operator=):
+        (Bindings::JavaField::type):
+        * bindings/runtime.h:
+
+2003-11-13  Richard Williamson   <rjw@apple.com>
+
+        More LiveConnect stuff.  This checkin adds abstract classes to model
+        language runtimes and a JNI based set of concrete implementations for
+        Java.
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * Makefile.am:
+        * bindings/Makefile.am: Removed.
+        * bindings/jni/Makefile.am: Removed.
+        * bindings/jni/jni_runtime.cpp: Added.
+        (JavaField::JavaField):
+        (JavaConstructor::JavaConstructor):
+        (JavaMethod::JavaMethod):
+        (JavaClass::JavaClass):
+        * bindings/jni/jni_runtime.h: Added.
+        (Bindings::JavaString::JavaString):
+        (Bindings::JavaString::~JavaString):
+        (Bindings::JavaString::operator=):
+        (Bindings::JavaString::characters):
+        (Bindings::JavaParameter::JavaParameter):
+        (Bindings::JavaParameter::~JavaParameter):
+        (Bindings::JavaParameter::operator=):
+        (Bindings::JavaParameter::type):
+        (Bindings::JavaConstructor::JavaConstructor):
+        (Bindings::JavaConstructor::~JavaConstructor):
+        (Bindings::JavaConstructor::operator=):
+        (Bindings::JavaConstructor::parameterAt):
+        (Bindings::JavaConstructor::numParameters):
+        (Bindings::JavaField::JavaField):
+        (Bindings::JavaField::~JavaField):
+        (Bindings::JavaField::operator=):
+        (Bindings::JavaField::name):
+        (Bindings::JavaField::type):
+        (Bindings::JavaMethod::JavaMethod):
+        (Bindings::JavaMethod::_commonDelete):
+        (Bindings::JavaMethod::~JavaMethod):
+        (Bindings::JavaMethod::_commonCopy):
+        (Bindings::JavaMethod::operator=):
+        (Bindings::JavaMethod::name):
+        (Bindings::JavaMethod::returnType):
+        (Bindings::JavaMethod::parameterAt):
+        (Bindings::JavaMethod::numParameters):
+        (Bindings::JavaClass::_commonDelete):
+        (Bindings::JavaClass::~JavaClass):
+        (Bindings::JavaClass::_commonCopy):
+        (Bindings::JavaClass::JavaClass):
+        (Bindings::JavaClass::operator=):
+        (Bindings::JavaClass::name):
+        (Bindings::JavaClass::methodAt):
+        (Bindings::JavaClass::numMethods):
+        (Bindings::JavaClass::constructorAt):
+        (Bindings::JavaClass::numConstructors):
+        (Bindings::JavaClass::fieldAt):
+        (Bindings::JavaClass::numFields):
+        * bindings/jni/jni_utility.cpp:
+        (callJNIMethod):
+        (callJNIMethodA):
+        (callJNIObjectMethod):
+        (callJNIByteMethod):
+        (callJNICharMethod):
+        (callJNIShortMethod):
+        (callJNIIntMethod):
+        (callJNILongMethod):
+        (callJNIFloatMethod):
+        (callJNIDoubleMethod):
+        (callJNIVoidMethodA):
+        (callJNIObjectMethodA):
+        (callJNIByteMethodA):
+        (callJNICharMethodA):
+        (callJNIShortMethodA):
+        (callJNIIntMethodA):
+        (callJNILongMethodA):
+        (callJNIFloatMethodA):
+        (callJNIDoubleMethodA):
+        (getCharactersFromJString):
+        (releaseCharactersForJString):
+        * bindings/jni/jni_utility.h:
+        * bindings/objc/Makefile.am: Removed.
+        * bindings/runtime.h: Added.
+        (Bindings::Parameter::~Parameter):
+        (Bindings::Constructor::~Constructor):
+        (Bindings::Field::~Field):
+        (Bindings::Method::~Method):
+        (Bindings::Class::~Class):
+
+2003-11-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John.
+
+        - fixed 3472562 - Null or Undefined variables passed to IN operator cause javascript exceptions
+        
+        * kjs/nodes.cpp:
+        (ForInNode::execute): If the in value is null or undefined, bail
+        out early, since attempting to iterate its properties will throw
+        an exception.
+
+2003-11-12  Darin Adler  <darin@apple.com>
+
+        - fixed the build
+
+        * Makefile.am: Fix the build by removing the bindings directory from SUBDIRS.
+        Later, we can either add this back and add the Makefile.am files to the top
+        level configure.in or leave it out and remove the Makefile.am files.
+
+2003-11-12  Richard Williamson   <rjw@apple.com>
+
+        Added utility functions for calling JNI methods.
+
+        Reviewed by Chris.
+
+        * JavaScriptCore.pbproj/project.pbxproj:
+        * Makefile.am:
+        * bindings/Makefile.am: Added.
+        * bindings/jni/Makefile.am: Added.
+        * bindings/jni/jni_utility.cpp: Added.
+        (attachToJavaVM):
+        (callJNIMethod):
+        (callJNIVoidMethod):
+        (callJNIObjectMethod):
+        (callJNIByteMethod):
+        (callJNICharMethod):
+        (callJNIShortMethod):
+        (callJNIIntMethod):
+        (callJNILongMethod):
+        (callJNIFloatMethod):
+        (callJNIDoubleMethod):
+        * bindings/jni/jni_utility.h: Added.
+        * bindings/objc/Makefile.am: Added.
+
+2003-11-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by John.
+
+        - fixed 3477528 -- array.sort(function) fails if the function returns a non-zero value that rounds to zero
+
+        * kjs/array_object.cpp:
+        (compareByStringForQSort): Added checks for undefined values to match what the specification calls for.
+        (compareWithCompareFunctionForQSort): Added checks for undefined values as above, and also changed the
+        code that looks at the compare function result to look at the number returned without rounding to an integer.
+        (ArrayProtoFuncImp::call): Changed the code that looks at the compare function result to look at the number
+        returned without rounding to an integer.
+
+=== Safari-113 ===
+
+2003-11-03  Vicki Murley <vicki@apple.com>
+
+        Reviewed by kocienda.
+
+        - fixed <rdar://problem/3471096>: non-B&I builds should not use order files, because they cause false "regressions" in perf.
+
+        * JavaScriptCore.pbproj/project.pbxproj: added empty SECTORDER_FLAGS variables to the Development and Deployment build styles
+
+2003-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - changed list manipulation to use Harri Porten's idea of a circular
+          linked list that is built from head to tail rather than building the
+          list backwards and reversing the list when done
+
+        * kjs/grammar.y: Handle CatchNode and FinallyNode in a type-safe way.
+        Change many places that passed 0L to pass nothing at all, or to pass 0.
+
+        * kjs/nodes.h:
+        (KJS::ElementNode::ElementNode): Build a circular list instead of a 0-terminated
+        backwards list.
+        (KJS::ArrayNode::ArrayNode): Break the circular list instead of reversing the list.
+        (KJS::PropertyValueNode::PropertyValueNode): Moved before ObjectLiteralNode so the
+        inline code in ObjectLiteralNode works. Build a circular list instead of a 0-terminated
+        backwards list. Made the case for the first node separate so we don't need a nil check.
+        (KJS::ObjectLiteralNode::ObjectLiteralNode): Break the circular list instead of
+        reversing the list.
+        (KJS::ArgumentListNode::ArgumentListNode): Build a circular list instead of a 0-terminated
+        backwards list. Also, made the constructors inline (moved here from .cpp file).
+        (KJS::ArgumentsNode::ArgumentsNode): Break the circular list instead of
+        reversing the list.
+        (KJS::NewExprNode::NewExprNode): Changed a 0L to 0.
+        (KJS::StatListNode::StatListNode): Make this constructor no longer inline (moved into
+        .cpp file). The one in the .cpp file builds a circular list instead of a 0-terminated
+        backwards list.
+        (KJS::VarDeclListNode::VarDeclListNode): Build a circular list instead of a 0-terminated
+        backwards list.
+        (KJS::VarStatementNode::VarStatementNode): Break the circular list instead of reversing
+        the list.
+        (KJS::BlockNode::BlockNode): Make this constructor no longer inline (moved into .cpp file).
+        The one in the .cpp file breaks the list instead of reversing it.
+        (KJS::ForNode::ForNode): Break the circular list instead of reversing the list.
+        (KJS::CaseClauseNode::CaseClauseNode): Break the circular list instead of reversing the
+        list.
+        (KJS::ClauseListNode::ClauseListNode): Build a circular list instead of a 0-terminated
+        backwards list.
+        (KJS::CaseBlockNode::CaseBlockNode): Make this constructor no longer inline (moved into
+        .cpp file). The one in the .cpp file breaks the list instead of reversing it.
+        (KJS::TryNode::TryNode): Changed constructor to take typed parameters for the catch and
+        finally nodes rather than just Node.
+        (KJS::ParameterNode::ParameterNode): Build a circular list instead of a 0-terminated
+        backwards list.
+        (KJS::FuncDeclNode::FuncDeclNode): Break the circular list instead of reversing the
+        list.
+        (KJS::FuncExprNode::FuncExprNode): Break the circular list instead of reversing the
+        list.
+
+        * kjs/nodes.cpp:
+        (StatListNode::StatListNode): Moved this constructor here, no longer inline.
+        Did the "break circular list" thing instead of the "reverse list" thing.
+        Added setLoc calls to match KJS in the KDE tree; since we don't currently
+        use the JavaScript debugging support, it's unclear whether there's any benefit, but
+        later we might be using it and it's good to be as close as possible.
+        (BlockNode::BlockNode): Moved this constructor here, no longer inline.
+        Did the "break circular list" thing instead of the "reverse list" thing.
+        Added setLoc calls.
+        (CaseBlockNode::CaseBlockNode): Moved this constructor here, no longer inline.
+        Did the "break circular list" thing instead of the "reverse list" thing.
+        (SourceElementsNode::SourceElementsNode): Moved this constructor here, no longer inline.
+        Did the "break circular list" thing instead of the "reverse list" thing.
+        Added setLoc calls.
+
+        * kjs/grammar.cpp: Regenerated.
+        * kjs/grammar.cpp.h: Regenerated.
+        * kjs/grammar.h: Regenerated.
+
+=== Safari-112 ===
+
+2003-10-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+        - fixed 3427069 - browsing mp3.com causes leaks (KJS)
+        
+        * kjs/string_object.cpp:
+        (StringProtoFuncImp::call): Don't do an early return, since that
+        could leak a temporary regexp.
+
+2003-10-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - fixed 3426076 - Leak of JS lexer data visiting http://www.ebay.com
+        
+        * kjs/grammar.cpp:
+        (yyerror): Updated the commented code.
+        * kjs/grammar.y: Don't delete string and identifier tokens when done
+        with them any more, they'll get cleaned up by the lexer now.
+        * kjs/internal.cpp:
+        (Parser::parse): Tell lexer when done parsing.
+        * kjs/lexer.cpp:
+        (Lexer::Lexer): Initialize new data members.
+        (Lexer::lex): Use new methods to make strings and identifiers, and
+        save them.
+        (Lexer::makeIdentifier): Make a new Identifier and save it in an
+        auto-growing array.
+        (Lexer::makeUString): Likewise for UStrings.
+        (Lexer::doneParsing): Clean up arrays of Ifentifiers and UStrings.
+        * kjs/lexer.h:
+
+2003-10-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Ken.
+
+        - fixed 3413962 -  malicious web pages can kill all future JavaScript execution by breaking recursion limit check
+        
+        * kjs/nodes.cpp:
+        (FunctionCallNode::evaluate): If we're going to return early due
+        to breaking the recursion limit, make sure to lower it again, or
+        it will creep up by one each time it's exceeded.
+
+2003-10-26  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCorePrefix.h: Added a C case to the NULL definition since we use C as well
+        as C++ in this project.
+
+2003-10-26  Darin Adler  <darin@apple.com>
+
+        - rolled in some CString changes Harri Porten did on the KDE side
+
+        * kjs/ustring.cpp:
+        (KJS::CString::CString): Use memcpy instead of strcpy for speed. Fix an off by one error
+        in the copy constructor.
+        (KJS::CString::operator=): Use memcpy instead of strcpy for speed.
+
+        * JavaScriptCorePrefix.h: Add a definition of NULL here that takes advantage of the GNU
+        __null feature even if the system C library doesn't.
+
+== Rolled over to ChangeLog-2003-10-25 ==
diff --git a/ChangeLog-2008-08-10 b/ChangeLog-2008-08-10
new file mode 100644
index 0000000..0912aec
--- /dev/null
+++ b/ChangeLog-2008-08-10
@@ -0,0 +1,31482 @@
+2008-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed (and updated) by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16620
+        [GTK] Autotools make dist and make check support
+
+        Get make dist working.
+
+        Note that not all possible configurations have been tested yet.
+
+        * GNUmakefile.am:
+
+2008-08-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Added same heap debug checks to more code paths.
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::put):
+        (KJS::JSActivation::putWithAttributes):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::putWithAttributes):
+        * kjs/JSObject.h:
+        (KJS::JSObject::putDirect):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTablePut):
+        (KJS::JSVariableObject::symbolTablePutWithAttributes):
+
+2008-08-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Fix some style issues in the sampling tool.
+
+        * VM/SamplingTool.cpp:
+        (KJS::sleepForMicroseconds):
+        (KJS::SamplingTool::dump):
+
+2008-08-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Revision 35651, despite being a rather trivial change, introduced a
+        large regression on the regexp-dna SunSpider test. This regression
+        stemmed from an increase in the size of CodeBlock::dump(). There is
+        no reason for this method (and several related methods) to be compiled
+        in non-debug builds with the sampling tool disabled. This patch
+        conditionally compiles them, reversing the regression on SunSpider.
+
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.cpp:
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+
+2008-08-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 20330: JSCore crash loading any filehurricane media page
+        <https://bugs.webkit.org/show_bug.cgi?id=20330>
+
+        Fix a typo in the constant loading patch. Also, add a case for
+        op_unexpected_load to CodeBlock::dump().
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addUnexpectedConstant):
+
+2008-08-08  Matt Lilek  <webkit@mattlilek.com>
+
+        Not reviewed, build fix.
+
+        * JavaScriptCore.exp:
+
+2008-08-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Improve performance of arithmetic operators
+
+        Added a fast (non-virtual) mechanism to determine if a non-immediate JSValue*
+        is a JSNumberCell.  We then use this to allow improved specialisation in many
+        arithmetic operators.  SunSpider reports a 2.5% progression overall, with greater
+        than 10% progressions on a number of arithmetic heavy tests.
+
+        * VM/Machine.cpp:
+        (KJS::fastIsNumber):
+        (KJS::fastToInt32):
+        (KJS::fastToUInt32):
+        (KJS::jsLess):
+        (KJS::jsLessEq):
+        (KJS::jsAdd):
+        (KJS::Machine::privateExecute):
+        * kjs/JSNumberCell.h:
+        (KJS::JSNumberCell::fastToInt32):
+        (KJS::JSNumberCell::fastToUInt32):
+        * kjs/collector.cpp:
+        (KJS::allocateBlock):
+        (KJS::Heap::heapAllocate):
+        * kjs/collector.h:
+        (KJS::Heap::fastIsNumber):
+
+2008-08-06  Adam Roben  <aroben@apple.com>
+
+        Try to fix the Windows build bots
+
+        * API/JSBase.cpp: Touch this to force JSC to rebuild and re-copy the
+        WTF headers.
+
+2008-08-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Revert change 35595.
+
+        * wtf/RetainPtr.h:
+
+2008-08-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Fix non-Mac build.
+
+        * wtf/RetainPtr.h: CoreFoundation only for PLATFORM(MAC)
+
+2008-08-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Fix non-Mac build.
+
+        * wtf/RetainPtr.h: CoreFoundation only for PLATFORM(MAC)
+
+2008-08-06  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Darin. Landed by Cameron.
+
+        Bug 20272: typo in JavaScriptCore
+        <https://bugs.webkit.org/show_bug.cgi?id=20272>
+
+        Correct the documentation for op_not. (typo)
+        Fix #undef. (typo)
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-08-06  Cameron Zwarich  <cwzwarich@webkit.org>
+
+        Reviewed by Maciej.
+
+        Bug 20286: Load constants all at once instead of using op_load
+        <https://bugs.webkit.org/show_bug.cgi?id=20286>
+
+        Load constants all at once into temporary registers instead of using
+        individual instances of op_load.
+
+        This is a 2.6% speedup on SunSpider.
+
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        (KJS::CodeBlock::mark):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::newTemporary):
+        (KJS::CodeGenerator::addConstant):
+        (KJS::CodeGenerator::addUnexpectedConstant):
+        (KJS::CodeGenerator::emitLoad):
+        (KJS::CodeGenerator::emitUnexpectedLoad):
+        (KJS::CodeGenerator::emitNewError):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::throwException):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * VM/RegisterID.h:
+        (KJS::RegisterID::RegisterID):
+        (KJS::RegisterID::makeConstant):
+        (KJS::RegisterID::isTemporary):
+        * kjs/NodeInfo.h:
+        * kjs/Parser.cpp:
+        (KJS::Parser::didFinishParsing):
+        * kjs/Parser.h:
+        (KJS::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::NullNode::emitCode):
+        (KJS::BooleanNode::emitCode):
+        (KJS::NumberNode::emitCode):
+        (KJS::StringNode::emitCode):
+        (KJS::ArrayNode::emitCode):
+        (KJS::DeleteResolveNode::emitCode):
+        (KJS::DeleteValueNode::emitCode):
+        (KJS::VoidNode::emitCode):
+        (KJS::ConstDeclNode::emitCodeSingle):
+        (KJS::ReturnNode::emitCode):
+        (KJS::ScopeNode::ScopeNode):
+        (KJS::ProgramNode::ProgramNode):
+        (KJS::ProgramNode::create):
+        (KJS::EvalNode::EvalNode):
+        (KJS::EvalNode::create):
+        (KJS::FunctionBodyNode::FunctionBodyNode):
+        (KJS::FunctionBodyNode::create):
+        (KJS::FunctionBodyNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::ScopeNode::neededConstants):
+
+2008-08-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron.
+
+        - add fast path for immediates to % operator, as we have for many other math ops
+        
+        This fixes handling for a 0 divisor relative to the last patch. Only an 0.2% speedup on SunSpider but
+        still a 1.4x win on Oliver's prime test.
+        
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-08-05  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Bug 20293: Crash in JavaScript codegen for eval("const a;")
+        <https://bugs.webkit.org/show_bug.cgi?id=20293>
+
+        Correctly handle constant declarations in eval code with no initializer.
+
+        * kjs/nodes.cpp:
+        (KJS::ConstDeclNode::emitCodeSingle):
+
+2008-08-05  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Roll out r35555 because of correctness issues.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-08-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - add fast path for immediates to % operator, as we have for many other math ops
+        
+        0.6% speedup on SunSpider. 1.4x speedup on a prime testing torture test that Oliver whipped up.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-07-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 19359: JavaScriptCore behaves differently from FF2/3 and IE when handling context in catch statement
+        <https://bugs.webkit.org/show_bug.cgi?id=19359>
+
+        Make our catch behave like Firefox and IE, we do this by using a StaticScopeObject
+        instead of a generic JSObject for the scope node.  We still don't make use of the
+        fact that we have a static scope inside the catch block, so the internal performance
+        of the catch block is not improved, even though technically it would be possible to
+        do so.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitPushNewScope):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::createExceptionScope):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/JSStaticScopeObject.cpp:
+        (KJS::JSStaticScopeObject::toThisObject):
+        (KJS::JSStaticScopeObject::put):
+        * kjs/JSStaticScopeObject.h:
+        * kjs/nodes.cpp:
+        (KJS::TryNode::emitCode):
+
+2008-08-02  Rob Gowin  <robg@gowin.net>
+
+        Reviewed by Eric Seidel.
+
+        Added JavaScriptCore/API/WebKitAvailability to list of files in
+        javascriptcore_h_api.
+
+        * GNUmakefile.am:
+
+2008-08-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Maciej.
+
+        Remove JSGlobalData::DataInstance. It was only needed when we had per-thread JSGlobalData
+        instances.
+
+        * kjs/JSGlobalData.h:
+
+2008-07-31  Kevin Ollivier <kevino@theolliviers.com>
+
+        Second attempt at Windows/wx build fix. Instead of avoiding inclusion of windows.h,
+        use defines, etc. to avoid conflicts in each affected file. Also, change PLATFORM(WIN)
+        to PLATFORM(WIN_OS) so that other ports using Windows headers get the right impls.
+
+        * VM/SamplingTool.cpp:
+        * wtf/Threading.h:
+
+2008-07-31  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam.
+
+        Fix Windows build.
+        
+        * kjs/collector.h:
+        * wtf/FastMalloc.cpp:
+
+2008-07-31  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon.
+
+        Bug 20170: [Qt] missing namespace defines in JavaScriptCore.pro
+        <https://bugs.webkit.org/show_bug.cgi?id=20170>
+
+        * JavaScriptCore.pro: Added missing define.
+
+2008-07-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Maciej.
+
+        Eliminate JSLock (it was already disabled, removing the stub implementaion and all
+        call sites now).
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        * API/JSCallbackConstructor.cpp:
+        (KJS::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::init):
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::construct):
+        (KJS::::hasInstance):
+        (KJS::::call):
+        (KJS::::getPropertyNames):
+        (KJS::::toNumber):
+        (KJS::::toString):
+        (KJS::::staticValueGetter):
+        (KJS::::callbackGetter):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRetain):
+        (JSGlobalContextRelease):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSStringRef.cpp:
+        (JSStringRelease):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * ForwardingHeaders/JavaScriptCore/JSLock.h: Removed.
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject):
+        (KJS::JSGlobalObject::init):
+        * kjs/JSLock.cpp: Removed.
+        * kjs/JSLock.h: Removed.
+        * kjs/Shell.cpp:
+        (functionGC):
+        (jscmain):
+        * kjs/collector.cpp:
+        (KJS::Heap::~Heap):
+        (KJS::Heap::heapAllocate):
+        (KJS::Heap::setGCProtectNeedsLocking):
+        (KJS::Heap::protect):
+        (KJS::Heap::unprotect):
+        (KJS::Heap::collect):
+        * kjs/identifier.cpp:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::checkSyntax):
+        (KJS::Interpreter::evaluate):
+
+2008-07-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix the Mac project to not display "test/" as part of file name for tests.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-07-31  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Rename USE(MULTIPLE_THREADS) to ENABLE(JSC_MULTIPLE_THREADS)
+        to better match the use/enable pattern (and better describe
+        the usage of the feature in question.)
+        
+        I also fixed a couple other ENABLE_ macros to be pre-processor
+        definition override-able to match the rest of the ENABLE_ macros
+        since it seems to be our convention that build systems can set
+        ENABLE_ macros in Makefiles.
+
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreadingOnce):
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        (KJS::JSGlobalData::~JSGlobalData):
+        * kjs/MathObject.cpp:
+        * kjs/collector.cpp:
+        (KJS::Heap::Heap):
+        (KJS::Heap::~Heap):
+        (KJS::allocateBlock):
+        (KJS::Heap::markStackObjectsConservatively):
+        * kjs/collector.h:
+        * kjs/dtoa.cpp:
+        (KJS::pow5mult):
+        (KJS::rv_alloc):
+        (KJS::freedtoa):
+        (KJS::dtoa):
+        * wtf/FastMalloc.cpp:
+        * wtf/Platform.h:
+        * wtf/RefCountedLeakCounter.cpp:
+
+2008-07-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mark Rowe.
+        
+        Try to clean up our usage of USE(MULTIPLE_THREADS) vs. USE(PTHREADS) a little.
+        It looks like JSC assumes that if MULTIPLE_THREADS is defined, then pthreads will always be available
+        I'm not sure that's always the case for gtk, certainly not for Windows.  We should eventually go back
+        and fix wtf/Threading.h to cover all these cases some day.
+
+        * kjs/JSLock.cpp:
+        * kjs/collector.h:
+        * wtf/Platform.h:
+
+2008-07-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver.
+        
+        MSVC warns when structs are called classes or vice versa.
+        Make all the source refer to JSGlobalData as a class.
+
+        * kjs/CommonIdentifiers.h:
+        * kjs/JSGlobalData.h:
+        * kjs/Parser.h:
+        * kjs/lexer.h:
+
+2008-07-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Add consistency checks to UString to document and enforce its design.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::create):
+        (KJS::UString::Rep::destroy):
+        (KJS::UString::Rep::checkConsistency):
+        (KJS::UString::expandCapacity):
+        (KJS::UString::expandPreCapacity):
+        (KJS::UString::UString):
+        (KJS::UString::spliceSubstringsWithSeparators):
+        (KJS::UString::append):
+        * kjs/ustring.h:
+        (KJS::UString::Rep::checkConsistency):
+
+2008-07-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fixes for Windows and non-AllInOne file build with SamplingTool, plus review fixes.
+
+        * GNUmakefile.am:              Adding SamplingTool.cpp to build.
+        * JavaScriptCore.exp:          Export hooks to init & control SamplingTool.
+        * JavaScriptCore.pri:          Adding SamplingTool.cpp to build.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Adding SamplingTool.cpp to build.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Adding SamplingTool.cpp to build.
+        * JavaScriptCoreSources.bkl:   Adding SamplingTool.cpp to build.
+        * VM/Machine.cpp:              MACHINE_SAMPLING_callingNativeFunction renamed MACHINE_SAMPLING_callingHostFunction
+        * VM/Machine.h:
+        * VM/Opcode.cpp:               SamplingTool moved to SamplingTool.cpp/.h, opcodeNames generated from FOR_EACH_OPCODE_ID.
+        * VM/Opcode.h:
+        * VM/SamplingTool.cpp:         Added .cpp/.h for SamplingTool.
+        * VM/SamplingTool.h:
+        * kjs/Shell.cpp:               Switched SAMPLING_TOOL_ENABLED to ENABLE_SAMPLING_TOOL.
+        * wtf/Platform.h:              Added ENABLE_SAMPLING_TOOL config option.
+        * kjs/nodes.cpp:               Header include to fix non-AllInOne builds.
+
+2008-07-30  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix compilation without multi-threading support.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::Heap):
+
+2008-07-30  Anders Carlsson  <andersca@apple.com>
+        
+        Add WebKitAvailability.h forwarding header.
+        
+        * ForwardingHeaders/JavaScriptCore/WebKitAvailability.h: Added.
+
+2008-07-30  Anders Carlsson  <andersca@apple.com>
+
+        Fix the else.
+        
+        * API/WebKitAvailability.h:
+
+2008-07-30  Anders Carlsson  <andersca@apple.com>
+
+        * API/WebKitAvailability.h:
+        Fix Windows (and other non-Mac builds).
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Add WebKitAvailability.h to the project.
+
+2008-07-30  Anders Carlsson  <andersca@apple.com>
+
+        One step closer towards fixing the Windows build.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Make sure to copy WebKitAvailability.h
+
+2008-07-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 20209: Atomize constant strings
+        <https://bugs.webkit.org/show_bug.cgi?id=20209>
+
+        Prevents significant performance degradation seen when a script contains multiple
+        identical strings that are used as keys to identify properties on objects.
+
+        No performance change on SunSpider.
+
+        * kjs/nodes.cpp: Atomize constant strings.
+
+2008-07-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/6111648> JavaScript exceptions fail if the scope chain includes the global object
+
+        In an attempt to remove the branch I just added to KJS::depth I
+        used the existence of a Variable Object at a point in the scope
+        chain as an indicator of function or global scope activation.
+        However this assumption results in incorrect behaviour if the
+        global object is injected into the scope chain with 'with'.
+
+        * VM/Machine.cpp:
+        (KJS::depth):
+
+2008-07-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Don't call JSGarbageCollect() on a released context.
+
+        * API/testapi.c: (main):
+
+2008-07-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Implement JSContextGroup APIs to make concurrent execution possible for
+        JavaScriptCore clients.
+
+        This changes the behavior of JSGlobalContextCreate(), so that it now uses a private context
+        group for each context, making JSlock implicit locking unnecessary.
+
+        * API/JSContextRef.h:
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        (JSContextGroupRetain):
+        (JSContextGroupRelease):
+        (JSGlobalContextCreate):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRelease):
+        (JSContextGetGroup):
+        Added new methods. JSGlobalContextCreate() calls JSGlobalContextCreateInGroup() now.
+
+        * API/APICast.h: (toJS): (toRef): Added converters for JSContextGroupRef.
+        * API/JSBase.cpp: (JSGarbageCollect): JSGarbageCollect(0) is now a no-op, and the passed in
+        context is actually used.
+
+        * API/JSBase.h: Aded a typedef for JSContextGroupRef. Updated documentation for
+        JSGarbageCollect().
+
+        * JavaScriptCore.exp: Removed JSGlobalData::sharedInstance().
+
+        * kjs/JSGlobalData.cpp:
+        * kjs/JSGlobalData.h:
+        Removed support for JSGlobalData shared instance. JSGlobalData::isSharedInstance member
+        variable still remains, to be deleted in a followup patch.
+
+        * kjs/JSLock.cpp: (KJS::JSLock::JSLock): Disabled JSLock, to be deleted in a follow-up patch.
+        
+        * kjs/collector.cpp:
+        (KJS::Heap::markOtherThreadConservatively): Removed an assertion that referenced
+        JSGlobalData::sharedInstance.
+
+        * kjs/collector.h: Made Heap destructor public, so that JSContextRelease can use it.
+
+2008-07-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Fix a leak of ThreadRegistrar objects.
+
+        As the heap is usually deleted when registered threads still exist, ThreadSpecific doesn't
+        have a chance to clean up per-thread object. Switched to native pthread calls, storing a
+        plain pointer that doesn't require cleanup.
+
+        * kjs/collector.cpp:
+        (KJS::PlatformThread::PlatformThread):
+        (KJS::Heap::Thread::Thread):
+        (KJS::Heap::Heap):
+        (KJS::Heap::~Heap):
+        (KJS::Heap::registerThread):
+        (KJS::Heap::unregisterThread):
+        * kjs/collector.h:
+
+2008-07-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20169
+        Memory allocated with fastMalloc is freed with delete
+
+        * VM/JSPropertyNameIterator.cpp:
+        (KJS::JSPropertyNameIterator::invalidate): Free the array properly.
+        (KJS::JSPropertyNameIterator::~JSPropertyNameIterator): Delete the array by calling
+        invalidate().
+
+2008-07-29  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Qt build.
+
+        * wtf/ThreadingQt.cpp: Add the extra argument to createThread.
+
+2008-07-29  Adam Roben  <aroben@apple.com>
+
+        Change Vector::find to return an index instead of an iterator
+
+        Indices are more natural than iterators when working with Vector.
+
+        Reviewed by John Sullivan.
+
+        * wtf/Vector.h:
+        (WTF::Vector::find): Changed to iterate the Vector manually and return
+        the index of the found item, rather than an iterator. When the item
+        could not be found, we return WTF::notFound.
+
+2008-07-29  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::setThreadName): Move a misplaced assertion to here...
+        (WTF::createThread): ...from here.
+
+2008-07-29  Adam Roben  <aroben@apple.com>
+
+        Add support for setting thread names on Windows
+
+        These thread names make it much easier to identify particular threads
+        in Visual Studio's Threads panel.
+
+        WTF::createThread now takes a const char* representing the thread's
+        name. On Windows, we throw a special exception to set this string as
+        the thread's name. Other platforms do nothing with this name for now.
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.exp: Export the new version of createThread that
+        takes 3 arguments (the old one continues to be exported for backward
+        compatibility).
+        * wtf/Threading.h: Add a threadName argument to createThread.
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::createThread):
+        * wtf/ThreadingNone.cpp:
+        (WTF::createThread):
+        Updated for function signature change.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::createThread): Updated for function signature change. We keep
+        around the old 2-argument version of createThread for backward
+        compatibility.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::setThreadName): Added. This function's implementation came from
+        MSDN.
+        (WTF::initializeThreading): Set the name of the main thread.
+        (WTF::createThread): Call setThreadName. We keep around the old
+        2-argument version of createThread for backward compatibility.
+
+2008-07-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Store UString::Rep::isStatic bit in identifierTable pointer instead of reportedCost for
+        slightly nicer code and a 0.5% SunSpider improvement.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * API/JSStringRef.cpp:
+        (JSStringRelease):
+        * kjs/PropertyNameArray.cpp:
+        (KJS::PropertyNameArray::add):
+        * kjs/identifier.cpp:
+        (KJS::IdentifierTable::~IdentifierTable):
+        (KJS::IdentifierTable::add):
+        (KJS::Identifier::addSlowCase):
+        (KJS::Identifier::remove):
+        * kjs/identifier.h:
+        (KJS::Identifier::add):
+        * kjs/ustring.cpp:
+        (KJS::):
+        (KJS::UString::Rep::create):
+        (KJS::UString::Rep::destroy):
+        * kjs/ustring.h:
+        (KJS::UString::Rep::identifierTable):
+        (KJS::UString::Rep::setIdentifierTable):
+        (KJS::UString::Rep::isStatic):
+        (KJS::UString::Rep::setStatic):
+        (KJS::UString::cost):
+
+2008-07-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed "ConstructTypeNative" => "ConstructTypeHost".
+        
+2008-07-26  Mark Rowe  <mrowe@apple.com>
+
+        Speculative fix for the wx build.
+
+        * JavaScriptCoreSources.bkl:  Add JSStaticScopeObject.cpp to the list of source files.
+
+2008-07-25  Oliver Hunt  <oliver@apple.com>
+
+        RS=Cameron Zwarich.
+
+        Whoops, forgot to save style correction.
+
+        * kjs/JSStaticScopeObject.h:
+
+2008-07-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 19718: Named anonymous functions are slow accessing global variables
+        <https://bugs.webkit.org/show_bug.cgi?id=19718>
+
+        To fix this we switch over to an activation-like scope object for
+        on which we attach the function name property, and add logic to 
+        prevent cross scope assignment to read only properties.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::findScopedProperty):
+        (KJS::CodeGenerator::emitResolve):
+        * VM/CodeGenerator.h:
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSStaticScopeObject.cpp: Added.
+        (KJS::JSStaticScopeObject::putWithAttributes):
+        (KJS::JSStaticScopeObject::isDynamicScope):
+        (KJS::JSStaticScopeObject::~JSStaticScopeObject):
+        (KJS::JSStaticScopeObject::getOwnPropertySlot):
+        * kjs/JSStaticScopeObject.h: Added.
+        (KJS::JSStaticScopeObject::JSStaticScopeObjectData::JSStaticScopeObjectData):
+        (KJS::JSStaticScopeObject::JSStaticScopeObject):
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallResolveNode::emitCode):
+        (KJS::PostfixResolveNode::emitCode):
+        (KJS::PrefixResolveNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+        (KJS::AssignResolveNode::emitCode):
+        (KJS::FuncExprNode::makeFunction):
+
+2008-07-25  kevino  <kevino@theolliviers.com>
+
+        wx build fix for Win.
+        
+        On wx/Win, including windows.h in Threading.h causes multiply-defined symbol errors
+        for libjpeg and wx, and also wx needs to include windows.h itself first for wx
+        includes to work right. So until we can find a better solution to this problem,
+        on wx, we work around the need to include windows.h here.
+
+        * wtf/Threading.h:
+
+2008-07-25  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add API/ to the
+        include path.
+
+2008-07-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the build of jsc on Qt/Windows, make sure os-win32 is in the
+        include search path (added by WebKit.pri).
+
+        * kjs/jsc.pro:
+
+2008-07-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Move JavaScriptCore API tests into a subdirectory of their own to avoid header name
+        conflicts and developer confusion.
+
+        * API/JSNode.c: Removed.
+        * API/JSNode.h: Removed.
+        * API/JSNodeList.c: Removed.
+        * API/JSNodeList.h: Removed.
+        * API/Node.c: Removed.
+        * API/Node.h: Removed.
+        * API/NodeList.c: Removed.
+        * API/NodeList.h: Removed.
+        * API/minidom.c: Removed.
+        * API/minidom.html: Removed.
+        * API/minidom.js: Removed.
+        * API/testapi.c: Removed.
+        * API/testapi.js: Removed.
+        * API/tests: Added.
+        * API/tests/JSNode.c: Copied from JavaScriptCore/API/JSNode.c.
+        * API/tests/JSNode.h: Copied from JavaScriptCore/API/JSNode.h.
+        * API/tests/JSNodeList.c: Copied from JavaScriptCore/API/JSNodeList.c.
+        * API/tests/JSNodeList.h: Copied from JavaScriptCore/API/JSNodeList.h.
+        * API/tests/Node.c: Copied from JavaScriptCore/API/Node.c.
+        * API/tests/Node.h: Copied from JavaScriptCore/API/Node.h.
+        * API/tests/NodeList.c: Copied from JavaScriptCore/API/NodeList.c.
+        * API/tests/NodeList.h: Copied from JavaScriptCore/API/NodeList.h.
+        * API/tests/minidom.c: Copied from JavaScriptCore/API/minidom.c.
+        * API/tests/minidom.html: Copied from JavaScriptCore/API/minidom.html.
+        * API/tests/minidom.js: Copied from JavaScriptCore/API/minidom.js.
+        * API/tests/testapi.c: Copied from JavaScriptCore/API/testapi.c.
+        * API/tests/testapi.js: Copied from JavaScriptCore/API/testapi.js.
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-07-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective WX build fix, add JavaScriptCore/API to the include search
+        path.
+
+        * jscore.bkl:
+
+2008-07-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Rubber-stamped by Lars.
+
+        Fix the build on Windows. operator new for ArgList is implemented using fastMalloc()
+        but operator delete was not implemented. Unfortunately MSVC decides to call/reference
+        the function, so a simple implementation using fastFree() fixes the build.
+
+        * kjs/ArgList.h:
+        (KJS::ArgList::operator delete):
+
+2008-07-25  Simon Hausmann  <hausmann@webkit.org>
+
+        Discussed with and rubber-stamped by Lars.
+
+        Fix the build system for the Qt port.
+
+        Recent JavaScriptCore changes require the addition of JavaScriptCore/API to the
+        include search path. With a build process that combines JavaScriptCore and
+        WebCore in one build process/Makefile the existance of
+        JavaScriptCore/API/Node.h and WebCore/dom/Node.h causes include conflicts.
+
+        This commit solves this by introducing a separate build of JavaScriptCore into
+        a static library.
+
+        As a result of the split-up a race-condition due to broken dependencies of
+        regular source files to header files of generated sources showed up very
+        frequently when doing parallel builds (which the buildbot does). This commit at
+        the same time tries to address the dependency problem by making the
+        addExtraCompiler() function also generate a pseudo extra compiler that
+        represents the header file output, so that qmake is aware of the creation of
+        the header file for dependency calculation.
+
+        At the same time I removed a lot of cruft from the pro files to ease maintenance.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro: Added.
+        * kjs/jsc.pro:
+
+2008-07-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed a strict aliasing violation, which caused hash tables with floating
+        point keys not to find items that were indeed in the tables
+        (intermittently, and only in release builds, of course).
+        
+        SunSpider reports no change.
+        
+        This bug doesn't seem to affect any existing code, but it causes obvious
+        crashes in some new code I'm working on.
+
+        * wtf/HashFunctions.h:
+        (WTF::FloatHash::hash): Use a union when punning between a float / double
+        and an unsigned (bucket of bits). With strict aliasing enabled, unions
+        are the only safe way to do this kind of type punning.
+
+        * wtf/HashTable.h: When rehashing, ASSERT that the item we just added to
+        the table is indeed in the table. In the buggy case described above, this
+        ASSERT fires.
+
+2008-07-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 20142: REGRESSION(r35245): /=/ weirdness
+        <https://bugs.webkit.org/show_bug.cgi?id=20142>
+
+        When adding all the meta data needed for exception error messages
+        I accidentally clobbered the handling of regex beginning with /=.
+
+        * kjs/grammar.y:
+
+2008-07-23  Alp Toker  <alp@nuanti.com>
+
+        Build fix after r35293: Add API/ to the include path.
+
+        * GNUmakefile.am:
+
+2008-07-23  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes
+
+        Build fix after r35293:
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add API/
+        to the include path.
+
+        Build fix after r35305:
+
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * VM/Opcode.cpp:
+        * VM/Opcode.h:
+        Completely compile out all sampler-related code when
+        SAMPLING_TOOL_ENABLED is 0. The sampler code can't be compiled 1) on
+        non-AllInOne configurations due to circular header dependencies, and
+        2) on platforms that don't have a usleep() function, such as Windows.
+
+2008-07-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen and Sam Weinig.
+
+        Improve switch performance.
+
+        Improve switch performance by converting to a hashmap based jump
+        table to avoid the sequence of dispatches that would otherwise be
+        needed.  This results in a 9-19x performance win for string switches
+        based on ad hoc testing, and a 6x improvement for integer switch
+        statements.  SunSpider reports a 1.2% progression.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        (KJS::SimpleJumpTable::offsetForValue):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::beginSwitch):
+        (KJS::prepareJumpTableForImmediateSwitch):
+        (KJS::prepareJumpTableForCharacterSwitch):
+        (KJS::prepareJumpTableForStringSwitch):
+        (KJS::CodeGenerator::endSwitch):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::offsetForStringSwitch):
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.cpp:
+        (KJS::):
+        * VM/Opcode.h:
+        * kjs/JSImmediate.h:
+        * kjs/nodes.cpp:
+        (KJS::):
+        (KJS::processClauseList):
+        (KJS::CaseBlockNode::tryOptimisedSwitch):
+        (KJS::CaseBlockNode::emitCodeForBlock):
+        * kjs/nodes.h:
+        (KJS::SwitchInfo::):
+
+2008-07-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Sampling tool to analyze cost of instruction execution and identify hot regions of JS code.
+        Enable Switches by setting SAMPLING_TOOL_ENABLED in Opcode.h.
+
+        * JavaScriptCore.exp: Export symbols for Shell.cpp.
+        * VM/Machine.cpp:     Added sampling hooks.
+        * VM/Machine.h:       Machine contains a pointer to a sampler, when sampling.
+        * VM/Opcode.cpp:      Tool implementation.
+        * VM/Opcode.h:        Tool declaration.
+        * kjs/Shell.cpp:      Initialize the sampler, if enabled.
+        * kjs/nodes.cpp:      Added sampling hooks.
+
+2008-07-23  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Bug 20097: [Qt] 20% Sunspider slow-down
+
+        <https://bugs.webkit.org/show_bug.cgi?id=20097>
+
+        Reviewed by Simon Hausmann.
+
+        * kjs/jsc.pro: Added missing NDEBUG define for release builds.
+
+2008-07-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        JSClassRef is created context-free, but gets infatuated with the first context it sees.
+
+        The implicit API contract is that JSClassRef can be used with any context on any thread.
+        This no longer worked, because UStrings in the class were turned into per-context
+        identifiers, and the cached JSObject prototype was tied to JSGlobalData, too.
+
+        * API/JSClassRef.h: Made a separate struct for context-dependent parts of OpaqueJSClass.
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass): Updated for renames and changed member variable order.
+        (OpaqueJSClass::~OpaqueJSClass): Assert that string members are not identifiers.
+        (clearReferenceToPrototype): Update for the new reference location.
+        (OpaqueJSClassContextData::OpaqueJSClassContextData): Make a deep copy of all strings.
+        (OpaqueJSClass::contextData): Added a function that finds the per-context part of
+        OpaqueJSClass in JSGlobalData, or creates it if not found.
+        (OpaqueJSClass::className): Always make a deep copy. Callers of this function do not have
+        a way to access JSGlobalData, so a per-context copy could not be made.
+        (OpaqueJSClass::staticValues): Updated for new data location.
+        (OpaqueJSClass::staticFunctions): Ditto.
+        (OpaqueJSClass::prototype): Changed to take an internal type for consistency.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        (KJS::JSGlobalData::~JSGlobalData):
+        * kjs/JSGlobalData.h:
+        Keep a HashMap to access per-context JSClass data given a pointr to the shared part.
+
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::className):
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::getPropertyNames):
+        (KJS::::staticValueGetter):
+        (KJS::::staticFunctionGetter):j
+        Use function accessors instead of accessing OpaqueJSClass members directly.
+
+        * API/JSContextRef.cpp: (JSGlobalContextCreate): Updated for the change in
+        OpaqueJSClass::prototype() argument type.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMake): Updated for the change in OpaqueJSClass::prototype() argument type.
+        (JSObjectMakeConstructor): Ditto.
+
+2008-07-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * kjs/ArgList.h: (KJS::ArgList::operator new): removed an extraneous "ArgList::" inside the
+        class definition.
+
+2008-07-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Sam Weinig.
+
+        Next step toward putting doubles in registers: Prepare the Register class
+        and its clients for registers that don't contain JSValue*s.
+        
+        This means a few things:
+        
+        1. Register::jsValue() clients, including ArgList clients, must now supply
+        an ExecState* when accessing an entry in an ArgList, in case the entry
+        will need to create a JSValue* on the fly.
+        
+        2. Register clients that definitely don't want to create a JSValue* on
+        the fly now use different APIs: getJSValue() for clients that know
+        the register contains a JSValue*, and v() for clients who just want a
+        void*.
+        
+        3. I had to change some headers around in order to resolve dependency
+        problems created by using a Register in the ArgList header.
+        
+        SunSpider reports no change.
+        
+2008-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Prevent integer overflow when reallocating storage vector for arrays.
+
+        Sunspider reports 1.005x as fast (no change expected).
+
+        * kjs/JSArray.cpp:
+
+2008-07-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6091287> Revamp the handling of CFBundleShortVersionString to be fixed at the major component of the version number.
+
+        * Configurations/Version.xcconfig:
+        * Info.plist:
+
+2008-07-21  Adam Roben  <aroben@apple.com>
+
+        Add Vector::find
+
+        This is a convenience wrapper around std::find.
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Vector.h:
+
+2008-07-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 20104: Exception in tables/mozilla_expected_failures/bugs/bug92868_1.html includes the equals operator in the quoted expression
+        <https://bugs.webkit.org/show_bug.cgi?id=20104>
+
+        To make this correct we make the dot and bracket assign nodes emit the information to indicate
+        the failure range is the dot/bracket accessor.
+
+        * kjs/grammar.y:
+
+2008-07-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (KJS::isStrWhiteSpace):
+
+2008-07-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * kjs/nodes.h:
+        (KJS::ThrowableExpressionData::ThrowableExpressionData):
+
+2008-07-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 18774: SQUIRRELFISH: print meaningful error messages <https://bugs.webkit.org/show_bug.cgi?id=18774>
+        <rdar://problem/5769353> SQUIRRELFISH: JavaScript error messages are missing informative text
+
+        Add support for decent error messages in JavaScript.  This patch achieves this by providing
+        ensuring the common errors and exceptions have messages that provide the text of expression
+        that trigger the exception.  In addition it attaches a number of properties to the exception
+        object detailing where in the source the expression came from.
+
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::lineNumberForVPC):
+        (KJS::CodeBlock::expressionRangeForVPC): 
+            Function to recover the expression range for an instruction
+            that triggered an exception.
+        * VM/CodeBlock.h:
+        (KJS::ExpressionRangeInfo::):
+        (KJS::CodeBlock::CodeBlock):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCall):
+        (KJS::CodeGenerator::emitCallEval):
+            Emit call needed to be modified so to place the expression range info internally,
+            as the CodeGenerator emits the arguments nodes itself, rather than the various call
+            nodes.
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::emitExpressionInfo):
+            Record the expression range info.
+        * VM/ExceptionHelpers.cpp:
+        (KJS::createErrorMessage):
+        (KJS::createInvalidParamError):
+        (KJS::createUndefinedVariableError):
+        (KJS::createNotAConstructorError):
+        (KJS::createNotAFunctionError):
+        (KJS::createNotAnObjectErrorStub):
+        (KJS::createNotAnObjectError):
+            Rewrite all the code for the error messages so that they make use of the newly available
+            information.
+        * VM/ExceptionHelpers.h:
+        * VM/Machine.cpp:
+        (KJS::isNotObject):  Now needs vPC and codeBlock
+        (KJS::Machine::throwException):
+            New logic to handle the NotAnObjectErrorStub and to handle the absurd "no default value" edge case
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        * kjs/DebuggerCallFrame.cpp:
+        (KJS::DebuggerCallFrame::evaluate):
+        * kjs/Error.cpp:
+        (KJS::Error::create):
+        * kjs/Error.h:
+        * kjs/JSGlobalObjectFunctions.cpp:
+        * kjs/JSImmediate.cpp:
+        (KJS::JSImmediate::toObject):
+        (KJS::JSImmediate::prototype):
+            My changes to the JSNotAnObject constructor needed to be handled here.
+        * kjs/JSNotAnObject.h:
+        (KJS::JSNotAnObjectErrorStub::JSNotAnObjectErrorStub):
+        (KJS::JSNotAnObjectErrorStub::isNull):
+        (KJS::JSNotAnObjectErrorStub::isNotAnObjectErrorStub):
+            Added a JSNotAnObjectErrorStub class to ease the handling of toObject failure exceptions,
+            and potentially allow even more detailed error messages in future.
+        * kjs/JSObject.h:
+        * kjs/Parser.h:
+        (KJS::Parser::parse):
+        * kjs/SourceRange.h:
+        * kjs/grammar.y:
+            Large amounts of position propagation.
+        * kjs/lexer.cpp:
+        (KJS::Lexer::Lexer):
+        (KJS::Lexer::shift):
+        (KJS::Lexer::lex):
+            The lexer needed a few changes to be able to correctly track token character positions.
+        * kjs/lexer.h:
+        * kjs/nodes.cpp:
+        (KJS::ThrowableExpressionData::emitThrowError):
+        (KJS::StatementNode::StatementNode):
+        (KJS::ResolveNode::emitCode):
+        (KJS::BracketAccessorNode::emitCode):
+        (KJS::DotAccessorNode::emitCode):
+        (KJS::NewExprNode::emitCode):
+        (KJS::EvalFunctionCallNode::emitCode):
+        (KJS::FunctionCallValueNode::emitCode):
+        (KJS::FunctionCallResolveNode::emitCode):
+        (KJS::FunctionCallBracketNode::emitCode):
+        (KJS::FunctionCallDotNode::emitCode):
+        (KJS::PostfixResolveNode::emitCode):
+        (KJS::PostfixBracketNode::emitCode):
+        (KJS::PostfixDotNode::emitCode):
+        (KJS::DeleteResolveNode::emitCode):
+        (KJS::DeleteBracketNode::emitCode):
+        (KJS::DeleteDotNode::emitCode):
+        (KJS::PrefixResolveNode::emitCode):
+        (KJS::PrefixBracketNode::emitCode):
+        (KJS::PrefixDotNode::emitCode):
+        (KJS::ThrowableBinaryOpNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+        (KJS::AssignResolveNode::emitCode):
+        (KJS::AssignDotNode::emitCode):
+        (KJS::ReadModifyDotNode::emitCode):
+        (KJS::AssignBracketNode::emitCode):
+        (KJS::ReadModifyBracketNode::emitCode):
+        (KJS::ForInNode::ForInNode):
+        (KJS::ForInNode::emitCode):
+        (KJS::WithNode::emitCode):
+        (KJS::LabelNode::emitCode):
+        (KJS::ThrowNode::emitCode):
+        (KJS::ProgramNode::ProgramNode):
+        (KJS::ProgramNode::create):
+        (KJS::EvalNode::generateCode):
+        (KJS::FunctionBodyNode::create):
+        (KJS::FunctionBodyNode::generateCode):
+        (KJS::ProgramNode::generateCode):
+            All of these methods were handling the position information.  
+            Constructors and create methods were modified to store the information.
+            All the emitCall implementations listed needed to be updated to actually
+            record the position information we have so carefully collected.
+        * kjs/nodes.h:
+        (KJS::ThrowableExpressionData::ThrowableExpressionData):
+        (KJS::ThrowableExpressionData::setExceptionSourceRange):
+        (KJS::ThrowableExpressionData::divot):
+        (KJS::ThrowableExpressionData::startOffset):
+        (KJS::ThrowableExpressionData::endOffset):
+        (KJS::ThrowableSubExpressionData::ThrowableSubExpressionData):
+        (KJS::ThrowableSubExpressionData::setSubexpressionInfo):
+        (KJS::ThrowablePrefixedSubExpressionData::ThrowablePrefixedSubExpressionData):
+        (KJS::ThrowablePrefixedSubExpressionData::setSubexpressionInfo):
+            ThrowableExpressionData is just a uniform mechanism for storing the position
+            information.
+        (KJS::ResolveNode::):
+        (KJS::PrePostResolveNode::):
+        (KJS::ThrowableBinaryOpNode::):
+        (KJS::WithNode::):
+
+2008-07-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Three renames:
+        
+        "CallTypeNative" => "CallTypeHost"
+        "code" => "byteCode"
+        "generatedCode" => "generatedByteCode"
+
+2008-07-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Optimized <= for immediate number cases.
+        
+        SunSpider reports no overall change, but a 10% speedup on access-nsieve.
+
+2008-07-18  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Fix some casts added in a previous build fix to match the style used
+        throughout WebKit.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::initializeCallFrame):
+        * VM/Register.h:
+        (KJS::Register::Register):
+
+2008-07-18  Landry Breuil  <landry@openbsd.org>
+
+        Bug 19975: [OpenBSD] Patches to enable build of WebKit
+
+        <https://bugs.webkit.org/show_bug.cgi?id=19975>
+
+        Reviewed by David Kilzer.
+
+        Support for OpenBSD, mostly threading and libm tweaks.
+
+        * kjs/collector.cpp: #include <pthread.h>
+        (KJS::currentThreadStackBase): use pthread_stackseg_np() to get stack base
+        * kjs/config.h: OpenBSD also provides <pthread_np.h>
+        * wtf/MathExtras.h: #include <sys/types.h> and <machine/ieee.h>
+        (isfinite), (signbit): as long as we don't have those functions provide fallback implementations
+        * wtf/Platform.h: Add support for PLATFORM(OPENBSD) and PLATFORM(SPARC64) macro
+
+2008-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Next step toward putting doubles in registers: Store constant pool
+        entries as registers, not JSValue*s.
+        
+        SunSpider reports no change.
+
+2008-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John Sullivan and Oliver Hunt.
+        
+        A tiny bit of tidying in function call register allocation.
+        
+        This patch saves one register when invoking a function expression and/or
+        a new expression that is stored in a temporary.
+        
+        Since it's just one register, I can't make a testcase for it.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCall): No need to ref the function we're calling
+        or its base. We'd like the call frame to overlap with them, if possible.
+        op_call will read the function and its base before writing the call frame,
+        so this is safe.
+
+        * kjs/nodes.cpp:
+        (KJS::NewExprNode::emitCode): No need to ref the function we're new-ing,
+        for the same reasons stated above.
+        
+        (KJS::FunctionCallValueNode::emitCode): ditto
+
+2008-07-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+        
+        * kjs/InternalFunction.cpp:
+
+2008-07-17  Sam Weinig  <sam@webkit.org>
+
+        Roll out r35199 as it is causing failures on the PPC build.
+
+2008-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by David Kilzer.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=20067
+        Support function.name (Firefox extension)
+        
+        Pretty straight-forward.
+
+2008-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6081636> Functions calls use more temporary
+        registers than necessary
+        
+        Holding a reference to the last statement result register caused each
+        successive statement to output its result to an even higher register.
+        
+        Happily, statements don't actually need to return a result register
+        at all. I hope to make this clearer in a future cleanup patch,
+        but this change will fix the major bug for now.
+
+        * kjs/nodes.cpp:
+        (KJS::statementListEmitCode):
+
+2008-07-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merge pre&post dot nodes to simplify the parse tree.
+        Sunspider results show 0.6% progression (no performance change expected).
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+
+2008-07-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Merge pre&post resolve nodes to simplify the parse tree.
+        Sunspider results show no performance change.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+
+2008-07-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Merge logical nodes to simplify the parse tree.
+        Sunspider results show 0.6% progression (no performance change expected).
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+
+2008-07-17  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix MinGW build (broken in r35198) and simplify getLocalTime().
+
+        * kjs/DateMath.cpp:
+        (KJS::getLocalTime):
+
+2008-07-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merge pre&post bracket nodes to simplify the parse tree.
+        Sunspider results show no performance change.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+
+2008-07-17  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix the 32-bit gcc builds, conversion from "long int" to Register is
+        ambiguous. Explicitly choose the intptr_t constructor.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::initializeCallFrame):
+        * VM/Register.h:
+        (KJS::Register::Register):
+
+2008-07-16  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        Fix JavaScript in 64-bit by using a pointer-sized integer
+        type in the Register union.  Also includes a rename of
+        the intType constant to IntType.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::initializeCallFrame):
+        * VM/Register.h:
+        (KJS::Register::):
+        (KJS::Register::Register):
+
+2008-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        First step toward putting doubles in registers: Turned Register into a
+        proper abstraction layer. It is no longer possible to cast a Register
+        to a JSValue*, or a Register& to a JSValue*&, or to access the union
+        inside a Register directly.
+        
+        SunSpider reports no change.
+        
+        In support of this change, I had to make the following mechanical changes
+        in a lot of places:
+        
+        1. Clients now use explicit accessors to read data out of Registers, and
+        implicit copy constructors to write data into registers.
+        
+        So, assignment that used to look like
+        
+            x.u.jsValue = y;
+        
+        now looks like
+        
+            x = y;
+            
+        And access that used to look like
+        
+            x = y.u.jsValue;
+        
+        now looks like
+        
+            x = y.jsValue();
+
+        2. I made generic flow control specific in opcodes that made their flow
+        control generic by treating a Register& as a JSValue*&. This had the
+        added benefit of removing some exception checking branches from immediate
+        number code.
+
+        3. I beefed up PropertySlot to support storing a Register* in a property
+        slot. For now, only JSVariableObject's symbolTableGet and symbolTablePut
+        use this functionality, but I expect more clients to use it in the future.
+        
+        4. I changed ArgList to be a buffer of Registers, not JSValue*'s, and I
+        changed ArgList iterator clients to iterate Registers, not JSValue*'s.
+
+2008-07-16  Ada Chan  <adachan@apple.com>
+
+        Fixed build.
+
+        * kjs/JSGlobalObject.cpp:
+
+2008-07-16  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam and Geoff.
+
+        <rdar://problem/5958840> Navigating to another page while profiler is
+        attached results in slow JavaScript for all time.
+
+        - The UNLIKELY keeps this from being a sunspider performance regression.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject): Stop the profiler associated
+        with this exec state.
+
+2008-07-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Replace adopting UString constructor in favor of explicit
+        static adopt method.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        * kjs/StringConstructor.cpp:
+        (KJS::stringFromCharCode):
+        * kjs/StringPrototype.cpp:
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        * kjs/ustring.cpp:
+        (KJS::UString::adopt):
+        * kjs/ustring.h:
+        (KJS::UString::UString):
+        (KJS::UString::~UString):
+
+2008-07-16  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        http://trolltech.com/developer/task-tracker/index_html?method=entry&id=216179
+        Fix potential crash (on Qt for Windows port) when performing JavaScript date
+        conversion.
+
+        * kjs/DateMath.cpp:
+        (KJS::getLocalTime): For the Qt port, prefer to use Windows code, i.e.
+        localtime_s() instead of localtime() since the latter might crash (on Windows)
+        given a non-sensible, e.g. NaN, argument.
+
+2008-07-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders and Geoff.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20023
+        Failed assertion in PropertyNameArray.cpp
+
+        This is already tested by testapi.
+
+        * API/JSObjectRef.cpp: (JSPropertyNameAccumulatorAddName): Add the string to identifier
+        table to appease PropertyNameArray.
+
+2008-07-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        Dereference identifiers when deleting a hash table (fixes leaks with private JSGlobalData
+        objects).
+
+        * kjs/JSGlobalData.cpp: (KJS::JSGlobalData::~JSGlobalData):
+        * kjs/lookup.cpp: (KJS::HashTable::deleteTable):
+        * kjs/lookup.h:
+        * kjs/lexer.cpp: (KJS::Lexer::~Lexer)
+        HashTable cannot have a destructor, because check-for-global-initializers complains about
+        having a global constructor then.
+
+2008-07-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        Check pthread_key_create return value.
+
+        This check was helpful when debugging a crash in run-webkit-tests --threaded that happened
+        because JSGlobalData objects were not deleted, and we were running out of pthread keys soon.
+        It also looks useful for production builds.
+
+        * wtf/ThreadSpecific.h: (WTF::::ThreadSpecific):
+
+2008-07-15  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        Rename pageGroupIdentifier to profileGroup to keep mention of a
+        pageGroup out of JavaScriptCore.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::init):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::setProfileGroup):
+        (KJS::JSGlobalObject::profileGroup):
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::create):
+        (KJS::ProfileGenerator::ProfileGenerator):
+        * profiler/ProfileGenerator.h:
+        (KJS::ProfileGenerator::profileGroup):
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        (KJS::dispatchFunctionToProfiles):
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+
+2008-07-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20037
+        Bug 20037: GCC 4.2 build broken due to strict aliasing violation.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::computeHash): Add a version of computeHash that takes a char* and explicit length.
+        * kjs/ustring.h:
+        * profiler/CallIdentifier.h:
+        (WTF::): Use new version of computeHash that takes a char* and explicit length to avoid unsafe aliasing.
+
+2008-07-14  David Hyatt  <hyatt@apple.com>
+
+        Fix a crashing bug in ListHashSet's -- operator.  Make sure that end() can be -- by special-casing the null
+        position.
+
+        Reviewed by Maciej
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetConstIterator::operator--):
+
+2008-07-14  David Hyatt  <hyatt@apple.com>
+
+        Buidl fix.  Make sure the second insertBefore method returns a value.
+
+        * wtf/ListHashSet.h:
+        (WTF::::insertBefore):
+
+2008-07-14  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Added include/pthreads to the
+        include path.
+
+2008-07-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Kevin McCullough.
+
+        Make JSGlobalData refcounted in preparation to adding a way to create contexts that share
+        global data.
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::create):
+        * kjs/JSGlobalData.h:
+        Made contructor private, and added a static create() method. Made the class inherit from
+        RefCounted.
+
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::globalData):
+        JSGlobalData is now owned by JSGlobalObject (except for the shared one, and the common
+        WebCore one, which are never deleted).
+
+        * kjs/Shell.cpp: (main): Create JSGlobalData with create() method.
+
+2008-07-14  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the single-threaded build.
+
+        * kjs/JSLock.cpp: Removed undeclared registerThread() function.
+        * kjs/collector.cpp:
+        (KJS::Heap::registerThread): Added dummy implementation.
+
+2008-07-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Eliminate per-thread JavaScript global data instance support and make arbitrary
+        global data/global object combinations possible.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::Heap): Store a JSGlobalData pointer instead of multiple pointers to its members.
+        This allows for going from any JS object to its associated global data, currently used in
+        JSGlobalObject constructor to initialize its JSGlobalData pointer.
+        (KJS::Heap::registerThread): Changed thread registration data to be per-heap. Previously,
+        only the shared heap could be used from multiple threads, so it was the only one that needed
+        thread registration, but now this can happen to any heap.
+        (KJS::Heap::unregisterThread): Ditto.
+        (KJS::Heap::markStackObjectsConservatively): Adapt for the above changes.
+        (KJS::Heap::setGCProtectNeedsLocking): Ditto.
+        (KJS::Heap::protect): Ditto.
+        (KJS::Heap::unprotect): Ditto.
+        (KJS::Heap::collect): Ditto.
+        (KJS::Heap::globalObjectCount): Use global object list associated with the current heap,
+        not the late per-thread one.
+        (KJS::Heap::protectedGlobalObjectCount): Ditto.
+
+        * kjs/collector.h:
+        (KJS::Heap::ThreadRegistrar): Added a helper object that unregisters a thread when it is
+        destroyed.
+
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::JSLock):
+        * kjs/JSLock.h:
+        (KJS::JSLock::JSLock):
+        Don't use JSLock to implicitly register threads. I've added registerThread() calls to most
+        places that use JSLock - we cannot guarantee absolute safety unless we always mark all
+        threads in the process, but these implicit registration calls should cover reasonable usage
+        scenarios, I hope.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Explicitly register the current thread.
+        (JSCheckScriptSyntax): Explicitly register the current thread.
+        (JSGarbageCollect): Changed to use the passed in context. Unfortunately, this creates a race
+        condition for clients that pass an already released context to JSGarbageCollect - but it is
+        unlikely to create real life problems.
+        To maintain compatibility, the shared heap is collected if NULL is passed.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Use a new syntax for JSGlobalObject allocation.
+        (JSGlobalContextRetain): Register the thread.
+        (JSContextGetGlobalObject): Register the thread.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        Register the thread.
+
+        * API/JSStringRef.cpp: (JSStringRelease): Changed a comment to not mention per-thread contexts.
+
+        * API/JSStringRefCF.cpp: Removed an unnecessary include of JSLock.h.
+
+        * JavaScriptCore.exp: Export JSGlobalData constructor/destructor, now that anyone can have
+        their own instances. Adapt to other changes, too.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made ThreadSpecific.h private, as it is now
+        included by collector.h and is thus needed in other projects.
+
+        * kjs/InitializeThreading.cpp: (KJS::initializeThreadingOnce): Don't initialize per-thread
+        global data, as it no longer exists.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        (KJS::JSGlobalData::~JSGlobalData):
+        * kjs/JSGlobalData.h:
+        Removed support for per-thread instance. Made constructor and destructor public.
+
+        * kjs/JSGlobalObject.cpp: (KJS::JSGlobalObject::init): Get to now arbitrary  JSGlobalData
+        via the heap.
+        (KJS::JSGlobalObject::operator new): Changed ot take JSGlobalDatra pointer.
+        * kjs/JSGlobalObject.h:
+
+        * kjs/Shell.cpp:
+        (main):
+        (jscmain):
+        Changed to maintain a custom JSGlobalData pointer instead of a per-thread one.
+
+2008-07-13  Ada Chan  <adachan@apple.com>
+
+        Windows build fix: Add wtf/RefCountedLeakCounter to the project.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2008-07-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk, Qt and Wx build fix: Add wtf/RefCountedLeakCounter in the
+        build scripts
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCoreSources.bkl:
+
+2008-07-11  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Darin Adler and Oliver Hunt.
+
+        Refactor RefCounting Leak counting code into a common class.
+
+        In order to export the symbols I needed to put the debug defines inside the function names
+        
+        Before we had a separate channel for each Logging each Leak type.  Since the leak channels were only used in one location, and only at quit for simplicity I combined them all into one leak channel.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: add new class
+        * kjs/nodes.cpp: remove old leak counting code
+        * wtf/RefCountedLeakCounter.cpp: Added. create a common leak counting class
+        * wtf/RefCountedLeakCounter.h: Added.
+
+2008-07-11  David Hyatt  <hyatt@apple.com>
+
+        Add an insertBefore method to ListHashSet to allow for insertions in the middle of the list (rather than just
+        at the end).
+
+        Reviewed by Anders
+
+        * wtf/ListHashSet.h:
+        (WTF::::insertBefore):
+        (WTF::::insertNodeBefore):
+
+2008-07-11  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Move call function to CallData.cpp and construct to ConstructData.cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/CallData.cpp: Copied from kjs/JSValue.cpp.
+        * kjs/ConstructData.cpp: Copied from kjs/JSValue.cpp.
+        * kjs/JSValue.cpp:
+
+2008-07-10  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Define WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST when building WebKit to ensure that no symbols end up with the weak_import attribute.
+
+        * Configurations/Base.xcconfig:
+
+2008-07-10  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix the Tiger build by omitting annotations from methods declared in categories when using old versions of GCC.
+
+        * API/WebKitAvailability.h:
+
+2008-07-10  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        -Minor cleanup. Renamed callTree() to head() and no longer use m_head
+        directly but instead keep it private and access via a method().
+
+        * profiler/HeavyProfile.cpp:
+        (KJS::HeavyProfile::HeavyProfile):
+        (KJS::HeavyProfile::generateHeavyStructure):
+        (KJS::HeavyProfile::addNode):
+        * profiler/Profile.h:
+        (KJS::Profile::head):
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::ProfileGenerator):
+
+2008-07-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Eliminate CollectorHeapIntrospector.
+
+        CollectorHeapIntrospector was added primarily in the hopes to improve leaks tool output,
+        a result that it didn't deliver. Also, it helped by labeling JSC heap regions as reported by
+        vmmap tool, but at the same time, it made them mislabeled as malloc'd ones - the correct
+        way to label mapped regions is to use a VM tag.
+
+        So, it makes more sense to remove it completely than to make it work with multiple heaps.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp:
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreading):
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/CollectorHeapIntrospector.cpp: Removed.
+        * kjs/CollectorHeapIntrospector.h: Removed.
+
+2008-07-09  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5951532> JSProfiler: Implement heavy (or bottom-up)
+        view (19228)
+        - Implemented the time and call count portionof heavy.  Now all that we
+        need is some UI.
+
+        * profiler/CallIdentifier.h: Removed an unused constructor.
+        * profiler/HeavyProfile.cpp: 
+        (KJS::HeavyProfile::HeavyProfile): Set the initial time of the head
+        node so that percentages work correctly.
+        (KJS::HeavyProfile::mergeProfiles): Sum the times and call count of
+        nodes being merged.
+        * profiler/ProfileNode.cpp: Set the intital values of time and call
+        count when copying ProfileNodes.
+        (KJS::ProfileNode::ProfileNode):
+
+2008-07-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix.
+
+        * GNUmakefile.am: Add HeavyProfile.cpp
+
+2008-07-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Don't warn about deprecated functions in production builds.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2008-07-09  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.pri: Fix Qt build by adding HeavyProfile.cpp.
+
+2008-07-09  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx biuld fix. Add HeavyProfile.cpp to build files.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-07-09  Kevin McCullough  <kmccullough@apple.com>
+
+        - Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-07-09  Kevin McCullough  <kmccullough@apple.com>
+
+        - Build fix.
+
+        * profiler/HeavyProfile.cpp:
+        (KJS::HeavyProfile::mergeProfiles):
+
+2008-07-09  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff and Adam.
+
+        <rdar://problem/5951532> JSProfiler: Implement Bottom-Up view (19228)
+        - This is the plumbing for bottom-up, but does not include calculating
+        time, mostly because I'm still undclear about what the end result should
+        look like.
+        - This, obviously, does not include the UI to expose this in the
+        inspector yet.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/CallIdentifier.h:
+        (KJS::CallIdentifier::CallIdentifier):
+        (WTF::): Added HashTraits for CallIdentifiers to be used by a HashMap.
+        * profiler/HeavyProfile.cpp: Added.
+        (KJS::HeavyProfile::HeavyProfile):
+        (KJS::HeavyProfile::generateHeavyStructure):
+        (KJS::HeavyProfile::addNode):
+        (KJS::HeavyProfile::mergeProfiles):
+        (KJS::HeavyProfile::addAncestorsAsChildren):
+        * profiler/HeavyProfile.h: Added.
+        (KJS::HeavyProfile::create):
+        (KJS::HeavyProfile::heavyProfile):
+        (KJS::HeavyProfile::treeProfile):
+        * profiler/Profile.cpp: Removed old commented out includes.
+        * profiler/Profile.h: The m_head is needed by the HeavyProfile so it
+        is now protected as opposed to private.
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::ProfileNode): Created a constructor to copy
+        ProfileNodes.
+        (KJS::ProfileNode::findChild): Added a null check to make HeavyProfile
+        children finding easier and avoid a potential crasher.
+        * profiler/ProfileNode.h: Mostly moved things around but also added some
+        functionality needed by HeavyProfile.
+        (KJS::ProfileNode::create):
+        (KJS::ProfileNode::functionName):
+        (KJS::ProfileNode::url):
+        (KJS::ProfileNode::lineNumber):
+        (KJS::ProfileNode::head):
+        (KJS::ProfileNode::setHead):
+        (KJS::ProfileNode::setNextSibling):
+        (KJS::ProfileNode::actualTotalTime):
+        (KJS::ProfileNode::actualSelfTime):
+        * profiler/TreeProfile.cpp: Implemented the ability to get a
+        HeavyProfile.
+        (KJS::TreeProfile::heavyProfile):
+        * profiler/TreeProfile.h:
+
+2008-07-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Added support for checking if an object has custom properties in its
+        property map. WebCore uses this to optimize marking DOM wrappers.
+
+2008-07-08  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective Gtk/Wx build fixes, add ProfileGenerator.cpp to the build.
+
+        * GNUmakefile.am:
+        * JavaScriptCoreSources.bkl:
+
+2008-07-08  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build, add ProfileGenerator.cpp to the build.
+
+        * JavaScriptCore.pri:
+
+2008-07-07  David Kilzer  <ddkilzer@apple.com>
+
+        releaseFastMallocFreeMemory() should always be defined
+
+        Reviewed by Darin.
+
+        * JavaScriptCore.exp: Changed to export C++ binding for
+        WTF::releaseFastMallocFreeMemory() instead of C binding for
+        releaseFastMallocFreeMemory().
+        * wtf/FastMalloc.cpp: Moved definitions of
+        releaseFastMallocFreeMemory() to be in the WTF namespace
+        regardless whether FORCE_SYSTEM_MALLOC is defined.
+        * wtf/FastMalloc.h: Moved releaseFastMallocFreeMemory() from
+        extern "C" binding to WTF::releaseFastMallocFreeMemory().
+
+2008-07-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff.
+
+        Bug 19926: URL causes crash within a minute
+        <https://bugs.webkit.org/show_bug.cgi?id=19926>
+
+        Add a check that lastGlobalObject is non-null in Machine::execute()
+        before copying its globals to the current register file.
+
+        In theory, it is possible to make a test case for this, but it will
+        take a while to get it right.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+
+2008-07-07  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Adele.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Fix a typo in a comment.
+
+2008-07-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2008-07-07  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        When the profiler is running it gathers information and creates a
+        Profile.  After it finishes the Profile can be sorted and have other
+        data refinements run over it.  Both of these were done in the same class
+        before.  Now I split the gathering operations into a new class called
+        ProfileGenerator.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/Profile.cpp: Removed code related to the gather stage of a
+        Profile's creation.  
+        (KJS::Profile::create):
+        (KJS::Profile::Profile):
+        * profiler/Profile.h: Ditto.
+        (KJS::Profile::title):
+        (KJS::Profile::callTree):
+        (KJS::Profile::setHead):
+        * profiler/ProfileGenerator.cpp: Added. This is the class that will
+        handle the stage of creating a Profile.  Once the Profile is finished
+        being created, this class goes away.
+        (KJS::ProfileGenerator::create):
+        (KJS::ProfileGenerator::ProfileGenerator):
+        (KJS::ProfileGenerator::title):
+        (KJS::ProfileGenerator::willExecute):
+        (KJS::ProfileGenerator::didExecute):
+        (KJS::ProfileGenerator::stopProfiling):
+        (KJS::ProfileGenerator::didFinishAllExecution):
+        (KJS::ProfileGenerator::removeProfileStart):
+        (KJS::ProfileGenerator::removeProfileEnd):
+        * profiler/ProfileGenerator.h: Added.
+        (KJS::ProfileGenerator::profile):
+        (KJS::ProfileGenerator::originatingGlobalExec):
+        (KJS::ProfileGenerator::pageGroupIdentifier):
+        (KJS::ProfileGenerator::client):
+        (KJS::ProfileGenerator::stoppedProfiling):
+        * profiler/Profiler.cpp: Now operates with the ProfileGenerator instead
+        of the Profile.
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling):
+        (KJS::Profiler::didFinishAllExecution): It is here that the Profile is
+        handed off to its client and the Profile Generator is no longer needed.
+        (KJS::dispatchFunctionToProfiles):
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+        * profiler/Profiler.h: Cleaned up the includes and subsequently the
+        forward declarations.  Also use the new ProfileGenerator.
+        (KJS::ProfilerClient::~ProfilerClient):
+        (KJS::Profiler::currentProfiles):
+        * profiler/TreeProfile.cpp: Use Profile's new interface.
+        (KJS::TreeProfile::create):
+        (KJS::TreeProfile::TreeProfile):
+        * profiler/TreeProfile.h:
+
+2008-07-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Third step in broad cleanup effort.
+
+        [ File list elided ]
+
+2008-07-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Second step in broad cleanup effort.
+
+        [ File list elided ]
+
+2008-07-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        First step in broad cleanup effort.
+
+        [ File list elided ]
+
+2008-07-05  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Cameron Zwarich.
+
+        Rename list.h/cpp to ArgList.h/cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Machine.h:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArgList.cpp: Copied from JavaScriptCore/kjs/list.cpp.
+        * kjs/ArgList.h: Copied from JavaScriptCore/kjs/list.h.
+        * kjs/IndexToNameMap.cpp:
+        * kjs/JSGlobalData.cpp:
+        * kjs/JSGlobalData.h:
+        * kjs/JSObject.h:
+        * kjs/collector.cpp:
+        * kjs/list.cpp: Removed.
+        * kjs/list.h: Removed.
+
+2008-07-05  Sam Weinig  <sam@webkit.org>
+
+        Fix non-AllInOne builds again.
+
+        * kjs/BooleanPrototype.cpp:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/NumberPrototype.cpp:
+        * kjs/ObjectPrototype.cpp:
+
+2008-07-05  Sam Weinig  <sam@webkit.org>
+
+        Fix build on case-sensitive build systems.
+
+        * kjs/IndexToNameMap.cpp:
+
+2008-07-05  Sam Weinig  <sam@webkit.org>
+
+        Fix build.
+
+        * kjs/Arguments.cpp:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/DateConstructor.cpp:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/NumberPrototype.cpp:
+        * kjs/ObjectPrototype.cpp:
+        * kjs/RegExpPrototype.cpp:
+        * kjs/StringConstructor.cpp:
+        * kjs/lookup.cpp:
+
+2008-07-05  Sam Weinig  <sam@webkit.org>
+
+        Fix non-AllInOne build.
+
+        * kjs/JSGlobalObject.cpp:
+
+2008-07-05  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Cameron Zwarich.
+
+        Split Arguments, IndexToNameMap, PrototypeFunction, GlobalEvalFunction and 
+        the functions on the global object out of JSFunction.h/cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Machine.cpp:
+        * kjs/AllInOneFile.cpp:
+        * kjs/Arguments.cpp: Copied from JavaScriptCore/kjs/JSFunction.cpp.
+        * kjs/Arguments.h: Copied from JavaScriptCore/kjs/JSFunction.h.
+        * kjs/GlobalEvalFunction.cpp: Copied from JavaScriptCore/kjs/JSFunction.cpp.
+        * kjs/GlobalEvalFunction.h: Copied from JavaScriptCore/kjs/JSFunction.h.
+        * kjs/IndexToNameMap.cpp: Copied from JavaScriptCore/kjs/JSFunction.cpp.
+        * kjs/IndexToNameMap.h: Copied from JavaScriptCore/kjs/JSFunction.h.
+        * kjs/JSActivation.cpp:
+        * kjs/JSFunction.cpp:
+        * kjs/JSFunction.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObjectFunctions.cpp: Copied from JavaScriptCore/kjs/JSFunction.cpp.
+        * kjs/JSGlobalObjectFunctions.h: Copied from JavaScriptCore/kjs/JSFunction.h.
+        The functions on the global object should be in JSGlobalObject.cpp, but putting them there
+        was a 0.5% regression.
+
+        * kjs/PrototypeFunction.cpp: Copied from JavaScriptCore/kjs/JSFunction.cpp.
+        * kjs/PrototypeFunction.h: Copied from JavaScriptCore/kjs/JSFunction.h.
+        * kjs/Shell.cpp:
+        * kjs/lexer.cpp:
+        * kjs/ustring.cpp:
+
+2008-07-04  Sam Weinig  <sam@webkit.org>
+
+        Really fix the mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-07-04  Sam Weinig  <sam@webkit.org>
+
+        Fix mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-07-04  Sam Weinig  <sam@webkit.org>
+
+        Fix non-AllInOne builds.
+
+        * kjs/Error.cpp:
+        * kjs/GetterSetter.cpp:
+        * kjs/JSImmediate.cpp:
+        * kjs/operations.cpp:
+
+2008-07-04  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Split Error and GetterSetter out of JSObject.h.
+
+        * API/JSCallbackObjectFunctions.h:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ClassInfo.h: Copied from JavaScriptCore/kjs/JSObject.h.
+        * kjs/Error.cpp: Copied from JavaScriptCore/kjs/JSObject.cpp.
+        * kjs/Error.h: Copied from JavaScriptCore/kjs/JSObject.h.
+        * kjs/GetterSetter.cpp:
+        * kjs/GetterSetter.h: Copied from JavaScriptCore/kjs/JSObject.h.
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/nodes.h:
+
+2008-07-04  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Wx build, added TreeProfile.cpp to the build.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-07-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix output path of recently-added script phase to reference the correct file.
+        This prevents Xcode from running the script phase unnecessarily, which caused
+        the generated header to be recreated and lead to AllInOneFile.cpp rebuilding.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-07-03  Mark Rowe  <mrowe@apple.com>
+
+        Follow-up to the 64-bit build fix.  Use intptr_t rather than ssize_t as
+        the latter is non-standard and does not exist on Windows.
+
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::lockCount):
+        (KJS::JSLock::lock):
+        (KJS::JSLock::unlock):
+        (KJS::JSLock::DropAllLocks::DropAllLocks):
+        * kjs/JSLock.h:
+
+2008-07-02  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.  pthread_getspecific works with pointer-sized values,
+        so use ssize_t rather than int to track the lock count to avoid warnings about
+        truncating the result of pthread_getspecific.
+
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::lockCount):
+        (KJS::JSLock::lock):
+        (KJS::JSLock::unlock):
+        (KJS::JSLock::DropAllLocks::DropAllLocks):
+        * kjs/JSLock.h:
+
+2008-07-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed checking for the array get/put fast case from the array code.
+        Callers who want the fast case should call getIndex and/or setIndex
+        instead. (get_by_val and put_by_val already do this.)
+        
+        SunSpider reports no change overall, but a 1.4% speedup on fannkuch and
+        a 3.6% speedup on nsieve.
+
+2008-07-03  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added TreeProfile.{h,cpp}.
+
+2008-07-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - Windows build fix
+
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine):
+
+2008-07-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix the non-threaded build.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::threadInstanceInternal):
+
+2008-07-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build, added TreeProfile to the build.
+
+        * JavaScriptCore.pri:
+
+2008-07-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        Don't create unnecessary JSGlobalData instances.
+
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::threadInstanceExists):
+        (KJS::JSGlobalData::sharedInstanceExists):
+        (KJS::JSGlobalData::threadInstance):
+        (KJS::JSGlobalData::sharedInstance):
+        (KJS::JSGlobalData::threadInstanceInternal):
+        (KJS::JSGlobalData::sharedInstanceInternal):
+        Added methods to query instance existence.
+
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreadingOnce):
+        Initialize thread instance static in a new way.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * kjs/collector.cpp:
+        (KJS::Heap::collect):
+        Check for instance existence before accessing it.
+
+2008-07-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=19862
+        REGRESSION (r34907): Gmail crashes in JavaScriptCore code while editing drafts
+        
+        I was never able to reproduce this issue, but Cameron could, and he says
+        that this patch fixes it.
+        
+        The crash seems tied to a timer or event handler callback. In such a case,
+        the sole reference to the global object may be in the current call frame,
+        so we can't depend on the global object to mark the call frame area in
+        the register file.
+        
+        The new GC marking rule is: the global object is not responsible for
+        marking the whole register file -- it's just responsible for the globals
+        section it's tied to. The heap is responsible for marking the call frame area.
+
+2008-07-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add the ability to trace JavaScriptCore garabge collections using dtrace.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Generate the dtrace probe header
+        file when building on a new enough version of Mac OS X.
+        * JavaScriptCorePrefix.h: Add our standard Mac OS X version detection macros.
+        * kjs/Tracing.d: Declare three dtrace probes.
+        * kjs/Tracing.h: Include the generated dtrace macros if dtrace is available,
+        otherwise provide versions that do nothing.
+        * kjs/collector.cpp:
+        (KJS::Heap::collect): Fire dtrace probes when starting a collection, after the
+        mark phase has completed, and when the collection is complete.
+        * wtf/Platform.h: Define HAVE_DTRACE when building on a new enough version of Mac OS X.
+
+2008-07-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+        
+        Reduced the max register file size from 8MB to 2MB.
+
+        We still allow about 20,000 levels of recursion.
+
+2008-07-02  Alp Toker  <alp@nuanti.com>
+
+        Build fix for r34960. Add TreeProfile.cpp to build.
+
+        * GNUmakefile.am:
+
+2008-07-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Optimized a[n] get for cases when a is an array or a string. When a is
+        an array, we optimize both get and put. When a is a string, we only
+        optimize get, since you can't put to a string.
+        
+        SunSpider says 3.4% faster.
+
+2008-07-02  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        -Small cleanup in preparation for implementing Bottom-up.
+
+        * profiler/CallIdentifier.h: Rename debug function to make it clear of
+        its output and intention to be debug only.
+        (KJS::CallIdentifier::operator const char* ): Implement in terms of
+        c_str.
+        (KJS::CallIdentifier::c_str):
+        * profiler/ProfileNode.cpp: Impelment findChild() which will be needed
+        by the bottom-up implementation.
+        (KJS::ProfileNode::findChild):
+        * profiler/ProfileNode.h: Added comments to make the collections of
+        functions more clear.
+        (KJS::ProfileNode::operator==):
+        (KJS::ProfileNode::c_str):
+
+2008-07-02  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Bug 19776: Number.toExponential() is incorrect for numbers between 0.1 and 1
+        <https://bugs.webkit.org/show_bug.cgi?id=19776>
+
+        Perform the sign check for the exponent on the actual exponent value,
+        which is 1 less than the value of decimalPoint, instead of on the value
+        of decimalPoint itself.
+
+        * kjs/NumberPrototype.cpp:
+        (KJS::exponentialPartToString):
+
+2008-07-02  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5951532> JSProfiler: Implement Bottom-Up view (19228)
+        - Subclass TreeProfile as I prepare for a HeavyProfile to be comming
+        later.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/Profile.cpp: By default we create a TreeProfile.
+        (KJS::Profile::create):
+        * profiler/Profile.h: Changes to the Profile class to make it amenable
+        to be inherited from.
+        (KJS::Profile::~Profile):
+        * profiler/TreeProfile.cpp: Added.
+        (KJS::TreeProfile::create):
+        (KJS::TreeProfile::TreeProfile):
+        (KJS::TreeProfile::heavyProfile):
+        * profiler/TreeProfile.h: Added.
+        (KJS::TreeProfile::treeProfile):
+
+2008-07-02  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan.
+
+        Broke CallIdentifier out into its own file. I did this because it's
+        going to grow a lot soon and I wanted this to be a separate patch.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/CallIdentifier.h: Added.
+        (KJS::CallIdentifier::CallIdentifier):
+        (KJS::CallIdentifier::operator==):
+        (KJS::CallIdentifier::operator!=):
+        (KJS::CallIdentifier::operator const char* ):
+        (KJS::CallIdentifier::toString):
+        * profiler/ProfileNode.h:
+
+2008-07-02  Simon Hausmann  <hausmann@webkit.org>
+
+        Build fix. Implemented missing functions for single-threaded build.
+
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::JSLock):
+        (KJS::JSLock::lock):
+        (KJS::JSLock::unlock):
+        (KJS::JSLock::DropAllLocks::DropAllLocks):
+
+2008-07-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Another non-AllInOne build fix.
+
+        * kjs/JSGlobalObject.cpp: Include JSLock.h here, too.
+
+2008-07-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Non-AllInOne build fix.
+
+        * kjs/interpreter.cpp: Include JSLock.h.
+
+2008-06-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Disable JSLock for per-thread contexts.
+
+        No change on SunSpider.
+
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        (KJS::JSGlobalData::sharedInstance):
+        Added isSharedInstance as a better way to tell whether the instance is shared (legacy).
+
+        * kjs/JSLock.cpp:
+        (KJS::createJSLockCount):
+        (KJS::JSLock::lockCount):
+        (KJS::setLockCount):
+        (KJS::JSLock::JSLock):
+        (KJS::JSLock::lock):
+        (KJS::JSLock::unlock):
+        (KJS::JSLock::currentThreadIsHoldingLock):
+        (KJS::JSLock::DropAllLocks::DropAllLocks):
+        (KJS::JSLock::DropAllLocks::~DropAllLocks):
+        * kjs/JSLock.h:
+        (KJS::JSLock::JSLock):
+        (KJS::JSLock::~JSLock):
+        Made JSLock and JSLock::DropAllLocks constructors take a parameter to decide whether to
+        actually lock a mutex, or only to increment recursion count. We cannot turn it into no-op
+        if we want to keep existing assertions working.
+        Made recursion count per-thread, now that locks may not lock.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Take JSLock after casting JSContextRef to ExecState* (which doesn't need
+        locking in any case), so that a decision whether to actually lock can be made.
+        (JSCheckScriptSyntax): Ditto.
+        (JSGarbageCollect): Only lock while collecting the shared heap, not the per-thread one.
+
+        * API/JSObjectRef.cpp:
+        (JSClassCreate): Don't lock, as there is no reason to.
+        (JSClassRetain): Ditto.
+        (JSClassRelease): Ditto.
+        (JSPropertyNameArrayRetain): Ditto.
+        (JSPropertyNameArrayRelease): Only lock while deleting the array, as that may touch
+        identifier table.
+        (JSPropertyNameAccumulatorAddName): Adding a string also involves an identifier table
+        lookup, and possibly modification.
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        (JSStringCreateWithUTF8CString):
+        (JSStringRetain):
+        (JSStringRelease):
+        (JSStringGetUTF8CString):
+        (JSStringIsEqual):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        JSStringRef operations other than releasing do not need locking.
+
+        * VM/Machine.cpp: Don't include unused JSLock.h.
+
+        * kjs/CollectorHeapIntrospector.cpp: (KJS::CollectorHeapIntrospector::statistics):
+        Don't take the lock for real, as heap introspection pauses the process anyway. It seems that
+        the existing code could cause deadlocks.
+
+        * kjs/Shell.cpp:
+        (functionGC):
+        (main):
+        (jscmain):
+        The test tool uses a per-thread context, so no real locking is required.
+
+        * kjs/collector.h:
+        (KJS::Heap::setGCProtectNeedsLocking): Optionally protect m_protectedValues access with a
+        per-heap mutex. This is only needed for WebCore Database code, which violates the "no data
+        migration between threads" by using ProtectedPtr on a background thread.
+        (KJS::Heap::isShared): Keep a shared flag here, as well.
+
+        * kjs/protect.h:
+        (KJS::::ProtectedPtr):
+        (KJS::::~ProtectedPtr):
+        (KJS::::operator):
+        (KJS::operator==):
+        (KJS::operator!=):
+        ProtectedPtr is ony used from WebCore, so it doesn't need to take JSLock. An assertion in
+        Heap::protect/unprotect guards agains possible future unlocked uses of ProtectedPtr in JSC.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::Heap): Initialize m_isShared.
+        (KJS::Heap::~Heap): No need to lock for real during destruction, but must keep assertions
+        in sweep() working.
+        (KJS::destroyRegisteredThread): Registered thread list is only accessed for shared heap,
+        so locking is always needed here.
+        (KJS::Heap::registerThread): Ditto.
+        (KJS::Heap::markStackObjectsConservatively): Use m_isShared instead of comparing to a shared
+        instance for a small speedup.
+        (KJS::Heap::setGCProtectNeedsLocking): Create m_protectedValuesMutex. There is currently no
+        way to undo this - and ideally, Database code will be fixed to lo longer require this quirk.
+        (KJS::Heap::protect): Take m_protectedValuesMutex (if it exists) while accessing
+        m_protectedValues.
+        (KJS::Heap::unprotect): Ditto.
+        (KJS::Heap::markProtectedObjects): Ditto.
+        (KJS::Heap::protectedGlobalObjectCount): Ditto.
+        (KJS::Heap::protectedObjectCount): Ditto.
+        (KJS::Heap::protectedObjectTypeCounts): Ditto.
+
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        Don't include JSLock.h, which is no longer used here. As a result, an explicit include had
+        to be added to many files in JavaScriptGlue, WebCore and WebKit.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::init):
+        * API/JSCallbackConstructor.cpp:
+        (KJS::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::init):
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::construct):
+        (KJS::::hasInstance):
+        (KJS::::call):
+        (KJS::::getPropertyNames):
+        (KJS::::toNumber):
+        (KJS::::toString):
+        (KJS::::staticValueGetter):
+        (KJS::::callbackGetter):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        (JSGlobalContextRetain):
+        (JSGlobalContextRelease):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * kjs/PropertyNameArray.h:
+        (KJS::PropertyNameArray::globalData):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::checkSyntax):
+        (KJS::Interpreter::evaluate):
+        Pass a parameter to JSLock/JSLock::DropAllLocks to decide whether the lock needs to be taken.
+
+2008-07-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19834
+        Failed assertion in JavaScriptCore/VM/SegmentedVector.h:82
+
+        Creating a global object with a custom prototype resets it twice (wasteful!).
+        So, addStaticGlobals() was called twice, but JSGlobalObject::reset() didn't reset
+        the register array.        
+
+        * kjs/JSGlobalObject.cpp: (KJS::JSGlobalObject::reset): Call setRegisterArray(0, 0).
+
+        * kjs/JSVariableObject.h: Changed registerArray to OwnArrayPtr. Also, added private copy
+        constructor and operator= to ensure that no one attempts to copy this object (for whatever
+        reason, I couldn't make Noncopyable work).
+
+        * kjs/JSGlobalObject.h: (KJS::JSGlobalObject::addStaticGlobals): Allocate registerArray
+        with new[].
+
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::copyRegisterArray): Allocate registerArray with new[].
+        (KJS::JSVariableObject::setRegisterArray): Avoid hitting an assertion in OwnArrayPtr when
+        "changing" the value from 0 to 0.
+
+2008-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Removed and/or reordered exception checks in array-style a[n] access.
+        
+        SunSpider says 1.4% faster.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): No need to check for exceptions before
+        calling toString, toNumber and/or get. If the call ends up being observable
+        through toString, valueOf, or a getter, we short-circuit it there, instead.
+        In the op_del_by_val case, I removed the incorrect comment without actually
+        removing the code, since I didn't want to tempt the GCC fates!
+
+        * kjs/JSObject.cpp:
+        (KJS::callDefaultValueFunction): Added exception check to prevent
+        toString and valueOf functions from observing execution after an exception
+        has been thrown. This removes some of the burden of exception checking
+        from the machine.
+
+        (KJS::JSObject::defaultValue): Removed redundant exception check here.
+
+        * kjs/PropertySlot.cpp:
+        (KJS::PropertySlot::functionGetter): Added exception check to prevent
+        getter functions from observing execution after an exception has been
+        thrown. This removes some of the burden of exception checking from the
+        machine.
+
+2008-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Optimized a[n] get and put for cases where n is an immediate unsigned
+        value.
+        
+        SunSpider says 3.5% faster.
+
+2008-07-01  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Bug 19844: JavaScript Switch statement modifies "this"
+        <https://bugs.webkit.org/show_bug.cgi?id=19844>
+
+        Use a temporary when generating code for switch clauses to avoid
+        overwriting 'this' or a local variable.
+
+        * kjs/nodes.cpp:
+        (KJS::CaseBlockNode::emitCodeForBlock):
+
+2008-07-01  Christian Dywan  <christian@twotoasts.de>
+
+        Gtk+ build fix.
+
+        * kjs/list.cpp: Include "JSCell.h"
+
+2008-07-01  Kevin McCullough  <kmccullough@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-07-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - Mac release build fix
+
+        * JavaScriptCore.exp:
+
+2008-07-01  Sam Weinig  <sam@webkit.org>
+
+        Try and fix mac builds.
+
+        * JavaScriptCore.exp:
+
+2008-07-01  Sam Weinig  <sam@webkit.org>
+
+        Fix non-AllInOne builds.
+
+        * kjs/DateMath.cpp:
+
+2008-07-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Split JSCell and JSNumberCell class declarations out of JSValue.h
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/JSPropertyNameIterator.h:
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSCell.cpp: Copied from JavaScriptCore/kjs/JSValue.cpp.
+        * kjs/JSCell.h: Copied from JavaScriptCore/kjs/JSValue.h.
+        (KJS::JSValue::getJSNumber):
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h: Copied from JavaScriptCore/kjs/JSValue.h.
+        * kjs/JSObject.h:
+        * kjs/JSString.cpp:
+        (KJS::jsString):
+        (KJS::jsOwnedString):
+        * kjs/JSString.h:
+        (KJS::JSValue::toThisJSString):
+        * kjs/JSValue.cpp:
+        * kjs/JSValue.h:
+
+2008-07-01  Anders Carlsson  <andersca@apple.com>
+
+        Build fixes.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::addStaticGlobals):
+
+2008-07-01  Simon Hausmann  <hausmann@webkit.org>
+
+        Build fix, include OwnPtr.h.
+
+        * kjs/RegExpConstructor.h:
+
+2008-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed a global object leak caused by the switch to one register file.
+        
+        Don't unconditionally mark the register file, since that logically
+        makes all global variables GC roots, even when their global object is
+        no longer reachable.
+        
+        Instead, make the global object associated with the register file
+        responsible for marking the register file.
+
+2008-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Removed the "registerBase" abstraction. Since the register file never
+        reallocates, we can keep direct pointers into it, instead of
+        <registerBase, offset> tuples.
+        
+        SunSpider says 0.8% faster.
+        
+2008-06-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix build by adding all (hopefully) the missing includes.
+
+        * kjs/BooleanPrototype.cpp:
+        * kjs/DateConstructor.cpp:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/NativeErrorConstructor.cpp:
+        * kjs/NumberPrototype.cpp:
+        * kjs/ObjectPrototype.cpp:
+        * kjs/RegExpConstructor.cpp:
+        * kjs/StringConstructor.cpp:
+        * kjs/StringPrototype.cpp:
+
+2008-06-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 19830: REGRESSION (r34883): Google Reader doesn't show up feed list on sidebar
+        <https://bugs.webkit.org/show_bug.cgi?id=19830>
+
+        Ensure that we do not eliminate a write to a local register when doing
+        peephole optimizations.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        (KJS::CodeGenerator::emitJumpIfFalse):
+
+2008-06-30  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Alder.
+
+        Split InternalFunction into its own header file.
+
+        * API/JSCallbackFunction.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/ArrayConstructor.h:
+        * kjs/BooleanConstructor.h:
+        * kjs/DateConstructor.h:
+        * kjs/ErrorConstructor.h:
+        * kjs/FunctionConstructor.h:
+        * kjs/FunctionPrototype.h:
+        * kjs/InternalFunction.h: Copied from kjs/JSFunction.h.
+        * kjs/JSFunction.h:
+        * kjs/NativeErrorConstructor.h:
+        * kjs/NumberConstructor.h:
+        * kjs/ObjectConstructor.h:
+        * kjs/RegExpConstructor.h:
+        * kjs/StringConstructor.h:
+        * profiler/Profiler.cpp:
+
+2008-06-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Kevin McCullough.
+
+        Remove empty files Instruction.cpp, LabelID.cpp, Register.cpp and RegisterID.cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Instruction.cpp: Removed.
+        * VM/LabelID.cpp: Removed.
+        * VM/Register.cpp: Removed.
+        * VM/RegisterID.cpp: Removed.
+
+2008-06-30  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped (reluctantly) by Kevin McCullough.
+
+        Rename date_object.h/cpp to DateInstance.h/cpp
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/DateConstructor.cpp:
+        * kjs/DateInstance.cpp: Copied from kjs/date_object.cpp.
+        * kjs/DateInstance.h: Copied from kjs/date_object.h.
+        * kjs/DatePrototype.cpp:
+        * kjs/DatePrototype.h:
+        * kjs/date_object.cpp: Removed.
+        * kjs/date_object.h: Removed.
+
+2008-06-30  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove internal.cpp and move its contents to there own .cpp files.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/GetterSetter.cpp: Copied from kjs/internal.cpp.
+        * kjs/InternalFunction.cpp: Copied from kjs/internal.cpp.
+        * kjs/JSNumberCell.cpp: Copied from kjs/internal.cpp.
+        * kjs/JSString.cpp: Copied from kjs/internal.cpp.
+        * kjs/JSString.h:
+        * kjs/LabelStack.cpp: Copied from kjs/internal.cpp.
+        * kjs/NumberConstructor.cpp:
+        * kjs/NumberObject.cpp:
+        (KJS::constructNumber):
+        (KJS::constructNumberFromImmediateNumber):
+        * kjs/internal.cpp: Removed.
+
+2008-06-30  Adam Roben  <aroben@apple.com>
+
+        Fix <rdar://5954749> Assertion failure due to HashTable's use of
+        operator&
+
+        HashTable was passing &value to constructDeletedValue, which in
+        classes like WebCore::COMPtr would cause an assertion. We now pass
+        value by reference instead of by address so that the HashTraits
+        implementations have more flexibility in constructing the deleted
+        value.
+
+        Reviewed by Ada Chan.
+
+        * VM/CodeGenerator.h: Updated for changes to HashTraits.
+        * wtf/HashTable.h:
+        (WTF::::deleteBucket): Changed to pass bucket by reference instead of
+        by address.
+        (WTF::::checkKey): Ditto.
+        * wtf/HashTraits.h:
+        (WTF::): Updated HashTraits for HashTable change.
+
+2008-07-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Make RegisterFile really unmap memory on destruction.
+
+        This fixes run-webkit-tests --threaded, which ran out of address space in a few seconds.
+
+        * VM/RegisterFile.cpp: (KJS::RegisterFile::~RegisterFile): Unmap all the memory, not just
+        1/4 of it.
+
+        * kjs/JSGlobalObject.h: Don't include RegisterFile.h, so that changes to it don't make
+        half of WebCore rebuild.
+
+        * VM/Machine.h: Don't forward declare RegisterFile, as RegisterFile.h is included already.
+
+        * VM/RegisterFile.h: (KJS::RegisterFile::RegisterFile): Assert that the allocation succeeded.
+
+2008-06-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Oliver.
+
+        Correct the documentation for op_put_by_index.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-06-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 19821: Merge the instruction pair (less, jfalse)
+        <https://bugs.webkit.org/show_bug.cgi?id=19821>
+        
+        This is a 2.4% win on SunSpider. I needed to add an ALWAYS_INLINE
+        intrinisc to CodeGenerator::rewindBinaryOp() to avoid a massive
+        regression in regexp-dna.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::rewindBinaryOp):
+        (KJS::CodeGenerator::emitJumpIfFalse):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.cpp:
+        (KJS::):
+        * VM/Opcode.h:
+
+2008-06-29  Sam Weinig  <sam@webkit.org>
+
+        Fix non-AllInOne builds.
+
+        * kjs/JSObject.cpp:
+        * kjs/JSValue.cpp:
+
+2008-06-29  Sam Weinig  <sam@webkit.org>
+
+        Build fix for Qt.
+
+        * kjs/DateMath.cpp:
+        * kjs/DatePrototype.cpp:
+
+2008-06-29  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Cameron Zwarich.
+
+        Splits ErrorConstructor, ErrorPrototype,  NativeErrorConstructor and
+        NativeErrorPrototype out of error_object.h/cpp and renames it ErrorInstance.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArrayConstructor.cpp:
+        * kjs/ArrayPrototype.cpp:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/DatePrototype.cpp:
+        * kjs/ErrorConstructor.cpp: Copied from kjs/error_object.cpp.
+        * kjs/ErrorConstructor.h: Copied from kjs/error_object.h.
+        * kjs/ErrorInstance.cpp: Copied from kjs/error_object.cpp.
+        * kjs/ErrorInstance.h: Copied from kjs/error_object.h.
+        * kjs/ErrorPrototype.cpp: Copied from kjs/error_object.cpp.
+        * kjs/ErrorPrototype.h: Copied from kjs/error_object.h.
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSObject.cpp:
+        * kjs/JSValue.cpp:
+        * kjs/NativeErrorConstructor.cpp: Copied from kjs/error_object.cpp.
+        * kjs/NativeErrorConstructor.h: Copied from kjs/error_object.h.
+        * kjs/NativeErrorPrototype.cpp: Copied from kjs/error_object.cpp.
+        * kjs/NativeErrorPrototype.h: Copied from kjs/error_object.h.
+        * kjs/NumberPrototype.cpp:
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpObject.cpp:
+        * kjs/RegExpPrototype.cpp:
+        * kjs/StringPrototype.cpp:
+        * kjs/error_object.cpp: Removed.
+        * kjs/error_object.h: Removed.
+        * kjs/internal.cpp:
+
+2008-06-29  Sam Weinig  <sam@webkit.org>
+
+        Fix non-AllInOne build.
+
+        * kjs/DateConstructor.cpp:
+        * kjs/DateMath.cpp:
+        * kjs/JSObject.cpp:
+
+2008-06-29  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Splits DateConstructor and DatePrototype out of date_object.h/cpp
+        Moves shared Date code into DateMath.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/DateConstructor.cpp: Copied from kjs/date_object.cpp.
+        * kjs/DateConstructor.h: Copied from kjs/date_object.h.
+        * kjs/DateMath.cpp:
+        (KJS::ymdhmsToSeconds):
+        (KJS::):
+        (KJS::skipSpacesAndComments):
+        (KJS::findMonth):
+        (KJS::parseDate):
+        (KJS::timeClip):
+        (KJS::formatDate):
+        (KJS::formatDateUTCVariant):
+        (KJS::formatTime):
+        * kjs/DateMath.h:
+        (KJS::gmtoffset):
+        * kjs/DatePrototype.cpp: Copied from kjs/date_object.cpp.
+        * kjs/DatePrototype.h: Copied from kjs/date_object.h.
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSObject.cpp:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        * kjs/internal.cpp:
+
+2008-06-29  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Cameron Zwarich
+
+        Fix Gtk non-AllInOne build
+
+        * GNUmakefile.am: include JSVariableObject.cpp
+        * kjs/RegExpConstructor.cpp: include RegExpObject.h
+        * kjs/RegExpObject.h: forward declare RegExpPrototype
+
+2008-06-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam and Cameron.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=19805
+          Array.concat turns missing array elements into "undefined"
+
+        Test: fast/js/array-holes.html
+
+        * JavaScriptCore.exp: No longer export JSArray::getItem.
+
+        * kjs/ArrayPrototype.cpp:
+        (KJS::arrayProtoFuncConcat): Changed to use getProperty instead of
+        JSArray::getItem -- need to handle properties from the prototype chain
+        instead of ignoring them.
+
+        * kjs/JSArray.cpp: Removed getItem.
+        * kjs/JSArray.h: Ditto.
+
+2008-06-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19804
+          optimize access to arrays without "holes"
+
+        SunSpider says 1.8% faster.
+
+        * kjs/JSArray.cpp:
+        (KJS::JSArray::JSArray): Initialize m_fastAccessCutoff when creating
+        arrays. Also updated for new location of m_vectorLength.
+        (KJS::JSArray::getItem): Updated for new location of m_vectorLength.
+        (KJS::JSArray::getSlowCase): Added. Broke out the non-hot parts of
+        getOwnPropertySlot to make the hot part faster.
+        (KJS::JSArray::getOwnPropertySlot): Added a new faster case for
+        indices lower than m_fastAccessCutoff. We can do theese with no
+        additional checks or branches.
+        (KJS::JSArray::put): Added a new faster case for indices lower than
+        m_fastAccessCutoff. We can do theese with no additional checks or
+        branches. Moved the maxArrayIndex handling out of this function.
+        Added code to set m_fastAccessCutoff when the very last hole in
+        an array is filled; this is how the cutoff gets set for most arrays.
+        (KJS::JSArray::putSlowCase): Moved the rest of the put function logic
+        in here, to make the hot part of the put function faster.
+        (KJS::JSArray::deleteProperty): Added code to lower m_fastAccessCutoff
+        when a delete makes a new hole in the array.
+        (KJS::JSArray::getPropertyNames): Updated for new location of
+        m_vectorLength.
+        (KJS::JSArray::increaseVectorLength): Ditto.
+        (KJS::JSArray::setLength): Added code to lower m_fastAccessCutoff
+        when setLength makes the array smaller.
+        (KJS::JSArray::mark): Updated for new location of m_vectorLength.
+        (KJS::JSArray::sort): Ditto. Set m_fastAccessCutoff after moving
+        all the holes to the end of the array.
+        (KJS::JSArray::compactForSorting): Ditto.
+        (KJS::JSArray::checkConsistency): Added consistency checks fro
+        m_fastAccessCutoff and updated for the new location of m_vectorLength.
+
+        * kjs/JSArray.h: Added declarations for slow case functions.
+        Replaced m_vectorLength with m_fastAccessCutoff.
+
+2008-06-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam.
+
+        When executing a native call, check for an exception before writing the
+        return value.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-06-28  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Flag headers as private or public as is appropriate.
+        These settings were accidentally removed during some project file cleanup.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-06-28  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Splits RegExpConstructor and RegExpPrototype out of RegExpObject.h/cpp
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Machine.cpp:
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/RegExpConstructor.cpp: Copied from kjs/RegExpObject.cpp.
+        * kjs/RegExpConstructor.h: Copied from kjs/RegExpObject.h.
+        * kjs/RegExpObject.cpp:
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp: Copied from kjs/RegExpObject.cpp.
+        * kjs/RegExpPrototype.h: Copied from kjs/RegExpObject.h.
+        * kjs/StringPrototype.cpp:
+        * kjs/internal.cpp:
+
+2008-06-28  Sam Weinig  <sam@webkit.org>
+
+        Fix non-AllInOne builds.
+
+        * kjs/StringConstructor.cpp:
+
+2008-06-28  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Rename string_object.h/cpp to StringObject.h/cpp and split out StringObjectThatMasqueradesAsUndefined,
+        StringConstructor and StringPrototype.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/StringConstructor.cpp: Copied from JavaScriptCore/kjs/string_object.cpp.
+        * kjs/StringConstructor.h: Copied from JavaScriptCore/kjs/string_object.h.
+        * kjs/StringObject.cpp: Copied from JavaScriptCore/kjs/string_object.cpp.
+        * kjs/StringObject.h: Copied from JavaScriptCore/kjs/string_object.h.
+        * kjs/StringObjectThatMasqueradesAsUndefined.h: Copied from JavaScriptCore/kjs/string_object.h.
+        * kjs/StringPrototype.cpp: Copied from JavaScriptCore/kjs/string_object.cpp.
+        * kjs/StringPrototype.h: Copied from JavaScriptCore/kjs/string_object.h.
+        * kjs/internal.cpp:
+        * kjs/string_object.cpp: Removed.
+        * kjs/string_object.h: Removed.
+
+2008-06-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix: JSVariableObject is now part of AllInOne
+
+        * GNUmakefile.am:
+
+2008-06-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19801
+          add a feature so we can tell what regular expressions are taking time
+
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile): Compile in the string if REGEXP_HISTOGRAM is on.
+
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute): Add hook to time execution.
+        (Histogram::~Histogram): Print a sorted list of what took time.
+        (Histogram::add): Accumulate records of what took time.
+        (HistogramTimeLogger::~HistogramTimeLogger): Hook that calls
+        Histogram::add at the right moment and creates the global histogram
+        object.
+
+        * pcre/pcre_internal.h: Define REGEXP_HISTOGRAM.
+
+        * pcre/pcre_tables.cpp: Added missing include of "config.h". Not needed
+        any more, but an omissions an earlier version of this patch detected.
+        * pcre/pcre_ucp_searchfuncs.cpp: Ditto.
+        * pcre/pcre_xclass.cpp: Ditto.
+
+2008-06-28  Sam Weinig  <sam@webkit.org>
+
+        Try and fix the Windows build again.
+
+        * kjs/RegExpObject.cpp:
+        * kjs/date_object.cpp:
+        * kjs/error_object.cpp:
+
+2008-06-28  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove unused StringConstructorFunction class.
+
+        * kjs/string_object.h:
+
+2008-06-28  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * kjs/ArrayPrototype.cpp:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/BooleanPrototype.h:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/JSImmediate.cpp:
+        * kjs/JSObject.cpp:
+        * kjs/MathObject.cpp:
+        * kjs/NumberPrototype.cpp:
+        * kjs/NumberPrototype.h:
+        * kjs/ObjectConstructor.cpp:
+        * kjs/RegExpObject.h:
+        * kjs/error_object.h:
+        * kjs/string_object.cpp:
+
+2008-06-28  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Splits FunctionConstructor out of FunctionPrototype.h/cpp
+        Splits NumberConstructor and NumberPrototype out of NumberObject.h/cpp
+        Rename object_object.h/cpp to ObjectPrototype.h/cpp and split out ObjectConstructor.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSClassRef.cpp:
+        * API/JSObjectRef.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Machine.cpp:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArrayConstructor.cpp:
+        * kjs/ArrayConstructor.h:
+        * kjs/FunctionConstructor.cpp: Copied from JavaScriptCore/kjs/FunctionPrototype.cpp.
+        * kjs/FunctionConstructor.h: Copied from JavaScriptCore/kjs/FunctionPrototype.h.
+        * kjs/FunctionPrototype.cpp:
+        * kjs/FunctionPrototype.h:
+        * kjs/JSFunction.cpp:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSImmediate.cpp:
+        * kjs/MathObject.h:
+        * kjs/NumberConstructor.cpp: Copied from JavaScriptCore/kjs/NumberObject.cpp.
+        * kjs/NumberConstructor.h: Copied from JavaScriptCore/kjs/NumberObject.h.
+        * kjs/NumberObject.cpp:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp: Copied from JavaScriptCore/kjs/NumberObject.cpp.
+        * kjs/NumberPrototype.h: Copied from JavaScriptCore/kjs/NumberObject.h.
+        * kjs/ObjectConstructor.cpp: Copied from JavaScriptCore/kjs/object_object.cpp.
+        * kjs/ObjectConstructor.h: Copied from JavaScriptCore/kjs/object_object.h.
+        * kjs/ObjectPrototype.cpp: Copied from JavaScriptCore/kjs/object_object.cpp.
+        * kjs/ObjectPrototype.h: Copied from JavaScriptCore/kjs/object_object.h.
+        * kjs/RegExpObject.h:
+        * kjs/Shell.cpp:
+        * kjs/error_object.h:
+        * kjs/internal.cpp:
+        * kjs/nodes.cpp:
+        * kjs/object_object.cpp: Removed.
+        * kjs/object_object.h: Removed.
+        * kjs/string_object.h:
+
+2008-06-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=19796
+          optimize expressions with ignored results (especially post-increment)
+
+        SunSpider says 0.9% faster.
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::tempDestination): Create a new temporary for
+        ignoredResult() too, just as we would for 0.
+        (KJS::CodeGenerator::finalDestination): Use the temporary if the
+        register passed in is ignoredResult() too, just as we would for 0.
+        (KJS::CodeGenerator::destinationForAssignResult): Return 0 if the
+        passed in register is ignoredResult(), just as we would for 0.
+        (KJS::CodeGenerator::moveToDestinationIfNeeded): Return 0 if the
+        register passed in is ignoredResult(). What matters is that we
+        don't want to emit a move. The return value won't be looked at.
+        (KJS::CodeGenerator::emitNode): Allow ignoredResult() and pass it
+        through to the node's emitCode function.
+
+        * VM/RegisterID.h:
+        (KJS::ignoredResult): Added. Special value to indicate the result of
+        a node will be ignored and need not be put in any register.
+
+        * kjs/nodes.cpp:
+        (KJS::NullNode::emitCode): Do nothing if dst == ignoredResult().
+        (KJS::BooleanNode::emitCode): Ditto.
+        (KJS::NumberNode::emitCode): Ditto.
+        (KJS::StringNode::emitCode): Ditto.
+        (KJS::RegExpNode::emitCode): Ditto.
+        (KJS::ThisNode::emitCode): Ditto.
+        (KJS::ResolveNode::emitCode): Do nothing if dst == ignoredResult() and
+        the identifier resolves to a local variable.
+        (KJS::ObjectLiteralNode::emitCode): Do nothing if dst == ignoredResult()
+        and the object is empty.
+        (KJS::PostIncResolveNode::emitCode): If dst == ignoredResult(), then do
+        nothing for the local constant case, and do a pre-increment in all the
+        other cases.
+        (KJS::PostDecResolveNode::emitCode): Ditto.
+        (KJS::PostIncBracketNode::emitCode): Ditto.
+        (KJS::PostDecBracketNode::emitCode): Ditto.
+        (KJS::PostIncDotNode::emitCode): Ditto.
+        (KJS::PostDecDotNode::emitCode): Ditto.
+        (KJS::DeleteValueNode::emitCode): Pass ignoredResult() when evaluating
+        the expression.
+        (KJS::VoidNode::emitCode): Ditto.
+        (KJS::TypeOfResolveNode::emitCode): If dst == ignoredResult(), do nothing
+        if the identifier resolves to a local variable, and don't bother generating
+        a typeof opcode in the other case.
+        (KJS::TypeOfValueNode::emitCode): Ditto.
+        (KJS::PreIncResolveNode::emitCode): Do nothing if dst == ignoredResult() and
+        the identifier resolves to a local constant.
+        (KJS::PreDecResolveNode::emitCode): Ditto.
+        (KJS::AssignResolveNode::emitCode): Turn ignoredResult() into 0 in a couple
+        places, because we need to put the result into a register so we can assign
+        it. At other sites this is taken care of by functions like finalDestination.
+        (KJS::CommaNode::emitCode): Pass ignoredResult() when evaluating the first
+        expression.
+        (KJS::ForNode::emitCode): Pass ignoredResult() when evaluating the first and
+        third expressions.
+        (KJS::ForInNode::emitCode): Pass ignoredResult() when evaluating the first
+        expression.
+
+2008-06-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19787
+          create most arrays from values in registers rather than with multiple put operations
+
+        SunSpider says 0.8% faster.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump): Added argv and argc parameters to new_array.
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Ditto.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitNewArray): Added.
+        * VM/CodeGenerator.h: Added ElementNode* argument to emitNewArray.
+
+        * kjs/nodes.cpp:
+        (KJS::ArrayNode::emitCode): Pass the ElementNode to emitNewArray so it can be
+        initialized with as many elements as possible. If the array doesn't have any
+        holes in it, that's all that's needed. If there are holes, then emit some separate
+        put operations for the other values in the array and for the length as needed.
+
+        * kjs/nodes.h: Added some accessors to ElementNode so the code generator can
+        iterate through elements and generate code to evaluate them. Now ArrayNode does
+        not need to be a friend. Also took out some unused PlacementNewAdoptType
+        constructors.
+
+2008-06-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        * kjs/nodes.h: Remove obsolete PlacementNewAdopt constructors.
+        We no longer mutate the AST in place.
+
+2008-06-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Build fix
+
+        * VM/Machine.cpp: include stdio.h for printf
+
+2008-06-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix platforms that don't use AllInOne.cpp
+
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanPrototype.h:
+        * kjs/FunctionPrototype.cpp:
+
+2008-06-27  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Splits ArrayConstructor out of ArrayPrototype.h/cpp
+        Splits BooleanConstructor and BooleanPrototype out of BooleanObject.h/cpp
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Machine.cpp:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArrayConstructor.cpp: Copied from kjs/ArrayPrototype.cpp.
+        * kjs/ArrayConstructor.h: Copied from kjs/ArrayPrototype.h.
+        * kjs/ArrayPrototype.cpp:
+        * kjs/ArrayPrototype.h:
+        * kjs/BooleanConstructor.cpp: Copied from kjs/BooleanObject.cpp.
+        * kjs/BooleanConstructor.h: Copied from kjs/BooleanObject.h.
+        * kjs/BooleanObject.cpp:
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp: Copied from kjs/BooleanObject.cpp.
+        * kjs/BooleanPrototype.h: Copied from kjs/BooleanObject.h.
+        * kjs/CommonIdentifiers.h:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/JSArray.cpp:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSImmediate.cpp:
+        * kjs/Shell.cpp:
+        * kjs/internal.cpp:
+        * kjs/nodes.cpp:
+        * kjs/string_object.cpp:
+
+2008-06-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam.
+
+        Bug 18626: SQUIRRELFISH: support the "slow script" dialog <https://bugs.webkit.org/show_bug.cgi?id=18626>
+        <rdar://problem/5973931> Slow script dialog needs to be reimplemented for squirrelfish
+
+        Adds support for the slow script dialog in squirrelfish.  This requires the addition
+        of three new op codes, op_loop, op_loop_if_true, and op_loop_if_less which have the
+        same behaviour as their simple jump equivalents but have an additional time out check.
+
+        Additional assertions were added to other jump instructions to prevent accidentally
+        creating loops with jump types that do not support time out checks.
+
+        Sunspider does not report a regression, however this appears very sensitive to code
+        layout and hardware, so i would expect up to a 1% regression on other systems.
+
+        Part of this required moving the old timeout logic from JSGlobalObject and into Machine
+        which is the cause of a number of the larger diff blocks.
+
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        (KJS::CodeGenerator::emitJumpScopes):
+        * VM/ExceptionHelpers.cpp:
+        (KJS::InterruptedExecutionError::isWatchdogException):
+        (KJS::createInterruptedExecutionException):
+        * VM/ExceptionHelpers.h:
+        * VM/LabelID.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine):
+        (KJS::Machine::throwException):
+        (KJS::Machine::resetTimeoutCheck):
+        (KJS::getCurrentTime):
+        (KJS::Machine::checkTimeout):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        (KJS::Machine::setTimeoutTime):
+        (KJS::Machine::startTimeoutCheck):
+        (KJS::Machine::stopTimeoutCheck):
+        (KJS::Machine::initTimeout):
+        * VM/Opcode.cpp:
+        (KJS::):
+        * VM/Opcode.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::init):
+        (KJS::JSGlobalObject::setTimeoutTime):
+        (KJS::JSGlobalObject::startTimeoutCheck):
+        * kjs/JSGlobalObject.h:
+        * kjs/JSObject.h:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+
+2008-06-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk and Qt build fix: Remove RegisterFileStack from the build
+        scripts.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+
+2008-06-27  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Geoff.
+
+        Build fixes. 
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::RegisterFile):
+        * kjs/JSGlobalObject.cpp:
+        * kjs/collector.cpp:
+
+2008-06-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        One RegisterFile to rule them all!
+        
+        SunSpider reports a 0.2% speedup.
+
+        This patch removes the RegisterFileStack abstraction and replaces it with
+        a single register file that
+        
+        (a) allocates a fixed storage area, including a fixed area for global
+        vars, so that no operation may cause the register file to reallocate
+        
+        and
+
+        (b) swaps between global storage areas when executing code in different 
+        global objects.
+        
+        This patch also changes the layout of the register file so that all call
+        frames, including call frames for global code, get a header. This is
+        required to support re-entrant global code. It also just makes things simpler.
+        
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addGlobalVar): New function. Differs from addVar in
+        that
+        
+        (a) global vars don't contribute to a CodeBlock's numLocals count, since
+        global storage is fixed and allocated at startup
+        
+        and
+        
+        (b) references to global vars get shifted to elide intermediate stack
+        between "r" and the global storage area.
+        
+        * VM/Machine.cpp:
+        (KJS::Machine::dumpRegisters): Updated this function to match the new
+        register file layout, and added the ability to dump exact identifiers
+        for the different parts of a call frame.
+        
+        (KJS::Machine::unwindCallFrame): Updated this function to match the new
+        register file layout.
+         
+        (KJS::Machine::execute): Updated this function to initialize a call frame
+        header for global code, and to swap global storage areas when switching
+        to execution in a new global object.
+        
+        (KJS::Machine::privateExecute): Got rid of "safeForReentry" and re-reading
+        of registerBase because the register file is always safe for reentry now,
+        and registerBase never changes.
+        
+        * VM/Machine.h: Moved the call frame header enum from Machine to RegisterFile,
+        to resolve a header dependency problem (a good sign that the enum belonged
+        in RegisterFile all along!)
+
+        * VM/RegisterFile.cpp:
+        * VM/RegisterFile.h: Changed RegisterFile to mmap a fixed size register
+        area. This allows us to avoid re-allocting the register file later on.
+        Instead, we rely on the OS to allocate physical pages to the register
+        file as necessary.
+
+        * VM/RegisterFileStack.cpp: Removed. Tada!
+        * VM/RegisterFileStack.h: Removed. Tada!
+
+        * kjs/DebuggerCallFrame.cpp: Updated this class to match the new
+        register file layout, greatly simplifying it in the process.
+
+        * kjs/JSActivation.h:
+        * kjs/JSActivation.cpp: Moved some of this logic up to JSVariableObject,
+        since the global object now needs to be able to tear off its registers
+        just like the activation object.
+
+        * kjs/JSFunction.cpp: No need to fiddle with the register file anymore.
+
+        * kjs/JSGlobalObject.h:
+        * kjs/JSGlobalObject.cpp: Updated JSGlobalObject to support moving its
+        global storage area into and out of the register file.
+
+        * kjs/PropertySlot.cpp: No need to fiddle with the register file anymore.
+
+        * kjs/collector.cpp: Renamed markStackObjectConservatively to
+        markConservatively, since we don't just mark stack objects this way.
+        
+        Also, added code to mark the machine's register file.
+
+        * kjs/config.h: Moved some platforms #defines from here...
+        * wtf/Platform.h: ...to here, to support mmap/VirtualAlloc detection
+        in RegisterFile.h.
+
+2008-06-26  Mark Rowe  <mrowe@apple.com>
+
+        Speculative fix for the Windows build.
+
+        * kjs/JSImmediate.cpp:
+
+2008-06-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler and Geoff Garen.
+
+        Fix the malloc zone introspection functions so that malloc_zone_statistics does not give
+        bogus output in an application that uses JavaScriptCore.
+
+        * kjs/CollectorHeapIntrospector.cpp:
+        (KJS::CollectorHeapIntrospector::statistics): Return statistics about memory allocated by the collector.
+        * kjs/CollectorHeapIntrospector.h:
+        * wtf/FastMalloc.cpp: Zero out the statistics.  FastMalloc doesn't track this information at present.
+        Returning zero for all values is preferable to returning bogus data.
+
+2008-06-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19721
+          speed up JavaScriptCore by not wrapping strings in objects just
+          to call functions on them
+
+        - optimize UString append and the replace function a bit
+
+        SunSpider says 1.8% faster.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/JSPropertyNameIterator.cpp: Added include of JSString.h, now needed
+        because jsString returns a JSString*.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Removed the toObject call from native
+        function calls. Also removed code to put the this value into a register.
+
+        * kjs/BooleanObject.cpp:
+        (KJS::booleanProtoFuncToString): Rewrite to handle false and true
+        separately.
+
+        * kjs/FunctionPrototype.cpp:
+        (KJS::constructFunction): Use single-character append rather than building
+        a string for each character.
+        * kjs/JSFunction.cpp:
+        (KJS::globalFuncUnescape): Ditto.
+
+        * kjs/JSImmediate.cpp:
+        (KJS::JSImmediate::prototype): Added. Gets the appropriate prototype for
+        use with an immediate value. To be used instead of toObject when doing a
+        get on an immediate value.
+        * kjs/JSImmediate.h: Added prototype.
+
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::toString): Tweaked formatting.
+
+        * kjs/JSObject.h:
+        (KJS::JSValue::get): Use prototype instead of toObject to avoid creating
+        an object wrapper just to search for properties. This also saves an
+        unnecessary hash table lookup since the object wrappers themselves don't
+        have any properties.
+
+        * kjs/JSString.h: Added toThisString and toThisJSString.
+
+        * kjs/JSValue.cpp:
+        (KJS::JSCell::toThisString): Added.
+        (KJS::JSCell::toThisJSString): Added.
+        (KJS::JSCell::getJSNumber): Added.
+        (KJS::jsString): Changed return type to JSString*.
+        (KJS::jsOwnedString): Ditto.
+
+        * kjs/JSValue.h:
+        (KJS::JSValue::toThisString): Added.
+        (KJS::JSValue::toThisJSString): Added.
+        (KJS::JSValue::getJSNumber): Added.
+
+        * kjs/NumberObject.cpp:
+        (KJS::NumberObject::getJSNumber): Added.
+        (KJS::integer_part_noexp): Append C string directly rather than first
+        turning it into a UString.
+        (KJS::numberProtoFuncToString): Use getJSNumber to check if the value
+        is a number rather than isObject(&NumberObject::info). This works for
+        immediate numbers, number cells, and NumberObject instances.
+        (KJS::numberProtoFuncToLocaleString): Ditto.
+        (KJS::numberProtoFuncValueOf): Ditto.
+        (KJS::numberProtoFuncToFixed): Ditto.
+        (KJS::numberProtoFuncToExponential): Ditto.
+        (KJS::numberProtoFuncToPrecision): Ditto.
+        * kjs/NumberObject.h: Added getJSNumber.
+
+        * kjs/PropertySlot.cpp: Tweaked comment.
+
+        * kjs/internal.cpp:
+        (KJS::JSString::toThisString): Added.
+        (KJS::JSString::toThisJSString): Added.
+        (KJS::JSString::getOwnPropertySlot): Changed code that searches the
+        prototype chain to start with the string prototype and not create a
+        string object.
+        (KJS::JSNumberCell::toThisString): Added.
+        (KJS::JSNumberCell::getJSNumber): Added.
+
+        * kjs/lookup.cpp:
+        (KJS::staticFunctionGetter): Moved here, because there's no point in
+        having a function that's only used for a function pointer be inline.
+        (KJS::setUpStaticFunctionSlot): New function for getStaticFunctionSlot.
+
+        * kjs/lookup.h:
+        (KJS::staticValueGetter): Don't mark this inline. It doesn't make sense
+        to have a function that's only used for a function pointer be inline.
+        (KJS::getStaticFunctionSlot): Changed to get properties from the parent
+        first before doing any handling of functions. This is the fastest way
+        to return the function once the initial setup is done.
+
+        * kjs/string_object.cpp:
+        (KJS::StringObject::getPropertyNames): Call value() instead of getString(),
+        avoiding an unnecessary virtual function call (the call to the type()
+        function in the implementation of the isString() function).
+        (KJS::StringObject::toString): Added.
+        (KJS::StringObject::toThisString): Added.
+        (KJS::StringObject::toThisJSString): Added.
+        (KJS::substituteBackreferences): Rewrote to use a appending algorithm
+        instead of a the old one that tried to replace in place.
+        (KJS::stringProtoFuncReplace): Merged this function and the replace function.
+        Replaced the hand-rolled dynamic arrays for source ranges and replacements
+        with Vector.
+        (KJS::stringProtoFuncToString): Handle JSString as well as StringObject.
+        Removed the separate valueOf implementation, since it can just share this.
+        (KJS::stringProtoFuncCharAt): Use toThisString, which handles JSString as
+        well as StringObject, and is slightly more efficient than the old code too.
+        (KJS::stringProtoFuncCharCodeAt): Ditto.
+        (KJS::stringProtoFuncConcat): Ditto.
+        (KJS::stringProtoFuncIndexOf): Ditto.
+        (KJS::stringProtoFuncLastIndexOf): Ditto.
+        (KJS::stringProtoFuncMatch): Ditto.
+        (KJS::stringProtoFuncSearch): Ditto.
+        (KJS::stringProtoFuncSlice): Ditto.
+        (KJS::stringProtoFuncSplit): Ditto.
+        (KJS::stringProtoFuncSubstr): Ditto.
+        (KJS::stringProtoFuncSubstring): Ditto.
+        (KJS::stringProtoFuncToLowerCase): Use toThisJSString.
+        (KJS::stringProtoFuncToUpperCase): Ditto.
+        (KJS::stringProtoFuncToLocaleLowerCase): Ditto.
+        (KJS::stringProtoFuncToLocaleUpperCase): Ditto.
+        (KJS::stringProtoFuncLocaleCompare): Ditto.
+        (KJS::stringProtoFuncBig): Use toThisString.
+        (KJS::stringProtoFuncSmall): Ditto.
+        (KJS::stringProtoFuncBlink): Ditto.
+        (KJS::stringProtoFuncBold): Ditto.
+        (KJS::stringProtoFuncFixed): Ditto.
+        (KJS::stringProtoFuncItalics): Ditto.
+        (KJS::stringProtoFuncStrike): Ditto.
+        (KJS::stringProtoFuncSub): Ditto.
+        (KJS::stringProtoFuncSup): Ditto.
+        (KJS::stringProtoFuncFontcolor): Ditto.
+        (KJS::stringProtoFuncFontsize): Ditto.
+        (KJS::stringProtoFuncAnchor): Ditto.
+        (KJS::stringProtoFuncLink): Ditto.
+
+        * kjs/string_object.h: Added toString, toThisString, and toThisJSString.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::append): Added a version that takes a character pointer and
+        size, so we don't have to create a UString just to append to another UString.
+        * kjs/ustring.h:
+
+2008-06-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        Make JSGlobalData per-thread.
+
+        No change on SunSpider total.
+
+        * wtf/ThreadSpecific.h: Re-enabled the actual implementation.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject): Re-added a JSLock-related assertion. We'll probably
+        want to preserve these somehow to keep legacy behavior in working condition.
+        (KJS::JSGlobalObject::init): Initialize globalData pointer earlier, so that it is ready
+        when updating JSGlobalObject linked list.
+
+        * kjs/JSGlobalObject.h: (KJS::JSGlobalObject::head): Changed head() to be non-static, and
+        to use JSGlobalData associated with the current object.
+
+        * kjs/InitializeThreading.cpp: (KJS::initializeThreadingOnce): Removed a no longer needed
+        Heap::registerAsMainThread() call.
+
+        * kjs/JSGlobalData.h: Removed a lying lie comment - parserObjectExtraRefCounts is not
+        transient, and while newParserObjects may conceptually be such, there is still some node
+        manipulation going on outside Parser::parse which touches it.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::~JSGlobalData): Delete recently added members.
+        (KJS::JSGlobalData::sharedInstance): Actually use a separate instance.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::Heap):
+        (KJS::Heap::~Heap): Added a destructor, which unconditionally deletes everything.
+        (KJS::Heap::sweep): Removed code related to "collect on main thread only" logic.
+        (KJS::Heap::collect): Ditto.
+        (KJS::Heap::globalObjectCount): Explicitly use per-thread instance of JSGlobalObject linked
+        list now that JSGlobalObject::head() is not static. Curently, WebCoreStatistics methods only
+        work with the main thread currently anyway.
+        (KJS::Heap::protectedGlobalObjectCount): Ditto.
+
+        * kjs/collector.h: Removed code related to "collect on main thread only" logic.
+
+        * JavaScriptCore.exp: Removed Heap::collectOnMainThreadOnly.
+
+2008-06-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19767
+        REGRESSION: Crash in sort() when visiting http://www.onnyturf.com/subway/
+
+        * kjs/JSArray.cpp: (KJS::AVLTreeAbstractorForArrayCompare::set_balance_factor):
+        Made changing balance factor from -1 to +1 work correctly.
+
+        * wtf/AVLTree.h: (KJS::AVLTreeDefaultBSet::operator[]): Added an assertion that catches
+        this slightly earlier.
+
+2008-06-25  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes an ASSERT in the profiler when starting multiple profiles
+        with the same name inside the same function/program.
+
+        Reviewed by Kevin McCullough.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::Profile): Initialize m_stoppedCallDepth to zero.
+        (KJS::Profile::stopProfiling): Set the current node to the parent,
+        because we are in a call that will not get a didExecute call.
+        (KJS::Profile::removeProfile): Increment m_stoppedCallDepth to
+        account for didExecute not being called for profile.
+        (KJS::Profile::willExecute): Increment m_stoppedCallDepth if stopped.
+        (KJS::Profile::didExecute): Decrement m_stoppedCallDepth if stopped and
+        greater than zero, and return early.
+        * profiler/Profile.h: Added stoppedProfiling().
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::findProfile): Removed.
+        (KJS::Profiler::startProfiling): Don't return early for stopped profiles.
+        (KJS::Profiler::stopProfiling): Skipp stopped profiles.
+        (KJS::Profiler::didFinishAllExecution): Code clean-up.
+        * profiler/Profiler.h: Removed findProfile.
+
+2008-06-25  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Attempt to fix Windows debug build. The compiler gives a warning when
+        Structured Exception Handling and destructors are used in the same
+        function. Using manual locking and unlocking instead of constructors
+        and destructors should fix the warning.
+
+        * kjs/Shell.cpp:
+        (main):
+
+2008-06-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Forgot to address a review comment about better names for tracked objects, doing it now.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/nodes.cpp:
+        (KJS::ParserRefCounted::ParserRefCounted):
+        (KJS::ParserRefCounted::ref):
+        (KJS::ParserRefCounted::deref):
+        (KJS::ParserRefCounted::hasOneRef):
+        (KJS::ParserRefCounted::deleteNewObjects):
+
+2008-06-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        Remove more threadInstance() calls.
+
+        * kjs/JSFunction.cpp:
+        (KJS::JSFunction::getParameterName):
+        (KJS::IndexToNameMap::unMap):
+        (KJS::Arguments::deleteProperty):
+        * kjs/JSFunction.h:
+        Access nullIdentifier without going to thread specific storage.
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse):
+        * kjs/Parser.h:
+        (KJS::ParserRefCountedData::ParserRefCountedData):
+        (KJS::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::ParserRefCounted::ParserRefCounted):
+        (KJS::ParserRefCounted::ref):
+        (KJS::ParserRefCounted::deref):
+        (KJS::ParserRefCounted::hasOneRef):
+        (KJS::ParserRefCounted::deleteNewObjects):
+        (KJS::Node::Node):
+        (KJS::StatementNode::StatementNode):
+        (KJS::BreakpointCheckStatement::BreakpointCheckStatement):
+        (KJS::ConstDeclNode::ConstDeclNode):
+        (KJS::BlockNode::BlockNode):
+        (KJS::ForInNode::ForInNode):
+        (KJS::ScopeNode::ScopeNode):
+        (KJS::ProgramNode::ProgramNode):
+        (KJS::ProgramNode::create):
+        (KJS::EvalNode::EvalNode):
+        (KJS::EvalNode::create):
+        (KJS::FunctionBodyNode::FunctionBodyNode):
+        (KJS::FunctionBodyNode::create):
+        * kjs/nodes.h:
+        (KJS::ExpressionNode::):
+        (KJS::NullNode::):
+        (KJS::BooleanNode::):
+        (KJS::NumberNode::):
+        (KJS::ImmediateNumberNode::):
+        (KJS::StringNode::):
+        (KJS::RegExpNode::):
+        (KJS::ThisNode::):
+        (KJS::ResolveNode::):
+        (KJS::ElementNode::):
+        (KJS::ArrayNode::):
+        (KJS::PropertyNode::):
+        (KJS::PropertyListNode::):
+        (KJS::ObjectLiteralNode::):
+        (KJS::BracketAccessorNode::):
+        (KJS::DotAccessorNode::):
+        (KJS::ArgumentListNode::):
+        (KJS::ArgumentsNode::):
+        (KJS::NewExprNode::):
+        (KJS::EvalFunctionCallNode::):
+        (KJS::FunctionCallValueNode::):
+        (KJS::FunctionCallResolveNode::):
+        (KJS::FunctionCallBracketNode::):
+        (KJS::FunctionCallDotNode::):
+        (KJS::PrePostResolveNode::):
+        (KJS::PostIncResolveNode::):
+        (KJS::PostDecResolveNode::):
+        (KJS::PostfixBracketNode::):
+        (KJS::PostIncBracketNode::):
+        (KJS::PostDecBracketNode::):
+        (KJS::PostfixDotNode::):
+        (KJS::PostIncDotNode::):
+        (KJS::PostDecDotNode::):
+        (KJS::PostfixErrorNode::):
+        (KJS::DeleteResolveNode::):
+        (KJS::DeleteBracketNode::):
+        (KJS::DeleteDotNode::):
+        (KJS::DeleteValueNode::):
+        (KJS::VoidNode::):
+        (KJS::TypeOfResolveNode::):
+        (KJS::TypeOfValueNode::):
+        (KJS::PreIncResolveNode::):
+        (KJS::PreDecResolveNode::):
+        (KJS::PrefixBracketNode::):
+        (KJS::PreIncBracketNode::):
+        (KJS::PreDecBracketNode::):
+        (KJS::PrefixDotNode::):
+        (KJS::PreIncDotNode::):
+        (KJS::PreDecDotNode::):
+        (KJS::PrefixErrorNode::):
+        (KJS::UnaryOpNode::UnaryOpNode):
+        (KJS::UnaryPlusNode::):
+        (KJS::NegateNode::):
+        (KJS::BitwiseNotNode::):
+        (KJS::LogicalNotNode::):
+        (KJS::BinaryOpNode::BinaryOpNode):
+        (KJS::ReverseBinaryOpNode::ReverseBinaryOpNode):
+        (KJS::MultNode::):
+        (KJS::DivNode::):
+        (KJS::ModNode::):
+        (KJS::AddNode::):
+        (KJS::SubNode::):
+        (KJS::LeftShiftNode::):
+        (KJS::RightShiftNode::):
+        (KJS::UnsignedRightShiftNode::):
+        (KJS::LessNode::):
+        (KJS::GreaterNode::):
+        (KJS::LessEqNode::):
+        (KJS::GreaterEqNode::):
+        (KJS::InstanceOfNode::):
+        (KJS::InNode::):
+        (KJS::EqualNode::):
+        (KJS::NotEqualNode::):
+        (KJS::StrictEqualNode::):
+        (KJS::NotStrictEqualNode::):
+        (KJS::BitAndNode::):
+        (KJS::BitOrNode::):
+        (KJS::BitXOrNode::):
+        (KJS::LogicalAndNode::):
+        (KJS::LogicalOrNode::):
+        (KJS::ConditionalNode::):
+        (KJS::ReadModifyResolveNode::):
+        (KJS::AssignResolveNode::):
+        (KJS::ReadModifyBracketNode::):
+        (KJS::AssignBracketNode::):
+        (KJS::AssignDotNode::):
+        (KJS::ReadModifyDotNode::):
+        (KJS::AssignErrorNode::):
+        (KJS::CommaNode::):
+        (KJS::VarDeclCommaNode::):
+        (KJS::ConstStatementNode::):
+        (KJS::SourceElements::SourceElements):
+        (KJS::EmptyStatementNode::):
+        (KJS::DebuggerStatementNode::):
+        (KJS::ExprStatementNode::):
+        (KJS::VarStatementNode::):
+        (KJS::IfNode::):
+        (KJS::IfElseNode::):
+        (KJS::DoWhileNode::):
+        (KJS::WhileNode::):
+        (KJS::ForNode::):
+        (KJS::ContinueNode::):
+        (KJS::BreakNode::):
+        (KJS::ReturnNode::):
+        (KJS::WithNode::):
+        (KJS::LabelNode::):
+        (KJS::ThrowNode::):
+        (KJS::TryNode::):
+        (KJS::ParameterNode::):
+        (KJS::FuncExprNode::):
+        (KJS::FuncDeclNode::):
+        (KJS::CaseClauseNode::):
+        (KJS::ClauseListNode::):
+        (KJS::CaseBlockNode::):
+        (KJS::SwitchNode::):
+        Changed ParserRefCounted to hold a JSGlobalData pointer, and used it to replace
+        threadInstance calls.
+
+2008-06-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make the JavaScript shell collect the heap from main() instead of
+        jscmain() to suppress leak messages in debug builds.
+
+        * kjs/Shell.cpp:
+        (main):
+        (jscmain):
+
+2008-06-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Make the conversion of the pair (less, jtrue) to jless use register
+        reference counting information for safety instead of requiring callers
+        to decide whether it is safe.
+
+        No changes on SunSpider codegen.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::CaseBlockNode::emitCodeForBlock):
+
+2008-06-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/6031594> JSProfiler: Profiler goes into an infinite
+        loop sometimes.
+        <rdar://problem/6031603> JSProfiler: Profiler asserts in debug and
+        give the wrong times in release
+
+        Fixed two issues found by Tim in the same test.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::removeProfileStart): No longer take profile's time from
+        all ancestors, but instead attribute it to its parent.  Also add an
+        Assert to ensure we only delete the child we mean to.
+        (KJS::Profile::removeProfileEnd): Ditto for profileEnd.
+        (KJS::Profile::didExecute): Cleaned up the execution order and correctly
+        attribute all of the parent's time to the new node.
+        * profiler/ProfileNode.cpp: If this node does not have a startTime it
+        should not get a giant total time, but instead be 0.
+        (KJS::ProfileNode::endAndRecordCall):
+        * profiler/ProfileNode.h:
+        (KJS::ProfileNode::removeChild): Should reset the sibling pointers since
+        one of them has been removed.
+
+2008-06-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=19739
+          REGRESSION: fast/js/property-getters-and-setters.html fails
+
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::put): Remove an untested optimization I checked in by accident.
+        The two loops up the prototype chain both need to start from this; instead the
+        second loop was starting where the first loop left off.
+
+2008-06-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * kjs/nodes.cpp:
+
+2008-06-24  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon.
+
+        For the Qt build on Windows don't depend on the presence of GNU CPP
+        but use MSVC's preprocessor instead.
+        dftables accepts a --preprocessor option which is set in pcre.pri for MSVC platforms.
+
+        * pcre/dftables: Added support for specifying the preprocessor command
+        to use via --preprocessor, similar to
+        WebCore/bindings/scripts/generate-bindings.pl.
+        * pcre/pcre.pri: Pass --preprocessor='cl /e' to dftables, or more
+        generally speaking QMAKE_CC /E for the win32-msvc buildspecs.
+
+2008-06-24  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build, added missing include.
+
+        * kjs/PropertySlot.cpp:
+
+2008-06-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Make ParserRefCountedCounter actually perform a leak check.
+
+        * kjs/nodes.cpp:
+        (KJS::ParserRefCountedCounter::~ParserRefCountedCounter): Check for leaks in destructor,
+        not in constructor.
+        (KJS::ParserRefCountedCounter::increment):
+        (KJS::ParserRefCountedCounter::decrement):
+        (KJS::ParserRefCounted::ParserRefCounted):
+        (KJS::ParserRefCounted::~ParserRefCounted):
+        While at it, also made counting thread-safe.
+
+2008-06-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 19730: REGRESSION (r34497): Text in alerts in "Leisure suit Larry" is not wrapped
+        <https://bugs.webkit.org/show_bug.cgi?id=19730>
+
+        Do not convert the pair (less, jtrue) to jless when jtrue is a jump
+        target. An example of this is when the condition of a while loop is a
+        LogicalOrNode.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitLabel):
+
+2008-06-20  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Adam Roben.
+
+        Fix compile with MinGW.
+
+        * kjs/Shell.cpp:
+        * wtf/Threading.h:
+        (WTF::atomicIncrement):
+        (WTF::atomicDecrement):
+
+2008-06-23  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Prepration for returning memory to the OS on Windows.  Track whether a portion of a span of memory was returned to the OS.
+        If it was, ask that it be recommitted before returning it to the application as an allocated region.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::New):  If the span was decommitted, ask that it be recommitted before returning it.
+        (WTF::TCMalloc_PageHeap::AllocLarge):  Ditto.
+        (WTF::TCMalloc_PageHeap::Carve):  When splitting a span, ensure that the decommitted state propogates to the two new spans.
+        (WTF::TCMalloc_PageHeap::Delete):  When merging a span, ensure that the resulting span is marked as decommitted if any of the
+        spans being merged were marked as decommitted.
+        (WTF::TCMalloc_PageHeap::IncrementalScavenge):  Mark as decommitted after releasing the span.
+        (WTF::TCMalloc_Central_FreeList::FetchFromSpans): Add an assertion to catch a decommitted span being returned to the application
+        without first being recommitted.
+        (WTF::TCMalloc_Central_FreeList::Populate): Ditto.
+        * wtf/TCSystemAlloc.cpp: Stub out TCMalloc_SystemCommit.
+        * wtf/TCSystemAlloc.h:
+
+2008-06-23  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the sample member of Span when NO_TCMALLOC_SAMPLES is defined.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::Delete): Only update Span::sample if NO_TCMALLOC_SAMPLES is not defined.
+        (WTF::TCMallocStats::do_free):  Ditto.
+
+2008-06-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - work toward https://bugs.webkit.org/show_bug.cgi?id=19721
+
+        More preparation toward making functions work on primitive types without
+        creating wrapper objects. No speedup this time, but prepares for a future
+        speedup without slowing things down.
+
+        SunSpider reports no change.
+
+        - Eliminated the implementsCall, callAsFunction and construct virtual
+          functions from JSObject. Instead, the CallData and ConstructData for
+          a native function includes a function pointer that the caller can use
+          directly. Changed all call sites to use CallData and ConstructData.
+
+        - Changed the "this" argument to native functions to be a JSValue rather
+          than a JSObject. This prepares us for passing primitives into these
+          functions. The conversion to an object now must be done inside the
+          function. Critically, if it's a function that can be called on a DOM
+          window object, then we have to be sure to call toThisObject on the
+          argument before we use it for anything even if it's already an object.
+
+        - Eliminated the practice of using constructor objects in the global
+          object to make objects of the various basic types. Since these
+          constructors can't be replaced by script, there's no reason to involve
+          a constructor object at all. Added functions to do the construction
+          directly.
+
+        - Made some more class members private and protected, including virtual
+          function overrides. This can catch code using unnecessarily slow virtual
+          function code paths when the type of an object is known statically. If we
+          later find a new reason use the members outside the class it's easy to
+          make them public again.
+
+        - Moved the declarations of the native implementations for functions out
+          of header files. These can have internal linkage and be declared inside
+          the source file.
+
+        - Changed PrototypeFunction to take function pointers with the right
+          arguments to be put directly into CallData. This eliminates the
+          need to have a separate PrototypeReflexiveFunction, and reveals that the
+          real purpose of that class included something else specific to eval --
+          storage of a cached global object. So renamed PrototypeReflexiveFunction
+          to GlobalEvalFunction.
+
+        * API/JSCallbackConstructor.cpp:
+        (KJS::constructJSCallback):
+        (KJS::JSCallbackConstructor::getConstructData):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::implementsHasInstance):
+        (KJS::JSCallbackFunction::call):
+        (KJS::JSCallbackFunction::getCallData):
+        * API/JSCallbackFunction.h:
+        (KJS::JSCallbackFunction::classInfo):
+        * API/JSCallbackObject.h:
+        (KJS::JSCallbackObject::classRef):
+        (KJS::JSCallbackObject::classInfo):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::getConstructData):
+        (KJS::::construct):
+        (KJS::::getCallData):
+        (KJS::::call):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (KJS::jsTypeStringForValue):
+        (KJS::Machine::privateExecute):
+        * kjs/ArrayPrototype.cpp:
+        (KJS::arrayProtoFuncToString):
+        (KJS::arrayProtoFuncToLocaleString):
+        (KJS::arrayProtoFuncJoin):
+        (KJS::arrayProtoFuncConcat):
+        (KJS::arrayProtoFuncPop):
+        (KJS::arrayProtoFuncPush):
+        (KJS::arrayProtoFuncReverse):
+        (KJS::arrayProtoFuncShift):
+        (KJS::arrayProtoFuncSlice):
+        (KJS::arrayProtoFuncSort):
+        (KJS::arrayProtoFuncSplice):
+        (KJS::arrayProtoFuncUnShift):
+        (KJS::arrayProtoFuncFilter):
+        (KJS::arrayProtoFuncMap):
+        (KJS::arrayProtoFuncEvery):
+        (KJS::arrayProtoFuncForEach):
+        (KJS::arrayProtoFuncSome):
+        (KJS::arrayProtoFuncIndexOf):
+        (KJS::arrayProtoFuncLastIndexOf):
+        (KJS::ArrayConstructor::ArrayConstructor):
+        (KJS::constructArrayWithSizeQuirk):
+        (KJS::constructWithArrayConstructor):
+        (KJS::ArrayConstructor::getConstructData):
+        (KJS::callArrayConstructor):
+        (KJS::ArrayConstructor::getCallData):
+        * kjs/ArrayPrototype.h:
+        * kjs/BooleanObject.cpp:
+        (KJS::booleanProtoFuncToString):
+        (KJS::booleanProtoFuncValueOf):
+        (KJS::constructBoolean):
+        (KJS::constructWithBooleanConstructor):
+        (KJS::BooleanConstructor::getConstructData):
+        (KJS::callBooleanConstructor):
+        (KJS::BooleanConstructor::getCallData):
+        (KJS::constructBooleanFromImmediateBoolean):
+        * kjs/BooleanObject.h:
+        * kjs/CallData.h:
+        (KJS::):
+        * kjs/ConstructData.h:
+        (KJS::):
+        * kjs/FunctionPrototype.cpp:
+        (KJS::callFunctionPrototype):
+        (KJS::FunctionPrototype::getCallData):
+        (KJS::functionProtoFuncToString):
+        (KJS::functionProtoFuncApply):
+        (KJS::functionProtoFuncCall):
+        (KJS::constructWithFunctionConstructor):
+        (KJS::FunctionConstructor::getConstructData):
+        (KJS::callFunctionConstructor):
+        (KJS::FunctionConstructor::getCallData):
+        (KJS::constructFunction):
+        * kjs/FunctionPrototype.h:
+        * kjs/JSArray.cpp:
+        (KJS::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (KJS::JSArray::sort):
+        (KJS::constructEmptyArray):
+        (KJS::constructArray):
+        * kjs/JSArray.h:
+        (KJS::JSArray::classInfo):
+        * kjs/JSFunction.cpp:
+        (KJS::JSFunction::call):
+        (KJS::globalFuncEval):
+        (KJS::globalFuncParseInt):
+        (KJS::globalFuncParseFloat):
+        (KJS::globalFuncIsNaN):
+        (KJS::globalFuncIsFinite):
+        (KJS::globalFuncDecodeURI):
+        (KJS::globalFuncDecodeURIComponent):
+        (KJS::globalFuncEncodeURI):
+        (KJS::globalFuncEncodeURIComponent):
+        (KJS::globalFuncEscape):
+        (KJS::globalFuncUnescape):
+        (KJS::globalFuncKJSPrint):
+        (KJS::PrototypeFunction::PrototypeFunction):
+        (KJS::PrototypeFunction::getCallData):
+        (KJS::GlobalEvalFunction::GlobalEvalFunction):
+        (KJS::GlobalEvalFunction::mark):
+        * kjs/JSFunction.h:
+        (KJS::InternalFunction::classInfo):
+        (KJS::InternalFunction::functionName):
+        (KJS::JSFunction::classInfo):
+        (KJS::GlobalEvalFunction::cachedGlobalObject):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        (KJS::JSGlobalObject::mark):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObject):
+        (KJS::JSGlobalObject::evalFunction):
+        * kjs/JSImmediate.cpp:
+        (KJS::JSImmediate::toObject):
+        * kjs/JSNotAnObject.cpp:
+        * kjs/JSNotAnObject.h:
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::put):
+        (KJS::callDefaultValueFunction):
+        (KJS::JSObject::defaultValue):
+        (KJS::JSObject::lookupGetter):
+        (KJS::JSObject::lookupSetter):
+        (KJS::JSObject::hasInstance):
+        (KJS::JSObject::fillGetterPropertySlot):
+        (KJS::Error::create):
+        (KJS::constructEmptyObject):
+        * kjs/JSObject.h:
+        (KJS::GetterSetter::GetterSetter):
+        (KJS::GetterSetter::getter):
+        (KJS::GetterSetter::setGetter):
+        (KJS::GetterSetter::setter):
+        (KJS::GetterSetter::setSetter):
+        * kjs/JSValue.cpp:
+        (KJS::JSCell::deleteProperty):
+        (KJS::call):
+        (KJS::construct):
+        * kjs/JSValue.h:
+        * kjs/MathObject.cpp:
+        (KJS::mathProtoFuncAbs):
+        (KJS::mathProtoFuncACos):
+        (KJS::mathProtoFuncASin):
+        (KJS::mathProtoFuncATan):
+        (KJS::mathProtoFuncATan2):
+        (KJS::mathProtoFuncCeil):
+        (KJS::mathProtoFuncCos):
+        (KJS::mathProtoFuncExp):
+        (KJS::mathProtoFuncFloor):
+        (KJS::mathProtoFuncLog):
+        (KJS::mathProtoFuncMax):
+        (KJS::mathProtoFuncMin):
+        (KJS::mathProtoFuncPow):
+        (KJS::mathProtoFuncRandom):
+        (KJS::mathProtoFuncRound):
+        (KJS::mathProtoFuncSin):
+        (KJS::mathProtoFuncSqrt):
+        (KJS::mathProtoFuncTan):
+        * kjs/MathObject.h:
+        * kjs/NumberObject.cpp:
+        (KJS::numberProtoFuncToString):
+        (KJS::numberProtoFuncToLocaleString):
+        (KJS::numberProtoFuncValueOf):
+        (KJS::numberProtoFuncToFixed):
+        (KJS::numberProtoFuncToExponential):
+        (KJS::numberProtoFuncToPrecision):
+        (KJS::NumberConstructor::NumberConstructor):
+        (KJS::constructWithNumberConstructor):
+        (KJS::NumberConstructor::getConstructData):
+        (KJS::callNumberConstructor):
+        (KJS::NumberConstructor::getCallData):
+        (KJS::constructNumber):
+        (KJS::constructNumberFromImmediateNumber):
+        * kjs/NumberObject.h:
+        (KJS::NumberObject::classInfo):
+        (KJS::NumberConstructor::classInfo):
+        * kjs/PropertySlot.cpp:
+        (KJS::PropertySlot::functionGetter):
+        * kjs/RegExpObject.cpp:
+        (KJS::regExpProtoFuncTest):
+        (KJS::regExpProtoFuncExec):
+        (KJS::regExpProtoFuncCompile):
+        (KJS::regExpProtoFuncToString):
+        (KJS::callRegExpObject):
+        (KJS::RegExpObject::getCallData):
+        (KJS::constructRegExp):
+        (KJS::constructWithRegExpConstructor):
+        (KJS::RegExpConstructor::getConstructData):
+        (KJS::callRegExpConstructor):
+        (KJS::RegExpConstructor::getCallData):
+        * kjs/RegExpObject.h:
+        (KJS::RegExpConstructor::classInfo):
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionReadline):
+        (functionQuit):
+        * kjs/date_object.cpp:
+        (KJS::gmtoffset):
+        (KJS::formatLocaleDate):
+        (KJS::fillStructuresUsingDateArgs):
+        (KJS::DateInstance::getTime):
+        (KJS::DateInstance::getUTCTime):
+        (KJS::DateConstructor::DateConstructor):
+        (KJS::constructDate):
+        (KJS::DateConstructor::getConstructData):
+        (KJS::callDate):
+        (KJS::DateConstructor::getCallData):
+        (KJS::dateParse):
+        (KJS::dateNow):
+        (KJS::dateUTC):
+        (KJS::dateProtoFuncToString):
+        (KJS::dateProtoFuncToUTCString):
+        (KJS::dateProtoFuncToDateString):
+        (KJS::dateProtoFuncToTimeString):
+        (KJS::dateProtoFuncToLocaleString):
+        (KJS::dateProtoFuncToLocaleDateString):
+        (KJS::dateProtoFuncToLocaleTimeString):
+        (KJS::dateProtoFuncValueOf):
+        (KJS::dateProtoFuncGetTime):
+        (KJS::dateProtoFuncGetFullYear):
+        (KJS::dateProtoFuncGetUTCFullYear):
+        (KJS::dateProtoFuncToGMTString):
+        (KJS::dateProtoFuncGetMonth):
+        (KJS::dateProtoFuncGetUTCMonth):
+        (KJS::dateProtoFuncGetDate):
+        (KJS::dateProtoFuncGetUTCDate):
+        (KJS::dateProtoFuncGetDay):
+        (KJS::dateProtoFuncGetUTCDay):
+        (KJS::dateProtoFuncGetHours):
+        (KJS::dateProtoFuncGetUTCHours):
+        (KJS::dateProtoFuncGetMinutes):
+        (KJS::dateProtoFuncGetUTCMinutes):
+        (KJS::dateProtoFuncGetSeconds):
+        (KJS::dateProtoFuncGetUTCSeconds):
+        (KJS::dateProtoFuncGetMilliSeconds):
+        (KJS::dateProtoFuncGetUTCMilliseconds):
+        (KJS::dateProtoFuncGetTimezoneOffset):
+        (KJS::dateProtoFuncSetTime):
+        (KJS::setNewValueFromTimeArgs):
+        (KJS::setNewValueFromDateArgs):
+        (KJS::dateProtoFuncSetMilliSeconds):
+        (KJS::dateProtoFuncSetUTCMilliseconds):
+        (KJS::dateProtoFuncSetSeconds):
+        (KJS::dateProtoFuncSetUTCSeconds):
+        (KJS::dateProtoFuncSetMinutes):
+        (KJS::dateProtoFuncSetUTCMinutes):
+        (KJS::dateProtoFuncSetHours):
+        (KJS::dateProtoFuncSetUTCHours):
+        (KJS::dateProtoFuncSetDate):
+        (KJS::dateProtoFuncSetUTCDate):
+        (KJS::dateProtoFuncSetMonth):
+        (KJS::dateProtoFuncSetUTCMonth):
+        (KJS::dateProtoFuncSetFullYear):
+        (KJS::dateProtoFuncSetUTCFullYear):
+        (KJS::dateProtoFuncSetYear):
+        (KJS::dateProtoFuncGetYear):
+        * kjs/date_object.h:
+        (KJS::DateInstance::internalNumber):
+        (KJS::DateInstance::classInfo):
+        * kjs/error_object.cpp:
+        (KJS::errorProtoFuncToString):
+        (KJS::constructError):
+        (KJS::constructWithErrorConstructor):
+        (KJS::ErrorConstructor::getConstructData):
+        (KJS::callErrorConstructor):
+        (KJS::ErrorConstructor::getCallData):
+        (KJS::NativeErrorConstructor::construct):
+        (KJS::constructWithNativeErrorConstructor):
+        (KJS::NativeErrorConstructor::getConstructData):
+        (KJS::callNativeErrorConstructor):
+        (KJS::NativeErrorConstructor::getCallData):
+        * kjs/error_object.h:
+        (KJS::NativeErrorConstructor::classInfo):
+        * kjs/internal.cpp:
+        (KJS::JSNumberCell::toObject):
+        (KJS::JSNumberCell::toThisObject):
+        (KJS::GetterSetter::mark):
+        (KJS::GetterSetter::toPrimitive):
+        (KJS::GetterSetter::toBoolean):
+        (KJS::GetterSetter::toNumber):
+        (KJS::GetterSetter::toString):
+        (KJS::GetterSetter::toObject):
+        (KJS::InternalFunction::InternalFunction):
+        (KJS::InternalFunction::implementsHasInstance):
+        * kjs/lookup.h:
+        (KJS::HashEntry::):
+        * kjs/nodes.cpp:
+        (KJS::FuncDeclNode::makeFunction):
+        (KJS::FuncExprNode::makeFunction):
+        * kjs/object_object.cpp:
+        (KJS::objectProtoFuncValueOf):
+        (KJS::objectProtoFuncHasOwnProperty):
+        (KJS::objectProtoFuncIsPrototypeOf):
+        (KJS::objectProtoFuncDefineGetter):
+        (KJS::objectProtoFuncDefineSetter):
+        (KJS::objectProtoFuncLookupGetter):
+        (KJS::objectProtoFuncLookupSetter):
+        (KJS::objectProtoFuncPropertyIsEnumerable):
+        (KJS::objectProtoFuncToLocaleString):
+        (KJS::objectProtoFuncToString):
+        (KJS::ObjectConstructor::ObjectConstructor):
+        (KJS::constructObject):
+        (KJS::constructWithObjectConstructor):
+        (KJS::ObjectConstructor::getConstructData):
+        (KJS::callObjectConstructor):
+        (KJS::ObjectConstructor::getCallData):
+        * kjs/object_object.h:
+        * kjs/string_object.cpp:
+        (KJS::replace):
+        (KJS::stringProtoFuncToString):
+        (KJS::stringProtoFuncValueOf):
+        (KJS::stringProtoFuncCharAt):
+        (KJS::stringProtoFuncCharCodeAt):
+        (KJS::stringProtoFuncConcat):
+        (KJS::stringProtoFuncIndexOf):
+        (KJS::stringProtoFuncLastIndexOf):
+        (KJS::stringProtoFuncMatch):
+        (KJS::stringProtoFuncSearch):
+        (KJS::stringProtoFuncReplace):
+        (KJS::stringProtoFuncSlice):
+        (KJS::stringProtoFuncSplit):
+        (KJS::stringProtoFuncSubstr):
+        (KJS::stringProtoFuncSubstring):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        (KJS::stringProtoFuncLocaleCompare):
+        (KJS::stringProtoFuncBig):
+        (KJS::stringProtoFuncSmall):
+        (KJS::stringProtoFuncBlink):
+        (KJS::stringProtoFuncBold):
+        (KJS::stringProtoFuncFixed):
+        (KJS::stringProtoFuncItalics):
+        (KJS::stringProtoFuncStrike):
+        (KJS::stringProtoFuncSub):
+        (KJS::stringProtoFuncSup):
+        (KJS::stringProtoFuncFontcolor):
+        (KJS::stringProtoFuncFontsize):
+        (KJS::stringProtoFuncAnchor):
+        (KJS::stringProtoFuncLink):
+        (KJS::stringFromCharCode):
+        (KJS::StringConstructor::StringConstructor):
+        (KJS::constructWithStringConstructor):
+        (KJS::StringConstructor::getConstructData):
+        (KJS::callStringConstructor):
+        (KJS::StringConstructor::getCallData):
+        * kjs/string_object.h:
+
+2008-06-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 19716: REGRESSION (SquirrelFish): Reproducible crash after entering a username at mint.com
+        <https://bugs.webkit.org/show_bug.cgi?id=19716>
+
+        When unwinding callframes for exceptions, check whether the callframe
+        was created by a reentrant native call to JavaScript after tearing off
+        the local variables instead of before.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::unwindCallFrame):
+
+2008-06-23  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Get testapi passing again in a debug build.
+
+        * API/testapi.c:
+        (main): Update the expected output of calling JSValueMakeString on a function object.
+
+2008-06-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Print a blank line when exiting the jsc interactive mode to ensure that the shell
+        prompt will start on a new line.
+
+        * kjs/Shell.cpp:
+        (runInteractive):
+
+2008-06-21  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Tweak the paths of the items in the "tests" group to clean things up a little.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-06-21  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Fix jsc to link against libedit.dylib rather than libedit.2.dylib.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-06-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Copy the JavaScriptCore shell (jsc) into JavaScriptCore.framework so that it will
+        be included in nightly builds.
+        https://bugs.webkit.org/show_bug.cgi?id=19691
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-06-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Mark Rowe.
+
+        Fix the build for non-Mac Darwin platforms by disabling their support
+        for readline in the JavaScript shell.
+
+        * kjs/config.h:
+
+2008-06-20  Timothy Hatcher  <timothy@apple.com>
+
+        Use member function pointers for the Profile::forEach function.
+        Eliminating a few static functions and simplified things a little.
+
+        Reviewed by Alexey Proskuryakov.
+
+        * JavaScriptCore.exp: Change the symbol for forEach.
+        * profiler/Profile.cpp:
+        (KJS::Profile::forEach): Use a member function pointer.
+        * profiler/Profile.h:
+        (KJS::Profile::sortTotalTimeDescending): Pass a function pointer.
+        (KJS::Profile::sortTotalTimeAscending): Ditto.
+        (KJS::Profile::sortSelfTimeDescending): Ditto.
+        (KJS::Profile::sortSelfTimeAscending): Ditto.
+        (KJS::Profile::sortCallsDescending): Ditto.
+        * profiler/ProfileNode.h:
+        (KJS::ProfileNode::sortTotalTimeDescending): No longer static.
+        (KJS::ProfileNode::sortTotalTimeAscending): Ditto.
+        (KJS::ProfileNode::sortSelfTimeDescending): Ditto.
+        (KJS::ProfileNode::sortSelfTimeAscending): Ditto.
+        (KJS::ProfileNode::sortCallsDescending): Ditto.
+
+2008-06-20  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Remove unused destructors.
+
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+
+2008-06-20  Timothy Hatcher  <timothy@apple.com>
+
+        Fixed an ASSERT(m_actualSelfTime <= m_actualTotalTime) when starting
+        and stopping a profile from the Develop menu. Also prevents
+        inserting an incorrect parent node as the new head after profiling
+        is stopped from the Develop menu.
+
+        Reviewed by Dan Bernstein.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::stopProfiling): If the current node is already the head
+        then there is no more need to record future nodes in didExecute.
+        (KJS::Profile::didExecute): Move the code of setupCurrentNodeAsStopped
+        into here since this was the only caller. When setting the total time
+        keep any current total time while adding the self time of the head.
+        (KJS::Profile::setupCurrentNodeAsStopped): Removed.
+        * profiler/Profile.h: Removed setupCurrentNodeAsStopped.
+
+2008-06-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        !USE(MULTIPLE_THREADS) on Darwin build fix
+
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreading):
+        * kjs/collector.h:
+
+2008-06-20  Kevin McCullough  <kmccullough@apple.com>
+
+        -Leopard Build Fix.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::removeProfileStart):
+        (KJS::Profile::removeProfileEnd):
+
+2008-06-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Just giving credit.
+
+        * ChangeLog:
+
+2008-06-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim and Dan.
+
+        <rdar://problem/6024846> JSProfiler: ASSERT hit in Profiler.
+        - Because InspectorController can call startProfiling() and
+        stopProfiling() we cannot assert that console.profile() and
+        console.profileEnd() will be in the profile tree.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::removeProfileStart):
+        (KJS::Profile::removeProfileEnd):
+
+2008-06-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5958770> JSProfiler: Time incorrectly given to (idle)
+        if profiling is started and finished within the same function. (19230)
+        - Now we profile one more stack frame up from the last frame to allocate
+        the time spent in it, if it exists.
+
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp: We need to let the profiler know when the JS program 
+        has finished since that is what will actually stop the profiler instead
+        of just calling stopProfiling().
+        (KJS::Machine::execute):
+        * profiler/Profile.cpp:
+        (KJS::Profile::create): Moved from Profile.h since it was getting pretty
+        long.
+        (KJS::Profile::Profile): We now have a client, which is a listener who
+        we will return this profile to, once it has actually finished.
+        (KJS::Profile::stopProfiling): Instead of fully stopping the profiler
+        here, we set the flag and keep it profiling in the background.
+        (KJS::Profile::didFinishAllExecution): This is where the profiler
+        actually finishes and creates the (idle) node if one should be made.
+        (KJS::Profile::removeProfileStart): Don't use m_currentNode since it is
+        needed by the profiler as it runs silently in the background.
+        (KJS::Profile::removeProfileEnd): Ditto.
+        (KJS::Profile::willExecute): Don't profile new functions if we have
+        stopped profiling.
+        (KJS::Profile::didExecute): Only record one more return as all the
+        remaining time will be attributed to that function.
+        (KJS::Profile::setupCurrentNodeAsStopped): Sets the current node's time.
+        * profiler/Profile.h: Added functions and variables for the above
+        changes.
+        (KJS::Profile::client):
+        * profiler/ProfileNode.h:
+        (KJS::CallIdentifier::toString): Debug method.
+        * profiler/Profiler.cpp: Added support for the ProfilerClient.
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling): No longer return sthe profile.
+        (KJS::Profiler::didFinishAllExecution): Now returns the profile to the
+        client instead of stopProfiling.
+        * profiler/Profiler.h:
+        (KJS::ProfilerClient::~ProfilerClient): Clients will implement this
+        interface.
+
+2008-06-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Surpress compiler warning (int vs unsigned comparison).
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+
+2008-06-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduce compiler define for MinGW, to have COMPILER(MINGW).
+
+        * wtf/Platform.h:
+
+2008-06-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        Make Machine per-JSGlobalData.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitOpcode):
+        * VM/Machine.cpp:
+        (KJS::callEval):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::throwException):
+        (KJS::Machine::execute):
+        (KJS::Machine::debug):
+        * VM/Machine.h:
+        * kjs/DebuggerCallFrame.cpp:
+        (KJS::DebuggerCallFrame::evaluate):
+        * kjs/DebuggerCallFrame.h:
+        (KJS::DebuggerCallFrame::DebuggerCallFrame):
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        * kjs/ExecState.h:
+        (KJS::ExecState::machine):
+        * kjs/JSFunction.cpp:
+        (KJS::JSFunction::callAsFunction):
+        (KJS::JSFunction::argumentsGetter):
+        (KJS::JSFunction::callerGetter):
+        (KJS::JSFunction::construct):
+        (KJS::globalFuncEval):
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+
+2008-06-19  Alp Toker  <alp@nuanti.com>
+
+        GTK+/autotools build fix. JSGlobalObject.cpp in now in
+        AllInOneFile.cpp and shouldn't be built separately.
+
+        * GNUmakefile.am:
+
+2008-06-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Get rid of some threadInstance calls.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::init):
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse):
+        * kjs/Shell.cpp:
+        (jscmain):
+
+2008-06-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam.
+
+        Fix an assertion failure at startup.
+
+        * kjs/JSObject.h: (KJS::JSObject::JSObject): Allow jsNull prototype in an assertion (I had
+        it fixed in a wrong copy of the file, so I wasn't getting the failure).
+
+2008-06-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::Heap):
+        (KJS::allocateBlock):
+        * kjs/collector.h:
+        No, #if PLATFORM(UNIX) was not right. I've just moved the unsafe initialization back for now,
+        as the platforms that use that code path do not use multiple threads yet.
+
+2008-06-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows and Qt build fixes.
+
+        * kjs/collector.h: 
+        * kjs/collector.cpp:
+        (KJS::Heap::Heap):
+        Wrapped m_pagesize in #if PLATFORM(UNIX), which should better match the sequence of #elifs
+        in allocateBlock(). Changed MIN_ARRAY_SIZE to be explicitly size_t, as this type is different
+        on different platforms.
+
+2008-06-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Prepare JavaScript heap for being per-thread.
+
+        * kjs/ExecState.h: Shuffle includes, making it possible to include ExecState.h in JSValue.h.
+        (KJS::ExecState::heap): Added an accessor.
+
+        * API/JSBase.cpp: (JSGarbageCollect): Collect both shared and per-thread heaps.
+
+        * API/JSContextRef.cpp: (JSGlobalContextCreate): When allocating JSGlobalObject, indicate
+        that it belongs to a shared heap.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp:
+        Moved JSGlobalObject.cpp to AllInOneFile, as a build fix for inlineAllocate magic.
+
+        * VM/CodeGenerator.h: (KJS::CodeGenerator::globalExec): Added an accessor (working via
+        m_scopeChain).
+
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::mark):
+        * VM/RegisterFileStack.h:
+        (KJS::RegisterFileStack::mark):
+        Made these pseudo-mark functions take Heap*.
+
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreading): Initialize heap introspector.
+
+        * kjs/JSGlobalData.h: Added Heap to the structure.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData): Initialize Heap.
+        (KJS::JSGlobalData::sharedInstance): Added a method to access shared global data instance
+        for legacy clients.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject): Changed to work with per-thread head; fixed list
+        maintenance logic.
+        (KJS::JSGlobalObject::init): Changed to work with per-thread head.
+        (KJS::JSGlobalObject::put): Assert that a cross-heap operation is not being attempted.
+        (KJS::JSGlobalObject::reset): Pass ExecState* where now required.
+        (KJS::JSGlobalObject::mark): Pass the current heap to RegisterFileStack::mark.
+        (KJS::JSGlobalObject::operator new): Overload operator new to use per-thread or shared heap.
+        * kjs/JSGlobalObject.h: Removed static s_head member.
+
+        * kjs/PropertyMap.h: (KJS::PropertyMap::PropertyMap): Removed unused SavedProperty.
+
+        * kjs/collector.h: Turned Collector into an actual object with its own data, renamed to Heap.
+        (KJS::Heap::initializeHeapIntrospector): Added.
+        (KJS::Heap::heap): Added a method to determine which heap a JSValue is in, if any.
+        (KJS::Heap::allocate): Made non-static.
+        (KJS::Heap::inlineAllocateNumber): Ditto.
+        (KJS::Heap::markListSet): Ditto.
+        (KJS::Heap::cellBlock): Ditto.
+        (KJS::Heap::cellOffset): Ditto.
+        (KJS::Heap::isCellMarked): Ditto.
+        (KJS::Heap::markCell): Ditto.
+        (KJS::Heap::reportExtraMemoryCost): Ditto.
+        (KJS::CollectorBlock): Added a back-reference to Heap for Heap::heap() method.
+        (KJS::SmallCellCollectorBlock): Ditto.
+
+        * kjs/collector.cpp: Changed MIN_ARRAY_SIZE to a #define to avoid a PIC branch. Removed
+        main thread related machinery.
+        (KJS::Heap::Heap): Initialize the newly added data members.
+        (KJS::allocateBlock): Marked NEVER_INLINE, as this is a rare case that uses a PIC branch.
+        Moved static pagesize to the class to make it safely initialized.
+        (KJS::Heap::heapAllocate): Initialize heap back reference after a new block is allocated.
+        (KJS::Heap::registerThread): Removed introspector initialization, as it is now performed
+        in InitializeThreading.cpp.
+        (KJS::Heap::markOtherThreadConservatively): Assert that the "other thread" case only occurs
+        for legacy clients using a shared heap.
+        (KJS::Heap::markStackObjectsConservatively): Moved fastMallocForbid/Allow down here, since
+        it doesn't need to be forbidden during other GC phases.
+
+        * kjs/JSImmediate.h:
+        (KJS::jsUndefined):
+        (KJS::jsNull):
+        (KJS::jsBoolean):
+        Moved from JSvalue.h, to make these usable in files that cannot include JSValue.h (such
+        as list.h).
+
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        * JavaScriptCore.exp:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitLoad):
+        * VM/JSPropertyNameIterator.cpp:
+        (KJS::JSPropertyNameIterator::create):
+        (KJS::JSPropertyNameIterator::next):
+        * VM/Machine.cpp:
+        (KJS::jsAddSlowCase):
+        (KJS::jsAdd):
+        (KJS::jsTypeStringForValue):
+        (KJS::scopeChainForCall):
+        (KJS::Machine::throwException):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::retrieveArguments):
+        * kjs/ArrayPrototype.cpp:
+        (KJS::arrayProtoFuncToString):
+        (KJS::arrayProtoFuncToLocaleString):
+        (KJS::arrayProtoFuncJoin):
+        (KJS::arrayProtoFuncConcat):
+        (KJS::arrayProtoFuncPop):
+        (KJS::arrayProtoFuncPush):
+        (KJS::arrayProtoFuncShift):
+        (KJS::arrayProtoFuncSlice):
+        (KJS::arrayProtoFuncSplice):
+        (KJS::arrayProtoFuncUnShift):
+        (KJS::arrayProtoFuncFilter):
+        (KJS::arrayProtoFuncMap):
+        (KJS::arrayProtoFuncEvery):
+        (KJS::arrayProtoFuncForEach):
+        (KJS::arrayProtoFuncSome):
+        (KJS::arrayProtoFuncIndexOf):
+        (KJS::arrayProtoFuncLastIndexOf):
+        (KJS::ArrayConstructor::ArrayConstructor):
+        (KJS::ArrayConstructor::construct):
+        (KJS::ArrayConstructor::callAsFunction):
+        * kjs/BooleanObject.cpp:
+        (KJS::BooleanPrototype::BooleanPrototype):
+        (KJS::booleanProtoFuncToString):
+        (KJS::BooleanConstructor::BooleanConstructor):
+        (KJS::BooleanConstructor::construct):
+        * kjs/FunctionPrototype.cpp:
+        (KJS::FunctionPrototype::FunctionPrototype):
+        (KJS::functionProtoFuncToString):
+        (KJS::FunctionConstructor::FunctionConstructor):
+        (KJS::FunctionConstructor::construct):
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::createArgumentsObject):
+        * kjs/JSArray.cpp:
+        (KJS::JSArray::JSArray):
+        (KJS::JSArray::lengthGetter):
+        * kjs/JSFunction.cpp:
+        (KJS::JSFunction::lengthGetter):
+        (KJS::JSFunction::construct):
+        (KJS::Arguments::Arguments):
+        (KJS::encode):
+        (KJS::decode):
+        (KJS::globalFuncParseInt):
+        (KJS::globalFuncParseFloat):
+        (KJS::globalFuncEscape):
+        (KJS::globalFuncUnescape):
+        (KJS::PrototypeFunction::PrototypeFunction):
+        (KJS::PrototypeReflexiveFunction::PrototypeReflexiveFunction):
+        * kjs/JSImmediate.cpp:
+        (KJS::JSImmediate::toObject):
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::registerThread):
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::put):
+        (KJS::JSObject::defineGetter):
+        (KJS::JSObject::defineSetter):
+        (KJS::Error::create):
+        * kjs/JSObject.h:
+        (KJS::JSObject::putDirect):
+        * kjs/JSString.h:
+        (KJS::JSString::JSString):
+        * kjs/JSValue.cpp:
+        (KJS::JSCell::operator new):
+        (KJS::jsString):
+        (KJS::jsOwnedString):
+        * kjs/JSValue.h:
+        (KJS::JSNumberCell::operator new):
+        (KJS::jsNumberCell):
+        (KJS::jsNaN):
+        (KJS::jsNumber):
+        (KJS::JSCell::marked):
+        (KJS::JSCell::mark):
+        (KJS::JSValue::toJSNumber):
+        * kjs/MathObject.cpp:
+        (KJS::MathObject::getValueProperty):
+        (KJS::mathProtoFuncAbs):
+        (KJS::mathProtoFuncACos):
+        (KJS::mathProtoFuncASin):
+        (KJS::mathProtoFuncATan):
+        (KJS::mathProtoFuncATan2):
+        (KJS::mathProtoFuncCeil):
+        (KJS::mathProtoFuncCos):
+        (KJS::mathProtoFuncExp):
+        (KJS::mathProtoFuncFloor):
+        (KJS::mathProtoFuncLog):
+        (KJS::mathProtoFuncMax):
+        (KJS::mathProtoFuncMin):
+        (KJS::mathProtoFuncPow):
+        (KJS::mathProtoFuncRandom):
+        (KJS::mathProtoFuncRound):
+        (KJS::mathProtoFuncSin):
+        (KJS::mathProtoFuncSqrt):
+        (KJS::mathProtoFuncTan):
+        * kjs/NumberObject.cpp:
+        (KJS::NumberPrototype::NumberPrototype):
+        (KJS::numberProtoFuncToString):
+        (KJS::numberProtoFuncToLocaleString):
+        (KJS::numberProtoFuncToFixed):
+        (KJS::numberProtoFuncToExponential):
+        (KJS::numberProtoFuncToPrecision):
+        (KJS::NumberConstructor::NumberConstructor):
+        (KJS::NumberConstructor::getValueProperty):
+        (KJS::NumberConstructor::construct):
+        (KJS::NumberConstructor::callAsFunction):
+        * kjs/RegExpObject.cpp:
+        (KJS::RegExpPrototype::RegExpPrototype):
+        (KJS::regExpProtoFuncToString):
+        (KJS::RegExpObject::getValueProperty):
+        (KJS::RegExpConstructor::RegExpConstructor):
+        (KJS::RegExpMatchesArray::fillArrayInstance):
+        (KJS::RegExpConstructor::arrayOfMatches):
+        (KJS::RegExpConstructor::getBackref):
+        (KJS::RegExpConstructor::getLastParen):
+        (KJS::RegExpConstructor::getLeftContext):
+        (KJS::RegExpConstructor::getRightContext):
+        (KJS::RegExpConstructor::getValueProperty):
+        (KJS::RegExpConstructor::construct):
+        * kjs/RegExpObject.h:
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+        (functionGC):
+        (functionRun):
+        (functionReadline):
+        (jscmain):
+        * kjs/date_object.cpp:
+        (KJS::formatLocaleDate):
+        (KJS::DatePrototype::DatePrototype):
+        (KJS::DateConstructor::DateConstructor):
+        (KJS::DateConstructor::construct):
+        (KJS::DateConstructor::callAsFunction):
+        (KJS::DateFunction::DateFunction):
+        (KJS::DateFunction::callAsFunction):
+        (KJS::dateProtoFuncToString):
+        (KJS::dateProtoFuncToUTCString):
+        (KJS::dateProtoFuncToDateString):
+        (KJS::dateProtoFuncToTimeString):
+        (KJS::dateProtoFuncToLocaleString):
+        (KJS::dateProtoFuncToLocaleDateString):
+        (KJS::dateProtoFuncToLocaleTimeString):
+        (KJS::dateProtoFuncValueOf):
+        (KJS::dateProtoFuncGetTime):
+        (KJS::dateProtoFuncGetFullYear):
+        (KJS::dateProtoFuncGetUTCFullYear):
+        (KJS::dateProtoFuncToGMTString):
+        (KJS::dateProtoFuncGetMonth):
+        (KJS::dateProtoFuncGetUTCMonth):
+        (KJS::dateProtoFuncGetDate):
+        (KJS::dateProtoFuncGetUTCDate):
+        (KJS::dateProtoFuncGetDay):
+        (KJS::dateProtoFuncGetUTCDay):
+        (KJS::dateProtoFuncGetHours):
+        (KJS::dateProtoFuncGetUTCHours):
+        (KJS::dateProtoFuncGetMinutes):
+        (KJS::dateProtoFuncGetUTCMinutes):
+        (KJS::dateProtoFuncGetSeconds):
+        (KJS::dateProtoFuncGetUTCSeconds):
+        (KJS::dateProtoFuncGetMilliSeconds):
+        (KJS::dateProtoFuncGetUTCMilliseconds):
+        (KJS::dateProtoFuncGetTimezoneOffset):
+        (KJS::dateProtoFuncSetTime):
+        (KJS::setNewValueFromTimeArgs):
+        (KJS::setNewValueFromDateArgs):
+        (KJS::dateProtoFuncSetYear):
+        (KJS::dateProtoFuncGetYear):
+        * kjs/error_object.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype):
+        (KJS::errorProtoFuncToString):
+        (KJS::ErrorConstructor::ErrorConstructor):
+        (KJS::ErrorConstructor::construct):
+        (KJS::NativeErrorPrototype::NativeErrorPrototype):
+        (KJS::NativeErrorConstructor::NativeErrorConstructor):
+        (KJS::NativeErrorConstructor::construct):
+        * kjs/identifier.h:
+        * kjs/internal.cpp:
+        (KJS::StringObject::create):
+        (KJS::JSString::lengthGetter):
+        (KJS::JSString::indexGetter):
+        (KJS::JSString::indexNumericPropertyGetter):
+        * kjs/interpreter.cpp:
+        * kjs/list.cpp:
+        (KJS::ArgList::slowAppend):
+        * kjs/list.h:
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter):
+        (KJS::cacheGlobalObject):
+        * kjs/nodes.cpp:
+        (KJS::Node::emitThrowError):
+        (KJS::StringNode::emitCode):
+        (KJS::ArrayNode::emitCode):
+        (KJS::FuncDeclNode::makeFunction):
+        (KJS::FuncExprNode::makeFunction):
+        * kjs/nodes.h:
+        * kjs/object_object.cpp:
+        (KJS::ObjectPrototype::ObjectPrototype):
+        (KJS::objectProtoFuncToLocaleString):
+        (KJS::objectProtoFuncToString):
+        (KJS::ObjectConstructor::ObjectConstructor):
+        (KJS::ObjectConstructor::construct):
+        * kjs/protect.h:
+        (KJS::gcProtect):
+        (KJS::gcUnprotect):
+        * kjs/string_object.cpp:
+        (KJS::StringObject::StringObject):
+        (KJS::StringPrototype::StringPrototype):
+        (KJS::replace):
+        (KJS::stringProtoFuncCharAt):
+        (KJS::stringProtoFuncCharCodeAt):
+        (KJS::stringProtoFuncConcat):
+        (KJS::stringProtoFuncIndexOf):
+        (KJS::stringProtoFuncLastIndexOf):
+        (KJS::stringProtoFuncMatch):
+        (KJS::stringProtoFuncSearch):
+        (KJS::stringProtoFuncReplace):
+        (KJS::stringProtoFuncSlice):
+        (KJS::stringProtoFuncSplit):
+        (KJS::stringProtoFuncSubstr):
+        (KJS::stringProtoFuncSubstring):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        (KJS::stringProtoFuncLocaleCompare):
+        (KJS::stringProtoFuncBig):
+        (KJS::stringProtoFuncSmall):
+        (KJS::stringProtoFuncBlink):
+        (KJS::stringProtoFuncBold):
+        (KJS::stringProtoFuncFixed):
+        (KJS::stringProtoFuncItalics):
+        (KJS::stringProtoFuncStrike):
+        (KJS::stringProtoFuncSub):
+        (KJS::stringProtoFuncSup):
+        (KJS::stringProtoFuncFontcolor):
+        (KJS::stringProtoFuncFontsize):
+        (KJS::stringProtoFuncAnchor):
+        (KJS::stringProtoFuncLink):
+        (KJS::StringConstructor::StringConstructor):
+        (KJS::StringConstructor::construct):
+        (KJS::StringConstructor::callAsFunction):
+        (KJS::StringConstructorFunction::StringConstructorFunction):
+        (KJS::StringConstructorFunction::callAsFunction):
+        * kjs/string_object.h:
+        (KJS::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * kjs/ustring.h:
+        Updated for the above changes.
+
+2008-06-17  Timothy Hatcher  <timothy@apple.com>
+
+        Added a type to DebuggerCallFrame so the under interface can
+        distinguish anonymous functions and program call frames.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19585
+
+        Reviewed by Geoff Garen.
+
+        * JavaScriptCore.exp: Export the DebuggerCallFrame::type symbol.
+        * kjs/DebuggerCallFrame.cpp:
+        (KJS::DebuggerCallFrame::type): Added.
+        * kjs/DebuggerCallFrame.h:
+
+2008-06-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Tim H.
+        
+        Remove bogus ASSERT which tripped every time for those who use PAC files.
+
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse):
+
+2008-06-17  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/5951534> JSProfiler: Don't profile console.profile()
+        or console.profileEnd()
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::stopProfiling): Moved the creation of the (idle) node to
+        the Profile (not ProfileNode).  This makes sense since the Profile
+        should be the one to modify the profile tree.  Also each stopProfiling()
+        does not need to check if it's the head node anymore.  Also fixed an
+        oddity where I was using willExecute to create the node.
+        (KJS::Profile::removeProfileStart): Removes the call to console.profile
+        that started this profile.
+        (KJS::Profile::removeProfileEnd): Removes the call to console.profileEnd
+        that ended this profile.
+        * profiler/Profile.h:
+        * profiler/ProfileNode.cpp: Moved the creation of the (idle) node to
+        the Profile object.
+        (KJS::ProfileNode::stopProfiling):
+        * profiler/ProfileNode.h: Added some helper functions and whitespace to
+        facilitate readability and the removal of profile() and profileEnd()
+        from the Profile tree.
+        (KJS::CallIdentifier::operator const char* ):
+        (KJS::ProfileNode::firstChild):
+        (KJS::ProfileNode::lastChild):
+        (KJS::ProfileNode::removeChild):
+        (KJS::ProfileNode::toString):
+
+2008-06-17  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Rubber stamped by Adam Roben.
+
+        Include JSGlobalObject.h to fix the build.
+
+        * kjs/ScopeChain.cpp:
+
+2008-06-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Reduce code duplication in emitReadModifyAssignment().
+
+        * kjs/nodes.cpp:
+        (KJS::emitReadModifyAssignment):
+
+2008-06-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Sort includes alphabetically.
+
+        * kjs/nodes.cpp:
+
+2008-06-16  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 19596: LEAK: Gmail leaks SegmentedVector<RegisterID>
+        <https://bugs.webkit.org/show_bug.cgi?id=19596>
+
+        When growing SegmentedVector, we start adding segments at the position
+        of the last segment, overwriting it. The destructor frees allocated
+        segments starting at the segment of index 1, because the segment of
+        index 0 is assumed to be the initial inline segment. This causes a leak
+        of the segment that is referenced by index 0. Modifying grow() so that
+        it starts adding segments at the position after the last segment fixes
+        the leak.
+
+        Since the initial segment is a special case in the lookup code, this
+        bug never manifested itself via incorrect results.
+
+        * VM/SegmentedVector.h:
+        (KJS::SegmentedVector::grow):
+
+2008-06-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey.
+        
+        - removed nearly unused types.h and LocalStorageEntry.h headers
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/ExecState.h:
+        * kjs/LocalStorageEntry.h: Removed.
+        * kjs/RegExpObject.cpp:
+        * kjs/error_object.cpp:
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        * kjs/types.h: Removed.
+
+2008-06-16  Alp Toker  <alp@nuanti.com>
+
+        Rubber-stamped by Geoff.
+
+        Change c++ to c in minidom and testapi emacs mode line comments.
+
+        * API/Node.h:
+        * API/NodeList.c:
+        * API/NodeList.h:
+        * API/testapi.c:
+
+2008-06-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Trying to fix Windows build.
+
+        * kjs/PropertyNameArray.h:
+        * kjs/identifier.cpp:
+        Include ExecState.h
+
+2008-06-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Slight cleanup to the SymbolTableEntry class.
+        
+        Renamed isEmpty to isNull, since we usually use "empty" to mean "holds
+        the valid, empty value", and "null" to mean "holds no value".
+        
+        Changed an "== 0" to a "!", to match our style guidelines.
+        
+        Added some ASSERTs to verify the (possibly questionable) assumption that
+        all register indexes will have their high two bits set. Also clarified a
+        comment to make that assumption clear.
+
+2008-06-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Initialize functionQueueMutex in a safe manner.
+
+        * wtf/MainThread.cpp:
+        (WTF::functionQueueMutex): Made it an AtomicallyInitializedStatic.
+
+        (WTF::dispatchFunctionsFromMainThread):
+        (WTF::setMainThreadCallbacksPaused):
+        Assert that the current thread is main, meaning that the callbacksPaused static can be
+        accessed.
+
+2008-06-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Make Identifier construction use an explicitly passed IdentifierTable.
+
+        No change on SunSpider total.
+
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::getPropertyNames):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray):
+        (JSObjectCopyPropertyNames):
+        * JavaScriptCore.exp:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::registerForLocal):
+        (KJS::CodeGenerator::isLocal):
+        (KJS::CodeGenerator::addConstant):
+        (KJS::CodeGenerator::findScopedProperty):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::globalData):
+        (KJS::CodeGenerator::propertyNames):
+        * VM/JSPropertyNameIterator.cpp:
+        (KJS::JSPropertyNameIterator::create):
+        * VM/Machine.cpp:
+        (KJS::Machine::throwException):
+        (KJS::Machine::privateExecute):
+        * kjs/ArrayPrototype.cpp:
+        (KJS::ArrayConstructor::ArrayConstructor):
+        * kjs/BooleanObject.cpp:
+        (KJS::BooleanConstructor::BooleanConstructor):
+        * kjs/FunctionPrototype.cpp:
+        (KJS::FunctionConstructor::FunctionConstructor):
+        (KJS::FunctionConstructor::construct):
+        * kjs/JSArray.cpp:
+        (KJS::JSArray::inlineGetOwnPropertySlot):
+        (KJS::JSArray::put):
+        (KJS::JSArray::deleteProperty):
+        (KJS::JSArray::getPropertyNames):
+        * kjs/JSFunction.cpp:
+        (KJS::Arguments::Arguments):
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::getOwnPropertySlot):
+        (KJS::JSObject::put):
+        (KJS::JSObject::putWithAttributes):
+        (KJS::JSObject::deleteProperty):
+        (KJS::JSObject::findPropertyHashEntry):
+        (KJS::JSObject::getPropertyNames):
+        (KJS::Error::create):
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::getPropertyNames):
+        * kjs/NumberObject.cpp:
+        (KJS::NumberConstructor::NumberConstructor):
+        * kjs/PropertyNameArray.cpp:
+        (KJS::PropertyNameArray::add):
+        * kjs/PropertyNameArray.h:
+        (KJS::PropertyNameArray::PropertyNameArray):
+        (KJS::PropertyNameArray::addKnownUnique):
+        * kjs/PropertySlot.h:
+        (KJS::PropertySlot::getValue):
+        * kjs/RegExpObject.cpp:
+        (KJS::RegExpConstructor::RegExpConstructor):
+        * kjs/ScopeChain.cpp:
+        (KJS::ScopeChainNode::print):
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+        * kjs/date_object.cpp:
+        (KJS::DateConstructor::DateConstructor):
+        * kjs/error_object.cpp:
+        (KJS::ErrorConstructor::ErrorConstructor):
+        (KJS::NativeErrorConstructor::NativeErrorConstructor):
+        * kjs/grammar.y:
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add):
+        (KJS::Identifier::addSlowCase):
+        * kjs/identifier.h:
+        (KJS::Identifier::Identifier):
+        (KJS::Identifier::from):
+        (KJS::Identifier::equal):
+        (KJS::Identifier::add):
+        (KJS::operator==):
+        (KJS::operator!=):
+        * kjs/internal.cpp:
+        (KJS::JSString::getOwnPropertySlot):
+        * kjs/lexer.cpp:
+        (KJS::Lexer::Lexer):
+        (KJS::Lexer::lex):
+        (KJS::Lexer::makeIdentifier):
+        * kjs/lexer.h:
+        * kjs/lookup.cpp:
+        (KJS::HashTable::createTable):
+        * kjs/lookup.h:
+        (KJS::HashTable::initializeIfNeeded):
+        (KJS::HashTable::entry):
+        (KJS::getStaticPropertySlot):
+        (KJS::getStaticFunctionSlot):
+        (KJS::getStaticValueSlot):
+        (KJS::lookupPut):
+        * kjs/object_object.cpp:
+        (KJS::objectProtoFuncHasOwnProperty):
+        (KJS::objectProtoFuncDefineGetter):
+        (KJS::objectProtoFuncDefineSetter):
+        (KJS::objectProtoFuncLookupGetter):
+        (KJS::objectProtoFuncLookupSetter):
+        (KJS::objectProtoFuncPropertyIsEnumerable):
+        (KJS::ObjectConstructor::ObjectConstructor):
+        * kjs/string_object.cpp:
+        (KJS::StringObject::getOwnPropertySlot):
+        (KJS::StringObject::getPropertyNames):
+        (KJS::StringConstructor::StringConstructor):
+        Just pass ExecState or JSGlobalData everywhere. Identifier construction is now always
+        explicit.
+
+        * kjs/nodes.cpp: (KJS::RegExpNode::emitCode): Here, Identifier was created from a non-literal
+        char*, which was incorrect, as that uses the pointer value as a key.
+
+2008-06-16  Thiago Macieira  <tjmaciei@trolltech.com>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19577
+
+        Fix compilation in C++ environments where C99 headers are not present
+
+        The stdbool.h header is a C99 feature, defining the "_Bool" type as well as the
+        "true" and "false" constants. But it's completely unnecessary in C++ as the
+        language already defines the "bool" type and its two values.
+
+        * API/JSBase.h:
+        * API/JSContextRef.h:
+        * API/JSObjectRef.h:
+        * API/JSStringRef.h:
+        * API/JSValueRef.h:
+
+2008-06-16  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by John.
+
+        <rdar://problem/6012509> JSProfiler: %s are incorrect if you exclude a
+        top level node like (idle)
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::focus):
+        (KJS::Profile::exclude): Subtract the selfTime from the totalTime of the
+        head since its self time will only be non-zero when one of its children
+        were excluded. Since the head's totalTime is used to calculate %s when
+        its totalTime is the same as the sum of all its visible childrens' times
+        their %s will sum to 100%.
+
+2008-06-16  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/5969992> JSProfiler: Remove the recursion limit in the profiler.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::willExecute):
+
+2008-06-16  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        <rdar://problem/5969992> JSProfiler: Remove the recursion limit in the
+        profiler.
+        - Remove the last of the uses of recursion in the profiler.
+
+        * JavaScriptCore.exp: Export the new function's signature.
+        * profiler/Profile.cpp: 
+        (KJS::calculateVisibleTotalTime): Added a new static method for
+        recalculating the visibleTotalTime of methods after focus has changed
+        which are visible.
+        (KJS::stopProfiling): 
+        (KJS::Profile::focus): Implemented focus without recursion.
+        * profiler/Profile.h: Moved implementation into the definition file.
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::traverseNextNodePreOrder): Added an argument for
+        whether or not to process the children nodes, this allows focus to skip
+        sub trees which have been set as not visible.
+        (KJS::ProfileNode::calculateVisibleTotalTime): This function set's a
+        node's total visible time to the sum of its self time and its children's
+        total times.
+        (KJS::ProfileNode::focus): Implemented focus without recursion.
+        * profiler/ProfileNode.h:
+        (KJS::CallIdentifier::operator!= ):
+        (KJS::ProfileNode::setActualTotalTime): Expanded setting the total time
+        so that focus could modify only the visible total time.
+        (KJS::ProfileNode::setVisibleTotalTime):
+
+2008-06-16  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Sam.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19552
+        JavaScriptCore headers use C++ style comments
+
+        Replace all C++ style comments with C style multiline
+        comments and remove all "mode" lines.
+
+        * API/JSBase.h:
+        * API/JSClassRef.h:
+        * API/JSContextRef.h:
+        * API/JSObjectRef.h:
+        * API/JSStringRef.h:
+        * API/JSStringRefBSTR.h:
+        * API/JSStringRefCF.h:
+        * API/JSValueRef.h:
+        * API/JavaScript.h:
+        * API/JavaScriptCore.h:
+
+2008-06-16  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Sam.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19557
+        (JavaScriptCore) minidom uses C++ style comments
+
+        Use only C style comments in minidom sources
+
+        * API/JSNode.c:
+        (JSNode_appendChild):
+        (JSNode_removeChild):
+        * API/JSNode.h:
+        * API/JSNodeList.c:
+        (JSNodeList_getProperty):
+        * API/JSNodeList.h:
+        * API/Node.c:
+        * API/Node.h:
+        * API/NodeList.c:
+        (NodeList_new):
+        (NodeList_item):
+        * API/NodeList.h:
+        * API/minidom.c:
+        (createStringWithContentsOfFile):
+        * wtf/Assertions.h:
+        * wtf/UnusedParam.h:
+
+2008-06-16  Adriaan de Groot  <groot@kde.org>
+
+        Reviewed by Simon.
+
+        Fix compilation on Solaris
+
+        On some systems, munmap takes a char* instead of a void* (contrary to POSIX and
+        Single Unix Specification). Since you can always convert from char* to void*
+        but not vice-versa, do the casting to char*.
+
+        * kjs/collector.cpp:
+        (KJS::allocateBlock):
+        (KJS::freeBlock):
+
+2008-06-16  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Make a UnaryOpNode class to reduce boilerplate code for UnaryPlusNode,
+        NegateNode, BitwiseNotNode, and LogicalNotNode.
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::emitToJSNumber):
+        * kjs/nodes.cpp:
+        (KJS::UnaryOpNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::UnaryOpNode::UnaryOpNode):
+        (KJS::UnaryPlusNode::):
+        (KJS::NegateNode::):
+        (KJS::NegateNode::precedence):
+        (KJS::BitwiseNotNode::):
+        (KJS::BitwiseNotNode::precedence):
+        (KJS::LogicalNotNode::):
+        (KJS::LogicalNotNode::precedence):
+
+2008-06-16  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix
+
+        * GNUmakefile.am:
+
+2008-06-15  Darin Adler  <darin@apple.com>
+
+        - rename KJS::List to KJS::ArgList
+
+        * API/JSCallbackConstructor.cpp:
+        (KJS::JSCallbackConstructor::construct):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::callAsFunction):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::construct):
+        (KJS::::callAsFunction):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        * kjs/ArrayPrototype.cpp:
+        (KJS::arrayProtoFuncToString):
+        (KJS::arrayProtoFuncToLocaleString):
+        (KJS::arrayProtoFuncJoin):
+        (KJS::arrayProtoFuncConcat):
+        (KJS::arrayProtoFuncPop):
+        (KJS::arrayProtoFuncPush):
+        (KJS::arrayProtoFuncReverse):
+        (KJS::arrayProtoFuncShift):
+        (KJS::arrayProtoFuncSlice):
+        (KJS::arrayProtoFuncSort):
+        (KJS::arrayProtoFuncSplice):
+        (KJS::arrayProtoFuncUnShift):
+        (KJS::arrayProtoFuncFilter):
+        (KJS::arrayProtoFuncMap):
+        (KJS::arrayProtoFuncEvery):
+        (KJS::arrayProtoFuncForEach):
+        (KJS::arrayProtoFuncSome):
+        (KJS::arrayProtoFuncIndexOf):
+        (KJS::arrayProtoFuncLastIndexOf):
+        (KJS::ArrayConstructor::construct):
+        (KJS::ArrayConstructor::callAsFunction):
+        * kjs/ArrayPrototype.h:
+        * kjs/BooleanObject.cpp:
+        (KJS::booleanProtoFuncToString):
+        (KJS::booleanProtoFuncValueOf):
+        (KJS::BooleanConstructor::construct):
+        (KJS::BooleanConstructor::callAsFunction):
+        * kjs/BooleanObject.h:
+        * kjs/CommonIdentifiers.h:
+        * kjs/ExecState.h:
+        (KJS::ExecState::emptyList):
+        * kjs/FunctionPrototype.cpp:
+        (KJS::FunctionPrototype::callAsFunction):
+        (KJS::functionProtoFuncToString):
+        (KJS::functionProtoFuncApply):
+        (KJS::functionProtoFuncCall):
+        (KJS::FunctionConstructor::construct):
+        (KJS::FunctionConstructor::callAsFunction):
+        * kjs/FunctionPrototype.h:
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::createArgumentsObject):
+        * kjs/JSArray.cpp:
+        (KJS::JSArray::JSArray):
+        (KJS::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * kjs/JSArray.h:
+        * kjs/JSFunction.cpp:
+        (KJS::JSFunction::callAsFunction):
+        (KJS::JSFunction::construct):
+        (KJS::IndexToNameMap::IndexToNameMap):
+        (KJS::Arguments::Arguments):
+        (KJS::encode):
+        (KJS::decode):
+        (KJS::globalFuncEval):
+        (KJS::globalFuncParseInt):
+        (KJS::globalFuncParseFloat):
+        (KJS::globalFuncIsNaN):
+        (KJS::globalFuncIsFinite):
+        (KJS::globalFuncDecodeURI):
+        (KJS::globalFuncDecodeURIComponent):
+        (KJS::globalFuncEncodeURI):
+        (KJS::globalFuncEncodeURIComponent):
+        (KJS::globalFuncEscape):
+        (KJS::globalFuncUnescape):
+        (KJS::globalFuncKJSPrint):
+        (KJS::PrototypeFunction::callAsFunction):
+        (KJS::PrototypeReflexiveFunction::callAsFunction):
+        * kjs/JSFunction.h:
+        * kjs/JSGlobalData.h:
+        * kjs/JSImmediate.cpp:
+        (KJS::JSImmediate::toObject):
+        * kjs/JSNotAnObject.cpp:
+        (KJS::JSNotAnObject::construct):
+        (KJS::JSNotAnObject::callAsFunction):
+        * kjs/JSNotAnObject.h:
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::put):
+        (KJS::JSObject::construct):
+        (KJS::JSObject::callAsFunction):
+        (KJS::Error::create):
+        * kjs/JSObject.h:
+        * kjs/MathObject.cpp:
+        (KJS::mathProtoFuncAbs):
+        (KJS::mathProtoFuncACos):
+        (KJS::mathProtoFuncASin):
+        (KJS::mathProtoFuncATan):
+        (KJS::mathProtoFuncATan2):
+        (KJS::mathProtoFuncCeil):
+        (KJS::mathProtoFuncCos):
+        (KJS::mathProtoFuncExp):
+        (KJS::mathProtoFuncFloor):
+        (KJS::mathProtoFuncLog):
+        (KJS::mathProtoFuncMax):
+        (KJS::mathProtoFuncMin):
+        (KJS::mathProtoFuncPow):
+        (KJS::mathProtoFuncRandom):
+        (KJS::mathProtoFuncRound):
+        (KJS::mathProtoFuncSin):
+        (KJS::mathProtoFuncSqrt):
+        (KJS::mathProtoFuncTan):
+        * kjs/MathObject.h:
+        * kjs/NumberObject.cpp:
+        (KJS::numberProtoFuncToString):
+        (KJS::numberProtoFuncToLocaleString):
+        (KJS::numberProtoFuncValueOf):
+        (KJS::numberProtoFuncToFixed):
+        (KJS::numberProtoFuncToExponential):
+        (KJS::numberProtoFuncToPrecision):
+        (KJS::NumberConstructor::construct):
+        (KJS::NumberConstructor::callAsFunction):
+        * kjs/NumberObject.h:
+        * kjs/RegExpObject.cpp:
+        (KJS::regExpProtoFuncTest):
+        (KJS::regExpProtoFuncExec):
+        (KJS::regExpProtoFuncCompile):
+        (KJS::regExpProtoFuncToString):
+        (KJS::RegExpObject::match):
+        (KJS::RegExpObject::test):
+        (KJS::RegExpObject::exec):
+        (KJS::RegExpObject::callAsFunction):
+        (KJS::RegExpConstructor::construct):
+        (KJS::RegExpConstructor::callAsFunction):
+        * kjs/RegExpObject.h:
+        * kjs/Shell.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionReadline):
+        (functionQuit):
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        * kjs/collector.h:
+        (KJS::Collector::markListSet):
+        * kjs/date_object.cpp:
+        (KJS::formatLocaleDate):
+        (KJS::fillStructuresUsingTimeArgs):
+        (KJS::fillStructuresUsingDateArgs):
+        (KJS::DateConstructor::construct):
+        (KJS::DateConstructor::callAsFunction):
+        (KJS::DateFunction::callAsFunction):
+        (KJS::dateProtoFuncToString):
+        (KJS::dateProtoFuncToUTCString):
+        (KJS::dateProtoFuncToDateString):
+        (KJS::dateProtoFuncToTimeString):
+        (KJS::dateProtoFuncToLocaleString):
+        (KJS::dateProtoFuncToLocaleDateString):
+        (KJS::dateProtoFuncToLocaleTimeString):
+        (KJS::dateProtoFuncValueOf):
+        (KJS::dateProtoFuncGetTime):
+        (KJS::dateProtoFuncGetFullYear):
+        (KJS::dateProtoFuncGetUTCFullYear):
+        (KJS::dateProtoFuncToGMTString):
+        (KJS::dateProtoFuncGetMonth):
+        (KJS::dateProtoFuncGetUTCMonth):
+        (KJS::dateProtoFuncGetDate):
+        (KJS::dateProtoFuncGetUTCDate):
+        (KJS::dateProtoFuncGetDay):
+        (KJS::dateProtoFuncGetUTCDay):
+        (KJS::dateProtoFuncGetHours):
+        (KJS::dateProtoFuncGetUTCHours):
+        (KJS::dateProtoFuncGetMinutes):
+        (KJS::dateProtoFuncGetUTCMinutes):
+        (KJS::dateProtoFuncGetSeconds):
+        (KJS::dateProtoFuncGetUTCSeconds):
+        (KJS::dateProtoFuncGetMilliSeconds):
+        (KJS::dateProtoFuncGetUTCMilliseconds):
+        (KJS::dateProtoFuncGetTimezoneOffset):
+        (KJS::dateProtoFuncSetTime):
+        (KJS::setNewValueFromTimeArgs):
+        (KJS::setNewValueFromDateArgs):
+        (KJS::dateProtoFuncSetMilliSeconds):
+        (KJS::dateProtoFuncSetUTCMilliseconds):
+        (KJS::dateProtoFuncSetSeconds):
+        (KJS::dateProtoFuncSetUTCSeconds):
+        (KJS::dateProtoFuncSetMinutes):
+        (KJS::dateProtoFuncSetUTCMinutes):
+        (KJS::dateProtoFuncSetHours):
+        (KJS::dateProtoFuncSetUTCHours):
+        (KJS::dateProtoFuncSetDate):
+        (KJS::dateProtoFuncSetUTCDate):
+        (KJS::dateProtoFuncSetMonth):
+        (KJS::dateProtoFuncSetUTCMonth):
+        (KJS::dateProtoFuncSetFullYear):
+        (KJS::dateProtoFuncSetUTCFullYear):
+        (KJS::dateProtoFuncSetYear):
+        (KJS::dateProtoFuncGetYear):
+        * kjs/date_object.h:
+        * kjs/debugger.h:
+        * kjs/error_object.cpp:
+        (KJS::errorProtoFuncToString):
+        (KJS::ErrorConstructor::construct):
+        (KJS::ErrorConstructor::callAsFunction):
+        (KJS::NativeErrorConstructor::construct):
+        (KJS::NativeErrorConstructor::callAsFunction):
+        * kjs/error_object.h:
+        * kjs/internal.cpp:
+        (KJS::JSNumberCell::toObject):
+        (KJS::JSNumberCell::toThisObject):
+        * kjs/list.cpp:
+        (KJS::ArgList::getSlice):
+        (KJS::ArgList::markLists):
+        (KJS::ArgList::slowAppend):
+        * kjs/list.h:
+        (KJS::ArgList::ArgList):
+        (KJS::ArgList::~ArgList):
+        * kjs/object_object.cpp:
+        (KJS::objectProtoFuncValueOf):
+        (KJS::objectProtoFuncHasOwnProperty):
+        (KJS::objectProtoFuncIsPrototypeOf):
+        (KJS::objectProtoFuncDefineGetter):
+        (KJS::objectProtoFuncDefineSetter):
+        (KJS::objectProtoFuncLookupGetter):
+        (KJS::objectProtoFuncLookupSetter):
+        (KJS::objectProtoFuncPropertyIsEnumerable):
+        (KJS::objectProtoFuncToLocaleString):
+        (KJS::objectProtoFuncToString):
+        (KJS::ObjectConstructor::construct):
+        (KJS::ObjectConstructor::callAsFunction):
+        * kjs/object_object.h:
+        * kjs/string_object.cpp:
+        (KJS::replace):
+        (KJS::stringProtoFuncToString):
+        (KJS::stringProtoFuncValueOf):
+        (KJS::stringProtoFuncCharAt):
+        (KJS::stringProtoFuncCharCodeAt):
+        (KJS::stringProtoFuncConcat):
+        (KJS::stringProtoFuncIndexOf):
+        (KJS::stringProtoFuncLastIndexOf):
+        (KJS::stringProtoFuncMatch):
+        (KJS::stringProtoFuncSearch):
+        (KJS::stringProtoFuncReplace):
+        (KJS::stringProtoFuncSlice):
+        (KJS::stringProtoFuncSplit):
+        (KJS::stringProtoFuncSubstr):
+        (KJS::stringProtoFuncSubstring):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        (KJS::stringProtoFuncLocaleCompare):
+        (KJS::stringProtoFuncBig):
+        (KJS::stringProtoFuncSmall):
+        (KJS::stringProtoFuncBlink):
+        (KJS::stringProtoFuncBold):
+        (KJS::stringProtoFuncFixed):
+        (KJS::stringProtoFuncItalics):
+        (KJS::stringProtoFuncStrike):
+        (KJS::stringProtoFuncSub):
+        (KJS::stringProtoFuncSup):
+        (KJS::stringProtoFuncFontcolor):
+        (KJS::stringProtoFuncFontsize):
+        (KJS::stringProtoFuncAnchor):
+        (KJS::stringProtoFuncLink):
+        (KJS::StringConstructor::construct):
+        (KJS::StringConstructor::callAsFunction):
+        (KJS::StringConstructorFunction::callAsFunction):
+        * kjs/string_object.h:
+
+2008-06-15  Darin Adler  <darin@apple.com>
+
+        - new names for more JavaScriptCore files
+
+        * API/JSCallbackFunction.cpp:
+        * API/JSObjectRef.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Machine.cpp:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArrayPrototype.cpp: Copied from JavaScriptCore/kjs/array_object.cpp.
+        * kjs/ArrayPrototype.h: Copied from JavaScriptCore/kjs/array_object.h.
+        * kjs/BooleanObject.cpp: Copied from JavaScriptCore/kjs/bool_object.cpp.
+        * kjs/BooleanObject.h: Copied from JavaScriptCore/kjs/bool_object.h.
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/FunctionPrototype.cpp: Copied from JavaScriptCore/kjs/function_object.cpp.
+        * kjs/FunctionPrototype.h: Copied from JavaScriptCore/kjs/function_object.h.
+        * kjs/JSArray.cpp: Copied from JavaScriptCore/kjs/array_instance.cpp.
+        * kjs/JSArray.h: Copied from JavaScriptCore/kjs/array_instance.h.
+        * kjs/JSFunction.cpp:
+        * kjs/JSFunction.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSImmediate.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSString.h:
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.cpp:
+        * kjs/MathObject.cpp: Copied from JavaScriptCore/kjs/math_object.cpp.
+        * kjs/MathObject.h: Copied from JavaScriptCore/kjs/math_object.h.
+        * kjs/NumberObject.cpp: Copied from JavaScriptCore/kjs/number_object.cpp.
+        * kjs/NumberObject.h: Copied from JavaScriptCore/kjs/number_object.h.
+        * kjs/PropertyMap.cpp: Copied from JavaScriptCore/kjs/property_map.cpp.
+        * kjs/PropertyMap.h: Copied from JavaScriptCore/kjs/property_map.h.
+        * kjs/PropertySlot.cpp: Copied from JavaScriptCore/kjs/property_slot.cpp.
+        * kjs/PropertySlot.h: Copied from JavaScriptCore/kjs/property_slot.h.
+        * kjs/RegExpObject.cpp: Copied from JavaScriptCore/kjs/regexp_object.cpp.
+        * kjs/RegExpObject.h: Copied from JavaScriptCore/kjs/regexp_object.h.
+        * kjs/ScopeChain.cpp: Copied from JavaScriptCore/kjs/scope_chain.cpp.
+        * kjs/ScopeChain.h: Copied from JavaScriptCore/kjs/scope_chain.h.
+        * kjs/ScopeChainMark.h: Copied from JavaScriptCore/kjs/scope_chain_mark.h.
+        * kjs/Shell.cpp:
+        * kjs/array_instance.cpp: Removed.
+        * kjs/array_instance.h: Removed.
+        * kjs/array_object.cpp: Removed.
+        * kjs/array_object.h: Removed.
+        * kjs/bool_object.cpp: Removed.
+        * kjs/bool_object.h: Removed.
+        * kjs/error_object.h:
+        * kjs/function_object.cpp: Removed.
+        * kjs/function_object.h: Removed.
+        * kjs/internal.cpp:
+        * kjs/math_object.cpp: Removed.
+        * kjs/math_object.h: Removed.
+        * kjs/nodes.cpp:
+        * kjs/number_object.cpp: Removed.
+        * kjs/number_object.h: Removed.
+        * kjs/object_object.cpp:
+        * kjs/property_map.cpp: Removed.
+        * kjs/property_map.h: Removed.
+        * kjs/property_slot.cpp: Removed.
+        * kjs/property_slot.h: Removed.
+        * kjs/regexp_object.cpp: Removed.
+        * kjs/regexp_object.h: Removed.
+        * kjs/scope_chain.cpp: Removed.
+        * kjs/scope_chain.h: Removed.
+        * kjs/scope_chain_mark.h: Removed.
+        * kjs/string_object.cpp:
+        * kjs/string_object.h:
+
+2008-06-15  Darin Adler  <darin@apple.com>
+
+        - new names for a few key JavaScriptCore files
+
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSClassRef.h:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSStringRef.cpp:
+        * API/JSStringRefCF.cpp:
+        * API/JSValueRef.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeBlock.cpp:
+        * VM/CodeGenerator.cpp:
+        * VM/ExceptionHelpers.cpp:
+        * VM/ExceptionHelpers.h:
+        * VM/JSPropertyNameIterator.cpp:
+        * VM/JSPropertyNameIterator.h:
+        * VM/Machine.cpp:
+        * kjs/AllInOneFile.cpp:
+        * kjs/DateMath.cpp:
+        * kjs/DebuggerCallFrame.cpp:
+        * kjs/ExecState.cpp:
+        * kjs/JSActivation.cpp:
+        * kjs/JSFunction.cpp: Copied from JavaScriptCore/kjs/function.cpp.
+        * kjs/JSFunction.h: Copied from JavaScriptCore/kjs/function.h.
+        * kjs/JSImmediate.cpp:
+        * kjs/JSNotAnObject.h:
+        * kjs/JSObject.cpp: Copied from JavaScriptCore/kjs/object.cpp.
+        * kjs/JSObject.h: Copied from JavaScriptCore/kjs/object.h.
+        * kjs/JSString.h: Copied from JavaScriptCore/kjs/internal.h.
+        * kjs/JSValue.cpp: Copied from JavaScriptCore/kjs/value.cpp.
+        * kjs/JSValue.h: Copied from JavaScriptCore/kjs/value.h.
+        * kjs/JSVariableObject.h:
+        * kjs/JSWrapperObject.h:
+        * kjs/Shell.cpp:
+        * kjs/SymbolTable.h:
+        * kjs/array_instance.h:
+        * kjs/collector.cpp:
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        * kjs/error_object.cpp:
+        * kjs/function.cpp: Removed.
+        * kjs/function.h: Removed.
+        * kjs/function_object.cpp:
+        * kjs/function_object.h:
+        * kjs/grammar.y:
+        * kjs/internal.cpp:
+        * kjs/internal.h: Removed.
+        * kjs/lexer.cpp:
+        * kjs/list.h:
+        * kjs/lookup.h:
+        * kjs/nodes.h:
+        * kjs/object.cpp: Removed.
+        * kjs/object.h: Removed.
+        * kjs/object_object.h:
+        * kjs/operations.cpp:
+        * kjs/property_map.cpp:
+        * kjs/property_slot.cpp:
+        * kjs/property_slot.h:
+        * kjs/protect.h:
+        * kjs/regexp_object.cpp:
+        * kjs/scope_chain.cpp:
+        * kjs/string_object.h:
+        * kjs/ustring.cpp:
+        * kjs/value.cpp: Removed.
+        * kjs/value.h: Removed.
+        * profiler/Profile.cpp:
+        * profiler/Profiler.cpp:
+
+2008-06-15  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Sam.
+
+        - cut down on confusing uses of "Object" and "Imp" in
+          JavaScriptCore class names
+
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::JSCallbackFunction):
+        * API/JSCallbackFunction.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/ExecState.h:
+        (KJS::ExecState::regExpTable):
+        (KJS::ExecState::regExpConstructorTable):
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::JSGlobalData):
+        (KJS::JSGlobalData::~JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::objectConstructor):
+        (KJS::JSGlobalObject::functionConstructor):
+        (KJS::JSGlobalObject::arrayConstructor):
+        (KJS::JSGlobalObject::booleanConstructor):
+        (KJS::JSGlobalObject::stringConstructor):
+        (KJS::JSGlobalObject::numberConstructor):
+        (KJS::JSGlobalObject::dateConstructor):
+        (KJS::JSGlobalObject::regExpConstructor):
+        (KJS::JSGlobalObject::errorConstructor):
+        (KJS::JSGlobalObject::evalErrorConstructor):
+        (KJS::JSGlobalObject::rangeErrorConstructor):
+        (KJS::JSGlobalObject::referenceErrorConstructor):
+        (KJS::JSGlobalObject::syntaxErrorConstructor):
+        (KJS::JSGlobalObject::typeErrorConstructor):
+        (KJS::JSGlobalObject::URIErrorConstructor):
+        * kjs/array_object.cpp:
+        (KJS::ArrayConstructor::ArrayConstructor):
+        (KJS::ArrayConstructor::getConstructData):
+        (KJS::ArrayConstructor::construct):
+        (KJS::ArrayConstructor::callAsFunction):
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        (KJS::BooleanObject::BooleanObject):
+        (KJS::BooleanPrototype::BooleanPrototype):
+        (KJS::booleanProtoFuncToString):
+        (KJS::booleanProtoFuncValueOf):
+        (KJS::BooleanConstructor::BooleanConstructor):
+        (KJS::BooleanConstructor::getConstructData):
+        (KJS::BooleanConstructor::construct):
+        (KJS::BooleanConstructor::callAsFunction):
+        * kjs/bool_object.h:
+        * kjs/date_object.cpp:
+        (KJS::DatePrototype::DatePrototype):
+        (KJS::DateConstructor::DateConstructor):
+        (KJS::DateConstructor::getConstructData):
+        (KJS::DateConstructor::construct):
+        (KJS::DateConstructor::callAsFunction):
+        (KJS::DateFunction::DateFunction):
+        (KJS::DateFunction::callAsFunction):
+        * kjs/date_object.h:
+        * kjs/error_object.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype):
+        (KJS::ErrorConstructor::ErrorConstructor):
+        (KJS::ErrorConstructor::getConstructData):
+        (KJS::ErrorConstructor::construct):
+        (KJS::ErrorConstructor::callAsFunction):
+        (KJS::NativeErrorConstructor::NativeErrorConstructor):
+        (KJS::NativeErrorConstructor::getConstructData):
+        (KJS::NativeErrorConstructor::construct):
+        (KJS::NativeErrorConstructor::callAsFunction):
+        (KJS::NativeErrorConstructor::mark):
+        * kjs/error_object.h:
+        * kjs/function.cpp:
+        (KJS::JSFunction::JSFunction):
+        (KJS::JSFunction::mark):
+        (KJS::JSFunction::getOwnPropertySlot):
+        (KJS::JSFunction::put):
+        (KJS::JSFunction::deleteProperty):
+        (KJS::PrototypeFunction::PrototypeFunction):
+        (KJS::PrototypeReflexiveFunction::PrototypeReflexiveFunction):
+        (KJS::PrototypeReflexiveFunction::mark):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (KJS::functionProtoFuncToString):
+        (KJS::FunctionConstructor::FunctionConstructor):
+        (KJS::FunctionConstructor::getConstructData):
+        (KJS::FunctionConstructor::construct):
+        (KJS::FunctionConstructor::callAsFunction):
+        * kjs/function_object.h:
+        * kjs/internal.cpp:
+        (KJS::StringObject::create):
+        (KJS::JSString::toObject):
+        (KJS::JSString::toThisObject):
+        (KJS::JSString::getOwnPropertySlot):
+        (KJS::InternalFunction::InternalFunction):
+        (KJS::InternalFunction::getCallData):
+        (KJS::InternalFunction::implementsHasInstance):
+        * kjs/math_object.cpp:
+        (KJS::MathObject::MathObject):
+        (KJS::MathObject::getOwnPropertySlot):
+        (KJS::MathObject::getValueProperty):
+        * kjs/math_object.h:
+        * kjs/number_object.cpp:
+        (KJS::NumberObject::NumberObject):
+        (KJS::NumberPrototype::NumberPrototype):
+        (KJS::numberProtoFuncToString):
+        (KJS::numberProtoFuncToLocaleString):
+        (KJS::numberProtoFuncValueOf):
+        (KJS::numberProtoFuncToFixed):
+        (KJS::numberProtoFuncToExponential):
+        (KJS::numberProtoFuncToPrecision):
+        (KJS::NumberConstructor::NumberConstructor):
+        (KJS::NumberConstructor::getOwnPropertySlot):
+        (KJS::NumberConstructor::getValueProperty):
+        (KJS::NumberConstructor::getConstructData):
+        (KJS::NumberConstructor::construct):
+        (KJS::NumberConstructor::callAsFunction):
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        (KJS::JSObject::putDirectFunction):
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        (KJS::ObjectConstructor::ObjectConstructor):
+        (KJS::ObjectConstructor::getConstructData):
+        (KJS::ObjectConstructor::construct):
+        (KJS::ObjectConstructor::callAsFunction):
+        * kjs/object_object.h:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        * kjs/regexp_object.cpp:
+        (KJS::regExpProtoFuncTest):
+        (KJS::regExpProtoFuncExec):
+        (KJS::regExpProtoFuncCompile):
+        (KJS::regExpProtoFuncToString):
+        (KJS::RegExpObject::RegExpObject):
+        (KJS::RegExpObject::~RegExpObject):
+        (KJS::RegExpObject::getOwnPropertySlot):
+        (KJS::RegExpObject::getValueProperty):
+        (KJS::RegExpObject::put):
+        (KJS::RegExpObject::putValueProperty):
+        (KJS::RegExpObject::match):
+        (KJS::RegExpObject::test):
+        (KJS::RegExpObject::exec):
+        (KJS::RegExpObject::getCallData):
+        (KJS::RegExpObject::callAsFunction):
+        (KJS::RegExpConstructorPrivate::RegExpConstructorPrivate):
+        (KJS::RegExpConstructor::RegExpConstructor):
+        (KJS::RegExpConstructor::performMatch):
+        (KJS::RegExpMatchesArray::RegExpMatchesArray):
+        (KJS::RegExpMatchesArray::~RegExpMatchesArray):
+        (KJS::RegExpMatchesArray::fillArrayInstance):
+        (KJS::RegExpConstructor::arrayOfMatches):
+        (KJS::RegExpConstructor::getBackref):
+        (KJS::RegExpConstructor::getLastParen):
+        (KJS::RegExpConstructor::getLeftContext):
+        (KJS::RegExpConstructor::getRightContext):
+        (KJS::RegExpConstructor::getOwnPropertySlot):
+        (KJS::RegExpConstructor::getValueProperty):
+        (KJS::RegExpConstructor::put):
+        (KJS::RegExpConstructor::putValueProperty):
+        (KJS::RegExpConstructor::getConstructData):
+        (KJS::RegExpConstructor::construct):
+        (KJS::RegExpConstructor::callAsFunction):
+        (KJS::RegExpConstructor::input):
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (KJS::StringObject::StringObject):
+        (KJS::StringObject::getOwnPropertySlot):
+        (KJS::StringObject::put):
+        (KJS::StringObject::deleteProperty):
+        (KJS::StringObject::getPropertyNames):
+        (KJS::StringPrototype::StringPrototype):
+        (KJS::StringPrototype::getOwnPropertySlot):
+        (KJS::replace):
+        (KJS::stringProtoFuncToString):
+        (KJS::stringProtoFuncValueOf):
+        (KJS::stringProtoFuncCharAt):
+        (KJS::stringProtoFuncCharCodeAt):
+        (KJS::stringProtoFuncConcat):
+        (KJS::stringProtoFuncIndexOf):
+        (KJS::stringProtoFuncLastIndexOf):
+        (KJS::stringProtoFuncMatch):
+        (KJS::stringProtoFuncSearch):
+        (KJS::stringProtoFuncReplace):
+        (KJS::stringProtoFuncSlice):
+        (KJS::stringProtoFuncSplit):
+        (KJS::stringProtoFuncSubstr):
+        (KJS::stringProtoFuncSubstring):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        (KJS::stringProtoFuncLocaleCompare):
+        (KJS::stringProtoFuncBig):
+        (KJS::stringProtoFuncSmall):
+        (KJS::stringProtoFuncBlink):
+        (KJS::stringProtoFuncBold):
+        (KJS::stringProtoFuncFixed):
+        (KJS::stringProtoFuncItalics):
+        (KJS::stringProtoFuncStrike):
+        (KJS::stringProtoFuncSub):
+        (KJS::stringProtoFuncSup):
+        (KJS::stringProtoFuncFontcolor):
+        (KJS::stringProtoFuncFontsize):
+        (KJS::stringProtoFuncAnchor):
+        (KJS::stringProtoFuncLink):
+        (KJS::StringConstructor::StringConstructor):
+        (KJS::StringConstructor::getConstructData):
+        (KJS::StringConstructor::construct):
+        (KJS::StringConstructor::callAsFunction):
+        (KJS::StringConstructorFunction::StringConstructorFunction):
+        (KJS::StringConstructorFunction::callAsFunction):
+        * kjs/string_object.h:
+        (KJS::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * profiler/Profiler.cpp:
+        (KJS::createCallIdentifier):
+
+2008-06-15  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Sam.
+
+        - use JS prefix and simpler names for basic JavaScriptCore types,
+          to complement JSValue and JSObject
+
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (KJS::jsLess):
+        (KJS::jsLessEq):
+        (KJS::jsAdd):
+        (KJS::callEval):
+        (KJS::Machine::execute):
+        (KJS::Machine::retrieveArguments):
+        (KJS::Machine::retrieveCaller):
+        (KJS::Machine::getCallFrame):
+        (KJS::Machine::getFunctionAndArguments):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * kjs/DebuggerCallFrame.cpp:
+        (KJS::DebuggerCallFrame::functionName):
+        * kjs/ExecState.h:
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::createArgumentsObject):
+        * kjs/array_instance.cpp:
+        (KJS::JSArray::checkConsistency):
+        (KJS::JSArray::JSArray):
+        (KJS::JSArray::~JSArray):
+        (KJS::JSArray::getItem):
+        (KJS::JSArray::lengthGetter):
+        (KJS::JSArray::inlineGetOwnPropertySlot):
+        (KJS::JSArray::getOwnPropertySlot):
+        (KJS::JSArray::put):
+        (KJS::JSArray::deleteProperty):
+        (KJS::JSArray::getPropertyNames):
+        (KJS::JSArray::increaseVectorLength):
+        (KJS::JSArray::setLength):
+        (KJS::JSArray::mark):
+        (KJS::JSArray::sort):
+        (KJS::JSArray::compactForSorting):
+        (KJS::JSArray::lazyCreationData):
+        (KJS::JSArray::setLazyCreationData):
+        * kjs/array_instance.h:
+        * kjs/array_object.cpp:
+        (KJS::ArrayPrototype::ArrayPrototype):
+        (KJS::ArrayPrototype::getOwnPropertySlot):
+        (KJS::arrayProtoFuncToString):
+        (KJS::arrayProtoFuncToLocaleString):
+        (KJS::arrayProtoFuncConcat):
+        (KJS::arrayProtoFuncSort):
+        (KJS::ArrayObjectImp::construct):
+        * kjs/array_object.h:
+        * kjs/completion.h:
+        * kjs/function.cpp:
+        (KJS::JSFunction::JSFunction):
+        (KJS::JSFunction::mark):
+        (KJS::JSFunction::getCallData):
+        (KJS::JSFunction::callAsFunction):
+        (KJS::JSFunction::argumentsGetter):
+        (KJS::JSFunction::callerGetter):
+        (KJS::JSFunction::lengthGetter):
+        (KJS::JSFunction::getOwnPropertySlot):
+        (KJS::JSFunction::put):
+        (KJS::JSFunction::deleteProperty):
+        (KJS::JSFunction::getParameterName):
+        (KJS::JSFunction::getConstructData):
+        (KJS::JSFunction::construct):
+        (KJS::IndexToNameMap::IndexToNameMap):
+        (KJS::Arguments::Arguments):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (KJS::functionProtoFuncToString):
+        (KJS::functionProtoFuncApply):
+        (KJS::FunctionObjectImp::construct):
+        * kjs/internal.cpp:
+        (KJS::JSString::toPrimitive):
+        (KJS::JSString::getPrimitiveNumber):
+        (KJS::JSString::toBoolean):
+        (KJS::JSString::toNumber):
+        (KJS::JSString::toString):
+        (KJS::StringInstance::create):
+        (KJS::JSString::toObject):
+        (KJS::JSString::toThisObject):
+        (KJS::JSString::lengthGetter):
+        (KJS::JSString::indexGetter):
+        (KJS::JSString::indexNumericPropertyGetter):
+        (KJS::JSString::getOwnPropertySlot):
+        (KJS::JSNumberCell::type):
+        (KJS::JSNumberCell::toPrimitive):
+        (KJS::JSNumberCell::getPrimitiveNumber):
+        (KJS::JSNumberCell::toBoolean):
+        (KJS::JSNumberCell::toNumber):
+        (KJS::JSNumberCell::toString):
+        (KJS::JSNumberCell::toObject):
+        (KJS::JSNumberCell::toThisObject):
+        (KJS::JSNumberCell::getUInt32):
+        (KJS::JSNumberCell::getTruncatedInt32):
+        (KJS::JSNumberCell::getTruncatedUInt32):
+        (KJS::GetterSetter::mark):
+        (KJS::GetterSetter::toPrimitive):
+        (KJS::GetterSetter::getPrimitiveNumber):
+        (KJS::GetterSetter::toBoolean):
+        (KJS::GetterSetter::toNumber):
+        (KJS::GetterSetter::toString):
+        (KJS::GetterSetter::toObject):
+        (KJS::GetterSetter::getOwnPropertySlot):
+        (KJS::GetterSetter::put):
+        (KJS::GetterSetter::toThisObject):
+        * kjs/internal.h:
+        (KJS::JSString::JSString):
+        (KJS::JSString::getStringPropertySlot):
+        * kjs/nodes.cpp:
+        (KJS::FuncDeclNode::makeFunction):
+        (KJS::FuncExprNode::makeFunction):
+        * kjs/nodes.h:
+        * kjs/object.cpp:
+        (KJS::JSObject::put):
+        (KJS::JSObject::deleteProperty):
+        (KJS::JSObject::defineGetter):
+        (KJS::JSObject::defineSetter):
+        (KJS::JSObject::lookupGetter):
+        (KJS::JSObject::lookupSetter):
+        (KJS::JSObject::fillGetterPropertySlot):
+        * kjs/object.h:
+        (KJS::GetterSetter::GetterSetter):
+        * kjs/operations.cpp:
+        (KJS::equal):
+        (KJS::strictEqual):
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::containsGettersOrSetters):
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpMatchesArray::getOwnPropertySlot):
+        (KJS::RegExpMatchesArray::put):
+        (KJS::RegExpMatchesArray::deleteProperty):
+        (KJS::RegExpMatchesArray::getPropertyNames):
+        (KJS::RegExpMatchesArray::RegExpMatchesArray):
+        (KJS::RegExpMatchesArray::fillArrayInstance):
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::StringInstance):
+        (KJS::replace):
+        (KJS::stringProtoFuncReplace):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        * kjs/string_object.h:
+        (KJS::StringInstance::internalValue):
+        * kjs/value.cpp:
+        (KJS::JSCell::getNumber):
+        (KJS::JSCell::getString):
+        (KJS::JSCell::getObject):
+        (KJS::jsString):
+        (KJS::jsOwnedString):
+        * kjs/value.h:
+        (KJS::JSNumberCell::JSNumberCell):
+        (KJS::jsNumberCell):
+        (KJS::JSValue::uncheckedGetNumber):
+        * profiler/Profiler.cpp:
+        (KJS::createCallIdentifier):
+        (KJS::createCallIdentifierFromFunctionImp):
+
+2008-06-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey.
+        
+        - add emitUnaryOp, emitNullaryOp and emitUnaryOpNoDst; use them
+        
+        This removes some boilerplate code and also reduces the number of
+        places that will need to be changed to do on-demand emit of
+        loads (and thus support k operands).
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitUnaryOp):
+        (KJS::CodeGenerator::emitNullaryOp):
+        (KJS::CodeGenerator::emitUnaryOpNoDst):
+        (KJS::CodeGenerator::emitPushScope):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::emitNewObject):
+        (KJS::CodeGenerator::emitNewArray):
+        (KJS::CodeGenerator::emitNot):
+        (KJS::CodeGenerator::emitBitNot):
+        (KJS::CodeGenerator::emitToJSNumber):
+        (KJS::CodeGenerator::emitNegate):
+        (KJS::CodeGenerator::emitInstanceOf):
+        (KJS::CodeGenerator::emitTypeOf):
+        (KJS::CodeGenerator::emitIn):
+        (KJS::CodeGenerator::emitReturn):
+        (KJS::CodeGenerator::emitEnd):
+        (KJS::CodeGenerator::emitGetPropertyNames):
+
+2008-06-15  Alp Toker  <alp@nuanti.com>
+
+        Rubber-stamped by Maciej.
+
+        Install 'jsc' application by default.
+
+        * GNUmakefile.am:
+
+2008-06-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - rename testkjs to jsc
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/jsc: Added.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Copied from JavaScriptCore.vcproj/testkjs/testkjs.vcproj.
+        * JavaScriptCore.vcproj/testkjs: Removed.
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jscore.bkl:
+        * kjs/Shell.cpp: Copied from kjs/testkjs.cpp.
+        (main):
+        (printUsageStatement):
+        (jscmain):
+        * kjs/jsc.pro: Copied from kjs/testkjs.pro.
+        * kjs/testkjs.cpp: Removed.
+        * kjs/testkjs.pro: Removed.
+        * tests/mozilla/expected.html:
+        * tests/mozilla/js1_2/Array/tostring_1.js:
+        * tests/mozilla/js1_2/Array/tostring_2.js:
+        * tests/mozilla/jsDriver.pl:
+
+2008-06-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Mac build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/nodes.h:
+
+2008-06-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Change the spelling of PrecMultiplicitave to PrecMultiplicative.
+
+        * kjs/nodes.h:
+        (KJS::MultNode::precedence):
+        (KJS::DivNode::precedence):
+        (KJS::ModNode::precedence):
+
+2008-06-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Remove unused preprocessor macros related to exceptions in the old
+        interpreter.
+
+        * kjs/nodes.cpp:
+
+2008-06-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 19484: More instructions needs to use temporary registers
+        <https://bugs.webkit.org/show_bug.cgi?id=19484>
+
+        Fix codegen for all binary operations so that temporaries are used if
+        necessary. This was done by making BinaryOpNode and ReverseBinaryOpNode
+        subclasses of ExpressionNode, and eliminating the custom emitCode()
+        methods for the individual node classes.
+
+        This only adds 3 new instructions to SunSpider code, and there is no
+        difference in SunSpider execution time.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitBitNot):
+        (KJS::CodeGenerator::emitBinaryOp):
+        * VM/CodeGenerator.h:
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::BinaryOpNode::emitCode):
+        (KJS::ReverseBinaryOpNode::emitCode):
+        (KJS::emitReadModifyAssignment):
+        (KJS::CaseBlockNode::emitCodeForBlock):
+        * kjs/nodes.h:
+        (KJS::BinaryOpNode::BinaryOpNode):
+        (KJS::ReverseBinaryOpNode::ReverseBinaryOpNode):
+        (KJS::MultNode::):
+        (KJS::DivNode::):
+        (KJS::DivNode::precedence):
+        (KJS::ModNode::):
+        (KJS::ModNode::precedence):
+        (KJS::AddNode::):
+        (KJS::AddNode::precedence):
+        (KJS::SubNode::):
+        (KJS::SubNode::precedence):
+        (KJS::LeftShiftNode::):
+        (KJS::LeftShiftNode::precedence):
+        (KJS::RightShiftNode::):
+        (KJS::RightShiftNode::precedence):
+        (KJS::UnsignedRightShiftNode::):
+        (KJS::UnsignedRightShiftNode::precedence):
+        (KJS::LessNode::):
+        (KJS::LessNode::precedence):
+        (KJS::GreaterNode::):
+        (KJS::GreaterNode::precedence):
+        (KJS::LessEqNode::):
+        (KJS::LessEqNode::precedence):
+        (KJS::GreaterEqNode::):
+        (KJS::GreaterEqNode::precedence):
+        (KJS::InstanceOfNode::):
+        (KJS::InstanceOfNode::precedence):
+        (KJS::InNode::):
+        (KJS::InNode::precedence):
+        (KJS::EqualNode::):
+        (KJS::EqualNode::precedence):
+        (KJS::NotEqualNode::):
+        (KJS::NotEqualNode::precedence):
+        (KJS::StrictEqualNode::):
+        (KJS::StrictEqualNode::precedence):
+        (KJS::NotStrictEqualNode::):
+        (KJS::NotStrictEqualNode::precedence):
+        (KJS::BitAndNode::):
+        (KJS::BitAndNode::precedence):
+        (KJS::BitOrNode::):
+        (KJS::BitOrNode::precedence):
+        (KJS::BitXOrNode::):
+        (KJS::BitXOrNode::precedence):
+        * kjs/nodes2string.cpp:
+        (KJS::LessNode::streamTo):
+        (KJS::GreaterNode::streamTo):
+        (KJS::LessEqNode::streamTo):
+        (KJS::GreaterEqNode::streamTo):
+        (KJS::InstanceOfNode::streamTo):
+        (KJS::InNode::streamTo):
+        (KJS::EqualNode::streamTo):
+        (KJS::NotEqualNode::streamTo):
+        (KJS::StrictEqualNode::streamTo):
+        (KJS::NotStrictEqualNode::streamTo):
+        (KJS::BitAndNode::streamTo):
+        (KJS::BitXOrNode::streamTo):
+        (KJS::BitOrNode::streamTo):
+
+2008-06-14  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Sam.
+
+        - rename a bunch of local symbols within the regular expression code to
+          follow our usual coding style, and do a few other name tweaks
+
+        * pcre/pcre_compile.cpp:
+        (CompileData::CompileData):
+        (checkEscape):
+        (readRepeatCounts):
+        (compileBranch):
+        (compileBracket):
+        (calculateCompiledPatternLength):
+        (returnError):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (MatchStack::MatchStack):
+        (MatchStack::canUseStackBufferForNextFrame):
+        (MatchStack::popCurrentFrame):
+        (match):
+        (tryFirstByteOptimization):
+        (tryRequiredByteOptimization):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2008-06-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Remove redundant uses of get().
+
+        * kjs/nodes.cpp:
+        (KJS::BracketAccessorNode::emitCode):
+        (KJS::AddNode::emitCode):
+        (KJS::SubNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+        (KJS::AssignDotNode::emitCode):
+        (KJS::ReadModifyDotNode::emitCode):
+        (KJS::AssignBracketNode::emitCode):
+        (KJS::ReadModifyBracketNode::emitCode):
+
+2008-06-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Make code generation not use a temporary for the left-hand side of an
+        expression if the right-hand side is a local variable.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::isLocal):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::leftHandSideNeedsCopy):
+        (KJS::CodeGenerator::emitNodeForLeftHandSide):
+        * kjs/nodes.cpp:
+        (KJS::ResolveNode::isPure):
+        (KJS::BracketAccessorNode::emitCode):
+        (KJS::AddNode::emitCode):
+        (KJS::SubNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+        (KJS::AssignDotNode::emitCode):
+        (KJS::ReadModifyDotNode::emitCode):
+        (KJS::AssignBracketNode::emitCode):
+        (KJS::ReadModifyBracketNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::ExpressionNode::):
+        (KJS::BooleanNode::):
+        (KJS::NumberNode::):
+        (KJS::StringNode::):
+
+2008-06-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - more of https://bugs.webkit.org/show_bug.cgi?id=17257
+          start ref counts at 1 instead of 0 for speed
+
+        * kjs/nodes.cpp:
+        (KJS::ParserRefCounted::hasOneRef): Added. Replaces refcount.
+        * kjs/nodes.h: Replaced refcount with hasOneRef.
+
+        * wtf/ListRefPtr.h:
+        (WTF::ListRefPtr::~ListRefPtr): Changed to use hasOneRef instead of
+        refcount, so this class can be used with the RefCounted template.
+
+        * wtf/RefCounted.h:
+        (WTF::RefCounted::hasOneRef): Made const, since there's no reason for
+        it to be non-const.
+
+2008-06-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - initialize local vars as side effect of call instead of in bytecode
+        1.004x speedup on SunSpider.
+
+        This removes just the dispatch overhead for these loads - in the
+        future, dead store elimination might be able to eliminate them
+        entirely.
+        
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator): For function blocks, don't
+        emit loads of undefined for var initialization.
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall): Instead, initialize locals
+        as part of the call.
+
+2008-06-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Remove helper functions in the parser that are no longer needed.
+
+        * kjs/grammar.y:
+
+2008-06-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 19484: More instructions needs to use temporary registers
+        <https://bugs.webkit.org/show_bug.cgi?id=19484>
+
+        Make code generation for AddNode and SubNode use temporaries when
+        necessary.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::AddNode::emitCode):
+        (KJS::SubNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::AddNode::):
+        (KJS::SubNode::):
+
+2008-06-13  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Combine TrueNode and FalseNode to make BooleanNode, and remove the
+        unused class PlaceholderTrueNode.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::BooleanNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::BooleanNode::):
+        (KJS::BooleanNode::precedence):
+        * kjs/nodes2string.cpp:
+        (KJS::BooleanNode::streamTo):
+
+2008-06-13  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Eliminate the use of temporaries to store the left hand side of an
+        expression when the right hand side is a constant. This slightly
+        improves the generated bytecode for a few SunSpider tests, but it is
+        mostly in preparation for fixing
+
+        Bug 19484: More instructions needs to use temporary registers
+        <https://bugs.webkit.org/show_bug.cgi?id=19484>
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::leftHandSideNeedsCopy):
+        (KJS::CodeGenerator::emitNodeForLeftHandSide):
+        * kjs/nodes.cpp:
+        (KJS::BracketAccessorNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+        (KJS::AssignDotNode::emitCode):
+        (KJS::ReadModifyDotNode::emitCode):
+        (KJS::AssignBracketNode::emitCode):
+        (KJS::ReadModifyBracketNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::ExpressionNode::):
+        (KJS::FalseNode::):
+        (KJS::TrueNode::):
+        (KJS::NumberNode::):
+        (KJS::StringNode::):
+
+2008-06-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - prettify opcode stats output
+        
+        I changed things to be a bit more aligned, also there is a new
+        section listing most common opcodes and most common sequences that
+        include them.
+
+        * VM/Opcode.cpp:
+        (KJS::OpcodeStats::~OpcodeStats):
+        * VM/Opcode.h:
+
+2008-06-13  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/5969992> JSProfiler: Remove the recursion limit in the
+        profiler.
+        - Remove recursion from exclude().  This leaves only focus() to fix.
+
+        * JavaScriptCore.exp: Change the signatures of the exported functions.
+        * profiler/Profile.cpp:
+        (KJS::Profile::forEach): I added a traverseNextNodePreOrder() function
+        and so needed to distinguish the other function by labeling it
+        traverseNextNodePostOrder().
+        (KJS::Profile::exclude): All new exclude that iteratively walks the tree
+        * profiler/Profile.h:
+        (KJS::Profile::focus): Add a null check for m_head.
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::traverseNextNodePostOrder): Renamed
+        (KJS::ProfileNode::traverseNextNodePreOrder): Walks the tree in pre-
+        order, where the parent is processed before the children.
+        (KJS::ProfileNode::setTreeVisible): Iterate over the sub-tree and set
+        all of the nodes visible value.  This changes another function that used
+        recursion.
+        (KJS::ProfileNode::exclude): Remove recursion from this function.
+        Because we now check for m_visible and we are walking the tree in pre-
+        order we do not need to check if an excluded node is in an excluded
+        sub-tree.
+        * profiler/ProfileNode.h: Added specific selfTime functions to
+        facilitate exclude().
+        (KJS::ProfileNode::setSelfTime):
+        (KJS::ProfileNode::setActualSelfTime):
+        (KJS::ProfileNode::setVisibleSelfTime):
+
+2008-06-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19434
+          speed up SunSpider by avoiding some string boxing
+
+        Speeds up SunSpider by 1.1%.
+
+        Optimized code path for getting built-in properties from strings -- avoid
+        boxing with a string object in that case. We can make further changes to avoid
+        even more boxing, but this change alone is a win.
+
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::JSCallbackObject::staticValueGetter): Use isObject instead of inherits
+        in asssert, since the type of slotBase() is now JSValue, not JSObject.
+        (KJS::JSCallbackObject::staticFunctionGetter): Ditto.
+        (KJS::JSCallbackObject::callbackGetter): Ditto.
+
+        * kjs/internal.cpp:
+        (KJS::StringImp::getPrimitiveNumber): Updated for change of data member name.
+        (KJS::StringImp::toBoolean): Ditto.
+        (KJS::StringImp::toNumber): Ditto.
+        (KJS::StringImp::toString): Ditto.
+        (KJS::StringInstance::create): Added; avoids a bit of cut and paste code.
+        (KJS::StringImp::toObject): Use StringInstance::create.
+        (KJS::StringImp::toThisObject): Ditto.
+        (KJS::StringImp::lengthGetter): Added. Replaces the getter that used to live in
+        the StringInstance class.
+        (KJS::StringImp::indexGetter): Ditto.
+        (KJS::StringImp::indexNumericPropertyGetter): Ditto.
+        (KJS::StringImp::getOwnPropertySlot): Added. Deals with built in properties of
+        the string class without creating a StringInstance.
+
+        * kjs/internal.h:
+        (KJS::StringImp::getStringPropertySlot): Added. To be used by both the string
+        and string object getOwnPropertySlot function.
+
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter): Updated since slotBase() is now a JSValue rather
+        than a JSObject.
+
+        * kjs/object.h: Removed PropertySlot::slotBase() function, which can now move
+        back into property_slot.h where it belongs since it doesn't have to cast to
+        JSObject*.
+
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::functionGetter): Updated since slot.slotBase() is now a JSValue*
+        instead of JSObject*. setGetterSlot still guarantees the base is a JSObject*.
+        * kjs/property_slot.h:
+        (KJS::PropertySlot::PropertySlot): Changed base to JSValue* intead of JSCell*.
+        (KJS::PropertySlot::setStaticEntry): Ditto.
+        (KJS::PropertySlot::setCustom): Ditto.
+        (KJS::PropertySlot::setCustomIndex): Ditto.
+        (KJS::PropertySlot::setCustomNumeric): Ditto.
+        (KJS::PropertySlot::slotBase): Moved inline here since it no longer involves a
+        downcast to JSObject*.
+        (KJS::PropertySlot::setBase): Changed to JSValue*.
+
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::getOwnPropertySlot): Changed to use getStringPropertySlot
+        instead of coding the properties here. This allows sharing the code with StringImp.
+
+        * kjs/string_object.h: Removed inlineGetOwnPropertySlot, lengthGetter, and indexGetter.
+        Made one of the constructors protected.
+
+        * kjs/value.h: Made getOwnPropertySlot private in the JSCell class -- this is better
+        since it's not the real JSObject getOwnPropertySlot semantic and most callers shouldn't
+        use it.
+
+2008-06-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        Preparation to making JavaScript heap per-thread.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        * kjs/collector.h:
+        (KJS::Collector::markListSet):
+        The collector now holds the list of protected lists itself, to be made per-instance.
+
+        * kjs/list.h: Changed to hold a pointer to a mark set this list is in, if any.
+        (KJS::List::List): Explicitly initialize m_size with zero, as m_vector.size() is
+        guaranteed to be such anyway.
+        (KJS::List::append): Changed the fast case to only be executed as long as inline buffer
+        is used, because otherwise, we now do more expensive checks.
+
+        * kjs/list.cpp:
+        (KJS::List::markLists): Renamed from markProtectedListsSlowCase, made it take the list set
+        as a parameter.
+        (KJS::List::slowAppend): If a non-immediate value is appended, the list needs to be added
+        to an appropriate Heap's protected list. For now, a static Collector::markListSet() is
+        used, but the code is layed out in preparation to making the switch to multiple heaps.
+
+        * JavaScriptCore.exp: Updated export list.
+
+2008-06-12  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 19510: CodeBlock::needsFullScopeChain not always set for global code
+        <https://bugs.webkit.org/show_bug.cgi?id=19510>
+
+        This fixes the symptoms by using CodeGenerator::m_codeType to determine
+        when to use temporaries instead of CodeBlock::needsFullScopeChain, but
+        it does not fix the problem itself.
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::leftHandSideNeedsCopy):
+
+2008-06-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 19498: REGRESSION (r34497): crash while loading GMail
+        <https://bugs.webkit.org/show_bug.cgi?id=19498>
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpIfTrueMayCombine):
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::CaseBlockNode::emitCodeForBlock):
+
+2008-06-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - a little bit of cleanup and prep for some upcoming optimizations
+
+        * JavaScriptCore.exp: Re-sorted this file (with sort command line tool).
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump): Fixed printf to avoid warnings -- to use %lu we
+        need to make sure the type is unsigned long.
+        * kjs/object.cpp:
+        (KJS::Error::create): Eliminated unused error names array, and also put
+        the strings into the code since there was already a switch statment.
+        This also avoids having to contemplate a hypothetical access past the
+        end of the array.
+        * kjs/object.h: Got rid of errorNames.
+        * kjs/property_slot.cpp: Deleted unused ungettableGetter.
+        * kjs/property_slot.h: Ditto.
+        * wtf/AlwaysInline.h: Added LIKELY alongside UNLIKELY.
+
+2008-06-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Bug 19457: Create fused opcodes for tests and conditional jumps
+        <https://bugs.webkit.org/show_bug.cgi?id=19457>
+
+        Add a new jless instruction, and modify the code generator to emit it
+        instead of the pair (less, jtrue).
+
+        Gives a 3.6% improvement on SunSpider.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::emitOpcode):
+        (KJS::CodeGenerator::retrieveLastBinaryOp):
+        (KJS::CodeGenerator::rewindBinaryOp):
+        (KJS::CodeGenerator::emitJump):
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        (KJS::CodeGenerator::emitJumpIfFalse):
+        (KJS::CodeGenerator::emitMove):
+        (KJS::CodeGenerator::emitNot):
+        (KJS::CodeGenerator::emitEqual):
+        (KJS::CodeGenerator::emitNotEqual):
+        (KJS::CodeGenerator::emitStrictEqual):
+        (KJS::CodeGenerator::emitNotStrictEqual):
+        (KJS::CodeGenerator::emitLess):
+        (KJS::CodeGenerator::emitLessEq):
+        (KJS::CodeGenerator::emitPreInc):
+        (KJS::CodeGenerator::emitPreDec):
+        (KJS::CodeGenerator::emitPostInc):
+        (KJS::CodeGenerator::emitPostDec):
+        (KJS::CodeGenerator::emitToJSNumber):
+        (KJS::CodeGenerator::emitNegate):
+        (KJS::CodeGenerator::emitAdd):
+        (KJS::CodeGenerator::emitMul):
+        (KJS::CodeGenerator::emitDiv):
+        (KJS::CodeGenerator::emitMod):
+        (KJS::CodeGenerator::emitSub):
+        (KJS::CodeGenerator::emitLeftShift):
+        (KJS::CodeGenerator::emitRightShift):
+        (KJS::CodeGenerator::emitUnsignedRightShift):
+        (KJS::CodeGenerator::emitBitAnd):
+        (KJS::CodeGenerator::emitBitXOr):
+        (KJS::CodeGenerator::emitBitOr):
+        (KJS::CodeGenerator::emitBitNot):
+        (KJS::CodeGenerator::emitInstanceOf):
+        (KJS::CodeGenerator::emitTypeOf):
+        (KJS::CodeGenerator::emitIn):
+        (KJS::CodeGenerator::emitLoad):
+        (KJS::CodeGenerator::emitNewObject):
+        (KJS::CodeGenerator::emitNewArray):
+        (KJS::CodeGenerator::emitResolve):
+        (KJS::CodeGenerator::emitGetScopedVar):
+        (KJS::CodeGenerator::emitPutScopedVar):
+        (KJS::CodeGenerator::emitResolveBase):
+        (KJS::CodeGenerator::emitResolveWithBase):
+        (KJS::CodeGenerator::emitResolveFunction):
+        (KJS::CodeGenerator::emitGetById):
+        (KJS::CodeGenerator::emitPutById):
+        (KJS::CodeGenerator::emitPutGetter):
+        (KJS::CodeGenerator::emitPutSetter):
+        (KJS::CodeGenerator::emitDeleteById):
+        (KJS::CodeGenerator::emitGetByVal):
+        (KJS::CodeGenerator::emitPutByVal):
+        (KJS::CodeGenerator::emitDeleteByVal):
+        (KJS::CodeGenerator::emitPutByIndex):
+        (KJS::CodeGenerator::emitNewFunction):
+        (KJS::CodeGenerator::emitNewRegExp):
+        (KJS::CodeGenerator::emitNewFunctionExpression):
+        (KJS::CodeGenerator::emitCall):
+        (KJS::CodeGenerator::emitReturn):
+        (KJS::CodeGenerator::emitEnd):
+        (KJS::CodeGenerator::emitConstruct):
+        (KJS::CodeGenerator::emitPushScope):
+        (KJS::CodeGenerator::emitPopScope):
+        (KJS::CodeGenerator::emitDebugHook):
+        (KJS::CodeGenerator::emitComplexJumpScopes):
+        (KJS::CodeGenerator::emitJumpScopes):
+        (KJS::CodeGenerator::emitNextPropertyName):
+        (KJS::CodeGenerator::emitGetPropertyNames):
+        (KJS::CodeGenerator::emitCatch):
+        (KJS::CodeGenerator::emitThrow):
+        (KJS::CodeGenerator::emitNewError):
+        (KJS::CodeGenerator::emitJumpSubroutine):
+        (KJS::CodeGenerator::emitSubroutineReturn):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.cpp:
+        * VM/Opcode.h:
+
+2008-06-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=19442
+          JavaScript array implementation doesn't maintain m_numValuesInVector when sorting
+
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::checkConsistency): Added. Empty inline version for when
+        consistency checks are turned off.
+        (KJS::ArrayInstance::ArrayInstance): Check consistency after construction.
+        (KJS::ArrayInstance::~ArrayInstance): Check consistency before destruction.
+        (KJS::ArrayInstance::put): Check consistency before and after.
+        (KJS::ArrayInstance::deleteProperty): Ditto.
+        (KJS::ArrayInstance::setLength): Ditto.
+        (KJS::compareByStringPairForQSort): Use typedef for clarity.
+        (KJS::ArrayInstance::sort): Check consistency before and after. Also broke the loop
+        to set up sorting into two separate passes. Added FIXMEs about various exception
+        safety issues. Added code to set m_numValuesInVector after sorting.
+        (KJS::ArrayInstance::compactForSorting): Ditto.
+
+        * kjs/array_instance.h: Added a definition of an enum for the types of consistency
+        check and a declaration of the consistency checking function.
+
+2008-06-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Link against libedit on Mac since HAVE(READLINE) is defined there.
+
+        * jscore.bkl:
+
+2008-06-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16503
+        match limit takes at least 13% of the time on the SunSpider regexp-dna test
+
+        Make the limit test slightly more efficient. It is not clear how much of a win it is,
+        as the improvement on regexp-dna varies from 2.3% to 0.6% depending on what revision I
+        apply the patch to. Today, the win on regexp-dna was minimal, but the total win was whopping
+        0.5%, due to random code generation changes.
+
+        * pcre/pcre_exec.cpp: (match): Avoid loading a constant on each iteration.
+
+2008-06-09  Alp Toker  <alp@nuanti.com>
+
+        gcc3/autotools build fix. Add explicit -O2 -fno-strict-aliasing to
+        each of the tools since these are no longer set globally.
+
+        * GNUmakefile.am:
+
+2008-06-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam.
+
+        Add an include for readline/history.h to fix the build for Darwin users
+        with the GNU readline library installed. Also, clean up the style of
+        the HAVE(READLINE) check.
+
+        * kjs/testkjs.cpp:
+        (runInteractive):
+
+2008-06-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Bug 17531: Add interactive mode to testkjs
+        <https://bugs.webkit.org/show_bug.cgi?id=17531>
+
+        This is a cleaned up version of Sam's earlier patch to add an
+        interactive mode to testkjs.
+
+        Readline support is only enabled on Darwin platforms for now, but
+        other ports can enable it by defining HAVE_READLINE in kjs/config.h.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/config.h:
+        * kjs/testkjs.cpp:
+        (Options::Options):
+        (runWithScripts):
+        (runInteractive):
+        (printUsageStatement):
+        (parseArguments):
+        (kjsmain):
+
+2008-06-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Bug 19346: REGRESSION: Mootools 1.2 Class inheritance broken in post-SquirrelFish merge
+        <https://bugs.webkit.org/show_bug.cgi?id=19346>
+
+        A check for whether a function's caller is eval code accidentally included
+        the case where the caller's caller is native code. Add a CodeType field to
+        CodeBlock and use this for the eval caller test instead.
+
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::CodeBlock):
+        (KJS::ProgramCodeBlock::ProgramCodeBlock):
+        (KJS::EvalCodeBlock::EvalCodeBlock):
+        * VM/Machine.cpp:
+        (KJS::getCallerFunctionOffset):
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNode::generateCode):
+        (KJS::ProgramNode::generateCode):
+
+2008-06-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 17928: testkjs shouldn't require "-f"
+        <https://bugs.webkit.org/show_bug.cgi?id=17928>
+
+        * kjs/testkjs.cpp:
+        (printUsageStatement):
+        (parseArguments):
+
+2008-06-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Eric.
+
+        Bug 17548: JavaScriptCore print(a, b) differs from Spidermonkey Behavior
+        <https://bugs.webkit.org/show_bug.cgi?id=17548>
+
+        * kjs/testkjs.cpp:
+        (functionPrint):
+
+2008-06-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam.
+
+        Bug 17547: JavaScriptCore print() differs from Spidermonkey Behavior
+        <https://bugs.webkit.org/show_bug.cgi?id=17547>
+
+        * kjs/testkjs.cpp:
+        (functionPrint):
+
+2008-06-07  Alexey Proskuryakov  <ap@webkit.org>
+
+        More build fixes.
+
+        * kjs/JSGlobalData.cpp: Fixed an included file name for case-sensitive file systems, fixed
+        JSGlobalData::threadInstance() for non-multithreaded builds.
+
+2008-06-07  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix - actually adding JSGlobalData.cpp to non-Mac builds!
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+
+2008-06-07  Alexey Proskuryakov  <ap@webkit.org>
+
+        Try to fix Gtk/gcc 4.3 build.
+
+        * kjs/JSGlobalData.h: Include ustring.h instead of forward-declaring UString::Rep.
+
+2008-06-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Combine per-thread objects into one, to make it easier to support legacy clients (for
+        which they shouldn't be really per-thread).
+
+        No change on SunSpider total.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added JSGlobalData.{h,cpp}
+
+        * kjs/JSGlobalData.cpp: Added.
+        (KJS::JSGlobalData::JSGlobalData):
+        (KJS::JSGlobalData::~JSGlobalData):
+        (KJS::JSGlobalData::threadInstance):
+        * kjs/JSGlobalData.h: Added.
+        This class encapsulates all data that should be per-thread (or shared between legacy clients).
+        It will also keep a Heap pointer, but right now, Heap (Collector) methods are all static.
+
+        * kjs/identifier.h:
+        (KJS::Identifier::Identifier):
+        Added a constructor explicitly taking JSGlobalData to access IdentifierTable. Actually,
+        all of them should, but this will be a separate patch.
+
+        * kjs/identifier.cpp:
+        (KJS::IdentifierTable::literalTable):
+        (KJS::createIdentifierTable):
+        (KJS::deleteIdentifierTable):
+        (KJS::Identifier::add):
+        (KJS::Identifier::addSlowCase):
+        Combined IdentifierTable and LiteralIdentifierTable into a single class for simplicity.
+
+        * kjs/grammar.y: kjsyyparse now takes JSGlobalData, not just a Lexer.
+
+        * kjs/nodes.cpp:
+        (KJS::Node::Node):
+        (KJS::EvalFunctionCallNode::emitCode):
+        (KJS::ScopeNode::ScopeNode):
+        Changed to access Lexer and Parser via JSGlobalData::threadInstance(). This is also a
+        temporary measure, they will need to use JSGlobalData explicitly.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::callEval):
+        * kjs/CommonIdentifiers.cpp:
+        (KJS::CommonIdentifiers::CommonIdentifiers):
+        * kjs/CommonIdentifiers.h:
+        * kjs/DebuggerCallFrame.cpp:
+        (KJS::DebuggerCallFrame::evaluate):
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        * kjs/ExecState.h:
+        (KJS::ExecState::globalData):
+        (KJS::ExecState::identifierTable):
+        (KJS::ExecState::propertyNames):
+        (KJS::ExecState::emptyList):
+        (KJS::ExecState::lexer):
+        (KJS::ExecState::parser):
+        (KJS::ExecState::arrayTable):
+        (KJS::ExecState::dateTable):
+        (KJS::ExecState::mathTable):
+        (KJS::ExecState::numberTable):
+        (KJS::ExecState::RegExpImpTable):
+        (KJS::ExecState::RegExpObjectImpTable):
+        (KJS::ExecState::stringTable):
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreadingOnce):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::init):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (KJS::JSGlobalObject::head):
+        (KJS::JSGlobalObject::globalData):
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse):
+        * kjs/Parser.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::getParameterName):
+        (KJS::IndexToNameMap::unMap):
+        (KJS::globalFuncEval):
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::checkSyntax):
+        (KJS::Interpreter::evaluate):
+        * kjs/lexer.cpp:
+        (kjsyylex):
+        * kjs/lexer.h:
+        * kjs/testkjs.cpp:
+        (prettyPrintScript):
+        Updated for the above changes. Most of threadInstance uses here will need to be replaced with
+        explicitly passed pointers to support legacy JSC clients.
+
+        * JavaScriptCore.exp: Removed KJS::parser().
+
+2008-06-06  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 19424: Add support for logging opcode pair counts
+        <https://bugs.webkit.org/show_bug.cgi?id=19424>
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.cpp:
+        (KJS::OpcodeStats::OpcodeStats):
+        (KJS::compareOpcodeIndices):
+        (KJS::compareOpcodePairIndices):
+        (KJS::OpcodeStats::~OpcodeStats):
+        (KJS::OpcodeStats::recordInstruction):
+        (KJS::OpcodeStats::resetLastInstruction):
+        * VM/Opcode.h:
+
+2008-06-06  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam.
+
+        <rdar://problem/5969992> JSProfiler: Remove the recursion limit in the
+        profiler.
+        - Change the remaining functions that do not take arguments, from using
+        recursion to using iteration.
+
+        * JavaScriptCore.exp:
+        * profiler/Profile.cpp:
+        (KJS::stopProfiling):
+        (KJS::restoreAll):
+        (KJS::Profile::stopProfiling): Use foreach instead of recursion.
+        (KJS::Profile::restoreAll): Ditto.
+        * profiler/Profile.h:
+        * profiler/ProfileNode.cpp: Remove recursion.
+        (KJS::ProfileNode::stopProfiling):
+        (KJS::ProfileNode::restore):
+        * profiler/ProfileNode.h:
+
+2008-06-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey.
+
+        Fix Greater and GreaterEq nodes to emit code for the left
+        and right sub-expressions in the correct order.
+
+        * kjs/nodes.cpp:
+        (KJS::GreaterNode::emitCode):
+        (KJS::GreaterEqNode::emitCode):
+
+2008-06-05  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Alp Toker.
+        
+        Fix whitespaces.
+
+        * kjs/collector.cpp:
+        (KJS::getPlatformThreadRegisters):
+
+2008-06-05  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin.
+        
+        Support compiling JavaScriptCore for ARM.
+
+        * kjs/collector.cpp:
+        (KJS::getPlatformThreadRegisters):
+        (KJS::otherThreadStackPointer):
+
+2008-06-05  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Jon.
+
+        - Name changes.
+
+        * JavaScriptCore.exp:
+        * profiler/Profile.cpp:
+        (KJS::Profile::Profile):
+        (KJS::Profile::stopProfiling):
+        (KJS::Profile::didExecute):
+        (KJS::Profile::forEach):
+        (KJS::Profile::debugPrintData):
+        (KJS::Profile::debugPrintDataSampleStyle):
+        * profiler/Profile.h:
+        (KJS::Profile::callTree):
+        (KJS::Profile::totalTime):
+        (KJS::Profile::sortTotalTimeDescending):
+        (KJS::Profile::sortTotalTimeAscending):
+        (KJS::Profile::sortSelfTimeDescending):
+        (KJS::Profile::sortSelfTimeAscending):
+        (KJS::Profile::sortCallsDescending):
+        (KJS::Profile::sortCallsAscending):
+        (KJS::Profile::sortFunctionNameDescending):
+        (KJS::Profile::sortFunctionNameAscending):
+        (KJS::Profile::focus):
+        (KJS::Profile::exclude):
+        (KJS::Profile::restoreAll):
+
+2008-06-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Added the -fno-move-loop-invariants flag to the pcre_exec.cpp build, to
+        tell GCC not to perform loop invariant motion, since GCC's loop
+        invariant motion doesn't do very well with computed goto code.
+        
+        SunSpider reports no change.
+
+2008-06-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis.
+        
+        Added the -fno-tree-pre flag to the Machine.cpp build, to tell GCC not
+        to perform Partial Redundancy Elimination (PRE) on trees in Machine.cpp,
+        since GCC's PRE doesn't do very well with computed goto code.
+        
+        SunSpider reports a .7% speedup.
+        
+2008-06-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis (or maybe the other way around).
+        
+        Minor change to PCRE to help out certain compilers.
+        
+        SunSpider reports no change, maybe a small speedup.
+
+        * pcre/pcre_exec.cpp:
+        (match): Use instructionPtr++ a little less, to avoid confusing the
+        optimizer.
+
+2008-06-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Re-landing an independent part of a previously rolled out threading patch.
+
+        * wtf/ThreadSpecific.h: Make sure to initialize POD thread-specific varaibles, too
+        (replaced "new T" with "new T()").
+
+2008-06-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Hyatt.
+        
+        - force inlining of a template function that only has one call site per specialization
+        1.3% speedup on SunSpider
+
+        * kjs/collector.cpp:
+        (KJS::Collector::heapAllocate): This template function is only
+        called from allocate() and allocateNumber() (once per
+        specialization) and the extra call overhead for GC allocation
+        shows up, so force inlining.
+
+2008-06-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey and Oliver.
+        
+        - remove profiler fetch hack
+        I measure an 0.5% progression from this, others show a wash. It seems not needed any more.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-06-05  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 19400: subscript operator does not protect base when necessary
+        <https://bugs.webkit.org/show_bug.cgi?id=19400>
+
+        Use a temporary for the base in BracketAccessorNode if the subscript
+        might possibly modify it.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::BracketAccessorNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::BracketAccessorNode::):
+
+2008-06-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Big cleanup of formatting and whitespace.
+
+2008-06-04  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Add an option to dump statistics on executed instructions.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.cpp:
+        (KJS::OpcodeStats::~OpcodeStats):
+        (KJS::OpcodeStats::recordInstruction):
+        * VM/Opcode.h:
+
+2008-06-04  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/5969992> JSProfiler: Remove the recursion limit in the
+        profiler.
+        - This patch removes the use of recursion for the sort functions.
+
+        * JavaScriptCore.exp: Change the signatures of the functions being
+        exported.
+        * profiler/Profile.cpp:
+        (KJS::Profile::sort): This generic function will accept any of the
+        static sort functions and apply them to the whole tree.
+        * profiler/Profile.h: All of the sorting functions now call the new
+        sort() function.
+        (KJS::Profile::sortTotalTimeDescending):
+        (KJS::Profile::sortTotalTimeAscending):
+        (KJS::Profile::sortSelfTimeDescending):
+        (KJS::Profile::sortSelfTimeAscending):
+        (KJS::Profile::sortCallsDescending):
+        (KJS::Profile::sortCallsAscending):
+        (KJS::Profile::sortFunctionNameDescending):
+        (KJS::Profile::sortFunctionNameAscending):
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::ProfileNode): m_head used to point to the head node
+        if this was the head node.  It now points to null to make iteration easy
+        (KJS::ProfileNode::willExecute): Now must check if m_head is null, this
+        check used to happend in the constructor.
+        (KJS::ProfileNode::stopProfiling): Again the check is slightly different
+        to determine if this is the head.
+        (KJS::ProfileNode::traverseNextNode): This function returns the next
+        node in post order.
+        (KJS::ProfileNode::sort): This generic function will sort according to
+        the comparator passed in, then reset the children pointers to macth the
+        new order.
+        * profiler/ProfileNode.h: The sorting function were removed from the
+        definition file and instead use the new generic sort() function
+        (KJS::ProfileNode::totalPercent): because the head can now be empty we
+        need to check here too for the head node.
+        (KJS::ProfileNode::selfPercent): Ditto
+        (KJS::ProfileNode::firstChild): This function is necessary for the 
+        iterative algorithm in Profile.cpp.
+        (KJS::ProfileNode::sortTotalTimeDescending):
+        (KJS::ProfileNode::sortTotalTimeAscending):
+        (KJS::ProfileNode::sortSelfTimeDescending):
+        (KJS::ProfileNode::sortSelfTimeAscending):
+        (KJS::ProfileNode::sortCallsDescending):
+        (KJS::ProfileNode::sortCallsAscending):
+        (KJS::ProfileNode::sortFunctionNameDescending):
+        (KJS::ProfileNode::sortFunctionNameAscending):
+        (KJS::ProfileNode::childrenBegin):
+        (KJS::ProfileNode::childrenEnd):
+        (KJS::ProfileNode::totalTimeDescendingComparator):
+        (KJS::ProfileNode::totalTimeAscendingComparator):
+        (KJS::ProfileNode::selfTimeDescendingComparator):
+        (KJS::ProfileNode::selfTimeAscendingComparator):
+        (KJS::ProfileNode::callsDescendingComparator):
+        (KJS::ProfileNode::callsAscendingComparator):
+        (KJS::ProfileNode::functionNameDescendingComparator):
+        (KJS::ProfileNode::functionNameAscendingComparator):
+
+2008-06-04  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Fix JSClassCreate to work with old JSCore API threading model.
+
+        No change on SunSpider.
+
+        * API/JSClassRef.cpp: (OpaqueJSClass::OpaqueJSClass): Since JSClass is constructed without
+        a context, there is no way for it to create Identifiers.
+        Also, added initializeThreading(), just for good measure.
+
+        * API/JSCallbackObjectFunctions.h: (KJS::::getPropertyNames): Make an Identifier out of the
+        string here, because propertyNames.add() needs that.
+
+        * kjs/identifier.cpp:
+        * kjs/identifier.h:
+        (KJS::Identifier::equal):
+        * kjs/ustring.cpp:
+        (KJS::equal):
+        Moved equal() from identifier.h to ustring.h, because it's not really about Identifiers,
+        and to make it possible to use it from StrHash.
+        Include StrHash.h from ustring.h to avoid having the behavior depend on headers that happen
+        to be included.
+
+        * wtf/StrHash.h: Removed.
+        * kjs/ustring.h: Made RefPtr<UString::Rep> use the same default hash as UString::Rep* (it
+        used to default to pointer equality). Moved the whole StrHash header into ustring.h.
+
+        * JavaScriptCore.exp: Export equal() for WebCore use (this StrHash is used in c_class.cpp,
+        jni_class.cpp, and npruntime.cpp).
+
+2008-06-04  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin.
+
+        Fix spacing in collector.{h,cpp}.
+
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+
+2008-06-03  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Build fix. The cleanup in r34355 missed a method.
+
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+
+2008-06-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19269
+          speed up SunSpider by eliminating the toObject call for most get/put/delete
+
+        Makes standalone SunSpider 1.025x as fast as before.
+
+        The getOwnPropertySlot virtual function now takes care of the toObject call
+        for get. Similarly, the put function (and later deleteProperty) does the
+        same for those operations. To do this, the virtual functions were moved from
+        the JSObject class to the JSCell class. Also, since the caller no longer knows
+        the identity of the "original object", which is used by JavaScript-function
+        based getters, changed the PropertySlot class so the original object is
+        already stored in the slot when getOwnPropertySlot is called, if the caller
+        intends to call getValue.
+
+        This affected the old interpreter code enough that the easiest thing for me
+        was to just delete it. While I am not certain the mysterious slowdown is not
+        still occurring, the net change is definitely a significant speedup.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/Machine.cpp: Moved the UNLIKELY macro into AlwaysInline.h.
+        (KJS::resolve): Set up the originalObject in the PropertySlot before
+        calling getPropertySlot. Also removed the originalObject argument from
+        getValue.
+        (KJS::resolve_skip): Ditto.
+        (KJS::resolveBaseAndProperty): Ditto.
+        (KJS::resolveBaseAndFunc): Ditto.
+        (KJS::Machine::privateExecute): Removed the toObject calls from the get and
+        put functions where possible, instead calling directly with JSValue and letting
+        the JSValue and JSCell calls handle toObject. Same for toThisObject.
+
+        * kjs/ExecState.h: Removed OldInterpreterExecState.
+
+        * API/JSBase.cpp: Updated includes.
+
+        * kjs/LocalStorageEntry.h: Removed contents. Later we can remove the file too.
+
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::lengthGetter): Removed originalObject argumet.
+        (KJS::ArrayInstance::inlineGetOwnPropertySlot): Don't pass a base value to
+        setValueSlot. Also use UNLIKELY around the "getting elements past the end of
+        the array" code path; less common than successfully getting an element.
+
+        * kjs/array_object.cpp:
+        (KJS::getProperty): Initialize the PropertySlot with the original object.
+        Don't pass the original object to the get function.
+        (KJS::arrayProtoFuncFilter): Ditto.
+        (KJS::arrayProtoFuncMap): Ditto.
+        (KJS::arrayProtoFuncEvery): Ditto.
+        (KJS::arrayProtoFuncForEach): Ditto.
+        (KJS::arrayProtoFuncSome): Ditto.
+
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct): Removed an obsolete comment.
+
+        * kjs/grammar.y: Eliminated support for some of the node types that were
+        used to optimize executing from the syntax tree.
+
+        * kjs/internal.cpp:
+        (KJS::StringImp::toThisObject): Added. Same as toObject.
+        (KJS::NumberImp::toThisObject): Ditto.
+        (KJS::GetterSetterImp::getOwnPropertySlot): Added. Not reached.
+        (KJS::GetterSetterImp::put): Ditto.
+        (KJS::GetterSetterImp::toThisObject): Ditto.
+
+        * kjs/internal.h: Added toThisObject to NumberImp for speed.
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::shift): Changed shift to just do a single character, to unroll
+        the loop and especially to make the one character case faster.
+        (KJS::Lexer::setCode): Call shift multiple times instead of passing a number.
+        (KJS::Lexer::lex): Ditto.
+        (KJS::Lexer::matchPunctuator): Ditto. Also removed unneeded elses after returns.
+        (KJS::Lexer::scanRegExp): Ditto.
+        * kjs/lexer.h: Removed the count argument from shift.
+
+        * kjs/math_object.cpp:
+        (KJS::mathProtoFuncPow): Call jsNaN instead of jsNumber(NaN).
+
+        * kjs/nodes.cpp: Removed some of the things needed only for the pre-SquirrelFish
+        execution model.
+        (KJS::ForNode::emitCode): Handle cases where some expressions are missing by
+        not emitting any code at all. The old way was to emit code for "true", but
+        this is an unnecessary remnant of the old way of doing things.
+
+        * kjs/nodes.h: Removed some of the things needed only for the pre-SquirrelFish
+        execution model.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::fillGetterPropertySlot): Changed to only pass in the getter
+        function. The old code passed in a base, but it was never used when
+        actually getting the property; the toThisObject call was pointless. Also
+        changed to not pass a base for setUndefined.
+
+        * kjs/object.h: Added the new JSCell operations to GetterSetterImp.
+        Never called.
+        (KJS::JSObject::get): Initialize the object in the PropertySlot and don't
+        pass it in getValue.
+        (KJS::JSObject::getOwnPropertySlotForWrite): Removed the base argument
+        in calls to setValueSlot.
+        (KJS::JSObject::getOwnPropertySlot): Ditto.
+        (KJS::JSValue::get): Added. Here because it calls through to JSObject.
+        A version of JSObject::get that also handles the other types of JSValue
+        by creating the appropriate wrapper. Saves the virtual call to toObject.
+        (KJS::JSValue::put): Ditto.
+        (KJS::JSValue::deleteProperty): Ditto.
+
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::undefinedGetter): Removed the originalObject argument.
+        (KJS::PropertySlot::ungettableGetter): Ditto.
+        (KJS::PropertySlot::functionGetter): Ditto. Use the value in the base
+        as the "this" object, which will be set to the original object by the new
+        PropertySlot initialization code. Also call toThisObject. The old code did
+        not do this, but needed to so we can properly handle the activation object
+        like the other similar code paths.
+
+        * kjs/property_slot.h:
+        (KJS::PropertySlot::PropertySlot): Added a constructor that takes a base
+        object. In debug builds, set the base to 0 if you don't pass one.
+        (KJS::PropertySlot::getValue): Don't take or pass the originalObject.
+        (KJS::PropertySlot::setValueSlot): Don't take a base object, and clear the
+        base object in debug builds.
+        (KJS::PropertySlot::setGetterSlot): Ditto.
+        (KJS::PropertySlot::setUndefined): Ditto.
+        (KJS::PropertySlot::setUngettable): Ditto.
+        (KJS::PropertySlot::slotBase): Assert that a base object is present.
+        This will fire if someone actually calls the get function without having
+        passed in a base object and the getter needs it.
+        (KJS::PropertySlot::setBase): Added. Used by the code that implements
+        toObject so it can supply the original object after the fact.
+        (KJS::PropertySlot::clearBase): Added. Clears the base, but is debug-only
+        code because it's an error to fetch the base if you don't have a guarantee
+        it was set.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::JSCallbackObject::cachedValueGetter):
+        (KJS::JSCallbackObject::staticValueGetter):
+        (KJS::JSCallbackObject::staticFunctionGetter):
+        (KJS::JSCallbackObject::callbackGetter):
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::getOwnPropertySlot):
+        (KJS::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableGet):
+        * kjs/array_instance.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::FunctionImp::callerGetter):
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::Arguments::mappedIndexGetter):
+        * kjs/function.h:
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter):
+        (KJS::staticValueGetter):
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::lengthGetter):
+        (KJS::StringInstance::indexGetter):
+        (KJS::stringInstanceNumericPropertyGetter):
+        * kjs/string_object.h:
+        Removed originalObject arguments from getters. Don't pass base values to
+        the various PropertySlot functions that no longer take them.
+
+        * kjs/value.cpp:
+        (KJS::JSCell::getOwnPropertySlot): Added. Calls toObject and then sets the slot.
+        This function has to always return true, because the caller can't walk the prototype
+        chain. Because of that, we do a getPropertySlot, not getOwnPropertySlot, which works
+        for the caller. This is private, only called by getOwnPropertySlotInternal.
+        (KJS::JSCell::put): Added. Calls toObject and then put.
+        (KJS::JSCell::toThisObject): Added. Calls toObject.
+
+        * kjs/value.h: Added get, put, and toThisObject to both JSValue
+        and JSCell. These take care of the toObject operation without an additional virtual
+        function call, and so make the common "already an object" case faster.
+
+        * wtf/AlwaysInline.h: Moved the UNLIKELY macro here for now. Maybe we can find a
+        better place later, or rename this header.
+
+2008-06-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Tim.
+
+        Bug 12983: Web Inspector break on the debugger keyword
+        <https://bugs.webkit.org/show_bug.cgi?id=12983>
+
+        Added a DebuggerStatementNode to handle codegen, and added a new
+        DidReachBreakPoint debug event (which will hopefully be useful
+        if we ever move breakpoint management into JSC proper).  Also
+        added didReachBreakpoint to Debugger to allow us to actually respond
+        to this event.
+
+        * VM/CodeBlock.cpp:
+        (KJS::debugHookName):
+        * VM/Machine.cpp:
+        (KJS::Machine::debug):
+        * VM/Machine.h:
+        * kjs/debugger.h:
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::DebuggerStatementNode::emitCode):
+        (KJS::DebuggerStatementNode::execute):
+        * kjs/nodes.h:
+        (KJS::DebuggerStatementNode::):
+        * kjs/nodes2string.cpp:
+        (KJS::DebuggerStatementNode::streamTo):
+
+2008-06-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - document remaining opcodes.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Document call, call_eval,
+        construct, ret and end opcodes.
+
+2008-06-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Document throw and catch opcodes.
+
+2008-06-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Removed JSObject::call, since it just called JSObject::callAsFunction.
+
+        SunSpider reports no change.
+
+2008-06-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        A little cleanup in the CodeGenerator.
+
+        * VM/CodeGenerator.cpp: A few changes here.
+
+        (1) Removed remaining cases of the old hack of putting "this" into the
+        symbol table; replaced with explicit tracking of m_thisRegister.
+
+        (2) Made m_thisRegister behave the same for function, eval, and program
+        code, removing the static programCodeThis() function.
+
+        (3) Added a feature to nix a ScopeNode's declaration stacks when done
+        compiling, to save memory.
+
+        (4) Removed code that copied eval declarations into special vectors: we
+        just use the originals in the ScopeNode now.
+        
+        * VM/CodeGenerator.h: Removed unneded parameters from the CodeGenerator
+        constructor: we just use get that data from the ScopeNode now.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute): When executing an eval node, don't iterate a
+        special copy of its declarations; iterate the originals, instead.
+
+        * kjs/nodes.cpp: Moved responsibility for knowing what AST data to throw
+        away into the CodeGenerator. Nodes no longer call shrinkCapacity on
+        their data directly.
+        
+        * kjs/nodes.h: Changed FunctionStack to ref its contents, so declaration
+        data stays around even after we've thrown away the AST, unless we explicitly
+        throw away the declaration data, too. This is useful for eval code, which
+        needs to reference its declaration data at execution time. (Soon, it will
+        be useful for program code, too, since program code should do the same.)
+
+2008-06-02  Adam Roben  <aroben@apple.com>
+
+        Build fix for non-AllInOne builds
+
+        * kjs/array_object.cpp: Added a missing #include.
+
+2008-06-02  Kevin McCullough  <kmccullough@apple.com>
+
+        Took out accidental confilct lines I checked in.
+
+        * ChangeLog:
+
+2008-06-02  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5969992> JSProfiler: Remove the recursion limit in the
+        profiler
+        Implement Next Sibling pointers as groundwork for removing the recursion
+        limit in the profiler.
+
+        * profiler/ProfileNode.cpp: Also I renamed parentNode and headNode since
+        'node' is redundant.
+        (KJS::ProfileNode::ProfileNode): Initialize the nextSibling.
+        (KJS::ProfileNode::willExecute): If there are already children then the
+        new child needs to be the nextSibling of the last child.
+        (KJS::ProfileNode::didExecute):
+        (KJS::ProfileNode::addChild): Ditto.
+        (KJS::ProfileNode::stopProfiling):
+        (KJS::ProfileNode::sortTotalTimeDescending): For all of the sorting
+        algorithms once the children are sorted their nextSibling pointers need
+        to be reset to reflect the new order.
+        (KJS::ProfileNode::sortTotalTimeAscending):
+        (KJS::ProfileNode::sortSelfTimeDescending):
+        (KJS::ProfileNode::sortSelfTimeAscending):
+        (KJS::ProfileNode::sortCallsDescending):
+        (KJS::ProfileNode::sortCallsAscending):
+        (KJS::ProfileNode::sortFunctionNameDescending):
+        (KJS::ProfileNode::sortFunctionNameAscending):
+        (KJS::ProfileNode::resetChildrensSiblings): This new function simply
+        loops over all of the children and sets their nextSibling pointers to
+        the next child in the Vector
+        (KJS::ProfileNode::debugPrintData):
+        * profiler/ProfileNode.h:
+        (KJS::ProfileNode::parent):
+        (KJS::ProfileNode::setParent):
+        (KJS::ProfileNode::nextSibling):
+        (KJS::ProfileNode::setNextSibling):
+        (KJS::ProfileNode::totalPercent):
+        (KJS::ProfileNode::selfPercent):
+
+2008-06-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Removed the recursion limit from JSObject::call, since the VM does
+        recursion checking now.
+
+        This should allow us to remove JSObject::call entirely, netting a small
+        speedup.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::call):
+
+2008-06-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Added a specific affordance for avoiding stack overflow when converting
+        recursive arrays to string, in preparation for removing generic stack
+        overflow checking from JSObject::call.
+        
+        Tested by fast/js/toString-stack-overflow.html.
+
+2008-06-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alice Liu.
+        
+        Refactored some hand-rolled code to call ScopeChain::globalObject instead.
+
+2008-06-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed ASSERT due to execution continuing after an exception is thrown
+        during array sort.
+
+        * kjs/array_instance.cpp:
+        (KJS::AVLTreeAbstractorForArrayCompare::compare_key_key): Don't call the
+        custom comparator function if an exception has been thrown. Just return
+        1 for everything, so the sort completes quickly. (The result will be
+        thrown away.)
+
+2008-05-30  Timothy Hatcher  <timothy@apple.com>
+
+        Made the starting line number of scripts be 1-based throughout the engine.
+        This cleans up script line numbers so they are all consistent now and fixes
+        some cases where script execution was shown as off by one line in the debugger.
+
+        No change in SunSpider.
+
+        Reviewed by Oliver Hunt.
+
+        * API/minidom.c:
+        (main): Pass a line number of 1 instead of 0 to parser().parse().
+        * API/testapi.c:
+        (main): Ditto. And removes a FIXME and changed an assertEqualsAsNumber
+        to use 1 instead of 2 for the line number.
+        * VM/Machine.cpp:
+        (KJS::callEval): Pass a line number of 1 instead of 0.
+        (KJS::Machine::debug): Use firstLine for WillExecuteProgram instead of
+        lastLine. Use lastLine for DidExecuteProgram instead of firstLine.
+        * kjs/DebuggerCallFrame.cpp:
+        (KJS::DebuggerCallFrame::evaluate): Pass a line number of 1 instead of
+        0 to parser().parse().
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse): ASSERT startingLineNumber is greatter than 0. Change
+        the startingLineNumber to be 1 if it was less than or equal to 0. This is needed
+        for release builds to maintain compatibility with the JavaScriptCore API.
+        * kjs/function.cpp:
+        (KJS::globalFuncEval): Pass a line number of 1 instead of 0 to parser().parse().
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct): Pass a line number of 1 instead of 0 to construct().
+        * kjs/lexer.cpp:
+        (Lexer::setCode): Made yylineno = startingLineNumber instead of adding 1.
+        * kjs/testkjs.cpp:
+        (functionRun): Pass a line number of 1 instead of 0 to Interpreter::evaluate().
+        (functionLoad): Ditto.
+        (prettyPrintScript): Ditto.
+        (runWithScripts): Ditto.
+        * profiler/Profiler.cpp:
+        (WebCore::createCallIdentifier): Removed a plus 1 of startingLineNumber.
+
+2008-05-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19180
+        speed up SunSpider by optimizing immediate number cases
+
+        Also fixed a JavaScriptCore regression seen on PowerPC - we didn't clip left shift
+        parameter to 0...31.
+
+        0.5% improvement on SunSpider overall, although a 8.5 regression on bitops-3bit-bits-in-byte.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::toTruncatedUInt32): Added. Same as getTruncatedInt32, but casts the result
+        to unsigned.
+
+2008-05-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19180
+        speed up SunSpider by optimizing immediate number cases
+
+        Also fixed two JavaScriptCore regressions seen on PowerPC - we didn't clip right shift
+        parameter to 0...31.
+
+        1.6% improvement on SunSpider, without significant regressions on any tests.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        Added fast paths for >>, ==, ===, !=, !==. Changed order of memory accesses in many
+        cases, making them less dependent on gcc's ability to properly assign registers. With this,
+        I could move exception checks back into slow code paths, and saw less randomness in general.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::rightShiftImmediateNumbers):
+        Added.
+
+2008-05-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+
+        - fixed <rdar://problem/5972943> REGRESSION(r33979): Flash clips do not play on cnn.com
+        
+        Finally blocks could clobber registers that had to remain live
+        until they returned. This patch takes a conservative approach and
+        makes sure that finally blocks do not reuse any registers that
+        were previously allocated for the function. In the future this
+        could probably be tightened up to be less profligate with the
+        register allocation.
+        
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::highestUsedRegister):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::TryNode::emitCode):
+
+2008-05-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * kjs/array_instance.cpp:
+
+2008-05-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19294
+        <rdar://problem/5969062> A crash when iterating over a sparse array backwards.
+
+        * kjs/array_instance.cpp: Turned sparseArrayCutoff into a macro, so that using max() on it
+        doesn't cause a PIC branch.
+        (KJS::ArrayInstance::increaseVectorLength): Added a comment about this function not
+        preserving class invariants.
+        (KJS::ArrayInstance::put): Update m_storage after reallocation. Move values that fit to
+        the vector from the map in all code paths.
+
+2008-05-29  Thiago Macieira  <tjmaciei@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation in Solaris with Sun CC
+
+        Lots of WebKit code uses C99 functions that, strict as it
+        is, the Solaris system doesn't provide in C++. So we must define them
+        for both GCC and the Sun CC.
+
+        * wtf/MathExtras.h:
+
+2008-05-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders.
+
+        Fix codegen for assignment being used as a function.
+
+        FunctionCallValueNode::emitCode failed to account for the
+        potential of the function expression to allocate arbitrary
+        registers.
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallValueNode::emitCode):
+
+2008-05-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=19183
+        REGRESSION (r33979): Crash in DebuggerCallFrame::functionName when
+        clicking button in returnEvent-crash.html
+
+        Added two new debugger hooks, willExecuteProgram and didExecuteProgram,
+        along with code to generate them, code to invoke them when unwinding
+        due to an exception, and code to dump them.
+        
+        SunSpider reports no change.
+
+        * VM/CodeBlock.cpp:
+        (KJS::debugHookName): I had to mark this function NEVER_INLINE to avoid
+        a .4% performance regression. The mind boggles.
+
+2008-05-28  Adam Roben  <aroben@apple.com>
+
+        Fix JavaScriptCore tests on OS X
+
+        We were quoting the path to testkjs too late, after it had already
+        been combined with spaces and other options.
+
+        * tests/mozilla/jsDriver.pl:
+        (top level): Move path quoting from here...
+        (sub get_kjs_engine_command): ...to here.
+
+2008-05-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver.
+
+        <rdar://problem/5968071> "const f" crashes in JavaScriptCore
+        
+        Make sure to null check the initializer.
+        
+        * kjs/nodes.cpp:
+        (KJS::ConstDeclNode::emitCodeSingle):
+
+2008-05-28  Adam Roben  <aroben@apple.com>
+
+        Make run-javascriptcore-tests work with a space in the path to testkjs
+
+        Reviewed by Alexey Proskuryakov.
+
+        * tests/mozilla/jsDriver.pl: Quote the path to the engine so that
+        spaces will be interpreted correctly.
+
+2008-05-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Fixed a misguiding comment - my measurement for negative numbers only included cases
+        where both operands were negative, which is not very interesting.
+
+        * VM/Machine.cpp:
+
+2008-05-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        Based on a patch by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19180
+        speed up SunSpider by optimizing immediate number cases
+
+        1.4% speedup on SunSpider.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::incImmediateNumber):
+        (KJS::JSImmediate::decImmediateNumber):
+        Added fast paths for ++ and --.
+
+        (KJS::JSImmediate::canDoFastAdditiveOperations): Corrected a comment.
+
+2008-05-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19180
+        speed up SunSpider by optimizing immediate number cases
+
+        2% speedup overall, maximum 10% on controlflow-recursive and bitops-3bit-bits-in-byte,
+        but a 4% regression on bitops-bits-in-byte and bitops-bitwise-and.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::canDoFastAdditiveOperations):
+        (KJS::JSImmediate::addImmediateNumbers):
+        (KJS::JSImmediate::subImmediateNumbers):
+        Added fast cases that work with positive values less than 2^30.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Use the above operations. Also updated SunSpider frequencies
+        with my results (looks like tag values have changed, not sure what caused the minor variation
+        in actual frequencies).
+
+2008-05-27  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Remove code that appended Cygwin's /bin directory to PATH.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        Prepend Cygwin's /bin directory to PATH. We prepend instead of append
+        so that Cygwin's utilities will win out over Win32 versions of the
+        same utilities (particularly perl). We do the prepend here instead of
+        in the Makefile because nmake doesn't seem to like prepending to PATH
+        inside the Makefile. This also matches the way WebCoreGenerated works.
+
+2008-05-27  Adam Roben  <aroben@apple.com>
+
+        Roll out r34163
+
+        A better fix is on the way.
+
+        * DerivedSources.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+
+2008-05-27  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * DerivedSources.make: Don't generate the bytecode docs if
+        OMIT_BYTECODE_DOCS is set to 1.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Set
+        OMIT_BYTECODE_DOCS for production builds.
+
+2008-05-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff and Maciej.
+
+        <rdar://problem/5806428> 
+        https://bugs.webkit.org/show_bug.cgi?id=17925
+        Crash in KJS::JSObject::put after setting this.__proto__
+
+        Set slotIsWriteable to false for __proto__, we want setting __proto__ to go through JSObject::put instead.
+        
+        * kjs/object.h:
+        (KJS::JSObject::getOwnPropertySlotForWrite):
+
+2008-05-27  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes to catch up with SquirrelFish, etc.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+        * wtf/Platform.h:
+
+2008-05-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19180
+          speed up SunSpider by optimizing immediate number cases
+
+        Add immediate number cases for the &, |, and ^ operators.
+        Makes standalone SunSpider 1.010x faster.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Add areBothImmediateNumbers special cases
+        for the &, |, and ^ operators.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::xorImmediateNumbers): Added.
+        (KJS::JSImmediate::orImmediateNumbers): Added.
+
+2008-05-26  Stephanie Lewis  <slewis@apple.com>
+
+        Windows build fix. 
+
+        * kjs/testkjs.cpp:
+
+2008-05-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Anders.
+        
+        - make addStaticGlobals protected instead of private so subclasses can use it
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalObject.h:
+
+2008-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/5960859> After an eval of a non-string or a syntax
+        error, all profile stack frames are incorrect
+        
+        SunSpider reports a .3% speedup, possibly because eval of a string is a
+        little more efficient now.
+
+        * VM/Machine.cpp:
+        (KJS::callEval): Make sure to call didExecute when returning early. I
+        simplified this function to remove one early return, making the job
+        of adding special code to early returns easier.
+
+        (KJS::Machine::execute): Use the new function ExecState when notifying
+        the profiler. (This doesn't change behavior now, but it might prevent
+        subtle errors in the future.)
+
+2008-05-23  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fixed toLower and toUpper implementations to allow being called
+        with a null result pointer and resultLength, to determine the
+        number of characters needed for the case conversion.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+
+2008-05-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Fixing a typo in the previous commit made as a last minute change.
+
+        * kjs/regexp_object.cpp:
+
+2008-05-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Changed regular expression matching result array to be lazily filled, because many callers
+        only care about it being non-null.
+
+        2% improvement on Acid3 test 26.
+
+        * kjs/array_instance.cpp: Added a void* member to ArrayStorage for ArrayInstance subclasses
+        to use.
+        * kjs/array_instance.h:
+        (KJS::ArrayInstance::lazyCreationData):
+        (KJS::ArrayInstance::setLazyCreationData):
+        Added methods to access it from subclasses.
+
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpMatchesArray::RegExpMatchesArray):
+        (KJS::RegExpMatchesArray::getOwnPropertySlot):
+        (KJS::RegExpMatchesArray::put):
+        (KJS::RegExpMatchesArray::deleteProperty):
+        (KJS::RegExpMatchesArray::getPropertyNames):
+        (KJS::RegExpMatchesArray::fillArrayInstanceIfNeeded):
+        (KJS::RegExpMatchesArray::~RegExpMatchesArray):
+        (KJS::RegExpObjectImp::arrayOfMatches):
+        RegExpMatchesArray is a subclass of ArrayInstance that isn't filled until
+        accessed for the first time.
+
+2008-05-24  Alp Toker  <alp@nuanti.com>
+
+        Win32/gcc build fix. Remove MSVC assumption.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SlowLock):
+
+2008-05-24  Oleg Finkelshteyn <olegfink@gmail.com>
+
+        Rubber-stamped, tweaked and landed by Alexey.
+
+        Build fix for gcc 4.3.
+
+        * JavaScriptCore/kjs/testkjs.cpp:
+        * JavaScriptCore/VM/CodeBlock.cpp:
+        Add missing standard includes.
+
+2008-05-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/5959886> REGRESSION: Assertion failure in JSImmediate::toString when loading GMail (19217)
+        
+        Change List to store a JSValue*** pointer + an offset instead of a JSValue** pointer to protect against the case where 
+        a register file changes while a list object points to its buffer.
+        
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::createArgumentsObject):
+        * kjs/list.cpp:
+        (KJS::List::getSlice):
+        * kjs/list.h:
+        (KJS::List::List):
+        (KJS::List::at):
+        (KJS::List::append):
+        (KJS::List::begin):
+        (KJS::List::end):
+        (KJS::List::buffer):
+
+2008-05-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        <rdar://problem/5960012> JSProfiler: Stack overflow if recursion is
+        too deep.
+        -Use a simple depth limit to restrict too deep of recursion.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::willExecute):
+        (KJS::Profile::didExecute):
+        * profiler/Profile.h:
+
+2008-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolling back in r34085, with performance resolved.
+        
+        Apparently, passing the eval function to callEval gave GCC a hernia.
+
+        Reviewed by Darin Adler, Kevin McCullough, and Oliver Hunt.
+        
+        Fixed <rdar://problem/5959447> Crashes and incorrect reporting in the
+        JavaScript profiler
+
+        * VM/Machine.cpp:
+        (KJS::Machine::unwindCallFrame): Fixed incorrect reporting / a crash
+        when unwinding from inside eval and/or program code: detect the
+        difference, and do the right thing. Also, be sure to notify the profiler
+        *before* deref'ing the scope chain, since the profiler uses the scope chain.
+
+        (KJS::Machine::execute): Fixed incorrect reporting / crash when calling
+        a JS function re-entrently: Machine::execute(FunctionBodyNode*...)
+        should not invoke the didExecute hook, because op_ret already does that.
+        Also, use the new function's ExecState when calling out to the profiler.
+        (Not important now, but could have become a subtle bug later.)
+
+        (KJS::Machine::privateExecute): Fixed a hard to reproduce crash when
+        profiling JS functions: notify the profiler *before* deref'ing the scope
+        chain, since the profiler uses the scope chain.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::call): Removed these hooks, because they are now unnecessary.
+
+        * profiler/Profile.cpp: Added a comment to explain a subtlety that only
+        Kevin and I understood previously. (Now, the whole world can understand!)
+
+        * profiler/Profiler.cpp:
+        (KJS::shouldExcludeFunction): Don't exclude .call and .apply. That was
+        a hack to fix bugs that no longer exist.
+
+        Finally, sped things up a little bit by changing the "Is the profiler
+        running?" check into an ASSERT, since we only call into the profiler
+        when it's running:
+
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+
+2008-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fixed <rdar://problem/5957662> REGRESSION(r33943-r33980): Can't send email , attach file or save as draft from hotmail.com
+        
+        SunSpider reports no change.
+        
+        This is a reworking of r34073, which I rolled out because it caused
+        lots of crashes.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator): Use removeDirect to nix old
+        properties whose names collide with new functions. (Don't use putWithAttributes
+        because that tries to write to the register file, which hasn't grown to
+        fit this program yet.)
+
+2008-05-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        As allocateNumber is used via jsNumberCell outside of JavaScriptCore,
+        we need to provide a non-inlined version of it to avoid creating a
+        weak external symbol.
+
+        * JavaScriptCore.exp:
+        * kjs/AllInOneFile.cpp:
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+        (KJS::Collector::allocateNumber):
+        * kjs/collector.h:
+        (KJS::Collector::allocate):
+        (KJS::Collector::inlineAllocateNumber):
+        * kjs/value.h:
+        (KJS::NumberImp::operator new):
+
+2008-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out r34073 because it caused lots of layout test crashes.
+
+2008-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out r34085 because it measured as a 7.6% performance regression.
+
+2008-05-23  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add the
+        profiler directory to the include path.
+
+2008-05-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders.
+
+        SQUIRRELFISH: JavaScript error messages are missing informative text
+
+        Partial fix.
+        Tidy up error messages, makes a couple of them provide slightly more info.
+        Inexplicably leads to a 1% SunSpider Progression.
+
+        * VM/ExceptionHelpers.cpp:
+        (KJS::createError):
+        (KJS::createInvalidParamError):
+        (KJS::createNotAConstructorError):
+        (KJS::createNotAFunctionError):
+        * VM/ExceptionHelpers.h:
+        * VM/Machine.cpp:
+        (KJS::isNotObject):
+
+2008-05-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Tim H.
+
+        Fix call stack reported by profiler when entering event handlers.
+
+        JSObject::call was arbitrarily notifying the profiler when it was
+        called, even if it was JS code, which notifies the profile on entry
+        in any case.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::call):
+
+2008-05-16  Alp Toker  <alp@nuanti.com>
+
+        Build fix for gcc 3. Default constructor required in ExecState,
+        used by OldInterpreterExecState.
+
+        * kjs/ExecState.h:
+        (KJS::ExecState::ExecState):
+
+2008-05-23  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <rdar://problem/5954997> global-recursion-on-full-stack.html crashes under guardmalloc.
+
+        Growing the register file with uncheckedGrow from within Machine::execute is not safe as the
+        register file may be too close to its maximum size to grow successfully.  By using grow,
+        checking the result and throwing a stack overflow error we can avoid crashing.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/RegisterFile.h: Remove the now-unused uncheckedGrow.
+
+2008-05-23  Oliver Hunt  <oliver@apple.com>
+
+        RS=Kevin McCullough
+
+        Remove JAVASCRIPT_PROFILER define
+
+        * VM/Machine.cpp:
+        (KJS::callEval):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * kjs/config.h:
+        * kjs/object.cpp:
+        (KJS::JSObject::call):
+
+2008-05-23  Oliver Hunt  <oliver@apple.com>
+
+       <rdar://problem/5951561> Turn on JavaScript Profiler
+
+        Reviewed by Kevin McCullough.
+
+        Flipped the switch on the profiler, rearranged how we
+        signal the the profiler is active so that calls aren't
+        needed in the general case.
+        
+        Also fixed the entry point for Machine::execute(FunctionBodyNode..)
+        to correctly indicate function exit.
+
+        Results in a 0.7-1.0% regression in SunSpider :-(
+
+        * VM/Machine.cpp:
+        (KJS::callEval):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * kjs/config.h:
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::profiler):
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling):
+        * profiler/Profiler.h:
+        (KJS::Profiler::enabledProfilerReference):
+
+2008-05-23  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build by adding profiler/ to the include search path.
+
+        * JavaScriptCore.pri:
+
+2008-05-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam.
+
+        Fix a bug in the profiler where time in the current function is given to
+        (idle).
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::didExecute): Set the start time and then call didExecute
+        to calculate the time spent in this function.
+        * profiler/ProfileNode.cpp: Remove confusing calculations that are no
+        longer necessary.
+        (KJS::ProfileNode::insertNode):
+        * profiler/ProfileNode.h: Expose access to the start time to allow the
+        simpler time calculations above.
+        (KJS::ProfileNode::startTime):
+        (KJS::ProfileNode::setStartTime):
+
+2008-05-22  Adam Roben  <aroben@apple.com>
+
+        Show "(Function object)" instead of "(JSInpectorCallbackWrapper
+        object)" in profiles
+
+        Reviewed by Kevin McCullough.
+
+        * profiler/Profiler.cpp:
+        (KJS::createCallIdentifier): Use JSObject::className instead of
+        getting the class name from the ClassInfo directly. JSObject
+        subclasses can override className to provide a custom class name, and
+        it seems like we should honor that.
+
+2008-05-22  Timothy Hatcher  <timothy@apple.com>
+
+        Added Profile::restoreAll and added ProfileNode::restoreAll
+        to the export file.
+
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.exp:
+        * profiler/Profile.h:
+
+2008-05-22  Alp Toker  <alp@nuanti.com>
+
+        GTK+ build fix. Add JavaScriptCore/profiler to include path.
+
+        * GNUmakefile.am:
+
+2008-05-22  Adam Roben  <aroben@apple.com>
+
+        Implement sub-millisecond profiling on Windows
+
+        Reviewed by Kevin McCullough.
+
+        * profiler/ProfileNode.cpp:
+        (KJS::getCount): Added. On Windows, we use QueryPerformanceCounter. On
+        other platforms, we use getCurrentUTCTimeWithMicroseconds.
+        (KJS::ProfileNode::endAndRecordCall): Use getCount instead of
+        getCurrentUTCTimeWithMicroseconds.
+        (KJS::ProfileNode::startTimer): Ditto.
+
+2008-05-22  Adam Roben  <aroben@apple.com>
+
+        Fix a profiler assertion when calling a NodeList as a function
+
+        Reviewed by Kevin McCullough.
+
+        * profiler/Profiler.cpp:
+        (KJS::createCallIdentifier): Don't assert when a non-function object
+        is called as a function. Instead, build up a CallIdentifier using the
+        object's class name.
+
+2008-05-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5951529> JSProfiler: Allow the profiler to "Exclude" a
+        profile node.
+        -Implement 'exclude'; where the excluded node attributes its time to its
+        parent's self time.
+
+        * JavaScriptCore.exp: Export the exclude function.
+        * profiler/Profile.h: 
+        (KJS::Profile::exclude):
+        * profiler/ProfileNode.cpp: 
+        (KJS::ProfileNode::setTreeVisible): New function that allows a change in
+        visiblitiy to be propogated to all the children of a node.
+        (KJS::ProfileNode::exclude): If the node matches the callIdentifier then
+        set the visiblity of this node and all of its children to false and
+        attribute it's total time to it's caller's self time.
+        * profiler/ProfileNode.h:
+
+2008-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix access to static global variables in Windows release builds.
+
+        * kjs/JSGlobalObject.h: Don't store a reference to an Identifier
+        in GlobalPropertyInfo as the Identifier is likely to be a temporary
+        and therefore may be destroyed before the GlobalPropertyInfo.
+
+2008-05-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Build fix.
+
+        * VM/Machine.cpp:
+        (KJS::callEval):
+
+2008-05-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        <rdar://problem/5951561> Turn on JavaScript Profiler
+        Get basic JS profiling working.
+        Even with this patch the profiler will not be compiled in because we do
+        not know the extend, if any, of the performance regression it would cause
+        when it is not in use. However with these changes, if the profiler were
+        on, it would not crash and show good profiling data.
+
+        * VM/Machine.cpp: Instrument the calls sites that are needed for profiling.
+        (KJS::callEval):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * kjs/function.cpp: Ditto.
+        (KJS::globalFuncEval):
+        * kjs/interpreter.cpp: Ditto.
+        (KJS::Interpreter::evaluate):
+        * profiler/Profile.cpp: 
+        (KJS::Profile::willExecute):
+        (KJS::Profile::didExecute): Because we do not get a good context when
+        startProfiling is called it is possible that m_currentNode will be at the
+        top of the known stack when a didExecute() is called.  What we then do is
+        create a new node that represents the function being exited and insert
+        it between the head and the currently known children, since they should
+        be children of this new node.
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::ProfileNode):
+        (KJS::ProfileNode::willExecute): Rename the add function for consistency.
+        (KJS::ProfileNode::addChild): Appends the child to this node but also
+        sets the parent pointer of the children to this node.
+        (KJS::ProfileNode::insertNode): Insert a node between this node and its
+        children.  Also set the time for the new node since it is now exiting
+        and we don't really know when it started.
+        (KJS::ProfileNode::stopProfiling):
+        (KJS::ProfileNode::startTimer):
+        * profiler/ProfileNode.h:
+        (KJS::CallIdentifier::toString): Added for debugging.
+        (KJS::ProfileNode::setParent):
+        (KJS::ProfileNode::setSelfTime): Fixed an old bug where we set the
+        visibleTotalTime not the visibleSelfTime.
+        (KJS::ProfileNode::children):
+        (KJS::ProfileNode::toString): Added for debugging.
+        * profiler/Profiler.cpp: remove unecessary calls.
+        (KJS::Profiler::startProfiling):
+
+2008-05-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Rename register arguments for op_call, op_call_eval, op_end, and op_construct 
+        to document what they are for.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCall):
+        (KJS::CodeGenerator::emitCallEval):
+        (KJS::CodeGenerator::emitEnd):
+        (KJS::CodeGenerator::emitConstruct):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-05-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        Bug 19116: SquirrelFish shouldn't regress on variable lookups
+        <https://bugs.webkit.org/show_bug.cgi?id=19116>
+
+        Last of the multiscope look up optimisations.  This is a wash overall on SunSpider
+        but is a factor of 5-10 improvement in multiscope read/write/modify (eg. ++, --, +=,
+        ... applied to any non-local var).
+
+        * kjs/nodes.cpp:
+        (KJS::PostIncResolveNode::emitCode):
+        (KJS::PostDecResolveNode::emitCode):
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+
+2008-05-22  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/5954233> Add method to release free memory from FastMalloc
+
+        Patch suggested by Mark Rowe.  Rubber-stamped by Maciej.
+
+        * JavaScriptCore.exp: Export _releaseFastMallocFreeMemory.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::): Added releaseFastMallocFreeMemory() for both
+        system malloc and FastMalloc code paths.
+        * wtf/FastMalloc.h: Define releaseFastMallocFreeMemory().
+
+2008-05-22  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej.
+
+        Roll out r34020 as it causes recursion tests to fail.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::call):
+
+2008-05-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark.
+
+        Don't leak the SymbolTable when compiling eval code.
+
+        * kjs/nodes.cpp:
+        (KJS::EvalNode::generateCode):
+
+2008-05-22  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Oliver.
+
+        Qt build fix.
+
+        * JavaScriptCore.pri: Added DebuggerCallFrame to the build.
+        * VM/LabelID.h: Include limits.h for UINT_MAX.
+        * wtf/VectorTraits.h: Include memory for std::auto_ptr.
+
+2008-05-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+        
+        Removed the old recursion guard mechanism, since squirrelfish has its
+        own mechanism. Also removed some old JS call tracing code, since we
+        have other ways to do that, too.
+        
+        SunSpider reports no change.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::call):
+
+2008-05-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fixed <rdar://problem/5954979> crash on celtic kane JS benchmark
+
+        * kjs/nodes.cpp:
+        (KJS::WithNode::emitCode):
+        (KJS::TryNode::emitCode):
+
+2008-05-21  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Maciej and Geoff.
+
+        <rdar://problem/5951561> Turn on JavaScript Profiler
+        -As part of the effort to turn on the profiler it would be helpful if it
+        did not need ExecStates to represent the stack location of the currently
+        executing statement.
+        -We now create each node as necessary with a reference to the current
+        node and each node knows its parent so that the tree can be made without
+        the entire stack.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::Profile): The current node starts at the head.
+        (KJS::Profile::stopProfiling): The current node is cleared when profiling
+        stops.
+        (KJS::Profile::willExecute): The current node either adds a new child or
+        starts and returns a reference to an already existing child if the call
+        ID that is requested already exists.
+        (KJS::Profile::didExecute): The current node finishes and returns its
+        parent.
+        * profiler/Profile.h: Use a single callIdentifier instead of a vector
+        since we no longer use the whole stack.
+        * profiler/ProfileNode.cpp: Now profile nodes keep a reference to their
+        parent.
+        (KJS::ProfileNode::ProfileNode): Initialize the parent.
+        (KJS::ProfileNode::didExecute): Record the time and return the parent.
+        (KJS::ProfileNode::addOrStartChild): If the given callIdentifier is
+        already a child, start it and return it, otherwise create a new one and
+        return that.
+        (KJS::ProfileNode::stopProfiling): Same logic, just use the new function.
+        * profiler/ProfileNode.h: Utilize the parent.
+        (KJS::ProfileNode::create):
+        (KJS::ProfileNode::parent):
+        * profiler/Profiler.cpp: 
+        (KJS::Profiler::startProfiling): Here is the only place where the
+        ExecState is used to figure out where in the stack the profiler is
+        currently profiling.
+        (KJS::dispatchFunctionToProfiles): Only send one CallIdentifier instead
+        of a vector of them.
+        (KJS::Profiler::willExecute): Ditto.
+        (KJS::Profiler::didExecute): Ditto.
+        (KJS::createCallIdentifier): Create only one CallIdentifier.
+        (KJS::createCallIdentifierFromFunctionImp): Ditto.
+        * profiler/Profiler.h:
+
+2008-05-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19180
+          speed up the < operator for the case when both values are integers
+
+        Makes standalone SunSpider 1.022x faster.
+
+        * VM/Machine.cpp:
+        (KJS::jsLess): Add a special case for when both are numbers that fit in a JSImmediate.
+
+2008-05-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver and Sam.
+        
+        - fixed <rdar://problem/5815631> REGRESSION (r31239): Multiscope optimisation of function calls results in incorrect this value (breaks tvtv.de)
+        
+        Track global this value in the scope chain so we can retrieve it
+        efficiently but it follows lexical scope properly.
+
+        * kjs/ExecState.h:
+        (KJS::ExecState::globalThisValue):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct):
+        * kjs/scope_chain.h:
+        (KJS::ScopeChainNode::ScopeChainNode):
+        (KJS::ScopeChainNode::globalThisObject):
+        (KJS::ScopeChainNode::push):
+        (KJS::ScopeChain::ScopeChain):
+
+2008-05-21  Kevin McCullough  <kmccullough@apple.com>
+
+        Sadness :(
+
+        * kjs/config.h:
+
+2008-05-21  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Maciej.
+
+        <rdar://problem/5950867> JSProfiler: Allow the profiler to "Focus" a
+        profile node.
+        - This patch updatest the times of the visible nodes correctly, but to do
+        so, some of the design of the ProfileNode changed.
+
+        * JavaScriptCore.exp: export focus' symbol.
+        * profiler/Profile.cpp: ProfileNodes now take a reference to the head of
+        the profile tree to get up-to-date accurate total profile time.
+        (KJS::Profile::Profile): Pass 0 for the head node.
+        (KJS::Profile::stopProfiling): stopProfiling no longer needs the time
+        passed into it, since it can get it from the head and it does not need to
+        be told it is the head because it can figure it out on it's own.
+        (KJS::Profile::willExecute): Set the head node for each created node.
+        * profiler/Profile.h:
+        (KJS::Profile::focus): Instead of taking a CallIdentifier that the caller
+        would have to create, now focus() takes a ProfileNode that they should
+        already have a reference to and focus() can extract the CallIdentifier
+        from it.
+        * profiler/ProfileNode.cpp: Create actual and visible versions fo the
+        total and self times for focus and exclude.  Also add a head node
+        reference so that nodes can get information from their head.
+        (KJS::ProfileNode::ProfileNode):
+        (KJS::ProfileNode::stopProfiling): Rename the total and self time
+        variables and set the visual ones to the actual ones, so that without any
+        changes to the visual versions of these variables, their times will match
+        the actual times.
+        (KJS::ProfileNode::focus): Now focus() has a bool to force it's children
+        to be visible if this node is visible.  If this node does not match the
+        CallIdentifier being focused then the visibleTotalTime is only updated if
+        one or more of it's children is the CallIdentifier being focused. 
+        (KJS::ProfileNode::restoreAll): Restores all variables with respect to
+        the visible data in the ProfileNode.
+        (KJS::ProfileNode::endAndRecordCall): Name change.
+        (KJS::ProfileNode::debugPrintData): Dump the new variables.
+        (KJS::ProfileNode::debugPrintDataSampleStyle): Name change.
+        * profiler/ProfileNode.h: Use the new variables and reference to the head
+        node.
+        (KJS::ProfileNode::create):
+        (KJS::ProfileNode::totalTime):
+        (KJS::ProfileNode::setTotalTime):
+        (KJS::ProfileNode::selfTime):
+        (KJS::ProfileNode::setSelfTime):
+        (KJS::ProfileNode::totalPercent):
+        (KJS::ProfileNode::selfPercent):
+        (KJS::ProfileNode::setVisible):
+
+2008-05-21  Alp Toker  <alp@nuanti.com>
+
+        GTK+/UNIX testkjs build fix. Include signal.h.
+
+        * kjs/testkjs.cpp:
+
+2008-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Yet more windows build fixes
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Yet more windows build fixes
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-05-21  Alp Toker  <alp@nuanti.com>
+
+        GTK+ build fix. Add DebuggerCallFrame.cpp and take AllInOneFile.cpp
+        changes into account.
+
+        * GNUmakefile.am:
+
+2008-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Add DebuggerCallFrame.{h,cpp} to the project file
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-05-21  Alp Toker  <alp@nuanti.com>
+
+        GTK+ port build fixes following squirrelfish merge r33979.
+
+        * GNUmakefile.am:
+
+2008-05-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - save a hash lookup wne writing to global properties
+        0.3% speedup on SunSpider, 7% on bitops-bitwise-and
+
+        * VM/Machine.cpp:
+        (KJS::resolveBase): Check for being a the end of the scope chain
+        before hash lookup.
+
+2008-05-21  Alp Toker  <alp@nuanti.com>
+
+        Rubber-stamped by Maciej.
+
+        Replace non-standard #pragma marks with comments to avoid compiler
+        warnings.
+
+        * profiler/ProfileNode.cpp:
+
+2008-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix layout test failure in fast/dom/getter-on-window-object2 introduced in r33961.
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::defineGetter):
+        (KJS::JSGlobalObject::defineSetter):
+        * kjs/JSGlobalObject.h:
+
+=== End merge of squirrelfish ===
+
+2008-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Tim Hatcher.
+        
+        Merged with trunk WebCore's new debugger.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (KJS::DebuggerCallFrame::evaluate): Changed this function to separate
+        the exception value from the return value. The WebKit debugger treats
+        them as one, but the WebCore debugger doesn't.
+
+        * kjs/DebuggerCallFrame.h:
+        (KJS::DebuggerCallFrame::dynamicGlobalObject): Added a new accessor for
+        the dynamic global object, since the debugger doesn't want the lexical
+        global object.
+
+2008-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 19116: SquirrelFish shouldn't regress on variable lookups
+        <https://bugs.webkit.org/show_bug.cgi?id=19116>
+
+        Optimise cross scope assignment, 0.4% progression in sunspider.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitPutScopedVar):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::AssignResolveNode::emitCode):
+
+2008-05-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - check property map before symbol table in JSGlobalObject::getOwnPropertySlot
+        0.5% speedup on SunSpider
+
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::getOwnPropertySlot): Check property map before symbol table
+        because symbol table access is likely to have been optimized.
+
+2008-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 19116: SquirrelFish shouldn't regress on variable lookups
+        <https://bugs.webkit.org/show_bug.cgi?id=19116>
+
+        Optimise multiscope lookup of statically resolvable function calls.
+        SunSpider reports a 1.5% improvement, including 37% on 
+        controlflow-recursive for some reason :D
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitResolve):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallResolveNode::emitCode):
+
+2008-05-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - give JSGlobalObject a special version of getOwnPropertySlot that tells you if the slot is directly writable
+        (WebCore change using this is a 2.6% speedup on in-browser SunSpider).
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::getOwnPropertySlot):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableGet):
+        * kjs/object.h:
+        (KJS::JSObject::getDirectLocation):
+        (KJS::JSObject::getOwnPropertySlotForWrite):
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::getLocation):
+        * kjs/property_map.h:
+        * kjs/property_slot.h:
+        (KJS::PropertySlot::putValue):
+
+2008-05-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 19116: SquirrelFish shouldn't regress on variable lookups
+        <https://bugs.webkit.org/show_bug.cgi?id=19116>
+
+        This restores multiscope optimisation to simple resolve, producing
+        a 2.6% progression in SunSpider.  Have verified that none of the
+        sites broken by the multiscope optimisation in trunk were effected
+        by this change.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::CodeBlock):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::findScopedProperty):
+        (KJS::CodeGenerator::emitResolve):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::resolve_n):
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/JSVariableObject.h:
+
+2008-05-20  Oliver Hunt  <oliver@apple.com>
+
+        Fixerate the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * VM/CodeGenerator.cpp:
+        * VM/RegisterFile.h:
+        * kjs/JSGlobalObject.h:
+        * kjs/Parser.cpp:
+        * kjs/interpreter.h:
+
+2008-05-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 19110: SquirrelFish: Google Maps - no maps
+        <https://bugs.webkit.org/show_bug.cgi?id=19110>
+
+        Correct a comedy of errors present in my original patch to "fix"
+        exceptions occurring midway through pre and post increment. This
+        solution is cleaner than the original, doesn't need the additional
+        opcodes, and as an added benefit does not break Google Maps.
+
+        Sunspider reports a 0.4% progression.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::PreIncBracketNode::emitCode):
+        (KJS::PreDecBracketNode::emitCode):
+        (KJS::PreIncDotNode::emitCode):
+        (KJS::PreDecDotNode::emitCode):
+
+2008-05-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - inline JSGlobalObject::getOwnPropertySlot
+        1% improvement on in-browser SunSpider (a wash command-line)
+
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::getOwnPropertySlot):
+
+2008-05-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18752: SQUIRRELFISH: exceptions are not always handled by the vm
+        <https://bugs.webkit.org/show_bug.cgi?id=18752>
+
+        Handle exceptions thrown by toString conversion in subscript operators,
+        this should basically complete exception handling in SquirrelFish.
+
+        Sunspider reports no regression.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-05-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Reapplying patch with previously missing files from r33553 -- Oliver]
+
+        Behold: debugging.
+        
+        SunSpider reports no change.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added DebuggerCallFrame.h/.cpp,
+        and created a debugger folder.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::generate): If the debugger is attached, always
+        generate full scope chains for its sake.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::unwindCallFrame): Notify the debugger when unwinding
+        due to an exception, so it doesn't keep stale call frames around.
+
+        (KJS::Machine::execute): Set Callee to 0 in eval frames, so the
+        debugger can distinguish them from function call frames.
+
+        (KJS::Machine::debug): Simplified this function, since the debugger
+        doesn't actually need all the information we used to provide.
+
+        (KJS::Machine::privateExecute): Treat debugging hooks like other function
+        calls, so the code we hook into (the debugger UI) can be optimized.
+
+        * kjs/debugger.cpp: Nixed these default callback implementations and
+        made the callbacks pure virtual instead, so the compiler could tell me
+        if I made a mistake in one of the subclasses.
+
+        * kjs/debugger.h: Removed a bunch of irrelevent data from the debugger
+        callbacks. Changed from passing an ExecState* to passing a
+        DebuggerCallFrame*, since an ExecState* doesn't contain sufficient
+        information anymore.
+
+        * kjs/function.cpp:
+        (KJS::globalFuncEval): Easiest bug fix evar!
+
+        [Previously missing files from r33553]
+        * kjs/DebuggerCallFrame.cpp: Copied from JavaScriptCore/profiler/FunctionCallProfile.h.
+        (KJS::DebuggerCallFrame::functionName):
+        (KJS::DebuggerCallFrame::thisObject):
+        (KJS::DebuggerCallFrame::evaluateScript):
+        * kjs/DebuggerCallFrame.h: Copied from JavaScriptCore/VM/Register.h.
+        (KJS::DebuggerCallFrame::DebuggerCallFrame):
+        (KJS::DebuggerCallFrame::scopeChain):
+        (KJS::DebuggerCallFrame::exception):
+
+2008-05-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 18991: SquirrelFish: Major codegen issue in a.b=expr, a[b]=expr
+        <https://bugs.webkit.org/show_bug.cgi?id=18991>
+
+        Fix the last remaining blocking cases of this bug.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::ReadModifyResolveNode::emitCode):
+
+2008-05-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Partial fix for:
+
+        Bug 18991: SquirrelFish: Major codegen issue in a.b=expr, a[b]=expr
+        <https://bugs.webkit.org/show_bug.cgi?id=18991>
+
+        Ensure that the code generated for assignments uses temporaries whenever
+        necessary. This patch covers the vast majority of situations, but there
+        are still a few left.
+
+        This patch also adds some missing cases to CodeBlock::dump().
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::destinationForAssignResult):
+        (KJS::CodeGenerator::leftHandSideNeedsCopy):
+        (KJS::CodeGenerator::emitNodeForLeftHandSide):
+        * kjs/NodeInfo.h:
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::AssignDotNode::emitCode):
+        (KJS::ReadModifyDotNode::emitCode):
+        (KJS::AssignBracketNode::emitCode):
+        (KJS::ReadModifyBracketNode::emitCode):
+        (KJS::ForInNode::ForInNode):
+        * kjs/nodes.h:
+        (KJS::ReadModifyResolveNode::):
+        (KJS::AssignResolveNode::):
+        (KJS::ReadModifyBracketNode::):
+        (KJS::AssignBracketNode::):
+        (KJS::AssignDotNode::):
+        (KJS::ReadModifyDotNode::):
+
+2008-05-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 19106: SquirrelFish: Activation is not marked correctly
+        <https://bugs.webkit.org/show_bug.cgi?id=19106>
+
+        We can't rely on the symbol table for a count of the number of globals
+        we need to mark as that misses duplicate parameters and 'this'.  Now we
+        use the actual local register count from the codeBlock.
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::mark):
+
+2008-05-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 19076: SquirrelFish: RegisterFile can be corrupted if implictly reenter global scope with no declared vars
+        <https://bugs.webkit.org/show_bug.cgi?id=19076>
+
+        Don't delay allocation of initial global RegisterFile, as we can't guarantee we will be able
+        to allocate the global 'this' register safely at any point after initialisation of the Global
+        Object.
+
+        Unfortunately this initial allocation caused a regression of 0.2-0.3%, however this patch adds
+        support for the static slot optimisation for the global Math object which brings it to a 0.3%
+        progression.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::programCodeThis):
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::addParameter):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * kjs/ExecState.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
+        (KJS::JSGlobalObject::addStaticGlobals):
+        * kjs/nodes.cpp:
+
+2008-05-16  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 19098: SquirrelFish: Ref'd temporaries can be clobbered
+        <https://bugs.webkit.org/show_bug.cgi?id=19098>
+
+        When doing code generation for a statement list, increase the reference
+        count on a register that might eventually be returned, so that it doesn't
+        get clobbered by a request for a new temporary.
+
+        * kjs/nodes.cpp:
+        (KJS::statementListEmitCode):
+
+2008-05-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fixed Bug 19044: SquirrelFish: Bogus values enter evaluation when closing over scope with parameter and var with same name
+        https://bugs.webkit.org/show_bug.cgi?id=19044
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::copyRegisters): Use numLocals from the code
+        block rather than the size of the symbol table for the number of
+        registers to copy, to account for duplicate parameters and vars
+        with the same name as parameters (we still have potentially
+        suboptimal codegen in that we allocate a local register for the
+        var in the latter case but it is never used).
+        
+2008-05-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        We regret to inform you that your program is crashing because you were
+        stupid.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Math is hard.
+
+2008-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more debugger action: filled in op_debug. All debugger control
+        flow works now, but variable inspection and backtraces still don't.
+        
+        SunSpider reports no change.
+
+        * VM/CodeGenerator.cpp: Changed op_debug to accept line number parameters.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::getFunctionAndArguments): Moved op_debug into a
+        NEVER_INLINE function to avoid a stunning 10% performance regression.
+        Also factored out a common function for retrieving the function and 
+        arguments from a  call frame. 
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::createArgumentsObject): Use the new factored out
+        function mentioned above.
+
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse): Increment m_sourceId before assigning it, so the
+        sourceId we send to the debugger matches the sourceId recorded in the
+        node.
+
+        * kjs/nodes.cpp: Emit debugging hooks.
+
+2008-05-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 19024: SQUIRRELFISH: ASSERTION FAILED: activation->isActivationObject() in Machine::unwindCallFrame
+        <https://bugs.webkit.org/show_bug.cgi?id=19024>
+
+        This fixes a number of issues.  The most important is that we now check every register
+        file for tainting rather than just looking for function register files as that was
+        insufficient. Additionally guarded against implicit re-entry into Eval code.
+
+        Also added a few additional assertions to reduce the amout of time between something
+        going wrong and us seeing the error.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/RegisterFile.cpp:
+        (KJS::RegisterFile::growBuffer):
+        (KJS::RegisterFile::addGlobalSlots):
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::pushGlobalRegisterFile):
+        (KJS::RegisterFileStack::pushFunctionRegisterFile):
+        * VM/RegisterFileStack.h:
+        (KJS::RegisterFileStack::inImplicitCall):
+
+2008-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A little more debugger action: emit opcodes for debugger hooks. Right
+        now, the opcode implementation is just a stub.
+        
+        SunSpider reports no change.
+        
+        Some example codegen for "function f() { 1; }":
+
+            [   0] dbg         DidEnterCallFrame
+            [   2] dbg         WillExecuteStatement
+            [   4] load        tr0, 1(@k0)
+            [   7] load        tr0, undefined(@k1)
+            [  10] dbg         WillLeaveCallFrame
+            [  12] ret         tr0
+
+2008-05-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 19025: SQUIRRELFISH: malformed syntax in onload handler causes crash
+        <https://bugs.webkit.org/show_bug.cgi?id=19025>
+
+        Simple fix -- move the use of functionBodyNode to after the null check.
+
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct):
+
+2008-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed a codegen crash with run-time parse errors.
+        
+        SunSpider reports no change.
+        
+        emitThrowError needs to return the temporary holding the error, not dst,
+        since dst may be NULL. In fact, emitThrowError shouldn't take a dst
+        parameter at all, since exceptions should not modify the destination
+        register.
+
+2008-05-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 19027: SquirrelFish: Incorrect codegen for pre-increment
+        <https://bugs.webkit.org/show_bug.cgi?id=19027>
+
+        This fixes the codegen issues for the pre-inc/decrement operators
+        to prevent incorrectly clobbering the destination in the event of
+        an exception.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitPreInc):
+        (KJS::CodeGenerator::emitPreDec):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::PreIncBracketNode::emitCode):
+        (KJS::PreDecBracketNode::emitCode):
+        (KJS::PreIncDotNode::emitCode):
+        (KJS::PreDecDotNode::emitCode):
+
+2008-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A little more debugger action: supply a real line number, sourceId,
+        and sourceURL in op_new_error.
+        
+        SunSpider reports a .2% speedup. Not sure what that's about.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Use the new good stuff in op_new_error.
+
+        * kjs/nodes.cpp:
+        (KJS::RegExpNode::emitCode): Use the shared emitThrowError instead of
+        rolling our own.
+
+2008-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A little more debugger action: implemented the exception callback.
+        
+        SunSpider reports a .2% speedup. Not sure what that's about.
+
+        * VM/CodeBlock.h: A little refactoring here. Store a pointer to our
+        owner ScopeNode so we can retrieve data from it. This allows us to
+        stop storing copies of the data ourselves. Also, store a "this" register
+        instead of a code type, since we were only using the code type to
+        calculate the "this" register.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::generate): Calculate the "this" register mentioned
+        above. Also, take care of removing "this" from the symbol table after
+        codegen is done, since relying on the timing of a destructor for correct
+        behavior is not so good.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::throwException): Invoke the debugger's exception callback.
+        (KJS::Machine::privateExecute): Use the "this" register mentioned above.
+
+2008-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Removed some unused exception machinery.
+        
+        SunSpider reports a .3% speedup.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/internal.cpp:
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/value.h:
+
+2008-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A little more debugger action.
+
+        * kjs/debugger.cpp:
+        * kjs/debugger.h: Removed debuggersPresent because it was unused.
+        Replaced AttachedGlobalObject linked list with a HashSet because HashSet
+        is faster and simpler. Changed all functions to return void instead of
+        bool, because no clients ever return false, and we don't want to support
+        it.
+
+        * kjs/nodes.cpp: Did some up-keep to avoid build bustage.
+        (KJS::Node::handleException):
+        (KJS::BreakpointCheckStatement::execute):
+        (KJS::FunctionBodyNodeWithDebuggerHooks::execute):
+
+2008-05-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        Bug 18752: SQUIRRELFISH: exceptions are not always handled by the vm
+        <https://bugs.webkit.org/show_bug.cgi?id=18752>
+
+        Replace old attempt at "branchless" exceptions as the extra information
+        being passed made gcc an unhappy compiler, replacing these custom toNumber
+        calls with ordinary toNumber logic (by relying on toNumber now preventing
+        side effects after an exception has been thrown) provided sufficient leeway
+        to add the additional checks for the remaining unchecked cases.
+
+        This leaves only toString conversions in certain contexts as possibly
+        misbehaving.
+
+        * VM/Machine.cpp:
+        (KJS::jsAdd):
+        (KJS::resolve):
+        (KJS::resolveBaseAndProperty):
+        (KJS::resolveBaseAndFunc):
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/value.h:
+        (KJS::JSValue::safeGetNumber):
+
+2008-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        First steps toward supporting the debugger API: support the sourceParsed
+        callback; plus some minor fixups.
+
+        SunSpider reports no regression.
+
+        * VM/CodeGenerator.h: Removed a misleading comment.
+
+        * kjs/Parser.h: Changed the parser to take an ExecState*, so it can
+        implement the sourceParsed callback -- that way, we only have to
+        implement the callback in one place.
+
+        * kjs/debugger.cpp: Nixed DebuggerImp, because its sole purpose in life
+        was to demonstrate the misapplication of design patterns.
+
+        * kjs/debugger.h: Changed sourceParsed to take a SourceProvider, to
+        reduce copying, and not to return a value, because pausing execution
+        after parsing is complicated, and no clients needed that ability, anyway.
+
+        * kjs/grammar.y: Make sure never to pass a NULL SourceElements* to
+        didFinishParsing -- that simplifies some code down the road.
+        
+        * kjs/nodes.cpp: Don't generate special AST nodes just because the
+        debugger is attached -- that's a relic of the old AST execution model,
+        and those nodes haven't been maintained.
+
+2008-05-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18752: SQUIRRELFISH: exceptions are not always handled by the vm
+        <https://bugs.webkit.org/show_bug.cgi?id=18752>
+
+        First step: prevent incorrect evaluation of valueOf/toString conversion
+        in right hand side of expression after earlier conversion throws.
+
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::toNumber):
+        * kjs/object.cpp:
+        (KJS::JSObject::defaultValue):
+
+2008-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18934: SQUIRRELFISH: ASSERT @ nytimes.com due to RegisterFile being clobbered
+        <https://bugs.webkit.org/show_bug.cgi?id=18934>
+
+        Unfortunately we cannot create new statically optimised globals if there are any
+        tainted RegisterFiles on the RegisterFileStack.  To handle this we re-introduce
+        (in a slightly cleaner form) the inImplicitCall concept to the RegisterFileStack.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::pushFunctionRegisterFile):
+        * VM/RegisterFileStack.h:
+
+2008-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Introduced support for function.caller.
+        
+        Improved support for walking interesting scopes for function introspection.
+        
+        This fixes all remaining layout tests not blocked by rebasing to trunk.
+        
+        SunSpider reports no change.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::dumpRegisters): Fixed a spacing issue.
+
+2008-05-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 18961: SQUIRRELFISH: Gmail doesn't load
+        <https://bugs.webkit.org/show_bug.cgi?id=18961>
+
+        Fix codegen for logical nodes so that they don't use their destination
+        as a temporary.
+
+        * kjs/nodes.cpp:
+        (KJS::LogicalAndNode::emitCode):
+        (KJS::LogicalOrNode::emitCode):
+
+2008-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+
+        - JavaScriptCore part of fix for: "SQUIRRELFISH: function toString broken after calling"
+        https://bugs.webkit.org/show_bug.cgi?id=18869
+       
+        Three layout tests are fixed:
+          fast/js/toString-elision-trailing-comma.html
+          fast/js/toString-prefix-postfix-preserve-parens.html
+          fast/js/kde/lval-exceptions.html
+        
+        Functions now save a shared subrange of the original source used
+        to make them (so in the common case this adds no storage above the
+        memory cache).
+        
+        * kjs/SourceProvider.h: Added.
+        (KJS::SourceProvider): New abstract base class for classes that provide on-demand access
+        to the source for a JavaScript program. This allows function objects to have access to their
+        original source without copying.
+        (KJS::UStringSourceProvider): SourceProvider subclass backed by a KJS::UString.
+        (KJS::UStringSourceProvider::create):
+        (KJS::UStringSourceProvider::getRange):
+        (KJS::UStringSourceProvider::data):
+        (KJS::UStringSourceProvider::length):
+        (KJS::UStringSourceProvider::UStringSourceProvider):
+        * kjs/SourceRange.h: Added.
+        (KJS::SourceRange::SourceRange): Class that holds a SourceProvider and a character range into
+        the source, to encapsulate on-demand access to the source of a function.
+        (KJS::SourceRange::toString):
+        * VM/Machine.cpp:
+        (KJS::eval): Pass a UStringSourceProvider to the parser.
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse): Take a SourceProvider and pass it on to the lexer.
+        * kjs/Parser.h:
+        (KJS::Parser::parse): Take a SourceProvider.
+        * kjs/lexer.cpp:
+        (KJS::Lexer::setCode): Take a SourceProvider; keep it around, and
+        use it to get the raw buffer and length.
+        * kjs/lexer.h:
+        (KJS::Lexer::sourceRange): Convenience function to get a source
+        range based on the lexer's source provieder, and char offsets
+        right before and after the desired range.
+        * kjs/function.cpp:
+        (KJS::globalFuncEval): Pass a UStringSourceProvider to the parser.
+        * kjs/function_object.cpp:
+        (KJS::functionProtoFuncToString): Use toSourceString to get the source.
+        (KJS::FunctionObjectImp::construct): Give the parser a UStringSourceProvider.
+        * kjs/grammar.y: When parsing a function declaration, function
+        expression, or getter or setter, tell the function body about its
+        SourceRange.
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::checkSyntax): Pass a SourceProvider to the parser.
+        (KJS::Interpreter::evaluate): Pass a SourceProvider to the parser.
+        * kjs/interpreter.h:
+        * kjs/nodes.h:
+        (KJS::FunctionBodyNode::setSource): Establish a SourceRange for this function.
+        (KJS::FunctionBodyNode::toSourceString): Get the source string out
+        of the SourceRange.
+        (KJS::FuncExprNode::): Take a SourceRange and set it on the body.
+        (KJS::FuncDeclNode::): ditto
+        * kjs/testkjs.cpp:
+        (prettyPrintScript): Use a SourceProvider appropriately.
+        * JavaScriptCore.exp: Export new symbols.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add new files.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add new files.
+
+2008-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bring back RegisterFile tainting in order to correctly handle
+        natively implemented getters and setters that re-enter JavaScript
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/RegisterFile.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        * kjs/object.cpp:
+        (KJS::JSObject::put):
+        (KJS::tryGetAndCallProperty):
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::functionGetter):
+
+2008-05-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - track character offsets of open and close braces, in preparation for saving function source
+        
+        I verified that there is no performance regression from this change.
+
+        * kjs/grammar.y:
+        * kjs/lexer.cpp:
+        (KJS::Lexer::lex):
+        (KJS::Lexer::matchPunctuator):
+        * kjs/lexer.h:
+
+2008-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Debug build fix
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::restoreLocalStorage):
+
+2008-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Build fixes for SquirrelFish on windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+        * VM/Register.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::restoreLocalStorage):
+        * kjs/collector.cpp:
+        (KJS::Collector::allocate):
+        (KJS::Collector::allocateNumber):
+        * kjs/collector.h:
+        (KJS::Collector::allocate):
+        (KJS::Collector::allocateNumber):
+        * kjs/property_slot.cpp:
+
+2008-05-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - fix activation tearoff in the case where functions are called with too many arguments
+        
+        Fixes:
+        fast/canvas/patternfill-repeat.html
+        fast/dom/SelectorAPI/bug-17313.html
+
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall):
+        (KJS::scopeChainForCall):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+
+2008-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed failure in fast/canvas/canvas-pattern-behaviour.html.
+        
+        SunSpider reports a small speedup. Not sure what that's about.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump): Fixed op_call_eval to dump as "op_call_eval".
+        This helped me while debugging.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::unwindCallFrame): When looking for an activation to tear
+        off, don't use the scope chain. Inside eval, the scope chain doesn't
+        belong to us; it belongs to our calling function.
+        
+        Also, don't use the needsFullScopeChain flag to decide whether to tear
+        off the activation. "function.arguments" can create an activation
+        for a function whose needsFullScopeChain flag is set to false.
+
+2008-05-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix function.call for calls of more than 8 arguments
+        
+        Fixes svg/carto.net/button.svg
+
+        * kjs/list.cpp:
+        (KJS::List::getSlice): properly set up the m_buffer of the target list.
+
+2008-05-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - don't return a null RegisterID from RegExpNode in the exception case, since the caller may need a real register
+
+        Fixes:
+        - fast/regex/early-acid3-86.html
+        - http/tests/misc/acid3.html
+        
+        * kjs/nodes.cpp:
+        (KJS::RegExpNode::emitCode):
+
+2008-05-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Fix a performance regression caused by the introduction of property
+        attributes to SymbolTable in r32859 by encoding the attributes and the
+        register index into a single field of SymbolTableEntry.
+
+        This leaves Node::optimizeVariableAccess() definitely broken, although
+        it was probably not entirely correct in SquirrelFish before this change.
+
+        * VM/CodeBlock.h:
+        (KJS::missingThisObjectMarker):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addVar):
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::registerForLocal):
+        (KJS::CodeGenerator::registerForLocalConstInit):
+        (KJS::CodeGenerator::isLocalConstant):
+        (KJS::CodeGenerator::addConstant):
+        (KJS::CodeGenerator::emitCall):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::IdentifierMapIndexHashTraits::emptyValue):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::saveLocalStorage):
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::getPropertyNames):
+        (KJS::JSVariableObject::getPropertyAttributes):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableGet):
+        (KJS::JSVariableObject::symbolTablePut):
+        (KJS::JSVariableObject::symbolTablePutWithAttributes):
+        * kjs/SymbolTable.h:
+        (KJS::SymbolTableEntry::SymbolTableEntry):
+        (KJS::SymbolTableEntry::isEmpty):
+        (KJS::SymbolTableEntry::getIndex):
+        (KJS::SymbolTableEntry::getAttributes):
+        (KJS::SymbolTableEntry::setAttributes):
+        (KJS::SymbolTableEntry::isReadOnly):
+        * kjs/nodes.cpp:
+        (KJS::getSymbolTableEntry):
+        (KJS::PostIncResolveNode::optimizeVariableAccess):
+        (KJS::PostDecResolveNode::optimizeVariableAccess):
+        (KJS::DeleteResolveNode::optimizeVariableAccess):
+        (KJS::TypeOfResolveNode::optimizeVariableAccess):
+        (KJS::PreIncResolveNode::optimizeVariableAccess):
+        (KJS::PreDecResolveNode::optimizeVariableAccess):
+        (KJS::ReadModifyResolveNode::optimizeVariableAccess):
+        (KJS::AssignResolveNode::optimizeVariableAccess):
+        (KJS::ProgramNode::initializeSymbolTable):
+
+2008-05-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Oliver.
+        
+        - add missing ! in an assert that I failed to reverse
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+
+2008-05-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fixed "SQUIRRELFISH: window.this shows up as a property, but it shouldn't"
+        https://bugs.webkit.org/show_bug.cgi?id=18868
+        
+        The basic approach is to have "this" only be present in the symbol
+        table at compile time, not runtime.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::~CodeGenerator): Remove "this" from symbol table.
+        (KJS::CodeGenerator::CodeGenerator): Add "this" back when re-using
+        a symbol table.
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::execute): Don't assert that "this" is in the symbol table.
+
+2008-05-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Trivial support for function.arguments: Currently, we only support
+        function.arguments from within the scope of function.
+        
+        This fixes the remaining Mozilla JS test failures.
+        
+        SunSpider reports no change.
+
+        * JavaScriptCore.exp:
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Separated scope chain deref from
+        activation register copying: since it is now possible for client code
+        to create an activation on behalf of a function that otherwise wouldn't
+        need one, having an activation no longer necessarily means that you need
+        to deref the scope chain.
+        
+        (KJS::Machine::getCallFrame): For now, this function only examines the
+        current scope. Walking parent scopes requires some refactoring in the
+        way we track execution stacks.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState): We use a negative call frame offset to
+        indicate that a given scope is not a function call scope.
+        
+2008-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Fix call frame set up for native -> JS function calls.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+
+2008-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed ecma_3/Object/8.6.2.6-001.js, and similar bugs.
+        
+        SunSpider reports a .4% speedup. Not sure what that's about.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Check for exception return from equal,
+        since toPrimitive can throw.
+
+        * kjs/operations.cpp:
+        (KJS::strictEqual): In response to an error I made in an earlier version
+        of this patch, I changed strictEqual to make clear the fact that it
+        performs no conversions and can't throw, making it slightly more efficient
+        in the process.
+
+2008-05-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix some dumb mistakes in my last patch
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitPushScope):
+        (KJS::CodeGenerator::emitGetPropertyNames):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-05-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - document opcodes relating to jumps, scopes, and property name iteration
+        
+        Documented jmp, jtrue, false, push_scope, pop_scope, get_pnames,
+        next_pname and jmp_scopes.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJump):
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        (KJS::CodeGenerator::emitJumpIfFalse):
+        (KJS::CodeGenerator::emitPushScope):
+        (KJS::CodeGenerator::emitNextPropertyName):
+        (KJS::CodeGenerator::emitGetPropertyNames):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/nodes.cpp:
+        (KJS::LogicalAndNode::emitCode):
+        (KJS::LogicalOrNode::emitCode):
+        (KJS::ConditionalNode::emitCode):
+        (KJS::IfNode::emitCode):
+        (KJS::IfElseNode::emitCode):
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::ForInNode::emitCode):
+        (KJS::WithNode::emitCode):
+
+2008-05-05  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 18749: SQUIRRELFISH: const support is broken
+        <https://bugs.webkit.org/show_bug.cgi?id=18749>
+
+        Adds support for const during code generation.
+
+        Fixes 2 layout tests.
+
+        * ChangeLog:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addVar):
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::isLocalConstant):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::addVar):
+        * kjs/nodes.cpp:
+        (KJS::PostIncResolveNode::emitCode):
+        (KJS::PostDecResolveNode::emitCode):
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+        (KJS::AssignResolveNode::emitCode):
+
+2008-05-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - document some more opcodes (and fix argument names)
+        
+        Added docs for eq, neq, stricteq, nstriceq, less and lesseq.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitEqual):
+        (KJS::CodeGenerator::emitNotEqual):
+        (KJS::CodeGenerator::emitStrictEqual):
+        (KJS::CodeGenerator::emitNotStrictEqual):
+        (KJS::CodeGenerator::emitLess):
+        (KJS::CodeGenerator::emitLessEq):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/nodes.cpp:
+        (KJS::LessNode::emitCode):
+        (KJS::GreaterNode::emitCode):
+        (KJS::LessEqNode::emitCode):
+        (KJS::GreaterEqNode::emitCode):
+        (KJS::EqualNode::emitCode):
+        (KJS::NotEqualNode::emitCode):
+        (KJS::StrictEqualNode::emitCode):
+        (KJS::NotStrictEqualNode::emitCode):
+        (KJS::CaseBlockNode::emitCodeForBlock):
+
+2008-05-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        More scaffolding for f.arguments.
+        
+        Track the offset of the last call frame in the ExecState, so we can
+        produce a backtrace at any time.
+        
+        Also, record numLocals, the sum of numVars + numParameters, in each code
+        block, to make updates to the ExecState a little cheaper than they
+        would be otherwise.
+        
+        We now use numLocals in a bunch of places where we used to calculate
+        numVars + numParameters or -numVars - numParameters.
+        
+        Reports are mixed, but all in all, this seems to be a wash on SunSpider.
+
+2008-05-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Whoops, correctly handle properties that don't exist in the 
+        symbol table.
+
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTablePutWithAttributes):
+
+2008-05-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Add attribute information to SymbolTable as ground work for
+        various DontEnum and ReadOnly issues.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addVar):
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::registerForLocal):
+        (KJS::CodeGenerator::registerForLocalConstInit):
+        (KJS::CodeGenerator::addConstant):
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::saveLocalStorage):
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::getPropertyNames):
+        (KJS::JSVariableObject::getPropertyAttributes):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTablePut):
+        (KJS::JSVariableObject::symbolTablePutWithAttributes):
+        * kjs/SymbolTable.h:
+        (KJS::SymbolTableEntry::SymbolTableEntry):
+        (KJS::SymbolTableIndexHashTraits::emptyValue):
+        * kjs/nodes.cpp:
+        (KJS::getSymbolTableEntry):
+        (KJS::ReadModifyResolveNode::optimizeVariableAccess):
+        (KJS::AssignResolveNode::optimizeVariableAccess):
+        (KJS::ProgramNode::initializeSymbolTable):
+
+2008-05-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        More scaffolding for f.arguments.
+        
+        Store the register file associated with an ExecState in the ExecState.
+        
+        SunSpider reports no change.
+
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Moved
+        registerFileStack above globalExec, so it gets initialized first.
+        Removed remnants of old activation scheme.
+
+2008-05-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Oliver.
+        
+        - renamed a few opcodes and fixed assembly formatting to accomodate the longest opcode
+        
+        equal --> eq
+        nequal --> neq
+        resolve_base_and_property --> resolve_with_base
+        resolve_base_and_func --> resolve_func
+        get_prop_id --> get_by_id
+        put_prop_id --> put_by_id
+        delete_prop_id --> del_by_id
+        get_prop_val --> get_by_val
+        put_prop_val --> put_by_val
+        delete_prop_val --> del_by_val
+        put_prop_index --> put_by_index
+        
+        * VM/CodeBlock.cpp:
+        (KJS::printUnaryOp):
+        (KJS::printBinaryOp):
+        (KJS::printConditionalJump):
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitEqual):
+        (KJS::CodeGenerator::emitNotEqual):
+        (KJS::CodeGenerator::emitResolveWithBase):
+        (KJS::CodeGenerator::emitResolveFunction):
+        (KJS::CodeGenerator::emitGetById):
+        (KJS::CodeGenerator::emitPutById):
+        (KJS::CodeGenerator::emitDeleteById):
+        (KJS::CodeGenerator::emitGetByVal):
+        (KJS::CodeGenerator::emitPutByVal):
+        (KJS::CodeGenerator::emitDeleteByVal):
+        (KJS::CodeGenerator::emitPutByIndex):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::ArrayNode::emitCode):
+        (KJS::PropertyListNode::emitCode):
+        (KJS::BracketAccessorNode::emitCode):
+        (KJS::DotAccessorNode::emitCode):
+        (KJS::EvalFunctionCallNode::emitCode):
+        (KJS::FunctionCallResolveNode::emitCode):
+        (KJS::FunctionCallBracketNode::emitCode):
+        (KJS::FunctionCallDotNode::emitCode):
+        (KJS::PostIncResolveNode::emitCode):
+        (KJS::PostDecResolveNode::emitCode):
+        (KJS::PostIncBracketNode::emitCode):
+        (KJS::PostDecBracketNode::emitCode):
+        (KJS::PostIncDotNode::emitCode):
+        (KJS::PostDecDotNode::emitCode):
+        (KJS::DeleteResolveNode::emitCode):
+        (KJS::DeleteBracketNode::emitCode):
+        (KJS::DeleteDotNode::emitCode):
+        (KJS::TypeOfResolveNode::emitCode):
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::PreIncBracketNode::emitCode):
+        (KJS::PreDecBracketNode::emitCode):
+        (KJS::PreIncDotNode::emitCode):
+        (KJS::PreDecDotNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+        (KJS::AssignResolveNode::emitCode):
+        (KJS::AssignDotNode::emitCode):
+        (KJS::ReadModifyDotNode::emitCode):
+        (KJS::AssignBracketNode::emitCode):
+        (KJS::ReadModifyBracketNode::emitCode):
+        (KJS::ConstDeclNode::emitCodeSingle):
+        (KJS::ForInNode::emitCode):
+        (KJS::TryNode::emitCode):
+
+2008-05-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Fix assertion when accessing arguments object with too many arguments provided
+
+        The arguments constructor was assuming that the register offset given for argv
+        was an absolute offset into the registerfile, rather than the offset from the
+        frame.  This patches corrects that issue.
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::createArgumentsObject):
+
+2008-05-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Sam Weinig.
+        
+        Cleaned up Machine.cpp according to our style guidelines: moved static
+        data to the top of the file; moved stand-alone functions below that;
+        moved the Machine constructor above other Machine member functions.
+
+2008-05-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam.
+        
+        - fix accidental breakage from last patch
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-05-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - a bunch more opcode documentation and corresponding parameter name fixes
+
+        I renamed a few opcodes:
+        
+        type_of --> typeof (that's what the JS operator is named)
+        instance_of --> instanceof (ditto)
+        create_error --> new_error (for consistency with other new_* opcodes)
+        
+        I documented the following opcodes:
+        
+        - load
+        - new_object
+        - new_array
+        - new_regexp
+        - mov
+        - pre_inc
+        - pre_dec
+        - post_inc
+        - post_dec
+        - to_jsnumber
+        - negate
+        - bitnot
+        - not
+        - instanceof
+        - typeof
+        - in
+        - new_func
+        - new_funcexp
+        - new_error
+
+        I also fixed formatting on some existing opcode docs.
+        
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitMove):
+        (KJS::CodeGenerator::emitNot):
+        (KJS::CodeGenerator::emitPreInc):
+        (KJS::CodeGenerator::emitPreDec):
+        (KJS::CodeGenerator::emitPostInc):
+        (KJS::CodeGenerator::emitPostDec):
+        (KJS::CodeGenerator::emitToJSNumber):
+        (KJS::CodeGenerator::emitNegate):
+        (KJS::CodeGenerator::emitBitNot):
+        (KJS::CodeGenerator::emitInstanceOf):
+        (KJS::CodeGenerator::emitTypeOf):
+        (KJS::CodeGenerator::emitIn):
+        (KJS::CodeGenerator::emitLoad):
+        (KJS::CodeGenerator::emitNewObject):
+        (KJS::CodeGenerator::emitNewArray):
+        (KJS::CodeGenerator::emitNewRegExp):
+        (KJS::CodeGenerator::emitNewError):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::scopeDepth):
+        (KJS::CodeGenerator::addVar):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::Node::emitThrowError):
+        (KJS::RegExpNode::emitCode):
+        (KJS::TypeOfValueNode::emitCode):
+        (KJS::UnaryPlusNode::emitCode):
+        (KJS::NegateNode::emitCode):
+        (KJS::BitwiseNotNode::emitCode):
+        (KJS::LogicalNotNode::emitCode):
+        (KJS::InstanceOfNode::emitCode):
+        (KJS::InNode::emitCode):
+
+2008-05-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff and Sam.
+        
+        - generate HTML bytecode docs at build time
+
+        * DerivedSources.make:
+        * docs: Added.
+        * docs/make-bytecode-docs.pl: Added.
+
+2008-05-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Update ExecState::m_scopeChain when switching scope chains inside the
+        machine.
+        
+        This fixes uses of lexicalGlobalObject, such as, in a subframe
+
+            alert(top.makeArray() instanceof Array ? "FAIL" : "PASS");
+        
+        and a bunch of the security failures listed in
+        https://bugs.webkit.org/show_bug.cgi?id=18870. (Those tests still fail,
+        seemingly because of regressions in exception messages).
+        
+        SunSpider reports no change.
+
+        * VM/Machine.cpp: Factored out scope chain updating into a common
+        function that takes care to update ExecState::m_scopeChain, too.
+
+        * kjs/ExecState.h: I made Machine a friend of ExecState so that Machine
+        could update ExecState::m_scopeChain, even though that value is
+        read-only for everyone else.
+
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Changed
+        this client to be a little friendlier to ExecState's internal
+        storage type for scope chain data.
+
+2008-05-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=18876
+        Squirrelfish: ScopeChainNode leak in op_jmp_scopes.
+        
+        SunSpider reports no change.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Don't construct a ScopeChain object,
+        since the direct threaded interpreter will goto across its destructor.
+
+2008-05-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A bit more efficient fix than r32832: Don't copy globals into function
+        register files; instead, have the RegisterFileStack track only the base
+        of the last *global* register file, so the global object's register
+        references stay good.
+        
+        SunSpider reports a .3% speedup. Not sure what that's about.
+
+2008-05-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18864: SquirrelFish: Support getter and setter definition in object literals
+        <https://bugs.webkit.org/show_bug.cgi?id=18864>
+
+        Add new opcodes to allow us to add getters and setters to an object.  These are
+        only used by the codegen for object literals.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitPutGetter):
+        (KJS::CodeGenerator::emitPutSetter):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::PropertyListNode::emitCode):
+
+2008-05-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - properly copy globals into and out of implicit call register
+        files, otherwise they will fail at global lookup
+
+        Fixes fast/js/array-tostring-and-join.html layout test.
+        
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::pushGlobalRegisterFile):
+        (KJS::RegisterFileStack::popGlobalRegisterFile):
+        (KJS::RegisterFileStack::pushFunctionRegisterFile):
+        (KJS::RegisterFileStack::popFunctionRegisterFile):
+
+2008-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=18822
+        SQUIRRELFISH: incorrect eval used in some cases
+        
+        Changed all code inside the machine to fetch the lexical global object
+        directly from the scope chain, instead of from the ExecState.
+        
+        Clients who fetch the lexical global object through the ExecState
+        still don't work.
+        
+        SunSpider reports no change.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Fetch the lexical global object from
+        the scope chain.
+        
+        * kjs/ExecState.h:
+        (KJS::ExecState::ExecState::lexicalGlobalObject): Moved the logic for
+        this function into ScopeChainNode, but kept this function around to
+        support existing clients.
+
+2008-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+        
+        Removed ExecState.cpp from AllInOneFile.cpp, for a .2% speedup.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp:
+
+2008-05-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff and Maciej.
+
+        Bug 18827: SquirrelFish: Prevent getters and setters from destroying the current RegisterFile
+        <https://bugs.webkit.org/show_bug.cgi?id=18827>
+
+        Remove safe/unsafe RegisterFile concept, and instead just add additional
+        logic to ensure we always push/pop RegisterFiles when executing getters
+        and setters, similar to the logic for valueOf and toString.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/RegisterFile.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        * kjs/object.cpp:
+        (KJS::JSObject::put):
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::functionGetter):
+
+2008-05-01  Oliver Hunt  <oliver@apple.com>
+
+        RS=Geoff
+
+        Rename unsafeForReentry to safeForReentry to avoid double negatives.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/RegisterFile.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+
+2008-05-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18827: SquirrelFish: Prevent getters and setters from destroying the current RegisterFile
+        <https://bugs.webkit.org/show_bug.cgi?id=18827>
+        
+        This patch makes getters and setters work.  It does this by
+        tracking whether the RegisterFile is "safe", that is whether
+        the interpreter is in a state that in which it can handle
+        the RegisterFile being reallocated.
+
+        * VM/Machine.cpp:
+        (KJS::resolve):
+        (KJS::Machine::privateExecute):
+        * VM/RegisterFile.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+
+2008-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Release build fix: Always compile in "isGlobalObject", since it's
+        listed in our .exp file.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::isGlobalObject):
+        * kjs/ExecState.h:
+
+2008-04-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Minor code restructuring to prepare for getters and setters, 
+        also helps exception semantics a bit.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed tyop.
+
+        * kjs/ExecState.h:
+
+2008-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Debug build fix: export a missing symbol.
+
+        * JavaScriptCore.exp:
+
+2008-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A little more ExecState refactoring: Now, only the global object creates
+        an ExecState.
+        
+        Also inlined ExecState::lexicalGlobalObject().
+        
+        SunSpider reports no change.
+
+2008-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        WebCore build fix: forward-declare ScopeChain.
+
+        * kjs/interpreter.h:
+
+2008-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix for JavaScriptGlue: export a missing symbol.
+
+        * JavaScriptCore.exp:
+
+2008-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Removed a lot of unused bits from ExecState, moving them into
+        OldInterpreterExecState, the fake scaffolding class.
+        
+        The clutter was making it hard to see the forest from the trees.
+        
+        .4% SunSpider speedup, probably because ExecState::lexicalGlobalObject()
+        is faster now.
+
+2008-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18643: SQUIRRELFISH: need to support implicit function calls (valueOf, toString, getters/setters)
+        <https://bugs.webkit.org/show_bug.cgi?id=18643>
+
+        Prevent static slot optimisation for new variables and functions in
+        globally re-entrant code called from an an implicit function call.
+
+        This is necessary to prevent us from needing to resize the global
+        slot portion of the root RegisterFile during an implicit (and hence
+        unguarded) function call.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/RegisterFile.h:
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::pushGlobalRegisterFile):
+        (KJS::RegisterFileStack::popGlobalRegisterFile):
+        (KJS::RegisterFileStack::pushFunctionRegisterFile):
+        (KJS::RegisterFileStack::popFunctionRegisterFile):
+        * VM/RegisterFileStack.h:
+        (KJS::RegisterFileStack::inImplicitFunctionCall):
+        (KJS::RegisterFileStack::lastGlobal):
+        * kjs/nodes.cpp:
+        (KJS::ProgramNode::generateCode):
+        * kjs/nodes.h:
+        (KJS::ProgramNode::):
+
+2008-04-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        In nested program code, don't propogate "this" back to the parent
+        register file. ("this" should remain constant in the parent register
+        file, regardless of the scripts it invokes.)
+
+        * VM/RegisterFile.cpp:
+        (KJS::RegisterFile::copyGlobals):
+
+2008-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Restore base pointer when popping a global RegisterFile
+
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::popGlobalRegisterFile):
+
+2008-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18643: SQUIRRELFISH: need to support implicit function calls (valueOf, toString, getters/setters)
+        <https://bugs.webkit.org/show_bug.cgi?id=18643>
+
+        Partial fix.  This results in all implicit calls to toString or valueOf
+        executing in a separate RegisterFile, so ensuring that the the pointers
+        in the triggering interpreter don't get trashed.  This still leaves the
+        task of preventing new global re-entry from toString and valueOf from
+        clobbering the RegisterFile.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::pushFunctionRegisterFile):
+        (KJS::RegisterFileStack::popFunctionRegisterFile):
+        * VM/RegisterFileStack.h:
+        * kjs/object.cpp:
+        (KJS::tryGetAndCallProperty):
+
+2008-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Simplified activation object a bit: No need to store the callee
+        in the activation object -- we can pull it out of the call frame
+        when needed, instead.
+        
+        SunSpider reports no change.
+
+2008-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        RS by Oliver Hunt on moving JSArguments.cpp out of AllInOneFile.cpp.
+
+        Substantially more handling of "arguments": "arguments" works fully
+        now, but "f.arguments" still doesn't work.
+
+        Fixes 10 regression tests.
+        
+        SunSpider reports no regression.
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::createArgumentsObject): Reconstruct an arguments
+        List to pass to the arguments object constructor.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp: Removed JSActivation.cpp from AllInOneFile.cpp
+        because that seems to make GCC happy. (Previously, I had added
+        JSActivation.cpp to AllInOneFile.cpp because *that* seemed to make GCC
+        happy. So it goes.)
+
+2008-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Groundwork for more handling of "arguments". I'm not checking in the
+        actual handling of "arguments" yet, because it still needs a little
+        fiddling to avoid a performance regression.
+        
+        SunSpider reports no change.
+
+        * VM/Machine.cpp:
+        (KJS::initializeCallFrame): Put argc in the register file, so the
+        arguments object can find it later, to determine arguments.length.
+
+        * kjs/nodes.h:
+        (KJS::FunctionBodyNode::): Added a special code accessor for when you
+        know the code has already been generated, and you don't have a scopeChain
+        to supply for potential code generation. (This is the case when the
+        activation object creates the arguments object.)
+
+2008-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Replace unsafe use of auto_ptr in Vector with manual memory
+        management.
+
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::~RegisterFileStack):
+        (KJS::RegisterFileStack::popRegisterFile):
+        * VM/RegisterFileStack.h:
+
+2008-04-27  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 18746: SQUIRRELFISH: indirect eval used when direct eval should be used
+        <https://bugs.webkit.org/show_bug.cgi?id=18746>
+
+        Change the base to the correct value of the 'this' object after the direct
+        eval test instead of before.
+
+        Fixes 5 layout tests.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/nodes.cpp:
+        (KJS::EvalFunctionCallNode::emitCode):
+
+2008-04-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - document all property getting, setting and deleting opcodes
+        
+        (And fix function parameter names to match corresponding opcode parameter names.)
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitResolve):
+        (KJS::CodeGenerator::emitResolveBase):
+        (KJS::CodeGenerator::emitResolveBaseAndProperty):
+        (KJS::CodeGenerator::emitResolveBaseAndFunc):
+        (KJS::CodeGenerator::emitGetPropId):
+        (KJS::CodeGenerator::emitPutPropId):
+        (KJS::CodeGenerator::emitDeletePropId):
+        (KJS::CodeGenerator::emitPutPropVal):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::resolve):
+        (KJS::resolveBase):
+        (KJS::resolveBaseAndProperty):
+        (KJS::resolveBaseAndFunc):
+        (KJS::Machine::privateExecute):
+        * kjs/nodes.cpp:
+        (KJS::ResolveNode::emitCode):
+        (KJS::ArrayNode::emitCode):
+        (KJS::PropertyListNode::emitCode):
+        (KJS::BracketAccessorNode::emitCode):
+        (KJS::EvalFunctionCallNode::emitCode):
+        (KJS::FunctionCallResolveNode::emitCode):
+        (KJS::FunctionCallBracketNode::emitCode):
+        (KJS::PostIncResolveNode::emitCode):
+        (KJS::PostDecResolveNode::emitCode):
+        (KJS::PostIncBracketNode::emitCode):
+        (KJS::PostDecBracketNode::emitCode):
+        (KJS::PostIncDotNode::emitCode):
+        (KJS::PostDecDotNode::emitCode):
+        (KJS::DeleteResolveNode::emitCode):
+        (KJS::TypeOfResolveNode::emitCode):
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::PreIncBracketNode::emitCode):
+        (KJS::PreDecBracketNode::emitCode):
+        (KJS::AssignResolveNode::emitCode):
+        (KJS::AssignDotNode::emitCode):
+        (KJS::ReadModifyDotNode::emitCode):
+        (KJS::AssignBracketNode::emitCode):
+        (KJS::ReadModifyBracketNode::emitCode):
+        (KJS::ConstDeclNode::emitCodeSingle):
+
+2008-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18628: SQUIRRELFISH: need to support recursion limit
+        <https://bugs.webkit.org/show_bug.cgi?id=18628>
+
+        Basically completes recursion limiting.  There is still some
+        tuning we may want to do to make things better in the face of
+        very bad code, but certainly nothing worse than anything already
+        possible in trunk.
+
+        Also fixes a WebKit test by fixing the exception text :D
+
+        * JavaScriptCore.exp:
+        * VM/ExceptionHelpers.cpp:
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/RegisterFile.cpp:
+        (KJS::RegisterFile::growBuffer):
+        (KJS::RegisterFile::addGlobalSlots):
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::grow):
+        (KJS::RegisterFile::uncheckedGrow):
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::pushRegisterFile):
+        * VM/RegisterFileStack.h:
+
+2008-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18628: SQUIRRELFISH: need to support recursion limit
+        <https://bugs.webkit.org/show_bug.cgi?id=18628>
+
+        Put a limit on the level of reentry recursion.  128 levels of re-entrant recursion
+        seems reasonable as it is greater than the old eval limit, and a long way short of
+        the reentry depth needed to overflow the stack.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/Machine.h:
+
+2008-04-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A tiny bit of cleanup to the regexp code.
+        
+        Removed some static_cast.
+        
+        Removed createRegExpImp because it's no longer used.
+
+2008-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18736: SQUIRRELFISH: switch statements with no default have incorrect codegen
+        <https://bugs.webkit.org/show_bug.cgi?id=18736>
+
+        Ensure the "default" target is correct in the absence of an explicit default handler.
+
+        * kjs/nodes.cpp:
+        (KJS::CaseBlockNode::emitCodeForBlock):
+
+2008-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18628: SQUIRRELFISH: need to support recursion limit
+        <https://bugs.webkit.org/show_bug.cgi?id=18628>
+
+        More bounds checking.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/RegisterFile.cpp:
+        (KJS::RegisterFile::growBuffer):
+        * VM/RegisterFile.h:
+
+2008-04-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix signal catching magic
+        
+        The signal handlers are restored to _exit but are only set when
+        running under run-javascriptcore-tests. fprintf from a signal
+        handler is not safe.
+
+        * kjs/testkjs.cpp:
+        (main):
+        (parseArguments):
+        * tests/mozilla/jsDriver.pl:
+
+2008-04-25  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 18732: SQUIRRELFISH: exceptions thrown by native constructors are ignored
+        <https://bugs.webkit.org/show_bug.cgi?id=18732>
+
+        Fixes another regression test.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-25  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 18728: SQUIRRELFISH: invalid regular expression constants should throw exceptions
+        <https://bugs.webkit.org/show_bug.cgi?id=18728>
+
+        Fixes another regression test.
+
+        * kjs/nodes.cpp:
+        (KJS::RegExpNode::emitCode):
+
+2008-04-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 18735: SQUIRRELFISH: closures are sometimes given an incorrect 'this' value when called
+        <https://bugs.webkit.org/show_bug.cgi?id=18735>
+
+        The overloaded toThisObject method was not copied over to JSActivation.
+
+        Fixes two regression tests.
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::toThisObject):
+        * kjs/JSActivation.h:
+
+2008-04-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Added support for arguments.callee.
+
+2008-04-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18628: SQUIRRELFISH: need to support recursion limit
+        <https://bugs.webkit.org/show_bug.cgi?id=18628>
+
+        Partial fix -- this gets us some of the required bounds checking, but not
+        complete coverage.  But it does manage to do them without regressing :D
+
+        * VM/ExceptionHelpers.cpp:
+        (KJS::createError):
+        (KJS::createStackOverflowError):
+        * VM/ExceptionHelpers.h:
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/RegisterFile.cpp:
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::):
+        (KJS::RegisterFile::RegisterFile):
+        (KJS::RegisterFile::grow):
+
+2008-04-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A tiny bit more handling of "arguments": create a real, but mostly
+        hollow, arguments object.
+        
+        Fixes 2 regression tests.
+
+2008-04-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 18717: SQUIRRELFISH: eval returns the wrong value for a variable declaration statement
+        <https://bugs.webkit.org/show_bug.cgi?id=18717>
+
+        Fixes a regression test, but exposes the failure of another due to the
+        lack of getters and setters.
+
+        * kjs/nodes.cpp:
+        (KJS::ConstDeclNode::emitCodeSingle):
+        (KJS::ConstDeclNode::emitCode):
+        (KJS::ConstStatementNode::emitCode):
+        (KJS::VarStatementNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Print a CRASH statement when crashing, so test failures are not a
+        mystery.
+
+        * kjs/testkjs.cpp:
+        (handleCrash):
+        (main):
+
+2008-04-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 18716: SQUIRRELFISH: typeof should return undefined for an undefined variable reference
+        <https://bugs.webkit.org/show_bug.cgi?id=18716>
+
+        This fixes 2 more regression tests.
+
+        * kjs/nodes.cpp:
+        (KJS::TypeOfResolveNode::emitCode):
+
+2008-04-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Put the callee in the call frame.
+        
+        Necessary in order to support "arguments" and "arguments.callee".
+
+        Also fixes a latent GC bug, where an executing function could be
+        subject to GC if the register holding it were overwritten. Here's
+        an example that would have caused problems:
+        
+        function f()
+        {
+            // Flood the machine stack to eliminate any old pointers to f.
+            g.call({});
+            
+            // Overwrite f in the register file.
+            f = 1;
+
+            // Force a GC.
+            for (var i = 0; i < 5000; ++i) {
+                ({});
+            }
+            
+            // Welcome to crash-ville.
+        }
+
+        function g()
+        {
+        }
+
+        f();
+
+        * VM/Machine.h: Changed the order of arguments to
+        execute(FunctionBodyNode*...) to match the other execute functions.
+        * kjs/function.cpp: Updated to match new argument requirements from
+        execute(FunctionBodyNode*...). Renamed newObj to thisObj to match the
+        rest of JavaScriptCore.
+
+        SunSpider reports no change.
+
+2008-04-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 18707: SQUIRRELFISH: eval always performs toString() on its argument
+        <https://bugs.webkit.org/show_bug.cgi?id=18707>
+
+        This fixes 4 more regression tests.
+
+        * VM/Machine.cpp:
+        (KJS::eval):
+
+2008-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix logic bug in SegmentedVector::grow which would sometimes fail to resize a segment when needed
+        
+        Fixes 3 JSC tests.
+
+        * VM/SegmentedVector.h:
+        (KJS::SegmentedVector::grow):
+
+2008-04-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Degenerate handling of "arguments" as a property of the activation
+        object. Currently, we just return a vanilla object.
+        
+        SunSpider reports no change.
+
+        Fixes:
+
+        ecma_3/Function/regress-94506.js.
+        
+        Reveals to have been secretly broken:
+
+        ecma_3/Function/15.3.4.3-1.js
+        ecma_3/Function/15.3.4.4-1.js
+        
+        These tests were passing incorrectly. testkjs creates a global array
+        named "arguments" to hold command-line arguments. That array was
+        tricking these tests into thinking that an arguments object with length
+        0 had been created. Since our new vanilla object shadows the global
+        property named arguments, that object no longer fools these tests into
+        passing.
+        
+        Net change: +1 failing test.
+
+        * kjs/AllInOneFile.cpp: Had to put JSActivation.cpp into AllInOneFile.cpp
+        to solve a surprising 8.6% regression in bitops-3bit-bits-in-byte.
+
+2008-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - save and restore callFrame
+
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * kjs/testkjs.cpp:
+        (main):
+
+2008-04-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed scopes for named function expressions.
+        
+        Fixes one regression test.
+        
+        Two changes here:
+        
+        (1) The function's name is supposed to have attributes DontDelete,
+        ReadOnly, regardless of the type of code executing.
+        
+        (2) Push the name object on the function's scope chain, rather than
+        the ExecState's scope chain because, well, that's where it belongs.
+
+2008-04-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Inlined JSObject::putDirect, for a .4% SunSpider speedup.
+        
+        I did this as a first step toward removing nodes.cpp from
+        AllInOneFile.cpp, but I'm putting that larger project aside for now.
+
+2008-04-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Geoff.
+        
+        - add OldInterpreterExecState class and use it in dead code
+        
+        This will allow removing things from the real ExecState class
+        without having to figure out how to remove all this code without
+        getting a perf regression.
+
+        * kjs/nodes.cpp:
+        (KJS::ExpressionNode::evaluateToNumber):
+        (KJS::ExpressionNode::evaluateToBoolean):
+        (KJS::ExpressionNode::evaluateToInt32):
+        (KJS::ExpressionNode::evaluateToUInt32):
+        (KJS::Node::setErrorCompletion):
+        (KJS::Node::throwError):
+        (KJS::Node::throwUndefinedVariableError):
+        (KJS::Node::handleException):
+        (KJS::Node::rethrowException):
+        (KJS::BreakpointCheckStatement::execute):
+        (KJS::BreakpointCheckStatement::optimizeVariableAccess):
+        (KJS::NullNode::evaluate):
+        (KJS::FalseNode::evaluate):
+        (KJS::TrueNode::evaluate):
+        (KJS::NumberNode::evaluate):
+        (KJS::NumberNode::evaluateToNumber):
+        (KJS::NumberNode::evaluateToBoolean):
+        (KJS::NumberNode::evaluateToInt32):
+        (KJS::NumberNode::evaluateToUInt32):
+        (KJS::ImmediateNumberNode::evaluate):
+        (KJS::ImmediateNumberNode::evaluateToInt32):
+        (KJS::ImmediateNumberNode::evaluateToUInt32):
+        (KJS::StringNode::evaluate):
+        (KJS::StringNode::evaluateToNumber):
+        (KJS::StringNode::evaluateToBoolean):
+        (KJS::RegExpNode::evaluate):
+        (KJS::ThisNode::evaluate):
+        (KJS::ResolveNode::inlineEvaluate):
+        (KJS::ResolveNode::evaluate):
+        (KJS::ResolveNode::evaluateToNumber):
+        (KJS::ResolveNode::evaluateToBoolean):
+        (KJS::ResolveNode::evaluateToInt32):
+        (KJS::ResolveNode::evaluateToUInt32):
+        (KJS::getSymbolTableEntry):
+        (KJS::ResolveNode::optimizeVariableAccess):
+        (KJS::LocalVarAccessNode::inlineEvaluate):
+        (KJS::LocalVarAccessNode::evaluate):
+        (KJS::LocalVarAccessNode::evaluateToNumber):
+        (KJS::LocalVarAccessNode::evaluateToBoolean):
+        (KJS::LocalVarAccessNode::evaluateToInt32):
+        (KJS::LocalVarAccessNode::evaluateToUInt32):
+        (KJS::getNonLocalSymbol):
+        (KJS::ScopedVarAccessNode::inlineEvaluate):
+        (KJS::ScopedVarAccessNode::evaluate):
+        (KJS::ScopedVarAccessNode::evaluateToNumber):
+        (KJS::ScopedVarAccessNode::evaluateToBoolean):
+        (KJS::ScopedVarAccessNode::evaluateToInt32):
+        (KJS::ScopedVarAccessNode::evaluateToUInt32):
+        (KJS::NonLocalVarAccessNode::inlineEvaluate):
+        (KJS::NonLocalVarAccessNode::evaluate):
+        (KJS::NonLocalVarAccessNode::evaluateToNumber):
+        (KJS::NonLocalVarAccessNode::evaluateToBoolean):
+        (KJS::NonLocalVarAccessNode::evaluateToInt32):
+        (KJS::NonLocalVarAccessNode::evaluateToUInt32):
+        (KJS::ElementNode::optimizeVariableAccess):
+        (KJS::ElementNode::evaluate):
+        (KJS::ArrayNode::optimizeVariableAccess):
+        (KJS::ArrayNode::evaluate):
+        (KJS::ObjectLiteralNode::optimizeVariableAccess):
+        (KJS::ObjectLiteralNode::evaluate):
+        (KJS::PropertyListNode::optimizeVariableAccess):
+        (KJS::PropertyListNode::evaluate):
+        (KJS::PropertyNode::optimizeVariableAccess):
+        (KJS::PropertyNode::evaluate):
+        (KJS::BracketAccessorNode::optimizeVariableAccess):
+        (KJS::BracketAccessorNode::inlineEvaluate):
+        (KJS::BracketAccessorNode::evaluate):
+        (KJS::BracketAccessorNode::evaluateToNumber):
+        (KJS::BracketAccessorNode::evaluateToBoolean):
+        (KJS::BracketAccessorNode::evaluateToInt32):
+        (KJS::BracketAccessorNode::evaluateToUInt32):
+        (KJS::DotAccessorNode::optimizeVariableAccess):
+        (KJS::DotAccessorNode::inlineEvaluate):
+        (KJS::DotAccessorNode::evaluate):
+        (KJS::DotAccessorNode::evaluateToNumber):
+        (KJS::DotAccessorNode::evaluateToBoolean):
+        (KJS::DotAccessorNode::evaluateToInt32):
+        (KJS::DotAccessorNode::evaluateToUInt32):
+        (KJS::ArgumentListNode::optimizeVariableAccess):
+        (KJS::ArgumentListNode::evaluateList):
+        (KJS::ArgumentsNode::optimizeVariableAccess):
+        (KJS::NewExprNode::optimizeVariableAccess):
+        (KJS::NewExprNode::inlineEvaluate):
+        (KJS::NewExprNode::evaluate):
+        (KJS::NewExprNode::evaluateToNumber):
+        (KJS::NewExprNode::evaluateToBoolean):
+        (KJS::NewExprNode::evaluateToInt32):
+        (KJS::NewExprNode::evaluateToUInt32):
+        (KJS::ExpressionNode::resolveAndCall):
+        (KJS::EvalFunctionCallNode::optimizeVariableAccess):
+        (KJS::EvalFunctionCallNode::evaluate):
+        (KJS::FunctionCallValueNode::optimizeVariableAccess):
+        (KJS::FunctionCallValueNode::evaluate):
+        (KJS::FunctionCallResolveNode::optimizeVariableAccess):
+        (KJS::FunctionCallResolveNode::inlineEvaluate):
+        (KJS::FunctionCallResolveNode::evaluate):
+        (KJS::FunctionCallResolveNode::evaluateToNumber):
+        (KJS::FunctionCallResolveNode::evaluateToBoolean):
+        (KJS::FunctionCallResolveNode::evaluateToInt32):
+        (KJS::FunctionCallResolveNode::evaluateToUInt32):
+        (KJS::LocalVarFunctionCallNode::inlineEvaluate):
+        (KJS::LocalVarFunctionCallNode::evaluate):
+        (KJS::LocalVarFunctionCallNode::evaluateToNumber):
+        (KJS::LocalVarFunctionCallNode::evaluateToBoolean):
+        (KJS::LocalVarFunctionCallNode::evaluateToInt32):
+        (KJS::LocalVarFunctionCallNode::evaluateToUInt32):
+        (KJS::ScopedVarFunctionCallNode::inlineEvaluate):
+        (KJS::ScopedVarFunctionCallNode::evaluate):
+        (KJS::ScopedVarFunctionCallNode::evaluateToNumber):
+        (KJS::ScopedVarFunctionCallNode::evaluateToBoolean):
+        (KJS::ScopedVarFunctionCallNode::evaluateToInt32):
+        (KJS::ScopedVarFunctionCallNode::evaluateToUInt32):
+        (KJS::NonLocalVarFunctionCallNode::inlineEvaluate):
+        (KJS::NonLocalVarFunctionCallNode::evaluate):
+        (KJS::NonLocalVarFunctionCallNode::evaluateToNumber):
+        (KJS::NonLocalVarFunctionCallNode::evaluateToBoolean):
+        (KJS::NonLocalVarFunctionCallNode::evaluateToInt32):
+        (KJS::NonLocalVarFunctionCallNode::evaluateToUInt32):
+        (KJS::FunctionCallBracketNode::optimizeVariableAccess):
+        (KJS::FunctionCallBracketNode::evaluate):
+        (KJS::FunctionCallDotNode::optimizeVariableAccess):
+        (KJS::FunctionCallDotNode::inlineEvaluate):
+        (KJS::FunctionCallDotNode::evaluate):
+        (KJS::FunctionCallDotNode::evaluateToNumber):
+        (KJS::FunctionCallDotNode::evaluateToBoolean):
+        (KJS::FunctionCallDotNode::evaluateToInt32):
+        (KJS::FunctionCallDotNode::evaluateToUInt32):
+        (KJS::PostIncResolveNode::optimizeVariableAccess):
+        (KJS::PostIncResolveNode::evaluate):
+        (KJS::PostIncLocalVarNode::evaluate):
+        (KJS::PostDecResolveNode::optimizeVariableAccess):
+        (KJS::PostDecResolveNode::evaluate):
+        (KJS::PostDecLocalVarNode::evaluate):
+        (KJS::PostDecLocalVarNode::inlineEvaluateToNumber):
+        (KJS::PostDecLocalVarNode::evaluateToNumber):
+        (KJS::PostDecLocalVarNode::evaluateToBoolean):
+        (KJS::PostDecLocalVarNode::evaluateToInt32):
+        (KJS::PostDecLocalVarNode::evaluateToUInt32):
+        (KJS::PostfixBracketNode::optimizeVariableAccess):
+        (KJS::PostIncBracketNode::evaluate):
+        (KJS::PostDecBracketNode::evaluate):
+        (KJS::PostfixDotNode::optimizeVariableAccess):
+        (KJS::PostIncDotNode::evaluate):
+        (KJS::PostDecDotNode::evaluate):
+        (KJS::PostfixErrorNode::evaluate):
+        (KJS::DeleteResolveNode::optimizeVariableAccess):
+        (KJS::DeleteResolveNode::evaluate):
+        (KJS::LocalVarDeleteNode::evaluate):
+        (KJS::DeleteBracketNode::optimizeVariableAccess):
+        (KJS::DeleteBracketNode::evaluate):
+        (KJS::DeleteDotNode::optimizeVariableAccess):
+        (KJS::DeleteDotNode::evaluate):
+        (KJS::DeleteValueNode::optimizeVariableAccess):
+        (KJS::DeleteValueNode::evaluate):
+        (KJS::VoidNode::optimizeVariableAccess):
+        (KJS::VoidNode::evaluate):
+        (KJS::TypeOfValueNode::optimizeVariableAccess):
+        (KJS::TypeOfResolveNode::optimizeVariableAccess):
+        (KJS::LocalVarTypeOfNode::evaluate):
+        (KJS::TypeOfResolveNode::evaluate):
+        (KJS::TypeOfValueNode::evaluate):
+        (KJS::PreIncResolveNode::optimizeVariableAccess):
+        (KJS::PreIncLocalVarNode::evaluate):
+        (KJS::PreIncResolveNode::evaluate):
+        (KJS::PreDecResolveNode::optimizeVariableAccess):
+        (KJS::PreDecLocalVarNode::evaluate):
+        (KJS::PreDecResolveNode::evaluate):
+        (KJS::PreIncConstNode::evaluate):
+        (KJS::PreDecConstNode::evaluate):
+        (KJS::PostIncConstNode::evaluate):
+        (KJS::PostDecConstNode::evaluate):
+        (KJS::PrefixBracketNode::optimizeVariableAccess):
+        (KJS::PreIncBracketNode::evaluate):
+        (KJS::PreDecBracketNode::evaluate):
+        (KJS::PrefixDotNode::optimizeVariableAccess):
+        (KJS::PreIncDotNode::evaluate):
+        (KJS::PreDecDotNode::evaluate):
+        (KJS::PrefixErrorNode::evaluate):
+        (KJS::UnaryPlusNode::optimizeVariableAccess):
+        (KJS::UnaryPlusNode::evaluate):
+        (KJS::UnaryPlusNode::evaluateToBoolean):
+        (KJS::UnaryPlusNode::evaluateToNumber):
+        (KJS::UnaryPlusNode::evaluateToInt32):
+        (KJS::UnaryPlusNode::evaluateToUInt32):
+        (KJS::NegateNode::optimizeVariableAccess):
+        (KJS::NegateNode::evaluate):
+        (KJS::NegateNode::evaluateToNumber):
+        (KJS::BitwiseNotNode::optimizeVariableAccess):
+        (KJS::BitwiseNotNode::inlineEvaluateToInt32):
+        (KJS::BitwiseNotNode::evaluate):
+        (KJS::BitwiseNotNode::evaluateToNumber):
+        (KJS::BitwiseNotNode::evaluateToBoolean):
+        (KJS::BitwiseNotNode::evaluateToInt32):
+        (KJS::BitwiseNotNode::evaluateToUInt32):
+        (KJS::LogicalNotNode::optimizeVariableAccess):
+        (KJS::LogicalNotNode::evaluate):
+        (KJS::LogicalNotNode::evaluateToBoolean):
+        (KJS::MultNode::optimizeVariableAccess):
+        (KJS::MultNode::inlineEvaluateToNumber):
+        (KJS::MultNode::evaluate):
+        (KJS::MultNode::evaluateToNumber):
+        (KJS::MultNode::evaluateToBoolean):
+        (KJS::MultNode::evaluateToInt32):
+        (KJS::MultNode::evaluateToUInt32):
+        (KJS::DivNode::optimizeVariableAccess):
+        (KJS::DivNode::inlineEvaluateToNumber):
+        (KJS::DivNode::evaluate):
+        (KJS::DivNode::evaluateToNumber):
+        (KJS::DivNode::evaluateToInt32):
+        (KJS::DivNode::evaluateToUInt32):
+        (KJS::ModNode::optimizeVariableAccess):
+        (KJS::ModNode::inlineEvaluateToNumber):
+        (KJS::ModNode::evaluate):
+        (KJS::ModNode::evaluateToNumber):
+        (KJS::ModNode::evaluateToBoolean):
+        (KJS::ModNode::evaluateToInt32):
+        (KJS::ModNode::evaluateToUInt32):
+        (KJS::throwOutOfMemoryErrorToNumber):
+        (KJS::addSlowCase):
+        (KJS::addSlowCaseToNumber):
+        (KJS::add):
+        (KJS::addToNumber):
+        (KJS::AddNode::optimizeVariableAccess):
+        (KJS::AddNode::evaluate):
+        (KJS::AddNode::inlineEvaluateToNumber):
+        (KJS::AddNode::evaluateToNumber):
+        (KJS::AddNode::evaluateToInt32):
+        (KJS::AddNode::evaluateToUInt32):
+        (KJS::AddNumbersNode::inlineEvaluateToNumber):
+        (KJS::AddNumbersNode::evaluate):
+        (KJS::AddNumbersNode::evaluateToNumber):
+        (KJS::AddNumbersNode::evaluateToInt32):
+        (KJS::AddNumbersNode::evaluateToUInt32):
+        (KJS::AddStringsNode::evaluate):
+        (KJS::AddStringLeftNode::evaluate):
+        (KJS::AddStringRightNode::evaluate):
+        (KJS::SubNode::optimizeVariableAccess):
+        (KJS::SubNode::inlineEvaluateToNumber):
+        (KJS::SubNode::evaluate):
+        (KJS::SubNode::evaluateToNumber):
+        (KJS::SubNode::evaluateToInt32):
+        (KJS::SubNode::evaluateToUInt32):
+        (KJS::LeftShiftNode::optimizeVariableAccess):
+        (KJS::LeftShiftNode::inlineEvaluateToInt32):
+        (KJS::LeftShiftNode::evaluate):
+        (KJS::LeftShiftNode::evaluateToNumber):
+        (KJS::LeftShiftNode::evaluateToInt32):
+        (KJS::LeftShiftNode::evaluateToUInt32):
+        (KJS::RightShiftNode::optimizeVariableAccess):
+        (KJS::RightShiftNode::inlineEvaluateToInt32):
+        (KJS::RightShiftNode::evaluate):
+        (KJS::RightShiftNode::evaluateToNumber):
+        (KJS::RightShiftNode::evaluateToInt32):
+        (KJS::RightShiftNode::evaluateToUInt32):
+        (KJS::UnsignedRightShiftNode::optimizeVariableAccess):
+        (KJS::UnsignedRightShiftNode::inlineEvaluateToUInt32):
+        (KJS::UnsignedRightShiftNode::evaluate):
+        (KJS::UnsignedRightShiftNode::evaluateToNumber):
+        (KJS::UnsignedRightShiftNode::evaluateToInt32):
+        (KJS::UnsignedRightShiftNode::evaluateToUInt32):
+        (KJS::lessThan):
+        (KJS::lessThanEq):
+        (KJS::LessNode::optimizeVariableAccess):
+        (KJS::LessNode::inlineEvaluateToBoolean):
+        (KJS::LessNode::evaluate):
+        (KJS::LessNode::evaluateToBoolean):
+        (KJS::LessNumbersNode::inlineEvaluateToBoolean):
+        (KJS::LessNumbersNode::evaluate):
+        (KJS::LessNumbersNode::evaluateToBoolean):
+        (KJS::LessStringsNode::inlineEvaluateToBoolean):
+        (KJS::LessStringsNode::evaluate):
+        (KJS::LessStringsNode::evaluateToBoolean):
+        (KJS::GreaterNode::optimizeVariableAccess):
+        (KJS::GreaterNode::inlineEvaluateToBoolean):
+        (KJS::GreaterNode::evaluate):
+        (KJS::GreaterNode::evaluateToBoolean):
+        (KJS::LessEqNode::optimizeVariableAccess):
+        (KJS::LessEqNode::inlineEvaluateToBoolean):
+        (KJS::LessEqNode::evaluate):
+        (KJS::LessEqNode::evaluateToBoolean):
+        (KJS::GreaterEqNode::optimizeVariableAccess):
+        (KJS::GreaterEqNode::inlineEvaluateToBoolean):
+        (KJS::GreaterEqNode::evaluate):
+        (KJS::GreaterEqNode::evaluateToBoolean):
+        (KJS::InstanceOfNode::optimizeVariableAccess):
+        (KJS::InstanceOfNode::evaluate):
+        (KJS::InstanceOfNode::evaluateToBoolean):
+        (KJS::InNode::optimizeVariableAccess):
+        (KJS::InNode::evaluate):
+        (KJS::InNode::evaluateToBoolean):
+        (KJS::EqualNode::optimizeVariableAccess):
+        (KJS::EqualNode::inlineEvaluateToBoolean):
+        (KJS::EqualNode::evaluate):
+        (KJS::EqualNode::evaluateToBoolean):
+        (KJS::NotEqualNode::optimizeVariableAccess):
+        (KJS::NotEqualNode::inlineEvaluateToBoolean):
+        (KJS::NotEqualNode::evaluate):
+        (KJS::NotEqualNode::evaluateToBoolean):
+        (KJS::StrictEqualNode::optimizeVariableAccess):
+        (KJS::StrictEqualNode::inlineEvaluateToBoolean):
+        (KJS::StrictEqualNode::evaluate):
+        (KJS::StrictEqualNode::evaluateToBoolean):
+        (KJS::NotStrictEqualNode::optimizeVariableAccess):
+        (KJS::NotStrictEqualNode::inlineEvaluateToBoolean):
+        (KJS::NotStrictEqualNode::evaluate):
+        (KJS::NotStrictEqualNode::evaluateToBoolean):
+        (KJS::BitAndNode::optimizeVariableAccess):
+        (KJS::BitAndNode::evaluate):
+        (KJS::BitAndNode::inlineEvaluateToInt32):
+        (KJS::BitAndNode::evaluateToNumber):
+        (KJS::BitAndNode::evaluateToBoolean):
+        (KJS::BitAndNode::evaluateToInt32):
+        (KJS::BitAndNode::evaluateToUInt32):
+        (KJS::BitXOrNode::optimizeVariableAccess):
+        (KJS::BitXOrNode::inlineEvaluateToInt32):
+        (KJS::BitXOrNode::evaluate):
+        (KJS::BitXOrNode::evaluateToNumber):
+        (KJS::BitXOrNode::evaluateToBoolean):
+        (KJS::BitXOrNode::evaluateToInt32):
+        (KJS::BitXOrNode::evaluateToUInt32):
+        (KJS::BitOrNode::optimizeVariableAccess):
+        (KJS::BitOrNode::inlineEvaluateToInt32):
+        (KJS::BitOrNode::evaluate):
+        (KJS::BitOrNode::evaluateToNumber):
+        (KJS::BitOrNode::evaluateToBoolean):
+        (KJS::BitOrNode::evaluateToInt32):
+        (KJS::BitOrNode::evaluateToUInt32):
+        (KJS::LogicalAndNode::optimizeVariableAccess):
+        (KJS::LogicalAndNode::evaluate):
+        (KJS::LogicalAndNode::evaluateToBoolean):
+        (KJS::LogicalOrNode::optimizeVariableAccess):
+        (KJS::LogicalOrNode::evaluate):
+        (KJS::LogicalOrNode::evaluateToBoolean):
+        (KJS::ConditionalNode::optimizeVariableAccess):
+        (KJS::ConditionalNode::evaluate):
+        (KJS::ConditionalNode::evaluateToBoolean):
+        (KJS::ConditionalNode::evaluateToNumber):
+        (KJS::ConditionalNode::evaluateToInt32):
+        (KJS::ConditionalNode::evaluateToUInt32):
+        (KJS::valueForReadModifyAssignment):
+        (KJS::ReadModifyResolveNode::optimizeVariableAccess):
+        (KJS::AssignResolveNode::optimizeVariableAccess):
+        (KJS::ReadModifyLocalVarNode::evaluate):
+        (KJS::AssignLocalVarNode::evaluate):
+        (KJS::ReadModifyConstNode::evaluate):
+        (KJS::AssignConstNode::evaluate):
+        (KJS::ReadModifyResolveNode::evaluate):
+        (KJS::AssignResolveNode::evaluate):
+        (KJS::AssignDotNode::optimizeVariableAccess):
+        (KJS::AssignDotNode::evaluate):
+        (KJS::ReadModifyDotNode::optimizeVariableAccess):
+        (KJS::ReadModifyDotNode::evaluate):
+        (KJS::AssignErrorNode::evaluate):
+        (KJS::AssignBracketNode::optimizeVariableAccess):
+        (KJS::AssignBracketNode::evaluate):
+        (KJS::ReadModifyBracketNode::optimizeVariableAccess):
+        (KJS::ReadModifyBracketNode::evaluate):
+        (KJS::CommaNode::optimizeVariableAccess):
+        (KJS::CommaNode::evaluate):
+        (KJS::ConstDeclNode::optimizeVariableAccess):
+        (KJS::ConstDeclNode::handleSlowCase):
+        (KJS::ConstDeclNode::evaluateSingle):
+        (KJS::ConstDeclNode::evaluate):
+        (KJS::ConstStatementNode::optimizeVariableAccess):
+        (KJS::ConstStatementNode::execute):
+        (KJS::statementListExecute):
+        (KJS::BlockNode::optimizeVariableAccess):
+        (KJS::BlockNode::execute):
+        (KJS::EmptyStatementNode::execute):
+        (KJS::ExprStatementNode::optimizeVariableAccess):
+        (KJS::ExprStatementNode::execute):
+        (KJS::VarStatementNode::optimizeVariableAccess):
+        (KJS::VarStatementNode::execute):
+        (KJS::IfNode::optimizeVariableAccess):
+        (KJS::IfNode::execute):
+        (KJS::IfElseNode::optimizeVariableAccess):
+        (KJS::IfElseNode::execute):
+        (KJS::DoWhileNode::optimizeVariableAccess):
+        (KJS::DoWhileNode::execute):
+        (KJS::WhileNode::optimizeVariableAccess):
+        (KJS::WhileNode::execute):
+        (KJS::ForNode::optimizeVariableAccess):
+        (KJS::ForNode::execute):
+        (KJS::ForInNode::optimizeVariableAccess):
+        (KJS::ForInNode::execute):
+        (KJS::ContinueNode::execute):
+        (KJS::BreakNode::execute):
+        (KJS::ReturnNode::optimizeVariableAccess):
+        (KJS::ReturnNode::execute):
+        (KJS::WithNode::optimizeVariableAccess):
+        (KJS::WithNode::execute):
+        (KJS::CaseClauseNode::optimizeVariableAccess):
+        (KJS::CaseClauseNode::evaluate):
+        (KJS::CaseClauseNode::executeStatements):
+        (KJS::ClauseListNode::optimizeVariableAccess):
+        (KJS::CaseBlockNode::optimizeVariableAccess):
+        (KJS::CaseBlockNode::executeBlock):
+        (KJS::SwitchNode::optimizeVariableAccess):
+        (KJS::SwitchNode::execute):
+        (KJS::LabelNode::optimizeVariableAccess):
+        (KJS::LabelNode::execute):
+        (KJS::ThrowNode::optimizeVariableAccess):
+        (KJS::ThrowNode::execute):
+        (KJS::TryNode::optimizeVariableAccess):
+        (KJS::TryNode::execute):
+        (KJS::ProgramNode::initializeSymbolTable):
+        (KJS::ScopeNode::optimizeVariableAccess):
+        (KJS::ProgramNode::processDeclarations):
+        (KJS::EvalNode::processDeclarations):
+        (KJS::ProgramNode::execute):
+        (KJS::EvalNode::execute):
+        (KJS::FunctionBodyNodeWithDebuggerHooks::execute):
+        (KJS::FuncDeclNode::execute):
+        (KJS::FuncExprNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::Node::):
+        (KJS::FalseNode::):
+        (KJS::TrueNode::):
+        (KJS::ArgumentsNode::):
+
+2008-04-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18672: SQUIRRELFISH: codegen fails with a large number of temporaries
+        <https://bugs.webkit.org/show_bug.cgi?id=18672>
+
+        Add a SegmentedVector type, which provides a Vector<T> which maintains
+        existing memory locations during resize.  This allows dynamically sizing
+        local, temporary and label "vectors" in CodeGenerator.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addVar):
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::newTemporary):
+        (KJS::CodeGenerator::newLabel):
+        * VM/CodeGenerator.h:
+        * VM/SegmentedVector.h: Added.
+        (KJS::SegmentedVector::SegmentedVector):
+        (KJS::SegmentedVector::~SegmentedVector):
+        (KJS::SegmentedVector::last):
+        (KJS::SegmentedVector::append):
+        (KJS::SegmentedVector::removeLast):
+        (KJS::SegmentedVector::size):
+        (KJS::SegmentedVector::operator[]):
+        (KJS::SegmentedVector::resize):
+        (KJS::SegmentedVector::shrink):
+        (KJS::SegmentedVector::grow):
+
+2008-04-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        A little refactoring in preparation for supporting 'arguments'.
+        
+        Fixes 2 regression tests.
+
+        SunSpider reports no change.        
+
+        We now check the activation register, instead of the codeBlock, to
+        determine whether we need to tear off the activation. This is to support
+        "f.arguments", which will create an activation/arguments pair for f,
+        even though the needsFullScopeChain flag is false for f's codeBlock.
+        
+        The test fixes resulted from calling initializeCallFrame for re-entrant
+        function code, instead of initializing (not enough) parts of the call
+        frame by hand.
+
+2008-04-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam.
+        
+        - propagate the "this" value properly to local eval
+        
+        (fixes a measly one regression test)
+
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::CodeBlock):
+        (KJS::ProgramCodeBlock::ProgramCodeBlock):
+        (KJS::EvalCodeBlock::EvalCodeBlock):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-22  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Add support for function declarations in eval code.
+
+        (this fixes 12 more regression tests)
+        
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * kjs/nodes.cpp:
+        (KJS::EvalNode::generateCode):
+
+2008-04-22  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Implement LabelNode.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::pushJumpContext):
+        (KJS::CodeGenerator::jumpContextForContinue):
+        (KJS::CodeGenerator::jumpContextForBreak):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::ForInNode::emitCode):
+        (KJS::ContinueNode::emitCode):
+        (KJS::BreakNode::emitCode):
+        (KJS::SwitchNode::emitCode):
+        (KJS::LabelNode::emitCode):
+
+2008-04-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed crash when unwinding from exceptions inside eval.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::unwindCallFrame): Don't assume that the top of the
+        current call frame's scope chain is an activation: it can be the global
+        object, instead.
+
+2008-04-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+
+        * kjs/testkjs.cpp:
+        (main): Convert signals to exit codes, so that crashing tests are
+        detected as regression test failures.
+
+2008-04-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Maciej Stachowiak.
+        
+        Renamed "needsActivation" to "needsFullScopeChain" because lying will
+        make hair grow on the backs of your hands.
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed ScopeChainNode lifetime problems:
+        
+        (1) In "with" and "catch" scopes, we would construct a ScopeChain
+        object and then jump across its destructor, leaking the ScopeChainNode
+        we had pushed.
+
+        (2) In global and eval scopes, we would fail to initially ref
+        "scopeChain", causing us to overrelease it later. Now that we ref
+        "scopeChain" properly, we also need to deref it when the script
+        terminates.
+
+        SunSpider reports a .2% regression, but an earlier round of ScopeChain
+        refactoring was a .4% speedup, so there.
+
+2008-04-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey.
+        
+        - use global object instead of null for "this" on unqualified calls
+        
+        This fixes 10 more JSC test regressions.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - throw proper exceptions for objects that don't implement call or construct
+        
+        This fixes 21 more JSC test regressions. It is also seemingly an
+        0.5% progression.
+
+        * VM/ExceptionHelpers.cpp:
+        (KJS::createNotAnObjectError):
+        (KJS::createNotAConstructorError):
+        (KJS::createNotAFunctionError):
+        * VM/ExceptionHelpers.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Implement emitCode for ConstDeclNode.
+
+        This fixes the crash (assertion) in js1_5/Scope/scope-001.js
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::registerForLocalConstInit):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::AssignResolveNode::emitCode):
+        (KJS::ConstDeclNode::emitCodeSingle):
+        (KJS::ConstDeclNode::emitCode):
+        (KJS::ConstStatementNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam.
+        
+        - add some support for the split window object
+
+        This fixes many layout tests.
+        
+        * VM/Machine.cpp:
+        (KJS::resolveBaseAndFunc): Use toThisObject() to ensure we get the
+        wrapper global, if one exists, as the "this" object.
+        * kjs/function.cpp:
+        (KJS::globalFuncEval): Use toGlobalObject() to handle the wrapper
+        case properly.
+
+2008-04-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - restore ScopeChain::operator= to avoid crash on many layout tests
+        
+        Otherwise, FunctionImp::setScope would cause a reference
+        underflow. I implemented using the copy construct and swap idiom.
+
+        * kjs/scope_chain.h:
+        (KJS::ScopeChain::swap):
+        (KJS::ScopeChain::operator=):
+
+2008-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18649: SQUIRRELFISH: correctly handle exceptions in eval code
+        <https://bugs.webkit.org/show_bug.cgi?id=18649>
+
+        Allocate a callframe for eval() and initialise with a null codeBlock to
+        indicate native code.  This prevents the unwinder from clobbering the
+        register stack.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed ScopeChain::push(ScopeChain&) because it was unused. Moved
+        ScopeChain::print to ScopeChainNode.
+        
+        ScopeChain is now nothing more than a resource-handling wrapper around
+        ScopeChainNode.
+
+2008-04-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 18671: SquirrelFish: continue inside switch fails
+        <https://bugs.webkit.org/show_bug.cgi?id=18671>
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::jumpContextForLabel):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::ContinueNode::emitCode):
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved push(JSObject*) and pop() from ScopeChain to ScopeChainNode,
+        rearranging scope_chain.h a bit.
+
+        SunSpider reports no change.
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved bottom() from ScopeChain to ScopeChainNode, simplifying it based
+        on the knowledge that the ScopeChain is never empty.
+
+        SunSpider reports no change.
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Moved begin() and end() from ScopeChain to ScopeChainNode. 
+        
+        Also marked a few methods "const".
+
+        SunSpider reports no change.
+        
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Turned ScopeChain::depth into a stand-alone function, and simplified it
+        a bit. 
+        
+        I also moved ScopeChain::depth to Machine.cpp because it doesn't report
+        the true depth of the ScopeChain -- just the Machine's perspective of
+        its depth within a given call frame.
+
+        SunSpider reports no change.
+        
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Removed indirection in ScopeChain::ref / ScopeChain::deref.
+        
+        SunSpider reports no change.
+        
+        * kjs/scope_chain.h:
+        (KJS::ScopeChain::ScopeChain):
+        (KJS::ScopeChain::~ScopeChain):
+        (KJS::ScopeChain::clear):
+
+2008-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Fix debug build
+
+        * kjs/nodes.cpp:
+        (KJS::ConstDeclNode::evaluateSingle):
+
+2008-04-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 18664: SQUIRRELFISH: correctly throw a SyntaxError when parsing of eval code fails
+        <https://bugs.webkit.org/show_bug.cgi?id=18664>
+
+        Correctly throw a SyntaxError when parsing of eval code fails.
+
+        * VM/Machine.cpp:
+        (KJS::eval):
+
+2008-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Partial fix for Bug 18649: SQUIRRELFISH: correctly handle exceptions in eval code
+
+        Make sure we correct the register state before jumping to vm_throw.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Simplified ScopeChain ref/deref.
+        
+        SunSpider reports a .4% speedup.
+        
+        * kjs/scope_chain.h:
+        (KJS::ScopeChainNode::ref): Removed this function because it was nonsense.
+        ScopeChainNodes are initialized with a refCount of 1, so the loop was
+        guaranteed to iterate exactly once.
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Removed support for empty ScopeChains.
+
+        SunSpider reports no change.
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Removed some completely unused ScopeChain member functions.
+
+        SunSpider reports no change.
+
+2008-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Avoid creating unnecessary ScopeChain objects, to reduce refcount churn.
+
+        SunSpider reports no change.
+
+2008-04-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Alexey.
+        
+        Add some braces.x
+
+        * kjs/testkjs.cpp:
+        (runWithScripts):
+
+2008-04-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - only print "End:" output when -d flag is passed.
+        
+        This fixes half of our failing JSC regression tests.
+
+        * kjs/testkjs.cpp:
+        (runWithScripts):
+
+2008-04-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Add support for variable declarations in eval code.
+
+        * VM/CodeBlock.h:
+        (KJS::EvalCodeBlock::EvalCodeBlock):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/Machine.h:
+        * kjs/function.cpp:
+        (KJS::globalFuncEval):
+        * kjs/nodes.cpp:
+        (KJS::EvalNode::generateCode):
+        * kjs/nodes.h:
+        (KJS::EvalNode::):
+
+2008-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Throw exceptions for invalid continue, break, and return statements.
+
+        Simple refactoring and extension of Cameron's AssignErrorNode, etc patch
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::pushJumpContext):
+        (KJS::CodeGenerator::popJumpContext):
+        (KJS::CodeGenerator::jumpContextForLabel):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::Node::emitThrowError):
+        (KJS::ContinueNode::emitCode):
+        (KJS::BreakNode::emitCode):
+        (KJS::ReturnNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Removed Machine.cpp from AllInOneFile.cpp, and manually inlined a few
+        things that used to be inlined automatically.
+        
+        1.9% speedup on SunSpider.
+        
+        My hope is that we'll face fewer surprises in Machine.cpp codegen, now
+        that GCC is making fewer decisions. The speedup seems to confirm that.
+
+2008-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18642: Iterator context may get placed into the return register, leading to much badness
+        <https://bugs.webkit.org/show_bug.cgi?id=18642>
+
+        To prevent incorrectly reusing what will become the result register for
+        eval and global code execution, we need to request and ref the destination
+        in advance of codegen.  Unfortunately this may lead to unnecessary copying,
+        although in future we can probably limit this.  Curiously SunSpider shows
+        a progression in a number of tests, although it comes out as a wash overall.
+
+        * kjs/nodes.cpp:
+        (KJS::EvalNode::emitCode):
+        (KJS::ProgramNode::emitCode):
+
+2008-04-20  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Add support for AssignErrorNode, PrefixErrorNode, and PostfixErrorNode.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCreateError):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::PostfixErrorNode::emitCode):
+        (KJS::PrefixErrorNode::emitCode):
+        (KJS::AssignErrorNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff and Mark.
+
+        Provide line number information in exceptions
+
+        Simple patch, adds line number information metadata to CodeBlock
+        and a simple method to get the line number responsible for a given
+        Instruction*.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::lineNumberForVPC):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::emitNode):
+        * VM/Machine.cpp:
+        (KJS::Machine::throwException):
+
+2008-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Provide "sourceURL" in exceptions
+
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::throwException):
+        * kjs/nodes.cpp:
+        (KJS::EvalNode::generateCode):
+        (KJS::ProgramNode::generateCode):
+
+2008-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Don't call emitCode directly on subnodes, instead use CodeGenerator::emitNode
+
+        This patch just a preparation for tracking line numbers.
+
+        * kjs/nodes.cpp:
+        (KJS::ObjectLiteralNode::emitCode):
+        (KJS::PropertyListNode::emitCode):
+        (KJS::ArgumentListNode::emitCode):
+        (KJS::TryNode::emitCode):
+
+2008-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18619: Support continue, break, and return in try .. finally blocks
+        <https://bugs.webkit.org/show_bug.cgi?id=18619>
+
+        This patch replaces the current partial finally support (which uses code
+        duplication to achieve what it does) with a subroutine based approach.
+        This has a number of advantages over code duplication:
+          * Reduced code size
+          * Simplified exception handling as the finaliser code only exists in 
+            one place, so no "magic" is needed to get the correct handler for a 
+            finaliser.
+          * When we support instruction to line number mapping we won't need to
+            worry about the dramatic code movement caused by duplication
+
+        On the downside it is necessary to add two new opcodes, op_jsr and op_sret
+        to enter and exit the finaliser subroutines, happily SunSpider reports
+        a performance progression (gcc amazes me) and ubench reports a wash.
+
+        While jsr and sret provide a mechanism that allows us to enter and exit
+        any arbitrary finaliser we need to, it was still necessary to increase
+        the amount of information tracked when entering and exiting both finaliser
+        scopes and dynamic scopes ("with").  This means "scopeDepth" is now
+        the combination of "finaliserDepth" and "dynamicScopeDepth".  We also
+        now use a scopeContextStack to ensure that we pop scopes and execute
+        finalisers in the correct order.  This increases the cost of "with" nodes
+        during codegen, but it should not be significant enough to effect real
+        world performance and greatly simplifies codegen for return, break and
+        continue when interacting with finalisers.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+          Pretty printing of jsr/sret opcodes
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::emitPushScope):
+        (KJS::CodeGenerator::emitPopScope):
+          Dynamic scopes need to be tracked on the scopeContextStack now
+
+        (KJS::CodeGenerator::pushFinallyContext):
+        (KJS::CodeGenerator::popFinallyContext):
+          Handle entry and exit from code regions with finalisers.  This is
+          needed solely to support return, continue and break inside finaliser
+          regions.
+
+        (KJS::CodeGenerator::emitComplexJumpScopes):
+          Helper function for emitJumpScopes to handle the complex codegen
+          needed to handle return, continue and break inside a finaliser region
+
+        (KJS::CodeGenerator::emitJumpScopes):
+          Updated to be aware of finalisers, if a cross-scope jump occurs inside
+          a finaliser we hand off codegen to emitComplexJumpScopes, otherwise
+          we can handle the normal (trivial) case with a single instruction.
+
+        (KJS::CodeGenerator::emitJumpSubroutine):
+        (KJS::CodeGenerator::emitSubroutineReturn):
+          Trivial opcode emitter functions.
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::scopeDepth):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+          Implement op_jsr and op_sret.
+
+        * VM/Opcode.h:
+          Ad op_jsr and op_sret
+
+        * kjs/nodes.cpp:
+        (KJS::TryNode::emitCode):
+          Fix codegen for new finaliser model.
+
+2008-04-17  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove unnecessary files from testkjs, testapi and minidom targets.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed ASSERT seen during run-sunspider of a debug build.
+
+        * VM/CodeGenerator.h: Made the default codegen buffers bigger. SunSpider
+        runs all tests in one global environment, so you end up with more than
+        128 locals. This is just a stop-gap until we code up a real
+        solution to arbitrary symbol and label limits.
+
+2008-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed a bug in exception unwinding, where we wouldn't deref the scope
+        chain in global scope, so we would leak ScopeChainNodes when exceptions
+        were thrown inside "with" and "catch" scopes.
+        
+        Also did some cleanup of the unwinding code along the way.
+        
+        Scope chain reference counting is still wrong in a few ways. I thought
+        I would fix this portion of it first.
+        
+        run-sunspider shows no change.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::throwException):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+
+2008-04-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Add more exception checking to toNumber conversions
+
+        This corrects op_pre_dec, op_negate, op_mod and op_sub.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-17  Geoffrey Garen  <ggaren@apple.com> and Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+        
+        Behold: eval.
+        
+        Introduced a new opcode: op_call_eval. In the normal case, it performs
+        an eval. In the case where eval has been overridden in some way, it
+        performs a function call.
+
+        * VM/CodeGenerator.h: Added a feature so the code generator knows not
+        to optimized locals in eval code.
+        
+2008-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added some ASSERTs to document codegen failures in
+        run-javascriptcore-tests.
+        
+        For all tests, program-level codegen now either succeeds, or fails with
+        an ASSERT.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addVar):
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::newTemporary):
+        (KJS::CodeGenerator::newLabel):
+
+2008-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed another case of a dst register being an unreferenced temporary
+        (caused an ASSERT when running the full sunspider suite).
+
+        * kjs/nodes.cpp:
+        (KJS::CaseBlockNode::emitCodeForBlock):
+
+2008-04-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - add documentation (and meaningful parameter names) for arithmetic and bitwise binary ops
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitMul):
+        (KJS::CodeGenerator::emitDiv):
+        (KJS::CodeGenerator::emitMod):
+        (KJS::CodeGenerator::emitSub):
+        (KJS::CodeGenerator::emitLeftShift):
+        (KJS::CodeGenerator::emitRightShift):
+        (KJS::CodeGenerator::emitUnsignedRightShift):
+        (KJS::CodeGenerator::emitBitAnd):
+        (KJS::CodeGenerator::emitBitXOr):
+        (KJS::CodeGenerator::emitBitOr):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::MultNode::emitCode):
+        (KJS::DivNode::emitCode):
+        (KJS::ModNode::emitCode):
+        (KJS::SubNode::emitCode):
+        (KJS::LeftShiftNode::emitCode):
+        (KJS::RightShiftNode::emitCode):
+        (KJS::UnsignedRightShiftNode::emitCode):
+        (KJS::BitAndNode::emitCode):
+        (KJS::BitXOrNode::emitCode):
+        (KJS::BitOrNode::emitCode):
+        (KJS::emitReadModifyAssignment):
+        (KJS::ReadModifyResolveNode::emitCode):
+
+2008-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Exception checks for toNumber in op_pre_inc
+
+        This is somewhat more convoluted than the simple hadException checks
+        we currently use.  Instead we use special toNumber conversions that
+        select between the exception and ordinary vPC.  This allows us to 
+        remove any branches in the common case (incrementing a number).
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::toNumber):
+        * ChangeLog:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/JSPropertyNameIterator.cpp:
+        (KJS::JSPropertyNameIterator::toNumber):
+        * VM/JSPropertyNameIterator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        * kjs/ExecState.h:
+        * kjs/JSNotAnObject.cpp:
+        (KJS::JSNotAnObject::toNumber):
+        * kjs/JSNotAnObject.h:
+        * kjs/internal.cpp:
+        (KJS::StringImp::toNumber):
+        (KJS::NumberImp::toNumber):
+        (KJS::GetterSetterImp::toNumber):
+        * kjs/internal.h:
+        * kjs/object.cpp:
+        (KJS::JSObject::toNumber):
+        * kjs/object.h:
+        * kjs/value.h:
+        (KJS::JSValue::toNumber):
+
+2008-04-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - ensure that activations are kept in a register to protect them from GC
+        
+        Also renamed OptionalCalleeScopeChain constant to OptionalCalleeActivation, since
+        that is what is now kept there, and there is no more need to keep the scope chain in
+        the register file.
+
+        * VM/Machine.cpp:
+        (KJS::initializeCallFrame):
+        (KJS::scopeChainForCall):
+        * VM/Machine.h:
+        (KJS::Machine::):
+
+2008-04-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Made "this" work in program code / global scope.
+        
+        The machine can initialize "this" prior to execution because it knows
+        that, for program code, "this" is always stored in lr1. 
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/Machine.h:
+        (KJS::Machine::):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+
+2008-04-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed a codegen bug when returning from inside a dynamic scope (a with
+        or catch block): we need to pop any dynamic scope(s) that have been
+        added so op_ret can find the activation object at the top of the scope
+        chain.
+
+        * kjs/nodes.cpp:
+        (KJS::ReturnNode::emitCode): If we're returning from inside a dynamic
+        scope, emit a jmp_scopes to take care of popping any dynamic scope(s)
+        and then branching to the return instruction.
+
+2008-04-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - document the add and get_prop_id opcodes
+        
+        In addition to adding documentation in comments, I changed
+        references to register IDs or indices relating to these opcodes to
+        have meaningful names instead of r0 r1 r2.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitAdd):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/nodes.cpp:
+        (KJS::DotAccessorNode::emitCode):
+        (KJS::FunctionCallDotNode::emitCode):
+        (KJS::PostIncDotNode::emitCode):
+        (KJS::PostDecDotNode::emitCode):
+        (KJS::PreIncDotNode::emitCode):
+        (KJS::PreDecDotNode::emitCode):
+        (KJS::AddNode::emitCode):
+        (KJS::ReadModifyDotNode::emitCode):
+
+2008-04-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Maciej Stachowiak.
+        
+        Fixed a codegen bug in with and switch, and added an ASSERT to
+        make sure it doesn't happen again.
+        
+        emitCode() assumes that dst, if non-zero, is either referenced or
+        non-temporary (i.e., it assumes that newTemporary() will return a
+        register not equal to dst). Certain callers to emitCode() weren't
+        guaranteeing that to be so, so temporary register values were being
+        overwritten.
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::emitNode): ASSERT that dst is referenced or non-temporary.
+
+        * kjs/nodes.cpp:
+        (KJS::CommaNode::emitCode): Reference the dst we pass.
+
+        (KJS::WithNode::emitCode): No need to pass an explicit dst register.
+        
+        (KJS::CaseBlockNode::emitCodeForBlock): No need to pass an explicit dst register.
+        (KJS::SwitchNode::emitCode): No need to pass an explicit dst register.
+
+        * kjs/nodes.h: Made dst the last parameter to emitCodeForBlock, to match
+        emitCode.
+
+2008-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18526: Throw exceptions when resolve fails for op_resolve_base_and_func.
+        <https://bugs.webkit.org/show_bug.cgi?id=18526>
+
+        Very simple fix, sunspider shows a 0.7% progression, ubench shows a 0.4% regression.
+
+        * VM/Machine.cpp:
+        (KJS::resolveBaseAndFunc):
+        (KJS::Machine::privateExecute):
+
+2008-04-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix incorrect result on 3d-raytrace test
+        
+        Oliver found and tracked down this bug, I just typed in the fix.
+
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall): When setting omitted parameters to undefined,
+        account for the space for local variables.
+
+2008-04-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix codegen handling of dst registers
+        
+        1.006x speedup (not sure why).
+        
+        Most emitCode functions take an optional "dst" parameter that says
+        where the output of the instruction should be written. I made some
+        functions for convenient handling of the dst register:
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::tempDestination): Takes the dst register. Returns it if
+        it is not null and is a temporary, otherwise allocates a new temporary. This is
+        intended for cases where an intermediate value might be written into the dst
+
+        (KJS::CodeGenerator::finalDestination): Takes the dst register and an optional
+        register that was used as a temp destination. Picks the right thing for the final
+        output. Intended to be used as the output register for the instruction that generates
+        the final value of a particular node.
+        
+        (KJS::CodeGenerator::moveToDestinationIfNeeded): Takes dst and a
+        RegisterID; moves from the register to dst if dst is defined and
+        different from the register. This is intended for cases where the
+        result of a node is already in a specific register (likely a
+        local), and so no code needs to be generated unless a specific
+        destination has been requested, in which case a move is needed.
+        
+        I also applied these methods throughout emitCode functions. In
+        some cases this was just cleanup, in other cases I fixed actual
+        codegen bugs. Below I have given specific comments for the cases
+        where I believe I fixed a codegen bug, or improved quality of codegen.
+        
+        * kjs/nodes.cpp:
+        (KJS::NullNode::emitCode):
+        (KJS::FalseNode::emitCode):
+        (KJS::TrueNode::emitCode):
+        (KJS::NumberNode::emitCode):
+        (KJS::StringNode::emitCode):
+        (KJS::RegExpNode::emitCode):
+        (KJS::ThisNode::emitCode): Now avoids emitting a mov when dst is
+        the same as the this register (the unlikely case of "this = this");
+        (KJS::ResolveNode::emitCode): Now avoids emitting a mov when dst
+        is the same as the local regiester, in the local var case (the
+        unlikely case of "x = x");
+        (KJS::ArrayNode::emitCode): Fixed a codegen bug where array
+        literal element expressions may have observed an intermediate
+        value of constructing the array.
+        (KJS::ObjectLiteralNode::emitCode): 
+        (KJS::PropertyListNode::emitCode): Fixed a codegen bug where object literal
+        property definition expressions may have obesrved an intermediate value of
+        constructing the object.
+        (KJS::BracketAccessorNode::emitCode):
+        (KJS::DotAccessorNode::emitCode):
+        (KJS::NewExprNode::emitCode):
+        (KJS::FunctionCallValueNode::emitCode):
+        (KJS::FunctionCallBracketNode::emitCode):
+        (KJS::FunctionCallDotNode::emitCode):
+        (KJS::PostIncResolveNode::emitCode):
+        (KJS::PostDecResolveNode::emitCode):
+        (KJS::PostIncBracketNode::emitCode):
+        (KJS::PostDecBracketNode::emitCode):
+        (KJS::PostIncDotNode::emitCode):
+        (KJS::PostDecDotNode::emitCode):
+        (KJS::DeleteResolveNode::emitCode):
+        (KJS::DeleteBracketNode::emitCode):
+        (KJS::DeleteDotNode::emitCode):
+        (KJS::DeleteValueNode::emitCode):
+        (KJS::VoidNode::emitCode):
+        (KJS::TypeOfResolveNode::emitCode):
+        (KJS::TypeOfValueNode::emitCode):
+        (KJS::PreIncResolveNode::emitCode): Fixed a codegen bug where the final
+        value would not be output to the dst register in the local var case.
+        (KJS::PreDecResolveNode::emitCode): Fixed a codegen bug where the final
+        value would not be output to the dst register in the local var case.
+        (KJS::PreIncBracketNode::emitCode):
+        (KJS::PreDecBracketNode::emitCode):
+        (KJS::PreIncDotNode::emitCode):
+        (KJS::PreDecDotNode::emitCode):
+        (KJS::UnaryPlusNode::emitCode):
+        (KJS::NegateNode::emitCode):
+        (KJS::BitwiseNotNode::emitCode):
+        (KJS::LogicalNotNode::emitCode):
+        (KJS::MultNode::emitCode):
+        (KJS::DivNode::emitCode):
+        (KJS::ModNode::emitCode):
+        (KJS::AddNode::emitCode):
+        (KJS::SubNode::emitCode):
+        (KJS::LeftShiftNode::emitCode):
+        (KJS::RightShiftNode::emitCode):
+        (KJS::UnsignedRightShiftNode::emitCode):
+        (KJS::LessNode::emitCode):
+        (KJS::GreaterNode::emitCode):
+        (KJS::LessEqNode::emitCode):
+        (KJS::GreaterEqNode::emitCode):
+        (KJS::InstanceOfNode::emitCode):
+        (KJS::InNode::emitCode):
+        (KJS::EqualNode::emitCode):
+        (KJS::NotEqualNode::emitCode):
+        (KJS::StrictEqualNode::emitCode):
+        (KJS::NotStrictEqualNode::emitCode):
+        (KJS::BitAndNode::emitCode):
+        (KJS::BitXOrNode::emitCode):
+        (KJS::BitOrNode::emitCode):
+        (KJS::LogicalAndNode::emitCode):
+        (KJS::LogicalOrNode::emitCode):
+        (KJS::ConditionalNode::emitCode):
+        (KJS::emitReadModifyAssignment): Allow an out argument separate from the operands,
+        needed for fixes below.
+        (KJS::ReadModifyResolveNode::emitCode): Fixed a codegen bug where the right side of
+        the expression may observe an intermediate value.
+        (KJS::AssignResolveNode::emitCode): Fixed a codegen bug where the right side of the
+        expression may observe an intermediate value.
+        (KJS::ReadModifyDotNode::emitCode): Fixed a codegen bug where the right side of the
+        expression may observe an intermediate value.
+        (KJS::ReadModifyBracketNode::emitCode): Fixed a codegen bug where the right side of the
+        expression may observe an intermediate value.
+        (KJS::CommaNode::emitCode): Avoid writing temporary value to dst register.
+        (KJS::ReturnNode::emitCode): Void return should return undefined, not null.
+        (KJS::FuncExprNode::emitCode):
+
+2008-04-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix huge performance regression (from trunk) in string-unpack-code
+        
+        This restores string-unpack-code performance to parity with
+        trunk (2.27x speedup relative to previous SquirrelFish)
+        
+        * VM/Machine.cpp:
+        (KJS::Machine::execute): Shrink register file after call to avoid
+        growing repeatedly.
+
+2008-04-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed dumpCallFrame to match our new convention of passing around a
+        ScopeChainNode* instead of a ScopeChain*.
+
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (KJS::Machine::dumpCallFrame):
+        * VM/Machine.h:
+
+2008-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18436: Need to throw exception on read/modify/write or similar resolve for nonexistent property
+        <https://bugs.webkit.org/show_bug.cgi?id=18436>
+
+        Add op_resolve_base_and_property for read/modify/write operations,
+        this adds a "superinstruction" to resolve the base and value of a
+        property simultaneously.  Just using resolveBase and resolve results 
+        in an 5% regression in ubench, 30% in loop-empty-resolve (which is 
+        expected).  1.3% progression in sunspider, 2.1% in ubench, with a 
+        21% gain in loop-empty-resolve.  The only outlier is function-missing-args
+        which gets a 3% regression that I could never resolve.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitResolveBaseAndProperty):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::resolveBaseAndProperty):
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::PostIncResolveNode::emitCode):
+        (KJS::PostDecResolveNode::emitCode):
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::ReadModifyResolveNode::emitCode):
+
+2008-04-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fixed "SquirrelFish crashes due to bad scope chain on some SunSpider tests"
+        https://bugs.webkit.org/show_bug.cgi?id=18508
+
+        3d-raytrace and string-unpack-code now run.
+        
+        The basic approach is to pass around ScopeChainNode* instead of
+        ScopeChain*, which in addition to not becoming suddenly an invalid
+        pointer also saves an indirection.
+        
+        This is an 0.4% speedup on SunSpider --squirrelfish (1.8% on --ubench)
+        
+        * VM/Machine.cpp:
+        (KJS::resolve):
+        (KJS::resolveBase):
+        (KJS::resolveBaseAndFunc):
+        (KJS::initializeCallFrame):
+        (KJS::scopeChainForCall):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::throwException):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        * VM/Register.h:
+        (KJS::Register::):
+        * kjs/nodes.cpp:
+        (KJS::EvalNode::generateCode):
+        (KJS::FunctionBodyNode::generateCode):
+        (KJS::ProgramNode::generateCode):
+        (KJS::ProgramNode::processDeclarations):
+        (KJS::EvalNode::processDeclarations):
+        (KJS::FuncDeclNode::makeFunction):
+        (KJS::FuncExprNode::makeFunction):
+        * kjs/nodes.h:
+        (KJS::ProgramNode::):
+        (KJS::EvalNode::):
+        (KJS::FunctionBodyNode::):
+        * kjs/object.h:
+        * kjs/scope_chain.h:
+        (KJS::ScopeChainNode::ScopeChainNode):
+        (KJS::ScopeChainNode::deref):
+        (KJS::ScopeChainIterator::ScopeChainIterator):
+        (KJS::ScopeChainIterator::operator*):
+        (KJS::ScopeChainIterator::operator->):
+        (KJS::ScopeChain::ScopeChain):
+        (KJS::ScopeChain::node):
+        (KJS::ScopeChain::deref):
+        (KJS::ScopeChain::ref):
+        (KJS::ScopeChainNode::ref):
+        (KJS::ScopeChainNode::release):
+        (KJS::ScopeChainNode::begin):
+        (KJS::ScopeChainNode::end):
+
+2008-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed crash when accessing registers in a torn-off activation object.
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::copyRegisters): Update our registerOffset after
+        copying our registers, since our offset should now be relative to
+        our private register array, not the shared register file.
+
+2008-04-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix a codegen flaw that makes some tests run way too fast or way too slow
+        
+        The basic problem was that FunctionCallResolveNode results in
+        codegen which can incorrectly write an intermediate value into the
+        dst register even when that is a local. I added convenience
+        functions to CodeGenerator for getting this right, but for now I
+        only fixed FunctionCallResolve.
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::tempDestination):
+        (KJS::CodeGenerator::):
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallResolveNode::emitCode):
+
+2008-04-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed and slightly tweaked by Geoffrey Garen.
+
+        Bug 18489: Squirrelfish doesn't build on linux
+        <https://bugs.webkit.org/show_bug.cgi?id=18489>
+
+        * JavaScriptCore.pri: Add VM into include path and its files into
+        source set
+        * VM/JSPropertyNameIterator.cpp: Fix include name
+        * VM/Machine.cpp: Add UNLIKELY macro for GCC
+        * VM/Machine.h: Add missing includes
+        * VM/RegisterFile.cpp: Add missing include
+        * kjs/testkjs.pro: Add VM into include path
+
+2008-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Restored OwnPtr in some places where I had removed it previously. We
+        can have an OwnPtr to an undefined class in a header as long as the
+        class's destructor isn't in the header.
+        
+2008-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed access to "this" inside dynamic scopes.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::registerForLocal): Always return a register for
+        "this", even if we're not optimizing access to other locals. Because
+        "this" is a keyword, it's always in a register and always accessible.
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::shouldOptimizeLocals): Factored out a function
+        for determining whether we should optimize access to locals, since
+        eval will need to make this test a little more complicated.
+
+2008-04-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam.
+        
+        - fix crash when running SunSpider full harness
+        
+        When growing the register file's buffer to make space for new globals,
+        make sure to copy accounting for the fact that the new space is logically
+        at the beginning of the buffer in this case, instead of at the end as when
+        growing for a new call frame.
+
+        * VM/RegisterFile.cpp:
+        (KJS::RegisterFile::newBuffer):
+        (KJS::RegisterFile::growBuffer):
+        (KJS::RegisterFile::addGlobalSlots):
+        * VM/RegisterFile.h:
+
+2008-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Mark constant pools for global and eval code (collectively known as
+        "program code"). (Constant pools for function code are already marked by
+        their functions.)
+        
+        The global object is responsible for marking program code constant
+        pools. Code blocks add themselves to the mark set at creation time, and
+        remove themselves from the mark set at destruction time.
+        
+        sunspider --squirrelfish reports a 1% speedup, perhaps because
+        generateCode() is now non-virtual.
+
+        * kjs/nodes.cpp: I had to use manual init and delete in this file
+        because putting an OwnPtr into the header would have created a circular
+        header dependency.
+
+2008-04-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 18231: Improve support for function call nodes in SquirrelFish
+        <https://bugs.webkit.org/show_bug.cgi?id=18231>
+
+        Use correct value of 'this' for function calls.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitResolveBaseAndFunc):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::resolveBaseAndFunc):
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallResolveNode::emitCode):
+
+2008-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        This time for sure.
+
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+
+2008-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed Interpreter::execute to honor the new model for returning non-NULL
+        values when an exception is thrown.
+
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+
+2008-04-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Fix SquirrelFish interpreter to pass internal exceptions back to 
+        native code correctly.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace the use of getCallData in op_construct with the new
+        getConstructData function that replaces implementsConstruct.
+
+        * API/JSCallbackConstructor.cpp:
+        (KJS::JSCallbackConstructor::getConstructData):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::getConstructData):
+        (KJS::::construct):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsConstructor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/CallData.h:
+        * kjs/ConstructData.h: Copied from JavaScriptCore/kjs/CallData.h.
+        * kjs/array_object.cpp:
+        (KJS::ArrayObjectImp::getConstructData):
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        (KJS::BooleanObjectImp::getConstructData):
+        * kjs/bool_object.h:
+        * kjs/date_object.cpp:
+        (KJS::DateObjectImp::getConstructData):
+        * kjs/date_object.h:
+        * kjs/error_object.cpp:
+        (KJS::ErrorObjectImp::getConstructData):
+        (KJS::NativeErrorImp::getConstructData):
+        * kjs/error_object.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::getCallData):
+        (KJS::FunctionImp::getConstructData):
+        (KJS::FunctionImp::construct):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::getConstructData):
+        * kjs/function_object.h:
+        * kjs/nodes.cpp:
+        (KJS::NewExprNode::inlineEvaluate):
+        * kjs/number_object.cpp:
+        (KJS::NumberObjectImp::getConstructData):
+        * kjs/number_object.h:
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        (KJS::ObjectObjectImp::getConstructData):
+        * kjs/object_object.h:
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpObjectImp::getConstructData):
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (KJS::StringObjectImp::getConstructData):
+        * kjs/string_object.h:
+        * kjs/value.cpp:
+        (KJS::JSCell::getConstructData):
+        * kjs/value.h:
+        (KJS::JSValue::getConstructData):
+
+2008-04-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18420: SquirrelFish: need to throw Reference and Type errors 
+        when attempting invalid operations on JSValues
+
+        Add validation and exception checks to SquirrelFish so that the
+        correct exceptions are thrown for undefined variables, type errors
+        and toObject failure.  Also handle exceptions thrown by native
+        function calls.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/ExceptionHelpers.cpp: Added.
+        (KJS::substitute):
+        (KJS::createError):
+        (KJS::createUndefinedVariableError):
+        * VM/ExceptionHelpers.h: Added.
+          Helper functions
+        * VM/Machine.cpp:
+        (KJS::resolve):
+           Modified to signal failure
+        (KJS::isNotObject):
+           Wrapper for JSValue::isObject and exception creation (these need
+           to be merged, lest GCC go off the deep end)
+        (KJS::Machine::privateExecute):
+           Adding the many exception and validity checks.
+
+        * kjs/JSNotAnObject.cpp: Added.
+          Stub object used to reduce the need for multiple exception checks
+          when toObject fails.
+        (KJS::JSNotAnObject::toPrimitive):
+        (KJS::JSNotAnObject::getPrimitiveNumber):
+        (KJS::JSNotAnObject::toBoolean):
+        (KJS::JSNotAnObject::toNumber):
+        (KJS::JSNotAnObject::toString):
+        (KJS::JSNotAnObject::toObject):
+        (KJS::JSNotAnObject::mark):
+        (KJS::JSNotAnObject::getOwnPropertySlot):
+        (KJS::JSNotAnObject::put):
+        (KJS::JSNotAnObject::deleteProperty):
+        (KJS::JSNotAnObject::defaultValue):
+        (KJS::JSNotAnObject::construct):
+        (KJS::JSNotAnObject::callAsFunction):
+        (KJS::JSNotAnObject::getPropertyNames):
+        * kjs/JSNotAnObject.h: Added.
+        (KJS::JSNotAnObject::JSNotAnObject):
+        * kjs/JSImmediate.cpp:
+        (KJS::JSImmediate::toObject):
+          modified to create an JSNotAnObject rather than throwing an exception
+          directly.
+
+2008-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Pass a function body node its function's scope chain, rather than the
+        current execution context's scope chain, when compiling it.
+        
+        This doesn't matter yet, but it will once we start using the scope
+        chain during compilation.
+
+        sunspider --squirrelfish notes a tiny speedup.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fix two bugs when throwing exceptions from re-entrant JS calls:
+        
+        (1) Don't shrink the register file to 0, since our caller may still
+        be using it.
+        
+        (2) In case of exception, return jsNull() instead of 0 because,
+        surprisingly, some JavaScriptCore clients rely on a function's return
+        value being safe to operate on even if the function threw an exception.
+        
+        Also:
+        
+        - Changed FunctionImp::callAsFunction to honor the new semantics of
+        exceptions not returning 0.
+        
+        - Renamed "handlerPC" to "handlerVPC" to match other uses of "VPC".
+        
+        - Renamed "exceptionData" to "exceptionValue", because "data" seemed to
+        imply something more than just a JSValue.
+        
+        - Merged prepareException into throwException, since throwException was
+        its only caller, and it seemed weird that throwException didn't take
+        an exception as an argument.
+
+        sunspider --squirrelfish does not seem to complain on my machine, but it
+        complains a little (.6%) on Oliver's.
+
+2008-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed op_construct for CallTypeNative to reacquire "r" before setting
+        its return value, since registerBase can theoretically change during the
+        execution of arbitrary code. (Not sure if any native constructors
+        actually make this possible.)
+
+        sunspider --squirrelfish does not seem to complain.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Sam Weinig.
+        
+        Re-entrant execution of function code (global code -> built-in function
+        -> JS function):
+        
+        Miraculously, sunspider --squirrelfish does not seem to complain.
+
+        A re-entrant function call is the same as a normal function call with
+        one exception: the re-entrant call leaves everything except for
+        CallerCodeBlock in the call frame header uninitialized, since the call
+        doesn't need to return to JS code. (It sets CallerCodeBlock to 0, to
+        indicate that the call shouldn't return to JS code.)
+        
+        Also fixed a few issues along the way:
+        
+        - Fixed two bugs in the read-write List implementation that caused
+        m_size and m_buffer to go stale.
+        
+        - Changed native call code to update "r" *before* setting the return
+        value, since the call may in turn call JS code, which changes the value
+        of "r".
+        
+        - Migrated initialization of "r" outside of Machine::privateExecute,
+        because global code and function code initialize "r" differently.
+        
+        - Migrated a codegen warning from Machine::privateExecute to the wiki.
+        
+        - Removed unnecessary "r" parameter from slideRegisterWindowForCall
+
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall):
+        (KJS::scopeChainForCall):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        * kjs/list.cpp:
+        (KJS::List::getSlice):
+        * kjs/list.h:
+        (KJS::List::clear):
+
+2008-04-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix problem with code generation for return with no argument
+        
+        3d-cube now runs
+
+        * kjs/nodes.cpp:
+        (KJS::ReturnNode::emitCode):
+
+2008-04-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - Implement support for JS constructors
+        
+        access-binary-trees and access-nbody now run.
+        
+        Inexplicably a 1% speedup.
+
+        * VM/Machine.cpp:
+        (KJS::initializeCallFrame):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        (KJS::Machine::):
+
+2008-04-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+
+        - More code cleanup in preparation for JS constructors
+
+        Factor the remaining interesting parts of JS function calls into
+        slideRegisterWindowForCall and scopeChainForCall.
+        
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall):
+        (KJS::scopeChainForCall):
+        (KJS::Machine::privateExecute):
+
+2008-04-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - Code cleanup in preparation for JS constructors
+
+        - Renamed returnInfo to callFrame. 
+        - Made an enum which defines what goes where in the call frame.
+        - Factored out initializeCallFrame function from op_call
+        
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCall):
+        (KJS::CodeGenerator::emitConstruct):
+        * VM/Machine.cpp:
+        (KJS::Machine::dumpRegisters):
+        (KJS::initializeCallFrame):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        (KJS::Machine::):
+
+2008-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed two bugs in register allocation for function calls:
+        
+        (1) op_call used to allocate codeBlock->numVars too many registers for
+        each call frame, due to duplicated math. Fixing this revealed...
+        
+        (2) By unconditionally calling resize(), op_call used to truncate the
+        register file when calling a function whose registers fit wholly within
+        the register file already allocated by its caller.
+        
+        sunspider --squirrelfish reports no regression.
+        
+        I also threw in a little extra formatting to dumpCallFrame, because it
+        helped me debug these issues.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::dumpRegisters):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::shrink):
+        (KJS::RegisterFile::grow):
+        * VM/RegisterFileStack.cpp:
+        (KJS::RegisterFileStack::popRegisterFile):
+
+2008-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Next step toward re-entrant execution of function code (global code ->
+        built-in function -> JS function):
+        
+        Made op_ret return from Machine::privateExecute if its calling codeBlock
+        is NULL.
+        
+        I'm checking this in by itself to demonstrate that a more clever
+        mechanism is not necessary for performance.
+        
+        sunspider --squirrelfish reports no regression.
+
+        * ChangeLog:
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+
+2008-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Next step toward re-entrant execution of function code (global code ->
+        built-in function -> JS function):
+        
+        Made Machine::execute return a value.
+        
+        Sketched out some code for Machine::execute for functions -- still
+        doesn't work yet, though.
+
+        sunspider --squirrelfish reports no regression.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+        * kjs/testkjs.cpp:
+        (runWithScripts):
+
+2008-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        First step toward re-entrant execution of function code (global code ->
+        built-in function -> JS function):
+        
+        Tiny bit of refactoring in the Machine class.
+
+        sunspider --squirrelfish reports no regression.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::dumpRegisters):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        (KJS::Machine::isGlobalCallFrame):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+
+2008-04-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Support for re-entrant execution of global code (global code -> built-in
+        function -> global code).
+        
+        Keep a stack of register files instead of just one. Globals propogate
+        between register files as the register files enter and exit the stack.
+        
+        An activation still uses its own register file's base as its
+        registerBase, but the global object uses the register file *stack*'s
+        registerBase, which updates dynamically to match the register file at
+        the top of the stack.
+        
+        sunspider --squirrelfish reports no regression.
+
+2008-04-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - initial preparatory work for JS constructors
+        
+        1) Allocate registers for the returnInfo block and "this" value when generating code for
+        op_construct. These are not used yet, but the JS branch of op_construct will use them.
+        
+        2) Adjust argc and argv appropriately for native constructor calls.
+        
+        3) Assign return value in a more straightforward way in op_ret since this is actually
+        a bit faster (and makes up for the allocation of extra registers above).
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitConstruct):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed crashing SunSpider tests.
+        
+        Let's just pretend this never happened, bokay?
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator):
+        * VM/CodeGenerator.h:
+        * VM/RegisterFile.cpp:
+        (KJS::RegisterFile::addGlobals):
+
+2008-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Restored dumping of generated code as a command-line switch:
+        run-testkjs -d will do it.
+
+2008-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Next step toward supporting re-entrant evaluation: Moved register file
+        maintenance code into a proper "RegisterFile" class.
+        
+        There's a subtle change to the register file's internal layout: for
+        global code / the global object, registerOffset is always 0 now. In
+        other words, all register counting starts at 0, not 0 + (number of
+        global variables). The helps simplify accounting when the number of
+        global variables changes.
+
+2008-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18338: Support exceptions in SquirrelFish <http://bugs.webkit.org/show_bug.cgi?id=18338>
+        
+        Initial support for exceptions in SquirrelFish, only supports finalisers in the
+        simple cases (eg. exceptions and non-goto/return across finaliser boundaries).
+        This doesn't add the required exception checks to existing code, it merely adds
+        support for throw, catch, and the required stack unwinding.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        (KJS::CodeBlock::getHandlerForVPC):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCatch):
+        (KJS::CodeGenerator::emitThrow):
+        * VM/CodeGenerator.h:
+        * VM/JSPropertyNameIterator.cpp:
+        (KJS::JSPropertyNameIterator::create):
+        * VM/Machine.cpp:
+        (KJS::prepareException):
+        (KJS::Machine::unwindCallFrame):
+        (KJS::Machine::throwException):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::ThrowNode::emitCode):
+        (KJS::TryNode::emitCode):
+        * kjs/nodes.h:
+        * kjs/scope_chain.cpp:
+        (KJS::ScopeChain::depth):
+        * kjs/scope_chain.h:
+
+2008-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        First step toward supporting re-entrant evaluation: Switch register
+        clients from using "registers", a pointer to a register vector, to
+        "registerBase", an indirect pointer to the logical first entry in the
+        register file. (The logical first entry is the first entry that is not
+        a global variable).
+        
+        With a vector, offsets into the register file remain good when the
+        underlying buffer reallocates, but they go bad when the logical
+        first entry moves. (The logical first entry moves when new global
+        variables get added to the beginning of the register file.) With an
+        indirect pointer to the logical first entry, offsets will remain good
+        regardless.
+
+        1.4% speedup on sunspider --squirrelfish. I suspect this is due to
+        reduced allocation when creating closures, and reduced indirection
+        through the register vector.
+
+        * wtf/Vector.h: Added an accessor for an indirect pointer to the vector's
+        buffer, which we currently use (incorrectly) for registerBase. This is
+        temporary scaffolding to allow us to change client code without
+        changing behavior.
+
+2008-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement codegen for ReadModifyDotNode.
+
+        * kjs/nodes.cpp:
+        (KJS::ReadModifyDotNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix codegen for PostIncDotNode and implement codegen for PostIncBracketNode,
+        PostDecBracketNode and PostDecDotNode.
+
+        * kjs/nodes.cpp:
+        (KJS::PostIncBracketNode::emitCode):
+        (KJS::PostDecBracketNode::emitCode):
+        (KJS::PostIncDotNode::emitCode):
+        (KJS::PostDecDotNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement codegen for PreDecResolveNode, PreIncBracketNode, PreDecBracketNode,
+        PreIncDotNode and PreDecDotNode.  This required adding one new op code, op_pre_dec.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitPreDec):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::PreDecResolveNode::emitCode):
+        (KJS::PreIncBracketNode::emitCode):
+        (KJS::PreDecBracketNode::emitCode):
+        (KJS::PreIncDotNode::emitCode):
+        (KJS::PreDecDotNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Improved register dumping, plus a liberal smattering of "const". Here's
+        what the new format looks like:
+
+        (gdb) call (void)dumpCallFrame(codeBlock, scopeChain, registers->begin(), r)
+        4 instructions; 48 bytes at 0x509210; 3 locals (2 parameters); 1 temporaries
+
+        [   0] load             lr1, undefined(@k0)
+        [   3] load             lr1, 2(@k1)
+        [   6] add              tr0, lr2, lr1
+        [  10] ret              tr0
+
+        Constants:
+          k0 = undefined
+          k1 = 2
+
+        Register frame: 
+
+        ----------------------------------------
+             use      |   address  |    value   
+        ----------------------------------------
+        [return info] |   0x80ac08 |   0x5081c0 
+        [return info] |   0x80ac0c |   0x508e90 
+        [return info] |   0x80ac10 |   0x504acc 
+        [return info] |   0x80ac14 |        0x2 
+        [return info] |   0x80ac18 |        0x0 
+        [return info] |   0x80ac1c |        0x7 
+        [return info] |   0x80ac20 |        0x0 
+        ----------------------------------------
+        [param]       |   0x80ac24 |        0x1 
+        [param]       |   0x80ac28 |        0x7 
+        [var]         |   0x80ac2c |        0xb 
+        [temp]        |   0x80ac30 |        0xf 
+
+2008-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support for evaluating multiple scripts in the same global environment.
+        (Still don't support re-entrant evaluation yet.)
+
+        The main changes here are:
+
+        (1) Obey the ECMA 10.1.3 rules regarding how to resolve collisions when
+        a given symbol is declared more than once. (This patch fixes the same
+        issue for function code, too.)
+        
+        (2) In the case of var and/or function collisions, reuse the existing
+        storage slot. For global code, this is required for previously
+        generated instructions to continue to work. For function code, it's
+        more of a "nice to have": it makes register layout in the case of
+        collisions easier to understand, and has the added benefit of saving
+        memory.
+        
+        (3) Allocate slots in the CodeGenerator's m_locals vector in parallel
+        to register indexes in the symbol table. This ensures that, given an
+        index in the symbol table, we can find the corresponding RegisterID
+        without hashing, which speeds up codegen. 
+        
+        I moved responsibility for emitting var and function initialization
+        instructions into the CodeGenerator, because bookkeeping in cases where
+        var, function, and/or parameter names collide requires a lot of
+        internal knowledge about the CodeGenerator.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addVar): Removed responsibility for checking whether
+        a var declaration overwrites "arguments", because the check is
+        inappropriate for global code, which may not have a pre-existing
+        "arguments" symbol in scope. Also changed this function to return a
+        boolean indicating whether addVar actually created a new RegisterID,
+        or just reused an old one.
+        
+        (KJS::CodeGenerator::CodeGenerator): Split out the constructors for
+        function code and global code, since they're quite different now.
+        
+        (KJS::CodeGenerator::registerForLocal): This function does its job
+        without any hashing now.
+        
+        * VM/Machine.cpp: Move old globals and update "r" before executing a
+        new script. That way, old globals stay at a constant offset from "r",
+        and previously optimized code still works.
+        
+        * VM/RegisterID.h: Added the ability to allocate a RegisterID before
+        initializing its index field. We use this for parameters now.
+
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableGet): Changed the ungettable getter
+        ASSERT to account for the fact that symbol indexes are all negative.
+
+2008-04-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement codegen for InNode.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitIn):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::InNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        - Implement codegen for DeleteResolveNode, DeleteBracketNode, DeleteDotNode and DeleteValueNode.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitGetPropId):
+        (KJS::CodeGenerator::emitPutPropId):
+        (KJS::CodeGenerator::emitDeletePropId):
+        (KJS::CodeGenerator::emitDeletePropVal):
+        (KJS::CodeGenerator::emitPutPropIndex):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::DeleteResolveNode::emitCode):
+        (KJS::DeleteBracketNode::emitCode):
+        (KJS::DeleteDotNode::emitCode):
+        (KJS::DeleteValueNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        - Implement codegen for Switch statements.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::pushJumpContext):
+        (KJS::CodeGenerator::popJumpContext):
+        (KJS::CodeGenerator::jumpContextForLabel):
+        * VM/CodeGenerator.h:
+        Rename LoopContext to JumpContext now that it used of Switch statements in addition
+        to loops.
+
+        * kjs/nodes.cpp:
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::ForInNode::emitCode):
+        (KJS::ContinueNode::emitCode):
+        (KJS::BreakNode::emitCode):
+        (KJS::CaseBlockNode::emitCodeForBlock):
+        (KJS::SwitchNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::CaseClauseNode::expr):
+        (KJS::CaseClauseNode::children):
+        (KJS::CaseBlockNode::):
+
+2008-04-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam.
+        
+        - fix crash in codegen from new nodes
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitConstruct):
+        * kjs/nodes.h:
+
+2008-04-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+
+        * kjs/nodes.cpp:
+        (KJS::ReadModifyResolveNode::emitCode):
+        (KJS::ReadModifyBracketNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - take a shot at marking constant pools for global and eval code
+        
+        Geoff says this won't really work in all cases but is an ok stopgap.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::mark):
+
+2008-04-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - fix 2x perf regression in 3d-morph
+        
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): If we subbed in null for the global object,
+        don't toObject it, since that will throw an exception (very slowly).
+
+2008-04-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Geoff
+        
+        - fix Release build
+
+        * kjs/nodes.cpp:
+        (KJS::getNonLocalSymbol):
+
+2008-04-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Removed the last vestiges of LocalStorage from JSVariableObject and
+        JSGlobalObject.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::saveLocalStorage): Save and restore from/to
+        registers. Use stub isReadOnly and isDontEnum methods for now, until
+        we really implement attributes in the symbol table.
+        (KJS::JSGlobalObject::restoreLocalStorage):
+        (KJS::JSGlobalObject::reset):
+
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::getPropertyNames): Use stub isDontEnum method
+        for now, as above.
+        (KJS::JSVariableObject::getPropertyAttributes): ditto
+
+        * kjs/JSVariableObject.h: Removed LocalStorage from JSVariableObjectData.
+        Removed mark method, because subclasses implement different strategies for
+        marking registers.
+        (KJS::JSVariableObject::isReadOnly): Stub method
+        (KJS::JSVariableObject::isDontEnum): ditto
+
+        Changed the code below to ASSERT_NOT_REACHED() and return 0, since it
+        can no longer retrieve LocalStorage from the ExecState. (Eventually,
+        we'll just remove this code and all its friends, but that's a task for
+        later.)
+        
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        * kjs/function.cpp:
+        (KJS::ActivationImp::markChildren):
+        * kjs/function.h:
+        * kjs/nodes.cpp:
+        (KJS::getNonLocalSymbol):
+        (KJS::ScopeNode::optimizeVariableAccess):
+        (KJS::ProgramNode::processDeclarations):
+
+2008-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Got globals?
+        
+        To get things working, I had to roll out
+        http://trac.webkit.org/projects/webkit/changeset/31226 for the time
+        being.
+
+        * VM/CodeBlock.h: Removed obsolete function.
+        
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): For the sake of re-entrancy, we track
+        and restore the global object's old rOffset value. (No way to test this
+        yet, but I think it will work.)
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - mark the constant pool (at least for function code blocks)
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::mark):
+        * VM/CodeBlock.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::mark):
+        * kjs/nodes.cpp:
+        (KJS::ScopeNode::mark):
+        * kjs/nodes.h:
+        (KJS::FuncExprNode::body):
+        (KJS::FuncDeclNode::body):
+
+2008-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Cleaned up a few loose ends.
+
+        * JavaScriptCore.exp: Export dumpRegisters, so it's visible to gdb even
+        if we don't explicitly call it in the source text.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): No need to call dumpRegisters anymore,
+        since that was just a hack for gdb's sake.
+
+        * kjs/JSActivation.h: Removed obsolete comment.
+
+        * VM/CodeGenerator.cpp: Added ASSERTs to verify that the localCount
+        we're given matches the number of locals actually allocated.
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::CodeGenerator): Changed "localCount" to include
+        the parameter count, since we're using the word "local" to mean
+        parameter, var, function, or "this". Renamed "m_nextLocal" to
+        "m_nextVar", since "m_nextLocal" doesn't contrast well with
+        "m_nextParameter".
+        
+        Also moved tracking of implicit "this" parameter from here...
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNode::generateCode): ... to here
+        (KJS::ProgramNode::generateCode): ... and here
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump): Added missing "\n".
+
+2008-04-01  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 18274: ResolveNode::emitCode() doesn't make a new temporary when dst
+                   is 0, leading to incorrect codegen
+        <http://bugs.webkit.org/show_bug.cgi?id=18274>
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallBracketNode::emitCode):
+        (KJS::FunctionCallDotNode::emitCode):
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - fix bug in for..in codegen (gotta use ident, not m_ident)
+
+        * kjs/nodes.cpp:
+        (KJS::ForInNode::emitCode):
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - Add suport for regexp literals
+
+        * VM/CodeBlock.cpp:
+        (KJS::regexpToSourceString):
+        (KJS::regexpName):
+        (KJS::CodeBlock::dump):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addRegExp):
+        (KJS::CodeGenerator::emitNewRegExp):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::RegExpNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff
+
+        Add support for for..in nodes
+        
+        Added two new opcodes to get_pnames and next_pname to handle iterating
+        over the set of properties on an object.  This iterator is explicitly
+        invalidated and the property name array is released on standard exit
+        from the loop, otherwise we rely on GC to do the clean up for us.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitNextPropertyName):
+        (KJS::CodeGenerator::emitGetPropertyNames):
+        * VM/CodeGenerator.h:
+        * VM/JSPropertyNameIterator.cpp: Added.
+        (KJS::JSPropertyNameIterator::JSPropertyNameIterator):
+        (KJS::JSPropertyNameIterator::type):
+        (KJS::JSPropertyNameIterator::toPrimitive):
+        (KJS::JSPropertyNameIterator::getPrimitiveNumber):
+        (KJS::JSPropertyNameIterator::toBoolean):
+        (KJS::JSPropertyNameIterator::toNumber):
+        (KJS::JSPropertyNameIterator::toString):
+        (KJS::JSPropertyNameIterator::toObject):
+        (KJS::JSPropertyNameIterator::mark):
+        (KJS::JSPropertyNameIterator::next):
+        (KJS::JSPropertyNameIterator::invalidate):
+        (KJS::JSPropertyNameIterator::~JSPropertyNameIterator):
+        (KJS::JSPropertyNameIterator::create):
+        * VM/JSPropertyNameIterator.h: Added.
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * VM/Register.h:
+        (KJS::Register::):
+        * kjs/PropertyNameArray.h:
+        * kjs/nodes.cpp:
+        (KJS::ForInNode::emitCode):
+        * kjs/nodes.h:
+        * kjs/value.h:
+
+2008-04-01  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Change CodeGenerator::emitCall() so it increments the reference count of
+        registers passed to it, and change its callers so they don't needlessly
+        increment the reference count of the registers they are passing.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCall):
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallResolveNode::emitCode):
+        (KJS::FunctionCallDotNode::emitCode):
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - generate call for PostIncDotNode
+
+        * kjs/nodes.cpp:
+        (KJS::PostIncDotNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix.
+        
+        - fix build (not sure how this ever worked?)
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallBracketNode::emitCode):
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - generate code for FunctionCallBracketNode
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallBracketNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff.
+        
+        - Fix two crashing SunSpider tests
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): set up 'this' properly for native calls.
+        * kjs/list.h:
+        (KJS::List::List): Fix intialization of buffer and size from
+        vector, the initialization order was wrong.
+
+2008-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: marked ASSERT-only variables as UNUSED_PARAMs.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableInitializeVariable):
+
+2008-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Next step toward global code: Moved get, put, and initializeVariable
+        functionality up into JSVariableObject, and changed JSActivation to
+        rely on it. 
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::JSActivation):
+        (KJS::JSActivation::getOwnPropertySlot):
+        (KJS::JSActivation::put):
+        (KJS::JSActivation::initializeVariable):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::valueAt):
+        (KJS::JSVariableObject::isReadOnly):
+        (KJS::JSVariableObject::symbolTableGet):
+        (KJS::JSVariableObject::symbolTablePut):
+        (KJS::JSVariableObject::symbolTableInitializeVariable):
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam.
+        
+        - fix HashTable assertion on some SunSpider tests
+        
+        Don't use -1 as the deleted value for JSValue*-keyed hashtables,
+        since it is a valid value (it's the immediate for -1).
+
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::JSValueHashTraits::emptyValue):
+        (KJS::CodeGenerator::JSValueHashTraits::deletedValue):
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::impossibleValue):
+
+2008-04-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add support for calling Native constructors like new Array(). 
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitConstruct):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::NewExprNode::emitCode):
+        * kjs/nodes.h:
+
+2008-04-01  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam.
+        
+        - add some missing toOpbject calls to avoid crashing when calling methods on primitives
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Changed Machine::dumpRegisters to take a pointer instead of a reference,
+        so gdb understands how to call it.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::dumpRegisters):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+
+2008-03-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Fix CodeGenerator::addConstant() so it uses the functionExpressions
+        counter for function expressions, not the functions counter.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addConstant):
+
+2008-03-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add emitCode support for TypeOfResolveNode and TypeOfValueNode.
+        Added new opcode op_type_of to handle them.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitNot):
+        (KJS::CodeGenerator::emitInstanceOf):
+        (KJS::CodeGenerator::emitTypeOf):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::jsTypeStringForValue):
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::TypeOfResolveNode::emitCode):
+        (KJS::TypeOfValueNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix non-computed goto version of isOpcode. op_end is a valid opcode.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::isOpcode):
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Added op_post_dec.
+
+2008-03-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoffrey Garen.
+
+        Add support for FunctionCallDotNode.
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallDotNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Next step toward global code: Removed more obsolete API, moved
+        saveLocalStorage and restoreLocalStorage to JSGlobalObject subclass,
+        since it's only intended for use there.
+        
+        * ChangeLog:
+        * JavaScriptCore.exp:
+        * kjs/Activation.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::saveLocalStorage):
+        (KJS::JSGlobalObject::restoreLocalStorage):
+        * kjs/JSGlobalObject.h:
+        * kjs/JSVariableObject.cpp:
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::JSVariableObjectData::JSVariableObjectData):
+        * kjs/function.cpp:
+        (KJS::ActivationImp::ActivationImp):
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Next step toward global code: subclass JSActivation + JSActivationData
+        from JSVariableObject + JSVariableObjectData.
+        
+        JSActivation now relies on JSVariableObject for access to registers and
+        symbol table, and for some delete functionality, but not for anything
+        else yet.
+
+        (KJS::JSActivation::mark): Cleaned up the style here a little bit.
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Next step toward global code: store "rOffset" in JSVariableObjectData.
+
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::JSVariableObjectData::JSVariableObjectData):
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Next steps toward global code:
+        
+        * Moved access to the register file into JSVariableObject.
+        
+        * Added more ASSERTs to indicate obsolete APIs there are just hanging
+        around to stave off build failures.
+
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::registers):
+        (KJS::JSVariableObject::JSVariableObjectData::JSVariableObjectData):
+        (KJS::JSVariableObject::JSVariableObject):
+
+2008-03-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver. Tweaked somewhat by Maciej.
+        
+        - implement codegen for ReadModifyResolveNode
+
+        * kjs/nodes.cpp:
+        (KJS::emitReadModifyAssignment):
+        (KJS::ReadModifyResolveNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff.
+
+        Fix the build -- r31492 removed activation tear-off, but r31493 used it.
+
+        * kjs/nodes.cpp:
+        (KJS::FuncExprNode::makeFunction):
+
+2008-03-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Add support for FuncExprNode to SquirrelFish.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::addConstant):
+        (KJS::CodeGenerator::emitNewFunctionExpression):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::FuncExprNode::emitCode):
+        (KJS::FuncExprNode::makeFunction):
+        * kjs/nodes.h:
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        First step toward global code: removed some obsolete JSGlobalObject
+        APIs, changing clients to ASSERT_NOT_REACHED.
+        
+        Activation tear-off and scope chain pushing is obsolete because we
+        statically detect whether an activation + scope node is required.
+        
+        The variableObject() and activationObject() accessors are obsolete
+        because they haven't been maintained, and they're mostly used by
+        node evaluation code, anyway.
+        
+        The localStorage() accessor is obsolete because everything is in
+        registers now, and it's mostly used by node evaluation code, anyway.
+
+2008-03-31  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - implement codegen for bracket accessor and bracket assign
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitGetPropVal):
+        (KJS::CodeGenerator::emitPutPropVal):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::BracketAccessorNode::emitCode):
+        (KJS::AssignBracketNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Removed FIXME that I just fixed.
+        
+        Added ASSERT to cover an error previously only covered by a FIXME.
+
+        * kjs/JSActivation.cpp:
+        (KJS::JSActivation::getOwnPropertySlot):
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Fixed indentation inside op_call. (I had left this code badly indented
+        to make the behavior-changing diff clearer.)
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed up logging of jump instructions to follow the following style:
+        
+        jump    offset(->absoluteTarget)
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+
+2008-03-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed the SymbolTable API to use int instead of size_t. It has been
+        using int internally for a while now (since squirrelfish symbols can
+        have negative indices).
+
+2008-03-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Add support for FunctionCallValueNode.
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallValueNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-31  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        1) Implemented array literals
+        
+        2) Renamed op_object_get and op_object_put to op_get_prop_id and
+        op_put_prop_id in preparation for new variants.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitNewArray):
+        (KJS::CodeGenerator::emitGetPropId):
+        (KJS::CodeGenerator::emitPutPropId):
+        (KJS::CodeGenerator::emitPutPropIndex):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::CodeGenerator):
+        (KJS::CodeGenerator::propertyNames):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::ArrayNode::emitCode):
+        (KJS::PropertyListNode::emitCode):
+        (KJS::DotAccessorNode::emitCode):
+        (KJS::PostIncResolveNode::emitCode):
+        (KJS::PreIncResolveNode::emitCode):
+        (KJS::AssignResolveNode::emitCode):
+        (KJS::AssignDotNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Implemented native function calls. (Re-entering from native code back
+        to JS doesn't work yet, though.)
+
+        0.2% speedup overall, due to some inlining tweaks. 3.6% regression on
+        function-empty.js, since we're making a new virtual call and taking a
+        new branch inside every op_call.
+        
+        I adjusted the JavaScriptCore calling convention to minimize overhead,
+        like so:
+        
+        The machine calls a single virtual function, "getCallData", to get all
+        the data it needs for a function call. Native code still uses the old
+        "isObject()" check followed by an "implementsCall()" check, which
+        aliases to "getCallData". (We can optimize native code to use getCallData
+        at our leisure.)
+        
+        To supply a list of arguments, the machine calls a new List constructor
+        that just takes a pointer and a length, without copying. Native code
+        still appends to the list one argument at a time. (We can optimize
+        native code to use the new List constructor at our leisure.)
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Changed resize() call to grow() call,
+        to encourage the compiler to inline the Vector code.
+
+        * kjs/CallData.h: Added.
+        (KJS::): CallData is a union because eventually native calls will stuff
+        a function pointer into it, to eliminate the callAsFunction virtual call.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction): Changed this to an ASSERT since
+        it's not implemented yet.
+        
+        * kjs/list.h: Made the List class two-faced, to support the old way and
+        the new way during this transition phase: lists can be made read-only
+        with just a pointer and a legnth, or you can append to them one item
+        at a time.
+
+        * kjs/value.h:
+        (KJS::jsUndefined): Marked this function ALWAYS_INLINE for the benefit
+        of a certain compiler that doesn't know what's best for it.
+
+2008-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+
+        Dump code that codegen can't handle yet, so it's easier to prioritize missing nodes.
+        
+        * kjs/nodes.h:
+        (KJS::Node::emitCode):
+
+2008-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+
+        Improve dumping of bytecode and fix coding style accordingly.
+        
+        Registers are printed as lr1 for locals, tr1 for temp registers. Identifiers print as
+        foobar(@id0) and constants print as "foo"(@k1) or 312.4(@k2) or the like. Constant and
+        identifier tables are dumped for reference.
+        
+        * VM/CodeBlock.cpp:
+        (KJS::escapeQuotes):
+        (KJS::valueToSourceString):
+        (KJS::registerName):
+        (KJS::constantName):
+        (KJS::idName):
+        (KJS::printUnaryOp):
+        (KJS::printBinaryOp):
+        (KJS::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (KJS::resolve):
+        (KJS::resolveBase):
+        (KJS::Machine::privateExecute):
+
+2008-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        Implement StringNode and VoidNode (both pretty trivial).
+
+        * kjs/nodes.cpp:
+        (KJS::StringNode::emitCode):
+        (KJS::VoidNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam.
+
+        Implement CommaNode.
+        
+        * kjs/nodes.cpp:
+        (KJS::CommaNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Adds support for dot notation and object literals.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitNewObject):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::ObjectLiteralNode::emitCode):
+        (KJS::PropertyListNode::emitCode):
+        (KJS::DotAccessorNode::emitCode):
+        (KJS::AssignDotNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Mark the register file. 
+        
+        It's a conservative mark for now, but once registers are typed, we can
+        do an exact mark.
+        
+        1.4% regression regardless of whether we actually do the marking.
+        GCC is is worth every penny.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Most of the changes here are just for
+        the fact that "registers" is a pointer now.
+
+        * kjs/JSGlobalObject.cpp: The global object owns the register file now.
+
+2008-03-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18204: SquirrelFish: continue/break do not correctly handle scope popping
+        <http://bugs.webkit.org/show_bug.cgi?id=18204>
+
+        We now track the scope depth as part of a loop context, and add an
+        extra instruction op_jump_scopes that is used to perform a jump across
+        dynamic scope boundaries.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpScopes):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::ContinueNode::emitCode):
+        (KJS::BreakNode::emitCode):
+
+2008-03-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add emitCode support for ConditionalNode.
+
+        * kjs/nodes.cpp:
+        (KJS::ConditionalNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Responding to feedback, added some comments, fixed up a few names, and
+        clarified that "locals" always means all local variables, functions,
+        and parameters.
+
+2008-03-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for "this".
+        
+        Supply an implicit "this" value as the first argument to every function.
+        Alias the "this" keyword to that argument.
+        
+        1% regression overall, 2.5% regression on empty function calls. Seems
+        like a reasonable cost for now, since we're doing more work.
+        (Eventually, we might decide to create a version of op_call specialized
+        for a known null "this" value.)
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCall):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/CommonIdentifiers.cpp:
+        (KJS::CommonIdentifiers::CommonIdentifiers):
+        * kjs/CommonIdentifiers.h:
+        * kjs/nodes.cpp:
+        (KJS::ThisNode::emitCode):
+        (KJS::FunctionCallResolveNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18192: Squirrelfish needs support for break and continue
+        <http://bugs.webkit.org/show_bug.cgi?id=18192>
+
+        Added a loop context stack to the code generator to provide the
+        correct jump labels for continue and goto.  Added logic to the
+        currently implemented loop constructs to manage entry and exit
+        from the loop contexts.  Finally, implemented codegen for break
+        and continue (and a pass through for LabelNode)
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::pushLoopContext):
+        (KJS::CodeGenerator::popLoopContext):
+        (KJS::CodeGenerator::loopContextForIdentifier):
+        (KJS::CodeGenerator::labelForContinue):
+        (KJS::CodeGenerator::labelForBreak):
+        * VM/CodeGenerator.h:
+        * kjs/nodes.cpp:
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::ContinueNode::emitCode):
+        (KJS::BreakNode::emitCode):
+        (KJS::LabelNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add emitCode support for UnaryPlusNode, NegateNode, BitwiseNotNode and LogicalNotNode.
+
+        * VM/CodeBlock.cpp:
+        (KJS::printUnaryOp):
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitToJSNumber):
+        (KJS::CodeGenerator::emitNegate):
+        (KJS::CodeGenerator::emitBitNot):
+        (KJS::CodeGenerator::emitNot):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::UnaryPlusNode::emitCode):
+        (KJS::NegateNode::emitCode):
+        (KJS::BitwiseNotNode::emitCode):
+        (KJS::LogicalNotNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-27  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add support for LogicalAndNode and LogicalOrNode.
+
+        * kjs/nodes.cpp:
+        (KJS::LogicalAndNode::emitCode):
+        (KJS::LogicalOrNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-27  Sam Weinig  <sam@webkit.org>
+
+        Clean up code and debug output.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-03-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Moved an ASSERT to a more logical place.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-03-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Add emitCode support for InstanceOfNode.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitInstanceOf):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::InstanceOfNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18142: squirrelfish needs to support dynamic scoping/with
+        <http://bugs.webkit.org/show_bug.cgi?id=18142>
+
+        Add support for dynamic scoping and add code to handle 'with'
+        statements.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::CodeBlock):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::getRegister):
+        (KJS::CodeGenerator::emitPushScope):
+        (KJS::CodeGenerator::emitPopScope):
+        * VM/CodeGenerator.h:
+        (KJS::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::WithNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add emitCode support for NullNode, FalseNode, TrueNode, IfNode, IfElseNode, DoWhileNode and WhileNode
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump): Dump op_jfalse opcode.
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpIfFalse): Identical to emitJumpIfTrue except it emits the op_jfalse opcode.
+        (KJS::CodeGenerator::emitLoad): Add and emitLoad override for booleans.
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute): Adds execution of op_jfalse. It is identical to op_jtrue, except the
+        the condition is reversed.
+        * VM/Opcode.h: Add op_jfalse.
+        * kjs/nodes.cpp:
+        (KJS::NullNode::emitCode): Added.
+        (KJS::FalseNode::emitCode): Added.
+        (KJS::TrueNode::emitCode): Added.
+        (KJS::IfNode::emitCode): Added.
+        (KJS::IfElseNode::emitCode): Added.
+        (KJS::DoWhileNode::emitCode): Added.
+        (KJS::WhileNode::emitCode): Added.
+        * kjs/nodes.h:
+
+2008-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Nixed an unused List.
+        
+        The calm before my stormy war against the List class.
+
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct):
+
+2008-03-26  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoffrey Garen.
+
+        Adds support for EqualNode, NotEqualNode, StrictEqualNode, NotStrictEqualNode,
+        LessEqNode, GreaterNode, GreaterEqNode, MultNode, DivNode, ModNode, SubNode,
+        LeftShiftNode, RightShiftNode, UnsignedRightShiftNode, BitAndNode, BitXOrNode,
+        and BitOrNode.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitEqual):
+        (KJS::CodeGenerator::emitNotEqual):
+        (KJS::CodeGenerator::emitStrictEqual):
+        (KJS::CodeGenerator::emitNotStrictEqual):
+        (KJS::CodeGenerator::emitLessEq):
+        (KJS::CodeGenerator::emitMult):
+        (KJS::CodeGenerator::emitDiv):
+        (KJS::CodeGenerator::emitMod):
+        (KJS::CodeGenerator::emitSub):
+        (KJS::CodeGenerator::emitLeftShift):
+        (KJS::CodeGenerator::emitRightShift):
+        (KJS::CodeGenerator::emitUnsignedRightShift):
+        (KJS::CodeGenerator::emitBitAnd):
+        (KJS::CodeGenerator::emitBitXOr):
+        (KJS::CodeGenerator::emitBitOr):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::jsLessEq):
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (KJS::MultNode::emitCode):
+        (KJS::DivNode::emitCode):
+        (KJS::ModNode::emitCode):
+        (KJS::SubNode::emitCode):
+        (KJS::LeftShiftNode::emitCode):
+        (KJS::RightShiftNode::emitCode):
+        (KJS::UnsignedRightShiftNode::emitCode):
+        (KJS::GreaterNode::emitCode):
+        (KJS::LessEqNode::emitCode):
+        (KJS::GreaterEqNode::emitCode):
+        (KJS::EqualNode::emitCode):
+        (KJS::NotEqualNode::emitCode):
+        (KJS::StrictEqualNode::emitCode):
+        (KJS::NotStrictEqualNode::emitCode):
+        (KJS::BitAndNode::emitCode):
+        (KJS::BitXOrNode::emitCode):
+        (KJS::BitOrNode::emitCode):
+        * kjs/nodes.h:
+
+2008-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Only print debug dumps in debug builds.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::generate):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Moved a few files around in the XCode project.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Made closures work.
+        
+        An activation object aliases to the register file until its associated
+        function returns, at which point it copies the registers for locals and
+        parameters into an independent storage buffer.
+
+2008-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed recent 25% regression on simple for loop test. GCC seems to be
+        very finicky about the code that gets inlined into
+        Machine::privateExecute.
+
+        Everything in this patch is simply the result of experiment.
+        
+        The resolve and resolve_base opcodes do not seem to have gotten slower
+        from this change.
+
+        * VM/Machine.cpp:
+        (KJS::resolve):
+        (KJS::resolveBase):
+        (KJS::Machine::privateExecute):
+        * kjs/nodes.h:
+
+2008-03-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 18059: squirrelfish needs to compile on platforms without computed goto
+        <http://bugs.webkit.org/show_bug.cgi?id=18059>
+
+        "Standard" macro style support for conditionalising the use of computed goto.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/Machine.cpp:
+        (KJS::Machine::isOpcode):
+        (KJS::Machine::privateExecute):
+        * VM/Machine.h:
+        (KJS::Machine::getOpcode):
+        (KJS::Machine::getOpcodeID):
+        * VM/Opcode.h:
+        * wtf/Platform.h:
+
+2008-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Moved my notes from nodes.h to the wiki.
+
+        * kjs/nodes.h:
+
+2008-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        SquirrelFish lives.
+        
+        Initial check-in of the code I've been carrying around. Lots of stuff
+        doesn't work. Plus a bunch of empty files.
+
+=== Start merge of squirrelfish ===
+
+2008-05-21  Darin Adler  <darin@apple.com>
+
+        - try to fix the Windows build
+
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::stopProfiling): Use ptrdiff_t instead of the less-common but incredibly
+        similar ssize_t type.
+        * wtf/AVLTree.h:
+        (KJS::AVLTree::search): Added a typename for a dependent name that's a type.
+
+2008-05-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - fix <rdar://problem/5952721> bug in JavaScript arguments object property lookup
+
+        Test: fast/js/arguments-bad-index.html
+
+        * kjs/function.cpp:
+        (KJS::IndexToNameMap::IndexToNameMap): Use unsigned instead of int.
+        (KJS::IndexToNameMap::isMapped): Use unsigned instead of int, and also use the
+        strict version of the numeric conversion function, since we don't want to allow
+        trailing junk.
+        (KJS::IndexToNameMap::unMap): Ditto.
+        (KJS::IndexToNameMap::operator[]): Ditto.
+        * kjs/function.h: Changed IndexToNameMap::size type from int to unsigned.
+
+2008-05-21  Timothy Hatcher  <timothy@apple.com>
+
+        Change the Profiler to allow multiple profiles to be running at
+        the same time. This can happen when you have nested console.profile()
+        calls. This required two changes. First, the Profiler needed to keep a
+        Vector of current profiles, instead of one. Second, a Profile needs
+        to keep track of the global ExecState it started in and the page group
+        identifier it is tracking.
+
+        The stopProfiling call now takes the same arguments as startProfiling.
+        This makes sure the correct profile is stopped. Passing a null UString
+        as the title will stop the last profile for the matching ExecState.
+
+        <rdar://problem/5951559> Multiple pages profiling can interfere with each other
+
+        Reviewed by Kevin McCullough.
+
+        * JavaScriptCore.exp: Added new exports. Removed old symbols.
+        * profiler/Profile.cpp:
+        (KJS::Profile::Profile): New constructor arguments for the
+        originatingGlobalExec and pageGroupIdentifier.
+        (KJS::Profile::stopProfiling): Set the m_originatingGlobalExec to null.
+        * profiler/Profile.h:
+        (KJS::Profile::create): Additional arguments.
+        (KJS::Profile::originatingGlobalExec): Return m_originatingGlobalExec.
+        (KJS::Profile::pageGroupIdentifier): Return m_pageGroupIdentifier.
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::findProfile): Added. Finds a Profile that matches
+        the ExecState and title.
+        (KJS::Profiler::startProfiling): Return early if there is already
+        a Profile with the ExecState and title. If not, create a new profile
+        and append it to m_currentProfiles.
+        (KJS::Profiler::stopProfiling): Loops through m_currentProfiles
+        and find the one matching the ExecState and title. If one is found
+        call stopProfiling and return the Profile after removing it
+        from m_currentProfiles.
+        (KJS::dispatchFunctionToProfiles): Helper inline function to loop through
+        m_currentProfiles and call a Profile function.
+        (KJS::Profiler::willExecute): Call dispatchFunctionToProfiles.
+        (KJS::Profiler::didExecute): Ditto.
+        * profiler/Profiler.h:
+
+2008-05-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5908520> REGRESSION (3.1.1-r33033): Crash in WebKit when opening or
+        refreshing page on people.com
+
+        The problem was that STL algorithms do not work with non-conformant comparators, and the
+        site used sort(function() { return 0.5 - Math.random(); } to randomly shuffle an array.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18687
+        REGRESSION(r32220): ecma/Array/15.4.4.5-3.js test now fails in GMT(BST)
+
+        Besides relying on sort stability, this test was just broken, and kept failing with the
+        new stable sort.
+
+        Tests: fast/js/sort-randomly.html
+               fast/js/sort-stability.html
+               fast/js/comparefn-sort-stability.html
+
+        * kjs/avl_tree.h: Added an AVL tree implementation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/AVLTree.h: Added.
+        Added an AVL tree implementation.
+
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::increaseVectorLength):
+        (KJS::ArrayInstance::sort):
+        (KJS::AVLTreeAbstractorForArrayCompare::get_less):
+        (KJS::AVLTreeAbstractorForArrayCompare::set_less):
+        (KJS::AVLTreeAbstractorForArrayCompare::get_greater):
+        (KJS::AVLTreeAbstractorForArrayCompare::set_greater):
+        (KJS::AVLTreeAbstractorForArrayCompare::get_balance_factor):
+        (KJS::AVLTreeAbstractorForArrayCompare::set_balance_factor):
+        (KJS::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (KJS::AVLTreeAbstractorForArrayCompare::compare_key_node):
+        (KJS::AVLTreeAbstractorForArrayCompare::compare_node_node):
+        (KJS::AVLTreeAbstractorForArrayCompare::null):
+        (KJS::ArrayInstance::compactForSorting):
+        
+        * kjs/array_instance.h: increaseVectorLength() now returns a bool to indicate whether it was
+        successful.
+
+        * wtf/Vector.h:
+        (WTF::Vector::Vector):
+        (WTF::::operator=):
+        (WTF::::fill):
+        Make these methods fail instead of crash when allocation fails, matching resize() and
+        reserveCapacity(), which already had this behavior. Callers need to check for null buffer
+        after making any Vector call that can try to allocate.
+
+        * tests/mozilla/ecma/Array/15.4.4.5-3.js: Fixed the test to use a consistent sort function,
+        as suggested in comments to a Mozilla bug filed about it (I'll keep tracking the bug to see
+        what the final resolution is).
+
+2008-05-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5950867> JSProfiler: Allow the profiler to "Focus" a
+        profile node.
+        - Implements focus by adding the idea of a profileNode being visible and
+        adding the ability to reset all of the visible flags.
+
+        * profiler/Profile.h: 
+        (KJS::Profile::focus):
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::ProfileNode): Initialize the visible flag.
+        (KJS::ProfileNode::setTreeVisible): Set the visibility of this node and
+        all of its descendents.
+        (KJS::ProfileNode::focus): Determine if this node should be visible when
+        focusing, if the functionName matches this node's function name or if any
+        of this node's children are visible.
+        (KJS::ProfileNode::restoreAll): Restore all nodes' visible flag.
+        (KJS::ProfileNode::debugPrintData):
+        * profiler/ProfileNode.h:
+        (KJS::ProfileNode::visible):
+        (KJS::ProfileNode::setVisible):
+
+2008-05-20  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a couple performance issues with the profiler. Also fixes
+        a regression where some nodes wouldn't be added to the tree.
+
+        Reviewed by Kevin McCullough.
+
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::addChild): Compare callIdentifier instead
+        of functionName.
+        * profiler/ProfileNode.h: 
+        (CallIdentifier.operator==): Compare the CallIdentifiers in
+        an order that fails sooner for non-matches.
+        (CallIdentifier.callIdentifier): Return the CallIdentifier by
+        reference to prevent making a new copy each time.
+
+2008-05-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5950796> JSProfiler: dump functions are in the code
+        Removed dump and logging functions from the Release version of the code
+        and renamed them to be obviously for debugging only.
+
+        * JavaScriptCore.exp:
+        * profiler/Profile.cpp:
+        (KJS::Profile::debugPrintData):
+        (KJS::Profile::debugPrintDataSampleStyle):
+        * profiler/Profile.h:
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::debugPrintData):
+        (KJS::ProfileNode::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.h:
+        * profiler/Profiler.cpp:
+        * profiler/Profiler.h:
+
+2008-05-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam.
+
+        <rdar://problem/5950538> JSProfiler: Keep track of non-JS execution time
+        We now have an extra node that represents the excess non-JS time.
+        - Also changed "SCRIPT" and "anonymous function" to be more consistent
+        with the debugger.
+
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::stopProfiling): If this ProfileNode is the head node
+        create a new child that has the excess execution time.
+        (KJS::ProfileNode::calculatePercentages): Moved calculation of the
+        percentages into a function since it's called from multiple places.
+        * profiler/ProfileNode.h: Add the newly needed functions used above.
+        (KJS::ProfileNode::setTotalTime):
+        (KJS::ProfileNode::setSelfTime):
+        (KJS::ProfileNode::setNumberOfCalls):
+        * profiler/Profiler.cpp: renamed "SCRIPT" and "anonymous function" to be
+        consistent with the debugger and use constants that can be localized
+        more easily.
+        (KJS::getCallIdentifiers):
+        (KJS::getCallIdentifierFromFunctionImp):
+
+2008-05-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        Removed only profiler-internal use of currentProfile since that concept
+        is changing.
+
+        * profiler/Profile.h: Now stopProfiling takes a time and bool as
+        arguments.  The time is used to calculate %s from and the bool tells
+        if this node is the head node and should be the one calculating the time.
+        (KJS::Profile::stopProfiling):
+        * profiler/ProfileNode.cpp: Ditto.
+        (KJS::ProfileNode::stopProfiling):
+        * profiler/ProfileNode.h: Ditto.
+
+2008-05-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Accidentally turned on the profiler.
+
+        * kjs/config.h:
+
+
+2008-05-20  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        Split function name into 3 parts so that the Web Inspector can link it to
+        the resource location from whence it came.
+
+        * kjs/ustring.cpp: Implemented operator> for UStrings
+        (KJS::operator>):
+        * kjs/ustring.h:
+        * profiler/Profile.cpp:
+        (KJS::Profile::Profile): Initialize all 3 values.
+        (KJS::Profile::willExecute): Use CallIdentifier struct.
+        (KJS::Profile::didExecute): Ditto.
+        * profiler/Profile.h: Ditto and remove unused function.
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::ProfileNode): Use CallIdentifier struct.
+        (KJS::ProfileNode::willExecute): Ditto and fix an issue where we
+        restarted the m_startTime even though it was already started.
+        (KJS::ProfileNode::didExecute): Ditto.
+        (KJS::ProfileNode::findChild): Ditto.
+        (KJS::functionNameDescendingComparator): Ditto and use new comparator.
+        (KJS::functionNameAscendingComparator): Ditto.
+        (KJS::ProfileNode::printDataInspectorStyle): Use CallIdentifier struct.
+        (KJS::ProfileNode::printDataSampleStyle): Ditto.
+        * profiler/ProfileNode.h:
+        (KJS::CallIdentifier::CallIdentifier): Describe the CallIdentifier struct
+        (KJS::CallIdentifier::operator== ):
+        (KJS::ProfileNode::create): Use the CallIdentifier struct.
+        (KJS::ProfileNode::callIdentifier):
+        (KJS::ProfileNode::functionName): Now only return the function name, not
+        the url and line number too.
+        (KJS::ProfileNode::url):
+        (KJS::ProfileNode::lineNumber):
+        * profiler/Profiler.cpp: Use the CallIdentifier struct. 
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+        (KJS::getCallIdentifiers):
+        (KJS::getCallIdentifierFromFunctionImp):
+
+2008-05-20  Timothy Hatcher  <timothy@apple.com>
+
+        Rename sortFileName{Ascending,Descending} to
+        sortFunctionName{Ascending,Descending}.
+
+        Reviewed by Kevin McCullough.
+
+        * JavaScriptCore.exp:
+        * kjs/config.h:
+        * profiler/Profile.h:
+        * profiler/ProfileNode.cpp:
+        (KJS::functionNameDescendingComparator):
+        (KJS::ProfileNode::sortFunctionNameDescending):
+        (KJS::functionNameAscendingComparator):
+        (KJS::ProfileNode::sortFunctionNameAscending):
+        * profiler/ProfileNode.h:
+
+2008-05-19  Timothy Hatcher  <timothy@apple.com>
+
+        Make the profiler use higher than millisecond resolution time-stamps.
+
+        Reviewed by Kevin McCullough.
+
+        * kjs/DateMath.cpp:
+        (KJS::getCurrentUTCTime): Call getCurrentUTCTimeWithMicroseconds and
+        floor the result.
+        (KJS::getCurrentUTCTimeWithMicroseconds): Copied from the previous
+        implementation of getCurrentUTCTime without the floor call.
+        * kjs/DateMath.h: Addded getCurrentUTCTimeWithMicroseconds.
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::ProfileNode): Use getCurrentUTCTimeWithMicroseconds.
+
+2008-05-19  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug in the profiler where call and apply would show up
+        and double the time spent in a function. We don't want to show call
+        and apply at all in the profiles. This change excludes them.
+
+        Reviewed by Kevin McCullough.
+
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::stopProfiling): Remove a second for loop and
+        calculate self time in the existing loop.
+        * profiler/Profiler.cpp:
+        (KJS::shouldExcludeFunction): Helper inline function that returns
+        true in the current function in an InternalFunctionImp and it is 
+        has the functionName call or apply.
+        (KJS::Profiler::willExecute): Call shouldExcludeFunction and return
+        early if if returns true.
+        (KJS::Profiler::didExecute): Ditto.
+
+2008-05-19  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Implement sorting by function name.
+
+        * JavaScriptCore.exp:
+        * profiler/Profile.h:
+        (KJS::Profile::sortFileNameDescending):
+        (KJS::Profile::sortFileNameAscending):
+        * profiler/ProfileNode.cpp:
+        (KJS::fileNameDescendingComparator):
+        (KJS::ProfileNode::sortFileNameDescending):
+        (KJS::fileNameAscendingComparator):
+        (KJS::ProfileNode::sortFileNameAscending):
+        * profiler/ProfileNode.h:
+
+2008-05-19  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Pass the exec state to profiler when calling startProfiling so that if
+        profiling is started within an execution context that location is
+        recorded correctly.
+
+        * JavaScriptCore.exp:
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::printDataInspectorStyle): Dump more info for debugging
+        purposes.
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        * profiler/Profiler.h:
+
+2008-05-19  Kevin McCullough  <kmccullough@apple.com>
+
+        Rubberstamped by Geoff.
+
+        Turn off the profiler because it is a performance regression.
+
+        * kjs/config.h:
+
+2008-05-19  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Anders and Beth.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16495
+        [GTK] Accessibility support with ATK/AT-SPI
+
+        Initial ATK/AT-SPI accessibility support for the GTK+ port.
+
+        * wtf/Platform.h:
+
+2008-05-19  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        -In an effort to make the profiler as efficient as possible instead of
+        prepending to a vector we keep the vector in reverse order and operate
+        over it backwards.
+
+        * profiler/Profile.cpp:
+        (KJS::Profile::willExecute):
+        (KJS::Profile::didExecute):
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::didExecute):
+        (KJS::ProfileNode::endAndRecordCall):
+        * profiler/ProfileNode.h:
+        * profiler/Profiler.cpp:
+        (KJS::getStackNames):
+
+2008-05-16  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        Implement sorting for the profiler.
+        I chose to sort the profileNodes in place since there is no reason they
+        need to retain their original order.
+
+        * JavaScriptCore.exp: Export the symbols.
+        * profiler/Profile.h: Add the different ways a profile can be sorted.
+        (KJS::Profile::sortTotalTimeDescending):
+        (KJS::Profile::sortTotalTimeAscending):
+        (KJS::Profile::sortSelfTimeDescending):
+        (KJS::Profile::sortSelfTimeAscending):
+        (KJS::Profile::sortCallsDescending):
+        (KJS::Profile::sortCallsAscending):
+        * profiler/ProfileNode.cpp: Implement those ways.
+        (KJS::totalTimeDescendingComparator):
+        (KJS::ProfileNode::sortTotalTimeDescending):
+        (KJS::totalTimeAscendingComparator):
+        (KJS::ProfileNode::sortTotalTimeAscending):
+        (KJS::selfTimeDescendingComparator):
+        (KJS::ProfileNode::sortSelfTimeDescending):
+        (KJS::selfTimeAscendingComparator):
+        (KJS::ProfileNode::sortSelfTimeAscending):
+        (KJS::callsDescendingComparator):
+        (KJS::ProfileNode::sortCallsDescending):
+        (KJS::callsAscendingComparator):
+        (KJS::ProfileNode::sortCallsAscending):
+        * profiler/ProfileNode.h: No longer use a Deque since it cannot be
+        sorted by std::sort and there was no reason not to use a Vector.  I
+        previously had though I would do prepending but am not.
+        (KJS::ProfileNode::selfTime):
+        (KJS::ProfileNode::totalPercent):
+        (KJS::ProfileNode::selfPercent):
+        (KJS::ProfileNode::children):
+        * profiler/Profiler.cpp: Removed these functions as they can be called
+        directoy on the Profile object after getting the Vector of them.
+        (KJS::getStackNames):
+        * profiler/Profiler.h:
+
+2008-05-15  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Since WebKitGtk is fully using autotools now, clean-up the .pro/.pri files
+        from gtk-port.
+
+        * JavaScriptCore.pro:
+        * kjs/testkjs.pro:
+
+2008-05-15  Kevin McCullough  <kmccullough@apple.com>
+
+        - Build fix.
+
+        * JavaScriptCore.exp:
+
+2008-05-15  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Cache some values to save on computing them repetitively. This will be
+        a big savings when we sort since we won't have to walk the tree for
+        every comparison!
+        - We cache these values when we end profiling because otherwise we won't
+        know which profile to get the totalTime for the whole profile from without
+        retaining a reference to the head profile or looking up the profile from
+        the list of all profiles.
+        - Also it's safe to assume we won't be asked for these values while we
+        are still profiling since the WebInspector only get's profileNodes from
+        profiles that are in the allProfiles() list and a profile is only added
+        to that list after it has finished and these values will no longer
+        change.
+
+        * JavaScriptCore.exp:
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::ProfileNode):
+        (KJS::ProfileNode::stopProfiling):
+        (KJS::ProfileNode::printDataInspectorStyle):
+        (KJS::ProfileNode::printDataSampleStyle):
+        (KJS::ProfileNode::endAndRecordCall):
+        * profiler/ProfileNode.h:
+        (KJS::ProfileNode::totalTime):
+        (KJS::ProfileNode::selfTime):
+        (KJS::ProfileNode::totalPercent):
+        (KJS::ProfileNode::selfPercent):
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::stopProfiling):
+
+2008-05-15  Simon Hausmann  <shausman@trolltech.com>
+
+        Reviewed by Holger.
+
+        Fix compilation when compiling with MSVC and wchar_t support.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::umemcasecmp):
+
+2008-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Turn on the profiler.
+
+        * kjs/config.h:
+
+2008-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Expose the new profiler functions to the WebInspector.
+
+        * JavaScriptCore.exp:
+
+2008-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Giving credit where credit is due.
+
+        * ChangeLog:
+
+2008-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff and Sam.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        Add the ability to get percentages of total and self time for displaying
+        in the WebInspector.
+
+        * profiler/Profile.h:
+        (KJS::Profile::totalProfileTime):
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::totalPercent):
+        (KJS::ProfileNode::selfPercent):
+        * profiler/ProfileNode.h:
+        * profiler/Profiler.h:
+        (KJS::Profiler::currentProfile):
+
+2008-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Rename FunctionCallProfile to ProfileNode.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * profiler/FunctionCallProfile.cpp: Removed.
+        * profiler/FunctionCallProfile.h: Removed.
+        * profiler/Profile.cpp:
+        (KJS::Profile::Profile):
+        (KJS::Profile::willExecute):
+        * profiler/Profile.h:
+        (KJS::Profile::callTree):
+        * profiler/ProfileNode.cpp: Copied from profiler/FunctionCallProfile.cpp.
+        (KJS::ProfileNode::ProfileNode):
+        (KJS::ProfileNode::willExecute):
+        (KJS::ProfileNode::didExecute):
+        (KJS::ProfileNode::addChild):
+        (KJS::ProfileNode::findChild):
+        (KJS::ProfileNode::stopProfiling):
+        (KJS::ProfileNode::selfTime):
+        (KJS::ProfileNode::printDataInspectorStyle):
+        (KJS::ProfileNode::printDataSampleStyle):
+        (KJS::ProfileNode::endAndRecordCall):
+        * profiler/ProfileNode.h: Copied from profiler/FunctionCallProfile.h.
+        (KJS::ProfileNode::create):
+        (KJS::ProfileNode::children):
+        * profiler/Profiler.cpp:
+
+2008-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by John.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Have each FunctionCallProfile be able to return it's total and self time.
+
+        * JavaScriptCore.exp:
+        * profiler/FunctionCallProfile.cpp:
+        (KJS::FunctionCallProfile::selfTime):
+        * profiler/FunctionCallProfile.h:
+        (KJS::FunctionCallProfile::totalTime):
+
+2008-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5934376> REGRESSION: A script fails because of a straw BOM character in it.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=4931>
+        Unicode format characters (Cf) should be removed from JavaScript source
+
+        Of all Cf characters, we are only removing BOM, because this is what Firefox trunk has
+        settled upon, after extensive discussion and investigation.
+
+        Based on Darin's work on this bug.
+
+        Test: fast/js/removing-Cf-characters.html
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::setCode): Tweak formatting. Use a call to shift(4) to read in the
+        first characters, instead of having special case code here.
+        (KJS::Lexer::shift): Add a loop when reading a character to skip BOM characters.
+
+2008-05-13  Matt Lilek  <webkit@mattlilek.com>
+
+        Not reviewed, build fix.
+
+        * kjs/date_object.cpp:
+        (KJS::DateObjectFuncImp::callAsFunction):
+
+2008-05-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam.
+
+        <rdar://problem/5933644> Implement Date.now
+        
+        Implement Date.now which returns the number of milliseconds since the epoch.
+        
+        * kjs/CommonIdentifiers.h:
+        * kjs/date_object.cpp:
+        (KJS::DateObjectFuncImp::):
+        (KJS::DateObjectImp::DateObjectImp):
+        (KJS::DateObjectFuncImp::callAsFunction):
+
+2008-05-13  Kevin McCullough  <kmccullough@apple.com>
+
+        Giving credit where credit is due.
+
+        * ChangeLog:
+
+2008-05-13  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam and Geoff.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        Use PassRefPtrs instead of RefPtrs when appropriate.
+
+        * profiler/FunctionCallProfile.cpp:
+        (KJS::FunctionCallProfile::addChild):
+        * profiler/FunctionCallProfile.h:
+        * profiler/Profile.h:
+        (KJS::Profile::callTree):
+
+2008-05-13  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Made some functions static (as per Adam) and changed from using raw
+        pointers to RefPtr for making these JavaScript Objects.
+
+        * profiler/FunctionCallProfile.cpp:
+        (KJS::FunctionCallProfile::addChild):
+        (KJS::FunctionCallProfile::findChild):
+        * profiler/FunctionCallProfile.h:
+        (KJS::FunctionCallProfile::create):
+        * profiler/Profile.cpp:
+        (KJS::Profile::Profile):
+        (KJS::Profile::willExecute):
+        (KJS::Profile::didExecute):
+        (KJS::functionNameCountPairComparator):
+        * profiler/Profile.h:
+        (KJS::Profile::create):
+        (KJS::Profile::title):
+        (KJS::Profile::callTree):
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        * profiler/Profiler.h:
+        (KJS::Profiler::allProfiles):
+        (KJS::Profiler::clearProfiles):
+
+2008-05-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/4949018> JavaScriptCore API claims to work with UTF8 strings, but only works
+        with ASCII strings
+        
+        * kjs/ustring.h:
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::createFromUTF8):
+        Added. Implementation adapted from JSStringCreateWithUTF8CString().
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithUTF8CString):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        Use UString::Rep::createFromUTF8().
+
+2008-05-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/4859666> WebKit needs availability macros in order to deprecate APIs
+
+        Create WebKit availability macros that key off the Mac OS X version being targeted to
+        determine the WebKit version being targeted.  Applications can define
+        WEBKIT_VERSION_MIN_REQUIRED before including WebKit headers in order to target a specific
+        version of WebKit.
+
+        The availability header is being added to JavaScriptCore rather than WebKit as JavaScriptCore
+        is the lowest-level portion of the public WebKit API.
+
+        * API/WebKitAvailability.h: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-05-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18828
+        Reproducible crash with PAC file
+
+        Naively moving JavaScriptCore into thread-specific data was inappropriate in the face of
+        exiting JavaScriptCore API clients, which expect a different therading model. Temporarily
+        disabling ThreadSpecific implementation until this can be sorted out.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+
+2008-05-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Roll out recent  threading changes (r32807, r32810, r32819, r32822) to simplify
+        SquirrelFish merging.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        * JavaScriptCore.exp:
+        * kjs/ExecState.h:
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreadingOnce):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject):
+        (KJS::JSGlobalObject::init):
+        (KJS::JSGlobalObject::put):
+        (KJS::JSGlobalObject::reset):
+        (KJS::JSGlobalObject::tearOffActivation):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::head):
+        (KJS::JSGlobalObject::perThreadData):
+        * kjs/JSLock.cpp:
+        (KJS::JSLock::registerThread):
+        * kjs/JSLock.h:
+        (KJS::JSLock::JSLock):
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::ArrayInstance):
+        (KJS::ArrayInstance::lengthGetter):
+        * kjs/array_object.cpp:
+        (KJS::arrayProtoFuncToString):
+        (KJS::arrayProtoFuncToLocaleString):
+        (KJS::arrayProtoFuncJoin):
+        (KJS::arrayProtoFuncConcat):
+        (KJS::arrayProtoFuncPop):
+        (KJS::arrayProtoFuncPush):
+        (KJS::arrayProtoFuncShift):
+        (KJS::arrayProtoFuncSlice):
+        (KJS::arrayProtoFuncSplice):
+        (KJS::arrayProtoFuncUnShift):
+        (KJS::arrayProtoFuncFilter):
+        (KJS::arrayProtoFuncMap):
+        (KJS::arrayProtoFuncEvery):
+        (KJS::arrayProtoFuncForEach):
+        (KJS::arrayProtoFuncSome):
+        (KJS::arrayProtoFuncIndexOf):
+        (KJS::arrayProtoFuncLastIndexOf):
+        (KJS::ArrayObjectImp::ArrayObjectImp):
+        (KJS::ArrayObjectImp::construct):
+        * kjs/bool_object.cpp:
+        (KJS::BooleanPrototype::BooleanPrototype):
+        (KJS::booleanProtoFuncToString):
+        (KJS::BooleanObjectImp::BooleanObjectImp):
+        (KJS::BooleanObjectImp::construct):
+        * kjs/collector.cpp:
+        (KJS::allocateBlock):
+        (KJS::Collector::recordExtraCost):
+        (KJS::Collector::heapAllocate):
+        (KJS::Collector::allocate):
+        (KJS::Collector::allocateNumber):
+        (KJS::Collector::registerAsMainThread):
+        (KJS::onMainThread):
+        (KJS::PlatformThread::PlatformThread):
+        (KJS::getCurrentPlatformThread):
+        (KJS::Collector::Thread::Thread):
+        (KJS::destroyRegisteredThread):
+        (KJS::initializeRegisteredThreadKey):
+        (KJS::Collector::registerThread):
+        (KJS::Collector::markStackObjectsConservatively):
+        (KJS::Collector::markCurrentThreadConservativelyInternal):
+        (KJS::Collector::markCurrentThreadConservatively):
+        (KJS::suspendThread):
+        (KJS::resumeThread):
+        (KJS::getPlatformThreadRegisters):
+        (KJS::otherThreadStackPointer):
+        (KJS::Collector::markOtherThreadConservatively):
+        (KJS::protectedValues):
+        (KJS::Collector::protect):
+        (KJS::Collector::unprotect):
+        (KJS::Collector::collectOnMainThreadOnly):
+        (KJS::Collector::markProtectedObjects):
+        (KJS::Collector::markMainThreadOnlyObjects):
+        (KJS::Collector::sweep):
+        (KJS::Collector::collect):
+        (KJS::Collector::size):
+        (KJS::Collector::globalObjectCount):
+        (KJS::Collector::protectedGlobalObjectCount):
+        (KJS::Collector::protectedObjectCount):
+        (KJS::Collector::protectedObjectTypeCounts):
+        (KJS::Collector::isBusy):
+        (KJS::Collector::reportOutOfMemoryToAllExecStates):
+        * kjs/collector.h:
+        (KJS::Collector::cellBlock):
+        (KJS::Collector::cellOffset):
+        (KJS::Collector::isCellMarked):
+        (KJS::Collector::markCell):
+        (KJS::Collector::reportExtraMemoryCost):
+        * kjs/date_object.cpp:
+        (KJS::formatLocaleDate):
+        (KJS::DatePrototype::DatePrototype):
+        (KJS::DateObjectImp::DateObjectImp):
+        (KJS::DateObjectImp::construct):
+        (KJS::DateObjectImp::callAsFunction):
+        (KJS::DateObjectFuncImp::DateObjectFuncImp):
+        (KJS::DateObjectFuncImp::callAsFunction):
+        (KJS::dateProtoFuncToString):
+        (KJS::dateProtoFuncToUTCString):
+        (KJS::dateProtoFuncToDateString):
+        (KJS::dateProtoFuncToTimeString):
+        (KJS::dateProtoFuncToLocaleString):
+        (KJS::dateProtoFuncToLocaleDateString):
+        (KJS::dateProtoFuncToLocaleTimeString):
+        (KJS::dateProtoFuncValueOf):
+        (KJS::dateProtoFuncGetTime):
+        (KJS::dateProtoFuncGetFullYear):
+        (KJS::dateProtoFuncGetUTCFullYear):
+        (KJS::dateProtoFuncToGMTString):
+        (KJS::dateProtoFuncGetMonth):
+        (KJS::dateProtoFuncGetUTCMonth):
+        (KJS::dateProtoFuncGetDate):
+        (KJS::dateProtoFuncGetUTCDate):
+        (KJS::dateProtoFuncGetDay):
+        (KJS::dateProtoFuncGetUTCDay):
+        (KJS::dateProtoFuncGetHours):
+        (KJS::dateProtoFuncGetUTCHours):
+        (KJS::dateProtoFuncGetMinutes):
+        (KJS::dateProtoFuncGetUTCMinutes):
+        (KJS::dateProtoFuncGetSeconds):
+        (KJS::dateProtoFuncGetUTCSeconds):
+        (KJS::dateProtoFuncGetMilliSeconds):
+        (KJS::dateProtoFuncGetUTCMilliseconds):
+        (KJS::dateProtoFuncGetTimezoneOffset):
+        (KJS::dateProtoFuncSetTime):
+        (KJS::setNewValueFromTimeArgs):
+        (KJS::setNewValueFromDateArgs):
+        (KJS::dateProtoFuncSetYear):
+        (KJS::dateProtoFuncGetYear):
+        * kjs/error_object.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype):
+        (KJS::errorProtoFuncToString):
+        (KJS::ErrorObjectImp::ErrorObjectImp):
+        (KJS::ErrorObjectImp::construct):
+        (KJS::NativeErrorPrototype::NativeErrorPrototype):
+        (KJS::NativeErrorImp::NativeErrorImp):
+        (KJS::NativeErrorImp::construct):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::FunctionImp::construct):
+        (KJS::Arguments::Arguments):
+        (KJS::ActivationImp::createArgumentsObject):
+        (KJS::encode):
+        (KJS::decode):
+        (KJS::globalFuncParseInt):
+        (KJS::globalFuncParseFloat):
+        (KJS::globalFuncEscape):
+        (KJS::globalFuncUnescape):
+        (KJS::PrototypeFunction::PrototypeFunction):
+        (KJS::PrototypeReflexiveFunction::PrototypeReflexiveFunction):
+        * kjs/function_object.cpp:
+        (KJS::FunctionPrototype::FunctionPrototype):
+        (KJS::functionProtoFuncToString):
+        (KJS::FunctionObjectImp::FunctionObjectImp):
+        (KJS::FunctionObjectImp::construct):
+        * kjs/internal.cpp:
+        (KJS::StringImp::toObject):
+        * kjs/internal.h:
+        (KJS::StringImp::StringImp):
+        (KJS::NumberImp::operator new):
+        * kjs/list.cpp:
+        (KJS::List::markSet):
+        (KJS::List::markProtectedListsSlowCase):
+        (KJS::List::expandAndAppend):
+        * kjs/list.h:
+        (KJS::List::List):
+        (KJS::List::~List):
+        (KJS::List::markProtectedLists):
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter):
+        (KJS::cacheGlobalObject):
+        * kjs/math_object.cpp:
+        (KJS::MathObjectImp::getValueProperty):
+        (KJS::mathProtoFuncAbs):
+        (KJS::mathProtoFuncACos):
+        (KJS::mathProtoFuncASin):
+        (KJS::mathProtoFuncATan):
+        (KJS::mathProtoFuncATan2):
+        (KJS::mathProtoFuncCeil):
+        (KJS::mathProtoFuncCos):
+        (KJS::mathProtoFuncExp):
+        (KJS::mathProtoFuncFloor):
+        (KJS::mathProtoFuncLog):
+        (KJS::mathProtoFuncMax):
+        (KJS::mathProtoFuncMin):
+        (KJS::mathProtoFuncPow):
+        (KJS::mathProtoFuncRandom):
+        (KJS::mathProtoFuncRound):
+        (KJS::mathProtoFuncSin):
+        (KJS::mathProtoFuncSqrt):
+        (KJS::mathProtoFuncTan):
+        * kjs/nodes.cpp:
+        (KJS::ParserRefCounted::ParserRefCounted):
+        (KJS::ParserRefCounted::ref):
+        (KJS::ParserRefCounted::deref):
+        (KJS::ParserRefCounted::refcount):
+        (KJS::ParserRefCounted::deleteNewObjects):
+        (KJS::Node::handleException):
+        (KJS::NumberNode::evaluate):
+        (KJS::StringNode::evaluate):
+        (KJS::ArrayNode::evaluate):
+        (KJS::PostIncResolveNode::evaluate):
+        (KJS::PostIncLocalVarNode::evaluate):
+        (KJS::PostDecResolveNode::evaluate):
+        (KJS::PostDecLocalVarNode::evaluate):
+        (KJS::PostDecLocalVarNode::inlineEvaluateToNumber):
+        (KJS::PostIncBracketNode::evaluate):
+        (KJS::PostDecBracketNode::evaluate):
+        (KJS::PostIncDotNode::evaluate):
+        (KJS::PostDecDotNode::evaluate):
+        (KJS::typeStringForValue):
+        (KJS::LocalVarTypeOfNode::evaluate):
+        (KJS::TypeOfResolveNode::evaluate):
+        (KJS::TypeOfValueNode::evaluate):
+        (KJS::PreIncLocalVarNode::evaluate):
+        (KJS::PreIncResolveNode::evaluate):
+        (KJS::PreDecLocalVarNode::evaluate):
+        (KJS::PreDecResolveNode::evaluate):
+        (KJS::PreIncConstNode::evaluate):
+        (KJS::PreDecConstNode::evaluate):
+        (KJS::PostIncConstNode::evaluate):
+        (KJS::PostDecConstNode::evaluate):
+        (KJS::PreIncBracketNode::evaluate):
+        (KJS::PreDecBracketNode::evaluate):
+        (KJS::PreIncDotNode::evaluate):
+        (KJS::PreDecDotNode::evaluate):
+        (KJS::NegateNode::evaluate):
+        (KJS::BitwiseNotNode::evaluate):
+        (KJS::MultNode::evaluate):
+        (KJS::DivNode::evaluate):
+        (KJS::ModNode::evaluate):
+        (KJS::addSlowCase):
+        (KJS::add):
+        (KJS::AddNumbersNode::evaluate):
+        (KJS::AddStringsNode::evaluate):
+        (KJS::AddStringLeftNode::evaluate):
+        (KJS::AddStringRightNode::evaluate):
+        (KJS::SubNode::evaluate):
+        (KJS::LeftShiftNode::evaluate):
+        (KJS::RightShiftNode::evaluate):
+        (KJS::UnsignedRightShiftNode::evaluate):
+        (KJS::BitXOrNode::evaluate):
+        (KJS::BitOrNode::evaluate):
+        (KJS::valueForReadModifyAssignment):
+        (KJS::ForInNode::execute):
+        (KJS::TryNode::execute):
+        (KJS::FuncDeclNode::makeFunction):
+        (KJS::FuncExprNode::evaluate):
+        * kjs/nodes.h:
+        * kjs/number_object.cpp:
+        (KJS::NumberPrototype::NumberPrototype):
+        (KJS::numberProtoFuncToString):
+        (KJS::numberProtoFuncToLocaleString):
+        (KJS::numberProtoFuncToFixed):
+        (KJS::numberProtoFuncToExponential):
+        (KJS::numberProtoFuncToPrecision):
+        (KJS::NumberObjectImp::NumberObjectImp):
+        (KJS::NumberObjectImp::getValueProperty):
+        (KJS::NumberObjectImp::construct):
+        (KJS::NumberObjectImp::callAsFunction):
+        * kjs/object.cpp:
+        (KJS::JSObject::call):
+        (KJS::JSObject::get):
+        (KJS::JSObject::put):
+        (KJS::JSObject::defineGetter):
+        (KJS::JSObject::defineSetter):
+        (KJS::JSObject::putDirect):
+        (KJS::Error::create):
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        (KJS::ObjectPrototype::ObjectPrototype):
+        (KJS::objectProtoFuncToLocaleString):
+        (KJS::objectProtoFuncToString):
+        (KJS::ObjectObjectImp::ObjectObjectImp):
+        (KJS::ObjectObjectImp::construct):
+        * kjs/property_map.h:
+        (KJS::SavedProperty::SavedProperty):
+        (KJS::SavedProperty::init):
+        (KJS::SavedProperty::~SavedProperty):
+        (KJS::SavedProperty::name):
+        (KJS::SavedProperty::value):
+        (KJS::SavedProperty::attributes):
+        * kjs/protect.h:
+        (KJS::gcProtect):
+        (KJS::gcUnprotect):
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpPrototype::RegExpPrototype):
+        (KJS::regExpProtoFuncToString):
+        (KJS::RegExpImp::getValueProperty):
+        (KJS::RegExpObjectImp::RegExpObjectImp):
+        (KJS::RegExpObjectImp::arrayOfMatches):
+        (KJS::RegExpObjectImp::getBackref):
+        (KJS::RegExpObjectImp::getLastParen):
+        (KJS::RegExpObjectImp::getLeftContext):
+        (KJS::RegExpObjectImp::getRightContext):
+        (KJS::RegExpObjectImp::getValueProperty):
+        (KJS::RegExpObjectImp::createRegExpImp):
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::StringInstance):
+        (KJS::StringInstance::lengthGetter):
+        (KJS::StringInstance::indexGetter):
+        (KJS::stringInstanceNumericPropertyGetter):
+        (KJS::StringPrototype::StringPrototype):
+        (KJS::replace):
+        (KJS::stringProtoFuncCharAt):
+        (KJS::stringProtoFuncCharCodeAt):
+        (KJS::stringProtoFuncConcat):
+        (KJS::stringProtoFuncIndexOf):
+        (KJS::stringProtoFuncLastIndexOf):
+        (KJS::stringProtoFuncMatch):
+        (KJS::stringProtoFuncSearch):
+        (KJS::stringProtoFuncReplace):
+        (KJS::stringProtoFuncSlice):
+        (KJS::stringProtoFuncSplit):
+        (KJS::stringProtoFuncSubstr):
+        (KJS::stringProtoFuncSubstring):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        (KJS::stringProtoFuncLocaleCompare):
+        (KJS::stringProtoFuncBig):
+        (KJS::stringProtoFuncSmall):
+        (KJS::stringProtoFuncBlink):
+        (KJS::stringProtoFuncBold):
+        (KJS::stringProtoFuncFixed):
+        (KJS::stringProtoFuncItalics):
+        (KJS::stringProtoFuncStrike):
+        (KJS::stringProtoFuncSub):
+        (KJS::stringProtoFuncSup):
+        (KJS::stringProtoFuncFontcolor):
+        (KJS::stringProtoFuncFontsize):
+        (KJS::stringProtoFuncAnchor):
+        (KJS::stringProtoFuncLink):
+        (KJS::StringObjectImp::StringObjectImp):
+        (KJS::StringObjectImp::construct):
+        (KJS::StringObjectImp::callAsFunction):
+        (KJS::StringObjectFuncImp::StringObjectFuncImp):
+        (KJS::StringObjectFuncImp::callAsFunction):
+        * kjs/string_object.h:
+        (KJS::StringInstanceThatMasqueradesAsUndefined::StringInstanceThatMasqueradesAsUndefined):
+        * kjs/testkjs.cpp:
+        (GlobalObject::GlobalObject):
+        (functionGC):
+        (functionRun):
+        (functionReadline):
+        (kjsmain):
+        * kjs/ustring.h:
+        * kjs/value.cpp:
+        (KJS::JSCell::operator new):
+        (KJS::jsString):
+        (KJS::jsOwnedString):
+        (KJS::jsNumberCell):
+        * kjs/value.h:
+        (KJS::jsNaN):
+        (KJS::jsNumber):
+        (KJS::jsNumberFromAnd):
+        (KJS::JSCell::marked):
+        (KJS::JSCell::mark):
+        (KJS::JSValue::toJSNumber):
+        * wtf/ThreadSpecific.h:
+        (WTF::T):
+
+2008-05-10  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Qt & wx build fix.
+
+        * JavaScriptCore.pri: Add profiler/Profile.cpp.
+        * JavaScriptCoreSources.bkl: Ditto.
+
+2008-05-10  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
+
+        Reviewed by Maciej.
+
+        Gtk+ build fix
+
+        * GNUmakefile.am: Add Profile.cpp in _sources
+
+2008-05-09  Brady Eidson  <beidson@apple.com>
+
+        Build Fix.  Kevin is an idiot.  
+        ("My name is Kevin McCullough and I approve this message.")
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-05-09  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        -<rdar://problem/5770054> JavaScript profiler (10928)
+        -Add Profile class so that all profiles can be stored and retrieved by
+        the WebInspector when that time comes.
+
+        * JavaScriptCore.exp: Export the new function signatures.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add the new files to the
+        project
+        * profiler/Profile.cpp: Added. This class represents a single run of the
+        profiler.
+        (KJS::Profile::Profile):
+        (KJS::Profile::willExecute):
+        (KJS::Profile::didExecute):
+        (KJS::Profile::printDataInspectorStyle):
+        (KJS::functionNameCountPairComparator):
+        (KJS::Profile::printDataSampleStyle):
+        * profiler/Profile.h: Added. Ditto
+        (KJS::Profile::stopProfiling):
+        * profiler/Profiler.cpp: Now the profiler keeps track of many profiles
+        but only runs one at a time.
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling):
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+        (KJS::Profiler::printDataInspectorStyle):
+        (KJS::Profiler::printDataSampleStyle):
+        * profiler/Profiler.h: Ditto.
+        (KJS::Profiler::~Profiler):
+        (KJS::Profiler::allProfiles):
+        (KJS::Profiler::clearProfiles):
+
+2008-05-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Mark.
+
+        Enable NPAPI plug-ins on 64-bit.
+        
+        * wtf/Platform.h:
+
+2008-05-07  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        wx & Gtk build fix.
+
+        Add SIZE_MAX definition for the wx port.
+
+        * os-win32/stdint.h:
+
+2008-05-07  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Support for isMainThread in the Qt port.
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading): Adjusted.
+        (WTF::isMainThread): Added.
+
+2008-05-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix debug-only leak seen on buildbot
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::checkKey): After writing an empty value in, but before constructing a
+        deleted value on top of it, call the destructor so the empty value doesn't leak.
+
+2008-05-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Get rid of static data in nodes.cpp (well, at least of non-debug one).
+
+        No measurable change on SunSpider.
+
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreadingOnce):
+        * kjs/nodes.cpp:
+        (KJS::newTrackedObjects):
+        (KJS::trackedObjectExtraRefCounts):
+        (KJS::initializeNodesThreading):
+        (KJS::ParserRefCounted::ParserRefCounted):
+        (KJS::ParserRefCounted::ref):
+        (KJS::ParserRefCounted::deref):
+        (KJS::ParserRefCounted::refcount):
+        (KJS::ParserRefCounted::deleteNewObjects):
+        * kjs/nodes.h:
+        Made newTrackedObjects and trackedObjectExtraRefCounts per-thread.
+
+2008-05-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Move call stack depth counter to global object.
+
+        * kjs/ExecState.h: (KJS::ExecState::functionCallDepth): Added a recursion depth counter to
+        per-thread data.
+        * kjs/JSGlobalObject.cpp: (KJS::JSGlobalObject::init): Initialize PerThreadData.functionCallDepth.
+        * kjs/JSGlobalObject.h: (KJS::JSGlobalObject::perThreadData): Made the result non-const.
+
+        * kjs/object.cpp:
+        (KJS::throwStackSizeExceededError): Moved throwError to a separate function, since it is now
+        the only thing in JSObject::call that needs a PIC branch.
+        (KJS::JSObject::call): Use a per-thread variable instead of local static for recursion depth
+        tracking.
+
+2008-05-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Make JavaScriptGlue and JavaScriptCore API functions implicitly call initializeThreading
+        for the sake of non-WebKit clients.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        These are the JavaScriptCore API bottlenecks. There are a few other JSStringRef
+        and JSClassRef functions that can be called earlier, but they do not do anything that
+        requires initializeThreading.
+
+        * kjs/InitializeThreading.cpp:
+        (KJS::doInitializeThreading):
+        (KJS::initializeThreading):
+        On Darwin, make the initialization happen under pthread_once, since there is no guarantee
+        that non-WebKit clients won't try to call this function re-entrantly.
+
+        * kjs/InitializeThreading.h:
+        * wtf/Threading.h:
+        Spell out initializeThreading contract.
+
+        * wtf/ThreadingPthreads.cpp: (WTF::isMainThread): Make sure that results are correct on
+        Darwin, even if threading was initialized from a secondary thread.
+
+2008-05-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18826
+        Make JavaScript heap per-thread
+
+        * wtf/ThreadSpecific.h: Make sure to initialize POD thread-specific varaibles, too
+        (replaced "new T" with "new T()").
+
+        * kjs/collector.h: Renamed Collector to Heap, made the heap per-thread. Removed support for
+        multithreaded access to a heap.
+        (KJS::CollectorBlock): Removed collectOnMainThreadOnly bitmap, added a reference to owner heap.
+        (KJS::SmallCellCollectorBlock): Ditto.
+        (KJS::Heap::markListSet): Moved from a static variable in List.cpp to a per-thread one here.
+        (KJS::Heap::heap): Added a method to find which heap a JSValue is allocated in.
+
+        * kjs/collector.cpp: Changed "const size_t" constants to #defines, to avoid a PIC branch
+        (gcc was using one to access a constant used in std::max(), because it takes a reference,
+        even though std::max() itself was inlined).
+        (KJS::Heap::threadHeap): JS heap is now per-thread.
+        (KJS::Heap::Heap): Zero-initialize the heap.
+        (KJS::allocateBlock): Added NEVER_INLINE, because this function uses a PIC branch, so
+        inlining it in Heap::heapAllocate() is bad for performance, now that the latter doesn't
+        use any global data.
+        (KJS::Heap::heapAllocate): Initialize Block::heap.
+        (KJS::Heap::markCurrentThreadConservatively): Moved into markStackObjectsConservatively(),
+        as GC only works with a current thread's heap now.
+        (KJS::Heap::sweep): Removed collectOnMainThreadOnly checks.
+        (KJS::Heap::collect): Ditto.
+
+        * kjs/JSLock.cpp:
+        * kjs/JSLock.h:
+        (KJS::JSLock::JSLock):
+        Removed registerThread(), as the heap no longer cares.
+
+        * kjs/InitializeThreading.cpp: (KJS::initializeThreading): Initialize new per-thread
+        variables in Heap and JSGlobalObject.
+
+        * kjs/ExecState.h: (KJS::ExecState::heap): Added a heap pointer for faster access to
+        per-thread heap, and an accessor for it.
+
+        * kjs/JSGlobalObject.h: Made JSGlobalObject linked list per-thread.
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject): Fixed a bug in linked list handling. It only worked
+        right if the removed object was the head one!
+        (KJS::JSGlobalObject::head): Return a per-thread list head.
+        (KJS::JSGlobalObject::init): Store a reference to per-thread heap.
+        (KJS::JSGlobalObject::reset): Pass ExecState to functions that need it.
+        (KJS::JSGlobalObject::tearOffActivation): Ditto.
+        (KJS::JSGlobalObject::operator new): JSGlobalObject allocation cannot use an ExecState,
+        so it needs a custom operator new that directly accesses per-thread heap.
+
+        * kjs/list.h:
+        (KJS::List::List): Replaced m_isInMarkSet boolean with an actual pointer to the set, since it
+        is no longer a single static object.
+        (KJS::List::~List): Ditto.
+        * kjs/list.cpp:
+        (KJS::List::markSet): Removed, this is now stored in Heap.
+        (KJS::List::markProtectedLists): Take a reference to the list.
+        (KJS::List::expandAndAppend): Ask the current thread heap for a mark set reference.
+
+        * kjs/protect.h:
+        (KJS::gcProtect):
+        (KJS::gcUnprotect):
+        Use the newly added Heap::heap() method to find out which heap the value to be (un)protected
+        belongs to.
+
+        * kjs/property_map.h: Removed unused SavedProperty class.
+
+        * JavaScriptCore.exp:
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::ArrayInstance):
+        (KJS::ArrayInstance::lengthGetter):
+        * kjs/array_object.cpp:
+        (KJS::arrayProtoFuncToString):
+        (KJS::arrayProtoFuncToLocaleString):
+        (KJS::arrayProtoFuncJoin):
+        (KJS::arrayProtoFuncConcat):
+        (KJS::arrayProtoFuncPop):
+        (KJS::arrayProtoFuncPush):
+        (KJS::arrayProtoFuncShift):
+        (KJS::arrayProtoFuncSlice):
+        (KJS::arrayProtoFuncSplice):
+        (KJS::arrayProtoFuncUnShift):
+        (KJS::arrayProtoFuncFilter):
+        (KJS::arrayProtoFuncMap):
+        (KJS::arrayProtoFuncEvery):
+        (KJS::arrayProtoFuncForEach):
+        (KJS::arrayProtoFuncSome):
+        (KJS::arrayProtoFuncIndexOf):
+        (KJS::arrayProtoFuncLastIndexOf):
+        (KJS::ArrayObjectImp::ArrayObjectImp):
+        (KJS::ArrayObjectImp::construct):
+        * kjs/bool_object.cpp:
+        (KJS::BooleanPrototype::BooleanPrototype):
+        (KJS::booleanProtoFuncToString):
+        (KJS::BooleanObjectImp::BooleanObjectImp):
+        (KJS::BooleanObjectImp::construct):
+        * kjs/date_object.cpp:
+        (KJS::formatLocaleDate):
+        (KJS::DatePrototype::DatePrototype):
+        (KJS::DateObjectImp::DateObjectImp):
+        (KJS::DateObjectImp::construct):
+        (KJS::DateObjectImp::callAsFunction):
+        (KJS::DateObjectFuncImp::DateObjectFuncImp):
+        (KJS::DateObjectFuncImp::callAsFunction):
+        (KJS::dateProtoFuncToString):
+        (KJS::dateProtoFuncToUTCString):
+        (KJS::dateProtoFuncToDateString):
+        (KJS::dateProtoFuncToTimeString):
+        (KJS::dateProtoFuncToLocaleString):
+        (KJS::dateProtoFuncToLocaleDateString):
+        (KJS::dateProtoFuncToLocaleTimeString):
+        (KJS::dateProtoFuncValueOf):
+        (KJS::dateProtoFuncGetTime):
+        (KJS::dateProtoFuncGetFullYear):
+        (KJS::dateProtoFuncGetUTCFullYear):
+        (KJS::dateProtoFuncToGMTString):
+        (KJS::dateProtoFuncGetMonth):
+        (KJS::dateProtoFuncGetUTCMonth):
+        (KJS::dateProtoFuncGetDate):
+        (KJS::dateProtoFuncGetUTCDate):
+        (KJS::dateProtoFuncGetDay):
+        (KJS::dateProtoFuncGetUTCDay):
+        (KJS::dateProtoFuncGetHours):
+        (KJS::dateProtoFuncGetUTCHours):
+        (KJS::dateProtoFuncGetMinutes):
+        (KJS::dateProtoFuncGetUTCMinutes):
+        (KJS::dateProtoFuncGetSeconds):
+        (KJS::dateProtoFuncGetUTCSeconds):
+        (KJS::dateProtoFuncGetMilliSeconds):
+        (KJS::dateProtoFuncGetUTCMilliseconds):
+        (KJS::dateProtoFuncGetTimezoneOffset):
+        (KJS::dateProtoFuncSetTime):
+        (KJS::setNewValueFromTimeArgs):
+        (KJS::setNewValueFromDateArgs):
+        (KJS::dateProtoFuncSetYear):
+        (KJS::dateProtoFuncGetYear):
+        * kjs/error_object.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype):
+        (KJS::errorProtoFuncToString):
+        (KJS::ErrorObjectImp::ErrorObjectImp):
+        (KJS::ErrorObjectImp::construct):
+        (KJS::NativeErrorPrototype::NativeErrorPrototype):
+        (KJS::NativeErrorImp::NativeErrorImp):
+        (KJS::NativeErrorImp::construct):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::lengthGetter):
+        (KJS::FunctionImp::construct):
+        (KJS::Arguments::Arguments):
+        (KJS::ActivationImp::createArgumentsObject):
+        (KJS::encode):
+        (KJS::decode):
+        (KJS::globalFuncParseInt):
+        (KJS::globalFuncParseFloat):
+        (KJS::globalFuncEscape):
+        (KJS::globalFuncUnescape):
+        (KJS::PrototypeFunction::PrototypeFunction):
+        (KJS::PrototypeReflexiveFunction::PrototypeReflexiveFunction):
+        * kjs/function_object.cpp:
+        (KJS::FunctionPrototype::FunctionPrototype):
+        (KJS::functionProtoFuncToString):
+        (KJS::FunctionObjectImp::FunctionObjectImp):
+        (KJS::FunctionObjectImp::construct):
+        * kjs/internal.cpp:
+        (KJS::StringImp::toObject):
+        * kjs/internal.h:
+        (KJS::StringImp::StringImp):
+        (KJS::NumberImp::operator new):
+        * kjs/lookup.h:
+        (KJS::staticFunctionGetter):
+        (KJS::cacheGlobalObject):
+        * kjs/math_object.cpp:
+        (KJS::MathObjectImp::getValueProperty):
+        (KJS::mathProtoFuncAbs):
+        (KJS::mathProtoFuncACos):
+        (KJS::mathProtoFuncASin):
+        (KJS::mathProtoFuncATan):
+        (KJS::mathProtoFuncATan2):
+        (KJS::mathProtoFuncCeil):
+        (KJS::mathProtoFuncCos):
+        (KJS::mathProtoFuncExp):
+        (KJS::mathProtoFuncFloor):
+        (KJS::mathProtoFuncLog):
+        (KJS::mathProtoFuncMax):
+        (KJS::mathProtoFuncMin):
+        (KJS::mathProtoFuncPow):
+        (KJS::mathProtoFuncRandom):
+        (KJS::mathProtoFuncRound):
+        (KJS::mathProtoFuncSin):
+        (KJS::mathProtoFuncSqrt):
+        (KJS::mathProtoFuncTan):
+        * kjs/nodes.cpp:
+        (KJS::Node::handleException):
+        (KJS::NumberNode::evaluate):
+        (KJS::StringNode::evaluate):
+        (KJS::ArrayNode::evaluate):
+        (KJS::PostIncResolveNode::evaluate):
+        (KJS::PostIncLocalVarNode::evaluate):
+        (KJS::PostDecResolveNode::evaluate):
+        (KJS::PostDecLocalVarNode::evaluate):
+        (KJS::PostDecLocalVarNode::inlineEvaluateToNumber):
+        (KJS::PostIncBracketNode::evaluate):
+        (KJS::PostDecBracketNode::evaluate):
+        (KJS::PostIncDotNode::evaluate):
+        (KJS::PostDecDotNode::evaluate):
+        (KJS::typeStringForValue):
+        (KJS::LocalVarTypeOfNode::evaluate):
+        (KJS::TypeOfResolveNode::evaluate):
+        (KJS::TypeOfValueNode::evaluate):
+        (KJS::PreIncLocalVarNode::evaluate):
+        (KJS::PreIncResolveNode::evaluate):
+        (KJS::PreDecLocalVarNode::evaluate):
+        (KJS::PreDecResolveNode::evaluate):
+        (KJS::PreIncConstNode::evaluate):
+        (KJS::PreDecConstNode::evaluate):
+        (KJS::PostIncConstNode::evaluate):
+        (KJS::PostDecConstNode::evaluate):
+        (KJS::PreIncBracketNode::evaluate):
+        (KJS::PreDecBracketNode::evaluate):
+        (KJS::PreIncDotNode::evaluate):
+        (KJS::PreDecDotNode::evaluate):
+        (KJS::NegateNode::evaluate):
+        (KJS::BitwiseNotNode::evaluate):
+        (KJS::MultNode::evaluate):
+        (KJS::DivNode::evaluate):
+        (KJS::ModNode::evaluate):
+        (KJS::addSlowCase):
+        (KJS::add):
+        (KJS::AddNumbersNode::evaluate):
+        (KJS::AddStringsNode::evaluate):
+        (KJS::AddStringLeftNode::evaluate):
+        (KJS::AddStringRightNode::evaluate):
+        (KJS::SubNode::evaluate):
+        (KJS::LeftShiftNode::evaluate):
+        (KJS::RightShiftNode::evaluate):
+        (KJS::UnsignedRightShiftNode::evaluate):
+        (KJS::BitXOrNode::evaluate):
+        (KJS::BitOrNode::evaluate):
+        (KJS::valueForReadModifyAssignment):
+        (KJS::ForInNode::execute):
+        (KJS::TryNode::execute):
+        (KJS::FuncDeclNode::makeFunction):
+        (KJS::FuncExprNode::evaluate):
+        * kjs/number_object.cpp:
+        (KJS::NumberPrototype::NumberPrototype):
+        (KJS::numberProtoFuncToString):
+        (KJS::numberProtoFuncToLocaleString):
+        (KJS::numberProtoFuncToFixed):
+        (KJS::numberProtoFuncToExponential):
+        (KJS::numberProtoFuncToPrecision):
+        (KJS::NumberObjectImp::NumberObjectImp):
+        (KJS::NumberObjectImp::getValueProperty):
+        (KJS::NumberObjectImp::construct):
+        (KJS::NumberObjectImp::callAsFunction):
+        * kjs/object.cpp:
+        (KJS::JSObject::defineGetter):
+        (KJS::JSObject::defineSetter):
+        (KJS::JSObject::putDirect):
+        (KJS::Error::create):
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        (KJS::ObjectPrototype::ObjectPrototype):
+        (KJS::objectProtoFuncToLocaleString):
+        (KJS::objectProtoFuncToString):
+        (KJS::ObjectObjectImp::ObjectObjectImp):
+        (KJS::ObjectObjectImp::construct):
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpPrototype::RegExpPrototype):
+        (KJS::regExpProtoFuncToString):
+        (KJS::RegExpImp::getValueProperty):
+        (KJS::RegExpObjectImp::RegExpObjectImp):
+        (KJS::RegExpObjectImp::arrayOfMatches):
+        (KJS::RegExpObjectImp::getBackref):
+        (KJS::RegExpObjectImp::getLastParen):
+        (KJS::RegExpObjectImp::getLeftContext):
+        (KJS::RegExpObjectImp::getRightContext):
+        (KJS::RegExpObjectImp::getValueProperty):
+        (KJS::RegExpObjectImp::createRegExpImp):
+        * kjs/regexp_object.h:
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::StringInstance):
+        (KJS::StringInstance::lengthGetter):
+        (KJS::StringInstance::indexGetter):
+        (KJS::stringInstanceNumericPropertyGetter):
+        (KJS::StringPrototype::StringPrototype):
+        (KJS::replace):
+        (KJS::stringProtoFuncCharAt):
+        (KJS::stringProtoFuncCharCodeAt):
+        (KJS::stringProtoFuncConcat):
+        (KJS::stringProtoFuncIndexOf):
+        (KJS::stringProtoFuncLastIndexOf):
+        (KJS::stringProtoFuncMatch):
+        (KJS::stringProtoFuncSearch):
+        (KJS::stringProtoFuncReplace):
+        (KJS::stringProtoFuncSlice):
+        (KJS::stringProtoFuncSplit):
+        (KJS::stringProtoFuncSubstr):
+        (KJS::stringProtoFuncSubstring):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        (KJS::stringProtoFuncLocaleCompare):
+        (KJS::stringProtoFuncBig):
+        (KJS::stringProtoFuncSmall):
+        (KJS::stringProtoFuncBlink):
+        (KJS::stringProtoFuncBold):
+        (KJS::stringProtoFuncFixed):
+        (KJS::stringProtoFuncItalics):
+        (KJS::stringProtoFuncStrike):
+        (KJS::stringProtoFuncSub):
+        (KJS::stringProtoFuncSup):
+        (KJS::stringProtoFuncFontcolor):
+        (KJS::stringProtoFuncFontsize):
+        (KJS::stringProtoFuncAnchor):
+        (KJS::stringProtoFuncLink):
+        (KJS::StringObjectImp::StringObjectImp):
+        (KJS::StringObjectImp::construct):
+        (KJS::StringObjectImp::callAsFunction):
+        (KJS::StringObjectFuncImp::StringObjectFuncImp):
+        (KJS::StringObjectFuncImp::callAsFunction):
+        * kjs/string_object.h:
+        (KJS::StringInstanceThatMasqueradesAsUndefined::StringInstanceThatMasqueradesAsUndefined):
+        * kjs/testkjs.cpp:
+        (GlobalObject::GlobalObject):
+        (functionGC):
+        (functionRun):
+        (functionReadline):
+        (kjsmain):
+        * kjs/ustring.h:
+        * kjs/value.cpp:
+        (KJS::JSCell::operator new):
+        (KJS::jsString):
+        (KJS::jsOwnedString):
+        (KJS::jsNumberCell):
+        * kjs/value.h:
+        (KJS::jsNaN):
+        (KJS::jsNumber):
+        (KJS::jsNumberFromAnd):
+        (KJS::JSCell::marked):
+        (KJS::JSCell::mark):
+        (KJS::JSValue::toJSNumber):
+        Removed collectOnMainThreadOnly, as this is the only way to collect now. Replaced calls to
+        static Collector methods with calls to per-thread Heap ones.
+
+2008-05-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - Mac build fix
+
+        * wtf/StrHash.h: Added header guards and removed #include "config.h".
+
+2008-05-01  Ada Chan  <adachan@apple.com>
+
+        #include <wtf/StrHash.h> in identifier.cpp.
+
+        Reviewed by Maciej.
+
+        * kjs/identifier.cpp:
+
+2008-05-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-05-01  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - Fix "sample" output so that it can be imported into Instruments
+        - Also keep track of number of times a function is profiled.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add StrHash.h which needed
+        to be pulled out of identifier.cpp so that it could be used by the
+        profiler and identifiers.
+        * kjs/identifier.cpp: Ditto.
+        * profiler/FunctionCallProfile.cpp:
+        (KJS::FunctionCallProfile::printDataInspectorStyle): Inspector style
+        printing should show microseconds.
+        (KJS::FunctionCallProfile::printDataSampleStyle): Sample style printing
+        now counts the number of times a function is in the stack tree and does
+        not print microseconds since that does not make sense for a sampler.
+        * profiler/FunctionCallProfile.h: Keep track of number of times a
+        function is profiled.
+        (KJS::FunctionCallProfile::numberOfCalls):
+        * profiler/Profiler.cpp:
+        (KJS::functionNameCountPairComparator): Comparator for sort function in
+        printDataSampleStyle.
+        (KJS::Profiler::printDataSampleStyle): Print the number of times that a
+        function is listed in the stack tree in order of most times listed.
+        * wtf/HashCountedSet.h: Added copyToVector since it didn't exist and is
+        a more standard way to copy a HashSet to a Vector. I added on variant
+        that takes a pair as the Vector's type and so the HashCountedSet simply
+        fills in that pair with its internal pair, and another variant that
+        takes a Vector of the type of the HashCountedSet and only fills in the
+        Vector with the first element of the pair.
+        (WTF::copyToVector):
+        * wtf/StrHash.h: Added.
+        (WTF::):
+
+2008-04-29  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX for ENABLE(DASHBOARD_SUPPORT)
+
+        * wtf/Platform.h: Defined ENABLE(DASHBOARD_SUPPORT) to 1 only for
+        PLATFORM(MAC) and PLATFORM(WIN).  Changed default to 0 for other
+        ports.
+
+2008-04-29  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin.
+
+        Wrapped Dashboard code with ENABLE(DASHBOARD_SUPPORT)
+
+        * wtf/Platform.h:
+
+2008-04-29  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        -<rdar://problem/5770054> JavaScript profiler (10928)
+        -Keep call count.
+
+        * profiler/FunctionCallProfile.cpp:
+        (KJS::FunctionCallProfile::FunctionCallProfile):
+        (KJS::FunctionCallProfile::didExecute): Implements call count and fixed a bug where a stackIndex
+        of 0 was causing the assert to be hit.
+        (KJS::FunctionCallProfile::stopProfiling):
+        (KJS::FunctionCallProfile::endAndRecordCall):
+        * profiler/FunctionCallProfile.h:
+
+2008-04-29  Simon Hausmann  <hausmann@webkit.org>
+
+        Qt/Windows build fix. The externally declared hash tables are actually
+        declared const and the const is mangled in the symbol name, so when
+        importing they also need to be marked const.
+
+        When compiling without MULTIPLE_THREADS use a const HashTable&
+        instead of a HashTable& in ThreadClassInfoHashTables to avoid
+        initializing the latter with a const reference.
+
+        * kjs/JSGlobalObject.cpp:
+
+2008-04-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * kjs/ExecState.h: For whatever reason, MSVC couldn't generate a default constructor for
+        a struct that had a "const List" member. Removing the const qulifier makes the problem go away.
+
+2008-04-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Fix run-webkit-tests --threading
+        and provisionally fix <https://bugs.webkit.org/show_bug.cgi?id=18661>
+        Proxy server issue in Sunday's Nightly
+
+        Changed ClassInfo objects for built-in objects to hold a getter function returning
+        a per-thread instance. This makes it safe to share these ClassInfo objects between threads -
+        and these are the only ones that need to be shared.
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::Lexer):
+        (KJS::Lexer::~Lexer):
+        * kjs/lexer.h:
+        Made mainTable a member of Lexer, so that it no longer needs to be shared between threads.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::deleteProperty):
+        (KJS::JSObject::findPropertyHashEntry):
+        (KJS::JSObject::propertyIsEnumerable):
+        (KJS::JSObject::getPropertyAttributes):
+        (KJS::JSObject::getPropertyNames):
+        * kjs/object.h:
+        (KJS::ClassInfo::propHashTable):
+        Added a new classPropHashTableGetterFunction field to ClassInfo. If it is non-zero, the
+        static table is not used.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::ThreadClassInfoHashTables::ThreadClassInfoHashTables): This new class holds per-thread
+        HashTables for built-in classes. The old static structs are copied to create per-thread
+        instances.
+        (KJS::JSGlobalObject::threadClassInfoHashTables): An accessor/initializer for the above.
+        (KJS::JSGlobalObject::init): Copy per-thread data into a single structure for faster access.
+        Also, construct globalExec.
+        (KJS::JSGlobalObject::reset): Adapted for globalExec now being an OwnPtr.
+        (KJS::JSGlobalObject::mark): Ditto.
+        (KJS::JSGlobalObject::globalExec): Ditto.
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Made JSGlobalObject::JSGlobalObjectData::globalExec an OwnPtr, so that it can
+        be initialized from JSGlobalObject::init() after them. Otherwise, ExecState constructor was
+        trying to access half-initialized JSGlobalObject to make its own copy of these table
+        references, and failed.
+        (KJS::JSGlobalObject::JSGlobalObject): Pass "this" value to init() to create globalExec.
+        (KJS::JSGlobalObject::perThreadData): An accessor for per-thread data.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        * kjs/ExecState.h:
+        (KJS::ExecState::propertyNames):
+        (KJS::ExecState::emptyList):
+        (KJS::ExecState::arrayTable):
+        (KJS::ExecState::dateTable):
+        (KJS::ExecState::mathTable):
+        (KJS::ExecState::numberTable):
+        (KJS::ExecState::RegExpImpTable):
+        (KJS::ExecState::RegExpObjectImpTable):
+        (KJS::ExecState::stringTable):
+        * kjs/ExecStateInlines.h:
+        (KJS::ExecState::ExecState):
+        Each ExecState holds its own reference to per-thread data, for even faster access. Moved
+        m_emptyList and m_propertyNames to the same structure, making ExecState faster to construct
+        and take less space on the stack.
+
+        * kjs/InitializeThreading.cpp: (KJS::initializeThreading): Initialize thread-static data
+        added to JSGlobalObject.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObject.cpp:
+        * JavaScriptCore.exp:
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::getPropertyAttributes):
+        * kjs/JSVariableObject.h:
+        * kjs/array_instance.cpp:
+        * kjs/array_object.cpp:
+        (KJS::ArrayPrototype::getOwnPropertySlot):
+        * kjs/bool_object.cpp:
+        * kjs/create_hash_table:
+        * kjs/date_object.cpp:
+        (KJS::DatePrototype::getOwnPropertySlot):
+        (KJS::DateObjectImp::DateObjectImp):
+        * kjs/error_object.cpp:
+        * kjs/function.cpp:
+        * kjs/function_object.cpp:
+        (KJS::FunctionPrototype::FunctionPrototype):
+        * kjs/internal.cpp:
+        * kjs/lookup.h:
+        * kjs/math_object.cpp:
+        (KJS::MathObjectImp::getOwnPropertySlot):
+        * kjs/number_object.cpp:
+        (KJS::NumberObjectImp::getOwnPropertySlot):
+        * kjs/object_object.cpp:
+        (KJS::ObjectPrototype::ObjectPrototype):
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpPrototype::RegExpPrototype):
+        (KJS::RegExpImp::getOwnPropertySlot):
+        (KJS::RegExpImp::put):
+        (KJS::RegExpObjectImp::getOwnPropertySlot):
+        (KJS::RegExpObjectImp::put):
+        * kjs/string_object.cpp:
+        (KJS::StringPrototype::getOwnPropertySlot):
+        Adjust for the above changes.
+
+2008-04-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam.
+
+        - make sure RefPtr's default hash doesn't ref/deref when computing the hash
+        - remove remnants of the hash table storage type optimization
+
+        * wtf/HashFunctions.h: Used "using" to get the hash and equal functions
+        from PtrHash<P*> into PtrHash<RefPtr<P>>.
+
+        * wtf/HashMap.h: Replaced uses of PairBaseHashTraits with PairHashTraits.
+        Eliminated storage-related typedefs. Removed constructor, destructor,
+        copy constructor, and destructor since the compiler-generated ones are
+        fine. Removed refAll and derefAll. Took out unnnecessary typecasts.
+        Removed use of RefCounter.
+
+        * wtf/HashSet.h: Eliminated storage-related typedefs. Removed constructor,
+        destructor, copy constructor, and destructor since the compiler-generated
+        ones are fine. Removed refAll and derefAll. Removed unneeded template
+        arguents from HashSetTranslatorAdapter. Eliminated unneeded HashSetTranslator
+        template.
+
+        * wtf/HashTable.h: Tweaked formatting. Removed NeedsRef, RefCounterBase,
+        RefCounter, HashTableRefCounterBase, HashTableRefCounter, and Assigner
+        class templates.
+
+        * wtf/HashTraits.h: Removed StorageTraits, needsRef, PairBaseHashTraits,
+        and HashKeyStorageTraits.
+
+        * wtf/RefPtrHashMap.h: Made all the same fixes as in HashMap. Also made
+        the corresponding changes to RefPtrHashMapRawKeyTranslator.
+
+2008-04-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mitz.
+
+        - fix assertion hit every time you view www.apple.com
+
+        * kjs/PropertyNameArray.cpp:
+        (KJS::PropertyNameArray::add): Changed assertion to allow null and empty strings.
+        Now to find out why we have a property named "" and if that's a bug!
+
+2008-04-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix crash inside PtrHash::hash when loading a page.
+
+        * wtf/HashFunctions.h: Explicitly use the superclass implementation of hash to avoid infinite recursion.
+
+2008-04-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix <rdar://problem/5657459> REGRESSION: JavaScriptCore no longer builds with
+          GCC 4.2 due to pointer aliasing warnings
+
+        Fix this by removing the HashTable optimizations that allowed us to share a back end
+        implementation between hash tables with integers, pointers, RefPtr, and String objects
+        as keys. The way it worked was incompatible with strict aliasing.
+
+        This increases code size. On Mac OS X we'll have to regenerate .order files to avoid
+        slowing down Safari startup times.
+
+        This creates a slight slowdown in SunSpider, mitigated by the following four speedups:
+
+        - speed up array put slightly by moving a branch (was already done for get)
+
+        - speed up symbol table access by adding a function named inlineGet to HashMap
+          and using that in symbolTableGet/Put
+
+        - speed up PropertyNameArray creation by reducing the amount of reference count
+          churn and uniqueness checking when adding names and not doing any allocation at
+          all when building small arrays
+
+        - speed up conversion of strings to floating point numbers by eliminating the
+          malloc/free of the buffer for the ASCII copy of the string; a way to make
+          things even faster would be to change strtod to take a UTF-16 string
+
+        Note that there is considerable unused complexity now in HashSet/Map/Table to support
+        "storage types", which is no longer used. Will do in a separate patch.
+
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::JSCallbackObject<Base>::getPropertyNames): Removed explicit cast to Identifier to
+        take advantage of the new PropertyNameArray::add overload and avoid reference count churn.
+        * API/JSObjectRef.cpp:
+        (JSPropertyNameAccumulatorAddName): Ditto.
+        * JavaScriptCore.exp: Updated PropertyNameArray::add entry point name.
+
+        * kjs/JSVariableObject.cpp: Removed now-unneeded IdentifierRepHashTraits::nullRepPtr
+        definition (see below).
+        (KJS::JSVariableObject::getPropertyNames): Removed explicit cast to Identifier.
+
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableGet): Use inlineGet for speed. Also changed to do
+        early exit instead of nesting the body inside an if.
+        (KJS::JSVariableObject::symbolTablePut): Ditto.
+
+        * kjs/PropertyNameArray.cpp:
+        (KJS::PropertyNameArray::add): Changed implementation to take a raw pointer instead of
+        a reference to an identifier. Do uniqueness checking by searching the vector when the
+        vector is short, only building the set once the vector is large enough.
+
+        * kjs/PropertyNameArray.h: Added an overload of add for a raw pointer, and made the old
+        add function call that one. Added an addKnownUnique function for use when the new
+        name is known to be different from any other in the array. Changed the vector to have
+        an inline capacity of 20.
+
+        * kjs/SymbolTable.h: Changed IdentifierRepHash to inherit from the default hash for
+        a RefPtr so we don't have to define so much. Added an overload of the hash function for
+        a raw pointer as required by the new RefPtrHashMap. Got rid of the now-unneeded
+        IdentifierRepHashTraits -- the default traits now work fine. Added a definition of
+        empthValueIsZero to SymbolTableIndexHashTraits; not having it was incorrect, but harmless.
+
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::put): Move the maxArrayIndex check inside the branch that checks
+        the index against the length, as done in the get function.
+
+        * kjs/function.cpp:
+        (KJS::globalFuncKJSPrint): Changed to use the new getCString instead of cstring.
+
+        * kjs/internal.cpp: Removed printInfo debugging function, a client of cstring.
+        If we need a debugging function we can easily make a better one and we haven't
+        used this one in a long time.
+        * kjs/internal.h: Ditto.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::getPropertyNames): Removed explicit cast to Identifier.
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::getEnumerablePropertyNames): Ditto. Also added a special case for
+        the case where the propertyNames array is empty -- in that case we know we're adding
+        a set of names that are non-overlapping so we can use addKnownUnique.
+        * kjs/ustring.cpp:
+        (KJS::UString::getCString): Replaces cstring. Puts the C string into a CStringBuffer,
+        which is a char Vector with an inline capacity. Also returns a boolean to indicate if
+        the converion was lossy, which eliminates the need for a separate is8Bit call.
+        (KJS::UString::toDouble): Changed to call getCString instead of cstring.
+        * kjs/ustring.h: Ditto.
+
+        * wtf/HashFunctions.h: Overload the hash and equal functions for RefPtr's default
+        hash to take raw pointers. This works with the changes to RefPtrHashMap to avoid
+        introducing refcount churn.
+
+        * wtf/HashMap.h: Removed special code to convert the deleted value to the empty value
+        when writing a new value into the map. This is now handled elsewhere.
+        (WTF::HashMap::get): Removed code that checks for an empty hash table before calling
+        HashTable::lookup; it's slightly more efficient to do this check inside lookup.
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::isDeletedBucket): Changed to use isDeletedValue instead of using
+        deletedValue and the equality operator.
+        (WTF::HashTable::deleteBucket): Changed to use constructDeletedValue instead of
+        using deletedValue and the assignment operator.
+        (WTF::HashTable::checkKey): Added. Factors out the check for values that are empty
+        or deleted keys that's used in various functions below.
+        (WTF::HashTable::lookup): Changed to use checkKey, check for a 0 table, and also
+        made public for use by RefPtrHashMap.
+        (WTF::HashTable::lookupForWriting): Changed to use checkKey.
+        (WTF::HashTable::fullLookupForWriting): Changed to use checkKey.
+        (WTF::HashTable::add): Changed to use checkKey, and call initializeBucket on a
+        deleted bucket before putting a new entry into it.
+        (WTF::HashTable::addPassingHashCode): Ditto.
+        (WTF::HashTable::deallocateTable): Check isDeletedBucket before calling ~ValueType.
+
+        * wtf/HashTraits.h: Got ridd of all the HashTraits specialization for the integer
+        types, since GeneicHashTraitsBase already deals with integers separately. Put the
+        deleted value support into GenericHashTraitsBase. Changed FloatHashTraits to
+        inherit from GenericHashTraits, and define construct/isDeletedValue rather than
+        deletedValue. Removed the ref and deref functions from RefPtr's HashTraits, and
+        defined construct/isDeletedValue. Eliminated DeletedValueAssigner. Changed
+        PairHashTraits to define construct/isDeletedValue, and also merged
+        PairBaseHashTraits in with PairHashTraits. Got rid of all specialization of
+        HashKeyStorageTraits. We'll remove that, and the needsRef data member, later.
+
+        * wtf/RefPtr.h: Added HashTableDeletedValueType, an enum type with a single value,
+        HashTableDeletedValue. Used that type to make a new constructor to construct
+        deleted values and also added an isHashTableDeletedValue function.
+
+        * wtf/RefPtrHashMap.h: Added RefPtrHashMapRawKeyTranslator and used it to implement
+        the raw pointer functions. This is a way to continue to avoid refcount thrash. We
+        can't use the old way because it depended on the underlying map using a non-RefPtr
+        type.
+        (WTF::HashMap::find): Use find with RefPtrHashMapRawKeyTranslator.
+        (WTF::HashMap::contains): Use contains with RefPtrHashMapRawKeyTranslator.
+        (WTF::HashMap::inlineAdd): Use add with RefPtrHashMapRawKeyTranslator.
+        (WTF::HashMap::get): Removed code that checks for an empty hash table before calling
+        HashTable::lookup; it's slightly more efficient to do this check inside lookup.
+        (WTF::HashMap::inlineGet): Added. Just like get, but marked inline for use in the
+        symbol table code.
+
+2008-04-25  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Mark Rowe.
+
+        Remove SavedBuiltins and SavedProperties classes and the methods used to
+        save data to them.  The CachedPage now stores a the JSGlobalObject in full.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        * kjs/JSVariableObject.cpp:
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::localStorage):
+        * kjs/SavedBuiltins.h: Removed.
+        * kjs/object.h:
+        * kjs/property_map.cpp:
+        * kjs/property_map.h:
+
+2008-04-25  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add some content to an empty ICU header file to prevent verification errors.
+
+        * icu/unicode/utf_old.h:
+
+2008-04-25  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/5819422> REGRESSION: Wrong line number passed to -willLeaveCallFrame
+
+        Patch by George Dicker and Michael Kahl.  Reviewed by Darin.
+
+        When -[NSObject(WebScriptDebugDelegate) webView:willLeaveCallFrame:sourceId:line:forWebFrame:]
+        is invoked, the first line number of the function is returned instead of the last
+        line number.  This regressed in r28458.
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNodeWithDebuggerHooks::execute): Pass lastLine() instead of lineNo()
+        when calling Debugger::returnEvent().
+
+2008-04-25  Darin Adler  <darin@apple.com>
+
+        Done with Stephanie Lewis.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Prepare for compilation with gcc 4.2 by
+        adding -fno-strict-aliasing to CollatorICU.cpp.
+
+2008-04-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add a #define to easily enable collecting on every allocation to aid
+        debugging GC bugs.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::heapAllocate):
+
+2008-04-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam and Sam.
+
+        -<rdar://problem/5770054> JavaScript profiler (10928)
+        -Only profile the page group that starts profiling to avoid profiling
+        tools that shouldn't be profiled unless explicitly requested to.
+
+        * JavaScriptCore.exp: Export new signature.
+        * kjs/JSGlobalObject.cpp: Add unique identifiers to the JSGlobalObject.
+        (KJS::JSGlobalObject::init):
+        * kjs/JSGlobalObject.h: Ditto.
+        (KJS::JSGlobalObject::setPageGroupIdentifier):
+        (KJS::JSGlobalObject::pageGroupIdentifier):
+        * profiler/Profiler.cpp: Check the identifier of the page group of the
+        lexical global exec state and only profile if it matches the given page
+        group identifier.
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+        * profiler/Profiler.h: Ditto.
+        (KJS::Profiler::Profiler):
+
+2008-04-24  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Simon.
+
+        Bug 15940: Implement threading API for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=15940
+
+        Original patch by Justin Haygood, tweaked by me.
+
+        * JavaScriptCore.pri:
+        * wtf/ThreadingQt.cpp: Added.
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::ThreadPrivate::getReturnValue):
+        (WTF::ThreadPrivate::ThreadPrivate):
+        (WTF::ThreadPrivate::run):
+        (WTF::createThread):
+        (WTF::waitForThreadCompletion): return !res to return
+        0 on success (to match the pthreads implementation).
+        (WTF::detachThread):
+        (WTF::identifierByQthreadHandle):
+        (WTF::currentThread):
+        (WTF::Mutex::Mutex):
+        (WTF::Mutex::~Mutex):
+        (WTF::Mutex::lock):
+        (WTF::Mutex::tryLock):
+        (WTF::Mutex::unlock):
+        (WTF::ThreadCondition::ThreadCondition):
+        (WTF::ThreadCondition::~ThreadCondition):
+        (WTF::ThreadCondition::wait):
+        (WTF::ThreadCondition::timedWait):
+        (WTF::ThreadCondition::signal):
+
+2008-04-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - simplify use of HashTraits to prepare for some upcoming hash table changes
+
+        * kjs/SymbolTable.h: Made SymbolTableIndexHashTraits derive from HashTraits<size_t>
+        and specialize only the empty value.
+
+2008-04-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Removed the #define for USE_SYSTEM_MALLOC that we set in WebKit.pri
+        already.
+
+        * wtf/Platform.h:
+
+2008-04-21  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam.
+
+        <rdar://problem/5770054> JavaScript profiler (10928)
+        - When stop profiling is called we need to stop the timers on all the
+        functions that are still running.
+
+        * profiler/FunctionCallProfile.cpp:
+        (KJS::FunctionCallProfile::didExecute):
+        (KJS::FunctionCallProfile::stopProfiling):
+        * profiler/FunctionCallProfile.h:
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::stopProfiling):
+
+2008-04-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Move collector main thread initialization from WebKit/win to KJS::initializeThreading.
+
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreading):
+
+2008-04-21  Adam Roben  <aroben@apple.com>
+
+        MSVC build fix
+
+        Reviewed by Alexey Proskuryakov.
+
+        * kjs/ustring.h:
+        (KJS::UString::cost): Disable a warning about assigning a 32-bit
+        size_t into a 31-bit size_t.
+
+2008-04-21  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Lars.
+
+        Made convertValueToQVariant accessible from within WebKit/qt/Api
+
+        * bindings/qt/qt_runtime.h:
+
+2008-04-21  Holger Hans Peter Freyther  <holger.freyther@trolltech.com>
+
+        Reviewed by Simon.
+
+        Build fix for Qt 4.3
+
+        * When building WebCore/internal make sure the QT_[BEGIN,END]_NAMESPACE is
+        always defined. Do this by adding defines to the compiler line
+        * For users of our API this is not feasible. Every public header file should
+        include qwebkitglobal.h. Define the QT_BEGIN_NAMESPACE and QT_END_NAMESPACE
+        when we are building everything < 4.4.0 and don't have them defined.
+
+        * kjs/testkjs.pro:
+
+2008-04-19  Matt Lilek  <webkit@mattlilek.com>
+
+        Not reviewed, Windows build fix - copy the profiler headers in all
+        configurations, not just Debug_Internal.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-04-19  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Alp Toker.
+
+        Don't build testkjs with rpath.
+
+        * GNUmakefile.am:
+
+2008-04-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes. Rename LocalStorage.h to LocalStorageEntry.h
+        to avoid header detection issues between WebCore/storage/LocalStorage.h 
+        and it, and add $(PROFILER_SOURCES) to the wx JSCore build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jscore.bkl:
+        * kjs/ExecState.h:
+        * kjs/JSVariableObject.h:
+        * kjs/LocalStorage.h: Removed.
+        * kjs/LocalStorageEntry.h: Copied from JavaScriptCore/kjs/LocalStorage.h.
+        * kjs/function.h:
+
+2008-04-18 Jan  Michael Alonzo  <jmalonzo@unpluggable.com>
+
+        Reviewed by Alp Toker.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16620
+        [GTK] Autotools make dist and make check support
+
+        Cleanups.
+
+        * GNUmakefile.am:
+
+2008-04-18  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Windows
+        build fix.
+
+2008-04-11  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Antti Koivisto.
+
+        Silence GCC 4.3 warnings by removing extraneous consts.
+
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+
+2008-04-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        -<rdar://problem/5770054> JavaScript profiler (10928)
+        - Use Deque instead of Vector since the profiler uses prepend a lot
+        and deque is faster at that.
+
+        * profiler/FunctionCallProfile.h:
+        (KJS::FunctionCallProfile::milliSecs): Corrected the name to match
+        its output.
+        * wtf/Deque.h:
+        (WTF::deleteAllValues):
+
+2008-04-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam and Adam.
+
+        -<rdar://problem/5770054> JavaScript profiler (10928)
+        - Cleaned up the header file and made some functions static, added
+        a new, sane, printing function, and fixed a few minor bugs.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/FunctionCallProfile.cpp:
+        (KJS::FunctionCallProfile::didExecute): Removed assertion that time is
+        > 0 because at ms resolution that may not be true and only cross-
+        platform way to get time differences is in ms.
+        (KJS::FunctionCallProfile::printDataInspectorStyle): Added a new
+        printing function for dumping data in a sane style.
+        (KJS::FunctionCallProfile::printDataSampleStyle): Fixed a bug where we
+        displayed too much precision when printing our floats. Also added logic
+        to make sure we don't display 0 because that doesn't make sense for a
+        sampling profile.
+        * profiler/FunctionCallProfile.h:
+        * profiler/Profiler.cpp: Moved functions that could be static into the
+        implementation, and chaned the ASSERTs to early returns.  I did this
+        because console.profile() is a JS function and so was being profiled
+        but asserting because the profiler had not been started! In the future
+        I would like to put the ASSERTs back and not profile the calls to
+        console.profile() and console.profileEnd().
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+        (KJS::getStackNames): Fixed a bug where the wrong ExecState was being
+        used.
+        (KJS::getFunctionName):
+        (KJS::Profiler::printDataInspectorStyle):
+        * profiler/Profiler.h:
+
+2008-04-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Fix leaks during plugin tests (which actually excercise background JS), and potential
+        PAC brokenness that was not reported, but very likely.
+
+        The leaks shadowed a bigger problem with Identifier destruction. Identifier::remove involves
+        an IdentifierTable lookup, which is now a per-thread instance. Since garbage collection can
+        currently happen on a different thread than allocation, a wrong table was used.
+
+        No measurable change on SunSpider total, ~1% variation on individual tests.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::create):
+        (KJS::UString::Rep::destroy):
+        * kjs/ustring.h:
+        Replaced isIdentifier with a pointer to IdentifierTable, so that destruction can be done
+        correctly. Took one bit from reportedCost, to avoid making UString::Rep larger (performance
+        effect was measurable on SunSpider).
+
+        * kjs/identifier.cpp:
+        (KJS::IdentifierTable::IdentifierTable):
+        (KJS::IdentifierTable::~IdentifierTable):
+        (KJS::IdentifierTable::add):
+        (KJS::IdentifierTable::remove):
+        Make IdentifierTable a real class. Its destructor needs to zero out outstanding references,
+        because some identifiers may briefly outlive it during thread destruction, and we don't want
+        them to use their stale pointers.
+
+        (KJS::LiteralIdentifierTable):
+        (KJS::Identifier::add):
+        Now that LiteralIdentifierTable is per-thread and can be destroyed not just during application
+        shutdown, it is not appropriate to simply bump refcount for strings that get there; changed
+        the table to hold RefPtrs.
+
+        (KJS::CStringTranslator::translate):
+        (KJS::UCharBufferTranslator::translate):
+        (KJS::Identifier::addSlowCase):
+        (KJS::Identifier::remove):
+        * kjs/identifier.h:
+        (KJS::Identifier::add):
+        Use and update UString::Rep::identifierTable as appropriate. Updating it is now done in
+        IdentifierTable::add, not in translators.
+
+2008-04-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Get rid of static compareWithCompareFunctionArguments in array_instance.cpp.
+
+        No change on SunSpider, CelticKane or iBench JavaScript. It is probable that in some cases,
+        merge sort is still faster, but more investigation is needed to determine a new cutoff.
+        Or possibly, it would be better to do what FIXME says (change to tree sort).
+
+        Also, made arguments a local variable - not sure why it was a member of
+        CompareWithCompareFunctionArguments.
+
+        * kjs/array_instance.cpp:
+        (KJS::CompareWithCompareFunctionArguments::CompareWithCompareFunctionArguments):
+        (KJS::CompareWithCompareFunctionArguments::operator()):
+        (KJS::ArrayInstance::sort):
+
+2008-04-18  Simon Hausmann  <hausmann@webkit.org>
+
+        Build fix for gcc 4.3. Include stdio.h for printf.
+
+        * profiler/FunctionCallProfile.cpp:
+        * profiler/Profiler.cpp:
+
+2008-04-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Reviewed by mrowe.
+
+        * wtf/Platform.h: Add HAVE_ACCESSIBILITY to Platform.h.
+
+2008-04-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        Thread static data destructors are not guaranteed to be called in any particular order;
+        turn ThreadSpecific into a phoenix-style singleton to avoid accessing freed memory when
+        deleted objects are interdependent (e.g. CommonIdentifiers and internal identifier tables).
+
+        No change on SunSpider.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::Data::Data):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2008-04-15  Srinivas Rao. M Hamse  <msrinirao@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - gcc 3.x build fix
+
+        * kjs/nodes.h: CallerType definition made public for gcc 3.x compilation
+
+2008-04-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Change ThreadSafeShared to act like RefCounted by starting out with a single ref by default
+
+        * wtf/Threading.h:
+        (WTF::ThreadSafeShared::ThreadSafeShared):
+
+2008-04-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        - To keep the behavior of the WebKit and JavaScriptCore API's the same,
+          we need to hide the fact that the global object and the window object
+          are no longer the same thing, and the the global object now changes on
+          navigations.  To do this, only the wrapper should ever be exposed.  This
+          fixes the two remaining spots where the internal global object is exposed,
+          the windowScriptObject returned from [WebFrame windowObject] and the object
+          return by calling JSContextGetGlobalObject on [WebFrame globalContext].
+
+        * API/JSContextRef.cpp:
+        (JSContextGetGlobalObject):
+        This is a bit of a hack, this returns the "this" representation of the globalObject
+        which will be the WrapperWindow for WebCore and the globalObject for non-WebCore.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        Call the new putWithAttributes method instead of relying on lower-level calls.
+        This is needed so that the window wrapper can forward the calls.
+
+        * JavaScriptCore.exp:
+        * kjs/Activation.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::putWithAttributes):
+        * kjs/JSGlobalObject.h:
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTablePutWithAttributes):
+        * kjs/function.cpp:
+        (KJS::ActivationImp::putWithAttributes):
+        * kjs/nodes.cpp:
+        (KJS::ConstDeclNode::handleSlowCase):
+        (KJS::ConstDeclNode::evaluateSingle):
+        (KJS::EvalNode::processDeclarations):
+        * kjs/object.cpp:
+        (KJS::JSObject::putWithAttributes):
+        * kjs/object.h:
+        Rename initializeVariable to putWithAttributes and move it down to JSObject so it
+        can be used for JSObjectSetProperty.
+
+2008-04-16  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam and Geoff.
+
+        -<rdar://problem/5770054> JavaScript profiler (10928)
+        Inital profiler prototype
+
+        * GNUmakefile.am: Added new files to project
+        * JavaScriptCore.pri: Ditto
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto
+        * JavaScriptCoreSources.bkl: Ditto
+        * kjs/config.h: Put compiling flag in here.
+        * kjs/function.cpp: Instrument calling the function eval().
+        (KJS::eval):
+        * kjs/interpreter.cpp: Instrument evaluating global scopes.
+        (KJS::Interpreter::evaluate):
+        * kjs/object.cpp: Instrument JS function calls.
+        (KJS::JSObject::call):
+        * profiler: Added.
+        * profiler/FunctionCallProfile.cpp: Added.
+        (KJS::FunctionCallProfile::FunctionCallProfile):
+        (KJS::FunctionCallProfile::~FunctionCallProfile):
+        (KJS::FunctionCallProfile::willExecute): Call right before the JS function or executing context is executed to start the profiler's timer.
+        (KJS::FunctionCallProfile::didExecute): Call right after the JS function or executing context is executed to stop the profiler's timer.
+        (KJS::FunctionCallProfile::addChild): Add a child to the current FunctionCallProfile if it isn't already a child of the current FunctionalCallProfile.
+        (KJS::FunctionCallProfile::findChild): Return the child that matches the given name if there is one.
+        (KJS::FunctionCallProfile::printDataSampleStyle): Print the current profiled information in a format that matches sample's output.
+        * profiler/FunctionCallProfile.h: Added.
+        (KJS::FunctionCallProfile::FunctionCallProfile):
+        (KJS::FunctionCallProfile::~FunctionCallProfile):
+        (KJS::FunctionCallProfile::functionName):
+        (KJS::FunctionCallProfile::microSecs):
+        * profiler/Profiler.cpp: Added.
+        (KJS::Profiler::profiler):
+        (KJS::Profiler::sharedProfiler): Return global singleton (may change due to multi-threading concerns)
+        (KJS::Profiler::startProfiling): Don't start collecting profiling information until the user starts the profiler. Also don't clear old prfiled data until the profiler is restarted.
+        (KJS::Profiler::stopProfiling): Stop collecting profile information.
+        (KJS::Profiler::willExecute): Same as above. 
+        (KJS::Profiler::didExecute): Same as above.
+        (KJS::Profiler::insertStackNamesInTree): Follow the stack of the given names and if a sub-stack is not in the current tree, add it.
+        (KJS::Profiler::getStackNames): Get the names from the different passed in parameters and order them as a stack.
+        (KJS::Profiler::getFunctionName): Get the function name from the given parameter.
+        (KJS::Profiler::printDataSampleStyle): Print the current profiled information in a format that matches sample's output.
+        (KJS::Profiler::debugLog):
+        * profiler/Profiler.h: Added.
+        (KJS::Profiler::Profiler):
+
+2008-04-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        - Remove kjs_ prefix from strtod, dtoa, and freedtoa and put it
+          in the KJS namespace.
+        - Make strtod, dtoa, and freedtoa c++ functions instead of extern "C".
+        - Remove mode switching from dtoa.  ~2% improvement on test 26. 
+        - Removes all unnecessary #defines from dtoa code.
+
+        * JavaScriptCore.exp:
+        * kjs/dtoa.cpp:
+        (KJS::ulp):
+        (KJS::b2d):
+        (KJS::d2b):
+        (KJS::ratio):
+        (KJS::strtod):
+        (KJS::freedtoa):
+        (KJS::dtoa):
+        * kjs/dtoa.h:
+        * kjs/function.cpp:
+        (KJS::parseInt):
+        * kjs/lexer.cpp:
+        (KJS::Lexer::lex):
+        * kjs/number_object.cpp:
+        (KJS::integer_part_noexp):
+        (KJS::numberProtoFuncToExponential):
+        * kjs/ustring.cpp:
+        (KJS::UString::from):
+        (KJS::UString::toDouble):
+
+2008-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Get rid of static execForCompareByStringForQSort in array_instance.cpp.
+
+        No change on SunSpider, CelticKane or iBench JavaScript.
+
+        * kjs/array_instance.cpp:
+        (KJS::ArraySortComparator::ArraySortComparator):
+        (KJS::ArraySortComparator::operator()):
+        (KJS::ArrayInstance::sort):
+        Switch slow case to std::sort, so that ExecState can be passed in a comparator.
+
+2008-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        MSVC build fix.
+
+        * kjs/CommonIdentifiers.cpp:
+        * kjs/CommonIdentifiers.h:
+        * kjs/Parser.cpp:
+        * kjs/Parser.h:
+        * kjs/identifier.cpp:
+        * kjs/lexer.h:
+        * wtf/ThreadSpecific.h:
+
+2008-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * kjs/date_object.cpp:
+        * kjs/date_object.h:
+        Don't include DateMath.h from date_object.h, as the latter is used from WebCore, while
+        where the former is not available.
+
+2008-04-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for MSVC. It does not want to have
+        WTF in the KJS namespace.
+
+        * kjs/CommonIdentifiers.h:
+
+2008-04-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for gcc.
+
+        ::msToGregorianDateTime  is not known to it.
+
+        * kjs/date_object.cpp:
+        (KJS::DateInstance::msToGregorianDateTime):
+
+2008-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Initialize threadMapMutex safely (as already done in ThreadingWin).
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+
+2008-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cache Gregorian date/time structure on DateInstance objects for 1.027x SunSpider speedup
+        (1.65x on date-format-xparb, 1.13x on date-format-tofte).
+
+        * kjs/DateMath.h:
+        (KJS::GregorianDateTime::copyFrom): Added. It presumably makes sense to keep GregorianDateTime
+        Noncopyable, so it's not just operator=.
+
+        * kjs/date_object.h: Added a per-object cache.
+
+        * kjs/date_object.cpp:
+        (KJS::DateInstance::DateInstance):
+        (KJS::DateInstance::msToGregorianDateTime):
+        (KJS::dateProtoFuncToString):
+        (KJS::dateProtoFuncToUTCString):
+        (KJS::dateProtoFuncToDateString):
+        (KJS::dateProtoFuncToTimeString):
+        (KJS::dateProtoFuncToLocaleString):
+        (KJS::dateProtoFuncToLocaleDateString):
+        (KJS::dateProtoFuncToLocaleTimeString):
+        (KJS::dateProtoFuncGetFullYear):
+        (KJS::dateProtoFuncGetUTCFullYear):
+        (KJS::dateProtoFuncToGMTString):
+        (KJS::dateProtoFuncGetMonth):
+        (KJS::dateProtoFuncGetUTCMonth):
+        (KJS::dateProtoFuncGetDate):
+        (KJS::dateProtoFuncGetUTCDate):
+        (KJS::dateProtoFuncGetDay):
+        (KJS::dateProtoFuncGetUTCDay):
+        (KJS::dateProtoFuncGetHours):
+        (KJS::dateProtoFuncGetUTCHours):
+        (KJS::dateProtoFuncGetMinutes):
+        (KJS::dateProtoFuncGetUTCMinutes):
+        (KJS::dateProtoFuncGetSeconds):
+        (KJS::dateProtoFuncGetUTCSeconds):
+        (KJS::dateProtoFuncGetTimezoneOffset):
+        (KJS::setNewValueFromTimeArgs):
+        (KJS::setNewValueFromDateArgs):
+        (KJS::dateProtoFuncSetYear):
+        (KJS::dateProtoFuncGetYear):
+        Use the cache when converting.
+
+2008-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Implement an abstraction for thread-specific storage, use it to get rid of some static objects.
+
+        SunSpider results were not conclusive, possibly up to 0.2% slowdown.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        Added ThreadSpecific.h
+
+        * wtf/ThreadSpecific.h: Added.
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+        (WTF::T):
+        (WTF::::operator):
+        Only implemented for platforms that use pthreads.
+
+        * kjs/CommonIdentifiers.cpp:
+        (KJS::CommonIdentifiers::shared):
+        * kjs/CommonIdentifiers.h:
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreading):
+        * kjs/Parser.cpp:
+        (KJS::parser):
+        * kjs/Parser.h:
+        * kjs/identifier.cpp:
+        (KJS::identifierTable):
+        (KJS::literalIdentifierTable):
+        (KJS::Identifier::initializeIdentifierThreading):
+        * kjs/identifier.h:
+        * kjs/lexer.cpp:
+        (KJS::lexer):
+        * kjs/lexer.h:
+        Make static instances per-thread.
+
+2008-04-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam.
+
+        Add ENABLE_OFFLINE_WEB_APPLICATIONS to FEATURE_DEFINES.
+        
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-04-15  Andre Poenitz  <andre.poenitz@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation with Qt namespaces
+
+        Qt can be configured to have all of its classes inside a specified namespaces.
+        This is for example used in plugin/component environments like Eclipse.
+
+        This change makes it possible to let the Qt port compile against a namespaced
+        Qt by the use of macros Qt provides to properly forward declare Qt classes in
+        the namespace.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2008-04-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam.
+
+        Don't leak the prototype class.
+        
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
+
+2008-04-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * wtf/ThreadingWin.cpp:
+
+2008-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18488
+        FastMalloc doesn't release thread-specific data on Windows
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex): (WTF::initializeThreading): Call threadMapMutex once to initialize the static safely.
+        (WTF::ThreadFunctionInvocation::ThreadFunctionInvocation): Added a structure to wrap thread entry point and arguments.
+        (WTF::wtfThreadEntryPoint): Make sure to end all WTF threads with pthread_exit(), to give pthreads-win32 a chance to call
+        destructors of thread-specific data.
+        (WTF::createThread): Use _beginthreadex instead of CreateThread, because MSDN says so. Also removed a call to CreateEvent,
+        for which I could see no reason at all.
+
+2008-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Touched a file to make JavaScriptCore.vcproj rebuild.
+
+        * wtf/MathExtras.h:
+
+2008-04-14  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        Rubberstamped by Alexey Proskuryakov.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Disable
+        the "potentially uninitialized variable" warning for grammar.cpp, as
+        it seems to be incorrect. yylval gets initialized by the lexer, but
+        MSVC doesn't seem to understand this.
+
+2008-04-11  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej.
+        
+        Add default hash for pairs of hashable types.
+
+        * wtf/HashFunctions.h:
+        (WTF::PairHash::hash):
+        (WTF::PairHash::equal):
+        (WTF::):
+
+2008-04-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        Make DateMath.cpp thread safe.
+
+        No measurable change on SunSpider (should be a very small speedup).
+
+        * kjs/DateMath.cpp:
+        (KJS::mimimumYearForDST): (KJS::equivalentYearForDST): Got rid of double caching of the
+        same precomputed value.
+        (KJS::calculateUTCOffset): (KJS::getUTCOffset): Factored actual UTC offset calculation code
+        out of getUTCOffset(), and notification setup into initDateMath().
+
+        (KJS::initDateMath): Added.
+
+        * kjs/DateMath.h:
+        * kjs/InitializeThreading.cpp:
+        (KJS::initializeThreading):
+        Added initDateMath().
+
+2008-04-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * kjs/grammar.y:
+
+2008-04-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Tiger build fix. Forward declaring a union didn't work for whatever reason, make the
+        parameters void*.
+
+        * kjs/grammar.y:
+        * kjs/lexer.cpp:
+        (kjsyylex):
+        (KJS::Lexer::lex):
+        * kjs/lexer.h:
+
+2008-04-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        Generate a pure (re-entrant) parser with Bison.
+
+        No change on SunSpider.
+
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/lexer.cpp:
+        (kjsyylex):
+        (KJS::Lexer::lex):
+        * kjs/lexer.h:
+        Pass state as function arguments, instead of global data. Don't call lexer() as often as
+        before, as this function is about to become slower due to thread-specific storage.
+
+        * kjs/function.cpp:
+        (KJS::isStrWhiteSpace): Don't call isSeparatorSpace() for 8-bit characters, as these are
+        already taken care of. This is a small speedup, compensating for a small slowdown caused
+        by switching Bison mode.
+
+2008-04-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18402
+        REGRESSION: visited element handling is incorrect in nested join/toString calls
+
+        No change on SunSpider total, possibly a tiny improvement (about 0.1%).
+
+        Test: fast/js/array-tostring-and-join.html
+
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::visitedElements): Store visited elements HashSet here, making it
+        common to toString/toLocalizedString/join again.
+
+        * kjs/array_object.cpp:
+        (KJS::arrayProtoFuncToString):
+        (KJS::arrayProtoFuncToLocaleString):
+        (KJS::arrayProtoFuncJoin):
+        Got rid of static variables. Replaced UString with Vector to avoid O(n^2) behavior and
+        regain performance.
+
+        * wtf/Vector.h:
+        (WTF::::resize):
+        (WTF::::grow):
+        (WTF::::reserveCapacity):
+        (WTF::::append):
+        (WTF::::insert):
+        Added null checks, so that Vector methods don't crash when out of memory. The caller should
+        check that data pointer is not null before proceeding.
+
+2008-04-10  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=18367 and the many dupes.
+        Bug 18367: Crash during celtic kane js speed 2007 test
+
+        GCC 4.2 on x86_64 Linux decided to reorder the local variables in markCurrentThreadConservatively's
+        stack frame.  This lead to the range of addresses the collector treated as stack to exclude the
+        contents of volatile registers that markCurrentThreadConservatively forces onto the stack.  This was
+        leading to objects being prematurely collected if the only reference to them was via a register at
+        the time a collection occurred.
+
+        The fix for this is to move the calculation of the top of the stack into a NEVER_INLINE function
+        that is called from markCurrentThreadConservatively.  This forces the dummy variable we use for
+        determining the top of stack to be in a different stack frame which prevents the compiler from
+        reordering it relative to the registers that markCurrentThreadConservatively forces onto the stack.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::markCurrentThreadConservativelyInternal):
+        (KJS::Collector::markCurrentThreadConservatively):
+        * kjs/collector.h:
+
+2008-04-10  Adam Roben  <aroben@apple.com>
+
+        VC++ Express build fix
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Link against user32.lib so
+        that anyone who links against WTF.lib will get user32.lib
+        automatically.
+
+2008-04-09  Adam Roben  <aroben@apple.com>
+
+        VC++ Express build fix
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj: Link against
+        user32.lib.
+
+2008-04-09  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * JavaScriptCore.exp: Export isMainThread.
+
+2008-04-09  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * wtf/AlwaysInline.h: Make sure to #include Platform.h before using
+        the macros it defines.
+
+2008-04-08  Mark Rowe  <mrowe@apple.com>
+
+        Export WTF::initializeThreading() from JavaScriptCore.
+
+        * JavaScriptCore.exp:
+
+2008-04-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        First step in implementing the "split window"
+
+        - Add a GlobalThisValue to ExecState which should be used 
+          in places that used to implement the "use the global object
+          as this if null" rule.
+        - Factor out lookupGetter/lookupSetter into virtual methods 
+          on JSObject so that they can be forwarded.
+        - Make defineGetter/defineSetter virtual methods for the same
+          reason.
+        - Have PrototypeReflexiveFunction store the globalObject used
+          to create it so that it can be used to get the correct thisObject
+          for eval.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * kjs/Activation.h:
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        (KJS::GlobalExecState::GlobalExecState):
+        * kjs/ExecState.h:
+        (KJS::ExecState::globalThisValue):
+        * kjs/ExecStateInlines.h:
+        (KJS::ExecState::ExecState):
+        (KJS::FunctionExecState::FunctionExecState):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        (KJS::JSGlobalObject::toGlobalObject):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (KJS::JSGlobalObject::JSGlobalObject):
+        * kjs/array_instance.cpp:
+        (KJS::CompareWithCompareFunctionArguments::CompareWithCompareFunctionArguments):
+        (KJS::compareWithCompareFunctionForQSort):
+        * kjs/array_object.cpp:
+        (KJS::arrayProtoFuncSort):
+        (KJS::arrayProtoFuncFilter):
+        (KJS::arrayProtoFuncMap):
+        (KJS::arrayProtoFuncEvery):
+        (KJS::arrayProtoFuncForEach):
+        (KJS::arrayProtoFuncSome):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::ActivationImp::toThisObject):
+        (KJS::globalFuncEval):
+        (KJS::PrototypeReflexiveFunction::PrototypeReflexiveFunction):
+        (KJS::PrototypeReflexiveFunction::mark):
+        * kjs/function.h:
+        (KJS::PrototypeReflexiveFunction::cachedGlobalObject):
+        * kjs/function_object.cpp:
+        (KJS::functionProtoFuncApply):
+        (KJS::functionProtoFuncCall):
+        * kjs/nodes.cpp:
+        (KJS::ExpressionNode::resolveAndCall):
+        (KJS::FunctionCallValueNode::evaluate):
+        (KJS::LocalVarFunctionCallNode::inlineEvaluate):
+        (KJS::ScopedVarFunctionCallNode::inlineEvaluate):
+        (KJS::FunctionCallBracketNode::evaluate):
+        (KJS::FunctionCallDotNode::inlineEvaluate):
+        * kjs/object.cpp:
+        (KJS::JSObject::call):
+        (KJS::JSObject::put):
+        (KJS::tryGetAndCallProperty):
+        (KJS::JSObject::lookupGetter):
+        (KJS::JSObject::lookupSetter):
+        (KJS::JSObject::toThisObject):
+        (KJS::JSObject::toGlobalObject):
+        (KJS::JSObject::fillGetterPropertySlot):
+        * kjs/object.h:
+        * kjs/object_object.cpp:
+        (KJS::objectProtoFuncLookupGetter):
+        (KJS::objectProtoFuncLookupSetter):
+        * kjs/string_object.cpp:
+        (KJS::replace):
+
+2008-04-08  Brady Eidson  <beidson@apple.com>
+
+        Encourage Windows to rebuild - AGAIN...
+
+        * kjs/DateMath.cpp:
+
+2008-04-08  Adam Roben  <aroben@apple.com>
+
+        Mac build fix
+
+        * JavaScriptCore.exp: Add callOnMainThread, and sorted the list.
+
+2008-04-08  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Adam Roben
+        
+        Touch some files to *strongly* encourage Windows to rebuilt with DOM_STORAGE enabled
+
+        * kjs/DateMath.cpp:
+
+2008-04-08  Adam Roben  <aroben@apple.com>
+
+        Move callOnMainThread to WTF
+
+        Reviewed by Alexey Proskuryakov.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        Added new files.
+
+        * wtf/MainThread.cpp:
+        * wtf/MainThread.h:
+        * wtf/gtk/MainThreadGtk.cpp:
+        * wtf/mac/MainThreadMac.mm:
+        * wtf/qt/MainThreadQt.cpp:
+        * wtf/win/MainThreadWin.cpp:
+        * wtf/wx/MainThreadWx.cpp:
+        Moved here from WebCore/platform. Replaced all instances of "WebCore"
+        with "WTF".
+
+        * kjs/bool_object.cpp: Touched to force JavaScriptCore.vcproj to
+        build.
+        to the WTF namespace.
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeThreading): Call initializeMainThread.
+
+2008-04-07  Brady Eidson  <beidson@apple.com>
+
+        Add "ENABLE_DOM_STORAGE" to keep in sync with the rest of the project
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-04-07  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * wtf/ThreadingWin.cpp: Back out some changes I didn't mean to land.
+
+2008-04-07  Adam Roben  <aroben@apple.com>
+
+        Add WTF::isMainThread
+
+        Reviewed by Alexey Proskuryakov.
+
+        * wtf/Threading.h: Declare the new function.
+        * wtf/ThreadingGtk.cpp:
+        (WTF::initializeThreading): Initialize the main thread identifier.
+        (WTF::isMainThread): Added.
+        * wtf/ThreadingNone.cpp: Ditto ThreadingGtk.cpp.
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp: Ditto.
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/ThreadingWin.cpp: Ditto.
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+
+2008-04-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Make UString thread-safe.
+
+        No change on SunSpider total, although individual tests have changed a lot, up to 3%.
+
+        * kjs/InitializeThreading.cpp: (KJS::initializeThreading): Call UString::null() to initialize
+        a static.
+        
+        * kjs/identifier.cpp:
+        (KJS::CStringTranslator::translate):
+        (KJS::UCharBufferTranslator::translate):
+        Use "true" for a boolean value instead of 1, because it's C++.
+
+        * kjs/ustring.h:
+        (KJS::CString::adopt): Added a method to create from a char* buffer without copying.
+        (KJS::UString::Rep::ref): Removed an assertion for JSLock::lockCount, as it's no longer
+        necessary to hold JSLock when working with strings.
+        (KJS::UString::Rep::deref): Ditto.
+        (KJS::UString::Rep::isStatic): Added a field to quickly determine that this is an empty
+        or null static string.
+
+        * kjs/ustring.cpp:
+        (KJS::): Removed normalStatBufferSize and statBufferSize, as there is no reason to have such
+        an advanced implementation of a debug-only ascii() method. Removed a long-obsolete comment
+        about UChar.
+        (KJS::UString::Rep::createCopying): Removed an assertion for JSLock::lockCount.
+        (KJS::UString::Rep::create): Ditto.
+        (KJS::UString::Rep::destroy): Ditto. Do not do anything for static null and empty strings,
+        as refcounting is not reliable for those. Reordered branches for a noticeable speed gain -
+        apparently this functiton is hot enough for SunSpider to see an effect from this!
+        (KJS::UString::null): Moved a star, added a comment.
+        (KJS::UString::cstring): Reimplemented to not call ascii(), which is not thread-safe.
+        (KJS::UString::ascii): Simplified statBuffer handling logic.
+        (KJS::UString::toDouble): Use cstring() instead of ascii().
+
+2008-04-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ensure that debug symbols are generated for x86_64 and ppc64 builds.
+
+        * Configurations/Base.xcconfig:
+
+2008-04-01  Christian Dywan  <christian@imendio.com>
+
+        Build fix for GCC 4.3.
+
+        * wtf/unicode/icu/CollatorICU.cpp: include string.h
+
+2008-04-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin.
+
+        Turn off using 64-bit arithmetic on 32-bit hardware, as dtoa own code is faster than
+        compiler-provided emulation.
+
+        1% speedup on Acid3 test 26.
+
+        * kjs/dtoa.cpp:
+
+2008-04-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Make MathExtras.h thread safe.
+
+        * kjs/math_object.cpp:
+        (KJS::mathProtoFuncRandom): If threading is enabled, rely on initializeThreading to call
+        wtf_random_init().
+
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        (WTF::initializeThreading):
+        * wtf/ThreadingNone.cpp:
+        (WTF::initializeThreading):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeThreading):
+        Call wtf_random_init(); made the function non-inline to avoid having to include too many
+        headers in Threading.h.
+
+2008-03-31  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+
+        Make matching of regexps using ^ much faster
+        http://bugs.webkit.org/show_bug.cgi?id=18086
+
+        * pcre/pcre_compile.cpp:
+        (compileBranch):
+        (branchNeedsLineStart):
+        * pcre/pcre_exec.cpp:
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2008-03-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/5829556> REGRESSION: Leak in KJS::initializeThreading()
+
+        * kjs/InitializeThreading.cpp: (KJS::initializeThreading): There is no guarantee that
+        initializeThreading() is called only once; check that the mutex hasn't been already allocated.
+
+2008-03-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 17924: Crash in KJS::ConstDeclNode::evaluate with |with| and |const|
+        <http://bugs.webkit.org/show_bug.cgi?id=17924>
+        <rdar://problem/5806933>
+
+        It turns out this is trivially avoidable if we just match firefox's
+        semantics and ensure that an assignment in a const declaration always
+        writes to the variable object.
+
+        * kjs/nodes.cpp:
+        (KJS::ConstDeclNode::handleSlowCase):
+
+2008-03-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix a dtoa thread safety issue.
+
+        WebCore can call kjs_strtod without holding JS lock, but we didn't have thread safety
+        compiled in for dtoa.
+
+        This is a 0.5% regression on SunSpider, which Sam Weinig has volunteered to cover with
+        his recent improvement.
+
+        * kjs/dtoa.cpp:
+        (Bigint::Balloc):
+        (Bigint::Bfree):
+        Changed to use fastMalloc/fastDelete - they are much faster than the dtoa custom version was
+        in the presence of locking (but somewhat slower in single-threaded case).
+        (Bigint::pow5mult): Got rid of the dreaded double-checked locking anti-pattern (had to
+        restructure the code to avoid significant performance implications).
+        (Bigint::lshift): Rewrote to avoid an allocation, if possible.
+
+        (Bigint::rv_alloc):
+        (Bigint::kjs_freedtoa):
+        (Bigint::kjs_dtoa):
+        Check for USE(MULTIPLE_THREADS), not dtoa legacy MULTIPLE_THREADS.
+
+        * kjs/InitializeThreading.cpp: Added.
+        (KJS::initializeThreading):
+        * kjs/InitializeThreading.h: Added.
+        Initialize threading at KJS level, if enabled.
+
+        * kjs/dtoa.h: Expose dtoa mutex for KJS::initializeThreading.
+
+        * kjs/testkjs.cpp: (kjsmain): Call initializeThreading.
+
+        * JavaScriptCore.exp: Export KJS::initializeThreading.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added InitializeThreading.{h,cpp}.
+
+        * wtf/Threading.h: Removed a using directive for WTF::initializeThreading - it is only
+        to be called from KJS::initializeThreading, and having it in the global namespace is useless.
+
+2008-03-28  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin
+
+        Export Unicode/UTF8.h and convertUTF16ToUTF8() for more flexible conversion in WebCore
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-03-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/5826236> Regular expressions with large nested repetition counts can have their
+        compiled length calculated incorrectly.
+
+        * pcre/pcre_compile.cpp:
+        (multiplyWithOverflowCheck):
+        (calculateCompiledPatternLength): Check for overflow when dealing with nested repetition counts
+        and bail with an error rather than returning incorrect results.
+
+2008-03-26  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Update FEATURE_DEFINES to be consistent with the other locations in which it is defined.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-03-26  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 18060: Assertion failure (JSLock not held) beneath
+        JSCallbackObject<Base>::toString
+
+        <http://bugs.webkit.org/show_bug.cgi?id=18060>
+
+        Reviewed by Geoff Garen.
+
+        Bug fix:
+
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::JSCallbackObject<Base>::toString): Make the DropAllLocks
+        instance only be in scope while calling convertToType.
+
+        Test:
+
+        * API/testapi.c:
+        (MyObject_convertToType): Implement type conversion to string.
+        * API/testapi.js: Add a test for type conversion to string.
+
+2008-03-26  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * kjs/array_instance.cpp: Touched this.
+        * wtf/HashFunctions.h:
+        (WTF::intHash): Added 8- and 16-bit versions of intHash.
+
+2008-03-26  Adam Roben  <aroben@apple.com>
+
+        Force JSC headers to be copied by touching a file
+
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::getPropertyNames):
+
+2008-03-26  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r31324
+
+        Written with Darin.
+
+        Added HashTable plumbing to support using wchar_t as a key type.
+
+        * wtf/HashFunctions.h:
+        * wtf/HashTraits.h:
+        (WTF::):
+
+2008-03-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - JSC part of fix for "SVG multichar glyph matching matches longest instead of first (affects Acid3 test 79)"
+        http://bugs.webkit.org/show_bug.cgi?id=18118
+
+        * wtf/HashFunctions.h:
+        (WTF::):
+        * wtf/HashTraits.h:
+        (WTF::):
+
+2008-03-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Cache C string identifiers by address, not value, assuming that C strings can only
+        be literals.
+
+        1% speedup on Acid3 test 26.
+
+        * kjs/identifier.cpp:
+        (KJS::literalIdentifierTable):
+        (KJS::Identifier::add):
+        Added a new table to cache UString::Reps created from C strings by address. Elements are
+        never removed from this cache, as only predefined identifiers can get there.
+
+        * kjs/identifier.h:
+        (KJS::Identifier::Identifier): Added a warning.
+
+2008-03-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Maciej.
+
+        An assertion was failing in function-toString-object-literals.html when parsing 1e-500.
+        The condition existed before, and got uncovered by turning compiled-out dtoa checks into
+        ASSERTs.
+
+        The assertion was verifying that the caller wasn't constructing a Bigint from 0.
+        This might have had some reason behind it originally, but I couldn't find any,
+        and this doesn't look like a reasonable requirement.
+
+        * kjs/dtoa.cpp: (d2b): Removed the assertion (two copies in different code paths).
+
+2008-03-25  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 18077: Integrate testapi.c into the Windows build
+
+        <http://bugs.webkit.org/show_bug.cgi?id=18077>
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Added.
+
+2008-03-25  Adam Roben  <aroben@apple.com>
+
+        Make testapi.c compile under MSVC
+
+        Currently you must compile testapi.c as C++ code since MSVC does not
+        support many C features that GCC does.
+
+        Reviewed by Steve Falkenburg.
+
+        * API/testapi.c:
+        (nan): Added an implementation of this for MSVC.
+        (assertEqualsAsUTF8String): Use malloc instead of dynamically-sized
+        stack arrays.
+        (assertEqualsAsCharactersPtr): Ditto.
+        (print_callAsFunction): Ditto.
+        (main): Ditto, and explicitly cast from UniChar* to JSChar*.
+
+2008-03-25  Adam Roben  <aroben@apple.com>
+
+        Stop using JavaScriptCore's custom stdbool.h and stdint.h on Windows
+
+        We can't remove the os-win32 directory yet because other ports (at
+        least wx) are still relying on it.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+          - Made all the include paths match the one for the Debug
+            configuration (these got out of sync in r30797)
+          - Removed os-win32 from the include path
+          - Removed os-win32 from the directories we copy to $WebKitOutputDir.
+          - Removed stdint.h from the project
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Delete the files that we may have previously copied from the os-win32
+        directory.
+
+2008-03-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * kjs/dtoa.cpp: Include stdint.h.
+
+2008-03-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin.
+
+        Cleanup dtoa.cpp style.
+
+        * kjs/dtoa.cpp:
+        (Bigint::Balloc):
+        (Bigint::Bfree):
+        (Bigint::multadd):
+        (Bigint::s2b):
+        (Bigint::hi0bits):
+        (Bigint::lo0bits):
+        (Bigint::i2b):
+        (Bigint::mult):
+        (Bigint::pow5mult):
+        (Bigint::lshift):
+        (Bigint::cmp):
+        (Bigint::diff):
+        (Bigint::ulp):
+        (Bigint::b2d):
+        (Bigint::d2b):
+        (Bigint::ratio):
+        (Bigint::):
+        (Bigint::match):
+        (Bigint::hexnan):
+        (Bigint::kjs_strtod):
+        (Bigint::quorem):
+        (Bigint::rv_alloc):
+        (Bigint::nrv_alloc):
+        (Bigint::kjs_freedtoa):
+        (Bigint::kjs_dtoa):
+        * kjs/dtoa.h:
+
+2008-03-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - convert a JavaScript immediate number to a string more efficiently
+
+        2% speedup of Acid3 test 26
+
+        * kjs/JSImmediate.cpp:
+        (KJS::JSImmediate::toString): Take advantage of the fact that all immediate
+        numbers are integers, and use the faster UString function for formatting integers
+        instead of the slower one that works for floating point. I think this is a leftover
+        from when immediate numbers were floating point.
+
+2008-03-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=18048
+        The "thisObject" parameter to JSEvaluateScript is not used properly
+
+        Making passing a thisObject to JSEvaluateScript actually set the thisObject of the created
+        ExecState.
+
+        * API/testapi.c:
+        (main): Add tests for setting the thisObject when calling JSEvaluateScript.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState): Assign the thisObject to m_thisValue and remove the comment. 
+
+2008-03-22  Jesse Ruderman  <jruderman@gmail.com>
+
+        Reviewed by Sam Weinig.  Landed by eseidel.
+        
+        Make testkjs flush stdout after printing.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/testkjs.cpp:
+        (functionPrint):
+
+2008-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Optimise lookup of Math, undefined, NaN and Infinity
+
+        Added a method to JSVariableObject to allow us to inject DontDelete properties
+        into the symbol table and localStorage.  This results in a 0.4% progression in
+        SunSpider, with a 8% gain in math-partial-sums.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableInsert):
+
+2008-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Global properties that use LocalStorage are not correctly listed as enumerable.
+
+        The problem was caused by JSObject::getPropertyAttributes not being aware
+        of the JSVariableObject SymbolTable.  The fix is to make getPropertyAttributes
+        virtual and override in JSVariableObject.  This does not produce any performance
+        regression.
+
+        * JavaScriptCore.exp:
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::getPropertyNames):
+        (KJS::JSVariableObject::getPropertyAttributes):
+        * kjs/JSVariableObject.h:
+        * kjs/object.h:
+
+2008-03-21  Arkadiusz Miskiewicz  <arekm@maven.pl>
+
+        Webkit does not build on linux powerpc
+
+        <http://bugs.webkit.org/show_bug.cgi?id=17019>
+
+        Reviewed by David Kilzer.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Unlock):
+
+2008-03-21  Rodney Dawes  <dobey@wayofthemonkey.com>
+
+        Reviewed by Holger.
+
+        http://bugs.webkit.org/show_bug.cgi?id=17981
+
+        Add javascriptcore_cppflags to Programs_minidom_CPPFLAGS.
+
+        * GNUmakefile.am:
+
+2008-03-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Consolidate static identifier initializers within CommonIdentifiers.
+
+        No reliably measurable change on SunSpider; maybe a tiny improvement (within 0.2%).
+
+        * kjs/CommonIdentifiers.h: Added static identifiers that were lazily initialized
+        throughout the code.
+
+        * kjs/date_object.cpp:
+        (KJS::DateObjectImp::DateObjectImp):
+        * kjs/function_object.cpp:
+        (KJS::FunctionPrototype::FunctionPrototype):
+        * kjs/object_object.cpp:
+        (KJS::ObjectPrototype::ObjectPrototype):
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpPrototype::RegExpPrototype):
+        Use the values from CommonIdentifiers. 
+
+        * kjs/lookup.h: Caching the identifier in a static wasn't a win on SunSpider, removed it.
+
+        * kjs/value.h:
+        (KJS::jsNaN): We already have a shared NaN value, no need for a duplicate here.
+
+        * wtf/MathExtras.h:
+        (wtf_atan2): Having local variables for numeric_limits constants is good for readability,
+        but there is no reason to keep them static.
+
+        * JavaScriptCore.exp: Don't needlessly export JSGlobalObject::s_head.
+
+2008-03-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Fix for leak introduced by inline ScopeChainNode use
+
+        To avoid any extra branches when managing an inline ScopeChainNode
+        in the ScopeChain the inline node gets inserted with a refcount of
+        2.  This meant than when the ScopeChain was destroyed the ScopeChainNodes
+        above the inline node would be leaked.
+
+        We resolve this by manually popping the inline node in the
+        FunctionExecState destructor.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/ExecStateInlines.h:
+        (KJS::FunctionExecState::~FunctionExecState):
+        * kjs/scope_chain.h:
+        (KJS::ScopeChain::popInlineScopeNode):
+
+2008-03-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Ensure that the defines in FEATURE_DEFINES are sorted so that they will match the default settings of build-webkit.
+        This will prevent the world from being rebuilt if you happen to switch between building in Xcode and with build-webkit on the
+        command-line.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-03-20  David Krause  <david.krause@gmail.com>
+
+        Reviewed by David Kilzer.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=17923
+        Bug 17923: ARM platform endian defines inaccurate
+
+        * wtf/Platform.h: 
+        Replaced !defined(__ARMEL__) check with !defined(__VFP_FP__)
+        for PLATFORM(MIDDLE_ENDIAN)
+
+2008-03-20  Maciej Stachowiak  <mjs@apple.com>
+
+        - fix build
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: install Activation.h as private
+
+2008-03-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - reduce function call overhead for 1.014x speedup on SunSpider
+
+        I moved some functions from ExecState.cpp to ExecStateInline.h and
+        from JSGlobalObject.cpp to JSGlobalObject.h, and declared them
+        inline; machine function call overhead for these was hurting JS
+        funcion call overhead.
+        
+        * kjs/ExecState.cpp:
+        * kjs/ExecStateInlines.h: Added.
+        (KJS::ExecState::ExecState):
+        (KJS::ExecState::~ExecState):
+        (KJS::FunctionExecState::FunctionExecState):
+        (KJS::FunctionExecState::~FunctionExecState):
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::pushActivation):
+        (KJS::JSGlobalObject::checkActivationCount):
+        (KJS::JSGlobalObject::popActivation):
+        * kjs/function.cpp:
+
+2008-03-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Avoid heap allocating the root scope chain node for eval and closure free functions
+
+        Maciej suggested using an inline ScopeChainNode for functions that don't use eval
+        or closures as they are unable to ever capture the scope chain.  This gives us a 2.4%
+        win in sunspider, a 15% win in controlflow-recursive, and big (>5%) wins in a number 
+        of other tests.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        * kjs/ExecState.h:
+        * kjs/scope_chain.h:
+        (KJS::ScopeChain::push):
+
+2008-03-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix release build.
+
+        * kjs/JSGlobalObject.cpp:  Add missing #include.
+
+2008-03-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/5785694>
+        Crash occurs at KJS::Collector::collect() when loading web clip widgets with a PAC file
+
+        Make the activeExecStates stack per JSGlobalObject instead of static to ensure
+        thread safety.
+
+        * JavaScriptCore.exp:
+        * kjs/ExecState.cpp:
+        (KJS::InterpreterExecState::InterpreterExecState):
+        (KJS::InterpreterExecState::~InterpreterExecState):
+        (KJS::EvalExecState::EvalExecState):
+        (KJS::EvalExecState::~EvalExecState):
+        (KJS::FunctionExecState::FunctionExecState):
+        (KJS::FunctionExecState::~FunctionExecState):
+        * kjs/ExecState.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::mark):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::activeExecStates):
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        (KJS::Collector::reportOutOfMemoryToAllExecStates): Iterate all JSGlobalObjects and report
+        the OutOfMemory condition to all the ExecStates in each.
+
+2008-03-19  Jasper Bryant-Greene  <jasper@unix.geek.nz>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=17941
+        Bug 17941: C++-style comments in JavaScriptCore API
+
+        * API/JSBase.h:
+        Remove C++-style comments from public JavaScriptCore API, replacing
+        with standard C90 block comments.
+
+2008-03-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=17939
+        Bug 17939: Crash decompiling "const a = 1, b;"
+
+        * kjs/nodes2string.cpp:
+        (KJS::ConstDeclNode::streamTo): Null-check the correct variable.
+
+2008-03-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 17929: Incorrect decompilation with |const|, comma
+        http://bugs.webkit.org/show_bug.cgi?id=17929
+
+        There were actually two bugs here. First we weren't correctly handling const
+        nodes with multiple declarations. The second issue was caused by us not 
+        giving the correct precedence to the initialisers.
+
+        * kjs/nodes2string.cpp:
+        (KJS::ConstDeclNode::streamTo):
+
+2008-03-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - Speed up JavaScript built-in properties by changing the
+          hash table to take advantage of the identifier objects
+
+        5% speedup for Acid3 test 26
+
+        * JavaScriptCore.exp: Updated.
+        * kjs/create_hash_table: Compute size of hash table large enough so that there
+        are no collisions, but don't generate the hash table.
+        * kjs/identifier.h: Made the add function that returns a PassRefPtr public.
+        * kjs/lexer.cpp:
+        (KJS::Lexer::lex): Updated for change to HashTable interface.
+        * kjs/lookup.cpp:
+        (KJS::HashTable::changeKeysToIdentifiers): Added. Finds the identifier for
+        each property so the equality comparision can be done with pointer comparision.
+        * kjs/lookup.h: Made the key be a union of char* with UString::Rep* so it can
+        hold identifiers. Added a keysAreIdentifiers flag to the HashTable. Changed
+        the Lookup functions to be member functions of HashTable instead.
+        * kjs/object.cpp:
+        (KJS::JSObject::deleteProperty): Update for change to HashTable.
+        (KJS::JSObject::findPropertyHashEntry): Ditto.
+        (KJS::JSObject::getPropertyAttributes): Ditto.
+        (KJS::JSObject::getPropertyNames): Ditto.
+
+2008-03-18  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=17925 and http://bugs.webkit.org/show_bug.cgi?id=17927.
+        - Bug 17925: Crash in KJS::JSObject::put after setting this.__proto__
+        - Bug 17927: Hang after attempting to create circular __proto__
+
+        * kjs/object.cpp:
+        (KJS::JSObject::put): Silently ignore attempts to set __proto__ to a non-object, non-null value.
+        Return after setting the exception when an attempt to set a cyclic __proto__ is detected so that
+        the cyclic value is not set.
+
+2008-03-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - inline ActivationImp::init for 0.8% SunSpider speedup
+
+        * kjs/Activation.h:
+        (KJS::ActivationImp::init): Moved here from function.cpp
+        * kjs/function.cpp:
+
+2008-03-18  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        Including config.h like in the other .cpp files gets the #ifdeffery
+        correct for rand_s.
+
+        * kjs/JSWrapperObject.cpp:
+
+2008-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        JavaScriptCore changes to support a WebCore speedup.
+
+        * JavaScriptCore.exp: Export the UString::Rep::computeHash function.
+        * wtf/HashSet.h: Added a find and contains function that take a translator,
+        like the add function.
+
+2008-03-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - a few micro-optimizations for 1.2% SunSpider speedup
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction): check for Return completion before Throw,
+        it is more likely.
+        * kjs/object.cpp:
+        (KJS::JSObject::put): When walking prototype chain, instead of
+        checking isObject (a virtual call), compare to jsNull (compare to
+        a constant) since null is the only non-object that can be in a
+        prototype chain.
+
+2008-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Optimise multi-scope function call resolution
+
+        Refactor multiscope variable resolution and use to add
+        optimised FunctionCallResolveNode subclasses.  
+
+        2.6% gain in sunspider performance, *25%* gain in controlflow-recursive
+
+        * kjs/nodes.cpp:
+        (KJS::getSymbolTableEntry):
+        (KJS::ResolveNode::optimizeVariableAccess):
+        (KJS::getNonLocalSymbol):
+        (KJS::ExpressionNode::resolveAndCall):
+        (KJS::FunctionCallResolveNode::optimizeVariableAccess):
+        (KJS::FunctionCallResolveNode::inlineEvaluate):
+        (KJS::ScopedVarFunctionCallNode::inlineEvaluate):
+        (KJS::ScopedVarFunctionCallNode::evaluate):
+        (KJS::ScopedVarFunctionCallNode::evaluateToNumber):
+        (KJS::ScopedVarFunctionCallNode::evaluateToBoolean):
+        (KJS::ScopedVarFunctionCallNode::evaluateToInt32):
+        (KJS::ScopedVarFunctionCallNode::evaluateToUInt32):
+        (KJS::NonLocalVarFunctionCallNode::inlineEvaluate):
+        (KJS::NonLocalVarFunctionCallNode::evaluate):
+        (KJS::NonLocalVarFunctionCallNode::evaluateToNumber):
+        (KJS::NonLocalVarFunctionCallNode::evaluateToBoolean):
+        (KJS::NonLocalVarFunctionCallNode::evaluateToInt32):
+        (KJS::NonLocalVarFunctionCallNode::evaluateToUInt32):
+        * kjs/nodes.h:
+        (KJS::ScopedVarFunctionCallNode::):
+        (KJS::NonLocalVarFunctionCallNode::):
+
+2008-03-17  David Kilzer  <ddkilzer@apple.com>
+
+        Don't define PLATFORM(MIDDLE_ENDIAN) on little endian ARM.
+
+        Reviewed by Darin.
+
+        See <http://bugs.webkit.org/show_bug.cgi?id=15416#c13>.
+
+        * wtf/Platform.h: Added check for !defined(__ARMEL__) when defining
+        PLATFORM(MIDDLE_ENDIAN).
+
+2008-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff, Darin and Weinig.
+
+        Add fast multi-level scope lookup
+        
+        Add logic and AST nodes to provide rapid variable resolution across
+        static scope boundaries.  This also adds logic that allows us to skip
+        any static scopes that do not contain the variable to be resolved.
+        
+        This results in a ~2.5% speedup in SunSpider, and gives a 25-30% speedup
+        in some simple and ad hoc closure and global variable access tests.
+
+        * JavaScriptCore.exp:
+        * kjs/Activation.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        * kjs/JSVariableObject.cpp:
+        * kjs/JSVariableObject.h:
+        * kjs/function.cpp:
+        (KJS::ActivationImp::isDynamicScope):
+        * kjs/nodes.cpp:
+        (KJS::ResolveNode::optimizeVariableAccess):
+        (KJS::ScopedVarAccessNode::inlineEvaluate):
+        (KJS::ScopedVarAccessNode::evaluate):
+        (KJS::ScopedVarAccessNode::evaluateToNumber):
+        (KJS::ScopedVarAccessNode::evaluateToBoolean):
+        (KJS::ScopedVarAccessNode::evaluateToInt32):
+        (KJS::ScopedVarAccessNode::evaluateToUInt32):
+        (KJS::NonLocalVarAccessNode::inlineEvaluate):
+        (KJS::NonLocalVarAccessNode::evaluate):
+        (KJS::NonLocalVarAccessNode::evaluateToNumber):
+        (KJS::NonLocalVarAccessNode::evaluateToBoolean):
+        (KJS::NonLocalVarAccessNode::evaluateToInt32):
+        (KJS::NonLocalVarAccessNode::evaluateToUInt32):
+        (KJS::IfElseNode::optimizeVariableAccess):
+        (KJS::ScopeNode::optimizeVariableAccess):
+        * kjs/nodes.h:
+        (KJS::ScopedVarAccessNode::):
+        (KJS::NonLocalVarAccessNode::):
+        * kjs/object.h:
+
+ 2008-03-16  weihongzeng  <weihong.zeng@hotmail.com>
+ 
+         Reviewed by Darin Adler.
+ 
+         http://bugs.webkit.org/show_bug.cgi?id=15416
+         Add support for mixed-endian processors
+ 
+         * kjs/dtoa.cpp: Add IEEE_ARM, triggered by PLATFORM(MIDDLE_ENDIAN).
+ 
+2008-03-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Rubber stamped by Darin.
+
+        Add set-webkit-configuration support for wx port, and centralize
+        build dir location setting.
+
+        http://bugs.webkit.org/show_bug.cgi?id=17790
+
+        * jscore.bkl:
+
+2008-03-14  Steve Falkenburg  <sfalken@apple.com>
+
+        PGO build fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-03-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Add logic to track whether a function uses a locally scoped eval or requires a closure
+        
+        Now that we limit eval we can track those uses of eval that operate
+        in the local scope and functions that require a closure.  We track
+        this information during initial parsing to avoid yet another tree
+        walk.
+
+        * JavaScriptCore.exp:
+        * kjs/NodeInfo.h:
+        * kjs/Parser.cpp:
+        (KJS::Parser::didFinishParsing):
+        * kjs/Parser.h:
+        (KJS::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::ScopeNode::ScopeNode):
+        (KJS::ProgramNode::ProgramNode):
+        (KJS::ProgramNode::create):
+        (KJS::EvalNode::EvalNode):
+        (KJS::EvalNode::create):
+        (KJS::FunctionBodyNode::FunctionBodyNode):
+        (KJS::FunctionBodyNode::create):
+        * kjs/nodes.h:
+        (KJS::ScopeNode::):
+        (KJS::ScopeNode::usesEval):
+        (KJS::ScopeNode::needsClosure):
+
+2008-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fixed another problem with Vector::shrinkCapacity.
+        
+        moveOverlapping isn't good enough for the case where the buffer hasn't
+        changed, because it still destroys the contents of the buffer.
+
+        * wtf/Vector.h:
+        (WTF::::shrinkCapacity): Changed to explicitly check whether the call
+        to allocateBuffer produced a new buffer. If it didn't, there's no need
+        to move.
+
+2008-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Fixed a few problems with Vector::shrinkCapacity that I noticed in testing.
+
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::deallocateBuffer): Clear our m_buffer pointer
+        when we deallocate m_buffer, in case we're not asked to reallocate a new
+        buffer. (Otherwise, we would use a stale m_buffer if we were asked to
+        perform any operations after shrinkCapacity was called.)
+        
+        (WTF::VectorBuffer::allocateBuffer): Made VectorBuffer with inline
+        capacity aware that calls to allocateBuffer might be shrinks, rather
+        than grows, so we shouldn't allocate a new buffer on the heap unless
+        our inline buffer is too small.
+        
+        (WTF::::shrinkCapacity): Call resize() instead of just setting m_size,
+        so destructors run. Call resize before reallocating the buffer to make
+        sure that we still have access to the objects we need to destroy. Call
+        moveOverlapping instead of move, since a call to allocateBuffer on an
+        inline buffer may produce identical storage.
+
+2008-03-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Get rid of a localime() call on platforms that have better alternatives.
+
+        * kjs/DateMath.h: Added getLocalTime();
+
+        * kjs/DateMath.cpp:
+        (KJS::getLocalTime):
+        (KJS::getDSTOffsetSimple):
+        Implementation moved from getDSTOffsetSimple().
+
+        * kjs/date_object.cpp:
+        (KJS::DateObjectImp::callAsFunction): Switched to getLocalTime().
+
+2008-03-14  David D. Kilzer  <ddkilzer@apple.com>
+
+        Unify concept of enabling the Mac Java bridge.
+
+        Reviewed by Darin and Anders.
+
+        * wtf/Platform.h: Define ENABLE_MAC_JAVA_BRIDGE here.
+
+2008-03-13  Mark Mentovai  <mark@moxienet.com>
+
+        Reviewed by eseidel.  Landed by eseidel.
+
+        * wtf/FastMalloc.cpp: #include <wtf/HashSet.h> outside of any
+        namespaces.
+
+2008-03-13  Mark Mentovai  <mark@moxienet.com>
+
+        Reviewed by eseidel.  Landed by eseidel.
+
+        * pcre/pcre_exec.cpp: Fix misnamed variable, allowing -DDEBUG build
+        to succeed.
+        * wtf/ThreadingPthreads.cpp: #include <sys/time.h> for gettimeofday
+        in non-pch build.
+
+2008-03-13  Steve Falkenburg  <sfalken@apple.com>
+
+        PGO build fixes.
+        
+        Disable PGO for normal release builds.
+        Added work-in-progress Release_PGOInstrument/Release_PGOOptimize targets.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-03-13  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Geoff.
+
+        Adding new functionality to Vector. Currently all of the shrink and 
+        resize functions on Vector only shrink the size of the Vector, not 
+        the capacity. For the Vector to take up as little memory as 
+        possible, though, it is necessary to be able to shrink the capacity 
+        as well. So this patch adds that functionality. 
+
+        I need this for a speed up I am working on, and Geoff wants to use 
+        it in a speed up he is working on also, so he asked me to commit it 
+        now. 
+
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::allocateBuffer):
+        (WTF::::shrinkCapacity):
+
+2008-03-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Attempt at fixing the Qt/Windows build bot. Quote using double-quotes
+        instead of single quotes.
+
+        * pcre/dftables:
+
+2008-03-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2008-03-12  Alp Toker  <alp@atoker.com>
+
+        Another autotools testkjs build fix attempt.
+
+        * GNUmakefile.am:
+
+2008-03-12  Alp Toker  <alp@atoker.com>
+
+        Attempt to fix the autotools testkjs build on systems with
+        non-standard include paths.
+
+        * GNUmakefile.am:
+
+2008-03-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5787743> REGRESSION: Crash at WTF::Collator::CreateCollator() running fast/js/kde/StringObject.html on Windows
+
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::createCollator): Check for null (== user default) m_locale before calling strcmp.
+
+2008-03-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Disable LTCG/PGO for grammar.cpp and nodes.cpp.
+        PGO on these files causes us to hang.
+        
+        Copy newer vsprops files from relative WebKitLibraries path to environment variable based path.
+        
+        Reviewed by Oliver.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2008-03-10  Darin Adler  <darin@apple.com>
+
+        - Windows build fix
+
+        * kjs/function.cpp: (KJS::decode): Initialize variable.
+
+2008-03-10  Brent Fulgham  <bfulgham@gmail.com>
+
+        Windows build fix
+
+        Reviewed by Adam.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Set the PATH to include Cygwin before running touch.
+
+2008-03-10  Eric Seidel  <eric@webkit.org>
+
+        Build fix for JSC on windows.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        * kjs/function.cpp:
+        (KJS::decode):
+        * kjs/nodes2string.cpp:
+        (KJS::escapeStringForPrettyPrinting):
+
+2008-03-10  Eric Seidel  <eric@webkit.org>
+        
+        No review, build fix only.
+        
+        Attempt to fix the windows build?
+
+        * kjs/ustring.h: change unsigned short to UChar
+
+2008-03-10  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin.
+
+        Remove KJS::UChar, use ::UChar instead
+        http://bugs.webkit.org/show_bug.cgi?id=17017
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        (JSStringCreateWithUTF8CString):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        * JavaScriptCore.exp:
+        * kjs/Parser.h:
+        * kjs/function.cpp:
+        (KJS::decode):
+        (KJS::parseInt):
+        (KJS::parseFloat):
+        (KJS::globalFuncEscape):
+        (KJS::globalFuncUnescape):
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct):
+        * kjs/identifier.cpp:
+        (KJS::Identifier::equal):
+        (KJS::CStringTranslator::translate):
+        * kjs/interpreter.h:
+        * kjs/lexer.cpp:
+        (KJS::Lexer::setCode):
+        (KJS::Lexer::shift):
+        (KJS::Lexer::lex):
+        (KJS::Lexer::convertUnicode):
+        (KJS::Lexer::makeIdentifier):
+        * kjs/lookup.cpp:
+        (KJS::keysMatch):
+        * kjs/nodes2string.cpp:
+        (KJS::escapeStringForPrettyPrinting):
+        (KJS::SourceStream::operator<<):
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        (KJS::RegExp::match):
+        * kjs/string_object.cpp:
+        (KJS::substituteBackreferences):
+        (KJS::stringProtoFuncCharCodeAt):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::computeHash):
+        (KJS::UString::UString):
+        (KJS::UString::append):
+        (KJS::UString::ascii):
+        (KJS::UString::operator=):
+        (KJS::UString::is8Bit):
+        (KJS::UString::toStrictUInt32):
+        (KJS::UString::find):
+        (KJS::operator==):
+        (KJS::operator<):
+        (KJS::compare):
+        (KJS::UString::UTF8String):
+        * kjs/ustring.h:
+        * pcre/pcre.h:
+
+2008-03-09  Steve Falkenburg  <sfalken@apple.com>
+
+        Stop Windows build if an error occurs in a prior project.
+
+        Rubber stamped by Darin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2008-03-09  J¸rg Billeter  <j@bitron.ch>
+
+        Reviewed by Alp Toker.
+
+        Conditionalise ICU for Unicode in the GTK+ port.
+
+        * wtf/Platform.h:
+
+2008-03-07  David D. Kilzer  <ddkilzer@apple.com>
+
+        Unify concept of enabling Netscape Plug-in API (NPAPI).
+
+        Reviewed by Darin.
+
+        * wtf/Platform.h: Define ENABLE_NETSCAPE_PLUGIN_API here.
+
+2008-03-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/5689093> Stricter (ES4) eval semantics
+        
+        The basic rule is:
+        
+        - "eval(s)" is treated as an operator that gives the ES3 eval behavior.
+            ... but only if there is no overriding declaration of "eval" in scope.
+        - All other invocations treat eval as a function that evaluates a
+        script in the context of its "this" object.
+            ... but if its "this" object is not the global object it was
+            originally associated with, eval throws an exception.
+        
+        Because only expressions of the form "eval(s)" have access to local
+        scope, the compiler can now statically determine whether a function
+        needs local scope to be dynamic.
+
+        * kjs/nodes.h: Added FunctionCallEvalNode. It works just like
+        FuncationCallResolveNode, except it statically indicates that the node
+        may execute eval in the ES3 way.
+        * kjs/nodes.cpp:
+        * kjs/nodes2string.cpp:
+
+        * tests/mozilla/expected.html: This patch happens to fix a Mozilla JS
+        test, but it's a bit of a pyrrhic victory. The test intends to test
+        Mozilla's generic API for calling eval on any object, but, in reality,
+        we only support calling eval on the global object.
+
+2008-03-06  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2008-03-06  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2008-03-06  Alp Toker  <alp@atoker.com>
+
+        Fix the build fix in r30845 to support out-of-tree builds.
+
+        * GNUmakefile.am:
+
+2008-03-06  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+2008-03-06  Darin Adler  <darin@apple.com>
+
+        - another small step towards fixing the Qt build
+
+        * JavaScriptCore.pri: Remove more references to the now-obsolete bindings directory.
+
+2008-03-06  Darin Adler  <darin@apple.com>
+
+        - a small step towards fixing the Qt build
+
+        * JavaScriptCore.pri: Remove references to files no longer present in JavaScriptCore/bindings.
+
+2008-03-06  Brady Eidson  <beidson@apple.com>
+
+        Gtk Build fix
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+2008-03-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Wx build fix.
+
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault): Put ICU workaround under both PLATFORM(DARWIN) and
+        PLATFORM(CF) checks, so that each port can decide if it wants to use CF on Mac for it.
+
+2008-03-06  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Darin
+
+        Add a timedWait() method to ThreadCondition
+
+        * JavaScriptCore.exp:
+
+        * wtf/Threading.h:
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait): Needs implementation
+
+2008-03-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        More build fixes.
+
+        * jscore.bkl: Add the wtf/unicode directory.
+        * wtf/unicode/CollatorDefault.cpp:
+        (WTF::Collator::userDefault): Use a constructor that does exist.
+        * wtf/unicode/icu/CollatorICU.cpp: Mac build fix for case-sensitive file systems.
+
+2008-03-06  Darin Adler  <darin@apple.com>
+
+        - try to fix the Qt build
+
+        * JavaScriptCore.pri: Add the wtf/unicode directory.
+
+2008-03-06  Darin Adler  <darin@apple.com>
+
+        - try to fix the GTK build
+
+        * GNUmakefile.am: Add a -I for the wtf/unicode directory.
+
+2008-03-06  Darin Adler  <darin@apple.com>
+
+        - try to fix the Mac build
+
+        * icu/unicode/parseerr.h: Copied from ../WebCore/icu/unicode/parseerr.h.
+        * icu/unicode/ucol.h: Copied from ../WebCore/icu/unicode/ucol.h.
+        * icu/unicode/uloc.h: Copied from ../WebCore/icu/unicode/uloc.h.
+        * icu/unicode/unorm.h: Copied from ../WebCore/icu/unicode/unorm.h.
+        * icu/unicode/uset.h: Copied from ../WebCore/icu/unicode/uset.h.
+
+2008-03-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5687269> Need to create a Collator abstraction for WebCore and JavaScriptCore
+
+        * wtf/Threading.h:
+        (WTF::initializeThreading):
+        * wtf/ThreadingGtk.cpp:
+        (WTF::initializeThreading):
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        * wtf/ThreadingWin.cpp:
+        Added AtomicallyInitializedStatic.
+
+        * kjs/string_object.cpp: (KJS::localeCompare): Changed to use Collator.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        Added new fiiles to projects.
+
+        * wtf/unicode/Collator.h: Added.
+        (WTF::Collator::):
+        * wtf/unicode/CollatorDefault.cpp: Added.
+        (WTF::Collator::Collator):
+        (WTF::Collator::~Collator):
+        (WTF::Collator::setOrderLowerFirst):
+        (WTF::Collator::collate):
+        * wtf/unicode/icu/CollatorICU.cpp: Added.
+        (WTF::cachedCollatorMutex):
+        (WTF::Collator::Collator):
+        (WTF::Collator::~Collator):
+        (WTF::Collator::setOrderLowerFirst):
+        (WTF::Collator::collate):
+        (WTF::Collator::createCollator):
+        (WTF::Collator::releaseCollator):
+
+2008-03-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Fix the wx build after the bindings move.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2008-03-05  Alp Toker  <alp@atoker.com>
+
+        GTK+ build fix for breakage introduced in r30800.
+
+        Track moved bridge sources from JavaScriptCore to WebCore.
+
+        * GNUmakefile.am:
+
+2008-03-05  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Remove definition of WTF_USE_SAFARI_THEME from wtf/Platform.h
+        because the PLATFORM(CG) flag is not set until config.h has
+        already included this file.
+
+        * wtf/Platform.h:  Remove useless definition of WTF_USE_SAFARI_THEME
+
+2008-03-05  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey and Mark Rowe
+
+        Fix for <rdar://problem/5778247> - Reproducible crash on storage/execute-sql-args.html
+
+        DatabaseThread::unscheduleDatabaseTasks() manually filters through a MessageQueue,
+        removing particular items for Databases that were shutting down.
+
+        This filtering operation is not atomic, and therefore causes a race condition with the
+        MessageQueue waking up and reading from the message queue.  
+
+        The end result was an attempt to dereference a null DatabaseTask.  Timing-wise, this never
+        seemed to happen in a debug build, otherwise an assertion would've caught it.  Replacing that
+        assertion with a crash in a release build is what revealed this bug.
+
+        * wtf/MessageQueue.h:
+        (WTF::::waitForMessage): Tweak the waiting logic to check the queue's empty state then go back
+          to sleep if the queue was empty - checking m_killed each time it wakes up.
+
+2008-03-05  David D. Kilzer  <ddkilzer@apple.com>
+
+        Remove unused header includes from interpreter.cpp.
+
+        Reviewed by Darin.
+
+        * kjs/interpreter.cpp: Remove unused header includes.
+
+2008-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam.
+        
+        Remove bindings/.
+
+        * bindings: Removed.
+
+2008-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Don't build bindings/ anymore.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoff.
+
+        Don't build JavaScriptCore/bindings.
+        
+        * JavaScriptCore.exp:
+        Export a couple of new functions. 
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Remove bindings/
+        
+        * kjs/config.h:
+        No need to define HAVE_JNI anymore.
+        
+        * kjs/interpreter.cpp:
+        Remove unnecessary include.
+
+2008-03-05  David D. Kilzer  <ddkilzer@apple.com>
+
+        Allow override of default script file name using command-line argument.
+
+        Reviewed by Adele.
+
+        * API/minidom.c:
+        (main): Allow first command-line argument to override the default script
+        file name of "minidom.js".
+        * API/testapi.c:
+        (main): Allow first command-line argument to override the default script
+        file name of "testapi.js".
+
+2008-03-04  Mark Rowe  <mrowe@apple.com>
+
+        Mac build fix.
+
+        * JavaScriptCore.exp:  Add new symbol to exports file.
+
+2008-03-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders.
+
+        Make ForInNode check for the timeout interrupt
+
+        * kjs/nodes.cpp:
+        (KJS::ForInNode::execute):
+
+2008-03-02  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Alp Toker.
+
+        http://bugs.webkit.org/show_bug.cgi?id=17415
+        GTK Build (using autotools) on Mac OS (DarwinPorts) Fails
+
+        Add -lstdc++ to link flags for minidom program.  This corrects
+        a build error for the GTK+ on Mac OS.
+
+        * GNUmakefile.am:
+
+2008-03-01  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Update Xcode configuration to support building debug and release from the mysterious future.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2008-02-29  Brent Fulgham  <bfulgham@gmail.com>
+
+        http://bugs.webkit.org/show_bug.cgi?id=17483
+        Implement scrollbars on Windows (Cairo)
+
+        Reviewed by Adam Roben.
+
+        * wtf/Platform.h:
+
+2008-02-29  Adam Roben  <aroben@apple.com>
+
+        Remove unused DebuggerImp::abort and DebuggerImp::aborted
+
+        Reviewed by Tim and Sam.
+
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct):
+        * kjs/internal.h:
+        (KJS::DebuggerImp::DebuggerImp):
+        * kjs/nodes.cpp:
+        (KJS::Node::handleException):
+        (KJS::FunctionBodyNodeWithDebuggerHooks::execute):
+
+2008-02-28  Eric Christopher  <echristo@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        ** TOTAL **:          1.005x as fast    2867.6ms +/- 0.4%  2853.2ms +/- 0.3%    significant
+
+        * kjs/nodes.cpp: Tell the compiler that exceptions are unexpected (for
+        the sake of branch prediction and code organization).
+
+2008-02-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        http://bugs.webkit.org/show_bug.cgi?id=17030
+        Small buffer overflow within initialization
+
+        * kjs/date_object.cpp:
+        (KJS::DateObjectFuncImp::callAsFunction):
+        (KJS::parseDate):
+        Remove unnecessary and incorrect memset() calls - GregorianDateTime can initialize itself.
+
+2008-02-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        - Add a variant of remove that takes a position and a length.
+
+        * wtf/Vector.h:
+        (WTF::Vector::remove):
+
+2008-02-25  Mark Mentovai  <mark@moxienet.com>
+
+        Reviewed by Mark Rowe.
+
+        Enable CollectorHeapIntrospector to build by itself, as well as in an AllInOneFile build.
+        http://bugs.webkit.org/show_bug.cgi?id=17538
+
+        * kjs/CollectorHeapIntrospector.cpp: Provide "using" declaration for
+          WTF::RemoteMemoryReader.
+        * kjs/collector.h: Move CollectorHeap declaration here...
+        * kjs/collector.cpp: ... from here.
+
+2008-02-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam.
+
+        * JavaScriptCore.exp: Sort the contents of this file.
+
+2008-02-25  Adam Roben  <aroben@apple.com>
+
+        MSVC build fix
+
+        * kjs/testkjs.cpp:
+        (functionQuit): Don't add a return statement after exit(0) for MSVC.
+
+2008-02-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        http://bugs.webkit.org/show_bug.cgi?id=17529
+        Add support for reading from stdin from testkjs
+
+        * kjs/testkjs.cpp:
+        (GlobalObject::GlobalObject): Add readline function to global object.
+        (functionReadline): Added. Reads characters from stdin until a '\n' or
+        EOF is encountered. The input is returned as a String to the caller.
+
+2008-02-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        http://bugs.webkit.org/show_bug.cgi?id=17528
+        Give testkjs a bath
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make the testkjs.cpp use 4 space indentation.
+        * kjs/testkjs.cpp:
+        (StopWatch::getElapsedMS):
+        (GlobalObject::className):
+        (GlobalObject::GlobalObject):
+        Rename GlobalImp to GlobalObject and setup the global functions
+        in the GlobalObject's constructor. Also, use static functions for
+        the implementation so we can use the standard PrototypeFunction
+        class and remove TestFunctionImp.
+        (functionPrint): Move print() functionality here.
+        (functionDebug): Move debug() functionality here.
+        (functionGC): Move gc() functionality here.
+        (functionVersion): Move version() functionality here.
+        (functionRun): Move run() functionality here.
+        (functionLoad): Move load() functionality here.
+        (functionQuit): Move quit() functionality here.
+        (prettyPrintScript): Fix indentation.
+        (runWithScripts): Since all the functionality of createGlobalObject is
+        now in the GlobalObject constructor, just call new here.
+        (parseArguments): Fix indentation.
+        (kjsmain): Ditto
+        (fillBufferWithContentsOfFile): Ditto.
+
+2008-02-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt and Mark Rowe.
+
+        http://bugs.webkit.org/show_bug.cgi?id=17505
+        Add support for getting command line arguments in testkjs
+
+        - This slightly changes the behavior of parsing arguments by requiring
+          a '-f' before all files. 
+
+        * kjs/testkjs.cpp:
+        (createGlobalObject): Add a global property called 'arguments' which
+        contains an array with the parsed arguments as strings.
+        (runWithScripts): Pass in the arguments vector so that it can be passed
+        to the global object.
+        (parseArguments): Change parsing rules to require a '-f' before any script
+        file. After all '-f' and '-p' arguments have been parsed, the remaining
+        are added to the arguments vector and exposed to the script. If there is a
+        chance of ambiguity (the user wants to pass the string '-f' to the script),
+        the string '--' can be used separate the options from the pass through 
+        arguments.
+        (kjsmain):
+
+2008-02-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17511
+          REGRESSION: Reproducible crash in SegmentedSubstring::SegmentedSubstring(SegmentedSubstring const&)
+
+        * wtf/Deque.h:
+        (WTF::::expandCapacityIfNeeded): Fixed the case where m_start and m_end
+        are both zero but the buffer capacity is non-zero.
+        (WTF::::prepend): Added validity checks.
+
+2008-02-23  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
+
+        Rubber stamped by Darin.
+
+        Add separator '\' after libJavaScriptCore_la_LIBADD and cleanup
+        whitespaces introduced in the previous commit.
+
+        * GNUmakefile.am: 
+
+2008-02-23  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
+
+        * GNUmakefile.am: Add GLOBALDEPS for testkjs and minidom.
+
+2008-02-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=17496
+          make Deque use a circular array; add iterators
+
+        * wtf/Deque.h: Wrote an all-new version of this class that uses a circular
+        buffer. Growth policy is identical to vector. Added iterators.
+
+        * wtf/Vector.h: Made two small refinements while using this to implement
+        Deque: Made VectorBufferBase derive from Noncopyable, which would have
+        saved me some debugging time if it had been there. Renamed Impl and
+        m_impl to Buffer and m_buffer.
+
+2008-02-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=17067
+          eliminate attributes parameter from JSObject::put for speed/clarity
+
+        * API/JSCallbackObject.h: Removed attribute arguments.
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::JSCallbackObject<Base>::put): Ditto.
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty): Use initializeVariable or putDirect when necessary
+        to set attribute values.
+        * JavaScriptCore.exp: Updated.
+        * bindings/objc/objc_runtime.h: Removed attribute arguments.
+        * bindings/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::put): Ditto.
+        * bindings/runtime_array.cpp:
+        (RuntimeArray::put): Ditto.
+        * bindings/runtime_array.h: Ditto.
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::put): Ditto.
+        * bindings/runtime_object.h: Ditto. Also removed canPut which was only
+        called from one place in WebCore that can use hasProperty instead.
+
+        * kjs/Activation.h: Removed attribute argument from put and added the new
+        initializeVariable function that's used to put variables in variable objects.
+        Also made isActivationObject a const member.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::put): Removed attribute argument.
+        (KJS::JSGlobalObject::initializeVariable): Added. Used to give variables
+        their initial values, which can include the read-only property.
+        (KJS::JSGlobalObject::reset): Removed obsolete comments about flags.
+        Removed Internal flag, which is no longer needed.
+        * kjs/JSGlobalObject.h: More of the same.
+
+        * kjs/JSVariableObject.h: Added pure virtual initializeVariable function.
+        (KJS::JSVariableObject::symbolTablePut): Removed checkReadOnly flag; we always
+        check read-only.
+        (KJS::JSVariableObject::symbolTableInitializeVariable): Added.
+
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::put): Removed attribute argument.
+        * kjs/array_instance.h: Ditto.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::put): Ditto.
+        (KJS::Arguments::put): Ditto.
+        (KJS::ActivationImp::put): Ditto.
+        (KJS::ActivationImp::initializeVariable): Added.
+        * kjs/function.h: Removed attribute arguments.
+
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct): Removed Internal flag.
+
+        * kjs/lookup.h:
+        (KJS::lookupPut): Removed attributes argument. Also changed to use putDirect
+        instead of calling JSObject::put.
+        (KJS::cacheGlobalObject): Ditto.
+
+        * kjs/nodes.cpp:
+        (KJS::ConstDeclNode::handleSlowCase): Call initializeVariable to initialize
+        the constant.
+        (KJS::ConstDeclNode::evaluateSingle): Ditto.
+        (KJS::TryNode::execute): Use putDirect to set up the new object.
+        (KJS::FunctionBodyNode::processDeclarations): Removed Internal.
+        (KJS::ProgramNode::processDeclarations): Ditto.
+        (KJS::EvalNode::processDeclarations): Call initializeVariable to initialize
+        the variables and functions.
+        (KJS::FuncDeclNode::makeFunction): Removed Internal.
+        (KJS::FuncExprNode::evaluate): Ditto.
+
+        * kjs/object.cpp: Removed canPut, which was only being used in one code path,
+        not the normal high speed one.
+        (KJS::JSObject::put): Removed attribute argument. Moved the logic from
+        canPut here, in the one code ath that was still using it.
+        * kjs/object.h: Removed Internal attribute, ad canPut function. Removed the
+        attributes argument to the put function. Made isActivationObject const.
+
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpImp::put): Removed attributes argument.
+        (KJS::RegExpImp::putValueProperty): Ditto.
+        (KJS::RegExpObjectImp::put): Ditto.
+        (KJS::RegExpObjectImp::putValueProperty): Ditto.
+        * kjs/regexp_object.h: Ditto.
+
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::put): Removed attributes argument.
+        * kjs/string_object.h: Ditto.
+
+2008-02-23  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
+
+        Not reviewed, Gtk build fix.
+
+        * kjs/testkjs.pro:
+
+2008-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix - move ThreadCondition implementation from WebCore to WTF.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::ThreadCondition):
+        (WTF::ThreadCondition::~ThreadCondition):
+        (WTF::ThreadCondition::wait):
+        (WTF::ThreadCondition::signal):
+        (WTF::ThreadCondition::broadcast):
+
+2008-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Touch some files, hoping that Windows build bot will create JSC headers.
+
+        * kjs/AllInOneFile.cpp:
+        * kjs/array_instance.cpp:
+        * wtf/HashTable.cpp:
+
+2008-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Qt/Wx build fix - this file was still in a wrong namespace, too.
+
+        * wtf/ThreadingNone.cpp:
+
+2008-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        More build fixing - fix mismatched braces.
+
+        * JavaScriptCore.pri:
+
+2008-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Wx and Gtk build fixes.
+
+        * JavaScriptCore.pri: Don't try to compile ThreadingPthreads.
+        * wtf/ThreadingGtk.cpp: Use a correct namespace.
+
+2008-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        Move basic threading support from WebCore to WTF.
+
+        Added mutex protection to MessageQueue::killed() for paranoia sake.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * wtf/Locker.h: Copied from WebCore/platform/Locker.h.
+        * wtf/MessageQueue.h: Copied from WebCore/platform/MessageQueue.h.
+        (WTF::::killed):
+        * wtf/Threading.h: Copied from WebCore/platform/Threading.h.
+        * wtf/ThreadingGtk.cpp: Copied from WebCore/platform/gtk/ThreadingGtk.cpp.
+        (WebCore::createThread):
+        * wtf/ThreadingNone.cpp: Copied from WebCore/platform/ThreadingNone.cpp.
+        * wtf/ThreadingPthreads.cpp: Copied from WebCore/platform/pthreads/ThreadingPthreads.cpp.
+        (WTF::createThread):
+        * wtf/ThreadingWin.cpp: Copied from WebCore/platform/win/ThreadingWin.cpp.
+        (WTF::createThread):
+        (WTF::Mutex::Mutex):
+        (WTF::Mutex::~Mutex):
+        (WTF::Mutex::lock):
+        (WTF::Mutex::tryLock):
+        (WTF::Mutex::unlock):
+
+2008-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Partial fix for <rdar://problem/5744037> Gmail out of memory (17455)
+        
+        I'm removing KJS_MEM_LIMIT for the following reasons:
+        
+        - We have a few reports of KJS_MEM_LIMIT breaking important web
+        applications, like GMail and Google Reader. (For example, if you
+        simply open 12 GMail tabs, tab #12 will hit the limit.)
+
+        - Firefox has no discernable JS object count limit, so any limit, even
+        a large one, is a potential compatibility problem.
+        
+        - KJS_MEM_LIMIT does not protect against malicious memory allocation,
+        since there are many ways to maliciously allocate memory without
+        increasing the JS object count.
+        
+        - KJS_MEM_LIMIT is already mostly broken, since it only aborts the
+        script that breaches the limit, not any subsequent scripts.
+        
+        - We've never gotten bug reports about websites that would have
+        benefited from an unbroken KJS_MEM_LIMIT. The initial check-in of
+        KJS_MEM_LIMIT (KJS revision 80061) doesn't mention a website that
+        needed it.
+        
+        - Any website that brings you anywhere close to crashing due to the
+        number of live JS objects will almost certainly put up the "slow
+        script" dialog at least 20 times beforehand.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        * kjs/collector.h:
+        * kjs/nodes.cpp:
+        (KJS::TryNode::execute):
+
+2008-02-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey P.
+
+        <rdar://problem/5759327> REGRESSION: while(NaN) acts like while(true)
+
+        Fix yet another case where we incorrectly relied on implicit double
+        to bool coercion.
+
+        * kjs/nodes.cpp:
+        (KJS::PostDecLocalVarNode::evaluateToBoolean):
+
+2008-02-20  Michael Knaup  <michael.knaup@mac.com>
+
+        Reviewed by Darin.
+
+        Fix for Bug 16753: date set methods with no args should result in NaN (Acid3 bug)
+        The set values result in NaN now when called with no args, NaN or +/- inf values.
+        The setYear, setFullYear and setUTCFullYear methods used on NaN dates work as 
+        descripted in the standard.
+
+        * kjs/date_object.cpp:
+        (KJS::fillStructuresUsingTimeArgs):
+        (KJS::fillStructuresUsingDateArgs):
+        (KJS::setNewValueFromTimeArgs):
+        (KJS::setNewValueFromDateArgs):
+        (KJS::dateProtoFuncSetYear):
+
+2008-02-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin.
+
+        Change OpaqueJSClass and RootObject to start with a ref count of 1.
+        
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClass::createNoAutomaticPrototype):
+        (OpaqueJSClass::create):
+        * API/JSClassRef.h:
+        * API/JSObjectRef.cpp:
+        (JSClassCreate):
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::RootObject::create):
+        (KJS::Bindings::RootObject::RootObject):
+
+2008-02-19  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Anders.
+
+        - removed explicit initialization to 1 for RefCounted; that's now the default
+
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Removed RefCounted initializer.
+
+2008-02-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders.
+
+        - next step for http://bugs.webkit.org/show_bug.cgi?id=17257
+          start ref counts at 1 instead of 0 for speed
+
+        * wtf/RefCounted.h:
+        (WTF::RefCounted::RefCounted): Have refcounts default to 1. This allows us to start
+        removing the explicit initialization of RefCounted from classes and eventually we
+        can remove the ability to have the initial count of 0 entirely.
+
+2008-02-18  Samuel Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=17419
+        Remove CompatMode from JavaScriptCore as it is never set to anything other than NativeMode
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::init):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::setDebugger):
+        * kjs/date_object.cpp:
+        (KJS::dateProtoFuncGetYear):
+
+2008-02-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        * wtf/ASCIICType.h:
+        (WTF::toASCIIHexValue): Added.
+
+2008-02-17  Darin Adler  <darin@apple.com>
+
+        * wtf/ListHashSet.h: (WTF::swap): Removed stray return statement.
+
+2008-02-15  Adam Roben  <aroben@apple.com>
+
+        Make JavaScriptCore's FEATURE_DEFINES match WebCore's
+
+        Reviewed by Mark.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-02-14  Stephanie Lewis <slewis@apple.com>
+
+        Reviewed by Geoff.
+
+        Update order files.
+
+        * JavaScriptCore.order:
+
+2008-02-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/5737835> nee http://bugs.webkit.org/show_bug.cgi?id=17329
+        Crash in JSGlobalObject::popActivation when inserting hyperlink in Wordpress (17329)
+        
+        Don't reset the "activations" stack in JSGlobalObject::reset, since we
+        might be executing a script during the call to reset, and the script
+        needs to safely run to completion.
+        
+        Instead, initialize the "activations" stack when the global object is
+        created, and subsequently rely on pushing and popping during normal
+        execution to maintain the stack's state.
+        
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::init):
+        (KJS::JSGlobalObject::reset):
+
+2008-02-13  Bernhard Rosenkraenzer  <bero@arklinux.org>
+
+        Reviewed by Darin.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=17339
+          JavaScriptCore does not build with gcc 4.3
+
+        * kjs/interpreter.cpp: Add include of <unistd.h>, since that's where
+        getpid() comes from.
+
+2008-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey P.
+
+        <rdar://problem/5737003> REGRESSION (r27747): can't browse pictures on fastcupid.com
+
+        When converting numeric values to booleans we need to account for NaN
+
+        * kjs/nodes.cpp:
+        (KJS::MultNode::evaluateToBoolean):
+        (KJS::ModNode::evaluateToBoolean):
+
+2008-02-08  Samuel Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/5659216> REGRESSION: PLT 0.3% slower due to r28868 (caching ClassNodeList and NamedNodeList)
+
+        - Tweak the statements in isASCIISpace to account for the statistical distribution of
+          usage in the PLT.
+
+        .4% speedup on my machine.  Stephanie's machine shows this as .3% speedup.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCIISpace): 
+
+2008-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fixes for:
+        <rdar://problem/5735497> Match Firefox's cross-domain model more accurately by return the built-in version of functions even if they have been overridden
+        <rdar://problem/5735443> Crash when setting the Window objects prototype to a custom Object and then calling a method on it
+
+        - Expose the native Object.prototype.toString implementation so that it can be used for cross-domain
+          toString calling.
+
+        * JavaScriptCore.exp:
+        * kjs/object_object.cpp:
+        * kjs/object_object.h:
+
+2008-02-10  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Eric.
+
+        * kjs/ExecState.h:
+        (KJS::ExecState::takeException): Added.
+
+2008-02-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=17256
+          eliminate default ref. count of 0 in RefCounted class
+
+        * wtf/RefCounted.h:
+        (WTF::RefCounted::RefCounted): Remove default of 0.
+
+2008-02-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=17256
+          Make clients of RefCounted explicitly set the count to 0.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * bindings/runtime_root.cpp:
+        (KJS::Bindings::RootObject::RootObject):
+
+2008-02-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mitz.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=17256
+          Change RegExp to start its ref count at 1, not 0
+
+        We'll want to do this to every RefCounted class, one at a time.
+
+        * kjs/nodes.h:
+        (KJS::RegExpNode::RegExpNode): Use RegExp::create instead of new RegExp.
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Marked inline, set initial ref count to 1.
+        (KJS::RegExp::create): Added. Calls new RegExp then adopts the initial ref.
+        * kjs/regexp.h: Reformatted. Made the constructors private. Added static
+        create functions that return objects already wrapped in PassRefPtr.
+        * kjs/regexp_object.cpp:
+        (KJS::regExpProtoFuncCompile): Use RegExp::create instead of new RegExp.
+        (KJS::RegExpObjectImp::construct): Ditto.
+        * kjs/string_object.cpp:
+        (KJS::stringProtoFuncMatch): Ditto.
+        (KJS::stringProtoFuncSearch): Ditto.
+
+2008-02-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        <rdar://problem/5731773> REGRESSION (r28973): Extraneous parentheses in function.toString()
+        https://bugs.webkit.org/show_bug.cgi?id=17214
+
+        Make a subclass of CommaNode to provide the correct precedence for each expression in
+        a variable declaration list.
+
+        * kjs/grammar.y:
+        * kjs/nodes.h:
+        (KJS::VarDeclCommaNode::):
+
+2008-02-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17247
+          Labelled continue/break can fail in some cases
+
+        Test: fast/js/continue-break-multiple-labels.html
+
+        * kjs/nodes.h:
+        (KJS::StatementNode::pushLabel): Made this virtual.
+        (KJS::LabelNode::pushLabel): Forward pushLabel calls to the statement inside.
+
+2008-02-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15003
+          Function.prototype.constructor should not be DontDelete/ReadOnly (Acid3 bug)
+
+        Test: fast/js/constructor-attributes.html
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset): Remove unwanted attributes from "constructor".
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct): Ditto.
+        * kjs/nodes.cpp:
+        (KJS::FuncDeclNode::makeFunction): Ditto.
+        (KJS::FuncExprNode::evaluate): Ditto.
+
+2008-02-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Added an ASSERT to catch refCount underflow, since it caused a leak in
+        my last check-in.
+
+        * wtf/RefCounted.h:
+        (WTF::RefCounted::deref):
+
+2008-02-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        PLT speedup related to <rdar://problem/5659272> REGRESSION: PLT .4%
+        slower due to r28884 (global variable symbol table optimization)
+        
+        Tweaked RefCounted::deref() to be a little more efficient.
+
+        1% - 1.5% speedup on my machine. .7% speedup on Stephanie's machine.
+        
+        * wtf/RefCounted.h:
+        (WTF::RefCounted::deref): Don't modify m_refCount if we're just going
+        to delete the object anyway. Also, use a simple == test, which might be
+        faster than <= on some hardware.
+
+2008-02-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17094
+          Array.prototype functions create length properties with DontEnum/DontDelete
+
+        Test results match Gecko with very few obscure exceptions that seem to be
+        bugs in Gecko.
+
+        Test: fast/js/array-functions-non-arrays.html
+
+        * kjs/array_object.cpp:
+        (KJS::arrayProtoFuncConcat):  Removed DontEnum and DontDelete from the call
+        to set length.
+        (KJS::arrayProtoFuncPop): Ditto. Also added missing call to deleteProperty,
+        which is not needed for real arrays, but is needed for non-arrays.
+        (KJS::arrayProtoFuncPush): Ditto.
+        (KJS::arrayProtoFuncShift): Ditto.
+        (KJS::arrayProtoFuncSlice): Ditto.
+        (KJS::arrayProtoFuncSort): Removed incorrect call to set length when
+        the array has no elements.
+        (KJS::arrayProtoFuncSplice): Removed DontEnum and DontDelete from the call
+        to set length.
+        (KJS::arrayProtoFuncUnShift): Ditto. Also added a check for 0 arguments to
+        make behavior match the specification in that case.
+        * kjs/nodes.cpp:
+        (KJS::ArrayNode::evaluate): Removed DontEnum and DontDelete from the call
+        to set length.
+
+2008-02-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - replace calls to put to set up properties with calls to putDirect, to
+          prepare for a future change where put won't take attributes any more,
+          and for a slight performance boost
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor): Use putDirect instead of put.
+        * kjs/CommonIdentifiers.h: Removed lastIndex.
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset): Use putDirect instead of put.
+        * kjs/array_object.cpp:
+        (KJS::arrayProtoFuncConcat): Took out extra call to get length (unused).
+        (KJS::ArrayObjectImp::ArrayObjectImp): Use putDirect instead of put.
+        * kjs/error_object.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype): Use putDirect instead of put.
+        * kjs/function.cpp:
+        (KJS::Arguments::Arguments): Use putDirect instead of put.
+        (KJS::PrototypeFunction::PrototypeFunction): Use putDirect instead of put.
+        * kjs/function_object.cpp:
+        (KJS::FunctionObjectImp::construct): Use putDirect instead of put.
+        * kjs/nodes.cpp:
+        (KJS::FuncDeclNode::makeFunction): Use putDirect instead of put.
+        (KJS::FuncExprNode::evaluate): Use putDirect instead of put.
+        * kjs/regexp_object.cpp:
+        (KJS::regExpProtoFuncCompile): Use setLastIndex instead of put(lastIndex).
+        (KJS::RegExpImp::match): Get and set lastIndex by using m_lastIndex instead of
+        calling get and put.
+        * kjs/regexp_object.h:
+        (KJS::RegExpImp::setLastIndex): Added.
+        * kjs/string_object.cpp:
+        (KJS::stringProtoFuncMatch): Use setLastIndex instead of put(lastIndex).
+
+2008-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=8080
+        NodeList (and other DOM lists) items are not enumeratable using for..in
+
+        * JavaScriptCore.exp:
+
+2008-02-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update versioning to support the mysterious future.
+
+        * Configurations/Version.xcconfig: Add SYSTEM_VERSION_PREFIX_1060.
+
+2008-02-04  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Fixes Bug 16889: REGRESSION (r29425): Canvas-based graphing calculator fails to run
+              Bug 17015: REGRESSION (r29414-29428): www.fox.com "shows" menu fails to render
+              Bug 17164: REGRESSION: JavaScript pop-up menu appears at wrong location when hovering image at http://news.chinatimes.com/
+
+        <http://bugs.webkit.org/show_bug.cgi?id=16889>
+        <rdar://problem/5696255>
+
+        <http://bugs.webkit.org/show_bug.cgi?id=17015>
+
+        <http://bugs.webkit.org/show_bug.cgi?id=17164>
+        <rdar://problem/5720947>
+
+        The ActivationImp tear-off (r29425) introduced a problem with ReadModify
+        nodes that first resolve a slot, call valueForReadModifyNode(), and then
+        store a value in the previously resolved slot. Since valueForReadModifyNode()
+        may cause a tear-off, the slot needs to be resolved again, but this was
+        not happening with the existing code.
+
+        * kjs/nodes.cpp:
+        (KJS::ReadModifyLocalVarNode::evaluate):
+        (KJS::ReadModifyResolveNode::evaluate):
+
+2008-02-04  Cameron McCormack <cam@mcc.id.au>
+
+        Reviewed by Geoff Garen.
+
+        Remove some unneccesary UNUSED_PARAMs.  Clarify ownership rule of return value of JSObjectCopyPropertyNames.
+
+        * API/JSNode.c:
+        (JSNode_appendChild):
+        (JSNode_removeChild):
+        (JSNode_replaceChild):
+        (JSNode_getNodeType):
+        (JSNode_getFirstChild):
+        * API/JSNodeList.c:
+        (JSNodeList_length):
+        * API/JSObjectRef.h:
+
+2008-02-04  Rodney Dawes  <dobey@wayofthemonkey.com>
+
+        Reviewed by Alp Toker and Mark Rowe.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=17175.
+        Bug 17175: Use of C++ compiler flags in CFLAGS
+
+        * GNUmakefile.am: Use global_cxxflags as well as global_cflags in CXXFLAGS.
+
+2008-02-04  Alp Toker  <alp@atoker.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Remove all trailing whitespace in the GTK+ port and related
+        components.
+
+        * GNUmakefile.am:
+
+2008-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        PLT speedup related to <rdar://problem/5659272> REGRESSION: PLT .4%
+        slower due to r28884 (global variable symbol table optimization)
+
+        Geoff's theory is that the slowdown was due to copying hash tables when
+        putting things into the back/forward cache. If that's true, then this
+        should fix the problem.
+
+        (According to Geoff's measurements, in a PLT that exaggerates the
+        importance of symbol table saving during cached page creation, this
+        patch is a ~3X speedup in cached page creation, and a 9% speedup overall.)
+
+        * JavaScriptCore.exp: Updated.
+
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::saveLocalStorage): Updated for changes to SavedProperty,
+        which has been revised to avoid initializing each SavedProperty twice when building
+        the array. Store the property names too, so we don't have to store the symbol table
+        separately. Do this by iterating the symbol table instead of the local storage vector.
+        (KJS::JSVariableObject::restoreLocalStorage): Ditto. Restore the symbol table as
+        well as the local storage vector.
+
+        * kjs/JSVariableObject.h: Removed save/restoreSymbolTable and do that work inside
+        save/restoreLocalStorage instead. Made restoreLocalStorage a non-const member function
+        that takes a const reference to a SavedProperties object.
+
+        * kjs/LocalStorage.h: Changed attributes to be unsigned instead of int to match
+        other declarations of attributes elsewhere.
+
+        * kjs/property_map.cpp:
+        (KJS::SavedProperties::SavedProperties): Updated for data member name change.
+        (KJS::PropertyMap::save): Updated for data member name change and to use the new
+        inline init function instead of setting the fields directly. This allows us to
+        skip initializing the SavedProperty objects when first allocating the array, and
+        just do it when we're actually setting up the individual elements.
+        (KJS::PropertyMap::restore): Updated for SavedProperty changes.
+
+        * kjs/property_map.h: Changed SavedProperty from a struct to a class. Set it up so
+        it does not get initialized at construction time to avoid initializing twice when
+        creating an array of SavedProperty. Removed the m_ prefixes from the members of
+        the SavedProperties struct. Generally we use m_ for class members and not struct.
+
+2008-02-02  Tony Chang  <idealisms@gmail.com>
+
+        Reviewed by darin.  Landed by eseidel.
+
+        Add #define guards for WIN32_LEAN_AND_MEAN and _CRT_RAND_S.
+
+        * kjs/config.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/TCSpinLock.h:
+
+2008-01-28  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        - Fix whitespace in nodes.h/cpp and nodes2string.cpp.
+
+        (NOTE: Specific changed functions elided for space and clarity)
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+
+2008-01-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Patch for http://bugs.webkit.org/show_bug.cgi?id=17025
+        nodes.h/cpp has been rolling around in the mud - lets hose it down
+
+        - Rename member variables to use the m_ prefix.
+
+        (NOTE: Specific changed functions elided for space and clarity)
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+
+2008-01-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - fix <rdar://problem/5657450> REGRESSION: const is broken
+
+        Test: fast/js/const.html
+
+        SunSpider said this was 0.3% slower. And I saw some Shark samples in
+        JSGlobalObject::put -- not a lot but a few. We may be able to regain the
+        speed, but for now we will take that small hit for correctness sake.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::put): Pass the checkReadOnly flag in to symbolTablePut
+        instead of passing attributes.
+
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTablePut): Removed the code to set attributes
+        here, since we only set attributes when creating a property. Added the code
+        to check read-only here, since we need that to implement const!
+
+        * kjs/function.cpp:
+        (KJS::ActivationImp::put): Pass the checkReadOnly flag in to symbolTablePut
+        instead of passing attributes.
+
+        * kjs/nodes.cpp:
+        (KJS::isConstant): Added.
+        (KJS::PostIncResolveNode::optimizeVariableAccess): Create a PostIncConstNode
+        if optimizing for a local variable and the variable is constant.
+        (KJS::PostDecResolveNode::optimizeVariableAccess): Ditto. But PostDecConstNode.
+        (KJS::PreIncResolveNode::optimizeVariableAccess): Ditto. But PreIncConstNode.
+        (KJS::PreDecResolveNode::optimizeVariableAccess): Ditto. But PreDecConstNode.
+        (KJS::PreIncConstNode::evaluate): Return the value + 1.
+        (KJS::PreDecConstNode::evaluate): Return the value - 1.
+        (KJS::PostIncConstNode::evaluate): Return the value converted to a number.
+        (KJS::PostDecConstNode::evaluate): Ditto.
+        (KJS::ReadModifyResolveNode::optimizeVariableAccess): Create a ReadModifyConstNode
+        if optimizing for a local variable and the variable is constant.
+        (KJS::AssignResolveNode::optimizeVariableAccess): Ditto. But AssignConstNode.
+        (KJS::ScopeNode::optimizeVariableAccess): Pass the local storage to the
+        node optimizeVariableAccess functions, since that's where we need to look to
+        figure out if a variable is constant.
+        (KJS::FunctionBodyNode::processDeclarations): Moved the call to
+        optimizeVariableAccess until after localStorage is set up.
+        (KJS::ProgramNode::processDeclarations): Ditto.
+
+        * kjs/nodes.h: Fixed the IsConstant and HasInitializer values. They are used
+        as flag masks, so a value of 0 will not work for IsConstant. Changed the
+        first parameter to optimizeVariableAccess to be a const reference to a symbol
+        table and added a const reference to local storage. Added classes for const
+        versions of local variable access: PostIncConstNode, PostDecConstNode,
+        PreIncConstNode, PreDecConstNode, ReadModifyConstNode, and AssignConstNode.
+
+        * kjs/object.cpp:
+        (KJS::JSObject::put): Tweaked comments a bit, and changed the checkReadOnly
+        expression to match the form used at the two other call sites.
+
+2008-01-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16498
+          ''.constructor.toString() gives [function]
+
+        Test: fast/js/function-names.html
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayObjectImp::ArrayObjectImp): Use the class name as the constructor's function name.
+        * kjs/bool_object.cpp:
+        (KJS::BooleanObjectImp::BooleanObjectImp): Ditto.
+        * kjs/date_object.cpp:
+        (KJS::DateObjectImp::DateObjectImp): Ditto.
+        * kjs/error_object.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype): Make the error object be an Error.
+        (KJS::ErrorObjectImp::ErrorObjectImp): Use the class name as the constructor's function name.
+        (KJS::NativeErrorPrototype::NativeErrorPrototype): Take const UString&.
+        (KJS::NativeErrorImp::NativeErrorImp): Use the prototype's name as the constructor's function
+        name.
+        * kjs/error_object.h: Change ErrorPrototype to inherit from ErrorInstance. Change the
+        NativeErrorImp constructor to take a NativeErrorPrototype pointer for its prototype.
+        * kjs/function.h: Removed unneeded constructor for internal functions without names.
+        We want to avoid those!
+        * kjs/function_object.cpp:
+        (KJS::functionProtoFuncToString): Removed code that writes out just [function] for functions
+        that have no names. There's no reason to do that.
+        (KJS::FunctionObjectImp::FunctionObjectImp): Use the class name as the constructor's
+        function name.
+        * kjs/internal.cpp: Removed the unused constructor.
+        * kjs/number_object.cpp:
+        (KJS::fractionalPartToString): Marked static for internal linkage.
+        (KJS::exponentialPartToString): Ditto.
+        (KJS::numberProtoFuncToPrecision): Removed an unneeded else.
+        (KJS::NumberObjectImp::NumberObjectImp): Use the class name as the constructor's
+        function name.
+        (KJS::NumberObjectImp::getValueProperty): Tweaked formatting.
+        * kjs/object_object.cpp:
+        (KJS::ObjectObjectImp::ObjectObjectImp): Use "Object" for the function name.
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpObjectImp::RegExpObjectImp): Use "RegExp" for the function name.
+        * kjs/string_object.cpp:
+        (KJS::StringObjectImp::StringObjectImp): Use the class name as the constructor's
+        function name.
+
+2008-01-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17027
+          Incorrect Function.toString behaviour with read/modify/write operators performed on negative numbers
+
+        Test: fast/js/function-toString-parentheses.html
+
+        The problem here was that a NumberNode with a negative number in it had the wrong
+        precedence. It's not a primary expression, it's a unary operator with a primary
+        expression after it.
+
+        Once the precedence of NumberNode was fixed, the cases from bug 17020 were also
+        fixed without trying to treat bracket nodes like dot nodes. That wasn't needed.
+        The reason we handle numbers before dot nodes specially is that the dot is a
+        legal character in a number. The same is not true of a bracket. Eventually we
+        could get smarter, and only add the parentheses when there is actual ambiguity.
+        There is none if the string form of the number already has a dot in it, or if
+        it's a number with a alphabetic name like infinity or NAN.
+
+        * kjs/nodes.h: Renamed back from ObjectAccess to DotExpr.
+        (KJS::NumberNode::precedence): Return PrecUnary for negative numbers, since
+        they serialize as a unary operator, not a primary expression.
+        * kjs/nodes2string.cpp:
+        (KJS::SourceStream::operator<<): Clear m_numberNeedsParens if this adds
+        parens; one set is enough.
+        (KJS::bracketNodeStreamTo): Remove unneeded special flag here. Normal
+        operator precedence suffices.
+        (KJS::NewExprNode::streamTo): Ditto.
+
+2008-01-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej and Darin.
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=17020
+        Function.toString does not parenthesise numbers for the bracket accessor
+
+        It turns out that logic was there for all of the dot accessor nodes to make numbers be
+        parenthesised properly, so it was a trivial extension to extend that to the bracket nodes.
+        I renamed the enum type to reflect the fact that it is now used for both dot and bracket
+        accessors.
+
+        * kjs/nodes2string.cpp:
+        (KJS::bracketNodeStreamTo):
+        (KJS::BracketAccessorNode::streamTo):
+
+2008-01-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        Fix Bug 17018: Incorrect code generated from Function.toString for get/setters in object literals
+
+        Don't quote getter and setter names during output, as that is simply wrong.
+
+        * kjs/nodes2string.cpp:
+        (KJS::PropertyNode::streamTo):
+
+2008-01-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=16860
+          a bit of cleanup after the Activation optimization
+
+        * JavaScriptCore.exp: Export the GlobalExecState constructor instead of
+        the global flavor of the ExecState constructor. It'd probably be cleaner
+        to not export either one, but JSGlobalObject inlines the code that
+        constructs the ExecState. If we changed that, we could remove this export.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Re-sorted a few things and
+        put the new source files into the kjs group rather than at the top level.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState): Marked inline and updated for data member
+        name changes. This is now only for use for the derived classes. Also removed
+        code that sets the unused m_savedExec data member for the global case. That
+        data member is only used for the other two types.
+        (KJS::ExecState::~ExecState): Marked inline and removed all the code.
+        The derived class destructors now inclde the appropriate code.
+        (KJS::ExecState::lexicalGlobalObject): Removed unneeded special case for
+        an empty scope chain. The bottom function already returns 0 for that case,
+        so the general case code handles it fine. Also changed to use data members
+        directly rather than calling functions.
+        (KJS::GlobalExecState::GlobalExecState): Added. Calls through to the base
+        class constructor.
+        (KJS::GlobalExecState::~GlobalExecState): Added.
+        (KJS::InterpreterExecState::InterpreterExecState): Added. Moved code to
+        manipulate activeExecStates here since we don't want to have to check for the
+        special case of globalExec.
+        (KJS::InterpreterExecState::~InterpreterExecState): Added.
+        (KJS::EvalExecState::EvalExecState): Added.
+        (KJS::EvalExecState::~EvalExecState): Added.
+        (KJS::FunctionExecState::FunctionExecState): Added.
+        (KJS::FunctionExecState::~FunctionExecState): Added.
+
+        * kjs/ExecState.h: Tweaked the header, includes, and declarations a bit.
+        Made ExecState inherit from Noncopyable. Reformatted some comments and
+        made them a bit more brief. Rearranged declarations a little bit and removed
+        unused savedExec function. Changed seenLabels function to return a reference
+        rather than a pointer. Made constructors and destructor protected, and also
+        did the same with all data members. Renamed m_thisVal to m_thisValue and
+        ls to m_labelStack. Added three new derived classes for each of the
+        types of ExecState. The primary goal here was to remove a branch from the
+        code in the destructor, but it's also clearer than overloading the arguments
+        to the ExecState constructor.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::getCurrentTime): Fixed formatting.
+        (KJS::JSGlobalObject::pushActivation): Removed parentheses that don't make
+        the expression clearer -- other similar sites didn't have these parentheses,
+        even the one a couple lines earlier that sets stackEntry.
+        (KJS::JSGlobalObject::tearOffActivation): Got rid of unneeded static_cast
+        (I think I mentioned this during patch review) and used an early exit so that
+        the entire contents of the function aren't nested inside an if statement.
+        Also removed the check of codeType, instead checking Activation for 0.
+        For now, I kept the codeType check, but inside an assertion.
+
+        * kjs/JSGlobalObject.h: Changed type of globalExec to GlobalExecState.
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction): Changed type to FunctionExecState.
+        (KJS::GlobalFuncImp::callAsFunction): Changed type to EvalExecState.
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate): Changed type to GlobalExecState.
+
+        * kjs/nodes.cpp:
+        (KJS::ContinueNode::execute): Changed code since seenLabels() returns a
+        reference now instead of a pointer.
+        (KJS::BreakNode::execute): Ditto.
+        (KJS::LabelNode::execute): Ditto.
+
+2008-01-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Cleanup node2string a little.
+        - Remove some unnecessary branching.
+        - Factor out bracket and dot streaming into static inline functions.
+
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        (KJS::bracketNodeStreamTo):
+        (KJS::dotNodeStreamTo):
+        (KJS::FunctionCallBracketNode::streamTo):
+        (KJS::FunctionCallDotNode::streamTo):
+        (KJS::PostIncBracketNode::streamTo):
+        (KJS::PostDecBracketNode::streamTo):
+        (KJS::PostIncDotNode::streamTo):
+        (KJS::PostDecDotNode::streamTo):
+        (KJS::DeleteBracketNode::streamTo):
+        (KJS::DeleteDotNode::streamTo):
+        (KJS::PreIncBracketNode::streamTo):
+        (KJS::PreDecBracketNode::streamTo):
+        (KJS::PreIncDotNode::streamTo):
+        (KJS::PreDecDotNode::streamTo):
+        (KJS::ReadModifyBracketNode::streamTo):
+        (KJS::AssignBracketNode::streamTo):
+        (KJS::ReadModifyDotNode::streamTo):
+        (KJS::AssignDotNode::streamTo):
+        (KJS::WhileNode::streamTo):
+
+2008-01-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=17001
+        Bug 17001: Build error with Gtk port on Mac OS X
+
+        If both XP_MACOSX and XP_UNIX are defined then X11.h and Carbon.h will both be included.
+        These provide conflicting definitions for a type named 'Cursor'.  As XP_UNIX is set by
+        the build system when targeting X11, it doesn't make sense for XP_MACOSX to also be set
+        in this instance.
+
+        * bindings/npapi.h: Don't define XP_MACOSX if XP_UNIX is defined.
+
+2008-01-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17013
+          JSC can't round trip certain for-loops
+
+        Test: fast/js/toString-for-var-decl.html
+
+        * kjs/nodes.h: Added PlaceholderTrueNode so we can put nodes into
+        for loops without injecting the word "true" into them (nice, but not
+        the bug fix). Fixed ForNode constructor so expr1WasVarDecl is set
+        only when there is an expression, since it's common for the actual
+        variable declaration to be moved by the parser.
+
+        * kjs/nodes2string.cpp:
+        (KJS::PlaceholderTrueNode::streamTo): Added. Empty.
+
+2008-01-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Fix for bug 17012: REGRESSION: JSC can't round trip an object literal
+
+        Add logic to ensure that object literals and function expressions get
+        parentheses when necessary.
+
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        (KJS::SourceStream::operator<<):
+
+2008-01-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+
+2008-01-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+
+2008-01-24  Michael Goddard  <michael.goddard@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix QDateTime to JS Date conversion.
+        Several conversion errors (some UTC related, some month
+        offset related) and the conversion distance for Date
+        to DateTime conversion weights were fixed (it should never
+        be better to convert a JS Number into a Date rather than
+        an int).
+        
+        * bindings/qt/qt_runtime.cpp:
+        (KJS::Bindings::convertValueToQVariant):
+        (KJS::Bindings::convertQVariantToValue):
+
+2008-01-24  Michael Goddard  <michael.goddard@trolltech.com>
+
+        Reviewed by Simon.
+
+        Add support for calling QObjects.
+        Add support for invokeDefaultMethod (via a call to
+        a specific slot), and also allow using it as a
+        constructor, like QtScript.
+        
+
+        * bindings/qt/qt_class.cpp:
+        (KJS::Bindings::QtClass::fallbackObject):
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtRuntimeObjectImp::construct):
+        (KJS::Bindings::QtInstance::QtInstance):
+        (KJS::Bindings::QtInstance::~QtInstance):
+        (KJS::Bindings::QtInstance::implementsCall):
+        (KJS::Bindings::QtInstance::invokeDefaultMethod):
+        * bindings/qt/qt_instance.h:
+        * bindings/qt/qt_runtime.cpp:
+        (KJS::Bindings::findMethodIndex):
+        (KJS::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
+        (KJS::Bindings::QtRuntimeMetaMethod::callAsFunction):
+        * bindings/qt/qt_runtime.h:
+
+2008-01-24  Michael Goddard  <michael.goddard@trolltech.com>
+
+        Reviewed by Simon.
+
+        Code style cleanups.
+        Add spaces before/after braces in inline function.
+
+        * bindings/qt/qt_instance.h:
+
+2008-01-24  Michael Goddard  <michael.goddard@trolltech.com>
+
+        Reviewed by Simon.
+
+        Code style cleanups.
+        Remove spaces and unneeded declared parameter names.
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtRuntimeObjectImp::removeFromCache):
+
+2008-01-24  Michael Goddard  <michael.goddard@trolltech.com>
+
+        Reviewed by Simon.
+
+        Clear stale RuntimeObjectImps.
+        Since other objects can have refs to the QtInstance,
+        we can't rely on the QtInstance being deleted when the
+        RuntimeObjectImp is invalidate or deleted.  This
+        could result in a stale JSObject being returned for
+        a valid Instance.
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
+        (KJS::Bindings::QtRuntimeObjectImp::~QtRuntimeObjectImp):
+        (KJS::Bindings::QtRuntimeObjectImp::invalidate):
+        (KJS::Bindings::QtRuntimeObjectImp::removeFromCache):
+        (KJS::Bindings::QtInstance::getRuntimeObject):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createRuntimeObject):
+        * bindings/runtime.h:
+
+2008-01-23  Alp Toker  <alp@atoker.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Remove whitespace after -I in automake include lists.
+
+        * GNUmakefile.am:
+
+2008-01-23  Michael Goddard <michael.goddard@trolltech.com>
+
+        Reviewed by Lars Knoll <lars@trolltech.com>.
+
+        Reworked the JavaScriptCore Qt bindings:
+        
+        * Add initial support for string and variant arrays, as well
+        as sub QObjects in the JS bindings.
+        
+        * Don't expose fields marked as not scriptable by moc.
+        
+        * Add support for dynamic properties and accessing named
+        QObject children of an object (like QtScript and older
+        IE DOM style JS).
+        * Add support for custom toString methods.
+        
+        * Fine tune some bindings to be closer to QtScript.
+        Make void functions return undefined, and empty/
+        null QStrings return a zero length string.
+        
+        * Create framework for allowing more direct method calls.
+        Since RuntimeMethod doesn't allow us to add additional
+        methods/properties to a function, add these classes.
+        Start prototyping object.signal.connect(...).
+        
+        * Add signal support to the Qt bindings.
+        Allow connecting to signals (object.signal.connect(slot)),
+        disconnecting, and emitting signals.  Currently chooses
+        the first signal that matches the name, so this will need
+        improvement.
+        
+        * Add property names, and resolve signals closer to use.
+        Enumerating properties now returns some of the Qt properties
+        and signals.  Slots and methods aren't quite present.  Also,
+        resolve signal connections etc. closer to the time of use, so
+        we can do more dynamic resolution based on argument type etc.
+        Still picks the first one with the same name, at the moment.
+        
+        * Make signature comparison code consistent.
+        Use the same code for checking meta signatures in
+        the method and fallback getters, and avoid a
+        QByteArray construction when we can.
+        
+        * Fix minor memory leak, and handle pointers better.
+        Delete the private object in the dtors, and use RefPtrs
+        for holding Instances etc.
+        
+        * Handle method lookup better.
+        Allow invocation time method lookup based on the arguments,
+        which is closer to QtScript behaviour.  Also, cache the
+        method lists and delete them in the QtClass dtor (stops
+        a memory leak).
+        
+        * Improve JS to Qt data type conversions.
+        Add some support for Date & RegExp JS objects,
+        and provide some metrics on the quality of the
+        conversion.
+        
+        * A couple of fixes for autotest failures.
+        Better support for converting lists, read/write only
+        QMetaProperty support, modified slot search order...)
+
+        * bindings/qt/qt_class.cpp:
+        (KJS::Bindings::QtClass::QtClass):
+        (KJS::Bindings::QtClass::~QtClass):
+        (KJS::Bindings::QtClass::name):
+        (KJS::Bindings::QtClass::fallbackObject):
+        (KJS::Bindings::QtClass::methodsNamed):
+        (KJS::Bindings::QtClass::fieldNamed):
+        * bindings/qt/qt_class.h:
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::QtInstance):
+        (KJS::Bindings::QtInstance::~QtInstance):
+        (KJS::Bindings::QtInstance::getRuntimeObject):
+        (KJS::Bindings::QtInstance::getClass):
+        (KJS::Bindings::QtInstance::implementsCall):
+        (KJS::Bindings::QtInstance::getPropertyNames):
+        (KJS::Bindings::QtInstance::invokeMethod):
+        (KJS::Bindings::QtInstance::invokeDefaultMethod):
+        (KJS::Bindings::QtInstance::stringValue):
+        (KJS::Bindings::QtInstance::booleanValue):
+        (KJS::Bindings::QtInstance::valueOf):
+        (KJS::Bindings::QtField::name):
+        (KJS::Bindings::QtField::valueFromInstance):
+        (KJS::Bindings::QtField::setValueToInstance):
+        * bindings/qt/qt_instance.h:
+        (KJS::Bindings::QtInstance::getBindingLanguage):
+        (KJS::Bindings::QtInstance::getObject):
+        * bindings/qt/qt_runtime.cpp:
+        (KJS::Bindings::QWKNoDebug::QWKNoDebug):
+        (KJS::Bindings::QWKNoDebug::~QWKNoDebug):
+        (KJS::Bindings::QWKNoDebug::operator<<):
+        (KJS::Bindings::):
+        (KJS::Bindings::valueRealType):
+        (KJS::Bindings::convertValueToQVariant):
+        (KJS::Bindings::convertQVariantToValue):
+        (KJS::Bindings::QtRuntimeMethod::QtRuntimeMethod):
+        (KJS::Bindings::QtRuntimeMethod::~QtRuntimeMethod):
+        (KJS::Bindings::QtRuntimeMethod::codeType):
+        (KJS::Bindings::QtRuntimeMethod::execute):
+        (KJS::Bindings::QtRuntimeMethodData::~QtRuntimeMethodData):
+        (KJS::Bindings::QtRuntimeMetaMethodData::~QtRuntimeMetaMethodData):
+        (KJS::Bindings::QtRuntimeConnectionMethodData::~QtRuntimeConnectionMethodData):
+        (KJS::Bindings::QtMethodMatchType::):
+        (KJS::Bindings::QtMethodMatchType::QtMethodMatchType):
+        (KJS::Bindings::QtMethodMatchType::kind):
+        (KJS::Bindings::QtMethodMatchType::isValid):
+        (KJS::Bindings::QtMethodMatchType::isVariant):
+        (KJS::Bindings::QtMethodMatchType::isMetaType):
+        (KJS::Bindings::QtMethodMatchType::isUnresolved):
+        (KJS::Bindings::QtMethodMatchType::isMetaEnum):
+        (KJS::Bindings::QtMethodMatchType::enumeratorIndex):
+        (KJS::Bindings::QtMethodMatchType::variant):
+        (KJS::Bindings::QtMethodMatchType::metaType):
+        (KJS::Bindings::QtMethodMatchType::metaEnum):
+        (KJS::Bindings::QtMethodMatchType::unresolved):
+        (KJS::Bindings::QtMethodMatchType::typeId):
+        (KJS::Bindings::QtMethodMatchType::name):
+        (KJS::Bindings::QtMethodMatchData::QtMethodMatchData):
+        (KJS::Bindings::QtMethodMatchData::isValid):
+        (KJS::Bindings::QtMethodMatchData::firstUnresolvedIndex):
+        (KJS::Bindings::indexOfMetaEnum):
+        (KJS::Bindings::findMethodIndex):
+        (KJS::Bindings::findSignalIndex):
+        (KJS::Bindings::QtRuntimeMetaMethod::QtRuntimeMetaMethod):
+        (KJS::Bindings::QtRuntimeMetaMethod::mark):
+        (KJS::Bindings::QtRuntimeMetaMethod::callAsFunction):
+        (KJS::Bindings::QtRuntimeMetaMethod::getOwnPropertySlot):
+        (KJS::Bindings::QtRuntimeMetaMethod::lengthGetter):
+        (KJS::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (KJS::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        (KJS::Bindings::QtRuntimeConnectionMethod::QtRuntimeConnectionMethod):
+        (KJS::Bindings::QtRuntimeConnectionMethod::callAsFunction):
+        (KJS::Bindings::QtRuntimeConnectionMethod::getOwnPropertySlot):
+        (KJS::Bindings::QtRuntimeConnectionMethod::lengthGetter):
+        (KJS::Bindings::QtConnectionObject::QtConnectionObject):
+        (KJS::Bindings::QtConnectionObject::~QtConnectionObject):
+        (KJS::Bindings::QtConnectionObject::metaObject):
+        (KJS::Bindings::QtConnectionObject::qt_metacast):
+        (KJS::Bindings::QtConnectionObject::qt_metacall):
+        (KJS::Bindings::QtConnectionObject::execute):
+        (KJS::Bindings::QtConnectionObject::match):
+        (KJS::Bindings::::QtArray):
+        (KJS::Bindings::::~QtArray):
+        (KJS::Bindings::::rootObject):
+        (KJS::Bindings::::setValueAt):
+        (KJS::Bindings::::valueAt):
+        * bindings/qt/qt_runtime.h:
+        (KJS::Bindings::QtField::):
+        (KJS::Bindings::QtField::QtField):
+        (KJS::Bindings::QtField::fieldType):
+        (KJS::Bindings::QtMethod::QtMethod):
+        (KJS::Bindings::QtMethod::name):
+        (KJS::Bindings::QtMethod::numParameters):
+        (KJS::Bindings::QtArray::getLength):
+        (KJS::Bindings::QtRuntimeMethod::d_func):
+        (KJS::Bindings::QtRuntimeMetaMethod::d_func):
+        (KJS::Bindings::QtRuntimeConnectionMethod::d_func):
+        (KJS::Bindings::):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createBindingForLanguageInstance):
+        (KJS::Bindings::Instance::createRuntimeObject):
+        (KJS::Bindings::Instance::reallyCreateRuntimeObject):
+        * bindings/runtime.h:
+
+2008-01-22  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin and Adam.
+
+        <rdar://problem/5688975>
+        div element on microsoft site has wrong left offset.
+        
+        Return true even if NPN_GetProperty returns null or undefined. This matches Firefox 
+        (and is what the Silverlight plug-in expects).
+        
+        * bindings/NP_jsobject.cpp:
+        (_NPN_GetProperty):
+
+2008-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=16909
+        REGRESSION: Amazon.com crash (ActivationImp)
+        
+        (and a bunch of other crashes)
+        
+        Plus, a .7% SunSpider speedup to boot.
+        
+        Replaced the buggy currentExec and savedExec mechanisms with an
+        explicit ExecState stack.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect): Explicitly mark the ExecState stack.
+
+        (KJS::Collector::reportOutOfMemoryToAllExecStates): Slight change in
+        behavior: We no longer throw an exception in any global ExecStates,
+        since global ExecStates are more like pseudo-ExecStates, and aren't
+        used for script execution. (It's unclear what would happen if you left
+        an exception waiting around in a global ExecState, but it probably
+        wouldn't be good.)
+
+2008-01-21  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
+
+        Reviewed by Alp Toker.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16955
+        Get errors when cross-compile webkit-gtk
+
+        * GNUmakefile.am: removed ICU_CFLAGS
+
+2008-01-18  Kevin McCullough  <kmccullough@apple.com>
+
+        - Build fix.
+
+        * kjs/ustring.h:
+
+2008-01-18  Kevin McCullough  <kmccullough@apple.com>
+
+        - Build fix.
+
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        (KJS::UString::cost):
+
+2008-01-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        - Correctly report cost of appended strings to trigger GC.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::Rep::create):
+        (KJS::UString::UString): Don't create unnecssary objects.
+        (KJS::UString::cost): Report cost if necessary but also keep track of 
+        reported cost.
+        * kjs/ustring.h:
+
+2008-01-18  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        Fix return type conversions from Qt slots to JS values.
+        
+        This also fixes fast/dom/open-and-close-by-DOM.html, which called
+        layoutTestController.windowCount().
+        
+        When constructing the QVariant that holds the return type we cannot
+        use the QVarian(Type) constuctor as that will create a null variant.
+        We have to use the QVariant(Type, void *) constructor instead, just
+        like in QMetaObject::read() for example.
+        
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::getRuntimeObject):
+
+2008-01-18  Prasanth Ullattil  <prasanth.ullattil@trolltech.com>
+
+        Reviewed by Simon Hausmann <hausmann@webkit.org>.
+
+        Fix compilation on Win64(2): Implemented currentThreadStackBase on X86-64 on Windows
+        
+
+        * kjs/collector.cpp:
+        (KJS::Collector::heapAllocate):
+
+2008-01-18  Prasanth Ullattil  <prasanth.ullattil@trolltech.com>
+
+        Reviewed by Simon Hausmann <hausmann@webkit.org>.
+
+        Fix compilation on Win64(1): Define WTF_PLATFORM_X86_64 correctly on Win64.
+        
+
+        * wtf/Platform.h:
+
+2008-01-17  Antti Koivisto  <antti@apple.com>
+
+        Fix Windows build.
+
+        * kjs/regexp_object.cpp:
+        (KJS::regExpProtoFuncToString):
+
+2008-01-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin.
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=16901
+        Convert remaining JS function objects to use the new PrototypeFunction class
+
+        - Moves Boolean, Function, RegExp, Number, Object and Global functions to their
+          own static function implementations so that they can be used with the
+          PrototypeFunction class.  SunSpider says this is 1.003x as fast.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        * kjs/array_object.h:
+        * kjs/bool_object.cpp:
+        (KJS::BooleanInstance::BooleanInstance):
+        (KJS::BooleanPrototype::BooleanPrototype):
+        (KJS::booleanProtoFuncToString):
+        (KJS::booleanProtoFuncValueOf):
+        (KJS::BooleanObjectImp::BooleanObjectImp):
+        (KJS::BooleanObjectImp::implementsConstruct):
+        (KJS::BooleanObjectImp::construct):
+        (KJS::BooleanObjectImp::callAsFunction):
+        * kjs/bool_object.h:
+        (KJS::BooleanInstance::classInfo):
+        * kjs/error_object.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype):
+        (KJS::errorProtoFuncToString):
+        * kjs/error_object.h:
+        * kjs/function.cpp:
+        (KJS::globalFuncEval):
+        (KJS::globalFuncParseInt):
+        (KJS::globalFuncParseFloat):
+        (KJS::globalFuncIsNaN):
+        (KJS::globalFuncIsFinite):
+        (KJS::globalFuncDecodeURI):
+        (KJS::globalFuncDecodeURIComponent):
+        (KJS::globalFuncEncodeURI):
+        (KJS::globalFuncEncodeURIComponent):
+        (KJS::globalFuncEscape):
+        (KJS::globalFuncUnEscape):
+        (KJS::globalFuncKJSPrint):
+        (KJS::PrototypeFunction::PrototypeFunction):
+        * kjs/function.h:
+        * kjs/function_object.cpp:
+        (KJS::FunctionPrototype::FunctionPrototype):
+        (KJS::functionProtoFuncToString):
+        (KJS::functionProtoFuncApply):
+        (KJS::functionProtoFuncCall):
+        * kjs/function_object.h:
+        * kjs/number_object.cpp:
+        (KJS::NumberPrototype::NumberPrototype):
+        (KJS::numberProtoFuncToString):
+        (KJS::numberProtoFuncToLocaleString):
+        (KJS::numberProtoFuncValueOf):
+        (KJS::numberProtoFuncToFixed):
+        (KJS::numberProtoFuncToExponential):
+        (KJS::numberProtoFuncToPrecision):
+        * kjs/number_object.h:
+        (KJS::NumberInstance::classInfo):
+        (KJS::NumberObjectImp::classInfo):
+        (KJS::NumberObjectImp::):
+        * kjs/object_object.cpp:
+        (KJS::ObjectPrototype::ObjectPrototype):
+        (KJS::objectProtoFuncValueOf):
+        (KJS::objectProtoFuncHasOwnProperty):
+        (KJS::objectProtoFuncIsPrototypeOf):
+        (KJS::objectProtoFuncDefineGetter):
+        (KJS::objectProtoFuncDefineSetter):
+        (KJS::objectProtoFuncLookupGetter):
+        (KJS::objectProtoFuncLookupSetter):
+        (KJS::objectProtoFuncPropertyIsEnumerable):
+        (KJS::objectProtoFuncToLocaleString):
+        (KJS::objectProtoFuncToString):
+        * kjs/object_object.h:
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpPrototype::RegExpPrototype):
+        (KJS::regExpProtoFuncTest):
+        (KJS::regExpProtoFuncExec):
+        (KJS::regExpProtoFuncCompile):
+        (KJS::regExpProtoFuncToString):
+        * kjs/regexp_object.h:
+
+2008-01-16  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej & Darin.
+
+        Fixes Bug 16868: Gmail crash
+          and Bug 16871: Crash when loading apple.com/startpage
+
+        <http://bugs.webkit.org/show_bug.cgi?id=16868>
+        <rdar://problem/5686108>
+
+        <http://bugs.webkit.org/show_bug.cgi?id=16871>
+        <rdar://problem/5686670>
+
+        Adds ActivationImp tear-off for cross-window eval() and fixes an
+        existing garbage collection issue exposed by the ActivationImp tear-off
+        patch (r29425) that can occur when an ExecState's m_callingExec is
+        different than its m_savedExec.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::mark):
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction):
+
+2008-01-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver.
+
+        Clean up MathObjectImp, it needed a little scrubbing.
+
+        * kjs/math_object.cpp:
+        (KJS::MathObjectImp::MathObjectImp):
+        (KJS::MathObjectImp::getOwnPropertySlot):
+        (KJS::MathObjectImp::getValueProperty):
+        (KJS::mathProtoFuncACos):
+        (KJS::mathProtoFuncASin):
+        (KJS::mathProtoFuncATan):
+        (KJS::mathProtoFuncATan2):
+        (KJS::mathProtoFuncCos):
+        (KJS::mathProtoFuncExp):
+        (KJS::mathProtoFuncLog):
+        (KJS::mathProtoFuncSin):
+        (KJS::mathProtoFuncSqrt):
+        (KJS::mathProtoFuncTan):
+        * kjs/math_object.h:
+        (KJS::MathObjectImp::classInfo):
+        (KJS::MathObjectImp::):
+
+2008-01-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Rename Lexer variable bol to atLineStart.
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::Lexer):
+        (KJS::Lexer::setCode):
+        (KJS::Lexer::nextLine):
+        (KJS::Lexer::lex):
+        * kjs/lexer.h:
+
+2008-01-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Anders Carlsson.
+
+        Remove uses of KJS_PURE_ECMA as we don't ever build with it defined,
+        and we have many features that are not included in the ECMA spec.
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::Lexer):
+        (KJS::Lexer::setCode):
+        (KJS::Lexer::nextLine):
+        (KJS::Lexer::lex):
+        * kjs/lexer.h:
+        * kjs/string_object.cpp:
+        * kjs/string_object.h:
+
+2008-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix <rdar://problem/5595552> r27608 introduced a 20% increase in JS binary size, 4% increase in WebCore binary size
+
+        - This changes the way JS functions that use Lookup tables are handled.  Instead of using
+          one class per function, which allowed specialization of the virtual callAsFunction
+          method, we now use one class, PrototypeFunction, which takes a pointer to a static
+          function to use as the implementation.  This significantly decreases the binary size
+          of JavaScriptCore (about 145k on an Intel only build) while still keeping some of the
+          speedup r27608 garnered (SunSpider says this is 1.005x as slow, which should leave some
+          wiggle room from the original 1% speedup) and keeps the functions implementations in separate
+          functions to help with optimizations.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/array_object.cpp:
+        (KJS::arrayProtoFuncToString):
+        (KJS::arrayProtoFuncToLocaleString):
+        (KJS::arrayProtoFuncJoin):
+        (KJS::arrayProtoFuncConcat):
+        (KJS::arrayProtoFuncPop):
+        (KJS::arrayProtoFuncPush):
+        (KJS::arrayProtoFuncReverse):
+        (KJS::arrayProtoFuncShift):
+        (KJS::arrayProtoFuncSlice):
+        (KJS::arrayProtoFuncSort):
+        (KJS::arrayProtoFuncSplice):
+        (KJS::arrayProtoFuncUnShift):
+        (KJS::arrayProtoFuncFilter):
+        (KJS::arrayProtoFuncMap):
+        (KJS::arrayProtoFuncEvery):
+        (KJS::arrayProtoFuncForEach):
+        (KJS::arrayProtoFuncSome):
+        (KJS::arrayProtoFuncIndexOf):
+        (KJS::arrayProtoFuncLastIndexOf):
+        * kjs/array_object.h:
+        * kjs/date_object.cpp:
+        (KJS::DatePrototype::getOwnPropertySlot):
+        (KJS::dateProtoFuncToString):
+        (KJS::dateProtoFuncToUTCString):
+        (KJS::dateProtoFuncToDateString):
+        (KJS::dateProtoFuncToTimeString):
+        (KJS::dateProtoFuncToLocaleString):
+        (KJS::dateProtoFuncToLocaleDateString):
+        (KJS::dateProtoFuncToLocaleTimeString):
+        (KJS::dateProtoFuncValueOf):
+        (KJS::dateProtoFuncGetTime):
+        (KJS::dateProtoFuncGetFullYear):
+        (KJS::dateProtoFuncGetUTCFullYear):
+        (KJS::dateProtoFuncToGMTString):
+        (KJS::dateProtoFuncGetMonth):
+        (KJS::dateProtoFuncGetUTCMonth):
+        (KJS::dateProtoFuncGetDate):
+        (KJS::dateProtoFuncGetUTCDate):
+        (KJS::dateProtoFuncGetDay):
+        (KJS::dateProtoFuncGetUTCDay):
+        (KJS::dateProtoFuncGetHours):
+        (KJS::dateProtoFuncGetUTCHours):
+        (KJS::dateProtoFuncGetMinutes):
+        (KJS::dateProtoFuncGetUTCMinutes):
+        (KJS::dateProtoFuncGetSeconds):
+        (KJS::dateProtoFuncGetUTCSeconds):
+        (KJS::dateProtoFuncGetMilliSeconds):
+        (KJS::dateProtoFuncGetUTCMilliseconds):
+        (KJS::dateProtoFuncGetTimezoneOffset):
+        (KJS::dateProtoFuncSetTime):
+        (KJS::dateProtoFuncSetMilliSeconds):
+        (KJS::dateProtoFuncSetUTCMilliseconds):
+        (KJS::dateProtoFuncSetSeconds):
+        (KJS::dateProtoFuncSetUTCSeconds):
+        (KJS::dateProtoFuncSetMinutes):
+        (KJS::dateProtoFuncSetUTCMinutes):
+        (KJS::dateProtoFuncSetHours):
+        (KJS::dateProtoFuncSetUTCHours):
+        (KJS::dateProtoFuncSetDate):
+        (KJS::dateProtoFuncSetUTCDate):
+        (KJS::dateProtoFuncSetMonth):
+        (KJS::dateProtoFuncSetUTCMonth):
+        (KJS::dateProtoFuncSetFullYear):
+        (KJS::dateProtoFuncSetUTCFullYear):
+        (KJS::dateProtoFuncSetYear):
+        (KJS::dateProtoFuncGetYear):
+        * kjs/date_object.h:
+        * kjs/function.cpp:
+        (KJS::PrototypeFunction::PrototypeFunction):
+        (KJS::PrototypeFunction::callAsFunction):
+        * kjs/function.h:
+        * kjs/lookup.h:
+        (KJS::HashEntry::):
+        (KJS::staticFunctionGetter):
+        * kjs/math_object.cpp:
+        (KJS::mathProtoFuncAbs):
+        (KJS::mathProtoFuncACos):
+        (KJS::mathProtoFuncASin):
+        (KJS::mathProtoFuncATan):
+        (KJS::mathProtoFuncATan2):
+        (KJS::mathProtoFuncCeil):
+        (KJS::mathProtoFuncCos):
+        (KJS::mathProtoFuncExp):
+        (KJS::mathProtoFuncFloor):
+        (KJS::mathProtoFuncLog):
+        (KJS::mathProtoFuncMax):
+        (KJS::mathProtoFuncMin):
+        (KJS::mathProtoFuncPow):
+        (KJS::mathProtoFuncRandom):
+        (KJS::mathProtoFuncRound):
+        (KJS::mathProtoFuncSin):
+        (KJS::mathProtoFuncSqrt):
+        (KJS::mathProtoFuncTan):
+        * kjs/math_object.h:
+        * kjs/string_object.cpp:
+        (KJS::stringProtoFuncToString):
+        (KJS::stringProtoFuncValueOf):
+        (KJS::stringProtoFuncCharAt):
+        (KJS::stringProtoFuncCharCodeAt):
+        (KJS::stringProtoFuncConcat):
+        (KJS::stringProtoFuncIndexOf):
+        (KJS::stringProtoFuncLastIndexOf):
+        (KJS::stringProtoFuncMatch):
+        (KJS::stringProtoFuncSearch):
+        (KJS::stringProtoFuncReplace):
+        (KJS::stringProtoFuncSlice):
+        (KJS::stringProtoFuncSplit):
+        (KJS::stringProtoFuncSubstr):
+        (KJS::stringProtoFuncSubstring):
+        (KJS::stringProtoFuncToLowerCase):
+        (KJS::stringProtoFuncToUpperCase):
+        (KJS::stringProtoFuncToLocaleLowerCase):
+        (KJS::stringProtoFuncToLocaleUpperCase):
+        (KJS::stringProtoFuncLocaleCompare):
+        (KJS::stringProtoFuncBig):
+        (KJS::stringProtoFuncSmall):
+        (KJS::stringProtoFuncBlink):
+        (KJS::stringProtoFuncBold):
+        (KJS::stringProtoFuncFixed):
+        (KJS::stringProtoFuncItalics):
+        (KJS::stringProtoFuncStrike):
+        (KJS::stringProtoFuncSub):
+        (KJS::stringProtoFuncSup):
+        (KJS::stringProtoFuncFontcolor):
+        (KJS::stringProtoFuncFontsize):
+        (KJS::stringProtoFuncAnchor):
+        (KJS::stringProtoFuncLink):
+        * kjs/string_object.h:
+
+2008-01-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+        
+        Some tweaks to our headerdoc, suggested by David Gatwood on the docs
+        team.
+
+        * API/JSBase.h:
+        * API/JSObjectRef.h:
+        * API/JSStringRef.h:
+        * API/JSValueRef.h:
+
+2008-01-15  Alp Toker  <alp@atoker.com>
+
+        Rubber-stamped by Anders.
+
+        Make the HTTP backend configurable in the GTK+ port. curl is currently
+        the only option.
+
+        * wtf/Platform.h: Don't hard-code WTF_USE_CURL for GTK
+
+2008-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Remove unneeded variable.
+
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFuncSubstr::callAsFunction):
+
+2008-01-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Use shared vsprops for most vcproj properties.
+        
+        Reviewed by Darin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add missing Debug_Internal config.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add missing Debug_Internal config.
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2008-01-14  Adam Roben  <aroben@apple.com>
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        some headers that were missing from the vcproj so their contents will
+        be included in Find in Files.
+
+2008-01-14  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 16871: Crash when loading apple.com/startpage
+
+        <http://bugs.webkit.org/show_bug.cgi?id=16871>
+        <rdar://problem/5686670>
+
+        Patch written by Darin, reviewed by me.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::mark): Call ActivationImp::markChildren if our
+        m_activation is on the stack. This is what ScopeChain::mark also does,
+        but apparently in some cases it's possible for an ExecState's
+        ActivationImp to not be in any ScopeChain.
+
+2008-01-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver.
+
+        -<rdar://problem/5622667> REGRESSION (Leopard-ToT): Endless loading loop
+        trying to view techreport.com comments
+        - We need to set values in the map, because if they are already in the
+        map they will not be reset when we use add().
+
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::put):
+
+2008-01-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam.
+
+        - re-speed-up the page load test (my StringImpl change slowed it down)
+
+        * wtf/RefCounted.h:
+        (WTF::RefCounted::RefCounted): Allow derived classes to start with a reference
+        count other than 0. Eventually everyone will want to start with a 1. This is a
+        staged change. For now, there's a default of 0, and you can specify 1. Later,
+        there will be no default and everyone will have to specify. And then later, there
+        will be a default of 1. Eventually, we can take away even the option of starting
+        with 0!
+
+        * wtf/Vector.h:
+        (WTF::Vector::Vector): Sped up creation of non-empty vectors by removing the
+        overhead of first constructing something empty and then calling resize.
+        (WTF::Vector::clear): Sped up the common case of calling clear on an empty
+        vector by adding a check for that case.
+        (WTF::Vector::releaseBuffer): Marked this function inline and removed a branch
+        in the case of vectors with no inline capacity (normal vectors) by leaving out
+        the code to copy the inline buffer in that case.
+
+2008-01-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16787
+        array.splice() with 1 element not working
+
+        Test: fast/js/array-splice.html
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayProtoFuncSplice::callAsFunction): Implement this Mozilla extension, and fix
+        some other edge cases.
+
+2008-01-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Share common files across projects.
+        
+        Unify vsprops files
+        Debug:          common.vsprops, debug.vsprops
+        Debug_Internal: common.vsprops, debug.vsprops, debug_internal.vsprops
+        Release:        common.vsprops, release.vsprops
+        
+        Shared properties can go into common.vsprops, shared debug settings can go into debug.vsprops.
+        debug_internal.vsprops will be mostly empty except for file path prefix modifiers.
+
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/debug.vsprops: Removed.
+        * JavaScriptCore.vcproj/debug_internal.vsprops: Removed.
+        * JavaScriptCore.vcproj/release.vsprops: Removed.
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2008-01-13  Marius Bugge Monsen  <mbm@trolltech.com>
+
+        Contributions and review by Adriaan de Groot,
+        Simon Hausmann, Eric Seidel, and Darin Adler.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=16590
+          Compilation fixes for Solaris.
+
+        * kjs/DateMath.h:
+        (KJS::GregorianDateTime::GregorianDateTime): Use the WIN_OS code path
+        for SOLARIS too, presumably because Solaris also lacks the tm_gtoff and tm_zone
+        fields.
+        (KJS::GregorianDateTime::operator tm): Ditto.
+
+        * kjs/collector.cpp:
+        (KJS::currentThreadStackBase): Use thr_stksegment on Solaris.
+
+        * wtf/MathExtras.h:
+        (isfinite): Implement for Solaris.
+        (isinf): Ditto.
+        (signbit): Ditto. But this one is wrong, so I added a FIXME.
+
+        * wtf/Platform.h: Define PLATFORM(SOLARIS) when "sun" or "__sun" is defined.
+
+2008-01-13  Michael Goddard  <michael.goddard@trolltech.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add binding language type to Instance.
+        Allows runtime determination of the type of an
+        Instance, to allow safe casting.  Doesn't actually
+        add any safe casting yet, though.
+
+        Add a helper function to get an Instance from a JSObject*.
+        Given an object and the expected binding language, see if
+        the JSObject actually wraps an Instance of the given type
+        and return it.  Otherwise return 0.
+
+        Move RuntimeObjectImp creations into Instance.
+        Make the ctor protected, and Instance a friend class, so
+        that all creation of RuntimeObjectImps goes through
+        one place.
+
+        Remove copy ctor/assignment operator for QtInstance.
+        Instance itself is Noncopyable, so QtInstance doesn't
+        need to have these.
+
+        Add caching for QtInstance and associated RuntimeObjectImps.
+        Push any dealings with QtLanguage bindings into QtInstance,
+        and cache them there, rather than in the Instance layer.  Add
+        a QtRuntimeObjectImp to help with caching.
+
+        * JavaScriptCore.exp:
+        * bindings/c/c_instance.h:
+        * bindings/jni/jni_instance.h:
+        * bindings/objc/objc_instance.h:
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
+        (KJS::Bindings::QtRuntimeObjectImp::~QtRuntimeObjectImp):
+        (KJS::Bindings::QtRuntimeObjectImp::invalidate):
+        (KJS::Bindings::QtRuntimeObjectImp::removeFromCache):
+        (KJS::Bindings::QtInstance::QtInstance):
+        (KJS::Bindings::QtInstance::~QtInstance):
+        (KJS::Bindings::QtInstance::getQtInstance):
+        (KJS::Bindings::QtInstance::getRuntimeObject):
+        * bindings/qt/qt_instance.h:
+        (KJS::Bindings::QtInstance::getBindingLanguage):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createBindingForLanguageInstance):
+        (KJS::Bindings::Instance::createRuntimeObject):
+        (KJS::Bindings::Instance::getInstance):
+        * bindings/runtime.h:
+        * bindings/runtime_object.h:
+        (KJS::RuntimeObjectImp::getInternalInstance):
+
+2008-01-12  Alp Toker  <alp@atoker.com>
+
+        Reviewed by Mark Rowe.
+
+        Hide non-public symbols in GTK+/autotools release builds.
+
+        * GNUmakefile.am:
+
+2008-01-12  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Mark Rowe.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=16852
+        Fixes leaking of ActivationStackNode objects.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::deleteActivationStack):
+        (KJS::JSGlobalObject::~JSGlobalObject):
+        (KJS::JSGlobalObject::init):
+        (KJS::JSGlobalObject::reset):
+        * kjs/JSGlobalObject.h:
+
+2008-01-12  Darin Adler  <darin@apple.com>
+
+        - try to fix Qt Windows build
+
+        * pcre/dftables: Remove reliance on the list form of Perl pipes.
+
+2008-01-12  Darin Adler  <darin@apple.com>
+
+        - try to fix Qt build
+
+        * kjs/function.cpp: Added include of scope_chain_mark.h.
+        * kjs/scope_chain_mark.h: Added multiple-include guards.
+
+2008-01-12  Mark Rowe  <mrowe@apple.com>
+
+        Another Windows build fix.
+
+        * kjs/Activation.h:
+
+2008-01-12  Mark Rowe  <mrowe@apple.com>
+
+        Attempted Windows build fix.  Use struct consistently when forward-declaring
+        ActivationStackNode and StackActivation.
+
+        * kjs/Activation.h:
+        * kjs/JSGlobalObject.h:
+
+2008-01-12  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Fixes a problem with the ActivationImp tear-off patch (r29425) where
+        some of the calls to JSGlobalObject::tearOffActivation() were using
+        the wrong test to determine whether it should leave a relic behind.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::ActivationImp::getOwnPropertySlot):
+
+2008-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/5665251> REGRESSION (r28880-r28886): Global
+        variable access (16644)
+        
+        This bug was caused by var declarations shadowing built-in properties of
+        the global object.
+        
+        To match Firefox, we've decided that var declarations will never shadow
+        built-in properties of the global object or its prototypes. We used to
+        behave more like IE, which allows shadowing, but walking that line got
+        us into trouble with websites that sent us down the Firefox codepath.
+
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableGet): New code to support calling
+        hasProperty before the variable object is fully initialized (so you
+        can call it during initialization).
+
+        * kjs/nodes.cpp:.
+        (KJS::ProgramNode::initializeSymbolTable): Always do a full hasProperty
+        check when looking for duplicates, not getDirect, since it only checks
+        the property map, and not hasOwnProperty, since it doesn't check
+        prototypes.
+        (KJS::EvalNode::processDeclarations): ditto
+
+        * kjs/property_slot.h:
+        (KJS::PropertySlot::ungettableGetter): Best function name evar.
+
+2008-01-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Optimized ActivationImp allocation, so that activation records are now
+        first allocated on an explicitly managed stack and only heap allocated
+        when necessary. Roughly a 5% improvement on SunSpider, and a larger
+        improvement on benchmarks that use more function calls.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/Activation.h: Added.
+        (KJS::ActivationImp::ActivationData::ActivationData):
+        (KJS::ActivationImp::ActivationImp):
+        (KJS::ActivationImp::classInfo):
+        (KJS::ActivationImp::isActivationObject):
+        (KJS::ActivationImp::isOnStack):
+        (KJS::ActivationImp::d):
+        (KJS::StackActivation::StackActivation):
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        (KJS::ExecState::~ExecState):
+        * kjs/ExecState.h:
+        (KJS::ExecState::replaceScopeChainTop):
+        (KJS::ExecState::setActivationObject):
+        (KJS::ExecState::setLocalStorage):
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        (KJS::JSGlobalObject::pushActivation):
+        (KJS::JSGlobalObject::checkActivationCount):
+        (KJS::JSGlobalObject::popActivationHelper):
+        (KJS::JSGlobalObject::popActivation):
+        (KJS::JSGlobalObject::tearOffActivation):
+        * kjs/JSGlobalObject.h:
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::JSVariableObjectData::JSVariableObjectData):
+        (KJS::JSVariableObject::JSVariableObject):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::ActivationImp::ActivationImp):
+        (KJS::ActivationImp::~ActivationImp):
+        (KJS::ActivationImp::init):
+        (KJS::ActivationImp::getOwnPropertySlot):
+        (KJS::ActivationImp::markHelper):
+        (KJS::ActivationImp::mark):
+        (KJS::ActivationImp::ActivationData::ActivationData):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function.h:
+        * kjs/nodes.cpp:
+        (KJS::PostIncResolveNode::evaluate):
+        (KJS::PostDecResolveNode::evaluate):
+        (KJS::PreIncResolveNode::evaluate):
+        (KJS::PreDecResolveNode::evaluate):
+        (KJS::ReadModifyResolveNode::evaluate):
+        (KJS::AssignResolveNode::evaluate):
+        (KJS::WithNode::execute):
+        (KJS::TryNode::execute):
+        (KJS::FunctionBodyNode::processDeclarations):
+        (KJS::FuncExprNode::evaluate):
+        * kjs/object.h:
+        * kjs/scope_chain.h:
+        (KJS::ScopeChain::replace):
+        * kjs/scope_chain_mark.h: Added.
+        (KJS::ScopeChain::mark):
+
+2008-01-11  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix the (clean) qmake build. For generating chartables.c we don't
+        depend on a separate input source file anymore, the dftables perl
+        script is enough. So use that instead as value for the .input
+        variable, to ensure that qmake also generates a rule to call dftables.
+
+        * pcre/pcre.pri:
+
+2008-01-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed some world leak reports:
+        * <rdar://problem/5669436> PLT complains about world leak of 1 JavaScript
+        Interpreter after running cvs-base suite
+
+        * <rdar://problem/5669423> PLT complains about world leak if browser
+        window is open when PLT starts
+        
+        * kjs/collector.h: Added the ability to distinguish between global
+        objects and GC-protected global objects, since we only consider the
+        latter to be world leaks.
+        * kjs/collector.cpp:
+
+2008-01-11  Mark Rowe  <mrowe@apple.com>
+
+        Silence qmake warning about ctgen lacking input.
+
+        Rubber-stamped by Alp Toker.
+
+        * pcre/pcre.pri:
+
+2008-01-10  David Kilzer  <ddkilzer@apple.com>
+
+        dftables should be rewritten as a script
+
+        <http://bugs.webkit.org/show_bug.cgi?id=16818>
+        <rdar://problem/5681463>
+
+        Reviewed by Darin.
+
+        Rewrote the dftables utility in Perl.  Attempted to switch all
+        build systems to call the script directly instead of building
+        a binary first.  Only the Xcode build was able to be tested.
+
+        * DerivedSources.make: Added pcre directory to VPATH and changed
+        to invoke dftables directly.
+        * GNUmakefile.am: Removed build information and changed to invoke
+        dftables directly.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Removed reference to
+        dftables project.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Ditto.
+        * JavaScriptCore.vcproj/dftables: Removed.
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed dftables target.
+        * jscore.bkl: Removed dftables executable definition.
+        * pcre/dftables: Copied from JavaScriptCore/pcre/dftables.cpp.
+        * pcre/dftables.cpp: Removed.
+        * pcre/dftables.pro: Removed.
+        * pcre/pcre.pri: Removed references to dftables.cpp and changed to
+        invoke dftables directly.
+
+2008-01-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16782
+          <rdar://problem/5675331> REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html
+
+        The crash resulted from a native object (DumpRenderTree's
+        EventSender) causing its wrapper to be invalidated (by clicking a
+        link that replaced the document in the window) and consequently
+        deallocated. The fix is to use RefPtrs to protect the native object
+        from deletion by self-invalidation.
+
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::callAsFunction):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::fallbackObjectGetter):
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::methodGetter):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::defaultValue):
+        (RuntimeObjectImp::callAsFunction):
+
+2008-01-07  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Turn testIsInteger assertions into compile-time asserts and move them into HashTraits.h
+        where possible.
+
+        * kjs/testkjs.cpp:
+        * wtf/HashTraits.h:
+
+2008-01-07  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Mark.
+
+        Enable SVG_FONTS by default.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-01-07  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by David Kilzer.
+
+        - get rid of empty fpconst.cpp
+
+        * GNUmakefile.am: Remove fpconst.cpp.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+
+        * kjs/fpconst.cpp: Removed.
+
+2008-01-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Kilzer.
+
+        - fix alignment problem with NaN and Inf globals
+
+        * kjs/fpconst.cpp: Move the contents of this file from here back to
+        value.cpp. The reason this was in a separate file is that the DARWIN
+        version of this used a declaration of the globals with a different
+        type to avoid creating "init routines". That's no longer necessary for
+        DARWIN and was never necessary for the non-DARWIN code path.
+        To make this patch easy to merge, I didn't actually delete this file
+        yet. We'll do that in a separate changeset.
+
+        * kjs/value.cpp: If C99's NAN and INFINITY are present, then use them,
+        othrewise use the union trick from fpconst.cpp. I think it would be
+        better to eliminate KJS::NaN and KJS::Inf and just use NAN and INFINITY
+        directly or std::numeric_limits<double>::quiet_nan() and
+        std::numeric_limits<double>::infinity(). But when I tried that, it
+        slowed down SunSpider. Someone else could do that cleanup if they
+        could do it without slowing down the engine.
+
+2008-01-07  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        JavaScript.h to the project.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Copy JavaScript.h to WEBKITOUTPUTDIR.
+
+2008-01-07  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin.
+
+        Fix Mac build.
+
+        * API/JSNode.c:
+        * API/JSNode.h:
+        * API/JSNodeList.c:
+        * API/JSNodeList.h:
+        * API/JavaScript.h:
+        * API/JavaScriptCore.h:
+        * API/minidom.c:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-01-07  Alp Toker  <alp@atoker.com>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16029
+        JavaScriptCore.h is not suitable for platforms other than Mac OS X
+
+        Introduce a new JavaScriptCore/JavaScript.h public API header. This
+        should be used by all new portable code using the JavaScriptCore API.
+
+        JavaScriptCore/JavaScriptCore.h will remain for compatibility with
+        existing applications that depend on it including JSStringRefCF.h
+        which isn't portable.
+
+        Also add minidom to the GTK+/autotools build since we can now support
+        it on all platforms.
+
+        * API/JSNode.h:
+        * API/JSNodeList.h:
+        * API/JavaScript.h: Added.
+        * API/JavaScriptCore.h:
+        * ForwardingHeaders/JavaScriptCore/JavaScript.h: Added.
+        * GNUmakefile.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-01-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Abstract all DateObject.set* functions in preparation for fixing:
+        http://bugs.webkit.org/show_bug.cgi?id=16753
+        
+        SunSpider had random changes here and there but was overall a wash.
+
+        * kjs/date_object.cpp:
+        (KJS::fillStructuresUsingTimeArgs):
+        (KJS::setNewValueFromTimeArgs):
+        (KJS::setNewValueFromDateArgs):
+        (KJS::DateProtoFuncSetMilliSeconds::callAsFunction):
+        (KJS::DateProtoFuncSetUTCMilliseconds::callAsFunction):
+        (KJS::DateProtoFuncSetSeconds::callAsFunction):
+        (KJS::DateProtoFuncSetUTCSeconds::callAsFunction):
+        (KJS::DateProtoFuncSetMinutes::callAsFunction):
+        (KJS::DateProtoFuncSetUTCMinutes::callAsFunction):
+        (KJS::DateProtoFuncSetHours::callAsFunction):
+        (KJS::DateProtoFuncSetUTCHours::callAsFunction):
+        (KJS::DateProtoFuncSetDate::callAsFunction):
+        (KJS::DateProtoFuncSetUTCDate::callAsFunction):
+        (KJS::DateProtoFuncSetMonth::callAsFunction):
+        (KJS::DateProtoFuncSetUTCMonth::callAsFunction):
+        (KJS::DateProtoFuncSetFullYear::callAsFunction):
+        (KJS::DateProtoFuncSetUTCFullYear::callAsFunction):
+
+2008-01-06  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Dan.
+
+        Add new helper function isArabicChar - SVG Fonts support needs it.
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isArabicChar):
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::isArabicChar):
+
+2008-01-06  Alp Toker  <alp@atoker.com>
+
+        Reviewed by Mark Rowe.
+
+        Use $(EXEEXT) to account for the .exe extension in the GTK+ Windows
+        build. (This is already done correctly in DerivedSources.make.) Issue
+        noticed by Mikkel when building in Cygwin.
+
+        Add a missing slash. This was a hack from the qmake build system that
+        isn't necessary with autotools.
+
+        * GNUmakefile.am:
+
+2008-01-05  Darin Adler  <darin@apple.com>
+
+        * API/JSRetainPtr.h: One more file that needed the change below.
+
+2008-01-05  Darin Adler  <darin@apple.com>
+
+        * wtf/OwnPtr.h: OwnPtr needs the same fix as RefPtr below.
+
+2008-01-05  Adam Roben  <aroben@apple.com>
+
+        Build fix.
+
+        Reviewed by Maciej.
+
+        * wtf/RetainPtr.h: Use PtrType instead of T* because of the
+        RemovePointer magic.
+
+2008-01-05  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Maciej Stachowiak.
+
+        - cut down own PIC branches by using a pointer-to-member-data instead of a
+          pointer-to-member-function in WTF smart pointers
+
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/PassRefPtr.h:
+        * wtf/RefPtr.h:
+        * wtf/RetainPtr.h:
+        Use a pointer to the m_ptr member instead of the get member.
+        The GCC compiler generates better code for this idiom.
+
+2008-01-05  Henry Mason  <hmason@mac.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16738
+        Bug 16738: Collector block offset could be stored as an cell offset instead of a byte offset
+
+        Gives a 0.4% SunSpider boost and prettier code.
+
+        * kjs/collector.cpp: Switched to cell offsets from byte offsets
+        (KJS::Collector::heapAllocate):
+        (KJS::Collector::sweep):
+
+2008-01-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Have the two malloc zones print useful diagnostics if their free method are unexpectedly invoked.
+        Due to <rdar://problem/5671357> this can happen if an application attempts to free a pointer that
+        was not allocated by any registered malloc zone on the system.
+
+        * kjs/CollectorHeapIntrospector.h:
+        * wtf/FastMalloc.cpp:
+
+2008-01-04  Alp Toker  <alp@atoker.com>
+
+        GTK+ autotools build fix. Terminate empty rules.
+
+        * GNUmakefile.am:
+
+2008-01-03  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix compilation with gcc 4.3: limits.h is needed for INT_MAX.
+
+        * pcre/pcre_exec.cpp:
+
+2008-01-03  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/expected.html: The fix for bug 16696 also fixed a test
+        case, ecma_3/RegExp/perlstress-002.js, so updated results to expect
+        that test to succeed.
+
+2008-01-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16696
+          JSCRE fails fails to match Acid3 regexp
+
+        Test: fast/regex/early-acid3-86.html
+
+        The problem was with the cutoff point between backreferences and octal
+        escape sequences. We need to determine the cutoff point by counting the
+        total number of capturing brackets, which requires an extra pass through
+        the expression when compiling it.
+
+        * pcre/pcre_compile.cpp:
+        (CompileData::CompileData): Added numCapturingBrackets. Removed some
+        unused fields.
+        (compileBranch): Use numCapturingBrackets when calling checkEscape.
+        (calculateCompiledPatternLength): Use numCapturingBrackets when calling
+        checkEscape, and also store the bracket count at the end of the compile.
+        (jsRegExpCompile): Call calculateCompiledPatternLength twice -- once to
+        count the number of brackets and then a second time to calculate the length.
+
+2008-01-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16696
+          JSCRE fails fails to match Acid3 regexp
+
+        Test: fast/regex/early-acid3-86.html
+
+        The problem was with the cutoff point between backreferences and octal
+        escape sequences. We need to determine the cutoff point by counting the
+        total number of capturing brackets, which requires an extra pass through
+        the expression when compiling it.
+
+        * pcre/pcre_compile.cpp:
+        (CompileData::CompileData): Added numCapturingBrackets. Removed some
+        unused fields.
+        (compileBranch): Use numCapturingBrackets when calling checkEscape.
+        (calculateCompiledPatternLength): Use numCapturingBrackets when calling
+        checkEscape, and also store the bracket count at the end of the compile.
+        (jsRegExpCompile): Call calculateCompiledPatternLength twice -- once to
+        count the number of brackets and then a second time to calculate the length.
+
+2008-01-02  David Kilzer <ddkilzer@webkit.org>
+
+        Reviewed and landed by Darin.
+
+        * kjs/nodes.cpp:
+        (KJS::DoWhileNode::execute): Added a missing return.
+
+2008-01-02  Darin Adler  <darin@apple.com>
+
+        - try to fix Qt build
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::foldCase): Add some missing const.
+
+2008-01-02  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        need to export ASCIICType.h for use in DRT
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIUpper):
+
+2008-01-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Cleanup error_object.h/cpp.
+
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::reset):
+        * kjs/error_object.cpp:
+        (KJS::ErrorInstance::ErrorInstance):
+        (KJS::ErrorPrototype::ErrorPrototype):
+        (KJS::ErrorProtoFuncToString::ErrorProtoFuncToString):
+        (KJS::ErrorProtoFuncToString::callAsFunction):
+        (KJS::ErrorObjectImp::ErrorObjectImp):
+        (KJS::ErrorObjectImp::implementsConstruct):
+        (KJS::ErrorObjectImp::construct):
+        (KJS::ErrorObjectImp::callAsFunction):
+        (KJS::NativeErrorPrototype::NativeErrorPrototype):
+        (KJS::NativeErrorImp::NativeErrorImp):
+        (KJS::NativeErrorImp::implementsConstruct):
+        (KJS::NativeErrorImp::construct):
+        (KJS::NativeErrorImp::callAsFunction):
+        (KJS::NativeErrorImp::mark):
+        * kjs/error_object.h:
+        (KJS::ErrorInstance::classInfo):
+        (KJS::NativeErrorImp::classInfo):
+
+2008-01-02  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Alp Toker.
+
+        * GNUmakefile.am: Add missing dependency on grammar.y.
+
+2008-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - fix for http://bugs.webkit.org/show_bug.cgi?id=16695
+          JSC allows non-identifier codepoints in identifiers (affects Acid3)
+
+        Test: fast/js/kde/parse.html
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::lex): Added additional states to distinguish Unicode escapes at the
+        start of identifiers from ones inside identifiers. Rejected characters that don't pass
+        the isIdentStart and isIdentPart tests.
+        (KJS::Lexer::convertUnicode): Removed incorrect FIXME comment.
+
+        * kjs/lexer.h: Added new states to distinguish \u escapes at the start of identifiers
+        from \u escapes inside identifiers.
+
+2008-01-01  Darin Adler  <darin@apple.com>
+
+        - rolled scope chain optimization out; it was breaking the world
+
+2008-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=16685
+          eliminate List::empty() to cut down on PIC branches
+
+        Also included one other speed-up -- remove the call to reserveCapacity from
+        FunctionBodyNode::processDeclarations in all but the most unusual cases.
+
+        Together these make SunSpider 1.016x as fast.
+
+        * JavaScriptCore.exp: Updated.
+        * kjs/ExecState.cpp:
+        (KJS::globalEmptyList): Added. Called only when creating global ExecState
+        instances.
+        (KJS::ExecState::ExecState): Broke constructor up into three separate functions,
+        for the three separate node types. Also went through each of the three and
+        streamlined as much as possible, removing dead code. This prevents us from having
+        to access the global in the function body version of the constructor.
+
+        * kjs/ExecState.h: Added emptyList(). Replaced the constructor with a set of
+        three that are specific to the different node types that can create new execution
+        state objects.
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayProtoFuncToLocaleString::callAsFunction): Use exec->emptyList() instead
+        of List::empty().
+        (KJS::ArrayProtoFuncConcat::callAsFunction): Ditto.
+        (KJS::ArrayProtoFuncSlice::callAsFunction): Ditto.
+        (KJS::ArrayProtoFuncSplice::callAsFunction): Ditto.
+        (KJS::ArrayProtoFuncFilter::callAsFunction): Ditto.
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction): Updated to call new ExecState constructor.
+        (KJS::GlobalFuncImp::callAsFunction): Ditto (for eval).
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct): Use exec->emptyList() instead of List::empty().
+
+        * kjs/list.cpp: Removed List::empty.
+        * kjs/list.h: Ditto.
+
+        * kjs/nodes.cpp:
+        (KJS::ElementNode::evaluate): Use exec->emptyList() instead of List::empty().
+        (KJS::ArrayNode::evaluate): Ditto.
+        (KJS::ObjectLiteralNode::evaluate): Ditto.
+        (KJS::PropertyListNode::evaluate): Ditto.
+        (KJS::FunctionBodyNode::processDeclarations): Another speed-up. Check the capacity
+        before calling reserveCapacity, because it doesn't get inlined the local storage
+        vector is almost always big enough -- saving the function call overhead is a big
+        deal.
+        (KJS::FuncDeclNode::makeFunction): Use exec->emptyList() instead of List::empty().
+        (KJS::FuncExprNode::evaluate): Ditto.
+        * kjs/object.cpp:
+        (KJS::tryGetAndCallProperty): Ditto.
+        * kjs/property_slot.cpp:
+        (KJS::PropertySlot::functionGetter): Ditto.
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFuncSplit::callAsFunction): Ditto.
+
+2008-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16648
+          REGRESSION (r28165): Yuku.com navigation prints "jsRegExpExecute failed with result -2"
+          <rdar://problem/5646486> REGRESSION (r28165): Layout test fast/regex/test1 fails intermittently
+
+        Fixes 34 failing test cases in the fast/regex/test1.html test.
+
+        Restored the stack which prevents infinite loops for brackets that match the empty
+        string; it had been removed as an optimization.
+
+        Unfortunately, restoring this stack causes the regular expression test in SunSpider
+        to be 1.095x as slow and the overall test to be 1.004x as slow. Maybe we can find
+        a correct optimization to restore the speed!
+
+        It's possible the original change was on the right track but just off by one.
+
+        * pcre/pcre_exec.cpp: Add back eptrblock, but name it BracketChainNode.
+        (MatchStack::pushNewFrame): Add back the logic needed here.
+        (startNewGroup): Ditto.
+        (match): Ditto.
+
+2008-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=16683
+          speed up function calls by making ScopeChain::push cheaper
+
+        This gives a 1.019x speedup on SunSpider.
+
+        After doing this, I realized this probably will be obsolete when the optimization
+        to avoid creating an activation object is done. When we do that one we should check
+        if rolling this out will speed things up, since this does add overhead at the time
+        you copy the scope chain.
+
+        * kjs/object.h: Removed the ScopeChain::release function. It was
+        marked inline, and called in exactly one place, so moved it there.
+        No idea why it was in this header file!
+
+        * kjs/scope_chain.cpp: Removed the overload of the ScopeChain::push
+        function that takes another ScopeChain. It was unused. I think we used
+        it over in WebCore at one point, but not any more.
+
+        * kjs/scope_chain.h: Changed ScopeChainNode into a struct rather than
+        a class, got rid of its constructor so we can have one that's uninitialized,
+        and moved the refCount into a derived struct, ScopeChainHeapNode. Made _node
+        mutable so it can be changed in the moveToHeap function. Changed the copy
+        constructor and assignment operator to call moveToHeap, since the top node
+        can't be shared when it's embedded in another ScopeChain object. Updated
+        functions as needed to handle the case where the first object isn't on the
+        heap or to add casts for cases where it's guaranteed to be. Changed the push
+        function to always put the new node into the ScopeChain object; it will get
+        put onto the heap when needed later.
+
+2008-01-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed slight logic error in reserveCapacity, where we would reallocate
+        the storage buffer unnecessarily.
+
+        * wtf/Vector.h:
+        (WTF::::reserveCapacity): No need to grow the buffer if newCapacity is
+        equal to capacity().
+
+2008-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=16684
+          eliminate debugger overhead from function body execution
+
+        Speeds SunSpider up 1.003x. That's a small amount, but measurable.
+
+        * JavaScriptCore.exp: Updated.
+        * kjs/Parser.h:
+        (KJS::Parser::parse): Create the node with a static member function named create() instead
+        of using new explicitly.
+
+        * kjs/grammar.y: Changed calls to new FunctionBodyNode to use FunctionBodyNode::create().
+
+        * kjs/nodes.cpp:
+        (KJS::ProgramNode::create): Added. Calls new.
+        (KJS::EvalNode::create): Ditto.
+        (KJS::FunctionBodyNode::create): Ditto, but creates FunctionBodyNodeWithDebuggerHooks
+        when a debugger is present.
+        (KJS::FunctionBodyNode::execute): Removed debugger hooks.
+        (KJS::FunctionBodyNodeWithDebuggerHooks::FunctionBodyNodeWithDebuggerHooks): Added.
+        (KJS::FunctionBodyNodeWithDebuggerHooks::execute): Calls the debugger, then the code,
+        then the debugger again.
+
+        * kjs/nodes.h: Added create functions, made the constructors private and protected.
+
+2007-12-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        More small cleanup to array_object.cpp
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayProtoFuncToString::callAsFunction):
+        (KJS::ArrayProtoFuncToLocaleString::callAsFunction):
+        (KJS::ArrayProtoFuncJoin::callAsFunction):
+        (KJS::ArrayProtoFuncConcat::callAsFunction):
+        (KJS::ArrayProtoFuncReverse::callAsFunction):
+        (KJS::ArrayProtoFuncShift::callAsFunction):
+        (KJS::ArrayProtoFuncSlice::callAsFunction):
+        (KJS::ArrayProtoFuncSort::callAsFunction):
+        (KJS::ArrayProtoFuncSplice::callAsFunction):
+        (KJS::ArrayProtoFuncUnShift::callAsFunction):
+        (KJS::ArrayProtoFuncFilter::callAsFunction):
+        (KJS::ArrayProtoFuncMap::callAsFunction):
+        (KJS::ArrayProtoFuncEvery::callAsFunction):
+
+2007-12-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Apply wkstyle to array_object.cpp
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayPrototype::ArrayPrototype):
+        (KJS::ArrayPrototype::getOwnPropertySlot):
+        (KJS::ArrayProtoFuncConcat::callAsFunction):
+        (KJS::ArrayProtoFuncPop::callAsFunction):
+        (KJS::ArrayProtoFuncReverse::callAsFunction):
+        (KJS::ArrayProtoFuncShift::callAsFunction):
+        (KJS::ArrayProtoFuncSlice::callAsFunction):
+        (KJS::ArrayProtoFuncSort::callAsFunction):
+        (KJS::ArrayProtoFuncSplice::callAsFunction):
+        (KJS::ArrayProtoFuncUnShift::callAsFunction):
+        (KJS::ArrayProtoFuncFilter::callAsFunction):
+        (KJS::ArrayProtoFuncMap::callAsFunction):
+        (KJS::ArrayProtoFuncEvery::callAsFunction):
+        (KJS::ArrayProtoFuncLastIndexOf::callAsFunction):
+        (KJS::ArrayObjectImp::ArrayObjectImp):
+        (KJS::ArrayObjectImp::implementsConstruct):
+        (KJS::ArrayObjectImp::construct):
+        (KJS::ArrayObjectImp::callAsFunction):
+
+2007-12-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Remove maxInt/minInt, replacing with std:max/min<int>()
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayProtoFuncSplice::callAsFunction):
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+
+2007-12-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+        
+        Update Number.toString to properly throw exceptions.
+        Cleanup code in Number.toString implementation.
+
+        * kjs/number_object.cpp:
+        (KJS::numberToString):
+        * kjs/object.cpp:
+        (KJS::Error::create): Remove bogus debug lines.
+
+2007-12-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver.
+
+        ASSERT when debugging via Drosera due to missed var lookup optimization.
+        http://bugs.webkit.org/show_bug.cgi?id=16634
+        
+        No test case possible.
+
+        * kjs/nodes.cpp:
+        (KJS::BreakpointCheckStatement::optimizeVariableAccess):
+        * kjs/nodes.h:
+
+2007-12-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver.
+
+        Fix (-0).toFixed() and re-factor a little
+        Fix (-0).toExponential() and printing of trailing 0s in toExponential
+        Fix toPrecision(nan) handling
+        http://bugs.webkit.org/show_bug.cgi?id=16640
+
+        * kjs/number_object.cpp:
+        (KJS::numberToFixed):
+        (KJS::fractionalPartToString):
+        (KJS::numberToExponential):
+        (KJS::numberToPrecision):
+
+2007-12-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        More changes to make number code readable
+
+        * kjs/number_object.cpp:
+        (KJS::integer_part_noexp):
+        (KJS::numberToFixed):
+        (KJS::numberToExponential):
+
+2007-12-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        More small cleanups to toPrecision
+
+        * kjs/number_object.cpp:
+        (KJS::numberToPrecision):
+
+2007-12-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        More small attempts to make number code readable
+
+        * kjs/number_object.cpp:
+        (KJS::exponentialPartToString):
+        (KJS::numberToExponential):
+        (KJS::numberToPrecision):
+
+2007-12-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Break out callAsFunction implementations into static functions
+
+        * kjs/number_object.cpp:
+        (KJS::numberToString):
+        (KJS::numberToFixed):
+        (KJS::numberToExponential):
+        (KJS::numberToPrecision):
+        (KJS::NumberProtoFunc::callAsFunction):
+
+2007-12-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Apply wkstyle/astyle and fix placement of *
+
+        * kjs/number_object.cpp:
+        (KJS::NumberInstance::NumberInstance):
+        (KJS::NumberPrototype::NumberPrototype):
+        (KJS::NumberProtoFunc::NumberProtoFunc):
+        (KJS::integer_part_noexp):
+        (KJS::intPow10):
+        (KJS::NumberProtoFunc::callAsFunction):
+        (KJS::NumberObjectImp::NumberObjectImp):
+        (KJS::NumberObjectImp::getOwnPropertySlot):
+        (KJS::NumberObjectImp::getValueProperty):
+        (KJS::NumberObjectImp::implementsConstruct):
+        (KJS::NumberObjectImp::construct):
+        (KJS::NumberObjectImp::callAsFunction):
+        * kjs/object.cpp:
+        (KJS::JSObject::put):
+
+2007-12-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        ASSERT in JavaScriptCore while viewing WICD test case
+        http://bugs.webkit.org/show_bug.cgi?id=16626
+        
+        * kjs/nodes.cpp:
+        (KJS::ForInNode::execute): move KJS_CHECK_EXCEPTION to proper place
+
+2007-12-26  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
+
+        Reviewed by Alp Toker.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16390
+        Use autotools or GNU make as the build system for the GTK port
+
+        * GNUmakefile.am: Added.
+
+2007-12-25  Maciej Stachowiak  <mjs@apple.com>
+        
+        Reviewed by Oliver.
+                
+        - Remove unnecessary redundant check from property setting
+        http://bugs.webkit.org/show_bug.cgi?id=16602
+                
+        1.3% speedup on SunSpider.
+        
+        * kjs/object.cpp:
+        (KJS::JSObject::put): Don't do canPut check when not needed; let
+        the PropertyMap handle it.        
+        (KJS::JSObject::canPut): Don't check the static property
+        table. lookupPut does that already.
+        
+2007-12-24  Alp Toker  <alp@atoker.com>
+
+        Fix builds that don't use AllInOneFile.cpp following breakage
+        introduced in r28973.
+
+        * kjs/grammar.y:
+
+2007-12-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+
+        - Optimize variable declarations
+        http://bugs.webkit.org/show_bug.cgi?id=16585
+        
+        3.5% speedup on SunSpider.
+
+        var statements now result in either assignments or empty statements.
+        
+        This allows a couple of optimization opportunities:
+        - No need to branch at runtime to check if there is an initializer
+        - EmptyStatementNodes can be removed entirely (also done in this patch)
+        - Assignment expressions get properly optimized for local variables
+        
+        This patch also includes some code cleanup:
+        - Most of the old VarStatement/VarDecl logic is now only used for const declarations, 
+          thus it is renamed appropriately
+        - AssignExprNode is gone
+        
+        * JavaScriptCore.exp:
+        * kjs/NodeInfo.h:
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::SourceElements::append):
+        (KJS::ConstDeclNode::ConstDeclNode):
+        (KJS::ConstDeclNode::optimizeVariableAccess):
+        (KJS::ConstDeclNode::handleSlowCase):
+        (KJS::ConstDeclNode::evaluateSingle):
+        (KJS::ConstDeclNode::evaluate):
+        (KJS::ConstStatementNode::optimizeVariableAccess):
+        (KJS::ConstStatementNode::execute):
+        (KJS::VarStatementNode::optimizeVariableAccess):
+        (KJS::VarStatementNode::execute):
+        (KJS::ForInNode::ForInNode):
+        (KJS::ForInNode::optimizeVariableAccess):
+        (KJS::ForInNode::execute):
+        (KJS::FunctionBodyNode::initializeSymbolTable):
+        (KJS::ProgramNode::initializeSymbolTable):
+        (KJS::FunctionBodyNode::processDeclarations):
+        (KJS::ProgramNode::processDeclarations):
+        (KJS::EvalNode::processDeclarations):
+        * kjs/nodes.h:
+        (KJS::DeclarationStacks::):
+        (KJS::StatementNode::):
+        (KJS::ConstDeclNode::):
+        (KJS::ConstStatementNode::):
+        (KJS::EmptyStatementNode::):
+        (KJS::VarStatementNode::):
+        (KJS::ForNode::):
+        * kjs/nodes2string.cpp:
+        (KJS::ConstDeclNode::streamTo):
+        (KJS::ConstStatementNode::streamTo):
+        (KJS::ScopeNode::streamTo):
+        (KJS::VarStatementNode::streamTo):
+        (KJS::ForNode::streamTo):
+        (KJS::ForInNode::streamTo):
+
+2007-12-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        * JavaScriptCore.exp: Remove unused symbol to prevent a weak external symbol
+        being generated in JavaScriptCore.framework.
+
+2007-12-21  Darin Adler  <darin@apple.com>
+
+        Requested by Maciej.
+
+        * kjs/nodes.h: Use the new NEVER_INLINE here and eliminate the old
+        KJS_NO_INLINE. We don't want to have two, and we figured it was better
+        to keep the one that's in WTF.
+
+2007-12-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=16561
+          remove debugger overhead from non-debugged JavaScript execution
+
+        1.022x as fast on SunSpider.
+
+        * JavaScriptCore.exp: Updated.
+
+        * kjs/NodeInfo.h: Renamed SourceElementsStub to SourceElements,
+        since that more accurately describes the role of this object, which
+        is a reference-counted wrapper for a Vector.
+
+        * kjs/Parser.cpp:
+        (KJS::Parser::didFinishParsing): Changed parameter type to SourceElements,
+        and use plain assignment instead of set.
+        * kjs/Parser.h: Changed parameter type of didFinishParsing to a
+        SourceElements. Also changed m_sourceElements; we now use a RefPtr instead
+        of an OwnPtr as well.
+
+        * kjs/grammar.y: Got rid of all the calls to release() on SourceElements.
+        That's now handed inside the constructors for various node types, since we now
+        use vector swapping instead.
+
+        * kjs/nodes.cpp:
+        (KJS::Node::rethrowException): Added NEVER_INLINE, because this was getting inlined
+        and we want exception handling out of the normal code flow.
+        (KJS::SourceElements::append): Moved here from the header. This now handles
+        creating a BreakpointCheckStatement for each statement in the debugger case.
+        That way we can get breakpoint handling without having it in every execute function.
+        (KJS::BreakpointCheckStatement::BreakpointCheckStatement): Added.
+        (KJS::BreakpointCheckStatement::execute): Added. Contains the code that was formerly
+        in the StatementNode::hitStatement function and the KJS_BREAKPOINT macro.
+        (KJS::BreakpointCheckStatement::streamTo): Added.
+        (KJS::ArgumentListNode::evaluateList): Use KJS_CHECKEXCEPTIONVOID since the return
+        type is void.
+        (KJS::VarStatementNode::execute): Removed KJS_BREAKPOINT.
+        (KJS::BlockNode::BlockNode): Changed parameter type to SourceElements.
+        Changed code to use release since the class now contains a vector rather than
+        a vector point.
+        (KJS::BlockNode::optimizeVariableAccess): Updated since member is now a vector
+        rather than a vector pointer.
+        (KJS::BlockNode::execute): Ditto.
+        (KJS::ExprStatementNode::execute): Removed KJS_BREAKPOINT.
+        (KJS::IfNode::execute): Ditto.
+        (KJS::IfElseNode::execute): Ditto.
+        (KJS::DoWhileNode::execute): Ditto.
+        (KJS::WhileNode::execute): Ditto.
+        (KJS::ContinueNode::execute): Ditto.
+        (KJS::BreakNode::execute): Ditto.
+        (KJS::ReturnNode::execute): Ditto.
+        (KJS::WithNode::execute): Ditto.
+        (KJS::CaseClauseNode::optimizeVariableAccess): Updated since member is now a vector
+        rather than a vector pointer.
+        (KJS::CaseClauseNode::executeStatements): Ditto.
+        (KJS::SwitchNode::execute): Removed KJS_BREAKPOINT.
+        (KJS::ThrowNode::execute): Ditto.
+        (KJS::TryNode::execute): Ditto.
+        (KJS::ScopeNode::ScopeNode): Changed parameter type to SourceElements.
+        (KJS::ProgramNode::ProgramNode): Ditto.
+        (KJS::EvalNode::EvalNode): Ditto.
+        (KJS::FunctionBodyNode::FunctionBodyNode): Ditto.
+        (KJS::ScopeNode::optimizeVariableAccess): Updated since member is now a vector
+        rather than a vector pointer.
+
+        * kjs/nodes.h: Removed hitStatement. Renamed SourceElements to StatementVector.
+        Renamed SourceElementsStub to SourceElements and made it derive from
+        ParserRefCounted rather than from Node, hold a vector rather than a pointer to
+        a vector, and changed the release function to swap with another vector rather
+        than the pointer idiom. Updated BlockNode and CaseClauseNode to hold actual
+        vectors instead of pointers to vectors. Added BreakpointCheckStatement.
+
+        * kjs/nodes2string.cpp:
+        (KJS::statementListStreamTo): Changed to work on a vector instead of a pointer
+        to a vector.
+        (KJS::BlockNode::streamTo): Ditto.
+        (KJS::CaseClauseNode::streamTo):  Ditto.
+
+        * wtf/AlwaysInline.h: Added NEVER_INLINE.
+        * wtf/PassRefPtr.h: Tweaked formatting. Added clear() function that matches the
+        ones in OwnPtr and auto_ptr.
+        * wtf/RefPtr.h: Ditto.
+
+2007-12-21  Darin Adler  <darin@apple.com>
+
+        - fix broken regression tests
+
+        The broken tests were fast/js/do-while-expression-value.html and
+        fast/js/while-expression-value.html.
+
+        * kjs/nodes.cpp: Check in the correct version of this file. I had accidentally landed
+        an old version of my patch for bug 16471.
+        (KJS::statementListExecute): The logic here was backwards. Have to set the value
+        even for non-normal execution results.
+
+2007-12-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Copy npruntime_internal.h
+        to WebKitBuild.
+
+2007-12-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by mjs.
+        
+        Split IfNode into IfNode and IfElseNode for speedup.
+        http://bugs.webkit.org/show_bug.cgi?id=16470
+        
+        SunSpider claims this is 1.003x as fast as before.
+        (This required running with --runs 15 to get consistent enough results to tell!)
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::IfNode::optimizeVariableAccess):
+        (KJS::IfNode::execute):
+        (KJS::IfNode::getDeclarations):
+        (KJS::IfElseNode::optimizeVariableAccess):
+        (KJS::IfElseNode::execute):
+        (KJS::IfElseNode::getDeclarations):
+        * kjs/nodes.h:
+        (KJS::IfNode::):
+        (KJS::IfElseNode::):
+        * kjs/nodes2string.cpp:
+        (KJS::IfNode::streamTo):
+        (KJS::IfElseNode::streamTo):
+
+2007-12-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        * wtf/OwnPtr.h:
+        (WTF::operator==): Added.
+        (WTF::operator!=): Added.
+
+2007-12-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        AST optimization: Avoid NULL-checking ForNode's child nodes.
+        
+        0.6% speedup on SunSpider.
+        
+        This is a proof of concept patch that demonstrates how to optimize
+        grammar productions with optional components, like
+        
+            for (optional; optional; optional) {
+                ...
+            }
+            
+        The parser emits NULL for an optional component that is not present.
+
+        Instead of checking for a NULL child at execution time, a node that
+        expects an optional component to be present more often than not checks
+        for a NULL child at construction time, and substitutes a viable
+        alternative node in its place.
+
+        (We'd like the parser to start emitting NULL a lot more once we teach
+        it to emit NULL for certain no-op productions like EmptyStatement and
+        VariableStatement, so, as a foundation, it's important for nodes with
+        NULL optional components to be fast.)
+
+        * kjs/Parser.cpp:
+        (KJS::Parser::didFinishParsing): Check for NULL SourceElements. Also,
+        moved didFinishParsing into the .cpp file because adding a branch while
+        it was in the header file caused a substantial and inexplicable
+        performance regression. (Did I mention that GCC is crazy?)
+
+        * kjs/grammar.y:
+
+        * kjs/nodes.cpp:
+        (KJS::BlockNode::BlockNode): Check for NULL SourceElements.
+        (KJS::ForNode::optimizeVariableAccess): No need to check for NULL here.
+        (KJS::ForNode::execute): No need to check for NULL here.
+        * kjs/nodes.h:
+        (KJS::ForNode::): Check for NULL SourceElements. Substitute a TrueNode
+        because it's semantically harmless, and it evaluates to boolean in an
+        efficient manner.
+
+2007-12-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Slight logic reordering in JSImmediate::from(double)
+
+        This gives a 0.6% improvement in SunSpider.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::from):
+
+2007-12-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by mjs.
+
+        Fix major Array regression introduced by 28899.
+
+        SunSpider claims this is at least 1.37x as fast as pre-regression. :)
+
+        * kjs/array_instance.cpp: make Arrays fast again!
+
+2007-12-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Geoff, then re-rubber-stamped by Geoff after final search/replace and testing.
+
+        Small reworking of Date code for 4% speedup on Date tests (0.2% overall)
+        http://bugs.webkit.org/show_bug.cgi?id=16537
+
+        Make msToYear human-readable
+        Make msToDayInMonth slightly more readable and avoid recalculating msToYear
+        Remove use of isInLeapYear to avoid calling msToYear
+        Remove dayInYear call by changing msToDayInMonth to dayInMonthFromDayInYear
+        Remove more duplicate calls to dayInYear and getUTCOffset for further speedup
+
+        * kjs/DateMath.cpp:
+        (KJS::daysFrom1970ToYear):
+        (KJS::msToYear):
+        (KJS::monthFromDayInYear):
+        (KJS::checkMonth):
+        (KJS::dayInMonthFromDayInYear):
+        (KJS::dateToDayInYear):
+        (KJS::getDSTOffsetSimple):
+        (KJS::getDSTOffset):
+        (KJS::gregorianDateTimeToMS):
+        (KJS::msToGregorianDateTime):
+
+2007-12-20  Rodney Dawes  <dobey@wayofthemonkey.com>
+
+        Reviewed by Darin Adler.
+
+        Proxy includes of npruntime.h or npapi.h through npruntime_internal.h
+        Include stdio.h in npapi.h for the use of FILE with XP_UNIX defined
+        This is for building with X11, as some type and enum names conflict
+        with #define names in X11 headers.
+        http://bugs.webkit.org/show_bug.cgi?id=15669
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/NP_jsobject.h:
+        * bindings/npapi.h:
+        * bindings/npruntime.cpp:
+        * bindings/npruntime_impl.h:
+        * bindings/npruntime_priv.h:
+        * bindings/npruntime_internal.h:
+        * bindings/testbindings.cpp:
+        * bindings/c/c_class.h:
+        * bindings/c/c_runtime.h:
+        * bindings/c/c_utility.h:
+
+2007-12-20  Darin Adler  <darin@apple.com>
+
+        - re-fix http://bugs.webkit.org/show_bug.cgi?id=16471
+          Completions need to be smaller (or not exist at all)
+
+        Same patch as last time with the test failures problem fixed.
+
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction): Make sure to check the completion
+        type from newExec to see if the execute raised an exception.
+
+2007-12-20  Darin Adler  <darin@apple.com>
+
+        - roll out that last change -- it was causing test failures;
+          I'll check it back in after fixing them
+
+2007-12-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=16471
+          Completions need to be smaller (or not exist at all)
+
+        SuSpider shows 2.4% speedup.
+
+        Stop using completions in the execution engine.
+        Instead, the completion type and label target are both
+        stored in the ExecState.
+
+        * API/JSContextRef.cpp: Removed unneeded include of "completion.h".
+        * bindings/runtime_method.cpp: Removed unused execute function.
+        * bindings/runtime_method.h: Ditto.
+
+        * kjs/ExecState.h: Added completionType, breakOrContinueTarget,
+        setCompletionType, setNormalCompletion, setBreakCompletion,
+        setContinueCompletion, setReturnValueCompletion, setThrowCompletion,
+        setInterruptedCompletion, m_completionType, and m_breakOrContinueTarget.
+
+        * kjs/completion.h: Removed constructor and getter for target
+        for break and continue from Completion. This class is now only
+        used for the public API to Interpreter and such.
+
+        * kjs/date_object.h: Removed unused execute function.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction): Removed some unneeded
+        exception processing. Updated to call the new execute function
+        and to get the completion type from the ExecState. Merged in
+        the execute function, which repeated some of the same logic and
+        was called only from here.
+        (KJS::GlobalFuncImp::callAsFunction): More of the same for eval.
+        * kjs/function.h: Removed execute.
+
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate): Added code to convert the result of
+        execut into a Completion.
+
+        * kjs/nodes.cpp:
+        (KJS::Node::setErrorCompletion): Renamed from createErrorCompletion.
+        Now sets the completion type in the ExecState.
+        (KJS::Node::rethrowException): Now sets the completion type in the
+        ExecState.
+        (KJS::StatementNode::hitStatement): Now sets the completion type in
+        the ExecState.
+        (KJS::VarStatementNode::execute): Updated to put completion type in
+        the ExecState instead of a Completion object.
+        (KJS::statementListExecute): Ditto. Also changed the for loop to use
+        indices instead of iterators.
+        (KJS::BlockNode::execute): Updated return type.
+        (KJS::EmptyStatementNode::execute): Updated to put completion type in
+        the ExecState instead of a Completion object.
+        (KJS::ExprStatementNode::execute): Ditto.
+        (KJS::IfNode::execute): Ditto.
+        (KJS::DoWhileNode::execute): Ditto. Also streamlined the logic a little
+        to make the normal case a little faster and moved the end outside the
+        loop so that "break" can do a break.
+        (KJS::WhileNode::execute): Ditto.
+        (KJS::ForNode::execute): Ditto.
+        (KJS::ForInNode::execute): Ditto.
+        (KJS::ContinueNode::execute): Updated to put completion type in
+        the ExecState instead of a Completion object.
+        (KJS::BreakNode::execute): Ditto.
+        (KJS::ReturnNode::execute): Ditto.
+        (KJS::WithNode::execute): Ditto.
+        (KJS::CaseClauseNode::executeStatements): Ditto. Also renamed to have
+        execute in its name to reflect the fact that it's a member of the same
+        family of functions.
+        (KJS::CaseBlockNode::executeBlock): Ditto.
+        (KJS::SwitchNode::execute): Ditto.
+        (KJS::LabelNode::execute): Ditto.
+        (KJS::ThrowNode::execute): Ditto.
+        (KJS::TryNode::execute): Ditto.
+        (KJS::ProgramNode::execute): Ditto.
+        (KJS::EvalNode::execute): Ditto.
+        (KJS::FunctionBodyNode::execute): Ditto.
+        (KJS::FuncDeclNode::execute): Ditto.
+
+        * kjs/nodes.h: Renamed setErrorCompletion to createErrorCompletion, made
+        hitStatement protected, changed return value of execute to a JSValue,
+        renamed evalStatements to executeStatements, and evalBlock to executeBlock.
+
+        * kjs/number_object.h: Removed unused execute function.
+
+2007-12-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Added Radar number.
+
+        * kjs/nodes.cpp:
+        (KJS::ProgramNode::processDeclarations):
+
+2007-12-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Linux build fix: config.h has to come first.
+
+        * kjs/error_object.cpp:
+
+2007-12-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Optimized global access to global variables, using a symbol table.
+        
+        SunSpider reports a 1.5% overall speedup, a 6.2% speedup on 3d-morph,
+        and a whopping 33.1% speedup on bitops-bitwise-and.
+
+        * API/JSCallbackObjectFunctions.h: Replaced calls to JSObject:: with
+        calls to Base::, since JSObject is not always our base class. This
+        was always a bug, but the bug is even more apparent after some of my
+        changes.
+
+        (KJS::::staticFunctionGetter): Replaced use of getDirect with call to
+        getOwnPropertySlot. Global declarations are no longer stored in the
+        property map, so a call to getDirect is insufficient for finding
+        override properties.
+
+        * API/testapi.c: 
+        * API/testapi.js: Added test for the getDirect change mentioned above.
+
+        * kjs/ExecState.cpp: 
+        * kjs/ExecState.h: Dialed back the optimization to store a direct
+        pointer to the localStorage buffer. One ExecState can grow the global
+        object's localStorage without another ExecState's knowledge, so
+        ExecState can't store a direct pointer to the localStorage buffer
+        unless/until we invent a way to update all the relevant ExecStates.
+
+        * kjs/JSGlobalObject.cpp: Inserted the symbol table into get and put
+        operations.
+        (KJS::JSGlobalObject::reset): Reset the symbol table and local storage,
+        too. Also, clear the property map here, removing the need for a
+        separate call.
+
+        * kjs/JSVariableObject.cpp:
+        * kjs/JSVariableObject.h: Added support for saving localStorage and the
+        symbol table to the back/forward cache, and restoring them.
+
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction): Renamed progNode to evalNode
+        because it's an EvalNode, not a ProgramNode.
+
+        * kjs/lookup.h:
+        (KJS::cacheGlobalObject): Replaced put with faster putDirect, since
+        that's how the rest of lookup.h works. putDirect is safe here because
+        cacheGlobalObject is only used for objects whose names are not valid
+        identifiers.
+
+        * kjs/nodes.cpp: The good stuff!
+
+        (KJS::EvalNode::processDeclarations): Replaced hasProperty with
+        the new hasOwnProperty, which is slightly faster.
+
+        * kjs/object.h: Nixed clearProperties because clear() does this job now.
+
+        * kjs/property_map.cpp:
+        * kjs/property_map.h: More back/forward cache support.
+        
+        * wtf/Vector.h:
+        (WTF::::grow): Added fast non-branching grow function. I used it in
+        an earlier version of this patch, even though it's not used anymore.
+
+2007-12-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Build fix for non-Mac platforms.  Move NodeInfo into its own header so that the YYTYPE
+        declaration in grammar.h is able to declare members of that type.
+
+        * kjs/NodeInfo.h: Added.
+        (KJS::createNodeInfo):
+        (KJS::mergeDeclarationLists):
+        (KJS::appendToVarDeclarationList):
+        * kjs/grammar.y:
+        * kjs/lexer.cpp:
+
+2007-12-19  Oliver Hunt  <oliver@apple.com>
+
+        Make appendToVarDeclarationList static
+
+        RS=Weinig.
+
+        * kjs/grammar.y:
+
+2007-12-18  Oliver Hunt  <oliver@apple.com>
+
+        Remove dead code due to removal of post-parse declaration discovery.
+
+        RS=Geoff.
+
+        Due to the removal of the declaration discovery pass after parsing we
+        no longer need any of the logic used for that discovery.
+
+        * kjs/nodes.cpp:
+        (KJS::Node::Node):
+        (KJS::VarDeclNode::VarDeclNode):
+        (KJS::BlockNode::BlockNode):
+        (KJS::ForInNode::ForInNode):
+        (KJS::CaseBlockNode::CaseBlockNode):
+        * kjs/nodes.h:
+        (KJS::VarStatementNode::):
+        (KJS::IfNode::):
+        (KJS::DoWhileNode::):
+        (KJS::WhileNode::):
+        (KJS::WithNode::):
+        (KJS::LabelNode::):
+        (KJS::TryNode::):
+        (KJS::FuncDeclNode::):
+        (KJS::CaseClauseNode::):
+        (KJS::ClauseListNode::):
+        (KJS::SwitchNode::):
+
+2007-12-18  Oliver Hunt  <oliver@apple.com>
+
+        Replace post-parse pass to find declarations with logic in the parser itself
+
+        Reviewed by Geoff.
+
+        Instead of finding declarations in a pass following the initial parsing of
+        a program, we incorporate the logic directly into the parser.  This lays
+        the groundwork for further optimisations (such as improving performance in
+        declaration expressions -- var x = y; -- to match that of standard assignment)
+        in addition to providing a 0.4% performance improvement in SunSpider.
+
+        * JavaScriptCore.exp:
+        * kjs/Parser.cpp:
+        (KJS::Parser::parse):
+        * kjs/Parser.h:
+        (KJS::Parser::didFinishParsing):
+        (KJS::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::ParserTracked::ParserTracked):
+        (KJS::ParserTracked::~ParserTracked):
+        (KJS::ParserTracked::ref):
+        (KJS::ParserTracked::deref):
+        (KJS::ParserTracked::refcount):
+        (KJS::ParserTracked::clearNewTrackedObjects):
+        (KJS::Node::Node):
+        (KJS::ScopeNode::ScopeNode):
+        (KJS::ProgramNode::ProgramNode):
+        (KJS::EvalNode::EvalNode):
+        (KJS::FunctionBodyNode::FunctionBodyNode):
+        (KJS::FunctionBodyNode::initializeSymbolTable):
+        (KJS::FunctionBodyNode::processDeclarations):
+        * kjs/nodes.h:
+        (KJS::ParserTracked::):
+        (KJS::Node::):
+        (KJS::ScopeNode::):
+
+2007-12-18  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Geoff.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=14521
+        Bug 14521: JavaScriptCore fails to build on Linux/PPC gcc 4.1.2
+        
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Unlock):
+
+        Use less strict memory operand constraint on inline asm generation.
+        PLATFORM(DARWIN) left unpatched due to Apple's GCC bug.
+
+        Patch by David Kilzer <ddkilzer@webkit.org>
+
+2007-12-18  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Remove outdated and non-functioning project files for the Apollo port.
+
+        * JavaScriptCore.apolloproj: Removed.
+
+2007-12-18  Darin Adler  <darin@apple.com>
+
+        - fix Windows build
+
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute): Change back from false/true to 0/1 -- I probably should not have
+        deleted MATCH_MATCH and MATCH_NOMATCH, but I'm going to leave them out.
+
+2007-12-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16458
+          REGRESSION (r28164): regular expressions can now hang due to lack of a match limit
+          <rdar://problem/5636067>
+
+        Test: fast/regex/slow.html
+
+        Slows down SunSpider a bit (about 1.01x); filed a bug to follow up on that:
+        http://bugs.webkit.org/show_bug.cgi?id=16503
+
+        * pcre/pcre.h: Changed name of error code to not specifically mention "recursion".
+        * pcre/pcre_exec.cpp:
+        (match): Replaced the depth limit, MATCH_RECURSION_LIMIT, with a total match looping
+        limit, matchLimit. Also eliminated the constants for MATCH_MATCH and MATCH_NOMATCH,
+        since they are just true and false (1 and 0).
+        (jsRegExpExecute): More of the MATCH_MATCH change.
+
+2007-12-17  Darin Adler  <darin@apple.com>
+
+        - speculative build fix for non-gcc platforms
+
+        * pcre/pcre_exec.cpp: (match): Remove unused cases from return switch.
+
+2007-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Speculative build fix for non-Mac platforms.
+
+        * pcre/pcre_compile.cpp: Include string.h for memset, memmove, etc.
+
+2007-12-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=16438
+        - removed some more unused code
+        - changed quite a few more names to WebKit-style
+        - moved more things out of pcre_internal.h
+        - changed some indentation to WebKit-style
+        - improved design of the functions for reading and writing
+          2-byte values from the opcode stream (in pcre_internal.h)
+
+        * pcre/dftables.cpp:
+        (main): Added the kjs prefix a normal way in lieu of using macros.
+
+        * pcre/pcre_compile.cpp: Moved some definitions here from pcre_internal.h.
+        (errorText): Name changes, fewer typedefs.
+        (checkEscape): Ditto. Changed uppercase conversion to use toASCIIUpper.
+        (isCountedRepeat): Name change.
+        (readRepeatCounts): Name change.
+        (firstSignificantOpcode): Got rid of the use of OP_lengths, which is
+        very lightly used here. Hard-coded the length of OP_BRANUMBER.
+        (firstSignificantOpcodeSkippingAssertions): Ditto. Also changed to
+        use the advanceToEndOfBracket function.
+        (getOthercaseRange): Name changes.
+        (encodeUTF8): Ditto.
+        (compileBranch): Name changes. Removed unused after_manual_callout and
+        the code to handle it. Removed code to handle OP_ONCE since we never
+        emit this opcode. Changed to use advanceToEndOfBracket in more places.
+        (compileBracket): Name changes.
+        (branchIsAnchored): Removed code to handle OP_ONCE since we never emit
+        this opcode.
+        (bracketIsAnchored): Name changes.
+        (branchNeedsLineStart): More fo the same.
+        (bracketNeedsLineStart): Ditto.
+        (branchFindFirstAssertedCharacter): Removed OP_ONCE code.
+        (bracketFindFirstAssertedCharacter): More of the same.
+        (calculateCompiledPatternLengthAndFlags): Ditto.
+        (returnError): Name changes.
+        (jsRegExpCompile): Ditto.
+
+        * pcre/pcre_exec.cpp: Moved some definitions here from pcre_internal.h.
+        (matchRef): Updated names.
+        Improved macros to use the do { } while(0) idiom so they expand to single
+        statements rather than to blocks or multiple statements. And refeactored
+        the recursive match macros.
+        (MatchStack::pushNewFrame): Name changes.
+        (getUTF8CharAndIncrementLength): Name changes.
+        (match): Name changes. Removed the ONCE opcode.
+        (jsRegExpExecute): Name changes.
+
+        * pcre/pcre_internal.h: Removed quite a few unneeded includes. Rewrote
+        quite a few comments. Removed the macros that add kjs prefixes to the
+        functions with external linkage; instead renamed the functions. Removed
+        the unneeded typedefs pcre_uint16, pcre_uint32, and uschar. Removed the
+        dead and not-all-working code for LINK_SIZE values other than 2, although
+        we aim to keep the abstraction working. Removed the OP_LENGTHS macro.
+        (put2ByteValue): Replaces put2ByteOpcodeValueAtOffset.
+        (get2ByteValue): Replaces get2ByteOpcodeValueAtOffset.
+        (put2ByteValueAndAdvance): Replaces put2ByteOpcodeValueAtOffsetAndAdvance.
+        (putLinkValueAllowZero): Replaces putOpcodeValueAtOffset; doesn't do the
+        addition, since a comma is really no better than a plus sign. Added an
+        assertion to catch out of range values and changed the parameter type to
+        int rather than unsigned.
+        (getLinkValueAllowZero): Replaces getOpcodeValueAtOffset.
+        (putLinkValue): New function that most former callers of the
+        putOpcodeValueAtOffset function can use; asserts the value that is
+        being stored is non-zero and then calls putLinkValueAllowZero.
+        (getLinkValue): Ditto.
+        (putLinkValueAndAdvance): Replaces putOpcodeValueAtOffsetAndAdvance. No
+        caller was using an offset, which makes sense given the advancing behavior.
+        (putLinkValueAllowZeroAndAdvance): Ditto.
+        (isBracketOpcode): Added. For use in an assertion.
+        (advanceToEndOfBracket): Renamed from moveOpcodePtrPastAnyAlternateBranches,
+        and removed comments about how it's not well designed. This function takes
+        a pointer to the beginning of a bracket and advances to the end of the
+        bracket.
+
+        * pcre/pcre_tables.cpp: Updated names.
+        * pcre/pcre_ucp_searchfuncs.cpp:
+        (kjs_pcre_ucp_othercase): Ditto.
+        * pcre/pcre_xclass.cpp:
+        (getUTF8CharAndAdvancePointer): Ditto.
+        (kjs_pcre_xclass): Ditto.
+        * pcre/ucpinternal.h: Ditto.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIAlpha): Added an int overload, like the one we already have for
+        isASCIIDigit.
+        (WTF::isASCIIAlphanumeric): Ditto.
+        (WTF::isASCIIHexDigit): Ditto.
+        (WTF::isASCIILower): Ditto.
+        (WTF::isASCIISpace): Ditto.
+        (WTF::toASCIILower): Ditto.
+        (WTF::toASCIIUpper): Ditto.
+
+2007-12-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16459
+          REGRESSION: assertion failure with regexp with \B in a case-ignoring character range
+          <rdar://problem/5646361>
+
+        The problem was that \B was not handled properly in character classes.
+
+        Test: fast/js/regexp-overflow.html
+
+        * pcre/pcre_compile.cpp:
+        (check_escape): Added handling of ESC_b and ESC_B in character classes here.
+        Allows us to get rid of the handling of \b in character classes from all the
+        call sites that handle it separately and to handle \B properly as well.
+        (compileBranch): Remove the ESC_b handling, since it's not needed any more.
+        (calculateCompiledPatternLengthAndFlags): Ditto.
+
+2007-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=16448
+        Bug 16448: [GTK] Celtic Kane JavaScript performance on Array test is slow relative to Mac
+
+        * kjs/array_instance.cpp:
+        (KJS::compareByStringPairForQSort):
+        (KJS::ArrayInstance::sort): Convert JSValue's to strings once up front and then sort the
+        results.  This avoids calling toString twice per comparison, but requires a temporary buffer
+        so we only use this approach in cases where the array being sorted is not too large.
+
+2007-12-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+        
+        More refactoring to support global variable optimization.
+        
+        Changed SymbolTable to use RefPtr<UString::Rep> as its key instead of
+        UString::Rep*. With globals, the symbol table can outlast the
+        declaration node for any given symbol, so the symbol table needs to ref
+        its symbol names.
+        
+        In support, specialized HashMaps with RefPtr keys to allow lookup
+        via raw pointer, avoiding refcount churn.
+        
+        SunSpider reports a .6% speedup (prolly just noise).
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added new file: wtf/RefPtrHashMap.h
+        * JavaScriptCore.xcodeproj/project.pbxproj: ditto
+
+        * kjs/JSVariableObject.cpp:
+        (KJS::JSVariableObject::getPropertyNames): Symbol table keys are RefPtrs now.
+
+        * kjs/SymbolTable.h: Modified key traits to match RefPtr. Added a
+        static Rep* for null, which helps compute the deletedValue() trait.
+
+        * wtf/HashMap.h: #include the RefPtr specialization so everyone can use it.
+
+        * wtf/RefPtrHashMap.h: Copied from wtf/HashMap.h. Added overloaded versions
+        of find(), contains(), get(), set(), add(), remove(), and take() that take
+        raw pointers as keys.
+
+2007-12-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16162
+        Problems with float parsing on Linux (locale-dependent parsing was used).
+
+        * kjs/dtoa.cpp: Removed USE_LOCALE to reduce future confusion.
+        * kjs/lexer.cpp: (KJS::Lexer::lex): Parse with kjs_strtod, not the system one.
+
+2007-12-14  Alp Toker  <alp@atoker.com>
+
+        Reviewed by Mark Rowe.
+
+        Enable the AllInOneFile.cpp optimization for the GTK+ port.
+
+        * JavaScriptCore.pri:
+
+2007-12-14  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed.  Remove commented out fprintf's that were for debugging purposes only.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::IncrementalScavenge):
+
+2007-12-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Don't use the MADV_DONTNEED code path for now as it has no effect on Mac OS X and is
+        currently untested on other platforms.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease): Return after releasing memory rather than potentially falling
+        through into another mechanism if multiple are supported.
+
+2007-12-14  Alp Toker  <alp@atoker.com>
+
+        Build fix for GTK+/Qt and ports that don't use AllInOneFile.cpp.
+
+        Include UnusedParam.h.
+
+        * wtf/TCSystemAlloc.cpp:
+
+2007-12-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Stephanie.
+
+        Fix build on windows
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::IncrementalScavenge):
+
+2007-12-14  Dan Bernstein  <mitz@apple.com>
+
+        - try again to fix the Windows build
+
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+
+2007-12-14  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+
+2007-12-14  Mark Rowe <mrowe@apple.com>
+
+        Reviewed by Maciej and Oliver.
+
+        Add final changes to make TCMalloc release memory to the system.
+        This results in a 0.4% regression against ToT, but this is offset
+        against the gains made by the original TCMalloc r38 merge - in fact
+        we retain around 0.3-0.4% progression overall.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::InitSizeClasses):
+        (WTF::TCMalloc_PageHeap::IncrementalScavenge):
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+
+2007-12-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - removed unnecessary includes of "Vector.h"
+
+        * wtf/HashMap.h:
+        (WTF::copyKeysToVector): Make the type of the vector be a template parameter.
+        This allows copying keys into a vector of a base class or one with an inline capacity.
+        (WTF::copyValuesToVector): Ditto.
+        * wtf/HashSet.h:
+        (WTF::copyToVector): Ditto.
+
+2007-12-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin and Geoff.
+
+        <rdar://problem/5619295> 
+        REGRESSION: 303-304: Embedded YouTube video fails to render- JS errors (16150) (Flash 9)
+        
+        Get rid of unnecessary and incorrect security checks for plug-ins accessing JavaScript objects. 
+        
+        The way this used to work was that each NPObject that wrapped a JSObject would have a root object
+        corresponding to the frame object (used for managing the lifecycle) and an origin root object (used for
+        doing security checks). 
+        
+        This would prevent a plug-in from accessing a frame's window object if it's security origin was different
+        (some parts of the window, such as the location object, can be accessed from frames with different security 
+        origins, and those checks are being done in WebCore).
+        
+        Also, if a plug-in were to access a window object of a frame that later went away, it could lead to that
+        Window JSObject being garbage collected and the NPObject pointing to freed memory.
+        
+        How this works now is that there is no origin root object anymore, and all NPObject wrappers that are created
+        for a plug-in will have the root object of the containing frame of that plug-in.
+        
+        * bindings/NP_jsobject.cpp:
+        (jsDeallocate):
+        Don't free the origin root object.
+        
+        (_NPN_CreateScriptObject):
+        Remove the origin root object parameter.
+        
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        Get rid of all security checks.
+        
+        * bindings/NP_jsobject.h:
+        Remove originRootObject from the JavaScriptObject struct.
+        
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant):
+        Always use the root object from the ExecState.
+        
+2007-12-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Move source file generation into its own vcproj to fix build dependencies.
+
+        Reviewed by Adam.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Added.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+
+2007-12-13  Alp Toker  <alp@atoker.com>
+
+        http://bugs.webkit.org/show_bug.cgi?id=16406
+        [Gtk] JavaScriptCore needs -lpthread
+
+        Build fix for Debian and any other platforms that don't implicitly
+        link to pthread.
+
+        Link to pthread on non-Windows platforms until this dependency is
+        removed from JSC.
+
+2007-12-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Build fix: Note some variables that are used only for ASSERTs.
+
+        * API/testapi.c:
+        (Base_finalize):
+        (globalObject_initialize):
+        (testInitializeFinalize):
+
+2007-12-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed: All JS tests crash on Windows.
+
+        NDEBUG wasn't defined when compiling testkjs in release builds, so the
+        HashTable definition in HashTable.h included an extra data member.
+
+        The solution was to add NDEBUG to the release testkjs configuration on
+        Windows and Mac.
+        
+        For giggles, I also added other missing #defines to testkjs on Windows.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/testkjs.cpp:
+        (main):
+
+2007-12-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Removed bogus ASSERT.
+        
+        ASSERT should only be used when we know that a code path will not be
+        taken. This code path is taken often during the jsFunFuzz test.
+
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute):
+
+2007-12-11  Darin Adler  <darin@apple.com>
+
+        * wtf/unicode/qt4/UnicodeQt4.h: Try to fix Qt build by adding U16_IS_SINGLE.
+
+2007-12-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16379
+          REGRESSION(r28525): Failures in http/tests/xmlhttprequest/response-encoding.html and
+          fast/dom/xmlhttprequest-html-response-encoding.html
+          and <rdar://problem/5640230> REGRESSION (306A4-ToT): Access violation in PCRE function
+          find_firstassertedchar
+
+        Test: fast/js/regexp-find-first-asserted.html
+
+        * pcre/pcre_compile.cpp:
+        (compileBracket): Take out unnecessary initialization of out parameters.
+        (branchFindFirstAssertedCharacter): Added. Broke out the half of the function that handles
+        a branch.
+        (bracketFindFirstAssertedCharacter): Renamed from find_firstassertedchar. Also removed the
+        options parameter -- the caller can handle the options.
+        (jsRegExpCompile): Changed call site to call the appropriate bracket or branch version of
+        the find_firstassertedchar function. Also put the REQ_IGNORE_CASE code here instead of
+        passing in the options.
+
+2007-12-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Split this:
+        
+                            FunctionBodyNode
+                                    ^
+                                    |
+                                ProgramNode
+            
+        into this:
+            
+                                ScopeNode
+                ^                   ^                   ^
+                |                   |                   |
+        FunctionBodyNode        ProgramNode         EvalNode
+
+        in preparation for specializing each class more while optimizing global
+        variable access.
+        
+        Also removed some cruft from the FunctionBodyNode interface to simplify
+        things.
+        
+        SunSpider says this patch is a .8% speedup, which seems reasonable,
+        since it eliminates a few branches and adds KJS_FAST_CALL in a few
+        places.
+        
+        Layout tests and JS tests pass. Also, this baby builds on Windows! (Qt
+        mileage may vary...)
+
+2007-12-10  Geoffrey Garen  <ggaren@apple.com>
+
+        RS by Mark Rowe.
+        
+        Mac build fix: added some exported symbols, now that Parser::parse is
+        defined in the header.
+
+        * JavaScriptCore.exp:
+
+2007-12-10  Sam Weinig  <sam@webkit.org>
+
+        Build fix.
+
+        Template methods need to be in the header.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * kjs/Parser.cpp:
+        * kjs/Parser.h:
+        (KJS::Parser::parse):
+
+2007-12-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Merged different implementations of Parser::parse into a single,
+        templatized implementation, in preparation for adding yet another
+        implementation for "eval" code.
+        
+        JS and layout tests pass.
+
+2007-12-10  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Mark Rowe
+
+        <rdar://problem/5639463> Bundle versions on Tiger should be 4523.x not 523.x
+
+        * Configurations/Version.xcconfig: Some Tiger versions of Xcode don't set MAC_OS_X_VERSION_MAJOR,
+          so assume Tiger and use a 4 for the SYSTEM_VERSION_PREFIX.
+
+2007-12-10  Mark Rowe  <mrowe@apple.com>
+
+        Tiger build fix.
+
+        * kjs/grammar.y: Use @1 and @0 in place of @$ where Tiger's bison chokes.
+
+2007-12-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16375
+          REGRESSION: Safari crashes on quit
+
+        Probably a debug-only issue.
+
+        * kjs/Parser.cpp:
+        (KJS::parser): Create the parser and never destroy it by using a pointer instead
+        of a global object.
+
+2007-12-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16369
+          REGRESSION (r28525): regular expression tests failing due to bad firstByte optimization
+
+        * pcre/pcre_compile.cpp: Changed some names to use interCaps intead of under_scores.
+        (branchIsAnchored): Broke is_anchored into two separate functions; this one works on a
+        branch and the other on an anchor. The old function would only work on a bracket.
+        Also removed unneeded parameters; the anchored check does not require the bracket
+        map or the options any more because we have a reduced set of features.
+        (bracketIsAnchored): Ditto.
+        (branchNeedsLineStart): Broke canApplyFirstCharOptimization into two functions and gave
+        both a better name. This is the function that was returning the wrong value. The failure
+        was beacuse the old function would only work on a bracket.
+        (bracketNeedsLineStart): Ditto.
+        (jsRegExpCompile): Changed to call the appropriate branch or bracket flavor of the
+        functions based on whether we compiled an outer bracket. Also removed inaccurate comments
+        and unneeded parameters.
+
+        - other small changes
+
+        * pcre/pcre.h: Renumbered error codes, in a logical order. First, normal failure, then
+        the recursion limit, then running out of memory, and finally an unexpected internal error.
+
+        * pcre/pcre_exec.cpp: Fixed indentation.
+        (jsRegExpExecute): Corrected an inaccurate comment.
+
+2007-12-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16370
+          REGRESSION (r28540): source URL and line number no longer set for outer function/programs
+
+        Test: fast/js/exception-linenums-in-html-1.html
+        Test: fast/js/exception-linenums-in-html-2.html
+        Test: fast/js/exception-linenums.html
+
+        By the time the ProgramNode was constructed, the source URL was empty.
+
+        * kjs/Parser.cpp:
+        (KJS::Parser::parseProgram): Added code to set and clear m_sourceURL, which is now
+        handled here instead of in the lexer; it needs to still be set when we create the
+        program node. Call setLoc to set the first and last line number.
+        (KJS::Parser::parseFunctionBody): Ditto, but for the body.
+        (KJS::Parser::parse): Removed the sourceURL argument.
+
+        * kjs/Parser.h: Added sourceURL(), m_sourceURL, and m_lastLine. Added a lastLine
+        parameter to didFinishParsing, since the bison grammar knows the last line number
+        and we otherwise do not know it. Removed the sourceURL parameter from parse, since
+        that's now handled at a higher level.
+
+        * kjs/grammar.y: Pass the last line number to didFinishParsing.
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::setCode): Removed the sourceURL argument and the code to set m_sourceURL.
+        (KJS::Lexer::clear): Ditto.
+        * kjs/lexer.h: More of the same.
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNode::FunctionBodyNode): Get the source URL from the parser rather
+        than from the lexer. Removed unneeded call to setLoc, since the line numbers already
+        both default to -1.
+
+2007-12-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam W.
+
+        Split the ENABLE_SVG_EXPERIMENTAL_FEATURES flag into separate flags.
+        
+        Fixes <rdar://problem/5620249> Must disable SVG animation
+        <rdar://problem/5612772> Disable SVG filters on Mac to match Windows behavior
+        
+        Minor config changes.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-12-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin.
+
+        - Rename isSafeScript to allowsAccessFrom.
+
+        * bindings/NP_jsobject.cpp:
+        (_isSafeScript):
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::allowsAccessFrom): Reverse caller/argument of allowsAccessFrom to match
+        the new call.
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Refactored variable access optimization: Removed the assumption that
+        the FunctionBodyNode holds the symbol table.
+        
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added #include.
+
+        * kjs/nodes.cpp:
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added #include.
+
+        * kjs/interpreter.cpp:
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added #include.
+
+        * kjs/grammar.y:
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added #include.
+
+        * kjs/function_object.cpp:
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed crash seen running layout tests.
+        
+        Reverted a change I made earlier today. Added a comment to try to
+        discourage myself from making this mistake a third time.
+
+        * kjs/function.cpp:
+        (KJS::ActivationImp::mark):
+        * kjs/function.h:
+        (KJS::ActivationImp::ActivationImpData::ActivationImpData):
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Refactored parsing of global code: Removed the assumption that 
+        ProgramNode inherits from FunctionBodyNode from the parser.
+
+        * kjs/Parser.cpp:
+        (KJS::Parser::parseProgram):
+        (KJS::Parser::parseFunctionBody):
+        (KJS::Parser::parse):
+        * kjs/Parser.h:
+        (KJS::Parser::didFinishParsing):
+        * kjs/function.cpp:
+        * kjs/grammar.y:
+        * kjs/nodes.h:
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added JSVariableObject.cpp to the .pri file.
+
+        * JavaScriptCore.pri:
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added #include.
+
+        * kjs/function.cpp:
+
+2007-12-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Re-named our B&I flag from BUILDBOT to PRODUCTION.
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj:
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: removed stray name qualification.
+
+        * kjs/function.h:
+        (KJS::ActivationImp::ActivationImp):
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: moved functions with qualified names outside of class
+        declaration.
+
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::symbolTableGet):
+        (KJS::JSVariableObject::symbolTablePut):
+
+2007-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Next step in refactoring JSGlobalObject: Added JSVariableObject class,
+        and factored symbol-table-related code into it. (JSGlobalObject doesn't
+        use the symbol table code yet, though.)
+        
+        Layout and JS tests, and testapi, pass. SunSpider reports no regression.
+
+2007-12-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16185
+          jsRegExpCompile should not add implicit non-capturing bracket
+
+        While this does not make SunSpider faster, it will make many regular
+        expressions a bit faster.
+
+        * pcre/pcre_compile.cpp: Moved CompileData struct in here from the
+        header since it's private to this file.
+        (compile_branch): Updated for function name change.
+        (compile_bracket): Renamed from compile_regex, since, for one thing,
+        this does not compile an entire regular expression.
+        (calculateCompiledPatternLengthAndFlags): Removed unused item_count
+        local variable. Renamed CompileData to cd instead of compile_block
+        to be consistent with other functions. Added code to set the
+        needOuterBracket flag if there's at least one "|" at the outer level.
+        (jsRegExpCompile): Renamed CompileData to cd instead of compile_block
+        to be consistent with other functions. Removed unneeded "size" field
+        from the compiled regular expression. If no outer bracket is needed,
+        then use compile_branch to compile the regular expression.
+
+        * pcre/pcre_internal.h: Removed the CompileData struct, which is now
+        private to pcre_compile.cpp. Removed the size member from JSRegExp.
+
+2007-12-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        MSVC7 build fix due to a compiler bug with placement new and/or
+        templates and casting.
+
+        Reviewed by Darin Adler.
+
+        * wtf/Vector.h:
+        (WTF::::append):
+
+2007-12-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16321
+          new RegExp("[\u0097]{4,6}", "gmy") crashes in DEBUG builds
+          <rdar://problem/5632992>
+
+        Test: fast/js/regexp-oveflow.html
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLengthAndFlags): In the case where a single character
+        character class is optimized to not use a character class at all, the preflight
+        code was not setting the lastitemlength variable.
+
+2007-12-05  Mark Rowe  <mrowe@apple.com>
+
+        Qt Windows build fix.  Include the time-related headers in the correct place.
+
+        * kjs/JSGlobalObject.cpp:
+        * kjs/interpreter.cpp:
+
+2007-12-05  Darin Adler  <darin@apple.com>
+
+        Not reviewed; just undoing a previous commit.
+
+        - remove earlier incorrect fix for http://bugs.webkit.org/show_bug.cgi?id=16220
+          <rdar://problem/5625221> Crash opening www.news.com (CNet)
+
+        The real bug was the backwards ?: in the compile function, which Geoff just
+        fixed. Rolling out the incorrect earlier fix.
+
+        * pcre/pcre_compile.cpp: (calculateCompiledPatternLengthAndFlags): Take out
+        the unneeded preflight change. The regression test proves this is still working
+        fine, so the bug remains fixed.
+
+2007-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Include headers before trying to use the things that they declare.
+
+        * kjs/JSImmediate.cpp:
+        * kjs/nodes.cpp:
+        * kjs/object.cpp:
+        * kjs/object_object.cpp:
+        * kjs/regexp_object.cpp:
+        * kjs/string_object.cpp:
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added some #includes.
+
+        * kjs/JSImmediate.cpp:
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added some #includes.
+
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSImmediate.cpp:
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Fixed #include spelling.
+
+        * kjs/debugger.cpp:
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added #include.
+
+        * kjs/debugger.cpp:
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added a forward declaration.
+
+        * kjs/debugger.h:
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added an #include.
+
+        * kjs/error_object.cpp:
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added an #include.
+
+        * kjs/bool_object.cpp:
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Third step in refactoring JSGlobalObject: Moved data members and 
+        functions accessing data members from Interpreter to JSGlobalObject.
+        Changed Interpreter member functions to static functions.
+        
+        This resolves a bug in global object bootstrapping, where the global
+        ExecState could be used when uninitialized.
+        
+        This is a big change, but it's mostly code motion and renaming.
+        
+        Layout and JS tests, and testjsglue and testapi, pass. SunSpider reports
+        a .7% regression, but Shark sees no difference related to this patch,
+        and SunSpider reported a .7% speedup from an earlier step in this 
+        refactoring, so I think it's fair to call that a wash.
+
+2007-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler. (Or vice versa.)
+        
+        Fixed ASSERT during run-javascriptcore-tests. (Darin just added the
+        ASSERT, but the bug wasn't new.)
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch): The ?: operator here was backwards, causing us to
+        execute the loop too many times, adding stray KET opcodes to the
+        compiled regular expression.
+
+2007-12-05  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        - Wait until local variable data is fully constructed before notifying the debugger of entering
+        or leaving a call frame.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNode::execute):
+
+2007-12-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver.
+
+        Build fix for GCC 4.2. Cast via a union to avoid strict-aliasing issues.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::):
+        (WTF::getPageHeap):
+
+2007-12-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin.
+
+        Fix testkjs in 64-bit.
+
+        When built for 64-bit the TCMalloc spin lock uses pthread mutexes rather than a custom spin lock
+        implemented in assembly.  If we fail to initialize the pthread mutex, attempts to lock or unlock
+        it will fail and trigger a call to abort.
+
+        * wtf/FastMalloc.cpp: Initialize the spin lock so that we can later lock and unlock it.
+        * wtf/TCSpinLock.h: Add an Init method to the optimised spin lock.
+
+2007-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Fix gtk build.
+
+        * wtf/TCSystemAlloc.cpp:
+
+2007-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe and Geoff Garen.
+
+        Merge TCMalloc r38
+
+        It also result in a performance progression between 0.5% and 
+        0.9% depending on the test, however most if not all of this 
+        gain will be consumed by the overhead involved in the later
+        change to release memory to the system.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/FastMalloc.cpp:
+        (WTF::KernelSupportsTLS):
+        (WTF::CheckIfKernelSupportsTLS):
+        (WTF::):
+        (WTF::ClassIndex):
+        (WTF::SLL_Next):
+        (WTF::SLL_SetNext):
+        (WTF::SLL_Push):
+        (WTF::SLL_Pop):
+        (WTF::SLL_PopRange):
+        (WTF::SLL_PushRange):
+        (WTF::SLL_Size):
+        (WTF::SizeClass):
+        (WTF::ByteSizeForClass):
+        (WTF::NumMoveSize):
+        (WTF::InitSizeClasses):
+        (WTF::AllocationSize):
+        (WTF::TCMalloc_PageHeap::GetSizeClassIfCached):
+        (WTF::TCMalloc_PageHeap::CacheSizeClass):
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Carve):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::IncrementalScavenge):
+        (WTF::PagesToMB):
+        (WTF::TCMalloc_PageHeap::Dump):
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        (WTF::TCMalloc_PageHeap::Check):
+        (WTF::ReleaseFreeList):
+        (WTF::TCMalloc_PageHeap::ReleaseFreePages):
+        (WTF::TCMalloc_ThreadCache_FreeList::Push):
+        (WTF::TCMalloc_ThreadCache_FreeList::PushRange):
+        (WTF::TCMalloc_ThreadCache_FreeList::PopRange):
+        (WTF::TCMalloc_ThreadCache_FreeList::Pop):
+        (WTF::TCMalloc_Central_FreeList::length):
+        (WTF::TCMalloc_Central_FreeList::tc_length):
+        (WTF::TCMalloc_Central_FreeList::Init):
+        (WTF::TCMalloc_Central_FreeList::ReleaseListToSpans):
+        (WTF::TCMalloc_Central_FreeList::EvictRandomSizeClass):
+        (WTF::TCMalloc_Central_FreeList::MakeCacheSpace):
+        (WTF::TCMalloc_Central_FreeList::ShrinkCache):
+        (WTF::TCMalloc_Central_FreeList::InsertRange):
+        (WTF::TCMalloc_Central_FreeList::RemoveRange):
+        (WTF::TCMalloc_Central_FreeList::FetchFromSpansSafe):
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        (WTF::TCMalloc_ThreadCache::Init):
+        (WTF::TCMalloc_ThreadCache::Cleanup):
+        (WTF::TCMalloc_ThreadCache::Allocate):
+        (WTF::TCMalloc_ThreadCache::Deallocate):
+        (WTF::TCMalloc_ThreadCache::FetchFromCentralCache):
+        (WTF::TCMalloc_ThreadCache::ReleaseToCentralCache):
+        (WTF::TCMalloc_ThreadCache::Scavenge):
+        (WTF::TCMalloc_ThreadCache::PickNextSample):
+        (WTF::TCMalloc_ThreadCache::NewHeap):
+        (WTF::TCMalloc_ThreadCache::GetThreadHeap):
+        (WTF::TCMalloc_ThreadCache::GetCache):
+        (WTF::TCMalloc_ThreadCache::GetCacheIfPresent):
+        (WTF::TCMalloc_ThreadCache::InitTSD):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        (WTF::TCMallocStats::ExtractStats):
+        (WTF::TCMallocStats::DumpStats):
+        (WTF::TCMallocStats::DumpStackTraces):
+        (WTF::TCMallocStats::TCMallocImplementation::MarkThreadIdle):
+        (WTF::TCMallocStats::TCMallocImplementation::ReleaseFreeMemory):
+        (WTF::TCMallocStats::TCMallocGuard::TCMallocGuard):
+        (WTF::TCMallocStats::TCMallocGuard::~TCMallocGuard):
+        (WTF::TCMallocStats::DoSampledAllocation):
+        (WTF::TCMallocStats::CheckCachedSizeClass):
+        (WTF::TCMallocStats::CheckedMallocResult):
+        (WTF::TCMallocStats::SpanToMallocResult):
+        (WTF::TCMallocStats::do_malloc):
+        (WTF::TCMallocStats::do_free):
+        (WTF::TCMallocStats::do_memalign):
+        (WTF::TCMallocStats::do_malloc_stats):
+        (WTF::TCMallocStats::do_mallopt):
+        (WTF::TCMallocStats::do_mallinfo):
+        (WTF::TCMallocStats::realloc):
+        (WTF::TCMallocStats::cpp_alloc):
+        (WTF::TCMallocStats::operator new):
+        (WTF::TCMallocStats::):
+        (WTF::TCMallocStats::operator new[]):
+        (WTF::TCMallocStats::malloc_stats):
+        (WTF::TCMallocStats::mallopt):
+        (WTF::TCMallocStats::mallinfo):
+        * wtf/TCPackedCache.h: Added.
+        (PackedCache::PackedCache):
+        (PackedCache::Put):
+        (PackedCache::Has):
+        (PackedCache::GetOrDefault):
+        (PackedCache::Clear):
+        (PackedCache::EntryToValue):
+        (PackedCache::EntryToUpper):
+        (PackedCache::KeyToUpper):
+        (PackedCache::UpperToPartialKey):
+        (PackedCache::Hash):
+        (PackedCache::KeyMatch):
+        * wtf/TCPageMap.h:
+        (TCMalloc_PageMap2::PreallocateMoreMemory):
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+        * wtf/TCSystemAlloc.h:
+
+2007-12-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam.
+
+        Make isSafeScript const.
+        
+        * kjs/JSGlobalObject.h:
+        (KJS::JSGlobalObject::isSafeScript):
+
+2007-12-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix first part of http://bugs.webkit.org/show_bug.cgi?id=16220
+          <rdar://problem/5625221> Crash opening www.news.com (CNet)
+
+        Test: fast/js/regexp-overflow.html
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLengthAndFlags): Add room for the additional BRA/KET that
+        was generated in the compile code but not taken into account here.
+
+2007-12-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15618
+          <rdar://problem/5619353> REGRESSION: Stack overflow/crash in KJS::equal (15618)
+
+        Test: fast/js/recursion-limit-equal.html
+
+        * kjs/operations.cpp: (KJS::equal): Check the exception from toPrimitive.
+
+2007-12-03  Dan Bernstein  <mitz@apple.com>
+
+        - fix a copy-and-paste-o
+
+        * bindings/npruntime.cpp:
+        (_NPN_GetIntIdentifier):
+
+2007-12-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix an ASSERT when getIntIdentifier is called with 0 or -1
+
+        * bindings/npruntime.cpp:
+        (_NPN_GetIntIdentifier): We cannot use the hashmap for 0 and -1 since
+        they are the empty value and the deleted value. Instead, keep the
+        identifiers for those two integers in a static array.
+
+2007-12-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mitz.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15848
+          <rdar://problem/5619330> REGRESSION: Assertion failure viewing comments page on digg.com
+
+        Test: fast/js/sparse-array.html
+
+        * kjs/array_instance.cpp:
+        (KJS::ArrayInstance::inlineGetOwnPropertySlot): Check sparse array cutoff before looking
+        in hash map. Can't avoid the branch because we can't look for 0 in the hash.
+        (KJS::ArrayInstance::deleteProperty): Ditto.
+
+2007-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added an #include.
+
+        * kjs/collector.cpp:
+
+2007-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Second step in refactoring JSGlobalObject: moved virtual functions from
+        Interpreter to JSGlobalObject.
+        
+        Layout and JS tests pass. SunSpider reports a .7% speedup -- don't 
+        believe his lies.
+
+2007-12-01  Alp Toker  <alp@atoker.com>
+
+        Reviewed by Adam Roben.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16228
+        kJSClassDefinitionEmpty is not exported with JS_EXPORT
+
+        Add JS_EXPORT to kJSClassDefinitionEmpty.
+
+        Make the gcc compiler check take precedence over the WIN32||_WIN32
+        check to ensure that symbols are exported on Windows when using gcc.
+
+        Add a TODO referencing the bug about JS_EXPORT in the Win build
+        (http://bugs.webkit.org/show_bug.cgi?id=16227)
+
+        Don't define JS_EXPORT as 'extern' when the compiler is unknown since
+        it would result in the incorrect expansion:
+
+          extern extern const JSClassDefinition kJSClassDefinitionEmpty;
+
+        (This was something we inherited from CFBase.h that doesn't make sense
+        for JSBase.h)
+
+        * API/JSBase.h:
+        * API/JSObjectRef.h:
+
+2007-11-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Reversed the ownership relationship between Interpreter and JSGlobalObject.
+        Now, the JSGlobalObject owns the Interpreter, and top-level objects
+        that need the two to persist just protect the JSGlobalObject from GC.
+        
+        Global object bootstrapping looks a little odd right now, but it will
+        make much more sense soon, after further rounds of refactoring.
+
+        * bindings/runtime_root.h: Made this class inherit from RefCounted,
+        to avoid code duplication.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect): No need to give special GC treatment to 
+        Interpreters, since we mark their global objects, which mark them.
+
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::mark): No need to mark our global object, since it
+        marks us.
+        * kjs/interpreter.h: Don't inherit from RefCounted -- JSGlobalObject 
+        owns us directly.
+
+        * kjs/testkjs.cpp: Modified to follow the new rules.
+        (createGlobalObject):
+        (runWithScripts):
+
+2007-11-30  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Eric.
+
+        * ChangeLog:
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+
+2007-11-30  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+        
+        Fix uninitialized var warnings in release build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * pcre/pcre_compile.cpp:
+        (compile_regex):
+
+2007-11-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16207
+          JavaScript regular expressions should match UTF-16 code units rather than characters
+
+        SunSpider says this is 5.5% faster on the regexp test, 0.4% faste overall.
+
+        Test: fast/js/regexp-non-bmp.html
+
+        Renamed ANY_CHAR to NOT_NEWLINE to more-accurately reflect its meaning.
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch): Removed calls to the UTF-16 character accessor functions, replacing
+        them with simple pointer dereferences in some cases, and no code at all in others.
+        (calculateCompiledPatternLengthAndFlags): Ditto.
+
+        * pcre/pcre_exec.cpp:
+        (match): Fixed indentation of some case labels (including all the BEGIN_OPCODE).
+        Removed calls to the UTF-16 character accessor functions, replacing them with simple
+        pointer dereferences in some cases, and no code at all in others. Also removed some
+        explicit UTF-16 support code in a few cases. Removed the unneeded "UTF-8" code path
+        in the ANY_CHAR repeat code, and in another case, eliminated the code to check against
+        end_subject in because it is already done outside the loop.
+        (jsRegExpExecute):
+
+        * pcre/pcre_internal.h: Removed all the UTF-16 helper functions.
+
+2007-11-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+        
+        PCRE crashes under GuardMalloc
+        http://bugs.webkit.org/show_bug.cgi?id=16127
+        check against patternEnd to make sure we don't walk off the end of the string
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (calculateCompiledPatternLengthAndFlags):
+
+2007-11-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+        
+        Fix layout test regressions caused by r28186
+        http://bugs.webkit.org/show_bug.cgi?id=16195
+        change first_byte and req_byte back to shorts instead of chars
+        (I think PCRE stuffs information in the high bits) 
+
+        * pcre/pcre_internal.h:
+
+2007-11-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej and Darin.
+
+        Make the JS collector work with multiple threads 
+
+        Under heavy contention it was possible the GC to suspend other
+        threads inside the pthread spinlock, which could lead to the GC
+        thread blocking on the pthread spinlock itself.
+
+        We now determine and store each thread's stack base when it is
+        registered, thus removing the need for any calls to pthread_get_stackaddr_np
+        that needed the pthread spinlock.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::Thread::Thread):
+        (KJS::Collector::registerThread):
+        (KJS::Collector::markOtherThreadConservatively):
+
+2007-11-29  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        Removed some unreachable code (ironically, the code was some
+        ASSERT_NOT_REACHED()s).
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        * pcre/pcre_exec.cpp:
+        (match):
+
+2007-11-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mark Rowe.
+        
+        Fix for --guard crash of fast/js/regexp-charclass-crash introduced by r28151.
+
+        * pcre/pcre_compile.cpp:
+        (is_anchored):
+
+2007-11-28  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.  Rubber-stamped by Eric.
+
+        * pcre/pcre_exec.cpp:
+        (match): Add braces around the body of the case statement to prevent
+        wanings about jumps across the initialization of a variable.
+
+2007-11-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mark Rowe.
+        
+        Attempt to fix non-mac builds after PCRE cleanup.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+        * pcre/pcre.pri:
+
+2007-11-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Centralize code for subjectPtr adjustments using inlines, only ever check for a single
+        trailing surrogate (as UTF16 only allows one), possibly fix PCRE bugs involving char
+        classes and garbled UTF16 strings.
+
+        * pcre/pcre_exec.cpp:
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+        (getPreviousChar):
+        (movePtrToPreviousChar):
+        (movePtrToNextChar):
+        (movePtrToStartOfCurrentChar):
+
+2007-11-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        change getChar* functions to return result and push 'c' into local scopes for clarity
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (calculateCompiledPatternLengthAndFlags):
+        * pcre/pcre_exec.cpp:
+        (match):
+        * pcre/pcre_internal.h:
+        (getChar):
+        (getCharAndAdvance):
+        (getCharAndLength):
+        (getCharAndAdvanceIfSurrogate):
+
+2007-11-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Comment cleanup
+
+        * pcre/pcre_exec.cpp:
+        (match):
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Further cleanups to calculateCompiledPatternLengthAndFlags
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLengthAndFlags):
+        * pcre/pcre_internal.h:
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Give consistent naming to the RegExp options/compile flags
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (is_anchored):
+        (find_firstassertedchar):
+        (printCompiledRegExp):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Pull first_byte and req_byte optimizations out into separate static funtions, SunSpider reported this as a win.
+
+        * pcre/pcre_exec.cpp:
+        (tryFirstByteOptimization):
+        (tryRequiredByteOptimization):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        give PCRE_MULTILINE a better name: OptionMatchAcrossMultipleLines
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (is_anchored):
+        (printCompiledRegExp):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver.
+
+        Deprecate jsRegExpExecute's offset-vector fallback code
+
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute):
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Make cur_is_word and prev_is_word locals, and change OP_ANY to OP_ANY_CHAR for clarity
+
+        * pcre/pcre_compile.cpp:
+        (find_fixedlength):
+        (compile_branch):
+        (canApplyFirstCharOptimization):
+        * pcre/pcre_exec.cpp:
+        (match):
+        * pcre/pcre_internal.h:
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mitz & Maciej.
+
+        Change _NC operators to use _IGNORING_CASE for clarity
+
+        * pcre/pcre_compile.cpp:
+        (find_fixedlength):
+        (compile_branch):
+        (find_firstassertedchar):
+        * pcre/pcre_exec.cpp:
+        (match):
+        * pcre/pcre_internal.h:
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mitz.
+
+        Remove branch from return
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        * pcre/pcre_exec.cpp:
+        (match):
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Add repeatInformationFromInstructionOffset inline
+
+        * pcre/pcre_exec.cpp:
+        (repeatInformationFromInstructionOffset):
+        (match):
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Remove no longer used error code JSRegExpErrorMatchLimit
+
+        * kjs/regexp.cpp:
+        (KJS::RegExp::match):
+        * pcre/pcre.h:
+        * pcre/pcre_internal.h:
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Make i locally scoped for better code clarity
+
+        * pcre/pcre_exec.cpp:
+        (match):
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Give subjectPtr and instructionPtr sane names, reduce size of MatchFrame for a 0.2% speedup.
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (calculateCompiledPatternLengthAndFlags):
+        * pcre/pcre_exec.cpp:
+        (match_ref):
+        (MatchStack::pushNewFrame):
+        (getUTF8CharAndIncrementLength):
+        (match):
+        * pcre/pcre_internal.h:
+        (getChar):
+        (getCharAndAdvance):
+        (getCharAndLength):
+        (getCharAndAdvanceIfSurrogate):
+        * pcre/pcre_xclass.cpp:
+        (getUTF8CharAndAdvancePointer):
+
+2007-11-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Small speedup (0.7%) by simplifying canUseStackBufferForNextFrame() check
+
+        * pcre/pcre_exec.cpp:
+        (MatchStack::MatchStack):
+        (MatchStack::popCurrentFrame):
+
+2007-11-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Lower MATCH_LIMIT_RECURSION to more sane levels to prevent hangs on run-javascriptcore-tests
+
+        * pcre/pcre_internal.h:
+
+2007-11-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Remove match_is_group variable for another 5% speedup
+
+        * pcre/pcre_compile.cpp:
+        * pcre/pcre_exec.cpp:
+        (startNewGroup):
+        (match):
+
+2007-11-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Abstract frame variables into locals and args
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        * pcre/pcre_exec.cpp:
+        (match):
+        * pcre/pcre_internal.h:
+
+2007-11-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Section off MatchData arguments into args struct
+
+        * pcre/pcre_exec.cpp:
+        (MatchStack::pushNewFrame):
+        (match):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Remove redundant eptrblock struct
+
+        * pcre/pcre_exec.cpp:
+        (MatchStack::pushNewFrame):
+        (match):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Remove redundant match_call_count and move recursion check out of super-hot code path
+        SunSpider says this is at least an 8% speedup for regexp.
+
+        * pcre/pcre_exec.cpp:
+        (MatchStack::MatchStack):
+        (MatchStack::pushNewFrame):
+        (MatchStack::popCurrentFrame):
+        (MatchStack::popAllFrames):
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Get rid of GETCHAR* macros, replacing them with better named inlines
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (calculateCompiledPatternLengthAndFlags):
+        * pcre/pcre_exec.cpp:
+        (match):
+        * pcre/pcre_internal.h:
+        (getCharAndAdvance):
+        (getCharAndLength):
+        (getCharAndAdvanceIfSurrogate):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Further cleanup GET/PUT inlines
+
+        * pcre/pcre_internal.h:
+        (putOpcodeValueAtOffset):
+        (getOpcodeValueAtOffset):
+        (putOpcodeValueAtOffsetAndAdvance):
+        (put2ByteOpcodeValueAtOffset):
+        (get2ByteOpcodeValueAtOffset):
+        (put2ByteOpcodeValueAtOffsetAndAdvance):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Give GET, PUT better names, and add (poor) moveOpcodePtrPastAnyAlternateBranches
+
+        * pcre/pcre_compile.cpp:
+        (firstSignificantOpCodeSkippingAssertions):
+        (find_fixedlength):
+        (complete_callout):
+        (compile_branch):
+        (compile_regex):
+        (is_anchored):
+        (canApplyFirstCharOptimization):
+        (find_firstassertedchar):
+        * pcre/pcre_exec.cpp:
+        (match):
+        * pcre/pcre_internal.h:
+        (putOpcodeValueAtOffset):
+        (getOpcodeValueAtOffset):
+        (putOpcodeValueAtOffsetAndAdvance):
+        (put2ByteOpcodeValueAtOffset):
+        (get2ByteOpcodeValueAtOffset):
+        (moveOpcodePtrPastAnyAlternateBranches):
+        * pcre/pcre_ucp_searchfuncs.cpp:
+        (_pcre_ucp_othercase):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Add inlines for toLowerCase, isWordChar, isSpaceChar for further regexp speedup
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+        (toLowerCase):
+        (flipCase):
+        (classBitmapForChar):
+        (charTypeForChar):
+        (isWordChar):
+        (isSpaceChar):
+        (CompileData::CompileData):
+        * pcre/pcre_xclass.cpp:
+        (_pcre_xclass):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        cleanup _pcre_ucp_othercase
+
+        * pcre/pcre_ucp_searchfuncs.cpp:
+        (_pcre_ucp_othercase):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Use better variable names for case ignoring options
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (find_firstassertedchar):
+        (printCompiledRegExp):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (match_ref):
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        split first_significant_code into two simpler functions
+
+        * pcre/pcre_compile.cpp:
+        (firstSignificantOpCode):
+        (firstSignificantOpCodeSkippingAssertions):
+        (is_anchored):
+        (canApplyFirstCharOptimization):
+        (find_firstassertedchar):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        clean up is_counted_repeat
+
+        * pcre/pcre_compile.cpp:
+        (is_counted_repeat):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        clean up check_escape
+
+        * pcre/pcre_compile.cpp:
+        (check_escape):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Reformat find_fixedlength
+
+        * pcre/pcre_compile.cpp:
+        (find_fixedlength):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        reformat is_anchored
+
+        * pcre/pcre_compile.cpp:
+        (is_anchored):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Remove unused function could_be_empty_branch
+
+        * pcre/pcre_compile.cpp:
+        (first_significant_code):
+        (find_fixedlength):
+        (compile_branch):
+        (canApplyFirstCharOptimization):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Pass around MatchData objects by reference
+
+        * pcre/pcre_exec.cpp:
+        (pchars):
+        (match_ref):
+        (match):
+        (jsRegExpExecute):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        give PCRE_STARTLINE a better name and rename match_data to MatchData
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (canApplyFirstCharOptimization):
+        (find_firstassertedchar):
+        (printCompiledRegExp):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (pchars):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Clean up find_firstassertedchar
+
+        * pcre/pcre_compile.cpp:
+        (get_othercase_range):
+        (find_firstassertedchar):
+        (calculateCompiledPatternLengthAndFlags):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Tim Hatcher.
+
+        Pass around CompileData& instead of CompileData*
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+        (jsRegExpCompile):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Clean up compile_branch, move _pcre_ord2utf8, and rename CompileData
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * pcre/pcre_compile.cpp:
+        (_pcre_ord2utf8):
+        (calculateCompiledPatternLengthAndFlags):
+        (jsRegExpCompile):
+        * pcre/pcre_internal.h:
+        * pcre/pcre_ord2utf8.cpp: Removed.
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        removing more macros
+
+        * pcre/pcre_compile.cpp:
+        (could_be_empty_branch):
+        (compile_branch):
+        (calculateCompiledPatternLengthAndFlags):
+        * pcre/pcre_exec.cpp:
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+        * pcre/pcre_xclass.cpp:
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        clean up formating in compile_branch
+
+        * pcre/pcre_compile.cpp:
+        (compile_branch):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Fix spacing for read_repeat_counts
+
+        * pcre/pcre_compile.cpp:
+        (read_repeat_counts):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Get rid of PCRE custom char types
+
+        * pcre/pcre_compile.cpp:
+        (check_escape):
+        (complete_callout):
+        (compile_branch):
+        (compile_regex):
+        (calculateCompiledPatternLengthAndFlags):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (match_ref):
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        reformat get_othercase_range
+
+        * pcre/pcre_compile.cpp:
+        (get_othercase_range):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Remove register keyword and more cleanup
+
+        * pcre/pcre_compile.cpp:
+        (find_fixedlength):
+        (compile_branch):
+        (is_anchored):
+        (is_startline):
+        (find_firstassertedchar):
+        (calculateCompiledPatternLengthAndFlags):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (MatchStack::canUseStackBufferForNextFrame):
+        (MatchStack::allocateNextFrame):
+        (MatchStack::pushNewFrame):
+        (MatchStack::frameIsStackAllocated):
+        (MatchStack::popCurrentFrame):
+        (MatchStack::unrollAnyHeapAllocatedFrames):
+        (getUTF8CharAndIncrementLength):
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+        (PUT2INC):
+        (isLeadingSurrogate):
+        (isTrailingSurrogate):
+        (decodeSurrogatePair):
+        (getChar):
+        * pcre/pcre_ord2utf8.cpp:
+        (_pcre_ord2utf8):
+        * pcre/pcre_xclass.cpp:
+        (getUTF8CharAndAdvancePointer):
+        (_pcre_xclass):
+
+2007-11-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Clean up jsRegExpExecute
+
+        * pcre/pcre_compile.cpp:
+        (returnError):
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+
+2007-11-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Merging updated system alloc and spinlock code from r38 of TCMalloc.
+
+        This is needed as a precursor to the merge of TCMalloc proper.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::TCMalloc_SpinLock):
+        (TCMalloc_SpinLock::):
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SpinLock::IsHeld):
+        * wtf/TCSystemAlloc.cpp:
+        (TrySbrk):
+        (TryMmap):
+        (TryVirtualAlloc):
+        (TryDevMem):
+        (TCMalloc_SystemAlloc):
+        * wtf/TCSystemAlloc.h:
+
+2007-11-28  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Geoff
+
+        Add copyKeysToVector utility, mirroring copyValuesToVector
+        Also change the copyValuesToVector implementation to be a little more attractive
+
+        * wtf/HashMap.h:
+        (WTF::copyKeysToVector):
+        (WTF::copyValuesToVector):
+
+2007-11-27  Alp Toker  <alp@atoker.com>
+
+        Reviewed by Mark Rowe.
+
+        Add a list of public JavaScriptCore headers for installation.
+
+        This follows the convention used for the Qt and GTK+ header lists.
+
+        * headers.pri: Added.
+
+2007-11-27  Alp Toker  <alp@atoker.com>
+
+        Prospective MSVC build fix.
+
+        Roll back dllexport/dllimport support for now.
+
+        * API/JSBase.h:
+
+2007-11-27  Alp Toker  <alp@atoker.com>
+
+        Reviewed by Maciej.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15569
+        [gtk] GTK JavaScriptCore needs to export symbols for JSC API and WTF
+
+        Introduce JS_EXPORT to mark symbols to be exported as public API.
+
+        Export all public symbols in the JavaScriptCore C API.
+
+        This matches conventions for exporting symbols set by the CF and CG
+        frameworks.
+
+        * API/JSBase.h:
+        * API/JSContextRef.h:
+        * API/JSObjectRef.h:
+        * API/JSStringRef.h:
+        * API/JSStringRefBSTR.h:
+        * API/JSStringRefCF.h:
+        * API/JSValueRef.h:
+
+2007-11-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam.
+
+        Make PropertyNameArray and ScopeChain COMEnumVariant friendly.
+        
+        * kjs/PropertyNameArray.cpp:
+        (KJS::PropertyNameArray::swap):
+        Implement PropertyNameArray::swap.
+        
+        * kjs/PropertyNameArray.h:
+        Add ValueType typedef. Replace PropertyNameArrayIterator with 
+        PropertyNameArray::const_iterator.
+        
+        * kjs/nodes.cpp:
+        (KJS::ForInNode::execute):
+        * kjs/scope_chain.cpp:
+        (KJS::ScopeChain::print):
+        Update for changes to PropertyNameArray.
+        
+        * kjs/scope_chain.h:
+        Add const_iterator and ValueType typedef.
+        
+2007-11-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin.
+
+        Add a ValueType typedef.
+        
+        * wtf/Vector.h:
+
+2007-11-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mitz.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16096
+          REGRESSION (r26653-r26699): Plaxo.com addressbook does not load in webkit nightlies
+
+        Test: fast/js/regexp-overflow.html
+
+        * pcre/pcre_compile.cpp: (calculateCompiledPatternLengthAndFlags):
+        Removed a stray "ptr++" that I added by accident when merging the
+        changes between PCRE 6.4 and 6.5. 
+
+2007-11-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Kevin McCullough.
+        
+        Fixed <rdar://problem/5597937> REGRESSION (r27126): Drosera does not 
+        show variables (can't enumerate ActivationImp properties)
+        
+        Implemented a custom ActivationImp::getPropertyNames, since 
+        ActivationImp now uses a custom property storage mechanism for local
+        variables.
+
+        * kjs/function.cpp:
+        (KJS::ActivationImp::getPropertyNames):
+        * kjs/function.h:
+
+2007-11-26  Alp Toker  <alp@atoker.com>
+
+        GTK+/Qt/Wx build fix for breakage introduced in r28039.
+
+        * ForwardingHeaders/JavaScriptCore/JSRetainPtr.h: Added.
+
+2007-11-24  Laszlo Gombos  <laszlo.gombos@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix minor compiler warning (GCC 4.1.3)
+
+        * pcre/pcre_internal.h:
+        * pcre/pcre_ucp_searchfuncs.cpp:
+        (_pcre_ucp_othercase):
+
+2007-11-25  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=16129
+        Bug 16129: REGRESSION (r27761-r27811): malloc error while visiting http://mysit.es (crashes release build)
+
+        * pcre/pcre_compile.cpp: Change errorcode to be passed by reference so that any error code is propagated
+        to our caller like they expect.
+
+2007-11-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        MSVC7 build fix. (rand_s doesn't exist there)
+
+        Reviewed by Adam Roben.
+
+        * kjs/config.h:
+        * wtf/MathExtras.h:
+
+2007-11-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Move WX_PYTHON logic into project build settings,
+        add WebKitLibraries dirs on Win, and explicitly include JSCore 
+        headers in testkjs rather than getting them from a template.
+        (Include dir order of JSCore/WTF and ICU headers is important due  
+        to wtf/unicode/utf8.h.)
+
+        * jscore.bkl:
+
+2007-11-23  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by George Staikos <staikos@kde.org>.
+
+        Fix make (dist)clean on Windows.
+        
+        OBJECTS_DIR_WTR does not exist anymore, use GENERATED_SOURCES_DIR.
+        
+
+        * JavaScriptCore.pri:
+        * pcre/pcre.pri:
+
+2007-11-22  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by George.
+
+        Make the directory of where to put the generated sources configurable through the GENERATED_SOURCE_DIR variable
+
+        * JavaScriptCore.pri:
+        * pcre/pcre.pri:
+
+2007-11-22  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by George.
+
+        Centralize the setup for all the extra compilers in a addExtraCompiler function.
+        
+        This allows adding a "generated_files" target that builds all generated files using "make generated_files".
+        For the build inside Qt we do not generate actual rules for the extra compilers but instead
+        do the variable substitution of compiler.output manually and add the generated sources to SOURCES.
+
+        * JavaScriptCore.pri:
+        * pcre/pcre.pri:
+
+2007-11-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/5602936> Need to resolve new GCC 4.2 warnings
+
+        Fix all warnings emitted by GCC 4.2 when building JavaScriptCore.  This allows builds with
+        -Werror to succeed.  At present they will crash when executed due to code that is not safe
+        under strict aliasing (<rdar://problem/5536806>).
+
+        * Configurations/Base.xcconfig: Remove the -Wno-long-double flag.
+        * kjs/date_object.cpp:
+        (KJS::formatTime): Test whether the stack-allocated string is empty rather than at a non-null address.
+        * kjs/dtoa.cpp:
+        (Bigint::): Tweak formatting to silence warnings.
+        * pcre/pcre_exec.cpp:
+        (match): Tweak formatting to silence warnings
+        * wtf/Assertions.cpp: Add printf format attribute to functions that warrant it.
+        * wtf/Assertions.h: Ditto.
+
+2007-11-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx port build fix (wx headers include ctype functions).
+
+        * kjs/config.h:
+
+2007-11-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Remove outdated and unused Windows port files.
+
+        Reviewed by Adam Roben.
+
+        * Makefile.vc: Removed.
+        * README-Win32.txt: Removed.
+
+2007-11-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver.
+
+        * tests/mozilla/jsDriver.pl: exit non-0 when user aborts test run
+
+2007-11-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix: <rdar://problem/5607032> REGRESSION: testapi exits with assertion failure in debug build
+             <rdar://problem/5440659> JSGlobalContextCreate throws away globalObjectClass's prototype
+             http://bugs.webkit.org/show_bug.cgi?id=16033
+
+        Split Interpreter's initialization into two distinct steps:  the creation of the global prototypes
+        and constructors, and storing them on the global object.  This allows JSClassRef's passed to
+        JSGlobalContextCreate to be instantiated with the correct prototype.
+
+        * API/JSCallbackObject.cpp: Assert at compile-time that the custom global object will fit in a collector cell.
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::JSCallbackObject):
+        (KJS::::init):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Construct and set the interpreter's global object separately.  When globalObjectClass
+        is passed we need to set the interpreter's global object before doing the JSCallbackObject's initialization to
+        prevent any JSObjectInitializeCallback's being invoked before a global object is set.
+        * API/testapi.c:
+        (globalObject_initialize): Test the object passed in is correct and that it has the expected global properties.
+        (globalObject_get):
+        (globalObject_set):
+        (main):
+        * API/testapi.js: Test that any static properties exposed by the global object's custom class are found.
+        * JavaScriptCore.exp:
+        * bindings/testbindings.cpp:
+        (main): Update for changes in Interpreter method signatures.
+        * bindings/testbindings.mm:
+        (main): Ditto.
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        (KJS::ExecState::mark):
+        (KJS::ExecState::setGlobalObject):
+        * kjs/ExecState.h: Rename scope to m_scopeChain.
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::Interpreter):
+        (KJS::Interpreter::init):
+        (KJS::Interpreter::globalObject):
+        (KJS::Interpreter::setGlobalObject):
+        (KJS::Interpreter::resetGlobalObjectProperties):
+        (KJS::Interpreter::createObjectsForGlobalObjectProperties):
+        (KJS::Interpreter::setGlobalObjectProperties): Switch to using putDirect to ensure that the global object's put method
+        cannot interfere with setting of the global properties.  This prevents a user-written JSClassRef from attempting to
+        call back into JavaScript from the initialization of the global object's members.
+        * kjs/interpreter.h:
+        * kjs/testkjs.cpp:
+        (setupInterpreter): Update for changes in Interpreter method signatures.
+
+2007-11-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Prevent testapi from reporting false leaks.  Clear out local variables pointing at
+        JSObjectRefs to allow their values to be collected.
+
+        * API/testapi.c:
+        (main):
+
+2007-11-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Prevent testapi from crashing if testapi.js can not be found by nil-checking the result of createStringWithContentsOfFile.
+
+        * API/testapi.c:
+        (main):
+
+2007-11-17  Alp Toker  <alp@atoker.com>
+
+        Reviewed by Eric.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16032
+        JS minidom is not portable
+
+        Use a plain UTF-8 string instead of a CFString.
+
+        Print to stdout, not stderr like CFShow() would have done, since that
+        behaviour seems unintentional.
+
+        * API/minidom.c:
+        (main):
+
+2007-11-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2007-11-16  Mark Rowe  <mrowe@apple.com>
+
+        Windows build fix.
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::record8):
+
+2007-11-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Eric.
+
+        Replace strings, identifier, buffer8 and buffer16 members of Lexer with vectors.
+        SunSpider claims this is a 0.7% speedup.
+
+        * kjs/lexer.cpp:
+        (KJS::Lexer::Lexer):
+        (KJS::Lexer::lex):
+        (KJS::Lexer::record8):
+        (KJS::Lexer::record16):
+        (KJS::Lexer::scanRegExp):
+        (KJS::Lexer::clear):
+        (KJS::Lexer::makeIdentifier):
+        (KJS::Lexer::makeUString):
+        * kjs/lexer.h:
+        * kjs/ustring.cpp:
+        (KJS::UString::UString): Add a convenience constructor that takes a const Vector<UChar>&.
+        * kjs/ustring.h:
+
+2007-11-16  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj: Add a new include path
+        and ignore the int -> bool conversion warning.
+
+2007-11-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Fix Windows debug build.
+        Rubber-stamped by Eric
+
+        * pcre/pcre_exec.cpp: (match): Removed ASSERT_NOT_REACHED assertions that were making MSVC
+        complain about unreachable code.
+
+2007-11-15  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/Parser.cpp:
+
+2007-11-15  Mark Rowe  <mrowe@apple.com>
+
+        Mac build and header search path sanity fix.
+
+        Reviewed by Sam Weinig and Tim Hatcher.
+
+        Move base setting for HEADER_SEARCH_PATHS into Base.xcconfig, and extend
+        it in JavaScriptCore.xcconfig.  This removes the need to override it on a
+        per-target basis inside the .xcodeproj file.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-11-15  Mark Rowe  <mrowe@apple.com>
+
+        Qt build fix.
+
+        * kjs/Parser.h:
+
+2007-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Another round of grammar / parsing cleanup.
+        
+        1. Created distinct parser calls for parsing function bodies vs
+        programs. This will help later with optimizing global variable access.
+        
+        2. Turned Parser into a singleton. Cleaned up Lexer's singleton 
+        interface.
+        
+        3. Modified Lexer to free a little more memory when done lexing. (Added
+        FIXMEs for similar issues that I didn't fix.)
+        
+        4. Changed Lexer::makeIdentifier and Lexer::makeUString to start 
+        respecting the arguments passed to them. (No behavior change, but this
+        problem could have caused serious problems for an unsuspecting user of
+        these functions.)
+        
+        5. Removed KJS_DEBUG_MEM because it was bit-rotted.
+        
+        6. Removed Parser::prettyPrint because the same work was simpler to do
+        at the call site.
+        
+        7. Some renames:
+        
+            "Parser::accept" => "Parser::didFinishParsing"
+            "Parser::sid" => "Parser::m_sourceID"
+            "Lexer::doneParsing" => "Lexer::clear"
+            "sid" => "sourceId"
+            "lineno" => "lineNo"
+        
+        * JavaScriptCore.exp:
+        * kjs/Parser.cpp:
+        (KJS::Parser::Parser):
+        (KJS::Parser::parseProgram):
+        (KJS::Parser::parseFunctionBody):
+        (KJS::Parser::parse):
+        (KJS::Parser::didFinishParsing):
+        (KJS::parser):
+        * kjs/Parser.h:
+        (KJS::Parser::sourceId):
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function_object.cpp:
+        (FunctionObjectImp::construct):
+        * kjs/grammar.y:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::checkSyntax):
+        (KJS::Interpreter::evaluate):
+        * kjs/interpreter.h:
+        * kjs/lexer.cpp:
+        (kjsyylex):
+        (KJS::lexer):
+        (KJS::Lexer::Lexer):
+        (KJS::Lexer::~Lexer):
+        (KJS::Lexer::scanRegExp):
+        (KJS::Lexer::doneParsing):
+        (KJS::Lexer::makeIdentifier):
+        (KJS::Lexer::makeUString):
+        * kjs/lexer.h:
+        (KJS::Lexer::pattern):
+        (KJS::Lexer::flags):
+        (KJS::Lexer::sawError):
+        * kjs/nodes.cpp:
+        (KJS::Node::Node):
+        (KJS::FunctionBodyNode::FunctionBodyNode):
+        * kjs/nodes.h:
+        * kjs/testkjs.cpp:
+        (prettyPrintScript):
+        (kjsmain):
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+
+2007-11-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        <rdar://problem/5601548> REGRESSION: All SourceElements and their children leak after a syntax error
+        
+        Add a stub node to maintain the Vector of SourceElements until assignment.
+
+        * kjs/grammar.y:
+        * kjs/nodes.h:
+        (KJS::SourceElementsStub::SourceElementsStub):
+        (KJS::SourceElementsStub::append):
+        (KJS::SourceElementsStub::release):
+        (KJS::SourceElementsStub::):
+        (KJS::SourceElementsStub::precedence):
+
+2007-11-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Abstract most of RMATCH into MatchStack functions.
+        
+        SunSpider claims this, combined with the last 2 patches was a 1% speedup, 10% for dna-regexp.
+
+        * pcre/pcre_exec.cpp:
+        (MatchStack::canUseStackBufferForNextFrame):
+        (MatchStack::allocateNextFrame):
+        (MatchStack::pushNewFrame):
+        (MatchStack::frameIsStackAllocated):
+        (MatchStack::popCurrentFrame):
+        (MatchStack::unrollAnyHeapAllocatedFrames):
+        (match):
+
+2007-11-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Remove RETURN_ERROR, add MatchStack
+        
+        * pcre/pcre_exec.cpp:
+        (MatchStack::MatchStack):
+        (MatchStack::unrollAnyHeapAllocatedFrames):
+        (matchError):
+        (match):
+        
+2007-11-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Clean up match function to match WebKit style
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * pcre/pcre_exec.cpp:
+        (match):
+
+2007-11-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2007-11-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15982
+        Improve JSString UTF-8 decoding
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithUTF8CString): Use strict decoding, return 0 on error.
+
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::convertUTF16ToUTF8):
+        (WTF::Unicode::convertUTF8ToUTF16):
+        * wtf/unicode/UTF8.h:
+        Made these function names start with a lower case letter.
+
+        * kjs/ustring.cpp: (KJS::UString::UTF8String): Updated for the above renaming.
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertUTF8ToUTF16WithLatin1Fallback): Renamed to highlight the difference
+        from convertUTF8ToUTF16 in wtf/unicode.
+        (KJS::Bindings::convertNPStringToUTF16): Updated for the above renaming.
+        (KJS::Bindings::identifierFromNPIdentifier): Ditto.
+        * bindings/c/c_utility.h: Made convertUTF8ToUTF16WithLatin1Fallback() a file static.
+
+2007-11-14  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Anders.
+
+        Fix the Xcode project file after it was messed up in r27402.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-11-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver.
+        
+        More PCRE style cleanup.
+
+        * pcre/pcre_compile.cpp:
+        (compile_regex):
+
+2007-11-14  Adam Roben  <aroben@apple.com>
+
+        Clean up the bison conflict checking script
+
+        Reviewed by Geoff.
+
+        * DerivedSources.make:
+
+2007-11-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Geoff.
+
+        Another round of PCRE cleanups: inlines
+        
+        SunSpider claims that this, combined with my previous PCRE cleanup were a 0.7% speedup, go figure.
+
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile):
+        * pcre/pcre_exec.cpp:
+        (match):
+        (jsRegExpExecute):
+        * pcre/pcre_internal.h:
+        (PUT):
+        (GET):
+        (PUT2):
+        (GET2):
+        (isNewline):
+
+2007-11-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+        
+        Give PCRE a (small) bath.
+        Fix some formating and break things off into separate functions
+        http://bugs.webkit.org/show_bug.cgi?id=15993
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLengthAndFlags):
+        (printCompiledRegExp):
+        (returnError):
+        (jsRegExpCompile):
+        * pcre/pcre_internal.h:
+        (compile_data::compile_data):
+
+2007-11-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel.
+        
+        Cleaned up the JavaScript grammar a bit.
+        
+        1. Changed BlockNode to always hold a child vector (which may be empty),
+        eliminating a few NULL-check branches in the common execution case.
+        
+        2. Changed the Block production to correctly report its starting and 
+        ending line numbers to the debugger. (It used to report its ending line
+        as its starting line.) Also, removed duplicate line-reporting code
+        inside the BlockNode constructor.
+        
+        3. Moved curly braces up from FunctionBody production into parent
+        productions. (I had to move the line number reporting code, too, since
+        it depends on the location of the curly braces.) This matches the ECMA
+        spec more closely, and makes some future changes I plan easier.
+        
+        4. Fixed statementList* convenience functions to deal appropriately with
+        empty Vectors.
+
+        SunSpider reports a small and statistically insignificant speedup.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::statementListPushFIFO):
+        (KJS::statementListGetDeclarations):
+        (KJS::statementListInitializeDeclarationStack):
+        (KJS::statementListInitializeVariableAccessStack):
+        (KJS::BlockNode::BlockNode):
+        (KJS::BlockNode::optimizeVariableAccess):
+        (KJS::BlockNode::getDeclarations):
+        (KJS::BlockNode::execute):
+        (KJS::FunctionBodyNode::initializeDeclarationStacks):
+        (KJS::FunctionBodyNode::optimizeVariableAccess):
+
+2007-11-13  Anders Carlsson  <andersca@apple.com>
+
+        Add RefCounted.h (And remove Shared.h)
+        
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2007-11-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * kjs/regexp.h:
+
+2007-11-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Renamed Shared to RefCounted.
+
+        * API/JSClassRef.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/interpreter.h:
+        * kjs/regexp.h:
+        * wtf/RefCounted.h: Copied from JavaScriptCore/wtf/Shared.h.
+        (WTF::RefCounted::RefCounted):
+        * wtf/Shared.h: Removed.
+
+2007-11-13  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        Reviewed by Geoff.
+
+        * kjs/regexp.h: Added a missing #include.
+
+2007-11-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Moved Shared.h into wtf so it could be used in more places. Deployed
+        Shared in places where JSCore previously had hand-rolled ref-counting
+        classes.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * API/JSClassRef.h:
+        * API/JSObjectRef.cpp:
+        (JSClassRetain):
+        (JSClassRelease):
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::init):
+        * kjs/interpreter.h:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        * kjs/regexp.h:
+        * wtf/Shared.h: Copied from WebCore/platform/Shared.h.
+
+2007-11-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Add an ASSERT to getTruncatedInt32 to enforce proper usage.
+        Best part about this patch?  It doesn't break the web!
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::getTruncatedInt32):
+        (KJS::JSImmediate::toDouble):
+        (KJS::JSImmediate::getUInt32):
+
+2007-11-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertUTF8ToUTF16):
+        * kjs/ustring.cpp:
+        (KJS::UString::UTF8String):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::ConvertUTF8ToUTF16):
+
+2007-11-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=11231
+          RegExp bug when handling newline characters
+          and a number of other differences between PCRE behvior
+          and JavaScript regular expressions:
+
+          + single-digit sequences like \4 should be treated as octal
+            character constants, unless there is a sufficient number
+            of brackets for them to be treated as backreferences
+
+          + \8 turns into the character "8", not a binary zero character
+            followed by "8" (same for 9)
+
+          + only the first 3 digits should be considered part of an
+            octal character constant (the old behavior was to decode
+            an arbitrarily long sequence and then mask with 0xFF)
+
+          + if \x is followed by anything other than two valid hex digits,
+            then it should simply be treated a the letter "x"; that includes
+            not supporting the \x{41} syntax
+
+          + if \u is followed by anything less than four valid hex digits,
+            then it should simply be treated a the letter "u"
+
+          + an extra "+" should be a syntax error, rather than being treated
+            as the "possessive quantifier"
+
+          + if a "]" character appears immediately after a "[" character that
+            starts a character class, then that's an empty character class,
+            rather than being the start of a character class that includes a
+            "]" character
+
+          + a "$" should not match a terminating newline; we could have gotten
+            PCRE to handle this the way we wanted by passing an appropriate option
+
+        Test: fast/js/regexp-no-extensions.html
+
+        * pcre/pcre_compile.cpp:
+        (check_escape): Check backreferences against bracount to catch both
+        overflows and things that should be treated as octal. Rewrite octal
+        loop to not go on indefinitely. Rewrite both hex loops to match and
+        remove \x{} support.
+        (compile_branch): Restructure loops so that we don't special-case a "]"
+        at the beginning of a character class. Remove code that treated "+" as
+        the possessive quantifier.
+        (jsRegExpCompile): Change the "]" handling here too.
+
+        * pcre/pcre_exec.cpp: (match): Changed CIRC to match the DOLL implementation.
+        Changed DOLL to remove handling of "terminating newline", a Perl concept
+        which we don't need.
+
+        * tests/mozilla/expected.html: Two tests are fixed now:
+        ecma_3/RegExp/regress-100199.js and ecma_3/RegExp/regress-188206.js.
+        One test fails now: ecma_3/RegExp/perlstress-002.js -- our success before
+        was due to a bug (we treated all 1-character numeric escapes as backreferences).
+        The date tests also now both expect success -- whatever was making them fail
+        before was probably due to the time being close to a DST shift; maybe we need
+        to get rid of those tests.
+
+2007-11-13  Darin Adler  <darin@apple.com>
+
+        * kjs/JSImmediate.h: (KJS::JSImmediate::getTruncatedInt32):
+        Remove too-strong assert that was firing constantly and preventing even basic
+        web browsing from working in a debug build. This function is used in many
+        cases where the immediate value is not a number; the assertion could perhaps
+        be added back later with a bit of reorganization.
+
+2007-11-13  Alp Toker  <alp@atoker.com>
+
+        Build fix for breakage to non-Mac builds introduced in r27746.
+
+        * kjs/ustring.cpp:
+
+2007-11-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+
+        Clean up evaluateToBoolean functions to use inlines instead of copy/paste code
+
+        * kjs/JSImmediate.h:
+        * kjs/nodes.cpp:
+        (KJS::GreaterNode::inlineEvaluateToBoolean):
+        (KJS::GreaterNode::evaluate):
+        (KJS::LessEqNode::inlineEvaluateToBoolean):
+        (KJS::LessEqNode::evaluate):
+        (KJS::GreaterEqNode::inlineEvaluateToBoolean):
+        (KJS::GreaterEqNode::evaluate):
+        (KJS::InNode::evaluateToBoolean):
+        (KJS::EqualNode::inlineEvaluateToBoolean):
+        (KJS::EqualNode::evaluate):
+        (KJS::NotEqualNode::inlineEvaluateToBoolean):
+        (KJS::NotEqualNode::evaluate):
+        (KJS::StrictEqualNode::inlineEvaluateToBoolean):
+        (KJS::StrictEqualNode::evaluate):
+        (KJS::NotStrictEqualNode::inlineEvaluateToBoolean):
+        (KJS::NotStrictEqualNode::evaluate):
+        * kjs/nodes.h:
+
+2007-11-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=15958
+        base64 spends 1.1% of total time checking for special Infinity case
+        
+        Use a fast character test instead of calling strncmp.
+        
+        1.1% speedup on string-base64. SunSpider reports a .4% speedup overall;
+        Sharks reports only .1%. Who are you going to believe? Huh?
+
+        * kjs/ustring.cpp:
+        (KJS::UString::toDouble):
+
+2007-11-12  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver.
+
+        Add evaluateToInt32 and evaluateUInt32 methods and deploy them.
+        Fix a few missing evaluateToBoolean methods
+        Deploy all evaluateTo* functions to more nodes to avoid slowdowns
+        http://bugs.webkit.org/show_bug.cgi?id=15950
+        
+        SunSpider claims this is at least a 1.4% speedup.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::getTruncatedInt32):
+        (KJS::JSImmediate::toDouble):
+        (KJS::JSImmediate::getUInt32):
+        * kjs/nodes.cpp:
+        (KJS::ExpressionNode::evaluateToNumber):
+        (KJS::ExpressionNode::evaluateToInt32):
+        (KJS::ExpressionNode::evaluateToUInt32):
+        (KJS::NumberNode::evaluateToInt32):
+        (KJS::NumberNode::evaluateToUInt32):
+        (KJS::ImmediateNumberNode::evaluateToInt32):
+        (KJS::ImmediateNumberNode::evaluateToUInt32):
+        (KJS::ResolveNode::evaluate):
+        (KJS::ResolveNode::evaluateToNumber):
+        (KJS::ResolveNode::evaluateToBoolean):
+        (KJS::ResolveNode::evaluateToInt32):
+        (KJS::ResolveNode::evaluateToUInt32):
+        (KJS::LocalVarAccessNode::evaluateToInt32):
+        (KJS::LocalVarAccessNode::evaluateToUInt32):
+        (KJS::BracketAccessorNode::evaluateToNumber):
+        (KJS::BracketAccessorNode::evaluateToBoolean):
+        (KJS::BracketAccessorNode::evaluateToInt32):
+        (KJS::BracketAccessorNode::evaluateToUInt32):
+        (KJS::DotAccessorNode::inlineEvaluate):
+        (KJS::DotAccessorNode::evaluate):
+        (KJS::DotAccessorNode::evaluateToNumber):
+        (KJS::DotAccessorNode::evaluateToBoolean):
+        (KJS::DotAccessorNode::evaluateToInt32):
+        (KJS::DotAccessorNode::evaluateToUInt32):
+        (KJS::NewExprNode::inlineEvaluate):
+        (KJS::NewExprNode::evaluate):
+        (KJS::NewExprNode::evaluateToNumber):
+        (KJS::NewExprNode::evaluateToBoolean):
+        (KJS::NewExprNode::evaluateToInt32):
+        (KJS::NewExprNode::evaluateToUInt32):
+        (KJS::FunctionCallResolveNode::inlineEvaluate):
+        (KJS::FunctionCallResolveNode::evaluate):
+        (KJS::FunctionCallResolveNode::evaluateToNumber):
+        (KJS::FunctionCallResolveNode::evaluateToBoolean):
+        (KJS::FunctionCallResolveNode::evaluateToInt32):
+        (KJS::FunctionCallResolveNode::evaluateToUInt32):
+        (KJS::LocalVarFunctionCallNode::evaluate):
+        (KJS::LocalVarFunctionCallNode::evaluateToNumber):
+        (KJS::LocalVarFunctionCallNode::evaluateToBoolean):
+        (KJS::LocalVarFunctionCallNode::evaluateToInt32):
+        (KJS::LocalVarFunctionCallNode::evaluateToUInt32):
+        (KJS::FunctionCallDotNode::evaluate):
+        (KJS::FunctionCallDotNode::evaluateToNumber):
+        (KJS::FunctionCallDotNode::evaluateToBoolean):
+        (KJS::FunctionCallDotNode::evaluateToInt32):
+        (KJS::FunctionCallDotNode::evaluateToUInt32):
+        (KJS::PostDecLocalVarNode::inlineEvaluateToNumber):
+        (KJS::PostDecLocalVarNode::evaluateToNumber):
+        (KJS::PostDecLocalVarNode::evaluateToBoolean):
+        (KJS::PostDecLocalVarNode::evaluateToInt32):
+        (KJS::PostDecLocalVarNode::evaluateToUInt32):
+        (KJS::typeStringForValue):
+        (KJS::UnaryPlusNode::evaluate):
+        (KJS::UnaryPlusNode::evaluateToBoolean):
+        (KJS::UnaryPlusNode::evaluateToNumber):
+        (KJS::UnaryPlusNode::evaluateToInt32):
+        (KJS::BitwiseNotNode::inlineEvaluateToInt32):
+        (KJS::BitwiseNotNode::evaluate):
+        (KJS::BitwiseNotNode::evaluateToNumber):
+        (KJS::BitwiseNotNode::evaluateToBoolean):
+        (KJS::BitwiseNotNode::evaluateToInt32):
+        (KJS::MultNode::evaluateToBoolean):
+        (KJS::MultNode::evaluateToInt32):
+        (KJS::MultNode::evaluateToUInt32):
+        (KJS::DivNode::evaluateToInt32):
+        (KJS::DivNode::evaluateToUInt32):
+        (KJS::ModNode::evaluateToBoolean):
+        (KJS::ModNode::evaluateToInt32):
+        (KJS::ModNode::evaluateToUInt32):
+        (KJS::AddNode::evaluateToNumber):
+        (KJS::AddNode::evaluateToInt32):
+        (KJS::AddNode::evaluateToUInt32):
+        (KJS::AddNumbersNode::evaluateToInt32):
+        (KJS::AddNumbersNode::evaluateToUInt32):
+        (KJS::SubNode::evaluateToInt32):
+        (KJS::SubNode::evaluateToUInt32):
+        (KJS::LeftShiftNode::inlineEvaluateToInt32):
+        (KJS::LeftShiftNode::evaluate):
+        (KJS::LeftShiftNode::evaluateToNumber):
+        (KJS::LeftShiftNode::evaluateToInt32):
+        (KJS::RightShiftNode::inlineEvaluateToInt32):
+        (KJS::RightShiftNode::evaluate):
+        (KJS::RightShiftNode::evaluateToNumber):
+        (KJS::RightShiftNode::evaluateToInt32):
+        (KJS::UnsignedRightShiftNode::inlineEvaluateToUInt32):
+        (KJS::UnsignedRightShiftNode::evaluate):
+        (KJS::UnsignedRightShiftNode::evaluateToNumber):
+        (KJS::UnsignedRightShiftNode::evaluateToInt32):
+        (KJS::LessNode::inlineEvaluateToBoolean):
+        (KJS::LessNode::evaluate):
+        (KJS::LessNode::evaluateToBoolean):
+        (KJS::LessNumbersNode::inlineEvaluateToBoolean):
+        (KJS::LessNumbersNode::evaluate):
+        (KJS::LessNumbersNode::evaluateToBoolean):
+        (KJS::LessStringsNode::inlineEvaluateToBoolean):
+        (KJS::LessStringsNode::evaluate):
+        (KJS::BitAndNode::evaluate):
+        (KJS::BitAndNode::inlineEvaluateToInt32):
+        (KJS::BitAndNode::evaluateToNumber):
+        (KJS::BitAndNode::evaluateToBoolean):
+        (KJS::BitAndNode::evaluateToInt32):
+        (KJS::BitXOrNode::inlineEvaluateToInt32):
+        (KJS::BitXOrNode::evaluate):
+        (KJS::BitXOrNode::evaluateToNumber):
+        (KJS::BitXOrNode::evaluateToBoolean):
+        (KJS::BitXOrNode::evaluateToInt32):
+        (KJS::BitOrNode::inlineEvaluateToInt32):
+        (KJS::BitOrNode::evaluate):
+        (KJS::BitOrNode::evaluateToNumber):
+        (KJS::BitOrNode::evaluateToBoolean):
+        (KJS::BitOrNode::evaluateToInt32):
+        (KJS::ConditionalNode::evaluateToNumber):
+        (KJS::ConditionalNode::evaluateToInt32):
+        (KJS::ConditionalNode::evaluateToUInt32):
+        (KJS::valueForReadModifyAssignment):
+        (KJS::AssignExprNode::evaluate):
+        (KJS::AssignExprNode::evaluateToBoolean):
+        (KJS::AssignExprNode::evaluateToNumber):
+        (KJS::AssignExprNode::evaluateToInt32):
+        (KJS::VarDeclNode::handleSlowCase):
+        * kjs/nodes.h:
+        (KJS::FunctionCallResolveNode::precedence):
+        (KJS::AddNode::precedence):
+        (KJS::AddNode::):
+        (KJS::LessNumbersNode::):
+        (KJS::LessStringsNode::):
+        * kjs/value.cpp:
+        (KJS::JSValue::toInt32SlowCase):
+        (KJS::JSValue::toUInt32SlowCase):
+        * kjs/value.h:
+        (KJS::JSValue::asCell):
+        (KJS::JSValue::toInt32):
+        (KJS::JSValue::toUInt32):
+
+2007-11-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15953
+        Add UTF-8 encoding/decoding to WTF
+
+        * kjs/ustring.h: Moved UTF8SequenceLength() and decodeUTF8Sequence() to wtf/unicode.
+        * kjs/ustring.cpp: (KJS::UString::UTF8String): Changed this function to take a strict/lenient
+        parameter. Callers are not interested in getting decoding results in strict mode, so 
+        this allows for bailing out as soon as an error is seen.
+
+        * kjs/function.cpp:
+        (KJS::encode): Updated for new UString::UTF8String() signature.
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters): Disambiguate UChar.
+        (JSStringCreateWithUTF8CString): Actually use UTF-8 when creating the string!
+        * bindings/c/c_utility.cpp: (KJS::Bindings::convertUTF8ToUTF16): Use ConvertUTF8ToUTF16().
+
+        * wtf/unicode/UTF8.cpp: Added.
+        (WTF::Unicode::inlineUTF8SequenceLengthNonASCII):
+        (WTF::Unicode::inlineUTF8SequenceLength):
+        (WTF::Unicode::UTF8SequenceLength):
+        (WTF::Unicode::decodeUTF8Sequence):
+        (WTF::Unicode::):
+        (WTF::Unicode::ConvertUTF16ToUTF8):
+        (WTF::Unicode::isLegalUTF8):
+        (WTF::Unicode::ConvertUTF8ToUTF16):
+        * wtf/unicode/UTF8.h: Added.
+        (WTF::Unicode::):
+        Some code moved from ustring.h, some adapted from unicode.org sources.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        Added UTF8.{h,cpp}
+
+2007-11-12  Josh Aas  <joshmoz@gmail.com>
+
+        Reviewed by Darin.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15946
+          add NPPValue NPPVpluginDrawingModel (Mozilla bug 403418 compat)
+
+        * bindings/npapi.h:
+
+2007-11-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15951
+          REGRESSION: assertion failure in regexp match() when running JS tests
+
+        Test: fast/js/regexp-many-brackets.html
+
+        * pcre/pcre_exec.cpp: (match): Added back accidentally-removed case for
+        the BRANUMBER opcode.
+
+2007-11-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix use of prefix and config.h, got rid of a few unneeded things in
+          the PCRE code; no behavior changes
+
+        * API/JSBase.cpp: Added include of config.h.
+        * API/JSCallbackConstructor.cpp: Ditto.
+        * API/JSCallbackFunction.cpp: Ditto.
+        * API/JSCallbackObject.cpp: Ditto.
+        * API/JSClassRef.cpp: Ditto.
+        * API/JSContextRef.cpp: Ditto.
+        * API/JSObjectRef.cpp: Ditto.
+        * API/JSStringRef.cpp: Ditto.
+        * API/JSValueRef.cpp: Ditto.
+
+        * JavaScriptCorePrefix.h: Removed obsolete <ctype.h> workaround.
+        Moved new/delete macros after includes, as they are in WebCore's prefix.
+        Removed "config.h".
+
+        * pcre/dftables.cpp: (main): Changed back to not use a separate maketables
+        function. This is needed for PCRE, but not helpful for our use. Also changed
+        the tables to all be 128 entries long instead of 256, since only the first
+        128 are ever used.
+
+        * pcre/pcre_compile.cpp: Added include of config.h. Eliminated digitab,
+        which was only being used to check hex digits. Changed all uses of TRUE and
+        FALSE to use the C++ true and false instead.
+        (check_escape): Just the TRUE/FALSE thing.
+        (is_counted_repeat): Ditto.
+        (could_be_empty_branch): Ditto.
+        (get_othercase_range): Ditto.
+        (compile_branch): Ditto.
+        (compile_regex): Ditto.
+        (is_anchored): Ditto.
+        (is_startline): Ditto.
+        (find_firstassertedchar): Ditto.
+        (jsRegExpCompile): Ditto.
+
+        * pcre/pcre_exec.cpp: Added include of config.h. Changed all uses of TRUE and
+        FALSE to use the C++ true and false instead.
+        (match_ref): Just the TRUE/FALSE thing.
+        (match): Ditto. Removed some unneeded braces.
+        (jsRegExpExecute): Just the TRUE/FALSE thing.
+
+        * pcre/pcre_internal.h: Moved the constants needed by dftables.cpp to the top
+        of the file instead of the bottom, so they can be used. Also changed the table
+        sizes to 128 instead of 256. Removed macro definitions of FALSE and TRUE.
+        Set array sizes for all the const arrays. Changed _pcre_utf8_table1_size to
+        be a macro instead of a extern int.
+
+        * pcre/pcre_maketables.cpp: Removed. It's all in dftables.cpp now.
+
+        * pcre/pcre_tables.cpp: Made table sizes explicit.
+
+        * pcre/pcre_xclass.cpp: Just the TRUE/FALSE thing.
+
+2007-11-12  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * wtf/FastMalloc.h: Add missing using statement.
+
+2007-11-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        Add special fastZeroedMalloc function to replace a 
+        number of fastCalloc calls where one argument was 1.
+        
+        This results in a 0.4% progression in SunSpider, more
+        than making up for the earlier regression caused by 
+        additional overflow checks.
+
+        * JavaScriptCore.exp:
+        * kjs/array_instance.cpp:
+        * kjs/property_map.cpp:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/HashTable.h:
+
+2007-11-11  Adam Roben  <aroben@apple.com>
+
+        Fix <rdar://5578982> ASSERT in HashTable::checkTableConsistencyExceptSize beneath WebNotificationCenter
+
+        The bug was due to a mismatch between HashMap::remove and
+        HashTable::checkTableConsistency. HashMap::remove can delete the value
+        stored in the HashTable (by derefing it), which is not normally
+        allowed by HashTable. It's OK in this case because the value is about
+        to be removed from the table, but HashTable wasn't aware of this.
+
+        HashMap::remove now performs the consistency check itself before
+        derefing the value.
+
+        Darin noticed that the same bug would occur in HashSet, so I've fixed
+        it there as well.
+
+        Reviewed by Darin.
+
+        * wtf/HashMap.h:
+        (WTF::HashMap::remove): Perform the HashTable consistency check
+        manually before calling deref.
+        * wtf/HashSet.h:
+        (WTF::HashSet::remove): Ditto.
+        * wtf/HashTable.h: Made checkTableConsistency public so that HashMap
+        and HashSet can call it.
+        (WTF::HashTable::removeAndInvalidateWithoutEntryConsistencyCheck):
+        Added.
+        (WTF::HashTable::removeAndInvalidate): Added.
+        (WTF::HashTable::remove):
+        (WTF::HashTable::removeWithoutEntryConsistencyCheck): Added.
+
+2007-11-11  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Use the correct filename case.
+
+        * kjs/nodes.h:
+
+2007-11-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=15902
+        15% of string-validate-input.js is spent compiling the same regular expression
+        
+        Store a compiled representation of the regular expression in the AST.
+        
+        Only a .2% SunSpider speedup overall, but a 10.6% speedup on 
+        string-validate-input.js.
+
+        * kjs/nodes.cpp:
+        (KJS::RegExpNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::RegExpNode::):
+        * kjs/nodes2string.cpp:
+        (KJS::RegExpNode::streamTo):
+        * kjs/regexp.cpp:
+        (KJS::RegExp::flags):
+        * kjs/regexp.h:
+        (KJS::RegExp::pattern):
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpObjectImp::construct):
+        (KJS::RegExpObjectImp::createRegExpImp):
+        * kjs/regexp_object.h:
+
+2007-11-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric.
+
+        Partial fix for <rdar://problem/5585334> numfuzz: integer overflows opening malformed SVG file in WebCore::ImageBuffer::create
+
+        Unfortunately this is a very slight regression, but is unavoidable.
+
+        * wtf/FastMalloc.cpp:
+
+2007-11-10  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+        
+        Add simple type inferencing to the parser, and create custom
+        AddNode and LessNode subclasses based on inferred types.
+        http://bugs.webkit.org/show_bug.cgi?id=15884
+        
+        SunSpider claims this is at least a 0.5% speedup.
+
+        * JavaScriptCore.exp:
+        * kjs/grammar.y:
+        * kjs/internal.cpp:
+        (KJS::NumberImp::getPrimitiveNumber):
+        (KJS::GetterSetterImp::getPrimitiveNumber):
+        * kjs/internal.h:
+        * kjs/lexer.cpp:
+        (KJS::Lexer::lex):
+        * kjs/nodes.cpp:
+        (KJS::Node::Node):
+        (KJS::StringNode::evaluate):
+        (KJS::StringNode::evaluateToNumber):
+        (KJS::StringNode::evaluateToBoolean):
+        (KJS::RegExpNode::evaluate):
+        (KJS::UnaryPlusNode::optimizeVariableAccess):
+        (KJS::AddNode::evaluate):
+        (KJS::AddNode::evaluateToNumber):
+        (KJS::AddNumbersNode::inlineEvaluateToNumber):
+        (KJS::AddNumbersNode::evaluate):
+        (KJS::AddNumbersNode::evaluateToNumber):
+        (KJS::AddStringsNode::evaluate):
+        (KJS::AddStringLeftNode::evaluate):
+        (KJS::AddStringRightNode::evaluate):
+        (KJS::lessThan):
+        (KJS::lessThanEq):
+        (KJS::LessNumbersNode::evaluate):
+        (KJS::LessStringsNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::ExpressionNode::):
+        (KJS::RegExpNode::):
+        (KJS::RegExpNode::precedence):
+        (KJS::TypeOfResolveNode::):
+        (KJS::LocalVarTypeOfNode::):
+        (KJS::UnaryPlusNode::):
+        (KJS::UnaryPlusNode::precedence):
+        (KJS::AddNode::):
+        (KJS::AddNode::precedence):
+        (KJS::AddNumbersNode::):
+        (KJS::AddStringLeftNode::):
+        (KJS::AddStringRightNode::):
+        (KJS::AddStringsNode::):
+        (KJS::LessNode::):
+        (KJS::LessNode::precedence):
+        (KJS::LessNumbersNode::):
+        (KJS::LessStringsNode::):
+        * kjs/nodes2string.cpp:
+        (KJS::StringNode::streamTo):
+        * kjs/object.cpp:
+        * kjs/object.h:
+        * kjs/value.h:
+        (KJS::JSValue::getPrimitiveNumber):
+
+2007-11-11  Darin Adler  <darin@apple.com>
+
+        - try another way of fixing dftables builds -- refactor pcre_internal.h a bit
+
+        * pcre/pcre_internal.h: Make most of this header do nothing when DFTABLES is set.
+        Later we can break it into two files.
+
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj: Take out now-unneeded include paths.
+        * pcre/dftables.cpp: Set DFTABLES. Use delete instead of free.
+        * pcre/dftables.pro: Take out now-unneeded include paths.
+        * pcre/pcre_maketables.cpp: Use new instead of malloc.
+
+2007-11-11  Darin Adler  <darin@apple.com>
+
+        * pcre/dftables.pro: Try fixing Qt builds (I looked at qt-win) by adding
+        another include path.
+
+2007-11-11  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Try fixing Mac Tiger builds
+        by adding another include path.
+
+2007-11-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15924
+          next round of changes to JSRegExp (formerly PCRE)
+
+        This is a combination of converting to C++, tweaking the API, and adding
+        some additional optimizations.
+
+        Future steps will involve getting rid of the use of UTF-8 completely
+        (we'll use UTF-16 exclusively instead), eliminating more source files,
+        and some more speed-ups.
+
+        SunSpider says the current round is an 0.9% speed-up overall, and a
+        5.3% speed-up for regexp.
+
+        * JavaScriptCore.exp: Updated for new entry points.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+        Updated for new source file names and ForwardingHeaders.
+
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Changed to use the error message without calling
+        strdup on it and to pass the new types and options.
+        (KJS::RegExp::~RegExp): Removed the now-unneeded free of the error message.
+        (KJS::RegExp::match): Pass the new types and options.
+        * kjs/regexp.h: Update type of m_constructionError.
+
+        * pcre/AUTHORS: Update to reflect the status of the project -- we don't include
+        the Google parts, and this isn't the PCRE library, per se.
+        * pcre/COPYING: Ditto.
+
+        * pcre/dftables.cpp: Copied from JavaScriptCore/pcre/dftables.c.
+        (main): Removed unneeded ctype_digit.
+
+        * pcre/pcre.h: Convert to C++, tweak API a bit. Use UChar instead of JSRegExpChar.
+
+        * pcre/pcre_compile.cpp: Copied from JavaScriptCore/pcre/pcre_compile.c.
+        Moved a lot of private stuff used only within this file here from pcre_internal.h.
+        Renumbered the error codes.
+        (error_text): Use a single string with embedded nulls for the error text (I got
+        this idea from newer versions of PCRE).
+        (check_escape): Changed return type to be enum instead of int. Replaced ctype_digit
+        uses with isASCIIDigit.
+        (is_counted_repeat): Ditto.
+        (read_repeat_counts): Ditto.
+        (first_significant_code): Ditto.
+        (find_fixedlength): Ditto.
+        (could_be_empty_branch): Ditto.
+        (compile_branch): Ditto. Also removed some code that handles changing options.
+        JavaScript doesn't have any of the features that allow options to change.
+        (compile_regex): Updated for change to options parameter.
+        (is_anchored): Ditto.
+        (find_firstassertedchar): Ditto.
+        (jsRegExpCompile): Changed to take separate flags instead of an options int.
+        Also changed to call new/delete instead of pcre_malloc/free.
+        (jsRegExpFree): Ditto.
+
+        * pcre/pcre_exec.cpp: Copied from JavaScriptCore/pcre/pcre_exec.c.
+        Added a case that uses computed goto for the opcode loop, but did not turn it on.
+        Changed the RMATCH macro to handle returns more efficiently by putting the where
+        pointer in the new frame instead of the old one, allowing us to branch to the
+        return with a single statement. Switched to new/delete from pcre_malloc/free.
+        Changed many RRETURN callers to not set the return value since it's already
+        set correctly. Replaced the rrc variable with an is_match variable. Values other
+        than "match" and "no match" are now handled differently. This allows us to remove
+        the code to check for those cases in various rules.
+        (match): All the case statements use a macro BEGIN_OPCODE instead. And all the
+        continue statements, or break statements that break out of the outer case use
+        a macro NEXT_OPCODE instead. Replaced a few if statements with assertions.
+        (jsRegExpExecute): Use new/delete instead of pcre_malloc/free. Removed unused
+        start_match field from the match block.
+
+        * pcre/pcre_internal.h: Moved the last few configuration macros from pcre-config.h
+        in here. Removed various unused types. Converted from JSRegExpChar to UChar.
+        Eliminated pcre_malloc/free. Replaced the opcode enum with a macro that can be
+        used in multiple places. Unfortunately we lose the comments for each opcode; we
+        should find a place to put those back. Removed ctype_digit.
+
+        * pcre/pcre_maketables.cpp: Copied from JavaScriptCore/pcre/pcre_maketables.c.
+        (pcre_maketables): Got rid of the conditional code that allows this to be compiled
+        in -- it's only used for dftables now (and soon may be obsolete entirely).
+        Changed code for cbit_digit to not use isdigit, and took the "_" case out of the
+        loop. Removed ctype_digit.
+
+        * pcre/pcre_ord2utf8.cpp: Copied from JavaScriptCore/pcre/pcre_ord2utf8.c.
+
+        * pcre/pcre_tables.cpp: Copied from JavaScriptCore/pcre/pcre_tables.c.
+        Moved _pcre_OP_lengths out of here into pcre_exec.cpp.
+
+        * pcre/pcre_ucp_searchfuncs.cpp: Copied from JavaScriptCore/pcre/pcre_ucp_searchfuncs.c.
+        Updated for other file name changes.
+
+        * pcre/pcre_xclass.cpp: Copied from JavaScriptCore/pcre/pcre_xclass.c.
+
+        * pcre/ucpinternal.h: Updated header.
+
+        * pcre/ucptable.cpp: Copied from JavaScriptCore/pcre/ucptable.c.
+
+        * wtf/ASCIICType.h: (WTF::isASCIIDigit): Removed a branch by changing from && to
+        & for this operation. Also added an overload that takes an int because that's
+        useful for PCRE. Later we could optimize for int and overload other functions in
+        this file; stuck to this simple one for now.
+
+        * wtf/unicode/icu/UnicodeIcu.h: Removed unused isUpper.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+        * pcre/LICENCE: Removed.
+        * pcre/pcre-config.h: Removed.
+        * wtf/FastMallocPCRE.cpp: Removed.
+
+        * pcre/dftables.c: Renamed to cpp.
+        * pcre/pcre_compile.c: Ditto.
+        * pcre/pcre_exec.c: Ditto.
+        * pcre/pcre_maketables.c: Ditto.
+        * pcre/pcre_ord2utf8.c: Ditto.
+        * pcre/pcre_tables.c: Ditto.
+        * pcre/pcre_ucp_searchfuncs.c: Ditto.
+        * pcre/pcre_xclass.c: Ditto.
+        * pcre/ucptable.c: Ditto.
+
+2007-11-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver.
+
+        Add KJS_CHECKEXCEPTIONBOOLEAN to match rest of nodes.cpp
+
+        * kjs/nodes.cpp:
+        (KJS::ExpressionNode::evaluateToBoolean):
+        (KJS::LessNode::evaluateToBoolean):
+        (KJS::GreaterNode::evaluateToBoolean):
+        (KJS::LessEqNode::evaluateToBoolean):
+        (KJS::GreaterEqNode::evaluateToBoolean):
+        (KJS::InstanceOfNode::evaluateToBoolean):
+        (KJS::InNode::evaluateToBoolean):
+        (KJS::EqualNode::evaluateToBoolean):
+        (KJS::NotEqualNode::evaluateToBoolean):
+        (KJS::StrictEqualNode::evaluateToBoolean):
+        (KJS::NotStrictEqualNode::evaluateToBoolean):
+        (KJS::LogicalAndNode::evaluateToBoolean):
+        (KJS::LogicalOrNode::evaluateToBoolean):
+        (KJS::ConditionalNode::evaluateToBoolean):
+
+2007-11-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15927
+          REGRESSION(r27487): delete a.c followed by __defineGetter__("c", ...) incorrectly deletes another property
+          and <rdar://problem/5586384> REGRESSION (r27487): Can't switch out of Edit HTML Source mode on Leopard Wiki
+
+        Test: fast/js/delete-then-put.html
+
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::put): Added a missing "- 1"; code to find an empty slot was not working.
+        (KJS::PropertyMap::checkConsistency): Added a missing range check that would have caught this
+        problem before.
+
+        - roll out a last-minute change to my evaluateToBoolean patch that was incorrect.
+
+        * kjs/nodes.h: (KJS::ExprStatementNode::ExprStatementNode): Take out call to
+        optimizeForUnnecessaryResult, since the result is used in some cases.
+
+2007-11-10  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        Roll out some changes that were (seemingly accidentally) checked in
+        with r27664.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2007-11-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15915
+          add an evaluation path for booleans like the one we have for numbers
+
+        Gives 1.1% on SunSpider.
+
+        * kjs/grammar.y: Create TrueNode and FalseNode instead of BooleanNode.
+
+        * kjs/nodes.h: Changed to use Noncopyable. Moved optimizeForUnnecessaryResult
+        down from Node to ExpressionNode. Changed some classes to not inherit from
+        ExpressionNode where not necessary, and removed unnneeded evaluate functions
+        as well as evaluate functions that need not be virtual. Call the
+        optimizeForUnnecessaryResult function on the start of a for loop too.
+        * kjs/nodes.cpp:
+        (KJS::ExpressionNode::evaluateToBoolean): Added.
+        (KJS::FalseNode::evaluate): Added.
+        (KJS::TrueNode::evaluate): Added.
+        (KJS::NumberNode::evaluateToBoolean): Added.
+        (KJS::StringNode::evaluateToBoolean): Added.
+        (KJS::LocalVarAccessNode::evaluateToBoolean): Added.
+        (KJS::BracketAccessorNode::evaluateToBoolean): Added.
+        (KJS::LogicalNotNode::evaluate): Changed to call evaluateToBoolean.
+        (KJS::LogicalNotNode::evaluateToBoolean): Added.
+        (KJS::lessThan): Changed to return bool.
+        (KJS::lessThanEq): Ditto.
+        (KJS::LessNode::evaluate): Changed since lessThan returns bool.
+        (KJS::LessNode::evaluateToBoolean): Added.
+        (KJS::GreaterNode::evaluate): Changed since lessThanEq returns bool.
+        (KJS::GreaterNode::evaluateToBoolean): Added.
+        (KJS::LessEqNode::evaluate): Changed since lessThanEq returns bool.
+        (KJS::LessEqNode::evaluateToBoolean): Added.
+        (KJS::GreaterEqNode::evaluate): Changed since lessThan returns bool.
+        (KJS::GreaterEqNode::evaluateToBoolean): Added.
+        (KJS::InstanceOfNode::evaluateToBoolean): Added.
+        (KJS::InNode::evaluateToBoolean): Added.
+        (KJS::EqualNode::evaluateToBoolean): Added.
+        (KJS::NotEqualNode::evaluateToBoolean): Added.
+        (KJS::StrictEqualNode::evaluateToBoolean): Added.
+        (KJS::NotStrictEqualNode::evaluateToBoolean): Added.
+        (KJS::ConditionalNode::evaluate): Changed to call evaluateToBoolean.
+        (KJS::IfNode::execute): Ditto.
+        (KJS::DoWhileNode::execute): Ditto.
+        (KJS::WhileNode::execute): Ditto.
+        (KJS::ForNode::execute): Ditto.
+
+        * kjs/nodes2string.cpp:
+        (KJS::FalseNode::streamTo): Added.
+        (KJS::TrueNode::streamTo): Added.
+
+2007-11-09  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        Reviewed by Darin.
+
+        * kjs/value.h:
+        (KJS::jsNumber): Add some explicit casts.
+
+2007-11-08  Darin Adler  <darin@apple.com>
+
+        - fix build
+
+        * kjs/grammar.y:
+        * kjs/nodes.h:
+        * kjs/property_map.cpp:
+
+2007-11-08  Darin Adler  <darin@apple.com>
+
+        - roll out accidentally-checked in changes
+
+        * kjs/nodes.cpp: Back to previous version.
+        * kjs/nodes.h: Ditto.
+        * kjs/grammar.y: Ditto.
+
+2007-11-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15912
+          fasta spends a lot of time in qsort
+
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::getEnumerablePropertyNames):
+        Use insertion sort instead of qsort for small sets of property names.
+        We can probably do some even-better speedups of for/in, but this nets
+        0.6% overall and 6.7% on fasta.
+
+2007-11-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15906
+          getting characters by indexing into a string is very slow
+
+        This fixes one source of the slowness -- the conversion to an unused
+        Identifier as we call the get function from the slot -- but doesn't
+        fix others, such as the fact that we have to allocate a new UString::Rep
+        for every single character.
+
+        Speeds up string-base64 30%, and at least 0.5% overall.
+        But does slow down access-fannkuch quite a bit. Might be worth
+        revisiting in the future to see what we can do about that (although
+        I did look at a profile for a while).
+
+        * kjs/property_slot.h: Add a new marker for "numeric" property slots;
+        slots where we don't need to pass the identifier to the get function.
+        (KJS::PropertySlot::getValue): Added code to call the numeric get function.
+        (KJS::PropertySlot::setCustomNumeric): Added.
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::indexGetter): Changed to use substr() instead
+        of constructing a wholly new UString each time.
+        (KJS::stringInstanceNumericPropertyGetter): Added. Like indexGetter, but
+        takes advantage of setCustomNumeric to avoid creating an Identifier.
+        (KJS::StringInstance::getOwnPropertySlot): Changed to use setCustomNumeric.
+
+2007-11-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15904
+          more speed-ups possible by tightening up int version of JSImmediate
+
+        1% improvement of SunSpider
+
+        * kjs/JSImmediate.h: Eliminate the now-unneeded FPBitValues struct template.
+        (KJS::JSImmediate::from): Overload for most numeric types; many types can
+        do fewer branches and checks.
+        (KJS::JSImmediate::getUInt32): Removed unneeded check for undefined.
+        (KJS::JSImmediate::getTruncatedInt32): Ditto.
+        (KJS::JSImmediate::getTruncatedUInt32): Ditto. There's no difference any more
+        between getUInt32 and getTruncatedUInt32, so that's worth a rename and merge later.
+
+        * kjs/grammar.y: Update since fromDouble is now just from.
+        * kjs/nodes.h: Ditto.
+
+        * kjs/value.h: (KJS::jsNumber): Overload for most numeric types.
+
+2007-11-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Bakefiles for building JavaScriptCore, needed by wx port.
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCoreSources.bkl: Added.
+        * jscore.bkl: Added.
+
+2007-11-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Fix regression caused by earlier bitwise and optimisation.  1 & undefined != 1.
+
+        The implementation of JSImmediate::areBothImmediateNumbers relies on 
+        (JSImmediate::getTag(immediate1) & JSImmediate::getTag(immediate2)) having 
+        a unique result when both immediate values are numbers.
+
+        The regression was due to UndefinedType & NumberType returning NumberType (3 & 1).
+        By swapping the value of NumberType and UndefinedType this ceases to be a problem.
+
+        * kjs/JSType.h:
+
+2007-11-08  Darin Adler  <darin@apple.com>
+
+        - fix build
+
+        * kjs/nodes.h: Add missing parameter name.
+
+2007-11-08  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+
+        Add ExpressionNode subclass of Node, use it.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::ForInNode::ForInNode):
+        * kjs/nodes.h:
+        (KJS::ExpressionNode::):
+        (KJS::NullNode::):
+        (KJS::NullNode::precedence):
+        (KJS::BooleanNode::):
+        (KJS::BooleanNode::precedence):
+        (KJS::RegExpNode::):
+        (KJS::RegExpNode::precedence):
+        (KJS::ThisNode::):
+        (KJS::ThisNode::precedence):
+        (KJS::ResolveNode::):
+        (KJS::ElementNode::):
+        (KJS::ArrayNode::):
+        (KJS::PropertyNode::):
+        (KJS::PropertyNode::precedence):
+        (KJS::PropertyNode::name):
+        (KJS::PropertyListNode::):
+        (KJS::ObjectLiteralNode::):
+        (KJS::ObjectLiteralNode::precedence):
+        (KJS::BracketAccessorNode::):
+        (KJS::DotAccessorNode::):
+        (KJS::DotAccessorNode::precedence):
+        (KJS::ArgumentListNode::):
+        (KJS::ArgumentsNode::):
+        (KJS::NewExprNode::):
+        (KJS::NewExprNode::precedence):
+        (KJS::FunctionCallValueNode::):
+        (KJS::FunctionCallValueNode::precedence):
+        (KJS::FunctionCallResolveNode::):
+        (KJS::FunctionCallBracketNode::):
+        (KJS::FunctionCallBracketNode::precedence):
+        (KJS::FunctionCallDotNode::):
+        (KJS::FunctionCallDotNode::precedence):
+        (KJS::PrePostResolveNode::):
+        (KJS::PostfixBracketNode::):
+        (KJS::PostfixBracketNode::precedence):
+        (KJS::PostIncBracketNode::):
+        (KJS::PostIncBracketNode::isIncrement):
+        (KJS::PostDecBracketNode::):
+        (KJS::PostDecBracketNode::isIncrement):
+        (KJS::PostfixDotNode::):
+        (KJS::PostfixDotNode::precedence):
+        (KJS::PostIncDotNode::):
+        (KJS::PostIncDotNode::isIncrement):
+        (KJS::PostDecDotNode::):
+        (KJS::PostDecDotNode::isIncrement):
+        (KJS::PostfixErrorNode::):
+        (KJS::PostfixErrorNode::precedence):
+        (KJS::DeleteResolveNode::):
+        (KJS::DeleteBracketNode::):
+        (KJS::DeleteBracketNode::precedence):
+        (KJS::DeleteDotNode::):
+        (KJS::DeleteDotNode::precedence):
+        (KJS::DeleteValueNode::):
+        (KJS::DeleteValueNode::precedence):
+        (KJS::VoidNode::):
+        (KJS::VoidNode::precedence):
+        (KJS::TypeOfResolveNode::):
+        (KJS::TypeOfValueNode::):
+        (KJS::PrefixBracketNode::):
+        (KJS::PrefixBracketNode::precedence):
+        (KJS::PreIncBracketNode::):
+        (KJS::PreIncBracketNode::isIncrement):
+        (KJS::PreDecBracketNode::):
+        (KJS::PreDecBracketNode::isIncrement):
+        (KJS::PrefixDotNode::):
+        (KJS::PrefixDotNode::precedence):
+        (KJS::PreIncDotNode::):
+        (KJS::PreIncDotNode::isIncrement):
+        (KJS::PreDecDotNode::):
+        (KJS::PreDecDotNode::isIncrement):
+        (KJS::PrefixErrorNode::):
+        (KJS::PrefixErrorNode::precedence):
+        (KJS::UnaryPlusNode::):
+        (KJS::UnaryPlusNode::precedence):
+        (KJS::NegateNode::):
+        (KJS::NegateNode::precedence):
+        (KJS::BitwiseNotNode::):
+        (KJS::BitwiseNotNode::precedence):
+        (KJS::LogicalNotNode::):
+        (KJS::LogicalNotNode::precedence):
+        (KJS::AddNode::):
+        (KJS::AddNode::precedence):
+        (KJS::LeftShiftNode::):
+        (KJS::LeftShiftNode::precedence):
+        (KJS::RightShiftNode::):
+        (KJS::RightShiftNode::precedence):
+        (KJS::UnsignedRightShiftNode::):
+        (KJS::UnsignedRightShiftNode::precedence):
+        (KJS::LessNode::):
+        (KJS::LessNode::precedence):
+        (KJS::GreaterNode::):
+        (KJS::GreaterNode::precedence):
+        (KJS::LessEqNode::):
+        (KJS::LessEqNode::precedence):
+        (KJS::GreaterEqNode::):
+        (KJS::GreaterEqNode::precedence):
+        (KJS::InstanceOfNode::):
+        (KJS::InstanceOfNode::precedence):
+        (KJS::InNode::):
+        (KJS::InNode::precedence):
+        (KJS::EqualNode::):
+        (KJS::EqualNode::precedence):
+        (KJS::NotEqualNode::):
+        (KJS::NotEqualNode::precedence):
+        (KJS::StrictEqualNode::):
+        (KJS::StrictEqualNode::precedence):
+        (KJS::NotStrictEqualNode::):
+        (KJS::NotStrictEqualNode::precedence):
+        (KJS::BitAndNode::):
+        (KJS::BitAndNode::precedence):
+        (KJS::BitOrNode::):
+        (KJS::BitOrNode::precedence):
+        (KJS::BitXOrNode::):
+        (KJS::BitXOrNode::precedence):
+        (KJS::LogicalAndNode::):
+        (KJS::LogicalAndNode::precedence):
+        (KJS::LogicalOrNode::):
+        (KJS::LogicalOrNode::precedence):
+        (KJS::ConditionalNode::):
+        (KJS::ConditionalNode::precedence):
+        (KJS::ReadModifyResolveNode::):
+        (KJS::ReadModifyResolveNode::precedence):
+        (KJS::AssignResolveNode::):
+        (KJS::AssignResolveNode::precedence):
+        (KJS::ReadModifyBracketNode::):
+        (KJS::ReadModifyBracketNode::precedence):
+        (KJS::AssignBracketNode::):
+        (KJS::AssignBracketNode::precedence):
+        (KJS::AssignDotNode::):
+        (KJS::AssignDotNode::precedence):
+        (KJS::ReadModifyDotNode::):
+        (KJS::ReadModifyDotNode::precedence):
+        (KJS::AssignErrorNode::):
+        (KJS::AssignErrorNode::precedence):
+        (KJS::CommaNode::):
+        (KJS::CommaNode::precedence):
+        (KJS::AssignExprNode::):
+        (KJS::AssignExprNode::precedence):
+        (KJS::ExprStatementNode::):
+        (KJS::IfNode::):
+        (KJS::DoWhileNode::):
+        (KJS::WhileNode::):
+        (KJS::ReturnNode::):
+        (KJS::WithNode::):
+        (KJS::ThrowNode::):
+        (KJS::ParameterNode::):
+        (KJS::CaseClauseNode::):
+        (KJS::CaseClauseNode::precedence):
+        (KJS::ClauseListNode::):
+        (KJS::SwitchNode::):
+
+2007-11-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam.
+
+        Add a fast path for bitwise-and of two immediate numbers for a 0.7% improvement in SunSpider (4% bitop improvement).
+
+        This only improves bitwise-and performance, as the additional logic required 
+        for similar code paths on or, xor, and shifting requires additional operations
+        and branches that negate (and in certain cases, regress) any advantage we might
+        otherwise receive.
+
+        This improves performance on all bitop tests, the cryptography tests, as well as 
+        the string-base64 and string-unpack-code tests.  No significant degradation on 
+        any other tests.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::areBothImmediateNumbers):
+        (KJS::JSImmediate::andImmediateNumbers):
+        * kjs/nodes.cpp:
+        (KJS::BitAndNode::evaluate):
+        * kjs/value.h:
+        (KJS::jsNumberFromAnd):
+
+2007-11-08  Adam Roben  <aroben@apple.com>
+
+        Stop using KJS inside of MathExtras.h
+
+        Reviewed by Darin.
+
+        * wtf/MathExtras.h: Removed an unused header, and a now-unused
+        forward-declaration.
+        (wtf_atan2): Use std::numeric_limits intead of KJS.
+
+2007-11-08  Sam Weinig  <sam@webkit.org>
+
+        Windows build fix.
+
+        * kjs/date_object.cpp:
+        (KJS::DateProtoFuncToLocaleString::callAsFunction): Fix unused arg warning.
+        (KJS::DateProtoFuncToLocaleDateString::callAsFunction): ditto
+        (KJS::DateProtoFuncToLocaleTimeString::callAsFunction): ditto
+
+2007-11-08  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/lookup.h: Add missing include.
+
+2007-11-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin.
+
+        Convert JavaScript internal function objects to use one class per
+        function.  This avoids a switch statement inside what used to be
+        the shared function classes and will allow Shark to better analyze
+        the code.
+
+        To make this switch, the value property of the HashEntry was changed
+        to a union of an intptr_t (which is used to continue handle valueGetters)
+        and function pointer which points to a static constructor for the
+        individual new function objects.
+
+        SunSpider claims this is a 1.0% speedup.
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayPrototype::getOwnPropertySlot):
+        (KJS::getProperty):
+        (KJS::ArrayProtoFuncToString::callAsFunction):
+        (KJS::ArrayProtoFuncToLocaleString::callAsFunction):
+        (KJS::ArrayProtoFuncJoin::callAsFunction):
+        (KJS::ArrayProtoFuncConcat::callAsFunction):
+        (KJS::ArrayProtoFuncPop::callAsFunction):
+        (KJS::ArrayProtoFuncPush::callAsFunction):
+        (KJS::ArrayProtoFuncReverse::callAsFunction):
+        (KJS::ArrayProtoFuncShift::callAsFunction):
+        (KJS::ArrayProtoFuncSlice::callAsFunction):
+        (KJS::ArrayProtoFuncSort::callAsFunction):
+        (KJS::ArrayProtoFuncSplice::callAsFunction):
+        (KJS::ArrayProtoFuncUnShift::callAsFunction):
+        (KJS::ArrayProtoFuncFilter::callAsFunction):
+        (KJS::ArrayProtoFuncMap::callAsFunction):
+        (KJS::ArrayProtoFuncEvery::callAsFunction):
+        (KJS::ArrayProtoFuncForEach::callAsFunction):
+        (KJS::ArrayProtoFuncSome::callAsFunction):
+        (KJS::ArrayProtoFuncIndexOf::callAsFunction):
+        (KJS::ArrayProtoFuncLastIndexOf::callAsFunction):
+        * kjs/array_object.h:
+        (KJS::ArrayPrototype::classInfo):
+        * kjs/create_hash_table:
+        * kjs/date_object.cpp:
+        (KJS::DatePrototype::getOwnPropertySlot):
+        (KJS::DateProtoFuncToString::callAsFunction):
+        (KJS::DateProtoFuncToUTCString::callAsFunction):
+        (KJS::DateProtoFuncToDateString::callAsFunction):
+        (KJS::DateProtoFuncToTimeString::callAsFunction):
+        (KJS::DateProtoFuncToLocaleString::callAsFunction):
+        (KJS::DateProtoFuncToLocaleDateString::callAsFunction):
+        (KJS::DateProtoFuncToLocaleTimeString::callAsFunction):
+        (KJS::DateProtoFuncValueOf::callAsFunction):
+        (KJS::DateProtoFuncGetTime::callAsFunction):
+        (KJS::DateProtoFuncGetFullYear::callAsFunction):
+        (KJS::DateProtoFuncGetUTCFullYear::callAsFunction):
+        (KJS::DateProtoFuncToGMTString::callAsFunction):
+        (KJS::DateProtoFuncGetMonth::callAsFunction):
+        (KJS::DateProtoFuncGetUTCMonth::callAsFunction):
+        (KJS::DateProtoFuncGetDate::callAsFunction):
+        (KJS::DateProtoFuncGetUTCDate::callAsFunction):
+        (KJS::DateProtoFuncGetDay::callAsFunction):
+        (KJS::DateProtoFuncGetUTCDay::callAsFunction):
+        (KJS::DateProtoFuncGetHours::callAsFunction):
+        (KJS::DateProtoFuncGetUTCHours::callAsFunction):
+        (KJS::DateProtoFuncGetMinutes::callAsFunction):
+        (KJS::DateProtoFuncGetUTCMinutes::callAsFunction):
+        (KJS::DateProtoFuncGetSeconds::callAsFunction):
+        (KJS::DateProtoFuncGetUTCSeconds::callAsFunction):
+        (KJS::DateProtoFuncGetMilliSeconds::callAsFunction):
+        (KJS::DateProtoFuncGetUTCMilliseconds::callAsFunction):
+        (KJS::DateProtoFuncGetTimezoneOffset::callAsFunction):
+        (KJS::DateProtoFuncSetTime::callAsFunction):
+        (KJS::DateProtoFuncSetMilliSeconds::callAsFunction):
+        (KJS::DateProtoFuncSetUTCMilliseconds::callAsFunction):
+        (KJS::DateProtoFuncSetSeconds::callAsFunction):
+        (KJS::DateProtoFuncSetUTCSeconds::callAsFunction):
+        (KJS::DateProtoFuncSetMinutes::callAsFunction):
+        (KJS::DateProtoFuncSetUTCMinutes::callAsFunction):
+        (KJS::DateProtoFuncSetHours::callAsFunction):
+        (KJS::DateProtoFuncSetUTCHours::callAsFunction):
+        (KJS::DateProtoFuncSetDate::callAsFunction):
+        (KJS::DateProtoFuncSetUTCDate::callAsFunction):
+        (KJS::DateProtoFuncSetMonth::callAsFunction):
+        (KJS::DateProtoFuncSetUTCMonth::callAsFunction):
+        (KJS::DateProtoFuncSetFullYear::callAsFunction):
+        (KJS::DateProtoFuncSetUTCFullYear::callAsFunction):
+        (KJS::DateProtoFuncSetYear::callAsFunction):
+        (KJS::DateProtoFuncGetYear::callAsFunction):
+        * kjs/date_object.h:
+        * kjs/lookup.cpp:
+        (KJS::Lookup::find):
+        * kjs/lookup.h:
+        (KJS::HashEntry::):
+        (KJS::staticFunctionGetter):
+        (KJS::staticValueGetter):
+        (KJS::getStaticPropertySlot):
+        (KJS::getStaticFunctionSlot):
+        (KJS::lookupPut):
+        * kjs/math_object.cpp:
+        (KJS::MathObjectImp::getOwnPropertySlot):
+        (KJS::MathProtoFuncAbs::callAsFunction):
+        (KJS::MathProtoFuncACos::callAsFunction):
+        (KJS::MathProtoFuncASin::callAsFunction):
+        (KJS::MathProtoFuncATan::callAsFunction):
+        (KJS::MathProtoFuncATan2::callAsFunction):
+        (KJS::MathProtoFuncCeil::callAsFunction):
+        (KJS::MathProtoFuncCos::callAsFunction):
+        (KJS::MathProtoFuncExp::callAsFunction):
+        (KJS::MathProtoFuncFloor::callAsFunction):
+        (KJS::MathProtoFuncLog::callAsFunction):
+        (KJS::MathProtoFuncMax::callAsFunction):
+        (KJS::MathProtoFuncMin::callAsFunction):
+        (KJS::MathProtoFuncPow::callAsFunction):
+        (KJS::MathProtoFuncRandom::callAsFunction):
+        (KJS::MathProtoFuncRound::callAsFunction):
+        (KJS::MathProtoFuncSin::callAsFunction):
+        (KJS::MathProtoFuncSqrt::callAsFunction):
+        (KJS::MathProtoFuncTan::callAsFunction):
+        * kjs/math_object.h:
+        (KJS::MathObjectImp::classInfo):
+        (KJS::MathObjectImp::):
+        * kjs/string_object.cpp:
+        (KJS::StringPrototype::getOwnPropertySlot):
+        (KJS::StringProtoFuncToString::callAsFunction):
+        (KJS::StringProtoFuncValueOf::callAsFunction):
+        (KJS::StringProtoFuncCharAt::callAsFunction):
+        (KJS::StringProtoFuncCharCodeAt::callAsFunction):
+        (KJS::StringProtoFuncConcat::callAsFunction):
+        (KJS::StringProtoFuncIndexOf::callAsFunction):
+        (KJS::StringProtoFuncLastIndexOf::callAsFunction):
+        (KJS::StringProtoFuncMatch::callAsFunction):
+        (KJS::StringProtoFuncSearch::callAsFunction):
+        (KJS::StringProtoFuncReplace::callAsFunction):
+        (KJS::StringProtoFuncSlice::callAsFunction):
+        (KJS::StringProtoFuncSplit::callAsFunction):
+        (KJS::StringProtoFuncSubstr::callAsFunction):
+        (KJS::StringProtoFuncSubstring::callAsFunction):
+        (KJS::StringProtoFuncToLowerCase::callAsFunction):
+        (KJS::StringProtoFuncToUpperCase::callAsFunction):
+        (KJS::StringProtoFuncToLocaleLowerCase::callAsFunction):
+        (KJS::StringProtoFuncToLocaleUpperCase::callAsFunction):
+        (KJS::StringProtoFuncLocaleCompare::callAsFunction):
+        (KJS::StringProtoFuncBig::callAsFunction):
+        (KJS::StringProtoFuncSmall::callAsFunction):
+        (KJS::StringProtoFuncBlink::callAsFunction):
+        (KJS::StringProtoFuncBold::callAsFunction):
+        (KJS::StringProtoFuncFixed::callAsFunction):
+        (KJS::StringProtoFuncItalics::callAsFunction):
+        (KJS::StringProtoFuncStrike::callAsFunction):
+        (KJS::StringProtoFuncSub::callAsFunction):
+        (KJS::StringProtoFuncSup::callAsFunction):
+        (KJS::StringProtoFuncFontcolor::callAsFunction):
+        (KJS::StringProtoFuncFontsize::callAsFunction):
+        (KJS::StringProtoFuncAnchor::callAsFunction):
+        (KJS::StringProtoFuncLink::callAsFunction):
+        * kjs/string_object.h:
+
+2007-11-08  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        Reviewed by Sam and Ada.
+
+        * wtf/MathExtras.h: Get rid of a circular #include dependency to fix
+        the build.
+
+2007-11-08  Adam Roben  <aroben@apple.com>
+
+        Fix a precedence warning on Windows
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::toBoolean):
+
+2007-11-08  Mark Rowe  <mrowe@apple.com>
+
+        Build fix for JavaScriptGlue.
+
+        * wtf/MathExtras.h: Include stdlib.h for srand and RAND_MAX.
+
+2007-11-08  Darin Adler  <darin@apple.com>
+
+        - Windows build fix
+
+        * kjs/JSImmediate.h: Include MathExtras.h rather than math.h since this file uses "signbit".
+
+2007-11-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        Replace the use of floats for immediate values with the use of integers for a 4.5% improvement in SunSpider.
+
+        Unfortunately this change results in NaN, +Inf, -Inf, and -0 being heap allocated now, but
+        we should now have faster array access, faster immediate to double conversion, and the 
+        potential to further improve bitwise operators in future.
+
+        This also removes the need for unions to avoid strict aliasing problems when extracting 
+        a value from immediates.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::trueImmediate):
+        (KJS::JSImmediate::falseImmediate):
+        (KJS::JSImmediate::undefinedImmediate):
+        (KJS::JSImmediate::nullImmediate):
+        (KJS::JSImmediate::toBoolean):
+        * kjs/value.h:
+        (KJS::jsNaN):
+
+2007-11-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin and Oliver.
+        
+        Add evaluateToNumber parallel evaluation tree to speed up number operations.
+        Make ImmediateNumberNode a subclass of NumberNode.
+        Share evaluate logic between evaluate and evaluateToNumber using inline functions
+        There is still a lot of improvement to be made here.
+        
+        SunSpider claims this is a 1.0% speedup overall (nbody 7.9%), base64 slowing 2.0%
+        Given the huge win that this prepares us for with simple type inferencing I see the small
+        regression in base64 being worth the substantial overall improvement.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::Node::evaluateToNumber):
+        (KJS::NumberNode::evaluate):
+        (KJS::NumberNode::evaluateToNumber):
+        (KJS::StringNode::evaluateToNumber):
+        (KJS::LocalVarAccessNode::inlineEvaluate):
+        (KJS::LocalVarAccessNode::evaluate):
+        (KJS::LocalVarAccessNode::evaluateToNumber):
+        (KJS::BracketAccessorNode::inlineEvaluate):
+        (KJS::BracketAccessorNode::evaluate):
+        (KJS::BracketAccessorNode::evaluateToNumber):
+        (KJS::NegateNode::evaluate):
+        (KJS::NegateNode::evaluateToNumber):
+        (KJS::MultNode::inlineEvaluateToNumber):
+        (KJS::MultNode::evaluate):
+        (KJS::MultNode::evaluateToNumber):
+        (KJS::DivNode::inlineEvaluateToNumber):
+        (KJS::DivNode::evaluate):
+        (KJS::DivNode::evaluateToNumber):
+        (KJS::ModNode::inlineEvaluateToNumber):
+        (KJS::ModNode::evaluate):
+        (KJS::ModNode::evaluateToNumber):
+        (KJS::throwOutOfMemoryErrorToNumber):
+        (KJS::addSlowCaseToNumber):
+        (KJS::add):
+        (KJS::addToNumber):
+        (KJS::AddNode::evaluateToNumber):
+        (KJS::SubNode::inlineEvaluateToNumber):
+        (KJS::SubNode::evaluate):
+        (KJS::SubNode::evaluateToNumber):
+        (KJS::valueForReadModifyAssignment):
+        (KJS::ReadModifyLocalVarNode::evaluate):
+        (KJS::ReadModifyResolveNode::evaluate):
+        (KJS::ReadModifyDotNode::evaluate):
+        (KJS::ReadModifyBracketNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::Node::):
+        (KJS::NumberNode::):
+        (KJS::ImmediateNumberNode::):
+        (KJS::AddNode::precedence):
+        * kjs/nodes2string.cpp:
+        (KJS::NumberNode::streamTo):
+
+2007-11-07  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Eric.
+
+        Fix up initialization after being mangled in r27572, and remove the
+        ternary expression as extraCost will always be zero for the numeric
+        heap.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::heapAllocate):
+
+2007-11-07  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/regexp_object.cpp:
+
+2007-11-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+        
+        Eliminated a bogus (though compiled-out) branch in the collector.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::heapAllocate):
+
+2007-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed part of http://bugs.webkit.org/show_bug.cgi?id=15861 
+        5.8% of string-validate-input.js is spent creating RegExpImps
+
+        Put RegExpImp properties into a static hashtable to avoid a slew of
+        PropertyMap churn when creating a RegExpImp.
+        
+        Factored important bits of regular expression implementation out of
+        RegExpImp (the JS object) and into RegExp (the PCRE wrapper class), 
+        making RegExp a ref-counted class. (This will help later.)
+
+        Removed PCRE_POSIX support because I didn't quite know how to test it 
+        and keep it working with these changes.
+        
+        1.1% SunSpider speedup. 5.8% speedup on string-validate-input.js.
+
+        * kjs/regexp.h: A few interface changes:
+        1. Renamed "subpatterns()" => "numSubpatterns()"
+        2. Made flag enumeration private and replaced it with public getters for
+        specific flags.
+        3. Made RegExp ref-counted so RegExps can be shared by RegExpImps.
+        4. Made RegExp take a string of flags instead of an int, eliminating 
+        duplicated flag parsing code elsewhere.
+
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpProtoFunc::callAsFunction): For RegExp.compile: 
+        - Fixed a bug where compile(undefined) would throw an exception. 
+        - Removed some now-redundant code.
+        - Used RegExp sharing to eliminate an allocation and a bunch of 
+        PropertyMap thrash. (Not a big win since compile is a deprecated 
+        function. I mainly did this to test the plubming.)
+
+2007-11-07  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by nobody, Qt/Windows build fix.
+
+        JavaScriptCore.pri expects OBJECTS_DIR to be set, so set it in
+        testkjs.pro, too, where it's included from.
+
+        * kjs/testkjs.pro:
+
+2007-11-07  Simon Hausmann  <shausman@trolltech.com>
+
+        Reviewed by Lars.
+
+        Fix "nmake clean" for the Qt/Windows build by replacing tmp/ with a variable that ends with the correct type of slash/backslash depending on the choice of compiler/make tool.
+
+        * JavaScriptCore.pri:
+        * pcre/pcre.pri:
+
+2007-11-07  Lars Knoll  <lars@trolltech.com>
+
+        Reviewed by Simon.
+
+        fix umemcasecmp
+        
+        Pretty embarrassing bug. Has the potential to fix quite a few test failures.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::umemcasecmp):
+
+2007-11-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.        
+        
+        - only collect when the heap is full, unless we have lots of extra cost garbage
+        
+        1.1% SunSpider speedup.
+        
+        This shouldn't hit memory use much since the extra space in those
+        blocks hangs around either way.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::heapAllocate):
+        (KJS::Collector::collect): Fix logic error that reversed the sense of collect's 
+        return value.
+
+2007-11-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Avoid unnecessarily boxing the result from post inc/decrement for 0.3% gain in sunspider
+        
+        We now convert the common 'for (...; ...; <var>++) ...' to the semantically identical
+        'for (...; ...; ++<var>) ...'.
+
+        * kjs/nodes.cpp:
+        (KJS::PostIncResolveNode::optimizeForUnnecessaryResult):
+        (KJS::PostIncLocalVarNode::evaluate):
+        (KJS::PostIncLocalVarNode::optimizeForUnnecessaryResult):
+        (KJS::PostDecResolveNode::optimizeForUnnecessaryResult):
+        (KJS::PostDecLocalVarNode::evaluate):
+        (KJS::PostDecLocalVarNode::optimizeForUnnecessaryResult):
+        * kjs/nodes.h:
+        (KJS::PrePostResolveNode::):
+        (KJS::PostIncResolveNode::):
+        (KJS::PostIncLocalVarNode::):
+        (KJS::PostDecResolveNode::):
+        (KJS::PostDecLocalVarNode::):
+        (KJS::PreIncResolveNode::):
+        (KJS::PreDecResolveNode::):
+        (KJS::ForNode::ForNode):
+
+2007-11-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+
+        This fixes a regressed layout test for string + object
+        
+        SunSpider claims this was an overall 0.3% speedup, although some individual tests were slower.
+
+        * kjs/nodes.cpp:
+        (KJS::add): remove erroneous "fast path" for string + *
+
+2007-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel.
+        
+        Added toJSNumber, a fast path for converting a JSValue to a JS number,
+        and deployed it in postfix expressions. In the fast case this 
+        eliminates a call to jsNumber.
+        
+        0.4% speedup on SunSpider.
+
+        * ChangeLog:
+        * kjs/nodes.cpp:
+        (KJS::PostIncResolveNode::evaluate):
+        (KJS::PostIncLocalVarNode::evaluate):
+        (KJS::PostDecResolveNode::evaluate):
+        (KJS::PostDecLocalVarNode::evaluate):
+        (KJS::PostIncBracketNode::evaluate):
+        (KJS::PostDecBracketNode::evaluate):
+        (KJS::PostIncDotNode::evaluate):
+        (KJS::PostDecDotNode::evaluate):
+        (KJS::UnaryPlusNode::evaluate):
+        * kjs/value.h:
+        (KJS::JSValue::toJSNumber):
+
+2007-11-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15846
+          REGRESSION (r27387): Memory corruption when running fast/js/kde/delete.html
+
+        There was a mistake in the algorithm used to find an empty slot in the property
+        map entries vector; when we were putting in a new property value and not overwriting
+        an existing deleted sentinel, we would enlarge the entries vector, but would not
+        overwrite the stale data that's in the new part. It was easy to pin this down by
+        turning on property map consistency checks -- I never would have landed with this
+        bug if I had run the regression tests once with consistency checks on!
+
+        * kjs/property_map.cpp: (KJS::PropertyMap::put): Changed logic for the case where
+        foundDeletedElement is false to always use the item at the end of the entries vector.
+        Also allowed me to merge with the logic for the "no deleted sentinels at all" case.
+
+2007-11-06  Oliver Hunt  <oliver@apple.com>
+
+        RS=Darin.
+
+        Fix previous patch to use a 3 bit shift, a 16 bit shift causes a regression in sunspider.
+
+        * kjs/nodes.cpp:
+        (KJS::add):
+
+2007-11-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        Replace boolean comparisons in AddNode with mask
+        comparisons for a 0.2% improvement in sunspider.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/nodes.cpp:
+        (KJS::add):
+
+2007-11-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+        
+        SunSpider claims this is a 1.1% speedup.
+
+        * kjs/nodes.cpp:
+        (KJS::throwOutOfMemoryError): Added, non inline.
+        (KJS::addSlowCase): renamed from add(), non inline.
+        (KJS::add): add fast path for String + String, Number + Number and String + *
+
+2007-11-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by mjs.
+        
+        Avoid more UString creation.
+        
+        SunSpider claims this is a 0.4% speedup.
+
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpObjectImp::construct): use UString::find(UChar)
+
+2007-11-05  Mark Rowe  <mrowe@apple.com>
+
+        Mac build fix.
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayProtoFunc::callAsFunction):
+
+2007-11-05  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * kjs/list.h:
+
+2007-11-05  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Add missing #include.
+
+        * kjs/operations.cpp:
+
+2007-11-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by mjs.
+        
+        Remove another call to toString(exec)
+        
+        SunSpider claims this is a 0.5% speedup.
+
+        * kjs/operations.cpp:
+        (KJS::equal): remove another toString
+
+2007-11-05  Eric Seidel  <eric@webkit.org>
+
+        * kjs/operations.cpp:
+        (KJS::equal): correct broken change.
+
+2007-11-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by mjs.
+
+        Remove one more call to toString(exec).
+        
+        SunSpider claims this is a 0.7% speedup.
+
+        * kjs/operations.cpp:
+        (KJS::equal): remove a call to toString()
+
+2007-11-05  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * pcre/pcre.pri:
+
+2007-11-05  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/list.cpp:
+
+2007-11-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Touched a file to test my new HTTP access.
+
+        * kjs/scope_chain.cpp:
+
+2007-11-05  Alp Toker  <alp@atoker.com>
+
+        Unreviewed build fix for qmake-based ports.
+
+        Someone with a better understanding of qmake still needs to sort out
+        the INCLUDEPATH/DEPENDPATH mess.
+
+        * JavaScriptCore.pri:
+
+2007-11-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        http://bugs.webkit.org/show_bug.cgi?id=15835
+
+        Switched List implementation from a custom heap allocator to an inline
+        Vector, for a disappointing .5% SunSpider speedup.
+        
+        Also renamed List::slice to List::getSlice because "get" is the 
+        conventional prefix for functions returning a value through an out 
+        parameter.
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayProtoFunc::callAsFunction): Removed some redundant function
+        calls and memory accesses.
+
+        * kjs/bool_object.cpp:
+        (BooleanObjectImp::construct): Removed questionable use of iterator.
+
+        * kjs/list.cpp:
+        * kjs/list.h: New List class, implemented in terms of Vector. Two 
+        interesting differences:
+            1. The inline capacity is 8, not 5. Many of the Lists constructed 
+            during a SunSpider run are larger than 5; almost none are larger
+            than 8.
+
+            2. The growth factor is 4, not 2. Since we can guarantee that Lists
+            aren't long-lived, we can grow them more aggressively, to avoid
+            excessive copying.
+
+        * kjs/regexp_object.cpp:
+        (RegExpObjectImp::construct): Removed redundant function calls.
+
+        * kjs/string_object.cpp:
+        (KJS::StringObjectImp::construct): Removed questionable use of iterator.
+
+        * wtf/Vector.h:
+        (WTF::::uncheckedAppend): Added a fast, unchecked version of append.
+
+2007-11-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alp Toker.
+
+        Add DEPENDPATH to JavaScriptCore and pcre to help qmake with dependencies.
+
+        * JavaScriptCore.pri:
+        * pcre/pcre.pri:
+
+2007-11-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15826
+          optimize opcode loop and case insensitive ASCII compares for a 30% speedup
+
+        SunSpider says it's 2.6% faster overall, 32.5% in the regular expression tests.
+
+        * pcre/pcre_internal.h: Added OP_ASCII_CHAR and OP_ASCII_LETTER_NC.
+
+        * pcre/pcre_compile.c:
+        (find_fixedlength): Added cases for OP_ASCII_CHAR and OP_ASCII_LETTER_NC. Also
+        added OP_NOT since there was no reason it should not be in here.
+        (could_be_empty_branch): Ditto.
+        (compile_branch): Streamlined all the single-character cases; there was a bit of
+        duplicate code. Added cases for OP_ASCII_CHAR and OP_ASCII_LETTER_NC as needed.
+        But in particular, compile to those opcodes when the single character match is
+        ASCII.
+        (find_firstassertedchar): Added cases for OP_ASCII_CHAR and OP_ASCII_LETTER_NC.
+
+        * pcre/pcre_exec.c: (match): Removed the "min", "minimize", and "op" fields from
+        the matchframe, after I discovered that none of them needed to be saved and restored
+        across recursive match calls. Also eliminated the ignored result field from the
+        matchframe, since I discovered that rrc ("recursive result code") was already the
+        exact same thing. Moved the handling of opcodes higher than OP_BRA into the default
+        statement of the switch instead of doing them before the switch. This removes a
+        branch from each iteration of the opcode interpreter, just as removal of "op"
+        removed at least one store from each iteration. Last, but not least, add the
+        OP_ASCII_CHAR and OP_ASCII_LETTER_NC functions. Neither can ever match a
+        surrogate pair and the letter case can be handled efficiently.
+
+2007-11-04  Darin Adler  <darin@apple.com>
+
+        * pcre/pcre_exec.c: (match): Try to fix the Windows build by removing unreachable code.
+
+2007-11-03  Darin Adler  <darin@apple.com>
+
+        - fix non-Mac builds; remove some more unused PCRE stuff
+
+        * pcre/pcre_compile.c:
+        (compile_branch): Removed branch chain and some unused ESC values.
+        (compile_regex): Ditto.
+        (jsRegExpCompile): Ditto.
+        * pcre/pcre_exec.c:
+        (match): Removed unused branch targets. Don't use macros any more.
+        (jsRegExpExecute): More of the same.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Update for removed files.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * pcre/pcre.pri: Ditto.
+
+        * pcre/MERGING: Removed.
+        * pcre/pcre_fullinfo.c: Removed.
+        * pcre/pcre_get.c: Removed.
+        * pcre/pcre_internal.h:
+        * pcre/ucp.h: Removed.
+
+2007-11-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15821
+          remove unused PCRE features for speed
+
+        A first step toward removing the PCRE features we don't use.
+        This gives a 0.8% speedup on SunSpider, and a 6.5% speedup on
+        the SunSpider regular expression test.
+
+        Replaced the public interface with one that doesn't use the
+        name PCRE. Removed code we don't need for JavaScript and various
+        configurations we don't use. This is in preparation for still
+        more changes in the future. We'll probably switch to C++ and
+        make some even more significant changes to the regexp engine
+        to get some additional speed.
+
+        There's probably additional unused stuff that I haven't
+        deleted yet.
+
+        This does mean that our PCRE is now a fork, but I think that's
+        not really a big deal.
+
+        * JavaScriptCore.exp: Remove the 5 old entry points and add
+        the 3 new entry points for WebCore's direct use of the regular
+        expression engine.
+
+        * kjs/config.h: Remove the USE(PCRE16) define. I decided to flip
+        its sense and now there's a USE(POSIX_REGEX) instead, which should
+        probably not be set by anyone. Maybe later we'll just get rid of it
+        altogether.
+
+        * kjs/regexp.h:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Switch to new jsRegExp function names and
+        defines. Cut down on the number of functions used.
+        (KJS::RegExp::~RegExp): Ditto.
+        (KJS::RegExp::match): Ditto.
+
+        * pcre/dftables.c: (main): Get rid of ctype_letter and ctype_meta,
+        which are unused.
+
+        * pcre/pcre-config.h: Get rid of EBCIDIC, PCRE_DATA_SCOPE, const,
+        size_t, HAVE_STRERROR, HAVE_MEMMOVE, HAVE_BCOPY, NEWLINE,
+        POSIX_MALLOC_THRESHOLD, NO_RECURSE, SUPPORT_UCP, SUPPORT_UTF8,
+        and JAVASCRIPT. These are all no longer configurable in our copy
+        of the library.
+
+        * pcre/pcre.h: Remove the macro-based kjs prefix hack, the PCRE
+        version macros, PCRE_UTF16, the code to set up PCRE_DATA_SCOPE,
+        the include of <stdlib.h>, and most of the constants and
+        functions defined in this header. Changed the naming scheme to
+        use a JSRegExp prefix rather than a pcre prefix. In the future,
+        we'll probably change this to be a C++ header.
+
+        * pcre/pcre_compile.c: Removed all unused code branches,
+        including many whole functions and various byte codes.
+        Kept changes outside of removal to a minimum.
+        (check_escape):
+        (first_significant_code):
+        (find_fixedlength):
+        (find_recurse):
+        (could_be_empty_branch):
+        (compile_branch):
+        (compile_regex):
+        (is_anchored):
+        (is_startline):
+        (find_firstassertedchar):
+        (jsRegExpCompile): Renamed from pcre_compile2 and changed the
+        parameters around a bit.
+        (jsRegExpFree): Added.
+
+        * pcre/pcre_exec.c: Removed many unused opcodes and variables.
+        Also started tearing down the NO_RECURSE mechanism since it's
+        now the default. In some cases there were things in the explicit
+        frame that could be turned into plain old local variables and
+        other small like optimizations.
+        (pchars):
+        (match_ref):
+        (match): Changed parameters quite a bit since it's now not used
+        recursively.
+        (jsRegExpExecute): Renamed from pcre_exec.
+
+        * pcre/pcre_internal.h: Get rid of PCRE_DEFINITION, PCRE_SPTR,
+        PCRE_IMS, PCRE_ICHANGED, PCRE_NOPARTIAL, PCRE_STUDY_MAPPED,
+        PUBLIC_OPTIONS, PUBLIC_EXEC_OPTIONS, PUBLIC_DFA_EXEC_OPTIONS,
+        PUBLIC_STUDY_OPTIONS, MAGIC_NUMBER, 16 of the opcodes,
+        _pcre_utt, _pcre_utt_size, _pcre_try_flipped, _pcre_ucp_findprop,
+        and _pcre_valid_utf8. Also moved pcre_malloc and pcre_free here.
+
+        * pcre/pcre_maketables.c: Changed to only compile in dftables.
+        Also got rid of many of the tables that we don't use.
+
+        * pcre/pcre_tables.c: Removed the unused Unicode property tables.
+
+        * pcre/pcre_ucp_searchfuncs.c: Removed everything except for
+        _pcre_ucp_othercase.
+
+        * pcre/pcre_xclass.c: (_pcre_xclass): Removed uneeded support
+        for classes based on Unicode properties.
+
+        * wtf/FastMallocPCRE.cpp: Removed unused bits. It would be good
+        to eliminate this completely, but we need the regular expression
+        code to be C++ first.
+
+        * pcre/pcre_fullinfo.c:
+        * pcre/pcre_get.c:
+        * pcre/ucp.h:
+        Files that are no longer needed. I didn't remove them with this
+        check-in, because I didn't want to modify all the project files.
+
+2007-11-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam.
+        
+        - remove NaN check from JSImmediate::fromDouble for 0.5% SunSpider speedup
+
+        It turns out that doing this check costs more than it saves.
+        
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::fromDouble):
+
+2007-11-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver.
+
+        Remove dummy variable from ClassInfo reducing the size of the struct by 1 word.
+        The variable had been kept around for binary compatibility, but since nothing
+        else is there is no point in continuing to keep it around.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObject.cpp:
+        * bindings/objc/objc_runtime.mm:
+        * bindings/runtime_array.cpp:
+        * bindings/runtime_object.cpp:
+        * kjs/array_instance.cpp:
+        * kjs/array_object.cpp:
+        * kjs/bool_object.cpp:
+        * kjs/date_object.cpp:
+        * kjs/error_object.cpp:
+        * kjs/function.cpp:
+        * kjs/internal.cpp:
+        * kjs/lookup.h:
+        * kjs/math_object.cpp:
+        * kjs/number_object.cpp:
+        * kjs/object.h:
+        * kjs/regexp_object.cpp:
+        * kjs/string_object.cpp:
+
+2007-11-03  Kevin McCullough  <kmccullough@apple.com>
+
+        - Updated testkjs results to make the build bots green until we
+        can fix the tests that are failing.  The new failures are in DST.
+
+        * tests/mozilla/expected.html:
+
+2007-11-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam.
+        
+        - don't print the var twice for ForInNodes with a var declaration
+
+        * kjs/nodes2string.cpp:
+        (KJS::ForInNode::streamTo):
+
+2007-11-03  Darin Adler  <darin@apple.com>
+
+        * pcre/pcre_compile.c: (check_escape): Windows build fix. Get rid of
+        C-incompatible declaration.
+
+2007-11-03  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/nodes.cpp:  Add missing include.
+
+2007-11-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15814
+          <rdar://problem/5536644> fast/js/kde/encode_decode_uri.html fails
+
+        These changes cause us to match the JavaScript specification and pass the
+        fast/js/kde/encode_decode_uri.html test.
+
+        * kjs/function.cpp: (KJS::encode): Call the UTF-8 string conversion in its
+        new strict mode, throwing an exception if there are malformed UTF-16 surrogate
+        pairs in the text.
+
+        * kjs/ustring.h: Added a strict version of the UTF-8 string conversion.
+        * kjs/ustring.cpp:
+        (KJS::decodeUTF8Sequence): Removed code to disallow U+FFFE and U+FFFF; while
+        those might be illegal in some sense, they aren't supposed to get any special
+        handling in the place where this function is currently used.
+        (KJS::UString::UTF8String): Added the strictness.
+
+2007-11-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15812
+          some JavaScript tests (from the Mozilla test suite) are failing
+
+        Two or three fixes get 7 more of the Mozilla tests passing.
+        This gets us down from 61 failing tests to 54.
+
+        * kjs/interpreter.h: (KJS::Interpreter::builtinRegExp):
+        Made this inline and gave it a more specific type. Some day we should
+        probably do that for all of these -- might even get a bit of a speed
+        boost from it.
+        * kjs/interpreter.cpp: Removed Interpreter::builtinRegExp now that it's
+        inline in the header.
+
+        * kjs/regexp_object.h:
+        * kjs/regexp_object.cpp:
+        (KJS::RegExpProtoFunc::callAsFunction): Moved test and exec out of the
+        switch statement into the RegExpImp object, so they can be shared with
+        RegExpImp::callAsFunction.
+        (KJS::RegExpImp::match): Added. Common code used by both test and exec.
+        (KJS::RegExpImp::test): Added.
+        (KJS::RegExpImp::exec): Added.
+        (KJS::RegExpImp::implementsCall): Added.
+        (KJS::RegExpImp::callAsFunction): Added.
+        (KJS::RegExpObjectImpPrivate::RegExpObjectImpPrivate): Initialize
+        lastInput to null rather than empty string -- we take advantage of the
+        difference in RegExpImp::match.
+        (KJS::RegExpObjectImp::input): Added. No reason to go through hash tables
+        just to get at a field like this.
+
+        * pcre/pcre_compile.c: (check_escape): Changed the \u handling to match
+        the JavaScript specification. If there are not 4 hex digits after the \u,
+        then it's processed as if it wasn't an escape sequence at all.
+
+        * pcre/pcre_internal.h: Added IS_NEWLINE, with the appropriate definition
+        for JavaScript (4 specific Unicode values).
+        * pcre/pcre_exec.c:
+        (match): Changed all call sites to use IS_NEWLINE.
+        (pcre_exec): Ditto.
+
+        * tests/mozilla/expected.html: Updated to expect 7 more successful tests.
+
+2007-11-03  David D. Kilzer  <ddkilzer@webkit.org>
+
+        Sort files(...); sections of Xcode project files.
+
+        Rubber-stamped by Darin.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-11-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - remove VarDeclListNode and simplify VarDeclNode evaluation for 0.4% SunSpider speedup
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::VarDeclNode::optimizeVariableAccess):
+        (KJS::VarDeclNode::getDeclarations):
+        (KJS::VarDeclNode::handleSlowCase):
+        (KJS::VarDeclNode::evaluateSingle):
+        (KJS::VarDeclNode::evaluate):
+        (KJS::VarStatementNode::execute):
+        * kjs/nodes.h:
+        (KJS::VarDeclNode::):
+        (KJS::VarStatementNode::):
+        * kjs/nodes2string.cpp:
+        (KJS::VarDeclNode::streamTo):
+
+2007-11-03  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15800
+        REGRESSION (r27303): RegExp leaks
+
+        * kjs/regexp_object.h:
+        (KJS::RegExpImp::setRegExp):
+        (KJS::RegExpImp::regExp):
+        (KJS::RegExpImp::classInfo):
+        * kjs/regexp_object.cpp:
+        (RegExpImp::RegExpImp):
+        (RegExpImp::~RegExpImp):
+        Renamed reg member variable to m_regExp, changed it to use OwnPtr.
+
+2007-11-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - add SourceElements as a typedef for Vector<RefPtr<StatementNode> >.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::statementListPushFIFO):
+        (KJS::statementListGetDeclarations):
+        (KJS::statementListInitializeDeclarationStacks):
+        (KJS::statementListInitializeVariableAccessStack):
+        (KJS::statementListExecute):
+        (KJS::BlockNode::BlockNode):
+        (KJS::FunctionBodyNode::FunctionBodyNode):
+        (KJS::ProgramNode::ProgramNode):
+        * kjs/nodes.h:
+        (KJS::CaseClauseNode::):
+
+2007-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15791
+          change property map data structure for less memory use, better speed
+
+        The property map now has an array of indices and a separate array of
+        property map entries. This slightly slows down lookup because of a second
+        memory acess, but makes property maps smaller and faster to iterate in
+        functions like mark().
+
+        SunSpider says this is 1.2% faster, although it makes the bitwise-end test
+        more than 10% slower. To fix that we'll need to optimize global variable lookup.
+
+        * kjs/property_map.cpp:
+        (KJS::PropertyMapEntry::PropertyMapEntry):
+        (KJS::PropertyMapHashTable::entries):
+        (KJS::PropertyMapHashTable::allocationSize):
+        (KJS::SavedProperties::SavedProperties):
+        (KJS::SavedProperties::~SavedProperties):
+        (KJS::PropertyMap::checkConsistency):
+        (KJS::PropertyMap::~PropertyMap):
+        (KJS::PropertyMap::clear):
+        (KJS::PropertyMap::get):
+        (KJS::PropertyMap::getLocation):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::insert):
+        (KJS::PropertyMap::createTable):
+        (KJS::PropertyMap::rehash):
+        (KJS::PropertyMap::remove):
+        (KJS::PropertyMap::mark):
+        (KJS::comparePropertyMapEntryIndices):
+        (KJS::PropertyMap::containsGettersOrSetters):
+        (KJS::PropertyMap::getEnumerablePropertyNames):
+        (KJS::PropertyMap::save):
+        (KJS::PropertyMap::restore):
+        * kjs/property_map.h:
+
+2007-11-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15807
+          HashMap needs a take() function that combines get and remove
+
+        * wtf/HashMap.h: Added take function. Simplistic implementation for now,
+        but still does only one hash table lookup.
+
+        * kjs/array_instance.cpp: (KJS::ArrayInstance::put): Use take rather than
+        a find followed by a remove.
+
+2007-11-02  David Carson  <dacarson@gmail.com>
+
+        Reviewed by Darin.
+
+        Fix compiler warning "warning: suggest parentheses around && within ||"
+        http://bugs.webkit.org/show_bug.cgi?id=15764
+
+        * kjs/value.h: (KJS::JSValue::isNumber): Add parentheses.
+
+2007-11-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        In preparation for making List a simple stack-allocated Vector:
+
+        Removed all instances of List copying and/or assignment, and made List 
+        inherit from Noncopyable.
+        
+        Functions that used to return a List by copy now take List& out 
+        parameters.
+        
+        Layout tests and JS tests pass.
+
+        * kjs/list.cpp:
+        (KJS::List::slice): Replaced copyTail with a more generic slice 
+        alternative. (JavaScriptCore only calls slice(1), but WebCore calls 
+        slice(2)).
+
+2007-11-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=15785
+        REGRESSION(r27344): Crash on load at finance.yahoo.com
+        
+        Reverted a small portion of my last check-in. (The speedup and the List 
+        removal are still there, though.)
+        
+        ActivationImp needs to hold a pointer to its function, and mark that 
+        pointer (rather than accessing its function through its ExecState, and 
+        counting on the active scope to mark its function) because a closure 
+        can cause an ActivationImp to outlive its ExecState along with any 
+        active scope.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::~FunctionImp):
+        (KJS::ActivationImp::ActivationImp):
+        * kjs/function.h:
+        (KJS::ActivationImp::ActivationImpPrivate::ActivationImpPrivate):
+
+        Also made HashTable a little more crash-happy in debug builds, so 
+        problems like this will show up earlier:
+        
+        * wtf/HashTable.h:
+        (WTF::HashTable::~HashTable):
+
+2007-11-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+        
+        Addressed some of Darin's review comments.
+        
+        Used perl -p, which is the shorthand while(<>) {}.
+        
+        Made sure not to suppress bison's output.
+        
+        Added line to removed bison_out.txt, since this script removes other 
+        intermediate files, too.
+
+        * DerivedSources.make:
+
+2007-11-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Removed List from ActivationImp, in preparation for making all lists
+        stack-allocated.
+        
+        Tests pass.
+        
+        1.0% speedup on SunSpider, presumably due to reduced List refcount thrash.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        (KJS::ExecState::~ExecState):
+        * kjs/function.cpp:
+        (KJS::ActivationImp::ActivationImp):
+        (KJS::ActivationImp::createArgumentsObject):
+        * kjs/function.h:
+        (KJS::ActivationImp::ActivationImpPrivate::ActivationImpPrivate):
+
+2007-11-01  Adam Roben  <aroben@apple.com>
+
+        Use jsNumberCell instead of jsNumber when converting double constants to JSValues
+
+        This fixes fast/js/math.html, ecma/Date/15.9.5.10-1.js, and
+        ecma/Date/15.9.5.12-1.js, which were suffering from a bug in MSVC.
+
+        It also gets rid of an MSVC warning that we previously had to silence.
+
+        Reviewed by Geoff.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Turn
+        back on the "overflow in constant arithmetic" warning.
+        * kjs/number_object.cpp:
+        (NumberObjectImp::getValueProperty): Use jsNumberCell instead of
+        jsNumber.
+
+2007-10-31  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * kjs/ExecState.h:
+
+2007-10-31  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - shave some cycles off of local storage access for a 1% SunSpider speedup
+        
+        Keep the LocalStorage pointer in the ExecState, instead of getting
+        it from the ActivationImp all the time.
+
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::updateLocalStorage):
+        * kjs/ExecState.h:
+        (KJS::ExecState::localStorage):
+        * kjs/nodes.cpp:
+        (KJS::LocalVarAccessNode::evaluate):
+        (KJS::LocalVarFunctionCallNode::evaluate):
+        (KJS::PostIncLocalVarNode::evaluate):
+        (KJS::PostDecLocalVarNode::evaluate):
+        (KJS::LocalVarTypeOfNode::evaluate):
+        (KJS::PreIncLocalVarNode::evaluate):
+        (KJS::PreDecLocalVarNode::evaluate):
+        (KJS::ReadModifyLocalVarNode::evaluate):
+        (KJS::AssignLocalVarNode::evaluate):
+        (KJS::FunctionBodyNode::processDeclarationsForFunctionCode):
+
+2007-10-31  Adam Roben  <aroben@apple.com>
+
+        Fix a crash on launch due to a static initializer race
+
+        We now use fast inline assembler spinlocks which can be statically
+        initialized at compile time.
+
+        As a side benefit, this speeds up SunSpider by 0.4%.
+
+        Reviewed by Oliver.
+
+        * wtf/FastMalloc.cpp:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/TCSystemAlloc.cpp:
+
+2007-10-31  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam.
+
+        - Corrected spelling.
+
+        * wtf/HashTraits.h:
+
+2007-10-31  Mark Rowe  <mrowe@apple.com>
+
+        Further Gtk build fixage.
+
+        * kjs/regexp_object.cpp:
+
+2007-10-31  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/regexp.h:
+
+2007-10-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15749
+          RegExp/RegExpObjectImp cause needless UString creation
+
+        Speeds things up 0.4% according to SunSpider.
+
+        * kjs/config.h: Define USE(PCRE16) instead of HAVE(PCREPOSIX),
+        because this library doesn't use the real PCRE -- it uses its
+        own PCRE that works on UTF-16.
+
+        * kjs/regexp.h: Removed a few unused functions. Changed the ifdef.
+        Use Noncopyable. Change the return value of match.
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Call pcre_compile2, for a slight speed boost.
+        (KJS::RegExp::~RegExp): PCRE16 rather than PCREPOSIX.
+        (KJS::RegExp::match): Change to return the position as an int and the
+        ovector as a OwnArrayPtr<int> for efficiency and clearer storage management.
+
+        * kjs/regexp_object.h: Change performMatch and arrayOfMatches to no longer
+        require a result string.
+        * kjs/regexp_object.cpp:
+        (RegExpProtoFunc::callAsFunction): Update for new signature of performMatch.
+        (RegExpObjectImp::performMatch): Change so it doesn't return a string.
+        (RegExpObjectImp::arrayOfMatches): Simplify by unifying the handling of
+        the main result with the backreferences; now it doesn't need to take
+        a result parameter.
+        (RegExpObjectImp::getBackref): Minor tweaks.
+        (RegExpObjectImp::getLastParen): Ditto.
+        (RegExpObjectImp::getLeftContext): Ditto.
+        (RegExpObjectImp::getRightContext): Ditto.
+        (RegExpObjectImp::getValueProperty): Change LastMatch case to call
+        getBackref(0) so we don't need a separate getLastMatch function.
+
+        * kjs/string_object.cpp:
+        (KJS::replace): Update to use new performMatch, including merging the
+        matched string section with the other substrings.
+        (KJS::StringProtoFunc::callAsFunction): Update functions to use the
+        new performMatch and match. Also change to use OwnArrayPtr.
+
+2007-10-31  Oliver Hunt  <oliver@apple.com>
+
+        * kjs/nodes.h: include OwnPtr.h
+
+2007-10-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Remove SourceCodeElement class and replaced with a Vector for a 0.8% gain on sunspider
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::statementListPushFIFO):
+        (KJS::statementListGetDeclarations):
+        (KJS::statementListInitializeDeclarationStacks):
+        (KJS::statementListInitializeVariableAccessStack):
+        (KJS::statementListExecute):
+        (KJS::BlockNode::optimizeVariableAccess):
+        (KJS::BlockNode::BlockNode):
+        (KJS::BlockNode::getDeclarations):
+        (KJS::BlockNode::execute):
+        (KJS::CaseClauseNode::optimizeVariableAccess):
+        (KJS::CaseClauseNode::getDeclarations):
+        (KJS::CaseClauseNode::evalStatements):
+        (KJS::FunctionBodyNode::initializeDeclarationStacks):
+        (KJS::FunctionBodyNode::optimizeVariableAccess):
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        (KJS::statementListStreamTo):
+        (KJS::BlockNode::streamTo):
+        (KJS::CaseClauseNode::streamTo):
+
+2007-10-30  Mark Rowe  <mrowe@apple.com>
+
+        * kjs/property_map.cpp: Added a missing using directive to fix the build
+        for non-Mac ports. Mac worked only because it does the AllInOneFile compile.
+
+2007-10-31  Maciej Stachowiak  <mjs@apple.com>
+
+        * kjs/property_map.cpp: Include HashTable.h the right way to fix the build
+        for non-Mac ports.
+
+2007-10-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin.
+
+        http://bugs.webkit.org/show_bug.cgi?id=11001
+        WebKit doesn't support RegExp.compile method
+
+        Test: fast/js/regexp-compile.html
+
+        * kjs/regexp_object.cpp:
+        (RegExpPrototype::RegExpPrototype):
+        (RegExpProtoFunc::callAsFunction):
+        * kjs/regexp_object.h:
+        (KJS::RegExpProtoFunc::):
+        Added RegExp.compile.
+
+        * tests/mozilla/expected.html: js1_2/regexp/compile.js now passes.
+
+2007-10-31  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - get rid of integer divide in PropertyMap and HashTable for 1% SunSpider speedup
+        
+        Integer divide sucks. Fortunately, a bunch of shifts and XORs
+        biased towards the high bits is sufficient to provide a good
+        double hash. Besides the SunSpider win, I used the dump statistics
+        mode for both to verify that collisions did not increase and that
+        the longest collision chain is not any longer.
+
+        * kjs/property_map.cpp:
+        (KJS::doubleHash):
+        (KJS::PropertyMap::get):
+        (KJS::PropertyMap::getLocation):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::insert):
+        (KJS::PropertyMap::remove):
+        (KJS::PropertyMap::checkConsistency):
+        * wtf/HashTable.h:
+        (WTF::doubleHash):
+        (WTF::::lookup):
+        (WTF::::lookupForWriting):
+        (WTF::::fullLookupForWriting):
+        (WTF::::add):
+
+2007-10-30  Adam Roben  <aroben@apple.com>
+
+        * kjs/collector.h: Make HeapType public so it can be used for non-member
+        things like the HeapConstants struct template. Fixes the build on Windows.
+
+2007-10-30  Adam Roben  <aroben@apple.com>
+
+        Change ALWAYS_INLINE and WTF_PRIVATE_INLINE to use __forceinline on Windows
+
+        Speeds up SunSpider by 0.4%.
+
+        Reviewed by Steve and Maciej.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Disable
+        a warning during LTCG in release builds about double -> float
+        conversion.
+        * wtf/AlwaysInline.h:
+        * wtf/FastMalloc.h:
+
+2007-10-30  Adam Roben  <aroben@apple.com>
+
+        Use GetCurrentThreadId instead of pthread_self in FastMalloc
+
+        Speeds up SunSpider by 0.3%.
+
+        Reviewed by Steve.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::InitTSD):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+
+2007-10-30  Adam Roben  <aroben@apple.com>
+
+        Switch to a Win32 critical section implementation of spinlocks
+        
+        Speeds up SunSpider by 0.4%.
+        
+        Reviewed by Steve.
+        
+        * wtf/FastMalloc.cpp:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::TCMalloc_SpinLock):
+        (TCMalloc_SpinLock::Init):
+        (TCMalloc_SpinLock::Finalize):
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        * wtf/TCSystemAlloc.cpp:
+
+2007-10-30  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 15586: REGRESSION (r26759-r26785): Windows nightly builds crash with Safari 3 Public Beta
+
+        http://bugs.webkit.org/show_bug.cgi?id=15586
+
+        Also fixes: <rdar://5565303> Cannot use regsvr32.exe to register WebKit.dll
+
+        Use Win32 TLS functions instead of __declspec(thread), which breaks
+        delay-loading.
+
+        Reviewed by Steve.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::getThreadHeap):
+        (WTF::TCMalloc_ThreadCache::InitModule):
+
+2007-10-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - allocate numbers in half-size cells, for an 0.5% SunSpider speedup
+        http://bugs.webkit.org/show_bug.cgi?id=15772
+        
+        We do this by using a single mark bit per two number cells, and
+        tweaking marking.
+        
+        Besides being an 0.5% win overall, this is a 7.1% win on morph.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::heapAllocate):
+        (KJS::Collector::markStackObjectsConservatively):
+        (KJS::Collector::sweep):
+        * kjs/collector.h:
+        (KJS::SmallCollectorCell::):
+
+2007-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben, Sam Weinig.
+        
+        Made conflicts in grammar.y a persistent build failure.
+
+        * DerivedSources.make:
+
+2007-10-30  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam and Geoff.
+
+        - Added a new cast so all the casts are in the same place.
+
+        * API/APICast.h:
+        (toGlobalRef):
+
+2007-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed <rdar://problem/5567504> shift/reduce conflict introduced in r24457
+        
+        JS tests, including 
+
+            ecma_2/Statements/dowhile-001.js
+            ecma_2/Statements/dowhile-002.js
+            ecma_2/Statements/dowhile-003.js
+            ecma_2/Statements/dowhile-004.js
+            ecma_2/Statements/dowhile-005.js
+            ecma_2/Statements/dowhile-006.js
+            ecma_2/Statements/dowhile-007.js
+            js1_2/statements/do_while.js
+
+        and layout tests, including
+
+            do-while-expression-value.html
+            do-while-semicolon.html
+            do-while-without-semicolon.html
+        
+        pass.
+        
+        * kjs/grammar.y: Use the explicit "error" production, as we do with other
+        automatic semicolon insertions, to disambiguate "do { } while();" from
+        "do { } while()" followed by ";" (the empty statement).
+
+2007-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Debranching remaining assignment nodes, and miscellaneous cleanup
+        
+        Split read-modify code paths out of AssignBracketNode and AssignDotNode
+        Removed now unnecessary check for write-only assignment in ReadModifyLocalVarNode 
+        and ReadModifyResolveNode evaluate methods
+
+        Leads to a 1% gain in SunSpider.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::ReadModifyLocalVarNode::evaluate):
+        (KJS::ReadModifyResolveNode::evaluate):
+        (KJS::AssignDotNode::evaluate):
+        (KJS::ReadModifyDotNode::optimizeVariableAccess):
+        (KJS::ReadModifyDotNode::evaluate):
+        (KJS::AssignBracketNode::evaluate):
+        (KJS::ReadModifyBracketNode::optimizeVariableAccess):
+        (KJS::ReadModifyBracketNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::AssignBracketNode::):
+        (KJS::AssignBracketNode::precedence):
+        (KJS::AssignDotNode::):
+        (KJS::AssignDotNode::precedence):
+        * kjs/nodes2string.cpp:
+        (KJS::ReadModifyBracketNode::streamTo):
+        (KJS::AssignBracketNode::streamTo):
+        (KJS::ReadModifyDotNode::streamTo):
+        (KJS::AssignDotNode::streamTo):
+
+2007-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Debranching various Node::evaluate implementations
+        
+        Reviewed by Maciej.
+        
+        Split the read-modify-write assignment cases out of AssignResolveNode and into ReadModifyResolveNode
+        Split the increment and decrement cases for Prefix- and Postfix- ResolveNode, BracketNode, and DotNode
+        
+        Gains 1.6% on SunSpider
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::PostIncResolveNode::optimizeVariableAccess):
+        (KJS::PostIncResolveNode::evaluate):
+        (KJS::PostIncLocalVarNode::evaluate):
+        (KJS::PostDecResolveNode::optimizeVariableAccess):
+        (KJS::PostDecResolveNode::evaluate):
+        (KJS::PostDecLocalVarNode::evaluate):
+        (KJS::PostIncBracketNode::evaluate):
+        (KJS::PostDecBracketNode::evaluate):
+        (KJS::PostIncDotNode::evaluate):
+        (KJS::PostDecDotNode::evaluate):
+        (KJS::PreIncResolveNode::optimizeVariableAccess):
+        (KJS::PreIncLocalVarNode::evaluate):
+        (KJS::PreIncResolveNode::evaluate):
+        (KJS::PreDecResolveNode::optimizeVariableAccess):
+        (KJS::PreDecLocalVarNode::evaluate):
+        (KJS::PreDecResolveNode::evaluate):
+        (KJS::PreIncBracketNode::evaluate):
+        (KJS::PreDecBracketNode::evaluate):
+        (KJS::PreIncDotNode::evaluate):
+        (KJS::PreDecDotNode::evaluate):
+        (KJS::ReadModifyResolveNode::optimizeVariableAccess):
+        (KJS::AssignResolveNode::optimizeVariableAccess):
+        (KJS::AssignLocalVarNode::evaluate):
+        (KJS::AssignResolveNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::PostDecResolveNode::):
+        (KJS::PostDecResolveNode::precedence):
+        (KJS::PostDecLocalVarNode::):
+        (KJS::PostfixBracketNode::):
+        (KJS::PostfixBracketNode::precedence):
+        (KJS::PostIncBracketNode::):
+        (KJS::PostIncBracketNode::isIncrement):
+        (KJS::PostDecBracketNode::):
+        (KJS::PostDecBracketNode::isIncrement):
+        (KJS::PostfixDotNode::):
+        (KJS::PostfixDotNode::precedence):
+        (KJS::PostIncDotNode::):
+        (KJS::PostIncDotNode::isIncrement):
+        (KJS::PostDecDotNode::):
+        (KJS::PreIncResolveNode::):
+        (KJS::PreDecResolveNode::):
+        (KJS::PreDecResolveNode::precedence):
+        (KJS::PreDecLocalVarNode::):
+        (KJS::PrefixBracketNode::):
+        (KJS::PrefixBracketNode::precedence):
+        (KJS::PreIncBracketNode::):
+        (KJS::PreIncBracketNode::isIncrement):
+        (KJS::PreDecBracketNode::):
+        (KJS::PreDecBracketNode::isIncrement):
+        (KJS::PrefixDotNode::):
+        (KJS::PrefixDotNode::precedence):
+        (KJS::PreIncDotNode::):
+        (KJS::PreIncDotNode::isIncrement):
+        (KJS::PreDecDotNode::):
+        (KJS::ReadModifyResolveNode::):
+        (KJS::ReadModifyLocalVarNode::):
+        (KJS::AssignResolveNode::):
+        (KJS::AssignResolveNode::precedence):
+        * kjs/nodes2string.cpp:
+        (KJS::PostIncResolveNode::streamTo):
+        (KJS::PostDecResolveNode::streamTo):
+        (KJS::PostfixBracketNode::streamTo):
+        (KJS::PostfixDotNode::streamTo):
+        (KJS::PreIncResolveNode::streamTo):
+        (KJS::PreDecResolveNode::streamTo):
+        (KJS::ReadModifyResolveNode::streamTo):
+        (KJS::AssignResolveNode::streamTo):
+
+2007-10-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+        
+        - Include Vector.h in a way that actually works.
+
+        * kjs/LocalStorage.h:
+
+2007-10-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+        
+        - Install LocalStorage.h as a private header.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-10-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - Define good VectorTraits for LocalStorage entry for 0.5% speed improvement on SunSpider.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/LocalStorage.h: Added.
+        (KJS::LocalStorageEntry::LocalStorageEntry):
+        (WTF::):
+        * kjs/function.h:
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNode::processDeclarationsForFunctionCode):
+
+2007-10-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Some small tweaks that I notice while reviewing Oliver's last patch.
+        
+        Includes removal of an unnecessary KJS_CHECKEXCEPTIONVALUE.
+        
+        No change in SunSpider because SunSpider doesn't take the code path that
+        would execute the unnecessary KJS_CHECKEXCEPTIONVALUE much.
+
+        * kjs/nodes.cpp:
+        (KJS::LocalVarPostfixNode::evaluate):
+        (KJS::TypeOfResolveNode::optimizeVariableAccess):
+        (KJS::LocalVarTypeOfNode::evaluate):
+        (KJS::PrefixResolveNode::optimizeVariableAccess):
+        (KJS::LocalVarPrefixNode::evaluate):
+        (KJS::AssignResolveNode::optimizeVariableAccess):
+        (KJS::LocalVarAssignNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::LocalVarTypeOfNode::):
+        (KJS::PrefixResolveNode::):
+        (KJS::LocalVarPrefixNode::):
+        (KJS::AssignResolveNode::):
+        (KJS::LocalVarAssignNode::):
+
+2007-10-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+        
+        SunSpider claims this was a 0.7% speedup.
+
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFunc::callAsFunction): avoid mallocing a jsString in the common case
+
+2007-10-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark.
+        
+        - re-enable asserts for access to empty or deleted keys
+
+        * wtf/HashTable.h:
+        (WTF::::lookup):
+        (WTF::::lookupForWriting):
+        (WTF::::fullLookupForWriting):
+        (WTF::::add):
+
+2007-10-29  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        * JavaScriptCore.exp: Export symbol for new StringInstance::getOwnPropertySlot
+
+2007-10-29  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.  Move struct declarations into nodes.h.
+
+        * kjs/grammar.y:
+        * kjs/nodes.h:
+
+2007-10-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+        
+        Give StringInstance a getOwnPropertySlot(ExecState, unsigned, PropertySlot) fastpath, just like Arrays.
+        Make it a compile time error to use toString(ExecState) on a StringInstance
+        
+        SunSpider claims this was a 6.6% speedup overall (22% on string-base64)
+
+        * kjs/internal.h:
+        (KJS::StringImp::getLength):
+        * kjs/string_object.cpp:
+        (KJS::StringInstance::lengthGetter):
+        (KJS::StringInstance::inlineGetOwnPropertySlot):
+        (KJS::StringInstance::getOwnPropertySlot):
+        * kjs/string_object.h:
+
+2007-10-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        Add nodes to allow Assignment, TypeOf, and prefix operators to 
+        make use of the new optimised local variable look up.
+
+        5% gain on sunspider
+
+        * kjs/nodes.cpp:
+        (KJS::TypeOfResolveNode::optimizeVariableAccess):
+        (KJS::LocalTypeOfAccessNode::evaluate):
+        (KJS::PrefixResolveNode::optimizeVariableAccess):
+        (KJS::PrefixLocalAccessNode::evaluate):
+        (KJS::AssignResolveNode::optimizeVariableAccess):
+        (KJS::AssignLocalAccessNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::TypeOfResolveNode::):
+        (KJS::TypeOfResolveNode::precedence):
+        (KJS::LocalTypeOfAccessNode::):
+        (KJS::PrefixResolveNode::):
+        (KJS::PrefixResolveNode::precedence):
+        (KJS::PrefixLocalAccessNode::):
+        (KJS::AssignResolveNode::):
+        (KJS::AssignLocalAccessNode::):
+
+2007-10-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - avoid creating and then breaking circular lists in the parser, instead track head and tail pointers at parse time
+        http://bugs.webkit.org/show_bug.cgi?id=15748
+        
+        Not a significant speedup or slowdown on SunSpider.
+
+        * kjs/Parser.cpp:
+        (KJS::clearNewNodes):
+        * kjs/Parser.h:
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::BlockNode::BlockNode):
+        (KJS::CaseBlockNode::CaseBlockNode):
+        (KJS::FunctionBodyNode::FunctionBodyNode):
+        (KJS::SourceElementsNode::SourceElementsNode):
+        (KJS::ProgramNode::ProgramNode):
+        * kjs/nodes.h:
+        (KJS::ElementNode::):
+        (KJS::ArrayNode::):
+        (KJS::PropertyListNode::):
+        (KJS::ObjectLiteralNode::):
+        (KJS::ArgumentListNode::):
+        (KJS::ArgumentsNode::):
+        (KJS::VarDeclListNode::):
+        (KJS::VarStatementNode::):
+        (KJS::ForNode::):
+        (KJS::ParameterNode::):
+        (KJS::FuncExprNode::):
+        (KJS::FuncDeclNode::):
+        (KJS::SourceElementsNode::):
+        (KJS::CaseClauseNode::):
+        (KJS::ClauseListNode::):
+
+2007-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Disable assertions in a manner that doesn't break the Qt Windows build.
+
+        * wtf/HashTable.h:
+        (WTF::::lookup):
+        (WTF::::lookupForWriting):
+        (WTF::::fullLookupForWriting):
+
+2007-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Temporarily disabling some ASSERTs I introduced in my last check-in 
+        because of http://bugs.webkit.org/show_bug.cgi?id=15747
+        Lots of layout tests fail the !HashTranslator::equal(KeyTraits::emptyValue() ASSERT
+
+        * wtf/HashTable.h:
+        (WTF::::lookup):
+        (WTF::::lookupForWriting):
+        (WTF::::fullLookupForWriting):
+        (WTF::::add):
+
+2007-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=15746
+        #ifndef ASSERT_DISABLED is no good!
+        
+        Replaced with #if !ASSERT_DISABLED.
+
+        * wtf/HashTable.h:
+        (WTF::::lookup):
+        (WTF::::lookupForWriting):
+        (WTF::::fullLookupForWriting):
+        (WTF::::add):
+
+2007-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Added FunctionCallResolveNode, PostfixResolveNode, and DeleteResolveNode
+        to the AST transfom that replaces slow resolve nodes with fast local 
+        variable alternatives.
+        
+        2.5% speedup on SunSpider.
+        
+        Also added some missing copyright notices.
+        
+        * kjs/nodes.cpp:
+        (KJS::FunctionCallResolveNode::optimizeVariableAccess):
+        (KJS::FunctionCallResolveNode::evaluate):
+        (KJS::LocalVarFunctionCallNode::evaluate):
+        (KJS::PostfixResolveNode::optimizeVariableAccess):
+        (KJS::PostfixResolveNode::evaluate):
+        (KJS::LocalVarPostfixNode::evaluate):
+        (KJS::DeleteResolveNode::optimizeVariableAccess):
+        (KJS::DeleteResolveNode::evaluate):
+        (KJS::LocalVarDeleteNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::FunctionCallResolveNode::):
+        (KJS::LocalVarFunctionCallNode::LocalVarFunctionCallNode):
+        (KJS::PostfixResolveNode::):
+        (KJS::LocalVarPostfixNode::LocalVarPostfixNode):
+        (KJS::DeleteResolveNode::):
+        (KJS::LocalVarDeleteNode::LocalVarDeleteNode):
+
+2007-10-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+        
+        Inline UString::Rep::deref() for a 0.8% improvement in SunSpider
+        Add virtual keyword to a few virtual functions previously unmarked.
+
+        * kjs/internal.h:
+        (KJS::StringImp::type):
+        (KJS::NumberImp::type):
+        * kjs/ustring.h:
+        (KJS::UString::Rep::deref):
+
+2007-10-28  Darin Adler  <darin@apple.com>
+
+        - fix "broken everything" from the storage leak fix
+
+        * wtf/RefPtr.h: (WTF::RefPtr::RefPtr): Added a PlacementNewAdopt constructor.
+        * kjs/ustring.h: (KJS::UString::UString): Pass PlacementNewAdopt along to RefPtr.
+
+2007-10-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam.
+
+        - turn on unused parameter waring on Mac OS X because it's already on elsewhere
+
+        * Configurations/Base.xcconfig: Took out -wno-unused-parameter.
+
+        * API/JSNode.c:
+        * API/JSNodeList.c:
+        * API/minidom.c:
+        * API/testapi.c:
+        Fixed unused variables by using them or marked them with UNUSED_PARAM.
+
+        * kjs/CollectorHeapIntrospector.h: (KJS::CollectorHeapIntrospector::zoneCalloc):
+        Removed parameter names to indicate they are unused.
+
+2007-10-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix a storage leak where we ref the UString every time we replace
+          a ResolveNode with a LocalVarAccessNode
+
+        * kjs/identifier.h: (KJS::Identifier::Identifier): Added a constructor
+        that takes PlacementNewAdopt.
+
+        * kjs/nodes.h: (KJS::ResolveNode::ResolveNode): Initialize the ident
+        with PlacementNewAdopt instead of the old value of ident.
+
+        * kjs/ustring.h: (KJS::UString::UString): Added a constructor that
+        takes PlacementNewAdopt.
+
+2007-10-28  Darin Adler  <darin@apple.com>
+
+        - Windows build fix; get rid of unused parameter
+
+        * kjs/nodes.cpp: (KJS::ResolveNode::optimizeVariableAccess): Don't pass it.
+        * kjs/nodes.h: (KJS::LocalVarAccessNode::LocalVarAccessNode): Remove it.
+        The assertions weren't all that helpful.
+
+2007-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.  Add include of MathExtras.h.
+
+        * kjs/string_object.cpp:
+
+2007-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej and Tim.
+
+        Replace uses of isNaN and isInf with isnan and isinf, and
+        remove isNaN and isInf.
+
+        * kjs/config.h: Remove unused HAVE_'s.
+        * kjs/date_object.cpp:
+        (KJS::DateInstance::getTime):
+        (KJS::DateInstance::getUTCTime):
+        (KJS::DateProtoFunc::callAsFunction):
+        (KJS::DateObjectImp::construct):
+        (KJS::DateObjectFuncImp::callAsFunction):
+        * kjs/function.cpp:
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/math_object.cpp:
+        (MathFuncImp::callAsFunction):
+        * kjs/nodes2string.cpp:
+        (KJS::isParserRoundTripNumber):
+        * kjs/number_object.cpp:
+        (NumberProtoFunc::callAsFunction):
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFunc::callAsFunction):
+        * kjs/ustring.cpp:
+        (KJS::UString::from):
+        * kjs/value.cpp:
+        (KJS::JSValue::toInteger):
+        (KJS::JSValue::toInt32SlowCase):
+        (KJS::JSValue::toUInt32SlowCase):
+
+2007-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: use the new-fangled missingSymbolMarker().
+
+        * kjs/nodes.cpp:
+        (KJS::ResolveNode::optimizeVariableAccess):
+        * kjs/nodes.h:
+        (KJS::LocalVarAccessNode::LocalVarAccessNode):
+
+2007-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak, Darin Adler.
+        
+        Much supporting work done by Maciej Stachowiak, Maks Orlovich, and 
+        Cameron Zwarich.
+        
+        AST transfom to replace slow resolve nodes with fast local variable
+        alternatives that do direct memory access. Currently, only ResolveNode
+        provides a fast local variable alternative. 6 others are soon to come.
+        
+        16.7% speedup on SunSpider.
+        
+        Most of this patch is just scaffolding to support iterating all the 
+        resolve nodes in the AST through optimizeResolveNodes(). In 
+        optimizeResolveNodes(), most classes just push their child nodes onto 
+        the processing stack, while ResolveNodes actually replace themselves in 
+        the tree with more optimized alternatives, if possible.
+
+        Here are the interesting bits:
+
+        * kjs/nodes.h: Added PlacementNewAdoptTag, along with implementations 
+        in Node and ResolveNode. This tag allows you to use placement new to 
+        swap out a base class Node in favor of a subclass copy that holds the
+        same data. (Without this tag, default initialization would NULL out
+        RefPtrs, change line numbers, etc.)
+
+        * kjs/nodes.cpp:
+        (KJS::ResolveNode::evaluate): Since we're taking the slow path, ASSERT
+        that the fast path is impossible, to make sure we didn't leave anything
+        on the table.
+
+        (KJS::FunctionBodyNode::optimizeResolveNodes): Here's where the AST 
+        transformation happens.
+        
+        (KJS::ResolveNode::optimizeResolveNodes): Here's where the ResolveNode
+        optimization happens.
+
+        * kjs/function.h: Added symbolTable() accessor for, for the sake of 
+        an ASSERT.
+
+2007-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej.
+
+        Fix "AllInOneFile.o has a global initializer in it".
+
+        Some versions of gcc generate a global initializer for std::numeric_limits<size_t>::max().
+        We can avoid this by moving it inside an inline function.
+
+        * kjs/SymbolTable.h:
+        (KJS::missingSymbolMarker):
+        * kjs/function.cpp:
+        (KJS::ActivationImp::getOwnPropertySlot):
+        (KJS::ActivationImp::put):
+
+2007-10-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark.
+        
+        - Added assertions to protect against adding empty or deleted keys to a HashTable
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::lookup):
+        (WTF::HashTable::lookupForWriting):
+        (WTF::HashTable::fullLookupForWriting):
+        (WTF::HashTable::add):
+
+2007-10-28  Darin Adler  <darin@apple.com>
+
+        - fix GTK build
+
+        * kjs/nodes2string.cpp: (KJS::isParserRoundTripNumber):
+        Use isNaN and isInf instead of isnan and isinf.
+
+2007-10-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15735
+          remove GroupNode to simplify AST and possibly get a modest speedup
+
+        This patch removes 4 node types: GroupNode, PropertyNameNode,
+        FunctionCallParenBracketNode, and FunctionCallParenDotNode.
+
+        To remove GroupNode, we add knowledge of precedence to the tree nodes,
+        and use that when serializing to determine where parentheses are needed.
+        This means we no longer have to represent parentheses in the tree.
+
+        The precedence values are named after productions in the grammar from the
+        JavaScript standard.
+
+        SunSpider says this is an 0.4% speedup.
+
+        * kjs/function.h:
+        * kjs/function.cpp: Removed escapeStringForPrettyPrinting -- it's part of
+        serialization, so I moved it to the file that takes care of that.
+
+        * kjs/grammar.y: Changed makeGetterOrSetterPropertyNode to use 0 to
+        indicate failure instead of a separate boolean. Got rid of PropertyNameNode
+        by merging the PropertyName rule into the Property rule (which was easier
+        than figuring out how to pass the Identifier from one node to another).
+        Got rid of GroupNode, nodeInsideAllParens(), FunctionCallParenBracketNode,
+        and FunctionCallParenDotNode.
+
+        * kjs/nodes.h: Removed unused forward declarations and Operator values.
+        Added Precedence enum, and precedence function to all nodes. Removed
+        nodeInsideAllParens. Added streamBinaryOperator function for serialization.
+        Removed GroupNode and PropertyNameNode. Made PropertyNode store an Identifier.
+        Removed FunctionCallParenBracketNode and FunctionCallParenDotNode.
+
+        * kjs/nodes.cpp: Removed Node::nodinsideAllParens, GroupNode, and PropertyNameNode.
+        (KJS::PropertyListNode::evaluate): Changed code to get name directly instead
+        of converting it from an Identifier to a jsString then back to a UString
+        then into an Identifier again!
+
+        * kjs/nodes2string.cpp: Changed special-token implementation to use a separate
+        function for each of Endl, Indent, Unindent, and DotExpr instead of using a
+        single function with a switch. Added a precedence that you can stream in, to
+        cause the next node serialized to add parentheses based on that precedence value.
+        (KJS::operatorString): Moved to the top of the file.
+        (KJS::escapeStringForPrettyPrinting): Moved here from function.cpp. Removed old
+        workaround for snprintf, since StringExtras.h takes care of that.
+        (KJS::operator<<): Made the char and char* versions faster by using UString's
+        character append functions instead of constructing a UString. Added the logic
+        to the Node* version to add parentheses if needed.
+        (KJS::Node::streamLeftAssociativeBinaryOperator): Added helper function.
+        (KJS::ElementNode::streamTo): Use PrecAssignment for the elements.
+        (KJS::BracketAccessorNode::streamTo): Use PrecCall for the expression before
+        the bracket.
+        (KJS::DotAccessorNode::streamTo): Use PrecCall for the expression before the dot.
+        (KJS::ArgumentListNode::streamTo): Use PrecAssignment for the arguments.
+        (KJS::NewExprNode::streamTo): Use PrecMember for the expression.
+        (KJS::FunctionCallValueNode::streamTo): Use PrecCall.
+        (KJS::FunctionCallBracketNode::streamTo): Ditto.
+        (KJS::FunctionCallDotNode::streamTo): Ditto.
+        (KJS::PostfixBracketNode::streamTo): Ditto.
+        (KJS::PostfixDotNode::streamTo): Ditto.
+        (KJS::PostfixErrorNode::streamTo): Use PrecLeftHandSide.
+        (KJS::DeleteBracketNode::streamTo): Use PrecCall.
+        (KJS::DeleteDotNode::streamTo): Ditto.
+        (KJS::DeleteValueNode::streamTo): Use PrecUnary.
+        (KJS::VoidNode::streamTo): Ditto.
+        (KJS::TypeOfValueNode::streamTo): Ditto.
+        (KJS::PrefixBracketNode::streamTo): Use PrecCall.
+        (KJS::PrefixDotNode::streamTo): Ditto.
+        (KJS::PrefixErrorNode::streamTo): Use PrecUnary.
+        (KJS::UnaryPlusNode::streamTo): Ditto.
+        (KJS::NegateNode::streamTo): Ditto.
+        (KJS::BitwiseNotNode::streamTo): Ditto.
+        (KJS::LogicalNotNode::streamTo): Ditto.
+        (KJS::MultNode::streamTo): Use streamLeftAssociativeBinaryOperator.
+        (KJS::DivNode::streamTo): Ditto.
+        (KJS::ModNode::streamTo): Ditto.
+        (KJS::AddNode::streamTo): Ditto.
+        (KJS::SubNode::streamTo): Ditto.
+        (KJS::LeftShiftNode::streamTo): Ditto.
+        (KJS::RightShiftNode::streamTo): Ditto.
+        (KJS::UnsignedRightShiftNode::streamTo): Ditto.
+        (KJS::LessNode::streamTo): Ditto.
+        (KJS::GreaterNode::streamTo): Ditto.
+        (KJS::LessEqNode::streamTo): Ditto.
+        (KJS::GreaterEqNode::streamTo): Ditto.
+        (KJS::InstanceOfNode::streamTo): Ditto.
+        (KJS::InNode::streamTo): Ditto.
+        (KJS::EqualNode::streamTo): Ditto.
+        (KJS::NotEqualNode::streamTo): Ditto.
+        (KJS::StrictEqualNode::streamTo): Ditto.
+        (KJS::NotStrictEqualNode::streamTo): Ditto.
+        (KJS::BitAndNode::streamTo): Ditto.
+        (KJS::BitXOrNode::streamTo): Ditto.
+        (KJS::BitOrNode::streamTo): Ditto.
+        (KJS::LogicalAndNode::streamTo): Ditto.
+        (KJS::LogicalOrNode::streamTo): Ditto.
+        (KJS::ConditionalNode::streamTo): Ditto.
+        (KJS::AssignResolveNode::streamTo): Use PrecAssignment for the right side.
+        (KJS::AssignBracketNode::streamTo): Use PrecCall for the expression before
+        the bracket and PrecAssignment for the right side.
+        (KJS::AssignDotNode::streamTo): Ditto.
+        (KJS::AssignErrorNode::streamTo): Use PrecLeftHandSide for the left side
+        and PrecAssignment for the right side.
+        (KJS::CommaNode::streamTo): Use PrecAssignment for both expressions.
+        (KJS::AssignExprNode::streamTo): Use PrecAssignment.
+
+2007-10-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Define wx port and set wx port USE options.
+
+        Reviewed by Adam Roben.
+
+        * wtf/Platform.h:
+
+2007-10-28  Mark Rowe  <mrowe@apple.com>
+
+        We don't include "config.h" in headers.
+
+        * bindings/jni/jni_instance.h:
+        * kjs/regexp.h:
+        * wtf/TCPageMap.h:
+        * wtf/TCSpinLock.h:
+
+2007-10-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Mark.
+        
+        - avoid using non-portable SIZE_T_MAX in favor of std::numeric_limits
+
+        * kjs/SymbolTable.h:
+        (KJS::SymbolTableIndexHashTraits::emptyValue):
+        * kjs/function.cpp:
+        (KJS::ActivationImp::getOwnPropertySlot):
+        (KJS::ActivationImp::put):
+
+2007-10-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric.
+        
+        - switch SymbolTable to be a HashMap instead of a PropertyMap for 3% SunSpider speedup
+
+        * kjs/SymbolTable.h:
+        (KJS::IdentifierRepHash::hash): Special hash function for identifier reps.
+        (KJS::IdentifierRepHash::equal): ditto
+        (KJS::SymbolTableIndexHashTraits::emptyValue): Special HashTraits for the index value.
+        (KJS::SymbolTable): change to a typedef for a HashMap.
+        * kjs/function.cpp:
+        (KJS::ActivationImp::getOwnPropertySlot): Adjusted for new SymbolTable API.
+        (KJS::ActivationImp::deleteProperty): ditto
+        (KJS::ActivationImp::put): ditto
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNode::initializesymbolTable): Adjusted, since
+        you now have to store a UString::rep, not an identifier.
+
+2007-10-27  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - numerous HashTable performance improvements
+        
+        This does not quite add up to a measurable win on SunSpider, but it allows a
+        follow-on > 3% improvement and probably helps WebCore too.
+        
+        I made the following improvements, among others:
+        
+        - Made HashFunctions note whether it is ok to compare a real value with the equal() function
+        to the empty or deleted value, and used this to optimize the comparisons done in hash lookup.
+        
+        - Specialized lookup so it doesn't have to do so many extra branches and build so many extra
+        std::pairs for cases that don't need them. There are now four versions, one for read-only access,
+        two for writing, and one folded directly into add() (these all were improvments).
+        
+        - Made HashMap::get() use lookup() directly instead of find() to avoid having to build iterators.
+        
+        - Made a special constructor for iterators that knows it points to
+        a valid filled cell and so skips updating itself.
+
+        - Reordered memory accesses in the various lookup functions for better code generation
+        
+        - Made simple translators avoid passing a hash code around
+        
+        - Other minor tweaks
+        
+        * wtf/HashTable.h:
+        (WTF::):
+        (WTF::HashTableConstIterator::HashTableConstIterator):
+        (WTF::HashTableIterator::HashTableIterator):
+        (WTF::IdentityHashTranslator::translate):
+        (WTF::HashTable::end):
+        (WTF::HashTable::lookup):
+        (WTF::HashTable::lookupForWriting):
+        (WTF::HashTable::makeKnownGoodIterator):
+        (WTF::HashTable::makeKnownGoodConstIterator):
+        (WTF::::lookup):
+        (WTF::::lookupForWriting):
+        (WTF::::fullLookupForWriting):
+        (WTF::::add):
+        (WTF::::addPassingHashCode):
+        (WTF::::reinsert):
+        (WTF::::find):
+        (WTF::::contains):
+        * kjs/identifier.cpp:
+        (WTF::):
+        * wtf/HashFunctions.h:
+        (WTF::):
+        * wtf/HashMap.h:
+        (WTF::):
+        (WTF::::get):
+        * wtf/HashSet.h:
+        (WTF::):
+        (WTF::::add):
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetTranslator::translate):
+
+2007-10-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - fix ASCIICType.h for some Windows compiles
+
+        * wtf/ASCIICType.h: Check the compiler, not the OS, since it's the
+        compiler/library that has the wchar_t that is just a typedef.
+
+2007-10-27  Kevin McCullough  <kmccullough@apple.com>
+
+        - BuildFix
+        - Forgot to change the build step when I changed the filename.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2007-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed the rest of "ASSERTION FAILED: _hash in KJS::UString::Rep::
+        computedHash()"
+        http://bugs.webkit.org/show_bug.cgi?id=15718
+
+        * kjs/identifier.cpp: Fixed more cases where an Identifier didn't get a 
+        hash value. Also changed O(n) strlen to O(1) check for empty string.
+        (KJS::Identifier::add):
+
+        * kjs/ustring.cpp: Changed O(n) strlens to O(1) checks for empty string.
+        (KJS::UString::UString):
+        (KJS::UString::operator=):
+
+2007-10-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - fix pow on Windows
+
+        * wtf/MathExtras.h: (wtf_pow): Add a special case for MSVC, which has
+        a "pow" function that does not properly handle the case where arg1 is
+        NaN and arg2 is 0.
+
+        * kjs/math_object.cpp: (MathFuncImp::callAsFunction): Don't explicity
+        specify "::pow" -- just "pow" is fine.
+
+2007-10-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15711
+          force JSImmediate to be inlined for roughly 1.2% SunSpider speedup
+
+        * kjs/JSImmediate.h: Put ALWAYS_INLINE on everything.
+
+        * kjs/object.h: Removed redundant includes.
+        * kjs/value.h: Ditto.
+
+2007-10-27  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark.
+        
+        - fixed "ASSERTION FAILED: _hash in KJS::UString::Rep::computedHash()"
+        http://bugs.webkit.org/show_bug.cgi?id=15718
+
+        * kjs/identifier.cpp:
+        (KJS::Identifier::addSlowCase): Ensure that empty Identifiers have a hash computed,
+        now that we count on all Identifiers already having one.
+
+2007-10-27  Mark Rowe  <mrowe@apple.com>
+
+        Silence a warning.
+
+        * kjs/SymbolTable.h:
+
+2007-10-27  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/function.h:
+
+2007-10-26  Kevin McCullough  <kmccullough@apple.com>
+
+       Rubber stamp by Adam. 
+
+        - Renamed JSStringRefCOM to JSStringRefBSTR since it he only thing the
+        files contain are functions that operate on BSTRs.
+
+        * API/JSStringRefBSTR.cpp: Copied from API/JSStringRefCOM.cpp.
+        * API/JSStringRefBSTR.h: Copied from API/JSStringRefCOM.h.
+        * API/JSStringRefCOM.cpp: Removed.
+        * API/JSStringRefCOM.h: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2007-10-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam.
+
+        - Made JSStringCreateWithBSTR capable of handling null BSTRs.
+
+        * API/JSStringRefCOM.cpp:
+        (JSStringCreateWithBSTR):
+
+2007-10-26  Sam Weinig  <sam@webkit.org>
+
+        Windows build fix.
+
+        * kjs/SymbolTable.h: Add header gaurd.
+        * kjs/nodes.h: #include "SymbolTable.h"
+
+2007-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Anders Carlsson.
+        
+        Fixed tyop.
+
+        * kjs/function.cpp:
+        (KJS::ActivationImp::getOwnPropertySlot):
+
+2007-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+        
+        Use computedHash(), which is safer than just directly accessing _hash.
+
+        * kjs/lookup.cpp:
+        (KJS::Lookup::findEntry):
+        (KJS::Lookup::find):
+
+2007-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: svn add SymbolTable.h
+
+        * kjs/SymbolTable.h: Added.
+        (KJS::SymbolTable::set):
+        (KJS::SymbolTable::get):
+
+2007-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export SymbolTable.h to WebCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2007-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Comment tweak suggested by Maciej.
+
+        * kjs/function.cpp:
+        (KJS::ActivationImp::getOwnPropertySlot):
+
+2007-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Tweaked property maps to remove 2 branches. 2.5% speedup on SunSpider.
+
+        * kjs/property_map.cpp: Use a special no branch accessor to the UString's
+        hash value. Also, return immediately instead of branching to the end
+        of the loop if the value is not found.
+        (KJS::PropertyMap::get):
+        (KJS::PropertyMap::getLocation):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::insert):
+        (KJS::PropertyMap::remove):
+        (KJS::PropertyMap::checkConsistency):
+
+        * kjs/ustring.h:
+        (KJS::UString::Rep::computedHash): Special no branch accessor to the
+        UString's hash value. Used when the caller knows that the hash value
+        has already been computed. (For example, if the caller got the UString
+        from an Identifier.)
+
+2007-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Switched ActivationImp to using a symbol table. For now, though, all
+        clients take the slow path.
+        
+        Net .6% speedup on SunSpider.
+        
+        Slowdowns:
+            - ActivationImp now mallocs in its constructor
+            - Local variable hits use an extra level of indirection to retrieve 
+            data
+            - Local variable misses do two lookups
+
+        Speedups:
+            - Fast initialization of local variables upon function entry
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added SymbolTable.h
+        
+        * kjs/function.cpp:
+        (KJS::ActivationImp::ActivationImp): Malloc a private structure to hold
+        data that won't fit in a JSCell.
+        (KJS::ActivationImp::argumentsGetter): Use slow symbol table path for 
+        lookup.
+        (KJS::ActivationImp::getOwnPropertySlot): ditto
+        (KJS::ActivationImp::deleteProperty): ditto
+        (KJS::ActivationImp::put): ditto
+        (KJS::ActivationImp::createArgumentsObject): ditto
+
+        (KJS::ActivationImp::mark): Call JSObject::mark first so that one of
+        our properties doesn't try to recursively mark us. (This caused a crash
+        in earlier testing. Not sure why we haven't run into it before.)
+
+        * kjs/nodes.cpp: Functions now build a symbol table the first time 
+        they're called.
+        (KJS::VarDeclNode::evaluate):
+        (KJS::FunctionBodyNode::FunctionBodyNode):
+        (KJS::FunctionBodyNode::initializeSymbolTable):
+        (KJS::FunctionBodyNode::processDeclarations):
+        (KJS::FunctionBodyNode::processDeclarationsForFunctionCode):
+        (KJS::FunctionBodyNode::processDeclarationsForProgramCode):
+
+        * kjs/nodes.h:
+        (KJS::FunctionBodyNode::symbolTable):
+
+        * wtf/Forward.h: Added Vector.
+
+2007-10-26  Kevin McCullough  <kmccullough@apple.com>
+
+        - Corrected function name mistake in this changelog.
+
+2007-10-26  Kevin McCullough  <kmccullough@apple.com>
+        Reviewed by Sam and Steve.
+
+        - Added convenience methods for converting between BSTR and JSStringRefs
+
+        * API/JSStringRefCOM.cpp: Added.
+        (JSStringCreateWithBSTR):
+        (JSStringCopyBSTR):
+        * API/JSStringRefCOM.h: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2007-10-26  Mark Rowe  <mrowe@apple.com>
+
+        Windows build fix.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+
+2007-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Make the JSC GC use a separate heap for JSNumbers to get a 0.7-1.4% progression in SunSpider.
+
+        * kjs/CollectorHeapIntrospector.cpp:
+        (KJS::CollectorHeapIntrospector::init):
+        (KJS::CollectorHeapIntrospector::enumerate):
+        * kjs/CollectorHeapIntrospector.h:
+        * kjs/collector.cpp:
+        (KJS::Collector::recordExtraCost):
+        (KJS::Collector::heapAllocate):
+        (KJS::Collector::allocate):
+        (KJS::Collector::allocateNumber):
+        (KJS::Collector::registerThread):
+        (KJS::Collector::markStackObjectsConservatively):
+        (KJS::Collector::markMainThreadOnlyObjects):
+        (KJS::Collector::sweep):
+        (KJS::Collector::collect):
+        * kjs/collector.h:
+        * kjs/internal.h:
+        (KJS::NumberImp::operator new):
+          Force numbers to be allocated in the secondary heap.
+
+2007-10-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - encourage GCC a little harder to inline a few hot functions for 1.5% improvement on SunSpider.
+
+        * kjs/value.h:
+        (KJS::JSValue::getUInt32):
+        (KJS::JSValue::getTruncatedInt32):
+        (KJS::JSValue::toNumber):
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::~PassRefPtr):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::operator->):
+
+2007-10-26  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/ExecState.h:
+
+2007-10-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark.
+
+        - Merge Context class fully into ExecState, since they are always created and used together.
+
+        No measurable performance impact but this is a useful cleanup.
+
+        * JavaScriptCore.pri:
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::ExecState):
+        (KJS::ExecState::~ExecState):
+        (KJS::ExecState::mark):
+        (KJS::ExecState::lexicalInterpreter):
+        * kjs/ExecState.h:
+        (KJS::ExecState::dynamicInterpreter):
+        (KJS::ExecState::setException):
+        (KJS::ExecState::clearException):
+        (KJS::ExecState::exception):
+        (KJS::ExecState::exceptionSlot):
+        (KJS::ExecState::hadException):
+        (KJS::ExecState::scopeChain):
+        (KJS::ExecState::callingExecState):
+        (KJS::ExecState::propertyNames):
+        * kjs/collector.cpp:
+        (KJS::Collector::reportOutOfMemoryToAllInterpreters):
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::FunctionImp::argumentsGetter):
+        (KJS::FunctionImp::callerGetter):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::Interpreter):
+        (KJS::Interpreter::init):
+        (KJS::Interpreter::evaluate):
+        (KJS::Interpreter::mark):
+        * kjs/interpreter.h:
+        (KJS::Interpreter::setCurrentExec):
+        (KJS::Interpreter::currentExec):
+        * kjs/nodes.cpp:
+        (KJS::currentSourceId):
+        (KJS::currentSourceURL):
+        (KJS::ThisNode::evaluate):
+        (KJS::ResolveNode::evaluate):
+        (KJS::FunctionCallResolveNode::evaluate):
+        (KJS::PostfixResolveNode::evaluate):
+        (KJS::DeleteResolveNode::evaluate):
+        (KJS::TypeOfResolveNode::evaluate):
+        (KJS::PrefixResolveNode::evaluate):
+        (KJS::AssignResolveNode::evaluate):
+        (KJS::VarDeclNode::evaluate):
+        (KJS::DoWhileNode::execute):
+        (KJS::WhileNode::execute):
+        (KJS::ForNode::execute):
+        (KJS::ForInNode::execute):
+        (KJS::ContinueNode::execute):
+        (KJS::BreakNode::execute):
+        (KJS::ReturnNode::execute):
+        (KJS::WithNode::execute):
+        (KJS::SwitchNode::execute):
+        (KJS::LabelNode::execute):
+        (KJS::TryNode::execute):
+        (KJS::FunctionBodyNode::processDeclarationsFunctionCode):
+        (KJS::FunctionBodyNode::processDeclarationsProgramCode):
+        (KJS::FunctionBodyNode::processDeclarations):
+        (KJS::FuncDeclNode::makeFunction):
+        (KJS::FuncExprNode::evaluate):
+
+2007-10-26  Mark Rowe  <mrowe@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2007-10-26  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * JavaScriptCore.pri:
+        * kjs/ExecState.cpp:
+
+2007-10-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - moved Context class into ExecState.{h,cpp} in preparation for merging 
+        ExecState and Context classes.
+
+        * kjs/ExecState.h: Moved CodeType enum and Context class here in
+        preparation for merging ExecState and Context.
+        * kjs/ExecState.cpp: Moved Context class here from Context.cpp.
+        (KJS::Context::Context):
+        (KJS::Context::~Context):
+        (KJS::Context::mark):
+        * kjs/context.h: Removed.
+        * kjs/Context.cpp: Removed.
+        * kjs/function.h: Removed CodeType enum.
+        * kjs/LabelStack.h: Added. Pulled LabelStack class out of internal.h.
+        * kjs/internal.h: Removed LabelStack.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new file, removed ones that are gone.
+        * kjs/collector.cpp: Fixed includes.
+        * kjs/function.cpp: ditto
+        * kjs/internal.cpp: ditto
+        * kjs/interpreter.cpp: ditto
+        * kjs/lookup.h: ditto
+        * kjs/nodes.cpp: ditto
+
+2007-10-26  Mark Rowe  <mrowe@apple.com>
+
+        Windows build fix.
+
+        * kjs/string_object.cpp:
+        (KJS::StringObjectFuncImp::callAsFunction):
+
+2007-10-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15703
+          fix numeric functions -- improve correctness and speed
+
+        Gives about 1% gain on SunSpider.
+
+        * kjs/value.h: Added toIntegerPreserveNan, removed toUInt16.
+        (KJS::JSValue::toInt32): Changed to call getTruncatedInt32 in a way that works
+        with both immediate and number values.
+        (KJS::JSValue::toUInt32): Ditto.
+        * kjs/value.cpp:
+        (KJS::JSValue::toInteger): Moved the logic from roundValue here, with a couple
+        differences. One is that it now correctly returns 0 for NaN, and another is that
+        there's no special case for 0 or infinity, since the general case already handles
+        those correctly.
+        (KJS::JSValue::toIntegerPreserveNaN): Added. Like toInteger, but without the
+        check for NaN.
+        (KJS::JSValue::toInt32SlowCase): Call toNumber instead of roundValue. The
+        truncation done by the typecast already does the necessary truncation that
+        roundValue was doing.
+        (KJS::JSValue::toUInt32SlowCase): Ditto.
+        (KJS::JSValue::toUInt16): Removed.
+
+        * kjs/internal.h: Removed roundValue.
+        * kjs/internal.cpp: Ditto.
+
+        * kjs/array_object.cpp: (KJS::ArrayProtoFunc::callAsFunction): Remove unneeded
+        code to handle NaN in Array.slice; toInteger now never returns NaN as specified.
+
+        * kjs/date_object.cpp:
+        (KJS::fillStructuresUsingTimeArgs): Replaced call to roundValue with a call to
+        toNumber as specified.
+        (KJS::DateProtoFunc::callAsFunction): In SetTime case, replaced call to roundValue
+        with a call to toNumber and timeClip as specified.
+        (KJS::DateObjectImp::construct): Removed unnecessary checks of numArgs in cases
+        where the default behavior of toInt32 (returning 0) was already correct. Replaced
+        call to roundValue with a call to toNumber as specified.
+        (KJS::DateObjectFuncImp::callAsFunction): Ditto.
+
+        * kjs/math_object.cpp: (MathFuncImp::callAsFunction): Removed unnecessary special
+        cases for the pow function that the library already handles correctly.
+
+        * kjs/number_object.cpp: (NumberProtoFunc::callAsFunction): Changed ToString to
+        call toIntegerPreserveNaN, so we can continue to handle the NaN case differently.
+        The real toInteger now returns 0 for NaN. Took out unneeded special case in
+        ToFixed for undefined; was only needed because our toInteger was wrong. Same
+        thing in ToExponential. Changed ToPrecision to call toIntegerPreserveNaN.
+
+        * kjs/string_object.cpp:
+        (KJS::StringProtoFunc::callAsFunction): Took out CharAt and CharCodeAt special
+        cases for undefined that were only needed because toInteger was wrong. Same in
+        IndexOf, and was able to remove some special cases. In LastIndexOf, used
+        toIntegerPreserveNaN, but was able to remove some special cases there too.
+        Changed Substr implementation to preserve correct behavior with the change
+        to toInteger and match the specification. Also made sure we weren't converting
+        an out of range double to an int.
+        (KJS::StringObjectFuncImp::callAsFunction): Changed constructor to just use
+        toUInt32, because truncating toUInt32 to 16 bits is the same thing and there's
+        no reason to have toUInt16 as a second, less-optimized function that's only
+        called at this one call site.
+
+        * wtf/MathExtras.h: Added trunc function for Windows.
+
+2007-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Tweaked the inner hashtable lookup loop to remove a branch in the "not 
+        found" case. .5% speedup on SunSpider.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/HashTable.h:
+        (WTF::::lookup):
+
+2007-10-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+
+        - fold together toPrimitive() and toNumber() conversions for 0.5% gain on SunSpider
+
+        * kjs/nodes.cpp:
+        (KJS::SubNode::evaluate): Subtract directly, since toPrimitive() is not
+        adding any value over toNumber() here.
+        (KJS::valueForReadModifyAssignment): Ditto.
+        (KJS::lessThan): Use new getPrimitiveNumber() method to avoid some virtual calls
+        and branches.
+        (KJS::lessThanEq): Ditto.
+        * JavaScriptCore.exp: Export new functions as needed.
+        * kjs/value.h:
+        (KJS::JSValue::toPrimitive): Fixed formatting.
+        (KJS::JSValue::getPrimitiveNumber): New method - this simultaneously converts
+        to number and tells you whether a toPrimitive() conversion with a Number hint
+        would have given a string.
+        * kjs/internal.cpp:
+        (KJS::StringImp::getPrimitiveNumber): Implemented. 
+        (KJS::NumberImp::getPrimitiveNumber): ditto
+        (KJS::GetterSetterImp::getPrimitiveNumber): ditto
+        (KJS::StringImp::toPrimitive): Fixed formatting.
+        (KJS::NumberImp::toPrimitive): ditto
+        (KJS::GetterSetterImp::toPrimitive): ditto
+        * kjs/internal.h:
+        * kjs/object.cpp:
+        (KJS::JSObject::getPrimitiveNumber): Implemented.
+        * kjs/object.h:
+
+2007-10-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Remove JSStringRefCFHack from windows as it is no longer needed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2007-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Rolled out my last patch. It turns out that I needed 2 words, not 1,
+        so it didn't help.
+
+2007-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=15694
+        Shrink the size of an activation object by 1 word
+        
+        This is in preparation for adding a symbol table to the activation 
+        object.
+        
+        The basic strategy here is to rely on the mutual exclusion between
+        the arguments object pointer and the function pointer (you only need
+        the latter in order to create the former), and store them in the same 
+        place. The LazyArgumentsObject class encapsulates this strategy.
+        
+        Also inlined the ArgumentsImp constructor, for good measure.
+        
+        SunSpider reports no regression. Regression tests pass.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/Context.cpp:
+        (KJS::Context::~Context):
+        * kjs/function.cpp:
+        (KJS::ActivationImp::LazyArgumentsObject::createArgumentsObject):
+        (KJS::ActivationImp::LazyArgumentsObject::mark):
+        (KJS::ActivationImp::argumentsGetter):
+        (KJS::ActivationImp::mark):
+        * kjs/function.h:
+        (KJS::ActivationImp::LazyArgumentsObject::LazyArgumentsObject):
+        (KJS::ActivationImp::LazyArgumentsObject::getOrCreate):
+        (KJS::ActivationImp::LazyArgumentsObject::resetArguments):
+        (KJS::ActivationImp::LazyArgumentsObject::setArgumentsObject):
+        (KJS::ActivationImp::LazyArgumentsObject::argumentsObject):
+        (KJS::ActivationImp::LazyArgumentsObject::setFunction):
+        (KJS::ActivationImp::LazyArgumentsObject::function):
+        (KJS::ActivationImp::LazyArgumentsObject::createdArgumentsObject):
+        (KJS::ActivationImp::LazyArgumentsObject::):
+        (KJS::ActivationImp::ActivationImp::ActivationImp):
+        (KJS::ActivationImp::resetArguments):
+
+2007-10-25  Adam Roben  <aroben@apple.com>
+
+        Change JavaScriptCore.vcproj to use DerivedSources.make
+
+        We were trying to emulate the logic of make in
+        build-generated-files.sh, but we got it wrong. We now use a
+        build-generated-files very much like the one that WebCore uses to
+        invoke make.
+
+        We also now only have a Debug configuration of dftables which we build
+        even when doing a Release build of JavaScriptCore. dftables also no
+        longer has the "_debug" name suffix.
+
+        Changes mostly made by Darin, reviewed by me.
+
+        * DerivedSources.make: Add a variable to set the extension used for
+        the dftables executable.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Updated to use Debug
+        dftables in Release configurations.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+           - Updated include path to point to the new location of the derived
+             sources.
+           - Modified pre-build event to pass the right arguments to
+             build-generated-files.sh and not call dftables directly.
+           - Added the derived source files to the project.
+           - Removed grammarWrapper.cpp, which isn't needed now that we're
+             compiling grammar.cpp directly.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        Slightly modified from the WebCore version.
+        * JavaScriptCore.vcproj/JavaScriptCore/grammarWrapper.cpp: Removed.
+        * JavaScriptCore.vcproj/dftables/dftables.vcproj:
+            - Changed the output location to match Mac.
+            - Removed the Release configuration.
+            - Removed the _debug suffix.
+
+2007-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel.
+        
+        Slightly elaborated the differences between declaration procesing in 
+        Function Code and Program Code.
+        
+        .3% speedup on SunSpider.
+
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNode::processDeclarationsFunctionCode): 
+        (KJS::FunctionBodyNode::processDeclarationsProgramCode): Store a 
+        minimum set of attributes instead of recomputing all the time. Also,
+        ignore m_parameters, since programs don't have arguments.
+
+2007-10-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+        
+        More preparation work before adding long-running mode to testkjs.
+
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction):
+        (prettyPrintScript):
+        (runWithScripts):
+        (parseArguments):
+        (kjsmain):
+        (fillBufferWithContentsOfFile):
+
+2007-10-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+        
+        Bring testkjs code out of the dark ages in preparation for more
+        radical improvements (like long-running testing support!)
+
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction):
+        (setupInterpreter):
+        (doIt):
+        (fillBufferWithContentsOfFile):
+
+2007-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Make a fast path for declaration processing inside Function Code.
+        
+        Lifted declaration processing code up from individual declaration nodes
+        and into processDeclarations.
+        
+        Broke out processDeclarations into two cases, depending on the type of 
+        code. This eliminates 2 branches, and facilitates more radical 
+        divergeance in the future.
+        
+        2.5% SunSpider speedup.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/nodes.cpp:
+        (KJS::FunctionBodyNode::initializeDeclarationStacks):
+        (KJS::FunctionBodyNode::processDeclarationsFunctionCode):
+        (KJS::FunctionBodyNode::processDeclarationsProgramCode):
+        (KJS::FunctionBodyNode::execute):
+        (KJS::FuncDeclNode::makeFunction):
+        * kjs/nodes.h:
+
+2007-10-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam.
+        
+        - add header includes needed on platforms that don't use AllInOneFile.cpp
+
+        * API/JSCallbackObject.cpp:
+        * kjs/Context.cpp:
+        * kjs/ExecState.cpp:
+        * kjs/array_instance.cpp:
+        * kjs/function_object.cpp:
+        * kjs/interpreter.cpp:
+        * kjs/nodes.cpp:
+
+2007-10-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Geoff.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: re-mark JSGlobalObject.h as private
+
+2007-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=15683
+        Re-order declaration initialization to avoid calling hasProperty inside
+        VarDeclNode::processDeclaration
+        
+        .7% speedup on SunSpider.
+
+        * kjs/function.h:
+        * kjs/function.cpp: Merged parameter processing into FunctionBodyNode's
+        other processing of declared symbols, so the order of execution could 
+        change.
+
+        * kjs/nodes.cpp:
+        (KJS::VarDeclNode::getDeclarations): Added special case for the 
+        "arguments" property name, explained in the comment.
+
+        (KJS::VarDeclNode::processDeclaration): Removed call to hasProperty
+        in the case of function code, since we know the declared symbol
+        management will resolve conflicts between symbols. Yay!
+
+        (KJS::VarDeclListNode::getDeclarations): Now that VarDeclNode's 
+        implementation of getDeclarations is non-trivial, we can't take a 
+        short-cut here any longer -- we need to put the VarDecl node on the 
+        stack so it gets processed normally.
+
+        (KJS::FunctionBodyNode::processDeclarations): Changed the order of 
+        processing to enforce mutual exclusion rules.
+
+        * kjs/nodes.h:
+        (KJS::DeclarationStacks::DeclarationStacks): Structure includes an 
+        ExecState now, for fast access to the "arguments" property name.
+
+2007-10-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+        
+        Add a JSGlobalObject class and remove the InterpreterMap
+        http://bugs.webkit.org/show_bug.cgi?id=15681
+        
+        This required making JSCallbackObject a template class to allow for
+        JSGlobalObjects with JSCallbackObject functionality.
+        
+        SunSpider claims this was a 0.5% speedup.
+
+        * API/JSCallbackObject.cpp:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h: Copied from API/JSCallbackObject.cpp.
+        (KJS::::JSCallbackObject):
+        (KJS::::init):
+        (KJS::::~JSCallbackObject):
+        (KJS::::initializeIfNeeded):
+        (KJS::::className):
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::implementsConstruct):
+        (KJS::::construct):
+        (KJS::::implementsHasInstance):
+        (KJS::::hasInstance):
+        (KJS::::implementsCall):
+        (KJS::::callAsFunction):
+        (KJS::::getPropertyNames):
+        (KJS::::toNumber):
+        (KJS::::toString):
+        (KJS::::setPrivate):
+        (KJS::::getPrivate):
+        (KJS::::inherits):
+        (KJS::::cachedValueGetter):
+        (KJS::::staticValueGetter):
+        (KJS::::staticFunctionGetter):
+        (KJS::::callbackGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant):
+        * bindings/jni/jni_jsobject.cpp:
+        * bindings/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        * kjs/Context.cpp:
+        (KJS::Context::Context):
+        * kjs/ExecState.cpp:
+        (KJS::ExecState::lexicalInterpreter):
+        * kjs/JSGlobalObject.h: Added.
+        (KJS::JSGlobalObject::JSGlobalObject):
+        (KJS::JSGlobalObject::isGlobalObject):
+        (KJS::JSGlobalObject::interpreter):
+        (KJS::JSGlobalObject::setInterpreter):
+        * kjs/array_instance.cpp:
+        * kjs/context.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::Interpreter):
+        (KJS::Interpreter::init):
+        (KJS::Interpreter::~Interpreter):
+        (KJS::Interpreter::globalObject):
+        (KJS::Interpreter::initGlobalObject):
+        (KJS::Interpreter::evaluate):
+        * kjs/interpreter.h:
+        * kjs/lookup.h:
+        (KJS::cacheGlobalObject):
+        * kjs/object.h:
+        (KJS::JSObject::isGlobalObject):
+        * kjs/testkjs.cpp:
+
+2007-10-24  Eric Seidel  <eric@webkit.org>
+
+        Build fix for Gtk, no review.
+
+        * kjs/collector.cpp: #include "context.h"
+
+2007-10-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej.
+        
+        Stop checking isOutOfMemory after every allocation, instead let the collector
+        notify all ExecStates if we ever hit this rare condition.
+        
+        SunSpider claims this was a 2.2% speedup.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect):
+        (KJS::Collector::reportOutOfMemoryToAllInterpreters):
+        * kjs/collector.h:
+        * kjs/nodes.cpp:
+        (KJS::TryNode::execute):
+
+2007-10-24  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/identifier.h:  Remove extra qualification.
+
+2007-10-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Disable ALWAYS_INLINE in debug builds, since it drives the debugger
+        crazy.
+
+        * wtf/AlwaysInline.h:
+
+2007-10-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Inlined the fast path for creating an Identifier from an Identifier. 
+        
+        This is a .4% speedup on SunSpider overall, but as big as a 2.5% 
+        speedup on certain individual tests. 65% of the Identifiers creating 
+        by SunSpider are already Identifiers.
+        
+        (The main reason I'm making this change is that it resolves a large
+        regression in a patch I haven't checked in yet.)
+
+        * JavaScriptCore.exp:
+        * kjs/identifier.cpp:
+        (KJS::Identifier::addSlowCase):
+        * kjs/identifier.h:
+        (KJS::Identifier::Identifier::add):
+
+2007-10-24  Lars Knoll  <lars@trolltech.com>
+
+        Reviewed by Simon.
+
+        some changes to the way JS values are converted to Qt values in the script bindings. Added support for converting JS arrays into QStringList's.
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::invokeMethod):
+        * bindings/qt/qt_runtime.cpp:
+        (KJS::Bindings::convertValueToQVariant):
+        (KJS::Bindings::QtField::setValueToInstance):
+
+2007-10-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin.
+
+        Remove old relation method, replace with specialised LessThan and lessThenEq functions for a 0.5-0.6% improvement in SunSpider
+
+        * kjs/nodes.cpp:
+        (KJS::lessThan):
+        (KJS::lessThanEq):
+        (KJS::LessNode::evaluate):
+        (KJS::GreaterNode::evaluate):
+        (KJS::LessEqNode::evaluate):
+        (KJS::GreaterEqNode::evaluate):
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+
+2007-10-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+
+        * kjs/nodes.h:
+        (KJS::ImmediateNumberNode::): Fix ASSERT correctness (and debug build!)
+
+2007-10-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        * kjs/object.cpp: (KJS::JSObject::defaultValue): Get rid of a little
+        Identifier ref/deref for what SunSpider claims is a 0.4% speedup.
+
+2007-10-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - separate out the code to create a hash table the first time from the code
+          to rehash
+
+        SunSpider claims this was a 0.7% speedup.
+
+        * kjs/property_map.cpp:
+        (KJS::PropertyMap::expand): Changed to call either createTable or rehash.
+        (KJS::PropertyMap::createTable): Added. For the case where we had no table.
+        (KJS::PropertyMap::rehash): Removed code needed only in the case where we
+        had no table.
+        * kjs/property_map.h: Added createTable.
+
+2007-10-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by darin.
+        
+        Add ImmediateNumberNode to hold a JSValue* instead of a double for numbers
+        which can be represented by JSImmediate.
+        
+        SunSpider claims this was a 0.6% speedup.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::NumberNode::evaluate):
+        (KJS::ImmediateNumberNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::Node::):
+        (KJS::ImmediateNumberNode::):
+        * kjs/nodes2string.cpp:
+        (ImmediateNumberNode::streamTo):
+
+2007-10-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15657
+          change static hash tables to use powers of two for speed
+
+        Seems to give 0.7% SunSpider speedup.
+
+        * kjs/create_hash_table: Updated to generate new format.
+        * kjs/lookup.cpp:
+        (KJS::keysMatch): Took out unneeded typecast.
+        (KJS::findEntry): Updated to expect table type 3 -- changed the printf to a plain old assert.
+        Replaced the modulus with a bit mask.
+        (KJS::Lookup::findEntry): Get the hash directly, since we know identifiers already have computed
+        their hash -- saves a branch.
+        (KJS::Lookup::find): Ditto.
+        * kjs/lookup.h: Changed attr from 2-byte value to one-byte value. Replaced hashSize with hashSizeMask.
+
+2007-10-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+        
+        - remove KJS_CHECKEXCEPTIONs in places where exceptions can't happen for 0.6% SunSpider speedup
+
+        * kjs/nodes.cpp:
+        (KJS::DoWhileNode::execute):
+        (KJS::WhileNode::execute):
+        (KJS::ForNode::execute):
+        (KJS::ForInNode::execute):
+        (KJS::SourceElementsNode::execute):
+
+2007-10-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        * kjs/JSImmediate.h: (KJS::JSImmediate::getUInt32):
+        Changed an && to an & for a 1% gain in SunSpider.
+
+2007-10-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Reduce branching in implementations of some operator implementations, yielding 1.3% boost to SunSpider.
+
+        * kjs/nodes.cpp:
+        (KJS::MultNode::evaluate):
+        (KJS::DivNode::evaluate):
+        (KJS::ModNode::evaluate):
+        (KJS::add):
+        (KJS::sub):
+        (KJS::AddNode::evaluate):
+        (KJS::SubNode::evaluate):
+        (KJS::valueForReadModifyAssignment):
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+
+2007-10-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Separating all of the simple (eg. non-read-modify-write) binary operators
+        into separate classes in preparation for further JS optimisations.
+        
+        Happily this produces a 0.8% to 1.0% performance increase in SunSpider with
+        no further work.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::MultNode::evaluate):
+        (KJS::DivNode::evaluate):
+        (KJS::ModNode::evaluate):
+        (KJS::AddNode::evaluate):
+        (KJS::SubNode::evaluate):
+        (KJS::LeftShiftNode::evaluate):
+        (KJS::RightShiftNode::evaluate):
+        (KJS::UnsignedRightShiftNode::evaluate):
+        (KJS::LessNode::evaluate):
+        (KJS::GreaterNode::evaluate):
+        (KJS::LessEqNode::evaluate):
+        (KJS::GreaterEqNode::evaluate):
+        (KJS::InstanceOfNode::evaluate):
+        (KJS::InNode::evaluate):
+        (KJS::EqualNode::evaluate):
+        (KJS::NotEqualNode::evaluate):
+        (KJS::StrictEqualNode::evaluate):
+        (KJS::NotStrictEqualNode::evaluate):
+        (KJS::BitAndNode::evaluate):
+        (KJS::BitXOrNode::evaluate):
+        (KJS::BitOrNode::evaluate):
+        (KJS::LogicalAndNode::evaluate):
+        (KJS::LogicalOrNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::MultNode::):
+        (KJS::DivNode::):
+        (KJS::ModNode::):
+        (KJS::AddNode::):
+        (KJS::SubNode::):
+        (KJS::LeftShiftNode::):
+        (KJS::RightShiftNode::):
+        (KJS::UnsignedRightShiftNode::):
+        (KJS::LessNode::):
+        (KJS::GreaterNode::):
+        (KJS::LessEqNode::):
+        (KJS::GreaterEqNode::):
+        (KJS::InstanceOfNode::):
+        (KJS::InNode::):
+        (KJS::EqualNode::):
+        (KJS::NotEqualNode::):
+        (KJS::StrictEqualNode::):
+        (KJS::NotStrictEqualNode::):
+        (KJS::BitAndNode::):
+        (KJS::BitOrNode::):
+        (KJS::BitXOrNode::):
+        (KJS::LogicalAndNode::):
+        (KJS::LogicalOrNode::):
+        * kjs/nodes2string.cpp:
+        (MultNode::streamTo):
+        (DivNode::streamTo):
+        (ModNode::streamTo):
+        (AddNode::streamTo):
+        (SubNode::streamTo):
+        (LeftShiftNode::streamTo):
+        (RightShiftNode::streamTo):
+        (UnsignedRightShiftNode::streamTo):
+        (LessNode::streamTo):
+        (GreaterNode::streamTo):
+        (LessEqNode::streamTo):
+        (GreaterEqNode::streamTo):
+        (InstanceOfNode::streamTo):
+        (InNode::streamTo):
+        (EqualNode::streamTo):
+        (NotEqualNode::streamTo):
+        (StrictEqualNode::streamTo):
+        (NotStrictEqualNode::streamTo):
+        (BitAndNode::streamTo):
+        (BitXOrNode::streamTo):
+        (BitOrNode::streamTo):
+        (LogicalAndNode::streamTo):
+
+2007-10-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15639
+          fix Math.abs(0), Math.ceil(-0), and Math.floor(-0)
+
+        Test: fast/js/math.html
+
+        * kjs/math_object.cpp: (MathFuncImp::callAsFunction):
+        Fix abs to look at the sign bit. Add a special case for values in the range
+        between -0 and -1 and a special case for ceil and for -0 for floor.
+
+2007-10-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric.
+
+        - streamline exception handling code for a >1% speed-up of SunSpider
+
+        * kjs/nodes.cpp: Changed macros to use functions for everything that's not
+        part of normal execution. We'll take function call overhead when propagating
+        an exception or out of memory.
+        (KJS::createOutOfMemoryCompletion): Added.
+        (KJS::substitute): Use append instead of the relatively inefficient + operator.
+        (KJS::Node::rethrowException): Added.
+        * kjs/nodes.h: Added rethrowException.
+
+2007-10-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15636
+          some JavaScriptCore regression tests are failing due to numeric conversion
+
+        This should restore correctness and make speed better too, restoring some
+        of the optimization we lost in my last check-in.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::getTruncatedInt32): Added. Uses the range checking idiom
+        I used in my patch yesterday.
+        (KJS::JSImmediate::getTruncatedUInt32): Ditto.
+
+        * kjs/internal.h: Removed getInt32 and added getTruncatedInt/UInt32.
+        * kjs/internal.cpp:
+        (KJS::NumberImp::getUInt32): Changed to always use double, since I can't find
+        a way to write this more efficiently for float.
+        (KJS::NumberImp::getTruncatedInt32): Added.
+        (KJS::NumberImp::getTruncatedUInt32): Added.
+
+        * kjs/value.h: Removed getInt32 and added getTruncatedInt/UInt32.
+        (KJS::JSValue::getUInt32):
+        (KJS::JSValue::getTruncatedInt32): Added.
+        (KJS::JSValue::getTruncatedUInt32): Added.
+        (KJS::JSValue::toInt32): Changed getInt32 call to getTruncatedInt32.
+        (KJS::JSValue::toUInt32): Changed getUInt32 call to getTruncatedUInt32.
+        * kjs/value.cpp:
+        (KJS::JSCell::getTruncatedInt32): Added.
+        (KJS::JSCell::getTruncatedUInt32): Added.
+        (KJS::JSValue::toInteger): Changed getUInt32 call to getTruncatedInt32.
+        (KJS::JSValue::toInt32SlowCase): Removed extra getInt32 call I accidentally
+        had left in here.
+        (KJS::JSValue::toUInt32SlowCase): Ditto.
+        (KJS::JSValue::toUInt16): Changed getUInt32 call to getTruncatedUInt32.
+
+        * JavaScriptCore.exp: Updated.
+
+2007-10-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15632
+          js1_5/Array/array-001.js test failing
+
+        One of the JavaScriptCore tests was failing; it failed because of
+        my change to NumberImp::getUInt32. The incorrect code I copied was
+        from JSImmediate::getUInt32, and was a pre-existing bug.
+
+        This patch fixes correctness, but will surely slow down SunSpider.
+        We may be able to code this tighter and get the speed back.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::getInt32): Renamed from toInt32 to more accurately
+        reflect the fact that this function only returns true if the value is
+        accurate (no fractional part, etc.). Changed code so that it returns
+        false when the value has a fraction.
+        (KJS::JSImmediate::getUInt32): Ditto.
+
+        * kjs/internal.cpp:
+        (KJS::NumberImp::getInt32): Changed code so that it returns false when
+        the value has a fraction. Restores the old behavior.
+        (KJS::NumberImp::getUInt32): Ditto.
+
+        * kjs/value.h:
+        (KJS::JSValue::getInt32): Updated for name change.
+        (KJS::JSValue::getUInt32): Ditto.
+        (KJS::JSValue::toInt32): Ditto.
+        (KJS::JSValue::toUInt32): Ditto.
+
+2007-10-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady.
+
+        - fix crash seen when running JavaScriptCore tests
+
+        * kjs/array_instance.cpp: (KJS::ArrayInstance::mark):
+        Copy and paste error: I accidentally had code here that was
+        making a copy of the HashMap -- that's illegal inside a mark
+        function and was unnecessary. The other callsite was modifying
+        the map as it iterated it, but this function is not.
+
+2007-10-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - Avoid moving floats into integer registers in jsNumber() for 3% speedup on SunSpider
+        http://bugs.webkit.org/show_bug.cgi?id=15627
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::fromDouble): Avoid moving floats to integer
+        registers since this is very slow.
+
+2007-10-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15617
+          improve speed of integer conversions
+
+        Makes SunSpider 6% faster.
+
+        * kjs/JSImmediate.h: Added toInt32 and toUInt32, with separate versions for
+        32-bit and 64-bit.
+        * kjs/value.h:
+        (KJS::JSValue::getUInt32): Call JSImmediate::toUInt32.
+
+        * kjs/internal.h: Added getInt32.
+        * kjs/internal.cpp:
+        (KJS::NumberImp::getInt32): Added.
+        (KJS::NumberImp::getUInt32): Replaced with more-optimal implementation
+        stolen from JSValue.
+
+        * kjs/value.h:
+        (KJS::jsNumber): Marked ALWAYS_INLINE, because this wasn't getting
+        inlined.
+        (KJS::JSValue::getInt32): Added.
+        (KJS::JSValue::getUInt32): Changed to call the new JSImmediate::toUInt32
+        to avoid converting from float to double.
+        (KJS::JSValue::toInt32): Made inline, separated out the slow case.
+        (KJS::JSValue::toUInt32): Ditto.
+        * kjs/value.cpp:
+        (KJS::JSCell::getInt32): Added.
+        (KJS::JSValue::toInt32SlowCase): Renamed from toInt32. Changed to use the
+        new getInt32. Added a faster case for in-range numbers.
+        (KJS::JSValue::toUInt32SlowCase): Ditto.
+        (KJS::JSValue::toUInt16): Added a faster case for in-range numbers.
+
+        * JavaScriptCore.exp: Updated for changes.
+
+2007-10-22  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Turn off
+        warning about implicit conversion to bool.
+
+2007-10-22  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * kjs/array_instance.cpp:
+
+2007-10-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15606
+          make cut-off for sparse vs. dense arrays smarter for speed with large arrays
+
+        Makes the morph test in SunSpider 26% faster, and the overall
+        benchmark 3% faster.
+
+        This also fixes some small problems we had with the distinction
+        between nonexistent and undefined values in arrays.
+
+        * kjs/array_instance.h: Tweaked formatting and naming.
+        * kjs/array_instance.cpp: Copied from kjs/array_object.cpp.
+        (KJS::storageSize): Added. Computes the size of the storage given a vector length.
+        (KJS::increasedVectorLength): Added. Implements the rule for resizing the vector.
+        (KJS::isDenseEnoughForVector): Added.
+        (KJS::ArrayInstance::ArrayInstance): Initialize the new fields.
+        (KJS::ArrayInstance::~ArrayInstance): Since m_storage is now never 0, delete it.
+        (KJS::ArrayInstance::getItem): Updated for name changes.
+        (KJS::ArrayInstance::lengthGetter): Ditto.
+        (KJS::ArrayInstance::inlineGetOwnPropertySlot): Added. Allows both versions of
+        getOwnPropertySlot to share more code.
+        (KJS::ArrayInstance::getOwnPropertySlot): Just refactored, no code change.
+        (KJS::ArrayInstance::put): Added logic for extending the vector as long as the
+        array is dense enough. Also keep m_numValuesInVector up to date.
+        (KJS::ArrayInstance::deleteProperty): Added code to keep m_numValuesInVector
+        up to date.
+        (KJS::ArrayInstance::getPropertyNames): Fixed bug where this would omit names
+        for array indices with undefined values.
+        (KJS::ArrayInstance::increaseVectorLength): Renamed from resizeStorage. Also
+        simplified to only handle getting larger.
+        (KJS::ArrayInstance::setLength): Added code to update m_numValuesInVector, to
+        zero out the unused part of the vector and to delete the map if it's no longer
+        needed.
+        (KJS::ArrayInstance::mark): Tweaked formatting.
+        (KJS::compareByStringForQSort): Ditto.
+        (KJS::ArrayInstance::sort): Ditto.
+        (KJS::CompareWithCompareFunctionArguments::CompareWithCompareFunctionArguments):
+        Ditto.
+        (KJS::compareWithCompareFunctionForQSort): Ditto.
+        (KJS::ArrayInstance::compactForSorting): Fixed bug where this would turn
+        undefined values into nonexistent values in some cases.
+
+        * kjs/array_object.h: Removed MAX_ARRAY_INDEX.
+        * kjs/array_object.cpp: Removed ArrayInstance. Moved to a separate file.
+
+        * JavaScriptCore.pri: Added array_instance.cpp.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * kjs/AllInOneFile.cpp: Ditto.
+
+2007-10-22  Andrew Wellington  <proton@wiretapped.net>
+
+        Reviewed by Mark Rowe.
+        
+        Fix for local database support after r26879
+        Ensure that ENABLE_DATABASE and ENABLE_ICONDATABASE are correctly set
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2007-10-22  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Alp.
+
+        Build fix for the non-qmake builds.
+
+        * wtf/Platform.h: Default to enabling the database features unless
+        otherwise specified. (similar to ENABLE_ICONDATABASE)
+
+2007-10-22  Holger Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann <hausmann@kde.org>.
+
+        * Do not build testkjs as an application bundle. This is
+        needed for run-javascriptcore-tests on OSX.
+        * Also, based on r26633, allow to test the WebKit/Qt port on OSX.
+        * Set DYLD_LIBRARY_PATH if it was set in the environment. It must be set
+        as we do not have -rpath on OSX.
+
+        * kjs/testkjs.pro:
+
+2007-10-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alp.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15575
+        Bug 15575: [GTK] Implement threading using GThread
+
+        * wtf/Platform.h: Do not enable pthreads for Gtk.
+
+2007-10-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Mitz.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=15603
+        Bug 15603: Regression(r26847): Crash when sorting an empty array from JavaScript
+
+        * kjs/array_object.cpp:
+        (KJS::freeStorage): Reinstate null-check that was removed in r26847.
+
+2007-10-21  Darin Adler  <darin@apple.com>
+
+        - fix Windows build
+
+        * kjs/array_instance.h: Removed unused ExecState parameter.
+        * kjs/array_object.cpp:
+        (KJS::ArrayInstance::put): Ditto.
+        (KJS::ArrayInstance::setLength): Ditto.
+
+2007-10-21  Darin Adler  <darin@apple.com>
+
+        * kjs/array_object.cpp: (KJS::ArrayInstance::put):
+        Add missing assignment that was causing regression test crash.
+
+2007-10-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15585
+          speed up sparse arrays by using a custom map
+    
+        Speeds up SunSpider by 10%.
+
+        * kjs/array_object.cpp:
+        (allocateStorage): Leave room for an additional pointer.
+        (reallocateStorage): Ditto.
+        (freeStorage): Ditto.
+        (ArrayInstance::~ArrayInstance): Delete the overflow map if present.
+        (ArrayInstance::getItem): Read values from the overflow map if present.
+        Removed the check of length, since it slows down the common case.
+        (ArrayInstance::getOwnPropertySlot): Ditto. Also removed the fallback
+        to the property map.
+        (ArrayInstance::put): Write values into the overflow map as needed.
+        Also create overflow map when needed.
+        (ArrayInstance::deleteProperty): Remove values from the overflow map
+        as appropriate.
+        (ArrayInstance::getPropertyNames): Add a name for each identifier in
+        the property map. This is extremely inefficient.
+        (ArrayInstance::setLength): Remove any values in the overflow map
+        that are past the new length, as we formerly did with the property map.
+        (ArrayInstance::mark): Mark any values in the overflow map.
+        (compareByStringForQSort): Removed unneeded undefined case, since
+        compactForSorting guarantees we will have no undefined values.
+        (compareWithCompareFunctionForQSort): Ditto.
+        (ArrayInstance::compactForSorting): Copy all the values out of the
+        overflow map and destroy it.
+
+        * kjs/property_map.h: Removed now-unused getSparseArrayPropertyNames.
+        * kjs/property_map.cpp: Ditto.
+
+2007-10-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15579
+          stop churning identifier reference counts copying Completion objects
+
+        * kjs/completion.h: Replace the Identifier with an Identifier*.
+        * kjs/nodes.cpp:
+        (ForInNode::execute): Update for change to Completion constructor.
+        (ContinueNode::execute): Ditto.
+        (BreakNode::execute): Ditto.
+
+2007-10-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alp.
+
+        Gtk changes needed to enable HTML 5 client-side database storage.
+
+        * wtf/Platform.h: Have Gtk use pthreads for now.
+
+2007-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=15570
+        Store gathered declaration nodes in the function body node.
+        
+        This means that you only have to gather the declaration nodes the first 
+        time the function executes. Performance gain of 2.10% on SunSpider, 
+        0.90% on command-line JS iBench.
+
+        * kjs/nodes.cpp: Split declaration stack initialization code off into 
+        initializeDeclarationStacks().
+        (FunctionBodyNode::FunctionBodyNode):
+        (FunctionBodyNode::initializeDeclarationStacks):
+        (FunctionBodyNode::processDeclarations):
+
+        * kjs/nodes.h: Changed DeclarationStacks structure to hold references, 
+        since the actual Vectors are now stored either on the stack or in the 
+        function body node.
+
+2007-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        http://bugs.webkit.org/show_bug.cgi?id=15559
+        Moved processDeclarations call into FunctionBodyNode::execute
+
+        To improve encapsulation, moved processDeclarations call into
+        FunctionBodyNode::execute. Also marked processDeclarations 
+        ALWAYS_INLINE, since it has only 1 caller now. This is a .71% speedup 
+        on command-line JS iBench.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::GlobalFuncImp::callAsFunction):
+        * kjs/function.h:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::evaluate):
+        * kjs/nodes.cpp:
+        (FunctionBodyNode::execute):
+        * kjs/nodes.h:
+
+2007-10-19  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam
+
+        Queue -> Deque! and small style tweaks
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+        * wtf/Deque.h: Added.
+        (WTF::DequeNode::DequeNode):
+        (WTF::Deque::Deque):
+        (WTF::Deque::~Deque):
+        (WTF::Deque::size):
+        (WTF::Deque::isEmpty):
+        (WTF::Deque::append):
+        (WTF::Deque::prepend):
+        (WTF::Deque::first):
+        (WTF::Deque::last):
+        (WTF::Deque::removeFirst):
+        (WTF::Deque::clear):
+        * wtf/Queue.h: Removed.
+
+
+2007-10-19  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Oliver
+
+        Added a simple LinkedList based Queue to wtf
+        We can make a better, more sophisticated an efficient one later, but have
+        needed one for some time, now!
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Queue.h: Added.
+        (WTF::QueueNode::QueueNode):
+        (WTF::Queue::Queue):
+        (WTF::Queue::~Queue):
+        (WTF::Queue::size):
+        (WTF::Queue::isEmpty):
+        (WTF::Queue::append):
+        (WTF::Queue::prepend):
+        (WTF::Queue::first):
+        (WTF::Queue::last):
+        (WTF::Queue::removeFirst):
+        (WTF::Queue::clear):
+
+2007-10-19  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Anders.
+
+        Try to fix Qt/Win build slave, by including windows.h also on Qt/Win.
+
+        * kjs/testkjs.cpp: Change PLATFORM(WIN) to PLATFORM(WIN_OS)
+
+2007-10-19  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Lars.
+
+        Fix compilation on Windows when wchar_t is a typedef instead of a native type (triggered by -Zc:wchar_t-).
+        Don't provide the wchar_t overloads then as they conflict with the unsigned short ones.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIAlpha):
+        (WTF::isASCIIAlphanumeric):
+        (WTF::isASCIIDigit):
+        (WTF::isASCIIHexDigit):
+        (WTF::isASCIILower):
+        (WTF::isASCIISpace):
+        (WTF::toASCIILower):
+        (WTF::toASCIIUpper):
+
+2007-10-19  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Lars.
+
+        Another build fix for the windows/qt build: Apply the same fix as in revision 26686 also to kjs/config.h to disable the disallowctype feature.
+
+        * kjs/config.h:
+
+2007-10-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam.
+        
+        - use __declspec(thread) for fast thread-local storage on Windows
+        
+        - 2.2% speedup on sunspider (on Windows)
+        - 7% speedup on the string section
+        - 6% speedup on JS iBench
+        
+        - fixed <rdar://problem/5473084> PLT on Windows got 2.5% slower between r25406 and r25422
+        - fixed at least some of <rdar://5527965? i-Bench JS was 14% slower in 310A11 than 310A10
+        
+        
+        * wtf/FastMalloc.cpp:
+        (WTF::getThreadHeap):
+        (WTF::setThreadHeap):
+        (WTF::TCMalloc_ThreadCache::GetCache):
+        (WTF::TCMalloc_ThreadCache::GetCacheIfPresent):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+
+2007-10-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15543
+          <rdar://problem/5545639> REGRESSION (r26697):
+          GoogleDocs: Can't create new documents or open existing ones
+
+        Test: fast/js/regexp-non-character.html
+
+        * pcre/pcre_compile.c: (check_escape): Take out the checks for valid characters
+        in the \u sequences -- not needed and actively harmful.
+
+2007-10-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver.
+
+        * wtf/Platform.h:
+        #define USE_PTHREADS on Mac.
+
+2007-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Merged DeclaredFunctionImp into FunctionImp (the base class) because 
+        the distinction between the two was unused.
+        
+        Removed codeType() from FunctionImp because FunctionImp and its 
+        subclasses all returned FunctionCode, so it was unused, practically 
+        speaking.
+        
+        Removed a different codeType() from GlobalFuncImp because it was unused.
+        (Perhaps it was vestigial from a time when GlobalFuncImp used to 
+        inherit from FunctionImp.)
+
+        * bindings/runtime_method.cpp:
+        * bindings/runtime_method.h:
+        * kjs/function.cpp:
+        (KJS::FunctionImp::FunctionImp):
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::FunctionImp::construct):
+        (KJS::FunctionImp::execute):
+        (KJS::FunctionImp::processVarDecls):
+        * kjs/function.h:
+        (KJS::FunctionImp::implementsConstruct):
+        (KJS::FunctionImp::scope):
+        * kjs/function_object.cpp:
+        (FunctionProtoFunc::callAsFunction):
+        (FunctionObjectImp::construct):
+        * kjs/nodes.cpp:
+        (FuncDeclNode::processFuncDecl):
+        (FuncExprNode::evaluate):
+
+2007-10-17  Adam Roben  <aroben@apple.com>
+
+        Windows build fix part 2.
+
+        Fix was by Darin, reviewed by Anders and Adam.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add
+        FastMallocPCRE.cpp to the project, and let Visual Studio have its way
+        with the post-build step.
+        * pcre/pcre.h: Don't DLL export the entry points just because this
+        is Win32 -- this is an internal copy of PCRE and should be private.
+        * pcre/pcre_compile.c: Fix an uninitialized variable warning --
+        there's no real problem but it's better to quiet the compiler by
+        tweaking the code slightly than turn off the warning entirely.
+
+2007-10-17  Adam Roben  <aroben@apple.com>
+
+        Windows build fix.
+
+        Reviewed by Anders.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Disable
+        some mismatched signed/unsigned comparison warnings.
+        * pcre/pcre_exec.c:
+        (match): #if-out some labels that don't seem to exist.
+
+2007-10-17  Mark Rowe  <mrowe@apple.com>
+
+        Gtk build fix.
+
+        * JavaScriptCore.pri: Add FastMallocPCRE.cpp.
+        * pcre/pcre_get. #if out two functions that depend on pcre_get_stringnumber, which
+        is currently unavailable for UTF-16.
+
+2007-10-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - merged PCRE changes between 6.4 and 6.5
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Removed pcre_config.c, pcre_globals.c, pcre_info.c, pcre_maketables.c,
+        pcre_printint.src, pcre_refcount.c, pcre_study.c, pcre_try_flipped.c,
+        pcre_ucp_findchar.c, pcre_version.c, and ucptable.c. Added pcre_ucp_searchfuncs.c.
+
+        * pcre/AUTHORS:
+        * pcre/LICENCE:
+        * pcre/MERGING:
+        * pcre/dftables.c:
+        * pcre/pcre-config.h:
+        * pcre/pcre.h:
+        * pcre/pcre.pri:
+        * pcre/pcre_compile.c:
+        * pcre/pcre_exec.c:
+        * pcre/pcre_fullinfo.c:
+        * pcre/pcre_get.c:
+        * pcre/pcre_internal.h:
+        * pcre/pcre_maketables.c:
+        * pcre/pcre_ord2utf8.c:
+        * pcre/pcre_tables.c:
+        * pcre/pcre_ucp_searchfuncs.c: Copied from pcre/pcre_ucp_findchar.c.
+        * pcre/pcre_xclass.c:
+        * pcre/ucp.h:
+        * pcre/ucpinternal.h:
+        * pcre/ucptable.c:
+        Updated with new versions from the PCRE 6.5 release, merged with changes.
+
+        * pcre/pcre_config.c: Removed.
+        * pcre/pcre_globals.c: Removed.
+        * pcre/pcre_info.c: Removed.
+        * pcre/pcre_printint.src: Removed.
+        * pcre/pcre_refcount.c: Removed.
+        * pcre/pcre_study.c: Removed.
+        * pcre/pcre_try_flipped.c: Removed.
+        * pcre/pcre_ucp_findchar.c: Removed.
+        * pcre/pcre_version.c: Removed.
+
+2007-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed KJS_VERBOSE because it was getting in the way of readability, 
+        and the messages didn't seem very helpful.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::callAsFunction):
+        (KJS::FunctionImp::passInParameters):
+        * kjs/lookup.h:
+        (KJS::lookupPut):
+        * kjs/object.cpp:
+        (KJS::JSObject::put):
+        * kjs/value.h:
+
+2007-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Removed the Parameter class because it was a redundant wrapper around 
+        Identifier.
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::passInParameters):
+        (KJS::FunctionImp::getParameterName):
+        * kjs/nodes.cpp:
+        (FunctionBodyNode::addParam):
+        * kjs/nodes.h:
+        (KJS::FunctionBodyNode::):
+
+2007-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Global replace of assert with ASSERT.
+
+2007-10-16  Adam Roben  <aroben@apple.com>
+
+        Make testkjs not delay-load WebKit
+
+        Soon, delay-loading WebKit will be impossible (because we will be
+        using __declspec(thread) for thread-local storage). This change
+        prepares testkjs for the future.
+
+        Reviewed by Sam.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Removed WebKitInitializer,
+        added FindSafari.
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj: Don't link against
+        WebKitInitializer, don't delay-load WebKit.
+        * kjs/testkjs.cpp: Don't use WebKitInitializer.
+
+2007-10-16  Adam Roben  <aroben@apple.com>
+
+        Updated testkjs for the rename of WebKit_debug.dll to WebKit.dll for the Debug configuration
+
+        Reviewed by Kevin McCullough.
+
+        * JavaScriptCore.vcproj/debug.vsprops: Added WebKitDLLConfigSuffix.
+        * JavaScriptCore.vcproj/debug_internal.vsprops: Ditto.
+        * JavaScriptCore.vcproj/release.vsprops: Ditto.
+        * JavaScriptCore.vcproj/testkjs/testkjs.vcproj: Use
+        WebKitDLLConfigSuffix when referring to WebKit.dll, and fixed a typo
+        in the name of icuuc36[_debug].dll.
+
+2007-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Re-structured variable and function declaration code.
+        
+        Command-line JS iBench shows no regression.
+        
+        Here are the changes:
+
+        1. Function declarations are now processed at the same time as var 
+        declarations -- namely, immediately upon entry to an execution context. 
+        This does not match Firefox, which waits to process a function
+        declaration until the declaration's containing block executes, but it 
+        does match IE and the ECMA spec. (10.1.3 states that var and function 
+        declarations should be processed at the same time -- namely, "On 
+        entering an execution context." 12.2 states that "A Block does not 
+        define a new execution scope.")
+
+        2. Declaration processing proceeds iteratively now, rather than 
+        recursively, storing the nodes is finds in stacks. This will later 
+        facilitate an optimization to hold on to the gathered declaration nodes, 
+        rather than re-fetching them in every function call. 
+        [ http://bugs.webkit.org/show_bug.cgi?id=14868 ]
+
+        Modified these tests because they expected the incorrect Mozilla 
+        behavior described above:
+
+        * tests/mozilla/ecma_3/Function/scope-001.js:
+        * tests/mozilla/js1_5/Scope/regress-184107.js:
+
+2007-10-16  Darin Adler  <darin@apple.com>
+
+        - try to fix the GTK build
+
+        * kjs/ustring.cpp: Include ASCIICType.h, not ASCIICtype.h.
+
+2007-10-16  Darin Adler  <darin@apple.com>
+
+        - try to fix the Windows build
+
+        * kjs/date_object.cpp: (KJS::parseDate): A couple instances of isspace were
+        in here. Not sure why it wasn't failing elsewhere. Changed to isASCIISpace.
+
+2007-10-16  Darin Adler  <darin@apple.com>
+
+        - try to fix the GTK build
+
+        * kjs/ustring.cpp: Include ASCIICType.h.
+
+2007-10-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej and Geoff (and looked over by Eric).
+
+        - http://bugs.webkit.org/show_bug.cgi?id=15519
+          eliminate use of <ctype.h> for processing ASCII
+
+        * wtf/ASCIICType.h: Added.
+        * wtf/DisallowCType.h: Added.
+
+        * kjs/config.h: Include DisallowCType.h.
+
+        * kjs/date_object.cpp:
+        (KJS::skipSpacesAndComments):
+        (KJS::findMonth):
+        (KJS::parseDate):
+        * kjs/function.cpp:
+        (KJS::decode):
+        * kjs/ustring.cpp:
+        (KJS::UString::toDouble):
+        Use ASCIICType.h functions instead of ctype.h ones.
+
+2007-10-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - fixes for "New JavaScript benchmark"
+        http://bugs.webkit.org/show_bug.cgi?id=15515
+        
+        * kjs/testkjs.cpp:
+        (TestFunctionImp::callAsFunction): Implement "load" for compatibility
+        with SpiderMonkey.
+        (TestFunctionImp::): ditto
+        (doIt): ditto
+        (kjsmain): Drop useless --> from output.
+
+2007-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed unnecessary #include.
+
+        * API/JSObjectRef.cpp:
+
+2007-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Double-reverse build fix. My tree was out of date.
+
+        * kjs/nodes.cpp:
+        (NumberNode::evaluate):
+
+2007-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * kjs/nodes.cpp:
+        (NumberNode::evaluate):
+
+2007-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Removed surprising self-named "hack" that made nested functions 
+        available as named properties of their containing functions, and placed
+        containing function objects in the scope chains of nested functions.
+        
+        There were a few reasons to remove this "hack:"
+
+        1. It contradicted FF, IE, and the ECMA spec.
+
+        2. It incurred a performance penalty, since merely parsing a function 
+        required parsing its body for nested functions (and so on).
+
+        3. SVN history contains no explanation for why it was added. It was just
+        legacy code in a large merge a long, long time ago.
+
+        [ Patch broken off from http://bugs.webkit.org/show_bug.cgi?id=14868 ]
+
+        * kjs/nodes.cpp:
+        (FuncDeclNode::processFuncDecl):
+
+2007-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Removed the concept of AnonymousCode. It was unused, and it doesn't
+        exist in the ECMA spec.
+        
+        [ Patch broken off from http://bugs.webkit.org/show_bug.cgi?id=14868 ]
+
+        * kjs/Context.cpp:
+        (KJS::Context::Context):
+        * kjs/function.h:
+        * kjs/nodes.cpp:
+        (ReturnNode::execute):
+
+2007-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Made function parameters DontDelete. This matches FF and the vague
+        description in ECMA 10.1.3. It's also required in order to make
+        symbol table based lookup of function parameters valid. (If the 
+        parameters aren't DontDelete, you can't guarantee that you'll find
+        them later in the symbol table.)
+
+        [ Patch broken off from http://bugs.webkit.org/show_bug.cgi?id=14868 ]
+
+        * kjs/function.cpp:
+        (KJS::FunctionImp::passInParameters):
+
+2007-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Some Vector optimizations. These are especially important when using
+        Vector as a stack for implementing recursive algorithms iteratively.
+        
+        [ Broken off from http://bugs.webkit.org/show_bug.cgi?id=14868 ]
+
+        1. Added shrink(), which is a version of resize() that you can call
+        to save a branch / improve code generation and inlining when you know 
+        that the vector is not getting bigger.
+        
+        2. Changed subclassing relationship in VectorBuffer to remove a call to
+        fastFree() in the destructor for the inlineCapacity != 0 template
+        specialization. This brings inline Vectors one step closer to true
+        stack-allocated arrays.
+        
+        Also changed abort() to CRASH(), since the latter works better.
+
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::allocateBuffer):
+        (WTF::VectorBufferBase::deallocateBuffer):
+        (WTF::VectorBufferBase::VectorBufferBase):
+        (WTF::VectorBufferBase::~VectorBufferBase):
+        (WTF::):
+        (WTF::VectorBuffer::VectorBuffer):
+        (WTF::VectorBuffer::~VectorBuffer):
+        (WTF::VectorBuffer::deallocateBuffer):
+        (WTF::VectorBuffer::releaseBuffer):
+        (WTF::Vector::clear):
+        (WTF::Vector::removeLast):
+        (WTF::::operator):
+        (WTF::::fill):
+        (WTF::::shrink):
+
+2007-10-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed http://bugs.webkit.org/show_bug.cgi?id=15490
+        Iteration statements sometimes incorrectly evaluate to the empty value 
+        (KDE r670547). 
+        
+        [ Broken off from http://bugs.webkit.org/show_bug.cgi?id=14868 ]
+        
+        This patch is a merge of KDE r670547, with substantial modification 
+        for performance.
+        
+        It fixes do-while statements to evaluate to a value. (They used
+        to evaluate to the empty value in all cases.) 
+
+        It also fixes SourceElementsNode to maintain the value of abnormal 
+        completions like "break" and "continue."
+        
+        It also re-works the main execution loop in SourceElementsNode so that
+        it (1) makes a little more sense and (2) avoids unnecessary work. This 
+        is a .28% speedup on command-line JS iBench.
+
+        * kjs/nodes.cpp:
+        (DoWhileNode::execute):
+        (SourceElementsNode::execute):
+
+2007-10-15  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Lars.
+
+        Fix compilation with gcc 4.3 by including 'limits' due to the use of std::numeric_limits.
+
+        * wtf/HashTraits.h:
+
+2007-10-5  Kevin Ollivier  <kevino@theolliviers.com>
+ 
+        Reviewed by Adam.
+        
+        Add support for MSVC7, and fix cases where PLATFORM(WIN) should
+        be PLATFORM(WIN_OS) for other ports building on Windows.
+ 
+        * kjs/DateMath.cpp:
+        (KJS::getDSTOffsetSimple):
+        * kjs/JSImmediate.h:
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/Platform.h:
+        * wtf/StringExtras.h:
+        (snprintf):
+        (vsnprintf):
+
+2007-10-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin.
+
+        Adds NegateNode optimization from KJS. The relevant revision in KDE
+        is 666736.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (NumberNode::evaluate):
+        * kjs/nodes.h:
+        (KJS::Node::):
+        (KJS::NumberNode::):
+        * kjs/nodes2string.cpp:
+        (NumberNode::streamTo):
+
+2007-10-14  Jason Foreman  <jason@threeve.org>
+
+        Reviewed by Maciej.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=15145
+        
+        Ensure that if adjusting n to minimize the difference of n*intPow10(e-p+1) to x,
+        that the property n < intPow10(p) is maintained.
+
+        * kjs/number_object.cpp:
+        (NumberProtoFunc::callAsFunction):
+
+== Rolled over to ChangeLog-2007-10-14 ==
diff --git a/ChangeLog-2009-06-16 b/ChangeLog-2009-06-16
new file mode 100644
index 0000000..52d3c36
--- /dev/null
+++ b/ChangeLog-2009-06-16
@@ -0,0 +1,39978 @@
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+
+        Rename PatchBuffer to LinkBuffer.  Previously our terminology has been a little
+        mixed up, but we have decided to fix on refering to the process that takes place
+        at the end of code generation as 'linking', and on any modifications that take
+        place later (and once the code has potentially already been executed) as 'patching'.
+
+        However, the term 'PatchBuffer' is already in use, and needs to be repurposed.
+
+        To try to minimize confusion, we're going to switch the terminology over in stages,
+        so for now we'll refer to later modifications as 'repatching'.  This means that the
+        new 'PatchBuffer' has been introduced with the name 'RepatchBuffer' instead.
+
+        This patch renames the old 'PatchBuffer' to 'LinkBuffer'.  We'll leave ToT in this
+        state for a week or so to try to avoid to much overlap of the meaning of the term
+        'PatchBuffer', then will come back and rename 'RepatchBuffer'.
+
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::LinkBuffer::LinkBuffer):
+        (JSC::AbstractMacroAssembler::LinkBuffer::~LinkBuffer):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Having moved most of their functionality into the RepatchBuffer class,
+        we can simplify the CodeLocation* classes.
+
+        The CodeLocation* classes are currently a tangle of templatey and friendly
+        badness, burried in the middle of AbstractMacroAssembler.  Having moved
+        the ability to repatch out into RepatchBufer they are now do-nothing wrappers
+        on CodePtr (MacroAssemblerCodePtr), that only exist to provide type-safety.
+
+        Simplify the code, and move them off into their own header.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        * assembler/CodeLocation.h: Copied from assembler/AbstractMacroAssembler.h.
+        (JSC::CodeLocationCommon::CodeLocationCommon):
+        (JSC::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::CodeLocationLabel::CodeLocationLabel):
+        (JSC::CodeLocationJump::CodeLocationJump):
+        (JSC::CodeLocationCall::CodeLocationCall):
+        (JSC::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::CodeLocationCommon::instructionAtOffset):
+        (JSC::CodeLocationCommon::labelAtOffset):
+        (JSC::CodeLocationCommon::jumpAtOffset):
+        (JSC::CodeLocationCommon::callAtOffset):
+        (JSC::CodeLocationCommon::nearCallAtOffset):
+        (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::operator!):
+        * bytecode/CodeBlock.h:
+        (JSC::getStructureStubInfoReturnLocation):
+        (JSC::getCallLinkInfoReturnLocation):
+        (JSC::getMethodCallLinkInfoReturnLocation):
+        * bytecode/Instruction.h:
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::ctiForValue):
+        (JSC::SimpleJumpTable::ctiForValue):
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCatch):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        (JSC::JITStubs::getPolymorphicAccessStructureListSlot):
+
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Having introduced the RepatchBuffer, ProcessorReturnAddress is now a do-nothing
+        wrapper around ReturnAddressPtr.  Remove it.  In tugging on this piece of string
+        it made sense to roll out the use of ReturnAddressPtr a little further into
+        JITStubs (which had always been the intention).
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkNearCallerToTrampoline):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
+        (JSC::CodeBlock::getBytecodeIndex):
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::StackHack::StackHack):
+        (JSC::returnToThrowTrampoline):
+        (JSC::throwStackOverflowError):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        (JSC::JITStackFrame::returnAddressSlot):
+        * runtime/JSGlobalData.h:
+
+2009-06-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6974857>
+
+        Define ENABLE_3D_RENDERING when building on 10.6, and move ENABLE_3D_RENDERING
+        switch from config.h to wtf/Platform.h.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move repatching methods into a set of methods on a class.  This will allow us to
+        coallesce memory reprotection calls.  Really, we want this class to be called
+        PatchBuffer, we want the class PatchBuffer to be called LinkBuffer, we want both
+        to be memblers of MacroAssembler rather then AbstractMacroAssembler, we don't
+        want the CodeLocationFoo types anymore (they are now only really there to provide
+        type safety, and that is completely undermined by the way we use offsets).  Then
+        the link & patch buffers should delegate the actual patching calls to the
+        architecture-specific layer of the MacroAssembler.  Landing all these changes as a
+        sequence of patches.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::RepatchBuffer):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relink):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::repatch):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::repatchLoadPtrToLEA):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Hunt & Oliver Garen.
+
+        We are currently generating two copies of the slow path for op_call for no reason.  Stop that.
+
+        Originally op_call used two slow paths since the first set up the pointer to the CallLinkInfo
+        for use when linking.  However this is now looked up using the return address (as we do for
+        property accesses) so the two paths are now identical.
+
+        No performance impact, reduces memory footprint.
+
+        * bytecode/CodeBlock.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+
+2009-06-12  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26373
+
+        Add a new class to Threading in wtf called ReadWriteLock that handles single writer/multiple reader locking.
+        Provide a pthreads-only implementation of the lock for now, as this class is only going to be used
+        on Snow Leopard at first.
+
+        * wtf/Threading.h:
+        (WTF::ReadWriteLock::impl):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ReadWriteLock::ReadWriteLock):
+        (WTF::ReadWriteLock::~ReadWriteLock):
+        (WTF::ReadWriteLock::readLock):
+        (WTF::ReadWriteLock::tryReadLock):
+        (WTF::ReadWriteLock::writeLock):
+        (WTF::ReadWriteLock::tryWriteLock):
+        (WTF::ReadWriteLock::unlock):
+
+2009-06-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make LiteralParser non-recursive
+
+        Convert LiteralParser from using a simple recursive descent parser
+        to a hand rolled PDA.  Relatively simple conversion, but required
+        modifications to MarkedArgumentBuffer to make it more suitable as
+        a generic marked vector.   I'll refactor and rename MarkedArgumentBuffer
+        in future as there are many other cases where it will be useful to
+        have such a class.
+
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::MarkedArgumentBuffer::removeLast):
+        (JSC::MarkedArgumentBuffer::last):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::tryLiteralParse):
+        (JSC::LiteralParser::):
+
+2009-06-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix for windows).
+
+        Adjust the exports for JSC on Windows like what was done for OSX in
+        the previous commit.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-12  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        UString shouldn't create sharedBuffer for SmallStrings.
+        https://bugs.webkit.org/show_bug.cgi?id=26360
+
+        The methods changed are not used by JSC, so there is no JS perf impact.  However,
+        there is a potential DOM perf impact, so I re-ran several of the tests that
+        I ran previously and ensured that the perf stay the same which caused me to
+        adjust the minLengthToShare.
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::sharedBuffer):
+            Determines if the buffer being shared is big enough before doing so.
+            Previously, BaseString::sharedBuffer was called but it would only know
+            the length of the base string (BaseString::len) which may not be the same
+            as the string being shared (Rep::len).
+        (JSC::UString::BaseString::sharedBuffer):
+            This is now only be used by Rep::sharedBuffer. which does the length check.
+        * runtime/UString.h:
+
+2009-06-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26191
+        Remove xmath include in MathExtras.h, because it is not needed and also
+        breaks VS2008 builds with TR1 turned on.
+
+        * wtf/MathExtras.h: Removed xmath include.
+
+2009-06-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        * ChangeLog-2007-10-14: Change pseudonym "Don Gibson" to me (was used while Google Chrome was not public); update my email address.
+
+2009-06-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding JSONObject.cpp to the build.
+
+        * JavaScriptCoreSources.bkl:
+
+2009-06-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        [Qt] Fix build break
+        https://bugs.webkit.org/show_bug.cgi?id=26340
+
+        * JavaScriptCore.pri: Add JSONObject.cpp to LUT files.
+
+2009-06-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Lower stringify recursion limit to deal with small windows stack.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::):
+
+2009-06-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix compilation warnings
+        <https://bugs.webkit.org/show_bug.cgi?id=26015>
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::wait): Fix compilation warning.
+        (WTF::ThreadCondition::timedWait): Ditto.
+
+2009-06-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix for Windows target.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+          Correct missing </File> tag after @r44550 that prevents the
+          project from being loaded in the Visual Studio IDE.
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe.
+
+        Tidy up a couple of comments.
+
+        * assembler/ARMv7Assembler.h:
+            Fix date in copyright, neaten up a couple of comments.
+        * assembler/MacroAssemblerARMv7.h:
+            Fix date in copyright.
+
+2009-06-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 26249: Support JSON.stringify
+        <https://bugs.webkit.org/show_bug.cgi?id=26249>
+        
+        Implement JSON.stringify.  This patch handles all the semantics of the ES5
+        JSON.stringify function, including replacer functions and arrays and both
+        string and numeric gap arguments.
+        
+        Currently uses a clamped recursive algorithm basically identical to the spec
+        description but with a few minor tweaks for performance and corrected semantics
+        discussed in the es-discuss mailing list.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::jsonTable):
+        * runtime/CommonIdentifiers.h:
+           add toJSON to the list of common identifiers
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            Add support for the JSON object lookup table
+
+        * runtime/JSONObject.cpp: Added.
+        (JSC::):
+        (JSC::JSONObject::getOwnPropertySlot):
+        (JSC::Stringifier::):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::appendString):
+
+        (JSC::Stringifier::StringKeyGenerator::StringKeyGenerator):
+        (JSC::Stringifier::StringKeyGenerator::getKey):
+        (JSC::Stringifier::IntKeyGenerator::IntKeyGenerator):
+        (JSC::Stringifier::IntKeyGenerator::getKey):
+            These KeyGenerator classes are used to abstract away the lazy evaluation of keys for
+            toJSON and replacer functions.
+
+        (JSC::Stringifier::toJSONValue):
+        (JSC::Stringifier::stringifyArray):
+        (JSC::Stringifier::stringifyObject):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSONObject.h: Added.
+        (JSC::JSONObject:::JSObject):
+        (JSC::JSONObject::classInfo):
+        (JSC::JSONObject::createStructure):
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JIT_OPTIMIZE_CALL & JIT_OPTIMIZE_METHOD_CALLS on ARMv7 platforms.
+
+        These optimizations function correctly with no further changes.
+
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_CALL & JIT_OPTIMIZE_METHOD_CALLS.
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed, build fix.
+
+        * assembler/MacroAssemblerARMv7.h:
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JIT_OPTIMIZE_ARITHMETIC on ARMv7 platforms.
+
+        Temporarily split support for 'branchTruncateDoubleToInt32' onto its own switch
+        ('supportsFloatingPointTruncate').  See comment in MacroAssemblerARMv7, we need
+        to work out wherther we are going to be able to support the current interface on
+        all platforms, or whether this should be refactored.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPoint):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns false).
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::addDouble):
+        (JSC::MacroAssemblerARMv7::subDouble):
+        (JSC::MacroAssemblerARMv7::mulDouble):
+        (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+            Implement FP code genertion operations.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+            Changed to call supportsFloatingPointTruncate().
+        (JSC::JIT::emitSlow_op_rshift):
+            Changed to call supportsFloatingPointTruncate().
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_ARITHMETIC.
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe & Geoff Garen.
+
+        Enable JIT_OPTIMIZE_PROPERTY_ACCESS on ARMv7 platforms.
+
+        Firm up interface for planting load intructions that will be repatched by
+        repatchLoadPtrToLEA().  This method should now no longer be applied to just
+        any loadPtr instruction.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (plants a load with a fixed width address).
+        (JSC::MacroAssemblerARMv7::move):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::moveWithPatch):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+            Switch to use common method 'moveFixedWidthEncoding()' to perform fixed width (often patchable) loads.
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+            Move an immediate to a register, always plants movT3/movt instruction pair.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (just a regular 32-bit load on x86).
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (just a regular 64-bit load on x86_64).
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_PROPERTY_ACCESS.
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JS language JIT for ARM thumb2 platforms.  Add ARMv7 specific
+        asm & constants, add appropriate configuration switches to Platform.h.
+
+        Landing this disabled until jump linking is completed (see YARR jit patch).
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32):
+            Fix: should load pointer with ImmPtr not Imm32.
+        (JSC::MacroAssemblerARMv7::store32):
+            Fix: should load pointer with ImmPtr not Imm32.
+        (JSC::MacroAssemblerARMv7::move):
+            Fix: When moving an Imm32 that is actually a pointer, should call movT3()
+            not mov(), to ensure code generation is repeatable (for exception handling).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            Disable JIT_OPTIMIZE_NATIVE_CALL specific code generation if the optimization is not enabled.
+        * jit/JIT.h:
+            Add ARMv7 specific values of constants & register names.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preverveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+            Implement for ARMv7 (move value to/from lr).
+        * jit/JITStubs.cpp:
+            Add JIT entry/thow trampolines, add macro to add thunk wrapper around stub routines.
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+            Add ARMv7 stack frame object.
+        * wtf/Platform.h:
+            Add changes necessary to allow JIT to build on this platform, disabled.
+
+2009-06-08  Mark Rowe  <mrowe@apple.com>
+
+        Speculative GTK build fix.
+
+        * wtf/DateMath.cpp:
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Previous patch caused a regression.
+
+        Restructure so no new (empty, inline) function calls are added on x86.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeWritable):
+        (JSC::ExecutableAllocator::makeExecutable):
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, GTK build fix (thanks, bdash).
+
+        * GNUmakefile.am: Moved DateMath with all other wtf kin.
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add (incomplete) support to YARR for running with the jit enabled
+        on Arm thumb2 platforms.  Adds new Assembler/MacroAssembler classes,
+        along with cache flushing support, tweaks to MacroAssemblerCodePtr
+        to support decorated thumb code pointers, and new enter/exit code
+        to YARR jit for the platform.
+
+        Support for this platform is still under development - the assembler
+        currrently only supports planting and linking jumps with a 16Mb range.
+        As such, initially commiting in a disabled state.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Add new assembler files.
+        * assembler/ARMv7Assembler.h: Added.
+            Add new Assembler.
+        * assembler/AbstractMacroAssembler.h:
+            Tweaks to ensure sizes of pointer values planted in JIT code do not change.
+        * assembler/MacroAssembler.h:
+            On ARMv7 platforms use MacroAssemblerARMv7.
+        * assembler/MacroAssemblerARMv7.h: Added.
+            Add new MacroAssembler.
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+            Add better ASSERT.
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+            Add better ASSERT.
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+            On ARMv7, MacroAssemblerCodePtr's mush be 'decorated' with a low bit set,
+            to indicate to the processor that the code is thumb code, not traditional
+            32-bit ARM.
+        (JSC::MacroAssemblerCodePtr::dataLocation):
+            On ARMv7, decoration must be removed.
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeWritable):
+            Reformatted, no change.
+        (JSC::ExecutableAllocator::makeExecutable):
+            When marking code executable also cache flush it, where necessary.
+        (JSC::ExecutableAllocator::MakeWritable::MakeWritable):
+            Only use the null implementation of this class if both !ASSEMBLER_WX_EXCLUSIVE
+            and running on x86(_64) - on other platforms we may also need ensure that
+            makeExecutable is called at the end to flush caches.
+        (JSC::ExecutableAllocator::reprotectRegion):
+            Reformatted, no change.
+        (JSC::ExecutableAllocator::cacheFlush):
+            Cache flush a region of memory, or platforms where this is necessary.
+        * wtf/Platform.h:
+            Add changes necessary to allow YARR jit to build on this platform, disabled.
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+            Add support to these methods for ARMv7.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, fix my previous fix.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::msToGregorianDateTime): Use WTF namespace qualifier to
+            disambiguate func signatures.
+
+2009-06-08  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Tiger build.
+
+        * wtf/Platform.h: Only test the value of the macro once we know it is defined.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, projectile-fixing Windows build.
+
+        * runtime/DateConversion.cpp: Added StringExtras include.
+        * wtf/DateMath.cpp: Replaced math with algorithm include (looking for std::min def for Windows).
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, Windows build fix.
+
+        * runtime/DateConstructor.cpp: Changed to use WTF namespace.
+        * runtime/DateConversion.cpp: Added UString include.
+        * runtime/DateInstance.cpp: Changed to use WTF namespace.
+        * wtf/DateMath.cpp: Added math include.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26238
+        Move most of runtime/DateMath functions to wtf/DateMath, and split off conversion-related
+        helpers to DateConversion.
+
+        * AllInOneFile.cpp: Changed DateMath->DateConversion.
+        * GNUmakefile.am: Ditto and added DateMath.
+        * JavaScriptCore.exp: Ditto.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added DateMath.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+        * pcre/pcre_exec.cpp: Changed to use DateMath.
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount): Changed to use DateConversion.
+        * runtime/DateConstructor.cpp: Ditto.
+        * runtime/DateConversion.cpp: Copied from JavaScriptCore/runtime/DateMath.cpp.
+        (JSC::parseDate): Refactored to use null-terminated characters as input.
+        * runtime/DateConversion.h: Copied from JavaScriptCore/runtime/DateMath.h.
+        * runtime/DateInstance.cpp: Changed to use wtf/DateMath.
+        * runtime/DateInstance.h: Ditto.
+        * runtime/DateMath.cpp: Removed.
+        * runtime/DateMath.h: Removed.
+        * runtime/DatePrototype.cpp: Ditto.
+        * runtime/InitializeThreading.cpp: Ditto.
+        * wtf/DateMath.cpp: Copied from JavaScriptCore/runtime/DateMath.cpp.
+        * wtf/DateMath.h: Copied from JavaScriptCore/runtime/DateMath.h.
+
+2009-06-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2009-06-07  David Kilzer  <ddkilzer@apple.com>
+
+        Make JavaScriptCore compile for iPhone and iPhone Simulator
+
+        Reviewed by Gavin Barraclough.
+
+        * Configurations/Base.xcconfig: Split GCC_ENABLE_OBJC_GC on
+        $(REAL_PLATFORM_NAME).  Added $(ARCHS_UNIVERSAL_IPHONE_OS) to
+        VALID_ARCHS.  Added REAL_PLATFORM_NAME_iphoneos,
+        REAL_PLATFORM_NAME_iphonesimulator, HAVE_DTRACE_iphoneos and
+        HAVE_DTRACE_iphonesimulator variables.
+        * Configurations/DebugRelase.xcconfig: Split ARCHS definition on
+        $(REAL_PLATFORM_NAME).
+        * Configurations/JavaScriptCore.xcconfig: Added
+        EXPORTED_SYMBOLS_FILE_armv6 and EXPORTED_SYMBOLS_FILE_armv7
+        variables.  Split OTHER_LDFLAGS into OTHER_LDFLAGS_BASE and
+        OTHER_LDFLAGS_$(REAL_PLATFORM_NAME) since CoreServices.framework
+        is only linked to on Mac OS X.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed references
+        to CoreServices.framework since it's linked using OTHER_LDFLAGS
+        in JavaScriptCore.xcconfig.
+        * profiler/ProfilerServer.mm: Added #import for iPhone
+        Simulator.
+        (-[ProfilerServer init]): Conditionalize use of
+        NSDistributedNotificationCenter to non-iPhone or iPhone
+        Simulator.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::): Build fix for iPhone and iPhone
+        Simulator.
+        * wtf/Platform.h: Defined PLATFORM(IPHONE) and
+        PLATFORM(IPHONE_SIMULATOR).
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Build fix for iPhone and iPhone
+        Simulator.
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $QMAKE_PATH_SEP instead of hardcoded / to fix Windows build
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        RS by Sam Weinig.
+
+        Remove bonus bogus \n from last commit.
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+
+2009-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change the implementation of op_throw so the stub function always modifies its
+        return address - if it doesn't find a 'catch' it will switch to a trampoline
+        to force a return from JIT execution.  This saves memory, by avoiding the need
+        for a unique return for every op_throw.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+            JITStubs::cti_op_throw now always changes its return address,
+            remove return code generated after the stub call (this is now
+            handled by ctiOpThrowNotCaught).
+        * jit/JITStubs.cpp:
+        (JSC::):
+            Add ctiOpThrowNotCaught definitions.
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            Change cti_op_throw to always change its return address.
+        * jit/JITStubs.h:
+            Add ctiOpThrowNotCaught declaration.
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rudder stamped by Sam Weinig.
+
+        Add missing ASSERT.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getRelocatedAddress):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Switch storePtrWithPatch to take the initial immediate value as an argument.
+
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jsr):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove patchLength..tByIdExternalLoadPrefix magic numbers from JIT.h.
+
+        These aren't really suitable values to be tracking within common code
+        of the JIT, since they are not (and realistically cannot) be checked
+        by ASSERTs, as the other repatch offsets are.  Move this functionality
+        (skipping the REX prefix when patching load instructions to LEAs on
+        x86-64) into the X86Assembler.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadPtrToLEA):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-06-05  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Bug 26160: Compile fails in MacOSX when GNU fileutils are installed
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26160>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use /bin/ln instead of ln for cases where this command is used with -h option.
+        As this option is not supported by GNU fileutils, this change helps users 
+        who have GNU fileutils in their PATH.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove DoubleNotEqual floating point comparison condition for now -
+        it is not used, and it is unclear the semantics are correct (I think
+        this comparison would actually give you not-equal-or-unordered, which
+        might be what is wanted... we can revisit this interface & get it
+        right when required).
+
+        Also, fix asserts in branchArith32 ops.  All adds & subs can check
+        for Signed, multiply only sets OF so can only check for overflow.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Minor tidy up in JITStubs.
+
+        * jit/JITStubs.cpp:
+        (JSC::StackHack::StackHack):
+        * jit/JITStubs.h:
+
+2009-06-05  Koen Kooi <koen@dominion.thruhere.net>
+
+        Reviewed by Xan Lopez.
+
+        Build fix for glib unicode backend.
+
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h:
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        3 tiny cleanups:
+
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+            store*() methods should take an ImplicitAddress, rather than an Address.
+        * assembler/X86Assembler.h:
+            Make patchPointer private.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret):
+            Remove empty line at end of function.
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Encapsulate many uses of void* in the assembler & jit with types that provide
+        more semantic information.  The new types are:
+        
+            * MacroAssemblerCodePtr - this wraps a pointer into JIT generated code.
+            * FunctionPtr - this wraps a pointer to a C/C++ function in JSC.
+            * ReturnAddressPtr - this wraps a return address resulting from a 'call' instruction.
+
+        Wrapping these types allows for stronger type-checking than is possible with everything
+        represented a void*.  For example, it is now enforced by the type system that near
+        calls can only be linked to JIT code and not to C functions in JSC (this was previously
+        required, but could not be enforced on the interface).
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::dataLocation):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::executableAddress):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadToLEA):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::operator!):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::CodeLocationLabel):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::addressForLookup):
+        (JSC::AbstractMacroAssembler::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+        (JSC::::CodeLocationCommon::instructionAtOffset):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::nearCallAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+        (JSC::FunctionPtr::value):
+        (JSC::FunctionPtr::executableAddress):
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+        (JSC::ReturnAddressPtr::value):
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::executableAddress):
+        (JSC::MacroAssemblerCodePtr::dataLocation):
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchPointerForCall):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator !):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::size):
+        (JSC::JITCode::HostFunction):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiArrayLengthTrampoline):
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallPreLink):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::operator!):
+        (JSC::Yarr::RegexCodeBlock::execute):
+
+2009-06-05  Antti Koivisto  <antti@apple.com>
+
+        Try to unbreak Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=13128
+        Safari not obeying cache header
+        
+        Export JSC::parseDate()
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-06-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug in property caching of getters and setters.
+
+        Make sure that the transition logic accounts for getters and setters.
+        If we don't we end up screwing up the transition tables so that some
+        transitions will start incorrectly believing that they need to check
+        for getters and setters. 
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * runtime/JSObject.h:
+        (JSC::):
+        * runtime/Structure.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Minor tweak to PatchBuffer, change it so it no longer holds a CodeRef, and instead
+        holds a separate code pointer and executable pool.  Since it now always holds its
+        own copy of the code size, and to simplify the construction sequence, it's neater
+        this way.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::finalizeCode):
+        (JSC::AbstractMacroAssembler::PatchBuffer::code):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove 'JIT_STUB_ARGUMENT_STACK' this is unused and untested.
+
+        This just leaves JIT_STUB_ARGUMENT_REGISTER and JIT_STUB_ARGUMENT_VA_LIST.
+        Since JIT_STUB_ARGUMENT_REGISTER is the sensible configuration on most platforms,
+        remove this define and make this the default behaviour.
+        Platforms must now define JIT_STUB_ARGUMENT_VA_LIST to get crazy va_list voodoo,
+        if they so desire.
+
+        (Refactoring of #ifdefs only, no functional change, no performance impact.)
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        * jit/JITArithmetic.cpp:
+            Remove some redundant typedefs, unused since arithmetic was added to the MacroAssembler interface.
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix due to header include problem.
+
+        * interpreter/Interpreter.h: Remove wtf from includes so that
+          compile can find the headers in expected places.
+
+2009-06-04  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        HashTable class (JavaScriptCore/wtf/HashTable.h) doesn't instantiated by 'new', so 
+        inheritance was removed. HashTable struct has been instantiated by operator new in
+        JSGlobalData.cpp:106.
+        HashTable couldn't inherited from FastAllocBase since struct with inheritance is 
+        no longer POD, so HashTable struct has been instantiated by fastNew, destroyed by
+        fastDelete.
+
+        * interpreter/Interpreter.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * wtf/HashTable.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Wrap the code that plants pushes/pops planted by JIT in explanatorily named
+        methods; move property storage reallocation into a standard stub function.
+
+        ~No performance impact (possible <1% progression on x86-64, likely just noise).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            Wrap calls to push/pop.
+        * jit/JIT.h:
+            Declare the new wrapper methods.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preverveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+            Define the new wrapper methods.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+            Wrap calls to push/pop.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+            Move property storage reallocation into a standard stub function.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::):
+
+2009-06-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Single-threaded QtWebKit configuration
+        <https://bugs.webkit.org/show_bug.cgi?id=26015>
+
+        * JavaScriptCore.pri: Use ThreadingNone.cpp instead of
+        ThreadingQt.cpp and make sure ENABLE_JSC_MULTIPLE_THREADS is turned off
+        when ENABLE_SINGLE_THREADED is tuned on
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::wait): Fix compilation warning.
+        (WTF::ThreadCondition::timedWait): Ditto.
+
+2009-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove workaround that was added to address <rdar://problem/5488678> as it no longer affects our Tiger builds.
+
+        * Configurations/Base.xcconfig:
+
+2009-06-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        Use C-style comments in Platform.h so it can be included from C
+        files.
+
+        * wtf/Platform.h:
+
+2009-06-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Use File::Spec->tmpdir instead of hardcoded paths for tempfile() dir
+        
+        This fixes the Windows-build if the user does not have a /tmp directory.
+
+        * pcre/dftables:
+
+2009-06-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver ">>" Hunt.
+
+        emitSlow_op_rshift is linking the wrong number of slow cases, if !supportsFloatingPoint().
+        Fixerate, and refactor/comment the code a little to make it clearer what is going on.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative windows build fix (errm, for the other patch!).
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative windows build fix.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::::CodeLocationCall::CodeLocationCall):
+        (JSC::::CodeLocationNearCall::CodeLocationNearCall):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliej Hunt.
+
+        Change JITStub functions from being static members on the JITStub class to be
+        global extern "C" functions, and switch their the function signature declaration
+        in the definition of the functions to be C-macro generated.  This makes it easier
+        to work with the stub functions from assembler code (since the names no longer
+        require mangling), and by delaring the functions with a macro we can look at
+        also auto-generating asm thunks to wrap the JITStub functions to perform the
+        work currently in 'restoreArgumentReference' (as a memory saving).
+
+        Making this change also forces us to be a bit more realistic about what is private
+        on the Register and CallFrame objects.  Presently most everything on these classes
+        is private, and the classes have plenty of friends.  We could befriend all the
+        global functions to perpetuate the delusion of encapsulation, but using friends is
+        a bit of a sledgehammer solution here - since friends can poke around with all of
+        the class's privates, and since all the major classes taht operate on Regsiters are
+        currently friends, right there is currently in practice very little protection at
+        all.  Better to start removing friend delclarations, and exposing just the parts
+        that need to be exposed.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::returnPC):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::returnValueRegister):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        (JSC::Register::i):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::classInfo):
+        * runtime/JSGlobalData.h:
+
+2009-06-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Tidy up the literal parser.
+
+        Make the number lexing in the LiteralParser exactly match the JSON spec, which
+        makes us cover more cases, but also more strict.  Also made string lexing only
+        allow double-quoted strings.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "WX" Weinig.
+
+        Allow the JIT to operate without relying on use of RWX memory, on platforms where this is supported.
+
+        This patch adds a switch to Platform.h (ENABLE_ASSEMBLER_WX_EXCLUSIVE) which enables this mode of operation.
+        When this flag is set, all executable memory will be allocated RX, and switched to RW only whilst being
+        modified.  Upon completion of code generation the protection is switched back to RX to allow execution.
+
+        Further optimization will be required before it is desirable to enable this mode of operation by default;
+        enabling this presently incurs a 5%-10% regression.
+
+        (Submitting disabled - no performance impact).
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadToLEA):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::fromFunctionPointer):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToFunction):
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::~PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+        (JSC::::CodeLocationCommon::nearCallAtOffset):
+        (JSC::::CodeLocationCall::CodeLocationCall):
+        (JSC::::CodeLocationNearCall::CodeLocationNearCall):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::CAN_SIGN_EXTEND_U32_64):
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::patchPointer):
+        (JSC::X86Assembler::relinkJump):
+        (JSC::X86Assembler::relinkCall):
+        (JSC::X86Assembler::repatchInt32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::repatchLoadToLEA):
+        (JSC::X86Assembler::patchInt32):
+        (JSC::X86Assembler::patchRel32):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::):
+        (JSC::ExecutableAllocator::makeWritable):
+        (JSC::ExecutableAllocator::makeExecutable):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::reprotectRegion):
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        * wtf/Platform.h:
+
+2009-05-29 Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Inherits Interpreter class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSGlobalData.cpp. 
+
+        * interpreter/Interpreter.h:
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (windows build fix).
+
+        Add exports for windows (corresponding to the JavaScriptCore.exp modification
+        in the previous change).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Alder and Maciej Stachowiak.
+
+        Bug 26057: StringImpl should share buffers with UString.
+        https://bugs.webkit.org/show_bug.cgi?id=26057
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::create):
+        (JSC::UString::BaseString::sharedBuffer): Only do the sharing when
+        the buffer exceeds a certain size.  The size was tuned by running
+        various dom benchmarks with numbers ranging from 20 to 800 and finding
+        a place that seemed to do the best overall.
+        * runtime/UString.h:
+
+2009-05-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliej "you just need to change NativeFunctionWrapper.h" Hunt.
+
+        Add ENABLE_JIT_OPTIMIZE_NATIVE_CALL switch to allow JIT to operate without native call optimizations.
+
+        * runtime/NativeFunctionWrapper.h:
+        * wtf/Platform.h:
+
+2009-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6935193> REGRESSION (r42734): Celtic Kane JavaScript benchmark does not run:
+        "Maximum call stack size exceeded"
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use the same recursion limit as the other recursion checks.
+        We need a limit of at least 100 to run the benchmark above.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added new build flag --filters for Mac. More details in WebCore/ChangeLog.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-05-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6928025> Stack overflow in JSC::stringProtoFuncReplace() running jsFunFuzz
+
+        We should always check for exceptions after creating a CachedCall, this wasn't being done in
+        the string replace logic.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed (make distcheck) build fix; adding missing headers.
+
+        * GNUmakefile.am:
+
+2009-05-27  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben
+        
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha.
+
+        When building on Windows, consider Windows specific files.
+
+        * GNUmakefile.am:
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        When building with MinGW, don't use the __declspec(dl{import,export})
+        decorations and rely on the linker to use its nifty auto-import feature.
+        It is extremely hard to get the decorations right with MinGW in general
+        and impossible in WebKit, where the resulting shared library is linking
+        together some static libraries.
+
+        * config.h:
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613
+
+        Be able to use GOwnPtr for GHashTable as well. The assumption
+        is that the hash table has been created with g_hash_table_new_full
+        and has proper destruction functions.
+
+        * wtf/GOwnPtr.cpp:
+        (WTF::GHashTable):
+        * wtf/GOwnPtr.h:
+
+2009-05-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6924033> REGRESSION: Assertion failure due to forward references
+
+        Add a pattern type for forward references to ensure that we don't confuse the
+        quantifier alternatives assertion.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::ForwardReference):
+
+2009-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for: <rdar://problem/6918095> REGRESSION: jQuery load() issue (25981),
+        and also an ASSERT failure on http://ihasahotdog.com/.
+
+        When overwriting a property on a dictionary with a cached specific value,
+        clear the cache if new value being written is different.
+
+        * JavaScriptCore.exp:
+            Export the new symbols.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_id_method_check_second):
+            Close dictionary prototypes upon caching a method access, as would happen when caching
+            a regular get_by_id.
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::locationForOffset):
+            Make these methods private.
+        (JSC::JSObject::putDirectInternal):
+            When overwriting a property on a dictionary with a cached specific value,
+            clear the cache if new value being written is different.
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+            Reset the specific value field for a given property in a dictionary.
+        (JSC::Structure::despecifyFunctionTransition):
+            Rename of 'changeFunctionTransition' (this was already internally refered to as a despecification).
+        * runtime/Structure.h:
+            Declare new method.
+
+2009-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "pieces of eight" Hunt.
+
+        When reseting RegexPattern class, should fully reset the class, not just bits of it.
+        In particular, we delete the cached character classes (for wordchars, etc), but do
+        not reset the set of pointers to the cached classes.  In the case of a repeated parse
+        due to an illegal back-reference we will continue to use the deleted character class.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::reset):
+
+2009-05-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix to correct r44161.
+
+        * wtf/FastAllocBase.h:
+
+2009-05-26  Zoltan Horvath  <horvath.zoltan.6@stud.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inherite HashTable from FastAllocBase, because it has been instantiated by
+        'new' in JavaScriptCore/runtime/JSGlobalData.cpp.
+
+        * wtf/HashTable.h:
+        * wtf/FastAllocBase.h: Remove 'wtf' path from TypeTraits.h to allow use outside of wtf.
+
+2009-05-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25126
+        Allow the buffer underlying UString to be shared.
+
+        In order to not grow the underlying size of any structure,
+        there is a union in the Rep string which holds
+         + m_sharedBuffer -- a pointer to the shared ref counted buffer
+           if the class is BaseString and the buffer is being shared OR
+         + m_baseString -- the BaseString if the class is only UString::Rep
+           but not a UString::BaseString
+
+        Ideally, m_sharedBuffer would be a RefPtr, but it cannot be because
+        it is in a union.
+
+        No change in sunspider perf.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::share):
+        (JSC::UString::Rep::destroy):
+        (JSC::UString::BaseString::sharedBuffer):
+        (JSC::UString::BaseString::setSharedBuffer):
+        (JSC::UString::BaseString::slowIsBufferReadOnly):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::concatenate):
+        (JSC::UString::append):
+        * runtime/UString.h:
+        (JSC::UString::Rep::Rep):
+        (JSC::UString::Rep::):
+        (JSC::UString::BaseString::isShared):
+        (JSC::UString::BaseString::isBufferReadOnly):
+        (JSC::UString::Rep::baseString):
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::isShared):
+        * wtf/OwnFastMallocPtr.h: Added.
+        (WTF::OwnFastMallocPtr::OwnFastMallocPtr):
+        (WTF::OwnFastMallocPtr::~OwnFastMallocPtr):
+        (WTF::OwnFastMallocPtr::get):
+        (WTF::OwnFastMallocPtr::release):
+
+2009-05-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Re-add interpreter logic to jit-enabled builds as GCC mysteriously regresses without it
+
+        * wtf/Platform.h:
+
+2009-05-25  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        The functions written in assembly need to have a leading
+        underscore on Windows too.
+
+        * jit/JITStubs.cpp:
+
+2009-05-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix for experimental PGO Windows target.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        * GNUmakefile.am: Added OwnPtrCommon.h and PassOwnPtr.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::OwnPtr): Added constructors that take a
+        PassOwnPtr.  Also added a copy constructor declaration that's
+        required when assigning a PassOwnPtr to a stack-based OwnPtr.
+        (WTF::operator=): Added assignment operator methods that take a
+        PassOwnPtr.
+        (WTF::swap): Reformatted.
+        (WTF::operator==): Whitespace changes.
+        (WTF::operator!=): Ditto.
+
+        * wtf/OwnPtrCommon.h: Added.
+        (WTF::deleteOwnedPtr):
+
+        * wtf/PassOwnPtr.h: Added.
+        (WTF::PassOwnPtr::PassOwnPtr):
+        (WTF::PassOwnPtr::~PassOwnPtr):
+        (WTF::PassOwnPtr::get):
+        (WTF::PassOwnPtr::clear):
+        (WTF::PassOwnPtr::release):
+        (WTF::PassOwnPtr::operator*):
+        (WTF::PassOwnPtr::operator->):
+        (WTF::PassOwnPtr::operator!):
+        (WTF::PassOwnPtr::operator UnspecifiedBoolType):
+        (WTF::::operator):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+
+2009-05-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove interpreter specific logic from the JIT builds.
+
+        This saves ~100k in JSC release builds.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * wtf/Platform.h:
+
+2009-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Part two of an attempted Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Part one of an attempted Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        op_method_check
+
+        Optimize method calls, by caching specific function values within the Structure.
+        The new opcode is used almost like an x86 opcode prefix byte to optimize op_get_by_id,
+        where the property access is being used to read a function to be passed to op-call (i.e.
+        'foo.bar();').  This patch modifies the Structure class such that when a property is
+        put to an object for the first time we will check if the value is a function.  If it is,
+        we will cache the function value on the Structure.  A Structure in such a state guarantees
+        that not only does a property with the given identifier exist on the object, but also that
+        its value is unchanged.  Upon any further attempt to put a property with the same identifier
+        (but a different value) to the object, it will transition back to a normal Structure (where
+        it will guarantee the presence but not the value of the property).
+
+        op_method_check makes use of the new information made available by the Structure, by
+        augmenting the functionality of op_get_by_id.  Upon generating a FunctionCallDotNode a
+        check will be emitted prior to the property access reading the function value, and the JIT
+        will generate an extra (initially unlinked but patchable) set of checks prior to the regular
+        JIT code for get_by_id.  The new code will do inline structure and prototype structure check
+        (unlike a regular get_by_id, which can only handle 'self' accesses inline), and then performs
+        an immediate load of the function value, rather than using memory accesses to load the value
+        from the obejct's property storage array.  If the method check fails it will revert, or if
+        the access is polymorphic, the op_get_by_id will continue to operate - and optimize itself -
+        just as any other regular op_get_by_id would.
+
+        ~2.5% on v8-tests, due to a ~9% progression on richards.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        * JavaScriptCore.exp:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::getMethodCallLinkInfoReturnLocation):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
+        (JSC::CodeBlock::addMethodCallLinkInfos):
+        (JSC::CodeBlock::methodCallLinkInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitMethodCheck):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::MethodCallCompilationInfo::MethodCallCompilationInfo):
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::patchMethodCallProto):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_id_method_check):
+        (JSC::JITStubs::cti_op_get_by_id_method_check_second):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        (JSC::constructError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::methodCallDummy):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::getPropertyAttributes):
+        (JSC::JSObject::getPropertySpecificFunction):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * runtime/JSObject.h:
+        (JSC::getJSFunction):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parseObject):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::):
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::setDespecifyFunctionProperty):
+        (JSC::PutPropertySlot::isCacheable):
+        (JSC::PutPropertySlot::cachedOffset):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changeFunctionTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::Structure::specificFunction):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHashTraits::emptyValue):
+        * wtf/Platform.h:
+
+2009-05-22  Brent Fulgham <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25950
+        JavaScriptCore Fails to build on Windows (Cairo) due to CoreFoundation
+        link requirement.
+
+        Modify project to add new Debug_CFLite and Release_CFLite targets.  These
+        use the new JavaScriptCoreCFLite.vsprops to link against CFLite.dll.
+        Existing projects are changed to use the new JavaScriptCoreCF.vsprops
+        to link against CoreFoundation.dll.
+
+        The JavaScriptCoreCommon.vsprops is modified to remove the link
+        against CoreFoundation.dll.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Original patch by Jürg Billeter and Naiem Shaik.
+        Implementing WTF Unicode functionality based on GLib.
+
+        * GNUmakefile.am:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/glib: Added.
+        * wtf/unicode/glib/UnicodeGLib.cpp: Added.
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::umemcasecmp):
+        * wtf/unicode/glib/UnicodeGLib.h: Added.
+        (WTF::Unicode::):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::isFormatChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::category):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::decompositionType):
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Added.
+
+2009-05-21  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add MacroAssemblerCodeRef.h to file list.
+
+        * GNUmakefile.am:
+
+2009-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+        Addition of MacroAssemblerCodeRef.h rubber stamped by Geoff Garen.
+
+        Refactor JIT code-handle objects.  The representation of generated code is currently
+        a bit of a mess.  We have a class JITCode which wraps the pointer to a block of
+        generated code, but this object does not reference the executable pool meaning that
+        external events (the pool being derefed) could make the pointer become invalid.
+        To overcome this both the JIT and Yarr implement further (and similar) objects to
+        wrap the code pointer with a RefPtr to the pool.  To add to the mire, as well as the
+        CodeBlock containing a handle onto the code the FunctionBodyNode also contains a
+        copy of the code pointer which is used almost (but not entirely) uniquely to access
+        the JIT code for a function.
+
+        Rationalization of all this:
+
+            * Add a new type 'MacroAssembler::CodeRef' as a handle for a block of JIT generated code.
+            * Change the JIT & Yarr to internally handle code using CodeRefs.
+            * Move the CodeRef (formerly anow defunct JITCodeRef) from CodeBlock to its owner node.
+            * Remove the (now) redundant code pointer from FunctionBodyNode.
+
+        While tidying this up I've made the PatchBuffer return code in new allocations using a CodeRef,
+        and have enforced an interface that the PatchBuffer will always be used, and 'finalizeCode()' or
+        'finalizeCodeAddendum()' will always be called exactly once on the PatchBuffer to complete code generation.
+
+        This gives us a potentially useful hook ('PatchBuffer::performFinalization()') at the end of generation,
+        which may have a number of uses.  It may be helpful should we wish to switch our generation
+        model to allow RW/RX exclusive memory, and it may be useful on non-cache-coherent platforms to
+        give us an oportunity to cache flush as necessary.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::CodeRef::CodeRef):
+        (JSC::AbstractMacroAssembler::CodeRef::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::~PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::complete):
+        (JSC::AbstractMacroAssembler::PatchBuffer::finalize):
+        (JSC::AbstractMacroAssembler::PatchBuffer::entry):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::setJITCode):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::executablePool):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::operator bool):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::size):
+        (JSC::JITCode::executablePool):
+        (JSC::JITCode::HostFunction):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateJITCode):
+        (JSC::EvalNode::generateJITCode):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateJITCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::generatedJITCode):
+        (JSC::ScopeNode::getExecutablePool):
+        (JSC::ScopeNode::setJITCode):
+        (JSC::ProgramNode::jitCode):
+        (JSC::EvalNode::jitCode):
+        (JSC::FunctionBodyNode::jitCode):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::pcreFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::RegexCodeBlock::operator bool):
+        (JSC::Yarr::RegexCodeBlock::set):
+        (JSC::Yarr::RegexCodeBlock::execute):
+
+2009-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/6910264> REGRESSION: Cached DOM global object property access fails in browser (25921)
+        <https://bugs.webkit.org/show_bug.cgi?id=25921>
+
+        When caching properties on the global object we need to ensure that we're
+        not attempting to cache through a shell object.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_global):
+
+2009-05-21  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2009-05-21  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25945: Add support for MADV_FREE to TCMalloc
+        <https://bugs.webkit.org/show_bug.cgi?id=25945>
+        <rdar://problem/6910754>
+
+        Add support for MADV_FREE to TCMalloc_SystemRelease for platforms that
+        don't also support MADV_FREE_REUSE. The code is identical to the MADV_DONTNEED
+        case except for the advice passed to madvise(), so combining the two cases
+        makes the most sense.
+
+        * wtf/Platform.h: Only define HAVE_MADV_FREE when not building on Tiger or
+        Leopard, because while it is defined on these platforms it actually does
+        nothing.
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease): use MADV_FREE if it is available; otherwise use
+        MADV_DONTNEED.
+
+2009-05-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25917> / <rdar://problem/6910066>.
+        Bug 25917: REGRESSION (r43559?): Javascript debugger crashes when pausing page
+
+        The debugger currently retrieves the arguments object from an activation rather than pulling
+        it from a call frame.  This is unreliable to due to the recent optimization to lazily create
+        the arguments object.  In the long-term it should stop doing that (<rdar://problem/6911886>),
+        but for now we force eager creation of the arguments object when debugging.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+
+2009-05-21  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 25912: Harden NumberPrototype.cpp by removing use of strcpy()
+        <https://bugs.webkit.org/show_bug.cgi?id=25912>
+
+        This causes no change on SunSpider.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp): replace strcpy() with memcpy(), ASSERT that the
+        temporary buffer has sufficient space to store the result, and move the
+        explicit null-termination closer to the memcpy() for easier visual inspection
+        of the code.
+        (JSC::fractionalPartToString): replace strcpy() with memcpy(), and ASSERT
+        that the temporary buffer has sufficient space to store the result. There
+        is no explicit null-termination because this is done by the caller. The
+        same is already true for exponentialPartToString().
+        (JSC::numberProtoFuncToExponential): replace strcpy() with memcpy(), explicitly
+        null-terminate the result, and ASSERT that the temporary buffer has sufficient
+        space to store the result.
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup the JSGlobalData when exiting early with the usage statement in jsc.
+
+        * jsc.cpp:
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+
+2009-05-20  Stephanie Lewis  <slewis@apple.com>
+
+        Update the order files.  <rdar://problem/6881750> Generate new order files.
+
+        * JavaScriptCore.order:
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Replace WREC with YARR + YARR_JIT for the Qt port. This is only
+        used when compiled with JIT support for now, so it is a drop-in
+        replacement for the WREC usage. Still including the wrec headers
+        as they are being referred from RegExp.h, though the contents of
+        that header it protected by "#if ENABLE(WREC)".
+
+        * JavaScriptCore.pri:
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix GTK debug build.
+
+        The function dumpDisjunction, compiled with debug enabled, uses
+        printf, which needs stdio.h to be included.
+
+        * yarr/RegexInterpreter.cpp:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25843: [Qt] Remove qt-port build flag
+        <https://bugs.webkit.org/show_bug.cgi?id=25843>
+
+        * JavaScriptCore.pro:
+
+
+2009-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity): Copy-paste typo.
+
+2009-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6885680> CrashTracer: [USER] 1 crash in Install
+        Mac OS X at <unknown binary> • 0x9274241c
+        
+        (Original patch by Joe Sokol and Ronnie Misra.)
+        
+        SunSpider says 1.004x faster.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity): Instead of doing complicated
+        math that sometimes used to overflow, just release the full range of the
+        register file.
+
+        * interpreter/RegisterFile.h:
+        (JSC::isPageAligned):
+        (JSC::RegisterFile::RegisterFile): Added ASSERTs to verify that it's
+        safe to release the full range of the register file.
+
+        (JSC::RegisterFile::shrink): No need to releaseExcessCapacity() if the
+        new end is not smaller than the old end. (Also, doing so used to cause
+        numeric overflow, unmapping basically the whole process from memory.)
+
+2009-05-19  Oliver Hunt  <oliver@apple.com>
+
+        RS=Mark Rowe.
+
+        <rdar://problem/6888393> REGRESSION: Start Debugging JavaScript crashes browser (nightly builds only?)
+        <https://bugs.webkit.org/show_bug.cgi?id=25717>
+
+        Remove JSC_FAST_CALL as it wasn't gaining us anything, and was
+        resulting in weird bugs in the nightly builds.
+
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isNumber):
+        (JSC::ExpressionNode::isString):
+        (JSC::ExpressionNode::isNull):
+        (JSC::ExpressionNode::isPure):
+        (JSC::ExpressionNode::isLocation):
+        (JSC::ExpressionNode::isResolveNode):
+        (JSC::ExpressionNode::isBracketAccessorNode):
+        (JSC::ExpressionNode::isDotAccessorNode):
+        (JSC::ExpressionNode::isFuncExprNode):
+        (JSC::ExpressionNode::isSimpleArray):
+        (JSC::ExpressionNode::isAdd):
+        (JSC::ExpressionNode::resultDescriptor):
+        (JSC::StatementNode::firstLine):
+        (JSC::StatementNode::lastLine):
+        (JSC::StatementNode::isEmptyStatement):
+        (JSC::StatementNode::isReturnNode):
+        (JSC::StatementNode::isExprStatement):
+        (JSC::StatementNode::isBlock):
+        (JSC::NullNode::isNull):
+        (JSC::BooleanNode::isPure):
+        (JSC::NumberNode::value):
+        (JSC::NumberNode::setValue):
+        (JSC::NumberNode::isNumber):
+        (JSC::NumberNode::isPure):
+        (JSC::StringNode::isPure):
+        (JSC::StringNode::isString):
+        (JSC::ResolveNode::identifier):
+        (JSC::ResolveNode::isLocation):
+        (JSC::ResolveNode::isResolveNode):
+        (JSC::BracketAccessorNode::isLocation):
+        (JSC::BracketAccessorNode::isBracketAccessorNode):
+        (JSC::DotAccessorNode::base):
+        (JSC::DotAccessorNode::identifier):
+        (JSC::DotAccessorNode::isLocation):
+        (JSC::DotAccessorNode::isDotAccessorNode):
+        (JSC::TypeOfResolveNode::identifier):
+        (JSC::AddNode::isAdd):
+        (JSC::BlockNode::isBlock):
+        (JSC::EmptyStatementNode::isEmptyStatement):
+        (JSC::ExprStatementNode::isExprStatement):
+        (JSC::ReturnNode::isReturnNode):
+        (JSC::ScopeNode::sourceURL):
+        (JSC::ProgramNode::bytecode):
+        (JSC::EvalNode::bytecode):
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::toSourceString):
+        (JSC::FunctionBodyNode::bytecode):
+        (JSC::FuncExprNode::isFuncExprNode):
+
+2009-05-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        - speed up string comparison, especially for short strings
+        
+        ~1% on SunSpider
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::operator==): Inline UString's operator==, since it is called from
+        hot places in the runtime. Also, specialize 2-char strings in a similar way to
+        1-char, since we're taking the hit of a switch anyway.
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        - for polymorphic prototype lookups, increase the number of slots from 4 to 8
+        
+        ~4% faster on v8 raytrace benchmark
+
+        * bytecode/Instruction.h:
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - tighten up the code for the load_varargs stub
+        
+        ~1-2% on v8-raytrace
+        
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs): Hoist some loop invariants that
+        the compiler didn't feel like hoisting for us. Remove unneeded exception check.
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - Improve code generation for access to prototype properties
+        
+        ~0.4% speedup on SunSpider.
+        
+        Based on a suggestion from Geoff Garen.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable YARR, and disable WREC for GTK+.
+
+        * GNUmakefile.am:
+        * yarr/RegexParser.h:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Add -no-install and -no-fast-install to programs and tests that we
+         don't install. Also remove -O2 since this is already handled at
+         configure time.
+
+         * GNUmakefile.am:
+
+2009-05-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Add JavaScriptCore/ to JSC include path only since it's not
+        required when building WebCore.
+
+        * GNUmakefile.am:
+
+2009-05-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Looking like MSVC doesn't like static variables in inline methods?
+        Make the state of the SSE2 check a static variable on the class
+        MacroAssemblerX86Common as a speculative build fix for Windows.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        (JSC::MacroAssemblerX86Common::):
+        * jit/JIT.cpp:
+
+2009-05-15  Adam Roben  <aroben@apple.com>
+
+        Add some assembler headers to JavaScriptCore.vcproj
+
+        This is just a convenience for Windows developers.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add FP support to the MacroAssembler, port JITArithmetic over to make use of this. Also add
+        API to determine whether FP support is available 'MacroAssembler::supportsFloatingPoint()',
+        FP is presently only supported on SSE2 platforms, not x87.  On platforms where a suitable
+        hardware FPU is not available 'supportsFloatingPoint()' may simply return false, and all
+        other methods ASSERT_NOT_REACHED().
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::supportsFloatingPoint):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::loadDouble):
+        (JSC::MacroAssemblerX86Common::storeDouble):
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::subDouble):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        (JSC::MacroAssemblerX86Common::set32):
+        (JSC::MacroAssemblerX86Common::setTest32):
+        (JSC::MacroAssemblerX86Common::x86Condition):
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::movePtrToDouble):
+        (JSC::MacroAssemblerX86_64::moveDoubleToPtr):
+        (JSC::MacroAssemblerX86_64::setPtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPoint):
+        * assembler/X86Assembler.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-05-15  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 25467: JavaScript debugger should use function.displayName as the function's name in the call stack
+        <https://bugs.webkit.org/show_bug.cgi?id=25467>
+        
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.exp: Added calculatedFunctionName
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Added calculatedFunctionName
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added calculatedFunctionName
+        * debugger/DebuggerCallFrame.cpp: Added calculatedFunctionName to match existing one in ProfileNode.
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * debugger/DebuggerCallFrame.h: Added calculatedFunctionName to match existing one in ProfileNode.
+
+2009-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix, not reviewed.
+
+        Quick fixes for JIT builds with OPTIMIZE flags disabled.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compilePutByIdHotPath):
+
+2009-05-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Back out incorrect Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-14  Adam Roben  <aroben@apple.com>
+
+        Windows jsc build fix
+
+        r43648 modified jsc.vcproj's post-build event not to try to copy files
+        that aren't present. Then r43661 mistakenly un-did that modification.
+        This patch restores the modification from r43648, but puts the code in
+        jscCommon.vsprops (where it should have been added in r43648).
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Restored empty
+        VCPostBuildEventTool tags.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Modified the post-build
+        event command line to match the one in jsc.vcproj from r43648.
+
+2009-05-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25325
+
+        Make sure pthread_self() is declared before it gets called in Collector.cpp
+
+        * runtime/Collector.cpp: Include pthread.h in most Unix-like platforms
+        (not just for OPENBSD)
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25785>.
+        Bug 25785: Segfault in mark when using JSObjectMakeConstructor
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor): OpaqueJSClass::prototype can return 0.  We need to use the default object prototype when it does.
+        * API/tests/testapi.c:
+        (main): Add a test case.
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect): Add a clearer assertion for a null value.  The assertion on the next line does catch this,
+        but the cause of the failure is not clear from the assertion itself.
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6681868> When building with Xcode 3.1.3 should be using gcc 4.2
+
+        The meaning of XCODE_VERSION_ACTUAL is more sensible in newer versions of Xcode.
+        Update our logic to select the compiler version to use the more appropriate XCODE_VERSION_MINOR
+        if the version of Xcode supports it, and fall back to XCODE_VERSION_ACTUAL if not.
+
+        * Configurations/Base.xcconfig:
+
+2009-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Checking register file bounds should be a ptr comparison (m_end is a Register*).
+        Also, the compare should be unsigned, pointers don'ts go negative.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2009-05-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <rdar://problem/6882919> REGRESSION: page at Metroauto site crashes in cti_op_loop_if_less (25730)
+
+        op_loop_if_less (imm < op) was loading op into regT1, but in the slow path spills regT0.
+        This leads to bad happen.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-05-13  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25746
+        Revert http://trac.webkit.org/changeset/43507 which caused crash in PPC nightlies with Safari 4.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::ref):
+        (WTF::::deref):
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::clearPthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::clearThreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::threadForIdentifier):
+        (WTF::clearThreadForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Revert the parser arena change. It was a slowdown, not a speedup.
+        Better luck next time (I'll break it up into pieces).
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Tiger build fix.
+
+        * parser/Grammar.y: Add back empty code blocks, needed by older
+        versions of bison on certain rules.
+
+2009-05-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2009-05-13  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes after r43642
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Updated.
+
+        * debugger/Debugger.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/RegExp.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/StringPrototype.cpp:
+        Added missing #includes.
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Step 3: Add some actual arena allocation. About 1% SunSpider speedup.
+
+        * JavaScriptCore.exp: Updated.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
+        contains const Identifier* now.
+        (JSC::BytecodeGenerator::emitPushNewScope): Updated to take a const
+        Identifier&.
+        * bytecompiler/BytecodeGenerator.h: Ditto
+
+        * bytecompiler/SegmentedVector.h: Added isEmpty.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Moved this function here from
+        WebCore so WebCore doesn't need the details of FunctionBodyNode.
+        * debugger/Debugger.h: Ditto.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute): Updated since VarStack contains const
+        Identifier* now.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_vm_lazyLinkCall): Call isHostFunction on the body
+        rather than on the function object, since we can't easily have inlined
+        access to the FunctionBodyNode in JSFunction.h since WebCore needs
+        access to that header.
+        (JSC::JITStubs::cti_op_construct_JSConstruct): Ditto.
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier): Ditto.
+
+        * parser/Grammar.y: Use JSGlobalData* to pass the global data pointer
+        around whenever possible instead of using void*. Changed
+        SET_EXCEPTION_LOCATION from a macro to an inline function. Marked
+        the structure-creating functions inline. Changed the VarStack to use
+        identifier pointers instead of actual identifiers. This takes
+        advantage of the fact that all identifier pointers come from the
+        arena and avoids reference count churn. Changed Identifier* to
+        const Identifier* to make sure we don't modify any by accident.
+        Used identifiers for regular expression strings too, using the new
+        scanRegExp that has out parameters instead of the old one that relied
+        on side effects in the Lexer. Move the creation of numeric identifiers
+        out of this file and into the PropertyNode constructor.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
+        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
+        and changed to call ParserArena.
+        (JSC::Lexer::scanRegExp): Added out arguments that are const Identifier*
+        as well as a prefix character argument so we can handle the /= case
+        without a string append.
+        (JSC::Lexer::skipRegExp): Added. Skips a regular expression without
+        allocating Identifier objects.
+        (JSC::Lexer::clear): Removed the code to manage m_identifiers, m_pattern,
+        and m_flags, and added code to set m_arena to 0.
+        * parser/Lexer.h: Updated for changes above.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
+        on the arena.
+        (JSC::ParserArenaDeletable::operator new): Changed to call the
+        allocateDeletable function on the arena instead of deleteWithArena.
+        (JSC::RegExpNode::RegExpNode): Changed arguments to Identifier instead
+        of UString since these come from the parser which makes identifiers.
+        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
+        numeric identifiers. Some day we might want to optimize this for
+        integers so it doesn't create a string for each one.
+        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
+        since it's now a const Identifier& so it can't be left uninitialized.
+        (JSC::BreakNode::BreakNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
+        to keep track of the statements rather than a separate statement vector.
+        (JSC::BlockNode::BlockNode): Ditto.
+        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.
+
+        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
+        It seemed strangely out of place in the header.
+        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
+        UString as well as Identifier.
+        (JSC::SourceElements::singleStatement): Added.
+        (JSC::SourceElements::lastStatement): Added.
+        (JSC::RegExpNode::emitBytecode): Updated since the pattern and flags
+        are now Identifier instead of UString. Also changed the throwError code
+        to use the substitution mechanism instead of doing a string append.
+        (JSC::SourceElements::emitBytecode): Added. Replaces the old
+        statementListEmitCode function, since we now keep the SourceElements
+        objects around.
+        (JSC::BlockNode::lastStatement): Added.
+        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
+        statementListEmitCode.
+        (JSC::CaseClauseNode::emitBytecode): Added.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
+        instead of statementListEmitCode.
+        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
+        SourceElements* instead of using releaseContentsIntoVector.
+        (JSC::ScopeNode::emitStatementsBytecode): Added.
+        (JSC::ScopeNode::singleStatement): Added.
+        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
+        of statementListEmitCode.
+        (JSC::EvalNode::emitBytecode): Ditto.
+        (JSC::EvalNode::generateBytecode): Removed code to clear the children
+        vector. This optimization is no longer possible since everything is in
+        a single arena.
+        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
+        insetad of statementListEmitCode and check for the return node using
+        the new functions.
+
+        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
+        of Identifier and rely on the arena to control lifetime. Added a new
+        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
+        FastAllocBase instead of having its own operator new. Base the Node
+        class on ParserArenaFreeable. Changed the various Node classes
+        to use const Identifier& instead of Identifier to avoid the need to
+        call their destructors and allow them to function as "freeable" in the
+        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
+        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
+        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
+        as a base class since they do not descend from Node. Eliminated the
+        StatementVector type and instead have various classes use SourceElements*
+        instead of StatementVector. This prevents those classes from having th
+        use ParserArenaDeletable to make sure the vector destructor is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Pass the arena to the lexer.
+
+        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
+        included by Nodes.h.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
+        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
+        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
+        since we store only the current pointer and the end of pool pointer.
+        (JSC::ParserArena::deallocateObjects): Added. Contains the common
+        memory-deallocation logic used by both the destructor and the
+        reset function.
+        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
+        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
+        new structures, and switched to use clear() instead of shrink(0) since
+        we don't really reuse arenas.
+        (JSC::ParserArena::makeNumericIdentifier): Added.
+        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
+        is empty.
+        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
+        since this is used only for assertions at the moment.
+
+        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
+        ones that don't need destructors to be called. Also added the segmented
+        vector of identifiers that used to be in the Lexer.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Use singleStatement function rather than
+        getting at a StatementVector.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Call isHostFunction on the body
+        rather than the function object.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Moved the structure version of this in
+        here from the header. It's not hot enough that it needs to be inlined.
+        (JSC::JSFunction::isHostFunction): Moved this in here from the header.
+        It's now a helper to be used only within the class.
+        (JSC::JSFunction::setBody): Moved this in here. It's not hot enough that
+        it needs to be inlined, and we want to be able to compile the header
+        without the definition of FunctionBodyNode.
+
+        * runtime/JSFunction.h: Eliminated the include of "Nodes.h". This was
+        exposing too much JavaScriptCore dependency to WebCore. Because of this
+        change and some changes made to WebCore, we could now export a lot fewer
+        headers from JavaScriptCore, but I have not done that yet in this check-in.
+        Made a couple functions non-inline. Removes some isHostFunction() assertions.
+        
+        * wtf/FastAllocBase.h: Added the conventional using statements we use in
+        WTF so we can use identifiers from the WTF namespace without explicit
+        namespace qualification or namespace directive. This is the usual WTF style,
+        although it's unconventional in the C++ world. We use the namespace primarily
+        for link-time disambiguation, not compile-time.
+
+        * wtf/FastMalloc.cpp: Fixed an incorrect comment.
+
+2009-05-13  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix: add JITStubCall.h to files list.
+
+        * GNUmakefile.am:
+
+2009-05-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed build fix, as suggested by Yael Aharon <yael.aharon@nokia.com>.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion): renamed IsValid to isValid.
+
+2009-05-13  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Revert r43562 - [Gtk] WTF_USE_JSC is already defined in
+        WebCore/config.h.
+
+        * wtf/Platform.h:
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add SamplingCounter tool to provide a simple mechanism for counting events in JSC
+        (enabled using ENABLE(SAMPLING_COUNTERS)).  To count events within a single function
+        use the class 'SamplingCounter', where the counter may be incremented from multiple
+        functions 'GlobalSamplingCounter' may be convenient; all other counters (stack or
+        heap allocated, rather than statically declared) should use the DeletableSamplingCounter.
+        Further description of these classes is provided alongside their definition in 
+        SamplingTool.h.
+
+        Counters may be incremented from c++ by calling the 'count()' method on the counter,
+        or may be incremented by JIT code by using the 'emitCount()' method within the JIT.
+
+        This patch also fixes CODEBLOCK_SAMPLING, which was missing a null pointer check.
+
+        * JavaScriptCore.exp:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::addWithCarry32):
+        (JSC::MacroAssemblerX86::and32):
+        (JSC::MacroAssemblerX86::or32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::or32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::and32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::adcl_im):
+        (JSC::X86Assembler::addq_im):
+        (JSC::X86Assembler::andl_im):
+        (JSC::X86Assembler::orl_im):
+        * bytecode/SamplingTool.cpp:
+        (JSC::AbstractSamplingCounter::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::AbstractSamplingCounter::count):
+        (JSC::GlobalSamplingCounter::name):
+        (JSC::SamplingCounter::SamplingCounter):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+        (JSC::JIT::emitCount):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * wtf/Platform.h:
+
+2009-05-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6881457> Crash occurs at JSC::Interpreter::execute() when loading http://www.sears.com
+
+        We created the arguments objects before an op_push_scope but not
+        before op_push_new_scope, this meant a null arguments object could
+        be resolved inside catch blocks.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushNewScope):
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6879881> Crash occurs at JSC::JSActivation::mark() when loading http://www.monster.com; http://www.cnet.com
+        <https://bugs.webkit.org/show_bug.cgi?id=25736> Crash loading www.google.dk/ig (and other igoogle's as well)
+
+        Following on from the lazy arguments creation patch, it's now
+        possible for an activation to to have a null register in the callframe
+        so we can't just blindly mark the local registers in an activation,
+        and must null check first instead.
+
+        * API/tests/testapi.c:
+        (functionGC):
+        * API/tests/testapi.js:
+        (bludgeonArguments.return.g):
+        (bludgeonArguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        WTF_USE_CTI_REPATCH_PIC is no longer used, remove.
+
+        * jit/JIT.h:
+        * jit/JITStubCall.h:
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        We've run into some problems where changing the size of the class JIT leads to
+        performance fluctuations.  Try forcing alignment in an attempt to stabalize this.
+
+        * jit/JIT.h:
+
+2009-05-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add ParserArena.cpp to the build.
+
+        * JavaScriptCoreSources.bkl:
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Unsigned underflow on 64bit cannot be treated as a negative number
+
+        This code included some placeswhere we deliberately create negative offsets
+        from unsigned values, on 32bit this is "safe", but in 64bit builds much
+        badness occurs. Solution is to use signed types as nature intended.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs):
+
+2009-05-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Define WTF_USE_JSC for the Gtk port.
+
+        * wtf/Platform.h:
+
+2009-05-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - allow all of strictEqual to be inlined into cti_op_stricteq once again
+        
+        We had this optimization once but accidentally lost it at some point.
+
+        * runtime/Operations.h:
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        instanceof should throw if the constructor being tested does not implement
+        'HasInstance" (i.e. is a function).  Instead we were returning false.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::isInvalidParamForIn):
+        (JSC::isInvalidParamForInstanceOf):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_instanceof):
+        * tests/mozilla/ecma_2/instanceof/instanceof-003.js:
+            Fix broken test case.
+        * tests/mozilla/ecma_2/instanceof/regress-7635.js:
+            Remove broken test case (was an exact duplicate of a test in instanceof-003.js).
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve function call forwarding performance
+
+        Make creation of the Arguments object occur lazily, so it
+        is not necessarily created for every function that references
+        it.  Then add logic to Function.apply to allow it to avoid
+        allocating the Arguments object at all.  Helps a lot with
+        the function forwarding/binding logic in jQuery, Prototype,
+        and numerous other JS libraries.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::willResolveToArguments):
+        (JSC::BytecodeGenerator::uncheckedRegisterForArguments):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitPushScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_init_arguments):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_load_varargs):
+        * parser/Nodes.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2009-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Enable use of SamplingFlags directly from JIT code.
+
+        * bytecode/SamplingTool.h:
+        * jit/JIT.h:
+        (JSC::JIT::sampleCodeBlock):
+        (JSC::JIT::sampleInstruction):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+
+2009-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Implement JIT generation for instanceof for non-objects (always returns false).
+        Also fixes the sequencing of the prototype and value isObject checks, to no match the spec.
+
+        0.5% progression on v8 tests overall, due to 3.5% on early-boyer.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        * runtime/TypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more JIT refactoring.
+        
+        Rearranged code to more clearly indicate what's conditionally compiled
+        and why. Now, all shared code is at the top of our JIT files, and all
+        #if'd code is at the bottom. #if'd code is delineated by large comments.
+        
+        Moved functions that relate to the JIT but don't explicitly do codegen
+        into JIT.cpp. Refactored SSE2 check to store its result as a data member
+        in the JIT.
+
+        * jit/JIT.cpp:
+        (JSC::isSSE2Present):
+        (JSC::JIT::JIT):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        (JSC::JIT::isSSE2Present):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        * JavaScriptCore.pri: Build the new JITOpcodes.cpp
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        More re-factoring of JIT code generation.  Use a macro to
+        forward the main switch-statement cases to the helper functions.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        More re-factoring of JIT code generation to move opcode generation
+        to helper functions outside the main switch-statement and gave those
+        helper functions standardized names. This patch covers the remaining
+        slow cases.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * GNUmakefile.am: Added JITOpcodes.cpp and JITStubCall.h to the project.
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        JITOpcodes.cpp and JITStubCall.h to the project.
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Some JIT refactoring.
+        
+        Moved JITStubCall* into its own header.
+        
+        Modified JITStubCall to ASSERT that its return value is handled correctly.
+        Also, replaced function template with explicit instantiations to resolve
+        some confusion.
+        
+        Replaced all uses of emit{Get,Put}CTIArgument with explicit peeks, pokes,
+        and calls to killLastResultRegister().
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITStubCall.h: Copied from jit/JIT.h.
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Start re-factoring JIT code generation to move opcode generation
+        to helper functions outside the main switch-statement and gave those
+        helper functions standardized names.  This patch only covers the main
+        pass and all the arithmetic opcodes in the slow path.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITOpcodes.cpp: Copied from jit/JIT.cpp.
+        * jit/JITPropertyAccess.cpp:
+
+2009-05-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Re-add experimental PGO configs.
+        
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "1" Garen.
+
+        Rip out the !USE(CTI_REPATCH_PIC) code.  It was untested and unused.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        GTK build fix - the deprecated waitForThreadCompletion is not needed on GTK.
+
+        * wtf/ThreadingPthreads.cpp: used #ifdef PLATFORM(DARWIN) around waitForThreadCompletion().
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        Build fix for newer versions of GCC
+
+        * wtf/ThreadingPthreads.cpp: Added a declaration of
+        waitForThreadCompletion before its definition to silence a warning.
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        * wtf/Threading.h:
+        (WTF::ThreadIdentifier::ThreadIdentifier):
+        (WTF::ThreadIdentifier::isValid):
+        (WTF::ThreadIdentifier::invalidate):
+        (WTF::ThreadIdentifier::platformId):
+        ThreadIdentifier is now a class, containing a PlatformThreadIdentifier and
+        methods that are used across the code on thread ids: construction, comparisons,
+        check for 'valid' state etc. '0' is used as invalid id, which happens to just work
+        with all platform-specific thread id implementations.
+
+        All the following files repeatedly reflect the new ThreadIdentifier for each platform.
+        We remove ThreadMap and threadMapMutex from all of them, remove the functions that
+        populated/searched/cleared the map and add platform-specific comparison operators
+        for ThreadIdentifier.
+
+        There are specific temporary workarounds for Safari 4 beta on OSX and Win32 since the
+        public build uses WTF threading functions with old type of ThreadingIdentifier.
+        The next time Safari 4 is rebuilt, it will 'automatically' pick up the new type and new
+        functions so the deprecated ones can be removed.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::waitForThreadCompletion): This is a workaround for Safari 4 beta on Mac.
+        Safari 4 is linked against old definition of ThreadIdentifier so it treats it as uint32_t.
+        This 'old' variant of waitForThreadCompletion takes uint32_t and has the old decorated name, so Safari can
+        load it from JavaScriptCore library. The other functions (CurrentThread() etc) happen to match their previous
+        decorated names and, while they return pthread_t now, it is a pointer which round-trips through a uint32_t.
+        This function will be removed as soon as Safari 4 will release next public build.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal): All the platforms (except Windows) used a sequential
+        counter as a thread ID and mapped it into platform ID. Windows was using native thread
+        id and mapped it into thread handle. Since we can always obtain a thread handle
+        by thread id, createThread now closes the handle.
+        (WTF::waitForThreadCompletion): obtains another one using OpenThread(id) API. If can not obtain a handle,
+        it means the thread already exited.
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::detachThreadDeprecated): old function, renamed (for Win Safari 4 beta which uses it for now).
+        (WTF::waitForThreadCompletionDeprecated): same.
+        (WTF::currentThreadDeprecated): same.
+        (WTF::createThreadDeprecated): same.
+
+        * bytecode/SamplingTool.h:
+        * bytecode/SamplingTool.cpp: Use DEFINE_STATIC_LOCAL for a static ThreadIdentifier variable, to avoid static constructor.
+
+        * JavaScriptCore.exp: export lists - updated decorated names of the WTF threading functions
+        since they now take a different type as a parameter.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: ditto for Windows, plus added "deprecated" functions
+        that take old parameter type - turns out public beta of Safari 4 uses those, so they need to be kept along for a while.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: ditto.
+
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
+        https://bugs.webkit.org/show_bug.cgi?id=25560
+        rdar://problem/6861069
+
+        I missed this case back a year ago when I sped up handling
+        of JavaScript wrappers. Easy to fix.
+
+        * runtime/JSObject.h:
+        (JSC::JSValue::get): Return the prototype itself if the property name
+        is __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot): Ditto.
+
+2009-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename emitGetFromCallFrameHeader to emitGetFromCallFrameHeaderPtr
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix. Build ParserAreana.cpp for Qt
+
+        * JavaScriptCore.pri:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24536
+
+        Symbian compilers cannot resolve WTF::PassRefPtr<JSC::Profile>
+        unless Profile.h is included.
+
+        * profiler/ProfileGenerator.h:
+
+2009-05-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24284
+
+        * JavaScriptCore.pri: coding style modified
+        * jsc.pro: duplicated values removed from INCLUDEPATH, DEFINES
+
+2009-05-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by NOBODY (build fix).
+
+        Also add ParserArena, in addition to AllInOne, for release builds,
+        since adding it to AllInOne breaks Mac.
+
+        * GNUmakefile.am:
+
+2009-05-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Adding ParserArena to the autotools build.
+
+        * GNUmakefile.am:
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        More Windows build fixes after r43479
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Export ParserArena::reset.
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes after r43479
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        ParserArena to the project.
+
+        * parser/NodeConstructors.h: Added a missing include.
+        (JSC::ParserArenaDeletable::operator new): Marked these as inline.
+
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        - fixed REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=25680
+
+        Accound for the 64-bit instruction prefix when rewriting mov to lea on 64-bit.
+        
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Part two: Remove reference counting from most nodes.
+
+        * JavaScriptCore.exp: Updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added ParserArena.h and .cpp.
+
+        * parser/Grammar.y: Replaced uses of ParserRefCountedData with uses of
+        ParserArenaData. Took out now-nonfunctional code that tries to manually
+        release declaration list. Changed the new calls that create FuncDeclNode
+        and FuncExprNode so that they use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaDeletable::operator new): Added.
+        (JSC::ParserArenaRefCounted::ParserArenaRefCounted): Added.
+        (JSC::Node::Node): Removed ParserRefCounted initializer.
+        (JSC::ElementNode::ElementNode): Ditto.
+        (JSC::PropertyNode::PropertyNode): Ditto.
+        (JSC::ArgumentsNode::ArgumentsNode): Ditto.
+        (JSC::SourceElements::SourceElements): Ditto.
+        (JSC::ParameterNode::ParameterNode): Ditto.
+        (JSC::FuncExprNode::FuncExprNode): Added ParserArenaRefCounted initializer.
+        (JSC::FuncDeclNode::FuncDeclNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Removed ParserRefCounted initializer.
+        (JSC::ClauseListNode::ClauseListNode): Ditto.
+        (JSC::CaseBlockNode::CaseBlockNode): Ditto.
+
+        * parser/NodeInfo.h: Replaced uses of ParserRefCountedData with uses of
+        ParserArenaData.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode): Added ParserArenaRefCounted initializer.
+        (JSC::ProgramNode::create): Use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom. Use the arena
+        contains function instead of the vecctor find function.
+        (JSC::EvalNode::create): Use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom. Use the arena
+        reset function instead of the vector shrink function.
+        (JSC::FunctionBodyNode::createNativeThunk): Use the proper version
+        of operator new for the reference-counted idiom, not the deletion idiom.
+        (JSC::FunctionBodyNode::create): More of the same.
+
+        * parser/Nodes.h: Added ParserArenaDeletable and ParserArenaRefCounted
+        to replace ParserRefCounted. Fixed inheritance so only the classes that
+        need reference counting inherit from ParserArenaRefCounted.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Set m_sourceElements to 0 since it now starts
+        uninitialized. Just set it to 0 again in the failure case, since it's
+        now just a raw pointer, not an owning one.
+        (JSC::Parser::reparseInPlace): Removed now-unneeded get() function.
+        (JSC::Parser::didFinishParsing): Replaced uses of ParserRefCountedData
+        with uses of ParserArenaData.
+
+        * parser/Parser.h: Less RefPtr, more arena.
+
+        * parser/ParserArena.cpp: Added.
+        * parser/ParserArena.h: Added.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Removed arena-related code, since it's
+        now in the Parser.
+        (JSC::JSGlobalData::createLeaked): Removed unneeded #ifndef.
+        (JSC::JSGlobalData::createNativeThunk): Tweaked #if a bit.
+
+        * runtime/JSGlobalData.h: Removed parserArena, which is now in Parser.
+
+        * wtf/RefCounted.h: Added deletionHasBegun function, for use in
+        assertions to catch deletion not done by the deref function.
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2: Try to fix the Windows build by adding a symbol which is really just a re-mangling of a changed method signature
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Try to fix the Windows build by removing an unknown symbol
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Touch Nodes.cpp to try to fix Windows build
+
+        * parser/Nodes.cpp: Removed whitespace.
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Quick fix for failures seen on buildbot. Maciej plans a better fix later.
+
+        * wtf/dtoa.cpp: Change the hardcoded number of 32-bit words in a BigInt
+        from 32 to 64. Parsing "1e500", for example, requires more than 32 words.
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        Part one: Change lifetimes so we won't have to use reference
+        counting so much, but don't eliminate the reference counts
+        entirely yet.
+
+        * JavaScriptCore.exp: Updated.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Update for use of raw pointers
+        instead of RefPtr.
+        (JSC::BytecodeGenerator::emitCall): Ditto.
+        (JSC::BytecodeGenerator::emitConstruct): Ditto.
+
+        * parser/Grammar.y: Update node creating code to use new (JSGlobalData*)
+        instead of the plain new. At the moment this is just a hook for future
+        arena allocation; it's inline and JSGlobalData* is not used.
+
+        * parser/NodeConstructors.h: Updated for name change of parserObjects to
+        parserArena. Also added explicit initialization for raw pointers that used
+        to be RefPtr. Also removed some uses of get() that aren't needed now that
+        the pointers are raw pointers. Also eliminated m_parameter from FuncExprNode
+        and FuncDeclNode. Also changed node-creating code to use new (JSGlobalData*)
+        as above.
+
+        * parser/Nodes.cpp: Eliminated NodeReleaser and all use of it.
+        (JSC::ParserRefCounted::ParserRefCounted): Updated for name change of
+        parserObjects to parserArena.
+        (JSC::SourceElements::append): Use raw pointers.
+        (JSC::ArrayNode::emitBytecode): Ditto.
+        (JSC::ArrayNode::isSimpleArray): Ditto.
+        (JSC::ArrayNode::toArgumentList): Ditto.
+        (JSC::ObjectLiteralNode::emitBytecode): Ditto.
+        (JSC::PropertyListNode::emitBytecode): Ditto.
+        (JSC::BracketAccessorNode::emitBytecode): Ditto.
+        (JSC::DotAccessorNode::emitBytecode): Ditto.
+        (JSC::ArgumentListNode::emitBytecode): Ditto.
+        (JSC::NewExprNode::emitBytecode): Ditto.
+        (JSC::EvalFunctionCallNode::emitBytecode): Ditto.
+        (JSC::FunctionCallValueNode::emitBytecode): Ditto.
+        (JSC::FunctionCallResolveNode::emitBytecode): Ditto.
+        (JSC::FunctionCallBracketNode::emitBytecode): Ditto.
+        (JSC::FunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::CallFunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::ApplyFunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::PostfixBracketNode::emitBytecode): Ditto.
+        (JSC::PostfixDotNode::emitBytecode): Ditto.
+        (JSC::DeleteBracketNode::emitBytecode): Ditto.
+        (JSC::DeleteDotNode::emitBytecode): Ditto.
+        (JSC::DeleteValueNode::emitBytecode): Ditto.
+        (JSC::VoidNode::emitBytecode): Ditto.
+        (JSC::TypeOfValueNode::emitBytecode): Ditto.
+        (JSC::PrefixBracketNode::emitBytecode): Ditto.
+        (JSC::PrefixDotNode::emitBytecode): Ditto.
+        (JSC::UnaryOpNode::emitBytecode): Ditto.
+        (JSC::BinaryOpNode::emitStrcat): Ditto.
+        (JSC::BinaryOpNode::emitBytecode): Ditto.
+        (JSC::EqualNode::emitBytecode): Ditto.
+        (JSC::StrictEqualNode::emitBytecode): Ditto.
+        (JSC::ReverseBinaryOpNode::emitBytecode): Ditto.
+        (JSC::ThrowableBinaryOpNode::emitBytecode): Ditto.
+        (JSC::InstanceOfNode::emitBytecode): Ditto.
+        (JSC::LogicalOpNode::emitBytecode): Ditto.
+        (JSC::ConditionalNode::emitBytecode): Ditto.
+        (JSC::ReadModifyResolveNode::emitBytecode): Ditto.
+        (JSC::AssignResolveNode::emitBytecode): Ditto.
+        (JSC::AssignDotNode::emitBytecode): Ditto.
+        (JSC::ReadModifyDotNode::emitBytecode): Ditto.
+        (JSC::AssignBracketNode::emitBytecode): Ditto.
+        (JSC::ReadModifyBracketNode::emitBytecode): Ditto.
+        (JSC::CommaNode::emitBytecode): Ditto.
+        (JSC::ConstDeclNode::emitCodeSingle): Ditto.
+        (JSC::ConstDeclNode::emitBytecode): Ditto.
+        (JSC::ConstStatementNode::emitBytecode): Ditto.
+        (JSC::statementListEmitCode): Ditto.
+        (JSC::BlockNode::emitBytecode): Ditto.
+        (JSC::ExprStatementNode::emitBytecode): Ditto.
+        (JSC::VarStatementNode::emitBytecode): Ditto.
+        (JSC::IfNode::emitBytecode): Ditto.
+        (JSC::IfElseNode::emitBytecode): Ditto.
+        (JSC::DoWhileNode::emitBytecode): Ditto.
+        (JSC::WhileNode::emitBytecode): Ditto.
+        (JSC::ForNode::emitBytecode): Ditto.
+        (JSC::ForInNode::emitBytecode): Ditto.
+        (JSC::ReturnNode::emitBytecode): Ditto.
+        (JSC::WithNode::emitBytecode): Ditto.
+        (JSC::CaseBlockNode::tryOptimizedSwitch): Ditto.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Ditto.
+        (JSC::SwitchNode::emitBytecode): Ditto.
+        (JSC::LabelNode::emitBytecode): Ditto.
+        (JSC::ThrowNode::emitBytecode): Ditto.
+        (JSC::TryNode::emitBytecode): Ditto.
+        (JSC::ScopeNodeData::ScopeNodeData): Use swap to transfer ownership
+        of the arena, varStack and functionStack.
+        (JSC::ScopeNode::ScopeNode): Pass in the arena when creating the
+        ScopeNodeData.
+        (JSC::ProgramNode::ProgramNode): Made this inline since it's used
+        in only one place.
+        (JSC::ProgramNode::create): Changed this to return a PassRefPtr since
+        we plan to have the scope nodes be outside the arena, so they will need
+        some kind of ownership transfer (maybe auto_ptr instead of PassRefPtr
+        in the future, though). Remove the node from the newly-created arena to
+        avoid a circular reference. Later we'll keep the node out of the arena
+        by using a different operator new, but for now it's the ParserRefCounted
+        constructor that puts the node into the arena, and there's no way to
+        bypass that.
+        (JSC::EvalNode::EvalNode): Ditto.
+        (JSC::EvalNode::create): Ditto.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Ditto.
+        (JSC::FunctionBodyNode::createNativeThunk): Moved the code that
+        reseets the arena here instead of the caller.
+        (JSC::FunctionBodyNode::create): Same change as the other create
+        functions above.
+        (JSC::FunctionBodyNode::emitBytecode): Use raw pointers.
+
+        * parser/Nodes.h: Removed NodeReleaser. Changed FunctionStack to
+        use raw pointers. Removed the releaseNodes function. Added an override
+        of operator new that takes a JSGlobalData* to prepare for future arena use.
+        Use raw pointers instead of RefPtr everywhere possible.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Pass the arena in.
+
+        * parser/Parser.h:
+        (JSC::Parser::parse): Updated for name change of parserObjects to parserArena.
+        (JSC::Parser::reparse): Ditto.
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Ditto.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Ditto.
+        (JSC::JSGlobalData::createNativeThunk): Moved arena manipulation into the
+        FunctionBodyNode::createNativeThunk function.
+
+        * runtime/JSGlobalData.h: Tweaked formatting and renamed parserObjects to
+        parserArena.
+
+        * wtf/NotFound.h: Added the usual "using WTF" to this header to match the
+        rest of WTF.
+
+2009-05-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25670
+        Remove no longer valid chunk of code from dtoa.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Removed invalid code.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        "Class const *" is the same as "const Class*", use the latter syntax consistently.
+
+        See <http://www.parashift.com/c++-faq-lite/const-correctness.html#faq-18.9>.
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLength):
+        * runtime/JSObject.h:
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        - speedup dtoa/strtod
+        
+        Added a bunch of inlining, and replaced malloc with stack allocation.
+        
+        0.5% SunSpider speedup (7% on string-tagcloud).
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToExponential):
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::from):
+        * wtf/dtoa.cpp:
+        (WTF::BigInt::BigInt):
+        (WTF::BigInt::operator=):
+        (WTF::Balloc):
+        (WTF::Bfree):
+        (WTF::multadd):
+        (WTF::s2b):
+        (WTF::i2b):
+        (WTF::mult):
+        (WTF::pow5mult):
+        (WTF::lshift):
+        (WTF::cmp):
+        (WTF::diff):
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::ratio):
+        (WTF::strtod):
+        (WTF::quorem):
+        (WTF::freedtoa):
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+
+2009-05-09  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Geoffrey Garen. Landed by Jan Alonzo.
+
+        Enable JIT on x86-64 gtk+
+        https://bugs.webkit.org/show_bug.cgi?id=24724
+
+        * GNUmakefile.am:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Removed the last non-call-related manually managed JIT stub call.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_rshift): Fully use the JITStubCall
+        abstraction, instead of emitPutJITStubArg.
+
+2009-05-09  Sebastian Andrzej Siewior  <sebastian@breakpoint.cc>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25653
+        PLATFORM(X86_64) inherits ia64
+
+        __ia64__ is defined by gcc in an IA64 arch and has completely
+        nothing in common with X86-64 exept both are from Intel and have
+        an 64bit address space. That's it. Since code seems to expect x86
+        here, ia64 has to go.
+
+        * wtf/Platform.h:
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Suggested by Geoffrey Garen.
+
+        Assume SSE2 is present on X86-64 and on MAC X86-32. This fixes a
+        build breakage on non-Mac X86-64 when JIT is enabled.
+
+        * jit/JITArithmetic.cpp:
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fix, adding missing files to make dist.
+
+        * GNUmakefile.am:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchLoadToLEA):
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchLoadToLEA):
+
+2009-05-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Original patch by John McCall. Updated by Cameron Zwarich. Further refined by me.
+        
+        - Assorted speedups to property access
+        
+        ~.3%-1% speedup on SunSpider
+        
+        1) When we know from the structure ID that an object is using inline storage, plant direct
+        loads and stores against it; no need to indirect through storage pointer.
+        
+        2) Also because of the above, union the property storage pointer with the first inline property
+        slot and add an extra inline property slot.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::patchLoadToLEA):
+        (JSC::::CodeLocationCommon::instructionAtOffset):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::store32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_EAXm):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::patchLoadToLEA):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getOffset):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::~JSObject):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/Structure.h:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all our JIT stubs so that they return a maximum of 1 JS value or
+        two non-JS pointers, and do all other value returning through out
+        parameters, in preparation for 64bit JS values on a 32bit system.
+
+        Stubs that used to return two JSValues now return one JSValue and take
+        and out parameter specifying where in the register array the second
+        value should go.
+        
+        SunSpider reports no change.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_post_dec):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6634956> CrashTracer: [REGRESSION] >400 crashes
+        in Safari at com.apple.JavaScriptCore • JSC::BytecodeGenerator::emitComplexJumpScopes + 468
+        https://bugs.webkit.org/show_bug.cgi?id=25658
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexJumpScopes): Guard the whole loop
+        with a bounds check. The old loop logic would decrement and read topScope
+        without a bounds check, which could cause crashes on page boundaries.
+
+2009-05-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by NOBODY (BuildFix).
+
+        Gtk fix: add LiteralParser to the build script per r43424.
+
+        Add LiteralParser to the Qt and Wx build scripts too.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCoreSources.bkl:
+
+2009-05-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough and Darin Adler.
+
+        Add a limited literal parser for eval to handle object and array literals fired at eval
+
+        This is a simplified parser and lexer that we can throw at strings passed to eval
+        in case a site is using eval to parse JSON (eg. json2.js).  The lexer is intentionally
+        limited (in effect it's whitelisting a limited "common" subset of the JSON grammar)
+        as this decreases the likelihood of us wating time attempting to parse any significant
+        amount of non-JSON content.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/LiteralParser.cpp: Added.
+        (JSC::isStringCharacter):
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parseStatement):
+        (JSC::LiteralParser::parseExpression):
+        (JSC::LiteralParser::parseArray):
+        (JSC::LiteralParser::parseObject):
+        (JSC::LiteralParser::StackGuard::StackGuard):
+        (JSC::LiteralParser::StackGuard::~StackGuard):
+        (JSC::LiteralParser::StackGuard::isSafe):
+        * runtime/LiteralParser.h: Added.
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::attemptJSONParse):
+        (JSC::LiteralParser::):
+        (JSC::LiteralParser::Lexer::Lexer):
+        (JSC::LiteralParser::Lexer::next):
+        (JSC::LiteralParser::Lexer::currentToken):
+        (JSC::LiteralParser::abortParse):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Restored a Mozilla JS test I accidentally gutted.
+
+        * tests/mozilla/ecma/Array/15.4.4.2.js:
+        (getTestCases):
+        (test):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        More abstraction for JITStub calls from JITed code.
+        
+        Added a JITStubCall class that automatically handles things like assigning
+        arguments to different stack slots and storing return values. Deployed
+        the class in about a billion places. A bunch more places remain to be
+        fixed up, but this is a good stopping point for now.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::JSRInfo::JSRInfo):
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+
+2009-05-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a new opcode jnlesseq, and optimize its compilation in the JIT using
+        techniques similar to what were used to optimize jnless in r43363.
+
+        This gives a 0.7% speedup on SunSpider, particularly on the tests 3d-cube,
+        control-flow-recursive, date-format-xparb, and string-base64.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Add support for dumping op_jnlesseq.
+        * bytecode/Opcode.h: Add op_jnlesseq to the list of opcodes.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add a peephole optimization
+        for op_jnlesseq when emitting lesseq followed by a jump.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Add case for op_jnlesseq.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Add case for op_jnlesseq.
+        (JSC::JIT::privateCompileSlowCases): Add case for op_jnlesseq.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_jnlesseq): Added.
+        (JSC::JIT::compileFastArithSlow_op_jnlesseq): Added.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_jlesseq): Added.
+        * jit/JITStubs.h:
+
+2009-05-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix test failures on 64-bit
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless): Avoid accidentaly treating an
+        immediate int as an immediate float in the 64-bit value representation.
+
+2009-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Removing an empty constructor and an uncalled, empty function seems to be a
+        pretty solid 1% regeression on my machine, so I'm going to put them back.
+        Um.  Yeah, this this pretty pointles and makes no sense at all.  I officially
+        lose the will to live in 3... 2...
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::~SamplingTool):
+
+2009-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "I see lots of ifdefs" Hunt.
+
+        Fix (kinda) for sampling tool breakage.  The codeblock sampling tool has become
+        b0rked due to recent changes in native function calling.  The initialization of
+        a ScopeNode appears to now occur before the sampling tool (or possibly the
+        interpreter has been brought into existence, wihich leads to crashyness).
+
+        This patch doesn't fix the problem.  The crash occurs when tracking a Scope, but
+        we shouldn't need to track scopes when we're just sampling opcodes, not
+        codeblocks.  Not retaining Scopes when just opcode sampling will reduce sampling
+        overhead reducing any instrumentation skew, which is a good thing.  As a side
+        benefit this patch also gets the opcode sampling going again, albeit in a bit of
+        a lame way.  Will come back later with a proper fix from codeblock sampling. 
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.cpp:
+        (JSC::compareLineCountInfoSampling):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+
+2009-05-07  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25640>.
+        Bug 25640: Crash on quit in r43384 nightly build on Leopard w/ Safari 4 beta installed
+        
+        Roll out r43366 as it removed symbols that Safari 4 Beta uses.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::ref):
+        (WTF::::deref):
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::clearPthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::clearThreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::threadForIdentifier):
+        (WTF::clearThreadForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+2009-05-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Suggested by Oliver Hunt.
+
+        Also check for Linux for the special-cased calling convention.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * wtf/Platform.h:
+
+2009-05-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Previously, when appending to an existing string and growing the underlying buffer,
+        we would actually allocate 110% of the required size in order to give us some space
+        to expand into.  Now we treat strings differently based on their size:
+
+        Small Strings (up to 4 pages):
+        Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
+        to our previous policy, however 112.5% is cheaper to calculate.
+
+        Medium Strings (up to 128 pages):
+        For pages covering multiple pages over-allocation is less of a concern - any unused
+        space will not be paged in if it is not used, so this is purely a VM overhead.  For
+        these strings allocate 2x the requested size.
+
+        Large Strings (to infinity and beyond!):
+        Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
+        any individual string be responsible for.
+
+        Additionally, round small allocations up to a multiple of 16 bytes, and medium and
+        large allocations up to a multiple of page size.
+
+        ~1.5% progression on Sunspider, due to 5% improvement on tagcloud & 15% on validate.
+
+        * runtime/UString.cpp:
+        (JSC::expandedSize):
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNativeThunk): Missed a spot in my last patch.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        * wtf/Platform.h: Reverted an accidental (and performance-catastrophic)
+        change.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Missed a spot in my last patch.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        (JSC::Parser::reparse): Shrink the parsedObjects vector after allocating
+        the root node, to avoid leaving a stray node in the vector, since that's
+        a slight memory leak, and it causes problems during JSGlobalData teardown.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): ASSERT that we're not being torn
+        down while we think we're still parsing, since that would cause lots of
+        bad memory references during our destruction.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Replaced two more macros with references to the JITStackFrame structure.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve native call performance
+
+        Fix the windows build by adding calling convention declarations everywhere,
+        chose fastcall as that seemed most sensible given we were having to declare
+        the convention explicitly.  In addition switched to fastcall on mac in the
+        deluded belief that documented fastcall behavior on windows would match 
+        actual its actual behavior.
+
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::argumentCount):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+        (functionReadline):
+        (functionQuit):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::setScopeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NativeFunctionWrapper.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpObject.cpp:
+        (JSC::callRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * wtf/Platform.h:
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Rolled out a portion of r43352 because it broke 64bit.
+
+        * jit/JITStubs.h:
+
+2009-05-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for functions reaturning ThreadIdentifier.
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+
+2009-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John Honeycutt.
+        
+        - enable optimization case im the last patch that I accidentally had disabled.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Attempt to fix Win build.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        * wtf/Threading.h:
+        (WTF::ThreadIdentifier::ThreadIdentifier):
+        (WTF::ThreadIdentifier::isValid):
+        (WTF::ThreadIdentifier::invalidate):
+        (WTF::ThreadIdentifier::platformId):
+        ThreadIdentifier is now a class, containing a PlatformThreadIdentifier and
+        methods that are used across the code on thread ids: construction, comparisons,
+        check for 'valid' state etc. '0' is used as invalid id, which happens to just work
+        with all platform-specific thread id implementations.
+
+        All the following files repeatedly reflect the new ThreadIdentifier for each platform.
+        We remove ThreadMap and threadMapMutex from all of them, remove the functions that
+        populated/searched/cleared the map and add platform-specific comparison operators
+        for ThreadIdentifier.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal): All the platforms (except Windows) used a sequential
+        counter as a thread ID and mapped it into platform ID. Windows was using native thread
+        id and mapped it into thread handle. Since we can always obtain a thread handle
+        by thread id, createThread now closes the handle.
+        (WTF::waitForThreadCompletion): obtains another one using OpenThread(id) API. If can not obtain a handle,
+        it means the thread already exited.
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::detachThreadDeprecated): old function, renamed (for Win Safari 4 beta which uses it for now).
+        (WTF::waitForThreadCompletionDeprecated): same.
+        (WTF::currentThreadDeprecated): same.
+        (WTF::createThreadDeprecated): same.
+
+        * bytecode/SamplingTool.h:
+        * bytecode/SamplingTool.cpp: Use DEFINE_STATIC_LOCAL for a static ThreadIdentifier variable, to avoid static constructor.
+
+        * JavaScriptCore.exp: export lists - updated the WTF threading functions decorated names
+        since they now take a different type as a parameter.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: ditto for Windows, plus added "deprecated" functions
+        that take old parameter type - turns out public beta of Safari 4 uses those, so they need to be kept along for a while.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: ditto.
+
+2009-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - optimize various cases of branch-fused less
+        
+        1% speedup on SunSpider overall
+        13% speedup on math-cordic
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        op_loop_if_less: Optimize case of constant as first operand, just as case of constant as
+        second operand.
+        op_jnless: Factored out into compileFastArith_op_jnless.
+        (JSC::JIT::privateCompileSlowCases):
+        op_jnless: Factored out into compileFastArithSlow_op_jnless.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_jnless): Factored out from main compile loop.
+        - Generate inline code for comparison of constant immediate int as first operand to another
+        immediate int, as for loop_if_less
+
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+        - Generate inline code for comparing two floating point numbers.
+        - Generate code for both cases of comparing a floating point number to a constant immediate 
+        int.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Fix dumping of op_jnless (tangentially related bugfix).
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added the return address of a stub function to the JITStackFrame abstraction.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::StackHack::StackHack):
+        (JSC::StackHack::~StackHack):
+        (JSC::returnToThrowTrampoline):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex): Fix missing braces. This would make us always
+        take the slower case for string parsing and Visual Studio correctly
+        noticed unreachable code.
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25589: goto instead of state machine in lexer
+        https://bugs.webkit.org/show_bug.cgi?id=25589
+
+        SunSpider is 0.8% faster.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::currentCharacter): Added.
+        (JSC::Lexer::currentOffset): Changed to call currentCharacter for clarity.
+        (JSC::Lexer::setCode): Removed code to set now-obsolete m_skipLineEnd.
+        (JSC::Lexer::shiftLineTerminator): Added. Handles line numbers and the
+        two-character line terminators.
+        (JSC::Lexer::makeIdentifier): Changed to take characters and length rather
+        than a vector, since we now make these directly out of the source buffer
+        when possible.
+        (JSC::Lexer::lastTokenWasRestrKeyword): Added.
+        (JSC::isNonASCIIIdentStart): Broke out the non-inline part.
+        (JSC::isIdentStart): Moved here.
+        (JSC::isNonASCIIIdentPart): Broke out the non-inline part.
+        (JSC::isIdentPart): Moved here.
+        (JSC::singleEscape): Moved here, and removed some unneeded cases.
+        (JSC::Lexer::record8): Moved here.
+        (JSC::Lexer::record16): Moved here.
+        (JSC::Lexer::lex): Rewrote this whole function to use goto and not use
+        a state machine. Got rid of most of the local variables. Also rolled the
+        matchPunctuator function in here.
+        (JSC::Lexer::scanRegExp): Changed to use the new version of isLineTerminator.
+        Clear m_buffer16 after using it instead of before.
+
+        * parser/Lexer.h: Removed State enum, setDone function, nextLine function,
+        lookupKeywordFunction, one of the isLineTerminator functions, m_done data member,
+        m_skipLineEnd data member, and m_state data member. Added shiftLineTerminator
+        function, currentCharacter function, and changed the arguments to the makeIdentifier
+        function. Removed one branch from the isLineTerminator function.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Streamlined the case where we don't replace anything.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Removed a few more special constants, and replaced them with uses of
+        the JITStackFrame struct.
+
+        Removed one of the two possible definitions of VoidPtrPair. The Mac
+        definition was more elegant, but SunSpider doesn't think it's any
+        faster, and it's net less elegant to have two ways of doing things.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode): Tweak formatting.
+
+2009-05-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the build thread stack base determination build on Symbian,
+        by moving the code block before PLATFORM(UNIX), which is also
+        enabled on Symbian builds.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix crash due to incorrectly using an invalid scopechain 
+
+        stringProtoFuncReplace was checking for an exception on a CachedCall
+        by asking for the cached callframes exception.  Unfortunately this
+        could crash in certain circumstances as CachedCall does not guarantee
+        a valid callframe following a call.  Even more unfortunately the check
+        was entirely unnecessary as there is only a single exception slot per
+        global data, so it was already checked via the initial exec->hadException()
+        check.
+
+        To make bugs like this more obvious, i've added a debug only destructor
+        to ScopeChainNode that 0's all of its fields.  This exposed a crash in
+        the standard javascriptcore tests.
+
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChain::~ScopeChain):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-05-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable op_strcat across += assignments.  This patch allows the lhs of a read/modify node
+        to be included within the concatenation operation, and also modifies the implementation
+        of the concatenation to attempt to reuse and cat onto the leftmost string, rather than
+        always allocating a new empty output string to copy into (as was previously the behaviour).
+
+        ~0.5% progression, due to a 3%-3.5% progression on the string tests (particularly validate).
+
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        * parser/Nodes.h:
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+        * runtime/UString.cpp:
+        (JSC::UString::reserveCapacity):
+        * runtime/UString.h:
+
+2009-05-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix the build on Windows without JIT: interpreter/RegisterFile.h needs
+        roundUpAllocationSize, which is protected by #if ENABLED(ASSEMBLER).
+        Moved the #ifdef down and always offer the function.
+
+        * jit/ExecutableAllocator.h:
+
+2009-05-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "++" Barraclough.
+        
+        Added some abstraction around the JIT stub calling convention by creating
+        a struct to represent the persistent stack frame JIT code shares with
+        JIT stubs.
+        
+        SunSpider reports no change.
+
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak & Darin Adler.
+
+        Improve string concatenation (as coded in JS as a sequence of adds).
+
+        Detect patterns corresponding to string concatenation, and change the bytecode
+        generation to emit a new op_strcat instruction.  By handling the full set of
+        additions within a single function we do not need allocate JSString wrappers
+        for intermediate results, and we can calculate the size of the output string
+        prior to allocating storage, in order to prevent reallocation of the buffer.
+
+        1.5%-2% progression on Sunspider, largely due to a 30% progression on date-format-xparb.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+            Add new opcodes.
+        * bytecode/Opcode.h:
+            Add new opcodes.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitStrcat):
+        (JSC::BytecodeGenerator::emitToPrimitive):
+            Add generation of new opcodes.
+        * bytecompiler/BytecodeGenerator.h:
+            Add generation of new opcodes.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            Add implmentation of new opcodes.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+            Add implmentation of new opcodes.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+            Add implmentation of new opcodes.
+        * jit/JITStubs.h:
+            Add implmentation of new opcodes.
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+            Add generation of new opcodes.
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::AddNode::):
+            Add methods to allow identification of add nodes.
+        * parser/ResultType.h:
+        (JSC::ResultType::definitelyIsString):
+        (JSC::ResultType::forAdd):
+            Fix error in detection of adds that will produce string results.
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+            Add implmentation of new opcodes.
+        * runtime/UString.cpp:
+        (JSC::UString::appendNumeric):
+            Add methods to append numbers to an existing string.
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        (JSC::UString::BaseString::BaseString):
+            Add support for creating an empty string with a non-zero capacity available in the BaseString.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Made RefCounted::m_refCount private.
+
+        * runtime/Structure.h: Removed addressOfCount.
+        * wtf/RefCounted.h: Made m_refCount private.
+        Added addressOfCount.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Fixed assertion seen a lot!
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::~FunctionBodyNode): Removed now-bogus assertion.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Working with Sam Weinig.
+
+        Redo parse tree constructor optimization without breaking the Windows
+        build the way I did yesterday. The previous try broke the build by adding
+        an include of Lexer.h and all its dependencies that had to work outside
+        the JavaScriptCore project.
+
+        * GNUmakefile.am: Added NodeConstructors.h.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Removed byteocde directory -- we no longer are trying to include Lexer.h
+        outside JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Change SegmentedVector.h
+        and Lexer.h back to internal files. Added NodeConstructors.h.
+
+        * parser/Grammar.y: Added include of NodeConstructors.h.
+        Changed use of ConstDeclNode to use public functions.
+
+        * parser/NodeConstructors.h: Copied from parser/Nodes.h.
+        Just contains the inlined constructors now.
+
+        * parser/Nodes.cpp: Added include of NodeConstructors.h.
+        Moved node constructors into the header.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Removed m_refCount
+        initialization.
+
+        * parser/Nodes.h: Removed all the constructor definitions, and also
+        removed the JSC_FAST_CALL from them since these are all inlined, so the
+        calling convention is irrelevant. Made more things private. Used a data
+        member for operator opcodes instead of a virtual function. Removed the
+        special FunctionBodyNode::ref/deref functions since the default functions
+        are now just as fast.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Fixed types here so we don't typecast until
+        after we do type checking.
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the Qt build on Windows.
+
+        * JavaScriptCore.pri: Define BUILDING_JavaScriptCore/WTF to get the meaning
+        of the JS_EXPORTDATA macros correct
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Enable the JIT for the Qt build on Windows.
+
+        * JavaScriptCore.pri:
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Tweak JavaScriptCore.pri for being able to override the generated sources dir for the
+        generated_files target.
+
+        * JavaScriptCore.pri:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $$GENERATED_SOURCES_DIR as output when running bison
+
+        A couple of the generators left the bison output file in the source
+        tree, and then moved it into $$GENERATED_SOURCES_DIR, which did not
+        work well when building release and debug configurations in parallel.
+
+        * JavaScriptCore.pri:
+
+2009-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Simplified a bit of codegen.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Moved all the JIT stub related code into one place.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+
+2009-05-05  Sam Weinig  <sam@webkit.org>
+
+        Try to fix Windows build.
+
+        Move Node constructor to the .cpp file.
+
+        * parser/Nodes.cpp: 
+        * parser/Nodes.h:
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+        Try to fix Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made SegmentedVector.h private.
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made Lexer.h private.
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25569: make ParserRefCounted use conventional reference counting
+        https://bugs.webkit.org/show_bug.cgi?id=25569
+
+        SunSpider speedup of about 1.6%.
+
+        * JavaScriptCore.exp: Updated.
+
+        * parser/Nodes.cpp:
+        (JSC::NodeReleaser::releaseAllNodes): ALWAYS_INLINE.
+        (JSC::NodeReleaser::adopt): Ditto.
+        (JSC::ParserRefCounted::ParserRefCounted): Removed most of the code.
+        Add the object to a Vector<RefPtr> that gets cleared after parsing.
+        (JSC::ParserRefCounted::~ParserRefCounted): Removed most of the code.
+
+        * parser/Nodes.h: Made ParserRefCounted inherit from RefCounted and
+        made inline versions of the constructor and destructor. Made the
+        Node constructor inline.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Call globalData->parserObjects.shrink(0) after
+        parsing, where it used to call ParserRefCounted::deleteNewObjects.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Eliminated code to manage the
+        newParserObjects and parserObjectExtraRefCounts.
+        (JSC::JSGlobalData::~JSGlobalData): Ditto.
+
+        * runtime/JSGlobalData.h: Replaced the HashSet and HashCountedSet
+        with a Vector.
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::~PassRefPtr): The most common thing to do with a
+        PassRefPtr in hot code is to pass it and then destroy it once it's
+        set to zero. Help the optimizer by telling it that's true.
+
+2009-05-05  Xan Lopez  <xlopez@igalia.com> and Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Disable the NativeFunctionWrapper for all non-Mac ports for now,
+        as it is also crashing on Linux/x86.
+
+        * runtime/NativeFunctionWrapper.h:
+
+2009-05-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose toThisObject for the DOM Window
+
+        * JavaScriptCore.exp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Make windows go again until i work out the
+        accursed calling convention).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * jit/JIT.cpp:
+        * runtime/NativeFunctionWrapper.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix windows debug builds).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Hopefully the last fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix the build fix caused by a different build fix).
+
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (No idea how my changes could have broken these).
+
+        * runtime/DatePrototype.cpp:
+        * runtime/RegExpObject.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Why should i expect msvc to list all the errors in a file?).
+
+        * parser/Nodes.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix warning, and another missing include).
+
+        * jit/JIT.cpp:
+        * parser/Nodes.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixes).
+
+        * runtime/ErrorPrototype.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/StringConstructor.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Will the fixes never end?).
+
+        * runtime/FunctionPrototype.h:
+        * runtime/Lookup.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixes).
+
+        * jit/JIT.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixing).
+
+        * runtime/CallData.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/Error.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Add missing file
+
+        * runtime/NativeFunctionWrapper.h: Copied from JavaScriptCore/jit/ExecutableAllocator.cpp.
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25559: Improve native function call performance
+        <https://bugs.webkit.org/show_bug.cgi?id=25559>
+
+        In order to cache calls to native functions we now make the standard
+        prototype functions use a small assembly thunk that converts the JS
+        calling convention into the native calling convention.  As this is
+        only beneficial in the JIT we use the NativeFunctionWrapper typedef
+        to alternate between PrototypeFunction and JSFunction to keep the
+        code sane.  This change from PrototypeFunction to NativeFunctionWrapper
+        is the bulk of this patch.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::call):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::leaq_mr):
+        (JSC::X86Assembler::call_m):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator bool):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::ctiNativeCallThunk):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateJITCode):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::):
+        (JSC::FunctionBodyNode::generatedJITCode):
+        (JSC::FunctionBodyNode::jitCode):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ArgList.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncToString):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::mark):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::setScope):
+        (JSC::JSFunction::scope):
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::scopeChain):
+        (JSC::JSFunction::clearScopeChain):
+        (JSC::JSFunction::setScopeChain):
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::setNativeFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::createNativeThunk):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::nativeFunctionThunk):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+
+2009-05-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        For convenience, let the sampling flags tool clear multiple flags at once.
+
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+
+2009-05-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Gavin.
+
+        - inline Vector::resize for a ~1.5% speedup on string-tagcloud
+
+        * wtf/Vector.h:
+        (WTF::Vector::resize): Inline
+
+2009-05-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+
+2009-05-03  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsAPIMangledNumber):
+        * runtime/JSNumberCell.h:
+
+2009-05-02  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in one last time (I hope).
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back out. It still breaks windows.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in.
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 25519: streamline lexer by handling BOMs differently
+        https://bugs.webkit.org/show_bug.cgi?id=25519
+
+        Roughly 1% faster SunSpider.
+
+        * parser/Grammar.y: Tweak formatting a bit.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Remove unnnecessary initialization of data members
+        that are set up by setCode.
+        (JSC::Lexer::currentOffset): Added. Used where the old code would look at
+        m_currentOffset.
+        (JSC::Lexer::shift1): Replaces the old shift function. No longer does anything
+        to handle BOM characters.
+        (JSC::Lexer::shift2): Ditto.
+        (JSC::Lexer::shift3): Ditto.
+        (JSC::Lexer::shift4): Ditto.
+        (JSC::Lexer::setCode): Updated for name change from yylineno to m_line.
+        Removed now-unused m_eatNextIdentifier, m_stackToken, and m_restrKeyword.
+        Replaced m_skipLF and m_skipCR with m_skipLineEnd. Replaced the old
+        m_length with m_codeEnd and m_currentOffset with m_codeStart. Added code
+        to scan for a BOM character and call copyCodeWithoutBOMs() if we find any.
+        (JSC::Lexer::copyCodeWithoutBOMs): Added.
+        (JSC::Lexer::nextLine): Updated for name change from yylineno to m_line.
+        (JSC::Lexer::makeIdentifier): Moved up higher in the file.
+        (JSC::Lexer::matchPunctuator): Moved up higher in the file and changed to
+        use a switch statement instead of just if statements.
+        (JSC::Lexer::isLineTerminator): Moved up higher in the file and changed to
+        have fewer branches.
+        (JSC::Lexer::lastTokenWasRestrKeyword): Added. This replaces the old
+        m_restrKeyword boolean.
+        (JSC::Lexer::isIdentStart): Moved up higher in the file. Changed to use
+        fewer branches in the ASCII but not identifier case.
+        (JSC::Lexer::isIdentPart): Ditto.
+        (JSC::Lexer::singleEscape): Moved up higher in the file.
+        (JSC::Lexer::convertOctal): Moved up higher in the file.
+        (JSC::Lexer::convertHex): Moved up higher in the file. Changed to use
+        toASCIIHexValue instead of rolling our own here.
+        (JSC::Lexer::convertUnicode): Ditto.
+        (JSC::Lexer::record8): Moved up higher in the file.
+        (JSC::Lexer::record16): Moved up higher in the file.
+        (JSC::Lexer::lex): Changed type of stringType to int. Replaced m_skipLF
+        and m_skipCR with m_skipLineEnd, which requires fewer branches in the
+        main lexer loop. Use currentOffset instead of m_currentOffset. Removed
+        unneeded m_stackToken. Use isASCIIDigit instead of isDecimalDigit.
+        Split out the two cases for InIdentifierOrKeyword and InIdentifier.
+        Added special case tight loops for identifiers and other simple states.
+        Removed a branch from the code that sets m_atLineStart to false using goto.
+        Streamlined the number-handling code so we don't check for the same types
+        twice for non-numeric cases and don't add a null to m_buffer8 when it's
+        not being used. Removed m_eatNextIdentifier, which wasn't working anyway,
+        and m_restrKeyword, which is redundant with m_lastToken. Set the
+        m_delimited flag without using a branch.
+        (JSC::Lexer::scanRegExp): Tweaked style a bit.
+        (JSC::Lexer::clear): Clear m_codeWithoutBOMs so we don't use memory after
+        parsing. Clear out UString objects in the more conventional way.
+        (JSC::Lexer::sourceCode): Made this no-longer inline since it has more
+        work to do in the case where we stripped BOMs.
+
+        * parser/Lexer.h: Renamed yylineno to m_lineNumber. Removed convertHex
+        function, which is the same as toASCIIHexValue. Removed isHexDigit
+        function, which is the same as isASCIIHedDigit. Replaced shift with four
+        separate shift functions. Removed isWhiteSpace function that passes
+        m_current, instead just passing m_current explicitly. Removed isOctalDigit,
+        which is the same as isASCIIOctalDigit. Eliminated unused arguments from
+        matchPunctuator. Added copyCoodeWithoutBOMs and currentOffset. Moved the
+        makeIdentifier function out of the header. Added lastTokenWasRestrKeyword
+        function. Added new constants for m_skipLineEnd. Removed unused yycolumn,
+        m_restrKeyword, m_skipLF, m_skipCR, m_eatNextIdentifier, m_stackToken,
+        m_position, m_length, m_currentOffset, m_nextOffset1, m_nextOffset2,
+        m_nextOffset3. Added m_skipLineEnd, m_codeStart, m_codeEnd, and
+        m_codeWithoutBOMs.
+
+        * parser/SourceProvider.h: Added hasBOMs function. In the future this can
+        be used to tell the lexer about strings known not to have BOMs.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncUnescape): Changed to use isASCIIHexDigit.
+
+        * wtf/ASCIICType.h: Added using statements to match the design of the
+        other WTF headers.
+
+2009-05-02  Ada Chan  <adachan@apple.com>
+
+        Fix windows build (when doing a clean build)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Simplified null-ish JSValues.
+        
+        Replaced calls to noValue() with calls to JSValue() (which is what
+        noValue() returned). Removed noValue().
+        
+        Replaced almost all uses of jsImpossibleValue() with uses of JSValue().
+        Its one remaining use is for construction of hash table deleted values.
+        For that specific task, I made a new, private constructor with a special
+        tag. Removed jsImpossibleValue().
+        
+        Removed "JSValue()" initialiazers, since default construction happens...
+        by default.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearException):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_vm_throw):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsNumberCell):
+        * runtime/JSObject.cpp:
+        (JSC::callDefaultValueFunction):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValueHashTraits::constructDeletedValue):
+        (JSC::JSValueHashTraits::isDeletedValue):
+        (JSC::JSValue::JSValue):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::clearBase):
+        (JSC::PropertySlot::clearValue):
+
+2009-05-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - speed up the lexer in various ways
+
+        ~2% command-line SunSpider speedup
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Moved below shift() so it can inline.
+        (JSC::Lexer::scanRegExp):  Use resize(0) instead of clear() on Vectors, since the intent
+        here is not to free the underlying buffer.
+        (JSC::Lexer::lex): ditto; also, change the loop logic a bit for the main lexing loop
+        to avoid branching on !m_done twice per iteration. Now we only check it once.
+        (JSC::Lexer::shift): Make this ALWAYS_INLINE and tag an unusual branch as UNLIKELY
+        * parser/Lexer.h:
+        (JSC::Lexer::makeIdentifier): force to be ALWAYS_INLINE
+        * wtf/Vector.h:
+        (WTF::::append): force to be ALWAYS_INLINE (may have helped in ways other than parsing but it wasn't
+        getting inlined in a hot code path in the lexer)
+
+2009-05-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix 64bit build.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Roll out JavaScriptCore API number marshaling.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSValue.h:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * JavaScriptCore.exp:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Too Far!" Garen.
+
+        Move JS number construction into JSValue.
+
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff "The Minneapolis" Garen.
+
+        Add mechanism to vend heap allocated JS numbers to JavaScriptCore API clients with a
+        representation that is independent of the number representation in the VM.
+        - Numbers leaving the interpreter are converted to a tagged JSNumberCell.
+        - The numbers coming into the interpreter (asserted to be the tagged JSNumberCell) are
+          converted back to the VM's internal number representation.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsAPIMangledNumber):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::isAPIMangledNumber):
+        (JSC::JSNumberCell::):
+        (JSC::JSNumberCell::JSNumberCell):
+        (JSC::JSValue::isAPIMangledNumber):
+        * runtime/JSValue.h:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 6.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 5.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 4.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 3.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+        
+        Renamed JSValuePtr => JSValue.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::put):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addUnexpectedConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/Debugger.h:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putWithAttributes):
+        (JSC::DebuggerActivation::lookupGetter):
+        (JSC::DebuggerActivation::lookupSetter):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::exception):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setException):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::exceptionSlot):
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setArgument):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::):
+        (JSC::JITCode::execute):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionSetSamplingFlag):
+        (functionClearSamplingFlag):
+        (functionReadline):
+        (functionQuit):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        * profiler/Profiler.h:
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::at):
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::asArguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.h:
+        (JSC::asBooleanObject):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        * runtime/Collector.h:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        (JSC::Completion::value):
+        (JSC::Completion::setValue):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::asDateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createError):
+        (JSC::createStackOverflowError):
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toPrimitive):
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::asInternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        (JSC::asActivation):
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::mark):
+        (JSC::compareNumbersForQSort):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::createStructure):
+        (JSC::asArray):
+        (JSC::isJSArray):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        (JSC::JSByteArray::put):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        (JSC::JSByteArray::setIndex):
+        (JSC::asByteArray):
+        (JSC::isJSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isString):
+        (JSC::JSValue::isGetterSetter):
+        (JSC::JSValue::isObject):
+        (JSC::JSValue::getString):
+        (JSC::JSValue::getObject):
+        (JSC::JSValue::getCallData):
+        (JSC::JSValue::getConstructData):
+        (JSC::JSValue::getUInt32):
+        (JSC::JSValue::getTruncatedInt32):
+        (JSC::JSValue::getTruncatedUInt32):
+        (JSC::JSValue::mark):
+        (JSC::JSValue::marked):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::toBoolean):
+        (JSC::JSValue::toNumber):
+        (JSC::JSValue::toString):
+        (JSC::JSValue::toObject):
+        (JSC::JSValue::toThisObject):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::JSValue::toThisString):
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        (JSC::asFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
+        (JSC::asGlobalObject):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::isValid):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isImmediate):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDoubleNumber):
+        (JSC::JSImmediate::isPositiveIntegerNumber):
+        (JSC::JSImmediate::isBoolean):
+        (JSC::JSImmediate::isUndefinedOrNull):
+        (JSC::JSImmediate::isEitherImmediate):
+        (JSC::JSImmediate::areBothImmediate):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeValue):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::makeUndefined):
+        (JSC::JSImmediate::makeNull):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::uintValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::rawValue):
+        (JSC::JSImmediate::trueImmediate):
+        (JSC::JSImmediate::falseImmediate):
+        (JSC::JSImmediate::undefinedImmediate):
+        (JSC::JSImmediate::nullImmediate):
+        (JSC::JSImmediate::zeroImmediate):
+        (JSC::JSImmediate::oneImmediate):
+        (JSC::JSImmediate::impossibleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32Fast):
+        (JSC::JSValue::getInt32Fast):
+        (JSC::JSValue::isUInt32Fast):
+        (JSC::JSValue::getUInt32Fast):
+        (JSC::JSValue::makeInt32Fast):
+        (JSC::JSValue::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::equal):
+        (JSC::JSFastMath::notEqual):
+        (JSC::JSFastMath::andImmediateNumbers):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::orImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        (JSC::JSFastMath::incImmediateNumber):
+        (JSC::JSFastMath::decImmediateNumber):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::put):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toPrimitive):
+        (JSC::JSNumberCell::getPrimitiveNumber):
+        (JSC::JSNumberCell::getJSNumber):
+        (JSC::jsNumberCell):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        (JSC::isNumberCell):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValue::isDoubleNumber):
+        (JSC::JSValue::getDoubleNumber):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::toJSNumber):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::numberToInt32):
+        (JSC::JSValue::numberToUInt32):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::createStructure):
+        (JSC::asObject):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSValue::isObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::get):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::toPrimitive):
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        (JSC::JSPropertyNameIterator::getPrimitiveNumber):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.cpp:
+        (JSC::JSString::toPrimitive):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        (JSC::asString):
+        (JSC::isJSString):
+        (JSC::JSValue::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toInteger):
+        (JSC::JSValue::toIntegerPreserveNaN):
+        * runtime/JSValue.h:
+        (JSC::JSValue::makeImmediate):
+        (JSC::JSValue::asValue):
+        (JSC::noValue):
+        (JSC::jsImpossibleValue):
+        (JSC::jsNull):
+        (JSC::jsUndefined):
+        (JSC::jsBoolean):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::callNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::getJSNumber):
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.cpp:
+        (JSC::JSValue::equalSlowCase):
+        (JSC::JSValue::strictEqualSlowCase):
+        (JSC::throwOutOfMemoryError):
+        (JSC::jsAddSlowCase):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/Operations.h:
+        (JSC::JSValue::equal):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::resolveBase):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::putValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::setBase):
+        (JSC::PropertySlot::):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        (JSC::ProtectedPtr::operator JSValue):
+        (JSC::ProtectedJSValue::ProtectedJSValue):
+        (JSC::ProtectedJSValue::get):
+        (JSC::ProtectedJSValue::operator JSValue):
+        (JSC::ProtectedJSValue::operator->):
+        (JSC::ProtectedJSValue::~ProtectedJSValue):
+        (JSC::ProtectedJSValue::operator=):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::RegExpConstructor::put):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        (JSC::asRegExpConstructor):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::put):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+        (JSC::RegExpObject::put):
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::exec):
+        (JSC::callRegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        (JSC::asRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        (JSC::asStringObject):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::changePrototypeTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::storedPrototype):
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "That doesn't look like what I thought it looks like" Weinig.
+        
+        Beefed up the JSValuePtr class and removed some non-JSValuePtr dependencies
+        on JSImmediate, in prepapration for making JSImmediate an implementation
+        detail of JSValuePtr.
+        
+        SunSpider reports no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_mod):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt): Updated for interface changes.
+
+        * runtime/JSImmediate.h:
+        (JSC::JSValuePtr::JSValuePtr):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::):
+        (JSC::jsImpossibleValue):
+        (JSC::jsNull):
+        (JSC::jsUndefined):
+        (JSC::jsBoolean):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator bool):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::isUndefined):
+        (JSC::JSValuePtr::isNull): Changed jsImpossibleValue(), jsNull(),
+        jsUndefined(), and jsBoolean() to operate in terms of JSValuePtr instead
+        of JSImmediate.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitwise_cast): Fixed up for clarity.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug fix for rdar:/6845379.  If a case-insensitive regex contains
+        a character class containing a range with an upper bound of \uFFFF
+        the parser will infinite-loop whist adding other-case characters
+        for characters in the range that do have another case.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        OPCODE_SAMPLING without CODEBLOCK_SAMPLING is currently broken,
+        since SamplingTool::Sample::isNull() checks the m_codeBlock
+        member (which is always null without CODEBLOCK_SAMPLING).
+
+        Restructure the checks so make this work again.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::Sample::isNull):
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        - Concatenate final three strings in simple replace case at one go
+
+        ~0.2% SunSpider speedup
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Use new replaceRange helper instead of
+        taking substrings and concatenating three strings.
+        * runtime/UString.cpp:
+        (JSC::UString::replaceRange): New helper function.
+        * runtime/UString.h:
+
+2009-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Gavin Barraclough.
+        
+        Changed JSValueEncodedAsPtr* => EncodedJSValuePtr to support a non-pointer
+        encoding for JSValuePtrs.
+
+        * API/APICast.h:
+        (toJS):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        * jit/JIT.cpp:
+        (JSC::):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Abandon Ship!" Hunt.
+
+        Fix a leak in Yarr.
+
+        All Disjunctions should be recorded in RegexPattern::m_disjunctions,
+        so that they can be freed at the end of compilation - copyDisjunction
+        is failing to do so.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+
+2009-04-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add function to CallFrame for dumping the current JS caller
+
+        Added debug only method CallFrame::dumpCaller() that provide the call location
+        of the deepest currently executing JS function.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/CallFrame.h:
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - make BaseStrings have themselves as a base, instead of nothing, to remove common branches
+
+        ~0.7% SunSpider speedup
+
+        * runtime/UString.h:
+        (JSC::UString::Rep::Rep): For the constructor without a base, set self as base instead of null.
+        (JSC::UString::Rep::baseString): Just read m_baseString - no more branching.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Two quick improvements to SamplingFlags mechanism.
+
+        SamplingFlags::ScopedFlag class to provide support for automagically
+        clearing a flag as it goes out of scope, and add a little more detail
+        to the output generated by the tool.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::stop):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::ScopedFlag::ScopedFlag):
+        (JSC::SamplingFlags::ScopedFlag::~ScopedFlag):
+
+2009-04-30  Adam Roben  <aroben@apple.com>
+
+        Restore build event steps that were truncated in r43082
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        Re-copied the command lines for the build events from the pre-r43082
+        .vcproj files.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Removed an unnecessary
+        attribute.
+
+2009-04-30  Adam Roben  <aroben@apple.com>
+
+        Move settings from .vcproj files to .vsprops files within the
+        JavaScriptCore directory
+
+        Moving the settings to a .vsprops file means that we will only have to
+        change a single setting to affect all configurations, instead of one
+        setting per configuration.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Moved settings from these files to the new .vsprops files. Note that
+        testapi.vcproj had a lot of overrides of default settings that were
+        the same as the defaults, which I've removed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Added.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_JAVASCRIPT_DEBUGGER define.
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - speed up string concatenation by reorganizing some simple cases
+
+        0.7% SunSpider speedup
+
+        * runtime/UString.cpp:
+        (JSC::concatenate): Put fast case for appending a single character
+        before the empty string special cases; streamline code a bit to
+        delay computing values that are not needed in the fast path.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add SamplingFlags mechanism.
+
+        This mechanism allows fine-grained JSC and JavaScript program aware
+        performance measurement.  The mechanism provides a set of 32 flags,
+        numbered #1..#32.  Flag #16 is initially set, and all other flags
+        are cleared.  Flags may be set and cleared from within
+
+        Enable by setting ENABLE_SAMPLING_FLAGS to 1 in wtf/Platform.h.
+        Disabled by default, no performance impact.  Flags may be modified
+        by calling SamplingFlags::setFlag() and SamplingFlags::clearFlag()
+        from within JSC implementation, or by calling setSamplingFlag() and
+        clearSamplingFlag() from JavaScript.
+
+        The flags are sampled with a frequency of 10000Hz, and the highest
+        set flag in recorded, allowing multiple events to be measured (with
+        the highest flag number representing the highest priority).
+
+        Disabled by default; no performance impact.
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::sample):
+        (JSC::SamplingFlags::start):
+        (JSC::SamplingFlags::stop):
+        (JSC::SamplingThread::threadStartFunc):
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::sample):
+        (JSC::SamplingTool::start):
+        (JSC::SamplingTool::stop):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::setFlag):
+        (JSC::SamplingFlags::clearFlag):
+        (JSC::SamplingTool::SamplingTool):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionSetSamplingFlag):
+        (functionClearSamplingFlag):
+        (runWithScripts):
+        * wtf/Platform.h:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Another attempt to fix the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Try and fix the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Peg-Leg" Hunt.
+
+        Coallesce input checking and reduce futzing with the index position
+        between alternatives and iterations of the main loop of a regex,
+        when run in YARR.
+
+        Consider the following regex:  /foo|bar/
+        
+        Prior to this patch, this will be implemented something like this pseudo-code description:
+        
+        loop:
+            check_for_available_input(3) // this increments the index by 3, for the first alterantive.
+                if (available) { test "foo" }
+            decrement_index(3)
+            check_for_available_input(3) // this increments the index by 3, for the second alterantive.
+                if (available) { test "bar" }
+            decrement_index(3)
+            check_for_available_input(1) // can we loop again?
+                if (available) { goto loop }
+
+        With these changes it will look more like this:
+
+            check_for_available_input(3) // this increments the index by 3, for the first alterantive.
+            if (!available) { goto fail }
+        loop:
+            test "foo"
+            test "bar"
+            check_for_available_input(1) // can we loop again?
+                if (available) { goto loop }
+        fail:
+
+
+        This gives about a 5% gain on v8-regex, no change on Sunspider.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracksTo):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clean up ArgList to be a trivial type
+
+        Separate out old ArgList logic to handle buffering and marking arguments
+        into a distinct MarkedArgumentBuffer type.  ArgList becomes a trivial
+        struct of a pointer and length.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * JavaScriptCore.exp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::emptyList):
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        (JSC::MarkedArgumentBuffer::markLists):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at):
+        (JSC::ArgList::isEmpty):
+        (JSC::ArgList::size):
+        (JSC::ArgList::begin):
+        (JSC::ArgList::end):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::fillArgList):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        (JSC::Heap::markListSet):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::fillArgList):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncMatch):
+
+2009-04-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25334
+
+        Fix Qt build when ENABLE_JIT is explicitly set to 1
+        to overrule defaults.
+
+        * JavaScriptCore.pri:
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Crash in profiler due to incorrect assuming displayName would be a string.
+
+        Fixed by adding a type guard.
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Removed scaffolding supporting dynamically converting between 32bit and
+        64bit value representations. 
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::construct):
+        (JSC::::call):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        (JSC::Register::marked):
+        (JSC::Register::mark):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::arguments):
+        (JSC::Register::callFrame):
+        (JSC::Register::codeBlock):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        (JSC::Register::vPC):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_call_eval):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionRun):
+        (functionLoad):
+        * runtime/ArgList.h:
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructError):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::constructWithStringConstructor):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+
+2009-04-28  David Kilzer  <ddkilzer@apple.com>
+
+        A little more hardening for UString
+
+        Reviewed by Maciej Stachowiak.
+
+        Revised fix for <rdar://problem/5861045> in r42644.
+
+        * runtime/UString.cpp:
+        (JSC::newCapacityWithOverflowCheck): Added.
+        (JSC::concatenate): Used newCapacityWithOverflowCheck().
+        (JSC::UString::append): Ditto.
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bring back r42969, this time with correct codegen
+
+        Add logic to the codegen for right shift to avoid jumping to a helper function
+        when shifting a small floating point value.
+
+        * jit/JITArithmetic.cpp:
+        (isSSE2Present):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+
+2009-04-28  Kevin Ollivier <kevino@theolliviers.com>
+
+        wxMSW build fix. Switch JSCore build back to static. 
+
+        * API/JSBase.h:
+        * config.h:
+        * jscore.bkl:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Roll out r42969, due to hangs in build bot.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::isSSE2Present):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add (even more) missing files to list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of string indexing
+
+        Add a cti_get_by_val_string function to specialise indexing into a string object.
+        This gives us a slight performance win on a number of string tests.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        * jit/JITStubs.h:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of right shifts of large or otherwise floating point values.
+
+        Add logic to the codegen for right shift to avoid jumping to a helper function
+        when shifting a small floating point value.
+
+        * jit/JITArithmetic.cpp:
+        (isSSE2Present): Moved to the head of file.
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add (more) missing files to list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add missing header to file list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Maciej "Henry Morgan" Stachowiak.
+
+        Enable YARR.
+        (Again.)
+
+        * wtf/Platform.h:
+
+2009-04-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Tweak a loop condition to keep GCC happy,
+        some GCCs seem to be having issues with this. :-/
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::breakTarget):
+        * wtf/Platform.h:
+
+2009-04-27  Adam Roben  <aroben@apple.com>
+
+        Windows Debug build fix
+
+        Not sure why the buildbots weren't affected by this problem.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS
+        re-order the file list, and added JavaScriptCore[_debug].def to the
+        project. This was not necessary for the fix, but made making the fix
+        easier.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed a function that no longer exists.
+
+2009-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Weinig Sam.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25416
+        "Cached prototype accesses unsafely hoist property storage load above structure checks."
+        
+        Do not hoist the load of the pointer to the property storage array.
+
+        No performance impact.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+
+2009-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey "Gaffe or energy?" Garen.
+
+        Randomize address requested by ExecutableAllocatorFixedVMPool.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+
+2009-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove scons-based build system.
+
+        * JavaScriptCore.scons: Removed.
+
+2009-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Make HAVE_MADV_FREE darwin only for now
+
+        * wtf/Platform.h:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk build fix - check if we have MADV_FREE before using it.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * wtf/Platform.h:
+
+2009-04-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switching JSCore from a static lib to a dynamic lib
+        to match the Apple build and fix symbol exports.
+
+        * jscore.bkl:
+
+2009-04-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25337
+        Move ThreadingQt.cpp under the qt directory.
+
+        * JavaScriptCore.pri:
+        * wtf/ThreadingQt.cpp: Removed.
+        * wtf/qt/ThreadingQt.cpp: Copied from JavaScriptCore/wtf/ThreadingQt.cpp.
+
+2009-04-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25338
+        Move ThreadingGtk.cpp under the gtk directory.
+
+        * GNUmakefile.am:
+        * wtf/ThreadingGtk.cpp: Removed.
+        * wtf/gtk/ThreadingGtk.cpp: Copied from JavaScriptCore/wtf/ThreadingGtk.cpp.
+
+2009-04-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Wesley" Weinig.
+
+        Improve performance to YARR interpreter.
+        (From about 3x slower than PCRE on regex-dna to about 30% slower).
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alterantiveBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::ByteTerm::):
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
+        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::SubpatternBegin):
+        (JSC::Yarr::ByteTerm::SubpatternEnd):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        * yarr/RegexPattern.h:
+
+2009-04-24  Rob Raguet-Schofield  <ragfield@gmail.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        * wtf/CurrentTime.h: Fix a typo in a comment.
+
+2009-04-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add reinterpret_cast
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+
+2009-04-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6050421> JavaScript register file should remap to release physical pages accumulated during deep recursion
+
+        We now track the maximum extent of the RegisterFile, and when we reach the final
+        return from JS (so the stack portion of the registerfile becomes empty) we see
+        if that extent is greater than maxExcessCapacity.  If it is we use madvise or
+        VirtualFree to release the physical pages that were backing the excess.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        With great sadness and a heavy heart I switch us back from YARR to WREC in
+        order to restore greenness to the world once more.
+
+        * wtf/Platform.h:
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        More Windows build fixage.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Remove a symbol that no longer exists.
+
+2009-04-23  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 24604: WebKit profiler reports incorrect total times
+        <https://bugs.webkit.org/show_bug.cgi?id=24604>
+
+        Reviewed by Timothy Hatcher and Kevin McCullough.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        (JSC::CallIdentifier::Hash::equal):
+        (JSC::CallIdentifier::hash):
+        (WTF::):
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/Profile.cpp: No more need for TreeProfile/HeavyProfile
+        (JSC::Profile::create):
+        * profiler/Profile.h:
+        * profiler/ProfileNode.cpp:
+        * profiler/ProfileNode.h:
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed.
+
+        Speculative Windows build fix II.
+
+        * yarr/RegexInterpreter.cpp:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed.
+
+        Speculative Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * runtime/RegExp.cpp:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by salty sea dogs Sam & Geoff.
+
+        Enable YARR_JIT by default (where supported), replacing WREC.
+
+        * wtf/Platform.h:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff "Dread Pirate Roberts" Garen.
+
+        Various small fixes to YARR JIT, in preparation for enabling it by default.
+
+        * Correctly index into the callframe when storing restart addresses for
+          nested alternatives.
+        * Allow backtracking back into matched alternatives of parentheses.
+        * Fix callframe offset calculation for parenthetical assertions.
+        * When a set of parenthese are quantified with a fixed and variable portion,
+          and the variable portion is quantified once, this should not reset the
+          pattern match on failure to match (the last match from the firxed portion
+          should be preserved).
+        * Up the pattern size limit to match PCRE's new limit.
+        * Unlclosed parentheses should be reported with the message "missing )".
+
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+
+2009-04-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Add the m_ prefix on FixedVMPoolAllocator's member variables, and fix typos in a few comments.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+
+2009-04-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Add some assertions to FixedVMPoolAllocator to guard against cases where we
+        attempt to free memory that didn't originate from the pool, or we attempt to
+        hand out a bogus address from alloc.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+
+2009-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam "Blackbeard" Weinig.
+
+        Although pirates do spell the word 'generate' as 'genertate',
+        webkit developers do not.  Fixertate.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+
+2009-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Blackbeard" Weinig.
+
+        Improvements to YARR JIT.  This patch expands support in three key areas:
+            * Add (temporary) support for falling back to PCRE for expressions not supported.
+            * Add support for x86_64 and Windows.
+            * Add support for singly quantified parentheses (? and ??), alternatives within
+              parentheses, and parenthetical assertions.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::storeToFrame):
+        (JSC::Yarr::RegexGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::RegexGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::RegexGenerator::AlternativeBacktrackRecord::AlternativeBacktrackRecord):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::addBacktrackJump):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracks):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::RegexGenerator::genertateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::genertateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::matchAssertionWordchar):
+        (JSC::Yarr::RegexGenerator::genertateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::RegexGenerator::generationFailed):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Fix for <rdar://problem/6816957>
+        Turn off Geolocation by default
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        * interpreter/CachedCall.h:
+
+2009-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        * runtime/StringPrototype.cpp:
+
+2009-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Improve String.replace performance slightly
+
+        Apply our vm reentry caching logic to String.replace with global
+        regexes.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Oliver Hunt.
+        
+        Re-Fixed <rdar://problem/6406045> REGRESSION: Stack overflow on PowerPC on
+        fast/workers/use-machine-stack.html (22531)
+        
+        SunSpider reports no change.
+        
+        Use a larger recursion limit on the main thread (because we can, and
+        there's some evidence that it may improve compatibility), and a smaller
+        recursion limit on secondary threads (because they tend to have smaller
+        stacks).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC::): Ditto. I wrote the recursion test slightly funny, so that the
+        common case remains a simple compare to constant.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin): Conservatively, set the array recursion limits
+        to the lower, secondary thread limit. We can do something fancier if
+        compatibility moves us, but this seems sufficient for now.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Adam Roben.
+        
+        Disabled one more Mozilla JS test because it fails intermittently on Windows.
+        (See https://bugs.webkit.org/show_bug.cgi?id=25160.)
+
+        * tests/mozilla/expected.html:
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Rename JavaScriptCore_debug.dll to JavaScriptCore.dll in the Debug
+        configuration
+
+        This matches the naming scheme for WebKit.dll, and will be necessary
+        once Safari links against JavaScriptCore.dll. This change also causes
+        run-safari not to fail (because the launcher printed by FindSafari was
+        always looking for JavaScriptCore.dll, never
+        JavaScriptCore_debug.dll).
+
+        Part of Bug 25305: can't run safari or drt on windows
+        <https://bugs.webkit.org/show_bug.cgi?id=25305>
+
+        Reviewed by Steve Falkenburg and Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Use $(WebKitDLLConfigSuffix) for naming JavaScriptCore.{dll,lib}.
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Fix JavaScriptCore build on VC++ Express
+
+        Reviewed by Steve Falkenburg and Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Link
+        explicitly against gdi32.lib and oleaut32.lib.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Tiger crash fix: Put VM tags in their own header file, and fixed up the
+        #ifdefs so they're not used on Tiger.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+        * wtf/VMTags.h: Added.
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        More Windows build fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Copy DLLs, PDBs.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add version stamping, resource copying.
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate JavaScriptCore.dll from WebKit.dll.
+        Slight performance improvement or no change on benchmarks.
+        
+        Allows us to break a circular dependency between CFNetwork and WebKit on Windows,
+        and simplifies standalone JavaScriptCore builds.
+
+        Reviewed by Oliver Hunt.
+
+        * API/JSBase.h: Export symbols with JS_EXPORT when using MSVC.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Build JavaScriptCore as a DLL instead of a static library.
+        * config.h: Specify __declspec(dllexport/dllimport) appropriately when exporting data.
+        * runtime/InternalFunction.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/JSArray.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/JSFunction.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/StringObject.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/UString.h: Specify JS_EXPORTDATA on exported data.
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Kevin McCullough.
+
+        Always tag mmaped memory on darwin and clean up #defines
+        now that they are a little bigger.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Tim Hatcher.
+
+        Add licenses for xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2009-04-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Build fix for Qt port (after r42646). Not reviewed.
+
+        * wtf/unicode/qt4/UnicodeQt4.h: Added U16_PREV.
+
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Better fix for JSStringCreateWithCFString hardening.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/5860954>
+        Harden JSStringCreateWithCFString against malformed CFStringRefs.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-04-19  David Kilzer  <ddkilzer@apple.com>
+
+        Make FEATURE_DEFINES completely dynamic
+
+        Reviewed by Darin Adler.
+
+        Make FEATURE_DEFINES depend on individual ENABLE_FEATURE_NAME
+        variables for each feature, making it possible to remove all
+        knowledge of FEATURE_DEFINES from build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig: Extract a variable
+        from FEATURE_DEFINES for each feature setting.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix typo.  s/VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE/VM_MEMORY_JAVASCRIPT_CORE/
+
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock): Fix bozo typo.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6801555> Tag JavaScript memory on SnowLeopard
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+
+2009-04-18  Drew Wilson  <amw@apple.com>
+
+        <rdar://problem/6781407> VisiblePosition.characterAfter should return UChar32
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic): Added.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/5861045>
+        A little bit of hardening for UString.
+
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::append):
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe and Dan Bernstein.
+
+        Fix for <rdar://problem/5861188>
+        A little bit of hardening for Vector.
+
+        * wtf/Vector.h:
+        (WTF::Vector<T, inlineCapacity>::append):
+        (WTF::Vector<T, inlineCapacity>::insert):
+
+2009-04-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        On x86_64, make all JIT-code allocations from a new heap, managed
+        by FixedVMPoolAllocator.  This class allocates a single large (2Gb)
+        pool of virtual memory from which all further allocations take place.
+        Since all JIT code is allocated from this pool, we can continue to
+        safely assume (as is already asserted) that it will always be possible
+        to link any JIT-code to JIT-code jumps and calls.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Add new file.
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Added.
+        (JSC::FreeListEntry::FreeListEntry):
+        (JSC::AVLTreeAbstractorForFreeList::get_less):
+        (JSC::AVLTreeAbstractorForFreeList::set_less):
+        (JSC::AVLTreeAbstractorForFreeList::get_greater):
+        (JSC::AVLTreeAbstractorForFreeList::set_greater):
+        (JSC::AVLTreeAbstractorForFreeList::get_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::set_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::null):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_key):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_node):
+        (JSC::AVLTreeAbstractorForFreeList::compare_node_node):
+        (JSC::sortFreeListEntriesByPointer):
+        (JSC::sortCommonSizedAllocations):
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+            The new 2Gb heap class!
+        * jit/ExecutableAllocatorPosix.cpp:
+            Disable use of this implementation on x86_64.
+        * wtf/AVLTree.h:
+            Add missing variable initialization.
+        (WTF::::remove):
+
+2009-04-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix bug where the VM reentry cache would not correctly unroll the cached callframe
+
+        Fix a check that was intended to mark a cached call as invalid when the callframe could
+        not be constructed.  Instead it was just checking that there was a place to put the
+        exception.  This eventually results in a non-recoverable RegisterFile starvation.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call): add assertion to ensure we don't use a bad callframe
+
+2009-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Simplify FEATURE_DEFINES definition
+
+        Reviewed by Darin Adler.
+
+        This moves FEATURE_DEFINES and its related ENABLE_FEATURE_NAME
+        variables to their own FeatureDefines.xcconfig file.  It also
+        extracts a new ENABLE_GEOLOCATION variable so that
+        FEATURE_DEFINES only needs to be defined once.
+
+        * Configurations/FeatureDefines.xcconfig: Added.
+        * Configurations/JavaScriptCore.xcconfig: Removed definition of
+        ENABLE_SVG_DOM_OBJC_BINDINGS and FEATURE_DEFINES.  Added include
+        of FeatureDefines.xcconfig.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added
+        FeatureDefines.xcconfig file.
+
+2009-04-08  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25027: JavaScript parseInt wrong on negative numbers
+        <https://bugs.webkit.org/show_bug.cgi?id=25027>
+
+        When dealing with negative numbers, parseInt should use ceil instead of floor.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-04-16  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6744652> 32-bit to 64-bit: Javascript hash tables double in size
+
+        Remove perfect hash optimization which removes 1 MB of overhead on 32-bit and almost 2 MB on 64-bit.  Removing the optimization was not a regression on SunSpider and the acid 3 test still passes.
+
+        * create_hash_table:
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::next):
+        (JSC::HashTable::entry):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getEnumerableNamesFromClassInfoTable):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix subtle error in optimised VM reentry in Array.sort
+
+        Basically to ensure we don't accidentally invalidate the cached callframe
+        we should be using the cached callframe rather than our own exec state.
+        While the old behaviour was wrong i have been unable to actually create a
+        test case where anything actually ends up going wrong.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Optimise op_resolve_base
+
+        If we can statically find a property we are trying to resolve
+        the base of, the base is guaranteed to be the global object.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveBase):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of read-write-modify operators
+
+        Implement cross scope optimisation for read-write-modify
+        operators, to avoid unnecessary calls to property resolve
+        helper functions.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        * bytecompiler/BytecodeGenerator.h:
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of remaining array enumeration functions
+
+        Make use of function entry cache for remaining Array enumeration functions.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of Array.sort
+
+        Cache the VM entry for Array.sort when using a JS comparison function.
+
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::sort):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25229: Need support for Array.prototype.reduceRight
+        <https://bugs.webkit.org/show_bug.cgi?id=25229>
+
+        Implement Array.reduceRight
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduceRight):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25227: Array.filter triggers an assertion when the target array shrinks while being filtered
+        <https://bugs.webkit.org/show_bug.cgi?id=25227>
+
+        We correct this simply by making the fast array path fall back on the slow path if
+        we ever discover the fast access is unsafe.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+
+2009-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25159: Support Array.prototype.reduce
+        <https://bugs.webkit.org/show_bug.cgi?id=25159>
+
+        Implement Array.prototype.reduce
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduce):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Move CallFrameClosure from inside the Interpreter class to its own file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h:
+        * interpreter/CallFrameClosure.h: Copied from JavaScriptCore/yarr/RegexJIT.h.
+        (JSC::CallFrameClosure::setArgument):
+        (JSC::CallFrameClosure::resetCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+
+2009-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25202: Improve performance of repeated callbacks into the VM
+
+        Add the concept of a CachedCall to native code for use in Array
+        prototype and similar functions where a single callback function
+        is called repeatedly with the same number of arguments.
+
+        Used Array.prototype.filter as the test function and got a 50% win
+        over a naive non-caching specialised version.  This makes the native
+        implementation of Array.prototype.filter faster than the JS one once
+        more.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h: Added.
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        (JSC::CachedCall::~CachedCall):
+           CachedCall is a wrapper that automates the calling and teardown
+           for a CallFrameClosure
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+           Create the basic entry closure for a function
+        (JSC::Interpreter::execute):
+           A new ::execute method to enter the interpreter from a closure
+        (JSC::Interpreter::endRepeatCall):
+           Clear the entry closure
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::CallFrameClosure::setArgument):
+        (JSC::Interpreter::CallFrameClosure::resetCallFrame):
+           Helper functions to simplify setting up the closure's callframe
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the build.
+
+        Add the yarr headers (and only the headers) to the build, so that
+        RegExp.cpp can compile. The headers are ifdefed out with yarr
+        disabled, so we don't need anything else for now.
+
+        * GNUmakefile.am:
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Remove support for profile-guided optimization on Windows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed
+        the Release_PGO configuration. Also let VS re-order the source files
+        list.
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        * GNUmakefile.am:
+
+2009-04-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix when building minidom. Not reviewed.
+
+        Use C-style comment instead of C++ style since autotools builds
+        minidom using gcc and not g++.
+
+        * wtf/Platform.h:
+
+2009-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative build fix.
+
+        * runtime/RegExp.h:
+
+2009-04-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cap'n Geoff Garen.
+
+        Yarr!
+        (Yet another regex runtime).
+
+        Currently disabled by default since the interpreter, whilst awesomely
+        functional, has not been optimized and is likely slower than PCRE, and
+        the JIT, whilst faster than WREC, is presently incomplete and does not
+        fallback to using an interpreter for the cases it cannot handle.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::swap):
+        (JSC::MacroAssemblerX86Common::signExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch16):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpw_im):
+        (JSC::X86Assembler::testw_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::immediate16):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wtf/Platform.h:
+        * yarr: Added.
+        * yarr/RegexCompiler.cpp: Added.
+        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::Yarr::CharacterClassConstructor::reset):
+        (JSC::Yarr::CharacterClassConstructor::append):
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeUpper):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeLower):
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::CharacterClassConstructor::addSorted):
+        (JSC::Yarr::CharacterClassConstructor::addSortedRange):
+        (JSC::Yarr::newlineCreate):
+        (JSC::Yarr::digitsCreate):
+        (JSC::Yarr::spacesCreate):
+        (JSC::Yarr::wordcharCreate):
+        (JSC::Yarr::nondigitsCreate):
+        (JSC::Yarr::nonspacesCreate):
+        (JSC::Yarr::nonwordcharCreate):
+        (JSC::Yarr::RegexPatternConstructor::RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::~RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::reset):
+        (JSC::Yarr::RegexPatternConstructor::assertionBOL):
+        (JSC::Yarr::RegexPatternConstructor::assertionEOL):
+        (JSC::Yarr::RegexPatternConstructor::assertionWordBoundary):
+        (JSC::Yarr::RegexPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::RegexPatternConstructor::atomBuiltInCharacterClass):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassAtom):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassRange):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassBuiltIn):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+        (JSC::Yarr::RegexPatternConstructor::copyTerm):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::disjunction):
+        (JSC::Yarr::RegexPatternConstructor::regexBegin):
+        (JSC::Yarr::RegexPatternConstructor::regexEnd):
+        (JSC::Yarr::RegexPatternConstructor::regexError):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::RegexPatternConstructor::setupDisjunctionOffsets):
+        (JSC::Yarr::RegexPatternConstructor::setupOffsets):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexCompiler.h: Added.
+        * yarr/RegexInterpreter.cpp: Added.
+        (JSC::Yarr::Interpreter::appendParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::restoreOutput):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (JSC::Yarr::Interpreter::InputStream::next):
+        (JSC::Yarr::Interpreter::InputStream::rewind):
+        (JSC::Yarr::Interpreter::InputStream::read):
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::reread):
+        (JSC::Yarr::Interpreter::InputStream::prev):
+        (JSC::Yarr::Interpreter::InputStream::getPos):
+        (JSC::Yarr::Interpreter::InputStream::setPos):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::InputStream::checkInput):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::testCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeCharacter):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeCharacterClass):
+        (JSC::Yarr::Interpreter::checkCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionEOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::matchPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+        (JSC::Yarr::Interpreter::recordParenthesesMatch):
+        (JSC::Yarr::Interpreter::resetMatches):
+        (JSC::Yarr::Interpreter::resetAssertionMatches):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionOnceBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionOnceEnd):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::matchTerm):
+        (JSC::Yarr::Interpreter::backtrackTerm):
+        (JSC::Yarr::Interpreter::matchAlternative):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::ParenthesesStackEntry::ParenthesesStackEntry):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        (JSC::Yarr::byteCompileRegex):
+        (JSC::Yarr::interpretRegex):
+        * yarr/RegexInterpreter.h: Added.
+        (JSC::Yarr::ByteTerm::):
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BOL):
+        (JSC::Yarr::ByteTerm::CheckInput):
+        (JSC::Yarr::ByteTerm::EOL):
+        (JSC::Yarr::ByteTerm::WordBoundary):
+        (JSC::Yarr::ByteTerm::BackReference):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::PatternEnd):
+        (JSC::Yarr::ByteTerm::invert):
+        (JSC::Yarr::ByteTerm::capture):
+        (JSC::Yarr::ByteDisjunction::ByteDisjunction):
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        (JSC::Yarr::BytecodePattern::~BytecodePattern):
+        * yarr/RegexJIT.cpp: Added.
+        (JSC::Yarr::RegexGenerator::optimizeAlternative):
+        (JSC::Yarr::RegexGenerator::matchCharacterClassRange):
+        (JSC::Yarr::RegexGenerator::matchCharacterClass):
+        (JSC::Yarr::RegexGenerator::jumpIfNoAvailableInput):
+        (JSC::Yarr::RegexGenerator::jumpIfAvailableInput):
+        (JSC::Yarr::RegexGenerator::checkInput):
+        (JSC::Yarr::RegexGenerator::atEndOfInput):
+        (JSC::Yarr::RegexGenerator::notAtEndOfInput):
+        (JSC::Yarr::RegexGenerator::jumpIfCharEquals):
+        (JSC::Yarr::RegexGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::RegexGenerator::readCharacter):
+        (JSC::Yarr::RegexGenerator::storeToFrame):
+        (JSC::Yarr::RegexGenerator::loadFromFrame):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::alternativeValid):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::nextAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::alternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::termValid):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::nextTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::term):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::lookaheadTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isSinglePatternCharacterLookaheadTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::inputOffset):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackGenerated):
+        (JSC::Yarr::RegexGenerator::jumpToBacktrackCheckEmitPending):
+        (JSC::Yarr::RegexGenerator::genertateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::genertateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::matchAssertionWordchar):
+        (JSC::Yarr::RegexGenerator::genertateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingleDisjunctionOneAlternative):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h: Added.
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        * yarr/RegexParser.h: Added.
+        (JSC::Yarr::):
+        (JSC::Yarr::Parser::):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::begin):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacterUnescaped):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::end):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::flush):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::):
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parseAtomEscape):
+        (JSC::Yarr::Parser::parseCharacterClassEscape):
+        (JSC::Yarr::Parser::parseCharacterClass):
+        (JSC::Yarr::Parser::parseParenthesesBegin):
+        (JSC::Yarr::Parser::parseParenthesesEnd):
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        (JSC::Yarr::Parser::saveState):
+        (JSC::Yarr::Parser::restoreState):
+        (JSC::Yarr::Parser::atEndOfPattern):
+        (JSC::Yarr::Parser::peek):
+        (JSC::Yarr::Parser::peekIsDigit):
+        (JSC::Yarr::Parser::peekDigit):
+        (JSC::Yarr::Parser::consume):
+        (JSC::Yarr::Parser::consumeDigit):
+        (JSC::Yarr::Parser::consumeNumber):
+        (JSC::Yarr::Parser::consumeOctal):
+        (JSC::Yarr::Parser::tryConsume):
+        (JSC::Yarr::Parser::tryConsumeHex):
+        (JSC::Yarr::parse):
+        * yarr/RegexPattern.h: Added.
+        (JSC::Yarr::CharacterRange::CharacterRange):
+        (JSC::Yarr::):
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::BOL):
+        (JSC::Yarr::PatternTerm::EOL):
+        (JSC::Yarr::PatternTerm::WordBoundary):
+        (JSC::Yarr::PatternTerm::invert):
+        (JSC::Yarr::PatternTerm::capture):
+        (JSC::Yarr::PatternTerm::quantify):
+        (JSC::Yarr::PatternAlternative::PatternAlternative):
+        (JSC::Yarr::PatternAlternative::lastTerm):
+        (JSC::Yarr::PatternAlternative::removeLastTerm):
+        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::~PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::addNewAlternative):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::~RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+        (JSC::Yarr::RegexPattern::containsIllegalBackReference):
+        (JSC::Yarr::RegexPattern::newlineCharacterClass):
+        (JSC::Yarr::RegexPattern::digitsCharacterClass):
+        (JSC::Yarr::RegexPattern::spacesCharacterClass):
+        (JSC::Yarr::RegexPattern::wordcharCharacterClass):
+        (JSC::Yarr::RegexPattern::nondigitsCharacterClass):
+        (JSC::Yarr::RegexPattern::nonspacesCharacterClass):
+        (JSC::Yarr::RegexPattern::nonwordcharCharacterClass):
+
+2009-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Missed code from last patch).
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+
+2009-04-13  Francisco Tolmasky  <francisco@280north.com>
+
+        Reviewed by Oliver Hunt.
+        
+        BUG 25171: It should be possible to manually set the name of an anonymous function
+        <https://bugs.webkit.org/show_bug.cgi?id=25171>
+
+        This change adds the displayName property to functions, which when set overrides the 
+        normal name when appearing in the console.
+
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp): Changed call to InternalFunction::name to InternalFunction::calculatedDisplayName
+        * runtime/CommonIdentifiers.h: Added displayName common identifier.
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName): Access to user settable displayName property
+        (JSC::InternalFunction::calculatedDisplayName): Returns displayName if it exists, if not then the natural name
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Disabled another JavaScriptCore test because it fails on Windows but
+        not Mac, so it makes the bots red.
+
+        * tests/mozilla/expected.html:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Disabled two JavaScriptCore tests because they fail on Window or Mac but
+        not both, so they make the bots red.
+
+        * tests/mozilla/expected.html: Updated expected results.
+
+2009-04-09  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25091
+        The Android platform requires threads to be registered with the VM.
+        This patch implements this behaviour inside ThreadingPthreads.cpp.
+
+        * wtf/ThreadingPthreads.cpp: Add a level above threadEntryPoint that takes care of (un)registering threads with the VM.
+        (WTF::runThreadWithRegistration): register the thread and run entryPoint. Unregister the thread afterwards.
+        (WTF::createThreadInternal): call runThreadWithRegistration instead of entryPoint directly.
+
+2009-04-09  David Kilzer  <ddkilzer@apple.com>
+
+        Reinstating <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Rolled r42345 back in.  The build failure was caused by an
+        internal script which had not been updated the same way that
+        build-webkit was updated.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-04-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverting <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings.
+        It broke Mac build, and I don't know how to fix it.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Checking for __GLIBCXX__ being bigger than some date is not enough
+        to get std::tr1, C++0x has to be in use too. Add another check for
+        __GXX_EXPERIMENTAL_CXX0X__.
+
+        * wtf/TypeTraits.h:
+
+2009-04-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix assertion failure in function.apply
+
+        The result of excess arguments to function.apply is irrelevant
+        so we don't need to provide a result register.  We were providing
+        temporary result register but not ref'ing it resulting in an
+        assertion failure.
+
+        * parser/Nodes.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2009-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Introduce the ENABLE_SVG_DOM_OBJC_BINDINGS feature define so
+        that SVG DOM Objective-C bindings may be optionally disabled.
+
+        * Configurations/JavaScriptCore.xcconfig: Added
+        ENABLE_SVG_DOM_OBJC_BINDINGS variable and use it in
+        FEATURE_DEFINES.
+
+2009-04-08  Paul Pedriana <ppedriana@ea.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20422
+        Allow custom memory allocation control.
+        
+        * wtf/FastAllocBase.h:
+        New added file. Implements allocation base class.
+        * wtf/TypeTraits.h:
+        Augments existing type traits support as needed by FastAllocBase.
+        * wtf/FastMalloc.h:
+        Changed to support FastMalloc match validation.
+        * wtf/FastMalloc.cpp:
+        Changed to support FastMalloc match validation.
+        * wtf/Platform.h:
+        Added ENABLE_FAST_MALLOC_MATCH_VALIDATION; defaults to 0.
+        * GNUmakefile.am:
+        Updated to include added FastAllocBase.h.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Updated to include added FastAllocBase.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        Updated to include added FastAllocBase.h.
+
+2009-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve function.apply performance
+
+        Jump through a few hoops to improve performance of function.apply in the general case.
+
+        In the case of zero or one arguments, or if there are only two arguments and the
+        second is an array literal we treat function.apply as function.call.
+
+        Otherwise we use the new opcodes op_load_varargs and op_call_varargs to do the .apply call
+        without re-entering the virtual machine.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitLoadVarargs):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs):
+        * jit/JITStubs.h:
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::ArrayNode::isSimpleArray):
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::ApplyFunctionCallDotNode::):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        * runtime/Arguments.h:
+        (JSC::Arguments::numProvidedArguments):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::copyToRegisters):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+
+2009-04-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25073
+        JavaScriptCore tests don't run if time zone is not PST
+
+        * API/tests/testapi.c:
+        (timeZoneIsPST): Added a function that checks whether the time zone is PST, using the same
+        method as functions in DateMath.cpp do for formatting the result.
+        (main): Skip date string format test if the time zone is not PST.
+
+2009-04-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Sam Weinig and Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25039
+        UString refactoring to support UChar* sharing.
+
+        No change in sunspider perf.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::BaseString::isShared):
+        Encapsulate the meaning behind the refcount == 1 checks because
+        this needs to do slightly more when sharing is added.
+        (JSC::concatenate):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        Make m_baseString part of a union to get rid of casts, but make it protected because
+        it is tricky to use it correctly since it is only valid when the Rep is not a BaseString.
+        The void* will be filled in when sharing is added.
+
+        Add constructors due to the making members protected and it make ensuring proper
+        initialization work better (like in SmallStringsStorage).
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::Rep):
+        (JSC::UString::Rep::):
+        (JSC::UString::BaseString::BaseString):
+        (JSC::UString::Rep::setBaseString):
+        (JSC::UString::Rep::baseString):
+
+2009-04-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25033
+        dtoa.cpp segfaults with g++ 4.4.0
+
+        g++ 4.4.0 seems to be more strict about aliasing rules, so it
+        produces incorrect code if dtoa.cpp is compiled with
+        -fstrict-aliasing (it also emits a ton of warnings, so fair enough
+        I guess). The problem was that we were only casting variables to
+        union types in order to do type punning, but GCC and the C
+        standard require that we actually use a union to store the value.
+
+        This patch does just that, the code is mostly copied from the dtoa
+        version in GCC:
+        http://gcc.gnu.org/viewcvs/trunk/libjava/classpath/native/fdlibm/dtoa.c?view=markup.
+
+        * wtf/dtoa.cpp:
+        (WTF::ulp):
+        (WTF::b2d):
+        (WTF::ratio):
+        (WTF::hexnan):
+        (WTF::strtod):
+        (WTF::dtoa):
+
+2009-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for Win port. Build the assembler sources to get missing functions.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+        * wtf/Platform.h:
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/6744471> crash in GC due to uninitialized callFunction pointer
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Initialize
+        callFunction as we do the other data members that are used in the mark function.
+
+2009-04-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann
+
+        https://bugs.webkit.org/show_bug.cgi?id=24490
+
+        Implement WTF::ThreadSpecific in the Qt build using
+        QThreadStorage.
+
+        * wtf/ThreadSpecific.h:
+
+2009-04-01  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24990
+        Put SECTORDER_FLAGS into xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix non-AllInOneFile builds.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+
+2009-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of Function.prototype.call
+        <https://bugs.webkit.org/show_bug.cgi?id=24907>
+
+        Optimistically assume that expression.call(..) is going to be a call to
+        Function.prototype.call, and handle it specially to attempt to reduce the
+        degree of VM reentrancy.
+
+        When everything goes right this removes the vm reentry improving .call()
+        by around a factor of 10.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::CallFunctionCallDotNode::):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+
+2009-03-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24884: Include strings.h for strcasecmp()
+        https://bugs.webkit.org/show_bug.cgi?id=24884
+
+        * runtime/DateMath.cpp: Reversed previous change including strings.h
+        * wtf/StringExtras.h: Include strings.h here is available
+
+2009-03-26  Adam Roben  <aroben@apple.com>
+
+        Copy testapi.js to $WebKitOutputDir on Windows
+
+        Part of Bug 24856: run-javascriptcore-tests should run testapi on
+        Windows
+        <https://bugs.webkit.org/show_bug.cgi?id=24856>
+
+        This matches what Mac does, which will help once we enable running
+        testapi from run-javascriptcore-tests on Windows.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Copy testapi.js next
+        to testapi.exe.
+
+2009-03-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix exception handling for instanceof in the interpreter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-03-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6724011> Write to freed memory in JSC::Label::deref
+        when reloading http://helpme.att.net/speedtest/
+
+        * bytecompiler/BytecodeGenerator.h: Reversed the declaration order for
+        m_labelScopes and m_labels to reverse their destruction order.
+        m_labelScopes has references to memory within m_labels, so its destructor
+        needs to run first.
+
+2009-03-24  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Correct warnings which in some environments are treated as errors.
+
+        * wtf/dtoa.cpp:
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::strtod):
+        (WTF::dtoa):
+
+2009-03-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+        
+        Explicitly define HAVE_LANGINFO_H on Darwin. Fixes the wx build bot jscore 
+        test failure. 
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24780
+
+        * wtf/Platform.h:
+
+2009-03-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix className() for API defined class
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::className):
+        * API/tests/testapi.c:
+        (EmptyObject_class):
+        (main):
+        * API/tests/testapi.js:
+
+2009-03-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make testapi assertions run in release builds, so that testapi actually
+        works in a release build.
+
+        Many of the testapi assertions have side effects that are necessary, and
+        given testapi is a testing program, perf impact of an assertion is not
+        important, so it makes sense to apply the assertions in release builds
+        anyway.
+
+        * API/tests/testapi.c:
+        (EvilExceptionObject_hasInstance):
+
+2009-03-23  David Kilzer  <ddkilzer@apple.com>
+
+        Provide JavaScript exception information after slow script timeout
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/Completion.cpp:
+        (JSC::evaluate): Set the exception object as the Completion
+        object's value for slow script timeouts.  This is used in
+        WebCore when reporting the exception.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::toString): Added.  Provides a
+        description message for the exception when it is reported.
+
+2009-03-23  Gustavo Noronha Silva  <gns@gnome.org> and Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24674
+        Crashes in !PLATFORM(MAC)'s formatLocaleDate, in very specific situations
+
+        Make sure strftime never returns 2-digits years to avoid ambiguity
+        and a crash. We wrap this new code option in HAVE_LANGINFO_H,
+        since it is apparently not available in all platforms.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * wtf/Platform.h:
+
+2009-03-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix exception handling in API
+
+        We can't just use the ExecState exception slot for returning exceptions
+        from class introspection functions provided through the API as many JSC
+        functions will explicitly clear the ExecState exception when returning.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Base>::getOwnPropertySlot):
+        (JSC::JSCallbackObject<Base>::put):
+        (JSC::JSCallbackObject<Base>::deleteProperty):
+        (JSC::JSCallbackObject<Base>::construct):
+        (JSC::JSCallbackObject<Base>::hasInstance):
+        (JSC::JSCallbackObject<Base>::call):
+        (JSC::JSCallbackObject<Base>::toNumber):
+        (JSC::JSCallbackObject<Base>::toString):
+        (JSC::JSCallbackObject<Base>::staticValueGetter):
+        (JSC::JSCallbackObject<Base>::callbackGetter):
+        * API/tests/testapi.c:
+        (MyObject_hasProperty):
+        (MyObject_getProperty):
+        (MyObject_setProperty):
+        (MyObject_deleteProperty):
+        (MyObject_callAsFunction):
+        (MyObject_callAsConstructor):
+        (MyObject_hasInstance):
+        (EvilExceptionObject_hasInstance):
+        (EvilExceptionObject_convertToType):
+        (EvilExceptionObject_class):
+        (main):
+        * API/tests/testapi.js:
+        (EvilExceptionObject.hasInstance):
+        (EvilExceptionObject.toNumber):
+        (EvilExceptionObject.toStringExplicit):
+
+2009-03-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20049: testapi failure: MyObject - 0 should be NaN but instead is 1.
+        <https://bugs.webkit.org/show_bug.cgi?id=20049>
+        <rdar://problem/6079127>
+
+        In this case, the test is wrong. According to the ECMA spec, subtraction
+        uses ToNumber, not ToPrimitive. Change the test to match the spec.
+
+        * API/tests/testapi.js:
+
+2009-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Ensure that JSObjectMakeFunction doesn't produce incorrect line numbers.
+
+        Also make test api correctly propagate failures.
+
+        * API/tests/testapi.c:
+        (main):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+
+2009-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Improve testapi by making it report failures in a way we can pick up
+        from our test scripts.
+
+        * API/tests/testapi.c:
+        (assertEqualsAsBoolean):
+        (assertEqualsAsNumber):
+        (assertEqualsAsUTF8String):
+        (assertEqualsAsCharactersPtr):
+        (main):
+        * API/tests/testapi.js:
+        (pass):
+        (fail):
+        (shouldBe):
+        (shouldThrow):
+
+2009-03-20  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24535
+
+        Fixes missing line terminator character (;) after macro call.
+        It is common practice to add the trailing ";" where macros are substituted
+        and not where they are defined with #define.
+        This change is consistent with other macro declarations across webkit,
+        and it also solves compilation failure with symbian compilers. 
+ 
+        * runtime/UString.cpp:
+        * wtf/Assertions.h:
+
+2009-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed a JavaScriptCore crash on the Windows buildbot.
+
+        * bytecompiler/BytecodeGenerator.h: Reduced the AST recursion limit.
+        Apparently, Windows has small stacks.
+
+2009-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A little cleanup in the RegisterFile code.
+        
+        Moved large inline functions out of the class declaration, to make it
+        more readable.
+        
+        Switched over to using the roundUpAllocationSize function to avoid
+        duplicate code and subtle bugs.
+        
+        Renamed m_maxCommitted to m_commitEnd, to match m_end.
+        
+        Renamed allocationSize to commitSize because it's the chunk size for
+        committing memory, not allocating memory.
+        
+        SunSpider reports no change.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocator.h:
+        (JSC::roundUpAllocationSize):
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6033712> -- a little bit of hardening in the Collector.
+        
+        SunSpider reports no change. I also verified in the disassembly that
+        we end up with a single compare to constant.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate):
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Oliver Hunt.
+
+        Fixed <rdar://problem/6406045> REGRESSION: Stack overflow on PowerPC on
+        fast/workers/use-machine-stack.html (22531)
+
+        Dialed down the re-entry allowance to 64 (from 128).
+        
+        On a 512K stack, this leaves about 64K for other code on the stack while
+        JavaScript is running. Not perfect, but it solves our crash on PPC.
+
+        Different platforms may want to dial this down even more.
+
+        Also, substantially shrunk BytecodeGenerator. Since we allocate one on
+        the stack in order to throw a stack overflow exception -- well, let's
+        just say the old code had an appreciation for irony.
+
+        SunSpider reports no change.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.h:
+        (JSC::):
+
+2009-03-19  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 24350: REGRESSION: Safari 4 breaks SPAW wysiwyg editor multiple instances
+        <https://bugs.webkit.org/show_bug.cgi?id=24350>
+        <rdar://problem/6674182>
+
+        The SPAW editor's JavaScript assumes that toString() on a function
+        constructed with the Function constructor produces a function with
+        a newline after the opening brace.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction): Add a newline after the opening brace of the
+        function's source code.
+
+2009-03-19  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23771: REGRESSION (r36016): JSObjectHasProperty freezes on global class without kJSClassAttributeNoAutomaticPrototype
+        <https://bugs.webkit.org/show_bug.cgi?id=23771>
+        <rdar://problem/6561016>
+
+        * API/tests/testapi.c:
+        (main): Add a test for this bug.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resetPrototype): Don't set the prototype of the
+        last object in the prototype chain to the object prototype when the
+        object prototype is already the last object in the prototype chain.
+
+2009-03-19  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/6687342> -[WebView scheduleInRunLoop:forMode:] has no affect on timers
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Added HAVE_RUNLOOP_TIMER for PLATFORM(MAC).
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6279213> Regular expression run-time complexity
+        limit too low for long inputs (21485)
+        
+        I raised PCRE's "matchLimit" (limit on backtracking) by an order of
+        magnitude. This fixes all the reported examples of timing out on legitimate
+        regular expression matches.
+        
+        In my testing on a Core Duo MacBook Pro, the longest you can get stuck
+        trying to match a string is still under 1s, so this seems like a safe change.
+        
+        I can think of a number of better solutions that are more complicated,
+        but this is a good improvement for now.
+
+        * pcre/pcre_exec.cpp:
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6603562> REGRESSION (Safari 4): regular expression
+        pattern size limit lower than Safari 3.2, other browsers, breaks SAP (14873)
+        
+        Bumped the pattern size limit to 1MB, and standardized it between PCRE
+        and WREC. (Empirical testing says that we can easily compile a 1MB regular
+        expression without risking a hang. Other browsers support bigger regular
+        expressions, but also hang.)
+        
+        SunSpider reports no change.
+        
+        I started with a patch posted to Bugzilla by Erik Corry (erikcorry@google.com).
+        
+        * pcre/pcre_internal.h:
+        (put3ByteValue):
+        (get3ByteValue):
+        (put3ByteValueAndAdvance):
+        (putLinkValueAllowZero):
+        (getLinkValueAllowZero): Made PCRE's "LINK_SIZE" (the number of bytes
+        used to record jumps between bytecodes) 3, to accomodate larger potential
+        jumps. Bumped PCRE's "MAX_PATTERN_SIZE" to 1MB. (Technically, at this
+        LINK_SIZE, we can support even larger patterns, but we risk a hang during
+        compilation, and it's not clear that such large patterns are important
+        on the web.)
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp): Match PCRE's maximum pattern size,
+        to avoid quirks between platforms.
+
+2009-03-18  Ada Chan  <adachan@apple.com>
+
+        Rolling out r41818 since it broke the windows build.
+        Error: ..\..\runtime\DatePrototype.cpp(30) : fatal error C1083: Cannot open include file: 'langinfo.h': No such file or directory
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        <rdar://problem/6692138> REGRESSION (Safari 4): Incorrect function return value when using IE "try ... finally" memory leak work-around (24654)
+        <https://bugs.webkit.org/show_bug.cgi?id=24654>
+
+        If the return value for a function is in a local register we need
+        to copy it before executing any finalisers, otherwise it is possible
+        for the finaliser to clobber the result.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::hasFinaliser):
+        * parser/Nodes.cpp:
+        (JSC::ReturnNode::emitBytecode):
+
+2009-03-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Mark Rowe.
+        
+        Move BUILDING_ON_* defines into Platform.h to make them available to other ports.
+        Also tweak the defines so that they work with the default values set by 
+        AvailabilityMacros.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24630
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Revert r41718 because it broke DumpRenderTree on Tiger.
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-Apple Mac ports build fix. Move defines for the BUILDING_ON_ macros into
+        Platform.h so that they're defined for all ports building on Mac, and tweak
+        the definitions of those macros based on Mark Rowe's suggestions to accomodate
+        cases where the values may not be <= to the .0 release for that version.
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Take advantage of the ability of recent versions of Xcode to easily switch the active
+        architecture.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Prevent AllInOneFile.cpp and ProfileGenerator.cpp from rebuilding unnecessarily when
+        switching between building in Xcode and via build-webkit.
+
+        build-webkit passes FEATURE_DEFINES to xcodebuild, resulting in it being present in the
+        Derived Sources build settings.  When building in Xcode, this setting isn't present so
+        Xcode reruns the script build phases.  This results in a new version of TracingDtrace.h
+        being generated, and the files that include it being rebuilt.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:  Don't regenerate TracingDtrace.h if it is
+        already newer than the input file.
+
+2009-03-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Resolved name conflict with globally defined tzname in Symbian.
+        Replaced with different name instead of using namespace qualifier
+        (appeared to be less clumsy).
+
+        * runtime/DateMath.cpp:
+
+2009-03-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6548446> TCMalloc_SystemRelease should use madvise rather than re-mmaping span of pages
+
+        * wtf/FastMalloc.cpp:
+        (WTF::mergeDecommittedStates): If either of the spans has been released to the system, release the other
+        span as well so that the flag in the merged span is accurate.
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp: Track decommitted spans when using MADV_FREE_REUSABLE / MADV_FREE_REUSE.
+        (TCMalloc_SystemRelease): Use madvise with MADV_FREE_REUSABLE when it is available.
+        (TCMalloc_SystemCommit): Use madvise with MADV_FREE_REUSE when it is available.
+        * wtf/TCSystemAlloc.h:
+
+2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Include string.h for strlen usage.
+
+        * wtf/Threading.cpp:
+
+2009-03-12  David Kilzer  <ddkilzer@apple.com>
+
+        Add NO_RETURN attribute to runInteractive() when not using readline
+
+        Reviewed by Darin Adler.
+
+        * jsc.cpp:
+        (runInteractive): If the readline library is not used, this method
+        will never return, thus the NO_RETURN attribute is needed to prevent
+        a gcc warning.
+
+2009-03-12  Adam Roben  <aroben@apple.com>
+
+        Adopt setThreadNameInternal on Windows
+
+        Also changed a Windows-only assertion about thread name length to an
+        all-platform log message.
+
+        Reviewed by Adam Treat.
+
+        * wtf/Threading.cpp:
+        (WTF::createThread): Warn if the thread name is longer than 31
+        characters, as Visual Studio will truncate names longer than that
+        length.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::setThreadNameInternal): Renamed from setThreadName and changed
+        to always operate on the current thread.
+        (WTF::initializeThreading): Changed to use setThreadNameInternal.
+        (WTF::createThreadInternal): Removed call to setThreadName. This is
+        now handled by threadEntryPoint and setThreadNameInternal.
+
+2009-03-11  David Kilzer  <ddkilzer@apple.com>
+
+        Clarify comments regarding order of FEATURE_DEFINES
+
+        Rubber-stamped by Mark Rowe.
+
+        * Configurations/JavaScriptCore.xcconfig: Added warning about
+        the consequences when FEATURE_DEFINES are not kept in sync.
+
+2009-03-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - WTF support for fixing <rdar://problem/3919124> Thai text selection
+          in Safari is incorrect
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext): Added. Returns
+        whether the character has Unicode line breaking property value SA
+        ("Complex Context").
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext): Added an
+        implementation that always returns false.
+
+2009-03-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Give threads names on platforms with pthread_setname_np.
+
+        * wtf/Threading.cpp:
+        (WTF::NewThreadContext::NewThreadContext): Initialize thread name.
+        (WTF::threadEntryPoint): Call setThreadNameInternal.
+        (WTF::createThread): Pass thread name.
+
+        * wtf/Threading.h: Added new comments, setThreadNameInternal.
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingNone.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Call pthread_setname_np when available.
+        * wtf/ThreadingQt.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingWin.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+
+2009-03-11  Adam Roben  <aroben@apple.com>
+
+        Change the Windows implementation of ThreadSpecific to use functions
+        instead of extern globals
+
+        This will make it easier to export ThreadSpecific from WebKit.
+
+        Reviewed by John Sullivan.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): 
+        Touched this file to force ThreadSpecific.h to be copied into
+        $WebKitOutputDir.
+
+        * wtf/ThreadSpecific.h: Replaced g_tls_key_count with tlsKeyCount()
+        and g_tls_keys with tlsKeys().
+
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+        Updated to use the new functions.
+
+        * wtf/ThreadSpecificWin.cpp:
+        (WTF::tlsKeyCount):
+        (WTF::tlsKeys):
+        Added.
+
+        (WTF::ThreadSpecificThreadExit): Changed to use the new functions.
+
+2009-03-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff Garen.
+
+        Bug 24291: REGRESSION (r38635): Single line JavaScript comment prevents HTML button click handler execution
+        <https://bugs.webkit.org/show_bug.cgi?id=24291>
+        <rdar://problem/6663472>
+
+        Add an extra newline to the end of the body of the program text constructed
+        by the Function constructor for parsing. This allows single line comments to
+        be handled correctly by the parser.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+
+2009-03-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 24447: REGRESSION (r41508): Google Maps does not complete initialization
+        <rdar://problem/6657774>
+
+        r41508 actually exposed a pre-existing bug where we were not invalidating the result
+        register cache at jump targets.  This causes problems when condition loads occur in an
+        expression -- namely through the ?: and || operators.  This patch corrects these issues
+        by marking the target of all forward jumps as being a jump target, and then clears the
+        result register cache when ever it starts generating code for a targeted instruction.
+
+        I do not believe it is possible to cause this class of failure outside of a single
+        expression, and expressions only provide forward branches, so this should resolve this
+        entire class of bug.  That said i've included a test case that gets as close as possible
+        to hitting this bug with a back branch, to hopefully prevent anyone from introducing the
+        problem in future.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Label::isUsed):
+        (JSC::AbstractMacroAssembler::Label::used):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpDst::JmpDst):
+        (JSC::X86Assembler::JmpDst::isUsed):
+        (JSC::X86Assembler::JmpDst::used):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23175: String and UString should be able to share a UChar* buffer.
+        <https://bugs.webkit.org/show_bug.cgi?id=23175>
+
+        Add CrossThreadRefCounted.
+
+        * wtf/CrossThreadRefCounted.h: Added.
+        (WTF::CrossThreadRefCounted::create):
+        (WTF::CrossThreadRefCounted::isShared):
+        (WTF::CrossThreadRefCounted::dataAccessMustBeThreadSafe):
+        (WTF::CrossThreadRefCounted::mayBePassedToAnotherThread):
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::CrossThreadRefCounted::~CrossThreadRefCounted):
+        (WTF::CrossThreadRefCounted::ref):
+        (WTF::CrossThreadRefCounted::deref):
+        (WTF::CrossThreadRefCounted::release):
+        (WTF::CrossThreadRefCounted::copy):
+        (WTF::CrossThreadRefCounted::threadSafeDeref):
+        * wtf/RefCounted.h:
+        * wtf/Threading.h:
+        (WTF::ThreadSafeSharedBase::ThreadSafeSharedBase):
+        (WTF::ThreadSafeSharedBase::derefBase):
+        (WTF::ThreadSafeShared::ThreadSafeShared):
+        (WTF::ThreadSafeShared::deref):
+
+2009-03-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24353
+        Allow to overrule default build options for Qt build.
+
+        * JavaScriptCore.pri: Allow to overrule ENABLE_JIT
+
+2009-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+
+2009-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 24268: RuntimeArray is not a fully implemented JSArray
+        <https://bugs.webkit.org/show_bug.cgi?id=24268>
+
+        Don't cast a type to JSArray, just because it reportsArray as a supertype
+        in the JS type system.  Doesn't appear feasible to create a testcase
+        unfortunately as setting up the failure conditions requires internal access 
+        to JSC not present in DRT.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+
+2009-03-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        When preforming an op_mov, preserve any existing register mapping.
+
+        ~0.5% progression on v8 tests x86-64.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-05  Simone Fiorentino  <simone.fiorentino@consulenti.fastweb.it>
+
+        Bug 24382: request to add SH4 platform
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24382>
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h: Added support for SH4 platform.
+
+2009-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Writes of constant values to SF registers should be made with direct memory
+        writes where possible, rather than moving the value via a hardware register.
+
+        ~3% win on SunSpider tests on x86, ~1.5% win on v8 tests on x86-64.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_i32m):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-05  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        Sprinkle "static" around NumberConstructor.cpp in order to please the compiler.
+
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+
+2009-03-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6354858> FastMallocZone's enumeration code reports fragmented administration space
+
+        The handling of MALLOC_ADMIN_REGION_RANGE_TYPE in FastMalloc's zone was incorrect.  It was attempting
+        to record the memory containing and individual span as an administrative region, when all memory
+        allocated via MetaDataAlloc should in fact be recorded.  This was causing memory regions allocated
+        via MetaDataAlloc to appear as "VM_ALLOCATE ?" in vmmap output.  They are now correctly reported as
+        "MALLOC_OTHER" regions associated with the JavaScriptCore FastMalloc zone.
+
+        Memory is allocated via MetaDataAlloc from two locations: PageHeapAllocator, and TCMalloc_PageMap{2,3}.
+        These two cases are handled differently.
+
+        PageHeapAllocator is extended to keep a linked list of memory regions that it has allocated.  The
+        first object in an allocated region contains the link to the previously allocated region. To record
+        the administrative regions of a PageHeapAllocator we can simply walk the linked list and record
+        each allocated region we encounter.
+
+        TCMalloc_PageMaps allocate memory via MetaDataAlloc to store each level of the radix tree.  To record
+        the administrative regions of a TCMalloc_PageMap we walk the tree and record the storage used for nodes
+        at each position rather than the nodes themselves.
+
+        A small performance improvement is achieved by coalescing adjacent memory regions inside the PageMapMemoryUsageRecorder
+        so that fewer calls in to the range recorder are necessary.  We further reduce the number of calls to the
+        range recorder by aggregating the in-use ranges of a given memory region into a local buffer before recording
+        them with a single call.  A similar approach is also used by AdminRegionRecorder.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::Init):
+        (WTF::PageHeapAllocator::New):
+        (WTF::PageHeapAllocator::recordAdministrativeRegions):
+        (WTF::TCMallocStats::FreeObjectFinder::isFreeObject):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::~PageMapMemoryUsageRecorder):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::recordPendingRegions):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::visit):
+        (WTF::TCMallocStats::AdminRegionRecorder::AdminRegionRecorder):
+        (WTF::TCMallocStats::AdminRegionRecorder::recordRegion):
+        (WTF::TCMallocStats::AdminRegionRecorder::visit):
+        (WTF::TCMallocStats::AdminRegionRecorder::recordPendingRegions):
+        (WTF::TCMallocStats::AdminRegionRecorder::~AdminRegionRecorder):
+        (WTF::TCMallocStats::FastMallocZone::enumerate):
+        (WTF::TCMallocStats::FastMallocZone::FastMallocZone):
+        (WTF::TCMallocStats::FastMallocZone::init):
+        * wtf/TCPageMap.h:
+        (TCMalloc_PageMap2::visitValues):
+        (TCMalloc_PageMap2::visitAllocations):
+        (TCMalloc_PageMap3::visitValues):
+        (TCMalloc_PageMap3::visitAllocations):
+
+2009-03-04  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24359
+        Repaint throttling mechanism
+        
+        Set ENABLE_REPAINT_THROTTLING to 0 by default.
+
+        * wtf/Platform.h:
+
+2009-03-03  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6581203> WebCore and WebKit should install the same set of headers during installhdrs phase as build phase
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Defined REAL_PLATFORM_NAME based
+        on PLATFORM_NAME to work around the missing definition on Tiger.
+        Updated HAVE_DTRACE to use REAL_PLATFORM_NAME.
+
+2009-03-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6639110> console.profile() doesn't work without a title
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::startProfiling): assert if there is not title to ensure
+        we don't start profiling without one.
+
+2009-03-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Enable Geolocation (except on Tiger and Leopard).
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-03-01  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6635688> Move HAVE_DTRACE check to Base.xcconfig
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Set HAVE_DTRACE Xcode variable
+        based on PLATFORM_NAME and MAC_OS_X_VERSION_MAJOR.  Also define
+        it as a preprocessor macro by modifying
+        GCC_PREPROCESSOR_DEFINITIONS.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Changed "Generate
+        DTrace header" script phase to check for HAVE_DTRACE instead of
+        MACOSX_DEPLOYMENT_TARGET.
+        * wtf/Platform.h: Removed definition of HAVE_DTRACE macro since
+        it's defined in Base.xcconfig now.
+
+2009-03-01  Horia Olaru  <olaru@adobe.com>
+
+        By looking in grammar.y there are only a few types of statement nodes
+        on which the debugger should stop. 
+
+        Removed isBlock and isLoop virtual calls. No need to emit debug hooks in
+        the "statementListEmitCode" method as long as the necessary hooks can be
+        added in each "emitCode".
+
+        https://bugs.webkit.org/show_bug.cgi?id=21073
+
+        Reviewed by Kevin McCullough.
+
+        * parser/Nodes.cpp:
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::statementListEmitCode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * parser/Nodes.h:
+
+2009-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix bug #23614.  Switches on double precision values were incorrectly
+        truncating the scrutinee value.  E.g.:
+
+            switch (1.1) { case 1: print("FAIL"); }
+
+        Was resulting in FAIL.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_switch_imm):
+
+2009-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Integer Immediate representation need not be canonical in x86 JIT code.
+        On x86-64 we already have loosened the requirement that the int immediate
+        representation in canonical, we should bring x86 into line.
+
+        This patch is a minor (~0.5%) improvement on sunspider & v8-tests, and
+        should reduce memory footoprint (reduces JIT code size).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-26  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24099
+        ARM Compiler Warnings in pcre_exec.cpp
+
+        * pcre/pcre_exec.cpp:
+        (match):
+
+2009-02-25  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 24086: Regression (r40993): WebKit crashes after logging in to lists.zenbe
+        <https://bugs.webkit.org/show_bug.cgi?id=24086>
+        <rdar://problem/6625111>
+
+        The numeric sort optimization in r40993 generated bytecode for a function
+        without generating JIT code. This breaks an assumption in some parts of
+        the JIT's function calling logic that the presence of a CodeBlock implies
+        the existence of JIT code.
+
+        In order to fix this, we simply generate JIT code whenever we check whether
+        a function is a numeric sort function. This only incurs an additional cost
+        in the case when the function is a numeric sort function, in which case it
+        is not expensive to generate JIT code for it.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+
+2009-02-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed <rdar://problem/6611174> REGRESSION (r36701): Unable to select
+        messages on hotmail (24052)
+        
+        The bug was that for-in enumeration used a cached prototype chain without
+        validating that it was up-to-date.
+        
+        This led me to refactor prototype chain caching so it was easier to work
+        with and harder to get wrong.
+        
+        After a bit of inlining, this patch is performance-neutral on SunSpider
+        and the v8 benchmarks.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list): Use the new refactored goodness. See
+        lines beginning with "-" and smile.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup): A shout out to const.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next): We can use a pointer comparison to
+        see if our cached structure chain is equal to the object's structure chain,
+        since in the case of a cache hit, we share references to the same structure
+        chain.
+
+        * runtime/Operations.h:
+        (JSC::countPrototypeChainEntriesAndCheckForProxies): Use the new refactored
+        goodness.
+
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::setShouldCache):
+        (JSC::PropertyNameArray::shouldCache): Renamed "cacheable" to "shouldCache"
+        to communicate that the client is specifying a recommendation, not a
+        capability.
+        
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): No need to initialize a RefPtr.
+        (JSC::Structure::getEnumerablePropertyNames): Moved some code into helper
+        functions.
+
+        (JSC::Structure::prototypeChain): New centralized accessor for a prototype
+        chain. Revalidates on every access, since the objects in the prototype
+        chain may have mutated.
+
+        (JSC::Structure::isValid): Helper function for revalidating a cached
+        prototype chain.
+
+        (JSC::Structure::getEnumerableNamesFromPropertyTable):
+        (JSC::Structure::getEnumerableNamesFromClassInfoTable): Factored out of
+        getEnumerablePropertyNames.
+
+        * runtime/Structure.h:
+
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create): No need for structureChainsAreEqual, since
+        we use pointer equality now. Refactored StructureChain to make a little
+        more sense and eliminate special cases for null prototypes.
+
+2009-02-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Use timeBeginPeriod to enable timing resolution greater than 16ms in command line jsc for Windows.
+        Allows more accurate reporting of benchmark times via command line jsc.exe. Doesn't affect WebKit's use of JavaScriptCore.
+        
+        Reviewed by Adam Roben.
+
+        * jsc.cpp:
+        (main):
+
+2009-02-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix?
+
+        * GNUmakefile.am:
+
+2009-02-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6259220> Rename AVAILABLE_AFTER_WEBKIT_VERSION_3_1 (etc.) to match the other macros
+
+        * API/JSBasePrivate.h:
+        * API/JSContextRef.h:
+        * API/JSObjectRef.h:
+        * API/WebKitAvailability.h:
+
+2009-02-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Next step in splitting JIT functionality out of the Interpreter class:
+        Moved vptr storage from Interpreter to JSGlobalData, so it could be shared
+        between Interpreter and JITStubs, and moved the *Trampoline JIT stubs
+        into the JITStubs class. Also added a VPtrSet class to encapsulate vptr
+        hacks during JSGlobalData initialization.
+        
+        SunSpider says 0.4% faster. Meh.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_is_string):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::ctiArrayLengthTrampoline):
+        (JSC::JITStubs::ctiStringLengthTrampoline):
+        (JSC::JITStubs::ctiVirtualCallPreLink):
+        (JSC::JITStubs::ctiVirtualCallLink):
+        (JSC::JITStubs::ctiVirtualCall):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/JSArray.h:
+        (JSC::isJSArray):
+        * runtime/JSByteArray.h:
+        (JSC::asByteArray):
+        (JSC::isJSByteArray):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        * runtime/JSString.h:
+        (JSC::isJSString):
+        * runtime/Operations.h:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+
+2009-02-23  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23787: Allow JIT to generate SSE2 code if using GCC
+        <https://bugs.webkit.org/show_bug.cgi?id=23787>
+
+        GCC version of the cpuid check.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present): previous assembly code fixed.
+
+2009-02-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24047: Need to simplify nested if's in WorkerRunLoop::runInMode
+        <https://bugs.webkit.org/show_bug.cgi?id=24047>
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::infiniteTime):
+        Allows for one to call waitForMessageFilteredWithTimeout and wait forever.
+
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::waitForMessage):
+        Made waitForMessage call waitForMessageFilteredWithTimeout, so that there is less
+        duplicate code.
+
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait):
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait):
+        Made these two implementations consistent with the pthread and gtk implementations.
+        Currently, the time calculations would overflow when passed large values.
+
+2009-02-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24096
+        PLATFORM(MAC)->PLATFORM(CF) since we want to use the CF functions in Chrome on OS X.
+
+        * wtf/CurrentTime.cpp:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix?
+
+        * GNUmakefile.am:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * GNUmakefile.am:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Next step in splitting JIT functionality out of the Interpreter class:
+        Created a JITStubs class and renamed Interpreter::cti_* to JITStubs::cti_*.
+        
+        Also, moved timeout checking into its own class, located in JSGlobalData,
+        so both the Interpreter and the JIT could have access to it.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/TimeoutChecker.cpp: Copied from interpreter/Interpreter.cpp.
+        (JSC::TimeoutChecker::TimeoutChecker):
+        (JSC::TimeoutChecker::reset):
+        (JSC::TimeoutChecker::didTimeOut):
+        * runtime/TimeoutChecker.h: Copied from interpreter/Interpreter.h.
+        (JSC::TimeoutChecker::setTimeoutInterval):
+        (JSC::TimeoutChecker::ticksUntilNextCheck):
+        (JSC::TimeoutChecker::start):
+        (JSC::TimeoutChecker::stop):
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix after r41100.
+
+        * GNUmakefile.am:
+
+2009-02-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6606660> 2==null returns true in 64bit jit
+
+        Code for op_eq_null and op_neq_null was incorrectly performing
+        a 32bit compare, which truncated the type tag from an integer
+        immediate, leading to incorrect behaviour.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::setPtr):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::setPtr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-02-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        First step in splitting JIT functionality out of the Interpreter class:
+        Created JITStubs.h/.cpp, and moved Interpreter::cti_* into JITStubs.cpp.
+        
+        Functions that the Interpreter and JITStubs share moved to Operations.h/.cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.cpp: Copied from interpreter/Interpreter.cpp.
+        (JSC::Interpreter::cti_op_resolve_base):
+        * jit/JITStubs.h: Copied from interpreter/Interpreter.h.
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/Operations.h:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::cachePrototypeChain):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::resolveBase):
+
+2009-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for x86-64. Where the JavaScriptCore text segment lies outside
+        a 2gb range of the heap containing JIT generated code, callbacks
+        from JIT code to the stub functions in Interpreter will be incorrectly
+        linked.
+
+        No performance impact on Sunspider, 1% regression on v8-tests,
+        due to a 3% regression on richards.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::tailRecursiveCall):
+        (JSC::MacroAssembler::makeTailRecursiveCall):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::call):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::moveWithPatch):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::patchJump):
+        (JSC::X86Assembler::patchCall):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::patchAddress):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Simplified .call and .apply in preparation for optimizing them. Also,
+        a little cleanup.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall): No need to do any specific conversion on
+        'this' -- op_convert_this will do it if necessary.
+
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject): Slightly relaxed the rules on
+        toThisObject to allow for 'undefined', which can be passed through
+        .call and .apply.
+
+2009-02-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23976: MessageQueue needs a way to wait for a message that satisfies an arbitrary criteria.
+        <https://bugs.webkit.org/show_bug.cgi?id=23976>
+
+        * wtf/Deque.h:
+        (WTF::Deque<T>::findIf):
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue<T>::waitForMessageFiltered):
+
+2009-02-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23974: Deque::Remove would be a useful method.
+        <https://bugs.webkit.org/show_bug.cgi?id=23974>
+
+        Add Deque::remove and DequeIteratorBase<T>::operator=.
+
+        Why was operator= added? Every concrete iterator (DequeIterator..DequeConstReverseIterator)
+        was calling DequeIteratorBase::assign(), which called Base::operator=(). Base::operator=()
+        was not implemented. This went unnoticed because the iterator copy code has been unused.
+
+        * wtf/Deque.h:
+        (WTF::Deque<T>::remove):
+        (WTF::DequeIteratorBase<T>::removeFromIteratorsList):
+        (WTF::DequeIteratorBase<T>::operator=):
+        (WTF::DequeIteratorBase<T>::~DequeIteratorBase):
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix symbols.filter location, and add other missing files to the
+        autotools build, so that make dist works.
+
+        * GNUmakefile.am:
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed failure in js1_5/Regress/regress-168347.js, as seen on the Oliver
+        bot.
+        
+        Technically, both behaviors are OK, but we might as well keep this test
+        passing.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded): No need to add a trailing semicolon
+        after a trailing '}', since '}' ends a block, indicating the end of a
+        statement.
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * runtime/FunctionPrototype.cpp:
+
+2009-02-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add assertion to guard against oversized pc relative calls.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::link):
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6595040> REGRESSION: http://www.amnestyusa.org/
+        fails to load.
+        
+        amnestyusa.org uses the Optimist JavaScript library, which adds event
+        listeners by concatenating string-ified functions. This is only sure to
+        be syntactically valid if the string-ified functions end in semicolons.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::isWhiteSpace):
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace):
+        (JSC::Lexer::isLineTerminator): Added some helper functions for examining
+        whitespace.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::appendSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString): When string-ifying a function, insert
+        a semicolon in the last non-whitespace position, if one doesn't already exist.
+
+2009-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Roll out r41022 as it breaks qt and gtk builds
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present):
+
+2009-02-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6468156>
+        REGRESSION (r36779): Adding link, images, flash in TinyMCE blocks entire page (21382)
+
+        No performance regression.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::fillArgList): Add codepath for when the "length" property has been
+        overridden.
+
+2009-02-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::):
+        (WTF::TCMallocStats::FastMallocZone::FastMallocZone):
+
+2009-02-16  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23787: Allow JIT to generate SSE2 code if using GCC
+        <https://bugs.webkit.org/show_bug.cgi?id=23787>
+
+        GCC version of the cpuid check.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present): GCC assembly code added.
+        6.6% progression on x86 Linux with JIT and WREC on SunSpider if using SSE2 capable machine.
+
+2009-02-13  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23960
+        Crash Fix.
+
+        Don't depend on 'initializeThreading()' to come before a call to 'isMainThread()'
+        as QtWebKit only calls 'initializeThreading()' during QWebPage construction.
+
+        A client app may well make a call to QWebSettings::iconForUrl() for instance
+        before creating a QWebPage and that call to QWebSettings triggers an
+        ASSERT(isMainThread()) deep within WebCore.
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::isMainThread):
+
+2009-02-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Some data in the instruction stream is potentially uninitialized - fix this.
+
+        Change the OperandTypes constructor so that uninitialized memory in the int
+        is zeroed, and modify the Instruction constructor taking an Opcode so that
+        if !HAVE(COMPUTED_GOTO) (i.e. when Opcode is an enum, and is potentially only
+        a byte) it zeros the Instruction first before writing the opcode.
+
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * parser/ResultType.h:
+        (JSC::OperandTypes::OperandTypes):
+
+2009-02-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix for non_JIT platforms.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setIsNumericCompareFunction):
+        (JSC::CodeBlock::isNumericCompareFunction):
+
+2009-02-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/6584057> Optimize sort by JS numeric comparison
+        function not to run the comparison function
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setIsNumericCompareFunction):
+        (JSC::CodeBlock::isNumericCompareFunction): Added the ability to track
+        whether a CodeBlock performs a sort-like numeric comparison.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Set the isNumericCompareFunction bit
+        after compiling.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::emitBytecode): Fixed a bug that caused us to
+        codegen an extra return at the end of all functions (eek!), since this
+        made it harder / weirder to detect the numeric comparison pattern in
+        bytecode.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort): Use the isNumericCompareFunction bit to do
+        a faster sort if we can.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody):
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h: Renamed and exported extractFunctionBody for
+        use in initializing lazyNumericCompareFunction.
+
+        * runtime/JSArray.cpp:
+        (JSC::compareNumbersForQSort):
+        (JSC::compareByStringPairForQSort):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        * runtime/JSArray.h: Added a fast numeric sort. Renamed ArrayQSortPair
+        to be more specific since we do different kinds of qsort now.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::numericCompareFunction):
+        (JSC::JSGlobalData::ClientData::~ClientData):
+        * runtime/JSGlobalData.h: Added helper data for computing the
+        isNumericCompareFunction bit.
+
+2009-02-13  Darin Adler  <darin@apple.com>
+
+        * Configurations/JavaScriptCore.xcconfig: Undo accidental commit of this file.
+
+2009-02-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt and Alexey Proskuryakov.
+
+        Speed up a couple string functions.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncIndexOf): Added a fast path for cases where the second
+        argument is either missing or an integer.
+        (JSC::stringProtoFuncBig): Use jsNontrivialString since the string is guaranteed
+        to be 2 or more characters long.
+        (JSC::stringProtoFuncSmall): Ditto.
+        (JSC::stringProtoFuncBlink): Ditto.
+        (JSC::stringProtoFuncBold): Ditto.
+        (JSC::stringProtoFuncItalics): Ditto.
+        (JSC::stringProtoFuncStrike): Ditto.
+        (JSC::stringProtoFuncSub): Ditto.
+        (JSC::stringProtoFuncSup): Ditto.
+        (JSC::stringProtoFuncFontcolor): Ditto.
+        (JSC::stringProtoFuncFontsize): Make the fast path Sam recently added even faster
+        by avoiding all but the minimum memory allocation.
+        (JSC::stringProtoFuncAnchor): Use jsNontrivialString.
+        (JSC::stringProtoFuncLink): Added a fast path.
+
+        * runtime/UString.cpp:
+        (JSC::UString::find): Added a fast path for single-character search strings.
+
+2009-02-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23926: Race condition in callOnMainThreadAndWait
+        <https://bugs.webkit.org/show_bug.cgi?id=23926>
+
+        * wtf/MainThread.cpp:
+        Removed callOnMainThreadAndWait since it isn't used.
+
+2009-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Math.random is really slow on windows.
+
+        Math.random calls WTF::randomNumber which is implemented as
+        the secure rand_s on windows.  Unfortunately rand_s is an order
+        of magnitude slower than arc4random.  For this reason I've
+        added "weakRandomNumber" for use by JavaScript's Math Object.
+        In the long term we should look at using our own secure PRNG
+        in place of the system, but this will do for now.
+
+        30% win on SunSpider on Windows, resolving most of the remaining
+        disparity vs. Mac.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom):
+        * wtf/RandomNumber.cpp:
+        (WTF::weakRandomNumber):
+        (WTF::randomNumber):
+        * wtf/RandomNumber.h:
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeWeakRandomNumberGenerator):
+
+2009-02-12  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build for other platforms.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2009-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove (/reduce) use of hard-wired register names from the JIT.
+        Currently there is no abstraction of registers used in the JIT,
+        which has a number of negative consequences.  Hard-wiring x86
+        register names makes the JIT less portable to other platforms,
+        and prevents us from performing dynamic register allocation to
+        attempt to maintain more temporary values in machine registers.
+        (The latter will be more important on x86-64, where we have more
+        registers to make use of).
+
+        Also, remove MacroAssembler::mod32.  This was not providing a
+        useful abstraction, and was not in keeping with the rest of the
+        MacroAssembler interface, in having specific register requirements.
+
+        * assembler/MacroAssemblerX86Common.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutVirtualRegister):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-12  Horia Olaru  <olaru@adobe.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23400
+
+        When throwing an exception within an eval argument string, the dst parameter was
+        modified in the functions below and the return value for eval was altered. Changed
+        the emitNode call in JSC::ThrowNode::emitBytecode to use a temporary register
+        to store its results instead of dst. The JSC::FunctionCallResolveNode::emitBytecode
+        would load the function within the dst registry, also altering the result returned
+        by eval. Replaced it with another temporary.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+
+2009-02-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Speed up String.prototype.fontsize.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize): Specialize for defined/commonly used values.
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Correctness fix.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Divide by the maximum representable value, which
+        is different on each platform now, to get values between 0 and 1.
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6582048>.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Make only one call to the random number generator
+        on platforms where the generator is cryptographically secure. The value
+        of randomness over and above cryptographically secure randomness is not
+        clear, and it caused some performance problems.
+
+2009-02-12  Adam Roben  <aroben@apple.com>
+
+        Fix lots of Perl warnings when building JavaScriptCoreGenerated on
+        Windows
+
+        Reviewed by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        Create the docs/ directory so that we can write bytecode.html into it.
+        This matches what JavaScriptCore.xcodeproj does.
+
+2009-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Lars.
+
+        Re-enable the JIT in the Qt build with -fno-stack-protector on Linux.
+
+        * JavaScriptCore.pri:
+
+2009-02-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23705
+        Fix the UI freeze caused by Worker generating a flood of messages.
+        Measure time we spend in executing posted work items. If too much time is spent
+        without returning to the run loop, exit and reschedule.
+
+        * wtf/MainThread.h:
+        Added initializeMainThreadPlatform() to initialize low-level mechanism for posting
+        work items from thread to thread. This removes #ifdefs for WIN and CHROMIUM from platform-independent code.
+
+        * wtf/MainThread.cpp:
+        (WTF::initializeMainThread):
+        (WTF::dispatchFunctionsFromMainThread):
+        Instead of dispatching all work items in the queue, dispatch them one by one
+        and measure elapsed time. After a threshold, reschedule and quit.
+
+        (WTF::callOnMainThread):
+        (WTF::callOnMainThreadAndWait):
+        Only schedule dispatch if the queue was empty - to avoid many posted messages in the run loop queue.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+        Use static instance of the mainThreadCaller instead of allocating and releasing it each time.
+        (WTF::initializeMainThreadPlatform):
+        * wtf/gtk/MainThreadChromium.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/gtk/MainThreadGtk.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/qt/MainThreadQt.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/wx/MainThreadWx.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2009-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Style cleanup.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::operator bool):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::ProcessorReturnAddress):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::operator void*):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+
+2009-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/AbstractMacroAssembler.h: Fix comments.
+
+2009-02-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Trying to fix wx build.
+
+        * bytecode/JumpTable.h: Include "MacroAssembler.h", not <MacroAssembler.h>.
+        * jscore.bkl: Added assembler directory to search paths.
+
+2009-02-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Build
+        fix.
+        (Narrow
+        changelog
+        for
+        dhyatt).
+
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+
+2009-02-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Reduce use of void* / reinterpret_cast in JIT repatching code,
+        add strong types for Calls and for the various types of pointers
+        we retain into the JIT generated instruction stream.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
+        (JSC::AbstractMacroAssembler::ImmPtr::asIntptr):
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::Call::link):
+        (JSC::AbstractMacroAssembler::Call::linkTo):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::operator bool):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::CodeLocationLabel):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::ProcessorReturnAddress):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::operator void*):
+        (JSC::AbstractMacroAssembler::PatchBuffer::entry):
+        (JSC::AbstractMacroAssembler::PatchBuffer::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::locationOf):
+        (JSC::AbstractMacroAssembler::PatchBuffer::returnAddressOffset):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::call):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getCallReturnOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::getStructureStubInfoReturnLocation):
+        (JSC::getCallLinkInfoReturnLocation):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::ctiForValue):
+        (JSC::SimpleJumpTable::ctiForValue):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::prepareJumpTableForStringSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_vm_throw):
+        * jit/JIT.cpp:
+        (JSC::ctiSetReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JIT::compileGetByIdSelf):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdReplace):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        (JSC::JIT::emitCTICall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitCTICall_internal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-10  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r40813
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Added profiler/ to the include
+        path so that Profiler.h can be found.
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Provide a class type for a generated block of JIT code.
+        Also changes the return address -> bytecode index map to
+        track the return addess as an unsigned offset into the code
+        instead of a ptrdiff_t in terms of void**s - the latter is
+        equal to the actual offset / sizeof(void*), making it a
+        potentially lossy representation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::returnAddressOffset):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getCallReturnOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CallReturnOffsetToBytecodeIndex::CallReturnOffsetToBytecodeIndex):
+        (JSC::getCallReturnOffset):
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::callReturnIndexVector):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::):
+        * jit/JITCall.cpp:
+        (JSC::JIT::linkCall):
+        * jit/JITCode.h: Added.
+        (JSC::):
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::operator bool):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+
+2009-02-09  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23856
+        Change the definition of "main thread" for Chromium on OSX.
+        It does not match the DARWIN definition.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Minor bugfix, incorrect check meant that subtraction causing integer overflow
+        would be missed on x86-64 JIT.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A more sensible register allocation for x86-64.
+
+        When WREC was ported to x86-64 it stuck with the same register allocation as x86.
+        This requires registers to be reordered on entry into WREC generated code, since
+        argument passing is different on x86-64 and x86 (regparm(3)).  This patch switches
+        x86-64 to use a native register allocation, that does not require argument registers
+        to be reordered.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+
+2009-02-05  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        Rubberstamped by Sam Weinig.
+
+        * wtf/TypeTraits.h: Include Platform.h, since this header uses macros
+        defined there.
+
+2009-02-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23747
+        Add Chromium threading-related files.
+
+        * wtf/MainThread.cpp: Added platform guard to initializeMainThread.
+        * wtf/chromium/ChromiumThreading.h: Added.
+        * wtf/chromium/MainThreadChromium.cpp: Added.
+        (WTF::initializeMainThread):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-02-05  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23713: COMPILE_ASSERTS should be moved out of TypeTraits.h and into .cpp file
+        <https://bugs.webkit.org/show_bug.cgi?id=23713>
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+        * wtf/HashTraits.h:
+        Remove unnecessary header file that I missed when moving out the type traits form this file.
+
+        * wtf/TypeTraits.cpp: Added.
+        (WTF::):
+        * wtf/TypeTraits.h:
+        Moved the compile asserts into TypeTraits.cpp file.
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver 'the nun' Hunt.
+
+        Add -e switch to jsc to enable evaluation of scripts passed on the command line.
+
+        * jsc.cpp:
+        (Script::Script):
+        (runWithScripts):
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam 'Big Mac' Weinig.
+
+        * assembler/AbstractMacroAssembler.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86Common.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86_64.h: Copied from assembler/MacroAssembler.h.
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        This patch tidies up the MacroAssembler, cleaning up the code and refactoring out the
+        platform-specific parts.  The MacroAssembler gets split up like a beef burger, with the
+        platform-agnostic data types being the lower bun (in the form of the class AbstractMacroAssembler),
+        the plaform-specific code generation forming a big meaty patty of methods like 'add32',
+        'branch32', etc (MacroAssemblerX86), and finally topped off with the bun-lid of the
+        MacroAssembler class itself, providing covenience methods such as the stack peek & poke,
+        and backwards branch methods, all of which can be described in a platform independent
+        way using methods from the base class.  The AbstractMacroAssembler is templated on the
+        type of the assembler class that will be used for code generation, and the three layers
+        are held together with the cocktail stick of inheritance.
+
+        The above description is a slight simplification since the MacroAssemblerX86 is actually
+        formed from two layers (in effect giving us a kind on bacon double cheeseburger) - with the
+        bulk of methods that are common between x86 & x86-64 implemented in MacroAssemblerX86Common,
+        which forms a base class for MacroAssemblerX86 and MacroAssemblerX86_64 (which add the methods
+        specific to the given platform).
+
+        I'm landing these changes first without splitting the classes across multiple files,
+        I will follow up with a second patch to split up the file MacroAssembler.h.
+
+        * assembler/MacroAssembler.h:
+        (JSC::AbstractMacroAssembler::):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::patch):
+        (JSC::AbstractMacroAssembler::DataLabel32::DataLabel32):
+        (JSC::AbstractMacroAssembler::DataLabel32::patch):
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::Jump::patch):
+        (JSC::AbstractMacroAssembler::JumpList::link):
+        (JSC::AbstractMacroAssembler::JumpList::linkTo):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::addressOf):
+        (JSC::AbstractMacroAssembler::PatchBuffer::setPtr):
+        (JSC::AbstractMacroAssembler::size):
+        (JSC::AbstractMacroAssembler::copyCode):
+        (JSC::AbstractMacroAssembler::label):
+        (JSC::AbstractMacroAssembler::align):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::swap):
+        (JSC::MacroAssemblerX86Common::signExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::jump):
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::sub32):
+        (JSC::MacroAssemblerX86_64::load32):
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        (JSC::MacroAssemblerX86_64::andPtr):
+        (JSC::MacroAssemblerX86_64::orPtr):
+        (JSC::MacroAssemblerX86_64::rshiftPtr):
+        (JSC::MacroAssemblerX86_64::subPtr):
+        (JSC::MacroAssemblerX86_64::xorPtr):
+        (JSC::MacroAssemblerX86_64::loadPtr):
+        (JSC::MacroAssemblerX86_64::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        (JSC::MacroAssemblerX86::add32):
+        (JSC::MacroAssemblerX86::sub32):
+        (JSC::MacroAssemblerX86::load32):
+        (JSC::MacroAssemblerX86::store32):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::peek):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::branch16):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::rshiftPtr):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::branchAddPtr):
+        (JSC::MacroAssembler::branchSubPtr):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-04  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23681
+        Worker tests crash in debug builds if run --singly
+
+        The crash happened because worker threads continued running while debug-only static objects
+        were already being destroyed on main thread.
+
+        * runtime/Structure.cpp: Create static debug-only sets in heap, so that they don't get
+        destroyed.
+
+        * wtf/ThreadingPthreads.cpp: Changed assertions to conventional form.
+
+2009-02-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23715
+
+        Simplify MacroAssembler interface, by combining comparison methods.
+        Seprate operations are combined as follows:
+            jz32/jnz32/jzPtr/jnzPtr -> branchTest32/branchTestPtr,
+            j*(Add|Mul|Sub)32/j*(Add|Mul|Sub)Ptr -> branch(Add|Mul|Sub)32/branch(Add|Mul|Sub)Ptr
+            j*32/j*Ptr (all other two op combparisons) -> branch32/brnachPtr
+            set*32 -> set32
+
+        Also, represent the Scale of BaseIndex addresses as a plain enum (0,1,2,3),
+        instead of as multiplicands (1,2,4,8).
+
+        This patch singificantly reduces replication of code, and increases functionality supported
+        by the MacroAssembler.  No performance impact.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branchPtrWithPatch):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::branch16):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::branchTest32):
+        (JSC::MacroAssembler::branchAddPtr):
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        (JSC::MacroAssembler::branchSubPtr):
+        (JSC::MacroAssembler::branchSub32):
+        (JSC::MacroAssembler::set32):
+        (JSC::MacroAssembler::setTest32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::jccRel32):
+        (JSC::X86Assembler::setccOpcode):
+        (JSC::X86Assembler::cmpq_mr):
+        (JSC::X86Assembler::setcc_r):
+        (JSC::X86Assembler::sete_r):
+        (JSC::X86Assembler::setne_r):
+        (JSC::X86Assembler::jne):
+        (JSC::X86Assembler::je):
+        (JSC::X86Assembler::jl):
+        (JSC::X86Assembler::jb):
+        (JSC::X86Assembler::jle):
+        (JSC::X86Assembler::jbe):
+        (JSC::X86Assembler::jge):
+        (JSC::X86Assembler::jg):
+        (JSC::X86Assembler::ja):
+        (JSC::X86Assembler::jae):
+        (JSC::X86Assembler::jo):
+        (JSC::X86Assembler::jp):
+        (JSC::X86Assembler::js):
+        (JSC::X86Assembler::jcc):
+        (JSC::X86Assembler::X86InstructionFormatter::putModRmSib):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoadCharacter):
+        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacterPair):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Fix a bug in Vector's shrinkCapacity method.  It did not properly copy elements into the inline buffer
+        when shrinking down from a size that was greater than the inline capacity.
+
+        Reviewed by Maciej
+
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::VectorBuffer):
+        (WTF::VectorBuffer::allocateBuffer):
+
+2009-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added accessor for JSByteArray storage.
+
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::storage):
+
+2009-02-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23560
+        Implement SharedTimer on WorkerRunLoop
+
+        * JavaScriptCore.exp:
+        Forgot to expose ThreadCondition::timedWait() in one of previous patches.
+
+2009-02-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21414> REGRESSION: Regular Expressions and character classes, shorthands and ranges
+        <rdar://problem/6543487>
+
+        In certain circumstances when WREC::Generator::generateCharacterClassInvertedRange invokes
+        itself recursively, it will incorrectly emit (and thus consume) the next single character
+        match in the current character class.  As WREC uses a binary search this out of sequence
+        codegen could result in a character match being missed and so cause the regex to produce
+        incorrect results.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23676: Speed up uses of reserveCapacity on new vectors by adding a new reserveInitialCapacity
+        https://bugs.webkit.org/show_bug.cgi?id=23676
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCopyPropertyNames): Use reserveInitialCapacity.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Ditto.
+        (JSC::Lexer::clear): Ditto.
+
+        * wtf/Vector.h: Added reserveInitialCapacity, a more efficient version of
+        reserveCapacity for use when the vector is brand new (still size 0 with no
+        capacity other than the inline capacity).
+
+2009-01-30  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        <rdar://problem/6391501> Enable the JIT on Mac OS X x86_64 as it passes all tests.
+
+        * wtf/Platform.h:
+
+2009-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe and Sam Weinig.
+
+        Finally fix load() to propagate exceptions correctly.
+
+        * jsc.cpp:
+        (functionLoad):
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23618
+        Templated worker tasks should be more error proof to use.
+        Fix Chromium build.
+
+        * wtf/TypeTraits.h:
+        (WTF::IsConvertibleToInteger::IsConvertibleToDouble):
+        Avoid "possible loss of data" warning when using Microsoft's C++ compiler
+        by avoiding an implicit conversion of int types to doubles.
+
+2009-01-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Bug 23580: GNU mode RVCT compilation support
+        <https://bugs.webkit.org/show_bug.cgi?id=23580>
+
+        * pcre/pcre_exec.cpp: Use COMPILER(GCC) instead of __GNUC__.
+        * wtf/FastMalloc.cpp: Ditto.
+        (WTF::TCMallocStats::):
+        * wtf/Platform.h: Don't define COMPILER(GCC) with RVCT --gnu.
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23618: Templated worker tasks should be more error proof to use
+        <https://bugs.webkit.org/show_bug.cgi?id=23618>
+
+        Add the type traits needed for the generic worker tasks
+        and compile asserts for them.
+
+        Add a summary header to the TypeTraits.h file to explain what is in there.
+
+        Add a note to explain IsPod's deficiencies.
+
+        * wtf/TypeTraits.h:
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23616: Various "template helpers" should be consolidated from isolated files in JavaScriptCore.
+        <https://bugs.webkit.org/show_bug.cgi?id=23616>
+
+        * wtf/TypeTraits.h: Moved RemovePointer, IsPod, IsInteger to this file.
+
+        * wtf/OwnPtr.h: Use RemovePointer from TypeTraits.h.
+        * wtf/RetainPtr.h:  Ditto.
+
+        * wtf/HashTraits.h: Use IsInteger from TypeTraits.h.
+
+        * wtf/VectorTraits.h: Use IsPod from TypeTraits.h.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added TypeTraits.h.
+
+2009-01-29  Stephanie Lewis <slewis@apple.com>
+
+        RS by Oliver Hunt.
+
+        Update the order files.
+
+        * JavaScriptCore.order:
+
+2009-01-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23551: Crash on page load with profiler enabled and running
+        <https://bugs.webkit.org/show_bug.cgi?id=23551>
+        <rdar://problem/6529521>
+
+        Interpreter::execute(FunctionBodyNode*, ...) calls Profiler::didExecute()
+        with a stale CallFrame. If some part of the scope chain has already been
+        freed, Profiler::didExecute() will crash when attempting to get the lexical
+        global object. The fix is to make the didExecute() call use the caller's
+        CallFrame, not the one made for the function call. In this case, the
+        willExecute() call should also be changed to match.
+
+        Since this occurs in the actual inspector JS, it is difficult to reduce.
+        I couldn't make a layout test.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for <rdar://problem/6525537>
+        Hang occurs when closing Installer window (iTunes, Aperture)
+
+        * JavaScriptCore.exp: Export JSGlobalData::sharedInstance.
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Initial patch by Mark Rowe.
+
+        <rdar://problem/6519356>
+        REGRESSION (r36006): "out of memory" alert running dromaeo on Windows
+
+        Report the cost of the ArrayStorage vector more accurately/often.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Report the extra cost even for a filled array
+        because JSString using the single character optimization and immediates
+        wont increase the cost themselves. 
+        (JSC::JSArray::putSlowCase): Update the cost when increasing the size of
+        the array.
+        (JSC::JSArray::increaseVectorLength): Ditto.
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Fix for <rdar://problem/6129678>
+        REGRESSION (Safari 3-4): Local variable not accessible from Dashcode console or variables view
+
+        Iterating the properties of activation objects accessed through the WebKit debugging
+        APIs was broken by forced conversion of JSActivation to the global object. To fix this,
+        we use a proxy activation object that acts more like a normal JSObject.
+
+        * debugger/DebuggerActivation.cpp: Added.
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::mark):
+        (JSC::DebuggerActivation::className):
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putWithAttributes):
+        (JSC::DebuggerActivation::deleteProperty):
+        (JSC::DebuggerActivation::getPropertyNames):
+        (JSC::DebuggerActivation::getPropertyAttributes):
+        (JSC::DebuggerActivation::defineGetter):
+        (JSC::DebuggerActivation::defineSetter):
+        (JSC::DebuggerActivation::lookupGetter):
+        (JSC::DebuggerActivation::lookupSetter):
+        * debugger/DebuggerActivation.h: Added.
+        Proxy JSActivation object for Debugging.
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::isActivationObject): Added.
+        * runtime/JSObject.h:
+        (JSC::JSObject::isActivationObject): Added.
+
+2009-01-28  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23490: Remove initialRefCount argument from RefCounted class
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23490>
+
+        Reviewed by Darin Adler.
+
+        RefCountedBase now always starts with a ref count of 1, so there
+        is no need to pass the initialRefCount into the class anymore.
+
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::ByteArray): Removed call to RefCounted(1).
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::RefCountedBase): Changed to start with a
+        ref count of 1.
+        (WTF::RefCounted::RefCounted): Removed initialRefCount argument
+        and removed call to RefCounted(1).
+
+2009-01-26  Adele Peterson  <adele@apple.com>
+
+        Build fix.  
+
+        * debugger/Debugger.cpp:
+
+2009-01-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes for eq null & neq null, on 64-bit JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=23559
+
+        This patch degrades 64-bit JIT performance on some benchmarks,
+        due to the whole not-being-incorrect thing.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-01-26  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 23552: Dashcode evaluator no longer works after making ExecStates actual call frames
+        <https://bugs.webkit.org/show_bug.cgi?id=23552>
+        <rdar://problem/6398839>
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame): Added so that WebScriptCallFrame can
+        evaluate JS starting from a global call frame.
+        * debugger/Debugger.h:
+
+2009-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Improve the consistency of settings in our .xcconfig files.
+
+        * Configurations/Base.xcconfig: Enable GCC_OBJC_CALL_CXX_CDTORS to match other projects.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Turn on the following warnings:
+
+            -Wcast-qual
+            -Wextra-tokens
+            -Wformat=2
+            -Winit-self
+            -Wmissing-noreturn
+            -Wpacked
+            -Wrendundant-decls
+
+        * Configurations/Base.xcconfig: Added the new warnings. Switched to -Wextra instead of
+        -W for clarity since we don't have to support the older versions of gcc that require the
+        old -W syntax. Since we now use -Wformat=2, removed -Wformat-security. Also removed
+        -Wno-format-y2k since we can have that one on now.
+
+2009-01-25  Judit Jasz  <jasy@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+        
+        Compilation problem fixing 
+        http://bugs.webkit.org/show_bug.cgi?id=23497
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall): Use JSValuePtr::encode.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Fourth patch: Deal with the last few stray warnings.
+
+        * parser/Parser.cpp: Only declare jscyyparse if it's not already declared.
+        This makes both separate compilation and all-in-one compilation work with the
+        -Wredundant-decls warning.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Third patch: Use the noreturn attribute on functions that don't
+        return to prepare for the use of the -Wmissing-noreturn warning.
+
+        * jit/JITCall.cpp:
+        (JSC::unreachable): Added NO_RETURN.
+        * jsc.cpp:
+        (functionQuit): Ditto.
+        (printUsageStatement): Ditto.
+        * wtf/AlwaysInline.h: Added definition of NO_RETURN.
+
+2009-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Force inlining of Lexer::matchPunctuator
+
+        2.2% win when parsing jQuery, Mootools, Prototype, etc
+
+        * parser/Lexer.h:
+
+2009-01-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix for <rdar://problem/6126212>
+        Ensure that callbacks out from the JSC interface are only allowed
+        to return in reverse-chronological order to that in which they were
+        made.  If we allow earlier callbacks to return first, then this may
+        result in setions of the RegisterFile in use by another thread
+        being trampled.
+
+        See uber-comment in JSLock.h for details.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+
+2009-01-23  Darin Adler  <darin@apple.com>
+
+        Try to fix WX build.
+
+        * runtime/JSGlobalObjectFunctions.h: Include <wtf/unicode/Unicode.h>
+        for the definition of UChar.
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        * Configurations/Base.xcconfig:
+        GCC 4.0 build fix.
+        
+        * runtime/JSNumberCell.h:
+        64-bit build fix.
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Turn on -Wmissing-prototypes and fix the warnings.
+        
+        * API/JSClassRef.cpp:
+        (clearReferenceToPrototype):
+        * Configurations/Base.xcconfig:
+        * runtime/Collector.cpp:
+        (JSC::getPlatformThreadRegisters):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSNumberCell.h:
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::createRep):
+        * wtf/FastMalloc.cpp:
+        * wtf/Threading.cpp:
+
+2009-01-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Disable GCC_WARN_ABOUT_MISSING_PROTOTYPES temporarily.
+
+        Current versions of Xcode only respect it for C and Objective-C files,
+        and our code doesn't currently compile if it is applied to C++ and
+        Objective-C++ files.
+
+        * Configurations/Base.xcconfig:
+
+2009-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23489
+        
+        Return currentTime() in correct units for the two early return cases.
+
+        Reviewed by Mark Rowe.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2009-01-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/6439247>
+        FastMalloc allocating an extra 4MB of meta-data on 64-bit
+
+        Rely on the fact that on all known x86-64 platforms only use 48 bits of
+        address space to shrink the initial size of the PageMap from ~4MB to 120K.
+        For 64-bit we still use a 3-level radix tree, but now each level is only 12
+        bits wide.
+
+        No performance change.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::MapSelector): Add specialization for 64 bit that takes into account the
+        16 bits of unused address space on x86-64.
+
+2009-01-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23461 LayoutTests/
+        fast/js/numeric-conversion.html is broken, and corresponding 
+        <rdar://problem/6514842>
+
+        The basic problem here is that parseInt(Infinity) should be NaN, 
+        but we were returning 0. NaN matches Safari 3.2.1 and Firefox.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-01-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6516853> (r39682-r39736) JSFunFuzz: crash on "(function(){({ x2: x }), })()"
+        <https://bugs.webkit.org/show_bug.cgi?id=23479>
+
+        Automatic semicolon insertion was resulting in this being accepted in the initial
+        nodeless parsing, but subsequent reparsing for code generation would fail, leading
+        to a crash.  The solution is to ensure that reparsing a function performs parsing
+        in the same state as the initial parse.  We do this by modifying the saved source
+        ranges to include rather than exclude the opening and closing braces.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): add an assertion for successful recompile
+        * parser/Lexer.h:
+        (JSC::Lexer::sourceCode): include rather than exclude braces.
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::toSourceString):  No need to append braces anymore.
+
+2009-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23373
+
+        Implement ThreadCondition::timedWait().
+        Since we borrow the code for condition variables from other sources,
+        I did the same for timedWait(). See comments in ThreadingWin.cpp for
+        rationale and more info.
+
+        * wtf/CONTRIBUTORS.pthreads-win32: 
+        Added. A list of Pthreads-win32 contributors mentioned in their license. The license itself
+        is included into wtf/ThreadingWin32.cpp.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingWin.cpp:
+        Additional info and Pthreads-win32 license at the beginning.
+        (WTF::PlatformCondition::timedWait): new method, derived from Pthreads-win32.
+        (WTF::PlatformCondition::signal): same
+        (WTF::ThreadCondition::ThreadCondition):
+        (WTF::ThreadCondition::~ThreadCondition):
+        (WTF::ThreadCondition::wait): this now calls PlatformCondition::timedWait.
+        (WTF::ThreadCondition::timedWait): same
+        (WTF::ThreadCondition::signal): this now calls PlatformCondition::signal.
+        (WTF::ThreadCondition::broadcast): same
+
+2009-01-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23469.
+
+        We need to check all numbers in integer switches, not just those
+        represented as integer JSImmediates.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_switch_imm):
+
+2009-01-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23468.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-01-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Suggested by Oliver Hunt. Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23456
+        Function argument names leak
+
+        * parser/Nodes.cpp: (JSC::FunctionBodyNode::~FunctionBodyNode): Destruct parameter names.
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2009-01-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Structure property table deleted offset maps are being leaked.
+        Probably shouldn't be doing that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23442
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Attempt to fix gtk build
+
+        * GNUmakefile.am:
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Add back the initialization to fix the build.
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        First patch: Fix some simple cases of various warnings.
+
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile): Use const_cast to change const-ness.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Remove unneeded initialization and
+        use UChar instead of unsigned short for UTF-16 values.
+
+        * wtf/dtoa.cpp:
+        (WTF::strtod): Use const_cast to change const-ness.
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Whoops, remove runtime/ByteArray references from .pri and .scons builds, update .bkl
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCoreSources.bkl:
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        RS=Dan Bernstein.
+
+        Move runtime/ByteArray to wtf/ByteArray
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSByteArray.cpp:
+        * runtime/JSByteArray.h:
+        * wtf/ByteArray.cpp: Renamed from JavaScriptCore/runtime/ByteArray.cpp.
+        (WTF::ByteArray::create):
+        * wtf/ByteArray.h: Renamed from JavaScriptCore/runtime/ByteArray.h.
+        (WTF::ByteArray::length):
+        (WTF::ByteArray::set):
+        (WTF::ByteArray::get):
+        (WTF::ByteArray::data):
+        (WTF::ByteArray::deref):
+        (WTF::ByteArray::ByteArray):
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Remove temporary operator-> from JSValuePtr.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrototype):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::CodeBlock::mark):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::keyForImmediateSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::throwException):
+        (JSC::cachePrototypeChain):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSArray):
+        (JSC::Interpreter::isJSString):
+        (JSC::Interpreter::isJSByteArray):
+        * interpreter/Register.h:
+        (JSC::Register::marked):
+        (JSC::Register::mark):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionRun):
+        (functionLoad):
+        (runWithScripts):
+        (runInteractive):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        (JSC::Heap::collect):
+        (JSC::typeName):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::internalNumber):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        (JSC::createErrorMessage):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toObject):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        (JSC::JSArray::mark):
+        (JSC::JSArray::sort):
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::setIndex):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::construct):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::lastInPrototypeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSValuePtr::get):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::mark):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::constructWithStringConstructor):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::createCachedPrototypeChain):
+        * runtime/Structure.h:
+        (JSC::Structure::mark):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+
+2009-01-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23409: REGRESSION: RegExp 'replace()' function improperly processes '$$'
+        <https://bugs.webkit.org/show_bug.cgi?id=23409>
+        <rdar://problem/6505723>
+
+        Test: fast/js/string-replace-3.html
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Remove code that adds an extra $ -- not sure
+        how this ever worked.
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        On x86-64 jit, cache JSImmedate::TagMask & JSImmedate::TagTypeNumber in
+        registers, save reloading them every time they're used.
+
+        Draws x86-64 jit performance close to that of i386 jit.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support to x86-64 JIT for inline double precision arithmetic ops.
+        +5/6% on x86-64, JIT enabled, sunspider.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_rr):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileFastArithSlow_op_sub):
+        * parser/ResultType.h:
+        (JSC::ResultType::isReusable):
+        (JSC::ResultType::isInt32):
+        (JSC::ResultType::definitelyIsNumber):
+        (JSC::ResultType::mightBeNumber):
+        (JSC::ResultType::isNotNumber):
+        (JSC::ResultType::unknownType):
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fixes for SamplingTool.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23390
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::encodeSample):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::samplingToolTrackCodeBlock):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitCTICall_internal):
+
+2009-01-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/6452301> REGRESSION: Latest WebKit nightlies
+        turn "c" into "" when stripping \\c_ character
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeEscape): Mimic a Firefox quirk when parsing
+        control escapes inside character classes.
+
+2009-01-16  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses): Removed unreachable code.
+
+2009-01-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6471394> REGRESSION (r39164): Discarding quantifier
+        on assertion gives incorrect result (23075)
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23075
+
+        * pcre/pcre_compile.cpp:
+        (compileBranch): Throw away an assertion if it's followed by a quantifier
+        with a 0 minimum, to match SpiderMonkey, v8, and the ECMA spec.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses): Fall back on PCRE for the rare
+        case of an assertion with a quantifier with a 0 minimum, since we
+        don't handle quantified subexpressions yet, and in this special case,
+        we can't just throw away the quantifier.
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support in ResultType to track that the results of bitops
+        are always of type int32_t.
+
+        * parser/Nodes.cpp:
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::BooleanNode::):
+        (JSC::NumberNode::):
+        (JSC::StringNode::):
+        (JSC::PrePostResolveNode::):
+        (JSC::TypeOfResolveNode::):
+        (JSC::TypeOfValueNode::):
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        (JSC::LogicalOpNode::):
+        * parser/ResultType.h:
+        (JSC::ResultType::isInt32):
+        (JSC::ResultType::isNotNumber):
+        (JSC::ResultType::booleanType):
+        (JSC::ResultType::numberType):
+        (JSC::ResultType::numberTypeCanReuse):
+        (JSC::ResultType::numberTypeCanReuseIsInt32):
+        (JSC::ResultType::stringOrNumberTypeCanReuse):
+        (JSC::ResultType::stringType):
+        (JSC::ResultType::unknownType):
+        (JSC::ResultType::forAdd):
+        (JSC::ResultType::forBitOp):
+        (JSC::OperandTypes::OperandTypes):
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support for integer addition, subtraction and multiplication
+        in JIT code on x86-64.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::mul32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::joMul32):
+        (JSC::MacroAssembler::joSub32):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileFastArithSlow_op_sub):
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        On x86-64 allow JSImmediate to encode 64-bit double precision values.
+        This patch only affects builds that set USE(ALTERNATE_JSIMMEDIATE).
+        Updates the implementation of JSValuePtr:: and JSImmediate:: methods
+        that operate on neumeric values to be be aware of the new representation.
+        When this representation is in use, the class JSNumberCell is redundant
+        and is compiled out.
+
+        The format of the new immediate representation is documented in JSImmediate.h.
+
+        * JavaScriptCore.exp:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::subPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::subq_rr):
+        (JSC::X86Assembler::movq_rr):
+        (JSC::X86Assembler::ucomisd_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::twoByteOp64):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfBothJSCells):
+        (JSC::JIT::emitJumpIfEitherNumber):
+        (JSC::JIT::emitJumpIfNotEitherNumber):
+        (JSC::JIT::emitJumpIfImmediateIntegerNumber):
+        (JSC::JIT::emitJumpIfNotImmediateIntegerNumber):
+        (JSC::JIT::emitJumpIfNotImmediateIntegerNumbers):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateIntegerNumber):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateIntegerNumbers):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::wtf_reinterpret_cast):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDoubleNumber):
+        (JSC::JSImmediate::isPositiveIntegerNumber):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::doubleToBoolean):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::makeOutOfIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::JSValuePtr::isInt32Fast):
+        (JSC::JSValuePtr::isUInt32Fast):
+        (JSC::JSValuePtr::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsNumberCell):
+        * runtime/JSNumberCell.h:
+        (JSC::createNumberStructure):
+        (JSC::isNumberCell):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValuePtr::isDoubleNumber):
+        (JSC::JSValuePtr::getDoubleNumber):
+        (JSC::JSValuePtr::isNumber):
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::jsNaN):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::numberToInt32):
+        (JSC::JSValuePtr::numberToUInt32):
+        * runtime/JSValue.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equal):
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * wtf/Platform.h:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/6045018>
+        REGRESSION (r34838): JavaScript objects appear to be leaked after loading google.com
+
+        Subtract the number of JSStrings cached in SmallStrings when calculating the
+        number of live JSObjects.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::objectCount):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::count):
+        * runtime/SmallStrings.h:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * runtime/Collector.cpp:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix crash seen running fast/canvas.
+
+        Make sure to mark the ScopeNode and CodeBlock being created
+        in the re-parse for exception information.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::mark):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2009-01-15  Craig Schlenter  <craig.schlenter@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23347
+        Compilation of JavaScriptCore/wtf/ThreadingPthreads.cpp fails on Linux
+
+        * wtf/ThreadingPthreads.cpp: included limits.h as INT_MAX is defined there.
+
+2009-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
+        <https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>
+
+        Character position for open and closing brace was incorrectly referencing m_position to
+        record their position in a source document, however this is unsafe as BOMs may lead to
+        m_position being an arbitrary position from the real position of the current character.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::matchPunctuator):
+
+2009-01-14  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23153: JSC build always touches JavaScriptCore/docs/bytecode.html
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23153>
+
+        Reviewed by Darin Adler.
+
+        Instead of building bytecode.html into ${SRCROOT}/docs/bytecode.html, build it
+        into ${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs/bytecode.html.
+
+        Also fixes make-bytecode-docs.pl to actually generate documentation.
+
+        * DerivedSources.make: Changed bytecode.html to be built into local docs
+        directory in ${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added "/docs" to the end of the
+        "mkdir -p" command so that the docs subdirectory is automatically created.
+        * docs/make-bytecode-docs.pl: Changed BEGIN_OPCODE to DEFINE_OPCODE so that
+        documentation is actually generated.
+
+2009-01-14  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix for Qt from Dmitry Titov.
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+2009-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 22903: REGRESSION (r36267): visiting this site reliably crashes WebKit nightly
+
+        EvalCodeBlock's do not reference the functions that are declared inside the eval
+        code, this means that simply marking the EvalCodeBlock through the global object
+        is insufficient to mark the declared functions.  This patch corrects this by
+        explicitly marking the CodeBlocks of all the functions declared in the cached
+        EvalNode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::mark):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasFunctions):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::mark):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::mark):
+        (JSC::EvalNode::mark):
+        * parser/Nodes.h:
+
+2009-01-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23312
+        Implement MessageQueue::waitForMessageTimed()
+        Also fixed ThreadCondition::timedWait() to take absolute time, as discussed on webkit-dev.
+        Win32 version of timedWait still has to be implemented.
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueueWaitResult: new enum for the result of MessageQueue::waitForMessageTimed.
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageTimed): New method.
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        (WTF::ThreadCondition::timedWait): changed to use absolute time instead of interval.
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait): ditto. The actual Win32 code is still to be implemented.
+
+2009-01-14  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Darin Adler and Oliver hunt.
+
+        Correctly match allocation functions by implementing a custom deref().
+
+        https://bugs.webkit.org/show_bug.cgi?id=23315
+
+        * runtime/ByteArray.h:
+        (JSC::ByteArray::deref):
+        (JSC::ByteArray::ByteArray):
+
+2009-01-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - update copyright
+
+        * Info.plist:
+
+2009-01-13  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler and Oliver Hunt.
+
+        <rdar://problem/6489314> REGRESSION: Business widget's front side 
+        fails to render correctly when flipping widget
+
+        The problem here is that parseInt was parsing NaN as 0. This patch 
+        corrects that by parsing NaN as NaN. This matches our old behavior 
+        and Firefox. 
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for: https://bugs.webkit.org/show_bug.cgi?id=23292
+
+        Implementation of two argument canDoFastAdditiveOperations does not correlate well with reality.
+
+        * runtime/JSImmediate.h:
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+
+2009-01-13  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23290
+        Fix JSImmediate::isImmediate(src) to !src->isCell()
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-01-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23281
+        Fix the Chromium Win build.
+        Need to use PLATFORM(WIN_OS) instead of PLATFORM(WIN).
+        Moved GTK and WX up in #if sequence because they could come with WIN_OS too,
+        while they have their own implementation even on Windows.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2009-01-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make the JSImmediate interface private.
+
+        All manipulation of JS values should be through the JSValuePtr class, not by using JSImmediate
+        directly.  The key missing methods on JSValuePtr are:
+
+            * isCell() - check for values that are JSCell*s, and as such where asCell() may be used.
+            * isInt32Fast() getInt32Fast() - fast check/access for integer immediates.
+            * isUInt32Fast() getUInt32Fast() - ditto for unsigned integer immediates.
+
+        The JIT is allowed full access to JSImmediate, since it needs to be able to directly
+        manipulate JSValuePtrs.  The Interpreter is provided access to perform operations directly
+        on JSValuePtrs through the new JSFastMath interface.
+
+        No performance impact.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toNumber):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::jsIsObjectType):
+        (JSC::cachePrototypeChain):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_vm_throw):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSArray):
+        (JSC::Interpreter::isJSString):
+        (JSC::Interpreter::isJSByteArray):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JSC::JIT::isStrictEqCaseHandledInJITCode):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlot):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSValuePtr::isNumberCell):
+        (JSC::JSValuePtr::asCell):
+        (JSC::JSValuePtr::isNumber):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        * runtime/JSImmediate.h:
+        (JSC::js0):
+        (JSC::jsImpossibleValue):
+        (JSC::JSValuePtr::toInt32):
+        (JSC::JSValuePtr::toUInt32):
+        (JSC::JSValuePtr::isCell):
+        (JSC::JSValuePtr::isInt32Fast):
+        (JSC::JSValuePtr::getInt32Fast):
+        (JSC::JSValuePtr::isUInt32Fast):
+        (JSC::JSValuePtr::getUInt32Fast):
+        (JSC::JSValuePtr::makeInt32Fast):
+        (JSC::JSValuePtr::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::equal):
+        (JSC::JSFastMath::notEqual):
+        (JSC::JSFastMath::andImmediateNumbers):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::orImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        (JSC::JSFastMath::incImmediateNumber):
+        (JSC::JSFastMath::decImmediateNumber):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValuePtr::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::JSNumberCell::toInt32):
+        (JSC::JSNumberCell::toUInt32):
+        (JSC::JSValuePtr::toJSNumber):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::numberToInt32):
+        (JSC::JSValuePtr::numberToUInt32):
+        * runtime/JSObject.h:
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::get):
+        (JSC::JSValuePtr::put):
+        * runtime/JSValue.cpp:
+        (JSC::JSValuePtr::toInteger):
+        (JSC::JSValuePtr::toIntegerPreserveNaN):
+        * runtime/JSValue.h:
+        * runtime/Operations.cpp:
+        (JSC::JSValuePtr::equalSlowCase):
+        (JSC::JSValuePtr::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equal):
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        * runtime/Structure.cpp:
+        (JSC::Structure::createCachedPrototypeChain):
+
+2009-01-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Since date time functions have moved here, now the wx port JSC
+        needs to depend on wx.
+
+        * jscore.bkl:
+
+2009-01-11  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23245
+
+        Add initializeThreading to key places in JS API to ensure that
+        UString is properly initialized.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        (JSGlobalContextCreate):
+        * API/JSObjectRef.cpp:
+        (JSClassCreate):
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        (JSStringCreateWithUTF8CString):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-01-11  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Separate out BaseString information from UString::Rep and make all baseString access go through
+        a member function, so that it may be used for something else (in the future) in the BaseString
+        case.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::mark):
+        Adjust to account for the changes in UString and put the UString in place in
+        SmallStringsStorage to aid in locality of reference among the UChar[] and UString::Rep's.
+
+        * runtime/SmallStrings.h:
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::destroy):
+        (JSC::UString::Rep::checkConsistency):
+        (JSC::expandCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::concatenate):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::baseIsSelf):
+        (JSC::UString::Rep::setBaseString):
+        (JSC::UString::Rep::baseString):
+        (JSC::UString::Rep::):
+        (JSC::UString::Rep::null):
+        (JSC::UString::Rep::empty):
+        (JSC::UString::Rep::data):
+        (JSC::UString::cost):
+        Separate out the items out used by base strings from those used in Rep's that only
+        point to base strings.  (This potentially saves 24 bytes per Rep.)
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23239: improve handling of unused arguments in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=23239
+
+        * runtime/DatePrototype.cpp: Moved LocaleDateTimeFormat enum outside #if
+        so we can use this on all platforms. Changed valueOf to share the same
+        function with getTime, since the contents of the two are identical. Removed
+        a FIXME since the idea isn't really specific enough or helpful enough to
+        need to sit here in the source code.
+        (JSC::formatLocaleDate): Changed the Mac version of this function to take
+        the same arguments as the non-Mac version so the caller doesn't have to
+        special-case the two platforms. Also made the formatString array be const;
+        before the characters were, but the array was a modifiable global variable.
+        (JSC::dateProtoFuncToLocaleString): Changed to call the new unified
+        version of formatLocaleDate and remove the ifdef.
+        (JSC::dateProtoFuncToLocaleDateString): Ditto.
+        (JSC::dateProtoFuncToLocaleTimeString): Ditto.
+
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toObject): Use the new ASSERT_UNUSED instead of the
+        old UNUSED_PARAM.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp): Changed to only use UNUSED_PARAM when the parameter
+        is actually unused.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease): Changed to only use UNUSED_PARAM when the parameter
+        is actually unused.
+        (TCMalloc_SystemCommit): Changed to omit the argument names instead of using
+        UNUSED_PARAM.
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix the build (whoops)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler and Anders Carlsson
+
+        Bug 23128: get/put_by_val need to respecialise in the face of ByteArray
+
+        Restructure the code slightly, and add comments per Darin's suggestions
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Whoops, I accidentally removed an exception check from fast the
+        fast path for string indexing when i originally landed the
+        byte array logic.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23128: get/put_by_val need to respecialise in the face of ByteArray
+        <https://bugs.webkit.org/show_bug.cgi?id=23128>
+
+        Fairly simple patch, add specialised versions of cti_op_get/put_by_val
+        that assume ByteArray, thus avoiding a few branches in the case of bytearray
+        manipulation.
+
+        No effect on SunSpider.  15% win on the original testcase.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        * interpreter/Interpreter.h:
+
+2009-01-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Try to fix Windows build.
+
+        * wtf/CurrentTime.cpp: Added a definition of msPerSecond (previously, this code was in
+        DateMath.cpp, with constant definition in DateTime.h)
+
+2009-01-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Try to fix Windows build.
+
+        * wtf/CurrentTime.cpp: Include <sys/types.h> and <sys/timeb.h>, as MSDN says to.
+
+2009-01-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23207
+        Moved currentTime() to from WebCore to WTF.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp: added export for WTF::currentTime()
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * runtime/DateMath.cpp:
+        (JSC::getCurrentUTCTimeWithMicroseconds): This function had another implementation of currentTime(), essentially. Now uses WTF version.
+        * wtf/CurrentTime.cpp: Added.
+        (WTF::currentTime):
+        (WTF::highResUpTime):
+        (WTF::lowResUTCTime):
+        (WTF::qpcAvailable):
+        * wtf/CurrentTime.h: Added.
+
+2009-01-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Stage two of converting JSValue from a pointer to a class type.
+        Remove the class JSValue.  The functionallity has been transitioned
+        into the wrapper class type JSValuePtr.
+
+        The last stage will be to rename JSValuePtr to JSValue, remove the
+        overloaded -> operator, and switch operations on JSValuePtrs from
+        using '->' to use '.' instead.
+
+        * API/APICast.h:
+        * JavaScriptCore.exp:
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValuePtr::asCell):
+        (JSC::JSValuePtr::isNumber):
+        (JSC::JSValuePtr::isString):
+        (JSC::JSValuePtr::isGetterSetter):
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::getString):
+        (JSC::JSValuePtr::getObject):
+        (JSC::JSValuePtr::getCallData):
+        (JSC::JSValuePtr::getConstructData):
+        (JSC::JSValuePtr::getUInt32):
+        (JSC::JSValuePtr::getTruncatedInt32):
+        (JSC::JSValuePtr::getTruncatedUInt32):
+        (JSC::JSValuePtr::mark):
+        (JSC::JSValuePtr::marked):
+        (JSC::JSValuePtr::toPrimitive):
+        (JSC::JSValuePtr::getPrimitiveNumber):
+        (JSC::JSValuePtr::toBoolean):
+        (JSC::JSValuePtr::toNumber):
+        (JSC::JSValuePtr::toString):
+        (JSC::JSValuePtr::toObject):
+        (JSC::JSValuePtr::toThisObject):
+        (JSC::JSValuePtr::needsThisConversion):
+        (JSC::JSValuePtr::toThisString):
+        (JSC::JSValuePtr::getJSNumber):
+        * runtime/JSImmediate.h:
+        (JSC::JSValuePtr::isUndefined):
+        (JSC::JSValuePtr::isNull):
+        (JSC::JSValuePtr::isUndefinedOrNull):
+        (JSC::JSValuePtr::isBoolean):
+        (JSC::JSValuePtr::getBoolean):
+        (JSC::JSValuePtr::toInt32):
+        (JSC::JSValuePtr::toUInt32):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::JSValuePtr::toJSNumber):
+        * runtime/JSObject.h:
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::get):
+        (JSC::JSValuePtr::put):
+        * runtime/JSString.h:
+        (JSC::JSValuePtr::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValuePtr::toInteger):
+        (JSC::JSValuePtr::toIntegerPreserveNaN):
+        (JSC::JSValuePtr::toInt32SlowCase):
+        (JSC::JSValuePtr::toUInt32SlowCase):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::makeImmediate):
+        (JSC::JSValuePtr::immediateValue):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator->):
+        (JSC::JSValuePtr::operator bool):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValuePtr::toFloat):
+        (JSC::JSValuePtr::asValue):
+        (JSC::operator==):
+        (JSC::operator!=):
+
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Adjustment to previous patch.  Remove call to initilizeThreading from JSGlobalCreate
+        and fix jsc.cpp instead.
+
+        * jsc.cpp:
+        (main):
+        (jscmain):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+
+2009-01-09  Sam Weinig  <sam@webkit.org>
+
+        Roll r39720 back in with a working interpreted mode.
+
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Added a template to make the pointer and flags combination
+        in UString more readable and less error prone.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added PtrAndFlags.h (and sorted the xcode project file).
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        Made the init threading initialize the UString globals.  Before
+        these were initilized using {} but that became harder due to the
+        addition of this tempalte class.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::createFromUTF8):
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::concatenate):
+        (JSC::UString::operator=):
+        (JSC::UString::makeNull):
+        (JSC::UString::nullRep):
+        * runtime/UString.h:
+        (JSC::UString::Rep::identifierTable):
+        (JSC::UString::Rep::setIdentifierTable):
+        (JSC::UString::Rep::isStatic):
+        (JSC::UString::Rep::setStatic):
+        (JSC::UString::Rep::):
+        (JSC::UString::Rep::null):
+        (JSC::UString::Rep::empty):
+        (JSC::UString::isNull):
+        (JSC::UString::null):
+        (JSC::UString::UString):
+
+        * wtf/PtrAndFlags.h: Added.
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::isFlagSet):
+        (WTF::PtrAndFlags::setFlag):
+        (WTF::PtrAndFlags::clearFlag):
+        (WTF::PtrAndFlags::get):
+        (WTF::PtrAndFlags::set):
+        A simple way to layer together a pointer and 2 flags.  It relies on the pointer being 4 byte aligned,
+        which should happen for all allocators (due to aligning pointers, int's, etc. on 4 byte boundaries).
+
+2009-01-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by -O-l-i-v-e-r- -H-u-n-t- Sam Weinig (sorry, Sam!).
+
+        Encode immediates in the low word of JSValuePtrs, on x86-64.
+
+        On 32-bit platforms a JSValuePtr may represent a 31-bit signed integer.
+        On 64-bit platforms, if USE(ALTERNATE_JSIMMEDIATE) is defined, a full
+        32-bit integer may be stored in an immediate.
+        
+        Presently USE(ALTERNATE_JSIMMEDIATE) uses the same encoding as the default
+        immediate format - the value is left shifted by one, so a one bit tag can
+        be added to indicate the value is an immediate.  However this means that
+        values must be commonly be detagged (by right shifting by one) before
+        arithmetic operations can be performed on immediates.  This patch modifies
+        the formattting so the the high bits of the immediate mark values as being
+        integer.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::not32):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::zeroExtend32ToPtr):
+        (JSC::MacroAssembler::jaePtr):
+        (JSC::MacroAssembler::jbPtr):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::notl_r):
+        (JSC::X86Assembler::testq_i32r):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::resizePropertyStorage):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isPositiveNumber):
+        (JSC::JSImmediate::areBothImmediateNumbers):
+        (JSC::JSImmediate::xorImmediateNumbers):
+        (JSC::JSImmediate::rightShiftImmediateNumbers):
+        (JSC::JSImmediate::canDoFastAdditiveOperations):
+        (JSC::JSImmediate::addImmediateNumbers):
+        (JSC::JSImmediate::subImmediateNumbers):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::toBoolean):
+        * wtf/Platform.h:
+
+2009-01-08  Sam Weinig  <sam@webkit.org>
+
+        Revert r39720. It broke Interpreted mode.
+
+2009-01-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23197
+        Delay creating the PCVector until an exception is thrown
+        Part of <rdar://problem/6469060>
+        Don't store exception information for a CodeBlock until first exception is thrown
+
+        - Change the process for re-parsing/re-generating bytecode for exception information
+          to use data from the original CodeBlock (offsets of GlobalResolve instructions) to
+          aid in creating an identical instruction stream on re-parse, instead of padding
+          interchangeable opcodes, which would result in different JITed code.
+        - Fix bug where the wrong ScopeChainNode was used when re-parsing/regenerating from
+          within some odd modified scope chains.
+        - Lazily create the pcVector by re-JITing the regenerated CodeBlock and stealing the
+          the pcVector from it.
+
+        Saves ~2MB on Membuster head.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::JITCodeRef::JITCodeRef):
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::addFunctionRegisterInfo):
+        (JSC::CodeBlock::hasExceptionInfo):
+        (JSC::CodeBlock::pcVector):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::EvalCodeBlock::baseScopeDepth):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::setRegeneratingForExceptionInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_vm_throw):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::generateBytecode):
+        (JSC::EvalNode::bytecodeForExceptionInfoReparse):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
+        * parser/Nodes.h:
+
+2009-01-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add Win32 implementation of ThreadSpecific.
+        https://bugs.webkit.org/show_bug.cgi?id=22614
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::ThreadSpecific):
+        (WTF::ThreadSpecific::~ThreadSpecific):
+        (WTF::ThreadSpecific::get):
+        (WTF::ThreadSpecific::set):
+        (WTF::ThreadSpecific::destroy):
+        * wtf/ThreadSpecificWin.cpp: Added.
+        (WTF::ThreadSpecificThreadExit):
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+
+2009-01-08  Justin McPherson <justin.mcpherson@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with Qt on NetBSD.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase): Use PLATFORM(NETBSD) to enter the
+        code path to retrieve the stack base using pthread_attr_get_np.
+        The PTHREAD_NP_H define is not used because the header file does
+        not exist on NetBSD, but the function is declared nevertheless.
+        * wtf/Platform.h: Introduce WTF_PLATFORM_NETBSD.
+
+2009-01-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/6469060> Don't store exception information for a CodeBlock until first exception is thrown
+
+        Don't initially store exception information (lineNumber/expressionRange/getByIdExcecptionInfo)
+        in CodeBlocks blocks.  Instead, re-parse for the data on demand and cache it then.
+
+        One important change that was needed to make this work was to pad op_get_global_var with nops to
+        be the same length as op_resolve_global, since one could be replaced for the other on re-parsing,
+        and we want to keep the offsets bytecode offsets the same.
+
+        1.3MB improvement on Membuster head.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Update op_get_global_var to account for the padding.
+        (JSC::CodeBlock::dumpStatistics): Add more statistic dumping.
+        (JSC::CodeBlock::CodeBlock): Initialize m_exceptionInfo.
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): Re-parses the CodeBlocks
+        associated SourceCode and steals the ExceptionInfo from it.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Creates the exception info on demand.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Ditto.
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset): Ditto.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfExceptionHandlers): Updated to account for m_exceptionInfo indirection.
+        (JSC::CodeBlock::addExceptionHandler): Ditto.
+        (JSC::CodeBlock::exceptionHandler): Ditto.
+        (JSC::CodeBlock::clearExceptionInfo): Ditto.
+        (JSC::CodeBlock::addExpressionInfo): Ditto.
+        (JSC::CodeBlock::addGetByIdExceptionInfo): Ditto.
+        (JSC::CodeBlock::numberOfLineInfos): Ditto.
+        (JSC::CodeBlock::addLineInfo): Ditto.
+        (JSC::CodeBlock::lastLineInfo): Ditto.
+
+        * bytecode/Opcode.h: Change length of op_get_global_var to match op_resolve_global.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump): Add comment indicating why it is okay not to pass a CallFrame.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Clear the exception info after generation for Function and Eval
+        Code when not in regenerate for exception info mode.
+        (JSC::BytecodeGenerator::BytecodeGenerator): Initialize m_regeneratingForExceptionInfo to false.
+        (JSC::BytecodeGenerator::emitGetScopedVar): Pad op_get_global_var with 2 nops.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::setRegeneratingForExcpeptionInfo): Added.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Pass the CallFrame to exception info accessors.
+        (JSC::Interpreter::privateExecute): Ditto.
+        (JSC::Interpreter::retrieveLastCaller): Ditto.
+        (JSC::Interpreter::cti_op_new_error): Ditto.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Pass the current bytecode offset instead of hard coding the
+        line number, the stub will do the accessing if it gets called.
+
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::emitBytecode): Moved.
+        (JSC::ProgramNode::generateBytecode): Moved.
+        (JSC::EvalNode::create): Moved.
+        (JSC::EvalNode::bytecodeForExceptionInfoReparse): Added.
+        (JSC::FunctionBodyNode::generateBytecode): Rename reparse to reparseInPlace.
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse): Addded.
+
+        * parser/Nodes.h:
+        (JSC::ScopeNode::features): Added getter.
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Renamed from reparse.
+        * parser/Parser.h:
+        (JSC::Parser::reparse): Added. Re-parses the passed in Node into
+        a new Node.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError): Pass along CallFrame.
+        (JSC::createInvalidParamError): Ditto.
+        (JSC::createNotAConstructorError): Ditto.
+        (JSC::createNotAFunctionError): Ditto.
+        (JSC::createNotAnObjectError): Ditto.
+
+2009-01-06  Gavin Barraclough  <baraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Replace accidentally removed references in BytecodeGenerator, deleting these
+        will be hindering the sharing of constant numbers and strings.
+
+        The code to add a new constant (either number or string) to their respective
+        map works by attempting to add a null entry, then checking the result of the
+        add for null.  The first time, this should return the null (or noValue).
+        The code checks for null (to see if this is the initial add), and then allocates
+        a new number / string object.  This code relies on the result returned from
+        the add to the map being stored as a reference, such that the allocated object
+        will be stored in the map, and will be resused if the same constant is encountered
+        again.  By failing to use a reference we will be leaking GC object for each
+        additional entry added to the map.  As GC objects they should be clollected,
+        be we should no be allocatin them in the first place.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23158
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+
+2009-01-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6040850> JavaScript register file should use VirtualAlloc on Windows
+
+        Fairly simple, just reserve 4Mb of address space for the
+        register file, and then commit one section at a time.  We
+        don't release committed memory as we drop back, but then
+        mac doesn't either so this probably not too much of a 
+        problem.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+
+2009-01-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23142
+        ThreadGlobalData leaks seen on buildbot
+
+        * wtf/ThreadSpecific.h: (WTF::ThreadSpecific::destroy): Temporarily reset the thread
+        specific value to make getter work on Mac OS X.
+
+        * wtf/Platform.h: Touch this file again to make sure all Windows builds use the most recent
+        version of ThreadSpecific.h.
+
+2009-01-05  Gavin Barraclough  <baraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Replace all uses of JSValue* with a new smart pointer type, JSValuePtr.
+        
+        A JavaScript value may be a heap object or boxed primitive, represented by a
+        pointer, or may be an unboxed immediate value, such as an integer.  Since a
+        value may dynamically need to contain either a pointer value or an immediate,
+        we encode immediates as pointer values (since all valid JSCell pointers are
+        allocated at alligned addesses, unaligned addresses are available to encode
+        immediates).  As such all JavaScript values are represented using a JSValue*.
+
+        This implementation is encumbered by a number of constraints.  It ties the
+        JSValue representation to the size of pointer on the platform, which, for
+        example, means that we currently can represent different ranges of integers
+        as immediates on x86 and x86-64.  It also prevents us from overloading the
+        to-boolean conversion used to test for noValue() - effectively forcing us
+        to represent noValue() as 0.  This would potentially be problematic were we
+        to wish to encode integer values differently (e.g. were we to use the v8
+        encoding, where pointers are tagged with 1 and integers with 0, then the
+        immediate integer 0 would conflict with noValue()).
+
+        This patch replaces all usage of JSValue* with a new class, JSValuePtr,
+        which encapsulates the pointer.  JSValuePtr maintains the same interface as
+        JSValue*, overloading operator-> and operator bool such that previous
+        operations in the code on variables of type JSValue* are still supported.
+
+        In order to provide a ProtectPtr<> type with support for the new value
+        representation (without using the internal JSValue type directly), a new
+        ProtectJSValuePtr type has been added, equivalent to the previous type
+        ProtectPtr<JSValue>.
+
+        This patch is likely the first in a sequence of three changes.  With the
+        value now encapsulated it will likely make sense to migrate the functionality
+        from JSValue into JSValuePtr, such that the internal pointer representation
+        need not be exposed.  Through migrating the functionality to the wrapper
+        class the existing JSValue should be rendered redundant, and the class is
+        likely to be removed (the JSValuePtr now wrapping a pointer to a JSCell).
+        At this stage it will likely make sense to rename JSValuePtr to JSValue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23114
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::put):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addUnexpectedConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitLoadJSV):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::exception):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setException):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::exceptionSlot):
+        (JSC::ExecState::hadException):
+        * interpreter/Interpreter.cpp:
+        (JSC::fastIsNumber):
+        (JSC::fastToInt32):
+        (JSC::fastToUInt32):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::inlineResolveBase):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::cachePrototypeChain):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::returnToThrowTrampoline):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_base):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_next_pname):
+        (JSC::Interpreter::cti_op_typeof):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_is_string):
+        (JSC::Interpreter::cti_op_is_object):
+        (JSC::Interpreter::cti_op_is_function):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_new_error):
+        (JSC::Interpreter::cti_vm_throw):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSArray):
+        (JSC::Interpreter::isJSString):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        (JSC::Register::getJSValue):
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::):
+        (JSC::JIT::execute):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::isOperandConstant31BitImmediateInt):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::resizePropertyStorage):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionReadline):
+        (functionQuit):
+        * parser/Nodes.cpp:
+        (JSC::NullNode::emitBytecode):
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::processClauseList):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        * profiler/Profiler.h:
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::ArgList::at):
+        (JSC::ArgList::append):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::asArguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.h:
+        (JSC::asBooleanObject):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        (JSC::Completion::value):
+        (JSC::Completion::setValue):
+        (JSC::Completion::isValueCompletion):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::asDateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncValueOf):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createError):
+        (JSC::createStackOverflowError):
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toPrimitive):
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/InitializeThreading.cpp:
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::asInternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        (JSC::asActivation):
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::mark):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::createStructure):
+        (JSC::asArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        (JSC::asFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
+        (JSC::asGlobalObject):
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isImmediate):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isPositiveNumber):
+        (JSC::JSImmediate::isBoolean):
+        (JSC::JSImmediate::isUndefinedOrNull):
+        (JSC::JSImmediate::isNegative):
+        (JSC::JSImmediate::isEitherImmediate):
+        (JSC::JSImmediate::isAnyImmediate):
+        (JSC::JSImmediate::areBothImmediate):
+        (JSC::JSImmediate::areBothImmediateNumbers):
+        (JSC::JSImmediate::andImmediateNumbers):
+        (JSC::JSImmediate::xorImmediateNumbers):
+        (JSC::JSImmediate::orImmediateNumbers):
+        (JSC::JSImmediate::rightShiftImmediateNumbers):
+        (JSC::JSImmediate::canDoFastAdditiveOperations):
+        (JSC::JSImmediate::addImmediateNumbers):
+        (JSC::JSImmediate::subImmediateNumbers):
+        (JSC::JSImmediate::incImmediateNumber):
+        (JSC::JSImmediate::decImmediateNumber):
+        (JSC::JSImmediate::makeValue):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::makeUndefined):
+        (JSC::JSImmediate::makeNull):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::uintValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::rawValue):
+        (JSC::JSImmediate::trueImmediate):
+        (JSC::JSImmediate::falseImmediate):
+        (JSC::JSImmediate::undefinedImmediate):
+        (JSC::JSImmediate::nullImmediate):
+        (JSC::JSImmediate::zeroImmediate):
+        (JSC::JSImmediate::oneImmediate):
+        (JSC::JSImmediate::impossibleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::jsNull):
+        (JSC::jsBoolean):
+        (JSC::jsUndefined):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::toInt32):
+        (JSC::toUInt32):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::put):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toPrimitive):
+        (JSC::JSNumberCell::getPrimitiveNumber):
+        (JSC::JSNumberCell::getJSNumber):
+        (JSC::jsNumberCell):
+        (JSC::jsNaN):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValue::toJSNumber):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::createStructure):
+        (JSC::asObject):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::get):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::toPrimitive):
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        (JSC::JSPropertyNameIterator::getPrimitiveNumber):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.cpp:
+        (JSC::JSString::toPrimitive):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        (JSC::asString):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::makeImmediate):
+        (JSC::JSValuePtr::immediateValue):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator->):
+        (JSC::JSValuePtr::hasValue):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValue::asValue):
+        (JSC::noValue):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::mark):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::callNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::getJSNumber):
+        (JSC::constructNumberFromImmediateNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.cpp:
+        (JSC::equal):
+        (JSC::equalSlowCase):
+        (JSC::strictEqual):
+        (JSC::strictEqualSlowCase):
+        (JSC::throwOutOfMemoryError):
+        * runtime/Operations.h:
+        (JSC::equalSlowCaseInline):
+        (JSC::strictEqualSlowCaseInline):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::putValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::setBase):
+        (JSC::PropertySlot::):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        (JSC::ProtectedPtr::ProtectedPtr):
+        (JSC::ProtectedPtr::operator JSValuePtr):
+        (JSC::ProtectedJSValuePtr::ProtectedJSValuePtr):
+        (JSC::ProtectedJSValuePtr::get):
+        (JSC::ProtectedJSValuePtr::operator JSValuePtr):
+        (JSC::ProtectedJSValuePtr::operator->):
+        (JSC::::ProtectedPtr):
+        (JSC::::~ProtectedPtr):
+        (JSC::::operator):
+        (JSC::ProtectedJSValuePtr::~ProtectedJSValuePtr):
+        (JSC::ProtectedJSValuePtr::operator=):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::RegExpConstructor::put):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        (JSC::asRegExpConstructor):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::put):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+        (JSC::RegExpObject::put):
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::exec):
+        (JSC::callRegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        (JSC::asRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        (JSC::asStringObject):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::createCachedPrototypeChain):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::storedPrototype):
+
+2009-01-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23085> [jsfunfuzz] Over released ScopeChainNode
+        <rdar://problem/6474110>
+
+        So this delightful bug was caused by our unwind code using a ScopeChain to perform
+        the unwind.  The ScopeChain would ref the initial top of the scope chain, then deref
+        the resultant top of scope chain, which is incorrect.
+
+        This patch removes the dependency on ScopeChain for the unwind, and i've filed
+        <https://bugs.webkit.org/show_bug.cgi?id=23144> to look into the unintuitive
+        ScopeChain behaviour.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2009-01-06  Adam Roben  <aroben@apple.com>
+
+        Hopeful Windows crash-on-launch fix
+
+        * wtf/Platform.h: Force a world rebuild by touching this file.
+
+2009-01-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by NOBODY (Build fix).
+
+        * GNUmakefile.am:Add ByteArray.cpp too
+
+2009-01-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by NOBODY (Speculative build fix).
+
+        AllInOneFile.cpp does not include the JSByteArray.cpp include it...
+
+        * GNUmakefile.am:
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix Wx build
+
+        * JavaScriptCoreSources.bkl:
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fixes
+
+        Rubber-stamped by Alice Liu.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        * runtime/ByteArray.cpp:
+        (JSC::ByteArray::create):
+        * runtime/ByteArray.h:
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        CanvasPixelArray performance is too slow 
+        <https://bugs.webkit.org/show_bug.cgi?id=23123>
+
+        The fix to this is to devirtualise get and put in a manner similar to
+        JSString and JSArray.  To do this I've added a ByteArray implementation
+        and JSByteArray wrapper to JSC.  We can then do vptr comparisons to
+        devirtualise the calls.
+
+        This devirtualisation improves performance by 1.5-2x in my somewhat ad
+        hoc tests.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_put_by_val):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSByteArray):
+        * runtime/ByteArray.cpp: Added.
+        (JSC::ByteArray::create):
+        * runtime/ByteArray.h: Added.
+        (JSC::ByteArray::length):
+        (JSC::ByteArray::set):
+        (JSC::ByteArray::get):
+        (JSC::ByteArray::data):
+        (JSC::ByteArray::ByteArray):
+        * runtime/JSByteArray.cpp: Added.
+        (JSC::):
+        (JSC::JSByteArray::JSByteArray):
+        (JSC::JSByteArray::createStructure):
+        (JSC::JSByteArray::getOwnPropertySlot):
+        (JSC::JSByteArray::put):
+        (JSC::JSByteArray::getPropertyNames):
+        * runtime/JSByteArray.h: Added.
+        (JSC::JSByteArray::canAccessIndex):
+        (JSC::JSByteArray::getIndex):
+        (JSC::JSByteArray::setIndex):
+        (JSC::JSByteArray::classInfo):
+        (JSC::JSByteArray::length):
+        (JSC::JSByteArray::):
+        (JSC::JSByteArray::JSByteArray):
+        (JSC::asByteArray):
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23073
+        <rdar://problem/6471129> Workers crash on Windows Release builds
+
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::destroy): Changed to clear the pointer only after data object
+        destruction is finished - otherwise, WebCore::ThreadGlobalData destructor was re-creating
+        the object in order to access atomic string table.
+        (WTF::ThreadSpecific::operator T*): Symmetrically, set up the per-thread pointer before
+        data constructor is called.
+
+        * wtf/ThreadingWin.cpp: (WTF::wtfThreadEntryPoint): Remove a Windows-only hack to finalize
+        a thread - pthreadVC2 is a DLL, so it gets thread detached messages, and cleans up thread
+        specific data automatically. Besides, this code wasn't even compiled in for some time now.
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23115
+        Create a version of ASSERT for use with otherwise unused variables
+
+        * wtf/Assertions.h: Added ASSERT_UNUSED.
+
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemRelease):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::heapAllocate):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::toBoolean):
+        (JSC::JSNotAnObject::toNumber):
+        (JSC::JSNotAnObject::toString):
+        (JSC::JSNotAnObject::getOwnPropertySlot):
+        (JSC::JSNotAnObject::put):
+        (JSC::JSNotAnObject::deleteProperty):
+        (JSC::JSNotAnObject::getPropertyNames):
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+        Use it in some places that used other idioms for this purpose.
+
+2009-01-04  Alice Liu  <alice.liu@apple.com>
+
+        <rdar://problem/6341776> Merge m_transitionCount and m_offset in Structure.
+
+        Reviewed by Darin Adler.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Remove m_transitionCount
+        (JSC::Structure::addPropertyTransitionToExistingStructure): No need to wait until after the assignment to offset to assert if it's notFound; move it up.
+        (JSC::Structure::addPropertyTransition): Use method for transitionCount instead of m_transitionCount. Remove line that maintains the m_transitionCount.
+        (JSC::Structure::changePrototypeTransition): Remove line that maintains the m_transitionCount.
+        (JSC::Structure::getterSetterTransition): Remove line that maintains the m_transitionCount.
+        * runtime/Structure.h:
+        Changed s_maxTransitionLength and m_offset from size_t to signed char.  m_offset will never become greater than 64 
+        because the structure transitions to a dictionary at that time.
+        (JSC::Structure::transitionCount): method to replace the data member
+
+2009-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Bug 15114: Provide compile-time assertions for sizeof(UChar), sizeof(DeprecatedChar), etc.
+        https://bugs.webkit.org/show_bug.cgi?id=15114
+
+        * wtf/unicode/Unicode.h: Assert size of UChar. There is no DeprecatedChar any more.
+
+2009-01-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Change the pcVector from storing native code pointers to storing offsets
+        from the base pointer. This will allow us to generate the pcVector on demand
+        for exceptions.
+
+        * bytecode/CodeBlock.h:
+        (JSC::PC::PC):
+        (JSC::getNativePCOffset):
+        (JSC::CodeBlock::getBytecodeIndex):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2009-01-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+        
+        * runtime/ScopeChain.cpp:
+
+2009-01-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] unwind logic for exceptions in eval fails to account for dynamic scope external to the eval
+        https://bugs.webkit.org/show_bug.cgi?id=23078
+
+        This bug was caused by eval codeblocks being generated without accounting
+        for the depth of the scope chain they inherited.  This meant that exception
+        handlers would understate their expected scope chain depth, which in turn
+        led to incorrectly removing nodes from the scope chain.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCatch):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::depth):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChain::localDepth):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::deref):
+        (JSC::ScopeChainNode::ref):
+
+2009-01-02  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22699
+        Enable NodeList caching for getElementsByTagName
+
+        * wtf/HashFunctions.h: Moved the definition of PHI here and renamed to stringHashingStartValue
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Attempt to fix Qt Linux build after r39553
+
+        * wtf/RandomNumberSeed.h: Include <sys/time.h> for gettimeofday().
+        Include <sys/types.h> and <unistd.h> for getpid().
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23081: These files are no longer part of the KDE libraries
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23081>
+
+        Reviewed by Darin Adler.
+
+        Removed "This file is part of the KDE libraries" comment from
+        source files.  Added or updated Apple copyrights as well.
+
+        * parser/Lexer.h:
+        * wtf/HashCountedSet.h:
+        * wtf/RetainPtr.h:
+        * wtf/VectorTraits.h:
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23080: Remove last vestiges of KJS references
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23080>
+
+        Reviewed by Darin Adler.
+
+        Also updated Apple copyright statements.
+
+        * DerivedSources.make: Changed bison "kjsyy" prefix to "jscyy".
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.pri: Ditto.  Also changed KJSBISON to JSCBISON
+        and kjsbison to jscbison.
+
+        * JavaScriptCoreSources.bkl: Changed JSCORE_KJS_SOURCES to
+        JSCORE_JSC_SOURCES.
+        * jscore.bkl: Ditto.
+
+        * create_hash_table: Updated copyright and removed old comment.
+
+        * parser/Grammar.y: Changed "kjsyy" prefix to "jscyy" prefix.
+        * parser/Lexer.cpp: Ditto.  Also changed KJS_DEBUG_LEX to
+        JSC_DEBUG_LEX.
+        (jscyylex):
+        (JSC::Lexer::lex):
+        * parser/Parser.cpp: Ditto.
+        (JSC::Parser::parse):
+
+        * pcre/dftables: Changed "kjs_pcre_" prefix to "jsc_pcre_".
+        * pcre/pcre_compile.cpp: Ditto.
+        (getOthercaseRange):
+        (encodeUTF8):
+        (compileBranch):
+        (calculateCompiledPatternLength):
+        * pcre/pcre_exec.cpp: Ditto.
+        (matchRef):
+        (getUTF8CharAndIncrementLength):
+        (match):
+        * pcre/pcre_internal.h: Ditto.
+        (toLowerCase):
+        (flipCase):
+        (classBitmapForChar):
+        (charTypeForChar):
+        * pcre/pcre_tables.cpp: Ditto.
+        * pcre/pcre_ucp_searchfuncs.cpp: Ditto.
+        (jsc_pcre_ucp_othercase):
+        * pcre/pcre_xclass.cpp: Ditto.
+        (getUTF8CharAndAdvancePointer):
+        (jsc_pcre_xclass):
+
+        * runtime/Collector.h: Updated header guards using the
+        clean-header-guards script.
+        * runtime/CollectorHeapIterator.h: Added missing header guard.
+        * runtime/Identifier.h: Updated header guards.
+        * runtime/JSFunction.h: Fixed end-of-namespace comment.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset): Renamed "kjsprint" debug function
+        to "jscprint".  Changed implementation method from
+        globalFuncKJSPrint() to globalFuncJSCPrint().
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncJSCPrint): Renamed from globalFuncKJSPrint().
+        * runtime/JSGlobalObjectFunctions.h: Ditto.
+
+        * runtime/JSImmediate.h: Updated header guards.
+        * runtime/JSLock.h: Ditto.
+        * runtime/JSType.h: Ditto.
+        * runtime/JSWrapperObject.h: Ditto.
+        * runtime/Lookup.h: Ditto.
+        * runtime/Operations.h: Ditto.
+        * runtime/Protect.h: Ditto.
+        * runtime/RegExp.h: Ditto.
+        * runtime/UString.h: Ditto.
+
+        * tests/mozilla/js1_5/Array/regress-157652.js: Changed "KJS"
+        reference in comment to "JSC".
+
+        * wrec/CharacterClassConstructor.cpp: Change "kjs_pcre_" function
+        prefixes to "jsc_pcre_".
+        (JSC::WREC::CharacterClassConstructor::put):
+        (JSC::WREC::CharacterClassConstructor::flush):
+
+        * wtf/unicode/Unicode.h: Change "KJS_" header guard to "WTF_".
+        * wtf/unicode/icu/UnicodeIcu.h: Ditto.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+2009-01-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make randomNumber generate 2^53 values instead of 2^32 (or 2^31 for rand() platforms)
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Remove declaration for JSC::Identifier::initializeIdentifierThreading()
+
+        Reviewed by Alexey Proskuryakov.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::initializeIdentifierThreading): Removed
+        declaration since the implementation was removed in r34412.
+
+2009-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        String.replace does not support $& replacement metacharacter when search term is not a RegExp
+        <https://bugs.webkit.org/show_bug.cgi?id=21431>
+        <rdar://problem/6274993>
+
+        Test: fast/js/string-replace-3.html
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Added a null check here so we won't try to handle $$-$9
+        backreferences when the search term is a string, not a RegExp. Added a check for 0 so we
+        won't try to handle $0 or $00 as a backreference.
+        (JSC::stringProtoFuncReplace): Added a call to substituteBackreferences.
+
+2009-01-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow 32-bit integers to be stored in JSImmediates, on x64-bit.
+        Presently the top 32-bits of a 64-bit JSImmediate serve as a sign extension of a 31-bit
+        int stored in the low word (shifted left by one, to make room for a tag).  In the new
+        format, the top 31-bits serve as a sign extension of a 32-bit int, still shifted left by
+        one.
+
+        The new behavior is enabled using a flag in Platform.h, 'WTF_USE_ALTERNATE_JSIMMEDIATE'.
+        When this is set the constants defining the range of ints allowed to be stored as
+        JSImmediate values is extended.  The code in JSImmediate.h can safely operate on either
+        format.  This patch updates the JIT so that it can also operate with the new format.
+
+        ~2% progression on x86-64, with & without the JIT, on sunspider & v8 tests.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::rshiftPtr):
+        (JSC::MacroAssembler::rshift32):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::compareImm64ForBranch):
+        (JSC::MacroAssembler::compareImm64ForBranchEquality):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::jgePtr):
+        (JSC::MacroAssembler::jlPtr):
+        (JSC::MacroAssembler::jlePtr):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnzSubPtr):
+        (JSC::MacroAssembler::joAddPtr):
+        (JSC::MacroAssembler::jzSubPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addq_rr):
+        (JSC::X86Assembler::orq_ir):
+        (JSC::X86Assembler::subq_ir):
+        (JSC::X86Assembler::xorq_rr):
+        (JSC::X86Assembler::sarq_CLr):
+        (JSC::X86Assembler::sarq_i8r):
+        (JSC::X86Assembler::cmpq_ir):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        (JSC::JIT::isOperandConstant31BitImmediateInt):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isPositiveNumber):
+        (JSC::JSImmediate::isNegative):
+        (JSC::JSImmediate::rightShiftImmediateNumbers):
+        (JSC::JSImmediate::canDoFastAdditiveOperations):
+        (JSC::JSImmediate::makeValue):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::rawValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::from):
+        * wtf/Platform.h:
+
+2008-12-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        [jsfunfuzz] Assertion + incorrect behaviour with dynamically created local variable in a catch block
+        <https://bugs.webkit.org/show_bug.cgi?id=23063>
+
+        Eval inside a catch block attempts to use the catch block's static scope in
+        an unsafe way by attempting to add new properties to the scope.  This patch
+        fixes this issue simply by preventing the catch block from using a static
+        scope if it contains an eval.
+
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::TryNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::TryNode::):
+
+2008-12-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Computed exception offset wrong when first instruction is attempt to resolve deleted eval
+        <https://bugs.webkit.org/show_bug.cgi?id=23062>
+
+        This was caused by the expression information for the initial resolve of
+        eval not being emitted.  If this resolve was the first instruction that
+        could throw an exception the information search would fail leading to an
+        assertion failure.  If it was not the first throwable opcode the wrong
+        expression information would used.
+
+        Fix is simply to emit the expression info.
+
+        * parser/Nodes.cpp:
+        (JSC::EvalFunctionCallNode::emitBytecode):
+
+2008-12-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23054: Caching of global lookups occurs even when the global object has become a dictionary
+        <https://bugs.webkit.org/show_bug.cgi?id=23054>
+        <rdar://problem/6469905>
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal): Do not cache lookup if the global
+        object has transitioned to a dictionary.
+        (JSC::Interpreter::cti_op_resolve_global): Do not cache lookup if the
+        global object has transitioned to a dictionary.
+
+2008-12-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23049> [jsfunfuzz] With blocks do not correctly protect their scope object
+        <rdar://problem/6469742> Crash in JSC::TypeInfo::hasStandardGetOwnPropertySlot() running jsfunfuzz
+
+        The problem that caused this was that with nodes were not correctly protecting
+        the final object that was placed in the scope chain.  We correct this by forcing
+        the use of a temporary register (which stops us relying on a local register
+        protecting the scope) and changing the behaviour of op_push_scope so that it
+        will store the final scope object.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushScope):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_push_scope):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * parser/Nodes.cpp:
+        (JSC::WithNode::emitBytecode):
+
+2008-12-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23037: Parsing and reparsing disagree on automatic semicolon insertion
+        <https://bugs.webkit.org/show_bug.cgi?id=23037>
+        <rdar://problem/6467124>
+
+        Parsing and reparsing disagree about automatic semicolon insertion, so that a
+        function like
+
+        function() { a = 1, }
+
+        is parsed as being syntactically valid but gets a syntax error upon reparsing.
+        This leads to an assertion failure in Parser::reparse(). It is not that big of
+        an issue in practice, because in a Release build such a function will return
+        'undefined' when called.
+
+        In this case, we are not following the spec and it should be a syntax error.
+        However, unless there is a newline separating the ',' and the '}', WebKit would
+        not treat it as a syntax error in the past either. It would be a bit of work to
+        make the automatic semicolon insertion match the spec exactly, so this patch
+        changes it to match our past behaviour.
+
+        The problem is that even during reparsing, the Lexer adds a semicolon at the
+        end of the input, which confuses allowAutomaticSemicolon(), because it is
+        expecting either a '}', the end of input, or a terminator like a newline.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Initialize m_isReparsing to false.
+        (JSC::Lexer::lex): Do not perform automatic semicolon insertion in the Lexer if
+        we are in the middle of reparsing.
+        (JSC::Lexer::clear): Set m_isReparsing to false.
+        * parser/Lexer.h:
+        (JSC::Lexer::setIsReparsing): Added.
+        * parser/Parser.cpp:
+        (JSC::Parser::reparse): Call Lexer::setIsReparsing() to notify the Lexer of
+        reparsing.
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Yet another attempt to fix Tiger.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Tiger build fix (correct this time)
+
+        * wtf/RandomNumber.cpp:
+
+2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Revert r39509, because kjsyydebug is used in the generated code if YYDEBUG is 1.
+
+        * parser/Grammar.y:
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Tiger build fix.
+
+        * wtf/RandomNumber.cpp:
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6358108> Insecure randomness in Math.random() leads to user tracking
+
+        Switch to arc4random on PLATFORM(DARWIN), this is ~1.5x slower than random(), but the
+        it is still so fast that there is no fathomable way it could be a bottleneck for anything.
+
+        randomNumber is called in two places
+          * During form submission where it is called once per form
+          * Math.random in JSC.  For this difference to show up you have to be looping on
+            a cached local copy of random, for a large (>10000) calls.
+
+        No change in SunSpider.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove unused kjsyydebug #define.
+
+        * parser/Grammar.y:
+
+2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt and Sam Weinig.
+
+        Bug 23029: REGRESSION (r39337): jsfunfuzz generates identical test files
+        <https://bugs.webkit.org/show_bug.cgi?id=23029>
+        <rdar://problem/6469185>
+
+        The unification of random number generation in r39337 resulted in random()
+        being initialized on Darwin, but rand() actually being used. Fix this by
+        making randomNumber() use random() instead of rand() on Darwin.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2008-12-29  Sam Weinig  <sam@webkit.org>
+
+        Fix buildbots.
+
+        * runtime/Structure.cpp:
+
+2008-12-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=23026
+        Move the deleted offsets vector into the PropertyMap
+
+        Saves 3 words per Structure.
+
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Change code using m_body.get() as a boolean to take advantage of the 
+        implicit conversion of RefPtr to boolean.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+
+2008-12-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 22840: REGRESSION (r38349): Gmail doesn't load with profiling enabled
+        <https://bugs.webkit.org/show_bug.cgi?id=22840>
+        <rdar://problem/6468077>
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray): Add an assertion that the range
+        of registers passed to op_new_array is sequential.
+        (JSC::BytecodeGenerator::emitCall): Correct the relocation of registers
+        when emitting profiler hooks so that registers aren't leaked. Also, add
+        an assertion that the 'this' register is always ref'd (because it is),
+        remove the needless protection of the 'this' register when relocating,
+        and add an assertion that the range of registers passed to op_call for
+        function call arguments is sequential.
+        (JSC::BytecodeGenerator::emitConstruct): Correct the relocation of
+        registers when emitting profiler hooks so that registers aren't leaked.
+        Also, add an assertion that the range of registers passed to op_construct
+        for function call arguments is sequential.
+
+2008-12-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/6467376> Race condition in WTF::currentThread can lead to a thread using two different identifiers during its lifetime
+
+        If a newly-created thread calls WTF::currentThread() before WTF::createThread calls establishIdentifierForPthreadHandle
+        then more than one identifier will be used for the same thread.  We can avoid this by adding some extra synchronization
+        during thread creation that delays the execution of the thread function until the thread identifier has been set up, and
+        an assertion to catch this problem should it reappear in the future.
+
+        * wtf/Threading.cpp: Added.
+        (WTF::NewThreadContext::NewThreadContext):
+        (WTF::threadEntryPoint):
+        (WTF::createThread): Add cross-platform createThread function that delays the execution of the thread function until
+        after the thread identifier has been set up.
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        (WTF::establishIdentifierForThread):
+        (WTF::createThreadInternal):
+        * wtf/ThreadingNone.cpp:
+        (WTF::createThreadInternal):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::createThreadInternal):
+        * wtf/ThreadingQt.cpp:
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::createThreadInternal):
+        * wtf/ThreadingWin.cpp:
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::createThreadInternal):
+
+        Add Threading.cpp to the build.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+2008-12-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove unused method.
+
+        * runtime/Structure.h: Remove mutableTypeInfo.
+
+2008-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix rounding / bounds / signed comparison bug in ExecutableAllocator.
+
+        ExecutableAllocator::alloc assumed that m_freePtr would be aligned.  This was
+        not always true, since the first allocation from an additional pool would not
+        be rounded up.  Subsequent allocations would be unaligned, and too much memory
+        could be erroneously allocated from the pool, when the size requested was
+        available, but the size rounded up to word granularity was not available in the
+        pool.  This may result in the value of m_freePtr being greater than m_end.
+
+        Under these circumstances, the unsigned check for space will always pass,
+        resulting in pointers to memory outside of the arena being returned, and
+        ultimately segfaulty goodness when attempting to memcpy the hot freshly jitted
+        code from the AssemblerBuffer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22974
+        ... and probably many, many more.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::alloc):
+        (JSC::ExecutablePool::roundUpAllocationSize):
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+
+2008-12-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Rename all uses of the term "repatch" to "patch".
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::DataLabelPtr::patch):
+        (JSC::MacroAssembler::DataLabel32::patch):
+        (JSC::MacroAssembler::Jump::patch):
+        (JSC::MacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::MacroAssembler::PatchBuffer::setPtr):
+        (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::storePtrWithPatch):
+        (JSC::MacroAssembler::jnePtrWithPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchAddress):
+        (JSC::X86Assembler::patchImmediate):
+        (JSC::X86Assembler::patchPointer):
+        (JSC::X86Assembler::patchBranchOffset):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2008-12-22  Adam Roben  <aroben@apple.com>
+
+        Build fix after r39428
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase): Added a missing MacroAssembler::
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by George Staikos.
+
+        Unify all TorchMobile copyright lines. Consolidate in a single line, as requested by Mark Rowe, some time ago.
+
+        * wtf/RandomNumber.cpp:
+        * wtf/RandomNumber.h:
+        * wtf/RandomNumberSeed.h:
+
+2008-12-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by George Staikos.
+
+        Fix copyright of the new RandomNumber* files.
+
+        * wtf/RandomNumber.cpp:
+        * wtf/RandomNumber.h:
+        * wtf/RandomNumberSeed.h:
+
+2008-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Cameron Zwarich.
+
+        Add support for call and property access repatching on x86-64.
+
+        No change in performance on current configurations (2x impovement on v8-tests with JIT enabled on x86-64).
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::DataLabelPtr::repatch):
+        (JSC::MacroAssembler::DataLabelPtr::operator X86Assembler::JmpDst):
+        (JSC::MacroAssembler::DataLabel32::repatch):
+        (JSC::MacroAssembler::RepatchBuffer::addressOf):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::loadPtrWithAddressOffsetRepatch):
+        (JSC::MacroAssembler::storePtrWithAddressOffsetRepatch):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnePtrWithRepatch):
+        (JSC::MacroAssembler::differenceBetween):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addl_im):
+        (JSC::X86Assembler::subl_im):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::movq_rm_disp32):
+        (JSC::X86Assembler::movq_mr_disp32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64_disp32):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::resizePropertyStorage):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * wtf/Platform.h:
+
+2008-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Port optimized property access generation to the MacroAssembler.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::AbsoluteAddress::AbsoluteAddress):
+        (JSC::MacroAssembler::DataLabelPtr::repatch):
+        (JSC::MacroAssembler::DataLabel32::DataLabel32):
+        (JSC::MacroAssembler::DataLabel32::repatch):
+        (JSC::MacroAssembler::Label::operator X86Assembler::JmpDst):
+        (JSC::MacroAssembler::Jump::repatch):
+        (JSC::MacroAssembler::JumpList::empty):
+        (JSC::MacroAssembler::RepatchBuffer::link):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::loadPtrWithAddressRepatch):
+        (JSC::MacroAssembler::storePtrWithAddressRepatch):
+        (JSC::MacroAssembler::push):
+        (JSC::MacroAssembler::ja32):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnePtrWithRepatch):
+        (JSC::MacroAssembler::align):
+        (JSC::MacroAssembler::differenceBetween):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rm_disp32):
+        (JSC::X86Assembler::movl_mr_disp32):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp_disp32):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * jit/JIT.cpp:
+        (JSC::ctiRepatchCallByReturnAddress):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::resizePropertyStorage):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::addressOfCount):
+
+2008-12-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22686
+
+        Added file which was missing to the javascriptcore_sources
+        variable, so that it shows up in the tarball created by `make
+        dist'.
+
+        * GNUmakefile.am:
+
+2008-12-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Antti Koivisto.
+
+        Build fix when building JS API tests with a c89 c compiler
+
+        Do not use C++ style comments and convert them to C comments.
+
+        * wtf/Platform.h:
+
+2008-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Same as last revision, adding cases for pre & post inc & dec.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22928
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2008-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixes for the JIT's handling of JSImmediate values on x86-64.
+        On 64-bit systems, the code in JSImmediate.h relies on the upper
+        bits of a JSImmediate being a sign extension of the low 32-bits.
+        This was not being enforced by the JIT, since a number of inline
+        operations were being performed on 32-bit values in registers, and
+        when a 32-bit result is written to a register on x86-64 the value
+        is zero-extended to 64-bits.
+        
+        This fix honors previous behavoir.  A better fix in the long run
+        (when the JIT is enabled by default) may be to change JSImmediate.h
+        so it no longer relies on the upper bits of the pointer,... though
+        if we're going to change JSImmediate.h for 64-bit, we probably may
+        as well change the format so that the full range of 32-bit ints can
+        be stored, rather than just 31-bits.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22925
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::signExtend32ToPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::andq_rr):
+        (JSC::X86Assembler::andq_ir):
+        (JSC::X86Assembler::orq_rr):
+        (JSC::X86Assembler::xorq_ir):
+        (JSC::X86Assembler::movsxd_rr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+
+2008-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Just a tidy up - rename & refactor some the #defines configuring the JIT.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_end):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_timeout_check):
+        (JSC::Interpreter::cti_register_file_check):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_new_object):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_new_func):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_arityCheck):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        (JSC::Interpreter::cti_op_push_activation):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_create_arguments):
+        (JSC::Interpreter::cti_op_create_arguments_no_params):
+        (JSC::Interpreter::cti_op_tear_off_activation):
+        (JSC::Interpreter::cti_op_tear_off_arguments):
+        (JSC::Interpreter::cti_op_profile_will_call):
+        (JSC::Interpreter::cti_op_profile_did_call):
+        (JSC::Interpreter::cti_op_ret_scopeChain):
+        (JSC::Interpreter::cti_op_new_array):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_base):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_new_func_exp):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_new_regexp):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_get_pnames):
+        (JSC::Interpreter::cti_op_next_pname):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_pop_scope):
+        (JSC::Interpreter::cti_op_typeof):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_is_string):
+        (JSC::Interpreter::cti_op_is_object):
+        (JSC::Interpreter::cti_op_is_function):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_push_new_scope):
+        (JSC::Interpreter::cti_op_jmp_scopes):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        (JSC::Interpreter::cti_op_debug):
+        (JSC::Interpreter::cti_vm_throw):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * wtf/Platform.h:
+
+2008-12-18  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21855: REGRESSION (r37323): Gmail complains about popup blocking when opening a link
+        <https://bugs.webkit.org/show_bug.cgi?id=21855>
+        <rdar://problem/6278244>
+
+        Move DynamicGlobalObjectScope to JSGlobalObject.h so that it can be used
+        from WebCore.
+
+        * interpreter/Interpreter.cpp:
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
+
+2008-12-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22393
+        Segfault when caching property accesses to primitive cells.
+        
+        Changed some asObject casts to asCell casts in cases where a primitive
+        value may be a cell and not an object.
+        
+        Re-enabled property caching for primitives in cases where it had been
+        disabled because of this bug.
+        
+        Updated a comment to better explain something Darin thought needed
+        explaining in an old patch review.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+
+2008-12-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixes for Sunspider failures with the JIT enabled on x86-64.
+
+        * assembler/MacroAssembler.h:
+            Switch the order of the RegisterID & Address form of je32, to keep it consistent with jne32.
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+            Port the m_ctiVirtualCall tramopline generation to use the MacroAssembler interface.
+        * jit/JITCall.cpp:
+            Fix bug in the non-optimizing code path, vptr check should have been to the memory address pointer
+            to by the register, not to the register itself.
+        * wrec/WRECGenerator.cpp:
+            See assembler/MacroAssembler.h, above.
+
+2008-12-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        print("Hello, 64-bit jitted world!");
+        Get hello-world working through the JIT, on x86-64.
+
+        * assembler/X86Assembler.h:
+            Fix encoding of opcode + RegisterID format instructions for 64-bit.
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+            Make VoidPtrPair actually be a pair of void*s.
+            (Possibly should make this change for 32-bit Mac platforms, too - but won't change 32-bit behaviour in this patch).
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+            Provide names for the timeoutCheckRegister & callFrameRegister on x86-64,
+            force x86-64 ctiTrampoline arguments onto the stack,
+            implement the asm trampolines for x86-64,
+            implement the restoreArgumentReference methods for x86-64 calling conventions.
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        * wtf/Platform.h:
+            Add switch settings to ENABLE(JIT), on PLATFORM(X86_64) (currently still disabled).
+
+2008-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add more CodeBlock statistics.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics):
+
+2008-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22897
+        <rdar://problem/6428342>
+        Look into feasibility of discarding bytecode after native codegen
+
+        Clear the bytecode Instruction vector at the end JIT generation.
+
+        Saves 4.8 MB on Membuster head.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Add logging for the case that someone tries
+        to dump the instructions of a CodeBlock that has had its bytecode
+        vector cleared.
+        (JSC::CodeBlock::CodeBlock): Initialize the instructionCount
+        (JSC::CodeBlock::handlerForBytecodeOffset): Use instructionCount instead
+        of the size of the instruction vector in the assertion.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Ditto.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Ditto.
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset): Ditto.
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset): Ditto.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setInstructionCount): Store the instruction vector size
+        in debug builds for assertions.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile): Clear the bytecode vector unless we
+        have compiled with Opcode sampling where we will continue to require it
+
+2008-12-17  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Adler.
+        Landed by Adam Barth.
+
+        Add ENABLE_TEXT_CARET to permit the ANDROID platform
+        to invalidate and draw the caret in a separate thread.
+
+        * wtf/Platform.h:
+        Default ENABLE_TEXT_CARET to 1.
+
+2008-12-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Don't use unique context group in JSGlobalContextCreate() on Tiger or Leopard, take two.
+
+        * API/JSContextRef.cpp: The previous patch that claimed to do this was making Tiger and
+        Leopard always use unique context group instead.
+
+2008-12-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22838
+        Remove dependency on the bytecode Instruction buffer in Interpreter::throwException
+        Part of <rdar://problem/6428342>
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset): Added. Function to get
+        a function Register index in a callFrame for a bytecode offset.
+        (JSC::CodeBlock::shrinkToFit): Shrink m_getByIdExceptionInfo and m_functionRegisterInfos.
+        * bytecode/CodeBlock.h:
+        (JSC::FunctionRegisterInfo::FunctionRegisterInfo): Added.
+        (JSC::CodeBlock::addFunctionRegisterInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Use functionRegisterForBytecodeOffset in JIT
+        mode.
+
+2008-12-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22837
+        Remove dependency on the bytecode Instruction buffer in Interpreter::cti_op_call_NotJSFunction
+        Part of <rdar://problem/6428342>
+
+        * interpreter/CallFrame.h: Added comment regarding returnPC storing a void*.
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC): We no longer have any cases of the PC
+        being in the instruction stream for JIT, so we can remove the check.
+        (JSC::Interpreter::cti_op_call_NotJSFunction): Use the CTI_RETURN_ADDRESS
+        as the call frame returnPC as it is only necessary for looking up when
+        throwing an exception.
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::): Added comment regarding returnPC storing a void*.
+        * jit/JIT.h: Remove ARG_instr4.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs): Don't pass the instruction pointer.
+
+2008-12-16  Darin Adler  <darin@apple.com>
+
+        Reviewed and landed by Cameron Zwarich.
+
+        Preparatory work for fixing
+
+        Bug 22887: Make UString::Rep use RefCounted rather than implementing its own ref counting
+        <https://bugs.webkit.org/show_bug.cgi?id=22887>
+
+        Change the various string translators used by Identifier:add() so that
+        they never zero the ref count of a newly created UString::Rep.
+
+        * runtime/Identifier.cpp:
+        (JSC::CStringTranslator::translate):
+        (JSC::Identifier::add):
+        (JSC::UCharBufferTranslator::translate):
+
+2008-12-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix for 'doze.
+
+        * assembler/AssemblerBuffer.h:
+
+2008-12-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Make the JIT compile on x86-64.
+        This largely involves populting the missing calls in MacroAssembler.h.
+        In addition some reinterpret_casts need removing from the JIT, and the
+        repatching property access code will need to be fully compiled out for
+        now.  The changes in interpret.cpp are to reorder the functions so that
+        the _generic forms come before all other property access methods, and
+        then to place all property access methods other than the generic forms
+        under control of the ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS macro.
+
+        No performance impact.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::storePtrWithRepatch):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::testImm64):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpq_rr):
+        (JSC::X86Assembler::cmpq_rm):
+        (JSC::X86Assembler::cmpq_im):
+        (JSC::X86Assembler::testq_i32m):
+        (JSC::X86Assembler::movl_mEAX):
+        (JSC::X86Assembler::movl_i32r):
+        (JSC::X86Assembler::movl_EAXm):
+        (JSC::X86Assembler::movq_rm):
+        (JSC::X86Assembler::movq_mEAX):
+        (JSC::X86Assembler::movq_mr):
+        (JSC::X86Assembler::movq_i64r):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64):
+        (JSC::X86Assembler::X86InstructionFormatter::immediate64):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::makeInt):
+
+2008-12-16  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22869: REGRESSION (r38407): http://news.cnet.com/8301-13579_3-9953533-37.html crashes
+        <https://bugs.webkit.org/show_bug.cgi?id=22869>
+        <rdar://problem/6402499>
+
+        Before r38407, Structure::m_nameInPrevious was ref'd due to it being
+        stored in a PropertyMap. However, PropertyMaps are created lazily after
+        r38407, so Structure::m_nameInPrevious is not necessarily ref'd while
+        it is being used. Making it a RefPtr instead of a raw pointer fixes
+        the problem.
+
+        Unfortunately, the crash in the bug is rather intermittent, and it is
+        impossible to add an assertion in UString::Ref::ref() to catch this bug
+        because some users of UString::Rep deliberately zero out the reference
+        count. Therefore, there is no layout test accompanying this bug fix.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure): Use get().
+        (JSC::Structure::materializePropertyMap): Use get().
+        (JSC::Structure::addPropertyTransitionToExistingStructure): Use get().
+        (JSC::Structure::addPropertyTransition): Use get().
+        * runtime/Structure.h: Make Structure::m_nameInPrevious a RefPtr instead
+        of a raw pointer.
+
+2008-12-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Attempt to fix win build. No 'using namespace WTF' in this file, needs manual WTF:: prefix.
+        Not sure why the build works as is here.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRandom):
+
+2008-12-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22876
+
+        Unify random number generation in JavaScriptCore & WebCore, by introducing
+        wtf/RandomNumber.h and moving wtf_random/wtf_random_init out of MathExtras.h.
+
+        wtf_random_init() has been renamed to initializeRandomNumberGenerator() and
+        lives in it's own private header: wtf/RandomNumberSeed.h, only intended to
+        be used from within JavaScriptCore.
+
+        wtf_random() has been renamed to randomNumber() and lives in a public header
+        wtf/RandomNumber.h, usable from within JavaScriptCore & WebCore. It encapsulates
+        the code taking care of initializing the random number generator (only when
+        building without ENABLE(JSC_MULTIPLE_THREADS), otherwhise initializeThreading()
+        already took care of that).
+
+        Functional change on darwin: Use random() instead of rand(), as it got a larger
+        period (more randomness). HTMLFormElement already contains this implementation
+        and I just moved it in randomNumber(), as  special case for PLATFORM(DARWIN).
+
+        * GNUmakefile.am: Add RandomNumber.(cpp/h) / RandomNumberSeed.h.
+        * JavaScriptCore.exp: Ditto.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.scons: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+        * runtime/MathObject.cpp: Use new WTF::randomNumber() functionality.
+        (JSC::mathProtoFuncRandom):
+        * wtf/MathExtras.h: Move wtf_random / wtf_random_init to new files.
+        * wtf/RandomNumber.cpp: Added.
+        (WTF::randomNumber):
+        * wtf/RandomNumber.h: Added.
+        * wtf/RandomNumberSeed.h: Added. Internal usage within JSC only.
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/ThreadingGtk.cpp: Rename wtf_random_init() to initializeRandomNumberGenerator().
+        (WTF::initializeThreading):
+        * wtf/ThreadingPthreads.cpp: Ditto.
+        (WTF::initializeThreading):
+        * wtf/ThreadingQt.cpp: Ditto.
+        (WTF::initializeThreading):
+        * wtf/ThreadingWin.cpp: Ditto.
+        (WTF::initializeThreading):
+
+2008-12-16 Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Qt/Win build fix
+
+        * JavaScriptCore.pri:
+
+2008-12-15  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix the build with GCC 4.0.
+
+        * Configurations/JavaScriptCore.xcconfig:  GCC 4.0 appears to have a bug when compiling with -funwind-tables on,
+        so don't use it with that compiler version.
+
+2008-12-15  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Cameron Zwarich.
+
+        <rdar://problem/6289933> Change WebKit-related projects to build with GCC 4.2 on Leopard.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Don't use unique context group in JSGlobalContextCreate() on Tiger or Leopard.
+
+        * API/JSContextRef.cpp: (JSGlobalContextCreate):
+
+2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6445089> Mach ports leak from worker threads
+
+        * interpreter/Interpreter.cpp: (JSC::getCPUTime):
+        Deallocate the thread self port.
+
+2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Construct stack frames in JIT code, so that backtracing can still work.
+        <rdar://problem/6447870> JIT should play nice with attempts to take stack traces
+
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::privateCompileMainPass):
+
+2008-12-15  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6402262> JavaScriptCore needs exception handling tables in order to get stack traces without frame pointers
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        Revert r39226 / Bug 22818: Unify JIT callback argument access OS X / Windows
+        This causes Acid3 failures – reverting for now & will revisit later.
+        https://bugs.webkit.org/show_bug.cgi?id=22873
+
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCTICall_internal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * wtf/Platform.h:
+
+2008-12-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6427048> crash due to infinite recursion after setting window.__proto__ = window
+
+        Replaced toGlobalObject with the more generally useful unwrappedObject and used it to
+        fix the cycle detection code in put(__proto__).
+
+        * JavaScriptCore.exp: Updated.
+
+        * runtime/JSGlobalObject.cpp: Removed toGlobalObject. We now use unwrappedObject instead.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::isGlobalObject): Ditto.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval): Use unwrappedObject and isGlobalObject here rather than toGlobalObject.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put): Rewrote prototype cycle checking loop. Use unwrappedObject in the loop now.
+        (JSC::JSObject::unwrappedObject): Replaced toGlobalObject with this new function.
+        * runtime/JSObject.h: More of the same.
+
+2008-12-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        
+        Visual Studio requires visibility of forward declarations to match class declaration.
+
+        * assembler/X86Assembler.h:
+
+2008-12-15  Gustavo Noronha Silva  <kov@kov.eti.br>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22686
+
+        GTK+ build fix.
+
+        * GNUmakefile.am:
+
+2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add support to X86Assembler emitting instructions that access all 16 registers on x86-64.
+        Add a new formating class, that is reponsible for both emitting the opcode bytes and the
+        ModRm  bytes of an instruction in a single call; this can insert the REX byte as necessary
+        before the opcode, but has access to the register numbers to build the REX.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::isAligned):
+        (JSC::AssemblerBuffer::data):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::load16):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::storePtrWithRepatch):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::push):
+        (JSC::MacroAssembler::compareImm32ForBranch):
+        (JSC::MacroAssembler::compareImm32ForBranchEquality):
+        (JSC::MacroAssembler::testImm32):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::jb32):
+        (JSC::MacroAssembler::je16):
+        (JSC::MacroAssembler::jg32):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jne32):
+        (JSC::MacroAssembler::jump):
+        * assembler/X86Assembler.h:
+        (JSC::X86::):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::size):
+        (JSC::X86Assembler::push_r):
+        (JSC::X86Assembler::pop_r):
+        (JSC::X86Assembler::push_i32):
+        (JSC::X86Assembler::push_m):
+        (JSC::X86Assembler::pop_m):
+        (JSC::X86Assembler::addl_rr):
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::addl_ir):
+        (JSC::X86Assembler::addq_ir):
+        (JSC::X86Assembler::addl_im):
+        (JSC::X86Assembler::andl_rr):
+        (JSC::X86Assembler::andl_ir):
+        (JSC::X86Assembler::orl_rr):
+        (JSC::X86Assembler::orl_mr):
+        (JSC::X86Assembler::orl_ir):
+        (JSC::X86Assembler::subl_rr):
+        (JSC::X86Assembler::subl_mr):
+        (JSC::X86Assembler::subl_ir):
+        (JSC::X86Assembler::subl_im):
+        (JSC::X86Assembler::xorl_rr):
+        (JSC::X86Assembler::xorl_ir):
+        (JSC::X86Assembler::sarl_i8r):
+        (JSC::X86Assembler::sarl_CLr):
+        (JSC::X86Assembler::shll_i8r):
+        (JSC::X86Assembler::shll_CLr):
+        (JSC::X86Assembler::imull_rr):
+        (JSC::X86Assembler::imull_i32r):
+        (JSC::X86Assembler::idivl_r):
+        (JSC::X86Assembler::cmpl_rr):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::cmpl_mr):
+        (JSC::X86Assembler::cmpl_ir):
+        (JSC::X86Assembler::cmpl_ir_force32):
+        (JSC::X86Assembler::cmpl_im):
+        (JSC::X86Assembler::cmpl_im_force32):
+        (JSC::X86Assembler::cmpw_rm):
+        (JSC::X86Assembler::testl_rr):
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::testl_i32m):
+        (JSC::X86Assembler::testq_rr):
+        (JSC::X86Assembler::testq_i32r):
+        (JSC::X86Assembler::testb_i8r):
+        (JSC::X86Assembler::sete_r):
+        (JSC::X86Assembler::setz_r):
+        (JSC::X86Assembler::setne_r):
+        (JSC::X86Assembler::setnz_r):
+        (JSC::X86Assembler::cdq):
+        (JSC::X86Assembler::xchgl_rr):
+        (JSC::X86Assembler::movl_rr):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::movl_i32r):
+        (JSC::X86Assembler::movl_i32m):
+        (JSC::X86Assembler::movq_rr):
+        (JSC::X86Assembler::movq_rm):
+        (JSC::X86Assembler::movq_mr):
+        (JSC::X86Assembler::movzwl_mr):
+        (JSC::X86Assembler::movzbl_rr):
+        (JSC::X86Assembler::leal_mr):
+        (JSC::X86Assembler::call):
+        (JSC::X86Assembler::jmp):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::jmp_m):
+        (JSC::X86Assembler::jne):
+        (JSC::X86Assembler::jnz):
+        (JSC::X86Assembler::je):
+        (JSC::X86Assembler::jl):
+        (JSC::X86Assembler::jb):
+        (JSC::X86Assembler::jle):
+        (JSC::X86Assembler::jbe):
+        (JSC::X86Assembler::jge):
+        (JSC::X86Assembler::jg):
+        (JSC::X86Assembler::ja):
+        (JSC::X86Assembler::jae):
+        (JSC::X86Assembler::jo):
+        (JSC::X86Assembler::jp):
+        (JSC::X86Assembler::js):
+        (JSC::X86Assembler::addsd_rr):
+        (JSC::X86Assembler::addsd_mr):
+        (JSC::X86Assembler::cvtsi2sd_rr):
+        (JSC::X86Assembler::cvttsd2si_rr):
+        (JSC::X86Assembler::movd_rr):
+        (JSC::X86Assembler::movsd_rm):
+        (JSC::X86Assembler::movsd_mr):
+        (JSC::X86Assembler::mulsd_rr):
+        (JSC::X86Assembler::mulsd_mr):
+        (JSC::X86Assembler::pextrw_irr):
+        (JSC::X86Assembler::subsd_rr):
+        (JSC::X86Assembler::subsd_mr):
+        (JSC::X86Assembler::ucomis_rr):
+        (JSC::X86Assembler::int3):
+        (JSC::X86Assembler::ret):
+        (JSC::X86Assembler::predictNotTaken):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::align):
+        (JSC::X86Assembler::link):
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormater::prefix):
+        (JSC::X86Assembler::X86InstructionFormater::oneByteOp):
+        (JSC::X86Assembler::X86InstructionFormater::twoByteOp):
+        (JSC::X86Assembler::X86InstructionFormater::oneByteOp64):
+        (JSC::X86Assembler::X86InstructionFormater::oneByteOp8):
+        (JSC::X86Assembler::X86InstructionFormater::twoByteOp8):
+        (JSC::X86Assembler::X86InstructionFormater::instructionImmediate8):
+        (JSC::X86Assembler::X86InstructionFormater::instructionImmediate32):
+        (JSC::X86Assembler::X86InstructionFormater::instructionRel32):
+        (JSC::X86Assembler::X86InstructionFormater::size):
+        (JSC::X86Assembler::X86InstructionFormater::isAligned):
+        (JSC::X86Assembler::X86InstructionFormater::data):
+        (JSC::X86Assembler::X86InstructionFormater::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormater::registerModRM):
+        (JSC::X86Assembler::X86InstructionFormater::memoryModRM):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2008-12-15  Darin Adler  <darin@apple.com>
+
+        * interpreter/RegisterFile.h: Tweak include formatting.
+
+2008-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix for Gtk+.
+
+        * interpreter/RegisterFile.h: Include stdio.h for fprintf
+
+2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6444455> Worker Thread crash running multiple workers for a moderate amount of time
+
+        * interpreter/RegisterFile.h: (JSC::RegisterFile::RegisterFile):
+        Improve error handling: if mmap fails, crash immediately, and print out the reason.
+
+2008-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Re-enable WREC on 64-bit.
+        Implements one of the MacroAssembler::jnzPtr methods, previously only implemented for 32-bit x86.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22849
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::testImm64):
+        (JSC::MacroAssembler::jnzPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testq_i32r):
+        (JSC::X86Assembler::testq_rr):
+        * wtf/Platform.h:
+
+2008-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix PPC builds.
+
+        * assembler/MacroAssembler.h:
+
+2008-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix only, no review.
+
+        * bytecode/CodeBlock.h:
+
+2008-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Port the remainder of the JIT, bar calling convention related code, and code
+        implementing optimizations which can be disabled, to use the MacroAssembler.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::MacroAssembler::RepatchBuffer::RepatchBuffer):
+        (JSC::MacroAssembler::RepatchBuffer::link):
+        (JSC::MacroAssembler::RepatchBuffer::addressOf):
+        (JSC::MacroAssembler::RepatchBuffer::setPtr):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::lshift32):
+        (JSC::MacroAssembler::mod32):
+        (JSC::MacroAssembler::rshift32):
+        (JSC::MacroAssembler::storePtrWithRepatch):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        (JSC::MacroAssembler::jump):
+        (JSC::MacroAssembler::label):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::xchgl_rr):
+        (JSC::X86Assembler::jmp_m):
+        (JSC::X86Assembler::repatchAddress):
+        (JSC::X86Assembler::getRelocatedAddress):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::JITCodeRef::JITCodeRef):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::executablePool):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileLinkPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JumpTable::JumpTable):
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::JSRInfo::JSRInfo):
+        * jit/JITArithmetic.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitCTICall_internal):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2008-12-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix the failures of the following layout tests, which regressed in
+        r39255:
+
+        fast/dom/StyleSheet/ownerNode-lifetime-2.html
+        fast/xsl/transform-xhr-doc.xhtml
+
+        The binary search in CodeBlock::getByIdExceptionInfoForBytecodeOffset()
+        doesn't guarantee that it actually finds a match, so add an explicit check
+        for this.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+
+2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Replace emitPutCallArg methods with emitPutJITStubArg methods.  Primarily to make the argument numbering
+        more sensible (1-based incrementing by 1, rather than 0-based incrementing by 4).  The CTI name also seems
+        to be being deprecated from the code generally.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+
+2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix windows builds.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+
+2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove loop counter 'i' from the JIT generation passes, replace with a member m_bytecodeIndex.
+
+        No impact on performance.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JmpTable::JmpTable):
+        (JSC::JIT::emitCTICall):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitGetVirtualRegisters):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitCTICall_internal):
+        (JSC::JIT::emitJumpSlowCaseIfJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
+        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutByIdSlowCase):
+
+2008-12-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        <rdar://problem/6428342> Look into feasibility of discarding bytecode after native codegen
+
+        Move more JIT functionality to using offsets into the Instruction buffer
+        instead of raw pointers. Two to go!
+
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC): Rename from vPCForPC.
+        (JSC::Interpreter::resolve): Pass offset to exception helper.
+        (JSC::Interpreter::resolveSkip): Ditto.
+        (JSC::Interpreter::resolveGlobal): Ditto.
+        (JSC::Interpreter::resolveBaseAndProperty): Ditto.
+        (JSC::Interpreter::resolveBaseAndFunc): Ditto.
+        (JSC::isNotObject): Ditto.
+        (JSC::Interpreter::unwindCallFrame): Call bytecodeOffsetForPC.
+        (JSC::Interpreter::throwException): Use offsets instead of vPCs.
+        (JSC::Interpreter::privateExecute): Pass offset to exception helper.
+        (JSC::Interpreter::retrieveLastCaller): Ditto.
+        (JSC::Interpreter::cti_op_instanceof): Ditto.
+        (JSC::Interpreter::cti_op_call_NotJSFunction): Ditto.
+        (JSC::Interpreter::cti_op_resolve): Pass offset to exception helper.
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct): Ditto.
+        (JSC::Interpreter::cti_op_resolve_func): Ditto.
+        (JSC::Interpreter::cti_op_resolve_skip): Ditto.
+        (JSC::Interpreter::cti_op_resolve_global): Ditto.
+        (JSC::Interpreter::cti_op_resolve_with_base): Ditto.
+        (JSC::Interpreter::cti_op_throw): Ditto.
+        (JSC::Interpreter::cti_op_in): Ditto.
+        (JSC::Interpreter::cti_vm_throw): Ditto.
+        * interpreter/Interpreter.h:
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Don't pass unnecessary vPC to stub.
+        * jit/JIT.h: Remove ARG_instr1 - ARG_instr3 and ARG_instr5 - ARG_instr6.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallEvalSetupArgs): Don't pass unnecessary vPC to stub..
+        (JSC::JIT::compileOpConstructSetupArgs): Ditto.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError): Take an offset instead of vPC.
+        (JSC::createInvalidParamError): Ditto.
+        (JSC::createNotAConstructorError): Ditto.
+        (JSC::createNotAFunctionError): Ditto.
+        (JSC::createNotAnObjectError): Ditto.
+        * runtime/ExceptionHelpers.h:
+
+2008-12-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 22835: Crash during bytecode generation when comparing to null
+        <https://bugs.webkit.org/show_bug.cgi?id=22835>
+        <rdar://problem/6286749>
+
+        Change the special cases in bytecode generation for comparison to null
+        to use tempDestination().
+
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+
+2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move slow-cases of JIT code generation over to the MacroAssembler interface.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::Label::Label):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::jg32):
+        (JSC::MacroAssembler::jzPtr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::emitGetVariableObjectRegister):
+        (JSC::JIT::emitPutVariableObjectRegister):
+        * jit/JIT.h:
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+        (JSC::JIT::getSlowCase):
+        (JSC::JIT::linkSlowCase):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::linkSlowCaseIfNotJSCell):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+
+2008-12-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 22828: Do not inspect bytecode instruction stream for op_get_by_id exception information
+        <https://bugs.webkit.org/show_bug.cgi?id=22828>
+
+        In order to remove the bytecode instruction stream after generating
+        native code, all inspection of bytecode instructions at runtime must
+        be removed. One particular instance of this is the special handling of
+        exceptions thrown by the op_get_by_id emitted directly before an
+        op_construct or an op_instanceof. This patch moves that information to
+        an auxiliary data structure in CodeBlock.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addGetByIdExceptionInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitGetByIdExceptionInfo):
+        * parser/Nodes.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+
+2008-12-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Change exception information accessors to take offsets into the bytecode
+        instruction buffer instead of pointers so that they can work even even
+        if the bytecode buffer is purged.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::instructionOffsetForNth):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+
+2008-12-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Tiny bit of refactoring in quantifier generation.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+
+2008-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove dependancy on having the Instruction buffer in order to
+        deref Structures used for property access and global resolves.
+        Instead, we put references to the necessary Structures in auxiliary
+        data structures on the CodeBlock. This is not an ideal solution,
+        as we still pay for having the Structures in two places and we
+        would like to eventually just hold on to offsets into the machine
+        code buffer.
+
+        - Also removes CodeBlock bloat in non-JIT by #ifdefing the JIT
+          only data structures.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * bytecode/CodeBlock.cpp:
+        (JSC::isGlobalResolve):
+        (JSC::isPropertyAccess):
+        (JSC::instructionOffsetForNth):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        (JSC::getNativePC):
+        (JSC::CodeBlock::instructions):
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::numberOfStructureStubInfos):
+        (JSC::CodeBlock::addStructureStubInfo):
+        (JSC::CodeBlock::structureStubInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::globalResolveInfo):
+        (JSC::CodeBlock::numberOfCallLinkInfos):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::callLinkInfo):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/Opcode.h:
+        (JSC::):
+        * bytecode/StructureStubInfo.cpp: Copied from bytecode/CodeBlock.cpp.
+        (JSC::StructureStubInfo::deref):
+        * bytecode/StructureStubInfo.h: Copied from bytecode/CodeBlock.h.
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_resolve_global):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+
+2008-12-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove CTI_ARGUMENTS mode, use va_start implementation on Windows,
+        unifying JIT callback (cti_*) argument access on OS X & Windows
+
+        No performance impact.
+
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitCTICall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * wtf/Platform.h:
+
+2008-12-11  Holger Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20953
+
+        For Qt it is not pratical to have a FontCache and GlyphPageTreeNode
+        implementation. This is one of the reasons why the Qt port is currently not
+        using WebCore/platform/graphics/Font.cpp. By allowing to not use
+        the simple/fast-path the Qt port will be able to use it.
+
+        Introduce USE(FONT_FAST_PATH) and define it for every port but the
+        Qt one.
+
+        * wtf/Platform.h: Enable USE(FONT_FAST_PATH)
+
+2008-12-11  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler and landed by Holger Freyther.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22648>
+        Fix threading on Qt-port and Gtk-port for Sampling tool.
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::waitForThreadCompletion):
+        * wtf/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+
+2008-12-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 22734: Debugger crashes when stepping into a function call in a return statement
+        <https://bugs.webkit.org/show_bug.cgi?id=22734>
+        <rdar://problem/6426796>
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): The DebuggerCallFrame uses
+        the 'this' value stored in a callFrame, so op_convert_this should be
+        emitted at the beginning of a function body when generating bytecode
+        with debug hooks.
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisObject): The assertion inherent in the call
+        to asObject() here is valid, because any 'this' value should have been
+        converted to a JSObject*.
+
+2008-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Port more of the JIT to use the MacroAssembler interface.
+        
+        Everything in the main pass, bar a few corner cases (operations with required
+        registers, or calling convention code).  Slightly refactors array creation,
+        moving the offset calculation into the callFrame into C code (reducing code
+        planted).
+
+        Overall this appears to be a 1% win on v8-tests, due to the smaller immediates
+        being planted (in jfalse in particular).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_new_array):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+
+2008-12-10  Sam Weinig  <sam@webkit.org>
+
+        Fix non-JIT builds.
+
+        * bytecode/CodeBlock.h:
+
+2008-12-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/6428332> Remove the CTI return address table from CodeBlock
+
+        Step 2:
+
+        Convert the return address table from a HashMap to a sorted Vector.  This
+        reduces the size of the data structure by ~4.5MB on Membuster head.
+
+        SunSpider reports a 0.5% progression.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::sizeInBytes): Generic method to get the cost of a Vector.
+        (JSC::CodeBlock::dumpStatistics): Add dumping of member sizes.
+        * bytecode/CodeBlock.h:
+        (JSC::PC::PC): Struct representing NativePC -> VirtualPC mappings.
+        (JSC::getNativePC): Helper for binary chop.
+        (JSC::CodeBlock::getBytecodeIndex): Used to get the VirtualPC from a
+        NativePC using a binary chop of the pcVector.
+        (JSC::CodeBlock::pcVector): Accessor.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::vPCForPC): Use getBytecodeIndex instead of jitReturnAddressVPCMap().get().
+        (JSC::Interpreter::cti_op_instanceof): Ditto.
+        (JSC::Interpreter::cti_op_resolve): Ditto.
+        (JSC::Interpreter::cti_op_resolve_func): Ditto.
+        (JSC::Interpreter::cti_op_resolve_skip): Ditto.
+        (JSC::Interpreter::cti_op_resolve_with_base): Ditto.
+        (JSC::Interpreter::cti_op_throw): Ditto.
+        (JSC::Interpreter::cti_op_in): Ditto.
+        (JSC::Interpreter::cti_vm_throw): Ditto.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile): Reserve exact capacity and fill the pcVector.
+
+2008-12-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added WREC support for an assertion followed by a quantifier. Fixed
+        PCRE to match.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses): Throw away the quantifier, since
+        it's meaningless. (Firefox does the same.)
+
+        * pcre/pcre_compile.cpp:
+        (compileBranch): ditto.
+
+2008-12-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        In preparation for compiling WREC without PCRE:
+        
+        Further relaxed WREC's parsing to be more web-compatible. Fixed PCRE to
+        match in cases where it didn't already.
+        
+        Changed JavaScriptCore to report syntax errors detected by WREC, rather
+        than falling back on PCRE any time WREC sees an error.
+        
+        * pcre/pcre_compile.cpp:
+        (checkEscape): Relaxed parsing of \c and \N escapes to be more
+        web-compatible.
+        
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp): Only fall back on PCRE if WREC has not reported
+        a syntax error.
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp): Fixed some error reporting to
+        match PCRE.
+
+        * wrec/WRECParser.cpp: Added error messages that match PCRE.
+
+        (JSC::WREC::Parser::consumeGreedyQuantifier):
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseNonCharacterEscape): Updated the above functions to
+        use the new setError API.
+
+        (JSC::WREC::Parser::consumeEscape): Relaxed parsing of \c \N \u \x \B
+        to be more web-compatible.
+
+        (JSC::WREC::Parser::parseAlternative): Distinguish between a malformed
+        quantifier and a quantifier with no prefix, like PCRE does.
+
+        (JSC::WREC::Parser::consumeParenthesesType): Updated to use the new setError API.
+
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::error):
+        (JSC::WREC::Parser::syntaxError):
+        (JSC::WREC::Parser::parsePattern):
+        (JSC::WREC::Parser::reset):
+        (JSC::WREC::Parser::setError): Store error messages instead of error codes,
+        to provide for exception messages. Use a setter for reporting errors, so
+        errors detected early are not overwritten by errors detected later.
+
+2008-12-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use va_args to access cti function arguments.
+        https://bugs.webkit.org/show_bug.cgi?id=22774
+
+        This may be a minor regression, but we'll take the hit if so to reduce fragility.
+
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+
+2008-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed twice by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22752
+        Clear SymbolTable after codegen for Function codeblocks that
+        don't require an activation
+
+        This is a ~1.5MB improvement on Membuster-head.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics): Add logging of non-empty symbol tables
+        and total size used by symbol tables.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Clear the symbol table here.
+
+2008-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unnecessary extra lookup when throwing an exception.
+        We used to first lookup the target offset using getHandlerForVPC
+        and then we would lookup the native code stub using 
+        nativeExceptionCodeForHandlerVPC.  Instead, we can just pass around
+        the HandlerInfo.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::handlerForVPC): Return the HandlerInfo.
+        * bytecode/CodeBlock.h: Remove nativeExceptionCodeForHandlerVPC.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Return a HandlerInfo instead of
+        and Instruction offset.
+        (JSC::Interpreter::privateExecute): Get the offset from HandlerInfo.
+        (JSC::Interpreter::cti_op_throw): Get the native code from the HandleInfo.
+        (JSC::Interpreter::cti_vm_throw): Ditto.
+        * interpreter/Interpreter.h:
+
+2008-12-09  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Speculative fix for the Chromium-Windows bot.
+        Add JavaScriptCore/os-win32 to the include path (for stdint.h)
+        Strangely it builds fine on my local windows box (or at least doesn't hit this error)
+
+        * JavaScriptCore.scons:
+
+2008-12-09  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+        
+        Add ExecutableAllocator files missing from Scons build.
+
+        * JavaScriptCore.scons:
+
+2008-12-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22631
+        Allow ScriptCallFrame query names of functions in the call stack.
+
+        * JavaScriptCore.exp: added InternalFunction::name and
+        UString operator==() as exported symbol
+
+2008-12-08  Judit Jasz  <jasy@inf.u-szeged.hu>
+
+        Reviewed and tweaked by Cameron Zwarich.
+
+        Bug 22352: Annotate opcodes with their length
+        <https://bugs.webkit.org/show_bug.cgi?id=22352>
+
+        * bytecode/Opcode.cpp:
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+
+2008-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Implemented more of the relaxed and somewhat weird rules for deciding
+        how to interpret a non-pattern-character.
+        
+        * wrec/Escapes.h:
+        (JSC::WREC::Escape::):
+        (JSC::WREC::Escape::Escape): Eliminated Escape::None because it was
+        unused. If you see an '\\', it's either a valid escape or an error.
+
+        * wrec/Quantifier.h:
+        (JSC::WREC::Quantifier::Quantifier):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier): Renamed "noMaxSpecified"
+        to "Infinity", since that's what it means.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeGreedyQuantifier): Re-wrote {n,m} parsing rules
+        because they were too strict before. Added support for backtracking
+        in the case where the {n,m} fails to parse as a quantifier, and yet is
+        not a syntax error.
+
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseNonCharacterEscape): Eliminated Escape::None,
+        as above.
+
+        (JSC::WREC::Parser::consumeEscape): Don't treat ASCII and _ escapes
+        as syntax errors. See fast/regex/non-pattern-characters.html.
+        
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::SavedState::SavedState):
+        (JSC::WREC::Parser::SavedState::restore): Added a state backtracker,
+        since parsing {n,m} forms requires backtracking if the form turns out
+        not to be a quantifier.
+
+2008-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Refactored WREC parsing so that only one piece of code needs to know
+        the relaxed and somewhat weird rules for deciding how to interpret a
+        non-pattern-character, in preparation for implementing those rules.
+        
+        Also, implemented the relaxed and somewhat weird rules for '}' and ']'.
+
+        * wrec/WREC.cpp: Reduced the regular expression size limit. Now that
+        WREC handles ']' properly, it compiles fast/js/regexp-charclass-crash.html,
+        which makes it hang at the old limit. (The old limit was based on the
+        misimpression that the same value in PCRE limited the regular expression
+        pattern size; in reality, it limited the expected compiled regular
+        expression size. WREC doesn't have a way to calculate an expected
+        compiled regular expression size, but this should be good enough.)
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::parsePatternCharacterSequence): Nixed this function because
+        it contained a second copy of the logic for handling non-pattern-characters,
+        which is about to get a lot more complicated.
+
+        (JSC::WREC::PatternCharacterSequence::PatternCharacterSequence): 
+        (JSC::WREC::PatternCharacterSequence::size):
+        (JSC::WREC::PatternCharacterSequence::append):
+        (JSC::WREC::PatternCharacterSequence::flush): Helper object for generating
+        an optimized sequence of pattern characters.
+
+        (JSC::WREC::Parser::parseNonCharacterEscape): Renamed to reflect the fact
+        that the main parseAlternative loop handles character escapes.
+
+        (JSC::WREC::Parser::parseAlternative): Moved pattern character sequence
+        logic from parsePatternCharacterSequence to here, using
+        PatternCharacterSequence to help with the details.
+
+        * wrec/WRECParser.h: Updated for renames.
+
+2008-12-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6166088> Give JSGlobalContextCreate a behavior that is concurrency aware,
+        and un-deprecate it
+
+        * API/JSContextRef.cpp: (JSGlobalContextCreate):
+        * API/JSContextRef.h:
+        Use a unique context group for the context, unless the application was linked against old
+        JavaScriptCore.
+
+2008-12-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for <rdar://problem/6428332> Remove the CTI return address table from CodeBlock
+
+        Step 1:
+
+        Remove use of jitReturnAddressVPCMap when looking for vPC to store Structures
+        in for cached lookup.  Instead, use the offset in the StructureStubInfo that is
+        already required.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics): Fix extraneous semicolon.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdSelf):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdReplace):
+        (JSC::JIT::compilePutByIdTransition):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength): Remove extra call to getStubInfo.
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2008-12-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Port the op_j?n?eq_null JIT code generation to use the MacroAssembler,
+        and clean up slightly at the same time.  The 'j' forms currently compare,
+        then set a register, then compare again, then branch.  Branch directly on
+        the result of the first compare.
+
+        Around a 1% progression on deltablue, crypto & early boyer, for about 1/2%
+        overall on v8-tests.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdSlowCase):
+
+2008-12-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Expand MacroAssembler to support more operations, required by the JIT.
+
+        Generally adds more operations and permutations of operands to the existing
+        interface.  Rename 'jset' to 'jnz' and 'jnset' to 'jz', which seem clearer,
+        and require that immediate pointer operands (though not pointer addresses to
+        load and store instructions) are wrapped in a ImmPtr() type, akin to Imm32().
+
+        No performance impact.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::):
+        (JSC::MacroAssembler::ImmPtr::ImmPtr):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::testImm32):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::jb32):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::je32):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jne32):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jnz32):
+        (JSC::MacroAssembler::jzPtr):
+        (JSC::MacroAssembler::jz32):
+        (JSC::MacroAssembler::joSub32):
+        (JSC::MacroAssembler::jump):
+        (JSC::MacroAssembler::sete32):
+        (JSC::MacroAssembler::setne32):
+        (JSC::MacroAssembler::setnz32):
+        (JSC::MacroAssembler::setz32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::andl_i8r):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::cmpl_mr):
+        (JSC::X86Assembler::cmpl_i8m):
+        (JSC::X86Assembler::subl_mr):
+        (JSC::X86Assembler::testl_i32m):
+        (JSC::X86Assembler::xorl_i32r):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::modRm_opmsib):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutCTIArgConstant):
+        (JSC::JIT::emitPutCTIParam):
+        (JSC::JIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+
+2008-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a bug where WREC would allow a quantifier whose minimum was
+        greater than its maximum.
+        
+        * wrec/Quantifier.h:
+        (JSC::WREC::Quantifier::Quantifier): ASSERT that the quantifier is not
+        backwards.
+        
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeGreedyQuantifier): Verify that the minimum
+        is not greater than the maximum.
+
+2008-12-08  Eric Seidel  <eric@webkit.org>
+        
+        Build fix only, no review.
+
+        * JavaScriptCore.scons: add bytecode/JumpTable.cpp
+
+2008-12-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=22716
+        <rdar://problem/6428315>
+        Add RareData structure to CodeBlock for infrequently used auxiliary data
+        members.
+
+        Reduces memory on Membuster-head by ~.5MB 
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::getHandlerForVPC):
+        (JSC::CodeBlock::nativeExceptionCodeForHandlerVPC):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfExceptionHandlers):
+        (JSC::CodeBlock::addExceptionHandler):
+        (JSC::CodeBlock::exceptionHandler):
+        (JSC::CodeBlock::addFunction):
+        (JSC::CodeBlock::function):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        (JSC::CodeBlock::addRegExp):
+        (JSC::CodeBlock::regexp):
+        (JSC::CodeBlock::numberOfImmediateSwitchJumpTables):
+        (JSC::CodeBlock::addImmediateSwitchJumpTable):
+        (JSC::CodeBlock::immediateSwitchJumpTable):
+        (JSC::CodeBlock::numberOfCharacterSwitchJumpTables):
+        (JSC::CodeBlock::addCharacterSwitchJumpTable):
+        (JSC::CodeBlock::characterSwitchJumpTable):
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables):
+        (JSC::CodeBlock::addStringSwitchJumpTable):
+        (JSC::CodeBlock::stringSwitchJumpTable):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
+
+2008-11-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16814
+        Allow ports to disable ActiveX->NPAPI conversion for Media Player.
+        Improve handling of miscellaneous ActiveX objects.
+
+        * wtf/Platform.h: Add another ENABLE(...).
+
+2008-12-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add dumping of CodeBlock member structure usage.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::isEmpty):
+
+2008-12-08  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22555: Sort "children" sections in Xcode project files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22555>
+
+        Reviewed by Eric Seidel.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Sorted.
+
+2008-12-08  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Enable Pan scrolling only when building on PLATFORM(WIN_OS)
+        Previously platforms like Apple Windows WebKit, Cairo Windows WebKit,
+        Wx and Chromium were enabling it explicitly, now we just turn it on
+        for all WIN_OS, later platforms can turn it off as needed on Windows
+        (or turn it on under Linux, etc.)
+        https://bugs.webkit.org/show_bug.cgi?id=22698
+
+        * wtf/Platform.h:
+
+2008-12-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Add basic memory statistics dumping for CodeBlock.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+
+2008-12-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Linux build with newer gcc/glibc.
+
+        * jit/ExecutableAllocatorPosix.cpp: Include unistd.h for
+        getpagesize(), according to
+        http://opengroup.org/onlinepubs/007908775/xsh/getpagesize.html
+
+2008-12-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the build with Qt on Windows.
+
+        * JavaScriptCore.pri: Compile ExecutableAllocatorWin.cpp on Windows.
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Fix non-WREC builds
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Put ENABLE(ASSEMBLER) guards around use of ExecutableAllocator in global data
+
+        Correct Qt and Gtk project files
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * runtime/JSGlobalData.h:
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add new files to other projects.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        Rename ExecutableAllocatorMMAP to the more sensible ExecutableAllocatorPosix
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorPosix.cpp: Renamed from JavaScriptCore/jit/ExecutableAllocatorMMAP.cpp.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich and Sam Weinig
+
+        <rdar://problem/6309878> Need more granular control over allocation of executable memory (21783)
+        <https://bugs.webkit.org/show_bug.cgi?id=21783>
+
+        Add a new allocator for use by the JIT that provides executable pages, so
+        we can get rid of the current hack that makes the entire heap executable.
+
+        1-2% progression on SunSpider-v8, 1% on SunSpider.  Reduces memory usage as well!
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::size):
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::size):
+        (JSC::MacroAssembler::copyCode):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::size):
+        (JSC::X86Assembler::executableCopy):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::executablePool):
+        (JSC::CodeBlock::setExecutablePool):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::~Interpreter):
+        * interpreter/Interpreter.h:
+        * jit/ExecutableAllocator.cpp: Added.
+        * jit/ExecutableAllocator.h: Added.
+        (JSC::ExecutablePool::create):
+        (JSC::ExecutablePool::alloc):
+        (JSC::ExecutablePool::~ExecutablePool):
+        (JSC::ExecutablePool::available):
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::poolForSize):
+        (JSC::ExecutablePool::sizeForAllocation):
+        * jit/ExecutableAllocatorMMAP.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorWin.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * parser/Nodes.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::poolForSize):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::~RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WRECGenerator.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap):
+        (TryVirtualAlloc):
+        (TryDevMem):
+        (TCMalloc_SystemRelease):
+
+2008-12-06  Sam Weinig  <sam@webkit.org>
+
+        Fix the Gtk build.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+
+2008-12-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich,
+
+        Move CodeBlock constructor into the .cpp file.
+
+        Sunspider reports a .7% progression, but I can only assume this
+        is noise.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+
+2008-12-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Split JumpTable code into its own file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/JumpTable.cpp: Copied from bytecode/CodeBlock.cpp.
+        * bytecode/JumpTable.h: Copied from bytecode/CodeBlock.h.
+
+2008-12-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22715
+        Encapsulate more CodeBlock members in preparation
+        of moving some of them to a rare data structure.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::locationForOffset):
+        (JSC::printConditionalJump):
+        (JSC::printGetByIdOp):
+        (JSC::printPutByIdOp):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::getHandlerForVPC):
+        (JSC::CodeBlock::nativeExceptionCodeForHandlerVPC):
+        (JSC::CodeBlock::lineNumberForVPC):
+        (JSC::CodeBlock::expressionRangeForVPC):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::addCaller):
+        (JSC::CodeBlock::removeCaller):
+        (JSC::CodeBlock::isKnownNotImmediate):
+        (JSC::CodeBlock::isConstantRegisterIndex):
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::isTemporaryRegisterIndex):
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::instructions):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::ownerNode):
+        (JSC::CodeBlock::setGlobalData):
+        (JSC::CodeBlock::setThisRegister):
+        (JSC::CodeBlock::thisRegister):
+        (JSC::CodeBlock::setNeedsFullScopeChain):
+        (JSC::CodeBlock::needsFullScopeChain):
+        (JSC::CodeBlock::setUsesEval):
+        (JSC::CodeBlock::usesEval):
+        (JSC::CodeBlock::setUsesArguments):
+        (JSC::CodeBlock::usesArguments):
+        (JSC::CodeBlock::codeType):
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::numberOfPropertyAccessInstructions):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::propertyAccessInstruction):
+        (JSC::CodeBlock::numberOfCallLinkInfos):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::callLinkInfo):
+        (JSC::CodeBlock::numberOfJumpTargets):
+        (JSC::CodeBlock::addJumpTarget):
+        (JSC::CodeBlock::jumpTarget):
+        (JSC::CodeBlock::lastJumpTarget):
+        (JSC::CodeBlock::numberOfExceptionHandlers):
+        (JSC::CodeBlock::addExceptionHandler):
+        (JSC::CodeBlock::exceptionHandler):
+        (JSC::CodeBlock::addExpressionInfo):
+        (JSC::CodeBlock::numberOfLineInfos):
+        (JSC::CodeBlock::addLineInfo):
+        (JSC::CodeBlock::lastLineInfo):
+        (JSC::CodeBlock::jitReturnAddressVPCMap):
+        (JSC::CodeBlock::numberOfIdentifiers):
+        (JSC::CodeBlock::addIdentifier):
+        (JSC::CodeBlock::identifier):
+        (JSC::CodeBlock::numberOfConstantRegisters):
+        (JSC::CodeBlock::addConstantRegister):
+        (JSC::CodeBlock::constantRegister):
+        (JSC::CodeBlock::addFunction):
+        (JSC::CodeBlock::function):
+        (JSC::CodeBlock::addFunctionExpression):
+        (JSC::CodeBlock::functionExpression):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        (JSC::CodeBlock::addRegExp):
+        (JSC::CodeBlock::regexp):
+        (JSC::CodeBlock::symbolTable):
+        (JSC::CodeBlock::evalCodeCache):
+        New inline setters/getters.
+
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::ProgramCodeBlock::~ProgramCodeBlock):
+        (JSC::ProgramCodeBlock::clearGlobalObject):
+        * bytecode/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/Label.h:
+        * interpreter/CallFrame.cpp:
+        * interpreter/Interpreter.cpp:
+        * jit/JIT.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITPropertyAccess.cpp:
+        * parser/Nodes.cpp:
+        * runtime/Arguments.h:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSGlobalObject.cpp:
+        Change direct access to use new getter/setters.
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Prevent GCC4.2 from hanging when trying to compile Interpreter.cpp.
+        Added "-fno-var-tracking" compiler flag.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22704
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ordering of branch operands in MacroAssembler in unnecessarily  inconsistent.
+
+        je, jg etc take an immediate operand as the second argument, but for the
+        equality branches (je, jne) the immediate operand was the first argument.  This
+        was unnecessarily inconsistent.  Change je, jne methods to take the immediate
+        as the second argument.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22703
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::je32):
+        (JSC::MacroAssembler::jne32):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacterPair):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Second tranche of porting JIT.cpp to MacroAssembler interface.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::mul32):
+        (JSC::MacroAssembler::jl32):
+        (JSC::MacroAssembler::jnzSub32):
+        (JSC::MacroAssembler::joAdd32):
+        (JSC::MacroAssembler::joMul32):
+        (JSC::MacroAssembler::jzSub32):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+
+2008-12-05  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22609: Provide a build-time choice when generating hash tables for properties of built-in DOM objects
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22609>
+        <rdar://problem/6331749>
+
+        Reviewed by Darin Adler.
+
+        Initial patch by Yosen Lin.  Adapted for ToT WebKit by David Kilzer.
+
+        Added back the code that generates a "compact" hash (instead of a
+        perfect hash) as a build-time option using the
+        ENABLE(PERFECT_HASH_SIZE) macro as defined in Lookup.h.
+
+        * create_hash_table: Rename variables to differentiate perfect hash
+        values from compact hash values.  Added back code to compute compact
+        hash tables.  Generate both hash table sizes and emit
+        conditionalized code based on ENABLE(PERFECT_HASH_SIZE).
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable): Added version of createTable() for
+        use with compact hash tables.
+        (JSC::HashTable::deleteTable): Updated to work with compact hash
+        tables.
+        * runtime/Lookup.h: Defined ENABLE(PERFECT_HASH_SIZE) macro here.
+        (JSC::HashEntry::initialize): Set m_next to zero when using compact
+        hash tables.
+        (JSC::HashEntry::setNext): Added for compact hash tables.
+        (JSC::HashEntry::next): Added for compact hash tables.
+        (JSC::HashTable::entry): Added version of entry() for use with
+        compact hash tables.
+        * runtime/Structure.cpp:
+        (JSC::Structure::getEnumerablePropertyNames): Updated to work with
+        compact hash tables.
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove redundant calls to JIT::emitSlowScriptCheck.
+        This is checked in the hot path, so is not needed on the slow path - and the code
+        was being planted before the start of the slow case, so was completely unreachable!
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move JIT::compileOpStrictEq to MacroAssembler interface.
+
+        The rewrite also looks like a small (<1%) performance progression.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22697
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfJSCell):
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove m_assembler from MacroAssembler::Jump.
+        Keeping a pointer allowed for some syntactic sugar - "link()" looks nicer
+        than "link(this)".  But maintaining this doubles the size of Jump, which
+        is even more unfortunate for the JIT, since there are many large structures
+        holding JmpSrcs.  Probably best to remove it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22693
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::Jump::Jump):
+        (JSC::MacroAssembler::Jump::link):
+        (JSC::MacroAssembler::Jump::linkTo):
+        (JSC::MacroAssembler::JumpList::link):
+        (JSC::MacroAssembler::JumpList::linkTo):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::je32):
+        (JSC::MacroAssembler::je16):
+        (JSC::MacroAssembler::jg32):
+        (JSC::MacroAssembler::jge32):
+        (JSC::MacroAssembler::jl32):
+        (JSC::MacroAssembler::jle32):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jne32):
+        (JSC::MacroAssembler::jnset32):
+        (JSC::MacroAssembler::jset32):
+        (JSC::MacroAssembler::jump):
+        (JSC::MacroAssembler::jzSub32):
+        (JSC::MacroAssembler::joAdd32):
+        (JSC::MacroAssembler::call):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParenthesesAssertion):
+        (JSC::WREC::Generator::generateParenthesesInvertedAssertion):
+        (JSC::WREC::Generator::generateParenthesesNonGreedy):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+        (JSC::WREC::Generator::terminateAlternative):
+        (JSC::WREC::Generator::terminateDisjunction):
+        * wrec/WRECParser.h:
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Simplify JIT generated checks for timeout code, by moving more work into the C function.
+        https://bugs.webkit.org/show_bug.cgi?id=22688
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_timeout_check):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::emitSlowScriptCheck):
+
+2008-12-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Encapsulate access to jump tables in the CodeBlock in preparation
+        of moving them to a rare data structure.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfImmediateSwitchJumpTables):
+        (JSC::CodeBlock::addImmediateSwitchJumpTable):
+        (JSC::CodeBlock::immediateSwitchJumpTable):
+        (JSC::CodeBlock::numberOfCharacterSwitchJumpTables):
+        (JSC::CodeBlock::addCharacterSwitchJumpTable):
+        (JSC::CodeBlock::characterSwitchJumpTable):
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables):
+        (JSC::CodeBlock::addStringSwitchJumpTable):
+        (JSC::CodeBlock::stringSwitchJumpTable):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::endSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2008-12-05  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r39020
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        Add some apparently-missing __.
+
+2008-12-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22673
+        
+        Added support for the assertion (?=) and inverted assertion (?!) atoms
+        in WREC.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateParenthesesAssertion):
+        (JSC::WREC::Generator::generateParenthesesInvertedAssertion): Split the
+        old (unused) generateParentheses into these two functions, with more
+        limited capabilities.
+        
+        * wrec/WRECGenerator.h:
+        (JSC::WREC::Generator::): Moved an enum to the top of the class definition,
+        to match the WebKit style, and removed a defunct comment.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::consumeParenthesesType):
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::): Added support for parsing (?=) and (?!).
+
+2008-12-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Disable the JIT for the Qt build alltogether again, after observing
+        more miscompilations in a wider range of newer gcc versions.
+
+        * JavaScriptCore.pri:
+
+2008-12-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Disable the JIT for the Qt build on Linux unless gcc is >= 4.2,
+        due to miscompilations.
+
+        * JavaScriptCore.pri:
+
+2008-12-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Start porting the JIT to use the MacroAssembler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22671
+        No change in performance.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::Jump::operator X86Assembler::JmpSrc):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::lshift32):
+        (JSC::MacroAssembler::rshift32):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::compareImm32ForBranchEquality):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnset32):
+        (JSC::MacroAssembler::jset32):
+        (JSC::MacroAssembler::jzeroSub32):
+        (JSC::MacroAssembler::joverAdd32):
+        (JSC::MacroAssembler::call):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::shll_i8r):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutCTIArg):
+        (JSC::JIT::emitPutCTIArgConstant):
+        (JSC::JIT::emitGetCTIArg):
+        (JSC::JIT::emitPutCTIArgFromVirtualRegister):
+        (JSC::JIT::emitPutCTIParam):
+        (JSC::JIT::emitGetCTIParam):
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader):
+        (JSC::JIT::emitPutVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2008-12-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Some refactoring for generateGreedyQuantifier.
+        
+        SunSpider reports no change (possibly a 0.3% speedup).
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateGreedyQuantifier): Clarified label
+        meanings and unified some logic to simplify things.
+
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::parseAlternative): Added a version of parseAlternative
+        that can jump to a Label, instead of a JumpList, upon failure. (Eventually,
+        when we have a true Label class, this will be redundant.) This makes
+        things easier for generateGreedyQuantifier, because it can avoid
+        explicitly linking things.
+
+2008-12-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix crashes in the Qt build on Linux/i386 with non-executable memory
+        by enabling TCSystemAlloc and the PROT_EXEC flag for mmap.
+
+        * JavaScriptCore.pri: Enable the use of TCSystemAlloc if the JIT is
+        enabled.
+        * wtf/TCSystemAlloc.cpp: Extend the PROT_EXEC permissions to
+        PLATFORM(QT).
+
+2008-12-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Enable ENABLE_JIT_OPTIMIZE_CALL, ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
+        and ENABLE_JIT_OPTIMIZE_ARITHMETIC, as suggested by Niko.
+
+        * JavaScriptCore.pri: 
+
+2008-12-04  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Enable the JSC jit for the Qt build by default for release builds on
+        linux-g++ and win32-msvc.
+
+        * JavaScriptCore.pri:
+
+2008-12-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Allow JIT to function without property access repatching and arithmetic optimizations.
+        Controlled by ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS and ENABLE_JIT_OPTIMIZE_ARITHMETIC switches.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22643
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp: Copied from jit/JIT.cpp.
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITPropertyAccess.cpp: Copied from jit/JIT.cpp.
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::resizePropertyStorage):
+        (JSC::transitionWillNeedStorageRealloc):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * wtf/Platform.h:
+
+2008-12-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Optimized sequences of characters in regular expressions by comparing
+        two characters at a time.
+        
+        1-2% speedup on SunSpider, 19-25% speedup on regexp-dna.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::jge32): Filled out a few more macro methods.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_mr): Added a verion of movl_mr that operates
+        without an offset, to allow the macro assembler to optmize for that case.
+        
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp): Test the saved value of index
+        instead of the index register when checking for "end of input." The
+        index register doesn't increment by 1 in an orderly fashion, so testing
+        it for == "end of input" is not valid.
+        
+        Also, jump all the way to "return failure" upon reaching "end of input,"
+        instead of executing the next alternative. This is more logical, and
+        it's a slight optimization in the case of an expression with many alternatives.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateIncrementIndex): Added support for
+        jumping to a failure label in the case where the index has reached "end
+        of input."
+
+        (JSC::WREC::Generator::generatePatternCharacterSequence):
+        (JSC::WREC::Generator::generatePatternCharacterPair): This is the
+        optmization. It's basically like generatePatternCharacter, but it runs two
+        characters at a time.
+        
+        (JSC::WREC::Generator::generatePatternCharacter): Changed to use isASCII,
+        since it's clearer than comparing to a magic hex value.
+        
+        * wrec/WRECGenerator.h:
+
+2008-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Allow JIT to operate without the call-repatching optimization.
+        Controlled by ENABLE(JIT_OPTIMIZE_CALL), defaults on, disabling
+        this leads to significant performance regression.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22639
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp: Copied from jit/JIT.cpp.
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::unreachable):
+        * jit/JITInlineMethods.h: Copied from jit/JIT.cpp.
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * wtf/Platform.h:
+
+2008-12-03  Eric Seidel  <eric@webkit.org>
+
+        Rubber-stamped by David Hyatt.
+
+        Make HAVE_ACCESSIBILITY only define if !defined
+
+        * wtf/Platform.h:
+
+2008-12-03  Sam Weinig  <sam@webkit.org>
+
+        Fix build.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::orl_i32r):
+
+2008-12-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove shared AssemblerBuffer 1MB buffer and instead give AssemblerBuffer
+        an 256 byte inline capacity.
+
+        1% progression on Sunspider.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::~AssemblerBuffer):
+        (JSC::AssemblerBuffer::grow):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::MacroAssembler):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::X86Assembler):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * parser/Nodes.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WRECGenerator.h:
+        (JSC::WREC::Generator::Generator):
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::Parser):
+
+2008-12-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt, with help from Gavin Barraclough.
+        
+        orl_i32r was actually coded as an 8bit OR. So, I renamed orl_i32r to
+        orl_i8r, changed all orl_i32r clients to use orl_i8r, and then added
+        a new orl_i32r that actually does a 32bit OR.
+        
+        (32bit OR is currently unused, but a patch I'm working on uses it.)
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::or32): Updated to choose between 8bit and 32bit OR.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::orl_i8r): The old orl_i32r.
+        (JSC::X86Assembler::orl_i32r): The new orl_i32r.
+        
+        * jit/JIT.cpp:
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate): Use orl_i8r, since we're ORing 8bit
+        values.
+
+2008-12-03  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Helper functions for turn -> degrees.
+        https://bugs.webkit.org/show_bug.cgi?id=22497
+
+        * wtf/MathExtras.h:
+        (turn2deg):
+        (deg2turn):
+
+2008-12-02  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22504: Crashes during code generation occur due to refing of ignoredResult()
+        <https://bugs.webkit.org/show_bug.cgi?id=22504>
+
+        Since ignoredResult() was implemented by casting 1 to a RegisterID*, any
+        attempt to ref ignoredResult() results in a crash. This will occur in
+        code generation of a function body where a node emits another node with
+        the dst that was passed to it, and then refs the returned RegisterID*.
+
+        To fix this problem, make ignoredResult() a member function of
+        BytecodeGenerator that simply returns a pointe to a fixed RegisterID
+        member of BytecodeGenerator.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::ignoredResult):
+        * bytecompiler/RegisterID.h:
+        * parser/Nodes.cpp:
+        (JSC::NullNode::emitBytecode):
+        (JSC::BooleanNode::emitBytecode):
+        (JSC::NumberNode::emitBytecode):
+        (JSC::StringNode::emitBytecode):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::ObjectLiteralNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PostfixBracketNode::emitBytecode):
+        (JSC::PostfixDotNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::TypeOfValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::FuncDeclNode::emitBytecode):
+
+2008-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22537
+        REGRESSION (r38745): Assertion failure in jsSubstring() at ge.com
+
+        The bug was that index would become greater than length, so our
+        "end of input" checks, which all check "index == length", would fail.
+        
+        The solution is to check for end of input before incrementing index,
+        to ensure that index is always <= length.
+        
+        As a side benefit, generateJumpIfEndOfInput can now use je instead of
+        jg, which should be slightly faster.
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateJumpIfEndOfInput):
+
+2008-12-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Plant shift right immediate instructions, which are awesome.
+        https://bugs.webkit.org/show_bug.cgi?id=22610
+        ~5% on the v8-crypto test.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+
+2008-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Cleaned up SegmentedVector by abstracting segment access into helper
+        functions.
+        
+        SunSpider reports no change.
+
+        * bytecompiler/SegmentedVector.h:
+        (JSC::SegmentedVector::SegmentedVector):
+        (JSC::SegmentedVector::~SegmentedVector):
+        (JSC::SegmentedVector::size):
+        (JSC::SegmentedVector::at):
+        (JSC::SegmentedVector::operator[]):
+        (JSC::SegmentedVector::last):
+        (JSC::SegmentedVector::append):
+        (JSC::SegmentedVector::removeLast):
+        (JSC::SegmentedVector::grow):
+        (JSC::SegmentedVector::clear):
+        (JSC::SegmentedVector::deleteAllSegments):
+        (JSC::SegmentedVector::segmentFor):
+        (JSC::SegmentedVector::subscriptFor):
+        (JSC::SegmentedVector::ensureSegmentsFor):
+        (JSC::SegmentedVector::ensureSegment):
+
+2008-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen. (Patch by Cameron Zwarich <zwarich@apple.com>.)
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22482
+        REGRESSION (r37991): Occasionally see "Scene rendered incorrectly"
+        message when running the V8 Raytrace benchmark
+        
+        Rolled out r37991. It didn't properly save xmm0, which is caller-save,
+        before calling helper functions.
+        
+        SunSpider and v8 benchmarks show little change -- possibly a .2%
+        SunSpider regression, possibly a .2% v8 benchmark speedup.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitToJSNumber):
+        (JSC::BytecodeGenerator::emitTypeOf):
+        (JSC::BytecodeGenerator::emitGetPropertyNames):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * parser/Nodes.cpp:
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+        * parser/ResultType.h:
+        (JSC::ResultType::isReusable):
+        (JSC::ResultType::mightBeNumber):
+        * runtime/JSNumberCell.h:
+
+2008-12-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unused (sampling only, and derivable) argument to JIT::emitCTICall.
+        https://bugs.webkit.org/show_bug.cgi?id=22587
+
+        * jit/JIT.cpp:
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+
+2008-12-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+        
+        Fix the inheritance chain for JSFunction.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::info): Add InternalFunction::info as parent class
+
+2008-12-02  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix ability to include JavaScriptCore.pri from other .pro files.
+
+        * JavaScriptCore.pri: Moved -O3 setting into the .pro files.
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2008-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich, with help from Gavin Barraclough.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22583.
+
+        Refactored regular expression parsing to parse sequences of characters
+        as a single unit, in preparation for optimizing sequences of characters.
+        
+        SunSpider reports no change.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wrec/Escapes.h: Added. Set of classes for representing an escaped
+        token in a pattern.
+
+        * wrec/Quantifier.h:
+        (JSC::WREC::Quantifier::Quantifier): Simplified this constructor slightly,
+        to match the new Escape constructor.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generatePatternCharacterSequence):
+        * wrec/WRECGenerator.h: Added an interface for generating a sequence
+        of pattern characters at a time. It doesn't do anything special yet.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeGreedyQuantifier):
+        (JSC::WREC::Parser::consumeQuantifier): Renamed "parse" to "consume" in
+        these functions, to match "consumeEscape."
+
+        (JSC::WREC::Parser::parsePatternCharacterSequence): New function for
+        iteratively aggregating a sequence of characters in a pattern.
+
+        (JSC::WREC::Parser::parseCharacterClassQuantifier):
+        (JSC::WREC::Parser::parseBackreferenceQuantifier): Renamed "parse" to
+        "consume" in these functions, to match "consumeEscape."
+
+        (JSC::WREC::Parser::parseCharacterClass): Refactored to use the common
+        escape processing code in consumeEscape.
+
+        (JSC::WREC::Parser::parseEscape): Refactored to use the common
+        escape processing code in consumeEscape.
+
+        (JSC::WREC::Parser::consumeEscape): Factored escaped token processing
+        into a common function, since we were doing this in a few places.
+
+        (JSC::WREC::Parser::parseTerm): Refactored to use the common
+        escape processing code in consumeEscape.
+
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::consumeOctal): Refactored to use a helper function
+        for reading a digit.
+
+2008-12-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20340: SegmentedVector segment allocations can lead to unsafe use of temporary registers
+        <https://bugs.webkit.org/show_bug.cgi?id=20340>
+
+        SegmentedVector currently frees segments and reallocates them when used
+        as a stack. This can lead to unsafe use of pointers into freed segments.
+
+        In order to fix this problem, SegmentedVector will be changed to only
+        grow and never shrink. Also, rename the reserveCapacity() member
+        function to grow() to match the actual usage in BytecodeGenerator, where
+        this function is used to allocate a group of registers at once, rather
+        than merely saving space for them.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Use grow() instead of 
+        reserveCapacity().
+        * bytecompiler/SegmentedVector.h:
+        (JSC::SegmentedVector::SegmentedVector):
+        (JSC::SegmentedVector::last):
+        (JSC::SegmentedVector::append):
+        (JSC::SegmentedVector::removeLast):
+        (JSC::SegmentedVector::grow): Renamed from reserveCapacity().
+        (JSC::SegmentedVector::clear):
+
+2008-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Disable WREC for x86_64 since memory allocated by the system allocator is not marked executable,
+        which causes 64-bit debug builds to crash.  Once we have a dedicated allocator for executable
+        memory we can turn this back on.
+
+        * wtf/Platform.h:
+
+2008-12-01  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Restore inline buffer after vector is shrunk back below its inline capacity.
+
+        * wtf/Vector.h:
+        (WTF::):
+        (WTF::VectorBuffer::restoreInlineBufferIfNeeded):
+        (WTF::::shrinkCapacity):
+
+2008-11-30  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Try to return free pages in the current thread cache too.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::releaseFastMallocFreeMemory):
+
+2008-12-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22567
+        Make HashTable work as expected with respect to threads. Specifically, it has class-level
+        thread safety and constant methods work on constant objects without synchronization.
+        
+        No observable change in behavior, so no test. This only affects debug builds.
+
+        * wtf/HashTable.cpp:
+        (WTF::hashTableStatsMutex):
+        (WTF::HashTableStats::~HashTableStats):
+        (WTF::HashTableStats::recordCollisionAtCount):
+        Guarded variable access with a mutex.
+
+        * wtf/HashTable.h:
+        (WTF::::lookup):
+        (WTF::::lookupForWriting):
+        (WTF::::fullLookupForWriting):
+        (WTF::::add):
+        (WTF::::reinsert):
+        (WTF::::remove):
+        (WTF::::rehash):
+        Changed increments of static variables to use atomicIncrement.
+
+        (WTF::::invalidateIterators):
+        (WTF::addIterator):
+        (WTF::removeIterator):
+        Guarded mutable access with a mutex.
+
+2008-11-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Enable WREC on PLATFORM(X86_64).  This change predominantly requires changes to the
+        WREC::Generator::generateEnter method to support the x86-64 ABI, and addition of
+        support for a limited number of quadword operations in the X86Assembler.
+
+        This patch will cause the JS heap to be allocated with RWX permissions on 64-bit Mac
+        platforms.  This is a regression with respect to previous 64-bit behaviour, but is no
+        more permissive than on 32-bit builds.  This issue should be addressed at some point.
+        (This is tracked by bug #21783.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=22554
+        Greater than 4x speedup on regexp-dna, on x86-64.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::push):
+        (JSC::MacroAssembler::move):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::movq_rr):
+        (JSC::X86Assembler::addl_i8m):
+        (JSC::X86Assembler::addl_i32r):
+        (JSC::X86Assembler::addq_i8r):
+        (JSC::X86Assembler::addq_i32r):
+        (JSC::X86Assembler::movq_mr):
+        (JSC::X86Assembler::movq_rm):
+        * wrec/WREC.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp:
+
+2008-12-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Preliminary work for bug 20340: SegmentedVector segment allocations can lead to unsafe use of temporary registers
+        <https://bugs.webkit.org/show_bug.cgi?id=20340>
+
+        SegmentedVector currently frees segments and reallocates them when used
+        as a stack. This can lead to unsafe use of pointers into freed segments.
+
+        In order to fix this problem, SegmentedVector will be changed to only
+        grow and never shrink, with the sole exception of clearing all of its
+        data, a capability that is required by Lexer. This patch changes the
+        public interface to only allow for these capabilities.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Use reserveCapacity()
+        instead of resize() for m_globals and m_parameters.
+        * bytecompiler/SegmentedVector.h:
+        (JSC::SegmentedVector::resize): Removed.
+        (JSC::SegmentedVector::reserveCapacity): Added.
+        (JSC::SegmentedVector::clear): Added.
+        (JSC::SegmentedVector::shrink): Removed.
+        (JSC::SegmentedVector::grow): Removed.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::clear): Use clear() instead of resize(0).
+
+2008-11-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Renames jumps to m_jumps in JumpList.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::JumpList::link):
+        (JSC::MacroAssembler::JumpList::linkTo):
+        (JSC::MacroAssembler::JumpList::append):
+
+2008-11-30  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22557
+        
+        Report free size in central and thread caches too.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::fastMallocStatistics):
+        * wtf/FastMalloc.h:
+
+2008-11-29  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22557
+        Add statistics for JavaScript GC heap.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::objectCount):
+        (JSC::addToStatistics):
+        (JSC::Heap::statistics):
+        * runtime/Collector.h:
+
+2008-11-29  Antti Koivisto  <antti@apple.com>
+
+        Fix debug build by adding a stub method.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocStatistics):
+
+2008-11-29  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22557
+        
+        Add function for getting basic statistics from FastMalloc.
+
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::DLL_Length):
+        (WTF::TCMalloc_PageHeap::ReturnedBytes):
+        (WTF::TCMallocStats::fastMallocStatistics):
+        * wtf/FastMalloc.h:
+
+2008-11-29  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        The C++ standard does not automatically grant the friendships of an
+        enclosing class to its nested subclasses, so we should do so explicitly.
+        This fixes the GCC 4.0 build, although both GCC 4.2 and Visual C++ 2005
+        accept the incorrect code as it is.
+
+        * assembler/MacroAssembler.h:
+
+2008-11-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Add the class MacroAssembler to provide some abstraction of code generation,
+        and change WREC to make use of this class, rather than directly accessing
+        the X86Assembler.
+
+        This patch also allows WREC to be compiled without the rest of the JIT enabled.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.h: Added.
+        (JSC::MacroAssembler::):
+        (JSC::MacroAssembler::MacroAssembler):
+        (JSC::MacroAssembler::copyCode):
+        (JSC::MacroAssembler::Address::Address):
+        (JSC::MacroAssembler::ImplicitAddress::ImplicitAddress):
+        (JSC::MacroAssembler::BaseIndex::BaseIndex):
+        (JSC::MacroAssembler::Label::Label):
+        (JSC::MacroAssembler::Jump::Jump):
+        (JSC::MacroAssembler::Jump::link):
+        (JSC::MacroAssembler::Jump::linkTo):
+        (JSC::MacroAssembler::JumpList::link):
+        (JSC::MacroAssembler::JumpList::linkTo):
+        (JSC::MacroAssembler::JumpList::append):
+        (JSC::MacroAssembler::Imm32::Imm32):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::load16):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::push):
+        (JSC::MacroAssembler::peek):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::compareImm32ForBranch):
+        (JSC::MacroAssembler::compareImm32ForBranchEquality):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::je32):
+        (JSC::MacroAssembler::je16):
+        (JSC::MacroAssembler::jg32):
+        (JSC::MacroAssembler::jge32):
+        (JSC::MacroAssembler::jl32):
+        (JSC::MacroAssembler::jle32):
+        (JSC::MacroAssembler::jne32):
+        (JSC::MacroAssembler::jump):
+        (JSC::MacroAssembler::breakpoint):
+        (JSC::MacroAssembler::ret):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpw_rm):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::assemblerBuffer):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WREC.h:
+        * wrec/WRECFunctors.cpp:
+        (JSC::WREC::GeneratePatternCharacterFunctor::generateAtom):
+        (JSC::WREC::GenerateCharacterClassFunctor::generateAtom):
+        (JSC::WREC::GenerateBackreferenceFunctor::generateAtom):
+        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
+        * wrec/WRECFunctors.h:
+        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateSaveIndex):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoadCharacter):
+        (JSC::WREC::Generator::generateJumpIfEndOfInput):
+        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
+        (JSC::WREC::Generator::generateReturnFailure):
+        (JSC::WREC::Generator::generateBacktrack1):
+        (JSC::WREC::Generator::generateBacktrackBackreference):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateParenthesesNonGreedy):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+        (JSC::WREC::Generator::terminateAlternative):
+        (JSC::WREC::Generator::terminateDisjunction):
+        * wrec/WRECGenerator.h:
+        (JSC::WREC::Generator::Generator):
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parsePatternCharacterQualifier):
+        (JSC::WREC::Parser::parseCharacterClassQuantifier):
+        (JSC::WREC::Parser::parseBackreferenceQuantifier):
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseOctalEscape):
+        (JSC::WREC::Parser::parseEscape):
+        (JSC::WREC::Parser::parseTerm):
+        (JSC::WREC::Parser::parseDisjunction):
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::parsePattern):
+        (JSC::WREC::Parser::parseAlternative):
+        * wtf/Platform.h:
+
+2008-11-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix compilation on Windows CE
+
+        Port away from the use of errno after calling strtol(), instead
+        detect conversion errors by checking the result and the stop
+        position.
+
+        * runtime/DateMath.cpp:
+        (JSC::parseLong):
+        (JSC::parseDate):
+
+2008-11-28  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implement lowResUTCTime() on Windows CE using GetSystemTime as _ftime() is not available.
+
+        * runtime/DateMath.cpp:
+        (JSC::lowResUTCTime):
+
+2008-11-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Removed unnecessary inclusion of errno.h, which also fixes compilation on Windows CE.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+
+2008-11-27  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        r38825 made JSFunction::m_body private, but some inspector code in
+        WebCore sets the field. Add setters for it.
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::setBody):
+
+2008-11-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix FIXME by adding accessor for JSFunction's m_body property.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::body):
+
+2008-11-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove unused member variables from ProgramNode.
+
+        * parser/Nodes.h:
+
+2008-11-27  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Enable mouse panning feaure on Windows Cairo build.
+        See http://bugs.webkit.org/show_bug.cgi?id=22525
+
+        * wtf/Platform.h: Enable mouse panning feaure on Windows Cairo build.
+
+2008-11-27  Alp Toker  <alp@nuanti.com>
+
+        Change recently introduced C++ comments in Platform.h to C comments to
+        fix the minidom build with traditional C.
+
+        Build GtkLauncher and minidom with the '-ansi' compiler flag to detect
+        API header breakage at build time.
+
+        * GNUmakefile.am:
+        * wtf/Platform.h:
+
+2008-11-27  Alp Toker  <alp@nuanti.com>
+
+        Remove C++ comment from JavaScriptCore API headers (introduced r35449).
+        Fixes build for ANSI C applications using the public API.
+
+        * API/WebKitAvailability.h:
+
+2008-11-26  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix the JSC Chromium Mac build by adding JavaScriptCore/icu into the include path
+
+        * JavaScriptCore.scons:
+
+2008-11-25  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove the unused member function JSFunction::getParameterName().
+
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+
+2008-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Polymorpic caching for get by id chain.  Similar to the polymorphic caching already implemented
+        for self and proto accesses (implemented by allowing multiple trampolines to be JIT genertaed,
+        and linked together) - the get by id chain caching is implemented as a genericization of the
+        proto list caching, allowing cached access lists to contain a mix of proto and proto chain
+        accesses (since in JS style inheritance hierarchies you may commonly see a mix of properties
+        being overridden on the direct prototype, or higher up its prototype chain).
+
+        In order to allow this patch to compile there is a fix to appease gcc 4.2 compiler issues
+        (removing the jumps between fall-through cases in privateExecute).
+        
+        This patch also removes redundant immediate checking from the reptach code, and fixes a related
+        memory leak (failure to deallocate trampolines). 
+
+        ~2% progression on v8 tests (bulk on the win on deltablue)
+
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        * interpreter/Interpreter.cpp:
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdChainList):
+
+2008-11-25  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move the collect() call in Heap::heapAllocate() that is conditionally
+        compiled under COLLECT_ON_EVERY_ALLOCATION so that it is before we get
+        information about the heap. This was causing assertion failures for me
+        while I was reducing a bug.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate):
+
+2008-11-24  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 13790: Function declarations are not treated as statements (used to affect starcraft2.com)
+        <https://bugs.webkit.org/show_bug.cgi?id=13790>
+
+        Modify the parser to treat function declarations as statements,
+        simplifying the grammar in the process. Technically, according to the
+        grammar in the ECMA spec, function declarations are not statements and
+        can not be used everywhere that statements can, but it is not worth the
+        possibility compatibility issues just to stick to the spec in this case.
+
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::FuncDeclNode::emitBytecode): Avoid returning ignoredResult()
+        as a result, because it causes a crash in DoWhileNode::emitBytecode().
+
+2008-11-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Unroll the regexp matching loop by 1. 10% speedup on simple matching
+        stress test. No change on SunSpider.
+        
+        (I decided not to unroll to arbitrary levels because the returns diminsh
+        quickly.)
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateJumpIfEndOfInput):
+        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
+        * wrec/WRECGenerator.h:
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::error):
+        (JSC::WREC::Parser::parsePattern):
+
+2008-11-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed some unnecessary "Generator::" prefixes.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateSaveIndex):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoopIfNotEndOfInput):
+        (JSC::WREC::Generator::generateReturnFailure):
+
+2008-11-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Made a bunch of WREC::Parser functions private, and added an explicit
+        "reset()" function, so a parser can be reused.
+
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::generator):
+        (JSC::WREC::Parser::ignoreCase):
+        (JSC::WREC::Parser::multiline):
+        (JSC::WREC::Parser::recordSubpattern):
+        (JSC::WREC::Parser::numSubpatterns):
+        (JSC::WREC::Parser::parsePattern):
+        (JSC::WREC::Parser::parseAlternative):
+        (JSC::WREC::Parser::reset):
+
+2008-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Implement repatching for get by id chain.
+        Previously the access is performed in a function stub, in the repatch form
+        the trampoline is not called to; instead the hot path is relinked to jump
+        directly to the trampoline, if it fails it will jump to the slow case.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22449
+        3% progression on deltablue.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2008-11-24  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20746
+
+        Various small compilation fixes to make the Qt port of WebKit
+        compile on Windows CE.
+
+        * config.h: Don't set _CRT_RAND_S for CE, it's not available.
+        * jsc.cpp: Disabled use of debugger includes for CE. It
+          does not have the debugging functions.
+        * runtime/DateMath.cpp: Use localtime() on Windows CE.
+        * wtf/Assertions.cpp: Compile on Windows CE without debugger.
+        * wtf/Assertions.h: Include windows.h before defining ASSERT.
+        * wtf/MathExtras.h: Include stdlib.h instead of xmath.h.
+        * wtf/Platform.h: Disable ERRNO_H and detect endianess based
+          on the Qt endianess. On Qt for Windows CE the endianess is
+          defined by the vendor specific build spec.
+        * wtf/Threading.h: Use the volatile-less atomic functions.
+        * wtf/dtoa.cpp: Compile without errno.
+        * wtf/win/MainThreadWin.cpp: Don't include windows.h on CE after
+        Assertions.h due to the redefinition of ASSERT.
+
+2008-11-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Replace accidentally deleted immediate check from get by id chain trampoline.
+        https://bugs.webkit.org/show_bug.cgi?id=22413
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2008-11-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add (really) polymorphic caching for get by id self.
+        Very similar to caching of prototype accesses, described below.
+
+        Oh, also, probably shouldn't have been leaking those structure list objects.
+        
+        4% preogression on deltablue.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::PrototypeStructureList::derefStructures):
+        * bytecode/Instruction.h:
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::patchGetByIdSelf):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdSelfList):
+
+2008-11-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed many crashes seen 'round the world (but only in release builds).
+        
+        Update outputParameter offset to reflect slight re-ordering of push
+        instructions in r38669.
+
+        * wrec/WRECGenerator.cpp:
+
+2008-11-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more RegExp refactoring.
+        
+        Deployed a helper function for reading the next character. Used the "link
+        vector of jumps" helper in a place I missed before.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateLoadCharacter):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        * wrec/WRECGenerator.h:
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22402
+        Replace abort() with CRASH()
+
+        * wtf/Assertions.h: Added a different method to crash, which should work even is 0xbbadbeef
+        is a valid memory address.
+
+        * runtime/Collector.cpp:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/TCSpinLock.h:
+        Replace abort() with CRASH().
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverted fix for bug 22042 (Replace abort() with CRASH()), because it was breaking
+        FOR_EACH_OPCODE_ID macro somehow, making Safari crash.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::collect):
+        * wtf/Assertions.h:
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
+        (WTF::InitSizeClasses):
+        (WTF::PageHeapAllocator::New):
+        (WTF::TCMallocStats::do_malloc):
+        * wtf/FastMalloc.h:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Init):
+        (TCMalloc_SpinLock::Finalize):
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+
+2008-11-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more RegExp refactoring.
+        
+        Moved all assembly from WREC.cpp into WRECGenerator helper functions.
+        This should help with portability and readability.
+        
+        Removed ASSERTs after calls to executableCopy(), and changed
+        executableCopy() to ASSERT instead.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateSaveIndex):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoopIfNotEndOfInput):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::ignoreCase):
+        (JSC::WREC::Parser::generator):
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * wtf/Assertions.h: Use ::abort for C++ code.
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22402
+        Replace abort() with CRASH()
+
+        * wtf/Assertions.h: Added abort() after an attempt to crash for extra safety.
+
+        * runtime/Collector.cpp:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/TCSpinLock.h:
+        Replace abort() with CRASH().
+
+2008-11-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed wrec => generator.
+
+        * wrec/WRECFunctors.cpp:
+        (JSC::WREC::GeneratePatternCharacterFunctor::generateAtom):
+        (JSC::WREC::GeneratePatternCharacterFunctor::backtrack):
+        (JSC::WREC::GenerateCharacterClassFunctor::generateAtom):
+        (JSC::WREC::GenerateCharacterClassFunctor::backtrack):
+        (JSC::WREC::GenerateBackreferenceFunctor::generateAtom):
+        (JSC::WREC::GenerateBackreferenceFunctor::backtrack):
+        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
+
+2008-11-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add support for (really) polymorphic caching of prototype accesses.
+        
+        If a cached prototype access misses, cti_op_get_by_id_proto_list is called.
+        When this occurs the Structure pointers from the instruction stream are copied
+        off into a new ProtoStubInfo object.  A second prototype access trampoline is
+        generated, and chained onto the first.  Subsequent missed call to
+        cti_op_get_by_id_proto_list_append, which append futher new trampolines, up to
+        PROTOTYPE_LIST_CACHE_SIZE (currently 4).  If any of the misses result in an
+        access other than to a direct prototype property, list formation is halted (or
+        for the initial miss, does not take place at all).
+
+        Separate fail case functions are provided for each access since this contributes
+        to the performance progression (enables better processor branch prediction).
+
+        Overall this is a near 5% progression on v8, with around 10% wins on richards
+        and deltablue.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        * bytecode/Instruction.h:
+        (JSC::ProtoStructureList::ProtoStubInfo::set):
+        (JSC::ProtoStructureList::ProtoStructureList):
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_append):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_chain_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProtoList):
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Try and fix the tiger build.
+
+        * parser/Grammar.y:
+
+2008-11-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Make JavaScriptCore Chromium build under Windows (cmd only, cygwin almost works)
+        https://bugs.webkit.org/show_bug.cgi?id=22347
+
+        * JavaScriptCore.scons:
+        * parser/Parser.cpp: Add using std::auto_ptr since we use auto_ptr
+
+2008-11-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+        
+        Reviewed by Sam Weinig.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparse):
+
+2008-11-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more RegExp refactoring.
+        
+        Created a helper function in the assembler for linking a vector of
+        JmpSrc to a location, and deployed it in a bunch of places.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::link):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::terminateAlternative):
+        (JSC::WREC::Generator::terminateDisjunction):
+        * wrec/WRECParser.cpp:
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::consumeHex):
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Fix non-mac builds.
+
+        * parser/Lexer.cpp:
+        * parser/Parser.cpp:
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=22385
+        <rdar://problem/6390179>
+        Lazily reparse FunctionBodyNodes on first execution.
+
+        - Saves 57MB on Membuster head.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Remove vector shrinking since this is now
+        handled by destroying the ScopeNodeData after generation.
+
+        * parser/Grammar.y: Add alternate NoNode version of the grammar
+        that does not create nodes.  This is used to lazily create FunctionBodyNodes
+        on first execution.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Fix bug where on reparse, the Lexer was confused about
+        what position and length meant. Position is the current position in the original
+        data buffer (important for getting correct line/column information) and length
+        the end offset in the original buffer.
+        * parser/Lexer.h:
+        (JSC::Lexer::sourceCode): Positions are relative to the beginning of the buffer.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData): Move initialization of ScopeNode data here.
+        (JSC::ScopeNode::ScopeNode): Add constructor that only sets the JSGlobalData
+        for FunctionBodyNode stubs.
+        (JSC::ScopeNode::~ScopeNode): Release m_children now that we don't inherit from
+        BlockNode.
+        (JSC::ScopeNode::releaseNodes): Ditto.
+        (JSC::EvalNode::generateBytecode): Only shrink m_children, as we need to keep around
+        the rest of the data.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Add constructor that only sets the
+        JSGlobalData. 
+        (JSC::FunctionBodyNode::create): Ditto.
+        (JSC::FunctionBodyNode::generateBytecode): If we don't have the data, do a reparse
+        to construct it. Then after generation, destroy the data.
+        (JSC::ProgramNode::generateBytecode): After generation, destroy the AST data.
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::): Add isFuncExprNode for FunctionConstructor.
+        (JSC::StatementNode::): Add isExprStatementNode for FunctionConstructor.
+        (JSC::ExprStatementNode::): Ditto.
+        (JSC::ExprStatementNode::expr): Add accessor for FunctionConstructor.
+        (JSC::FuncExprNode::): Add isFuncExprNode for FunctionConstructor
+
+        (JSC::ScopeNode::adoptData): Adopts a ScopeNodeData.
+        (JSC::ScopeNode::data): Accessor for ScopeNodeData.
+        (JSC::ScopeNode::destroyData): Deletes the ScopeNodeData.
+        (JSC::ScopeNode::setFeatures): Added.
+        (JSC::ScopeNode::varStack): Added assert.
+        (JSC::ScopeNode::functionStack): Ditto.
+        (JSC::ScopeNode::children): Ditto.
+        (JSC::ScopeNode::neededConstants): Ditto.
+        Factor m_varStack, m_functionStack, m_children and m_numConstants into ScopeNodeData.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparse): Reparse the SourceCode in the FunctionBodyNode and set
+        set up the ScopeNodeData for it. 
+        * parser/Parser.h:
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::endOffset): Added for use in the lexer.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::getFunctionBody): Assuming a ProgramNode with one FunctionExpression in it,
+        get the FunctionBodyNode.  Any issues signifies a parse failure in constructFunction. 
+        (JSC::constructFunction): Make parsing functions in the form new Function(""), easier
+        by concatenating the strings together (with some glue) and parsing the function expression
+        as a ProgramNode from which we can receive the FunctionBodyNode. This has the added benefit
+        of not having special parsing code for the arguments and lazily constructing the 
+        FunctionBodyNode's AST on first execution.
+
+        * runtime/Identifier.h:
+        (JSC::operator!=): Added.
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Speedup the lexer to offset coming re-parsing patch.
+
+        - .6% progression on Sunspider.
+
+        * bytecompiler/SegmentedVector.h:
+        (JSC::SegmentedVector::shrink): Fixed bug where m_size would not be
+        set when shrinking to 0.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer):
+        (JSC::Lexer::isIdentStart): Use isASCIIAlpha and isASCII to avoid going into ICU in the common cases.
+        (JSC::Lexer::isIdentPart): Use isASCIIAlphanumeric and isASCII to avoid going into ICU in the common cases
+        (JSC::isDecimalDigit): Use version in ASCIICType.h. Inlining it was a regression.
+        (JSC::Lexer::isHexDigit): Ditto.
+        (JSC::Lexer::isOctalDigit): Ditto.
+        (JSC::Lexer::clear): Resize the m_identifiers SegmentedVector to initial
+        capacity
+        * parser/Lexer.h: Remove unused m_strings vector. Make m_identifiers
+        a SegmentedVector<Identifier> to avoid allocating a new Identifier* for
+        each identifier found.  The SegmentedVector is need so we can passes 
+        references to the Identifier to the parser, which remain valid even when
+        the vector is resized.
+        (JSC::Lexer::makeIdentifier): Inline and return a reference to the added
+        Identifier.
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add isASCII to ASCIICType.  Use coming soon!
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCII):
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add OwnPtr constructor and OwnPtr::adopt that take an auto_ptr.
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::OwnPtr):
+        (WTF::OwnPtr::adopt):
+
+2008-11-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22364
+        Crashes seen on Tiger buildbots due to worker threads exhausting pthread keys
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::makeUsableFromMultipleThreads):
+        (JSC::Heap::registerThread):
+        * runtime/Collector.h:
+        Pthread key for tracking threads is only created on request now, because this is a limited
+        resource, and thread tracking is not needed for worker heaps, or for WebCore heap.
+
+        * API/JSContextRef.cpp: (JSGlobalContextCreateInGroup): Call makeUsableFromMultipleThreads().
+
+        * runtime/JSGlobalData.cpp: (JSC::JSGlobalData::sharedInstance): Ditto.
+
+        * runtime/JSGlobalData.h: (JSC::JSGlobalData::makeUsableFromMultipleThreads): Just forward
+        the call to Heap, which clients need not know about, ideally.
+
+2008-11-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more WREC refactoring.
+        
+        Removed the "Register" suffix from register names in WREC, and renamed:
+            currentPosition => index
+            currentValue => character
+            quantifierCount => repeatCount
+            
+        Added a top-level parsePattern function to the WREC parser, which
+        allowed me to remove the error() and atEndOfPattern() accessors.
+        
+        Factored out an MSVC customization into a constant.
+        
+        Renamed nextLabel => beginPattern.
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateBacktrack1):
+        (JSC::WREC::Generator::generateBacktrackBackreference):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+        (JSC::WREC::Generator::generateDisjunction):
+        (JSC::WREC::Generator::terminateDisjunction):
+        * wrec/WRECGenerator.h:
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::parsePattern):
+
+2008-11-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22361
+        A little more RegExp refactoring.
+        
+        Consistently named variables holding the starting position at which
+        regexp matching should begin to "startOffset".
+        
+        A few more "regExpObject" => "regExpConstructor" changes.
+        
+        Refactored RegExpObject::match for clarity, and replaced a slow "get"
+        of the "global" property with a fast access to the global bit.
+        
+        Made the error message you see when RegExpObject::match has no input a
+        little more informative, as in Firefox.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+
+2008-11-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more refactoring.
+        
+        Removed the "emit" and "emitUnlinked" prefixes from the assembler.
+        
+        Moved the JmpSrc and JmpDst class definitions to the top of the X86
+        assembler class, in accordance with WebKit style guidelines.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpSrc::JmpSrc):
+        (JSC::X86Assembler::JmpDst::JmpDst):
+        (JSC::X86Assembler::int3):
+        (JSC::X86Assembler::pushl_m):
+        (JSC::X86Assembler::popl_m):
+        (JSC::X86Assembler::movl_rr):
+        (JSC::X86Assembler::addl_rr):
+        (JSC::X86Assembler::addl_i8r):
+        (JSC::X86Assembler::addl_i8m):
+        (JSC::X86Assembler::addl_i32r):
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::andl_rr):
+        (JSC::X86Assembler::andl_i32r):
+        (JSC::X86Assembler::cmpl_i8r):
+        (JSC::X86Assembler::cmpl_rr):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::cmpl_mr):
+        (JSC::X86Assembler::cmpl_i32r):
+        (JSC::X86Assembler::cmpl_i32m):
+        (JSC::X86Assembler::cmpl_i8m):
+        (JSC::X86Assembler::cmpw_rm):
+        (JSC::X86Assembler::orl_rr):
+        (JSC::X86Assembler::orl_mr):
+        (JSC::X86Assembler::orl_i32r):
+        (JSC::X86Assembler::subl_rr):
+        (JSC::X86Assembler::subl_i8r):
+        (JSC::X86Assembler::subl_i8m):
+        (JSC::X86Assembler::subl_i32r):
+        (JSC::X86Assembler::subl_mr):
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::testl_i32m):
+        (JSC::X86Assembler::testl_rr):
+        (JSC::X86Assembler::xorl_i8r):
+        (JSC::X86Assembler::xorl_rr):
+        (JSC::X86Assembler::sarl_i8r):
+        (JSC::X86Assembler::sarl_CLr):
+        (JSC::X86Assembler::shl_i8r):
+        (JSC::X86Assembler::shll_CLr):
+        (JSC::X86Assembler::imull_rr):
+        (JSC::X86Assembler::imull_i32r):
+        (JSC::X86Assembler::idivl_r):
+        (JSC::X86Assembler::negl_r):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::movzbl_rr):
+        (JSC::X86Assembler::movzwl_mr):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_i32r):
+        (JSC::X86Assembler::movl_i32m):
+        (JSC::X86Assembler::leal_mr):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::jmp_m):
+        (JSC::X86Assembler::movsd_mr):
+        (JSC::X86Assembler::xorpd_mr):
+        (JSC::X86Assembler::movsd_rm):
+        (JSC::X86Assembler::movd_rr):
+        (JSC::X86Assembler::cvtsi2sd_rr):
+        (JSC::X86Assembler::cvttsd2si_rr):
+        (JSC::X86Assembler::addsd_mr):
+        (JSC::X86Assembler::subsd_mr):
+        (JSC::X86Assembler::mulsd_mr):
+        (JSC::X86Assembler::addsd_rr):
+        (JSC::X86Assembler::subsd_rr):
+        (JSC::X86Assembler::mulsd_rr):
+        (JSC::X86Assembler::ucomis_rr):
+        (JSC::X86Assembler::pextrw_irr):
+        (JSC::X86Assembler::call):
+        (JSC::X86Assembler::jmp):
+        (JSC::X86Assembler::jne):
+        (JSC::X86Assembler::jnz):
+        (JSC::X86Assembler::je):
+        (JSC::X86Assembler::jl):
+        (JSC::X86Assembler::jb):
+        (JSC::X86Assembler::jle):
+        (JSC::X86Assembler::jbe):
+        (JSC::X86Assembler::jge):
+        (JSC::X86Assembler::jg):
+        (JSC::X86Assembler::ja):
+        (JSC::X86Assembler::jae):
+        (JSC::X86Assembler::jo):
+        (JSC::X86Assembler::jp):
+        (JSC::X86Assembler::js):
+        (JSC::X86Assembler::predictNotTaken):
+        (JSC::X86Assembler::convertToFastCall):
+        (JSC::X86Assembler::restoreArgumentReference):
+        (JSC::X86Assembler::restoreArgumentReferenceForTrampoline):
+        (JSC::X86Assembler::modRm_rr):
+        (JSC::X86Assembler::modRm_rr_Unchecked):
+        (JSC::X86Assembler::modRm_rm):
+        (JSC::X86Assembler::modRm_rm_Unchecked):
+        (JSC::X86Assembler::modRm_rmsib):
+        (JSC::X86Assembler::modRm_opr):
+        (JSC::X86Assembler::modRm_opr_Unchecked):
+        (JSC::X86Assembler::modRm_opm):
+        (JSC::X86Assembler::modRm_opm_Unchecked):
+        (JSC::X86Assembler::modRm_opmsib):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitNakedFastCall):
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
+        (JSC::JIT::emitArithIntToImmWithJump):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateParenthesesNonGreedy):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+        (JSC::WREC::Generator::generateDisjunction):
+
+2008-11-19  Simon Hausmann  <hausmann@webkit.org>
+
+        Sun CC build fix, removed trailing comman for last enum value.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::):
+
+2008-11-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Expand the workaround for Apple GCC compiler bug <rdar://problem/6354696> to all versions of GCC 4.0.1.
+        It has been observed with builds 5465 (Xcode 3.0) and 5484 (Xcode 3.1), and there is no evidence
+        that it has been fixed in newer builds of GCC 4.0.1.
+
+        This addresses <https://bugs.webkit.org/show_bug.cgi?id=22351> (WebKit nightly crashes on launch on 10.4.11).
+
+        * wtf/StdLibExtras.h:
+
+2008-11-18  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak and Geoff Garen.
+
+        Bug 22287: ASSERTION FAILED: Not enough jumps linked in slow case codegen in CTI::privateCompileSlowCases())
+        <https://bugs.webkit.org/show_bug.cgi?id=22287>
+
+        Fix a typo in the number cell reuse code where the first and second
+        operands are sometimes confused.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+
+2008-11-18  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2008-11-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Minor RegExp cleanup.
+        
+        SunSpider says no change.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match): Renamed "regExpObj" to "regExpConstructor".
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp): Instead of checking for a NULL output vector,
+        ASSERT that the output vector is not NULL. (The rest of WREC is not
+        safe to use with a NULL output vector, and we probably don't want to
+        spend the time and/or performance to make it safe.)
+
+2008-11-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        A little more renaming and refactoring.
+        
+        VM_CHECK_EXCEPTION() => CHECK_FOR_EXCEPTION().
+        NEXT_INSTRUCTION => NEXT_INSTRUCTION().
+
+        Removed the "Error_" and "TempError_" prefixes from WREC error types.
+
+        Refactored the WREC parser so it doesn't need a "setError" function,
+        and changed "isEndOfPattern" and its use -- they read kind of backwards
+        before.
+        
+        Changed our "TODO:" error messages at least to say something, since you
+        can't say "TODO:" in shipping software.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_del_by_val):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseGreedyQuantifier):
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseEscape):
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::):
+        (JSC::WREC::Parser::atEndOfPattern):
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22337
+        Enable workers by default
+
+        * Configurations/JavaScriptCore.xcconfig: Define ENABLE_WORKERS.
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        - Windows build fix
+
+        * wrec/WRECFunctors.h:
+        * wrec/WRECGenerator.h:
+        * wrec/WRECParser.h:
+        CharacterClass is a struct, not a class, fix forward declarations.
+
+2008-11-18  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * assembler/X86Assembler.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * wrec/Quantifier.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * assembler/AssemblerBuffer.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Split WREC classes out into individual files, with a few modifications
+        to more closely match the WebKit coding style.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/X86Assembler.h:
+        * runtime/RegExp.cpp:
+        * wrec/CharacterClass.cpp: Copied from wrec/CharacterClassConstructor.cpp.
+        (JSC::WREC::CharacterClass::newline):
+        (JSC::WREC::CharacterClass::digits):
+        (JSC::WREC::CharacterClass::spaces):
+        (JSC::WREC::CharacterClass::wordchar):
+        (JSC::WREC::CharacterClass::nondigits):
+        (JSC::WREC::CharacterClass::nonspaces):
+        (JSC::WREC::CharacterClass::nonwordchar):
+        * wrec/CharacterClass.h: Copied from wrec/CharacterClassConstructor.h.
+        * wrec/CharacterClassConstructor.cpp:
+        (JSC::WREC::CharacterClassConstructor::addSortedRange):
+        (JSC::WREC::CharacterClassConstructor::append):
+        * wrec/CharacterClassConstructor.h:
+        * wrec/Quantifier.h: Copied from wrec/WREC.h.
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WREC.h:
+        * wrec/WRECFunctors.cpp: Copied from wrec/WREC.cpp.
+        * wrec/WRECFunctors.h: Copied from wrec/WREC.cpp.
+        (JSC::WREC::GenerateAtomFunctor::~GenerateAtomFunctor):
+        (JSC::WREC::GeneratePatternCharacterFunctor::GeneratePatternCharacterFunctor):
+        (JSC::WREC::GenerateCharacterClassFunctor::GenerateCharacterClassFunctor):
+        (JSC::WREC::GenerateBackreferenceFunctor::GenerateBackreferenceFunctor):
+        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
+        * wrec/WRECGenerator.cpp: Copied from wrec/WREC.cpp.
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        * wrec/WRECGenerator.h: Copied from wrec/WREC.h.
+        * wrec/WRECParser.cpp: Copied from wrec/WREC.cpp.
+        (JSC::WREC::Parser::parseGreedyQuantifier):
+        (JSC::WREC::Parser::parseCharacterClassQuantifier):
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseEscape):
+        (JSC::WREC::Parser::parseTerm):
+        * wrec/WRECParser.h: Copied from wrec/WREC.h.
+        (JSC::WREC::Parser::):
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::setError):
+        (JSC::WREC::Parser::error):
+        (JSC::WREC::Parser::recordSubpattern):
+        (JSC::WREC::Parser::numSubpatterns):
+        (JSC::WREC::Parser::ignoreCase):
+        (JSC::WREC::Parser::multiline):
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix a few builds.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix a few builds.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/CTI.* => jit/JIT.*.
+        
+        Removed VM.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp: Removed.
+        * VM/CTI.h: Removed.
+        * bytecode/CodeBlock.cpp:
+        * interpreter/Interpreter.cpp:
+        * jit: Added.
+        * jit/JIT.cpp: Copied from VM/CTI.cpp.
+        * jit/JIT.h: Copied from VM/CTI.h.
+        * runtime/RegExp.cpp:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved runtime/ExecState.* => interpreter/CallFrame.*.
+
+        * API/JSBase.cpp:
+        * API/OpaqueJSString.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerCallFrame.h:
+        * interpreter/CallFrame.cpp: Copied from runtime/ExecState.cpp.
+        * interpreter/CallFrame.h: Copied from runtime/ExecState.h.
+        * interpreter/Interpreter.cpp:
+        * parser/Nodes.cpp:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/Profiler.cpp:
+        * runtime/ClassInfo.h:
+        * runtime/Collector.cpp:
+        * runtime/Completion.cpp:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/ExecState.cpp: Removed.
+        * runtime/ExecState.h: Removed.
+        * runtime/Identifier.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        * runtime/Lookup.h:
+        * runtime/PropertyNameArray.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * API/APICast.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * API/APICast.h:
+        * runtime/ExecState.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/SamplingTool.* => bytecode/SamplingTool.*.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/SamplingTool.cpp: Removed.
+        * VM/SamplingTool.h: Removed.
+        * bytecode/SamplingTool.cpp: Copied from VM/SamplingTool.cpp.
+        * bytecode/SamplingTool.h: Copied from VM/SamplingTool.h.
+        * jsc.cpp:
+        (runWithScripts):
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * runtime/ExecState.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/ExceptionHelpers.cpp => runtime/ExceptionHelpers.cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/ExceptionHelpers.cpp: Removed.
+        * runtime/ExceptionHelpers.cpp: Copied from VM/ExceptionHelpers.cpp.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/RegisterFile.cpp => interpreter/RegisterFile.cpp.
+
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/RegisterFile.cpp: Removed.
+        * interpreter/RegisterFile.cpp: Copied from VM/RegisterFile.cpp.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved:
+            VM/ExceptionHelpers.h => runtime/ExceptionHelpers.h
+            VM/Register.h => interpreter/Register.h
+            VM/RegisterFile.h => interpreter/RegisterFile.h
+        
+        
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/ExceptionHelpers.h: Removed.
+        * VM/Register.h: Removed.
+        * VM/RegisterFile.h: Removed.
+        * interpreter/Register.h: Copied from VM/Register.h.
+        * interpreter/RegisterFile.h: Copied from VM/RegisterFile.h.
+        * runtime/ExceptionHelpers.h: Copied from VM/ExceptionHelpers.h.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/Machine.cpp => interpreter/Interpreter.cpp.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Machine.cpp: Removed.
+        * interpreter/Interpreter.cpp: Copied from VM/Machine.cpp.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/Machine.h => interpreter/Interpreter.h
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/Machine.cpp:
+        * VM/Machine.h: Removed.
+        * VM/SamplingTool.cpp:
+        * bytecode/CodeBlock.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/DebuggerCallFrame.cpp:
+        * interpreter: Added.
+        * interpreter/Interpreter.h: Copied from VM/Machine.h.
+        * profiler/ProfileGenerator.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/Collector.cpp:
+        * runtime/Completion.cpp:
+        * runtime/ExecState.h:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * wrec/WREC.cpp:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved runtime/Interpreter.cpp => runtime/Completion.cpp.
+
+        Moved functions from Interpreter.h to Completion.h, and removed
+        Interpreter.h from the project.
+
+        * API/JSBase.cpp:
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * jsc.cpp:
+        * runtime/Completion.cpp: Copied from runtime/Interpreter.cpp.
+        * runtime/Completion.h:
+        * runtime/Interpreter.cpp: Removed.
+        * runtime/Interpreter.h: Removed.
+
+2008-11-17  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22312>
+        Fix PCRE include path problem on Qt-port
+
+        * JavaScriptCore.pri:
+        * pcre/pcre.pri:
+
+2008-11-17  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22313>
+        Add missing CTI source to the build system on Qt-port
+
+        * JavaScriptCore.pri:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix JSGlue build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * jsc.pro:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        More file moves:
+        
+        VM/CodeBlock.* => bytecode/CodeBlock.*
+        VM/EvalCodeCache.h => bytecode/EvalCodeCache.h
+        VM/Instruction.h => bytecode/Instruction.h
+        VM/Opcode.* => bytecode/Opcode.*
+
+        * GNUmakefile.am:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeBlock.cpp: Removed.
+        * VM/CodeBlock.h: Removed.
+        * VM/EvalCodeCache.h: Removed.
+        * VM/Instruction.h: Removed.
+        * VM/Opcode.cpp: Removed.
+        * VM/Opcode.h: Removed.
+        * bytecode: Added.
+        * bytecode/CodeBlock.cpp: Copied from VM/CodeBlock.cpp.
+        * bytecode/CodeBlock.h: Copied from VM/CodeBlock.h.
+        * bytecode/EvalCodeCache.h: Copied from VM/EvalCodeCache.h.
+        * bytecode/Instruction.h: Copied from VM/Instruction.h.
+        * bytecode/Opcode.cpp: Copied from VM/Opcode.cpp.
+        * bytecode/Opcode.h: Copied from VM/Opcode.h.
+        * jsc.pro:
+        * jscore.bkl:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix a few more builds.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCoreSources.bkl:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * GNUmakefile.am:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Some file moves:
+        
+        VM/LabelID.h => bytecompiler/Label.h
+        VM/RegisterID.h => bytecompiler/RegisterID.h
+        VM/SegmentedVector.h => bytecompiler/SegmentedVector.h
+        bytecompiler/CodeGenerator.* => bytecompiler/BytecodeGenerator.*
+
+        * AllInOneFile.cpp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/LabelID.h: Removed.
+        * VM/RegisterID.h: Removed.
+        * VM/SegmentedVector.h: Removed.
+        * bytecompiler/BytecodeGenerator.cpp: Copied from bytecompiler/CodeGenerator.cpp.
+        * bytecompiler/BytecodeGenerator.h: Copied from bytecompiler/CodeGenerator.h.
+        * bytecompiler/CodeGenerator.cpp: Removed.
+        * bytecompiler/CodeGenerator.h: Removed.
+        * bytecompiler/Label.h: Copied from VM/LabelID.h.
+        * bytecompiler/LabelScope.h:
+        * bytecompiler/RegisterID.h: Copied from VM/RegisterID.h.
+        * bytecompiler/SegmentedVector.h: Copied from VM/SegmentedVector.h.
+        * jsc.cpp:
+        * parser/Nodes.cpp:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved masm => assembler and split "AssemblerBuffer.h" out of "X86Assembler.h".
+        
+        Also renamed ENABLE_MASM to ENABLE_ASSEMBLER.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler: Added.
+        * assembler/AssemblerBuffer.h: Copied from masm/X86Assembler.h.
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::~AssemblerBuffer):
+        (JSC::AssemblerBuffer::ensureSpace):
+        (JSC::AssemblerBuffer::isAligned):
+        (JSC::AssemblerBuffer::putByteUnchecked):
+        (JSC::AssemblerBuffer::putByte):
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putShort):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt):
+        (JSC::AssemblerBuffer::data):
+        (JSC::AssemblerBuffer::size):
+        (JSC::AssemblerBuffer::reset):
+        (JSC::AssemblerBuffer::executableCopy):
+        (JSC::AssemblerBuffer::grow):
+        * assembler/X86Assembler.h: Copied from masm/X86Assembler.h.
+        * masm: Removed.
+        * masm/X86Assembler.h: Removed.
+        * wtf/Platform.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * GNUmakefile.am:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Fixed tyop.
+
+        * VM/CTI.cpp:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix windows build.
+
+        * VM/CTI.cpp:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * GNUmakefile.am:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed ENABLE_CTI and ENABLE(CTI) to ENABLE_JIT and ENABLE(JIT).
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        * VM/Machine.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * VM/Machine.h:
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::prepareJumpTableForStringSwitch):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * runtime/JSGlobalData.h:
+        * wrec/WREC.h:
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * VM/CTI.cpp:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by a few people on squirrelfish-dev.
+        
+        Renamed CTI => JIT.
+
+        * VM/CTI.cpp:
+        (JSC::JIT::killLastResultRegister):
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitGetVirtualRegisters):
+        (JSC::JIT::emitPutCTIArgFromVirtualRegister):
+        (JSC::JIT::emitPutCTIArg):
+        (JSC::JIT::emitGetCTIArg):
+        (JSC::JIT::emitPutCTIArgConstant):
+        (JSC::JIT::getConstantImmediateNumericArg):
+        (JSC::JIT::emitPutCTIParam):
+        (JSC::JIT::emitGetCTIParam):
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader):
+        (JSC::JIT::emitPutVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::printBytecodeOperandTypes):
+        (JSC::JIT::emitAllocateNumber):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitNakedFastCall):
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::linkSlowCaseIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
+        (JSC::JIT::getDeTaggedConstantImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        (JSC::JIT::emitArithIntToImmWithJump):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        (JSC::JIT::JIT):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileLinkPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::freeCTIMachineTrampolines):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::emitGetVariableObjectRegister):
+        (JSC::JIT::emitPutVariableObjectRegister):
+        * VM/CTI.h:
+        (JSC::JIT::compile):
+        (JSC::JIT::compileGetByIdSelf):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdReplace):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkCallers):
+        * VM/Machine.cpp:
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        * VM/Machine.h:
+        * VM/RegisterFile.h:
+        * parser/Nodes.h:
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/Structure.h:
+        * runtime/TypeInfo.h:
+        * runtime/UString.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix wx build.
+
+        * jscore.bkl:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed X86:: and X86Assembler:: prefixes in a lot of places using typedefs.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetVirtualRegister):
+        (JSC::CTI::emitGetVirtualRegisters):
+        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
+        (JSC::CTI::emitPutCTIArg):
+        (JSC::CTI::emitGetCTIArg):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutVirtualRegister):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::emitArithIntToImmWithJump):
+        (JSC::CTI::emitTagAsBoolImmediate):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JmpTable::JmpTable):
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+        (JSC::CTI::JSRInfo::JSRInfo):
+        * wrec/WREC.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed OBJECT_OFFSET => FIELD_OFFSET
+
+        Nixed use of OBJECT_OFFSET outside of CTI.cpp by making CTI a friend in
+        more places.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renames:
+        
+        X86Assembler::copy => X86Assembler::executableCopy
+        AssemblerBuffer::copy => AssemblerBuffer::executableCopy
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        * masm/X86Assembler.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        (JSC::X86Assembler::executableCopy):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed WREC => JSC::WREC, removing JSC:: prefix in a lot of places.
+        Renamed WRECFunction => WREC::CompiledRegExp, and deployed this type
+        name in place of a few casts.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wrec/CharacterClassConstructor.cpp:
+        * wrec/CharacterClassConstructor.h:
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WREC.h:
+        (JSC::WREC::Generator::Generator):
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::parseAlternative):
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed BytecodeInterpreter => Interpreter.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::freeCTIMachineTrampolines):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::Interpreter::slideRegisterWindowForCall):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::dumpCallFrame):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::resetTimeoutCheck):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::uncachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::uncacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        (JSC::Interpreter::findFunctionCallFrame):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_end):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_timeout_check):
+        (JSC::Interpreter::cti_register_file_check):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_new_object):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_new_func):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_arityCheck):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        (JSC::Interpreter::cti_op_push_activation):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_create_arguments):
+        (JSC::Interpreter::cti_op_create_arguments_no_params):
+        (JSC::Interpreter::cti_op_tear_off_activation):
+        (JSC::Interpreter::cti_op_tear_off_arguments):
+        (JSC::Interpreter::cti_op_profile_will_call):
+        (JSC::Interpreter::cti_op_profile_did_call):
+        (JSC::Interpreter::cti_op_ret_scopeChain):
+        (JSC::Interpreter::cti_op_new_array):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_base):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_new_func_exp):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_new_regexp):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_get_pnames):
+        (JSC::Interpreter::cti_op_next_pname):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_pop_scope):
+        (JSC::Interpreter::cti_op_typeof):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_is_string):
+        (JSC::Interpreter::cti_op_is_object):
+        (JSC::Interpreter::cti_op_is_function):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_push_new_scope):
+        (JSC::Interpreter::cti_op_jmp_scopes):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        (JSC::Interpreter::cti_op_debug):
+        (JSC::Interpreter::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/ExecState.h:
+        (JSC::ExecState::interpreter):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSString.h:
+        * wrec/WREC.cpp:
+        (WREC::compileRegExp):
+        * wrec/WREC.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Roll out r38461 (my last patch) because it broke the world.
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A few more renames:
+
+        BytecodeInterpreter => Interpreter
+        WREC => JSC::WREC, removing JSC:: prefix in a lot of places
+        X86Assembler::copy => X86Assembler::executableCopy
+        AssemblerBuffer::copy => AssemblerBuffer::executableCopy
+        WRECFunction => WREC::RegExpFunction
+        OBJECT_OFFSET => FIELD_OFFSET
+        
+        Also:
+
+        Nixed use of OBJECT_OFFSET outside of CTI.cpp by making CTI a friend in more places.
+        Nixed X86:: and X86Assembler:: prefixes in a lot of places using typedefs
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitGetVirtualRegister):
+        (JSC::CTI::emitGetVirtualRegisters):
+        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
+        (JSC::CTI::emitPutCTIArg):
+        (JSC::CTI::emitGetCTIArg):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutVirtualRegister):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::emitArithIntToImmWithJump):
+        (JSC::CTI::emitTagAsBoolImmediate):
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::freeCTIMachineTrampolines):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JmpTable::JmpTable):
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+        (JSC::CTI::JSRInfo::JSRInfo):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::Interpreter::slideRegisterWindowForCall):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::dumpCallFrame):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::resetTimeoutCheck):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::uncachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::uncacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        (JSC::Interpreter::findFunctionCallFrame):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_end):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_timeout_check):
+        (JSC::Interpreter::cti_register_file_check):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_new_object):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_new_func):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_arityCheck):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        (JSC::Interpreter::cti_op_push_activation):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_create_arguments):
+        (JSC::Interpreter::cti_op_create_arguments_no_params):
+        (JSC::Interpreter::cti_op_tear_off_activation):
+        (JSC::Interpreter::cti_op_tear_off_arguments):
+        (JSC::Interpreter::cti_op_profile_will_call):
+        (JSC::Interpreter::cti_op_profile_did_call):
+        (JSC::Interpreter::cti_op_ret_scopeChain):
+        (JSC::Interpreter::cti_op_new_array):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_base):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_new_func_exp):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_new_regexp):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_get_pnames):
+        (JSC::Interpreter::cti_op_next_pname):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_pop_scope):
+        (JSC::Interpreter::cti_op_typeof):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_is_string):
+        (JSC::Interpreter::cti_op_is_object):
+        (JSC::Interpreter::cti_op_is_function):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_push_new_scope):
+        (JSC::Interpreter::cti_op_jmp_scopes):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        (JSC::Interpreter::cti_op_debug):
+        (JSC::Interpreter::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * jsc.cpp:
+        (runWithScripts):
+        * masm/X86Assembler.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        (JSC::X86Assembler::executableCopy):
+        * runtime/ExecState.h:
+        (JSC::ExecState::interpreter):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSImmediate.h:
+        * runtime/JSString.h:
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wrec/CharacterClassConstructor.cpp:
+        * wrec/CharacterClassConstructor.h:
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WREC.h:
+        (JSC::WREC::Generator::Generator):
+        (JSC::WREC::Parser::):
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::parseAlternative):
+
+2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21810
+        Remove use of static C++ objects that are destroyed at exit time (destructors)
+
+        Conditionally have the DEFINE_STATIC_LOCAL workaround <rdar://problem/6354696> 
+        (Codegen issue with C++ static reference in gcc build 5465) based upon the compiler 
+        build versions. It will use the:
+        static T& = *new T;
+        style for all other compilers.
+
+        * wtf/StdLibExtras.h:
+
+2008-11-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22290
+        Remove cross-heap GC and MessagePort multi-threading support
+
+        It is broken (and may not be implementable at all), and no longer needed, as we
+        don't use MessagePorts for communication with workers any more.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        Remove hooks for cross-heap GC.
+
+2008-11-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup jsc command line code a little.
+
+        * jsc.cpp:
+        (functionQuit):
+        (main): Use standard exit status macros
+        (cleanupGlobalData): Factor out cleanup code into this function.
+        (printUsageStatement): Use standard exit status macros.
+
+2008-11-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup BytecodeGenerator constructors.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/CodeGenerator.h:
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateBytecode):
+
+2008-11-15  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        - do the long-planned StructureID -> Structure rename
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor):
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CTI.cpp:
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::transitionWillNeedStorageRealloc):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        * VM/CTI.h:
+        (JSC::CTI::compileGetByIdSelf):
+        (JSC::CTI::compileGetByIdProto):
+        (JSC::CTI::compileGetByIdChain):
+        (JSC::CTI::compilePutByIdReplace):
+        (JSC::CTI::compilePutByIdTransition):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * VM/CodeBlock.h:
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * VM/Machine.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::BytecodeInterpreter::resolveGlobal):
+        (JSC::BytecodeInterpreter::BytecodeInterpreter):
+        (JSC::cachePrototypeChain):
+        (JSC::BytecodeInterpreter::tryCachePutByID):
+        (JSC::BytecodeInterpreter::uncachePutByID):
+        (JSC::BytecodeInterpreter::tryCacheGetByID):
+        (JSC::BytecodeInterpreter::uncacheGetByID):
+        (JSC::BytecodeInterpreter::privateExecute):
+        (JSC::BytecodeInterpreter::tryCTICachePutByID):
+        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
+        (JSC::BytecodeInterpreter::cti_op_instanceof):
+        (JSC::BytecodeInterpreter::cti_op_construct_JSConstruct):
+        (JSC::BytecodeInterpreter::cti_op_resolve_global):
+        (JSC::BytecodeInterpreter::cti_op_is_undefined):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/Identifier.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell):
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        (JSC::JSCell::structure):
+        (JSC::JSValue::needsThisConversion):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createLeaked):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::argumentsStructure):
+        (JSC::JSGlobalObject::arrayStructure):
+        (JSC::JSGlobalObject::booleanObjectStructure):
+        (JSC::JSGlobalObject::callbackConstructorStructure):
+        (JSC::JSGlobalObject::callbackFunctionStructure):
+        (JSC::JSGlobalObject::callbackObjectStructure):
+        (JSC::JSGlobalObject::dateStructure):
+        (JSC::JSGlobalObject::emptyObjectStructure):
+        (JSC::JSGlobalObject::errorStructure):
+        (JSC::JSGlobalObject::functionStructure):
+        (JSC::JSGlobalObject::numberObjectStructure):
+        (JSC::JSGlobalObject::prototypeFunctionStructure):
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure):
+        (JSC::JSGlobalObject::regExpStructure):
+        (JSC::JSGlobalObject::stringObjectStructure):
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        (JSC::JSNumberCell::JSNumberCell):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::getPropertyAttributes):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::hasCustomProperties):
+        (JSC::JSObject::hasGetterSetterProperties):
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::setStructure):
+        (JSC::JSObject::inheritorID):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.h:
+        (JSC::equalSlowCaseInline):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::setCachedStructure):
+        (JSC::PropertyNameArrayData::cachedStructure):
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        (JSC::PropertyNameArrayData::cachedPrototypeChain):
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PrototypeFunction.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        * runtime/Structure.cpp: Copied from JavaScriptCore/runtime/StructureID.cpp.
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::startIgnoringLeaks):
+        (JSC::Structure::stopIgnoringLeaks):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::clearEnumerationCache):
+        (JSC::Structure::growPropertyStorageCapacity):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::createCachedPrototypeChain):
+        (JSC::Structure::checkConsistency):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        (JSC::Structure::expandPropertyMapHashTable):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        (JSC::Structure::getEnumerablePropertyNamesInternal):
+        * runtime/Structure.h: Copied from JavaScriptCore/runtime/StructureID.h.
+        (JSC::Structure::create):
+        (JSC::Structure::previousID):
+        (JSC::Structure::setCachedPrototypeChain):
+        (JSC::Structure::cachedPrototypeChain):
+        (JSC::Structure::):
+        (JSC::Structure::get):
+        * runtime/StructureChain.cpp: Copied from JavaScriptCore/runtime/StructureIDChain.cpp.
+        (JSC::StructureChain::StructureChain):
+        (JSC::structureChainsAreEqual):
+        * runtime/StructureChain.h: Copied from JavaScriptCore/runtime/StructureIDChain.h.
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::head):
+        * runtime/StructureID.cpp: Removed.
+        * runtime/StructureID.h: Removed.
+        * runtime/StructureIDChain.cpp: Removed.
+        * runtime/StructureIDChain.h: Removed.
+        * runtime/StructureIDTransitionTable.h: Removed.
+        * runtime/StructureTransitionTable.h: Copied from JavaScriptCore/runtime/StructureIDTransitionTable.h.
+
+2008-11-15  Darin Adler  <darin@apple.com>
+
+        - fix non-WREC build
+
+        * runtime/RegExp.cpp: Put "using namespace WREC" inside #if ENABLE(WREC).
+
+2008-11-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        As ThreadingNone doesn't implement threads, isMainThread should return true,
+        not false.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22285
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved all WREC-related code into WREC.cpp and put it in a WREC namespace.
+        Removed the WREC prefix from class names.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/Machine.h:
+        (JSC::BytecodeInterpreter::assemblerBuffer):
+        * masm/X86Assembler.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * wrec/CharacterClassConstructor.cpp:
+        * wrec/CharacterClassConstructor.h:
+        * wrec/WREC.cpp:
+        (WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
+        (WREC::GeneratePatternCharacterFunctor::generateAtom):
+        (WREC::GeneratePatternCharacterFunctor::backtrack):
+        (WREC::GenerateCharacterClassFunctor::generateAtom):
+        (WREC::GenerateCharacterClassFunctor::backtrack):
+        (WREC::GenerateBackreferenceFunctor::generateAtom):
+        (WREC::GenerateBackreferenceFunctor::backtrack):
+        (WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
+        (WREC::GenerateParenthesesNonGreedyFunctor::backtrack):
+        (WREC::Generator::generateBacktrack1):
+        (WREC::Generator::generateBacktrackBackreference):
+        (WREC::Generator::generateBackreferenceQuantifier):
+        (WREC::Generator::generateNonGreedyQuantifier):
+        (WREC::Generator::generateGreedyQuantifier):
+        (WREC::Generator::generatePatternCharacter):
+        (WREC::Generator::generateCharacterClassInvertedRange):
+        (WREC::Generator::generateCharacterClassInverted):
+        (WREC::Generator::generateCharacterClass):
+        (WREC::Generator::generateParentheses):
+        (WREC::Generator::generateParenthesesNonGreedy):
+        (WREC::Generator::generateParenthesesResetTrampoline):
+        (WREC::Generator::generateAssertionBOL):
+        (WREC::Generator::generateAssertionEOL):
+        (WREC::Generator::generateAssertionWordBoundary):
+        (WREC::Generator::generateBackreference):
+        (WREC::Generator::generateDisjunction):
+        (WREC::Generator::terminateDisjunction):
+        (WREC::Parser::parseGreedyQuantifier):
+        (WREC::Parser::parseQuantifier):
+        (WREC::Parser::parsePatternCharacterQualifier):
+        (WREC::Parser::parseCharacterClassQuantifier):
+        (WREC::Parser::parseBackreferenceQuantifier):
+        (WREC::Parser::parseParentheses):
+        (WREC::Parser::parseCharacterClass):
+        (WREC::Parser::parseOctalEscape):
+        (WREC::Parser::parseEscape):
+        (WREC::Parser::parseTerm):
+        (WREC::Parser::parseDisjunction):
+        (WREC::compileRegExp):
+        * wrec/WREC.h:
+        (WREC::Generator::Generator):
+        (WREC::Parser::Parser):
+        (WREC::Parser::parseAlternative):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed another case of "m_jit" to "m_assembler".
+
+        * VM/CTI.cpp:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+        (JSC::WRECGenerator::WRECGenerator):
+        (JSC::WRECParser::WRECParser):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed "jit" to "assembler" and, for brevity, replaced *jit.* with __
+        using a macro.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetVirtualRegister):
+        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
+        (JSC::CTI::emitPutCTIArg):
+        (JSC::CTI::emitGetCTIArg):
+        (JSC::CTI::emitPutCTIArgConstant):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutVirtualRegister):
+        (JSC::CTI::emitInitRegister):
+        (JSC::CTI::emitAllocateNumber):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::linkSlowCaseIfNotJSCell):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::emitArithIntToImmWithJump):
+        (JSC::CTI::emitTagAsBoolImmediate):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileLinkPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generateBacktrack1):
+        (JSC::WRECGenerator::generateBacktrackBackreference):
+        (JSC::WRECGenerator::generateBackreferenceQuantifier):
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generatePatternCharacter):
+        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+        (JSC::WRECGenerator::generateCharacterClass):
+        (JSC::WRECGenerator::generateParentheses):
+        (JSC::WRECGenerator::generateParenthesesNonGreedy):
+        (JSC::WRECGenerator::generateParenthesesResetTrampoline):
+        (JSC::WRECGenerator::generateAssertionBOL):
+        (JSC::WRECGenerator::generateAssertionEOL):
+        (JSC::WRECGenerator::generateAssertionWordBoundary):
+        (JSC::WRECGenerator::generateBackreference):
+        (JSC::WRECGenerator::generateDisjunction):
+        (JSC::WRECGenerator::terminateDisjunction):
+
+2008-11-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove dead method declaration.
+
+        * bytecompiler/CodeGenerator.h:
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed LabelID to Label, Label::isForwardLabel to Label::isForward.
+
+        * VM/LabelID.h:
+        (JSC::Label::Label):
+        (JSC::Label::isForward):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::newLabel):
+        (JSC::BytecodeGenerator::emitLabel):
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::prepareJumpTableForImmediateSwitch):
+        (JSC::prepareJumpTableForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        * bytecompiler/CodeGenerator.h:
+        * bytecompiler/LabelScope.h:
+        (JSC::LabelScope::LabelScope):
+        (JSC::LabelScope::breakTarget):
+        (JSC::LabelScope::continueTarget):
+        * parser/Nodes.cpp:
+        (JSC::LogicalOpNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::CaseBlockNode::emitBytecodeForBlock):
+        (JSC::TryNode::emitBytecode):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed JITCodeBuffer to AssemblerBuffer and renamed its data members
+        to be more like the rest of our buffer classes, with a size and a
+        capacity.
+        
+        Added an assert in the unchecked put case to match the test in the checked
+        put case.
+        
+        Changed a C-style cast to a C++-style cast.
+        
+        Renamed MAX_INSTRUCTION_SIZE to maxInstructionSize.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileRegExp):
+        * VM/Machine.cpp:
+        (JSC::BytecodeInterpreter::BytecodeInterpreter):
+        * VM/Machine.h:
+        (JSC::BytecodeInterpreter::assemblerBuffer):
+        * masm/X86Assembler.h:
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::~AssemblerBuffer):
+        (JSC::AssemblerBuffer::ensureSpace):
+        (JSC::AssemblerBuffer::isAligned):
+        (JSC::AssemblerBuffer::putByteUnchecked):
+        (JSC::AssemblerBuffer::putByte):
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putShort):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt):
+        (JSC::AssemblerBuffer::data):
+        (JSC::AssemblerBuffer::size):
+        (JSC::AssemblerBuffer::reset):
+        (JSC::AssemblerBuffer::copy):
+        (JSC::AssemblerBuffer::grow):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::X86Assembler):
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_i32m):
+        (JSC::X86Assembler::emitCall):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::emitUnlinkedJmp):
+        (JSC::X86Assembler::emitUnlinkedJne):
+        (JSC::X86Assembler::emitUnlinkedJe):
+        (JSC::X86Assembler::emitUnlinkedJl):
+        (JSC::X86Assembler::emitUnlinkedJb):
+        (JSC::X86Assembler::emitUnlinkedJle):
+        (JSC::X86Assembler::emitUnlinkedJbe):
+        (JSC::X86Assembler::emitUnlinkedJge):
+        (JSC::X86Assembler::emitUnlinkedJg):
+        (JSC::X86Assembler::emitUnlinkedJa):
+        (JSC::X86Assembler::emitUnlinkedJae):
+        (JSC::X86Assembler::emitUnlinkedJo):
+        (JSC::X86Assembler::emitUnlinkedJp):
+        (JSC::X86Assembler::emitUnlinkedJs):
+        (JSC::X86Assembler::link):
+        (JSC::X86Assembler::emitModRm_rr):
+        (JSC::X86Assembler::emitModRm_rm):
+        (JSC::X86Assembler::emitModRm_opr):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Maciej Stachowiak.
+        
+        Reverted most "opcode" => "bytecode" renames. We use "bytecode" as a
+        mass noun to refer to a stream of instructions. Each instruction may be
+        an opcode or an operand.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructureIDs):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructureIDs):
+        (JSC::CodeBlock::refStructureIDs):
+        * VM/CodeBlock.h:
+        * VM/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * VM/Machine.cpp:
+        (JSC::BytecodeInterpreter::isOpcode):
+        (JSC::BytecodeInterpreter::throwException):
+        (JSC::BytecodeInterpreter::tryCachePutByID):
+        (JSC::BytecodeInterpreter::uncachePutByID):
+        (JSC::BytecodeInterpreter::tryCacheGetByID):
+        (JSC::BytecodeInterpreter::uncacheGetByID):
+        (JSC::BytecodeInterpreter::privateExecute):
+        (JSC::BytecodeInterpreter::tryCTICachePutByID):
+        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
+        * VM/Machine.h:
+        (JSC::BytecodeInterpreter::getOpcode):
+        (JSC::BytecodeInterpreter::getOpcodeID):
+        (JSC::BytecodeInterpreter::isCallBytecode):
+        * VM/Opcode.cpp:
+        (JSC::):
+        (JSC::OpcodeStats::OpcodeStats):
+        (JSC::compareOpcodeIndices):
+        (JSC::compareOpcodePairIndices):
+        (JSC::OpcodeStats::~OpcodeStats):
+        (JSC::OpcodeStats::recordInstruction):
+        (JSC::OpcodeStats::resetLastInstruction):
+        * VM/Opcode.h:
+        (JSC::):
+        (JSC::padOpcodeName):
+        * VM/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::run):
+        (JSC::compareOpcodeIndicesSampling):
+        (JSC::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        (JSC::ScopeSampleRecord::ScopeSampleRecord):
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLabel):
+        (JSC::BytecodeGenerator::emitOpcode):
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        (JSC::BytecodeGenerator::emitPreInc):
+        (JSC::BytecodeGenerator::emitPreDec):
+        (JSC::BytecodeGenerator::emitPostInc):
+        (JSC::BytecodeGenerator::emitPostDec):
+        (JSC::BytecodeGenerator::emitBinaryOp):
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitUnexpectedLoad):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveFunction):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitPutGetter):
+        (JSC::BytecodeGenerator::emitPutSetter):
+        (JSC::BytecodeGenerator::emitDeleteById):
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        (JSC::BytecodeGenerator::emitDeleteByVal):
+        (JSC::BytecodeGenerator::emitPutByIndex):
+        (JSC::BytecodeGenerator::emitNewObject):
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitUnaryNoDstOp):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::BytecodeGenerator::emitSubroutineReturn):
+        (JSC::BytecodeGenerator::emitPushNewScope):
+        (JSC::BytecodeGenerator::beginSwitch):
+        * bytecompiler/CodeGenerator.h:
+        * jsc.cpp:
+        (runWithScripts):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::emitModRm_opr):
+        (JSC::X86Assembler::emitModRm_opr_Unchecked):
+        (JSC::X86Assembler::emitModRm_opm):
+        (JSC::X86Assembler::emitModRm_opm_Unchecked):
+        (JSC::X86Assembler::emitModRm_opmsib):
+        * parser/Nodes.cpp:
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::ReverseBinaryOpNode::emitBytecode):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ScopeNode::ScopeNode):
+        * parser/Nodes.h:
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::AddNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::InNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::fromDictionaryTransition):
+        * wtf/Platform.h:
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renames:
+        
+        CodeGenerator => BytecodeGenerator
+        emitCodeForBlock => emitBytecodeForBlock
+        generatedByteCode => generatedBytecode
+        generateCode => generateBytecode
+
+        * JavaScriptCore.exp:
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::setDumpsGeneratedCode):
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::allocateConstants):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addParameter):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::isLocal):
+        (JSC::BytecodeGenerator::isLocalConstant):
+        (JSC::BytecodeGenerator::newRegister):
+        (JSC::BytecodeGenerator::newTemporary):
+        (JSC::BytecodeGenerator::highestUsedRegister):
+        (JSC::BytecodeGenerator::newLabelScope):
+        (JSC::BytecodeGenerator::newLabel):
+        (JSC::BytecodeGenerator::emitLabel):
+        (JSC::BytecodeGenerator::emitBytecode):
+        (JSC::BytecodeGenerator::retrieveLastBinaryOp):
+        (JSC::BytecodeGenerator::retrieveLastUnaryOp):
+        (JSC::BytecodeGenerator::rewindBinaryOp):
+        (JSC::BytecodeGenerator::rewindUnaryOp):
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addUnexpectedConstant):
+        (JSC::BytecodeGenerator::addRegExp):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        (JSC::BytecodeGenerator::emitPreInc):
+        (JSC::BytecodeGenerator::emitPreDec):
+        (JSC::BytecodeGenerator::emitPostInc):
+        (JSC::BytecodeGenerator::emitPostDec):
+        (JSC::BytecodeGenerator::emitBinaryOp):
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitUnexpectedLoad):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveFunction):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitPutGetter):
+        (JSC::BytecodeGenerator::emitPutSetter):
+        (JSC::BytecodeGenerator::emitDeleteById):
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        (JSC::BytecodeGenerator::emitDeleteByVal):
+        (JSC::BytecodeGenerator::emitPutByIndex):
+        (JSC::BytecodeGenerator::emitNewObject):
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitUnaryNoDstOp):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitPushScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::popFinallyContext):
+        (JSC::BytecodeGenerator::breakTarget):
+        (JSC::BytecodeGenerator::continueTarget):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::BytecodeGenerator::emitSubroutineReturn):
+        (JSC::BytecodeGenerator::emitPushNewScope):
+        (JSC::BytecodeGenerator::beginSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
+        * bytecompiler/CodeGenerator.h:
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/Nodes.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError):
+        (JSC::NullNode::emitBytecode):
+        (JSC::BooleanNode::emitBytecode):
+        (JSC::NumberNode::emitBytecode):
+        (JSC::StringNode::emitBytecode):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::isPure):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::ObjectLiteralNode::emitBytecode):
+        (JSC::PropertyListNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::ArgumentListNode::emitBytecode):
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::emitPreIncOrDec):
+        (JSC::emitPostIncOrDec):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PostfixBracketNode::emitBytecode):
+        (JSC::PostfixDotNode::emitBytecode):
+        (JSC::PostfixErrorNode::emitBytecode):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::DeleteBracketNode::emitBytecode):
+        (JSC::DeleteDotNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::TypeOfValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::PrefixBracketNode::emitBytecode):
+        (JSC::PrefixDotNode::emitBytecode):
+        (JSC::PrefixErrorNode::emitBytecode):
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+        (JSC::StrictEqualNode::emitBytecode):
+        (JSC::ReverseBinaryOpNode::emitBytecode):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::InstanceOfNode::emitBytecode):
+        (JSC::LogicalOpNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ConstDeclNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::statementListEmitCode):
+        (JSC::BlockNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::CaseBlockNode::emitBytecodeForBlock):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::EvalNode::generateBytecode):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::ProgramNode::generateBytecode):
+        (JSC::FuncDeclNode::emitBytecode):
+        (JSC::FuncExprNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::BooleanNode::):
+        (JSC::NumberNode::):
+        (JSC::StringNode::):
+        (JSC::ProgramNode::):
+        (JSC::EvalNode::):
+        (JSC::FunctionBodyNode::):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed all forms of "byte code" "opcode" "op code" "code" "bitcode"
+        etc. to "bytecode".
+
+        * VM/CTI.cpp:
+        (JSC::CTI::printBytecodeOperandTypes):
+        (JSC::CTI::emitAllocateNumber):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::SwitchRecord::SwitchRecord):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructureIDs):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::derefStructureIDs):
+        (JSC::CodeBlock::refStructureIDs):
+        * VM/CodeBlock.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * VM/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * VM/Machine.cpp:
+        (JSC::BytecodeInterpreter::isBytecode):
+        (JSC::BytecodeInterpreter::throwException):
+        (JSC::BytecodeInterpreter::execute):
+        (JSC::BytecodeInterpreter::tryCachePutByID):
+        (JSC::BytecodeInterpreter::uncachePutByID):
+        (JSC::BytecodeInterpreter::tryCacheGetByID):
+        (JSC::BytecodeInterpreter::uncacheGetByID):
+        (JSC::BytecodeInterpreter::privateExecute):
+        (JSC::BytecodeInterpreter::tryCTICachePutByID):
+        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
+        (JSC::BytecodeInterpreter::cti_op_call_JSFunction):
+        (JSC::BytecodeInterpreter::cti_vm_dontLazyLinkCall):
+        (JSC::BytecodeInterpreter::cti_vm_lazyLinkCall):
+        * VM/Machine.h:
+        (JSC::BytecodeInterpreter::getBytecode):
+        (JSC::BytecodeInterpreter::getBytecodeID):
+        (JSC::BytecodeInterpreter::isCallBytecode):
+        * VM/Opcode.cpp:
+        (JSC::):
+        (JSC::BytecodeStats::BytecodeStats):
+        (JSC::compareBytecodeIndices):
+        (JSC::compareBytecodePairIndices):
+        (JSC::BytecodeStats::~BytecodeStats):
+        (JSC::BytecodeStats::recordInstruction):
+        (JSC::BytecodeStats::resetLastInstruction):
+        * VM/Opcode.h:
+        (JSC::):
+        (JSC::padBytecodeName):
+        * VM/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::run):
+        (JSC::compareBytecodeIndicesSampling):
+        (JSC::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        (JSC::ScopeSampleRecord::ScopeSampleRecord):
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitLabel):
+        (JSC::CodeGenerator::emitBytecode):
+        (JSC::CodeGenerator::emitJump):
+        (JSC::CodeGenerator::emitJumpIfTrue):
+        (JSC::CodeGenerator::emitJumpIfFalse):
+        (JSC::CodeGenerator::emitMove):
+        (JSC::CodeGenerator::emitUnaryOp):
+        (JSC::CodeGenerator::emitPreInc):
+        (JSC::CodeGenerator::emitPreDec):
+        (JSC::CodeGenerator::emitPostInc):
+        (JSC::CodeGenerator::emitPostDec):
+        (JSC::CodeGenerator::emitBinaryOp):
+        (JSC::CodeGenerator::emitEqualityOp):
+        (JSC::CodeGenerator::emitUnexpectedLoad):
+        (JSC::CodeGenerator::emitInstanceOf):
+        (JSC::CodeGenerator::emitResolve):
+        (JSC::CodeGenerator::emitGetScopedVar):
+        (JSC::CodeGenerator::emitPutScopedVar):
+        (JSC::CodeGenerator::emitResolveBase):
+        (JSC::CodeGenerator::emitResolveWithBase):
+        (JSC::CodeGenerator::emitResolveFunction):
+        (JSC::CodeGenerator::emitGetById):
+        (JSC::CodeGenerator::emitPutById):
+        (JSC::CodeGenerator::emitPutGetter):
+        (JSC::CodeGenerator::emitPutSetter):
+        (JSC::CodeGenerator::emitDeleteById):
+        (JSC::CodeGenerator::emitGetByVal):
+        (JSC::CodeGenerator::emitPutByVal):
+        (JSC::CodeGenerator::emitDeleteByVal):
+        (JSC::CodeGenerator::emitPutByIndex):
+        (JSC::CodeGenerator::emitNewObject):
+        (JSC::CodeGenerator::emitNewArray):
+        (JSC::CodeGenerator::emitNewFunction):
+        (JSC::CodeGenerator::emitNewRegExp):
+        (JSC::CodeGenerator::emitNewFunctionExpression):
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitReturn):
+        (JSC::CodeGenerator::emitUnaryNoDstOp):
+        (JSC::CodeGenerator::emitConstruct):
+        (JSC::CodeGenerator::emitPopScope):
+        (JSC::CodeGenerator::emitDebugHook):
+        (JSC::CodeGenerator::emitComplexJumpScopes):
+        (JSC::CodeGenerator::emitJumpScopes):
+        (JSC::CodeGenerator::emitNextPropertyName):
+        (JSC::CodeGenerator::emitCatch):
+        (JSC::CodeGenerator::emitNewError):
+        (JSC::CodeGenerator::emitJumpSubroutine):
+        (JSC::CodeGenerator::emitSubroutineReturn):
+        (JSC::CodeGenerator::emitPushNewScope):
+        (JSC::CodeGenerator::beginSwitch):
+        (JSC::CodeGenerator::endSwitch):
+        * bytecompiler/CodeGenerator.h:
+        (JSC::CodeGenerator::emitNode):
+        * jsc.cpp:
+        (runWithScripts):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::emitModRm_opr):
+        (JSC::X86Assembler::emitModRm_opr_Unchecked):
+        (JSC::X86Assembler::emitModRm_opm):
+        (JSC::X86Assembler::emitModRm_opm_Unchecked):
+        (JSC::X86Assembler::emitModRm_opmsib):
+        * parser/Nodes.cpp:
+        (JSC::NullNode::emitBytecode):
+        (JSC::BooleanNode::emitBytecode):
+        (JSC::NumberNode::emitBytecode):
+        (JSC::StringNode::emitBytecode):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::ObjectLiteralNode::emitBytecode):
+        (JSC::PropertyListNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::ArgumentListNode::emitBytecode):
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PostfixBracketNode::emitBytecode):
+        (JSC::PostfixDotNode::emitBytecode):
+        (JSC::PostfixErrorNode::emitBytecode):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::DeleteBracketNode::emitBytecode):
+        (JSC::DeleteDotNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::TypeOfValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::PrefixBracketNode::emitBytecode):
+        (JSC::PrefixDotNode::emitBytecode):
+        (JSC::PrefixErrorNode::emitBytecode):
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+        (JSC::StrictEqualNode::emitBytecode):
+        (JSC::ReverseBinaryOpNode::emitBytecode):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::InstanceOfNode::emitBytecode):
+        (JSC::LogicalOpNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::ConstDeclNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::BlockNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::FuncDeclNode::emitBytecode):
+        (JSC::FuncExprNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::AddNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::InNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        (JSC::ProgramNode::):
+        (JSC::EvalNode::):
+        (JSC::FunctionBodyNode::):
+        * runtime/JSNotAnObject.h:
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::fromDictionaryTransition):
+        * wtf/Platform.h:
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed Machine to BytecodeInterpreter.
+        
+        Nixed the Interpreter class, and changed its two functions to stand-alone
+        functions.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::freeCTIMachineTrampolines):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructureIDs):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructureIDs):
+        (JSC::CodeBlock::refStructureIDs):
+        * VM/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::BytecodeInterpreter::resolve):
+        (JSC::BytecodeInterpreter::resolveSkip):
+        (JSC::BytecodeInterpreter::resolveGlobal):
+        (JSC::BytecodeInterpreter::resolveBase):
+        (JSC::BytecodeInterpreter::resolveBaseAndProperty):
+        (JSC::BytecodeInterpreter::resolveBaseAndFunc):
+        (JSC::BytecodeInterpreter::slideRegisterWindowForCall):
+        (JSC::BytecodeInterpreter::callEval):
+        (JSC::BytecodeInterpreter::BytecodeInterpreter):
+        (JSC::BytecodeInterpreter::initialize):
+        (JSC::BytecodeInterpreter::~BytecodeInterpreter):
+        (JSC::BytecodeInterpreter::dumpCallFrame):
+        (JSC::BytecodeInterpreter::dumpRegisters):
+        (JSC::BytecodeInterpreter::isOpcode):
+        (JSC::BytecodeInterpreter::unwindCallFrame):
+        (JSC::BytecodeInterpreter::throwException):
+        (JSC::BytecodeInterpreter::execute):
+        (JSC::BytecodeInterpreter::debug):
+        (JSC::BytecodeInterpreter::resetTimeoutCheck):
+        (JSC::BytecodeInterpreter::checkTimeout):
+        (JSC::BytecodeInterpreter::createExceptionScope):
+        (JSC::BytecodeInterpreter::tryCachePutByID):
+        (JSC::BytecodeInterpreter::uncachePutByID):
+        (JSC::BytecodeInterpreter::tryCacheGetByID):
+        (JSC::BytecodeInterpreter::uncacheGetByID):
+        (JSC::BytecodeInterpreter::privateExecute):
+        (JSC::BytecodeInterpreter::retrieveArguments):
+        (JSC::BytecodeInterpreter::retrieveCaller):
+        (JSC::BytecodeInterpreter::retrieveLastCaller):
+        (JSC::BytecodeInterpreter::findFunctionCallFrame):
+        (JSC::BytecodeInterpreter::tryCTICachePutByID):
+        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
+        (JSC::BytecodeInterpreter::cti_op_convert_this):
+        (JSC::BytecodeInterpreter::cti_op_end):
+        (JSC::BytecodeInterpreter::cti_op_add):
+        (JSC::BytecodeInterpreter::cti_op_pre_inc):
+        (JSC::BytecodeInterpreter::cti_timeout_check):
+        (JSC::BytecodeInterpreter::cti_register_file_check):
+        (JSC::BytecodeInterpreter::cti_op_loop_if_less):
+        (JSC::BytecodeInterpreter::cti_op_loop_if_lesseq):
+        (JSC::BytecodeInterpreter::cti_op_new_object):
+        (JSC::BytecodeInterpreter::cti_op_put_by_id):
+        (JSC::BytecodeInterpreter::cti_op_put_by_id_second):
+        (JSC::BytecodeInterpreter::cti_op_put_by_id_generic):
+        (JSC::BytecodeInterpreter::cti_op_put_by_id_fail):
+        (JSC::BytecodeInterpreter::cti_op_get_by_id):
+        (JSC::BytecodeInterpreter::cti_op_get_by_id_second):
+        (JSC::BytecodeInterpreter::cti_op_get_by_id_generic):
+        (JSC::BytecodeInterpreter::cti_op_get_by_id_fail):
+        (JSC::BytecodeInterpreter::cti_op_instanceof):
+        (JSC::BytecodeInterpreter::cti_op_del_by_id):
+        (JSC::BytecodeInterpreter::cti_op_mul):
+        (JSC::BytecodeInterpreter::cti_op_new_func):
+        (JSC::BytecodeInterpreter::cti_op_call_JSFunction):
+        (JSC::BytecodeInterpreter::cti_op_call_arityCheck):
+        (JSC::BytecodeInterpreter::cti_vm_dontLazyLinkCall):
+        (JSC::BytecodeInterpreter::cti_vm_lazyLinkCall):
+        (JSC::BytecodeInterpreter::cti_op_push_activation):
+        (JSC::BytecodeInterpreter::cti_op_call_NotJSFunction):
+        (JSC::BytecodeInterpreter::cti_op_create_arguments):
+        (JSC::BytecodeInterpreter::cti_op_create_arguments_no_params):
+        (JSC::BytecodeInterpreter::cti_op_tear_off_activation):
+        (JSC::BytecodeInterpreter::cti_op_tear_off_arguments):
+        (JSC::BytecodeInterpreter::cti_op_profile_will_call):
+        (JSC::BytecodeInterpreter::cti_op_profile_did_call):
+        (JSC::BytecodeInterpreter::cti_op_ret_scopeChain):
+        (JSC::BytecodeInterpreter::cti_op_new_array):
+        (JSC::BytecodeInterpreter::cti_op_resolve):
+        (JSC::BytecodeInterpreter::cti_op_construct_JSConstruct):
+        (JSC::BytecodeInterpreter::cti_op_construct_NotJSConstruct):
+        (JSC::BytecodeInterpreter::cti_op_get_by_val):
+        (JSC::BytecodeInterpreter::cti_op_resolve_func):
+        (JSC::BytecodeInterpreter::cti_op_sub):
+        (JSC::BytecodeInterpreter::cti_op_put_by_val):
+        (JSC::BytecodeInterpreter::cti_op_put_by_val_array):
+        (JSC::BytecodeInterpreter::cti_op_lesseq):
+        (JSC::BytecodeInterpreter::cti_op_loop_if_true):
+        (JSC::BytecodeInterpreter::cti_op_negate):
+        (JSC::BytecodeInterpreter::cti_op_resolve_base):
+        (JSC::BytecodeInterpreter::cti_op_resolve_skip):
+        (JSC::BytecodeInterpreter::cti_op_resolve_global):
+        (JSC::BytecodeInterpreter::cti_op_div):
+        (JSC::BytecodeInterpreter::cti_op_pre_dec):
+        (JSC::BytecodeInterpreter::cti_op_jless):
+        (JSC::BytecodeInterpreter::cti_op_not):
+        (JSC::BytecodeInterpreter::cti_op_jtrue):
+        (JSC::BytecodeInterpreter::cti_op_post_inc):
+        (JSC::BytecodeInterpreter::cti_op_eq):
+        (JSC::BytecodeInterpreter::cti_op_lshift):
+        (JSC::BytecodeInterpreter::cti_op_bitand):
+        (JSC::BytecodeInterpreter::cti_op_rshift):
+        (JSC::BytecodeInterpreter::cti_op_bitnot):
+        (JSC::BytecodeInterpreter::cti_op_resolve_with_base):
+        (JSC::BytecodeInterpreter::cti_op_new_func_exp):
+        (JSC::BytecodeInterpreter::cti_op_mod):
+        (JSC::BytecodeInterpreter::cti_op_less):
+        (JSC::BytecodeInterpreter::cti_op_neq):
+        (JSC::BytecodeInterpreter::cti_op_post_dec):
+        (JSC::BytecodeInterpreter::cti_op_urshift):
+        (JSC::BytecodeInterpreter::cti_op_bitxor):
+        (JSC::BytecodeInterpreter::cti_op_new_regexp):
+        (JSC::BytecodeInterpreter::cti_op_bitor):
+        (JSC::BytecodeInterpreter::cti_op_call_eval):
+        (JSC::BytecodeInterpreter::cti_op_throw):
+        (JSC::BytecodeInterpreter::cti_op_get_pnames):
+        (JSC::BytecodeInterpreter::cti_op_next_pname):
+        (JSC::BytecodeInterpreter::cti_op_push_scope):
+        (JSC::BytecodeInterpreter::cti_op_pop_scope):
+        (JSC::BytecodeInterpreter::cti_op_typeof):
+        (JSC::BytecodeInterpreter::cti_op_is_undefined):
+        (JSC::BytecodeInterpreter::cti_op_is_boolean):
+        (JSC::BytecodeInterpreter::cti_op_is_number):
+        (JSC::BytecodeInterpreter::cti_op_is_string):
+        (JSC::BytecodeInterpreter::cti_op_is_object):
+        (JSC::BytecodeInterpreter::cti_op_is_function):
+        (JSC::BytecodeInterpreter::cti_op_stricteq):
+        (JSC::BytecodeInterpreter::cti_op_nstricteq):
+        (JSC::BytecodeInterpreter::cti_op_to_jsnumber):
+        (JSC::BytecodeInterpreter::cti_op_in):
+        (JSC::BytecodeInterpreter::cti_op_push_new_scope):
+        (JSC::BytecodeInterpreter::cti_op_jmp_scopes):
+        (JSC::BytecodeInterpreter::cti_op_put_by_index):
+        (JSC::BytecodeInterpreter::cti_op_switch_imm):
+        (JSC::BytecodeInterpreter::cti_op_switch_char):
+        (JSC::BytecodeInterpreter::cti_op_switch_string):
+        (JSC::BytecodeInterpreter::cti_op_del_by_val):
+        (JSC::BytecodeInterpreter::cti_op_put_getter):
+        (JSC::BytecodeInterpreter::cti_op_put_setter):
+        (JSC::BytecodeInterpreter::cti_op_new_error):
+        (JSC::BytecodeInterpreter::cti_op_debug):
+        (JSC::BytecodeInterpreter::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitOpcode):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/ExecState.h:
+        (JSC::ExecState::interpreter):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/Interpreter.cpp:
+        (JSC::Interpreter::evaluate):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::setTimeoutTime):
+        (JSC::JSGlobalObject::startTimeoutCheck):
+        (JSC::JSGlobalObject::stopTimeoutCheck):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSString.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+
+2008-11-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - Remove SymbolTable from FunctionBodyNode and move it to CodeBlock
+        
+        It's not needed for functions that have never been executed, so no
+        need to waste the memory. Saves ~4M on membuster after 30 pages.
+
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::retrieveArguments):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::generateCode):
+        (JSC::FunctionBodyNode::generateCode):
+        * parser/Nodes.h:
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+
+2008-11-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22259: Make all opcodes use eax as their final result register
+        <https://bugs.webkit.org/show_bug.cgi?id=22259>
+
+        Change one case of op_add (and the corresponding slow case) to use eax
+        rather than edx. Also, change the order in which the two results of
+        resolve_func and resolve_base are emitted so that the retrieved value is
+        put last into eax.
+
+        This gives no performance change on SunSpider or the V8 benchmark suite
+        when run in either harness.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+
+2008-11-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Geoff has this wacky notion that emitGetArg and emitPutArg should be related to
+        doing the same thing.  Crazy.
+        
+        Rename the methods for accessing virtual registers to say 'VirtualRegister' in the
+        name, and those for setting up the arguments for CTI methods to contain 'CTIArg'.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetVirtualRegister):
+        (JSC::CTI::emitGetVirtualRegisters):
+        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
+        (JSC::CTI::emitPutCTIArg):
+        (JSC::CTI::emitGetCTIArg):
+        (JSC::CTI::emitPutCTIArgConstant):
+        (JSC::CTI::emitPutVirtualRegister):
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCallEvalSetupArgs):
+        (JSC::CTI::compileOpConstructSetupArgs):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        * VM/CTI.h:
+
+2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        Fix potential build break by adding StdLibExtras.h
+        
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2008-11-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Generate less code for the slow cases of op_call and op_construct.
+        https://bugs.webkit.org/show_bug.cgi?id=22272
+
+        1% progression on v8 tests.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitRetrieveArg):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::getCallLinkInfoReturnLocation):
+        (JSC::CodeBlock::getCallLinkInfo):
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+        (JSC::Machine::cti_vm_dontLazyLinkCall):
+        (JSC::Machine::cti_vm_lazyLinkCall):
+        * VM/Machine.h:
+
+2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21810
+        Remove use of static C++ objects that are destroyed at exit time (destructors)
+
+        Create DEFINE_STATIC_LOCAL macro. Change static local objects to leak to avoid 
+        exit-time destructor. Update code that was changed to fix this issue that ran 
+        into a gcc bug (<rdar://problem/6354696> Codegen issue with C++ static reference 
+        in gcc build 5465). Also typdefs for template types needed to be added in some 
+        cases so the type could make it through the macro successfully.
+
+        Basically code of the form:
+        static T m;
+        becomes:
+        DEFINE_STATIC_LOCAL(T, m, ());
+
+        Also any code of the form:
+        static T& m = *new T;
+        also becomes:
+        DEFINE_STATIC_LOCAL(T, m, ());
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/MainThread.cpp:
+        (WTF::mainThreadFunctionQueueMutex):
+        (WTF::functionQueue):
+        * wtf/StdLibExtras.h: Added. Add DEFINE_STATIC_LOCAL macro
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+
+2008-11-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22269
+        Reduce PropertyMap usage
+
+        From observation of StructureID statistics, it became clear that many
+        StructureID's were not being used as StructureIDs themselves, but rather
+        only being necessary as links in the transition chain.  Acknowledging this
+        and that PropertyMaps stored in StructureIDs can be treated as caches, that
+        is that they can be reconstructed on demand, it became clear that we could
+        reduce the memory consumption of StructureIDs by only keeping PropertyMaps
+        for the StructureIDs that need them the most.
+
+        The specific strategy used to reduce the number of StructureIDs with
+        PropertyMaps is to take the previous StructureIDs PropertyMap when initially
+        transitioning (addPropertyTransition) from it and clearing out the pointer 
+        in the process.  The next time we need to do the same transition, for instance
+        repeated calls to the same constructor, we use the new addPropertyTransitionToExistingStructure
+        first, which allows us not to need the PropertyMap to determine if the property
+        exists already, since a transition to that property would require it not already
+        be present in the StructureID.  Should there be no transition, the PropertyMap
+        can be constructed on demand (via materializePropertyMap) to determine if the put is a 
+        replace or a transition to a new StructureID.
+
+        Reduces memory use on Membuster head test (30 pages open) by ~15MB.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect): First use addPropertyTransitionToExistingStructure
+        so that we can avoid building the PropertyMap on subsequent similar object
+        creations.
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry): Add version of constructor which takes
+        all values to be used when lazily building the PropertyMap. 
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics): Add statistics on the number of StructureIDs
+        with PropertyMaps.
+        (JSC::StructureID::StructureID): Rename m_cachedTransistionOffset to m_offset
+        (JSC::isPowerOf2):
+        (JSC::nextPowerOf2):
+        (JSC::sizeForKeyCount): Returns the expected size of a PropertyMap for a key count.
+        (JSC::StructureID::materializePropertyMap): Builds the PropertyMap out of its previous pointer chain.
+        (JSC::StructureID::addPropertyTransitionToExistingStructure): Only transitions if there is a
+        an existing transition.
+        (JSC::StructureID::addPropertyTransition): Instead of always copying the ProperyMap, try and take
+        it from it previous pointer.
+        (JSC::StructureID::removePropertyTransition): Simplify by calling toDictionaryTransition() to do
+        transition work.
+        (JSC::StructureID::changePrototypeTransition): Build the PropertyMap if necessary before transitioning
+        because once you have transitioned, you will not be able to reconstruct it afterwards as there is no
+        previous pointer, pinning the ProperyMap as well.
+        (JSC::StructureID::getterSetterTransition): Ditto.
+        (JSC::StructureID::toDictionaryTransition): Pin the PropertyMap so that it is not destroyed on further transitions.
+        (JSC::StructureID::fromDictionaryTransition): We can only transition back from a dictionary transition if there
+        are no deleted offsets.
+        (JSC::StructureID::addPropertyWithoutTransition): Build PropertyMap on demands and pin.
+        (JSC::StructureID::removePropertyWithoutTransition): Ditto.
+        (JSC::StructureID::get): Build on demand.
+        (JSC::StructureID::createPropertyMapHashTable): Add version of create that takes a size
+        for on demand building.
+        (JSC::StructureID::expandPropertyMapHashTable):
+        (JSC::StructureID::rehashPropertyMapHashTable):
+        (JSC::StructureID::getEnumerablePropertyNamesInternal): Build PropertyMap on demand.
+        * runtime/StructureID.h:
+        (JSC::StructureID::propertyStorageSize): Account for StructureIDs without PropertyMaps.
+        (JSC::StructureID::isEmpty): Ditto.
+        (JSC::StructureID::materializePropertyMapIfNecessary):
+        (JSC::StructureID::get): Build PropertyMap on demand
+
+2008-11-14  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21500>
+
+        JavaScriptCore build with -O3 flag instead of -O2 (gcc).
+        2.02% speedup on SunSpider (Qt-port on Linux)
+        1.10% speedup on V8 (Qt-port on Linux)
+        3.45% speedup on WindScorpion (Qt-port on Linux)
+
+        * JavaScriptCore.pri:
+
+2008-11-14  Kristian Amlie  <kristian.amlie@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        Compile fix for RVCT.
+
+        In reality, it is two fixes:
+
+        1. Remove typename. I believe typename can only be used when the named
+        type depends on the template parameters, which it doesn't in this
+        case, so I think this is more correct.
+        2. Replace ::iterator scope with specialized typedef. This is to work
+        around a bug in RVCT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22260
+
+        * wtf/ListHashSet.h:
+        (WTF::::find):
+
+2008-11-14  Kristian Amlie  <kristian.amlie@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        Compile fix for WINSCW.
+
+        This fix doesn't protect against implicit conversions from bool to
+        integers, but most likely that will be caught on another platform.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22260
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::operator bool):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::operator bool):
+
+2008-11-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22245: Move wtf/dtoa.h into the WTF namespace
+        <https://bugs.webkit.org/show_bug.cgi?id=22245>
+
+        Move wtf/dtoa.h into the WTF namespace from the JSC namespace. This
+        introduces some ambiguities in name lookups, so I changed all uses of
+        the functions in wtf/dtoa.h to explicitly state the namespace.
+
+        * JavaScriptCore.exp:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToExponential):
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::from):
+        (JSC::UString::toDouble):
+        * wtf/dtoa.cpp:
+        * wtf/dtoa.h:
+
+2008-11-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 22257: Enable redundant read optimizations for results generated by compileBinaryArithOp()
+        <https://bugs.webkit.org/show_bug.cgi?id=22257>
+
+        This shows no change in performance on either SunSpider or the V8
+        benchmark suite, but it removes an ugly special case and allows for
+        future optimizations to be implemented in a cleaner fashion.
+
+        This patch was essentially given to me by Gavin Barraclough upon my
+        request, but I did regression and performance testing so that he could
+        work on something else.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate): Move the final
+        result to eax if it is not already there.
+        (JSC::CTI::compileBinaryArithOp): Remove the killing of the final result
+        register that disables the optimization.
+
+2008-11-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add a Scons-based build system for building
+        the Chromium-Mac build of JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=21991
+
+        * JavaScriptCore.scons: Added.
+        * SConstruct: Added.
+
+2008-11-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+        
+        Add PLATFORM(CHROMIUM) to the "we don't use cairo" blacklist
+        until https://bugs.webkit.org/show_bug.cgi?id=22250 is fixed.
+
+        * wtf/Platform.h:
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        In r38375 the 'jsc' shell was changed to improve teardown on quit. The
+        main() function in jsc.cpp uses Structured Exception Handling, so Visual
+        C++ emits a warning when destructors are used.
+        
+        In order to speculatively fix the Windows build, this patch changes that
+        code to use explicit pointer manipulation and locking rather than smart
+        pointers and RAII.
+
+        * jsc.cpp:
+        (main):
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22246: Get arguments for opcodes together to eliminate more redundant memory reads
+        <https://bugs.webkit.org/show_bug.cgi?id=22246>
+
+        It is common for opcodes to read their first operand into eax and their
+        second operand into edx. If the value intended for the second operand is
+        in eax, we should first move eax to the register for the second operand
+        and then read the first operand into eax.
+
+        This is a 0.5% speedup on SunSpider and a 2.0% speedup on the V8
+        benchmark suite when measured using the V8 harness.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArgs):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22238: Avoid unnecessary reads of temporaries when the target machine register is not eax
+        <https://bugs.webkit.org/show_bug.cgi?id=22238>
+
+        Enable the optimization of not reading a value back from memory that we
+        just wrote when the target machine register is not eax. In order to do
+        this, the code generation for op_put_global_var must be changed to
+        read its argument into a register before overwriting eax.
+
+        This is a 0.5% speedup on SunSpider and shows no change on the V8
+        benchmark suite when run in either harness.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::privateCompileMainPass):
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Perform teardown in the 'jsc' shell in order to suppress annoying and
+        misleading leak messages. There is still a lone JSC::Node leaking when
+        quit() is called, but hopefully that can be fixed as well.
+
+        * jsc.cpp:
+        (functionQuit):
+        (main):
+
+2008-11-13  Mike Pinkerton  <pinkerton@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22087
+        Need correct platform defines for Mac Chromium
+
+        Set the appropriate platform defines for Mac Chromium, which is
+        similar to PLATFORM(MAC), but isn't.
+
+        * wtf/Platform.h:
+
+2008-11-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - remove immediate checks from native codegen for known non-immediate cases like "this"
+        
+        ~.5% speedup on v8 benchmarks
+        
+        In the future we can extend this model to remove all sorts of
+        typechecks based on local type info or type inference.
+        
+        I also added an assertion to verify that all slow cases linked as
+        many slow case jumps as the corresponding fast case generated, and
+        fixed the pre-existing cases where this was not true.
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::linkSlowCaseIfNotJSCell):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21943: Avoid needless reads of temporary values in CTI code
+        <https://bugs.webkit.org/show_bug.cgi?id=21943>
+
+        If an opcode needs to load a virtual register and a previous opcode left
+        the contents of that virtual register in a machine register, use the
+        value in the machine register rather than getting it from memory.
+
+        In order to perform this optimization, it is necessary to know the
+        jump tagets in the CodeBlock. For temporaries, the only problematic
+        jump targets are binary logical operators and the ternary conditional
+        operator. However, if this optimization were to be extended to local 
+        variable registers as well, other jump targets would need to be
+        included, like switch statement cases and the beginnings of catch
+        blocks.
+
+        This optimization also requires that the fast case and the slow case
+        of an opcode use emitPutResult() on the same register, which was chosen
+        to be eax, as that is the register into which we read the first operand
+        of opcodes. In order to make this the case, we needed to add some mov
+        instructions to the slow cases of some instructions.
+
+        This optimizaton is not applied whenever compileBinaryArithOp() is used
+        to compile an opcode, because different machine registers may be used to
+        store the final result. It seems possible to rewrite the code generation
+        in compileBinaryArithOp() to allow for this optimization.
+
+        This optimization is also not applied when generating slow cases,
+        because some fast cases overwrite the value of eax before jumping to the
+        slow case. In the future, it may be possible to apply this optimization
+        to slow cases as well, but it did not seem to be a speedup when testing
+        an early version of this patch.
+
+        This is a 1.0% speedup on SunSpider and a 6.3% speedup on the V8
+        benchmark suite.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::killLastResultRegister):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutResult):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::isTemporaryRegisterIndex):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitLabel):
+
+2008-11-12  Alp Toker  <alp@nuanti.com>
+
+        autotools build system fix-up only. Add FloatQuad.h to the source
+        lists and sort them.
+
+        * GNUmakefile.am:
+
+2008-11-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22192
+        +37 failures in fast/profiler
+        
+        along with Darin's review comments in
+        https://bugs.webkit.org/show_bug.cgi?id=22174
+        Simplified op_call by nixing its responsibility for moving the value of
+        "this" into the first argument slot
+
+        * VM/Machine.cpp:
+        (JSC::returnToThrowTrampoline):
+        (JSC::throwStackOverflowError):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_call_arityCheck):
+        (JSC::Machine::cti_vm_throw): Moved the throw logic into a function, since
+        functions are better than macros.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct): Ensure that the function register
+        is preserved if profiling is enabled, since the profiler uses that
+        register.
+
+        * runtime/JSGlobalData.h: Renamed throwReturnAddress to exceptionLocation,
+        because I had a hard time understanding what "throwReturnAddress" meant.
+
+2008-11-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Roll in r38322, now that test failures have been fixed.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCallEvalSetupArgs):
+        (JSC::CTI::compileOpConstructSetupArgs):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::execute):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_call_arityCheck):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitCallEval):
+        (JSC::CodeGenerator::emitConstruct):
+        * bytecompiler/CodeGenerator.h:
+        * parser/Nodes.cpp:
+        (JSC::EvalFunctionCallNode::emitCode):
+        (JSC::FunctionCallValueNode::emitCode):
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::FunctionCallBracketNode::emitCode):
+        (JSC::FunctionCallDotNode::emitCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::neededConstants):
+
+2008-11-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22201
+        Integer conversion in array.length was safe signed values,
+        but the length is unsigned.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+
+2008-11-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Roll out r38322 due to test failures on the bots.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::execute):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::throwStackOverflowPreviousFrame):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_call_arityCheck):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitCallEval):
+        (JSC::CodeGenerator::emitConstruct):
+        * bytecompiler/CodeGenerator.h:
+        * parser/Nodes.cpp:
+        (JSC::EvalFunctionCallNode::emitCode):
+        (JSC::FunctionCallValueNode::emitCode):
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::FunctionCallBracketNode::emitCode):
+        (JSC::FunctionCallDotNode::emitCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::neededConstants):
+
+2008-11-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22174
+        Simplified op_call by nixing its responsibility for moving the value of
+        "this" into the first argument slot.
+
+        Instead, the caller emits an explicit load or mov instruction, or relies
+        on implicit knowledge that "this" is already in the first argument slot.
+        As a result, two operands to op_call are gone: firstArg and thisVal.
+        
+        SunSpider and v8 tests show no change in bytecode or CTI.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCallEvalSetupArgs):
+        (JSC::CTI::compileOpConstructSetupArgs): Split apart these three versions
+        of setting up arguments to op_call, because they're more different than
+        they are the same -- even more so with this patch.
+
+        (JSC::CTI::compileOpCall): Updated for the fact that op_construct doesn't
+        match op_call anymore.
+
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases): Merged a few call cases. Updated
+        for changes mentioned above.
+
+        * VM/CTI.h:
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Updated for new bytecode format of call / construct.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval): Updated for new bytecode format of call / construct.
+
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters): Simplified these debugging functions, 
+        taking advantage of the new call frame layout.
+
+        (JSC::Machine::execute): Fixed up the eval version of execute to be
+        friendlier to calls in the new format.
+
+        (JSC::Machine::privateExecute): Implemented the new call format in
+        bytecode.
+
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_call_eval): Updated CTI helpers to match the new
+        call format.
+        
+        Fixed a latent bug in stack overflow checking that is now hit because
+        the register layout has changed a bit -- namely: when throwing a stack
+        overflow exception inside an op_call helper, we need to account for the
+        fact that the current call frame is only half-constructed, and use the
+        parent call frame instead.
+
+        * VM/Machine.h:
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitCallEval):
+        (JSC::CodeGenerator::emitConstruct):
+        * bytecompiler/CodeGenerator.h: Updated codegen to match the new call
+        format.
+
+        * parser/Nodes.cpp:
+        (JSC::EvalFunctionCallNode::emitCode):
+        (JSC::FunctionCallValueNode::emitCode):
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::FunctionCallBracketNode::emitCode):
+        (JSC::FunctionCallDotNode::emitCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::neededConstants): ditto
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove an unused forwarding header for a file that no longer exists.
+
+        * ForwardingHeaders/JavaScriptCore/JSLock.h: Removed.
+
+2008-11-11  Mark Rowe  <mrowe@apple.com>
+
+        Fix broken dependencies building JavaScriptCore on a freezing cold cat, caused
+        by failure to update all instances of "kjs" to their new locations.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-11-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Adam Roben.
+
+        * wtf/AVLTree.h: (WTF::AVLTree::Iterator::start_iter):
+        Fix indentation a little more.
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Clean up EvalCodeCache to match our coding style a bit more.
+
+        * VM/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Bug 22179: Move EvalCodeCache from CodeBlock.h into its own file
+        <https://bugs.webkit.org/show_bug.cgi?id=22179>
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.h:
+        * VM/EvalCodeCache.h: Copied from VM/CodeBlock.h.
+        * VM/Machine.cpp:
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the 'm_' prefix from the fields of the SwitchRecord struct.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+        (JSC::SwitchRecord):
+        (JSC::SwitchRecord::SwitchRecord):
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Make asInteger() a static function so that it has internal linkage.
+
+        * VM/CTI.cpp:
+        (JSC::asInteger):
+
+2008-11-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        - shrink CodeBlock and AST related Vectors to exact fit (5-10M savings on membuster test)
+        
+        No perf regression combined with the last patch (each seems like a small regression individually)
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        * parser/Nodes.h:
+        (JSC::SourceElements::releaseContentsIntoVector):
+        * wtf/Vector.h:
+        (WTF::Vector::shrinkToFit):
+
+2008-11-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        - remove inline capacity from declaration stacks (15M savings on membuster test)
+
+        No perf regression on SunSpider or V8 test combined with other upcoming memory improvement patch.
+        
+        * JavaScriptCore.exp:
+        * parser/Nodes.h:
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        While r38286 removed the need for the m_callFrame member variable of
+        CTI, it should be also be removed.
+
+        * VM/CTI.h:
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make CTI::asInteger() a non-member function, since it needs no access to
+        any of CTI's member variables.
+
+        * VM/CTI.cpp:
+        (JSC::asInteger):
+        * VM/CTI.h:
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Use 'value' instead of 'js' in CTI as a name for JSValue* to match our
+        usual convention elsewhere.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make CTI::getConstant() a member function of CodeBlock instead.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename CodeBlock::isConstant() to isConstantRegisterIndex().
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+
+2008-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix for non-CTI builds.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::initialize):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the unused labels member variable of CodeBlock.
+
+        * VM/CodeBlock.h:
+        * VM/LabelID.h:
+        (JSC::LabelID::setLocation):
+
+2008-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Batch compile the set of static trampolines at the point Machine is constructed, using a single allocation.
+        Refactor out m_callFrame from CTI, since this is only needed to access the global data (instead store a
+        pointer to the global data directly, since this is available at the point the Machine is constructed).
+        Add a method to align the code buffer, to allow JIT generation for multiple trampolines in one block.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::getConstant):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::freeCTIMachineTrampolines):
+        * VM/CTI.h:
+        (JSC::CTI::compile):
+        (JSC::CTI::compileGetByIdSelf):
+        (JSC::CTI::compileGetByIdProto):
+        (JSC::CTI::compileGetByIdChain):
+        (JSC::CTI::compilePutByIdReplace):
+        (JSC::CTI::compilePutByIdTransition):
+        (JSC::CTI::compileCTIMachineTrampolines):
+        (JSC::CTI::compilePatchGetArrayLength):
+        * VM/Machine.cpp:
+        (JSC::Machine::initialize):
+        (JSC::Machine::~Machine):
+        (JSC::Machine::execute):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_lazyLinkCall):
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::JITCodeBuffer::isAligned):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::align):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2008-11-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Antti Koivisto.
+        
+        - Make Vector::clear() release the Vector's memory (1MB savings on membuster)
+        https://bugs.webkit.org/show_bug.cgi?id=22170
+
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::deallocateBuffer): Set capacity to 0 as
+        well as size, otherwise shrinking capacity to 0 can fail to reset
+        the capacity and thus cause a future crash.
+        (WTF::Vector::~Vector): Shrink size not capacity; we only need
+        to call destructors, the buffer will be freed anyway.
+        (WTF::Vector::clear): Change this to shrinkCapacity(0), not just shrink(0).
+        (WTF::::shrinkCapacity): Use shrink() instead of resize() for case where
+        the size is greater than the new capacity, to work with types that have no
+        default constructor.
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Split multiple definitions into separate lines.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileBinaryArithOp):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22162: Remove cachedValueGetter from the JavaScriptCore API implementation
+        <https://bugs.webkit.org/show_bug.cgi?id=22162>
+
+        There is no more need for the cachedValueGetter hack now that we have
+        PropertySlot::setValue(), so we should remove it.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22152: Remove asObject() call from JSCallbackObject::getOwnPropertySlot()
+        <https://bugs.webkit.org/show_bug.cgi?id=22152>
+
+        With the recent change to adopt asType() style cast functions with
+        assertions instead of static_casts in many places, the assertion for
+        the asObject() call in JSCallbackObject::getOwnPropertySlot() has been
+        failing when using any nontrivial client of the JavaScriptCore API.
+        The cast isn't even necessary to call slot.setCustom(), so it should
+        be removed.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::getOwnPropertySlot):
+
+2008-11-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        A few coding style fixes for AVLTree.
+
+        * wtf/AVLTree.h: Moved to WTF namespace, Removed "KJS_" from include guards.
+        (WTF::AVLTree::Iterator::start_iter): Fixed indentation
+
+        * runtime/JSArray.cpp: Added "using namepace WTF".
+
+2008-11-09  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculatively fix the non-AllInOne build.
+
+        * runtime/NativeErrorConstructor.cpp:
+
+2008-11-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22149
+          remove unused code from the parser
+
+        * AllInOneFile.cpp: Removed nodes2string.cpp.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.exp: Ditto.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+
+        * VM/CodeBlock.h: Added include.
+
+        * VM/Machine.cpp: (JSC::Machine::execute): Use the types from
+        DeclarationStacks as DeclarationStacks:: rather than Node:: since
+        "Node" really has little to do with it.
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator): Ditto.
+
+        * jsc.cpp:
+        (Options::Options): Removed prettyPrint option.
+        (runWithScripts): Ditto.
+        (printUsageStatement): Ditto.
+        (parseArguments): Ditto.
+        (jscmain): Ditto.
+
+        * parser/Grammar.y: Removed use of obsolete ImmediateNumberNode.
+
+        * parser/Nodes.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError): Use inline functions
+        instead of direct member access for ThrowableExpressionData values.
+        (JSC::BracketAccessorNode::emitCode): Ditto.
+        (JSC::DotAccessorNode::emitCode): Ditto.
+        (JSC::NewExprNode::emitCode): Ditto.
+        (JSC::EvalFunctionCallNode::emitCode): Ditto.
+        (JSC::FunctionCallValueNode::emitCode): Ditto.
+        (JSC::FunctionCallResolveNode::emitCode): Ditto.
+        (JSC::FunctionCallBracketNode::emitCode): Ditto.
+        (JSC::FunctionCallDotNode::emitCode): Ditto.
+        (JSC::PostfixResolveNode::emitCode): Ditto.
+        (JSC::PostfixBracketNode::emitCode): Ditto.
+        (JSC::PostfixDotNode::emitCode): Ditto.
+        (JSC::DeleteResolveNode::emitCode): Ditto.
+        (JSC::DeleteBracketNode::emitCode): Ditto.
+        (JSC::DeleteDotNode::emitCode): Ditto.
+        (JSC::PrefixResolveNode::emitCode): Ditto.
+        (JSC::PrefixBracketNode::emitCode): Ditto.
+        (JSC::PrefixDotNode::emitCode): Ditto.
+        (JSC::ThrowableBinaryOpNode::emitCode): Ditto.
+        (JSC::InstanceOfNode::emitCode): Ditto.
+        (JSC::ReadModifyResolveNode::emitCode): Ditto.
+        (JSC::AssignResolveNode::emitCode): Ditto.
+        (JSC::AssignDotNode::emitCode): Ditto.
+        (JSC::ReadModifyDotNode::emitCode): Ditto.
+        (JSC::AssignBracketNode::emitCode): Ditto.
+        (JSC::ReadModifyBracketNode::emitCode): Ditto.
+        (JSC::statementListEmitCode): Take a const StatementVector instead
+        of a non-const one. Also removed unused statementListPushFIFO.
+        (JSC::ForInNode::emitCode): Inline functions instead of member access.
+        (JSC::ThrowNode::emitCode): Ditto.
+        (JSC::EvalNode::emitCode): Ditto.
+        (JSC::FunctionBodyNode::emitCode): Ditto.
+        (JSC::ProgramNode::emitCode): Ditto.
+
+        * parser/Nodes.h: Removed unused includes and forward declarations.
+        Removed Precedence enum. Made many more members private instead of
+        protected or public. Removed unused NodeStack typedef. Moved the
+        VarStack and FunctionStack typedefs from Node to ScopeNode. Made
+        Node::emitCode pure virtual and changed classes that don't emit
+        any code to inherit from ParserRefCounted rather than Node.
+        Moved isReturnNode from Node to StatementNode. Removed the
+        streamTo, precedence, and needsParensIfLeftmost functions from
+        all classes. Removed the ImmediateNumberNode class and make
+        NumberNode::setValue nonvirtual.
+
+        * parser/nodes2string.cpp: Removed.
+
+2008-11-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig and Maciej Stachowiak.
+        Includes some work done by Chris Brichford.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=14886
+          Stack overflow due to deeply nested parse tree doing repeated string concatentation
+
+        Test: fast/js/large-expressions.html
+
+        1) Code generation is recursive, so takes stack proportional to the complexity
+           of the source code expression. Fixed by setting an arbitrary recursion limit
+           of 10,000 nodes.
+
+        2) Destruction of the syntax tree was recursive. Fixed by introducing a
+           non-recursive mechanism for destroying the tree.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator): Initialize depth to 0.
+        (JSC::CodeGenerator::emitThrowExpressionTooDeepException): Added. Emits the code
+        to throw a "too deep" exception.
+        * bytecompiler/CodeGenerator.h:
+        (JSC::CodeGenerator::emitNode): Check depth and emit an exception if we exceed
+        the maximum depth.
+
+        * parser/Nodes.cpp:
+        (JSC::NodeReleaser::releaseAllNodes): Added. To be called inside node destructors
+        to avoid recursive calls to destructors for nodes inside this one.
+        (JSC::NodeReleaser::release): Added. To be called inside releaseNodes functions.
+        Also added releaseNodes functions and calls to releaseAllNodes inside destructors
+        for each class derived from Node that has RefPtr to other nodes.
+        (JSC::NodeReleaser::adopt): Added. Used by the release function.
+        (JSC::NodeReleaser::adoptFunctionBodyNode): Added.
+
+        * parser/Nodes.h: Added declarations of releaseNodes and destructors in all classes
+        that needed it. Eliminated use of ListRefPtr and releaseNext, which are the two parts
+        of an older solution to the non-recursive destruction problem that works only for
+        lists, whereas the new solution works for other graphs. Changed ReverseBinaryOpNode
+        to use BinaryOpNode as a base class to avoid some duplicated code.
+
+2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
+        
+        wx build fixes after addition of JSCore parser and bycompiler dirs. Also cleanup
+        the JSCore Bakefile's group names to be consistent.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2008-11-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21801: REGRESSION (r37821): YUI date formatting JavaScript puts the letter 'd' in place of the day
+        <https://bugs.webkit.org/show_bug.cgi?id=21801>
+
+        Fix the constant register check in the 'typeof' optimization in
+        CodeGenerator, which was completely broken after r37821.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+
+2008-11-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22129: Move CTI::isConstant() to CodeBlock
+        <https://bugs.webkit.org/show_bug.cgi?id=22129>
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::isConstant):
+
+2008-11-07  Alp Toker  <alp@nuanti.com>
+
+        autotools fix. Always use the configured perl binary (which may be
+        different to the one in $PATH) when generating sources.
+
+        * GNUmakefile.am:
+
+2008-11-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Change grammar.cpp to Grammar.cpp and grammar.h to Grammar.h in several
+        build scripts.
+
+        * DerivedSources.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+
+2008-11-07  Alp Toker  <alp@nuanti.com>
+
+        More grammar.cpp -> Grammar.cpp build fixes.
+
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+
+2008-11-07  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the build on case-sensitive file systems. grammar.y was renamed to
+        Grammar.y but Lexer.cpp includes grammar.h. The build bots didn't
+        notice this change because of stale files.
+
+        * parser/Lexer.cpp:
+
+2008-11-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Rename the m_nextGlobal, m_nextParameter, and m_nextConstant member
+        variables of CodeGenerator to m_nextGlobalIndex, m_nextParameterIndex,
+        and m_nextConstantIndex respectively. This is to distinguish these from
+        member variables like m_lastConstant, which are actually RefPtrs to
+        Registers.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::addGlobalVar):
+        (JSC::CodeGenerator::allocateConstants):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::addParameter):
+        (JSC::CodeGenerator::addConstant):
+        * bytecompiler/CodeGenerator.h:
+
+2008-11-06  Gavin Barraclough  barraclough@apple.com
+
+        Reviewed by Oliver Hunt.
+
+        Do not make a cti_* call to perform an op_call unless either:
+        (1) The codeblock for the function body has not been generated.
+        (2) The number of arguments passed does not match the callee arity.
+
+        ~1% progression on sunspider --v8
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_call_arityCheck):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+        * kjs/nodes.h:
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move the remaining files in the kjs subdirectory of JavaScriptCore to
+        a new parser subdirectory, and remove the kjs subdirectory entirely.
+
+        * AllInOneFile.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeBlock.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/SamplingTool.h:
+        * bytecompiler/CodeGenerator.h:
+        * jsc.pro:
+        * jscore.bkl:
+        * kjs: Removed.
+        * kjs/NodeInfo.h: Removed.
+        * kjs/Parser.cpp: Removed.
+        * kjs/Parser.h: Removed.
+        * kjs/ResultType.h: Removed.
+        * kjs/SourceCode.h: Removed.
+        * kjs/SourceProvider.h: Removed.
+        * kjs/grammar.y: Removed.
+        * kjs/keywords.table: Removed.
+        * kjs/lexer.cpp: Removed.
+        * kjs/lexer.h: Removed.
+        * kjs/nodes.cpp: Removed.
+        * kjs/nodes.h: Removed.
+        * kjs/nodes2string.cpp: Removed.
+        * parser: Added.
+        * parser/Grammar.y: Copied from kjs/grammar.y.
+        * parser/Keywords.table: Copied from kjs/keywords.table.
+        * parser/Lexer.cpp: Copied from kjs/lexer.cpp.
+        * parser/Lexer.h: Copied from kjs/lexer.h.
+        * parser/NodeInfo.h: Copied from kjs/NodeInfo.h.
+        * parser/Nodes.cpp: Copied from kjs/nodes.cpp.
+        * parser/Nodes.h: Copied from kjs/nodes.h.
+        * parser/Parser.cpp: Copied from kjs/Parser.cpp.
+        * parser/Parser.h: Copied from kjs/Parser.h.
+        * parser/ResultType.h: Copied from kjs/ResultType.h.
+        * parser/SourceCode.h: Copied from kjs/SourceCode.h.
+        * parser/SourceProvider.h: Copied from kjs/SourceProvider.h.
+        * parser/nodes2string.cpp: Copied from kjs/nodes2string.cpp.
+        * pcre/pcre.pri:
+        * pcre/pcre_exec.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toNumber):
+        * runtime/RegExp.cpp:
+
+2008-11-06  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r38196
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Added bytecompiler/ to the
+        include path.
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Create a new bytecompiler subdirectory of JavaScriptCore and move some
+        relevant files to it.
+
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeGenerator.cpp: Removed.
+        * VM/CodeGenerator.h: Removed.
+        * bytecompiler: Added.
+        * bytecompiler/CodeGenerator.cpp: Copied from VM/CodeGenerator.cpp.
+        * bytecompiler/CodeGenerator.h: Copied from VM/CodeGenerator.h.
+        * bytecompiler/LabelScope.h: Copied from kjs/LabelScope.h.
+        * jscore.bkl:
+        * kjs/LabelScope.h: Removed.
+
+2008-11-06  Adam Roben  <aroben@apple.com>
+
+        Windows clean build fix after r38155
+
+        Rubberstamped by Cameron Zwarich.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Update
+        the post-build event for the move of create_hash_table out of kjs/.
+
+2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22107
+
+        Bug uncovered during RVCT port in functions not used. get_lt() and
+        get_gt() takes only one argument - remove second argument where
+        applicable.
+
+        * wtf/AVLTree.h:
+        (JSC::AVLTree::remove): Remove second argument of get_lt/get_gt().
+        (JSC::AVLTree::subst): Ditto.
+
+2008-11-06  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Cameron Zwarich.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22033
+        [GTK] CTI/Linux r38064 crashes; JIT requires executable memory
+
+        Mark pages allocated by the FastMalloc mmap code path executable with
+        PROT_EXEC. This fixes crashes seen on CPUs and kernels that enforce
+        non-executable memory (like ExecShield on Fedora Linux) when the JIT
+        is enabled.
+
+        This patch does not resolve the issue on debug builds so affected
+        developers may still need to pass --disable-jit to configure.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap):
+        (TryDevMem):
+        (TCMalloc_SystemRelease):
+
+2008-11-06  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 22099: Make the Qt port build the JSC shell in the correct place
+        <https://bugs.webkit.org/show_bug.cgi?id=22099>
+
+        Adjust include paths and build destination dir for the 'jsc' executable
+        in the Qt build.
+
+        * jsc.pro:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implemented the block allocation on Symbian through heap allocation.
+
+        Unfortunately there is no way to allocate virtual memory. The Posix
+        layer provides mmap() but no anonymous mapping. So this is a very slow
+        solution but it should work as a start.
+
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+        (JSC::freeBlock):
+
+2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Borrow some math functions from the MSVC port to the build with the
+        RVCT compiler.
+
+        * wtf/MathExtras.h:
+        (isinf):
+        (isnan):
+        (signbit):
+
+2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Include strings.h for strncasecmp().
+        This is needed for compilation inside Symbian and it is also
+        confirmed by the man-page on Linux.
+
+        * runtime/DateMath.cpp:
+
+2008-11-06  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implemented currentThreadStackBase for Symbian.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+
+2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        RVCT does not support tm_gmtoff field, so disable that code just like
+        for MSVC.
+
+        * runtime/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime):
+        (JSC::GregorianDateTime::operator tm):
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Define PLATFORM(UNIX) for S60. Effectively WebKit on S60 is compiled
+        on top of the Posix layer.
+
+        * wtf/Platform.h:
+
+2008-11-06  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added __SYMBIAN32__ condition for defining PLATFORM(SYMBIAN).
+
+        * wtf/Platform.h:
+
+2008-11-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added WINSCW compiler define for Symbian S60.
+
+        * wtf/Platform.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use the GCC defines of the WTF_ALIGN* macros for the RVCT and the
+        MINSCW compiler.
+
+        * wtf/Vector.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Define capabilities of the SYMBIAN platform. Some of the system
+        headers are actually dependent on RVCT.
+
+        * wtf/Platform.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add missing stddef.h header needed for compilation in Symbian.
+
+        * runtime/Collector.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added COMPILER(RVCT) to detect the ARM RVCT compiler used in the Symbian environment.
+
+        * wtf/Platform.h:
+
+2008-11-06  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build, adjust include paths after move of jsc.pro.
+
+        * jsc.pro:
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move kjs/Shell.cpp to the top level of the JavaScriptCore directory and
+        rename it to jsc.cpp to reflect the name of the binary compiled from it.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp: Copied from kjs/Shell.cpp.
+        * jsc.pro:
+        * jscore.bkl:
+        * kjs/Shell.cpp: Removed.
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move create_hash_table and jsc.pro out of the kjs directory and into the
+        root directory of JavaScriptCore.
+
+        * DerivedSources.make:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_hash_table: Copied from kjs/create_hash_table.
+        * jsc.pro: Copied from kjs/jsc.pro.
+        * kjs/create_hash_table: Removed.
+        * kjs/jsc.pro: Removed.
+        * make-generated-sources.sh:
+
+2008-11-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22094
+
+        Fix for bug where the callee incorrectly recieves the caller's lexical
+        global object as this, rather than its own.  Implementation closely
+        follows the spec, passing jsNull, checking in the callee and replacing
+        with the global object where necessary.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_call_eval):
+        * runtime/JSCell.h:
+        (JSC::JSValue::toThisObject):
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        * runtime/JSImmediate.h:
+
+2008-11-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after Operations.cpp move.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build for case-sensitive build systems and wxWindows.
+
+        * JavaScriptCoreSources.bkl:
+        * kjs/create_hash_table:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build for case-sensitive build systems.
+
+        * JavaScriptCoreSources.bkl:
+        * kjs/Shell.cpp:
+        * runtime/Interpreter.cpp:
+        * runtime/JSArray.cpp:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build for case-sensitive build systems.
+
+        * API/JSBase.cpp:
+        * API/JSObjectRef.cpp:
+        * runtime/CommonIdentifiers.h:
+        * runtime/Identifier.cpp:
+        * runtime/InitializeThreading.cpp:
+        * runtime/InternalFunction.h:
+        * runtime/JSString.h:
+        * runtime/Lookup.h:
+        * runtime/PropertyNameArray.h:
+        * runtime/PropertySlot.h:
+        * runtime/StructureID.cpp:
+        * runtime/StructureID.h:
+        * runtime/UString.cpp:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move more files to the runtime subdirectory of JavaScriptCore.
+
+        * API/APICast.h:
+        * API/JSBase.cpp:
+        * API/JSCallbackObject.cpp:
+        * API/JSClassRef.cpp:
+        * API/JSClassRef.h:
+        * API/JSStringRefCF.cpp:
+        * API/JSValueRef.cpp:
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        * VM/Machine.cpp:
+        * VM/RegisterFile.h:
+        * debugger/Debugger.h:
+        * kjs/SourceProvider.h:
+        * kjs/TypeInfo.h: Removed.
+        * kjs/collector.cpp: Removed.
+        * kjs/collector.h: Removed.
+        * kjs/completion.h: Removed.
+        * kjs/create_hash_table:
+        * kjs/identifier.cpp: Removed.
+        * kjs/identifier.h: Removed.
+        * kjs/interpreter.cpp: Removed.
+        * kjs/interpreter.h: Removed.
+        * kjs/lexer.cpp:
+        * kjs/lexer.h:
+        * kjs/lookup.cpp: Removed.
+        * kjs/lookup.h: Removed.
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/operations.cpp: Removed.
+        * kjs/operations.h: Removed.
+        * kjs/protect.h: Removed.
+        * kjs/regexp.cpp: Removed.
+        * kjs/regexp.h: Removed.
+        * kjs/ustring.cpp: Removed.
+        * kjs/ustring.h: Removed.
+        * pcre/pcre_exec.cpp:
+        * profiler/CallIdentifier.h:
+        * profiler/Profile.h:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ArrayPrototype.h:
+        * runtime/Collector.cpp: Copied from kjs/collector.cpp.
+        * runtime/Collector.h: Copied from kjs/collector.h.
+        * runtime/CollectorHeapIterator.h:
+        * runtime/Completion.h: Copied from kjs/completion.h.
+        * runtime/ErrorPrototype.cpp:
+        * runtime/Identifier.cpp: Copied from kjs/identifier.cpp.
+        * runtime/Identifier.h: Copied from kjs/identifier.h.
+        * runtime/InitializeThreading.cpp:
+        * runtime/Interpreter.cpp: Copied from kjs/interpreter.cpp.
+        * runtime/Interpreter.h: Copied from kjs/interpreter.h.
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSValue.h:
+        * runtime/Lookup.cpp: Copied from kjs/lookup.cpp.
+        * runtime/Lookup.h: Copied from kjs/lookup.h.
+        * runtime/MathObject.cpp:
+        * runtime/NativeErrorPrototype.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/Operations.cpp: Copied from kjs/operations.cpp.
+        * runtime/Operations.h: Copied from kjs/operations.h.
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Protect.h: Copied from kjs/protect.h.
+        * runtime/RegExp.cpp: Copied from kjs/regexp.cpp.
+        * runtime/RegExp.h: Copied from kjs/regexp.h.
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/SmallStrings.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        * runtime/StructureID.cpp:
+        * runtime/StructureID.h:
+        * runtime/StructureIDTransitionTable.h:
+        * runtime/SymbolTable.h:
+        * runtime/TypeInfo.h: Copied from kjs/TypeInfo.h.
+        * runtime/UString.cpp: Copied from kjs/ustring.cpp.
+        * runtime/UString.h: Copied from kjs/ustring.h.
+        * wrec/CharacterClassConstructor.h:
+        * wrec/WREC.h:
+
+2008-11-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+        
+        Removed two copy constructors that the compiler can generate for us
+        automatically.
+
+        * VM/LabelID.h:
+        (JSC::LabelID::setLocation):
+        (JSC::LabelID::offsetFrom):
+        (JSC::LabelID::ref):
+        (JSC::LabelID::refCount):
+        * kjs/LabelScope.h:
+
+2008-11-05  Anders Carlsson  <andersca@apple.com>
+
+        Fix Snow Leopard build.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Steve Falkenburg.
+
+        Move dtoa.cpp and dtoa.h to the WTF Visual Studio project to reflect
+        their movement in the filesystem.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move kjs/dtoa.h to the wtf subdirectory of JavaScriptCore.
+
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/dtoa.cpp: Removed.
+        * kjs/dtoa.h: Removed.
+        * wtf/dtoa.cpp: Copied from kjs/dtoa.cpp.
+        * wtf/dtoa.h: Copied from kjs/dtoa.h.
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move kjs/config.h to the top level of JavaScriptCore.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h: Copied from kjs/config.h.
+        * kjs/config.h: Removed.
+
+2008-11-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        * wtf/ThreadingNone.cpp: Tweak formatting.
+
+2008-11-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22061
+          create script to check for exit-time destructors
+
+        * JavaScriptCore.exp: Changed to export functions rather than
+        a global for the atomically initialized static mutex.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added a script
+        phase that runs the check-for-exit-time-destructors script.
+
+        * wtf/MainThread.cpp:
+        (WTF::mainThreadFunctionQueueMutex): Changed to leak an object
+        rather than using an exit time destructor.
+        (WTF::functionQueue): Ditto.
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::cachedCollatorMutex): Ditto.
+
+        * wtf/Threading.h: Changed other platforms to share the Windows
+        approach where the mutex is internal and the functions are exported.
+        * wtf/ThreadingGtk.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex): Ditto.
+        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
+        * wtf/ThreadingNone.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex): Ditto.
+        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex): Changed to leak an object rather than using
+        an exit time destructor.
+        (WTF::lockAtomicallyInitializedStaticMutex): Mutex change.
+        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
+        (WTF::threadMap): Changed to leak an object rather than using
+        an exit time destructor.
+        * wtf/ThreadingQt.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex): Mutex change.
+        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex): Added an assertion.
+
+2008-11-04  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Update
+        the location of JSStaticScopeObject.{cpp,h}.
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move AllInOneFile.cpp to the top level of JavaScriptCore.
+
+        * AllInOneFile.cpp: Copied from kjs/AllInOneFile.cpp.
+        * GNUmakefile.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp: Removed.
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Add NodeInfo.h to the JavaScriptCore Xcode project.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-11-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Move more files into the runtime subdirectory of JavaScriptCore.
+
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSClassRef.cpp:
+        * API/OpaqueJSString.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArgList.cpp: Removed.
+        * kjs/ArgList.h: Removed.
+        * kjs/Arguments.cpp: Removed.
+        * kjs/Arguments.h: Removed.
+        * kjs/BatchedTransitionOptimizer.h: Removed.
+        * kjs/CollectorHeapIterator.h: Removed.
+        * kjs/CommonIdentifiers.cpp: Removed.
+        * kjs/CommonIdentifiers.h: Removed.
+        * kjs/ExecState.cpp: Removed.
+        * kjs/ExecState.h: Removed.
+        * kjs/GetterSetter.cpp: Removed.
+        * kjs/GetterSetter.h: Removed.
+        * kjs/InitializeThreading.cpp: Removed.
+        * kjs/InitializeThreading.h: Removed.
+        * kjs/JSActivation.cpp: Removed.
+        * kjs/JSActivation.h: Removed.
+        * kjs/JSGlobalData.cpp: Removed.
+        * kjs/JSGlobalData.h: Removed.
+        * kjs/JSLock.cpp: Removed.
+        * kjs/JSLock.h: Removed.
+        * kjs/JSStaticScopeObject.cpp: Removed.
+        * kjs/JSStaticScopeObject.h: Removed.
+        * kjs/JSType.h: Removed.
+        * kjs/PropertyNameArray.cpp: Removed.
+        * kjs/PropertyNameArray.h: Removed.
+        * kjs/ScopeChain.cpp: Removed.
+        * kjs/ScopeChain.h: Removed.
+        * kjs/ScopeChainMark.h: Removed.
+        * kjs/SymbolTable.h: Removed.
+        * kjs/Tracing.d: Removed.
+        * kjs/Tracing.h: Removed.
+        * runtime/ArgList.cpp: Copied from kjs/ArgList.cpp.
+        * runtime/ArgList.h: Copied from kjs/ArgList.h.
+        * runtime/Arguments.cpp: Copied from kjs/Arguments.cpp.
+        * runtime/Arguments.h: Copied from kjs/Arguments.h.
+        * runtime/BatchedTransitionOptimizer.h: Copied from kjs/BatchedTransitionOptimizer.h.
+        * runtime/CollectorHeapIterator.h: Copied from kjs/CollectorHeapIterator.h.
+        * runtime/CommonIdentifiers.cpp: Copied from kjs/CommonIdentifiers.cpp.
+        * runtime/CommonIdentifiers.h: Copied from kjs/CommonIdentifiers.h.
+        * runtime/ExecState.cpp: Copied from kjs/ExecState.cpp.
+        * runtime/ExecState.h: Copied from kjs/ExecState.h.
+        * runtime/GetterSetter.cpp: Copied from kjs/GetterSetter.cpp.
+        * runtime/GetterSetter.h: Copied from kjs/GetterSetter.h.
+        * runtime/InitializeThreading.cpp: Copied from kjs/InitializeThreading.cpp.
+        * runtime/InitializeThreading.h: Copied from kjs/InitializeThreading.h.
+        * runtime/JSActivation.cpp: Copied from kjs/JSActivation.cpp.
+        * runtime/JSActivation.h: Copied from kjs/JSActivation.h.
+        * runtime/JSGlobalData.cpp: Copied from kjs/JSGlobalData.cpp.
+        * runtime/JSGlobalData.h: Copied from kjs/JSGlobalData.h.
+        * runtime/JSLock.cpp: Copied from kjs/JSLock.cpp.
+        * runtime/JSLock.h: Copied from kjs/JSLock.h.
+        * runtime/JSStaticScopeObject.cpp: Copied from kjs/JSStaticScopeObject.cpp.
+        * runtime/JSStaticScopeObject.h: Copied from kjs/JSStaticScopeObject.h.
+        * runtime/JSType.h: Copied from kjs/JSType.h.
+        * runtime/PropertyNameArray.cpp: Copied from kjs/PropertyNameArray.cpp.
+        * runtime/PropertyNameArray.h: Copied from kjs/PropertyNameArray.h.
+        * runtime/ScopeChain.cpp: Copied from kjs/ScopeChain.cpp.
+        * runtime/ScopeChain.h: Copied from kjs/ScopeChain.h.
+        * runtime/ScopeChainMark.h: Copied from kjs/ScopeChainMark.h.
+        * runtime/SymbolTable.h: Copied from kjs/SymbolTable.h.
+        * runtime/Tracing.d: Copied from kjs/Tracing.d.
+        * runtime/Tracing.h: Copied from kjs/Tracing.h.
+
+2008-11-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Move #define to turn on dumping StructureID statistics to StructureID.cpp so that
+        turning it on does not require a full rebuild. 
+
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        * runtime/StructureID.h:
+
+2008-11-03  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix warning when building on Darwin without JSC_MULTIPLE_THREADS
+        enabled.
+
+        * kjs/InitializeThreading.cpp:
+
+2008-11-02  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 22042: REGRESSION(r38066): ASSERTION FAILED: source in CodeBlock
+        <https://bugs.webkit.org/show_bug.cgi?id=22042>
+
+        Rename parameter name to avoid ASSERT.
+
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+
+2008-11-02  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 22035: Remove the '_' suffix on constructor parameter names for structs
+        <https://bugs.webkit.org/show_bug.cgi?id=22035>
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::JSCallbackObjectData::JSCallbackObjectData):
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        * wrec/WREC.h:
+        (JSC::Quantifier::Quantifier):
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        Rename SourceRange.h to SourceCode.h.
+
+        * API/JSBase.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.h:
+        * kjs/SourceCode.h: Copied from kjs/SourceRange.h.
+        * kjs/SourceRange.h: Removed.
+        * kjs/grammar.y:
+        * kjs/lexer.h:
+        * kjs/nodes.cpp:
+        (JSC::ForInNode::ForInNode):
+        * kjs/nodes.h:
+        (JSC::ThrowableExpressionData::setExceptionSourceCode):
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22019: Move JSC::Interpreter::shouldPrintExceptions() to WebCore::Console
+        <https://bugs.webkit.org/show_bug.cgi?id=22019>
+
+        The JSC::Interpreter::shouldPrintExceptions() function is not used at
+        all in JavaScriptCore, so it should be moved to WebCore::Console, its
+        only user.
+
+        * JavaScriptCore.exp:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove the call to Interpreter::setShouldPrintExceptions() from the
+        GlobalObject constructor in the shell. The shouldPrintExceptions()
+        information is not used anywhere in JavaScriptCore, only in WebCore.
+
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+
+2008-10-31  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix.
+
+        * wtf/Threading.h:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move more files from the kjs subdirectory of JavaScriptCore to the
+        runtime subdirectory.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/RegExpConstructor.cpp: Removed.
+        * kjs/RegExpConstructor.h: Removed.
+        * kjs/RegExpMatchesArray.h: Removed.
+        * kjs/RegExpObject.cpp: Removed.
+        * kjs/RegExpObject.h: Removed.
+        * kjs/RegExpPrototype.cpp: Removed.
+        * kjs/RegExpPrototype.h: Removed.
+        * runtime/RegExpConstructor.cpp: Copied from kjs/RegExpConstructor.cpp.
+        * runtime/RegExpConstructor.h: Copied from kjs/RegExpConstructor.h.
+        * runtime/RegExpMatchesArray.h: Copied from kjs/RegExpMatchesArray.h.
+        * runtime/RegExpObject.cpp: Copied from kjs/RegExpObject.cpp.
+        * runtime/RegExpObject.h: Copied from kjs/RegExpObject.h.
+        * runtime/RegExpPrototype.cpp: Copied from kjs/RegExpPrototype.cpp.
+        * runtime/RegExpPrototype.h: Copied from kjs/RegExpPrototype.h.
+
+2008-10-31  Mark Rowe  <mrowe@apple.com>
+
+        Revert an incorrect portion of r38034.
+
+        * profiler/ProfilerServer.mm:
+
+2008-10-31  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        Disable strict aliasing in ProfilerServer.mm as it leads to the compiler being unhappy
+        with the common Obj-C idiom self = [super init];
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Change a header guard to match our coding style.
+
+        * kjs/InitializeThreading.h:
+
+2008-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed a small bit of https://bugs.webkit.org/show_bug.cgi?id=21962
+        AST uses way too much memory
+        
+        Removed a word from StatementNode by nixing LabelStack and turning it
+        into a compile-time data structure managed by CodeGenerator.
+        
+        v8 tests and SunSpider, run by Gavin, report no change.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.order:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp:
+        * JavaScriptCoreSources.bkl: I sure hope this builds!
+        
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::newLabelScope):
+        (JSC::CodeGenerator::breakTarget):
+        (JSC::CodeGenerator::continueTarget):
+        * VM/CodeGenerator.h: Nixed the JumpContext system because it depended
+        on a LabelStack in the AST, and it was a little cumbersome on the client
+        side. Replaced with LabelScope, which tracks all break / continue
+        information in the CodeGenerator, just like we track LabelIDs and other
+        stacks of compile-time data.
+
+        * kjs/LabelScope.h: Added.
+        (JSC::LabelScope::):
+        (JSC::LabelScope::LabelScope):
+        (JSC::LabelScope::ref):
+        (JSC::LabelScope::deref):
+        (JSC::LabelScope::refCount):
+        (JSC::LabelScope::breakTarget):
+        (JSC::LabelScope::continueTarget):
+        (JSC::LabelScope::type):
+        (JSC::LabelScope::name):
+        (JSC::LabelScope::scopeDepth): Simple abstraction for holding everything
+        you might want to know about a break-able / continue-able scope.
+
+        * kjs/LabelStack.cpp: Removed.
+        * kjs/LabelStack.h: Removed.
+
+        * kjs/grammar.y: No need to push labels at parse time -- we don't store
+        LabelStacks in the AST anymore.
+
+        * kjs/nodes.cpp:
+        (JSC::DoWhileNode::emitCode):
+        (JSC::WhileNode::emitCode):
+        (JSC::ForNode::emitCode):
+        (JSC::ForInNode::emitCode):
+        (JSC::ContinueNode::emitCode):
+        (JSC::BreakNode::emitCode):
+        (JSC::SwitchNode::emitCode):
+        (JSC::LabelNode::emitCode):
+        * kjs/nodes.h:
+        (JSC::StatementNode::):
+        (JSC::LabelNode::): Use LabelScope where we used to use JumpContext.
+        Simplified a bunch of code. Touched up label-related error messages a
+        bit.
+
+        * kjs/nodes2string.cpp:
+        (JSC::LabelNode::streamTo): Updated for rename.
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22005: Move StructureIDChain into its own file
+        <https://bugs.webkit.org/show_bug.cgi?id=22005>
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * runtime/StructureID.cpp:
+        * runtime/StructureID.h:
+        * runtime/StructureIDChain.cpp: Copied from runtime/StructureID.cpp.
+        * runtime/StructureIDChain.h: Copied from runtime/StructureID.h.
+
+2008-10-31  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-10-31  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-10-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - fix storage leak seen on buildbot
+
+        Some other cleanup too. The storage leak was caused by the fact
+        that HashTraits<CallIdentifier>::needsDestruction was false, so
+        the call identifier objects didn't get deleted.
+
+        * profiler/CallIdentifier.h:
+        
+        Added a default constructor to create empty call identifiers.
+
+        Changed the normal constructor to use const UString&
+        to avoid extra copying and reference count thrash.
+        
+        Removed the explicit copy constructor definition, since it's what
+        the compiler will automatically generate. (Rule of thumb: Either
+        you need both a custom copy constructor and a custom assignment
+        operator, or neither.)
+
+        Moved the CallIdentifier hash function out of the WTF namespace;
+        there's no reason to put it there.
+
+        Changed the CallIdentifier hash function to be a struct rather than
+        a specialization of the IntHash struct template. Having it be
+        a specialization made no sense, since CallIdentifier is not an integer,
+        and did no good.
+
+        Removed explicit definition of emptyValueIsZero in the hash traits,
+        since inheriting from GenericHashTraits already makes that false.
+
+        Removed explicit definition of emptyValue, instead relying on the
+        default constructor and GenericHashTraits.
+
+        Removed explicit definition of needsDestruction, because we want it
+        to have its default value: true, not false. This fixes the leak!
+
+        Changed constructDeletedValue and isDeletedValue to use a line number
+        of numeric_limits<unsigned>::max() to indicate a value is deleted.
+        Previously this used empty strings for the empty value and null strings
+        for the deleted value, but it's more efficient to use null for both.
+
+2008-10-31  Timothy Hatcher  <timothy@apple.com>
+
+        Emit the WillExecuteStatement debugger hook before the for loop body
+        when the statement node for the body isn't a block. This allows
+        breakpoints on those statements in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22004
+
+        Reviewed by Darin Adler.
+
+        * kjs/nodes.cpp:
+        (JSC::ForNode::emitCode): Emit the WillExecuteStatement
+        debugger hook before the statement node if isn't a block.
+        Also emit the WillExecuteStatement debugger hook for the
+        loop as the first op-code.
+        (JSC::ForInNode::emitCode): Ditto.
+
+2008-10-31  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes console warnings about not having an autorelease pool.
+        Also fixes the build for Snow Leopard, by including individual
+        Foundation headers instead of Foundation.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21995
+
+        Reviewed by Oliver Hunt.
+
+        * profiler/ProfilerServer.mm:
+        (-[ProfilerServer init]): Create a NSAutoreleasePool and drain it.
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculative wxWindows build fix.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Move VM/JSPropertyNameIterator.cpp and VM/JSPropertyNameIterator.h to
+        the runtime directory.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/JSPropertyNameIterator.cpp: Removed.
+        * VM/JSPropertyNameIterator.h: Removed.
+        * runtime/JSPropertyNameIterator.cpp: Copied from VM/JSPropertyNameIterator.cpp.
+        * runtime/JSPropertyNameIterator.h: Copied from VM/JSPropertyNameIterator.h.
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculative wxWindows build fix.
+
+        * jscore.bkl:
+
+2008-10-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Jon Homeycutt.
+
+        Explicitly default to building for only the native architecture in debug and release builds.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Create a debugger directory in JavaScriptCore and move the relevant
+        files to it.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.cpp:
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        * debugger: Added.
+        * debugger/Debugger.cpp: Copied from kjs/debugger.cpp.
+        * debugger/Debugger.h: Copied from kjs/debugger.h.
+        * debugger/DebuggerCallFrame.cpp: Copied from kjs/DebuggerCallFrame.cpp.
+        * debugger/DebuggerCallFrame.h: Copied from kjs/DebuggerCallFrame.h.
+        * kjs/AllInOneFile.cpp:
+        * kjs/DebuggerCallFrame.cpp: Removed.
+        * kjs/DebuggerCallFrame.h: Removed.
+        * kjs/Parser.cpp:
+        * kjs/Parser.h:
+        * kjs/debugger.cpp: Removed.
+        * kjs/debugger.h: Removed.
+        * kjs/interpreter.cpp:
+        * kjs/nodes.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/JSGlobalObject.cpp:
+
+2008-10-30  Benjamin K. Stuhl  <bks24@cornell.edu>
+
+        gcc 4.3.3/linux-x86 generates "suggest parentheses around && within ||"
+        warnings; add some parentheses to disambiguate things. No functional
+        changes, so no tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21973
+        Add parentheses to clean up some gcc warnings
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIAlphanumeric):
+        (WTF::isASCIIHexDigit):
+
+2008-10-30  Kevin Lindeman  <klindeman@apple.com>
+
+        Adds ProfilerServer, which is a distributed notification listener
+        that allows starting and stopping the profiler remotely for use
+        in conjunction with the profiler's DTace probes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21719
+
+        Reviewed by Timothy Hatcher.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Calls startProfilerServerIfNeeded.
+        * profiler/ProfilerServer.h: Added.
+        * profiler/ProfilerServer.mm: Added.
+        (+[ProfilerServer sharedProfileServer]):
+        (-[ProfilerServer init]):
+        (-[ProfilerServer startProfiling]):
+        (-[ProfilerServer stopProfiling]):
+        (JSC::startProfilerServerIfNeeded):
+
+2008-10-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after PropertyMap and StructureID merge.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Change the JavaScriptCore Xcode project to use relative paths for the
+        PCRE source files.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-10-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich and Geoffrey Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21989
+        Merge PropertyMap and StructureID
+
+        - Move PropertyMap code into StructureID in preparation for lazily
+          creating the map on gets.
+        - Make remove with transition explicit by adding removePropertyTransition.
+        - Make the put/remove without transition explicit.
+        - Make cache invalidation part of put/remove without transition.
+
+        1% speedup on SunSpider; 0.5% speedup on v8 suite.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/identifier.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        * runtime/PropertyMap.cpp: Removed.
+        * runtime/PropertyMap.h: Removed.
+        * runtime/PropertyMapHashTable.h: Copied from runtime/PropertyMap.h.
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::StructureID::addPropertyTransition):
+        (JSC::StructureID::removePropertyTransition):
+        (JSC::StructureID::toDictionaryTransition):
+        (JSC::StructureID::changePrototypeTransition):
+        (JSC::StructureID::getterSetterTransition):
+        (JSC::StructureID::addPropertyWithoutTransition):
+        (JSC::StructureID::removePropertyWithoutTransition):
+        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
+        (JSC::StructureID::checkConsistency):
+        (JSC::StructureID::copyPropertyTable):
+        (JSC::StructureID::get):
+        (JSC::StructureID::put):
+        (JSC::StructureID::remove):
+        (JSC::StructureID::insertIntoPropertyMapHashTable):
+        (JSC::StructureID::expandPropertyMapHashTable):
+        (JSC::StructureID::createPropertyMapHashTable):
+        (JSC::StructureID::rehashPropertyMapHashTable):
+        (JSC::comparePropertyMapEntryIndices):
+        (JSC::StructureID::getEnumerablePropertyNamesInternal):
+        * runtime/StructureID.h:
+        (JSC::StructureID::propertyStorageSize):
+        (JSC::StructureID::isEmpty):
+        (JSC::StructureID::get):
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21987: CTI::putDoubleResultToJSNumberCellOrJSImmediate() hardcodes its result register
+        <https://bugs.webkit.org/show_bug.cgi?id=21987>
+
+        CTI::putDoubleResultToJSNumberCellOrJSImmediate() hardcodes its result
+        register as ecx, but it should be tempReg1, which is ecx at all of its
+        callsites.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 21985: Opcodes should use eax as their destination register whenever possible
+        <https://bugs.webkit.org/show_bug.cgi?id=21985>
+
+        Change more opcodes to use eax as the register for their final result,
+        and change calls to emitPutResult() that pass eax to rely on the default
+        value of eax.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+
+2008-10-30  Alp Toker  <alp@nuanti.com>
+
+        Build fix attempt for older gcc on the trunk-mac-intel build bot
+        (error: initializer for scalar variable requires one element).
+
+        Modify the initializer syntax slightly with an additional comma.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_post_dec):
+
+2008-10-30  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21571
+        VoidPtrPair breaks CTI on Linux
+
+        The VoidPtrPair return change made in r37457 does not work on Linux
+        since POD structs aren't passed in registers.
+
+        This patch uses a union to vectorize VoidPtrPair to a uint64_t and
+        matches Darwin/MSVC fixing CTI/WREC on Linux.
+
+        Alexey reports no measurable change in Mac performance with this fix.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_post_dec):
+        * VM/Machine.h:
+        (JSC::):
+
+2008-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Initial work to reduce cost of JSNumberCell allocation
+
+        This does the initial work needed to bring more of number
+        allocation into CTI code directly, rather than just falling
+        back onto the slow paths if we can't guarantee that a number
+        cell can be reused.
+
+        Initial implementation only used by op_negate to make sure
+        it all works.  In a negate heavy (though not dominated) test
+        it results in a 10% win in the non-reusable cell case.
+
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitAllocateNumber):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitArithIntToImmWithJump):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitUnaryOp):
+        * VM/CodeGenerator.h:
+        (JSC::CodeGenerator::emitToJSNumber):
+        (JSC::CodeGenerator::emitTypeOf):
+        (JSC::CodeGenerator::emitGetPropertyNames):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        * VM/Machine.h:
+        * kjs/ResultType.h:
+        (JSC::ResultType::isReusableNumber):
+        (JSC::ResultType::toInt):
+        * kjs/nodes.cpp:
+        (JSC::UnaryOpNode::emitCode):
+        (JSC::BinaryOpNode::emitCode):
+        (JSC::EqualNode::emitCode):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::negl_r):
+        (JSC::X86Assembler::xorpd_mr):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::JSNumberCell):
+
+2008-10-29  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6326563> Crash on launch
+
+        For Windows, export explicit functions rather than exporting data for atomicallyInitializedStaticMutex.
+        
+        Exporting data from a DLL on Windows requires specifying __declspec(dllimport) in the header used by
+        callers, but __declspec(dllexport) when defined in the DLL implementation. By instead exporting
+        the explicit lock/unlock functions, we can avoid this.
+        
+        Fixes a crash on launch, since we were previously erroneously exporting atomicallyInitializedStaticMutex as a function.
+        
+        Reviewed by Darin Adler.
+
+        * wtf/Threading.h:
+        (WTF::lockAtomicallyInitializedStaticMutex):
+        (WTF::unlockAtomicallyInitializedStaticMutex):
+        * wtf/ThreadingWin.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex):
+        (WTF::unlockAtomicallyInitializedStaticMutex):
+
+2008-10-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove direct use of PropertyMap.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertyAttributes):
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::hasCustomProperties):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::putDirect):
+        * runtime/PropertyMap.cpp:
+        (JSC::PropertyMap::get):
+        * runtime/PropertyMap.h:
+        (JSC::PropertyMap::isEmpty):
+        (JSC::PropertyMap::get):
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        * runtime/StructureID.h:
+        (JSC::StructureID::propertyStorageSize):
+        (JSC::StructureID::get):
+        (JSC::StructureID::put):
+        (JSC::StructureID::remove):
+        (JSC::StructureID::isEmpty):
+
+2008-10-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Rename and move the StructureID transition table to its own file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::addPropertyTransition):
+        * runtime/StructureID.h:
+        (JSC::StructureID::):
+        * runtime/StructureIDTransitionTable.h: Copied from runtime/StructureID.h.
+        (JSC::StructureIDTransitionTableHash::hash):
+        (JSC::StructureIDTransitionTableHash::equal):
+
+2008-10-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21958
+        Pack bits in StructureID to reduce the size of each StructureID by 2 words.
+
+        * runtime/PropertyMap.h:
+        (JSC::PropertyMap::propertyMapSize):
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics): Add additional size statistics when dumping.
+        (JSC::StructureID::StructureID):
+        * runtime/StructureID.h:
+
+2008-10-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes after addition of runtime and ImageBuffer changes.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2008-10-29  Timothy Hatcher  <timothy@apple.com>
+
+        Emit the WillExecuteStatement debugger hook before the "else" body
+        when there is no block for the "else" body. This allows breakpoints
+        on those statements in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21944
+
+        Reviewed by Maciej Stachowiak.
+
+        * kjs/nodes.cpp:
+        (JSC::IfElseNode::emitCode): Emit the WillExecuteStatement
+        debugger hook before the else node if isn't a block.
+
+2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * JavaScriptCore.exp: Export HashTable::deleteTable().
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        Fix builddir != srcdir builds after kjs -> runtime breakage. Sources
+        may now be generated in both kjs/ and runtime/.
+
+        Also sort the sources list for readability.
+
+        * GNUmakefile.am:
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Build fix attempt after kjs -> runtime rename.
+
+        * GNUmakefile.am:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Remove a duplicate includes directory.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Attempt to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - export WTF::atomicallyInitializedStaticMutex
+
+        * JavaScriptCore.exp:
+
+2008-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed CodeBlock dumping to accurately report constant register indices.
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        More Qt build fixes.
+
+        * JavaScriptCore.pri:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the Qt build, hopefully for real this time.
+
+        * JavaScriptCore.pri:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Create a runtime directory in JavaScriptCore and begin moving files to
+        it. This is the first step towards removing the kjs directory and
+        placing files in more meaningful subdirectories of JavaScriptCore.
+
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSClassRef.cpp:
+        * API/JSClassRef.h:
+        * API/JSStringRefCF.cpp:
+        * API/JSValueRef.cpp:
+        * API/OpaqueJSString.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArrayConstructor.cpp: Removed.
+        * kjs/ArrayConstructor.h: Removed.
+        * kjs/ArrayPrototype.cpp: Removed.
+        * kjs/ArrayPrototype.h: Removed.
+        * kjs/BooleanConstructor.cpp: Removed.
+        * kjs/BooleanConstructor.h: Removed.
+        * kjs/BooleanObject.cpp: Removed.
+        * kjs/BooleanObject.h: Removed.
+        * kjs/BooleanPrototype.cpp: Removed.
+        * kjs/BooleanPrototype.h: Removed.
+        * kjs/CallData.cpp: Removed.
+        * kjs/CallData.h: Removed.
+        * kjs/ClassInfo.h: Removed.
+        * kjs/ConstructData.cpp: Removed.
+        * kjs/ConstructData.h: Removed.
+        * kjs/DateConstructor.cpp: Removed.
+        * kjs/DateConstructor.h: Removed.
+        * kjs/DateInstance.cpp: Removed.
+        * kjs/DateInstance.h: Removed.
+        * kjs/DateMath.cpp: Removed.
+        * kjs/DateMath.h: Removed.
+        * kjs/DatePrototype.cpp: Removed.
+        * kjs/DatePrototype.h: Removed.
+        * kjs/Error.cpp: Removed.
+        * kjs/Error.h: Removed.
+        * kjs/ErrorConstructor.cpp: Removed.
+        * kjs/ErrorConstructor.h: Removed.
+        * kjs/ErrorInstance.cpp: Removed.
+        * kjs/ErrorInstance.h: Removed.
+        * kjs/ErrorPrototype.cpp: Removed.
+        * kjs/ErrorPrototype.h: Removed.
+        * kjs/FunctionConstructor.cpp: Removed.
+        * kjs/FunctionConstructor.h: Removed.
+        * kjs/FunctionPrototype.cpp: Removed.
+        * kjs/FunctionPrototype.h: Removed.
+        * kjs/GlobalEvalFunction.cpp: Removed.
+        * kjs/GlobalEvalFunction.h: Removed.
+        * kjs/InternalFunction.cpp: Removed.
+        * kjs/InternalFunction.h: Removed.
+        * kjs/JSArray.cpp: Removed.
+        * kjs/JSArray.h: Removed.
+        * kjs/JSCell.cpp: Removed.
+        * kjs/JSCell.h: Removed.
+        * kjs/JSFunction.cpp: Removed.
+        * kjs/JSFunction.h: Removed.
+        * kjs/JSGlobalObject.cpp: Removed.
+        * kjs/JSGlobalObject.h: Removed.
+        * kjs/JSGlobalObjectFunctions.cpp: Removed.
+        * kjs/JSGlobalObjectFunctions.h: Removed.
+        * kjs/JSImmediate.cpp: Removed.
+        * kjs/JSImmediate.h: Removed.
+        * kjs/JSNotAnObject.cpp: Removed.
+        * kjs/JSNotAnObject.h: Removed.
+        * kjs/JSNumberCell.cpp: Removed.
+        * kjs/JSNumberCell.h: Removed.
+        * kjs/JSObject.cpp: Removed.
+        * kjs/JSObject.h: Removed.
+        * kjs/JSString.cpp: Removed.
+        * kjs/JSString.h: Removed.
+        * kjs/JSValue.cpp: Removed.
+        * kjs/JSValue.h: Removed.
+        * kjs/JSVariableObject.cpp: Removed.
+        * kjs/JSVariableObject.h: Removed.
+        * kjs/JSWrapperObject.cpp: Removed.
+        * kjs/JSWrapperObject.h: Removed.
+        * kjs/MathObject.cpp: Removed.
+        * kjs/MathObject.h: Removed.
+        * kjs/NativeErrorConstructor.cpp: Removed.
+        * kjs/NativeErrorConstructor.h: Removed.
+        * kjs/NativeErrorPrototype.cpp: Removed.
+        * kjs/NativeErrorPrototype.h: Removed.
+        * kjs/NumberConstructor.cpp: Removed.
+        * kjs/NumberConstructor.h: Removed.
+        * kjs/NumberObject.cpp: Removed.
+        * kjs/NumberObject.h: Removed.
+        * kjs/NumberPrototype.cpp: Removed.
+        * kjs/NumberPrototype.h: Removed.
+        * kjs/ObjectConstructor.cpp: Removed.
+        * kjs/ObjectConstructor.h: Removed.
+        * kjs/ObjectPrototype.cpp: Removed.
+        * kjs/ObjectPrototype.h: Removed.
+        * kjs/PropertyMap.cpp: Removed.
+        * kjs/PropertyMap.h: Removed.
+        * kjs/PropertySlot.cpp: Removed.
+        * kjs/PropertySlot.h: Removed.
+        * kjs/PrototypeFunction.cpp: Removed.
+        * kjs/PrototypeFunction.h: Removed.
+        * kjs/PutPropertySlot.h: Removed.
+        * kjs/SmallStrings.cpp: Removed.
+        * kjs/SmallStrings.h: Removed.
+        * kjs/StringConstructor.cpp: Removed.
+        * kjs/StringConstructor.h: Removed.
+        * kjs/StringObject.cpp: Removed.
+        * kjs/StringObject.h: Removed.
+        * kjs/StringObjectThatMasqueradesAsUndefined.h: Removed.
+        * kjs/StringPrototype.cpp: Removed.
+        * kjs/StringPrototype.h: Removed.
+        * kjs/StructureID.cpp: Removed.
+        * kjs/StructureID.h: Removed.
+        * kjs/completion.h:
+        * kjs/interpreter.h:
+        * runtime: Added.
+        * runtime/ArrayConstructor.cpp: Copied from kjs/ArrayConstructor.cpp.
+        * runtime/ArrayConstructor.h: Copied from kjs/ArrayConstructor.h.
+        * runtime/ArrayPrototype.cpp: Copied from kjs/ArrayPrototype.cpp.
+        * runtime/ArrayPrototype.h: Copied from kjs/ArrayPrototype.h.
+        * runtime/BooleanConstructor.cpp: Copied from kjs/BooleanConstructor.cpp.
+        * runtime/BooleanConstructor.h: Copied from kjs/BooleanConstructor.h.
+        * runtime/BooleanObject.cpp: Copied from kjs/BooleanObject.cpp.
+        * runtime/BooleanObject.h: Copied from kjs/BooleanObject.h.
+        * runtime/BooleanPrototype.cpp: Copied from kjs/BooleanPrototype.cpp.
+        * runtime/BooleanPrototype.h: Copied from kjs/BooleanPrototype.h.
+        * runtime/CallData.cpp: Copied from kjs/CallData.cpp.
+        * runtime/CallData.h: Copied from kjs/CallData.h.
+        * runtime/ClassInfo.h: Copied from kjs/ClassInfo.h.
+        * runtime/ConstructData.cpp: Copied from kjs/ConstructData.cpp.
+        * runtime/ConstructData.h: Copied from kjs/ConstructData.h.
+        * runtime/DateConstructor.cpp: Copied from kjs/DateConstructor.cpp.
+        * runtime/DateConstructor.h: Copied from kjs/DateConstructor.h.
+        * runtime/DateInstance.cpp: Copied from kjs/DateInstance.cpp.
+        * runtime/DateInstance.h: Copied from kjs/DateInstance.h.
+        * runtime/DateMath.cpp: Copied from kjs/DateMath.cpp.
+        * runtime/DateMath.h: Copied from kjs/DateMath.h.
+        * runtime/DatePrototype.cpp: Copied from kjs/DatePrototype.cpp.
+        * runtime/DatePrototype.h: Copied from kjs/DatePrototype.h.
+        * runtime/Error.cpp: Copied from kjs/Error.cpp.
+        * runtime/Error.h: Copied from kjs/Error.h.
+        * runtime/ErrorConstructor.cpp: Copied from kjs/ErrorConstructor.cpp.
+        * runtime/ErrorConstructor.h: Copied from kjs/ErrorConstructor.h.
+        * runtime/ErrorInstance.cpp: Copied from kjs/ErrorInstance.cpp.
+        * runtime/ErrorInstance.h: Copied from kjs/ErrorInstance.h.
+        * runtime/ErrorPrototype.cpp: Copied from kjs/ErrorPrototype.cpp.
+        * runtime/ErrorPrototype.h: Copied from kjs/ErrorPrototype.h.
+        * runtime/FunctionConstructor.cpp: Copied from kjs/FunctionConstructor.cpp.
+        * runtime/FunctionConstructor.h: Copied from kjs/FunctionConstructor.h.
+        * runtime/FunctionPrototype.cpp: Copied from kjs/FunctionPrototype.cpp.
+        * runtime/FunctionPrototype.h: Copied from kjs/FunctionPrototype.h.
+        * runtime/GlobalEvalFunction.cpp: Copied from kjs/GlobalEvalFunction.cpp.
+        * runtime/GlobalEvalFunction.h: Copied from kjs/GlobalEvalFunction.h.
+        * runtime/InternalFunction.cpp: Copied from kjs/InternalFunction.cpp.
+        * runtime/InternalFunction.h: Copied from kjs/InternalFunction.h.
+        * runtime/JSArray.cpp: Copied from kjs/JSArray.cpp.
+        * runtime/JSArray.h: Copied from kjs/JSArray.h.
+        * runtime/JSCell.cpp: Copied from kjs/JSCell.cpp.
+        * runtime/JSCell.h: Copied from kjs/JSCell.h.
+        * runtime/JSFunction.cpp: Copied from kjs/JSFunction.cpp.
+        * runtime/JSFunction.h: Copied from kjs/JSFunction.h.
+        * runtime/JSGlobalObject.cpp: Copied from kjs/JSGlobalObject.cpp.
+        * runtime/JSGlobalObject.h: Copied from kjs/JSGlobalObject.h.
+        * runtime/JSGlobalObjectFunctions.cpp: Copied from kjs/JSGlobalObjectFunctions.cpp.
+        * runtime/JSGlobalObjectFunctions.h: Copied from kjs/JSGlobalObjectFunctions.h.
+        * runtime/JSImmediate.cpp: Copied from kjs/JSImmediate.cpp.
+        * runtime/JSImmediate.h: Copied from kjs/JSImmediate.h.
+        * runtime/JSNotAnObject.cpp: Copied from kjs/JSNotAnObject.cpp.
+        * runtime/JSNotAnObject.h: Copied from kjs/JSNotAnObject.h.
+        * runtime/JSNumberCell.cpp: Copied from kjs/JSNumberCell.cpp.
+        * runtime/JSNumberCell.h: Copied from kjs/JSNumberCell.h.
+        * runtime/JSObject.cpp: Copied from kjs/JSObject.cpp.
+        * runtime/JSObject.h: Copied from kjs/JSObject.h.
+        * runtime/JSString.cpp: Copied from kjs/JSString.cpp.
+        * runtime/JSString.h: Copied from kjs/JSString.h.
+        * runtime/JSValue.cpp: Copied from kjs/JSValue.cpp.
+        * runtime/JSValue.h: Copied from kjs/JSValue.h.
+        * runtime/JSVariableObject.cpp: Copied from kjs/JSVariableObject.cpp.
+        * runtime/JSVariableObject.h: Copied from kjs/JSVariableObject.h.
+        * runtime/JSWrapperObject.cpp: Copied from kjs/JSWrapperObject.cpp.
+        * runtime/JSWrapperObject.h: Copied from kjs/JSWrapperObject.h.
+        * runtime/MathObject.cpp: Copied from kjs/MathObject.cpp.
+        * runtime/MathObject.h: Copied from kjs/MathObject.h.
+        * runtime/NativeErrorConstructor.cpp: Copied from kjs/NativeErrorConstructor.cpp.
+        * runtime/NativeErrorConstructor.h: Copied from kjs/NativeErrorConstructor.h.
+        * runtime/NativeErrorPrototype.cpp: Copied from kjs/NativeErrorPrototype.cpp.
+        * runtime/NativeErrorPrototype.h: Copied from kjs/NativeErrorPrototype.h.
+        * runtime/NumberConstructor.cpp: Copied from kjs/NumberConstructor.cpp.
+        * runtime/NumberConstructor.h: Copied from kjs/NumberConstructor.h.
+        * runtime/NumberObject.cpp: Copied from kjs/NumberObject.cpp.
+        * runtime/NumberObject.h: Copied from kjs/NumberObject.h.
+        * runtime/NumberPrototype.cpp: Copied from kjs/NumberPrototype.cpp.
+        * runtime/NumberPrototype.h: Copied from kjs/NumberPrototype.h.
+        * runtime/ObjectConstructor.cpp: Copied from kjs/ObjectConstructor.cpp.
+        * runtime/ObjectConstructor.h: Copied from kjs/ObjectConstructor.h.
+        * runtime/ObjectPrototype.cpp: Copied from kjs/ObjectPrototype.cpp.
+        * runtime/ObjectPrototype.h: Copied from kjs/ObjectPrototype.h.
+        * runtime/PropertyMap.cpp: Copied from kjs/PropertyMap.cpp.
+        * runtime/PropertyMap.h: Copied from kjs/PropertyMap.h.
+        * runtime/PropertySlot.cpp: Copied from kjs/PropertySlot.cpp.
+        * runtime/PropertySlot.h: Copied from kjs/PropertySlot.h.
+        * runtime/PrototypeFunction.cpp: Copied from kjs/PrototypeFunction.cpp.
+        * runtime/PrototypeFunction.h: Copied from kjs/PrototypeFunction.h.
+        * runtime/PutPropertySlot.h: Copied from kjs/PutPropertySlot.h.
+        * runtime/SmallStrings.cpp: Copied from kjs/SmallStrings.cpp.
+        * runtime/SmallStrings.h: Copied from kjs/SmallStrings.h.
+        * runtime/StringConstructor.cpp: Copied from kjs/StringConstructor.cpp.
+        * runtime/StringConstructor.h: Copied from kjs/StringConstructor.h.
+        * runtime/StringObject.cpp: Copied from kjs/StringObject.cpp.
+        * runtime/StringObject.h: Copied from kjs/StringObject.h.
+        * runtime/StringObjectThatMasqueradesAsUndefined.h: Copied from kjs/StringObjectThatMasqueradesAsUndefined.h.
+        * runtime/StringPrototype.cpp: Copied from kjs/StringPrototype.cpp.
+        * runtime/StringPrototype.h: Copied from kjs/StringPrototype.h.
+        * runtime/StructureID.cpp: Copied from kjs/StructureID.cpp.
+        * runtime/StructureID.h: Copied from kjs/StructureID.h.
+
+2008-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21919
+        Sampler reports bogus time in op_enter during 3d-raytrace.js
+        
+        Fixed a bug where we would pass the incorrect Instruction* during some
+        parts of CTI codegen.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        * wtf/Platform.h:
+
+2008-10-28  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        -Removed unused includes.
+        Apparent .4% speedup in Sunspider
+
+        * kjs/JSObject.cpp:
+        * kjs/interpreter.cpp:
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        Include copyright license files in the autotools dist target.
+
+        Change suggested by Mike Hommey.
+
+        * GNUmakefile.am:
+
+2008-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Stop discarding CodeBlock samples that can't be charged to a specific
+        opcode. Instead, charge the relevant CodeBlock, and provide a footnote
+        explaining the situation.
+        
+        This will help us tell which CodeBlocks are hot, even if we can't
+        identify specific lines of code within the CodeBlocks.
+
+        * VM/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::compareScopeSampleRecords):
+        (JSC::SamplingTool::dump):
+
+        * VM/SamplingTool.h:
+        (JSC::ScopeSampleRecord::ScopeSampleRecord):
+        (JSC::ScopeSampleRecord::~ScopeSampleRecord):
+
+2008-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added a mutex around the SamplingTool's ScopeNode* map, to solve a crash
+        when sampling the v8 tests.
+
+        * VM/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        (JSC::SamplingTool::notifyOfScope):
+        * VM/SamplingTool.h: Since new ScopeNodes can be created after
+        the SamplingTools has begun sampling, reads and writes to / from the
+        map need to be synchronized. Shark says this doesn't measurably increase
+        sampling overhead.
+
+2008-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Provide a dummy value to the
+        HostCallRecord in CTI non-sampling builds, to silence compiler warning.
+
+2008-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::encodeSample): Explicitly cast bool to int, to
+        silence compiler warning.
+
+2008-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig, with Gavin Barraclough's help.
+        
+        Fixed Sampling Tool:
+            - Made CodeBlock sampling work with CTI
+            - Improved accuracy by unifying most sampling data into a single
+              32bit word, which can be written / read atomically.
+            - Split out three different #ifdefs for modularity: OPCODE_SAMPLING;
+              CODEBLOCK_SAMPLING; OPCODE_STATS.
+            - Improved reporting clarity
+            - Refactored for code clarity
+
+        * JavaScriptCore.exp: Exported another symbol.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h: Updated CTI codegen to use the unified SamplingTool interface
+        for encoding samples. (This required passing the current vPC to a lot
+        more functions, since the unified interface samples the current vPC.)
+        Added hooks for writing the current CodeBlock* on function entry and
+        after a function call, for the sake of the CodeBlock sampler. Removed
+        obsolete hook for clearing the current sample inside op_end. Also removed
+        the custom enum used to differentiate flavors of op_call, since the
+        OpcodeID enum works just as well. (This was important in an earlier
+        version of the patch, but now it's just cleanup.)
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::lineNumberForVPC):
+        * VM/CodeBlock.h: Upated for refactored #ifdefs. Changed lineNumberForVPC
+        to be robust against vPCs not recorded for exception handling, since
+        the Sampler may ask for an arbitrary vPC.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::execute):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        * VM/Machine.h:
+        (JSC::Machine::setSampler):
+        (JSC::Machine::sampler):
+        (JSC::Machine::jitCodeBuffer): Upated for refactored #ifdefs. Changed
+        Machine to use SamplingTool helper objects to record movement in and
+        out of host code. This makes samples a bit more precise.
+        
+        * VM/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * VM/Opcode.h: Upated for refactored #ifdefs. Added a little more padding,
+        to accomodate our more verbose opcode names.
+
+        * VM/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample): Only count a sample toward our total
+        if we actually record it. This solves cases where a CodeBlock will
+        claim to have been sampled many times, with reported samples that don't
+        match.
+
+        (JSC::SamplingTool::run): Read the current sample into a Sample helper
+        object, to ensure that the data doesn't change while we're analyzing it,
+        and to help decode the data. Only access the CodeBlock sampling hash
+        table if CodeBlock sampling has been enabled, so non-CodeBlock sampling
+        runs can operate with even less overhead.
+
+        (JSC::SamplingTool::dump): I reorganized this code a lot to print the
+        most important info at the top, print as a table, annotate and document
+        the stuff I didn't understand when I started, etc.
+
+        * VM/SamplingTool.h: New helper classes, described above.
+
+        * kjs/Parser.h:
+        * kjs/Shell.cpp:
+        (runWithScripts):
+        * kjs/nodes.cpp:
+        (JSC::ScopeNode::ScopeNode): Updated for new sampling APIs.
+
+        * wtf/Platform.h: Moved sampling #defines here, since our custom is to
+        put ENABLE #defines into Platform.h. Made explicit the fact that
+        CODEBLOCK_SAMPLING depends on OPCODE_SAMPLING.
+
+2008-10-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        JSC Build fix, not reviewed.
+
+        * VM/CTI.cpp: add missing include stdio.h for debug builds
+
+2008-10-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+        
+        Get rid of a bonus ASSERT when using a null string as a regexp.
+        Specifically calling: RegularExpression::match() with String::empty()
+        will hit this ASSERT.
+        Chromium hits this, but I don't know of any way to make a layout test.
+
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute):
+
+2008-10-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Suggested and rubber-stamped by Geoff Garen.
+
+        Fix a crash when opening Font Picker.
+
+        The change also hopefully fixes this bug, which I could never reproduce:
+        https://bugs.webkit.org/show_bug.cgi?id=20241
+        <rdar://problem/6290576> Safari crashes at JSValueUnprotect() when fontpicker view close
+
+        * API/JSContextRef.cpp: (JSContextGetGlobalObject): Use lexical global object instead of
+        dynamic one.
+
+2008-10-24  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove ScopeChainNode::bottom() and inline it into its only caller,
+        ScopeChainnode::globalObject().
+
+        * kjs/JSGlobalObject.h:
+        (JSC::ScopeChainNode::globalObject):
+        * kjs/ScopeChain.h:
+        (JSC::ScopeChain::bottom):
+
+2008-10-24  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21862: Create JSFunction prototype property lazily
+        <https://bugs.webkit.org/show_bug.cgi?id=21862>
+
+        This is a 1.5% speedup on SunSpider and a 1.4% speedup on the V8
+        benchmark suite, including a 3.8% speedup on Earley-Boyer.
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * kjs/nodes.cpp:
+        (JSC::FuncDeclNode::makeFunction):
+        (JSC::FuncExprNode::makeFunction):
+
+2008-10-24  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21475
+        
+        Provide support for the Geolocation API
+        
+        http://dev.w3.org/geo/api/spec-source.html
+
+        * wtf/Platform.h: ENABLE_GEOLOCATION defaults to 0
+
+2008-10-24  Darin Adler  <darin@apple.com>
+
+        - finish rolling out https://bugs.webkit.org/show_bug.cgi?id=21732
+
+        * API/APICast.h:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/ExceptionHelpers.h:
+        * VM/JSPropertyNameIterator.cpp:
+        * VM/JSPropertyNameIterator.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * VM/Register.h:
+        * kjs/ArgList.cpp:
+        * kjs/ArgList.h:
+        * kjs/Arguments.cpp:
+        * kjs/Arguments.h:
+        * kjs/ArrayConstructor.cpp:
+        * kjs/ArrayPrototype.cpp:
+        * kjs/BooleanConstructor.cpp:
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/CallData.cpp:
+        * kjs/CallData.h:
+        * kjs/ConstructData.cpp:
+        * kjs/ConstructData.h:
+        * kjs/DateConstructor.cpp:
+        * kjs/DateInstance.h:
+        * kjs/DatePrototype.cpp:
+        * kjs/DatePrototype.h:
+        * kjs/DebuggerCallFrame.cpp:
+        * kjs/DebuggerCallFrame.h:
+        * kjs/ErrorConstructor.cpp:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/FunctionPrototype.h:
+        * kjs/GetterSetter.cpp:
+        * kjs/GetterSetter.h:
+        * kjs/InternalFunction.h:
+        * kjs/JSActivation.cpp:
+        * kjs/JSActivation.h:
+        * kjs/JSArray.cpp:
+        * kjs/JSArray.h:
+        * kjs/JSCell.cpp:
+        * kjs/JSCell.h:
+        * kjs/JSFunction.cpp:
+        * kjs/JSFunction.h:
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        * kjs/JSGlobalObjectFunctions.cpp:
+        * kjs/JSGlobalObjectFunctions.h:
+        * kjs/JSImmediate.cpp:
+        * kjs/JSImmediate.h:
+        * kjs/JSNotAnObject.cpp:
+        * kjs/JSNotAnObject.h:
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h:
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSStaticScopeObject.cpp:
+        * kjs/JSStaticScopeObject.h:
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.h:
+        * kjs/JSWrapperObject.h:
+        * kjs/MathObject.cpp:
+        * kjs/MathObject.h:
+        * kjs/NativeErrorConstructor.cpp:
+        * kjs/NumberConstructor.cpp:
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.cpp:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp:
+        * kjs/ObjectConstructor.cpp:
+        * kjs/ObjectPrototype.cpp:
+        * kjs/ObjectPrototype.h:
+        * kjs/PropertyMap.h:
+        * kjs/PropertySlot.cpp:
+        * kjs/PropertySlot.h:
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpMatchesArray.h:
+        * kjs/RegExpObject.cpp:
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp:
+        * kjs/Shell.cpp:
+        * kjs/StringConstructor.cpp:
+        * kjs/StringObject.cpp:
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        * kjs/StringPrototype.cpp:
+        * kjs/StructureID.cpp:
+        * kjs/StructureID.h:
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/completion.h:
+        * kjs/grammar.y:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/nodes.h:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/protect.h:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/Profiler.cpp:
+        * profiler/Profiler.h:
+        Use JSValue* instead of JSValuePtr.
+
+2008-10-24  David Kilzer  <ddkilzer@apple.com>
+
+        Rolled out r37840.
+
+        * wtf/Platform.h:
+
+2008-10-23  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21475
+        
+        Provide support for the Geolocation API
+        
+        http://dev.w3.org/geo/api/spec-source.html
+
+        * wtf/Platform.h: ENABLE_GEOLOCATION defaults to 0
+
+2008-10-23  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 21832: Fix scripts using 'new File::Temp' for Perl 5.10
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21832>
+
+        Reviewed by Sam Weinig.
+
+        * pcre/dftables: Use imported tempfile() from File::Temp instead of
+        'new File::Temp' to make the script work with Perl 5.10.
+
+2008-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix hideous pathological case performance when looking up repatch info, bug #21727.
+
+        When repatching JIT code to optimize we look up records providing information about
+        the generated code (also used to track recsources used in linking to be later released). 
+        The lookup was being performed using a linear scan of all such records.
+
+        (1) Split up the different types of reptach information.  This means we can search them
+            separately, and in some cases should reduce their size.
+        (2) In the case of property accesses, search with a binary chop over the data.
+        (3) In the case of calls, pass a pointer to the repatch info into the relink function.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::unlinkCall):
+        (JSC::CTI::linkCall):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        (JSC::CodeBlock::derefStructureIDs):
+        * VM/CodeBlock.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::setUnlinked):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::getStructureStubInfoReturnLocation):
+        (JSC::binaryChop):
+        (JSC::CodeBlock::addCaller):
+        (JSC::CodeBlock::getStubInfo):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitResolve):
+        (JSC::CodeGenerator::emitGetById):
+        (JSC::CodeGenerator::emitPutById):
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_vm_lazyLinkCall):
+
+2008-10-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21833
+        Place JavaScript Debugger hooks under #if ENABLE(JAVASCRIPT_DEBUGGER).
+
+        * wtf/Platform.h:
+
+2008-10-23  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 21831: Fix create_hash_table for Perl 5.10
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21831>
+
+        Reviewed by Sam Weinig.
+
+        * kjs/create_hash_table: Escaped square brackets so that Perl 5.10
+        doesn't try to use @nameEntries.
+
+2008-10-23  Darin Adler  <darin@apple.com>
+
+        - roll out https://bugs.webkit.org/show_bug.cgi?id=21732
+          to remove the JSValuePtr class, to fix two problems
+
+            1) slowness under MSVC, since it doesn't handle a
+               class with a single pointer in it as efficiently
+               as a pointer
+
+            2) uninitialized pointers in Vector
+
+        * JavaScriptCore.exp: Updated.
+
+        * API/APICast.h:
+        (toRef):
+        * VM/CTI.cpp:
+        (JSC::CTI::asInteger):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::addConstant):
+        * VM/CodeGenerator.h:
+        (JSC::CodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::CodeGenerator::JSValueHashTraits::isDeletedValue):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_vm_throw):
+        Removed calls to payload functions.
+
+        * VM/Register.h:
+        (JSC::Register::Register): Removed overload for JSCell and call
+        to payload function.
+
+        * kjs/JSCell.h: Changed JSCell to derive from JSValue again.
+        Removed JSValuePtr constructor.
+        (JSC::asCell): Changed cast from reinterpret_cast to static_cast.
+
+        * kjs/JSImmediate.h: Removed JSValuePtr class. Added typedef back.
+
+        * kjs/JSValue.h:
+        (JSC::JSValue::JSValue): Added empty protected inline constructor back.
+        (JSC::JSValue::~JSValue): Same for destructor.
+        Removed == and != operator for JSValuePtr.
+
+        * kjs/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot): Chnaged argument to const JSValue*
+        and added a const_cast.
+
+        * kjs/protect.h: Removed overloads and specialization for JSValuePtr.
+
+2008-10-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Really "fix" CTI mode on windows 2k3.
+
+        This adds new methods fastMallocExecutable and fastFreeExecutable
+        to wrap allocation for cti code.  This still just makes fastMalloc
+        return executable memory all the time, which will be fixed in a
+        later patch.
+
+        However in windows debug builds all executable allocations will be
+        allocated on separate executable pages, which should resolve any
+        remaining 2k3 issues.  Conveniently the 2k3 bot will now also fail
+        if there are any fastFree vs. fastFreeExecutable errors.
+
+        * ChangeLog:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * kjs/regexp.cpp:
+        (JSC::RegExp::~RegExp):
+        * masm/X86Assembler.h:
+        (JSC::JITCodeBuffer::copy):
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocExecutable):
+        (WTF::fastFreeExecutable):
+        (WTF::TCMallocStats::fastMallocExecutable):
+        (WTF::TCMallocStats::fastFreeExecutable):
+        * wtf/FastMalloc.h:
+
+2008-10-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21294
+          Bug 21294: Devirtualize getOwnPropertySlot()
+
+        A bit over 3% faster on V8 tests.
+
+        * JavascriptCore.exp: Export leak-related functions..
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructureID): Set HasStandardGetOwnPropertySlot
+        since this class doesn't override getPropertySlot.
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructureID): Ditto.
+
+        * VM/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError): Use a structure
+        that's created just for this class instead of trying to share a single "null
+        prototype" structure.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_create_arguments_no_params): Rename
+        Arguments::ArgumentsNoParameters to Arguments::NoParameters.
+        
+        * kjs/Arguments.h: Rename the enum from Arguments::ArgumentsParameters to
+        Arguments::NoParametersType and the value from Arguments::ArgumentsNoParameters
+        to Arguments::NoParameters.
+        (JSC::Arguments::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+        (JSC::Arguments::Arguments): Added an assertion that there are no parameters.
+
+        * kjs/DatePrototype.h:
+        (JSC::DatePrototype::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructureID): Set HasStandardGetOwnPropertySlot
+        since this class doesn't override getPropertySlot.
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::createStructureID): Ditto.
+
+        * kjs/JSArray.h:
+        (JSC::JSArray::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/JSCell.h: Added declaration of fastGetOwnPropertySlot; a non-virtual
+        version that uses the structure bit to decide whether to call the virtual
+        version.
+
+        * kjs/JSFunction.h:
+        (JSC::JSFunction::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Initialize new structures; removed
+        nullProtoStructureID.
+        * kjs/JSGlobalData.h: Added new structures. Removed nullProtoStructureID.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/JSNotAnObject.h:
+        (JSC::JSNotAnObjectErrorStub::JSNotAnObjectErrorStub): Use a structure
+        that's created just for this class instead of trying to share a single "null
+        prototype" structure.
+        (JSC::JSNotAnObjectErrorStub::isNotAnObjectErrorStub): Marked this function
+        virtual for clarity and made it private since no one should call it if they
+        already have a pointer to this specific type.
+        (JSC::JSNotAnObject::JSNotAnObject): Use a structure that's created just
+        for this class instead of trying to share a single "null prototype" structure.
+        (JSC::JSNotAnObject::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/JSObject.h:
+        (JSC::JSObject::createStructureID): Added HasStandardGetOwnPropertySlot.
+        (JSC::JSObject::inlineGetOwnPropertySlot): Added. Used so we can share code
+        between getOwnPropertySlot and fastGetOwnPropertySlot.
+        (JSC::JSObject::getOwnPropertySlot): Moved so that functions are above the
+        functions that call them. Moved the guts of this function into
+        inlineGetOwnPropertySlot.
+        (JSC::JSCell::fastGetOwnPropertySlot): Added. Checks the
+        HasStandardGetOwnPropertySlot bit and if it's set, calls
+        inlineGetOwnPropertySlot, otherwise calls getOwnPropertySlot.
+        (JSC::JSObject::getPropertySlot): Changed to call fastGetOwnPropertySlot.
+        (JSC::JSValue::get): Changed to call fastGetOwnPropertySlot.
+
+        * kjs/JSWrapperObject.h: Made constructor protected to emphasize that
+        this class is only a base class and never instantiated.
+
+        * kjs/MathObject.h:
+        (JSC::MathObject::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+        * kjs/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructureID): Ditto.
+        * kjs/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructureID): Ditto.
+        * kjs/RegExpObject.h:
+        (JSC::RegExpObject::createStructureID): Ditto.
+        * kjs/StringObject.h:
+        (JSC::StringObject::createStructureID): Ditto.
+
+        * kjs/TypeInfo.h: Added HasStandardGetOwnPropertySlot flag and
+        hasStandardGetOwnPropertySlot accessor function.
+
+2008-10-22  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21803: Fuse op_jfalse with op_eq_null and op_neq_null
+        <https://bugs.webkit.org/show_bug.cgi?id=21803>
+
+        Fuse op_jfalse with op_eq_null and op_neq_null to make the new opcodes
+        op_jeq_null and op_jneq_null.
+
+        This is a 2.6% speedup on the V8 Raytrace benchmark, and strangely also
+        a 4.7% speedup on the V8 Arguments benchmark, even though it uses
+        neither of the two new opcodes.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitJumpIfTrue):
+        (JSC::CodeGenerator::emitJumpIfFalse):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        * VM/Opcode.h:
+
+2008-10-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Should not define PLATFORM(WIN,MAC,GTK) when PLATFORM(CHROMIUM) is defined
+        https://bugs.webkit.org/show_bug.cgi?id=21757
+
+        PLATFORM(CHROMIUM) implies HAVE_ACCESSIBILITY
+
+        * wtf/Platform.h:
+
+2008-10-22  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Correct opcode names in documentation.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-21  Oliver Hunt <oliver@apple.com>
+
+        RS=Maciej Stachowiak.
+
+        Force FastMalloc to make all allocated pages executable in
+        a vague hope this will allow the Win2k3 bot to be able to
+        run tests.
+
+        Filed Bug 21783: Need more granular control over allocation of executable memory
+        to cover a more granular version of this patch.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryVirtualAlloc):
+
+2008-10-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21769
+        MessagePort should be GC protected if there are messages to be delivered
+
+        * wtf/MessageQueue.h:
+        (WTF::::isEmpty): Added. Also added a warning for methods that return a snapshot of queue
+        state, thus likely to cause race conditions.
+
+2008-10-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - convert post-increment to pre-increment in a couple more places for speed
+
+        Speeds up V8 benchmarks a little on most computers. (But, strangely, slows
+        them down a little on my computer.)
+
+        * kjs/nodes.cpp:
+        (JSC::statementListEmitCode): Removed default argument, since we always want
+        to specify this explicitly.
+        (JSC::ForNode::emitCode): Tolerate ignoredResult() as the dst -- means the
+        same thing as 0.
+        (JSC::ReturnNode::emitCode): Ditto.
+        (JSC::ThrowNode::emitCode): Ditto.
+        (JSC::FunctionBodyNode::emitCode): Pass ignoredResult() so that we know we
+        don't have to compute the result of function statements.
+
+2008-10-21  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix an include of a non-public header to use "" instead of <>.
+
+        * API/JSProfilerPrivate.cpp:
+
+2008-10-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21766
+        REGRESSION: 12 JSC tests fail
+
+        The JSGlobalObject was mutating the shared nullProtoStructureID when
+        used in jsc.  Instead of using nullProtoStructureID, use a new StructureID.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+        (jscmain):
+
+2008-10-20  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove an untaken branch in CodeGenerator::emitJumpIfFalse(). This
+        function is never called with a backwards target LabelID, and there is
+        even an assertion to this effect at the top of the function body.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitJumpIfFalse):
+
+2008-10-20  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add opcode documentation for undocumented opcodes.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21683
+        Don't create intermediate StructureIDs for builtin objects
+
+        Second stage in reduce number of StructureIDs created when initializing the
+        JSGlobalObject.
+
+        - Use putDirectWithoutTransition for the remaining singleton objects to reduce
+          the number of StructureIDs create for about:blank from 132 to 73.
+
+        * kjs/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * kjs/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * kjs/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * kjs/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * kjs/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * kjs/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * kjs/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * kjs/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * kjs/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructureID):
+        * kjs/InternalFunction.cpp:
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * kjs/JSObject.h:
+        * kjs/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * kjs/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * kjs/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * kjs/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * kjs/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * kjs/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        * kjs/StructureID.h:
+        (JSC::StructureID::setPrototypeWithoutTransition):
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Fix autotools dist build target by listing recently added header
+        files only. Not reviewed.
+
+        * GNUmakefile.am:
+
+2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::tryCacheGetByID): Removed a redundant and sometimes
+        incorrect cast, which started ASSERTing after Darin's last checkin.
+
+2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Re-enable CTI, which I accidentally disabled while checking in fixes
+        to bytecode.
+
+        * wtf/Platform.h:
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Typo fix in function name: mimimum -> minimum.
+
+        * kjs/DateMath.cpp:
+        (JSC::minimumYearForDST):
+        (JSC::equivalentYearForDST):
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Mark Rowe.
+
+        Use pthread instead of GThread where possible in the GTK+ port. This
+        fixes issues with global initialisation, particularly on GTK+/Win32
+        where a late g_thread_init() will cause hangs.
+
+        * GNUmakefile.am:
+        * wtf/Platform.h:
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        * wtf/ThreadingPthreads.cpp:
+
+2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21735
+        Emit profiling instrumentation only if the Web Inspector's profiling
+        feature is enabled
+
+        22.2% speedup on empty function call benchmark.
+        2.9% speedup on v8 benchmark.
+        0.7% speedup on SunSpider.
+        
+        Lesser but similar speedups in bytecode.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases): Nixed JITed profiler hooks. Profiler
+        hooks now have their own opcodes. Added support for compiling profiler
+        hook opcodes.
+        
+        (JSC::CodeBlock::dump): Dump support for the new profiling opcodes.
+
+        * VM/CodeGenerator.h:
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct): Conditionally emit profiling hooks
+        around call and construct, at the call site. (It's easier to get things
+        right this way, if you have profiled code calling non-profiled code.
+        Also, you get a slightly more accurate profile, since you charge the full
+        cost of the call / construct operation to the callee.)
+        
+        Also, fixed a bug where construct would fetch the ".prototype" property
+        from the constructor before evaluating the arguments to the constructor,
+        incorrectly allowing an "invalid constructor" exception to short-circuit
+        argument evaluation. I encountered this bug when trying to make
+        constructor exceptions work with profiling.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval): Removed obsolete profiler hooks.
+
+        (JSC::Machine::throwException): Added a check for an exception thrown
+        within a call instruction. We didn't need this before because the call
+        instruction would check for a valid call before involing the profiler.
+        (JSC::Machine::execute): Added a didExecute hook at the end of top-level
+        function invocation, since op_ret no longer does this for us.
+
+        (JSC::Machine::privateExecute): Removed obsolete profiler hooks. Added
+        profiler opcodes. Changed some ++vPC to vPC[x] notation, since the
+        latter is better for performance, and it makes reasoning about the
+        current opcode in exception handling much simpler.
+
+        (JSC::Machine::cti_op_call_NotJSFunction): Removed obsolete profiler
+        hooks.
+
+        (JSC::Machine::cti_op_create_arguments_no_params): Added missing
+        CTI_STACK_HACK that I noticed when adding CTI_STACK_HACK to the new
+        profiler opcode functions.
+
+        (JSC::Machine::cti_op_profile_will_call):
+        (JSC::Machine::cti_op_profile_did_call): The new profiler opcode
+        functions.
+
+        (JSC::Machine::cti_op_construct_NotJSConstruct): Removed obsolete profiler
+        hooks.
+
+        * VM/Machine.h:
+        (JSC::Machine::isCallOpcode): Helper for exception handling.
+
+        * VM/Opcode.h: Declare new opcodes.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsProfiling): Added virtual interface that
+        allows WebCore to specify whether the target global object has the Web
+        Inspector's profiling feature enabled.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        * profiler/Profiler.h: Added support for invoking the profiler with
+        an arbitrary JSValue*, and not a known object. We didn't need this
+        before because the call instruction would check for a valid call before
+        involing the profiler.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - get CTI working on Windows again
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCTICall): Add an overload for functions that
+        return JSObject*.
+        * VM/CTI.h: Use JSValue* and JSObject* as return types for
+        cti_op functions. Apparently, MSVC doesn't handle returning
+        the JSValuePtr struct in a register. We'll have to look into
+        this more.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstructFast):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_vm_throw):
+        Change these functions to return pointer types, and never
+        JSValuePtr.
+        * VM/Machine.h: Ditto.
+
+2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed some recent break-age in bytecode mode.
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructureIDs): Fixed up an ASSERT caused by
+        Gavin's last checkin. This is a temporary fix so I can keep on moving.
+        I'll send email about what I think is an underlying problem soon.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Removed a redundant and sometimes
+        incorrect cast, which started ASSERTing after Darin's last checkin.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        - another similar Windows build fix
+
+        * VM/CTI.cpp: Changed return type to JSObject* instead of JSValuePtr.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * VM/CTI.cpp: Use JSValue* instead of JSValuePtr for ctiTrampoline.
+        * VM/CTI.h: Ditto.
+
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - finish https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_profiler): Use asFunction.
+        (JSC::Machine::cti_vm_lazyLinkCall): Ditto.
+        (JSC::Machine::cti_op_construct_JSConstructFast): Use asObject.
+
+        * kjs/JSCell.h: Re-sort friend classes. Eliminate inheritance from
+        JSValue. Changed cast in asCell from static_cast to reinterpret_cast.
+        Removed JSValue::getNumber(double&) and one of JSValue::getObject
+        overloads.
+
+        * kjs/JSValue.h: Made the private constructor and destructor both
+        non-virtual and also remove the definitions. This class can never
+        be instantiated or derived.
+
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Change JSValuePtr from a typedef into a class. This allows us to support
+        conversion from JSCell* to JSValuePtr even if JSCell isn't derived from
+        JSValue.
+
+        * JavaScriptCore.exp: Updated symbols that involve JSValuePtr, since
+        it's now a distinct type.
+
+        * API/APICast.h:
+        (toRef): Extract the JSValuePtr payload explicitly since we can't just
+        cast any more.
+        * VM/CTI.cpp:
+        (JSC::CTI::asInteger): Ditto.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::addConstant): Get at the payload directly.
+        (JSC::CodeGenerator::emitLoad): Added an overload of JSCell* because
+        otherwise classes derived from JSValue end up calling the bool
+        overload instead of JSValuePtr.
+        * VM/CodeGenerator.h: Ditto. Also update traits to use JSValue*
+        and the payload functions.
+
+        * VM/Register.h: Added a JSCell* overload and use of payload functions.
+
+        * kjs/JSCell.h:
+        (JSC::asCell): Use payload function.
+        (JSC::JSValue::asCell): Use JSValue* instead of JSValuePtr.
+        (JSC::JSValuePtr::JSValuePtr): Added. Constructor that takes JSCell*
+        and creates a JSValuePtr.
+
+        * kjs/JSImmediate.h: Added JSValuePtr class. Also updated makeValue
+        and makeInt to work with JSValue* and the payload function.
+
+        * kjs/JSValue.h: Added == and != operators for JSValuePtr. Put them
+        here because eventually all the JSValue functions should go here
+        except what's needed by JSImmediate. Also fix asValue to use
+        JSValue* instead of JSValuePtr.
+
+        * kjs/PropertySlot.h: Change constructor to take JSValuePtr.
+
+        * kjs/protect.h: Update gcProtect functions to work with JSCell*
+        as well as JSValuePtr. Also updated the ProtectedPtr<JSValuePtr>
+        specialization to work more directly. Also changed all the call
+        sites to use gcProtectNullTolerant.
+
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * VM/Machine.cpp:
+        (JSC::fastToUInt32): Call toUInt32SlowCase function; no longer a member
+        of JSValue.
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::toInt32): Ditto.
+        (JSC::JSNumberCell::toUInt32): Ditto.
+
+        * kjs/JSValue.cpp:
+        (JSC::toInt32SlowCase): Made a non-member function.
+        (JSC::JSValue::toInt32SlowCase): Changed to call non-member function.
+        (JSC::toUInt32SlowCase): More of the same.
+        (JSC::JSValue::toUInt32SlowCase): Ditto.
+
+        * kjs/JSValue.h: Moved static member function so they are no longer
+        member functions at all.
+
+        * VM/CTI.h: Removed forward declaration of JSValue.
+        * VM/ExceptionHelpers.h: Ditto.
+        * kjs/CallData.h: Ditto.
+        * kjs/ConstructData.h: Ditto.
+        * kjs/JSGlobalObjectFunctions.h: Ditto.
+        * kjs/PropertyMap.h: Ditto.
+        * kjs/StructureID.h: Ditto.
+        * kjs/collector.h: Ditto.
+        * kjs/completion.h: Ditto.
+
+        * kjs/grammar.y:
+        (JSC::makeBitwiseNotNode): Call new non-member toInt32 function.
+        (JSC::makeLeftShiftNode): More of the same.
+        (JSC::makeRightShiftNode): Ditto.
+
+        * kjs/protect.h: Added a specialization for ProtectedPtr<JSValuePtr>
+        so this can be used with JSValuePtr.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Tweak a little more to get closer to where we can make JSValuePtr a class.
+
+        * API/APICast.h:
+        (toJS): Change back to JSValue* here, since we're converting the
+        pointer type.
+        * VM/CTI.cpp:
+        (JSC::CTI::unlinkCall): Call asPointer.
+        * VM/CTI.h: Cast to JSValue* here, since it's a pointer cast.
+        * kjs/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame): Call noValue.
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Call noValue.
+        * kjs/JSImmediate.cpp:
+        (JSC::JSImmediate::toObject): Remove unneeded const_cast.
+        * kjs/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject): Call noValue.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix non-all-in-one build
+
+        * kjs/completion.h:
+        (JSC::Completion::Completion): Add include of JSValue.h.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix assertions I introduced with my casting changes
+
+        These were showing up as failures in the JavaScriptCore tests.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_instanceof): Remove the bogus asCell casting that
+        was at the top of the function, and instead cast at the point of use.
+        (JSC::Machine::cti_op_construct_NotJSConstruct): Moved the cast to
+        object after checking the construct type.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix non-all-in-one build
+
+        * kjs/JSGlobalObjectFunctions.h: Add include of JSImmedate.h (for now).
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix build
+
+        * kjs/interpreter.h: Include JSValue.h instead of JSImmediate.h.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        * kjs/interpreter.h: Fix include of JSImmediate.h.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix non-all-in-one build
+
+        * kjs/interpreter.h: Add include of JSImmediate.h.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix non-all-in-one build
+
+        * kjs/ConstructData.h: Add include of JSImmedate.h (for now).
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine): Use JSCell* type since MSVC seems to only allow
+        calling ~JSCell directly if it's a JSCell*.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - next step on https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Use JSValuePtr everywhere instead of JSValue*. In the future, we'll be
+        changing JSValuePtr to be a class, and then eventually renaming it
+        to JSValue once that's done.
+
+        * JavaScriptCore.exp: Update entry points, since some now take JSValue*
+        instead of const JSValue*.
+
+        * API/APICast.h:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/ExceptionHelpers.h:
+        * VM/JSPropertyNameIterator.cpp:
+        * VM/JSPropertyNameIterator.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * VM/Register.h:
+        * kjs/ArgList.cpp:
+        * kjs/ArgList.h:
+        * kjs/Arguments.cpp:
+        * kjs/Arguments.h:
+        * kjs/ArrayConstructor.cpp:
+        * kjs/ArrayPrototype.cpp:
+        * kjs/BooleanConstructor.cpp:
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/CallData.cpp:
+        * kjs/CallData.h:
+        * kjs/ConstructData.cpp:
+        * kjs/ConstructData.h:
+        * kjs/DateConstructor.cpp:
+        * kjs/DateInstance.h:
+        * kjs/DatePrototype.cpp:
+        * kjs/DebuggerCallFrame.cpp:
+        * kjs/DebuggerCallFrame.h:
+        * kjs/ErrorConstructor.cpp:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/GetterSetter.cpp:
+        * kjs/GetterSetter.h:
+        * kjs/InternalFunction.h:
+        * kjs/JSActivation.cpp:
+        * kjs/JSActivation.h:
+        * kjs/JSArray.cpp:
+        * kjs/JSArray.h:
+        * kjs/JSCell.cpp:
+        * kjs/JSCell.h:
+        * kjs/JSFunction.cpp:
+        * kjs/JSFunction.h:
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        * kjs/JSGlobalObjectFunctions.cpp:
+        * kjs/JSGlobalObjectFunctions.h:
+        * kjs/JSImmediate.cpp:
+        * kjs/JSImmediate.h:
+        * kjs/JSNotAnObject.cpp:
+        * kjs/JSNotAnObject.h:
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h:
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSStaticScopeObject.cpp:
+        * kjs/JSStaticScopeObject.h:
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.h:
+        * kjs/JSWrapperObject.h:
+        * kjs/MathObject.cpp:
+        * kjs/NativeErrorConstructor.cpp:
+        * kjs/NumberConstructor.cpp:
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.cpp:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp:
+        * kjs/ObjectConstructor.cpp:
+        * kjs/ObjectPrototype.cpp:
+        * kjs/ObjectPrototype.h:
+        * kjs/PropertyMap.h:
+        * kjs/PropertySlot.cpp:
+        * kjs/PropertySlot.h:
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpMatchesArray.h:
+        * kjs/RegExpObject.cpp:
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp:
+        * kjs/Shell.cpp:
+        * kjs/StringConstructor.cpp:
+        * kjs/StringObject.cpp:
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        * kjs/StringPrototype.cpp:
+        * kjs/StructureID.cpp:
+        * kjs/StructureID.h:
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/completion.h:
+        * kjs/grammar.y:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/nodes.h:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/protect.h:
+        * profiler/ProfileGenerator.cpp:
+        Replace JSValue* with JSValuePtr.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_eval): Removed stray parentheses from my
+        last check-in.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - first step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove casts from JSValue* to derived classes, replacing them with
+        calls to inline casting functions. These functions are also a bit
+        better than aidrect cast because they also do a runtime assertion.
+
+        Removed use of 0 as for JSValue*, changing call sites to use a
+        noValue() function instead.
+
+        Move things needed by classes derived from JSValue out of the class,
+        since the classes won't be deriving from JSValue any more soon.
+
+        I did most of these changes by changing JSValue to not be JSValue* any
+        more, then fixing a lot of the compilation problems, then rolling out
+        the JSValue change.
+
+        1.011x as fast on SunSpider (presumably due to some of the Machine.cpp changes)
+
+        * API/APICast.h: Removed unneeded forward declarations.
+
+        * API/JSCallbackObject.h: Added an asCallbackObject function for casting.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::asCallbackObject): Added.
+        (JSC::JSCallbackObject::getOwnPropertySlot): Use asObject.
+        (JSC::JSCallbackObject::call): Use noValue.
+        (JSC::JSCallbackObject::staticValueGetter): Use asCallbackObject.
+        (JSC::JSCallbackObject::staticFunctionGetter): Ditto.
+        (JSC::JSCallbackObject::callbackGetter): Ditto.
+
+        * JavaScriptCore.exp: Updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added RegExpMatchesArray.h.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::asInteger): Added. For use casting a JSValue to an integer.
+        (JSC::CTI::emitGetArg): Use asInteger.
+        (JSC::CTI::emitGetPutArg): Ditto.
+        (JSC::CTI::getConstantImmediateNumericArg): Ditto. Also use noValue.
+        (JSC::CTI::emitInitRegister): Use asInteger.
+        (JSC::CTI::getDeTaggedConstantImmediate): Ditto.
+        (JSC::CTI::compileOpCallInitializeCallFrame): Ditto.
+        (JSC::CTI::compileOpCall): Ditto.
+        (JSC::CTI::compileOpStrictEq): Ditto.
+        (JSC::CTI::privateCompileMainPass): Ditto.
+        (JSC::CTI::privateCompileGetByIdProto): Ditto.
+        (JSC::CTI::privateCompileGetByIdChain): Ditto.
+        (JSC::CTI::privateCompilePutByIdTransition): Ditto.
+        * VM/CTI.h: Rewrite the ARG-related macros to use C++ casts instead of
+        C casts and get rid of some extra parentheses. Addd declaration of
+        asInteger.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp): Use asString.
+        (JSC::CodeGenerator::emitLoad): Use noValue.
+        (JSC::CodeGenerator::findScopedProperty): Change globalObject argument
+        to JSObject* instead of JSValue*.
+        (JSC::CodeGenerator::emitResolve): Remove unneeded cast.
+        (JSC::CodeGenerator::emitGetScopedVar): Use asCell.
+        (JSC::CodeGenerator::emitPutScopedVar): Ditto.
+        * VM/CodeGenerator.h: Changed out argument of findScopedProperty.
+        Also change the JSValueMap to use PtrHash explicitly instead of
+        getting it from DefaultHash.
+
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive): Use noValue.
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next): Ditto.
+
+        * VM/Machine.cpp:
+        (JSC::fastIsNumber): Moved isImmediate check here instead of
+        checking for 0 inside Heap::isNumber. Use asCell and asNumberCell.
+        (JSC::fastToInt32): Ditto.
+        (JSC::fastToUInt32): Ditto.
+        (JSC::jsLess): Use asString.
+        (JSC::jsLessEq): Ditto.
+        (JSC::jsAdd): Ditto.
+        (JSC::jsTypeStringForValue): Use asObject.
+        (JSC::jsIsObjectType): Ditto.
+        (JSC::jsIsFunctionType): Ditto.
+        (JSC::inlineResolveBase): Use noValue.
+        (JSC::Machine::callEval): Use asString. Initialize result to
+        undefined, not 0.
+        (JSC::Machine::Machine): Remove unneeded casts to JSCell*.
+        (JSC::Machine::throwException): Use asObject.
+        (JSC::Machine::debug): Remove explicit calls to the DebuggerCallFrame
+        constructor.
+        (JSC::Machine::checkTimeout): Use noValue.
+        (JSC::cachePrototypeChain): Use asObject.
+        (JSC::Machine::tryCachePutByID): Use asCell.
+        (JSC::Machine::tryCacheGetByID): Use aCell and asObject.
+        (JSC::Machine::privateExecute): Use noValue, asCell, asObject, asString,
+        asArray, asActivation, asFunction. Changed code that creates call frames
+        for host functions to pass 0 for the function pointer -- the call frame
+        needs a JSFunction* and a host function object is not one. This was
+        caught by the assertions in the casting functions. Also remove some
+        unneeded casts in cases where two values are compared.
+        (JSC::Machine::retrieveLastCaller): Use noValue.
+        (JSC::Machine::tryCTICachePutByID): Use asCell.
+        (JSC::Machine::tryCTICacheGetByID): Use aCell and asObject.
+        (JSC::setUpThrowTrampolineReturnAddress): Added this function to restore
+        the PIC-branch-avoidance that was recently lost.
+        (JSC::Machine::cti_op_add): Use asString.
+        (JSC::Machine::cti_op_instanceof): Use asCell and asObject.
+        (JSC::Machine::cti_op_call_JSFunction): Use asFunction.
+        (JSC::Machine::cti_op_call_NotJSFunction): Changed code to pass 0 for
+        the function pointer, since we don't have a JSFunction. Use asObject.
+        (JSC::Machine::cti_op_tear_off_activation): Use asActivation.
+        (JSC::Machine::cti_op_construct_JSConstruct): Use asFunction and asObject.
+        (JSC::Machine::cti_op_construct_NotJSConstruct): use asObject.
+        (JSC::Machine::cti_op_get_by_val): Use asArray and asString.
+        (JSC::Machine::cti_op_resolve_func): Use asPointer; this helps prepare
+        us for a situation where JSValue is not a pointer.
+        (JSC::Machine::cti_op_put_by_val): Use asArray.
+        (JSC::Machine::cti_op_put_by_val_array): Ditto.
+        (JSC::Machine::cti_op_resolve_global): Use asGlobalObject.
+        (JSC::Machine::cti_op_post_inc): Change VM_CHECK_EXCEPTION_2 to
+        VM_CHECK_EXCEPTION_AT_END, since there's no observable work done after
+        that point. Also use asPointer.
+        (JSC::Machine::cti_op_resolve_with_base): Use asPointer.
+        (JSC::Machine::cti_op_post_dec): Change VM_CHECK_EXCEPTION_2 to
+        VM_CHECK_EXCEPTION_AT_END, since there's no observable work done after
+        that point. Also use asPointer.
+        (JSC::Machine::cti_op_call_eval): Use asObject, noValue, and change
+        VM_CHECK_EXCEPTION_ARG to VM_THROW_EXCEPTION_AT_END.
+        (JSC::Machine::cti_op_throw): Change return value to a JSValue*.
+        (JSC::Machine::cti_op_in): Use asObject.
+        (JSC::Machine::cti_op_switch_char): Use asString.
+        (JSC::Machine::cti_op_switch_string): Ditto.
+        (JSC::Machine::cti_op_put_getter): Use asObject.
+        (JSC::Machine::cti_op_put_setter): Ditto.
+        (JSC::Machine::cti_vm_throw): Change return value to a JSValue*.
+        Use noValue.
+        * VM/Machine.h: Change return values of both cti_op_throw and
+        cti_vm_throw to JSValue*.
+
+        * VM/Register.h: Remove nullJSValue, which is the same thing
+        as noValue(). Also removed unneeded definition of JSValue.
+
+        * kjs/ArgList.h: Removed unneeded definition of JSValue.
+
+        * kjs/Arguments.h:
+        (JSC::asArguments): Added.
+
+        * kjs/ArrayPrototype.cpp:
+        (JSC::getProperty): Use noValue.
+        (JSC::arrayProtoFuncToString): Use asArray.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncConcat): Ditto.
+        (JSC::arrayProtoFuncPop): Ditto. Also removed unneeded initialization
+        of the result, which is set in both sides of the branch.
+        (JSC::arrayProtoFuncPush): Ditto.
+        (JSC::arrayProtoFuncShift): Removed unneeded initialization
+        of the result, which is set in both sides of the branch.
+        (JSC::arrayProtoFuncSort): Use asArray.
+
+        * kjs/BooleanObject.h:
+        (JSC::asBooleanObject): Added.
+
+        * kjs/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString): Use asBooleanObject.
+        (JSC::booleanProtoFuncValueOf): Ditto.
+
+        * kjs/CallData.cpp:
+        (JSC::call): Use asObject and asFunction.
+        * kjs/ConstructData.cpp:
+        (JSC::construct): Ditto.
+
+        * kjs/DateConstructor.cpp:
+        (JSC::constructDate): Use asDateInstance.
+
+        * kjs/DateInstance.h:
+        (JSC::asDateInstance): Added.
+
+        * kjs/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString): Use asDateInstance.
+        (JSC::dateProtoFuncToUTCString): Ditto.
+        (JSC::dateProtoFuncToDateString): Ditto.
+        (JSC::dateProtoFuncToTimeString): Ditto.
+        (JSC::dateProtoFuncToLocaleString): Ditto.
+        (JSC::dateProtoFuncToLocaleDateString): Ditto.
+        (JSC::dateProtoFuncToLocaleTimeString): Ditto.
+        (JSC::dateProtoFuncValueOf): Ditto.
+        (JSC::dateProtoFuncGetTime): Ditto.
+        (JSC::dateProtoFuncGetFullYear): Ditto.
+        (JSC::dateProtoFuncGetUTCFullYear): Ditto.
+        (JSC::dateProtoFuncToGMTString): Ditto.
+        (JSC::dateProtoFuncGetMonth): Ditto.
+        (JSC::dateProtoFuncGetUTCMonth): Ditto.
+        (JSC::dateProtoFuncGetDate): Ditto.
+        (JSC::dateProtoFuncGetUTCDate): Ditto.
+        (JSC::dateProtoFuncGetDay): Ditto.
+        (JSC::dateProtoFuncGetUTCDay): Ditto.
+        (JSC::dateProtoFuncGetHours): Ditto.
+        (JSC::dateProtoFuncGetUTCHours): Ditto.
+        (JSC::dateProtoFuncGetMinutes): Ditto.
+        (JSC::dateProtoFuncGetUTCMinutes): Ditto.
+        (JSC::dateProtoFuncGetSeconds): Ditto.
+        (JSC::dateProtoFuncGetUTCSeconds): Ditto.
+        (JSC::dateProtoFuncGetMilliSeconds): Ditto.
+        (JSC::dateProtoFuncGetUTCMilliseconds): Ditto.
+        (JSC::dateProtoFuncGetTimezoneOffset): Ditto.
+        (JSC::dateProtoFuncSetTime): Ditto.
+        (JSC::setNewValueFromTimeArgs): Ditto.
+        (JSC::setNewValueFromDateArgs): Ditto.
+        (JSC::dateProtoFuncSetYear): Ditto.
+        (JSC::dateProtoFuncGetYear): Ditto.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisObject): Use asObject.
+        (JSC::DebuggerCallFrame::evaluate): Use noValue.
+        * kjs/DebuggerCallFrame.h: Added a constructor that
+        takes only a callFrame.
+
+        * kjs/ExecState.h:
+        (JSC::ExecState::clearException): Use noValue.
+
+        * kjs/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Use asFunction.
+        (JSC::functionProtoFuncApply): Use asArguments and asArray.
+
+        * kjs/GetterSetter.cpp:
+        (JSC::GetterSetter::getPrimitiveNumber): Use noValue.
+
+        * kjs/GetterSetter.h:
+        (JSC::asGetterSetter): Added.
+
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::name): Use asString.
+
+        * kjs/InternalFunction.h:
+        (JSC::asInternalFunction): Added.
+
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter): Use asActivation.
+
+        * kjs/JSActivation.h:
+        (JSC::asActivation): Added.
+
+        * kjs/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Use noValue.
+        (JSC::JSArray::deleteProperty): Ditto.
+        (JSC::JSArray::increaseVectorLength): Ditto.
+        (JSC::JSArray::setLength): Ditto.
+        (JSC::JSArray::pop): Ditto.
+        (JSC::JSArray::sort): Ditto.
+        (JSC::JSArray::compactForSorting): Ditto.
+        * kjs/JSArray.h:
+        (JSC::asArray): Added.
+
+        * kjs/JSCell.cpp:
+        (JSC::JSCell::getJSNumber): Use noValue.
+
+        * kjs/JSCell.h:
+        (JSC::asCell): Added.
+        (JSC::JSValue::asCell): Changed to not preserve const.
+        Given the wide use of JSValue* and JSCell*, it's not
+        really useful to use const.
+        (JSC::JSValue::isNumber): Use asValue.
+        (JSC::JSValue::isString): Ditto.
+        (JSC::JSValue::isGetterSetter): Ditto.
+        (JSC::JSValue::isObject): Ditto.
+        (JSC::JSValue::getNumber): Ditto.
+        (JSC::JSValue::getString): Ditto.
+        (JSC::JSValue::getObject): Ditto.
+        (JSC::JSValue::getCallData): Ditto.
+        (JSC::JSValue::getConstructData): Ditto.
+        (JSC::JSValue::getUInt32): Ditto.
+        (JSC::JSValue::getTruncatedInt32): Ditto.
+        (JSC::JSValue::getTruncatedUInt32): Ditto.
+        (JSC::JSValue::mark): Ditto.
+        (JSC::JSValue::marked): Ditto.
+        (JSC::JSValue::toPrimitive): Ditto.
+        (JSC::JSValue::getPrimitiveNumber): Ditto.
+        (JSC::JSValue::toBoolean): Ditto.
+        (JSC::JSValue::toNumber): Ditto.
+        (JSC::JSValue::toString): Ditto.
+        (JSC::JSValue::toObject): Ditto.
+        (JSC::JSValue::toThisObject): Ditto.
+        (JSC::JSValue::needsThisConversion): Ditto.
+        (JSC::JSValue::toThisString): Ditto.
+        (JSC::JSValue::getJSNumber): Ditto.
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter): Use asFunction.
+        (JSC::JSFunction::callerGetter): Ditto.
+        (JSC::JSFunction::lengthGetter): Ditto.
+        (JSC::JSFunction::construct): Use asObject.
+
+        * kjs/JSFunction.h:
+        (JSC::asFunction): Added.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::lastInPrototypeChain): Use asObject.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::asGlobalObject): Added.
+        (JSC::ScopeChainNode::globalObject): Use asGlobalObject.
+
+        * kjs/JSImmediate.h: Added noValue, asPointer, and makeValue
+        functions. Use rawValue, makeValue, and noValue consistently
+        instead of doing reinterpret_cast in various functions.
+
+        * kjs/JSNumberCell.h:
+        (JSC::asNumberCell): Added.
+        (JSC::JSValue::uncheckedGetNumber): Use asValue and asNumberCell.
+        (JSC::JSValue::toJSNumber): Use asValue.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::put): Use asObject and asGetterSetter.
+        (JSC::callDefaultValueFunction): Use noValue.
+        (JSC::JSObject::defineGetter): Use asGetterSetter.
+        (JSC::JSObject::defineSetter): Ditto.
+        (JSC::JSObject::lookupGetter): Ditto. Also use asObject.
+        (JSC::JSObject::lookupSetter): Ditto.
+        (JSC::JSObject::hasInstance): Use asObject.
+        (JSC::JSObject::fillGetterPropertySlot): Use asGetterSetter.
+
+        * kjs/JSObject.h:
+        (JSC::JSObject::getDirect): Use noValue.
+        (JSC::asObject): Added.
+        (JSC::JSValue::isObject): Use asValue.
+        (JSC::JSObject::get): Removed unneeded const_cast.
+        (JSC::JSObject::getPropertySlot): Use asObject.
+        (JSC::JSValue::get): Removed unneeded const_cast.
+        Use asValue, asCell, and asObject.
+        (JSC::JSValue::put): Ditto.
+        (JSC::JSObject::allocatePropertyStorageInline): Fixed spelling
+        of "oldPropertStorage".
+
+        * kjs/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot): Use asObject.
+
+        * kjs/JSString.h:
+        (JSC::asString): Added.
+        (JSC::JSValue::toThisJSString): Use asValue.
+
+        * kjs/JSValue.h: Make PreferredPrimitiveType a top level enum
+        instead of a member of JSValue. Added an asValue function that
+        returns this. Removed overload of asCell for const. Use asValue
+        instead of getting right at this.
+
+        * kjs/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncIsPrototypeOf): Use asObject.
+        (JSC::objectProtoFuncDefineGetter): Ditto.
+        (JSC::objectProtoFuncDefineSetter): Ditto.
+
+        * kjs/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot): Take a const JSValue* so the
+        callers don't have to worry about const.
+        (JSC::PropertySlot::clearBase): Use noValue.
+        (JSC::PropertySlot::clearValue): Ditto.
+
+        * kjs/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1): Use asRegExpConstructor.
+        (JSC::regExpConstructorDollar2): Ditto.
+        (JSC::regExpConstructorDollar3): Ditto.
+        (JSC::regExpConstructorDollar4): Ditto.
+        (JSC::regExpConstructorDollar5): Ditto.
+        (JSC::regExpConstructorDollar6): Ditto.
+        (JSC::regExpConstructorDollar7): Ditto.
+        (JSC::regExpConstructorDollar8): Ditto.
+        (JSC::regExpConstructorDollar9): Ditto.
+        (JSC::regExpConstructorInput): Ditto.
+        (JSC::regExpConstructorMultiline): Ditto.
+        (JSC::regExpConstructorLastMatch): Ditto.
+        (JSC::regExpConstructorLastParen): Ditto.
+        (JSC::regExpConstructorLeftContext): Ditto.
+        (JSC::regExpConstructorRightContext): Ditto.
+        (JSC::setRegExpConstructorInput): Ditto.
+        (JSC::setRegExpConstructorMultiline): Ditto.
+        (JSC::constructRegExp): Use asObject.
+
+        * kjs/RegExpConstructor.h:
+        (JSC::asRegExpConstructor): Added.
+
+        * kjs/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal): Use asRegExpObject.
+        (JSC::regExpObjectIgnoreCase): Ditto.
+        (JSC::regExpObjectMultiline): Ditto.
+        (JSC::regExpObjectSource): Ditto.
+        (JSC::regExpObjectLastIndex): Ditto.
+        (JSC::setRegExpObjectLastIndex): Ditto.
+        (JSC::callRegExpObject): Ditto.
+
+        * kjs/RegExpObject.h:
+        (JSC::asRegExpObject): Added.
+
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest): Use asRegExpObject.
+        (JSC::regExpProtoFuncExec): Ditto.
+        (JSC::regExpProtoFuncCompile): Ditto.
+        (JSC::regExpProtoFuncToString): Ditto.
+
+        * kjs/StringObject.h:
+        (JSC::StringObject::internalValue): Use asString.
+        (JSC::asStringObject): Added.
+
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Use asRegExpObject.
+        (JSC::stringProtoFuncToString): Ue asStringObject.
+        (JSC::stringProtoFuncMatch): Use asRegExpObject.
+        (JSC::stringProtoFuncSearch): Ditto.
+        (JSC::stringProtoFuncSplit): Ditto.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames): Use asObject.
+        (JSC::StructureID::createCachedPrototypeChain): Ditto.
+        (JSC::StructureIDChain::StructureIDChain): Use asCell and asObject.
+
+        * kjs/collector.h:
+        (JSC::Heap::isNumber): Removed null handling. This can only be called
+        on valid cells.
+        (JSC::Heap::cellBlock): Removed overload for const and non-const.
+        Whether the JSCell* is const or not really should have no effect on
+        whether you can modify the collector block it's in.
+
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::evaluate): Use noValue and noObject.
+
+        * kjs/nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitCode): Use JSObject for the global
+        object rather than JSValue.
+        (JSC::PostfixResolveNode::emitCode): Ditto.
+        (JSC::PrefixResolveNode::emitCode): Ditto.
+        (JSC::ReadModifyResolveNode::emitCode): Ditto.
+        (JSC::AssignResolveNode::emitCode): Ditto.
+
+        * kjs/operations.h:
+        (JSC::equalSlowCaseInline): Use asString, asCell, asNumberCell, 
+        (JSC::strictEqualSlowCaseInline): Ditto.
+
+2008-10-18  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21702: Special op_create_activation for the case where there are no named parameters
+        <https://bugs.webkit.org/show_bug.cgi?id=21702>
+
+        This is a 2.5% speedup on the V8 Raytrace benchmark and a 1.1% speedup
+        on the V8 Earley-Boyer benchmark.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_create_arguments_no_params):
+        * VM/Machine.h:
+        * kjs/Arguments.h:
+        (JSC::Arguments::):
+        (JSC::Arguments::Arguments):
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - in debug builds, alter the stack to avoid blowing out MallocStackLogging
+        
+        (In essence, while executing a CTI function we alter the return
+        address to jscGeneratedNativeCode so that a single consistent
+        function is on the stack instead of many random functions without
+        symbols.)
+
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::doSetReturnAddress):
+        (JSC::):
+        (JSC::StackHack::StackHack):
+        (JSC::StackHack::~StackHack):
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_profiler):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_lazyLinkCall):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstructFast):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+
+2008-10-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Optimize op_call by allowing call sites to be directly linked to callees.
+
+        For the hot path of op_call, CTI now generates a check (initially for an impossible
+        value), and the first time the call is executed we attempt to link the call directly
+        to the callee.  We can currently only do so if the arity of the caller and callee
+        match.  The (optimized) setup for the call on the hot path is linked directly to
+        the ctiCode for the callee, without indirection.
+        
+        Two forms of the slow case of the call are generated, the first will be executed the
+        first time the call is reached.  As well as this path attempting to link the call to
+        a callee, it also relinks the slow case to a second slow case, which will not continue
+        to attempt relinking the call.  (This policy could be changed in future, but for not
+        this is intended to prevent thrashing).
+
+        If a callee that the caller has been linked to is garbage collected, then the link
+        in the caller's JIt code will be reset back to a value that cannot match - to prevent
+        any false positive matches.
+
+        ~20% progression on deltablue & richards, >12% overall reduction in v8-tests
+        runtime, one or two percent progression on sunspider.
+
+        Reviewed by Oliver Hunt.
+
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitNakedCall):
+        (JSC::unreachable):
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::unlinkCall):
+        (JSC::CTI::linkCall):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        (JSC::CodeBlock::derefStructureIDs):
+        * VM/CodeBlock.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CodeBlock::addCaller):
+        (JSC::CodeBlock::removeCaller):
+        (JSC::CodeBlock::getStubInfo):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_profiler):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_lazyLinkCall):
+        (JSC::Machine::cti_op_construct_JSConstructFast):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        * VM/Machine.h:
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * kjs/JSFunction.h:
+        * kjs/nodes.h:
+        (JSC::FunctionBodyNode::):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::getDifferenceBetweenLabels):
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        - remove ASSERT that makes the leaks buildbot cry
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich
+        
+        - don't bother to do arguments tearoff when it will have no effect
+
+        ~1% on v8 raytrace
+        
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitReturn):
+
+2008-10-17  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Sam Weinig. Landed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21603
+        [GTK] Minor fixes to GOwnPtr
+
+        * wtf/GOwnPtr.cpp:
+        (WTF::GError):
+        (WTF::GList):
+        (WTF::GCond):
+        (WTF::GMutex):
+        (WTF::GPatternSpec):
+        (WTF::GDir):
+        * wtf/GOwnPtr.h:
+        (WTF::freeOwnedGPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::outPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        * wtf/Threading.h:
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - speed up transitions that resize the property storage a fair bit
+        
+        ~3% speedup on v8 RayTrace benchmark, ~1% on DeltaBlue
+
+        * VM/CTI.cpp:
+        (JSC::resizePropertyStorage): renamed from transitionObject, and reduced to just resize
+        the object's property storage with one inline call.
+        (JSC::CTI::privateCompilePutByIdTransition): Use a separate function for property storage
+        resize, but still do all the rest of the work in assembly in that case, and pass the known
+        compile-time constants of old and new size rather than structureIDs, saving a bunch of
+        redundant memory access.
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage): Just call the inline version.
+        * kjs/JSObject.h:
+        (JSC::JSObject::allocatePropertyStorageInline): Inline version of allocatePropertyStorage
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::pushl_i32): Add code to assmeble push of a constant; code originally by Cameron Zwarich.
+
+2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove some C style casts.
+
+        * masm/X86Assembler.h:
+        (JSC::JITCodeBuffer::putIntUnchecked):
+        (JSC::X86Assembler::link):
+        (JSC::X86Assembler::linkAbsoluteAddress):
+        (JSC::X86Assembler::getRelocatedAddress):
+
+2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Remove some C style casts.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        * VM/Machine.cpp:
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_fail):
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - Avoid restoring the caller's 'r' value in op_ret
+        https://bugs.webkit.org/show_bug.cgi?id=21319
+
+        This patch stops writing the call frame at call and return points;
+        instead it does so immediately before any CTI call.
+        
+        0.5% speedup or so on the v8 benchmark
+               
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+
+2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make WREC require CTI because it won't actually compile otherwise.
+
+        * wtf/Platform.h:
+
+2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - fixed <rdar://problem/5806316> JavaScriptCore should not force building with gcc 4.0
+        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
+
+        This time there is no performance regression; we can avoid having
+        to use the fastcall calling convention for CTI functions by using
+        varargs to prevent the compiler from moving things around on the
+        stack.
+        
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        * VM/Machine.h:
+        * wtf/Platform.h:
+
+2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix for REGRESSION: r37631 causing crashes on buildbot
+        https://bugs.webkit.org/show_bug.cgi?id=21682
+        
+        * kjs/collector.cpp:
+        (JSC::Heap::collect): Avoid crashing when a GC occurs while no global objects are live.
+
+2008-10-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21683
+        Don't create intermediate StructureIDs for builtin objects
+
+        First step in reduce number of StructureIDs created when initializing the
+        JSGlobalObject.
+
+        - In order to avoid creating the intermediate StructureIDs use the new putDirectWithoutTransition
+          and putDirectFunctionWithoutTransition to add properties to JSObjects without transitioning
+          the StructureID.  This patch just implements this strategy for ObjectPrototype but alone
+          reduces the number of StructureIDs create for about:blank by 10, from 142 to 132.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * kjs/JSObject.h:
+        (JSC::JSObject::putDirectWithoutTransition):
+        * kjs/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * kjs/ObjectPrototype.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::addPropertyWithoutTransition):
+        * kjs/StructureID.h:
+
+2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix for: REGRESSION: over 100 StructureIDs leak loading about:blank (result of fix for bug 21633)
+        
+        Apparent slight progression (< 0.5%) on v8 benchmarks and SunSpider.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::~StructureID): Don't deref this object's parent's pointer to
+        itself from the destructor; that doesn't even make sense.
+        (JSC::StructureID::addPropertyTransition): Don't refer the single transition;
+        the rule is that parent StructureIDs are ref'd but child ones are not. Refing
+        the child creates a cycle.
+
+2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21609
+        Make MessagePorts protect their peers across heaps
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markCrossHeapDependentObjects):
+        * kjs/JSGlobalObject.h:
+        * kjs/collector.cpp:
+        (JSC::Heap::collect):
+        Before GC sweep phase, a function supplied by global object is now called for all global
+        objects in the heap, making it possible to implement cross-heap dependencies.
+
+2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21610
+        run-webkit-threads --threaded crashes in StructureID destructor
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        Protect access to a static (debug-only) HashSet with a lock.
+
+2008-10-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Goeffrey Garen.
+
+        Add function to dump statistics for StructureIDs.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        * kjs/StructureID.h:
+
+2008-10-15  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21633: Avoid using a HashMap when there is only a single transition
+        <https://bugs.webkit.org/show_bug.cgi?id=21633>
+
+        This is a 0.8% speedup on SunSpider and between a 0.5% and 1.0% speedup
+        on the V8 benchmark suite, depending on which harness we use. It will
+        also slightly reduce the memory footprint of a StructureID.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        * kjs/StructureID.h:
+        (JSC::StructureID::):
+
+2008-10-15  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        1.40% speedup on SunSpider, 1.44% speedup on V8. (Linux)
+        
+        No change on Mac.
+
+        * VM/Machine.cpp:
+        (JSC::fastIsNumber): ALWAYS_INLINE modifier added.
+
+2008-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21345
+        Start the debugger without reloading the inspected page
+
+        * JavaScriptCore.exp: New symbols.
+        * JavaScriptCore.xcodeproj/project.pbxproj: New files.
+
+        * VM/CodeBlock.h:
+        (JSC::EvalCodeCache::get): Updated for tweak to parsing API.
+
+        * kjs/CollectorHeapIterator.h: Added. An iterator for the object heap,
+        which we use to find all the live functions and recompile them.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Updated for tweak to parsing API.
+
+        * kjs/FunctionConstructor.cpp:
+        (JSC::constructFunction): Updated for tweak to parsing API.
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Try to validate our SourceCode in debug
+        builds by ASSERTing that it's syntactically valid. This doesn't catch
+        all SourceCode bugs, but it catches a lot of them.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval): Updated for tweak to parsing API.
+
+        * kjs/Parser.cpp:
+        (JSC::Parser::parse):
+        * kjs/Parser.h:
+        (JSC::Parser::parse): Tweaked the parser to make it possible to parse
+        without an ExecState, and to allow the client to specify a debugger to
+        notify (or not) about the source we parse. This allows the inspector
+        to recompile even though no JavaScript is executing, then notify the
+        debugger about all source code when it's done.
+
+        * kjs/Shell.cpp:
+        (prettyPrintScript): Updated for tweak to parsing API.
+
+        * kjs/SourceRange.h:
+        (JSC::SourceCode::isNull): Added to help with ASSERTs.
+
+        * kjs/collector.cpp:
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::sweep):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * kjs/collector.h:
+        (JSC::): Moved a bunch of declarations around to enable compilation of
+        CollectorHeapIterator.
+
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::checkSyntax):
+        (JSC::Interpreter::evaluate): Updated for tweak to parsing API.
+
+        * kjs/lexer.h:
+        (JSC::Lexer::sourceCode): BUG FIX: Calculate SourceCode ranges relative
+        to the SourceCode range in which we're lexing, otherwise nested functions
+        that are compiled individually get SourceCode ranges that don't reflect
+        their nesting.
+
+        * kjs/nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        (JSC::FunctionBodyNode::create):
+        (JSC::FunctionBodyNode::copyParameters):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::setSource):
+        (JSC::FunctionBodyNode::parameterCount): Added some helper functions for
+        copying one FunctionBodyNode's parameters to another. The recompiler uses
+        these when calling "finishParsing".
+
+2008-10-15  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        - part of https://bugs.webkit.org/show_bug.cgi?id=20746
+          Fix compilation on Windows CE.
+
+        str(n)icmp, strdup and vsnprintf are not available on Windows CE,
+        they are called _str(n)icmp, etc. instead
+
+        * wtf/StringExtras.h: Added inline function implementations.
+
+2008-10-15  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Cameron Zwarich.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=20912>
+        Use simple uint32_t multiplication on op_mul if both operands are
+        immediate number and they are between zero and 0x7FFF.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Make pan scrolling a platform configurable option.
+        https://bugs.webkit.org/show_bug.cgi?id=21515
+
+        * wtf/Platform.h: Add ENABLE_PAN_SCROLLING
+
+2008-10-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Sam Weinig.
+        
+        - revert r37572 and r37581 for now
+        
+        Turns out GCC 4.2 is still a (small) regression, we'll have to do
+        more work to turn it on.
+
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
+        * wtf/Platform.h:
+
+2008-10-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20256
+        Array.push and other standard methods disappear
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        Don't use static hash tables even on platforms that don't enable JSC_MULTIPLE_THREADS -
+        these tables reference IdentifierTable, which is always per-GlobalData.
+
+2008-10-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - always use CTI_ARGUMENTS and CTI_ARGUMENTS_FASTCALL
+        
+        This is a small regression for GCC 4.0, but simplifies the code
+        for future improvements and lets us focus on GCC 4.2+ and MSVC.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
+        * wtf/Platform.h:
+
+2008-10-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - make Machine::getArgumentsData an Arguments method and inline it
+        
+        ~2% on v8 raytrace
+
+        * VM/Machine.cpp:
+        * kjs/Arguments.h:
+        (JSC::Machine::getArgumentsData):
+
+2008-10-13  Alp Toker  <alp@nuanti.com>
+
+        Fix autotools dist build target by listing recently added header
+        files only. Not reviewed.
+
+        * GNUmakefile.am:
+
+2008-10-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Mark Rowe.
+        
+        - fixed <rdar://problem/5806316> JavaScriptCore should not force building with gcc 4.0
+        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
+
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-10-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21541: Move RegisterFile growth check to callee
+        <https://bugs.webkit.org/show_bug.cgi?id=21541>
+
+        Move the RegisterFile growth check to the callee in the common case,
+        where some of the information is known statically at JIT time. There is
+        still a check in the caller in the case where the caller provides too
+        few arguments.
+
+        This is a 2.1% speedup on the V8 benchmark, including a 5.1% speedup on
+        the Richards benchmark, a 4.1% speedup on the DeltaBlue benchmark, and a
+        1.4% speedup on the Earley-Boyer benchmark. It is also a 0.5% speedup on
+        SunSpider.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompile):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+        * VM/RegisterFile.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpl_mr):
+        (JSC::X86Assembler::emitUnlinkedJg):
+
+2008-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21577
+        5 false positive StructureID leaks
+
+        - Add leak ignore set to StructureID to selectively ignore leaking some StructureIDs.
+        - Add create method to JSGlolalData to be used when the data will be intentionally
+          leaked and ignore all leaks caused the StructureIDs stored in it.
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createLeaked):
+        * kjs/JSGlobalData.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        (JSC::StructureID::startIgnoringLeaks):
+        (JSC::StructureID::stopIgnoringLeaks):
+        * kjs/StructureID.h:
+
+2008-10-13  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Darin Adler. Landed by Jan Alonzo.
+
+        WebKit GTK Port needs a smartpointer to handle g_free (GFreePtr?)
+        http://bugs.webkit.org/show_bug.cgi?id=20483
+
+        Add a GOwnPtr smart pointer (similar to OwnPtr) to handle memory
+        allocated by GLib and start the conversion to use it.
+
+        * GNUmakefile.am:
+        * wtf/GOwnPtr.cpp: Added.
+        (WTF::GError):
+        (WTF::GList):
+        (WTF::GCond):
+        (WTF::GMutex):
+        (WTF::GPatternSpec):
+        (WTF::GDir):
+        * wtf/GOwnPtr.h: Added.
+        (WTF::freeOwnedPtr):
+        (WTF::GOwnPtr::GOwnPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::get):
+        (WTF::GOwnPtr::release):
+        (WTF::GOwnPtr::rawPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        (WTF::GOwnPtr::operator*):
+        (WTF::GOwnPtr::operator->):
+        (WTF::GOwnPtr::operator!):
+        (WTF::GOwnPtr::operator UnspecifiedBoolType):
+        (WTF::GOwnPtr::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        (WTF::Mutex::~Mutex):
+        (WTF::Mutex::lock):
+        (WTF::Mutex::tryLock):
+        (WTF::Mutex::unlock):
+        (WTF::ThreadCondition::~ThreadCondition):
+        (WTF::ThreadCondition::wait):
+        (WTF::ThreadCondition::timedWait):
+        (WTF::ThreadCondition::signal):
+        (WTF::ThreadCondition::broadcast):
+
+2008-10-12  Gabriella Toth  <gtoth@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        - part of https://bugs.webkit.org/show_bug.cgi?id=21055
+          Bug 21055: not invoked functions
+
+        * kjs/nodes.cpp: Deleted a function that is not invoked:
+        statementListInitializeVariableAccessStack.
+
+2008-10-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/unicode/icu/UnicodeIcu.h: Fixed indentation to match WebKit coding style.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+2008-10-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21556
+          Bug 21556: non-ASCII digits are allowed in places where only ASCII should be
+
+        * wtf/unicode/icu/UnicodeIcu.h: Removed isDigit, digitValue, and isFormatChar.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+2008-10-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make the append method that takes a Vector more strict - it now requires the elements 
+        of the vector to be appended same type as the elements of the Vector they're being appended to.
+        
+        This would cause problems when dealing with Vectors containing other Vectors.
+        
+        * wtf/Vector.h:
+        (WTF::::append):
+
+2008-10-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Clean up RegExpMatchesArray.h to match our coding style.
+
+        * kjs/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::getPropertyNames):
+
+2008-10-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 21525: 55 StructureID leaks on Wikitravel's main page
+        <https://bugs.webkit.org/show_bug.cgi?id=21525>
+
+        Bug 21533: Simple JavaScript code leaks StructureIDs
+        <https://bugs.webkit.org/show_bug.cgi?id=21533>
+
+        StructureID::getEnumerablePropertyNames() ends up calling back to itself
+        via JSObject::getPropertyNames(), which causes the PropertyNameArray to
+        be cached twice. This leads to a memory leak in almost every use of
+        JSObject::getPropertyNames() on an object. The fix here is based on a
+        suggestion of Sam Weinig.
+
+        This patch also fixes every StructureID leaks that occurs while running
+        the Mozilla MemBuster test.
+
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::setCacheable):
+        (JSC::PropertyNameArray::cacheable):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+
+2008-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Use fastcall calling convention on GCC > 4.0
+
+        Results in a 2-3% improvement in GCC 4.2 performance, so
+        that it is no longer a regression vs. GCC 4.0
+
+        * VM/CTI.cpp:
+        * VM/Machine.h:
+        * wtf/Platform.h:
+
+2008-10-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        - Add a workaround for a bug in ceil in Darwin libc.
+        - Remove old workarounds for JS math functions that are not needed
+          anymore.
+
+        The math functions are heavily tested by fast/js/math.html.
+
+        * kjs/MathObject.cpp:
+        (JSC::mathProtoFuncAbs): Remove workaround.
+        (JSC::mathProtoFuncCeil): Ditto.
+        (JSC::mathProtoFuncFloor): Ditto.
+        * wtf/MathExtras.h:
+        (wtf_ceil): Add ceil workaround for darwin.
+
+2008-10-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler
+
+        Add Assertions to JSObject constructor.
+
+        * kjs/JSObject.h:
+        (JSC::JSObject::JSObject):
+
+2008-10-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Remove now unused m_getterSetterFlag variable from PropertyMap.
+
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::operator=):
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMap::PropertyMap):
+
+2008-10-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add leaks checking to StructureID.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+
+2008-10-09  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20760
+        Implement support for x86 Linux in CTI
+
+        Prepare to enable CTI/WREC on supported architectures.
+
+        Make it possible to use the CTI_ARGUMENT workaround with GCC as well
+        as MSVC by fixing some preprocessor conditionals.
+
+        Note that CTI/WREC no longer requires CTI_ARGUMENT on Linux so we
+        don't actually enable it except when building with MSVC. GCC on Win32
+        remains untested.
+
+        Adapt inline ASM code to use the global symbol underscore prefix only
+        on Darwin and to call the properly mangled Machine::cti_vm_throw
+        symbol name depending on CTI_ARGUMENT.
+
+        Also avoid global inclusion of the JIT infrastructure headers
+        throughout WebCore and WebKit causing recompilation of about ~1500
+        source files after modification to X86Assembler.h, CTI.h, WREC.h,
+        which are only used deep inside JavaScriptCore.
+
+        * GNUmakefile.am:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * kjs/regexp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::match):
+        * kjs/regexp.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitConvertToFastCall):
+        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+
+2008-10-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for bug #21160, x=0;1/(x*-1) == -Infinity
+
+        * ChangeLog:
+        * VM/CTI.cpp:
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::emitUnlinkedJs):
+
+2008-10-09  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21459: REGRESSION (r37324): Safari crashes inside JavaScriptCore while browsing hulu.com
+        <https://bugs.webkit.org/show_bug.cgi?id=21459>
+
+        After r37324, an Arguments object does not mark an associated activation
+        object. This change was made because Arguments no longer directly used
+        the activation object in any way. However, if an activation is torn off,
+        then the backing store of Arguments becomes the register array of the
+        activation object. Arguments directly marks all of the arguments, but
+        the activation object is being collected, which causes its register
+        array to be freed and new memory to be allocated in its place.
+
+        Unfortunately, it does not seem possible to reproduce this issue in a
+        layout test.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::mark):
+        * kjs/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
+
+2008-10-09  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Build fix for MinGW.
+
+        * wtf/AlwaysInline.h:
+
+2008-10-08  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21497: REGRESSION (r37433): Bytecode JSC tests are severely broken
+        <https://bugs.webkit.org/show_bug.cgi?id=21497>
+
+        Fix a typo in r37433 that causes the failure of a large number of JSC
+        tests with the bytecode interpreter enabled.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-08  Mark Rowe  <mrowe@apple.com>
+
+        Windows build fix.
+
+        * VM/CTI.cpp:
+        (JSC::): Update type of argument to ctiTrampoline.
+
+2008-10-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21403
+          Bug 21403: use new CallFrame class rather than Register* for call frame manipulation
+
+        Add CallFrame as a synonym for ExecState. Arguably, some day we should switch every
+        client over to the new name.
+
+        Use CallFrame* consistently rather than Register* or ExecState* in low-level code such
+        as Machine.cpp and CTI.cpp. Similarly, use callFrame rather than r as its name and use
+        accessor functions to get at things in the frame.
+
+        Eliminate other uses of ExecState* that aren't needed, replacing in some cases with
+        JSGlobalData* and in other cases eliminating them entirely.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * VM/CTI.cpp:
+        (JSC::CTI::getConstant):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+        (JSC::CodeGenerator::emitLoad):
+        (JSC::CodeGenerator::emitUnexpectedLoad):
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::Machine::resolve):
+        (JSC::Machine::resolveSkip):
+        (JSC::Machine::resolveGlobal):
+        (JSC::inlineResolveBase):
+        (JSC::Machine::resolveBase):
+        (JSC::Machine::resolveBaseAndProperty):
+        (JSC::Machine::resolveBaseAndFunc):
+        (JSC::Machine::slideRegisterWindowForCall):
+        (JSC::isNotObject):
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::throwException):
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
+        (JSC::Machine::execute):
+        (JSC::Machine::debug):
+        (JSC::Machine::createExceptionScope):
+        (JSC::cachePrototypeChain):
+        (JSC::Machine::tryCachePutByID):
+        (JSC::Machine::tryCacheGetByID):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::retrieveCaller):
+        (JSC::Machine::retrieveLastCaller):
+        (JSC::Machine::findFunctionCallFrame):
+        (JSC::Machine::getArgumentsData):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::getCTIArrayLengthTrampoline):
+        (JSC::Machine::getCTIStringLengthTrampoline):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/RegisterFile.h:
+        * kjs/Arguments.h:
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::type):
+        (JSC::DebuggerCallFrame::thisObject):
+        (JSC::DebuggerCallFrame::evaluate):
+        * kjs/DebuggerCallFrame.h:
+        * kjs/ExecState.cpp:
+        (JSC::CallFrame::thisValue):
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * kjs/JSVariableObject.h:
+        * kjs/Parser.cpp:
+        (JSC::Parser::parse):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * kjs/Shell.cpp:
+        (prettyPrintScript):
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * kjs/identifier.cpp:
+        (JSC::Identifier::checkSameIdentifierTable):
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::checkSyntax):
+        (JSC::Interpreter::evaluate):
+        * kjs/nodes.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError):
+        (JSC::RegExpNode::emitCode):
+        (JSC::ArrayNode::emitCode):
+        (JSC::InstanceOfNode::emitCode):
+        * kjs/nodes.h:
+        * kjs/regexp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * kjs/regexp.h:
+        * profiler/HeavyProfile.h:
+        * profiler/Profile.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+
+2008-10-08  Mark Rowe  <mrowe@apple.com>
+
+        Typed by Maciej Stachowiak, reviewed by Mark Rowe.
+
+        Fix crash in fast/js/constant-folding.html with CTI disabled.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-08  Timothy Hatcher  <timothy@apple.com>
+
+        Roll out r37427 because it causes an infinite recursion loading about:blank.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21476
+
+2008-10-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21403
+          Bug 21403: use new CallFrame class rather than Register* for call frame manipulation
+
+        Add CallFrame as a synonym for ExecState. Arguably, some day we should switch every
+        client over to the new name.
+
+        Use CallFrame* consistently rather than Register* or ExecState* in low-level code such
+        as Machine.cpp and CTI.cpp. Similarly, use callFrame rather than r as its name and use
+        accessor functions to get at things in the frame.
+
+        Eliminate other uses of ExecState* that aren't needed, replacing in some cases with
+        JSGlobalData* and in other cases eliminating them entirely.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * VM/CTI.cpp:
+        (JSC::CTI::getConstant):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+        (JSC::CodeGenerator::emitLoad):
+        (JSC::CodeGenerator::emitUnexpectedLoad):
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::Machine::resolve):
+        (JSC::Machine::resolveSkip):
+        (JSC::Machine::resolveGlobal):
+        (JSC::inlineResolveBase):
+        (JSC::Machine::resolveBase):
+        (JSC::Machine::resolveBaseAndProperty):
+        (JSC::Machine::resolveBaseAndFunc):
+        (JSC::Machine::slideRegisterWindowForCall):
+        (JSC::isNotObject):
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::throwException):
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
+        (JSC::Machine::execute):
+        (JSC::Machine::debug):
+        (JSC::Machine::createExceptionScope):
+        (JSC::cachePrototypeChain):
+        (JSC::Machine::tryCachePutByID):
+        (JSC::Machine::tryCacheGetByID):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::retrieveCaller):
+        (JSC::Machine::retrieveLastCaller):
+        (JSC::Machine::findFunctionCallFrame):
+        (JSC::Machine::getArgumentsData):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::getCTIArrayLengthTrampoline):
+        (JSC::Machine::getCTIStringLengthTrampoline):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/RegisterFile.h:
+        * kjs/Arguments.h:
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::type):
+        (JSC::DebuggerCallFrame::thisObject):
+        (JSC::DebuggerCallFrame::evaluate):
+        * kjs/DebuggerCallFrame.h:
+        * kjs/ExecState.cpp:
+        (JSC::CallFrame::thisValue):
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * kjs/JSVariableObject.h:
+        * kjs/Parser.cpp:
+        (JSC::Parser::parse):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * kjs/Shell.cpp:
+        (prettyPrintScript):
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * kjs/identifier.cpp:
+        (JSC::Identifier::checkSameIdentifierTable):
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::checkSyntax):
+        (JSC::Interpreter::evaluate):
+        * kjs/nodes.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError):
+        (JSC::RegExpNode::emitCode):
+        (JSC::ArrayNode::emitCode):
+        (JSC::InstanceOfNode::emitCode):
+        * kjs/nodes.h:
+        * kjs/regexp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * kjs/regexp.h:
+        * profiler/HeavyProfile.h:
+        * profiler/Profile.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+
+2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Oliver Hunt.
+
+        Avoid endless loops when compiling without the computed goto
+        optimization.
+
+        NEXT_OPCODE expands to "continue", which will not work inside
+        loops.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Re-landing the following fix with the crashing bug in it fixed (r37405):
+        
+        - optimize away multiplication by constant 1.0
+        
+        2.3% speedup on v8 RayTrace benchmark
+
+        Apparently it's not uncommon for JavaScript code to multiply by
+        constant 1.0 in the mistaken belief that this converts integer to
+        floating point and that there is any operational difference.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for
+        case where parameter is already number.
+        (JSC::CTI::privateCompileSlowCases): ditto
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): ditto
+        * kjs/grammar.y:
+        (makeMultNode): Transform as follows:
+        +FOO * BAR ==> FOO * BAR
+        FOO * +BAR ==> FOO * BAR
+        FOO * 1 ==> +FOO
+        1 * FOO ==> +FOO
+        (makeDivNode): Transform as follows:
+        +FOO / BAR ==> FOO / BAR
+        FOO / +BAR ==> FOO / BAR
+        (makeSubNode): Transform as follows:
+        +FOO - BAR ==> FOO - BAR
+        FOO - +BAR ==> FOO - BAR
+        * kjs/nodes.h:
+        (JSC::ExpressionNode::stripUnaryPlus): Helper for above
+        grammar.y changes
+        (JSC::UnaryPlusNode::stripUnaryPlus): ditto
+
+2008-10-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - correctly handle appending -0 to a string, it should stringify as just 0
+
+        * kjs/ustring.cpp:
+        (JSC::concatenate):
+
+2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix WebKit compilation with VC2008SP1
+
+        Apply the TR1 workaround for JavaScriptCore, too.
+
+        * JavaScriptCore.pro:
+
+2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation errors on VS2008 64Bit
+
+        * kjs/collector.cpp:
+        (JSC::currentThreadStackBase):
+
+2008-10-08  André Pönitz  <apoenitz@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation with Qt namespaces.
+
+        * wtf/Threading.h:
+
+2008-10-07  Sam Weinig  <sam@webkit.org>
+
+        Roll out r37405.
+
+2008-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Switch CTI runtime calls to the fastcall calling convention
+
+        Basically this means that we get to store the argument for CTI
+        calls in the ECX register, which saves a register->memory write
+        and subsequent memory->register read.
+        
+        This is a 1.7% progression in SunSpider and 2.4% on commandline
+        v8 tests on Windows
+
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        * VM/CTI.h:
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
+          We need this to correctly reload ecx from inside certain property access
+          trampolines.
+        * wtf/Platform.h:
+
+2008-10-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        - optimize away multiplication by constant 1.0
+        
+        2.3% speedup on v8 RayTrace benchmark
+
+        Apparently it's not uncommon for JavaScript code to multiply by
+        constant 1.0 in the mistaken belief that this converts integer to
+        floating point and that there is any operational difference.
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for
+        case where parameter is already number.
+        (JSC::CTI::privateCompileSlowCases): ditto
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): ditto
+        * kjs/grammar.y:
+        (makeMultNode): Transform as follows:
+        +FOO * BAR ==> FOO * BAR
+        FOO * +BAR ==> FOO * BAR
+        FOO * 1 ==> +FOO
+        1 * FOO ==> +FOO
+        (makeDivNode): Transform as follows:
+        +FOO / BAR ==> FOO / BAR
+        FOO / +BAR ==> FOO / BAR
+        (makeSubNode): Transform as follows:
+        +FOO - BAR ==> FOO - BAR
+        FOO - +BAR ==> FOO - BAR
+        * kjs/nodes.h:
+        (JSC::ExpressionNode::stripUnaryPlus): Helper for above
+        grammar.y changes
+        (JSC::UnaryPlusNode::stripUnaryPlus): ditto
+
+2008-10-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - make constant folding code more consistent
+        
+        Added a makeSubNode to match add, mult and div; use the makeFooNode functions always,
+        instead of allocating nodes directly in other places in the grammar.
+
+        * kjs/grammar.y:
+
+2008-10-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Move hasGetterSetterProperties flag from PropertyMap to StructureID.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * kjs/JSObject.h:
+        (JSC::JSObject::hasGetterSetterProperties):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getOwnPropertySlot):
+        * kjs/PropertyMap.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        (JSC::StructureID::toDictionaryTransition):
+        (JSC::StructureID::changePrototypeTransition):
+        (JSC::StructureID::getterSetterTransition):
+        * kjs/StructureID.h:
+        (JSC::StructureID::hasGetterSetterProperties):
+        (JSC::StructureID::setHasGetterSetterProperties):
+
+2008-10-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Roll r37370 back in with bug fixes.
+
+        - PropertyMap::storageSize() should reflect the number of keys + deletedOffsets
+          and has nothing to do with the internal deletedSentinel count anymore.
+
+2008-10-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move callframe initialization into JIT code, again.
+        
+        As a part of the restructuring the second result from functions is now
+        returned in edx, allowing the new value of 'r' to be returned via a
+        register, and stored to the stack from JIT code, too.
+
+        4.5% progression on v8-tests. (3% in their harness)
+
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitCall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_post_dec):
+        * VM/Machine.h:
+        * kjs/JSFunction.h:
+        * kjs/ScopeChain.h:
+
+2008-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix typo in method name.
+
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+
+2008-10-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Roll out r37370.
+
+2008-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21415
+        Improve the division between PropertyStorageArray and PropertyMap
+
+        - Rework ProperyMap to store offsets in the value so that they don't
+          change when rehashing.  This allows us not to have to keep the 
+          PropertyStorageArray in sync and thus not have to pass it in.
+        - Rename PropertyMap::getOffset -> PropertyMap::get since put/remove
+          now also return offsets.
+        - A Vector of deleted offsets is now needed since the storage is out of
+          band.
+
+        1% win on SunSpider.  Wash on V8 suite.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::transitionWillNeedStorageRealloc):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        Transition logic can be greatly simplified by the fact that
+        the storage capacity is always known, and is correct for the
+        inline case.
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::put): Rename getOffset -> get.
+        (JSC::JSObject::deleteProperty): Ditto.
+        (JSC::JSObject::getPropertyAttributes): Ditto.
+        (JSC::JSObject::removeDirect): Use returned offset to
+        clear the value in the PropertyNameArray.
+        (JSC::JSObject::allocatePropertyStorage): Add assert.
+        * kjs/JSObject.h:
+        (JSC::JSObject::getDirect): Rename getOffset -> get
+        (JSC::JSObject::getDirectLocation): Rename getOffset -> get
+        (JSC::JSObject::putDirect): Use propertyStorageCapacity to determine whether
+        or not to resize.  Also, since put now returns an offset (and thus 
+        addPropertyTransition does also) setting of the PropertyStorageArray is
+        now done here.
+        (JSC::JSObject::transitionTo):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::checkConsistency): PropertyStorageArray is no longer 
+        passed in.
+        (JSC::PropertyMap::operator=): Copy the delete offsets vector.
+        (JSC::PropertyMap::put): Instead of setting the PropertyNameArray
+        explicitly, return the offset where the value should go.
+        (JSC::PropertyMap::remove): Instead of removing from the PropertyNameArray
+        explicitly, return the offset where the value should be removed.
+        (JSC::PropertyMap::get): Switch to using the stored offset, instead
+        of the implicit one.
+        (JSC::PropertyMap::insert):
+        (JSC::PropertyMap::expand): This is never called when m_table is null,
+        so remove that branch and add it as an assertion.
+        (JSC::PropertyMap::createTable): Consistency checks no longer take
+        a PropertyNameArray.
+        (JSC::PropertyMap::rehash): No need to rehash the PropertyNameArray
+        now that it is completely out of band.
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry): Store offset into PropertyNameArray.
+        (JSC::PropertyMap::get): Switch to using the stored offset, instead
+        of the implicit one.
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID): Initialize the propertyStorageCapacity to 
+        JSObject::inlineStorageCapacity.
+        (JSC::StructureID::growPropertyStorageCapacity): Grow the storage capacity as
+        described below.
+        (JSC::StructureID::addPropertyTransition): Copy the storage capacity.
+        (JSC::StructureID::toDictionaryTransition): Ditto.
+        (JSC::StructureID::changePrototypeTransition): Ditto.
+        (JSC::StructureID::getterSetterTransition): Ditto.
+        * kjs/StructureID.h:
+        (JSC::StructureID::propertyStorageCapacity): Add propertyStorageCapacity
+        which is the current capacity for the JSObjects PropertyStorageArray.
+        It starts at the JSObject::inlineStorageCapacity (currently 2), then
+        when it first needs to be resized moves to the JSObject::nonInlineBaseStorageCapacity
+        (currently 16), and after that doubles each time.
+
+2008-10-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21396: Remove the OptionalCalleeActivation call frame slot
+        <https://bugs.webkit.org/show_bug.cgi?id=21396>
+
+        Remove the OptionalCalleeActivation call frame slot. We have to be
+        careful to store the activation object in a register, because objects
+        in the scope chain do not get marked.
+
+        This is a 0.3% speedup on both SunSpider and the V8 benchmark.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitReturn):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+        (JSC::Machine::initializeCallFrame):
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::):
+
+2008-10-06  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Chromium doesn't use pthreads on windows, so make its use conditional.
+        
+        Also convert a WORD to a DWORD to avoid a compiler warning.  This
+        matches the other methods around it.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+        (WTF::ThreadCondition::broadcast):
+
+2008-10-06  Mark Mentovai  <mark@moxienet.com>
+
+        Reviewed by Tim Hatcher.
+
+        Allow ENABLE_DASHBOARD_SUPPORT and ENABLE_MAC_JAVA_BRIDGE to be
+        disabled on the Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21333
+
+        * wtf/Platform.h:
+
+2008-10-06  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21416
+        Pass 0 for size to VirtualAlloc, as documented by MSDN.
+        Identified by Application Verifier.
+        
+        Reviewed by Darin Adler.
+
+        * kjs/collector.cpp:
+        (KJS::freeBlock):
+
+2008-10-06  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcheri and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21412
+        Bug 21412: Refactor user initiated profile count to be more stable
+        - Export UString::from for use with creating the profile title.
+
+        * JavaScriptCore.exp:
+
+2008-10-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed. Build fix.
+        
+        - revert toBoolean changes (r37333 and r37335); need to make WebCore work with these
+
+        * API/JSValueRef.cpp:
+        (JSValueToBoolean):
+        * ChangeLog:
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        * kjs/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncSome):
+        * kjs/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * kjs/GetterSetter.h:
+        * kjs/JSCell.h:
+        (JSC::JSValue::toBoolean):
+        * kjs/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toBoolean):
+        * kjs/JSNumberCell.h:
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::toBoolean):
+        * kjs/JSObject.h:
+        * kjs/JSString.cpp:
+        (JSC::JSString::toBoolean):
+        * kjs/JSString.h:
+        * kjs/JSValue.h:
+        * kjs/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorMultiline):
+        * kjs/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2008-10-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - optimize op_jtrue, op_loop_if_true and op_not in various ways
+        https://bugs.webkit.org/show_bug.cgi?id=21404
+        
+        1) Make JSValue::toBoolean nonvirtual and completely inline by
+        making use of the StructureID type field.
+        
+        2) Make JSValue::toBoolean not take an ExecState; doesn't need it.
+        
+        3) Make op_not, op_loop_if_true and op_jtrue not read the
+        ExecState (toBoolean doesn't need it any more) and not check
+        exceptions (toBoolean can't throw).
+
+        * API/JSValueRef.cpp:
+        (JSValueToBoolean):
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        * kjs/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncSome):
+        * kjs/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * kjs/GetterSetter.h:
+        * kjs/JSCell.h:
+        (JSC::JSValue::toBoolean):
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::toBoolean):
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        (JSC::JSObject::toBoolean):
+        (JSC::JSCell::toBoolean):
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        (JSC::JSString::toBoolean):
+        * kjs/JSValue.h:
+        * kjs/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorMultiline):
+        * kjs/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2008-10-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Build fix for MinGW.
+
+        * JavaScriptCore.pri:
+        * kjs/DateMath.cpp:
+        (JSC::highResUpTime):
+
+2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove ScopeNode::containsClosures() now that it is unused.
+
+        * kjs/nodes.h:
+        (JSC::ScopeNode::containsClosures):
+
+2008-10-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix releas-only test failures caused by the fix to bug 21375
+
+        * VM/Machine.cpp:
+        (JSC::Machine::unwindCallFrame): Update ExecState while unwinding call frames;
+        it now matters more to have a still-valid ExecState, since dynamicGlobalObject
+        will make use of the ExecState's scope chain.
+        * VM/Machine.h:
+
+2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21364: Remove the branch in op_ret for OptionalCalleeActivation and OptionalCalleeArguments
+        <https://bugs.webkit.org/show_bug.cgi?id=21364>
+
+        Use information from the parser to detect whether an activation is
+        needed or 'arguments' is used, and emit explicit instructions to tear
+        them off before op_ret. This allows a branch to be removed from op_ret
+        and simplifies some other code. This does cause a small change in the
+        behaviour of 'f.arguments'; it is no longer live when 'arguments' is not
+        mentioned in the lexical scope of the function.
+
+        It should now be easy to remove the OptionaCalleeActivation slot in the
+        call frame, but this will be done in a later patch.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitReturn):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::mark):
+        * kjs/Arguments.h:
+        (JSC::Arguments::isTornOff):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::copyRegisters):
+        (JSC::JSActivation::copyRegisters):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+
+2008-10-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - fixed "REGRESSION (r37297): fast/js/deep-recursion-test takes too long and times out"
+        https://bugs.webkit.org/show_bug.cgi?id=21375
+        
+        The problem is that dynamicGlobalObject had become O(N) in number
+        of call frames, but unwinding the stack for an exception called it
+        for every call frame, resulting in O(N^2) behavior for an
+        exception thrown from inside deep recursion.
+
+        Instead of doing it that way, stash the dynamic global object in JSGlobalData.
+        
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Helper class to temporarily
+        store and later restore a dynamicGlobalObject in JSGlobalData.
+        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
+        (JSC::Machine::execute): In each version, establish a DynamicGlobalObjectScope.
+        For ProgramNode, always establish set new dynamicGlobalObject, for FunctionBody and Eval,
+        only if none is currently set.
+        * VM/Machine.h:
+        * kjs/ExecState.h:
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Ininitalize new dynamicGlobalObject field to 0.
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.h:
+        (JSC::ExecState::dynamicGlobalObject): Moved here from ExecState for benefit of inlining.
+        Return lexical global object if this is a globalExec(), otherwise look in JSGlobalData
+        for the one stashed there.
+
+2008-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Avoid an extra lookup when transitioning to an existing StructureID
+        by caching the offset of property that caused the transition.
+
+        1% win on V8 suite.  Wash on SunSpider.
+
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::put):
+        * kjs/PropertyMap.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        * kjs/StructureID.h:
+        (JSC::StructureID::setCachedTransistionOffset):
+        (JSC::StructureID::cachedTransistionOffset):
+
+2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21364: Remove the branch in op_ret for OptionalCalleeActivation and OptionalCalleeArguments
+        <https://bugs.webkit.org/show_bug.cgi?id=21364>
+
+        This patch does not yet remove the branch, but it does a bit of refactoring
+        so that a CodeGenerator now knows whether the associated CodeBlock will need
+        a full scope before doing any code generation. This makes it possible to emit
+        explicit tear-off instructions before every op_ret.
+
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitPushScope):
+        (JSC::CodeGenerator::emitPushNewScope):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::needsActivation):
+
+2008-10-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for bug #21387 - using SamplingTool with CTI.
+
+        (1) A repatch offset offset changes due to an additional instruction to update SamplingTool state.
+        (2) Fix an incusion order problem due to ExecState changes.
+        (3) Change to a MACHINE_SAMPLING macro, use of exec should now be accessing global data.
+
+        * VM/CTI.h:
+        (JSC::CTI::execute):
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::privateExecuteReturned):
+        * kjs/Shell.cpp:
+
+2008-10-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Add a 'Check For Weak VTables' build phase to catch weak vtables as early as possible.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-10-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=21320
+        leaks of PropertyNameArrayData seen on buildbot
+
+        - Fix RefPtr cycle by making PropertyNameArrayData's pointer back
+          to the StructureID a weak pointer.
+
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::setCachedStructureID):
+        (JSC::PropertyNameArrayData::cachedStructureID):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::StructureID::clearEnumerationCache):
+        (JSC::StructureID::~StructureID):
+
+2008-10-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21295
+          Bug 21295: Replace ExecState with a call frame Register pointer
+
+        10% faster on Richards; other v8 benchmarks faster too.
+        A wash on SunSpider.
+
+        This does the minimum necessary to get the speedup. Next step in
+        cleaning this up is to replace ExecState with a CallFrame class,
+        and be more judicious about when to pass a call frame and when
+        to pass a global data pointer, global object pointer, or perhaps
+        something else entirely.
+
+        * VM/CTI.cpp: Remove the debug-only check of the exception in
+        ctiVMThrowTrampoline -- already checked in the code the trampoline
+        jumps to, so not all that useful. Removed the exec argument from
+        ctiTrampoline. Removed emitDebugExceptionCheck -- no longer needed.
+        (JSC::CTI::emitCall): Removed code to set ExecState::m_callFrame.
+        (JSC::CTI::privateCompileMainPass): Removed code in catch to extract
+        the exception from ExecState::m_exception; instead, the code that
+        jumps into catch will make sure the exception is already in eax.
+        * VM/CTI.h: Removed exec from the ctiTrampoline. Also removed the
+        non-helpful "volatile". Temporarily left ARG_exec in as a synonym
+        for ARG_r; I'll change that on a future cleanup pass when introducing
+        more use of the CallFrame type.
+        (JSC::CTI::execute): Removed the ExecState* argument.
+
+        * VM/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError): Take
+        JSGlobalData* instead of ExecState*.
+        (JSC::createInterruptedExecutionException): Ditto.
+        * VM/ExceptionHelpers.h: Ditto. Also removed an unneeded include.
+
+        * VM/Machine.cpp:
+        (JSC::slideRegisterWindowForCall): Removed the exec and
+        exceptionValue arguments. Changed to return 0 when there's a stack
+        overflow rather than using a separate exception argument to cut
+        down on memory accesses in the calling convention.
+        (JSC::Machine::unwindCallFrame): Removed the exec argument when
+        constructing a DebuggerCallFrame. Also removed code to set
+        ExecState::m_callFrame.
+        (JSC::Machine::throwException): Removed the exec argument when
+        construction a DebuggerCallFrame.
+        (JSC::Machine::execute): Updated to use the register instead of
+        ExecState and also removed various uses of ExecState.
+        (JSC::Machine::debug):
+        (JSC::Machine::privateExecute): Put globalData into a local
+        variable so it can be used throughout the interpreter. Changed
+        the VM_CHECK_EXCEPTION to get the exception in globalData instead
+        of through ExecState.
+        (JSC::Machine::retrieveLastCaller): Turn exec into a registers
+        pointer by calling registers() instead of by getting m_callFrame.
+        (JSC::Machine::callFrame): Ditto.
+        Tweaked exception macros. Made new versions for when you know
+        you have an exception. Get at global exception with ARG_globalData.
+        Got rid of the need to pass in the return value type.
+        (JSC::Machine::cti_op_add): Update to use new version of exception
+        macros.
+        (JSC::Machine::cti_op_pre_inc): Ditto.
+        (JSC::Machine::cti_timeout_check): Ditto.
+        (JSC::Machine::cti_op_instanceof): Ditto.
+        (JSC::Machine::cti_op_new_func): Ditto.
+        (JSC::Machine::cti_op_call_JSFunction): Optimized by using the
+        ARG values directly instead of through local variables -- this gets
+        rid of code that just shuffles things around in the stack frame.
+        Also get rid of ExecState and update for the new way exceptions are
+        handled in slideRegisterWindowForCall.
+        (JSC::Machine::cti_vm_compile): Update to make exec out of r since
+        they are both the same thing now.
+        (JSC::Machine::cti_op_call_NotJSFunction): Ditto.
+        (JSC::Machine::cti_op_init_arguments): Ditto.
+        (JSC::Machine::cti_op_resolve): Ditto.
+        (JSC::Machine::cti_op_construct_JSConstruct): Ditto.
+        (JSC::Machine::cti_op_construct_NotJSConstruct): Ditto.
+        (JSC::Machine::cti_op_resolve_func): Ditto.
+        (JSC::Machine::cti_op_put_by_val): Ditto.
+        (JSC::Machine::cti_op_put_by_val_array): Ditto.
+        (JSC::Machine::cti_op_resolve_skip): Ditto.
+        (JSC::Machine::cti_op_resolve_global): Ditto.
+        (JSC::Machine::cti_op_post_inc): Ditto.
+        (JSC::Machine::cti_op_resolve_with_base): Ditto.
+        (JSC::Machine::cti_op_post_dec): Ditto.
+        (JSC::Machine::cti_op_call_eval): Ditto.
+        (JSC::Machine::cti_op_throw): Ditto. Also rearranged to return
+        the exception value as the return value so it can be used by
+        op_catch.
+        (JSC::Machine::cti_op_push_scope): Ditto.
+        (JSC::Machine::cti_op_in): Ditto.
+        (JSC::Machine::cti_op_del_by_val): Ditto.
+        (JSC::Machine::cti_vm_throw): Ditto. Also rearranged to return
+        the exception value as the return value so it can be used by
+        op_catch.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName): Pass globalData.
+        (JSC::DebuggerCallFrame::evaluate): Eliminated code to make a
+        new ExecState.
+        * kjs/DebuggerCallFrame.h: Removed ExecState argument from
+        constructor.
+
+        * kjs/ExecState.h: Eliminated all data members and made ExecState
+        inherit privately from Register instead. Also added a typedef to
+        the future name for this class, which is CallFrame. It's just a
+        Register* that knows it's a pointer at a call frame. The new class
+        can't be constructed or copied. Changed all functions to use
+        the this pointer instead of m_callFrame. Changed exception-related
+        functions to access an exception in JSGlobalData. Removed functions
+        used by CTI to pass the return address to the throw machinery --
+        this is now done directly with a global in the global data.
+
+        * kjs/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Pass globalData instead of exec.
+
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::name): Take globalData instead of exec.
+        * kjs/InternalFunction.h: Ditto.
+
+        * kjs/JSGlobalData.cpp: Initialize the new exception global to 0.
+        * kjs/JSGlobalData.h: Declare two new globals. One for the current
+        exception and another for the return address used by CTI to
+        implement the throw operation.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Removed code to set up globalExec,
+        which is now the same thing as globalCallFrame.
+        (JSC::JSGlobalObject::reset): Get globalExec from our globalExec
+        function so we don't have to repeat the logic twice.
+        (JSC::JSGlobalObject::mark): Removed code to mark the exception;
+        the exception is now stored in JSGlobalData and marked there.
+        (JSC::JSGlobalObject::globalExec): Return a pointer to the end
+        of the global call frame.
+        * kjs/JSGlobalObject.h: Removed the globalExec data member.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction): Pass globalData instead of exec.
+
+        * kjs/collector.cpp:
+        (JSC::Heap::collect): Mark the global exception.
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart): Pass globalData
+        instead of exec to createCallIdentifier.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute): Pass globalData instead of exec to
+        createCallIdentifier.
+        (JSC::Profiler::didExecute): Ditto.
+        (JSC::Profiler::createCallIdentifier): Take globalData instead of
+        exec.
+        (JSC::createCallIdentifierFromFunctionImp): Ditto.
+        * profiler/Profiler.h: Change interface to take a JSGlobalData
+        instead of an ExecState.
+
+2008-10-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 21369: Add opcode documentation for all undocumented opcodes
+        <https://bugs.webkit.org/show_bug.cgi?id=21369>
+
+        This patch adds opcode documentation for all undocumented opcodes, and
+        it also renames op_init_arguments to op_create_arguments.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_create_arguments):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+
+2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - "this" object in methods called on primitives should be wrapper object
+        https://bugs.webkit.org/show_bug.cgi?id=21362
+
+        I changed things so that functions which use "this" do a fast
+        version of toThisObject conversion if needed. Currently we miss
+        the conversion entirely, at least for primitive types. Using
+        TypeInfo and the primitive check, I made the fast case bail out
+        pretty fast.
+        
+        This is inexplicably an 1.007x SunSpider speedup (and a wash on V8 benchmarks).
+     
+        Also renamed some opcodes for clarity:
+        
+        init ==> enter
+        init_activation ==> enter_with_activation
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_convert_this):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::createStructureID):
+        * kjs/JSCell.h:
+        (JSC::JSValue::needsThisConversion):
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructureID):
+        * kjs/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructureID):
+        * kjs/JSString.h:
+        (JSC::JSString::createStructureID):
+        * kjs/JSValue.h:
+        * kjs/TypeInfo.h:
+        (JSC::TypeInfo::needsThisConversion):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::usesThis):
+
+2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21356: The size of the RegisterFile differs depending on 32-bit / 64-bit and Debug / Release
+        <https://bugs.webkit.org/show_bug.cgi?id=21356>
+
+        The RegisterFile decreases in size (measured in terms of numbers of
+        Registers) as the size of a Register increases. This causes
+
+            js1_5/Regress/regress-159334.js
+
+        to fail in 64-bit debug builds. This fix makes the RegisterFile on all
+        platforms the same size that it is in 32-bit Release builds.
+
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+
+2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - Some code cleanup to how we handle code features.
+        
+        1) Rename FeatureInfo typedef to CodeFeatures.
+        2) Rename NodeFeatureInfo template to NodeInfo.
+        3) Keep CodeFeature bitmask in ScopeNode instead of trying to break it out into individual bools.
+        4) Rename misleadingly named "needsClosure" method to "containsClosures", which better describes the meaning
+        of ClosureFeature.
+        5) Make setUsersArguments() not take an argument since it only goes one way.
+
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        * kjs/NodeInfo.h:
+        * kjs/Parser.cpp:
+        (JSC::Parser::didFinishParsing):
+        * kjs/Parser.h:
+        (JSC::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::usesEval):
+        (JSC::ScopeNode::containsClosures):
+        (JSC::ScopeNode::usesArguments):
+        (JSC::ScopeNode::setUsesArguments):
+
+2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
+        <https://bugs.webkit.org/show_bug.cgi?id=21343>
+
+        A fix was landed for this issue in r37253, and the ChangeLog assumes
+        that it is a compiler bug, but it turns out that it is a subtle issue
+        with mixing signed and unsigned 32-bit values in a 64-bit environment.
+        In order to properly fix this bug, we should convert our signed offsets
+        into the register file to use ptrdiff_t.
+
+        This may not be the only instance of this issue, but I will land this
+        fix first and look for more later.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::getArgumentsData):
+        * VM/Machine.h:
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        * kjs/Arguments.h:
+        (JSC::Arguments::init):
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        * VM/CTI.cpp: Another Windows build fix. Change the args of ctiTrampoline.
+
+        * kjs/JSNumberCell.h: A build fix for newer versions of gcc. Added
+        declarations of JSGlobalData overloads of jsNumberCell.
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * kjs/ScopeChain.h: Add forward declaration of JSGlobalData.
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21295
+          Turn ExecState into a call frame pointer.
+
+        Remove m_globalObject and m_globalData from ExecState.
+
+        SunSpider says this is a wash (slightly faster but not statistically
+        significant); which is good enough since it's a preparation step and
+        not supposed to be a spedup.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction):
+        * kjs/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * kjs/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * kjs/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * kjs/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * kjs/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * kjs/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * kjs/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * kjs/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * kjs/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * kjs/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        Pass JSGlobalData* instead of ExecState* to the InternalFunction
+        constructor.
+
+        * API/OpaqueJSString.cpp: Added now-needed include.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitSlowScriptCheck): Changed to use ARGS_globalData
+        instead of ARGS_exec.
+
+        * VM/CTI.h: Added a new argument to the CTI, the global data pointer.
+        While it's possible to get to the global data pointer using the
+        ExecState pointer, it's slow enough that it's better to just keep
+        it around in the CTI arguments.
+
+        * VM/CodeBlock.h: Moved the CodeType enum here from ExecState.h.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::execute): Pass fewer arguments when constructing
+        ExecState, and pass the global data pointer when invoking CTI.
+        (JSC::Machine::firstCallFrame): Added. Used to get the dynamic global
+        object, which is in the scope chain of the first call frame.
+        (JSC::Machine::cti_op_add): Use globalData instead of exec when
+        possible, to keep fast cases fast, since it's now more expensive to
+        get to it through the exec pointer.
+        (JSC::Machine::cti_timeout_check): Ditto.
+        (JSC::Machine::cti_op_put_by_id_second): Ditto.
+        (JSC::Machine::cti_op_get_by_id_second): Ditto.
+        (JSC::Machine::cti_op_mul): Ditto.
+        (JSC::Machine::cti_vm_compile): Ditto.
+        (JSC::Machine::cti_op_get_by_val): Ditto.
+        (JSC::Machine::cti_op_sub): Ditto.
+        (JSC::Machine::cti_op_put_by_val): Ditto.
+        (JSC::Machine::cti_op_put_by_val_array): Ditto.
+        (JSC::Machine::cti_op_negate): Ditto.
+        (JSC::Machine::cti_op_div): Ditto.
+        (JSC::Machine::cti_op_pre_dec): Ditto.
+        (JSC::Machine::cti_op_post_inc): Ditto.
+        (JSC::Machine::cti_op_lshift): Ditto.
+        (JSC::Machine::cti_op_bitand): Ditto.
+        (JSC::Machine::cti_op_rshift): Ditto.
+        (JSC::Machine::cti_op_bitnot): Ditto.
+        (JSC::Machine::cti_op_mod): Ditto.
+        (JSC::Machine::cti_op_post_dec): Ditto.
+        (JSC::Machine::cti_op_urshift): Ditto.
+        (JSC::Machine::cti_op_bitxor): Ditto.
+        (JSC::Machine::cti_op_bitor): Ditto.
+        (JSC::Machine::cti_op_call_eval): Ditto.
+        (JSC::Machine::cti_op_throw): Ditto.
+        (JSC::Machine::cti_op_is_string): Ditto.
+        (JSC::Machine::cti_op_debug): Ditto.
+        (JSC::Machine::cti_vm_throw): Ditto.
+
+        * VM/Machine.h: Added firstCallFrame.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Pass fewer arguments when
+        constructing ExecState.
+
+        * kjs/ExecState.cpp: Deleted contents. Later we'll remove the
+        file altogether.
+
+        * kjs/ExecState.h: Removed m_globalObject and m_globalData.
+        Moved CodeType into another header.
+        (JSC::ExecState::ExecState): Take only a single argument, a
+        call frame pointer.
+        (JSC::ExecState::dynamicGlobalObject): Get the object from
+        the first call frame since it's no longer stored.
+        (JSC::ExecState::globalData): Get the global data from the
+        scope chain, since we no longer store a pointer to it here.
+        (JSC::ExecState::identifierTable): Ditto.
+        (JSC::ExecState::propertyNames): Ditto.
+        (JSC::ExecState::emptyList): Ditto.
+        (JSC::ExecState::lexer): Ditto.
+        (JSC::ExecState::parser): Ditto.
+        (JSC::ExecState::machine): Ditto.
+        (JSC::ExecState::arrayTable): Ditto.
+        (JSC::ExecState::dateTable): Ditto.
+        (JSC::ExecState::mathTable): Ditto.
+        (JSC::ExecState::numberTable): Ditto.
+        (JSC::ExecState::regExpTable): Ditto.
+        (JSC::ExecState::regExpConstructorTable): Ditto.
+        (JSC::ExecState::stringTable): Ditto.
+        (JSC::ExecState::heap): Ditto.
+
+        * kjs/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor): Pass
+        JSGlobalData* instead of ExecState* to the InternalFunction
+        constructor.
+        (JSC::constructFunction): Pass the global data pointer when
+        constructing a new scope chain.
+
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction): Take a JSGlobalData*
+        instead of an ExecState*. Later we can change more places to
+        work this way -- it's more efficient to take the type you need
+        since the caller might already have it.
+        * kjs/InternalFunction.h: Ditto.
+
+        * kjs/JSCell.h:
+        (JSC::JSCell::operator new): Added an overload that takes a
+        JSGlobalData* so you can construct without an ExecState*.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Moved creation of the global scope
+        chain in here, since it now requires a pointer to the global data.
+        Moved the initialization of the call frame in here since it requires
+        the global scope chain node. Removed the extra argument to ExecState
+        when creating the global ExecState*.
+        * kjs/JSGlobalObject.h: Removed initialization of globalScopeChain
+        and the call frame from the JSGlobalObjectData constructor. Added
+        a thisValue argument to the init function.
+
+        * kjs/JSNumberCell.cpp: Added versions of jsNumberCell that take
+        JSGlobalData* rather than ExecState*.
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::operator new): Added a version that takes
+        JSGlobalData*.
+        (JSC::JSNumberCell::JSNumberCell): Ditto.
+        (JSC::jsNumber): Ditto.
+        * kjs/JSString.cpp:
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
+        * kjs/JSString.h:
+        (JSC::JSString::JSString): Changed to take JSGlobalData*.
+        (JSC::jsEmptyString): Added a version that takes JSGlobalData*.
+        (JSC::jsSingleCharacterString): Ditto.
+        (JSC::jsSingleCharacterSubstring): Ditto.
+        (JSC::jsNontrivialString): Ditto.
+        (JSC::JSString::getIndex): Ditto.
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
+
+        * kjs/ScopeChain.h: Added a globalData pointer to each node.
+        (JSC::ScopeChainNode::ScopeChainNode): Initialize the globalData
+        pointer.
+        (JSC::ScopeChainNode::push): Set the global data pointer in the
+        new node.
+        (JSC::ScopeChain::ScopeChain): Take a globalData argument.
+
+        * kjs/SmallStrings.cpp:
+        (JSC::SmallStrings::createEmptyString): Take JSGlobalData* instead of
+        ExecState*.
+        (JSC::SmallStrings::createSingleCharacterString): Ditto.
+        * kjs/SmallStrings.h:
+        (JSC::SmallStrings::emptyString): Ditto.
+        (JSC::SmallStrings::singleCharacterString): Ditto.
+
+2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
+        <https://bugs.webkit.org/show_bug.cgi?id=21343>
+
+        Add a workaround for a bug in GCC, which affects GCC 4.0, GCC 4.2, and
+        llvm-gcc 4.2. I put it in an #ifdef because it was a slight regression
+        on SunSpider in 32-bit, although that might be entirely random.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        * kjs/Shell.cpp: (main): Don't delete JSGlobalData. Later, we need to change
+        this tool to use public JavaScriptCore API instead.
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        Suggested by Alexey Proskuryakov.
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Remove call to heap.destroy() because
+        it's too late to ref the JSGlobalData object once it's already being
+        destroyed. In practice this is not a problem because WebCore's JSGlobalData
+        is never destroyed and JSGlobalContextRelease takes care of calling
+        heap.destroy() in advance.
+
+2008-10-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Replace SSE3 check with an SSE2 check, and implement SSE2 check on windows.
+
+        5.6% win on SunSpider on windows.
+
+        * VM/CTI.cpp:
+        (JSC::isSSE2Present):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+
+2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Cameron Zwarich.
+        
+        - fix mistaken change of | to || which caused a big perf regression on EarleyBoyer
+
+        * kjs/grammar.y:
+
+2008-10-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21321
+          Bug 21321: speed up JavaScriptCore by inlining Heap in JSGlobalData
+
+        1.019x as fast on SunSpider.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Use heap. instead of heap-> to work with the heap.
+        (JSCheckScriptSyntax): Ditto.
+        (JSGarbageCollect): Ditto.
+        (JSReportExtraMemoryCost): Ditto.
+        * API/JSContextRef.cpp:
+        (JSGlobalContextRetain): Ditto.
+        (JSGlobalContextRelease): Destroy the heap with the destroy function instead
+        of the delete operator.
+        (JSContextGetGlobalObject): Use heap. instead of heap-> to work with the heap.
+        * API/JSObjectRef.cpp:
+        (JSObjectMake): Use heap. instead of heap-> to work with the heap.
+        (JSObjectMakeFunctionWithCallback): Ditto.
+        (JSObjectMakeConstructor): Ditto.
+        (JSObjectMakeFunction): Ditto.
+        (JSObjectMakeArray): Ditto.
+        (JSObjectMakeDate): Ditto.
+        (JSObjectMakeError): Ditto.
+        (JSObjectMakeRegExp): Ditto.
+        (JSObjectHasProperty): Ditto.
+        (JSObjectGetProperty): Ditto.
+        (JSObjectSetProperty): Ditto.
+        (JSObjectGetPropertyAtIndex): Ditto.
+        (JSObjectSetPropertyAtIndex): Ditto.
+        (JSObjectDeleteProperty): Ditto.
+        (JSObjectCallAsFunction): Ditto.
+        (JSObjectCallAsConstructor): Ditto.
+        (JSObjectCopyPropertyNames): Ditto.
+        (JSPropertyNameAccumulatorAddName): Ditto.
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual): Ditto.
+        (JSValueIsInstanceOfConstructor): Ditto.
+        (JSValueMakeNumber): Ditto.
+        (JSValueMakeString): Ditto.
+        (JSValueToNumber): Ditto.
+        (JSValueToStringCopy): Ditto.
+        (JSValueToObject): Ditto.
+        (JSValueProtect): Ditto.
+        (JSValueUnprotect): Ditto.
+
+        * kjs/ExecState.h:
+        (JSC::ExecState::heap): Update to use the & operator.
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Update to initialize a heap member
+        instead of calling new to make a heap.
+        (JSC::JSGlobalData::~JSGlobalData): Destroy the heap with the destroy
+        function instead of the delete operator.
+        * kjs/JSGlobalData.h: Change from Heap* to a Heap.
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::mark): Use the & operator here.
+        (JSC::JSGlobalObject::operator new): Use heap. instead of heap-> to work
+        with the heap.
+
+2008-10-02  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21317: Replace RegisterFile size and capacity information with Register pointers
+        <https://bugs.webkit.org/show_bug.cgi?id=21317>
+
+        This is a 2.3% speedup on the V8 DeltaBlue benchmark, a 3.3% speedup on
+        the V8 Raytrace benchmark, and a 1.0% speedup on SunSpider.
+
+        * VM/Machine.cpp:
+        (JSC::slideRegisterWindowForCall):
+        (JSC::Machine::callEval):
+        (JSC::Machine::execute):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::start):
+        (JSC::RegisterFile::end):
+        (JSC::RegisterFile::size):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+        (JSC::RegisterFile::lastGlobal):
+        (JSC::RegisterFile::markGlobals):
+        (JSC::RegisterFile::markCallFrames):
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::copyGlobalsTo):
+
+2008-10-02  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Change bitwise operations introduced in r37166 to boolean operations. We
+        only use bitwise operations over boolean operations for increasing
+        performance in extremely hot code, but that does not apply to anything
+        in the parser.
+
+        * kjs/grammar.y:
+
+2008-10-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for bug #21232 - should reset m_isPendingDash on flush,
+        and should allow '\-' as beginning or end of a range (though
+        not to specifiy a range itself).
+
+        * ChangeLog:
+        * wrec/CharacterClassConstructor.cpp:
+        (JSC::CharacterClassConstructor::put):
+        (JSC::CharacterClassConstructor::flush):
+        * wrec/CharacterClassConstructor.h:
+        (JSC::CharacterClassConstructor::flushBeforeEscapedHyphen):
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generateDisjunction):
+        (JSC::WRECParser::parseCharacterClass):
+        (JSC::WRECParser::parseDisjunction):
+        * wrec/WREC.h:
+
+2008-10-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - remove the "static" from declarations in a header file, since we
+          don't want them to have internal linkage
+
+        * VM/Machine.h: Remove the static keyword from the constant and the
+        three inline functions that Geoff just moved here.
+
+2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21283.
+        Profiler Crashes When Started
+
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        (JSC::makeHostCallFramePointer):
+        (JSC::isHostCallFrame):
+        (JSC::stripHostCallFrameBit): Moved some things to the header so
+        JSGlobalObject could use them.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Call the
+        new makeHostCallFramePointer API, since 0 no longer indicates a host
+        call frame.
+
+2008-10-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21304
+        Stop using a static wrapper map for WebCore JS bindings
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::ClientData::~ClientData):
+        * kjs/JSGlobalData.h:
+        Added a client data member to JSGlobalData. WebCore will use it to store bindings-related
+        global data.
+
+        * JavaScriptCore.exp: Export virtual ClientData destructor.
+
+2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * kjs/Error.h:
+
+2008-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler and Cameron Zwarich.
+
+        Preliminary step toward dynamic recompilation: Standardized and
+        simplified the parsing interface.
+        
+        The main goal in this patch is to make it easy to ask for a duplicate
+        compilation, and get back a duplicate result -- same source URL, same
+        debugger / profiler ID, same toString behavior, etc.
+        
+        The basic unit of compilation and evaluation is now SourceCode, which
+        encompasses a SourceProvider, a range in that provider, and a starting
+        line number.
+
+        A SourceProvider now encompasses a source URL, and *is* a source ID,
+        since a pointer is a unique identifier.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax): Provide a SourceCode to the Interpreter, since
+        other APIs are no longer supported.
+        
+        * VM/CodeBlock.h:
+        (JSC::EvalCodeCache::get): Provide a SourceCode to the Interpreter, since
+        other APIs are no longer supported.
+        (JSC::CodeBlock::CodeBlock): ASSERT something that used to be ASSERTed
+        by our caller -- this is a better bottleneck.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator): Updated for the fact that
+        FunctionBodyNode's parameters are no longer a WTF::Vector.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::Arguments): ditto
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Provide a SourceCode to the Parser,
+        since other APIs are no longer supported.
+
+        * kjs/FunctionConstructor.cpp:
+        (JSC::constructFunction): Provide a SourceCode to the Parser, since
+        other APIs are no longer supported. Adopt FunctionBodyNode's new
+        "finishParsing" API.
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getParameterName): Updated for the fact that
+        FunctionBodyNode's parameters are no longer a wtf::Vector.
+
+        * kjs/JSFunction.h: Nixed some cruft.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval): Provide a SourceCode to the Parser, since
+        other APIs are no longer supported. 
+
+        * kjs/Parser.cpp:
+        (JSC::Parser::parse): Require a SourceCode argument, instead of a bunch
+        of broken out parameters. Stop tracking sourceId as an integer, since we
+        use the SourceProvider pointer for this now. Don't clamp the
+        startingLineNumber, since SourceCode does that now.
+
+        * kjs/Parser.h:
+        (JSC::Parser::parse): Standardized the parsing interface to require a
+        SourceCode.
+
+        * kjs/Shell.cpp:
+        (functionRun):
+        (functionLoad):
+        (prettyPrintScript):
+        (runWithScripts):
+        (runInteractive): Provide a SourceCode to the Interpreter, since
+        other APIs are no longer supported.
+
+        * kjs/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::url):
+        (JSC::SourceProvider::asId):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::UStringSourceProvider): Added new
+        responsibilities described above.
+
+        * kjs/SourceRange.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::toString):
+        (JSC::SourceCode::provider):
+        (JSC::SourceCode::firstLine):
+        (JSC::SourceCode::data):
+        (JSC::SourceCode::length): Added new responsibilities described above.
+        Renamed SourceRange to SourceCode, based on review feedback. Added
+        a makeSource function for convenience.
+
+        * kjs/debugger.h: Provide a SourceCode to the client, since other APIs
+        are no longer supported.
+
+        * kjs/grammar.y: Provide startingLineNumber when creating a SourceCode.
+
+        * kjs/debugger.h: Treat sourceId as intptr_t to avoid loss of precision
+        on 64bit platforms.
+
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::checkSyntax):
+        (JSC::Interpreter::evaluate):
+        * kjs/interpreter.h: Require a SourceCode instead of broken out arguments.
+
+        * kjs/lexer.cpp:
+        (JSC::Lexer::setCode):
+        * kjs/lexer.h:
+        (JSC::Lexer::sourceRange): Fold together the SourceProvider and line number
+        into a SourceCode. Fixed a bug where the Lexer would accidentally keep
+        alive the last SourceProvider forever.
+
+        * kjs/nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::generateCode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        (JSC::FunctionBodyNode::create):
+        (JSC::FunctionBodyNode::generateCode):
+        (JSC::ProgramNode::generateCode):
+        (JSC::FunctionBodyNode::paramString):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::):
+        (JSC::ScopeNode::sourceId):
+        (JSC::FunctionBodyNode::):
+        (JSC::FunctionBodyNode::parameterCount):
+        (JSC::FuncExprNode::):
+        (JSC::FuncDeclNode::): Store a SourceCode in all ScopeNodes, since
+        SourceCode is now responsible for tracking URL, ID, etc. Streamlined
+        some ad hoc FunctionBodyNode fixups into a "finishParsing" function, to
+        help make clear what you need to do in order to finish parsing a
+        FunctionBodyNode.
+
+        * wtf/Vector.h:
+        (WTF::::releaseBuffer): Don't ASSERT that releaseBuffer() is only called
+        when buffer is not 0, since FunctionBodyNode is more than happy
+        to get back a 0 buffer, and other functions like RefPtr::release() allow
+        for 0, too.
+
+2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21289: REGRESSION (r37160): Inspector crashes on load
+        <https://bugs.webkit.org/show_bug.cgi?id=21289>
+
+        The code in Arguments::mark() in r37160 was wrong. It marks indices in
+        d->registers, but that makes no sense (they are local variables, not
+        arguments). It should mark those indices in d->registerArray instead.
+
+        This patch also changes Arguments::copyRegisters() to use d->numParameters
+        instead of recomputing it.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::mark):
+        * kjs/Arguments.h:
+        (JSC::Arguments::copyRegisters):
+
+2008-09-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21214
+          work on getting rid of ExecState
+
+        Eliminate some unneeded uses of dynamicGlobalObject.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::contextData): Changed to use a map in the global data instead
+        of on the global object. Also fixed to use only a single hash table lookup.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor): Use lexicalGlobalObject rather than dynamicGlobalObject
+        to get the object prototype.
+
+        * kjs/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use arrayVisitedElements set in global data rather
+        than in the global object.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Don't initialize opaqueJSClassData, since
+        it's no longer a pointer.
+        (JSC::JSGlobalData::~JSGlobalData): We still need to delete all the values, but
+        we don't need to delete the map since it's no longer a pointer.
+
+        * kjs/JSGlobalData.h: Made opaqueJSClassData a map instead of a pointer to a map.
+        Also added arrayVisitedElements.
+
+        * kjs/JSGlobalObject.h: Removed arrayVisitedElements.
+
+        * kjs/Shell.cpp:
+        (functionRun): Use lexicalGlobalObject instead of dynamicGlobalObject.
+        (functionLoad): Ditto.
+
+2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculative Windows build fix.
+
+        * kjs/grammar.y:
+
+2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 21123: using "arguments" in a function should not force creation of an activation object
+        <https://bugs.webkit.org/show_bug.cgi?id=21123>
+
+        Make the 'arguments' object not require a JSActivation. We store the
+        'arguments' object in the OptionalCalleeArguments call frame slot. We
+        need to be able to get the original 'arguments' object to tear it off
+        when returning from a function, but 'arguments' may be assigned to in a
+        number of ways.
+
+        Therefore, we use the OptionalCalleeArguments slot when we want to get
+        the original activation or we know that 'arguments' was not assigned a
+        different value. When 'arguments' may have been assigned a new value,
+        we use a new local variable that is initialized with 'arguments'. Since
+        a function parameter named 'arguments' may overwrite the value of
+        'arguments', we also need to be careful to look up 'arguments' in the
+        symbol table, so we get the parameter named 'arguments' instead of the
+        local variable that we have added for holding the 'arguments' object.
+
+        This is a 19.1% win on the V8 Raytrace benchmark using the SunSpider
+        harness, and a 20.7% win using the V8 harness. This amounts to a 6.5%
+        total speedup on the V8 benchmark suite using the V8 harness.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::cti_op_init_arguments):
+        (JSC::Machine::cti_op_ret_activation_arguments):
+        * VM/Machine.h:
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::):
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::mark):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+        * kjs/Arguments.h:
+        (JSC::Arguments::setRegisters):
+        (JSC::Arguments::init):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::copyRegisters):
+        (JSC::JSActivation::copyRegisters):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * kjs/grammar.y:
+        * kjs/nodes.h:
+        (JSC::ScopeNode::setUsesArguments):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::orl_mr):
+
+2008-10-01  Kevin McCullough  <kmccullough@apple.com>
+
+        Rubberstamped by Geoff Garen.
+
+        Remove BreakpointCheckStatement because it's not used anymore.
+        No effect on sunspider or the jsc tests.
+
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+
+2008-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of CTI on windows.
+
+        Currently on platforms where the compiler doesn't allow us to safely
+        index relative to the address of a parameter we need to actually
+        provide a pointer to CTI runtime call arguments.  This patch improves
+        performance in this case by making the CTI logic for restoring this
+        parameter much less conservative by only resetting it before we actually
+        make a call, rather than between each and every SF bytecode we generate
+        code for.
+
+        This results in a 3.6% progression on the v8 benchmark when compiled with MSVC.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        * VM/CTI.h:
+        * masm/X86Assembler.h:
+        * wtf/Platform.h:
+
+2008-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - track uses of "this", "with" and "catch" in the parser
+        
+        Knowing this up front will be useful for future optimizations.
+        
+        Perf and correctness remain the same.
+        
+        * kjs/NodeInfo.h:
+        * kjs/grammar.y:
+
+2008-09-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add WebKitAvailability macros for JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError,
+        and JSObjectMakeRegExp
+
+        * API/JSObjectRef.h:
+
+2008-09-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21214
+          work on getting rid of ExecState
+
+        Replaced the m_prev field of ExecState with a bit in the
+        call frame pointer to indicate "host" call frames.
+
+        * VM/Machine.cpp:
+        (JSC::makeHostCallFramePointer): Added. Sets low bit.
+        (JSC::isHostCallFrame): Added. Checks low bit.
+        (JSC::stripHostCallFrameBit): Added. Clears low bit.
+        (JSC::Machine::unwindCallFrame): Replaced null check that was
+        formerly used to detect host call frames with an isHostCallFrame check.
+        (JSC::Machine::execute): Pass in a host call frame pointer rather than
+        always passing 0 when starting execution from the host. This allows us
+        to follow the entire call frame pointer chain when desired, or to stop
+        at the host calls when that's desired.
+        (JSC::Machine::privateExecute): Replaced null check that was
+        formerly used to detect host call frames with an isHostCallFrame check.
+        (JSC::Machine::retrieveCaller): Ditto.
+        (JSC::Machine::retrieveLastCaller): Ditto.
+        (JSC::Machine::callFrame): Removed the code to walk up m_prev pointers
+        and replaced it with code that uses the caller pointer and uses the
+        stripHostCallFrameBit function.
+
+        * kjs/ExecState.cpp: Removed m_prev.
+        * kjs/ExecState.h: Ditto.
+
+2008-09-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move all detection of 'arguments' in a lexical scope to the parser, in
+        preparation for fixing
+
+        Bug 21123: using "arguments" in a function should not force creation of an activation object
+        <https://bugs.webkit.org/show_bug.cgi?id=21123>
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        * kjs/NodeInfo.h:
+        * kjs/grammar.y:
+
+2008-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        * kjs/Shell.cpp:
+        (runWithScripts): Fixed indentation.
+
+2008-09-30  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Build fix.  Move InternalFunction::classInfo implementation into the .cpp
+        file to prevent the vtable for InternalFunction being generated as a weak symbol.
+        Has no effect on SunSpider.
+
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::classInfo):
+        * kjs/InternalFunction.h:
+
+2008-09-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        - optimize appending a number to a string
+        https://bugs.webkit.org/show_bug.cgi?id=21203
+        
+        It's pretty common in real-world code (and on some of the v8
+        benchmarks) to append a number to a string, so I made this one of
+        the fast cases, and also added support to UString to do it
+        directly without allocating a temporary UString.
+        
+        ~1% speedup on v8 benchmark.
+
+        * VM/Machine.cpp:
+        (JSC::jsAddSlowCase): Make this NEVER_INLINE because somehow otherwise
+        the change is a regression.
+        (JSC::jsAdd): Handle number + string special case.
+        (JSC::Machine::cti_op_add): Integrate much of the logic of jsAdd to
+        avoid exception check in the str + str, num + num and str + num cases.
+        * kjs/ustring.cpp:
+        (JSC::expandedSize): Make this a non-member function, since it needs to be 
+        called in non-member functions but not outside this file.
+        (JSC::expandCapacity): Ditto.
+        (JSC::UString::expandCapacity): Call the non-member version. 
+        (JSC::createRep): Helper to make a rep from a char*.
+        (JSC::UString::UString): Use above helper.
+        (JSC::concatenate): Guts of concatenating constructor for cases where first
+        item is a UString::Rep, and second is a UChar* and length, or a char*.
+        (JSC::UString::append): Implement for cases where first item is a UString::Rep,
+        and second is an int or double. Sadly duplicates logic of UString::from(int)
+        and UString::from(double).
+        * kjs/ustring.h:
+
+2008-09-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21214
+          work on getting rid of ExecState
+
+        * JavaScriptCore.exp: Updated since JSGlobalObject::init
+        no longer takes a parameter.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::execute): Removed m_registerFile argument
+        for ExecState constructors.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Removed globalThisValue
+        argument for ExecState constructor.
+
+        * kjs/ExecState.cpp:
+        (JSC::ExecState::ExecState): Removed globalThisValue and
+        registerFile arguments to constructors.
+
+        * kjs/ExecState.h: Removed m_globalThisValue and
+        m_registerFile data members.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Removed globalThisValue
+        argument for ExecState constructor.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject): Got rid of parameter
+        for the init function.
+
+2008-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Cameron Zwarich.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21225
+        Machine::retrieveLastCaller should check for a NULL codeBlock
+        
+        In order to crash, you would need to call retrieveCaller in a situation
+        where you had two host call frames in a row in the register file. I
+        don't know how to make that happen, or if it's even possible, so I don't
+        have a test case -- but better safe than sorry!
+
+        * VM/Machine.cpp:
+        (JSC::Machine::retrieveLastCaller):
+
+2008-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Store the callee ScopeChain, not the caller ScopeChain, in the call frame
+        header. Nix the "scopeChain" local variable and ExecState::m_scopeChain, and
+        access the callee ScopeChain through the call frame header instead.
+
+        Profit: call + return are simpler, because they don't have to update the
+        "scopeChain" local variable, or ExecState::m_scopeChain.
+        
+        Because CTI keeps "r" in a register, reading the callee ScopeChain relative
+        to "r" can be very fast, in any cases we care to optimize.
+
+        0% speedup on empty function call benchmark. (5.5% speedup in bytecode.)
+        0% speedup on SunSpider. (7.5% speedup on controlflow-recursive.)
+        2% speedup on SunSpider --v8.
+        2% speedup on v8 benchmark.
+
+        * VM/CTI.cpp: Changed scope chain access to read the scope chain from
+        the call frame header. Sped up op_ret by changing it not to fuss with
+        the "scopeChain" local variable or ExecState::m_scopeChain.
+
+        * VM/CTI.h: Updated CTI trampolines not to take a ScopeChainNode*
+        argument, since that's stored in the call frame header now.
+
+        * VM/Machine.cpp: Access "scopeChain" and "codeBlock" through new helper
+        functions that read from the call frame header. Updated functions operating
+        on ExecState::m_callFrame to account for / take advantage of the fact that
+        Exec:m_callFrame is now never NULL.
+        
+        Fixed a bug in op_construct, where it would use the caller's default
+        object prototype, rather than the callee's, when constructing a new object.
+
+        * VM/Machine.h: Made some helper functions available. Removed
+        ScopeChainNode* arguments to a lot of functions, since the ScopeChainNode*
+        is now stored in the call frame header.
+
+        * VM/RegisterFile.h: Renamed "CallerScopeChain" to "ScopeChain", since
+        that's what it is now.
+
+        * kjs/DebuggerCallFrame.cpp: Updated for change to ExecState signature.
+
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h: Nixed ExecState::m_callFrame, along with the unused
+        isGlobalObject function.
+
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h: Gave the global object a fake call frame in
+        which to store the global scope chain, since our code now assumes that
+        it can always read the scope chain out of the ExecState's call frame.
+
+2008-09-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Remove the isActivationObject() virtual method on JSObject and use
+        StructureID information instead. This should be slightly faster, but
+        isActivationObject() is only used in assertions and unwinding the stack
+        for exceptions.
+
+        * VM/Machine.cpp:
+        (JSC::depth):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_ret_activation):
+        * kjs/JSActivation.cpp:
+        * kjs/JSActivation.h:
+        * kjs/JSObject.h:
+
+2008-09-29  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Reviewed and tweaked by Darin Adler.
+
+        Fix build for non-all-in-one platforms.
+
+        * kjs/StringPrototype.cpp: Added missing ASCIICType.h include.
+
+2008-09-29  Bradley T. Hughes  <bradley.hughes@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with icpc
+
+        * wtf/HashSet.h:
+        (WTF::::find):
+        (WTF::::contains):
+
+2008-09-29  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed copyright from Trolltech ASA to Nokia.
+        
+        Nokia acquired Trolltech ASA, assets were transferred on September 26th 2008.
+        
+
+        * wtf/qt/MainThreadQt.cpp:
+
+2008-09-29  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Lars Knoll.
+
+        Don't accidentially install libJavaScriptCore.a for the build inside
+        Qt.
+
+        * JavaScriptCore.pro:
+
+2008-09-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21200: Allow direct access to 'arguments' without using op_resolve
+        <https://bugs.webkit.org/show_bug.cgi?id=21200>
+
+        Allow fast access to the 'arguments' object by adding an extra slot to
+        the callframe to store it.
+
+        This is a 3.0% speedup on the V8 Raytrace benchmark.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::registerFor):
+        * VM/CodeGenerator.h:
+        (JSC::CodeGenerator::registerFor):
+        * VM/Machine.cpp:
+        (JSC::Machine::initializeCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * kjs/NodeInfo.h:
+        * kjs/Parser.cpp:
+        (JSC::Parser::didFinishParsing):
+        * kjs/Parser.h:
+        (JSC::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::usesArguments):
+
+2008-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add an ASCII fast-path to toLowerCase and toUpperCase.
+
+        The fast path speeds up the common case of an ASCII-only string by up to 60% while adding a less than 5% penalty
+        to the less common non-ASCII case.
+
+        This also removes stringProtoFuncToLocaleLowerCase and stringProtoFuncToLocaleUpperCase, which were identical
+        to the non-locale variants of the functions.  toLocaleLowerCase and toLocaleUpperCase now use the non-locale
+        variants of the functions directly.
+
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+
+2008-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Speed up parseInt and parseFloat.
+
+        Repeatedly indexing into a UString is slow, so retrieve a pointer into the underlying buffer once up front
+        and use that instead.  This is a 7% win on a parseInt/parseFloat micro-benchmark.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        (JSC::parseFloat):
+
+2008-09-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        In Qt's initializeThreading re-use an existing thread identifier for the main
+        thread if it exists.
+
+        currentThread() implicitly creates new identifiers and it could be that
+        it is called before initializeThreading().
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading):
+
+2008-09-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Added Machine::retrieveCaller to the export list.
+
+        Reviewed by Kevin McCullough and Tim Hatcher.
+
+        * JavaScriptCore.exp: Added Machine::retrieveCaller.
+
+2008-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * VM/CTI.cpp:
+        (JSC::):
+
+2008-09-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=21175
+
+        Store the callee CodeBlock, not the caller CodeBlock, in the call frame
+        header. Nix the "codeBlock" local variable, and access the callee
+        CodeBlock through the call frame header instead.
+        
+        Profit: call + return are simpler, because they don't have to update the
+        "codeBlock" local variable.
+        
+        Because CTI keeps "r" in a register, reading the callee CodeBlock relative
+        to "r" can be very fast, in any cases we care to optimize. Presently,
+        no such cases seem important.
+        
+        Also, stop writing "dst" to the call frame header. CTI doesn't use it.
+        
+        21.6% speedup on empty function call benchmark.
+        3.8% speedup on SunSpider --v8.
+        2.1% speedup on v8 benchmark.
+        0.7% speedup on SunSpider (6% speedup on controlflow-recursive).
+        
+        Small regression in bytecode, because currently every op_ret reads the
+        callee CodeBlock to check needsFullScopeChain, and bytecode does not
+        keep "r" in a register. On-balance, this is probably OK, since CTI is
+        our high-performance execution model. Also, this should go away once
+        we make needsFullScopeChain statically determinable at parse time.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall): The speedup!
+        (JSC::CTI::privateCompileSlowCases): ditto
+
+        * VM/CTI.h:
+        (JSC::): Fixed up magic trampoline constants to account for the nixed
+        "codeBlock" argument.
+        (JSC::CTI::execute): Changed trampoline function not to take a "codeBlock"
+        argument, since codeBlock is now stored in the call frame header.
+        
+        * VM/Machine.cpp: Read the callee CodeBlock from the register file. Use
+        a NULL CallerRegisters in the call frame header to signal a built-in
+        caller, since CodeBlock is now never NULL.
+
+        * VM/Machine.h: Made some stand-alone functions Machine member functions
+        so they could call the private codeBlock() accessor in the Register
+        class, of which Machine is a friend. Renamed "CallerCodeBlock" to
+        "CodeBlock", since it's no longer the caller's CodeBlock.
+
+        * VM/RegisterFile.h: Marked some methods const to accommodate a 
+        const RegisterFile* being passed around in Machine.cpp.
+
+2008-09-26  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Not reviewed.
+
+        Narrow-down the target of the JavaScriptCore .lut.h generator so
+        it won't try to create the WebCore .lut.hs.
+
+        * GNUmakefile.am:
+
+2008-09-26  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Tim Hatcher.
+
+        Update FEATURE_DEFINES after ENABLE_CROSS_DOCUMENT_MESSAGING was removed.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-09-26  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Anders Carlson.
+
+        Change the name 'sc' to 'scopeChainNode' in a few places.
+
+        * kjs/nodes.cpp:
+        (JSC::EvalNode::generateCode):
+        (JSC::FunctionBodyNode::generateCode):
+        (JSC::ProgramNode::generateCode):
+
+2008-09-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=21152
+        Speedup static property get/put
+
+        Convert getting/setting static property values to use static functions
+        instead of storing an integer and switching in getValueProperty/putValueProperty.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertyAttributes):
+        * kjs/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        * kjs/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * kjs/PropertySlot.h:
+        (JSC::PropertySlot::):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::RegExpConstructor::setInput):
+        (JSC::RegExpConstructor::setMultiline):
+        (JSC::RegExpConstructor::multiline):
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+        (JSC::setRegExpObjectLastIndex):
+        * kjs/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        (JSC::RegExpObject::lastIndex):
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+        * kjs/create_hash_table:
+        * kjs/lexer.cpp:
+        (JSC::Lexer::lex):
+        * kjs/lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        (JSC::setUpStaticFunctionSlot):
+        * kjs/lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::setKey):
+        (JSC::HashEntry::key):
+        (JSC::HashEntry::attributes):
+        (JSC::HashEntry::function):
+        (JSC::HashEntry::functionLength):
+        (JSC::HashEntry::propertyGetter):
+        (JSC::HashEntry::propertyPutter):
+        (JSC::HashEntry::lexerValue):
+        (JSC::HashEntry::):
+        (JSC::HashTable::entry):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::lookupPut):
+
+2008-09-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak & Oliver Hunt.
+
+        Add support for reusing temporary JSNumberCells.  This change is based on the observation
+        that if the result of certain operations is a JSNumberCell and is consumed by a subsequent
+        operation that would produce a JSNumberCell, we can reuse the object rather than allocating
+        a fresh one.  E.g. given the expression ((a * b) * c), we can statically determine that
+        (a * b) will have a numeric result (or else it will have thrown an exception), so the result
+        will either be a JSNumberCell or a JSImmediate.
+
+        This patch changes three areas of JSC:
+            * The AST now tracks type information about the result of each node.
+            * This information is consumed in bytecode compilation, and certain bytecode operations
+              now carry the statically determined type information about their operands.
+            * CTI uses the information in a number of fashions:
+                * Where an operand to certain arithmetic operations is reusable, it will plant code
+                  to try to perform the operation in JIT code & reuse the cell, where appropriate.
+                * Where it can be statically determined that an operand can only be numeric (typically
+                  the result of another arithmetic operation) the code will not redundantly check that
+                  the JSCell is a JSNumberCell.
+                * Where either of the operands to an add are non-numeric do not plant an optimized
+                  arithmetic code path, just call straight out to the C function.
+
+        +6% Sunspider (10% progression on 3D, 16% progression on math, 60% progression on access-nbody),
+        +1% v8-tests (improvements in raytrace & crypto)
+
+        * VM/CTI.cpp: Add optimized code generation with reuse of temporary JSNumberCells.
+        * VM/CTI.h:
+        * kjs/JSNumberCell.h:
+        * masm/X86Assembler.h:
+
+        * VM/CodeBlock.cpp: Add type information to specific bytecodes.
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+
+        * kjs/nodes.cpp: Track static type information for nodes.
+        * kjs/nodes.h:
+        * kjs/ResultDescriptor.h: (Added)
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-09-26  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos, Maciej Stachowiak.
+
+        Add utility functions needed for upcoming WML code.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIPrintable):
+
+2008-09-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Reverted the part of r36614 that used static data because static data
+        is not thread-safe.
+
+2008-09-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Removed dynamic check for whether the callee needs an activation object.
+        Replaced with callee code to create the activation object.
+
+        0.5% speedup on SunSpider.
+        No change on v8 benchmark. (Might be a speedup, but it's in range of the
+        variance.)
+
+        0.7% speedup on v8 benchmark in bytecode.
+        1.3% speedup on empty call benchmark in bytecode.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Added support for op_init_activation,
+        the new opcode that specifies that the callee's initialization should
+        create an activation object.
+        (JSC::CTI::privateCompile): Removed previous code that did a similar
+        thing in an ad-hoc way.
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Added a case for dumping op_init_activation.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate): Added fixup code to change op_init to
+        op_init_activation if necessary. (With a better parser, we would know
+        which to use from the beginning.)
+
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (WTF::): Faster traits for the instruction vector. An earlier version
+        of this patch relied on inserting at the beginning of the vector, and
+        depended on this change for speed.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::execute): Removed clients of setScopeChain, the old
+        abstraction for dynamically checking for whether an activation object
+        needed to be created.
+        (JSC::Machine::privateExecute): ditto
+
+        (JSC::Machine::cti_op_push_activation): Renamed this function from
+        cti_vm_updateScopeChain, and made it faster by removing the call to 
+        setScopeChain.
+        * VM/Machine.h:
+
+        * VM/Opcode.h: Declared op_init_activation.
+
+2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Move most of the return code back into the callee, now that the callee
+        doesn't have to calculate anything dynamically.
+        
+        11.5% speedup on empty function call benchmark.
+        
+        SunSpider says 0.3% faster. SunSpider --v8 says no change.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+
+2008-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove staticFunctionGetter.  There is only one remaining user of
+        staticFunctionGetter and it can be converted to use setUpStaticFunctionSlot.
+
+        * JavaScriptCore.exp:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+
+2008-09-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - inline JIT fast case of op_neq
+        - remove extra level of function call indirection from slow cases of eq and neq
+        
+        1% speedup on Richards
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_neq):
+        * kjs/operations.cpp:
+        (JSC::equal):
+        (JSC::equalSlowCase):
+        * kjs/operations.h:
+        (JSC::equalSlowCaseInline):
+
+2008-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21080
+        <rdar://problem/6243534>
+        Crash below Function.apply when using a runtime array as the argument list
+
+        Test: plugins/bindings-array-apply-crash.html
+
+        * kjs/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply): Revert to the slow case if the object inherits from 
+        JSArray (via ClassInfo) but is not a JSArray.
+
+2008-09-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Style change.
+
+        * kjs/nodes.cpp:
+        (JSC::statementListEmitCode):
+
+2008-09-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 21031: Breakpoints in the condition of loops only breaks the first
+        time
+        - Now when setting breakpoints in the condition of a loop (for, while,
+        for in, and do while) will successfully break each time throught the
+        loop.
+        - For 'for' loops we need a little more complicated behavior that cannot
+        be accomplished without some more significant changes:
+        https://bugs.webkit.org/show_bug.cgi?id=21073
+
+        * kjs/nodes.cpp:
+        (JSC::statementListEmitCode): We don't want to blindly emit a debug hook
+        at the first line of loops, instead let the loop emit the debug hooks.
+        (JSC::DoWhileNode::emitCode):
+        (JSC::WhileNode::emitCode):
+        (JSC::ForNode::emitCode):
+        (JSC::ForInNode::emitCode):
+        * kjs/nodes.h:
+        (JSC::StatementNode::):
+        (JSC::DoWhileNode::):
+        (JSC::WhileNode::):
+        (JSC::ForInNode::):
+
+2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/5605532> Need a SPI for telling JS the size of
+        the objects it retains
+
+        * API/tests/testapi.c: Test the new SPI a little.
+
+        * API/JSSPI.cpp: Add the new SPI.
+        * API/JSSPI.h: Add the new SPI.
+        * JavaScriptCore.exp: Add the new SPI.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add the new SPI.
+
+2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * API/JSBase.h: Filled in some missing function names.
+
+2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21057
+        Crash in RegisterID::deref() running fast/canvas/canvas-putImageData.html
+
+        * VM/CodeGenerator.h: Changed declaration order to ensure the
+        m_lastConstant, which is a RefPtr that points into m_calleeRegisters,
+        has its destructor called before the destructor for m_calleeRegisters.
+
+2008-09-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21047
+          speed up ret_activation with inlining
+
+        About 1% on v8-raytrace.
+
+        * JavaScriptCore.exp: Removed JSVariableObject::setRegisters.
+
+        * kjs/JSActivation.cpp: Moved copyRegisters to the header to make it inline.
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::copyRegisters): Moved here. Also removed the registerArraySize
+        argument to setRegisters, since the object doesn't need to store the number of
+        registers.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset): Removed unnecessary clearing left over from when we
+        used this on objects that weren't brand new. These days, this function is really
+        just part of the constructor.
+
+        * kjs/JSGlobalObject.h: Added registerArraySize to JSGlobalObjectData, since
+        JSVariableObjectData no longer needs it. Added a setRegisters override here
+        that handles storing the size.
+
+        * kjs/JSStaticScopeObject.h: Removed code to set registerArraySize, since it
+        no longer exists.
+
+        * kjs/JSVariableObject.cpp: Moved copyRegisterArray and setRegisters to the
+        header to make them inline.
+        * kjs/JSVariableObject.h: Removed registerArraySize from JSVariableObjectData,
+        since it was only used for the global object.
+        (JSC::JSVariableObject::copyRegisterArray): Moved here ot make it inline.
+        (JSC::JSVariableObject::setRegisters): Moved here to make it inline. Also
+        removed the code to set registerArraySize and changed an if statement into
+        an assert to save an unnnecessary branch.
+
+2008-09-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - inline PropertyMap::getOffset to speed up polymorphic lookups
+        
+        ~1.5% speedup on v8 benchmark
+        no effect on SunSpider
+
+        * JavaScriptCore.exp:
+        * kjs/PropertyMap.cpp:
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMap::getOffset):
+
+2008-09-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20992
+        Build fails on GTK+ Mac OS
+
+        * wtf/ThreadingGtk.cpp: Remove platform ifdef as suggested by
+          Richard Hult.
+        (WTF::initializeThreading):
+
+2008-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 19968: Slow Script at www.huffingtonpost.com
+        <https://bugs.webkit.org/show_bug.cgi?id=19968>
+
+        Finally found the cause of this accursed issue.  It is triggered
+        by synchronous creation of a new global object from JS.  The new
+        global object resets the timer state in this execution group's
+        Machine, taking timerCheckCount to 0.  Then when JS returns the
+        timerCheckCount is decremented making it non-zero.  The next time
+        we execute JS we will start the timeout counter, however the non-zero
+        timeoutCheckCount means we don't reset the timer information. This
+        means that the timeout check is now checking the cumulative time
+        since the creation of the global object rather than the time since
+        JS was last entered.  At this point the slow script dialog is guaranteed
+        to eventually be displayed incorrectly unless a page is loaded
+        asynchronously (which will reset everything into a sane state).
+
+        The fix for this is rather trivial -- the JSGlobalObject constructor
+        should not be resetting the machine timer state.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+          Now that we can't rely on the GlobalObject initialising the timeout
+          state, we do it in the Machine constructor.
+
+        * VM/Machine.h:
+        (JSC::Machine::stopTimeoutCheck):
+          Add assertions to guard against this happening.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+          Don't reset the timeout state.
+
+2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21038 | <rdar://problem/6240812>
+        Uncaught exceptions in regex replace callbacks crash webkit
+        
+        This was a combination of two problems:
+        
+        (1) the replace function would continue execution after an exception
+        had been thrown.
+        
+        (2) In some cases, the Machine would return 0 in the case of an exception,
+        despite the fact that a few clients dereference the Machine's return
+        value without first checking for an exception.
+        
+        * VM/Machine.cpp:
+        (JSC::Machine::execute):
+        
+        ^ Return jsNull() instead of 0 in the case of an exception, since some
+        clients depend on using our return value.
+        
+        ^ ASSERT that execution does not continue after an exception has been
+        thrown, to help catch problems like this in the future.
+
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        
+        ^ Stop execution if an exception has been thrown.
+
+2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the windows build.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+
+2008-09-23  Alp Toker  <alp@nuanti.com>
+
+        Build fix.
+
+        * VM/CTI.h:
+
+2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Removed duplicate #if.
+
+2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Changed the layout of the call frame from
+        
+        { header, parameters, locals | constants, temporaries }
+        
+        to
+        
+        { parameters, header | locals, constants, temporaries }
+        
+        This simplifies function entry+exit, and enables a number of future
+        optimizations.
+        
+        13.5% speedup on empty call benchmark for bytecode; 23.6% speedup on
+        empty call benchmark for CTI.
+        
+        SunSpider says no change. SunSpider --v8 says 1% faster.
+
+        * VM/CTI.cpp:
+        
+        Added a bit of abstraction for calculating whether a register is a
+        constant, since this patch changes that calculation:
+        (JSC::CTI::isConstant):
+        (JSC::CTI::getConstant):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+
+        Updated for changes to callframe header location:
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::printOpcodeOperandTypes):
+        
+        Renamed to spite Oliver:
+        (JSC::CTI::emitInitRegister):
+        
+        Added an abstraction for emitting a call through a register, so that
+        calls through registers generate exception info, too:
+        (JSC::CTI::emitCall):
+
+        Updated to match the new callframe header layout, and to support calls
+        through registers, which have no destination address:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+
+        * VM/CTI.h:
+
+        More of the above:
+        (JSC::CallRecord::CallRecord):
+
+        * VM/CodeBlock.cpp:
+
+        Updated for new register layout:
+        (JSC::registerName):
+        (JSC::CodeBlock::dump):
+
+        * VM/CodeBlock.h:
+        
+        Updated CodeBlock to track slightly different information about the
+        register frame, and tweaked the style of an ASSERT_NOT_REACHED.
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::getStubInfo):
+
+        * VM/CodeGenerator.cpp:
+        
+        Added some abstraction around constant register allocation, since this
+        patch changes it, changed codegen to account for the new callframe
+        layout, and added abstraction around register fetching code
+        that used to assume that all local registers lived at negative indices,
+        since vars now live at positive indices:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::addVar):
+        (JSC::CodeGenerator::addGlobalVar):
+        (JSC::CodeGenerator::allocateConstants):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::addParameter):
+        (JSC::CodeGenerator::registerFor):
+        (JSC::CodeGenerator::constRegisterFor):
+        (JSC::CodeGenerator::newRegister):
+        (JSC::CodeGenerator::newTemporary):
+        (JSC::CodeGenerator::highestUsedRegister):
+        (JSC::CodeGenerator::addConstant):
+        
+        ASSERT that our caller referenced the registers it passed to us.
+        Otherwise, we might overwrite them with parameters:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct):
+
+        * VM/CodeGenerator.h:
+        
+        Added some abstraction for getting a RegisterID for a given index,
+        since the rules are a little weird:
+        (JSC::CodeGenerator::registerFor):
+
+        * VM/Machine.cpp:
+
+        Utility function to transform a machine return PC to a virtual machine
+        return VPC, for the sake of stack unwinding, since both PCs are stored
+        in the same location now:
+        (JSC::vPCForPC):
+
+        Tweaked to account for new call frame:
+        (JSC::Machine::initializeCallFrame):
+        
+        Tweaked to account for registerOffset supplied by caller:
+        (JSC::slideRegisterWindowForCall):
+
+        Tweaked to account for new register layout:
+        (JSC::scopeChainForCall):
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::execute):
+
+        Changed op_call and op_construct to implement the new calling convention:
+        (JSC::Machine::privateExecute):
+
+        Tweaked to account for the new register layout:
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::retrieveCaller):
+        (JSC::Machine::retrieveLastCaller):
+        (JSC::Machine::callFrame):
+        (JSC::Machine::getArgumentsData):
+
+        Changed CTI call helpers to implement the new calling convention:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_ret_activation):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_call_eval):
+
+        * VM/Machine.h:
+
+        * VM/Opcode.h:
+        
+        Renamed op_initialise_locals to op_init, because this opcode
+        doesn't initialize all locals, and it doesn't initialize only locals.
+        Also, to spite Oliver.
+        
+        * VM/RegisterFile.h:
+        
+        New call frame enumeration values:
+        (JSC::RegisterFile::):
+
+        Simplified the calculation of whether a RegisterID is a temporary,
+        since we can no longer assume that all positive non-constant registers
+        are temporaries:
+        * VM/RegisterID.h:
+        (JSC::RegisterID::RegisterID):
+        (JSC::RegisterID::setTemporary):
+        (JSC::RegisterID::isTemporary):
+
+        Renamed firstArgumentIndex to firstParameterIndex because the assumption
+        that this variable pertained to the actual arguments supplied by the
+        caller caused me to write some buggy code:
+        * kjs/Arguments.cpp:
+        (JSC::ArgumentsData::ArgumentsData):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+
+        Updated for new call frame layout:
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::type):
+        * kjs/DebuggerCallFrame.h:
+
+        Changed the activation object to account for the fact that a call frame
+        header now sits between parameters and local variables. This change
+        requires all variable objects to do their own marking, since they
+        now use their register storage differently:
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+        (JSC::JSActivation::copyRegisters):
+        (JSC::JSActivation::createArgumentsObject):
+        * kjs/JSActivation.h:
+
+        Updated global object to use the new interfaces required by the change
+        to JSActivation above:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        (JSC::JSGlobalObject::copyGlobalsFrom):
+        (JSC::JSGlobalObject::copyGlobalsTo):
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addStaticGlobals):
+
+        Updated static scope object to use the new interfaces required by the 
+        change to JSActivation above:
+        * kjs/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::mark):
+        (JSC::JSStaticScopeObject::~JSStaticScopeObject):
+        * kjs/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::d):
+
+        Updated variable object to use the new interfaces required by the 
+        change to JSActivation above:
+        * kjs/JSVariableObject.cpp:
+        (JSC::JSVariableObject::copyRegisterArray):
+        (JSC::JSVariableObject::setRegisters):
+        * kjs/JSVariableObject.h:
+
+        Changed the bit twiddling in symbol table not to assume that all indices
+        are negative, since they can be positive now:
+        * kjs/SymbolTable.h:
+        (JSC::SymbolTableEntry::SymbolTableEntry):
+        (JSC::SymbolTableEntry::isNull):
+        (JSC::SymbolTableEntry::getIndex):
+        (JSC::SymbolTableEntry::getAttributes):
+        (JSC::SymbolTableEntry::setAttributes):
+        (JSC::SymbolTableEntry::isReadOnly):
+        (JSC::SymbolTableEntry::pack):
+        (JSC::SymbolTableEntry::isValidIndex):
+
+        Changed call and construct nodes to ref their functions and/or bases,
+        so that emitCall/emitConstruct doesn't overwrite them with parameters.
+        Also, updated for rename to registerFor:
+        * kjs/nodes.cpp:
+        (JSC::ResolveNode::emitCode):
+        (JSC::NewExprNode::emitCode):
+        (JSC::EvalFunctionCallNode::emitCode):
+        (JSC::FunctionCallValueNode::emitCode):
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::FunctionCallBracketNode::emitCode):
+        (JSC::FunctionCallDotNode::emitCode):
+        (JSC::PostfixResolveNode::emitCode):
+        (JSC::DeleteResolveNode::emitCode):
+        (JSC::TypeOfResolveNode::emitCode):
+        (JSC::PrefixResolveNode::emitCode):
+        (JSC::ReadModifyResolveNode::emitCode):
+        (JSC::AssignResolveNode::emitCode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitCode):
+
+        Added abstraction for getting exception info out of a call through a
+        register:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitCall):
+        
+        Removed duplicate #if:
+        * wtf/Platform.h:
+
+2008-09-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        Bug 21030: The JS debugger breaks on the do of a do-while not the while
+        (where the conditional statement is)
+        https://bugs.webkit.org/show_bug.cgi?id=21030
+        Now the statementListEmitCode detects if a do-while node is being
+        emited and emits the debug hook on the last line instead of the first.
+
+        This change had no effect on sunspider.
+
+        * kjs/nodes.cpp:
+        (JSC::statementListEmitCode):
+        * kjs/nodes.h:
+        (JSC::StatementNode::isDoWhile):
+        (JSC::DoWhileNode::isDoWhile):
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - inline the fast case of instanceof
+        https://bugs.webkit.org/show_bug.cgi?id=20818
+
+        ~2% speedup on EarleyBoyer test.
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_instanceof):
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - add forgotten slow case logic for !==
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileSlowCases):
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - inline the fast cases of !==, same as for ===
+        
+        2.9% speedup on EarleyBoyer benchmark
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpStrictEq): Factored stricteq codegen into this function,
+        and parameterized so it can do the reverse version as well.
+        (JSC::CTI::privateCompileMainPass): Use the above for stricteq and nstricteq.
+        * VM/CTI.h:
+        (JSC::CTI::): Declare above stuff.
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_nstricteq): Removed fast cases, now handled inline.
+
+2008-09-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20989: Aguments constructor should put 'callee' and 'length' properties in a more efficient way
+        <https://bugs.webkit.org/show_bug.cgi?id=20989>
+
+        Make special cases for the 'callee' and 'length' properties in the
+        Arguments object.
+
+        This is somewhere between a 7.8% speedup and a 10% speedup on the V8
+        Raytrace benchmark, depending on whether it is run alone or with the
+        other V8 benchmarks.
+
+        * kjs/Arguments.cpp:
+        (JSC::ArgumentsData::ArgumentsData):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::mark):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - speed up instanceof some more
+        https://bugs.webkit.org/show_bug.cgi?id=20818
+        
+        ~2% speedup on EarleyBoyer
+
+        The idea here is to record in the StructureID whether the class
+        needs a special hasInstance or if it can use the normal logic from
+        JSObject. 
+        
+        Based on this I inlined the real work directly into
+        cti_op_instanceof and put the fastest checks up front and the
+        error handling at the end (so it should be fairly straightforward
+        to split off the beginning to be inlined if desired).
+
+        I only did this for CTI, not the bytecode interpreter.
+        
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructureID):
+        * ChangeLog:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_instanceof):
+        * kjs/JSImmediate.h:
+        (JSC::JSImmediate::isAnyImmediate):
+        * kjs/TypeInfo.h:
+        (JSC::TypeInfo::overridesHasInstance):
+        (JSC::TypeInfo::flags):
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21019
+          make FunctionBodyNode::ref/deref fast
+
+        Speeds up v8-raytrace by 7.2%.
+
+        * kjs/nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode): Initialize m_refCount to 0.
+        * kjs/nodes.h:
+        (JSC::FunctionBodyNode::ref): Call base class ref once, and thereafter use
+        m_refCount.
+        (JSC::FunctionBodyNode::deref): Ditto, but the deref side.
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Pointed out by Sam Weinig.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::fillArgList): Fix bad copy and paste. Oops!
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20983
+          ArgumentsData should have some room to allocate some extra arguments inline
+
+        Speeds up v8-raytrace by 5%.
+
+        * kjs/Arguments.cpp:
+        (JSC::ArgumentsData::ArgumentsData): Use a fixed buffer if there are 4 or fewer
+        extra arguments.
+        (JSC::Arguments::Arguments): Use a fixed buffer if there are 4 or fewer
+        extra arguments.
+        (JSC::Arguments::~Arguments): Delete the buffer if necessary.
+        (JSC::Arguments::mark): Update since extraArguments are now Register.
+        (JSC::Arguments::fillArgList): Added special case for the only case that's
+        actually used in the practice, when there are no parameters. There are some
+        other special cases in there too, but that's the only one that matters.
+        (JSC::Arguments::getOwnPropertySlot): Updated to use setValueSlot since there's
+        no operation to get you at the JSValue* inside a Register as a "slot".
+
+2008-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=21014
+        Speed up for..in by using StructureID to avoid calls to hasProperty
+
+        Speeds up fasta by 8%.
+
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::invalidate):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next):
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::begin):
+        (JSC::PropertyNameArrayData::end):
+        (JSC::PropertyNameArrayData::setCachedStructureID):
+        (JSC::PropertyNameArrayData::cachedStructureID):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::structureIDChainsAreEqual):
+        * kjs/StructureID.h:
+
+2008-09-22  Kelvin Sherlock  <ksherlock@gmail.com>
+
+        Updated and tweaked by Sam Weinig.
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 20020: Proposed enhancement to JavaScriptCore API
+        <https://bugs.webkit.org/show_bug.cgi?id=20020>
+
+        Add JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError, and JSObjectMakeRegExp
+        functions to create JavaScript Array, Date, Error, and RegExp objects, respectively.
+
+        * API/JSObjectRef.cpp: The functions
+        * API/JSObjectRef.h: Function prototype and documentation
+        * JavaScriptCore.exp: Added functions to exported function list
+        * API/tests/testapi.c: Added basic functionality tests.
+
+        * kjs/DateConstructor.cpp:
+        Replaced static JSObject* constructDate(ExecState* exec, JSObject*, const ArgList& args)
+        with JSObject* constructDate(ExecState* exec, const ArgList& args).
+        Added static JSObject* constructWithDateConstructor(ExecState* exec, JSObject*, const ArgList& args) function
+
+        * kjs/DateConstructor.h:
+        added prototype for JSObject* constructDate(ExecState* exec, const ArgList& args)
+
+        * kjs/ErrorConstructor.cpp:
+        removed static qualifier from ErrorInstance* constructError(ExecState* exec, const ArgList& args)
+
+        * kjs/ErrorConstructor.h:
+        added prototype for ErrorInstance* constructError(ExecState* exec, const ArgList& args)
+
+        * kjs/RegExpConstructor.cpp:
+        removed static qualifier from JSObject* constructRegExp(ExecState* exec, const ArgList& args)
+
+        * kjs/RegExpConstructor.h:
+        added prototype for JSObject* constructRegExp(ExecState* exec, const ArgList& args)
+
+2008-09-22  Matt Lilek  <webkit@mattlilek.com>
+
+        Not reviewed, Windows build fix.
+
+        * kjs/Arguments.cpp:
+        * kjs/FunctionPrototype.cpp:
+
+2008-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=20982
+        Speed up the apply method of functions by special-casing array and 'arguments' objects
+
+        1% speedup on v8-raytrace.
+
+        Test: fast/js/function-apply.html
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::fillArgList):
+        * kjs/Arguments.h:
+        * kjs/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * kjs/JSArray.cpp:
+        (JSC::JSArray::fillArgList):
+        * kjs/JSArray.h:
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20993
+          Array.push/pop need optimized cases for JSArray
+
+        3% or so speedup on DeltaBlue benchmark.
+
+        * kjs/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop): Call JSArray::pop when appropriate.
+        (JSC::arrayProtoFuncPush): Call JSArray::push when appropriate.
+
+        * kjs/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Set m_fastAccessCutoff when appropriate, getting
+        us into the fast code path.
+        (JSC::JSArray::pop): Added.
+        (JSC::JSArray::push): Added.
+        * kjs/JSArray.h: Added push and pop.
+
+        * kjs/operations.cpp:
+        (JSC::throwOutOfMemoryError): Don't inline this. Helps us avoid PIC branches.
+
+2008-09-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag
+
+        Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>
+        
+        2.2% speedup on EarleyBoyer benchmark.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructureID):
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructureID):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructureID):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance):
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor):
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_instanceof):
+        * kjs/InternalFunction.cpp:
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::createStructureID):
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/TypeInfo.h:
+        (JSC::TypeInfo::implementsHasInstance):
+
+2008-09-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        Based on initial work by Darin Adler.
+        
+        - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
+        - use this to JIT inline code for eq_null and neq_null
+        https://bugs.webkit.org/show_bug.cgi?id=20823
+
+        0.5% speedup on SunSpider
+        ~4% speedup on Richards benchmark
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/Machine.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_is_undefined):
+        * VM/Machine.h:
+        * kjs/JSCell.h:
+        * kjs/JSValue.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructureID):
+        * kjs/StructureID.h:
+        (JSC::StructureID::mutableTypeInfo):
+        * kjs/TypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::masqueradesAsUndefined):
+        * kjs/operations.cpp:
+        (JSC::equal):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::setne_r):
+        (JSC::X86Assembler::setnz_r):
+        (JSC::X86Assembler::testl_i32m):
+
+2008-09-22  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Initialize QCoreApplication in kjs binary/Shell.cpp
+        
+        This allows us to use QCoreApplication::instance() to
+        get the main thread in ThreadingQt.cpp
+
+        * kjs/Shell.cpp:
+        (main):
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading):
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        - blind attempt to fix non-all-in-one builds
+
+        * kjs/JSGlobalObject.cpp: Added includes of Arguments.h and RegExpObject.h.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        - fix debug build
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::addPropertyTransition): Use typeInfo().type() instead of m_type.
+        (JSC::StructureID::createCachedPrototypeChain): Ditto.
+
+2008-09-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
+        https://bugs.webkit.org/show_bug.cgi?id=20981
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        * VM/Machine.cpp:
+        (JSC::jsIsObjectType):
+        (JSC::Machine::Machine):
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSCell.h:
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * kjs/JSGlobalObject.h:
+        (JSC::StructureID::prototypeForLookup):
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructureID):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        * kjs/JSObject.h:
+        (JSC::JSObject::createStructureID):
+        * kjs/JSString.h:
+        (JSC::JSString::createStructureID):
+        * kjs/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpMatchesArray.h: Added.
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::getPropertyNames):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        (JSC::StructureID::toDictionaryTransition):
+        (JSC::StructureID::changePrototypeTransition):
+        (JSC::StructureID::getterSetterTransition):
+        * kjs/StructureID.h:
+        (JSC::StructureID::create):
+        (JSC::StructureID::typeInfo):
+        * kjs/TypeInfo.h: Added.
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::type):
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - fix crash logging into Gmail due to recent Arguments change
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::Arguments): Fix window where mark() function could
+        see d->extraArguments with uninitialized contents.
+        (JSC::Arguments::mark): Check d->extraArguments for 0 to handle two
+        cases: 1) Inside the constructor before it's initialized.
+        2) numArguments <= numParameters.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        - fix loose end from the "duplicate constant values" patch
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitLoad): Add a special case for values the
+        hash table can't handle.
+
+2008-09-21  Mark Rowe  <mrowe@apple.com>
+
+        Fix the non-AllInOneFile build.
+
+        * kjs/Arguments.cpp: Add missing #include.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich and Mark Rowe.
+
+        - fix test failure caused by my recent IndexToNameMap patch
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::deleteProperty): Added the accidentally-omitted
+        check of the boolean result from toArrayIndex.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20975
+          inline immediate-number case of ==
+
+        * VM/CTI.h: Renamed emitJumpSlowCaseIfNotImm to
+        emitJumpSlowCaseIfNotImmNum, since the old name was incorrect.
+
+        * VM/CTI.cpp: Updated for new name.
+        (JSC::CTI::privateCompileMainPass): Added op_eq.
+        (JSC::CTI::privateCompileSlowCases): Added op_eq.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_eq): Removed fast case, since it's now
+        compiled.
+
+2008-09-21  Peter Gal  <galpter@inf.u-szeged.hu>
+
+        Reviewed by Tim Hatcher and Eric Seidel.
+
+        Fix the QT/Linux JavaScriptCore segmentation fault.
+        https://bugs.webkit.org/show_bug.cgi?id=20914
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading): Use currentThread() if
+        platform is not a MAC (like in pre 36541 revisions)
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * kjs/debugger.h: Removed some unneeded includes and declarations.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20972
+          speed up Arguments further by eliminating the IndexToNameMap
+
+        No change on SunSpider. 1.29x as fast on V8 Raytrace.
+
+        * kjs/Arguments.cpp: Moved ArgumentsData in here. Eliminated the
+        indexToNameMap and hadDeletes data members. Changed extraArguments into
+        an OwnArrayPtr and added deletedArguments, another OwnArrayPtr.
+        Replaced numExtraArguments with numParameters, since that's what's
+        used more directly in hot code paths.
+        (JSC::Arguments::Arguments): Pass in argument count instead of ArgList.
+        Initialize ArgumentsData the new way.
+        (JSC::Arguments::mark): Updated.
+        (JSC::Arguments::getOwnPropertySlot): Overload for the integer form so
+        we don't have to convert integers to identifiers just to get an argument.
+        Integrated the deleted case with the fast case.
+        (JSC::Arguments::put): Ditto.
+        (JSC::Arguments::deleteProperty): Ditto.
+
+        * kjs/Arguments.h: Minimized includes. Made everything private. Added
+        overloads for the integral property name case. Eliminated mappedIndexSetter.
+        Moved ArgumentsData into the .cpp file.
+
+        * kjs/IndexToNameMap.cpp: Emptied out and prepared for deletion.
+        * kjs/IndexToNameMap.h: Ditto.
+
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::createArgumentsObject): Elminated ArgList.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        Removed IndexToNameMap.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitLoad): One more tweak: Wrote this in a slightly
+        clearer style.
+
+2008-09-21  Judit Jasz  <jasy@inf.u-szeged.hu>
+
+        Reviewed and tweaked by Darin Adler.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20645
+          Elminate duplicate constant values in CodeBlocks.
+
+        Seems to be a wash on SunSpider.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitLoad): Use m_numberMap and m_stringMap to guarantee
+        we emit the same JSValue* for identical numbers and strings.
+        * VM/CodeGenerator.h: Added overload of emitLoad for const Identifier&.
+        Add NumberMap and IdentifierStringMap types and m_numberMap and m_stringMap.
+        * kjs/nodes.cpp:
+        (JSC::StringNode::emitCode): Call the new emitLoad and let it do the
+        JSString creation.
+
+2008-09-21  Paul Pedriana  <webkit@pedriana.com>
+
+        Reviewed and tweaked by Darin Adler.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=16925
+          Fixed lack of Vector buffer alignment for both GCC and MSVC.
+          Since there's no portable way to do this, for now we don't support
+          other compilers.
+
+        * wtf/Vector.h: Added WTF_ALIGH_ON, WTF_ALIGNED, AlignedBufferChar, and AlignedBuffer.
+        Use AlignedBuffer insteadof an array of char in VectorBuffer.
+
+2008-09-21  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19408
+          Add lightweight constant folding to the parser for *, /, + (only for numbers), <<, >>, ~ operators.
+
+        1.008x as fast on SunSpider.
+
+        * kjs/grammar.y:
+        (makeNegateNode): Fold if expression is a number > 0.
+        (makeBitwiseNotNode): Fold if expression is a number.
+        (makeMultNode): Fold if expressions are both numbers.
+        (makeDivNode): Fold if expressions are both numbers.
+        (makeAddNode): Fold if expressions are both numbers.
+        (makeLeftShiftNode): Fold if expressions are both numbers.
+        (makeRightShiftNode): Fold if expressions are both numbers.
+
+2008-09-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - speed up === operator by generating inline machine code for the fast paths
+        https://bugs.webkit.org/show_bug.cgi?id=20820
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitJumpSlowCaseIfNotImmediateNumber):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmediateNumbers):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmediates):
+        (JSC::CTI::emitTagAsBoolImmediate):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_stricteq):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::sete_r):
+        (JSC::X86Assembler::setz_r):
+        (JSC::X86Assembler::movzbl_rr):
+        (JSC::X86Assembler::emitUnlinkedJnz):
+
+2008-09-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Free memory allocated for extra arguments in the destructor of the
+        Arguments object.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::~Arguments):
+        * kjs/Arguments.h:
+
+2008-09-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20815: 'arguments' object creation is non-optimal
+        <https://bugs.webkit.org/show_bug.cgi?id=20815>
+
+        Fix our inefficient way of creating the arguments object by only
+        creating named properties for each of the arguments after a use of the
+        'delete' statement. This patch also speeds up access to the 'arguments'
+        object slightly, but it still does not use the array fast path for
+        indexed access that exists for many opcodes.
+
+        This is about a 20% improvement on the V8 Raytrace benchmark, and a 1.5%
+        improvement on the Earley-Boyer benchmark, which gives a 4% improvement
+        overall.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::mark):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * kjs/Arguments.h:
+        (JSC::Arguments::ArgumentsData::ArgumentsData):
+        * kjs/IndexToNameMap.h:
+        (JSC::IndexToNameMap::size):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::createArgumentsObject):
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::uncheckedSymbolTableGet):
+        (JSC::JSActivation::uncheckedSymbolTableGetValue):
+        (JSC::JSActivation::uncheckedSymbolTablePut):
+        * kjs/JSFunction.h:
+        (JSC::JSFunction::numParameters):
+
+2008-09-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix crash seen on buildbot
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::mark): Add back mark of arrayPrototype,
+        deleted by accident in my recent check-in.
+
+2008-09-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+        
+        - speculative fix for non-AllInOne builds
+
+        * kjs/operations.h:
+
+2008-09-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        - assorted optimizations to === and !== operators
+        (work towards <https://bugs.webkit.org/show_bug.cgi?id=20820>)
+        
+        2.5% speedup on earley-boyer test
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_stricteq): Use inline version of
+        strictEqualSlowCase; remove unneeded exception check.
+        (JSC::Machine::cti_op_nstricteq): ditto
+        * kjs/operations.cpp:
+        (JSC::strictEqual): Use strictEqualSlowCaseInline
+        (JSC::strictEqualSlowCase): ditto
+        * kjs/operations.h:
+        (JSC::strictEqualSlowCaseInline): Version of strictEqualSlowCase that can be inlined,
+        since the extra function call indirection is a lose for CTI.
+
+2008-09-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - finish https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+        This also includes some optimizations that make the change an overall
+        small speedup. Without those it was a bit of a slowdown.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor): Take a structure.
+        * API/JSCallbackConstructor.h: Ditto.
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction): Pass a structure.
+        * API/JSCallbackObject.h: Take a structure.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::JSCallbackObject): Ditto.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype): Pass in a structure. Call setPrototype
+        if there's a custom prototype involved.
+        * API/JSObjectRef.cpp:
+        (JSObjectMake): Ditto.
+        (JSObjectMakeConstructor): Pass in a structure.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/Machine.cpp:
+        (JSC::jsLess): Added a special case for when both arguments are strings.
+        This avoids converting both strings to with UString::toDouble.
+        (JSC::jsLessEq): Ditto.
+        (JSC::Machine::privateExecute): Pass in a structure.
+        (JSC::Machine::cti_op_construct_JSConstruct): Ditto.
+        (JSC::Machine::cti_op_new_regexp): Ditto.
+        (JSC::Machine::cti_op_is_string): Ditto.
+        * VM/Machine.h: Made isJSString public so it can be used in the CTI.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::Arguments): Pass in a structure.
+
+        * kjs/JSCell.h: Mark constructor explicit.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::markIfNeeded): Added an overload for marking structures.
+        (JSC::JSGlobalObject::reset): Eliminate code to set data members to
+        zero. We now do that in the constructor, and we no longer use this
+        anywhere except in the constructor. Added code to create structures.
+        Pass structures rather than prototypes when creating objects.
+        (JSC::JSGlobalObject::mark): Mark the structures.
+
+        * kjs/JSGlobalObject.h: Removed unneeded class declarations.
+        Added initializers for raw pointers in JSGlobalObjectData so
+        everything starts with a 0. Added structure data and accessor
+        functions.
+
+        * kjs/JSImmediate.cpp:
+        (JSC::JSImmediate::nonInlineNaN): Added.
+        * kjs/JSImmediate.h:
+        (JSC::JSImmediate::toDouble): Rewrote to avoid PIC branches.
+
+        * kjs/JSNumberCell.cpp:
+        (JSC::jsNumberCell): Made non-inline to avoid PIC branches
+        in functions that call this one.
+        (JSC::jsNaN): Ditto.
+        * kjs/JSNumberCell.h: Ditto.
+
+        * kjs/JSObject.h: Removed constructor that takes a prototype.
+        All callers now pass structures.
+
+        * kjs/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * kjs/ArrayConstructor.h:
+        * kjs/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * kjs/ArrayPrototype.h:
+        * kjs/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * kjs/BooleanPrototype.h:
+        * kjs/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::constructDate):
+        * kjs/DateConstructor.h:
+        * kjs/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * kjs/DateInstance.h:
+        * kjs/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * kjs/DatePrototype.h:
+        * kjs/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        (JSC::constructError):
+        * kjs/ErrorConstructor.h:
+        * kjs/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * kjs/ErrorInstance.h:
+        * kjs/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * kjs/ErrorPrototype.h:
+        * kjs/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * kjs/FunctionConstructor.h:
+        * kjs/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * kjs/FunctionPrototype.h:
+        * kjs/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        * kjs/GlobalEvalFunction.h:
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * kjs/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        * kjs/JSArray.h:
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::construct):
+        * kjs/JSObject.cpp:
+        (JSC::constructEmptyObject):
+        * kjs/JSString.cpp:
+        (JSC::StringObject::create):
+        * kjs/JSWrapperObject.h:
+        * kjs/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * kjs/MathObject.h:
+        * kjs/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * kjs/NativeErrorConstructor.h:
+        * kjs/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * kjs/NativeErrorPrototype.h:
+        * kjs/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        (JSC::constructNumber):
+        (JSC::constructNumberFromImmediateNumber):
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * kjs/NumberPrototype.h:
+        * kjs/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::constructObject):
+        * kjs/ObjectConstructor.h:
+        * kjs/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * kjs/ObjectPrototype.h:
+        * kjs/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * kjs/PrototypeFunction.h:
+        * kjs/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::constructRegExp):
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * kjs/RegExpPrototype.h:
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+        * kjs/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        (JSC::constructWithStringConstructor):
+        * kjs/StringConstructor.h:
+        * kjs/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * kjs/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * kjs/StringPrototype.h:
+        Take and pass structures.
+
+2008-09-19  Alp Toker  <alp@nuanti.com>
+
+        Build fix for the 'gold' linker and recent binutils. New behaviour
+        requires that we link to used libraries explicitly.
+
+        * GNUmakefile.am:
+
+2008-09-19  Sam Weinig  <sam@webkit.org>
+
+        Roll r36694 back in.  It did not cause the crash.
+
+        * JavaScriptCore.exp:
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::invalidate):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h:
+        * kjs/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::create):
+        (JSC::PropertyNameArrayData::propertyNameVector):
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        (JSC::PropertyNameArrayData::cachedPrototypeChain):
+        (JSC::PropertyNameArrayData::begin):
+        (JSC::PropertyNameArrayData::end):
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::operator[]):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end):
+        (JSC::PropertyNameArray::setData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::releaseData):
+        * kjs/StructureID.cpp:
+        (JSC::structureIDChainsAreEqual):
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::StructureID::clearEnumerationCache):
+        (JSC::StructureID::createCachedPrototypeChain):
+        * kjs/StructureID.h:
+
+2008-09-19  Sam Weinig  <sam@webkit.org>
+
+        Roll out r36694.
+
+        * JavaScriptCore.exp:
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::invalidate):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h:
+        * kjs/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::operator[]):
+        (JSC::PropertyNameArray::releaseIdentifiers):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+        * kjs/StructureID.h:
+        (JSC::StructureID::clearEnumerationCache):
+
+2008-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Improve peformance of local variable initialisation.
+
+        Pull local and constant initialisation out of slideRegisterWindowForCall
+        and into its own opcode.  This allows the JIT to generate the initialisation
+        code for a function directly into the instruction stream and so avoids a few
+        branches on function entry.
+
+        Results a 1% progression in SunSpider, particularly in a number of the bitop
+        tests where the called functions are very fast. 
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitInitialiseRegister):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (JSC::slideRegisterWindowForCall):
+        (JSC::Machine::privateExecute):
+        * VM/Opcode.h:
+
+2008-09-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=20928
+        Speed up JS property enumeration by caching entire PropertyNameArray
+
+        1.3% speedup on Sunspider, 30% on string-fasta.
+
+        * JavaScriptCore.exp:
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::invalidate):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h:
+        * kjs/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::create):
+        (JSC::PropertyNameArrayData::propertyNameVector):
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        (JSC::PropertyNameArrayData::cachedPrototypeChain):
+        (JSC::PropertyNameArrayData::begin):
+        (JSC::PropertyNameArrayData::end):
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::operator[]):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end):
+        (JSC::PropertyNameArray::setData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::releaseData):
+        * kjs/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * kjs/StructureID.cpp:
+        (JSC::structureIDChainsAreEqual):
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::StructureID::clearEnumerationCache):
+        (JSC::StructureID::createCachedPrototypeChain):
+        * kjs/StructureID.h:
+
+2008-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix a mismatched new[]/delete in JSObject::allocatePropertyStorage
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage): Spotted by valgrind.
+
+2008-09-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - part 2 of https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+        * JavaScriptCore.exp: Exported constructEmptyObject for use in WebCore.
+
+        * kjs/JSGlobalObject.h: Changed the protected constructor to take a
+        structure instead of a prototype.
+
+        * kjs/JSVariableObject.h: Removed constructor that takes a prototype.
+
+2008-09-19  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use the template hoisting technique on the RefCounted class. This reduces the code bloat due to
+        non-template methods' code been copied for each instance of the template.
+        The patch splits RefCounted between a base class that holds non-template methods and attributes
+        and the template RefCounted class that keeps the same functionnality.
+
+        On my Linux with gcc 4.3 for the Gtk port, this is:
+        - a ~600KB save on libwebkit.so in release.
+        - a ~1.6MB save on libwebkit.so in debug.
+
+        It is a wash on Sunspider and a small win on Dromaeo (not sure it is relevant).
+        On the whole, it should be a small win as we reduce the compiled code size and the only
+        new function call should be inlined by the compiler.
+
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Copied from RefCounted.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::RefCountedBase): Ditto.
+        (WTF::RefCountedBase::~RefCountedBase): Ditto.
+        (WTF::RefCountedBase::derefBase): Tweaked from the RefCounted version to remove
+        template section.
+        (WTF::RefCounted::RefCounted):
+        (WTF::RefCounted::deref): Small wrapper around RefCountedBase::derefBase().
+        (WTF::RefCounted::~RefCounted): Keep private destructor.
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - part 1 of https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+        * kjs/lookup.h: Removed things here that were used only in WebCore:
+        cacheGlobalObject, JSC_DEFINE_PROTOTYPE, JSC_DEFINE_PROTOTYPE_WITH_PROTOTYPE,
+        and JSC_IMPLEMENT_PROTOTYPE.
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20927
+          simplify/streamline the code to turn strings into identifiers while parsing
+
+        * kjs/grammar.y: Get rid of string from the union, and use ident for STRING as
+        well as for IDENT.
+
+        * kjs/lexer.cpp:
+        (JSC::Lexer::lex): Use makeIdentifier instead of makeUString for String.
+        * kjs/lexer.h: Remove makeUString.
+
+        * kjs/nodes.h: Changed StringNode to hold an Identifier instead of UString.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch): Updated since StringNode now holds an Identifier.
+        (JSC::prepareJumpTableForStringSwitch): Ditto.
+        * kjs/nodes.cpp:
+        (JSC::StringNode::emitCode): Ditto. The comment from here is now in the lexer.
+        (JSC::processClauseList): Ditto.
+        * kjs/nodes2string.cpp:
+        (JSC::StringNode::streamTo): Ditto.
+
+2008-09-18  Sam Weinig  <sam@webkit.org>
+
+        Fix style.
+
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+
+2008-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20911: REGRESSION(r36480?): Reproducible assertion failure below derefStructureIDs 64-bit JavaScriptCore
+        <https://bugs.webkit.org/show_bug.cgi?id=20911>
+
+        The problem was simply caused by the int constructor for Instruction
+        failing to initialise the full struct in 64bit builds.
+
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        - fix release build
+
+        * wtf/RefCountedLeakCounter.cpp: Removed stray "static".
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * kjs/JSGlobalObject.h: Tiny style guideline tweak.
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20925
+          LEAK messages appear every time I quit
+
+        * JavaScriptCore.exp: Updated, and also added an export
+        needed for future WebCore use of JSC::StructureID.
+
+        * wtf/RefCountedLeakCounter.cpp:
+        (WTF::RefCountedLeakCounter::suppressMessages): Added.
+        (WTF::RefCountedLeakCounter::cancelMessageSuppression): Added.
+        (WTF::RefCountedLeakCounter::RefCountedLeakCounter): Tweaked a bit.
+        (WTF::RefCountedLeakCounter::~RefCountedLeakCounter): Added code to
+        log the reason there was no leak checking done.
+        (WTF::RefCountedLeakCounter::increment): Tweaked a bit.
+        (WTF::RefCountedLeakCounter::decrement): Ditto.
+
+        * wtf/RefCountedLeakCounter.h: Replaced setLogLeakMessages with two
+        new functions, suppressMessages and cancelMessageSuppression. Also
+        added m_ prefixes to the data member names.
+
+2008-09-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20437
+
+        Add a proper #define to define which XML Parser implementation to use. Client
+        code can use #if USE(QXMLSTREAM) to decide if the Qt XML StreamReader
+        implementation is going to be used.
+
+        * wtf/Platform.h:
+
+2008-09-18  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make a Unicode non-breaking space count as a whitespace character in
+        PCRE. This change was already made in WREC, and it fixes one of the
+        Mozilla JS tests. Since it is now fixed in PCRE as well, we can check
+        in a new set of expected test results.
+
+        * pcre/pcre_internal.h:
+        (isSpaceChar):
+        * tests/mozilla/expected.html:
+
+2008-09-18  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Mark Rowe and Maciej Stachowiak.
+
+        add an option use arch to specify which architecture to run.
+
+        * tests/mozilla/jsDriver.pl:
+
+2008-09-17  Oliver Hunt  <oliver@apple.com>
+
+        Correctly restore argument reference prior to SFX runtime calls.
+        
+        Reviewed by Steve Falkenburg.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+
+2008-09-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20876: REGRESSION (r36417, r36427): fast/js/exception-expression-offset.html fails
+        <https://bugs.webkit.org/show_bug.cgi?id=20876>
+
+        r36417 and r36427 caused an get_by_id opcode to be emitted before the
+        instanceof and construct opcodes, in order to enable inline caching of
+        the prototype property. Unfortunately, this regressed some tests dealing
+        with exceptions thrown by 'instanceof' and the 'new' operator. We fix
+        these problems by detecting whether an "is not an object" exception is
+        thrown before op_instanceof or op_construct, and emit the proper
+        exception in those cases.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/CodeGenerator.h:
+        * VM/ExceptionHelpers.cpp:
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAnObjectError):
+        * VM/ExceptionHelpers.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::getOpcode):
+        (JSC::Machine::privateExecute):
+        * VM/Machine.h:
+        * kjs/nodes.cpp:
+        (JSC::NewExprNode::emitCode):
+        (JSC::InstanceOfNode::emitCode):
+
+2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JIT generation cti_op_construct_verify.
+        
+        Quarter to half percent progression on v8-tests.
+        Roughly not change on SunSpider (possible minor progression).
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+
+2008-09-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Improve timer accuracy for JavaScript Date object on Windows.
+        
+        Use a combination of ftime and QueryPerformanceCounter.
+        ftime returns the information we want, but doesn't have sufficient resolution.
+        QueryPerformanceCounter has high resolution, but is only usable to measure time intervals.
+        To combine them, we call ftime and QueryPerformanceCounter initially. Later calls will use
+        QueryPerformanceCounter by itself, adding the delta to the saved ftime.  We re-sync to
+        correct for drift if the low-res and high-res elapsed time between calls differs by more
+        than twice the low-resolution timer resolution.
+        
+        QueryPerformanceCounter may be inaccurate due to a problems with:
+        - some PCI bridge chipsets (http://support.microsoft.com/kb/274323)
+        - BIOS bugs (http://support.microsoft.com/kb/895980/)
+        - BIOS/HAL bugs on multiprocessor/multicore systems (http://msdn.microsoft.com/en-us/library/ms644904.aspx)
+        
+        Reviewed by Darin Adler.
+
+        * kjs/DateMath.cpp:
+        (JSC::highResUpTime):
+        (JSC::lowResUTCTime):
+        (JSC::qpcAvailable):
+        (JSC::getCurrentUTCTimeWithMicroseconds):
+
+2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement JIT generation of CallFrame initialization, for op_call.
+
+        1% sunspider 2.5% v8-tests.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+
+2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Optimizations for op_call in CTI.  Move check for (ctiCode == 0) into JIT code,
+        move copying of scopeChain for CodeBlocks that needFullScopeChain into head of
+        functions, instead of checking prior to making the call.
+
+        3% on v8-tests (4% on richards, 6% in delta-blue)
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/Machine.cpp:
+        (JSC::Machine::execute):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_vm_updateScopeChain):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+
+2008-09-17  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Fix the QtWebKit/Mac build
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading): use QCoreApplication to get the main thread
+
+2008-09-16  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20857: REGRESSION (r36427): ASSERTION FAILED: m_refCount >= 0 in RegisterID::deref()
+        <https://bugs.webkit.org/show_bug.cgi?id=20857>
+
+        Fix a problem stemming from the slightly unsafe behaviour of the
+        CodeGenerator::finalDestination() method by putting the "func" argument
+        of the emitConstruct() method in a RefPtr in its caller. Also, add an
+        assertion guaranteeing that this is always the case.
+
+        CodeGenerator::finalDestination() is still incorrect and can cause
+        problems with a different allocator; see bug 20340 for more details.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitConstruct):
+        * kjs/nodes.cpp:
+        (JSC::NewExprNode::emitCode):
+
+2008-09-16  Alice Liu  <alice.liu@apple.com>
+
+        build fix.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+
+2008-09-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        CTI code generation for op_ret.  The majority of the work
+        (updating variables on the stack & on exec) can be performed
+        directly in generated code.
+
+        We still need to check, & to call out to C-code to handle
+        activation records, profiling, and full scope chains.
+
+        +1.5% Sunspider, +5/6% v8 tests.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_ret_activation):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        * VM/Machine.h:
+
+2008-09-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Fix the Windows build.
+
+        Add some extra parentheses to stop MSVC from complaining so much.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        * kjs/operations.cpp:
+        (JSC::strictEqual):
+
+2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - speed up the === and !== operators by choosing the fast cases better
+        
+        No effect on SunSpider but speeds up the V8 EarlyBoyer benchmark about 4%.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        * kjs/JSImmediate.h:
+        (JSC::JSImmediate::areBothImmediate):
+        * kjs/operations.cpp:
+        (JSC::strictEqual):
+        (JSC::strictEqualSlowCase):
+        * kjs/operations.h:
+
+2008-09-15  Oliver Hunt  <oliver@apple.com>
+
+        RS=Sam Weinig.
+
+        Coding style cleanup.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-09-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 20874: op_resolve does not do any form of caching
+        <https://bugs.webkit.org/show_bug.cgi?id=20874>
+
+        This patch adds an op_resolve_global opcode to handle (and cache)
+        property lookup we can statically determine must occur on the global
+        object (if at all).
+
+        3% progression on sunspider, 3.2x improvement to bitops-bitwise-and, and
+        10% in math-partial-sums
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::findScopedProperty):
+        (JSC::CodeGenerator::emitResolve):
+        * VM/Machine.cpp:
+        (JSC::resolveGlobal):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_resolve_global):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+
+2008-09-15  Sam Weinig  <sam@webkit.org>
+
+        Roll out r36462.  It broke document.all.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+        (JSC::Machine::cti_op_eq_null):
+        (JSC::Machine::cti_op_neq_null):
+        * VM/Machine.h:
+        (JSC::Machine::isJSString):
+        * kjs/JSCell.h:
+        * kjs/JSWrapperObject.h:
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+
+2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20863: ASSERTION FAILED: addressOffset < instructions.size() in CodeBlock::getHandlerForVPC
+        <https://bugs.webkit.org/show_bug.cgi?id=20863>
+
+        r36427 changed the number of arguments to op_construct without changing
+        the argument index for the vPC in the call to initializeCallFrame() in
+        the CTI case. This caused a JSC test failure. Correcting the argument
+        index fixes the test failure.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_construct_JSConstruct):
+
+2008-09-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix GCC 4.2 build.
+
+        * VM/CTI.h:
+
+2008-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed a typo in op_get_by_id_chain that caused it to miss every time
+        in the interpreter.
+        
+        Also, a little cleanup.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Set up baseObject before entering the
+        loop, so we compare against the right values.
+
+2008-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed the CalledAsConstructor flag from the call frame header. Now,
+        we use an explicit opcode at the call site to fix up constructor results.
+
+        SunSpider says 0.4% faster.
+        
+        cti_op_construct_verify is an out-of-line function call for now, but we
+        can fix that once StructureID holds type information like isObject.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Codegen for the new opcode.
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+        * VM/CodeGenerator.cpp: Codegen for the new opcode. Also...
+        (JSC::CodeGenerator::emitCall): ... don't test for known non-zero value.
+        (JSC::CodeGenerator::emitConstruct): ... ditto.
+
+        * VM/Machine.cpp: No more CalledAsConstructor
+        (JSC::Machine::privateExecute): Implementation for the new opcode.
+        (JSC::Machine::cti_op_ret): The speedup: no need to check whether we were
+        called as a constructor.
+        (JSC::Machine::cti_op_construct_verify): Implementation for the new opcode.
+        * VM/Machine.h:
+
+        * VM/Opcode.h: Declare new opcode.
+
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::): No more CalledAsConstructor
+
+2008-09-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Inline code generation of eq_null/neq_null for CTI.  Uses vptr checking for
+        StringObjectsThatAreMasqueradingAsBeingUndefined.  In the long run, the
+        masquerading may be handled differently (through the StructureIDs - see bug
+        #20823).
+
+        >1% on v8-tests.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitJumpSlowCaseIfIsJSCell):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+        (JSC::Machine::cti_op_eq_null):
+        (JSC::Machine::cti_op_neq_null):
+        * VM/Machine.h:
+        (JSC::Machine::doesMasqueradesAsUndefined):
+        * kjs/JSWrapperObject.h:
+        (JSC::JSWrapperObject::):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * kjs/StringObject.h:
+        (JSC::StringObject::StringObject):
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+
+2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Oliver Hunt.
+
+        r36427 broke CodeBlock::dump() by changing the number of arguments to
+        op_construct without changing the code that prints it. This patch fixes
+        it by printing the additional argument.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2008-09-15  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * kjs/StructureID.cpp: Removed a stray semicolon.
+
+2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix a crash in fast/js/exception-expression-offset.html caused by not
+        updating all mentions of the length of op_construct in r36427.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+
+2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix layout test failure introduced by fix for 20849
+        
+        (The failing test was fast/js/delete-then-put.html)
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::removeDirect): Clear enumeration cache
+        in the dictionary case.
+        * kjs/JSObject.h:
+        (JSC::JSObject::putDirect): Ditto.
+        * kjs/StructureID.h:
+        (JSC::StructureID::clearEnumerationCache): Inline to handle the
+        clear.
+
+2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix JSC test failures introduced by fix for 20849
+
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames): Use the correct count.
+
+2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20851: REGRESSION (r36410): fast/js/kde/GlobalObject.html fails
+        <https://bugs.webkit.org/show_bug.cgi?id=20851>
+
+        r36410 introduced an optimization for parseInt() that is incorrect when
+        its argument is larger than the range of a 32-bit integer. If the
+        argument is a number that is not an immediate integer, then the correct
+        behaviour is to return the floor of its value, unless it is an infinite
+        value, in which case the correct behaviour is to return 0.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2008-09-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=20849
+        Cache property names for getEnumerablePropertyNames in the StructureID.
+
+        ~0.5% speedup on Sunspider overall (9.7% speedup on string-fasta).  ~1% speedup
+        on the v8 test suite.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::getEnumerablePropertyNames):
+        * kjs/StructureID.h:
+
+2008-09-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - speed up JS construction by extracting "prototype" lookup so PIC applies.
+        
+        ~0.5% speedup on SunSpider
+        Speeds up some of the V8 tests as well, most notably earley-boyer.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall): Account for extra arg for prototype.
+        (JSC::CTI::privateCompileMainPass): Account for increased size of op_construct.
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitConstruct): Emit separate lookup to get prototype property.
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Expect prototype arg in op_construct.
+        (JSC::Machine::cti_op_construct_JSConstruct): ditto
+        (JSC::Machine::cti_op_construct_NotJSConstruct): ditto
+
+2008-09-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add a protected destructor for RefCounted.
+
+        It is wrong to call its destructor directly, because (1) this should be taken care of by
+        deref(), and (2) many classes that use RefCounted have non-virtual destructors.
+
+        No change in behavior.
+
+        * wtf/RefCounted.h: (WTF::RefCounted::~RefCounted):
+
+2008-09-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Accelerated property accesses.
+
+        Inline more of the array access code into the JIT code for get/put_by_val.
+        Accelerate get/put_by_id by speculatively inlining a disable direct access
+        into the hot path of the code, and repatch this with the correct StructureID
+        and property map offset once these are known.  In the case of accesses to the
+        prototype and reading the array-length a trampoline is genertaed, and the
+        branch to the slow-case is relinked to jump to this.
+
+        By repatching, we mean rewriting the x86 instruction stream.  Instructions are
+        only modified in a simple fasion - altering immediate operands, memory access
+        deisplacements, and branch offsets.
+        
+        For regular get_by_id/put_by_id accesses to an object, a StructureID in an
+        instruction's immediate operant is updateded, and a memory access operation's
+        displacement is updated to access the correct field on the object.  In the case
+        of more complex accesses (array length and get_by_id_prototype) the offset on
+        the branch to slow-case is updated, to now jump to a trampoline.
+
+        +2.8% sunspider, +13% v8-tests
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::CTI):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileArrayLengthTrampoline):
+        (JSC::CTI::privateCompileStringLengthTrampoline):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::privateCompilePatchGetStringLength):
+        * VM/CTI.h:
+        (JSC::CTI::compileGetByIdSelf):
+        (JSC::CTI::compileGetByIdProto):
+        (JSC::CTI::compileGetByIdChain):
+        (JSC::CTI::compilePutByIdReplace):
+        (JSC::CTI::compilePutByIdTransition):
+        (JSC::CTI::compileArrayLengthTrampoline):
+        (JSC::CTI::compileStringLengthTrampoline):
+        (JSC::CTI::compilePatchGetArrayLength):
+        (JSC::CTI::compilePatchGetStringLength):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        * VM/CodeBlock.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::CodeBlock::getStubInfo):
+        * VM/Machine.cpp:
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_put_by_val_array):
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpl_i8m):
+        (JSC::X86Assembler::emitUnlinkedJa):
+        (JSC::X86Assembler::getRelocatedAddress):
+        (JSC::X86Assembler::getDifferenceBetweenLabels):
+        (JSC::X86Assembler::emitModRm_opmsib):
+
+2008-09-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - split the "prototype" lookup for hasInstance into opcode stream so it can be cached
+        
+        ~5% speedup on v8 earley-boyer test
+
+        * API/JSCallbackObject.h: Add a parameter for the pre-looked-up prototype.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance): Ditto.
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor): Look up and pass in prototype.
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Pass along prototype.
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Print third arg.
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitInstanceOf): Implement this, now that there
+        is a third argument.
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Pass along the prototype.
+        (JSC::Machine::cti_op_instanceof): ditto
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::hasInstance): Expect to get a pre-looked-up prototype.
+        * kjs/JSObject.h:
+        * kjs/nodes.cpp:
+        (JSC::InstanceOfNode::emitCode): Emit a get_by_id of the prototype
+        property and pass that register to instanceof.
+        * kjs/nodes.h:
+
+2008-09-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove unnecessary virtual function call from cti_op_call_JSFunction -
+        ~5% on richards, ~2.5% on v8-tests, ~0.5% on sunspider.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+
+2008-09-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20827: the 'typeof' operator is slow
+        <https://bugs.webkit.org/show_bug.cgi?id=20827>
+
+        Optimize the 'typeof' operator when its result is compared to a constant
+        string.
+
+        This is a 5.5% speedup on the V8 Earley-Boyer test.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (JSC::BinaryOpNode::emitCode):
+        (JSC::EqualNode::emitCode):
+        (JSC::StrictEqualNode::emitCode):
+        * kjs/nodes.h:
+
+2008-09-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=20844
+        Speed up parseInt for numbers
+
+        Sunspider reports this as 1.029x as fast overall and 1.37x as fast on string-unpack-code.
+        No change on the v8 suite.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt): Don't convert numbers to strings just to
+        convert them back to numbers.
+
+2008-09-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20816: op_lesseq should be optimized
+        <https://bugs.webkit.org/show_bug.cgi?id=20816>
+
+        Add a loop_if_lesseq opcode that is similar to the loop_if_less opcode.
+
+        This is a 9.4% speedup on the V8 Crypto benchmark.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitJumpIfTrue):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+
+2008-09-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup Sampling code.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCall):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        (JSC::CTI::execute):
+        * VM/SamplingTool.cpp:
+        (JSC::):
+        (JSC::SamplingTool::run):
+        (JSC::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::callingHostFunction):
+
+2008-09-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 20821: Cache property transitions to speed up object initialization
+        https://bugs.webkit.org/show_bug.cgi?id=20821
+
+        Implement a transition cache to improve the performance of new properties
+        being added to objects.  This is extremely beneficial in constructors and
+        shows up as a 34% improvement on access-binary-trees in SunSpider (0.8%
+        overall)
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::):
+        (JSC::transitionWillNeedStorageRealloc):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        * VM/CTI.h:
+        (JSC::CTI::compilePutByIdTransition):
+        * VM/CodeBlock.cpp:
+        (JSC::printPutByIdOp):
+        (JSC::CodeBlock::printStructureIDs):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructureIDs):
+        (JSC::CodeBlock::refStructureIDs):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitPutById):
+        * VM/Machine.cpp:
+        (JSC::cachePrototypeChain):
+        (JSC::Machine::tryCachePutByID):
+        (JSC::Machine::tryCacheGetByID):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/JSObject.h:
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::transitionTo):
+        * kjs/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::wasTransition):
+        (JSC::PutPropertySlot::setWasTransition):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::transitionTo):
+        (JSC::StructureIDChain::StructureIDChain):
+        * kjs/StructureID.h:
+        (JSC::StructureID::previousID):
+        (JSC::StructureID::setCachedPrototypeChain):
+        (JSC::StructureID::cachedPrototypeChain):
+        (JSC::StructureID::propertyMap):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::addl_i8m):
+        (JSC::X86Assembler::subl_i8m):
+
+2008-09-12  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20819: JSValue::isObject() is slow
+        <https://bugs.webkit.org/show_bug.cgi?id=20819>
+
+        Optimize JSCell::isObject() and JSCell::isString() by making them
+        non-virtual calls that rely on the StructureID type information.
+
+        This is a 0.7% speedup on SunSpider and a 1.0% speedup on the V8
+        benchmark suite.
+
+        * JavaScriptCore.exp:
+        * kjs/JSCell.cpp:
+        * kjs/JSCell.h:
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        (JSC::JSString::JSString):
+        * kjs/StructureID.h:
+        (JSC::StructureID::type):
+
+2008-09-11  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn off PGO Optimization on CTI.cpp -> <rdar://problem/6207709>.  Fixes
+        crash on CNN and on Dromaeo.
+        Fix Missing close tag in vcproj. 
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-09-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Not reviewed.
+
+        Correct an SVN problem with the last commit and actually add the new
+        files.
+
+        * wrec/CharacterClassConstructor.cpp: Added.
+        (JSC::):
+        (JSC::getCharacterClassNewline):
+        (JSC::getCharacterClassDigits):
+        (JSC::getCharacterClassSpaces):
+        (JSC::getCharacterClassWordchar):
+        (JSC::getCharacterClassNondigits):
+        (JSC::getCharacterClassNonspaces):
+        (JSC::getCharacterClassNonwordchar):
+        (JSC::CharacterClassConstructor::addSorted):
+        (JSC::CharacterClassConstructor::addSortedRange):
+        (JSC::CharacterClassConstructor::put):
+        (JSC::CharacterClassConstructor::flush):
+        (JSC::CharacterClassConstructor::append):
+        * wrec/CharacterClassConstructor.h: Added.
+        (JSC::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::CharacterClassConstructor::isUpsideDown):
+        (JSC::CharacterClassConstructor::charClass):
+
+2008-09-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20788: Split CharacterClassConstructor into its own file
+        <https://bugs.webkit.org/show_bug.cgi?id=20788>
+
+        Split CharacterClassConstructor into its own file and clean up some
+        style issues.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wrec/CharacterClassConstructor.cpp: Added.
+        (JSC::):
+        (JSC::getCharacterClassNewline):
+        (JSC::getCharacterClassDigits):
+        (JSC::getCharacterClassSpaces):
+        (JSC::getCharacterClassWordchar):
+        (JSC::getCharacterClassNondigits):
+        (JSC::getCharacterClassNonspaces):
+        (JSC::getCharacterClassNonwordchar):
+        (JSC::CharacterClassConstructor::addSorted):
+        (JSC::CharacterClassConstructor::addSortedRange):
+        (JSC::CharacterClassConstructor::put):
+        (JSC::CharacterClassConstructor::flush):
+        (JSC::CharacterClassConstructor::append):
+        * wrec/CharacterClassConstructor.h: Added.
+        (JSC::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::CharacterClassConstructor::isUpsideDown):
+        (JSC::CharacterClassConstructor::charClass):
+        * wrec/WREC.cpp:
+        (JSC::WRECParser::parseCharacterClass):
+
+2008-09-10  Simon Hausmann  <hausmann@webkit.org>
+
+        Not reviewed but trivial one-liner for yet unused macro.
+
+        Changed PLATFORM(WINCE) to PLATFORM(WIN_CE) as requested by Mark.
+
+        (part of https://bugs.webkit.org/show_bug.cgi?id=20746)
+
+        * wtf/Platform.h:
+
+2008-09-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix a typo by renaming the overloaded orl_rr that takes an immediate to
+        orl_i32r.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::orl_i32r):
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generatePatternCharacter):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+
+2008-09-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Add inline property storage for JSObject.
+
+        1.2% progression on Sunspider. .5% progression on the v8 test suite.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::mark): There is no reason to check storageSize now that
+        we start from 0.
+        (JSC::JSObject::allocatePropertyStorage): Allocates/reallocates heap storage.
+        * kjs/JSObject.h:
+        (JSC::JSObject::offsetForLocation): m_propertyStorage is not an OwnArrayPtr
+        now so there is no reason to .get()
+        (JSC::JSObject::usingInlineStorage):
+        (JSC::JSObject::JSObject): Start with m_propertyStorage pointing to the
+        inline storage.
+        (JSC::JSObject::~JSObject): Free the heap storage if not using the inline
+        storage.
+        (JSC::JSObject::putDirect): Switch to the heap storage only when we know
+        we know that we are about to add a property that will overflow the inline
+        storage.
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::createTable): Don't allocate the propertyStorage, that is
+        now handled by JSObject.
+        (JSC::PropertyMap::rehash): PropertyStorage is not a OwnArrayPtr anymore.
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMap::storageSize): Rename from markingCount.
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::addPropertyTransition): Don't resize the property storage
+        if we are using inline storage.
+        * kjs/StructureID.h:
+
+2008-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Inline immediate number version of op_mul.
+
+        Renamed mull_rr to imull_rr as that's what it's 
+        actually doing, and added imull_i32r for the constant
+        case immediate multiply.
+
+        1.1% improvement to SunSpider.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::imull_rr):
+        (JSC::X86Assembler::imull_i32r):
+
+2008-09-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Not reviewed.
+
+        Mac build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-09-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add optimised access to known properties on the global object.
+
+        Improve cross scope access to the global object by emitting
+        code to access it directly rather than by walking the scope chain.
+
+        This is a 0.8% win in SunSpider and a 1.7% win in the v8 benchmarks.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::findScopedProperty):
+        (JSC::CodeGenerator::emitResolve):
+        (JSC::CodeGenerator::emitGetScopedVar):
+        (JSC::CodeGenerator::emitPutScopedVar):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::PostfixResolveNode::emitCode):
+        (JSC::PrefixResolveNode::emitCode):
+        (JSC::ReadModifyResolveNode::emitCode):
+        (JSC::AssignResolveNode::emitCode):
+
+2008-09-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - enable polymorphic inline caching of properties of primitives
+        
+        1.012x speedup on SunSpider.
+
+        We create special structure IDs for JSString and
+        JSNumberCell. Unlike normal structure IDs, these cannot hold the
+        true prototype. Due to JS autoboxing semantics, the prototype used
+        when looking up string or number properties depends on the lexical
+        global object of the call site, not the creation site. Thus we
+        enable StructureIDs to handle this quirk for primitives.
+        
+        Everything else should be straightforward.
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        * VM/CTI.h:
+        (JSC::CTI::compileGetByIdProto):
+        (JSC::CTI::compileGetByIdChain):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+        (JSC::cachePrototypeChain):
+        (JSC::Machine::tryCachePutByID):
+        (JSC::Machine::tryCacheGetByID):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        * kjs/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        * kjs/JSCell.h:
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.h:
+        (JSC::StructureID::prototypeForLookup):
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::JSNumberCell):
+        (JSC::jsNumberCell):
+        * kjs/JSObject.h:
+        (JSC::JSObject::prototype):
+        * kjs/JSString.cpp:
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * kjs/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::):
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsNontrivialString):
+        * kjs/SmallStrings.cpp:
+        (JSC::SmallStrings::createEmptyString):
+        (JSC::SmallStrings::createSingleCharacterString):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        (JSC::StructureID::getterSetterTransition):
+        (JSC::StructureIDChain::StructureIDChain):
+        * kjs/StructureID.h:
+        (JSC::StructureID::create):
+        (JSC::StructureID::storedPrototype):
+
+2008-09-09  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20746
+
+        Added WINCE platform macro.
+
+        * wtf/Platform.h:
+
+2008-09-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove unnecessary override of getOffset.
+
+        Sunspider reports this as a .6% progression.
+
+        * JavaScriptCore.exp:
+        * kjs/JSObject.h:
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::putDirect):
+        * kjs/PropertyMap.cpp:
+        * kjs/PropertyMap.h:
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20759: Remove MacroAssembler
+        <https://bugs.webkit.org/show_bug.cgi?id=20759>
+
+        Remove MacroAssembler and move its functionality to X86Assembler.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::emitPutArg):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutResult):
+        (JSC::CTI::emitDebugExceptionCheck):
+        (JSC::CTI::emitJumpSlowCaseIfNotImm):
+        (JSC::CTI::emitJumpSlowCaseIfNotImms):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateArrayLengthTrampoline):
+        (JSC::CTI::privateStringLengthTrampoline):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JmpTable::JmpTable):
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+        (JSC::CTI::JSRInfo::JSRInfo):
+        * masm/MacroAssembler.h: Removed.
+        * masm/MacroAssemblerWin.cpp: Removed.
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitConvertToFastCall):
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+        * wrec/WREC.h:
+        (JSC::WRECGenerator::WRECGenerator):
+        (JSC::WRECParser::WRECParser):
+
+2008-09-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Don't waste the first item in the PropertyStorage.
+
+        - Fix typo (makingCount -> markingCount)
+        - Remove undefined method declaration.
+
+        No change on Sunspider.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::mark):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::put):
+        (JSC::PropertyMap::remove):
+        (JSC::PropertyMap::getOffset):
+        (JSC::PropertyMap::insert):
+        (JSC::PropertyMap::rehash):
+        (JSC::PropertyMap::resizePropertyStorage):
+        (JSC::PropertyMap::checkConsistency):
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMap::markingCount): Fix typo.
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Not reviewed.
+
+        Speculative Windows build fix.
+
+        * masm/MacroAssemblerWin.cpp:
+        (JSC::MacroAssembler::emitConvertToFastCall):
+        (JSC::MacroAssembler::emitRestoreArgumentReference):
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20755: Create an X86 namespace for register names and other things
+        <https://bugs.webkit.org/show_bug.cgi?id=20755>
+
+        Create an X86 namespace to put X86 register names. Perhaps I will move
+        opcode names here later as well.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::emitPutArg):
+        (JSC::CTI::emitPutArgConstant):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutResult):
+        (JSC::CTI::emitDebugExceptionCheck):
+        (JSC::CTI::emitJumpSlowCaseIfNotImms):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateArrayLengthTrampoline):
+        (JSC::CTI::privateStringLengthTrampoline):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * masm/X86Assembler.h:
+        (JSC::X86::):
+        (JSC::X86Assembler::emitModRm_rm):
+        (JSC::X86Assembler::emitModRm_rm_Unchecked):
+        (JSC::X86Assembler::emitModRm_rmsib):
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generateParentheses):
+        (JSC::WRECGenerator::generateBackreference):
+        (JSC::WRECGenerator::gernerateDisjunction):
+        * wrec/WREC.h:
+
+2008-09-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unnecessary friend declaration.
+
+        * kjs/PropertyMap.h:
+
+2008-09-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace uses of PropertyMap::get and PropertyMap::getLocation with
+        PropertyMap::getOffset.
+
+        Sunspider reports this as a .6% improvement.
+
+        * JavaScriptCore.exp:
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertyAttributes):
+        * kjs/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::locationForOffset):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::remove):
+        (JSC::PropertyMap::getOffset):
+        * kjs/PropertyMap.h:
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Bug 20754: Remove emit prefix from assembler opcode methods
+        <https://bugs.webkit.org/show_bug.cgi?id=20754>
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::emitPutArg):
+        (JSC::CTI::emitPutArgConstant):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutResult):
+        (JSC::CTI::emitDebugExceptionCheck):
+        (JSC::CTI::emitCall):
+        (JSC::CTI::emitJumpSlowCaseIfNotImm):
+        (JSC::CTI::emitJumpSlowCaseIfNotImms):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateArrayLengthTrampoline):
+        (JSC::CTI::privateStringLengthTrampoline):
+        (JSC::CTI::compileRegExp):
+        * masm/MacroAssemblerWin.cpp:
+        (JSC::MacroAssembler::emitConvertToFastCall):
+        (JSC::MacroAssembler::emitRestoreArgumentReference):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::pushl_r):
+        (JSC::X86Assembler::pushl_m):
+        (JSC::X86Assembler::popl_r):
+        (JSC::X86Assembler::popl_m):
+        (JSC::X86Assembler::movl_rr):
+        (JSC::X86Assembler::addl_rr):
+        (JSC::X86Assembler::addl_i8r):
+        (JSC::X86Assembler::addl_i32r):
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::andl_rr):
+        (JSC::X86Assembler::andl_i32r):
+        (JSC::X86Assembler::cmpl_i8r):
+        (JSC::X86Assembler::cmpl_rr):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::cmpl_i32r):
+        (JSC::X86Assembler::cmpl_i32m):
+        (JSC::X86Assembler::cmpw_rm):
+        (JSC::X86Assembler::orl_rr):
+        (JSC::X86Assembler::subl_rr):
+        (JSC::X86Assembler::subl_i8r):
+        (JSC::X86Assembler::subl_i32r):
+        (JSC::X86Assembler::subl_mr):
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::testl_rr):
+        (JSC::X86Assembler::xorl_i8r):
+        (JSC::X86Assembler::xorl_rr):
+        (JSC::X86Assembler::sarl_i8r):
+        (JSC::X86Assembler::sarl_CLr):
+        (JSC::X86Assembler::shl_i8r):
+        (JSC::X86Assembler::shll_CLr):
+        (JSC::X86Assembler::mull_rr):
+        (JSC::X86Assembler::idivl_r):
+        (JSC::X86Assembler::cdq):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::movzwl_mr):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_i32r):
+        (JSC::X86Assembler::movl_i32m):
+        (JSC::X86Assembler::leal_mr):
+        (JSC::X86Assembler::ret):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::jmp_m):
+        (JSC::X86Assembler::call_r):
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generateBacktrack1):
+        (JSC::WRECGenerator::generateBacktrackBackreference):
+        (JSC::WRECGenerator::generateBackreferenceQuantifier):
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generatePatternCharacter):
+        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+        (JSC::WRECGenerator::generateCharacterClass):
+        (JSC::WRECGenerator::generateParentheses):
+        (JSC::WRECGenerator::gererateParenthesesResetTrampoline):
+        (JSC::WRECGenerator::generateAssertionBOL):
+        (JSC::WRECGenerator::generateAssertionEOL):
+        (JSC::WRECGenerator::generateAssertionWordBoundary):
+        (JSC::WRECGenerator::generateBackreference):
+        (JSC::WRECGenerator::gernerateDisjunction):
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Clean up the WREC code some more.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileRegExp):
+        * wrec/WREC.cpp:
+        (JSC::getCharacterClassNewline):
+        (JSC::getCharacterClassDigits):
+        (JSC::getCharacterClassSpaces):
+        (JSC::getCharacterClassWordchar):
+        (JSC::getCharacterClassNondigits):
+        (JSC::getCharacterClassNonspaces):
+        (JSC::getCharacterClassNonwordchar):
+        (JSC::WRECGenerator::generateBacktrack1):
+        (JSC::WRECGenerator::generateBacktrackBackreference):
+        (JSC::WRECGenerator::generateBackreferenceQuantifier):
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generatePatternCharacter):
+        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+        (JSC::WRECGenerator::generateCharacterClass):
+        (JSC::WRECGenerator::generateParentheses):
+        (JSC::WRECGenerator::gererateParenthesesResetTrampoline):
+        (JSC::WRECGenerator::generateAssertionBOL):
+        (JSC::WRECGenerator::generateAssertionEOL):
+        (JSC::WRECGenerator::generateAssertionWordBoundary):
+        (JSC::WRECGenerator::generateBackreference):
+        (JSC::WRECGenerator::gernerateDisjunction):
+        (JSC::WRECParser::parseCharacterClass):
+        (JSC::WRECParser::parseEscape):
+        (JSC::WRECParser::parseTerm):
+        * wrec/WREC.h:
+
+2008-09-09  Mark Rowe  <mrowe@apple.com>
+
+        Build fix, rubber-stamped by Anders Carlsson.
+
+        Silence spurious build warnings about missing format attributes on functions in Assertions.cpp.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-09-09  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix builds using the "debug" variant.
+
+        This reverts r36130 and tweaks Identifier to export the same symbols for Debug
+        and Release configurations.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.Debug.exp: Removed.
+        * JavaScriptCore.base.exp: Removed.
+        * JavaScriptCore.exp: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/identifier.cpp:
+        (JSC::Identifier::addSlowCase): #ifdef the call to checkSameIdentifierTable so that
+        there is no overhead in Release builds.
+        (JSC::Identifier::checkSameIdentifierTable): Add empty functions for Release builds.
+        * kjs/identifier.h:
+        (JSC::Identifier::add): #ifdef the calls to checkSameIdentifierTable so that there is
+        no overhead in Release builds, and remove the inline definitions of checkSameIdentifierTable.
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Clean up WREC a bit to bring it closer to our coding style guidelines.
+
+        * wrec/WREC.cpp:
+        (JSC::):
+        (JSC::getCharacterClass_newline):
+        (JSC::getCharacterClass_d):
+        (JSC::getCharacterClass_s):
+        (JSC::getCharacterClass_w):
+        (JSC::getCharacterClass_D):
+        (JSC::getCharacterClass_S):
+        (JSC::getCharacterClass_W):
+        (JSC::CharacterClassConstructor::append):
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+        (JSC::WRECParser::parseQuantifier):
+        (JSC::WRECParser::parsePatternCharacterQualifier):
+        (JSC::WRECParser::parseCharacterClassQuantifier):
+        (JSC::WRECParser::parseBackreferenceQuantifier):
+        * wrec/WREC.h:
+        (JSC::Quantifier::):
+        (JSC::Quantifier::Quantifier):
+
+2008-09-09  Jungshik Shin  <jungshik.shin@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Try MIME charset names before trying IANA names 
+        ( https://bugs.webkit.org/show_bug.cgi?id=17537 )
+
+        * wtf/StringExtras.h: (strcasecmp): Added.
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Mark Rowe.
+
+        Bug 20719: REGRESSION (r36135-36244): Hangs, then crashes after several seconds
+        <https://bugs.webkit.org/show_bug.cgi?id=20719>
+        <rdar://problem/6205787>
+
+        Fix a typo in the case-insensitive matching of character patterns.
+
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generatePatternCharacter):
+
+2008-09-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - allow polymorphic inline cache to handle Math object functions and possibly other similar things
+        
+        1.012x speedup on SunSpider.
+
+        * kjs/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        * kjs/lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * kjs/lookup.h:
+        (JSC::getStaticPropertySlot):
+
+2008-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        Split storage of properties out of the PropertyMap and into the JSObject
+        to allow sharing PropertyMap on the StructureID.  In order to get this
+        function correctly, the StructureID's transition mappings were changed to
+        transition based on property name and attribute pairs, instead of just
+        property name.
+
+        - Removes the single property optimization now that the PropertyMap is shared.
+          This will be replaced by in-lining some values on the JSObject.
+
+        This is a wash on Sunspider and a 6.7% win on the v8 test suite.
+
+        * JavaScriptCore.base.exp:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileGetByIdSelf): Get the storage directly off the JSObject.
+        (JSC::CTI::privateCompileGetByIdProto): Ditto.
+        (JSC::CTI::privateCompileGetByIdChain): Ditto.
+        (JSC::CTI::privateCompilePutByIdReplace): Ditto.
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::mark): Mark the PropertyStorage.
+        (JSC::JSObject::put): Update to get the propertyMap of the StructureID.
+        (JSC::JSObject::deleteProperty): Ditto.
+        (JSC::JSObject::defineGetter): Return early if the property is already a getter/setter.
+        (JSC::JSObject::defineSetter): Ditto.
+        (JSC::JSObject::getPropertyAttributes): Update to get the propertyMap of the StructureID
+        (JSC::JSObject::getPropertyNames): Ditto.
+        (JSC::JSObject::removeDirect): Ditto.
+        * kjs/JSObject.h: Remove PropertyMap and add PropertyStorage.
+        (JSC::JSObject::propertyStorage): return the PropertyStorage.
+        (JSC::JSObject::getDirect): Update to get the propertyMap of the StructureID.
+        (JSC::JSObject::getDirectLocation): Ditto.
+        (JSC::JSObject::offsetForLocation): Compute location directly.
+        (JSC::JSObject::hasCustomProperties): Update to get the propertyMap of the StructureID.
+        (JSC::JSObject::hasGetterSetterProperties): Ditto.
+        (JSC::JSObject::getDirectOffset): Get by indexing into PropertyStorage.
+        (JSC::JSObject::putDirectOffset): Put by indexing into PropertyStorage.
+        (JSC::JSObject::getOwnPropertySlotForWrite): Update to get the propertyMap of the StructureID.
+        (JSC::JSObject::getOwnPropertySlot): Ditto.
+        (JSC::JSObject::putDirect): Move putting into the StructureID unless the property already exists.
+        * kjs/PropertyMap.cpp: Use the propertyStorage as the storage for the JSValues.
+        (JSC::PropertyMap::checkConsistency): 
+        (JSC::PropertyMap::operator=):
+        (JSC::PropertyMap::~PropertyMap):
+        (JSC::PropertyMap::get):
+        (JSC::PropertyMap::getLocation):
+        (JSC::PropertyMap::put):
+        (JSC::PropertyMap::getOffset):
+        (JSC::PropertyMap::insert):
+        (JSC::PropertyMap::expand):
+        (JSC::PropertyMap::rehash):
+        (JSC::PropertyMap::createTable):
+        (JSC::PropertyMap::resizePropertyStorage): Resize the storage to match the size of the map
+        (JSC::PropertyMap::remove):
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h: 
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (JSC::PropertyMap::isEmpty):
+        (JSC::PropertyMap::size):
+        (JSC::PropertyMap::makingCount):
+        (JSC::PropertyMap::PropertyMap):
+
+        * kjs/StructureID.cpp: 
+        (JSC::StructureID::addPropertyTransition): Transitions now are based off the property name
+        and attributes. 
+        (JSC::StructureID::toDictionaryTransition): Copy the map.
+        (JSC::StructureID::changePrototypeTransition): Copy the map.
+        (JSC::StructureID::getterSetterTransition): Copy the map.
+        (JSC::StructureID::~StructureID): 
+        * kjs/StructureID.h:
+        (JSC::TransitionTableHash::hash): Custom hash for transition map.
+        (JSC::TransitionTableHash::equal): Ditto.
+        (JSC::TransitionTableHashTraits::emptyValue): Custom traits for transition map
+        (JSC::TransitionTableHashTraits::constructDeletedValue): Ditto.
+        (JSC::TransitionTableHashTraits::isDeletedValue): Ditto.
+        (JSC::StructureID::propertyMap): Added.
+
+2008-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 20694: Slow Script error pops up when running Dromaeo tests
+
+        Correct error in timeout logic where execution tick count would
+        be reset to incorrect value due to incorrect offset and indirection.
+        Codegen for the slow script dialog was factored out into a separate
+        method (emitSlowScriptCheck) rather than having multiple copies of
+        the same code.  Also added calls to generate slow script checks
+        for loop_if_less and loop_if_true opcodes.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+
+2008-09-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove references to the removed WRECompiler class.
+
+        * VM/Machine.h:
+        * wrec/WREC.h:
+
+2008-09-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Mark Rowe.
+
+        Fix the build with CTI enabled but WREC disabled.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+
+2008-09-08  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * kjs/nodes.h:
+        (JSC::StatementNode::):
+        (JSC::BlockNode::):
+
+2008-09-08  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+       <rdar://problem/6134407> Breakpoints in for loops, while loops or
+       conditions without curly braces don't break. (19306)
+       -Statement Lists already emit debug hooks but conditionals without
+       brackets are not lists.
+
+        * kjs/nodes.cpp:
+        (KJS::IfNode::emitCode):
+        (KJS::IfElseNode::emitCode):
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::ForInNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::StatementNode::):
+        (KJS::BlockNode::):
+
+2008-09-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        - Cache the code generated for eval to speed up SunSpider and web sites
+        https://bugs.webkit.org/show_bug.cgi?id=20718
+        
+        1.052x on SunSpider
+        2.29x on date-format-tofte
+        
+        Lots of real sites seem to get many hits on this cache as well,
+        including GMail, Google Spreadsheets, Slate and Digg (the last of
+        these gets over 100 hits on initial page load).
+
+        * VM/CodeBlock.h:
+        (JSC::EvalCodeCache::get):
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_call_eval):
+        * VM/Machine.h:
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20711: Change KJS prefix on preprocessor macros to JSC
+        <https://bugs.webkit.org/show_bug.cgi?id=20711>
+
+        * kjs/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * kjs/CommonIdentifiers.h:
+        * kjs/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::putValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setRegisterSlot):
+        * kjs/lookup.h:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        (JSC::Node::):
+        (JSC::ExpressionNode::):
+        (JSC::StatementNode::):
+        (JSC::NullNode::):
+        (JSC::BooleanNode::):
+        (JSC::NumberNode::):
+        (JSC::ImmediateNumberNode::):
+        (JSC::StringNode::):
+        (JSC::RegExpNode::):
+        (JSC::ThisNode::):
+        (JSC::ResolveNode::):
+        (JSC::ElementNode::):
+        (JSC::ArrayNode::):
+        (JSC::PropertyNode::):
+        (JSC::PropertyListNode::):
+        (JSC::ObjectLiteralNode::):
+        (JSC::BracketAccessorNode::):
+        (JSC::DotAccessorNode::):
+        (JSC::ArgumentListNode::):
+        (JSC::ArgumentsNode::):
+        (JSC::NewExprNode::):
+        (JSC::EvalFunctionCallNode::):
+        (JSC::FunctionCallValueNode::):
+        (JSC::FunctionCallResolveNode::):
+        (JSC::FunctionCallBracketNode::):
+        (JSC::FunctionCallDotNode::):
+        (JSC::PrePostResolveNode::):
+        (JSC::PostfixResolveNode::):
+        (JSC::PostfixBracketNode::):
+        (JSC::PostfixDotNode::):
+        (JSC::PostfixErrorNode::):
+        (JSC::DeleteResolveNode::):
+        (JSC::DeleteBracketNode::):
+        (JSC::DeleteDotNode::):
+        (JSC::DeleteValueNode::):
+        (JSC::VoidNode::):
+        (JSC::TypeOfResolveNode::):
+        (JSC::TypeOfValueNode::):
+        (JSC::PrefixResolveNode::):
+        (JSC::PrefixBracketNode::):
+        (JSC::PrefixDotNode::):
+        (JSC::PrefixErrorNode::):
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::AddNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::ThrowableBinaryOpNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::InNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        (JSC::LogicalOpNode::):
+        (JSC::ConditionalNode::):
+        (JSC::ReadModifyResolveNode::):
+        (JSC::AssignResolveNode::):
+        (JSC::ReadModifyBracketNode::):
+        (JSC::AssignBracketNode::):
+        (JSC::AssignDotNode::):
+        (JSC::ReadModifyDotNode::):
+        (JSC::AssignErrorNode::):
+        (JSC::CommaNode::):
+        (JSC::VarDeclCommaNode::):
+        (JSC::ConstDeclNode::):
+        (JSC::ConstStatementNode::):
+        (JSC::EmptyStatementNode::):
+        (JSC::DebuggerStatementNode::):
+        (JSC::ExprStatementNode::):
+        (JSC::VarStatementNode::):
+        (JSC::IfNode::):
+        (JSC::IfElseNode::):
+        (JSC::DoWhileNode::):
+        (JSC::WhileNode::):
+        (JSC::ForNode::):
+        (JSC::ContinueNode::):
+        (JSC::BreakNode::):
+        (JSC::ReturnNode::):
+        (JSC::WithNode::):
+        (JSC::LabelNode::):
+        (JSC::ThrowNode::):
+        (JSC::TryNode::):
+        (JSC::ParameterNode::):
+        (JSC::ScopeNode::):
+        (JSC::ProgramNode::):
+        (JSC::EvalNode::):
+        (JSC::FunctionBodyNode::):
+        (JSC::FuncExprNode::):
+        (JSC::FuncDeclNode::):
+        (JSC::CaseClauseNode::):
+        (JSC::ClauseListNode::):
+        (JSC::CaseBlockNode::):
+        (JSC::SwitchNode::):
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20704: Replace the KJS namespace
+        <https://bugs.webkit.org/show_bug.cgi?id=20704>
+
+        Rename the KJS namespace to JSC. There are still some uses of KJS in
+        preprocessor macros and comments, but these will also be changed some
+        time in the near future.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        (toGlobalRef):
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::staticValues):
+        (OpaqueJSClass::staticFunctions):
+        * API/JSClassRef.h:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSProfilerPrivate.cpp:
+        * API/JSStringRef.cpp:
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * JavaScriptCore.Debug.exp:
+        * JavaScriptCore.base.exp:
+        * VM/CTI.cpp:
+        (JSC::):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/ExceptionHelpers.h:
+        * VM/Instruction.h:
+        * VM/JSPropertyNameIterator.cpp:
+        * VM/JSPropertyNameIterator.h:
+        * VM/LabelID.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * VM/Opcode.cpp:
+        * VM/Opcode.h:
+        * VM/Register.h:
+        (WTF::):
+        * VM/RegisterFile.cpp:
+        * VM/RegisterFile.h:
+        * VM/RegisterID.h:
+        (WTF::):
+        * VM/SamplingTool.cpp:
+        * VM/SamplingTool.h:
+        * VM/SegmentedVector.h:
+        * kjs/ArgList.cpp:
+        * kjs/ArgList.h:
+        * kjs/Arguments.cpp:
+        * kjs/Arguments.h:
+        * kjs/ArrayConstructor.cpp:
+        * kjs/ArrayConstructor.h:
+        * kjs/ArrayPrototype.cpp:
+        * kjs/ArrayPrototype.h:
+        * kjs/BatchedTransitionOptimizer.h:
+        * kjs/BooleanConstructor.cpp:
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanObject.cpp:
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/BooleanPrototype.h:
+        * kjs/CallData.cpp:
+        * kjs/CallData.h:
+        * kjs/ClassInfo.h:
+        * kjs/CommonIdentifiers.cpp:
+        * kjs/CommonIdentifiers.h:
+        * kjs/ConstructData.cpp:
+        * kjs/ConstructData.h:
+        * kjs/DateConstructor.cpp:
+        * kjs/DateConstructor.h:
+        * kjs/DateInstance.cpp:
+        (JSC::DateInstance::msToGregorianDateTime):
+        * kjs/DateInstance.h:
+        * kjs/DateMath.cpp:
+        * kjs/DateMath.h:
+        * kjs/DatePrototype.cpp:
+        * kjs/DatePrototype.h:
+        * kjs/DebuggerCallFrame.cpp:
+        * kjs/DebuggerCallFrame.h:
+        * kjs/Error.cpp:
+        * kjs/Error.h:
+        * kjs/ErrorConstructor.cpp:
+        * kjs/ErrorConstructor.h:
+        * kjs/ErrorInstance.cpp:
+        * kjs/ErrorInstance.h:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/ErrorPrototype.h:
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        * kjs/FunctionConstructor.h:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/FunctionPrototype.h:
+        * kjs/GetterSetter.cpp:
+        * kjs/GetterSetter.h:
+        * kjs/GlobalEvalFunction.cpp:
+        * kjs/GlobalEvalFunction.h:
+        * kjs/IndexToNameMap.cpp:
+        * kjs/IndexToNameMap.h:
+        * kjs/InitializeThreading.cpp:
+        * kjs/InitializeThreading.h:
+        * kjs/InternalFunction.cpp:
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * kjs/JSActivation.cpp:
+        * kjs/JSActivation.h:
+        * kjs/JSArray.cpp:
+        * kjs/JSArray.h:
+        * kjs/JSCell.cpp:
+        * kjs/JSCell.h:
+        * kjs/JSFunction.cpp:
+        * kjs/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        * kjs/JSGlobalObjectFunctions.cpp:
+        * kjs/JSGlobalObjectFunctions.h:
+        * kjs/JSImmediate.cpp:
+        * kjs/JSImmediate.h:
+        * kjs/JSLock.cpp:
+        * kjs/JSLock.h:
+        * kjs/JSNotAnObject.cpp:
+        * kjs/JSNotAnObject.h:
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h:
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSStaticScopeObject.cpp:
+        * kjs/JSStaticScopeObject.h:
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        * kjs/JSType.h:
+        * kjs/JSValue.cpp:
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.cpp:
+        * kjs/JSVariableObject.h:
+        * kjs/JSWrapperObject.cpp:
+        * kjs/JSWrapperObject.h:
+        * kjs/LabelStack.cpp:
+        * kjs/LabelStack.h:
+        * kjs/MathObject.cpp:
+        * kjs/MathObject.h:
+        * kjs/NativeErrorConstructor.cpp:
+        * kjs/NativeErrorConstructor.h:
+        * kjs/NativeErrorPrototype.cpp:
+        * kjs/NativeErrorPrototype.h:
+        * kjs/NodeInfo.h:
+        * kjs/NumberConstructor.cpp:
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.cpp:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp:
+        * kjs/NumberPrototype.h:
+        * kjs/ObjectConstructor.cpp:
+        * kjs/ObjectConstructor.h:
+        * kjs/ObjectPrototype.cpp:
+        * kjs/ObjectPrototype.h:
+        * kjs/Parser.cpp:
+        * kjs/Parser.h:
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
+        * kjs/PropertyMap.h:
+        * kjs/PropertyNameArray.cpp:
+        * kjs/PropertyNameArray.h:
+        * kjs/PropertySlot.cpp:
+        * kjs/PropertySlot.h:
+        * kjs/PrototypeFunction.cpp:
+        * kjs/PrototypeFunction.h:
+        * kjs/PutPropertySlot.h:
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpObject.cpp:
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp:
+        * kjs/RegExpPrototype.h:
+        * kjs/ScopeChain.cpp:
+        * kjs/ScopeChain.h:
+        * kjs/ScopeChainMark.h:
+        * kjs/Shell.cpp:
+        (jscmain):
+        * kjs/SmallStrings.cpp:
+        * kjs/SmallStrings.h:
+        * kjs/SourceProvider.h:
+        * kjs/SourceRange.h:
+        * kjs/StringConstructor.cpp:
+        * kjs/StringConstructor.h:
+        * kjs/StringObject.cpp:
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        * kjs/StringPrototype.cpp:
+        * kjs/StringPrototype.h:
+        * kjs/StructureID.cpp:
+        * kjs/StructureID.h:
+        * kjs/SymbolTable.h:
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/completion.h:
+        * kjs/create_hash_table:
+        * kjs/debugger.cpp:
+        * kjs/debugger.h:
+        * kjs/dtoa.cpp:
+        * kjs/dtoa.h:
+        * kjs/grammar.y:
+        * kjs/identifier.cpp:
+        * kjs/identifier.h:
+        (JSC::Identifier::equal):
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/lexer.cpp:
+        (JSC::Lexer::Lexer):
+        (JSC::Lexer::clear):
+        (JSC::Lexer::makeIdentifier):
+        * kjs/lexer.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/protect.h:
+        * kjs/regexp.cpp:
+        * kjs/regexp.h:
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        (JSC::operator!=):
+        (JSC::IdentifierRepHash::hash):
+        (WTF::):
+        * masm/MacroAssembler.h:
+        * masm/MacroAssemblerWin.cpp:
+        * masm/X86Assembler.h:
+        * pcre/pcre_exec.cpp:
+        * profiler/CallIdentifier.h:
+        (WTF::):
+        * profiler/HeavyProfile.cpp:
+        * profiler/HeavyProfile.h:
+        * profiler/Profile.cpp:
+        * profiler/Profile.h:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        * profiler/ProfileNode.h:
+        * profiler/Profiler.cpp:
+        * profiler/Profiler.h:
+        * profiler/TreeProfile.cpp:
+        * profiler/TreeProfile.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+        * wtf/AVLTree.h:
+
+2008-09-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        - rename IA32MacroAssembler class to X86Assembler
+        
+        We otherwise call the platform X86, and also, I don't see any macros.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * masm/IA32MacroAsm.h: Removed.
+        * masm/MacroAssembler.h:
+        (KJS::MacroAssembler::MacroAssembler):
+        * masm/MacroAssemblerWin.cpp:
+        (KJS::MacroAssembler::emitRestoreArgumentReference):
+        * masm/X86Assembler.h: Copied from masm/IA32MacroAsm.h.
+        (KJS::X86Assembler::X86Assembler):
+        * wrec/WREC.cpp:
+        (KJS::WRECGenerator::generateNonGreedyQuantifier):
+        (KJS::WRECGenerator::generateGreedyQuantifier):
+        (KJS::WRECGenerator::generateParentheses):
+        (KJS::WRECGenerator::generateBackreference):
+        (KJS::WRECGenerator::gernerateDisjunction):
+        * wrec/WREC.h:
+
+2008-09-07  Cameron Zwarich  <cwzwarich@webkit.org>
+
+        Not reviewed.
+
+        Visual C++ seems to have some odd casting rules, so just convert the
+        offending cast back to a C-style cast for now.
+
+        * kjs/collector.cpp:
+        (KJS::otherThreadStackPointer):
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Mark Rowe.
+
+        Attempt to fix the Windows build by using a const_cast to cast regs.Esp
+        to a uintptr_t instead of a reinterpret_cast.
+
+        * kjs/collector.cpp:
+        (KJS::otherThreadStackPointer):
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Remove C-style casts from kjs/collector.cpp.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::heapAllocate):
+        (KJS::currentThreadStackBase):
+        (KJS::Heap::markConservatively):
+        (KJS::otherThreadStackPointer):
+        (KJS::Heap::markOtherThreadConservatively):
+        (KJS::Heap::sweep):
+
+2008-09-07  Mark Rowe  <mrowe@apple.com>
+
+        Build fix for the debug variant.
+
+        * DerivedSources.make: Also use the .Debug.exp exports file when building the debug variant.
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove C-style casts from the CTI code.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetArg):
+        (KJS::CTI::emitGetPutArg):
+        (KJS::ctiRepatchCallByReturnAddress):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompileGetByIdSelf):
+        (KJS::CTI::privateCompileGetByIdProto):
+        (KJS::CTI::privateCompileGetByIdChain):
+        (KJS::CTI::privateCompilePutByIdReplace):
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+
+=== End merge of squirrelfish-extreme ===
+
+2008-09-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig. Adapted somewhat by Maciej Stachowiak.
+        
+        - refactor WREC to share more of the JIT infrastructure with CTI
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetArg):
+        (KJS::CTI::emitGetPutArg):
+        (KJS::CTI::emitPutArg):
+        (KJS::CTI::emitPutArgConstant):
+        (KJS::CTI::emitPutCTIParam):
+        (KJS::CTI::emitGetCTIParam):
+        (KJS::CTI::emitPutToCallFrameHeader):
+        (KJS::CTI::emitGetFromCallFrameHeader):
+        (KJS::CTI::emitPutResult):
+        (KJS::CTI::emitDebugExceptionCheck):
+        (KJS::CTI::emitJumpSlowCaseIfNotImm):
+        (KJS::CTI::emitJumpSlowCaseIfNotImms):
+        (KJS::CTI::emitFastArithDeTagImmediate):
+        (KJS::CTI::emitFastArithReTagImmediate):
+        (KJS::CTI::emitFastArithPotentiallyReTagImmediate):
+        (KJS::CTI::emitFastArithImmToInt):
+        (KJS::CTI::emitFastArithIntToImmOrSlowCase):
+        (KJS::CTI::emitFastArithIntToImmNoCheck):
+        (KJS::CTI::CTI):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompileSlowCases):
+        (KJS::CTI::privateCompile):
+        (KJS::CTI::privateCompileGetByIdSelf):
+        (KJS::CTI::privateCompileGetByIdProto):
+        (KJS::CTI::privateCompileGetByIdChain):
+        (KJS::CTI::privateCompilePutByIdReplace):
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+        (KJS::CTI::compileRegExp):
+        * VM/CTI.h:
+        (KJS::CallRecord::CallRecord):
+        (KJS::JmpTable::JmpTable):
+        (KJS::SlowCaseEntry::SlowCaseEntry):
+        (KJS::CTI::JSRInfo::JSRInfo):
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        * wrec/WREC.cpp:
+        (KJS::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
+        (KJS::GeneratePatternCharacterFunctor::generateAtom):
+        (KJS::GeneratePatternCharacterFunctor::backtrack):
+        (KJS::GenerateCharacterClassFunctor::generateAtom):
+        (KJS::GenerateCharacterClassFunctor::backtrack):
+        (KJS::GenerateBackreferenceFunctor::generateAtom):
+        (KJS::GenerateBackreferenceFunctor::backtrack):
+        (KJS::GenerateParenthesesNonGreedyFunctor::generateAtom):
+        (KJS::GenerateParenthesesNonGreedyFunctor::backtrack):
+        (KJS::WRECGenerate::generateBacktrack1):
+        (KJS::WRECGenerate::generateBacktrackBackreference):
+        (KJS::WRECGenerate::generateBackreferenceQuantifier):
+        (KJS::WRECGenerate::generateNonGreedyQuantifier):
+        (KJS::WRECGenerate::generateGreedyQuantifier):
+        (KJS::WRECGenerate::generatePatternCharacter):
+        (KJS::WRECGenerate::generateCharacterClassInvertedRange):
+        (KJS::WRECGenerate::generateCharacterClassInverted):
+        (KJS::WRECGenerate::generateCharacterClass):
+        (KJS::WRECGenerate::generateParentheses):
+        (KJS::WRECGenerate::generateParenthesesNonGreedy):
+        (KJS::WRECGenerate::gererateParenthesesResetTrampoline):
+        (KJS::WRECGenerate::generateAssertionBOL):
+        (KJS::WRECGenerate::generateAssertionEOL):
+        (KJS::WRECGenerate::generateAssertionWordBoundary):
+        (KJS::WRECGenerate::generateBackreference):
+        (KJS::WRECGenerate::gernerateDisjunction):
+        (KJS::WRECGenerate::terminateDisjunction):
+        (KJS::WRECParser::parseGreedyQuantifier):
+        (KJS::WRECParser::parseQuantifier):
+        (KJS::WRECParser::parsePatternCharacterQualifier):
+        (KJS::WRECParser::parseCharacterClassQuantifier):
+        (KJS::WRECParser::parseBackreferenceQuantifier):
+        (KJS::WRECParser::parseParentheses):
+        (KJS::WRECParser::parseCharacterClass):
+        (KJS::WRECParser::parseOctalEscape):
+        (KJS::WRECParser::parseEscape):
+        (KJS::WRECParser::parseTerm):
+        (KJS::WRECParser::parseDisjunction):
+        * wrec/WREC.h:
+        (KJS::WRECGenerate::WRECGenerate):
+        (KJS::WRECParser::):
+        (KJS::WRECParser::WRECParser):
+        (KJS::WRECParser::parseAlternative):
+        (KJS::WRECParser::isEndOfPattern):
+
+2008-09-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix the sampler build.
+
+        * VM/SamplingTool.h:
+
+2008-09-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Jump through the necessary hoops required to make MSVC cooperate with SFX
+
+        We now explicitly declare the calling convention on all cti_op_* cfunctions,
+        and return int instead of bool where appropriate (despite the cdecl calling
+        convention seems to state MSVC generates code that returns the result value
+        through ecx).  SFX behaves slightly differently under MSVC, specifically it
+        stores the base argument address for the cti_op_* functions in the first
+        argument, and then does the required stack manipulation through that pointer.
+        This is necessary as MSVC's optimisations assume they have complete control
+        of the stack, and periodically elide our stack manipulations, or move
+        values in unexpected ways.  MSVC also frequently produces tail calls which may
+        clobber the first argument, so the MSVC path is slightly less efficient due
+        to the need to restore it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        (KJS::):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * masm/MacroAssembler.h:
+        (KJS::MacroAssembler::emitConvertToFastCall):
+        * masm/MacroAssemblerIA32GCC.cpp: Removed.
+           For performance reasons we need these no-op functions to be inlined.
+
+        * masm/MacroAssemblerWin.cpp:
+        (KJS::MacroAssembler::emitRestoreArgumentReference):
+        * wtf/Platform.h:
+
+2008-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak, or maybe the other way around.
+        
+        Added the ability to coalesce JITCode buffer grow operations by first
+        growing the buffer and then executing unchecked puts to it.
+        
+        About a 2% speedup on date-format-tofte.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::compileOpCall):
+        * masm/IA32MacroAsm.h:
+        (KJS::JITCodeBuffer::ensureSpace):
+        (KJS::JITCodeBuffer::putByteUnchecked):
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShortUnchecked):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putIntUnchecked):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::IA32MacroAssembler::emitTestl_i32r):
+        (KJS::IA32MacroAssembler::emitMovl_mr):
+        (KJS::IA32MacroAssembler::emitMovl_rm):
+        (KJS::IA32MacroAssembler::emitMovl_i32m):
+        (KJS::IA32MacroAssembler::emitUnlinkedJe):
+        (KJS::IA32MacroAssembler::emitModRm_rr):
+        (KJS::IA32MacroAssembler::emitModRm_rr_Unchecked):
+        (KJS::IA32MacroAssembler::emitModRm_rm_Unchecked):
+        (KJS::IA32MacroAssembler::emitModRm_rm):
+        (KJS::IA32MacroAssembler::emitModRm_opr):
+        (KJS::IA32MacroAssembler::emitModRm_opr_Unchecked):
+        (KJS::IA32MacroAssembler::emitModRm_opm_Unchecked):
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Disable WREC and CTI on platforms that we have not yet had a chance to test with.
+
+        * wtf/Platform.h:
+
+2008-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Use jo instead of a mask compare when fetching array.length and
+        string.length. 4% speedup on array.length / string.length torture
+        test.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+
+2008-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed a CTI compilation pass by recording labels during bytecode
+        generation. This is more to reduce complexity than it is to improve
+        performance.
+
+        SunSpider reports no change.
+
+        CodeBlock now keeps a "labels" set, which holds the offsets of all the
+        instructions that can be jumped to.
+
+        * VM/CTI.cpp: Nixed a pass.
+
+        * VM/CodeBlock.h: Added a "labels" set.
+
+        * VM/LabelID.h: No need for a special LableID for holding jump
+        destinations, since the CodeBlock now knows all jump destinations.
+
+        * wtf/HashTraits.h: New hash traits to accomodate putting offset 0 in
+        the set.
+
+        * kjs/nodes.cpp:
+        (KJS::TryNode::emitCode): Emit a dummy label to record sret targets.
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        Move the JITCodeBuffer onto Machine and remove the static variables.
+
+        * VM/CTI.cpp: Initialize m_jit with the Machine's code buffer.
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine): Allocate a JITCodeBuffer.
+        * VM/Machine.h:
+        * kjs/RegExpConstructor.cpp:
+        (KJS::constructRegExp): Pass the ExecState through.
+        * kjs/RegExpPrototype.cpp:
+        (KJS::regExpProtoFuncCompile): Ditto.
+        * kjs/StringPrototype.cpp:
+        (KJS::stringProtoFuncMatch): Ditto.
+        (KJS::stringProtoFuncSearch): Ditto.
+        * kjs/nodes.cpp:
+        (KJS::RegExpNode::emitCode): Compile the pattern at code generation time
+        so that we have access to an ExecState.
+        * kjs/nodes.h:
+        (KJS::RegExpNode::):
+        * kjs/nodes2string.cpp:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Pass the ExecState through.
+        (KJS::RegExp::create): Ditto.
+        * kjs/regexp.h:
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::IA32MacroAssembler): Reset the JITCodeBuffer when we are
+        constructed.
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::compile): Retrieve the JITCodeBuffer from the Machine.
+        * wrec/WREC.h:
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        Fix the build when CTI is disabled.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::~CodeBlock):
+        * VM/CodeGenerator.cpp:
+        (KJS::prepareJumpTableForStringSwitch):
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine):
+        (KJS::Machine::~Machine):
+
+2008-09-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix some windows abi issues.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        (KJS::CallRecord::CallRecord):
+        (KJS::):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_post_inc):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_post_dec):
+        * VM/Machine.h:
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix ecma/FunctionObjects/15.3.5.3.js after I broke it in r93.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_call_NotJSFunction): Restore m_callFrame to the correct value after making the native call.
+        (KJS::Machine::cti_op_construct_NotJSConstruct): Ditto.
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix fast/dom/Window/console-functions.html.
+
+        The call frame on the ExecState was not being updated on calls into native functions.  This meant that functions
+        such as console.log would use the line number of the last JS function on the call stack.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_call_NotJSFunction): Update the ExecState's call frame before making a native function call,
+        and restore it when the function is done.
+        (KJS::Machine::cti_op_construct_NotJSConstruct): Ditto.
+
+2008-09-05  Oliver Hunt  <oliver@apple.com>
+
+        Start bringing up SFX on windows.
+
+        Reviewed by Mark Rowe and Sam Weinig
+
+        Start doing the work to bring up SFX on windows.  Initially
+        just working on WREC, as it does not make any calls so reduces
+        the amount of code that needs to be corrected.
+        
+        Start abstracting the CTI JIT codegen engine.
+
+        * ChangeLog:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        * masm/IA32MacroAsm.h:
+        * masm/MacroAssembler.h: Added.
+        (KJS::MacroAssembler::MacroAssembler):
+        * masm/MacroAssemblerIA32GCC.cpp: Added.
+        (KJS::MacroAssembler::emitConvertToFastCall):
+        * masm/MacroAssemblerWin.cpp: Added.
+        (KJS::MacroAssembler::emitConvertToFastCall):
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseGreedyQuantifier):
+        (KJS::WRECompiler::parseCharacterClass):
+        (KJS::WRECompiler::parseEscape):
+        (KJS::WRECompiler::compilePattern):
+        * wrec/WREC.h:
+
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support for slow scripts (timeout checking).
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompile):
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall):
+        (KJS::Machine::cti_timeout_check):
+        (KJS::Machine::cti_vm_throw):
+
+2008-09-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Third round of style cleanup.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * kjs/ExecState.h:
+
+2008-09-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Jon Honeycutt.
+
+        Second round of style cleanup.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * wrec/WREC.h:
+
+2008-09-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        First round of style cleanup.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * masm/IA32MacroAsm.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+
+2008-09-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Merged http://trac.webkit.org/changeset/36081 to work with CTI.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::tryCtiCacheGetByID):
+
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Enable profiling in CTI.
+
+        * VM/CTI.h:
+        (KJS::):
+        (KJS::CTI::execute):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_call_JSFunction):
+        (KJS::Machine::cti_op_call_NotJSFunction):
+        (KJS::Machine::cti_op_ret):
+        (KJS::Machine::cti_op_construct_JSConstruct):
+        (KJS::Machine::cti_op_construct_NotJSConstruct):
+
+2008-09-04  Victor Hernandez  <vhernandez@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        
+        Fixed an #if to support using WREC without CTI.
+
+        * kjs/regexp.cpp:
+        (KJS::RegExp::match):
+
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        The array/string length trampolines are owned by the Machine, not the codeblock that compiled them.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+        * VM/Machine.cpp:
+        (KJS::Machine::~Machine):
+        * VM/Machine.h:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough and Sam Weinig.
+
+        Fix a crash on launch of jsc when GuardMalloc is enabled.
+
+        * kjs/ScopeChain.h:
+        (KJS::ScopeChain::ScopeChain): Initialize m_node to 0 when we have no valid scope chain.
+        (KJS::ScopeChain::~ScopeChain): Null-check m_node before calling deref.
+
+2008-09-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Fix inspector and fast array access so that it bounds
+        checks correctly.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitUnlinkedJb):
+        (KJS::IA32MacroAssembler::emitUnlinkedJbe):
+
+2008-09-03  Mark Rowe  <mrowe@apple.com>
+
+        Move the assertion after the InitializeAndReturn block, as
+        that is used even when CTI is enabled.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-09-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Replace calls to exit with ASSERT_WITH_MESSAGE or ASSERT_NOT_REACHED.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::cti_vm_throw):
+
+2008-09-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tweak JavaScriptCore to compile on non-x86 platforms.  This is achieved
+        by wrapping more code with ENABLE(CTI), ENABLE(WREC), and PLATFORM(X86)
+        #if's.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::printStructureIDs): Use %td as the format specifier for
+        printing a ptrdiff_t.
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        (KJS::RegExp::~RegExp):
+        (KJS::RegExp::match):
+        * kjs/regexp.h:
+        * masm/IA32MacroAsm.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+        * wtf/Platform.h: Only enable CTI and WREC on x86.  Add an extra define to
+        track whether any MASM-using features are enabled.
+
+2008-09-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Copy Geoff's array/string length optimization for CTI.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+        * VM/CTI.h:
+        (KJS::CTI::compileArrayLengthTrampoline):
+        (KJS::CTI::compileStringLengthTrampoline):
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine):
+        (KJS::Machine::getCtiArrayLengthTrampoline):
+        (KJS::Machine::getCtiStringLengthTrampoline):
+        (KJS::Machine::tryCtiCacheGetByID):
+        (KJS::Machine::cti_op_get_by_id_second):
+        * VM/Machine.h:
+        * kjs/JSString.h:
+        * kjs/ustring.h:
+
+2008-09-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement fast array accesses in CTI - 2-3% progression on sunspider.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitFastArithIntToImmNoCheck):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        * VM/CTI.h:
+        * kjs/JSArray.h:
+
+2008-09-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Enable fast property access support in CTI.
+
+        * VM/CTI.cpp:
+        (KJS::ctiSetReturnAddress):
+        (KJS::ctiRepatchCallByReturnAddress):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        (KJS::CTI::privateCompileGetByIdSelf):
+        (KJS::CTI::privateCompileGetByIdProto):
+        (KJS::CTI::privateCompileGetByIdChain):
+        (KJS::CTI::privateCompilePutByIdReplace):
+        * VM/CTI.h:
+        (KJS::CTI::compileGetByIdSelf):
+        (KJS::CTI::compileGetByIdProto):
+        (KJS::CTI::compileGetByIdChain):
+        (KJS::CTI::compilePutByIdReplace):
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::~CodeBlock):
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        (KJS::doSetReturnAddressVmThrowTrampoline):
+        (KJS::Machine::tryCtiCachePutByID):
+        (KJS::Machine::tryCtiCacheGetByID):
+        (KJS::Machine::cti_op_put_by_id):
+        (KJS::Machine::cti_op_put_by_id_second):
+        (KJS::Machine::cti_op_put_by_id_generic):
+        (KJS::Machine::cti_op_put_by_id_fail):
+        (KJS::Machine::cti_op_get_by_id):
+        (KJS::Machine::cti_op_get_by_id_second):
+        (KJS::Machine::cti_op_get_by_id_generic):
+        (KJS::Machine::cti_op_get_by_id_fail):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * kjs/JSCell.h:
+        * kjs/JSObject.h:
+        * kjs/PropertyMap.h:
+        * kjs/StructureID.cpp:
+        (KJS::StructureIDChain::StructureIDChain):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::emitCmpl_i32m):
+        (KJS::IA32MacroAssembler::emitMovl_mr):
+        (KJS::IA32MacroAssembler::emitMovl_rm):
+
+2008-09-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        A backslash (\) at the of a RegEx should produce an error.
+        Fixes fast/regex/test1.html.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseEscape):
+
+2008-09-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Link jumps for the slow case of op_loop_if_less.  Fixes acid3.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Switch WREC on by default.
+
+        * wtf/Platform.h:
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix two failures in fast/regex/test1.html
+          - \- in a character class should be treated as a literal -
+          - A missing max quantifier needs to be treated differently than
+            a null max quantifier.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateNonGreedyQuantifier):
+        (KJS::WRECompiler::generateGreedyQuantifier):
+        (KJS::WRECompiler::parseCharacterClass):
+        * wrec/WREC.h:
+        (KJS::Quantifier::Quantifier):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix crash in fast/js/kde/evil-n.html
+
+        * kjs/regexp.cpp: Always pass a non-null offset vector to the wrec function.
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Add pattern length limit fixing one test in fast/js.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::compile):
+        * wrec/WREC.h:
+        (KJS::WRECompiler::):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Make octal escape parsing/back-reference parsing more closely match 
+        prior behavior fixing one test in fast/js.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseCharacterClass): 8 and 9 should be IdentityEscaped
+        (KJS::WRECompiler::parseEscape):
+        * wrec/WREC.h:
+        (KJS::WRECompiler::peekDigit):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Fix one mozilla test.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateCharacterClassInverted): Fix incorrect not
+        ascii upper check.
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Parse octal escapes in character classes fixing one mozilla test.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseCharacterClass):
+        (KJS::WRECompiler::parseOctalEscape):
+        * wrec/WREC.h:
+        (KJS::WRECompiler::consumeOctal):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fixes two mozilla tests with WREC enabled.
+
+        * wrec/WREC.cpp:
+        (KJS::CharacterClassConstructor::append): Keep the character class sorted
+        when appending another character class.
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Fixes two mozilla tests with WREC enabled.
+
+        * wrec/WREC.cpp:
+        (KJS::CharacterClassConstructor::addSortedRange): Insert the range at the correct position
+        instead of appending it to the end.
+
+2008-09-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move cross-compilation unit call into NEVER_INLINE function.
+
+        * VM/Machine.cpp:
+        (KJS::doSetReturnAddressVmThrowTrampoline):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Fix one test in fast/js.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_construct_NotJSConstruct): Throw a createNotAConstructorError,
+        instead of a createNotAFunctionError.
+
+2008-08-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Zero-cost exception handling.  This patch takes the exception checking
+        back of the hot path.  When an exception occurs in a Machine::cti*
+        method, the return address to JIT code is recorded, and is then
+        overwritten with a pointer to a trampoline routine.  When the method
+        returns the trampoline will cause the cti_vm_throw method to be invoked.
+
+        cti_vm_throw uses the return address preserved above, to discover the
+        vPC of the bytecode that raised the exception (using a map build during
+        translation).  From the VPC of the faulting bytecode the vPC of a catch
+        routine may be discovered (unwinding the stack where necesary), and then
+        a bytecode address for the catch routine is looked up.  Final cti_vm_throw
+        overwrites its return address to JIT code again, to trampoline directly
+        to the catch routine.
+        
+        cti_op_throw is handled in a similar fashion.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitPutCTIParam):
+        (KJS::CTI::emitPutToCallFrameHeader):
+        (KJS::CTI::emitGetFromCallFrameHeader):
+        (KJS::ctiSetReturnAddressForArgs):
+        (KJS::CTI::emitDebugExceptionCheck):
+        (KJS::CTI::printOpcodeOperandTypes):
+        (KJS::CTI::emitCall):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::CallRecord::CallRecord):
+        (KJS::):
+        (KJS::CTI::execute):
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::cti_op_instanceof):
+        (KJS::Machine::cti_op_call_NotJSFunction):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_op_in):
+        (KJS::Machine::cti_vm_throw):
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::):
+        * kjs/ExecState.h:
+        (KJS::ExecState::setCtiReturnAddress):
+        (KJS::ExecState::ctiReturnAddress):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitPushl_m):
+        (KJS::IA32MacroAssembler::emitPopl_m):
+        (KJS::IA32MacroAssembler::getRelocatedAddress):
+
+2008-08-31  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fall back to PCRE for any regexp containing parentheses until we correctly backtrack within them.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseParentheses):
+        * wrec/WREC.h:
+        (KJS::WRECompiler::):
+
+2008-08-31  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix several issues within ecma_3/RegExp/perlstress-001.js with WREC enabled.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateNonGreedyQuantifier): Compare with the maximum quantifier count rather than the minimum.
+        (KJS::WRECompiler::generateAssertionEOL): Do a register-to-register comparison rather than immediate-to-register.
+        (KJS::WRECompiler::parseCharacterClass): Pass through the correct inversion flag.
+
+2008-08-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Re-fix the six remaining failures in the Mozilla JavaScript tests in a manner that does not kill performance.
+        This shows up as a 0.6% progression on SunSpider on my machine.
+
+        Grow the JITCodeBuffer's underlying buffer when we run out of space rather than just bailing out.
+
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::~CodeBlock): Switch to using fastFree now that JITCodeBuffer::copy uses fastMalloc.
+        * kjs/regexp.cpp: Ditto.
+        * masm/IA32MacroAsm.h:
+        (KJS::JITCodeBuffer::growBuffer):
+        (KJS::JITCodeBuffer::JITCodeBuffer):
+        (KJS::JITCodeBuffer::~JITCodeBuffer):
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::JITCodeBuffer::reset):
+        (KJS::JITCodeBuffer::copy):
+
+2008-08-29  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej
+
+        Roll out previous patch as it causes a 5% performance regression
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        (KJS::getJCB):
+        (KJS::CTI::privateCompile):
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::~CodeBlock):
+        * masm/IA32MacroAsm.h:
+        (KJS::JITCodeBuffer::JITCodeBuffer):
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::JITCodeBuffer::getEIP):
+        (KJS::JITCodeBuffer::start):
+        (KJS::JITCodeBuffer::getOffset):
+        (KJS::JITCodeBuffer::reset):
+        (KJS::JITCodeBuffer::copy):
+        (KJS::IA32MacroAssembler::emitModRm_rr):
+        (KJS::IA32MacroAssembler::emitModRm_rm):
+        (KJS::IA32MacroAssembler::emitModRm_rmsib):
+        (KJS::IA32MacroAssembler::IA32MacroAssembler):
+        (KJS::IA32MacroAssembler::emitInt3):
+        (KJS::IA32MacroAssembler::emitPushl_r):
+        (KJS::IA32MacroAssembler::emitPopl_r):
+        (KJS::IA32MacroAssembler::emitMovl_rr):
+        (KJS::IA32MacroAssembler::emitAddl_rr):
+        (KJS::IA32MacroAssembler::emitAddl_i8r):
+        (KJS::IA32MacroAssembler::emitAddl_i32r):
+        (KJS::IA32MacroAssembler::emitAddl_mr):
+        (KJS::IA32MacroAssembler::emitAndl_rr):
+        (KJS::IA32MacroAssembler::emitAndl_i32r):
+        (KJS::IA32MacroAssembler::emitCmpl_i8r):
+        (KJS::IA32MacroAssembler::emitCmpl_rr):
+        (KJS::IA32MacroAssembler::emitCmpl_rm):
+        (KJS::IA32MacroAssembler::emitCmpl_i32r):
+        (KJS::IA32MacroAssembler::emitCmpl_i32m):
+        (KJS::IA32MacroAssembler::emitCmpw_rm):
+        (KJS::IA32MacroAssembler::emitOrl_rr):
+        (KJS::IA32MacroAssembler::emitOrl_i8r):
+        (KJS::IA32MacroAssembler::emitSubl_rr):
+        (KJS::IA32MacroAssembler::emitSubl_i8r):
+        (KJS::IA32MacroAssembler::emitSubl_i32r):
+        (KJS::IA32MacroAssembler::emitSubl_mr):
+        (KJS::IA32MacroAssembler::emitTestl_i32r):
+        (KJS::IA32MacroAssembler::emitTestl_rr):
+        (KJS::IA32MacroAssembler::emitXorl_i8r):
+        (KJS::IA32MacroAssembler::emitXorl_rr):
+        (KJS::IA32MacroAssembler::emitSarl_i8r):
+        (KJS::IA32MacroAssembler::emitSarl_CLr):
+        (KJS::IA32MacroAssembler::emitShl_i8r):
+        (KJS::IA32MacroAssembler::emitShll_CLr):
+        (KJS::IA32MacroAssembler::emitMull_rr):
+        (KJS::IA32MacroAssembler::emitIdivl_r):
+        (KJS::IA32MacroAssembler::emitCdq):
+        (KJS::IA32MacroAssembler::emitMovl_mr):
+        (KJS::IA32MacroAssembler::emitMovzwl_mr):
+        (KJS::IA32MacroAssembler::emitMovl_rm):
+        (KJS::IA32MacroAssembler::emitMovl_i32r):
+        (KJS::IA32MacroAssembler::emitMovl_i32m):
+        (KJS::IA32MacroAssembler::emitLeal_mr):
+        (KJS::IA32MacroAssembler::emitRet):
+        (KJS::IA32MacroAssembler::emitJmpN_r):
+        (KJS::IA32MacroAssembler::emitJmpN_m):
+        (KJS::IA32MacroAssembler::emitCall):
+        (KJS::IA32MacroAssembler::label):
+        (KJS::IA32MacroAssembler::emitUnlinkedJmp):
+        (KJS::IA32MacroAssembler::emitUnlinkedJne):
+        (KJS::IA32MacroAssembler::emitUnlinkedJe):
+        (KJS::IA32MacroAssembler::emitUnlinkedJl):
+        (KJS::IA32MacroAssembler::emitUnlinkedJle):
+        (KJS::IA32MacroAssembler::emitUnlinkedJge):
+        (KJS::IA32MacroAssembler::emitUnlinkedJae):
+        (KJS::IA32MacroAssembler::emitUnlinkedJo):
+        (KJS::IA32MacroAssembler::link):
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::compilePattern):
+        (KJS::WRECompiler::compile):
+        * wrec/WREC.h:
+
+2008-08-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Have JITCodeBuffer manage a Vector containing the generated code so that it can grow
+        as needed when generating code for a large function.  This fixes all six remaining failures
+        in Mozilla tests in both debug and release builds.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile):
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::~CodeBlock):
+        * masm/IA32MacroAsm.h:
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::JITCodeBuffer::getEIP):
+        (KJS::JITCodeBuffer::start):
+        (KJS::JITCodeBuffer::getOffset):
+        (KJS::JITCodeBuffer::getCode):
+        (KJS::IA32MacroAssembler::emitModRm_rr):
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::compilePattern):
+        * wrec/WREC.h:
+
+2008-08-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement parsing of octal escapes in regular expressions.  This fixes three Mozilla tests.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseOctalEscape):
+        (KJS::WRECompiler::parseEscape): Parse the escape sequence as an octal escape if it has a leading zero.
+        Add a FIXME about treating invalid backreferences as octal escapes in the future.
+        * wrec/WREC.h:
+        (KJS::WRECompiler::consumeNumber): Multiply by 10 rather than 0 so that we handle numbers with more than
+        one digit.
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIOctalDigit):
+
+2008-08-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Pass vPC to instanceof method.  Fixes 2 mozilla tests in debug.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_instanceof):
+
+2008-08-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Pass vPCs to resolve methods for correct exception creation.  Fixes
+        17 mozilla tests in debug.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_resolve_with_base):
+
+2008-08-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remembering to actually throw the exception passed to op throw helps.
+        Regressions 19 -> 6.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_vm_throw):
+
+2008-08-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support for exception unwinding the stack.
+        
+        Once upon a time, Sam asked me for a bettr ChangeLog entry.  The return address
+        is now preserved on entry to a JIT code function (if we preserve lazily we need
+        restore the native return address during exception stack unwind).  This takes
+        the number of regressions down from ~150 to 19.
+
+        * VM/CTI.cpp:
+        (KJS::getJCB):
+        (KJS::CTI::emitExceptionCheck):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::):
+        * VM/Machine.cpp:
+        (KJS::Machine::throwException):
+        (KJS::Machine::cti_op_call_JSFunction):
+        (KJS::Machine::cti_op_call_NotJSFunction):
+        (KJS::Machine::cti_op_construct_JSConstruct):
+        (KJS::Machine::cti_op_construct_NotJSConstruct):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_vm_throw):
+
+2008-08-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix js1_2/regexp/word_boundary.js and four other Mozilla tests with WREC enabled.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateCharacterClassInvertedRange): If none of the exact matches
+        succeeded, jump to failure.
+        (KJS::WRECompiler::compilePattern): Restore and increment the current position stored
+        on the stack to ensure that it will be reset to the correct position after a failed
+        match has consumed input.
+
+2008-08-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix a hang in ecma_3/RegExp/15.10.2-1.js with WREC enabled.
+        A backreference with a quantifier would get stuck in an infinite
+        loop if the captured range was empty.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateBackreferenceQuantifier): If the captured range
+        was empty, do not attempt to match the backreference.
+        (KJS::WRECompiler::parseBackreferenceQuantifier):
+        * wrec/WREC.h:
+        (KJS::Quantifier::):
+
+2008-08-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement op_debug.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::debug):
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::cti_op_debug):
+        * VM/Machine.h:
+
+2008-08-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_switch_string fixing 1 mozilla test and one test in fast/js.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::SwitchRecord::):
+        (KJS::SwitchRecord::SwitchRecord):
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeBlock.h:
+        (KJS::ExpressionRangeInfo::):
+        (KJS::StringJumpTable::offsetForValue):
+        (KJS::StringJumpTable::ctiForValue):
+        (KJS::SimpleJumpTable::add):
+        (KJS::SimpleJumpTable::ctiForValue):
+        * VM/CodeGenerator.cpp:
+        (KJS::prepareJumpTableForStringSwitch):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::cti_op_switch_string):
+        * VM/Machine.h:
+
+2008-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Do not recurse on the machine stack when executing op_call.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetPutArg):
+        (KJS::CTI::emitPutArg):
+        (KJS::CTI::emitPutArgConstant):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::):
+        (KJS::CTI::compile):
+        (KJS::CTI::execute):
+        (KJS::CTI::):
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine):
+        (KJS::Machine::execute):
+        (KJS::Machine::cti_op_call_JSFunction):
+        (KJS::Machine::cti_op_call_NotJSFunction):
+        (KJS::Machine::cti_op_ret):
+        (KJS::Machine::cti_op_construct_JSConstruct):
+        (KJS::Machine::cti_op_construct_NotJSConstruct):
+        (KJS::Machine::cti_op_call_eval):
+        * VM/Machine.h:
+        * VM/Register.h:
+        (KJS::Register::Register):
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::):
+        * kjs/InternalFunction.h:
+        (KJS::InternalFunction::InternalFunction):
+        * kjs/JSFunction.h:
+        (KJS::JSFunction::JSFunction):
+        * kjs/ScopeChain.h:
+        (KJS::ScopeChain::ScopeChain):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitModRm_opm):
+        (KJS::IA32MacroAssembler::emitCmpl_i32m):
+        (KJS::IA32MacroAssembler::emitCallN_r):
+
+2008-08-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Exit instead of crashing in ctiUnsupported and ctiTimedOut.
+
+        * VM/Machine.cpp:
+        (KJS::ctiUnsupported):
+        (KJS::ctiTimedOut):
+
+2008-08-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement codegen for op_jsr and op_sret.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::CTI::JSRInfo::JSRInfo):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::emitJmpN_m):
+        (KJS::IA32MacroAssembler::linkAbsoluteAddress):
+
+2008-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Initial support for exceptions (throw / catch must occur in same CodeBlock).
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitExceptionCheck):
+        (KJS::CTI::emitCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::nativeExceptionCodeForHandlerVPC):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCatch):
+        * VM/Machine.cpp:
+        (KJS::Machine::throwException):
+        (KJS::Machine::privateExecute):
+        (KJS::ctiUnsupported):
+        (KJS::ctiTimedOut):
+        (KJS::Machine::cti_op_add):
+        (KJS::Machine::cti_op_pre_inc):
+        (KJS::Machine::cti_timeout_check):
+        (KJS::Machine::cti_op_loop_if_less):
+        (KJS::Machine::cti_op_put_by_id):
+        (KJS::Machine::cti_op_get_by_id):
+        (KJS::Machine::cti_op_instanceof):
+        (KJS::Machine::cti_op_del_by_id):
+        (KJS::Machine::cti_op_mul):
+        (KJS::Machine::cti_op_call):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_construct):
+        (KJS::Machine::cti_op_get_by_val):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_sub):
+        (KJS::Machine::cti_op_put_by_val):
+        (KJS::Machine::cti_op_lesseq):
+        (KJS::Machine::cti_op_loop_if_true):
+        (KJS::Machine::cti_op_negate):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_div):
+        (KJS::Machine::cti_op_pre_dec):
+        (KJS::Machine::cti_op_jless):
+        (KJS::Machine::cti_op_not):
+        (KJS::Machine::cti_op_jtrue):
+        (KJS::Machine::cti_op_post_inc):
+        (KJS::Machine::cti_op_eq):
+        (KJS::Machine::cti_op_lshift):
+        (KJS::Machine::cti_op_bitand):
+        (KJS::Machine::cti_op_rshift):
+        (KJS::Machine::cti_op_bitnot):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_mod):
+        (KJS::Machine::cti_op_less):
+        (KJS::Machine::cti_op_neq):
+        (KJS::Machine::cti_op_post_dec):
+        (KJS::Machine::cti_op_urshift):
+        (KJS::Machine::cti_op_bitxor):
+        (KJS::Machine::cti_op_bitor):
+        (KJS::Machine::cti_op_call_eval):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_op_push_scope):
+        (KJS::Machine::cti_op_stricteq):
+        (KJS::Machine::cti_op_nstricteq):
+        (KJS::Machine::cti_op_to_jsnumber):
+        (KJS::Machine::cti_op_in):
+        (KJS::Machine::cti_op_del_by_val):
+        (KJS::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * kjs/ExecState.h:
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::emitCmpl_i32m):
+
+2008-08-28  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Print debugging info to stderr so that run-webkit-tests can capture it.
+        This makes it easy to check whether test failures are due to unimplemented
+        op codes, missing support for exceptions, etc.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::printOpcodeOperandTypes):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        (KJS::ctiException):
+        (KJS::ctiUnsupported):
+        (KJS::Machine::cti_op_call):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_construct):
+        (KJS::Machine::cti_op_get_by_val):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_call_eval):
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough and Maciej Stachowiak.
+
+        Fix fast/js/bitwise-and-on-undefined.html.
+
+        A temporary value in the slow path of op_bitand was being stored in edx, but was
+        being clobbered by emitGetPutArg before we used it.  To fix this, emitGetPutArg
+        now takes a third argument that specifies the scratch register to use when loading
+        from memory.  This allows us to avoid clobbering the temporary in op_bitand.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetPutArg):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        * VM/CTI.h:
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Switch CTI on by default.
+
+        * wtf/Platform.h:
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix the build of the full WebKit stack.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Mark two new headers as private so they can be pulled in from WebCore.
+        * VM/CTI.h: Fix build issues that show up when compiled with GCC 4.2 as part of WebCore.
+        * wrec/WREC.h: Ditto.
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement op_new_error.  Does not fix any tests as it is always followed by the unimplemented op_throw.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_new_error):
+        * VM/Machine.h:
+
+2008-08-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_put_getter and op_put_setter.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_put_getter):
+        (KJS::Machine::cti_op_put_setter):
+        * VM/Machine.h:
+
+2008-08-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_del_by_val fixing 3 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_del_by_val):
+        * VM/Machine.h:
+
+2008-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Quick & dirty fix to get SamplingTool sampling op_call.
+
+        * VM/SamplingTool.h:
+        (KJS::SamplingTool::callingHostFunction):
+
+2008-08-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Fix op_put_by_index.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main): Use emitPutArgConstant instead of emitGetPutArg
+        for the property value.
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_put_by_index): Get the property value from the correct argument.
+
+2008-08-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_switch_imm in the CTI fixing 13 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_switch_imm):
+        * VM/Machine.h:
+
+2008-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement op_switch_char in CTI.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitCall):
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::CallRecord::CallRecord):
+        (KJS::SwitchRecord::SwitchRecord):
+        * VM/CodeBlock.h:
+        (KJS::SimpleJumpTable::SimpleJumpTable::ctiForValue):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_switch_char):
+        * VM/Machine.h:
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitJmpN_r):
+        (KJS::IA32MacroAssembler::getRelocatedAddress):
+        * wtf/Platform.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Implement op_put_by_index to fix 1 mozilla test.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_put_by_index):
+        * VM/Machine.h:
+
+2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        More fixes from Geoff's review.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetArg):
+        (KJS::CTI::emitGetPutArg):
+        (KJS::CTI::emitPutArg):
+        (KJS::CTI::emitPutArgConstant):
+        (KJS::CTI::getConstantImmediateNumericArg):
+        (KJS::CTI::emitGetCTIParam):
+        (KJS::CTI::emitPutResult):
+        (KJS::CTI::emitCall):
+        (KJS::CTI::emitJumpSlowCaseIfNotImm):
+        (KJS::CTI::emitJumpSlowCaseIfNotImms):
+        (KJS::CTI::getDeTaggedConstantImmediate):
+        (KJS::CTI::emitFastArithDeTagImmediate):
+        (KJS::CTI::emitFastArithReTagImmediate):
+        (KJS::CTI::emitFastArithPotentiallyReTagImmediate):
+        (KJS::CTI::emitFastArithImmToInt):
+        (KJS::CTI::emitFastArithIntToImmOrSlowCase):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_jmp_scopes to fix 2 Mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_push_new_scope): Update ExecState::m_scopeChain after calling ARG_setScopeChain.
+        (KJS::Machine::cti_op_jmp_scopes):
+        * VM/Machine.h:
+
+2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebKit Regular Expression Compiler. (set ENABLE_WREC = 1 in Platform.h).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/regexp.cpp:
+        * kjs/regexp.h:
+        * wrec: Added.
+        * wrec/WREC.cpp: Added.
+        * wrec/WREC.h: Added.
+        * wtf/Platform.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove bogus assertion.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_del_by_id):
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement op_push_new_scope and stub out op_catch.  This fixes 11 Mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_push_new_scope):
+        (KJS::Machine::cti_op_catch):
+        * VM/Machine.h:
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Clean up op_resolve_base so that it shares its implementation with the bytecode interpreter.
+
+        * VM/Machine.cpp:
+        (KJS::inlineResolveBase):
+        (KJS::resolveBase):
+
+2008-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add codegen support for op_instanceof, fixing 15 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_instanceof):
+        (KJS::Machine::cti_op_del_by_id):
+        * VM/Machine.h:
+        * wtf/Platform.h:
+
+2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fixes for initial review comments.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::ctiCompileGetArg):
+        (KJS::CTI::ctiCompileGetPutArg):
+        (KJS::CTI::ctiCompilePutResult):
+        (KJS::CTI::ctiCompileCall):
+        (KJS::CTI::CTI):
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::printOpcodeOperandTypes):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        * VM/Register.h:
+        * kjs/JSValue.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Fix up exception checking code.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_call):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_construct):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_call_eval):
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix slowcase for op_post_inc and op_post_dec fixing 2 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement op_in, fixing 8 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_in):
+        * VM/Machine.h:
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Don't hardcode the size of a Register for op_new_array.  Fixes a crash
+        seen during the Mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Add support for op_push_scope and op_pop_scope, fixing 20 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_push_scope):
+        (KJS::Machine::cti_op_pop_scope):
+        * VM/Machine.h:
+
+2008-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add codegen support for op_del_by_id, fixing 49 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_del_by_id):
+        * VM/Machine.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Don't hardcode the size of a Register for op_get_scoped_var and op_put_scoped_var 
+        fixing 513 mozilla tests in debug build.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+
+2008-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Added code generator support for op_loop, fixing around 60 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Set -fomit-frame-pointer in the correct location.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        Inital cut of CTI, Geoff's review fixes to follow.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp: Added.
+        (KJS::getJCB):
+        (KJS::CTI::ctiCompileGetArg):
+        (KJS::CTI::ctiCompileGetPutArg):
+        (KJS::CTI::ctiCompilePutArg):
+        (KJS::CTI::ctiCompilePutArgImm):
+        (KJS::CTI::ctiImmediateNumericArg):
+        (KJS::CTI::ctiCompileGetCTIParam):
+        (KJS::CTI::ctiCompilePutResult):
+        (KJS::CTI::ctiCompileCall):
+        (KJS::CTI::slowCaseIfNotImm):
+        (KJS::CTI::slowCaseIfNotImms):
+        (KJS::CTI::ctiFastArithDeTagConstImmediate):
+        (KJS::CTI::ctiFastArithDeTagImmediate):
+        (KJS::CTI::ctiFastArithReTagImmediate):
+        (KJS::CTI::ctiFastArithPotentiallyReTagImmediate):
+        (KJS::CTI::ctiFastArithImmToInt):
+        (KJS::CTI::ctiFastArithIntToImmOrSlowCase):
+        (KJS::CTI::CTI):
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::ctiCompileAdd):
+        (KJS::CTI::ctiCompileAddImm):
+        (KJS::CTI::ctiCompileAddImmNotInt):
+        (KJS::CTI::TEMP_HACK_PRINT_TYPES):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass3_Link):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h: Added.
+        (KJS::CTI2Result::CTI2Result):
+        (KJS::CallRecord::CallRecord):
+        (KJS::JmpTable::JmpTable):
+        (KJS::SlowCaseEntry::SlowCaseEntry):
+        (KJS::CTI::compile):
+        (KJS::CTI::LabelInfo::LabelInfo):
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::CodeBlock):
+        (KJS::CodeBlock::~CodeBlock):
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        (KJS::ctiException):
+        (KJS::ctiUnsupported):
+        (KJS::ctiTimedOut):
+        (KJS::Machine::cti_op_end):
+        (KJS::Machine::cti_op_add):
+        (KJS::Machine::cti_op_pre_inc):
+        (KJS::Machine::cti_timeout_check):
+        (KJS::Machine::cti_op_loop_if_less):
+        (KJS::Machine::cti_op_new_object):
+        (KJS::Machine::cti_op_put_by_id):
+        (KJS::Machine::cti_op_get_by_id):
+        (KJS::Machine::cti_op_mul):
+        (KJS::Machine::cti_op_new_func):
+        (KJS::Machine::cti_op_call):
+        (KJS::Machine::cti_op_ret):
+        (KJS::Machine::cti_op_new_array):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_construct):
+        (KJS::Machine::cti_op_get_by_val):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_sub):
+        (KJS::Machine::cti_op_put_by_val):
+        (KJS::Machine::cti_op_lesseq):
+        (KJS::Machine::cti_op_loop_if_true):
+        (KJS::Machine::cti_op_negate):
+        (KJS::Machine::cti_op_resolve_base):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_div):
+        (KJS::Machine::cti_op_pre_dec):
+        (KJS::Machine::cti_op_jless):
+        (KJS::Machine::cti_op_not):
+        (KJS::Machine::cti_op_jtrue):
+        (KJS::Machine::cti_op_post_inc):
+        (KJS::Machine::cti_op_eq):
+        (KJS::Machine::cti_op_lshift):
+        (KJS::Machine::cti_op_bitand):
+        (KJS::Machine::cti_op_rshift):
+        (KJS::Machine::cti_op_bitnot):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_new_func_exp):
+        (KJS::Machine::cti_op_mod):
+        (KJS::Machine::cti_op_less):
+        (KJS::Machine::cti_op_neq):
+        (KJS::Machine::cti_op_post_dec):
+        (KJS::Machine::cti_op_urshift):
+        (KJS::Machine::cti_op_bitxor):
+        (KJS::Machine::cti_op_new_regexp):
+        (KJS::Machine::cti_op_bitor):
+        (KJS::Machine::cti_op_call_eval):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_op_get_pnames):
+        (KJS::Machine::cti_op_next_pname):
+        (KJS::Machine::cti_op_typeof):
+        (KJS::Machine::cti_op_stricteq):
+        (KJS::Machine::cti_op_nstricteq):
+        (KJS::Machine::cti_op_to_jsnumber):
+        * VM/Machine.h:
+        * VM/Register.h:
+        (KJS::Register::jsValue):
+        (KJS::Register::getJSValue):
+        (KJS::Register::codeBlock):
+        (KJS::Register::scopeChain):
+        (KJS::Register::i):
+        (KJS::Register::r):
+        (KJS::Register::vPC):
+        (KJS::Register::jsPropertyNameIterator):
+        * VM/SamplingTool.cpp:
+        (KJS::):
+        (KJS::SamplingTool::run):
+        (KJS::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::zeroImmediate):
+        (KJS::JSImmediate::oneImmediate):
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::JSVariableObjectData::offsetOf_registers):
+        (KJS::JSVariableObject::offsetOf_d):
+        (KJS::JSVariableObject::offsetOf_Data_registers):
+        * masm: Added.
+        * masm/IA32MacroAsm.h: Added.
+        (KJS::JITCodeBuffer::JITCodeBuffer):
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::JITCodeBuffer::getEIP):
+        (KJS::JITCodeBuffer::start):
+        (KJS::JITCodeBuffer::getOffset):
+        (KJS::JITCodeBuffer::reset):
+        (KJS::JITCodeBuffer::copy):
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitModRm_rr):
+        (KJS::IA32MacroAssembler::emitModRm_rm):
+        (KJS::IA32MacroAssembler::emitModRm_rmsib):
+        (KJS::IA32MacroAssembler::emitModRm_opr):
+        (KJS::IA32MacroAssembler::emitModRm_opm):
+        (KJS::IA32MacroAssembler::IA32MacroAssembler):
+        (KJS::IA32MacroAssembler::emitInt3):
+        (KJS::IA32MacroAssembler::emitPushl_r):
+        (KJS::IA32MacroAssembler::emitPopl_r):
+        (KJS::IA32MacroAssembler::emitMovl_rr):
+        (KJS::IA32MacroAssembler::emitAddl_rr):
+        (KJS::IA32MacroAssembler::emitAddl_i8r):
+        (KJS::IA32MacroAssembler::emitAddl_i32r):
+        (KJS::IA32MacroAssembler::emitAddl_mr):
+        (KJS::IA32MacroAssembler::emitAndl_rr):
+        (KJS::IA32MacroAssembler::emitAndl_i32r):
+        (KJS::IA32MacroAssembler::emitCmpl_i8r):
+        (KJS::IA32MacroAssembler::emitCmpl_rr):
+        (KJS::IA32MacroAssembler::emitCmpl_rm):
+        (KJS::IA32MacroAssembler::emitCmpl_i32r):
+        (KJS::IA32MacroAssembler::emitCmpw_rm):
+        (KJS::IA32MacroAssembler::emitOrl_rr):
+        (KJS::IA32MacroAssembler::emitOrl_i8r):
+        (KJS::IA32MacroAssembler::emitSubl_rr):
+        (KJS::IA32MacroAssembler::emitSubl_i8r):
+        (KJS::IA32MacroAssembler::emitSubl_i32r):
+        (KJS::IA32MacroAssembler::emitSubl_mr):
+        (KJS::IA32MacroAssembler::emitTestl_i32r):
+        (KJS::IA32MacroAssembler::emitTestl_rr):
+        (KJS::IA32MacroAssembler::emitXorl_i8r):
+        (KJS::IA32MacroAssembler::emitXorl_rr):
+        (KJS::IA32MacroAssembler::emitSarl_i8r):
+        (KJS::IA32MacroAssembler::emitSarl_CLr):
+        (KJS::IA32MacroAssembler::emitShl_i8r):
+        (KJS::IA32MacroAssembler::emitShll_CLr):
+        (KJS::IA32MacroAssembler::emitMull_rr):
+        (KJS::IA32MacroAssembler::emitIdivl_r):
+        (KJS::IA32MacroAssembler::emitCdq):
+        (KJS::IA32MacroAssembler::emitMovl_mr):
+        (KJS::IA32MacroAssembler::emitMovzwl_mr):
+        (KJS::IA32MacroAssembler::emitMovl_rm):
+        (KJS::IA32MacroAssembler::emitMovl_i32r):
+        (KJS::IA32MacroAssembler::emitMovl_i32m):
+        (KJS::IA32MacroAssembler::emitLeal_mr):
+        (KJS::IA32MacroAssembler::emitRet):
+        (KJS::IA32MacroAssembler::JmpSrc::JmpSrc):
+        (KJS::IA32MacroAssembler::JmpDst::JmpDst):
+        (KJS::IA32MacroAssembler::emitCall):
+        (KJS::IA32MacroAssembler::label):
+        (KJS::IA32MacroAssembler::emitUnlinkedJmp):
+        (KJS::IA32MacroAssembler::emitUnlinkedJne):
+        (KJS::IA32MacroAssembler::emitUnlinkedJe):
+        (KJS::IA32MacroAssembler::emitUnlinkedJl):
+        (KJS::IA32MacroAssembler::emitUnlinkedJle):
+        (KJS::IA32MacroAssembler::emitUnlinkedJge):
+        (KJS::IA32MacroAssembler::emitUnlinkedJae):
+        (KJS::IA32MacroAssembler::emitUnlinkedJo):
+        (KJS::IA32MacroAssembler::emitPredictionNotTaken):
+        (KJS::IA32MacroAssembler::link):
+        (KJS::IA32MacroAssembler::copy):
+        * wtf/Platform.h:
+
+2008-08-26  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej.
+
+        Enabled -fomit-frame-pointer on Release and Production builds, add additional Profiling build config for shark, etc.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+=== Start merge of squirrelfish-extreme ===
+
+2008-09-06  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the Mac Debug build by adding symbols that are exported only in a
+        Debug configuration.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.Debug.exp: Added.
+        * JavaScriptCore.base.exp: Copied from JavaScriptCore.exp.
+        * JavaScriptCore.exp: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-09-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20681
+          JSPropertyNameIterator functions need to be inlined
+
+        1.007x as fast on SunSpider overall
+        1.081x as fast on SunSpider math-cordic
+
+        * VM/JSPropertyNameIterator.cpp: Moved functions out of here.
+        * VM/JSPropertyNameIterator.h:
+        (KJS::JSPropertyNameIterator::JSPropertyNameIterator): Moved
+        this into the header and marked it inline.
+        (KJS::JSPropertyNameIterator::create): Ditto.
+        (KJS::JSPropertyNameIterator::next): Ditto.
+
+2008-09-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20673
+          single-character strings are churning in the Identifier table
+
+        1.007x as fast on SunSpider overall
+        1.167x as fast on SunSpider string-fasta
+
+        * JavaScriptCore.exp: Updated.
+        * kjs/SmallStrings.cpp:
+        (KJS::SmallStrings::singleCharacterStringRep): Added.
+        * kjs/SmallStrings.h: Added singleCharacterStringRep for clients that
+        need just a UString, not a JSString.
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add): Added special cases for single character strings
+        so that the UString::Rep that ends up in the identifier table is the one
+        from the single-character string optimization; otherwise we end up having
+        to look it up in the identifier table over and over again.
+        (KJS::Identifier::addSlowCase): Ditto.
+        (KJS::Identifier::checkSameIdentifierTable): Made this function an empty
+        inline in release builds so that callers don't have to put #ifndef NDEBUG
+        at each call site.
+        * kjs/identifier.h:
+        (KJS::Identifier::add): Removed #ifndef NDEBUG around the calls to
+        checkSameIdentifierTable.
+        (KJS::Identifier::checkSameIdentifierTable): Added. Empty inline version
+        for NDEBUG builds.
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * kjs/JSObject.h: Move the inline virtual destructor after a non-inline
+        virtual function so that the symbol for the vtable is not marked as a
+        weakly exported symbol.
+
+2008-09-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20671
+          JavaScriptCore string manipulation spends too much time in memcpy
+
+        1.011x as fast on SunSpider overall
+        1.028x as fast on SunSpider string tests
+
+        For small strings, use a loop rather than calling memcpy. The loop can
+        be faster because there's no function call overhead, and because it can
+        assume the pointers are aligned instead of checking that. Currently the
+        threshold is set at 20 characters, based on some testing on one particular
+        computer. Later we can tune this for various platforms by setting
+        USTRING_COPY_CHARS_INLINE_CUTOFF appropriately, but it does no great harm
+        if not perfectly tuned.
+
+        * kjs/ustring.cpp:
+        (KJS::overflowIndicator): Removed bogus const.
+        (KJS::maxUChars): Ditto.
+        (KJS::copyChars): Added.
+        (KJS::UString::Rep::createCopying): Call copyChars instead of memcpy.
+        Also eliminated need for const_cast.
+        (KJS::UString::expandPreCapacity): Ditto.
+        (KJS::concatenate): Ditto.
+        (KJS::UString::spliceSubstringsWithSeparators): Ditto.
+        (KJS::UString::append): Ditto.
+
+2008-09-05  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam and Alexey.
+
+        Make the profiler work with a null exec state.  This will allow other
+        applications start the profiler to get DTrace probes going without
+        needing a WebView.
+
+        * ChangeLog:
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::ProfileGenerator):
+        (KJS::ProfileGenerator::willExecute):
+        (KJS::ProfileGenerator::didExecute):
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling):
+        (KJS::dispatchFunctionToProfiles):
+
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        
+        Fixed an off-by-one error that would cause the StructureIDChain to
+        be one object too short.
+        
+        Can't construct a test case because other factors make this not crash
+        (yet!).
+
+        * kjs/StructureID.cpp:
+        (KJS::StructureIDChain::StructureIDChain):
+
+2008-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20639.
+        Bug 20639: ENABLE_DASHBOARD_SUPPORT does not need to be a FEATURE_DEFINE
+
+        * Configurations/JavaScriptCore.xcconfig: Remove ENABLE_DASHBOARD_SUPPORT from FEATURE_DEFINES.
+        * wtf/Platform.h: Set ENABLE_DASHBOARD_SUPPORT for PLATFORM(MAC).
+
+2008-09-04  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Mac build fix.
+
+        * kjs/config.h: Only check the value of HAVE_CONFIG_H if it is defined.
+
+2008-09-04  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Eric Seidel.
+
+        http://bugs.webkit.org/show_bug.cgi?id=20380
+        [GTK][AUTOTOOLS] Include autotoolsconfig.h from config.h
+
+        * kjs/config.h: Include the configuration header generated by
+        autotools if available.
+
+2008-09-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix the QtWebKit build to match changes in r36016
+
+        * JavaScriptCore.pri:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::printStructureID): Store the instruction offset into an unsigned local
+        to avoid a warning related to format specifiers.
+        (KJS::CodeBlock::printStructureIDs): Ditto.
+
+2008-09-04  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Correct the spelling of 'entryIndices'.
+
+        * kjs/PropertyMap.cpp:
+        (KJS::PropertyMap::get):
+        (KJS::PropertyMap::getLocation):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::insert):
+        (KJS::PropertyMap::remove):
+        (KJS::PropertyMap::checkConsistency):
+        * kjs/PropertyMap.h:
+        (KJS::PropertyMapHashTable::entries):
+        (KJS::PropertyMap::getOffset):
+        (KJS::PropertyMap::putOffset):
+        (KJS::PropertyMap::offsetForTableLocation):
+
+2008-09-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6193925> REGRESSION: Crash occurs at
+        KJS::Machine::privateExecute() when attempting to load my Mobile Gallery
+        (http://www.me.com/gallery/#home)
+        
+        also
+        
+        https://bugs.webkit.org/show_bug.cgi?id=20633 Crash in privateExecute
+        @ cs.byu.edu
+        
+        The underlying problem was that we would cache prototype properties
+        even if the prototype was a dictionary.
+        
+        The fix is to transition a prototype back from dictionary to normal
+        status when an opcode caches access to it. (This is better than just
+        refusing to cache, since a heavily accessed prototype is almost
+        certainly not a true dictionary.)
+
+        * VM/Machine.cpp:
+        (KJS::Machine::tryCacheGetByID):
+        * kjs/JSObject.h:
+
+2008-09-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Clean up Platform.h and add PLATFORM(CHROMIUM), PLATFORM(SKIA) and USE(V8_BINDINGS)
+
+        * Configurations/JavaScriptCore.xcconfig: add missing ENABLE_*
+        * wtf/ASCIICType.h: include <wtf/Assertions.h> since it depends on it.
+        * wtf/Platform.h:
+
+2008-09-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        Remove the rest of the "zombie" code from the profiler.
+        - There is no longer a need for the ProfilerClient callback mechanism.
+
+        * API/JSProfilerPrivate.cpp:
+        (JSStartProfiling):
+        * JavaScriptCore.exp:
+        * profiler/HeavyProfile.h:
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::create):
+        (KJS::ProfileGenerator::ProfileGenerator):
+        * profiler/ProfileGenerator.h:
+        (KJS::ProfileGenerator::profileGroup):
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling): Immediately return the profile when
+        stopped instead of using a callback.
+        * profiler/Profiler.h:
+        * profiler/TreeProfile.h:
+
+2008-09-03  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * wtf/win/MainThreadWin.cpp:
+
+2008-09-02  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin and Tim.
+
+        Remove most of the "zombie" mode from the profiler.  Next we will need
+        to remove the client callback mechanism in profiles.
+
+        - This simplifies the code, leverages the recent changes I've made in
+        getting line numbers from SquirrelFish, and is a slight speed
+        improvement on SunSpider.
+        - Also the "zombie" mode was a constant source of odd edge cases and
+        obscure bugs so it's good to remove since all of its issues may not have
+        been found.
+
+        * API/JSProfilerPrivate.cpp: No need to call didFinishAllExecution() any
+        more.
+        (JSEndProfiling):
+        * JavaScriptCore.exp: Export the new signature of retrieveLastCaller()
+        * VM/Machine.cpp:
+        (KJS::Machine::execute): No need to call didFinishAllExecution() any
+        more.
+        (KJS::Machine::retrieveCaller): Now operates on InternalFunctions now
+        since the RegisterFile is no longer guaranteeded to store only
+        JSFunctions
+        (KJS::Machine::retrieveLastCaller): Now also retrieve the function's
+        name
+        (KJS::Machine::callFrame): A result of changing retrieveCaller()
+        * VM/Machine.h:
+        * VM/Register.h: 
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject):
+        * kjs/nodes.h:
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::create): Now pass the original exec and get the
+        global exec and client when necessary.  We need the original exec so we
+        can have the stack frame where profiling started.
+        (KJS::ProfileGenerator::ProfileGenerator): ditto.
+        (KJS::ProfileGenerator::addParentForConsoleStart): This is where the 
+        parent to star of the profile is added, if there is one.
+        (KJS::ProfileGenerator::willExecute): Remove uglyness!
+        (KJS::ProfileGenerator::didExecute): Ditto!
+        (KJS::ProfileGenerator::stopProfiling):
+        (KJS::ProfileGenerator::removeProfileStart): Use a better way to find
+        and remove the function we are looking for.
+        (KJS::ProfileGenerator::removeProfileEnd): Ditto.
+        * profiler/ProfileGenerator.h:
+        (KJS::ProfileGenerator::client):
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::removeChild): Add a better way to remove a child from
+        a ProfileNode.
+        (KJS::ProfileNode::stopProfiling):
+        (KJS::ProfileNode::debugPrintData): Modified a debug-only diagnostic
+        function to be sane.
+        * profiler/ProfileNode.h:
+        * profiler/Profiler.cpp: Change to pass the original exec state.
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling):
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+        (KJS::Profiler::createCallIdentifier):
+        * profiler/Profiler.h:
+
+2008-09-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Implement callOnMainThreadAndWait().
+
+        This will be useful when a background thread needs to perform UI calls synchronously
+        (e.g. an openDatabase() call cannot return until the user answers to a confirmation dialog).
+
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::FunctionWithContext): Added a ThreadCondition member. When
+        non-zero, the condition is signalled after the function is called.
+        (WTF::mainThreadFunctionQueueMutex): Renamed from functionQueueMutex, sinc this is no longer
+        static. Changed to be initialized from initializeThreading() to avoid lock contention.
+        (WTF::initializeMainThread): On non-Windows platforms, just call mainThreadFunctionQueueMutex.
+        (WTF::dispatchFunctionsFromMainThread): Signal synchronous calls when done.
+        (WTF::callOnMainThread): Updated for functionQueueMutex rename.
+        (WTF::callOnMainThreadAndWait):  Added.
+
+        * wtf/MainThread.h: Added callOnMainThreadAndWait(); initializeMainThread() now exists on
+        all platforms.
+
+        * wtf/win/MainThreadWin.cpp: (WTF::initializeMainThread): Added a callOnMainThreadAndWait()
+        call to initialize function queue mutex.
+
+        * wtf/ThreadingGtk.cpp: (WTF::initializeThreading):
+        * wtf/ThreadingPthreads.cpp: (WTF::initializeThreading):
+        * wtf/ThreadingQt.cpp: (WTF::initializeThreading):
+        Only initialize mainThreadIdentifier on non-Darwin platforms. It was not guaranteed to be
+        accurate on Darwin.
+
+2008-09-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Use isUndefinedOrNull() instead of separate checks for each in op_eq_null
+        and op_neq_null.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-09-02  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Bug 20296: OpcodeStats doesn't build on platforms which don't have mergesort().
+        <https://bugs.webkit.org/show_bug.cgi?id=20296>
+
+        * VM/Opcode.cpp:
+        (KJS::OpcodeStats::~OpcodeStats): mergesort() replaced with qsort()
+
+2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fast path for array.length and string.length.
+        
+        SunSpider says 0.5% faster.
+
+2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        Added optimized paths for comparing to null.
+        
+        SunSpider says 0.5% faster.
+
+2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Changed jsDriver.pl to dump the exact text you would need in order to
+        reproduce a test result. This enables a fast workflow where you copy
+        and paste a test failure in the terminal.
+
+        * tests/mozilla/jsDriver.pl:
+
+2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented the rest of Darin's review comments for the 09-01 inline
+        caching patch.
+        
+        SunSpider says 0.5% faster, but that seems like noise.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Put PutPropertySlot into
+        its own file, and added BatchedTransitionOptimizer.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::~CodeBlock): Use array indexing instead of a pointer
+        iterator.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator): Used BatchedTransitionOptimizer to
+        make batched put and remove for declared variables fast, without forever
+        pessimizing the global object. Removed the old getDirect/removeDirect hack
+        that tried to do the same in a more limited way.
+
+        * VM/CodeGenerator.h: Moved IdentifierRepHash to the KJS namespace since
+        it doesn't specialize anything in WTF.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine): Nixed the DummyConstruct tag because it was
+        confusingly named.
+
+        (KJS::Machine::execute):  Used BatchedTransitionOptimizer, as above. Fixed
+        up some comments.
+
+        (KJS::cachePrototypeChain): Cast to JSObject*, since it's more specific.
+
+        (KJS::Machine::tryCachePutByID): Use isNull() instead of comparing to
+        jsNull(), since isNull() leaves more options open for the future.
+        (KJS::Machine::tryCacheGetByID): ditto
+        (KJS::Machine::privateExecute): ditto
+
+        * VM/SamplingTool.cpp:
+        (KJS::SamplingTool::dump): Use C++-style cast, to match our style
+        guidelines.
+
+        * kjs/BatchedTransitionOptimizer.h: Added. New class that allows host
+        code to add a batch of properties to an object in an efficient way.
+
+        * kjs/JSActivation.cpp: Use isNull(), as above.
+
+        * kjs/JSArray.cpp: Get rid of DummyConstruct tag, as above.
+        * kjs/JSArray.h:
+
+        * kjs/JSGlobalData.cpp: Nixed two unused StructureIDs.
+        * kjs/JSGlobalData.h:
+
+        * kjs/JSImmediate.cpp: Use isNull(), as above.
+
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::mark): Moved mark tracing code elsewhere, to make this
+        function more readable.
+
+        (KJS::JSObject::put): Use isNull(), as above.
+
+        (KJS::JSObject::createInheritorID): Return a raw pointer, since the
+        object is owned by a data member, not necessarily the caller.
+        * kjs/JSObject.h:
+
+        * kjs/JSString.cpp: Use isNull(), as above.
+
+        * kjs/PropertyMap.h: Updated to use PropertySlot::invalidOffset.
+
+        * kjs/PropertySlot.h: Changed KJS_INVALID_OFFSET to WTF::notFound
+        because C macros are so 80's.
+
+        * kjs/PutPropertySlot.h: Added. Split out of PropertySlot.h. Also renamed
+        PutPropertySlot::SlotType to PutPropertySlot::Type, and slotBase to base,
+        since "slot" was redundant.
+
+        * kjs/StructureID.cpp: Added a new transition *away* from dictionary
+        status, to support BatchedTransitionOptimizer.
+
+        (KJS::StructureIDChain::StructureIDChain): No need to store m_size as
+        a data member, so keep it in a local, which might be faster.
+        * kjs/StructureID.h:
+
+        * kjs/SymbolTable.h: Moved IdentifierRepHash to KJS namespace, as above.
+        * kjs/ustring.h:
+
+2008-09-02  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add
+        StructureID.{cpp,h} to the project. Also let VS reorder this file.
+        * VM/CodeBlock.cpp: Include StringExtras so that snprintf will be
+        defined on Windows.
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Fix release build.
+
+        * JavaScriptCore.exp:
+
+2008-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk buildfix
+
+        * GNUmakefile.am:
+        * kjs/PropertyMap.cpp: rename Identifier.h to identifier.h
+        * kjs/StructureID.cpp: include JSObject.h
+
+2008-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        First cut at inline caching for access to vanilla JavaScript properties.
+        
+        SunSpider says 4% faster. Tests heavy on dictionary-like access have
+        regressed a bit -- we have a lot of room to improve in this area,
+        but this patch is over-ripe as-is.
+        
+        JSCells now have a StructureID that uniquely identifies their layout,
+        and holds their prototype.
+        
+        JSValue::put takes a PropertySlot& argument, so it can fill in details
+        about where it put a value, for the sake of caching.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator): Avoid calling removeDirect if we
+        can, since it disables inline caching in the global object. This can
+        probably improve in the future.
+
+        * kjs/JSGlobalObject.cpp: Nixed reset(), since it complicates caching, and
+        wasn't really necessary.
+
+        * kjs/JSObject.cpp: Tweaked getter / setter behavior not to rely on the
+        IsGetterSetter flag, since the flag was buggy. This is necessary in order
+        to avoid accidentally accessing a getter / setter as a normal property.
+        
+        Also changed getter / setter creation to honor ReadOnly, matching Mozilla.
+        
+        * kjs/PropertyMap.cpp: Nixed clear(), since it complicates caching and
+        isn't necessary.
+
+        * kjs/Shell.cpp: Moved SamplingTool dumping outside the loop. This allows
+        you to aggregate sampling of multiple files (or the same file repeatedly),
+        which helped me track down regressions.
+
+        * kjs/ustring.h: Moved IdentifierRepHash here to share it.
+
+2008-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Eagerly allocate the Math object's numeric constants. This avoids
+        constantly reallocating them in loops, and also ensures that the Math
+        object will not use the single property optimization, which makes
+        properties ineligible for caching.
+
+        SunSpider reports a small speedup, in combination with inline caching.
+
+        * kjs/MathObject.cpp:
+        (KJS::MathObject::MathObject):
+        (KJS::MathObject::getOwnPropertySlot):
+        * kjs/MathObject.h:
+
+2008-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix, not reviewed.
+
+        * GNUmakefile.am: Add SmallStrings.cpp in both release and debug builds
+
+2008-08-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20577: REGRESSION (r36006): Gmail is broken
+        <https://bugs.webkit.org/show_bug.cgi?id=20577>
+
+        r36006 changed stringProtoFuncSubstr() so that it is uses the more
+        efficient jsSubstring(), rather than using UString::substr() and then
+        calling jsString(). However, the change did not account for the case
+        where the start and the length of the substring extend beyond the length
+        of the original string. This patch corrects that.
+
+        * kjs/StringPrototype.cpp:
+        (KJS::stringProtoFuncSubstr):
+
+2008-08-31  Simon Hausmann  <hausmann@wekit.org>
+
+        Unreviewed build fix (with gcc 4.3)
+
+        * kjs/ustring.h: Properly forward declare operator== for UString and
+        the the concatenate functions inside the KJS namespace.
+
+2008-08-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20333
+          improve JavaScript speed when handling single-character strings
+
+        1.035x as fast on SunSpider overall.
+        1.127x as fast on SunSpider string tests.
+        1.910x as fast on SunSpider string-base64 test.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction): Removed unneeded explicit construction of UString.
+
+        * GNUmakefile.am: Added SmallStrings.h and SmallStrings.cpp.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/Machine.cpp:
+        (KJS::jsAddSlowCase): Changed to use a code path that doesn't involve
+        a UString constructor. This avoids an extra jump caused by the "in charge"
+        vs. "not in charge" constructors.
+        (KJS::jsAdd): Ditto.
+        (KJS::jsTypeStringForValue): Adopted jsNontrivialString.
+
+        * kjs/ArrayPrototype.cpp:
+        (KJS::arrayProtoFuncToString): Adopted jsEmptyString.
+        (KJS::arrayProtoFuncToLocaleString): Ditto.
+        (KJS::arrayProtoFuncJoin): Ditto.
+        * kjs/BooleanPrototype.cpp:
+        (KJS::booleanProtoFuncToString): Adopted jsNontrivialString.
+        * kjs/DateConstructor.cpp:
+        (KJS::callDate): Ditto.
+        * kjs/DatePrototype.cpp:
+        (KJS::formatLocaleDate): Adopted jsEmptyString and jsNontrivialString.
+        (KJS::dateProtoFuncToString): Ditto.
+        (KJS::dateProtoFuncToUTCString): Ditto.
+        (KJS::dateProtoFuncToDateString): Ditto.
+        (KJS::dateProtoFuncToTimeString): Ditto.
+        (KJS::dateProtoFuncToLocaleString): Ditto.
+        (KJS::dateProtoFuncToLocaleDateString): Ditto.
+        (KJS::dateProtoFuncToLocaleTimeString): Ditto.
+        (KJS::dateProtoFuncToGMTString): Ditto.
+
+        * kjs/ErrorPrototype.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype): Ditto.
+        (KJS::errorProtoFuncToString): Ditto.
+
+        * kjs/JSGlobalData.h: Added SmallStrings.
+
+        * kjs/JSString.cpp:
+        (KJS::jsString): Eliminated the overload that takes a const char*.
+        Added code to use SmallStrings to get strings of small sizes rather
+        than creating a new JSString every time.
+        (KJS::jsSubstring): Added. Used when creating a string from a substring
+        to avoid creating a JSString in cases where the substring will end up
+        empty or as one character.
+        (KJS::jsOwnedString): Added the same code as in jsString.
+
+        * kjs/JSString.h: Added new functions jsEmptyString, jsSingleCharacterString,
+        jsSingleCharacterSubstring, jsSubstring, and jsNontrivialString for various
+        cases where we want to create JSString, and want special handling for small
+        strings.
+        (KJS::JSString::JSString): Added an overload that takes a PassRefPtr of
+        a UString::Rep so you don't have to construct a UString; PassRefPtr can be
+        more efficient.
+        (KJS::jsEmptyString): Added.
+        (KJS::jsSingleCharacterString): Added.
+        (KJS::jsSingleCharacterSubstring): Added.
+        (KJS::jsNontrivialString): Added.
+        (KJS::JSString::getIndex): Adopted jsSingleCharacterSubstring.
+        (KJS::JSString::getStringPropertySlot): Ditto.
+
+        * kjs/NumberPrototype.cpp:
+        (KJS::numberProtoFuncToFixed): Adopted jsNontrivialString.
+        (KJS::numberProtoFuncToExponential): Ditto.
+        (KJS::numberProtoFuncToPrecision): Ditto.
+
+        * kjs/ObjectPrototype.cpp:
+        (KJS::objectProtoFuncToLocaleString): Adopted toThisJSString.
+        (KJS::objectProtoFuncToString): Adopted jsNontrivialString.
+
+        * kjs/RegExpConstructor.cpp: Separated the lastInput value that's used
+        with the lastOvector to return matches from the input value that can be
+        changed via JavaScript. They will be equal in many cases, but not all.
+        (KJS::RegExpConstructor::performMatch): Set input.
+        (KJS::RegExpMatchesArray::RegExpMatchesArray): Ditto.
+        (KJS::RegExpMatchesArray::fillArrayInstance): Adopted jsSubstring. Also,
+        use input rather than lastInput in the appropriate place.
+        (KJS::RegExpConstructor::getBackref): Adopted jsSubstring and jsEmptyString.
+        Added code to handle the case where there is no backref -- before this
+        depended on range checking in UString::substr which is not present in
+        jsSubstring.
+        (KJS::RegExpConstructor::getLastParen): Ditto.
+        (KJS::RegExpConstructor::getLeftContext): Ditto.
+        (KJS::RegExpConstructor::getRightContext): Ditto.
+        (KJS::RegExpConstructor::getValueProperty): Use input rather than lastInput.
+        Also adopt jsEmptyString.
+        (KJS::RegExpConstructor::putValueProperty): Ditto.
+        (KJS::RegExpConstructor::input): Ditto.
+
+        * kjs/RegExpPrototype.cpp:
+        (KJS::regExpProtoFuncToString): Adopt jsNonTrivialString. Also changed to
+        use UString::append to append single characters rather than using += and
+        a C-style string.
+
+        * kjs/SmallStrings.cpp: Added.
+        (KJS::SmallStringsStorage::SmallStringsStorage): Construct the
+        buffer and UString::Rep for all 256 single-character strings for
+        the U+0000 through U+00FF. This covers all the values used in
+        the base64 test as well as most values seen elsewhere on the web
+        as well. It's possible that later we might fix this to only work
+        for U+0000 through U+007F but the others are used quite a bit in
+        the current version of the base64 test.
+        (KJS::SmallStringsStorage::~SmallStringsStorage): Free memory.
+        (KJS::SmallStrings::SmallStrings): Create a set of small strings,
+        initially not created; created later when they are used.
+        (KJS::SmallStrings::~SmallStrings): Deallocate. Not left compiler
+        generated because the SmallStringsStorage class's destructor needs
+        to be visible.
+        (KJS::SmallStrings::mark): Mark all the strings.
+        (KJS::SmallStrings::createEmptyString): Create a cell for the
+        empty string. Called only the first time.
+        (KJS::SmallStrings::createSingleCharacterString): Create a cell
+        for one of the single-character strings. Called only the first time.
+        * kjs/SmallStrings.h: Added.
+
+        * kjs/StringConstructor.cpp:
+        (KJS::stringFromCharCodeSlowCase): Factored out of strinFromCharCode.
+        Only used for cases where the caller does not pass exactly one argument.
+        (KJS::stringFromCharCode): Adopted jsSingleCharacterString.
+        (KJS::callStringConstructor): Adopted jsEmptyString.
+
+        * kjs/StringObject.cpp:
+        (KJS::StringObject::StringObject): Adopted jsEmptyString.
+
+        * kjs/StringPrototype.cpp:
+        (KJS::stringProtoFuncReplace): Adopted jsSubstring.
+        (KJS::stringProtoFuncCharAt): Adopted jsEmptyString and
+        jsSingleCharacterSubstring and also added a special case when the
+        index is an immediate number to avoid conversion to and from floating
+        point, since that's the common case.
+        (KJS::stringProtoFuncCharCodeAt): Ditto.
+        (KJS::stringProtoFuncMatch): Adopted jsSubstring and jsEmptyString.
+        (KJS::stringProtoFuncSlice): Adopted jsSubstring and
+        jsSingleCharacterSubstring. Also got rid of some unneeded locals and
+        removed unneeded code to set the length property of the array, since it
+        is automatically updated as values are added to the array.
+        (KJS::stringProtoFuncSplit): Adopted jsEmptyString.
+        (KJS::stringProtoFuncSubstr): Adopted jsSubstring.
+        (KJS::stringProtoFuncSubstring): Ditto.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::collect): Added a call to mark SmallStrings.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::expandedSize): Made this a static member function since
+        it doesn't need to look at any data members.
+        (KJS::UString::expandCapacity): Use a non-inline function, makeNull, to
+        set the rep to null in failure cases. This avoids adding a PIC branch for
+        the normal case when there is no failure.
+        (KJS::UString::expandPreCapacity): Ditto.
+        (KJS::UString::UString): Ditto.
+        (KJS::concatenate): Refactored the concatenation constructor into this
+        separate function. Calling the concatenation constructor was leading to
+        an extra branch because of the in-charge vs. not-in-charge versions not
+        both being inlined, and this was showing up as nearly 1% on Shark. Also
+        added a special case for when the second string is a single character,
+        since it's a common idiom to build up a string that way and we can do
+        things much more quickly, without involving memcpy for example. Also
+        adopted the non-inline function, nullRep, for the same reason given for
+        makeNull above.
+        (KJS::UString::append): Adopted makeNull for failure cases.
+        (KJS::UString::operator=): Ditto.
+        (KJS::UString::toDouble): Added a special case for converting single
+        character strings to numbers. We're doing this a ton of times while
+        running the base64 test.
+        (KJS::operator==): Added special cases so we can compare single-character
+        strings without calling memcmp. Later we might want to special case other
+        short lengths similarly.
+        (KJS::UString::makeNull): Added.
+        (KJS::UString::nullRep): Added.
+        * kjs/ustring.h: Added declarations for the nullRep and makeNull. Changed
+        expandedSize to be a static member function. Added a declaration of the
+        concatenate function. Removed the concatenation constructor. Rewrote
+        operator+ to use the concatenate function.
+
+2008-08-29  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * VM/Machine.cpp:
+        (KJS::getCPUTime):
+
+2008-08-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6174667> 
+        When a machine is under heavy load, the Slow Script dialog often comes up many times and just gets in the way
+        
+        Instead of using clock time, use the CPU time spent executing the current thread when
+        determining if the script has been running for too long.
+        
+        * VM/Machine.cpp:
+        (KJS::getCPUTime):
+        (KJS::Machine::checkTimeout):
+
+2008-08-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Sam Weinig.
+
+        Change 'term' to 'expr' in variable names to standardize terminology.
+
+        * kjs/nodes.cpp:
+        (KJS::BinaryOpNode::emitCode):
+        (KJS::ReverseBinaryOpNode::emitCode):
+        (KJS::ThrowableBinaryOpNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::BinaryOpNode::BinaryOpNode):
+        (KJS::ReverseBinaryOpNode::ReverseBinaryOpNode):
+        (KJS::MultNode::):
+        (KJS::DivNode::):
+        (KJS::ModNode::):
+        (KJS::AddNode::):
+        (KJS::SubNode::):
+        (KJS::LeftShiftNode::):
+        (KJS::RightShiftNode::):
+        (KJS::UnsignedRightShiftNode::):
+        (KJS::LessNode::):
+        (KJS::GreaterNode::):
+        (KJS::LessEqNode::):
+        (KJS::GreaterEqNode::):
+        (KJS::ThrowableBinaryOpNode::):
+        (KJS::InstanceOfNode::):
+        (KJS::InNode::):
+        (KJS::EqualNode::):
+        (KJS::NotEqualNode::):
+        (KJS::StrictEqualNode::):
+        (KJS::NotStrictEqualNode::):
+        (KJS::BitAndNode::):
+        (KJS::BitOrNode::):
+        (KJS::BitXOrNode::):
+        * kjs/nodes2string.cpp:
+        (KJS::MultNode::streamTo):
+        (KJS::DivNode::streamTo):
+        (KJS::ModNode::streamTo):
+        (KJS::AddNode::streamTo):
+        (KJS::SubNode::streamTo):
+        (KJS::LeftShiftNode::streamTo):
+        (KJS::RightShiftNode::streamTo):
+        (KJS::UnsignedRightShiftNode::streamTo):
+        (KJS::LessNode::streamTo):
+        (KJS::GreaterNode::streamTo):
+        (KJS::LessEqNode::streamTo):
+        (KJS::GreaterEqNode::streamTo):
+        (KJS::InstanceOfNode::streamTo):
+        (KJS::InNode::streamTo):
+        (KJS::EqualNode::streamTo):
+        (KJS::NotEqualNode::streamTo):
+        (KJS::StrictEqualNode::streamTo):
+        (KJS::NotStrictEqualNode::streamTo):
+        (KJS::BitAndNode::streamTo):
+        (KJS::BitXOrNode::streamTo):
+        (KJS::BitOrNode::streamTo):
+
+2008-08-28  Alp Toker  <alp@nuanti.com>
+
+        GTK+ dist/build fix. List newly added header files.
+
+        * GNUmakefile.am:
+
+2008-08-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Change to throw a ReferenceError at runtime instead of a ParseError
+        at parse time, when the left hand side expression of a for-in statement
+        is not an lvalue.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::ForInNode::emitCode):
+
+2008-08-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Not reviewed, build fix (at least for OpenBSD, posssibly more).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20545
+        missing #include <unistd.h> in JavaScriptCore/VM/SamplingTool.cpp
+
+        * VM/SamplingTool.cpp: add the missing include.
+
+2008-08-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff and Cameron.
+
+        <rdar://problem/6174603> Hitting assertion in Register::codeBlock when
+        loading facebook (20516).
+
+        - This was a result of my line numbers change.  After a host function is
+        called the stack does not get reset correctly.
+        - Oddly this also appears to be a slight speedup on SunSpider.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-08-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff and Tim.
+
+        Export new API methods.
+
+        * JavaScriptCore.exp:
+
+2008-08-25  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff, Tim and Mark.
+
+        <rdar://problem/6150623> JSProfiler: It would be nice if the profiles
+        in the console said what file and line number they came from
+        - Lay the foundation for getting line numbers and other data from the
+        JavaScript engine.  With the cleanup in kjs/ExecState this is actually
+        a slight performance improvement.
+
+        * JavaScriptCore.exp: Export retrieveLastCaller() for WebCore.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/Machine.cpp: Now Host and JS functions set a call frame on the
+        exec state, so this and the profiler code were pulled out of the
+        branches.
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::retrieveLastCaller): This get's the lineNumber, sourceID
+        and sourceURL for the previously called function.
+        * VM/Machine.h:
+        * kjs/ExecState.cpp: Remove references to JSFunction since it's not used
+        anywhere.
+        * kjs/ExecState.h:
+
+2008-08-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Ensure that JSGlobalContextRelease() performs garbage collection, even if there are other
+        contexts in the current context's group.
+
+        This is only really necessary when the last reference is released, but there is no way to
+        determine that, and no harm in collecting slightly more often.
+
+        * API/JSContextRef.cpp: (JSGlobalContextRelease): Explicitly collect the heap if it is not
+        being destroyed.
+
+2008-08-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20093: JSC shell does not clear exceptions after it executes toString on an expression
+        <https://bugs.webkit.org/show_bug.cgi?id=20093>
+
+        Clear exceptions after evaluating any code in the JSC shell. We do not
+        report exceptions that are caused by calling toString on the final
+        valued, but at least we avoid incorrect behaviour.
+
+        Also, print any exceptions that occurred while evaluating code at the
+        interactive prompt, not just while evaluating code from a file.
+
+        * kjs/Shell.cpp:
+        (runWithScripts):
+        (runInteractive):
+
+2008-08-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Remove an unnecessary RefPtr to a RegisterID.
+
+        * kjs/nodes.cpp:
+        (KJS::DeleteBracketNode::emitCode):
+
+2008-08-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use the correct version number for when JSGlobalContextCreate was introduced.
+
+        * API/JSContextRef.h:
+
+2008-08-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Mark Rowe.
+
+        Remove modelines.
+
+        * API/APICast.h:
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSClassRef.cpp:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSProfilerPrivate.cpp:
+        * API/JSStringRef.cpp:
+        * API/JSStringRefBSTR.cpp:
+        * API/JSStringRefCF.cpp:
+        * API/JSValueRef.cpp:
+        * API/tests/JSNode.c:
+        * API/tests/JSNode.h:
+        * API/tests/JSNodeList.c:
+        * API/tests/JSNodeList.h:
+        * API/tests/Node.c:
+        * API/tests/Node.h:
+        * API/tests/NodeList.c:
+        * API/tests/NodeList.h:
+        * API/tests/minidom.c:
+        * API/tests/minidom.js:
+        * API/tests/testapi.c:
+        * API/tests/testapi.js:
+        * JavaScriptCore.pro:
+        * kjs/FunctionConstructor.h:
+        * kjs/FunctionPrototype.h:
+        * kjs/JSArray.h:
+        * kjs/JSString.h:
+        * kjs/JSWrapperObject.cpp:
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.h:
+        * kjs/lexer.h:
+        * kjs/lookup.h:
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/HashCountedSet.h:
+        * wtf/HashFunctions.h:
+        * wtf/HashIterators.h:
+        * wtf/HashMap.h:
+        * wtf/HashSet.h:
+        * wtf/HashTable.h:
+        * wtf/HashTraits.h:
+        * wtf/ListHashSet.h:
+        * wtf/ListRefPtr.h:
+        * wtf/Noncopyable.h:
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/PassRefPtr.h:
+        * wtf/Platform.h:
+        * wtf/RefPtr.h:
+        * wtf/RefPtrHashMap.h:
+        * wtf/RetainPtr.h:
+        * wtf/UnusedParam.h:
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/icu/UnicodeIcu.h:
+
+2008-08-22  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Some cleanup to match our coding style.
+
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/completion.h:
+        * kjs/identifier.cpp:
+        (KJS::Identifier::equal):
+        (KJS::CStringTranslator::hash):
+        (KJS::CStringTranslator::equal):
+        (KJS::CStringTranslator::translate):
+        (KJS::UCharBufferTranslator::equal):
+        (KJS::UCharBufferTranslator::translate):
+        (KJS::Identifier::remove):
+        * kjs/operations.h:
+
+2008-08-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * API/WebKitAvailability.h: Define DEPRECATED_ATTRIBUTE.
+
+2008-08-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Bring back shared JSGlobalData and implicit locking, because too many clients rely on it.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::~JSGlobalData):
+        (KJS::JSGlobalData::JSGlobalData): Re-add shared instance.
+        (KJS::JSGlobalData::sharedInstanceExists): Ditto.
+        (KJS::JSGlobalData::sharedInstance): Ditto.
+        (KJS::JSGlobalData::sharedInstanceInternal): Ditto.
+
+        * API/JSContextRef.h: Deprecated JSGlobalContextCreate(). Added a very conservative
+        description of its threading model (nothing is allowed).
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Use shared JSGlobalData.
+        (JSGlobalContextCreateInGroup): Support passing NULL group to request a unique one.
+        (JSGlobalContextRetain): Added back locking.
+        (JSGlobalContextRelease): Ditto.
+        (JSContextGetGlobalObject): Ditto.
+
+        * API/tests/minidom.c: (main):
+        * API/tests/testapi.c: (main):
+        Switched to JSGlobalContextCreateInGroup() to avoid deprecation warnings.
+
+        * JavaScriptCore.exp: Re-added JSLock methods. Added JSGlobalContextCreateInGroup (d'oh!).
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        * API/JSCallbackConstructor.cpp:
+        (KJS::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::init):
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::construct):
+        (KJS::::hasInstance):
+        (KJS::::call):
+        (KJS::::getPropertyNames):
+        (KJS::::toNumber):
+        (KJS::::toString):
+        (KJS::::staticValueGetter):
+        (KJS::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * ForwardingHeaders/JavaScriptCore/JSLock.h: Added.
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject):
+        (KJS::JSGlobalObject::init):
+        * kjs/JSLock.cpp: Added.
+        (KJS::createJSLockCount):
+        (KJS::JSLock::lockCount):
+        (KJS::setLockCount):
+        (KJS::JSLock::JSLock):
+        (KJS::JSLock::lock):
+        (KJS::JSLock::unlock):
+        (KJS::JSLock::currentThreadIsHoldingLock):
+        (KJS::JSLock::DropAllLocks::DropAllLocks):
+        (KJS::JSLock::DropAllLocks::~DropAllLocks):
+        * kjs/JSLock.h: Added.
+        (KJS::JSLock::JSLock):
+        (KJS::JSLock::~JSLock):
+        * kjs/Shell.cpp:
+        (functionGC):
+        (jscmain):
+        * kjs/collector.cpp:
+        (KJS::Heap::~Heap):
+        (KJS::Heap::heapAllocate):
+        (KJS::Heap::setGCProtectNeedsLocking):
+        (KJS::Heap::protect):
+        (KJS::Heap::unprotect):
+        (KJS::Heap::collect):
+        * kjs/identifier.cpp:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::checkSyntax):
+        (KJS::Interpreter::evaluate):
+        Re-added implicit locking.
+
+2008-08-19  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim and Mark.
+
+        Implement DTrace hooks for dashcode and instruments.
+
+        * API/JSProfilerPrivate.cpp: Added. Expose SPI so that profiling can be
+        turned on from a client.  The DTrace probes were added within the
+        profiler mechanism for performance reasons so the profiler must be
+        started to enable tracing.
+        (JSStartProfiling):
+        (JSEndProfiling):
+        * API/JSProfilerPrivate.h: Added. Ditto.
+        * JavaScriptCore.exp: Exposing the start/stop methods to clients.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/Tracing.d: Define the DTrace probes.
+        * kjs/Tracing.h: Ditto.
+        * profiler/ProfileGenerator.cpp: Implement the DTrace probes in the
+        profiler.
+        (KJS::ProfileGenerator::willExecute):
+        (KJS::ProfileGenerator::didExecute):
+
+2008-08-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+        
+        * kjs/operations.cpp:
+        (KJS::equal):
+
+2008-08-18  Timothy Hatcher  <timothy@apple.com>
+
+        Fix an assertion when generating a heavy profile because the
+        empty value and deleted value of CallIdentifier where equal.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20439
+
+        Reviewed by Dan Bernstein.
+
+        * profiler/CallIdentifier.h: Make the emptyValue for CallIdentifier
+        use empty strings for URL and function name.
+
+2008-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - eliminate JSValue::type()
+
+        This will make it slightly easier to change the JSImmediate design without
+        having to touch so many call sites.
+
+        SunSpider says this change is a wash (looked like a slight speedup, but not
+        statistically significant).
+
+        * API/JSStringRef.cpp: Removed include of JSType.h.
+        * API/JSValueRef.cpp: Removed include of JSType.h.
+        (JSValueGetType): Replaced use of JSValue::type() with
+        JSValue::is functions.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/JSPropertyNameIterator.cpp: Removed type() implementation.
+        (KJS::JSPropertyNameIterator::toPrimitive): Changed to take
+        PreferredPrimitiveType argument instead of JSType.
+        * VM/JSPropertyNameIterator.h: Ditto.
+
+        * VM/Machine.cpp:
+        (KJS::fastIsNumber): Updated for name change.
+        (KJS::fastToInt32): Ditto.
+        (KJS::fastToUInt32): Ditto.
+        (KJS::jsAddSlowCase): Updated toPrimitive caller for change from
+        JSType to PreferredPrimitiveType.
+        (KJS::jsAdd): Replaced calls to JSValue::type() with calls to
+        JSValue::isString().
+        (KJS::jsTypeStringForValue): Replaced calls to JSValue::type()
+        with multiple calls to JSValue::is -- we could make this a
+        virtual function instead if we want to have faster performance.
+        (KJS::Machine::privateExecute): Renamed JSImmediate::toTruncatedUInt32
+        to JSImmediate::getTruncatedUInt32 for consistency with other functions.
+        Changed two calls of JSValue::type() to JSValue::isString().
+
+        * kjs/GetterSetter.cpp:
+        (KJS::GetterSetter::toPrimitive): Changed to take
+        PreferredPrimitiveType argument instead of JSType.
+        (KJS::GetterSetter::isGetterSetter): Added.
+        * kjs/GetterSetter.h:
+
+        * kjs/JSCell.cpp:
+        (KJS::JSCell::isString): Added.
+        (KJS::JSCell::isGetterSetter): Added.
+        (KJS::JSCell::isObject): Added.
+
+        * kjs/JSCell.h: Eliminated type function. Added isGetterSetter.
+        Made isString and isObject virtual. Changed toPrimitive to take
+        PreferredPrimitiveType argument instead of JSType.
+        (KJS::JSCell::isNumber): Use Heap::isNumber for faster performance.
+        (KJS::JSValue::isGetterSetter): Added.
+        (KJS::JSValue::toPrimitive): Changed to take
+        PreferredPrimitiveType argument instead of JSType.
+
+        * kjs/JSImmediate.h: Removed JSValue::type() and replaced
+        JSValue::toTruncatedUInt32 with JSValue::getTruncatedUInt32.
+        (KJS::JSImmediate::isEitherImmediate): Added.
+
+        * kjs/JSNotAnObject.cpp:
+        (KJS::JSNotAnObject::toPrimitive): Changed to take
+        PreferredPrimitiveType argument instead of JSType.
+        * kjs/JSNotAnObject.h: Ditto.
+        * kjs/JSNumberCell.cpp:
+        (KJS::JSNumberCell::toPrimitive): Ditto.
+        * kjs/JSNumberCell.h:
+        (KJS::JSNumberCell::toInt32): Renamed from fastToInt32. There's no
+        other "slow" version of this once you have a JSNumberCell, so there's
+        no need for "fast" in the name. It's a feature that this hides the
+        base class toInt32, which does the same job less efficiently (and has
+        an additional ExecState argument).
+        (KJS::JSNumberCell::toUInt32): Ditto.
+
+        * kjs/JSObject.cpp:
+        (KJS::callDefaultValueFunction): Use isGetterSetter instead of type.
+        (KJS::JSObject::getPrimitiveNumber): Use PreferredPrimitiveType.
+        (KJS::JSObject::defaultValue): Ditto.
+        (KJS::JSObject::defineGetter): Use isGetterSetter.
+        (KJS::JSObject::defineSetter): Ditto.
+        (KJS::JSObject::lookupGetter): Ditto.
+        (KJS::JSObject::lookupSetter): Ditto.
+        (KJS::JSObject::toNumber): Use PreferredPrimitiveType.
+        (KJS::JSObject::toString): Ditto.
+        (KJS::JSObject::isObject): Added.
+
+        * kjs/JSObject.h:
+        (KJS::JSObject::inherits): Call the isObject from JSCell; it's now
+        hidden by our override of isObject.
+        (KJS::JSObject::getOwnPropertySlotForWrite): Use isGetterSetter
+        instead of type.
+        (KJS::JSObject::getOwnPropertySlot): Ditto.
+        (KJS::JSObject::toPrimitive): Use PreferredPrimitiveType.
+
+        * kjs/JSString.cpp:
+        (KJS::JSString::toPrimitive): Use PreferredPrimitiveType.
+        (KJS::JSString::isString): Added.
+        * kjs/JSString.h: Ditto.
+
+        * kjs/JSValue.h: Removed type(), added isGetterSetter(). Added
+        PreferredPrimitiveType enum and used it as the argument for the
+        toPrimitive function.
+        (KJS::JSValue::getBoolean): Simplified a bit an removed a branch.
+
+        * kjs/collector.cpp:
+        (KJS::typeName): Changed to use JSCell::is functions instead of
+        calling JSCell::type.
+
+        * kjs/collector.h:
+        (KJS::Heap::isNumber): Renamed from fastIsNumber.
+
+        * kjs/nodes.h: Added now-needed include of JSType, since the type
+        is used here to record types of values in the tree.
+
+        * kjs/operations.cpp:
+        (KJS::equal): Rewrote to no longer depend on type().
+        (KJS::strictEqual): Ditto.
+
+2008-08-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        If there are no nodes in a profile all the time should be attributed to
+        (idle)
+
+        * profiler/Profile.cpp: If ther are no nodes make sure we still process
+        the head.
+        (KJS::Profile::forEach):
+        * profiler/ProfileGenerator.cpp: Remove some useless code.
+        (KJS::ProfileGenerator::stopProfiling):
+
+2008-08-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        Make JSGlobalContextRetain/Release actually work.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextRetain):
+        (JSGlobalContextRelease):
+        Ref/deref global data to give checking for globalData.refCount() some sense.
+
+        * API/tests/testapi.c: (main): Added a test for this bug.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::~JSGlobalData):
+        While checking for memory leaks, found that JSGlobalData::emptyList has changed to
+        a pointer, but it was not destructed, causing a huge leak in run-webkit-tests --threaded.
+
+2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Change the counting of constants so that preincrement and predecrement of
+        const local variables are considered unexpected loads.
+
+        * kjs/nodes.cpp:
+        (KJS::PrefixResolveNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::ScopeNode::neededConstants):
+
+2008-08-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        <rdar://problem/6150322> In Gmail, a crash occurs at KJS::Machine::privateExecute() when applying list styling to text after a quote had been removed
+        <https://bugs.webkit.org/show_bug.cgi?id=20386>
+
+        This crash was caused by "depth()" incorrectly determining the scope depth 
+        of a 0 depth function without a full scope chain.  Because such a function
+        would not have an activation the depth function would return the scope depth
+        of the parent frame, thus triggering an incorrect unwind.  Any subsequent 
+        look up that walked the scope chain would result in incorrect behaviour,
+        leading to a crash or incorrect variable resolution.  This can only actually
+        happen in try...finally statements as that's the only path that can result in
+        the need to unwind the scope chain, but not force the function to need a
+        full scope chain.
+
+        The fix is simply to check for this case before attempting to walk the scope chain.
+
+        * VM/Machine.cpp:
+        (KJS::depth):
+        (KJS::Machine::throwException):
+
+2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 20419: Remove op_jless
+        <https://bugs.webkit.org/show_bug.cgi?id=20419>
+
+        Remove op_jless, which is rarely used now that we have op_loop_if_less.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+
+2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Dan Bernstein.
+
+        Fix a typo in r35807 that is also causing build failures for
+        non-AllInOne builds.
+
+        * kjs/NumberConstructor.cpp:
+
+2008-08-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Made room for a free word in JSCell.
+        
+        SunSpider says no change.
+        
+        I changed JSCallbackObjectData, Arguments, JSArray, and RegExpObject to
+        store auxiliary data in a secondary structure.
+
+        I changed InternalFunction to store the function's name in the property
+        map.
+        
+        I changed JSGlobalObjectData to use a virtual destructor, so WebCore's
+        JSDOMWindowBaseData could inherit from it safely. (It's a strange design
+        for JSDOMWindowBase to allocate an object that JSGlobalObject deletes,
+        but that's really our only option, given the size constraint.)
+        
+        I also added a bunch of compile-time ASSERTs, and removed lots of comments
+        in JSObject.h because they were often out of date, and they got in the
+        way of reading what was actually going on.
+        
+        Also renamed JSArray::getLength to JSArray::length, to match our style
+        guidelines.
+
+2008-08-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Sped up property access for array.length and string.length by adding a
+        mechanism for returning a temporary value directly instead of returning
+        a pointer to a function that retrieves the value.
+        
+        Also removed some unused cruft from PropertySlot.
+        
+        SunSpider says 0.5% - 1.2% faster.
+
+        NOTE: This optimization is not a good idea in general, because it's
+        actually a pessimization in the case of resolve for assignment,
+        and it may get in the way of other optimizations in the future.
+        
+2008-08-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Disable dead code stripping in debug builds.
+
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6143072> FastMallocZone's enumeration code makes assumptions about handling of remote memory regions that overlap
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Don't directly compare pointers mapped into the local process with
+        a pointer that has not been mapped.  Instead, calculate a local address for the pointer and compare with that.
+        (WTF::TCMallocStats::FreeObjectFinder::findFreeObjects): Pass in the remote address of the central free list so that it can
+        be used when calculating local addresses.
+        (WTF::TCMallocStats::FastMallocZone::enumerate): Ditto.
+
+2008-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        <rdar://problem/6139914> Please include a _debug version of JavaScriptCore framework
+
+        * Configurations/Base.xcconfig: Factor out the debug-only settings so that they can shared
+        between the Debug configuration and debug Production variant.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Enable the debug variant.
+
+2008-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        Add extra cast to avoid warnings about loss of precision when casting from
+        JSValue* to an integer type.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::intValue):
+        (KJS::JSImmediate::uintValue):
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Still fixing Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Added OpaqueJSString
+        to yet another place.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Trying to fix non-Apple builds.
+
+        * ForwardingHeaders/JavaScriptCore/OpaqueJSString.h: Added.
+
+2008-08-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Allow JSImmediate to hold 31 bit signed integer immediate values.  The low two bits of a
+        JSValue* are a tag, with the tag value 00 indicating the JSValue* is a pointer to a
+        JSCell.  Non-zero tag values used to indicate that the JSValue* is not a real pointer,
+        but instead holds an immediate value encoded within the pointer.  This patch changes the
+        encoding so both the tag values 01 and 11 indicate the value is a signed integer, allowing
+        a 31 bit value to be stored.  All other immediates are tagged with the value 10, and
+        distinguished by a secondary tag.
+
+        Roughly +2% on SunSpider.
+
+        * kjs/JSImmediate.h: Encoding of JSImmediates has changed - see comment at head of file for
+                             descption of new layout.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        More build fixes.
+
+        * API/OpaqueJSString.h: Add a namespace to friend declaration to appease MSVC.
+        * API/JSStringRefCF.h: (JSStringCreateWithCFString) Cast UniChar* to UChar* explicitly.
+        * JavaScriptCore.exp: Added OpaqueJSString::create(const KJS::UString&) to fix WebCore build.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Marked OpaqueJSString as private
+
+        * kjs/identifier.cpp:
+        (KJS::Identifier::checkSameIdentifierTable):
+        * kjs/identifier.h:
+        (KJS::Identifier::add):
+        Since checkSameIdentifierTable is exported for debug build's sake, gcc wants it to be
+        non-inline in release builds, too.
+
+        * JavaScriptCore.exp: Don't export inline OpaqueJSString destructor.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        JSStringRef is created context-free, but can get linked to one via an identifier table,
+        breaking an implicit API contract.
+
+        Made JSStringRef point to OpaqueJSString, which is a new string object separate from UString.
+
+        * API/APICast.h: Removed toRef/toJS conversions for JSStringRef, as this is no longer a
+        simple typecast.
+
+        * kjs/identifier.cpp:
+        (KJS::Identifier::checkSameIdentifierTable):
+        * kjs/identifier.h:
+        (KJS::Identifier::add):
+        (KJS::UString::checkSameIdentifierTable):
+        Added assertions to verify that an identifier is not being added to a different JSGlobalData.
+
+        * API/JSObjectRef.cpp:
+        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray): Changed OpaqueJSPropertyNameArray to
+        hold JSStringRefs. This is necessary to avoid having to construct (and leak) a new instance
+        in JSPropertyNameArrayGetNameAtIndex(), now that making a JSStringRef is not just a typecast.
+
+        * API/OpaqueJSString.cpp: Added.
+        (OpaqueJSString::create):
+        (OpaqueJSString::ustring):
+        (OpaqueJSString::identifier):
+        * API/OpaqueJSString.h: Added.
+        (OpaqueJSString::create):
+        (OpaqueJSString::characters):
+        (OpaqueJSString::length):
+        (OpaqueJSString::OpaqueJSString):
+        (OpaqueJSString::~OpaqueJSString):
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::staticValueGetter):
+        (KJS::::callbackGetter):
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        (JSStringCreateWithUTF8CString):
+        (JSStringRetain):
+        (JSStringRelease):
+        (JSStringGetLength):
+        (JSStringGetCharactersPtr):
+        (JSStringGetMaximumUTF8CStringSize):
+        (JSStringGetUTF8CString):
+        (JSStringIsEqual):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        (JSStringCopyCFString):
+        * API/JSValueRef.cpp:
+        (JSValueMakeString):
+        (JSValueToStringCopy):
+        Updated to use OpaqueJSString.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        Added OpaqueJSString.
+
+2008-08-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/6115819> Notify of profile in console
+        - Profiles now have a unique ID so that they can be linked to the
+        console message that announces that a profile completed.
+
+        * profiler/HeavyProfile.cpp: 
+        (KJS::HeavyProfile::HeavyProfile):
+        * profiler/Profile.cpp:
+        (KJS::Profile::create):
+        (KJS::Profile::Profile):
+        * profiler/Profile.h:
+        (KJS::Profile::uid):
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::create):
+        (KJS::ProfileGenerator::ProfileGenerator):
+        * profiler/ProfileGenerator.h:
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        * profiler/TreeProfile.cpp:
+        (KJS::TreeProfile::create):
+        (KJS::TreeProfile::TreeProfile):
+        * profiler/TreeProfile.h:
+
+2008-08-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Nixed a PIC branch from JSObject::getOwnPropertySlot, by forcing
+        fillGetterProperty, which references a global function pointer,
+        out-of-line.
+        
+        .2% SunSpider speedup, 4.3% access-nbody speedup, 8.7% speedup on a
+        custom property access benchmark for objects with one property.
+
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::fillGetterPropertySlot):
+
+2008-08-13  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20349
+        WTF::initializeThreading() fails if threading is already initialized
+
+        Fix threading initialization logic to support cases where
+        g_thread_init() has already been called elsewhere.
+
+        Resolves database-related crashers reported in several applications.
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::initializeThreading):
+
+2008-08-13  Brad Hughes <bhughes@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compiling of QtWebKit in release mode with the Intel C++ Compiler for Linux
+
+        The latest upgrade of the intel compiler allows us to compile all of
+        Qt with optimizations enabled (yay!).
+
+        * JavaScriptCore.pro:
+
+2008-08-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add peephole optimisation to 'op_not... jfalse...' (eg. if(!...) )
+
+        This is a very slight win in sunspider, and a fairly substantial win
+        in hot code that does if(!...), etc.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::retrieveLastUnaryOp):
+        (KJS::CodeGenerator::rewindBinaryOp):
+        (KJS::CodeGenerator::rewindUnaryOp):
+        (KJS::CodeGenerator::emitJumpIfFalse):
+        * VM/CodeGenerator.h:
+
+2008-08-12  Dan Bernstein  <mitz@apple.com>
+
+        - JavaScriptCore part of <rdar://problem/6121636>
+          Make fast*alloc() abort() on failure and add "try" variants that
+          return NULL on failure.
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.exp: Exported tryFastCalloc().
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::RegisterFile): Removed an ASSERT().
+        * kjs/JSArray.cpp:
+        (KJS::JSArray::putSlowCase): Changed to use tryFastRealloc().
+        (KJS::JSArray::increaseVectorLength): Ditto.
+        * kjs/ustring.cpp:
+        (KJS::allocChars): Changed to use tryFastMalloc().
+        (KJS::reallocChars): Changed to use tryFastRealloc().
+        * wtf/FastMalloc.cpp:
+        (WTF::fastZeroedMalloc): Removed null checking of fastMalloc()'s result
+        and removed extra call to InvokeNewHook().
+        (WTF::tryFastZeroedMalloc): Added. Uses tryFastMalloc().
+        (WTF::tryFastMalloc): Renamed fastMalloc() to this.
+        (WTF::fastMalloc): Added. This version abort()s if allocation fails.
+        (WTF::tryFastCalloc): Renamed fastCalloc() to this.
+        (WTF::fastCalloc): Added. This version abort()s if allocation fails.
+        (WTF::tryFastRealloc): Renamed fastRealloc() to this.
+        (WTF::fastRealloc): Added. This version abort()s if allocation fails.
+        (WTF::do_malloc): Made this a function template. When the abortOnFailure
+        template parameter is set, the function abort()s on failure to allocate.
+        Otherwise, it sets errno to ENOMEM and returns zero.
+        (WTF::TCMallocStats::fastMalloc): Defined to abort() on failure.
+        (WTF::TCMallocStats::tryFastMalloc): Added. Does not abort() on
+        failure.
+        (WTF::TCMallocStats::fastCalloc): Defined to abort() on failure.
+        (WTF::TCMallocStats::tryFastCalloc): Added. Does not abort() on
+        failure.
+        (WTF::TCMallocStats::fastRealloc): Defined to abort() on failure.
+        (WTF::TCMallocStats::tryFastRealloc): Added. Does not abort() on
+        failure.
+        * wtf/FastMalloc.h: Declared the "try" variants.
+
+2008-08-11  Adam Roben  <aroben@apple.com>
+
+        Move WTF::notFound into its own header so that it can be used
+        independently of Vector
+
+        Rubberstamped by Darin Adler.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added NotFound.h to the project.
+        * wtf/NotFound.h: Added. Moved the notFound constant here...
+        * wtf/Vector.h: ...from here.
+
+2008-08-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6130393> REGRESSION: PhotoBooth hangs after launching under TOT Webkit
+
+        * API/JSContextRef.cpp: (JSGlobalContextRelease): Corrected a comment.
+
+        * kjs/collector.cpp: (KJS::Heap::~Heap): Ensure that JSGlobalData is not deleted while
+        sweeping the heap.
+
+== Rolled over to ChangeLog-2008-08-10 ==
diff --git a/ChangeLog-2010-05-24 b/ChangeLog-2010-05-24
new file mode 100644
index 0000000..e6ec0f1
--- /dev/null
+++ b/ChangeLog-2010-05-24
@@ -0,0 +1,28211 @@
+2010-05-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+
+        Accidentally committed double write of codeblock in Interpreter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-05-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=39583
+        Move creation of 'this' object from caller to callee in construction.
+
+        Presently the caller of a constructor is responsible for providing a this
+        object.  Instead, move the object creation into a new op_create_this opcode,
+        planted in the head of the contructor bytecode for a function.  Since the
+        prototype for the object is provided by performing a get_by_id on the callee,
+        also add a new get_callee opcode (this is used to get the callee JSFunction
+        into a register so that a normal get_by_id can be used).
+
+        Currently the caller is also responsible for detecting when op_construct is
+        performed on a JSFunction representing a host function, in which case an
+        exception is thrown – and this check currently takes place when constructing
+        the this object.  Instead, mirroring the recent changes for non-host functions,
+        add a parallel code-path for native constructors to follow, with a thunk for
+        invoking native constructors provided by JITStubs, and a constructor-specific
+        NativeFunction on NativeExecutable.  Provide an implementation of a host
+        constructor which will throw an exception.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitGetByIdExceptionInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiNativeConstruct):
+        (JSC::):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSFunction.h:
+
+2010-05-23  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=39575
+        Make JS DOMObject inherit from JSObjectWithGlobalObject instead of JSObject
+
+        Expose the global object stored in JSObjectWithGlobalObject.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        (JSC::JSObjectWithGlobalObject::globalObject):
+        * runtime/JSObjectWithGlobalObject.h:
+
+2010-05-21  Oliver Hunt  <oliver@apple.com>
+
+        "asm volatile" isn't valid outside of functions.
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JITStubs.cpp:
+
+2010-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed build fix.
+
+        Interpreter fix following r59974.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+
+2010-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Interpreter fix following r59939.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-05-21  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix.
+
+        * wtf/SizeLimits.cpp: Removed a check while I figure out how to write it properly.
+
+2010-05-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Enforce size constraints on various data structures in JavaScriptCore/wtf.
+        https://bugs.webkit.org/show_bug.cgi?id=39327
+
+        I only modified the default build for OSX and Chromium's build file to include WTFCompileAsserts.cpp
+        as those should be sufficient to catch regressions on the size of the data structures.
+
+        * JavaScriptCore.gypi: Added the WTFCompileAsserts.cpp file.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added the WTFCompileAsserts.cpp file.
+        * runtime/UString.cpp: Added a compile assert for UString size.
+        * wtf/SizeLimits.cpp: Added compile asserts for data structures that didn't have cpp files.
+        * wtf/text/StringImpl.cpp: Added a compile assert for StringImpl size.
+
+2010-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 39509 - Exceptions raised when JSString::value() is called not always properly thrown.
+        Missing some CHECK_FOR_EXCEPTION()s, cleanup NativeError construction (adding a property
+        via the prototype was inefficient, and whilst trivially true that the property is is not
+        a rope - and thus couldn't except - it would be hard to prove this).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::tryGetValue):
+        (JSC::JSString::getIndex):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2010-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix interpreter build.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Split out JITCall32_64.cpp, and tightened up some #ifdefs in the hopes
+        of improving compile times.
+        https://bugs.webkit.org/show_bug.cgi?id=39507
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp: Copied from jit/JITCall.cpp.
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubs.cpp:
+
+2010-05-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix for Qt after r59941.
+
+        * JavaScriptCore.pro: missing runtime/JSObjectWithGlobalObject.cpp added to SOURCES.
+
+2010-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix #3
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix #2
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix #1
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        All callable objects should have a global object reference
+        https://bugs.webkit.org/show_bug.cgi?id=39495
+
+        All objects that may ever return a value other CallTypeNone
+        or ConstructTypeNone now get a global object in their constructor
+        and store that in their first anonymous slot.  We add a new type
+        JSObjectWithGlobalObject to allow us to share this logic as much
+        as possible, however some objects have specific inheritance 
+        requirements so we can't just use it universally.
+
+        To enforce this requirement JSValue::getCallData and getConstructData
+        make use of a new "isValidCallee" function to assert that any object
+        that returns a value other than CallType/ConstructTypeNone has a
+        global object in anonymous slot 0.
+
+        In order to ensure that static function slots are converted into
+        function objects with the correct global object, all prototype objects
+        and other classes with static function slots also gain a global object
+        reference.  Happily this fixes the long standing issue where host
+        function objects get a prototype from the lexical global object of the
+        first function that calls them, instead of the global object that they
+        are defined on.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        (JSC::):
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        (JSC::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.h:
+        (JSC::JSValue::getCallData):
+        (JSC::JSValue::getConstructData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSObjectWithGlobalObject.cpp: Added.
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSObjectWithGlobalObject.h: Added.
+        (JSC::JSObjectWithGlobalObject::createStructure):
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::isValidCallee):
+        * runtime/JSValue.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PrototypeFunction.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::constructRegExp):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+
+2010-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed the unused entry in the CallFrame
+        https://bugs.webkit.org/show_bug.cgi?id=39470
+        
+        Removed the unused entry in the CallFrame, and reordered CallFrame
+        writes on the hot path to be in forwards order.
+        
+        SunSpider says 0.3% faster.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2010-05-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Split the QScriptValue autotest into smaller chunks.
+
+        File tst_qscriptvalue_generated.cpp was huge and it was difficult to compile
+        it with MSVS2008, because of the code optimization.
+
+        Tests were splited into a few files for better use of distributed
+        compilation.
+        Repeated calls to insert() and operator<<() where replaced by loops,
+        that should reduce time of code optimizing.
+
+        New files were generated by the same application, test logic wasn't changed.
+
+        [Qt] The QScriptValue autotest should be refactored.
+        https://bugs.webkit.org/show_bug.cgi?id=38987
+
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp: Removed.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_init.cpp: Added.
+        (tst_QScriptValue::initScriptValues):
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_istype.cpp: Added.
+        (tst_QScriptValue::isValid_initData):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_initData):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_initData):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isNumber_initData):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+        (tst_QScriptValue::isFunction_initData):
+        (tst_QScriptValue::isFunction_makeData):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_initData):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_initData):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_initData):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_initData):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_totype.cpp: Added.
+        (tst_QScriptValue::toString_initData):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+        (tst_QScriptValue::toNumber_initData):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+        (tst_QScriptValue::toBool_initData):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_initData):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+        (tst_QScriptValue::toInteger_initData):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_initData):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_initData):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_initData):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-05-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Add COMPILER(MSVC) guard for strnstr
+        https://bugs.webkit.org/show_bug.cgi?id=39397
+
+        BREWMP uses MSVC for simulator build, but it is not OS(WINDOWS).
+        Add COMPILER(MSVC) guard for strnstr.
+
+        * wtf/StringExtras.h:
+
+2010-05-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add !PLATFORM(BREWMP) guard for isMainThread
+        https://bugs.webkit.org/show_bug.cgi?id=39396
+
+        BREWMP sets ENABLE(SINGLE_THREADED), so it uses isMainThread from ThreadingNone.cpp.
+        Exclude isMainThread in MainThread.cpp.
+
+        * wtf/MainThread.cpp:
+
+2010-05-20  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Use skia as BREW MP's graphics backend.
+        https://bugs.webkit.org/show_bug.cgi?id=39407
+
+        Define WTF_PLATFORM_SKIA=1 for BREW MP.
+
+        * wtf/Platform.h:
+
+2010-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fixed naming mixup: it's op_call_put_result, not ret_result.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Whittling away at CodeBlock use: Removed a little wonkiness in closure lookup
+        https://bugs.webkit.org/show_bug.cgi?id=39444
+        
+        Calculate all lookup depths at compile time. I'm not sure why we couldn't
+        do this before, but whatever the reason, it seems to be gone now.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_resolve_skip):
+
+2010-05-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix warnings seen on the buildbots today
+        https://bugs.webkit.org/show_bug.cgi?id=39368
+
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount): Removed unneeded initialization of global variable.
+        These are all initialized to zero anyway, so no need to try to initialize
+        it and get a warning.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime): Removed unused global variable.
+
+2010-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed some reliance on callFame[CodeBlock] by storing CodeBlock in a
+        local variable in the Interpreter.
+        https://bugs.webkit.org/show_bug.cgi?id=39447
+
+        Small speedup on SunSpider in Interpreter mode.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jsc.cpp:
+        * wtf/Platform.h:
+
+2010-05-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 39408 - Unify JIT/interpreter return behaviour.
+
+        Presently the JIT and the interpreter have differing implementations in how
+        they handle storing the result of a function call back to the register file.
+        In both cases the op_call ( / _eval / _varargs / op_construct) opcode has an
+        operand indicating the VM register in which the result should be stored.
+        The JIT plants code after the call to store the result, so the value will be
+        stored as soon as the callee has returned.  In the interpreter the call
+        passes the return value register id into the callee via the callee callframe,
+        and the callee is responsible for writing the result back into its callers
+        register file after it has restored the parents callframe pointer, but before
+        returning.
+
+        Instead, move the task of writing the call result to the register file into a
+        new opcode (op_call_put_result), and after returning the callee should leave
+        the return value in a canonical location.  In the case of the interpreter,
+        this canonical location is a local variable in privateExecute
+        (functionReturnValue), in the case of the JIT this is the normal return value
+        registers (regT0, or regT1:regT0 in JSVALUE32_64).  op_call_put_result stores
+        the result from the canonical location to the registerfile.
+
+        In addition to unifying JIT & interpreter behaviour this change allows us to
+        remove a slot from the callframe, omit the write of the result where the
+        return value from the call is not used, and provides a 2% speedup on sunspider
+        in the interpreter.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::finalDestinationOrIgnored):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        (JSC::ExecState::noCaller):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::emit_op_call_put_result):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+
+2010-05-20  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Provide bindings for DeviceOrientation
+        https://bugs.webkit.org/show_bug.cgi?id=39210
+
+        Adds ENABLE_DEVICE_ORIENTATION to XCode project file, always disabled.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-05-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Errk! rename op_constructor_ret as requested in review of Bug 39399.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret_object_or_this):
+
+2010-05-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 39399 - Move responsibility for verifying constructors return objects from the caller to the callee.
+        
+        This is a necessary step to move object creation from caller to callee.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isConstructor):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionBodyNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_constructor_ret):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_constructor_ret):
+
+2010-05-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix windows build II.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 39393 - JSFunction need not be a subclass of InternalFunction.
+
+        re-landing r59800.
+
+        * JavaScriptCore.exp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::findFunctionCallFrame):
+        * interpreter/Interpreter.h:
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.cpp:
+        (JSC::):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        (JSC::JSFunction::calculatedDisplayName):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * runtime/JSObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+
+2010-05-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Reverting r59800, this b0rked stuff.
+
+        * JavaScriptCore.exp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::findFunctionCallFrame):
+        * interpreter/Interpreter.h:
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.cpp:
+        (JSC::):
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+
+2010-05-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 39393 - JSFunction need not be a subclass of InternalFunction.
+
+        This may prevent us from introducing a more useful parent class to
+        JSFunction, e.g. a JSObject that holds an executable, which could
+        also reference an eval or program executable.
+
+        * JavaScriptCore.exp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::findFunctionCallFrame):
+        * interpreter/Interpreter.h:
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.cpp:
+        (JSC::):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        (JSC::JSFunction::calculatedDisplayName):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * runtime/JSObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+
+2010-05-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        emitJumpIfNotJSCell should special case constant immediate values
+        https://bugs.webkit.org/show_bug.cgi?id=39392
+        <rdar://problem/8001324>
+
+        Make emitJumpSlowCaseIfNotJSCell special case constant immediate
+        values, in addition to the immediate JSCell optimisation.
+
+        Also add assertions to make sure no one else produces code that
+        attempts to load constants from the register file.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::tagFor):
+        (JSC::JSInterfaceJIT::payloadFor):
+        (JSC::JSInterfaceJIT::emitLoadDouble):
+        (JSC::JSInterfaceJIT::addressFor):
+        * jit/ThunkGenerators.cpp:
+
+2010-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Slight refactoring to CodeBlock bytecode access
+        https://bugs.webkit.org/show_bug.cgi?id=39384
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::returnPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::retrieveLastCaller): Moved bytecode access into a
+        CodeBlock helper function. Changed CallFrame to accurately represent
+        how the returnPC is stored in JIT vs Interpreter.
+
+2010-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Don't build the Interpreter into JIT builds.
+        https://bugs.webkit.org/show_bug.cgi?id=39373
+
+        SunSpider says no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * wtf/Platform.h:
+
+2010-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Standardized naming: "bytecode offset" wins; "bytecode index" loses.
+        
+        Also renamed getBytecodeOffset to bytecodeOffset, to match the WebKit
+        naming style.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallReturnOffsetToBytecodeOffset::CallReturnOffsetToBytecodeOffset):
+        (JSC::getCallReturnOffset):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::callReturnIndexVector):
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileLinkPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JumpTable::JumpTable):
+        (JSC::SwitchRecord::SwitchRecord):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        (JSC::JIT::isLabeled):
+        (JSC::JIT::map):
+        (JSC::JIT::unmap):
+        (JSC::JIT::isMapped):
+        (JSC::JIT::getMappedPayload):
+        (JSC::JIT::getMappedTag):
+        (JSC::JIT::emitGetVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_new_error):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_new_error):
+        (JSC::JIT::emit_op_convert_this):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-05-19  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        The backtrackParenthesesOnceEnd function should store the start position
+        of the subpattern's non-greedy match at the place of the subpattern's
+        start index in the output array instead of the place of the
+        subpattern's end index.
+        Add layout test for checking of non-greedy matching of subpattern in
+        regular expressions.
+        https://bugs.webkit.org/show_bug.cgi?id=39289
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+
+2010-05-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 39343 - Dynamically generate a native call thunk per NativeFunction
+        
+        https://bugs.webkit.org/show_bug.cgi?id=39252 regressed performance on i386,
+        by adding an extra indirection to making a native call.  By introducing per-
+        NativeFunction thunks we can hard code the function pointer into the thunk
+        so that it need not be loaded from the callee.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getCTIStub):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * wtf/Platform.h:
+
+2010-05-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Simplified handling of 'arguments' -- 1.2% SunSpider speedup
+        https://bugs.webkit.org/show_bug.cgi?id=39200
+        
+        Removed the reserved OptionalCalleeArguments slot from the CallFrame.
+        Now, slots for 'arguments' are allocated and initialized only by
+        functions that might need them.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Updated for new bytecode operands.
+
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::unmodifiedArgumentsRegister): Added a helper function for mapping
+        from the arguments register to its unmodified counterpart.
+
+        (JSC::CodeBlock::setArgumentsRegister):
+        (JSC::CodeBlock::argumentsRegister):
+        (JSC::CodeBlock::usesArguments):  Changed from a "usesArguments" bool to
+        an optional int index representing the arguments register.
+
+        * bytecode/Opcode.h: Updated for new bytecode operands.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar): Factored out a helper function for
+        allocating an anonymous var.
+
+        (JSC::BytecodeGenerator::BytecodeGenerator): Merged / simplified some
+        arguments vs activation logic, and added code to allocate the arguments
+        registers when needed.
+
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary): Updated for new bytecode operands.
+
+        (JSC::BytecodeGenerator::emitCallEval): No need to create the arguments
+        object before calling eval; the activation object will lazily create the
+        arguments object if eval resolves it.
+
+        (JSC::BytecodeGenerator::emitReturn): Updated for new bytecode operands.
+
+        (JSC::BytecodeGenerator::emitPushScope):
+        (JSC::BytecodeGenerator::emitPushNewScope): Ditto emitCallEval.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::addVar): Factored out a helper function for
+        allocating an anonymous var.
+
+        (JSC::BytecodeGenerator::registerFor): No more need for special handling
+        of the arguments registers; they're allocated just like normal registers
+        now.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callerFrame):
+        (JSC::ExecState::init):
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::resetCallFrame): Nixed optionalCalleeArguments.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments): Opcodes accessing 'arguments' now
+        take operands specifying registers, just like all other opcodes.
+        JSActivation::copyRegisters is no longer responsible for tearing off the
+        arguments object; instead, the VM is responsible for both.
+
+        Also, a behavior change: Each access to f.arguments creates a new object,
+        unless f itself uses 'arguments'. This matches Chrome, and is necessary
+        for the optimization. f.arguments is a nonstandard, deprecated feature,
+        so high fidelity to a given implementation is not necessarily a goal.
+        Also, as illustrated by the new test case, the identity of f.arguments
+        has been broken since 2008, except in the case where f itself accesses
+        f.arguments -- but nobody seemed to notice. So, hopefully this change won't
+        break the web.
+        
+        * interpreter/Register.h: Nixed the special arguments accessor. It's no
+        longer needed.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_init_arguments):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_init_arguments): The actual optimization: Removed
+        OptionalCalleeArguments from the callframe slot. Now, it doesn't need
+        to be initialized for most calls.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Updated stubs to support arbitrary 'arguments' registers,
+        instead of hard-coding something in the call frame.
+
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters): Removed some obfuscatory abstraction.
+
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::generatedByteCode): Added a helper for accessing
+        the 'arguments' register. In a future patch, that kind of data should
+        probably move out of CodeBlock and into Executable.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h: Simplified / fixed access to 'arguments' via
+        the activation object. It now implements the same behavior implemented
+        by optimized variable access in the VM. This simplifies some other
+        things, too -- like eval code generation.
+
+2010-05-18  Sam Weinig  <sam@webkit.org>
+
+        Try to fix the windows build.
+
+        * API/JSStringRefBSTR.cpp:
+
+2010-05-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add an inlineCapacity template parameter to ListHashSet and use it to shrink the positioned object list hash set.
+        https://bugs.webkit.org/show_bug.cgi?id=39304
+        <rdar://problem/7998366>
+
+        Add an inlineCapacity template parameter to ListHashSet.
+
+        * wtf/ListHashSet.h:
+        (WTF::::ListHashSet):
+        (WTF::::operator):
+        (WTF::::swap):
+        (WTF::::~ListHashSet):
+        (WTF::::size):
+        (WTF::::capacity):
+        (WTF::::isEmpty):
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::find):
+        (WTF::::contains):
+        (WTF::::add):
+        (WTF::::insertBefore):
+        (WTF::::remove):
+        (WTF::::clear):
+        (WTF::::unlinkAndDelete):
+        (WTF::::appendNode):
+        (WTF::::insertNodeBefore):
+        (WTF::::deleteAllNodes):
+        (WTF::::makeIterator):
+        (WTF::::makeConstIterator):
+        (WTF::deleteAllValues):
+
+2010-05-18  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix the interpreter after r59637
+        https://bugs.webkit.org/show_bug.cgi?id=39287
+
+        * runtime/Executable.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getCallData):
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+
+2010-05-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Oops, meant ebx not eax there.  Fix Qt (and probably Win too).
+
+        * jit/JITOpcodes32_64.cpp:
+
+2010-05-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 39252 - Move host/native JSFunction's NativeFunction onto NativeExecutable.
+
+        Currently host functions reuse JSFunction's ScopeChain as storage for their
+        NativeFunction (the C function pointer to the host function implementation).
+        Instead, move this onto NativeExecutable.  This will allow host functions to
+        have a scopechain (which will be implemented as a separate patch).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::specializedThunk):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiNativeCall):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::function):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::JSFunction::nativeFunction):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::scope):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getThunk):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+
+2010-05-17  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Remove WinCE endian dedection.
+        https://bugs.webkit.org/show_bug.cgi?id=38511
+
+        Windows CE supports little-endian format only.
+        Correct dedection was added in r57804.
+
+        * wtf/Platform.h:
+
+2010-05-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Reduce the size of FunctionExecutable
+        https://bugs.webkit.org/show_bug.cgi?id=39180
+        
+        Change m_numVariables from a size_t to 31 bits in a bitfield,
+        packed with another bit for m_forceUsesArguments (which in turn
+        get packed with the base class).
+        
+        Reduces the size of FunctionExecutable from 160 to 152 bytes.
+
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::variableCount):
+        (JSC::FunctionExecutable::FunctionExecutable):
+
+2010-05-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect codegen for slowcase of < in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=39151
+
+        Call the correct stud for the slowcases of the < operator.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jless):
+
+2010-05-15  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Darin Adler.
+
+        Fix bug https://bugs.webkit.org/show_bug.cgi?id=38890
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2010-05-15  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Adam Treat.
+
+        [EFL] Add build system for the EFL port.
+        http://webkit.org/b/37945
+
+        * CMakeLists.txt: Added.
+        * CMakeListsEfl.txt: Added.
+        * config.h: Add conditional to look for cmakeconfig.h.
+        * jsc/CMakeLists.txt: Added.
+        * jsc/CMakeListsEfl.txt: Added.
+        * wtf/CMakeLists.txt: Added.
+        * wtf/CMakeListsEfl.txt: Added.
+
+2010-05-15  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update MIPS JIT for unsigned right shift, Math.sqrt, load16
+        https://bugs.webkit.org/show_bug.cgi?id=38412
+
+        Fixed MIPS build failure.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::srl):
+        (JSC::MIPSAssembler::srlv):
+        (JSC::MIPSAssembler::sqrtd):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::urshift32):
+        (JSC::MacroAssemblerMIPS::sqrtDouble):
+        (JSC::MacroAssemblerMIPS::load16):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointSqrt):
+        * jit/JSInterfaceJIT.h:
+
+2010-05-15  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        WebInspector: JSC Should provide heap size info for Timeline panel.
+        https://bugs.webkit.org/show_bug.cgi?id=38420
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/Collector.cpp:
+        (JSC::Heap::size):
+        * runtime/Collector.h:
+
+2010-05-15  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Add a new define for we need strict arena alignment. ARMv5 with
+        double word instructions set this value.
+
+        * wtf/Platform.h:
+
+2010-05-14  Stephanie Lewis  <slewis@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Update order files.
+
+        * JavaScriptCore.order:
+
+2010-05-14  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Implementation of QtScript API that provide method to convert a value to an object.
+
+        [Qt] QtScript is missing toObject API
+        https://bugs.webkit.org/show_bug.cgi?id=36594
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::toObject):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::toObject):
+        * qt/api/qscriptvalue.h:
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toObject):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::toObject):
+        (tst_QScriptEngine::toObjectTwoEngines):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::toObjectSimple):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+
+2010-05-14  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        String Indexing Failure on JSVALUE32 targets
+        https://bugs.webkit.org/show_bug.cgi?id=39034
+
+        Remove zero-extend/shift-right code on regT1, because we already have
+        it in emit_op_get_by_val().
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+
+2010-05-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix a VS2010 assert in std::copy
+        https://bugs.webkit.org/show_bug.cgi?id=38630
+
+        The assert complains that the output iterator is null.
+
+        * wtf/Vector.h:
+        (WTF::::operator):
+
+2010-05-13  Maciej Stachowiak  <mjs@apple.com>
+
+        No review, attempted build fix.
+
+        Try to fix Tiger build with some gratuitous initialization of
+        seemingly uninitialized variables.
+
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::tryCreateUninitialized):
+
+2010-05-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Various JavaScript string optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=39051
+
+        Approximately 1% SunSpider speedup.
+        
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin): Remove branches from the hot code path
+        by moving the first pass outside the loop, and duplicating the hot loop
+        to extract the loop-invariant branch.
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match): resize ovector to 0 instead of clearing to avoid
+        thrash in case of large matches.
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::performMatch): Mark ALWAYS_INLINE to make the
+        compiler respect our authority.
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators): Inline.
+        (JSC::stringProtoFuncSubstring): Rewrite boundary condition checks to
+        reduce the number of floating point comparisons and branches.
+
+2010-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=39039
+        Provide support for separate bytecode/JIT code translations for call/construct usage
+        This will allow us to produce code generated specifically for use as a constructor, not for general function use.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::getJITCode):
+        (JSC::CodeBlock::executablePool):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCallOrConstruct):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiVirtualConstructLink):
+        (JSC::JITThunks::ctiVirtualConstruct):
+        (JSC::):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCodeForCall):
+        (JSC::FunctionExecutable::generateJITCodeForConstruct):
+        (JSC::FunctionExecutable::markAggregate):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::isHostFunction):
+        (JSC::ExecutableBase::generatedJITCodeForCall):
+        (JSC::ExecutableBase::generatedJITCodeForConstruct):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::bytecodeForCall):
+        (JSC::FunctionExecutable::isGeneratedForCall):
+        (JSC::FunctionExecutable::generatedBytecodeForCall):
+        (JSC::FunctionExecutable::bytecodeForConstruct):
+        (JSC::FunctionExecutable::isGeneratedForConstruct):
+        (JSC::FunctionExecutable::generatedBytecodeForConstruct):
+        (JSC::FunctionExecutable::symbolTable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::jitCodeForCall):
+        (JSC::FunctionExecutable::jitCodeForConstruct):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::construct):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+
+2010-05-12  Oliver Hunt  <oliver@apple.com>
+
+        build fix
+
+        <rdar://problem/7977960> REGRESSION (r59282): Tiger PPC build broken
+
+        * runtime/UString.h:
+        (JSC::tryMakeString):
+
+2010-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://7969718> Incorrect 32-bit codegen for op_jnlesseq
+        https://bugs.webkit.org/show_bug.cgi?id=39038
+
+        Correct the use of incorrect comparison operators.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2010-05-12  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Eric Seidel.
+
+        JavaScriptCore: fix build when some optimizations are disabled
+        https://bugs.webkit.org/show_bug.cgi?id=38800
+
+        Remove outdated UNUSED_PARAMs when using JIT but with
+        ENABLE_JIT_OPTIMIZE_CALL and ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
+        disabled.
+
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+
+2010-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Work around GCC stupidity by either explicitly inlining or by
+        using ALWAYS_INLINE
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        * runtime/UString.h:
+        (JSC::UString::~UString):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::RefPtr::~RefPtr):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::tryCreateUninitialized):
+
+2010-05-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Detect debug mode consistently
+        https://bugs.webkit.org/show_bug.cgi?id=38863
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+
+2010-05-12  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove a direct jump in generatePatternCharacterGreedy() and
+        generatePatternCharacterClassGreedy() functions if quantityCount of the term
+        is unlimited.
+        https://bugs.webkit.org/show_bug.cgi?id=38898
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+
+2010-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Slight simplification to the calling convention: read RegisterFile::end()
+        from an absolute address, instead of from a pointer to the RegisterFile
+        on the stack.
+        
+        SunSpider reports no change.
+        
+        This should free us to remove the RegisterFile argument from the stack.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2010-05-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Possible Gtk build fix - use ALWAYS_INLINE on functions that were inlined.
+
+        * wtf/text/AtomicString.h:
+        (WebCore::AtomicString::add): Use ALWAYS_INLINE.
+        * wtf/text/WTFString.h:
+        (WebCore::String::length): Ditto.
+        (WebCore::String::isEmpty): Ditto.
+
+2010-05-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a compile time assert that sizeof(String) == sizeof(AtomicString).
+
+        * wtf/text/AtomicString.cpp:
+
+2010-05-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38961
+        Move some member variables around to reduce class sizes.
+        
+        Make AtomicString no longer inherit from FastAllocBase.
+
+        Since AtomicString's first (and only) member variable, a RefPtr, also inherits from FastAllocBase this
+        was causing the size of AtomicString to contain sizeof(void*) bytes of padding.
+
+        * wtf/text/AtomicString.h:
+
+2010-05-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        Patch by Gavin Barraclough.
+        
+        Rest of REGRESSION (r57900-57919): 3% PLT Regression from moving strings into WTF.
+        https://bugs.webkit.org/show_bug.cgi?id=38930
+        <rdar://problem/7937188>
+        
+        Inline string functions that are commonly used in WTFString, CString, and AtomicString.
+
+        * JavaScriptCore.exp: Remove exports of inline functions.
+        * wtf/text/AtomicString.cpp:
+        (WebCore::AtomicString::addSlowCase): Rename add to addSlowCase, and inline the fast path
+            of add.
+        * wtf/text/AtomicString.h:
+        (WebCore::AtomicString::add): Inline the fast path of add.
+        * wtf/text/CString.cpp: Inline implementation of data and length in the header.
+        * wtf/text/CString.h:
+        (WTF::CString::data): Inline implementation of data.
+        (WTF::CString::length): Inline implementation of length.
+        * wtf/text/WTFString.cpp: Remove implementations of functions to be inlined.
+        * wtf/text/WTFString.h:
+        (WebCore::String::String): Inline implementation.
+        (WebCore::String::length): Ditto.
+        (WebCore::String::characters): Ditto.
+        (WebCore::String::operator[]): Ditto.
+        (WebCore::String::isEmpty): Ditto.
+
+2010-05-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg and Jon Honeycutt.
+        Patch by Gavin Barraclough.
+        
+        REGRESSION (r57900-57919): 3% PLT Regression from moving strings into WTF.
+        https://bugs.webkit.org/show_bug.cgi?id=38930
+        <rdar://problem/7937188>
+        
+        When the String classes were moved from WebCore to WTF, it meant that on Windows, all operations
+        on Strings in WebCore had to cross a DLL boundary (from WebKit.dll to JavaScript.dll).
+        
+        We fix this by refactoring some of the WTF string code, so the code in AtomicString, StringImpl, and
+        WTFString can be built by both WebCore and WTF, and we don't need to talk across a DLL to do operations
+        on Strings.
+
+        * GNUmakefile.am: Add new file to build system.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.pro: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove string exports, because these are now
+            handled in WebCore.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Remove the post-build step that was added
+            here (the post build step is in JavaScriptCoreCommon.vsprops).
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Copy the three cpp files that need to be compiled
+            by WebCore into the WebKitOutputDir directory.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add the StringStatics file.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add the three WTF string cpp files to this project.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Remove the need to link against WTF.lib (since jsc links against JavaScriptCore).
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add the StringStatics file.
+        * wtf/text/AtomicString.cpp: Moved code to StringStatics.
+        * wtf/text/StringImpl.cpp: Ditto.
+        * wtf/text/StringStatics.cpp: Added. Move functions in WTF Strings that define static variables to here, so 
+            the rest of the files can be compiled in WebCore.
+        (WebCore::StringImpl::empty): Moved from StringImpl.cpp to here.
+        (WebCore::AtomicString::init): Moved from AtomicString.cpp to here.
+
+2010-05-11  Alice Liu  <alice.liu@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Fix build error when enabling debugging block in WebKit win painting code
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-11  Mark Rowe  <mrowe@apple.com>
+
+        Fix the world.
+
+        In r59162 a change was made to WebCore's FeatureDefines.xcconfig that enabled FILE_READER and FILE_WRITER.
+        The author and reviewer of that patch ignored the carefully-worded warning at the top of that file asking
+        that changes to the file be kept in sync across JavaScriptCore, WebCore and WebKit, as well as being kept
+        in sync with build-webkit.  This led to WebCore and WebKit having different views of Document's vtable
+        and results in crashes in Safari shortly after launch when virtual function calls resulted in the wrong
+        function in WebCore being called.
+
+        We fix this by bringing the FeatureDefines.xcconfig files in to sync.  Based on the ChangeLog message and
+        other changes in r59162 it appears that enabling FILE_WRITER was unintentional so that particular change
+        has been reverted.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-05-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r59171.
+        http://trac.webkit.org/changeset/59171
+        https://bugs.webkit.org/show_bug.cgi?id=38933
+
+        "Broke the world" (Requested by bweinstein on #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/AtomicString.cpp:
+        (WebCore::AtomicString::init):
+        * wtf/text/StringImpl.cpp:
+        (WebCore::StringImpl::empty):
+        * wtf/text/StringStatics.cpp: Removed.
+
+2010-05-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+        Patch by Gavin Barraclough.
+        
+        REGRESSION (r57900-57919): 3% PLT Regression from moving strings into WTF.
+        https://bugs.webkit.org/show_bug.cgi?id=38930
+        <rdar://problem/7937188>
+        
+        When the String classes were moved from WebCore to WTF, it meant that on Windows, all operations
+        on Strings in WebCore had to cross a DLL boundary (from WebKit.dll to JavaScript.dll).
+        
+        We fix this by refactoring some of the WTF string code, so the code in AtomicString, StringImpl, and
+        WTFString can be built by both WebCore and WTF, and we don't need to talk across a DLL to do operations
+        on Strings.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove string exports, because these are now
+            handled in WebCore.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Remove the post-build step that was added
+            here (the post build step is in JavaScriptCoreCommon.vsprops).
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Copy the three cpp files that need to be compiled
+            by WebCore into the WebKitOutputDir directory.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add the StringStatics file.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add the three WTF string cpp files to this project.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Remove the need to link against WTF.lib (since jsc links against JavaScriptCore).
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add the StringStatics file.
+        * wtf/text/AtomicString.cpp: Moved code to StringStatics.
+        * wtf/text/StringImpl.cpp: Ditto.
+        * wtf/text/StringStatics.cpp: Added. Move functions in WTF Strings that define static variables to here, so 
+            the rest of the files can be compiled in WebCore.
+        (WebCore::StringImpl::empty): Moved from StringImpl.cpp to here.
+        (WebCore::AtomicString::init): Moved from AtomicString.cpp to here.
+
+2010-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed test failures seen on SnowLeopard buildbot.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter): Don't use size_t and wtf::notFound.
+        Instead, use the individual types and notFound values of the string APIs
+        we're using, since they're not necessarily the same in 64bit.
+
+2010-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Darin Adler.
+
+        Start using ropes in String.prototype.replace.
+        
+        1%-1.5% speedup on SunSpider.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope): Updated for RopeImpl refactoring.
+
+        (JSC::JSString::replaceCharacter): Added a replaceCharacter function, which creates
+        a rope for the resulting replacement.
+
+        * runtime/JSString.h: A few changes here:
+        (JSC::):
+        (JSC::RopeBuilder::RopeIterator::RopeIterator):
+        (JSC::RopeBuilder::RopeIterator::operator++):
+        (JSC::RopeBuilder::RopeIterator::operator*):
+        (JSC::RopeBuilder::RopeIterator::operator!=):
+        (JSC::RopeBuilder::RopeIterator::WorkItem::WorkItem):
+        (JSC::RopeBuilder::RopeIterator::WorkItem::operator!=):
+        (JSC::RopeBuilder::RopeIterator::skipRopes): Created a RopeIterator abstraction.
+        We use this to do a substring find without having to resolve the rope.
+        (We could use this iterator when resolving ropes, too, but resolving
+        ropes backwards is usually more efficient.)
+
+        (JSC::RopeBuilder::JSString): Added constructors for 2 & 3 UStrings.
+
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::size): Updated for RopeImpl refactoring.
+
+        * runtime/Operations.h: Updated for RopeImpl refactoring.
+        (JSC::jsString): Added jsString functions for 2 & 3 UStrings.
+
+        * runtime/RopeImpl.cpp:
+        (JSC::RopeImpl::derefFibersNonRecursive):
+        * runtime/RopeImpl.h:
+        (JSC::RopeImpl::initializeFiber):
+        (JSC::RopeImpl::size):
+        (JSC::RopeImpl::fibers):
+        (JSC::RopeImpl::deref):
+        (JSC::RopeImpl::RopeImpl): A little refactoring to make this patch easier:
+        Moved statics to the top of the class; put multi-statement functions on
+        multiple lines; renamed "fiberCount" to "size" to match other collections;
+        changed the "fibers" accessor to return the fibers buffer, instead of an
+        item in the buffer, to make iteration easier.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Don't resolve a rope unless we need to. Do
+        use our new replaceCharacter function if possible. Do use a rope to
+        represent splicing three strings together.
+
+2010-05-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] Disable JIT support for mingw-w64
+        https://bugs.webkit.org/show_bug.cgi?id=38747
+
+        Disale JIT for mingw-w64 as it is reportedly
+        unstable.
+
+        Thanks for Vanboxem Rruben for the investigation.
+
+        * wtf/Platform.h:
+
+2010-05-09  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        JavaScriptCore/wtf/MD5.h: checksum should take a reference to output.
+        https://bugs.webkit.org/show_bug.cgi?id=38723
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/MD5.cpp:
+        (WTF::expectMD5):
+          Fix for checksum change.
+        (WTF::MD5::checksum):
+          Take a reference to output, instead of returning the result by value, to reduce coping for performance.
+        * wtf/MD5.h:
+
+2010-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        Fix accidental repeat addition of emit_op_new_regexp
+
+        * jit/JITOpcodes.cpp:
+
+2010-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(r57955): RegExp literals should not actually be cached, so r57955 should be rolled out.
+        https://bugs.webkit.org/show_bug.cgi?id=38828
+        <rdar://problem/7961634>
+
+        Rollout r57955
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addRegExp):
+        (JSC::CodeBlock::regexp):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addRegExp):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_regexp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2010-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Reserve a large-ish initial capacity for Lexer::m_buffer16.
+        
+        SunSpider says 0.3% faster.
+        
+        m_buffer16 is used when parsing complex strings -- for example, strings
+        with escape sequences in them. These kinds of strings can be really long,
+        and we want to avoid repeatedly copying as we grow m_buffer16.
+        
+        The net memory cost is quite low, since it's proporitional to source
+        code we already have in memory, and we throw away m_buffer16 right when
+        we're done parsing.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): No need to reserve initial capacity in our constructor,
+        since setCode will be called before we're asked to lex anything.
+        (JSC::Lexer::setCode): Reserve enough space to lex half the source code
+        as a complex string without having to copy.
+        (JSC::Lexer::clear): No need to reserve initial capacity here either,
+        since setCode will be called before we're asked to lex anything.
+
+2010-05-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove YARR configuration rules from Qt make system
+        https://bugs.webkit.org/show_bug.cgi?id=38819
+
+        Setting YARR based on JIT seeting is now in Platform.h 
+        for all ports. This patch essentially reverses r49238.
+
+        * JavaScriptCore.pri:
+
+2010-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Improve string indexing performance
+        https://bugs.webkit.org/show_bug.cgi?id=38814
+
+        Add an assembly stub to do indexed loads from strings much
+        more cheaply than the current stub dispatch logic.  We can
+        do this because we are able to make guarantees about the
+        register contents when entering the stub so the call overhead
+        is negligible.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+           Moved from JITOpcodes.cpp to keep the slowcase next to
+           the normal case codegen as we do for everything else.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitFastArithImmToInt):
+
+2010-05-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Fixed version of: "Optimized o[s] where o is a cell and s is a string"
+        https://bugs.webkit.org/show_bug.cgi?id=38815
+        
+        Fixed the previous patch for this from Geoff Garen.
+        
+        The two problems were a missing exception check and a PropertySlot
+        initialized improperly, leading to crashes and failures in the case
+        of getters accessed with bracket syntax.
+
+    Previous patch:
+
+        Optimized o[s] where o is a cell and s is a string, removing some old
+        code that wasn't really tuned for the JIT.
+        
+        SunSpider says 0.8% faster.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+
+2010-05-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        Fix missing terminating ' character warning
+
+        The warning has been only seen on the Gtk buildbots.
+
+        * wtf/Platform.h:
+
+2010-05-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Refactor YARR and YARR_JIT default rules in Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=38727
+
+        Turn on YARR and YARR JIT by default of JIT is enabled.
+        Ports can overrule this default decisions as they wish.
+
+        * wtf/Platform.h:
+
+2010-05-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Split JSVALUE32_64 code out of JITOpcodes.cpp and into JITOpcodes32_64.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=38808
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp: Added.
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_sret):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_stricteq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emit_op_nstricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_push_scope):
+        (JSC::JIT::emit_op_pop_scope):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emitSlow_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_jmp_scopes):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_new_error):
+        (JSC::JIT::emit_op_debug):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_init_arguments):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+
+2010-05-08  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix halfword loads on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=38741
+
+        The BaseIndex and ImplicitAddress are contain 32bit wide offset, but
+        the load16 functions were working with 8 bit data (encoded in the
+        instruction). If the offset cannot be encoded in an instruction, it
+        should be stored in a temporary register.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::getOffsetForHalfwordDataTransfer):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load16):
+
+2010-05-08  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix spanning branch instruction on Cortex-A8 with Thumb-2 JIT
+        https://bugs.webkit.org/show_bug.cgi?id=38280
+
+        If the 32-bit Thumb-2 branch instruction spans two 4KiB regions and
+        the target of the branch falls within the first region it is
+        possible for the processor to incorrectly determine the branch
+        instruction, and it is also possible in some cases for the processor
+        to enter a deadlock state.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+
+2010-05-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        [WTFURL] Add a buffer for managing the output of the canonicalizer
+        https://bugs.webkit.org/show_bug.cgi?id=38671
+
+        The canonicalizer produces a stream of canonicalized characters, which
+        we will store in a URLBuffer.  URLBuffer is quite similar to Vector,
+        but serves as an abstraction to isolate us from the underlying
+        character storage.  In the case of WebKit, we'll probably implement a
+        subclass of URLBuffer with Vector.  In Chromium, the backing store is a
+        std::string, which avoids an unnecessary memcpy that would be caused by
+        using Vector instead.
+
+        * wtf/url/src/URLBuffer.h: Added.
+        (WTF::URLBuffer::URLBuffer):
+        (WTF::URLBuffer::~URLBuffer):
+        (WTF::URLBuffer::at):
+        (WTF::URLBuffer::set):
+        (WTF::URLBuffer::capacity):
+        (WTF::URLBuffer::length):
+        (WTF::URLBuffer::data):
+        (WTF::URLBuffer::setLength):
+        (WTF::URLBuffer::append):
+        (WTF::URLBuffer::grow):
+
+2010-05-08  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed, just reverting commit.
+
+        REGRESSION(59000): r59000 contained all sorts of changes it should not have, needs revert.
+        https://bugs.webkit.org/show_bug.cgi?id=38798
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+
+2010-05-04  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        Safari pegs CPU and drops tons of frames using HTML5 Vimeo player
+        <https://bugs.webkit.org/show_bug.cgi?id=34005>
+        <rdar://problem/7569713>
+        
+        Added cancelCallOnMainThread.  callOnMainThread should always now be paired
+        with cancelCallOnMainThread in situations where the refcon passed to callOnMainThread
+        may be dealloced before the main thread function can be dispatched.  
+        
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::operator == ): Supports the FunctionWithContextFinder predicate functor.
+        (WTF::FunctionWithContextFinder::FunctionWithContextFinder):  Predicate functor for use with Dequeue::findIf
+        (WTF::FunctionWithContextFinder::operator()):
+        (WTF::cancelCallOnMainThread):
+        * wtf/MainThread.h:
+
+2010-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-07  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed, rolling out r58990.
+        http://trac.webkit.org/changeset/58990
+
+        Broke 4 tests on Snow Leopard and Qt.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+
+2010-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Optimize access to the global object from a function that uses eval
+        https://bugs.webkit.org/show_bug.cgi?id=38644
+
+        Fix bug where cross scope access to a global var (vs. property) would
+        be allowed without checking for intervening dynamic scopes.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+
+2010-05-07  Oliver Hunt  <oliver@apple.com>
+
+        32-bit buildfix.
+
+        Macro expansion I stab at thee!
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+
+2010-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Optimized o[s] where o is a cell and s is a string, removing some old
+        code that wasn't really tuned for the JIT.
+        
+        SunSpider says 0.8% faster.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+
+2010-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Optimize access to the global object from a function that uses eval
+        https://bugs.webkit.org/show_bug.cgi?id=38644
+
+        Add op_resolve_global_dynamic, a variant of op_resolve_global that
+        checks each node in the scope chain for dynamically inserted properties
+        and falls back to the normal resolve logic in that case.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::isGlobalResolve):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::findScopedProperty):
+           Now take an additional reference parameter to used to indicate that
+           there were nodes that may gain dynamic properties
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+           deal with additional argument to findScopedProperty
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+           These functions use findScopedProperty directly in order to
+           optimise lookup.  They cannot trivially handle any degree of
+           dynamism in the lookup so we just give up in such case.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+           Happily resolve_global_dynamic can share the slow case!
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::isDynamicScope):
+        * runtime/JSActivation.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::isDynamicScope):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::isDynamicScope):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.h:
+
+2010-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed Sputnik failure seen on buildbot.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString): Cast to unsigned before checking magnitude,
+        to efficiently exclude negative numbers, which require two characters
+        instead of one.
+
+2010-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Slightly more effective way to guarantee a compile-time constant, at
+        least on gcc.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString): Use pointer notation instead of array
+        notation, so the compiler treats the string and its contents as constant.
+
+2010-05-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [WTFURL] Add core URL parser
+        https://bugs.webkit.org/show_bug.cgi?id=38572
+
+        This patch adds the core of the URL parser.  The URL parser uses a
+        templated notion of a code unit to support different string types.
+        Later we'll add some non-templated APIs with concrete types that
+        clients can use more conveniently.
+
+        The URLParser has a couple calls to ASSERT(), which I've commented out
+        for now.  I'm not 100% sure how to handle the dependency issues there
+        yet, so I've punted on the issue for now.
+
+        Also, there are a number of methods that are declared public in this
+        patch that are only used by the canonicalizer.  My plan is to make
+        those private or protected and make the canonicalizer a friend of the
+        parser.  The details will be in a later patch.
+
+        * wtf/url/src/URLComponent.h:
+        (WTF::URLComponent::fromRange):
+        (WTF::URLComponent::isNonEmpty):
+        (WTF::URLComponent::isEmptyOrInvalid):
+        * wtf/url/src/URLParser.h: Added.
+        (WTF::URLParser::):
+        (WTF::URLParser::isPossibleAuthorityTerminator):
+        (WTF::URLParser::parseAuthority):
+        (WTF::URLParser::extractScheme):
+        (WTF::URLParser::parseAfterScheme):
+        (WTF::URLParser::parseStandardURL):
+        (WTF::URLParser::parsePath):
+        (WTF::URLParser::parsePathURL):
+        (WTF::URLParser::parseMailtoURL):
+        (WTF::URLParser::parsePort):
+        (WTF::URLParser::extractFileName):
+        (WTF::URLParser::extractQueryKeyValue):
+        (WTF::URLParser::isURLSlash):
+        (WTF::URLParser::shouldTrimFromURL):
+        (WTF::URLParser::trimURL):
+        (WTF::URLParser::consecutiveSlashes):
+        (WTF::URLParser::isPortDigit):
+        (WTF::URLParser::nextAuthorityTerminator):
+        (WTF::URLParser::parseUserInfo):
+        (WTF::URLParser::parseServerInfo):
+
+2010-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a fast path for number-to-character conversion via
+        Number.prototype.toString base 36.
+        
+        0.7% speedup on SunSpider.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString): Made radix interpretation a little more
+        efficient by keeping it in int space. Turned "const char" into
+        "static const char" just in case. Added a fast path for base 36
+        conversion of something that will turn into a character.
+
+2010-05-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        [WTFURL] Add a malloc-backed URLBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=38694
+
+        This patch adds a URLBuffer that uses new/delete to manage the backing
+        store for the buffer.
+
+        * wtf/url/src/RawURLBuffer.h: Added.
+        (WTF::RawURLBuffer::RawURLBuffer):
+        (WTF::RawURLBuffer::~RawURLBuffer):
+        (WTF::RawURLBuffer::resize):
+
+2010-05-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JavaScriptCore/wtf/RandomNumber.h should provide using WTF::*
+        https://bugs.webkit.org/show_bug.cgi?id=38719
+
+        * wtf/RandomNumber.h:
+          Add using directives.
+
+2010-05-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable YARR_JIT for X86 Mac for QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=38668
+
+        * wtf/Platform.h:
+
+2010-05-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 38714 - Add result caching for Math.sin
+
+        Math.sin is frequently called with the same operand, caching the result should
+        improve performance.  CachedTranscendentalFunction adds a generic mechanism to
+        cache results for pure functions with the signature "double func(double)", and
+        where NaN maps to NaN.
+
+        CachedTranscendentalFunction uses a very simple hash function designed to be
+        fast to execute since we cannot cache the result, and trivial to JIT generate,
+        should we wish to do so.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/CachedTranscendentalFunction.h: Added.
+        (JSC::CachedTranscendentalFunction::CachedTranscendentalFunction):
+        (JSC::CachedTranscendentalFunction::~CachedTranscendentalFunction):
+        (JSC::CachedTranscendentalFunction::operator()):
+        (JSC::CachedTranscendentalFunction::initialize):
+        (JSC::CachedTranscendentalFunction::hash):
+        * runtime/JSGlobalData.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncSin):
+        * wtf/Platform.h:
+
+2010-05-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::sample): Use a cast, so Windows will be happy when
+        this code is enabled.
+        * wtf/Platform.h: Reverted last change to this file, which seems to have
+        been accidental.
+
+2010-05-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add compile switch to make debugger keyword plant breakpoint instructions.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * wtf/Platform.h:
+
+2010-05-06  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        Fix ARM builds
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load16):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load16):
+
+2010-05-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Improve performance of single character string compares
+        https://bugs.webkit.org/show_bug.cgi?id=38659
+
+        Add logic to the jit to identify comparisons to single character string literals
+        and then just perform the comparison inline, rather than ignoring the evidence
+        and attempting to perform an integer comparison.
+
+        Multiple changes required -- add jnlesseq opcode, add helper function to identify
+        single character string constants, add a helper to load single character strings.
+        Then add the 32_64 and normal codepaths to the JIT.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load16):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadCharacterString):
+        (JSC::JIT::isOperandConstantImmediateChar):
+        * jit/JSInterfaceJIT.h:
+        (JSC::ThunkHelpers::stringImplDataOffset):
+        (JSC::ThunkHelpers::jsStringLengthOffset):
+        (JSC::ThunkHelpers::jsStringValueOffset):
+         Moved from ThunkGenerators to make it possible to share.
+        * jit/ThunkGenerators.cpp:
+
+2010-05-06  Martin Robinson  <mrobinson@webkit.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Enable DOM clipboard and drag-and-drop access
+        https://bugs.webkit.org/show_bug.cgi?id=30623
+
+        Convert dragging portion of drag-and-drop to use DataObjectGtk.
+
+        * wtf/gobject/GRefPtr.h: Add forward declarations for GObject functions.
+
+2010-05-06  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        MAC_JAVA_BRIDGE should be renamed JAVA_BRIDGE
+        https://bugs.webkit.org/show_bug.cgi?id=38544
+
+        * wtf/Platform.h:
+
+2010-05-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        [WTFURL] Add a class to represent the segments of a URL
+        https://bugs.webkit.org/show_bug.cgi?id=38566
+
+        When paired with a string, this class represents a parsed URL.
+
+        * wtf/url/src/URLSegments.cpp: Added.
+        (WTF::URLSegments::length):
+        (WTF::URLSegments::charactersBefore):
+        * wtf/url/src/URLSegments.h: Added.
+        (WTF::URLSegments::):
+        (WTF::URLSegments::URLSegments):
+        * wtf/url/wtfurl.gyp:
+
+2010-05-05  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Adding comment with link to RefPtr documentation.
+        https://bugs.webkit.org/show_bug.cgi?id=38601
+
+        * wtf/RefPtr.h:
+
+2010-05-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 38604 - workers-gc2 crashing on Qt
+
+        This appears to be due to a couple of issues.
+        (1) When the atomic string table is deleted it does not clear the 'inTable' bit
+        on AtomicStrings - it implicitly assumes that all AtomicStrings have already
+        been deleted at this point (otherwise they will crash in their destructor when
+        they try to remove themselves from the atomic string table).
+        (2) We don't fix the ordering in which WTF::WTFThreadData and
+        WebCore::ThreadGlobalData are destructed.
+
+        We should make sure that ThreadGlobalData is cleaned up before worker threads
+        terminate and WTF::WTFThreadData is destroyed, and we should clear the inTable
+        bit of members on atomic string table destruction.
+
+        WTF changes (fix issue 1, above) - ensure inTable property is cleared when the
+        atomic string table is destroyed (also, rename InTable to IsAtomic, to make it
+        clear which table we are refering to!)
+
+        * wtf/text/AtomicString.cpp:
+        (WebCore::AtomicStringTable::destroy):
+        (WebCore::CStringTranslator::translate):
+        (WebCore::UCharBufferTranslator::translate):
+        (WebCore::HashAndCharactersTranslator::translate):
+        (WebCore::AtomicString::add):
+        * wtf/text/StringImpl.cpp:
+        (WebCore::StringImpl::~StringImpl):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::isAtomic):
+        (WebCore::StringImpl::setIsAtomic):
+        * wtf/text/StringImplBase.h:
+
+2010-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Array.join specialised for actual arrays
+        https://bugs.webkit.org/show_bug.cgi?id=38592
+
+        Bring Array.join in line with the other array methods by specialising for
+        this === an array.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+
+2010-05-04  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebKit crashes at DebuggerCallFrame::functionName() if m_callFrame is the top global callframe.
+        https://bugs.webkit.org/show_bug.cgi?id=38535
+
+        Don't call asFunction if callee is not a FunctionType to prevent assertion failure
+        in JSCell::isObject().
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+
+2010-05-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Remove redundant exports to fix Windows build warnings.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix a memory leak inside the QScriptValue.
+
+        QSciptValuePrivate::toString should release all temporary variables.
+
+        [Qt] QScriptValue::toString have a memory leak.
+        https://bugs.webkit.org/show_bug.cgi?id=38112
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toString):
+
+2010-05-04  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Darin Adler.
+
+        Does not work on SPARC because of alignment issues
+        https://bugs.webkit.org/show_bug.cgi?id=38455
+
+        Use AllocAlignmentInteger instead of void* on pageheap_memory to
+        avoid crashing at runtime in some architectures. Investigated by
+        Mike Hommey <mh@glandium.org>, change suggested by Darin Adler.
+
+        * wtf/FastMalloc.cpp:
+
+2010-05-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add first WTFURL file
+        https://bugs.webkit.org/show_bug.cgi?id=38470
+
+        This class represents a component of a URL, such as the scheme or path.
+        Essentially, the class is an index into a string buffer.
+
+        * wtf/url: Added.
+            - There was some discussion about where to put the URL library.
+              There are a number of reasonable options, but putting the library
+              in the WTF directory seems like a reasonable alternative.  This
+              location will make more sense once WTF is moved out of
+              JavaScriptCore and into a top-level directory.
+        * wtf/url/src: Added.
+            - I've added this extra directory to the usual structure because we
+              eventually want a "public" folder that defines the public
+              interface to this library that clients outside of svn.webkit.org
+              can rely upon, much like the various subfolders of the WebKit
+              directory often define a public API.
+        * wtf/url/src/URLComponent.h: Added.
+            - I've added this somewhat trivial class to get the ball rolling.
+        (WTF::URLComponent::URLComponent):
+        (WTF::URLComponent::isValid):
+        (WTF::URLComponent::isNonempty):
+        (WTF::URLComponent::reset):
+        (WTF::URLComponent::operator==):
+        (WTF::URLComponent::begin):
+        (WTF::URLComponent::setBegin):
+        (WTF::URLComponent::length):
+        (WTF::URLComponent::setLength):
+        (WTF::URLComponent::end):
+        * wtf/url/wtfurl.gyp: Added.
+            - WTFURL will be an independently buildable library, hence the
+              beginnings of a wtfurl.gyp file.
+
+2010-05-03  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38368
+        <rdar://problem/7834433> REGRESSSION: 1.5% PLT regression due to 56028 
+        (return memory quicker).
+        Instead of returning everything but the smallest spans spread out 
+        the spans kept over several size lists.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge):
+
+2010-05-03  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Clean up a few compiler warnings
+        https://bugs.webkit.org/show_bug.cgi?id=38073
+
+        * wtf/text/StringImpl.cpp:
+        (WebCore::StringImpl::ascii):
+
+2010-05-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting previous commit).
+
+        Rolling out r58114 - this introduced memory leaks of
+        AtomicStrings then workers terminated.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ThunkGenerators.cpp:
+        (JSC::ThunkHelpers::stringImplDataOffset):
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierCStringTranslator::equal):
+        (JSC::IdentifierCStringTranslator::translate):
+        (JSC::Identifier::add):
+        (JSC::IdentifierUCharBufferTranslator::hash):
+        (JSC::IdentifierUCharBufferTranslator::equal):
+        (JSC::IdentifierUCharBufferTranslator::translate):
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        (WTF::WTFThreadData::~WTFThreadData):
+        * wtf/WTFThreadData.h:
+        (JSC::IdentifierTable::remove):
+        (JSC::IdentifierTable::literalTable):
+        (WTF::WTFThreadData::atomicStringTable):
+        * wtf/text/AtomicString.cpp:
+        (WebCore::AtomicStringTable::create):
+        (WebCore::AtomicStringTable::table):
+        (WebCore::AtomicStringTable::destroy):
+        (WebCore::stringTable):
+        (WebCore::CStringTranslator::hash):
+        (WebCore::CStringTranslator::equal):
+        (WebCore::CStringTranslator::translate):
+        (WebCore::operator==):
+        (WebCore::AtomicString::add):
+        (WebCore::equal):
+        (WebCore::UCharBufferTranslator::hash):
+        (WebCore::UCharBufferTranslator::equal):
+        (WebCore::UCharBufferTranslator::translate):
+        (WebCore::HashAndCharactersTranslator::hash):
+        (WebCore::HashAndCharactersTranslator::equal):
+        (WebCore::HashAndCharactersTranslator::translate):
+        (WebCore::AtomicString::find):
+        (WebCore::AtomicString::remove):
+        * wtf/text/AtomicStringTable.h: Removed.
+        * wtf/text/StringImpl.cpp:
+        (WebCore::StringImpl::~StringImpl):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable):
+        (WebCore::equal):
+        * wtf/text/StringImplBase.h:
+        (WTF::StringImplBase::StringImplBase):
+
+2010-05-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Implement scheduleDispatchFunctionsOnMainThread for wx port.
+        https://bugs.webkit.org/show_bug.cgi?id=38480
+
+        * wtf/wx/MainThreadWx.cpp:
+        (wxCallAfter::wxCallAfter):
+        (wxCallAfter::OnCallback):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2010-05-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Build and use Mac's ComplexTextController to support complex text in wx.
+        https://bugs.webkit.org/show_bug.cgi?id=38482
+
+        * wtf/Platform.h:
+
+2010-05-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Interpreter crashes due to incorrect refcounting of cached structures.
+        https://bugs.webkit.org/show_bug.cgi?id=38491
+        rdar://problem/7926160
+
+        Make sure we ref/deref structures used for cached custom property getters
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+
+2010-05-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Enable JIT for QtWebKit on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=38339
+
+        JIT on Symbian has been stable for quite some time, it
+        is time to turn it on by default.
+
+        * wtf/Platform.h:
+
+2010-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add codegen support for unsigned right shift
+        https://bugs.webkit.org/show_bug.cgi?id=38375
+
+        Expose unsigned right shift in the macro assembler, and make use of it
+        from the jit.  Currently if the result is outside the range 0..2^31-1
+        we simply fall back to the slow case, even in JSVALUE64 and JSVALUE32_64
+        where technically we could still return an immediate value.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::urshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::urshift32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::urshift32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::shrl_i8r):
+        (JSC::X86Assembler::shrl_CLr):
+           Add unsigned right shift to the x86 assembler
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+           op_rshift no longer simply get thrown to a stub function
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+          JSVALUE32 and JSVALUE64 implementation.  Only supports
+          double lhs in JSVALUE64.
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+          Refactor right shift code to have shared implementation between signed
+          and unsigned versions.
+
+2010-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Handle double on righthand side of a right shift
+        https://bugs.webkit.org/show_bug.cgi?id=38363
+
+        In 64-bit we support right shift of a double, and there's no
+        reason not to in 32-bit either.  This is a 1.1% sunspider
+        improvement in 32bit.
+
+        Given high performance javascript code frequently makes
+        use of bit operators to perform double->int conversion i'll
+        follow this patch up with similar patches for bitwise 'and'
+        and 'or'.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+
+2010-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Hoist JSVALUE32_64 arithmetic implementations into a separate file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITArithmetic32_64.cpp: Added.
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+
+2010-04-29  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt
+
+        Add sqrt() instruction support for ARM assembler (using VFP)
+        https://bugs.webkit.org/show_bug.cgi?id=38312
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fsqrtd_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARM::sqrtDouble):
+
+2010-04-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Refactor qtscriptglobal.h
+        https://bugs.webkit.org/show_bug.cgi?id=37953
+
+        Use the same pattern in qtscriptglobal.h as in 
+        qwebkitglobal.h without checking for specific OSs.
+
+        * qt/api/qtscriptglobal.h:
+
+2010-04-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Small cleanup.
+
+        QScriptValuePrivate constructor shouldn't take QScriptEngine pointer
+        as a parameter, because it breaks a private / public separation rule.
+        QScriptEnginePrivate::get(QScriptEngine*) should return
+        a QScriptEnginePrivate pointer instead of a QScriptEnginePtr, it simplifies
+        implementation.
+
+        [Qt] QScriptValuePrivate class needs some cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=37729
+
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::get):
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::QScriptValue):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::QScriptValuePrivate):
+
+2010-04-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Simon Hausmann.
+
+        [WINCE] Export g_stackBase with JS_EXPORTDATA
+        https://bugs.webkit.org/show_bug.cgi?id=37437
+
+        Export g_stackBase with JS_EXPORTDATA as it is used by SharedTimerWince.cpp.
+
+        * runtime/Collector.cpp:
+
+2010-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Do an unordered compare so that we don't treat NaN incorrectly.
+
+        RS=Gavin Barraclough
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::powThunkGenerator):
+
+2010-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add fast paths for Math.pow and Math.sqrt
+        https://bugs.webkit.org/show_bug.cgi?id=38294
+
+        Add specialized thunks for Math.pow and Math.sqrt.
+        This requires adding a sqrtDouble function to the MacroAssembler
+        and sqrtsd to the x86 assembler.
+
+        Math.pow is slightly more complicated, in that we have
+        to implement exponentiation ourselves rather than relying
+        on hardware support.  The inline exponentiation is restricted
+        to positive integer exponents on a numeric base.  Exponentiation
+        is finally performed through the "Exponentiation by Squaring"
+        algorithm.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::sqrtDouble):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARMv7::sqrtDouble):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::loadDouble):
+        (JSC::MacroAssemblerX86::supportsFloatingPointSqrt):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::sqrtDouble):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::loadDouble):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointSqrt):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::movsd_mr):
+        (JSC::X86Assembler::sqrtsd_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::twoByteOp):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * create_hash_table:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiNativeCallThunk):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitLoadDouble):
+        (JSC::JSInterfaceJIT::emitJumpIfImmediateNumber):
+        (JSC::JSInterfaceJIT::emitJumpIfNotImmediateNumber):
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::loadDoubleArgument):
+        (JSC::SpecializedThunkJIT::loadInt32Argument):
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::NativeExecutable):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+
+2010-04-28  Mike Thole  <mthole@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Reenable WTF_USE_PROTECTION_SPACE_AUTH_CALLBACK now that an
+        exports file for it has been added.
+
+        * wtf/Platform.h:
+
+2010-04-28  Mike Thole  <mthole@apple.com>
+
+        Build fix, not reviewed.
+
+        * wtf/Platform.h:
+        Disable WTF_USE_PROTECTION_SPACE_AUTH_CALLBACK until an exports file is created.
+
+2010-04-28  Mike Thole  <mthole@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Add canAuthenticateAgainstProtectionSpace() to frame loader so that a protection space 
+        can be inspected before attempting to authenticate against it
+        https://bugs.webkit.org/show_bug.cgi?id=38271
+
+        * wtf/Platform.h: Add WTF_USE_PROTECTION_SPACE_AUTH_CALLBACK define.
+
+2010-04-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Don't use CFAbsoluteTimeGetCurrent on Mac OS X, since it's just a cover
+        for gettimeofday anyway.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime): Remove the CF version of this. Change the "other POSIX"
+        version to pass 0 for the time zone instead of ignoring a return value.
+        Also get rid of unneeded type casts, since operations involving both
+        integers and doubles are always evaluated as doubles in C without explicit
+        type casting.
+
+2010-04-28  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] callOnMainThread should equate to MessageLoop::PostTask
+        https://bugs.webkit.org/show_bug.cgi?id=38276
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * wtf/MainThread.cpp:
+        * wtf/chromium/ChromiumThreading.h:
+        * wtf/chromium/MainThreadChromium.cpp:
+        (WTF::initializeMainThread):
+        (WTF::callOnMainThread):
+        (WTF::callOnMainThreadAndWait):
+        (WTF::setMainThreadCallbacksPaused):
+        (WTF::isMainThread):
+
+2010-04-28  Simon Hausmann  <simon.hausmann@nokia.com>, Kent Hansen <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JSC's currentThreadStackBase is not reentrant on some platforms
+        https://bugs.webkit.org/show_bug.cgi?id=37195
+
+        This function needs to be reentrant to avoid memory corruption on platforms where
+        the implementation uses global variables.
+
+        This patch adds a mutex lock where necessary and makes the Symbian implementation
+        reentrant.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBaseMutex):
+        (JSC::currentThreadStackBase):
+
+2010-04-28  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with gcc 3.4.
+
+        AtomicStringImpl.h:29: error: base `WebCore::StringImpl' with only
+        non-default constructor in class without a constructor
+
+        * wtf/text/AtomicStringImpl.h:
+        (WebCore::AtomicStringImpl::AtomicStringImpl): Provide a default constructor.
+        * wtf/text/StringImpl.h: Allow AtomicStringImpl to call a StringImpl constructor through a friend declaration.
+
+2010-04-27  Stephanie Lewis  <slewis@apple.com>
+
+        Fix Tiger build.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::Carve):
+
+2010-04-26  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38154 FastMalloc calls madvise too often.
+        <rdar://problem/7834433> REGRESSSION: 1.5% PLT regression due to 56028 (return memory quicker).  
+        To save on madvise calls when recommitting memory recommit the entire span and then carve it
+        instead of carving the span up and only committing the part that will be used immediately.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Carve):
+
+2010-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add specialized thunks for a char code related string functions
+        https://bugs.webkit.org/show_bug.cgi?id=38177
+
+        This is a simple extension to my prior patch.  Basically hoist the
+        existing character loading logic from the charCodeAt thunk and into
+        a helper function, then add a helper to load strings from the small
+        string cache.  This allows trivial implementations of fromCharCode
+        and charAt. 
+
+        * create_hash_table:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSCell):
+        (JSC::SpecializedThunkJIT::tagReturnAsJSCell):
+        * jit/ThunkGenerators.cpp:
+        (JSC::stringCharLoad):
+        (JSC::charToString):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+
+2010-04-27  Thomas Zander <t.zander@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the build on Symbian on Linux using the Makefile based mkspec
+
+        * JavaScriptCore.pri: It is necessary to specify the library search path
+        when linking against JavaScriptCore.
+
+2010-04-21  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compile fix for Visual Studio 2010
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+
+        Patch by Prasanth Ullattil <prasanth.ullattil@nokia.com>
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::transitionTableAdd):
+        * wtf/MathExtras.h:
+        * wtf/Platform.h:
+
+2010-04-27  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename COMPILER(MSVC7) to COMPILER(MSVC7_OR_LOWER)
+
+        * config.h:
+        (JSC::Structure::transitionTableAdd):
+        * wtf/Assertions.h:
+        * wtf/Atomics.h:
+        * wtf/CurrentTime.h:
+        (WTF::getLocalTime):
+        * wtf/Platform.h:
+        * wtf/StaticConstructors.h:
+        * wtf/StringExtras.h:
+        * wtf/Vector.h:
+        (WTF::::append):
+
+2010-04-15  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix Mac build break.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+        - Make sure JavaScriptCore's debug_and_release config follows that
+          of WebCore.
+        - Use different name for JavaScriptCore target in debug and release
+          since they might be written in the same path at the same time on
+          parallel builds
+        - Consolidate the DESTDIR determination logic in JavaScriptCore.pri
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2010-04-21  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Make sure WebKit is not compiled using C++0x.
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+
+        As the rest of Qt compiles in the C++0x mode, people might start
+        compiling it in this mode. WebKit don't support this yet.
+
+        Patch by Thiago Macieira <thiago.macieira@nokia.com>
+
+        * JavaScriptCore.pro:
+
+2010-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Fix windows
+
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::argumentToVirtualRegister):
+
+2010-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Need to support more efficient dispatch of lightweight builtins
+        https://bugs.webkit.org/show_bug.cgi?id=38155
+
+        The problem with calling lightweight builtins is that marshalling
+        the call from the nitro calling convention to the system calling
+        convention is very expensive relative to the cost of the actually
+        evaluating the function.  To work around this problem this patch
+        adds the ability to define a custom thunk for a builtin.
+
+        This allows us to use high performance custom implementations of
+        the common and sensible versions of simple builtins.  This patch
+        includes a simple (use of which is currently hardcoded) thunk for
+        charCodeAt.
+
+        This adds a JSInterfaceJIT subclass called SpecializedThunkJIT
+        that has helper functions to remove (or at least reduce) the need
+        to have separate thunk implementations for each JSValue encoding.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+          Many project file updates
+
+        * create_hash_table:
+          Add thunk generation callbacks to the hash tables, currently
+          we hardcode the script to only support charCodeAt
+
+        * jit/JITStubCall.h:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::~JITThunks):
+        (JSC::JITThunks::specializedThunk):
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h: Added.
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::loadCellArgument):
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        (JSC::SpecializedThunkJIT::loadInt32Argument):
+        (JSC::SpecializedThunkJIT::appendFailure):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::finalize):
+        (JSC::SpecializedThunkJIT::argumentToVirtualRegister):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        * jit/ThunkGenerators.cpp: Added.
+        (JSC::ThunkHelpers::stringImplDataOffset):
+        (JSC::ThunkHelpers::jsStringLengthOffset):
+        (JSC::ThunkHelpers::jsStringValueOffset):
+        (JSC::charCodeAtThunkGenerator):
+        * jit/ThunkGenerators.h: Added.
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::NativeExecutable):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getThunk):
+        * runtime/JSString.h:
+        (JSC::):
+        * runtime/JSValue.h:
+          Protect some of the JSVALUE32 and JSVALUE32_64 only constants
+          and function behind appropriate USE() guards to make it harder
+          to use the wrong flags for the target build.
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::generator):
+        (JSC::HashEntry::):
+          Make the lookup tables use a specialized thunkGenerator
+          if present
+        * wtf/text/StringImpl.h:
+
+2010-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * runtime/JSImmediate.h:
+        * runtime/JSValue.h:
+
+2010-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Factor some basic JS interface logic out of JIT and into a superclass
+        https://bugs.webkit.org/show_bug.cgi?id=38163
+
+        Create JSInterfaceJIT to hold some common low level functions for
+        interacting with the JS RegisterFile.  Doing this separately from
+        https://bugs.webkit.org/show_bug.cgi?id=38155 to ease reviewing.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        * jit/JSInterfaceJIT.h: Added.
+        (JSC::JSInterfaceJIT::emitLoadJSCell):
+        (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::tagFor):
+        (JSC::JSInterfaceJIT::payloadFor):
+        (JSC::JSInterfaceJIT::addressFor):
+
+2010-04-26  Sam Weinig  <sam@webkit.org>
+
+        Fix Tiger build.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::isMainThread):
+
+2010-04-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7766413>
+        
+        Fixed a crash seen when using the JavaScriptCore API with WebKit.
+        
+        No layout test because DumpRenderTree doesn't use the JavaScriptCore API
+        in this way.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::setGlobalObject):
+        (JSC::RegisterFile::clearGlobalObject):
+        (JSC::RegisterFile::globalObject):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile): Use WeakGCPtr for managing m_globalObject,
+        since it's a weak pointer. (We never noticed this error before because,
+        in WebKit, global objects always have a self-reference in a global variable,
+        so marking the register file's global variables would keep m_globalObject
+        alive. In the JavaScriptCore API, you can allocate a global object with
+        no self-reference.)
+
+        * runtime/JSActivation.h: Removed unneeded #include.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject): Don't use ==, since a weak
+        pointer is 0 when the object it points to runs its destructor.
+
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::clear): Changed to return a bool indicating whether the
+        clear actually happened.
+        (JSC::WeakGCPtr::assign): Changed to forbid assignment of 0 as a shorthand
+        for calling clear(). A client should never clear by assigning 0, since
+        clear() should be conditional on whether the object doing the clearing
+        is still pointed to by the weak pointer. (Otherwise, a zombie object might
+        clear a pointer to a new, valid object.)
+
+2010-04-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=38097
+        Disentangle initializing the main thread from initializing threading
+
+        This is the first step in getting rid of the WEB_THREAD #define and
+        paving the way to allowing mac both WebKit and WebKit2 to use the same
+        WebCore.
+
+        * JavaScriptCore.exp: Export initializeMainThread and initializeMainThreadToProcessMainThread.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Sort files.
+
+        * wtf/MainThread.cpp:
+        (WTF::mainThreadInitializationMutex):
+        (WTF::mainThreadFunctionQueueMutex):
+        (WTF::initializeMainThread):
+        (WTF::deprecatedInitializeMainThread):
+        * wtf/MainThread.h:
+        Added Mac only initializeMainThreadToProcessMainThread which sets up callOnMainThread
+        and isMainThead calls to assume that WebCore's main thread is also the
+        process's main thread. Since it is possible that both initializeMainThread
+        and initializeMainThreadToProcessMainThread could be called, the first one called
+        wins (either will work).
+
+        * wtf/Threading.h: Moved to top of file.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): Remove call to initializeMainThread.
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeThreading): Ditto.
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeThreading): Ditto.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeMainThreadPlatform):
+        (WTF::initializeMainThreadToProcessMainThread):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+        (WTF::isMainThread):
+        Add runtime switch between the old behavior of using the system's main
+        thread and a stored pointer to the main thread. Tiger always uses the
+        system's main thread.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeThreading): Remove call to initializeMainThread.
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform): Add call to initializeCurrentThreadInternal
+        removed from initializeThreading.
+
+2010-04-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix a memory leak in the QScriptString.
+
+        QScriptStringPrivate's constructor shouldn't call JSStringRetain as
+        QScriptConverter implicitly pass a JSStringRef ownership.
+
+        [Qt] QScriptStringPrivate c'tor problem
+        https://bugs.webkit.org/show_bug.cgi?id=38110
+
+        * qt/api/qscriptstring_p.h:
+        (QScriptStringPrivate::QScriptStringPrivate):
+
+2010-04-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r56560): Crash in parseFloat if passed invalid UTF-16 data
+        https://bugs.webkit.org/show_bug.cgi?id=38083
+        rdar://problem/7901044
+
+        Tests: fast/js/ToNumber.html
+               fast/js/parseFloat.html
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt): Added a FIXME comment about a problem I noticed.
+        (JSC::parseFloat): Added a FIXME comment about a problem I noticed;
+        covered by test cases in the test I added.
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble): Added FIXME comments about two problems I
+        noticed; covered by test cases in the tests I added. Added a return
+        statement so we don't crash when illegal UTF-16 sequences are present.
+
+2010-04-24  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Allow to construct HashTraits<WebCore::QualifiedName>::constructDeletedValue
+
+        Former implementation attempted to use AtomicString(HashTableDeletedValue)
+        however those values cannot be used that way: one cannot construct
+        QualifiedNameImpl out of such AtomicString as we'll try to lookup this string
+        in the table, for example.
+        https://bugs.webkit.org/show_bug.cgi?id=37722
+
+        * wtf/RefPtr.h: expose hash table deleted value
+
+2010-04-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Levin.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=38060
+        Split up Threading.h
+
+        Move bits for of Threading.h into 3 new files.
+        - Atomics.h for atomic operations.
+        - ThreadSafeShared.h for the ThreadSafeShared class.
+        - ThreadingPrimitives.h for the primitives and platform types.
+
+        Basic threading operations (creation, etc.) remain in Threading.h.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Atomics.h: Copied from wtf/Threading.h.
+        * wtf/ThreadSafeShared.h: Copied from wtf/Threading.h.
+        * wtf/Threading.h:
+        * wtf/ThreadingPrimitives.h: Copied from wtf/Threading.h.
+
+2010-04-23  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * wtf/qt/MainThreadQt.cpp: #include <QThread>
+
+2010-04-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=38022
+        Move isMainThread predicate function to MainThread.h
+
+        * wtf/MainThread.cpp:
+        (WTF::initializeMainThread):
+        (WTF::isMainThread):
+        * wtf/MainThread.h:
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeThreading):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeThreading):
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeMainThreadPlatform):
+        (WTF::isMainThread):
+        * wtf/qt/MainThreadQt.cpp:
+        (WTF::isMainThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeThreading):
+        * wtf/text/AtomicString.cpp:
+
+2010-04-23  Gabor Rapcsanyi  <rgabor@inf.u-szeged.hu>
+
+        Reviewed by Laszlo Gombos.
+
+        Add RVCT support for Linux
+
+        Developed in cooperation with Gabor Loki.
+
+        * API/JSStringRef.h:
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JITStubs.cpp:
+        * wtf/MathExtras.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2010-04-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [WIN] Move OwnPtrWin.cpp into platform specific folder.
+        https://bugs.webkit.org/show_bug.cgi?id=38042
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrWin.cpp: Removed.
+        * wtf/win/OwnPtrWin.cpp: Copied from JavaScriptCore/wtf/OwnPtrWin.cpp.
+
+2010-04-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [BREWMP] Move OwnPtrBrew.cpp into platform specific folder.
+        https://bugs.webkit.org/show_bug.cgi?id=38042
+
+        * wtf/OwnPtrBrew.cpp: Removed.
+        * wtf/brew/OwnPtrBrew.cpp: Copied from JavaScriptCore/wtf/OwnPtrBrew.cpp.
+
+2010-04-22  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Update Android to use isfinite, isinf, isnan and signbit from namespace std.
+        https://bugs.webkit.org/show_bug.cgi?id=37948
+
+        * wtf/MathExtras.h:
+
+2010-04-22  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix.
+
+        * wtf/MD5.cpp: fix include path of CString.h
+
+2010-04-22  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        MD5 is required for WebSocket new protocol implementation
+        https://bugs.webkit.org/show_bug.cgi?id=37913
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/MD5.cpp: Added.
+        * wtf/MD5.h: Added.
+
+2010-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Errk, accidentally committed commenting out two ASSERTs! reverting.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+
+2010-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38006
+        Change lifetime of JSC::IdentifierTables used by WebCores to match AtomicStringTable
+
+        Presently JSC's IdentifierTables are owned by the JSGlobalData.  For
+        JSGlobalData objects created via the API this should continue to be the case,
+        but for the JSGlobalData objects used by WebCore (the main thread's common
+        global data, and those for workers) use a IdentifierTable provided (and owned)
+        by wtfThreadData.  This allow the lifetime of these IdentifierTable to match
+        those of the corresponding AtomicStringTables.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShim::APIEntryShim):
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::markRoots):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::createContextGroup):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::):
+        (JSC::JSGlobalData::isSharedInstance):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        (WTF::WTFThreadData::~WTFThreadData):
+
+2010-04-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r58110.
+        http://trac.webkit.org/changeset/58110
+        https://bugs.webkit.org/show_bug.cgi?id=38007
+
+        Caused an internal compiler error on Qt (Requested by abarth
+        on #webkit).
+
+        * wtf/MathExtras.h:
+
+2010-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * API/JSWeakObjectMapRefPrivate.cpp:
+
+2010-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * API/JSBase.cpp:
+        * API/JSCallbackObject.cpp:
+
+2010-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37978
+        Unify JSC::IdentifierTable and WebCore::AtomicStringTable implementations.
+
+        These two classes both implement a HashSet of uniqued StringImpls, with
+        translator classes to avoid unnecessary object creation. The only difference
+        between the classes is which flag (isIdentifier or inTable) is set.
+        Combine the two classes using a template predicated on which flag to use.
+
+        New class AtomicStringTable created, containing all the goodness from
+        IdentifierTable & AtomicStringTable, expect for Identifier's literalTable,
+        which has been moved onto JSGlobalData. Removed duplicate string translator
+        classes. Renamed StringImpl's inTable flag to more explicit 'isAtomic',
+        and set this on the empty string (which matches Identifier behaviour, and
+        removes a redundant check for zero-length).
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Identifier.cpp:
+        (JSC::createLiteralTable):
+        (JSC::deleteLiteralTable):
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        (WTF::WTFThreadData::~WTFThreadData):
+        * wtf/WTFThreadData.h:
+        (WTF::WTFThreadData::atomicStringTable):
+        * wtf/text/AtomicString.cpp:
+        (WebCore::table):
+        (WebCore::operator==):
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
+        (WebCore::AtomicString::remove):
+        * wtf/text/AtomicStringTable.h: Added.
+        (WTF::CStringTranslator::hash):
+        (WTF::CStringTranslator::equal):
+        (WTF::CStringTranslator::translate):
+        (WTF::UCharBufferTranslator::hash):
+        (WTF::UCharBufferTranslator::equal):
+        (WTF::UCharBufferTranslator::translate):
+        (WTF::HashAndCharactersTranslator::hash):
+        (WTF::HashAndCharactersTranslator::equal):
+        (WTF::HashAndCharactersTranslator::translate):
+        (WTF::IdentifierOrAtomicStringTable::remove):
+        (WTF::::~IdentifierOrAtomicStringTable):
+        (WTF::::add):
+        (WTF::::find):
+        * wtf/text/StringImpl.cpp:
+        (WebCore::StringImpl::~StringImpl):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::isAtomic):
+        (WebCore::StringImpl::setIsAtomic):
+        (WebCore::equal):
+        * wtf/text/StringImplBase.h:
+        (WTF::StringImplBase::StringImplBase):
+
+2010-04-22  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Update Android to use isfinite, isinf, isnan and signbit from namespace std.
+        https://bugs.webkit.org/show_bug.cgi?id=37948
+
+        * wtf/MathExtras.h:
+
+2010-04-22  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove dependency of JSC to QtGui
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+
+        The patch also make sure that hal.h is in the include path on Symbian.
+        The dependency to QtGui took care of that before.
+
+        Patch by Thiago Macieira <thiago.macieira@nokia.com>
+             and Rohan McGovern <rohan.mcgovern@nokia.com>
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2010-04-22  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Corrects symbols visibility for JavaScriptCore.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37867
+
+        * JavaScriptCore.pro:
+
+2010-04-22  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Use BLX and BX to keep happy the return stack predictor above ARMv4
+        https://bugs.webkit.org/show_bug.cgi?id=37862
+
+        Inspired by Jacob Bramley's patch from JaegerMonkey
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::bx):
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::loadBranchTarget):
+        (JSC::ARMAssembler::jmp):
+        (JSC::ARMAssembler::getLdrImmAddress):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::jump):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::ret):
+        (JSC::MacroAssemblerARM::prepareCall):
+        (JSC::MacroAssemblerARM::call32):
+
+2010-04-21  Andy Estes  <aestes@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        Export WTF::deleteOwnedPtr(HFONT).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-04-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Make SmallStrings store an array of RefPtr<StringImpl>,
+        instead of a direct array of StringImpls.  This allows
+        us to remove a friend (and a layering violation) from
+        WTF::StringImpl, and makes it so that all StringImpls
+        are individually heap allocated.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * wtf/text/StringImpl.h:
+
+2010-04-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=37937
+        Wean JavaScriptCore off calls to isMainThread()
+
+        - Replace use of isMainThread() for interpreter reentry checks
+          with a stored value on the JSGlobalData.
+        - Replace use of isMainThread() for useMainThread only check in the
+          collector with a stored exclusive thread.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        Always default to a small stack type for uses of the JSC API. It is
+        unlikely that the interpreter reentry required on the web will be as
+        important for other uses of JavaScriptCore. 
+
+        * JavaScriptCore.exp: 
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Update exports.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        Use new stored JSGlobalData::maxReentryDepth instead of isMainThread().
+
+        * interpreter/Interpreter.h:
+        Rename MaxMainThreadReentryDepth to MaxLargeThreadReentryDepth and 
+        MaxSecondaryThreadReentryDepth to MaxSmallThreadReentryDepth.
+
+        * jsc.cpp:
+        (main): Use the a large stack for jsc since it is always using the
+        main thread.
+        
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        Use new stored JSGlobalData::maxReentryDepth instead of isMainThread().
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::registerThread):
+        Use the concept of making JSC run on an exclusiveThread instead of
+        forcing a mainThreadOnly assertion.
+        
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::createLeaked):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        Add ThreadStackType argument to JSGlobalData constructors and set
+        maxReentryDepth based on it.
+
+2010-04-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix pt. 3).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-04-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix pt. 2).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-04-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Qt build fix).
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * wtf/qt/StringQt.cpp: Copied from WebCore/platform/text/qt/StringQt.cpp.
+
+2010-04-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * API/JSValueRef.cpp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+        * runtime/Identifier.h:
+        * wtf/WTFThreadData.h:
+        (JSC::IdentifierTable::remove):
+        (JSC::IdentifierTable::literalTable):
+        * wtf/text/StringImpl.cpp:
+        (WebCore::StringImpl::~StringImpl):
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt, Darin Adler.
+
+        Bug 37906 - Remove JSC::UStringImpl; unify with StringImpl.
+
+        JSC::UStringImpl and WebCore::StringImpl (soon to be renamed to
+        WTF::StringImpl) are almost identical.  Remove duplication of code by unifying
+        the two, move missing features from UStringImpl into StringImpl & delete the
+        class UStringImpl.
+
+        * API/JSClassRef.cpp:
+        * API/JSContextRef.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/EvalCodeCache.h:
+        * bytecode/JumpTable.cpp:
+        * profiler/ProfileNode.cpp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/Identifier.h:
+        (JSC::Identifier::equal):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (WTF::):
+        * runtime/UStringImpl.cpp: Removed.
+        * runtime/UStringImpl.h:
+        * wtf/text/StringHash.h:
+        (WebCore::StringHash::equal):
+        (WebCore::CaseFoldingHash::equal):
+        * wtf/text/StringImpl.cpp:
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::empty):
+        (WebCore::StringImpl::sharedBuffer):
+        (WebCore::equal):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::create):
+        (WebCore::StringImpl::tryCreateUninitialized):
+        (WebCore::StringImpl::cost):
+        (WebCore::StringImpl::isIdentifier):
+        (WebCore::StringImpl::setIsIdentifier):
+        (WebCore::StringImpl::computeHash):
+        (WebCore::StringImpl::copyChars):
+        (WebCore::StringImpl::):
+
+2010-04-21  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Added missing #include "Lookup.h" in LUT source files.
+        https://bugs.webkit.org/show_bug.cgi?id=37903
+
+        * runtime/ArrayPrototype.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/JSONObject.cpp:
+        * runtime/MathObject.cpp:
+        * runtime/NumberConstructor.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/StringPrototype.cpp:
+
+2010-04-21  Gustavo Sverzut Barbieri  <barbieri@profusion.mobi>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add missing EFL JavaScriptCore file.
+        http://webkit.org/b/37854
+
+        * wtf/efl: Added.
+        * wtf/efl/MainThreadEfl.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::timeoutFired):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2010-04-20  Xan Lopez  <xlopez@igalia.com>
+
+        Another attempt to fix the build.
+
+        * GNUmakefile.am:
+
+2010-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] RegExp literals are constants that should be persistent across multiple function calls.
+        https://bugs.webkit.org/show_bug.cgi?id=37908
+
+        Dump the separate RegExp constant pool, and just use the standard JS constant pool
+        in codeblock.  This allows us to drop op_new_regexp and all associated code as well.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::):
+
+2010-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Fix license on create_regex_tables
+
+        * create_regex_tables:
+
+2010-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix gtk
+
+        * GNUmakefile.am:
+        * make-generated-sources.sh:
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 37895 - Share common code from UStringImplBase with StringImpl
+
+        The implementation of StringImpl & UStringImpl is very similar.  Restructure
+        StringImpl to match UStringImpl, moving the flags and length into a base class,
+        so that this can be shared between both string types to increase code reuse.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RopeImpl.h:
+        (JSC::RopeImpl::RopeImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::UStringImpl):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::characters):
+        * wtf/text/StringImplBase.h: Copied from JavaScriptCore/runtime/UStringImpl.h.
+        (WTF::StringImplBase::length):
+        (WTF::StringImplBase::operator new):
+        (WTF::StringImplBase::StringImplBase):
+
+2010-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Autogenerate yarr character tables
+        https://bugs.webkit.org/show_bug.cgi?id=37877
+
+        Use a python script to automatically generate character tables
+        for the builtin YARR character classes.  This allows us to generate
+        actual tables as well, by using these tables we can both increase
+        performance of the check (for complex builtins) and reduce the actual
+        code size.
+
+        4-8% win on string-unpack-code, but lots of noise on other tests so
+        i'm only confident saying its a 1% win overall.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ExtendedAddress::ExtendedAddress):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branchTest8):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpb_im):
+        (JSC::X86Assembler::testb_im):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * create_regex_tables: Added.
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::matchCharacterClass):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::CharacterClassTable::create):
+        (JSC::Yarr::CharacterClassTable::CharacterClassTable):
+        (JSC::Yarr::CharacterClass::CharacterClass):
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows fix - missed a bit!).
+
+        * wtf/text/AtomicString.h:
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows fix).
+
+        * wtf/text/AtomicString.h:
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        Add missing .def file entries.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 37869 - Move URopeImpl to its own .h/.cpp
+        
+        Currently Ropes are implemented by the class URopeImpl, which is defined in
+        UStringImpl.h, and then typedefed to the name JSString::Rope. Remove the
+        typedef, and rename all uses of URopeImpl and JSString::Rope to just RopeImpl.
+
+        Move RopeImpl to its own header, and remove all remaining references to ropes
+        from UStringImpl (rename UStringOrRopeImpl to UStringImplBase, rename or move
+        the isRope & deref methods from UStringOrRopeImpl).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::):
+        * runtime/RopeImpl.cpp: Copied from JavaScriptCore/runtime/UStringImpl.cpp.
+        (JSC::RopeImpl::derefFibersNonRecursive):
+        (JSC::RopeImpl::destructNonRecursive):
+        * runtime/RopeImpl.h: Copied from JavaScriptCore/runtime/UStringImpl.h.
+        (JSC::RopeImpl::tryCreateUninitialized):
+        (JSC::RopeImpl::isRope):
+        (JSC::RopeImpl::deref):
+        (JSC::RopeImpl::RopeImpl):
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+        (JSC::UStringImplBase::isInvalid):
+        (JSC::UStringImplBase::ref):
+        (JSC::UStringImplBase::UStringImplBase):
+        (JSC::UStringImplBase::):
+        (JSC::UStringImpl::UStringImpl):
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 37828 - Move WebCore's String classes to WTF
+
+        Move these classes up to WTF so they are available to all clients of WTF (in
+        particular JSC).
+
+        As a first patch, making the most minimal change possible, since this patch
+        could easily grow rather large since we'll have to change every class forward
+        declaration ( e.g. every "namespace WebCore { class String; }" much change to
+        "namespace WTF { class String; }").
+
+        Moving the files, but leaving the classes logically in the WebCore namespace -
+        which is technically a layering violation - I'll come back and fix this up in a
+        subsequent patch.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h:
+        * wtf/StaticConstructors.h: Copied from WebCore/platform/StaticConstructors.h.
+        * wtf/text/AtomicString.cpp: Copied from WebCore/platform/text/AtomicString.cpp.
+        * wtf/text/AtomicString.h: Copied from WebCore/platform/text/AtomicString.h.
+        * wtf/text/AtomicStringImpl.h: Copied from WebCore/platform/text/AtomicStringImpl.h.
+        * wtf/text/StringBuffer.h: Copied from WebCore/platform/text/StringBuffer.h.
+        * wtf/text/StringHash.h: Copied from WebCore/platform/text/StringHash.h.
+        * wtf/text/StringImpl.cpp: Copied from WebCore/platform/text/StringImpl.cpp.
+        * wtf/text/StringImpl.h: Copied from WebCore/platform/text/StringImpl.h.
+        * wtf/text/WTFString.cpp: Copied from WebCore/platform/text/String.cpp.
+        (WebCore::charactersToFloat):
+        * wtf/text/WTFString.h: Copied from WebCore/platform/text/PlatformString.h.
+
+2010-04-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed speculative buildfix for WinCE after r57882
+        https://bugs.webkit.org/show_bug.cgi?id=37701
+
+        * JavaScriptCore.pri: missing wince* case added.
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Speculative Chromium/Win build fix, attempt #2.
+
+        * config.h:
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Speculative Chromium/Win build fix.
+
+        * config.h: JS_EXPORTDATA should do nothing on !JSC builds.
+
+2010-04-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Target(WebCore,jsc,...) must depends on static library of JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=37701
+
+        * JavaScriptCore.pri: dependency added.
+
+2010-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Maciej Stachowiak (relanding r57829).
+        Added missing JS_EXPORTDATA
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSContextRef.cpp:
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::remove):
+        (JSC::Identifier::checkCurrentIdentifierTable):
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+        * wtf/WTFThreadData.cpp: Copied from JavaScriptCore/wtf/WTFThreadData.cpp.
+        * wtf/WTFThreadData.h: Copied from JavaScriptCore/wtf/WTFThreadData.h.
+
+2010-04-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (rolling out r57829).
+        This broke windows.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSContextRef.cpp:
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::remove):
+        (JSC::Identifier::checkCurrentIdentifierTable):
+        (JSC::createIdentifierTableSpecificCallback):
+        (JSC::createIdentifierTableSpecific):
+        * runtime/Identifier.h:
+        (JSC::ThreadIdentifierTableData::ThreadIdentifierTableData):
+        (JSC::defaultIdentifierTable):
+        (JSC::setDefaultIdentifierTable):
+        (JSC::currentIdentifierTable):
+        (JSC::setCurrentIdentifierTable):
+        (JSC::resetCurrentIdentifierTable):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+        * wtf/WTFThreadData.cpp: Removed.
+        * wtf/WTFThreadData.h: Removed.
+
+2010-04-19  Douglas Gregor  <dgregor@apple.com>
+
+        Reviewed and landed by Anders Carlsson.
+
+        * runtime/UStringImpl.h:
+        Fix class/struct declaration mismatches.
+
+2010-04-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Checked in these tests I wrote becuase Balazs Kelemen wanted to use them.
+
+        * tests/perf: Added.
+        * tests/perf/bench-allocate-nonretained.js: Added.
+        * tests/perf/bench-allocate-retained.js: Added.
+
+2010-04-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-04-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37745
+        Move string uniquing tables to (new) WTFThreadData class.
+
+        Remove AtomicString's dependency on ThreadGlobalData so that we can move
+        WebCore's string classes up to WTF.
+
+        WTFThreadData.cpp/.h are based on ThreadGlobalData from WebCore.
+        Moved JSC & WebCore's string uniquing tables to this class.
+
+        This patch introduces a temporary layering violation in providing forward
+        declarations of classes from JSC and WTF; this will be resolved as we move
+        more string code up to WTF.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::remove):
+        (JSC::Identifier::checkCurrentIdentifierTable):
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+        * wtf/WTFThreadData.cpp: Copied from WebCore/platform/ThreadGlobalData.cpp.
+        (WTF::WTFThreadData::WTFThreadData):
+        (WTF::WTFThreadData::~WTFThreadData):
+        * wtf/WTFThreadData.h: Copied from WebCore/platform/ThreadGlobalData.h.
+        (WTF::WTFThreadData::atomicStringTable):
+        (WTF::WTFThreadData::initializeIdentifierTable):
+        (WTF::WTFThreadData::currentIdentifierTable):
+        (WTF::WTFThreadData::setCurrentIdentifierTable):
+        (WTF::WTFThreadData::resetCurrentIdentifierTable):
+        (WTF::wtfThreadData):
+
+2010-04-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build fix for WinCE.
+
+        Moved the include of the non-existing errno.h header file inside
+        platform guard macros.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2010-04-18  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Laszlo Gombos.
+
+        [WINCE] Don't define WTF_CPU_MIDDLE_ENDIAN=1
+        https://bugs.webkit.org/show_bug.cgi?id=37434
+
+        Windows CE supports little-endian format only, so don't define
+        WTF_CPU_MIDDLE_ENDIAN=1.
+
+        * wtf/Platform.h:
+
+2010-04-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix JavaScriptCore's include path for WinCE builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=36751
+
+        * JavaScriptCore.pri:
+
+2010-04-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by nobody, build fix.
+
+2010-04-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by nobody, build fix.
+
+2010-04-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 37730 - Remove JSC::UString dependencies from WebCore::StringImpl
+        (Following on from bug #37675).
+
+        Make the argument ordering for UStringImpl's constructor & create
+        methods match, when passed a shared buffer.
+
+        * JavaScriptCore.exp:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+
+2010-04-15  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix memory leak in QScriptEngine::evaluate().
+
+        QScriptEnginePrivate::evaluate should release temporary variables.
+
+        [Qt] QScriptEngine::evaluate has memory leak.
+        https://bugs.webkit.org/show_bug.cgi?id=37596
+
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h:
+
+2010-04-14  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix a memory leak in QScriptValue::inherits.
+
+        [Qt] QScriptValue::inherits has a memory leak.
+        https://bugs.webkit.org/show_bug.cgi?id=37617
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::inherits):
+
+2010-04-14  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix a few memory leaks in QScriptEngine.
+
+        Syntax checking caused memory leak, not all temporary variables were released.
+
+        [Qt] Syntax checking  in the QtScript cause a memory leak.
+        https://bugs.webkit.org/show_bug.cgi?id=37610
+
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::checkSyntax):
+        * qt/api/qscriptsyntaxcheckresult.cpp:
+        (QScriptSyntaxCheckResultPrivate::errorMessage):
+        (QScriptSyntaxCheckResultPrivate::errorLineNumber):
+
+2010-04-14  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix memory leak inside QScriptEnginePrivate::makeJSValue.
+
+        QScriptEnginePrivate::makeJSValue should release temporary JSStringRef variable.
+
+        [Qt] tst_QScriptValue::toString has a memory leak.
+        https://bugs.webkit.org/show_bug.cgi?id=37598
+
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::makeJSValue):
+
+2010-04-14  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Move the YARR JIT fallback detection from RegexJIT.cpp to
+        RegexCompiler.cpp.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37571
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::operator!):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-04-14  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Mac OS X: Use deployment target to determine whether memory tagging should be enabled
+        https://bugs.webkit.org/show_bug.cgi?id=34888
+
+        When building on (Snow) Leopard but targeting Tiger
+        (TARGETING_TIGER defined, BUILDING_ON_TIGER not defined),
+        WebKit would crash on Tiger because the tags passed to mmap
+        caused those function calls to fail.
+
+        Conversely, when building on Tiger but targeting Leopard
+        (BUILDING_ON_TIGER defined, TARGETING_LEOPARD defined), WebKit
+        would crash on Leopard because the tags passed to vm_map and
+        vm_allocate caused those function calls to fail.
+
+        Solution: Use TARGETING_TIGER rather than BUILDING_ON_TIGER to
+        govern the tag definitions. Use the same tags for vm_map and
+        vm_allocate regardless of target, since they work on
+        both. Fall back to the mmap tags that work on Tiger (that is,
+        "no tags") if targeting Tiger, since those tags also work on
+        Leopard.
+
+        * wtf/VMTags.h:
+
+2010-04-12  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build fix.
+
+        [Qt] Build fix for Mac when building with build-webkit --qt
+
+        Specifying no configuration on Mac builds WebCore both in debug
+        and release. JavaScriptCore has to follow this rule as well.
+
+        * JavaScriptCore.pro:
+
+2010-04-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7851332> Fix the build.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::): Initialize extra members of malloc_introspection_t to zero.
+
+2010-04-09  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Make CallIdentifier constructor to handle null urls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37341
+
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::CallIdentifier):
+
+2010-04-09  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix crashes with package builds in release
+
+        Add NDEBUG to the defines for package build in JavaScriptCore.pri,
+        so that it's consistently used for JavaScriptCore, WebCore, jsc and all
+        other tools using wtf, etc. data structures directly. Mixing NDEBUG with
+        non-NDEBUG builds causes crashes due to differences in data structures when
+        assertions/checks are enabled.
+
+        * JavaScriptCore.pri:
+
+2010-04-09  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Implement NO_RETURN for COMPILER(MSVC).
+        https://bugs.webkit.org/show_bug.cgi?id=33056 
+
+        Added NO_RETURN_WITH_VALUE for functions with non-void return type.
+
+        * jsc.cpp:
+        * wtf/AlwaysInline.h:
+        * wtf/FastMalloc.cpp:
+
+2010-04-08  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Simon Hausmann.
+
+        [WINCE] Check if ARM or _ARM_ is defined
+        https://bugs.webkit.org/show_bug.cgi?id=37200
+
+        MSVC defines ARM and _ARM_ for Windows CE ARM. Define WTF_CPU_ARM=1
+        when either ARM or _ARM_ is defined.
+
+        * wtf/Platform.h:
+
+2010-04-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed Oliver Hunt.
+
+        [Qt]r57240 broke Qt build (might be a gcc bug)
+        https://bugs.webkit.org/show_bug.cgi?id=37253
+
+        Workaround until fix. On PLATFORM(QT) use inline instead of ALWAYS_INLINE.
+
+        * wtf/PassRefPtr.h: Qt guards added.
+
+2010-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Vector<UString> makes many needless calls to UString::UString and UString::~UString
+
+        Add a VectorTrait<UString> specialisation to allow vector to simply memset/memcpy
+        data around.  Only difference from the VectorTrait<RefPtr<T> > traits is the inability
+        to use memset to initialize data.
+
+        * runtime/UString.h:
+        (WTF::):
+
+2010-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Beat gcc with a clue bat -- force inlining of refIfNotNull and derefIfNotNull
+
+        * wtf/PassRefPtr.h:
+
+2010-04-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Replace isprint with isASCIIPrintable
+        https://bugs.webkit.org/show_bug.cgi?id=37223
+
+        WebKit does not use functions in <ctype.h> as they are dependent on the current
+        locale. Use the equivalent functions in <wtf/ASCIICType.h>. isASCIIPrintable
+        replaces isprint.
+
+        * pcre/pcre_exec.cpp:
+        (pchars):
+
+2010-04-07  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37219
+        
+        This change disables text caret for the iPhone platflorm.
+        
+        * wtf/Platform.h: Disabled text caret for iPhone.
+
+2010-04-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION: Worker termination via JS timeout may cause worker tests like fast/workers/worker-terminate.html fail.
+        https://bugs.webkit.org/show_bug.cgi?id=36646
+
+        Add a new exception type for forcibly terminating a JavaScript stack.
+        The new exception functions similarly to the
+        InterruptedExecutionException but is conceptually different because
+        execution is terminated instead of just interrupted.
+
+        * GNUmakefile.am:
+            - Added new Terminator.h file.
+        * JavaScriptCore.gypi:
+            - Added new Terminator.h file.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+            - Added new Terminator.h file.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Added new Terminator.h file.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+            - Fully unwind the stack for TerminatedExecutionException.
+        (JSC::Interpreter::privateExecute):
+            - Check if we've been terminated at the same time we check if we've
+              timed out.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Check if we've been terminated at the same time we check if we've
+              timed out.
+        * runtime/Completion.cpp:
+            - Some exceptions define special completion types so that calls can
+              see why we terminated evaluation.
+        (JSC::evaluate):
+        * runtime/Completion.h:
+            - Define a new completion type for termination.
+        (JSC::):
+        * runtime/ExceptionHelpers.cpp:
+            - Define TerminatedExecutionException and refactor pseudo-RTTI
+              virtual function to be more semantic.
+        (JSC::InterruptedExecutionError::exceptionType):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        (JSC::TerminatedExecutionError::exceptionType):
+        (JSC::TerminatedExecutionError::toString):
+        (JSC::createTerminatedExecutionException):
+        * runtime/ExceptionHelpers.h:
+            - Entry point for generating a TerminatedExecutionException.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+            - Add a Terminator object that can be used to asynchronously
+              terminate a JavaScript execution stack.
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::exceptionType):
+            - Define that, by default, thrown objects have a normal exception
+              type.
+        * runtime/Terminator.h: Added.
+            - Added a new controller object that can be used to terminate
+              execution asynchronously.  This object is more or less a
+              glorified bool.
+        (JSC::Terminator::Terminator):
+        (JSC::Terminator::termianteSoon):
+        (JSC::Terminator::shouldTerminate):
+
+2010-04-05  Oliver Hunt  <oliver@apple.com>
+
+        And another one.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2010-04-05  Oliver Hunt  <oliver@apple.com>
+
+        And another build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2010-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Support weak maps in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=37132
+
+        Expose an API to allow creation of a map for storing
+        weak JS references.
+
+        * API/JSWeakObjectMapRefInternal.h: Added.
+        (OpaqueJSWeakObjectMap::create):
+        (OpaqueJSWeakObjectMap::map):
+        (OpaqueJSWeakObjectMap::~OpaqueJSWeakObjectMap):
+        (OpaqueJSWeakObjectMap::OpaqueJSWeakObjectMap):
+        * API/JSWeakObjectMapRefPrivate.cpp: Added.
+        * API/JSWeakObjectMapRefPrivate.h: Added.
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::registerWeakMap):
+        (JSC::JSGlobalObject::deregisterWeakMap):
+
+2010-04-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Symbian] Consolidate Symbian WINSCW environment configuration
+        https://bugs.webkit.org/show_bug.cgi?id=37100
+
+        Move the "undefinition" of WIN32 and _WIN32 from WebCore/config.h
+        to JavaScriptCore/wtf/Platform.h as it is not specific to WebCore.
+
+        PLATFORM(WIN) and OS(WIN) no longer needs to be undefined as
+        undefining WIN32 takes care of it.
+
+        * wtf/Platform.h:
+
+2010-04-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37068
+        Change UString to use a 0 rep for null strings instead of a null object.
+
+        No performance impact.
+
+        * JavaScriptCore.exp:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        * runtime/UString.h:
+        (JSC::UString::UString):
+        (JSC::UString::data):
+        (JSC::UString::size):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::cost):
+
+2010-04-03  Balazs Kelemen  <kb@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Fix uninitalised members in CallLinkInfo and BytecodeGenerator.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36816
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+
+2010-04-03  yael aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Enable HTMLProgressElement for Safari on OSX
+        https://bugs.webkit.org/show_bug.cgi?id=36961
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-04-02  Ruben Van Boxem  <vanboxem.ruben@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Mingw-w64 fixes for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=35607
+
+        * runtime/Collector.cpp: use the msvc code for mingw-w64 (but not mingw-w32)
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+        (JSC::currentThreadStackBase):
+        * wtf/Platform.h: added COMPILER(MINGW64) check to differentiate between mingw.org and mingw-w64 functions
+
+2010-04-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated the .def file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-04-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Inlined toThisString and toThisJSString to avoid virtual function call overhead
+        https://bugs.webkit.org/show_bug.cgi?id=37039
+        
+        Maybe a 1% speedup on iBench JS.
+
+        * JavaScriptCore.exp: New exports.
+
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        * runtime/JSValue.h:
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::toThisObject): Nixed the old virtual-type implementation.
+
+        * runtime/JSObject.h:
+        (JSC::JSValue::toThisString):
+        (JSC::JSValue::toThisJSString): Added the inlined implementation.
+
+2010-04-02  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Beef up documentation for ASSERT* and CRASH macros a bit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36527
+
+        * wtf/Assertions.h:
+
+2010-04-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, minor build fix.
+
+        Change the order of the member initialisation list
+        in constructor to match declaration order
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+
+2010-04-01  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Add FileThread for async file operation support in FileReader and FileWriter
+        https://bugs.webkit.org/show_bug.cgi?id=36896
+
+        Add ENABLE_FILE_READER and ENABLE_FILE_WRITER flags.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-03-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix pt II).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 36871 - Remove JSC::CString
+        Use WTF::CString instead (which until recently was WebCore::CString).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+
+2010-03-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, fix after r56842.
+
+        Add UNUSED_PARAM a to silence warning.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-03-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, Symbian build fix.
+
+        Refactor JITStubs.cpp so that the list of STUB_FUNCTIONs
+        are not dependent on the JSVALUE32_64 guard.
+
+        * jit/JITStubs.cpp: Place the JSVALUE32_64 guard inside 
+        the body of cti_op_eq_strings.
+        * jit/JITStubs.h: Remove JSVALUE32_64 guard from 
+        cti_op_eq_strings stub.
+
+2010-03-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        Fixing b0rked version of JavaScriptCore.vcproj - added lines were truncated.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2010-03-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36866
+        Move CString to WTF
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text: Added.
+        * wtf/text/CString.cpp: Copied from WebCore/platform/text/CString.cpp.
+        * wtf/text/CString.h: Copied from WebCore/platform/text/CString.h.
+        (WTF::CStringBuffer::data):
+        (WTF::CStringBuffer::length):
+        (WTF::CStringBuffer::create):
+        (WTF::CStringBuffer::CStringBuffer):
+        (WTF::CStringBuffer::mutableData):
+        (WTF::CString::CString):
+        (WTF::CString::isNull):
+        (WTF::CString::buffer):
+        (WTF::operator!=):
+
+2010-03-30  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build break.
+
+        [Qt] Fix build break on Qt Mac.
+
+        DESTDIR path on Mac do not include the configuration path by default
+        like on Windows. Have to force it.
+
+        * JavaScriptCore.pro:
+
+2010-03-29  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        add JSObjectRefPrivate.h
+
+2010-03-29  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        MIPS JIT Supports
+        https://bugs.webkit.org/show_bug.cgi?id=30144
+
+        The following changes enable MIPS JIT.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::lbu):
+        (JSC::MIPSAssembler::linkWithOffset):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load8):
+        (JSC::MacroAssemblerMIPS::branch8):
+        (JSC::MacroAssemblerMIPS::branchTest8):
+        (JSC::MacroAssemblerMIPS::setTest8):
+        (JSC::MacroAssemblerMIPS::setTest32):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preserveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+        * wtf/Platform.h:
+
+2010-02-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add support for Widgets 1.0: View Mode Media Feature
+        https://bugs.webkit.org/show_bug.cgi?id=35446
+
+        Add an enable flag for the Widgets (http://www.w3.org/TR/widgets-reqs/)
+        and turn it on for Qt only.
+
+        * wtf/Platform.h:
+
+2010-03-29  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Corrected name of (u)int64_t compile time assert.
+        https://bugs.webkit.org/show_bug.cgi?id=36739
+
+        int64_t_is_four_bytes -> int64_t_is_eight_bytes
+
+        * os-win32/stdint.h:
+
+2010-03-29  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use the -l syntax for linking against JavaScriptCore on Windows.
+        This allow qmake to extract dependencies correctly when generating VS
+        solutions.
+
+        * JavaScriptCore.pri:
+
+2010-03-29  Thomas Zander  <t.zander@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36742
+
+        gcc for Symbian doesn't support gcc extensions like atomicity.h - disable
+
+        * wtf/Threading.h: also detect os symbian
+
+2010-03-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove the definition of WTF_CHANGES guards from the build system
+        https://bugs.webkit.org/show_bug.cgi?id=31670
+  
+        * JavaScriptCore.pro: Remove the definition of WTF_CHANGES
+        as it is already defined in config.h
+
+2010-03-28  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add API for reporting additional memory cost of JavaScript objects
+        https://bugs.webkit.org/show_bug.cgi?id=36650
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::reportAdditionalMemoryCost):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::reportAdditionalMemoryCost):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::reportAdditionalMemoryCost):
+
+2010-03-28  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QScriptEngine API was enriched by globalObject() method
+        which give an access to the global object.
+
+        [Qt] QScriptEngine doesn't give an access to global object
+        https://bugs.webkit.org/show_bug.cgi?id=36603
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::globalObject):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::globalObject):
+        * qt/api/qscriptengine_p.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::globalObject):
+
+2010-03-26  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build JavaScriptCore as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=36590
+
+        This patch takes what was left of the unused JavaScriptCore.pro
+        and moved the compilation logic from JavaScriptCore.pri to
+        JavaScriptCore.pro.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+
+2010-03-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+
+2010-03-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 36611 - Cleanup JSC::CString
+        Rename CString::c_str() -> CString::data(), CString::size() -> CString::length(),
+        remove UString::getCString() (all uses are wrong, should use UString::UTF8String()).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (runInteractive):
+        (fillBufferWithContentsOfFile):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::c_str):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncJSCPrint):
+        * runtime/UString.cpp:
+        (JSC::operator==):
+        (JSC::UString::toDouble):
+        * runtime/UString.h:
+        (JSC::CString::length):
+        (JSC::CString::data):
+
+2010-03-25  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build fix.
+
+        [Qt] Build fix on MSVC. Reverts r55633 for stdint.h
+
+        This file gets included in generated moc files which don't
+        include the prefix header.
+
+        * os-win32/stdint.h:
+
+2010-03-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+2010-03-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Switch String::latin1, String::utf8, String::fromUTF8 to
+        use WTF's Unicode conversion methods rather than TextEncoder.
+        These methods only perform simple conversion, and don't need
+        really require TextEncoder's full capability (to look up arbitrary
+        encodings by name), switching to only be dependent on WTF will
+        make it easier if we chose to move WebCore::String to WTF.
+
+        * JavaScriptCore.exp:
+
+2010-03-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        * wtf/FastMalloc.h: Added a using directive for fastMallocSize, like we do for all public
+        WTF symbols. Also sorted the list alphabetically.
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows build fix part II).
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative windows build fix).
+
+2010-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 36519 - JSGlobalContextRelease is unnecessarily slow
+
+        Since [ http://trac.webkit.org/changeset/35917 ], calling
+        JSGlobalContextRelease always triggers a GC heap collection
+        (if not a full destroy). As per 35917's changelog "This is
+        only really necessary when the (JSGlobalObject's) last
+        reference is released, but there is no way to determine that,
+        and no harm in collecting slightly more often."
+        
+        Well, we now know of cases of API clients who are harmed by
+        the performance penalty of collecting too often, so it's time
+        to add a way to determine whether a call to JSGlobalContextRelease
+        is removing the last protect from it's global object.  If further
+        protects are retaining the global object (likely from other
+        JSGlobalContextRefs), then don't trigger a GC collection.
+
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::unprotect): return a boolean indicating that the value is now unprotected.
+        * runtime/Collector.h:
+        * wtf/HashCountedSet.h:
+        (WTF::::remove): return a boolean indicating whether the value was removed from the set.
+
+2010-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice): Some versions of GCC emit a warning about the implicit 64- to 32-bit truncation
+        that takes place here. An explicit cast is sufficient to silence it.
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): Fixed a typo - length doesn't
+        need to be converted with toInteger().
+
+2010-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36511
+        <rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check
+
+        Test: fast/js/sputnik-S15.4.4.12_A3_T3.html
+
+        * runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): We were incorrectly computing
+        the start offset, and iterated over (almost) all integers. Note that this can be fixed
+        without using doubles, but the code would be much more complicated, and there is no important
+        reason to stick to integers here.
+
+2010-03-23  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix compilation on Itanium in 32-bit mode
+        https://bugs.webkit.org/show_bug.cgi?id=36494
+
+        * wtf/Platform.h: Introduce CPU(IA64_32). Don't define
+          WTF_USE_JSVALUE64 if the CPU is in 32-bit mode.
+
+2010-03-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Interpreter fix for <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Only take the fast negate path if
+        a bit other than bit 31 is set. If none of bits 0-30 are set, then the
+        value we're negating can only be 0 or -2147483648, and neither can be
+        negated in int space.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate): Updated the JIT implementation to match
+        the interpreter, since it's slightly simpler.
+
+2010-03-22  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Symbian] More efficient aligned memory allocation for JSC Collector
+        https://bugs.webkit.org/show_bug.cgi?id=34350
+
+        * JavaScriptCore.pri: Added 2 new Symbian source files and HAL linkage
+
+        * runtime/Collector.cpp: Reduced port-specific code and added private data member
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+
+        * runtime/Collector.h: Added private data member
+
+        * wtf/symbian: Added.
+        * wtf/symbian/BlockAllocatorSymbian.cpp: Added.
+        (WTF::AlignedBlockAllocator::AlignedBlockAllocator): Helper class to allocate 
+        aligned blocks more efficiently as required by Collector
+        (WTF::AlignedBlockAllocator::alloc):
+        (WTF::AlignedBlockAllocator::free):
+        (WTF::AlignedBlockAllocator::destroy):
+        (WTF::AlignedBlockAllocator::~AlignedBlockAllocator):
+        * wtf/symbian/BlockAllocatorSymbian.h: Added.
+
+2010-03-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed <rdar://problem/7728196> REGRESSION (r46701): -(-2147483648)
+        evaluates to -2147483648 on 32 bit (35842)
+        
+        Two ways to fix the same bug:
+        
+        1. Check for overflow when negating, since negating the largest negative
+        int causes overflow.
+        
+        2. Constant-fold even when negating a negative, since, like they say in
+        high school, "math works."
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchNeg32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchNeg32): Added a branching version
+        of the negate operator.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate): Use the branching version of the negate 
+        operator to check for overflow.
+
+        (JSC::JIT::emitSlow_op_negate): Link the check for overflow to a slow case.
+        (We could emit inline code for this, since we know what the result would
+        be, but that's probably just a waste of generated code.)
+
+        * parser/Grammar.y: Constant fold even when negating a negative.
+
+2010-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/36431> Clean up 'int' use in UString.cpp after r54789
+
+        Reviewed by Darin Adler.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from): Changed argument type from 'unsigned int'
+        to 'unsigned' to match WebKit coding style.
+        (JSC::UString::find): Changed static_cast<int>() to
+        static_cast<unsigned>() now that this method returns unsigned.
+        (JSC::UString::rfind): Ditto.
+        * runtime/UString.h:
+        (JSC::UString::from): Changed argument type from 'unsigned int'
+        to 'unsigned' to match WebKit coding style.
+
+2010-03-22  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for syntax checking in the QtScript API.
+
+        New class was created; the QScriptSyntaxCheckResult which main
+        responsibility is to provide results of the ECMA Script code
+        syntax check. The class is not fully functional as the JSC C API
+        doesn't expose an error column number, but it is a good start point
+        for a future development.
+
+        [Qt] QtScript functionality should be extended by syntax checking.
+        https://bugs.webkit.org/show_bug.cgi?id=36123
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::checkSyntax):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::checkSyntax):
+        * qt/api/qscriptengine_p.h:
+        * qt/api/qscriptsyntaxcheckresult.cpp: Added.
+        (QScriptSyntaxCheckResult::QScriptSyntaxCheckResult):
+        (QScriptSyntaxCheckResult::~QScriptSyntaxCheckResult):
+        (QScriptSyntaxCheckResult::operator=):
+        (QScriptSyntaxCheckResult::state):
+        (QScriptSyntaxCheckResult::errorLineNumber):
+        (QScriptSyntaxCheckResult::errorColumnNumber):
+        (QScriptSyntaxCheckResult::errorMessage):
+        * qt/api/qscriptsyntaxcheckresult.h: Added.
+        * qt/api/qscriptsyntaxcheckresult_p.cpp: Added.
+        (QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::errorMessage):
+        (QScriptSyntaxCheckResultPrivate::errorLineNumber):
+        * qt/api/qscriptsyntaxcheckresult_p.h: Added.
+        (QScriptSyntaxCheckResultPrivate::get):
+        (QScriptSyntaxCheckResultPrivate::QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::state):
+        (QScriptSyntaxCheckResultPrivate::errorColumnNumber):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::checkSyntax_data):
+        (tst_QScriptEngine::checkSyntax):
+
+2010-03-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New class; QScriptProgram.
+
+        The class should be used to evaluate the same script multiple times
+        more efficiently.
+
+        [Qt] QtScript should have QScriptProgram class
+        https://bugs.webkit.org/show_bug.cgi?id=36008
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::evaluate):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptprogram.cpp: Added.
+        (QScriptProgram::QScriptProgram):
+        (QScriptProgram::~QScriptProgram):
+        (QScriptProgram::operator=):
+        (QScriptProgram::isNull):
+        (QScriptProgram::sourceCode):
+        (QScriptProgram::fileName):
+        (QScriptProgram::firstLineNumber):
+        (QScriptProgram::operator==):
+        (QScriptProgram::operator!=):
+        * qt/api/qscriptprogram.h: Added.
+        * qt/api/qscriptprogram_p.h: Added.
+        (QScriptProgramPrivate::get):
+        (QScriptProgramPrivate::QScriptProgramPrivate):
+        (QScriptProgramPrivate::~QScriptProgramPrivate):
+        (QScriptProgramPrivate::isNull):
+        (QScriptProgramPrivate::sourceCode):
+        (QScriptProgramPrivate::fileName):
+        (QScriptProgramPrivate::firstLineNumber):
+        (QScriptProgramPrivate::operator==):
+        (QScriptProgramPrivate::operator!=):
+        (QScriptProgramPrivate::program):
+        (QScriptProgramPrivate::file):
+        (QScriptProgramPrivate::line):
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::evaluateProgram):
+
+2010-03-21  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt #2 to fix the Windows build after r56314
+
+        * API/tests/testapi.c: Include JSObjectRefPrivate.h for the new
+        methods instead of declaring them locally (and non-extern).
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Backed out previous change.
+
+2010-03-21  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt to fix the Windows build after r56314
+
+        Try to fix the following errors on the Windows buildbot:
+
+            Linking...
+            testapi.obj : error LNK2001: unresolved external symbol "bool __cdecl JSObjectSetPrivateProperty(struct OpaqueJSContext const *,struct OpaqueJSValue *,struct OpaqueJSString *,struct OpaqueJSValue const *)" (?JSObjectSetPrivateProperty@@YA_NPBUOpaqueJSContext@@PAUOpaqueJSValue@@PAUOpaqueJSString@@PBU2@@Z)
+            testapi.obj : error LNK2001: unresolved external symbol "struct OpaqueJSValue const * __cdecl JSObjectGetPrivateProperty(struct OpaqueJSContext const *,struct OpaqueJSValue *,struct OpaqueJSString *)" (?JSObjectGetPrivateProperty@@YAPBUOpaqueJSValue@@PBUOpaqueJSContext@@PAU1@PAUOpaqueJSString@@@Z)
+            C:\cygwin\home\buildbot\slave\win-release\build\WebKitBuild\bin\testapi.exe : fatal error LNK1120: 2 unresolved externals
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added
+        missing symbols to be exported.
+
+2010-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Documentation fix for previous patch.
+
+        * API/JSObjectRefPrivate.h:
+
+2010-03-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSC needs an API to allow custom objects to have aprivate GC-accessible properties
+        https://bugs.webkit.org/show_bug.cgi?id=36420
+
+        Add new API methods to support "private" properties on custom
+        objects.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSCallbackObjectData):
+        (JSC::JSCallbackObjectData::~JSCallbackObjectData):
+        (JSC::JSCallbackObjectData::getPrivateProperty):
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::markChildren):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::getPrivateProperty):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        (JSC::JSCallbackObject::deletePrivateProperty):
+        (JSC::JSCallbackObject::markChildren):
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSObjectRefPrivate.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes after introduction of Brew files.
+
+        * wscript:
+
+2010-03-18  Tom Callaway  <tcallawa@redhat.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 35429: Fix compile on SPARC64
+        https://bugs.webkit.org/show_bug.cgi?id=35429
+
+        * wtf/Platform.h: Set WTF_USE_JSVALUE64 for SPARC64
+
+2010-03-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add API to directly expose JSON parsing
+        https://bugs.webkit.org/show_bug.cgi?id=34887
+
+        Add API to expose JSON parsing directly, and add tests to testapi
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        (JSValueCreateJSONString):
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.exp:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONStringify):
+        * runtime/JSONObject.h:
+
+2010-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler and Mark Rowe.
+
+        Update WebKit availability macros for release after 4.0.
+
+        * API/WebKitAvailability.h:
+
+2010-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        undefined, NaN, and Infinity should be ReadOnly
+        https://bugs.webkit.org/show_bug.cgi?id=36263
+
+        Simply add the ReadOnly flag to these properties.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2010-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Speed up Math.round a little by removing unneeded special case
+        https://bugs.webkit.org/show_bug.cgi?id=36107
+
+        Test: fast/js/math.html
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): This function had a special case for numbers
+        between -0.5 and -0.0 to return -0.0. But the algorithm in the function
+        already yields -0.0 for those cases, so the extra checking and branching
+        is unneeded.
+
+2010-03-17  Mike Homey  <glandium@debian.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for SPARC. Fix missing macro value.
+
+        * wtf/Platform.h:
+
+2010-03-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt, Darin Adler.
+
+        Bug 36083 - REGRESSION (r55772-r55834): Crash in JavaScriptCore RegExp code on PowerPC
+
+        The problem is a bug in our port of PCRE - that a read may take place from the first character in an
+        empty string.  For the time being, revert to using a valid pointer in the data segment rather than
+        an invalid non-null pointer into the zero-page for the empty string's data pointer.  A better fix for
+        this will be to remove PCRE.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+
+2010-03-16  Darin Adler  <darin@apple.com>
+
+        Rolled out r56081 since it broke the Windows build.
+
+2010-03-16  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove extra <new> include and add guards to operator new/delete definitions
+        https://bugs.webkit.org/show_bug.cgi?id=35967
+
+        Remove extra <new> header include from FastAlloc.cpp since it is included in 
+        FastAlloc.h. Add ENABLE(GLOBAL_FASTMALLOC_NEW) macro guard to operator
+        new/delete/new []/delete [] definitions.
+
+        * wtf/FastMalloc.cpp:
+
+2010-03-15  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add a function to create a BREW instance without local variable declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=34705
+
+        Add a template function to create a BREW instance in one line.
+
+        * wtf/brew/ShellBrew.h: Added.
+        (WTF::createInstance):
+
+2010-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Removed a now-incorrect comment I forgot to remove in my last check-in.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge):
+
+2010-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a portion of:
+        <rdar://problem/7165917> | https://bugs.webkit.org/show_bug.cgi?id=28676
+        Safari 4 does not release memory back to the operating system fast enough (28676)
+
+        Every few seconds, release a percentage of the minimum unused page count
+        during that time period.
+
+        SunSpider reports no change, command-line or in-browser, Mac or Windows.
+        
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Renamed shouldContinueScavenging
+        to shouldScavenge, since scavenging is no longer something that we interrupt.
+
+        (WTF::TCMalloc_PageHeap::scavenge): The new scavenging algorithm. Fixes
+        a bug where the old code would release only one item from each size class
+        per scavenge, potentially leaving large numbers of large-sized objects
+        unreleased for a long time.
+
+        (WTF::TCMalloc_PageHeap::shouldScavenge):
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+        (WTF::TCMalloc_PageHeap::periodicScavenge): Updated to track the minimum
+        value of free_committed_pages_ during a given scavenge period.
+
+2010-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35843
+        Re-land reverted fix to JSString::getIndex()
+
+        Calling getIndex() on a JSString in rope form may result in a JSException being thrown
+        if there is insuficient memory so value(exec) returns UString() with length zero,
+        which will be passed to jsSingleCharacterSubstring.
+        Add a slow case function to trap the error & return a safe null value, until the
+        exception is handled.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::getIndexSlowCase):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterString):
+        (JSC::JSString::getStringPropertySlot):
+
+2010-03-04  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add a long long version of abs() for MSVC.
+
+        * wtf/MathExtras.h:
+        (abs):
+
+2010-03-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Combine ctiTrampolines on ARM and Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=36014
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 36075 - Clean up screwyness re static string impls & Identifiers.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass): Classname may be null/empty, and these are an identifer.  This is okay, since the null/empty strings are shared across all threads.
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add): No need to explicitly hash null reps, this is done in the ststic UStringImpl constructor.
+        (JSC::Identifier::addSlowCase): UStringImpl::empty() handled & checkCurrentIdentifierTable now called in the header.
+        (JSC::Identifier::checkCurrentIdentifierTable): Replaces checkSameIdentifierTable (this no longer checked the rep since the identifierTable pointer was removed from UString::Rep long ago).
+        * runtime/Identifier.h:
+        (JSC::Identifier::add): Replace call to checkSameIdentifierTable with call to checkCurrentIdentifierTable at head of function.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl): Remove call to checkConsistency - this function no longer checks anything interesting.
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::UStringOrRopeImpl): Set s_refCountFlagIsIdentifier in static constructor.
+        (JSC::UStringImpl::UStringImpl): remove calls to checkConsistency (see above), add new ASSERT to substring constructor.
+        (JSC::UStringImpl::setHash): ASSERT not static (static strings set the hash in their constructor, should not reach this code path).
+        (JSC::UStringImpl::create): Add missing ASSERT.
+        (JSC::UStringImpl::setIsIdentifier): ASSERT !isStatic() (static strings hash set in constructor).
+
+2010-03-12  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by David Levin.
+
+        Two functions tryConsumeCharacter() and tryConsumeCharacterClass() are
+        removed from yarr/RegexInterpreter.cpp because they are never called.
+
+        * yarr/RegexInterpreter.cpp:
+
+2010-03-11  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        The JSNative state was renamed to JSPrimitive. The new name better
+        coresponds to the ECMAScript standard.
+
+        Enum QScriptValuePrivate::States was renamed to State to obey Qt
+        coding style rules ("States" name suggests that a state could
+        mixed together with an other state using bitwise logic operators.
+
+        [Qt] QScriptValuePrivate::States has naming issues
+        https://bugs.webkit.org/show_bug.cgi?id=35968
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::refinedJSValue):
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Remove nonsense comments used in development & commited in error.
+
+        * runtime/UStringImpl.h:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Remove export.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=36041
+        Remove unnecessary differences in common code between WebCore::StringImpl & JSC::UStringImpl
+
+        Much of the code in WebCore::StringImpl and JSC::UStringImpl is now very similar,
+        but has trivial and unnecessary formatting differences, such as the exact wording
+        of comments, missing ASSERTs, functions implemented in the .h vs .cpp etc.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add): UStringImpl::empty() now automatically hashes, uas per WebCore strings.
+        (JSC::Identifier::addSlowCase): UStringImpl::empty() now automatically hashes, uas per WebCore strings.
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl): Only call bufferOwnership() once, add missing ASSERTs.
+        (JSC::UStringImpl::createUninitialized): Move from .h, not commonly called, no need to inline.
+        (JSC::UStringImpl::create): Move from .h, not commonly called, no need to inline.
+        (JSC::UStringImpl::sharedBuffer): Rewritten to more closely match WebCore implementation, remove need for separate baseSharedBuffer() method.
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::UStringImpl): Automatically hash static strings, ASSERT m_data & m_length are non-null/non-zero in non-static strings.
+        (JSC::UStringImpl::setHash): Add missing ASSERT.
+        (JSC::UStringImpl::create): Moved to .cpp / added missing check for empty string creation.
+        (JSC::UStringImpl::adopt): Vector.size() returns size_t, not unsigned.
+        (JSC::UStringImpl::cost): Renamed m_bufferSubstring -> m_substringBuffer
+        (JSC::UStringImpl::hash): Reordered in file.
+        (JSC::UStringImpl::existingHash): Reordered in file.
+        (JSC::UStringImpl::computeHash): Reordered in file, renamed parameter.
+        (JSC::UStringImpl::checkConsistency): rewrote ASSERT.
+        (JSC::UStringImpl::bufferOwnership): Return type should be BufferOwnership.
+        (JSC::UStringImpl::): Moved friends to head of class.
+
+2010-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
+
+        Default to using the appropriate SDK if the target Mac OS X version is not the current Mac OS X version.
+
+        * Configurations/Base.xcconfig:
+
+2010-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/7745082> Make it possible to build WebKit for older Mac OS X versions from the current Mac OS X version
+
+        Introduce TARGET_MAC_OS_X_VERSION_MAJOR to represent the Mac OS X version that is being targeted.  It defaults to the
+        current Mac OS X version unless otherwise specified.
+
+        Key off TARGET_MAC_OS_X_VERSION_MAJOR where we'd previously been keying off MAC_OS_X_VERSION_MAJOR.
+
+        Explicitly map from the target Mac OS X version to the preferred compiler since Xcode's default compiler choice
+        may not be usable when targetting a different Mac OS X version.
+
+        Key off TARGET_GCC_VERSION rather than MAC_OS_X_VERSION_MAJOR in locations where we'd previously been keying off
+        MAC_OS_X_VERSION_MAJOR but the decision is really related to the compiler version being used.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Sort the project file .
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-03-11  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Buildfix for Thumb-2 after r55684. Add branch8 and branchTest8 functions.
+        https://bugs.webkit.org/show_bug.cgi?id=35892
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::ldrb):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load8):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::setTest8):
+
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+        
+        Rename JSC::UStringImpl::data() to characters(), to match WebCore::StringImpl.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::processClauseList):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UString.cpp:
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::data):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::characters):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::setHash):
+
+2010-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler, Geoffrey Garen, Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35991
+        Would be faster to not use a thread specific to implement StringImpl::empty()
+
+        Change JSC::UStringImpl's implementation of empty() match to match StringImpl's new implementation
+        (use a static defined within the empty() method), and change the interface to match too (return
+        a pointer not a reference). 
+
+        ~0% performance impact (possible minor progression from moving empty() from .h to .cpp).
+
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, fixing Snow Leopard build.
+
+        * wtf/mac/MainThreadMac.mm: Forgot 'static' for a new local function.
+        (WTF::postTimer):
+
+2010-03-10  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make Document::postTask to use a single queue of tasks, to fire them in order
+        https://bugs.webkit.org/show_bug.cgi?id=35943
+
+        The patch uses CFRunLoopTimer to schedule execution of tasks instead of performSelectorOnMainThread which apparently can starve other event sources.
+        The timer is used when the schedule request is coming on the main thread itself. This happens when the task is posted on the main thread or
+        when too many tasks are posted and the queue does 'stop and re-schedule' to make sure run loop has a chance to execute other events.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::timerFired):
+        (WTF::postTimer):
+        (WTF::scheduleDispatchFunctionsOnMainThread): Use timer posted to the current RunLoop if scheduling the task execution while on the main thread.
+
+2010-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed old symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov, Darin Adler, and Sam Weinig.
+
+        Refactored fastCheckConsistency to match some review comments:
+            - renamed fastCheckConsistency to fastMallocSize, and changed ValueCheck
+              to ASSERT that a pointer's fastMallocSize is not 0.
+            - implemented a version of fastMallocSize for tcmalloc.
+            
+        Also moved some pre-existing code around to avoid a problem related to
+        mismatched #define/#undef of malloc/free in this source file.
+
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSize): Renamed. Fixed indentation.
+
+        (WTF::TCMalloc_PageHeap::scavenge): Removed an incorrect ASSERT that
+        got in the way of testing the tcmalloc implementation. (More information
+        on why this ASSERT is incorrect is in <rdar://problem/7165917>.)
+
+        (WTF::TCMallocStats::fastMallocSize): Implemented for tcmalloc.
+
+        * wtf/FastMalloc.h: Updated for rename.
+
+        * wtf/ValueCheck.h:
+        (WTF::): Moved the ASSERT that used to be in fastCheckConsistency here.
+
+2010-03-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Make global new/delete operators configurable for all ports and disable it
+        for the wx port for now.
+
+        * wtf/FastMalloc.h:
+        * wtf/Platform.h:
+
+2010-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting r54510).
+
+        This caused a performance regression, by breaking the code
+        generator's logic to calculate the skip level for resolving
+        variables (traced by rdar:7683350)  Reverting for now.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+
+2010-03-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed FastMalloc statistics reporting to be a bit clearer. We now
+        report:
+            - Reserved VM Bytes: the VM that has been mapped into the process.
+            - Committed VM Bytes: the subset of Reserved VM Bytes actually in use.
+            - Free List Bytes: the subset of Committed VM Bytes in a free list.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocStatistics):
+        (WTF::TCMallocStats::fastMallocStatistics): Updated to report the statistics
+        above. Standardized use of "ifdef WTF_CHANGES". Added a SpinLockHolder
+        around all statistics gathering, since it reads from the page heap.
+
+        * wtf/FastMalloc.h: Updated to report the statistics above. 
+
+2010-03-09  Gabor Loki  <loki@webkit.org>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Buildfix for ARM after r55684. Add branch8 and branchTest8 functions.
+        https://bugs.webkit.org/show_bug.cgi?id=35892
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load8):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branchTest8):
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: 'P' is not a type. Luckily, 'void' is.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastCheckConsistency):
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export a new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Switching malloc implementations requires a world rebuild
+        https://bugs.webkit.org/show_bug.cgi?id=35899
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastCheckConsistency):
+        (WTF::TCMallocStats::fastCheckConsistency):
+        * wtf/FastMalloc.h:
+        * wtf/ValueCheck.h:
+        (WTF::): Moved pointer checking into a helper function in FastMalloc.cpp,
+        so you can switch malloc implementations without rebuilding the world.
+
+2010-03-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        TypeInfo is unnecessarily large
+        https://bugs.webkit.org/show_bug.cgi?id=35850
+
+        Reduce the size of the type and flags members to a single
+        byte each, reducing the size of Structure by 8 bytes.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::setTest8):
+          Add single byte branches, and correct setTest8 to do a
+          single byte read from memory, and actually store the result
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpb_im):
+        (JSC::X86Assembler::testb_im):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_construct_verify):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::type):
+
+2010-03-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (reverting regression).
+
+        Reverting 55035, this caused a regression.
+        (https://bugs.webkit.org/show_bug.cgi?id=35843)
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+
+2010-03-08  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added a new USE definition for secure text mode on the Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=31265
+
+        * wtf/Platform.h:
+
+2010-03-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Blob.slice support.
+        https://bugs.webkit.org/show_bug.cgi?id=32993
+
+        Add ENABLE_BLOB_SLICE feature define.
+        Also fix a problem that JSValue.toInteger is not exposed on Windows.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-07  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Small performance fix in the QScriptConverter::toString().
+
+        The QByteArray was replaced by the QVarLengthArray which doesn't
+        have to allocate any memory on heap.
+
+        [Qt] QScriptConverter::toString() should use QVarLengthArray instead of QByteArray
+        https://bugs.webkit.org/show_bug.cgi?id=35577
+
+        * qt/api/qscriptconverter_p.h:
+        (QScriptConverter::toString):
+
+2010-03-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove unnecessary includes of wtf/Platform.h.  This is already pulled in by config.h.
+
+        * API/APICast.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBuffer.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/CodeLocation.h:
+        * assembler/LinkBuffer.h:
+        * assembler/MIPSAssembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/RepatchBuffer.h:
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITStubs.h:
+        * os-win32/stdint.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSImmediate.h:
+        * wtf/ASCIICType.h:
+        * wtf/StdLibExtras.h:
+        * wtf/VMTags.h:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.h:
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-03-06  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Share OwnPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=35776
+
+        Share OwnPtr implementation with BREW MP and remove OwnPtrBrew.
+
+        * wtf/OwnPtrBrew.cpp: Added.
+        (WTF::deleteOwnedPtr):
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.cpp: Removed.
+        * wtf/brew/OwnPtrBrew.h: Removed.
+
+2010-03-06  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Implemented JIT_OPTIMIZE_NATIVE_CALL for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33426
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+2010-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add enw exports to windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSC should cache int to Identifier conversion as it does for ordinary strings
+        https://bugs.webkit.org/show_bug.cgi?id=35814
+
+        Make the NumericStrings cache cache unsigned ints in addition to signed.
+        We keep them separate from the int cache as it both simplifies code, and
+        also because the unsigned path is exclusive to property access and therefore
+        seems to have different usage patterns.
+
+        The primary trigger for the unsigned to Identifier propertyName conversion
+        is the construction of array-like objects out of normal objects.  Given these
+        tend to be relative small numbers, and the array-like behaviour lends itself
+        to sequential values this patch also adds a non-colliding cache for all small
+        numbers.
+
+        * JavaScriptCore.exp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::from):
+        * runtime/Identifier.h:
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookup):
+        (JSC::NumericStrings::lookupSmallString):
+
+2010-03-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Allow static property getters to interact with JSCs caching
+        https://bugs.webkit.org/show_bug.cgi?id=35716
+
+        Add new opcodes for handling cached lookup of static value getters.
+        More or less the same as with JS getters, all that changes is that
+        instead of calling through a JSFunction we always know that we have
+        a C function to call.
+
+        For the patching routines in the JIT we now need to pass a few
+        new parameters to allow us to pass enough information to the stub
+        function to allow us to call the C function correctly.  Logically
+        this shouldn't actually be necessary as all of these functions ignore
+        the identifier, but removing the ident parameter would require
+        somewhat involved changes to the way we implement getOwnPropertySlot,
+        etc.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::):
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::cachedPropertyType):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setCacheableCustom):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        (JSC::PropertySlot::customGetter):
+
+2010-03-04  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. Remove a non-ASCII character introduced in the following bug.
+
+        put_by_id does will incorrectly cache writes where a specific value exists, where at the point of caching the same value is being written.
+        https://bugs.webkit.org/show_bug.cgi?id=35537
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2010-03-04  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Make the OUTPUT_DIR variable in qmake projects independent of build-webkit's logic.
+
+        This also allows shadow builds relying only on qmake to work properly.
+        * jsc.pro:
+        * qt/api/QtScript.pro:
+        * qt/tests/qscriptengine/qscriptengine.pro:
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/tests.pri:
+
+2010-03-03  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QScriptValue::isObject fix.
+
+        Fix broken internal state evaluation from JSValue to JSNative / JSObject.
+        New function was introduced which should take care about promoting
+        JSValue state inside QScriptValuePrivate. It should be used instead of a
+        direct JSC C API call.
+
+        The bug exposed a weakness in autotest suite, as the QScriptValuePrivate
+        is based on state machine with lazy state evaluation, there is a possibility
+        that serial sequencial calls to the same public const function could return
+        different results. The patch fix the issue.
+
+        [Qt] Sometimes QScriptValue::isObject returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=35387
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::refineJSValue):
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-03-03  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MIPS JIT Supports
+        https://bugs.webkit.org/show_bug.cgi?id=30144
+
+        The following changes enable MIPS YARR and YARR_JIT.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MIPSAssembler.h: Added.
+        (JSC::MIPSRegisters::):
+        (JSC::MIPSAssembler::MIPSAssembler):
+        (JSC::MIPSAssembler::):
+        (JSC::MIPSAssembler::JmpSrc::JmpSrc):
+        (JSC::MIPSAssembler::JmpDst::JmpDst):
+        (JSC::MIPSAssembler::JmpDst::isUsed):
+        (JSC::MIPSAssembler::JmpDst::used):
+        (JSC::MIPSAssembler::emitInst):
+        (JSC::MIPSAssembler::nop):
+        (JSC::MIPSAssembler::loadDelayNop):
+        (JSC::MIPSAssembler::copDelayNop):
+        (JSC::MIPSAssembler::move):
+        (JSC::MIPSAssembler::li):
+        (JSC::MIPSAssembler::lui):
+        (JSC::MIPSAssembler::addiu):
+        (JSC::MIPSAssembler::addu):
+        (JSC::MIPSAssembler::subu):
+        (JSC::MIPSAssembler::mult):
+        (JSC::MIPSAssembler::mfhi):
+        (JSC::MIPSAssembler::mflo):
+        (JSC::MIPSAssembler::mul):
+        (JSC::MIPSAssembler::andInsn):
+        (JSC::MIPSAssembler::andi):
+        (JSC::MIPSAssembler::nor):
+        (JSC::MIPSAssembler::orInsn):
+        (JSC::MIPSAssembler::ori):
+        (JSC::MIPSAssembler::xorInsn):
+        (JSC::MIPSAssembler::xori):
+        (JSC::MIPSAssembler::slt):
+        (JSC::MIPSAssembler::sltu):
+        (JSC::MIPSAssembler::sltiu):
+        (JSC::MIPSAssembler::sll):
+        (JSC::MIPSAssembler::sllv):
+        (JSC::MIPSAssembler::sra):
+        (JSC::MIPSAssembler::srav):
+        (JSC::MIPSAssembler::lw):
+        (JSC::MIPSAssembler::lwl):
+        (JSC::MIPSAssembler::lwr):
+        (JSC::MIPSAssembler::lhu):
+        (JSC::MIPSAssembler::sw):
+        (JSC::MIPSAssembler::jr):
+        (JSC::MIPSAssembler::jalr):
+        (JSC::MIPSAssembler::jal):
+        (JSC::MIPSAssembler::bkpt):
+        (JSC::MIPSAssembler::bgez):
+        (JSC::MIPSAssembler::bltz):
+        (JSC::MIPSAssembler::beq):
+        (JSC::MIPSAssembler::bne):
+        (JSC::MIPSAssembler::bc1t):
+        (JSC::MIPSAssembler::bc1f):
+        (JSC::MIPSAssembler::newJmpSrc):
+        (JSC::MIPSAssembler::appendJump):
+        (JSC::MIPSAssembler::addd):
+        (JSC::MIPSAssembler::subd):
+        (JSC::MIPSAssembler::muld):
+        (JSC::MIPSAssembler::lwc1):
+        (JSC::MIPSAssembler::ldc1):
+        (JSC::MIPSAssembler::swc1):
+        (JSC::MIPSAssembler::sdc1):
+        (JSC::MIPSAssembler::mtc1):
+        (JSC::MIPSAssembler::mfc1):
+        (JSC::MIPSAssembler::truncwd):
+        (JSC::MIPSAssembler::cvtdw):
+        (JSC::MIPSAssembler::ceqd):
+        (JSC::MIPSAssembler::cngtd):
+        (JSC::MIPSAssembler::cnged):
+        (JSC::MIPSAssembler::cltd):
+        (JSC::MIPSAssembler::cled):
+        (JSC::MIPSAssembler::cueqd):
+        (JSC::MIPSAssembler::coled):
+        (JSC::MIPSAssembler::coltd):
+        (JSC::MIPSAssembler::culed):
+        (JSC::MIPSAssembler::cultd):
+        (JSC::MIPSAssembler::label):
+        (JSC::MIPSAssembler::align):
+        (JSC::MIPSAssembler::getRelocatedAddress):
+        (JSC::MIPSAssembler::getDifferenceBetweenLabels):
+        (JSC::MIPSAssembler::size):
+        (JSC::MIPSAssembler::executableCopy):
+        (JSC::MIPSAssembler::getCallReturnOffset):
+        (JSC::MIPSAssembler::linkJump):
+        (JSC::MIPSAssembler::linkCall):
+        (JSC::MIPSAssembler::linkPointer):
+        (JSC::MIPSAssembler::relinkJump):
+        (JSC::MIPSAssembler::relinkCall):
+        (JSC::MIPSAssembler::repatchInt32):
+        (JSC::MIPSAssembler::repatchPointer):
+        (JSC::MIPSAssembler::repatchLoadPtrToLEA):
+        (JSC::MIPSAssembler::relocateJumps):
+        (JSC::MIPSAssembler::linkWithOffset):
+        (JSC::MIPSAssembler::linkCallInternal):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerMIPS.h: Added.
+        (JSC::MacroAssemblerMIPS::MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::):
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::not32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::rshift32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::xor32):
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::loadPtrWithPatchToLEA):
+        (JSC::MacroAssemblerMIPS::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::load16):
+        (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPoint):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerMIPS::pop):
+        (JSC::MacroAssemblerMIPS::push):
+        (JSC::MacroAssemblerMIPS::move):
+        (JSC::MacroAssemblerMIPS::swap):
+        (JSC::MacroAssemblerMIPS::signExtend32ToPtr):
+        (JSC::MacroAssemblerMIPS::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::branch16):
+        (JSC::MacroAssemblerMIPS::branchTest32):
+        (JSC::MacroAssemblerMIPS::jump):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+        (JSC::MacroAssemblerMIPS::breakpoint):
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::ret):
+        (JSC::MacroAssemblerMIPS::set32):
+        (JSC::MacroAssemblerMIPS::setTest32):
+        (JSC::MacroAssemblerMIPS::moveWithPatch):
+        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
+        (JSC::MacroAssemblerMIPS::tailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::makeTailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        (JSC::MacroAssemblerMIPS::addDouble):
+        (JSC::MacroAssemblerMIPS::subDouble):
+        (JSC::MacroAssemblerMIPS::mulDouble):
+        (JSC::MacroAssemblerMIPS::convertInt32ToDouble):
+        (JSC::MacroAssemblerMIPS::insertRelaxationWords):
+        (JSC::MacroAssemblerMIPS::branchTrue):
+        (JSC::MacroAssemblerMIPS::branchFalse):
+        (JSC::MacroAssemblerMIPS::branchEqual):
+        (JSC::MacroAssemblerMIPS::branchNotEqual):
+        (JSC::MacroAssemblerMIPS::branchDouble):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerMIPS::linkCall):
+        (JSC::MacroAssemblerMIPS::repatchCall):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2010-03-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add virtual memory tags for TCMalloc and WebCore's purgeable buffers.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap): Use the VM tag.
+        * wtf/VMTags.h: Make use of VM_MEMORY_TCMALLOC and VM_MEMORY_WEBCORE_PURGEABLE_BUFFERS.
+
+2010-03-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Adam Roben.
+
+        Fix bogus xcopy that was polluting source tree at build time.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2010-03-02  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Oliver Hunt.
+
+        Allow building smoothly on win32 and win64 using GCC
+        https://bugs.webkit.org/show_bug.cgi?id=35607
+
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+
+2010-03-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        Revert database thread changes that are no longer required
+        https://bugs.webkit.org/show_bug.cgi?id=35519
+
+        Jochen Eisinger created 55214 and 55247 to track which database
+        owns which thread.  Dmitry suggested that this could also
+        be done via TLS, though.  After exploring the options, Jochen
+        chose to go the TLS route, so these patches are no longer needed.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::createThreadInternal):
+
+2010-03-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toString().
+
+        More ECMA Script compliance, especially for values as NaN, Inifinite
+        and really big/small numbers.
+
+        [Qt] QScriptValue::toString() returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=34850
+
+        * qt/api/qscriptconverter_p.h:
+        (QScriptConverter::toString):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toString):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toString_initData):
+        (tst_QScriptValue::toString_makeData):
+        (tst_QScriptValue::toString_test):
+
+2010-03-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Introduce a new class; QScriptString.
+
+        The QScriptString class should act as a handle to "interned"
+        strings in a QScriptEngine.
+
+        [Qt] QtScript should provide QScriptString
+        https://bugs.webkit.org/show_bug.cgi?id=34843
+
+        * qt/api/QtScript.pro:
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::toStringHandle):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::toStringHandle):
+        * qt/api/qscriptstring.cpp: Added.
+        (QScriptString::QScriptString):
+        (QScriptString::~QScriptString):
+        (QScriptString::operator=):
+        (QScriptString::isValid):
+        (QScriptString::operator==):
+        (QScriptString::operator!=):
+        (QScriptString::toArrayIndex):
+        (QScriptString::toString):
+        (QScriptString::operator QString):
+        (qHash):
+        * qt/api/qscriptstring.h: Added.
+        * qt/api/qscriptstring_p.h: Added.
+        (QScriptStringPrivate::QScriptStringPrivate):
+        (QScriptStringPrivate::~QScriptStringPrivate):
+        (QScriptStringPrivate::get):
+        (QScriptStringPrivate::isValid):
+        (QScriptStringPrivate::operator==):
+        (QScriptStringPrivate::operator!=):
+        (QScriptStringPrivate::toArrayIndex):
+        (QScriptStringPrivate::toString):
+        (QScriptStringPrivate::id):
+        * qt/tests/qscriptstring/qscriptstring.pro: Added.
+        * qt/tests/qscriptstring/tst_qscriptstring.cpp: Added.
+        (tst_QScriptString::tst_QScriptString):
+        (tst_QScriptString::~tst_QScriptString):
+        (tst_QScriptString::test):
+        (tst_QScriptString::hash):
+        (tst_QScriptString::toArrayIndex_data):
+        (tst_QScriptString::toArrayIndex):
+        * qt/tests/tests.pro:
+
+2010-03-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Export function on windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Refactor named getter function signature to be in line with indexing getter signature
+        https://bugs.webkit.org/show_bug.cgi?id=35563
+
+        This removes the PropertySlot argument from getter functions, and makes them directly
+        pass the slot base.  This makes the semantics for the functions match that of the
+        indexing getters.
+
+        On the down side, this means that we can no longer simply use a proxy function for
+        JS getters, so we now add another marker value to indicate that a getter is present
+        and branch accordingly.
+
+        Against all rationality sunspider reports this as a perf win, but i suspect it's just noise.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * JavaScriptCore.exp:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        * runtime/JSFunction.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+
+2010-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        PropertySlot::getValue(ExecState, unsigned) unnecessarily converts index to an Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=35561
+
+        Fix this by defining a separate property getter function for index getters.  This allows
+        us to pass an unsigned number without the conversion to an Identifier.  We then update
+        setCustomIndex to take this new getter type.
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+
+2010-03-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 35537 - put_by_id does will incorrectly cache writes where a specific value exists,
+                    where at the point of caching the same value is being written.
+
+        When performing a put_by_id that is replacing a property already present on the object,
+        there are three interesting cases regarding the state of the specific value:
+
+        (1) No specific value set - nothing to do, leave the structure in it's current state,
+            can cache.
+        (2) A specific value was set, the new put is not of a specified value (i.e. function),
+            or is of a different specific value - in these cases we need to perform a despecifying
+            transition to clear the specific value in the structure, but having done so this is a
+            normal property so as such we can again cache normally.
+        (3) A specific value was set, and we are overwriting with the same value - in these cases
+            leave the structure unchanged, but since a specific value is set we cannot cache this
+            put (we would need the JIT to dynamically check the value being written matched).
+
+        Unfortunately, the current behaviour does not match this.  the checks for a specific value
+        being present & the value matching are combined in such a way that in case (2), above we
+        will unnecessarily prevent the transition being cached, but in case (3) we will incorrectly
+        fail to prevent caching.
+
+        The bug exposes itself if multiple puts of the same specific value are performed to a
+        property, and erroneously the put is allowed to be cached by the JIT.  Method checks may be
+        generated caching calls of this structure.  Subsequent puts performed from JIT code may
+        write different values without triggering a despecify transition, and as such cached method
+        checks will continue to pass, despite the value having changed.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2010-03-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build on Mac OS X/Cocoa 64-bit
+
+        * JavaScriptCore.pri: Add missing implementation file to resolve JSC symbols
+
+2010-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Remove wrec.  All builds should have switched to yarr by now.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wrec: Removed.
+        * wrec/CharacterClass.cpp: Removed.
+        * wrec/CharacterClass.h: Removed.
+        * wrec/CharacterClassConstructor.cpp: Removed.
+        * wrec/CharacterClassConstructor.h: Removed.
+        * wrec/Escapes.h: Removed.
+        * wrec/Quantifier.h: Removed.
+        * wrec/WREC.cpp: Removed.
+        * wrec/WREC.h: Removed.
+        * wrec/WRECFunctors.cpp: Removed.
+        * wrec/WRECFunctors.h: Removed.
+        * wrec/WRECGenerator.cpp: Removed.
+        * wrec/WRECGenerator.h: Removed.
+        * wrec/WRECParser.cpp: Removed.
+        * wrec/WRECParser.h: Removed.
+        * wscript:
+
+2010-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make the lookup table generator include an explicit cast to expected
+        type of the function.  We do this because otherwise the blind intptr_t
+        cast that is subsequently applied allows incorrectly typed functions
+        to be inserted into the table, where they will only fail at runtime.
+        This change makes such errors produce a compile time failure.
+
+        * create_hash_table:
+
+2010-02-26  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian specific getCPUTime implemetation
+        https://bugs.webkit.org/show_bug.cgi?id=34742
+
+        Default implementation doesn't work on Symbian devices.
+        This change adds a proper implementation by
+        asking thread execution time from the current thread.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-02-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35406
+        <rdar://problem/6945502> Make generic array methods work with JavaArray
+
+        Renamed lazyCreationData to subclassData. This is extra data that can be used by JSArray
+        subclasses (you can't add new data members, because it wouldn't fit in JSCell otherwise).
+
+        * JavaScriptCore.exp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        * runtime/JSArray.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::~RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+
+2010-02-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSC crashes like crazy in the JSPropertyNameIterator destructor
+
+        Add back null check of m_cachedStructure.  Curse last minute changes.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+
+2010-02-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Race condition in JSPropertyNameIterator and Structure destruction
+        https://bugs.webkit.org/show_bug.cgi?id=35398
+
+        JSPropertyNameIterator and Structure have a cyclic dependency that they
+        manage by clearing the appropriate reference in each other during their
+        destruction.  However if the Structure is destroyed while the 
+        JSPropertyNameIterator is dead but not yet finalized the Structures
+        WeakGCPtr will return null, and so prevent Structure from clearing
+        the m_cachedStructure pointer of the iterator.  When the iterator is
+        then finalised the m_cachedStructure is invalid, and the attempt to
+        clear the structures back reference fails.
+
+        To fix this we simply make JSPropertyNameIterator keep the Structure
+        alive, using the weak pointer to break the ref cycle.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+          The iterator now keeps m_cachedStructure alive itself, so no longer needs
+          to check for it being cleared
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+          Add an assertion to ensure correct usage
+        (JSC::JSPropertyNameIterator::cachedStructure):
+          Add .get()
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+          Add an assertion that our iterator isn't already dead, and remove
+          the now unnecessary attempt to clear the ref in the iterator
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::hasDeadObject):
+          An assert-only function to allow us to assert correct behaviour
+          in the Structure destructor
+
+2010-02-25  Jochen Eisinger  <jochen@chromium.org>
+ 
+        Reviewed by Jeremy Orlow.
+ 
+        Make the context that was passed to the ThreadFunction accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=35379
+
+        When a database is opened, right now you
+        don't have any context from where it is opened. The problem is that
+        the actual calls that open a database go through the sqlite3 vfs
+        layer, so there's no easy way to pass this function down to to
+        platform/sql/chromium/SQLFileSystemChromium*.cpp
+
+        This patch will allow you to get from anywhere within webkit a pointer
+        to the Thread object that actually created the thread you're currently
+        on (in case of the database, this can be either a thread forked of
+        from the main thread or from a worker thread), and query the object
+        for context information.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::threadContext):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        (WTF::threadContext):
+        * wtf/ThreadingWin.cpp:
+        (WTF::):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::threadContext):
+
+2010-02-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reverting to re-submit with better change log.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::createThreadInternal):
+
+2010-02-25  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Make the context that was passed to the ThreadFunction accessible.
+        https://bugs.webkit.org/show_bug.cgi?id=35379
+
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        (WTF::threadContext):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+        (WTF::threadContext):
+        * wtf/ThreadingWin.cpp:
+        (WTF::):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::contextForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::threadContext):
+
+2010-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [REGRESSION in r55185] EXC_BAD_ACCESS on opening inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=35335
+
+        compileGetDirectOffset modifies the contents of the object register
+        when the object is not using the inline storage array.  As the object
+        register contains our 'this' pointer we can't allow it to be clobbered.
+        The fix is simply to copy the register into a separate scratch register
+        when we're loading off an object that doesn't use inline storage.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+
+2010-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Speed up getter performance in the jit
+        https://bugs.webkit.org/show_bug.cgi?id=35332
+
+        Implement getter lookup caching in the interpreter.
+        The getter stubs are generated through basically the
+        same code paths as the normal get_by_id caching.
+        Instead of simply loading a property and returning,
+        we load the getter slot, and pass the getter, base value
+        and return address to a shared stub used for getter
+        dispatch.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/GetterSetter.h:
+
+2010-02-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Web Inspector: Regression: r55027+: Inspector broken
+        https://bugs.webkit.org/show_bug.cgi?id=35253
+
+        op_get_by_id_getter_chain was not passing the correct this parameter.
+        The bug was caused by incorrect use of baseCell instead of baseValue,
+        baseValue contains the original object for the lookup (and hence the
+        correct this object), baseCell is clobbered as part of walking the
+        prototype chain.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-02-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Dimitri Glazkov.
+
+        Chromium build fix.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Changes references of GOwnPtr to reflect their new place.
+        http://webkit.org/b/35084
+
+        * JavaScriptCore/JavaScriptCore.gypi:
+        * JavaScriptCore/wtf/Threading.h:
+        * JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h:
+
+2010-02-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Adding the EFL implementation of JavaScriptCore.
+        See https://bugs.webkit.org/show_bug.cgi?id=35084 for details.
+
+        * GNUmakefile.am: Updated to reflect the new location of GOwnPtr and
+                          GRefPtr.
+        * wtf/efl/MainThreadEfl.cpp: Added.
+        * wtf/gobject/GOwnPtr.cpp: Moved from wtf/gtk.
+        * wtf/gobject/GOwnPtr.h: Moved from wtf/gtk.
+        * wtf/gobject/GRefPtr.cpp: Moved from wtf/gtk.
+        * wtf/gobject/GRefPtr.h: Moved from wtf/gtk.
+
+2010-02-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove auto_ptr usage in JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=35221
+
+        * parser/Nodes.h: Removed now unneeded adopt method.
+        * parser/Parser.cpp: Removed <memory> include as it is not required anymore.
+        * wtf/OwnPtr.h: Removed the constructor from auto_ptr.
+        * wtf/VectorTraits.h: Removed a template specialization for auto_ptr.
+        * wtf/unicode/Collator.h: Made userDefault return a PassOwnPtr.
+        * wtf/unicode/CollatorDefault.cpp:
+        (WTF::Collator::userDefault): Changed the method to match the next signature.
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault): Ditto.
+
+2010-02-22  Huahui Wu  <hwu@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add code that enables SquirrelFish Extreme (a.k.a JSCX, JSC JIT)
+        in Android. It's disabled by default, but is enabled when the 
+        enveronment variable ENABLE_JSC_JIT is set to true.
+        https://bugs.webkit.org/show_bug.cgi?id=34855
+
+        * Android.mk:
+        * wtf/Platform.h:
+
+2010-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSStringBuilder should not CRASH if allocation fails, it should throw a JSException.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::JSStringBuilder):
+        (JSC::JSStringBuilder::append):
+        (JSC::JSStringBuilder::build):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::tryAllocateBuffer):
+        (WTF::):
+        (WTF::VectorBuffer::tryAllocateBuffer):
+        (WTF::::tryExpandCapacity):
+        (WTF::::tryReserveCapacity):
+        (WTF::::tryAppend):
+
+2010-02-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Map FastMalloc to BREW memory allocator
+        https://bugs.webkit.org/show_bug.cgi?id=33570
+
+        Use MALLOC macro instead of the standard malloc function.
+        Although RVCT provides malloc, we can't use it in BREW
+        because the loader does not initialize the base address properly.
+
+        * wtf/FastMalloc.cpp:
+        * wtf/brew/SystemMallocBrew.h: Added.
+        (mallocBrew):
+        (callocBrew):
+        (freeBrew):
+        (reallocBrew):
+
+2010-02-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-02-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Build fix for RVCT.
+
+        Fix after r55024. The "-i" option is for perl not for the
+        script.
+
+        * DerivedSources.pro:
+
+2010-02-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make UString::m_data be const, and make the UChar owned/ref-counted by CrossThreadRefCounted be const too.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::UStringImpl):
+        * wtf/OwnFastMallocPtr.h:
+        (WTF::OwnFastMallocPtr::~OwnFastMallocPtr):
+
+2010-02-21  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HashMapTranslatorAdapter::translate() needs to set the mapped value.
+
+        HTTPHeaderMap::add(const char*, const String&) does not work
+        https://bugs.webkit.org/show_bug.cgi?id=35227
+
+        * wtf/HashMap.h:
+        (WTF::HashMapTranslatorAdapter::translate):
+
+2010-02-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by David Levin.
+
+        Add an ENABLE flag for sandboxed iframes to make it possible to disable it in releases
+        https://bugs.webkit.org/show_bug.cgi?id=35147
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSString::getIndex() calls value() to resolve the string value (is a rope)
+        to a UString, then passes the result to jsSingleCharacterSubstring without
+        checking for an exception.  In case of out-of-memory the returned UString
+        is null(), which may result in an out-of-buounds substring being created.
+        This is bad.
+
+        Simple fix is to be able to get an index from a rope without resolving to
+        UString.  This may be a useful optimization in some test cases.
+
+        The same bug exists in some other methods is JSString, these can be fixed
+        by changing them to call getIndex().
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterString):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/UStringImpl.cpp:
+        (JSC::singleCharacterSubstring):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::singleCharacterSubstring):
+
+2010-02-19  Oliver Hunt  <oliver@apple.com>
+
+        RS = Gavin Barraclough.
+
+        Split the 32/64 version of JITPropertyAccess into a separate file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp: Added.
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+
+2010-02-19  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Added additional parameter to create_rvct_stubs 
+        for setting the regularexpression prefix.
+        Renamed it because it now works for other platforms too.
+        https://bugs.webkit.org/show_bug.cgi?id=34951
+
+        * DerivedSources.pro:
+        * create_jit_stubs: Copied from JavaScriptCore/create_rvct_stubs.
+        * create_rvct_stubs: Removed.
+
+2010-02-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve interpreter getter performance
+        https://bugs.webkit.org/show_bug.cgi?id=35138
+
+        Improve the performance of getter dispatch by making it possible
+        for the interpreter to cache the GetterSetter object lookup.
+
+        To do this we simply need to make PropertySlot aware of getters
+        as a potentially cacheable property, and record the base and this
+        objects for a getter access.  This allows us to use more-or-less
+        identical code to that used by the normal get_by_id caching, with
+        the dispatch being the only actual difference.
+
+        I'm holding off of implementing this in the JIT until I do some
+        cleanup to try and making coding in the JIT not be as horrible
+        as it is currently.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isGetter):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        (JSC::PropertySlot::thisValue):
+
+2010-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a portion of:
+        <rdar://problem/7165917> | https://bugs.webkit.org/show_bug.cgi?id=28676
+        Safari 4 does not release memory back to the operating system fast enough (28676)
+        
+        This patch fixes a surprisingly common edge case in which the page heap
+        would have only one free span, but that span would be larger than the
+        minimum free size, so we would decide not to free it, even though it
+        could be as large as 100MB or more!
+        
+        SunSpider reports no change on Mac or Windows.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge): Call shouldContinueScavenging() instead
+        of doing the math ourselves. Don't keep a local value for pagesDecommitted
+        because that lets free_committed_pages_ be wrong temporarily. Instead,
+        update free_committed_pages_ as we go. ASSERT that we aren't releasing
+        a span that has already been released, because we think this is impossible.
+        Finally, don't be afraid to release all free memory in the page heap when
+        scavenging. We only scavenge after 5 seconds of the application's working
+        set not growing, and we keep both thread caches and a central cache on
+        top of the page heap, so the extra free pages in the page heap were just
+        overkill.
+
+2010-02-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35070
+        Addition of 2 strings of length 2^31 may result in a string of length 0.
+
+        Check for overflow when creating a new JSString as a result of an addition
+        or concatenation, throw an out of memory exception.
+
+        * runtime/JSString.h:
+        (JSC::):
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2010-02-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Linux] Webkit incompatible with Java plugins
+        https://bugs.webkit.org/show_bug.cgi?id=24912
+
+        Add support for GFile to GOwnPtr.
+
+        Based on original work by Gustavo Noronha.
+
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GFile):
+        * wtf/gtk/GOwnPtr.h:
+
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix a handful of other leaks seen on the buildbot.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::deref): Delegate through to the subclass version of deref to ensure that
+        the correct cleanup takes place.  This function previously featured some code that attempted to
+        skip deletion of static UStringImpl's.  Closer inspection revealed that it was in fact equivalent
+        to "if (false)", meaning that UStringImpl's which had their final deref performed via this function
+        were leaked.
+
+2010-02-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a handful of leaks seen on the buildbot.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::deref): Call URopeImpl::destructNonRecursive rather than delete
+        to ensure that the rope's fibers are also destroyed.
+
+2010-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34964
+        Leaks tool reports false memory leaks due to Rope implementation.
+
+        A rope is a recursive data structure where each node in the rope holds a set of
+        pointers, each of which may reference either a string (in UStringImpl form) or
+        another rope node.  A low bit in each pointer is used to distinguish between
+        rope & string elements, in a fashion similar to the recently-removed
+        PtrAndFlags class (see https://bugs.webkit.org/show_bug.cgi?id=33731 ).  Again,
+        this causes a problem for Leaks - refactor to remove the magic pointer
+        mangling.
+
+        Move Rope out from JSString.h and rename to URopeImpl, to match UStringImpl.
+        Give UStringImpl and URopeImpl a common parent class, UStringOrRopeImpl.
+        Repurpose an otherwise invalid permutation to flags (static & should report
+        memory cost) to identify ropes.
+
+        This allows us to change the rope's fibers to interrogate the object rather
+        than storing a bool within the low bits of the pointer (or in some cases the
+        use of a common parent class removes the need to determine the type at all -
+        there is a common interface to ref or get the length of either ropes or strings).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::JSStringFinalizerStruct):
+        (JSC::RopeBuilder::JSStringFinalizerStruct::):
+        * runtime/UString.cpp:
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::size):
+        * runtime/UStringImpl.cpp:
+        (JSC::URopeImpl::derefFibersNonRecursive):
+        (JSC::URopeImpl::destructNonRecursive):
+        * runtime/UStringImpl.h:
+        (JSC::UStringOrRopeImpl::isRope):
+        (JSC::UStringOrRopeImpl::length):
+        (JSC::UStringOrRopeImpl::ref):
+        (JSC::UStringOrRopeImpl::):
+        (JSC::UStringOrRopeImpl::operator new):
+        (JSC::UStringOrRopeImpl::UStringOrRopeImpl):
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::):
+        (JSC::URopeImpl::tryCreateUninitialized):
+        (JSC::URopeImpl::initializeFiber):
+        (JSC::URopeImpl::fiberCount):
+        (JSC::URopeImpl::fibers):
+        (JSC::URopeImpl::deref):
+        (JSC::URopeImpl::URopeImpl):
+        (JSC::URopeImpl::hasOneRef):
+        (JSC::UStringOrRopeImpl::deref):
+
+2010-02-15  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the SP at ctiOpThrowNotCaught on Thumb2 (JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=34939
+
+        * jit/JITStubs.cpp:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix!).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Some general Rope related refactoring.
+
+        Rename Rope::m_ropeLength to m_fiberCount, to be more descriptive.
+        Rename Rope::m_stringLength to simply m_length (since this is the
+        more conventional name for the length of a string).  Move append
+        behaviour out into a new RopeBuilder class, so that Rope no longer
+        needs any knowledge of the JSString or UString implementation.
+
+        Make Rope no longer be nested within JSString.
+        (Rope now no-longer need reside within JSString.h, but leaving
+        the change of moving this out to a different header as a separate
+        change from these renames).
+
+        * JavaScriptCore.exp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * runtime/JSString.cpp:
+        (JSC::Rope::destructNonRecursive):
+        (JSC::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::Rope::Fiber::Fiber):
+        (JSC::Rope::Fiber::deref):
+        (JSC::Rope::Fiber::ref):
+        (JSC::Rope::Fiber::refAndGetLength):
+        (JSC::Rope::Fiber::isRope):
+        (JSC::Rope::Fiber::rope):
+        (JSC::Rope::Fiber::isString):
+        (JSC::Rope::Fiber::string):
+        (JSC::Rope::Fiber::nonFiber):
+        (JSC::Rope::tryCreateUninitialized):
+        (JSC::Rope::append):
+        (JSC::Rope::fiberCount):
+        (JSC::Rope::length):
+        (JSC::Rope::fibers):
+        (JSC::Rope::Rope):
+        (JSC::Rope::operator new):
+        (JSC::):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::length):
+        (JSC::RopeBuilder::canGetIndex):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::isRope):
+        (JSC::RopeBuilder::fiberCount):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add missing cast for !YARR (PPC) builds.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-02-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
+
+        StructureTransitionTable was effectively a smart pointer type,
+        one machine word in size and wholly contained as a member of
+        of Structure.  It either pointed to an actual table, or could
+        be used to describe a single transtion entry without use of a
+        table.
+
+        This, however, worked by using a PtrAndFlags, which is not
+        compatible with the leaks tool.  Since there is no clear way to
+        obtain another bit for 'free' here, and since there are bits
+        available up in Structure, merge this functionality back up into
+        Structure.  Having this in a separate class was quite clean
+        from an enacapsulation perspective, but this solution doesn't
+        seem to bad - all table access is now intermediated through the
+        Structure::structureTransitionTableFoo methods, keeping the
+        optimization fairly well contained.
+
+        This was the last use of PtrAndFlags, so removing the file too.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::):
+        (JSC::Structure::structureTransitionTableContains):
+        (JSC::Structure::structureTransitionTableGet):
+        (JSC::Structure::structureTransitionTableHasTransition):
+        (JSC::Structure::structureTransitionTableRemove):
+        (JSC::Structure::structureTransitionTableAdd):
+        (JSC::Structure::structureTransitionTable):
+        (JSC::Structure::setStructureTransitionTable):
+        (JSC::Structure::singleTransition):
+        (JSC::Structure::setSingleTransition):
+        * runtime/StructureTransitionTable.h:
+        * wtf/PtrAndFlags.h: Removed.
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Bug 34948 - tryMakeString should fail on error in length calculation
+
+        Ooops! - "bool overflow" argument should have been "bool& overflow".
+
+        * runtime/UString.h:
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix (pt 2!)).
+
+        Some symbol names have changed, remove, will readd if required.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Build Fix (pt 1?)).
+
+        Some symbol names have changed, remove, will readd if required.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some mistaken code added in http://trac.webkit.org/changeset/53860.
+
+        * API/APIShims.h:
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim): No need to start/stop the
+        timeout checker when calling out from the API to the client; we want to
+        monitor the VM for timeouts, not the client. This mistake was harmless /
+        undetectable, since it's totally redundant with the APIEntryShim, which
+        also starts / stops the timeout checker.
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 34952 - String lengths in UString should be unsigned.
+        This matches WebCore::StringImpl, and better unifies behaviour throughout JSC.
+
+        * JavaScriptCore.exp:
+        * bytecode/EvalCodeCache.h:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        * runtime/Identifier.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEscape):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::indent):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSplit):
+        (JSC::trimString):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::getCString):
+        (JSC::UString::ascii):
+        (JSC::UString::operator[]):
+        (JSC::UString::toStrictUInt32):
+        (JSC::UString::find):
+        (JSC::UString::rfind):
+        (JSC::UString::substr):
+        (JSC::operator<):
+        (JSC::operator>):
+        (JSC::compare):
+        (JSC::equal):
+        (JSC::UString::UTF8String):
+        * runtime/UString.h:
+        (JSC::UString::size):
+        (JSC::operator==):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::UStringImpl):
+
+2010-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 34948 - tryMakeString should fail on error in length calculation
+
+        The sum of the length of substrings could overflow.
+
+        * runtime/UString.h:
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+
+2010-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7628524> Crash beneath JSGlobalContextRelease when
+        typing in Google search field with GuardMalloc/full page heap enabled
+
+        * API/JSContextRef.cpp: Don't use APIEntryShim, since that requires
+        a JSGlobalData, which this function destroys. Do use setCurrentIdentifierTable
+        and JSLock instead, since those are the two features of APIEntryShim we
+        require.
+
+2010-02-15  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Laszlo Gombos.
+
+        Added additional parameter to create_rvct_stubs 
+        for setting the offset of thunkReturnAddress.
+        https://bugs.webkit.org/show_bug.cgi?id=34657
+
+        * create_rvct_stubs:
+        * jit/JITStubs.cpp:
+
+2010-02-15  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toIntXX methods.
+
+        More ECMA Script compliance.
+
+        [Qt] QScriptValue::toIntXX returns incorrect values
+        https://bugs.webkit.org/show_bug.cgi?id=34847
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toInteger_initData):
+        (tst_QScriptValue::toInteger_makeData):
+        (tst_QScriptValue::toInteger_test):
+        (tst_QScriptValue::toInt32_initData):
+        (tst_QScriptValue::toInt32_makeData):
+        (tst_QScriptValue::toInt32_test):
+        (tst_QScriptValue::toUInt32_initData):
+        (tst_QScriptValue::toUInt32_makeData):
+        (tst_QScriptValue::toUInt32_test):
+        (tst_QScriptValue::toUInt16_initData):
+        (tst_QScriptValue::toUInt16_makeData):
+        (tst_QScriptValue::toUInt16_test):
+
+2010-02-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        Implement NEVER_INLINE and NO_RETURN for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=34740
+
+        * wtf/AlwaysInline.h:
+
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
+
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
+
+2010-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Many false leaks in release builds due to PtrAndFlags
+
+        Remove UntypedPtrAndBitfield (similar to PtrAndFlags) in UStringImpl,
+        and steal bits from the refCount instead.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        (JSC::UStringImpl::):
+
+2010-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed an unnecessary data dependency from my last patch.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Since isAnyStringMarked being false
+        is a condition of entering the loop, we can just use '=' instead of '|='.
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Additional refptr/passrefptr workarounds for WINSCW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::PassRefPtr::PassRefPtr):
+        (WTF::PassRefPtr::~PassRefPtr):
+        (WTF::PassRefPtr::clear):
+        (WTF::::operator):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::::operator):
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Additional refptr/passrefptr workarounds for WINSCW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::PassRefPtr::PassRefPtr):
+        (WTF::PassRefPtr::~PassRefPtr):
+        (WTF::PassRefPtr::clear):
+        (WTF::::operator):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::::operator):
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Additional refptr/passrefptr workarounds for WINSCW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::PassRefPtr::PassRefPtr):
+        (WTF::PassRefPtr::~PassRefPtr):
+        (WTF::PassRefPtr::clear):
+        (WTF::::operator):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::::operator):
+
+2010-02-12  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Don't import the cmath functions from std:: for WINSCW.
+
+        * wtf/MathExtras.h:
+
+2010-02-12  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Typedef both JSChar and UChar to wchar_t in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=34560
+
+        Define both JSChar and UChar to wchar_t as the size
+        of wchar_t is 2 bytes in RVCT.
+
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Darin Adler.
+
+        The rest of the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        Don't unconditionally hang onto small strings. Instead, hang onto all
+        small strings as long as any small string is still referenced.
+        
+        SunSpider reports no change.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markRoots): Mark the small strings cache last, so it can
+        check if anything else has kept any strings alive.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren): Only keep our strings alive if some
+        other reference to at least one of them exists, too.
+
+2010-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Some progress toward fixing
+        https://bugs.webkit.org/show_bug.cgi?id=34864 | <rdar://problem/7594198>
+        Many objects left uncollected after visiting mail.google.com and closing
+        window
+        
+        SunSpider reports no change.
+        
+        Keep weak references, rather than protected references, to cached for-in
+        property name enumerators.
+        
+        One problem with protected references is that a chain like 
+            [ gc object 1 ] => [ non-gc object ] => [ gc object 2 ]
+        takes two GC passes to break, since the first pass collects [ gc object 1 ],
+        releasing [ non-gc object ] and unprotecting [ gc object 2 ], and only
+        then can a second pass collect [ gc object 2 ].
+        
+        Another problem with protected references is that they can keep a bunch
+        of strings alive long after they're useful. In SunSpider and a few popular
+        websites, the size-speed tradeoff seems to favor weak references.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Moved this constructor
+        into the .cpp file, since it's not used elsewhere.
+
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator): Added a destructor
+        to support our weak reference.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::clearEnumerationCache):
+        (JSC::Structure::enumerationCache): Added a function for clearing a
+        Structure's enumeration cache, used by our new destructor. Also fixed
+        indentation to match the rest of the file.
+
+        * runtime/Structure.h: Changed from protected pointer to weak pointer.
+
+2010-02-11  Chris Rogers  <crogers@google.com>
+
+        Reviewed by David Levin.
+
+        audio engine: add Complex number class
+        https://bugs.webkit.org/show_bug.cgi?id=34538
+
+        * wtf/Complex.h: Added.
+        (WebCore::complexFromMagnitudePhase):
+
+2010-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added an SPI for asking about all the different live objects on the heap.
+        Useful for memory debugging.
+
+        * JavaScriptCore.exp: Export the new SPI.
+
+        * runtime/Collector.cpp:
+        (JSC::typeName): Use a little capitalization. Don't crash in the case of
+        a non-object cell, since it might just be an uninitialized cell.
+
+        (JSC::Heap::objectTypeCounts): The new SPI.
+
+        * runtime/Collector.h:
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::operator++): Made 2 tweaks to these iterators:
+        (1) Skip the last cell in the block, since it's a dummy sentinel, and
+        we don't want it to confuse the object count; (2) Fixed a logic error
+        in LiveObjectIterator that could cause it to iterate dead objects if
+        m_block were equal to m_heap.nextBlock and m_cell were less than
+        m_heap.nextCell. No test for this since I can't think of a way that this
+        could make WebKit behave badly.
+
+2010-02-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Guard cmath using declarations in MathExtras.h on Android
+        https://bugs.webkit.org/show_bug.cgi?id=34840
+
+        Android does not provide these functions.
+
+        * wtf/MathExtras.h:
+
+2010-02-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Restore ENABLE_RUBY flag so vendors can ship with Ruby disabled if they choose.
+        https://bugs.webkit.org/show_bug.cgi?id=34698
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-02-10  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Add Windows complex text support and Mac support for containsCharacters.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34759
+
+        * wscript:
+
+2010-02-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Addressing issues found by style bot.
+
+        * wtf/ValueCheck.h: Renamed header guard to match final file name.
+
+        * wtf/Vector.h: (WTF::::checkConsistency): Remove braces around a one-line clause.
+
+2010-02-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34490
+        WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added ValueCheck.h.
+
+        * wtf/ValueCheck.h: Added. Moved code out of HashTraits, since it would be awkward to
+        include that from Vector.h.
+        (WTF::ValueCheck::checkConsistency): Allow null pointers, those are pretty consistent.
+
+        * wtf/HashTraits.h: Moved value checking code out of here.
+
+        * wtf/HashTable.h: (WTF::::checkTableConsistencyExceptSize): Updated for the above changes.
+
+        * wtf/Vector.h:
+        (WTF::::checkConsistency): Check all vector elements.
+        (WTF::ValueCheck): Support checking a Vector as an element in other containers. Currently
+        unused.
+
+2010-02-10  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::toBool.
+
+        Fix ECMA compliance in the QScriptValue for values like 0, NaN and
+        empty strings.
+
+        [Qt] QScriptValue::toBool problem
+        https://bugs.webkit.org/show_bug.cgi?id=34793
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toBool):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toBool_initData):
+        (tst_QScriptValue::toBool_makeData):
+        (tst_QScriptValue::toBool_test):
+        (tst_QScriptValue::toBoolean_initData):
+        (tst_QScriptValue::toBoolean_makeData):
+        (tst_QScriptValue::toBoolean_test):
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use derefIfNotNull() to work around WINSCW compiler forward declaration bug
+
+        The compiler bug is reported at
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+
+        The change should be reverted when the above bug is fixed in WINSCW compiler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+2009-10-06  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Get rid of WINSCW hack for UnSpecifiedBoolType
+
+        Add parenthesis around (RefPtr::*UnspecifiedBoolType) to make the WINSCW
+        compiler work with the default UnSpecifiedBoolType() operator.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+
+        * wtf/RefPtr.h:
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New functions nullValue() and undefinedValue().
+
+        [Qt] QScriptEngine should contain nullValue and undefinedValue methods
+        https://bugs.webkit.org/show_bug.cgi?id=34749
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::nullValue):
+        (QScriptEngine::undefinedValue):
+        * qt/api/qscriptengine.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::nullValue):
+        (tst_QScriptEngine::undefinedValue):
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixes for QScriptValue::toNumber().
+
+        Fix ECMA compliance in QScriptValue for values unbound
+        to a QScriptEngine.
+
+        [Qt] QScriptValue::toNumber() is broken
+        https://bugs.webkit.org/show_bug.cgi?id=34592
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::toNumber_initData):
+        (tst_QScriptValue::toNumber_makeData):
+        (tst_QScriptValue::toNumber_test):
+
+2010-02-09  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QScriptValue::isNumber().
+
+        The isNumber() should return 'true' if the value is in the CNumber
+        state.
+
+        [Qt] QScriptValue::isNumber() returns an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=34575
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::isNumber):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp:
+        (tst_QScriptValue::isNumber_initData):
+        (tst_QScriptValue::isNumber_makeData):
+        (tst_QScriptValue::isNumber_test):
+
+2010-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Small refactoring to the small strings cache to allow it to be cleared
+        dynamically.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::clear):
+        * runtime/SmallStrings.h: Moved initialization code into a shared function,
+        and changed the constructor to call it.
+
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Geoff Garen.
+
+        Rename StringBuilder::release && JSStringBuilder::releaseJSString
+        to 'build()'.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::build):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::build):
+
+2010-02-09  John Sullivan  <sullivan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=34772
+        Overzealous new assertion in URStringImpl::adopt()
+
+        Reviewed by Adam Barth.
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        Only assert that vector.data() is non-zero if vector.size() is non-zero.
+
+2010-02-09  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Try to fix build problem on SnowLeopard slaves to bring them back.
+
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8): Mark method as 'static inline' to suppress "warning: no previous prototype for ..."
+
+2010-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Three small string fixes:
+        (1) StringBuilder::release should CRASH if the buffer allocation failed.
+        (2) Remove weird, dead code from JSString::tryGetValue, replace with an ASSERT.
+        (3) Move UString::createFromUTF8 out to the API, as tryCreateStringFromUTF8.
+            This is only used from the API, and (now) unlike other UString::create
+            methods may return UString::null() to indicate failure cases.  Better
+            handle these in the API.
+
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8):
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/JSString.h:
+        (JSC::Fiber::tryGetValue):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::from):
+        (JSC::UString::find):
+        * runtime/UString.h:
+
+2010-02-09  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] use nanval() for Symbian as nonInlineNaN
+        https://bugs.webkit.org/show_bug.cgi?id=34170
+
+        numeric_limits<double>::quiet_NaN is broken in Symbian
+        causing NaN to be evaluated as a number.
+
+        * runtime/JSValue.cpp:
+        (JSC::nonInlineNaN):
+
+2010-02-09  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add a soft modulo operation to ARM JIT using a trampoline function.
+        The performance progression is about ~1.8% on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        Developed in cooperation with Gabor Loki.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::softModulo):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiSoftModulo):
+        * wtf/Platform.h:
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (SL/win build fixes).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/StringPrototype.cpp:
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        Make String.replace throw an exception on out-of-memory, rather than
+        returning a null (err, empty-ish) string.  Move String::replaceRange
+        and String::spliceSubstringsWithSeparators out to StringPrototype -
+        these were fairly specific use anyway, and we can better integrate
+        throwing the JS expcetion this way.
+
+        Also removes redundant assignment operator from UString.
+
+        * JavaScriptCore.exp:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringRange::StringRange):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::jsReplaceRange):
+        (JSC::stringProtoFuncReplace):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+
+2010-02-08  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Undefine WTF_OS_WINDOWS and WTF_PLATFORM_WIN
+        https://bugs.webkit.org/show_bug.cgi?id=34561
+
+        As the binary for simulator is built with MSVC 2005,
+        WTF_OS_WINDOWS and WTF_PLATFORM_WIN are defined.
+        Undefine them as we don't target Windows.
+
+        * wtf/Platform.h:
+
+2010-02-08  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Darin Adler.
+
+        audio engine: add Vector3 class
+        https://bugs.webkit.org/show_bug.cgi?id=34548
+
+        * wtf/Vector3.h: Added.
+        (WebCore::Vector3::Vector3):
+        (WebCore::Vector3::abs):
+        (WebCore::Vector3::isZero):
+        (WebCore::Vector3::normalize):
+        (WebCore::Vector3::x):
+        (WebCore::Vector3::y):
+        (WebCore::Vector3::z):
+        (WebCore::operator+):
+        (WebCore::operator-):
+        (WebCore::operator*):
+        (WebCore::dot):
+        (WebCore::cross):
+        (WebCore::distance):
+
+2010-02-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix warning in clang++
+
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make makeString CRASH if we fail to allocate a string.
+
+        (tryMakeString or jsMakeNontrivialString can be used where we
+        expect allocation may fail and want to handle the error).
+
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/UString.h:
+        (JSC::tryMakeString):
+        (JSC::makeString):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a couple of unnecesary C-style casts spotted by Darin.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Switch some more StringBuilder/jsNontrivialString code to use
+        JSStringBuilder/jsMakeNontrivialString - these methods will
+        throw an exception if we hit out-of-memory, rather than just
+        CRASHing.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+
+2010-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use an empty identifier instead of a null identifier for parse
+        tokens without an identifier.
+
+        This helps encapsulate the null UStringImpl within UString.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+
+2010-02-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Build fix for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-02-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed RVCT build fix.
+
+        Similar to r54391, don't import the cmath functions from std:: for RVCT.
+
+        * wtf/MathExtras.h:
+
+2010-02-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Change UStringImpl::create to CRASH if the string cannot be allocated,
+        rather than returning a null string (which will behave like a zero-length
+        string if used).
+
+        Also move createRep function from UString to become new overloaded
+        UStringImpl::create methods.  In doing so, bring their behaviour closer to
+        being in line with WebCore::StringImpl, in removing the behaviour that they
+        can be used to produce null UStrings (ASSERT the char* provided is non-null).
+        This behaviour of converting null C-strings to null UStrings is inefficient
+        (cmompared to just using UString::null()), incompatible with WebCore::StringImpl's
+        behaviour, and may generate unexpected behaviour, since in many cases a null
+        UString can be used like an empty string.
+
+        With these changes UStringImpl need not have a concept of null impls, we can
+        start transitioning this to become an implementation detail of UString, that
+        internally it chooses to use a null-object rather than an actually zero impl
+        pointer.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::stopProfiling):
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        (JSC::throwError):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::UString::UString):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::isNull):
+        (JSC::UString::null):
+        (JSC::UString::rep):
+        (JSC::UString::UString):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::create):
+        * runtime/UStringImpl.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define SYSTEM_MALLOC 1
+        https://bugs.webkit.org/show_bug.cgi?id=34640
+
+        Make BREWMP use system malloc because FastMalloc is not ported.
+
+        * wtf/Platform.h:
+
+2010-02-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't call CRASH() in fastMalloc and fastCalloc when the requested memory size is 0
+        https://bugs.webkit.org/show_bug.cgi?id=34569
+
+        With USE_SYSTEM_MALLOC=1, fastMalloc and fastCalloc call CRASH()
+        if the return value of malloc and calloc is 0.
+        
+        However, these functions can return 0 when the request size is 0.
+        Libc manual says, "If size is 0, then malloc() returns either NULL,
+        or a unique pointer value that can later be successfully passed to free()."
+        Though malloc returns a unique pointer in most systems,
+        0 can be returned in some systems. For instance, BREW's MALLOC returns 0
+        when size is 0.
+
+        If malloc or calloc returns 0 due to allocation size, increase the size
+        to 1 and try again.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+
+2010-02-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix.  Remove a symbol corresponding to an inline function from the linker export
+        file to prevent a weak external failure.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Accommodate rename of script.
+
+2010-02-04  Daniel Bates  <dbates@webkit.org>
+
+        [Qt] Unreviewed, build fix for Qt bot.
+
+        * runtime/JSStringBuilder.h: Changed #include <X.h> notation #include "X.h".
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Clearing a WeakGCPtr is weird
+        https://bugs.webkit.org/show_bug.cgi?id=34627
+
+        Added a WeakGCPtr::clear interface.
+        
+        As discussed in https://bugs.webkit.org/show_bug.cgi?id=33383, the old
+        interface made it pretty weird for a client to conditionally clear a
+        WeakGCPtr, which is exactly what clients want to do when objects are
+        finalized.
+
+        * API/JSClassRef.cpp:
+        (clearReferenceToPrototype): Use the new WeakGCPtr::clear() interface. 
+
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::clear): Added an interface for clearing a WeakGCPtr,
+        iff its current value is the value passed in. It's cumbersome for the
+        client to do this test, since WeakGCPtr sometimes pretends to be null.
+
+2010-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a header.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add a JSStringBuilder class (similar-to, and derived-from StringBuilder) to
+        construct JSStrings, throwing a JS exception should we run out of memory whilst
+        allocating storage for the string.
+
+        Similarly, add jsMakeNontrivialString methods to use in cases where previously
+        we were calling makeString & passing the result to jsNontrivialString.  Again,
+        these new methods throw if we hit an out of memory condition.
+
+        Move throwOutOfMemoryError into ExceptionHelpers, to make it more widely available.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSStringBuilder.h: Added.
+        (JSC::JSStringBuilder::releaseJSString):
+        (JSC::jsMakeNontrivialString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.cpp:
+        * runtime/Operations.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+
+2010-02-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * wtf/MathExtras.h:
+
+2010-02-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Make MathExtras.h compatible with <cmath>
+        https://bugs.webkit.org/show_bug.cgi?id=34618
+
+        * wtf/MathExtras.h: Include <cmath> instead of <math.h>.
+        Use "using" as we do elsewhere in WTF for the four functions from <cmath>
+        we want to use without the prefix. Later we could consider making the std
+        explicit at call sites instead.
+
+2010-02-04  Tamas Szirbucz  <szirbucz@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use an easily appendable structure for trampolines instead of pointer parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=34424
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
+
+2010-02-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Increase test coverage for the QScriptValue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34533
+
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::dataHelper):
+        (tst_QScriptValue::newRow):
+        (tst_QScriptValue::testHelper):
+        (tst_QScriptValue::ctor):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated.cpp: Added.
+        (tst_QScriptValue::initScriptValues):
+        (tst_QScriptValue::isValid_initData):
+        (tst_QScriptValue::isValid_makeData):
+        (tst_QScriptValue::isValid_test):
+        (tst_QScriptValue::isBool_initData):
+        (tst_QScriptValue::isBool_makeData):
+        (tst_QScriptValue::isBool_test):
+        (tst_QScriptValue::isBoolean_initData):
+        (tst_QScriptValue::isBoolean_makeData):
+        (tst_QScriptValue::isBoolean_test):
+        (tst_QScriptValue::isFunction_initData):
+        (tst_QScriptValue::isFunction_makeData):
+        (tst_QScriptValue::isFunction_test):
+        (tst_QScriptValue::isNull_initData):
+        (tst_QScriptValue::isNull_makeData):
+        (tst_QScriptValue::isNull_test):
+        (tst_QScriptValue::isString_initData):
+        (tst_QScriptValue::isString_makeData):
+        (tst_QScriptValue::isString_test):
+        (tst_QScriptValue::isUndefined_initData):
+        (tst_QScriptValue::isUndefined_makeData):
+        (tst_QScriptValue::isUndefined_test):
+        (tst_QScriptValue::isObject_initData):
+        (tst_QScriptValue::isObject_makeData):
+        (tst_QScriptValue::isObject_test):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define WTF_PLATFORM_BREWMP_SIMULATOR when AEE_SIMULATOR is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34514
+
+        PLATFORM(BREWMP_SIMULATOR) guard is needed to make distinction between BREWMP
+        and BREWMP simulator.
+
+        * wtf/Platform.h:
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Remove COMPILE_ASSERT conflict with the underlying PLATFORM
+        https://bugs.webkit.org/show_bug.cgi?id=34190
+
+        COMPILE_ASSERT conflicts with the underlying PLATFORM because it is defined
+        both in WTF's Assertions.h and BREWMP's AEEClassIDs.h. Include AEEClassIDs.h
+        in Assertions.h and undef COMPILE_ASSERT to avoid redefining COMPILE_ASSERT.
+
+        * wtf/Assertions.h:
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Implement OwnPtrBrew to make sure BREW instances are freed.
+        https://bugs.webkit.org/show_bug.cgi?id=34518
+
+        Add OwnPtrBrew to release IFile, IFileMgr and IBitmap instances.
+
+        * wtf/brew/OwnPtrBrew.cpp: Added.
+        (WTF::IFileMgr):
+        (WTF::IFile):
+        (WTF::IBitmap):
+        (WTF::freeOwnedPtrBrew):
+        * wtf/brew/OwnPtrBrew.h: Added.
+        (WTF::OwnPtrBrew::OwnPtrBrew):
+        (WTF::OwnPtrBrew::~OwnPtrBrew):
+        (WTF::OwnPtrBrew::get):
+        (WTF::OwnPtrBrew::release):
+        (WTF::OwnPtrBrew::outPtr):
+        (WTF::OwnPtrBrew::set):
+        (WTF::OwnPtrBrew::clear):
+        (WTF::OwnPtrBrew::operator*):
+        (WTF::OwnPtrBrew::operator->):
+        (WTF::OwnPtrBrew::operator!):
+        (WTF::OwnPtrBrew::operator UnspecifiedBoolType):
+        (WTF::OwnPtrBrew::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+
+2010-02-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Export WTF::fastStrDup symbol
+        https://bugs.webkit.org/show_bug.cgi?id=34526
+
+        * JavaScriptCore.exp:
+
+2010-02-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Enable JIT compilation for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34536
+
+        * wtf/Platform.h:
+
+2010-02-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Crash in CollectorBitmap::get at nbcolympics.com
+        https://bugs.webkit.org/show_bug.cgi?id=34504
+
+        This was caused by the use of m_offset to determine the offset of
+        a new property into the property storage.  This patch corrects
+        the effected cases by incorporating the anonymous slot count. It
+        also removes the duplicate copy of anonymous slot count from the
+        property table as keeping this up to date merely increased the
+        chance of a mismatch.  Finally I've added a large number of
+        assertions in an attempt to prevent such a bug from happening
+        again.
+
+        With the new assertions in place the existing anonymous slot tests
+        all fail without the m_offset fixes.
+
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+
+2010-02-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Copyright year updating for Windows version resources should be automatic
+        https://bugs.webkit.org/show_bug.cgi?id=34503
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add dummy main thread functions
+        https://bugs.webkit.org/show_bug.cgi?id=33569
+
+        Add dummy initializeMainThreadPlatform and
+        scheduleDispatchFunctionsOnMainThread.
+
+        * wtf/brew/MainThreadBrew.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Add using WTF::getLocalTime to CurrentTime.h
+        https://bugs.webkit.org/show_bug.cgi?id=34493
+
+        * wtf/CurrentTime.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add HAVE_XXX definitions
+        https://bugs.webkit.org/show_bug.cgi?id=34414
+
+        Add HAVE_ERRNO_H=1
+
+        * wtf/Platform.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Don't define HAVE_TM_GMTOFF, HAVE_TM_ZONE and HAVE_TIMEGM
+        https://bugs.webkit.org/show_bug.cgi?id=34388
+
+        BREWMP does not have these features.
+
+        * wtf/Platform.h:
+
+2010-02-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Define WTF_PLATFORM_BREWMP=1 when BUILDING_BREWMP is defined
+        https://bugs.webkit.org/show_bug.cgi?id=34386
+
+        Define WTF_PLATFORM_BREWMP=1 so that PLATFORM(BREWMP) guard can be used.
+
+        * wtf/Platform.h:
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Date.UTC() should apply TimeClip operation.
+        https://bugs.webkit.org/show_bug.cgi?id=34461
+
+        ECMAScript 5 15.9.4.3:
+        > 9 Return TimeClip(MakeDate(MakeDay(yr, m, dt), MakeTime(h, min, s, milli))).
+
+        * runtime/DateConstructor.cpp:
+        (JSC::dateUTC): Calls WTF::timeClip().
+
+2010-02-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug that Math.round() retunrs incorrect results for huge integers
+        https://bugs.webkit.org/show_bug.cgi?id=34462
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound): Avoid "arg + 0.5".
+
+2010-02-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port WTF's currentTime
+        https://bugs.webkit.org/show_bug.cgi?id=33567
+
+        Combine GETUTCSECONDS and GETTIMEMS to calculate the number
+        of milliseconds since 1970/01/01 00:00:00 UTC.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2010-02-01  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] WinCE buildfix after r52729 and fix for Q_BIG_ENDIAN typo.
+        https://bugs.webkit.org/show_bug.cgi?id=34378
+
+        * wtf/Platform.h:
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Structure not accounting for anonymous slots when computing property storage size
+        https://bugs.webkit.org/show_bug.cgi?id=34441
+
+        Previously any Structure with anonymous storage would have a property map, so we
+        were only including anonymous slot size if there was a property map.  Given this
+        is no longer the case we should always include the anonymous slot count in the
+        property storage size.
+
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix, update exports file (again)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix, update exports file
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSC is failing to propagate anonymous slot count on some transitions
+        https://bugs.webkit.org/show_bug.cgi?id=34321
+
+        Remove secondary Structure constructor, and make Structure store a copy
+        of the number of anonymous slots directly so saving an immediate allocation
+        of a property map for all structures with anonymous storage, which also
+        avoids the leaked property map on new property transition in the original
+        version of this patch.
+
+        We need to propagate the the anonymous slot count otherwise we can end up
+        with a structure recording incorrect information about the available and
+        needed space for property storage, or alternatively incorrectly reusing
+        some slots.
+
+        * JavaScriptCore.exp:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::hasAnonymousSlots):
+        (JSC::Structure::anonymousSlotCount):
+
+2010-01-31  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Buildfix for WinCE + style fixes (TLS_OUT_OF_INDEXES is not defined).
+        https://bugs.webkit.org/show_bug.cgi?id=34380
+
+        * wtf/ThreadSpecific.h:
+
+2010-01-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        [Windows] Fix a bug of round() with huge integral numbers
+        https://bugs.webkit.org/show_bug.cgi?id=34297
+
+        Fix a bug that round() for huge integral numbers returns incorrect
+        results. For example, round(8639999913600001) returns
+        8639999913600002 without this change though the double type can
+        represent 8639999913600001 precisely.
+
+        Math.round() of JavaScript has a similar problem. But this change
+        doesn't fix it because Math.round() doesn't use round() of
+        MathExtra.h.
+
+        * wtf/MathExtras.h:
+        (round): Avoid to do "num + 0.5" or "num - 0.5".
+        (roundf): Fixed similarly.
+        (llround): Calls round().
+        (llroundf): Calls roundf().
+        (lround): Calls round().
+        (lroundf): Calls roundf().
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Sort Xcode projects.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-29  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build.
+
+        Disable ENABLE_INDEXED_DATABASE since it is "completely non-functional".
+
+        As the comment in FeatureDefines.xcconfig notes, the list of feature defines
+        needs to be kept in sync across the various files.  The default values also
+        need to be kept in sync between these files and build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Fix the ARM build.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure): Call the right Structure::create overload.
+
+2010-01-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix for MSW, use ThreadingWin.cpp as the Windows pthreads implementation
+        implements pthread_t in a way that makes it impossible to check its validity,
+        which is needed by ThreadingPthreads.cpp.
+
+        * wscript:
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DOM Objects shouldn't all require custom mark functions
+        https://bugs.webkit.org/show_bug.cgi?id=34291
+
+        Make getAnonymousValue const-friendly
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getAnonymousValue):
+
+2010-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplify anonymous slot implementation
+        https://bugs.webkit.org/show_bug.cgi?id=34282
+
+        A class must now specify the number of slots it needs at construction time
+        rather than later on with a transition.  This makes many things simpler,
+        we no longer need to need an additional transition on object creation to
+        add the anonymous slots, and we remove the need for a number of transition
+        type checks. 
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::JSCell::createDummyStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::Fiber::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::anonymousSlotCount):
+        * runtime/StructureTransitionTable.h:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MessageEvent.data should deserialize in the context of the MessageEvent's global object
+        https://bugs.webkit.org/show_bug.cgi?id=34227
+
+        Add logic to allow us to create an Object, Array, or Date instance
+        so we can create them in the context of a specific global object,
+        rather than just using the current lexical global object.
+
+        * JavaScriptCore.exp:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyObject):
+        (JSC::constructEmptyArray):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
+
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
+
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
+
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
+
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
+
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
+
+2010-01-27  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove trailing \ from inline function code
+        https://bugs.webkit.org/show_bug.cgi?id=34223
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port WTF's randomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=33566
+
+        Use GETRAND to generate 4 byte random byte sequence to implement
+        weakRandomNumber. Create a secure random number generator with
+        AEECLSID_RANDOM to implement randomNumber.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::weakRandomNumber):
+        (WTF::randomNumber):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Port getCPUTime
+        https://bugs.webkit.org/show_bug.cgi?id=33572
+
+        Use GETUPTIMEMS which returns a continuously and
+        linearly increasing millisecond timer from the time the device
+        was powered on. This function is enough to implement getCPUTime.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Oliver Hunt.
+
+        [BREWMP] Add MarkStack fastMalloc implementation for platforms without VirtualAlloc or mmap.
+        https://bugs.webkit.org/show_bug.cgi?id=33582
+
+        Use fastMalloc and fastFree to implement MarkStack::allocateStack and
+        MarkStack::releaseStack for platforms without page level allocation.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackNone.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+2010-01-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Don't use time function
+        https://bugs.webkit.org/show_bug.cgi?id=33577
+
+        Calling time(0) in BREW devices causes a crash because time
+        is not properly ported in most devices. Cast currentTime() to
+        time_t to get the same result as time(0).
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+
+2010-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Revert r53899 (HashMap<AtomicStringImpl*, Value> key checks) and subsequent build fixes,
+        because they make SVG tests crash in release builds.
+
+        * wtf/HashMap.h:
+        (WTF::::remove):
+        * wtf/HashSet.h:
+        (WTF::::remove):
+        * wtf/HashTable.h:
+        (WTF::::add):
+        (WTF::::addPassingHashCode):
+        (WTF::::removeAndInvalidate):
+        (WTF::::remove):
+        (WTF::::rehash):
+        (WTF::::checkTableConsistency):
+        (WTF::::checkTableConsistencyExceptSize):
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::emptyValue):
+        (WTF::):
+        * wtf/RefPtrHashMap.h:
+        (WTF::::remove):
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        More Windows build fixing.
+
+        * wtf/HashTraits.h: _msize takes void*, remove const qualifier from type.
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * wtf/HashTraits.h: Include malloc.h for _msize().
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * wtf/HashTable.h: (WTF::HashTable::checkTableConsistencyExceptSize): Remove const from a
+        static (empty) version of this function.
+
+2010-01-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34150
+        WebKit needs a mechanism to catch stale HashMap entries
+
+        It is very difficult to catch stale pointers that are HashMap keys - since a pointer's hash
+        is just its value, it is very unlikely that any observable problem is reproducible.
+
+        This extends hash table consistency checks to check that pointers are referencing allocated
+        memory blocks, and makes it possible to invoke the checks explicitly (it is not feasible
+        to enable CHECK_HASHTABLE_CONSISTENCY by default, because that affects performance too much).
+
+        * wtf/HashMap.h: (WTF::::checkConsistency): Call through to HashTable implementation. We can
+        add similar calls to HashSet and HashCountedSet, but I haven't seen hard to debug problems
+        with those yet.
+
+        * wtf/HashSet.h: (WTF::::remove): The version of checkTableConsistency that's guarded by
+        CHECK_HASHTABLE_CONSISTENCY is now called internalCheckTableConsistency().
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::internalCheckTableConsistency):
+        (WTF::HashTable::internalCheckTableConsistencyExceptSize):
+        (WTF::HashTable::checkTableConsistencyExceptSize):
+        Expose checkTableConsistency() even if CHECK_HASHTABLE_CONSISTENCY is off.
+        (WTF::::add): Updated for checkTableConsistency renaming.
+        (WTF::::addPassingHashCode): Ditto.
+        (WTF::::removeAndInvalidate): Ditto.
+        (WTF::::remove): Ditto.
+        (WTF::::rehash): Ditto.
+        (WTF::::checkTableConsistency): The assertion for !shouldExpand() was not correct - this
+        function returns true for tables with m_table == 0.
+        (WTF::::checkTableConsistencyExceptSize): Call checkValueConsistency for key. Potentially,
+        we could do the same for values.
+
+        * wtf/HashTraits.h:
+        (WTF::GenericHashTraits::checkValueConsistency): An empty function that can be overridden
+        to add checks. Currently, the only override is for pointer hashes.
+
+        * wtf/RefPtrHashMap.h: (WTF::::remove): Updated for checkTableConsistency renaming.
+
+2010-01-26  Lyon Chen  <liachen@rim.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Opcode.h use const void* for Opcode cause error #1211 for RVCT compiler
+        https://bugs.webkit.org/show_bug.cgi?id=33902
+
+        * bytecode/Opcode.h:
+
+2010-01-26  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Windows build references non-existent include paths
+        https://bugs.webkit.org/show_bug.cgi?id=34175
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2010-01-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Using JavaScriptCore API with a webkit vended context can result in slow script dialog
+        https://bugs.webkit.org/show_bug.cgi?id=34172
+
+        Make the APIShim correctly increment and decrement the timeout
+        entry counter.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix compilation of QtScript with non-gcc compilers
+
+        Variable length stack arrays are a gcc extension. Use QVarLengthArray
+        as a more portable solution that still tries to allocate on the stack
+        first.
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::call):
+
+2010-01-26  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix the build on platforms without JIT support.
+
+        The JIT support should be determined at compile-time via wtf/Platform.h
+
+        * qt/api/QtScript.pro:
+
+2010-01-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        First steps of the QtScript API.
+        
+        Two new classes were created; QScriptEngine and QScriptValue.
+        The first should encapsulate a javascript context and the second a script
+        value.
+        
+        This API is still in development, so it isn't compiled by default.
+        To trigger compilation, pass --qmakearg="CONFIG+=build-qtscript" to
+        build-webkit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32565
+
+        * qt/api/QtScript.pro: Added.
+        * qt/api/qscriptconverter_p.h: Added.
+        (QScriptConverter::toString):
+        * qt/api/qscriptengine.cpp: Added.
+        (QScriptEngine::QScriptEngine):
+        (QScriptEngine::~QScriptEngine):
+        (QScriptEngine::evaluate):
+        (QScriptEngine::collectGarbage):
+        * qt/api/qscriptengine.h: Added.
+        * qt/api/qscriptengine_p.cpp: Added.
+        (QScriptEnginePrivate::QScriptEnginePrivate):
+        (QScriptEnginePrivate::~QScriptEnginePrivate):
+        (QScriptEnginePrivate::evaluate):
+        * qt/api/qscriptengine_p.h: Added.
+        (QScriptEnginePrivate::get):
+        (QScriptEnginePrivate::collectGarbage):
+        (QScriptEnginePrivate::makeJSValue):
+        (QScriptEnginePrivate::context):
+        * qt/api/qscriptvalue.cpp: Added.
+        (QScriptValue::QScriptValue):
+        (QScriptValue::~QScriptValue):
+        (QScriptValue::isValid):
+        (QScriptValue::isBool):
+        (QScriptValue::isBoolean):
+        (QScriptValue::isNumber):
+        (QScriptValue::isNull):
+        (QScriptValue::isString):
+        (QScriptValue::isUndefined):
+        (QScriptValue::isError):
+        (QScriptValue::isObject):
+        (QScriptValue::isFunction):
+        (QScriptValue::toString):
+        (QScriptValue::toNumber):
+        (QScriptValue::toBool):
+        (QScriptValue::toBoolean):
+        (QScriptValue::toInteger):
+        (QScriptValue::toInt32):
+        (QScriptValue::toUInt32):
+        (QScriptValue::toUInt16):
+        (QScriptValue::call):
+        (QScriptValue::engine):
+        (QScriptValue::operator=):
+        (QScriptValue::equals):
+        (QScriptValue::strictlyEquals):
+        * qt/api/qscriptvalue.h: Added.
+        (QScriptValue::):
+        * qt/api/qscriptvalue_p.h: Added.
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::get):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isValid):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isError):
+        (QScriptValuePrivate::isObject):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toInteger):
+        (QScriptValuePrivate::toInt32):
+        (QScriptValuePrivate::toUInt32):
+        (QScriptValuePrivate::toUInt16):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::engine):
+        (QScriptValuePrivate::context):
+        (QScriptValuePrivate::value):
+        (QScriptValuePrivate::object):
+        (QScriptValuePrivate::inherits):
+        (QScriptValuePrivate::isJSBased):
+        (QScriptValuePrivate::isNumberBased):
+        (QScriptValuePrivate::isStringBased):
+        * qt/api/qtscriptglobal.h: Added.
+        * qt/tests/qscriptengine/qscriptengine.pro: Added.
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp: Added.
+        (tst_QScriptEngine::tst_QScriptEngine):
+        (tst_QScriptEngine::~tst_QScriptEngine):
+        (tst_QScriptEngine::init):
+        (tst_QScriptEngine::cleanup):
+        (tst_QScriptEngine::collectGarbage):
+        (tst_QScriptEngine::evaluate):
+        * qt/tests/qscriptvalue/qscriptvalue.pro: Added.
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp: Added.
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::init):
+        (tst_QScriptValue::cleanup):
+        (tst_QScriptValue::ctor):
+        (tst_QScriptValue::toString_data):
+        (tst_QScriptValue::toString):
+        (tst_QScriptValue::copyConstructor_data):
+        (tst_QScriptValue::copyConstructor):
+        (tst_QScriptValue::assignOperator_data):
+        (tst_QScriptValue::assignOperator):
+        (tst_QScriptValue::dataSharing):
+        (tst_QScriptValue::constructors_data):
+        (tst_QScriptValue::constructors):
+        (tst_QScriptValue::call):
+        * qt/tests/tests.pri: Added.
+        * qt/tests/tests.pro: Added.
+
+2010-01-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Linux tests: the pthread functions on Linux produce segfault if they receive 0 thread handle.
+        After r53714, we can have 0 thread handles passed to pthread_join and pthread_detach if corresponding threads
+        were already terminated and their threadMap entries cleared.
+        Add a 0 check.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2010-01-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Refactor JITStubs.cpp so that DEFINE_STUB_FUNCTION is only used once for each function
+        https://bugs.webkit.org/show_bug.cgi?id=33866
+
+        Place the guard USE(JSVALUE32_64) inside the body of the DEFINE_STUB_FUNCTION
+        macro for those functions that are always present.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-01-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Remove the Bakefile build system, which is no longer being used.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=34022
+
+        * JavaScriptCoreSources.bkl: Removed.
+        * jscore.bkl: Removed.
+
+2010-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34025
+        Enable client-based Geolocation abstraction for Mac, Windows AppleWebKit targets.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempted Snow Leopard build fix.
+
+        * wtf/ThreadingPthreads.cpp: Add a forward declaration of a function which is not 'static'.
+
+2009-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the leak of ThreadIdentifiers in threadMap across threads.
+        https://bugs.webkit.org/show_bug.cgi?id=32689
+
+        Test is added to DumpRenderTree.mm.
+
+        * Android.mk: Added file ThreadIdentifierDataPthreads.(h|cpp) to build.
+        * Android.v8.wtf.mk: Ditto.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp: Added. Contains custom implementation of thread-specific data that uses custom destructor.
+        (WTF::ThreadIdentifierData::~ThreadIdentifierData): Removes the ThreadIdentifier from the threadMap.
+        (WTF::ThreadIdentifierData::identifier):
+        (WTF::ThreadIdentifierData::initialize):
+        (WTF::ThreadIdentifierData::destruct): Custom thread-specific destructor. Resets the value for the key again to cause second invoke.
+        (WTF::ThreadIdentifierData::initializeKeyOnceHelper):
+        (WTF::ThreadIdentifierData::initializeKeyOnce): Need to use pthread_once since initialization may come on any thread(s).
+        * wtf/ThreadIdentifierDataPthreads.h: Added.
+        (WTF::ThreadIdentifierData::ThreadIdentifierData):
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint): Move initializeCurrentThreadInternal to after the lock to make
+                                 sure it is invoked when ThreadIdentifier is already established.
+
+        * wtf/Threading.h: Rename setThreadNameInternal -> initializeCurrentThreadInternal since it does more then only set the name now.
+        * wtf/ThreadingNone.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        (WTF::initializeThreading): Ditto.
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeCurrentThreadInternal): Ditto.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::clearPthreadHandleForIdentifier): Make it not 'static' so the ~ThreadIdentifierData() in another file can call it.
+        (WTF::initializeCurrentThreadInternal): Set the thread-specific data. The ThreadIdentifier is already established by creating thread.
+        (WTF::waitForThreadCompletion): Remove call to clearPthreadHandleForIdentifier(threadID) since it is now done in ~ThreadIdentifierData().
+        (WTF::detachThread): Ditto.
+        (WTF::currentThread): Use the thread-specific data to get the ThreadIdentifier. It's many times faster then Mutex-protected iteration through the map.
+                              Also, set the thread-specific data if called first time on the thread.
+
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ThreadSpecific for ENABLE(SINGLE_THREADED)
+        https://bugs.webkit.org/show_bug.cgi?id=33878
+
+        Implement ThreadSpecific with a simple getter/setter
+        when ENABLE(SINGLE_THREADED) is true.
+
+        Due to the change in https://bugs.webkit.org/show_bug.cgi?id=33236,
+        an implementation of ThreadSpecific must be available to build WebKit.
+        This causes a build failure for platforms without a proper
+        ThreadSpecific implementation.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2010-01-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add fastStrDup to FastMalloc
+        https://bugs.webkit.org/show_bug.cgi?id=33937
+
+        The new string returned by fastStrDup is obtained with fastMalloc,
+        and can be freed with fastFree. This makes the memory management 
+        more consistent because we don't need to keep strdup allocated pointers
+        and free them with free(). Instead we can use fastFree everywhere.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastStrDup):
+        * wtf/FastMalloc.h:
+
+2010-01-21  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        history.back() for same-document history traversals isn't synchronous as the specification states.
+        <rdar://problem/7535011> and https://bugs.webkit.org/show_bug.cgi?id=33538
+
+        * wtf/Platform.h: Add a "HISTORY_ALWAYS_ASYNC" enable and turn it on for Chromium.
+
+2010-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Always create a prototype for automatically managed classes.
+        
+        This fixes some errors where prototype chains were not correctly hooked
+        up, and also ensures that API classes work correctly with features like
+        instanceof.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create): Cleaned up some of this code. Also changed it
+        to always create a prototype class.
+
+        * API/tests/testapi.c:
+        (Derived2_class):
+        (main): Fixed a null value crash in the exception checking code.
+        * API/tests/testapi.js: Added some tests for the case where a prototype
+        chain would not be hooked up correctly.
+
+2010-01-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Force JSC to create a prototype chain for API classes with a
+        parent class but no static functions.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
+
+2010-01-21  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Object.getOwnPropertyDescriptor always returns undefined for JS API objects
+        https://bugs.webkit.org/show_bug.cgi?id=33946
+
+        Ideally the getOwnPropertyDescriptor() reimplementation should return an
+        access descriptor that wraps the property getter and setter callbacks, but
+        that approach is much more involved than returning a value descriptor.
+        Keep it simple for now.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyDescriptor):
+        * API/tests/testapi.js:
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Remove unnecessary function call.
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use the inline i386 assembly for x86_64 as well rather than falling back to using pthread mutexes.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+
+2010-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7215063> Use GCD instead of an extra thread for FastMalloc scavenging on platforms where it is supported
+
+        Abstract the background scavenging slightly so that an alternate implementation that uses GCD can be used on platforms
+        where it is supported.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::shouldContinueScavenging):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::periodicScavenge):
+        * wtf/Platform.h:
+
+2010-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7562708> REGRESSION(53460): Heap::destroy may not run
+        all destructors
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks): Instead of fully marking protected objects,
+        just set their mark bits. This prevents protected objects from keeping
+        unprotected objects alive. Destructor order is not guaranteed, so it's
+        OK to destroy objects pointed to by protected objects before destroying
+        protected objects.
+
+2010-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        CrossThreadCopier needs to support ThreadSafeShared better.
+        https://bugs.webkit.org/show_bug.cgi?id=33698
+
+        * wtf/TypeTraits.cpp: Added tests for the new type traits.
+        * wtf/TypeTraits.h:
+        (WTF::IsSubclass): Determines if a class is a derived from another class.
+        (WTF::IsSubclassOfTemplate): Determines if a class is a derived from a
+        template class (with one parameter that is unknown).
+        (WTF::RemoveTemplate): Reveals the type for a template parameter.
+
+2010-01-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler and Adam Roben.
+
+        Feature defines are difficult to maintain on Windows builds
+        https://bugs.webkit.org/show_bug.cgi?id=33883
+
+        FeatureDefines.vsprops are now maintained in a way similar to
+        Configurations/FeatureDefines.xcconfig, with the added advantage
+        of having a single FeatureDefines file across all projects.
+
+        * Configurations/FeatureDefines.xcconfig: Add comments about keeping feature definitions in sync.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add FeatureDefines.vsprops inherited property sheet.
+
+2010-01-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed buildfix for r53547.
+
+        * DerivedSources.pro:
+
+2010-01-20  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make extraCompilers for generated sources depend on their scripts
+
+        * DerivedSources.pro:
+
+2010-01-19  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        When JavaScriptCore calls Debugger::Exception, have it pass a
+        hasHandler variable that represents if exception is being handled
+        in the same function (not in a parent on the call stack).
+        
+        This just adds a new parameter, no behavior is changed.
+
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2010-01-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Inline functions that are hot in DOM manipulation
+        https://bugs.webkit.org/show_bug.cgi?id=33820
+        
+        (3% speedup on Dromaeo DOM Core tests)
+
+        * runtime/WeakGCMap.h:
+        (JSC::::get): inline
+
+2010-01-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix for JIT with RVCT.
+
+        Remove IMPORT statement; cti_vm_throw is already defined in JITStubs.h.
+        Remove extra ')'.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiVMThrowTrampoline):
+
+2010-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
+
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
+        
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
+
+2010-01-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Reverting r53455, breaks 2 javascriptcore tests.
+
+        * API/JSContextRef.cpp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrinkBlocks):
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Revert r53454, since it causes much sadness in this world.
+
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION (52082): Crash on worker thread when reloading http://radnan.public.iastate.edu/procedural/
+        https://bugs.webkit.org/show_bug.cgi?id=33826
+
+        This bug was caused by a GC-protected object being destroyed early by
+        Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
+        to GC-protected memory to be valid.
+
+        The solution is to do two passes of tear-down in Heap::destroy. The first
+        pass tears down all unprotected objects. The second pass ASSERTs that all
+        previously protected objects are now unprotected, and then tears down
+        all perviously protected objects. These two passes simulate the two passes
+        that would have been required to free a protected object during normal GC.
+        
+        * API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy): Moved ASSERTs to here.
+        (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
+        setter to the function that does the shrinking.
+        (JSC::Heap::freeBlocks): Implemented above algorithm.
+        (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.
+
+2010-01-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
+
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate setter support for type=month.
+        https://bugs.webkit.org/show_bug.cgi?id=33021
+
+        Expose the following functions to be used by WebCore:
+         - WTF::msToyear()
+         - WTF::dayInYear()
+         - WTF::monthFromDayInYear()
+         - WTF::dayInMonthFromDayInYear()
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::msToYear): Remove "static inline".
+        (WTF::dayInYear): Remove "static inline".
+        (WTF::monthFromDayInYear): Remove "static inline".
+        (WTF::dayInMonthFromDayInYear): Remove "static inline".
+        * wtf/DateMath.h: Declare the above functions.
+
+2010-01-18  Darin Adler  <darin@apple.com>
+
+        Fix build by reverting the previous change.
+
+        * runtime/UString.h: Rolled out the FastAllocBase base class.
+        It was making UString larger, and therefore JSString larger,
+        and too big for a garbage collection cell.
+
+        This raises the unpleasant possibility that many classes became
+        larger because we added the FastAllocBase base class. I am
+        worried about this, and it needs to be investigated.
+
+2010-01-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for UString class
+        https://bugs.webkit.org/show_bug.cgi?id=27831
+
+        Inherits the following class from FastAllocBase because it is
+        instantiated by 'new' and no need to be copyable:
+
+        class name     - instantiated at:
+        classs UString - JavaScriptCore/runtime/UString.cpp:160
+
+        * runtime/UString.h:
+
+2010-01-18  Evan Cheng  <evan.cheng@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add some ALWAYS_INLINE for key functions not inlined by some versions of GCC.
+        rdar://problem/7553780
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getPropertySlot): ALWAYS_INLINE both overloads.
+        * runtime/JSString.h:
+        (JSC::JSString::JSString): ALWAYS_INLINE the version that takes a UString.
+        * runtime/UString.h:
+        (JSC::operator==): ALWAYS_INLINE the version that compares two UString objects.
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Delete dftables-xxxxxxxx.in files automatically.
+        https://bugs.webkit.org/show_bug.cgi?id=33796
+
+        * pcre/dftables: unlink unnecessary temporary file.
+
+2010-01-18  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Force qmake to generate a single makefile for DerivedSources.pro
+
+        * DerivedSources.pro:
+
+2010-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        Rolling out r53391 and r53392 because of random crashes on buildbots.
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.cpp:
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        * runtime/UString.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix the build with strict gcc and RVCT versions: It's not legal to cast a
+        pointer to a function to a void* without an intermediate cast to a non-pointer
+        type. A cast to a ptrdiff_t inbetween fixes it.
+
+        * runtime/JSString.h:
+        (JSC::Fiber::JSString):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove UntypedPtrAndBitfield from UStringImpl (akin to PtrAndFlags).
+
+        This break the OS X Leaks tool.  Instead, free up some more bits from the refCount.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::):
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+2010-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33731
+        Remove uses of PtrAndFlags from JIT data stuctures.
+
+        These break the OS X Leaks tool.  Free up a bit in CallLinkInfo, and invalid
+        permutation of pointer states in MethodCallLinkInfo to represent the removed bits.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * runtime/UString.h:
+
+2010-01-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache JS string values made from DOM strings (Dromaeo speedup)
+        https://bugs.webkit.org/show_bug.cgi?id=33768
+        <rdar://problem/7353576>
+
+        * runtime/JSString.h:
+        (JSC::jsStringWithFinalizer): Added new mechanism for a string to have an optional
+        finalizer callback, for the benefit of weak-referencing caches.
+        (JSC::):
+        (JSC::Fiber::JSString):
+        (JSC::Fiber::~JSString):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope): Clear fibers so this doesn't look like a string with a finalizer.
+        * runtime/WeakGCMap.h: Include "Collector.h" to make this header includable by itself.
+
+2010-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for <rdar://problem/7548432>
+        Add ALWAYS_INLINE to jsLess for a 1% speedup on llvm-gcc.
+
+        * runtime/Operations.h:
+        (JSC::jsLess):
+
+2010-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESISON: Google maps buttons not working properly
+        https://bugs.webkit.org/show_bug.cgi?id=31871
+
+        REGRESSION(r52948): JavaScript exceptions thrown on Google Maps when
+        getting directions for a second time
+        https://bugs.webkit.org/show_bug.cgi?id=33446
+        
+        SunSpider and v8 report no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID): Update our cached offset in case
+        flattening the dictionary changed any of its offsets.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): ditto
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33705
+        UStringImpl::create() should use internal storage
+
+        When creating a UStringImpl copying of a UChar*, we can use an internal buffer,
+        by calling UStringImpl::tryCreateUninitialized().
+
+        Also, remove duplicate of copyChars from JSString, call UStringImpl's version.
+
+        Small (max 0.5%) progression on Sunspidey.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::create):
+
+2010-01-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make naming & behaviour of UString[Impl] methods more consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=33702
+
+        UString::create() creates a copy of the UChar* passed, but UStringImpl::create() assumes
+        that it should assume ownership of the provided buffer (with UString::createNonCopying()
+        and UStringImpl::createCopying() providing the alternate behaviours).  Unify on create()
+        taking a copy of the provided buffer.  For non-copying cases, use the name 'adopt', and
+        make this method take a Vector<UChar>&.  For cases where non-copying construction was being
+        used, other than from a Vector<UChar>, change the code to allocate the storage along with
+        the UStringImpl using UStringImpl::createUninitialized().  (The adopt() method also more
+        closely matches that of WebCore::StringImpl).
+
+        Also, UString::createUninitialized() and UStringImpl::createUninitialized() have incompatible
+        behaviours, in that the UString form sets the provided UChar* to a null or non-null value to
+        indicate success or failure, but UStringImpl uses the returned PassRefPtr<UStringImpl> to
+        indicate when allocation has failed (potentially leaving the output Char* uninitialized).
+        This is also incompatible with WebCore::StringImpl's behaviour, in that
+        StringImpl::createUninitialized() will CRASH() if unable to allocate.  Some uses of
+        createUninitialized() in JSC are unsafe, since they do not test the result for null.
+        UStringImpl's indication is preferable, since we may want a successful call to set the result
+        buffer to 0 (specifically, StringImpl returns 0 for the buffer where createUninitialized()
+        returns the empty string, which seems reasonable to catch bugs early).  UString's method
+        cannot support UStringImpl's behaviour directly, since it returns an object rather than a
+        pointer.
+            - remove UString::createUninitialized(), replace with calls to UStringImpl::createUninitialized()
+            - create a UStringImpl::tryCreateUninitialized() form UStringImpl::createUninitialized(),
+              with current behaviour, make createUninitialized() crash on failure to allocate.
+            - make cases in JSC that do not check the result call createUninitialized(), and cases that do
+              check call tryCreateUninitialized().
+
+        Rename computedHash() to existingHash(), to bring this in line wih WebCore::StringImpl.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHash::hash):
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::adopt):
+        (JSC::IdentifierRepHash::hash):
+        (JSC::makeString):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::adopt):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::tryCreateUninitialized):
+        (JSC::UStringImpl::existingHash):
+
+2010-01-13  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSON.stringify and JSON.parse needlessly process properties in the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=33053
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (buildfix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33641
+        Assertion failure in Lexer.cpp if input stream ends while in string escape
+
+        Test: fast/js/end-in-string-escape.html
+
+        * parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
+        assertion a chance to fire.
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (buildfix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig & Darin Adler.
+
+        Three quick fixes to UStringImpl.
+            - The destroy() method can be switched back to a normal destructor; since we've switched
+              the way we protect static strings to be using an odd ref-count the destroy() won't abort.
+            - The cost() calculation logic was wrong.  If you have multiple JSStrings wrapping substrings
+              of a base string, they would each report the full cost of the base string to the heap.
+              Instead we should only be reporting once for the base string.
+            - Remove the overloaded new operator calling fastMalloc, replace this with a 'using' to pick
+              up the implementation from the parent class.
+
+        * JavaScriptCore.exp:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::~UStringImpl):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::deref):
+
+2010-01-13  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Split the build process in two different .pro files.
+        This allows qmake to be run once all source files are available.
+
+        * DerivedSources.pro: Added.
+        * JavaScriptCore.pri: Moved source generation to DerivedSources.pro
+        * pcre/pcre.pri: Moved source generation to DerivedSources.pro
+
+2010-01-12  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [ES5] Implement Object.getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=32242
+
+        Add an extra argument to getPropertyNames() and getOwnPropertyNames()
+        (and all reimplementations thereof) that indicates whether non-enumerable
+        properties should be added.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyNames):
+        * runtime/Arguments.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp: Rename getEnumerablePropertyNames() to getPropertyNames(), which takes an extra argument.
+        (JSC::Structure::getPropertyNames):
+        * runtime/Structure.h:
+        (JSC::):
+
+2010-01-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33540
+        Make it possible to build in debug mode with assertions disabled
+
+        * jit/JITStubs.cpp: (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Identifier.cpp: (JSC::Identifier::checkSameIdentifierTable):
+        * wtf/FastMalloc.cpp:
+        * wtf/HashTable.h: (WTF::HashTableConstIterator::checkValidity):
+        * yarr/RegexCompiler.cpp: (JSC::Yarr::compileRegex):
+
+2009-11-23  Yong Li  <yoli@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Make GIF decoder support down-sampling
+        https://bugs.webkit.org/show_bug.cgi?id=31806
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::upperBoundScaledY):
+        (WebCore::ImageDecoder::lowerBoundScaledY):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::scaledRect):
+        (WebCore::RGBA32Buffer::setScaledRect):
+        (WebCore::ImageDecoder::scaledSize):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::copyOnePixel):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+
+2010-01-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ecma/Date/15.9.5.12-1.js fails every night at midnight
+        https://bugs.webkit.org/show_bug.cgi?id=28041
+
+        Change the test to use a concrete time instead of "now".
+
+        * tests/mozilla/ecma/Date/15.9.5.10-1.js:
+        * tests/mozilla/ecma/Date/15.9.5.12-1.js:
+
+2010-01-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Enable JIT and YARR_JIT if (CPU(X86_64) && OS(LINUX) && GCC_VERSION >= 40100)
+
+        * wtf/Platform.h:
+
+2010-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33481
+        Uninitialized data members in ArrayStorage
+        
+        SunSpider reports no change.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Initialize missing data members in the two cases
+        where we don't use fastZeroedMalloc, so it doesn't happen automatically.
+
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33480
+        
+        Improve debugging reliability for WTF on Windows.
+        Store WTF static library's PDB file into a better location.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-01-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        Remove extraneous entries from def file causing build warning.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+        * tests/mozilla/ecma_2/RegExp/properties-001.js:
+        (AddRegExpCases):
+        * tests/mozilla/js1_2/regexp/toString.js:
+        Update relevant Mozilla tests (Mozilla has had this behavior since November 2003).
+
+2010-01-10  Darin Adler  <darin@apple.com>
+
+        * tests/mozilla/ecma/Array/15.4.1.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.1.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.1-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.2-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.2.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Array/15.4.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/LexicalConventions/7.7.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.13.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.16.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.18.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.5.js: Added property allow-tabs.
+        * tests/mozilla/ecma/Math/15.8.2.7.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.1.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.1-4.js: Added property allow-tabs.
+        * tests/mozilla/ecma/String/15.5.3.js: Added property allow-tabs.
+        * tests/mozilla/ecma/TypeConversion/9.5-2.js: Added property allow-tabs.
+        * tests/mozilla/ecma/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/LexicalConventions/keywords-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/RegExp/exec-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/match-004.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/replace-001.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/String/split-002.js: Added property allow-tabs.
+        * tests/mozilla/ecma_2/jsref.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/Date/shell.js: Modified property allow-tabs.
+        * tests/mozilla/ecma_3/Exceptions/regress-181654.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-209067.js: Added property allow-tabs.
+        * tests/mozilla/ecma_3/RegExp/regress-85721.js: Added property allow-tabs.
+        * tests/mozilla/importList.html: Added property allow-tabs.
+        * tests/mozilla/js1_1/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/general2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Array/splice2.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/Objects/toString-001.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/charCodeAt.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/concat.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/String/match.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/String/slice.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Function_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/Number.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/String.js: Modified property allow-tabs.
+        * tests/mozilla/js1_2/function/nesting.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-1.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/function/regexparg-2-n.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/jsref.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/equality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/operator/strictEquality.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_dollar_number.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_input_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastIndex.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastMatch_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_lastParen_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_leftContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_multiline_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_object.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/RegExp_rightContext_as_array.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/alphanumeric.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/asterisk.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backslash.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/backspace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/beginLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/character_class.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/compile.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/control_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/digit.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/dot.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/endLine.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/everything.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/exec.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/flags.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/global.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/hexadecimal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/ignoreCase.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/interval.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/octal.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/parentheses.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/plus.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/question_mark.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/simple_form.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/source.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/special_characters.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_replace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_search.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/string_split.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/test.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/toString.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/vertical_bar.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/whitespace.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/regexp/word_boundary.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/break.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/continue.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/do_while.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch.js: Added property allow-tabs.
+        * tests/mozilla/js1_2/statements/switch2.js: Added property allow-tabs.
+        * tests/mozilla/js1_3/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_4/shell.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-111557.js: Added property allow-tabs.
+        * tests/mozilla/js1_5/Regress/regress-216320.js: Added property allow-tabs.
+        * tests/mozilla/menuhead.html: Added property allow-tabs.
+        * tests/mozilla/mklistpage.pl: Added property allow-tabs.
+        * tests/mozilla/runtests.pl: Added property allow-tabs.
+
+2010-01-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33417
+
+        Cleans up style errors exposed by the patch for bug #33198.
+        Moreover, fixes all "Weird number of spaces at line-start. Are you using a 4-space indent?"
+        errors reported by check-webkit-style.
+
+        No functionality was changed. So, no new tests.
+
+        * wtf/Platform.h:
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        It's unused; the string representation is reconstructed from flags.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+
+2010-01-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Memory use grows grows possibly unbounded in this JavaScript Array test case
+        https://bugs.webkit.org/show_bug.cgi?id=31675
+
+        This fixes one observed bug in this test case, which is that
+        arrays don't report extra cost for the sparse value maps.
+
+        SunSpider reports a small speedup.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Report extra memory cost for
+        the sparse value map.
+        * runtime/JSArray.h: 
+
+2010-01-08  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary #include from FastMalloc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=33393
+
+        * wtf/FastMalloc.cpp:
+
+2010-01-08  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52983.
+        http://trac.webkit.org/changeset/52983
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        Broke 59 JavaScriptCore tests.  I don't think Kent knew about
+        run-javascriptcore-tests.  Sadly neither does the commit-bot,
+        yet.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        (JSC::RegExp::flags):
+
+2010-01-08  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r52981.
+        http://trac.webkit.org/changeset/52981
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        Caused two JS tests to start failing:
+        ecma_2/RegExp/properties-001.js and js1_2/regexp/toString.js
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Don't store RegExp flags string representation
+        https://bugs.webkit.org/show_bug.cgi?id=33321
+
+        It's unused; the string representation is reconstructed from flags.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+
+2010-01-08  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RegExp.prototype.toString returns "//" for empty regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=33319
+
+        "//" starts a single-line comment, hence "/(?:)/" should be used, according to ECMA.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2010-01-08  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        RVCT compiler with "-Otime -O3" optimization tries to optimize out 
+        inline new'ed pointers that are passed as arguments.
+        Proposed patch assigns new'ed pointer explicitly outside function call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33084
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+
+2010-01-08  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove an unnecessary cacheFlush from ARM_TRADITIONAL JIT
+        https://bugs.webkit.org/show_bug.cgi?id=33203
+
+        * assembler/ARMAssembler.cpp: Remove obsolete linkBranch function.
+        (JSC::ARMAssembler::executableCopy): Inline a clean linkBranch code.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::getLdrImmAddress): Use inline function.
+        (JSC::ARMAssembler::getLdrImmAddressOnPool): Ditto.
+        (JSC::ARMAssembler::patchPointerInternal): Remove an unnecessary cacheFlush.
+        (JSC::ARMAssembler::linkJump): Use patchPointerInternal instead of linkBranch.
+        (JSC::ARMAssembler::linkCall): Ditto.
+        (JSC::ARMAssembler::relinkCall): Ditto.
+
+2010-01-07  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Build fix for JSVALUE32 when ENABLE_JIT_OPTIMIZE* are disabled
+        https://bugs.webkit.org/show_bug.cgi?id=33311
+
+        Move compileGetDirectOffset function to common part of JSVALUE32
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Allow call sites to determine if ASSERT_* and LOG_* macros are operational
+        https://bugs.webkit.org/show_bug.cgi?id=33020
+
+        * wtf/Assertions.h: Set ASSERT_MSG_DISABLED, FATAL_DISABLED,
+        ERROR_DISABLED, LOG_DISABLED to 1 if the compiler does not support
+        variadic macros. Refactor for better readibility.
+
+2010-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32987
+
+        Added ENABLE_XHTMLMP flag. Disabled by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-01-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Symbian] Port ARM traditional JIT Trampolines to RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=30552
+
+        Take the GCC implementation and mechanically convert
+        it to RVCT syntax.
+
+        Use 'bx rX' instead of 'mov pc, rX' when it is available.
+
+        Developed in cooperation with Iain Campbell and Gabor Loki.
+
+        * JavaScriptCore.pri: Extra step to generate RVCT stubs. The 
+        script generation intentionally executed all the time not just
+        for RVCT targets.
+
+        * create_rvct_stubs: Added. Perl script to expand precompiler macros
+        for RVCT assembler - the template is defined in JITStubs.cpp.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a crash seen on the buildbots.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Disable specific function tracking here,
+        instead of in WebCore, to ensure that the disabling happens before a
+        specific function can be registered.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Mac build fix.
+
+        * JavaScriptCore.exp: Export new JSGlobalData static data members.
+
+2010-01-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33057
+        REGRESSION(r49365): typeof(xhr.responseText) != "string" in Windows
+
+        <rdar://problem/7296920> REGRESSION: WebKit fails to start PeaceKeeper benchmark
+
+        Test: fast/js/webcore-string-comparison.html
+
+        In r49365, some code was moved from JSString.cpp to JSString.h, and as a result, WebCore
+        got a way to directly instantiate JSStrings over DLL borders. Since vftable for JSString was
+        not exported, objects created from WebCore got a different vptr, and JavaScriptCore
+        optimizations that relied on vptr of all JSString objects being equal failed.
+
+        * config.h: Added a JS_EXPORTCLASS macro for exporting classes. It's currently the same as
+        JS_EXPORTDATA, but it clearly needed a new name.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        Store vptrs just once, no need to repeatedly pick and copy them. This makes it possible to
+        assert vptr correctness in object destructors (which don't have access to JSGlobalData,
+        and even Heap::heap(this) will fail for fake objects created from storeVPtrs()).
+
+        * runtime/JSArray.cpp: (JSC::JSArray::~JSArray): Assert that vptr is what we expect it to be.
+        It's important to assert in destructor, because MSVC changes the vptr after constructor
+        is invoked.
+        * runtime/JSByteArray.cpp: (JSC::JSByteArray::~JSByteArray): Ditto.
+        * runtime/JSByteArray.h: Ditto.
+        * runtime/JSFunction.h: Ditto.
+        * runtime/JSFunction.cpp: (JSC::JSFunction::~JSFunction): Ditto.
+
+        * runtime/JSCell.h: (JSC::JSCell::setVPtr): Added a method to substitute vptr for another
+        one.
+
+        * runtime/JSString.h: Export JSString class together with its vftable, and tell other
+        libraries tp import it. This is needed on platforms that have a separate JavaScriptCore
+        dynamic library - and on Mac, we already did the export via JavaScriptCore.exp.
+        (JSC::JSString::~JSString): Assert tha vptr is what we expect it to be.
+        (JSC::fixupVPtr): Store a previously saved primary vftable pointer (do nothing if building
+        JavaScriptCore itself).
+        (JSC::jsSingleCharacterString): Call fixupVPtr in case this is call across DLL boundary.
+        (JSC::jsSingleCharacterSubstring): Ditto.
+        (JSC::jsNontrivialString): Ditto.
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new static
+        JSGlobalData members that are used in WebCore via inline functions.
+
+2010-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Safari memory usage skyrockets using new Google AdWords interface
+        https://bugs.webkit.org/show_bug.cgi?id=33343
+
+        The memory use was caused by the global object creating too many structures
+        as it thrashed between different specific functions.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::despecifyAllFunctions):
+        * runtime/Structure.h:
+        (JSC::Structure::disableSpecificFunctionTracking): Track a thrash count
+        for specific functions. Disable specific function tracking once the
+        thrash count has been hit.
+
+2010-01-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Enable JIT in debug mode on win32 after r51141 fixed the crashes.
+
+        * JavaScriptCore.pri:
+
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Mac] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
+
+        Using of operator += cause compile error on Mac, so it is changed to
+        "= static_cast<AllocAlignmentInteger*>(old_ptr) + 1".
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
+
+2010-01-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Build fix when FAST_MALLOC_MATCH_VALIDATION=1
+        https://bugs.webkit.org/show_bug.cgi?id=33312
+
+        Remove pByte (committed in r42344 from #20422), because pByte doesn't
+        exist and it is unnecessary.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::realloc):
+
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        QT build fix.
+
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecific):
+
+2010-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part I.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-01-06  Dan Bernstein  <mitz@apple.com>
+
+        Build fix
+
+        * runtime/Identifier.cpp:
+        (JSC::createIdentifierTableSpecificCallback):
+
+2010-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33236
+        Remove m_identifierTable pointer from UString
+
+        Currently every string holds a pointer so that during destruction,
+        if a string has been used as an identifier, it can remove itself
+        from the table.  By instead accessing the identifierTable via a
+        thread specific tracking the table associated with the current
+        globaldata, we can save the memory cost of this pointer.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+
+            - change the API shims to track the identifierTable of the current JSGlobalData.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+
+            - update creation of JSGlobalData for API usage to use new create method.
+            - fix shim instanciation bug in JSGlobalContextCreateInGroup.
+
+        * JavaScriptCore.exp:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+
+            - add asserts to check the identifierTable is being tracked correctly.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+        (JSC::Identifier::remove):
+        (JSC::Identifier::checkSameIdentifierTable):
+        (JSC::createIdentifierTableSpecificCallback):
+        (JSC::createIdentifierTableSpecific):
+        (JSC::createDefaultDataSpecific):
+
+            - Use currentIdentifierTable() instead of UStringImpl::m_identifierTable.
+            - Define methods to access the thread specific identifier tables.
+
+        * runtime/Identifier.h:
+        (JSC::ThreadIdentifierTableData::ThreadIdentifierTableData):
+        (JSC::defaultIdentifierTable):
+        (JSC::setDefaultIdentifierTable):
+        (JSC::currentIdentifierTable):
+        (JSC::setCurrentIdentifierTable):
+        (JSC::resetCurrentIdentifierTable):
+
+            - Declare methods to access the thread specific identifier tables.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNonDefault):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+
+            - creation of JSGlobalData objects, other than for API usage, associate themselves with the current thread.
+
+        * runtime/JSGlobalData.h:
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::destroy):
+
+            - destroy() method should be using isIdentifier().
+
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+        (JSC::UStringImpl::setIsIdentifier):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::UStringImpl):
+
+            - replace m_identifierTable with a single m_isIdentifier bit.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::stringHash):
+
+            - change string hash result from 32-bit to 31-bit, to free a bit in UStringImpl for m_isIdentifier.
+
+2009-12-25 Patrick Gansterer <paroga@paroga.com>
+ 
+        Reviewed by Eric Seidel.
+
+        Buildfix for WinCE + style fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=32939
+
+        * jsc.cpp:
+        (functionPrint):
+        (functionQuit):
+        (parseArguments):
+        (fillBufferWithContentsOfFile):
+ 
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        WinCE buildfix after r52791 (renamed PLATFORM(WINCE) to OS(WINCE)).
+        https://bugs.webkit.org/show_bug.cgi?id=33205
+
+        * jit/ExecutableAllocator.h:
+
+2010-01-05  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Added compiler error for unsupported platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=33112
+
+        * jit/JITStubs.cpp:
+
+2010-01-05  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Follow r52729 in ARMAssembler.
+        https://bugs.webkit.org/show_bug.cgi?id=33208
+
+        Use WTF_ARM_ARCH_AT_LEAST instead of ARM_ARCH_VERSION
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::encodeComplexImm): Move tmp declaration to ARMv7
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::bkpt):
+
+2010-01-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix for Gtk+
+
+        Don't use // comments in Platform.h, at least some of them seem to make the version of GCC
+        used on the Gtk buildbot unhappy.
+
+        * wtf/Platform.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Reorganize, document and rename OS() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33198
+
+        * wtf/Platform.h: Rename, reorganize and document OS() macros.
+
+        Adapt to name changes. Also fixed a few incorrect OS checks.
+
+        * API/JSContextRef.cpp:
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerX86Common.h:
+        * bytecode/SamplingTool.cpp:
+        * config.h:
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        * jsc.cpp:
+        (main):
+        * parser/Grammar.y:
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::currentThreadStackBase):
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * runtime/Collector.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackPosix.cpp:
+        * runtime/MarkStackSymbian.cpp:
+        * runtime/MarkStackWin.cpp:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/CurrentTime.cpp:
+        (WTF::lowResUTCTime):
+        * wtf/CurrentTime.h:
+        (WTF::getLocalTime):
+        * wtf/DateMath.cpp:
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::InitModule):
+        (WTF::TCMallocStats::):
+        * wtf/FastMalloc.h:
+        * wtf/MathExtras.h:
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/StringExtras.h:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/TCSystemAlloc.cpp:
+        * wtf/ThreadSpecific.h:
+        (WTF::::destroy):
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+        (WTF::createThreadInternal):
+        * wtf/VMTags.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2010-01-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Add missing files to the build system - make distcheck build fix.
+
+        * GNUmakefile.am:
+
+2010-01-04  Gavin Barraclough <barraclough@apple.com>
+
+        Reviewed by Sam Weinig, additional coding by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33163
+        Add string hashing functions to WTF.
+        Use WTF's string hashing functions from UStringImpl.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UStringImpl.cpp:
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::computeHash):
+        * wtf/HashFunctions.h:
+        * wtf/StringHashFunctions.h: Added.
+        (WTF::stringHash):
+
+2010-01-04  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attempt to fix ARM bulid.
+
+        * wtf/Platform.h:
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Add an 'isIdentifier' to UStringImpl, use this where appropriate
+        (where previously 'identifierTable' was being tested).
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UStringImpl.h:
+        (JSC::UStringImpl::isIdentifier):
+
+2010-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Shimmey Shimmey" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33158
+        Refactor JSC API entry/exit to use RAII instead of copy/pasting code.
+        Make it easier to change set of actions taken when passing across the API boundary.
+
+        * API/APIShims.h: Added.
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        (JSReportExtraMemoryCost):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-01-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan and Mark Rowe.
+
+        Updated copyright string
+
+        * Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2010-01-04  Adam Roben  <aroben@apple.com>
+
+        No review, rolling out r52741.
+        http://trac.webkit.org/changeset/52741
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Add cacheFlush support for WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=33110
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-01-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Roben.
+
+        Implement NO_RETURN for COMPILER(MSVC).
+        https://bugs.webkit.org/show_bug.cgi?id=33056
+
+        * wtf/AlwaysInline.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix some PLATFORM(*_ENDIAN) uses to CPU()
+        https://bugs.webkit.org/show_bug.cgi?id=33148
+
+        * runtime/JSCell.cpp:
+        (JSC::):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Document CPU() macros in comments.
+        https://bugs.webkit.org/show_bug.cgi?id=33147
+
+        * wtf/Platform.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Reorganize, document and rename CPU() platform macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33145
+        ExecutableAllocatorSymbian appears to have buggy ARM version check
+        https://bugs.webkit.org/show_bug.cgi?id=33138
+        
+        * wtf/Platform.h:
+        Rename all macros related to detection of particular CPUs or
+        classes of CPUs to CPU(), reorganize and document them.
+
+        All remaining changes are adapting to the renames, plus fixing the
+        second bug cited above.
+        
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Registers::):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::movl_mEAX):
+        (JSC::X86Assembler::movl_EAXm):
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCount):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * wrec/WREC.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SlowLock):
+        * wtf/Threading.h:
+        * wtf/dtoa.cpp:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        * yarr/RegexJIT.h:
+
+2010-01-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Clean up COMPILER macros and remove unused ones.
+        https://bugs.webkit.org/show_bug.cgi?id=33132
+        
+        Removed values are COMPILER(BORLAND) and COMPILER(CYGWIN) - they were
+        not used anywhere.
+
+        * wtf/Platform.h:
+
+2010-01-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Update wtf/Platform.h to document the new system for porting macros.
+        https://bugs.webkit.org/show_bug.cgi?id=33130
+
+        * wtf/Platform.h:
+
+2009-12-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        PLATFORM(CAIRO) should be defined by WIN_CAIRO define
+        https://bugs.webkit.org/show_bug.cgi?id=22250
+
+        * wtf/Platform.h: Define WTF_PLATFORM_CAIRO for GTK port only
+        For the WinCairo port WTF_PLATFORM_CAIRO is already defined in config.h
+
+2009-12-28  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Delete ThreadPrivate instance after it is finished.
+        https://bugs.webkit.org/show_bug.cgi?id=32614
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadMonitor::instance):
+        (WTF::ThreadMonitor::threadFinished):
+        (WTF::createThreadInternal):
+        (WTF::detachThread):
+
+2009-12-28  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Cleanup of #define JS_EXPORT.
+
+        * API/JSBase.h:
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        WinCE buildfix (HWND_MESSAGE isn't supported there)
+
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2009-12-27  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Barth.
+
+        Added a file with WinMain function to link agains in WinCE.
+
+        * os-win32/WinMain.cpp: Added.
+        (convertToUtf8):
+        (WinMain):
+
+2009-12-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed; revert of r52550.
+
+        The change regressed the following LayoutTests for QtWebKit.
+
+        fast/workers/worker-call.html -> crashed
+        fast/workers/worker-close.html -> crashed
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-24  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix memory leak by deleting instance of ThreadPrivate
+        in function waitForThreadCompletion(), synchronously, or in
+        detachThread(), asynchronously.
+        https://bugs.webkit.org/show_bug.cgi?id=32614 
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+
+2009-12-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Laszlo Gombos.
+
+        Include stddef.h for ptrdiff_t
+        https://bugs.webkit.org/show_bug.cgi?id=32891
+
+        ptrdiff_t is typedef-ed in stddef.h.
+        Include stddef.h in jit/ExecutableAllocator.h.
+
+        * jit/ExecutableAllocator.h:
+
+2009-12-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Buildfix after r47092.
+
+        * wtf/wince/MemoryManager.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+
+2009-12-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLInputElement::valueAsDate getter support.
+        https://bugs.webkit.org/show_bug.cgi?id=32876
+
+        Expose dateToDaysFrom1970().
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970):
+        * wtf/DateMath.h:
+
+2009-12-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Turn off datagrid by default, at least for all platforms Apple ships.
+        The datagrid implementation isn't ready for general web use yet.
+
+        * Configurations/FeatureDefines.xcconfig: Turn off datagrid by default.
+
+2009-12-22  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Updates Android's scheduleDispatchFunctionsOnMainThread() to use new
+        AndroidThreading class, rather than using JavaSharedClient directly.
+        This fixes the current layering violation.
+        https://bugs.webkit.org/show_bug.cgi?id=32651
+
+        The pattern is copied from Chromium, which uses the ChromiumThreading
+        class. This patch also fixes the style in ChromiumThreading.h.
+
+        * wtf/android/AndroidThreading.h: Added. Declares AndroidThreading.
+        * wtf/android/MainThreadAndroid.cpp: Modified
+        (WTF::scheduleDispatchFunctionsOnMainThread): Uses AndroidThreading.
+        * wtf/chromium/ChromiumThreading.h: Modified. Fixes style.
+
+2009-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix a couple of problems with UntypedPtrAndBitfield.
+
+        Add a m_leaksPtr to reduce false positives from leaks in debug builds
+        (this isn't perfect because we'd like a solution for release builds,
+        but this is now at least as good as a PtrAndFlags would be).
+
+        Switch SmallStringsto use a regular string for the base, rather than
+        a static one.  UntypedPtrAndBitfield assumes all strings are at least
+        8 byte aligned; this migt not be true of static strings.  Shared buffers
+        are heap allocated, as are all UStringImpls other than static strings.
+        Static strings cannot end up being the owner string of substrings,
+        since the only static strings are length 0.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UStringImpl.h:
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UStringImpl::UStringImpl):
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        RVCT (__ARMCC_VERSION < 400000) does not provide strcasecmp and strncasecmp
+        https://bugs.webkit.org/show_bug.cgi?id=32857
+
+        Add implementation of strcasecmp and strncasecmp for RVCT < 4.0
+        because earlier versions of RVCT 4.0 does not provide these functions.
+
+        * wtf/StringExtras.cpp: Added.
+        (strcasecmp):
+        (strncasecmp):
+        * wtf/StringExtras.h:
+
+2009-12-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Define ALWAYS_INLINE and WTF_PRIVATE_INLINE to __forceinline for RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=32853
+
+        Use __forceinline forces RVCT to compile a C or C++ function
+        inline. The compiler attempts to inline the function, regardless of
+        the characteristics of the function.
+
+        * wtf/AlwaysInline.h:
+        * wtf/FastMalloc.h:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective GTK build fix: Add UStringImpl.cpp/h to the build.
+
+        * GNUmakefile.am:
+
+2009-12-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, add UStringImpl.cpp to the build.
+
+        * JavaScriptCore.pri:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix part 5.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Fix breakage of world introduced in build fix to r52463.
+
+        * runtime/UStringImpl.h:
+
+2009-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32831
+        Replace UString::Rep implementation, following introduction of ropes to JSC.
+
+            * Remove redundant overcapacity mechanisms.
+            * Reduce memory cost of Rep's.
+            * Add an inline storage mechanism akin to that in WebCore's StringImpl.
+
+        ~1% Sunspider progression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        (JSC::createRep):
+        (JSC::UString::createFromUTF8):
+        (JSC::UString::createUninitialized):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::ascii):
+        (JSC::UString::operator=):
+        (JSC::UString::toStrictUInt32):
+        (JSC::equal):
+        * runtime/UString.h:
+        (JSC::UString::isEmpty):
+        (JSC::UString::cost):
+        (JSC::makeString):
+        * runtime/UStringImpl.cpp: Added.
+        (JSC::UStringImpl::baseSharedBuffer):
+        (JSC::UStringImpl::sharedBuffer):
+        (JSC::UStringImpl::destroy):
+        (JSC::UStringImpl::computeHash):
+        * runtime/UStringImpl.h: Added.
+        (JSC::UntypedPtrAndBitfield::UntypedPtrAndBitfield):
+        (JSC::UntypedPtrAndBitfield::asPtr):
+        (JSC::UntypedPtrAndBitfield::operator&=):
+        (JSC::UntypedPtrAndBitfield::operator|=):
+        (JSC::UntypedPtrAndBitfield::operator&):
+        (JSC::UStringImpl::create):
+        (JSC::UStringImpl::createCopying):
+        (JSC::UStringImpl::createUninitialized):
+        (JSC::UStringImpl::data):
+        (JSC::UStringImpl::size):
+        (JSC::UStringImpl::cost):
+        (JSC::UStringImpl::hash):
+        (JSC::UStringImpl::computedHash):
+        (JSC::UStringImpl::setHash):
+        (JSC::UStringImpl::identifierTable):
+        (JSC::UStringImpl::setIdentifierTable):
+        (JSC::UStringImpl::ref):
+        (JSC::UStringImpl::deref):
+        (JSC::UStringImpl::allocChars):
+        (JSC::UStringImpl::copyChars):
+        (JSC::UStringImpl::computeHash):
+        (JSC::UStringImpl::null):
+        (JSC::UStringImpl::empty):
+        (JSC::UStringImpl::checkConsistency):
+        (JSC::UStringImpl::):
+        (JSC::UStringImpl::UStringImpl):
+        (JSC::UStringImpl::operator new):
+        (JSC::UStringImpl::bufferOwnerString):
+        (JSC::UStringImpl::bufferOwnership):
+        (JSC::UStringImpl::isStatic):
+
+2009-12-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move some build decisions from Qt build system into source files
+        https://bugs.webkit.org/show_bug.cgi?id=31956
+
+        * JavaScriptCore.pri: Compile files unconditionally
+        * jit/ExecutableAllocatorPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * jit/ExecutableAllocatorWin.cpp: Guard with PLATFORM(WIN_OS)
+        * runtime/MarkStackPosix.cpp: Guard with PLATFORM(UNIX) && !PLATFORM(SYMBIAN)
+        * runtime/MarkStackSymbian.cpp: Guard with PLATFORM(SYMBIAN)
+        * runtime/MarkStackWin.cpp: Guard with PLATFORM(WIN_OS)
+        * wtf/Platform.h: Guard ENABLE_JSC_MULTIPLE_THREADS with ENABLE_SINGLE_THREADED for the Qt port
+        * wtf/ThreadingNone.cpp: Guard with ENABLE(SINGLE_THREADED)
+        * wtf/qt/ThreadingQt.cpp: Guard with !ENABLE(SINGLE_THREADED)
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add createNonCopying method to UString to make replace constructor passed bool,
+        to make behaviour more explicit.  Add createFromUTF8 to UString (wrapping method
+        on UString::Rep), since other cases of transliteration (e.g.  from ascii) are
+        performed in UString constructors.  Add/use setHash & size() accessors on Rep,
+        rather than accessing _hash/len directly.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::CStringTranslator::translate):
+        (JSC::UCharBufferTranslator::translate):
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::release):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::createNonCopying):
+        (JSC::UString::createFromUTF8):
+        * runtime/UString.h:
+        (JSC::UString::Rep::setHash):
+        (JSC::UString::~UString):
+        (JSC::makeString):
+
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Gavin Barraclough.
+        
+        Changed Register constructors to assignment operators, to streamline
+        moving values into registers. (In theory, there's no difference between
+        the two, since the constructor should just inline away, but there seems
+        to be a big difference in the addled mind of the GCC optimizer.)
+
+        In the interpreter, this is a 3.5% SunSpider speedup and a 1K-2K
+        reduction in stack usage per privateExecute stack frame.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setCalleeArguments):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScopeChain):
+        (JSC::ExecState::init):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock): Added a little bit of casting so these
+        functions could use the new Register assignment operators.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::Register):
+        (JSC::Register::operator=): Swapped in assignment operators for constructors.
+
+2009-12-18  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32713
+        [Qt] make wtf/Assertions.h compile in winscw compiler.
+
+        Add string arg before ellipsis to help winscw compiler resolve variadic
+        macro definitions in wtf/Assertions.h. 
+
+        * wtf/Assertions.h:
+
+2009-12-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixed intermittent failure seen on Windows buildbot, and in other JSC
+        API clients.
+        
+        Added a WeakGCPtr class and changed OpaqueJSClass::cachedPrototype to
+        use it, to avoid vending a stale object as a prototype.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::prototype):
+        * API/JSClassRef.h: Use WeakGCPtr.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/WeakGCPtr.h: Added.
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::operator*):
+        (JSC::WeakGCPtr::operator->):
+        (JSC::WeakGCPtr::operator!):
+        (JSC::WeakGCPtr::operator bool):
+        (JSC::WeakGCPtr::operator UnspecifiedBoolType):
+        (JSC::WeakGCPtr::assign):
+        (JSC::::operator):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::static_pointer_cast):
+        (JSC::const_pointer_cast):
+        (JSC::getPtr): Added WeakGCPtr to the project.
+
+2009-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32720
+
+        * JavaScriptCore.exp:
+            - Remove exports for UString::append
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Make StringBuilder a private header (was project).
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] GRefPtr does not take a reference when assigned a raw pointer
+        https://bugs.webkit.org/show_bug.cgi?id=32709
+
+        Ensure that when assigning a raw pointer to a GRefPtr, the reference
+        count is incremented. Also remove the GRefPtr conversion overload as
+        GRefPtr types have necessarily incompatible reference counting.
+
+        * wtf/gtk/GRefPtr.h:
+        (WTF::GRefPtr::operator=):
+
+2009-12-18  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clean up the qmake build system to distinguish between trunk builds and package builds
+
+        https://bugs.webkit.org/show_bug.cgi?id=32716
+
+        * pcre/pcre.pri: Use standalone_package instead of QTDIR_build
+
+2009-12-18  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Compile warning from line 29 of GRefPtr.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=32703
+
+        Fix memory leak and compiler warning in GRefPtr GHashTable template
+        specialization.
+
+        * wtf/gtk/GRefPtr.cpp:
+        (WTF::refGPtr):
+
+2009-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add BUILDING_ON_SNOW_LEOPARD and TARGETING_SNOW_LEOPARD #defines.
+
+        * wtf/Platform.h:
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Sync JavaScriptCore.vcproj with JavaScriptCore.xcodeproj and the
+        source tree
+
+        Fixes <http://webkit.org/b/32665>.
+
+        Reviewed by Ada Chan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Moved
+        around files and filters so that the structure matches
+        JavaScriptCore.xcodeproj and the source tree. A few headers that were
+        previously omitted have been added, as well as JSZombie.{cpp,h}.
+
+2009-12-17  Adam Roben  <aroben@apple.com>
+
+        Remove HeavyProfile and TreeProfile completely
+
+        These were mostly removed in r42808, but the empty files were left in
+        place.
+
+        Fixes <http://webkit.org/b/32664>.
+
+        Reviewed by John Sullivan.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+        Removed HeavyProfile/TreeProfile source files.
+
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-12-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] WebKit GTK needs a wrapper for ref counted glib/gobject structs
+        https://bugs.webkit.org/show_bug.cgi?id=21599
+
+        Implement GRefPtr, a smart pointer for reference counted GObject types.
+
+        * GNUmakefile.am:
+        * wtf/gtk/GOwnPtr.cpp:
+        (WTF::GDir):
+        * wtf/gtk/GRefPtr.h: Added.
+        (WTF::):
+        (WTF::GRefPtr::GRefPtr):
+        (WTF::GRefPtr::~GRefPtr):
+        (WTF::GRefPtr::clear):
+        (WTF::GRefPtr::get):
+        (WTF::GRefPtr::operator*):
+        (WTF::GRefPtr::operator->):
+        (WTF::GRefPtr::operator!):
+        (WTF::GRefPtr::operator UnspecifiedBoolType):
+        (WTF::GRefPtr::hashTableDeletedValue):
+        (WTF::::operator):
+        (WTF::::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+        (WTF::adoptGRef):
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+
+2009-12-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2009-12-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/7355025> Interpreter::privateExecute macro generates
+        bloated code
+        
+        This patch cuts Interpreter stack use by about a third.
+
+        * bytecode/Opcode.h: Changed Opcode to const void* to work with the
+        const static initiliazation we want to do in Interpreter::privateExecute.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter): Moved hashtable initialization here to
+        avoid polluting Interpreter::privateExecute's stack, and changed it from a
+        series of add() calls to one add() call in a loop, to cut down on code size.
+
+        (JSC::Interpreter::privateExecute): Changed a series of label computations
+        to a copy of a compile-time constant array to cut down on code size.
+
+2009-12-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Disable debug variants of WebKit frameworks.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "r=me" Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32498
+        <rdar://problem/7471495>
+        REGRESSION(r51978-r52039): AJAX "Mark This Forum Read" function no longer
+        works
+        
+        Fixed a tyop.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd): Use the '&&' operator, not the ',' operator.
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the windows build: don't export this inlined function.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Inlined JSCell's operator new.
+        
+        3.7% speedup on bench-allocate-nonretained.js.
+
+        * JavaScriptCore.exp:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+
+2009-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed the number heap, replacing it with a one-item free list for
+        numbers, taking advantage of the fact that two number cells fit inside
+        the space for one regular cell, and number cells don't require destruction.
+        
+        SunSpider says 1.6% faster in JSVALUE32 mode (the only mode that
+        heap-allocates numbers).
+        
+        SunSpider says 1.1% faster in JSVALUE32_64 mode. v8 says 0.8% faster
+        in JSVALUE32_64 mode. 10% speedup on bench-alloc-nonretained.js. 6%
+        speedup on bench-alloc-retained.js.
+        
+        There's a lot of formulaic change in this patch, but not much substance.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlockPtr):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::allocate):
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells):
+        (JSC::Heap::sweep):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * runtime/Collector.h:
+        (JSC::): Removed all code pertaining to the number heap, and changed all
+        heap template functions and classes to non-template functions and classes.
+
+        (JSC::Heap::allocateNumber): A new optimization to replace the number
+        heap: allocate half-sized number cells in pairs, returning the first
+        cell and caching the second cell for the next allocation.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::LiveObjectIterator::LiveObjectIterator):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::DeadObjectIterator):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::ObjectIterator):
+        (JSC::ObjectIterator::operator++):
+        * runtime/JSCell.h:
+        (JSC::JSCell::isNumber): Removed all code pertaining to the number heap,
+        and changed all heap template functions and classes to non-template functions
+        and classes.
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WeakGCMap class
+        https://bugs.webkit.org/show_bug.cgi?id=32547
+
+        Inherits WeakGCMap from FastAllocBase because it is instantiated by
+        'new' at: WebCore/dom/Document.cpp:512.
+
+        * runtime/WeakGCMap.h:
+
+2009-12-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for dtoa's P5Node struct
+        https://bugs.webkit.org/show_bug.cgi?id=32544
+
+        Inherits P5Node struct from Noncopyable because it is instantiated by
+        'new' at wtf/dtoa.cpp:588 and don't need to be copyable.
+
+        * wtf/dtoa.cpp:
+
+2009-12-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32524
+        REGRESSION(52084): fast/dom/prototypes.html failing two CSS tests
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): The original patch put the parentheses in the wrong
+        place, completely changing the calculation and making it almost always
+        wrong. Moved the parentheses around the '+' operation, like the original
+        compiler warning suggested.
+
+2009-12-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix.
+
+        Fix crosses initialization of usedPrimaryBlocks for JSValue32
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+
+2009-12-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        GCC 4.3.x warning fixed. Suggested parantheses added.
+        warning: ../../../JavaScriptCore/wtf/StdLibExtras.h:77: warning: suggest parentheses around + or - in operand of &
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed GC from mark-sweep to mark-allocate.
+        
+        Added WeakGCMap to keep WebCore blissfully ignorant about objects that
+        have become garbage but haven't run their destructors yet.
+        
+        1% SunSpider speedup.
+        7.6% v8 speedup (37% splay speedup).
+        17% speedup on bench-alloc-nonretained.js.
+        18% speedup on bench-alloc-retained.js.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated for renames and new
+        files.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Updated to use the Collector
+        iterator abstraction.
+
+        * jsc.cpp:
+        (functionGC): Updated for rename.
+
+        * runtime/Collector.cpp: Slightly reduced the number of allocations per
+        collection, so that small workloads only allocate on collector block,
+        rather than two.
+
+        (JSC::Heap::Heap): Updated to use the new allocateBlock function.
+
+        (JSC::Heap::destroy): Updated to use the new freeBlocks function.
+
+        (JSC::Heap::allocateBlock): New function to initialize a block when
+        allocating it.
+
+        (JSC::Heap::freeBlock): Consolidated the responsibility for running
+        destructors into this function.
+
+        (JSC::Heap::freeBlocks): Updated to use freeBlock.
+
+        (JSC::Heap::recordExtraCost): Sweep the heap in this reporting function,
+        so that allocation, which is more common, doesn't have to check extraCost.
+
+        (JSC::Heap::heapAllocate): Run destructors right before recycling a
+        garbage cell. This has better cache utilization than a separate sweep phase.
+
+        (JSC::Heap::resizeBlocks):
+        (JSC::Heap::growBlocks):
+        (JSC::Heap::shrinkBlocks): New set of functions for managing the size of
+        the heap, now that the heap doesn't maintain any information about its
+        size.
+
+        (JSC::isPointerAligned):
+        (JSC::isHalfCellAligned):
+        (JSC::isPossibleCell):
+        (JSC::isCellAligned):
+        (JSC::Heap::markConservatively): Cleaned up this code a bit.
+
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells): Some helper functions for examining the the mark
+        bitmap.
+
+        (JSC::Heap::sweep): Simplified this function by using a DeadObjectIterator.
+
+        (JSC::Heap::markRoots): Reordered some operations for clarity.
+
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToStatistics):
+        (JSC::Heap::statistics): Rewrote these functions to calculate an object
+        count on demand, since the heap doesn't maintain this information by 
+        itself.
+
+        (JSC::Heap::reset): New function for resetting the heap once we've
+        exhausted heap space.
+
+        (JSC::Heap::collectAllGarbage): This function matches the old collect()
+        behavior, but it's now an uncommon function used only by API.
+
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::count):
+        (JSC::CollectorBitmap::isEmpty): Added some helper functions for managing
+        the collector mark bitmap.
+
+        (JSC::Heap::reportExtraMemoryCost): Changed reporting from cell equivalents
+        to bytes, so it's easier to understand.
+        
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::CollectorHeapIterator):
+        (JSC::CollectorHeapIterator::operator!=):
+        (JSC::CollectorHeapIterator::operator*):
+        (JSC::CollectorHeapIterator::advance):
+        (JSC::::LiveObjectIterator):
+        (JSC::::operator):
+        (JSC::::DeadObjectIterator):
+        (JSC::::ObjectIterator): New iterators for encapsulating details about
+        heap layout, and what's live and dead on the heap.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength): Delay reporting extra cost until
+        we're fully constructed, so the heap mark phase won't visit us in an
+        invalid state.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::JSCell::JSCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Added a dummy cell to simplify allocation logic.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring): Don't report extra cost for substrings, since they
+        share a buffer that's already reported extra cost.
+
+        * runtime/Tracing.d:
+        * runtime/Tracing.h: Changed these dtrace hooks not to report object
+        counts, since they're no longer cheap to compute.
+
+        * runtime/UString.h: Updated for renames.
+
+        * runtime/WeakGCMap.h: Added.
+        (JSC::WeakGCMap::isEmpty):
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedBegin):
+        (JSC::WeakGCMap::uncheckedEnd):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove): Mentioned above.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount): Added a bit population count function, so the heap can
+        count live objects to fulfill statistics questions.
+
+The very last cell in the block is not allocated -- should not be marked.
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Export some new symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some old exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Use unsigned instead of uint32_t to avoid dependencies.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitCount):
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative Windows build fix).
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+
+2009-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32496
+        Switch remaining cases of string construction to use StringBuilder.
+        Builds strings using a vector rather than using string append / addition.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::indent):
+        * runtime/JSString.h:
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+        (JSC::stringProtoFuncConcat):
+
+2009-12-08  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add code to allow toggling ATSUI/Core Text rendering at runtime in ComplexTextController.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        The goal here is to allow for a zero runtime hit for ports that decide to select
+        the API at compile time.
+        When both USE(ATSUI) and USE(CORE_TEXT) are true, the API is toggled
+        at runtime.  Core Text is used for OS Versions >= 10.6.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT and USE_ATSUI on Chrome/Mac.
+
+2009-12-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Unify codegen for forward and backward variants of branches
+        https://bugs.webkit.org/show_bug.cgi?id=32463
+
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop): Implemented in terms of forward variant.
+        (JSC::JIT::emit_op_loop_if_true): ditto
+        (JSC::JIT::emitSlow_op_loop_if_true): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        (JSC::JIT::emit_op_loop_if_less): ditto
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        * jit/JITOpcodes.cpp:
+
+2009-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Allow WTFs concept of the main thread to differ from pthreads when necessary.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-12-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32454
+        Refactor construction of simple strings to avoid string concatenation.
+
+        Building strings through concatenation has a memory and performance cost -
+        a memory cost since we must over-allocate the buffer to leave space to append
+        into, and performance in that the string may still require reallocation (and
+        thus copying during construction).  Instead move the full construction to
+        within a single function call (makeString), so that the arguments' lengths
+        can be calculated and an appropriate sized buffer allocated before copying
+        any characters.
+
+        ~No performance change (~2% progression on date tests).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatDate):
+        (JSC::formatDateUTCVariant):
+        (JSC::formatTime):
+        (JSC::formatTimeUTC):
+        * runtime/DateConversion.h:
+        (JSC::):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToGMTString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        * runtime/UString.h:
+        (JSC::):
+        (JSC::makeString):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        Re-landing r51975 - added toPrimitiveString method,
+        performs toPrimitive then subsequent toString operations.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added
+        $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Move QuartzCorePresent.h to include/private
+
+        This fixes other projects that use wtf/Platform.h
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS do its thang.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Write
+        QuartzCorePresent.h to $(WebKitOutputDir)/include/private.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        Added $(WebKitOutputDir)/include/private to the include path.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Fix clean builds and everything rebuilding on every build
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Don't
+        write out QuartzCorePresent.h if it exists but is older than
+        QuartzCore.h. Also, create the directory we write QuartzCorePresent.h
+        into first.
+
+2009-12-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix for systems with spaces in their paths
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Quote some paths.
+
+2009-12-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add check for presence of QuartzCore headers
+        https://bugs.webkit.org/show_bug.cgi?id=31856
+        
+        The script now checks for the presence of QuartzCore.h. If present
+        it will turn on ACCELERATED_COMPOSITING and 3D_RENDERING to enable
+        HW compositing on Windows. The script writes QuartzCorePresent.h to
+        the build directory which has a define telling whether QuartzCore is 
+        present.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * wtf/Platform.h:
+
+2009-12-11  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix a problem that JSC::gregorianDateTimeToMS() returns a negative
+        value for a huge year value.
+        https://bugs.webkit.org/show_bug.cgi?id=32304
+
+        * wtf/DateMath.cpp:
+        (WTF::dateToDaysFrom1970): Renamed from dateToDayInYear, and changed the return type to double.
+        (WTF::calculateDSTOffset): Follow the dateToDaysFrom1970() change.
+        (WTF::timeClip): Use maxECMAScriptTime.
+        (JSC::gregorianDateTimeToMS): Follow the dateToDaysFrom1970() change.
+
+2009-12-10  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r51975.
+        http://trac.webkit.org/changeset/51975
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect caching of prototype lookup with dictionary base
+        https://bugs.webkit.org/show_bug.cgi?id=32402
+
+        Make sure we don't add cached prototype lookup to the proto_list
+        lookup chain if the top level object is a dictionary.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32400
+        Switch remaining cases of string addition to use ropes.
+
+        ~1% progression on Sunspidey.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::appendStringInConstruct):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+
+2009-12-10  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove JSObject::getPropertyAttributes() and all usage of it.
+        https://bugs.webkit.org/show_bug.cgi?id=31933
+
+        getOwnPropertyDescriptor() should be used instead.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        * debugger/DebuggerActivation.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::propertyIsEnumerable):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+
+2009-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32367
+        Add support for short Ropes (up to 3 entries) inline within JSString.
+        (rather than externally allocating an object to hold the rope).
+        Switch jsAdd of (JSString* + JSString*) to now make use of Ropes.
+
+        ~1% progression on Sunspidey.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::deref):
+        (JSC::JSString::Rope::Fiber::ref):
+        (JSC::JSString::Rope::Fiber::refAndGetLength):
+        (JSC::JSString::Rope::append):
+        (JSC::JSString::JSString):
+        (JSC::JSString::~JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::length):
+        (JSC::JSString::canGetIndex):
+        (JSC::JSString::appendStringInConstruct):
+        (JSC::JSString::appendValueInConstructAndIncrementLength):
+        (JSC::JSString::isRope):
+        (JSC::JSString::string):
+        (JSC::JSString::ropeLength):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsAdd):
+        (JSC::resolveBase):
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix three more things found by compiling with clang++.
+        
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        Add the 'std' qualifier to the call to make_pair.
+
+        * wtf/DateMath.cpp:
+        (WTF::initializeDates):
+        Incrementing a bool is deprecated according to the C++ specification.
+        
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        Name lookup should not be done in dependent bases, so explicitly qualify the call to set.
+
+2009-12-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Google reader gets stuck in the "Loading..." state and does not complete
+        https://bugs.webkit.org/show_bug.cgi?id=32256
+        <rdar://problem/7456388>
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless): Fix some backward branches.
+
+2009-12-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32228
+        Make destruction of ropes non-recursive to prevent stack exhaustion.
+        Also, pass a UString& into initializeFiber rather than a Ustring::Rep*,
+        since the Rep is not being ref counted this could result in usage of a
+        Rep with refcount zero (where the Rep comes from a temporary UString
+        returned from a function).
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::destructNonRecursive):
+        (JSC::JSString::Rope::~Rope):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::initializeFiber):
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+
+2009-12-09  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Update to r51457. ASSERTs changed to COMPILE_ASSERTs.
+        The speedup is 25%.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-12-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Updates Android Makefiles with latest additions.
+        https://bugs.webkit.org/show_bug.cgi?id=32278
+
+        * Android.mk: Modified.
+        * Android.v8.wtf.mk: Modified.
+
+2009-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix a bug found while trying to compile JavaScriptCore with clang++.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm): Don't self assign here.  Use false instead.
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Attempt to fix the Windows build.
+        
+        * wtf/FastMalloc.h:
+
+2009-12-09  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix some things found while trying to compile JavaScriptCore with clang++.
+
+        * wtf/FastMalloc.h:
+        Add correct exception specifications for the allocation/deallocation operators.
+        
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        Fix a bunch of struct/class mismatches.
+
+2009-12-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        move code generation portions of Nodes.cpp to bytecompiler directory
+        https://bugs.webkit.org/show_bug.cgi?id=32284
+
+        * bytecompiler/NodesCodegen.cpp: Copied from parser/Nodes.cpp. Removed parts that
+        are not about codegen.
+        * parser/Nodes.cpp: Removed everything that is about codegen.
+
+        Update build systems:
+        
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-12-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Mac plugins support.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=32236
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by David Levin.
+
+        Revert and reopen "Add asserts to RefCounted to make sure ref/deref happens on the right thread."
+        It may have caused massive increase of reported leaks on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref):
+        (WTF::RefCountedBase::hasOneRef):
+        (WTF::RefCountedBase::refCount):
+        (WTF::RefCountedBase::derefBase):
+        * wtf/ThreadVerifier.h: Removed.
+
+2009-12-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Darin Adler.
+
+        Make WebKit build correctly on FreeBSD, IA64, and Alpha.
+        Based on work by Petr Salinger <Petr.Salinger@seznam.cz>,
+        and Colin Watson <cjwatson@ubuntu.com>.
+
+        * wtf/Platform.h:
+
+2009-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Disable thread verification on this class since it uses addressOfCount().
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Add ASSERT.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::derefBase): Ditto.
+        (WTF::RefCountedBase::disableThreadVerification): delegate to ThreadVerifier method.
+        * wtf/ThreadVerifier.h: Added.
+        (WTF::ThreadVerifier::ThreadVerifier): New Debug-only class to verify that ref/deref of RefCounted is done on the same thread.
+        (WTF::ThreadVerifier::activate): Activates checks. Called when ref count becomes above 2.
+        (WTF::ThreadVerifier::deactivate): Deactivates checks. Called when ref count drops below 2.
+        (WTF::ThreadVerifier::disableThreadVerification): used on objects that should not be checked (StringImpl etc)
+        (WTF::ThreadVerifier::verifyThread):
+        * GNUmakefile.am: Add ThreadVerifier.h to the build file.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+2009-12-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        [Android] Adds Makefiles for Android port.
+        https://bugs.webkit.org/show_bug.cgi?id=31325
+
+        * Android.mk: Added.
+        * Android.v8.wtf.mk: Added.
+
+2009-12-07  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove ENABLE_SHARED_SCRIPT flags
+        https://bugs.webkit.org/show_bug.cgi?id=32245
+        This patch was obtained by "git revert" command and then un-reverting of ChangeLog files.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-12-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fixage part I).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32184
+        Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
+        Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toString):
+        * API/JSValueRef.cpp:
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/Profiler.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getString):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getString):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::createOrNull):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::getIndex):
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::JSValue::toString):
+        * runtime/JSValue.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/Operations.cpp:
+        (JSC::JSValue::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::equalTo):
+        * runtime/PropertyDescriptor.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+
+2009-12-07  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Holger Freyther.
+
+        Turn on (SVG) Filters support, by default.
+        https://bugs.webkit.org/show_bug.cgi?id=32224
+
+        * Configurations/FeatureDefines.xcconfig: Enable FILTERS build flag.
+
+2009-12-07  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Be flexible about which version of ICU is used on Windows.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Add optional xcopy commands to copy ICU 4.2.
+
+2009-12-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        op_loop_if_less JIT codegen is broken for 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=32221
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false): Fix codegen in this version - test was backwards.
+
+2009-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.create fails if properties on the descriptor are getters
+        https://bugs.webkit.org/show_bug.cgi?id=32219
+
+        Correctly initialise the PropertySlots with the descriptor object.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Actually tested 64-bit *and* 32-bit build this time.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really really fix 64-bit build for prior patch (actually tested this time).
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_false):
+        (JSC::JIT::emitSlow_op_loop_if_false):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Really fix 64-bit build for prior patch.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless):
+
+2009-12-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Fix 64-bit build for prior patch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-12-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        conway benchmark spends half it's time in op_less (jump fusion fails)
+        https://bugs.webkit.org/show_bug.cgi?id=32190
+
+        <1% speedup on SunSpider and V8
+        2x speedup on "conway" benchmark
+        
+        Two optimizations:
+        1) Improve codegen for logical operators &&, || and ! in a condition context
+        
+        When generating code for combinations of &&, || and !, in a
+        condition context (i.e. in an if statement or loop condition), we
+        used to produce a value, and then separately jump based on its
+        truthiness. Now we pass the false and true targets in, and let the
+        logical operators generate jumps directly. This helps in four
+        ways:
+
+        a) Individual clauses of a short-circuit logical operator can now
+        jump directly to the then or else clause of an if statement (or to
+        the top or exit of a loop) instead of jumping to a jump.
+        
+        b) It used to be that jump fusion with the condition of the first
+        clause of a logical operator was inhibited, because the register
+        was ref'd to be used later, in the actual condition jump; this no
+        longer happens since a jump straight to the final target is
+        generated directly.
+
+        c) It used to be that jump fusion with the condition of the second
+        clause of a logical operator was inhibited, because there was a
+        jump target right after the second clause and before the actual
+        condition jump. But now it's no longer necessary for the first
+        clause to jump there so jump fusion is not blocked.
+
+        d) We avoid generating excess mov statements in some cases.
+        
+        As a concrete example this source:
+        
+        if (!((x < q && y < q) || (t < q && z < q))) {
+            // ...
+        }
+        
+        Used to generate this bytecode:
+        
+        [  34] less              r1, r-15, r-19
+        [  38] jfalse            r1, 7(->45)
+        [  41] less              r1, r-16, r-19
+        [  45] jtrue             r1, 14(->59)
+        [  48] less              r1, r-17, r-19
+        [  52] jfalse            r1, 7(->59)
+        [  55] less              r1, r-18, r-19
+        [  59] jtrue             r1, 17(->76)
+        
+        And now generates this bytecode (also taking advantage of the second optimization below):
+        
+        [  34] jnless            r-15, r-19, 8(->42)
+        [  38] jless             r-16, r-19, 26(->64)
+        [  42] jnless            r-17, r-19, 8(->50)
+        [  46] jless             r-18, r-19, 18(->64)
+        
+        Note the jump fusion and the fact that there's less jump
+        indirection - three of the four jumps go straight to the target
+        clause instead of indirecting through another jump.
+        
+        2) Implement jless opcode to take advantage of the above, since we'll now often generate
+        a less followed by a jtrue where fusion is not forbidden.
+       
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::hasConditionContextCodegen): Helper function to determine
+        whether a node supports special conditional codegen. Return false as this is the default.
+        (JSC::ExpressionNode::emitBytecodeInConditionContext): Assert not reached - only really
+        defined for nodes that do have conditional codegen.
+        (JSC::UnaryOpNode::expr): Add const version.
+        (JSC::LogicalNotNode::hasConditionContextCodegen): Returne true only if subexpression
+        supports it.
+        (JSC::LogicalOpNode::hasConditionContextCodegen): Return true.
+        * parser/Nodes.cpp:
+        (JSC::LogicalNotNode::emitBytecodeInConditionContext): Implemented - just swap
+        the true and false targets for the child node.
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext): Implemented - handle jumps
+        directly, improving codegen quality. Also handles further nested conditional codegen.
+        (JSC::ConditionalNode::emitBytecode): Use condition context codegen when available.
+        (JSC::IfNode::emitBytecode): ditto
+        (JSC::IfElseNode::emitBytecode): ditto
+        (JSC::DoWhileNode::emitBytecode): ditto
+        (JSC::WhileNode::emitBytecode): ditto
+        (JSC::ForNode::emitBytecode): ditto
+
+        * bytecode/Opcode.h: 
+        - Added loop_if_false opcode - needed now that falsey jumps can be backwards.
+        - Added jless opcode to take advantage of new fusion opportunities.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Handle above.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfTrue): Add peephole for less + jtrue ==> jless.
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add handling of backwrds falsey jumps.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInConditionContext): Wrapper to handle tracking of
+        overly deep expressions etc.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Implement the two new opcodes (loop_if_false, jless).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Implement JIT support for the two new opcodes.
+        (JSC::JIT::privateCompileSlowCases): ditto
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless): ditto
+        (JSC::JIT::emitBinaryDoubleOp): ditto
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_if_less): ditto
+        (JSC::JIT::emit_op_loop_if_false): ditto
+        (JSC::JIT::emitSlow_op_loop_if_false): ditto
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-12-04  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        JavaScript delete operator should return false for string properties
+        https://bugs.webkit.org/show_bug.cgi?id=32012
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+
+2009-12-03  Drew Wilson  <atwilson@chromium.org>
+
+        Rolled back r51633 because it causes a perf regression in Chromium.
+
+        * wtf/Platform.h:
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Export a symbol that should be exported.
+
+2009-12-03  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Mac build.
+
+        * JavaScriptCore.exp:  Export a symbol that should be exported.
+
+2009-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(4.0.3-48777): Crash in JSC::ExecState::propertyNames() (Debug-only?)
+        https://bugs.webkit.org/show_bug.cgi?id=32133
+
+        Work around odd GCC-ism and correct the scopechain for use by
+        calls made while a cachedcall is active on the callstack.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Brraaaaiiiinnnnnzzzzzzzz" Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32136
+        Add a rope representation to JSString.  Presently JSString always holds its data in UString form.
+        Instead, allow the result of a string concatenation to be represented in a tree form - with a
+        variable sized, reference-counted rope node retaining a set of UString::Reps (or other rope nopes).
+
+        Strings must still currently be resolved down to a flat UString representation before being used,
+        but by holding the string in a rope representation during construction we can avoid copying data
+        until we know the final size of the string.
+
+        ~2% progression on SunSpider (~25% on date-format-xparb, ~20% on string-validate-input).
+
+        * JavaScriptCore.exp:
+
+            - Update exports.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            - Switch the string length trampoline to read the length directly from JSString::m_length,
+              rather than from the JSString's UString::Rep's 'len' property.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            - Modify op_add such that addition of two strings, where either or both strings are already
+              in rope representation, produces a rope as a result.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::Rope::~Rope):
+        (JSC::copyChars):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toBoolean):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toString):
+        (JSC::JSString::toThisString):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::Rope::Fiber::Fiber):
+        (JSC::JSString::Rope::Fiber::destroy):
+        (JSC::JSString::Rope::Fiber::isRope):
+        (JSC::JSString::Rope::Fiber::rope):
+        (JSC::JSString::Rope::Fiber::string):
+        (JSC::JSString::Rope::create):
+        (JSC::JSString::Rope::initializeFiber):
+        (JSC::JSString::Rope::ropeLength):
+        (JSC::JSString::Rope::stringLength):
+        (JSC::JSString::Rope::fibers):
+        (JSC::JSString::Rope::Rope):
+        (JSC::JSString::Rope::operator new):
+        (JSC::JSString::JSString):
+        (JSC::JSString::value):
+        (JSC::JSString::length):
+        (JSC::JSString::isRope):
+        (JSC::JSString::rope):
+        (JSC::JSString::string):
+        (JSC::JSString::canGetIndex):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::JSString::getIndex):
+        (JSC::jsSubstring):
+        (JSC::JSString::getStringPropertySlot):
+
+            - Add rope form.
+
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        (JSC::concatenateStrings):
+
+            - Update string concatenation, and addition of ropes, to produce ropes.
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+
+            - Make use of new JSString::length() method to avoid prematurely resolving ropes.
+
+2009-11-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch Chrome/Mac to use Core Text APIs rather than ATSUI APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=31802
+
+        No test since this is already covered by existing pixel tests.
+
+        * wtf/Platform.h: #define USE_CORE_TEXT for Chrome/Mac.
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add files missed in prior patch.
+
+        * runtime/JSZombie.cpp:
+        (JSC::):
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h: Added.
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::isZombie):
+        (JSC::JSZombie::classInfo):
+        (JSC::JSZombie::isGetterSetter):
+        (JSC::JSZombie::isAPIValueWrapper):
+        (JSC::JSZombie::isPropertyNameIterator):
+        (JSC::JSZombie::getCallData):
+        (JSC::JSZombie::getConstructData):
+        (JSC::JSZombie::getUInt32):
+        (JSC::JSZombie::toPrimitive):
+        (JSC::JSZombie::getPrimitiveNumber):
+        (JSC::JSZombie::toBoolean):
+        (JSC::JSZombie::toNumber):
+        (JSC::JSZombie::toString):
+        (JSC::JSZombie::toObject):
+        (JSC::JSZombie::markChildren):
+        (JSC::JSZombie::put):
+        (JSC::JSZombie::deleteProperty):
+        (JSC::JSZombie::toThisObject):
+        (JSC::JSZombie::toThisString):
+        (JSC::JSZombie::toThisJSString):
+        (JSC::JSZombie::getJSNumber):
+        (JSC::JSZombie::getOwnPropertySlot):
+
+2009-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add zombies to JSC
+        https://bugs.webkit.org/show_bug.cgi?id=32103
+
+        Add a compile time flag to make the JSC collector replace "unreachable"
+        objects with zombie objects.  The zombie object is a JSCell subclass that
+        ASSERTs on any attempt to use the JSCell methods.  In addition there are
+        a number of additional assertions in bottleneck code to catch zombie usage
+        as quickly as possible.
+
+        Grrr. Argh. Brains.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isZombie):
+        (JSC::JSValue::isZombie):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        * wtf/Platform.h:
+
+2009-12-01  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added variants of find/contains/add that allow a foreign key type to be used.
+        This will allow AtomicString-keyed maps to be queried by C string without
+        having to create a temporary AtomicString (see HTTPHeaderMap.)
+        The code for this is adapted from the equivalent in HashSet.h.
+
+        * wtf/HashMap.h:
+        (WTF::HashMap::find):
+        (WTF::HashMap::contains):
+        (WTF::HashMap::add):
+        * wtf/HashSet.h: Changed "method" to "function member" in a comment.
+
+2009-12-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Revert 51551 because it broke GTK+.
+
+        * wtf/Platform.h:
+
+2009-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows Build fix.  Reviewed by NOBODY.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 31859 - Make world selection for JSC IsolatedWorlds automagical.
+
+        WebCore presently has to explicitly specify the world before entering into JSC,
+        which is a little fragile (particularly since property access via a
+        getter/setter might invoke execution). Instead derive the current world from
+        the lexical global object.
+        
+        Remove the temporary duct tape of willExecute/didExecute virtual hooks on the JSGlobalData::ClientData - these are no longer necessary.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+
+2009-11-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove obsolete PLATFORM(KDE) code
+        https://bugs.webkit.org/show_bug.cgi?id=31958
+
+        KDE is now using unpatched QtWebKit.
+
+        * parser/Lexer.cpp: Remove obsolete KDE_USE_FINAL guard
+        * wtf/Platform.h: Remove PLATFORM(KDE) definition and code 
+        section that is guarded with it.
+
+2009-11-30  Jan-Arve Sæther  <jan-arve.saether@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix compilation with win32-icc
+
+        The Intel compiler does not support the __has_trivial_constructor type
+        trait.  The Intel Compiler can report itself as _MSC_VER >= 1400. The
+        reason for that is that the Intel Compiler depends on the Microsoft
+        Platform SDK, and in order to try to be "fully" MS compatible it will
+        "pretend" to be the same MS compiler as was shipped with the MS PSDK.
+        (Thus, compiling with win32-icc with VC8 SDK will make the source code
+        "think" the compiler at hand supports this type trait).
+
+        * wtf/TypeTraits.h:
+
+2009-11-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Mac build has JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=31828
+
+        * wtf/Platform.h: Enable JIT for Qt Mac builds
+
+2009-11-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Apply workaround for the limitation of VirtualFree with MEM_RELEASE to all ports running on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=31943
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+
+2009-11-28  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31930
+
+        Seems a typo. We don't need ~270k memory to determine the vptrs.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+
+2009-11-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Unreviewed. 
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        Build fix for chromium after r51423.
+        Exclude gtk directory from chromium build.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect behaviour of jneq_null in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=31901
+
+        Correct the logic of jneq_null.  This is already covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move GOwnPtr* from wtf to wtf/gtk
+        https://bugs.webkit.org/show_bug.cgi?id=31793
+
+        * GNUmakefile.am: Change the path for GOwnPtr.*.
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Remove
+          GOwnPtr.cpp from the exclude list.
+        * JavaScriptCore.gypi: Change the path for GOwnPtr.*.
+        * wscript: Remove GOwnPtr.cpp from the exclude list.
+        * wtf/GOwnPtr.cpp: Removed.
+        * wtf/GOwnPtr.h: Removed.
+        * wtf/Threading.h: Change the path for GOwnPtr.h.
+        * wtf/gtk/GOwnPtr.cpp: Copied from JavaScriptCore/wtf/GOwnPtr.cpp.
+        * wtf/gtk/GOwnPtr.h: Copied from JavaScriptCore/wtf/GOwnPtr.h.
+        * wtf/unicode/glib/UnicodeGLib.h: Change the path for GOwnPtr.h.
+
+2009-11-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE_SHARED_SCRIPT feature define and flag for build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=31444
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-11-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add ability to enable ACCELERATED_COMPOSITING on Windows (currently disabled)
+        https://bugs.webkit.org/show_bug.cgi?id=27314
+
+        * wtf/Platform.h:
+
+2009-11-24  Jason Smith  <dark.panda@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        RegExp#exec's returned Array-like object behaves differently from
+        regular Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=31689
+
+        * JavaScriptCore/runtime/RegExpConstructor.cpp: ensure that undefined
+        values are added to the returned RegExpMatchesArray
+
+2009-11-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON.stringify performance on undefined is very poor
+        https://bugs.webkit.org/show_bug.cgi?id=31839
+
+        Switch from a UString to a Vector<UChar> when building
+        the JSON string, allowing us to safely remove the substr-copy
+        we otherwise did when unwinding an undefined property.
+
+        Also turns out to be a ~5% speedup on stringification.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::StringBuilder::append):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+
+2009-11-24  Mark Rowe  <mrowe@apple.com>
+
+        Fix production builds where the source tree may be read-only.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Include "config.h" to meet Coding Style Guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=31792
+
+        * wtf/unicode/UTF8.cpp:
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        * wtf/unicode/wince/UnicodeWince.cpp:
+
+2009-11-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Streamlined some Math functions where we expect or know the result not
+        to be representable as an int.
+        
+        SunSpider says 0.6% faster.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::jsDoubleNumber):
+        (JSC::JSValue::JSValue): Added a function for making a numeric JSValue
+        and skipping the "can I encode this as an int?" check, avoiding the
+        overhead of int <-> double roundtripping and double <-> double comparison
+        and branching.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan): For these functions, which we expect or know
+        to produce results not representable as ints, call jsDoubleNumber instead
+        of jsNumber.
+
+2009-11-23  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed. Unbreak the regression tests after r51329.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Null-check clientData before dereferencing it.
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction): Ditto.
+
+2009-11-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Part 1/3 of <rdar://problem/7377477> REGRESSION: Many web pages fail to render after interesting script runs in isolated world
+
+        Some clients of the JavaScriptCore API expect to be able to make callbacks over the JSC API,
+        and for this to automagically cause execution to take place in the world associated with the
+        global object associated with the ExecState (JSContextRef) passed.  However this is not how
+        things work - the world must be explicitly set within WebCore.
+
+        Making this work just for API calls to evaluate & call will be a far from perfect solution,
+        since direct (non-API) use of JSC still relies on WebCore setting the current world correctly.
+        A better solution would be to make this all work automagically all throughout WebCore, but this
+        will require more refactoring.
+
+        Since the API is in JSC but worlds only exist in WebCore, add callbacks on the JSGlobalData::ClientData
+        to allow it to update the current world on entry/exit via the JSC API.  This is temporary duck
+        tape, and should be removed once the current world no longer needs to be explicitly tracked.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::ClientData::beginningExecution):
+        (JSC::JSGlobalData::ClientData::completedExecution):
+        * runtime/JSGlobalData.h:
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Adds MainThreadAndroid.cpp with Android-specific WTF threading functions.
+        https://bugs.webkit.org/show_bug.cgi?id=31807
+
+        * wtf/android: Added.
+        * wtf/android/MainThreadAndroid.cpp: Added.
+        (WTF::timeoutFired):
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-11-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31748
+        Make WebSocketHandleCFNet respect proxy auto-configuration files via CFProxySupport
+
+        * JavaScriptCore.exp: Export callOnMainThreadAndWait.
+
+2009-11-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Symbian] Fix lastIndexOf() for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31773
+
+        Symbian soft floating point library has problems with operators
+        comparing NaN to numbers. Without a workaround lastIndexOf() 
+        function does not work.
+
+        Patch developed by David Leong.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):Add an extra test 
+        to check for NaN for Symbian.
+
+2009-11-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Android port lacks implementation of atomicIncrement and atomicDecrement.
+        https://bugs.webkit.org/show_bug.cgi?id=31715
+
+        * wtf/Threading.h: Modified.
+        (WTF::atomicIncrement): Added Android implementation.
+        (WTF::atomicDecrement): Added Android implementation.
+
+2009-11-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Sort source lists and remove obsolete comments 
+        from the build system.
+
+        * JavaScriptCore.pri:
+
+2009-11-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt][Mac] Turn on multiple JavaScript threads for QtWebkit on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=31753
+
+        * wtf/Platform.h:
+
+2009-11-19  Steve Block  <steveblock@google.com>
+
+        Android port lacks configuration in Platform.h and config.h.
+        https://bugs.webkit.org/show_bug.cgi?id=31671
+
+        * wtf/Platform.h: Modified. Added Android-specific configuration.
+
+2009-11-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31690
+        Make SocketStreamHandleCFNet work on Windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::FunctionWithContext):
+        (WTF::dispatchFunctionsFromMainThread):
+        (WTF::callOnMainThreadAndWait):
+        * wtf/MainThread.h:
+        Re-add callOnMainThreadAndWait(), which was removed in bug 23926.
+
+2009-11-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        isMainThread() on Chromium (Mac and Linux) is so slow it timeouts LayoutTests..
+        https://bugs.webkit.org/show_bug.cgi?id=31693
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): grab and use the pthread_t of the main thread instead of ThreadIdentifier.
+        (WTF::isMainThread): Ditto.
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(STRING_H) guard from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=31668
+
+        * config.h:
+        * runtime/UString.cpp:
+
+2009-11-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Fixing a bug in MessageQueue::removeIf() that leads to an
+        assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31657
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::removeIf):
+
+2009-11-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove HAVE(FLOAT_H) guard
+        https://bugs.webkit.org/show_bug.cgi?id=31661
+
+        JavaScriptCore has a dependency on float.h, there is
+        no need to guard float.h.
+
+        * runtime/DatePrototype.cpp: Remove include directive 
+        for float.h as it is included in MathExtras.h already.
+        * runtime/Operations.cpp: Ditto.
+        * runtime/UString.cpp: Ditto.
+        * wtf/dtoa.cpp: Ditto.
+        * wtf/MathExtras.h: Remove HAVE(FLOAT_H) guard.
+        * wtf/Platform.h: Ditto.
+
+2009-11-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix for 32-bit Sparc machines: these machines are big-endian.
+
+        * wtf/Platform.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove support for Qt v4.3 or older versions
+        https://bugs.webkit.org/show_bug.cgi?id=29469
+
+        * JavaScriptCore.pro:
+        * jsc.pro:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-11-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move UString::from(double) implementation to new
+        WTF::doubleToStringInJavaScriptFormat(), and expose it because WebCore
+        code will use it.
+        https://bugs.webkit.org/show_bug.cgi?id=31330
+
+        - Introduce new function createRep(const char*, unsigned) and
+          UString::UString(const char*, unsigned) to reduce 2 calls to strlen().
+        - Fix a bug that dtoa() doesn't update *rve if the input value is NaN
+          or Infinity.
+
+        No new tests because this doesn't change the behavior.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::UString::from): Move the code to doubleToStringInJavaScriptFormat().
+        * runtime/UString.h:
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Fix a bug about rve.
+        (WTF::append): A helper for doubleToStringInJavaScriptFormat().
+        (WTF::doubleToStringInJavaScriptFormat): Move the code from UString::from(double).
+        * wtf/dtoa.h:
+
+2009-11-18  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove WTF_USE_JAVASCRIPTCORE_BINDINGS as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=31643
+
+        * JavaScriptCore.pro:
+
+2009-11-18  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove Chromium's unnecessary dependency on wtf's tcmalloc files.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31648
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-18  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [Qt] Implement symbol hiding for JSC's JIT functions.
+
+        These functions are implemented directly in assembly, so they need the
+        proper directives to enable/disable visibility. On ELF systems, it's
+        .hidden, whereas on Mach-O systems (Mac) it's .private_extern. On
+        Windows, it's not necessary since you have to explicitly export. I
+        also implemented the AIX idiom, though it's unlikely anyone will
+        implement AIX/POWER JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=30864
+
+        * jit/JITStubs.cpp:
+
+2009-11-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Interpreter may do an out of range access when throwing an exception in the profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=31635
+
+        Add bounds check.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2009-11-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix the clobber list of cacheFlush for ARM and Thumb2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=31631
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-11-18  Harald Fernengel  <harald.fernengel@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix detection of linux-g++
+
+        Never use "linux-g++*" to check for linux-g++, since this will break embedded
+        builds which use linux-arm-g++ and friends. Use 'linux*-g++*' to check for any
+        g++ on linux mkspec.
+
+        * JavaScriptCore.pri:
+
+2009-11-17  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add JSContextRefPrivate.h to list of copied files.
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2009-11-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] Style cleanup for GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=31506
+
+        Remove forward declaration in GOwnPtr and do some style cleanup.
+
+        * wtf/GOwnPtr.cpp:
+        * wtf/GOwnPtr.h:
+        (WTF::GOwnPtr::GOwnPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::get):
+        (WTF::GOwnPtr::release):
+        (WTF::GOwnPtr::outPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        (WTF::GOwnPtr::operator*):
+        (WTF::GOwnPtr::operator->):
+        (WTF::GOwnPtr::operator!):
+        (WTF::GOwnPtr::operator UnspecifiedBoolType):
+        (WTF::GOwnPtr::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+        (WTF::freeOwnedGPtr):
+
+2009-11-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of JavaScriptCore API in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=31577
+
+        Add assertions to the 'toJS' functions to catch mistakes like
+        this early.  Restructure existing code which blindly passed potentially
+        null values to toJS when forwarding exceptions so that a null check is
+        performed first.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/tests/testapi.c: Fix errors in the API tester.
+        (MyObject_getProperty):
+        (MyObject_convertToType):
+        (EvilExceptionObject_convertToType):
+
+2009-11-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Minor fixes for JSVALUE32_64: branchConvertDoubleToInt32
+        failed on a CortexA8 CPU, but not on a simulator; and
+        JITCall.cpp modifications was somehow not committed to mainline.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::fmrs_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2009-11-16  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build on Windows CE 6.
+
+        * JavaScriptCore.pri: Add missing include path.
+        * wtf/Platform.h: Include ce_time.h for Windows CE 6.
+
+2009-11-13  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding optimization support for mode JSVALUE32_64
+        on ARM systems.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-11-14  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31050
+
+        Adding JSVALUE32_64 support for ARM (but not turning it
+        on by default). All optimizations must be disabled, since
+        this patch is only the first of a series of patches.
+
+        During the work, a lot of x86 specific code revealed and
+        made platform independent.
+        See revisions: 50531 50541 50593 50594 50595
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fdivd_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::branchOr32):
+        (JSC::MacroAssemblerARM::set8):
+        (JSC::MacroAssemblerARM::setTest8):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::zeroDouble):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        * wtf/StdLibExtras.h:
+
+2009-11-13  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify TextBoundaries implementations by only relying on WTF Unicode abstractions
+        https://bugs.webkit.org/show_bug.cgi?id=31468
+
+        Adding isAlphanumeric abstraction, required
+        by TextBoundaries.cpp.
+
+        * wtf/unicode/glib/UnicodeGLib.h:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::isAlphanumeric):
+
+2009-11-13  Norbert Leser  <norbert.leser&nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Added macros for USERINCLUDE paths within symbian blocks
+        to guarantee inclusion of respective header files from local path
+        first (to avoid clashes with same names of header files in system include path).
+
+        * JavaScriptCore.pri:
+
+2009-11-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSValueProtect and JSValueUnprotect don't protect API wrapper values
+        https://bugs.webkit.org/show_bug.cgi?id=31485
+
+        Make JSValueProtect/Unprotect use a new 'toJS' function, 'toJSForGC' that
+        does not attempt to to strip out API wrapper objects.
+
+        * API/APICast.h:
+        (toJSForGC):
+        * API/JSValueRef.cpp:
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/tests/testapi.c:
+        (makeGlobalNumberValue):
+        (main):
+
+2009-11-13  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Antti Koivisto.
+
+        Fix typo, ce_time.cpp should be ce_time.c
+
+        * JavaScriptCore.pri:
+
+2009-11-12  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Calculate the time offset only if we were able to parse
+        the date string. This saves an IPC in Chromium for
+        invalid date strings.
+        https://bugs.webkit.org/show_bug.cgi?id=31416
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::parseDateFromNullTerminatedCharacters):
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r50896 until i can work out why it causes failures.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Remove LIBRARY directive from def file to fix Debug_All target.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Holger Freyther.
+
+        Revert r50204, since it makes DRT crash on 32 bits release builds
+        for GTK+.
+
+        * wtf/FastMalloc.h:
+
+2009-11-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Start unifying entry logic for function and eval code.
+
+        Eval now uses a ret instruction to end execution, and sets up
+        a callframe more in line with what we do for function entry.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::emitBytecode):
+
+2009-11-12  Richard Moe Gustavsen  <richard.gustavsen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Disable pthread_setname_np.
+
+        This allows Qt builds on Mac from 10.6 to run on earlier version
+        where this symbol is not present.
+        https://bugs.webkit.org/show_bug.cgi?id=31403
+
+        * wtf/Platform.h:
+
+2009-11-12  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix linking on Linux 32-bit.
+
+        It was missing the ".text" directive at the top of the file,
+        indicating that code would follow. Without it, the assembler created
+        "NOTYPE" symbols, which would result in linker errors.
+        https://bugs.webkit.org/show_bug.cgi?id=30863
+
+        * jit/JITStubs.cpp:
+
+2009-11-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Refactor multiple JavaScriptCore threads
+        https://bugs.webkit.org/show_bug.cgi?id=31328
+
+        Remove the id field from the PlatformThread structure 
+        as it is not used.
+
+        * runtime/Collector.cpp:
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Linux build fix: Added an #include for UINT_MAX.
+
+        * runtime/WeakRandom.h:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptGlue build fix: Marked a file 'private' instead of 'project'.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-11-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "avGni arBalroguch" Barraclough.
+
+        Faster Math.random, based on GameRand.
+        
+        SunSpider says 1.4% faster.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added the header to the project.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h: Use an object to track random number generation
+        state, initialized to the current time.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom): Use the new hotness.
+
+        * runtime/WeakRandom.h: Added.
+        (JSC::WeakRandom::WeakRandom):
+        (JSC::WeakRandom::get):
+        (JSC::WeakRandom::advance): The new hotness.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Imported the v8 DST cache.
+        
+        SunSpider says 1.5% faster.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Reset the DST cache when resetting
+        other date data.
+
+        * runtime/JSGlobalData.h:
+        (JSC::DSTOffsetCache::DSTOffsetCache):
+        (JSC::DSTOffsetCache::reset): Added a struct for the DST cache.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateDSTOffsetSimple):
+        (WTF::calculateDSTOffset):
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getDSTOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: The imported code for probing and updating the cache.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed an edge case that could cause the engine not to notice a timezone
+        change.
+        
+        No test because this case would require manual intervention to change
+        the timezone during the test.
+        
+        SunSpider reports no change.
+
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::reset): Added a helper function for resetting
+        this cache. Also, shrank the cache, since we'll be resetting it often.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache): Include resetting the DateInstanceCache
+        in resetting Date data. (Otherwise, a cache hit could bypass a necessary
+        timezone update check.)
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some manual inlining and constant propogation in Date code.
+        
+        SunSpider reports a 0.4% speedup on date-*, no overall speedup. Shark
+        says some previously evident stalls are now gone.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatTime):
+        (JSC::formatTimeUTC): Split formatTime into UTC and non-UTC variants.
+
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::gregorianDateTime):
+        (JSC::DateInstance::gregorianDateTimeUTC): Split gregorianDateTime into
+        a UTC and non-UTC variant, and split each variant into a fast inline
+        case and a slow out-of-line case.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Updated for the gregorianDateTime change above.
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export a new symbol.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "Home Wrecker" Weinig.
+
+        Added a tiny cache for Date parsing.
+        
+        SunSpider says 1.2% faster.
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate): Try to reuse the last parsed Date, if present.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalData.h: Added storage for last parsed Date. Refactored
+        this code to make resetting the date cache easier.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
+        refactoring.
+
+        * wtf/DateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h: Changed ExecState to be first parameter, as is the JSC custom.
+
+2009-11-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Can cache prototype lookups on uncacheable dictionaries.
+        https://bugs.webkit.org/show_bug.cgi?id=31198
+
+        Replace fromDictionaryTransition with flattenDictionaryObject and
+        flattenDictionaryStructure.  This change is necessary as we need to
+        guarantee that our attempt to convert away from a dictionary structure
+        will definitely succeed, and in some cases this requires mutating the
+        object storage itself.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/JSObject.h:
+        (JSC::JSObject::flattenDictionaryObject):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::comparePropertyMapEntryIndices):
+        * runtime/Structure.h:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Remove extra character from r50701.
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Not reviewed, build fix.
+
+        Revert r50695 because it broke QtWebKit (clean builds).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Prepended $$PWD to GENERATED_SOURCES_DIR to avoid potential ambiguities when included from WebCore.pro.
+        Some preprocessors consider this GENERATED_SOURCES_DIR relative to current invoking dir (e.g., ./WebCore),
+        and not the working dir of JavaCriptCore.pri (i.e., ../JavaScriptCore/).
+
+        * JavaScriptCore.pri:
+
+2009-11-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use explicit parentheses to silence gcc 4.4 -Wparentheses warnings
+        https://bugs.webkit.org/show_bug.cgi?id=31040
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative snow leopard and windows build fixes).
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+        
+        Hopefully, the last build fix.
+
+        Create better separation in DateMath about the JSC
+        and non-JSC portions. Also, only expose the non-JSC
+        version in the exports.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (JSC::getUTCOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+        (JSC::gmtoffset):
+
+2009-11-08  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        For the change in DateMath.
+
+        * config.h:
+        * wtf/DateMath.cpp:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export some symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated export file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: added some #includes.
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2009-11-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31197
+        Implemented a timezone cache not based on Mac OS X's notify_check API.
+        
+        If the VM calculates the local timezone offset from UTC, it caches the
+        result until the end of the current VM invocation. (We don't want to cache
+        forever, because the user's timezone may change over time.)
+        
+        This removes notify_* overhead on Mac, and, more significantly, removes
+        OS time and date call overhead on non-Mac platforms.
+
+        ~8% speedup on Date microbenchmark on Mac. SunSpider reports maybe a tiny
+        speedup on Mac. (Speedup on non-Mac platforms should be even more noticeable.)
+
+        * JavaScriptCore.exp:
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Made the 
+        DynamicGlobalObjectScope constructor responsible for checking whether a
+        dynamicGlobalObject has already been set. This eliminated some duplicate
+        client code, and allowed me to avoid adding even more duplicate client
+        code. Made DynamicGlobalObjectScope responsible for resetting the
+        local timezone cache upon first entry to the VM.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/DateMath.cpp:
+        (WTF::getCurrentUTCTime):
+        (WTF::getCurrentUTCTimeWithMicroseconds):
+        (WTF::getLocalTime):
+        (JSC::getUTCOffset): Use the new cache. Also, see below.
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::initializeDates):
+        (JSC::parseDateFromNullTerminatedCharacters): Simplified the way this function
+        accounts for the local timezone offset, to accomodate our new caching API,
+        and a (possibly misguided) caller in WebCore. Also, see below.
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): Moved most of the code in
+        DateMath.* into the JSC namespace. The code needed to move so it could
+        naturally interact with ExecState and JSGlobalData to support caching.
+        Logically, it seemed right to move it, too, since this code is not really
+        as low-level as the WTF namespace might imply -- it implements a set of
+        date parsing and conversion quirks that are finely tuned to the JavaScript
+        language. Also removed the Mac OS X notify_* infrastructure.
+        
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime): Moved the rest of the DateMath code here, and renamed
+        it to make it consistent with WTF's currentTime function.
+
+2009-11-06  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Unreviewed trivial buildfix after r50595.
+
+        Rename the remaining rshiftPtr calls to rshift32
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitFastArithImmToInt):
+
+2009-11-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tidy up the shift methods on the macro-assembler interface.
+
+        Currently behaviour of shifts of a magnitude > 0x1f is undefined.
+        Instead defined that all shifts are masked to this range.  This makes a lot of
+        practical sense, both since having undefined behaviour is not particularly
+        desirable, and because this behaviour is commonly required (particularly since
+        it is required bt ECMA-262 for shifts).
+
+        Update the ARM assemblers to provide this behaviour.  Remove (now) redundant
+        masks from JITArithmetic, and remove rshiftPtr (this was used in case that
+        could be rewritten in a simpler form using rshift32, only optimized JSVALUE32
+        on x86-64, which uses JSVALUE64!)
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::rshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        * assembler/MacroAssemblerX86_64.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+
+2009-11-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Remove a magic number (1) from the JIT, instead compute the value with OBJECT_OFFSET.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument):
+        * jit/JITStubs.h:
+
+2009-11-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31159
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The x86 branchDouble behaviour is reworked, and all JIT
+        ports should follow the x86 port. See bug 31104 and 31151
+
+        This patch contains a fix for the traditional ARM port
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::fmrs_r):
+        (JSC::ARMAssembler::ftosid_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+
+2009-11-05  Chris Jerdonek  <chris.jerdonek@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Removed the "this is part of the KDE project" comments from 
+        all *.h, *.cpp, *.idl, and *.pm files.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=31167
+        
+        The maintenance and architecture page in the project wiki lists
+        this as a task.
+        
+        This change includes no changes or additions to test cases 
+        since the change affects only comments.
+        
+        * wtf/wince/FastMallocWince.h:
+
+2009-11-05  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Use ARMv7 specific encoding for immediate constants on ARMv7 target
+        https://bugs.webkit.org/show_bug.cgi?id=31060
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::getOp2): Use INVALID_IMM
+        (JSC::ARMAssembler::getImm): Use encodeComplexImm for complex immediate
+        (JSC::ARMAssembler::moveImm): Ditto.
+        (JSC::ARMAssembler::encodeComplexImm): Encode a constant by one or two
+        instructions or a PC relative load.
+        * assembler/ARMAssembler.h: Use INVALID_IMM if a constant cannot be
+        encoded as an immediate constant.
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::movw_r): 16-bit immediate load
+        (JSC::ARMAssembler::movt_r): High halfword 16-bit immediate load
+        (JSC::ARMAssembler::getImm16Op2): Encode immediate constant for
+        movw_r and mowt_r
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Provide TARGETING_TIGER and TARGETING_LEOPARD as analogues to
+        BUILDING_ON_TIGER and BUILDING_ON_LEOPARD.  The TARGETING_ macros
+        consider the deployment target; the BUILDING_ON_ macros consider the
+        headers being built against.
+
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31151
+        Fix branchDouble behaviour on ARM THUMB2 JIT.
+
+        The ARMv7 JIT is currently using ARMv7Assembler::ConditionEQ to branch
+        for DoubleEqualOrUnordered, however this is incorrect - ConditionEQ won't
+        branch on unordered operands.  Similarly, DoubleLessThanOrUnordered &
+        DoubleLessThanOrEqualOrUnordered use ARMv7Assembler::ConditionLO &
+        ARMv7Assembler::ConditionLS, whereas they should be using
+        ARMv7Assembler::ConditionLT & ARMv7Assembler::ConditionLE.
+
+        Fix these, and fill out the missing DoubleConditions.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Enable native call optimizations on ARMv7.  (Existing ARM_TRADITIONAL
+        implementation was generic, worked perfectly, just needed turning on).
+
+        * jit/JITOpcodes.cpp:
+        * wtf/Platform.h:
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe, Oliver Hunt, and Sam Weinig.
+
+        Add a missing assert to the ARMv7 JIT.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::ARMThumbImmediate):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove bogus op_ prefix on dumped version of three opcodes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2009-11-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix dumping of constants in bytecode so that they aren't printed as large positive register numbers.
+
+        We do this by having the registerName function return information about the constant if the register
+        number corresponds to a constant.  This requires that registerName, and several functions that call it,
+        be converted to member functions of CodeBlock so that the constant value can be retrieved.  The
+        ExecState also needs to be threaded down through these functions so that it can be passed on to
+        constantName when needed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+
+2009-11-04  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30647
+        Solaris build failure due to strnstr.
+
+        * wtf/StringExtras.h: Enable strnstr on Solaris, too.
+
+2009-11-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=31104
+        Refactor x86-specific behaviour out of the JIT.
+
+        - Add explicit double branch conditions for ordered and unordered comparisons (presently the brehaviour is a mix).
+        - Refactor double to int conversion out into the MacroAssembler.
+        - Remove broken double to int conversion for !JSVALUE32_64 builds - this code was broken and slowing us down, fixing it showed it not to be an improvement.
+        - Remove exclusion of double to int conversion from (1 % X) cases in JSVALUE32_64 builds - if this was of benefit this is no longer the case; simplify.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+
+2009-11-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove BUILDING_ON_LEOPARD from JavaScriptCore.gyp.  This is supposed
+        to be set as needed only in wtf/Platform.h.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-11-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION (r48573): JSC may incorrectly cache chain lookups with a dictionary at the head of the chain
+        https://bugs.webkit.org/show_bug.cgi?id=31045
+
+        Add guards to prevent caching of prototype chain lookups with dictionaries at the
+        head of the chain.  Also add a few tighter assertions to cached prototype lookups
+        to catch this in future.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2009-11-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        PLATFORM(CF) should be set when building for Qt on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=23671
+
+        * wtf/Platform.h: Turn on CF support if both QT and DARWIN
+        platforms are defined.
+
+2009-11-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove threadsafe refcounting from tasks used with WTF::MessageQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=30612
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::~MessageQueue):
+        (WTF::MessageQueue::append):
+        (WTF::MessageQueue::appendAndCheckEmpty):
+        (WTF::MessageQueue::prepend):
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+        (WTF::MessageQueue::tryGetMessage):
+        (WTF::MessageQueue::removeIf):
+        The MessageQueue is changed to act as a queue of OwnPtr<DataType>. It takes ownership
+        of posted tasks and passes it to the new owner (in another thread) when the task is fetched.
+        All methods have arguments of type PassOwnPtr<DataType> and return the same type.
+
+        * wtf/Threading.cpp:
+        (WTF::createThread):
+        Superficial change to trigger rebuild of JSC project on Windows,
+        workaround for https://bugs.webkit.org/show_bug.cgi?id=30890
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed failing layout test: restore a special case I accidentally deleted.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromDateArgs): In the case of applying a change to a date
+        that is NaN, reset the date to 0 *and* then apply the change; don't just
+        reset the date to 0.
+
+2009-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: update for object-to-pointer change.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30942
+        Use pointers instead of copies to pass GregorianDateTime objects around.
+        
+        SunSpider reports a shocking 4.5% speedup on date-format-xparb, and 1.3%
+        speedup on date-format-tofte.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::gregorianDateTime):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Renamed getGregorianDateTime to gregorianDateTime,
+        since it no longer has an out parameter. Uses 0 to indicate invalid dates.
+
+2009-10-30  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's ListHashSet
+        https://bugs.webkit.org/show_bug.cgi?id=30853
+
+        Inherits ListHashSet class from FastAllocBase because it is
+        instantiated by 'new' in WebCore/rendering/RenderBlock.cpp:1813.
+
+        * wtf/ListHashSet.h:
+
+2009-10-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Regression: crash enumerating properties of an object with getters or setters
+        https://bugs.webkit.org/show_bug.cgi?id=30948
+
+        Add a guard to prevent us trying to cache property enumeration on
+        objects with getters or setters.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+
+2009-10-30  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ENABLE_RUBY guards as discussed with Dave Hyatt and Maciej Stachowiak.
+
+        Bug 28420 -  Implement HTML5 <ruby> rendering
+        (https://bugs.webkit.org/show_bug.cgi?id=28420)
+ 
+        No new tests (no functional change).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r50218-r50262): E*TRADE accounts page is missing content
+        https://bugs.webkit.org/show_bug.cgi?id=30947
+        <rdar://problem/7348833>
+
+        The logic for flagging that a structure has non-enumerable properties
+        was in addPropertyWithoutTransition, rather than in the core Structure::put
+        method.  Despite this I was unable to produce a testcase that caused
+        the failure that etrade was experiencing, but the new assertion in
+        getEnumerablePropertyNames triggers on numerous layout tests without
+        the fix, so in effecti all for..in enumeration in any test ends up
+        doing the required consistency check.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::put):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::checkConsistency):
+
+2009-10-29  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add cacheFlush support for Thumb-2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=30865
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-10-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSC JIT on ARMv7 cannot link jumps >16Mb range
+        https://bugs.webkit.org/show_bug.cgi?id=30891
+
+        Start planing all relative jumps as move-32-bit-immediate-to-register-BX.
+        In the cases where the jump would fall within a relative jump range, use a relative jump.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::~ARMv7Assembler):
+        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::executableCopy):
+        (JSC::ARMv7Assembler::linkJump):
+        (JSC::ARMv7Assembler::relinkJump):
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::isB):
+        (JSC::ARMv7Assembler::isBX):
+        (JSC::ARMv7Assembler::isMOV_imm_T3):
+        (JSC::ARMv7Assembler::isMOVT):
+        (JSC::ARMv7Assembler::isNOP_T1):
+        (JSC::ARMv7Assembler::isNOP_T2):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+        (JSC::ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmFirst):
+        (JSC::ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmSecond):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp5i6Imm4Reg4EncodedImm):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        * jit/JIT.h:
+        * wtf/Platform.h:
+
+2009-10-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve for..in enumeration performance
+        https://bugs.webkit.org/show_bug.cgi?id=30887
+
+        Improve indexing of an object with a for..in iterator by
+        identifying cases where get_by_val is being used with a iterator
+        as the subscript and replace it with a new get_by_pname
+        bytecode.  get_by_pname then optimizes lookups that directly access
+        the base object.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::pushOptimisedForIn):
+        (JSC::BytecodeGenerator::popOptimisedForIn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::getOffset):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+          Track the existence (or not) of non-enumerable properties.
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageCapacity):
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::hasNonEnumerableProperties):
+        (JSC::Structure::hasAnonymousSlots):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attemp to fix Windows build.
+
+        Touch the cpp file to cause recompile.
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this since Database removes tasks when it is stopped.
+
+        * wtf/MessageQueue.h:
+        (WTF::::removeIf):
+
+2009-10-28  Afonso R. Costa Jr.  <afonso.costa@openbossa.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Enable YARR when YARR_JIT is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30730
+
+        When enabling or disabling JIT using JAVASCRIPTCORE_JIT, the ENABLE_YARR should
+        be toggled also.
+
+        * JavaScriptCore.pri:
+
+2009-10-24  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix strict aliasing warning by switching reinterpret_cast to bitwise_cast.
+
+        strict-aliasing warnings in JSFunction.h
+        https://bugs.webkit.org/show_bug.cgi?id=27869
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::scopeChain):
+        (JSC::JSFunction::setScopeChain):
+        (JSC::JSFunction::setNativeFunction):
+
+2009-10-28  Jan-Arve Sæther <jan-arve.saether@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Build-fix for 64-bit Windows
+
+        * wtf/Platform.h: Make sure to use WTF_USE_JSVALUE64
+
+2009-10-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix!).
+
+        * jit/JIT.h:
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Export fastMalloc, fastCalloc, fastRealloc and fastFree on GCC/Unix
+        https://bugs.webkit.org/show_bug.cgi?id=30769
+
+        When using -fvisibility=hidden to hide all internal symbols by default
+        the malloc symbols will be hidden as well. For memory instrumentation
+        it is needed to provide an instrumented version of these symbols and
+        override the normal routines and by changing the visibility back to
+        default this becomes possible.
+
+        The only other solution would be to use system malloc instead of the
+        TCmalloc implementation but this will not allow to analyze memory
+        behavior with the default allocator.
+
+        * wtf/FastMalloc.h: Define WTF_FAST_MALLOC_EXPORT for GCC and !darwin
+
+2009-10-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Samuel Q. Weinig.
+
+        Make the asserts protecting the offsets in the JIT more descriptive.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little bit of refactoring in the date code.
+
+        * JavaScriptCore.exp: Don't export this unused symbol.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h: Removed some unused functions. Changed the default
+        constructor to ensure that a DateInstance is always initialized.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype): Pass an initializer to our constructor,
+        since it now requires one.
+
+        * wtf/DateMath.cpp:
+        (WTF::msToGregorianDateTime): Only compute our offset from UTC if our
+        output will require it. Otherwise, our offset is 0.
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Mark DateInstaceCache.h private, so other frameworks can see it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: re-readded this file.
+
+        * runtime/DateInstanceCache.h: Added.
+        (JSC::DateInstanceData::create):
+        (JSC::DateInstanceData::DateInstanceData):
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::add):
+        (JSC::DateInstanceCache::lookup):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30800
+        Cache recently computed date data.
+        
+        SunSpider reports a ~0.5% speedup, mostly from date-format-tofte.js.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new file.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        (JSC::DateInstance::getGregorianDateTime): Use the shared cache.
+
+        * runtime/DateInstance.h: Renamed m_cache to m_data, to avoid the confusion
+        of a "cache cache".
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Pass an ExecState to these functions, so they
+        can access the DateInstanceCache.
+
+        * runtime/JSGlobalData.h: Keep a DateInstanceCache.
+
+2009-10-27  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Ensures that JavaScriptCore/wtf/CurrentTime.cpp is not built in PLATFORM(CHROMIUM) builds.
+
+        Chromium uses a different method to calculate the current time than is used in
+        JavaScriptCore/wtf/CurrentTime.cpp. This can lead to time skew when calls to currentTime() and Chromium's time
+        function are mixed.  In particular, timers can get scheduled in the past which leads to 100% CPU use.
+        See http://code.google.com/p/chromium/issues/detail?id=25892 for an example.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30833
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * wtf/CurrentTime.cpp:
+
+2009-10-27  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Fix typo in RegexInterpreter.cpp and RegexJIT.cpp alterantive to
+        alternative.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alternativeDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Use
+        winresrc.h because it exists even when MFC is not installed, and is
+        all that's needed here.
+
+2009-10-26  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The thunkReturnAddress is on JITStackFrame on ARM JIT as well
+        https://bugs.webkit.org/show_bug.cgi?id=30782
+
+        Move the thunkReturnAddress from top of the stack into the JITStackFrame
+        structure. This is a requirement for JSValue32_64 support on ARM.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::ret): Return with link register
+        (JSC::MacroAssemblerARM::prepareCall): Store the return address in link register
+        * jit/JIT.h: Remove unused ctiReturnRegister
+        * jit/JITInlineMethods.h: Same as ARMv7
+        (JSC::JIT::restoreArgumentReference): Ditto.
+        (JSC::JIT::restoreArgumentReferenceForTrampoline): Ditto.
+        * jit/JITOpcodes.cpp: Remove ctiReturnRegister related instruction
+        * jit/JITStubs.cpp: Store thunkReturnAddress on JITStackFrame. Use
+        small trampoline functions which handle return addresses for each
+        CTI_STUB_FUNCTION.
+        * jit/JITStubs.h: Store thunkReturnAddress on JITStackFrame
+        (JSC::JITStackFrame::returnAddressSlot): Return with the address of thunkReturnAddress
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter): Remove the unnecessary instruction
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ability to disable ReadWriteLock on platforms (eg Android) that use pthreads but do not support pthread_rwlock.
+        https://bugs.webkit.org/show_bug.cgi?id=30713
+
+        * wtf/Platform.h: Modified. Defines HAVE_PTHREAD_RWLOCK for all platforms currently using pthreads.
+        * wtf/Threading.h: Modified. Use pthread_rwlock_t only when HAVE_PTHREAD_RWLOCK is defined.
+        * wtf/ThreadingPthreads.cpp: Modified. Build ReadWriteLock methods only when HAVE_PTHREAD_RWLOCK is defined.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] [Symbian] Set the capability and memory required to run QtWebKit for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30476
+
+        Assign ReadUserData WriteUserData NetworkServices Symbian capabilities
+        to jsc.exe.
+
+        * jsc.pro:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Fixes a leak in createThreadInternal on Android.
+        https://bugs.webkit.org/show_bug.cgi?id=30698
+
+        * wtf/ThreadingPthreads.cpp: Modified.
+        (WTF::createThreadInternal): Avoid leaking a ThreadData object on failure.
+
+2009-10-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fixed ASSERT when opening Safari's Caches window while the Web Inspector
+        is open.
+
+        * runtime/Collector.cpp:
+        (JSC::typeName): Added two new types to the type name list in the Collector.
+        These types have been around for a while, but nobody remembered to consider them here.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::isPropertyNameIterator):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::isPropertyNameIterator): Give the Collector
+        a way to tell if a cell is a JSPropertyNameIterator.
+
+2009-10-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30686
+        Remove debug-specific def file.
+        Only Debug_All target uses JavaScriptCore_debug.dll naming, and since
+        that target is only used internally, maintaining two files just to
+        suppress a single link warning isn't worthwhile.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Removed.
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Export WTF::deleteOwnedPtr(HDC).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Ditto.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated variable name.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname): Slightly tweaked this #ifdef to match the
+        size of a JSValue because m_jsStrings is an array of JSValues.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed a 64-bit regression caused by the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=30570.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname): Use TimesEight stepping on 64-bit, since
+        64-bit pointers are eight bytes long.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Refactored DateInstance::msToGregorianDateTime so that a DateInstance's
+        caller doesn't need to supply the DateInstance's own internal value to
+        the DateInstance.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::getGregorianDateTime): Renamed from "msToGregorianDateTime".
+
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Also renamed "utc" to "outputIsUTC", for clarity.
+
+2009-10-20  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        The op_next_pname should use 4 bytes addressing mode in case of JSValue32
+        https://bugs.webkit.org/show_bug.cgi?id=30570
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname):
+
+2009-10-20  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Move OverridesMarkChildren flag from DatePrototype to its parent class
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tightened up some put_by_id_transition code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30539
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition): No need to do object type
+        checks or read Structures and prototypes from objects: they're all known
+        constants at compile time.
+
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added a private API for getting a global context from a context, for
+        clients who want to preserve a context for a later callback.
+
+        * API/APICast.h:
+        (toGlobalRef): Added an ASSERT, since this function is used more often
+        than before.
+
+        * API/JSContextRef.cpp:
+        * API/JSContextRefPrivate.h: Added. The new API.
+
+        * API/tests/testapi.c:
+        (print_callAsFunction):
+        (main): Test the new API.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build and export the new API.
+
+2009-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Tightened up some instanceof code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30488
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof): No need to do object type checks - 
+        cell type checks and ImplementsDefaultHasIntance checks implicitly
+        supersede object type checks.
+
+2009-10-18  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Use _stricmp and _strnicmp instead of deprecated stricmp and strnicmp.
+        https://bugs.webkit.org/show_bug.cgi?id=30474
+
+        stricmp and strnicmp are deprecated beginning in Visual
+        C++ 2005. Use _stricmp and _strnicmp instead in StringExtras.h.
+
+        * wtf/StringExtras.h:
+        (strncasecmp):
+        (strcasecmp):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: apparently we shouldn't export those symbols?
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export some symbols.
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        structure typeinfo flags should be inherited.
+        https://bugs.webkit.org/show_bug.cgi?id=30468
+
+        Add StructureFlag constant to the various JSC classes and use
+        it for the TypeInfo construction.  This allows us to simply
+        accumulate flags by basing each classes StructureInfo on its parents.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fast for-in enumeration: Cache JSPropertyNameIterator; cache JSStrings
+        in JSPropertyNameIterator; inline more code.
+
+        1.024x as fast on SunSpider (fasta: 1.43x as fast).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetPropertyNames):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        * bytecompiler/BytecodeGenerator.h: Added a few extra operands to
+        op_get_pnames and op_next_pname so that we can track iteration state
+        in the register file instead of in the JSPropertyNameIterator. (To be
+        cacheable, the JSPropertyNameIterator must be stateless.)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::Interpreter::privateExecute): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames): Updated for in-RegisterFile
+        iteration state tracking.
+
+        (JSC::JIT::emit_op_next_pname): Inlined code generation for op_next_pname.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Added has_property and to_object stubs. Removed op_next_pname
+        stub, since has_property is all we need anymore.
+
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames): Don't do caching at this layer
+        anymore, since we don't create a JSPropertyNameIterator at this layer.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create): Do do caching at this layer.
+        (JSC::JSPropertyNameIterator::get):  Updated for in-RegisterFile
+        iteration state tracking.
+        (JSC::JSPropertyNameIterator::markChildren): Mark our JSStrings.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::size):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::JSPropertyNameIterator::cachedStructure):
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::cachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::Structure::setEnumerationCache): Don't store iteration state in
+        a JSPropertyNameIterator. Do cache a JSPropertyNameIterator in a
+        Structure.
+
+        * runtime/JSValue.h:
+        (JSC::asCell):
+        * runtime/MarkStack.h: Make those mischievous #include gods happy.
+
+        * runtime/ObjectConstructor.cpp:
+
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): Renamed countPrototypeChainEntriesAndCheckForProxies
+        to normalizePrototypeChain, since it changes dictionary prototypes to
+        non-dictionary objects.
+
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end): Simplified some code here to help with
+        current and future refactoring.
+
+        * runtime/Protect.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition): No need to clear
+        the enumeration cache with adding / removing properties without
+        transition. It is an error to add / remove properties without transition
+        once an object has been observed, and we can ASSERT to catch that.
+
+        * runtime/Structure.h:
+        (JSC::Structure::enumerationCache): Changed the enumeration cache to
+        hold a JSPropertyNameIterator.
+
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::head): Removed StructureChain::isCacheable because
+        it was wrong-headed in two ways: (1) It gave up when a prototype was a
+        dictionary, but instead we want un-dictionary heavily accessed
+        prototypes; (2) It folded a test for hasDefaultGetPropertyNames() into
+        a generic test for "cacheable-ness", but hasDefaultGetPropertyNames()
+        is only releavant to for-in caching.
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Debug build in makefile should build Debug_All.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_All configuration.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, we can't use the simple hash there because the PlatformModuleVersion 
+        structure differs.
+
+        * wtf/Platform.h:
+
+2009-10-16  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement ExecutableAllocator for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29946
+
+        Tested with YARR JIT enabled for Symbian; 
+        This patch does not (yet) enable YARR JIT by default.
+
+        * JavaScriptCore.pri:
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorSymbian.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::MarkStack::markChildren):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesMarkChildren):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetOwnPropertySlot):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+2009-10-14  Darin Adler  <darin@apple.com>
+
+        Additions so fix for https://bugs.webkit.org/show_bug.cgi?id=18994
+        can build on Windows.
+
+        * wtf/MathExtras.h: Added llround and llroundf for Windows.
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Set ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH for plugins while we're still building stubs.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        from the make system into common code.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand reinterpret_cast<void*>
+        https://bugs.webkit.org/show_bug.cgi?id=29034
+
+        Change reinterpret_cast<void*> to regular C style (void*) cast 
+        for the ARM RVCT compiler.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr): 
+        * jit/JITOpcodes.cpp: Cast to FunctionPtr first 
+           instead of directly casting to reinterpret_cast
+        * jit/JITStubCall.h: Ditto + change the type of m_stub
+          from void* to FunctionPtr.
+        (JSC::JITStubCall::JITStubCall): 
+        (JSC::JITStubCall::call):
+        * jit/JITStubs.cpp: Ditto.
+        (JSC::DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)):
+
+2009-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Re-enable the JIT.
+
+        * wtf/Platform.h:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Support for String.trim(), String.trimLeft() and String.trimRight() methods
+        https://bugs.webkit.org/show_bug.cgi?id=26590
+
+        Implement trim, trimLeft, and trimRight
+
+        * runtime/StringPrototype.cpp:
+        (JSC::isTrimWhitespace):
+           Our normal string whitespace function does not include U+200B which
+           is needed for compatibility with mozilla's implementation of trim.
+           U+200B does not appear to be expected according to spec, however I am
+           choosing to be lax, and match mozilla behavior so have added this
+           exception.
+        (JSC::trimString):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Eliminated some legacy bytecode weirdness.
+        
+        Use vPC[x] subscripting instead of ++vPC to access instruction operands.
+        This is simpler, and often more efficient.
+
+        To support this, and to remove use of hard-coded offsets in bytecode and
+        JIT code generation and dumping, calculate jump offsets from the beginning
+        of an instruction, rather than the middle or end.
+        
+        Also, use OPCODE_LENGTH instead of hard-coded constants for the sizes of
+        opcodes.
+        
+        SunSpider reports no change in JIT mode, and a 1.01x speedup in Interpreter
+        mode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printConditionalJump):
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::prepareJumpTableForImmediateSwitch):
+        (JSC::prepareJumpTableForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        * bytecompiler/Label.h:
+        (JSC::Label::setLocation):
+        (JSC::Label::bind):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emitSlow_op_loop_if_true):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_jmp_scopes):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Migrated some code that didn't belong out of Structure.
+        
+        SunSpider says maybe 1.03x faster.
+
+        * runtime/JSCell.h: Nixed Structure::markAggregate, and made marking of
+        a Structure's prototype the direct responsility of the object using it.
+        (Giving Structure a mark function was misleading because it implied that
+        all live structures get marked during GC, when they don't.)
+        
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::markChildren): Added code to mark prototypes stored
+        on the global object. Maybe this wasn't necessary, but now we don't have
+        to wonder.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::getEnumerableNamesFromClassInfoTable):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/PropertyNameArray.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache): Moved property name gathering code
+        from Structure to JSObject because having a Structure iterate its JSObject
+        was a layering violation. A JSObject is implemented using a Structure; not
+        the other way around.
+
+2009-10-09  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the GTK release build.
+
+        * GNUmakefile.am: Include Grammar.cpp in release builds now that
+        AllInOneFile.cpp is gone.
+
+2009-10-09  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Rubber-stamped by Eric Seidel.
+
+        Add ARM JIT support for Gtk port (disabled by default)
+        https://bugs.webkit.org/show_bug.cgi?id=30228
+
+        * GNUmakefile.am:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: added a few more variable initializations.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSearch):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added missing #include.
+
+        * jsc.cpp:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: initialize variable whose initialization the compiler
+        can't otherwise figure out.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: fixed file name case.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        At long last, I pronounce the death of AllInOneFile.cpp.
+        
+        SunSpider reports a 1.01x speedup.
+
+        * AllInOneFile.cpp: Removed.
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added missing project files
+        to compilation stages.
+
+        * parser/Grammar.y:
+        * parser/Lexer.cpp:
+        * parser/Lexer.h:
+        (JSC::jscyylex):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/Collector.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::operator new):
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::operator new):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::operator new):
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructorPrivate::RegExpConstructorPrivate):
+        (JSC::RegExpConstructorPrivate::lastOvector):
+        (JSC::RegExpConstructorPrivate::tempOvector):
+        (JSC::RegExpConstructorPrivate::changeLastOvector):
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        * yarr/RegexJIT.cpp:
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::executeRegex): Inlined a few things that Shark said
+        were hot, on the presumption that AllInOneFile.cpp used to inline them
+        automatically.
+
+2009-10-08  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for JIT'ed op_call instructions (evals, constructs, etc.)
+        when !ENABLE(JIT_OPTIMIZE_CALL) && USE(JSVALUE32_64)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30201
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed no longer exported symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+        
+        Removed the optional lock from Heap::protect, Heap::unprotect, and friends,
+        since WebCore no longer uses it.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::protectedObjectCount):
+        (JSC::Heap::protectedObjectTypeCounts):
+        * runtime/Collector.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's IdentifierArena
+        https://bugs.webkit.org/show_bug.cgi?id=30158
+
+        Inherits IdentifierArena class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/ParserArena.cpp:36.
+
+        * parser/ParserArena.h:
+
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Export DateInstance::info in a way that works on Windows
+
+        Fixes <http://webkit.org/b/30171>
+        fast/dom/Window/window-postmessage-clone.html fails on Windows
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed the export of DateInstance::info from here.
+
+        * runtime/DateInstance.h: Use JS_EXPORTDATA to export
+        DateInstance::info, which is the required way of exporting data on
+        Windows.
+
+2009-10-07  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        When enabling or disabling the JIT through .qmake.cache, make sure
+        to also toggle ENABLE_YARR_JIT.
+
+        * JavaScriptCore.pri:
+
+2009-10-06  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Linking fails with "relocation R_X86_64_PC32 against symbol
+        `cti_vm_throw'"
+        https://bugs.webkit.org/show_bug.cgi?id=28422
+
+        * jit/JITStubs.cpp:
+        Mark cti_vm_throw symbol as PLT-indirect symbol, so it doesn't end up
+        in text segment causing relocation errors on amd64 architecture.
+        Introduced new define SYMBOL_STRING_RELOCATION for such symbols.
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Windows linking fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Windows build fix.
+
+        * runtime/DateInstance.cpp:
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Expose helpers to throw correct exceptions during object graph walk
+        used for cloning and add a helper function to create Date instances
+        without going through the JS Date constructor function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createTypeError):
+        * runtime/ExceptionHelpers.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        * wtf/CrossThreadRefCounted.h:
+        Removed an unused function and assert improvement.
+        (WTF::CrossThreadRefCounted::isOwnedByCurrentThread): Moved out common code from asserts.
+        (WTF::CrossThreadRefCounted::ref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::deref): Changed assert to use the common method.
+        (WTF::CrossThreadRefCounted::crossThreadCopy): Since this includes a potentially
+        non-threadsafe operation, add an assert that the class is owned by the current thread.
+
+2009-10-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add Symbian files to the list of excludes.
+
+        * wscript:
+
+2009-10-05  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove precompiled header from JavaScriptCore compilation to
+        prevent qmake warning during autonomous compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=30069
+
+        * JavaScriptCore.pro:
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the concept of a "fast access cutoff" in arrays, because it
+        punished some patterns of array access too much, and made things too
+        complex for inlining in some cases.
+        
+        1.3% speedup on SunSpider.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::): Check m_vectorLength instead of m_fastAccessCutoff when
+        getting / putting from / to an array. Inline putting past the end of
+        the array.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::canSetIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::markChildrenDirect): Removed m_fastAccessCutoff, and
+        replaced with checks for JSValue() to detect reads and writes from / to
+        uninitialized parts of the array.
+
+2009-10-02  Jonni Rainisto  <jonni.rainisto@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Math.random() gives too low values on Win32 when _CRT_RAND_S is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29956
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Added PLATFORM(WIN_OS) to handle 15bit rand()
+
+2009-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Take one branch instead of two to test for JSValue().
+        
+        1.1% SunSpider speedup.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_create_arguments):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description): Added support for dumping the new empty value,
+        and deleted values, in debug builds.
+
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue()): Construct JSValue() with the empty value tag.
+
+        (JSC::JSValue::JSValue(JSCell*)): Convert null pointer to the empty value
+        tag, to avoid having two different c++ versions of null / empty.
+
+        (JSC::JSValue::operator bool): Test for the empty value tag, instead
+        of testing for the cell tag with a 0 payload.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc:
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Fix the Qt on Mac OS X build.
+
+        * wtf/FastMalloc.cpp:
+
+2009-10-02  Jørgen Lind  <jorgen.lind@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow enabling and disabling of the JIT through a qmake variable.
+
+        Qt's configure may set this variable through .qmake.cache if a
+        commandline option is given and/or the compile test for hwcap.h
+        failed/succeeded.
+
+        * JavaScriptCore.pri:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29187
+
+        Don't inline ~ListRefPtr() to work around winscw compiler forward declaration
+        bug regarding templated classes.
+
+        The compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812
+
+        The change will be reverted when the above bug is fixed in winscw compiler.
+
+        * wtf/ListRefPtr.h:
+        (WTF::::~ListRefPtr):
+
+2009-10-01  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Allow custom memory allocation control for the whole JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=27029
+
+        Since in JavaScriptCore almost every class which has been instantiated by operator new is
+        inherited from FastAllocBase (bug #20422), we disable customizing global operator new for the Qt-port
+        when USE_SYSTEM_MALLOC=0.
+
+        Add #include <unistd.h> to FastMalloc.cpp because it's used by TCMalloc_PageHeap::scavengerThread().
+        (It's needed for the functionality of TCmalloc.)
+
+        Add TCSystemAlloc.cpp to JavaScriptCore.pri if USE_SYSTEM_MALLOC is disabled.
+
+        * JavaScriptCore.pri:
+        * wtf/FastMalloc.cpp:
+        (WTF::sleep):
+        * wtf/FastMalloc.h:
+
+2009-09-30  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by George Staikos.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        Modified by George Wright  <gwright@rim.com> to correctly work
+        with the RVCT-defined __TARGET_ARCH_ARM and __TARGET_ARCH_THUMB
+        compiler macros, as well as adding readability changes.
+
+        * wtf/Platform.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Devirtualise array toString conversion
+
+        Tweak the implementation of Array.prototype.toString to have a fast path
+        when acting on a true JSArray.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
+2009-09-30  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Buildfix for platforms using JSVALUE32.
+        https://bugs.webkit.org/show_bug.cgi?id=29915
+
+        After http://trac.webkit.org/changeset/48905 the build broke in JSVALUE32 case.
+        Also removed unreachable code.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+         - Declaration of "OperandTypes types" moved before first use.
+         - Typos fixed: dst modified to result, regT2 added.
+         - Unreachable code removed.
+        (JSC::JIT::emitSlow_op_add):
+         - Missing declaration of "OperandTypes types" added.
+
+2009-09-30  Janne Koskinen  <janne.p.koskinen@digia.com> 
+
+        Reviewed by Simon Hausmann.
+
+        Reduce heap size on Symbian from 64MB to 8MB.
+
+        This is not a perfect fix, it requires more fine tuning.
+        But this makes it possible again to debug in the emulator,
+        which is more important in order to be able to fix other
+        run-time issues.
+
+        * runtime/Collector.h:
+
+2009-09-30  Janne Koskinen  <janne.p.koskinen@digia.com> 
+
+        Reviewed by Simon Hausmann.
+
+        Fix CRASH() macro for Symbian build.
+
+        * wtf/Assertions.h: Added missing }
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Inlined a few math operations.
+        
+        ~1% SunSpider speedup.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub): Don't take a stub call when operating on
+        a constant int and a double.
+
+2009-09-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Tidy up codeblock sampler
+        https://bugs.webkit.org/show_bug.cgi?id=29836
+
+        Some rather simple refactoring of codeblock sampler so that
+        it's easier for us to use it to find problems in non-jsc
+        environments
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.h:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::enableSampler):
+        (JSC::Interpreter::dumpSampleData):
+        (JSC::Interpreter::startSampling):
+        (JSC::Interpreter::stopSampling):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::sampler):
+        * jit/JIT.h:
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::startSampling):
+        (JSC::JSGlobalData::stopSampling):
+        (JSC::JSGlobalData::dumpSampleData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29895
+
+        The following files are generated by JavaScriptCore's GYP file and should be ignored:
+
+        pcre.mk
+        wtf.scons
+        wtf.mk
+        SConstruct
+        wtf_config.scons
+        wtf_config.mk
+        pcre.scons
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Standardized an optimization for adding non-numbers.
+        
+        SunSpider says maybe a tiny speedup.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+
+2009-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: export a new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+        
+        6% speedup on bench-alloc-nonretained.js.
+
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::destroyJSGlobalObjectData):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::JSGlobalObject):
+
+2009-09-29  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by David Kilzer.
+
+        [Qt] Assert messages prints visible in Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29808
+
+        Asserts use vprintf to print the messages to stderr.
+        In Symbian Open C it is not possible to see stderr so
+        I routed the messages to stdout instead.
+
+        * wtf/Assertions.cpp:
+
+2009-09-29  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Darin Adler.
+
+        [Qt] Symbian CRASH macro implementation
+
+        Added Symbian specific crash macro that
+        stops to crash line if JIT debugging is used.
+        Additional differentiation of access violation
+        (KERN-EXEC 3) and CRASH panic.
+
+        * wtf/Assertions.h:
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Fix the PowerPC build.
+
+        * JavaScriptCore.exp:
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/7195704> JavaScriptCore fails to mark registers when built for x86_64 using LLVM GCC.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markCurrentThreadConservatively): Force jmp_buf to use the appropriate alignment for a pointer
+        to ensure that we correctly interpret the contents of registers during marking.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added new exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed exports that no longer exist.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
+        https://bugs.webkit.org/show_bug.cgi?id=29822
+        
+        Added NotNullPassRefPtr, and deployed it in all places that initialize
+        JavaScript objects.
+        
+        2.2% speedup on bench-allocate-nonretained.js.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::JSCallbackObject):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::addFunctionExpr):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/FunctionPrototype.h:
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::setStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PrototypeFunction.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        * wtf/PassRefPtr.h:
+        (WTF::NotNullPassRefPtr::NotNullPassRefPtr):
+        (WTF::NotNullPassRefPtr::~NotNullPassRefPtr):
+        (WTF::NotNullPassRefPtr::get):
+        (WTF::NotNullPassRefPtr::clear):
+        (WTF::NotNullPassRefPtr::releaseRef):
+        (WTF::NotNullPassRefPtr::operator*):
+        (WTF::NotNullPassRefPtr::operator->):
+        (WTF::NotNullPassRefPtr::operator!):
+        (WTF::NotNullPassRefPtr::operator UnspecifiedBoolType):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::RefPtr):
+        (WTF::operator==):
+
+2009-09-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Hard dependency on SSE2 instruction set with JIT
+        https://bugs.webkit.org/show_bug.cgi?id=29779
+
+        Add floating point support checks to op_jfalse and op_jtrue, and
+        fix the logic for the slow case of op_add
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium port - recognize we are being built independently
+        of chromium and look for dependencies under webkit/chromium rather
+        than chromium/src.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement XSLT support with QtXmlPatterns.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        * wtf/Platform.h: Add a WTF_USE_QXMLQUERY #define.
+
+2009-09-28  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Remove __clear_cache which is an internal function of GCC
+        https://bugs.webkit.org/show_bug.cgi?id=28886
+
+        Although __clear_cache is exported from GCC, this is an internal
+        function. GCC makes no promises about it.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix an absolute path to somewhere in Oliver's machine to a relative path
+        for derived JSONObject.lut.h.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-09-28  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add ARM version detection for Windows CE.
+
+        * wtf/Platform.h:
+
+2009-09-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add MarkStackSymbian.cpp to build JavascriptCore for Symbian.
+
+        Re-use Windows shrinkAllocation implementation because Symbian doesn't
+        support releasing part of memory region.
+        
+        Use fastMalloc and fastFree to implement allocateStack and releaseStack
+        for Symbian port.
+
+        * JavaScriptCore.pri:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackSymbian.cpp: Added.
+        (JSC::MarkStack::initializePagesize):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+2009-09-25  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix unaligned data access in YARR_JIT on ARMv5 and below.
+        https://bugs.webkit.org/show_bug.cgi?id=29695
+
+        On ARMv5 and below all data access should be naturally aligned.
+        In the YARR_JIT there is a case when character pairs are
+        loaded from the input string, but this data access is not
+        naturally aligned. This fix introduces load32WithUnalignedHalfWords
+        and branch32WithUnalignedHalfWords functions which contain
+        naturally aligned memory loads - half word loads - on ARMv5 and below.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARMv7::branch32):
+        (JSC::MacroAssemblerARMv7::branch32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerX86Common::branch32WithUnalignedHalfWords):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for JavaScriptCore.  Also there are some
+        wtf project files that get built apparently.
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Ada Chan  <adachan@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+        
+        SunSpider says 0.5% faster.
+        
+        0.8% speedup on bench-alloc-nonretained.js.
+        2.5% speedup on v8-splay.js.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::lexicalGlobalObject):
+        (JSC::ExecState::globalThisValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainNode::push):
+        (JSC::ScopeChain::ScopeChain):
+        (JSC::ScopeChain::globalObject): Added a globalObject data member to ScopeChainNode.
+        Replaced accessor function for globalObject() with data member. Replaced
+        globalThisObject() accessor with direct access to globalThis, to match.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h: Inlined array and object construction.
+
+2009-09-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add ARM version detection rules for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29715
+
+        * wtf/Platform.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark "Do It!" Rowe.
+
+        Some GCC versions don't like C++-style comments in preprocessor
+        directives, change to C-style to shut them up.
+
+        * wtf/Platform.h:
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Division is needlessly slow in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=29723
+
+        Add codegen for op_div on x86-64
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::isOperandConstantImmediateDouble):
+        (JSC::JIT::addressFor):
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateNumber):
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        JavaScriptCore/JavaScriptCore.gyp directory)
+
+        JavaScriptCore.xcodeproj
+        JavaScriptCore.sln
+        JavaScriptCore.vcproj
+        JavaScriptCore_Debug.rules
+        JavaScriptCore_Release.rules
+        JavaScriptCore_Release - no tcmalloc.rules
+        JavaScriptCore_Purify.rules
+        JavaScriptCore.mk
+        JavaScriptCore_Debug_rules.mk
+        JavaScriptCore_Release_rules.mk
+        JavaScriptCore_Release - no tcmalloc_rules.mk
+        JavaScriptCore_Purify_rules.mk
+        JavaScriptCore.scons
+        JavaScriptCore_main.scons
+
+        * JavaScriptCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        Replace platform-dependent code with WTF::currentTime()
+        https://bugs.webkit.org/show_bug.cgi?id=29148
+
+        * jsc.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+        (StopWatch::getElapsedMS):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2009-09-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7215058> FastMalloc scavenging thread should be named
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavengerThread): Set the thread name.
+        * wtf/Platform.h: Move the knowledge of whether pthread_setname_np exists to here as HAVE(PTHREAD_SETNAME_NP).
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Use HAVE(PTHREAD_SETNAME_NP).
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed clear to removeAll, as suggested by Darin Adler.
+
+        * wtf/HashCountedSet.h:
+        (WTF::::removeAll):
+
+2009-09-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix FastMalloc to build with assertions enabled.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_Central_FreeList::ReleaseToSpans):
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::IsHeld):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+
+        Removed some unnecessary parameter names.
+
+        * wtf/HashCountedSet.h:
+
+2009-09-24  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        On Windows JSChar is typedef'ed to wchar_t.
+
+        When building with WINSCW for Symbian we need to do the
+        same typedef.
+
+        * API/JSStringRef.h:
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        A piece of my last patch that I forgot.
+
+        * wtf/HashCountedSet.h:
+        (WTF::::clear): Added HashCountedSet::clear.
+
+2009-09-24  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid __clear_cache built-in function if DISABLE_BUILTIN_CLEAR_CACHE define is set
+        https://bugs.webkit.org/show_bug.cgi?id=28886
+
+        There are some GCC packages (for example GCC-2006q3 from CodeSourcery)
+        which contain __clear_cache built-in function only for C while the C++
+        version of __clear_cache is missing on ARM architectures.
+
+        Fixed a small bug in the inline assembly of cacheFlush function on
+        ARM_TRADITIONAL.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added the ability to swap vectors with inline capacities, so you can
+        store a vector with inline capacity in a hash table.
+
+        * wtf/Vector.h:
+        (WTF::swap):
+        (WTF::VectorBuffer::swap):
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        Move definition of USE(PLUGIN_HOST_PROCESS) from WebKitPrefix.h to Platform.h
+
+        Reviewed by Mark Rowe.
+
+        * wtf/Platform.h: Define WTF_USE_PLUGIN_HOST_PROCESS to 1 when
+        building on 64-bit SnowLeopard.  Define to 0 elsewhere.
+
+2009-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Code sampling builds are broken.
+        https://bugs.webkit.org/show_bug.cgi?id=29662
+
+        Fix build.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/SamplingTool.cpp:
+        (JSC::ScriptSampleRecord::sample):
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::notifyOfScope):
+        (JSC::compareScriptSampleRecords):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::ScriptSampleRecord::ScriptSampleRecord):
+        (JSC::ScriptSampleRecord::~ScriptSampleRecord):
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Forward.h: Added PassOwnPtr.
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's javascriptcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Added.
+
+2009-09-22  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with WINSCW: no varargs macros
+
+        Disable variadic arguments for WINSCW just like we do
+        for MSVC7.
+
+        * wtf/Assertions.h:
+
+2009-09-22  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Disable variadic macros on MSVC7.
+
+        This was originally added in r26589 but not extended
+        when LOG_DISABLED/ASSERT_DISABLED was introduced.
+
+        * wtf/Assertions.h:
+
+2009-09-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix for Windows CE < 5
+
+        Define WINCEBASIC to disable the IsDebuggerPresent() code in
+        wtf/Assertions.cpp.
+
+        * JavaScriptCore.pri:
+
+2009-09-22  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix major memory leak in JavaScriptCore RegisterFile on Windows CE
+
+        https://bugs.webkit.org/show_bug.cgi?id=29367
+
+        On Widows CE we must decommit all committed pages before we release
+        them. See VirtualFree documentation.
+        Desktop Windows behaves much smoother in this situation.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+
+        * wtf/Platform.h: Also sort PLATFORM(IPHONE) #defines.
+
+2009-09-21  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Fix] SourceCode's uninitialized member
+        
+        Potential source of crashes and bugs was fixed. Default constructor
+        didn't initialized m_provider member.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29364
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+
+2009-09-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=29599
+
+        It is unsafe to attempt to cache new property transitions on
+        dictionaries of any type.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+
+2009-09-21  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej Stachowiak.
+
+        Re-land SNES fix with corrected assertion.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-21  Adam Roben  <aroben@apple.com>
+
+        Revert r48573, as it caused many assertion failures
+
+        * interpreter/Interpreter.cpp:
+        * jit/JITStubs.cpp:
+        * runtime/BatchedTransitionOptimizer.h:
+        * runtime/JSObject.cpp:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam 'Cabin Boy' Weinig.
+
+        Fix stack alignment with ARM THUMB2 JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=29526
+        
+        Stack is currently being decremented by 0x3c, bump this to 0x40 to make this a
+        multiple of 16 bytes.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+
+2009-09-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        SNES is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=29534
+
+        The problem was that the emulator used multiple classes with
+        more properties than our dictionary cutoff allowed, this resulted
+        in more or less all critical logic inside the emulator requiring
+        uncached property access.
+
+        Rather than simply bumping the dictionary cutoff, this patch
+        recognises that there are two ways to create a "dictionary"
+        structure.  Either by adding a large number of properties, or
+        by removing a property.  In the case of adding properties we
+        know all the existing properties will maintain their existing
+        offsets, so we could cache access to those properties, if we
+        know they won't be removed.
+
+        To make this possible, this patch adds the logic required to
+        distinguish a dictionary created by addition from one created
+        by removal.  With this logic in place we can now cache access
+        to objects with large numbers of properties.
+
+        SNES performance improved by more than 6x.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement ES5 Object.create function
+        https://bugs.webkit.org/show_bug.cgi?id=29524
+
+        Implement Object.create.  Very simple patch, effectively Object.defineProperties
+        only creating the target object itself.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorCreate):
+
+2009-09-19  Dan Bernstein  <mitz@apple.com>
+
+        Fix clean debug builds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-19  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by George Staikos.
+
+        QtWebKit Windows CE compile fix
+
+        https://bugs.webkit.org/show_bug.cgi?id=29379
+
+        There is no _aligned_alloc or _aligned_free on Windows CE.
+        We just use the Windows code that was there before and use VirtualAlloc.
+        But that also means that the BLOCK_SIZE must be 64K as this function
+        allocates on 64K boundaries.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        * runtime/Collector.h:
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement ES5 Object.defineProperties function
+        https://bugs.webkit.org/show_bug.cgi?id=29522
+
+        Implement Object.defineProperties.  Fairly simple patch, simply makes use of
+        existing functionality used for defineProperty.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::defineProperties):
+        (JSC::objectConstructorDefineProperties):
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Windows build fix part2
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Windows build fix part 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Implement Object.defineProperty.  This requires adding the API to
+        ObjectConstructor, along with a helper function that implements the
+        ES5 internal [[ToPropertyDescriptor]] function.  It then adds
+        JSObject::defineOwnProperty that implements the appropriate ES5 semantics.
+        Currently defineOwnProperty uses a delete followed by a put to redefine
+        attributes of a property, clearly this is less efficient than it could be
+        but we can improve this if it needs to be possible in future.
+
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::defineGetter):
+        (JSC::DebuggerActivation::defineSetter):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+          Update defineGetter/Setter calls
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineGetter):
+        (JSC::JSGlobalObject::defineSetter):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::writable):
+        (JSC::PropertyDescriptor::enumerable):
+        (JSC::PropertyDescriptor::configurable):
+        (JSC::PropertyDescriptor::isDataDescriptor):
+        (JSC::PropertyDescriptor::isGenericDescriptor):
+        (JSC::PropertyDescriptor::isAccessorDescriptor):
+        (JSC::PropertyDescriptor::getter):
+        (JSC::PropertyDescriptor::setter):
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        (JSC::PropertyDescriptor::setWritable):
+        (JSC::PropertyDescriptor::setEnumerable):
+        (JSC::PropertyDescriptor::setConfigurable):
+        (JSC::PropertyDescriptor::setSetter):
+        (JSC::PropertyDescriptor::setGetter):
+        (JSC::PropertyDescriptor::equalTo):
+        (JSC::PropertyDescriptor::attributesEqual):
+        (JSC::PropertyDescriptor::attributesWithOverride):
+        * runtime/PropertyDescriptor.h:
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        (JSC::PropertyDescriptor::value):
+        (JSC::PropertyDescriptor::setValue):
+        (JSC::PropertyDescriptor::isEmpty):
+        (JSC::PropertyDescriptor::writablePresent):
+        (JSC::PropertyDescriptor::enumerablePresent):
+        (JSC::PropertyDescriptor::configurablePresent):
+        (JSC::PropertyDescriptor::setterPresent):
+        (JSC::PropertyDescriptor::getterPresent):
+        (JSC::PropertyDescriptor::operator==):
+        (JSC::PropertyDescriptor::):
+
+2009-09-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Build fix to enable ARM_THUMB2 on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JITStubs.cpp:
+        * wtf/Platform.h:
+
+2009-09-18  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Defines two pseudo-platforms for ARM and Thumb-2 instruction set.
+        https://bugs.webkit.org/show_bug.cgi?id=29122
+
+        Introduces WTF_PLATFORM_ARM_TRADITIONAL and WTF_PLATFORM_ARM_THUMB2
+        macros on ARM platforms. The PLATFORM(ARM_THUMB2) should be used
+        when Thumb-2 instruction set is the required target. The
+        PLATFORM(ARM_TRADITIONAL) is for generic ARM instruction set. In
+        case where the code is common the PLATFORM(ARM) have to be used.
+
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * jit/ExecutableAllocator.h:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::preserveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt/Windows CE build.
+
+        * JavaScriptCore.pri: Build the ce_time.cpp functions from
+        within Qt externally.
+        * wtf/DateMath.cpp: Removed unnecessary Qt #ifdef, for the
+        Qt build these functions are no external, too.
+
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian/WINSCW build fox.
+
+        Repeat Q_OS_WIN wchar_t hack for WINSCW, similar to
+        revision 24774.
+
+        WINSCW defines wchar_t, thus UChar has to be wchar_t
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2009-09-17  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian/WINSCW build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29186
+
+        WINSCW Template specialisation name in declaration must the be the same as in implementation.
+
+        * runtime/LiteralParser.h:
+
+2009-09-15  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27060
+
+        Symbian compiler for emulator target (WINSCW) fails with
+        "illegal operand" for m_attributesInPrevious in structure.ccp
+        (when calling make_pair functions).
+        This error is apparently due to the compiler not properly
+        resolving the unsigned type of the declared bitfield.
+
+        Initial patch explicitly casted m_attributesInPrevious
+        to unsigned, but since bitfield optimization is not critical for
+        the emulator target, this conditional change in header file
+        appears to be least intrusive.
+
+        * runtime/Structure.h:
+
+2009-09-16  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Fix GCC warnings on ARM_THUMB2 platform
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::countLeadingZerosPartial):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        The webkit stdint and stdbool headers exists because
+        the compiler MSVC doesn't include them.  The check
+        should not check for PLATFORM(WIN_OS) but for MSVC.
+
+        * os-win32/stdbool.h:
+        * os-win32/stdint.h:
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h:
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix after flag was moved to correct place.
+
+        * wscript:
+
+2009-09-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Build fix for 64-bit Qt on Mac OS X
+
+        * wtf/Platform.h: Use JSVALUE64 on DARWIN, not only on MAC
+
+2009-09-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix wtf/ThreadSpecific.h under Qt to free thread local objects.
+        https://bugs.webkit.org/show_bug.cgi?id=29295
+
+        This is an important fix when JavaScript workers are in use, since
+        unfreed ThreadGlobalDatas leak a big amount of memory (50-100k each).
+        QThreadStorage calls the destructor of a given object, which is the
+        ThreadSpecific::Data. Unlike pthread, Qt is object oriented, and does
+        not support the calling of a static utility function when the thread
+        is about to close. In this patch we call the ThreadSpecific::destroy()
+        utility function from the destructor of ThreadSpecific::Data. Moreover,
+        since Qt resets all thread local values to 0 before the calling of the
+        appropriate destructors, we set back the pointer to its original value.
+        This is necessary because the get() method of the ThreadSpecific
+        object may be called during the exuction of the destructor.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::Data::~Data):
+        (WTF::::~ThreadSpecific):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Allow anonymous storage inside JSObject
+        https://bugs.webkit.org/show_bug.cgi?id=29168
+
+        Add the concept of anonymous slots to Structures so that it is
+        possible to store references to values that need marking in the
+        standard JSObject storage buffer.  This allows us to reduce the
+        malloc overhead of some objects (by allowing them to store JS
+        values in the inline storage of the object) and reduce the 
+        dependence of custom mark functions (if all an objects children
+        are in the standard object property storage there's no need to
+        mark them manually).
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        (JSC::JSObject::addAnonymousSlots):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::TransitionTable::addSlotTransition):
+        (JSC::StructureTransitionTable::TransitionTable::removeSlotTransition):
+        (JSC::StructureTransitionTable::TransitionTable::getSlotTransition):
+        (JSC::StructureTransitionTable::getAnonymousSlotTransition):
+        (JSC::StructureTransitionTable::addAnonymousSlotTransition):
+        (JSC::StructureTransitionTable::removeAnonymousSlotTransition):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added the ENABLE_MATHML define to the features
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-15 Csaba Osztrogonac <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows.
+
+        After http://trac.webkit.org/changeset/47795 the MinGW build broke,
+        because MinGW has __mingw_aligned_malloc instead of _aligned_malloc.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock): MinGW case added.
+        (JSC::Heap::freeBlock): MinGW case added.
+
+2009-09-15  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for Windows/MinGW
+
+        https://bugs.webkit.org/show_bug.cgi?id=29268
+
+        * wtf/Platform.h: JSVALUE32_64 temporarily disabled on PLATFORM(WIN_OS) with COMPILER(MINGW)
+
+2009-09-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Detect VFP at runtime in generic ARM port on Linux platform.
+        https://bugs.webkit.org/show_bug.cgi?id=29076
+
+        * JavaScriptCore.pri:
+        * assembler/MacroAssemblerARM.cpp: Added.
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+
+2009-09-14  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix for windows build.
+
+        * JavaScriptCore.pri: Correct a logic error.
+        * pcre/dftables: Add missing paranthesis for tmpdir function.
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build fix for windows exports (again).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build fix for windows exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Correct fix for non-allinonefile builds
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix non-allinonefile builds
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        This patch basically requires two separate steps, the first is to split getPropertyNames
+        into two functions -- getOwnPropertyNames and getPropertyNames, basically making them behave
+        in the same way as getOwnPropertySlot and getPropertySlot.  In essence getOwnPropertyNames
+        produces the list of properties on an object excluding its prototype chain and getPropertyNames
+        just iterates the the object and its prototype chain calling getOwnPropertyNames at each level.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorKeys):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::getOwnEnumerablePropertyNames):
+        (JSC::Structure::getEnumerablePropertyNames):
+        * runtime/Structure.h:
+
+2009-09-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=29214
+
+        Add a flag to TypeInfo to indicate whether a type overrides getPropertyNames.
+        This flag is used to make sure that caching of the property name data is safe.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::hasDefaultGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * runtime/JSGlobalData.cpp: (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        Added a new mainThreadOnly flag that WebCore would set.
+
+        * runtime/Collector.cpp: (JSC::Heap::registerThread): JSC API methods always call this,
+        so this is a good place to check that the API isn't used form a wrong thread.
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compiling JavaScriptCore on sparc 64 with gcc fails.
+
+        ThreadSafeShared uses the atomic __gnu_cxx::__exchange_and_add with an int,
+        however on sparc 64 the _Atomic_word argument is typedefed to long (8 bytes).
+
+        The patch disables WTF_USE_LOCKFREE_THREADSAFESHARED in ThreadSafeShared to use
+        a mutex instead when compiling for sparc 64 with gcc.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29175
+
+        * wtf/Platform.h:
+        __sparc64__ is not defined on all OS.
+        Uses instead: __sparc__ && __arch64__ || __sparcv9
+        * wtf/Threading.h:
+
+2009-09-11  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compile error on Windows7(64Bit) with latest SDK.
+
+        Added the missing include file.
+
+        * runtime/UString.cpp:
+
+2009-09-11  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Qt/Windows CE compile fix, include the executable allocator and
+        markstack implementation in the windows build.
+
+        * JavaScriptCore.pri:
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * wtf/Platform.h:
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Update JavaScriptCore and WebKit's FeatureDefines.xcconfig so that they are in sync with WebCore as they need to be.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Export WTF::tryFastMalloc used in WebSocketChannel.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Make StructureTransitionTable use an enum for the PtrAndFlags member
+        used for the single transition slot optimisation.
+
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::usingSingleTransitionSlot):
+        (JSC::StructureTransitionTable::):
+
+2009-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Refactor StructureTransitionTable and Structure to unify handling of the single slot optimization
+        https://bugs.webkit.org/show_bug.cgi?id=29141
+
+        Make StructureTransitionTable encapsulate the single transition slot optimization.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::hasTransition):
+        (JSC::StructureTransitionTable::reifySingleTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+        (JSC::StructureTransitionTable::table):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::usingSingleTransitionSlot):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        (JSC::StructureTransitionTable::setTransitionTable):
+        (JSC::StructureTransitionTable::):
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Implement fastDeleteSkippingDestructor for FastAllocBase and fastDeleteAllValues for HashSet
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        FastAllocBase has been extended with fastDeleteSkippingDestructor function which
+        releases memory without destructor call. fastDeleteAllValues has been implemented 
+        similar as deleteAllValues but it uses fastDelete function to release memory.
+
+        * wtf/FastAllocBase.h:
+        (WTF::fastDeleteSkippingDestructor):
+        * wtf/HashSet.h:
+        (WTF::fastDeleteAllValues):
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand GCC visibility attribute
+        https://bugs.webkit.org/show_bug.cgi?id=29079
+
+        * API/JSBase.h: Make the test more specific to hit only
+        the GCC compiler
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert of the previous change.  It broke the tests.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+
+2009-09-10  Ben Laurie  <benl@google.com>
+
+        Reviewed by Adam Barth.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26836>
+
+        If dtoa was given a small buffer and the number was either infinite or
+        NaN, then the buffer would be overflowed.
+
+        * wtf/dtoa.cpp:
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Change reinterpret_cast to static_cast in r48212.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove WTF_PLATFORM_FORCE_PACK as it is no longer used
+        https://bugs.webkit.org/show_bug.cgi?id=29066
+
+        * wtf/Platform.h:
+
+2009-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Implement flushing the instruction cache for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29075
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush): Call IMB_Range to flush
+        the instruction cache on Symbian
+
+2009-09-09  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29024
+        Make JavaScriptCore compile on platforms with case-insensitive file systems and typeinfo.h in STL
+
+        These platforms include Microsoft Visual Studio 2003, and Symbian with Metrowerks compiler.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSTypeInfo.h: Copied from JavaScriptCore/runtime/TypeInfo.h.
+        * runtime/Structure.h:
+        * runtime/TypeInfo.h: Removed.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSON.stringify(Date) loses the milliseconds information
+        https://bugs.webkit.org/show_bug.cgi?id=29063
+
+        Make sure we include milliseconds in the output of toISOString.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build fix when USE(LOCKFREE_THREADSAFESHARED) is not defined
+        https://bugs.webkit.org/show_bug.cgi?id=29011
+
+        * wtf/Threading.h: Use LOCKFREE_THREADSAFESHARED guard for 
+        atomicIncrement and atomicDecrement
+
+2009-09-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control in Yarr's RegexInterpreter
+        https://bugs.webkit.org/show_bug.cgi?id=29025
+
+        Inherits RegexInterpreter classes from FastAllocBase (bug #20422), which has
+        been instantiated by 'new':
+
+        class ByteDisjunction
+        -> instantiated in JavaScriptCore/yarr/RegexInterpreter.cpp:1462
+
+        struct BytecodePattern
+        -> instantiated in JavaScriptCore/yarr/RegexInterpreter.cpp:1279
+
+        * yarr/RegexInterpreter.h:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reverting r48121 to fix Windows build errors.
+
+        * JavaScriptCore.exp:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Export WTF::tryFastMalloc used in WebSocketChannel.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+
+        * JavaScriptCore.exp:
+
+2009-09-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix windows export files
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-09-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [[ToString]] conversion should use the actual toString function for String objects.
+
+        Remove incorrect specialisations of toString conversions on StringObject.
+
+        * JavaScriptCore.exp:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+
+2009-09-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Add new export.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Add new export.
+
+2009-09-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove unneeded export.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Remove unneeded export.
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=28909
+
+        Part two.
+
+        Make some improvements to garbage collection code:
+
+            1) Create a runtime assertion that catches any classes that
+               override markChildren but have the HasDefaultMark bit set.
+            2) Remove checks of the mark bit outside the MarkStack::append
+               function; they are redundant.
+            3) Improve the efficiency of the asObject and asArray functions
+               when called on JSCell* to avoid a round trip to JSValue.
+            4) Make more callers use the checked asCell and asObject
+               casting functions rather than unchecked casts.
+            5) Removed the JSCell::marked function and other GC-related
+               functions because these operations are no longer things that
+               code other than the core GC code needs to do directly. Fixed
+               callers that were calling them.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively): Removed unneeded call to MarkStack::drain.
+        (JSC::Heap::markProtectedObjects): Removed unneeded check of the mark
+        bit and call to MarkStack::drain.
+        (JSC::Heap::collect): Removed unneeded checks of the mark bit and also
+        changed call to SmallStrings::mark to call markChildren instead to match
+        the rest of the objects.
+        (JSC::typeName): Removed unneeded cast to JSObject*.
+
+        * runtime/JSArray.h:
+        (JSC::asArray): Added an overload for JSCell* and changed the JSValue
+        version to call it. Removed some unneeded casts.
+        (JSC::JSArray::markChildrenDirect): Marked this function inline. It's in
+        a header, and if not marked inline this could lead to linking problems.
+        (JSC::MarkStack::markChildren): Added. This helper function is used by
+        the drain function to avoid repating code. Also added the code here to
+        check fro default mark violations in debug code. If a markChildren
+        function adds something to the mark stack, but the type info claimed
+        hasDefaultMark was true, then we will get an assertion now. Also fixed
+        the assertion about the mark bit to use the Heap function directly
+        because we don't have a JSCell::marked function any more.
+        (JSC::MarkStack::drain): Changed a local variable from "v" to "value",
+        and from "currentCell" to "cell". Changed to call markChildren in two
+        places instead of repeating a chain of if statements twice. Changed
+        code that reads and writes the mark bit to use Heap::isCellMarked and
+        Heap::markCell so we can eliminate the JSCell::marked and
+        JSCell::markCellDirect functions.
+
+        * runtime/JSCell.h: Removed JSCell's markCellDirect and marked member
+        functions. Added a comment explaining that asCell should be deprecated
+        in favor of the JSValue asCell member function.
+        (JSC::MarkStack::append): Added the assertion that catches callers
+        that have set the HasDefaultMark bit incorrectly. Changed
+        code that reads and writes the mark bit to use Heap::isCellMarked and
+        Heap::markCell so we can eliminate the JSCell::marked and
+        JSCell::markCellDirect functions. Moved the overload of
+        MarkStack::append for JSValue here so it can call through to the cell
+        version. The old version had a copy of all the code instead, but that
+        repeated the conversion from JSValue to JSCell* and the check for
+        whether a value is a cell multiple times.
+        (JSC::Structure::markAggregate): Moved this function here to avoid
+        dependencies for Structure.h, since this calls MarkStack::append.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren): Added code to clear
+        m_isCheckingForDefaultMarkViolation so the marking done by JSObject
+        doesn't trigger the assertion.
+
+        * runtime/JSValue.h: Moved some stray includes that were outside the
+        header guard inside it. Not sure how that happened! Removed the
+        GC-related member functions markChildren, hasChildren, marked, and
+        markDirect.
+
+        * runtime/JSWrapperObject.h: Made markChildren private.
+        (JSC::JSWrapperObject::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set.
+
+        * runtime/MarkStack.h: Added m_isCheckingForDefaultMarkViolation and
+        initialized it to false. Moved the append function body from here to
+        JSCell.h. Added a declaration of a private markChildren function used
+        inside the drain function.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Changed the name and style of this
+        function to match other functions. This allows us to share the normal
+        mark stack code path.
+
+        * runtime/SmallStrings.h: Changed the name and interface of mark to
+        the more-normal markChildren style.
+
+        * runtime/Structure.h: Moved the body of markAggregate into the
+        JSCell.h to avoid a circular dependency with JSCell.h.
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)
+        https://bugs.webkit.org/show_bug.cgi?id=28909
+
+        Part one.
+
+        Make some improvements to garbage collection code:
+
+            1) Fix the two classes that had the default mark bit set but
+               should not.
+            2) Remove checks of the mark bit outside the MarkStack::append
+               function; they are redundant.
+            3) Make more callers use the checked asCell and asObject
+               casting functions rather than unchecked casts.
+            4) Removed some GC-related functions because these operations are
+               no longer things that code other than the core GC code needs
+               to do directly. Fixed callers that were calling them.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate): Removed unneeded check of the mark
+        bit before calling MarkStack::append.
+
+        * interpreter/Register.h: Removed unneeded marked and markChildren
+        functions.
+
+        * jit/JITStubs.cpp:
+        (op_eq): Removed unneeded assertions, instead using checked casting
+        functions such as asObject.
+
+        * runtime/ArgList.h: Added now-needed forward declaration of MarkStack.
+
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren): Remmoved unneeded check of the mark bit.
+
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set.
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getObject): Use asObject to avoid a direct static_cast.
+
+        * runtime/JSObject.h:
+        (JSC::asObject): Added an overload for JSCell* and changed the JSValue
+        version to call it.
+        (JSC::JSValue::get): Use asObject to avoid a direct static_cast.
+
+        * runtime/JSWrapperObject.h: Made markChildren private.
+        (JSC::JSWrapperObject::createStructure): Added. Fixes a bug where the
+        HasDefaultMark bit was set. Later we may want to optimize this for
+        wrapper types that never have cells in their internal values, but there
+        is no measured performance regression in SunSpider or V8 doing this
+        all the time.
+
+        * runtime/MarkStack.cpp: Tweaked formatting.
+
+2009-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switch USE_ defines over to the compiler so that they can be
+        checked by files not including config.h (like WebCorePrefix.h).
+
+        * wtf/Platform.h:
+
+2009-09-03  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary dependency on unistd.h
+        https://bugs.webkit.org/show_bug.cgi?id=28962
+
+        * runtime/Completion.cpp:
+
+2009-09-03  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add strnstr for Linux and Windows in StringExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=28901
+
+        * wtf/StringExtras.h:
+        (strnstr):
+
+2009-09-03  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's HashEntry class
+        https://bugs.webkit.org/show_bug.cgi?id=27830
+
+        Inherits HashEntry class from FastAllocBase because it has been
+        instantiated by 'new' JavaScriptCore/runtime/Lookup.cpp:32.
+
+        * runtime/Lookup.h:
+
+2009-09-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Should crash if JIT code buffer allocation fails.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28926
+        <rdar://problem/7031922>
+
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorWin.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for building on Windows.
+
+        * wtf/ThreadingPthreads.cpp:
+
+2009-09-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Use fastMalloc when neither MMAP nor VIRTUALALLOC are enabled
+        
+        RegisterFile constructor currently throws #error when both
+        MMAP and VIRTUALALLOC conditions fail.
+        On any platform that does not provide these features
+        (for instance, Symbian),
+        the fallback should be regular malloc (or fastMalloc).
+        It is functionally equivalent in this case, even though it may
+        have certain drawbacks such as lack of dynamic pre-allocation.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+
+2009-08-31  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed typo.
+        https://bugs.webkit.org/show_bug.cgi?id=28691
+
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        JSON Stringifier does not follow ES5 spec for handling of Number, String and Boolean objects
+        https://bugs.webkit.org/show_bug.cgi?id=28797
+
+        Fixed unwrapBoxedPrimitive to do the right thing, which necessitated a couple of new exception
+        checks, and corrected the logic in gap to correctly convert Number and String objects.
+
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        JSON.stringify replacer array does not accept values that are not string primitives.
+        https://bugs.webkit.org/show_bug.cgi?id=28788
+
+        Update the JSON stringifier to initialise its replacer array according to the most
+        recent version of the spec.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        * wtf/Threading.h: (WTF::atomicIncrement): Changed atomicIncrement to match decrement
+        and return the new value. Also added using directives for these functions, to match
+        te rest of WTF.
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Link the testapi against CFLite when building the WinCairo port.
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add new Release_CFLite
+          target.  Update all targets to inherit from either the
+          JavaScriptCF.vsprops (Apple target) or the JavaScriptCFLite.vsprops
+          file (WinCairo target).
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Remove
+          input file CoreFoundation.lib. This is provided by either the
+          JavaScriptCF.vsprops or JavaScriptCFLite.vsprops file.
+
+2009-08-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        Fix Windows-specific crash due to missing memory clearing call.
+        
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+
+2009-08-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix: JavaScriptCore_debug.def missing some exports.  Apple
+        Windows build does not use this file, so it was not noticed previously.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        x86-64 GTK broken due to code offsets changing, pointers sometimes packed into immediates.
+        https://bugs.webkit.org/show_bug.cgi?id=28317
+
+        Missed one, fix part II.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        * assembler/X86Assembler.h:
+        (JSC::CAN_SIGN_EXTEND_8_32):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        JSON.stringify replacer array does not accept values that are not string primitives.
+        https://bugs.webkit.org/show_bug.cgi?id=28788
+
+        Update the JSON stringifier to initialise its replacer array according to the most
+        recent version of the spec.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+
+2009-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        JSON parser accepts trailing comma in array literals
+        https://bugs.webkit.org/show_bug.cgi?id=28779
+
+        Update parser to correctly fail if there's a trailing comma.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        'this' in JSON.parse reviver is the global object
+        https://bugs.webkit.org/show_bug.cgi?id=28752
+
+        This is a technically simple change, we merely update the code for calling
+        the reviver function to pass the correct this object.  Doing so however
+        exposes the holder to arbitrary mutation by the reviver function so it is
+        necessary for us to now guard all property accesses against the possibility
+        of failure.
+
+        * runtime/JSArray.h:
+          JSON needs to delete a property from the array, so we friend its 
+          Walker class so that we can make a non-virtual call to the arrays
+          delete and getOwnPropertySlot methods.
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::callReviver):
+          We need to pass the correct this object
+        (JSC::Walker::walk):
+          Update calls to callReviver, and update property logic logic
+          to correctly handle the holder being mutated by the reviver
+          function.
+
+2009-08-26  Alice Liu  <alice.liu@apple.com>
+
+        Windows build fix: added some exported symbols
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Removed some exported symbols that no longer exist.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliejver Hunt.
+
+        x86-64 GTK broken due to code offsets changing, pointers sometimes packed into immediates.
+        https://bugs.webkit.org/show_bug.cgi?id=28317
+
+        We rely on a slightly OS X specific behaviour, that x86-64 applications have a 4Gb zero page,
+        so pointers are never representable as a 32-bit integer, and always have to be represented by
+        a separate immediate load instruction, rather than within the immediate field of an arithmetic
+        or memory operation.
+
+        We explicitly check for a couple of cases where a value might be representable in 32-bit, but
+        these probably never kick in on Mac OS, and only kick in to hose GTK.  Deleting these does not
+        show a performance degradation on SunSpider.  Remove.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A bit of Collector refatoring.
+        
+        SunSpider says no change. v8 says 1.003x faster (1.02x faster on splay).
+
+        * JavaScriptCore.exp:
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toPrimitive):
+        (JSC::JSCell::getPrimitiveNumber):
+        (JSC::JSCell::toBoolean):
+        (JSC::JSCell::toNumber):
+        (JSC::JSCell::toString):
+        (JSC::JSCell::toObject): Removed pure virtual functions from
+        JSCell, so the collector can construct one. This allowed
+        me to remove a bunch of ASSERT_NOT_REACHED throughout the
+        code, too.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell): ditto
+        (JSC::Heap::heap): Inlined this function because it's trivial.
+
+        * JavaScriptCore.exp:
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks): Renamed freeHeap to freeBlocks, since
+        it doesn't actually free the Heap object.
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::sweep):
+        * runtime/Collector.h: Refactored block allocation and destruction
+        into helper functions.
+        
+        * runtime/GetterSetter.cpp:
+        * runtime/JSAPIValueWrapper.cpp:
+        * runtime/JSPropertyNameIterator.cpp: Removed dummy implementations
+        of pure virtual functions. (See above.)
+
+=== End re-roll-in of r47738:47740 with Windows crash fixed ===
+
+2009-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: start out with a 32-bit value to avoid a shortening warning.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::sweep):
+
+2009-08-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Substantially reduced VM thrash in the GC heap.
+        
+        1.08x faster on v8 (1.60x faster on v8-splay).
+        
+        1.40x faster on bench-alloc-nonretained.
+        
+        1.90x faster on bench-alloc-retained.
+        
+        SunSpider says no change.
+        
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate): Fixed a long-standing bug: update a few local
+        variables unconditionally after calling collect(), since they may be used
+        even if we don't "goto scan". (In the bug I saw, usedBlocks got out of
+        sync with heap.usedBlocks).
+        (JSC::Heap::sweep): Keep enough free heap space to accomodate 
+        the number of objects we'll allocate before the next GC, plus 25%, for
+        good measure.
+        * runtime/Collector.h: Bumped the block size to 256k. This seems to give
+        the best cache performance, and it prevents us from initiating lots of
+        VM traffic to recover very small chunks of memory.
+
+=== Begin re-roll-in of r47738:47740 with Windows crash fixed ===
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added OwnPtr to VectorTraits so we can store OwnPtrs in Vectors.
+
+        * wtf/VectorTraits.h:
+
+2009-08-26  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Remove duplicated files from file list.
+
+        * GNUmakefile.am:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More export fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Hopefully fix all the exports from JSC on windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fixes).
+
+        Forgot I added files to JavaScriptCore. 
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the core runtime support for getOwnPropertyDescriptor.
+        This adds a virtual getOwnPropertyDescriptor method to every class
+        that implements getOwnPropertySlot that shadows the behaviour of
+        getOwnPropertySlot.  The alternative would be to make getOwnPropertySlot
+        (or PropertySlots in general) provide property attribute information,
+        but quick testing showed this to be a regression.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertyDescriptor):
+        * runtime/DatePrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyDescriptor):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        (JSC::JSONObject::getOwnPropertyDescriptor):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::getPropertyDescriptor):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        (JSC::JSString::getOwnPropertyDescriptor):
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticFunctionDescriptor):
+        (JSC::getStaticValueDescriptor):
+          Add property descriptor equivalents of the lookup
+          table access functions
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        (JSC::MathObject::getOwnPropertyDescriptor):
+        * runtime/MathObject.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/PropertyDescriptor.cpp: Added.
+        (JSC::PropertyDescriptor::writable):
+        (JSC::PropertyDescriptor::enumerable):
+        (JSC::PropertyDescriptor::configurable):
+        (JSC::PropertyDescriptor::hasAccessors):
+        (JSC::PropertyDescriptor::setUndefined):
+        (JSC::PropertyDescriptor::getter):
+        (JSC::PropertyDescriptor::setter):
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        * runtime/PropertyDescriptor.h: Added.
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        (JSC::PropertyDescriptor::attributes):
+        (JSC::PropertyDescriptor::isValid):
+        (JSC::PropertyDescriptor::value):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertyDescriptor):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyDescriptor):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertyDescriptor):
+        * runtime/StringPrototype.h:
+
+2009-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        How many copies of the parameters do you need?
+        https://bugs.webkit.org/show_bug.cgi?id=28701
+
+        The function parameters in JSC get copied a lot - and unnecessarily so.
+
+        Originally this happened due to duplicating FunctionBodyNodes on recompilation,
+        though the problem has been exacerbated by copying the parameters from the
+        original function body onto the executable, then back onto the real body that
+        will be generated (this happens on every function).  And this is all made worse
+        since the data structures in question are a little ugly - C style arrays of C++
+        objects containing ref counts, so they need a full copy-construct (rather than
+        a simple memcpy).
+
+        This can all be greatly simplified by just punting the parameters off into
+        their own ref-counted object, and forgoing all the copying.
+
+        ~no performance change, possible slight progression.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::parameterCount):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::FunctionExecutable::compile):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::parameterCount):
+
+2009-08-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by NOBODY (Buildfix).
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_CFLite target
+          that inherits from the debug_wincairo property sheet and therefore
+          links to the proper debug library.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_CFLite target
+          that inherits from the debug_wincairo property sheet and therefore
+          links to the proper debug library.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Export tryFastMalloc for Canvas3D work
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * JavaScriptCore.exp:
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        PLATFORM(CFNETWORK) should be USE(CFNETWORK).
+        https://bugs.webkit.org/show_bug.cgi?id=28713
+
+        * wtf/Platform.h: Added a #define to catch this issue in the
+        future. The define would generate an error on gcc without the
+        space in the expansion, but Visual C++ needs the space to cause an error.
+
+2009-08-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Revise CFLite Debug build to emit DLL's with _debug label.
+        https://bugs.webkit.org/show_bug.cgi?id=28695.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Modify
+          Cairo debug build to inherit from new debug_cairo property sheet.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops:
+          Modify to look for debug CFLite when in debug build.
+
+2009-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Adler & Darin Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28691
+        Do not retain ScopeNodes outside of parsing
+        
+        There is now no need for these to exist outside of parsing - their use in the runtime is replaced by Executable types.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::adoptData):
+        (JSC::FunctionBodyNode::parameterCount):
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        (JSC::Parser::arena):
+        (JSC::Parser::Parser):
+        (JSC::Parser::parse):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        (JSC::arrayProtoFuncSort):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compile):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCode):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::FunctionExecutable::copyParameters):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::sourceID):
+        (JSC::ScriptExecutable::sourceURL):
+        (JSC::ScriptExecutable::lineNo):
+        (JSC::ScriptExecutable::lastLine):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::recordParse):
+        (JSC::EvalExecutable::bytecode):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::bytecode):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::make):
+        (JSC::FunctionExecutable::bytecode):
+        (JSC::FunctionExecutable::isGenerated):
+        (JSC::FunctionExecutable::name):
+        (JSC::FunctionExecutable::parameterCount):
+        (JSC::FunctionExecutable::jitCode):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-08-24  Darin Adler  <darin@apple.com>
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put): Landed revised version I had tested but forgot
+        to land. Leave out the branch, since we don't need one.
+
+2009-08-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Array index miss case creates a string every time
+        https://bugs.webkit.org/show_bug.cgi?id=28664
+
+        SunSpider test results I saw:
+
+            0.5% faster overall
+            1% faster on crypto-aes
+            20% faster on crypto-md5
+            13% faster on crypto-sha1
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype): Initialize m_hasNoPropertiesWithUInt32Names
+        to true.
+        (JSC::ObjectPrototype::put): Clearly m_hasNoPropertiesWithUInt32Names if the new
+        property has a name that is the string form of a UInt32.
+        (JSC::ObjectPrototype::getOwnPropertySlot): Don't call JSObject::getOwnPropertySlot
+        if m_hasNoPropertiesWithUInt32Names is true, and it is highly likely to be true.
+
+        * runtime/ObjectPrototype.h: Added declarations for the above.
+
+2009-08-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Fix a typo in my distcheck build fix.
+
+        * GNUmakefile.am:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix for make distcheck.
+
+        * GNUmakefile.am: Added files required for the build.
+
+2009-08-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION(r47639-r47660): Webkit crashes on launch on PowerPC
+        https://bugs.webkit.org/show_bug.cgi?id=28655
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Initialize properly with a VPtrHackExecutable.
+        * wtf/Platform.h:
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Fix storage leak from syntax tree arena allocation patch.
+
+        * parser/Nodes.h: CommaNode needs to inherit from ParserArenaDeletable
+        because it has a vector.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData): Made non-inline again.
+        This is used outside Nodes.cpp so can't be inline unless
+        it is in the header.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Two loose ends from the last commit.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made ParserArena.h
+        and create_hash_table project-internal instead of "private".
+        * runtime/Executable.h: Removed accidentally-added constructor.
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Use an actual arena now. 0.6% speedup on SunSpider.
+
+        New and improved with 100% less leaking of the universe.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed all exports involving the class FunctionBodyNode, which no
+        longer needs to be used outside JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made Nodes.h and
+        Executable.h project-internal instead of "private".
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
+        contains const Identifier* now.
+
+        * parser/Grammar.y: Made identifiers from the lexer be const
+        Identifier* and updated since VarStack contains const Identifier* now.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
+        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
+        and changed to call ParserArena.
+        (JSC::Lexer::clear): Removed the code to manage m_identifiers and
+        added code to set m_arena to 0.
+        * parser/Lexer.h: Updated for changes above.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
+        on the arena.
+        (JSC::ParserArenaDeletable::operator new): Changed to call the
+        allocateDeletable function on the arena instead of deleteWithArena.
+        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
+        numeric identifiers. Some day we might want to optimize this for
+        integers so it doesn't create a string for each one.
+        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
+        since it's now a const Identifier& so it can't be left uninitialized.
+        (JSC::BreakNode::BreakNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
+        to keep track of the statements rather than a separate statement vector.
+        (JSC::BlockNode::BlockNode): Ditto.
+        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.
+
+        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
+        It seemed strangely out of place in the header.
+        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
+        UString as well as Identifier.
+        (JSC::SourceElements::singleStatement): Added.
+        (JSC::SourceElements::lastStatement): Added.
+        (JSC::RegExpNode::emitBytecode): Changed the throwError code to use
+        the substitution mechanism instead of doing a string append.
+        (JSC::SourceElements::emitBytecode): Added. Replaces the old
+        statementListEmitCode function, since we now keep the SourceElements
+        objects around.
+        (JSC::BlockNode::lastStatement): Added.
+        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
+        statementListEmitCode.
+        (JSC::CaseClauseNode::emitBytecode): Added.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
+        instead of statementListEmitCode.
+        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
+        SourceElements* instead of using releaseContentsIntoVector.
+        (JSC::ScopeNode::emitStatementsBytecode): Added.
+        (JSC::ScopeNode::singleStatement): Added.
+        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
+        of statementListEmitCode.
+        (JSC::EvalNode::emitBytecode): Ditto.
+        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
+        insetad of statementListEmitCode and check for the return node using
+        the new functions.
+
+        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
+        of Identifier and rely on the arena to control lifetime. Added a new
+        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
+        FastAllocBase instead of having its own operator new. Base the Node
+        class on ParserArenaFreeable. Changed the various Node classes
+        to use const Identifier& instead of Identifier to avoid the need to
+        call their destructors and allow them to function as "freeable" in the
+        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
+        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
+        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
+        as a base class since they do not descend from Node. Eliminated the
+        StatementVector type and instead have various classes use SourceElements*
+        instead of StatementVector. This prevents those classes from having to
+        use ParserArenaDeletable to make sure the vector destructor is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Pass the arena to the lexer.
+
+        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
+        included by Nodes.h.
+        (JSC::Parser::parseFunctionFromGlobalCode): Changed to use the
+        singleStatement function, since there is no longer any children function.
+        Removed some unneeded use of RefPtr.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
+        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
+        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
+        since we store only the current pointer and the end of pool pointer.
+        (JSC::ParserArena::deallocateObjects): Added. Contains the common
+        memory-deallocation logic used by both the destructor and the
+        reset function.
+        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
+        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
+        new structures, and switched to use clear() instead of shrink(0) since
+        we don't really reuse arenas.
+        (JSC::ParserArena::makeNumericIdentifier): Added.
+        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
+        is empty.
+        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
+        since this is used only for assertions at the moment.
+        (JSC::ParserArena::derefWithArena): Make non-inline.
+
+        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
+        ones that don't need destructors to be called. Also added a separate
+        IdentifierArena object, a segmented vector of identifiers that used
+        to be in the Lexer.
+
+        * runtime/Executable.h: Moved the definition of the
+        FunctionExecutable::make function here. It can't go in JSFunction.h
+        since that header has to be used outside JavaScriptCore and so can't
+        include this, which includes Nodes.h. The function could be moved
+        elswhere if we don't want to include JSFunction.h in this header, but
+        for now this seems to be the best place.
+
+        * runtime/JSFunction.h: Removed the include of Executable.h and
+        definition of the FunctionExecutable::make function.
+
+        * wtf/FastMalloc.cpp: Fixed an incorrect comment.
+
+2009-08-21  Mark Rowe  <mrowe@apple.com>
+
+        Fix the non-JIT build.
+
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative QuickTime build fix.
+
+        * runtime/JSArray.cpp:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative QT build fix.
+
+        * runtime/StringPrototype.cpp:
+
+2009-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restructure Executable types so that host functions do not hold a FunctionExecutable.
+        https://bugs.webkit.org/show_bug.cgi?id=28621
+
+        All JSFunction objects have a pointer to an Executable*.  This is currently always a
+        FunctionExecutable, however this has a couple of drawbacks.  Host functions do not
+        store a range of information that the FunctionExecutable provides (source, name,
+        CodeBlock & information presently held on the FunctionBodyNode). 
+
+        [ * nearly all... see below! ]
+
+        Instead, make JSFunctions hold a pointer to an ExecutableBase, move fields specific
+        to JS sourced executable types (source, node) into a new subclass (ScriptExecutable),
+        and create a new NativeExecutable type.  We now provide a new method in JSFunction
+        to access & downcast to FunctionExecutable, but in doing so we can make an early
+        check (with an ASSERT) to ensure that the Executable read from a function will only
+        be treated as a FunctionExecutable (and thus the JS sepcific fields will only be
+        accessed) if the JSFunction is not a host function.
+
+        There is one JSFunction that currently does not have an Executable, which is the
+        object created to allow us to read out the vtable pointer.  By making this change
+        we can also add a new Executable type fror this object (VPtrHackExecutable).
+        Since this means that really all JSFunctions have an Executable we no longer have
+        to null-check m_executable before us it - particularly in isHostFunction().
+
+        This patch removes CacheableEvalExecutable, since all subclasses of ExecutableBase
+        can now be ref-counted - since both JSFunction holds (and ref-counts) an ExecutableBase
+        that might be a FunctionExecutable or a NativeExecutable.  This does now mean that all
+        ProgramExecutables and EvalExecutables (unnecessarily) provide an interface to be
+        ref-counted, however this seems less-bad than host functions unnecessarily providing
+        interface to access non-host specific information.
+
+        The class hierarcy has changed from this:
+        
+        - ExecutableBase
+            - ProgramExecutable
+            - EvalExecutable
+                - CacheableEvalExecutable (also RefCounted by multiple-inheritance)
+            - FunctionExecutable (also RefCounted by multiple-inheritance, 'special' FunctionExecutable also used for host functions)
+
+        To this:
+        
+        - RefCounted
+            - ExecutableBase
+                - NativeExecutable
+                - VPtrHackExecutable
+                - ScriptExecutable
+                    - ProgramExecutable
+                    - EvalExecutable
+                    - FunctionExecutable
+
+        This patch speeds up sunspidey by a couple of ms (presumably due to the changes to isHostFunction()).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        * runtime/Executable.cpp:
+        (JSC::NativeExecutable::~NativeExecutable):
+        (JSC::VPtrHackExecutable::~VPtrHackExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::~ExecutableBase):
+        (JSC::ExecutableBase::isHostFunction):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::source):
+        (JSC::ScriptExecutable::sourceID):
+        (JSC::ScriptExecutable::sourceURL):
+        (JSC::ScriptExecutable::lineNo):
+        (JSC::ScriptExecutable::lastLine):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        (JSC::JSFunction::jsExecutable):
+        (JSC::JSFunction::isHostFunction):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Browser hangs on opening Web Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28438
+
+        Code generation needs to be able to walk the entire scopechain in some
+        cases, however the symbol table used by activations was a member of the
+        codeblock.  Following recompilation this may no longer exist, leading
+        to a crash or hang on lookup.
+
+        We fix this by introducing a refcounted SymbolTable subclass, SharedSymbolTable,
+        for the CodeBlocks used by function code.  This allows activations to
+        maintain ownership of a copy of the symbol table even after recompilation so
+        they can continue to work.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable):
+        (JSC::CodeBlock::sharedSymbolTable):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::FunctionCodeBlock::~FunctionCodeBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArguments):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateBytecode):
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        (JSC::JSActivation::JSActivationData::~JSActivationData):
+        * runtime/SymbolTable.h:
+
+2009-08-20  Xan Lopez  <xlopez@igalia.com>
+
+        Add new file to GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-08-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added a number => string cache.
+        
+        1.07x faster on v8 (1.7x faster on v8-splay).
+        1.004x faster on SunSpider.
+
+        * runtime/JSCell.h: Moved JSValue::toString to JSString.h.
+        * runtime/JSGlobalData.h: Holds the cache.
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toString):
+        (JSC::JSNumberCell::toThisString): Removed -0 special case.
+        UString handles this now, since too many clients were
+        special-casing it.
+
+        * runtime/JSString.h:
+        (JSC::JSValue::toString): Use the cache when converting
+        an int or double to string.
+
+        * runtime/Operations.h:
+        (JSC::concatenateStrings): Call toString to take advantage
+        of the cache.
+
+        * runtime/SmallStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookup): The cache.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from): Added -0 special case mentioned above.
+        Removed appendNumeric because it's mutually exclusive with the
+        cache.
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: fast/profiler/call.html is crashing occasionally
+        https://bugs.webkit.org/show_bug.cgi?id=28476
+
+        Using the codeblock for information about how many parameters and
+        locals a function has is unsafe in certain circumstances.  The
+        basic scenario is all function code being cleared in response to
+        the debugger or profiler being enabled, and then an activation is
+        marked before its associated function is re-executed.
+
+        To deal with this scenario we store the variable count of a function
+        directly in the FunctionExecutable, and then use that information.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateBytecode):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::variableCount):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+
+2009-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Numbering of arguments to emitGetJITStubArg/emitPutJITStubArg incorrect
+        <bug lost in the great bug disasteroony of 08/20/09!>
+
+        The argumentNumber argument to emitGetJITStubArg/emitPutJITStubArg should match
+        the argument number used within the stub functions in JITStubs.cpp, but it doesn't.
+
+        Firstly, all the numbers changed when we added a void* 'reserved' as the first slot
+        (rather than leaving argument 0 unused), and secondly in 32_64 builds the index to
+        peek/poke needs to be multiplies by 2 (since the argument to peek/poke is a number
+        of machine words, and on 32_64 build the argument slots to stub functions are two
+        words wide).
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
+        https://bugs.webkit.org/show_bug.cgi?id=28332
+
+        Follow up style fixes that were missed in review.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::StructureTransitionTable::contains):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::add):
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Add new exports to windows jsc build
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: significant slowdown on Celtic Kane "AJAX declaration" subtest
+        https://bugs.webkit.org/show_bug.cgi?id=28332
+
+        The method check optimisation made transitions aware of the value being
+        assigned when a transition was assigning a function.  This had the side
+        effect of making every assignment of a function expression result in a
+        new transition, and thus a new Structure.  The net result of this is that
+        the common JS idiom of
+
+            function MyObject() {
+                this.myFunction = function(...){...};
+            }
+            new MyObject();
+
+        Will produce a unique structure on every iteration, meaning that all
+        caching is defeated and there is a significant amount of structure churn.
+
+        The fix is to return the transition to its original form where it is
+        keyed off a property name + attributes tuple, but have each transition
+        support an optional transition on a specific value.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::hasTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::transitionedFor):
+        (JSC::Structure::hasTransition):
+        (JSC::Structure::):
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHashTraits::emptyValue):
+        (JSC::StructureTransitionTable::hasTransition):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+
+2009-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove FunctionCodeBlock.
+        https://bugs.webkit.org/show_bug.cgi?id=28502
+
+        These only exist to allow JIT code to dereference properties off the
+        CodeBlock for any callee, regardless of whether it is a host function.
+
+        Instead just use the FunctionExecutable.  Copy the m_parameters field
+        from the CodeBlock into the Executable, and use this to distinguish
+        between host functions, functions that have been bytecompiled, and
+        functions that have not.
+
+        m_parameters is moved to ExecutableBase rather than FunctionExecutable
+        so that (as a separate change) we can move make a separate class of
+        executable for host code, which is not devived from FunctionExecutable
+        (host code does not feature any of the properties that normal executable
+        do and will provide, such as source, attributes, and a parsed name).
+
+        1% win on v8 tests, 0.5% on sunspider.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
+        
+            remove NativeCodeBlocks and the NativeCode code type.
+        
+        * jit/JIT.cpp:
+        (JSC::JIT::linkCall):
+
+            Revert to previous behaviour (as currently still commented!) that Hhost functions have a null codeblock.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+
+            Bring the 32_64 & non-32_64 JITs into line with each other, callee in regT0.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+
+            Rewrite call trampolines to not use the CodeBlock.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+            Make call_JSFunction & call_arityCheck return the callee, don't expect to be passed the CodeBlock.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::):
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::FunctionExecutable::isHostFunction):
+
+            Add m_numParameters.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+
+            Only call generatedBytecode() on JSFunctions non-host FunctionExecutables.
+
+2009-08-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28054
+       
+        Use a helper function to work around winscw compiler forward declaration bug
+        regarding templated classes.
+
+        Add parenthesis around (PassRefPtr::*UnspecifiedBoolType) to make winscw compiler
+        work with the default UnSpecifiedBoolType() operator, which removes the winscw
+        specific bool cast hack.
+
+        * wtf/PassRefPtr.h:
+        (WTF::derefIfNotNull):
+        (WTF::PassRefPtr::~PassRefPtr):
+
+2009-08-19  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Change namespace ARM to ARMRegisters
+        X86 to X86Registers to avoid conflict with macros
+        https://bugs.webkit.org/show_bug.cgi?id=28428
+
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        * wrec/WRECGenerator.cpp:
+        * wrec/WRECGenerator.h:
+        * yarr/RegexJIT.cpp:
+
+2009-08-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        We actually need to mark the value in a number object if we're using the
+        32bit number representation.
+
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+
+2009-08-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+         We probably shouldn't be keeping the AST for eval nodes around forevar.
+        https://bugs.webkit.org/show_bug.cgi?id=28469
+
+        EvalNodes don't destroyData() (delete their parser data) since they need to hold onto
+        their varStack.  Copy a list of variable onto EvalCodeBlock, and this can go away.
+
+        * bytecode/CodeBlock.h:
+        (JSC::EvalCodeBlock::variable):
+        (JSC::EvalCodeBlock::numVariables):
+        (JSC::EvalCodeBlock::adoptVariables):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/Nodes.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateBytecode):
+        * runtime/Executable.h:
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        http://bugs.webkit.org/show_bug.cgi?id=28441
+
+        Fix a build issue with ICU 4.2 or later on Windows with Visual C++. 
+        Instead of defining all isXXX and toupper/tolower as 
+          WTF_Please_use_ASCIICType_instead_of_ctype_see_comment_in_ASCIICType_h,
+        #define them to be different by prepending 'WTF_...ASCIIType_h' with
+        the originial names like 'toupper_WTF_...ASCIIType_h'. 
+
+        * wtf/DisallowCType.h:
+
+2009-08-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Assigning a function to an object should always use the existing transition, even if the transition is not specialized
+        https://bugs.webkit.org/show_bug.cgi?id=28442
+
+        Check for an unspecialized transition as an alternative to always failing if specialisation does not match.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Added additional getter to ByteArray with an unsigned char as return.
+        ByteArray can take unsigned char directly now.
+
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::set):
+        (WTF::ByteArray::get):
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        
+2009-08-18  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-08-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        No, silly runtime, AST nodes are not for you.
+
+        We still use AST nodes (ScopeNodes, particularly FunctionBodyNodes) within
+        the runtime, which means that these nodes must be persisted outside of the
+        arena, contain both parser & runtime data, etc.  This is all a bit of a mess.
+
+        Move functionality into a new FunctionExecutable class.
+
+        * API/JSCallbackFunction.cpp:
+        * API/JSObjectRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::discardBytecode):
+        (JSC::CodeBlock::instructionCount):
+        (JSC::CodeBlock::getJITCode):
+        (JSC::CodeBlock::executablePool):
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::extractExceptionInfo):
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::functionDecl):
+        (JSC::CodeBlock::numberOfFunctionDecls):
+        (JSC::CodeBlock::addFunctionExpr):
+        (JSC::CodeBlock::functionExpr):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::NativeCodeBlock::NativeCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::reparseDataIfNecessary):
+        * parser/Nodes.h:
+        (JSC::EvalNode::partialDestroyData):
+        * parser/Parser.h:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/CallData.h:
+        (JSC::):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/ConstructData.h:
+        (JSC::):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        * runtime/Executable.cpp: Added.
+        (JSC::EvalExecutable::generateBytecode):
+        (JSC::ProgramExecutable::generateBytecode):
+        (JSC::FunctionExecutable::generateBytecode):
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCode):
+        (JSC::FunctionExecutable::isHostFunction):
+        (JSC::FunctionExecutable::markAggregate):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::recompile):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::~ExecutableBase):
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::source):
+        (JSC::ExecutableBase::sourceID):
+        (JSC::ExecutableBase::lastLine):
+        (JSC::ExecutableBase::usesEval):
+        (JSC::ExecutableBase::usesArguments):
+        (JSC::ExecutableBase::needsActivation):
+        (JSC::ExecutableBase::astNode):
+        (JSC::ExecutableBase::generatedJITCode):
+        (JSC::ExecutableBase::getExecutablePool):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::bytecode):
+        (JSC::EvalExecutable::varStack):
+        (JSC::EvalExecutable::evalNode):
+        (JSC::EvalExecutable::jitCode):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        (JSC::ProgramExecutable::bytecode):
+        (JSC::ProgramExecutable::programNode):
+        (JSC::ProgramExecutable::jitCode):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::name):
+        (JSC::FunctionExecutable::bytecode):
+        (JSC::FunctionExecutable::generatedBytecode):
+        (JSC::FunctionExecutable::usesEval):
+        (JSC::FunctionExecutable::usesArguments):
+        (JSC::FunctionExecutable::parameterCount):
+        (JSC::FunctionExecutable::paramString):
+        (JSC::FunctionExecutable::isGenerated):
+        (JSC::FunctionExecutable::body):
+        (JSC::FunctionExecutable::jitCode):
+        (JSC::FunctionExecutable::createNativeThunk):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::isDynamicScope):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        (JSC::FunctionExecutable::make):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalData.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix 300,000+ leaks seen during the regression tests.
+
+        EvalCodeCache::get was heap-allocating an EvalExecutable instance without adopting the initial reference.
+        While fixing this we noticed that EvalExecutable was a RefCounted type that was sometimes stack allocated.
+        To make this cleaner and to prevent clients from attempting to ref a stack-allocated instance, we move the
+        refcounting down to a new CacheableEvalExecutable class that derives from EvalExecutable. EvalCodeCache::get
+        now uses CacheableEvalExecutable::create and avoids the leak.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/Executable.h:
+        (JSC::CacheableEvalExecutable::create):
+        (JSC::CacheableEvalExecutable::CacheableEvalExecutable):
+
+2009-08-17  Oliver Hunt  <oliver@apple.com>
+
+        RS=Mark Rowe.
+
+        REGRESSION (r47292): Prototype.js is broken by ES5 Arguments changes
+        https://bugs.webkit.org/show_bug.cgi?id=28341
+        <rdar://problem/7145615>
+
+        Reverting r47292.  Alas Prototype.js breaks with Arguments inheriting
+        from Array as ES5 attempted.  Prototype.js defines $A in terms of a 
+        function it places on (among other global objects) the Array prototype,
+        thus breaking $A for arrays.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * tests/mozilla/ecma_3/Function/arguments-001.js:
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2009-08-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix build with FAST_MALLOC_MATCH_VALIDATION enabled.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
+
+2009-08-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix crash on ./ecma_2/RegExp/exec-002.js.
+        https://bugs.webkit.org/show_bug.cgi?id=28353
+
+        Change the order of freeParenthesesDisjunctionContext and
+        popParenthesesDisjunctionContext on all call sites as the pop
+        method is accessing backTrack->lastContext which is the context
+        that is about to be freed.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+
+2009-08-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28352
+
+        Fix coding style violations. Use m_ for C++ class members. Remove
+        trailing whitespace on empty lines.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::tryConsumeCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::alterantiveBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2009-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build with JIT disabled.
+
+        * runtime/Arguments.h: Only compile the jitCode method when the JIT is enabled.
+        * runtime/Executable.h: Include PrototypeFunction.h so the compiler knows what
+        NativeFunctionWrapper is when the JIT is disabled.
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added ENABLE_EVENTSOURCE flag.
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-14  Gavin Barraclough  <barraclough@apple.com>
+
+        * parser/Parser.h:
+        (JSC::EvalExecutable::parse):
+        (JSC::ProgramExecutable::parse):
+        * runtime/Executable.h:
+
+2009-08-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove AST nodes from use within the Runtime (outside of parsing), stage 1
+        https://bugs.webkit.org/show_bug.cgi?id=28330
+
+        Remove the EvalNode and ProgramNode from use in the runtime.  They still exist
+        after this patch, but are hidden behind EvalExecutable and FunctionExecutable,
+        and are also still reachable behind CodeBlock::m_ownerNode.
+
+        The next step will be to beat back FunctionBodyNode in the same fashion.
+        Then remove the usage via CodeBlock, then only construct these nodes only on
+        demand during bytecode generation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::GlobalCodeBlock::~GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::NativeCodeBlock::NativeCodeBlock):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::execute):
+        * interpreter/Interpreter.h:
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        (JSC::Parser::reparse):
+        (JSC::Parser::parseFunctionFromGlobalCode):
+        (JSC::::parse):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Error.cpp:
+        (JSC::throwError):
+        * runtime/Error.h:
+        * runtime/Executable.h: Added.
+        (JSC::TemplateExecutable::TemplateExecutable):
+        (JSC::TemplateExecutable::markAggregate):
+        (JSC::TemplateExecutable::sourceURL):
+        (JSC::TemplateExecutable::lineNo):
+        (JSC::TemplateExecutable::bytecode):
+        (JSC::TemplateExecutable::jitCode):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::codeBlocks):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::arrayConstructorIsArray): Removed unneeded isObject call
+        and updated remaining isObject call to new name, inherits.
+
+        * runtime/JSCell.h: Renamed isObject(<class>) to inherits(<class>)
+        but more importantly, made it non-virtual (it was already inline)
+        so it is now as fast as JSObject::inherits was.
+
+        * runtime/JSObject.h: Removed inherits function since the one
+        in the base class is fine as-is. Also made various JSCell functions
+        that should not be called on JSObject uncallable by making them
+        both private and not implemented.
+        (JSC::JSCell::inherits): Updated name.
+        (JSC::JSValue::inherits): Ditto.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncConcat):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSValue.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChain::localDepth):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSplit):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-07-31  Harald Fernengel  <harald.fernengel@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Adding QNX as a platform. Currently only tested with Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27885
+
+        * JavaScriptCore/runtime/Collector.cpp: Added retrieving of stack base
+          since QNX doesn't have the pthread _nt functions
+        * JavaScriptCore/wtf/Platform.h: Added WTF_PLATFORM_QNX and corresponding
+          defines
+        * WebCore/bridge/npapi.h: Build fix for missing typedefs on QNX
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Currently generic ARM and ARMv7 platforms work only with JSVALUE32
+        https://bugs.webkit.org/show_bug.cgi?id=28300
+
+        * wtf/Platform.h:
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Enable JIT on ARM for QT by default
+        https://bugs.webkit.org/show_bug.cgi?id=28259
+
+        * wtf/Platform.h:
+
+2009-08-14  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Enable YARR_JIT on ARM for QT by default
+        https://bugs.webkit.org/show_bug.cgi?id=28259
+
+        * wtf/Platform.h:
+
+2009-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Arguments object should inherit from Array
+        https://bugs.webkit.org/show_bug.cgi?id=28298
+
+        Make the Arguments object conform to the behaviour specified in ES5.
+        The simple portion of this is to make Arguments use Array.prototype
+        as its prototype rather than Object.prototype.
+
+        The spec then requires us to set instance.constructor to the pristine
+        Object constructor, and instance.toString and instance.toLocaleString
+        to the pristine versions from Object.prototype.  To do this we now 
+        make the ObjectPrototype constructor return its toString and
+        toLocaleString functions (similar to the call and apply functions
+        from FunctionPrototype).
+
+        Oddly enough this reports itself as a slight win, but given the code
+        isn't hit in the tests that claim to have improved I put this down to
+        code motion.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::initializeStandardProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::objectConstructor):
+        (JSC::JSGlobalObject::objectToStringFunction):
+        (JSC::JSGlobalObject::objectToLocaleStringFunction):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * tests/mozilla/ecma_3/Function/arguments-001.js:
+          Update test to new es5 behaviour
+
+2009-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Remove MarkStack::drain from the JSC exports file
+
+        MarkStack::drain is now marked inline, the including it in the exports file
+        produces an ld warning
+
+        * JavaScriptCore.exp:
+
+2009-08-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove accidentally left in debugging statement.
+
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Array.isArray
+        https://bugs.webkit.org/show_bug.cgi?id=28296
+
+        Add support for Array.isArray to the Array constructor
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayConstructor.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Attempt to fix windows build
+
+        * runtime/Collector.cpp:
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Add a bit to TypeInfo to indicate that an object uses the standard
+        JSObject::markChildren method.  This allows us to devirtualise marking
+        of most objects (though a branch is still needed).  We also add a branch
+        to identify arrays thus devirtualising marking in that case as well.
+
+        In order to make the best use of this devirtualisation I've also reworked
+        the MarkStack::drain() logic to make the iteration more efficient.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * JavaScriptCore.exp:
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::markChildren):
+        * runtime/JSArray.h:
+        (JSC::JSArray::markChildrenDirect):
+        (JSC::MarkStack::drain):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::MarkStack::append):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        (JSC::JSObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSType.h:
+        (JSC::):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::MarkSet::MarkSet):
+        (JSC::MarkStack::MarkStackArray::last):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/TypeInfo.h:
+        (JSC::TypeInfo::hasDefaultMark):
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Some small bits of housekeeping.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make Parser.h
+        project instead of private. Remove JSONObject.lut.h.
+
+        * assembler/ARMAssembler.h: Remove unneeded WTF prefix.
+        * assembler/AssemblerBufferWithConstantPool.h: Ditto.
+        * bytecompiler/BytecodeGenerator.h: Ditto.
+
+        * wtf/SegmentedVector.h: Add a "using" statement as we do
+        with the other WTF headers.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Fix Tiger build.
+
+        * parser/Grammar.y: Use a template function so we can compile
+        setStatementLocation even if it comes before YYLTYPE is defined.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Too much use of void* in Grammar.y
+        https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Changed all the helper functions to
+        take a JSGlobalData* instead of a void*. A couple formatting
+        tweaks that I missed when breaking this into pieces.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Reduced and sorted includes. Tweaked comment
+        format. Marked a few more functions inline.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Pass the number to the PropertyNode instead of
+        first turning it into an Identifier.
+
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode): Add an overload that takes a double
+        so the code to convert to a string can be here instead of Grammar.y.
+        * parser/Nodes.h: Ditto.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Eliminate the DBG macro.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        Another part of https://bugs.webkit.org/show_bug.cgi?id=28287
+
+        * parser/Grammar.y: Eliminate the SET_EXCEPTION_LOCATION macro.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by George Staikos.
+
+        George asked me to break the patch from
+        https://bugs.webkit.org/show_bug.cgi?id=28287
+        into smaller pieces and land it in stages.
+
+        * parser/Grammar.y: Eliminate the LEXER macro.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try some more to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export a new symbol.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Ditto.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export a new symbol.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Ditto.
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        Eliminate dependencies on Nodes.h outside JavaScriptCore,
+        and cut down on them inside JavaScriptCore.
+
+        Change regular expression parsing to use identifiers as
+        with other strings we parse.
+
+        Fix a couple things that are needed to use const Identifier
+        more, which will be part of the parser arena work.
+
+        * JavaScriptCore.exp: Resorted and updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Changed
+        CollectorHeapIterator.h to be project-internal.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushNewScope): Added const.
+        * bytecompiler/BytecodeGenerator.h: Ditto.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Moved this function
+        here from WebCore. Here is better since it uses so many internals.
+        Removed unimportant optimization for the no listener case.
+        * debugger/Debugger.h: Ditto. Also removed unneeded include
+        and tweaked formatting and comments.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName): Call asFunction instead
+        of doing the unchecked static_cast.
+        (JSC::DebuggerCallFrame::calculatedFunctionName): Ditto.
+
+        * jit/JITStubs.cpp:
+        (JSC::op_call_JSFunction): Call isHostFunction on the body rather
+        than on the JSFunction.
+        (JSC::vm_lazyLinkCall): Ditto.
+        (JSC::op_construct_JSConstruct): Ditto.
+
+        * parser/Grammar.y: Changed callers to use new scanRegExp with
+        out arguments instead of relying on state in the Lexer. And
+        callers that just want to skip a regular expression to use
+        skipRegExp.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::scanRegExp): Changed to use out arguments, and to
+        add a prefix argument so we can add in the "=" character as needed.
+        Also rewrote to streamline the logic a bit inspired by suggestions
+        by David Levin.
+        (JSC::Lexer::skipRegExp): Added. Version of the function above that
+        does not actually put the regular expression into a string.
+        (JSC::Lexer::clear): Removed code to clear m_pattern and m_flags.
+        * parser/Lexer.h: Changed scanRegExp to have out arguments. Added
+        skipRegExp. Eliminated pattern, flags, m_pattern, and m_flags.
+
+        * parser/NodeConstructors.h:
+        (JSC::RegExpNode::RegExpNode): Changed to take const Identifier&.
+        * parser/Nodes.cpp:
+        (JSC::RegExpNode::emitBytecode): Changed since m_pattern and
+        m_flags are now Identifier instead of UString.
+        (JSC::FunctionBodyNode::make): Moved this function here instead
+        of putting it in the JSFunction.h header.
+        * parser/Nodes.h: Changed RegExpNode to use Identifier.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier): Changed to use isHostFunction
+        on the body instead of on the JSFunction object.
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Ditto.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostFunction): Moved here from header.
+        (JSC::JSFunction::isHostFunctionNonInline): Added.
+        (JSC::JSFunction::JSFunction): Removed unneeded initialization of
+        m_body to 0.
+        (JSC::JSFunction::setBody): Moved here from header.
+
+        * runtime/JSFunction.h: Removed unneeded includes. Moved private
+        constructor down to the private section. Made virtual functions
+        private. Removed unneeded overload of setBody and moved the body
+        of the function into the .cpp file. Changed assertions to use
+        the non-inline version of isHostFunction.
+
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter): Use asFunction instead
+        of doing the unchecked static_cast.
+
+        * wtf/SegmentedVector.h:
+        (WTF::SegmentedVector::isEmpty): Added.
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Use the version of operator new that takes a JSGlobalData when allocating FuncDeclNode and FuncExprNode
+        from within the grammar to prevent these nodes from being leaked.
+
+        * parser/Grammar.y:
+
+2009-08-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Remove the special-case for Qt wrt JSVALUE_32 introduced in
+        r46709. It must've been a dependency issue on the bot, as
+        after a manual build all the tests pass on amd64 and ia32.
+
+        * wtf/Platform.h:
+
+2009-08-12  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add optimize call and property access support for ARM JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        For tightly coupled sequences the BEGIN_UNINTERRUPTED_SEQUENCE and
+        END_UNINTERRUPTED_SEQUENCE macros have been introduced which ensure
+        space for instructions and constants of the named sequence. This
+        method is vital for those architecture which are using constant pool.
+
+        The 'latePatch' method - which was linked to JmpSrc - is replaced with
+        a port specific solution (each calls are marked to place their address
+        on the constant pool).
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::linkBranch):
+        (JSC::ARMAssembler::executableCopy): Add extra align for constant pool.
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::JmpSrc::JmpSrc):
+        (JSC::ARMAssembler::sizeOfConstantPool):
+        (JSC::ARMAssembler::jmp):
+        (JSC::ARMAssembler::linkCall):
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::flushIfNoSpaceFor): Fix the
+        computation of the remaining space.
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::ensureSpace):
+        (JSC::MacroAssemblerARM::sizeOfConstantPool):
+        (JSC::MacroAssemblerARM::prepareCall):
+        * assembler/X86Assembler.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::endUninterruptedSequence):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Dave Kilzer.
+
+        Disable WTF_USE_JSVALUE32_64 on iPhone for now (support not yet added for ARMv7).
+
+        * wtf/Platform.h:
+
+2009-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachoviak.
+
+        Ooops - moved code that had been accidentally added to op_new_func instead of
+        op_new_func_exp, to where it shoulds be.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * wtf/Platform.h:
+
+2009-08-12  Ada Chan  <adachan@apple.com>
+
+        Added workaround for the limitation that VirtualFree with MEM_RELEASE
+        can only accept the base address returned by VirtualAlloc when the region
+        was reserved and it can only free the entire region, and not a part of it.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackWin.cpp:
+        (JSC::MarkStack::releaseStack):
+
+2009-08-12  Balazs Kelemen  <kelemen.balazs.3@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        Build fix: use std::numeric_limits<long long>::min() instead of LLONG_MIN
+        since LLONG_MIN is not defined in standard c++.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+
+2009-08-12  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix for Gtk platforms debug builds.
+
+        * GNUmakefile.am: Choose MarkStackPosix.cpp or MarkStackWin.cpp
+        depending on platform.
+
+2009-08-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for Mac and 32-bit Windows.
+
+        * runtime/UString.cpp: Include wtf/StringExtras.h for snprintf.
+        (JSC::UString::from): Use %lld instead of %I64d for snprintf
+        on non-windows platforms.
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compile error on 64Bit Windows, when UString::from
+        is called with an intptr_t.
+
+        Added new UString::From overload with long long parameter.
+
+        Thanks to Holger for the long long idea.
+
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+        * runtime/UString.h:
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Minor style fixes.
+
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::getValue):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Jump through a few hoops to make it much harder to accidentally
+        miss null-checking of values returned by the try-* allocation
+        routines.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::allocChars):
+        (JSC::reallocChars):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::createRep):
+        (JSC::concatenate):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+        (WTF::TCMallocStats::tryFastMalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::~TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::operator PossiblyNull<T>):
+        (WTF::TryMallocReturnValue::getValue):
+        * wtf/Platform.h:
+        * wtf/PossiblyNull.h: Added.
+        (WTF::PossiblyNull::PossiblyNull):
+        (WTF::PossiblyNull::~PossiblyNull):
+        (WTF::::getValue):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix part deux).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        These objects were also being referenced from the CodeBlock.  By changing this
+        to just retain pointers to FunctionBodyNodes these classes can be restricted to
+        use during parsing.
+
+        No performance impact (or sub-percent progression).
+
+        * JavaScriptCore.exp:
+            Update symbols.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunction):
+        (JSC::CodeBlock::function):
+            Unify m_functions & m_functionExpressions into a single Vector<RefPtr<FuncExprNode> >.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+            FunctionStacks now contain FunctionBodyNodes not FuncDeclNodes.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+            Update to reflect chnages in CodeBlock.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+            Update to reflect chnages in CodeBlock.
+
+        * parser/Grammar.y:
+            FunctionStacks now contain FunctionBodyNodes not FuncDeclNodes.
+
+        * parser/NodeConstructors.h:
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::mark):
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::ident):
+            Move m_ident & make methods from FuncDeclNode & FuncExprNode to FunctionBodyNode.
+
+        * runtime/JSFunction.h:
+        (JSC::FunctionBodyNode::make):
+            Make this method inline (was FuncDeclNode::makeFunction).
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Native JSON.stringify does not omit functions
+        https://bugs.webkit.org/show_bug.cgi?id=28117
+
+        Objects that are callable should be treated as undefined when
+        serialising to JSON.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        REGRESSION: Hang/crash in BytecodeGenerator::constRegisterFor loading simple page
+        https://bugs.webkit.org/show_bug.cgi?id=28169
+
+        Handle the case where someone has attempted to shadow a property
+        on the global object with a constant.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::constRegisterFor):
+        * parser/Nodes.cpp:
+        (JSC::ConstDeclNode::emitCodeSingle):
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds ENABLE_NOTIFICATION flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Modifications on JavaScriptCore to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28121
+
+        * runtime/Collector.cpp: Haiku doesn't have sys/mman.h, using OS.h instead.
+        (JSC::currentThreadStackBase): Haiku uses its own threading system.
+        * wtf/Platform.h: Defining all Haiku platform values.
+        * wtf/haiku/MainThreadHaiku.cpp: Adding a missing header (NotImplemented.h).
+
+2009-08-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Buildfix for Qt-win platforms.
+
+        * JavaScriptCore.pri: Choose MarkStackPosix.cpp or MarkStackWin.cpp depend on platform.
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (And another build fix).
+
+        Add new exports for MSVC
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (yet another build fix).
+
+        Remove obsolete entries from MSVC exports file
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Add includes needed for non-allinonefile builds
+
+        * runtime/GetterSetter.h:
+        * runtime/ScopeChain.h:
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Fix export file for last build fix
+
+        * JavaScriptCore.exp:
+
+2009-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Hoist page size initialization into platform specific code.
+
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::pageSize):
+        * runtime/MarkStackPosix.cpp:
+        (JSC::MarkStack::initializePagesize):
+        * runtime/MarkStackWin.cpp:
+        (JSC::MarkStack::initializePagesize):
+
+2009-08-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Stack overflow crash in JavaScript garbage collector mark pass
+        https://bugs.webkit.org/show_bug.cgi?id=12216
+
+        Make the GC mark phase iterative by using an explicit mark stack.
+        To do this marking any single object is performed in multiple stages
+          * The object is appended to the MarkStack, this sets the marked
+            bit for the object using the new markDirect() function, and then
+            returns
+          * When the MarkStack is drain()ed the object is popped off the stack
+            and markChildren(MarkStack&) is called on the object to collect 
+            all of its children.  drain() then repeats until the stack is empty.
+
+        Additionally I renamed a number of methods from 'mark' to 'markAggregate'
+        in order to make it more clear that marking of those object was not
+        going to result in an actual recursive mark.
+
+        * GNUmakefile.am
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::markAggregate):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Register.h:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markGlobals):
+        (JSC::RegisterFile::markCallFrames):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::markAggregate):
+        (JSC::EvalNode::markAggregate):
+        (JSC::FunctionBodyNode::markAggregate):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::markAggregate):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/ArgList.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        * runtime/Arguments.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markCurrentThreadConservativelyInternal):
+        (JSC::Heap::markCurrentThreadConservatively):
+        (JSC::Heap::markOtherThreadConservatively):
+        (JSC::Heap::markStackObjectsConservatively):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::markChildren):
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::markCellDirect):
+        (JSC::JSCell::markChildren):
+        (JSC::JSValue::markDirect):
+        (JSC::JSValue::markChildren):
+        (JSC::JSValue::hasChildren):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::drain):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::markChildren):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::markChildren):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::markAggregate):
+        (JSC::JSONObject::markStringifiers):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::markChildren):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSType.h:
+        (JSC::):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        * runtime/MarkStack.cpp: Added.
+        (JSC::MarkStack::compact):
+        * runtime/MarkStack.h: Added.
+        (JSC::):
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendValues):
+        (JSC::MarkStack::~MarkStack):
+        (JSC::MarkStack::MarkSet::MarkSet):
+        (JSC::MarkStack::pageSize):
+        
+        MarkStackArray is a non-shrinking, mmap-based vector type
+        used for storing objects to be marked.
+        (JSC::MarkStack::MarkStackArray::MarkStackArray):
+        (JSC::MarkStack::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStack::MarkStackArray::expand):
+        (JSC::MarkStack::MarkStackArray::append):
+        (JSC::MarkStack::MarkStackArray::removeLast):
+        (JSC::MarkStack::MarkStackArray::isEmpty):
+        (JSC::MarkStack::MarkStackArray::size):
+        (JSC::MarkStack::MarkStackArray::shrinkAllocation):
+        * runtime/MarkStackPosix.cpp: Added.
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+        * runtime/MarkStackWin.cpp: Added.
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+
+        * runtime/ScopeChain.h:
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::mark):
+        * runtime/Structure.h:
+        (JSC::Structure::markAggregate):
+
+2009-08-10  Mark Rowe  <mrowe@apple.com>
+        
+        Reviewed by Darin Adler.
+
+        Fix hundreds of "pointer being freed was not allocated" errors seen on the build bot.
+
+        * wtf/FastMalloc.h: Implement nothrow variants of the delete and delete[] operators since
+        we implement the nothrow variants of new and new[].  The nothrow variant of delete is called
+        explicitly in the implementation of std::sort which was resulting in FastMalloc-allocated
+        memory being passed to the system allocator to free.
+
+2009-08-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        [Gtk] Unreviewed build fix. Move JSAPIValueWrapper.cpp/.h in the debug
+        section. This file is already part of AllInOneFile in Release builds.
+
+        * GNUmakefile.am:
+
+2009-08-10  Darin Adler  <darin@apple.com>
+
+        * wtf/FastMalloc.h: Fix build.
+
+2009-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        FastMalloc.h has cross-platform code but marked as WinCE-only
+        https://bugs.webkit.org/show_bug.cgi?id=28160
+
+        1) The support for nothrow was inside #if PLATFORM(WINCE) even though it is
+           not platform-specific.
+        2) The code tried to override operator delete nothrow, which does not exist.
+        3) The code in the header checks the value of USE_SYSTEM_MALLOC, but the code
+           in FastMalloc.cpp checks only if the macro is defined.
+
+        * wtf/FastMalloc.h: See above.
+        * wtf/FastMalloc.cpp: Ditto.
+
+2009-08-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix an annoying indentation issue.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+
+2009-08-10  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add new files to makefile.
+
+        * GNUmakefile.am:
+
+2009-08-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix compilation with the interpreter instead of the JIT by including
+        PrototypeFunction.h as forward-declared through NativeFunctionWrapper.h.
+
+        * runtime/ObjectConstructor.cpp:
+
+2009-08-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by George Staikos.
+
+        JSON.stringify replacer returning undefined does not omit object properties
+        https://bugs.webkit.org/show_bug.cgi?id=28118
+
+        Correct behaviour of stringify when using a replacer function that returns
+        undefined.  This is a simple change to move the undefined value check to
+        after the replacer function is called.  This means that the replacer function
+        is now called for properties with the value undefined, however i've confirmed
+        that this behaviour is correct.
+        
+        In addition I've made the cyclic object exception have a more useful error
+        message.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-08-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Seidel and Sam Weinig.
+
+        [ES5] Implement Object.getPrototypeOf
+        https://bugs.webkit.org/show_bug.cgi?id=28114
+
+        Implement getPrototypeOf
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConsGetPrototypeOf):
+        * runtime/ObjectConstructor.h:
+
+2009-08-07  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for Noncopyable class
+        https://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Several classes which are inherited from Noncopyable are instantiated by
+        operator new, so Noncopyable class has been inherited from FastAllocBase.
+
+        * wtf/Noncopyable.h:
+
+2009-08-07  George Staikos <george.staikos@torchmobile.com> 
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27305
+        Implement WinCE-specific unicode layer.
+        Written by George Staikos <george.staikos@torchmobile.com>
+        with bug fixes by Yong Li <yong.li@torchmobile.com>
+        refactored by Joe Mason <joe.mason@torchmobile.com> 
+
+        * wtf/Platform.h:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/wince/UnicodeWince.cpp: Added.
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        * wtf/unicode/wince/UnicodeWince.h: Added.
+        (WTF::Unicode::):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isHighSurrogate):
+        (WTF::Unicode::isLowSurrogate):
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext):
+        (WTF::Unicode::umemcasecmp):
+        (WTF::Unicode::surrogateToUcs4):
+
+2009-08-07  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28069
+
+        Add inline to help winscw compiler resolve specialized argument in 
+        templated functions.  
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString):
+
+2009-08-07  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for RegExpObjectData struct
+        http://bugs.webkit.org/show_bug.cgi?id=26750
+
+        Inherits RegExpObjectData struct from FastAllocBase because
+        it has been instantiated by 'new' in JavaScriptCore/runtime/RegExpObject.cpp:62
+
+        * runtime/RegExpObject.h:
+
+2009-08-06  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Updated patch for bug #27059:
+        Symbian platform always uses little endian encoding,
+        regardless of compiler.
+        We need to make sure that we correctly detect EABI architecture
+        for armv5 targets on Symbian,
+        where __EABI__ is set but not __ARM_EABI__
+
+        * wtf/Platform.h:
+
+2009-08-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed revert.
+
+        http://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Revert 46877 because it broke GTK.
+
+        * wtf/Noncopyable.h:
+
+2009-08-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make get_by_id/put_by_id/method_check/call defer optimization using a data flag rather than a code modification.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27635 )
+
+        This improves performance of ENABLE(ASSEMBLER_WX_EXCLUSIVE) builds by 2-2.5%, reducing the overhead to about 2.5%.
+        (No performance impact with ASSEMBLER_WX_EXCLUSIVE disabled).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printStructureStubInfo):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+            - Change a pointer in CallLinkInfo/MethodCallLinkInfo to use a PtrAndFlags, use a flag to track when an op has been executed once.
+
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::seenOnce):
+        (JSC::StructureStubInfo::setSeen):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID, add a flag to track when an op has been executed once.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::unlinkCall):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        (JSC::JITStubs::getPolymorphicAccessStructureListSlot):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITStubs::):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::operator!):
+        (WTF::PtrAndFlags::operator->):
+            - Add ! and -> operators, add constuctor with pointer argument.
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Adam Barth.
+
+        Allow custom memory allocation control for Noncopyable class
+        https://bugs.webkit.org/show_bug.cgi?id=27879
+
+        Several classes which inherited from Noncopyable are instantiated by
+        operator new, so Noncopyable class has been inherited from FastAllocBase.
+
+        * wtf/Noncopyable.h:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add explicit dependencies for our build verification scripts to ensure that they always run after linking has completed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Mark Rowe  <mrowe@apple.com>
+
+        Bring a little order to our otherwise out of control lives.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-08-06  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's PolymorphicAccessStructureList struct
+        https://bugs.webkit.org/show_bug.cgi?id=27877
+
+        Inherits PolymorphicAccessStructureList struct from FastAllocBase because it has been instantiated by
+        'new' in JavaScriptCore/jit/JITStubs.cpp:1229.
+
+        * bytecode/Instruction.h:
+
+2009-08-05  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's ScopeNodeData struct
+        https://bugs.webkit.org/show_bug.cgi?id=27875
+
+        Inherits ScopeNodeData struct from FastAllocBase because it has been instantiated by
+        'new' in JavaScriptCore/parser/Nodes.cpp:1848.
+
+        * parser/Nodes.h:
+
+2009-08-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add floating point support for generic ARM port.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::doubleTransfer):
+        * assembler/ARMAssembler.h:
+        (JSC::ARM::):
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::faddd_r):
+        (JSC::ARMAssembler::fsubd_r):
+        (JSC::ARMAssembler::fmuld_r):
+        (JSC::ARMAssembler::fcmpd_r):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::fdtr_d):
+        (JSC::ARMAssembler::fmsr_r):
+        (JSC::ARMAssembler::fsitod_r):
+        (JSC::ARMAssembler::fmstat):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeDouble):
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::branchDouble):
+        * jit/JIT.h:
+
+2009-08-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add JIT support for generic ARM port without optimizations.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        All JIT optimizations are disabled.
+
+        Signed off by Zoltan Herczeg <zherczeg@inf.u-szeged.hu>
+        Signed off by Gabor Loki <loki@inf.u-szeged.hu>
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::load32):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+        * wtf/Platform.h:
+
+2009-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oiver Hunt.
+
+        Revert r46643 since this breaks the Yarr::Interpreter running the v8 tests.
+        https://bugs.webkit.org/show_bug.cgi?id=27874
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+
+2009-08-04  Oliver Hunt  <oliver@apple.com>
+
+        PPC64 Build fix
+
+        * wtf/Platform.h:
+
+2009-08-04  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Adam Treat
+
+        Explicitly include limits.h header when using INT_MAX and INT_MIN
+
+        * interpreter/Interpreter.cpp
+
+2009-08-03  Harald Fernengel  <harald.fernengel@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix compile error for ambigous call to abs()
+        https://bugs.webkit.org/show_bug.cgi?id=27873
+
+        Fix ambiguity in abs(long int) call by calling labs() instead
+
+        * wtf/DateMath.cpp: replace call to abs() with labs()
+
+2009-08-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Consolidate common gcc flags to WebKit.pri
+        https://bugs.webkit.org/show_bug.cgi?id=27934
+
+        * JavaScriptCore.pro:
+
+2009-08-03  Ada Chan  <adachan@apple.com>
+
+        Fixed the Tiger build.
+
+        * wtf/FastMalloc.cpp:
+
+2009-08-03  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Don't use background thread to scavenge memory on Tiger until we figure out why it causes a crash.
+        https://bugs.webkit.org/show_bug.cgi?id=27900
+
+        * wtf/FastMalloc.cpp:
+
+2009-08-03  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Jan Alonzo.
+
+        Fix build break on Gtk/x86_64.
+        https://bugs.webkit.org/show_bug.cgi?id=27936
+
+        Use JSVALUE64 for X86_64 LINUX, except Qt.
+
+        * wtf/Platform.h:
+
+2009-08-02  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the GTK+ build.
+
+        * wtf/Platform.h:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Disabled JSVALUE32_64 on Qt builds, since all layout tests mysteriously
+        crash with it enabled.
+
+        * wtf/Platform.h:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix.
+
+        Added JSAPIValueWrapper.cpp to the build.
+
+        * JavaScriptCore.pri:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        Exported symbols for JSAPIValueWrapper.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        GTK build fix.
+
+        * jit/JITStubs.cpp: #include <stdarg.h>, for a definition of va_start.
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix.
+        
+        * runtime/Collector.cpp: #include <limits.h>, for a definition of ULONG_MAX.
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Nixed JSImmediate::prototype, JSImmediate::toObject,
+        and JSImmediate::toThisObject, and removed their exported symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * runtime/JSImmediate.cpp:
+        * runtime/JSImmediate.h:
+
+2009-08-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Enabled JSVALUE32_64 by default on all platforms other than x86_64 (which uses JSVALUE64).
+
+        * wtf/Platform.h:
+
+2009-08-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Jan Alonzo.
+
+        Script for building the JavaScriptCore library for wx.
+        https://bugs.webkit.org/show_bug.cgi?id=27619
+
+        * wscript: Added.
+
+2009-08-02  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        DateMath depends on strftime and localtime, which need to be imported manually on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=26558
+
+        * wtf/DateMath.cpp:
+
+2009-08-01  David Kilzer  <ddkilzer@apple.com>
+
+        wtf/Threading.h: added include of Platform.h
+
+        Reviewed by Mark Rowe.
+
+        * wtf/Threading.h: Added #include "Platform.h" since this header
+        uses PLATFORM() and other macros.
+
+2009-08-01  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Roll out r46668 as it was misinformed.  ScopeChain is only used with placement new.
+
+        * runtime/ScopeChain.h:
+
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Allow custom memory allocation control for JavaScriptCore's HashMap class
+        http://bugs.webkit.org/show_bug.cgi?id=27871
+
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/API/JSClassRef.cpp:148.
+
+        * wtf/RefPtrHashMap.h:
+        (WTF::):
+
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Allow custom memory allocation control for JavaScriptCore's ScopeChain class
+        https://bugs.webkit.org/show_bug.cgi?id=27834
+
+        Inherits ScopeChain class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSFunction.h:109.
+
+        * runtime/ScopeChain.h:
+
+2009-08-01  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's RegExpConstructorPrivate struct 
+        https://bugs.webkit.org/show_bug.cgi?id=27833
+
+        Inherits RegExpConstructorPrivate class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/RegExpConstructor.cpp:152.
+
+        * runtime/RegExpConstructor.cpp:
+
+2009-07-31  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Resurrect the old GetTickCount implementation of currentTime, controlled by WTF_USE_QUERY_PERFORMANCE_COUNTER
+        currentSystemTime taken from older WebKit; currentTime written by Yong Li <yong.li@torchmobile.com>; cleanup by Joe Mason <joe.mason@torchmobile.com>
+        https://bugs.webkit.org/show_bug.cgi?id=27848
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentSystemTime): get current time with GetCurrentFT
+        (WTF::currentTime): track msec elapsed since first currentSystemTime call using GetTickCount
+        * wtf/Platform.h:
+
+2009-07-31  Ada Chan  <adachan@apple.com>
+
+        Fixes the Windows release-PGO build.
+
+        Reviewed by Jon Honeycutt.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Suppresses the warning about unreachable code that we get by adding "return 0" to WTF::TCMalloc_PageHeap::runScavengerThread().
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::runScavengerThread): Fixes the error about the method not returning a value in the release-PGO build.
+
+2009-07-31  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Change malloc to fastMalloc and free to fastFree in Yarr's RegexInterpreter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27874
+
+        Use fastMalloc and fastFree instead of malloc and free in RegexInterpreter.cpp's methods.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+
+2009-07-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Fix compiler warning.
+
+        GCC does not like C++-style comments in preprocessor directives.
+
+        * wtf/Platform.h:
+
+2009-07-30  John McCall  <rjmccall@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Optimize the X86_64 trampolines: avoid the need for filler arguments
+        and move the stub-args area closer to the stack pointer.
+
+        * jit/JIT.h: adjust patch offsets because of slight code-size change 
+        * jit/JITCode.h:
+        (JSC::JITCode::execute): don't pass filler args
+        * jit/JITStubs.cpp:
+        (ctiTrampoline): (X86_64): push args onto stack, use args directly
+        (ctiVMThrowTrampoline): (X86_64): adjust %rsp by correct displacement
+        (ctiOpThrowNotCaught): (X86_64): adjust %rsp by correct displacement
+        * jit/JITStubs.h:
+        (JITStackFrame): (X86_64): move args area earlier
+        (ctiTrampoline): remove filler args from prototype
+
+2009-07-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Temporarily revert r46618 since this is b0rking on Linux.
+
+2009-07-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make get_by_id/put_by_id/method_check/call defer optimization using a data flag rather than a code modification.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27635 )
+
+        This improves performance of ENABLE(ASSEMBLER_WX_EXCLUSIVE) builds by 2-2.5%, reducing the overhead to about 2.5%.
+        (No performance impact with ASSEMBLER_WX_EXCLUSIVE disabled).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printStructureStubInfo):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+            - Change a pointer in CallLinkInfo/MethodCallLinkInfo to use a PtrAndFlags, use a flag to track when an op has been executed once.
+
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::seenOnce):
+        (JSC::StructureStubInfo::setSeen):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID, add a flag to track when an op has been executed once.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+            - Make StructureStubInfo store the type as an integer, rather than an OpcodeID.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::unlinkCall):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+            - Remove the "don't lazy link" stage of calls.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        (JSC::JITStubs::getPolymorphicAccessStructureListSlot):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITStubs::):
+            - Remove the "don't lazy link" stage of calls, and the "_second" stage of get_by_id/put_by_id/method_check.
+
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::operator!):
+        (WTF::PtrAndFlags::operator->):
+            - Add ! and -> operators, add constuctor with pointer argument.
+
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed failing tests seen on Windows buildbot.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Use "int" instead of "bool" to guarantee a 32-bit result,
+        regardless of compiler. gcc on mac uses 32-bit values for bool,
+        but gcc on linux and MSVC on Windows use 8-bit values.
+
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added missing symbols on Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: removed stale symbols on Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+=== End merge of nitro-extreme branch 2009-07-30 ===
+
+2009-07-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a post-review typo in r46066 that caused tons of test failures.
+        
+        SunSpider reports no change.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Initialize the full vector capacity, to avoid
+        uninitialized members at the end.
+
+2009-07-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows WebKit build fix: Added some missing exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get the branch working on windows.
+        https://bugs.webkit.org/show_bug.cgi?id=27391
+        
+        SunSpider says 0.3% faster.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Updated
+        MSVC export lists to fix linker errors.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added / removed
+        new / old project files.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Used #pragma pack to tell
+        MSVC that these structures represent actual memory layout, and should not be
+        automatically aligned. Changed the return value load to load a 64bit quantity
+        into the canonical registers.
+
+        * jit/JIT.h: Moved OBJECT_OFFSETOF definition to StdLibExtras.h because
+        it's needed by more than just the JIT, and it supplements a standard library
+        macro (offsetof).
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame): Fixed an incorrectly signed
+        cast to resolve an MSVC warning.
+
+        * jit/JITStubs.h: Used #pragma pack to tell MSVC that these structures
+        represent actual memory layout, and should not be automatically aligned. 
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Replaced memset_pattern8 with a for loop, since
+        memset_pattern8 is not portable. (I verified that this version of the loop
+        gives the best performance / generated code in GCC.)
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject): Removed accidental usage of FIELD_OFFSET --
+        OBJECT_OFFSETOF is our new macro name. (FIELD_OFFSET conflicts with a
+        definition in winnt.h.)
+
+        * runtime/JSValue.cpp: Added some headers needed by non-all-in-one builds.
+        
+        * runtime/JSValue.h:
+        (JSC::JSValue::): Made the tag signed, to match MSVC's signed enum values.
+        (GCC doesn't seem to care one way or the other.)
+
+        * wtf/MainThread.cpp: Moved the StdLibExtras.h #include -- I did this a
+        while ago to resolve a conflict with winnt.h. I can't remember if it's truly
+        still needed, but what the heck.
+
+        * wtf/StdLibExtras.h: Moved OBJECT_OFFSETOF definition here.
+
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig (?).
+        
+        Fixed an assertion seen during the stress test.
+        
+        Don't assume that, if op1 is constant, op2 is not, and vice versa. Sadly,
+        not all constants get folded.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Include op_convert_this in result caching.
+        
+        No change on SunSpider or v8.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this):
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Made the op_convert_this JIT stub return an EncodedJSValue, so
+        to maintain the result caching contract that { tag, payload } can be
+        found in { regT1, regT0 }.
+
+2009-07-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented result chaining.
+        
+        1% faster on SunSpider. 4%-5% faster on v8.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rr): Added an optimization to eliminate
+        no-op mov instructions, to simplify chaining.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h: Added data members and helper functions for recording
+        chained results. We record both a mapping from virtual to machine register
+        and the opcode for which the mapping is valid, to help ensure that the
+        mapping isn't used after the mapped register has been stomped by other
+        instructions.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase): Chain function call results.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoad2):
+        (JSC::JIT::isLabeled):
+        (JSC::JIT::map):
+        (JSC::JIT::unmap):
+        (JSC::JIT::isMapped):
+        (JSC::JIT::getMappedPayload):
+        (JSC::JIT::getMappedTag): Use helper functions when loading virtual
+        registers into machine registers, in case the loads can be eliminated
+        by chaining.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_catch): Chain results from these opcodes.
+
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call): Load the profiler into regT2 to
+        avoid stomping a chained result.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id): Chain results from these opcodes.
+
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Always use { regT1, regT0 }, to facilitate
+        chaining.
+
+        (JSC::JITStubCall::call): Unmap all mapped registers, since our callee
+        stub might stomp them.
+
+2009-07-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Don't reload values in emitBinaryDoubleOp.
+
+        SunSpider reports a 0.6% progression. 
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-07-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Convert op_div to load op1 and op2 up front.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+
+2009-07-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Don't emit code in emitBinaryDoubleOp if code is unreachable, observable
+        via an empty (unlinked) jumplist passed in.  This only effects op_jnless
+        and op_jnlesseq at present.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-07-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Converted op_mod to put { tag, payload } in { regT1, regT0 }, and
+        tidied up its constant case.
+        
+        SunSpider reports a 0.2% regression, but a micro-benchmark of op_mod
+        shows a 12% speedup, and the SunSpider test that uses op_mod most should
+        benefit a lot from result caching in the end, since it almost always
+        performs (expression) % constant.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+
+2009-06-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Converted some more arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Converted some more arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }, and added a case for subtract constant.
+        
+        SunSpider says no change. v8 says 0.3% slower.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitSlow_op_sub):
+
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove more uses of addressFor(), load double constants directly from
+        the constantpool in the CodeBlock, rather than from the register file.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a bug in postfix ops, where we would treat x = x++ and x = x--
+        as a no-op, even if x were not an int, and the ++/-- could have side-effects.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Converted some arithmetic ops to put { tag, payload } in
+        { regT1, regT0 }.
+        
+        SunSpider says 0.7% faster. v8 says no change.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::isOperandConstantImmediateInt):
+        (JSC::JIT::getOperandConstantImmediateInt):
+
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start removing cases of addressFor().
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitStoreDouble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in my last patch with regression fixed.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out my last patch because it was a 2% SunSpider regression.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "Sam Weinig" Barraclough.
+        
+        Standardized the rest of our opcodes to put { tag, payload } in
+        { regT1, regT0 } where possible.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+
+2009-06-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace calls to store32(tagFor()) and store32(payloadFor())
+        with emitStoreInt32(), emitStoreBool(), and emitStoreCell().
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_load_varargs):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitStoreInt32):
+        (JSC::JIT::emitStoreCell):
+        (JSC::JIT::emitStoreBool):
+        (JSC::JIT::emitStore):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+2009-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized the rest of the property access instructions to put { tag,
+        payload } in { regT1, regT0 }.
+
+        Small v8 speedup, 0.2% SunSpider slowdown.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoad2):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Various cleanups.
+        - Use fpRegT* instead of X86::xmm*.
+        - Use a switch statement in emitBinaryDoubleOp instead of a bunch of
+          if/elses.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add inline code dealing with doubles for op_jfalse and op_jtrue.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::zeroDouble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-06-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Standardized op_get_by_id to put { tag, payload } in { regT1, regT0 }.
+        
+        SunSpider and v8 report maybe 0.2%-0.4% regressions, but the optimization
+        this enables will win much more than that back.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-06-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Standardized op_call to put { tag, payload } in { regT1, regT0 }.
+        
+        SunSpider and v8 report no change.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+
+2009-06-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Handle multiplying by zero a little better by
+        inlining the case that both operands are non-negative
+        into the slowpath.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchOr32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Optimize x++ to ++x inside for loops.
+        
+        Sadly, no measurable speedup, but this should help with result chaining.
+
+        * parser/Nodes.cpp:
+        (JSC::ForNode::emitBytecode):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emitSlow_op_construct_verify):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Standardized some more opcodes to put { tag, payload } in { regT1, regT0 }.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+
+2009-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig (sort of, maybe).
+        
+        Fixed some ASSERTs in http/tests/security.
+        
+        These ASSERTs were introduced by http://trac.webkit.org/changeset/45057,
+        but the underlying problem was actually older. http://trac.webkit.org/changeset/45057
+        just exposed the problem by enabling optimization in more cases.
+        
+        The ASSERTs fired because we tested PropertySlot::slotBase() for validity,
+        but slotBase() ASSERTs if it's invalid, so we would ASSERT before
+        the test could happen. Solution: Remove the ASSERT. Maybe it was valid
+        once, but it clearly goes against a pattern we've deployed of late.
+        
+        The underlying problem was that WebCore would re-use a PropertySlot in
+        the case of a forwarding access, and the second use would not completely
+        overwrite the first use. Solution: Make sure to overwrite m_offset when
+        setting a value on a PropertySlot. (Other values already get implicitly
+        overwritten during reuse.)
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setRegisterSlot):
+        (JSC::PropertySlot::setUndefined):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::clearOffset):
+
+2009-06-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JIT_OPTIMIZE_METHOD_CALLS on the branch, implementation matches current implemenatation in ToT.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::compileGetByIdSlowCase):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bit off a tiny bit more of standardizing opcode behavior to help with result
+        caching.
+        
+        SunSpider reports no change, v8 maybe a tiny speedup.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emitSlow_op_to_jsnumber):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bit off a tiny bit more of standardizing opcode behavior to help with result
+        caching -- including removing my old enemy, op_resolve_function, because
+        it was non-standard, and removing it felt better than helping it limp along.
+        
+        SunSpider reports no change, v8 maybe a tiny speedup.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Bit off a tiny bit of standardizing opcode behavior to help with result
+        caching.
+        
+        0.6% SunSpider speedup. 0.3% v8 speedup.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoad): Accomodate a base register that overlaps with payload
+        by loading tag before payload, to avoid stomping base/payload.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov): Abide by the standard "tag in regT1, payload in
+        regT0" semantics.
+
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var): Ditto. Also, removed some irrelevent
+        loads while I was at it. The global object's "d" pointer never changes
+        after construction.
+
+2009-06-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove 'arguments' field from Register union (again).
+        This time do so without breaking tests (radical, I know).
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::optionalCalleeArguments):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::init):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::i):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        (JSC::Register::arguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed some result register tracking cruft in preparation for a new
+        result tracking mechanism.
+        
+        SunSpider reports no change.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpDst::JmpDst): No need to track jump targets in
+        machine code; we already do this in bytecode.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::emitTimeoutCheck): Make sure to save and restore the result
+        registers, so an opcode with a timeout check can still benefit from result
+        register caching.
+
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases): Removed calls to killLastResultRegister()
+        in preparation for something new.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_sret):
+        (JSC::JIT::emit_op_jmp_scopes): ditto
+
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::getArgument): added a mechanism for reloading an argument
+        you passed to a JIT stub, for use in emitTimeoutCheck.
+
+2009-06-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove now-useless inplace variants of binary ops.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emit_op_mul):
+
+2009-06-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Move off memory operands to aid in re-enabling result caching.
+
+        - No regression measured.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emitBitAnd32InPlace):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emitBitOr32InPlace):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emitBitXor32InPlace):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitAdd32InPlace):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emitSub32InPlaceLeft):
+        (JSC::JIT::emitSub32InPlaceRight):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitMul32InPlace):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emit_op_to_jsnumber):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+
+2009-06-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed some missing and/or misplaced labels in bytecode generation, so
+        we don't have to work around them in JIT code generation.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        * parser/Nodes.cpp:
+        (JSC::TryNode::emitBytecode):
+
+2009-06-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        For member function calls, emit "this" directly into the "this" slot
+        for the function call, instead of moving it there later. This reduces
+        time spent in op_mov during certain calls, like "a.b.c()".
+        
+        1%-2% speedup on v8, mostly richards and delta-blue.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+
+2009-06-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove 'arguments' field from Register union.  Having JSCell derived types in the union is
+        dangerous since it opens the possibility for the field to be written as a raw pointer but
+        then read as a JSValue.  This will lead to statle data being read for the tag, which may
+        be dangerous.  Having removed Arguments* types form Register, all arguments objects must
+        always explicitly be stored in the register file as JSValues.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::optionalCalleeArguments):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+
+2009-06-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add back known this value optimization by abstracting
+        slow case if not JSCell jumps.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::linkSlowCaseIfNotJSCell):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+
+2009-06-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed some of the regression in crypto-aes.js. (8.5% speedup in
+        crypto-aes.js.)
+        
+        SunSpider reports no change overall.
+        
+        Division was producing double results, which took the slow path through
+        array access code.
+        
+        Strangely, all my attempts at versions of this patch that modified array
+        access code to accept ints encoded as doubles along the fast or slow paths
+        were regressions. So I did this instead.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div): When dividing an int by an int, go ahead and try
+        to turn the result into an int. Don't just do int division, though, because
+        testing shows it to be slower than SSE double division, and the corner
+        cases are pretty complicated / lengthy on top of that. Also, don't try
+        to canonicalize division of known tiny numerators into ints, since that's a
+        waste of time.
+
+2009-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed a regression caused by my recent fix for NaN.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp): Actually do the comparison in reverse
+        order, like the ChangeLog said we would, bokay?
+
+2009-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig and Oliver Hunt.
+        
+        Fixed two edge cases in %:
+        
+        - Don't do -2147483648 % x as a fast case, since you might do -2147483648 % -1,
+        which will signal a hardware exception due to overflow.
+
+        - In the case of a zero remainder, be sure to store negative zero if the
+        dividend was zero.
+        
+        SunSpider reports no change.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+
+2009-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed a regression when comparing to NaN.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp): For op_jnless and op_jnless_eq, do the
+        comparison in reverse order, and jump if the result is below or 
+        below-or-equal. This ensures that we do jump in the case of NaN.
+
+2009-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        SunSpider says no change.
+        
+        Fixed regressions in fast/js/var-declarations-shadowing.html and
+        fast/js/equality.html, caused by recent == and != optimizations.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_eq): Don't treat "compare to string" as always
+        numeric or string comparison. If the second operand is an object, you
+        need to ToPrimitive it, and start all over again. Also, I wrote out each
+        of the possible cases explicitly, to cut down on redundant branching.
+
+2009-05-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix bug in fast/js/constant-folding.html where we were not negating
+        -0 properly.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+
+2009-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Refactored new slow case codegen for == and !=.
+        
+        SunSpider reports no change, maybe a tiny speedup.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq): Made a vptr comparison a *Ptr operation,
+        instead of *32, to make it portable to 64bit. Reorganized the string
+        and generic cases to make their control flow a little clearer.
+
+2009-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Optimized == and != for our new value representation -- especially for strings.
+        
+        14% speedup on date-format-tofte.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_eq_strings):
+        (JSC::JITStubs::cti_op_call_eval):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSValue.h:
+
+2009-05-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix non-SSE enabled builds.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add): Don't early return here, we still need to call the JIT stub.
+        (JSC::JIT::emitSlow_op_sub): Ditto.
+
+2009-05-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Here's a thought: let's not take a jit stub call just to multiply by 1,
+        bokay?
+        
+        imul doesn't set the zero flag, so to test for a zero result, we need
+        an explicit instruction. (Luckily, it does set the overflow flag, so
+        we can still use that.)
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32InPlace):
+
+2009-05-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Premature Commit" Garen.
+
+        Add back constant integer cases for op_add.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32Constant):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateDouble):
+        (JSC::JIT::isOperandConstantImmediateDouble):
+
+2009-05-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added fast double cases for op_jnless and op_jnlesseq.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::jumps): New accesor, used by
+        addSlowCase.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::ucomisd_rm): New method for comparing register to
+        memory.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_div): Modified emitBinaryDoubleOp to accept comparison/jump
+        operations in addition to operations with explicit result registers.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::addSlowCase): Added an "addSlowCase" for JumpLists, so clients
+        can track multiple jumps to the same slow case condition together.
+
+2009-05-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Implement op_negate inline fast cases.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::neg32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::negl_m):
+        (JSC::X86Assembler::xorpd_rr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Update the patchOffsetGetByIdSlowCaseCall constant for the
+        case that OPCODE_SAMPLING is enabled.
+
+        * jit/JIT.h:
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added support for inline subtraction of doubles.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlowSub32InPlaceLeft):
+        (JSC::JIT::emitBinaryDoubleOp):
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Added support for inline division.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::divsd_rr):
+        (JSC::X86Assembler::divsd_mr):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitBinaryOp):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added support for inline addition of doubles.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32InPlace):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Factored inline double operations into a helper function, so that we
+        can reuse this code for other math operations.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+
+2009-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added support for inline multiplication of doubles.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cvtsi2sd_mr): New function, useful for loading an
+        int32 into a double register.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul): Filled out these cases for double arithmetic.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::addressFor): New function, useful for addressing a JSValue's
+        full 64bits as a double.
+
+2009-05-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement and enable optimized calls.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Add ENABLE(JIT_OPTIMIZE_CALL) guards
+        around the the optimize call only trampolines (virtualCallPreLink and virtualCallLink).
+        Update the trampolines to account for the new JSValue representation.
+        (JSC::JIT::unlinkCall): Use NULL instead of JSValue noValue. 
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall): Update to account for the new JSValue representation
+        (JSC::JIT::compileOpCallSlowCase): Ditto.
+
+        * jit/JITStubs.h: Remove incorrect !ENABLE(JIT_OPTIMIZE_CALL) guard.
+
+        * wtf/Platform.h: Enable ENABLE_JIT_OPTIMIZE_CALL.
+
+2009-05-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement and enable optimized property access.
+
+        * assembler/AbstractMacroAssembler.h: Fix comment.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines): Remove array length trampoline
+        and implement the string length trampoline.
+        * jit/JIT.h: Add new constants for patch offsets.
+        * jit/JITInlineMethods.h: Remove FIELD_OFFSET which is now in StdLibExtras.h.
+        * jit/JITPropertyAccess.cpp: 
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Add version of addArgument that takes
+        two registers for the tag and payload.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs): Remove array length trampoline pointer.
+        (JSC::JITStubs::cti_op_get_by_id_self_fail): 
+        * jit/JITStubs.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject): Move m_inheritorID below the property storage
+        to align it to a 16 byte boundary.
+        * wtf/Platform.h: Enable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
+        * wtf/StdLibExtras.h: Move FIELD_OFFSET here.
+
+2009-05-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unneeded ExecState parameter from the number JSValue constructors.
+
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::JSValue):
+
+2009-05-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implemented fast path for op_put_by_val when putting to arrays.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+
+2009-05-15  Geoffrey Garen  <ggaren@apple.com> (Mostly by Sam)
+
+        Reviewed by Sam Weinig.
+        
+        Implemented fast path for op_get_by_val when accessing array.
+
+        * jit/JIT.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a failure in fast/js/math-transforms.html caused by failing to
+        preserve -0 in multiplication.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jz):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32Constant):
+        (JSC::JIT::emitMul32InPlace): Check both for overflow and for zero when
+        doing multiplication. Use a slow case to get these right.
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a bug in the varargs calling convention.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs): Move the argument count into regT1,
+        since that's where ctiVirtualCall expects it to be.
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a small bug in instanceof's looping code.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof): NULL means the object has no prototype,
+        so only loop when *not* equal to NULL.
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a small bug in instanceof's result writing code.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof): Make sure to fill out the payload bits
+        in all cases.
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Removed an invalid assertion in cti_op_urshift which
+        depended on a fast path for op_urshift which has
+        never existed.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_urshift):
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed loop_if_true, which had the same reversed test that jtrue had.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_true):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        In op_neq, we apparently want to check that one value
+        does *not* equal another.  Go figure.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_neq):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        The slow case of op_mod should call op_mod's jit stub,
+        not op_mul.  That would be dumb.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed problems when using 'arguments' due to a half-initialized register.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setCalleeArguments):
+        (JSC::ExecState::init): Require a full JSValue when setting up the 
+        'arguments' virtual register, since this register is accessible from JIT
+        code and bytecode, and needs to be a true JSValue.
+
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::resetCallFrame): ditto
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): ditto
+
+        * interpreter/Register.h: Removed the constructor that allowed assignment
+        of a JSArguments* to a register. That is not safe. See above.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params): ditto
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        We really want to go to the slow case in op_jfalse and
+        op_jtrue if the value is *not* boolean. 
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Flipped the condition when emitting a an op_loop_if_less or op_loop_if_lesseq
+        if the first operand is a constant.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Added missing return in op_jnless and op_jnlesseq. 
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+
+2009-05-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Load constants into the the register file as a temporary measure to
+        aid bring up.  This allows us to use to treat constants like any
+        other virtual register.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
+
+2009-05-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented op_strict_eq. Original patch by Snowy, by way of Sam and Gavin.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8): Added set8, since it's slightly
+        faster than set32, and the new value representation usually doesn't
+        need set32.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload): Added helper functions for dealing with
+        constants. Eventually, we should write special cases for all constants,
+        but these are helpful in the short term.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq): teh opcodez.
+
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValue::isDouble): Added a LowestTag for clarity.
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed some bugs in host function calls.
+        
+        testapi now passes!
+
+        * jit/JIT.cpp: Changed some registers around to avoid overwriting edx:eax,
+        which is how JSValues are now returned. Also changed the code that
+        passes thisValue to pass the full 64bits of the value. Also added
+        an #error compiler directive to other platform builds, since the JSValue
+        return signature probably won't return in edx:eax on those platforms,
+        and we'll have to investigate a solution.
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed parameters from functions that are intended never to use their
+        parameters.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Ported op_instance_of from TOT. It's basically the same, but some register
+        stuff changed to memory stuff.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitStore): Changed to use helper functions.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof): Ported from TOT.
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Added a comment to explain an exception-handling subtelty that we found
+        hard to remember when reviewing my last patch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented try/catch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw): Updated to use JITStackFrame abstraction.
+        (JSC::JIT::emit_op_catch): Filled out.
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implemented op_loop_if_true, op_jfalse, op_jtrue, op_jeq_null and op_jneq_null
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_instanceof): Moved from below to be next to its
+        fast brother.
+
+        (JSC::JIT::emit_op_loop_if_true): Similar to the old version
+        in that it tries to do the integer case first and reduce the
+        number of jumps you might need to take.
+        (JSC::JIT::emitSlow_op_loop_if_true):
+
+        (JSC::JIT::emit_op_jfalse): Very similar to op_loop_if_true, only
+        the inverse and without a timeout check.
+        (JSC::JIT::emitSlow_op_jfalse):
+
+        (JSC::JIT::emit_op_jtrue): Very similar to op_loop_if_true except
+        without the timeout check.
+        (JSC::JIT::emitSlow_op_jtrue):
+
+        (JSC::JIT::emit_op_jeq_null): Very similar to the implementation
+        of op_eq, except it takes jumps instead of copying the condition
+        to a dst.
+        (JSC::JIT::emit_op_jneq_null): Ditto but for op_neq.
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented op_call_varargs.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_construct):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented op_call_eval.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITStubCall.h:
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Implemented op_not. (Gavin did most of the work!)
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emitSlow_op_not):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented op_global_resolve.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq): Added back accidentally removed
+        early returns. 
+
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_global): Pretty similar to the old code,
+        but we need two reads and a TimesEight step in order to account for the
+        64bit value size.
+
+        * jit/JITStubs.h:
+        (JSC::): Slightly tweaked this code to specialize for a JSGlobalObject*,
+        to avoid having to pass an irrelevant tag pointer to the stub.
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implemented op_to_jsnumber.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emitSlow_op_to_jsnumber):
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implemented op_convert_this.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+
+2009-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Got basic JS function and constructor calls working.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_construct):
+        (JSC::JIT::compileOpCall): Filled out these cases, with call_eval #if'd out.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitLoad): Restored some legacy "*CTIArg*" functions,
+        since I wanted to avoid the complexity of revamping the API here while
+        trying to bring it up. Eventually, we should re-remove all of these functions.
+
+        (JSC::JIT::recordJumpTarget): Removed unnecessary macro cruft. You will
+        not silence me, Sam Weinig! The world will know that you are a crufty,
+        crufty, crufty programmer!!!
+
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h: Changed up some offsets in the JITStackFrame class, since
+        and off-by-one error was causing stack misalignment.
+
+2009-05-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_eq_null and op_neq_null.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8):
+        (JSC::MacroAssemblerX86Common::setTest8):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_stricteq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emit_op_nstricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jsc.cpp:
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_new_error.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_error):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument): Add a version of addArgument
+        that takes a constant JSValue.
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove now unused emitGetVariableObjectRegister and emitPutVariableObjectRegister.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_to_primitive and op_next_pname.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emitSlow_op_loop_if_true):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_next_pname):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add op_get_global_var, op_put_global_var, emit_op_get_scoped_var, emit_op_put_scoped_var and
+        op_unexpected_load.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::tagFor):
+        (JSC::JIT::payloadFor):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitStore):
+        (JSC::JIT::emitLoadReturnValue):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_unexpected_load):
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added overflow handling to op_sub.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlowSub32InPlaceLeft):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove a function call by folding op_get_by_id and op_put_by_id into
+        their respective compile functions.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Make JITStubCall work in 64bit by making the stack index
+        step dependent on the size of void*.
+
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement simple version of property access opcodes
+        which just call a stub functions.
+
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument):
+        * jsc.cpp:
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added work-around for XCode debugging echo problem.
+
+        * jsc.cpp:
+        (runInteractive):
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added overflow handling to op_add.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlowAdd32InPlace):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add slow cases for op_jnless or emit_op_jnlesseq.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add implementations for op_jnless, emit_op_jnlesseq, op_loop_if_less and op_loop_if_lesseq.
+        No slow cases for op_jnless or emit_op_jnlesseq yet.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Turn the RECORD_JUMP_TARGET macro into an inline function.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::recordJumpTarget):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_jmp_scopes):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Add MacroAssemblerX86Common::set8 to fix the build.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8):
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added overflow recovery for pre_inc and pre_dec.
+        
+        Turned some short-circuit code into early returns, as is the WebKit style.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_dec):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_jmp, op_loop, op_eq and op_neq.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement the slow cases for arithmetic opcodes.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_mod):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Implement op_bitnot.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::not32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::notl_m):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_bitnot):
+
+2009-05-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add arithmetic opcode implementations from the old nitro-extreme branch.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitBitAnd32Constant):
+        (JSC::JIT::emitBitAnd32InPlace):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitBitOr32Constant):
+        (JSC::JIT::emitBitOr32InPlace):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitBitXor32Constant):
+        (JSC::JIT::emitBitXor32InPlace):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emitSlow_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitAdd32InPlace):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSub32ConstantLeft):
+        (JSC::JIT::emitSub32ConstantRight):
+        (JSC::JIT::emitSub32InPlaceLeft):
+        (JSC::JIT::emitSub32InPlaceRight):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitMul32Constant):
+        (JSC::JIT::emitMul32InPlace):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed JIT_OPTIMIZE_ARITHMETIC setting, since it was all about 32bit
+        value representations.
+        
+        Added JSAPIValueWrapper to the repository.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * runtime/JSAPIValueWrapper.cpp: Added.
+        (JSC::JSAPIValueWrapper::toPrimitive):
+        (JSC::JSAPIValueWrapper::getPrimitiveNumber):
+        (JSC::JSAPIValueWrapper::toBoolean):
+        (JSC::JSAPIValueWrapper::toNumber):
+        (JSC::JSAPIValueWrapper::toString):
+        (JSC::JSAPIValueWrapper::toObject):
+        * runtime/JSAPIValueWrapper.h: Added.
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::isAPIValueWrapper):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        (JSC::jsAPIValueWrapper):
+        * wtf/Platform.h:
+
+2009-05-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Turned on the JIT and got it building and running the most trivial of
+        programs.
+        
+        All configurable optimizations are turned off, and a few opcodes are ad
+        hoc #if'd out.
+        
+        So far, I've only merged op_mov and op_end, but some stub-reliant
+        opcodes work as-is from TOT.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emitSlow_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emitSlow_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emitSlow_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        (JSC::JIT::tagFor):
+        (JSC::JIT::payloadFor):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoadReturnValue):
+        (JSC::JIT::emitStore):
+        (JSC::JIT::emitStoreReturnValue):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_unexpected_load):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_push_scope):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_new_error):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        (JSC::JIT::emitSlow_op_construct_verify):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_switch_imm):
+        * jit/JITStubs.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * runtime/JSValue.h:
+        (JSC::JSValue::payload):
+        * wtf/Platform.h:
+
+2009-05-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add some new MacroAssembler and assembler functions that will be needed shortly.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::neg32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::sub32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::addl_rm):
+        (JSC::X86Assembler::andl_mr):
+        (JSC::X86Assembler::andl_rm):
+        (JSC::X86Assembler::andl_im):
+        (JSC::X86Assembler::negl_r):
+        (JSC::X86Assembler::notl_r):
+        (JSC::X86Assembler::orl_rm):
+        (JSC::X86Assembler::orl_im):
+        (JSC::X86Assembler::subl_rm):
+        (JSC::X86Assembler::xorl_mr):
+        (JSC::X86Assembler::xorl_rm):
+        (JSC::X86Assembler::xorl_im):
+        (JSC::X86Assembler::imull_mr):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Remove the NumberHeap.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::sweep):
+        (JSC::Heap::collect):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::statistics):
+        (JSC::typeName):
+        (JSC::Heap::isBusy):
+        * runtime/Collector.h:
+        (JSC::Heap::globalData):
+        * runtime/JSCell.h:
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Land initial commit of new number representation for 32 bit platforms,
+        with JIT disabled.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        * API/tests/testapi.c:
+        (EvilExceptionObject_convertToType):
+        * AllInOneFile.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitUnexpectedLoad):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::privateExecute):
+        * parser/Nodes.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::processClauseList):
+        * runtime/ArgList.h:
+        * runtime/Collector.h:
+        (JSC::sizeof):
+        * runtime/DateMath.cpp:
+        * runtime/ExceptionHelpers.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::isAPIValueWrapper):
+        (JSC::JSValue::isString):
+        (JSC::JSValue::isGetterSetter):
+        (JSC::JSValue::isObject):
+        (JSC::JSValue::getString):
+        (JSC::JSValue::getObject):
+        (JSC::JSValue::getCallData):
+        (JSC::JSValue::getConstructData):
+        (JSC::JSValue::getUInt32):
+        (JSC::JSValue::marked):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::toBoolean):
+        (JSC::JSValue::toNumber):
+        (JSC::JSValue::toString):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::JSValue::toThisString):
+        (JSC::JSValue::getJSNumber):
+        (JSC::JSValue::toObject):
+        (JSC::JSValue::toThisObject):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.cpp: Removed.
+        * runtime/JSNumberCell.h: Removed.
+        * runtime/JSObject.h:
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        * runtime/JSString.h:
+        (JSC::JSValue::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toInteger):
+        (JSC::JSValue::toIntegerPreserveNaN):
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::toThisObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        (JSC::JSValue::synthesizePrototype):
+        (JSC::JSValue::description):
+        (JSC::nonInlineNaN):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::EncodedJSValueHashTraits::emptyValue):
+        (JSC::jsNaN):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::toInt32):
+        (JSC::toUInt32):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::isDouble):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::tag):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::asUInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::JSValue::toJSNumber):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        * runtime/Operations.h:
+        (JSC::JSValue::equal):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        * runtime/PropertySlot.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        * wtf/Platform.h:
+
+=== Start merge of nitro-extreme branch 2009-07-30 ===
+
+2009-07-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        Resolve class/struct mixup in forward declarations
+        https://bugs.webkit.org/show_bug.cgi?id=27708
+
+        * API/JSClassRef.h:
+        * bytecode/SamplingTool.h:
+        * interpreter/Interpreter.h:
+        * jit/JIT.h:
+        * profiler/ProfileGenerator.h:
+        * profiler/Profiler.h:
+        * runtime/ClassInfo.h:
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+
+2009-07-28  Ada Chan  <adachan@apple.com>        
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27236
+        - Implement TCMalloc_SystemRelease and TCMalloc_SystemCommit for Windows.
+        - Use a background thread to periodically scavenge memory to release back to the system.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::init):
+        (WTF::TCMalloc_PageHeap::runScavengerThread):
+        (WTF::TCMalloc_PageHeap::scavenge):
+        (WTF::TCMalloc_PageHeap::shouldContinueScavenging):
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::GrowHeap):
+        (WTF::sleep):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+        (TCMalloc_SystemCommit):
+        * wtf/TCSystemAlloc.h:
+
+2009-07-28  Xan Lopez  <xlopez@igalia.com>
+
+        Add new files, fixes distcheck.
+
+        * GNUmakefile.am:
+
+2009-07-28  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Determining whether to use JIT or interpreter
+        moved from JavaScriptCore.pri to Platform.h
+
+        * JavaScriptCore.pri:
+        * wtf/Platform.h:
+
+2009-07-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Fix of misuse of sort command.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Build fix for Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Fix tyop in JIT, renamed preverveReturnAddressAfterCall -> preserveReturnAddressAfterCall.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preserveReturnAddressAfterCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Gtk build fix.
+
+        * runtime/JSLock.cpp: (JSC::JSLock::JSLock): Fix "no threading" case.
+
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Release build fix.
+
+        * runtime/JSLock.h: (JSC::JSLock::~JSLock):
+
+2009-07-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27735
+        Give a helpful name to JSLock constructor argument
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * JavaScriptCore.exp:
+        * jsc.cpp:
+        (functionGC):
+        (cleanupGlobalData):
+        (jscmain):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC::):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::~JSLock):
+
+2009-07-25  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for OpaqueJSPropertyNameArray struct
+        https://bugs.webkit.org/show_bug.cgi?id=27342
+
+        Inherits OpaqueJSPropertyNameArray struct from FastAllocBase because it has been
+        instantiated by 'new' JavaScriptCore/API/JSObjectRef.cpp:473.
+
+        * API/JSObjectRef.cpp:
+
+2009-07-24  Ada Chan  <adachan@apple.com>
+
+        In preparation for https://bugs.webkit.org/show_bug.cgi?id=27236:
+        Remove TCMALLOC_TRACK_DECOMMITED_SPANS.  We'll always track decommitted spans.
+        We have tested this and show it has little impact on performance.
+
+        Reviewed by Mark Rowe.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::New):
+        (WTF::TCMalloc_PageHeap::AllocLarge):
+        (WTF::propagateDecommittedState):
+        (WTF::mergeDecommittedStates):
+        (WTF::TCMalloc_PageHeap::Delete):
+        (WTF::TCMalloc_PageHeap::IncrementalScavenge):
+
+2009-07-24  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler and Adam Barth.
+
+        Build fix for x86 platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=27602
+
+        * jit/JIT.cpp:
+
+2009-07-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, adding missing header.
+
+        * jit/JIT.cpp:
+
+2009-07-22  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add wince specific memory files into wtf/wince
+        https://bugs.webkit.org/show_bug.cgi?id=27550
+
+        * wtf/wince/FastMallocWince.h: Added.
+        * wtf/wince/MemoryManager.cpp: Added.
+        * wtf/wince/MemoryManager.h: Added.
+
+2009-07-23  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix for missing mmap features in Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=24540
+
+        Fix, conditionally for PLATFORM(SYMBIAN), as an alternative 
+        to missing support for the MAP_ANON property flag in mmap. 
+        It utilizes Symbian specific memory allocation features.
+
+        * runtime/Collector.cpp
+
+2009-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        With ENABLE(ASSEMBLER_WX_EXCLUSIVE), only change permissions once per repatch event.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27564 )
+
+        Currently we change permissions forwards and backwards for each instruction modified,
+        instead we should only change permissions once per complete repatching event.
+
+        2.5% progression running with ENABLE(ASSEMBLER_WX_EXCLUSIVE) enabled,
+        which recoups 1/3 of the penalty of running with this mode enabled.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::linkBranch):
+            - Replace usage of MakeWritable with cacheFlush.
+        
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::patchPointerInternal):
+        (JSC::ARMAssembler::repatchLoadPtrToLEA):
+            - Replace usage of MakeWritable with cacheFlush.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::relinkJump):
+        (JSC::ARMv7Assembler::relinkCall):
+        (JSC::ARMv7Assembler::repatchInt32):
+        (JSC::ARMv7Assembler::repatchPointer):
+        (JSC::ARMv7Assembler::repatchLoadPtrToLEA):
+        (JSC::ARMv7Assembler::setInt32):
+            - Replace usage of MakeWritable with cacheFlush.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::performFinalization):
+            - Make explicit call to cacheFlush.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+            - Make size always available.
+
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::RepatchBuffer):
+        (JSC::RepatchBuffer::~RepatchBuffer):
+            - Add calls to MakeWritable & makeExecutable.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::relinkJump):
+        (JSC::X86Assembler::relinkCall):
+        (JSC::X86Assembler::repatchInt32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+            - Remove usage of MakeWritable.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getJITCode):
+            - Provide access to CodeBlock's JITCode.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeExecutable):
+        (JSC::ExecutableAllocator::cacheFlush):
+            - Remove MakeWritable, make cacheFlush public.
+
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+            - Add CodeBlock argument to RepatchBuffer.
+
+        * jit/JIT.h:
+            - Pass CodeBlock argument for use by RepatchBuffer.
+
+        * jit/JITCode.h:
+        (JSC::JITCode::start):
+        (JSC::JITCode::size):
+            - Provide access to code start & size.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+            - Add CodeBlock argument to RepatchBuffer.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            - Pass CodeBlock argument for use by RepatchBuffer.
+
+2009-07-21  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Cache not only the structure of the method, but the
+        structure of its prototype as well.
+        https://bugs.webkit.org/show_bug.cgi?id=27077
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+
+2009-07-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Move call linking / repatching down from AbstractMacroAssembler into MacroAssemblerARCH classes.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27527 )
+
+        This allows the implementation to be defined per architecture.  Specifically this addresses the
+        fact that x86-64 MacroAssembler implements far calls as a load to register, followed by a call
+        to register.  Patching the call actually requires the pointer load to be patched, rather than
+        the call to be patched.  This is implementation detail specific to MacroAssemblerX86_64, and as
+        such is best handled there.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::linkCall):
+        (JSC::MacroAssemblerARM::repatchCall):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::linkCall):
+        (JSC::MacroAssemblerARMv7::repatchCall):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::linkCall):
+        (JSC::MacroAssemblerX86::repatchCall):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::linkCall):
+        (JSC::MacroAssemblerX86_64::repatchCall):
+
+2009-07-21  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Every wtf file includes other wtf files with <> style includes
+        except this one.  Fix the exception.
+
+        * wtf/ByteArray.h:
+
+2009-07-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move LinkBuffer/RepatchBuffer out of AbstractMacroAssembler.
+        ( https://bugs.webkit.org/show_bug.cgi?id=27485 )
+
+        This change is the first step in a process to move code that should be in
+        the architecture-specific MacroAssembler classes up out of Assmbler and
+        AbstractMacroAssembler.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - added new files
+        
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::linkPointer):
+            - rename patchPointer to bring it in line with the current link/repatch naming scheme
+        
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::linkCall):
+        (JSC::ARMv7Assembler::linkPointer):
+        (JSC::ARMv7Assembler::relinkCall):
+        (JSC::ARMv7Assembler::repatchInt32):
+        (JSC::ARMv7Assembler::repatchPointer):
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::setPointer):
+            - rename patchPointer to bring it in line with the current link/repatch naming scheme
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::linkJump):
+        (JSC::AbstractMacroAssembler::linkCall):
+        (JSC::AbstractMacroAssembler::linkPointer):
+        (JSC::AbstractMacroAssembler::getLinkerAddress):
+        (JSC::AbstractMacroAssembler::getLinkerCallReturnOffset):
+        (JSC::AbstractMacroAssembler::repatchJump):
+        (JSC::AbstractMacroAssembler::repatchCall):
+        (JSC::AbstractMacroAssembler::repatchNearCall):
+        (JSC::AbstractMacroAssembler::repatchInt32):
+        (JSC::AbstractMacroAssembler::repatchPointer):
+        (JSC::AbstractMacroAssembler::repatchLoadPtrToLEA):
+            - remove the LinkBuffer/RepatchBuffer classes, but leave a set of (private, friended) methods to interface to the Assembler
+
+        * assembler/LinkBuffer.h: Added.
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::~LinkBuffer):
+        (JSC::LinkBuffer::link):
+        (JSC::LinkBuffer::patch):
+        (JSC::LinkBuffer::locationOf):
+        (JSC::LinkBuffer::locationOfNearCall):
+        (JSC::LinkBuffer::returnAddressOffset):
+        (JSC::LinkBuffer::finalizeCode):
+        (JSC::LinkBuffer::finalizeCodeAddendum):
+        (JSC::LinkBuffer::code):
+        (JSC::LinkBuffer::performFinalization):
+            - new file containing the LinkBuffer class, previously a member of AbstractMacroAssembler
+
+        * assembler/RepatchBuffer.h: Added.
+        (JSC::RepatchBuffer::RepatchBuffer):
+        (JSC::RepatchBuffer::relink):
+        (JSC::RepatchBuffer::repatch):
+        (JSC::RepatchBuffer::repatchLoadPtrToLEA):
+        (JSC::RepatchBuffer::relinkCallerToTrampoline):
+        (JSC::RepatchBuffer::relinkCallerToFunction):
+        (JSC::RepatchBuffer::relinkNearCallerToTrampoline):
+            - new file containing the RepatchBuffer class, previously a member of AbstractMacroAssembler
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::linkPointerForCall):
+        (JSC::X86Assembler::linkPointer):
+        (JSC::X86Assembler::relinkJump):
+        (JSC::X86Assembler::relinkCall):
+        (JSC::X86Assembler::repatchInt32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::setPointer):
+        (JSC::X86Assembler::setInt32):
+        (JSC::X86Assembler::setRel32):
+            - rename patchPointer to bring it in line with the current link/repatch naming scheme
+
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+            - include new headers
+            - remove MacroAssembler:: specification from RepatchBuffer usage
+
+        * jit/JITPropertyAccess.cpp:
+        * yarr/RegexJIT.cpp:
+            - include new headers
+
+2009-07-21  Robert Agoston  <Agoston.Robert@stud.u-szeged.hu>
+
+        Reviewed by David Levin.
+
+        Fixed #undef typo.
+        https://bugs.webkit.org/show_bug.cgi?id=27506
+
+        * bytecode/Opcode.h:
+
+2009-07-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r46153, r46154, and r46155
+
+        These changes were causing build failures and assertion failures on
+        Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        * runtime/StringPrototype.cpp:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/Platform.h:
+        * wtf/PossiblyNull.h: Removed.
+
+2009-07-21  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by David Levin.
+
+        Add ENABLE_RUBY to list of build options
+        https://bugs.webkit.org/show_bug.cgi?id=27324
+
+        * Configurations/FeatureDefines.xcconfig: Added flag ENABLE_RUBY.
+
+2009-07-20  Oliver Hunt  <oliver@apple.com>
+
+        Build fix attempt #2
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-20  Oliver Hunt  <oliver@apple.com>
+
+        Build fix attempt #1
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Jump through a few hoops to make it much harder to accidentally
+        miss null-checking of values returned by the try-* allocation
+        routines.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::allocChars):
+        (JSC::reallocChars):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::createRep):
+        (JSC::concatenate):
+        (JSC::UString::spliceSubstringsWithSeparators):
+        (JSC::UString::replaceRange):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastZeroedMalloc):
+        (WTF::tryFastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::tryFastRealloc):
+        (WTF::TCMallocStats::tryFastMalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        * wtf/FastMalloc.h:
+        (WTF::TryMallocReturnValue::TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::~TryMallocReturnValue):
+        (WTF::TryMallocReturnValue::operator Maybe<T>):
+        (WTF::TryMallocReturnValue::getValue):
+        * wtf/PossiblyNull.h:
+        (WTF::PossiblyNull::PossiblyNull):
+        (WTF::PossiblyNull::~PossiblyNull):
+        (WTF::PossiblyNull::getValue):
+        * wtf/Platform.h:
+
+2009-07-20  Gavin Barraclough  <barraclough@apple.com>
+
+        RS Oliver Hunt.
+
+        Add ARM assembler files to xcodeproj, for convenience editing.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-07-20  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by David Levin.
+
+        Fix an incorrect assertion in Vector::remove.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27477
+
+        * wtf/Vector.h:
+        (WTF::::remove):
+        Assert that the position at which to start removing elements + the
+        length (the number of elements to remove) is less than or equal to the
+        size of the entire Vector.
+
+2009-07-20  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27468
+        Back out r46060, which caused problems for some Apple developers.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2009-07-20  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Allow custom memory allocation control in NewThreadContext
+        https://bugs.webkit.org/show_bug.cgi?id=27338
+
+        Inherits NewThreadContext struct from FastAllocBase because it
+        has been instantiated by 'new' JavaScriptCore/wtf/Threading.cpp:76.
+
+        * wtf/Threading.cpp:
+
+2009-07-20  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Allow custom memory allocation control in JavaScriptCore's JSClassRef.h
+        https://bugs.webkit.org/show_bug.cgi?id=27340
+
+        Inherit StaticValueEntry and StaticFunctionEntry struct from FastAllocBase because these
+        have been instantiated by 'new' in JavaScriptCore/API/JSClassRef.cpp:153
+        and in JavaScriptCore/API/JSClassRef.cpp:166.
+
+        * API/JSClassRef.h:
+
+2009-07-20  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control in JavaScriptCore's RegexPattern.h
+        https://bugs.webkit.org/show_bug.cgi?id=27343
+
+        Inherits RegexPattern.h's structs (which have been instantiated by operator new) from FastAllocBase:
+
+        CharacterClass (new call: JavaScriptCore/yarr/RegexCompiler.cpp:144)
+        PatternAlternative (new call: JavaScriptCore/yarr/RegexPattern.h:221) 
+        PatternDisjunction (new call: JavaScriptCore/yarr/RegexCompiler.cpp:446)
+
+        * yarr/RegexPattern.h:
+
+2009-07-20  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's MatchFrame struct
+        https://bugs.webkit.org/show_bug.cgi?id=27344
+
+        Inherits MatchFrame struct from FastAllocBase because it has
+        been instantiated by 'new' JavaScriptCore/pcre/pcre_exec.cpp:359.
+
+        * pcre/pcre_exec.cpp:
+
+2009-07-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Remove some outdated S60 platform specific code
+        https://bugs.webkit.org/show_bug.cgi?id=27423
+
+        * wtf/Platform.h:
+
+2009-07-20  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        Qt build fix with MSVC and MinGW.
+
+        * jsc.pro: Make sure jsc is a console application, and turn off
+        exceptions and stl support to fix the build.
+
+2009-07-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Do not use C++-style comments in preprocessor directives.
+
+        GCC does not like this in some configurations, using C-style
+        comments is safer.
+
+        * wtf/Platform.h:
+
+2009-07-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2009-07-17  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Add YARR support for generic ARM platforms (disabled by default).
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        Add generic ARM port for MacroAssembler. It supports the whole
+        MacroAssembler functionality except floating point.
+
+        The class JmpSrc is extended with a flag which enables to patch
+        the jump destination offset during execution. This feature is
+        required for generic ARM port.
+
+        Signed off by Zoltan Herczeg <zherczeg@inf.u-szeged.hu>
+        Signed off by Gabor Loki <loki@inf.u-szeged.hu>
+
+        * JavaScriptCore.pri:
+        * assembler/ARMAssembler.cpp: Added.
+        (JSC::ARMAssembler::getLdrImmAddress):
+        (JSC::ARMAssembler::linkBranch):
+        (JSC::ARMAssembler::patchConstantPoolLoad):
+        (JSC::ARMAssembler::getOp2):
+        (JSC::ARMAssembler::genInt):
+        (JSC::ARMAssembler::getImm):
+        (JSC::ARMAssembler::moveImm):
+        (JSC::ARMAssembler::dataTransfer32):
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h: Added.
+        (JSC::ARM::):
+        (JSC::ARMAssembler::ARMAssembler):
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::JmpSrc::JmpSrc):
+        (JSC::ARMAssembler::JmpSrc::enableLatePatch):
+        (JSC::ARMAssembler::JmpDst::JmpDst):
+        (JSC::ARMAssembler::JmpDst::isUsed):
+        (JSC::ARMAssembler::JmpDst::used):
+        (JSC::ARMAssembler::emitInst):
+        (JSC::ARMAssembler::and_r):
+        (JSC::ARMAssembler::ands_r):
+        (JSC::ARMAssembler::eor_r):
+        (JSC::ARMAssembler::eors_r):
+        (JSC::ARMAssembler::sub_r):
+        (JSC::ARMAssembler::subs_r):
+        (JSC::ARMAssembler::rsb_r):
+        (JSC::ARMAssembler::rsbs_r):
+        (JSC::ARMAssembler::add_r):
+        (JSC::ARMAssembler::adds_r):
+        (JSC::ARMAssembler::adc_r):
+        (JSC::ARMAssembler::adcs_r):
+        (JSC::ARMAssembler::sbc_r):
+        (JSC::ARMAssembler::sbcs_r):
+        (JSC::ARMAssembler::rsc_r):
+        (JSC::ARMAssembler::rscs_r):
+        (JSC::ARMAssembler::tst_r):
+        (JSC::ARMAssembler::teq_r):
+        (JSC::ARMAssembler::cmp_r):
+        (JSC::ARMAssembler::orr_r):
+        (JSC::ARMAssembler::orrs_r):
+        (JSC::ARMAssembler::mov_r):
+        (JSC::ARMAssembler::movs_r):
+        (JSC::ARMAssembler::bic_r):
+        (JSC::ARMAssembler::bics_r):
+        (JSC::ARMAssembler::mvn_r):
+        (JSC::ARMAssembler::mvns_r):
+        (JSC::ARMAssembler::mul_r):
+        (JSC::ARMAssembler::muls_r):
+        (JSC::ARMAssembler::mull_r):
+        (JSC::ARMAssembler::ldr_imm):
+        (JSC::ARMAssembler::ldr_un_imm):
+        (JSC::ARMAssembler::dtr_u):
+        (JSC::ARMAssembler::dtr_ur):
+        (JSC::ARMAssembler::dtr_d):
+        (JSC::ARMAssembler::dtr_dr):
+        (JSC::ARMAssembler::ldrh_r):
+        (JSC::ARMAssembler::ldrh_d):
+        (JSC::ARMAssembler::ldrh_u):
+        (JSC::ARMAssembler::strh_r):
+        (JSC::ARMAssembler::push_r):
+        (JSC::ARMAssembler::pop_r):
+        (JSC::ARMAssembler::poke_r):
+        (JSC::ARMAssembler::peek_r):
+        (JSC::ARMAssembler::clz_r):
+        (JSC::ARMAssembler::bkpt):
+        (JSC::ARMAssembler::lsl):
+        (JSC::ARMAssembler::lsr):
+        (JSC::ARMAssembler::asr):
+        (JSC::ARMAssembler::lsl_r):
+        (JSC::ARMAssembler::lsr_r):
+        (JSC::ARMAssembler::asr_r):
+        (JSC::ARMAssembler::size):
+        (JSC::ARMAssembler::ensureSpace):
+        (JSC::ARMAssembler::label):
+        (JSC::ARMAssembler::align):
+        (JSC::ARMAssembler::jmp):
+        (JSC::ARMAssembler::patchPointerInternal):
+        (JSC::ARMAssembler::patchConstantPoolLoad):
+        (JSC::ARMAssembler::patchPointer):
+        (JSC::ARMAssembler::repatchInt32):
+        (JSC::ARMAssembler::repatchPointer):
+        (JSC::ARMAssembler::repatchLoadPtrToLEA):
+        (JSC::ARMAssembler::linkJump):
+        (JSC::ARMAssembler::relinkJump):
+        (JSC::ARMAssembler::linkCall):
+        (JSC::ARMAssembler::relinkCall):
+        (JSC::ARMAssembler::getRelocatedAddress):
+        (JSC::ARMAssembler::getDifferenceBetweenLabels):
+        (JSC::ARMAssembler::getCallReturnOffset):
+        (JSC::ARMAssembler::getOp2Byte):
+        (JSC::ARMAssembler::placeConstantPoolBarrier):
+        (JSC::ARMAssembler::RM):
+        (JSC::ARMAssembler::RS):
+        (JSC::ARMAssembler::RD):
+        (JSC::ARMAssembler::RN):
+        (JSC::ARMAssembler::getConditionalField):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::JmpSrc::enableLatePatch):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::enableLatePatch):
+        (JSC::AbstractMacroAssembler::Jump::enableLatePatch):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h: Added.
+        (JSC::MacroAssemblerARM::):
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::mul32):
+        (JSC::MacroAssemblerARM::not32):
+        (JSC::MacroAssemblerARM::or32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::load32):
+        (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::loadPtrWithPatchToLEA):
+        (JSC::MacroAssemblerARM::load16):
+        (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::pop):
+        (JSC::MacroAssemblerARM::push):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::swap):
+        (JSC::MacroAssemblerARM::signExtend32ToPtr):
+        (JSC::MacroAssemblerARM::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branch16):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::jump):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::mull32):
+        (JSC::MacroAssemblerARM::branchMul32):
+        (JSC::MacroAssemblerARM::branchSub32):
+        (JSC::MacroAssemblerARM::breakpoint):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::ret):
+        (JSC::MacroAssemblerARM::set32):
+        (JSC::MacroAssemblerARM::setTest32):
+        (JSC::MacroAssemblerARM::tailRecursiveCall):
+        (JSC::MacroAssemblerARM::makeTailRecursiveCall):
+        (JSC::MacroAssemblerARM::moveWithPatch):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::storePtrWithPatch):
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeDouble):
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARM::ARMCondition):
+        (JSC::MacroAssemblerARM::prepareCall):
+        (JSC::MacroAssemblerARM::call32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpSrc::enableLatePatch):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+
+2009-07-17  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Extend AssemblerBuffer with constant pool handling mechanism.
+        https://bugs.webkit.org/show_bug.cgi?id=24986
+
+        Add a platform independed constant pool framework.
+        This pool can store 32 or 64 bits values which is enough to hold
+        any integer, pointer or double constant.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        (JSC::AssemblerBuffer::append):
+        (JSC::AssemblerBuffer::grow):
+        * assembler/AssemblerBufferWithConstantPool.h: Added.
+        (JSC::):
+
+2009-07-17  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Build fix for non-Darwin.
+        Add a guard for inclusion of RetainPtr.h which includes CoreFoundation.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=27382
+
+        * wtf/unicode/icu/CollatorICU.cpp:
+
+2009-07-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by John Sullivan.
+
+        Get user default collation order via a CFLocale API when available.
+
+        * wtf/unicode/icu/CollatorICU.cpp: (WTF::Collator::userDefault):
+
+2009-07-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix the include path for the Symbian port
+        https://bugs.webkit.org/show_bug.cgi?id=27358
+
+        * JavaScriptCore.pri:
+
+2009-07-17  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by David Levin.
+
+        Build fix on platforms don't have MMAP.
+        https://bugs.webkit.org/show_bug.cgi?id=27365
+
+        * interpreter/RegisterFile.h: Including stdio.h irrespectively of HAVE(MMAP)
+
+2009-07-16  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add --web-sockets flag and ENABLE_WEB_SOCKETS define.
+        https://bugs.webkit.org/show_bug.cgi?id=27206
+        
+        Add ENABLE_WEB_SOCKETS
+
+        * Configurations/FeatureDefines.xcconfig: add ENABLE_WEB_SOCKETS
+
+2009-07-16  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added Haiku-specific files for JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=26620
+
+        * wtf/haiku/MainThreadHaiku.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-07-16  Gavin Barraclough  <barraclough@apple.com>
+
+        RS by Oliver Hunt.
+
+        Revert r45969, this fix does not appear to be valid.
+        https://bugs.webkit.org/show_bug.cgi?id=27077
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+
+2009-07-16  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Allow custom memory allocation control in ExceptionInfo and RareData struct
+        https://bugs.webkit.org/show_bug.cgi?id=27336
+
+        Inherits ExceptionInfo and RareData struct from FastAllocBase because these
+        have been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.cpp:1289 and
+        in JavaScriptCore/bytecode/CodeBlock.h:453.
+
+        Remove unnecessary WTF:: namespace from CodeBlock inheritance.
+ 
+        * bytecode/CodeBlock.h:
+
+2009-07-16  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        Fix FeatureDefines.xcconfig to not be out of sync with the rest of the world.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-07-16  Yong Li  <yong.li@torchmobile.com>
+
+         Reviewed by George Staikos.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27320
+         _countof is only included in CE6; for CE5 we need to define it ourself
+
+         * wtf/Platform.h:
+
+2009-07-16  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Workers + garbage collector: weird crashes
+        https://bugs.webkit.org/show_bug.cgi?id=27077
+
+        We need to unlink cached method call sites when a function is destroyed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        * jit/JIT.cpp:
+        (JSC::JIT::unlinkMethodCall):
+        * jit/JIT.h:
+
+2009-07-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows Build fix.
+
+        Visual Studio reset our intermediate directory on us.
+        This sets it back.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2009-07-15  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26794
+        Make Yacc-generated parsers to use fastMalloc/fastFree.
+        
+        Define YYMALLOC and YYFREE to fastMalloc and fastFree
+        respectively.
+
+        * parser/Grammar.y:
+
+2009-07-15  Darin Adler  <darin@apple.com>
+
+        Fix a build for a particular Apple configuration.
+
+        * wtf/FastAllocBase.h: Change include to use "" style for
+        including another wtf header. This is the style we use for
+        including other public headers in the same directory.
+
+2009-07-15  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27303
+        Implement createThreadInternal for WinCE.
+        Contains changes by George Staikos <george.staikos@torchmobile.com> and Joe Mason <joe.mason@torchmobile.com>
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::createThreadInternal):
+
+2009-07-15  Joe Mason  <joe.mason@torchmobile.com>
+
+         Reviewed by George Staikos.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27298
+         Platform defines for WINCE.
+         Contains changes by Yong Li <yong.li@torchmobile.com>,
+         George Staikos <george.staikos@torchmobile.com> and Joe Mason <joe.mason@torchmobile.com>
+
+         * wtf/Platform.h:
+
+2009-07-15  Yong Li  <yong.li@torchmobile.com>
+
+         Reviewed by Adam Treat.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27306
+         Use RegisterClass instead of RegisterClassEx on WinCE.
+
+         * wtf/win/MainThreadWin.cpp:
+         (WTF::initializeMainThreadPlatform):
+
+2009-07-15  Yong Li  <yong.li@torchmobile.com>
+
+         Reviewed by George Staikos.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27301
+         Use OutputDebugStringW on WinCE since OutputDebugStringA is not supported
+         Originally written by Yong Li <yong.li@torchmobile.com> and refactored by
+         Joe Mason <joe.mason@torchmobile.com>
+
+         * wtf/Assertions.cpp: vprintf_stderr_common
+
+2009-07-15  Yong Li  <yong.li@torchmobile.com>
+
+         Reviewed by George Staikos.
+
+         https://bugs.webkit.org/show_bug.cgi?id=27020
+         msToGregorianDateTime should set utcOffset to 0 when outputIsUTC is false
+
+         * wtf/DateMath.cpp:
+         (WTF::gregorianDateTimeToMS):
+
+2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup - Remove obsolete code from the make system
+        https://bugs.webkit.org/show_bug.cgi?id=27299
+
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-07-07  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27056
+
+        Alternate bool operator for codewarrior compiler (WINSCW).
+        Compiler (latest b482) reports error for UnspecifiedBoolType construct:
+        "illegal explicit conversion from 'WTF::OwnArrayPtr<JSC::Register>' to 'bool'"
+
+        Same fix as in r38391.
+
+        * JavaScriptCore/wtf/OwnArrayPtr.h:
+
+2009-07-15  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Qualify include path with wtf to fix compilation
+        on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=27055
+
+        * interpreter/Interpreter.h:
+
+2009-07-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Dave Kilzer.
+
+        Turn off non-portable date manipulations for SYMBIAN
+        https://bugs.webkit.org/show_bug.cgi?id=27064
+
+        Introduce HAVE(TM_GMTOFF), HAVE(TM_ZONE) and HAVE(TIMEGM) guards 
+        and place the rules for controlling the guards in Platform.h.
+        Turn off these newly introduced guards for SYMBIAN.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+        * wtf/DateMath.h:
+        (WTF::GregorianDateTime::GregorianDateTime):
+        (WTF::GregorianDateTime::operator tm):
+        * wtf/Platform.h:
+
+2009-07-15  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Undef ASSERT on Symbian, to avoid excessive warnings
+        https://bugs.webkit.org/show_bug.cgi?id=27052
+
+        * wtf/Assertions.h:
+
+2009-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        REGRESSION: fast/js/postfix-syntax.html fails with interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=27294
+
+        When postfix operators operating on locals assign to the same local
+        the order of operations has to be to store the incremented value, then
+        store the unmodified number.  Rather than implementing this subtle
+        semantic in the interpreter I've just made the logic explicit in the
+        bytecode generator, so x=x++ effectively becomes x=ToNumber(x) (for a
+        local var x).
+
+        * parser/Nodes.cpp:
+        (JSC::emitPostIncOrDec):
+
+2009-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Hausmann.
+
+        REGRESSION(43559): fast/js/kde/arguments-scope.html fails with interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=27259
+
+        The interpreter was incorrectly basing its need to create the arguments object
+        based on the presence of the callframe's argument reference rather than the local
+        arguments reference.  Based on this it then overrode the local variable reference.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-07-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Reorganize JavaScriptCore headers into:
+        API: include/JavaScriptCore/
+        Private: include/private/JavaScriptCore/
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Change JSCell's superclass to NoncopyableCustomAllocated
+        https://bugs.webkit.org/show_bug.cgi?id=27248
+
+        JSCell class customizes operator new, since Noncopyable will be 
+        inherited from FastAllocBase, NoncopyableCustomAllocated has 
+        to be used.
+
+        * runtime/JSCell.h:
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Change all Noncopyable inheriting visibility to public.
+        https://bugs.webkit.org/show_bug.cgi?id=27225
+
+        Change all Noncopyable inheriting visibility to public because
+        it is needed to the custom allocation framework (bug #20422).
+
+        * bytecode/SamplingTool.h:
+        * bytecompiler/RegisterID.h:
+        * interpreter/CachedCall.h:
+        * interpreter/RegisterFile.h:
+        * parser/Lexer.h:
+        * parser/Parser.h:
+        * runtime/ArgList.h:
+        * runtime/BatchedTransitionOptimizer.h:
+        * runtime/Collector.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSLock.h:
+        * runtime/JSONObject.cpp:
+        * runtime/SmallStrings.cpp:
+        * runtime/SmallStrings.h:
+        * wtf/CrossThreadRefCounted.h:
+        * wtf/GOwnPtr.h:
+        * wtf/Locker.h:
+        * wtf/MessageQueue.h:
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnFastMallocPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/RefCounted.h:
+        * wtf/ThreadSpecific.h:
+        * wtf/Threading.h:
+        * wtf/Vector.h:
+        * wtf/unicode/Collator.h:
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Change ParserArenaRefCounted's superclass to RefCountedCustomAllocated
+        https://bugs.webkit.org/show_bug.cgi?id=27249
+
+        ParserArenaDeletable customizes operator new, to avoid double inheritance
+        ParserArenaDeletable's superclass has been changed to RefCountedCustomAllocated.
+
+        * parser/Nodes.h:
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Add RefCountedCustomAllocated to RefCounted.h
+        https://bugs.webkit.org/show_bug.cgi?id=27232
+
+        Some class which are inherited from RefCounted customize
+        operator new, but RefCounted is inherited from Noncopyable
+        which will be inherited from FastAllocBase. To avoid
+        conflicts Noncopyable inheriting was moved down to RefCounted
+        and to avoid double inheritance this class has been added.
+
+        * wtf/RefCounted.h:
+        (WTF::RefCountedCustomAllocated::deref):
+        (WTF::RefCountedCustomAllocated::~RefCountedCustomAllocated):
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Add NoncopyableCustomAllocated to Noncopyable.h.
+        https://bugs.webkit.org/show_bug.cgi?id=27228
+        
+        Some classes which inherited from Noncopyable overrides operator new
+        since Noncopyable'll be inherited from FastAllocBase, Noncopyable.h 
+        needs to be extended with this new class to support the overriding. 
+
+        * wtf/Noncopyable.h:
+        (WTFNoncopyable::NoncopyableCustomAllocated::NoncopyableCustomAllocated):
+        (WTFNoncopyable::NoncopyableCustomAllocated::~NoncopyableCustomAllocated):
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's IdentifierTable class
+        https://bugs.webkit.org/show_bug.cgi?id=27260
+
+        Inherits IdentifierTable class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Identifier.cpp:70.
+
+        * runtime/Identifier.cpp:
+
+2009-07-14  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for JavaScriptCore's Profiler class
+        https://bugs.webkit.org/show_bug.cgi?id=27253
+
+        Inherits Profiler class from FastAllocBase because it has been instantiated by
+        'new' in JavaScriptCore/profiler/Profiler.cpp:56.
+
+        * profiler/Profiler.h:
+
+2009-07-06  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Authors: George Staikos <george.staikos@torchmobile.com>, Joe Mason <joe.mason@torchmobile.com>, Makoto Matsumoto <matumoto@math.keio.ac.jp>, Takuji Nishimura
+
+        https://bugs.webkit.org/show_bug.cgi?id=27030
+        Implement custom RNG for WinCE using Mersenne Twister
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/wince/mt19937ar.c: Added.
+        (init_genrand):
+        (init_by_array):
+        (genrand_int32):
+        (genrand_int31):
+        (genrand_real1):
+        (genrand_real2):
+        (genrand_real3):
+        (genrand_res53):
+
+2009-07-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix.
+
+        * GNUmakefile.am:
+
+2009-07-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Add ENABLE(SHARED_WORKERS) flag and define SharedWorker APIs
+        https://bugs.webkit.org/show_bug.cgi?id=26932
+
+        Added ENABLE(SHARED_WORKERS) flag (off by default).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-07-07  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Maciej Stachoviak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27058
+
+        Removed superfluous parenthesis around single expression.
+        Compilers on Symbian platform fail to properly parse and compile.
+
+        * JavaScriptCore/wtf/Platform.h:
+
+2009-07-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Maciej Stachoviak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27054
+
+        Renamed Translator to HashTranslator
+
+        Codewarrior compiler (WINSCW) latest b482 cannot resolve typename
+        mismatch between template declaration and definition
+        (HashTranslator / Translator)
+
+        * wtf/HashSet.h:
+
+2009-07-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27053
+
+        Ambiguity in LabelScope initialization
+
+        Codewarrior compiler (WINSCW) latest b482 on Symbian cannot resolve
+        type of "0" unambiguously. Set expression explicitly to
+        PassRefPtr<Label>::PassRefPtr()
+
+        * bytecompiler/BytecodeGenerator.cpp
+
+2009-07-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable support for accelerated compositing and 3d transforms on Leopard.
+        <https://bugs.webkit.org/show_bug.cgi?id=20166>
+        <rdar://problem/6120614>
+
+        Reviewed by Oliver Hunt.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-07-10  Mark Rowe  <mrowe@apple.com>
+
+        Second part of the "make Windows happier" dance.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-10  Mark Rowe  <mrowe@apple.com>
+
+        Try and make the Windows build happy.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-07-10  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        * debugger/Debugger.h: Made this function virtual for use in WebCore's
+        WebInspector.
+
+2009-07-10  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        ParserArenaDeletable should override delete
+        https://bugs.webkit.org/show_bug.cgi?id=26790
+
+        ParserArenaDeletable overrides new, but it does not override delete.
+        ParserArenaDeletable must be freed by fastFree
+        because it is allocated by fastMalloc.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaDeletable::operator delete):
+        * parser/Nodes.h:
+
+2009-07-10  Adam Roben  <aroben@apple.com>
+
+        Sort all our Xcode projects
+
+        Accomplished using sort-Xcode-project-file.
+
+        Requested by Dave Kilzer.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-07-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        Windows build fix for the last change.
+
+        * wtf/dtoa.cpp: Forgot to include Vector.h
+
+2009-07-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: crash in edge cases of floating point parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=27110
+        <rdar://problem/7044458>
+        
+        Tests: fast/css/number-parsing-crash.html
+               fast/css/number-parsing-crash.html
+               fast/js/number-parsing-crash.html
+        
+        * wtf/dtoa.cpp:
+        (WTF::BigInt::BigInt): Converted this to more a proper class, using a Vector
+        with inline capacity
+
+        (WTF::lshift): Rearranged logic somewhat nontrivially to deal with the new way of sizing BigInts.
+        Added an assertion to verify that invariants are maintained.
+
+        All other functions are adapted fairly mechanically to the above changes.
+        (WTF::BigInt::clear):
+        (WTF::BigInt::size):
+        (WTF::BigInt::resize):
+        (WTF::BigInt::words):
+        (WTF::BigInt::append):
+        (WTF::multadd):
+        (WTF::s2b):
+        (WTF::i2b):
+        (WTF::mult):
+        (WTF::cmp):
+        (WTF::diff):
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::ratio):
+        (WTF::strtod):
+        (WTF::quorem):
+        (WTF::dtoa):
+
+2009-07-09  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Turned on CHANNEL_MESSAGING by default because the MessageChannel API
+        can now be implemented for Web Workers and is reasonably stable.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-07-09  Oliver Hunt  <oliver@apple.com>
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-07-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 27016 - Interpreter crashes due to invalid array indexes
+        <https://bugs.webkit.org/show_bug.cgi?id=27016>
+
+        Unsigned vs signed conversions results in incorrect behaviour in
+        64bit interpreter builds.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-07-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Upstream JavaScriptCore.gypi, the project file for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=27135
+
+        * JavaScriptCore.gypi: Added.
+
+2009-07-09  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+        
+        Authors: Yong Li <yong.li@torchmobile.com>, Joe Mason <joe.mason@torchmobile.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=27031
+        Add an override for deleteOwnedPtr(HDC) on Windows
+        
+        * wtf/OwnPtrCommon.h:
+        * wtf/OwnPtrWin.cpp:
+        (WTF::deleteOwnedPtr):
+
+2009-07-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Guard singal.h dependency with HAVE(SIGNAL_H) to enable building jsc
+        on SYMBIAN.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27026
+
+        Based on Norbert Leser's work.
+
+        * jsc.cpp:
+        (printUsageStatement):
+        (parseArguments):
+        * wtf/Platform.h:
+
+2009-07-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Stop loading constants into the register file.
+
+        Instead, use high register values (highest bit bar the sign bit set) to indicate
+        constants in the instruction stream, and when we encounter such a value load it
+        directly from the CodeBlock.
+
+        Since constants are no longer copied into the register file, this patch renders
+        the 'unexpected constant' mechanism redundant, and removes it.
+
+        2% improvement, thanks to Sam Weinig.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isTemporaryRegisterIndex):
+        (JSC::CodeBlock::constantRegister):
+        (JSC::CodeBlock::isConstantRegisterIndex):
+        (JSC::CodeBlock::getConstant):
+        (JSC::ExecState::r):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::preserveLastVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitNewError):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::noCaller):
+        (JSC::ExecState::hasHostCallFrameFlag):
+        (JSC::ExecState::addHostCallFrameFlag):
+        (JSC::ExecState::removeHostCallFrameFlag):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_error):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_enter_with_activation):
+        * parser/Nodes.cpp:
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * wtf/Platform.h:
+
+2009-07-07  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=27025> / <rdar://problem/7033448>.
+        Bug 27025: Crashes and regression test failures related to regexps in 64-bit
+
+        For x86_64 RegexGenerator uses rbx, a callee-save register, as a scratch register but
+        neglects to save and restore it.  The change in handling of the output vector in r45545
+        altered code generation so that the RegExp::match was now storing important data in rbx,
+        which caused crashes and bogus results when it was clobbered.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter): Save rbx.
+        (JSC::Yarr::RegexGenerator::generateReturn): Restore rbx.
+
+2009-07-06  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Darin Adler and Mark Rowe.
+
+        Decommitted spans are added to the list of normal spans rather than 
+        the returned spans in TCMalloc_PageHeap::Delete().
+        https://bugs.webkit.org/show_bug.cgi?id=26998
+        
+        In TCMalloc_PageHeap::Delete(), the deleted span can be decommitted in 
+        the process of merging with neighboring spans that are also decommitted.  
+        The merged span needs to be placed in the list of returned spans (spans 
+        whose memory has been returned to the system).  Right now it's always added 
+        to the list of the normal spans which can theoretically cause thrashing.  
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::Delete):
+
+2009-07-05  Lars Knoll  <lars.knoll@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26843
+
+        Fix run-time crashes in JavaScriptCore with the Metrowerks compiler on Symbian.
+
+        The Metrowerks compiler on the Symbian platform moves the globally
+        defined Hashtables into read-only memory, despite one of the members
+        being mutable. This causes crashes at run-time due to write access to
+        read-only memory.
+
+        Avoid the use of const with this compiler by introducing the
+        JSC_CONST_HASHTABLE macro.
+
+        Based on idea by Norbert Leser.
+
+        * runtime/Lookup.h: Define JSC_CONST_HASHTABLE as const for !WINSCW.
+        * create_hash_table: Use JSC_CONST_HASHTABLE for hashtables.
+        * runtime/JSGlobalData.cpp: Import various global hashtables via the macro.
+
+2009-07-04  Dan Bernstein  <mitz@apple.com>
+
+        - debug build fix
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getLastParen):
+
+2009-07-03  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Maciej Stachowiak (and revised slightly)
+
+        RegExp::match to be optimized
+        https://bugs.webkit.org/show_bug.cgi?id=26957
+
+        Allow regexp matching to use Vectors with inline capacity instead of
+        allocating a new ovector buffer every time.
+        
+        ~5% speedup on SunSpider string-unpack-code test, 0.3% on SunSpider overall.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructorPrivate::RegExpConstructorPrivate):
+        (JSC::RegExpConstructorPrivate::lastOvector):
+        (JSC::RegExpConstructorPrivate::tempOvector):
+        (JSC::RegExpConstructorPrivate::changeLastOvector):
+        (JSC::RegExpConstructor::performMatch):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
+
+2009-06-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Override operator new/delete with const std::nothrow_t& as the second
+        argument.
+        https://bugs.webkit.org/show_bug.cgi?id=26792
+
+        On Windows CE, operator new/delete, new[]/delete[] with const
+        std::nothrow_t& must be overrided because some standard template
+        libraries use these operators.
+
+        The problem occurs when memory allocated by new(size_t s, const
+        std::nothrow_t&) is freed by delete(void* p). This causes the umatched
+        malloc/free problem.
+
+        The patch overrides all new, delete, new[] and delete[] to use
+        fastMaloc and fastFree consistently.
+
+        * wtf/FastMalloc.h:
+        (throw):
+
+2009-06-30  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Sam Weinig.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
+
+        Remove unnecessary references to AssemblerBuffer.
+
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+
+2009-06-29  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Still seeing occasional leaks from UString::sharedBuffer code
+        https://bugs.webkit.org/show_bug.cgi?id=26420
+
+        The problem is that the pointer to the memory allocation isn't visible
+        by "leaks" due to the lower bits being used as flags.  The fix is to
+        make the pointer visible in memory (in debug only). The downside of
+        this fix that the memory allocated by sharedBuffer will still look like
+        a leak in non-debug builds when any flags are set.
+
+        * wtf/PtrAndFlags.h:
+        (WTF::PtrAndFlags::set):
+
+2009-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove more unused scons support.
+
+        * SConstruct: Removed.
+
+2009-06-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/7016214> JSON.parse fails to parse valid JSON with most Unicode characters
+        <https://bugs.webkit.org/show_bug.cgi?id=26802>
+
+        In the original JSON.parse patch unicode was handled correctly, however in some last
+        minute "clean up" I oversimplified isSafeStringCharacter.  This patch corrects this bug.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser::Lexer::lexString):
+
+2009-06-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7009684> REGRESSION(r45039): Crashes inside JSEvent::put on PowerPC (26746)
+        <https://bugs.webkit.org/show_bug.cgi?id=26746>
+
+        Fix for r45039 incorrectly uncached a get_by_id by converting it to put_by_id.  Clearly this
+        is less than correct.  This patch corrects that error.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+
+2009-06-26  Eric Seidel  <eric@webkit.org>
+
+        No review, only rolling out r45259.
+
+        Roll out r45259 after crash appeared on the bots:
+        plugins/undefined-property-crash.html
+        ASSERTION FAILED: s <= HeapConstants<heapType>::cellSize
+        (leopard-intel-debug-tests/build/JavaScriptCore/runtime/Collector.cpp:278
+        void* JSC::Heap::heapAllocate(size_t) [with JSC::HeapType heapType = PrimaryHeap])
+
+        * runtime/DateInstance.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/Lookup.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/UString.h:
+
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for QDataStream operators to Vector.
+
+        * wtf/Vector.h:
+        (WTF::operator<<):
+        (WTF::operator>>):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Make the opcode sampler work once again.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Extend FastAllocBase.h with 'using WTF::FastAllocBase' to avoid
+        unnecessary WTF:: usings.
+        Remove existing unnecessary WTF:: usings.
+
+        * interpreter/Interpreter.h:
+        * profiler/CallIdentifier.h:
+        * runtime/ScopeChain.h:
+        * wtf/FastAllocBase.h:
+
+2009-06-24  David Levin  <levin@chromium.org>
+
+        Fix all builds.
+
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Register.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26677
+
+        Inherits CodeBlock class from FastAllocBase because it
+        has been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.h:217.
+
+        * bytecode/CodeBlock.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26676
+
+        Inherits BytecodeGenerator class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/Nodes.cpp:1892.
+
+        * bytecompiler/BytecodeGenerator.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26675
+
+        Inherits Register class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSVariableObject.h:149.
+
+        * interpreter/Register.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26674
+
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:458.
+
+        * wtf/HashMap.h:
+
+2009-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6940519> REGRESSION (Safari 4 Public Beta - TOT): google.com/adplanner shows blank page instead of site details in "basic research'
+
+        The problem was caused by the page returned with a function using a
+        var declaration list containing around ~3000 variables.  The solution
+        to this is to flatten the comma expression representation and make
+        codegen comma expressions and initializer lists iterative rather than
+        recursive.
+
+        * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        * parser/Nodes.cpp:
+        (JSC::CommaNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isCommaNode):
+        (JSC::CommaNode::isCommaNode):
+        (JSC::CommaNode::append):
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26645
+
+        Inherits ScopeChainNode class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/ScopeChain.h:95.
+
+        * wtf/RefPtr.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26648
+
+        Inherits Deque class from FastAllocBase because it has been
+        instantiated by 'new' with DEFINE_STATIC_LOCAL macro in 
+        JavaScriptCore/wtf/MainThread.cpp:62.
+
+        * wtf/Deque.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26644
+
+        Inherits RefPtr class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/StructureChain.cpp:41.
+
+        * wtf/RefPtr.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Inherits HashSet class from FastAllocBase, because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Collector.h:116.
+
+        * wtf/HashSet.h:
+
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Inherits Vector class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:633.
+
+        * wtf/Vector.h:
+
+2009-06-24  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Maciej Stachoviak.
+
+        The BytecodeGenerator objects were instantiated on stack, which takes up ~38kB per instance
+        (each instance includes copy of JSC::CodeBlock with large SymbolTable, etc.).
+        Specifically, since there is nested invocation (e.g., GlobalCode --> FunctionCode),
+        the stack overflows immediately on Symbian hardware (max. 80 kB).
+        Proposed change allocates generator objects on heap.
+        Performance impact (if any) should be negligible and change is proposed as general fix,
+        rather than ifdef'd for SYMBIAN.
+
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateBytecode):
+        (JSC::EvalNode::generateBytecode):
+        (JSC::EvalNode::bytecodeForExceptionInfoReparse):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
+
+2009-06-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6992806> REGRESSION: Enumeration can skip new properties in cases of prototypes that have more than 64 (26593)
+        <https://bugs.webkit.org/show_bug.cgi?id=26593>
+
+        Do not attempt to cache structure chains if they contain a dictionary at any level.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::addPropertyTransition):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+        * runtime/StructureChain.h:
+
+2009-06-23  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26654
+        Add the proper export define for the JavaScriptCore API when building for WINCE.
+
+        * API/JSBase.h:
+
+2009-06-23  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Authors: Yong Li <yong.li@torchmobile.com>, Joe Mason <joe.mason@torchmobile.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=26611
+        Implement currentThreadStackBase on WINCE by adding a global,
+        g_stackBase, which must be set to the address of a local variable
+        by the caller before calling any WebKit function that invokes JSC.
+
+        * runtime/Collector.cpp:
+        (JSC::isPageWritable):
+        (JSC::getStackBase):
+          Starts at the top of the stack and returns the entire range of
+          consecutive writable pages as an estimate of the actual stack.
+          This will be much bigger than the actual stack range, so some
+          dead objects can't be collected, but it guarantees live objects
+          aren't collected prematurely.
+
+        (JSC::currentThreadStackBase):
+          On WinCE, returns g_stackBase if set or call getStackBase as a
+          fallback if not.
+
+2009-06-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix stupid performance problem in the LiteralParser
+
+        The LiteralParser was making a new UString in order to use
+        toDouble, however UString's toDouble allows a much wider range
+        of numberic strings than the LiteralParser accepts, and requires
+        an additional heap allocation or two for the construciton of the
+        UString.  To rectify this we just call WTF::dtoa directly using
+        a stack allocated buffer to hold the validated numeric literal.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+
+2009-06-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 26640: JSON.stringify needs to special case Boolean objects
+        <https://bugs.webkit.org/show_bug.cgi?id=26640>
+
+        Add special case handling of the Boolean object so we match current
+        ES5 errata.
+
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive): renamed from unwrapNumberOrString
+        (JSC::gap):
+        (JSC::Stringifier::appendStringifiedValue):
+
+2009-06-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26591: Support revivers in JSON.parse
+        <https://bugs.webkit.org/show_bug.cgi?id=26591>
+
+        Add reviver support to JSON.parse.  This completes the JSON object.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::Walker):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+
+2009-06-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26592: Support standard toJSON functions
+        <https://bugs.webkit.org/show_bug.cgi?id=26592>
+
+        Add support for the standard Date.toJSON function.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToJSON):
+
+2009-06-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 26594: JSC needs to support Date.toISOString
+        <https://bugs.webkit.org/show_bug.cgi?id=26594>
+
+        Add support for Date.toISOString.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+
+2009-06-21  Oliver Hunt  <oliver@apple.com>
+
+        Remove dead code.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+
+2009-06-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler and Cameron Zwarich.
+
+        Bug 26587: Support JSON.parse
+        <https://bugs.webkit.org/show_bug.cgi?id=26587>
+
+        Extend the LiteralParser to support the full strict JSON
+        grammar, fix a few places where the grammar was incorrectly
+        lenient.   Doesn't yet support the JSON.parse reviver function
+        but that does not block the JSON.parse functionality itself.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::tryJSONParse):
+        (JSC::LiteralParser::):
+        (JSC::LiteralParser::Lexer::Lexer):
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative build fix for windows).
+
+        Simply removed some whitespace form this file to make windows build wtf and
+        hopefully copy the new MessageQueque.h so that WebCore picks it up.
+
+        * wtf/Assertions.cpp:
+
+2009-06-21  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25043>
+        Added support for multi-threaded MessagePorts.
+
+        * wtf/MessageQueue.h:
+        (WTF::::appendAndCheckEmpty):
+            Added API to test whether the queue was empty before adding an element.
+  
+2009-06-20  David D. Kilzer  <ddkilzer@webkit.org>
+
+        Fix namespace comment in SegmentedVector.h
+
+        * wtf/SegmentedVector.h: Updated namespace comment to reflect
+        new namespace after r44897.
+
+2009-06-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
+
+        Reviewed by Oliver Hunt.
+
+        An Iterator added for SegmentedVector. Currently
+        only the pre ++ operator is supported.
+
+        * wtf/SegmentedVector.h:
+        (WTF::SegmentedVectorIterator::~SegmentedVectorIterator):
+        (WTF::SegmentedVectorIterator::operator*):
+        (WTF::SegmentedVectorIterator::operator->):
+        (WTF::SegmentedVectorIterator::operator++):
+        (WTF::SegmentedVectorIterator::operator==):
+        (WTF::SegmentedVectorIterator::operator!=):
+        (WTF::SegmentedVectorIterator::operator=):
+        (WTF::SegmentedVectorIterator::SegmentedVectorIterator):
+        (WTF::SegmentedVector::alloc):
+        (WTF::SegmentedVector::begin):
+        (WTF::SegmentedVector::end):
+
+2009-06-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
+
+        Reviewed by Oliver Hunt.
+
+        Move SegmentedVector to /wtf subdirectory
+        and change "namespace JSC" to "namespace WTF"
+
+        Additional build file updates by David Kilzer.
+
+        * GNUmakefile.am: Updated path to SegmentedVector.h.
+        * JavaScriptCore.order: Updated SegmentedVector namespace from
+        JSC to WTF in mangled C++ method name.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Removed reference to bytecompiler\SegmentedVector.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added reference to
+        wtf\SegmentedVector.h.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Moved
+        SegmentedVector.h definition from bytecompiler subdirectory to
+        wtf subdirectory.
+        * bytecompiler/BytecodeGenerator.h: Updated #include path to
+        SegmentedVector.h and prepended WTF:: namespace to its use.
+        * parser/Lexer.h: Ditto.
+        * wtf/SegmentedVector.h: Renamed from JavaScriptCore/bytecompiler/SegmentedVector.h.
+        (WTF::SegmentedVector::SegmentedVector):
+        (WTF::SegmentedVector::~SegmentedVector):
+        (WTF::SegmentedVector::size):
+        (WTF::SegmentedVector::at):
+        (WTF::SegmentedVector::operator[]):
+        (WTF::SegmentedVector::last):
+        (WTF::SegmentedVector::append):
+        (WTF::SegmentedVector::removeLast):
+        (WTF::SegmentedVector::grow):
+        (WTF::SegmentedVector::clear):
+        (WTF::SegmentedVector::deleteAllSegments):
+        (WTF::SegmentedVector::segmentExistsFor):
+        (WTF::SegmentedVector::segmentFor):
+        (WTF::SegmentedVector::subscriptFor):
+        (WTF::SegmentedVector::ensureSegmentsFor):
+        (WTF::SegmentedVector::ensureSegment):
+
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix take 2 - rename FIELD_OFFSET to something that doesn't conflict with winnt.h).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emitGetVariableObjectRegister):
+        (JSC::JIT::emitPutVariableObjectRegister):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::checkStructure):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+
+2009-06-19  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Reorganize ARM architecture specific macros.
+        Use PLATFORM_ARM_ARCH(7) instead of PLATFORM(ARM_V7).
+
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
+
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix armv7 JIT build issues.
+
+        Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it now contains non POD types),
+        and the FIELD_OFFSET macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT macros.
+
+        * Replace offsetofs with FIELD_OFFSETs (safe on C++ objects).
+        * Move COMPILE_ASSERTs defending layout of JITStackFrame structure on armv7 into JITThunks constructor.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
+
+        Blind attempt at build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Inherits CallIdentifier struct from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/profiler/CallIdentifier.h:86.
+
+        * wtf/HashCountedSet.h:
+
+2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26540
+        Modify the test shell to add a new function 'checkSyntax' that will
+        only parse the source instead of executing it. In this way we can test
+        pure parsing performance against some of the larger scripts in the wild.
+
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionCheckSyntax):
+
+2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+        
+        Inherits HashCountedSet class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Collector.cpp:1095.
+
+        * wtf/HashCountedSet.h:
+
+2009-06-19  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26558
+        Declare these symbols extern for WINCE as they are provided by libce.
+
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-06-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/6988973> ScopeChain leak in interpreter builds
+
+        Move the Scopechain destruction code in JSFunction outside of the ENABLE(JIT)
+        path.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * wtf/Platform.h:
+
+2009-06-19  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26543
+        Windows CE uses 'GetLastError' instead of 'errno.'
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+
+2009-06-19  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        Add export for Windows corresponding to OSX export done in r44844.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin "Viceroy of Venezuela" Barraclough.
+
+        Bug 26532: Native functions do not correctly unlink from optimised callsites when they're collected
+        <https://bugs.webkit.org/show_bug.cgi?id=26532> <rdar://problem/6625385>
+
+        We need to make sure that each native function instance correctly unlinks any references to it
+        when it is collected.  Allowing this to happen required a few changes:
+            * Every native function needs a codeblock to track the link information
+            * To have this codeblock, every function now also needs its own functionbodynode
+              so we no longer get to have a single shared instance.
+            * Identifying a host function is now done by looking for CodeBlock::codeType() == NativeCode
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+           Constructor for NativeCode CodeBlock
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        (JSC::CodeBlock::setJITCode):
+           Add assertions to ensure we don't try and use NativeCode CodeBlocks as
+           a normal codeblock.
+
+        * bytecode/CodeBlock.h:
+        (JSC::):
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
+          More assertions.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::linkCall):
+          Update logic to allow native function caching
+
+        * jit/JITStubs.cpp:
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::isHostFunction):
+        * parser/Nodes.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::mark):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Windows build fix).
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Timezone calculation incorrect in Venezuela.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26531
+        <rdar://problem/6646169> Time is incorrectly reported to JavaScript in both Safari 3 and Firefox 3
+
+        The problem is that we're calculating the timezone relative to 01/01/2000,
+        but the VET timezone changed from -4 hours to -4:30 hours on 12/09/2007.
+        According to the spec, section 15.9.1.9 states "the time since the beginning
+        of the year", presumably meaning the *current* year.  Change the calculation
+        to be based on whatever the current year is, rather than a canned date.
+
+        No performance impact.
+
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe (originally reviewed by Sam Weinig).
+
+        (Reintroducing patch added in r44492, and reverted in r44796.)
+
+        Change the implementation of op_throw so the stub function always modifies its
+        return address - if it doesn't find a 'catch' it will switch to a trampoline
+        to force a return from JIT execution.  This saves memory, by avoiding the need
+        for a unique return for every op_throw.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+            JITStubs::cti_op_throw now always changes its return address,
+            remove return code generated after the stub call (this is now
+            handled by ctiOpThrowNotCaught).
+        * jit/JITStubs.cpp:
+        (JSC::):
+            Add ctiOpThrowNotCaught definitions.
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            Change cti_op_throw to always change its return address.
+        * jit/JITStubs.h:
+            Add ctiOpThrowNotCaught declaration.
+
+2009-06-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
+
+        - Exposed functions now needed by WebCore.
+
+        * JavaScriptCore.exp:
+
+2009-06-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26429: Make JSON.stringify non-recursive so it can handle objects
+        of arbitrary complexity
+        https://bugs.webkit.org/show_bug.cgi?id=26429
+
+        For marking I decided not to use gcProtect, because this is inside the engine
+        so it's easy enough to just do marking. And that darned gcProtect does locking!
+        Oliver tried to convince me to used MarkedArgumentBuffer, but the constructor
+        for that class says "FIXME: Remove all clients of this API, then remove this API."
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect): Add a call to JSONObject::markStringifiers.
+
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers): Added emptyIdentifier.
+        * runtime/CommonIdentifiers.h: Ditto.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Initialize firstStringifierToMark to 0.
+        * runtime/JSGlobalData.h: Added firstStringifierToMark.
+
+        * runtime/JSONObject.cpp: Cut down the includes to the needed ones only.
+        (JSC::unwrapNumberOrString): Added. Helper for unwrapping number and string
+        objects to get their number and string values.
+        (JSC::ReplacerPropertyName::ReplacerPropertyName): Added. The class is used
+        to wrap an identifier or integer so we don't have to do any work unless we
+        actually call a replacer.
+        (JSC::ReplacerPropertyName::value): Added.
+        (JSC::gap): Added. Helper function for the Stringifier constructor.
+        (JSC::PropertyNameForFunctionCall::PropertyNameForFunctionCall): Added.
+        The class is used to wrap an identifier or integer so we don't have to
+        allocate a number or string until we actually call toJSON or a replacer.
+        (JSC::PropertyNameForFunctionCall::asJSValue): Added.
+        (JSC::Stringifier::Stringifier): Updated and moved out of the class
+        definition. Added code to hook this into a singly linked list for marking.
+        (JSC::Stringifier::~Stringifier): Remove from the singly linked list.
+        (JSC::Stringifier::mark): Mark all the objects in the holder stacks.
+        (JSC::Stringifier::stringify): Updated.
+        (JSC::Stringifier::appendQuotedString): Tweaked and streamlined a bit.
+        (JSC::Stringifier::toJSON): Renamed from toJSONValue.
+        (JSC::Stringifier::appendStringifiedValue): Renamed from stringify.
+        Added code to use the m_holderStack to do non-recursive stringify of
+        objects and arrays. This code also uses the timeout checker since in
+        pathological cases it could be slow even without calling into the
+        JavaScript virtual machine.
+        (JSC::Stringifier::willIndent): Added.
+        (JSC::Stringifier::indent): Added.
+        (JSC::Stringifier::unindent): Added.
+        (JSC::Stringifier::startNewLine): Added.
+        (JSC::Stringifier::Holder::Holder): Added.
+        (JSC::Stringifier::Holder::appendNextProperty): Added. This is the
+        function that handles the format of arrays and objects.
+        (JSC::JSONObject::getOwnPropertySlot): Moved this down to the bottom
+        of the file so the JSONObject class is not interleaved with the
+        Stringifier class.
+        (JSC::JSONObject::markStringifiers): Added. Calls mark.
+        (JSC::JSONProtoFuncStringify): Streamlined the code here. The code
+        to compute the gap string is now a separate function.
+
+        * runtime/JSONObject.h: Made everything private. Added markStringifiers.
+
+2009-06-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6974140> REGRESSION(r43849): Crash in cti_op_call_NotJSFunction when getting directions on maps.google.com
+
+        Roll out r43849 as it appears that we cannot rely on the address of
+        an objects property storage being constant even if the structure is
+        unchanged.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe.
+
+        Fully revert r44492 & r44748 while we fix a bug they cause on internal builds <rdar://problem/6955963>.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6947426> sunspider math-cordic.js exhibits different intermediate results running 32-bit vs. 64-bit
+
+        On 64-bit, NaN-encoded values must be detagged before they can be used in rshift.
+
+        No performance impact.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+
+2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
+
+        * jsc.cpp:
+        (main):
+
+2009-06-17  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
+
+        * config.h:
+        * jsc.cpp:
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/CurrentTime.cpp:
+        (WTF::lowResUTCTime):
+        * wtf/DateMath.cpp:
+        (WTF::getLocalTime):
+        * wtf/MathExtras.h:
+        * wtf/Platform.h:
+        * wtf/StringExtras.h:
+        * wtf/Threading.h:
+        * wtf/win/MainThreadWin.cpp:
+
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
+
+        Remove PropertySlot::putValue - PropertySlots should only be used for getting,
+        not putting.  Rename JSGlobalObject::getOwnPropertySlot to hasOwnPropertyForWrite,
+        which is what it really was being used to ask, and remove some other getOwnPropertySlot
+        & getOwnPropertySlotForWrite methods, which were unused and likely to lead to confusion.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
+        * runtime/JSObject.h:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/PropertySlot.h:
+
+2009-06-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver hunt.
+
+        Temporarily partially disable r44492, since this is causing some problems on internal builds.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+
+2009-06-16  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+
+2009-06-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Initialize m_bytecodeIndex to -1 in JIT, and correctly initialize
+        it for each type of stub using the return address to find the correct
+        offset.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+
+== Rolled over to ChangeLog-2009-06-16 ==
diff --git a/ChangeLog-2011-02-16 b/ChangeLog-2011-02-16
new file mode 100644
index 0000000..9f81b2b
--- /dev/null
+++ b/ChangeLog-2011-02-16
@@ -0,0 +1,24628 @@
+2011-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 54524 - Allow JSObject to fully utilize cell's capacity for inline storage.
+
+        Currently JSObject is both directly instantiated for regular JS objects, and
+        derived to implement subtypes. A consequence of this is that we need to ensure
+        that sufficient space from the cell is left unused and available for any data
+        members that will be introduced by subclasses of JSObject. By restructuring
+        the internal storage array out of JSObject we can increase the size in the
+        internal storage for regular objects.
+
+        Add classes JSFinalObject and JSNonFinalObject. JSNonFinalObject retains as
+        much additional capacity as is currently available to allow for data members
+        in subclasses. JSFinalObject utilizes all available space for internal storage,
+        and only allows construction through JSFinalObject::create().
+
+        The additional storage made available in the JSObject means that we need no
+        longer rely on a union of the internal storage with a pointer to storage that
+        is only valid for external storage. This means we can go back to always having
+        a valid pointer to property storage, regardless of whether this is internal or
+        external. This simplifies some cases of access to the array from C code, and
+        significantly simplifies JIT access, since repatching no longer needs to be
+        able to change between a load of the storage pointer / a LEA of the internal
+        storage.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::repatchPointer):
+        * assembler/MIPSAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/RepatchBuffer.h:
+        * assembler/X86Assembler.h:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyObject):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        (JSC::JSObject::allocatePropertyStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSFinalObject::create):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSObject::offsetOfInlineStorage):
+        (JSC::constructEmptyObject):
+        (JSC::createEmptyObjectStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::~JSObject):
+        (JSC::Structure::isUsingInlineStorage):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::isVanilla):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StrictEvalActivation.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::growPropertyStorageCapacity):
+
+2011-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Incorrect handling of global writes in dynamic contexts
+        https://bugs.webkit.org/show_bug.cgi?id=49383
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+          Can't use the existing callframe to return an uncaught exception
+          as by definition that callframe has already been torn down.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::varDeclarations):
+        (JSC::ASTBuilder::funcDeclarations):
+        (JSC::ASTBuilder::features):
+        (JSC::ASTBuilder::numConstants):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::addVar):
+        (JSC::ASTBuilder::incConstants):
+        (JSC::ASTBuilder::usesThis):
+        (JSC::ASTBuilder::usesCatch):
+        (JSC::ASTBuilder::usesClosures):
+        (JSC::ASTBuilder::usesArguments):
+        (JSC::ASTBuilder::usesAssignment):
+        (JSC::ASTBuilder::usesWith):
+        (JSC::ASTBuilder::usesEval):
+          Don't need a vector of scopes in the ASTBuilder
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+          In strict mode the optimisation that we use to skip a lookup
+          on the global object is incorrect and lead to us always
+          disallowing global writes when we needed to do a dynamic slot
+          lookup.  Now the strict mode path actually checks for the
+          property.
+
+2011-02-15  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix for
+        https://bugs.webkit.org/show_bug.cgi?id=54415
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Remove deleted files.
+
+2011-02-15  Oliver Hunt  <oliver@apple.com>
+
+        Fix EFL build for
+        https://bugs.webkit.org/show_bug.cgi?id=54415
+
+        * CMakeLists.txt:
+
+2011-02-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Refactor handles and weak pointers to become nicer and more automatic
+        https://bugs.webkit.org/show_bug.cgi?id=54415
+
+        Move to a true handle based mechanism for GC value protection.  This
+        also allows us to switch to a more sensible behaviour for weak pointers
+        in which weak pointers are automatically updated.
+
+        This allows us to remove the old (and convoluted) that required all
+        objects that may be held by a weak reference to be aware of the reference
+        and manually clear them in their destructors.
+
+        This also adds a few new data types to JSC that we use to efficiently
+        allocate and return the underlying handle storage.
+
+        This patch is largely renaming and removing now unnecessary destructors
+        from objects.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        (OpaqueJSClass::prototype):
+        * API/JSClassRef.h:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * collector/handles/Global.h: Added.
+            New Global handle type used to keep gc objects live, even if they're not
+            marked.
+        (JSC::Global::Global):
+        (JSC::Global::~Global):
+        (JSC::Global::set):
+            We can only assign directly to a global from another global.
+            In all other cases we need the JSGlobalData to be provided
+            explicitly so we use a set function.
+        (JSC::Global::operator=):
+        (JSC::Global::clear):
+        (JSC::Global::isHashTableDeletedValue):
+        (JSC::Global::internalSet):
+        * collector/handles/Handle.h: Added.
+            Root "Handle" type used for immutable handles and to provide the basic
+            APIs needed for pointer-like behaviour.
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::operator UnspecifiedBoolType*):
+        (JSC::HandleBase::isEmpty):
+        (JSC::HandleBase::HandleBase):
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::invalidate):
+        (JSC::HandleBase::setSlot):
+        (JSC::HandleTypes::getFromSlot):
+        (JSC::HandleTypes::toJSValue):
+        (JSC::HandleTypes::validateUpcast):
+        (JSC::HandleConverter::operator->):
+        (JSC::HandleConverter::operator*):
+        (JSC::Handle::Handle):
+        (JSC::Handle::get):
+        (JSC::Handle::wrapSlot):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * collector/handles/HandleHeap.cpp: Added.
+            New heap for global handles.
+        (JSC::HandleHeap::HandleHeap):
+        (JSC::HandleHeap::grow):
+        (JSC::HandleHeap::markStrongHandles):
+        (JSC::HandleHeap::updateAfterMark):
+        (JSC::HandleHeap::clearWeakPointers):
+        (JSC::HandleHeap::writeBarrier):
+        * collector/handles/HandleHeap.h: Added.
+        (JSC::HandleHeap::heapFor):
+        (JSC::HandleHeap::toHandle):
+        (JSC::HandleHeap::toNode):
+        (JSC::HandleHeap::allocate):
+        (JSC::HandleHeap::deallocate):
+        (JSC::HandleHeap::makeWeak):
+            Convert a hard handle into weak handle that does not
+            protect the object it points to.
+        (JSC::HandleHeap::makeSelfDestroying):
+            Converts a handle to a weak handle that will be returned
+            to the free list when the referenced object dies.
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::slot):
+        (JSC::HandleHeap::Node::handleHeap):
+        (JSC::HandleHeap::Node::setFinalizer):
+        (JSC::HandleHeap::Node::makeWeak):
+        (JSC::HandleHeap::Node::isWeak):
+        (JSC::HandleHeap::Node::makeSelfDestroying):
+        (JSC::HandleHeap::Node::isSelfDestroying):
+        (JSC::HandleHeap::Node::finalizer):
+        (JSC::HandleHeap::Node::setPrev):
+        (JSC::HandleHeap::Node::prev):
+        (JSC::HandleHeap::Node::setNext):
+        (JSC::HandleHeap::Node::next):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        * interpreter/Interpreter.h:
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::globalObjectCollected):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * runtime/GCHandle.cpp: Removed.
+        * runtime/GCHandle.h: Removed.
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::allocateGlobalHandle):
+        (JSC::Heap::reportExtraMemoryCost):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::allocateGlobalHandle):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::clearEnumerationCache):
+        * runtime/Protect.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        * runtime/Structure.h:
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtrBase::get):
+        (JSC::WeakGCPtrBase::clear):
+        (JSC::WeakGCPtrBase::operator!):
+        (JSC::WeakGCPtrBase::operator UnspecifiedBoolType*):
+        (JSC::WeakGCPtrBase::~WeakGCPtrBase):
+        (JSC::WeakGCPtrBase::WeakGCPtrBase):
+        (JSC::WeakGCPtrBase::internalSet):
+        (JSC::LazyWeakGCPtr::LazyWeakGCPtr):
+        (JSC::LazyWeakGCPtr::set):
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::operator=):
+        * runtime/WriteBarrier.h:
+        * wtf/BlockStack.h: Added.
+        (WTF::::BlockStack):
+        (WTF::::~BlockStack):
+        (WTF::::blocks):
+        (WTF::::grow):
+        (WTF::::shrink):
+        * wtf/SentinelLinkedList.h: Added.
+        (WTF::::SentinelLinkedList):
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::push):
+        (WTF::::remove):
+        * wtf/SinglyLinkedList.h: Added.
+        (WTF::::SinglyLinkedList):
+        (WTF::::isEmpty):
+        (WTF::::push):
+        (WTF::::pop):
+
+2011-02-15  Pratik Solanki  <psolanki@apple.com>
+
+        Move WTF_USE_CFNETWORK to Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=54168
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Define WTF_USE_CFNETWORK for Windows builds.
+
+2011-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Moved MarkedBlock data members to the head of the block
+        https://bugs.webkit.org/show_bug.cgi?id=54482
+        
+        This allows for a variable-sized tail, to accommodate oversized blocks.
+
+        SunSpider reports no change.
+        
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate):
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * runtime/MarkedBlock.h: Added missing element to the CELLS_PER_BLOCK
+        calculation. This kind of error is why we want to migrate to the system
+        described below.
+
+        (JSC::roundUpToMultipleOf):
+        (JSC::MarkedBlock::firstCell):
+        (JSC::MarkedBlock::cells):
+        (JSC::MarkedBlock::cellNumber): Use subtraction instead of masking to
+        calculate cell number. The mask is no longer correct because the first
+        cell is not at the head of the block.
+
+        (JSC::MarkedBlock::forEach): Replaced m_cells data member with a cells()
+        accessor. We want to use sizeof(MarkedBlock) to calculate the size of the
+        block header, so we can't have an explicit data member to represent the block tail.
+        
+        Also replaced iteration from zero with iteration from startCell(), since
+        the first N cells are now occupied by the header.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::reset): Replaced iteration from zero as above.
+
+2011-02-15  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix Mutex::tryLock() on Windows to work properly with PlatformCondition::timedWait()
+        https://bugs.webkit.org/show_bug.cgi?id=54408
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::PlatformCondition::timedWait):
+
+2011-02-15  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Remove some dead code in ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=54461
+
+        * assembler/ARMv7Assembler.h: remove dead code.
+
+2011-02-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Some MarkedBlock refactoring.
+        
+        Made cells private.
+        
+        Renamed cells => m_cells
+                marked => m_marks.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate):
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::markCount):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::forEach):
+
+2011-02-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add basic parser for Content Security Policy
+        https://bugs.webkit.org/show_bug.cgi?id=54379
+
+        Add a constructor for copying a Vector into a String.  I suspect there
+        are a number of call sites that are doing this manually that would
+        benefit from being moved to this API.
+
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+
+2011-02-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: use call frame column to determine execution line in source frame.
+        https://bugs.webkit.org/show_bug.cgi?id=54001
+
+        * wtf/text/TextPosition.h:
+        (WTF::ZeroBasedNumber::convertAsOneBasedInt):
+
+2011-02-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a compile-time option to completely disable WebArchive support.
+        https://bugs.webkit.org/show_bug.cgi?id=52712
+
+        Add an ENABLE(WEB_ARCHIVE) compile-time setting and use it for all WebArchive code.
+        Ports Affected:
+            WebArchive support is currently enabled for all ports that define PLATFORM(CF) apart from Qt.
+            This patch preserves this behavior except that it also disables support in the Chromium port.
+
+        * wtf/Platform.h: Add ENABLE_WEB_ARCHIVE definition and turn it off explicitly for Qt & Chromium ports.
+
+2011-02-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 53760 - JSC fails to build with TOT Clang
+        https://bugs.webkit.org/show_bug.cgi?id=53760
+
+        Fix -Woverloaded-virtual warnings. This is also a 6% speedup on the v8 raytrace
+        benchmark; it is nothing-to-noise on everything else.
+
+        * API/JSCallbackObject.h: Remove pointlessly overloaded method.
+        * API/JSCallbackObjectFunctions.h: Ditto.
+        * runtime/Arguments.cpp: 
+        (JSC::Arguments::put): Change signature to match the base class. This implementation
+        was no longer being called by anyone. This wasn't noticed because it is merely an
+        optimization of the base class' implementation.
+        * runtime/Arguments.h: Ditto.
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Use /dev/urandom as the OSRandomSource on OS(DARWIN)
+        https://bugs.webkit.org/show_bug.cgi?id=54279
+
+        I'm not sure it makes much of a difference whether we use arc4random or
+        /dev/urandom on Mac.  However, there's some aesthetic benefit to using
+        the same underlying API on as many platforms as reasonable.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
+
+2011-02-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Kenneth Russell.
+
+        Enable ArrayBuffers by default
+        https://bugs.webkit.org/show_bug.cgi?id=54310
+
+        Export the required functions.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-11  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove explicit disable ENABLE_ASSEMBLER_WX_EXCLUSIVE on non-iOS ports
+        https://bugs.webkit.org/show_bug.cgi?id=54107
+        
+        It is unnecessary to explicitly disable ENABLE_ASSEMBLER_WX_EXCLUSIVE
+        by the definition of ENABLE().
+
+        * wtf/Platform.h:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Randomly touch some build files in the hopes of fixing the Qt build.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Garbage collection timer cycles forever, even when nothing is happening
+        https://bugs.webkit.org/show_bug.cgi?id=54320
+        
+        (Rolling back in r78386 with the build fixed.)
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger): Be sure to make
+        our timer inert after forcing a GC, to avoid GC'ing repeatedly.
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Used svn merge -r78386:78385 to roll out r78386 because it broke the build.
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Garbage collection timer cycles forever, even when nothing is happening
+        https://bugs.webkit.org/show_bug.cgi?id=54320
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger): Be sure to make
+        our timer inert after forcing a GC, to avoid GC'ing repeatedly.
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build: added an exported symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for the heap: Removed CollectorHeapIterator
+        https://bugs.webkit.org/show_bug.cgi?id=54298
+        
+        CollectorHeapIterator is a God object that knows the internals of each
+        of the pieces of the heap. This undermines the encapsulation I'm trying
+        to achieve by splitting concepts into different classes.
+        
+        As an alternative, I've given each class a forEach iteration function,
+        which takes a functor as an argument. Now, each class just needs to
+        know how to iterate the things it knows about.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed CollectorHeapIterator.
+
+        * debugger/Debugger.cpp:
+        (JSC::Recompiler::Recompiler):
+        (JSC::Recompiler::~Recompiler):
+        (JSC::Recompiler::operator()):
+        (JSC::Debugger::recompileAllJSFunctions): Updated to use forEach interface
+        instead of an iterator.
+
+        * runtime/CollectorHeapIterator.h: Removed.
+
+        * runtime/Heap.cpp:
+        (JSC::TypeCounter::TypeCounter):
+        (JSC::TypeCounter::typeName):
+        (JSC::TypeCounter::operator()):
+        (JSC::TypeCounter::take):
+        (JSC::Heap::protectedObjectTypeCounts):
+        (JSC::Heap::objectTypeCounts): Added forEach and removed iterator.
+
+        * runtime/Heap.h:
+        (JSC::Heap::forEach):
+        * runtime/JSGlobalData.cpp:
+        (JSC::Recompiler::operator()):
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::forEach): Added forEach. Removed friend declaration
+        for CollectorHeapIterator. Now, we can make all our data private and
+        change it without breaking any other classes.
+
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::forEach): Added forEach and removed iterator.
+
+2011-02-11  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        CryptographicRandomNumber has its threading ifdefs backwards
+        https://bugs.webkit.org/show_bug.cgi?id=54280
+
+        Turns out we want the mutex when thread is enabled.  :)
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
+
+2011-02-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit should have a cryptographic RNG
+        https://bugs.webkit.org/show_bug.cgi?id=22049
+
+        Teach JavaScriptCore how to export this function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more encapsulation for MarkedBlock: Made all constants private
+        so clients don't know whether allocations are fixed-sized or not
+        https://bugs.webkit.org/show_bug.cgi?id=54270
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::advance): Updated for removal of HeapConstants.
+
+        * runtime/Error.cpp: Switched to using ASSERT_CLASS_FITS_IN_CELL, like
+        all other classes.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocate): Updated for removal of HeapConstants.
+        (JSC::Heap::reset): Updated to use size(), instead of calculating size
+        on our own.
+
+        * runtime/Heap.h: Moved the ASSERT here to MarkedBlock, since it enforces
+        on special knowledge of fixed-sizery, which only MarkedBlock is supposed
+        to know about.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Updated for removal of HeapConstants.
+        Also changed to reset nextCell to 0 at the end of a block, since that
+        seems more consistent.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Changed to use a fixed array of char.
+        This hard-coded size is a little wonky, but the compiler will tell us
+        if it's ever wrong, so I think it's OK.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep): Updated for removal of HeapConstants.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::size):
+        (JSC::MarkedBlock::capacity): Made constants private to this class.
+        Removed HeapConstants. Added size() and capacity() functions.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        * runtime/MarkedSpace.h: Use MarkedBlock helper functions instead of
+        direct knowledge of MarkedBlock internals.
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more encapsulation for MarkedBlock: Made mark bits private
+        https://bugs.webkit.org/show_bug.cgi?id=54264
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::reset): Renamed clearMarkBits => clearMarks, since clients
+        don't need to know that marks are represented as bits. Renamed
+        markedCells => markCount, since clients don't need to know that blocks
+        are split into cells.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::markCount): New helper functions for encapsulating
+        the information clients actually need.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::MarkedSpace::markCount):
+        (JSC::MarkedSpace::objectCount):
+        * runtime/MarkedSpace.h: Use new helper functions instead of accessing
+        MarkedBlock data directly.
+
+2011-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Cached JavaScript Parser Data Being Left in Memory Cache
+        https://bugs.webkit.org/show_bug.cgi?id=54245
+
+        Added clear method which removes SourceProviderCache items.
+        Cleaned up extraneous whitespace.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * parser/SourceProviderCache.cpp:
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::clear):
+        (JSC::SourceProviderCache::byteSize):
+        (JSC::SourceProviderCache::add):
+        * parser/SourceProviderCache.h:
+
+2011-02-10  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Follow-up fix to r78291. I should pass (int) 0, not '0' to memset. 
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::commonConstructor): fix mistaken post-review change.
+
+2011-02-10  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Make DefaultGCActivityCallback for PLATFORM(CF) Easier to Subclass
+        https://bugs.webkit.org/show_bug.cgi?id=54257
+
+        A subclass may want to specify the CFRunLoop that the Garbage Collection
+        will happen on. It was difficult to manipulate this in a subclass because
+        the current DefaultGCActivityCallback class does this in its constructor.
+        This patch generalizes things a bit more so that a specific run loop can
+        be passed in to the constructor. This makes it so all run loop management
+        can stay in DefaultGCActivityCallback and a subclass can specify any runloop.
+
+        * runtime/GCActivityCallback.h: expose a PLATFORM(CF) constructor that can
+        specify the runloop GC can be scheduled on.
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): two constructors,
+        one that specifies the run loop and passes that on to commonConstructor and
+        the old constructor defaults to the current run loop.
+        (JSC::DefaultGCActivityCallback::commonConstructor): do normal construction,
+        adding the timer to the given runloop.
+
+2011-02-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for MarkedBlock: Moved allocate() and sweep() into MarkedBlock
+        https://bugs.webkit.org/show_bug.cgi?id=54253
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h: Removed DeadObjectIterator, since it
+        is now unused.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Moved the call to shrink() here, since it seems a
+        little more clear for MarkedSpace's client to tell it explicitly when to
+        shrink.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Split out from MarkedSpace::allocate.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep): Split out from MarkedSpace::sweep, and
+        converted to more directly iterate a MarkedBlock based on knowing its
+        internal structure.
+
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        * runtime/MarkedSpace.h: Split out the code mentioned above.
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix compilation error on OpenBSD
+        https://bugs.webkit.org/show_bug.cgi?id=53766
+
+        Add a HAVE_STRNSTR in Platform.h and define it only on Darwin and FreeBSD.
+
+        * wtf/Platform.h:
+        * wtf/StringExtras.h: Use HAVE(STRNSTR) now.
+
+2011-02-10  Adam Roben  <aroben@apple.com>
+
+        Print locations of assertions and logs in a way that Visual Studio understands
+
+        With this change, double-clicking one of these locations in Visual Studio's Output Window
+        will focus that line of code in the editor.
+
+        Fixes <http://webkit.org/b/54208> Double-clicking locations of assertions/logs in Visual
+        Studio's Output Window does nothing
+
+        Reviewed by Alexey Proskuryakov.
+
+        * wtf/Assertions.cpp:
+        (printCallSite): Use OS(WINDOWS) instead of the meaningless OS(WIN). When we aren't using
+        the debug CRT (and thus can't call _CrtDbgReport), print the file and line number using the
+        same format that cl.exe uses when it prints compiler errors.
+
+2011-02-10  Dan Bernstein  <mitz@apple.com>
+
+        LLVM Compiler build fix.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+
+2011-02-10  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Remove PCRE source from trunk
+        https://bugs.webkit.org/show_bug.cgi?id=54188
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.order:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * pcre/AUTHORS: Removed.
+        * pcre/COPYING: Removed.
+        * pcre/dftables: Removed.
+        * pcre/pcre.h: Removed.
+        * pcre/pcre.pri: Removed.
+        * pcre/pcre_compile.cpp: Removed.
+        * pcre/pcre_exec.cpp: Removed.
+        * pcre/pcre_internal.h: Removed.
+        * pcre/pcre_tables.cpp: Removed.
+        * pcre/pcre_ucp_searchfuncs.cpp: Removed.
+        * pcre/pcre_xclass.cpp: Removed.
+        * pcre/ucpinternal.h: Removed.
+        * pcre/ucptable.cpp: Removed.
+        * wscript:
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add randomValuesFromOS for OS(WINDOWS)
+        https://bugs.webkit.org/show_bug.cgi?id=54155
+
+        Use CryptGenRandom for generating cryptographically secure random numbers.
+        This will work on WinCE and MinGW too.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-10  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION(r78149): Return value of read() shouldn't be ignored.
+        https://bugs.webkit.org/show_bug.cgi?id=54167
+        
+        stdio read should have its return value handled. Build error in gcc 4.4.5.
+
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename randomValuesFromOS to cryptographicallyRandomValuesFromOS
+        https://bugs.webkit.org/show_bug.cgi?id=54156
+
+        randomValuesFromOS generates random numbers of cryptographic quality.
+        Make this clear by adding "cryptographically" to the function name.
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::stir):
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
+        * wtf/OSRandomSource.h:
+
+2011-02-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8805364> Malloc zone enumeration code should be safe in the face of errors from the memory reader.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::recordAdministrativeRegions): Use the new helper function to walk the linked list safely.
+        (WTF::TCMalloc_ThreadCache_FreeList::enumerateFreeObjects): Ditto.
+        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Ditto.
+        (WTF::TCMallocStats::PageMapFreeObjectFinder::visit): Bail out if the span could not be read.
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::visit): Ditto.
+        * wtf/MallocZoneSupport.h:
+        (WTF::RemoteMemoryReader::operator()): Remove an assert that is not valid.
+        (WTF::RemoteMemoryReader::nextEntryInLinkedList): Add a helper function for retrieving the next entry in
+        a linked list. It maps a failed read of the remote memory in to a null pointer, which all callers can
+        handle gracefully.
+
+2011-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 54164 - Optimize global_var accesses on JSVALUE64
+
+        Directly embed the pointer to d->registers, optimize out the load
+        from the variable object, as we do already in JSVALUE32_64.
+
+        This is a ~1.5% win on sunspidey.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little more encapsulation for MarkedBlock: Made MarkedBlock responsible
+        for its own initialization and destruction
+        https://bugs.webkit.org/show_bug.cgi?id=54137
+
+        * runtime/CollectorHeapIterator.h: Removed ObjectIterator since it is
+        now unused.
+
+        * runtime/JSCell.h: Maded MarkedBlock a friend so it can construct and
+        destruct JSCells.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock): Migrated initialization and destruction
+        code from MarkedSpace, updating it not to use ObjectIterator. We don't
+        want to use an abstract iterator since iteration will be unique to each
+        block in the future.
+
+        * runtime/MarkedBlock.h: Made the consructor private and moved it into
+        the .cpp file because it's big now.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock): Migrated code.
+
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::collectorBlock): Keep a vector of MarkedBlock
+        pointers instead of aligned allocations -- how MarkedBlocks are allocated
+        is now an implementation detail of MarkedBlock.
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Another attempt to fix the Qt Windows build.
+
+        * config.h:
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Qt Windows build.
+
+        * wtf/OSRandomSource.cpp:
+        (WTF::randomValuesFromOS):
+
+2011-02-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WTF::cryptographicallyRandomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=54083
+
+        Introduce a cryptographically strong random number generator to WTF.
+        The random number generator is based on arc4random as found in:
+
+        http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/crypt/arc4random.c?rev=1.22
+
+        I've changed to source to WebKit style and abstracted the operating
+        system interaction to OSRandomSource.  We'll use this functionality to
+        expose a cryptographically strong random number generator to
+        JavaScript.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h:
+        * wtf/CMakeLists.txt:
+        * wtf/CryptographicallyRandomNumber.cpp: Added.
+        (WTF::initMutexIfNeeded):
+        (WTF::init):
+        (WTF::addRandomData):
+        (WTF::stir):
+        (WTF::stirIfNeeded):
+        (WTF::getByte):
+        (WTF::getWord):
+        (WTF::cryptographicallyRandomNumber):
+        (WTF::cryptographicallyRandomValues):
+        * wtf/CryptographicallyRandomNumber.h: Added.
+        * wtf/OSRandomSource.cpp: Added.
+        (WTF::randomValuesFromOS):
+        * wtf/OSRandomSource.h: Added.
+        * wtf/wtf.pri:
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the build.
+
+        * wtf/Bitmap.h: Include string.h for memset. Not sure why this started
+        failing now.
+
+2011-02-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A tiny bit of encapsulation for MarkedBlock: made its heap data member private
+        https://bugs.webkit.org/show_bug.cgi?id=54129
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::heap): Made the heap data member private, and provided
+        a constructor and an accessor.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::heap): Use the constructor and accessor.
+
+2011-02-09  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Added.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed some dead code from Heap
+        https://bugs.webkit.org/show_bug.cgi?id=54064
+
+        * runtime/MarkedSpace.cpp: Removed some now-unused constants and
+        declarations.
+
+        (JSC::MarkedSpace::allocate): Removed some ASSERTs that are also ASSERTed
+        by our caller. Removed redundant typedefs.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use a vector to track blocks in the Heap, instead of hand-rolled vector-like code
+        https://bugs.webkit.org/show_bug.cgi?id=54062
+        
+        SunSpider reports no change.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::isValid):
+        (JSC::CollectorHeapIterator::isLive): Updated for new mark invariant: To
+        know if an object is live, you just need to test its mark bit.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace): Moved waterMark and highWaterMark from
+        CollectorHeap into MarkedSpace, since they're global state. Removed call
+        to memset since CollectorHeap is a true class with its own constructor now.
+
+        (JSC::MarkedSpace::destroy): Change uses of m_heap.usedBlocks to
+        m_heap.blocks.size(), and m_heap.numBlocks to m_heap.blocks.capacity().
+
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock): No need to manage our vector manually anymore.
+
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearMarkBits):
+        (JSC::MarkedSpace::markedCells):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::capacity):
+        (JSC::MarkedSpace::reset):
+        (JSC::MarkedSpace::primaryHeapEnd):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap):
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark):
+        (JSC::MarkedSpace::contains): Same as above.
+
+2011-02-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Give each MarkedBlock enough mark bits to cover the whole block
+        https://bugs.webkit.org/show_bug.cgi?id=54029
+        
+        SunSpider reports no change.
+
+        This simplifies access to mark bits, since any cell-aligned pointer
+        into a block now has a valid mark bit to test.
+        
+        * runtime/MarkedBlock.h: Changed CELLS_PER_BLOCK to account for the extra
+        mark bits. This happens not to change its actual value.
+        (JSC::MarkedBlock::cellNumber):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked): Changed const JSCell* to const void* to
+        remove a cast from our caller, and to more accurately reflect the fact
+        that MarkedBlock is agnostic about the types pointed to by the pointers
+        you pass to it.
+
+        (JSC::MarkedBlock::isPossibleCell): Removed a null check. We now consider
+        the null pointer to be a possible cell with a 0 (impossible) block. This
+        removes a null check from marking.
+
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Simplified the contains check, and inlined
+        the whole thing, now that it's so simple.
+
+2011-02-08  Daniel Bates  <dbates@rim.com>
+
+        Rubber-stamped by Martin Robinson.
+
+        Rename enum ProtectionSeting [sic] to ProtectionSetting.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        * jit/ExecutableAllocator.h:
+
+2011-02-08  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Should not always define USE_SYSTEM_MALLOC
+        https://bugs.webkit.org/show_bug.cgi?id=54007
+
+        * wtf/Platform.h:
+
+2011-02-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        LLVM Compiler build fix.
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrier::WriteBarrier):
+
+2011-02-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        JSVariableObject::setRegisters should take PassOwnArrayPtr for registersArray.
+        https://bugs.webkit.org/show_bug.cgi?id=53902
+
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters): Uses OwnArrayPtr<Register> instead of Register*.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::copyGlobalsFrom): Ditto.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setRegisters): Takes PassOwnArrayPtr<Register> instead of Register*
+        for registerArray.
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::copyRegisterArray): Returns PassOwnArrayPtr<Register> instead of Register*.
+        (JSC::JSVariableObject::setRegisters): Takes PassOwnArrayPtr<Register> instead of Register*
+        for registerArray.
+
+2011-02-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed some dead code from Heap
+        https://bugs.webkit.org/show_bug.cgi?id=53969
+        
+        SunSpider reports no change.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::sweep):
+        * runtime/MarkedSpace.h: Removed resizeBlocks and growBlocks, and
+        renamed shrinkBlocks to shrink, making it unconditionally shrink as
+        much as possible.
+
+2011-02-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Simplified the marked space's mark invariant
+        https://bugs.webkit.org/show_bug.cgi?id=53968
+        
+        SunSpider reports no change.
+        
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate): Mark objects when allocating them. This
+        means that, at all times other than the mark phase, an object is live
+        if and only if it is marked.
+
+        (JSC::MarkedSpace::containsSlowCase): Use the new mark invariant to
+        simplify testing whether an object is live.
+
+2011-02-07  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=53950
+        USE_WK_SCROLLBAR_PAINTER in ScrollbarThemeMac should be in
+        Platform.h instead
+
+        * wtf/Platform.h:
+
+2011-02-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Add built-in decoder for UTF-8 for improved performance
+        https://bugs.webkit.org/show_bug.cgi?id=53898
+
+        * wtf/unicode/UnicodeMacrosFromICU.h: Added U8_MAX_LENGTH and
+        U8_APPEND_UNSAFE. Also fixed header.
+
+2011-02-07  Adam Roben  <aroben@apple.com>
+
+        Delete precompiled headers whenever any .vsprops file changes
+
+        Precompiled headers need to be rebuilt if, e.g., an ENABLE_* macro is changed in one of our
+        .vsprops files. Unfortunately, Visual Studio isn't smart enough to figure this out, so we
+        give it some assistance by deleting the precompiled headers whenever any .vsprops file
+        changes.
+
+        I also made some drive-by fixes while I was in the area.
+
+        Fixes <http://webkit.org/b/53826> react-to-vsprops-changes.py doesn't force precompiled
+        headers to be rebuilt, but should
+
+        Reviewed by David Kilzer.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Stop ignoring the
+        return code from react-to-vsprops-changes.py so we will notice when errors are introduced.
+        But skip the script entirely in production builds, where it is both unnecessary and can't
+        function correctly (due to not having the entire source tree available to it).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Removed an extra '*' in the glob for finding manifest files. The extra '*' was
+        leftover from before we rearranged WebKitBuild in r75138. Moved code to delete an old file
+        to the new delete_if_older_than function. Added code to delete any precompiled headers older
+        than the newest .vsprops file.
+        (delete_if_older_than): Added. Code came from main.
+
+2011-02-07  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+        
+        ASSERTS_DISABLED -> ASSERT_DISABLED
+
+        * wtf/BloomFilter.h:
+
+2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed; speculative Qt build fix.
+
+        * JavaScriptCore.pro:
+
+2011-02-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        OwnArraryPtr.h uses deleteOwnedPtr but doesn’t include OwnPtrCommon.h
+        https://bugs.webkit.org/show_bug.cgi?id=52867
+
+        Removed LOOSE_OWN_ARRAY_PTR and OwnArrayPtr<T>::set. Replaced all calls to OwnArrayPtr::set
+        and loose instantiation of OwnArrayPtr by calls to operator= and adoptArrayPtr. Also removed
+        OwnArrayPtrCommon.h since PassOwnArrayPtr.h needs to include OwnArrayPtr.h and there is
+        no point in putting deleteOwnedArrayPtr into a separate header.
+        
+        Note: if this patch breaks build, the code is either instiantiating OwnArrayPtr
+        without calling adoptArrayPtr or calling set on ArrayOwnPtr instead of operator=.
+
+        No tests are added since this is a refactoring.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString): Calls adoptArrayPtr.
+        * GNUmakefile.am: Removed OwnArrayPtrCommon.h
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deleteProperty): Calls adoptArrayPtr.
+        * runtime/Arguments.h:
+        (JSC::Arguments::copyRegisters): Ditto.
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Ditto.
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::setRegisters): Calls operator= instead of set.
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain): Ditto.
+        * wtf/CMakeLists.txt:
+        * wtf/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime): No longer instnatiates OwnArrayPtr
+        with a null pointer.
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnArrayPtrCommon.h: Removed.
+        * wtf/PassOwnArrayPtr.h: No longer includes OwnArrayCommon.h
+        (WTF::deleteOwnedArrayPtr): Moved from OwnArrayPtrCommon.h
+
+2011-02-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Use bloom filter for descendant selector filtering
+        https://bugs.webkit.org/show_bug.cgi?id=53880
+        
+        Implement a bloom filter with k=2 and 8 bit counting.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/BloomFilter.h: Added.
+        (WTF::BloomFilter::maximumCount):
+        (WTF::BloomFilter::BloomFilter):
+        (WTF::BloomFilter::mayContain):
+        (WTF::BloomFilter::add):
+        (WTF::BloomFilter::remove):
+        (WTF::BloomFilter::firstSlot):
+        (WTF::BloomFilter::secondSlot):
+        (WTF::::add):
+        (WTF::::remove):
+        (WTF::::clear):
+        (WTF::::likelyEmpty):
+        (WTF::::isClear):
+
+2011-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in r77612 with ASSERT/crash fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=53759
+        
+        Don't shrink the heap to 0 unconditionally. Instead, shrink to 1 if
+        necessary. For now, the heap assumes that it always has at least one
+        block live.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::shrinkBlocks):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark):
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: REALLY remove the last vestiges of JSVALUE32!
+
+        <rdar://problem/8957409> Remove last vestiges of JSVALUE32
+        <http://webkit.org/b/53779>
+
+        * DerivedSources.make: Removed dependency on
+        JavaScriptCore.JSVALUE32.exp.
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/8957409> Remove last vestiges of JSVALUE32
+        <http://webkit.org/b/53779>
+
+        Reviewed by Darin Adler.
+
+        Support for JSVALUE32 was originaly removed in r70111.
+
+        * Configurations/JavaScriptCore.xcconfig: Changed armv6 to use
+        JavaScriptCore.JSVALUE32_64.exp and ppc64 to use
+        JavaScriptCore.JSVALUE64.exp to match Platform.h.
+        * DerivedSources.make: Removed rule for
+        JavaScriptCore.JSVALUE32.exp.
+        * JavaScriptCore.JSVALUE32only.exp: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed references
+        to JavaScriptCore.JSVALUE32only.exp.
+
+2011-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        Use static_cast and other style cleanup in YarrInterpreter.cpp
+        <http://webkit.org/b/53772>
+
+        Reviewed by John Sullivan.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::InputStream::readChecked): Use
+        static_cast.
+        (JSC::Yarr::Interpreter::InputStream::checkInput): Remove
+        unnecessary else block.
+        (JSC::Yarr::Interpreter::matchAssertionEOL): Ditto.
+        (JSC::Yarr::Interpreter::backtrackBackReference): Ditto.
+        (JSC::Yarr::ByteCompiler::emitDisjunction): Use static_cast.
+
+2011-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77625 and r77626.
+        http://trac.webkit.org/changeset/77625
+        http://trac.webkit.org/changeset/77626
+        https://bugs.webkit.org/show_bug.cgi?id=53765
+
+        It broke Windows builds (Requested by Ossy_ on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Removed.
+
+2011-02-04  Jessie Berlin  <jberlin@apple.com>
+
+        Windows build fix. Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2011-02-04  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace PCRE with Yarr in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=53496
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_regex_tables:
+        * runtime/RegExp.cpp:
+        * wtf/Platform.h:
+        * yarr/Yarr.h:
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        * yarr/YarrSyntaxChecker.h:
+        * yarr/yarr.pri: Added.
+
+2011-02-04  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed rollout two patches r77614 and r77612.
+
+        REGRESSION: Snow Leopard Intel Release anumber of failing tests.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+
+2011-02-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix 32bit build.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Use an explicit cast to avoid shortening warnings,
+        since 1.5 is double (64bit), and the result is size_t (32bit).
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Changed MarkedSpace to delegate grow/shrink decisions to Heap
+        https://bugs.webkit.org/show_bug.cgi?id=53759
+        
+        SunSpider reports no change.
+        
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        * runtime/Heap.h: Reorganized a few data members for better cache locality.
+        Added a grow policy.
+        
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::reset): Don't shrink automatically. Instead, wait for
+        the heap to make an explicit sweep call.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark): Use a watermark to determine how
+        many bytes to allocate before failing and giving the heap an opportunity
+        to collect garbage. This also means that we allocate blocks on demand,
+        instead of ahead of time.
+
+2011-02-03  James Kozianski  <koz@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add navigator.registerProtocolHandler behind a flag.
+        https://bugs.webkit.org/show_bug.cgi?id=52609
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Not all blocks are freed when the heap is freed (counting is hard!)
+        https://bugs.webkit.org/show_bug.cgi?id=53732
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy): Freeing a block compacts the list, so just
+        keep freeing block 0 until there are no blocks left.
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: The new MarkedBlock.h header
+        needs to be private, not project, so other projects can include headers
+        that depend on it.
+
+2011-02-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start using MarkedBlock instead of CollectorBlock
+        https://bugs.webkit.org/show_bug.cgi?id=53693
+        
+        SunSpider reports no change.
+        
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::isPossibleCell): Updated for const-ness.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::containsSlowCase):
+        (JSC::MarkedSpace::clearMarkBits): Updated for const-ness.
+
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::collectorBlock):
+        (JSC::MarkedSpace::heap):
+        (JSC::MarkedSpace::isMarked):
+        (JSC::MarkedSpace::testAndSetMarked):
+        (JSC::MarkedSpace::setMarked):
+        (JSC::MarkedSpace::contains): Switched from CollectorBlock to MarkedBlock,
+        and deleted dead CollectorBlock-related code.
+
+2011-02-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Avoid strlen() in AtomicString::fromUTF8
+        https://bugs.webkit.org/show_bug.cgi?id=50516
+
+        Add an overload to calculateStringHashFromUTF8 to get
+        strlen() of the input data with only one call.
+
+        This change shows about 3% performance win on the xml-parser benchmark.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        oops, build fix!
+
+        * wtf/Assertions.cpp:
+
+2011-02-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 53650 - Add a BACKTRACE macro to Assertions.h
+
+        Add a BACKTRACE macro to Assertions.h, which will print a backtrace on
+        debug Mac builds, make CRASH (and thus ASSERT) automatically call this.
+
+        * JavaScriptCore.exp:
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2011-02-02  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improper backtrack of nested non-capturing greedy paren to prior paren
+        https://bugs.webkit.org/show_bug.cgi?id=53261
+
+        A paren that follows a non-capturing greedy paren nested within a 
+        non-capturing fixed paren was back tracking to the last paren 
+        processed instead of the immediately prior paren.
+        Refactored default backtracking of parens to prior paren to work for
+        both nested (within) and immediately prior (after) parens.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setJumpListToPriorParen):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getJumpListToPriorParen):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        (JSC::Yarr::YarrGenerator::generateDisjunction):
+
+2011-02-02  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Add DerivedSources.make to some Visual Studio projects
+        https://bugs.webkit.org/show_bug.cgi?id=53607
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Add DerivedSources.make.
+
+2011-02-02  Steve Lacey  <sjl@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Implement basic media statistics on media elements.
+        https://bugs.webkit.org/show_bug.cgi?id=53322
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-02-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for wxWebKit.
+
+        * wtf/wx/StringWx.cpp:
+        (WTF::String::String):
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more Heap refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=53577
+        
+        SunSpider reports no change.
+        
+        Split out MarkedBlock into its own file / class.
+        
+        Did the following renames:
+            isCellMarked => isMarked
+            checkMarkCell => testAndSetMarked
+            markCell => setMarked
+            cellOffset => cellNumber
+            collectorBlock => blockFor
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Heap.cpp:
+        (JSC::WeakGCHandlePool::update):
+        * runtime/Heap.h:
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::setMarked):
+        * runtime/JSArray.h:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::internalAppend):
+        * runtime/MarkedBlock.cpp: Added.
+        * runtime/MarkedBlock.h: Added.
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::cellNumber):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::isCellAligned):
+        (JSC::MarkedBlock::isPossibleCell):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isMarked):
+        (JSC::MarkedSpace::testAndSetMarked):
+        (JSC::MarkedSpace::setMarked):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+
+2011-02-02  Sam Weinig  <sam@webkit.org>
+
+        Fix windows clean build.
+
+        * DerivedSources.make:
+
+2011-02-02  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix dist compilation
+        https://bugs.webkit.org/show_bug.cgi?id=53579
+
+        * GNUmakefile.am: Added WriteBarrier.h to the sources, it was
+        added in r77151
+
+2011-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77297.
+        http://trac.webkit.org/changeset/77297
+        https://bugs.webkit.org/show_bug.cgi?id=53538
+
+        caused leopard crashes (Requested by paroga on #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Fix Mac production builds.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Try to fix the windows build.
+
+        * DerivedSources.make:
+
+2011-02-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Avoid strlen() in AtomicString::fromUTF8
+        https://bugs.webkit.org/show_bug.cgi?id=50516
+
+        Add an overload to calculateStringHashFromUTF8 to get
+        strlen() of the input data with only one call.
+
+        This change shows about 3% performance win on the xml-parser benchmark.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-02-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Part 2 for <rdar://problem/8492788>
+        Adopt WKScrollbarPainterController
+
+        Use header detection to define scrollbar painting controller #define.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Refactor JSGlobalObject-related tear-down
+        https://bugs.webkit.org/show_bug.cgi?id=53478
+        
+        While investigating crashes caused by r77082, I noticed some strange
+        destructor-time behaviors. This patch makes them less strange.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::GlobalCodeBlock::~GlobalCodeBlock): Store the set of global code
+        blocks on the Heap, instead of on independent global objects. The heap
+        is guaranteed to outlast any GC-owned data structure. The heap is also
+        a natural place to store objects that needs out-of-band marking, since
+        the heap is responsible for marking all roots.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::protectedGlobalObjectCount):
+        * runtime/Heap.h:
+        (JSC::Heap::codeBlocks):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/MarkedSpace.cpp: Store the set of global objects in a weak map
+        owned by JSGlobalData, instead of an instrusive circular linked list.
+        This is simpler, and it avoids destructor-time access between garbage
+        collected objects, which is hard to get right.
+
+        (JSC::MarkedSpace::destroy): Make sure to clear mark bits before tearing
+        everything down. Otherwise, weak data structures will incorrectly report
+        that objects pending destruction are still alive.
+
+2011-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION(77082): GC-related crashes seen: on WebKit2 bot; on GTK 32bit
+        bot; loading trac pages; typing in search field
+        https://bugs.webkit.org/show_bug.cgi?id=53519
+        
+        The crashes were all caused by failure to run an object's destructor.
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::ObjectIterator::ObjectIterator): Don't skip forward upon
+        construction. The iterator class used to do that when it was designed
+        for prior-to-beginning initialization. I forgot to remove this line
+        of code when I changed the iterator to normal initialization.
+        
+        Skipping forward upon construction was causing the heap to skip running
+        the destructor for the very first object in a block when destroying the
+        block. This usually did not crash, since block destruction is rare and
+        most objects have pretty trivial destructors. However, in the rare case
+        when the heap would destroy a block whose first object was a global
+        object or a DOM node, BOOM.
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Update JSObject storage for new marking API
+        https://bugs.webkit.org/show_bug.cgi?id=53467
+
+        JSObject no longer uses EncodedJSValue for its property storage.
+        This produces a stream of mechanical changes to PropertySlot and
+        anonymous storage APIs.
+
+        * JavaScriptCore.exp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::putAnonymousValue):
+        (JSC::JSObject::clearAnonymousValue):
+        (JSC::JSObject::getAnonymousValue):
+        (JSC::JSObject::putThisToAnonymousValue):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setRegisterSlot):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+
+2011-02-01  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Antonio Gomes.
+
+        Modify RandomNumberSeed.h to use USE(MERSENNE_TWISTER_19937)
+        https://bugs.webkit.org/show_bug.cgi?id=53506
+
+        Currently, use of the Mersenne Twister pseudorandom number generator
+        is hardcoded to the Windows CE port. With the passing of bug #53253,
+        we can generalize support for this PRNG to all ports that use srand(3)
+        and rand(3), including Windows CE.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2011-02-01  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        MacroAssemblerARM would generate code that did 32bit loads
+        on addresses that were not aligned. More specifically it would
+        generate a ldr r8,[r1, #7] which isn't valid on ARMv5 and lower.
+        The intended instruction really is ldrb r8,[r1, #7]; ensure we
+        call load8 instead of load32.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46095
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::set32Test32):
+        (JSC::MacroAssemblerARM::set32Test8):
+
+2011-02-01  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix some Visual Studio compiler warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=53476
+
+        * wtf/MathExtras.h:
+        (clampToInteger):
+        (clampToPositiveInteger):
+        * wtf/ThreadingWin.cpp:
+        (WTF::absoluteTimeToWaitTimeoutInterval):
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bogus callframe during stack unwinding
+        https://bugs.webkit.org/show_bug.cgi?id=53454
+
+        Trying to access a callframe's globalData after destroying its
+        ScopeChain is not a good thing.  While we could access the
+        globalData directly through the (known valid) scopechain we're
+        holding on to, it feels fragile.  Instead we push the valid
+        ScopeChain onto the callframe again to ensure that the callframe
+        itself remains valid.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+
+2011-01-31  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Reapplying this change again.
+        Changed isValid() to use .get() as a result of change r77151.
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        rolling r77098, r77099, r77100, r77109, and
+        r77111 back in, along with a few more Qt fix attempts.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::internalAppend):
+        (JSC::JSCell::MarkStack::deprecatedAppend):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::clear):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-31  Dan Winship  <danw@gnome.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        wss (websockets ssl) support for gtk via new gio TLS support
+        https://bugs.webkit.org/show_bug.cgi?id=50344
+
+        Add a GPollableOutputStream typedef for TLS WebSockets support
+
+        * wtf/gobject/GTypedefs.h:
+
+2011-01-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53352
+        Heavy external fragmentation in FixedVMPoolAllocator can lead to a CRASH().
+
+        The FixedVMPoolAllocator currently uses a best fix policy -
+        switch to first fit, this is less prone to external fragmentation.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::AllocationTableSizeClass::AllocationTableSizeClass):
+        (JSC::AllocationTableSizeClass::blockSize):
+        (JSC::AllocationTableSizeClass::blockCount):
+        (JSC::AllocationTableSizeClass::blockAlignment):
+        (JSC::AllocationTableSizeClass::size):
+        (JSC::AllocationTableLeaf::AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::~AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::allocate):
+        (JSC::AllocationTableLeaf::free):
+        (JSC::AllocationTableLeaf::isEmpty):
+        (JSC::AllocationTableLeaf::isFull):
+        (JSC::AllocationTableLeaf::size):
+        (JSC::AllocationTableLeaf::classForSize):
+        (JSC::AllocationTableLeaf::dump):
+        (JSC::LazyAllocationTable::LazyAllocationTable):
+        (JSC::LazyAllocationTable::~LazyAllocationTable):
+        (JSC::LazyAllocationTable::allocate):
+        (JSC::LazyAllocationTable::free):
+        (JSC::LazyAllocationTable::isEmpty):
+        (JSC::LazyAllocationTable::isFull):
+        (JSC::LazyAllocationTable::size):
+        (JSC::LazyAllocationTable::dump):
+        (JSC::LazyAllocationTable::classForSize):
+        (JSC::AllocationTableDirectory::AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::~AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::allocate):
+        (JSC::AllocationTableDirectory::free):
+        (JSC::AllocationTableDirectory::isEmpty):
+        (JSC::AllocationTableDirectory::isFull):
+        (JSC::AllocationTableDirectory::size):
+        (JSC::AllocationTableDirectory::classForSize):
+        (JSC::AllocationTableDirectory::dump):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::allocated):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::classForSize):
+        (JSC::FixedVMPoolAllocator::offsetToPointer):
+        (JSC::FixedVMPoolAllocator::pointerToOffset):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::committed):
+
+2011-01-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76969.
+        http://trac.webkit.org/changeset/76969
+        https://bugs.webkit.org/show_bug.cgi?id=53418
+
+        "It is causing crashes in GTK+ and Leopard bots" (Requested by
+        alexg__ on #webkit).
+
+        * runtime/WeakGCMap.h:
+
+2011-01-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r77098, r77099, r77100, r77109, and
+        r77111.
+        http://trac.webkit.org/changeset/77098
+        http://trac.webkit.org/changeset/77099
+        http://trac.webkit.org/changeset/77100
+        http://trac.webkit.org/changeset/77109
+        http://trac.webkit.org/changeset/77111
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        Qt build is broken
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        (JSC::JSCell::MarkStack::append):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Removed.
+
+2011-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix the build fix. I assume Oliver meant m_cell, not m_value.
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::clear):
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        More Qt build fixes
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::clear):
+
+2011-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        rolling r77006 and r77020 back in.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::internalAppend):
+        (JSC::JSCell::MarkStack::deprecatedAppend):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Filter all Heap collection through a common reset function, in
+        preparation for adding features triggered by collection.
+        https://bugs.webkit.org/show_bug.cgi?id=53396
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): When we're over the extraCost
+        limit, just call collectAllGarbage() instead of rolling our own special
+        way of resetting the heap. In theory, this may be slower in some cases,
+        but it also fixes cases of pathological heap growth that we've seen,
+        where the only objects being allocated are temporary and huge
+        (<rdar://problem/8885843>).
+
+        (JSC::Heap::allocate):
+        (JSC::Heap::collectAllGarbage): Use the shared reset function.
+
+        (JSC::Heap::reset):
+        * runtime/Heap.h: Carved a new shared reset function out of the old
+        collectAllGarbage.
+
+2011-01-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77025.
+        http://trac.webkit.org/changeset/77025
+        https://bugs.webkit.org/show_bug.cgi?id=53401
+
+        It made js1_5/Regress/regress-159334.js fail on 64 bit Linux
+        (Requested by Ossy on #webkit).
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FreeListEntry::FreeListEntry):
+        (JSC::AVLTreeAbstractorForFreeList::get_less):
+        (JSC::AVLTreeAbstractorForFreeList::set_less):
+        (JSC::AVLTreeAbstractorForFreeList::get_greater):
+        (JSC::AVLTreeAbstractorForFreeList::set_greater):
+        (JSC::AVLTreeAbstractorForFreeList::get_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::set_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::null):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_key):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_node):
+        (JSC::AVLTreeAbstractorForFreeList::compare_node_node):
+        (JSC::reverseSortFreeListEntriesByPointer):
+        (JSC::reverseSortCommonSizedAllocations):
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::FixedVMPoolAllocator::addToCommittedByteCount):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::maybeModifyVMPoolSize):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+
+2011-01-30  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Daniel Bates.
+
+        Code style issue in JavaScriptCore/wtf/CurrentTime.h
+        https://bugs.webkit.org/show_bug.cgi?id=53394
+
+        According to rule #3 at http://webkit.org/coding/coding-style.html,
+        This patch fix style issue in CurrentTime.h.
+
+        No functionality change, no new tests.
+
+        * wtf/CurrentTime.h:
+        (WTF::currentTimeMS):
+        (WTF::getLocalTime):
+
+2011-01-30  Benjamin Poulain  <ikipou@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] JavaScriptCore does not link on Mac if building WebKit 2
+        https://bugs.webkit.org/show_bug.cgi?id=53377
+
+        The option "-whole-archive" is not availabe with the libtool of Mac OS X,
+        instead, we can use "-all_load" on Mac.
+
+        * JavaScriptCore.pri:
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Sorry Leopard bot -- I committed a change by accident.
+
+        * JavaScriptCore.exp: You may have your symbols back now.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Simplified Heap iteration
+        https://bugs.webkit.org/show_bug.cgi?id=53393
+
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::isValid):
+        (JSC::CollectorHeapIterator::isLive):
+        (JSC::CollectorHeapIterator::advance): Removed "max" argument to
+        advance because it's a constant.
+        (JSC::LiveObjectIterator::LiveObjectIterator):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::DeadObjectIterator):
+        (JSC::DeadObjectIterator::operator++):
+        (JSC::ObjectIterator::ObjectIterator):
+        (JSC::ObjectIterator::operator++): Factored out common checks into
+        two helper functions -- isValid() for "Am I past the end?" and isLive()
+        for "Is the cell I'm pointing to live?".
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::sweep): Always sweep from the beginning of the heap
+        to the end, to avoid making sweep subtly reliant on internal Heap state.
+        (JSC::MarkedSpace::primaryHeapBegin):
+        (JSC::MarkedSpace::primaryHeapEnd): Always be explicit about where
+        iteration begins.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Simplified heap destruction
+        https://bugs.webkit.org/show_bug.cgi?id=53392
+
+        * JavaScriptCore.exp:
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        * runtime/Heap.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        * runtime/MarkedSpace.h: Don't go out of our way to destroy GC-protected
+        cells last -- the difficult contortions required to do so just don't seem
+        justified. We make no guarantees about GC protection after the client
+        throws away JSGlobalData, and it doesn't seem like any meaningful
+        guarantee is even possible.
+
+2011-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Switched heap to use the Bitmap class and removed CollectorBitmap
+        https://bugs.webkit.org/show_bug.cgi?id=53391
+        
+        SunSpider says 1.005x as fast. Seems like a fluke.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocate): Updated for rename and returning a value
+        rather than taking a value by reference.
+
+        * runtime/MarkedSpace.h: Code reuse is good.
+
+        * wtf/Bitmap.h:
+        (WTF::::testAndSet): Added, since this is the one thing Bitmap was missing
+        which CollectorBitmap had. (Renamed from the less conventional "getset".)
+
+        (WTF::::nextPossiblyUnset): Renamed and changed to return a value for
+        clarity. It's all the same with inlining.
+
+2011-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Some more Heap cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=53357
+        
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated exported symbols.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): Renamed recordExtraCost to 
+        reportExtraMemoryCostSlowCase to match our naming conventions.
+
+        (JSC::Heap::capacity): Renamed size to capacity because this function
+        returns the capacity of the heap, including unused portions.
+
+        * runtime/Heap.h:
+        (JSC::Heap::globalData):
+        (JSC::Heap::markedSpace):
+        (JSC::Heap::machineStackMarker):
+        (JSC::Heap::reportExtraMemoryCost): Moved statics to the top of the file.
+        Moved ctor and dtor to the beginning of the class definition. Grouped
+        functions by purpose.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::capacity): Renamed size to capacity because this
+        function returns the capacity of the heap, including unused portions.
+
+        * runtime/MarkedSpace.h: Removed statistics and the Statistics class because
+        the same information can be gotten just by calling size() and capacity().
+
+        * runtime/MemoryStatistics.cpp:
+        * runtime/MemoryStatistics.h: Ditto.
+
+2011-01-29  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move wince/mt19937ar.c to ThirdParty and make it a policy choice
+        https://bugs.webkit.org/show_bug.cgi?id=53253
+
+        Make inclusion of MT19937 a policy decision.
+
+        Currently, we hardcoded to  use MT19937 when building for
+        Windows CE. Instead, we should make this a policy decision
+        with the Windows CE port using this by default.
+
+        * JavaScriptCore.pri: Append Source/ThirdParty to the end
+        of the list include directories.
+        * wtf/CMakeLists.txt: Ditto.
+        * wtf/Platform.h: Defined WTF_USE_MERSENNE_TWISTER_19937 when
+        building for Windows CE.
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Substituted USE(MERSENNE_TWISTER_19937) for OS(WINCE).
+
+2011-01-29  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Bug 53374 - Remove uses of unsafe string functions in debugging code
+        https://bugs.webkit.org/show_bug.cgi?id=53374
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::printTraceData):
+
+2011-01-29  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JavaScriptCoreUseJIT environment variable broken
+        https://bugs.webkit.org/show_bug.cgi?id=53372
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Check the actual value in the string returned
+        by getenv() rather than just doing a NULL check on the return value.
+
+2011-01-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Move CharacterNames.h into WTF directory
+        https://bugs.webkit.org/show_bug.cgi?id=49618
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/unicode/CharacterNames.h: Renamed from WebCore/platform/text/CharacterNames.h.
+        * wtf/unicode/UTF8.cpp:
+
+2011-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add various clampToInt() methods to MathExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=52910
+        
+        Add functions for clamping doubles and floats to valid int
+        ranges, for signed and positive integers.
+
+        * wtf/MathExtras.h:
+        (clampToInteger):
+        (clampToPositiveInteger):
+
+2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r77006 and r77020.
+        http://trac.webkit.org/changeset/77006
+        http://trac.webkit.org/changeset/77020
+        https://bugs.webkit.org/show_bug.cgi?id=53360
+
+        "Broke Windows tests" (Requested by rniwa on #webkit).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        (JSC::JSCell::MarkStack::append):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::isValid):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Removed.
+
+2011-01-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53352
+        Heavy external fragmentation in FixedVMPoolAllocator can lead to a CRASH().
+
+        The FixedVMPoolAllocator currently uses a best fix policy -
+        switch to first fit, this is less prone to external fragmentation.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::AllocationTableSizeClass::AllocationTableSizeClass):
+        (JSC::AllocationTableSizeClass::blockSize):
+        (JSC::AllocationTableSizeClass::blockCount):
+        (JSC::AllocationTableSizeClass::blockAlignment):
+        (JSC::AllocationTableSizeClass::size):
+        (JSC::AllocationTableLeaf::AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::~AllocationTableLeaf):
+        (JSC::AllocationTableLeaf::allocate):
+        (JSC::AllocationTableLeaf::free):
+        (JSC::AllocationTableLeaf::isEmpty):
+        (JSC::AllocationTableLeaf::isFull):
+        (JSC::AllocationTableLeaf::size):
+        (JSC::AllocationTableLeaf::classForSize):
+        (JSC::AllocationTableLeaf::dump):
+        (JSC::LazyAllocationTable::LazyAllocationTable):
+        (JSC::LazyAllocationTable::~LazyAllocationTable):
+        (JSC::LazyAllocationTable::allocate):
+        (JSC::LazyAllocationTable::free):
+        (JSC::LazyAllocationTable::isEmpty):
+        (JSC::LazyAllocationTable::isFull):
+        (JSC::LazyAllocationTable::size):
+        (JSC::LazyAllocationTable::dump):
+        (JSC::LazyAllocationTable::classForSize):
+        (JSC::AllocationTableDirectory::AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::~AllocationTableDirectory):
+        (JSC::AllocationTableDirectory::allocate):
+        (JSC::AllocationTableDirectory::free):
+        (JSC::AllocationTableDirectory::isEmpty):
+        (JSC::AllocationTableDirectory::isFull):
+        (JSC::AllocationTableDirectory::size):
+        (JSC::AllocationTableDirectory::classForSize):
+        (JSC::AllocationTableDirectory::dump):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::allocated):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::classForSize):
+        (JSC::FixedVMPoolAllocator::offsetToPointer):
+        (JSC::FixedVMPoolAllocator::pointerToOffset):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::committed):
+
+2011-01-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Convert markstack to a slot visitor API
+        https://bugs.webkit.org/show_bug.cgi?id=53219
+
+        Move the MarkStack over to a slot based marking API.
+
+        In order to avoiding aliasing concerns there are two new types
+        that need to be used when holding on to JSValues and JSCell that
+        need to be marked: WriteBarrier and DeprecatedPtr.  WriteBarrier
+        is expected to be used for any JSValue or Cell that's lifetime and
+        marking is controlled by another GC object.  DeprecatedPtr is used
+        for any value that we need to rework ownership for.
+
+        The change over to this model has produced a large amount of
+        code changes, but they are mostly mechanical (forwarding JSGlobalData,
+        etc).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::markChildren):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrivateProperty):
+        * API/JSWeakObjectMapRefInternal.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::markChildren):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Register.h:
+        (JSC::Register::jsValueSlot):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeSet::mark):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::markChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::getter):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setter):
+        (JSC::GetterSetter::setSetter):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        (JSC::GlobalEvalFunction::markChildren):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::cachedGlobalObject):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::value):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append):
+        (JSC::JSCell::MarkStack::appendCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::regExpConstructor):
+        (JSC::JSGlobalObject::errorConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::evalFunction):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::methodCallDummy):
+        (JSC::constructArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::Holder::objectSlot):
+        (JSC::Stringifier::markAggregate):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSValue::putDirect):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::markChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MarkStack.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::resolveBase):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChain::top):
+        * runtime/ScopeChainMark.h:
+        (JSC::ScopeChain::markAggregate):
+        * runtime/SmallStrings.cpp:
+        (JSC::isMarked):
+        (JSC::SmallStrings::markChildren):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototypeSlot):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::uncheckedGet):
+        (JSC::WeakGCMap::uncheckedGetSlot):
+        (JSC::::get):
+        (JSC::::take):
+        (JSC::::set):
+        (JSC::::uncheckedRemove):
+        * runtime/WriteBarrier.h: Added.
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::operator==):
+
+2011-01-28  Adam Roben  <aroben@apple.com>
+
+        Chromium build fix after r76967
+
+        * wtf/ThreadingPrimitives.h: Use OS(WINDOWS) instead of PLATFORM(WIN), to match other
+        similar macros in this file.
+
+2011-01-28  Michael Saboff  <msaboff@apple.com>
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Reapplying this this change.  No change from prior patch in
+        JavaScriptCore.
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-27  Adam Roben  <aroben@apple.com>
+
+        Extract code to convert a WTF absolute time to a Win32 wait interval into a separate
+        function
+
+        Fixes <http://webkit.org/b/53208> <rdar://problem/8922490> BinarySemaphore should wrap a
+        Win32 event
+
+        Reviewed by Dave Hyatt.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export the new function.
+
+        * wtf/ThreadingPrimitives.h: Declare the new function.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait): Moved code to convert the absolute time to a wait
+        interval from here...
+        (WTF::absoluteTimeToWaitTimeoutInterval): ...to here.
+
+2011-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add basic rubber banding support
+        <rdar://problem/8219429>
+        https://bugs.webkit.org/show_bug.cgi?id=53277
+
+        * wtf/Platform.h: Add ENABLE for rubber banding.
+
+2011-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r76893.
+        http://trac.webkit.org/changeset/76893
+        https://bugs.webkit.org/show_bug.cgi?id=53287
+
+        It made some tests crash on GTK and Qt debug bots (Requested
+        by Ossy on #webkit).
+
+        * runtime/WeakGCMap.h:
+
+2011-01-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WTFString method to compare equality with Vector<UChar>
+        https://bugs.webkit.org/show_bug.cgi?id=53266
+
+        I'm planning to use this method in the new XSS filter implementation,
+        but it seems generally useful.
+
+        * wtf/text/StringImpl.h:
+        (WTF::equalIgnoringNullity):
+        * wtf/text/WTFString.h:
+        (WTF::equalIgnoringNullity):
+
+2011-01-27  Michael Saboff  <msaboff@apple.com>
+
+        Potentially Unsafe HashSet of RuntimeObject* in RootObject definition
+        https://bugs.webkit.org/show_bug.cgi?id=53271
+
+        Added new isValid() methods to check if a contained object in
+        a WeakGCMap is valid when using an unchecked iterator.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::isValid):
+
+2011-01-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add events to represent the start/end of a gesture scroll
+        https://bugs.webkit.org/show_bug.cgi?id=53215
+
+        * wtf/Platform.h: Add ENABLE for gesture events. 
+
+2011-01-26  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Fix --minimal build
+        https://bugs.webkit.org/show_bug.cgi?id=52839
+
+        Move definition of USE_SYSTEM_MALLOC out of pri file.
+        Put it in platform.h instead.
+
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp:
+        * wtf/wtf.pri:
+
+2011-01-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Add JIT support to build system
+        https://bugs.webkit.org/show_bug.cgi?id=53079
+
+        * CMakeListsWinCE.txt:
+
+2011-01-25  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Set BUILDSTYLE to Release_PGO at the very start
+        of the file so that ConfigurationBuildDir takes that into account. Also set it the right way
+        (by redefining the macro) rather than the wrong way (by modifying the environment variable).
+
+2011-01-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Windows production build fix.
+        Use correct environment variable escaping
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2011-01-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSON.stringify processing time exponentially grows with size of object
+        https://bugs.webkit.org/show_bug.cgi?id=51922
+
+        Remove last use of reserveCapacity from JSON stringification, as it results
+        in appalling append behaviour when there are a large number of property names
+        and nothing else.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+
+2011-01-25  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+        
+        Try to fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-01-25  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION: Leak in JSParser::Scope::copyCapturedVariablesToVector()
+        https://bugs.webkit.org/show_bug.cgi?id=53061
+         
+        Cache did not know about the subclass so failed to fully delete the items. 
+        Got rid of the subclass and moved the classes to separate files.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::saveFunctionInfo):
+        (JSC::JSParser::Scope::restoreFunctionInfo):
+        (JSC::JSParser::findCachedFunctionInfo):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/SourceProvider.h:
+        * parser/SourceProviderCache.cpp: Added.
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::byteSize):
+        * parser/SourceProviderCache.h: Added.
+        (JSC::SourceProviderCache::SourceProviderCache):
+        (JSC::SourceProviderCache::add):
+        (JSC::SourceProviderCache::get):
+        * parser/SourceProviderCacheItem.h: Added.
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        (JSC::SourceProviderCacheItem::approximateByteSize):
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+
+2011-01-25  Marcilio Mendonca  <mamendonca@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 53087: Refactoring: replaced a hanging "else" with a "return"
+        statement
+        https://bugs.webkit.org/show_bug.cgi?id=53087.
+
+        Refactoring work: Replaced a hanging "else" within an #if PLATFORM(M
+        with a "return" so that the code is more readable and less error pro
+        (e.g., "else" doesn't use braces so adding extra lines to the else
+        block won't have any effect; even worse, code still compiles
+        successfully.
+
+        * wtf/Assertions.cpp:
+
+2011-01-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Change ENABLE_3D_CANVAS to ENABLE_WEBGL
+        https://bugs.webkit.org/show_bug.cgi?id=53041
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-01-25  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Added a missing "set".
+
+2011-01-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add missing defines for COMPILER(RVCT) && CPU(ARM_THUMB2)
+        https://bugs.webkit.org/show_bug.cgi?id=52949
+
+        * jit/JITStubs.cpp:
+
+2011-01-24  Adam Roben  <aroben@apple.com>
+
+        Windows Production build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Update for move of JavaScriptCore into Source.
+
+2011-01-24  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Optimize regex patterns which contain empty alternatives
+        https://bugs.webkit.org/show_bug.cgi?id=51395
+
+        Eliminate the empty alternatives from the regex pattern and convert it to do
+        the matching in an easier way.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
+
+2011-01-24  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Move project files into Source
+        https://bugs.webkit.org/show_bug.cgi?id=52891
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2011-01-23  Mark Rowe  <mrowe@apple.com>
+
+        Follow-up to r76477.
+
+        Fix the scripts that detect problematic code such as static initializers
+        and destructors, weak vtables, inappropriate files in the framework wrappers,
+        and public headers including private headers. These had all been broken
+        since the projects were moved in to the Source directory as the paths to the
+        scripts were not updated at that time.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use WTF::StringHasher in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=52934
+
+        Add an additional function to calculate the hash
+        of data with a runtimedependent size.
+
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::createBlobHash):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Fix comment in String::ascii()
+        https://bugs.webkit.org/show_bug.cgi?id=52980
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::ascii):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add String::containsOnlyLatin1()
+        https://bugs.webkit.org/show_bug.cgi?id=52979
+
+        * wtf/text/WTFString.h:
+        (WTF::String::containsOnlyLatin1):
+        (WTF::charactersAreAllLatin1):
+
+2011-01-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove obsolete JSVALUE32 code
+        https://bugs.webkit.org/show_bug.cgi?id=52948
+
+        r70111 removed support for JSVALUE32.
+        ARM, MIPS and X86 support JSVALUE32_64 only.
+
+        * jit/JITStubs.cpp:
+
+2011-01-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERT running run-webkit-tests --threaded.
+        https://bugs.webkit.org/show_bug.cgi?id=52971
+        
+        SunSpider and v8 report no change.
+
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        (JSC::ConservativeSet::add):
+        * runtime/ConservativeSet.h: Tweaked the inline capacity to 128, and
+        the growth policy to 2X, to make SunSpider and v8 happy.
+        (JSC::ConservativeSet::ConservativeSet):
+        (JSC::ConservativeSet::~ConservativeSet):
+        (JSC::ConservativeSet::mark): Use OSAllocator directly, instead of malloc.
+        Malloc is forbidden during a multi-threaded mark phase because it can
+        cause deadlock.
+
+2011-01-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        A few of Maciej's review suggestions for my last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=52946        
+
+        SunSpider reports no change.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated build systems.
+
+        * runtime/ConservativeSet.cpp: Added.
+        (JSC::isPointerAligned):
+        (JSC::ConservativeSet::add):
+        * runtime/ConservativeSet.h: Added.
+        (JSC::ConservativeSet::ConservativeSet):
+        (JSC::ConservativeSet::mark): Split ConservativeSet out into its own
+        file, and moved the conservative check into ConservativeSet::add, making
+        ConservativeSet's responsibility clearer.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        * runtime/MachineStackMarker.h:
+        * runtime/MarkStack.h: Updated for changes above.
+
+2011-01-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r76430.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Reorganized MarkedSpace, making many of its functions private.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::Heap::heap):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::globalData):
+        (JSC::MarkedSpace::heap):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix build: moved helper function out of #ifdef.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        A few of Maciej's review suggestions for my last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=52946        
+
+        SunSpider reports no change.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::swapIfBackwards): Added a helper function for handling platforms
+        where the stack can grow in any direction.
+
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively): Use the helper
+        function.
+
+        (JSC::isPointerAligned): Use "!" instead of "==0" because a robot told me to.
+
+        (JSC::MachineStackMarker::markConservatively): Changed to use a more
+        standard looping idiom, and to use the helper function above.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isCellAligned): Use "!" instead of "==0" because a robot told me to.
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Cleaned up some conservative marking code.
+        https://bugs.webkit.org/show_bug.cgi?id=52946
+        
+        SunSpider reports no change.
+
+        * interpreter/RegisterFile.h: No need for a special marking function,
+        since we already expose a start() and end().
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::registerFile):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::contains): Migrated markConservatively() to the machine stack
+        marker class. Now, Heap just provides a contains() function, which the
+        machine stack marker uses for checking whether a pointer points into the heap.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        (JSC::isPointerAligned):
+        (JSC::MachineStackMarker::markConservatively):
+        * runtime/MachineStackMarker.h: Move the conservative marking code here.
+
+        * runtime/MarkStack.h:
+        (JSC::ConservativeSet::add):
+        (JSC::ConservativeSet::mark): Changed to using a vector instead of hash
+        set. Vector seems to be a bit faster, and it generates smaller code.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::containsSlowCase):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::isCellAligned):
+        (JSC::MarkedSpace::isPossibleCell):
+        (JSC::MarkedSpace::contains): Kept the code for determining whether a
+        pointer pointed into marked space, and moved the code for marking
+        a set of conservative pointers into the machine stack marker.
+
+        * wtf/HashSet.h:
+        (WTF::::add): Added two missing inlines that I noticed while testing
+        vector vs hash set.
+
+2011-01-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Work around a Clang bug <rdar://problem/8876150> that leads to it incorrectly emitting an access
+        control warning when a client tries to use operator bool exposed above via "using PageBlock::operator bool".
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::operator bool):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::operator bool):
+
+2011-01-21  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [RegexFuzz] Hang with forward assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52825
+        <rdar://problem/8894332>
+
+        The backtrackTo label from the first term in a list of terms is
+        being overwritten by processing of subsequent terms.  Changed
+        copyBacktrackToLabel() to check for an existing bcaktrackTo label
+        before copying and renamed it to propagateBacktrackToLabel() since
+        it no longer copies.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::propagateBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Moved the mark stack from global data to the heap, since it pertains
+        to the heap, and not the virtual machine as a whole.
+        https://bugs.webkit.org/show_bug.cgi?id=52930
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2011-01-21  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r76177): All JavaScriptCore tests fail on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=52814
+
+        Get the approximateByteSize value before releasing the OwnPtr.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseFunctionInfo):
+
+2011-01-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Remove unnecessary <stdio.h> include
+        https://bugs.webkit.org/show_bug.cgi?id=52884
+
+        * jit/JIT.cpp: remove unnecessary include.
+
+2011-01-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Added OwnPtrCommon.h because OwnArrayPtr::set calls deleteOwnedPtr.
+
+        * wtf/OwnArrayPtr.h:
+
+2011-01-20  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [WINCE] Remove obsolete JSVALUE32 code
+        https://bugs.webkit.org/show_bug.cgi?id=52450
+
+        Remove the "offset hack" in create_jit_stubs, since we
+        only support JSVALUE32_64 in the meantime.
+
+        * create_jit_stubs: Removed offset argument
+        * jit/JITStubs.cpp:
+
+2011-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        When marking conservatively, guard against reviving dead objects.
+        https://bugs.webkit.org/show_bug.cgi?id=52840
+        
+        SunSpider and v8 say no change.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markCallFrames): Updated to use the ConservativeSet API.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::recordExtraCost): No need to guard against conservative
+        marking reviving dead objects anymore, since the conservative marking
+        mechanism guards against this now.
+
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors): Don't drain the mark stack inside a
+        marking function. We want to establish a separation of concerns between
+        visiting roots and draining the mark stack.
+
+        (JSC::Heap::markRoots): Gather the set of conservative references before
+        clearning mark bits, because conservative marking now uses the mark bits
+        to determine if a reference is valid, and avoid reviving dead objects.
+
+        (JSC::Heap::collectAllGarbage): No need to guard against conservative
+        marking reviving dead objects anymore, since the conservative marking
+        mechanism guards against this now.
+
+        * runtime/Heap.h: Updated to use the ConservativeSet API.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markCurrentThreadConservatively):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        (JSC::MachineStackMarker::markMachineStackConservatively):
+        * runtime/MachineStackMarker.h: Ditto.
+
+        * runtime/MarkStack.h:
+        (JSC::ConservativeSet::add):
+        (JSC::ConservativeSet::mark): Added ConservativeSet, for gathering the
+        set of conservative references. This is different from MarkStack, since
+        we don't mark the set until it is completely gathered.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::resizeBlocks):
+        (JSC::MarkedSpace::markConservatively):
+        * runtime/MarkedSpace.h: When marking conservatively, guard against
+        reviving dead objects.
+
+2011-01-20  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [Symbian] Fix StackBounds::initialize()
+        https://bugs.webkit.org/show_bug.cgi?id=52842
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize): Use TThreadStackInfo.iLimit for stack limit
+
+2011-01-20  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8890203> [RegexFuzz] Crash in generated code (52773)
+        https://bugs.webkit.org/show_bug.cgi?id=52773
+
+        Fixed case where an existing DataLabelPtr is overwritten.  The
+        replacing DataLabelPtr is now resolved immediately in
+        linkDataLabelToBacktrackIfExists().  Cleanup - eliminated bool
+        return value for the routine as it was never used.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+
+2011-01-20  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt][WK2] WebKit2 enabled build fails to link
+
+        Work around undefined reference linking issues until the buildsystem gets redesigned.
+        These issues first occured in minimal builds (see BUG 50519).
+
+        * JavaScriptCore.pri: link as whole-archive for WebKit2 builds
+
+2011-01-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Refactoring of the custom allocation framework
+        https://bugs.webkit.org/show_bug.cgi?id=49897
+
+        Inheriting from FastAllocBase can result in objects getting larger (bug #33896, #46589).
+        The modification replaces Noncopyable and FastAllocBase classes and these inherits with their
+        equivalent macro implementation at the necessary places.
+
+        * wtf/FastAllocBase.h: Turn FastAllocBase's implementation into a macro.
+
+2011-01-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Follow-up to r75766 / <rdar://problem/5469576>.
+
+        We were failing to initialize the key, causing all sorts of unexpected behavior.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::setThreadHeap):
+        (WTF::TCMalloc_ThreadCache::GetThreadHeap):
+        (WTF::TCMalloc_ThreadCache::InitTSD): Ensure that the key is initialized.
+
+2011-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Rolled back in r76078, with crash fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+        
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Account for the fact that the global
+        object moves its variables into and out of the register file. While out
+        of the register file, the symbol table's size is not an accurate count
+        for the size of the register array, since the BytecodeGenerator might
+        be compiling, adding items to the symbol table.
+        
+2011-01-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Stack overflow when converting an Error object to string
+        https://bugs.webkit.org/show_bug.cgi?id=46410
+
+        * Android.mk: Added StringRecursionChecker.cpp and
+        StringRecursionChecker.h.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.pro: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use StringRecursionChecker instead
+        of the older hand-written code to do the same thing.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString): Use StringRecursionChecker.
+
+        * runtime/JSGlobalData.h: Renamed arrayVisitedElements to
+        stringRecursionCheckVisitedObjects.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString): Use StringRecursionChecker.
+
+        * runtime/StringRecursionChecker.cpp: Added.
+        * runtime/StringRecursionChecker.h: Added.
+
+2011-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove non-spec support for callable RegExp
+        https://bugs.webkit.org/show_bug.cgi?id=28285
+
+        Remove support for callable regexps.  If it breaks sites we can
+        just roll this out.
+
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * tests/mozilla/expected.html: update results.
+
+2011-01-19  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cache function offsets to speed up javascript parsing
+        https://bugs.webkit.org/show_bug.cgi?id=52622
+        
+        Use cache to save function offsets and some other info.
+        This avoids quite a bit of work when reparsing the source.
+
+        * parser/ASTBuilder.h:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::CachedFunctionInfo::CachedFunctionInfo):
+        (JSC::JSParser::CachedFunctionInfo::approximateByteSize):
+        (JSC::JSParser::CachedFunctionInfo::closeBraceToken):
+        (JSC::JSParser::Scope::copyCapturedVariablesToVector):
+        (JSC::JSParser::Scope::saveFunctionInfo):
+        (JSC::JSParser::Scope::restoreFunctionInfo):
+        (JSC::JSParser::findCachedFunctionInfo):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset):
+        (JSC::Lexer::setLineNumber):
+        (JSC::Lexer::sourceProvider):
+        * parser/SourceProvider.h:
+        (JSC::SourceProviderCache::SourceProviderCache):
+        (JSC::SourceProviderCache::~SourceProviderCache):
+        (JSC::SourceProviderCache::byteSize):
+        (JSC::SourceProviderCache::add):
+        (JSC::SourceProviderCache::get):
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::~SourceProvider):
+        (JSC::SourceProvider::cache):
+        (JSC::SourceProvider::notifyCacheSizeChanged):
+        (JSC::SourceProvider::cacheSizeChanged):
+        * parser/SyntaxChecker.h:
+
+2011-01-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-up to r75766 / <rdar://problem/5469576>.
+
+        * DerivedSources.make: Evaluate the SDKROOT variable correctly.
+
+2011-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52672
+
+        Rather than coming up with a somewhat convoluted mechanism to ensure that
+        developers can override the global objects prototype with a function named
+        __proto__ and expect it to work, we just disallow it at the syntax level.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseFunctionInfo):
+
+2011-01-19  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8882994> Regression: Simple nested backtrack hangs
+        https://bugs.webkit.org/show_bug.cgi?id=52675
+
+        The changeset (r76076) for https://bugs.webkit.org/show_bug.cgi?id=52540
+        broke simple backtracking in some cases.  Reworked that change to 
+        link both jumps and labels.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-19  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [JSC] scripts have incorrect starting line (always 1).
+        https://bugs.webkit.org/show_bug.cgi?id=52721
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * debugger/Debugger.h:
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::startPosition):
+
+2011-01-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Laszlo Gombos and Tor Arne Vestbø.
+
+        [Qt] Remove unnecessary "../Source" from paths
+        after moving source files into Source is finished.
+
+        * JavaScriptCore.pri:
+
+2011-01-19  Benjamin Kalman  <kalman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Don't return void from void function String::split
+        https://bugs.webkit.org/show_bug.cgi?id=52684
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::split):
+
+2011-01-18  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r76078.
+        http://trac.webkit.org/changeset/76078
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+
+        Caused crashes of fast/canvas/webgl/constants.html,
+        fast/canvas/webgl/gl-enum-tests.html, and possibly other layout
+        test crashes in Release mode. WebGL crashes were observed with
+        "run-webkit-tests fast/canvas/webgl". It was necessary to run
+        multiple tests to provoke the crash.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::markGlobals):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren):
+
+2011-01-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Assertion asking activation for arguments when arguments is overridden
+        https://bugs.webkit.org/show_bug.cgi?id=52690
+
+        Clean up code to retrieve arguments from activation and function objects.
+        Remove the incorrect assertion from JSActivation's argumentsGetter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+
+2011-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Removed RegisterFile::markGlobals because it was obtuse, and it
+        unnecessarily relied on conservative marking.
+        https://bugs.webkit.org/show_bug.cgi?id=52668
+
+        * interpreter/RegisterFile.h: Removed markGlobals.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren): Added a comment explaning why some
+        JSActivations don't always mark their registers arrays.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Instead of calling markGlobals, mark
+        the registers array directly.
+
+2011-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8875432> Regression: Some text-only e-mails cause hang beneath RegExp::match (52540)
+        https://bugs.webkit.org/show_bug.cgi?id=52540
+        https://bugs.webkit.org/show_bug.cgi?id=52662
+
+        Directly use backtrack label with parentheses nested under a
+        non-capturing parentheses.  Also linked current parentheses
+        tail code object for possible parens nested within a non-capturing
+        parentheses.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
+2011-01-18  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Only use moving memory model assumption in ExecutableAllocator::intializePageSize() for Symbian OS
+        https://bugs.webkit.org/show_bug.cgi?id=52517
+
+        Patch by David Tapuska
+
+        Currently, we compile code with respect to the Symbian-specific moving memory model
+        assumption for all ARMv5 or lower architectures. Instead, we should only compile
+        such code when building for Symbian OS on those architectures because this model
+        is Symbian-specific.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+
+2011-01-18  Dimitry Andric  <dim@freebsd.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix linking JavaScriptCore on FreeBSD/amd64
+        https://bugs.webkit.org/show_bug.cgi?id=52591
+
+        Linking of JavaScriptCore on FreeBSD/amd64 fails, for the same reason as
+        in bug 28422: cti_vm_throw needs a "@plt" suffix, otherwise the linker
+        complains about the relocation type.
+
+        * jit/JITStubs.cpp: use @plt suffix on x86_64 platforms, for both Linux
+        and FreeBSD.
+
+2011-01-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        [jsfunfuzz] Assertion in codegen for array of NaN constants
+        https://bugs.webkit.org/show_bug.cgi?id=52643
+
+        Don't cache NaN literals in the code generator, as NaN doesn't compare
+        as equal to itself it causes problems when rehashing the number cache.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+
+2011-01-17  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        REGRESSION(r75709): Return value of fscanf() shouldn't be ignored.
+        https://bugs.webkit.org/show_bug.cgi?id=52585
+        
+        gcc 4.4.4+ has warn_unused_value attribute on fscanf, so we should check
+        the return value to get around the gcc warning
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::maybeModifyVMPoolSize):
+
+2011-01-17  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [regexfuzz] Crash running regex with lookahead
+        https://bugs.webkit.org/show_bug.cgi?id=52548
+
+        Eliminated agressive chaining of backtracks.  This code was overwriting
+        already valid backtrack information.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::processBacktracks):
+
+2011-01-17  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix some headers with missing or misspelled #ifndef guards
+        https://bugs.webkit.org/show_bug.cgi?id=52545
+
+        * wtf/RefPtrHashMap.h:
+
+2011-01-17  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Update xcodeproj svn:ignore to include xcuserdata.
+
+        * JavaScriptCore.xcodeproj: Modified property svn:ignore.
+
+2011-01-16  Adam Barth  <abarth@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Move WebKit into Source
+        https://bugs.webkit.org/show_bug.cgi?id=52530
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        [jsfunfuzz] Parser doesn't correctly validate for-loop syntax
+        https://bugs.webkit.org/show_bug.cgi?id=52516
+
+        Ensure that we always check for a semicolon after encountering
+        multiple declarations in the initialiser portion of a for-loop.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseForStatement):
+
+2011-01-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Strict mode restrictions on arguments and eval usage aren't complete
+        https://bugs.webkit.org/show_bug.cgi?id=52528
+
+        Fix a few bugs in strict mode where we incorrect allow mutation of
+        arguments and eval in the parser.
+
+        Alas the "optimisation" used by the syntax checker for validating
+        binary and unary expressions was too aggressive: we do actually need
+        a stack for operations and operands although it needn't be as complete
+        as that used for the full AST builder.
+
+        Also disallow assignment to arguments in all cases as allowing arguments
+        to be assignable is always an error in strict mode, regardless of context.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::BinaryExprContext::BinaryExprContext):
+        (JSC::ASTBuilder::UnaryExprContext::UnaryExprContext):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::BinaryExprContext::BinaryExprContext):
+        (JSC::SyntaxChecker::BinaryExprContext::~BinaryExprContext):
+        (JSC::SyntaxChecker::UnaryExprContext::UnaryExprContext):
+        (JSC::SyntaxChecker::UnaryExprContext::~UnaryExprContext):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2011-01-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in r75886.
+        https://bugs.webkit.org/show_bug.cgi?id=52527
+        
+        r75886 broke the GTK Linux bot because Linux was -- quite surprisingly --
+        set up to use the constants for embedded devices.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::maybeModifyVMPoolSize): Separated Linux constants from embedded
+        constants.
+
+2011-01-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r75886.
+        http://trac.webkit.org/changeset/75886
+        https://bugs.webkit.org/show_bug.cgi?id=52526
+
+        "Broke GTK+ 64bit" (Requested by xan_ on #webkit).
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2011-01-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8870429> Shrink the executable pool on embedded devices
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Dropped the pool size from 32MB
+        to 16MB.
+
+2011-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect behavior changing attributes of an accessor
+        https://bugs.webkit.org/show_bug.cgi?id=52515
+
+        defineProperty doesn't correctly handle changing attributes of an accessor
+        property.  This is because we don't pass the full descriptor to the 
+        putDescriptor helper function, which means we have insufficient information
+        to do the right thing. Once that's passed the correct behavior is relatively
+        simple to implement.
+
+        * runtime/JSObject.cpp:
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+
+2011-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [jsfunfuzz] Incorrect handling of consecutive duplicate labels
+        https://bugs.webkit.org/show_bug.cgi?id=52505
+
+        Compare StringImpl*'s instead of Identifier*'s when looking for duplicate
+        labels.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+
+2011-01-14  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+        
+        Initialize m_operationInProgress after r75855.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+
+2011-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reverted accidentally committed code from my last checkin.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+
+2011-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Try to fix the GTK bot.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots): Kids, remember to initialize your data members.
+        Knowing is half the battle.
+
+2011-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        [jsfunfuzz] We should be clearing the lexers temporary character buffers when switching to strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=52501
+
+        Clear the temporary character buffers used for reading escaped characters and
+        numbers.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset):
+
+2011-01-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix non-Dtrace builds: #include Tracing.h instead of TracingDtrace.h.
+
+        * runtime/Heap.cpp:
+
+2011-01-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Split out a MarkedSpace strategy object from Heap.
+        https://bugs.webkit.org/show_bug.cgi?id=52421
+        
+        SunSpider reports no change.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated our 7 build systems. Which is cool.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::recordExtraCost):
+        (JSC::Heap::allocate):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::statistics):
+        (JSC::Heap::size):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * runtime/Heap.h:
+        (JSC::Heap::globalData):
+        (JSC::Heap::markedSpace):
+        (JSC::Heap::isCellMarked):
+        (JSC::Heap::checkMarkCell):
+        (JSC::Heap::markCell): Moved all code pertaining to managing chunks of
+        collector memory out of this class. Heap now just delegates to MarkedSpace.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::Heap::heap): Updated for MarkedSpace delegation.
+
+        * runtime/JSValue.h: Moved the ValueStringPair typedef to help with #includes.
+
+        * runtime/MarkedSpace.cpp: Copied from runtime/Heap.cpp.
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::resizeBlocks):
+        (JSC::MarkedSpace::growBlocks):
+        (JSC::MarkedSpace::shrinkBlocks):
+        (JSC::MarkedSpace::markConservatively):
+        (JSC::MarkedSpace::clearMarkBits):
+        (JSC::MarkedSpace::markedCells):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::addToStatistics):
+        (JSC::MarkedSpace::statistics):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::reset):
+        (JSC::MarkedSpace::primaryHeapBegin):
+        (JSC::MarkedSpace::primaryHeapEnd):
+        * runtime/MarkedSpace.h: Copied from runtime/Heap.h.
+        (JSC::MarkedSpace::globalData):
+        (JSC::MarkedSpace::didShrink):
+        (JSC::MarkedSpace::cellBlock):
+        (JSC::MarkedSpace::cellOffset):
+        (JSC::MarkedSpace::isCellMarked):
+        (JSC::MarkedSpace::checkMarkCell):
+        (JSC::MarkedSpace::markCell): Moved all code pertaining to managing chunks of
+        collector memory into this class.
+
+        * runtime/MemoryStatistics.cpp:
+        (JSC::heapStatistics):
+        * runtime/MemoryStatistics.h: Updated for MarkedSpace delegation.
+
+2011-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] parser doesn't enforce continue restrictions correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=52493
+
+        This patch reworks handling of break, continue and label statements
+        to correctly handle all the valid and invalid cases.  Previously certain
+        errors would be missed by the parser in strict mode, but the bytecode 
+        generator needed to handle those cases for non-strict code so nothing
+        failed, it simply became non-standard behaviour.
+
+        Now that we treat break and continue errors as early faults in non-strict
+        mode as well that safety net has been removed so the parser bugs result in
+        crashes at codegen time.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::ScopeLabelInfo::ScopeLabelInfo):
+        (JSC::JSParser::next):
+        (JSC::JSParser::nextTokenIsColon):
+        (JSC::JSParser::continueIsValid):
+            Continue is only valid in loops so we can't use breakIsValid()
+        (JSC::JSParser::pushLabel):
+            We now track whether the label is for a loop (and is therefore a
+            valid target for continue.
+        (JSC::JSParser::popLabel):
+        (JSC::JSParser::getLabel):
+            Replace hasLabel with getLabel so that we can validate the target
+            when parsing continue statements.
+        (JSC::JSParser::Scope::continueIsValid):
+        (JSC::JSParser::Scope::pushLabel):
+        (JSC::JSParser::Scope::getLabel):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::LabelInfo::LabelInfo):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+            Consecutive labels now get handled iteratively so that we can determine
+            whether they're valid targets for continue.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::nextTokenIsColon):
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset):
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
+        https://bugs.webkit.org/show_bug.cgi?id=45186
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scheduleScavenger): Added missing this pointer to CreateTimerQueueTimer().
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
+        https://bugs.webkit.org/show_bug.cgi?id=45186
+
+        r75819 accidentally changed the initial state of the scavenge timer.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Changed initial state of m_scavengingSuspended to true.
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed Windows Release build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavengerTimerFired):
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed Windows Release build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavengerTimerFired):
+
+2011-01-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Use the Windows thread pool instead of an extra thread for FastMalloc scavenging
+        https://bugs.webkit.org/show_bug.cgi?id=45186
+
+        Use CreateTimerQueueTimer() to start periodicScavenge() and stop it with DeleteTimerQueueTimer().
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::rescheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+        (WTF::scavengerTimerFired):
+        (WTF::TCMalloc_PageHeap::periodicScavenge):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+
+2011-01-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Align import/export directives
+        https://bugs.webkit.org/show_bug.cgi?id=52208
+
+        * API/JSBase.h: Align import/export directives with
+        WebKit2/Shared/API/c/WKBase.h
+
+2011-01-14  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Incorrect backtracking for nested alternatives
+        https://bugs.webkit.org/show_bug.cgi?id=52387
+
+        In the process of propigating a datalabel it wasn't getting connected
+        to a destination when the destination was an indirect jump.  Added
+        code to recognize a direct backtrack destination that was an indirect
+        jump and added mechanism to associate DataLabelPtrs with indirect
+        jump entries.
+        Removed dead method
+        BacktrackDestination::linkDataLabelToHereIfExists()
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::IndirectJumpEntry):
+        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::addDataLabel):
+        (JSC::Yarr::YarrGenerator::GenerationState::addIndirectJumpEntry):
+        (JSC::Yarr::YarrGenerator::GenerationState::emitIndirectJumpTable):
+        Changes to link indirect jumps with DataLabelPtr's.
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::clearSubDataLabelPtr):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists): 
+        Updated to handle immediate linking of indirect jumps to
+        DataLabelPtr.
+        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction): Changed to
+        reflect updated linkDataLabelToBacktrackIfExists().
+
+2011-01-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: provide script column offset to frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=52377
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::firstColumn):
+
+2011-01-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/5469576> Use __PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0 if available.
+
+        * DerivedSources.make: Create a header file, HeaderDetection.h, that tells
+        us whether pthread_machdep.h is available.
+        * wtf/FastMalloc.cpp: If __PTK_FRAMEWORK_JAVASCRIPTCORE_KEY0 is available, then
+        don't do the pthread_getspecific_function_pointer trick.
+        (WTF::setThreadHeap): Ditto, but set thread-specific data.
+        (WTF::TCMalloc_ThreadCache::GetThreadHeap): Ditto, but get rather than set.
+
+2011-01-13  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JIT requires VM overcommit (particularly on x86-64), Linux does not by default support this without swap?
+        https://bugs.webkit.org/show_bug.cgi?id=42756
+
+        The FixedVMPool Allocator does not work well on systems where
+        allocating very large amounts of memory upfront is not reasonable,
+        like Linux without overcommit enabled. As a workaround, on Linux,
+        default to the values used in embedded environments (in the MB
+        range), and only jump to the GB range if we detect at runtime that
+        overcommit is enabled. Should fix crashes on Linux/x86_64 with
+        less than 3 or 4GB of RAM.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::free): use new variables for VM pool
+        size and coalesce limit.
+        (JSC::ExecutableAllocator::isValid): swap the variables from
+        embedded to generic values at runtime, on linux, if overcommit is
+        enabled.
+        (JSC::ExecutableAllocator::underMemoryPressure): use new variables
+        for VM pool size and coalesce limit.
+
+2011-01-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Add new Yarr.h header to the list file.
+
+        * GNUmakefile.am: ditto.
+
+2011-01-12  Martin Robinson  <mrobinson@igalia.com>
+
+        Missing Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h in WebKitGtk tarball
+        https://bugs.webkit.org/show_bug.cgi?id=52299
+
+        * GNUmakefile.am: Fix the GTK+ build on ARMv7 by including missing source
+        files in the source list.
+
+2011-01-12  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add Yarr.h to YARR
+        https://bugs.webkit.org/show_bug.cgi?id=51021
+
+        Move other common constants and functions from YARR's different files
+        to Yarr.h.
+        Use Yarr.h header instead of including other YARR headers where it
+        is possible.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        * yarr/Yarr.h: Added.
+        * yarr/YarrInterpreter.cpp:
+        * yarr/YarrInterpreter.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::jitCompile):
+        (JSC::Yarr::execute):
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPattern::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+
+2011-01-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r75595.
+        http://trac.webkit.org/changeset/75595
+        https://bugs.webkit.org/show_bug.cgi?id=52286
+
+        It broke fast/regex/pcre-test-1.html (Requested by Ossy on
+        #webkit).
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        * yarr/Yarr.h: Removed.
+        * yarr/YarrInterpreter.cpp:
+        * yarr/YarrInterpreter.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::jitCompile):
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::execute):
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+
+2011-01-12  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add Yarr.h to YARR
+        https://bugs.webkit.org/show_bug.cgi?id=51021
+
+        Move other common constants and functions from YARR's different files
+        to Yarr.h.
+        Use Yarr.h header instead of including other YARR headers where it
+        is possible.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        * yarr/Yarr.h: Added.
+        * yarr/YarrInterpreter.cpp:
+        * yarr/YarrInterpreter.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::jitCompile):
+        (JSC::Yarr::execute):
+        * yarr/YarrJIT.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPattern::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+
+2011-01-11  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Missing call to popTempSortVector() for exception case in JSArray::sort.
+        https://bugs.webkit.org/show_bug.cgi?id=50718
+
+        Fix to patch of 50718 that added pushTempSortVector() and 
+        popTempSortVector() to JSArray::sort() to mark elements during sort.
+        Need to add popTempSortVector() for the return case if toString()
+        had an exception.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Added popTempSortVector()
+
+2011-01-11  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        Microoptimization in ~JSString
+        https://bugs.webkit.org/show_bug.cgi?id=52222
+
+        The case where m_fibers is 0 seems to be the most common one
+        (almost 1/2 of the time, followed at some distance by m_fibers = 1
+        in 1/4 of the cases in a typical SunSpider execution). We can save
+        one comparison in this common case by doing a bit of refactoring
+        in the JSString destructor; overall a 0.3% progression, but only
+        the string tests show improvement.
+
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::~JSString):
+
+2011-01-10  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        ASSERTION Failure in JSC::binaryChop
+        https://bugs.webkit.org/show_bug.cgi?id=25614
+
+        Changed JITStubs::cti_register_file_check() to use the current stack's
+        return PC to find the bytecode for handling the exception in the prior
+        frame.  Also added the appropriate arrity check routine call to the
+        JIT to bytecode vector (m_callReturnIndexVector) in the CodeBlock.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile): Changed the arrity check call location
+        so that it gets added to the m_calls list so that it's included in
+        CodeBlock::m_callReturnIndexVector.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Use the current call frame's return PC.
+
+2011-01-10  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Martin Robinson.
+
+        Remove extraneous COMPILER(GCC) condition when checking GCC_VERSION_AT_LEAST()
+        https://bugs.webkit.org/show_bug.cgi?id=52178
+
+        It is sufficient to test GCC_VERSION_AT_LEAST() instead of both COMPILER(GCC) and
+        GCC_VERSION_AT_LEAST(). Notice GCC_VERSION_AT_LEAST() is defined to be 0 when we
+        are not compiling with GCC.
+
+        Fixes style issues at the callsites (i.e. replace comma with comma-space in
+        macro function argument list). Also, makes a spelling correction in a comment.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * wtf/Platform.h:
+
+2011-01-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: removed some uses of nextNumber that I missed last time.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+
+2011-01-10  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Use __builtin_expect when compiling using RVCT in GNU mode
+        https://bugs.webkit.org/show_bug.cgi?id=51866
+
+        We should only use __builtin_expect if we are compiling with GCC or RVCT 3 or higher in GNU mode
+        as pointed out by Siddharth Mathur per <http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0202h/Cjabddedbde.html>.
+
+        * wtf/AlwaysInline.h:
+        * wtf/Platform.h: Removed define WTF_COMPILER_RVCT4_OR_GREATER. Instead added macro
+        function RVCT_VERSION_AT_LEAST so that we can test for an arbitrary minimum RVCT
+        version.
+
+2011-01-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Moved Collector.* => Heap.*, since the file contains a class named "Heap".
+
+        * API/JSCallbackObject.cpp:
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        * interpreter/RegisterFile.h:
+        * jit/JITStubs.cpp:
+        * runtime/Collector.cpp: Removed.
+        * runtime/Collector.h: Removed.
+        * runtime/CollectorHeapIterator.h:
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/Heap.cpp: Copied from JavaScriptCore/runtime/Collector.cpp.
+        * runtime/Heap.h: Copied from JavaScriptCore/runtime/Collector.h.
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/MachineStackMarker.cpp:
+        * runtime/MemoryStatistics.h:
+        * runtime/Protect.h:
+        * runtime/UString.cpp:
+        * runtime/WeakGCMap.h:
+        * runtime/WeakGCPtr.h:
+
+2011-01-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove unused isString() case in JSString::toPrimitiveString()
+        https://bugs.webkit.org/show_bug.cgi?id=52167
+
+        We never call toPrimitiveString() with strings, so remove the
+        check and add an ASSERT ensuring this never happens. 0.7% overall
+        progression in sunspider, since one of the call sites is very hot.
+
+        * runtime/JSString.h:
+        (JSC::JSValue::toPrimitiveString):
+
+2011-01-10  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Rename the existing YARR files and classes
+        https://bugs.webkit.org/show_bug.cgi?id=51872
+
+        Replace the "Regex" prefix with "Yarr" in the name of YARR files and classes.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::printTraceData):
+        * yarr/YarrInterpreter.cpp: Renamed from Source/JavaScriptCore/yarr/RegexInterpreter.cpp.
+        (JSC::Yarr::Interpreter::appendParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::restoreOutput):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (JSC::Yarr::Interpreter::InputStream::next):
+        (JSC::Yarr::Interpreter::InputStream::rewind):
+        (JSC::Yarr::Interpreter::InputStream::read):
+        (JSC::Yarr::Interpreter::InputStream::readPair):
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::reread):
+        (JSC::Yarr::Interpreter::InputStream::prev):
+        (JSC::Yarr::Interpreter::InputStream::getPos):
+        (JSC::Yarr::Interpreter::InputStream::setPos):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::InputStream::checkInput):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::InputStream::isNotAvailableInput):
+        (JSC::Yarr::Interpreter::testCharacterClass):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::checkCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionEOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+        (JSC::Yarr::Interpreter::recordParenthesesMatch):
+        (JSC::Yarr::Interpreter::resetMatches):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::lookupForBeginChars):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::ParenthesesStackEntry::ParenthesesStackEntry):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alternativeDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        (JSC::Yarr::byteCompile):
+        (JSC::Yarr::interpret):
+        * yarr/YarrInterpreter.h: Renamed from Source/JavaScriptCore/yarr/RegexInterpreter.h.
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BOL):
+        (JSC::Yarr::ByteTerm::CheckInput):
+        (JSC::Yarr::ByteTerm::EOL):
+        (JSC::Yarr::ByteTerm::WordBoundary):
+        (JSC::Yarr::ByteTerm::BackReference):
+        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
+        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::SubpatternBegin):
+        (JSC::Yarr::ByteTerm::SubpatternEnd):
+        (JSC::Yarr::ByteTerm::invert):
+        (JSC::Yarr::ByteTerm::capture):
+        (JSC::Yarr::ByteDisjunction::ByteDisjunction):
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        (JSC::Yarr::BytecodePattern::~BytecodePattern):
+        * yarr/YarrJIT.cpp: Renamed from Source/JavaScriptCore/yarr/RegexJIT.cpp.
+        (JSC::Yarr::YarrGenerator::optimizeAlternative):
+        (JSC::Yarr::YarrGenerator::matchCharacterClassRange):
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+        (JSC::Yarr::YarrGenerator::jumpIfNoAvailableInput):
+        (JSC::Yarr::YarrGenerator::jumpIfAvailableInput):
+        (JSC::Yarr::YarrGenerator::checkInput):
+        (JSC::Yarr::YarrGenerator::atEndOfInput):
+        (JSC::Yarr::YarrGenerator::notAtEndOfInput):
+        (JSC::Yarr::YarrGenerator::jumpIfCharEquals):
+        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::YarrGenerator::readCharacter):
+        (JSC::Yarr::YarrGenerator::storeToFrame):
+        (JSC::Yarr::YarrGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::YarrGenerator::loadFromFrame):
+        (JSC::Yarr::YarrGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::IndirectJumpEntry):
+        (JSC::Yarr::YarrGenerator::IndirectJumpEntry::addJump):
+        (JSC::Yarr::YarrGenerator::AlternativeBacktrackRecord::AlternativeBacktrackRecord):
+        (JSC::Yarr::YarrGenerator::GenerationState::GenerationState):
+        (JSC::Yarr::YarrGenerator::GenerationState::addIndirectJumpEntry):
+        (JSC::Yarr::YarrGenerator::GenerationState::emitIndirectJumpTable):
+        (JSC::Yarr::YarrGenerator::GenerationState::incrementParenNestingLevel):
+        (JSC::Yarr::YarrGenerator::GenerationState::decrementParenNestingLevel):
+        (JSC::Yarr::YarrGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::YarrGenerator::GenerationState::emitParenthesesTail):
+        (JSC::Yarr::YarrGenerator::GenerationState::addJumpToNextInteration):
+        (JSC::Yarr::YarrGenerator::GenerationState::addJumpsToNextInteration):
+        (JSC::Yarr::YarrGenerator::GenerationState::addDataLabelToNextIteration):
+        (JSC::Yarr::YarrGenerator::GenerationState::linkToNextIteration):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::BacktrackDestination):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::clear):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::clearDataLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasDestination):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::isStackOffset):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::isLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::isJumpList):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::hasDataLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyTarget):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyTo):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::addBacktrackJump):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setStackOffset):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setNextBacktrackLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::copyBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackJumpList):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setBacktrackSourceLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setDataLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::setSubDataLabelPtr):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkToNextBacktrack):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::getStackOffset):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::getLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::getBacktrackJumps):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::getDataLabel):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::jumpToBacktrack):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkDataLabelToHereIfExists):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkAlternativeBacktracks):
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::linkAlternativeBacktracksTo):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::alternativeValid):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::nextAlternative):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::alternative):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::isLastAlternative):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::termValid):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::nextTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::term):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getSubParenNum):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::isMainDisjunction):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setParenthesesTail):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getParenthesesTail):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::lookaheadTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::isSinglePatternCharacterLookaheadTerm):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::inputOffset):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::clearBacktrack):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::addBacktrackJump):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackDataLabel):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setBackTrackStackOffset):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackLabel):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkAlternativeBacktracks):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkAlternativeBacktracksTo):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::setBacktrackLink):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::chainBacktracks):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::chainBacktrackJumps):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::getBacktrackDestination):
+        (JSC::Yarr::YarrGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::processBacktracks):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::setNextIteration):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::addAfterParenJump):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::YarrGenerator::generateAssertionBOL):
+        (JSC::Yarr::YarrGenerator::generateAssertionEOL):
+        (JSC::Yarr::YarrGenerator::matchAssertionWordchar):
+        (JSC::Yarr::YarrGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterPair):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassSingle):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        (JSC::Yarr::YarrGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::YarrGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::YarrGenerator::generateTerm):
+        (JSC::Yarr::YarrGenerator::generateDisjunction):
+        (JSC::Yarr::YarrGenerator::generateEnter):
+        (JSC::Yarr::YarrGenerator::generateReturn):
+        (JSC::Yarr::YarrGenerator::YarrGenerator):
+        (JSC::Yarr::YarrGenerator::generate):
+        (JSC::Yarr::YarrGenerator::compile):
+        (JSC::Yarr::jitCompile):
+        * yarr/YarrJIT.h: Renamed from Source/JavaScriptCore/yarr/RegexJIT.h.
+        (JSC::Yarr::YarrCodeBlock::YarrCodeBlock):
+        (JSC::Yarr::YarrCodeBlock::~YarrCodeBlock):
+        (JSC::Yarr::YarrCodeBlock::setFallBack):
+        (JSC::Yarr::YarrCodeBlock::isFallBack):
+        (JSC::Yarr::YarrCodeBlock::set):
+        (JSC::Yarr::YarrCodeBlock::execute):
+        (JSC::Yarr::YarrCodeBlock::getAddr):
+        (JSC::Yarr::execute):
+        * yarr/YarrParser.h: Renamed from Source/JavaScriptCore/yarr/RegexParser.h.
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::begin):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::end):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parseAtomEscape):
+        (JSC::Yarr::Parser::parseCharacterClassEscape):
+        (JSC::Yarr::Parser::parseCharacterClass):
+        (JSC::Yarr::Parser::parseParenthesesBegin):
+        (JSC::Yarr::Parser::parseParenthesesEnd):
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        (JSC::Yarr::Parser::saveState):
+        (JSC::Yarr::Parser::restoreState):
+        (JSC::Yarr::Parser::atEndOfPattern):
+        (JSC::Yarr::Parser::peek):
+        (JSC::Yarr::Parser::peekIsDigit):
+        (JSC::Yarr::Parser::peekDigit):
+        (JSC::Yarr::Parser::consume):
+        (JSC::Yarr::Parser::consumeDigit):
+        (JSC::Yarr::Parser::consumeNumber):
+        (JSC::Yarr::Parser::consumeOctal):
+        (JSC::Yarr::Parser::tryConsume):
+        (JSC::Yarr::Parser::tryConsumeHex):
+        (JSC::Yarr::parse):
+        * yarr/YarrPattern.cpp: Renamed from Source/JavaScriptCore/yarr/RegexPattern.cpp.
+        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::Yarr::CharacterClassConstructor::reset):
+        (JSC::Yarr::CharacterClassConstructor::append):
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeUpper):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeLower):
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::CharacterClassConstructor::addSorted):
+        (JSC::Yarr::CharacterClassConstructor::addSortedRange):
+        (JSC::Yarr::BeginCharHelper::BeginCharHelper):
+        (JSC::Yarr::BeginCharHelper::addBeginChar):
+        (JSC::Yarr::BeginCharHelper::merge):
+        (JSC::Yarr::BeginCharHelper::addCharacter):
+        (JSC::Yarr::BeginCharHelper::linkHotTerms):
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::~YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::reset):
+        (JSC::Yarr::YarrPatternConstructor::assertionBOL):
+        (JSC::Yarr::YarrPatternConstructor::assertionEOL):
+        (JSC::Yarr::YarrPatternConstructor::assertionWordBoundary):
+        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::YarrPatternConstructor::atomBuiltInCharacterClass):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassAtom):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassRange):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
+        (JSC::Yarr::YarrPatternConstructor::atomBackReference):
+        (JSC::Yarr::YarrPatternConstructor::copyDisjunction):
+        (JSC::Yarr::YarrPatternConstructor::copyTerm):
+        (JSC::Yarr::YarrPatternConstructor::quantifyAtom):
+        (JSC::Yarr::YarrPatternConstructor::disjunction):
+        (JSC::Yarr::YarrPatternConstructor::regexBegin):
+        (JSC::Yarr::YarrPatternConstructor::regexEnd):
+        (JSC::Yarr::YarrPatternConstructor::regexError):
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
+        (JSC::Yarr::YarrPatternConstructor::setupOffsets):
+        (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
+        (JSC::Yarr::YarrPatternConstructor::optimizeBOL):
+        (JSC::Yarr::YarrPatternConstructor::addBeginTerm):
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionBeginTerms):
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeBeginTerms):
+        (JSC::Yarr::YarrPatternConstructor::setupBeginChars):
+        (JSC::Yarr::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h: Renamed from Source/JavaScriptCore/yarr/RegexPattern.h.
+        (JSC::Yarr::CharacterRange::CharacterRange):
+        (JSC::Yarr::CharacterClassTable::create):
+        (JSC::Yarr::CharacterClassTable::CharacterClassTable):
+        (JSC::Yarr::CharacterClass::CharacterClass):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::ForwardReference):
+        (JSC::Yarr::PatternTerm::BOL):
+        (JSC::Yarr::PatternTerm::EOL):
+        (JSC::Yarr::PatternTerm::WordBoundary):
+        (JSC::Yarr::PatternTerm::invert):
+        (JSC::Yarr::PatternTerm::capture):
+        (JSC::Yarr::PatternTerm::quantify):
+        (JSC::Yarr::PatternAlternative::PatternAlternative):
+        (JSC::Yarr::PatternAlternative::lastTerm):
+        (JSC::Yarr::PatternAlternative::removeLastTerm):
+        (JSC::Yarr::PatternAlternative::setOnceThrough):
+        (JSC::Yarr::PatternAlternative::onceThrough):
+        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::~PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::addNewAlternative):
+        (JSC::Yarr::TermChain::TermChain):
+        (JSC::Yarr::BeginChar::BeginChar):
+        (JSC::Yarr::YarrPattern::~YarrPattern):
+        (JSC::Yarr::YarrPattern::reset):
+        (JSC::Yarr::YarrPattern::containsIllegalBackReference):
+        (JSC::Yarr::YarrPattern::newlineCharacterClass):
+        (JSC::Yarr::YarrPattern::digitsCharacterClass):
+        (JSC::Yarr::YarrPattern::spacesCharacterClass):
+        (JSC::Yarr::YarrPattern::wordcharCharacterClass):
+        (JSC::Yarr::YarrPattern::nondigitsCharacterClass):
+        (JSC::Yarr::YarrPattern::nonspacesCharacterClass):
+        (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
+
+2011-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * parser/SyntaxChecker.h:
+
+2011-01-10  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add CTI ASM versions for RVCT ARM THUMB2 mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52154
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+
+2011-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Qt build fix.
+
+        * JavaScriptCore.pro:
+
+2011-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 52079 - Syntax errors should be early errors.
+
+        From chapter 16 the spec:
+            An implementation must report most errors at the time the relevant ECMAScript language construct is
+            evaluated. An early error is an error that can be detected and reported prior to the evaluation of
+            any construct in the Program containing the error. An implementation must report early errors in a
+            Program prior to the first evaluation of that Program. Early errors in eval code are reported at
+            the time eval is called but prior to evaluation of any construct within the eval code. All errors
+            that are not early errors are runtime errors.
+
+            An implementation must treat any instance of the following kinds of errors as an early error:
+                * Any syntax error."
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Added new files.
+        * bytecode/CodeBlock.cpp:
+            Removed op_throw_syntax_error.
+        * bytecode/Opcode.h:
+            Removed op_throw_syntax_error.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+            If m_expressionTooDeep then throw a runtime error.
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+            Initialize m_expressionTooDeep.
+        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
+            Sets m_expressionTooDeep.
+        * bytecompiler/BytecodeGenerator.h:
+            Added m_expressionTooDeep, removed emitThrowSyntaxError.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+            Conditions that threw syntax error are now handled during parsing;
+            during bytecompilation these are now just ASSERTs.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+            Removed op_throw_syntax_error.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createRegExp):
+            Renamed; added syntax check.
+        * parser/JSParser.cpp:
+        (JSC::JSParser::breakIsValid):
+        (JSC::JSParser::hasLabel):
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::setIsFunction):
+        (JSC::JSParser::Scope::isFunctionBoundary):
+        (JSC::JSParser::ScopeRef::hasContainingScope):
+        (JSC::JSParser::ScopeRef::containingScope):
+        (JSC::JSParser::AutoPopScopeRef::AutoPopScopeRef):
+        (JSC::JSParser::AutoPopScopeRef::~AutoPopScopeRef):
+        (JSC::JSParser::AutoPopScopeRef::setPopped):
+        (JSC::JSParser::popScopeInternal):
+        (JSC::JSParser::popScope):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parsePrimaryExpression):
+        * parser/JSParser.h:
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createRegExp):
+            Renamed; added syntax check.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createOutOfMemoryError):
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+            Broke out createOutOfMemoryError.
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+            Add check for exception after bytecode generation.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+            RegExp error prefixes not included in error string.
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::parse):
+            Removed regexBegin/regexEnd/regexError.
+        * yarr/RegexPattern.cpp:
+        (JSC::Yarr::RegexPatternConstructor::regexBegin):
+            Removed regexEnd/regexError.
+        (JSC::Yarr::compileRegex):
+            Add call to regexBegin (no longer called from the parser).
+        * yarr/YarrSyntaxChecker.cpp: Added.
+        (JSC::Yarr::SyntaxChecker::assertionBOL):
+        (JSC::Yarr::SyntaxChecker::assertionEOL):
+        (JSC::Yarr::SyntaxChecker::assertionWordBoundary):
+        (JSC::Yarr::SyntaxChecker::atomPatternCharacter):
+        (JSC::Yarr::SyntaxChecker::atomBuiltInCharacterClass):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassBegin):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassAtom):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassRange):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassBuiltIn):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassEnd):
+        (JSC::Yarr::SyntaxChecker::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::SyntaxChecker::atomParentheticalAssertionBegin):
+        (JSC::Yarr::SyntaxChecker::atomParenthesesEnd):
+        (JSC::Yarr::SyntaxChecker::atomBackReference):
+        (JSC::Yarr::SyntaxChecker::quantifyAtom):
+        (JSC::Yarr::SyntaxChecker::disjunction):
+        (JSC::Yarr::checkSyntax):
+        * yarr/YarrSyntaxChecker.h: Added.
+            Check RegExp syntax.
+
+2011-01-10  Adam Roben  <aroben@apple.com>
+
+        Roll out r75289
+
+        It was causing assertion failures. See <http://webkit.org/b/52156>.
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2011-01-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Unify string table adding in AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=51927
+
+        Move code for adding a string into a separate function.
+        This removes multiple occurrence of the same logic.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::addToStringTable): Added.
+        (WTF::AtomicString::add): Use addToStringTable().
+        (WTF::AtomicString::fromUTF8): Ditto.
+
+2011-01-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Split machine stack marking functions into their own class (MachineStackMarker)
+        https://bugs.webkit.org/show_bug.cgi?id=52088
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Moved registerThread()
+        call behind an #ifdef because we shouldn't be registering threads at all
+        if we don't support usage on multiple threads.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated projects.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        * runtime/Collector.h:
+        (JSC::Heap::machineStackMarker): Moved code to machineStackMarker.
+
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::makeUsableFromMultipleThreads): Removed an unnecessary
+        level of indirection, to make Heap less of a God class.
+
+        * runtime/MachineStackMarker.h: Copied from Source/JavaScriptCore/runtime/Collector.h.
+        * runtime/MachineStackMarker.cpp: Copied from Source/JavaScriptCore/runtime/Collector.cpp.
+        (JSC::MachineStackMarker::MachineStackMarker):
+        (JSC::MachineStackMarker::~MachineStackMarker):
+        (JSC::MachineStackMarker::makeUsableFromMultipleThreads):
+        (JSC::MachineStackMarker::registerThread):
+        (JSC::MachineStackMarker::unregisterThread):
+        (JSC::MachineStackMarker::markCurrentThreadConservativelyInternal):
+        (JSC::MachineStackMarker::markCurrentThreadConservatively):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        (JSC::MachineStackMarker::markMachineStackConservatively): Moved code from Heap.
+
+2011-01-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 26276 - Need a mechanism to determine stack extent on WINDOWS, SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE platforms
+
+        Fix for win32.  The base of the stack is stored in the "deallocation stack" field of the
+        Thread Information Block - see: http://en.wikipedia.org/wiki/Win32_Thread_Information_Block
+        for more information!
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2011-01-07  Adam Roben  <aroben@apple.com>
+
+        Update react-to-vsprops-changes.py after r74855
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+
+2011-01-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Port scrollbar painting to GtkStyleContext
+        https://bugs.webkit.org/show_bug.cgi?id=52051
+
+        * wtf/gobject/GTypedefs.h: Add GtkStyleContext forward
+        declaration.
+
+2011-01-07  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Martin Robinson.
+
+        Enable PCRE computed gotos when compiling with RCVT 4.0 or greater in GNU mode
+        https://bugs.webkit.org/show_bug.cgi?id=52034
+
+        Derived from a patch by Eli Fidler.
+
+        RVCT 4 or greater in GNU mode supports the computed goto GNU language extension
+        as per <http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0348c/ch03s07s12.html>.
+
+        * pcre/pcre_exec.cpp: Modified to check for feature, HAVE(COMPUTED_GOTO), instead
+        of hardcoding the GCC compiler.
+        * wtf/Platform.h: Define WTF_COMPILER_RVCT4_OR_GREATER if __ARMCC_VERSION >= 400000.
+
+2011-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 52035 - Unregistering DOMWrapperWorlds is unsafe
+
+        The method DOMWrapperWorld::unregisterWorld() effectively calls the DOMWrapperWorld's
+        destructor early, in order to release wrappers once we know we no longer intend to use them.
+        Whilst it is okay to have a method to throw away wrappers (assuming we know we're willing to
+        lose any state stored on them) it is not okay to deregister the world from the JSGlobalData.
+        A sequence of events that triggers the bug would look like this:
+
+        (1) Create a DOMWrapperWorld.
+        (2) Register a timer in the world.
+        (3) Call unregisterWorld() on the world.
+        (4) Timer goes off, code is executed in the world, creates a Node not attached to a Document.
+        (5) We attempt to lookup a wrapper map for the world on the JSGlobalData, but because we've
+            called forgetWorld() none exists.
+        (6) Attempt to add a wrapper to a NULL map.
+
+        Fix the problem by not removing the JSGlobalData's wrapper map until the world really goes away.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+
+2011-01-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 52021 - zeroDouble broken on ARMv7
+
+        The bug here is that zeroDouble was working incorrectly,
+        leading to op_loop_if_true failing - specifically in the
+        case where the value being checked is 0.0 encoded as a
+        double (rather than an integer immediate).
+
+        Additionally this patch removes a redundant duplicate compare
+        in some (many) case.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::vcmp_F64):
+        (JSC::ARMv7Assembler::vcmpz_F64):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchDoubleNonZero):
+        (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchDouble):
+        (JSC::MacroAssemblerARMv7::branchDoubleNonZero):
+        (JSC::MacroAssemblerARMv7::branchDoubleZeroOrNaN):
+        (JSC::MacroAssemblerARMv7::compare32):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchDoubleNonZero):
+        (JSC::MacroAssemblerMIPS::branchDoubleZeroOrNaN):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchDoubleNonZero):
+        (JSC::MacroAssemblerX86Common::branchDoubleZeroOrNaN):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+
+2011-01-06  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Added debug code to compare the results of JIT regexp with 
+        interpreted regexp and displays discrepencies.  This debug code is
+        controlled by the ENABLE_YARR_JIT_DEBUG macro in wtf/Platform.h and
+        is only valid if ENABLE_YARR_JIT is enabled.
+
+        Fixed a discovered problem in RegExp::printTraceData, changing
+        m_pattern to the getter pattern().
+        Also deleted an extraneous semicolon.
+
+        Enhancement: Add Regexp Debug Compare between JIT and Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=51834
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::printTraceData):
+        * wtf/Platform.h:
+
+2011-01-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [WINCE] Remove JSC::g_stackBase
+        https://bugs.webkit.org/show_bug.cgi?id=51779
+
+        * wtf/StackBounds.cpp:
+
+2011-01-06  Joone Hur  <joone.hur@collabora.co.uk>
+
+        Reviewed by Eric Seidel.
+
+        WML Parser should treat line/column number in a consistent way
+        https://bugs.webkit.org/show_bug.cgi?id=51601
+
+        Add the equality operators to TextPosition class.
+
+        * wtf/text/TextPosition.h:
+        (WTF::TextPosition::operator==): Added.
+        (WTF::TextPosition::operator!=): Added.
+        (WTF::TextPosition::belowRangePosition): Use belowBase() instead of base().
+        (WTF::ZeroBasedNumber::operator==): Added.
+        (WTF::ZeroBasedNumber::operator!=): Added.
+        (WTF::OneBasedNumber::operator==): Added.
+        (WTF::OneBasedNumber::operator!=): Added.
+
+2011-01-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        [WINCE] Determine stack extent
+        https://bugs.webkit.org/show_bug.cgi?id=26276
+
+        Scan the stack for writeable pages and use the limits.
+
+        * wtf/StackBounds.cpp:
+        (WTF::detectGrowingDownward):
+        (WTF::isPageWritable):
+        (WTF::getLowerStackBound):
+        (WTF::getUpperStackBound):
+        (WTF::StackBounds::initialize):
+
+2011-01-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Revert change to additional library search path needed to find ICU.
+
+2011-01-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Debug and Release builds on Windows clobber each other
+        https://bugs.webkit.org/show_bug.cgi?id=49185
+        
+        Changes the structure of WebKitBuild build products directory so we
+        completely separate each build configuration into independent directories.
+        
+        Although we previously had per-configuration directories for obj, this change adds
+        per-configuration directories for bin, lib, obj, and include. Each configuration's
+        build products are stored within a directory inside of WebKitBuild.
+        
+        Most use of $(WebKitOutputDir) in the build files has been replaced by $(ConfigurationBuildDir),
+        defined in common.vsprops to be $(WebKitOutputDir)\$(ConfigurationName).
+        
+        For PGO, $(ConfigurationBuildDir) points to the same directory (Release_PGO) to allow
+        for proper operation of the instrumentation/optimization scripts.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePGOOptimize.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd:
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd:
+
+2011-01-05  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix.
+
+        * wtf/Encoder.h: Add <stdint.h> include for systems that
+        do not natively know about uint8_t, etc.
+
+2011-01-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [CMake] Fix the usage of SOURCE_GROUP
+        https://bugs.webkit.org/show_bug.cgi?id=51739
+
+        * CMakeLists.txt:
+
+2011-01-05  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt][V8] Fix the build after recent changes.
+
+        * pcre/pcre.pri: Correct the path after Source was introduced.
+
+2011-01-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix. Update path to FindSafari after source code reorganization.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+
+2011-01-04  Daniel Bates  <dbates@rim.com>
+
+        Fix the Android build after changeset 74975 <http://trac.webkit.org/changeset/74975>
+        (https://bugs.webkit.org/show_bug.cgi?id=51855).
+
+        * wtf/ThreadingPthreads.cpp: Add include of PassOwnPtr.h.
+        (WTF::runThreadWithRegistration): Use -> instead of . to dereference pointer.
+
+2011-01-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Try to fix the EFL build.
+
+        * wtf/CMakeLists.txt: Remove PlatformRefPtr from the CMake source list.
+
+2011-01-04  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        StackBounds initialization in WTFThreadData should be guarded by #if USE(JSC)
+        https://bugs.webkit.org/show_bug.cgi?id=51881
+
+        The StackBounds class is only used by JavaScriptCore.
+
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        * wtf/WTFThreadData.h:
+        (WTF::WTFThreadData::resetCurrentIdentifierTable):
+
+2011-01-03  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        Remove the last non-GObject usage of PlatformRefPtr and move the code to GRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=51846
+
+        * GNUmakefile.am: Remove PlatformRefPtr.h from the sources list.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * jit/ExecutableAllocator.h: Change references to PlatformRefPtr to RefPtr.
+        (JSC::ExecutableAllocator::cacheFlush): Ditto.
+        * wtf/PlatformRefPtr.h: Removed.
+        * wtf/RandomNumber.cpp: Change references to PlatformRefPtr to RefPtr.
+        (WTF::randomNumber): Ditto.
+        * wtf/brew/RefPtrBrew.h: Ditto.
+        (WTF::refIfNotNull): Added.
+        (WTF::derefIfNotNull): Added.
+        * wtf/brew/ShellBrew.h: Change references to PlatformRefPtr to RefPtr.
+        (WTF::createRefPtrInstance): Modified to return a RefPtr.
+        * wtf/gobject/GRefPtr.cpp: 
+        (WTF::refGPtr): Moved from PlatformRefPtr here.
+        (WTF::derefGPtr): Ditto.
+        * wtf/gobject/GRefPtr.h: Ditto.
+        (WTF::GRefPtr::GRefPtr): Ditto.
+        (WTF::GRefPtr::~GRefPtr): Ditto.
+        (WTF::GRefPtr::clear): Ditto.
+        (WTF::GRefPtr::isHashTableDeletedValue): Ditto.
+        (WTF::GRefPtr::get): Ditto.
+        (WTF::GRefPtr::operator*): Ditto.
+        (WTF::GRefPtr::operator->): Ditto.
+        (WTF::GRefPtr::operator!): Ditto.
+        (WTF::GRefPtr::operator UnspecifiedBoolType): Ditto.
+        (WTF::GRefPtr::hashTableDeletedValue): Ditto.
+        (WTF::::operator): Ditto.
+        (WTF::::swap): Ditto.
+        (WTF::swap): Ditto.
+        (WTF::operator==): Ditto.
+        (WTF::operator!=): Ditto.
+        (WTF::static_pointer_cast): Ditto.
+        (WTF::const_pointer_cast): Ditto.
+        (WTF::getPtr): Ditto.
+        (WTF::adoptGRef): Ditto.
+        (WTF::refGPtr): Ditto.
+        (WTF::derefGPtr): Ditto.
+
+2011-01-04  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Roben.
+
+        LEAK: Deallocate instance of ThreadFunctionInvocation if thread creation fails
+        https://bugs.webkit.org/show_bug.cgi?id=51860
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::createThreadInternal):
+
+2011-01-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt][Symbian] Make sure that WebKit headers are included before platform headers on Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=31273
+
+        On Symbian PREPEND_INCLUDEPATH is the best way to make sure that WebKit headers
+        are included before platform headers. On all other platforms continue to use
+        INCLUDEPATH (as before). This is a continuation of r65877.
+
+        No new tests as there is no new functionality.
+
+        * JavaScriptCore.pri:
+
+2011-01-04  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * wtf/ThreadingWin.cpp: Added include of PassOwnPtr.h. Fixed paragraphing
+        of conditional includes.
+        (WTF::wtfThreadEntryPoint): Use -> instead of . to dereference pointer.
+        (WTF::createThreadInternal): Tweaked #if to not need separate macro.
+
+2011-01-04  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Adam Roben.
+
+        Extract ThreadFunctionInvocation into separate file and share between Apple Windows and Android
+        https://bugs.webkit.org/show_bug.cgi?id=51855
+
+        Both the Apple Windows and Android ports implement a similar adapter structure,
+        called ThreadFunctionInvocation and ThreadData respectively, as part of
+        their thread creation process. Instead, we should share such an adapter
+        structure and remove duplicate code.
+
+        * JavaScriptCore.gypi: Added header wtf/ThreadFunctionInvocation.h.
+        * wtf/ThreadFunctionInvocation.h: Added.
+        (WTF::ThreadFunctionInvocation::ThreadFunctionInvocation):
+        * wtf/ThreadingPthreads.cpp: Removed Android-specific structure ThreadData; Instead, use ThreadFunctionInvocation.
+        (WTF::runThreadWithRegistration):
+        (WTF::createThreadInternal): 
+        * wtf/ThreadingWin.cpp: Moved structure ThreadFunctionInvocation to its own file so that
+        it can be shared with the Android implementation of createThreadInternal().
+        (WTF::wtfThreadEntryPoint): Use OwnPtr to hold passed instance of ThreadFunctionInvocation.
+
+2011-01-04  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Use __builtin_expect when compiling using RVCT in GNU mode
+        https://bugs.webkit.org/show_bug.cgi?id=51866
+
+        Derived from a patch by Dave Tapuska.
+
+        * wtf/AlwaysInline.h:
+
+2011-01-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        * wtf/Forward.h: Added Decoder and Encoder.
+
+2011-01-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add Encode/Decode machinery Darin and I plan to work with for back/forward stuff in WebKit2.
+
+        Starting out with a pure virtual interface to be implemented in WK2, but we might change that later.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+
+        * wtf/Decoder.h: Added.
+        * wtf/Encoder.h: Added.
+
+2011-01-03  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Qt] Add NullPtr.cpp introduced in r71155 to the Qt build system.
+
+        This fix is required for builds where HAVE(NULLPTR) is false
+        (e.g. some MSVC and Symbian builds).
+
+        * wtf/wtf.pri:
+
+2011-01-02  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Simon Fraser.
+
+        <rdar://problem/8812159> Update copyright strings
+
+        * Info.plist:
+
+2011-01-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix GTK+ build after r74855.
+
+        Reviewed by Xan Lopez.
+
+        * GNUmakefile.am: Fix include pathes.
+
+2011-01-02  Adam Barth  <abarth@webkit.org>
+
+        One more .. missing in the Qt build.
+
+        * jsc.pro:
+
+2011-01-02  Xan Lopez  <xlopez@igalia.com>
+
+        Fix GTK+ build.
+
+        * GNUmakefile.am: add -I$(srcdir)/Source to the JSC cppflags so
+        that anyone can include its headers without adding the prefix
+        'Source/'.
+
+2011-01-02  Carl Lobo  <carllobo@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Fix Windows Build for non-production where VSPropsRedirectionDir is not defined.
+        https://bugs.webkit.org/show_bug.cgi?id=51797
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2011-01-01  Adam Barth  <abarth@webkit.org>
+
+        Fix relative include paths in an attempt to fix the Qt build.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2011-01-01  Adam Barth  <abarth@webkit.org>
+
+        Another speculative build fix for GTK.
+
+        * GNUmakefile.am:
+
+2011-01-01  Adam Barth  <abarth@webkit.org>
+
+        Speculative build fix for GTK.  Update the paths in GNUmakefile to
+        include "Source".
+
+        * GNUmakefile.am:
+
+2011-01-01  Adam Barth  <abarth@webkit.org>
+
+        Update relative paths in JavaScriptCore.gyp to account for the extra
+        level of directories.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-12-31  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add a fast case for ASCII strings in HashAndUTF8CharactersTranslator::equal
+        https://bugs.webkit.org/show_bug.cgi?id=50517
+
+        This change shows about 2% performance win on the xml-parser benchmark.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::HashAndUTF8CharactersTranslator::equal):
+
+2010-12-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [CMake] Add WTF_HEADERS
+        https://bugs.webkit.org/show_bug.cgi?id=51741
+
+        Add the WTF headers to show them in Visual Studio.
+
+        * wtf/CMakeLists.txt:
+        * wtf/CMakeListsWinCE.txt:
+
+2010-12-30  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Reviewed by David Kilzer.
+
+        [Qt] Don't build wtf/TCSystemAlloc.cpp if --system-malloc option is
+        used
+        https://bugs.webkit.org/show_bug.cgi?id=51672
+
+        * wtf/wtf.pri: Replaced USE_SYSTEM_MALLOC with USE_SYSTEM_MALLOC=1
+
+2010-12-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use OS(WINDOWS) instead of COMPILER(MSVC) in FastMalloc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=51743
+
+        Most of the ifdefs belong to windows and not to the MSVC compiler.
+
+        * wtf/FastMalloc.cpp:
+
+2010-12-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 51724 - In strict mode string literals should allow \0, but disallow \8 and \9.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseString):
+
+2010-12-29  Helder Correia  <helder@sencha.com>
+
+        Reviewed by Eric Seidel.
+
+        <VT> and <FF> are not valid JSON whitespace characters
+        https://bugs.webkit.org/show_bug.cgi?id=51671
+
+        Vertical Tab and Form Feed are not allowed white spaces by the JSON
+        RFC 4627: http://www.ietf.org/rfc/rfc4627.txt (2. JSON Grammar).
+
+        Tests: ietestcenter/Javascript/15.12.1.1-0-2.html
+               ietestcenter/Javascript/15.12.1.1-0-3.html
+
+        * runtime/LiteralParser.cpp:
+        (JSC::isJSONWhiteSpace):
+        (JSC::LiteralParser::Lexer::lex):
+
+2010-12-28  Helder Correia  <helder@sencha.com>
+
+        Reviewed by Eric Seidel.
+
+        JSON.stringify must exist as a function taking 3 parameters
+        https://bugs.webkit.org/show_bug.cgi?id=51667
+
+        The reported function length is 1 instead.
+
+        Test: ietestcenter/Javascript/15.12.3-0-2.html
+
+        * runtime/JSONObject.cpp:
+
+2010-12-28  Helder Correia  <helder@sencha.com>
+
+        Reviewed by Sam Weinig.
+
+        JSON.parse must exist as a function taking 2 parameters
+        https://bugs.webkit.org/show_bug.cgi?id=51666
+
+        Support for revivers was introduced in bug 26591, but the function
+        length has since remained unchanged.
+
+        Test: ietestcenter/Javascript/15.12.2-0-2.html
+
+        * runtime/JSONObject.cpp:
+
+2010-12-27  Jake Helfert  <jake@jakeonthenet.com>
+
+        Reviewed and reworked by Darin Adler.
+
+        Building WebKit with Visual Studio 2010 fails due
+        to ambiguous assignment operator errors.
+        https://bugs.webkit.org/show_bug.cgi?id=51116
+
+        * wtf/NullPtr.h: Added a HAVE(NULLPTR) definition for use with
+        Platform.h HAVE macro, and included the Visual Studio 2010 compiler
+        as one of the ones that has nullptr.
+        * wtf/NullPtr.cpp: Updated condition to match.
+        
+        * wtf/PassOwnArrayPtr.h: Don't include the operator=(nullptr_t)
+        overload if we are compiling in loose mode and the compiler has
+        nullptr, because assignment of 0 will otherwise encounter
+        ambiguitity with this overload and the overload for loose mode
+        that takes a raw pointer. The conditional can be removed when we
+        get rid of loose mode.
+        * wtf/PassOwnPtr.h: Ditto.
+
+        * wtf/PassRefPtr.h: Don't include the operator=(nullptr_t) overload
+        if the compiler has nullptr, because assignment of 0 would be
+        ambiguous with the overload that takes a raw pointer. The conditional
+        can be removed if we ever decide we no longer need to support
+        assigning 0, but might need a way to catch that usage on older compilers.
+        * wtf/RefPtr.h: Ditto.
+        * wtf/RetainPtr.h: Ditto
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added NullPtr.cpp,
+        accidentally omitted when the file was first added.
+
+2010-12-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        [GTK] Add standalone target for JSC
+        https://bugs.webkit.org/show_bug.cgi?id=51607
+
+        * GNUmakefile.am: add convenience target to only build jsc and its
+        dependencies.
+
+2010-12-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [WINCE] Add CPU(MIPS) detection
+        https://bugs.webkit.org/show_bug.cgi?id=51342
+
+        WinCE usually defines MIPS and _MIPS_.
+
+        * wtf/Platform.h:
+
+2010-12-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename RegexCompiler.cpp to RegexPattern.cpp.
+        Implicitly call compileRegex from RegexPattern's constructor.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        * yarr/RegexCompiler.cpp: Removed.
+        * yarr/RegexCompiler.h: Removed.
+        * yarr/RegexInterpreter.cpp:
+        * yarr/RegexJIT.cpp:
+        * yarr/RegexPattern.cpp: Copied from JavaScriptCore/yarr/RegexCompiler.cpp.
+        (JSC::Yarr::compileRegex):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        * yarr/RegexPattern.h:
+
+2010-12-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for WinCE after r74360.
+
+        Move the OS(WINDOWS) section after the OS(WINCE) section
+        and add missing argument to the getStackMax call.
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2010-12-22  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        [Symbian] Make sure OSAllocatorSymbian builds
+
+        This patch only addresses the build problem.
+
+        https://bugs.webkit.org/show_bug.cgi?id=51128 tracks the full
+        (re)implementation of the Symbian allocator.
+
+        * wtf/OSAllocatorSymbian.cpp:
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+
+2010-12-22  Dan Bernstein  <mitz@apple.com>
+
+        Changed WebKitTools to Tools.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+
+2010-12-22  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Changed WebKitTools to Tools in script build phases.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-12-22  Andrei Popescu  <andreip@google.com>
+
+        Unreviewed build fix.
+
+        Fix Chromium Linux shared library build.
+        [Chromium] r74431 broke the Chromium Linux shared library build
+        https://bugs.webkit.org/show_bug.cgi?id=51462
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+
+2010-12-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r74462.
+        http://trac.webkit.org/changeset/74462
+        https://bugs.webkit.org/show_bug.cgi?id=51449
+
+        broke chromium win (Requested by tonyg-cr on #webkit).
+
+        * JavaScriptCore.gypi:
+
+2010-12-21  Tony Gentilcore  <tonyg@chromium.org>
+
+        Unreviewed build fix.
+
+        [chromium] Build fix after r74431
+        https://bugs.webkit.org/show_bug.cgi?id=51447
+
+        * JavaScriptCore.gypi:
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative build fix.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::underMemoryPressure):
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26276 - Need a mechanism to determine stack extent
+
+        This patch adds accurate stack size calculation for:
+            DARWIN, QNX, UNIX
+        We still need to fix:
+            WINDOWS, SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+         Reviewed by Geoff Garen.
+ 
+        <rdar://problem/8765333> CRASH running out of executable memory, loading io9.com
+        https://bugs.webkit.org/show_bug.cgi?id=51443
+
+        The problem here is that each page uses a reasonable amount of memory, (~4Mb),
+        and that when miultiple pages are open we keep all JIT code for all functions
+        in all pages alive.
+
+        Add a check to detect high memory pressure situations in the executable allocator
+        (>50% of available memory allocated), and upon a top level entry into JSC (no code
+        running on the stack) in this situation throw away all JIT code.
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): stop passing exec to recompile.
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutablePool::systemAlloc): Count allocations.
+        (JSC::ExecutablePool::systemRelease): Count deallocations.
+        (JSC::ExecutablePool::underMemoryPressure): Check memory pressure.
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::underMemoryPressure): Stub out; only meaningful with FixedVMPool.
+        * jit/ExecutableAllocatorWin.cpp:
+        (JSC::ExecutablePool::underMemoryPressure): Stub out; only meaningful with FixedVMPool.
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::recompile): Remove ExecState argument to recompile.
+        * runtime/Executable.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::recompileAllJSFunctions): throws away all JIT code.
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): add check / call to throw away.
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/8241425> JIT executable memory excessive usage due to regex caching
+        https://bugs.webkit.org/show_bug.cgi?id=51434
+
+        Reduce the amount of memory the RegExpCache can hold on to on iOS.
+        Currently the RegExpCache can hold 256 RegExp objects. If each falls into a separate
+        ExecutablePool, with a common size of 16Kb, this means we end up holding onto 4Mb of
+        memory. Firstly, we can reduce this by simply reducing the size of the cache to 32
+        entries. Secondly, we can use a separate set of ExecutablePools for JIT code generated
+        from RegExp objects. This helps in two ways (1) it increases the probability that
+        RegExps in the cache share the same pool, and (2) it means that a RegExp can't end
+        up holding on to a large ExecutablePool containing a translation of JS code.
+        (A RegExp could end up keeping a larger RegExp alive that happened to be sharing the
+        same pool, but large RegExp patterns are less common).
+
+        * runtime/JSGlobalData.h:
+        * runtime/RegExpCache.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Eeeep! build fix!
+
+        * wtf/OSAllocator.h:
+        (WTF::OSAllocator::decommitAndRelease):
+
+2010-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Ooops, fixed typo in comment.
+
+        * wtf/OSAllocator.h:
+
+2010-12-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough & Oliver Hunt.
+
+        Added PageAllocationAligned, a cross-platform abstraction for memory allocations with arbitrary alignment requirements
+        https://bugs.webkit.org/show_bug.cgi?id=51359
+        
+        I think this patch fixes <rdar://problem/8107952> [5.0.1] WER crash in
+        Heap::allocateBlock (1902752929), and some other leaks and crashes as well.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated build files.
+
+        * runtime/AlignedMemoryAllocator.h: Removed. Supplanted by
+        PageAllocationAligned.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::addWeakGCHandle):
+        * runtime/Collector.h: Switched from AlignedMemoryAllocator to
+        PageAllocationAligned.
+
+        * runtime/GCHandle.cpp:
+        * runtime/GCHandle.h: Ditto.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation): Removed aligned memory allocation
+        functions. Supplanted by PageAllocationAligned.
+
+        * wtf/PageAllocationAligned.cpp: Added.
+        (WTF::PageAllocationAligned::allocate):
+        (WTF::PageAllocationAligned::deallocate):
+        * wtf/PageAllocationAligned.h: Added.
+        (WTF::PageAllocationAligned::PageAllocationAligned): New cross-platform
+        class for doing aligned memory allocation. This class properly matches
+        allocation and deallocation library calls, fixing a long-standing bug
+        in PageAllocation.
+
+        * wtf/Platform.h: Removed some defunction VM platform defines.
+
+        * wtf/wtf.pri: Updated build files.
+
+2010-12-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        ASSERTION FAILED: base->index() == m_codeBlock->argumentsRegister() while loading taobao.com
+        https://bugs.webkit.org/show_bug.cgi?id=49006
+
+        This problem was caused by having a parameter named 'arguments'.
+        The fix is to treat parameters named 'arguments' as shadowing
+        the actual arguments property, and so logically turn the function
+        into one that doesn't "use" arguments.
+
+        This required a bit of fiddling in the parser to ensure we correctly
+        propagate the 'feature' of shadowing is set correctly.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+          Change assertion to an early return as we may now reference
+          a property named 'arguments' without being in a function that
+          has the ArgumentsFeature
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::declareParameter):
+        (JSC::JSParser::Scope::shadowsArguments):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::usesArguments):
+
+2010-12-21  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Eric Seidel and Darin Adler.
+
+        Deallocate GregorianDateTime.timeZone (if allocated) when copying so that we don't leak memory.
+        https://bugs.webkit.org/show_bug.cgi?id=51367
+
+        Inspired by a patch by George Staikos.
+
+        * wtf/DateMath.cpp:
+        (JSC::msToGregorianDateTime): Modified to set timeZone to nullptr since timeZone is now
+        of type OwnPtrArray<char>.
+        * wtf/DateMath.h: Change timeZone to type OwnArrayPtr<char>; Removed destructor since it is no longer needed.
+        (JSC::GregorianDateTime::GregorianDateTime): Modified to use OwnPtrArray semantics for timeZone.
+        (JSC::GregorianDateTime::operator tm): Ditto.
+        (JSC::GregorianDateTime::copyFrom): Ditto.
+
+2010-12-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r74402.
+        http://trac.webkit.org/changeset/74402
+        https://bugs.webkit.org/show_bug.cgi?id=51402
+
+        This patch broke the Windows 7 Release Layout Tests (Requested
+        by jessieberlin on #webkit).
+
+        * wtf/StackBounds.cpp:
+        (WTF::estimateStackBound):
+        (WTF::StackBounds::initialize):
+
+2010-12-21  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Unify the name of parentheses in YARR: rename parenthesis to
+        parentheses.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+
+2010-12-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Set BUILDING_QT__ consistently
+        https://bugs.webkit.org/show_bug.cgi?id=51341
+
+        * JavaScriptCore.pri: Remove the definition of BUILDING_QT__ as it
+        is already defined in WebKit.pri.
+
+2010-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26276 - Need a mechanism to determine stack extent
+
+        This patch adds accurate stack size calculation for:
+            DARWIN, WINDOWS, QNX, UNIX
+        We still need to fix:
+            SOLARIS, OPENBSD, SYMBIAN, HAIKU, WINCE
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2010-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        PPC build fix; stop using std::swap on PageAllocation/PageReservation,
+        this was failing on some compilers since the lack of default construction
+        for the m_executable/m_writable fields meant the value being swapped may
+        not have been fully initialized.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::deallocate):
+        * wtf/PageBlock.h:
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::deallocate):
+
+2010-12-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        |delete name| in strict mode code should be an early error
+        https://bugs.webkit.org/show_bug.cgi?id=50431
+
+        Disallow the |delete IDENTIFIER| production in strict mode, and removed
+        a bunch of now unnecessary code.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::jsParse):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h:
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+
+2010-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olver Hunt.
+
+        Bug 51358 - Should check stack depth rather than using recursion limits in byte compilation
+
+        The current implementation of recursion limit checking is not safe on smaller stacks.
+        Switch to using a common mechanism, shared with the parser, to check recursion limits.
+
+        Make bytecompiler use StackBounds. Empirical testing shows emitStrcat to have the largest
+        footprint on the stack, at just under 1k on x86-64.  Given this, the default recursion
+        check (requiring 4k of available space to recurse) seems reasonable.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+
+2010-12-20  Tony Gentilcore  <tonyg@chromium.org>
+
+        Unreviewed build fix.
+
+        Include pthread to fix chromium mac build (broken by r74360)
+        https://bugs.webkit.org/show_bug.cgi?id=51356
+
+        * wtf/StackBounds.cpp:
+
+2010-12-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        * GNUmakefile.am: add missing files.
+
+2010-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 26276 - Need a mechanism to determine stack extent
+
+        This patch adds a class 'StackBounds', to hold information about the machine stack.
+        The implementation of this class broadly adheres to the current implmentation of
+        stack limit checking, and as such does not solve the problem of determining stack
+        extent, but gives us a common place to do so.
+
+        Currently two mechanism are provided to determine the stack origin (the point the
+        stack is growing away from). currentThreadStackBase() in Collector provides a
+        more accurate determination of the stack origin, so use this to calculate
+        StackBounds::m_origin; WTFThreadData::approximatedStackStart is less accurate, and
+        as such can be removed.  Cache the StackBounds on WTFThreadData such that they
+        need only be determined once per thread, and for non-API contexts cache this
+        information in JSGlobalData, to save a thread-specific access.
+
+        For the time being retain the estimate of stack size used by JSC's parser
+        (128 * sizeof(void*) * 1024), with a view to replacing this with something more
+        accurate in the near future.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::canRecurse):
+        (JSC::JSParser::JSParser):
+            Change to use StackBounds.
+        * runtime/Collector.cpp:
+        (JSC::Heap::registerThread):
+        (JSC::Heap::markCurrentThreadConservativelyInternal):
+            Change to use StackBounds, cached on JSGlobalData.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::stack):
+            Add a cached copy of StackBounds.
+        * wtf/StackBounds.cpp: Copied from JavaScriptCore/runtime/Collector.cpp.
+        (WTF::estimateStackBound):
+        (WTF::StackBounds::initialize):
+        (WTF::getStackMax):
+            Copy code from Collector.cpp to determine stack origin.
+        * wtf/StackBounds.h: Added.
+        (WTF::StackBounds::StackBounds):
+            No argument constructor; returns a null StackBounds.
+        (WTF::StackBounds::currentThreadStackBounds):
+            Returns a StackBounds object representing the stack limits
+            of the current thread.
+        (WTF::StackBounds::origin):
+            Returns to stack origin (the point the stack is growing away
+            from; the highest extent of the stack on machines where the
+            stack grows downwards.
+        (WTF::StackBounds::recursionLimit):
+            Returns a limit value that is 'a comfortable distance from
+            the end of the stack'. Our concept of this is currently 1 page
+            away from the end, however the default value may be tuned in
+            the future, and clients may override passing a larger delta;
+            should only be called on StackBounds object representing the
+            stack of the thread this method is called on (checked by
+            checkConsistency).
+        (WTF::StackBounds::recursionCheck):
+            Checks whether we are currently 'a comfortable distance from
+            the end of the stack'. Our concept of this is currently 1 page
+            away from the end, however the default value may be tuned in
+            the future, and clients may override passing a larger delta
+            to apply when checking, if they wish to do so. This method
+            should only be called on StackBounds object representing the
+            stack of the thread this method is called on (checked by
+            checkConsistency).
+        (WTF::StackBounds::current):
+            Approximate current stack position. On machines where the stack
+            is growing downwards this is the lowest address that might need
+            conservative collection.
+        (WTF::StackBounds::isGrowingDownward):
+            True for all platforms other than WINCE, which has to check.
+        (WTF::StackBounds::checkConsistency):
+            This is called in methods that shoulds only be operating on a
+            valid set of bounds; as such we expect m_origin != m_bounds
+            (i.e. stack size != zero) - we're really testing that this
+            object is not null (the constructor initializes both fields
+            to zero).  Also checks that current() is within the stack's
+            bounds.
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        * wtf/WTFThreadData.h:
+        (WTF::WTFThreadData::stack):
+            Add the StackBounds member variable.
+
+2010-12-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Factored common page set management into a new PageBlock base class
+        https://bugs.webkit.org/show_bug.cgi?id=51285
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * wtf/PageAllocation.cpp: Removed.
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::deallocate):
+        (WTF::PageAllocation::PageAllocation):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::deallocate):
+        (WTF::PageReservation::PageReservation):
+        * wtf/wtf.pri:
+
+2010-12-17  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        RegExp Jit'ed expression crashes clicking link on yelp.com
+        https://bugs.webkit.org/show_bug.cgi?id=51284
+
+        When transitioning between an non-repeating beginning of line
+        anchored expression and the remaining refactored repeating 
+        expression, we should not clear any residual datalabel in 
+        state's m_backtrack.  It will be resolved and cleared in subsequent
+        code when linkAlternativeBacktracks() is called for the repeating
+        alternative(s).
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::clear):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::clearBacktrack):
+
+2010-12-17  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Updated for the renaming of WebKitTools to Tools
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+
+2010-12-17  Ariya Hidayat  <ariya@sencha.com>
+
+        Reviewed by Oliver Hunt.
+
+        [JSC] parseAssignmentExpression should use TreeBuilder::CreatesAST
+        https://bugs.webkit.org/show_bug.cgi?id=51268
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseAssignmentExpression):
+
+2010-12-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed RChunk from PageAllocation/PageReservation, since it's now unused.
+        https://bugs.webkit.org/show_bug.cgi?id=51276
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::PageReservation):
+
+2010-12-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Incorrect encoding of some constants in ARMv7 JIT
+        https://bugs.webkit.org/show_bug.cgi?id=51273
+        <rdar://problem/8650210>
+
+        When using immediate encoding 3 we need to write the byte
+        that holds a duplicated value.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::makeEncodedImm):
+
+2010-12-16  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] useless warnings when building on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=50985
+
+        Disable some compiler warnings that aren't indicative of real problems.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-12-16  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=51166
+        ExecutableAllocator::cacheFlush should call sys_cache_control
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush): Use the more correct and forward looking API -
+        sys_cache_control(kCacheFunctionPrepareForExecution,...).
+
+2010-12-16  Ariya Hidayat  <ariya@sencha.com>
+
+        Reviewed by Andreas Kling.
+
+        [JSC] Const correctness in ASTBuilder and SyntaxChecker
+        https://bugs.webkit.org/show_bug.cgi?id=51141
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::getName):
+        (JSC::ASTBuilder::getType):
+        (JSC::ASTBuilder::isResolve):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2010-12-15  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Web Audio API: port FFTFrame to MKL
+        https://bugs.webkit.org/show_bug.cgi?id=50986
+
+        Fixed bug in log2 emulation function provided for Windows port of
+        Web Audio API.
+
+        * wtf/MathExtras.h:
+        (log2):
+
+2010-12-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <http://webkit.org/b/51064> Reproducible crash inside WebCore::MediaPlayerPrivateQTKit::createQTMovie when loading <video>
+
+        * wtf/text/WTFString.h: Prevent String from being implicitly convertable to bool.
+        It was previously implicitly convertible to bool on Mac via operator NSString*,
+        but since that always has a non-zero return value it would give unexpected results.
+
+2010-12-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] [Symbian] Do not use pkg-config on Symbian as it is not supported
+        https://bugs.webkit.org/show_bug.cgi?id=50231
+
+        Guard CONFIG+=link_pkgconfig with !symbian.
+
+        * jsc.pro:
+
+2010-12-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Revert accidental change disabling the JIT for most platforms.
+
+        * wtf/Platform.h:
+
+2010-12-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Clang fails to build the JSC interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=51016
+
+        Clang does not allow indirect gotos out of scopes with cleanup. GCC 4.2 allows
+        them, but it does not correctly generate the cleanup, causing a leak if the
+        cleanup decrements a reference count.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Put an Identifier into its own scope.
+
+2010-12-14  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Simplify context-menu handling code
+        https://bugs.webkit.org/show_bug.cgi?id=49658
+
+        * wtf/PlatformRefPtr.h: Add leakRef()
+
+2010-12-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JavaScriptCore should not use "asm volatile" outside of a function
+        https://bugs.webkit.org/show_bug.cgi?id=50991
+
+        * jit/JITStubs.cpp: Remove the volatile keyword from asm statements.
+
+2010-12-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows production build fix.
+        Try copying ICU 4.6 in addition to 4.4 and 4.2.
+
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
+
+2010-12-13  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION: mobileme mail viewing is broken
+        https://bugs.webkit.org/show_bug.cgi?id=50884
+
+        Fixed problem where simple parenthesis (those without capture and
+        with a fixed count) where not propagating backtrack to labels for 
+        nested parentheses.  Also added the nesting level for the parentheses 
+        state created in that case as well.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyBacktrackToLabel):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+
+2010-12-13  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Reduce the size of the RegexStackSpaceForBackTrackInfoParentheses in YARR
+        https://bugs.webkit.org/show_bug.cgi?id=49385
+
+        Remove the BackTrackInfoParentheses struct prevBegin and prevEnd members.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        * yarr/RegexPattern.h:
+
+2010-12-10  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION Hang inside Yarr::RegexCodeBlock::execute when visiting
+        bugs.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=50816
+
+        First nested parentheses of the second or greater alternative
+        where backtracking to the prior parentheses.  Changed the default
+        handling of initial parentheses for all alternatives to go back
+        to the immediate outer paren.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::getTermIndex):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setParenthesesTail):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::getParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::processBacktracks):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+
+2010-12-11  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add an overload to makeString for Vector<char>
+        https://bugs.webkit.org/show_bug.cgi?id=50123
+
+        Also cleanup StringTypeAdapter.
+
+        * wtf/text/StringConcatenate.h:
+
+2010-12-10  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Build fix for Symbian: don't compile POSIX memory management implementation 
+        https://bugs.webkit.org/show_bug.cgi?id=50707
+
+        * wtf/wtf.pri:
+
+2010-12-10  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows production build fix.
+        
+        Don't stop if react-to-vsprops-changes.py exits with an error,
+        since this will occur in production builds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-12-10  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Turn on USE(CROSS_PLATFORM_CONTEXT_MENUS) for Windows.
+
+        * wtf/Platform.h:
+
+2010-12-10  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed, rolling out r73703.
+        http://trac.webkit.org/changeset/73703
+        https://bugs.webkit.org/show_bug.cgi?id=49658
+
+        This patch is causing crashes on the GTK+ bots.
+
+        * wtf/PlatformRefPtr.h:
+
+2010-12-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Cleanup StringWx.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=50525
+
+        Use StringImpl::createUninitialized to avoid memcpy and fix style issues.
+
+        * wtf/wx/StringWx.cpp:
+        (WTF::String::String):
+
+2010-12-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Simplify context-menu handling code
+        https://bugs.webkit.org/show_bug.cgi?id=49658
+
+        * wtf/PlatformRefPtr.h:
+
+2010-12-09  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION (r73065?): A regex no longer works 
+        https://bugs.webkit.org/show_bug.cgi?id=50570
+
+        Changed the handling of adjacent parentheses backtracks in two ways.
+        First, only outer most paren backtracks default to back tracking
+        to the "next character" looping code.  Second, added a jump around 
+        backtracks that fall through to the next backtrack where the
+        second backtrack has some greedy processing before the backtracking
+        from outside the parentheses code.
+        Also cleaned up extraneous white spce, removing white space at the
+        end of or that makes up a whole line.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::GenerationState::GenerationState):
+        (JSC::Yarr::RegexGenerator::GenerationState::incrementParenNestingLevel):
+        (JSC::Yarr::RegexGenerator::GenerationState::decrementParenNestingLevel):
+        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::RegexGenerator::GenerationState::emitParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::setNextIteration):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+
+2010-12-09  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Addressed the "FIXME" issues in array sort for toString() methods that
+        mutate the array in either size or contents.  The change is to mark
+        the temporary array contents so that they are not garbage collected
+        and to make sure the array is large enough to hold the contents
+        of the sorted temporary vector.
+        https://bugs.webkit.org/show_bug.cgi?id=50718
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::addTempSortVector):
+        (JSC::Heap::removeTempSortVector):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/Collector.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort):
+        * runtime/JSValue.h:
+
+2010-12-09  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed setting of backtrack labels to not overwrite a prior
+        label.  Where losing prior labe which then reverted back to 
+        next character label.
+        https://bugs.webkit.org/show_bug.cgi?id=50579
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackToLabel):
+
+2010-12-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Permit Character Class Escape in CharacterRange in Character Class.
+        https://bugs.webkit.org/show_bug.cgi?id=50483
+        https://bugs.webkit.org/show_bug.cgi?id=50538
+        https://bugs.webkit.org/show_bug.cgi?id=50654
+        https://bugs.webkit.org/show_bug.cgi?id=50646
+
+        We recently tightened up our spec conformance in generating syntax
+        error in these cases, however testing in the wild has shown this
+        to be problematic. This reverts the previous change in allowing
+        class escapes (e.g. \d) in ranges in character classes ([]), but
+        does retain some closer conformance to the spec in only allowing
+        ranges that would be permitted per the grammar rules in the spec
+        (e.g. in /[\d-a-z]/ "a-z" cannot be considered as a range).
+
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::parse):
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Try to fix crash-on-launch seen on Windows builder.
+
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::OSAllocator::release): Disabled an ASSERT, because it checks for
+        a bug that hasn't been fixed yet.
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def file.
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def
+        file to remove a symbol -- the next build failure will say which symbol
+        to add back.
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated .def file.
+
+2010-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix GTK Linux build.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/AlignedMemoryAllocator.h:
+        (JSC::::AlignedMemoryAllocator): Updated for Usage enum moving to OSAllocator.
+
+2010-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Migrated OS-specific allocation code from PageReservation and PageAllocation to OSAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=50653
+
+        * JavaScriptCore.exp: Updated for new function signature.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator): Removed checkAllocatedOkay.
+        OSAllocator is now the central location for verifying that allocation succeeds.
+        This allowed me to remove some complicating cross-platform cruft.
+
+        * runtime/AlignedMemoryAllocator.h:
+        (JSC::::allocate): Updated for code motion.
+
+        * wtf/OSAllocator.h: Added Usage, writable, and executable parameters, to
+        support VM features required by clients of PageAllocation and PageReservation.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit): Moved PageAllocation support for randomizing
+        executable memory here.
+
+        * wtf/OSAllocatorSymbian.cpp:
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit): Updated for new function signatures.
+
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::protection):
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::release): Updated for new function signatures. Moved
+        some protection-related and WINCE-related code from PageAllocation here.
+
+        * wtf/PageAllocation.cpp: Nixed cross-platform lastError abstraction, since
+        it was only used by checkAllocatedOkay, which is now gone.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::allocate):
+        (WTF::PageAllocation::allocateAligned):
+        (WTF::PageAllocation::deallocate):
+        (WTF::PageAllocation::isPowerOfTwo):
+        (WTF::PageAllocation::systemAllocateAligned): Removed system* functions,
+        and replaced calls to them with calls to OSAllocator.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::reserve):
+        (WTF::PageReservation::deallocate):
+        (WTF::PageReservation::PageReservation): Ditto. Added m_writable and
+        m_executable because these flags are now required when committing memory.
+
+2010-12-08  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add web audio files to mac port Xcode projects
+        https://bugs.webkit.org/show_bug.cgi?id=50721
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-12-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Marking the active global object re-enters through markConservatively
+        https://bugs.webkit.org/show_bug.cgi?id=50711
+
+        draining of the MarkStack is not allowed to be re-entrant, we got away
+        with this simply due to the logic in MarkStack::drain implicitly handling
+        changes that could be triggered by the re-entry.
+
+        Just to be safe this patch removes the re-entry through markConservatively
+        so we don't accidentally introduce such an issue in future.  I've also
+        added an assertion to catch such errors.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::markCurrentThreadConservativelyInternal):
+        (JSC::Heap::markOtherThreadConservatively):
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+
+2010-12-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Share code between Mac (CA) and Windows (CACF) GraphicsLayer implementations
+        https://bugs.webkit.org/show_bug.cgi?id=49388
+
+        Added a WTF_PLATFORM_CA flag. Set when platform is MAC or IOS or (WINDOWS AND CG)
+        which was decided was the best way to identify a build with CoreAnimation
+
+        * wtf/Platform.h:
+
+2010-12-07  Anders Carlsson  <andersca@apple.com>
+
+        Build fix follow up build fix.
+
+        * pcre/pcre_ucp_searchfuncs.cpp:
+        (jsc_pcre_ucp_othercase):
+
+2010-12-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix clang++ build
+        https://bugs.webkit.org/show_bug.cgi?id=50645
+
+        Explicitly cast offset to int.
+
+        * pcre/pcre_ucp_searchfuncs.cpp:
+        (jsc_pcre_ucp_othercase):
+
+2010-12-07  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by David Levin.
+
+        Fix compilation of core web audio files on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=50603
+
+        Added log2 definition to MathExtras.h on Windows platform.
+
+        * wtf/MathExtras.h:
+        (log2):
+
+2010-12-07  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=50412
+        http://www.wunderground.com/US/CA/Hayward.html causes big memory spike during page loading 
+        
+        Creating a substring caused the original string be flattened if it was in the rope form. This could use
+        significant amount of memory by reducing buffer sharing between strings.
+        
+        Add a rope specific substring function that constructs the substring by reusing the rope fibers
+        instead of flattening the rope.
+        
+        No change observed in SunSpider.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::substringFromRope):
+        * runtime/JSString.h:
+        (JSC::jsSubstring):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+
+2010-12-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Simplified some ASLR-related code in PageAllocation/Reservation
+        https://bugs.webkit.org/show_bug.cgi?id=50599
+        
+        Removed reserveAt, allocateAt, and friends, since they all existed to
+        serve one feature: ASLR for executable memory on x86_64 on Mac. Moved
+        ASLR code down into systemAllocate -- now, any time you allocate
+        executable memory on a supporting platform, the memory's location is
+        randomized.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator): No need for the caller
+        to randomize anything.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::systemAllocate): Removed some *At() functions, and
+        beefed up executable allocation with randomization.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::systemReserve): Removed some *At() functions.
+
+2010-12-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reserveAndCommit doesn't commit on MADVISE_FREE_REUSE systems
+        https://bugs.webkit.org/show_bug.cgi?id=50588
+        
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit): Tightened up some comments. Changed
+        reserveAndCommit to actually commit on MADVISE_FREE_REUSE systems.
+
+2010-12-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Add build system
+        https://bugs.webkit.org/show_bug.cgi?id=50522
+
+        * CMakeListsWinCE.txt: Added.
+        * shell/CMakeListsWinCE.txt: Added.
+        * wtf/CMakeListsWinCE.txt: Added.
+
+2010-12-06  John Tantalo  <john.tantalo@gmail.com>
+
+        Reviewed by Geoffrey Garen.
+
+        jsc does not ignore shebang
+        https://bugs.webkit.org/show_bug.cgi?id=49576
+
+        * jsc.cpp:
+        (fillBufferWithContentsOfFile):
+          - translate shebang into a valid JavaScript comment so the lexer ignores it
+
+2010-12-05  Adam Roben  <aroben@apple.com>
+
+        Windows production build fix
+
+        Put spaces after trailing backslashes when setting
+        %WebKitVSPropsRedirectionDir%. According to MSDN
+        <http://msdn.microsoft.com/en-us/library/2kzfk8c7(v=VS.80).aspx>:
+
+           A backslash ( \ ) followed by a newline character is interpreted as
+           a space in the command; use a backslash at the end of a line to
+           continue a command onto the next line. NMAKE interprets the
+           backslash literally if any other character, including a space or
+           tab, follows the backslash.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2010-12-04  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, build fix after r69132.
+
+        * shell/CMakeLists.txt: Fix directory name (jsc -> shell).
+
+2010-12-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Drop GdkDrawable usage, it's deprecated in GTK+3.x and we can use GdkWindow
+        https://bugs.webkit.org/show_bug.cgi?id=50451
+
+        * wtf/gobject/GTypedefs.h: add GdkWindow defines.
+
+2010-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Bug 50509 - set* methods on MacroAssembler are awfully named.
+
+        Methods set32 and setTest32 compare 32-bit operands, and set a 32-bit results based on the comparison.
+        set8 compares 32-bit operands, and sets an 8-bit result based on the comparison.
+        setTest8 compares 8-bit operands, and sets a 32-bit result based on the comparison.
+
+        Rename to clarify.
+
+        set32 -> set32Compare32
+        setTest32 -> set32Test32
+        set8 -> set8Compare32
+        setTest8 -> set32Test8
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::setPtr):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::set32Compare32):
+        (JSC::MacroAssemblerARM::set8Compare32):
+        (JSC::MacroAssemblerARM::set32Test32):
+        (JSC::MacroAssemblerARM::set32Test8):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::set32Compare32):
+        (JSC::MacroAssemblerARMv7::set8Compare32):
+        (JSC::MacroAssemblerARMv7::set32Test32):
+        (JSC::MacroAssemblerARMv7::set32Test8):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::set8Compare32):
+        (JSC::MacroAssemblerMIPS::set32Compare32):
+        (JSC::MacroAssemblerMIPS::set32Test8):
+        (JSC::MacroAssemblerMIPS::set32Test32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::set8Compare32):
+        (JSC::MacroAssemblerX86Common::set32Compare32):
+        (JSC::MacroAssemblerX86Common::set32Test8):
+        (JSC::MacroAssemblerX86Common::set32Test32):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+
+2010-12-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Incorrect logic for returning memory at the end of linking.
+        Reviewed by Geoff Garen.
+
+        At the end of linking we return any space at the end of the
+        allocated executable region that was saved due to branch
+        compaction.  This is currently by done by subtracting the
+        different from the m_freePtr in the allocation pool.  This
+        can be incorrect if your allocation was made from a new
+        page that was not selected for subsequent allocations.
+
+        This patch corrects this behaviour by verifying that the
+        memory being returned actually comes from the current
+        allocation pool.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::tryShrink):
+
+2010-12-03  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough
+
+        Changes to significantly reduce branches to branches in JIT'ed
+        parentheses backtrack processing.  The changes include the following:
+        - Taking the backtracking processing out of line and adding it as
+          code at the end of the JIT'ed routine.
+        - Allow backtracks to be direct via an indirect branch for an address
+          pushed onto the stack.  If the use of an indirect branch is from a
+          conditional jump, then we emit a trampoline at the end of the 
+          routine.
+        - Propogate backtracks instead of adding trampolines.  Backtracks are
+          propogated to where they are used.  This change also eliminated 
+          trampoline branch code that aren't used.
+        - Added global expression state to keep track of parentheses tail
+          code and indirect branches.
+        Other changes made to support these changes.
+        - Split invertOrCapture flag on Patterns to two separate flags.  Added
+          getters for these flags.  Rippled these changes to both the JIT 
+          and interpreter code.
+        - Split BacktrackDestination out off TermGenerationState struct.
+          This is done to hold references to a backtrack for later code
+          generation.
+        https://bugs.webkit.org/show_bug.cgi?id=50295
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::JmpDst::isSet):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::JmpDst::isSet):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Label::isSet):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::isUsed):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::used):
+        (JSC::AbstractMacroAssembler::JumpList::clear):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::JmpDst::isSet):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpDst::isSet):
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeBeginTerms):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BackReference):
+        (JSC::Yarr::ByteTerm::invert):
+        (JSC::Yarr::ByteTerm::capture):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::IndirectJumpEntry::IndirectJumpEntry):
+        (JSC::Yarr::RegexGenerator::IndirectJumpEntry::addJump):
+        (JSC::Yarr::RegexGenerator::GenerationState::GenerationState):
+        (JSC::Yarr::RegexGenerator::GenerationState::addIndirectJumpEntry):
+        (JSC::Yarr::RegexGenerator::GenerationState::emitIndirectJumpTable):
+        (JSC::Yarr::RegexGenerator::GenerationState::addParenthesesTail):
+        (JSC::Yarr::RegexGenerator::GenerationState::emitParenthesesTail):
+        (JSC::Yarr::RegexGenerator::GenerationState::addJumpToNextInteration):
+        (JSC::Yarr::RegexGenerator::GenerationState::addJumpsToNextInteration):
+        (JSC::Yarr::RegexGenerator::GenerationState::addDataLabelToNextIteration):
+        (JSC::Yarr::RegexGenerator::GenerationState::linkToNextIteration):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::BacktrackDestination):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::clear):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::clearDataLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::haveDestination):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::isStackOffset):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::isLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::isJumpList):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::haveDataLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyTarget):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::copyTo):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::addBacktrackJump):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setStackOffset):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setNextBacktrackLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackToLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackJumpList):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setBacktrackSourceLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setDataLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::setSubDataLabelPtr):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkToNextBacktrack):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::getStackOffset):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::getLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::getBacktrackJumps):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::getDataLabel):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkDataLabelToHereIfExists):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkAlternativeBacktracks):
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::linkAlternativeBacktracksTo):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::clearBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::addBacktrackJump):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setDataLabelPtr):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBackTrackStackOffset):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackLabel):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracks):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracksTo):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackLink):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::chainBacktracks):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::chainBacktrackJumps):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::getBacktrackDestination):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::ParenthesesTail):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::processBacktracks):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::setNextIteration):
+        (JSC::Yarr::RegexGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::RegexGenerator::generateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::compile):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::invert):
+        (JSC::Yarr::PatternTerm::capture):
+
+2010-12-03  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        First steps to adding web audio files to build systems
+        https://bugs.webkit.org/show_bug.cgi?id=49952
+
+        * wtf/Complex.h:
+
+2010-12-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Move StringWx.cpp into wtf directory
+        https://bugs.webkit.org/show_bug.cgi?id=50060
+
+        * wtf/wx/StringWx.cpp: Renamed from WebCore/platform/text/wx/StringWx.cpp.
+        (WTF::String::String):
+
+2010-12-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Move StringBrew.cpp into wtf directory
+        https://bugs.webkit.org/show_bug.cgi?id=50058
+
+        * wtf/brew/StringBrew.cpp: Renamed from WebCore/platform/text/brew/StringBrew.cpp.
+        (WTF::String::String):
+
+2010-12-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Move StringHaiku.cpp into wtf directory
+        https://bugs.webkit.org/show_bug.cgi?id=50057
+
+        * wtf/haiku/StringHaiku.cpp: Renamed from WebCore/platform/text/haiku/StringHaiku.cpp.
+        (WTF::String::String):
+        (WTF::String::operator BString):
+
+2010-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::synchronize): Added a non-CF implementation.
+
+2010-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed <rdar://problem/8310571> CrashTracer: 60 crashes in Photo Booth at
+        com.apple.JavaScriptCore: JSC::Heap::markRoots + 746
+        
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Call our new
+        synchronize() function.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::activityCallback):
+        * runtime/Collector.h: Added an activityCallback() accessor, for the
+        call above.
+
+        * runtime/GCActivityCallback.h:
+        (JSC::GCActivityCallback::synchronize):
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::operator()):
+        (JSC::DefaultGCActivityCallback::synchronize): Track the run loop we're
+        scheduled in. If we begin/resume execution within a new run loop, reschedule
+        on it. This prevents a crash when using a lockless context group on
+        multiple threads -- the crash would happen if the GC timer scheduled on
+        thread A, then you continued execution on thread B, then the thread A
+        timer fired.
+
+2010-12-02  Darin Adler  <darin@apple.com>
+
+        * wtf/ASCIICType.h: Fix wrong type from last check-in.
+
+2010-12-02  Darin Adler  <darin@apple.com>
+
+        Try to fix certain builds (Qt Windows).
+
+        * wtf/ASCIICType.h: Added an overload for unsigned because in obsolete
+        versions of ICU, UChar32 can be a typedef for unsigned. Adding this
+        overload should make us compatible with these old ICUs.
+
+2010-12-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add AtomicString::fromUTF8
+        https://bugs.webkit.org/show_bug.cgi?id=45594
+
+        Unicode::calculateStringHashFromUTF8 creates a StringHash out of UTF8 input data and
+        calculates the required length for the UTF16 conversation in one step.
+        This is then used in a specialized translator for the string table of AtomicString.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::CStringTranslator::equal):
+        (WTF::HashAndUTF8CharactersTranslator::hash):
+        (WTF::HashAndUTF8CharactersTranslator::equal):
+        (WTF::HashAndUTF8CharactersTranslator::translate):
+        (WTF::AtomicString::add):
+        (WTF::AtomicString::addSlowCase):
+        (WTF::AtomicString::find):
+        (WTF::AtomicString::fromUTF8):
+        * wtf/text/AtomicString.h:
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::readUTF8Sequence):
+        (WTF::Unicode::convertUTF8ToUTF16):
+        (WTF::Unicode::calculateStringHashFromUTF8):
+        (WTF::Unicode::equalUTF16WithUTF8):
+        * wtf/unicode/UTF8.h:
+
+2010-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added a little hardening to OSAllocator.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::release):
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::release): CRASH() if the OS's virtual memory system
+        reports an error.
+
+2010-12-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        [Qt] Make platform managing of OSAllocator better than r73106
+        https://bugs.webkit.org/show_bug.cgi?id=50385
+
+        * wtf/OSAllocatorPosix.cpp: Remove platform specific guard.
+        * wtf/OSAllocatorSymbian.cpp: Remove platform specific guard.
+        * wtf/OSAllocatorWin.cpp: Remove platform specific guard.
+        * wtf/wtf.pri: Add the correct platform specific source file instead of all of them.
+
+2010-12-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Use GetTickCount() for srand()
+        https://bugs.webkit.org/show_bug.cgi?id=50338
+
+        time() is not a native function on WinCE, so use GetTickCount() instead.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2010-12-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] [Symbian] Reintroduce compiler optimizations for JSC
+        https://bugs.webkit.org/show_bug.cgi?id=50270
+
+        Add compiler optimization (symbian ARM target) which was lost after split from WebCore.
+        Tested via Sunspider and V8 - both of which show significant performance improvement.
+
+        * JavaScriptCore.pro:
+
+2010-12-02  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Move regex parsing and fallback handling to runtime/RegExp.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=50015
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::printTraceData):
+        * runtime/RegExp.h:
+        (JSC::RegExp::pattern):
+        * yarr/RegexInterpreter.cpp:
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::setFallBack):
+        (JSC::Yarr::RegexCodeBlock::isFallBack):
+        (JSC::Yarr::executeRegex):
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the GTK build.
+
+        * GNUmakefile.am: Use a full path to OSAllocator*.cpp.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the EFL Linux build.
+
+        * CMakeListsEfl.txt: Added OSAllocator to the project.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: Include all OS files for Qt's sake, and then
+        use #ifdefs in the files to exclude things based on OS.
+        
+        This is a pretty bad way to manage platforms -- hopefully we can
+        fix the Qt build system and move away from this in the future.
+
+        * wtf/OSAllocatorPosix.cpp:
+        * wtf/OSAllocatorSymbian.cpp:
+        * wtf/OSAllocatorWin.cpp:
+        * wtf/wtf.pri:
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Chromium build.
+        
+        * JavaScriptCore.gypi: This is a Windows build file, so use OSAllocatorWin.cpp.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the GTK build.
+
+        * GNUmakefile.am: Added OSAllocator to another project.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the GTK Linux build.
+
+        * JavaScriptCore.gypi: Added OSAllocator to the project.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt Linux build.
+
+        * wtf/OSAllocatorPosix.cpp: Use the right errno.h.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build: export some more symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt Linux build.
+
+        * wtf/wtf.pri: Use the POSIX OSAllocator for Qt Linux.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: commit doesn't have a return value.
+
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::OSAllocator::commit):
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Export some symbols.
+
+        * JavaScriptCore.exp:
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Export OSAllocator.h as private
+        so other projects can see it.
+
+        * wtf/OSAllocatorPosix.cpp: #include UnusedParam.h for UNUSED_PARAM.
+
+2010-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Baby step toward a cross-platform virtual memory abstraction: created
+        an all-static OSAllocator class and changed MarkStack to use it.
+
+        * JavaScriptCore.exp: These functions are inlined now.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added OSAllocatorWin.cpp.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added OSAllocatorPosix.cpp.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack): Use OSAllocator instead of rolling our
+        own platform-specific code.
+
+        * runtime/MarkStackNone.cpp: Removed. Nothing used this.
+
+        * runtime/MarkStackPosix.cpp: 
+        * runtime/MarkStackSymbian.cpp:
+        * runtime/MarkStackWin.cpp: Removed custom platform-specific code, since
+        we use the OSAllocator abstraction now.
+
+        * wtf/OSAllocator.h: Added.
+        * wtf/OSAllocatorPosix.cpp: Added.
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::release):
+        * wtf/OSAllocatorSymbian.cpp: Added.
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::release):
+        * wtf/OSAllocatorWin.cpp: Added.
+        (WTF::OSAllocator::reserve):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::release): The new OSAllocator abstraction.
+
+        * wtf/wtf.pri: Added OSAllocatorSymbian.cpp.
+
+2010-12-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WinCairo build should not use link-time code generation (LTCG)
+        https://bugs.webkit.org/show_bug.cgi?id=50353
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+010-12-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        vcproj changes can't be applied cleanly by the Windows EWS bot
+        https://bugs.webkit.org/show_bug.cgi?id=50328
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Added property svn:eol-style.
+
+2010-12-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 50298 - /()()()()()()()()()(?:(\10a|b)(X|Y))+/.exec("bXXaYYaY") ASSERTs
+
+        For unmatched subpattens we previously used to set the subpattern end to -1,
+        but now we only set the start value. E.g. consider the following:
+            /a(b)?c/.exec("ac");
+        Previously we would generate an internal results array of:
+            [ 0, 2, -1, -1 ]
+        Since fairly recently we have generated results of:
+            [ 0, 2, -1, ??? ]
+        (With the end index of the subpattern uninitialized).
+
+        Update these ASSERTs to account for this.
+
+        Also, when stripping out self-referencing backreferences, (e.g. /(\1)/) we
+        were checking the wrong property on the pattern term. We should have been
+        looking at term.parentheses.subpatternId, but instead were checking
+        term.subpatternId. The latter is actually only the subpatternId for
+        back reference terms. Rename this to backReferenceSubpatternId.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+
+2010-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Bug 50297 - \s in YARR should match BOMs.
+
+        From section 15.10.2.12 CharacterClassEscape contains:
+
+        The production CharacterClassEscape :: s evaluates by returning the set of characters containing the
+        characters that are on the right-hand side of the WhiteSpace (7.2) or LineTerminator (7.3) productions.
+
+        Table 2 in section 7.2 contains:
+
+        \uFEFF Byte Order Mark <BOM>
+
+        * create_regex_tables:
+            Add BOM to spaces table.
+
+2010-11-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed review comments following bug #48101.
+        Mostly typos, plus gave quantifyInfinite a symbolic name.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::checkForTerminalParentheses):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::parse):
+
+2010-11-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WTF project missing build-stopping code from its pre-build event
+        https://bugs.webkit.org/show_bug.cgi?id=50281
+
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd:
+
+2010-11-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Cleanup UTF8.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=49581
+
+        Use macros and functions instead of range values directly.
+
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::inlineUTF8SequenceLength):
+        (WTF::Unicode::UTF8SequenceLength):
+        (WTF::Unicode::convertUTF16ToUTF8):
+        (WTF::Unicode::readUTF8Sequence):
+        (WTF::Unicode::convertUTF8ToUTF16):
+        * wtf/unicode/UnicodeMacrosFromICU.h: Added U_IS_SUPPLEMENTARY macro.
+
+2010-11-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed a crash seen when using a PageAllocation to store itself.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::systemDeallocate): Zero out m_base before unmapping
+        it, in case unmapping m_base unmaps the PageAllocation.
+
+        * wtf/BumpPointerAllocator.h:
+        (WTF::BumpPointerPool::destroy): Now this work-around isn't needed!
+
+2010-11-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        m_hasNonEnumerableProperties is never initialized in Structure
+        https://bugs.webkit.org/show_bug.cgi?id=50266
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): initialize member variable.
+
+2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix (part 1). Use correct environment variable syntax in cmd files.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreLink.cmd:
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd:
+        * JavaScriptCore.vcproj/jsc/jscPreLink.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd:
+        * JavaScriptCore.vcproj/testapi/testapiPreLink.cmd:
+
+2010-11-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WTF support for <rdar://problem/8650085> adding word-prefix search options to the text search API.
+        https://bugs.webkit.org/show_bug.cgi?id=50038
+
+        * wtf/unicode/UnicodeMacrosFromICU.h: Copied additional macros from icu/unicode/utf16.h.
+
+2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        JavaScriptCore projects on Windows should use cmd files for build events
+        https://bugs.webkit.org/show_bug.cgi?id=50193
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreLink.cmd: Added.
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd: Added.
+        * JavaScriptCore.vcproj/jsc/jscPreLink.cmd: Added.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd: Added.
+        * JavaScriptCore.vcproj/testapi/testapiPreLink.cmd: Added.
+
+2010-11-29  Dai Mikurube  <dmikurube@google.com>
+
+        Reviewed by Kent Tamura.
+
+        when empty, clicking "down" on outer-spin-button returns "max value"
+        https://bugs.webkit.org/show_bug.cgi?id=45491
+
+        It is required to calculate UTC/DST offsets to retrieve the current local milliseconds for
+        date/time type inputs. WTF::currentTimeMS() returns a UTC time, and WTF::getLocalTime()
+        returns a struct tm, not milliseconds.
+
+        Calculating milliseconds from a struct tm is not simple since timegm() cannot be used in all
+        environments. This calculation is already done in calculateUTCOffset(), and complicated.
+        Duplicating this complicated calculation is unreasonable because of maintainability.
+        To achieve this without duplication, we must call calculate{UTC|DST}Offset in some way.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DateMath.cpp: Changed calculateUTCOffset() and calculateDSTOffset() to external functions.
+        (WTF::calculateUTCOffset):
+        (WTF::calculateDSTOffset):
+        * wtf/DateMath.h:
+
+2010-11-29  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Switch web audio code to use FloatPoint3D instead of Vector3
+        https://bugs.webkit.org/show_bug.cgi?id=50186
+
+        * wtf/Vector3.h: Removed.
+
+2010-11-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a mechanism for Windows pre-build/pre-link/post-build events to be separated into individual cmd files
+        https://bugs.webkit.org/show_bug.cgi?id=49858
+
+        We're migrating our prebuild/prelink/postbuild steps out of vcproj and vsprops files:
+        - To simplify editing (editing vsprops build steps is confusing).
+        - For more readable diffs.
+
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd: Added.
+
+2010-11-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improved accuracy of command-line SunSpider.
+
+        * jsc.cpp:
+        (functionRun): Changed the "run" function to run a given test in
+        its own global object. Previously, all tests ran in the same global
+        object, which created name conflicts, and made globals from previous
+        tests artificially survive into later tests.
+        
+        Also changed "run" to return the elapsed milliseconds when running a
+        given test, for slightly more accurate numbers.
+
+        (functionCheckSyntax): Ditto on returning elapsed milliseconds.
+
+2010-11-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Andreas Kling.
+
+        Remove a couple unneeded overflow checks
+        https://bugs.webkit.org/show_bug.cgi?id=49816
+
+        * wtf/text/CString.cpp:
+        (WTF::CString::init): Use an ASSERT instead of
+        an overflow check with CRASH.
+
+2010-11-29  Adam Roben  <aroben@apple.com>
+
+        Robustify react-to-vsprops-changes.py against changes to its location
+        or the location of the .vsprops files
+
+        Suggested by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        Removed file_modification_times.
+        (main): Use glob.glob to find the .vsprops files and assert that we found some.
+
+2010-11-29  Adam Roben  <aroben@apple.com>
+
+        Touch wtf/Platform.h whenever any .vsprops file changes
+
+        This will cause all files to be recompiled, which will make changes to
+        preprocessor macros (e.g., ENABLE_*) actually take effect.
+
+        Fixes <http://webkit.org/b/50167> Windows build fails when ENABLE_*
+        macros are changed (because not enough files are rebuilt)
+
+        Reviewed by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Touch wtf/Platform.h if it's older than any .vsprops file. Also
+        added some comments and logging to make it clearer what the script is
+        doing and why.
+
+2010-11-29  Adam Roben  <aroben@apple.com>
+
+        Update react-to-vsprops-changes.py after r72555
+
+        .vsprops files are no longer accessed relative to $WebKitLibrariesDir.
+
+        Fixes <http://webkit.org/b/50166> REGRESSION (r72555):
+        react-to-vsprops-changes.py no longer works for people with a
+        non-default $WebKitLibrariesDir
+
+        Reviewed by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Always look in WebKitLibraries/win for .vsprops files, not in
+        $WebKitLibrariesDir.
+
+2010-11-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 48100 - YARR allows what seems like a bogus character-class range
+
+        Per ECMA-262 character classes containing character ranges containing
+        character classes are invalid, eg:
+            /[\d-x]/
+            /[x-\d]/
+            /[\d-\d]/
+        These should throw a syntax error.
+
+        * yarr/RegexParser.h:
+
+2010-11-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 48101 - Yarr gives different results for /(?:a*?){2,}/
+
+        The test cases in the linked mozilla bug demonstrate a couple of
+        problems in subpattern matching. These bugs lie in the optimized
+        cases - for matching parentheses with a quantity count of 1, and
+        for matching greedy quantified parentheses at the end of a regex
+        (which do not backtrack).
+
+        In both of these cases we are failing to correctly handle empty
+        matches. In the case of parentheses-single matches (quantity count
+        one) we are failing to test for empty matches at all. In the case
+        of terminal subpattern matches we do currently check, however there
+        is a subtler bug here too. In the case of an empty match we will
+        presently immediately fall through to the next alternative (or
+        complete the regex match), whereas upon a failed match we should
+        be backtracking into the failing alternative, to give it a chance
+        to match further (e.g. consider /a??b?|a/.exec("ab") - upon first
+        attempting to match the first alternative this will match the empty
+        string - since a?? is non-greedy, however rather than moving on to
+        the second alternative we should be re-matching the first one, at
+        which point the non-greedy a?? will match, and as such the result
+        should be "ab", not "a").
+
+        Terminal subpattern matching contains a second bug, too. The frame
+        location values in the subpattern should be being allocated with
+        the outer disjunction's frame (as we do for the parentheses-single
+        optimization). Consider the following three regexes:
+            /a*(?:b*)*c*/
+            /a*(?:b*)c*/
+            /a*(?:b*)*/
+        Considering only the frame location required by the atoms a,b, and
+        c, (ignoring space associated with the nested subpattern) the first
+        regex (a normal subpattern match) requires a frame size of 2 for
+        the outer disjunction, (to backtrack terms a & c), with each
+        iteration of the subpattern requiring a frame of size 1 (in order
+        to backtrack b). In the case of the second regex (where the
+        parentheses-single optimization will kick in) the outer frame must
+        be set up with a frame size of 3, since the outer frame will also
+        be used when running the nested subpattern. We will currently only
+        allocate a farme of size 1 for the outer disjuntion (to contain a),
+        howver the frame size should be 2 (since the subpattern will be
+        evaluated in the outer frame). In addition to failing to allocate
+        frame space the frame offsets are also presently invalid - in the
+        case of the last regex b's frame location will be set assuming it
+        to be the first term in the frame, whereas in this case b lies
+        after the term a, and should be taking a separate frame location.
+
+        In order to correctly allocate the frame for terminal subpattern
+        matches we must move this optimization back up from the JIT into
+        the compiler (and thus interpreter too), since this is where the
+        frame allocation takes place.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::RegexPatternConstructor::checkForTerminalParentheses):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm):
+
+2010-11-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Remove Bakefile build system files
+        https://bugs.webkit.org/show_bug.cgi?id=49983
+
+        r53757 only removed the content, but not the files.
+        This patch removes that empty files.
+
+        * JavaScriptCoreSources.bkl: Removed.
+        * jscore.bkl: Removed.
+
+2010-11-24  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Merge the usage of jumps and calls at ARM-JIT
+        https://bugs.webkit.org/show_bug.cgi?id=50008
+
+        Those JmpSrc objects which represent jumps (not calls) should point to
+        after the jump instruction.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::loadBranchTarget):
+        (JSC::ARMAssembler::getAbsoluteJumpAddress):
+        (JSC::ARMAssembler::linkJump):
+        (JSC::ARMAssembler::relinkJump):
+        (JSC::ARMAssembler::linkCall):
+        (JSC::ARMAssembler::relinkCall):
+        (JSC::ARMAssembler::getRelocatedAddress):
+        (JSC::ARMAssembler::getDifferenceBetweenLabels):
+        (JSC::ARMAssembler::getCallReturnOffset):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::call):
+
+2010-11-24  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Optimize foldCase, toLower and toUpper methods in glib unicode backend
+        https://bugs.webkit.org/show_bug.cgi?id=48625
+
+        GLib methods use UTF-8 strings, so we have to convert from UTF-16 to
+        UTF-8 to perform the case operations and then convert back the result to
+        UTF-16. GLib conversion methods return a new allocated string, so we
+        have to memcpy the result into the destination buffer too. Using our
+        own methods to convert between UTF-8 and UTF-16 from wtf/unicode/UTF8.h
+        we don't need such memcpy, since they take an already allocated buffer
+        rather than returning a new one. There's another optimization for the
+        case when the destination buffer is not large enough. In that case,
+        methods should return the expected destination buffer size and are
+        called again with a new buffer. We can avoid the conversion to UTF-16 by
+        pre-calculating the required size for the destination buffer.
+
+        * wtf/unicode/glib/UnicodeGLib.cpp:
+        (WTF::Unicode::getUTF16LengthFromUTF8):
+        (WTF::Unicode::convertCase):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+
+2010-11-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Use WTF::StringHasher directly in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=49893
+
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierUCharBufferTranslator::hash):
+
+2010-11-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Add WTF::FixedArray::size()
+        https://bugs.webkit.org/show_bug.cgi?id=49891
+
+        Add a method to get the size of a FixedArray.
+
+        * wtf/FixedArray.h:
+        (WTF::FixedArray::size):
+
+2010-11-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Set correct preprocessor definitions
+        https://bugs.webkit.org/show_bug.cgi?id=49887
+
+        * wtf/Platform.h:
+
+2010-11-22  Adam Roben  <aroben@apple.com>
+
+        Use paths relative to $WebKitVSPropsRedirectionDir to access shared .vsprops files
+
+        Apple's Windows build allows placing header files and import libraries for WebKit's
+        dependencies (CoreGraphics, CFNetwork, SQLite, etc.) outside the source tree via the
+        $WebKitLibrariesDir environment variable. This is both required for production builds and
+        convenient for Apple-internal developer builds. Apple's production builds also require that
+        WebKit's shared .vsprops files be accessed relative to $WebKitLibrariesDir. In production
+        builds, the files are copied into that directory tree by the
+        WebKitLibraries/win/tools/WinTools.make file. In Apple-internal developer builds, the
+        copying is done by
+        JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make.
+
+        This .vsprops copying is problematic in one very important case: when a developer updates
+        their source tree and then tries to build. Visual Studio only reads .vsprops files when a
+        project is first loaded. So, when Visual Studio is first opened after the .vsprops files are
+        updated, it reads in the old files that were already residing in $WebKitLibrariesDir. When a
+        build is started, JavaScriptCoreGenerated.make copies the new .vsprops files into
+        $WebKitLibrariesDir, but Visual Studio will not pick up the changes.  The rest of the build
+        will proceed with out-of-date .vsprops files, which will likely result in a build failure.
+
+        To fix this, we now use normal relative paths to access the .vsprops files in the source
+        tree rather than in $WebKitLibrariesDir, but prefix those paths with a new environment
+        variable, $WebKitVSPropsRedirectionDir. In developer builds, this environment variable is
+        unset, so the normal relative paths are used to read the .vsprops files out of the source
+        tree directly. In production builds, this environment variable is set to a fake directory
+        that will cause the .vsprops files in $WebKitLibrariesDir to be found when the relative path
+        is resolved.
+        
+        For example, JavaScriptCore.vcproj uses this path for FeatureDefines.vsprops:
+
+        $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
+
+        In developer builds, where $WebKitVSPropsRedirectionDir is unset, this will point to the
+        files in WebKitLibraries\win\tools\vsprops in the source tree. In production builds,
+        JavaScriptCore.make sets $WebKitVSPropsRedirectionDir to
+        "$(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\", so the full path for
+        FeatureDefines.vsprops becomes:
+
+        $(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\1\2\3\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
+
+        which resolves to:
+
+        $(SRCROOT)\AppleInternal\tools\vsprops\OpenSource\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops
+
+        (We rely on the fact that Windows doesn't care whether the directories "1", "2", and "3"
+        actually exist since they are matched by an equal number of ".." path components.)
+
+        Note that Visual Studio still won't pick up changes made to .vsprops files while Visual
+        Studio is open, but that problem hasn't seemed to cause developers many headaches so far.
+
+        Fixes <http://webkit.org/b/49181> Windows build fails mysteriously when .vsprops files are
+        updated
+
+        Reviewed by Dave Hyatt.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Set $WebKitVSPropsRedirectionDir so that
+        production builds can find the .vsprops files.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Stopy copying the
+        .vsprops files. It isn't needed anymore.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Changed to use paths relative to $WebKitVSPropsRedirectionDir to access shared .vsprops
+        files.
+
+2010-11-19  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        YARR JIT should fallback to YARR Interpreter instead of PCRE.
+        https://bugs.webkit.org/show_bug.cgi?id=46719
+
+        Remove the ENABLE_YARR macro and the option of matching regular
+        expressions with PCRE from JavaScriptCore.
+
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * tests/mozilla/expected.html:
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::byteCompileRegex):
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::getFallback):
+        (JSC::Yarr::RegexCodeBlock::isFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-11-20  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        [BREWMP] Replace DBGPRINTF and DBGPRINTF_FATAL with dbg_Message
+        https://bugs.webkit.org/show_bug.cgi?id=49520
+
+        DBGPRINTF and DBGPRINTF_FATAL macros are prohibited in Mod1. Use dbg_Message instead.
+
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2010-11-20  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Support JIT_OPTIMIZE_MOD on Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=49432
+
+        Rewrite the soft modulo operation into macroassembler form, and move it
+        to JSValue32_64 section.
+        Add support for soft modulo on Thumb-2 JIT also.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::clz):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::countLeadingZeros32):
+        (JSC::MacroAssemblerARM::relativeTableJump):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::countLeadingZeros32):
+        (JSC::MacroAssemblerARMv7::relativeTableJump):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::softModulo):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * wtf/Platform.h:
+
+2010-11-20  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/49848> Make it possible to display the last character of a secure text field unobscured
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.exp:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::secure): Added argument that controls whether
+        the last character is obscured or not.  Implemented behavior.
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::LastCharacterBehavior): Added enum.
+        (WTF::StringImpl::secure): Updated method signature.
+
+2010-11-19  William Chan  <willchan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add USE(CHROMIUM_NET)
+
+        Indicates the use of Chromium's network stack.  Chromium's network
+        stack performs better when it has full view of all resource requests,
+        so USE(CHROMIUM_NET) can be used to bypass throttles.
+
+        https://bugs.webkit.org/show_bug.cgi?id=49778
+
+        * wtf/Platform.h:
+
+2010-11-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add Debug_Cairo_CFLite and Release_Cairo_CFLite configurations for all vcproj files
+        https://bugs.webkit.org/show_bug.cgi?id=49819
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2010-11-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Don't check for constant registers when we can guarantee that the register won't be in the constant pool
+        https://bugs.webkit.org/show_bug.cgi?id=49814
+
+        Add uncheckedR(int) to CallFrame, and replace all the uses of r() with uncheckedR()
+        when we can guarantee that the register is not referring to a constant.
+        This makes the interpreter about 0.5% faster, and makes the CallFrame initialisation
+        logic correct when we're using a faked callframe (as in the case of the globalExec).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::createActivation):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisObject):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::uncheckedR):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+
+2010-11-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Normalize Cairo/CFLite project/solution configuration names
+        https://bugs.webkit.org/show_bug.cgi?id=49818
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2010-11-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Windows vcproj configuration names should be normalized across projects
+        https://bugs.webkit.org/show_bug.cgi?id=49776
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+
+2010-11-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, build fix after r72360.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+
+2010-11-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Bug 49577 - Function.prototype should be non-configurable
+
+        Ooops, Function.prototype should not be enumerable!
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+
+2010-11-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 49708 - Stop recompiling functions to regenerate exception info.
+
+        Instead only hold info as necessary – keep divot info is the inspector
+        is enabled, line number info is debugging or profiling, and handler
+        info for functions with try/catch.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::addExpressionInfo):
+        (JSC::CodeBlock::addLineInfo):
+        (JSC::CodeBlock::hasExpressionInfo):
+        (JSC::CodeBlock::hasLineInfo):
+        (JSC::CodeBlock::needsCallReturnIndices):
+        (JSC::CodeBlock::callReturnIndexVector):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        (JSC::BytecodeGenerator::addLineInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::jitThrow):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Collector.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::usingAPI):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsRichSourceInfo):
+        (JSC::JSGlobalObject::globalData):
+
+2010-11-18  Adam Roben  <aroben@apple.com>
+
+        Add a script to delete manifest-related files when they are older than
+        any .vsprops file
+
+        Changes to .vsprops files can cause the manifest files to become
+        invalid, and Visual Studio doesn't always figure out that it needs to
+        rebuild them.
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Call the new script.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        Added the new script.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py: Added.
+        (file_modification_times): Generator to return the modification time of
+        each file in a directory hierarchy.
+        (main): Get the modification time of the newest vsprops file, then find
+        all manifest-related files in the obj directory. Delete all
+        manifest-related files that are older than the newest vsprops file.
+
+2010-11-18  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        <rdar://problem/8602509&8602717&8602724> Enable compaction support.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2010-11-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 49635 - Profiler implementation is fragile
+
+        The profile presently requires the exception handling mechanism to explicitly
+        remove all stack frames that are exited during the exception unwind mechanism.
+        This is fragile in a number of ways:
+          * We have to change bytecode register allocation when compiling code to run
+            when profiling, to preserve the callee function (this is also required to
+            call did_call after the call has returned).
+          * In the JIT we have to maintain additional data structures
+            (CodeBlock::RareData::m_functionRegisterInfos) to map back to the register
+            containing the callee.
+          * In the interpreter we use 'magic values' to offset into the instruction
+            stream to rediscover the register containing the function.
+
+        Instead, move profiling into the head and tail of functions.
+          * This correctly accounts the cost of the call itself to the caller.
+          * This allows us to access the callee function object from the callframe.
+          * This means that at the point a call is made we can track the stack depth
+            on the ProfileNode.
+          * When unwinding we can simply report the depth at which the exception is
+            being handled - all call frames above this level are freed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::methodCallLinkInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::ProfileGenerator::exceptionUnwind):
+        (JSC::ProfileGenerator::stopProfiling):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::willExecute):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::create):
+        (JSC::ProfileNode::callerCallFrame):
+        * profiler/Profiler.cpp:
+        (JSC::dispatchFunctionToProfiles):
+        (JSC::Profiler::_willExecute):
+        (JSC::Profiler::_didExecute):
+        (JSC::Profiler::exceptionUnwind):
+        * profiler/Profiler.h:
+
+2010-11-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Remove leftover Windows Debug_Internal configurations
+        https://bugs.webkit.org/show_bug.cgi?id=49758
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2010-11-18  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Avoid increasing required alignment of target type warning
+        https://bugs.webkit.org/show_bug.cgi?id=43963
+
+        * runtime/UString.h:
+        (JSC::UStringHash::equal):
+        * wtf/StdLibExtras.h:
+
+2010-11-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add stubbed out ScrollAnimator for the Mac
+        https://bugs.webkit.org/show_bug.cgi?id=49678
+
+        * wtf/Platform.h: Enable SMOOTH_SCROLLING on the Mac, this has no
+        change in behavior at the moment.
+
+2010-11-17  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/49634> Make overflow guards in WTF::String::utf8 explicit
+
+        Reviewed by Darin Adler.
+
+        Add an explicit overflow check prior to allocating our buffer,
+        rather than implicitly relying on the guard in convertUTF16ToUTF8.
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::utf8):
+
+2010-11-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r72197.
+        http://trac.webkit.org/changeset/72197
+        https://bugs.webkit.org/show_bug.cgi?id=49661
+
+        broke fast/regex/test1.html (Requested by stampho on #webkit).
+
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExpRepresentation::~RegExpRepresentation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * tests/mozilla/expected.html:
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.cpp:
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::getFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        YARR JIT should fallback to YARR Interpreter instead of PCRE.
+        https://bugs.webkit.org/show_bug.cgi?id=46719
+
+        Remove the ENABLE_YARR macro and the option of matching regular
+        expressions with PCRE from JavaScriptCore.
+
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * tests/mozilla/expected.html:
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        * yarr/RegexCompiler.h:
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::byteCompileRegex):
+        * yarr/RegexInterpreter.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::getFallback):
+        (JSC::Yarr::RegexCodeBlock::isFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        * yarr/RegexPattern.h:
+
+2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Extend YARR Interpreter with beginning character look-up optimization
+        https://bugs.webkit.org/show_bug.cgi?id=45751
+
+        Add beginning character look-up optimization which sets the start
+        index to the first possible successful pattern match.
+        Extend YARR Interpreter with lookupForBeginChars function which
+        implements the beginning character look-up optimization.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::InputStream::readPair):
+        (JSC::Yarr::Interpreter::InputStream::isNotAvailableInput):
+        (JSC::Yarr::Interpreter::lookupForBeginChars):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+
+2010-11-17  Alexis Menard  <alexis.menard@nokia.com>, Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Kenneth Christiansen, Tor Arne Vestbø.
+
+        [Qt] Add support for use GStreamer with the Qt build
+
+        Enable the build/inclusion of the wtf/QObject convenience classes.
+
+        * JavaScriptCore.pri:
+        * wtf/wtf.pri:
+
+2010-11-17  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Collect the beginning characters in a RegExp pattern for look-up
+        optimization
+        https://bugs.webkit.org/show_bug.cgi?id=45748
+
+        Extend the YARR's parser with an algorithm which collects the potential
+        beginning characters from a RegExp pattern for later look-up optimization.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::BeginCharHelper::BeginCharHelper):
+        (JSC::Yarr::BeginCharHelper::addBeginChar):
+        (JSC::Yarr::BeginCharHelper::merge):
+        (JSC::Yarr::BeginCharHelper::addCharacter):
+        (JSC::Yarr::BeginCharHelper::linkHotTerms):
+        (JSC::Yarr::RegexPatternConstructor::RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::addBeginTerm):
+        (JSC::Yarr::RegexPatternConstructor::setupDisjunctionBeginTerms):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeBeginTerms):
+        (JSC::Yarr::RegexPatternConstructor::setupBeginChars):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::TermChain::TermChain):
+        (JSC::Yarr::BeginChar::BeginChar):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-11-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r72160.
+        http://trac.webkit.org/changeset/72160
+        https://bugs.webkit.org/show_bug.cgi?id=49646
+
+        Broke lots of fast/profiler tests, among others (Requested by
+        aroben on #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFunctionRegisterInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::profileHookRegister):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::ProfileGenerator::stopProfiling):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::willExecute):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::create):
+        (JSC::ProfileNode::operator==):
+        * profiler/Profiler.cpp:
+        (JSC::dispatchFunctionToProfiles):
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        * profiler/Profiler.h:
+
+2010-11-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 49635 - Profiler implementation is fragile
+
+        The profile presently requires the exception handling mechanism to explicitly
+        remove all stack frames that are exited during the exception unwind mechanism.
+        This is fragile in a number of ways:
+          * We have to change bytecode register allocation when compiling code to run
+            when profiling, to preserve the callee function (this is also required to
+            call did_call after the call has returned).
+          * In the JIT we have to maintain additional data structures
+            (CodeBlock::RareData::m_functionRegisterInfos) to map back to the register
+            containing the callee.
+          * In the interpreter we use 'magic values' to offset into the instruction
+            stream to rediscover the register containing the function.
+
+        Instead, move profiling into the head and tail of functions.
+          * This correctly accounts the cost of the call itself to the caller.
+          * This allows us to access the callee function object from the callframe.
+          * This means that at the point a call is made we can track the stack depth
+            on the ProfileNode.
+          * When unwinding we can simply report the depth at which the exception is
+            being handled - all call frames above this level are freed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::methodCallLinkInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::count):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        * interpreter/Interpreter.cpp:
+        (JSC::ProfileHostCall::ProfileHostCall):
+        (JSC::ProfileHostCall::~ProfileHostCall):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_has_called):
+        (JSC::JIT::emit_op_profile_will_return):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_has_called):
+        (JSC::JIT::emit_op_profile_will_return):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::ProfileGenerator::exceptionUnwind):
+        (JSC::ProfileGenerator::stopProfiling):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::willExecute):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::create):
+        (JSC::ProfileNode::operator==):
+        (JSC::ProfileNode::exec):
+        * profiler/Profiler.cpp:
+        (JSC::dispatchFunctionToProfiles):
+        (JSC::Profiler::hasCalled):
+        (JSC::Profiler::willEvaluate):
+        (JSC::Profiler::willReturn):
+        (JSC::Profiler::didEvaluate):
+        (JSC::Profiler::exceptionUnwind):
+        * profiler/Profiler.h:
+
+2010-11-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben and Steve Falkenburg.
+
+        Touch Platform.h to force a rebuild for Windows.
+
+        * wtf/Platform.h:
+
+2010-11-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Disable LTCG for Windows Release builds. Add new Release_LTCG configuration.
+        https://bugs.webkit.org/show_bug.cgi?id=49632
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+
+2010-11-16  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The number of recursive match calls isn't limited in YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=47906
+
+        Check the number of the matchDisjunction recursive calls to avoid unbounded
+        recursion.
+        Now the matchDisjunction function returns JSRegExpResult instead of bool.
+        The JSRegExpResult enum contains the result of matching or the error code
+        of the failure (like HitLimit) which terminates the matching.
+        The error codes are based on pcre's jsRegExpExecute error codes.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        * yarr/RegexInterpreter.h:
+
+2010-11-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Rest of the Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-11-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-11-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=49606
+
+        The bug here is that we read the prototype from the RHS argument using a regular
+        op_get_by_id before op_instanceof has checked that this is an object implementing
+        HasInstance. This incorrect behaviour gives rise to further unnecessary complexity
+        in the code base, since we have additional logic (implemented using the
+        GetByIdExceptionInfo data structures on CodeBlock) to convert not an object errors
+        from the get_by_id into invalid parameter errors. Having fixed this bug this code
+        is all redundant, since in these cases the get_by_id will never have been reached.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addExpressionInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCheckHasInstance):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createTerminatedExecutionException):
+        (JSC::createUndefinedVariableError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::toBoolean):
+        (JSC::JSNotAnObject::toNumber):
+        (JSC::JSNotAnObject::toString):
+        (JSC::JSNotAnObject::toObject):
+        (JSC::JSNotAnObject::getOwnPropertySlot):
+        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
+        (JSC::JSNotAnObject::put):
+        (JSC::JSNotAnObject::deleteProperty):
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isActivationObject):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        (JSC::JSValue::synthesizePrototype):
+
+2010-11-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Harden additional string functions against large lengths
+        https://bugs.webkit.org/show_bug.cgi?id=49574
+
+        * wtf/text/CString.cpp:
+        (WTF::CString::init): Check for length that is too large for CString.
+        (WTF::CString::newUninitialized): Ditto.
+        (WTF::CString::copyBufferIfNeeded): Fix types so the length stays
+        in a size_t.
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::append): Check for length that is too large.
+
+2010-11-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 49577 - Function.prototype should be non-configurable
+
+        JSC lazily allocates the prototype property of Function objects.
+
+        We check the prototype exists on 'get', but not on 'put'.
+        If you 'put' without having first done a 'get' you can end up with a configurable
+        prototype (prototype should only ever be non-configurable).
+
+        This is visible in a couple of ways:
+          * 'delete' on the property may succeed. (the next access will result in a new,
+          reset prototype object).
+          * the prototype may be set to a getter.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+            Reify the prototype property before allowing an enumerate including don't enum properties.
+        (JSC::JSFunction::put):
+            Reify the prototype property before any put to it.
+
+2010-11-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 49488 - Only add source specific information to exceptions in Interpreter::throwException
+
+        Three types of source location information are added to errors.
+
+        (1) Divot information.
+
+        This was added with the intention of using it to provide better source highlighting in the inspector.
+        We may still want to do so, but we probably should not be exposing these values in a manner visible to
+        user scripts – only through an internal C++ interface. The code adding divot properties to objects has
+        been removed.
+
+        (2) Line number information.
+
+        Line number information is presently sometimes added at the point the exception is created, and sometimes
+        added at the point the exception passes through throwException. Change this so that throwException has
+        the sole responsibility for adding line number and source file information.
+
+        (3) Source snippets in the message of certain type errors (e.g. 'doc' in `Result of expression 'doc' [undefined] is not an object.`).
+
+        These messages are currently created at the point the exceptions is raised. Instead reformat the message
+        such that the source snippet is located at the end (`Result of expression 'b1' [undefined] is not an object.`
+        becomes `'undefined' is not an object (evaluating 'b1.property')`), and append these to the message at
+        the in throw Exception. This presents a number of advantages:
+          * we no longer need to have source location information to create these TypeErrors.
+          * we can chose to append source location information in other error messages, including those where
+            passing source location to the point of construction would be inconvenient.
+          * we can chose in future to omit to append source location information when running in a non-debug mode.
+
+        This also cleans up some error output, e.g. removing double brackets ('[[]]') around objects in output,
+        removing double periods (..) at end of lines, and adding slightly more context to some errors.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+            - Separated called to access line and range information.
+
+        * bytecode/CodeBlock.h:
+            - Separated called to access line and range information.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::isInvalidParamForIn):
+        (JSC::isInvalidParamForInstanceOf):
+            - Update parameters passed to error constructors.
+        (JSC::appendSourceToError):
+            - Update message property to add location information (previously added in createErrorMessage, in ExceptionHelpers)
+        (JSC::Interpreter::throwException):
+            - Updated to call appendSourceToError. 
+        (JSC::Interpreter::privateExecute):
+            - Update parameters passed to error constructors.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Update parameters passed to error constructors.
+
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        (JSC::hasErrorInfo):
+            - Removed divot properties.
+
+        * runtime/Error.h:
+            - Removed divot properties.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+            - Initialize new property.
+
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::appendSourceToMessage):
+        (JSC::ErrorInstance::setAppendSourceToMessage):
+        (JSC::ErrorInstance::clearAppendSourceToMessage):
+            - Added flag to check for errors needing location information appending.
+        (JSC::ErrorInstance::isErrorInstance):
+            - Added virtual method to check for ErrorInstances.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+            - Update parameters passed to error constructors, stopped adding line number information early, changed TypeError messages.
+
+        * runtime/ExceptionHelpers.h:
+            - Updated function signatures.
+
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+            - Update parameters passed to error constructors.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::isErrorInstance):
+            - Added virtual method to check for ErrorInstances.
+
+2010-11-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        CString(const char*) crashes when passed a null pointer
+        https://bugs.webkit.org/show_bug.cgi?id=49450
+
+        * wtf/text/CString.cpp:
+        (WTF::CString::CString):
+        Return early if str is null.
+
+2010-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 49420 - Clean up syntax/reference error throw.
+
+        Some errors detected at compile time are thrown at runtime. We currently do so using a op_new_error/op_throw bytecode pair.
+        This is not ideal. op_throw is used for explicit user throw statements, and has different requirements in terms or meta data
+        attached to the exception (controlled by the explicitThrow parameter passed to Interpreter::throwException). To work around
+        this, op_new_error has to add the meta data at an early stage, which is unlike other VM exceptions being raised.
+
+        We can simplify this and bring into line with other exception behaviour by changing new_error from just allocating an
+        Exception instance to also throwing it – but as a regular VM throw, correctly passing explicitThrow as false.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitThrowSyntaxError):
+        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThrowableExpressionData::emitThrowReferenceError):
+        (JSC::ThrowableExpressionData::emitThrowSyntaxError):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::PostfixErrorNode::emitBytecode):
+        (JSC::PrefixErrorNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw_reference_error):
+        (JSC::JIT::emit_op_throw_syntax_error):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_throw_reference_error):
+        (JSC::JIT::emit_op_throw_syntax_error):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/Nodes.h:
+
+2010-11-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Harden some string functions against large lengths
+        https://bugs.webkit.org/show_bug.cgi?id=49293
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::create): Fix incorrect use of PassRefPtr. Check for
+        strlen results that are too large for StringImpl.
+        (WTF::StringImpl::lower): Check for lengths that are too large for
+        int32_t.
+        (WTF::StringImpl::upper): Fix incorrect use of PassRefPtr. Check for
+        lengths that are too large for int32_t.
+        (WTF::StringImpl::secure): Fix incorect use of PassRefPtr. Use unsigned
+        rather than int and int32_t so we can handle any length.
+        (WTF::StringImpl::foldCase): Fix incorrect use of PassRefPtr. Check for
+        lengths that are too large for int32_t.
+        (WTF::StringImpl::find): Check for strlen results that are too large for
+        StringImpl.
+        (WTF::StringImpl::findIgnoringCase): Ditto.
+        (WTF::StringImpl::replace): Fix incorrect use of PassRefPtr.
+        (WTF::StringImpl::createWithTerminatingNullCharacter): Check before
+        incrementing length.
+
+2010-11-11  Dan Horák  <dan@danny.cz>
+
+        Reviewed by Andreas Kling.
+
+        Add support for the s390/s390x architectures, it's big-endian
+        with s390 being 32-bit and s390x being 64-bit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=34786
+
+        * wtf/Platform.h:
+
+2010-11-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        HTML5 Ruby support should be mandatory feature
+        https://bugs.webkit.org/show_bug.cgi?id=49272
+
+        Remove Ruby as optional feature.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * JavaScriptCorePrefix.h:: Touch it to avoid incremental build failure on Windows.
+
+2010-11-10  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Adds TextPosition* classes -- a structure that stores line/column/generation
+        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
+        wrappers that emphasize whether int number is used as zero-based or
+        one-based.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Added.
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+        (WTF::ZeroBasedNumber::fromZeroBasedInt):
+        (WTF::ZeroBasedNumber::ZeroBasedNumber):
+        (WTF::ZeroBasedNumber::zeroBasedInt):
+        (WTF::ZeroBasedNumber::base):
+        (WTF::ZeroBasedNumber::belowBase):
+        (WTF::OneBasedNumber::fromOneBasedInt):
+        (WTF::OneBasedNumber::OneBasedNumber):
+        (WTF::OneBasedNumber::oneBasedInt):
+        (WTF::OneBasedNumber::convertAsZeroBasedInt):
+        (WTF::OneBasedNumber::convertToZeroBased):
+        (WTF::OneBasedNumber::base):
+        (WTF::OneBasedNumber::belowBase):
+        (WTF::toZeroBasedTextPosition):
+        (WTF::toOneBasedTextPosition):
+        (WTF::ZeroBasedNumber::convertToOneBased):
+
+2010-11-09  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        ARM JIT asserts when loading http://reader.google.com in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=48912
+
+        There are several cases when the uninterrupted sequence is larger than
+        maximum required offset for pathing the same sequence. Eg.: if in a
+        uninterrupted sequence the last macroassembler's instruction is a stub
+        call, it emits store instruction(s) which should not be included in the
+        calculation of length of uninterrupted sequence. So, the insnSpace and
+        constSpace should be upper limit instead of hard limit.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::endUninterruptedSequence):
+
+2010-11-09  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/49279> Fix include statements for local headers
+
+        Reviewed by Gavin Barraclough.
+
+        Use "Foo.h" instead of <Foo.h> for local headers.
+
+        * assembler/AbstractMacroAssembler.h: Also fixed sort order.
+        * assembler/CodeLocation.h:
+        * yarr/RegexJIT.h:
+        * yarr/RegexParser.h:
+
+2010-11-08  Adam Roben  <aroben@apple.com>
+
+        Roll out r71532
+
+        It broke the build for Cygwin 1.7 installs. Cygwin 1.7's default
+        .bashrc unsets %TEMP%, which broke copy-tools.cmd.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-tools.cmd: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/show-alert.js: Removed.
+
+2010-11-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        >=webkitgtk-1.2.5: parallel build fails with libtool: link: cannot find the library `libwebkit-1.0.la' or unhandled argument `libwebkit-1.0.la'
+        https://bugs.webkit.org/show_bug.cgi?id=49128
+
+        r59042 introduced a C++-style comment in Platform.h, which is often
+        included in C source files. Change it to a C-style comment.
+
+        * wtf/Platform.h: Fix the C++-style comment.
+
+2010-11-08  Adam Roben  <aroben@apple.com>
+
+        Show a message and cause the build to immediately fail when any
+        .vsprops files are copied
+
+        When $WebKitLibrariesDir is set to a non-standard location, the
+        .vsprops files have to be copied from WebKitLibraries/win to
+        $WebKitLibrariesDir. When this happens, Visual Studio doesn't pick up
+        changes to the .vsprops files until the next time it opens the solution
+        file. Before this patch, the build would soldier on with the old
+        .vsprops files, leading to strange build failures. Now we detect that
+        the .vsprops files have been updated, display a message to the user
+        telling them what to do, and make the build fail immediately.
+
+        Fixes <http://webkit.org/b/49181> Windows build fail mysteriously when
+        .vsprops files are updated
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        Moved code to copy the tools directory to the new copy-tools.cmd
+        script. Moved that after the command that writes the buildfailed file
+        so the build will be considered a failure if copy-tools.cmd fails.
+        Changed to write the project name into buildfailed like all our other
+        projects do, so those other projects will know that the failure was due
+        to this project.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        Added new scripts.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-tools.cmd: Added. Copies
+        the tools directory to $WebKitLibrariesDir. If any files were copied,
+        we display a message to the user and exit with error code 1 to cause
+        the build to fail. In non-interactive builds, we just print the message
+        to the build log. In interactive builds, we show the message in an
+        alert.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/show-alert.js: Added. Uses
+        Windows Scripting Host to display a message in an alert.
+
+2010-11-07  Sam Magnuson  <smagnuson@netflix.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] make install does not cause JavaScriptCore to be built
+        https://bugs.webkit.org/show_bug.cgi?id=49114
+
+        * JavaScriptCore.pro:
+
+2010-11-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Website consistently crashing TOT in JIT::execute() on news.com.au
+        https://bugs.webkit.org/show_bug.cgi?id=48954
+
+        The problem here was the strict pass of this conversion was loading the
+        this structure into one register but doing the flags check off a different
+        register.  This is clearly wrong.  I have been unable to trigger the crash
+        with a reduction, but I've added an assertion to the this conversion to
+        attempt to make it more readily catchable in future.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this_strict):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_convert_this_strict):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-11-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        Use leakRef instead of releaseRef
+        https://bugs.webkit.org/show_bug.cgi?id=48974
+
+        Use leakRef instead of the deprecated releaseRef. This was renamed
+        some time ago because 'releaseRef' is too close to 'release',
+        which does something completely different.
+
+2010-11-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(49798): Crash in HTMLObjectElement::parseMappedAttribute
+        https://bugs.webkit.org/show_bug.cgi?id=48789
+
+        The contract for all String/AtomicString methods seems to be that it's
+        safe to call them, even when the String is null (impl() returns 0).
+        This contract was broken by r49798 (unintentionally) when optimizing
+        for dromeo.
+        This patch adds a null check to AtomicString::lower() fixing this
+        crash and preventing future confusion.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::lower):
+
+2010-11-04  Adam Barth  <abarth@webkit.org>
+
+        Enabled ICCJPEG on Chromium Mac
+        https://bugs.webkit.org/show_bug.cgi?id=48977
+
+        * wtf/Platform.h:
+
+2010-11-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Crash in Function.prototype.call.apply
+        https://bugs.webkit.org/show_bug.cgi?id=48485
+
+        The problem here was op_load_varargs failing to ensure that
+        there was sufficient space for the entire callframe prior to
+        op_call_varargs.  This meant that when we then re-entered the
+        VM it was possible to stomp over an earlier portion of the
+        stack, so causing sub-optimal behaviour.
+
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoadVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_load_varargs):
+
+2010-11-03  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Chris Marrin.
+
+        Redesign extension mechanism in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=46894
+
+        * JavaScriptCore.exp:
+         - Exposed String::split(const String&, Vector<String>).
+
+2010-11-03  Adam Roben  <aroben@apple.com>
+
+        Bring WTF.vcproj up to date
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added filters for the text and
+        unicode directories, added new files, removed old files.
+
+2010-11-03  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Remove unused initializeWeakRandomNumberGenerator
+        https://bugs.webkit.org/show_bug.cgi?id=48899
+
+        WeakRandom class is used instead of weakRandomNumber and its initializer.
+
+        * wtf/RandomNumberSeed.h:
+
+2010-11-03  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Unused class: JSFastMath with JSValue64
+        https://bugs.webkit.org/show_bug.cgi?id=48835
+
+        Remove unused JSFastMath class.
+
+        * runtime/JSImmediate.h:
+
+2010-11-02  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r71127
+
+        MSVC isn't smart enough to figure out that the definition of the global
+        nullptr variable isn't needed, so we provide one for it.
+
+        Fixes <http://webkit.org/b/48862> Windows build is broken due to
+        undefined symbol nullptr
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export nullptr.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added NullPtr.cpp and let VS
+        resort the files.
+
+        * wtf/NullPtr.cpp: Added.
+
+2010-11-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Remove special handling of HashTableDeletedValue in PlatformRefPtr and manually manage memory that cannot be controlled by HashTraits
+        https://bugs.webkit.org/show_bug.cgi?id=48841
+
+        Remove special handling of HashTableDeletedValue in PlatformRefPtr.
+        This is better handled on a case-by-case basis, when HashTraits
+        cannot account for it.
+
+        * wtf/PlatformRefPtr.h:
+        (WTF::PlatformRefPtr::~PlatformRefPtr):
+        (WTF::PlatformRefPtr::clear):
+        (WTF::::operator):
+
+2010-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute
+        https://bugs.webkit.org/show_bug.cgi?id=47573
+
+        I think the interpreter portion of this was introduced by
+        an incorrect but silent merge when I updated prior to committing.
+        The JIT change is basically just a correctness fix, but it is
+        needed to prevent the testcase from asserting in debug builds.
+
+        The basic problem is incorrectly setting the activation object
+        on an arguments object.  The crash was due to us setting a null
+        activation in the interpreter, in the jit we were setting the
+        activation of a strict mode arguments object.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * wtf/Platform.h:
+
+2010-10-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Adam Roben and David Kilzer.
+
+        Fix and cleanup of build systems
+        https://bugs.webkit.org/show_bug.cgi?id=48342
+
+        * Configurations/FeatureDefines.xcconfig: Add missing ENABLE_FULLSCREEN_API
+
+2010-10-28  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Include stddef.h unconditionally in Assertions.h
+        https://bugs.webkit.org/show_bug.cgi?id=48573
+
+        There is no reason to have stddef.h include be MSVC-only.
+
+        * wtf/Assertions.h:
+
+2010-10-28  Herczeg Zoltan  <zherczeg@webkit.org>
+
+        Rubber stamped by Csaba Osztrogonác.
+
+        Try to fix interpreter build.
+
+        Needed parentheses around assignment to avoid GCC warning after
+        http://trac.webkit.org/changeset/70703
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-28  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Csaba Osztrogonác.
+
+        resetAssertionMatches() is an unused function in YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=48503
+
+        The resetAssertionMatches() function is removed from YARR Interpreter
+        because it's never called.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::resetMatches):
+
+2010-10-28  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Wrong instruction form for BKPT
+        https://bugs.webkit.org/show_bug.cgi?id=48427
+
+        One '0' is missing from BKPT instruction.
+        Thanks for Jacob Bramley for reporting this error.
+
+        * assembler/ARMAssembler.h:
+
+2010-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Snow Leopard build.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+
+2010-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Do not have two different asCell APIs in JSValue
+        https://bugs.webkit.org/show_bug.cgi?id=47979
+
+        Remove JSCell* asCell(JSValue) in favor of only using
+        JSValue::asCell().
+
+        * API/APICast.h:
+        (toRef):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::testPrototype):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/JSByteArray.h:
+        (JSC::asByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::getCallData):
+        (JSC::JSCell::getConstructData):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::asString):
+        * runtime/JSValue.h:
+        * runtime/Operations.cpp:
+        (JSC::jsIsObjectType):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+
+2010-10-27  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Support emit_op_mod() for MIPS on JSVALUE32_64
+        https://bugs.webkit.org/show_bug.cgi?id=46511
+
+        This patch uses MIPS div instructions for op_mod to improve performance.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+
+2010-10-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        * wtf/Platform.h: Make sure ACCELERATED_COMPOSITING is
+        turned off in the WinCairo port.  This isn't supported (yet.)
+
+2010-10-27  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Chris Marrin.
+
+        Add ENABLE_WEB_AUDIO feature enable flag (initially disabled) to build-webkit
+        https://bugs.webkit.org/show_bug.cgi?id=48279
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-10-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Windows build fix.
+
+        * jit/JITStubs.cpp:
+        (JSC::jitThrow):
+
+2010-10-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 48365 - Remove output parameters from JITStackFrame
+
+        The JIT stub functions presently use the stackframe to provide a couple of additional return values.
+          * In the case of uncaught exceptions the exception value is returned on the stackframe.exception property.
+          * In the case of caught exceptions the updated value for the callFrame register is returned on the stackframe.callFrame property.
+
+        Change exception returns such that exceptions are always returned on JSGlobalData::exception.
+        Change op_catch such that the new CallFrame value is returned from op_throw / vm_throw in regT0.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::execute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::jitThrow):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createErrorForInvalidGlobalAssignment):
+        (JSC::throwOutOfMemoryError):
+        (JSC::throwStackOverflowError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2010-10-27  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48060
+        Speed up op_jeq_null and op_jneq_null.
+
+        For both opcodes the NullTag and UndefinedTag are checked to control the
+        jump. These values can be simply checked by AboveOrEqual or Below
+        condition if they are the two highest unsigned integers from JSValue's
+        Tag field.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        * runtime/JSValue.h:
+
+2010-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+        
+        SunSpider reports no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Walk the stack to calculate the high
+        water mark currently in use. It's not safe to assume that the current
+        CallFrame's high water mark is the highest high water mark because
+        calls do not always set up at the end of a CallFrame. A large caller
+        CallFrame can encompass a small callee CallFrame.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): Make sure to set a 0 CodeBlock
+        in the CallFrame of a host call, like the Interpreter does, instead of
+        leaving the CodeBlock field uninitialized. The backtracing code requires
+        a valid CodeBlock field in each CallFrame.
+
+2010-10-27  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add cmn to branch32(reg, imm) on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=48062
+
+        The conditional comparison can be done with cmn if the imm value is
+        negative and can fit into the cmn instruction.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+
+2010-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Interpreter build fix.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove exec and globalData arguments from jsNumber
+        https://bugs.webkit.org/show_bug.cgi?id=48270
+
+        Remove the now unused exec and globalData arguments from jsNumber
+        and mechanically update all users of jsNumber.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (functionRun):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/CachedTranscendentalFunction.h:
+        (JSC::CachedTranscendentalFunction::operator()):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/Error.cpp:
+        (JSC::addErrorSourceInfo):
+        (JSC::addErrorDivotInfo):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        (JSC::jsNaN):
+        (JSC::JSValue::toJSNumber):
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::PropertyNameForFunctionCall::value):
+        (JSC::JSONStringify):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/JSValue.h:
+        (JSC::jsDoubleNumber):
+        (JSC::jsNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::toJSNumber):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectLastIndex):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncLocaleCompare):
+
+2010-10-25  David Tapuska  <dtapuska@rim.com>
+
+        Reviewed by David Kilzer.
+
+        Enable VFP if our compiler settings indicated we had a hardware
+        VFP.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46096
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+
+2010-10-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70451.
+        http://trac.webkit.org/changeset/70451
+        https://bugs.webkit.org/show_bug.cgi?id=48249
+
+        Broke set-unloaded-frame-location.html under Qt (Requested by
+        caseq on #webkit).
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Removed.
+
+2010-10-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Replace _countof with WTF_ARRAY_LENGTH
+        https://bugs.webkit.org/show_bug.cgi?id=48229
+
+        * wtf/Platform.h:
+
+2010-10-25  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Adds TextPosition* classes -- a structure that stores line/column/generation
+        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
+        wrappers that emphasize whether int number is used as zero-based or
+        one-based.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Added.
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+        (WTF::ZeroBasedNumber::fromZeroBasedInt):
+        (WTF::ZeroBasedNumber::ZeroBasedNumber):
+        (WTF::ZeroBasedNumber::zeroBasedInt):
+        (WTF::ZeroBasedNumber::base):
+        (WTF::ZeroBasedNumber::belowBase):
+        (WTF::OneBasedNumber::fromOneBasedInt):
+        (WTF::OneBasedNumber::OneBasedNumber):
+        (WTF::OneBasedNumber::oneBasedInt):
+        (WTF::OneBasedNumber::convertAsZeroBasedInt):
+        (WTF::OneBasedNumber::convertToZeroBased):
+        (WTF::OneBasedNumber::base):
+        (WTF::OneBasedNumber::belowBase):
+        (WTF::toZeroBasedTextPosition):
+        (WTF::toOneBasedTextPosition):
+        (WTF::ZeroBasedNumber::convertToOneBased):
+
+2010-10-24  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        Check endianness with __BIG_ENDIAN in RVCT.
+        https://bugs.webkit.org/show_bug.cgi?id=46122
+
+        RVCT defines __BIG_ENDIAN if compiling for a big-endian target.
+
+        * wtf/Platform.h:
+
+2010-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Dave Kilzer.
+
+        Removed empty directories.
+
+        * JavaScriptCore: Removed.
+        * JavaScriptCore/runtime: Removed.
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, fix typo of last build fix.
+
+        * wtf/DateMath.cpp:
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for chromium.
+
+        * wtf/DateMath.cpp: Added missing include.
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add WTF_ARRAY_LENGTH macro to WTF
+        https://bugs.webkit.org/show_bug.cgi?id=32828
+
+        Unify the different implementations and usages.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+        * wtf/StdLibExtras.h:
+
+2010-10-24  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Filter example Chiseled from SVG Wow! is slow
+        https://bugs.webkit.org/show_bug.cgi?id=48174
+
+        Added 'using WTF::ByteArray;' at the end of ByteArray.h
+
+        * wtf/ByteArray.h:
+
+2010-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Inline WTF::bitwise_cast and fix style
+        https://bugs.webkit.org/show_bug.cgi?id=48208
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitwise_cast):
+        (WTF::bitCount):
+
+2010-10-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        Unify globalData APIs
+        https://bugs.webkit.org/show_bug.cgi?id=47969
+
+        Make JSGlobalObject::globalData return a reference and adapt
+        callers. This unifies the API with the existing
+        CallFrame::globalData, which also returns a reference.
+
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/JSParser.cpp:
+        (JSC::jsParse):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (JSC::createEvalError):
+        (JSC::createRangeError):
+        (JSC::createReferenceError):
+        (JSC::createSyntaxError):
+        (JSC::createTypeError):
+        (JSC::createURIError):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::globalData):
+
+2010-10-23  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, rolling out r70369.
+        http://trac.webkit.org/changeset/70369
+        https://bugs.webkit.org/show_bug.cgi?id=47974
+
+        Caused weird artifacts in expected results.
+
+        * wtf/Platform.h:
+
+2010-10-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Crashes randomly in cairo_scaled_font_destroy
+        https://bugs.webkit.org/show_bug.cgi?id=46794
+
+        Make PlatformRefPtr aware of hashTableDeletedValue. When PlatformRefPtr
+        goes away this should probably be handled in the future via some special
+        hooks in RefCounted (or its contained type).
+
+        * wtf/PlatformRefPtr.h:
+        (WTF::PlatformRefPtr::~PlatformRefPtr):
+        (WTF::PlatformRefPtr::clear):
+        (WTF::::operator):
+
+2010-10-22  Adam Roben  <aroben@apple.com>
+
+        Remove the QuartzCorePresent.h mechanism
+
+        This header was used to detect whether QuartzCore headers were present
+        on the system. Everyone should have these headers now so we no longer
+        need to detect.
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Remove
+        code to generate QuartzCorePresent.h.
+
+        * wtf/Platform.h: Stop including QuartzCorePresent.h on Windows and
+        collapse all USE_ACCELERATED_COMPOSITING settings into one #ifdef.
+
+2010-10-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed, rolling out r70290.
+        http://trac.webkit.org/changeset/70290
+        https://bugs.webkit.org/show_bug.cgi?id=48111
+
+        Undelete Android build files.
+
+        * Android.mk: Added.
+
+2010-10-22  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        JSC interpreter regressions after r69940
+        https://bugs.webkit.org/show_bug.cgi?id=47839
+
+        Wrong "if": It should test whether the result exists,
+        and not the opposite. It is an interpreter bug, hence
+        the bots does not capture it.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+
+2010-10-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Remove Android build system
+        https://bugs.webkit.org/show_bug.cgi?id=48111
+
+        * Android.mk: Removed.
+
+2010-10-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add a String constructor which takes AECHAR*
+        https://bugs.webkit.org/show_bug.cgi?id=45043
+
+        Add String(const AECHAR*) constructor for convenience.
+
+        * wtf/text/WTFString.h:
+
+2010-10-21  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use GCharsetConverter instead of g_iconv in TextCodecGtk
+        https://bugs.webkit.org/show_bug.cgi?id=47896
+
+        * wtf/gobject/GTypedefs.h:
+
+2010-10-21  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed, rolling out r70174.
+        http://trac.webkit.org/changeset/70174
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+
+        This patch reverts a change that causes
+        http/tests/xmlhttprequest/origin-whitelisting-removal.html to crash.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the EFL build.
+
+        * wtf/CMakeLists.txt:
+
+2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build: export needed symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47851
+        
+        Add methods to DecimalNumber to return the buffer length
+        required for decimal and exponential output.
+        
+        Make some of the DecimalNumber code non-inline (no
+        effect on Sunspider), adding DecimalNumber.cpp to various
+        build systems.
+        
+        Make some DecimalNumber methods 'const'.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * wtf/DecimalNumber.cpp: Added.
+        (WTF::DecimalNumber::bufferLengthForStringDecimal):
+        (WTF::DecimalNumber::bufferLengthForStringExponential):
+        (WTF::DecimalNumber::toStringDecimal):
+        (WTF::DecimalNumber::toStringExponential):
+        * wtf/DecimalNumber.h:
+        (WTF::DecimalNumber::sign):
+        (WTF::DecimalNumber::exponent):
+        (WTF::DecimalNumber::significand):
+        (WTF::DecimalNumber::precision):
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+        * wtf/wtf.pri:
+
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70165.
+        http://trac.webkit.org/changeset/70165
+        https://bugs.webkit.org/show_bug.cgi?id=48007
+
+        It broke tests on Qt bot (Requested by Ossy on #webkit).
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Removed.
+
+2010-10-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix the Windows build after r70165. Move the copying of JavaScript headers from JavaScriptCore's post-build
+        step to JavaScriptCoreGenerated, so the copying is done even when a cpp file in JavaScriptCore is changed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-10-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, fixing the Win build.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Walk the stack to calculate the high
+        water mark currently in use. It's not safe to assume that the current
+        CallFrame's high water mark is the highest high water mark because
+        calls do not always set up at the end of a CallFrame. A large caller
+        CallFrame can encompass a small callee CallFrame.
+
+2010-10-20  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Adds TextPosition* classes -- a structure that stores line/column/generation
+        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
+        wrappers that emphasize whether int number is used as zero-based or
+        one-based.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Added.
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+        (WTF::ZeroBasedNumber::fromZeroBasedInt):
+        (WTF::ZeroBasedNumber::ZeroBasedNumber):
+        (WTF::ZeroBasedNumber::zeroBasedInt):
+        (WTF::ZeroBasedNumber::base):
+        (WTF::ZeroBasedNumber::belowBase):
+        (WTF::OneBasedNumber::fromOneBasedInt):
+        (WTF::OneBasedNumber::OneBasedNumber):
+        (WTF::OneBasedNumber::oneBasedInt):
+        (WTF::OneBasedNumber::convertAsZeroBasedInt):
+        (WTF::OneBasedNumber::convertToZeroBased):
+        (WTF::OneBasedNumber::base):
+        (WTF::OneBasedNumber::belowBase):
+        (WTF::toZeroBasedTextPosition):
+        (WTF::toOneBasedTextPosition):
+        (WTF::ZeroBasedNumber::convertToOneBased):
+
+2010-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        [BREWMP] Turn off JIT for simulator build
+        https://bugs.webkit.org/show_bug.cgi?id=47937
+
+        We don't need to test x86 JIT.
+
+        * wtf/Platform.h:
+
+2010-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove support for JSVALUE32 from JSC
+        https://bugs.webkit.org/show_bug.cgi?id=47948
+
+        Remove all the code for supporting JSVALUE32 from JSC.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emitSlow_op_jlesseq):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        * jit/ThunkGenerators.cpp:
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * runtime/Collector.cpp:
+        (JSC::isPossibleCell):
+        (JSC::typeName):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSImmediate.h:
+        (JSC::reinterpretIntptrToDouble):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDouble):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        * runtime/JSValue.h:
+        * runtime/NumberObject.h:
+        * wtf/Platform.h:
+
+2010-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        BytecodeGenerator::m_lastOpcodePosition must be initialized in all constructors
+        https://bugs.webkit.org/show_bug.cgi?id=47920
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Add missing member initialization.
+
+2010-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        RVCT fails to compile DateMath.cpp due to overloaded function pow
+        https://bugs.webkit.org/show_bug.cgi?id=47844
+
+        Choose std::pow(double, double) among multiple overloaded pow functions
+        to fix build for RVCT.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseES5DateFromNullTerminatedCharacters):
+
+2010-10-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Use UChar instead of wchar_t in UnicodeWinCE
+        https://bugs.webkit.org/show_bug.cgi?id=47904
+
+        Make UnicodeWinCE more portable, so we can use it for other ports too.
+
+        * wtf/unicode/wince/UnicodeWinCE.cpp:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isAlphanumeric):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        * wtf/unicode/wince/UnicodeWinCE.h:
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isHighSurrogate):
+        (WTF::Unicode::isLowSurrogate):
+        (WTF::Unicode::umemcasecmp):
+        (WTF::Unicode::surrogateToUcs4):
+
+2010-10-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix style of UnicodeWinCE
+        https://bugs.webkit.org/show_bug.cgi?id=47818
+
+        * wtf/unicode/wince/UnicodeWinCE.cpp:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        * wtf/unicode/wince/UnicodeWinCE.h:
+
+2010-10-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: add missing file.
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: Functions created with the function constructor don't implement strict mode semantics
+        https://bugs.webkit.org/show_bug.cgi?id=47860
+
+        When creating the FunctionExecutable for a new function the function constructor
+        was always passing false for whether or not a function was strict, rather than
+        using the information from the freshly parsed function itself.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::fromGlobalCode):
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Strict mode: |this| should be undefined if it is not explicitly provided
+        https://bugs.webkit.org/show_bug.cgi?id=47833
+
+        To make strict mode behave correctly we want to pass undefined instead of null
+        as the default this value.  This has no impact on behaviour outside of strict
+        mode as both values are replaced with the global object if necessary.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+
+2010-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make a nullptr that works with OwnPtr and RefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=47756
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added NullPtr.h.
+
+        * wtf/NullPtr.h: Added.
+
+        * wtf/OwnArrayPtr.h: Add an overload of = taking nullptr.
+        * wtf/OwnPtr.h: Ditto.
+        * wtf/PassOwnArrayPtr.h: Ditto.
+        * wtf/PassOwnPtr.h: Ditto.
+        * wtf/PassRefPtr.h: Ditto.
+        * wtf/RefPtr.h: Ditto.
+        * wtf/RetainPtr.h: Ditto.
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: JIT doesn't check for |this| being an immediate before dereferencing
+        https://bugs.webkit.org/show_bug.cgi?id=47826
+
+        There's no guarantee that |this| will be a cell in a strict mode function, so
+        don't claim that it is.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+
+2010-10-18  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        if (0) throw "x" ; else { } throws parse error after r69906
+        https://bugs.webkit.org/show_bug.cgi?id=47807
+
+        r69906 introduced a bug: the semicolon is not parsed after a throw
+        expression anymore. Thus, the semicolon terminates the "if" parsing
+        in the example above, and the else token results a parse error.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseThrowStatement):
+
+2010-10-18  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Andreas Kling.
+
+        Remove some unnecessary lines of code from Parser.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=47816
+
+        * parser/Parser.cpp:
+
+2010-10-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Build broken with JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=47801
+
+        This is a regression caused by r69940.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+
+2010-10-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change FastAllocBase implementation into a macro
+        https://bugs.webkit.org/show_bug.cgi?id=42998
+
+        It was investigated in bug #33896 that inheriting classes from FastAllocBase 
+        can result in objects getting larger which leads to memory regressions. 
+        Using a macro instead of inheriting classes from FastAllocBase would solve the issue. 
+
+        * wtf/FastAllocBase.h: Add a WTF_MAKE_FAST_ALLOCATED macro
+
+2010-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: arguments is not valid as the base expression for pre- or post-fix expressions
+        https://bugs.webkit.org/show_bug.cgi?id=47791
+
+        Simple fix, check for arguments in addition to eval.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseUnaryExpression):
+
+2010-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: Assignment that would create a global should be a late ReferenceError, not a syntax failure
+        https://bugs.webkit.org/show_bug.cgi?id=47788
+
+        Fixing this required a couple of changes:
+         * resolve_base now has a flag to indicate whether it is being used for a put in strict mode.
+           this allows us to throw an exception when we're doing a completely generic resolve for
+           assignment, and that assignment would create a new global.
+         * There is a new opcode 'op_ensure_property_exists' that is used to determine whether
+           the property being assigned to already exists on the global object.  This currently
+           has no caching, but such caching could be added relatively trivially.  It is only used
+           in the case where we know that a property will be placed on the global object, and
+           we cannot verify that the property already exists.
+
+        In the jit we plant a call to cti_op_resolve_base_strict_put in the effected case rather
+        than making op_resolve_base have an additional runtime branch.
+
+        There's also a new helper function to create the exception for the invalid assignment.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseProgram):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createErrorForInvalidGlobalAssignment):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+
+2010-10-17  Simon Fraser  <simon.fraser@apple.com>
+
+        First part of fix for Windows build failure. Will wait for the
+        next set of link errors to determine the mangled forms for dtoaRoundSF
+        and dtoaRoundDP.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Very large and small numbers fail to round-trip through CSS
+        https://bugs.webkit.org/show_bug.cgi?id=20674
+        
+        New exports required to use DecimalNumber in WebCore.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-10-16  Kyusun Kim  <maniagoon@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add using declarations for currentTimeMS() and parseDateFromNullTerminatedCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=47758
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2010-10-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename StringHasherFunctions.h to StringHasher.h
+        https://bugs.webkit.org/show_bug.cgi?id=47200
+
+        Now StringHasherFunctions.h only contains the StringHasher class, so rename it to the correct name.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/StringHashFunctions.h: Removed.
+        * wtf/StringHasher.h: Copied from JavaScriptCore/wtf/StringHashFunctions.h.
+        * wtf/text/StringHash.h:
+        * wtf/text/StringImpl.h:
+
+2010-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Automatic Semicolon Insertion incorrectly inserts semicolon after break, continue, and return followed by a newline
+        https://bugs.webkit.org/show_bug.cgi?id=47762
+
+        The old YACC parser depended on the lexer for some classes of semicolon insertion.
+        The new parser handles ASI entirely on its own so when the lexer inserts a semicolon
+        on its own the net result is a spurious semicolon in the input stream.  This can result
+        in incorrect parsing in some cases:
+
+        if (0)
+            break
+        ;else {}
+
+        Would result in a parse failure as the output from the lexer is essentially
+
+        if (0)
+             break
+        ;;else
+
+        So the second semicolon is interpreted as a empty statement, which terminates the if,
+        making the else an error.
+
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseThrowStatement):
+          Parsing of throw statement was wrong, and only worked due to the weird behaviour
+          in the lexer
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+          Remove bogus semicolon insertion from the newline handling
+
+2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Replace some String::format() usages by StringConcatenate in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=47714
+
+        * wtf/text/StringConcatenate.h: Add UChar specific StringTypeAdapter, to accept single UChars in makeString().
+
+2010-10-15  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for Debug Leopard which is failng to compile after r69842.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-10-15  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The parenthetical assertion checking isn't working in some cases with YARR
+        Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46893
+
+        Calculate the countToCheck value of a TypeParentheticalAssertion by
+        subtracting the number of characters which follows
+        a TypeParentheticalAssertion term with the number of characters which should
+        be matched by terms which are contained
+        in the TypeParentheticalAssertion term (minimumSize).
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-10-14  Nathan Vander Wilt  <nate@andyet.net>
+
+        Reviewed by Darin Adler.
+
+        Added parser for ECMAScript 5 standard date format, so Date.parse can handle RFC 3339 timestamps: https://bugs.webkit.org/show_bug.cgi?id=44632
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * wtf/DateMath.cpp:
+        (WTF::ymdhmsToSeconds):
+        (WTF::parseES5DateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+
+2010-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace lots of String::format() usages by StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=47664
+
+        Add StringTypeAdapter<char> to accept single characters for makeString().
+
+        * wtf/text/StringConcatenate.h:
+        (WTF::makeString):
+
+2010-10-14  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        need way to measure size of JITed ARM code
+        https://bugs.webkit.org/show_bug.cgi?id=47121
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::dumpLinkStats):
+        (JSC::LinkBuffer::dumpCode):
+
+2010-10-14  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The backreference checking isn't working in some cases with YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46904
+
+        The Interpreter::matchBackReference() function returns true without matching
+        when a backreference points to the same parentheses where it is.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchBackReference):
+
+2010-10-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Text breaking is slow: enable ICU as an opt-in
+        https://bugs.webkit.org/show_bug.cgi?id=40332
+
+        Added a config flag that enables ICU as an opt-in instead of the Qt specific code.
+        Because of the inclusion of ICU headers, some explicit casting was necessary in UnicodeQt4.h
+
+        * JavaScriptCore.pri:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+
+2010-10-14  Anton Faern  <anton@bladehawke.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47658
+        NetBSD was not included in the WTF_PLATFORM_FOO to WTF_OS_FOO
+        change.  This means that OS(NETBSD) is also undefined.
+
+        * wtf/Platform.h: s/_PLATFORM_/_OS_/ for NetBSD
+
+2010-10-13  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARMv7 JIT should generated conditional branches when possible
+        https://bugs.webkit.org/show_bug.cgi?id=47384
+
+        Use different jump padding sizes for conditional and unconditional
+        jumps (12 bytes and 10 bytes respectively). This allows the JIT to
+        include the IT instruction as part of the conditional jump sequence
+        which in turn allows it to optimize away the IT using an ARMv7 
+        conditional branch instruction. Use 2-byte B(T1) and 4-byte B(T3) for
+        conditional branches when displacement is in range. Also use IT/B(T4)
+        for conditional branch when displacement does not fit in B(T3).
+
+        For unconditional jump, instruction selection options are:
+        B(T2), B(T4), MOVW/MOVT/BX. For conditional jump, instruction selection
+        options are: B(T1), B(T3), IT/B(T4), ITTT/MOVW/MOVT/BX.
+
+        * assembler/ARMv7Assembler.cpp:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
+        (JSC::ARMv7Assembler::ifThenElse):
+        (JSC::ARMv7Assembler::jumpSizeDelta):
+        (JSC::ARMv7Assembler::canCompact):
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::canBeJumpT1):
+        (JSC::ARMv7Assembler::canBeJumpT3):
+        (JSC::ARMv7Assembler::canBeJumpT4):
+        (JSC::ARMv7Assembler::linkJumpT1):
+        (JSC::ARMv7Assembler::linkJumpT3):
+        (JSC::ARMv7Assembler::linkJumpT4):
+        (JSC::ARMv7Assembler::linkConditionalJumpT4):
+        (JSC::ARMv7Assembler::linkBX):
+        (JSC::ARMv7Assembler::linkConditionalBX):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::canCompact):
+        (JSC::MacroAssemblerARMv7::computeJumpType):
+        (JSC::MacroAssemblerARMv7::jumpSizeDelta):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::ret):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+
+2010-10-13  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Darin Adler.
+
+        Don't depend on Windows on sched_yield and sched.h
+        https://bugs.webkit.org/show_bug.cgi?id=45543
+
+        sched.h is part of pthreads and sched_yield is implemented
+        in pthreads-win32 as Sleep(0). This patch avoids a gratuitous
+        dependency on pthreads-win32 in this file.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SlowLock):
+
+2010-10-13  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port unicode
+        https://bugs.webkit.org/show_bug.cgi?id=45716
+
+        Brew MP port uses only the subset of ICU library to reduce the binary size.
+        Follow the WinCE's implementation.
+
+        * wtf/Platform.h:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/brew/UnicodeBrew.cpp: Added.
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isAlphanumeric):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        * wtf/unicode/brew/UnicodeBrew.h: Added.
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic):
+        (WTF::Unicode::umemcasecmp):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        [WTFURL] Add URLQueryCanonicalizer
+        https://bugs.webkit.org/show_bug.cgi?id=45088
+
+        This class canonicalizes the query component of URLs.  The main tricky
+        bit there is the convertCharset function, which I've moved to a
+        templated dependency.  There'll likely be more about that in future
+        patches.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url/src/URLEscape.cpp: Added.
+        * wtf/url/src/URLEscape.h: Added.
+        (WTF::appendEscapedCharacter):
+        * wtf/url/src/URLQueryCanonicalizer.h: Added.
+        (WTF::URLQueryCanonicalizer::canonicalize):
+        (WTF::URLQueryCanonicalizer::isAllASCII):
+        (WTF::URLQueryCanonicalizer::appendRaw8BitQueryString):
+        (WTF::URLQueryCanonicalizer::convertToQueryEncoding):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43987 - Downloading using XHR is much slower than before
+        Change StringBuilder to use overcapacity in a StringImpl, rather than a Vector.
+        Fundamentally this should be the same (copies current contents to expand capacity,
+        rather than using a rope), but this approach allows the intermadiate state of the
+        String to be inspected in the buffer without copying to resolve.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::Stringifier::Holder::appendNextProperty):
+            Renamed StringBuilder::size() -> length() (to match other String types).
+
+        * runtime/UStringBuilder.h:
+        (JSC::UStringBuilder::append):
+        (JSC::UStringBuilder::toUString):
+            Update for changes in parent class, can just 'using' the append methods.
+
+        * wtf/text/StringBuilder.cpp: Added.
+        (WTF::StringBuilder::reifyString):
+        (WTF::StringBuilder::resize):
+        (WTF::StringBuilder::reserveCapacity):
+        (WTF::StringBuilder::allocateBuffer):
+        (WTF::StringBuilder::appendUninitialized):
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::shrinkToFit):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::StringBuilder):
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::toString):
+        (WTF::StringBuilder::toStringPreserveCapacity):
+        (WTF::StringBuilder::length):
+        (WTF::StringBuilder::isEmpty):
+        (WTF::StringBuilder::operator[]):
+        (WTF::StringBuilder::clear):
+            Class updated to use overcapacity in a StringImpl, rather than a Vector.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/wtf.pri:
+
+2010-10-13  Adam Roben  <aroben@apple.com>
+
+        Export tryFastRealloc for WebKit2's benefit
+
+        Rubber-stamped by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added
+        tryFastRealloc. Removed RegExpObject::info, which is now exported via
+        JS_EXPORTDATA.
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        [WTFURL] Add a mechanism for classifying types of characters
+        https://bugs.webkit.org/show_bug.cgi?id=45085
+
+        Various characters have different escaping rules depending on where
+        they are in URLs.  This patch adds a table containing that information.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url/src/URLCharacterTypes.cpp: Added.
+        * wtf/url/src/URLCharacterTypes.h: Added.
+        (WTF::URLCharacterTypes::isQueryChar):
+        (WTF::URLCharacterTypes::isIPv4Char):
+        (WTF::URLCharacterTypes::isHexChar):
+        (WTF::URLCharacterTypes::isCharOfType):
+
+2010-10-13  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Missing parameters for bytecode dump of next_pname
+        https://bugs.webkit.org/show_bug.cgi?id=47590
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): add missing parameters to the dump.
+
+2010-10-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Add wtf/text/StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=47584
+
+        Move runtime/StringConcatenate.h to wtf/text, make it work for Strings too.
+        Add a special runtime/UStringConcatenate.h class that inherits from StringConcatenate, and extends it for use with UString.
+        Exactly the same design that has been followed while refactoring StringBuilder.
+
+        The UString variants can all be removed as soon as WTF::String & JSC::UString converge.
+
+        * GNUmakefile.am: Add wtf/text/StringConcatenate.h and runtime/UStringConcatenate.h.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * bytecode/CodeBlock.cpp: s/makeString/makeUString/
+        (JSC::escapeQuotes):
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        * bytecompiler/NodesCodegen.cpp: Ditto.
+        (JSC::substitute):
+        * profiler/Profiler.cpp: Ditto.
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ExceptionHelpers.cpp: Ditto.
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        * runtime/FunctionConstructor.cpp: Ditto.
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp: Ditto.
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/JSONObject.cpp: Ditto.
+        (JSC::Stringifier::indent):
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/RegExpConstructor.cpp: Ditto.
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp: Ditto.
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp: Ditto.
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringConcatenate.h: Removed.
+        * runtime/UStringConcatenate.h: Added. Only contains the StringTypeAdapter<JSC::UString> code and the makeUString variants, the rest lives in wtf/text/StringConcatenate.h
+        (JSC::makeUString):
+        * wtf/text/StringConcatenate.h: Copied from runtime/StringConcatenate.h.
+        (WTF::makeString):
+
+2010-10-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::length):
+
+2010-10-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Unify JSC::StringBuilder & WebCore::StringBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=47538
+
+        Move runtime/StringBuilder.h to wtf/text/StringBuilder.h. Rename build() to toString() and return a WTF::String().
+        Move the append(const JSC::UString&) method into runtime/UStringBuilder.h.
+        UStringBuilder inherits from StringBuilder.h and adds append(const JSC::UString&) and UString toUString() functionality.
+
+        No new code, just move code around.
+
+        * GNUmakefile.am: Add wtf/text/StringBuilder.h / runtime/UStringBuilder.h. Remove runtime/StringBuilder.h.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString): Use UStringBuilder, instead of StringBuilder. Rename build() -> toUString().
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction): Ditto.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncUnescape): Ditto.
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify): Ditto.
+        (JSC::Stringifier::appendQuotedString): Ditto.
+        (JSC::Stringifier::appendStringifiedValue): Ditto.
+        (JSC::Stringifier::startNewLine): Ditto.
+        (JSC::Stringifier::Holder::appendNextProperty): Ditto.
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString): Ditto.
+        * runtime/NumberPrototype.cpp: Remove unneeded JSStringBuilder.h / StringBuilder.h include.
+        * runtime/StringBuilder.h: Removed.
+        * runtime/UStringBuilder.h: Added. Inherits from WTF::StringBuilder, extending it by two methods.
+        (JSC::UStringBuilder::append): append(const JSC::UString&)
+        (JSC::UStringBuilder::toUString):
+        * wtf/text/StringBuilder.h: Copied from runtime/StringBuilder.h. Move JSC::UString parts into runtime/UStringBuilder.h
+        (WTF::StringBuilder::append): Renamed m_buffer to buffer everywhere.
+        (WTF::StringBuilder::isEmpty): Ditto (+ constify method). 
+        (WTF::StringBuilder::reserveCapacity): Ditto.
+        (WTF::StringBuilder::resize): Ditto.
+        (WTF::StringBuilder::size): Ditto.
+        (WTF::StringBuilder::operator[]): Ditto.
+        (WTF::StringBuilder::toString): Ditto (+ renamed from build()). Returns a String, not an UString. The old build() method is now named toUString() and lives in UStringBuilder.
+
+2010-10-12  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cleaned up the processing of replacements after regular expression
+        processing, especially the case where there wasn't a match.
+        Changed to use empty strings instead of computing a zero length sub
+        string.
+        https://bugs.webkit.org/show_bug.cgi?id=47506
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncReplace):
+
+2010-10-11  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Clang build fix after r69472.
+        https://bugs.webkit.org/show_bug.cgi?id=46523
+
+        * wtf/text/StringHash.h:
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Undo last minute change to 32bit build.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_convert_this_strict):
+
+2010-10-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Build fix for Windows. Add a necessary export from r69516.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Fix interpreter build -- was broken by incorrect merge.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=10701
+
+        Initial strict mode implementation.  This is the simplest
+        implementation that could possibly work and adds (hopefully)
+        all of the restrictions required by strict mode.  There are
+        a number of inefficiencies, especially in the handling of
+        arguments and eval as smart implementations would make this
+        patch more complicated.  
+
+        The SyntaxChecker AST builder has become somewhat more complex
+        as strict mode does require more parse tree information to
+        validate the syntax.
+
+        Summary of major changes to the parser:
+            * We track when we enter strict mode (this may come as a surprise)
+            * Strict mode actually requires a degree of AST knowledge to validate
+              so the SyntaxChecker now produces values that can be used to distinguish
+              "node" types.
+            * We now track variables that are written to.  We do this to
+              statically identify writes to global properties that don't exist
+              and abort at that point.  This should actually make it possible
+              to optimise some other cases in the future but for now it's
+              purely for validity checking.  Currently writes are only tracked
+              in strict mode code.
+            * Labels are now tracked as it is now a syntax error to jump to a label
+              that does not exist (or to use break, continue, or return in a context
+              where they would be invalid).
+
+        Runtime changes:
+            * In order to get correct hanlding of the Arguments object all
+              strict mode functions that reference arguments create and tearoff
+              the arguments object on entry.  This is not strictly necessary
+              but was the least work necessary to get the correct behaviour.
+            * PutPropertySlot now tracks whether it is being used for a strict
+              mode write, and if so Object::put will throw when a write can't be
+              completed.
+            * StrictEvalActivation was added as an "activation" object for strict
+              mode eval (so that strict eval does not introduce new variables into
+              the containing scope).
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isStrictMode):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitReturn):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isStrictMode):
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emitSlow_op_convert_this_strict):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_pnames):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::isResolve):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::startLoop):
+        (JSC::JSParser::endLoop):
+        (JSC::JSParser::startSwitch):
+        (JSC::JSParser::endSwitch):
+        (JSC::JSParser::setStrictMode):
+        (JSC::JSParser::strictMode):
+        (JSC::JSParser::isValidStrictMode):
+        (JSC::JSParser::declareParameter):
+        (JSC::JSParser::breakIsValid):
+        (JSC::JSParser::pushLabel):
+        (JSC::JSParser::popLabel):
+        (JSC::JSParser::hasLabel):
+        (JSC::JSParser::DepthManager::DepthManager):
+        (JSC::JSParser::DepthManager::~DepthManager):
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::startSwitch):
+        (JSC::JSParser::Scope::endSwitch):
+        (JSC::JSParser::Scope::startLoop):
+        (JSC::JSParser::Scope::endLoop):
+        (JSC::JSParser::Scope::inLoop):
+        (JSC::JSParser::Scope::breakIsValid):
+        (JSC::JSParser::Scope::pushLabel):
+        (JSC::JSParser::Scope::popLabel):
+        (JSC::JSParser::Scope::hasLabel):
+        (JSC::JSParser::Scope::isFunction):
+        (JSC::JSParser::Scope::declareVariable):
+        (JSC::JSParser::Scope::declareWrite):
+        (JSC::JSParser::Scope::deleteProperty):
+        (JSC::JSParser::Scope::declareParameter):
+        (JSC::JSParser::Scope::setNeedsFullActivation):
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::JSParser::Scope::getUncapturedWrittenVariables):
+        (JSC::JSParser::Scope::getDeletedVariables):
+        (JSC::JSParser::Scope::setStrictMode):
+        (JSC::JSParser::Scope::strictMode):
+        (JSC::JSParser::Scope::isValidStrictMode):
+        (JSC::JSParser::pushScope):
+        (JSC::JSParser::popScope):
+        (JSC::JSParser::declareVariable):
+        (JSC::JSParser::declareWrite):
+        (JSC::JSParser::deleteProperty):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseSourceElements):
+        (JSC::JSParser::parseDoWhileStatement):
+        (JSC::JSParser::parseWhileStatement):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseForStatement):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseSwitchStatement):
+        (JSC::JSParser::parseSwitchClauses):
+        (JSC::JSParser::parseSwitchDefaultClause):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseBlockStatement):
+        (JSC::JSParser::parseStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionBody):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parseIfStatement):
+        (JSC::JSParser::parseExpression):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseConditionalExpression):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseStrictObjectLiteral):
+        (JSC::JSParser::parsePrimaryExpression):
+        (JSC::JSParser::parseMemberExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::isReparsing):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::isStrictMode):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::appendToComma):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegex):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::createStrictModeCallerIfNecessary):
+        (JSC::Arguments::createStrictModeCalleeIfNecessary):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getConstructData):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        (JSC::createTypeErrorFunction):
+        * runtime/Error.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::isStrictMode):
+        (JSC::EvalExecutable::create):
+        (JSC::FunctionExecutable::create):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::toStrictThisObject):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::createDescriptorForThrowingProperty):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::put):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::internalFunctionStructure):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::toStrictThisObject):
+        (JSC::throwTypeError):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isStrictModeFunction):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSValue::putDirect):
+        (JSC::JSValue::toStrictThisObject):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::toStrictThisObject):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSValue.h:
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::toStrictThisObject):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::isStrictMode):
+        * runtime/StrictEvalActivation.cpp: Added.
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        (JSC::StrictEvalActivation::deleteProperty):
+        (JSC::StrictEvalActivation::toThisObject):
+        (JSC::StrictEvalActivation::toStrictThisObject):
+        * runtime/StrictEvalActivation.h: Added.
+
+2010-10-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Windows build fix after r69472.
+
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::hash):
+
+2010-10-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Use WTF::StringHasher in WTF::CaseFoldingHash
+        https://bugs.webkit.org/show_bug.cgi?id=46523
+
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::foldCase):
+        (WTF::CaseFoldingHash::hash):
+
+2010-10-09  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47445
+        Remove unused function WTFThreadData::initializeIdentifierTable()
+
+        * wtf/WTFThreadData.h:
+
+2010-10-08  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added check to start of subexpression being positive before using
+        subexpression in replacement.
+        https://bugs.webkit.org/show_bug.cgi?id=47324
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+
+2010-10-08  Chris Evans  <cevans@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47393
+
+        Use unsigned consistently to check for max StringImpl length.
+        Add a few integer overflow checks.
+        Uses the existing paradigm of CRASH() when we can't reasonably handle a crazily large request.
+
+        * wtf/text/WTFString.cpp:
+        * wtf/text/StringImpl.h:
+        * wtf/text/StringImpl.cpp:
+        Better use of size_t vs. unsigned; check for integer overflows.
+
+2010-10-07  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARM JIT generates undefined operations due to partially uninitialized ShiftTypeAndAmount
+        https://bugs.webkit.org/show_bug.cgi?id=47356
+
+        * assembler/ARMv7Assembler.h:
+
+2010-10-06  Chris Evans  <cevans@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47248
+
+        Use size_t consistently in CString, to prevent theoretical trouble
+        with > 4GB strings on 64-bit platforms.
+
+        * wtf/text/CString.h:
+        * wtf/text/CString.cpp:
+        Use size_t for string lengths.
+        * wtf/MD5.cpp:
+        (WTF::expectMD5): use suitable format string + cast for size_t.
+        * JavaScriptCore.exp:
+        Update symbol name.
+
+2010-10-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start cleaning up Arguments.h
+        https://bugs.webkit.org/show_bug.cgi?id=47304
+
+        * wtf/TypeTraits.h:
+        * wtf/TypeTraits.cpp:
+        Add RemoveReference type trait.
+
+2010-10-06  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Build fix for glib support.
+        https://bugs.webkit.org/show_bug.cgi?id=47221
+
+        If compiling with GLib support enabled, we also need to link wtf against
+        glib library.
+
+        * wtf/CMakeListsEfl.txt:
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Gavin Barraclough.
+
+        [BREWMP] Port ExecutableAllocator::cacheFlush to enable ARM JIT
+        https://bugs.webkit.org/show_bug.cgi?id=47117
+
+        Use IMemCache1 to flush data cache and invalidate instruction cache.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-10-05  Leandro Pereira  <leandro@profusion.mobi>
+
+        Unreviewed. Build fix.
+
+        Moved "jsc" directory to "shell", so that the name does not clash with the
+        JavaScriptCore shell in some build systems.
+        http://webkit.org/b/47049
+
+        * CMakeLists.txt: Changed reference from "jsc" to "shell".
+        * jsc: Removed.
+        * jsc/CMakeLists.txt: Removed.
+        * jsc/CMakeListsEfl.txt: Removed.
+        * shell: Copied from JavaScriptCore/jsc.
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Use PlatformRefPtr in randomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=46989
+
+        Use PlatformRefPtr to free memory automatically.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2010-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r68338): JavaScript error on PowerPC only (crashes on Interpreter built for x86_64)
+        https://bugs.webkit.org/show_bug.cgi?id=46690
+
+        Use the correct register value when initialising the arguments
+        object in the interpreter.  This is covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-04  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARMv7 JIT should take advantage of 2-byte branches to reduce code size
+        https://bugs.webkit.org/show_bug.cgi?id=47007
+
+        * assembler/ARMv7Assembler.cpp:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::canBeJumpT2):
+        (JSC::ARMv7Assembler::canBeJumpT4):
+        (JSC::ARMv7Assembler::linkBX):
+        (JSC::ARMv7Assembler::linkJumpT4):
+        (JSC::ARMv7Assembler::linkJumpT2):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+
+2010-10-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Use fast malloc for WebKit EFL
+        https://bugs.webkit.org/show_bug.cgi?id=46691
+
+        Use fast malloc for WebKit EFL because the fast malloc is to allocate
+        memory quickly.
+
+        * wtf/CMakeListsEfl.txt:
+
+2010-10-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Lazily create activation objects
+        https://bugs.webkit.org/show_bug.cgi?id=47107
+
+        Make it possible to lazily create the activation object
+        for a function that needs one.  This allows us to reduce
+        the overhead of entering a function that may require
+        an activation in some cases, but not always.
+
+        This does make exception handling a little more complex as
+        it's now necessary to verify that a callframes activation
+        has been created, and create it if not, in all of the
+        paths used in exception handling.
+
+        We also need to add logic to check for the existence of
+        the activation in the scoped_var opcodes, as well as
+        op_ret, op_ret_object_or_this and op_tearoff_activation
+        so that we can avoid creating an activation unnecesarily
+        on function exit. 
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::createActivation):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setActivationRegister):
+        (JSC::CodeBlock::activationRegister):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::createActivationIfNecessary):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_create_activation):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-10-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Remove ENABLE_SANDBOX
+        https://bugs.webkit.org/show_bug.cgi?id=47032
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-10-01  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        Specify ALWAYS_INLINE at function declaration not function definition
+        https://bugs.webkit.org/show_bug.cgi?id=46960
+
+        For functions defined with ALWAYS_INLINE, add the attribute to the declaration as well.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * wtf/FastMalloc.cpp:
+
+2010-10-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Unreviewed.
+
+        [BREWMP] Change Collector BLOCK_SIZE to 64KB
+        https://bugs.webkit.org/show_bug.cgi?id=46436
+
+        Lower BLOCK_SIZE to 64KB because Brew MP runs on low end devices.
+
+        * runtime/Collector.h:
+
+2010-10-01  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Stack overflow on symbian platform.
+        https://bugs.webkit.org/show_bug.cgi?id=40598
+        
+        Move big allocation in arrayProtoFuncToString from stack to heap.
+        JSC::arrayProtoFuncToString function can be called recursivly and
+        1K allocation on stack cahse stack overflow.
+        Can be useful for other platforms with limited stack size.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add a factory function which returns an instance wrapped in PlatformRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=46373
+
+        A Brew MP instance has reference count 1 when it is created, so call adoptPlatformRef
+        to wrap the instance in PlatformRefPtr.
+
+        * wtf/brew/ShellBrew.h:
+        (WTF::createRefPtrInstance):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port PlatformRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=46370
+
+        Implement refPlatformPtr and derefPlatformPtr to use PlatformRefPtr in Brew MP.
+
+        * wtf/brew/RefPtrBrew.h: Added.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+
+2010-09-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add additional checks to StringBuffer.
+        <rdar://problem/7756381>
+
+        * wtf/text/StringBuffer.h:
+        (WTF::StringBuffer::StringBuffer):
+        (WTF::StringBuffer::resize):
+
+2010-09-30  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make 2D accelerated canvas rendering build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=46007
+        
+        Added ACCELERATED_2D_CANVAS to FeatureDefines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-09-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] wxMSW build fix. Make sure we copy the compiler flags and remove exception handling from
+        the copy so as not to alter global settings.
+
+        * wscript:
+
+2010-09-30  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The case-insensitivity backreference checking isn't working with YARR
+        Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46882
+
+        Add ignorecase checking to the Interpreter::tryConsumeBackReference() function.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Andreas Kling.
+
+        [BREWMP] Leave initializeRandomNumberGenerator empty.
+        https://bugs.webkit.org/show_bug.cgi?id=46851
+
+        On Brew MP, AEECLSID_RANDOM initializes itself.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2010-09-30  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Remove unnecessary cacheFlush calls from Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=46702
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::relinkCall):
+        (JSC::ARMv7Assembler::repatchInt32):
+        (JSC::ARMv7Assembler::repatchPointer):
+
+2010-09-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Next try to fix cygwin build.
+
+        * wtf/Assertions.cpp:
+
+2010-09-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Build fix for cygwin #2. It's OS(WINDOWS), not OS(WIN).
+
+        * wtf/Assertions.cpp:
+
+2010-09-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Build fix for cygwin.
+
+        * wtf/Assertions.cpp:
+
+2010-09-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [WINCE] Buildfix for Assertions.cpp after r68511.
+        https://bugs.webkit.org/show_bug.cgi?id=46807
+
+        Some, but not all WinCE environments have support for IsDebuggerPresent().
+        Add HAVE(ISDEBUGGERPRESENT) to make this a build option.
+        HAVE(ISDEBUGGERPRESENT) will be 1 for all OS(WIN) by default.
+
+        * wtf/Assertions.cpp:
+        * wtf/Platform.h:
+
+2010-09-29  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Csaba Osztrogonác.
+
+        JSC compile fails on 32bit platform when Regexp Tracing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=46713
+
+        Fix the cast of pointer in regexp tracing to avoid the warning.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-09-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Begin hooking up painting in the plug-in process
+        https://bugs.webkit.org/show_bug.cgi?id=46766
+
+        * JavaScriptCore.exp:
+        Add tryFastRealloc, used by WebKit2.
+
+2010-09-28  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Guard GRefPtr/GOwnPtr files with ENABLE(GLIB_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=46721
+
+        Enable GOwnPtr/GRefPtr build only if glib support has been
+        explicitly enabled using the WTF_ENABLE_GLIB_SUPPORT macro.
+
+        * wtf/gobject/GOwnPtr.cpp:
+        * wtf/gobject/GOwnPtr.h:
+        * wtf/gobject/GRefPtr.cpp:
+        * wtf/gobject/GRefPtr.h:
+
+2010-09-28  İsmail Dönmez  <ismail@namtrac.org>
+
+        Reviewed by Andreas Kling.
+
+        Test for WINCE instead of WINCEBASIC, compiler always defines WINCE.
+        Remove reference to unexisting path JavaScriptCore/os-wince.
+
+        * JavaScriptCore.pri:
+        * wtf/Assertions.cpp:
+
+2010-09-27  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Changed the initialization of JSArray objects to have space for 
+        3 elements for the constructor that takes a ArgList argument.
+        This improves v8-deltablue performance by about 2.8% by reducing 
+        the number of realloc() calls.
+        https://bugs.webkit.org/show_bug.cgi?id=46664
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+
+2010-09-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 46680 - Inlining string concatenation can regress interpreter performance
+        <rdar://problem/8362752> REGRESSION: ~6.4% sunspider regression in interpreter
+        Do not inline calls to string concatenation in the interpret loop.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::concatenateStrings):
+        (JSC::Interpreter::privateExecute):
+
+2010-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Fix thinko.
+
+        * runtime/JSCell.h:
+
+2010-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Try to fix Windows build.
+
+        * runtime/JSCell.h:
+        (JSC::MSVCBugWorkaround::MSVCBugWorkaround):
+        (JSC::MSVCBugWorkaround::~MSVCBugWorkaround):
+
+2010-09-27  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add operator == for AtomicString and Vector<Uchar>
+        https://bugs.webkit.org/show_bug.cgi?id=46509
+
+        * JavaScriptCore.exp:
+        * wtf/text/AtomicString.cpp:
+        (WTF::operator==):
+        * wtf/text/AtomicString.h:
+        (WTF::operator==):
+        (WTF::operator!=):
+
+2010-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * wtf/Noncopyable.h:
+
+2010-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Alexey Proskuryakov and Adam Barth.
+
+        Add WTF_MAKE_NONCOPYABLE macro
+        https://bugs.webkit.org/show_bug.cgi?id=46589
+
+        Going forward, we'd like to get rid of the Noncopyable and FastAllocBase classes. The
+        reason for this is that the Itanium C++ ABI states that no empty classes of the same type
+        can be laid out at the same offset in the class. This can result in objects getting larger
+        which leads to memory regressions. (One example of this is the String class which grew by
+        sizeof(void*) when both its base class and its first member variable inherited indirectly
+        from FastAllocBase).
+
+        * wtf/Noncopyable.h:
+        Add a WTF_MAKE_NONCOPYABLE macro and get rid of NoncopyableCustomAllocated.
+        
+        * runtime/JSCell.h:
+        * wtf/RefCounted.h:
+        Don't inherit from NoncopyableCustomAllocated. Instead, use WTF_MAKE_NONCOPYABLE.
+
+2010-09-27  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] use ENABLE(GLIB_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=46630
+
+        * wtf/Platform.h: Include GTypedefs.h only if glib support
+        is explicitly enabled.
+
+2010-09-25  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
+
+        Reviewed by Adam Barth.
+
+        jsc: Document the strcat opcode.
+        https://bugs.webkit.org/show_bug.cgi?id=46571
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-09-21  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
+
+        Reviewed by Adam Barth.
+
+        make-bytecode-docs.pl: Add a comment to the generated HTML
+        https://bugs.webkit.org/show_bug.cgi?id=46570
+
+        Generate an HTML Comment that this file was generated from
+        Interpreter.cpp with the make-bytecode-docs.pl script.
+
+        * docs/make-bytecode-docs.pl:
+
+2010-09-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Remove WTF::stringHash functions
+        https://bugs.webkit.org/show_bug.cgi?id=46520
+
+        Since r68289 the stringHash functions are only wrappers around StringHasher::createHash.
+        So use StringHasher::createHash directly and remove stringHash.
+
+        * wtf/StringHashFunctions.h:
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::computeHash): Use WTF::StringHasher::createHash directly.
+
+2010-09-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add WTF::StringHasher::createBlobHash
+        https://bugs.webkit.org/show_bug.cgi?id=46514
+
+        Add this function for hashing FormElementKey and QualifiedNameComponents.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::StringHasher::createBlobHash):
+
+2010-09-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION (r68289): Assertion failure in StringHasher::addCharacter() (ch != invalidCharacterValue)
+        running websocket/tests/bad-sub-protocol-non-ascii.html
+        https://bugs.webkit.org/show_bug.cgi?id=46553
+
+        Because we use StringHasher for binary data too, so the check for invalid unicode input is wrong.
+        Add an additional member variable to indicate if we have an pending character
+        instead of only using an invalid character for this purpose.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::StringHasher::StringHasher):
+        (WTF::StringHasher::addCharacters):
+        (WTF::StringHasher::addCharacter):
+        (WTF::StringHasher::hash):
+
+2010-09-26  Mark Hahnenberg  <mhahnenb@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        valueOf called in wrong order in atan2 and date constructors.
+        https://bugs.webkit.org/show_bug.cgi?id=26978
+
+        Fixed the bug where the arguments to atan2 were being evaluated 
+        out of order.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncATan2):
+
+2010-09-26  Mark Hahnenberg  <mhahnenb@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        valueOf called in wrong order in atan2 and date constructors.
+        https://bugs.webkit.org/show_bug.cgi?id=26978
+
+        Fixed the issue where the parameters to the Date constructor
+        were being evaluated to numbers more than once.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateUTC):
+
+2010-09-25  Oliver Hunt  <oliver@apple.com>
+
+        Fix various builds
+
+        Relearning the lesson that last minute changes are bad.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetArgumentsLength):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+
+2010-09-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Avoid constructing arguments object when accessing length and index properties
+        https://bugs.webkit.org/show_bug.cgi?id=46572
+
+        Add opcodes to read argument length and properties, and then implement them.
+        Much like other lazy opcodes these opcodes take a fast path when the arguments
+        object has not been instantiated, and fall back on generic access mechanisms
+        if they are acting on an instantiated object.
+
+        3% win on v8-earleyboyer, no change elsewhere.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetArgumentsLength):
+        (JSC::BytecodeGenerator::emitGetArgumentByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+
+2010-09-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Fix typo in StringHasher class
+        https://bugs.webkit.org/show_bug.cgi?id=45970
+
+        * wtf/StringHashFunctions.h:
+        (WTF::StringHasher::createHash):
+
+2010-09-24  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add WTF::StringHasher
+        https://bugs.webkit.org/show_bug.cgi?id=45970
+
+        StringHasher is a class for calculation stringHash out of character string.
+        This class will unify the different usages of the same algorithm.
+
+        * wtf/StringHashFunctions.h:
+        (WTF::StringHasher::StringHasher):
+        (WTF::StringHasher::addCharacters):
+        (WTF::StringHasher::addCharacter):
+        (WTF::StringHasher::hash):
+        (WTF::StringHasher::createHash):
+        (WTF::StringHasher::defaultCoverter):
+        (WTF::StringHasher::addCharactersToHash):
+        (WTF::stringHash):
+
+2010-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Variable declarations inside a catch scope don't get propogated to the parent scope
+        https://bugs.webkit.org/show_bug.cgi?id=46501
+
+        Add logic to make variable declaration look for a scope for the
+        new variable.  This allows us to create a scope (eg. for catch)
+        and then seal it, so that additional variable declarations
+        contained are propogated to the correct target.  Strangely this
+        comes out as a performance win, but I think it's mostly cache
+        effects.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::preventNewDecls):
+        (JSC::JSParser::Scope::allowsNewDecls):
+        (JSC::JSParser::declareVariable):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionDeclaration):
+
+2010-09-24  İsmail Dönmez  <ismail@namtrac.org>
+
+       Reviewed by Csaba Osztrogonác.
+
+       Add a Windows compatible inttypes.h header to fix WinCE build.
+       https://bugs.webkit.org/show_bug.cgi?id=46463
+
+       * os-win32/inttypes.h: Added.
+
+2010-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION(r68223): It broke 2-3 tests on bots (Requested by Ossy on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=46448
+
+        Roll this back in, with additional logic to prevent us from delaying construction
+        of functions named "arguments"
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitInitLazyRegister):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_init_lazy_reg):
+        (JSC::JIT::emit_op_new_func):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_init_lazy_reg):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+
+2010-09-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r68223.
+        http://trac.webkit.org/changeset/68223
+        https://bugs.webkit.org/show_bug.cgi?id=46448
+
+        It broke 2-3 tests on bots (Requested by Ossy on #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_init_arguments):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_init_arguments):
+        * parser/Nodes.h:
+
+2010-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Delay construction of functions that aren't captured
+        https://bugs.webkit.org/show_bug.cgi?id=46433
+
+        If a function isn't captured by an activation there's no
+        way it can be accessed indirectly, so we can delay the
+        construction until it's used (similar to what we do with
+        arguments).  We rename the existing op_init_arguments to
+        op_init_lazy_reg and removed its implicit handling of
+        the anonymous argument register, and make op_new_function
+        take a parameter to indicate whether it should null check
+        the target slot before creating the function object.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitInitLazyRegister):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_init_lazy_reg):
+        (JSC::JIT::emit_op_new_func):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_init_lazy_reg):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+
+2010-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/8460731> ~9.9% speedup when compiling interpreter with llvm-gcc-4.2
+        https://bugs.webkit.org/show_bug.cgi?id=46423
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Disable the gcc computed
+        goto hacks added in r55564 when compiling with llvm-gcc-4.2.
+
+2010-09-23  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Darin Adler.
+
+        Fix usage of enum as if it was a define
+        https://bugs.webkit.org/show_bug.cgi?id=46355
+
+        pthread.h defines PTHREAD_MUTEX_DEFAULT and PTHREAD_MUTEX_NORMAL as an
+        enum.  Hence, it cannot be used by the preprocessor which always
+        evaluates that condition as true. This was giving a warning when
+        compiling with gcc and "-Wundef" flag.
+
+        The second path, when PTHREAD_MUTEX_DEFAULT is not the same of
+        PTHREAD_MUTEX_NORMAL, is not slow. So, let's eliminate the first path
+        and get rid of that #if.
+
+        * wtf/ThreadingPthreads.cpp: Always call pthread_mutexattr_init() to
+        set mutex type to PTHREAD_MUTEX_NORMAL.
+        (WTF::Mutex::Mutex):
+
+2010-09-23  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Removed extraneous truncation of ovector on entry and error exit.
+        Changed the initialization to -1 of vector to only initialize
+        the start indecies, which is sufficient for the pattern/subpatterns.
+        Changed the JIT code to not clear the end index for subpatterns
+        as it isn't needed.  These changes are worth ~2.7% on v8-regexp.
+        https://bugs.webkit.org/show_bug.cgi?id=46404
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+
+2010-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Only copy captured variables into activation
+        https://bugs.webkit.org/show_bug.cgi?id=46330
+
+        We now track free variable information which means that
+        we no longer need to copy every variable defined in a
+        function.  With this patch activations only retain those
+        variables needed for correctness.  In order to interact
+        safely with the inspector this means that JSActivation
+        now provides its own lookup functions so it can avoid 
+        trying to read or write to variables that have been
+        optimised out.
+
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::capturedVariableCount):
+        (JSC::ScopeNode::captures):
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::capturedVariableCount):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSActivation.h:
+
+2010-09-23  Ismail Donmez  <ismail@namtrac.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix jsc.exe build for Windows CE
+
+        * jsc.pro: Add mmtimer.lib for Windows CE.
+
+2010-09-23  Ismail Donmez  <ismail@namtrac.org>
+
+        Unreviewed.
+
+        JIT should be disabled on Windows CE. Broken in r64176.
+
+        * wtf/Platform.h:
+
+2010-09-23  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        Reduce the number of BOL checks in YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46260
+
+        Extend the YARR Interpreter with an optimization which reduces the number of
+        BOL assertion checks. If a "TypeBodyAlternative" byteTerm is followed by a
+        "TypeAssertionBOL" byteTerm it will be checked just one time.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
+        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+
+2010-09-22  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed the cross over from alternatives executed once and
+        those that loop.  This fixed the problem where the index
+        was getting messed up for looping alternatives causing an
+        infinite loop.
+        https://bugs.webkit.org/show_bug.cgi?id=46189
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2010-09-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Rubber stamped by Jon Honeycutt.
+
+        Allow jsc.exe to be run against unversioned ICU.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2010-09-22  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Laszlo Gombos.
+
+        Use "typedef wchar_t JSChar" when compiled with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=40651
+
+        Use wchar_t for JSChar and UChar when compiled with RVCT.
+        Linux is the exception for this rule.
+
+        * API/JSStringRef.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2010-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [INTERPRETER] Two tests fail with SputnikError: #1.1: if argArray is neither an array nor an arguments object (see 10.1.8), a TypeError exception is thrown
+        https://bugs.webkit.org/show_bug.cgi?id=44245
+
+        Remove incorrect code from op_load_varargs in the interpreter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [JIT] fast/js/sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.5/S15.3.5.3_A2_T6.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=44246
+
+        JIT code generated for instanceof was not checking to ensure that the prototype property was
+        an object, this patch ensures that it does.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+
+2010-09-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Inline UTF8SequenceLength
+        https://bugs.webkit.org/show_bug.cgi?id=45589
+
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::convertUTF8ToUTF16): Use inline version of UTF8SequenceLength to improve performance.
+
+2010-09-21  Oliver Hunt  <oliver@apple.com>
+
+        RS=Gavin Barraclough.
+
+        Fix codeblock dumping
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+
+2010-09-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Speed up function.apply(..., arguments)
+        https://bugs.webkit.org/show_bug.cgi?id=46207
+
+        Add code to do argument copying inline in the case
+        where we're using Function.apply to forward our arguments
+        directly.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+           Splitted op_load_varargs into fast and slow paths, so add the call
+           to the slow path generator.
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+          Remove 32bit specific emit_op_load_varargs as the logic is the
+          same for all value representations
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_load_varargs):
+          Copy arguments inline
+        (JSC::JIT::emitSlow_op_load_varargs):
+
+2010-09-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8363003> REGRESSION: ~1.4% sunspider regression in
+        interpreter due to 54724 and 54596
+        
+        Fixed a typo (using "UNLIKELY" instead of "LIKELY").
+        
+        * wtf/PassRefPtr.h:
+        (WTF::refIfNotNull):
+        (WTF::derefIfNotNull): It is likely that m_ptr != 0 because most RefPtrs
+        hold real data. Also, in cases where they do not hold real data, the
+        compiler usually sees a call to release() right before the call to the
+        destructor, so it can probably optimize out the test completely.
+
+2010-09-21  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Martin Robinson.
+
+        Build issues with Windows versions of the GTK+ port
+        https://bugs.webkit.org/show_bug.cgi?id=45844
+
+        Link with winmm.dll when necessary and specify the executable extension
+        explicitely so that the Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@
+        rule actually works.
+
+        Don't try to build the ThreadSpecificWin.cpp since GTK+ port uses
+        a section in ThreadSpecific.cpp
+
+        * GNUmakefile.am:
+
+2010-09-21  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] 'make dist' should be fixed in preparation for the next release
+        https://bugs.webkit.org/show_bug.cgi?id=46129
+
+        * GNUmakefile.am: Update the sources list to include missing headers.
+
+2010-09-21  Dave Tapuska  <dtapuska@rim.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45673
+
+        r65596 caused ENABLE_PROFILER_REFERENCE_OFFSET to not be
+        8 byte aligned. A non 8 byte divisible value for this will
+        cause the sp to become non 8 byte aligned.
+
+        Verify and correct offset values that r65596 effected that
+        weren't updated.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-09-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Fix Opcode stats compilation
+        https://bugs.webkit.org/show_bug.cgi?id=46079
+
+        The FixedArray API had changed, and <stdio.h> was not included for
+        printf.
+
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+
+2010-09-20  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed detection of alternative smaller than the first alternative
+        to only check looping alternatives.
+        https://bugs.webkit.org/show_bug.cgi?id=46049
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2010-09-20  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        REGRESSION(67790): jsc tests are failed with YARR interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46083
+
+        Fix the initializing of the lastSubpatternId member of
+        parentheses.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+
+2010-09-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 46077 - ASSERT failure in YARR JIT
+
+        We will currently attempt to loop if there are multiple alternatives, they are all
+        BOL predicated, and the last alternative is longer then the first - however if all
+        alternatives are BOL predicated the head of loop label will not have been set, and
+        we'll try to link a jump to an undefined label. Stop doing so.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2010-09-20  Adam Roben  <aroben@apple.com>
+
+        Export RegExpObject::info from JavaScriptCore
+
+        This allows obj->inherits(&RegExpObject::info) to work correctly from
+        outside JavaScriptCore.dll on Windows.
+
+        Fixes <http://webkit.org/b/46098>
+        fast/loader/stateobjects/pushstate-object-types.html fails on Windows
+
+        Reviewed by John Sullivan.
+
+        * runtime/RegExpObject.h: Added JS_EXPORTDATA to the info member, as
+        we already have for some other classes whose info members have to be
+        used from outside the DLL.
+
+2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix - implicit double-to-int conversion invalid on 32-bit.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncSetYear):
+
+2010-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 46065 - Unify implementation of ToInt32 and ToUInt32, don't use fmod.
+
+        These methods implement the same conversion (see discussion in the notes
+        of sections of 9.5 and 9.6 of the spec), only differing in how the result
+        is interpretted.
+
+        Date prototype is incorrectly using toInt32, and this is causing us to
+        provide an output value indicating whether the input to ToInt32 was finite
+        (the corresponding methods on Date are actually spec'ed to use ToInteger,
+        not ToInt32).  This patch partially fixes this in order to remove this
+        bogus output value, hoewever more work will be require to bring Date
+        fully up to spec compliance (the constructor is still performing ToInt32
+        conversions).
+
+        * JavaScriptCore.exp:
+        * runtime/DatePrototype.cpp:
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/JSValue.cpp:
+        (JSC::toInt32):
+        * runtime/JSValue.h:
+        (JSC::toUInt32):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+
+2010-09-18  Darin Adler  <darin@apple.com>
+
+        First step in fixing Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Removed incorrect symbol. The build will probably still fail,
+        but the failure will tell us what symbol to add.
+
+2010-09-18  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Added code to unroll regular expressions containing ^.
+        Alternatives that begin with ^ are tagged during parsing
+        and rolled up in containing sub expression structs.
+        After parsing, a regular expression flagged as containing
+        a ^ (a.k.a. BOL) is processed further in optimizeBOL().
+        A copy of the disjunction is made excluding alternatives that
+        are rooted with BOL.  The original alternatives are flagged
+        to only be executed once.  The copy of the other alternatives are
+        added to the original expression.
+        In the case that all original alternatives are flagged, there
+        won't be any looping alternatives.
+        The JIT generator will emit code accordingly, executing the
+        original alternatives once and then looping over the
+        alternatives that aren't anchored with a BOL (if any).
+        https://bugs.webkit.org/show_bug.cgi?id=45787
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::assertionBOL):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+        (JSC::Yarr::RegexPatternConstructor::copyTerm):
+        (JSC::Yarr::RegexPatternConstructor::optimizeBOL):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternAlternative::PatternAlternative):
+        (JSC::Yarr::PatternAlternative::setOnceThrough):
+        (JSC::Yarr::PatternAlternative::onceThrough):
+        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-09-18  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Rename Wince files to WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=37287
+
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/wince/UnicodeWinCE.cpp: Copied from JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp.
+        * wtf/unicode/wince/UnicodeWinCE.h: Copied from JavaScriptCore/wtf/unicode/wince/UnicodeWince.h.
+        * wtf/unicode/wince/UnicodeWince.cpp: Removed.
+        * wtf/unicode/wince/UnicodeWince.h: Removed.
+        * wtf/wince/FastMallocWinCE.h: Copied from JavaScriptCore/wtf/wince/FastMallocWince.h.
+        * wtf/wince/FastMallocWince.h: Removed.
+
+2010-09-18  Ademar de Souza Reis Jr  <ademar.reis@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Enable Platform Strategies on Qt
+
+        [Qt] Turn on PLATFORM_STRATEGIES
+        https://bugs.webkit.org/show_bug.cgi?id=45831
+
+        * wtf/Platform.h: Enable Platform Strategies when building QtWebkit
+
+2010-09-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Imprecise tracking of variable capture leads to overly pessimistic creation of activations
+        https://bugs.webkit.org/show_bug.cgi?id=46020
+
+        The old logic for track free and captured variables would cause us
+        to decide we needed an activation in every function along the scope
+        chain between a variable capture and its declaration.  We now track
+        captured variables precisely which requires a bit of additional work
+
+        The most substantial change is that the parsing routine needs to
+        be passed the list of function parameters when reparsing a function
+        as when reparsing we don't parse the function declaration itself only
+        its body.
+
+        * JavaScriptCore.exp:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::needsFullActivation):
+           We need to distinguish between use of a feature that requires
+           an activation and eval so we now get this additional flag.
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::JSParser::Scope::getCapturedVariables):
+           We can't simply return the list of "capturedVariables" now as
+           is insufficiently precise, so we compute them instead.
+        (JSC::JSParser::popScope):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseMemberExpression):
+        * parser/JSParser.h:
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+           Pass function parameters (if available) to the parser.
+
+2010-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add IsFloatingPoint and IsArithmetic type traits
+        https://bugs.webkit.org/show_bug.cgi?id=46018
+
+        * wtf/TypeTraits.h:
+        * wtf/TypeTraits.cpp:
+
+2010-09-17  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] FontPlatformDataFreeType should use smart pointers to hold its members
+        https://bugs.webkit.org/show_bug.cgi?id=45917
+
+        Added support to PlatformRefPtr for handling HashTableDeletedValue.
+
+        * wtf/PlatformRefPtr.h:
+        (WTF::PlatformRefPtr::PlatformRefPtr): Added a constructor that takes HashTableDeletedValue.
+        (WTF::PlatformRefPtr::isHashTableDeletedValue): Added.
+
+2010-09-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Crash due to timer triggered GC on one heap while another heap is active
+        https://bugs.webkit.org/show_bug.cgi?id=45932
+        <rdar://problem/8318446>
+
+        The GC timer may trigger for one heap while another heap is active.  This
+        is safe, but requires us to ensure that we have temporarily associated the
+        thread's identifierTable with the heap we're collecting on.  Otherwise we
+        may end up with the identifier tables in an inconsistent state leading to
+        an eventual crash.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocate):
+        (JSC::Heap::reset):
+        (JSC::Heap::collectAllGarbage):
+           Add assertions to ensure we have the correct identifierTable active
+           while collecting.
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
+           Temporarily make the expected IdentifierTable active
+        * wtf/WTFThreadData.h:
+        (JSC::IdentifierTable::remove):
+           Make it possible to see when IdentifierTable::remove has succeeded
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::~StringImpl):
+           CRASH if an StringImpl is an Identifier but isn't present in the
+           active IdentifierTable.  If we get to this state something has
+           gone wrong and we should just crash immediately.
+
+2010-09-16  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Implement dissolveDragImageToFraction
+        https://bugs.webkit.org/show_bug.cgi?id=45826
+
+        * wtf/gobject/GTypedefs.h: Added forward declarations for GtkWindow and GdkEventExpose.
+
+2010-09-16  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Jian Li.
+
+        Unify FILE_SYSTEM and FILE_WRITER enables under the name FILE_SYSTEM.
+        https://bugs.webkit.org/show_bug.cgi?id=45798
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-09-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Use free variable analysis to improve activation performance
+        https://bugs.webkit.org/show_bug.cgi?id=45837
+
+        Adds free and captured variable tracking to the JS parser.  This
+        allows us to avoid construction of an activation object in some
+        cases.  Future patches will make more use of this information to
+        improve those cases where activations are still needed.
+
+        * parser/ASTBuilder.h:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::declareVariable):
+        (JSC::JSParser::Scope::useVariable):
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::JSParser::Scope::capturedVariables):
+        (JSC::JSParser::ScopeRef::ScopeRef):
+        (JSC::JSParser::ScopeRef::operator->):
+        (JSC::JSParser::ScopeRef::index):
+        (JSC::JSParser::currentScope):
+        (JSC::JSParser::pushScope):
+        (JSC::JSParser::popScope):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parsePrimaryExpression):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::needsActivation):
+        (JSC::ScopeNode::hasCapturedVariables):
+        * parser/Parser.cpp:
+        (JSC::Parser::didFinishParsing):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::recordParse):
+
+2010-09-14  Hyung Song  <beergun@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add IMemGroup and IMemSpace to OwnPtr type.
+        https://bugs.webkit.org/show_bug.cgi?id=44764
+
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.cpp:
+        (WTF::deleteOwnedPtr):
+
+2010-09-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Sort with non-numeric custom sort function fails on array with length but no values
+        https://bugs.webkit.org/show_bug.cgi?id=45781
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Replaced early exit for an array of length zero to instead
+        exit for any array without values, even if it has a non-0 length.
+
+2010-09-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows production build fix.
+        Roll out r65143.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-09-14  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Share UnicodeMacrosFromICU.h
+        https://bugs.webkit.org/show_bug.cgi?id=45710
+
+        glib, qt4 and wince use the same macros from ICU.
+        Remove the code duplication and use the same header file.
+
+        * wtf/unicode/UnicodeMacrosFromICU.h: Copied from JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h.
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Removed.
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWince.h:
+
+2010-09-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Preparation for eliminating deprecatedParseURL
+        https://bugs.webkit.org/show_bug.cgi?id=45695
+
+        * wtf/text/WTFString.h: Added isAllSpecialCharacters, moved here from
+        the HTML tree builder.
+
+2010-09-13  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add option to conditionally compile smooth scrolling support.
+        https://bugs.webkit.org/show_bug.cgi?id=45689
+
+        ENABLE(SMOOTH_SCROLLING) is disabled by default for all platforms.
+
+        * wtf/Platform.h:
+
+2010-09-13  Adam Roben  <aroben@apple.com>
+
+        Copy JavaScriptCore's generated sources to the right directory
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Fixed typo.
+
+2010-09-13  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Don't call _msize
+        https://bugs.webkit.org/show_bug.cgi?id=45556
+
+        Because Brew MP uses its own memory allocator, it is not correct to use
+        _msize in fastMallocSize. Add !PLATFORM(BREWMP) guard.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSize):
+
+2010-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] V8 port: webcore project files changes
+        https://bugs.webkit.org/show_bug.cgi?id=45141
+
+        * JavaScriptCore.pro: Moved wtf specific files to wtf.pri,
+        so that they can also be used from WebCore.pro for v8 builds.
+        * wtf/wtf.pri: Added.
+
+2010-09-10  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Andreas Kling.
+
+        Add a define missing when building with glib unicode backend
+        https://bugs.webkit.org/show_bug.cgi?id=45544
+
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h:
+
+2010-09-10  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Refactor JavaScriptCore memory statistics so that WebKit doesn't need to know 
+        about the JIT and other implementation details of JavaScriptCore.  Necessary 
+        to fix PPC build.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=45528
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/MemoryStatistics.cpp: Added.
+        (JSC::memoryStatistics):
+        * runtime/MemoryStatistics.h: Added.
+
+2010-09-09  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Added a regular expression tracing facility.  This tracing is connected
+        to jsc.  Every compiled regular expression object is added to a list.
+        When the process exits, each regular expression dumps its pattern,
+        JIT address, number of times it was executed and the number of matches.
+        This tracing is controlled by the macro ENABLE_REGEXP_TRACING in
+        wtf/Platform.h.
+        https://bugs.webkit.org/show_bug.cgi?id=45401
+
+        * JavaScriptCore.exp:
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::addRegExpToTrace):
+        (JSC::JSGlobalData::dumpRegExpTrace):
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wtf/Platform.h:
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::getAddr):
+
+2010-09-09  John Therrell  <jtherrell@apple.com>
+
+        32-bit build fix.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::committedByteCount):
+
+2010-09-09  John Therrell  <jtherrell@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Added statistics sampling and reporting for JavaScriptCore's RegisterFile and ExecutableAllocator classes
+        https://bugs.webkit.org/show_bug.cgi?id=45134
+
+        Added thread-safe committed byte counting and reporting functionality to RegisterFile and 
+        ExecutableAllocator.
+
+        * JavaScriptCore.exp:
+        Exported new symbols to allow for WebKit to get statistics from JavaScriptCore classes.
+        
+        * interpreter/RegisterFile.cpp:
+        (JSC::registerFileStatisticsMutex):
+        Added function which returns a static Mutex used for locking during read/write access to
+        static committed byte count variable.
+        (JSC::RegisterFile::~RegisterFile):
+        Added call to addToStatistics since memory is decommitted here.
+        (JSC::RegisterFile::releaseExcessCapacity):
+        Added call to addToStatistics since memory is decommitted here.
+        (JSC::RegisterFile::initializeThreading):
+        Added function which calls registerFileStatisticsMutex().
+        (JSC::RegisterFile::committedByteCount):
+        Added function which returns the current committed byte count for RegisterFile.
+        (JSC::RegisterFile::addToCommittedByteCount):
+        Added function which updates committed byte count.
+        
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        Added call to addToStatistics since memory is committed here.
+        (JSC::RegisterFile::grow):
+        Added call to addToStatistics since memory is committed here.
+        
+        * jit/ExecutableAllocator.h:
+        Added function prototype for public static function committedByteCount().
+        
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        Added call to addToStatistics since memory is decommitted here.
+        (JSC::FixedVMPoolAllocator::reuse):
+        Added call to addToStatistics since memory is committed here.
+        (JSC::FixedVMPoolAllocator::addToCommittedByteCount):
+        Added function which updates committed byte count.
+        (JSC::ExecutableAllocator::committedByteCount):
+        Added function which returns the current committed byte count for ExecutableAllocator.
+        
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        Added call to RegisterFile::initializeThreading.
+
+2010-09-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <http://webkit.org/b/45502> JSObjectSetPrivateProperty does not handle NULL values as it claims
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrivateProperty): Don't call toJS if we have a NULL value as that will cause an assertion
+        failure. Instead map NULL directly to the null JSValue.
+        * API/tests/testapi.c:
+        (main): Add test coverage for the NULL value case.
+
+2010-09-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        [Qt] JSVALUE32_64 not works on Windows platform with MinGW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=29268
+
+        * wtf/Platform.h: Enable JSVALUE32_64 for Qt/Windows/MinGW, because it works now.
+
+2010-09-08  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Removing doneSemicolon label in the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=45289
+
+        As a side effect of moving the multiline comment parsing
+        to a separate function, an opportunity raised to simplify
+        the single line comment parsing, and removing doneSemicolon
+        label. Slight performance increase on --parse-only
+        tests (from 32.8ms to 31.5ms)
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+
+2010-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove accessor for private member variable in JSParser
+        https://bugs.webkit.org/show_bug.cgi?id=45378
+
+        m_token is private to JSParser, so it does not seem to be useful
+        to have an accessor for it. On top of that, the file was both
+        using the accessor and directly accessing the member variable,
+        only one style should be used.
+
+2010-09-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] REGRESSION(63348): jsc is broken
+        https://bugs.webkit.org/show_bug.cgi?id=42818
+
+        Need fastcall conventions on Qt/Win/MinGW.
+        Based on patches of Gavin Barraclough: r63947 and r63948.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-09-08  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        Remove some unnecessary duplicate calls to string functions
+
+        https://bugs.webkit.org/show_bug.cgi?id=45314
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::format):
+
+2010-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Re-Disable JIT for MSVC 64bit to fix the build on this compiler.
+        https://bugs.webkit.org/show_bug.cgi?id=45382
+
+        It was enabled in the cleanup made in r64176, though it is still
+        not implemented.
+
+        * wtf/Platform.h:
+
+2010-09-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Need a WebSocket implementation
+        https://bugs.webkit.org/show_bug.cgi?id=45197
+
+        Add a GIO-based WebSocket implementation.
+
+        * wtf/gobject/GRefPtr.cpp: Added PlatformRefPtr support for GSource.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+        * wtf/gobject/GRefPtr.h: Added new template specialization declarations.
+        * wtf/gobject/GTypedefs.h: Add some more GLib/GIO forward declarations.
+
+2010-08-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Handle MediaQueryExp memory management exclusively with smart pointers
+        https://bugs.webkit.org/show_bug.cgi?id=44874
+        
+        Implemented a non-copying sort function to make it possible to sort a Vector
+        of OwnPtrs (which cannot be copied). This is required for the above.
+
+        * wtf/NonCopyingSort.h: Added.
+        (WTF::nonCopyingSort): It's secretly heapsort.
+        (WTF::heapSort): heapsort implementation.
+        (WTF::siftDown): Helper function for heapsort.
+        (WTF::heapify): ditto
+
+        Adjust build systems.
+        
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-09-08  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Refactoring multiline comments in the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=45289
+
+        MultiLine comment parsing is moved to a separate function.
+
+        Slight performance increase on --parse-only tests (from 33.6ms to 32.8ms)
+        SunSpider reports no change (from 523.1ms to 521.2ms).
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseMultilineComment):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-09-07  James Robinson  <jamesr@chromium.org>
+
+        Compile fix attempt for windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-09-07  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Fix Windows build after r66936
+        https://bugs.webkit.org/show_bug.cgi?id=45348
+
+        Add symbol names that were missing from r66936.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-09-07  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        pushState and replaceState do not clone RegExp objects correctly
+        https://bugs.webkit.org/show_bug.cgi?id=44718
+        
+        Move internal representation of JSC::RegExp (which depends on wether
+        YARR and YARR_JIT is enabled) into RegExpRepresentation which can live
+        in the implementation only. This makes it feasible to use RegExp in
+        WebCore without bringing in all of YARR.
+
+        * JavaScriptCore.exp: Export RegExp and RegExpObject functions that are
+        needed inside WebCore's JSC bindings.
+        * runtime/RegExp.cpp:
+        (JSC::RegExpRepresentation::~RegExpRepresentation):
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+
+2010-09-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8381749> -Wcast-align warning emitted when building with clang
+
+        Remove the -Wcast-align-warning since it isn't really useful, and clang is more aggressive about warning than gcc.
+
+        * Configurations/Base.xcconfig:
+
+2010-09-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(66741): Undefined pthread macros
+        https://bugs.webkit.org/show_bug.cgi?id=45246
+
+        PTHREAD_MUTEX_NORMAL and PTHREAD_MUTEX_DEFAULT (introduced in r60487) are not defined on Linux, 
+        but used in a statement. Add an additional check to test this.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+
+2010-09-06  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix
+
+2010-09-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        SerializedScriptValue needs to use a flat storage mechanism
+        https://bugs.webkit.org/show_bug.cgi?id=45244
+
+        Export JSArray::put
+
+        * JavaScriptCore.exp:
+
+2010-09-06  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Support JSVALUE32_64 on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=43999
+
+        Add missing functions to support JSVALUE32_64 on MIPS.
+        Remove JSVALUE32 as the default for MIPS.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::divd):
+        (JSC::MIPSAssembler::mthc1):
+        (JSC::MIPSAssembler::cvtwd):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::neg32):
+        (JSC::MacroAssemblerMIPS::branchOr32):
+        (JSC::MacroAssemblerMIPS::set8):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::divDouble):
+        (JSC::MacroAssemblerMIPS::convertInt32ToDouble):
+        (JSC::MacroAssemblerMIPS::branchDouble):
+        (JSC::MacroAssemblerMIPS::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerMIPS::zeroDouble):
+        * jit/JIT.h:
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+
+2010-09-06  Robert Hogan  <robert@webkit.org>
+
+        Unreviewed, compile fix.
+
+        Fix compile failure in r66843
+
+        Revert to original patch in bugzilla. Leave bug open for
+        discussion on potential removal of double utf8 conversion.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45240
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::format):
+
+2010-09-06  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] utf8 encoding of console() messages
+
+        Unskip:
+        http/tests/security/xssAuditor/embed-tag-null-char.html
+        http/tests/security/xssAuditor/object-embed-tag-null-char.html
+
+        Both tests failed because Qt's implementation of String::format()
+        is casting a utf8 result to String, which assumes latin1 in
+        its constructor. So instead of casting a QString to a String, use
+        StringImpl::create() instead. Unfortunately, this involves a lot
+        of extra casts but the end result is correct.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45240
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::format):
+
+2010-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45135
+        <rdar://problem/7823714> TCMalloc_PageHeap doesn't hold a mutex while manipulating shared data
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger): Make sure to create a non-recursive mutex
+        regardless of platform default, so that we can assert that it's held (this is for platforms
+        that don't have libdispatch).
+        (WTF::TCMalloc_PageHeap::signalScavenger): Assert that the mutex is held, so we can look
+        at m_scavengeThreadActive. For platforms that have libdispatch, assert that pageheap_lock
+        is held.
+        (WTF::TCMalloc_PageHeap::periodicScavenge): Make sure that pageheap_lock is held before
+        manipulating m_scavengeThreadActive. Otherwise, there is an obvious race condition, and we
+        can make unbalanced calls to dispatch_resume().
+
+2010-09-03  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Martin Robinson.
+
+        [EFL] Regression (66531) Build break with Glib Support
+        https://bugs.webkit.org/show_bug.cgi?id=45011
+
+        Move GtkTypedefs.h to GTypedefs.h and let it inside gobject directory
+        since when glib is enabled, EFL port needs it, too.
+
+        * CMakeListsEfl.txt: Include gobject directory to find new header
+        file.
+        * GNUmakefile.am: Ditto.
+        * wtf/CMakeListsEfl.txt: Ditto.
+        * wtf/Platform.h: Include header if port is EFL and glib support is
+        enabled.
+        * wtf/gtk/GtkTypedefs.h: Removed.
+        * wtf/gobject/GTypedefs.h: Added. Sections specific to GTK are now
+        guarded by PLATFORM(GTK).
+
+2010-09-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix warning in wtf/ByteArray.h
+        https://bugs.webkit.org/show_bug.cgi?id=44672
+
+        * wtf/ByteArray.h: Use maximal sized array for MSVC and unsized array for other compilers.
+
+2010-09-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Actually parse a URL from ParsedURL
+        https://bugs.webkit.org/show_bug.cgi?id=45080
+
+        This patch only handles standard URLs.  At some point we'll need to
+        distinguish between standard URLs and other kinds of URLs.
+
+        * wtf/url/api/ParsedURL.cpp:
+        (WTF::ParsedURL::ParsedURL):
+
+2010-09-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ParsedURL and URLString to WTFURL API
+        https://bugs.webkit.org/show_bug.cgi?id=45078
+
+        Currently there's no actual URL parsing going on, but this patch is a
+        start to sketching out the API.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url/api/ParsedURL.cpp: Added.
+        (WTF::ParsedURL::ParsedURL):
+        (WTF::ParsedURL::scheme):
+        (WTF::ParsedURL::username):
+        (WTF::ParsedURL::password):
+        (WTF::ParsedURL::host):
+        (WTF::ParsedURL::port):
+        (WTF::ParsedURL::path):
+        (WTF::ParsedURL::query):
+        (WTF::ParsedURL::fragment):
+        (WTF::ParsedURL::segment):
+        * wtf/url/api/ParsedURL.h: Added.
+        (WTF::ParsedURL::spec):
+        * wtf/url/api/URLString.h: Added.
+        (WTF::URLString::URLString):
+        (WTF::URLString::string):
+
+2010-09-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WTFURL to the JavaScriptCore build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=45075
+
+        Building code is good.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-09-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43230
+        <rdar://problem/8254215> REGRESSION: Memory leak within JSParser::JSParser
+
+        One can't delete a ThreadSpecific object that has data in it. It's not even possible to
+        enumerate data objects in all threads, much less destroy them from a thread that's destroying
+        the ThreadSpecific.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::JSParser):
+        * runtime/JSGlobalData.h: 
+        * wtf/WTFThreadData.cpp:
+        (WTF::WTFThreadData::WTFThreadData):
+        * wtf/WTFThreadData.h:
+        (WTF::WTFThreadData::approximatedStackStart):
+        Moved stack guard tracking from JSGlobalData to WTFThreadData.
+
+        * wtf/ThreadSpecific.h: Made destructor unimplemented. It's dangerous, and we probably won't
+        ever face a situation where we'd want to delete a ThreadSpecific object.
+
+2010-09-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Ecma-262 15.11.1.1 states that if the argument is undefined then an
+        Error object's message property should be set to the empty string.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+
+2010-08-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge): Replaced somewhat-quirky code that
+        mixed types with code that uses size_t.
+
+        * wtf/TCPageMap.h: Removed names of unused arguments to avoid warning.
+
+2010-08-31  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Isolate all GTK+ typedefs into one file
+        https://bugs.webkit.org/show_bug.cgi?id=44900
+
+        * GNUmakefile.am: Add GtkTypedefs.h to the source lists.
+        * wtf/Platform.h: #include GtkTypedefs.h for the GTK+ build.
+        * wtf/ThreadingPrimitives.h: Remove GTK+ typedefs.
+        * wtf/gobject/GOwnPtr.h: Ditto.
+        * wtf/gobject/GRefPtr.h: Ditto.
+        * wtf/gtk/GtkTypedefs.h: Added.
+
+2010-08-31  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Fix 'make dist' in preparation of the 1.3.3 release
+        https://bugs.webkit.org/show_bug.cgi?id=44978
+
+        * GNUmakefile.am: Adding missing headers to the sources list.
+
+2010-08-31  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Support emit_op_mod() for MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=42855
+
+        This patch uses MIPS div instructions for op_mod to improve performance.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::div):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+
+2010-08-31  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Modify ASSERT_UNUSED and UNUSED_PARAM similar to Qt's Q_UNUSED.
+        https://bugs.webkit.org/show_bug.cgi?id=44870
+
+        * wtf/Assertions.h:
+        * wtf/UnusedParam.h:
+
+2010-08-31  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        JSC TimeoutChecker::didTimeOut overflows on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=38538
+
+        Make getCPUTime() return values relative to the first call.
+        The previous implementation relied on simply on currentTime(), which
+        return a time since epoch and not a time since the thread started. This
+        made the return value of getCPUTime() overflow on 32 bits.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2010-08-30  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        HISTORY_ALWAYS_ASYNC should be removed (history should always be async)
+        https://bugs.webkit.org/show_bug.cgi?id=44315
+
+        Remove ENABLE_HISTORY_ALWAYS_ASYNC #define.
+
+        * wtf/Platform.h: 
+
+2010-08-30  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Fix namespace for wtf/Complex.h and wtf/Vector3.h
+        https://bugs.webkit.org/show_bug.cgi?id=44892
+
+        * wtf/Complex.h:
+        * wtf/Vector3.h:
+
+2010-08-30  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Strings returned by asciiDebug() should be NULL-terminated.
+        https://bugs.webkit.org/show_bug.cgi?id=44866
+
+        * wtf/text/WTFString.cpp:
+        (asciiDebug):
+
+2010-08-30  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor number parsing in the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=44104
+
+        Number parsing was full of gotos, and needed a complete
+        redesign to remove them (Only one remained). Furthermore
+        integer arithmetic is empolyed for fast cases (= small
+        integer numbers).
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseHex):
+        (JSC::Lexer::parseOctal):
+        (JSC::Lexer::parseDecimal):
+        (JSC::Lexer::parseNumberAfterDecimalPoint):
+        (JSC::Lexer::parseNumberAfterExponentIndicator):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-08-29  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Added U_IS_BMP.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+        * wtf/unicode/wince/UnicodeWince.h: Ditto.
+
+2010-08-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port vprintf_stderr_common
+        https://bugs.webkit.org/show_bug.cgi?id=33568
+
+        Use BREW's DBGPRINTF to output debug messages.
+
+        * wtf/Assertions.cpp:
+
+2010-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 44830 - In Array's prototype functyions we're incorrectly handing large index values
+
+        We are in places casting doubles to unsigneds, and unsigneds to ints, without always check
+        that the result is within bounds. This is problematic in the case of double-to-unsigned
+        conversion because we should be saturating to array length.
+
+        Also, the error return value from Array.splice should be [], not undefined.
+
+        I don't see any security concerns here. These methods are spec'ed in such a way that they
+        can be applied to non Array objects, so in all cases the (potentially bogus) indices are
+        being passed to functions that will safely check accesses are within bounds.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::argumentClampedIndexFromStartOrEnd):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/JSValue.h:
+        (JSC::JSValue::toUInt32):
+
+2010-08-28  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add an ENABLE define for purgeable memory support
+        https://bugs.webkit.org/show_bug.cgi?id=44777
+
+        * wtf/Platform.h:
+
+2010-08-27  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] NPAPI Plugin metadata should be cached, and loading a plugin should not require loading every plugin
+        https://bugs.webkit.org/show_bug.cgi?id=43179
+
+        Add ENABLE_NETSCAPE_PLUGIN_METADATA_CACHE flag to enable persistent
+        NPAPI Plugin Cache. The flag is enabled by default.
+
+        * wtf/Platform.h: Add ENABLE_NETSCAPE_PLUGIN_METADATA_CACHE
+
+2010-07-27  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Add JavaScript API to allow a page to go fullscreen.
+        rdar://problem/6867795
+        https://bugs.webkit.org/show_bug.cgi?id=43099
+
+        * wtf/Platform.h: Enable FULLSCREEN_API mode for the Mac (except iOS).
+
+2010-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 44745 - Number.toFixed/toExponential/toPrecision are inaccurate.
+
+        These methods should be using a version of dtoa that can generate results accurate
+        to the requested precision, whereas our version of dtoa is only currently able to
+        support producing results sufficiently accurate to distinguish the value from any
+        other IEEE-754 double precision number.
+
+        This change has no impact on benchmarks we track.
+
+        On microbenchmarks for these functions, this is a slight regression where a high
+        precision is requested (dtoa now need to iterate further to generate a a greater
+        number of digits), but with smaller precision values (hopefully more common) this
+        improves performance, since it reduced the accurate of result dtoa is required,
+        to produce, and removes the need to pre-round values before calling dtoa. 
+
+        * JavaScriptCore.exp:
+            doubleToStringInJavaScriptFormat renamed to numberToString
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+            doubleToStringInJavaScriptFormat renamed to numberToString
+
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+            doubleToStringInJavaScriptFormat renamed to numberToString
+
+        * wtf/DecimalNumber.h:
+        (WTF::DecimalNumber::DecimalNumber):
+        (WTF::DecimalNumber::toStringDecimal):
+        (WTF::DecimalNumber::toStringExponential):
+            Remove all pre-rounding of values, instead call dtoa correctly.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+            Reenable support for rounding to specific-figures/decimal-places in dtoa.
+            Modify to remove unbiased rounding, provide ECMA required away-from-zero.
+            Rewrite doubleToStringInJavaScriptFormat to use DecimalNumber, rename to
+            numberToString.
+
+2010-08-27  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Byte alignment issue on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=29415
+
+        MIPS accesses one byte at a time for now to avoid the help from the
+        kernel to fix unaligned accesses.
+
+        * wtf/text/AtomicString.cpp:
+        (WebCore::equal):
+        * wtf/text/StringHash.h:
+        (WebCore::StringHash::equal):
+
+2010-08-27  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix a couple of typos in comment.
+
+        * bytecode/CodeBlock.h:
+
+2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * wtf/dtoa.cpp:
+
+2010-08-26  Gavin Barraclough  <baraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 44735 - Clean up dtoa.cpp
+        Remove unused & unmaintained code paths, reformat code to match
+        coding standard & use platform #defines from Platform.h directly.
+
+        * wtf/dtoa.cpp:
+        (WTF::storeInc):
+        (WTF::multadd):
+        (WTF::s2b):
+        (WTF::lo0bits):
+        (WTF::mult):
+        (WTF::pow5mult):
+        (WTF::lshift):
+        (WTF::diff):
+        (WTF::ulp):
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::ratio):
+        (WTF::):
+        (WTF::strtod):
+        (WTF::quorem):
+        (WTF::dtoa):
+
+2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Partially revert r65959. The toString changes regressed the v8 tests,
+        but keep the toFixed/toExponential/toPrecision changes.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/NumberPrototype.cpp:
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        * wtf/DecimalNumber.h:
+        * wtf/dtoa.cpp:
+        (WTF::append):
+        (WTF::doubleToStringInJavaScriptFormat):
+        * wtf/dtoa.h:
+        * wtf/text/WTFString.cpp:
+        * wtf/text/WTFString.h:
+
+2010-08-26  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Remove the USE(GLES2_RENDERING) define and associated code
+        https://bugs.webkit.org/show_bug.cgi?id=43761
+
+        Remove WTF_USE_GLES2_RENDERING from the list of defines in chromium, it's unused.
+
+        * wtf/Platform.h:
+
+2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rolling out r64608, this regressed performance.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::~LinkBuffer):
+        (JSC::LinkBuffer::performFinalization):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::create):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::poolForSize):
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+
+2010-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Bug 44655 - Add debug only convenience methods to obtain a Vector<char> from a String/StringImpl.
+
+        * wtf/text/WTFString.cpp:
+        (asciiDebug):
+            Return a Vector<char> containing the contents of a string as ASCII.
+
+2010-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add PassOwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=44627
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add the new files.
+
+        * wtf/Forward.h:
+        Forward declare PassOwnArrayPtr.
+        
+        * wtf/OwnArrayPtr.h:
+        Mimic the OwnPtr interface.
+
+        * wtf/OwnArrayPtrCommon.h: Added.
+        (WTF::deleteOwnedArrayPtr):
+        Move delete function here so it can be shared by OwnArrayPtr and
+        PassOwnArrayPtr.
+
+        * wtf/PassOwnArrayPtr.h: Added.
+        Mimic the PassOwnPtr interface.
+
+2010-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [JSC] JavaScript parsing error when loading Equifax web page
+        https://bugs.webkit.org/show_bug.cgi?id=42900
+
+        '-->' is ostensibly only meant to occur when there is only
+        whitespace preceeding it on the line.  However firefox treats
+        multiline comments as a space character, so they are allowed.
+        One side effect of the firefox model is that any line terminators
+        inside the multiline comment are ignored, so
+
+            foo/*
+            */-->
+
+        is treated as
+
+            foo -->
+
+        and so '-->' will not be a comment in this case.  Happily this simply
+        means that to fix this issue all we need to do is stop updating
+        m_atLineStart when handling multiline comments.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+
+2010-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Improve overflow handling in StringImpl::Replace
+        https://bugs.webkit.org/show_bug.cgi?id=42502
+        <rdar://problem/8203794>
+
+        Harden StringImpl::replace against overflow -- I can't see how this
+        could be abused, but it's better to be safe than sorry.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::replace):
+
+2010-08-26  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] The GNUmakefile.am files contain a myriad of confusing preprocessor and compiler flag definitions
+        https://bugs.webkit.org/show_bug.cgi?id=44624
+
+        Clean up GNUmakefile.am.
+
+        * GNUmakefile.am: Alphabetize the include order in javascriptcore_cppflags. Move
+        a couple include lines from the top-level GNUmakefile.am.
+
+2010-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Kent Tamura.
+
+        Local variables 'k' and 'y' in s2b() in dtoa.cpp are computed but not used
+        https://bugs.webkit.org/show_bug.cgi?id=29259
+
+        Remove unused code in dtoa.cpp, spotted by Wan-Teh Chang.
+
+        * wtf/dtoa.cpp:
+        (WTF::s2b):
+
+2010-08-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kevin Ollivier.
+
+        [BREWMP] Add build system
+        https://bugs.webkit.org/show_bug.cgi?id=44645
+
+        Make waf script portable so that we can add more ports.
+
+        * wscript:
+
+2010-08-25  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the single entry regular expression cache introduced as part of
+        the fix for https://bugs.webkit.org/show_bug.cgi?id=41238.
+        The performance problem in Dromaeo that initiated that bug is no 
+        longer present. Dromaeo has been modified so that the regular
+        expression tests are somewhat random and don't benefit from a
+        single entry cache.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+
+2010-08-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Cairo and EFL port shouldn't depend on glib.
+        https://bugs.webkit.org/show_bug.cgi?id=44354
+
+        Replace GRefPtr with PlatformRefPtr. Keep GLib specific bits in
+        GRefPtr.h.
+
+        * GNUmakefile.am: Add PlatformRefPtr.h to the source list.
+        * wtf/PlatformRefPtr.h: Migrated from GRefPtr.h.
+        (WTF::PlatformRefPtr::PlatformRefPtr): Ditto.
+        (WTF::PlatformRefPtr::~PlatformRefPtr): Ditto.
+        (WTF::PlatformRefPtr::clear): Ditto.
+        (WTF::PlatformRefPtr::get): Ditto.
+        (WTF::PlatformRefPtr::operator*): Ditto.
+        (WTF::PlatformRefPtr::operator->): Ditto.
+        (WTF::PlatformRefPtr::operator!): Ditto.
+        (WTF::PlatformRefPtr::operator UnspecifiedBoolType): Ditto.
+        (WTF::PlatformRefPtr::hashTableDeletedValue): Ditto.
+        (WTF::::operator): Ditto.
+        (WTF::::swap): Ditto.
+        (WTF::swap): Ditto.
+        (WTF::operator==): Ditto.
+        (WTF::operator!=): Ditto.
+        (WTF::static_pointer_cast): Ditto.
+        (WTF::const_pointer_cast): Ditto.
+        (WTF::getPtr): Ditto.
+        (WTF::adoptPlatformRef): Ditto.
+        * wtf/gobject/GRefPtr.cpp: Changes to reflect new names.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+        * wtf/gobject/GRefPtr.h: Ditto.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+
+2010-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove dead code in JSGlobalObject
+        https://bugs.webkit.org/show_bug.cgi?id=44615
+
+        The recursion data member in the JSGlobalObject and its getter
+        plus inc/dec methods seems to be unused, remove them.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+
+2010-08-25  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Changed the initial and subsequent allocation of vector storage to
+        Array()s. The changes are to limit sparse arrays to 100000 entries
+        and fixed the sparse map to vector storage conversion to use the 
+        minimum amount of memory needed to store the current number of entries.
+        These changes address https://bugs.webkit.org/show_bug.cgi?id=43707
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::getNewVectorLength):
+
+2010-08-16  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid increasing required alignment of target type warning
+        https://bugs.webkit.org/show_bug.cgi?id=43963
+
+        Fix platform independent alignment warnings.
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetNodeAllocator::pool):
+
+2010-08-19  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable truncated floating point feature on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=44233
+
+        Enable truncated floating point feature with the help of VCVTR.S32.F64
+        instruction. If VCVTR.S32.F64 can't fit the result into a 32-bit
+        integer/register, it saturates at INT_MAX or INT_MIN. Testing this
+        looks quicker than testing FPSCR for exception.
+
+        Inspired by Jacob Bramley's patch from JaegerMonkey
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::cmn_r):
+        (JSC::ARMAssembler::vcvtr_s32_f64_r):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+
+2010-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/DecimalNumber.h:
+        (WTF::DecimalNumber::intPow10):
+        * wtf/dtoa.cpp:
+        * wtf/dtoa.h:
+
+2010-08-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=44487
+
+        Number.toExponential/toFixed/toPrecision all contain a spaghetti of duplicated
+        code & unnecessary complexity. Add a new DecimalNumber class to encapsulate
+        double to string conversion, share the implementations of rounding &
+        decimal-fraction/exponential formatting.
+
+        * JavaScriptCore.exp:
+            Update exports.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::toThisNumber):
+        (JSC::getIntegerArgumentInRange):
+            Helper methods used in implementing toExponential/toFixed/toString.
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+            Reimplemented using new DecimalNumber class.
+            
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+            Updated to call numberToString.
+
+        * wtf/DecimalNumber.h: Added.
+        (WTF::):
+        (WTF::DecimalNumber::DecimalNumber):
+        (WTF::DecimalNumber::toStringDecimal):
+        (WTF::DecimalNumber::toStringExponential):
+        (WTF::DecimalNumber::sign):
+        (WTF::DecimalNumber::exponent):
+        (WTF::DecimalNumber::significand):
+        (WTF::DecimalNumber::precision):
+        (WTF::DecimalNumber::init):
+        (WTF::DecimalNumber::isZero):
+        (WTF::DecimalNumber::roundToPrecision):
+            New class to perform double to string conversion.
+            Has three constructors, which allow conversion with no rounding,
+            rounding to significant-figures, or rounding to decimal-places,
+            and two methods for formatting strings, either using decimal
+            fraction or exponential encoding. Internal implementation uses
+            pre-rounding of the values before calling dtoa rather than
+            relying on dtoa to correctly round, which does not produce
+            fully accurate results. Hopefully we can address this in the
+            near future.
+
+        * wtf/dtoa.cpp:
+        (WTF::intPow10):
+        * wtf/dtoa.h:
+            intPow10 is used internally by DecimalNumber.
+            
+        * wtf/text/WTFString.cpp:
+        (WTF::copyToString):
+        (WTF::nanOrInfToString):
+            Used internally in numberToString for NaN/Infinity handling.
+        (WTF::numberToString):
+            Added new method to convert doubles to strings.
+
+        * wtf/text/WTFString.h:
+            Added declaration for numberToString. This is here because
+            we should switch over to using this for all double to string
+            conversion in WebCore (see section 2.4.4.3 of the HTML5 spec).
+
+2010-08-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Don't seed the JS random number generator from time()
+        https://bugs.webkit.org/show_bug.cgi?id=41868
+        <rdar://problem/8171025>
+
+        Switch to using the secure random number generator to
+        seed the fast random generator, and make the generator
+        be per global object.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::weakRandomNumber):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRandom):
+
+2010-08-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Make overflow guards in UString::utf8 explicit
+        https://bugs.webkit.org/show_bug.cgi?id=44540
+
+        Add an explicit overflow check prior to allocating our buffer,
+        rather than implicitly relying on the guard in convertUTF16ToUTF8.
+
+        * runtime/UString.cpp:
+        (JSC::UString::utf8):
+
+2010-08-24  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Symbian] Fix commit/decommit of system memory using RChunk
+
+        Swap accidentially reversed start and m_base values for determining the
+        offset within the RChunk.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::systemCommit):
+        (WTF::PageReservation::systemDecommit):
+
+2010-08-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Rubber-stamped by Gabor Loki.
+
+        [WINCE] Buildfix for GeneratedJITStubs after r64818
+        https://bugs.webkit.org/show_bug.cgi?id=44469
+
+        Use " THUNK_RETURN_ADDRESS_OFFSET" instead of "#offset#".
+
+        * jit/JITStubs.cpp:
+
+2010-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        [REGRESSION] Interpreter incorrectly excludes prototype chain when validating put_by_id_transition
+        https://bugs.webkit.org/show_bug.cgi?id=44240
+        <rdar://problem/8328995>
+
+        Fix an error I introduced when cleaning up the interpreter side of the logic
+        to prevent setters being called in object initialisers.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-08-23  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed case where a single character search string in a string.replace()
+        did not properly handle back reference replacement.  The fix is to 
+        check for a '$' as part of the check to see if we can execute the
+        single character replace optimization.
+        https://bugs.webkit.org/show_bug.cgi?id=44067
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2010-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSON.stringify is much slower than Firefox on particular pathological input
+        https://bugs.webkit.org/show_bug.cgi?id=44456
+
+        Make StringBuilder::reserveCapacity reserve additional space so we don't end up
+        repeatedly copying the entire result string.
+
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        (JSC::StringBuilder::reserveCapacity):
+
+2010-08-23  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Handle blob resource.
+        https://bugs.webkit.org/show_bug.cgi?id=43941
+
+        * JavaScriptCore.exp: Add an export that is neede by BlobResourceHandle.
+
+2010-08-19  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        JSC: Move the static_cast into to(U)Int32 fast case
+        https://bugs.webkit.org/show_bug.cgi?id=44037
+
+        Do the static_cast<(u)int32_t> inline to avoid the function call overhead
+        for easily converted values (within (u)int32_t range.)
+
+        * runtime/JSValue.cpp:
+        (JSC::toInt32SlowCase):
+        (JSC::toUInt32SlowCase):
+        * runtime/JSValue.h:
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+
+2010-08-18  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        REGRESSION(r58469): Math.pow() always returns double-backed JSValue which is extremely slow as array subscript
+        https://bugs.webkit.org/show_bug.cgi?id=43742
+
+        Add codegen for pow() to return Int32 values when possible.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::powThunkGenerator):
+
+2010-08-18  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        The JITStackFrame is wrong using Thumb-2 JIT with JSVALUE32_64
+        https://bugs.webkit.org/show_bug.cgi?id=43897
+
+        A 64 bits wide member in a structure is aligned to 8 bytes on ARM by
+        default, but this is not taken into account in the offset defines of
+        JITStackFrame.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-08-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Rename UString::substr to substringSharingImpl, add to WTF::String.
+        Now WTF::String can do everything that JSC::UString can do!
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::getRange):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::indent):
+        (JSC::Stringifier::unindent):
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::trimString):
+        * runtime/UString.cpp:
+        (JSC::UString::substringSharingImpl):
+        * runtime/UString.h:
+        * wtf/text/WTFString.cpp:
+        (WTF::String::substringSharingImpl):
+        * wtf/text/WTFString.h:
+
+2010-08-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-08-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-08-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 44146 - Remove toDouble/toUInt32 methods from UString.
+
+        These methods all implement JavaScript language specific behaviour, and as such
+        are not suited to being on a generic string object.  They are also inefficient
+        and incorrectly used, refactor & cleanup.  Uses of these methods really divide
+        out into two cases.
+
+        ToNumber:
+        Uses of toDouble from JSString and from parseFloat are implementing ecma's
+        ToNumber conversion from strings (see ecma-262 9.3.1), so UString::toDouble
+        should largely just be moved out to a global jsToNumber function.  ToNumber is
+        capable of recognizing either decimal or hexadecimal numbers, but parseFloat
+        should only recognize decimal values.  This is currently handled by testing for
+        hexadecimal before calling toDouble, which should unnecessary - instead we can
+        just split out the two parts to the grammar into separate functions. Also,
+        strtod recognizes a set of literals (nan, inf, and infinity - all with any
+        capitalization) - which are not defined by any of the specs we are implementing.
+        To handle this we need to perform additional work in toDouble to convert the
+        unsupported cases of infinities back to NaNs.  Instead we should simply remove
+        support for this literals from strtod.  This should provide a more desirable
+        behaviour for all clients of strtod.
+
+        Indexed properties:
+        Uses of the toStrictUInt32 methods are were all converting property names to
+        indices, and all uses of toUInt32 were incorrect; in all cases we should have
+        been calling toUInt32.  This error results in some incorrect behaviour in the
+        DOM (accessing property "0 " of a NodeList should fail; it currently does not).
+        Move this method onto Identifier (our canonical property name), and make it
+        always perform a strict conversion. Add a layout test to check NodeList does
+        convert indexed property names correctly.
+
+        * JavaScriptCore.exp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::toUInt32):
+        * runtime/Identifier.h:
+        (JSC::Identifier::toUInt32):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        (JSC::Identifier::toArrayIndex):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlot):
+        (JSC::JSByteArray::getOwnPropertyDescriptor):
+        (JSC::JSByteArray::put):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::isInfinity):
+        (JSC::jsHexIntegerLiteral):
+        (JSC::jsStrDecimalLiteral):
+        (JSC::jsToNumber):
+        (JSC::parseFloat):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        * wtf/dtoa.cpp:
+        (WTF::strtod):
+
+2010-08-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 44099 - REGRESSION(r65468): Crashes in StringImpl::find
+
+        Bug 44080 introuduced a couple of cases in which array bounds could be overrun.
+        One of these was fixed in r65493, this patch fixes the other and address the
+        concerns voiced in comment #6 by restructuring the loops to remove the code
+        dupliction without introducing an additional if check.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::find):
+        (WTF::StringImpl::findIgnoringCase):
+        (WTF::StringImpl::reverseFind):
+        (WTF::StringImpl::reverseFindIgnoringCase):
+
+2010-08-17  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Move the accelerated compositing build flag to the right place
+        https://bugs.webkit.org/show_bug.cgi?id=43882
+
+        * wtf/Platform.h:
+
+2010-08-17  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Avoid uninitialized memory read in StringImpl::find().
+
+        REGRESSION(r65468): Crashes in StringImpl::find
+        https://bugs.webkit.org/show_bug.cgi?id=44099
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::find):
+
+2010-08-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Add VectorTraits to String & DefaultHash traits to UString to unify behaviour.
+
+        * runtime/UString.h:
+        (JSC::UStringHash::hash):
+        (JSC::UStringHash::equal):
+        (WTF::):
+        * wtf/text/WTFString.h:
+        (WTF::):
+
+2010-08-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Remove unnecessary includes from UString.h, add new includes as necessary.
+
+        * profiler/CallIdentifier.h:
+        * profiler/ProfileNode.h:
+        * runtime/DateConversion.cpp:
+        * runtime/Identifier.h:
+        (JSC::IdentifierRepHash::hash):
+        * runtime/RegExpCache.h:
+        * runtime/RegExpKey.h:
+        * runtime/UString.cpp:
+        (JSC::UString::substr):
+        * runtime/UString.h:
+        * wtf/text/WTFString.h:
+
+2010-08-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Bug 44080 - String find/reverseFind methods need tidying up
+        These methods have a couple of problems with their interface, and implementation.
+
+        These methods take and int index, and return an int - however this is problematic
+        since on 64-bit string indices may have a full 32-bit range.  This spills out into
+        surrounding code, which unsafely casts string indices from unsigned to int. Code
+        checking the result of these methods check for a mix of "== -1", "< 0", and
+        "== notFound".  Clean this up by changing these methods to take an unsigned
+        starting index, and return a size_t. with a failed match indicated by notFound.
+        reverseFind also has a special meaning for the starting index argument, in that a
+        negative index is interpreted as an offset back from the end of the string. Remove
+        this functionality, in the (1!) case where it is used we should just calculate the
+        offset by subtracting from the string's length.
+
+        The implementation has a few problems too.  The code is not in webkit style, in
+        using assorted abbreviations in variable names, and implementations of similar
+        find methods with differing argument types were unnecessarily inconsistent. When
+        find is passed const char* data the string would be handled as latin1 (zero
+        extended to UTF-16) for all characters but the first; this is sign extended.
+        Case-insensitive find is broken for unicode strings; the hashing optimization is
+        not unicode safe, and could result in false negatives.
+
+        Unify UString find methods to match String.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::escapeQuotes):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::substitute):
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::getFlagsValue):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSplit):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::UString::find):
+        (JSC::UString::reverseFind):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::find):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::find):
+        (WTF::StringImpl::findCaseInsensitive):
+        (WTF::StringImpl::reverseFind):
+        (WTF::StringImpl::reverseFindCaseInsensitive):
+        (WTF::StringImpl::endsWith):
+        (WTF::StringImpl::replace):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::startsWith):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::split):
+        * wtf/text/WTFString.h:
+        (WTF::String::find):
+        (WTF::String::reverseFind):
+        (WTF::String::findCaseInsensitive):
+        (WTF::String::reverseFindCaseInsensitive):
+        (WTF::String::contains):
+        (WTF::find):
+        (WTF::reverseFind):
+
+2010-08-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, do not build WebCore as a convenience library as this leads to
+        errors in the Win build w/export symbols and causes problems with DOM bindings
+        debugging in gdb. 
+
+        * wscript:
+
+2010-08-16  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Build fix after r65366.
+
+        * CMakeLists.txt: Use if (VAR) instead of if (${VAR}) to check if
+        they're empty.
+        * jsc/CMakeLists.txt: Ditto.
+        * wtf/CMakeLists.txt: Ditto.
+
+2010-08-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, don't build intermediate source in DerivedSources dir.
+
+        * wscript:
+
+2010-08-14  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMake] Add preprocessor detection for generator scripts
+        https://bugs.webkit.org/show_bug.cgi?id=43984
+
+        * CMakeLists.txt:
+
+2010-08-14  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMake] Set target properties only if available
+        https://bugs.webkit.org/show_bug.cgi?id=43978
+
+        * CMakeLists.txt:
+        * jsc/CMakeLists.txt:
+        * wtf/CMakeLists.txt:
+
+2010-08-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, add CString to the list of forwards.
+
+        * wtf/Forward.h:
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+        Switch String::/UString::ascii() to return a CString.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * jsc.cpp:
+        (runWithScripts):
+        (runInteractive):
+        * runtime/Identifier.h:
+        (JSC::Identifier::ascii):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/UString.cpp:
+        (JSC::UString::ascii):
+        (JSC::UString::latin1):
+        * runtime/UString.h:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::asciiOLD):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.cpp:
+        (WTF::String::ascii):
+        (WTF::String::latin1):
+        * wtf/text/WTFString.h:
+
+2010-08-13  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid increasing required alignment of target type warning on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=38045
+
+        The reinterpret_cast<Type1*>([pointer to Type2]) expressions - where
+        sizeof(Type1) > sizeof(Type2) - cause the following warning on ARM:
+        increases required alignment of target type warnings.
+        Casting the type of [pointer to Type2] object to void* bypasses the
+        warning.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        * jit/JITStubs.cpp:
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::New):
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        * wtf/MD5.cpp:
+        (WTF::reverseBytes):
+        (WTF::MD5::addBytes):
+        (WTF::MD5::checksum):
+        * wtf/StdLibExtras.h:
+        (isPointerTypeAlignmentOkay):
+        (reinterpret_cast_ptr):
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::inlineBuffer):
+        * wtf/qt/StringQt.cpp:
+        (WTF::String::String):
+
+2010-08-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Unify UString::UTF8String() & String::utf8() methods,
+        remove UString::cost() & make atArrayIndex a free function.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpName):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (runInteractive):
+        (fillBufferWithContentsOfFile):
+        * pcre/pcre_exec.cpp:
+        (Histogram::~Histogram):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::c_str):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/Identifier.h:
+        (JSC::Identifier::toStrictUInt32):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        (JSC::toArrayIndex):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::parseInt):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble):
+        (JSC::putUTF8Triple):
+        (JSC::UString::utf8):
+        * runtime/UString.h:
+        (JSC::UString::~UString):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::utf8):
+        * wtf/text/WTFString.h:
+        (WTF::String::~String):
+        (WTF::String::swap):
+        (WTF::String::isNull):
+        (WTF::String::isEmpty):
+        (WTF::String::impl):
+        (WTF::String::length):
+        (WTF::String::String):
+        (WTF::String::isHashTableDeletedValue):
+
+2010-08-12  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Refactoring the fpu code generator for the ARM port
+        https://bugs.webkit.org/show_bug.cgi?id=43842
+
+        Support up to 32 double precision registers, and the
+        recent VFP instruction formats. This patch is mainly
+        a style change which keeps the current functionality.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMRegisters::):
+        (JSC::ARMAssembler::):
+        (JSC::ARMAssembler::emitInst):
+        (JSC::ARMAssembler::emitDoublePrecisionInst):
+        (JSC::ARMAssembler::emitSinglePrecisionInst):
+        (JSC::ARMAssembler::vadd_f64_r):
+        (JSC::ARMAssembler::vdiv_f64_r):
+        (JSC::ARMAssembler::vsub_f64_r):
+        (JSC::ARMAssembler::vmul_f64_r):
+        (JSC::ARMAssembler::vcmp_f64_r):
+        (JSC::ARMAssembler::vsqrt_f64_r):
+        (JSC::ARMAssembler::vmov_vfp_r):
+        (JSC::ARMAssembler::vmov_arm_r):
+        (JSC::ARMAssembler::vcvt_f64_s32_r):
+        (JSC::ARMAssembler::vcvt_s32_f64_r):
+        (JSC::ARMAssembler::vmrs_apsr):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::sqrtDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+
+2010-08-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r65295.
+        http://trac.webkit.org/changeset/65295
+        https://bugs.webkit.org/show_bug.cgi?id=43950
+
+        It broke 4 sputnik tests (Requested by Ossy on #webkit).
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpName):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (runInteractive):
+        (fillBufferWithContentsOfFile):
+        * pcre/pcre_exec.cpp:
+        (Histogram::~Histogram):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::c_str):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::toArrayIndex):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::parseInt):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble):
+        (JSC::UString::UTF8String):
+        * runtime/UString.h:
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        (JSC::UString::cost):
+        (JSC::UString::~UString):
+        (JSC::UString::toArrayIndex):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::utf8):
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+        (WTF::String::isHashTableDeletedValue):
+        (WTF::String::length):
+        (WTF::String::operator[]):
+        (WTF::String::isNull):
+        (WTF::String::isEmpty):
+        (WTF::String::impl):
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Unify UString::UTF8String() & String::utf8() methods,
+        remove UString::cost() & make atArrayIndex a free function.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpName):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (runInteractive):
+        (fillBufferWithContentsOfFile):
+        * pcre/pcre_exec.cpp:
+        (Histogram::~Histogram):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::c_str):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * runtime/Identifier.h:
+        (JSC::Identifier::toStrictUInt32):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        (JSC::toArrayIndex):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::parseInt):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble):
+        (JSC::putUTF8Triple):
+        (JSC::UString::utf8):
+        * runtime/UString.h:
+        (JSC::UString::~UString):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::utf8):
+        * wtf/text/WTFString.h:
+        (WTF::String::~String):
+        (WTF::String::swap):
+        (WTF::String::isNull):
+        (WTF::String::isEmpty):
+        (WTF::String::impl):
+        (WTF::String::length):
+        (WTF::String::String):
+        (WTF::String::isHashTableDeletedValue):
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Eeerk! - revert accidentally committed changes in UString!
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        * runtime/UString.h:
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Change UString constructors to match those in WTF::String.
+        This changes behaviour of UString((char*)0) to create null
+        strings, akin to UString() rather than UString::empty().
+        (This matches String).  Remove unused constructors from
+        UString, and add null-terminated UTF-16 constructor, to
+        match String.  Move String's constructor into the .cpp to
+        match UString.
+
+        * JavaScriptCore.exp:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createSingleCharacterString):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        * runtime/UString.h:
+        (JSC::UString::UString):
+        (JSC::UString::swap):
+        (JSC::UString::adopt):
+        (JSC::UString::operator[]):
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+        (WTF::String::adopt):
+        (WTF::String::operator[]):
+
+2010-08-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        * runtime/UString.h: Removed unneccessary #include.
+
+2010-08-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Revert changes to ALWAYS_INLINEness of a couple of functions in UString.
+        This appears to have degraded performance.
+
+        * runtime/UString.cpp:
+        (JSC::UString::ascii):
+        * runtime/UString.h:
+        (JSC::UString::length):
+        (JSC::UString::isEmpty):
+        (JSC::UString::~UString):
+
+2010-08-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix warnings: unknown conversion type character 'l' in format
+        https://bugs.webkit.org/show_bug.cgi?id=43359
+
+        Qt port doesn't call any printf in String::format(...), consequently
+        using __attribute__((format(printf,m,n))) is incorrect and causes
+        false positive warnings on Windows if you build with MinGW.
+
+        Qt port calls QString::vsprintf(...) , which is platform
+        independent, and handles %lli, %llu and %llx on all platforms.
+        (http://trac.webkit.org/changeset/35712)
+
+        * wtf/text/WTFString.h:
+
+2010-08-12  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix the array subscript is above array bounds warning in ByteArray on ARM.
+        https://bugs.webkit.org/show_bug.cgi?id=43358
+
+        The warning is very similar to this one: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37861
+
+        * wtf/ByteArray.cpp:
+        (WTF::ByteArray::create):
+
+2010-08-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use GSettings to save/restore Web Inspector settings
+        https://bugs.webkit.org/show_bug.cgi?id=43512
+
+        * wtf/gobject/GRefPtr.cpp: Added support for GVariant, used by our
+        GSettings support.
+        (WTF::refGPtr):
+        (WTF::derefGPtr):
+        * wtf/gobject/GRefPtr.h:
+
+2010-08-12  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        The scratch register should be saved in YARR with ARM JIT
+        https://bugs.webkit.org/show_bug.cgi?id=43910
+
+        Reported by Jocelyn Turcotte.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+
+2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Forward.h:
+
+2010-08-11  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Geoffrey Garen.
+
+        Date("") should be an invalid date. For IE, Firefox and Chrome, Date("") is invalid date,
+        which means isNaN(new Date("")) should return true.
+        https://bugs.webkit.org/show_bug.cgi?id=43793
+        Tests: fast/js/date-constructor.html
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+
+2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows & !JIT build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamp by sam weinig
+
+        Touch a file to stop the bot rolling a bit change out!
+
+        * runtime/UString.cpp:
+        (JSC::UString::ascii):
+
+2010-08-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix for wx and WebDOM bindings, add CString classes to the list of forwards.
+
+        * wtf/Forward.h:
+
+2010-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamps by Darin Adler & Sam Weinig.
+
+        Bug 43867 - Some UString cleanup
+
+        Change JSC::UString data(), size(), and from(), to characters(), length(), and number() to match WTF::String.
+        Move string concatenation methods to a new header to simplify down UString.h.  Remove is8Bit().
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClass::className):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::create):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpName):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::processClauseList):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createRegex):
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::makeNumericIdentifier):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::data):
+        (JSC::UStringSourceProvider::length):
+        * profiler/Profiler.cpp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyNames):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/Identifier.h:
+        (JSC::Identifier::characters):
+        (JSC::Identifier::length):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::decode):
+        (JSC::parseInt):
+        (JSC::parseFloat):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toString):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::indent):
+        (JSC::Stringifier::unindent):
+        (JSC::Walker::walk):
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        (JSC::JSString::getIndexSlowCase):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::RopeBuilder::fiberCount):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsNontrivialString):
+        (JSC::JSString::getIndex):
+        (JSC::jsString):
+        (JSC::jsStringWithFinalizer):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::append):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::Lexer::Lexer):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookupSmallString):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringBuilder.h:
+        (JSC::StringBuilder::append):
+        * runtime/StringConcatenate.h: Copied from JavaScriptCore/runtime/UString.h.
+        (JSC::):
+        (JSC::sumWithOverflow):
+        (JSC::tryMakeString):
+        (JSC::makeString):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::localeCompare):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        (JSC::UString::ascii):
+        (JSC::UString::operator[]):
+        (JSC::UString::toDouble):
+        (JSC::UString::find):
+        (JSC::UString::rfind):
+        (JSC::UString::substr):
+        (JSC::operator==):
+        (JSC::operator<):
+        (JSC::operator>):
+        (JSC::UString::UTF8String):
+        * runtime/UString.h:
+        (JSC::UString::UString):
+        (JSC::UString::adopt):
+        (JSC::UString::length):
+        (JSC::UString::characters):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        (JSC::UString::cost):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::codePointCompare):
+        (JSC::UString::toArrayIndex):
+        (JSC::IdentifierRepHash::hash):
+        (WTF::):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::Parser):
+
+2010-08-11  Gabor Loki  <loki@webkit.org>
+
+        Qt build fix (ARMv7).
+
+        Fix invalid conversion from int to Condition.
+        Add ARMv7Assembler.cpp to JavaScriptCore.pro.
+
+        * JavaScriptCore.pro:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
+
+2010-08-11  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        At collection time, we frequently want to mark a cell, while checking
+        whether it was originally checked.  Previously, this was a get
+        operation follwed by a set operation.  Fusing the two saves
+        computation and gives a 0.5% sunspider speedup.
+
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::getset):
+        (JSC::Heap::checkMarkCell):
+        * runtime/JSArray.h:
+        (JSC::MarkStack::drain):
+        * runtime/JSCell.h:
+        (JSC::MarkStack::append):
+
+2010-08-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Improve vsprops copying for Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=41982
+
+        When we detect a new SDK, always copy a new set of vsprops files.
+        Previously, if someone updated their SDK after updating their sources,
+        they could end up with out-of-date vsprops files.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-08-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add leakRef and clear to all RefPtr variants
+        https://bugs.webkit.org/show_bug.cgi?id=42389
+
+        * API/JSRetainPtr.h: Changed all uses of "template <...>" to instead do
+        "template<...>". We should probably put this in the style guide and do it
+        consitently. Fixed other minor style issues. Defined many of the inlined
+        functions outside the class definition, to avoid style checker warnings
+        about multiple statements on a single line and for slightly better clarity
+        of the class definition itself. Renamed releaseRef to leakRef. Added a
+        releaseRef that calls leakRef so we don't have to rename all callers oat
+        once. Added a clear function.
+
+        * wtf/PassRefPtr.h: Changed all uses of releaseRef to leakRef.
+n
+        * wtf/RefPtr.h: Changed all uses of "template <...>" to instead do
+        "template<...>". Tidied up declarations and comments a bit.
+         Changed all uses of releaseRef to leakRef.
+
+        * wtf/RetainPtr.h: Changed all uses of "template <...>" to instead do
+        "template<...>". Defined many of the inlined functions outside the class
+        definition, to avoid style checker warnings about multiple statements on
+        a single line and for slightly better clarity of the class definition itself.
+        Renamed releaseRef to leakRef. Added a releaseRef that calls leakRef so we
+        don't have to rename all callers at once. Added a clear function.
+
+2010-08-10  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, reverting an unintentional change to a file submitted in r65108.
+
+        * bytecode/CodeBlock.h:
+        (JSC::binaryChop):
+
+2010-08-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Bug 43817 - Remove UString::Rep
+        UString::Rep has for a long time been replaced by UStringImpl (Rep
+        remaining as a typedef).  UStringImpl has since been removed too
+        (unified with StringImpl). Remove Rep, rename rep() to impl() and
+        m_rep to m_impl.  Also add impl() method to Identifier, and rename
+        its UString member from _ustring to m_string.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::deletePrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (tryCreateStringFromUTF8):
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * API/JSClassRef.h:
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addParameter):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::willResolveToArguments):
+        (JSC::BytecodeGenerator::uncheckedRegisterForArguments):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::isLocal):
+        (JSC::BytecodeGenerator::isLocalConstant):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        (JSC::keyForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::processClauseList):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseStrictObjectLiteral):
+        * pcre/pcre_exec.cpp:
+        (Histogram::add):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        * profiler/Profile.cpp:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierCStringTranslator::equal):
+        (JSC::IdentifierCStringTranslator::translate):
+        (JSC::Identifier::add):
+        (JSC::IdentifierUCharBufferTranslator::hash):
+        (JSC::IdentifierUCharBufferTranslator::equal):
+        (JSC::IdentifierUCharBufferTranslator::translate):
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::ustring):
+        (JSC::Identifier::impl):
+        (JSC::Identifier::data):
+        (JSC::Identifier::size):
+        (JSC::Identifier::ascii):
+        (JSC::Identifier::isNull):
+        (JSC::Identifier::isEmpty):
+        (JSC::Identifier::toUInt32):
+        (JSC::Identifier::toStrictUInt32):
+        (JSC::Identifier::toArrayIndex):
+        (JSC::Identifier::toDouble):
+        (JSC::Identifier::equal):
+        (JSC::Identifier::add):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::displayName):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSString.h:
+        (JSC::):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsSubstring):
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::deleteProperty):
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTableGet):
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::setKey):
+        (JSC::HashEntry::key):
+        (JSC::HashTable::entry):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::add):
+        (JSC::PropertyNameArray::addKnownUnique):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::create):
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStrings::singleCharacterStringRep):
+        * runtime/SmallStrings.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::hasTransition):
+        (JSC::Structure::remove):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::Structure::hasTransition):
+        * runtime/StructureTransitionTable.h:
+        * runtime/SymbolTable.h:
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::UString::toStrictUInt32):
+        (JSC::UString::substr):
+        * runtime/UString.h:
+        (JSC::UString::UString):
+        (JSC::UString::adopt):
+        (JSC::UString::data):
+        (JSC::UString::size):
+        (JSC::UString::isNull):
+        (JSC::UString::isEmpty):
+        (JSC::UString::impl):
+        (JSC::UString::cost):
+        (JSC::operator==):
+        (JSC::codePointCompare):
+        (JSC::IdentifierRepHash::hash):
+        (WTF::):
+
+2010-08-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Bug 43816 - Remove UStringImpl
+        The class was actually removed a long time ago, replaced by StringImpl.
+        UStringImpl is just a typedef onto StringImpl.  Remove this.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::replaceCharacter):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::RopeIterator::operator*):
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsSubstring):
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/RopeImpl.cpp:
+        (JSC::RopeImpl::derefFibersNonRecursive):
+        * runtime/RopeImpl.h:
+        (JSC::RopeImpl::deref):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        * runtime/UString.cpp:
+        (JSC::initializeUString):
+        * runtime/UString.h:
+        (JSC::UString::adopt):
+        (JSC::tryMakeString):
+        (JSC::makeString):
+        * runtime/UStringImpl.h: Removed.
+
+2010-08-10  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        Make FastMalloc more portable.
+        https://bugs.webkit.org/show_bug.cgi?id=41790
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+
+2010-08-10  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by David Levin.
+
+        [WINCE] Buildfix for CE 6.0
+        https://bugs.webkit.org/show_bug.cgi?id=43027
+
+        CE 6.0 doesn't define localtime in the system include files.
+
+        * wtf/Platform.h: Include ce_time.h on all OS(WINCE).
+
+2010-08-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Bug 43786 - Move AtomicStringHash from WebCore to WTF
+        Also remove deprecated string headers from WebCore/platform/text.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/AtomicString.h:
+        * wtf/text/AtomicStringHash.h: Copied from WebCore/platform/text/AtomicStringHash.h.
+
+2010-08-09  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt/ARM again, this time including the other changed file.
+
+        * jit/JIT.h:
+
+2010-08-09  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt/ARM
+
+        C++ overload resolution I stab at thee
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::endUninterruptedSequence):
+
+2010-08-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Allow an assembler/macroassembler to compact branches to more concise forms when linking
+        https://bugs.webkit.org/show_bug.cgi?id=43745
+
+        This patch makes it possible for an assembler to convert jumps into a different
+        (presumably more efficient) form at link time.  Currently implemented in the
+        ARMv7 JIT as that already had logic to delay linking of jumps until the end of
+        compilation already.  The ARMv7 JIT chooses between either a 4 byte short jump
+        or a full 32-bit offset (and rewrites ITTT instructions as appropriate), so does
+        not yet produce the most compact form possible.  The general design of the linker
+        should make it relatively simple to introduce new branch types with little effort,
+        as the linker has no knowledge of the exact form of any of the branches.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.cpp: Added.
+        (JSC::):
+          Record jump sizes
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
+        (JSC::ARMv7Assembler::LinkRecord::from):
+        (JSC::ARMv7Assembler::LinkRecord::setFrom):
+        (JSC::ARMv7Assembler::LinkRecord::to):
+        (JSC::ARMv7Assembler::LinkRecord::type):
+        (JSC::ARMv7Assembler::LinkRecord::linkType):
+        (JSC::ARMv7Assembler::LinkRecord::setLinkType):
+          Encapsulate LinkRecord fields so we can compress the values somewhat
+
+        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
+          Need to record the jump type now
+
+        (JSC::ARMv7Assembler::b):
+        (JSC::ARMv7Assembler::blx):
+        (JSC::ARMv7Assembler::bx):
+          Need to pass the jump types
+
+        (JSC::ARMv7Assembler::executableOffsetFor):
+        (JSC::ARMv7Assembler::jumpSizeDelta):
+        (JSC::ARMv7Assembler::linkRecordSourceComparator):
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::convertJumpTo):
+        (JSC::ARMv7Assembler::recordLinkOffsets):
+        (JSC::ARMv7Assembler::jumpsToLink):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::unlinkedCode):
+          Helper functions for the linker
+
+        (JSC::ARMv7Assembler::linkJump):
+        (JSC::ARMv7Assembler::canBeShortJump):
+        (JSC::ARMv7Assembler::linkLongJump):
+        (JSC::ARMv7Assembler::linkShortJump):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+           Moving code around for the various jump linking functions
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::beginUninterruptedSequence):
+        (JSC::AbstractMacroAssembler::endUninterruptedSequence):
+          We have to track uninterrupted sequences in any assembler that compacts
+          branches as that's not something we're allowed to do in such sequences.
+          AbstractMacroAssembler has a nop version of these functions as it makes the
+          code elsewhere nicer.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::link):
+        (JSC::LinkBuffer::patch):
+        (JSC::LinkBuffer::locationOf):
+        (JSC::LinkBuffer::locationOfNearCall):
+        (JSC::LinkBuffer::returnAddressOffset):
+        (JSC::LinkBuffer::trampolineAt):
+          Updated these functions to adjust for any changed offsets in the linked code
+
+        (JSC::LinkBuffer::applyOffset):
+          A helper function to deal with the now potentially moved labels
+
+        (JSC::LinkBuffer::linkCode):
+          The new and mighty linker function
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::beginUninterruptedSequence):
+        (JSC::MacroAssemblerARMv7::endUninterruptedSequence):
+        (JSC::MacroAssemblerARMv7::jumpsToLink):
+        (JSC::MacroAssemblerARMv7::unlinkedCode):
+        (JSC::MacroAssemblerARMv7::computeJumpType):
+        (JSC::MacroAssemblerARMv7::convertJumpTo):
+        (JSC::MacroAssemblerARMv7::recordLinkOffsets):
+        (JSC::MacroAssemblerARMv7::jumpSizeDelta):
+        (JSC::MacroAssemblerARMv7::link):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::branchMul32):
+        (JSC::MacroAssemblerARMv7::breakpoint):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::ret):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::executableOffsetFor):
+        (JSC::MacroAssemblerARMv7::inUninterruptedSequence):
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+           All branches need to pass on their type now
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::returnLastBytes):
+           We can't know ahead of time how much space will be necessary to
+           hold the linked code if we're compacting branches, this new
+           function allows us to return the unused bytes at the end of linking
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+           The JIT class now needs to take a linker offset so that recompilation
+           can generate the same jumps when using branch compaction.
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+          Update for new trampolineAt changes
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::):
+        * wtf/Platform.h:
+
+2010-08-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Qt build fix III.
+
+        * wtf/text/WTFString.h:
+
+2010-08-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Qt build fix.
+
+        * wtf/qt/StringQt.cpp:
+
+2010-08-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Bug 43594 - Add string forwards to Forward.h
+        This allows us to remove forward declarations for these classes from
+        WebCore/WebKit (a step in moving these class from WebCore:: to WTF::).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Forward.h:
+
+2010-08-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r64938.
+        http://trac.webkit.org/changeset/64938
+        https://bugs.webkit.org/show_bug.cgi?id=43685
+
+        Did not compile on several ports (Requested by abarth on
+        #webkit).
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::load32):
+        (JSC::MacroAssemblerX86::store32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_mr):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::):
+        * jit/JIT.h:
+        * jit/JITMarkObjects.cpp: Removed.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::setupPolymorphicProtoList):
+        * wtf/Platform.h:
+
+2010-08-07  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        The JIT code contains a number of direct references to GC'd objects.
+        When we have movable objects, these references will need to be
+        updated.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::int32AtLocation):
+        (JSC::AbstractMacroAssembler::pointerAtLocation):
+        (JSC::AbstractMacroAssembler::jumpTarget):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::loadPtrWithPatch):
+            Normally, loadPtr will optimize when the register is eax.  Since
+            the slightly smaller instruction changes the offsets, it messes up
+            our ability to repatch the code.  We added this new instruction
+            that garuntees a constant size.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::load32WithPatch):
+            Changed load32 in the same way described above.
+        (JSC::MacroAssemblerX86::load32):
+            Moved the logic to optimize laod32 from movl_mr to load32
+        (JSC::MacroAssemblerX86::store32):
+            Moved the logic to optimize store32 from movl_rm to store32
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::int32AtLocation):
+        (JSC::X86Assembler::pointerAtLocation):
+        (JSC::X86Assembler::jumpTarget):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+            As described in StructureStubInfo.h, we needed to add additional
+            fields to both StructureStubInfo and
+            PolymorphicAccessStructureList so that we can determine the
+            structure of the JITed code at patch time.
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::markAggregate):
+            Added this function to mark the JITed code that correosponds to
+            this structure stub info.
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::):
+        * jit/JIT.h:
+        * jit/JITMarkObjects.cpp: Added.
+        (JSC::JIT::patchPrototypeStructureAddress):
+        (JSC::JIT::patchGetDirectOffset):
+        (JSC::JIT::markGetByIdProto):
+        (JSC::JIT::markGetByIdChain):
+        (JSC::JIT::markGetByIdProtoList):
+        (JSC::JIT::markPutByIdTransition):
+        (JSC::JIT::markGlobalObjectReference):
+        * jit/JITPropertyAccess.cpp:
+            Added asserts for the patch offsets.
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::setupPolymorphicProtoList):
+        * wtf/Platform.h:
+            Added ENABLE_MOVABLE_GC_OBJECTS flag
+
+2010-08-07  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Revert JSArray to point to the beginning of the contained ArrayStorage
+        struct.  This is described in
+        https://bugs.webkit.org/show_bug.cgi?id=43526.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::getNewVectorLength):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::length):
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+
+2010-08-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE(YARR) guard around JSGlobalData::m_regexAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=43399
+
+        m_regexAllocator is used only by RegExp::compile which is guarded with ENABLE(YARR).
+
+        * runtime/JSGlobalData.h:
+
+2010-08-07  Patrick Roland Gansterer  <paroga@paroga.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Enable JIT on WinCE
+        https://bugs.webkit.org/show_bug.cgi?id=43303
+
+        Add ExtraCompiler for generating GeneratedJITStubs_MSVC.asm.
+
+        * DerivedSources.pro:
+
+2010-08-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Created a separate SimpleFontData constructor exclusively for SVG fonts and moved the CTFontRef
+        from SimpleFontData to FontPlatformData.
+        https://bugs.webkit.org/show_bug.cgi?id=43674
+
+        * wtf/Platform.h: Moved definitions of WTF_USE_CORE_TEXT and WTF_USE_ATSUI here from WebCore/config.h.
+
+2010-08-07  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bitmap.h has no default constructor
+        https://bugs.webkit.org/show_bug.cgi?id=43619
+
+        Without a constructor, the initial bits of the Bitmap class
+        are undefinied. If only a few, or zero bits are 0, the memory
+        area provided by AlignedMemoryAllocator can be easly exhausted.
+
+        Csaba Osztrogonác helped to find this bug.
+
+        * wtf/Bitmap.h:
+        (WTF::::Bitmap):
+
+2010-08-06  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        [EFL] Build fix.
+
+        * CMakeLists.txt: add runtime/CGHandle.cpp.
+
+2010-08-06  Jessie Berlin  <jberlin@apple.com>
+
+        Roll out http://trac.webkit.org/changeset/64801, which broke the Safari Windows Build.
+        Unreviewed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Forward.h:
+
+2010-08-06  Jessie Berlin  <jberlin@apple.com>
+
+        Windows Build Fix (continued). Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-06  Jessie Berlin  <jberlin@apple.com>
+
+        Windows Build Fix. Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Add GCHandle.h and GCHandle.cpp.
+
+2010-08-06  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43207
+
+        WeakGCPtr's should instead of directly pointing to the GC'd object
+        should be directed to an array of pointers that can be updated for
+        movable objects.
+
+        * Android.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::updateWeakGCHandles):
+        (JSC::WeakGCHandlePool::update):
+        (JSC::Heap::addWeakGCHandle):
+        (JSC::Heap::markRoots):
+        * runtime/Collector.h:
+        (JSC::Heap::weakGCHandlePool):
+        * runtime/GCHandle.cpp: Added.
+        (JSC::WeakGCHandle::pool):
+        (JSC::WeakGCHandlePool::WeakGCHandlePool):
+        (JSC::WeakGCHandlePool::allocate):
+        (JSC::WeakGCHandlePool::free):
+        (JSC::WeakGCHandlePool::operator new):
+        * runtime/GCHandle.h: Added.
+        (JSC::WeakGCHandle::isValidPtr):
+        (JSC::WeakGCHandle::isPtr):
+        (JSC::WeakGCHandle::isNext):
+        (JSC::WeakGCHandle::invalidate):
+        (JSC::WeakGCHandle::get):
+        (JSC::WeakGCHandle::set):
+        (JSC::WeakGCHandle::getNextInFreeList):
+        (JSC::WeakGCHandle::setNextInFreeList):
+        (JSC::WeakGCHandlePool::isFull):
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::~WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::assign):
+        (JSC::get):
+
+2010-08-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix warnings about difference in symbol visiblity on Mac OS X
+
+        * jsc.pro:
+
+2010-08-06  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor identifier parsing in lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41845
+
+        The code is refactored to avoid gotos. The new code
+        has the same performance as the old one.
+
+        SunSpider --parse-only: no change (from 34.0ms to 33.6ms)
+        SunSpider: no change (from 523.2ms to 523.5ms)
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseIdent):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-08-06  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        The ARM JIT does not support JSValue32_64 with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=43411
+
+        JSValue32_64 is enabled for RVCT by default.
+
+        * create_jit_stubs:
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+        * wtf/Platform.h:
+
+2010-08-05  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Darin Adler.
+
+        Define WTF_USE_ARENA_ALLOC_ALIGNMENT_INTEGER for MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=43514
+
+        MIPS needs to define WTF_USE_ARENA_ALLOC_ALIGNMENT_INTEGER, so that
+        RenderArena::allocate() can return 8-byte aligned memory to avoid
+        exceptions on sdc1/ldc1.
+
+        * wtf/Platform.h:
+
+2010-08-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig
+
+        Bug 43594 - Add string forwards to Forward.h
+        This allows us to remove forward declarations for these classes from
+        WebCore/WebKit (a step in moving these class from WebCore:: to WTF::).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Forward.h:
+
+2010-08-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed leak seen on buildbot.
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::operator()): Make out timer a RetainPtr,
+        since anything less would be uncivilized.
+
+2010-08-05  Andy Estes  <aestes@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Rename iOS-related OS and PLATFORM macros.
+        https://bugs.webkit.org/show_bug.cgi?id=43493
+        
+        Rename WTF_OS_IPHONE_OS to WTF_OS_IOS, WTF_PLATFORM_IPHONE to
+        WTF_PLATFORM_IOS, and WTF_PLATFORM_IPHONE_SIMULATOR to
+        WTF_PLATFORM_IOS_SIMULATOR.
+
+        * jit/ExecutableAllocator.h:
+        * jit/JITStubs.cpp:
+        * profiler/ProfilerServer.mm:
+        (-[ProfilerServer init]):
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::):
+        * wtf/Platform.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+
+2010-08-05  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43464
+
+        Currently, the global object is being embedded in the JavaScriptCore
+        bytecode, however since the global object is the same for all opcodes
+        in a code block, we can have the global object just be a member of the
+        associated code block.
+
+        Additionally, I added an assert inside of emitOpcode that verifies
+        that the last generated opcode was of the correct length.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObject):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        * bytecode/Opcode.h:
+        (JSC::opcodeLength):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitOpcode):
+            Added an assert to check that the last generated opcode is the
+            correct length.
+        (JSC::BytecodeGenerator::rewindBinaryOp):
+            Changed the last opcode to op_end since the length will no longer
+            be correct.
+        (JSC::BytecodeGenerator::rewindUnaryOp):
+            Changed the last opcode to op_end since the length will no longer
+            be correct.
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        * jit/JITStubs.cpp:
+        (JSC::cti_op_resolve_global):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+
+2010-08-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 43185 - Switch RegisterFile over to use PageAllocation
+
+        Remove platform-specific memory allocation code.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+        (JSC::RegisterFile::checkAllocatedOkay):
+        * wtf/PageAllocation.cpp:
+        (WTF::PageAllocation::lastError):
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::allocate):
+        (WTF::PageAllocation::allocateAt):
+        (WTF::PageAllocation::allocateAligned):
+        (WTF::PageAllocation::pageSize):
+        (WTF::PageAllocation::isPageAligned):
+        (WTF::PageAllocation::isPowerOfTwo):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::reserve):
+        (WTF::PageReservation::reserveAt):
+
+2010-08-05  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=43401 where array 
+        content aren't properly initialized as part of unshift.  
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCount):
+
+2010-08-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Unify blob related feature defines to ENABLE(BLOB).
+        https://bugs.webkit.org/show_bug.cgi?id=43081
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-08-05  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Remove GHashTable left-overs. GHashTable is ref-counted, and is
+        correctly supported by GRefPtr.
+
+        * wtf/gobject/GOwnPtr.h:
+
+2010-08-05  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed.
+
+        Typo fix that makes distcheck happy.
+
+        * GNUmakefile.am:
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43461
+        Invalid NaN parsing
+        
+        * wtf/dtoa.cpp: Turn off the dtoa feature that allows you to specify a
+        non-standard NaN representation, since our NaN encoding assumes that all
+        true NaNs have the standard bit pattern.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber): Don't allow an API client to accidentally specify
+        a non-standard NaN either.
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part II.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::systemReserve):
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::systemReserve):
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix - add new header to !Mac projects.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 43515 - Fix small design issues with PageAllocation, split out PageReservation.
+
+        The PageAllocation class has a number of issues:
+        * Changes in bug #43269 accidentally switched SYMBIAN over to use malloc/free to allocate
+          blocks of memory for the GC heap, instead of allocating RChunks.  Revert this change in
+          behaviour.
+        * In order for PageAllocation to work correctly on WinCE we should be decommitting memory
+          before deallocating.  In order to simplify understanding the expected state at deallocate,
+          split behaviour out into PageAllocation and PageReservation classes.  Require that all
+          memory be decommitted before calling deallocate on a PageReservation, add asserts to
+          enforce this.
+        * add many missing asserts.
+        * inline more functions.
+        * remove ability to create sub-PageAllocations from an existing PageAllocations object -
+          this presented an interface that would allow sub regions to be deallocated, which would
+          not have provided expected behaviour.
+        * remove writable/executable arguments to commit, this value can be cached at the point
+          the memory is reserved.
+        * remove writable/executable arguments to allocateAligned, protection other than RW is not
+          supported.
+        * add missing checks for overflow & failed allocation to mmap path through allocateAligned.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::Allocation::Allocation):
+        (JSC::ExecutablePool::Allocation::base):
+        (JSC::ExecutablePool::Allocation::size):
+        (JSC::ExecutablePool::Allocation::operator!):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        * runtime/AlignedMemoryAllocator.h:
+        (JSC::::allocate):
+        (JSC::::AlignedMemoryAllocator):
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        * runtime/Collector.h:
+        * wtf/PageAllocation.cpp:
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::operator!):
+        (WTF::PageAllocation::allocate):
+        (WTF::PageAllocation::allocateAt):
+        (WTF::PageAllocation::allocateAligned):
+        (WTF::PageAllocation::deallocate):
+        (WTF::PageAllocation::pageSize):
+        (WTF::PageAllocation::systemAllocate):
+        (WTF::PageAllocation::systemAllocateAt):
+        (WTF::PageAllocation::systemAllocateAligned):
+        (WTF::PageAllocation::systemDeallocate):
+        (WTF::PageAllocation::systemPageSize):
+        * wtf/PageReservation.h: Copied from JavaScriptCore/wtf/PageAllocation.h.
+        (WTF::PageReservation::PageReservation):
+        (WTF::PageReservation::commit):
+        (WTF::PageReservation::decommit):
+        (WTF::PageReservation::reserve):
+        (WTF::PageReservation::reserveAt):
+        (WTF::PageReservation::deallocate):
+        (WTF::PageReservation::systemCommit):
+        (WTF::PageReservation::systemDecommit):
+        (WTF::PageReservation::systemReserve):
+        (WTF::PageReservation::systemReserveAt):
+        * wtf/Platform.h:
+
+2010-08-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r64655.
+        http://trac.webkit.org/changeset/64655
+        https://bugs.webkit.org/show_bug.cgi?id=43496
+
+        JavaScriptCore references patch seems to have caused
+        regressions in QT and GTK builds (Requested by nlawrence on
+        #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+        * runtime/JSCell.h:
+        (JSC::JSValue::asCell):
+        (JSC::MarkStack::append):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        * runtime/JSObject.h:
+        (JSC::JSObject::prototype):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::asCell):
+        * runtime/MarkStack.h:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+
+2010-08-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Enable JSVALUE64 for CPU(PPC64).
+        Basic browsing seems to work.
+
+        * wtf/Platform.h:
+
+2010-08-04  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Refactoring MarkStack::append to take a reference.  This is in
+        preparation for movable objects when we will need to update pointers.
+        http://bugs.webkit.org/show_bug.cgi?id=41177
+
+        Unless otherwise noted, all changes are to either return by reference
+        or pass a reference to MarkStack::append.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::markAggregate):
+        * runtime/Collector.cpp:
+        (JSC::Heap::markConservatively):
+            Added a temporary variable to prevent marking from changing an
+            unknown value on the stack
+        * runtime/JSCell.h:
+        (JSC::JSValue::asCell):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendInternal):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        * runtime/JSObject.h:
+        (JSC::JSObject::prototype):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::asCell):
+        * runtime/MarkStack.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::createStructure):
+            Changed the structure flags to include a custom markChildren.
+        (JSC::NativeErrorConstructor::markChildren):
+            Update the prototype of the stored structure.
+        * runtime/NativeErrorConstructor.h:
+            Added structure flags.
+        * runtime/Structure.h:
+        (JSC::Structure::storedPrototype):
+
+2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tightened up some get_by_id_chain* code generation
+        https://bugs.webkit.org/show_bug.cgi?id=40935
+
+        This is in the style of
+        https://bugs.webkit.org/show_bug.cgi?id=30539, and changed code to
+        call accessor functions when it was not necessary to directly access
+        the private variables.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2010-08-03  Adam Roben  <aroben@apple.com>
+
+        Turn on PLATFORM_STRATEGIES on Windows
+
+        Fixes <http://webkit.org/b/43431>.
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Platform.h:
+
+2010-08-04  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Enable JSValue32_64 for GCC on ARM by default
+        https://bugs.webkit.org/show_bug.cgi?id=43410
+
+        * wtf/Platform.h:
+
+2010-08-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative windows build fix.
+
+        * wtf/Bitmap.h:
+
+2010-08-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix following r64624.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/PageAllocation.h:
+
+2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43269
+
+        Added new allocateAligned methods to PageAllocation.  In order to
+        prevent a regress in performance, the function needs to be inlined.
+
+        Additionally, I ported the symbian block allocator to use
+        PageAllocation and added a new WTF::Bitmap class to support this.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/AlignedMemoryAllocator.h: Added.
+        (JSC::AlignedMemory::deallocate):
+        (JSC::AlignedMemory::base):
+        (JSC::AlignedMemory::AlignedMemory):
+        (JSC::AlignedMemoryAllocator::destroy):
+        (JSC::AlignedMemoryAllocator::allocate):
+        (JSC::AlignedMemoryAllocator::AlignedMemoryAllocator):
+        (JSC::AlignedMemoryAllocator::~AlignedMemoryAllocator):
+        (JSC::AlignedMemoryAllocator::free):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::allocate):
+        (JSC::Heap::shrinkBlocks):
+        (JSC::Heap::markConservatively):
+        (JSC::Heap::clearMarkBits):
+        (JSC::Heap::markedCells):
+        * runtime/Collector.h:
+        (JSC::CollectorHeap::collectorBlock):
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::operator*):
+        (JSC::LiveObjectIterator::operator++):
+        (JSC::DeadObjectIterator::operator++):
+        * wtf/Bitmap.h: Added.
+        (WTF::Bitmap::get):
+        (WTF::Bitmap::set):
+        (WTF::Bitmap::clear):
+        (WTF::Bitmap::clearAll):
+        (WTF::Bitmap::advanceToNextFreeBit):
+        (WTF::Bitmap::count):
+        (WTF::Bitmap::isEmpty):
+        (WTF::Bitmap::isFull):
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::operator UnspecifiedBoolType):
+        (WTF::PageAllocation::allocateAligned):
+        (WTF::PageAllocation::reserveAligned):
+        * wtf/Platform.h:
+        * wtf/symbian: Removed.
+        * wtf/symbian/BlockAllocatorSymbian.cpp: Removed.
+        * wtf/symbian/BlockAllocatorSymbian.h: Removed.
+
+2010-08-03  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=43314.  The prior code
+        was using the wrong "length" value to move array contents when adding
+        space to the beginning of an array for an unshift() or similar
+        operation.  Instead of using m_vectorLength, the length of the
+        allocated JSValue array, the code was using m_length, the declared
+        length of the array.  These two values do not need to match.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::increaseVectorPrefixLength):
+
+2010-08-03  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix following https://bugs.webkit.org/show_bug.cgi?id=43089
+        (accidentally inverted a compiler version check).
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-08-03  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Implement DEFINE_STUB_FUNCTION for WinCE.
+        https://bugs.webkit.org/show_bug.cgi?id=34953
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-08-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43390 - Do not CRASH if we run out of room for jit code.
+
+        Change the ExecutableAllocator implementations not to crash, and to return 0 if memory cannot be allocated.
+        The assemblers should pass this through without trying to use it in executableCopy.
+        Change the LinkBuffer to handle this, and to provide an allocationSuccessful() method to test for this.
+
+        Change the JIT to throw an exception if allocation fails.
+        Make JIT optimizations fail gracefully if memory cannot be allocated (use non-optimized path).
+        Change YARR JIT to fallback to PCRE 
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::allocationSuccessful):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::allocInternal):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::setupPolymorphicProtoList):
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a crash seen on the GTK 64bit buildbot.
+        
+        When JSArray is allocated for the vptr stealing hack, it's not allocated
+        in the heap, so the JSArray constructor can't safely call Heap::heap().
+        
+        Since this was subtle enough to confuse smart people, I've changed JSArray
+        to have an explicit vptr stealing constructor.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+
+2010-08-03  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Beth Dakin.
+
+        Changed the ENABLE_MATHML value to enable MathML by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-08-03  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Change to keep returned pointer from malloc family functions to
+        quiet memory leak detect.  The pointer is saved in the new m_allocBase
+        member of the ArrayStorage structure.  This fixes the issue found in 
+        https://bugs.webkit.org/show_bug.cgi?id=43229.
+
+        As part of this change, we use m_allocBase when reallocating and
+        freeing the memory associated with ArrayStorage.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        * runtime/JSArray.h:
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43444
+        PLATFORM(CF) is false on Windows in JavaScriptCore
+
+        Moved some PLATFORM(WIN) #defines down into JavaScriptCore.
+
+        * wtf/Platform.h: Added WTF_PLATFORM_CF 1 and WTF_USE_PTHREADS 0, inherited
+        from WebCore/config.h. Removed WTF_USE_WININET 1 since WebCore/config.h
+        just #undefined that later.
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build: Don't use GCActivityCallbackCF on Windows, since
+        PLATFORM(CF) is not defined on Windows.
+        
+        We'll need to enable the GC activity callback some other way, but this
+        change should get the build back to normal.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+        * runtime/GCActivityCallbackCF.cpp: Make it easier to detect this error
+        in the future with an explicit error message.
+
+2010-08-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build: update .def file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-08-03  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41318
+        GC should reclaim garbage even when new objects are not being allocated rapidly
+
+        Added a callback in JavaScriptCore that gets triggered after an
+        allocation causes the heap to reset.  This is useful for adding a
+        timer that will trigger garbage collection after the "last" allocation.
+
+        Also needed was to add lock and unlock methods to JSLock that needed
+        only a JSGlobalData object versus an ExecState object.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reset):
+        (JSC::Heap::setActivityCallback):
+        * runtime/Collector.h:
+        * runtime/GCActivityCallback.cpp: Added.
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::operator()):
+        * runtime/GCActivityCallback.h: Added.
+        (JSC::GCActivityCallback::~GCActivityCallback):
+        (JSC::GCActivityCallback::operator()):
+        (JSC::GCActivityCallback::GCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/GCActivityCallbackCF.cpp: Added.
+        (JSC::DefaultGCActivityCallbackPlatformData::trigger):
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::operator()):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::JSLock):
+        * runtime/JSLock.h:
+
+2010-08-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix after removal of need to compile ExecutableAllocatorPosix.cpp
+
+        * wscript:
+
+2010-08-02  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [QT] build fix for symbian
+        https://bugs.webkit.org/show_bug.cgi?id=43234
+
+        1) wrong order of passing param's
+        2) static_cast complains on symbian so using reinterpret_cast
+
+        No new tests added. Just a build fix for qt symbian
+
+        * wtf/PageAllocation.cpp:
+        (WTF::PageAllocation::commit):
+        (WTF::PageAllocation::decommit):
+        (WTF::PageAllocation::reserve):
+
+2010-07-30  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Simon Fraser.
+
+        Enabling view modes to all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=37505
+
+        Removing ENABLE_WIDGETS_10_SUPPORT flag.
+
+        As view mode media feature is not part of widget 1.0 specification
+        any more the ENABLE_WIDGETS_10_SUPPORT flag may be removed. The only use
+        of this flag was related to view mode media feature implementation in Qt. 
+
+        * wtf/Platform.h:
+
+2010-07-30  Andy Estes  <aestes@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Add Xcode support for compiling WebKit against iOS SDKs.
+        https://bugs.webkit.org/show_bug.cgi?id=42796
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-07-30  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Davin Levin.
+
+        Added a yield() function.
+        https://bugs.webkit.org/show_bug.cgi?id=42843
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::yield):
+        * wtf/ThreadingWin.cpp:
+        (WTF::yield):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::yield):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::yield):
+
+2010-07-30  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add library version and soname to EFL generated libraries and binary.
+        https://bugs.webkit.org/show_bug.cgi?id=43212
+
+        Add version and soname to libjavascriptcore.so and libwtf.so in case of
+        linking as shared libraries, and version to jsc executable.
+
+        * CMakeLists.txt:
+        * jsc/CMakeLists.txt:
+        * wtf/CMakeLists.txt:
+
+2010-07-30  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [QT] build fix for symbian
+        https://bugs.webkit.org/show_bug.cgi?id=43234
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+
+2010-07-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r64313.
+        http://trac.webkit.org/changeset/64313
+        https://bugs.webkit.org/show_bug.cgi?id=43233
+
+        Some Chromium bots are not happy with it for some unknown
+        reason. (Requested by dumi on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        * wtf/ThreadingWin.cpp:
+        * wtf/gtk/ThreadingGtk.cpp:
+        * wtf/qt/ThreadingQt.cpp:
+
+2010-07-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r64302.
+        http://trac.webkit.org/changeset/64302
+        https://bugs.webkit.org/show_bug.cgi?id=43223
+
+        Assertion is bogus (Requested by olliej on #webkit).
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        * jit/JITStubs.cpp:
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile):
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::New):
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        * wtf/MD5.cpp:
+        (WTF::reverseBytes):
+        (WTF::MD5::addBytes):
+        (WTF::MD5::checksum):
+        * wtf/StdLibExtras.h:
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::inlineBuffer):
+        * wtf/qt/StringQt.cpp:
+        (WebCore::String::String):
+
+2010-07-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed the handling for removing and adding elements at the front
+        of an array.  The code now keeps a bias that indicates the amount of
+        JSValue sized holes are prior to the ArrayStorage block.  This means
+        that shift operations are now memmove's of the header part of
+        the ArrayStorage and unshift operations are similar, but may require a
+        realloc first to create the space.  Similar operations are performed
+        for special cases of splice and slice.
+        Also optimized the new Array(size) case so that we don't allocate and
+        initialize array elements until the JS code starts using elements.
+        The array growth code is slightly more aggressive for initial growth
+        based on size growth of any previous array.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::getNewVectorLength):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::length):
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::arrayStorage):
+        (JSC::JSArray::setArrayStorage):
+        (JSC::JSArray::markChildrenDirect):
+
+2010-07-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed MINIMUM_CELL_SIZE to be fixed at 64 bytes.
+
+        * runtime/Collector.h:
+
+2010-07-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by David Levin.
+
+        Added a yield() function.
+        https://bugs.webkit.org/show_bug.cgi?id=42843
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::yield):
+        * wtf/ThreadingWin.cpp:
+        (WTF::yield):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::yield):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::yield):
+
+2010-07-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed issue where RegExp greedy jit code loops when no input is
+        consumed.  Changed the code to only loop if some input was consumed,
+        but fall through if we successfully match an alternative that 
+        doesn't consume any input.
+        https://bugs.webkit.org/show_bug.cgi?id=42664
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+
+2010-07-29  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Avoid increasing required alignment of target type warning on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=38045
+
+        The reinterpret_cast<Type1*>([pointer to Type2]) expressions - where
+        sizeof(Type1) > sizeof(Type2) - cause the following warning on ARM:
+        increases required alignment of target type warnings.
+        Casting the type of [pointer to Type2] object to void* bypasses the
+        warning.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        * jit/JITStubs.cpp:
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile):
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::New):
+        (WTF::TCMalloc_Central_FreeList::Populate):
+        * wtf/MD5.cpp:
+        (WTF::reverseBytes):
+        (WTF::MD5::addBytes):
+        (WTF::MD5::checksum):
+        * wtf/StdLibExtras.h:
+        (reinterpret_cast_ptr):
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::inlineBuffer):
+        * wtf/qt/StringQt.cpp:
+        (WebCore::String::String):
+
+2010-07-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed build fix.
+
+        Include a missing header in the source list to fix 'make dist.'
+
+        * GNUmakefile.am: Include missing header.
+
+2010-07-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 43162 - Add support for MADV_FREE to PageAllocation.
+
+        * wtf/PageAllocation.cpp:
+        (WTF::PageAllocation::commit):
+        (WTF::PageAllocation::decommit):
+
+2010-07-27  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Add FILE_SYSTEM build flag for FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=42915
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Temporarily rolling out http://trac.webkit.org/changeset/64177,
+        this seems to give QT ARM/Win a headache (specifically, looks
+        like structure layour differs, objects get too large - 
+        "..\..\..\JavaScriptCore\runtime\ArrayPrototype.cpp:41:"
+        "error: size of array 'dummyclass_fits_in_cell' is negative").
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/JSArray.cpp:
+        (JSC::increasedVectorLength):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::length):
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::markChildrenDirect):
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative build fix for Chromium/Win
+
+        * wtf/Platform.h:
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Oh! that makes more sense!  Maybe C++-style comments are bringing teh bad mojo.
+
+        * wtf/Platform.h:
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative build fix for GTK/64 ... seems to be barfing on a comment o_O
+
+        * wtf/Platform.h:
+
+2010-07-27  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed the handling for removing and adding elements at the front
+        of an array.  The code now keeps a bias that indicates the amount of
+        JSValue sized holes are prior to the ArrayStorage block.  This means
+        that shift operations are now memmove's of the header part of
+        the ArrayStorage and unshift operations are similar, but may require a
+        realloc first to create the space.  Similar operations are performed
+        for special cases of splice and slice.
+        Also optimized the new Array(size) case so that we don't allocate and
+        initialize array elements until the JS code starts using elements.
+        The array growth code is slightly more aggressive for initial growth
+        based on size growth of any previous array.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::getNewVectorLength):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToRegisters):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::length):
+        (JSC::JSArray::canGetIndex):
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::uncheckedSetIndex):
+        (JSC::JSArray::arrayStorage):
+        (JSC::JSArray::setArrayStorage):
+        (JSC::JSArray::markChildrenDirect):
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43089 - Cleanup JIT related switched in Platform.h
+
+        The code the enable to JIT checks every permutation of platform & OS individually, but
+        now the JIT is enabled on the majority much all x86/x86-64/ARM/MIPS systems.  It should
+        be cleaner to just enable by default on these platforms, and explicitly disable on configs
+        that don't aren't supported.
+
+        Also, rename ENABLE_JIT_OPTIMIZE_MOD to ENABLE_JIT_USE_SOFT_MODULO.  I always find this
+        confusing since enabling this "optimization" would be possible, but would be a regression
+        on x86/x86-64 systems!  I think it's clearer to reserve "JIT_OPTIMIZE" for compiler
+        technologies applicable to all platforms, and make a more optional behaviour like this a
+        "USE".
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * wtf/Platform.h:
+
+2010-07-27  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Make PLATFORM(CHROMIUM) and not OS(MAC) turn USE(GLES2_RENDERING) on
+        https://bugs.webkit.org/show_bug.cgi?id=43084
+
+        This turns USE(GLES2_RENDERING) on for chromium on windows/linux.  This causes no
+        change in behavior, that's all controlled by ENABLE() macros that are currently off.
+
+        * wtf/Platform.h:
+
+2010-07-23  Helder Correia  <heldercorreia@codeaurora.org>
+
+        Reviewed by Darin Adler.
+
+        Canvas tests 2d.imageData.object.round and 2d.imageData.object.wrap are
+        failing. For canvas image data manipulation, the values passed should
+        be truncated and wrapped. Also fix the canvas-ImageData-behaviour test
+        to expect wrapping rather than clamping, and add some new checkings.
+        https://bugs.webkit.org/show_bug.cgi?id=40272
+
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::setIndex):
+        (JSC::JSByteArray::JSByteArray):
+
+2010-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42621 - Add a bump allocator for the YARR interpreter
+
+        The regex engine requires lifo allocation, however currently uses the general purpose
+        malloc/free memory allocation.  A simple bump pointer allocator should provide a lower
+        overhead allocation solution.
+
+        When using YARR interpreter, 15% progression on v8-regex.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalData.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        * wtf/BumpPointerAllocator.h: Added.
+        (WTF::BumpPointerPool::ensureCapacity):
+        (WTF::BumpPointerPool::alloc):
+        (WTF::BumpPointerPool::dealloc):
+        (WTF::BumpPointerPool::operator new):
+        (WTF::BumpPointerPool::BumpPointerPool):
+        (WTF::BumpPointerPool::create):
+        (WTF::BumpPointerPool::shrink):
+        (WTF::BumpPointerPool::destroy):
+        (WTF::BumpPointerPool::ensureCapacityCrossPool):
+        (WTF::BumpPointerPool::deallocCrossPool):
+        (WTF::BumpPointerAllocator::BumpPointerAllocator):
+        (WTF::BumpPointerAllocator::~BumpPointerAllocator):
+        (WTF::BumpPointerAllocator::startAllocator):
+        (WTF::BumpPointerAllocator::stopAllocator):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::byteCompileRegex):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix from Chromium/GTK build fix!
+
+        * wtf/PageAllocation.cpp:
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Chromium/GTK build fix
+
+        * wtf/PageAllocation.cpp:
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix for !Mac platforms.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43009 - Abstract out page allocation from executable allocators
+
+        It would be great to have a single platform abstraction for block allocation, rather than copy/paste code.
+
+        In this initial implementation I've made Symbian fall back to use malloc/free for non-executable memory.
+        I think this will match current behaviour for the next client we will want to port across (RegisterFile &
+        Collector).
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorPosix.cpp: Removed.
+        * jit/ExecutableAllocatorSymbian.cpp: Removed.
+        * jit/ExecutableAllocatorWin.cpp: Removed.
+        * wscript:
+        * wtf/PageAllocator.cpp: Added.
+        (WTF::protection):
+        (WTF::PageAllocation::commit):
+        (WTF::PageAllocation::decommit):
+        (WTF::PageAllocator::allocate):
+        (WTF::PageAllocator::reserve):
+        (WTF::PageAllocator::deallocate):
+        (WTF::PageAllocator::pagesize):
+        * wtf/PageAllocator.h: Added.
+        (WTF::PageAllocation::PageAllocation):
+        (WTF::PageAllocation::base):
+        (WTF::PageAllocation::size):
+        (WTF::PageAllocation::chunk):
+        (WTF::PageAllocation::operator!):
+        (WTF::PageAllocator::):
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Rolling out r64097:64100, oops, more b0rked than I relized by my last changes, sorry!
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorPosix.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocatorSymbian.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocatorWin.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * wscript:
+        * wtf/PageAllocation.cpp: Removed.
+        * wtf/PageAllocation.h: Removed.
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative !debug build fix II.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative !debug build fix.
+
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+
+2010-07-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43009 - Abstract out page allocation from executable allocators
+
+        It would be great to have a single platform abstraction for block allocation, rather than copy/paste code.
+
+        In this initial implementation I've made Symbian fall back to use malloc/free for non-executable memory.
+        I think this will match current behaviour for the next client we will want to port across (RegisterFile &
+        Collector).
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorPosix.cpp: Removed.
+        * jit/ExecutableAllocatorSymbian.cpp: Removed.
+        * jit/ExecutableAllocatorWin.cpp: Removed.
+        * wscript:
+        * wtf/PageAllocator.cpp: Added.
+        (WTF::protection):
+        (WTF::PageAllocation::commit):
+        (WTF::PageAllocation::decommit):
+        (WTF::PageAllocator::allocate):
+        (WTF::PageAllocator::reserve):
+        (WTF::PageAllocator::deallocate):
+        (WTF::PageAllocator::pagesize):
+        * wtf/PageAllocator.h: Added.
+        (WTF::PageAllocation::PageAllocation):
+        (WTF::PageAllocation::base):
+        (WTF::PageAllocation::size):
+        (WTF::PageAllocation::chunk):
+        (WTF::PageAllocation::operator!):
+        (WTF::PageAllocator::):
+
+2009-10-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Use the default timeout interval for JS as the HTML tokenizer delay for setHtml()
+
+        This ensures that long-running JavaScript (for example due to a modal alert() dialog),
+        will not trigger a deferred load after only 500ms (the default tokenizer delay) while
+        still giving a reasonable timeout (10 seconds) to prevent deadlock.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29381
+
+        * runtime/TimeoutChecker.h: Add getter for the timeout interval
+
+2010-07-25  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kent Tamura.
+
+        [WINCE] Buildfix for JSC in release mode
+        https://bugs.webkit.org/show_bug.cgi?id=42934
+
+        * jsc.cpp: Don't use __try on WinCE.
+
+2010-07-24  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [MSVC] Ensure 4 byte alignment on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=42935
+
+        * jit/JITStubs.h: Added #pragma pack(4) around JITStackFrame.
+
+2010-07-24  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        [WINCE] Cleanup defines in Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=42933
+
+        * wtf/Platform.h:
+
+2010-07-23  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Cleanup glib support (make it optional)
+        https://bugs.webkit.org/show_bug.cgi?id=42480
+
+        Remove gobject/GRefPtr.cpp if not using soup/glib.
+
+        * wtf/CMakeListsEfl.txt:
+
+2010-07-23  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Implement TCSpinLock.
+        https://bugs.webkit.org/show_bug.cgi?id=41792
+
+        Implement the SpinLock with InterlockedExchange from the Windows API.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+        (TCMalloc_SpinLock::IsHeld):
+        (TCMalloc_SpinLock::Init):
+        (TCMalloc_SlowLock):
+
+2010-07-22  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rolling out r63947 and r63948, because they broke Qt Windows build.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Eeeep! r63947 hosed all non-x86 builds!
+
+        * jit/JITStubs.h:
+
+2010-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42818 - [Qt] REGRESSION(63348): jsc is broken
+        Speculative fix, need fastcall conventions on Qt/Win.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2010-07-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Do more constant folding
+        https://bugs.webkit.org/show_bug.cgi?id=42867
+
+        Constant fold a few more operations.  SunSpider says this is
+        a win but I suspect that's just code motion at play.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+
+2010-07-22  Kent Hansen  <kent.hansen@nokia.com>
+
+        Reviewed by Kent Tamura.
+
+        Error properties of the Global Object are missing the DontEnum attribute
+        https://bugs.webkit.org/show_bug.cgi?id=28771
+
+        Add the attributes to become spec compliant.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+
+2010-07-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit on Windows should build optionally with an unversioned ICU DLL
+        https://bugs.webkit.org/show_bug.cgi?id=42722
+        <rdar://problem/8211743> JavaScriptCore needs to link against unversioned ICU
+        
+        Dynamically create a new header, ICUVersion.h, as part of build-generated-files.sh.
+        Header contains a preprocessor define (U_DISABLE_RENAMING) indicating to ICU whether the ICU API
+        should be namespaced with the current ICU version number. Proper value is determined
+        by checking for the presence of libicuuc.lib, the unversioned copy of ICU.
+        
+        To get the proper value for U_DISABLE_RENAMING into all source files, we force
+        the include of ICUVersion.h (our generated header) via the compiler options.
+        
+        Since the versioned and unversioned ICU have different filenames (libicuuc.lib vs icuuc.lib)
+        we copy the ICU lib to an intermediate location under obj with a common name. This
+        allows us to link properly with either without adding a new build configuration.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Copy ICU libs into a common location with a common name.
+        Add additional library search path to pick up icu lib.
+        Change ICU library filename specified to linker.
+        Add forced include of ICUVersion.h.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Generate ICUVersion.h
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Add forced include of ICUVersion.h.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        Copy ICU libs into a common location with a common name.
+        Add additional library search path to pick up icu lib.
+        Change ICU library filename specified to linker.
+        Add forced include of ICUVersion.h.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        Copy ICU libs into a common location with a common name.
+        Add additional library search path to pick up icu lib.
+        Change ICU library filename specified to linker.
+        Add forced include of ICUVersion.h.
+
+2010-07-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Re-save vsprops files after no-op edits in Visual Studio
+        to fix manual edit issues.
+
+2010-07-20  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Steve Block.
+
+        Need to be able to configure Geolocation policy regarding user permissions
+        https://bugs.webkit.org/show_bug.cgi?id=42068
+
+        If CLIENT_BASED_GEOLOCATION is enabled, enable preemtive permission policy
+        by default 
+
+        * wtf/Platform.h:
+        
+2010-07-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r63742.
+        http://trac.webkit.org/changeset/63742
+        https://bugs.webkit.org/show_bug.cgi?id=42641
+
+        Broke Leopard Intel build. (Requested by bbandix on #webkit).
+
+        * wtf/Platform.h:
+
+2010-07-20  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Steve Block.
+
+        Need to be able to configure Geolocation policy regarding user permissions
+        https://bugs.webkit.org/show_bug.cgi?id=42068
+
+        If CLIENT_BASED_GEOLOCATION is enabled, enable preemtive permission policy
+        by default 
+
+        * wtf/Platform.h:
+        
+2010-07-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG CleanUp of SVGPathData parsing
+        https://bugs.webkit.org/show_bug.cgi?id=41410
+
+        Added piOverTwo to MathExtras.
+
+        * wtf/MathExtras.h:
+
+2010-07-19  Mike Moretti  <mike.moretti@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Symbian] Build fix after r63404.
+
+        Implement isValid() function for the Symbian executable allocator.
+
+        * jit/ExecutableAllocatorSymbian.cpp:
+        (JSC::ExecutableAllocator::isValid):
+
+2010-07-19  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=42118
+        Disable WebGL on Leopard for now. 
+
+        LayoutTests fail on some graphics hardware on Leopard because one of the features we use,
+        GL_ARB_framebuffer_object, is not universally available in Leopard like it is in
+        SnowLeopard. This will allow LayoutTests to pass on Leopard until we add logic to use a
+        software OpenGL driver on machines without this support.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-07-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use OwnPtr for CodeBlock objects
+        https://bugs.webkit.org/show_bug.cgi?id=42490
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable): Moved this here and made it non-inline.
+        Eliminated the code that used to initialize the raw pointer since it's now
+        an OwnPtr.
+        (JSC::EvalExecutable::~EvalExecutable): Removed the explicit delete here.
+        (JSC::ProgramExecutable::ProgramExecutable): Ditto.
+        (JSC::ProgramExecutable::~ProgramExecutable): Ditto.
+        (JSC::FunctionExecutable::FunctionExecutable): Ditto.
+        (JSC::FunctionExecutable::~FunctionExecutable): Ditto.
+        (JSC::EvalExecutable::compileInternal): Added use of adoptPtr and get.
+        (JSC::ProgramExecutable::compileInternal): Ditto.
+        (JSC::FunctionExecutable::compileForCallInternal): Ditto.
+        (JSC::FunctionExecutable::compileForConstructInternal): Ditto.
+        (JSC::FunctionExecutable::recompile): Use clear instead of delete followed
+        by assignment of 0.
+
+        * runtime/Executable.h: Moved constructors to the cpp file and changed
+        raw pointers to OwnPtr.
+
+2010-07-19  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Fix build on 64-bit systems. According to
+        JavaScriptCore/wtf/Platform.h, x86_64 uses fixed allocator, which
+        needs jit/ExecutableAllocatorFixedVMPool.cpp to be included in build
+        system.
+        https://bugs.webkit.org/show_bug.cgi?id=42559
+
+        * CMakeListsEfl.txt: add missing file for x86_64.
+
+2010-07-16  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Unreviewed build system cleanup.
+
+        Move ExecutableAllocator{FixedVMPool,Posix,Symbian,Win}.cpp from
+        root CMakeLists.txt to the platform CMakeLists.txt.
+
+        * CMakeLists.txt:
+        * CMakeListsEfl.txt: Add ExecutableAllocatorPosix.cpp.
+
+2010-07-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        ES5 allows use of reserved words as IdentifierName
+        https://bugs.webkit.org/show_bug.cgi?id=42471
+
+        Modify the lexer to allow us to avoid identifying reserved
+        words in those contexts where they are valid identifiers, and
+        we know it's safe.  Additionally tag the reserved word tokens
+        so we can easily identify them in those cases where we can't
+        guarantee that we've skipped reserved word identification.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseMemberExpression):
+        * parser/JSParser.h:
+        (JSC::):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::):
+
+2010-07-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        clang++ build fixes for JavaScriptCore and WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=42478
+
+        * runtime/RegExpKey.h:
+        (JSC::operator==):
+        Move the RegExpKey equals operator into the JSC namespace so it can be found by ADL.
+
+2010-07-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Levin.
+
+        Really add WARN_UNUSED_RESULT to leakRef
+        https://bugs.webkit.org/show_bug.cgi?id=42464
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::):
+        (WTF::NonNullPassRefPtr::):
+        Put the WARN_UNUSED_RESULT attribute at the right place.
+
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::releaseRef):
+        Remove WARN_UNUSED_RESULT here for now, it leads to two warnings that need
+        to be fixed first.
+
+2010-07-15  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Levin.
+
+        [Chromium] Disable c4291 for chromium windows multi dll build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=42177
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2010-07-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash entering mail.yahoo.com
+        https://bugs.webkit.org/show_bug.cgi?id=42394
+    
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::argumentNumberFor): Added a NULL check. If the
+        identifier we're resolving is not a local variable, registerFor returns
+        NULL.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionBodyNode::emitBytecode): Unrelated to the crash, but I
+        noticed this while working on it: No need to NULL-check returnNode,
+        since an early return has already done so.
+
+2010-07-15  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Simplify the distribution step
+        https://bugs.webkit.org/show_bug.cgi?id=42414
+
+        * GNUmakefile.am: Add extra dist files directly to EXTRA_DIST instead
+        of adding them by proxy via javascriptcore_dist. Sort the EXTRA_DIST list.
+        Refer to create_hash_table and create_regexp_tables directly, as is the
+        behavior with other code generation scripts.
+
+2010-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix dumping of op_put_by_id.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printPutByIdOp):
+
+2010-07-15  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Refactoring some parts of the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41845
+
+        This patch is a precursor of refactoring the identifier
+        parsing, which currently slows down the lexer, and not
+        ready for landing. This patch contains those sources,
+        which does not slow down the lexer (mainly style changes).
+
+        SunSpider: no change (529.4ms to 528.7ms)
+        --parse-only: no change (31.0ms to 31.2ms)
+
+        * parser/Lexer.cpp:
+        (JSC::isIdentStart): using typesOfASCIICharacters to determine
+             whether the current character is in identifier start
+        (JSC::isIdentPart): using typesOfASCIICharacters to determine
+             whether the current character is in identifier part
+        (JSC::Lexer::parseString): style fix
+        (JSC::Lexer::lex): removing the else after the main which
+             which reduces code duplication
+
+2010-07-15  Mark Rowe  <mrowe@apple.com>
+
+        Update the sorting in the Xcode project files.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-07-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make sure that mixed interpreter/jit builds don't try to use the jit if the allocator fails
+        https://bugs.webkit.org/show_bug.cgi?id=42310
+
+        Add some null checks to deal with the Fixed VM allocator failing
+        to get the requested executable region, delay the creation of the
+        JITStubs in JSGlobalData until after we know whether we're using
+        the JIT.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::poolForSize):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isValid):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutableAllocator::isValid):
+        * jit/ExecutableAllocatorWin.cpp:
+        (JSC::ExecutableAllocator::isValid):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getCTIStub):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::jitCompileRegex):
+
+2010-07-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative Qt/Windows build fix.
+
+        * jit/JITStubs.h:
+
+2010-07-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=42280
+        JIT_STUB_ARGUMENT_VA_LIST is only slowing us down! Remove it!
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+
+2010-07-14  Oliver Hunt  <oliver@apple.com>
+
+        RS=Geoff Garen.
+
+        Guard the CF path of interpreter vs. jit selection with PLATFORM(CF)
+
+        This allows the code to work on windows as well.  Also unifies the
+        environment variable with the preference name.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2010-07-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Don Melton.
+
+        Crash when trying to enable JIT and Interpreter in a single build.
+
+        CFPreferences code added at the last minute failed to account for
+        the preference not being present and then attempted to CFRelease
+        a null value.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2010-07-14  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change indentations in the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41845
+
+        This patch fixes an old, indentation error comes from kjs,
+        as webkit has a different style rule for switches, and change
+        the indentation of the main switch, which is a temporary
+        style error. This change makes easier to see the behavioural
+        changes in the follow-up patch.
+
+        No behavioural changes.
+
+        * parser/Lexer.cpp:
+        (JSC::singleEscape):
+        (JSC::Lexer::lex):
+
+2010-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r63262.
+        http://trac.webkit.org/changeset/63262
+        https://bugs.webkit.org/show_bug.cgi?id=42229
+
+        broke Windows compile (Requested by bweinstein on #webkit).
+
+        * API/tests/testapi.c:
+        (assertEqualsAsCharactersPtr):
+        (main):
+        * testapi.pro: Removed.
+
+2010-07-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        ES5 requires BOMs to be treated as whitespace
+        https://bugs.webkit.org/show_bug.cgi?id=42218
+
+        Add BOM character to the Lexer's definition of whitespace,
+        and remove the logic that dealt with stripping BOMs and
+        caching the cleaned string.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+
+2010-07-13  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Avoid slow-path for put() in Array.splice()
+        https://bugs.webkit.org/show_bug.cgi?id=41920
+
+        Defer creation of the returned array until its final size is known
+        to avoid growing it while adding elements.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Add two modes of creation, CreateInitialized (old)
+        and CreateCompact (which should only be used when constructing arrays whose
+        size and contents are known at the time of creation.)
+        (JSC::JSArray::setLength): Skip first consistency check if in CreateCompact
+        initialization mode. (Only applies to non-empty arrays.)
+        (JSC::JSArray::checkConsistency): Build fix (JSValue::type() is gone)
+        * runtime/JSArray.h:
+        (JSC::JSArray::uncheckedSetIndex): Added for fast initialization of compact
+        arrays. Does no bounds or other sanity checking.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice): Optimized creation of the returned JSArray.
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk): Pass CreateInitialized to ctor.
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray): Pass CreateInitialized to ctor.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray): Pass CreateInitialized to ctor.
+
+2010-07-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42207 - Clean up interface to compile executables, always check for exceptions
+
+        Presently interface to compile executable is inconsistent between eval/program and
+        function code, and is error prone in allowing a caller to byte compile without JIT
+        compiling an executable (we rely on all executables with codeblocks having JIT code).
+        Unify on an interface where all compilation is performed by a single compile (with
+        ForCall|ForConstruct variants) method, and make all clients check for errors.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/Parser.h:
+        (JSC::Parser::isFunctionBodyNode):
+        (JSC::Parser::parse):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createStackOverflowError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::compile):
+        (JSC::EvalExecutable::generatedBytecode):
+        (JSC::EvalExecutable::generatedJITCode):
+        (JSC::ProgramExecutable::compile):
+        (JSC::ProgramExecutable::generatedBytecode):
+        (JSC::ProgramExecutable::generatedJITCode):
+        (JSC::FunctionExecutable::generatedBytecode):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::generatedJITCodeForConstructWithArityCheck):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::canUseJIT):
+
+2010-07-13  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Oliver Hunt.
+
+        testapi.c depends on the Core Foundation.
+        https://bugs.webkit.org/show_bug.cgi?id=40058
+
+        Separate CoreFoundation specific tests in JSC's testapi.c. Enabling it
+        to compile in Qt environments.
+
+        All tests should work except for the JSStringCreateWithCharacters() function,
+        because its tests depend on Core Foundation specific functions.
+
+        * API/tests/testapi.c:
+        (testJSStringRefCF): moved CoreFoundation specific tests to this function.
+        (main): The moves plus some minor tweaks.
+        * testapi.pro: Added.
+
+2010-07-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42182 - Change how numeric compare functions are detected
+
+        There are three problems with the current mechanism:
+          * It requires that a function executable be bytecode compiled without
+            being JIT generated (in order to copy the bytecode from the numeric
+            compare function).  This is a problem since we have an invariant when
+            running with the JIT that functions are never bytecode compiled without
+            also being JIT generated (after checking the codeblock we assume the
+            function has JIT code).  To help maintain this invariant 
+          * This implementation will prevent us from experimenting with alternate
+            compilation paths which do not compile via bytecode.
+          * It doesn't work.  Functions passing more than two arguments will match
+            if they are comparing their last two arguments, not the first two.
+            Generally the mapping back from bytecode to semantics may be more
+            complex then initially expected.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::setIsNumericCompareFunction):
+        (JSC::BytecodeGenerator::argumentNumberFor):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BlockNode::singleStatement):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isSubtract):
+        (JSC::BinaryOpNode::lhs):
+        (JSC::BinaryOpNode::rhs):
+        (JSC::SubNode::isSubtract):
+        (JSC::ReturnNode::value):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2010-07-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: Crash at JSC::JIT::privateCompile(JSC::MacroAssemblerCodePtr*)
+        https://bugs.webkit.org/show_bug.cgi?id=41763
+
+        There are two parts to this patch, the first is to fix the actual
+        problem.  When calling copyStringWithoutBOMs on a string we know
+        to contain BOMs we return a value indicating that there are no
+        BOMs.
+
+        The second part of this fix is simply to harden the path that
+        led to a crash when parsing failed.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+           Harden compilation stubs against parser failure.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::sourceCode):
+           Add assertions to ensure that subranges into a source provider
+           are always actually braces.  Hopefully this should catch similar
+           failures in future.  These assertions fire on existing tests
+           without this fix.
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::tryJitCodeForCall):
+        (JSC::FunctionExecutable::tryJitCodeForConstruct):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::copyStringWithoutBOMs):
+           Make copyStringWithBOMs do the right thing.
+
+2010-07-13  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the constant encoding in data transfer instructions on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=42166
+
+        The getImm function is designed to produce modified immediate constant
+        for data processing instructions. It should not be used to encode
+        any constant for data transfer. In the current situation there is no
+        way to use any immediate constant for data transfer. So, the moveImm
+        function is the desired method to pass the offset value to the data
+        transfer instructions.
+
+        Reported by Jacob Bramley.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::call32):
+
+2010-07-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        String to number coercion is not spec compliant
+        https://bugs.webkit.org/show_bug.cgi?id=31349
+
+        ToNumber should ignore NBSP (\u00a0)
+        https://bugs.webkit.org/show_bug.cgi?id=25490
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseIntOverflow): Added a version that works on UChar.
+        * runtime/JSGlobalObjectFunctions.h: Ditto.
+
+        * runtime/UString.cpp:
+        (JSC::isInfinity): Added helper functions.
+        (JSC::UString::toDouble): Use isStrWhiteSpace instead of
+        isSASCIISpace to define what we should skip. Got rid of the
+        code that used CString and UTF8String, instead processing the
+        UChar of the string directly, except for when we call strtod.
+        For strtod, use our own home-grown conversion function that
+        does not try to do any UTF-16 processing. Tidied up the logic
+        a bit as well.
+
+2010-07-12  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] make dist is broken because of missing headers and other miscellaneous reasons
+        https://bugs.webkit.org/show_bug.cgi?id=42107
+
+        * GNUmakefile.am: Add missing header to the sources list.
+
+2010-07-12  Adam Roben  <aroben@apple.com>
+
+        Stop generating stripped symbols for Release builds
+
+        It turns out we can strip the symbols after-the-fact using PDBCopy.
+
+        Fixes <http://webkit.org/b/42085>.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Removed the pre-link event, which just created the public\sym
+        directory.
+
+2010-07-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add WARN_UNUSED_RETURN to the smart pointer "leak" member functions
+        https://bugs.webkit.org/show_bug.cgi?id=42086
+
+        * wtf/OwnPtr.h:
+        * wtf/PassOwnPtr.h:
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::releaseRef):
+        (WTF::NonNullPassRefPtr::leakRef):
+        (WTF::NonNullPassRefPtr::releaseRef):
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::releaseRef):
+
+2010-07-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        HAVE_COMPUTED_GOTO is dependent on the interpreter being enabled
+        https://bugs.webkit.org/show_bug.cgi?id=42039
+
+        Separate the existence of computed goto support in the compiler
+        from whether or not we are using the interpreter.  All the current
+        HAVE(COMPUTED_GOTO) guards are for the interpreter, but I'd like
+        the option of using it elsewhere.  The interpreter now uses
+        ENABLE(COMPUTED_GOTO_INTERPRETER) 
+
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        * wtf/Platform.h:
+
+2010-07-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove switches from inner expression loops in the parser
+        https://bugs.webkit.org/show_bug.cgi?id=42035
+
+        Use bitmasks and flags on the token types to identify unary and
+        binary operators, rather than switching on the token type to
+        identify them.
+
+        * parser/JSParser.cpp:
+        (JSC::isUnaryOp):
+        (JSC::JSParser::isBinaryOperator):
+        * parser/JSParser.h:
+        (JSC::):
+
+2010-07-09  Leon Clarke  <leonclarke@google.com>
+
+        Reviewed by Adam Barth.
+
+        add support for link prefetching
+        https://bugs.webkit.org/show_bug.cgi?id=3652
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-07-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Tidy up lexer token ids
+        https://bugs.webkit.org/show_bug.cgi?id=42014
+
+        Stop using character literals to identify single character tokens
+        and instead use symbolic names for all tokens.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeBinaryNode):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::consume):
+        (JSC::JSParser::match):
+        (JSC::JSParser::autoSemiColon):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::allowAutomaticSemicolon):
+        (JSC::JSParser::parseDoWhileStatement):
+        (JSC::JSParser::parseWhileStatement):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseForStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseSwitchStatement):
+        (JSC::JSParser::parseSwitchClauses):
+        (JSC::JSParser::parseSwitchDefaultClause):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseDebuggerStatement):
+        (JSC::JSParser::parseStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parseIfStatement):
+        (JSC::JSParser::parseExpression):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseConditionalExpression):
+        (JSC::isUnaryOp):
+        (JSC::JSParser::isBinaryOperator):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseObjectLiteral):
+        (JSC::JSParser::parseStrictObjectLiteral):
+        (JSC::JSParser::parseArrayLiteral):
+        (JSC::JSParser::parsePrimaryExpression):
+        (JSC::JSParser::parseArguments):
+        (JSC::JSParser::parseMemberExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h:
+        (JSC::):
+        * parser/Lexer.cpp:
+        (JSC::):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-07-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 42015 - Enable JSValue32_64 on ARMv7
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        * wtf/Platform.h:
+
+2010-07-09  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Assertion failure in String::utf8() for certain invalid UTF16 inputs
+        https://bugs.webkit.org/show_bug.cgi?id=41983
+
+        * wtf/text/WTFString.cpp:
+        (WebCore::String::utf8):
+         - Fixed assertion when sourceExhausted is returned from convertUTF16ToUTF8.
+
+2010-07-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove a couple of excess writes from the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41981
+
+        Remove a couple of fields from JSTokenInfo, and rename the remaining ones
+        to something more accurate
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::tokenStart):
+        (JSC::JSParser::tokenLine):
+        (JSC::JSParser::tokenEnd):
+        * parser/JSParser.h:
+        (JSC::JSTokenInfo::JSTokenInfo):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+
+2010-07-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Property declarations in an object literal should not consider the prototype chain when being added to the new object
+        https://bugs.webkit.org/show_bug.cgi?id=41929
+
+        To fix this all we need to do is ensure that all new properties are
+        added with putDirect rather than a fully generic call to put.  This
+        is safe as an object literal is by definition going to produce a
+        completely normal object.
+
+        Rather than duplicating all the put_by_id logic we add an additional
+        flag to op_put_by_id to indicate it should be using putDirect.  In
+        the interpreter this adds a runtime branch, but in the jit this is
+        essentially free as the branch is taken at compile time.  This does
+        actually improve object literal creation time even in the interpreter
+        as we no longer need to walk the prototype chain to verify that the
+        cached put is safe.
+
+        We still emit normal put_by_id code when emitting __proto__ as we want
+        to get the correct handling for changing the prototype.
+
+        Sunspider claims this is a 0.7% speedup which is conceivably real due
+        to the performance improvement in object literals, but I suspect its
+        really just the result of code motion.
+
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.h:
+        (JSC::JIT::compilePutByIdTransition):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchPutByIdReplace):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchPutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        (JSC::JSValue::putDirect):
+        * runtime/JSValue.h:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        String.prototype methods should CheckObjectCoercible (test this is not null or undefined).
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::trimString):
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Date.prototype.toJSON takes one argument, report this correctly.
+
+        * runtime/DatePrototype.cpp:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        RegExp's prototype should be an object of type RegExp.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+
+2010-07-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JavaScript parser violates ECMA automatic semicolon insertion rule
+        https://bugs.webkit.org/show_bug.cgi?id=41844
+
+        Remove (very) old and bogus logic that automatically inserted a semicolon
+        at the end of a script's source.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+
+2010-07-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlson.
+
+        Tidy up the lexer
+
+        Remove some of the old yacc/lex-isms still present in the lexer
+
+        * parser/JSParser.h:
+        (JSC::):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-07-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make object-literal parsing conformant with the spec.
+        https://bugs.webkit.org/show_bug.cgi?id=41892
+
+        Bring our parsing of object literals into conformance with the ES5 spec.
+        Basically disallow conflicting accessor vs. normal property definitions
+        The bulk of this patch is just fiddling to maintain performance.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::getName):
+        (JSC::ASTBuilder::getType):
+        * parser/JSParser.cpp:
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseObjectLiteral):
+        (JSC::JSParser::parseStrictObjectLiteral):
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::clear):
+        * parser/Lexer.h:
+        (JSC::Lexer::currentOffset):
+        (JSC::Lexer::setOffset):
+          Add logic to allow us to roll the lexer back in the input stream.
+        * parser/Nodes.h:
+        (JSC::PropertyNode::):
+        (JSC::PropertyNode::type):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::isValid):
+        (JSC::SourceProvider::setValid):
+          SourceProvider now records whether the input text
+          has already been validated.
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::Property::Property):
+        (JSC::SyntaxChecker::Property::operator!):
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+          The SyntaxChecker mode now needs to maintain a bit more information
+          to ensure that we can validate object literals correctly.
+
+2010-07-08  Darin Adler  <darin@apple.com>
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::sharedInstance): Fix typo.
+
+2010-07-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix assertion seen on the Leopard buildbot.
+        The single shared instance of JSGlobalData was not being
+        adopted after creation.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::sharedInstance): Do adoptRef and then leakRef.
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        BOMs are whitespace.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::isStrWhiteSpace):
+
+2010-07-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed.
+
+        Try fix the GTK+ build by touching this file.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        GTK build fix take two.
+
+        * GNUmakefile.am:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        GTK build fix.
+
+        * GNUmakefile.am:
+
+2010-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41641
+
+        Update compile flags to allow use of ExecutableAllocatorFixedVMPool on platforms
+        other than x86-64 (this may be useful on 32-bit platforms, too).
+
+        Simplify ifdefs by dividing into thwo broad allocation strategies
+        (ENABLE_EXECUTABLE_ALLOCATOR_FIXED & ENABLE_EXECUTABLE_ALLOCATOR_DEMAND).
+
+        Rename constant used in the code to have names descriptive of their purpose,
+        rather than their specific value on a given platform.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * wtf/Platform.h:
+
+2010-07-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Silence a few noisy build rules.
+
+        * GNUmakefile.am:
+
+2010-07-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62765.
+        http://trac.webkit.org/changeset/62765
+        https://bugs.webkit.org/show_bug.cgi?id=41840
+
+        All jscore and layout tests crash on Qt bot (Requested by Ossy
+        on #webkit).
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+
+2010-07-08  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Interpreter: Crash in op_load_varargs on 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=41795
+
+        Added missing cast of argCount to int32_t in op_load_varargs.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-07-08  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make FastMalloc more portable.
+        https://bugs.webkit.org/show_bug.cgi?id=41790
+
+        Use WTF::Mutex instead of pthread_mutex_t and
+        replace pthread_cond_t with WTF::ThreadCondition.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::initializeScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMalloc_PageHeap::scavengerThread):
+
+2010-07-08  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Remove needless #include <fcntl.h> from TCSystemAlloc.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=41777
+
+        * wtf/TCSystemAlloc.cpp:
+
+2010-07-07  Darin Adler  <darin@apple.com>
+
+        Fixed build in configurations like PowerPC.
+
+        * runtime/RegExpConstructor.cpp: Added include of PassOwnPtr.h.
+        * runtime/RegExpObject.cpp: Ditto.
+        * wtf/SizeLimits.cpp: Changed compile time assertion to work
+        even on platforms where two bool members do not end up taking
+        the same size as one int member!
+
+2010-07-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Lazy mode of parser allows invalid syntax in object literals.
+        https://bugs.webkit.org/show_bug.cgi?id=41809
+
+        Make the parser itself validate getter and setter syntax rather
+        than offloading it to the AST builder.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseProperty):
+
+2010-07-07  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Revert r62689.
+        https://bugs.webkit.org/show_bug.cgi?id=41804
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks):
+
+2010-07-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Add reverseFind to Vector and deploy in HTML5 parser
+        https://bugs.webkit.org/show_bug.cgi?id=41778
+
+        This method seems generally useful.  I'm slightly surprised we don't
+        have it already.
+
+        * wtf/Vector.h:
+        (WTF::::reverseFind):
+
+2010-07-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Turn on adoptRef assertion for RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=41547
+
+        * wtf/CrossThreadRefCounted.h: Fixed include style. Includes of other
+        WTF headers should use "" includes; consistent in most WTF headers.
+        Added a call to relaxAdoptionRequirement.
+
+        * wtf/RefCounted.h: Fixed include style. Removed LOOSE_REF_COUNTED.
+        Added relaxAdoptionRequirement.
+
+2010-07-07  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::freeBlocks):
+
+2010-07-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        More OwnPtr work
+        https://bugs.webkit.org/show_bug.cgi?id=41727
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty): Use adoptPtr.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::JSCallbackObject): Ditto.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Ditto.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::createRareDataIfNecessary): Ditto.
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode): Ditto.
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Ditto.
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments): Ditto.
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compile): Ditto.
+        (JSC::ProgramExecutable::compile): Ditto.
+        (JSC::FunctionExecutable::compileForCall): Ditto.
+        (JSC::FunctionExecutable::compileForConstruct): Ditto.
+        (JSC::FunctionExecutable::reparseExceptionInfo): Ditto.
+        (JSC::EvalExecutable::reparseExceptionInfo): Ditto.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Ditto.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor): Ditto.
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject): Ditto.
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createSingleCharacterString): Ditto.
+        (JSC::SmallStrings::singleCharacterStringRep): Ditto.
+
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault): Use adoptPtr.
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::ByteCompiler): Ditto.
+        (JSC::Yarr::ByteCompiler::compile): Ditto.
+        (JSC::Yarr::ByteCompiler::regexBegin): Ditto.
+        (JSC::Yarr::byteCompileRegex): Ditto.
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern): Ditto.
+
+2010-07-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Make clear set the pointer to 0 before deletion
+        https://bugs.webkit.org/show_bug.cgi?id=41727
+
+        * wtf/OwnArrayPtr.h: Changed code so we always set the pointer to its new
+        value before deleting the old one, including in the set function and the
+        clear function. This required changing safeDelete.
+        * wtf/OwnPtr.h: Ditto. Also removed some extra null checks.
+        * wtf/PassOwnPtr.h: Ditto.
+
+        * wtf/PassRefPtr.h: Changed code so we always set the pointer to its new
+        value before deref'ing the old one in the clear function. Also added a
+        leakRef function for NonNullPassRefPtr.
+        * wtf/RefPtr.h: Ditto.
+
+        * wtf/gobject/GOwnPtr.h: More of the same.
+        * wtf/gobject/GRefPtr.h: Ditto.
+
+2010-07-07  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Refactored string parsing inside the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41606
+
+        Does not use goto. Although the last sunspider
+        parse-only tests yields 1.044x speedup, I think the
+        patch can have a slight improvement at most.
+
+        * parser/Lexer.cpp:
+        (JSC::singleEscape):
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+
+2010-07-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make it possible to have both the JIT and Interpreter available in a single build
+        https://bugs.webkit.org/show_bug.cgi?id=41722
+
+        Separate the concept of !ENABLE(JIT) and ENABLE(INTERPRETER) and make it possible
+        to have both JIT and INTERPRETER enabled at the same time.  This doesn't add
+        support for mix mode execution, but it does allow a single build to contain all
+        the code needed to use either the interpreter or the jit.
+
+        If both ENABLE(INTERPRETER) and ENABLE(JIT) are true then setting the environment
+        variable JSC_FORCE_INTERPRETER will force JSC to use the interpreter.
+
+        This patch basically consists of replacing !ENABLE(JIT) with ENABLE(INTERPRETER),
+        or converting #if ENABLE(JIT) ... #else ... into #if ENABLE(JIT) ... #endif
+        #if ENABLE(INTERPRETER), etc.  There are also a few functions that need to be
+        renamed to resolve return type ambiguity.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::returnVPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::generateJITCode):
+        (JSC::ProgramExecutable::generateJITCode):
+        (JSC::FunctionExecutable::generateJITCodeForCall):
+        (JSC::FunctionExecutable::generateJITCodeForConstruct):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::canUseJIT):
+        * wtf/Platform.h:
+
+2010-07-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Add adoptPtr and leakPtr functions for OwnPtr and PassOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=41320
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): Use assignment
+        instead of set since the result of reparseExceptionInfo is now a
+        PassOwnPtr.
+
+        * bytecode/CodeBlock.h: Change extractExceptionInfo to return a
+        PassOwnPtr instead of a raw pointer.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::reparseExceptionInfo): Return a PassOwnPtr.
+        (JSC::EvalExecutable::reparseExceptionInfo): Ditto.
+        (JSC::ProgramExecutable::reparseExceptionInfo): Added. This was
+        in the header before, but it's better to not have it there to reduce
+        header dependencies. Return a PassOwnPtr.
+
+        * runtime/Executable.h: Made reparseExceptionInfo return a PassOwnPtr,
+        and put it in the private sections of classes other than the base class.
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::append): Use leakPtr instead of release.
+        (WTF::MessageQueue::appendAndCheckEmpty): Ditto.
+        (WTF::MessageQueue::prepend): Ditto.
+
+        * wtf/OwnPtr.h: Tweaked formatting. Changed the release function to return
+        a PassOwnPtr rather than a raw pointer. Added a leakPtr function that
+        returns a raw pointer. Put the constructor that takes a raw pointer and
+        the set function into a section guarded by LOOSE_OWN_PTR. Adapted to the
+        new adoptPtr function from PassOwnPtr.h.
+
+        * wtf/PassOwnPtr.h: Tweaked formatting. Renamed the release function
+        to leakPtr. Added an adoptPtr function that creates a new PassOwnPtr.
+        Put the constructor and assignment operators that take a raw pointer
+        into a section guarded by LOOSE_PASS_OWN_PTR.
+
+2010-07-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler
+
+        Update comment in StringExtras.h to be more accurate.
+
+        * wtf/StringExtras.h:
+
+2010-07-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62511.
+        http://trac.webkit.org/changeset/62511
+        https://bugs.webkit.org/show_bug.cgi?id=41686
+
+        Breaks Linux/64bit compilation (Requested by xan_ on #webkit).
+
+        * jit/ExecutableAllocator.cpp:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * wtf/Platform.h:
+
+2010-07-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41641
+
+        Update compile flags to allow use of ExecutableAllocatorFixedVMPool on platforms
+        other than x86-64 (this may be useful on 32-bit platforms, too).
+
+        Simplify ifdefs by dividing into thwo broad allocation strategies
+        (ENABLE_EXECUTABLE_ALLOCATOR_FIXED & ENABLE_EXECUTABLE_ALLOCATOR_DEMAND).
+
+        Rename constant used in the code to have names descriptive of their purpose,
+        rather than their specific value on a given platform.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutablePool::systemAlloc):
+        * jit/ExecutableAllocatorPosix.cpp:
+        * jit/ExecutableAllocatorSymbian.cpp:
+        * jit/ExecutableAllocatorWin.cpp:
+        * wtf/Platform.h:
+
+2010-07-05  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        ThreadingPthreads.cpp should use JNIUtility.h on Android, not outdated jni_utility.h
+        https://bugs.webkit.org/show_bug.cgi?id=41594
+
+        * wtf/ThreadingPthreads.cpp:
+
+2010-07-04  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r62456.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Be slightly more consistent in using uint32_t to prevent
+        warnings about comparisons between signed and unsigned types, and attempts to call an overload
+        of std::min that doesn't exist.
+
+2010-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41553
+        Make StringExtras.h versions of snprintf and vsnprintf match the unix versions.
+
+        - MSVC does not ensure the buffers are null terminated as the unix versions do.
+
+        * runtime/JSGlobalObjectFunctions.cpp: Cleanup includes.
+        * runtime/UString.cpp: Clean up includes.
+        (JSC::UString::from): Don't pass sizeof(buf) - 1, that is wrong.
+        * wtf/StringExtras.h:
+        (snprintf): Ensure null termination of buffer.
+        (vsnprintf): Ditto.
+
+2010-07-03  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make Arguments::MaxArguments clamping work for numbers >= 0x80000000 in
+        the interpreter as well as the JIT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41351
+        rdar://problem/8142141
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Fix signed integer overflow problem
+        in op_load_varargs handling. 0xFFFFFFFF was read as -1.
+
+2010-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dumitru Daniliuc.
+
+        Support for keys and in-memory storage for IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=41252
+
+        Set the role to Private.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Move BOM handling out of the lexer and parser
+        https://bugs.webkit.org/show_bug.cgi?id=41539
+
+        Doing the BOM stripping in the lexer meant that we could
+        end up having to strip the BOMs from a source multiple times.
+        To deal with this we now require all strings provided by
+        a SourceProvider to already have had the BOMs stripped.
+        This also simplifies some of the lexer logic.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::copyStringWithoutBOMs):
+
+2010-07-03  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kent Tamura.
+
+        [WINCE] Implement Unicode::isAlphanumeric and Unicode::isArabicChar.
+        https://bugs.webkit.org/show_bug.cgi?id=41411
+
+        * wtf/unicode/wince/UnicodeWince.cpp:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/wince/UnicodeWince.h:
+        (WTF::Unicode::isArabicChar):
+
+2010-07-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Change the CRASH() macro to print "WebKit CRASH" log.
+        https://bugs.webkit.org/show_bug.cgi?id=41524
+
+        Print "WebKit CRASH" before crashing.
+
+        * wtf/Assertions.h:
+
+2010-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41565 - Repatching in ARMv7Assembler::repatchLoadPtrToLEA is broken
+
+        This method tried to repatch a LDR (T2) into an ADD (T3) - but it only
+        repatches the first instruction word.  The layout of the fields in the
+        second word is different, and also needs repatching.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::repatchLoadPtrToLEA):
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clamp the number of arguments supported by function.apply
+        https://bugs.webkit.org/show_bug.cgi?id=41351
+        <rdar://problem/8142141>
+
+        Add clamping logic to function.apply similar to that
+        enforced by firefox.  We have a smaller clamp than
+        firefox as our calling convention means that stack
+        usage is proportional to argument count -- the firefox
+        limit is larger than you could actually call.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::):
+
+2010-07-02  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Re-enable JIT_OPTIMIZE_NATIVE_CALL on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=40179
+
+        Add the MIPS part to re-enable JIT_OPTIMIZE_NATIVE_CALL.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * wtf/Platform.h:
+
+2010-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41552 - Clean up ARMv7 vfp code generation
+        Emit separate opcode individually, remove magic numbers.
+
+        Also remove invalid assert from JSImmediate (number cells are not CELL_MASK aligned).
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::vadd_F64):
+        (JSC::ARMv7Assembler::vcmp_F64):
+        (JSC::ARMv7Assembler::vcvt_F64_S32):
+        (JSC::ARMv7Assembler::vcvtr_S32_F64):
+        (JSC::ARMv7Assembler::vdiv_F64):
+        (JSC::ARMv7Assembler::vldr):
+        (JSC::ARMv7Assembler::vmov_F64_0):
+        (JSC::ARMv7Assembler::vmov):
+        (JSC::ARMv7Assembler::vmrs):
+        (JSC::ARMv7Assembler::vmul_F64):
+        (JSC::ARMv7Assembler::vstr):
+        (JSC::ARMv7Assembler::vsub_F64):
+        (JSC::ARMv7Assembler::VFPOperand::VFPOperand):
+        (JSC::ARMv7Assembler::VFPOperand::bits1):
+        (JSC::ARMv7Assembler::VFPOperand::bits4):
+        (JSC::ARMv7Assembler::vcvtOp):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpOp):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpMemOp):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchDouble):
+        * runtime/JSImmediate.h:
+        (JSC::JSValue::isCell):
+
+2010-07-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62410.
+        http://trac.webkit.org/changeset/62410
+        https://bugs.webkit.org/show_bug.cgi?id=41549
+
+        accursed last minute changes (Requested by olliej on #webkit).
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::copyCodeWithoutBOMs):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::):
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::hasBOMs):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+
+2010-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41548
+        Use snprintf instead of sprintf everywhere in JavaScriptCore
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Move BOM handling out of the lexer and parser
+        https://bugs.webkit.org/show_bug.cgi?id=41539
+
+        Doing the BOM stripping in the lexer meant that we could
+        end up having to strip the BOMs from a source multiple times.
+        To deal with this we now require all strings provided by
+        a SourceProvider to already have had the BOMs stripped.
+        This also simplifies some of the lexer logic.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::copyStringWithoutBOMs):
+
+2010-07-02  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+        
+        [ Updated after rollout. ]
+
+        Merged RegExp constructor and RegExp::create methods.
+        Both functions are called with three parameters and check whether 
+        flags (the third param) is given or not.
+        Avoid extra hash lookups in RegExpCache::create by passing a pre-computed
+        iterator parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=41055
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed. Build fix for GTK+.
+
+        Build Lexer.lut.h with the rest of the .lut.h files. Later these should
+        all probably be moved to DerivedSources.
+
+        * GNUmakefile.am:
+
+2010-06-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Separate DerivedSources per-project
+        https://bugs.webkit.org/show_bug.cgi?id=41109
+
+        Generate JavaScriptCore derived sources in <builddir>/DerivedSources/JavaScriptCore.
+
+        * GNUmakefile.am:
+
+2010-07-02  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        The alternativeFrameLocation value is wrong in the emitDisjunction function in
+        case of PatternTerm::TypeParentheticalAssertion. This value needs to be
+        computed from term.frameLocation instead of term.inputPosition. This mistake caused glibc
+        memory corruption in some cases.
+        Layout test added for checking of TypeParentheticalAssertion case.
+        https://bugs.webkit.org/show_bug.cgi?id=41458
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a FixedArray template to encapsulate fixed length arrays
+        https://bugs.webkit.org/show_bug.cgi?id=41506
+
+        This new type is used in place of fixed length C arrays so
+        that debug builds can guard against attempts to go beyond
+        the end of the array.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLength):
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::allocate):
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::clearAll):
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::operator*):
+        * runtime/DateInstanceCache.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSStringFinalizerStruct::):
+        * runtime/NumericStrings.h:
+        * runtime/RegExpCache.h:
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::singleCharacterStrings):
+        * wtf/AVLTree.h:
+        * wtf/FixedArray.h: Added.
+        (WTF::FixedArray::operator[]):
+        (WTF::FixedArray::data):
+
+2010-07-01  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Improve the main lexer switch by mapping input characters to their type
+        https://bugs.webkit.org/show_bug.cgi?id=41459
+
+        Sunsipder: no change (from 532.9ms to 531.5ms)
+        SunSpider --parse-only: 1.025x as fast (from 33.1ms to 32.3ms)
+
+        * parser/Lexer.cpp:
+        (JSC::):
+        (JSC::Lexer::lex):
+
+2010-07-01  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Ander Carlsson.
+
+        Define HAVE_HOSTED_CORE_ANIMATION on Snow Leopard.
+
+        * wtf/Platform.h:
+
+2010-07-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41490 - Add missing operations to MacroAssemblerARMv7
+        Also, make single, double, quad register numbers in ARMv7Assembler distinct & strongly typed.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMRegisters::):
+        (JSC::ARMRegisters::asSingle):
+        (JSC::ARMRegisters::asDouble):
+        (JSC::VFPImmediate::VFPImmediate):
+        (JSC::VFPImmediate::isValid):
+        (JSC::VFPImmediate::value):
+        (JSC::ARMv7Assembler::singleRegisterMask):
+        (JSC::ARMv7Assembler::doubleRegisterMask):
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::add_S):
+        (JSC::ARMv7Assembler::neg):
+        (JSC::ARMv7Assembler::orr_S):
+        (JSC::ARMv7Assembler::sub):
+        (JSC::ARMv7Assembler::sub_S):
+        (JSC::ARMv7Assembler::vadd_F64):
+        (JSC::ARMv7Assembler::vcmp_F64):
+        (JSC::ARMv7Assembler::vcvt_F64_S32):
+        (JSC::ARMv7Assembler::vcvtr_S32_F64):
+        (JSC::ARMv7Assembler::vdiv_F64):
+        (JSC::ARMv7Assembler::vldr):
+        (JSC::ARMv7Assembler::vmov_F64_0):
+        (JSC::ARMv7Assembler::vmov):
+        (JSC::ARMv7Assembler::vmul_F64):
+        (JSC::ARMv7Assembler::vstr):
+        (JSC::ARMv7Assembler::vsub_F64):
+        (JSC::ARMv7Assembler::vcvt):
+        (JSC::ARMv7Assembler::vmem):
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::fpTempRegisterAsSingle):
+        (JSC::MacroAssemblerARMv7::neg32):
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::divDouble):
+        (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
+        (JSC::MacroAssemblerARMv7::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerARMv7::zeroDouble):
+        (JSC::MacroAssemblerARMv7::branchOr32):
+        (JSC::MacroAssemblerARMv7::set32):
+        (JSC::MacroAssemblerARMv7::set8):
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86Common.h:
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve reentrancy logic in polymorphic cache stubs
+        <https://bugs.webkit.org/show_bug.cgi?id=41482>
+        <rdar://problem/8094380>
+
+        Make the polymorphic cache stubs handle reentrancy
+        better.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+
+2010-07-01  Antti Koivisto  <koivisto@iki.fi>
+
+        Revert accidental commit.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+
+2010-06-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Add assertion, off by default, for when you forget to do adoptRef
+        https://bugs.webkit.org/show_bug.cgi?id=41422
+
+        * wtf/PassRefPtr.h: Tweaked formatting. Added a new adopted
+        function, called on the pointer by adoptRef, with an empty inline
+        default version, meant to be overloaded. Unified the inlining
+        with a macro named REF_DEREF_INLINE to make it clearer what's
+        going on in the refIfNotNull/derefIfNotNull functions. Renamed
+        releaseRef to leakRef, but left the old name in for compatibility
+        for now.
+
+        * wtf/RefCounted.h: Added code to require adoption and assert if
+        you don't call adoptRef. For now, it is turned off because of the
+        LOOSE_REF_COUNTED define in this header. Later we can turn it on
+        once we get everything working without asserting.
+
+2010-06-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 41238 - RegExp performance slow on Dromaeo benchmark
+
+        Other javascript engines appear to cache prior results of regular 
+        expression operations.
+
+        Suggest adding some sort of caching mechanism to regular expression 
+        processing.
+
+        Added a single entry cache of match() results to RegExp class.
+
+        Also added performance improvements to UString == operator.
+        First check the impls for equality.  Then get the length of
+        each of the non-null impls.  Next check the sizes for equality.
+        Then check the data for the case of different impls that point 
+        to the same data (most likely due to substrings from the beginning of
+        another string).  Lastly we check the underlying data for equality.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * runtime/UString.h:
+        (JSC::operator==):
+
+2010-06-29  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        WTF::HashSet iterators are quasi-mutable.  Changing the value through
+        dereferencing an iterator will not change the behavior of methods like
+        contains or find, but will change the behavior of iterating.
+
+        * wtf/HashSet.h:
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::find):
+        (WTF::::remove):
+        * wtf/HashTable.h:
+
+2010-06-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Clean up the source lists in the GNUMakefile.am files
+        https://bugs.webkit.org/show_bug.cgi?id=41229
+
+        Clean up the GNUMakefile.am a little bit. Alphabetize and conglomerate
+        the source lists.
+
+        * GNUmakefile.am:
+
+2010-06-29  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix QtScript build after QScriptValuePrivate ctor changes
+        https://bugs.webkit.org/show_bug.cgi?id=41307
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::prototype):
+        * qt/benchmarks/qscriptengine/qscriptengine.pro:
+
+2010-06-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QScriptEngine API should contain a newArray function
+        https://bugs.webkit.org/show_bug.cgi?id=39115
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::newArray):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::newArray):
+        * qt/api/qscriptengine_p.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::newArray):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Install jsc as jsc-X where X is the major API version to allow
+        parallel installation of both GTK+ 2.x and 3.x versions.
+
+        * GNUmakefile.am:
+
+2010-06-28  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Kent Tamura.
+
+        add ENABLE_DIRECTORY_UPLOAD build support
+        https://bugs.webkit.org/show_bug.cgi?id=41100
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Revert to build jsc, since the tests expect this.
+
+        * GNUmakefile.am:
+
+2010-06-28  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Only one character lookahead should be enough for the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41213
+
+        The lexer had 4 character lookahead before, which required
+        a complex shifting mechanism. This can be improved by using
+        only one character lookahead for most decisions, and a
+        peek() function as a fallback when it is absolutely necessary.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::currentCharacter):
+        (JSC::Lexer::currentOffset):
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::shift):
+        (JSC::Lexer::peek):
+        (JSC::Lexer::getUnicodeCharacter):
+        (JSC::Lexer::shiftLineTerminator):
+        (JSC::Lexer::lastTokenWasRestrKeyword):
+        (JSC::Lexer::lex):
+        (JSC::Lexer::scanRegExp):
+        (JSC::Lexer::skipRegExp):
+        * parser/Lexer.h:
+
+2010-06-28  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Build fix for latest version of Ecore library.
+        Ecore recently changed return type of callbacks from int to Eina_Bool.
+
+        * wtf/efl/MainThreadEfl.cpp:
+        (WTF::timeoutFired): Return Eina_Bool instead of int.
+
+2010-06-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QScriptValue should have API for accessing object properties
+        https://bugs.webkit.org/show_bug.cgi?id=40903
+
+        Make possible to access properties inside QScriptValues. While this
+        still doesn't support the ResolveLocal parameter, it is already useful
+        for testing the API.
+
+        The tests from upstream QtScript weren't imported since most of them
+        depend on the setProperty() function as well. A simple test was created.
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::property):
+        * qt/api/qscriptvalue.h:
+        (QScriptValue::):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::property):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::propertySimple):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Add support for GTK+3
+        https://bugs.webkit.org/show_bug.cgi?id=41253
+
+        Suffix jsc with the API version of the library, so that
+        libwebkitgtk 1.x and 3.x can install jsc.
+
+        * GNUmakefile.am:
+
+2010-06-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Turn ENABLE(SINGLE_THREADED) on.
+        https://bugs.webkit.org/show_bug.cgi?id=41135
+
+        Brew MP does not support preemptive multi-threading.
+        Disable threading for Brew MP.
+
+        * wtf/Platform.h:
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add an ENABLE_WEB_TIMING option for enabling Web Timing support.
+        https://bugs.webkit.org/show_bug.cgi?id=38924
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-25  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        We assume in testapi.c that the value aHeapRef refers to will not be
+        moved.  When we have movable objects, this will not be the case.
+
+        * API/tests/testapi.c:
+        (main):
+
+2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r61924.
+        http://trac.webkit.org/changeset/61924
+        https://bugs.webkit.org/show_bug.cgi?id=41240
+
+        It was rolled out, but cq+ wasn't removed (Requested by Ossy_
+        on #webkit).
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-25  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Merge RegExp constructor and RegExp::create methods into one.
+        Both of function are called with tree parameters and check whether 
+        flags (the third param) is given or not.
+        Simplify hash lookups in RegExpCache::create with giving them an extra 
+        iterator parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=41055
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-25  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Introduce QtScript benchmarks.
+
+        The QtScript performance should be tested regularly. The patch introduces
+        micro benchmarks for existing API.
+
+        [Qt] Performance of the QtScript API is not tested.
+        https://bugs.webkit.org/show_bug.cgi?id=40911
+
+        * qt/benchmarks/benchmarks.pri: Copied from JavaScriptCore/qt/tests/tests.pri.
+        * qt/benchmarks/benchmarks.pro: Added.
+        * qt/benchmarks/qscriptengine/qscriptengine.pro: Added.
+        * qt/benchmarks/qscriptengine/tst_qscriptengine.cpp: Added.
+        (tst_QScriptEngine::checkSyntax_data):
+        (tst_QScriptEngine::checkSyntax):
+        (tst_QScriptEngine::constructor):
+        (tst_QScriptEngine::evaluateString_data):
+        (tst_QScriptEngine::evaluateString):
+        (tst_QScriptEngine::evaluateProgram_data):
+        (tst_QScriptEngine::evaluateProgram):
+        (tst_QScriptEngine::newObject):
+        (tst_QScriptEngine::nullValue):
+        (tst_QScriptEngine::undefinedValue):
+        (tst_QScriptEngine::globalObject):
+        (tst_QScriptEngine::toStringHandle):
+        * qt/benchmarks/qscriptvalue/qscriptvalue.pro: Added.
+        * qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp: Added.
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::values_data):
+        (tst_QScriptValue::ctorBool):
+        (tst_QScriptValue::ctorReal):
+        (tst_QScriptValue::ctorNumber):
+        (tst_QScriptValue::ctorQString):
+        (tst_QScriptValue::ctorCString):
+        (tst_QScriptValue::ctorSpecial):
+        (tst_QScriptValue::ctorQScriptValue):
+        (tst_QScriptValue::isValid_data):
+        (tst_QScriptValue::isValid):
+        (tst_QScriptValue::isBool_data):
+        (tst_QScriptValue::isBool):
+        (tst_QScriptValue::isNumber_data):
+        (tst_QScriptValue::isNumber):
+        (tst_QScriptValue::isFunction_data):
+        (tst_QScriptValue::isFunction):
+        (tst_QScriptValue::isNull_data):
+        (tst_QScriptValue::isNull):
+        (tst_QScriptValue::isString_data):
+        (tst_QScriptValue::isString):
+        (tst_QScriptValue::isUndefined_data):
+        (tst_QScriptValue::isUndefined):
+        (tst_QScriptValue::isObject_data):
+        (tst_QScriptValue::isObject):
+        (tst_QScriptValue::isError_data):
+        (tst_QScriptValue::isError):
+        (tst_QScriptValue::toString_data):
+        (tst_QScriptValue::toString):
+        (tst_QScriptValue::toNumber_data):
+        (tst_QScriptValue::toNumber):
+        (tst_QScriptValue::toBool_data):
+        (tst_QScriptValue::toBool):
+        (tst_QScriptValue::toInteger_data):
+        (tst_QScriptValue::toInteger):
+        (tst_QScriptValue::toInt32_data):
+        (tst_QScriptValue::toInt32):
+        (tst_QScriptValue::toUInt32_data):
+        (tst_QScriptValue::toUInt32):
+        (tst_QScriptValue::toUInt16_data):
+        (tst_QScriptValue::toUInt16):
+        (tst_QScriptValue::toObject_data):
+        (tst_QScriptValue::toObject):
+        (tst_QScriptValue::equals_data):
+        (tst_QScriptValue::equals):
+        (tst_QScriptValue::strictlyEquals_data):
+        (tst_QScriptValue::strictlyEquals):
+        (tst_QScriptValue::instanceOf_data):
+        (tst_QScriptValue::instanceOf):
+
+2010-06-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove old js parser
+        https://bugs.webkit.org/show_bug.cgi?id=41222
+
+        Remove the old yacc parser, this also solves the tiger problem.  Which
+        was a conflict between yacc generated token values and those in the
+        custom parser
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/Grammar.y: Removed.
+        * parser/JSParser.cpp:
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * wtf/Platform.h:
+
+2010-06-25  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        New QtScript API; setPrototype() and prototype().
+
+        This patch implements QScriptValue's prototype accessors.
+
+        [Qt] QScriptValue should have accessors to a prototype.
+        https://bugs.webkit.org/show_bug.cgi?id=39356
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::prototype):
+        (QScriptValue::setPrototype):
+        * qt/api/qscriptvalue.h:
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::prototype):
+        (QScriptValuePrivate::setPrototype):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::getSetPrototype):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+
+2010-06-25  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMake] Add option to enable JIT.
+        JIT is disabled by default, but now it's possible to enable it through
+        an option to CMake: -DENABLE_JIT will enable it.
+        https://bugs.webkit.org/show_bug.cgi?id=40936
+
+        * CMakeLists.txt: Add missing files and re-sort.
+
+2010-06-25  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [CMake] Remove unused variable in EFL build system. It was previously
+        being used to set the flags of each port but it was superseded by
+        other flags.
+        https://bugs.webkit.org/show_bug.cgi?id=40931
+
+        * jsc/CMakeLists.txt:
+
+2010-06-25  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Aligning AssemblerBuffer to 128 bytes gives a 0.4% speedup on
+        sunspider.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+
+2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r61842.
+        http://trac.webkit.org/changeset/61842
+        https://bugs.webkit.org/show_bug.cgi?id=41208
+
+        It broke Windows build (Requested by Ossy_ on #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.h: Removed.
+        * wtf/win/OwnPtrWin.h: Removed.
+
+2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r61833.
+        http://trac.webkit.org/changeset/61833
+        https://bugs.webkit.org/show_bug.cgi?id=41205
+
+        It broke Leopard and GTK (Requested by Ossy_ on #webkit).
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Change OwnPtrCommon to include platform-specific headers
+        https://bugs.webkit.org/show_bug.cgi?id=40279
+
+        Adding new type to OwnPtrCommon needlessly causes all ports to do full rebuilds.
+        Change OwnPtrCommon to include platform-specific headers to avoid all ports rebuilds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.h: Added.
+        * wtf/win/OwnPtrWin.h: Added.
+
+2010-06-25  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Add the possibility for a head and footer section to create_jit_stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=36050
+
+        * create_jit_stubs:
+
+2010-06-24  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Merge RegExp constructor and RegExp::create methods into one.
+        Both of function are called with tree parameters and check whether 
+        flags (the third param) is given or not.
+        Simplify hash lookups in RegExpCache::create with giving them an extra 
+        iterator parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=41055
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Incorrect use of '+ 4' and 0 instead of tag and payload offsets in JSValue32_64
+        https://bugs.webkit.org/show_bug.cgi?id=41193
+
+        I noticed a use of '+ 4' in some of the 32_64 code paths and realised there
+        were a few places where endianness was being hardcoded.  This patch fixes
+        the errors i could find through code inspection.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2010-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        Temporarily get the tiger bot working again by disabling the
+        new JS parser.  GCC on tiger is miscompiling the parser and
+        I don't have access to a tiger machine right now.
+
+        * wtf/Platform.h:
+
+ 2010-06-21  Nathan Lawrence  <nlawrence@apple.com>
+
+         Reviewed by Geoff Garen.
+
+         https://bugs.webkit.org/show_bug.cgi?id=40128
+         Fixed broken debug functionality.
+
+         * interpreter/Interpreter.cpp:
+         (JSC::Interpreter::dumpRegisters):
+             Fixed to work with updated call frame.
+         * runtime/JSImmediate.h:
+         (JSC::JSValue::isCell):
+             Added assert for aligned cell.
+         * runtime/JSValue.cpp:
+         (JSC::JSValue::description):
+             Fixed to work with current JSValue implementation.
+         * runtime/JSZombie.cpp:
+         (JSC::JSZombie::leakedZombieStructure):
+             JSombies compile again.
+
+2010-06-24  Leandro Pereira  <leandro@profusion.mobi>
+
+        Unreviewed build fix.
+
+        * CMakeLists.txt: Add JSParser.cpp.
+
+2010-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Single character string replacement may replace too many characters
+        https://bugs.webkit.org/show_bug.cgi?id=41138
+        <rdar://problem/8097496>
+
+        Simple fix to stop the rope path of single character replacement
+        once the first replacement occurs.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+
+2010-06-24  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the length of instruction stream controlled by constant pool
+        https://bugs.webkit.org/show_bug.cgi?id=40293
+
+        The initial/maximum length of instruction stream (m_maxDistance) should
+        be set when the first constant arrives to the constant pool. Otherwise
+        the constant pool could be placed into an uninterrupted sequence.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::):
+
+2010-06-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        We assume bytecodeOffset will always return a value > 1,
+        so we adjust the failure case to return 1 instead of 0.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+
+2010-06-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Custom-written JavaScript parser
+        https://bugs.webkit.org/show_bug.cgi?id=34019
+
+        Implement a recursive descent parser similar to that used by V8 and
+        SpiderMonkey.  Greater than 2x improvement in SunSpider parsing tests.
+
+        The parser consists of a JSParser class that uses a TreeBuilder to actually
+        build the AST.  There are currently two builders -- the ASTBuilder and
+        SyntaxChecker which separate the job of building an AST for code generation
+        and simply checking syntactic correctness.
+
+        There's still some less than ideal code remaining in the parser to allow
+        us to retain the existing lexing code with minimal changes.  We'll tidy
+        this up at a later date.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/ASTBuilder.h: Added.
+        (JSC::ASTBuilder::BinaryOpInfo::BinaryOpInfo):
+        (JSC::ASTBuilder::AssignmentInfo::AssignmentInfo):
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::createSourceElements):
+        (JSC::ASTBuilder::varDeclarations):
+        (JSC::ASTBuilder::funcDeclarations):
+        (JSC::ASTBuilder::features):
+        (JSC::ASTBuilder::numConstants):
+        (JSC::ASTBuilder::appendToComma):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegex):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArguments):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createElementList):
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createClause):
+        (JSC::ASTBuilder::createClauseList):
+        (JSC::ASTBuilder::setUsesArguments):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::appendStatement):
+        (JSC::ASTBuilder::addVar):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::evalCount):
+        (JSC::ASTBuilder::appendBinaryExpressionInfo):
+        (JSC::ASTBuilder::operatorStackPop):
+        (JSC::ASTBuilder::operatorStackHasHigherPrecedence):
+        (JSC::ASTBuilder::getFromOperandStack):
+        (JSC::ASTBuilder::shrinkOperandStackBy):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::operatorStackAppend):
+        (JSC::ASTBuilder::popOperandStack):
+        (JSC::ASTBuilder::appendUnaryToken):
+        (JSC::ASTBuilder::unaryTokenStackLastType):
+        (JSC::ASTBuilder::unaryTokenStackLastStart):
+        (JSC::ASTBuilder::unaryTokenStackRemoveLast):
+        (JSC::ASTBuilder::assignmentStackAppend):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::Scope::Scope):
+        (JSC::ASTBuilder::setExceptionLocation):
+        (JSC::ASTBuilder::incConstants):
+        (JSC::ASTBuilder::usesThis):
+        (JSC::ASTBuilder::usesCatch):
+        (JSC::ASTBuilder::usesClosures):
+        (JSC::ASTBuilder::usesArguments):
+        (JSC::ASTBuilder::usesAssignment):
+        (JSC::ASTBuilder::usesWith):
+        (JSC::ASTBuilder::usesEval):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/JSParser.cpp: Added.
+        (JSC::JSParser::AllowInOverride::AllowInOverride):
+        (JSC::JSParser::AllowInOverride::~AllowInOverride):
+        (JSC::JSParser::token):
+        (JSC::JSParser::next):
+        (JSC::JSParser::consume):
+        (JSC::JSParser::match):
+        (JSC::JSParser::tokenStart):
+        (JSC::JSParser::tokenLine):
+        (JSC::JSParser::tokenEnd):
+        (JSC::JSParser::):
+        (JSC::JSParser::autoSemiColon):
+        (JSC::JSParser::canRecurse):
+        (JSC::JSParser::lastTokenEnd):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::allowAutomaticSemicolon):
+        (JSC::JSParser::parseSourceElements):
+        (JSC::JSParser::parseVarDeclaration):
+        (JSC::JSParser::parseConstDeclaration):
+        (JSC::JSParser::parseDoWhileStatement):
+        (JSC::JSParser::parseWhileStatement):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseForStatement):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseThrowStatement):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseSwitchStatement):
+        (JSC::JSParser::parseSwitchClauses):
+        (JSC::JSParser::parseSwitchDefaultClause):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseDebuggerStatement):
+        (JSC::JSParser::parseBlockStatement):
+        (JSC::JSParser::parseStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionBody):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parseExpressionStatement):
+        (JSC::JSParser::parseIfStatement):
+        (JSC::JSParser::parseExpression):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseConditionalExpression):
+        (JSC::isUnaryOp):
+        (JSC::JSParser::isBinaryOperator):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseObjectLiteral):
+        (JSC::JSParser::parseArrayLiteral):
+        (JSC::JSParser::parsePrimaryExpression):
+        (JSC::JSParser::parseArguments):
+        (JSC::JSParser::parseMemberExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h: Added.
+        (JSC::):
+        (JSC::JSTokenInfo::JSTokenInfo):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::setLastLineNumber):
+        (JSC::Lexer::lastLineNumber):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h: Added.
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::createSourceElements):
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::appendToComma):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegex):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArguments):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createElementList):
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::createClause):
+        (JSC::SyntaxChecker::createClauseList):
+        (JSC::SyntaxChecker::setUsesArguments):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::appendStatement):
+        (JSC::SyntaxChecker::addVar):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::evalCount):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/JSGlobalData.h:
+        * wtf/Platform.h:
+        * wtf/ThreadSpecific.h:
+        (WTF::T):
+
+2010-06-23  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Optimization of the QScriptValuePrivate.
+
+        Patch change only internals of the QScriptValuePrivate.
+        Most of the QScriptValuePrivate's attributes were moved
+        into an union.
+
+        [Qt] Optimization of the QScriptVAluePrivate.
+        https://bugs.webkit.org/show_bug.cgi?id=40415
+
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::globalObject):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::~QScriptValuePrivate):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toObject):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::operator JSValueRef):
+        (QScriptValuePrivate::operator JSObjectRef):
+        (QScriptValuePrivate::refinedJSValue):
+
+2010-06-23  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] Implement ThreadSpecific with glib
+        https://bugs.webkit.org/show_bug.cgi?id=39829
+
+        Implement ThreadSpecific with glib's GStaticPrivate.
+        This patch makes it possible to build GTK port without pthread.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+
+2010-06-23  Leandro Pereira  <leandro@profusion.mobi>
+
+        Unreviewed build fix.
+
+        * CMakeLists.txt: Add runtime/RegExpCache.cpp.
+
+2010-06-22  Renata Hodovan  <hodovan@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Adding regular expression caching to JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=38142
+
+        The cache is based on Round Robin eviction policy, and
+        can cache at most 256 character long regular expressions,
+        and at most 256 of them. These values can be changed at compile time.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::regExpCache):
+        * runtime/RegExpCache.cpp: Added.
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        (JSC::RegExpCache::RegExpCache):
+        * runtime/RegExpCache.h: Added.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpKey.h: Added.
+        (JSC::RegExpKey::RegExpKey):
+        (JSC::RegExpKey::getFlagsValue):
+        (WTF::operator==):
+        (WTF::):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+
+2010-06-22  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add native call support for ARM and Thumb-2 JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=40231
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * wtf/Platform.h:
+
+2010-06-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make JSC more resilient in the face of parse failures
+        https://bugs.webkit.org/show_bug.cgi?id=40951
+
+        A number of recent bugs have occurred due to issues like miscounting
+        BOMs, etc which lead to interesting crashes later on.  Adding this
+        logic hardens JSC in the face of these errors, and has no impact on
+        performance (32bit jit actually gets 0.7% faster but I put that down
+        to cache effects).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffset):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::generateJITCodeForCall):
+        (JSC::FunctionExecutable::generateJITCodeForConstruct):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::bytecodeForCall):
+        (JSC::FunctionExecutable::bytecodeForConstruct):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::numericCompareFunction):
+
+2010-06-21  John Sullivan  <sullivan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        RetainPtr can't be used in HashMaps or HashSets
+        <https://bugs.webkit.org/show_bug.cgi?id=40938>
+        
+        Added hashing knowledge similar to that in COMPtr.h.
+
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::RetainPtr):
+        New function, copied from COMPtr.h but for the type change.
+        (WTF::RetainPtr::isHashTableDeletedValue):
+        Ditto.
+        (WTF::RetainPtr::hashTableDeletedValue):
+        Ditto.
+        Added template code for HashTraits and PtrHash copied from COMPtr.h but for the type change.
+        The only difference is that constructDeletedValue() matches the RefPtr implementation (in HashTraits.h)
+        rather than the COMPtr implementation.
+
+2010-06-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Need to ensure that we grow the RegisterFile when creating a callframe for host code
+        https://bugs.webkit.org/show_bug.cgi?id=40858
+        <rdar://problem/8108986>
+
+        In the past the use of the callframe in hostcode was much more
+        limited.  Now that we expect the callframe to always be valid
+        we need to grow the RegisterFile so that this is actually the
+        case.  In this particular case the problem was failing to grow
+        the registerfile could lead to a callframe that extended beyond
+        RegisterFiler::end(), so vm re-entry would clobber the callframe
+        other scenarios could also lead to badness.
+
+        I was unable to construct a simple testcase to trigger badness,
+        and any such testcase would be so dependent on exact vm stack
+        layout that it would be unlikely to work as a testcase following
+        any callframe or register allocation changes anyway.
+
+        Thankfully the new assertion I added should help to catch these
+        failures in future, and triggers on a couple of tests currently.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::registerFile):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-06-21  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Speech Input Patch 0: Added compilation argument to conditionally compile pending patches.
+        https://bugs.webkit.org/show_bug.cgi?id=40878
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-21  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Use global new/delete operator overloading with USE_SYSTEM_MALLOC=1
+        https://bugs.webkit.org/show_bug.cgi?id=40653
+
+        Currently, other ports do not use global new/delete operator overloading
+        when USE_SYSTEM_MALLOC=1. Brew MP uses system malloc, but it needs to enable
+        "global fastMalloc new" because the default new/delete causes crash on device.
+        We need to replace them with Brew MP's MALLOC/FREE.
+
+        * wtf/FastMalloc.h:
+
+2010-06-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Work around a build problem with libjscore on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=40840
+
+        Sbsv2 sometimes have problems with debug/release configuration
+        determination causing QtWebKit in release to try linking with the debug
+        JavaScriptCore static library. This patch limit the jscore/jscored
+        r58306 fix necessary for mac builds only to the mac platform to prevent the
+        different name problem.
+
+        The real fix would be to fix qmake or the toolchain, this patch might
+        help meanwhile.
+
+        * JavaScriptCore.pri:
+
+2010-06-21  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kent Tamura.
+
+        Buildfix after r61338.
+        https://bugs.webkit.org/show_bug.cgi?id=40888
+
+        roundUpAllocationSize is needed in RegisterFile.h.
+
+        * jit/ExecutableAllocator.h:
+
+2010-06-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Include <string.h> in StringExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=40808
+
+        Without string.h, RVCT 2.2 can't compile StringExtras.h.
+        It can't find strlen and strncmp.
+
+        * wtf/StringExtras.h:
+
+2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Don't use __attribute__((may_alias)) with the Intel compiler,
+        as it doesn't understand it.
+
+        * wtf/Vector.h:
+
+2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix compilation with the Intel C++ compiler (11.1.072).
+
+        Like RVCT, label pointers must be void*, not const void*.
+
+        * bytecode/Opcode.h:
+
+2010-06-19  Thiago Macieira <thiago.macieira@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add the WTF_COMPILER_INTEL for when the Intel compiler is used
+        for building. Usually, the Intel compiler masquerades as
+        another compiler in the system and gets away with it, but some
+        times specific fixes are required (such as when using language
+        extensions).
+
+        * wtf/Platform.h:
+
+2010-06-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Incorrect handling of multiple BOMs scattered through a file.
+        https://bugs.webkit.org/show_bug.cgi?id=40865
+
+        When determining the offset of open and close braces in a source
+        with BOMs we were finishing our count early as we failed to account
+        for BOMs prior to the open/close brace positions effecting those
+        positions.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::sourceCode):
+
+2010-06-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Don't throw away exception information for functions that use exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=40786
+
+        Simple patch to stop JSC from throwing away the exception information
+        of a function that uses "exceptiony" features like try and throw.  This
+        is a speed up for catching expressions but it's difficult to quantify as
+        the old cost of reparsing is amortised over all exceptions caught in the
+        effected function.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::emitCatch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitThrow):
+
+2010-06-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add PlatformStrategies and PluginStrategy classes.
+        https://bugs.webkit.org/show_bug.cgi?id=40850
+
+        * wtf/Platform.h:
+
+2010-06-18  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Unreviewed build fix.
+
+        * wtf/CMakeLists.txt: Add MD5.cpp.
+
+2010-06-17  Shu Chang  <chang.shu@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix the link error on symbian with ENABLE_JIT=0.
+        1. Add "#if ENABLE(JIT)" in the header file;
+        2. Put feature enable/disable logic to a common.pri so
+        that both JavaScriptCore.pri and WebCore.pri can share.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40780
+
+        * JavaScriptCore.pri:
+        * jit/ExecutableAllocator.h:
+
+2010-06-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use adoptRef and create functions in more code paths
+        https://bugs.webkit.org/show_bug.cgi?id=40760
+
+        * API/JSClassRef.h: Removed unneeded include of RefCounted.h.
+        * API/JSWeakObjectMapRefPrivate.cpp: Ditto.
+
+        * bytecode/CodeBlock.h:
+        (JSC::FunctionCodeBlock::FunctionCodeBlock): Use the
+        SharedSymbolTable::create function instead of calling new directly.
+
+        * runtime/SymbolTable.h: Added a create function to the SharedSymbolTable
+        class and made the constructor private.
+
+2010-06-17  Mark Brand  <mabrand@mabrand.nl>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] use "win32-g++*" scope to match all MinGW makespecs
+
+        The scope "win32-g++" comes from the name of the makespec. However, it
+        is frequently used to check for MinGW. This works fine as long as
+        win32-g++ is the only makespec for MinGW. Now we need the wildcard
+        to cover "win32-g++-cross" as well.
+
+        * JavaScriptCore.pro:
+
+2010-06-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        Deploy adoptRef in more places, including all HTML and MathML elements
+        https://bugs.webkit.org/show_bug.cgi?id=39941
+
+        * wtf/ThreadSafeShared.h: Made the constructor protected and removed the
+        unneeded support for initial reference counts other than 1.
+
+2010-06-16  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Store matchBegin directly in the array of output instead of the stack.
+        https://bugs.webkit.org/show_bug.cgi?id=38988
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::generate):
+
+2010-06-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make JavaScriptCore build with clang++.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutVirtualRegister):
+        Explicitly cast to an int.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::compileRegex):
+        Return 0 instead of false.
+
+2010-06-15  Adam Roben  <aroben@apple.com>
+
+        Make WebCore's and JavaScriptCore's DerivedSources available for debugging in production builds
+
+        Fixes <http://webkit.org/b/40626> <rdar://problem/8094205>.
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Copy the contents of
+        JavaScriptCore's DerivedSources directory to
+        AppleInternal/Sources/JavaScriptCore.
+
+2010-06-15  Gabor Loki  <loki@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Fix invalid access to non-static data member warning in JITPropertyAccess32_64 on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=40423
+
+        Using OBJECT_OFFSETOF macro instead of objectof to bypass access to
+        non-static data member warning.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2010-06-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename the rest of the *Tokenizer classes to *DocumentParser
+        https://bugs.webkit.org/show_bug.cgi?id=40507
+
+        * wtf/Platform.h:
+         - fixed a comment to match new names.
+
+2010-06-11  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Explicit conversions from QtScript types to JSC opaque types were removed.
+        https://bugs.webkit.org/show_bug.cgi?id=40412
+
+        Conversion between a JSC C types and a QtScript private types, takes
+        main part of the source code. In most cases a mapping between the types
+        is one to one. New cast operators were added to simplify the code.
+
+        The QScriptValuePrivate could be casted to the JSValueRef and the JSObjectRef.
+        The QScriptEnginePrivate could be casted to the JSGlobalContext.
+        The QScriptProgramPrivate could be casted to the JSStringRef.
+
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::evaluate):
+        (QScriptEnginePrivate::newObject):
+        (QScriptEnginePrivate::globalObject):
+        * qt/api/qscriptengine_p.h:
+        (QScriptEnginePrivate::operator JSGlobalContextRef):
+        * qt/api/qscriptprogram_p.h:
+        (QScriptProgramPrivate::operator JSStringRef):
+        * qt/api/qscriptsyntaxcheckresult.cpp:
+        (QScriptSyntaxCheckResultPrivate::~QScriptSyntaxCheckResultPrivate):
+        (QScriptSyntaxCheckResultPrivate::errorMessage):
+        (QScriptSyntaxCheckResultPrivate::errorLineNumber):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::~QScriptValuePrivate):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isBool):
+        (QScriptValuePrivate::isNumber):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isString):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::isFunction):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toObject):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::strictlyEquals):
+        (QScriptValuePrivate::instanceOf):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::operator JSValueRef):
+        (QScriptValuePrivate::operator JSObjectRef):
+        (QScriptValuePrivate::setValue):
+        (QScriptValuePrivate::inherits):
+        (QScriptValuePrivate::refinedJSValue):
+
+2010-05-31  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement the simple text code path.
+        https://bugs.webkit.org/show_bug.cgi?id=40077
+
+        Remove the FONT_FAST_PATH macro and use the Qt's
+        fast text implementation instead of the one of WebKit.
+
+        The Qt::TextBypassShaping flag is used to tell Qt to
+        only use the glyph advances.
+
+        Qt 4.7 is needed to get this flag thus the complex path is always
+        used if QtWebKit is compiled against an earlier version.
+
+        Contrary to the WebKit's implementation, the complex code path
+        is taken if the text is RightToLeft, justified or is formatted
+        with non-zero letter or word spacing.
+
+        * wtf/Platform.h:
+
+2010-06-11  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        add codePointCompare to JavaScriptCore.exp
+        https://bugs.webkit.org/show_bug.cgi?id=40426
+
+        * JavaScriptCore.exp:
+
+2010-06-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Math Javascript Bug on Safari 5 (webkit 533.16) under "32bit" mode
+        https://bugs.webkit.org/show_bug.cgi?id=40367
+
+        If we're in the slow case of right shift we must write the type tag as
+        the only reason we hit this code path is because we know we're working
+        with a double.  eg. we are guaranteed that the tag cannot be reused.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitRightShiftSlowCase):
+
+2010-06-10  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Remove weakRandomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=40291
+
+        weakRandomNumber is used nowhere. Currently, WeakRandom is used instead.
+
+        * wtf/RandomNumber.cpp:
+        * wtf/RandomNumber.h:
+
+2010-06-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Export StringImpl::ascii(). It might be not very useful, but it's a public function.
+
+        * JavaScriptCore.exp:
+
+2010-06-09  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Adam Treat.
+
+        [EFL] Allow building core libraries as shared objects to speed up
+        linking time on machines with small amounts of memory.
+        http://webkit.org/b/39899
+
+        * CMakeLists.txt: If building with shared core, install the lib.
+        * jsc/CMakeListsEfl.txt: Needs Glib and Ecore to link dynamically.
+        * wtf/CMakeLists.txt: If building with shared core, install the lib.
+
+2010-06-09  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by David Levin.
+
+        Remove some unused variable warnings from JITOpcodes
+        https://bugs.webkit.org/show_bug.cgi?id=40298
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+
+2010-05-18  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Fix for Bug 34529 -  [CSSOM] issues with cssText and selectorText
+        Add U16_LENGTH that is needed to implement CSS character serialization.
+        https://bugs.webkit.org/show_bug.cgi?id=34529
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWince.h:
+
+2010-06-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r60830.
+        http://trac.webkit.org/changeset/60830
+        https://bugs.webkit.org/show_bug.cgi?id=40305
+
+        Broke the Windows build (Requested by abarth on #webkit).
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.h: Removed.
+        * wtf/win/OwnPtrWin.h: Removed.
+
+2010-06-08  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed. An attempt to fix test break.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-08  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Change OwnPtrCommon to include platform-specific headers
+        https://bugs.webkit.org/show_bug.cgi?id=40279
+
+        Adding new type to OwnPtrCommon needlessly causes all ports to do full rebuilds.
+        Change OwnPtrCommon to include platform-specific headers to avoid all ports rebuilds.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.h: Added.
+        * wtf/win/OwnPtrWin.h: Added.
+
+2010-06-07  MORITA Hajime  <morrita@google.com>
+        
+        Reviewed by Kent Tamura.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40219
+        [Mac] ENABLE_METER_TAG should be enabled
+        
+        Added ENABLE_METER_TAG.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add more types to OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=39667
+
+        Add ISSL and ISocket to the list of OwnPtr-ed type.
+
+        * wtf/OwnPtrCommon.h:
+        * wtf/brew/OwnPtrBrew.cpp:
+        (WTF::deleteOwnedPtr):
+
+2010-06-07  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Crash when compiling on Snow Leopard and running on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=31403
+
+        Disable the use of pthread_setname_np and other symbols
+        when targetting Leopard.
+
+        Use the defines TARGETING_XX instead of BUILDING_ON_XX 
+        for features that cannot be used before Snow Leopard.
+
+        * wtf/Platform.h:
+
+2010-06-07  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by NOBODY (JSVALUE32_64 build fix).
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+
+2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix pt 2).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix pt 1).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-06-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 40214 - Clean up error construction / throwing in JSC.
+        
+        The one egregious insanity here is that creating an error requires
+        a VM-entry-esqe-host call (the string argument is wrapped as a JS
+        object & pushed on the RegisterFile, then unwrapped back to a
+        UString).  Changing this also means you only require a global
+        object, not an ExecState, to create an error.
+
+        The methods to create error objects are also parameterized
+        requiring a switch on the type, which can be made cleaner and
+        faster by moving to a separate method per error type.  Code to add
+        divot information to error had been duplicated, and is coalesced
+        back into a single function.
+
+        Convenience methods added to create & throw type & syntax error
+        with a default error message, since this is a common case.
+
+        Also, errors are currently thrown either using
+        "throwError(exec, error)" or "exec->setException(error)" - unify
+        on the former, since this is more commonly used.  Add
+        "throwVMError(exec, error)" equivalents, as a convenience for
+        cases where the result was being wrapped in "JSValue::encode(...)".
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeError):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::PostfixErrorNode::emitBytecode):
+        (JSC::PrefixErrorNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        * parser/Nodes.h:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (JSC::createEvalError):
+        (JSC::createRangeError):
+        (JSC::createReferenceError):
+        (JSC::createSyntaxError):
+        (JSC::createTypeError):
+        (JSC::createURIError):
+        (JSC::addErrorSourceInfo):
+        (JSC::addErrorDivotInfo):
+        (JSC::addErrorInfo):
+        (JSC::hasErrorInfo):
+        (JSC::throwError):
+        (JSC::throwTypeError):
+        (JSC::throwSyntaxError):
+        * runtime/Error.h:
+        (JSC::throwVMError):
+        (JSC::throwVMTypeError):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructWithErrorConstructor):
+        (JSC::callErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createStackOverflowError):
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compile):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::from):
+        * runtime/Identifier.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSObject.cpp:
+        (JSC::throwSetterError):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        (JSC::JSValue::synthesizePrototype):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::constructWithNativeErrorConstructor):
+        (JSC::callNativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToString):
+
+2010-06-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        [BREWMP] Add PLATFORM(BREWMP) guard for using std::xxx
+        https://bugs.webkit.org/show_bug.cgi?id=39710
+
+        Build fix for BREW MP.
+
+        * wtf/MathExtras.h:
+
+2010-06-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTML5 parser should be within 1% of old parser performance
+        https://bugs.webkit.org/show_bug.cgi?id=40172
+
+        Fix cast in this operator= to allow for assignment between vectors with
+        different inline capacities (as clearly intended by its author).
+
+        * wtf/Vector.h:
+        (WTF::::operator):
+
+2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        New QtScript API; QScriptValue::instanceOf.
+
+        New function create an easy way to check value's prototype hierarchy.
+
+        [Qt] QScriptValue should have an instanceOf method
+        https://bugs.webkit.org/show_bug.cgi?id=40120
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::instanceOf):
+        * qt/api/qscriptvalue.h:
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::instanceOf):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp:
+        (tst_QScriptValue::instanceOf_initData):
+        (tst_QScriptValue::instanceOf_makeData):
+        (tst_QScriptValue::instanceOf_test):
+
+2010-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (interpreter build fix).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-06-04  Mark Rowe  <mrowe@apple.com>
+
+        Silence some warnings seen on the build bot.
+
+        * JavaScriptCore.JSVALUE32_64only.exp: Add a trailing newline.
+        * JavaScriptCore.JSVALUE32only.exp: Ditto.
+        * JavaScriptCore.JSVALUE64only.exp: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Remove the .exp files from all targets so that Xcode doesn't
+        complain about not knowing how to compile them.
+
+2010-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 40187 - Change function signature of NativeConstructor to match NativeFunction
+
+        Mostly for consistency, but constructor & args arguments are redundant,
+        and this will help if we wish to be able to JIT calls to more constructors.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::construct):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeConstruct):
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructWithArrayConstructor):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructWithBooleanConstructor):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructWithDateConstructor):
+        * runtime/Error.cpp:
+        (JSC::constructNativeError):
+        (JSC::Error::create):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructWithErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructWithFunctionConstructor):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::constructWithNativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::errorStructure):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructWithObjectConstructor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructWithRegExpConstructor):
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+
+2010-06-04  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a takeFirst() method to Deque and use it where appropriate.
+        https://bugs.webkit.org/show_bug.cgi?id=40089
+
+        * wtf/Deque.h:
+        (WTF::::takeFirst):
+        * wtf/MainThread.cpp:
+        (WTF::dispatchFunctionsFromMainThread):
+        * wtf/MessageQueue.h:
+        (WTF::::tryGetMessage):
+
+2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove a QEXPECT_FAIL flag from an autotest.
+
+        Test tst_QScriptEngine::globalObject pass after 36600 bug
+        fix have been applied.
+
+        [Qt] Expected fail in the tst_QScriptEngine::globalObject should be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=40114
+
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::globalObject):
+
+2010-06-04  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix QScriptValue::equals.
+
+        Handling for a few edge cases were added. Now comparison between
+        NaN, an invalid objects should works as supposed.
+
+        [Qt] QScriptValue::equals problems
+        https://bugs.webkit.org/show_bug.cgi?id=40110
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::equals):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::equals):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp:
+        (tst_QScriptValue::equals_initData):
+        (tst_QScriptValue::equals_makeData):
+        (tst_QScriptValue::equals_test):
+
+2010-06-03  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        New states in QScriptValuePrivate.
+
+        The CSpecial state was divided into CNull and CUndefined. It simplify
+        the QScriptValue code by avoiding a few "cast" and "if".
+        Moreover the MSVS compiler didn't like casting between a double and an
+        enum which is avoided now.
+
+        [Qt] The QScriptValuePrivate::CSpecial is too generic.
+        https://bugs.webkit.org/show_bug.cgi?id=40067
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::):
+        (QScriptValuePrivate::QScriptValuePrivate):
+        (QScriptValuePrivate::isNull):
+        (QScriptValuePrivate::isUndefined):
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toBool):
+        (QScriptValuePrivate::toObject):
+        (QScriptValuePrivate::assignEngine):
+        (QScriptValuePrivate::isNumberBased):
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Qt build fix).
+
+        * wtf/Platform.h:
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 40150 - ENABLE_JIT_OPTIMIZE_NATIVE_CALL on all x86/x86_64 platforms
+        This was fixed in bug #40094.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Platform.h:
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (Interpreter build fix).
+
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE32only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix II).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (windows build fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-06-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 40094 - The return type of NativeFunction should be EncodedJSValue
+        On Windows & Linux, using JSVALUE32_64, EncodedJSValue is returned in registers, but JSValue is not.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        * JavaScriptCore.exp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeCall):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+        (functionReadline):
+        (functionQuit):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSCell.h:
+        (JSC::getCallData):
+        (JSC::getConstructData):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSObject.cpp:
+        (JSC::callDefaultValueFunction):
+        * runtime/JSValue.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::callObjectConstructor):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpObject.cpp:
+        (JSC::callRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::stringProtoFuncTrim):
+        (JSC::stringProtoFuncTrimLeft):
+        (JSC::stringProtoFuncTrimRight):
+
+2010-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add value-representation specific sections to the mac export file.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.JSVALUE32_64only.exp: Added.
+        * JavaScriptCore.JSVALUE32only.exp: Added.
+        * JavaScriptCore.JSVALUE64only.exp: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/8054988> Work around an LLVM GCC code generation bug that results in crashes inside PCRE.
+
+        * pcre/pcre_exec.cpp:
+        (repeatInformationFromInstructionOffset): Change the type of instructionOffset to int.  There's no good
+        reason for it to be a short, and using int prevents this code from triggering the LLVM GCC bug.
+
+2010-06-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fix the QScriptValue::strictlyEquals function.
+
+        Handling for a few edge cases was added.
+
+        New autotest that covers the QScriptValue::strictlyEquals function.
+
+        [Qt] QScriptValue::strictlyEquals is broken
+        https://bugs.webkit.org/show_bug.cgi?id=36600
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::strictlyEquals):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::strictlyEquals):
+        * qt/tests/qscriptvalue/qscriptvalue.pro:
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp: Added.
+        (tst_QScriptValue::strictlyEquals_initData):
+        (tst_QScriptValue::strictlyEquals_makeData):
+        (tst_QScriptValue::strictlyEquals_test):
+
+2010-06-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        New function QScriptEngine::newObject.
+
+        The function creates a object of class Object and returns it
+        as a QScriptValue.
+
+        [Qt] QScriptEngine API should contain a newObject function
+        https://bugs.webkit.org/show_bug.cgi?id=39114
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::newObject):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::newObject):
+        * qt/api/qscriptengine_p.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::newObject):
+
+2010-06-02  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+        https://bugs.webkit.org/show_bug.cgi?id=40011
+
+        Thumb-2 build fix: The offset parameter of ldrh should be encoded as an
+        imm12 immediate constant in load16. If it is not fit in the instruction
+        a temporary register has to be used.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load16):
+
+2010-06-02  Sterling Swigart  <sswigart@google.com>
+
+        Reviewed by David Levin.
+
+        Image Resizer Patch 0: Added compilation argument to conditionally compile pending patches.
+        https://bugs.webkit.org/show_bug.cgi?id=39906
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 40021 - Refactor bytecode generation for calls so that register for this & args are allocated together
+
+        This is a useful stepping stone towards reversing argument order.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addParameter):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::thisRegister):
+        (JSC::CallArguments::argumentRegister):
+        (JSC::CallArguments::callFrame):
+        (JSC::CallArguments::count):
+        (JSC::BytecodeGenerator::shouldEmitProfileHooks):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::CallArguments::CallArguments):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2010-06-01  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Explicitly use PTHREAD_MUTEX_NORMAL to create pthread mutex.
+        https://bugs.webkit.org/show_bug.cgi?id=39893
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::Mutex::Mutex):
+
+2010-06-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Use DEFINE_STATIC_LOCAL for threadMapMutex and threadMap
+        https://bugs.webkit.org/show_bug.cgi?id=39831
+
+        Use DEFINE_STATIC_LOCAL for static local variables.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+
+2010-06-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Fix style errors of dtoa
+        https://bugs.webkit.org/show_bug.cgi?id=39972
+
+        Fix all errors reported by check-webkit-style.
+
+        * wtf/dtoa.cpp:
+        * wtf/dtoa.h:
+
+2010-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/OwnArrayPtr.h:
+        (WTF::OwnArrayPtr::set): Fix the assertion in here to match the one in OwnPtr.
+        At some point someone fixed the "asserts when assigning to 0 and the pointer is
+        already 0" issue in OwnPtr but forgot to do it here.
+
+2010-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Updated exported symbols.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Disabled ENABLE_JIT_OPTIMIZE_NATIVE_CALL on Windows for now, until I
+        can figure out why it's crashing.
+
+        * wtf/Platform.h:
+
+2010-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed Windows crash seen on buildbot.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): __fastcall puts the first
+        argument in ecx.
+
+2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Updated exported symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: disable a little more stuff when JIT_OPTIMIZE_NATIVE_CALL
+        is disabled.
+
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        * wtf/Platform.h:
+
+2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Updated exported symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-05-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig, Gavin Barraclough, Oliver Hunt.
+
+        Simplified the host calling convention.
+        
+        22.5% speedup on 32-bit host function calls. 9.5% speedup on 64-bit host
+        function calls.
+        
+        No change on SunSpider.
+        
+        All JS calls (but not constructs, yet) now go through the normal JS
+        calling convention via the RegisterFile. As a result, the host calling
+        convention, which used to be this
+
+            JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*, JSObject*, JSValue thisValue, const ArgList&)
+            
+        is now this
+
+            JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*)
+            
+        Callee, 'this', and argument access all hapen relative to the ExecState*,
+        which is a pointer into the RegisterFile.
+        
+        This patch comes in two parts.
+        
+        PART ONE: Functional code changes.
+        
+        * wtf/Platform.h: Disabled optimized calls on platforms I didn't test.
+        We can re-enable once we verify that host calls on these platforms are
+        correct.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::calculatedFunctionName): Updated for change to
+        ExecState::callee().
+
+        (JSC::DebuggerCallFrame::thisObject): Updated for removal of ExecState::thisValue().
+
+        * interpreter/CallFrame.cpp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callee):
+        (JSC::ExecState::scopeChain):
+        (JSC::ExecState::init): Changed callee() to be JSObject* instead of
+        JSFunction* -- now, it might be some other callable host object.
+
+        (JSC::ExecState::hostThisRegister):
+        (JSC::ExecState::hostThisValue):
+        (JSC::ExecState::argumentCount):
+        (JSC::ExecState::argumentCountIncludingThis):
+        (JSC::ExecState::argument):
+        (JSC::ExecState::setArgumentCountIncludingThis):
+        (JSC::ExecState::setCallee): Added convenient accessors for arguments
+        from within a host function. Removed thisValue() because it was too
+        tempting to use incorrectly, and it only had one or two clients, anyway.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval): Updated for removal of ExecState::thisValue().
+
+        (JSC::Interpreter::throwException): Be sure to shrink the register file
+        before invoking the exception handler, to reduce the chances that the
+        handler will re-throw in the case of stack overflow. (Re-throwing is now
+        more likely than it used to be, since standardizing the calling convention
+        implicitly added stack overflow checks to some places where they used to be missing.)
+
+        (JSC::Interpreter::execute): Clarified the scope of DynamicGlobalObjectScope.
+        Updated for CallFrame::init API change.
+
+        (JSC::Interpreter::executeCall): Clarified scope of DynamicGlobalObjectScope.
+        Updated for CallFrame::init API change. Added support for calling a host
+        function.
+
+        (JSC::Interpreter::executeConstruct): Clarified scope of DynamicGlobalObjectScope.
+        Updated for CallFrame::init API change. 
+
+        (JSC::Interpreter::prepareForRepeatCall): Updated for CallFrame::init API change. 
+
+        (JSC::Interpreter::privateExecute): Updated for CallFrame::init API change.
+        Added some explicit JSValue(JSObject*) initialization, since relaxing
+        the JSFunction* restriction on callee has made register types more ambiguous.
+        Removed toThisObject() conversion, since all callees do it themselves now.
+        Updated host function call for new host function signature. Updated for
+        change to ExecState::argumentCount() API.
+
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::operator=):
+        (JSC::Register::function): Changed callee() to be JSObject* instead of
+        JSFunction* -- now, it might be some other callable host object.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): Deleted a bunch of code that
+        set up the arguments to host functions -- all but one of the arguments
+        are gone now. This is the actual optimization.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Updated for ExecState and Register API
+        changes noted above. Removed toThisObject() conversion, since all callees
+        do it themselves now.
+        
+        * runtime/ArgList.h:
+        (JSC::ArgList::ArgList): ArgList is getting close to unused. Added a
+        temporary shim for converting from ExecState* to ArgList where it's still
+        necessary.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments): Updated for ExecState and Register API
+        changes noted above. 
+
+        * runtime/CallData.cpp:
+        (JSC::call): Changed call always to call Interpreter::executeCall, even
+        for host functions. This ensures that the normal calling convention is
+        set up in the RegsiterFile when calling from C++ to host function.
+
+        * runtime/CallData.h: Changed host function signature as described above.
+
+        * runtime/ConstructData.cpp:
+        (JSC::construct): Moved JSFunction::construct code here so I could nix
+        JSFunction::call and JSFunction::call. We want a JSFunction-agnostic
+        way to call and construct, so that everything works naturally for non-
+        JSFunction objects. 
+
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSFunction.h: Updated for ExecState and Register API changes
+        noted above. Nixed JSFunction::call and JSFunction::construct, noted above.
+ 
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Ditto.
+
+        PART TWO: Global search and replace.
+        
+        In the areas below, I used global search-and-replace to change
+            (ExecState*, JSObject*, JSValue, const ArgList&) => (ExecState*)
+            args.size() => exec->argumentCount()
+            args.at(i) => exec->argument(i)
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        * JavaScriptCore.exp:
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+        (functionReadline):
+        (functionQuit):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSString.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::callObjectConstructor):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::exec):
+        (JSC::callRegExpObject):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::stringProtoFuncTrim):
+        (JSC::stringProtoFuncTrimLeft):
+        (JSC::stringProtoFuncTrimRight):
+
+2010-05-28  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix the JSObjectSetPrototype function.
+
+        A cycle in a prototype chain can cause an application hang or
+        even crash.
+        A check for a prototype chain cycles was added to
+        the JSObjectSetPrototype.
+
+        JSObjectSetPrototype doesn't check for cycle in prototype chain.
+        https://bugs.webkit.org/show_bug.cgi?id=39360
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrototype):
+        * API/tests/testapi.c:
+        (assertTrue):
+        (checkForCycleInPrototypeChain):
+        (main):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/JSObject.h:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+
+2010-05-28  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix MIPS JIT DoubleGreaterThanOrEqual Operands
+        https://bugs.webkit.org/show_bug.cgi?id=39504
+
+        Swapped two operands of left and right for DoubleGreaterThanOrEqual.
+        This patch fixed two layout tests as follows.
+        fast/js/comparison-operators-greater.html
+        fast/js/comparison-operators-less.html
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchDouble):
+
+2010-05-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move jit compilation from linking thunks into cti_vm_lazyLink methods.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-05-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 39898 - Move arity check into callee.
+        
+        We can reduce the size of the virtual call trampolines by moving the arity check
+        into the callee functions.  As a following step we will be able to remove the
+        check for native function / codeblocks by performing translation in a lazy stub.
+        
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        (JSC::ExecState::setReturnPC):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::generateJITCodeForCall):
+        (JSC::FunctionExecutable::generateJITCodeForConstruct):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::FunctionExecutable::generatedJITCodeForCallWithArityCheck):
+        (JSC::FunctionExecutable::generatedJITCodeForConstructWithArityCheck):
+
+2010-05-27  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Darin Adler.
+
+        UTF-16 code points compare() for String objects
+        https://bugs.webkit.org/show_bug.cgi?id=39701
+
+        Moving compare() implementation from UString to StringImpl for it to be shared
+        with String. Adding overloaded free functions codePointCompare() in StringImpl
+        and WTFString. Renaming function compare in UString to codePointCompare to be
+        consistent.
+
+        * runtime/JSArray.cpp:
+        (JSC::compareByStringPairForQSort):
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::codePointCompare):
+        * wtf/text/StringImpl.cpp:
+        (WebCore::codePointCompare):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.cpp:
+        (WebCore::codePointCompare):
+        * wtf/text/WTFString.h:
+
+2010-05-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kent Tamura.
+
+        Null characters handled incorrectly in ToNumber conversion
+        https://bugs.webkit.org/show_bug.cgi?id=38088
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt): Changed code to use UTF8String().data() instead of
+        ascii() to fix the thread safety issue. Code path is covered by existing
+        tests in run-javascriptcore-tests.
+        (JSC::parseFloat): Moved comment to UString::toDouble since the issue
+        affects all clients, not just parseFloat. Specifically, this also affects
+        standard JavaScript numeric conversion, ToNumber.
+
+        * runtime/UString.cpp:
+        (JSC::UString::toDouble): Added a comment about incorrect space skipping.
+        Changed trailing junk check to use the length of the CString instead of
+        checking for a null character. Also got rid of a little unneeded logic
+        in the case where we tolerate trailing junk.
+
+2010-05-27  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Search for the new allocation one word at a time.  Improves
+        performance on SunSpider by approximately 1%.
+        http://bugs.webkit.org/show_bug.cgi?id=39758
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocate):
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::advanceToNextPossibleFreeCell):
+
+2010-05-27  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fixes for Windows after recent changes.
+
+        * wscript:
+
+2010-05-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        More build fixage for make dist.
+
+        * GNUmakefile.am:
+
+2010-05-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        RVCT does not have strnstr.
+        https://bugs.webkit.org/show_bug.cgi?id=39719
+
+        Add COMPILER(RVCT) guard to strnstr in StringExtras.h as RVCT does not provide strnstr.
+
+        * wtf/StringExtras.h:
+
+2010-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 39795 - Add support for YARR JIT generation of greedy quantified parens at the end of the main disjunction.
+        (relanding r60267)
+
+        If the last item in a main disjunction is a quantified set of parentheses,
+        this is easier to code generate for than the general case for quantified
+        parentheses. This is because we never need to backtrack into the parentheses
+        - the first match will be the final and accepted match.
+
+        This patch also somewhat reverts a recent change to when fallback to PCRE
+        occurs. At the minute the compiler is tracking on patterns which will
+        require JIT fallback. This is handy from a performance perspective (it saves
+        the failed attempt at JIT compilation), but it means introducing knowledge
+        of the JITs capabilities into the other layers of the regex compilers. For
+        the specific feature of back-references, add a flag tracking their presence
+        on the pattern, and make these expressions fallback without attempting to
+        JIT. For parentheses, return to detecting which cases are have or have not
+        been handled during JIT compilation.
+
+        18% progression on tagcloud, ~1.5% overall on sunspidey.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isMainDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::shouldFallBack):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (revert).
+
+        Temporarily rolling out r60267, I appear to have hoesed perf at the last minute. :-/ Fixing.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::term):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-05-26  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fixes for make distcheck.
+
+        * GNUmakefile.am:
+
+2010-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 39795 - Add support for YARR JIT generation of greedy quantified parens at the end of the main disjunction.
+
+        If the last item in a main disjunction is a quantified set of parentheses,
+        this is easier to code generate for than the general case for quantified
+        parentheses. This is because we never need to backtrack into the parentheses
+        - the first match will be the final and accepted match.
+
+        This patch also somewhat reverts a recent change to when fallback to PCRE
+        occurs. At the minute the compiler is tracking on patterns which will
+        require JIT fallback. This is handy from a performance perspective (it saves
+        the failed attempt at JIT compilation), but it means introducing knowledge
+        of the JITs capabilities into the other layers of the regex compilers. For
+        the specific feature of back-references, add a flag tracking their presence
+        on the pattern, and make these expressions fallback without attempting to
+        JIT. For parentheses, return to detecting which cases are have or have not
+        been handled during JIT compilation.
+
+        18% progression on tagcloud, ~1.5% overall on sunspidey.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isLastTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isMainDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesGreedyNoBacktrack):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::shouldFallBack):
+        (JSC::Yarr::jitCompileRegex):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+
+2010-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed a crash seen on the Leopard bot, caused by merge.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Get the return address from the callframe,
+        since it's no longer passed to us as an argument.
+
+2010-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed build failure caused by merge.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): On error, return a single value, since this
+        function no longer returns a pair.
+
+2010-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/8020221>
+        
+        Fixed a crash seen on Windows when calling a function with too many
+        arguments.
+        
+        SunSpider reports no change.
+        
+        No test because the ASSERT I added fires in existing tests.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Make sure to grow the registerFile when too
+        many arguments have been provided, since the caller only allocated enough
+        registerFile space for the arguments it provided, not enough for the extra
+        copy of arguments we're going to need.
+
+2010-05-25  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Build fix for JSFunction
+        https://bugs.webkit.org/show_bug.cgi?id=39658
+
+        MSVC can't compile one of JSFunction constructors when JIT is disabled.
+        "PassRefPtr<NativeExecutable>" causes the compile error as NativeExecutable is not defined. 
+        Add ENABLE(JIT) guard to the constructor.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+
+2010-05-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 39643 - Clean up code generation in the JIT of stub function calls for op_call.
+
+        Presently, as soon as op-call strays off the hot path we set up a set of values on
+        the stack to be passed as arguments to cti functions, in case any should be called.
+
+        Instead, hoist the setup of the callframe to happen slightly sooner, and make the
+        cti functions to compile & check arity read these values from the callframe. This
+        allows up to remove the deprecated methods to manually set up cti arguments, rather
+        than using JITStubCall.h.
+
+        * interpreter/CallFrame.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2010-05-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+        Relanding r60075.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitGetByIdExceptionInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiNativeConstruct):
+        (JSC::):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        * runtime/JSFunction.h:
+        * wtf/Platform.h:
+
+== Rolled over to ChangeLog-2010-05-24 ==
diff --git a/ChangeLog-2012-05-22 b/ChangeLog-2012-05-22
new file mode 100644
index 0000000..2b3dee1
--- /dev/null
+++ b/ChangeLog-2012-05-22
@@ -0,0 +1,70902 @@
+2012-05-22  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] getPlatformThreadRegisters() should fetch target thread's registers
+        https://bugs.webkit.org/show_bug.cgi?id=87148
+
+        Reviewed by George Staikos.
+
+        Our previous implementation of getPlatformThreadRegisters() read registers in current
+        thread's context but it is supposed to read the target thread's registers.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::getPlatformThreadRegisters):
+
+2012-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support reflective arguments access
+        https://bugs.webkit.org/show_bug.cgi?id=85721
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r116345 from dfgopt.
+        
+        This adds support for op_create_arguments to the DFG. No other arguments-related
+        opcodes are added by this change, though it does add a lot of the scaffolding
+        necessary for the other ops.
+        
+        This also adds GetByVal/PutByVal optimizations for Arguments.
+        
+        Finally, this rationalizes slowPathCall with no return. Previously, that would
+        work via callOperation() overloads that took InvalidGPRReg as the return GPR.
+        But that creates awful ambiguity, since we had template functions that were
+        polymorphic over all parameters except the second, which was a GPRReg, and a
+        bunch of non-template overloads that also potentially had GPRReg as the second
+        argument. I finally started to hit this ambiguity and was getting absolutely
+        bizarre compiler errors, that made me feel like I was programming in SML. So,
+        I changed the no-argument overloads to take NoResultTag instead, which made
+        everything sensible again by eliminating the overload ambiguity.
+        
+        This is a ~7% speed-up on V8/earley and neutral elsewhere.
+
+        * bytecode/PredictedType.h:
+        (JSC::isArgumentsPrediction):
+        (JSC):
+        (JSC::isActionableMutableArrayPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGCommon.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::unmodifiedArgumentsRegister):
+        (Node):
+        (JSC::DFG::Node::shouldSpeculateArguments):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentSpillAllRegistersImpl):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::pickCanTrample):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Arguments.h:
+        (ArgumentsData):
+        (Arguments):
+        (JSC::Arguments::offsetOfData):
+
+2011-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        GC allocation trigger should be tuned to system RAM
+        https://bugs.webkit.org/show_bug.cgi?id=87039
+
+        Reviewed by Darin Adler.
+
+        This helps avoid OOM crashes on small platforms, and helps avoid "too much GC"
+        performance issues on big platforms.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (Heap): GC balances between a fixed minimum and a proportional multiplier,
+        which are limited based on system RAM.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createContextGroup):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::createLeaked):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): Renamed HeapSize to HeapType because the exact size is
+        influenced by the heap type, but not determined by it.
+
+2012-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Disable private names by default in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=87088
+
+        Reviewed by Geoff Garen.
+
+        r117859 introduced a preliminary implementation of ES6-like private name objects to JSC.
+        These are probably not yet ready to be web-facing, so disabling by default in WebCore.
+        Opting-in for JSC & DumpRenderTree so that we can still run the fast/js/names.html test.
+
+        * jsc.cpp:
+        (GlobalObject):
+        (GlobalObject::javaScriptExperimentsEnabled):
+            - Implemented new trap to opt-in to private names support.
+        * runtime/JSGlobalObject.cpp:
+        (JSC):
+        (JSC::JSGlobalObject::reset):
+            - Only add the Name property to the global object if experiments are enabled.
+        * runtime/JSGlobalObject.h:
+        (GlobalObjectMethodTable):
+            - Added new trap to enabled experiments.
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::finishCreation):
+            - Set the global object's m_experimentsEnabled state on construction.
+        (JSC::JSGlobalObject::javaScriptExperimentsEnabled):
+            - Defaults to off.
+
+2012-05-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Truncating multiplication on integers should not OSR exit every time
+        https://bugs.webkit.org/show_bug.cgi?id=85752
+
+        Reviewed by Gavin Barraclough.
+        
+        Merge r116264 from dfgopt.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::mulShouldSpeculateInteger):
+        (Graph):
+        (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+
+2012-05-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        DFG should be able to compute dominators
+        https://bugs.webkit.org/show_bug.cgi?id=85269
+
+        Unreviewed trivial 32 bit buildfix after r117861.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+
+2012-05-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to compute dominators
+        https://bugs.webkit.org/show_bug.cgi?id=85269
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r115754 from dfgopt.
+        
+        Implements a naive dominator calculator, which is currently just used to
+        print information in graph dumps. I've enabled it by default mainly to
+        be able to track its performance impact. So far it appears that there is
+        none, which is unsurprising given that the number of basic blocks in most
+        procedures is small.
+        
+        Also tweaked bytecode dumping to reveal more useful information about the
+        nature of the code block.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * dfg/DFGDominators.cpp: Added.
+        (DFG):
+        (JSC::DFG::Dominators::Dominators):
+        (JSC::DFG::Dominators::~Dominators):
+        (JSC::DFG::Dominators::compute):
+        (JSC::DFG::Dominators::iterateForBlock):
+        * dfg/DFGDominators.h: Added.
+        (DFG):
+        (Dominators):
+        (JSC::DFG::Dominators::invalidate):
+        (JSC::DFG::Dominators::computeIfNecessary):
+        (JSC::DFG::Dominators::isValid):
+        (JSC::DFG::Dominators::dominates):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (Graph):
+
+2012-05-21  Michael Saboff  <msaboff@apple.com>
+
+        Cleanup of Calls to operationStrCat and operationNewArray and Use Constructor after r117729
+        https://bugs.webkit.org/show_bug.cgi?id=87027
+
+        Reviewed by Oliver Hunt.
+
+        Change calls to operationStrCat and operationNewArray to provide the
+        pointer to the EncodedJSValue* data buffer instead of the ScratchBuffer
+        that contains it.  Added a ScratchBuffer::create() function.
+        This is a clean-up to r117729.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSGlobalData.h:
+        (JSC::ScratchBuffer::create):
+        (JSC::ScratchBuffer::dataBuffer):
+        (JSC::JSGlobalData::scratchBufferForSize):
+
+2012-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Add support for private names
+        https://bugs.webkit.org/show_bug.cgi?id=86509
+
+        Reviewed by Oliver Hunt.
+
+        The spec isn't final, but we can start adding support to allow property maps
+        to contain keys that aren't identifiers.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::getStaticValue):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+            - Only expose public named properties over the JSC API.
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+            - Added new files to build system.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+            - Added support for property access with name objects.
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::privateNamePrototypeTable):
+            - Added hash table for NamePrototype
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            - Added support for property access with name objects.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Added support for property access with name objects.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+            - Added support for property access with name objects.
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+            - Added hash table for NamePrototype
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::privateNameStructure):
+        (JSC::JSGlobalObject::symbolTableHasProperty):
+            - Added new global properties.
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::isName):
+            - Added type for NameInstances, for fast isName check.
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::deleteProperty):
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTableGet):
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+            - symbol table lookup should take a PropertyName.
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+            - entry lookup should take a PropertyName.
+        * runtime/NameConstructor.cpp: Added.
+        (JSC):
+        (JSC::NameConstructor::NameConstructor):
+        (JSC::NameConstructor::finishCreation):
+        (JSC::constructPrivateName):
+        (JSC::NameConstructor::getConstructData):
+        (JSC::NameConstructor::getCallData):
+        * runtime/NameConstructor.h: Added.
+        (JSC):
+        (NameConstructor):
+        (JSC::NameConstructor::create):
+        (JSC::NameConstructor::createStructure):
+            - Added constructor.
+        * runtime/NameInstance.cpp: Added.
+        (JSC):
+        (JSC::NameInstance::NameInstance):
+        (JSC::NameInstance::destroy):
+        * runtime/NameInstance.h: Added.
+        (JSC):
+        (NameInstance):
+        (JSC::NameInstance::createStructure):
+        (JSC::NameInstance::create):
+        (JSC::NameInstance::privateName):
+        (JSC::NameInstance::nameString):
+        (JSC::NameInstance::finishCreation):
+        (JSC::isName):
+            - Added instance.
+        * runtime/NamePrototype.cpp: Added.
+        (JSC):
+        (JSC::NamePrototype::NamePrototype):
+        (JSC::NamePrototype::finishCreation):
+        (JSC::NamePrototype::getOwnPropertySlot):
+        (JSC::NamePrototype::getOwnPropertyDescriptor):
+        (JSC::privateNameProtoFuncToString):
+        * runtime/NamePrototype.h: Added.
+        (JSC):
+        (NamePrototype):
+        (JSC::NamePrototype::create):
+        (JSC::NamePrototype::createStructure):
+            - Added prototype.
+        * runtime/PrivateName.h: Added.
+        (JSC):
+        (PrivateName):
+        (JSC::PrivateName::PrivateName):
+        (JSC::PrivateName::uid):
+            - A private name object holds a StringImpl that can be used as a unique key in a property map.
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::findWithString):
+            - Strings should only match keys in the table that are identifiers.
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+        (PropertyName):
+        (JSC::PropertyName::uid):
+        (JSC::PropertyName::publicName):
+        (JSC::PropertyName::asIndex):
+        (JSC::operator==):
+        (JSC::operator!=):
+            - replaced impl() & ustring() with uid() [to get the raw impl] and publicName() [impl or null, if not an identifier].
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+            - call uid() to get a PropertyName raw impl, for use as a key.
+
+2012-04-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Bytecode dumps should contain data about the state of get_by_id caches
+        https://bugs.webkit.org/show_bug.cgi?id=85246
+
+        Reviewed by Gavin Barraclough.
+        
+        Merge r115694 from dfgopt.
+        
+        Changed the DFG bytecode parser (and the code that calls it) to be able
+        to call codeBlock->dump() on the code blocks being parsed.
+        
+        Changed bytecode dumping to be able to print the state of get_by_id
+        caches inline with the bytecode.
+        
+        Removed the old StructureStubInfo dumping code, which no longer worked
+        right, and was incapable of telling us information about chain and list
+        accesses.
+        
+        This change does not add dumping for put_by_id caches. We can add that
+        at a later time.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::dumpStructure):
+        (JSC):
+        (JSC::dumpChain):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::printGlobalResolveInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::visitStructures):
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::jitCompile):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::parse):
+        * dfg/DFGByteCodeParser.h:
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h:
+        (DFG):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+
+2012-05-21  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header files.
+
+2012-05-21  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        GCC 4.7 and C++11
+        https://bugs.webkit.org/show_bug.cgi?id=86465
+
+        Reviewed by Darin Adler.
+
+        Set emptyValueIsZero flag so RegExpKey can be used with the non-copyable RegExp values.
+
+        * runtime/RegExpKey.h:
+
+2012-05-20  Michael Saboff  <msaboff@apple.com>
+
+        JSGlobalData ScratchBuffers Are Not Visited During Garbage Collection
+        https://bugs.webkit.org/show_bug.cgi?id=86553
+
+        Reviewed by Gavin Barraclough.
+
+        Scratch buffers can contain the only reference to live objects.
+        Therefore visit scratch buffer contents as conservative roots.
+        Changed the scratch buffers to be a struct with an "active"
+        length and the actual buffer.  The users of the scratch
+        buffer emit code where needed to set and clear the active
+        length as appropriate.  During marking, the active count is
+        used for conservative marking.
+
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::gatherConservativeRoots):
+        * runtime/JSGlobalData.h:
+        (JSC::ScratchBuffer::ScratchBuffer):
+        (ScratchBuffer):
+        (JSC::ScratchBuffer::allocationSize):
+        (JSC::ScratchBuffer::setActiveLength):
+        (JSC::ScratchBuffer::activeLength):
+        (JSC::ScratchBuffer::activeLengthPtr):
+        (JSC::ScratchBuffer::dataBuffer):
+        (JSGlobalData):
+        (JSC::JSGlobalData::scratchBufferForSize):
+
+2012-05-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Predicted types should know about arguments
+        https://bugs.webkit.org/show_bug.cgi?id=85165
+
+        Reviewed by Oliver Hunt.
+        
+        Merge r115604 from dfgopt.
+
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionToAbbreviatedString):
+        (JSC::predictionFromClassInfo):
+        * bytecode/PredictedType.h:
+        (JSC):
+        (JSC::isMyArgumentsPrediction):
+        (JSC::isArgumentsPrediction):
+
+2012-05-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Bytecompiler should emit trivially fewer jumps in loops
+        https://bugs.webkit.org/show_bug.cgi?id=85144
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r115587 from dfgopt.
+        
+        1-2% across the board win.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+
+2012-05-19  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Windows build broken due to changes in the http://trac.webkit.org/changeset/117646
+        https://bugs.webkit.org/show_bug.cgi?id=86939
+
+        The changeset 117646 changed the JSString::toBoolean signature. This
+        change is for fixing the windows build break.
+
+        Reviewed by Ryosuke Niwa.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(117646): fast/canvas/webgl/glsl-conformance.html is crashing in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=86929
+
+        Reviewed by Oliver Hunt.
+        
+        The problem was that if CFG simplification saw a Branch with identical successors,
+        it would always perform a basic block merge. But that's wrong if the successor has
+        other predecessors.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+
+2012-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFG simplification crashes if it's trying to remove an unreachable block
+        that has an already-killed-off unreachable successor
+        https://bugs.webkit.org/show_bug.cgi?id=86918
+
+        Reviewed by Oliver Hunt.
+        
+        This fixes crashes in:
+        inspector/styles/styles-computed-trace.html
+        inspector/console/console-big-array.html
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::fixPhis):
+
+2012-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have control flow graph simplification
+        https://bugs.webkit.org/show_bug.cgi?id=84553
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r115512 from dfgopt.
+
+        This change gives the DFG the ability to simplify the control flow graph
+        as part of an optimization fixpoint that includes CSE, CFA, and constant
+        folding. This required a number of interesting changes including:
+        
+        - Solidifying the set of invariants that the DFG obeys. For example, the
+          head and tail of each basic block must advertise the set of live locals
+          and the set of available locals, respectively. It must do so by
+          referring to the first access to the local in the block (for head) and
+          the last one (for tail). This patch introduces the start of a
+          validation step that may be turned on even with asserts disabled. To
+          ensure that these invariants are preserved, I had to remove the
+          redundant phi elimination phase. For now I just remove the call, but in
+          the future we will probably remove it entirely unless we find a use for
+          it.
+        
+        - Making it easier to get the boolean version of a JSValue. This is a
+          pure operation, but we previously did not treat it as such.
+        
+        - Fixing the merging and filtering of AbstractValues that correspond to
+          concrete JSValues. This was previously broken and was limiting the
+          effect of running constant folding. Fixing this meant that I had to
+          change how constant folding eliminates GetLocal nodes, so as to ensure
+          that the resulting graph still obeys DFG rules.
+        
+        - Introducing simplified getters for some of the things that DFG phases
+          want to know about, like the Nth child of a node (now just
+          graph.child(...) if you don't care about performance too much) or
+          getting successors of a basic block.
+        
+        The current CFG simplifier can handle almost all of the cases that it
+        ought to handle; the noteworthy one that is not yet handled is removing
+        basic blocks that just have jumps. To do this right we need to be able
+        to remove jump-only blocks that also perform keep-alive on some values.
+        To make this work, we need to be able to hoist the keep-alive into (or
+        just above) a Branch. This is not fundamentally difficult but I opted to
+        let this patch omit this optimization. We can handle this later.
+        
+        This is a big win on programs that include inline functions that are
+        often called with constant arguments. Of course, SunSpider, V8, and
+        Kraken don't count. Those benchmarks are completely neutral with this
+        change.
+
+        * API/JSValueRef.cpp:
+        (JSValueToBoolean):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::dfgOSREntryDataForBytecodeIndex):
+        * bytecode/Operands.h:
+        (JSC::Operands::setOperandFirstTime):
+        (Operands):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::isClear):
+        (JSC::DFG::AbstractValue::operator!=):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::validateIgnoringValue):
+        (AbstractValue):
+        * dfg/DFGAdjacencyList.h:
+        (JSC::DFG::AdjacencyList::child):
+        (JSC::DFG::AdjacencyList::setChild):
+        (AdjacencyList):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::~BasicBlock):
+        (BasicBlock):
+        (JSC::DFG::BasicBlock::numNodes):
+        (JSC::DFG::BasicBlock::nodeIndex):
+        (JSC::DFG::BasicBlock::isPhiIndex):
+        (JSC::DFG::BasicBlock::isInPhis):
+        (JSC::DFG::BasicBlock::isInBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::run):
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        (JSC::DFG::performCFA):
+        * dfg/DFGCFAPhase.h:
+        (DFG):
+        * dfg/DFGCFGSimplificationPhase.cpp: Added.
+        (DFG):
+        (CFGSimplificationPhase):
+        (JSC::DFG::CFGSimplificationPhase::CFGSimplificationPhase):
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::killUnreachable):
+        (JSC::DFG::CFGSimplificationPhase::findOperandSource):
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::jettisonBlock):
+        (JSC::DFG::CFGSimplificationPhase::fixPhis):
+        (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
+        (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
+        (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
+        (OperandSubstitution):
+        (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::dump):
+        (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        (JSC::DFG::performCFGSimplification):
+        * dfg/DFGCFGSimplificationPhase.h: Added.
+        (DFG):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::run):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        (JSC::DFG::performCSE):
+        * dfg/DFGCSEPhase.h:
+        (DFG):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        (JSC::DFG::performConstantFolding):
+        * dfg/DFGConstantFoldingPhase.h:
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGEdge.h:
+        (Edge):
+        (JSC::DFG::Edge::operator UnspecifiedBoolType*):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupBlock):
+        (JSC::DFG::performFixup):
+        * dfg/DFGFixupPhase.h:
+        (DFG):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::handleSuccessor):
+        (DFG):
+        (JSC::DFG::Graph::determineReachability):
+        (JSC::DFG::Graph::resetReachability):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::deref):
+        (JSC::DFG::Graph::changeIndex):
+        (Graph):
+        (JSC::DFG::Graph::changeEdge):
+        (JSC::DFG::Graph::numSuccessors):
+        (JSC::DFG::Graph::successor):
+        (JSC::DFG::Graph::successorForCondition):
+        (JSC::DFG::Graph::isPredictedNumerical):
+        (JSC::DFG::Graph::byValIsPure):
+        (JSC::DFG::Graph::clobbersWorld):
+        (JSC::DFG::Graph::numChildren):
+        (JSC::DFG::Graph::child):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToConstant):
+        (JSC::DFG::Node::numSuccessors):
+        (Node):
+        (JSC::DFG::Node::successor):
+        (JSC::DFG::Node::successorForCondition):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::endPhase):
+        * dfg/DFGPhase.h:
+        (JSC::DFG::runPhase):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::run):
+        (JSC::DFG::performPredictionPropagation):
+        * dfg/DFGPredictionPropagationPhase.h:
+        (DFG):
+        * dfg/DFGRedundantPhiEliminationPhase.cpp:
+        (JSC::DFG::RedundantPhiEliminationPhase::run):
+        (JSC::DFG::performRedundantPhiElimination):
+        * dfg/DFGRedundantPhiEliminationPhase.h:
+        (DFG):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::use):
+        (ScoreBoard):
+        (JSC::DFG::ScoreBoard::useIfHasResult):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::createOSREntries):
+        (JSC::DFG::SpeculativeJIT::linkOSREntries):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::nextBlock):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::use):
+        (JSC::DFG::SpeculativeJIT::jump):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp: Added.
+        (DFG):
+        (Validate):
+        (JSC::DFG::Validate::Validate):
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::reportValidationContext):
+        (JSC::DFG::Validate::dumpData):
+        (JSC::DFG::Validate::dumpGraphIfAppropriate):
+        (JSC::DFG::validate):
+        * dfg/DFGValidate.h: Added.
+        (DFG):
+        (JSC::DFG::validate):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        (JSC::DFG::performVirtualRegisterAllocation):
+        * dfg/DFGVirtualRegisterAllocationPhase.h:
+        (DFG):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncSome):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSObject.cpp:
+        (JSC):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::toBoolean):
+        * runtime/JSString.h:
+        (JSString):
+        (JSC::JSCell::toBoolean):
+        (JSC::JSValue::toBoolean):
+        * runtime/JSValue.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorMultiline):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2012-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+
+2012-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have constant propagation
+        https://bugs.webkit.org/show_bug.cgi?id=84004
+
+        Reviewed by Gavin Barraclough.
+        
+        Merge r114554 from dfgopt.
+        
+        Changes AbstractValue to be able to hold a "set" of constants, where
+        the maximum set size is 1 - so merging a value containing constant A
+        with another value containing constant B where A != B will result in
+        the AbstractValue claiming that it does not know any constants (i.e.
+        it'll just have a predicted type and possible a structure).
+        
+        Added a constant folding phase that uses this new information to
+        replace pure operations known to have constant results with
+        JSConstants. This is OSR-exit-aware, in that it will prepend a Phantom
+        that refers to all of the kids of the node we replaced.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::clear):
+        (JSC::DFG::AbstractValue::isClear):
+        (JSC::DFG::AbstractValue::makeTop):
+        (JSC::DFG::AbstractValue::clobberValue):
+        (AbstractValue):
+        (JSC::DFG::AbstractValue::valueIsTop):
+        (JSC::DFG::AbstractValue::value):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::operator==):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::validate):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGAdjacencyList.h:
+        (JSC::DFG::AdjacencyList::initialize):
+        (AdjacencyList):
+        (JSC::DFG::AdjacencyList::reset):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::constantCSE):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp: Added.
+        (DFG):
+        (ConstantFoldingPhase):
+        (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
+        (JSC::DFG::ConstantFoldingPhase::run):
+        (JSC::DFG::performConstantFolding):
+        * dfg/DFGConstantFoldingPhase.h: Added.
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.h:
+        (Graph):
+        (JSC::DFG::Graph::convertToConstant):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToConstant):
+        (Node):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/JSValue.h:
+        (JSValue):
+
+2012-05-18  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Fix build for Qt by using ASSERT_UNUSED in DFGSpeculativeJIT
+        https://bugs.webkit.org/show_bug.cgi?id=86902
+
+        Reviewed by Andreas Kling.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+
+2012-04-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have out-of-line slow paths
+        https://bugs.webkit.org/show_bug.cgi?id=83992
+
+        Reviewed by Oliver Hunt.
+        
+        Merge of r114472 and r114553 from dfgopt.
+        
+        Introduces the notion of slow path code generation closures in the DFG.
+        These are defined in DFGSlowPathGenerator.h, though they are fairly
+        extensible so DFGSpeculativeJIT64.cpp and DFGSpeculativeJIT32_64.cpp
+        define a couple special-purpose ones. A slow path generation closure
+        (DFG::SlowPathGenerator) is executed after the main speculative path is
+        generated. This makes them great for scheduling slow path code out of
+        the way of the hot paths.
+        
+        This patch also converts most - but not all - of the DFG to use slow
+        path generators instead of inline slow paths.
+        
+        The result is a sub-1% improvement on SunSpider and V8, and a miniscule
+        regression on Kraken.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
+        (TrustedImmPtr):
+        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
+        (TrustedImm32):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGCommon.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (DFG):
+        (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+        (PropertyAccessRecord):
+        (JITCompiler):
+        * dfg/DFGSilentRegisterSavePlan.h: Added.
+        (DFG):
+        (SilentRegisterSavePlan):
+        (JSC::DFG::SilentRegisterSavePlan::SilentRegisterSavePlan):
+        (JSC::DFG::SilentRegisterSavePlan::spillAction):
+        (JSC::DFG::SilentRegisterSavePlan::fillAction):
+        (JSC::DFG::SilentRegisterSavePlan::nodeIndex):
+        (JSC::DFG::SilentRegisterSavePlan::gpr):
+        (JSC::DFG::SilentRegisterSavePlan::fpr):
+        * dfg/DFGSlowPathGenerator.h: Added.
+        (DFG):
+        (SlowPathGenerator):
+        (JSC::DFG::SlowPathGenerator::SlowPathGenerator):
+        (JSC::DFG::SlowPathGenerator::~SlowPathGenerator):
+        (JSC::DFG::SlowPathGenerator::generate):
+        (JSC::DFG::SlowPathGenerator::label):
+        (JSC::DFG::SlowPathGenerator::call):
+        (JumpingSlowPathGenerator):
+        (JSC::DFG::JumpingSlowPathGenerator::JumpingSlowPathGenerator):
+        (JSC::DFG::JumpingSlowPathGenerator::linkFrom):
+        (JSC::DFG::JumpingSlowPathGenerator::jumpTo):
+        (CallSlowPathGenerator):
+        (JSC::DFG::CallSlowPathGenerator::CallSlowPathGenerator):
+        (JSC::DFG::CallSlowPathGenerator::call):
+        (JSC::DFG::CallSlowPathGenerator::setUp):
+        (JSC::DFG::CallSlowPathGenerator::recordCall):
+        (JSC::DFG::CallSlowPathGenerator::tearDown):
+        (CallResultAndNoArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndNoArgumentsSlowPathGenerator::CallResultAndNoArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndNoArgumentsSlowPathGenerator::generateInternal):
+        (CallResultAndOneArgumentSlowPathGenerator):
+        (JSC::DFG::CallResultAndOneArgumentSlowPathGenerator::CallResultAndOneArgumentSlowPathGenerator):
+        (JSC::DFG::CallResultAndOneArgumentSlowPathGenerator::generateInternal):
+        (CallResultAndTwoArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndTwoArgumentsSlowPathGenerator::CallResultAndTwoArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndTwoArgumentsSlowPathGenerator::generateInternal):
+        (CallResultAndThreeArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndThreeArgumentsSlowPathGenerator::CallResultAndThreeArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndThreeArgumentsSlowPathGenerator::generateInternal):
+        (CallResultAndFourArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndFourArgumentsSlowPathGenerator::CallResultAndFourArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndFourArgumentsSlowPathGenerator::generateInternal):
+        (CallResultAndFiveArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndFiveArgumentsSlowPathGenerator::CallResultAndFiveArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndFiveArgumentsSlowPathGenerator::generateInternal):
+        (JSC::DFG::slowPathCall):
+        (AssigningSlowPathGenerator):
+        (JSC::DFG::AssigningSlowPathGenerator::AssigningSlowPathGenerator):
+        (JSC::DFG::AssigningSlowPathGenerator::generateInternal):
+        (JSC::DFG::slowPathMove):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::~SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (DFG):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
+        (JSC::DFG::SpeculativeJIT::silentSpill):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::SpeculativeJIT::silentSpillAllRegistersImpl):
+        (JSC::DFG::SpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::SpeculativeJIT::pickCanTrample):
+        (JSC::DFG::SpeculativeJIT::silentFillAllRegisters):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (ValueToNumberSlowPathGenerator):
+        (JSC::DFG::ValueToNumberSlowPathGenerator::ValueToNumberSlowPathGenerator):
+        (JSC::DFG::ValueToNumberSlowPathGenerator::generateInternal):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::generateInternal):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (ValueToNumberSlowPathGenerator):
+        (JSC::DFG::ValueToNumberSlowPathGenerator::ValueToNumberSlowPathGenerator):
+        (JSC::DFG::ValueToNumberSlowPathGenerator::generateInternal):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::generateInternal):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-18  Tony Chang  <tony@chromium.org>
+
+        remove the CSS_GRID_LAYOUT compiler define, but default grid layout to off
+        https://bugs.webkit.org/show_bug.cgi?id=86767
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig: Remove ENABLE_CSS_GRID_LAYOUT.
+
+2012-05-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Setting array index -1 and looping over array causes bad behavior
+        https://bugs.webkit.org/show_bug.cgi?id=86733
+        <rdar://problem/11477670>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGOperations.cpp:
+
+2012-05-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Rolled out r117495 because it caused som out of memory crashes.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+
+2012-05-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored the Heap to move more MarkedSpace logic into MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=86790
+
+        Reviewed by Gavin Barraclough.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::markRoots):
+        (JSC):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (Heap): Took all the functors from here...
+
+        * heap/MarkedBlock.h:
+        (CountFunctor):
+        (JSC::MarkedBlock::CountFunctor::CountFunctor):
+        (JSC::MarkedBlock::CountFunctor::count):
+        (JSC::MarkedBlock::CountFunctor::returnValue):
+        (MarkedBlock):
+        * heap/MarkedSpace.h:
+        (JSC::ClearMarks::operator()):
+        (JSC):
+        (JSC::Sweep::operator()):
+        (JSC::MarkCount::operator()):
+        (JSC::Size::operator()):
+        (JSC::Capacity::operator()):
+        (MarkedSpace):
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity): and put them here.
+
+2012-05-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Increase the GC allocation trigger
+        https://bugs.webkit.org/show_bug.cgi?id=86699
+
+        Reviewed by Sam Weinig.
+
+        This helps a lot when the heap is growing, and helps to resolve
+        the regression caused by r116484.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+
+2012-05-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GC in the middle of JSObject::allocatePropertyStorage can cause badness
+        https://bugs.webkit.org/show_bug.cgi?id=83839
+
+        Reviewed by Geoff Garen.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * jit/JITStubs.cpp: Making changes to use the new return value of growPropertyStorage.
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::growPropertyStorage): Renamed to more accurately reflect that we're 
+        growing our already-existing PropertyStorage.
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::setPropertyStorage): "Atomically" sets the new property storage 
+        and the new structure so that we can be sure a GC never occurs when our Structure
+        info is out of sync with our PropertyStorage.
+        (JSC):
+        (JSC::JSObject::putDirectInternal): Moved the check to see if we should 
+        allocate more backing store before the actual property insertion into 
+        the structure.
+        (JSC::JSObject::putDirectWithoutTransition): Ditto.
+        (JSC::JSObject::transitionTo): Ditto.
+        * runtime/Structure.cpp:
+        (JSC::Structure::suggestedNewPropertyStorageSize): Added to keep the resize policy 
+        for property backing stores contained within the Structure class.
+        (JSC):
+        * runtime/Structure.h:
+        (JSC::Structure::shouldGrowPropertyStorage): Lets clients know if another insertion 
+        into the Structure would require resizing the property backing store so that they can 
+        preallocate the required storage.
+        (Structure):
+
+2012-05-16  Geoffrey Garen  <ggaren@apple.com>
+
+        GC is not thread-safe when moving values between C stacks
+        https://bugs.webkit.org/show_bug.cgi?id=86672
+
+        Reviewed by Phil Pizlo.
+
+        GC pauses thread A while marking thread A, and then B while marking B,
+        which isn't safe against A and B moving values between each others'
+        stacks.
+
+        This is a theoretical bug -- I haven't been able to reproduce it
+        in the wild.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromOtherThread):
+        (JSC::MachineThreads::gatherConservativeRoots): Pause all C stacks for the
+        duration of stack marking, to avoid missing values that might be moving
+        between C stacks.
+
+2012-05-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Block freeing thread should not free blocks when we are actively requesting them
+        https://bugs.webkit.org/show_bug.cgi?id=86519
+
+        Reviewed by Geoff Garen.
+
+        * heap/BlockAllocator.h:
+        (JSC::BlockAllocator::allocate): Reordering the setting of the flag so its done 
+        while we hold the lock to ensure proper locking.
+
+2012-05-15  Filip Pizlo  <fpizlo@apple.com>
+
+        shrinkToFit() is often not called for Vectors in CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=86436
+
+        Reviewed by Oliver Hunt.
+        
+        The vectors in CodeBlock are often appended to during various stages of
+        compilation, but we neglect to shrink them after compilation finishes. This
+        patch takes the most brutal possible approach: shrink all the vectors after
+        the bytecompile phase, and then shrink them again after the appropriate
+        JITing phase. The two shrinks are necessary because the JIT may append more
+        stuff, but may also generate code that directly references things in other
+        vectors; hence some can only be shrunk before JIT and some after. Also,
+        we may allow a CodeBlock to sit around for a long time - possibly forever -
+        before invoking the JIT, hence it makes sense to have two shrinks.
+        
+        This is performance neutral on the major benchmarks we track.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::appendWeakReferenceTransition):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2012-05-15  Oliver Hunt  <oliver@apple.com>
+
+        Make error information available even if all we have is line number information.
+        https://bugs.webkit.org/show_bug.cgi?id=86547
+
+        Reviewed by Filip Pizlo.
+
+        We don't need expression information to generate useful line, file, and stack information,
+        so only require that we have line number info available.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        * runtime/Executable.h:
+        (JSC):
+
+2012-05-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Block freeing thread should not free blocks when we are actively requesting them
+        https://bugs.webkit.org/show_bug.cgi?id=86519
+
+        Reviewed by Geoffrey Garen.
+
+        The block freeing thread shoots us in the foot if it decides to run while we're actively 
+        requesting blocks and returning them. This situation can arise when there is a lot of copying 
+        collection going on in steady state. We allocate a large swath of pages to copy into, then we 
+        return all the newly free old pages to the BlockAllocator. In this state, if the block freeing 
+        thread wakes up in between collections (which is more likely than it waking up during a 
+        collection) and frees half of these pages, they will be needed almost immediately during the 
+        next collection, causing a storm of VM allocations which we know are going to be very slow.
+
+        What we'd like is for when things have quieted down the block freeing thread can then return 
+        memory to the OS. Usually this will be when a page has fully loaded and has a low allocation 
+        rate. In this situation, our opportunistic collections will only be running at least every few 
+        seconds, thus the extra time spent doing VM allocations won't matter nearly as much as, say, 
+        while a page is loading.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator): Initialize our new field.
+        (JSC::BlockAllocator::blockFreeingThreadMain): We check if we've seen any block requests recently.
+        If so, reset our flag and go back to sleep. We also don't bother with locking here. If we miss out 
+        on an update, we'll see it when we wake up again.
+        * heap/BlockAllocator.h: Add new field to track whether or not we've received recent block requests.
+        (BlockAllocator):
+        (JSC::BlockAllocator::allocate): If we receive a request for a block, set our field that tracks 
+        that to true. We don't bother locking since we assume that writing to a bool is atomic.
+
+2012-05-14  Luke Macpherson  <macpherson@chromium.org>
+
+        Introduce ENABLE_CSS_VARIABLES compile flag.
+        https://bugs.webkit.org/show_bug.cgi?id=86338
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a configuration option for CSS Variables support, disabling it by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Cannot login to iCloud
+        https://bugs.webkit.org/show_bug.cgi?id=86321
+
+        Reviewed by Filip Pizlo.
+
+        This is a bug introduced by bug#85853, we shouldn't allow assignment to
+        the prototype property of functions to be cached, since we need to clear
+        the cached inheritorID.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+
+2012-05-14  Michael Saboff  <msaboff@apple.com>
+
+        Enh: Add the Ability to Disable / Enable JavaScript GC Timer
+        https://bugs.webkit.org/show_bug.cgi?id=86382
+
+        Reviewed by Darin Adler.
+
+        Add flag to GCActivityCallback to enable / disable activity timer.
+        Add api via Heap to set the flag's value.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Windows export
+        * heap/Heap.cpp:
+        (JSC::Heap::setGarbageCollectionTimerEnabled):
+        * heap/Heap.h:
+        * runtime/GCActivityCallback.h:
+        (JSC::GCActivityCallback::isEnabled):
+        (JSC::GCActivityCallback::setEnabled):
+        (JSC::GCActivityCallback::GCActivityCallback):
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::timerDidFire):
+
+2012-05-14  Michael Saboff  <msaboff@apple.com>
+
+        Increase Debug Logging in MarkStack::validate()
+        https://bugs.webkit.org/show_bug.cgi?id=86408
+
+        Rubber-stamped by Filip Pizlo.
+
+        Added some descriptive debug messages for the conditions and
+        values when a cell validation fails.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::validate):
+
+2012-05-14  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-05-14  Yong Li  <yoli@rim.com>
+
+        DFG JIT didn't work with ARM EABI.
+        https://bugs.webkit.org/show_bug.cgi?id=84449
+
+        Reviewed by Filip Pizlo.
+
+        Add a 32-bit dummy argument for some callOperation()
+        methods to make it work for ARM EABI.
+
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+2012-05-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Introduce PropertyName class
+        https://bugs.webkit.org/show_bug.cgi?id=86241
+
+        Reviewed by Darin Adler.
+
+        This patch introduced a couple of small bugs.
+
+        * runtime/PropertyName.h:
+        (JSC::toUInt32FromCharacters):
+            - Returning wrong value for "" - should not convert to 0.
+        (JSC::PropertyName::PropertyName):
+            - Remove the ASSERT, it was a little too aspirational.
+
+2012-05-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG performs incorrect constant folding on double-to-uint32 conversion in
+        Uint32Array PutByVal
+        https://bugs.webkit.org/show_bug.cgi?id=86330
+
+        Reviewed by Darin Adler.
+        
+        static_cast<int>(d) is wrong, since JS semantics require us to use toInt32(d).
+        In particular, C++ casts on typical hardware (like x86 and similar) will
+        return 0x80000000 for double values that are out of range of the int32 domain
+        (i.e. less than -2^31 or greater than or equal to 2^31). But JS semantics call
+        for wrap-around; for example the double value 4294967297 ought to become the
+        int32 value 1, not 0x80000000.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+
+2012-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Introduce PropertyName class
+        https://bugs.webkit.org/show_bug.cgi?id=86241
+
+        Reviewed by Geoff Garen.
+
+        Replace 'const Identifier&' arguments to functions accessing object properties with a new 'PropertyName' type.
+        This change paves the way to allow for properties keyed by values that are not Identifiers.
+
+        This change is largely a mechanical find & replace.
+        It also changes JSFunction's constructor to take a UString& instead of an Identifier&
+        (since in some cases we can no longer guarantee that we'lll have an Identifier), and
+        unifies Identifier's methods to obtain array indices onto PropertyName.
+
+        The new PropertyName class retains the ability to support .impl() and .ustring(), but
+        in a future patch we may need to rework this, since not all PropertyNames should be
+        equal based on their string representation.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::finishCreation):
+        * API/JSCallbackFunction.h:
+        (JSCallbackFunction):
+        (JSC::JSCallbackFunction::create):
+        * API/JSCallbackObject.h:
+        (JSCallbackObject):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::getOwnPropertyDescriptor):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::getStaticValue):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putDirectVirtual):
+        (JSC::DebuggerActivation::deleteProperty):
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        (JSC::DebuggerActivation::defineOwnProperty):
+        * debugger/DebuggerActivation.h:
+        (DebuggerActivation):
+        * jsc.cpp:
+        (GlobalObject::addFunction):
+        (GlobalObject::addConstructableFunction):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        (JSC::Arguments::defineOwnProperty):
+        * runtime/Arguments.h:
+        (Arguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        (JSC::ArrayConstructor::getOwnPropertyDescriptor):
+        * runtime/ArrayConstructor.h:
+        (ArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        (JSC::putProperty):
+        * runtime/ArrayPrototype.h:
+        (ArrayPrototype):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::finishCreation):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        (JSC::BooleanPrototype::getOwnPropertyDescriptor):
+        * runtime/BooleanPrototype.h:
+        (BooleanPrototype):
+        * runtime/ClassInfo.h:
+        (MethodTable):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        (JSC::DateConstructor::getOwnPropertySlot):
+        (JSC::DateConstructor::getOwnPropertyDescriptor):
+        * runtime/DateConstructor.h:
+        (DateConstructor):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertySlot):
+        (JSC::DatePrototype::getOwnPropertyDescriptor):
+        * runtime/DatePrototype.h:
+        (DatePrototype):
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::create):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::finishCreation):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        (JSC::ErrorPrototype::getOwnPropertyDescriptor):
+        * runtime/ErrorPrototype.h:
+        (ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::finishCreation):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::finishCreation):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncBind):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::create):
+        (FunctionPrototype):
+        * runtime/Identifier.cpp:
+        (JSC):
+        * runtime/Identifier.h:
+        (Identifier):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        * runtime/InternalFunction.h:
+        (InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putDirectVirtual):
+        (JSC::JSActivation::deleteProperty):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSActivation):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        (JSArray):
+        (JSC):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::finishCreation):
+        * runtime/JSBoundFunction.h:
+        (JSBoundFunction):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertySlot):
+        (JSC::JSCell::put):
+        (JSC::JSCell::deleteProperty):
+        (JSC::JSCell::putDirectVirtual):
+        (JSC::JSCell::defineOwnProperty):
+        (JSC::JSCell::getOwnPropertyDescriptor):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::finishCreation):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty):
+        (JSC::getCalculatedDisplayName):
+        * runtime/JSFunction.h:
+        (JSFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putDirectVirtual):
+        (JSC::JSGlobalObject::defineOwnProperty):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::createThrowTypeError):
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
+        (JSC::JSGlobalObject::symbolTableHasProperty):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertySlot):
+        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
+        (JSC::JSNotAnObject::put):
+        (JSC::JSNotAnObject::deleteProperty):
+        * runtime/JSNotAnObject.h:
+        (JSNotAnObject):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        (JSC::JSONObject::getOwnPropertyDescriptor):
+        * runtime/JSONObject.h:
+        (JSONObject):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putDirectVirtual):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::hasProperty):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::hasOwnProperty):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::findPropertyHashEntry):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::getPropertyDescriptor):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlot):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::get):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putOwnDataProperty):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putDirectVirtual):
+        (JSC::JSStaticScopeObject::getOwnPropertySlot):
+        * runtime/JSStaticScopeObject.h:
+        (JSStaticScopeObject):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSString):
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSValue.h:
+        (JSC):
+        (JSValue):
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::deleteProperty):
+        (JSC::JSVariableObject::symbolTableGet):
+        (JSC::JSVariableObject::putDirectVirtual):
+        * runtime/JSVariableObject.h:
+        (JSVariableObject):
+        (JSC::JSVariableObject::symbolTableGet):
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        (JSC):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticFunctionSlot):
+        (JSC::getStaticFunctionDescriptor):
+        (JSC::getStaticValueSlot):
+        (JSC::getStaticValueDescriptor):
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        (JSC::MathObject::getOwnPropertyDescriptor):
+        * runtime/MathObject.h:
+        (MathObject):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NumberConstructor.cpp:
+        (JSC):
+        (JSC::NumberConstructor::finishCreation):
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        (JSC::NumberConstructor::put):
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/NumberConstructor.h:
+        (NumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        (JSC::NumberPrototype::getOwnPropertyDescriptor):
+        * runtime/NumberPrototype.h:
+        (NumberPrototype):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        (JSC::ObjectConstructor::getOwnPropertyDescriptor):
+        * runtime/ObjectConstructor.h:
+        (ObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put):
+        (JSC::ObjectPrototype::defineOwnProperty):
+        (JSC::ObjectPrototype::getOwnPropertySlot):
+        (JSC::ObjectPrototype::getOwnPropertyDescriptor):
+        * runtime/ObjectPrototype.h:
+        (ObjectPrototype):
+        * runtime/PropertySlot.h:
+        (PropertySlot):
+        (JSC::PropertySlot::getValue):
+        * runtime/RegExpConstructor.cpp:
+        (JSC):
+        (JSC::RegExpConstructor::finishCreation):
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        (JSC::RegExpConstructor::getOwnPropertyDescriptor):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::RegExpConstructor::put):
+        * runtime/RegExpConstructor.h:
+        (RegExpConstructor):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::defineOwnProperty):
+        * runtime/RegExpObject.cpp:
+        (JSC):
+        (JSC::RegExpObject::getOwnPropertySlot):
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        (JSC::RegExpObject::deleteProperty):
+        (JSC::RegExpObject::defineOwnProperty):
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::RegExpObject::put):
+        * runtime/RegExpObject.h:
+        (RegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        (JSC::RegExpPrototype::getOwnPropertyDescriptor):
+        * runtime/RegExpPrototype.h:
+        (RegExpPrototype):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::deleteProperty):
+        * runtime/StrictEvalActivation.h:
+        (StrictEvalActivation):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::finishCreation):
+        (JSC::StringConstructor::getOwnPropertySlot):
+        (JSC::StringConstructor::getOwnPropertyDescriptor):
+        * runtime/StringConstructor.h:
+        (StringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertySlot):
+        (JSC::StringObject::getOwnPropertyDescriptor):
+        (JSC::StringObject::put):
+        (JSC::StringObject::defineOwnProperty):
+        (JSC::StringObject::deleteProperty):
+        * runtime/StringObject.h:
+        (StringObject):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertySlot):
+        (JSC::StringPrototype::getOwnPropertyDescriptor):
+        * runtime/StringPrototype.h:
+        (StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::get):
+
+2012-05-11  Michael Saboff  <msaboff@apple.com>
+
+        Rolling out r116659.
+
+        Causes ASSERT failures on bots.
+
+        Rubber stamped by Geoff Garen.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::markingThreadMain):
+        (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::MarkStackThreadSharedData::reset):
+        (JSC::MarkStack::reset):
+        (JSC):
+        (JSC::SlotVisitor::copyAndAppend):
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        (MarkStack):
+        * runtime/JSString.h:
+        (JSString):
+        (JSC::JSString::finishCreation):
+        (JSC::JSString::is8Bit):
+        (JSC::JSRopeString::finishCreation):
+
+2012-05-11  Oliver Hunt  <oliver@apple.com>
+
+        Appease thread verifier when dealing with the JSC API's shared VM
+        https://bugs.webkit.org/show_bug.cgi?id=86268
+
+        Reviewed by Geoffrey Garen.
+
+        If we're the shared VM, just disable the verifier.  This makes debug builds
+        livable against non-webkit clients.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2012-05-11  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT memory allocator is not returning memory to the OS on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=86047
+
+        Reviewed by Geoff Garen.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::notifyPageIsFree):
+
+2012-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Clarified JSGlobalData (JavaScript VM) lifetime
+        https://bugs.webkit.org/show_bug.cgi?id=85142
+
+        Reviewed by Alexey Proskuryakov.
+
+        (Follow-up fix.)
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Restored some code I removed because I misread an #ifdef.
+        (We don't need to test BUILDING_ON_LEOPARD, but we still need the linked-on
+        test, because apps might have been linked on older OS's.)
+
+2012-05-11  Sam Weinig  <sam@webkit.org>
+
+        Fix crash seen when running with libgmalloc
+        <rdar://problem/11435411>
+        https://bugs.webkit.org/show_bug.cgi?id=86232
+
+        Reviewed by Gavin Barraclough.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::markingThreadMain):
+        Don't delete the SlotVisitor before the ParallelModeEnabler has had a chance to run its
+        destructor.
+
+2012-05-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove op_get_callee
+
+        Rubber stamped by Geoff Garen.
+        
+        This is now redundant.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-05-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Cache inheritorID on JSFunction
+        https://bugs.webkit.org/show_bug.cgi?id=85853
+
+        Reviewed by Geoff Garen & Filip Pizlo.
+
+        An object's prototype is indicated via its structure.  To create an otherwise
+        empty object with object A as its prototype, we require a structure with its
+        prototype set to point to A.  We wish to use this same structure for all empty
+        objects created with a prototype of A, so we presently store this structure as
+        a property of A, known as the inheritorID.
+
+        When a function F is invoked as a constructor, where F has a property 'prototype'
+        set to point to A, in order to create the 'this' value for the constructor to
+        use the following steps are taken:
+          - the 'prototype' proptery of F is read, via a regular [[Get]] access.
+          - the inheritorID internal property of the prototype is read.
+          - a new, empty object is constructed with its structure set to point to inheritorID.
+
+        There are two drawbacks to the current approach:
+          - it requires that every object has an inheritorID field.
+          - it requires a [[Get]] access on every constructor call to access the 'prototype' property.
+
+        Instead, switch to caching a copy of the inheritorID on the function.  Constructor
+        calls now only need read the internal property from the callee, saving a [[Get]].
+        This also means that JSObject::m_inheritorID is no longer commonly read, and in a
+        future patch we can move to storing this in a more memory efficient fashion.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateJSFunction):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::cacheInheritorID):
+        (JSC):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::cachedInheritorID):
+        (JSFunction):
+        (JSC::JSFunction::offsetOfCachedInheritorID):
+
+2012-05-10  Michael Saboff  <msaboff@apple.com>
+
+        Enh: Hash Const JSString in Backing Stores to Save Memory
+        https://bugs.webkit.org/show_bug.cgi?id=86024
+
+        Reviewed by Filip Pizlo.
+
+        During garbage collection, each marking thread keeps a HashMap of
+        strings.  While visiting via MarkStack::copyAndAppend(), we check to
+        see if the string we are visiting is already in the HashMap.  If not
+        we add it.  If so, we change the reference to the current string we're
+        visiting to the prior string.
+
+        To somewhat reduce the performance impact of this change, if a string
+        is unique at the end of a marking it will not be checked during further
+        GC phases.  In some cases this won't catch all duplicates, but we are
+        trying to catch the growth of duplicate strings.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::resetChildren): New method called by the 
+        main thread to reset the slave threads.  This is primarily done to
+        clear the m_uniqueStrings HashMap.
+        (JSC):
+        (JSC::MarkStackThreadSharedData::markingThreadMain):
+        (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::MarkStackThreadSharedData::reset):
+        (JSC::MarkStack::reset): Added call to clear m_uniqueStrings.
+        (JSC::MarkStack::internalAppend): New method that performs the hash consting.
+        (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash consting
+        internalAppend()
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        (MarkStack):
+        (JSC::MarkStack::sharedData):
+        * runtime/JSString.h:
+        (JSString): Added m_isHashConstSingleton flag, accessors for the flag and
+        code to initialize the flag.
+        (JSC::JSString::finishCreation):
+        (JSC::JSString::isHashConstSingleton):
+        (JSC::JSString::clearHashConstSingleton):
+        (JSC::JSString::setHashConstSingleton):
+        (JSC::JSRopeString::finishCreation):
+
+2012-05-09  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT memory allocator is not returning memory to the OS on Darwin
+        https://bugs.webkit.org/show_bug.cgi?id=86047
+        <rdar://problem/11414948>
+
+        Reviewed by Geoff Garen.
+        
+        Work around the problem by using a different madvise() flag, but only for the JIT memory
+        allocator. Also put in ASSERTs that the call is actually working.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::notifyNeedPage):
+        (JSC::FixedVMPoolExecutableAllocator::notifyPageIsFree):
+
+2012-05-09  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to get useful debug logging from the JIT memory allocator
+        https://bugs.webkit.org/show_bug.cgi?id=86042
+
+        Reviewed by Geoff Garen.
+
+        * jit/ExecutableAllocator.h:
+
+2012-05-09  Gavin Barraclough  <barraclough@apple.com>
+
+        GC race condition in OpaqueJSClass::prototype
+        https://bugs.webkit.org/show_bug.cgi?id=86034
+
+        Build fix.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+            - Eeeep, landed bad version of patch!
+
+2012-05-09  Gavin Barraclough  <barraclough@apple.com>
+
+        GC race condition in OpaqueJSClass::prototype
+        https://bugs.webkit.org/show_bug.cgi?id=86034
+
+        Reviewed by Filip Pizlo.
+
+        The bug here is basically:
+            if (weakref) weakref->method()
+        where a GC may occur between the if & the method call.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+
+2012-05-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CopiedSpace does not add pinned blocks back to the to-space filter
+        https://bugs.webkit.org/show_bug.cgi?id=86011
+
+        Reviewed by Geoffrey Garen.
+
+        After a collection has finished, we go through the blocks in from-space 
+        and move any of them that are pinned into to-space. At the beginning of 
+        collection, we reset the to-space block filter that is used during 
+        conservative scanning and add back the blocks that are filled during the 
+        collection. However, we neglect to add back those blocks that are moved 
+        from from-space to to-space, which can cause the conservative scan to 
+        think that some pinned items are not actually in CopiedSpace.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneCopying): Add the pinned blocks back to the 
+        to-space filter. Also added a comment and assert for future readers that 
+        indicates that it's okay that we don't also add the block to the 
+        to-space block set since it was never removed.
+
+
+2012-05-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Use independent version numbers for public libraries
+        https://bugs.webkit.org/show_bug.cgi?id=85984
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * GNUmakefile.am: Use LIBJAVASCRIPTCOREGTK_VERSION for library
+        version.
+
+2012-05-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Do not install JavaScriptCore platform-specific headers
+        https://bugs.webkit.org/show_bug.cgi?id=85983
+
+        Reviewed by Gustavo Noronha Silva.
+
+        JavaScriptCore.h includes JSStringRefCF.h unconditionally. It was
+        renamed to JavaScript.h in r29234 and it still exists for
+        compatibility with mac and windows users.
+
+        * GNUmakefile.list.am: Remove JavaScriptCore.h, JSStringRefCF.h
+        and JSStringRefBSTR.h from the sources and headers list.
+
+2012-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        ROLLING OUT r114255
+        
+        GC in the middle of JSObject::allocatePropertyStorage can cause badness
+        https://bugs.webkit.org/show_bug.cgi?id=83839
+
+        Reviewed by nobody.
+
+        This breaks the world, with COLLECT_ON_EVERY_ALLOCATION enabled.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        * runtime/Structure.cpp:
+        (JSC):
+        * runtime/Structure.h:
+        (JSC::Structure::didTransition):
+
+2012-05-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Heap should not continually allocate new pages in steady state
+        https://bugs.webkit.org/show_bug.cgi?id=85936
+
+        Reviewed by Geoff Garen.
+
+        Currently, in steady state (i.e. a constant amount of live GC 
+        memory with a constant rate of allocation) assuming we've just 
+        finished a collection with X live blocks in CopiedSpace, we 
+        increase our working set by X blocks in CopiedSpace with each 
+        collection we perform. This is due to the fact that we allocate 
+        until we run out of free blocks to use in the Heap before we 
+        consider whether we should run a collection. 
+
+        In the longer term, this issue will be mostly resolved by 
+        implementing quick release for the CopiedSpace. In the shorter 
+        term, we should change our policy to check whether we should 
+        allocate before trying to use a free block from the Heap. We 
+        can change our policy to something more appropriate once we 
+        have implemented quick release.
+
+        This change should also have the convenient side effect of 
+        reducing the variance in GC-heavy tests (e.g. v8-splay) due 
+        to fact that we are doing less VM allocation during copying 
+        collection. Overall, this patch is performance neutral across 
+        the benchmarks we track.
+
+        * heap/CopiedSpace.cpp: 
+        (JSC::CopiedSpace::getFreshBlock): Shuffle the request from the BlockAllocator
+        around so that we only do it if the block request must succeed 
+        i.e. after we've already checked whether we should do a collection.
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase): Ditto.
+        (JSC::MarkedAllocator::allocateBlock): We no longer have a failure mode in this 
+        function because by the time we've called it, we've already checked whether we 
+        should run a collection so there's no point in returning null.
+        * heap/MarkedAllocator.h: Removing old arguments from function declaration.
+        (MarkedAllocator):
+
+2012-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        SIGFPE on divide in classic interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=85917
+
+        Rubber stamped by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            - check for divisor of -1.
+
+2012-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Rolling out r110287
+
+        RS=Filip Pizlo
+
+        r110287 was meant to be refactoring only, but changed behavior
+        enough to break some websites, including qq.com.
+
+2012-05-07  Andy Estes  <aestes@apple.com>
+
+        ENABLE_IFRAME_SEAMLESS should be part of FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Fix release build.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2012-05-07  Oliver Hunt  <oliver@apple.com>
+
+        LLInt doesn't check for Ropes when performing a character switch
+        https://bugs.webkit.org/show_bug.cgi?id=85837
+
+        Reviewed by Filip Pizlo.
+
+        Make LLint check if the scrutinee of a char switch is a rope, and if
+        so fall back to a slow case.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-05-07  Eric Seidel  <eric@webkit.org>
+
+        Add ENABLE_IFRAME_SEAMLESS so Apple can turn off SEAMLESS if needed
+        https://bugs.webkit.org/show_bug.cgi?id=85822
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove TrustedImm32::m_isPointer
+        https://bugs.webkit.org/show_bug.cgi?id=85726
+
+        Rubber stamped by Sam Weinig.
+
+        We used to rely on being able to generate code with known, fixed offsets – to do so we
+        would inhibit more optimal code generation for pointers. This is no longer necessary.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
+        (TrustedImm32):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::branch32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::move):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::move):
+
+2012-05-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not Flush GetLocal's
+        https://bugs.webkit.org/show_bug.cgi?id=85663
+        <rdar://problem/11373600>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flushArgument):
+        (JSC::DFG::ByteCodeParser::handleCall):
+
+2012-05-04  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Doesn't build with ENABLE_JIT=0 
+        https://bugs.webkit.org/show_bug.cgi?id=85042
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/Operands.h:
+
+2012-05-03  Oliver Hunt  <oliver@apple.com>
+
+        Regression(r114702): Clobbering the caller frame register before we've stored it.
+        https://bugs.webkit.org/show_bug.cgi?id=85564
+
+        Reviewed by Filip Pizlo.
+
+        Don't use t0 as a temporary, when we're about to use the value in t0.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2012-05-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Removing remainder of accidental printfs.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+
+2012-05-03  Andy Estes  <aestes@apple.com>
+
+        If you add printf()s to your garbage collector, the layout tests are gonna have a bad time.
+
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC::DefaultGCActivityCallbackPlatformData::timerDidFire):
+
+2012-05-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Heap::reportAbandonedObjectGraph should not hasten an allocation-triggered collection
+        https://bugs.webkit.org/show_bug.cgi?id=85543
+
+        Reviewed by Filip Pizlo.
+
+        Currently reportAbandonedObjectGraph causes the Heap to think it is closer to its 
+        allocation limit for the current cycle, thus hastening an allocation-triggered collection. 
+        In reality, it should just affect the opportunistic GC timer. We should track the bytes 
+        we think have been abandoned and the bytes that have been allocated separately.
+
+        * heap/Heap.cpp: Added a new field m_abandonedBytes to Heap to keep track of how much 
+        we think we've abandoned.
+        (JSC::Heap::Heap): 
+        (JSC::Heap::reportAbandonedObjectGraph): 
+        (JSC):
+        (JSC::Heap::didAbandon): Added this function for reportAbandonedObjectGraph to call 
+        rather than didAllocate. Works the same as didAllocate, but modifies bytes abandoned rather 
+        than bytes allocated. Also notifies the timer, summing the two values together.
+        (JSC::Heap::collect):
+        (JSC::Heap::didAllocate): Now adds the bytes allocated and bytes abandoned when reporting 
+        to GCActivityCallback.
+        * heap/Heap.h:
+        (Heap):
+
+2012-05-02  Eric Seidel  <eric@webkit.org>
+
+        Sort ENABLE_ defines in FeatureDefines.xcconfig files to make them easier to compare with one another (and easier to autogenerate)
+        https://bugs.webkit.org/show_bug.cgi?id=85433
+
+        Reviewed by Adam Barth.
+
+        I have a script which can autogenerate these xcconfig files as well as the
+        vsprops files (and soon the Chromium, cmake, gnumake and qmake) feature lists
+        from a central feature list file.
+        In preparation for posting such a tool, I'm re-sorting these xcconfig files to be
+        alphabetically ordered (currently they're close, but not quite).
+        There is also at least one inconsistency between these files (CSS_LEGACY_PREFIXES) which
+        I will fix in a second pass.  I will also sort the FEATURE_DEFINES = line in a follow-up patch.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-02  Hojong Han  <hojong.han@samsung.com>
+
+        ARM_TRADITIONAL build fix
+        https://bugs.webkit.org/show_bug.cgi?id=85358
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::lshift32):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::or32):
+        (JSC::MacroAssemblerARM::urshift32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::branchSub32):
+
+2012-05-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Opportunistic GC should give up if the Heap is paged out
+        https://bugs.webkit.org/show_bug.cgi?id=85411
+
+        Reviewed by Filip Pizlo.
+
+        Opportunistic GC is punishing us severely in limited memory situations because its 
+        assumptions about how much time a collection will take are way out of whack when the Heap 
+        has been paged out by the OS. We should add a simple detection function to the Heap that 
+        detects if its is paged out. It will do this by iterating each block of both the MarkedSpace 
+        and CopiedSpace. If that operation takes longer than a fixed amount of time (e.g. 100ms), 
+        the function returns true. This function will only be run prior to an opportunistic 
+        collection (i.e. it will not run during our normal allocation-triggered collections).
+
+        In my tests, steady state was drastically improved in high memory pressure situations (i.e. 
+        the browser was still usable, significant reduction in SPODs). Occasionally, a normal GC
+        would be triggered due to pages doing things in the background, which would cause a 
+        significant pause. As we close pages we now cause normal collections rather than full 
+        collections, which prevents us from collecting all of the dead memory immediately. One 
+        nice way to deal with this issue might be to do incremental sweeping.
+
+
+        * heap/CopiedSpace.cpp:
+        (JSC::isBlockListPagedOut): Helper function to reduce code duplication when iterating over 
+        to-space, from-space, and the oversize blocks.
+        (JSC):
+        (JSC::CopiedSpace::isPagedOut): Tries to determine whether or not CopiedSpace is paged out
+        by iterating all of the blocks.
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/Heap.cpp:
+        (JSC::Heap::isPagedOut): Tries to determine whether the Heap is paged out by asking the 
+        MarkedSpace and CopiedSpace if they are paged out.
+        (JSC):
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::increaseLastGCLength): Added this so that the GC timer can linearly back off 
+        each time it determines that the Heap is paged out.
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::isPagedOut): Tries to determine if this particular MarkedAllocator's
+        list of blocks are paged out.
+        (JSC):
+        * heap/MarkedAllocator.h:
+        (MarkedAllocator):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::isPagedOut): For each MarkedAllocator, check to see if they're paged out.
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::cancel):
+        (JSC):
+        * runtime/GCActivityCallback.h:
+        (JSC::GCActivityCallback::cancel):
+        (DefaultGCActivityCallback):
+        * runtime/GCActivityCallbackCF.cpp: Added a constant of 100ms for the timeout in determining
+        whether the Heap is paged out or not.
+        (JSC):
+        (JSC::DefaultGCActivityCallbackPlatformData::timerDidFire): Added the check to see if we 
+        should attempt a collection based on whether or not we can iterate the blocks of the Heap in 
+        100ms. If we can't, we cancel the timer and tell the Heap we just wasted 100ms more trying to 
+        do a collection. This gives us a nice linear backoff so we're not constantly re-trying in
+        steady state paged-out-ness.
+        (JSC::DefaultGCActivityCallback::cancel): Added this function which, while currently doing 
+        exactly the same thing as willCollect, is more obvious as to what it's doing when we call it 
+        in timerDidFire.
+
+2012-05-02  Yong Li  <yoli@rim.com>
+
+        Fix GCC X86 build error
+        https://bugs.webkit.org/show_bug.cgi?id=85379
+
+        Reviewed by Rob Buis.
+
+        Always explicitly claim ".text" to make sure
+        functions defined with inline assembly will be
+        created in the correct section.
+
+        * dfg/DFGOperations.cpp:
+        (JSC):
+
+2012-05-02  Oliver Hunt  <oliver@apple.com>
+
+        Unreviewed, rolling out r115388.
+        http://trac.webkit.org/changeset/115388
+        https://bugs.webkit.org/show_bug.cgi?id=85011
+
+        This caused many weird performance problems, and needs to be
+        landed in pieces.
+
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        (JSC):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::execute):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::growSlowCase):
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::end):
+        (JSC::RegisterFile::size):
+        (JSC::RegisterFile::addressOfEnd):
+        (RegisterFile):
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::handleHostCall):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+
+2012-05-01  Oliver Hunt  <oliver@apple.com>
+
+        Physijs demo crashes due to DFG not updating topCallFrame correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=85311
+
+        Reviewed by Filip Pizlo.
+
+        A few of the dfg operations failed to correctly set the topCallFrame,
+        and so everything goes wrong.  This patch corrects the effected operations,
+        and makes debug builds poison topCallFrame before calling a dfg operation.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::prepareForExternalCall):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+
+2012-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Should be able to use YARR JIT without the JS language JIT
+        https://bugs.webkit.org/show_bug.cgi?id=85252
+
+        Reviewed by Geoff Garen.
+
+        Need to split canUseRegExpJIT out of canUseJIT.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+        (JSC::useJIT):
+        (JSC::JSGlobalData::JSGlobalData):
+            - replace m_canUseJIT with m_canUseAssembler
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::canUseRegExpJIT):
+            - Added canUseRegExpJIT, distinct from canUseJIT.
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+            - Call canUseRegExpJIT instead of canUseJIT.
+
+2012-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Should be able to build YARR JIT without the JS language JIT
+        https://bugs.webkit.org/show_bug.cgi?id=85242
+
+        Reviewed by Michael Saboff.
+
+        Some build macros are wrong.
+
+        * assembler/RepatchBuffer.h:
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        * jit/JITExceptions.cpp:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+
+2012-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Arguments object resets attributes on redefinition of a parameter
+        https://bugs.webkit.org/show_bug.cgi?id=84994
+
+        Rubber stamped by Oliver Hunt.
+
+        There is a bug that we always re-add the original property before
+        redefinition, doing so in a way that will reset the attributes
+        without checking configurability.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+            - Only instantiate the property once - do not re-add if
+              it has already been added, or if it has been deleted.
+
+2012-04-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove an erroneous assertion after r115655.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::toUStringWithRadix):
+
+2012-04-30  Myles Maxfield  <mmaxfield@google.com>
+
+        End of Interpreter::tryCacheGetByID can trigger the garbage collector
+        https://bugs.webkit.org/show_bug.cgi?id=84927
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+
+2012-04-30  Benjamin Poulain  <benjamin@webkit.org>
+
+        jsSingleCharacterString and jsSingleCharacterSubstring are not inlined
+        https://bugs.webkit.org/show_bug.cgi?id=85147
+
+        Reviewed by Darin Adler.
+
+        The functions jsSingleCharacterString() and jsSingleCharacterSubstring() were not inlined
+        by the compiler. This annihilate the gains of using SmallStrings.
+
+        On stringProtoFuncCharAt(), this patch improves the performance by 11%.
+
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+
+2012-04-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        Add fast patch for radix == 10 on numberProtoFuncToString
+        https://bugs.webkit.org/show_bug.cgi?id=85120
+
+        Reviewed by Darin Adler.
+
+        When radix, we use to turn the doubleValue into a JSValue just to convert
+        it to a String. The problem is that was using the slow path for conversion and
+        for the toString() operation.
+
+        This patch shortcuts the creation of a JSValue and uses NumericStrings directly.
+        The conversion is split between Integer and Double to ensure the fastest conversion
+        for the common case of integer arguments.
+
+        Converting number with radix 10 becomes 5% faster.
+
+        Due to the simpler conversion of number to string for integer, converting
+        integers that do not fall in the two previous optimizations get 32% faster.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::extractRadixFromArgs):
+        (JSC::integerValueToString):
+        (JSC::numberProtoFuncToString):
+
+2012-04-30  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header.
+
+2012-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Factored threaded block allocation into a separate object
+        https://bugs.webkit.org/show_bug.cgi?id=85148
+
+        Reviewed by Sam Weinig.
+
+        99% of this patch just moves duplicated block allocation and 
+        deallocation code into a new object named BlockAllocator, with these 
+        exceptions:
+
+        * heap/BlockAllocator.h: Added.
+        (BlockAllocator::BlockAllocator): The order of declarations here now 
+        guards us against an unlikely race condition during startup.
+
+        * heap/BlockAllocator.cpp:
+        JSC::BlockAllocator::blockFreeingThreadMain): Added a FIXME to 
+        highlight a lack of clarity we have in our block deallocation routines.
+
+2012-04-28  Sam Weinig  <sam@webkit.org>
+
+        Try to fix the Qt build.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+
+2012-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Clarified JSGlobalData (JavaScript VM) lifetime
+        https://bugs.webkit.org/show_bug.cgi?id=85142
+
+        Reviewed by Anders Carlsson.
+
+        This was so confusing that I didn't feel like I could reason about 
+        memory lifetime in the heap without fixing it.
+
+        The rules are:
+
+        (1) JSGlobalData owns the virtual machine and all memory in it.
+
+        (2) Deleting a JSGlobalData frees the virtual machine and all memory 
+        in it.
+
+        (Caveat emptor: if you delete the virtual machine while you're running 
+        JIT code or accessing GC objects, you're gonna have a bad time.)
+
+        (I opted not to make arbitrary sub-objects keep the virtual machine 
+        alive automatically because:
+
+                (a) doing that right would be complex and slow;
+
+                (b) in the case of an exiting thread or process, there's no 
+                clear way to give the garbage collector a chance to try again 
+                later; 
+
+                (c) continuing to run the garbage collector after we've been 
+                asked to shut down the virtual machine seems rude;
+
+                (d) we've never really supported that feature, anyway.)
+
+        (3) Normal ref-counting will do. No need to call a battery of 
+        specialty functions to tear down a JSGlobalData. Its foibles 
+        notwithstanding, C++ does in fact know how to execute destructors in 
+        order.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Removed compatibility shim for older 
+        operating systems because it's no longer used.
+
+        (JSGlobalContextRelease): Now that we can rely on JSGlobalData to "do 
+        the right thing", this code is much simpler. We still have one special 
+        case to notify the garbage collector if we're removing the last 
+        reference to the global object, since this can improve memory behavior.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::freeAllBlocks):
+        * heap/CopiedSpace.h:
+        (CopiedSpace): Renamed "destroy" => "freeAllBlocks" because true 
+        destruction-time behaviors should be limited to our C++ destructor.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::~Heap):
+        (JSC):
+        (JSC::Heap::lastChanceToFinalize):
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::heap): Renamed "destroy" => "lastChanceToFinalize" because 
+        true destruction-time behaviors should be limited to our C++ 
+        destructor.
+
+        Reorganized the code, putting code that must run before any objects 
+        get torn down into lastChanceToFinalize, and code that just tears down 
+        objects into our destructor.
+
+        * heap/Local.h:
+        (JSC::LocalStack::LocalStack):
+        (JSC::LocalStack::push):
+        (LocalStack): See rule (2).
+
+        * jsc.cpp:
+        (functionQuit):
+        (main):
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+        * testRegExp.cpp:
+        (main):
+        (printUsageStatement):
+        (parseArguments):
+        (realMain): See rule (3).
+
+        I removed the feature of ensuring orderly tear-down when calling quit()
+        or running in --help mode because it didn't seem very useful and 
+        making it work with Windows structured exception handling and 
+        NO_RETURN didn't seem like a fun way to spend a Saturday.
+
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Moved heap to be the first data 
+        member in JSGlobalData to ensure that it's destructed last, so other 
+        objects that reference it destruct without crashing. This allowed me 
+        to remove clearBuiltinStructures() altogether, and helped guarantee 
+        rule (3).
+
+        (JSC::JSGlobalData::~JSGlobalData): Explicitly call 
+        lastChanceToFinalize() at the head of our destructor to ensure that 
+        all pending finalizers run while the virtual machine is still in a 
+        valid state. Trying to resurrect (re-ref) the virtual machine at this 
+        point is not valid, but all other operations are.
+
+        Changed a null to a 0xbbadbeef to clarify just how bad this beef is.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::globalData): See rule (3).
+
+2012-04-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * heap/WeakBlock.h:
+        (WeakBlock):
+
+2012-04-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Made WeakSet::allocate() static and removed its JSGlobalData argument
+        https://bugs.webkit.org/show_bug.cgi?id=85128
+
+        Reviewed by Anders Carlsson.
+
+        This is a step toward faster finalization.
+
+        WeakSet::allocate() now deduces which WeakSet to allocate from based on
+        its JSCell* argument. (Currently, there's only one WeakSet, but soon
+        there will be many.)
+
+        This was a global replace of "globalData.heap.weakSet()->allocate" with
+        "WeakSet::allocate", plus by-hand removal of the JSGlobalData argument.
+
+        * heap/WeakSetInlines.h: Copied from Source/JavaScriptCore/heap/WeakSet.h.
+
+        I had to split out WeakSet::allocate() in to a separate header to avoid
+        a cycle.
+
+        (JSC::WeakSet::allocate): We can mask the pointer we're passed to
+        figure out where to allocate our WeakImpl. (Soon, we'll use this to
+        associate the WeakImpl with the GC block it references.)
+
+2012-04-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Stop using aligned allocation for WeakBlock
+        https://bugs.webkit.org/show_bug.cgi?id=85124
+
+        Reviewed by Anders Carlsson.
+
+        We don't actually use the alignment for anything.
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::WeakBlock): Switched from aligned allocation to regular
+        allocation.
+
+        * heap/WeakBlock.h:
+        (WeakBlock): Don't use HeapBlock because HeapBlock requires aligned
+        allocation. This change required me to add some declarations that we used
+        to inherit from HeapBlock.
+
+        (WeakBlock::blockFor): Removed. This function relied on aligned allocation
+        but didn't do anything for us.
+
+        (WeakBlock::deallocate): Removed. WeakBlock doesn't own any of the deallocation
+        logic, so it shouldn't own the function.
+
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::~WeakSet):
+        (JSC::WeakSet::finalizeAll):
+        (JSC::WeakSet::visitLiveWeakImpls):
+        (JSC::WeakSet::visitDeadWeakImpls):
+        (JSC::WeakSet::sweep):
+        (JSC::WeakSet::shrink):
+        (JSC::WeakSet::resetAllocator):
+        (JSC::WeakSet::tryFindAllocator):
+        * heap/WeakSet.h:
+        (WeakSet): Updated declarations to reflect WeakBlock not inheriting from
+        HeapBlock. This allowed me to remove some casts, which was nice.
+
+        (JSC::WeakSet::deallocate): Directly set the deallocated flag instead of
+        asking WeakBlock to do it for us.  We don't need to have a WeakBlock
+        pointer to set the flag, so stop asking for one.
+
+2012-04-27  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] Implement a helper method createNotEnoughArgumentsError()
+        https://bugs.webkit.org/show_bug.cgi?id=85102
+
+        Reviewed by Geoffrey Garen.
+
+        In bug 84787, kbr@ requested to avoid hard-coding
+        createTypeError(exec, "Not enough arguments") here and there.
+        This patch implements createNotEnoughArgumentsError(exec)
+        and uses it in JSC bindings.
+
+        c.f. a corresponding bug for V8 bindings is bug 85097.
+
+        * runtime/Error.cpp:
+        (JSC::createNotEnoughArgumentsError):
+        (JSC):
+        * runtime/Error.h:
+        (JSC):
+
+2012-04-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Only allow non-null pointers in the WeakSet
+        https://bugs.webkit.org/show_bug.cgi?id=85119
+
+        Reviewed by Darin Adler.
+
+        This is a step toward more efficient finalization.
+
+        No clients put non-pointers (JSValues) into Weak<T> and PassWeak<T>.
+
+        Some clients put null pointers into Weak<T> and PassWeak<T>, but this is
+        more efficient and straight-forward to model with a null in the Weak<T>
+        or PassWeak<T> instead of allocating a WeakImpl just to hold null.
+
+        * heap/PassWeak.h:
+        (JSC): Removed the Unknown (JSValue) type of weak pointer because it's
+        unused now.
+
+        (PassWeak): Don't provide a default initializer for our JSCell* argument.
+        This feature was only used in one place, and it was a bug.
+
+        (JSC::::get): Don't check for a null stored inside our WeakImpl: that's 
+        not allowed anymore.
+
+        (JSC::PassWeak::PassWeak): Handle null as a null WeakImpl instead of
+        allocating a WeakImpl and storing null into it.
+
+        * heap/Weak.h:
+        (Weak):
+        (JSC::::Weak): Same changes as in PassWeak<T>.
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::visitLiveWeakImpls):
+        (JSC::WeakBlock::visitDeadWeakImpls): Only non-null cells are valid in
+        the WeakSet now, so no need to check for non-cells and null cell pointers.
+
+        * heap/WeakImpl.h:
+        (JSC::WeakImpl::WeakImpl): Only non-null cells are valid in the WeakSet
+        now, so ASSERT that.
+
+2012-04-27  Gavin Barraclough  <barraclough@apple.com>
+
+        <rdar://problem/7909395> Math in JavaScript is inaccurate on iOS
+
+        By defalut IEEE754 denormal support is disabled on iOS;
+        turn it on.
+
+        Reviewed by Filip Pizlo.
+
+        * jsc.cpp:
+        (main):
+            - clear the appropriate bit in the fpscr.
+
+2012-04-27  Michael Saboff  <msaboff@apple.com>
+
+        Memory wasted in JSString for non-rope strings
+        https://bugs.webkit.org/show_bug.cgi?id=84907
+
+        Reviewed by Geoffrey Garen.
+
+        Split JSString into two classes, JSString as a base class that does not
+        include the fibers of a Rope, and a subclass JSRopeString that has the
+        rope functionality.  Both classes "share" the same ClassInfo.  Added
+        a bool to JSString to indicate that the string was allocated as a JSRopeString
+        to properly handle visiting the fiber children when the rope is resolved and
+        the JSRopeString appears as a JSString.  Didn't change the interface of JSString
+        to require any JIT changes.
+
+        As part of this change, removed "cellSize" from ClassInfo since both classes
+        share the same ClassInfo, but have different sizes.  The only use I could find
+        for cellSize was an ASSERT in allocateCell().
+
+        This appears to be neutral on performance tests.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Changed JSString::resolveRope
+                to JSRopeString::resolveRope
+        * runtime/ClassInfo.h:
+        (JSC):
+        (ClassInfo):
+        * runtime/JSCell.h:
+        (JSC::allocateCell):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::RopeBuilder::expand):
+        (JSC::JSString::visitChildren):
+        (JSC):
+        (JSC::JSRopeString::visitFibers):
+        (JSC::JSRopeString::resolveRope):
+        (JSC::JSRopeString::resolveRopeSlowCase8):
+        (JSC::JSRopeString::resolveRopeSlowCase):
+        (JSC::JSRopeString::outOfMemory):
+        (JSC::JSRopeString::getIndexSlowCase):
+        * runtime/JSString.h:
+        (JSC):
+        (JSString):
+        (JSC::JSString::finishCreation):
+        (JSC::JSString::create):
+        (JSC::JSString::isRope):
+        (JSC::JSString::is8Bit):
+        (JSRopeString):
+        (RopeBuilder):
+        (JSC::JSRopeString::RopeBuilder::RopeBuilder):
+        (JSC::JSRopeString::RopeBuilder::append):
+        (JSC::JSRopeString::RopeBuilder::release):
+        (JSC::JSRopeString::RopeBuilder::length):
+        (JSC::JSRopeString::JSRopeString):
+        (JSC::JSRopeString::finishCreation):
+        (JSC::JSRopeString::createNull):
+        (JSC::JSRopeString::create):
+        (JSC::JSString::value):
+        (JSC::JSString::tryGetValue):
+        (JSC::JSString::getIndex):
+        (JSC::jsStringBuilder):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsStringFromArguments):
+
+2012-04-27  Oliver Hunt  <oliver@apple.com>
+
+        Correct assertion.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2012-04-27  Oliver Hunt  <oliver@apple.com>
+
+        Lazy link phase of baseline jit fails to propagate exception
+        https://bugs.webkit.org/show_bug.cgi?id=85092
+
+        Reviewed by Filip Pizlo.
+
+        Very simple patch, when linking produces an error we need to actually store
+        the exception prior to throwing it.  I can't find any other examples of this,
+        but as we're already in the slow path when throwing an exception I've hardened
+        exception throwing against null exceptions.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        * jit/JITStubs.cpp:
+        (JSC::lazyLinkFor):
+
+2012-04-27  Benjamin Poulain  <benjamin@webkit.org>
+
+        Generalize the single character optimization of numberProtoFuncToString
+        https://bugs.webkit.org/show_bug.cgi?id=85027
+
+        Reviewed by Geoffrey Garen.
+
+        The function numberProtoFuncToString() has an optimization to use SmallStrings::singleCharacterString()
+        when the radix is 36.
+
+        This patch generalize the optimization for any radix. Any positive number smaller than its radix
+        can be represented by a single character of radixDigits.
+
+        This makes numberProtoFuncToString() about twice as fast for this case of single digit conversion.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+
+2012-04-27  Gavin Peters  <gavinp@chromium.org>
+
+        Add new ENABLE_LINK_PRERENDER define to control the Prerendering API
+        https://bugs.webkit.org/show_bug.cgi?id=84871
+
+        Reviewed by Adam Barth.
+
+        Prerendering is currently covered by the ENABLE_LINK_PREFETCH macro, but the new Prerendering
+        API separates it from prefetching.  Having separate include guards lets ports enable prefetching,
+        a relatively easy change, without needing to build the infrastructure for prerendering, which
+        is considerably more complicated.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Allocating WeakImpl should not trigger GC, as that makes the world very tricksy.
+        https://bugs.webkit.org/show_bug.cgi?id=85020
+
+        Reviewed by Gavin Barraclough.
+
+        Now in the event that we are unable to find an allocator for a new handle, just
+        add a new allocator rather than trying to recover "dead" handles through a GC.
+
+        Find allocator is now much simpler, and addAllocator directly reports the
+        increased memory usage to the heap without causing any GC to happen immediately.
+
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::findAllocator):
+        (JSC::WeakSet::addAllocator):
+
+2012-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Remove RegisterFile::end()/m_end
+        https://bugs.webkit.org/show_bug.cgi?id=85011
+
+        Reviewed by Gavin Barraclough.
+
+        Get rid of end() and m_end from RegisterFile.  From now on
+        we only care about the end of the committed region when calling
+        code.  When re-entering the VM we now plant the new CallFrame
+        immediately after whatever the current topCallFrame is.  This
+        required adding a routine to CallFrame to determine exactly what
+        we should be doing (in the absence of an existing CallFrame, we
+        can't reason about the frameExtent() so we check for that).
+
+        This also now means that the GC only marks the portion of the
+        RegisterFile that is actually in use, and that VM re-entry doesn't
+        exhaust the RegisterFile as rapidly.
+
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        (JSC::ExecState::startOfReusableRegisterFile):
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::execute):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::growSlowCase):
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::commitEnd):
+        (JSC::RegisterFile::addressOfEnd):
+        (RegisterFile):
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::handleHostCall):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+
+2012-04-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ARMv7 backend should optimize Float32 arrays
+        https://bugs.webkit.org/show_bug.cgi?id=85000
+        <rdar://problem/10652827>
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::flds):
+        (JSC::ARMv7Assembler::fsts):
+        (JSC::ARMv7Assembler::vcvtds):
+        (JSC::ARMv7Assembler::vcvtsd):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadFloat):
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::storeFloat):
+        (JSC::MacroAssemblerARMv7::convertFloatToDouble):
+        (JSC::MacroAssemblerARMv7::convertDoubleToFloat):
+        * bytecode/PredictedType.h:
+        (JSC::isActionableFloatMutableArrayPrediction):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateFloat32Array):
+
+2012-04-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add a version of StringImpl::find() without offset
+        https://bugs.webkit.org/show_bug.cgi?id=83968
+
+        Reviewed by Sam Weinig.
+
+        Add support for the new StringImpl::find() to UString.
+
+        Change stringProtoFuncIndexOf() to specifically take advatage of the feature.
+        This gives a 12% gains on a distribution of strings between 30 and 100 characters.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences):
+        (JSC::stringProtoFuncIndexOf):
+        * runtime/UString.h:
+        (UString):
+        (JSC::UString::find):
+
+2012-04-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        WebCore shouldn't call collectAllGarbage directly
+        https://bugs.webkit.org/show_bug.cgi?id=84897
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Exported symbol 
+        for reportAbanondedObjectGraph so WebCore can use it.
+        * heap/Heap.h: Ditto.
+
+2012-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Biolab disaster crashes on ToT
+        https://bugs.webkit.org/show_bug.cgi?id=84898
+
+        Reviewed by Filip Pizlo.
+
+        Whoops, committed without saving reviewer requested change.
+
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Biolab disaster crashes on ToT
+        https://bugs.webkit.org/show_bug.cgi?id=84898
+
+        Reviewed by Filip Pizlo.
+
+        I recently added an assertion to the Interpreter to catch incorrect
+        updates of topCallFrame.  This caused a bunch of sites (including biolab
+        disaster) to crash as we were not correctly handling callee registers
+        of inlined functions, leading to a mismatch.
+
+        I could not actually make this trigger directly, although it does trigger
+        already on some of the GTK and QT bots.
+
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-04-25  Kenneth Russell  <kbr@google.com>
+
+        Delete CanvasPixelArray, ByteArray, JSByteArray and JSC code once unreferenced
+        https://bugs.webkit.org/show_bug.cgi?id=83655
+
+        Reviewed by Oliver Hunt.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionToAbbreviatedString):
+        (JSC::predictionFromClassInfo):
+        * bytecode/PredictedType.h:
+        (JSC):
+        (JSC::isActionableIntMutableArrayPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueSource::forPrediction):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSByteArray.cpp: Removed.
+        * runtime/JSByteArray.h: Removed.
+        * runtime/JSGlobalData.cpp:
+
+2012-04-25  Filip Pizlo  <fpizlo@apple.com>
+
+        http://bellard.org/jslinux/ triggers an assertion failure in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=84815
+        <rdar://problem/11319514>
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+
+2012-04-25  Michael Saboff  <msaboff@apple.com>
+
+        Closure in try {} with catch captures all locals from the enclosing function
+        https://bugs.webkit.org/show_bug.cgi?id=84804
+
+        Reviewed by Oliver Hunt.
+
+        Changed the capturing of local variables from capturing when eval is used,
+        within a "with" or within a "catch" to be just when an eval is used.
+        Renamed the function returning that we should capture from
+        getCapturedVariables() to usesEval(), since that what it noew returns.
+        Needed to fix the "with" code to only range check when the activation
+        has actually been torn off.  Added m_isTornOff to JSActivation to
+        track this.
+
+        * parser/Parser.h:
+        (JSC::Scope::usesEval):
+        (JSC::Scope::getCapturedVariables):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        * runtime/JSActivation.h:
+        (JSActivation):
+        (JSC::JSActivation::tearOff):
+
+2012-04-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GC Activity Callback timer should be based on how much has been allocated since the last collection
+        https://bugs.webkit.org/show_bug.cgi?id=84763
+
+        Reviewed by Geoffrey Garen.
+
+        The desired behavior for the GC timer is to collect at some point in the future, 
+        regardless of how little we've allocated. A secondary goal, which is almost if not 
+        as important, is for the timer to collect sooner if there is the potential to 
+        collect a greater amount of memory. Conversely, as we allocate more memory we'd 
+        like to reduce the delay to the next collection. If we're allocating quickly enough, 
+        the timer should be preempted in favor of a normal allocation-triggered collection. 
+        If allocation were to slow or stop, we'd like the timer to be able to opportunistically 
+        run a collection without us having to allocate to the hard limit set by the Heap.
+
+        This type of policy can be described in terms of the amount of CPU we are willing 
+        to dedicate to reclaim a single MB of memory. For example, we might be willing to 
+        dedicate 1% of our CPU to reclaim 1 MB. We base our CPU usage off of the length of 
+        the last collection, e.g. if our last collection took 1ms, we would want to wait about 
+        100ms before running another collection to reclaim 1 MB. These constants should be 
+        tune-able, e.g. 0.1% CPU = 1 MB vs. 1% CPU = 1 MB vs. 10% CPU = 1 MB.
+
+        * API/JSBase.cpp: Use the new reportAbandonedObjectGraph.
+        (JSGarbageCollect):
+        * API/JSContextRef.cpp: Ditto.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportAbandonedObjectGraph): Similar to reportExtraMemoryCost. Clients call
+        this function to notify the Heap that some unknown number of JSC objects might have just 
+        been abandoned and are now garbage. The Heap might schedule a new collection timer based 
+        on this notification.
+        (JSC):
+        (JSC::Heap::collect): Renamed m_lastFullGCSize to the less confusing m_sizeAfterLastCollect.
+        * heap/Heap.h:
+        (Heap):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::zapFreeList): Fixed a bug in zapFreeList that failed to nullify the 
+        current allocator's FreeList once zapping was complete.
+        * runtime/GCActivityCallback.cpp: Removed didAbandonObjectGraph because it was replaced by 
+        Heap::reportAbandonedObjectGraph.
+        (JSC):
+        * runtime/GCActivityCallback.h:
+        (JSC::GCActivityCallback::willCollect):
+        (DefaultGCActivityCallback):
+        * runtime/GCActivityCallbackCF.cpp: Refactored the GC timer code so that we now schedule the 
+        timer based on how much we have allocated since the last collection up to a certain amount. 
+        We use the length of the previous GC to try to keep our total cost of opportunistic timer-triggered
+        collections around 1% of the CPU per MB of garbage we expect to reclaim up to a maximum of 5 MB.
+        (DefaultGCActivityCallbackPlatformData):
+        (JSC):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::commonConstructor):
+        (JSC::scheduleTimer):
+        (JSC::cancelTimer):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+
+2012-04-24  Michael Saboff  <msaboff@apple.com>
+
+        objectProtoFuncToString creates new string every invocation
+        https://bugs.webkit.org/show_bug.cgi?id=84781
+
+        Reviewed by Geoffrey Garen.
+
+        Cache the results of object toString() in the attached Structure.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren): visit new m_hasObjectToStringValue.
+        * runtime/Structure.h: Added new member m_hasObjectToStringValue
+        (JSC):
+        (JSC::Structure::objectToStringValue):
+        (Structure):
+        (JSC::Structure::setObjectToStringValue):
+
+2012-04-24  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=84727.
+        Fix build when ENABLE_JIT_CONSTANT_BLINDING enabled.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::or32):
+        (JSC::MacroAssemblerSH4::and32):
+        (JSC::MacroAssemblerSH4::lshift32):
+        (JSC::MacroAssemblerSH4::xor32):
+        (JSC::MacroAssemblerSH4::branchSub32):
+        (JSC::MacroAssemblerSH4::urshift32):
+
+2012-04-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Add explicit patchableBranchPtrWithPatch/patchableJump methods
+        https://bugs.webkit.org/show_bug.cgi?id=84498
+
+        Reviewed by Filip Pizlo.
+
+        Don't rely on inUninterruptedSequence to distinguish which jumps we need to be able to repatch.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchableJump::PatchableJump):
+        (PatchableJump):
+        (JSC::AbstractMacroAssembler::PatchableJump::operator Jump&):
+        (AbstractMacroAssembler):
+        (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
+            - Added PatchableJump type, removed inUninterruptedSequence.
+        * assembler/LinkBuffer.h:
+        (LinkBuffer):
+        (JSC::LinkBuffer::locationOf):
+            - Only allow the location to be taken of patchable branches
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::patchableBranchPtrWithPatch):
+        (JSC::MacroAssembler::patchableJump):
+        (JSC::MacroAssembler::shouldBlind):
+            - Added default implementation of patchableBranchPtrWithPatch, patchableJump.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::MacroAssemblerARMv7):
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::patchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::patchableJump):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+            - Added ARMv7 implementation of patchableBranchPtrWithPatch, patchableJump.
+        * dfg/DFGCorrectableJumpPoint.h:
+        (DFG):
+        (JSC::DFG::CorrectableJumpPoint::switchToLateJump):
+            - Late jumps are PatchableJumps.
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+            - replace use of inUninterruptedSequence
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+        (PropertyAccessRecord):
+            - replace use of inUninterruptedSequence
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+            - replace use of inUninterruptedSequence
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+            - replace use of inUninterruptedSequence
+        * jit/JIT.h:
+        (PropertyStubCompilationInfo):
+            - replace use of inUninterruptedSequence
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::endUninterruptedSequence):
+            - replace use of inUninterruptedSequence
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+            - replace use of inUninterruptedSequence
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+            - replace use of inUninterruptedSequence
+
+2012-04-24  Benjamin Poulain  <bpoulain@apple.com>
+
+        Generalize the single character optimization of r114072
+        https://bugs.webkit.org/show_bug.cgi?id=83961
+
+        Reviewed by Eric Seidel.
+
+        Use the regular String::find(StringImpl*) in all cases now that it has been made faster.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingStringSearch):
+
+2012-04-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, 32-bit build fix.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-04-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG performs incorrect DCE on (some?) intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=84746
+        <rdar://problem/11310772>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::setIntrinsicResult):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-04-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Failure to allocate ArrayStorage in emit_op_new_array leads to poisonous JSArray
+        https://bugs.webkit.org/show_bug.cgi?id=84648
+
+        Reviewed by Geoffrey Garen.
+
+        When emit_op_new_array successfully allocates a new JSArray but fails to allocate 
+        the corresponding ArrayStorage for it, it falls back to the out-of-line stub call 
+        to constructArray, which constructs and entirely new JSArray/ArrayStorage pair. 
+        This leaves us with a JSArray hanging around on the stack or in a register that 
+        did not go through its own constructor, thus giving it uninitialized memory in the 
+        two fields that are checked in JSArray::visitChildren.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateJSArray): We try to allocate the ArrayStorage first, so that 
+        if we fail we haven't generated the poisonous JSArray that can cause a GC crash.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_new_array):
+
+2012-04-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG on ARMv7 should not OSR exit on every integer division
+        https://bugs.webkit.org/show_bug.cgi?id=84661
+
+        Reviewed by Oliver Hunt.
+        
+        On ARMv7, ArithDiv no longer has to know whether or not to speculate integer (since
+        that was broken with the introduction of Int32ToDouble) nor does it have to know
+        whether or not to convert its result to integer. This is now taken care of for free
+        with the addition of the DoubleAsInt32 node, which represents a double-is-really-int
+        speculation.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-04-24  Geoffrey Garen  <ggaren@apple.com>
+
+        "GlobalHandle" HandleHeap (now WeakSet) allocations grow but do not shrink
+        https://bugs.webkit.org/show_bug.cgi?id=84740
+        <rdar://problem/9917638>
+
+        Reviewed by Gavin Barraclough.
+
+        Shrink!
+
+        * heap/Heap.cpp:
+        (JSC::Heap::destroy): Be more specific about what's shrinking, since we
+        can also shrink the WeakSet, but we don't do so here.
+
+        (JSC::Heap::collect): If we're going to shrink the heap, shrink the
+        WeakSet too. Otherwise, its footprint is permanent.
+
+        * heap/Heap.h:
+        (Heap): Removed shrink() as a public interface, since it's vague about
+        which parts of the heap it affects, and it's really an internal detail.
+
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::shrink): Nix any free blocks. We assume that sweep() has
+        already taken place, since that's the convention for shrink() in the heap.
+
+        * heap/WeakSet.h:
+        (WeakSet): New function!
+
+2012-04-24  Adam Klein  <adamk@chromium.org>
+
+        Fix includes in StrongInlines.h and ScriptValue.h
+        https://bugs.webkit.org/show_bug.cgi?id=84659
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/StrongInlines.h: Include JSGlobalData.h, since JSGlobalData's
+        definiition is required here.
+
+2012-04-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit should ensure that all variables have been initialized
+        https://bugs.webkit.org/show_bug.cgi?id=84653
+        <rdar://problem/11258183>
+
+        Reviewed by Gavin Barraclough.
+        
+        Initialize all uncaptured dead variables to undefined on OSR exit.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+
+2012-04-23  Oliver Hunt  <oliver@apple.com>
+
+        Call instruction for the baseline JIT stores origin info in wrong callframe
+        https://bugs.webkit.org/show_bug.cgi?id=84645
+
+        Reviewed by Gavin Barraclough.
+
+        The baseline JIT was updating the wrong callframe when making a call.  If the
+        call failed during dispatch (unable to perform codegen, calling a non-object)
+        we would attempt to use this information, but it would be completely wrong.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2012-04-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG must keep alive values that it will perform speculations on
+        https://bugs.webkit.org/show_bug.cgi?id=84638
+        <rdar://problem/11258183>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGNodeType.h:
+        (DFG):
+
+2012-04-23  Oliver Hunt  <oliver@apple.com>
+
+        Fix non-LLInt builds by temporarily removing an over-enthusiastic assertion
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeCall):
+
+2012-04-22  Jon Lee  <jonlee@apple.com>
+
+        Remove notifications support on Mac Lion.
+        https://bugs.webkit.org/show_bug.cgi?id=84554
+        <rdar://problem/11297128>
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-04-21  Darin Adler  <darin@apple.com>
+
+        Change JavaScript lexer to use 0 instead of -1 for sentinel, eliminating the need to put characters into ints
+        https://bugs.webkit.org/show_bug.cgi?id=84523
+
+        Reviewed by Oliver Hunt.
+
+        Profiles showed that checks against -1 were costly, and I saw they could be eliminated.
+        Streamlined this code to use standard character types and 0 rather than -1. One benefit
+        of this is that there's no widening and narrowing. Another is that there are many cases
+        where we already have the correct behavior for 0, so can eliminate a branch that was
+        used to test for -1 before. Also eliminates typecasts in the code.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::invalidCharacterMessage): Updated use of String::format since m_current is now a
+        character type, not an int.
+        (JSC::Lexer::setCode): Use 0 rather than -1 when past the end.
+        (JSC::Lexer::shift): Ditto. Also spruced up the comment a bit.
+        (JSC::Lexer::atEnd): Added. New function that distinguishes an actual 0 character from the end
+        of the code. This can be used places we used to cheeck for -1.
+        (JSC::Lexer::peek): Updated to use -1 instead of 0. Removed meaningless comment.
+        (JSC::Lexer::parseFourDigitUnicodeHex): Changed to use character types instead of int.
+        (JSC::Lexer::shiftLineTerminator): Removed now-unneeded type casts. Changed local variable that
+        had a data-member-style name.
+        (JSC::Lexer::parseIdentifier): Removed now-unneeded explicit checks for -1, since the isIdentPart
+        function already returns false for the 0 character. Updated types in a couple other places. Used
+        the atEnd function where needed.
+        (JSC::Lexer::parseIdentifierSlowCase): More of the same.
+        (JSC::characterRequiresParseStringSlowCase): Added overloaded helper function for parseString.
+        (JSC::Lexer::parseString): Ditto.
+        (JSC::Lexer::parseStringSlowCase): Ditto.
+        (JSC::Lexer::parseMultilineComment): Ditto.
+        (JSC::Lexer::lex): More of the same. Also changed code to set the startOffset directly in
+        the tokenInfo instead of putting it in a local variable first, saving some memory access.
+        (JSC::Lexer::scanRegExp): Ditto.
+        (JSC::Lexer::skipRegExp): Ditto.
+
+        * parser/Lexer.h: Changed return type of the peek function and type of m_current from int to
+        the character type. Added atEnd function.
+        (JSC::Lexer::setOffset): Used 0 instead of -1 and removed an overzealous attempt to optimize. 
+        (JSC::Lexer::lexExpectIdentifier): Used 0 instead of -1.
+
+2012-04-21  Darin Adler  <darin@apple.com>
+
+        Change JavaScript lexer to use 0 instead of -1 for sentinel, eliminating the need to put characters into ints
+        https://bugs.webkit.org/show_bug.cgi?id=84523
+
+        Reviewed by Oliver Hunt.
+
+        Separate preparation step of copyright dates, renaming, and other small tweaks.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::invalidCharacterMessage): Removed "get" from name to match WebKit naming conventions.
+        (JSC::Lexer::peek): Removed meaningless comment.
+        (JSC::Lexer::parseFourDigitUnicodeHex): Renamed from getUnicodeCharacter to be more precise about
+        what this function does.
+        (JSC::Lexer::shiftLineTerminator): Renamed local variable that had a data-member-style name.
+        (JSC::Lexer::parseStringSlowCase): Updated for new name of parseFourDigitUnicodeHex.
+        (JSC::Lexer::lex): Updated for new name of invalidCharacterMessage.
+
+        * parser/Lexer.h: Removed an unneeded forward declaration of the RegExp class.
+        Renamed getInvalidCharMessage to invalidCharacterMessage and made it const. Renamed
+        getUnicodeCharacter to parseFourDigitUnicodeHex.
+
+2012-04-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize int8 and int16 arrays on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=84503
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::ldrsb):
+        (JSC::ARMv7Assembler::ldrsh):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load16Signed):
+        (JSC::MacroAssemblerARMv7::load8Signed):
+        * bytecode/PredictedType.h:
+        (JSC::isActionableIntMutableArrayPrediction):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateInt8Array):
+        (JSC::DFG::Node::shouldSpeculateInt16Array):
+
+2012-04-20  Oliver Hunt  <oliver@apple.com>
+
+        Add an ability to find the extent of a callframe
+        https://bugs.webkit.org/show_bug.cgi?id=84513
+
+        Reviewed by Filip Pizlo.
+
+        Add a function to get the extent of a callframe and
+        use that function for a new assertion to make sure the
+        RegisterFile makes sense using that information.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::frameExtentInternal):
+        (JSC):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::frameExtent):
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeCall):
+
+2012-04-20  Benjamin Poulain  <bpoulain@apple.com>
+
+        Inline the JSArray constructor
+        https://bugs.webkit.org/show_bug.cgi?id=84416
+
+        Reviewed by Geoffrey Garen.
+
+        The constructor is trivial, no reason to jump for it.
+
+        This makes the creation of array ~5% faster (on non-trivial cases, no empty arrays).
+
+        * runtime/JSArray.cpp:
+        (JSC):
+        * runtime/JSArray.h:
+        (JSC::JSArray::JSArray):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-04-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Heap should cancel GC timer at the start of the collection
+        https://bugs.webkit.org/show_bug.cgi?id=84477
+
+        Reviewed by Geoffrey Garen.
+
+        Currently the Heap cancels the GC timer at the conclusion of a collection. 
+        We should change this to be at the beginning because something (e.g. a finalizer) 
+        could call didAbandonObjectGraph(), which will schedule the timer, but then 
+        we'll immediately unschedule the timer at the conclusion of the collection, 
+        thus potentially preventing large swaths of memory from being reclaimed in a timely manner.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect): Remove outdated fix-me and remove check for whether the Heap is 
+        busy or not, since we're just scheduling a timer to run a GC in the future.
+        * heap/Heap.cpp:
+        (JSC::Heap::collect): Rename didCollect to willCollect and move the call to the 
+        top of Heap::collect.
+        * runtime/GCActivityCallback.cpp: Renamed didCollect to willCollect.
+        (JSC::DefaultGCActivityCallback::willCollect):
+        * runtime/GCActivityCallback.h: Ditto.
+        (JSC::GCActivityCallback::willCollect):
+        (DefaultGCActivityCallback): 
+        * runtime/GCActivityCallbackCF.cpp: Ditto.
+        (JSC::DefaultGCActivityCallback::willCollect):
+
+2012-04-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSGarbageCollect should not call collectAllGarbage()
+        https://bugs.webkit.org/show_bug.cgi?id=84476
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect): Notify the Heap's GCActivityCallback using didAbandonObjectGraph.
+
+2012-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Exception stack traces aren't complete when the exception starts in native code
+        https://bugs.webkit.org/show_bug.cgi?id=84073
+
+        Reviewed by Filip Pizlo.
+
+        Refactored building the stack trace to so that we can construct
+        it earlier, and don't rely on any prior work performed in the
+        exception handling machinery. Also updated LLInt and the DFG to
+        completely initialise the callframes of host function calls.
+
+        Also fixed a few LLInt paths that failed to correctly update the
+        topCallFrame.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC):
+        (JSC::Interpreter::throwException):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jsc.cpp:
+        (functionJSCStack):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::handleHostCall):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        (JSC::throwError):
+        * runtime/Error.h:
+        (JSC):
+
+2012-04-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        We're collecting pathologically due to small allocations
+        https://bugs.webkit.org/show_bug.cgi?id=84404
+
+        Reviewed by Geoffrey Garen.
+
+        No change in performance on run-jsc-benchmarks.
+
+        * dfg/DFGSpeculativeJIT.h: Replacing m_firstFreeCell with m_freeList.
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        * heap/CopiedSpace.cpp: Getting rid of any water mark related stuff, since it's no 
+        longer useful. 
+        (JSC::CopiedSpace::CopiedSpace):
+        (JSC::CopiedSpace::tryAllocateSlowCase): We now only call didAllocate here rather than 
+        carrying out a somewhat complicated accounting job for our old water mark throughout CopiedSpace.
+        (JSC::CopiedSpace::tryAllocateOversize):  Call the new didAllocate to notify the Heap of 
+        newly allocated stuff.
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::destroy):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::startedCopying):
+        * heap/Heap.cpp: Removed water mark related stuff, replaced with new bytesAllocated and 
+        bytesAllocatedLimit to track how much memory has been allocated since the last collection.
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportExtraMemoryCostSlowCase):
+        (JSC::Heap::collect): We now set the new limit of bytes that we can allocate before triggering 
+        a collection to be the size of the Heap after the previous collection. Thus, we still have our 
+        2x allocation amount.
+        (JSC::Heap::didAllocate): Notifies the GC activity timer of how many bytes have been allocated 
+        thus far and then adds the new number of bytes to the current total.
+        (JSC):
+        * heap/Heap.h: Removed water mark related stuff.
+        (JSC::Heap::notifyIsSafeToCollect):
+        (Heap):
+        (JSC::Heap::shouldCollect):
+        (JSC):
+        * heap/MarkedAllocator.cpp: 
+        (JSC::MarkedAllocator::tryAllocateHelper): Refactored to use MarkedBlock's new FreeList struct.
+        (JSC::MarkedAllocator::allocateSlowCase):
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h: 
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::allocate): 
+        (JSC::MarkedAllocator::zapFreeList): Refactored to take in a FreeList instead of a FreeCell.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelper):
+        (JSC::MarkedBlock::zapFreeList):
+        * heap/MarkedBlock.h:
+        (FreeList): Added a new struct that keeps track of the current MarkedAllocator's
+        free list including the number of bytes of stuff in the free list so that when the free list is 
+        exhausted, the correct amount can be reported to Heap.
+        (MarkedBlock):
+        (JSC::MarkedBlock::FreeList::FreeList):
+        (JSC):
+        * heap/MarkedSpace.cpp: Removing all water mark related stuff.
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::findAllocator): Refactored to use the didAllocate interface with the Heap. This 
+        function still needs work though now that the Heap knows how many bytes have been allocated 
+        since the last collection.
+        * jit/JITInlineMethods.h: Refactored to use MarkedBlock's new FreeList struct.
+        (JSC::JIT::emitAllocateBasicJSObject): Ditto.
+        * llint/LowLevelInterpreter.asm: Ditto.
+        * runtime/GCActivityCallback.cpp: 
+        (JSC::DefaultGCActivityCallback::didAllocate): 
+        * runtime/GCActivityCallback.h:
+        (JSC::GCActivityCallback::didAllocate): Renamed willAllocate to didAllocate to indicate that 
+        the allocation that is being reported has already taken place.
+        (DefaultGCActivityCallback):
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC):
+        (JSC::DefaultGCActivityCallback::didAllocate): Refactored to return early if the amount of 
+        allocation since the last collection is not above a threshold (initially arbitrarily chosen to 
+        be 128KB). 
+
+2012-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        MacroAssemblerARMv7::branchTruncateDoubleToUint32 should obey the overflow signal
+        https://bugs.webkit.org/show_bug.cgi?id=84401
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchTruncateDoubleToUint32):
+
+2012-04-19  Don Olmstead  <don.olmstead@am.sony.com>
+
+        KeywordLookupGenerator.py should take an output file as an argument
+        https://bugs.webkit.org/show_bug.cgi?id=84292
+
+        Reviewed by Eric Seidel.
+
+        Extended KeywordLookupGenerator to accept an additional argument specifying an output file. If this argument is found stdout is redirected to a file for the duration of the script.
+
+        * KeywordLookupGenerator.py:
+
+2012-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to perform debugCall on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=84381
+
+        Reviewed by Oliver Hunt.
+        
+        debugCall() was clobbering the argument to the call it was making, leading to a
+        corrupt ExecState*. This change fixes that issue by using a scratch register that
+        does not clobber arguments, and it also introduces more assertions that we have
+        a valid call frame.
+
+        * dfg/DFGAssemblyHelpers.cpp:
+        (DFG):
+        (JSC::DFG::AssemblyHelpers::jitAssertHasValidCallFrame):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::selectScratchGPR):
+        (AssemblyHelpers):
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        (JSC::DFG::AssemblyHelpers::jitAssertHasValidCallFrame):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::selectScratchGPR):
+
+2012-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt no-JIT fallback native call trampoline's exception handler incorrectly assumes that
+        the PB/PC has been preserved
+        https://bugs.webkit.org/show_bug.cgi?id=84367
+
+        Reviewed by Oliver Hunt.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to load from Float64 arrays on ARMv7 without crashing
+        https://bugs.webkit.org/show_bug.cgi?id=84361
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+
+2012-04-19  Dominik Röttsches  <dominik.rottsches@linux.intel.com>
+
+        [CMake] Build fix after r114575
+        https://bugs.webkit.org/show_bug.cgi?id=84322
+
+        Reviewed by Simon Hausmann.
+
+        Build fix, adding WTF when linking jsc shell.
+
+        * shell/CMakeLists.txt:
+
+2012-04-18  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC testing should have complete coverage over typed array types
+        https://bugs.webkit.org/show_bug.cgi?id=84302
+
+        Reviewed by Geoff Garen.
+        
+        Added Uint8ClampedArray to the set of typed arrays that are supported by jsc
+        command-line.
+
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+
+2012-04-18  Filip Pizlo  <fpizlo@apple.com>
+
+        jsc command line should support typed arrays by default
+        https://bugs.webkit.org/show_bug.cgi?id=84298
+
+        Rubber stamped by Gavin Barraclough.
+
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+
+2012-04-18  Filip Pizlo  <fpizlo@apple.com>
+
+        JSVALUE32_64 should be able to perform division on ARM without crashing, and variables
+        forced double should not be scrambled when performing OSR entry
+        https://bugs.webkit.org/show_bug.cgi?id=84272
+
+        Reviewed by Geoff Garen.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+
+2012-04-18  Don Olmstead  <don.olmstead@am.sony.com> 
+
+        JavaScriptCore.gypi not current
+        https://bugs.webkit.org/show_bug.cgi?id=84224
+
+        Reviewed by Eric Seidel.
+
+        Updated JavaScriptCore.gypi to contain the latest sources. Removed os-win32 as it wasn't used. Also removed references to ICU files in the gypi file as ICU is most likely specified by the port itself.
+
+        Private and public header files were determined by looking at copy-files.cmd within Apple's Visual Studio directory.
+
+        * JavaScriptCore.gypi:
+
+2012-04-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove m_subclassData from JSArray, move the attribute to subclass as needed
+        https://bugs.webkit.org/show_bug.cgi?id=84249
+
+        Reviewed by Geoffrey Garen.
+
+        JSArray's m_subclassData is only used by WebCore's RuntimeArray. This patch moves
+        the attribute to RuntimeArray to avoid allocating memory for the pointer in the common
+        case.
+
+        This gives ~1% improvement in JSArray creation microbenchmark thanks to fewer allocations
+        of CopiedSpace.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateJSArray):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+
+2012-04-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        replaceUsingStringSearch: delay the creation of the replace string until needed
+        https://bugs.webkit.org/show_bug.cgi?id=83841
+
+        Reviewed by Geoffrey Garen.
+
+        We do not need to obtain the replaceValue until we have a match. By moving the intialization
+        of replaceValue when needed, we save a few instructions when there is no match.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::replaceUsingStringSearch):
+        (JSC::stringProtoFuncReplace):
+
+2012-04-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GC activity timer should be tied to allocation, not collection
+        https://bugs.webkit.org/show_bug.cgi?id=83919
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSContextRef.cpp: Used the new didAbandonObjectGraph callback to indicate that now that we've 
+        released a global object, we're abandoning a potentially large number of objects that JSC might want 
+        to collect.
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase): Added the call to timer's willAllocate function to indicate 
+        that we've hit a slow path and are allocating now, so schedule the timer.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::collectAllGarbage): Removed the call to discardAllCompiledCode because it was causing us to 
+        throw away too much code during our benchmarks (especially vp8, which is very large and thus has large 
+        amounts of compiled code).
+        (JSC::Heap::collect): Added the new call to didCollect at the conclusion of a collection so that we 
+        can cancel the timer if we no longer need to run a collection. Also added a check at the beginning of a 
+        collection to see if we should throw away our compiled code. Currently this is set to happen about once 
+        every minute.
+        * heap/Heap.h: Added field to keep track of the last time we threw away our compiled code.
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase): Added call to willAllocate on the allocation slow path, just like 
+        in CopiedSpace.
+        * runtime/GCActivityCallback.cpp: Added default stubs for non-CF platforms.
+        (JSC::DefaultGCActivityCallback::willAllocate):
+        (JSC):
+        (JSC::DefaultGCActivityCallback::didCollect):
+        (JSC::DefaultGCActivityCallback::didAbandonObjectGraph):
+        * runtime/GCActivityCallback.h: Added new functions to make JSC's GC timer less arcane. This includes replacing 
+        the operator () with willAllocate() and adding an explicit didCollect() to cancel the timer after a collection 
+        occurs rather than relying on the way the timer is invoked to cancel itself. Also added a callback for 
+        when somebody else (e.g. WebCore or the JSC API) to notify JSC that they have just abandoned an entire graph of 
+        objects and that JSC might want to clean them up.
+        (JSC::GCActivityCallback::~GCActivityCallback):
+        (JSC::GCActivityCallback::willAllocate):
+        (JSC::GCActivityCallback::didCollect):
+        (JSC::GCActivityCallback::didAbandonObjectGraph):
+        (JSC::GCActivityCallback::synchronize):
+        (DefaultGCActivityCallback):
+        * runtime/GCActivityCallbackCF.cpp: Re-wired all the run loop stuff to implement the aforementioned functions. 
+        We added a flag to check whether the timer was active because the call to CFRunLoopTimerSetNextFireDate actually 
+        turned out to be quite expensive (although Instruments couldn't tell us this).
+        (DefaultGCActivityCallbackPlatformData):
+        (JSC):
+        (JSC::DefaultGCActivityCallbackPlatformData::timerDidFire):
+        (JSC::DefaultGCActivityCallback::commonConstructor):
+        (JSC::scheduleTimer):
+        (JSC::cancelTimer):
+        (JSC::DefaultGCActivityCallback::willAllocate):
+        (JSC::DefaultGCActivityCallback::didCollect):
+        (JSC::DefaultGCActivityCallback::didAbandonObjectGraph):
+
+2012-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not attempt to get rare case counts for op_mod on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=84218
+
+        Reviewed by Geoff Garen.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::isX86):
+        (DFG):
+
+2012-04-17  Myles Maxfield  <mmaxfield@google.com>
+
+        BumpPointerAllocator assumes page size is less than MINIMUM_BUMP_POOL_SIZE
+        https://bugs.webkit.org/show_bug.cgi?id=80912
+
+        Reviewed by Hajime Morita.
+
+        * wtf/BumpPointerAllocator.h:
+        (WTF::BumpPointerPool::create):
+
+2012-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to create an inheritorID for the global this object without crashing
+        https://bugs.webkit.org/show_bug.cgi?id=84200
+        <rdar://problem/11251082>
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSGlobalThis.cpp:
+        (JSC::JSGlobalThis::setUnwrappedObject):
+        * runtime/JSGlobalThis.h:
+        (JSC::JSGlobalThis::unwrappedObject):
+        (JSGlobalThis):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::resetInheritorID):
+
+2012-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG and LLInt should not clobber the frame pointer on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=84185
+        <rdar://problem/10767252>
+
+        Reviewed by Gavin Barraclough.
+        
+        Changed LLInt to use a different register. Changed DFG to use one fewer
+        registers. We should revisit this and switch the DFG to use a different
+        register instead of r7, but we can do that in a subsequent step since
+        the performance effect is tiny.
+
+        * dfg/DFGGPRInfo.h:
+        (GPRInfo):
+        (JSC::DFG::GPRInfo::toRegister):
+        (JSC::DFG::GPRInfo::toIndex):
+        * offlineasm/armv7.rb:
+
+2012-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        use after free in JSC::DFG::Node::op / JSC::DFG::ByteCodeParser::flushArgument
+        https://bugs.webkit.org/show_bug.cgi?id=83942
+        <rdar://problem/11247370>
+
+        Reviewed by Gavin Barraclough.
+        
+        Don't use references to the graph after resizing the graph.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flushArgument):
+
+2012-04-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype.toString should be generic
+        https://bugs.webkit.org/show_bug.cgi?id=81588
+
+        Reviewed by Sam Weinig.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+            - check for join function, use fast case if base object is array & join is present & default.
+        * runtime/CommonIdentifiers.h:
+            - added 'join'.
+
+2012-04-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-04-16  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r114309.
+        http://trac.webkit.org/changeset/114309
+        https://bugs.webkit.org/show_bug.cgi?id=84097
+
+        it broke everything (Requested by olliej on #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/CodeBlock.h:
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::throwException):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (functionJSCStack):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::handleHostCall):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        (JSC::throwError):
+        * runtime/Error.h:
+        (JSC):
+
+2012-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Exception stack traces aren't complete when the exception starts in native code
+        https://bugs.webkit.org/show_bug.cgi?id=84073
+
+        Reviewed by Gavin Barraclough.
+
+        Refactored building the stack trace to so that we can construct
+        it earlier, and don't rely on any prior work performed in the
+        exception handling machinery. Also updated LLInt and the DFG to
+        completely initialise the callframes of host function calls.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::codeOriginIndexForReturn):
+        (CodeBlock):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC):
+        (JSC::Interpreter::throwException):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (functionJSCStack):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::handleHostCall):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        (JSC::throwError):
+        * runtime/Error.h:
+        (JSC):
+
+2012-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Fix COMMANDLINE_TYPEDARRAYS build
+        https://bugs.webkit.org/show_bug.cgi?id=84051
+
+        Reviewed by Gavin Barraclough.
+
+        Update for new putByIndex API and wtf changes.
+
+        * JSCTypedArrayStubs.h:
+        (JSC):
+
+2012-04-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GC in the middle of JSObject::allocatePropertyStorage can cause badness
+        https://bugs.webkit.org/show_bug.cgi?id=83839
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * jit/JITStubs.cpp: Making changes to use the new return value of growPropertyStorage.
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::growPropertyStorage): Renamed to more accurately reflect that we're 
+        growing our already-existing PropertyStorage.
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::setPropertyStorage): "Atomically" sets the new property storage 
+        and the new structure so that we can be sure a GC never occurs when our Structure
+        info is out of sync with our PropertyStorage.
+        (JSC):
+        (JSC::JSObject::putDirectInternal): Moved the check to see if we should 
+        allocate more backing store before the actual property insertion into 
+        the structure.
+        (JSC::JSObject::putDirectWithoutTransition): Ditto.
+        (JSC::JSObject::transitionTo): Ditto.
+        * runtime/Structure.cpp:
+        (JSC::Structure::suggestedNewPropertyStorageSize): Added to keep the resize policy 
+        for property backing stores contained within the Structure class.
+        (JSC):
+        * runtime/Structure.h:
+        (JSC::Structure::shouldGrowPropertyStorage): Lets clients know if another insertion 
+        into the Structure would require resizing the property backing store so that they can 
+        preallocate the required storage.
+        (Structure):
+
+2012-04-13  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r114185.
+        http://trac.webkit.org/changeset/114185
+        https://bugs.webkit.org/show_bug.cgi?id=83967
+
+        Broke a bunch of JavaScript related tests (Requested by
+        andersca on #webkit).
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        * runtime/CommonIdentifiers.h:
+        * tests/mozilla/ecma/Array/15.4.4.2.js:
+        (getTestCases):
+
+2012-04-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Don't rely on fixed offsets to patch calls
+        https://bugs.webkit.org/show_bug.cgi?id=83966
+
+        Rubber stamped by Oliver Hunt.
+
+        These aren't being used anywhere!
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2012-04-13  Hojong Han  <hojong.han@samsung.com>
+
+        Array.prototype.toString and Array.prototype.toLocaleString should be generic
+        https://bugs.webkit.org/show_bug.cgi?id=81588
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        * runtime/CommonIdentifiers.h:
+        * tests/mozilla/ecma/Array/15.4.4.2.js:
+        (getTestCases.array.item.new.TestCase):
+        (getTestCases):
+
+2012-04-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Don't rely on fixed offsets to patch method checks
+        https://bugs.webkit.org/show_bug.cgi?id=83958
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/StructureStubInfo.h:
+            - Add fields for the method check info.
+        * jit/JIT.cpp:
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+            - Store the offsets on the stub info, instead of asserting.
+        * jit/JIT.h:
+            - Delete all the method check related offsets.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+            - Use the offset from the stubInfo.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Pass the stubInfo to patchMethodCallProto.
+
+2012-04-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Don't rely on fixed offsets to patch get_by_id/put_by_id
+        https://bugs.webkit.org/show_bug.cgi?id=83924
+
+        Reviewed by Oliver Hunt.
+
+        Store offsets in the structure stub info, as we do for the DFG JIT.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::differenceBetween):
+            - this method can be static (now used from PropertyStubCompilationInfo::copyToStubInfo, will be removed soon!)
+        * bytecode/StructureStubInfo.h:
+            - added new fields for baseline JIT offsets.
+        * jit/JIT.cpp:
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+            - moved out from JIT::privateCompile.
+        (JSC::JIT::privateCompile):
+            - moved out code to PropertyStubCompilationInfo::copyToStubInfo.
+        * jit/JIT.h:
+        (PropertyStubCompilationInfo):
+            - added helper functions to initializae PropertyStubCompilationInfo, state to store more offset info.
+            - removed many offsets.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::resetPatchGetById):
+        (JSC::JIT::resetPatchPutById):
+            - changed code generation to use new interface to store info on PropertyStubCompilationInfo.
+            - changed repatch functions to read offsets from the structure stub info.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::resetPatchGetById):
+        (JSC::JIT::resetPatchPutById):
+            - changed code generation to use new interface to store info on PropertyStubCompilationInfo.
+            - changed repatch functions to read offsets from the structure stub info.
+
+2012-04-13  Rob Buis  <rbuis@rim.com>
+
+        Fix some compiler warnings (miscellaneous)
+        https://bugs.webkit.org/show_bug.cgi?id=80790
+
+        Reviewed by Antonio Gomes.
+
+        Fix signed/unsigned comparison warning.
+
+        * parser/Lexer.cpp:
+        (JSC::::record16):
+
+2012-04-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        Improve replaceUsingStringSearch() for case of a single character searchValue
+        https://bugs.webkit.org/show_bug.cgi?id=83738
+
+        Reviewed by Geoffrey Garen.
+
+        This patch improves replaceUsingStringSearch() with the following:
+        -Add a special case for single character search, taking advantage of the faster WTF::find().
+        -Inline replaceUsingStringSearch().
+        -Use StringImpl::create() instead of UString::substringSharingImpl() since we know we are in the bounds
+         by definition.
+
+        This gives less than 1% improvement for the multicharacter replace.
+        The single character search show about 9% improvement.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingStringSearch):
+
+2012-04-12  Michael Saboff  <msaboff@apple.com>
+
+        StructureStubInfo::reset() causes leaks of PolymorphicAccessStructureList and ExecutableMemoryHandle objects
+        https://bugs.webkit.org/show_bug.cgi?id=83823
+
+        Reviewed by Gavin Barraclough.
+
+        Put the clearing of the accessType to after the call to deref() so that
+        deref() can use the accessType to delete referenced objects as needed.
+
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::reset):
+
+2012-04-12  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] Fix WebKit1 build with V8
+        https://bugs.webkit.org/show_bug.cgi?id=83322
+
+        Reviewed by Adam Barth.
+
+        * yarr/yarr.pri:
+
+2012-04-12  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=83821
+        Move dfg repatching properties of structure stub info into a union
+
+        Reviewed by Oliver Hunt.
+
+        We want to be able to have similar properties for the baseline JIT, some restructuring to prepare for this.
+
+        * bytecode/StructureStubInfo.h:
+        (StructureStubInfo):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchByIdSelfAccess):
+        (JSC::DFG::linkRestoreScratch):
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+
+2012-04-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Delete a bunch of unused, copy & pasted values in JIT.h
+        https://bugs.webkit.org/show_bug.cgi?id=83822
+
+        Reviewed by Oliver Hunt.
+        
+        The only architecture we support the JSVALUE64 JIT on is x86-64, all the patch offsets for other architectures are just nonsense.
+
+        * jit/JIT.h:
+        (JIT):
+
+2012-04-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][ARM] Buildfix after r113934.
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::compare8):
+        (MacroAssemblerARM):
+
+2012-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It is incorrect to short-circuit Branch(LogicalNot(@a)) if boolean speculations on @a may fail
+        https://bugs.webkit.org/show_bug.cgi?id=83744
+        <rdar://problem/11206946>
+
+        Reviewed by Andy Estes.
+        
+        This does the conservative thing: it only short-circuits Branch(LogicalNot(@a)) if @a is a node
+        that is statically known to return boolean results.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2012-04-11  Michael Saboff  <msaboff@apple.com>
+
+        Invalid Union Reference in StructureStubInfo.{cpp.h}
+        https://bugs.webkit.org/show_bug.cgi?id=83735
+
+        Reviewed by Filip Pizlo.
+
+        Changed the references to u.getByIdProtoList and u.getByIdSelfList
+        to be consistent.
+
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+
+2012-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed attempting to make Qt's eccentric hardware work.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::compare8):
+        (MacroAssemblerARM):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::compare8):
+        (MacroAssemblerMIPS):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::compare8):
+        (MacroAssemblerSH4):
+
+2012-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        op_is_foo should be optimized
+        https://bugs.webkit.org/show_bug.cgi?id=83666
+
+        Reviewed by Gavin Barraclough.
+        
+        This implements inlining of op_is_undefined, op_is_string, op_is_number,
+        and op_is_boolean in LLInt and the baseline JIT. op_is_object and
+        op_is_function are not inlined because they are quite a bit more complex.
+        
+        This also implements all of the op_is_foo opcodes in the DFG, but it does
+        not do any type profiling based optimizations, yet.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::compare8):
+        (MacroAssemblerARMv7):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::compare8):
+        (MacroAssemblerX86Common):
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::testPtr):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArguments):
+        (CCallHelpers):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC):
+        (JSC::JIT::emit_op_is_boolean):
+        (JSC::JIT::emit_op_is_number):
+        (JSC::JIT::emit_op_is_string):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC):
+        (JSC::JIT::emit_op_is_boolean):
+        (JSC::JIT::emit_op_is_number):
+        (JSC::JIT::emit_op_is_string):
+        * jit/JITStubs.cpp:
+        (JSC):
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/armv7.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2012-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        If you use an IntegerOperand and want to return it with integerResult, you need to
+        zero extend to get rid of the box
+        https://bugs.webkit.org/show_bug.cgi?id=83734
+        <rdar://problem/11232296>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+
+2012-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        SpeculativeJIT::fillStorage() should work with all the states that a cell may be in
+        https://bugs.webkit.org/show_bug.cgi?id=83722
+
+        Reviewed by Gavin Barraclough.
+        
+        It's now possible to do StorageOperand on a cell, in the case that the storage is
+        inline. But this means that fillStorage() must be able to handle all of the states
+        that a cell might be in. Previously it didn't.
+        
+        With this change, it now does handle all of the states, and moreover, it does so
+        by preserving the DataFormat of cells and performing all of the cell speculations
+        that should be performed if you're using a cell as storage. But if you use this on
+        something that is known to be storage already then it behaves as it did before.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+
+2012-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Global variable predictions should not be coalesced unnecessarily
+        https://bugs.webkit.org/show_bug.cgi?id=83678
+
+        Reviewed by Geoff Garen.
+        
+        Removed the PredictionTracker and everyone who used it. Converted GetGlobalVar
+        to have a heapPrediction like a civilized DFG opcode ought to.
+        
+        No performance effect.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * bytecode/PredictionTracker.h: Removed.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGenerationInfo.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2012-04-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        Optimize String.split() for 1 character separator
+        https://bugs.webkit.org/show_bug.cgi?id=83546
+
+        Reviewed by Gavin Barraclough.
+
+        This patch adds a serie of optimizations to make stringProtoFuncSplit() faster in the common case
+        where the separator is a single character.
+
+        The two main gains are:
+        -Use of the find() function with a single character instead of doing a full string matching.
+        -Use of WTF::find() instead of UString::find() to avoid branching on is8Bit() and have a simpler inline
+         function.
+
+        The code is also changed to avoid making unnecessary allocations by converting the 8bit string to 16bits.
+
+        This makes String.split() faster by about 13% in that particular case.
+
+        * runtime/StringPrototype.cpp:
+        (JSC):
+        (JSC::splitStringByOneCharacterImpl):
+        (JSC::stringProtoFuncSplit):
+
+2012-04-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am: Ad missing files.
+
+2012-04-10  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-04-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup wtf/Platform.h and config.h files
+        https://bugs.webkit.org/show_bug.cgi?id=83431
+
+        Reviewed by Eric Seidel.
+
+        The ENABLE() and USE() macros take care about the case when the flag
+        isn't defined. So there is no need to define anything with 0.
+
+        Also move duplicated code from the config.h files to Platform.h and
+        merge a few preprocessor commands to make the file more readable.
+
+        * config.h:
+
+2012-04-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should flush SetLocals to arguments
+        https://bugs.webkit.org/show_bug.cgi?id=83554
+
+        Reviewed by Gavin Barraclough.
+        
+        This is necessary to match baseline JIT argument capture behavior.
+        
+        But to make this work right we need to have a story for arguments into
+        which we store values of different formats. This patch introduces the
+        notion of an ArgumentPosition - i.e. an argument in a particular inline
+        call frame - and forces unification of all data pertinent to selecting
+        the argument's data format.
+        
+        Also fixed an amusing bug in the handling of OSR on SetLocals if there
+        was any insertion/deletion of nodes in the basic block. This is benign
+        for now but won't be eventually since the DFG is getting smarter. So
+        better fix it now.
+        
+        Also fixed an amusing bug in the handling of OSR on SetLocals if they
+        are immediately followed by a Flush. I think this bug might have always
+        been there but now it'll happen more commonly, and it's covered by the
+        run-javascriptcore-tests.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentPosition.h: Added.
+        (DFG):
+        (ArgumentPosition):
+        (JSC::DFG::ArgumentPosition::ArgumentPosition):
+        (JSC::DFG::ArgumentPosition::addVariable):
+        (JSC::DFG::ArgumentPosition::mergeArgumentAwareness):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGDoubleFormatState.h: Added.
+        (DFG):
+        (JSC::DFG::mergeDoubleFormatStates):
+        (JSC::DFG::mergeDoubleFormatState):
+        (JSC::DFG::doubleFormatStateToString):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::predict):
+        (JSC::DFG::VariableAccessData::argumentAwarePrediction):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
+        (JSC::DFG::VariableAccessData::doubleFormatState):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
+        (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
+        (JSC::DFG::VariableAccessData::mergeDoubleFormatState):
+        (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
+
+2012-04-10  Adam Klein  <adamk@chromium.org>
+
+        Remove unused NonNullPassRefPtr from WTF
+        https://bugs.webkit.org/show_bug.cgi?id=82389
+
+        Reviewed by Kentaro Hara.
+
+        * JavaScriptCore.order: Remove nonexistent symbols referencing NonNullPassRefPtr.
+
+2012-04-10  Darin Adler  <darin@apple.com>
+
+        Remove unused data member from Lexer class
+        https://bugs.webkit.org/show_bug.cgi?id=83429
+
+        Reviewed by Kentaro Hara.
+
+        I noticed that m_delimited was "write-only", so I deleted it.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Removed code to set m_delimited.
+        (JSC::Lexer::parseIdentifier): Ditto.
+        (JSC::Lexer::parseIdentifierSlowCase): Ditto.
+        (JSC::Lexer::lex): Ditto.
+        * parser/Lexer.h: Deleted m_delimited.
+
+2012-04-10  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Enable USE_FOLDERS property
+        https://bugs.webkit.org/show_bug.cgi?id=83571
+
+        Reviewed by Daniel Bates.
+
+        Setting the FOLDER property on targets gives more structure 
+        to the generated Visual Studio solutions.
+        This does not affect other CMake generators.
+
+        * CMakeLists.txt:
+        * shell/CMakeLists.txt:
+
+2012-04-10  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to see why a code block was not compiled by the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=83553
+
+        Reviewed by Geoff Garen.
+        
+        If DFG_ENABLE(DEBUG_VERBOSE) and a code block is rejected, then print the
+        opcode that caused the rejection.
+
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::debugFail):
+        (DFG):
+        (JSC::DFG::canHandleOpcodes):
+
+2012-04-09  Gavin Barraclough  <barraclough@apple.com>
+
+        If a callback constructor returns a C++ null, throw a type error.
+        https://bugs.webkit.org/show_bug.cgi?id=83537
+
+        Rubber Stamped by Geoff Garen.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+            - If a callback constructor returns a C++ null, throw a type error.
+        * API/tests/testapi.c:
+        (Base_returnHardNull):
+        * API/tests/testapi.js:
+            - Add a test case for callback constructors that return a C++ null.
+
+2012-04-09  Gavin Barraclough  <barraclough@apple.com>
+
+        If a callback function returns a C++ null, convert to undefined.
+        https://bugs.webkit.org/show_bug.cgi?id=83534
+
+        Reviewed by Geoff Garen.
+
+        * API/JSCallbackFunction.cpp:
+            - If a callback function returns a C++ null, convert to undefined.
+        (JSC::JSCallbackFunction::call):
+        * API/tests/testapi.c:
+        (Base_returnHardNull):
+        * API/tests/testapi.js:
+            - Add a test case for callback functions that return a C++ null.
+
+2012-04-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Classic interpreter's GC hooks shouldn't attempt to scan instructions for code blocks that
+        are currently being generated
+        https://bugs.webkit.org/show_bug.cgi?id=83531
+        <rdar://problem/11215200>
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+
+2012-04-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, modernize and clean up uses of ARM assembly mnemonics in inline asm blocks.
+
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        * offlineasm/armv7.rb:
+
+2012-04-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove HAVE_STDINT_H
+        https://bugs.webkit.org/show_bug.cgi?id=83434
+
+        Reviewed by Kentaro Hara.
+
+        HAVE_STDINT_H is defined with 1 all the time and we us stdint.h without HAVE(STDINT_H) already.
+
+        * config.h:
+
+2012-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not load the property storage if it is inline.
+        https://bugs.webkit.org/show_bug.cgi?id=83455
+
+        Reviewed by Gavin Barraclough.
+        
+        We had previously decided to have all property storage accesses go through
+        the property storage pointer even if they don't "really" have to, because
+        we were thinking this would help GC barriers somehow. Well, we never ended
+        up doing anything with that. Hence, doing these wasted loads of the
+        property storage pointer when the storage is inline is just a waste of CPU
+        cycles.
+        
+        This change makes the DFG's inline property accesses (GetByOffset and
+        PutByOffset) go directly to the inline property storage if the structure(s)
+        tell us that it's OK.
+        
+        This looks like an across-the-board 1% win.
+
+        * bytecode/StructureSet.h:
+        (JSC):
+        (JSC::StructureSet::allAreUsingInlinePropertyStorage):
+        (StructureSet):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+
+2012-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Command-line jsc's exception handling should be rationalized
+        https://bugs.webkit.org/show_bug.cgi?id=83437
+
+        Reviewed by Dan Bernstein.
+        
+        - If an exception is thrown during run() execution, it is now propagated,
+          so that it will terminate program execution unless it is caught.
+          
+        - If program execution terminates with an exception, the exception is now
+          always printed.
+          
+        - When printing the exception, the backtrace is now also printed if one is
+          available. It will only not be available if you use something akin to my
+          favorite line of code, 'throw "error"', since primitives don't have
+          properties and hence we cannot attach a "stack" property to them.
+
+        * jsc.cpp:
+        (functionRun):
+        (runWithScripts):
+
+2012-04-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Forced OSR exits should lead to recompilation based on count, not rate
+        https://bugs.webkit.org/show_bug.cgi?id=83247
+        <rdar://problem/10720925>
+
+        Reviewed by Geoff Garen.
+        
+        Track which OSR exits happen because of inadequate coverage. Count them
+        separately. If the count reaches a threshold, immediately trigger
+        reoptimization.
+        
+        This is in contrast to the recompilation trigger for all other OSR exits.
+        Normally recomp is triggered when the exit rate exceeds a certain ratio.
+        
+        Looks like a slight V8 speedup (sub 1%).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::forcedOSRExitCounter):
+        (JSC::CodeBlock::addressOfForcedOSRExitCounter):
+        (JSC::CodeBlock::offsetOfForcedOSRExitCounter):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        (CodeBlock):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        (DFG):
+        * dfg/DFGOSRExitCompiler.h:
+        (OSRExitCompiler):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+
+2012-04-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not abuse ArrayStorage's m_length for testing array consistency
+        https://bugs.webkit.org/show_bug.cgi?id=83403
+
+        Reviewed by Geoffrey Garen.
+
+        Array creation from a list of values is a 3 steps process:
+        -JSArray::tryCreateUninitialized()
+        -JSArray::initializeIndex() for each values
+        -JSArray::completeInitialization()
+
+        Previously, the attribute m_length was not set to the final size
+        JSArray::tryCreateUninitialized() because it was used to test the array
+        consistency JSArray::initializeIndex().
+
+        This caused the initialization loop using JSArray::initializeIndex() maintain
+        two counters:
+        -index of the loop
+        -storage->m_length++
+
+        This patch fixes this by using the index of the initialization loop for the indinces of
+        JSArray::initializeIndex(). For testing consistency, the variable m_initializationIndex
+        is introduced if CHECK_ARRAY_CONSISTENCY is defined.
+
+        The patch also fixes minor unrelated build issue when CHECK_ARRAY_CONSISTENCY is defined.
+
+        This improves the performance of JSArray creation from literals by 8%.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::tryFinishCreationUninitialized):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (ArrayStorage):
+        (JSC::JSArray::initializeIndex):
+        (JSC::JSArray::completeInitialization):
+
+2012-04-06  Jon Lee  <jonlee@apple.com>
+
+        Build fix for Windows bots.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: export missing symbol.
+
+2012-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Renamed
+
+                WeakHeap => WeakSet
+                HandleHeap => HandleSet
+
+        Reviewed by Sam Weinig.
+
+        These sets do have internal allocators, but it's confusing to call them
+        heaps because they're sub-objects of an object called "heap".
+
+        * heap/HandleHeap.cpp: Removed.
+        * heap/HandleHeap.h: Removed.
+        * heap/HandleSet.cpp: Copied from JavaScriptCore/heap/HandleHeap.cpp.
+        * heap/WeakHeap.cpp: Removed.
+        * heap/WeakHeap.h: Removed.
+        * heap/WeakSet.cpp: Copied from JavaScriptCore/heap/WeakHeap.cpp.
+        * heap/WeakSet.h: Copied from JavaScriptCore/heap/WeakHeap.h.
+
+        Plus global rename using grep.
+
+2012-04-06  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10912476> HiDPI: Have canvas use a hidpi backing store, but downsample upon access
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_HIGH_DPI_CANVAS.
+
+2012-04-06  Rob Buis  <rbuis@rim.com>
+
+        Fix cast-align warnings in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=80790
+
+        Reviewed by George Staikos.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::link):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::copyAndAppend):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildren):
+        * wtf/RefCountedArray.h:
+        (WTF::RefCountedArray::Header::payload):
+
+2012-04-06  Darin Adler  <darin@apple.com>
+
+        Streamline strtod and fix some related problems
+        https://bugs.webkit.org/show_bug.cgi?id=82857
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<>::lex): Use parseDouble. Since we have already scanned the number
+        and we know it has only correct characters, leading spaces, trailing junk, and
+        trailing spaces are not a possibility. No need to add a trailing null character.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt): Changed overflow based 10 case to use parseDouble. No need
+        to allow trailing junk since the code above already allows only numeric digits
+        in the string. This code path is used only in unusual cases, so it's not
+        optimized for 8-bit strings, but easily could be.
+        (JSC::jsStrDecimalLiteral): Removed the allow trailing junk argument to this
+        function template because all the callers are OK with trailing junk. Use the
+        parseDouble function. No need to copy the data into a byte buffer, because
+        parseDouble handles that.
+        (JSC::toDouble): Got rid of the DisallowTrailingJunk argument to the
+        jsStrDecimalLiteral function template. That's OK because this function
+        already checks for trailing junk and handles it appropriately. The old code
+        path was doing it twice.
+        (JSC::parseFloat): Got rid of the AllowTrailingJunk argument to the
+        jsStrDecimalLiteral function template; the template allows junk unconditionally.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::::Lexer::lexNumber): Use parseDouble. Since we have already scanned the number
+        and we know it has only correct characters, leading spaces, trailing junk, and
+        trailing spaces are not a possibility. No need to add a trailing null character.
+        No need to copy the data into a byte buffer, because parseDouble handles that.
+        We could optimize the UChar case even more because we know all the characters
+        are ASCII, but not doing that at this time.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Updated.
+
+2012-04-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove JSC dependency from GregorianDateTime
+        https://bugs.webkit.org/show_bug.cgi?id=83290
+
+        Reviewed by Geoffrey Garen.
+
+        This allows us to move it to WTF later.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/JSDateMath.h:
+
+2012-04-05  Michael Saboff  <msaboff@apple.com>
+
+        Call Heap::discardAllCompiledCode() in low memory situations
+        https://bugs.webkit.org/show_bug.cgi?id=83335
+
+        Reviewed by Geoffrey Garen.
+
+        Restructured Heap::discardAllCompiledCode() to do the "Is JavaScriptRunning?"
+        check inline so that it can be called directly without this check.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::discardAllCompiledCode):
+        (JSC::Heap::collectAllGarbage):
+        * heap/Heap.h: Added JS_EXPORT_PRIVATE to discardAllCompiledCode() so it can be
+        called from WebCore.
+        (Heap):
+        * runtime/JSGlobalData.h: Removed unused " void discardAllCompiledCode()" declaration.
+        (JSGlobalData):
+
+2012-04-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Speed up the conversion from JSValue to String for bulk operations
+        https://bugs.webkit.org/show_bug.cgi?id=83243
+
+        Reviewed by Geoffrey Garen.
+
+        When making operations on primitive types, we loose some time converting
+        values to JSString in order to extract the string.
+
+        This patch speeds up some basic Array operations by avoiding the creation
+        of intermediary JSString when possible.
+
+        For the cases where we need to convert a lot of JSValue in a tight loop,
+        an inline conversion is used.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSort):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort):
+        * runtime/JSString.h:
+        (JSC::JSValue::toUString):
+        (JSC):
+        (JSC::inlineJSValueNotStringtoUString):
+        (JSC::JSValue::toUStringInline):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toUStringSlowCase):
+        (JSC):
+        * runtime/JSValue.h:
+        (JSValue):
+
+2012-04-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Use QuickSort when sorting primitive values by string representation
+        https://bugs.webkit.org/show_bug.cgi?id=83312
+
+        Reviewed by Gavin Barraclough.
+
+        When the value we are sorting are all primitive values, we do not need to
+        ensure a stable sort as two values with equal string representation are
+        indistinguishable from JavaScript.
+
+        This gives about 16% performance increase when sorting primitive values.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort):
+
+2012-04-05  Oliver Hunt  <oliver@apple.com>
+
+        SIGILL in JavaScriptCore on a Geode processor
+        https://bugs.webkit.org/show_bug.cgi?id=82496
+
+        Reviewed by Gavin Barraclough.
+
+        Don't attempt to use the DFG when SSE2 is not available.
+
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::canCompileOpcodes):
+
+2012-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Fix 32-bit build.
+
+        * API/APICast.h:
+        (toJS):
+
+2012-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Replace static_cast with jsCast when casting JSCell subclasses in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=83307
+
+        Reviewed by Gavin Barraclough.
+
+        Replace all usage of static_cast<JSCell subtype*> with jsCast<> in JavaScriptCore.
+        This results in assertions when unsafe casts are performed, but simply leaves
+        a static_cast<> in release builds.
+
+        * API/APICast.h:
+        (toJS):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::finishCreation):
+        (JSC::::construct):
+        (JSC::::call):
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::finishCreation):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.h:
+        (JSC::isHostFunction):
+        * runtime/JSActivation.h:
+        (JSC::asActivation):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        * runtime/JSArray.h:
+        (JSC::asArray):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::boundFunctionCall):
+        (JSC::boundFunctionConstruct):
+        * runtime/JSByteArray.h:
+        (JSC::asByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toObject):
+        * runtime/JSCell.h:
+        (JSC::jsCast):
+        * runtime/JSGlobalObject.h:
+        (JSC::asGlobalObject):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::allowsAccessFrom):
+        (JSC::JSObject::toThisObject):
+        (JSC::JSObject::unwrappedObject):
+        * runtime/JSObject.h:
+        (JSC::asObject):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Register::propertyNameIterator):
+        * runtime/JSString.h:
+        (JSC::asString):
+        (JSC::JSValue::toString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSubstr):
+
+2012-04-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Make something faster than JSStringBuilder for joining an array of JSValue
+        https://bugs.webkit.org/show_bug.cgi?id=83180
+
+        Reviewed by Geoffrey Garen.
+
+        This patch add the class JSStringJoiner optimized for join() operations.
+
+        This class makes stricter constraints than JSStringBuilder in order avoid
+        memory allocations.
+
+        In the best case, the class allocate memory only twice:
+        -Allocate an array to keep a list of UString to join.
+        -Allocate the final string.
+
+        We also avoid the conversion from 8bits strings to 16bits strings since
+        they are costly and unlikly to help for subsequent calls.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/JSStringJoiner.cpp: Added.
+        (JSC):
+        (JSC::appendStringToData):
+        (JSC::joinStrings):
+        (JSC::JSStringJoiner::build):
+        * runtime/JSStringJoiner.h: Added.
+        (JSC):
+        (JSStringJoiner):
+        (JSC::JSStringJoiner::JSStringJoiner):
+        (JSC::JSStringJoiner::append):
+
+2012-04-05  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=77293
+        [Un]Reserve 'let'
+
+        Rubber stamped by Oliver Hunt.
+
+        Revert r106198.
+        This does break the web - e.g. https://bvi.bnc.ca/index/bnc/indexen.html
+        If we're going to reserve let, we're going to have to do so in a more
+        circumspect fashion.
+
+        * parser/Keywords.table:
+
+2012-04-05  Michael Saboff  <msaboff@apple.com>
+
+        Rolling out http://trac.webkit.org/changeset/113262.
+        Original code was fine.
+
+        Rubber-stamped by Oliver Hunt.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::additionBlindedConstant):
+
+2012-04-05  Patrick Gansterer  <paroga@webkit.org>
+
+        [WinCE] Remove unnecessary function decleration
+        https://bugs.webkit.org/show_bug.cgi?id=83155
+
+        Reviewed by Kentaro Hara.
+
+        * runtime/JSDateMath.cpp:
+
+2012-04-04  Patrick Gansterer  <paroga@webkit.org>
+
+        Add WTF::getCurrentLocalTime()
+        https://bugs.webkit.org/show_bug.cgi?id=83164
+
+        Reviewed by Alexey Proskuryakov.
+
+        Replace the calls to WTF::getLocalTime() with time(0) with the new function.
+        This allows us to use Win32 API on windows to get the same result in a next step.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+
+2012-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Parser fails to revert some state after parsing expression and object literals.
+        https://bugs.webkit.org/show_bug.cgi?id=83236
+
+        Reviewed by Gavin Barraclough.
+
+        Reset left hand side counter after parsing the literals.
+
+        * parser/Parser.cpp:
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+
+2012-04-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG InstanceOf should not uselessly speculate cell
+        https://bugs.webkit.org/show_bug.cgi?id=83234
+
+        Reviewed by Oliver Hunt.
+        
+        If InstanceOf is the only user of its child then don't speculate cell, since
+        the not-cell case is super easy to handle.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+
+2012-04-04  Michael Saboff  <msaboff@apple.com>
+
+        Fixed minor error: "& 3" should be "& 2".
+
+        Rubber-stamped by Oliver Hunt.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::additionBlindedConstant):
+
+2012-04-04  Michael Saboff  <msaboff@apple.com>
+
+        Constant Blinding for add/sub immediate crashes in ArmV7 when dest is SP
+        https://bugs.webkit.org/show_bug.cgi?id=83191
+
+        Reviewed by Oliver Hunt.
+
+        Make are that blinded constant pairs are similarly aligned to the
+        original immediate values so that instructions that expect that
+        alignment work correctly.  One example is ARMv7 add/sub imm to SP.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::add): Added ASSERT that immediate is word aligned.
+        (JSC::ARMv7Assembler::sub): Added ASSERT that immediate is word aligned.
+        (JSC::ARMv7Assembler::sub_S): Added ASSERT that immediate is word aligned.
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::additionBlindedConstant):
+
+2012-04-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should short-circuit Branch(LogicalNot(...))
+        https://bugs.webkit.org/show_bug.cgi?id=83181
+
+        Reviewed by Geoff Garen.
+        
+        Slight (sub 1%) speed-up on V8.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2012-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        [Qt] REGRESSION(r113141): All tests assert on 32 bit debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=83139
+
+        Reviewed by Sam Weinig.
+
+        * heap/PassWeak.h:
+        (JSC::::get): 32-bit JSValue treats JSValue(nullptr).asCell() as an error,
+        so work around that here. (Long-term, we should make 32-bit and 64-bit
+        agree on the right behavior.)
+
+2012-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Updated JSC expected test results to reflect recent bug fixes <disapproving look>.
+
+        Reviewed by Sam Weinig.
+
+        * tests/mozilla/expected.html:
+
+2012-03-29  Geoffrey Garen  <ggaren@apple.com>
+
+        First step toward incremental Weak<T> finalization
+        https://bugs.webkit.org/show_bug.cgi?id=82670
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements a Weak<T> heap that is compatible with incremental
+        finalization, while making as few behavior changes as possible. The behavior
+        changes it makes are:
+
+        (*) Weak<T>'s raw JSValue no longer reverts to JSValue() automatically --
+        instead, a separate flag indicates that the JSValue is no longer valid.
+        (This is required so that the JSValue can be preserved for later finalization.)
+        Objects dealing with WeakImpls directly must change to check the flag.
+
+        (*) Weak<T> is no longer a subclass of Handle<T>.
+
+        (*) DOM GC performance is different -- 9% faster in the geometric mean,
+        but 15% slower in one specific case:
+                gc-dom1.html: 6%  faster
+                gc-dom2.html: 23% faster
+                gc-dom3.html: 17% faster
+                gc-dom4.html: 15% *slower*
+
+        The key features of this new heap are:
+
+        (*) Each block knows its own state, independent of any other blocks.
+
+        (*) Each block caches its own sweep result.
+
+        (*) The heap visits dead Weak<T>s at the end of GC. (It doesn't
+        mark them yet, since that would be a behavior change.)
+
+        * API/JSCallbackObject.cpp:
+        (JSC::JSCallbackObjectData::finalize):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init): Updated to use the new WeakHeap API.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri: Paid the build system tax since I added some new files.
+
+        * heap/Handle.h: Made WeakBlock a friend and exposed slot() as public,
+        so we can keep passing a Handle<T> to finalizers, to avoid more surface
+        area change in this patch. A follow-up patch should change the type we
+        pass to finalizers.
+
+        * heap/HandleHeap.cpp:
+        (JSC):
+        (JSC::HandleHeap::writeBarrier):
+        (JSC::HandleHeap::isLiveNode):
+        * heap/HandleHeap.h:
+        (JSC):
+        (HandleHeap):
+        (Node):
+        (JSC::HandleHeap::Node::Node): Removed all code related to Weak<T>, since
+        we have a separate WeakHeap now.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap): Removed m_extraCost because extra cost is accounted
+        for through our watermark now. Removed m_waterMark because it was unused.
+
+        (JSC::Heap::destroy): Updated for addition of WeakHeap.
+
+        (JSC::Heap::reportExtraMemoryCostSlowCase): Changed from using its own
+        variable to participating in the watermark strategy. I wanted to standardize
+        WeakHeap and all other Heap clients on this strategy, to make sure it's
+        accurate.
+ 
+        (JSC::Heap::markRoots): Updated for addition of WeakHeap. Added WeakHeap
+        dead visit pass, as explained above.
+
+        (JSC::Heap::collect):
+        (JSC::Heap::resetAllocators): Updated for addition of WeakHeap.
+
+        (JSC::Heap::addFinalizer):
+        (JSC::Heap::FinalizerOwner::finalize): Updated for new Weak<T> API.
+
+        * heap/Heap.h:
+        (JSC::Heap::weakHeap):
+        (Heap):
+        (JSC::Heap::addToWaterMark): Added a way to participate in the watermarking
+        strategy, since this is the best way for WeakHeap to report its memory
+        cost. (I plan to update this in a follow-up patch to make it more accurate,
+        but for now it is not less accurate than it used to be.)
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC::MarkedSpace::addToWaterMark):
+        (JSC::MarkedSpace::didConsumeFreeList): Removed m_nurseryWaterMark because
+        it was unused, and I didn't want to update WeakHeap to keep an usused
+        variable working. Added API for above.
+
+        * heap/PassWeak.h:
+        (JSC):
+        (WeakImplAccessor):
+        (PassWeak):
+        (JSC::::operator):
+        (JSC::::get):
+        (JSC::::was):
+        (JSC::::PassWeak):
+        (JSC::::~PassWeak):
+        (JSC::UnspecifiedBoolType):
+        (JSC::::leakImpl):
+        (JSC::adoptWeak):
+        * heap/Strong.h:
+        (JSC::Strong::operator!):
+        (Strong):
+        (JSC::Strong::operator UnspecifiedBoolType*):
+        (JSC::Strong::get):
+        * heap/Weak.h:
+        (Weak):
+        (JSC::::Weak):
+        (JSC):
+        (JSC::::isHashTableDeletedValue):
+        (JSC::::~Weak):
+        (JSC::::swap):
+        (JSC::=):
+        (JSC::::operator):
+        (JSC::UnspecifiedBoolType):
+        (JSC::::release):
+        (JSC::::clear):
+        (JSC::::hashTableDeletedValue): Lots of code changes here, but they boil
+        down to two things:
+
+        (*) Allocate WeakImpls from the WeakHeap instead of Handles from the HandleHeap.
+
+        (*) Explicitly check WeakImpl::state() for non-liveness before returning
+        a value (explained above).
+
+        These files implement the new Weak<T> heap behavior described above:
+
+        * heap/WeakBlock.cpp: Added.
+        * heap/WeakBlock.h: Added.
+        * heap/WeakHandleOwner.cpp: Added.
+        * heap/WeakHandleOwner.h: Added.
+        * heap/WeakHeap.cpp: Added.
+        * heap/WeakHeap.h: Added.
+        * heap/WeakImpl.h: Added.
+
+        One interesting difference from the old heap is that we don't allow
+        clients to overwrite a WeakImpl after allocating it, and we don't recycle
+        WeakImpls prior to garbage collection. This is required for lazy finalization,
+        but it will also help us esablish a useful invariant in the future: allocating
+        a WeakImpl will be a binding contract to run a finalizer at some point in the
+        future, even if the WeakImpl is later deallocated.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub): Check the Weak<T> for ! instead of
+        its JSValue, since that's our API contract now, and the JSValue might
+        be stale.
+
+        * runtime/JSCell.h:
+        (JSC::jsCast): Allow casting NULL pointers because it's useful and harmless.
+
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::add): I can't remember why I did this.
+
+        * runtime/StructureTransitionTable.h:
+        * runtime/WeakGCMap.h: I had to update these classes because they allocate
+        and deallocate weak pointers manually. They should probably stop doing that.
+
+2012-04-03  Keishi Hattori  <keishi@webkit.org>
+
+        Disable ENABLE_DATALIST for now
+        https://bugs.webkit.org/show_bug.cgi?id=82871
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig: Disabled ENABLE_DATALIST.
+
+2012-04-02  Filip Pizlo  <fpizlo@apple.com>
+
+        jsr/sret should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=82986
+        <rdar://problem/11017015>
+
+        Reviewed by Sam Weinig and Geoff Garen.
+        
+        Replaces jsr/sret with finally block inlining.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC):
+        * bytecompiler/BytecodeGenerator.h:
+        (FinallyContext):
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITOpcodes.cpp:
+        (JSC):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-04-03  Mark Rowe  <mrowe@apple.com>
+
+        Make it possible to install the JavaScriptCore test tools.
+
+        Part of <rdar://problem/11158607>.
+        
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Introduce an aggregate target named
+        Test Tools that builds testapi, minidom and testRegExp. Switch All from depending on
+        those targets individually to depending on the new aggregate target.
+
+2012-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Offlineasm ARM backend has a very convoluted way of saying it wants to emit a
+        three-operand multiply instruction
+        https://bugs.webkit.org/show_bug.cgi?id=83100
+
+        Reviewed by Darin Adler.
+        
+        Changed the "muli"/"mulp" case to call emitArmV7() since that helper method was
+        already smart enough to do the Right Thing for multiply.
+
+        * offlineasm/armv7.rb:
+
+2012-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Offlineasm ARM backend uses the wrong mnemonic for multiply
+        https://bugs.webkit.org/show_bug.cgi?id=83098
+        <rdar://problem/11168744>
+
+        Reviewed by Gavin Barraclough.
+        
+        Use "mul" instead of "muls" since we're passing three operands, not two.
+
+        * offlineasm/armv7.rb:
+
+2012-04-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Linux crashes during boot
+        https://bugs.webkit.org/show_bug.cgi?id=83096
+
+        Reviewed by Filip Pizlo.
+
+        The bug here is that we add empty JSValues to the sparse map, and then set them
+        - but a GC may occur before doing so (due to a call to reportExtraMemory cost).
+        We may want to consider making it safe to mark empty JSValues, but the simple &
+        contained fix to this specific bug is to just initialize these values to
+        something other than JSValue().
+
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::add):
+            - Initialize sparse map entries.
+
+2012-04-02  Oliver Hunt  <oliver@apple.com>
+
+        Incorrect liveness information when inlining
+        https://bugs.webkit.org/show_bug.cgi?id=82985
+
+        Reviewed by Filip Pizlo.
+
+        Don't remap register numbers that have already been remapped.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+
+2012-04-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Activation tear-off neglects to copy the callee and scope chain, leading to crashes if we
+        try to create an arguments object from the activation
+        https://bugs.webkit.org/show_bug.cgi?id=82947
+        <rdar://problem/11058598>
+
+        Reviewed by Gavin Barraclough.
+        
+        We now copy the entire call frame header just to be sure. This is mostly perf-netural,
+        except for a 3.7% slow-down in V8/earley.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::tearOff):
+
+2012-04-02  Daniel Bates  <dbates@webkit.org>
+
+        Remove Source/JavaScriptCore/wtf and its empty subdirectories
+
+        Rubber-stamped by Eric Seidel.
+
+        Following the move of WTF from Source/JavaScriptCore/wtf to Source/WTF
+        (https://bugs.webkit.org/show_bug.cgi?id=75673), remove directory
+        Source/JavaScriptCore/wtf and its empty subdirectories.
+
+        * wtf: Removed.
+        * wtf/android: Removed.
+        * wtf/blackberry: Removed.
+        * wtf/chromium: Removed.
+        * wtf/dtoa: Removed.
+        * wtf/efl: Removed.
+        * wtf/gobject: Removed.
+        * wtf/gtk: Removed.
+        * wtf/mac: Removed.
+        * wtf/qt: Removed.
+        * wtf/qt/compat: Removed.
+        * wtf/tests: Removed.
+        * wtf/text: Removed.
+        * wtf/threads: Removed.
+        * wtf/threads/win: Removed.
+        * wtf/unicode: Removed.
+        * wtf/unicode/glib: Removed.
+        * wtf/unicode/icu: Removed.
+        * wtf/unicode/qt4: Removed.
+        * wtf/unicode/wince: Removed.
+        * wtf/url: Removed.
+        * wtf/url/api: Removed.
+        * wtf/url/src: Removed.
+        * wtf/win: Removed.
+        * wtf/wince: Removed.
+        * wtf/wx: Removed.
+
+2012-04-02  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am: Add missing file.
+
+2012-04-01  Darin Adler  <darin@apple.com>
+
+        Fix incorrect path for libWTF.a in Mac project file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed the "../Release" prefix that
+        would cause other configurations to try to link with the "Release" version of
+        libWTF.a instead of the correct version.
+
+2012-03-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize a==b for a being an object and b being either an object or
+        null/undefined, and vice versa
+        https://bugs.webkit.org/show_bug.cgi?id=82656
+
+        Reviewed by Oliver Hunt.
+        
+        Implements additional object equality optimizations for the case that one
+        operand is predicted to be an easily speculated object (like FinalObject or
+        Array) and the other is either an easily speculated object or Other, i.e.
+        Null or Undefined.
+        
+        2-5% speed-up on V8/raytrace, leading to a sub-1% progression on V8.
+        
+        I also took the opportunity to clean up the control flow for the speculation
+        decisions in the various Compare opcodes. And to fix a build bug in SamplingTool.
+        And to remove debug cruft I stupidly committed in my last patch.
+        
+        * bytecode/SamplingTool.h:
+        (SamplingRegion):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2012-03-30  David Barr  <davidbarr@chromium.org>
+
+        Split up top-level .gitignore and .gitattributes
+        https://bugs.webkit.org/show_bug.cgi?id=82687
+
+        Reviewed by Tor Arne Vestbø.
+
+        * JavaScriptCore.gyp/.gitignore: Added.
+
+2012-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows (make based) build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Copy WTF header files into a place where JavaScriptCore build can see them.
+
+2012-03-30  Keishi Hattori  <keishi@webkit.org>
+
+        Change ENABLE_INPUT_COLOR to ENABLE_INPUT_TYPE_COLOR and enable it for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=80972
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor recompileAllJSFunctions() to be less expensive
+        https://bugs.webkit.org/show_bug.cgi?id=80330
+
+        Reviewed by Filip Pizlo.
+
+        This change is performance neutral on the JS benchmarks we track. It's mostly to improve page 
+        load performance, which currently does at least a couple full GCs per navigation.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::discardAllCompiledCode): Rename recompileAllJSFunctions to discardAllCompiledCode 
+        because the function doesn't actually recompile anything (and never did); it simply throws code
+        away for it to be recompiled later if we determine we should do so.
+        (JSC):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::addFunctionExecutable): Adds a newly created FunctionExecutable to the Heap's list.
+        (JSC::Heap::removeFunctionExecutable): Removes the specified FunctionExecutable from the Heap's list.
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * runtime/Executable.cpp: Added next and prev fields to FunctionExecutables so that they can 
+        be used in DoublyLinkedLists.
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::finalize): Removes the FunctionExecutable from the Heap's list.
+        * runtime/Executable.h:
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::create): Adds the FunctionExecutable to the Heap's list.
+        * runtime/JSGlobalData.cpp: Remove recompileAllJSFunctions, as it's the Heap's job to own and manage 
+        the list of FunctionExecutables.
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Use the new discardAllCompiledCode.
+
+2012-03-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for non-x86 platforms.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+
+2012-03-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix p2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix p1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Template the Yarr::Interpreter on the character type
+        https://bugs.webkit.org/show_bug.cgi?id=82637
+
+        Reviewed by Sam Weinig.
+
+        We should be able to call to the interpreter after having already checked the character type,
+        without having to re-package the character pointer back up into a string!
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        (JSC::RegExp::matchCompareWithInterpreter):
+            - Don't pass length.
+        * yarr/Yarr.h:
+            - moved function declarations to YarrInterpreter.h.
+        * yarr/YarrInterpreter.cpp:
+        (Yarr):
+        (Interpreter):
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (InputStream):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::interpret):
+            - templated Interpreter class on CharType.
+        * yarr/YarrInterpreter.h:
+        (Yarr):
+            - added function declarations.
+
+2012-03-29  David Kilzer  <ddkilzer@apple.com>
+
+        Don't use a flattened framework path when building on OS X
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/ToolExecutable.xcconfig: Use REAL_PLATFORM_NAME
+        to select different INSTALL_PATH values.
+
+2012-03-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix, add Win-specific sources
+        the wx port needs after WTF move.
+
+        * wscript:
+
+2012-03-29  Andy Estes  <aestes@apple.com>
+
+        Remove an unused variable that breaks the build with newer versions of clang.
+
+        Rubber stamped by Gavin Barraclough.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+
+2012-03-29  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        HashMap<>::add should return a more descriptive object
+        https://bugs.webkit.org/show_bug.cgi?id=71063
+
+        Reviewed by Ryosuke Niwa.
+
+        Update code to use AddResult instead of a pair. Note that since WeakGCMap wraps
+        the iterator type, there's a need for its own AddResult type -- instantiated from
+        HashTableAddResult template class.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::contextData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        (JSC::JITThunks::hostFunctionStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::add8):
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        (JSC::IdentifierTable::add):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::add):
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        * runtime/JSArray.h:
+        (SparseArrayValueMap):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/StringRecursionChecker.h:
+        (JSC::StringRecursionChecker::performCheck):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::add):
+        * runtime/WeakGCMap.h:
+        (WeakGCMap):
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+
+2012-03-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for !ENABLE(YARR_JIT) after r112454.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::invalidateCode):
+
+2012-03-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG object equality speculations should be simplified
+        https://bugs.webkit.org/show_bug.cgi?id=82557
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateFinalObject):
+        (JSC::DFG::Node::shouldSpeculateArray):
+
+2012-03-28  David Kilzer  <ddkilzer@apple.com>
+
+        minidom configurations should be based on ToolExecutable.xcconfig
+        <http://webkit.org/b/82513>
+
+        Reviewed by Mark Rowe.
+
+        Note that this patch changes minidom from being installed in
+        /usr/local/bin to JavaScriptCore.framework/Resources.
+
+        * Configurations/ToolExecutable.xcconfig: Add semi-colon.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Base minidom
+        configurations on ToolExecutable.xcconfig.  Remove redundant
+        PRODUCT_NAME and SKIP_INSTALL variables.
+
+2012-03-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix - some compiles generating NORETURN related warnings.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::setSubpatternStart):
+        (JSC::Yarr::YarrGenerator::setSubpatternEnd):
+        (JSC::Yarr::YarrGenerator::clearSubpatternStart):
+
+2012-03-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed. Build fix, move WTF back into JSCore target
+        until issues with JSCore not linking in all WTF symbols are resolved.
+        
+        * wscript:
+
+2012-03-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Yarr: if we're not using the output array, don't populate it!
+        https://bugs.webkit.org/show_bug.cgi?id=82519
+
+        Reviewed by Sam Weinig.
+
+        * runtime/RegExp.cpp:
+        (JSC):
+            - Missed review comment! - didn't fully remove RegExpRepresentation.
+
+2012-03-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Yarr: if we're not using the output array, don't populate it!
+        https://bugs.webkit.org/show_bug.cgi?id=82519
+
+        Reviewed by Sam Weinig.
+
+        Add a new variant of the match method to RegExp that returns a MatchResult,
+        and modify YarrJIT to be able to compile code that doesn't use an output vector.
+
+        This is a 3% progression on v8-regexp.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Moved MatchResult into its own header.
+        * assembler/AbstractMacroAssembler.h:
+            - Added missing include.
+        * runtime/MatchResult.h: Added.
+        (MatchResult::MatchResult):
+        (MatchResult):
+        (MatchResult::failed):
+        (MatchResult::operator bool):
+        (MatchResult::empty):
+            - Moved MatchResult into its own header.
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileIfNecessary):
+        (JSC::RegExp::match):
+            - Changed due to execute & representation changes.
+        (JSC::RegExp::compileMatchOnly):
+        (JSC::RegExp::compileIfNecessaryMatchOnly):
+            - Added helper to compile MatchOnly code.
+        (JSC::RegExp::invalidateCode):
+        (JSC::RegExp::matchCompareWithInterpreter):
+        (JSC::RegExp::printTraceData):
+            - Changed due representation changes.
+        * runtime/RegExp.h:
+        (RegExp):
+        (JSC::RegExp::hasCode):
+            - Made YarrCodeBlock a member.
+        * runtime/RegExpConstructor.h:
+        (RegExpConstructor):
+        (JSC::RegExpConstructor::performMatch):
+            - Added no-ovector form.
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::reifyAllProperties):
+            - Match now takes a reference to ovector, not a pointer.
+        * runtime/RegExpObject.h:
+        (JSC):
+            - Moved MatchResult into its own header.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
+            - Match now takes a reference to ovector, not a pointer.
+        * testRegExp.cpp:
+        (testOneRegExp):
+            - Match now takes a reference to ovector, not a pointer.
+        * yarr/YarrJIT.cpp:
+        (Yarr):
+        (YarrGenerator):
+        (JSC::Yarr::YarrGenerator::initCallFrame):
+        (JSC::Yarr::YarrGenerator::removeCallFrame):
+        (JSC::Yarr::YarrGenerator::setSubpatternStart):
+        (JSC::Yarr::YarrGenerator::setSubpatternEnd):
+        (JSC::Yarr::YarrGenerator::clearSubpatternStart):
+        (JSC::Yarr::YarrGenerator::setMatchStart):
+        (JSC::Yarr::YarrGenerator::getMatchStart):
+            - Added helper functions to intermediate access to output.
+        (JSC::Yarr::YarrGenerator::generateDotStarEnclosure):
+        (JSC::Yarr::YarrGenerator::generate):
+        (JSC::Yarr::YarrGenerator::backtrack):
+        (JSC::Yarr::YarrGenerator::generateEnter):
+        (JSC::Yarr::YarrGenerator::compile):
+            - Changed to use the new helpers, only generate subpatterns if IncludeSubpatterns.
+        (JSC::Yarr::jitCompile):
+            - Needs to template of MatchOnly or IncludeSubpatterns.
+        * yarr/YarrJIT.h:
+        (YarrCodeBlock):
+        (JSC::Yarr::YarrCodeBlock::set8BitCode):
+        (JSC::Yarr::YarrCodeBlock::set16BitCode):
+        (JSC::Yarr::YarrCodeBlock::has8BitCodeMatchOnly):
+        (JSC::Yarr::YarrCodeBlock::has16BitCodeMatchOnly):
+        (JSC::Yarr::YarrCodeBlock::set8BitCodeMatchOnly):
+        (JSC::Yarr::YarrCodeBlock::set16BitCodeMatchOnly):
+        (JSC::Yarr::YarrCodeBlock::execute):
+        (JSC::Yarr::YarrCodeBlock::clear):
+            - Added a second set of CodeRefs, so that we can compile RexExps with/without subpattern matching.
+
+2012-03-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit should not generate an exit for variables of inlinees if the
+        inlinees are not in scope
+        https://bugs.webkit.org/show_bug.cgi?id=82312
+
+        Reviewed by Oliver Hunt.
+        
+        * bytecode/CodeBlock.h:
+        (JSC::baselineCodeBlockForInlineCallFrame):
+        (JSC):
+        (JSC::baselineCodeBlockForOriginAndBaselineCodeBlock):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::computeNumVariablesForCodeOrigin):
+        (DFG):
+        (JSC::DFG::OSRExit::OSRExit):
+
+2012-03-27  Matt Lilek  <mrl@apple.com>
+
+        Stop compiling Interpreter.cpp with -fno-var-tracking
+        https://bugs.webkit.org/show_bug.cgi?id=82299
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-03-27  Pratik Solanki  <psolanki@apple.com>
+
+        Compiler warning when JIT is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=82352
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+
+2012-03-26  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Unaligned userspace access for SH4 platforms
+        https://bugs.webkit.org/show_bug.cgi?id=79104
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/AbstractMacroAssembler.h:
+        (Jump):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load16Unaligned):
+        (JSC::MacroAssemblerSH4::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerSH4::branchDouble):
+        (JSC::MacroAssemblerSH4::branchTrue):
+        (JSC::MacroAssemblerSH4::branchFalse):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::extraInstrForBranch):
+        (SH4Assembler):
+        (JSC::SH4Assembler::bra):
+        (JSC::SH4Assembler::linkJump):
+        * jit/JIT.h:
+        (JIT):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+
+2012-03-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        cssText should use shorthand notations
+        https://bugs.webkit.org/show_bug.cgi?id=81737
+
+        Reviewed by Enrica Casucci.
+
+        Export symbols of BitVector on Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should assert that argument value recoveries can only be
+        AlreadyInRegisterFile or Constant
+        https://bugs.webkit.org/show_bug.cgi?id=82249
+
+        Reviewed by Michael Saboff.
+        
+        Made the assertions that the DFG makes for argument value recoveries match
+        what Arguments expects.
+
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::isConstant):
+        (ValueRecovery):
+        (JSC::ValueRecovery::isAlreadyInRegisterFile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-03-26  Dan Bernstein  <mitz@apple.com>
+
+        Tried to fix the Windows build.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+
+2012-03-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed - speculative Windows build fix.
+
+        * yarr/YarrCanonicalizeUCS2.h:
+        (JSC::Yarr::getCanonicalPair):
+
+2012-03-26  Dan Bernstein  <mitz@apple.com>
+
+        Fixed builds with assertions disabled.
+
+        * yarr/YarrCanonicalizeUCS2.h:
+        (JSC::Yarr::areCanonicallyEquivalent):
+
+2012-03-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed - errk! - accidentally the whole pbxproj.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-03-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Greek sigma is handled wrong in case independent regexp.
+        https://bugs.webkit.org/show_bug.cgi?id=82063
+
+        Reviewed by Oliver Hunt.
+
+        The bug here is that we assume that any given codepoint has at most one additional value it
+        should match under a case insensitive match, and that the pair of codepoints that match (if
+        a codepoint does not only match itself) can be determined by calling toUpper/toLower on the
+        given codepoint). Life is not that simple.
+
+        Instead, pre-calculate a set of tables mapping from a UCS2 codepoint to the set of characters
+        it may match, under the ES5.1 case-insensitive matching rules. Since unicode is fairly regular
+        we can pack this table quite nicely, and get it down to 364 entries. This means we can use a
+        simple binary search to find an entry in typically eight compares.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * yarr/yarr.pri:
+            - Added new files to build systems.
+        * yarr/YarrCanonicalizeUCS2.cpp: Added.
+            - New - autogenerated, UCS2 canonicalized comparison tables.
+        * yarr/YarrCanonicalizeUCS2.h: Added.
+        (JSC::Yarr::rangeInfoFor):
+            - Look up the canonicalization info for a UCS2 character.
+        (JSC::Yarr::getCanonicalPair):
+            - For a UCS2 character with a single equivalent value, look it up.
+        (JSC::Yarr::isCanonicallyUnique):
+            - Returns true if no other UCS2 code points are canonically equal.
+        (JSC::Yarr::areCanonicallyEquivalent):
+            - Compare two values, under canonicalization rules.
+        * yarr/YarrCanonicalizeUCS2.js: Added.
+            - script used to generate YarrCanonicalizeUCS2.cpp.
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+            - Use isCanonicallyUnique, rather than Unicode toUpper/toLower.
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+            - Use isCanonicallyUnique, rather than Unicode toUpper/toLower.
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+            - Updated to determine canonical equivalents correctly.
+        (JSC::Yarr::CharacterClassConstructor::putUnicodeIgnoreCase):
+            - Added, used to put a non-ascii, non-unique character in a case-insensitive match.
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+            - Updated to determine canonical equivalents correctly.
+        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
+            - Changed to call putUnicodeIgnoreCase, instead of putChar, avoid a double lookup of rangeInfo.
+
+2012-03-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Add the build outputs dir to the list of build dirs,
+        so we make sure it finds the API headers on all platforms.
+
+        * wscript:
+
+2012-03-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for WinCE after r112039.
+
+        * interpreter/Register.h:
+        (Register): Removed inline keyword from decleration since
+                    there is an ALWAYS_INLINE at the definition anyway.
+
+2012-03-26  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-03-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Move WTF to its own static lib build.
+
+        * wscript:
+
+2012-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG int-to-double conversion should be revealed to CSE
+        https://bugs.webkit.org/show_bug.cgi?id=82135
+
+        Reviewed by Oliver Hunt.
+        
+        This introduces the notion of an Int32ToDouble node, which is injected
+        into the graph anytime we know that we have a double use of a node that
+        was predicted integer. The Int32ToDouble simplifies double speculation
+        on integers by skipping the path that would unbox doubles, if we know
+        that the value is already proven to be an integer. It allows integer to
+        double conversions to be subjected to common subexpression elimination
+        (CSE) by allowing the CSE phase to see where these conversions are
+        occurring. Finally, it allows us to see when a constant is being used
+        as both a double and an integer. This is a bit odd, since it means that
+        sometimes a double use of a constant will not refer directly to the
+        constant. This should not cause problems, for now, but it may require
+        some canonizalization in the future if we want to support strength
+        reductions of double operations based on constants.
+        
+        To allow injection of nodes into the graph, this change introduces the
+        DFG::InsertionSet, which is a way of lazily inserting elements into a
+        list. This allows the FixupPhase to remain O(N) despite performing
+        multiple injections in a single basic block. Without the InsertionSet,
+        each injection would require performing an insertion into a vector,
+        which is O(N), leading to O(N^2) performance overall. With the
+        InsertionSet, each injection simply records what insertion would have
+        been performed, and all insertions are performed at once (via
+        InsertionSet::execute) after processing of a basic block is completed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PredictedType.h:
+        (JSC::isActionableIntMutableArrayPrediction):
+        (JSC):
+        (JSC::isActionableFloatMutableArrayPrediction):
+        (JSC::isActionableTypedMutableArrayPrediction):
+        (JSC::isActionableMutableArrayPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::useKindToString):
+        (DFG):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupBlock):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGInsertionSet.h: Added.
+        (DFG):
+        (Insertion):
+        (JSC::DFG::Insertion::Insertion):
+        (JSC::DFG::Insertion::index):
+        (JSC::DFG::Insertion::element):
+        (InsertionSet):
+        (JSC::DFG::InsertionSet::InsertionSet):
+        (JSC::DFG::InsertionSet::append):
+        (JSC::DFG::InsertionSet::execute):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::IntegerOperand::IntegerOperand):
+        (JSC::DFG::DoubleOperand::DoubleOperand):
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        (JSC::DFG::StorageOperand::StorageOperand):
+        (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGOperands should be moved out of the DFG and into bytecode
+        https://bugs.webkit.org/show_bug.cgi?id=82151
+
+        Reviewed by Dan Bernstein.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Operands.h: Copied from Source/JavaScriptCore/dfg/DFGOperands.h.
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGOSREntry.h:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOperands.h: Removed.
+        * dfg/DFGVariableAccessData.h:
+
+2012-03-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG 64-bit Branch implementation should not be creating a JSValueOperand that
+        it isn't going to use
+        https://bugs.webkit.org/show_bug.cgi?id=82136
+
+        Reviewed by Geoff Garen.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+
+2012-03-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed. Fix the build after WTF move.
+
+        * wscript:
+
+2012-03-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG double voting may be overzealous in the case of variables that end up
+        being used as integers
+        https://bugs.webkit.org/show_bug.cgi?id=82008
+
+        Reviewed by Oliver Hunt.
+        
+        Cleaned up propagation, making the intent more explicit in most places.
+        Back-propagate NodeUsedAsInt for cases where a node was used in a context
+        that is known to strongly prefer integers.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::run):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
+        (JSC::DFG::PredictionPropagationPhase::vote):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        (JSC::DFG::PredictionPropagationPhase::fixupNode):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+
+2012-03-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Node::shouldNotSpeculateInteger() should be eliminated
+        https://bugs.webkit.org/show_bug.cgi?id=82123
+
+        Reviewed by Geoff Garen.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (Node):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+
+2012-03-24  Yong Li  <yoli@rim.com>
+
+        Increase getByIdSlowCase ConstantSpace/InstructionSpace for CPU(ARM_TRADITIONAL)
+        https://bugs.webkit.org/show_bug.cgi?id=81521
+
+        Increase sequenceGetByIdSlowCaseConstantSpace and sequenceGetByIdSlowCaseInstructionSpace
+        for CPU(ARM_TRADITIONAL) to fit actual need.
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JIT.h:
+        (JIT):
+
+2012-03-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Fixup should be able to short-circuit trivial ValueToInt32's
+        https://bugs.webkit.org/show_bug.cgi?id=82030
+
+        Reviewed by Michael Saboff.
+        
+        Takes the fixup() method of the prediction propagation phase and makes it
+        into its own phase. Adds the ability to short-circuit trivial ValueToInt32
+        nodes, and mark pure ValueToInt32's as such.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCommon.h:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp: Added.
+        (DFG):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::FixupPhase):
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::performFixup):
+        * dfg/DFGFixupPhase.h: Added.
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::run):
+        (PredictionPropagationPhase):
+
+2012-03-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        tryReallocate could break the zero-ed memory invariant of CopiedBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=82087
+
+        Reviewed by Filip Pizlo.
+
+        Removing this optimization turned out to be ~1% regression on kraken, so I simply 
+        undid the modification to the current block if we fail.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryReallocate): Undid the reset in the CopiedAllocator if we fail 
+        to reallocate from the current block.
+
+2012-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac] No need for platform-specific ENABLE_BLOB values
+        https://bugs.webkit.org/show_bug.cgi?id=82102
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-23  Michael Saboff  <msaboff@apple.com>
+
+        DFG::compileValueToInt32 Sometime Generates GPR to FPR reg back to GPR
+        https://bugs.webkit.org/show_bug.cgi?id=81805
+
+        Reviewed by Filip Pizlo.
+
+        Added SpeculativeJIT::checkGeneratedType() to determine the current format
+        of an operand.  Used that information in SpeculativeJIT::compileValueToInt32
+        to generate code that will use integer and JSValue types in integer
+        format directly without a conversion to double.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkGeneratedType):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        * dfg/DFGSpeculativeJIT.h:
+        (DFG):
+        (SpeculativeJIT):
+
+2012-03-23  Steve Falkenburg  <sfalken@apple.com>
+
+        Update Apple Windows build files for WTF move
+        https://bugs.webkit.org/show_bug.cgi?id=82069
+
+        Reviewed by Jessie Berlin.
+
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Removed WTF and WTFGenerated.
+
+2012-03-23  Dean Jackson  <dino@apple.com>
+
+        Disable CSS_SHADERS in Apple builds
+        https://bugs.webkit.org/show_bug.cgi?id=81996
+
+        Reviewed by Simon Fraser.
+
+        Remove ENABLE_CSS_SHADERS from FeatureDefines. It's now in Platform.h.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-23  Gavin Barraclough  <barraclough@apple.com>
+
+        RexExp constructor last match properties should not rely on previous ovector
+        https://bugs.webkit.org/show_bug.cgi?id=82077
+
+        Reviewed by Oliver Hunt.
+
+        This change simplifies matching, and will enable subpattern results to be fully lazily generated in the future.
+
+        This patch changes the scheme used to lazily generate the last match properties of the RegExp object.
+        Instead of relying on the results in the ovector, we can instead lazily generate the subpatters using
+        a RegExpMatchesArray. To do so we just need to store the input, the regexp matched, and the match
+        location (the MatchResult). When the match is accessed or the input is set, we reify results. We use
+        a special value of setting the saved result to MatchResult::failed() to indicated that we're in a
+        reified state. This means that next time a match is performed, the store of the result will
+        automatically blow away the reified value.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Added new files.
+        * runtime/RegExp.cpp:
+        (JSC::RegExpFunctionalTestCollector::outputOneTest):
+            - changed 'subPattern' -> 'subpattern' (there was a mix in JSC, 'subpattern' was more common).
+        * runtime/RegExpCachedResult.cpp: Added.
+        (JSC::RegExpCachedResult::visitChildren):
+        (JSC::RegExpCachedResult::lastResult):
+        (JSC::RegExpCachedResult::setInput):
+            - New methods, mark GC objects, lazily create the matches array, and record a user provided input (via assignment to RegExp.inupt).
+        * runtime/RegExpCachedResult.h: Added.
+        (RegExpCachedResult):
+            - Added new class.
+        (JSC::RegExpCachedResult::RegExpCachedResult):
+        (JSC::RegExpCachedResult::record):
+        (JSC::RegExpCachedResult::input):
+            - Initialize the object, record the result of a RegExp match, access the stored input property.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+            - Initialize m_result/m_multiline properties.
+        (JSC::RegExpConstructor::visitChildren):
+            - Make sure the cached results (or lazy source for them) are marked.
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+            - Moved from RegExpConstructor, moved to RegExpCachedResult, and using new caching scheme.
+        (JSC::regExpConstructorInput):
+        (JSC::setRegExpConstructorInput):
+            - Changed to use RegExpCachedResult.
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::create):
+        (RegExpConstructor):
+        (JSC::RegExpConstructor::setMultiline):
+        (JSC::RegExpConstructor::multiline):
+            - Move multiline property onto the constructor object; it is not affected by the last match.
+        (JSC::RegExpConstructor::setInput):
+        (JSC::RegExpConstructor::input):
+            - These defer to RegExpCachedResult.
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/RegExpMatchesArray.cpp: Added.
+        (JSC::RegExpMatchesArray::visitChildren):
+            - Eeeep! added missing visitChildren!
+        (JSC::RegExpMatchesArray::finishCreation):
+        (JSC::RegExpMatchesArray::reifyAllProperties):
+        (JSC::RegExpMatchesArray::reifyMatchProperty):
+            - Moved from RegExpConstructor.cpp.
+        (JSC::RegExpMatchesArray::leftContext):
+        (JSC::RegExpMatchesArray::rightContext):
+            - Since the match start/
+        * runtime/RegExpMatchesArray.h:
+        (RegExpMatchesArray):
+            - Declare new methods & structure flags.
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+            - performMatch now requires the JSString input, to cache.
+        * runtime/StringPrototype.cpp:
+        (JSC::removeUsingRegExpSearch):
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+            - performMatch now requires the JSString input, to cache.
+
+2012-03-23  Tony Chang  <tony@chromium.org>
+
+        [chromium] rename newwtf target back to wtf
+        https://bugs.webkit.org/show_bug.cgi?id=82064
+
+        Reviewed by Adam Barth.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2012-03-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Simplify memory usage tracking in CopiedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=80705
+
+        Reviewed by Filip Pizlo.
+
+        * heap/CopiedAllocator.h:
+        (CopiedAllocator): Rename currentUtilization to currentSize.
+        (JSC::CopiedAllocator::currentCapacity):
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+        (JSC::CopiedBlock::payload): Move the implementation of payload() out of the class
+        declaration.
+        (JSC):
+        (JSC::CopiedBlock::size): Add new function to calculate the block's size.
+        (JSC::CopiedBlock::capacity): Ditto for capacity.
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::CopiedSpace): Remove old bogus memory stats fields and add a new
+        field for the water mark.
+        (JSC::CopiedSpace::init):
+        (JSC::CopiedSpace::tryAllocateSlowCase): When we fail to allocate from the current 
+        block, we need to update our current water mark with the size of the block.
+        (JSC::CopiedSpace::tryAllocateOversize): When we allocate a new oversize block, we 
+        need to update our current water mark with the size of the used portion of the block.
+        (JSC::CopiedSpace::tryReallocate): We don't need to update the water mark when 
+        reallocating because it will either get accounted for when we fill up the block later 
+        in the case of being able to reallocate in the current block or it will get picked up 
+        immediately because we'll have to get a new block.
+        (JSC::CopiedSpace::tryReallocateOversize): We do, however, need to update in when 
+        realloc-ing an oversize block because we deallocate the old block and allocate a brand 
+        new one.
+        (JSC::CopiedSpace::doneFillingBlock): Update the water mark as blocks are returned to 
+        the CopiedSpace by the SlotVisitors.
+        (JSC::CopiedSpace::doneCopying): Add in any pinned blocks to the water mark.
+        (JSC::CopiedSpace::getFreshBlock): We use the Heap's new function to tell us whether or 
+        not we should collect now instead of doing the calculation ourself.
+        (JSC::CopiedSpace::destroy):
+        (JSC):
+        (JSC::CopiedSpace::size): Manually calculate the size of the CopiedSpace, similar to how 
+        MarkedSpace does.
+        (JSC::CopiedSpace::capacity): Ditto for capacity.
+        * heap/CopiedSpace.h:
+        (JSC::CopiedSpace::waterMark):
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::startedCopying): Reset water mark to 0 when we start copying during a 
+        collection.
+        (JSC::CopiedSpace::allocateNewBlock):
+        (JSC::CopiedSpace::fitsInBlock):
+        (JSC::CopiedSpace::allocateFromBlock):
+        * heap/Heap.cpp:
+        (JSC::Heap::size): Incorporate size of CopiedSpace into the total size of the Heap.
+        (JSC::Heap::capacity): Ditto for capacity.
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::shouldCollect): New function for other sub-parts of the Heap to use to 
+        determine whether they should initiate a collection or continue to allocate new blocks.
+        (JSC):
+        (JSC::Heap::waterMark): Now is the sum of the water marks of the two sub-parts of the
+        Heap (MarkedSpace and CopiedSpace).
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase): Changed to use the Heap's new shouldCollect() function.
+
+2012-03-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        BitVector::resizeOutOfLine doesn't memset when converting an inline buffer
+        https://bugs.webkit.org/show_bug.cgi?id=82012
+
+        Reviewed by Filip Pizlo.
+
+        Initialize out-of-line buffers while extending an inline buffer. Also export symbols to be used in WebCore.
+
+        * wtf/BitVector.cpp:
+        (WTF::BitVector::resizeOutOfLine):
+        * wtf/BitVector.h:
+        (BitVector):
+        (OutOfLineBits):
+
+2012-03-22  Michael Saboff  <msaboff@apple.com>
+
+        ExecutableAllocator::memoryPressureMultiplier() might can return NaN
+        https://bugs.webkit.org/show_bug.cgi?id=82002
+
+        Reviewed by Filip Pizlo.
+
+        Guard against divide by zero and then make sure the return
+        value is >= 1.0.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::memoryPressureMultiplier):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::memoryPressureMultiplier):
+
+2012-03-22  Jessie Berlin  <jberlin@apple.com>
+
+        Windows build fix after r111778.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Don't include and try to build files owned by WTF.
+        Also, let VS have its way with the vcproj in terms of file ordering.
+
+2012-03-22  Raphael Kubo da Costa  <rakuco@FreeBSD.org>
+
+        [CMake] Unreviewed build fix after r111778.
+
+        * CMakeLists.txt: Move ${WTF_DIR} after ${JAVASCRIPTCORE_DIR} in
+        the include paths so that the right config.h is used.
+
+2012-03-22  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, fix chromium build after wtf move.
+
+        Remove old wtf_config and wtf targets.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2012-03-22  Martin Robinson  <mrobinson@igalia.com>
+
+        Fixed the GTK+ WTF/JavaScriptCore build after r111778.
+
+        * GNUmakefile.list.am: Removed an extra trailing backslash.
+
+2012-03-22  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * Configurations/JavaScriptCore.xcconfig: Tell the linker to pull in all members from static libraries
+        rather than only those that contain symbols that JavaScriptCore itself uses.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Remove some bogus settings that crept in to the Xcode project.
+
+2012-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG NodeFlags has some duplicate code and naming issues
+        https://bugs.webkit.org/show_bug.cgi?id=81975
+
+        Reviewed by Gavin Barraclough.
+        
+        Removed most references to "ArithNodeFlags" since those are now just part
+        of the node flags. Fixed some renaming goofs (EdgedAsNum is once again
+        NodeUsedAsNum). Got rid of setArithNodeFlags() and mergeArithNodeFlags()
+        because the former was never called and the latter did the same things as
+        mergeFlags().
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        (Node):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        (JSC::DFG::nodeUsedAsNumber):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::mergeDefaultArithFlags):
+
+2012-03-22  Eric Seidel  <eric@webkit.org>
+
+        Actually move WTF files to their new home
+        https://bugs.webkit.org/show_bug.cgi?id=81844
+
+        Unreviewed.  The details of the port-specific changes
+        have been seen by contributors from those ports, but
+        the whole 5MB change isn't very reviewable as-is.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JSCTypedArrayStubs.h:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+
+2012-03-22  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed. Adding Source/WTF to the build.
+
+        * wscript:
+
+2012-03-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Add JSValue::isFunction
+        https://bugs.webkit.org/show_bug.cgi?id=81935
+
+        Reviewed by Geoff Garen.
+
+        This would be useful in the WebCore bindings code.
+        Also, remove asFunction, replace with jsCast<JSFunction*>.
+
+        * API/JSContextRef.cpp:
+        * debugger/Debugger.cpp:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueOfFunctionConstant):
+        * dfg/DFGOperations.cpp:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::isInlineCallFrameSlow):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * runtime/Arguments.h:
+        (JSC::Arguments::finishCreation):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::compileFor):
+        (JSC::FunctionExecutable::compileOptimizedFor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        * runtime/JSFunction.h:
+        (JSC):
+        (JSC::asJSFunction):
+        (JSC::JSValue::isFunction):
+        * runtime/JSGlobalData.cpp:
+        (WTF::Recompiler::operator()):
+        (JSC::JSGlobalData::releaseExecutableMemory):
+        * runtime/JSValue.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+
+2012-03-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculation on booleans should be rationalized
+        https://bugs.webkit.org/show_bug.cgi?id=81840
+
+        Reviewed by Gavin Barraclough.
+        
+        This removes isKnownBoolean() and replaces it with AbstractState-based
+        optimization, and cleans up the control flow in code gen methods for
+        Branch and LogicalNot. Also fixes a goof in Node::shouldSpeculateNumber,
+        and removes isKnownNotBoolean() since that method appeared to be a
+        helper used solely by 32_64's speculateBooleanOperation().
+        
+        This is performance-neutral.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-03-21  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * wtf/MetaAllocator.h:
+        (MetaAllocator): Export the destructor.
+
+2012-03-21  Eric Seidel  <eric@webkit.org>
+
+        Fix remaining WTF includes in JavaScriptCore in preparation for moving WTF headers out of JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=81834
+
+        Reviewed by Adam Barth.
+
+        * jsc.cpp:
+        * os-win32/WinMain.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/TimeoutChecker.cpp:
+        * testRegExp.cpp:
+        * tools/CodeProfiling.cpp:
+
+2012-03-21  Eric Seidel  <eric@webkit.org>
+
+        WTF::MetaAllocator has a weak vtable (discovered when building wtf as a static library)
+        https://bugs.webkit.org/show_bug.cgi?id=81838
+
+        Reviewed by Geoffrey Garen.
+
+        My understanding is that weak vtables happen when the compiler/linker cannot
+        determine which compilation unit should constain the vtable.  In this case
+        because there were only pure virtual functions as well as an "inline"
+        virtual destructor (thus the virtual destructor was defined in many compilation
+        units).  Since you can't actually "inline" a virtual function (it still has to
+        bounce through the vtable), the "inline" on this virutal destructor doesn't
+        actually help performance, and is only serving to confuse the compiler here.
+        I've moved the destructor implementation to the .cpp file, thus making
+        it clear to the compiler where the vtable should be stored, and solving the error.
+
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocator::~MetaAllocator):
+        (WTF):
+        * wtf/MetaAllocator.h:
+
+2012-03-20  Gavin Barraclough  <barraclough@apple.com>
+
+        RegExpMatchesArray should not copy the ovector
+        https://bugs.webkit.org/show_bug.cgi?id=81742
+
+        Reviewed by Michael Saboff.
+
+        Currently, all RegExpMatchesArray object contain Vector<int, 32>, used to hold any sub-pattern results.
+        This makes allocation/construction/destruction of these objects more expensive. Instead, just store the
+        main match, and recreate the sub-pattern ranges only if necessary (these are often only used for grouping,
+        and the results never accessed).
+        If the main match (index 0) of the RegExpMatchesArray is accessed, reify that value alone.
+
+        * dfg/DFGOperations.cpp:
+            - RegExpObject match renamed back to test (test returns a bool).
+        * runtime/RegExpConstructor.cpp:
+        (JSC):
+            - Removed RegExpResult, RegExpMatchesArray constructor, destroy method.
+        (JSC::RegExpMatchesArray::finishCreation):
+            - Removed RegExpConstructorPrivate parameter.
+        (JSC::RegExpMatchesArray::reifyAllProperties):
+            - (Was fillArrayInstance) Reify all properties of the RegExpMatchesArray.
+            If there are sub-pattern properties, the RegExp is re-run to generate their values.
+        (JSC::RegExpMatchesArray::reifyMatchProperty):
+            - Reify just the match (index 0) property of the RegExpMatchesArray.
+        * runtime/RegExpConstructor.h:
+        (RegExpConstructor):
+        (JSC::RegExpConstructor::performMatch):
+            - performMatch now returns a MatchResult, rather than using out-parameters.
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+            - Moved from .cpp, stores the input/regExp/result to use when lazily reifying properties.
+        (RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::create):
+            - Now passed the input string matched against, the RegExp, and the MatchResult.
+        (JSC::RegExpMatchesArray::reifyAllPropertiesIfNecessary):
+        (JSC::RegExpMatchesArray::reifyMatchPropertyIfNecessary):
+            - Helpers to conditionally reify properties.
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::getOwnPropertySlotByIndex):
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::putByIndex):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::deletePropertyByIndex):
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        (JSC::RegExpMatchesArray::defineOwnProperty):
+            - Changed to use reifyAllPropertiesIfNecessary/reifyMatchPropertyIfNecessary
+            (getOwnPropertySlotByIndex calls reifyMatchPropertyIfNecessary if index is 0).
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::exec):
+        (JSC::RegExpObject::match):
+            - match now returns a MatchResult.
+        * runtime/RegExpObject.h:
+        (JSC::MatchResult::MatchResult):
+            - Added the result of a match is a start & end tuple.
+        (JSC::MatchResult::failed):
+            - A failure is indicated by (notFound, 0).
+        (JSC::MatchResult::operator bool):
+            - Evaluates to false if the match failed.
+        (JSC::MatchResult::empty):
+            - Evaluates to true if the match succeeded with length 0.
+        (JSC::RegExpObject::test):
+            - Now returns a bool.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+            - RegExpObject match renamed back to test (test returns a bool).
+        * runtime/StringPrototype.cpp:
+        (JSC::removeUsingRegExpSearch):
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+            - performMatch now returns a MatchResult, rather than using out-parameters.
+
+2012-03-21  Hojong Han  <hojong.han@samsung.com>
+
+        Fix out of memory by allowing overcommit
+        https://bugs.webkit.org/show_bug.cgi?id=81743
+
+        Reviewed by Geoffrey Garen.
+
+        Garbage collection is not triggered and new blocks are added
+        because overcommit is allowed by MAP_NORESERVE flag when high water mark is big enough.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+
+2012-03-21  Jessie Berlin  <jberlin@apple.com>
+
+        More Windows build fixing.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Fix the order of the include directories to look in include/private first before looking
+        in include/private/JavaScriptCore.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        Look in the Production output directory (where the wtf headers will be). This is the same
+        thing that is done for jsc and testRegExp in ReleasePGO.
+
+2012-03-21  Jessie Berlin  <jberlin@apple.com>
+
+        WTF headers should be in $(ConfigurationBuildDir)\include\private\wtf, not
+        $(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf.
+        https://bugs.webkit.org/show_bug.cgi?id=81739
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        Look for AtomicString.cpp, StringBuilder.cpp, StringImpl.cpp, and WTFString.cpp in the wtf
+        subdirectory of the build output, not the JavaScriptCore/wtf subdirectory.
+        * JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj:
+        Ditto.
+
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops:
+        Get the headers for those 4 files from the wtf subdirectory of the build output, not the
+        JavaScriptCore/wtf subdirectory.
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+        Ditto.
+
+2012-03-20  Eric Seidel  <eric@webkit.org>
+
+        Move wtf/Platform.h from JavaScriptCore to Source/WTF/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80911
+
+        Reviewed by Adam Barth.
+
+        Update the various build systems to depend on Source/WTF headers
+        as well as remove references to Platform.h (since it's now moved).
+
+        * CMakeLists.txt:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+
+2012-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        op_mod fails on many interesting corner cases
+        https://bugs.webkit.org/show_bug.cgi?id=81648
+
+        Reviewed by Oliver Hunt.
+        
+        Removed most strength reduction for op_mod, and fixed the integer handling
+        to do the right thing for corner cases. Oddly, this revealed bugs in OSR,
+        which this patch also fixes.
+        
+        This patch is performance neutral on all of the major benchmarks we track.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITArithmetic.cpp:
+        (JSC):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC):
+        * jit/JITStubs.h:
+        (TrampolineStructure):
+        (JSC::JITThunks::ctiNativeConstruct):
+        * llint/LowLevelInterpreter64.asm:
+        * wtf/Platform.h:
+        * wtf/SimpleStats.h:
+        (WTF::SimpleStats::variance):
+
+2012-03-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows (make based) build fix.
+        <rdar://problem/11069015>
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: devenv /rebuild doesn't work with JavaScriptCore.vcproj. Use /clean and /build instead.
+
+2012-03-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Move WTF-related Windows project files out of JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=80680
+
+        This change only moves the vcproj and related files from JavaScriptCore/JavaScriptCore.vcproj/WTF.
+        It does not move any source code. This is in preparation for the WTF source move out of
+        JavaScriptCore.
+
+        Reviewed by Jessie Berlin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/WTF: Removed.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFDebug.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGenerated.make: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGenerated.vcproj: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedCommon.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebug.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugAll.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedProduction.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedRelease.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedReleaseCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFPostBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFPreBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/build-generated-files.sh: Removed.
+        * JavaScriptCore.vcproj/WTF/copy-files.cmd: Removed.
+        * JavaScriptCore.vcproj/WTF/work-around-vs-dependency-tracking-bugs.py: Removed.
+
+2012-03-20  Benjamin Poulain  <bpoulain@apple.com>
+
+        Cache the type string of JavaScript object
+        https://bugs.webkit.org/show_bug.cgi?id=81446
+
+        Reviewed by Geoffrey Garen.
+
+        Instead of creating the JSString every time, we create
+        lazily the strings in JSGlobalData.
+
+        This avoid the construction of the StringImpl and of the JSString,
+        which gives some performance improvements.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::finalizeSmallStrings):
+        (JSC::SmallStrings::initialize):
+        (JSC):
+        * runtime/SmallStrings.h:
+        (SmallStrings):
+
+2012-03-20  Oliver Hunt  <oliver@apple.com>
+
+        Allow LLINT to work even when executable allocation fails.
+        https://bugs.webkit.org/show_bug.cgi?id=81693
+
+        Reviewed by Gavin Barraclough.
+
+        Don't crash if executable allocation fails if we can fall back on LLINT
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+
+2012-03-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Division optimizations fail to infer cases of truncated division and mishandle -2147483648/-1
+        https://bugs.webkit.org/show_bug.cgi?id=81428
+
+        32 bit buildfix after r111355.
+
+        2147483648 (2^31) isn't valid int literal in ISO C90, because 2147483647 (2^31-1) is the biggest int.
+        The smallest int is -2147483648 (-2^31) == -2147483647 - 1  == -INT32_MAX-1 == INT32_MIN (stdint.h).
+
+        Reviewed by Zoltan Herczeg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
+
+2012-03-19  Jochen Eisinger  <jochen@chromium.org>
+
+        Split WTFReportBacktrace into WTFReportBacktrace and WTFPrintBacktrace
+        https://bugs.webkit.org/show_bug.cgi?id=80983
+
+        Reviewed by Darin Adler.
+
+        This allows printing a backtrace acquired by an earlier WTFGetBacktrace
+        call which is useful for local debugging.
+
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2012-03-19  Benjamin Poulain  <benjamin@webkit.org>
+
+        Do not copy the script source in the SourceProvider, just reference the existing string
+        https://bugs.webkit.org/show_bug.cgi?id=81466
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/SourceCode.h: Remove the unused, and incorrect, function data().
+        * parser/SourceProvider.h: Add OVERRIDE for clarity.
+
+2012-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Division optimizations fail to infer cases of truncated division and
+        mishandle -2147483648/-1
+        https://bugs.webkit.org/show_bug.cgi?id=81428
+        <rdar://problem/11067382>
+
+        Reviewed by Oliver Hunt.
+
+        If you're a division over integers and you're only used as an integer, then you're
+        an integer division and remainder checks become unnecessary. If you're dividing
+        -2147483648 by -1, don't crash.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::add32):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * llint/LowLevelInterpreter64.asm:
+
+2012-03-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        Simplify SmallStrings
+        https://bugs.webkit.org/show_bug.cgi?id=81445
+
+        Reviewed by Gavin Barraclough.
+
+        SmallStrings had two methods that should not be public: count() and clear().
+
+        The method clear() is effectively replaced by finalizeSmallStrings(). The body
+        of the method was moved to the constructor since the code is obvious.
+
+        The method count() is unused.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        * runtime/SmallStrings.h:
+        (SmallStrings):
+
+2012-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG can no longer compile V8-v4/regexp in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=81592
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Prediction propagation for UInt32ToNumber incorrectly assumes that outs outcome does not
+        change throughout the fixpoint
+        https://bugs.webkit.org/show_bug.cgi?id=81583
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2012-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        GC should not attempt to clear LLInt instruction inline caches for code blocks that are in
+        the process of being generated
+        https://bugs.webkit.org/show_bug.cgi?id=81565
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+
+2012-03-19  Eric Seidel  <eric@webkit.org>
+
+        Fix WTF header include discipline in Chromium WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=81281
+
+        Reviewed by James Robinson.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * wtf/unicode/icu/CollatorICU.cpp:
+
+2012-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG NodeUse should be called Edge and NodeReferenceBlob should be called AdjacencyList
+        https://bugs.webkit.org/show_bug.cgi?id=81556
+
+        Rubber stamped by Gavin Barraclough.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::forNode):
+        * dfg/DFGAdjacencyList.h: Copied from Source/JavaScriptCore/dfg/DFGNodeReferenceBlob.h.
+        (JSC::DFG::AdjacencyList::AdjacencyList):
+        (JSC::DFG::AdjacencyList::child):
+        (JSC::DFG::AdjacencyList::setChild):
+        (JSC::DFG::AdjacencyList::child1):
+        (JSC::DFG::AdjacencyList::child2):
+        (JSC::DFG::AdjacencyList::child3):
+        (JSC::DFG::AdjacencyList::setChild1):
+        (JSC::DFG::AdjacencyList::setChild2):
+        (JSC::DFG::AdjacencyList::setChild3):
+        (JSC::DFG::AdjacencyList::child1Unchecked):
+        (JSC::DFG::AdjacencyList::initialize):
+        (AdjacencyList):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addVarArgChild):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::canonicalize):
+        (JSC::DFG::CSEPhase::performSubstitution):
+        * dfg/DFGEdge.h: Copied from Source/JavaScriptCore/dfg/DFGNodeUse.h.
+        (DFG):
+        (JSC::DFG::Edge::Edge):
+        (JSC::DFG::Edge::operator==):
+        (JSC::DFG::Edge::operator!=):
+        (Edge):
+        (JSC::DFG::operator==):
+        (JSC::DFG::operator!=):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::operator[]):
+        (JSC::DFG::Graph::at):
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        (JSC::DFG::Graph::clearAndDerefChild1):
+        (JSC::DFG::Graph::clearAndDerefChild2):
+        (JSC::DFG::Graph::clearAndDerefChild3):
+        (Graph):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::getPrediction):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::child1):
+        (JSC::DFG::Node::child1Unchecked):
+        (JSC::DFG::Node::child2):
+        (JSC::DFG::Node::child3):
+        (Node):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::arithNodeFlagsAsString):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        (JSC::DFG::nodeUsedAsNumber):
+        * dfg/DFGNodeReferenceBlob.h: Removed.
+        * dfg/DFGNodeUse.h: Removed.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::mergeDefaultArithFlags):
+        (JSC::DFG::PredictionPropagationPhase::vote):
+        (JSC::DFG::PredictionPropagationPhase::fixupNode):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::use):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::at):
+        (JSC::DFG::SpeculativeJIT::canReuse):
+        (JSC::DFG::SpeculativeJIT::use):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::IntegerOperand::IntegerOperand):
+        (JSC::DFG::DoubleOperand::DoubleOperand):
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        (JSC::DFG::StorageOperand::StorageOperand):
+        (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+
+2012-03-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Object.freeze broken on latest Nightly
+        https://bugs.webkit.org/show_bug.cgi?id=80577
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+            - defineOwnProperty was checking for correct behaviour, provided that length/callee hadn't
+            been overrridden. instead, just reify length/callee & rely on JSObject::defineOwnProperty.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::defineOwnProperty):
+            - for arguments/caller/length properties, defineOwnProperty was incorrectly asserting that
+            the object must be extensible; this is incorrect since these properties should already exist
+            on the object. In addition, it was asserting that the arguments/caller values must match the
+            corresponding magic data properties, but for strict mode function this is incorrect. Instead,
+            just reify the arguments/caller accessor & defer to JSObject::defineOwnProperty.
+
+2012-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt get_by_pname slow path incorrectly assumes that the operands are not constants
+        https://bugs.webkit.org/show_bug.cgi?id=81559
+
+        Reviewed by Michael Saboff.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2012-03-19  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Implement OSAllocator::commit/decommit in the correct way
+        https://bugs.webkit.org/show_bug.cgi?id=77013
+
+        We should use mmap(PROT_NONE, MAP_LAZY) instead of posix_madvise() to
+        implement memory decommitting for QNX.
+
+        Reviewed by Rob Buis.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+
+2012-03-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed - revent a couple of files accidentally committed.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::defineOwnProperty):
+
+2012-03-19  Jessie Berlin  <jberlin@apple.com>
+
+        Another Windows build fix after r111129.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-19  Raphael Kubo da Costa  <rakuco@FreeBSD.org>
+
+        Cross-platform processor core counter: fix build on FreeBSD.
+        https://bugs.webkit.org/show_bug.cgi?id=81482
+
+        Reviewed by Zoltan Herczeg.
+
+        The documentation of sysctl(3) shows that <sys/types.h> should be
+        included before <sys/sysctl.h> (sys/types.h tends to be the first
+        included header in general).
+
+        This should fix the build on FreeBSD and other systems where
+        sysctl.h really depends on types defined in types.h.
+
+        * wtf/NumberOfCores.cpp:
+
+2012-03-19  Jessie Berlin  <jberlin@apple.com>
+
+        Windows build fix after r111129.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-19  Gavin Barraclough  <barraclough@apple.com>
+
+        JSCallbackFunction::toStringCallback/valueOfCallback do not handle 0 return value from convertToType
+        https://bugs.webkit.org/show_bug.cgi?id=81468 <rdar://problem/11034745>
+
+        Reviewed by Oliver Hunt.
+
+        The API specifies that convertToType may opt not to handle a conversion:
+            "@result The objects's converted value, or NULL if the object was not converted."
+        In which case, it would propagate first up the JSClass hierarchy, calling its superclass's
+        conversion functions, and failing that call the JSObject::defaultValue function.
+
+        Unfortunately this behaviour was removed in bug#69677/bug#69858, and instead we now rely on
+        the toStringCallback/valueOfCallback function introduced in bug#69156. Even after a fix in
+        bug#73368, these will return the result from the first convertToType they find, regardless
+        of whether this result is null, and if no convertToType method is found in the api class
+        hierarchy (possible if toStringCallback/valueOfCallback was accessed off the prototype
+        chain), they will also return a null pointer. This is unsafe.
+
+        It would be easy to make the approach based around toStringCallback/valueOfCallback continue
+        to walk the api class hierarchy, but making the fallback to defaultValue would be problematic
+        (since defaultValue calls toStringCallback/valueOfCallback, this would infinitely recurse).
+        Making the fallback work with toString/valueOf methods attached to api objects is probably
+        not the right thing to do – instead, we should just implement the defaultValue trap for api
+        objects.
+
+        In addition, this bug highlights that fact that JSCallbackFunction::call will allow a hard
+        null to be returned from C to JavaScript - this is not okay. Handle with an exception.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+            - Should be null checking the return value.
+        (JSC):
+            - Remove toStringCallback/valueOfCallback.
+        * API/JSCallbackFunction.h:
+        (JSCallbackFunction):
+            - Remove toStringCallback/valueOfCallback.
+        * API/JSCallbackObject.h:
+        (JSCallbackObject):
+            - Add defaultValue mthods to JSCallbackObject.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::defaultValue):
+            - Add defaultValue mthods to JSCallbackObject.
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+            - Remove toStringCallback/valueOfCallback.
+        * API/tests/testapi.js:
+            - Revert this test, now we no longer artificially introduce a toString method onto the api object.
+
+2012-03-18  Raphael Kubo da Costa  <rakuco@FreeBSD.org>
+
+        [EFL] Include ICU_INCLUDE_DIRS when building.
+        https://bugs.webkit.org/show_bug.cgi?id=81483
+
+        Reviewed by Daniel Bates.
+
+        So far, only the ICU libraries were being included when building
+        JavaScriptCore, however the include path is also needed, otherwise the
+        build will fail when ICU is installed into a non-standard location.
+
+        * PlatformEfl.cmake: Include ${ICU_INCLUDE_DIRS}.
+
+2012-03-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Strength reduction, RegExp.exec -> RegExp.test
+        https://bugs.webkit.org/show_bug.cgi?id=81459
+
+        Reviewed by Sam Weinig.
+
+        RegExp.prototype.exec & RegExp.prototype.test can both be used to test a regular
+        expression for a match against a string - however exec is more expensive, since
+        it allocates a matches array object. In cases where the result is consumed in a
+        boolean context the allocation of the matches array can be trivially elided.
+
+        For example:
+            function f()
+            {
+                for (i =0; i < 10000000; ++i)
+                    if(!/a/.exec("a"))
+                        err = true;
+            }
+
+        This is a 2.5x speedup on this example microbenchmark loop.
+
+        In a more advanced form of this optimization, we may be able to avoid allocating
+        the array where access to the array can be observed.
+
+        * create_hash_table:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jsc.cpp:
+        (GlobalObject::addConstructableFunction):
+        * runtime/Intrinsic.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC):
+        * runtime/JSFunction.h:
+        (JSFunction):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::exec):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpObject.h:
+        (RegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+
+2012-03-16  Michael Saboff  <msaboff@apple.com>
+
+        Improve diagnostic benefit of JSGlobalData::m_isInitializingObject
+        https://bugs.webkit.org/show_bug.cgi?id=81244
+
+        Rubber stamped by Filip Pizlo.
+
+        Changed type and name of JSGlobalData::m_isInitializingObject to
+        ClassInfo* and m_initializingObjectClass.
+        Changed JSGlobalData::setInitializingObject to
+        JSGlobalData::setInitializingObjectClass.  This pointer can be used within 
+        the debugger to determine what type of object is being initialized.
+        
+        * runtime/JSCell.h:
+        (JSC::JSCell::finishCreation):
+        (JSC::allocateCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::isInitializingObject):
+        (JSC::JSGlobalData::setInitializingObjectClass):
+        * runtime/Structure.h:
+        (JSC::JSCell::finishCreation):
+
+2012-03-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix. Do not preserve owner and group information when installing the WTF headers.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-03-15  David Dorwin  <ddorwin@chromium.org>
+
+        Make the array pointer parameters in the Typed Array create() methods const.
+        https://bugs.webkit.org/show_bug.cgi?id=81147
+
+        Reviewed by Kenneth Russell.
+
+        This allows const arrays to be passed to these methods.
+        They use PassRefPtr<Subclass> create(), which already has a const parameter.
+
+        * wtf/Int16Array.h:
+        (Int16Array):
+        (WTF::Int16Array::create):
+        * wtf/Int32Array.h:
+        (Int32Array):
+        (WTF::Int32Array::create):
+        * wtf/Int8Array.h:
+        (Int8Array):
+        (WTF::Int8Array::create):
+        * wtf/Uint16Array.h:
+        (Uint16Array):
+        (WTF::Uint16Array::create):
+        * wtf/Uint32Array.h:
+        (Uint32Array):
+        (WTF::Uint32Array::create):
+        * wtf/Uint8Array.h:
+        (Uint8Array):
+        (WTF::Uint8Array::create):
+        * wtf/Uint8ClampedArray.h:
+        (Uint8ClampedArray):
+        (WTF::Uint8ClampedArray::create):
+
+2012-03-15  Myles Maxfield  <mmaxfield@google.com>
+
+        CopiedSpace::tryAllocateOversize assumes system page size
+        https://bugs.webkit.org/show_bug.cgi?id=80615
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateOversize):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::oversizeBlockFor):
+        * wtf/BumpPointerAllocator.h:
+        (WTF::BumpPointerPool::create):
+        * wtf/StdLibExtras.h:
+        (WTF::roundUpToMultipleOf):
+
+2012-03-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing Windows build breakage
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-15  Patrick Gansterer  <paroga@webkit.org>
+
+        [EFL] Make zlib a general build requirement
+        https://bugs.webkit.org/show_bug.cgi?id=80153
+
+        Reviewed by Hajime Morita.
+
+        After r109538 WebSocket module needs zlib to support deflate-frame extension.
+
+        * wtf/Platform.h:
+
+2012-03-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        NumericStrings should be inlined
+        https://bugs.webkit.org/show_bug.cgi?id=81183
+
+        Reviewed by Gavin Barraclough.
+
+        NumericStrings is not always inlined. When it is not, the class is not faster
+        than using UString::number() directly.
+
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        (JSC::NumericStrings::lookupSmallString):
+
+2012-03-15  Andras Becsi  <andras.becsi@nokia.com>
+
+        Fix ARM build after r110792.
+
+        Unreviewed build fix.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        Remove superfluous curly brackets.
+
+2012-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        ARMv7: prefer vmov(gpr,gpr->double) over vmov(gpr->single)
+        https://bugs.webkit.org/show_bug.cgi?id=81256
+
+        Reviewed by Oliver Hunt.
+
+        This is a 0.5% sunspider progression.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
+            - switch which form of vmov we use.
+
+2012-03-15  YoungTaeck Song  <youngtaeck.song@samsung.com>
+
+        [EFL] Add OwnPtr specialization for Ecore_Timer.
+        https://bugs.webkit.org/show_bug.cgi?id=80119
+
+        Reviewed by Hajime Morita.
+
+        Add an overload for deleteOwnedPtr(Ecore_Timer*) on EFL port.
+
+        * wtf/OwnPtrCommon.h:
+        (WTF):
+        * wtf/efl/OwnPtrEfl.cpp:
+        (WTF::deleteOwnedPtr):
+        (WTF):
+
+2012-03-15  Hojong Han  <hojong.han@samsung.com>
+
+        Linux has madvise enough to support OSAllocator::commit/decommit
+        https://bugs.webkit.org/show_bug.cgi?id=80505
+
+        Reviewed by Geoffrey Garen.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+
+2012-03-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
+        * JavaScriptCore.vcproj/WTF/copy-files.cmd:
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+
+2012-03-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+
+2012-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Move wx port to using export macros
+        https://bugs.webkit.org/show_bug.cgi?id=77279
+
+        Reviewed by Hajime Morita.
+
+        * wscript:
+        * wtf/Platform.h:
+
+2012-03-14  Benjamin Poulain  <bpoulain@apple.com>
+
+        Avoid StringImpl::getData16SlowCase() when sorting array
+        https://bugs.webkit.org/show_bug.cgi?id=81070
+
+        Reviewed by Geoffrey Garen.
+
+        The function codePointCompare() is used intensively when sorting strings.
+        This patch improves its performance by:
+        -Avoiding character conversion.
+        -Inlining the function.
+
+        This makes Peacekeeper's arrayCombined test 30% faster.
+
+        * wtf/text/StringImpl.cpp:
+        * wtf/text/StringImpl.h:
+        (WTF):
+        (WTF::codePointCompare):
+        (WTF::codePointCompare8):
+        (WTF::codePointCompare16):
+        (WTF::codePointCompare8To16):
+
+2012-03-14  Hojong Han  <hojong.han@samsung.com>
+
+        Fix memory allocation failed by fastmalloc
+        https://bugs.webkit.org/show_bug.cgi?id=79614
+
+        Reviewed by Geoffrey Garen.
+
+        Memory allocation failed even if the heap grows successfully.
+        It is wrong to get the span only from the large list after the heap grows,
+        because new span could be added in the normal list.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::New):
+
+2012-03-14  Hojong Han  <hojong.han@samsung.com>
+
+        Run cacheFlush page by page to assure of flushing all the requested ranges
+        https://bugs.webkit.org/show_bug.cgi?id=77712
+
+        Reviewed by Geoffrey Garen.
+
+        Current MetaAllocator concept, always coalesces adjacent free spaces,
+        doesn't meet memory management of Linux kernel.
+        In a certain case Linux kernel doesn't regard contiguous virtual memory areas as one but two.
+        Therefore cacheFlush page by page guarantees a flush-requested range.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2012-03-14  Oliver Hunt  <oliver@apple.com>
+
+        Make ARMv7 work again
+        https://bugs.webkit.org/show_bug.cgi?id=81157
+
+        Reviewed by Geoffrey Garen.
+
+        We were trying to use the ARMv7 dataRegister as a scratch register in a scenario
+        where we the ARMv7MacroAssembler would also try to use dataRegister for its own
+        nefarious purposes.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::store32):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+
+2012-03-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Heap::destroy leaks CopiedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=81055
+
+        Reviewed by Geoffrey Garen.
+
+        Added a destroy() function to CopiedSpace that moves all normal size 
+        CopiedBlocks from the CopiedSpace to the Heap's list of free blocks 
+        as well as deallocates all of the oversize blocks in the CopiedSpace. 
+        This function is now called in Heap::destroy().
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::destroy):
+        (JSC):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/Heap.cpp:
+        (JSC::Heap::destroy):
+
+2012-03-14  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Implement REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR using AnimationFrameRateController
+        https://bugs.webkit.org/show_bug.cgi?id=81000
+
+        Enable WTF_USE_REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR for BlackBerry.
+
+        Reviewed by Antonio Gomes.
+
+        * wtf/Platform.h:
+
+2012-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        ValueToInt32 speculation will cause OSR exits even when it does not have to
+        https://bugs.webkit.org/show_bug.cgi?id=81068
+        <rdar://problem/11043926>
+
+        Reviewed by Anders Carlsson.
+        
+        Two related changes:
+        1) ValueToInt32 will now always just defer to the non-speculative path, instead
+           of exiting, if it doesn't know what speculations to perform.
+        2) ValueToInt32 will speculate boolean if it sees this to be profitable.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateBoolean):
+        (Node):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+
+2012-03-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        More Windows build fixing
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Type conversion of exponential part failed
+        https://bugs.webkit.org/show_bug.cgi?id=80673
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Lexer.cpp:
+        (JSC::::lex):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        (JSC):
+        (JSC::jsStrDecimalLiteral): Added another template argument that exposes whether or not
+        we accept trailing junk to clients of jsStrDecimalLiteral. Also added additional template 
+        parameter for strtod to allow trailing spaces.
+        (JSC::toDouble):
+        (JSC::parseFloat): Accept trailing junk, as per the ECMA 262 spec (15.1.2.3).
+        * runtime/LiteralParser.cpp:
+        (JSC::::Lexer::lexNumber):
+        * tests/mozilla/expected.html: Update the expected page for run-javascriptcore-tests so that 
+        we will run ecma/TypeConversion/9.3.1-3.js as a regression test now.
+        * wtf/dtoa.cpp:
+        (WTF):
+        (WTF::strtod): We also needed to sometimes accept trailing spaces to pass a few other tests that were 
+        broken by changing the default allowance of trailing junk in jsStrDecimalLiteral.
+        * wtf/dtoa.h:
+        * wtf/dtoa/double-conversion.cc: When the AdvanceToNonspace function was lifted out of the 
+        Chromium codebase, the person porting it only thought to check for spaces when skipping whitespace.
+        A few of our JSC tests check for other types of trailing whitespace, so I've added checks for those 
+        here to cover those cases (horizontal tab, vertical tab, carriage return, form feed, and line feed).
+        * wtf/text/WTFString.cpp:
+        (WTF::toDoubleType): Disallow trailing spaces, as this breaks form input verification stuff.
+
+2012-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix since is_pod<> includes some header that I didn't know about.
+        Removing the assert for now.
+
+        * dfg/DFGOperations.h:
+        * llint/LLIntSlowPaths.h:
+
+2012-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Functions with C linkage should return POD types
+        https://bugs.webkit.org/show_bug.cgi?id=81061
+
+        Reviewed by Mark Rowe.
+
+        * dfg/DFGOperations.h:
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        (SlowPathReturnType):
+        (JSC::LLInt::encodeResult):
+
+2012-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Loads from UInt32Arrays should not result in a double up-convert if it isn't necessary
+        https://bugs.webkit.org/show_bug.cgi?id=80979
+        <rdar://problem/11036848>
+
+        Reviewed by Oliver Hunt.
+        
+        Also improved DFG IR dumping to include type information in a somewhat more
+        intuitive way.
+
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToAbbreviatedString):
+        (JSC):
+        * bytecode/PredictedType.h:
+        (JSC):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+
+2012-03-13  George Staikos  <staikos@webkit.org>
+
+        The callback is only used if SA_RESTART is defined.  Compile it out
+        otherwise to avoid a warning.
+        https://bugs.webkit.org/show_bug.cgi?id=80926
+
+        Reviewed by Alexey Proskuryakov.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC):
+
+2012-03-13  Hojong Han  <hojong.han@samsung.com>
+
+        Dump the generated code for ARM_TRADITIONAL
+        https://bugs.webkit.org/show_bug.cgi?id=80975
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::dumpCode):
+
+2012-03-13  Adam Barth  <abarth@webkit.org> && Benjamin Poulain  <bpoulain@apple.com>
+
+        Always enable ENABLE(CLIENT_BASED_GEOLOCATION)
+        https://bugs.webkit.org/show_bug.cgi?id=78853
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2012-03-13  Kwonjin Jeong  <gram@company100.net>
+
+        Remove SlotVisitor::copy() method.
+        https://bugs.webkit.org/show_bug.cgi?id=80973
+
+        Reviewed by Geoffrey Garen.
+
+        SlotVisitor::copy() method isn't called anywhere.
+
+        * heap/MarkStack.cpp: Remove definition of SlotVisitor::copy() method.
+        * heap/SlotVisitor.h: Remove declaration of SlotVisitor::copy() method.
+
+2012-03-12  Hojong Han  <hojong.han@samsung.com>
+
+        Fix test cases for RegExp multiline
+        https://bugs.webkit.org/show_bug.cgi?id=80822
+
+        Reviewed by Gavin Barraclough.
+
+        * tests/mozilla/js1_2/regexp/RegExp_multiline.js:
+        * tests/mozilla/js1_2/regexp/RegExp_multiline_as_array.js:
+        * tests/mozilla/js1_2/regexp/beginLine.js:
+        * tests/mozilla/js1_2/regexp/endLine.js:
+
+2012-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Arithmetic use inference should be procedure-global and should run in tandem
+        with type propagation
+        https://bugs.webkit.org/show_bug.cgi?id=80819
+        <rdar://problem/11034006>
+
+        Reviewed by Gavin Barraclough.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp: Removed.
+        * dfg/DFGArithNodeFlagsInferencePhase.h: Removed.
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::isNotZero):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::mergeDefaultArithFlags):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::flags):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeFlags):
+
+2012-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Node::op and Node::flags should be private
+        https://bugs.webkit.org/show_bug.cgi?id=80824
+        <rdar://problem/11033435>
+
+        Reviewed by Gavin Barraclough.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        (JSC::DFG::ArithNodeFlagsInferencePhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandPrediction):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::flushArgument):
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::isJSConstant):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::canonicalize):
+        (JSC::DFG::CSEPhase::endIndexForPureCSE):
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::byValIsPure):
+        (JSC::DFG::CSEPhase::clobbersWorld):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateInteger):
+        (JSC::DFG::Graph::negateShouldSpeculateInteger):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGNode.cpp: Removed.
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::Node::Node):
+        (Node):
+        (JSC::DFG::Node::op):
+        (JSC::DFG::Node::flags):
+        (JSC::DFG::Node::setOp):
+        (JSC::DFG::Node::setFlags):
+        (JSC::DFG::Node::mergeFlags):
+        (JSC::DFG::Node::filterFlags):
+        (JSC::DFG::Node::clearFlags):
+        (JSC::DFG::Node::setOpAndDefaultFlags):
+        (JSC::DFG::Node::mustGenerate):
+        (JSC::DFG::Node::isConstant):
+        (JSC::DFG::Node::isWeakConstant):
+        (JSC::DFG::Node::valueOfJSConstant):
+        (JSC::DFG::Node::hasVariableAccessData):
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::resolveGlobalDataIndex):
+        (JSC::DFG::Node::hasArithNodeFlags):
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::setArithNodeFlag):
+        (JSC::DFG::Node::mergeArithNodeFlags):
+        (JSC::DFG::Node::hasConstantBuffer):
+        (JSC::DFG::Node::hasRegexpIndex):
+        (JSC::DFG::Node::hasVarNumber):
+        (JSC::DFG::Node::hasScopeChainDepth):
+        (JSC::DFG::Node::hasResult):
+        (JSC::DFG::Node::hasInt32Result):
+        (JSC::DFG::Node::hasNumberResult):
+        (JSC::DFG::Node::hasJSResult):
+        (JSC::DFG::Node::hasBooleanResult):
+        (JSC::DFG::Node::isJump):
+        (JSC::DFG::Node::isBranch):
+        (JSC::DFG::Node::isTerminal):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasFunctionCheckData):
+        (JSC::DFG::Node::hasStructureTransitionData):
+        (JSC::DFG::Node::hasStructureSet):
+        (JSC::DFG::Node::hasStorageAccessData):
+        (JSC::DFG::Node::hasFunctionDeclIndex):
+        (JSC::DFG::Node::hasFunctionExprIndex):
+        (JSC::DFG::Node::child1):
+        (JSC::DFG::Node::child2):
+        (JSC::DFG::Node::child3):
+        (JSC::DFG::Node::firstChild):
+        (JSC::DFG::Node::numChildren):
+        * dfg/DFGNodeFlags.cpp: Copied from Source/JavaScriptCore/dfg/DFGNode.cpp.
+        * dfg/DFGNodeFlags.h: Added.
+        (DFG):
+        (JSC::DFG::nodeUsedAsNumber):
+        (JSC::DFG::nodeCanTruncateInteger):
+        (JSC::DFG::nodeCanIgnoreNegativeZero):
+        (JSC::DFG::nodeMayOverflow):
+        (JSC::DFG::nodeCanSpeculateInteger):
+        * dfg/DFGNodeType.h: Added.
+        (DFG):
+        (JSC::DFG::defaultFlags):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::vote):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        (JSC::DFG::PredictionPropagationPhase::fixupNode):
+        * dfg/DFGRedundantPhiEliminationPhase.cpp:
+        (JSC::DFG::RedundantPhiEliminationPhase::run):
+        (JSC::DFG::RedundantPhiEliminationPhase::replacePhiChild):
+        (JSC::DFG::RedundantPhiEliminationPhase::updateBlockVariableInformation):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-03-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Minor DataLog fixes
+        https://bugs.webkit.org/show_bug.cgi?id=80826
+
+        Reviewed by Andreas Kling.
+
+        * bytecode/ExecutionCounter.cpp:
+        Do not include DataLog.h, it is not used.
+        
+        * jit/ExecutableAllocator.cpp:
+        Ditto.
+
+        * wtf/DataLog.cpp:
+        (WTF::initializeLogFileOnce):
+        Add missing semi-colon to the code path where DATA_LOG_FILENAME is defined.
+
+        * wtf/HashTable.cpp:
+        Include DataLog as it is used.
+
+2012-03-12  SangGyu Lee  <sg5.lee@samsung.com>
+
+        Integer overflow check code in arithmetic operation in classic interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=80465
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-03-12  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt][Mac] Build fails after enabling LLINT when JIT is disabled (r109863)
+        https://bugs.webkit.org/show_bug.cgi?id=80827
+
+        Qt on Mac uses OS(DARWIN) as well, but we do not want to enable LLINT.
+
+        Reviewed by Simon Hausmann.
+
+        * wtf/Platform.h:
+
+2012-03-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed prospective Qt/Mac build fix
+
+        * runtime/JSGlobalData.cpp: use #USE(CF) instead of PLATFORM(MAC) to determine
+        whether to include CoreFoundation headers, used for JIT configuration in JSGlobalData
+        constructor.
+
+2012-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        All DFG nodes should have a mutable set of flags
+        https://bugs.webkit.org/show_bug.cgi?id=80779
+        <rdar://problem/11026218>
+
+        Reviewed by Gavin Barraclough.
+        
+        Got rid of NodeId, and placed all of the flags that distinguished NodeId
+        from NodeType into a separate Node::flags field. Combined what was previously
+        ArithNodeFlags into Node::flags.
+        
+        In the process of debugging, I found that the debug support in the virtual
+        register allocator was lacking, so I improved it. I also realized that the
+        virtual register allocator was assuming that the nodes in a basic block were
+        contiguous, which is no longer the case. So I fixed that. The fix also made
+        it natural to have more extreme assertions, so I added them. I suspect this
+        will make it easier to catch virtual register allocation bugs in the future.
+        
+        This is mostly performance neutral; if anything it looks like a slight
+        speed-up.
+        
+        This patch does leave some work for future refactorings; for example, Node::op
+        is unencapsulated. This was already the case, though now it feels even more
+        like it should be. I avoided doing that because this patch has already grown
+        way bigger than I wanted.
+        
+        Finally, this patch creates a DFGNode.cpp file and makes a slight effort to
+        move some unnecessarily inline stuff out of DFGNode.h.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        (JSC::DFG::ArithNodeFlagsInferencePhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::endIndexForPureCSE):
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::clobbersWorld):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        (CSEPhase):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::opName):
+        (JSC::DFG::Graph::dump):
+        (DFG):
+        * dfg/DFGNode.cpp: Added.
+        (DFG):
+        (JSC::DFG::arithNodeFlagsAsString):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::nodeUsedAsNumber):
+        (JSC::DFG::nodeCanTruncateInteger):
+        (JSC::DFG::nodeCanIgnoreNegativeZero):
+        (JSC::DFG::nodeMayOverflow):
+        (JSC::DFG::nodeCanSpeculateInteger):
+        (JSC::DFG::defaultFlags):
+        (JSC::DFG::Node::Node):
+        (Node):
+        (JSC::DFG::Node::setOpAndDefaultFlags):
+        (JSC::DFG::Node::mustGenerate):
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::setArithNodeFlag):
+        (JSC::DFG::Node::mergeArithNodeFlags):
+        (JSC::DFG::Node::hasResult):
+        (JSC::DFG::Node::hasInt32Result):
+        (JSC::DFG::Node::hasNumberResult):
+        (JSC::DFG::Node::hasJSResult):
+        (JSC::DFG::Node::hasBooleanResult):
+        (JSC::DFG::Node::isJump):
+        (JSC::DFG::Node::isBranch):
+        (JSC::DFG::Node::isTerminal):
+        (JSC::DFG::Node::child1):
+        (JSC::DFG::Node::child2):
+        (JSC::DFG::Node::child3):
+        (JSC::DFG::Node::firstChild):
+        (JSC::DFG::Node::numChildren):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::vote):
+        (JSC::DFG::PredictionPropagationPhase::fixupNode):
+        * dfg/DFGScoreBoard.h:
+        (ScoreBoard):
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::assertClear):
+        (JSC::DFG::ScoreBoard::use):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-03-10  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt should support JSVALUE64
+        https://bugs.webkit.org/show_bug.cgi?id=79609
+        <rdar://problem/10063437>
+
+        Reviewed by Gavin Barraclough and Oliver Hunt.
+        
+        Ported the LLInt, which previously only worked on 32-bit, to 64-bit. This
+        patch moves a fair bit of code from LowLevelInterpreter32_64.asm to the common
+        file, LowLevelInterpreter.asm. About 1/3 of the LLInt did not have to be
+        specialized for value representation.
+        
+        Also made some minor changes to offlineasm and the slow-paths.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntEntrypoints.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::llint_trace_value):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        (SlowPathReturnType):
+        (JSC::LLInt::SlowPathReturnType::SlowPathReturnType):
+        (JSC::LLInt::encodeResult):
+        * llint/LLIntThunks.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/armv7.rb:
+        * offlineasm/asm.rb:
+        * offlineasm/ast.rb:
+        * offlineasm/backends.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/parser.rb:
+        * offlineasm/registers.rb:
+        * offlineasm/transform.rb:
+        * offlineasm/x86.rb:
+        * wtf/Platform.h:
+
+2012-03-10  Yong Li  <yoli@rim.com>
+
+        Web Worker crashes with WX_EXCLUSIVE
+        https://bugs.webkit.org/show_bug.cgi?id=80532
+
+        Let each JS global object own a meta allocator
+        for WX_EXCLUSIVE to avoid conflicts from Web Worker.
+        Also fix a mutex leak in MetaAllocator's dtor.
+
+        Reviewed by Filip Pizlo.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::~DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators):
+        (DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::bytesCommittedByAllocactors):
+        (JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators):
+        (JSC::DemandExecutableAllocator::allocateNewSpace):
+        (JSC::DemandExecutableAllocator::allocators):
+        (JSC::DemandExecutableAllocator::allocatorsMutex):
+        (JSC):
+        (JSC::ExecutableAllocator::initializeAllocator):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutableAllocator::memoryPressureMultiplier):
+        (JSC::ExecutableAllocator::allocate):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::dumpProfile):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        (ExecutableAllocator):
+        (JSC::ExecutableAllocator::allocator):
+        * wtf/MetaAllocator.h:
+        (WTF::MetaAllocator::~MetaAllocator): Finalize the spin lock.
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Finalize): Add empty Finalize() to some implementations.
+
+2012-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Object.freeze broken on latest Nightly
+        https://bugs.webkit.org/show_bug.cgi?id=80577
+
+        Reviewed by Oliver Hunt.
+
+        The problem here is that deleteProperty rejects deletion of prototype.
+        This is correct in most cases, however defineOwnPropery is presently
+        implemented internally to ensure the attributes change by deleting the
+        old property, and creating a new one.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::deleteProperty):
+            - If deletePropery is called via defineOwnPropery, allow old prototype to be removed.
+
+2012-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype.toLocaleString visits elements in wrong order under certain conditions
+        https://bugs.webkit.org/show_bug.cgi?id=80663
+
+        Reviewed by Michael Saboff.
+
+        The bug here is actually that we're continuing to process the array after an exception
+        has been thrown, and that the second value throw is overriding the first.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+
+2012-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        WebKit compiled by gcc (Xcode 3.2.6) hangs while running DOM/Accessors.html
+        https://bugs.webkit.org/show_bug.cgi?id=80080
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingRegion::Locker::Locker):
+        (JSC::SamplingRegion::Locker::~Locker):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingRegion::exchangeCurrent):
+        * wtf/Atomics.h:
+        (WTF):
+        (WTF::weakCompareAndSwap):
+        (WTF::weakCompareAndSwapUIntPtr):
+
+2012-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        REGRESSION: Date.parse("Tue Nov 23 20:40:05 2010 GMT") returns NaN
+        https://bugs.webkit.org/show_bug.cgi?id=49989
+
+        Reviewed by Oliver Hunt.
+
+        Patch originally by chris reiss <christopher.reiss@nokia.com>,
+        allow the year to appear before the timezone in date strings.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+
+2012-03-09  Mark Rowe  <mrowe@apple.com>
+
+        Ensure that the WTF headers are copied at installhdrs time.
+
+        Reviewed by Dan Bernstein and Jessie Berlin.
+
+        * Configurations/JavaScriptCore.xcconfig: Set INSTALLHDRS_SCRIPT_PHASE = YES
+        so that our script phases are invoked at installhdrs time. The only one that
+        does any useful work at that time is the one that installs WTF headers.
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Add support for ENABLE(LEGACY_NOTIFICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=80497
+
+        Reviewed by Adam Barth.
+
+        Prep for b80472: Update API for Web Notifications
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-09  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Bash scripts should support LF endings only
+        https://bugs.webkit.org/show_bug.cgi?id=79509
+
+        Reviewed by David Kilzer.
+
+        * gyp/generate-derived-sources.sh: Added property svn:eol-style.
+        * gyp/run-if-exists.sh: Added property svn:eol-style.
+        * gyp/update-info-plist.sh: Added property svn:eol-style.
+
+2012-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Windows debug build fix.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlind):
+        Fix unreachable code warnings (which we treat as errors).
+
+2012-03-09  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Zoltan Herczeg.
+
+        [Qt] Fix the SH4 build after r109834
+        https://bugs.webkit.org/show_bug.cgi?id=80492
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        (JSC::MacroAssemblerSH4::branchSub32):
+
+2012-03-09  Andy Wingo  <wingo@igalia.com>
+
+        Refactor code feature analysis in the parser
+        https://bugs.webkit.org/show_bug.cgi?id=79112
+
+        Reviewed by Geoffrey Garen.
+
+        This commit refactors the parser to more uniformly propagate flag
+        bits down and up the parse process, as the parser descends and
+        returns into nested blocks.  Some flags get passed town to
+        subscopes, some apply to specific scopes only, and some get
+        unioned up after parsing subscopes.
+
+        The goal is to eventually be very precise with scoping
+        information, once we have block scopes: one block scope might use
+        `eval', which would require the emission of a symbol table within
+        that block and containing blocks, whereas another block in the
+        same function might not, allowing us to not emit a symbol table.
+
+        * parser/Nodes.h:
+        (JSC::ScopeFlags): Rename from CodeFeatures.
+        (JSC::ScopeNode::addScopeFlags):
+        (JSC::ScopeNode::scopeFlags): New accessors for m_scopeFlags.
+        (JSC::ScopeNode::isStrictMode):
+        (JSC::ScopeNode::usesEval):
+        (JSC::ScopeNode::usesArguments):
+        (JSC::ScopeNode::setUsesArguments):
+        (JSC::ScopeNode::usesThis):
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+        (JSC::ScopeNode::needsActivation): Refactor these accessors to
+        operate on the m_scopeFlags member.
+        (JSC::ScopeNode::source):
+        (JSC::ScopeNode::sourceURL):
+        (JSC::ScopeNode::sourceID): Shuffle these definitions around; no
+        semantic change.
+        (JSC::ScopeNode::ScopeNode)
+        (JSC::ProgramNode::ProgramNode)
+        (JSC::EvalNode::EvalNode)
+        (JSC::FunctionBodyNode::FunctionBodyNode): Have these constructors
+        take a ScopeFlags as an argument, instead of a bool inStrictContext.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create): Adapt constructors to change.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::addVar):
+        (JSC::ASTBuilder::Scope::Scope):
+        (Scope):
+        (ASTBuilder):
+        (JSC::ASTBuilder::makeFunctionCallNode): Don't track scope
+        features here.  Instead rely on the base Parser mechanism to track
+        features.
+
+        * parser/NodeInfo.h (NodeInfo, NodeDeclarationInfo): "ScopeFlags".
+
+        * parser/Parser.h:
+        (JSC::Scope::Scope): Manage scope through flags, not
+        bit-booleans.  This lets us uniformly propagate them up and down.
+        (JSC::Scope::declareWrite):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::useVariable):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::getCapturedVariables):
+        (JSC::Scope::saveFunctionInfo):
+        (JSC::Scope::restoreFunctionInfo):
+        (JSC::Parser::pushScope): Adapt to use scope flags and their
+        accessors instead of bit-booleans.
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseInner):
+        (JSC::::didFinishParsing):
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseWithStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parsePrimaryExpression): Hoist some of the flag handling
+        out of the "context" (ASTBuilder or SyntaxChecker) and to here.
+        Does not seem to have a performance impact.
+
+        * parser/SourceProviderCacheItem.h (SourceProviderCacheItem):
+        Cache the scopeflags.
+        * parser/SyntaxChecker.h: Remove evalCount() decl.
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::isStrictMode):
+        (JSC::ScriptExecutable::recordParse):
+        (ScriptExecutable): ScopeFlags, not features.
+
+2012-03-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Build fix for MSVC after r110266
+
+        Unreviewed. A #ifdef for MSVC was left over in r110266.
+
+        * runtime/RegExpObject.h:
+        (RegExpObject):
+
+2012-03-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Allocate the RegExpObject's data with the Cell
+        https://bugs.webkit.org/show_bug.cgi?id=80654
+
+        Reviewed by Gavin Barraclough.
+
+        This patch removes the creation of RegExpObject's data to avoid the overhead
+        create by the allocation and destruction.
+
+        We RegExp are created repeatedly, this provides some performance improvment.
+        The PeaceKeeper test stringDetectBrowser improves by 10%.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        (JSC::RegExpObject::visitChildren):
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        (JSC::RegExpObject::defineOwnProperty):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setRegExp):
+        (JSC::RegExpObject::regExp):
+        (JSC::RegExpObject::setLastIndex):
+        (JSC::RegExpObject::getLastIndex):
+        (RegExpObject):
+
+2012-03-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate WTF parts of JavaScriptCoreGenerated into WTFGenerated for Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=80657
+        
+        Preparation for WTF separation from JavaScriptCore.
+        The "Generated" vcproj files on Windows are necessary so Visual Studio can calculate correct
+        dependencies for generated files.
+        
+        This also removes the PGO build targets from the WTF code, since we can't build instrumentation/optimization
+        versions of the WTF code independent of the JavaScriptCore code.
+
+        Reviewed by Jessie Berlin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add WTFGenerated, update dependent projects.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Removed WTF specific parts.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Removed WTF specific parts.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Removed WTF specific parts.
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Removed WTF specific parts.
+        * JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Add WTFGenerated, update dependent projects.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Remove PGO targets from WTF.
+        * JavaScriptCore.vcproj/WTF/WTFGenerated.make: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make.
+        * JavaScriptCore.vcproj/WTF/WTFGenerated.vcproj: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedCommon.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebug.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugAll.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedDebugCairoCFLite.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedRelease.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFGeneratedReleaseCairoCFLite.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops: Removed.
+        * JavaScriptCore.vcproj/WTF/build-generated-files.sh: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh.
+        * JavaScriptCore.vcproj/WTF/copy-files.cmd: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd.
+        * JavaScriptCore.vcproj/WTF/work-around-vs-dependency-tracking-bugs.py: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py.
+
+2012-03-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix the build of WebKit with WTFURL following the removal of ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80652
+
+        Reviewed by Eric Seidel.
+
+        Fix the header, URLSegments.h is not part of the API.
+
+        * wtf/url/api/ParsedURL.h:
+
+2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix for micro data API.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Gavin Barraclough  <barraclough@apple.com>
+
+        String.prototype.match and replace do not clear global regexp lastIndex per ES5.1 15.5.4.10
+        https://bugs.webkit.org/show_bug.cgi?id=26890
+
+        Reviewed by Oliver Hunt.
+
+        Per 15.10.6.2 step 9.a.1 called via the action of the last iteration of 15.5.4.10 8.f.i.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::stringProtoFuncMatch):
+            - added calls to setLastIndex.
+
+2012-03-08  Matt Lilek  <mrl@apple.com>
+
+        Don't enable VIDEO_TRACK on all OS X platforms
+        https://bugs.webkit.org/show_bug.cgi?id=80635
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.  That day is not today.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlind):
+        * assembler/MacroAssemblerX86Common.h:
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
+
+2012-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Build fix. One of these days I'll manage to commit something that works everywhere.
+
+        * assembler/AbstractMacroAssembler.h:
+        (AbstractMacroAssembler):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
+        (MacroAssemblerX86Common):
+
+2012-03-08  Chao-ying Fu  <fu@mips.com>
+
+        Update MIPS patchOffsetGetByIdSlowCaseCall
+        https://bugs.webkit.org/show_bug.cgi?id=80302
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JIT.h:
+        (JIT):
+
+2012-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Missing some places where we should be blinding 64bit values (and blinding something we shouldn't)
+        https://bugs.webkit.org/show_bug.cgi?id=80633
+
+        Reviewed by Gavin Barraclough.
+
+        Add 64-bit trap for shouldBlindForSpecificArch, so that we always blind
+        if there isn't a machine specific implementation (otherwise the 64bit value
+        got truncated and 32bit checks were used -- leaving 32bits untested).
+        Also add a bit of logic to ensure that we don't try to blind a few common
+        constants that go through the ImmPtr paths -- encoded numeric JSValues and
+        unencoded doubles with common "safe" values.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlindDouble):
+        (MacroAssembler):
+        (JSC::MacroAssembler::shouldBlind):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
+
+2012-03-08  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/11012572> Ensure that the staged frameworks path is in the search path for JavaScriptCore
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2012-03-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix line endings for copy-files.cmd.
+        
+        If a cmd file doesn't have Windows line endings, it doesn't work properly.
+        In this case, the label :clean wasn't found, breaking the clean build.
+        
+        Reviewed by Jessie Berlin.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+
+2012-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA incorrectly handles ValueToInt32
+        https://bugs.webkit.org/show_bug.cgi?id=80568
+
+        Reviewed by Gavin Barraclough.
+        
+        Changed it match exactly the decision pattern used in
+        DFG::SpeculativeJIT::compileValueToInt32
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-03-08  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        [Qt] [WK2] Webkit fails to link when compiled with force_static_libs_as_shared
+        https://bugs.webkit.org/show_bug.cgi?id=80524
+
+        Reviewed by Simon Hausmann.
+
+        Move IdentifierTable methods defintion to WTFThreadData.cpp to fix linking 
+        of WTF library.
+
+        * runtime/Identifier.cpp:
+        * wtf/WTFThreadData.cpp:
+        (JSC):
+        (JSC::IdentifierTable::~IdentifierTable):
+        (JSC::IdentifierTable::add):
+
+2012-03-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG instruction count threshold should be lifted to 10000
+        https://bugs.webkit.org/show_bug.cgi?id=80579
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions):
+
+2012-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Incorrect tracking of abstract values of variables forced double
+        https://bugs.webkit.org/show_bug.cgi?id=80566
+        <rdar://problem/11001442>
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+
+2012-03-07  Chao-yng Fu  <fu@mips.com>
+
+        [Qt] Fix the MIPS/SH4 build after r109834
+        https://bugs.webkit.org/show_bug.cgi?id=80492
+
+        Reviewed by Oliver Hunt.
+
+        Implement three-argument branch(Add,Sub)32.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+
+2012-03-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110127.
+        http://trac.webkit.org/changeset/110127
+        https://bugs.webkit.org/show_bug.cgi?id=80562
+
+        compile failed on AppleWin (Requested by ukai on #webkit).
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::finalize):
+        * runtime/Executable.h:
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::create):
+        * runtime/JSGlobalData.cpp:
+        (WTF):
+        (Recompiler):
+        (WTF::Recompiler::operator()):
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+        (JSC):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+
+2012-03-07  Hojong Han  <hojong.han@samsung.com>
+
+        The end atom of the marked block considered to filter invalid cells
+        https://bugs.webkit.org/show_bug.cgi?id=79191
+
+        Reviewed by Geoffrey Garen.
+
+        Register file could have stale pointers beyond the end atom of marked block.
+        Those pointers can weasel out of filtering in-middle-of-cell pointer.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isLiveCell):
+
+2012-03-07  Jessie Berlin  <jberlin@apple.com>
+
+        Clean Windows build fails after r110033
+        https://bugs.webkit.org/show_bug.cgi?id=80553
+
+        Rubber-stamped by Jon Honeycutt and Eric Seidel.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        Place the implementation files next to their header files in the wtf/text subdirectory.
+        Use echo -F to tell xcopy that these are files (since there is apparently no flag).
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        Update the path to those implementation files.
+        * JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj:
+        Ditto.
+
+2012-03-07  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Eliminate redundant Phis in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=80415
+
+        Reviewed by Filip Pizlo.
+
+        Although this may not have any advantage at current stage, this is towards
+        minimal SSA to make more high level optimizations (like bug 76770) easier.
+        We have the choices either to build minimal SSA from scratch or to
+        keep current simple Phi insertion mechanism and remove the redundancy
+        in another phase. Currently we choose the latter because the change
+        could be smaller.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGRedundantPhiEliminationPhase.cpp: Added.
+        (DFG):
+        (RedundantPhiEliminationPhase):
+        (JSC::DFG::RedundantPhiEliminationPhase::RedundantPhiEliminationPhase):
+        (JSC::DFG::RedundantPhiEliminationPhase::run):
+        (JSC::DFG::RedundantPhiEliminationPhase::getRedundantReplacement):
+        (JSC::DFG::RedundantPhiEliminationPhase::replacePhiChild):
+        (JSC::DFG::RedundantPhiEliminationPhase::fixupPhis):
+        (JSC::DFG::RedundantPhiEliminationPhase::updateBlockVariableInformation):
+        (JSC::DFG::performRedundantPhiElimination):
+        * dfg/DFGRedundantPhiEliminationPhase.h: Added.
+        (DFG):
+
+2012-03-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor recompileAllJSFunctions() to be less expensive
+        https://bugs.webkit.org/show_bug.cgi?id=80330
+
+        Reviewed by Geoffrey Garen.
+
+        This change is performance neutral on the JS benchmarks we track. It's mostly to improve page 
+        load performance, which currently does at least a couple full GCs per navigation.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::discardAllCompiledCode): Rename recompileAllJSFunctions to discardAllCompiledCode 
+        because the function doesn't actually recompile anything (and never did); it simply throws code
+        away for it to be recompiled later if we determine we should do so.
+        (JSC):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::addFunctionExecutable): Adds a newly created FunctionExecutable to the Heap's list.
+        (JSC::Heap::removeFunctionExecutable): Removes the specified FunctionExecutable from the Heap's list.
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * runtime/Executable.cpp: Added next and prev fields to FunctionExecutables so that they can 
+        be used in DoublyLinkedLists.
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::finalize): Removes the FunctionExecutable from the Heap's list.
+        * runtime/Executable.h:
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::create): Adds the FunctionExecutable to the Heap's list.
+        * runtime/JSGlobalData.cpp: Remove recompileAllJSFunctions, as it's the Heap's job to own and manage 
+        the list of FunctionExecutables.
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Use the new discardAllCompiledCode.
+
+2012-03-06  Oliver Hunt  <oliver@apple.com>
+
+        Further harden 64-bit JIT
+        https://bugs.webkit.org/show_bug.cgi?id=80457
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements blinding for ImmPtr.  Rather than xor based blinding
+        we perform randomised pointer rotations in order to avoid the significant
+        cost in executable memory that would otherwise be necessary (and to avoid
+        the need for an additional scratch register in some cases).
+
+        As with the prior blinding patch there's a moderate amount of noise as we
+        correct the use of ImmPtr vs. TrustedImmPtr.
+
+        * assembler/AbstractMacroAssembler.h:
+        (ImmPtr):
+        (JSC::AbstractMacroAssembler::ImmPtr::asTrustedImmPtr):
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::shouldBlind):
+        (JSC::MacroAssembler::RotatedImmPtr::RotatedImmPtr):
+        (RotatedImmPtr):
+        (JSC::MacroAssembler::rotationBlindConstant):
+        (JSC::MacroAssembler::loadRotationBlindedConstant):
+        (JSC::MacroAssembler::convertInt32ToDouble):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::poke):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::branchAdd32):
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::rotateRightPtr):
+        (JSC::MacroAssemblerX86_64::xorPtr):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::xorq_rm):
+        (JSC::X86Assembler::rorq_i8r):
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::createOSREntries):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentFillGPR):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::emitEdgeCode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_post_inc):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+        (JSC::JIT::emitGetVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emit_op_jmp_scopes):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_throw_reference_error):
+        (JSC::JIT::emit_op_debug):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emitSlow_op_new_array):
+        (JSC::JIT::emit_op_new_array_buffer):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emit_op_jmp_scopes):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_index):
+        * jit/JITStubCall.h:
+        (JITStubCall):
+        (JSC::JITStubCall::addArgument):
+
+2012-03-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        ARM build fix.
+
+        Reviewed by Zoltan Herczeg.
+
+        Implement three-argument branch(Add,Sub)32.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::branchSub32):
+
+2012-03-07  Andy Wingo  <wingo@igalia.com>
+
+        Parser: Inline ScopeNodeData into ScopeNode
+        https://bugs.webkit.org/show_bug.cgi?id=79776
+
+        Reviewed by Geoffrey Garen.
+
+        It used to be that some ScopeNode members were kept in a separate
+        structure because sometimes they wouldn't be needed, and
+        allocating a ParserArena was expensive.  This patch makes
+        ParserArena lazily allocate its IdentifierArena, allowing the
+        members to be included directly, which is simpler and easier to
+        reason about.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena):
+        (JSC::ParserArena::reset):
+        (JSC::ParserArena::isEmpty):
+        * parser/ParserArena.h:
+        (JSC::ParserArena::identifierArena): Lazily allocate the
+        IdentifierArena.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ScopeNode::singleStatement):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::destroyData):
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+        (JSC::ScopeNode::needsActivation):
+        (JSC::ScopeNode::hasCapturedVariables):
+        (JSC::ScopeNode::capturedVariableCount):
+        (JSC::ScopeNode::captures):
+        (JSC::ScopeNode::varStack):
+        (JSC::ScopeNode::functionStack):
+        (JSC::ScopeNode::neededConstants):
+        (ScopeNode):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ScopeNode::emitStatementsBytecode): Inline ScopeNodeData
+        into ScopeNode.  Adapt accessors.
+
+2012-03-06  Eric Seidel  <eric@webkit.org>
+
+        Make WTF public headers use fully-qualified include paths and remove ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80363
+
+        Reviewed by Mark Rowe.
+
+        Historically WTF has been part of JavaScriptCore, and on Mac and Windows
+        its headers have appeared as part of the "private" headers exported by
+        JavaScriptCore.  All of the WTF headers there are "flattened" into a single
+        private headers directory, and WebCore, WebKit and WebKit2 have used "ForwardingHeaders"
+        to re-map fully-qualified <wtf/text/Foo.h> includes to simple <JavaScriptCore/Foo.h> includes.
+
+        However, very soon, we are moving the WTF source code out of JavaScriptCore into its
+        own directory and project.  As part of such, the WTF headers will no longer be part of
+        the JavaScriptCore private interfaces.
+        In preparation for that, this change makes both the Mac and Win builds export
+        WTF headers in a non-flattened manner.  On Mac, that means into usr/local/include/wtf
+        (and subdirectories), on Windows for now that means JavaScriptCore/wtf (and subdirectories).
+
+        There are 5 parts to this change.
+        1.  Updates the JavaScriptCore XCode and VCProj files to actually install these headers
+            (and header directories) into the appropriate places in the build directory.
+        2.  Updates JavaScriptCore.xcodeproj to look for these WTF headers in this install location
+            (WebCore, WebKit, etc. had already been taught to look in previous patches).
+        3.  Fixes all JavaScriptCore source files, and WTF headers to include WTF headers
+            using fully qualified paths.
+        4.  Stops the Mac and Win builds from installing these WTF headers in their old "flattened" location.
+        5.  Removes WebCore and WebKit ForwardingHeaders/wtf directories now that the flattened headers no longer exist.
+
+        Unfortunately we see no way to do this change in smaller parts, since all of these steps are interdependant.
+        It is possible there are internal Apple projects which depend on JavaScriptCore/Foo.h working for WTF
+        headers, those will have to be updated to use <wtf/Foo.h> after this change.
+        I've discussed this proposed change at length with Mark Rowe, and my understanding is they
+        are ready for (and interested in) this change happening.
+
+        * API/tests/JSNode.c:
+        * API/tests/JSNodeList.c:
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGOperations.cpp:
+        * heap/GCAssertions.h:
+        * heap/HandleHeap.h:
+        * heap/HandleStack.h:
+        * heap/MarkedSpace.h:
+        * heap/PassWeak.h:
+        * heap/Strong.h:
+        * heap/Weak.h:
+        * jit/HostCallReturnValue.cpp:
+        * jit/JIT.cpp:
+        * jit/JITStubs.cpp:
+        * jit/ThunkGenerators.cpp:
+        * parser/Lexer.cpp:
+        * runtime/Completion.cpp:
+        * runtime/Executable.cpp:
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        * runtime/JSVariableObject.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/WriteBarrier.h:
+        * tools/CodeProfile.cpp:
+        * tools/TieredMMapArray.h:
+        * wtf/AVLTree.h:
+        * wtf/Alignment.h:
+        * wtf/AlwaysInline.h:
+        * wtf/ArrayBufferView.h:
+        * wtf/Assertions.h:
+        * wtf/Atomics.h:
+        * wtf/Bitmap.h:
+        * wtf/BoundsCheckedPointer.h:
+        * wtf/CheckedArithmetic.h:
+        * wtf/Deque.h:
+        * wtf/ExportMacros.h:
+        * wtf/FastAllocBase.h:
+        * wtf/FastMalloc.h:
+        * wtf/Float32Array.h:
+        * wtf/Float64Array.h:
+        * wtf/Functional.h:
+        * wtf/HashCountedSet.h:
+        * wtf/HashFunctions.h:
+        * wtf/HashMap.h:
+        * wtf/HashSet.h:
+        * wtf/HashTable.h:
+        * wtf/HashTraits.h:
+        * wtf/Int16Array.h:
+        * wtf/Int32Array.h:
+        * wtf/Int8Array.h:
+        * wtf/IntegralTypedArrayBase.h:
+        * wtf/ListHashSet.h:
+        * wtf/MainThread.h:
+        * wtf/MetaAllocator.h:
+        * wtf/Noncopyable.h:
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/PackedIntVector.h:
+        * wtf/ParallelJobs.h:
+        * wtf/PassOwnArrayPtr.h:
+        * wtf/PassOwnPtr.h:
+        * wtf/PassRefPtr.h:
+        * wtf/PassTraits.h:
+        * wtf/Platform.h:
+        * wtf/PossiblyNull.h:
+        * wtf/RefCounted.h:
+        * wtf/RefCountedLeakCounter.h:
+        * wtf/RefPtr.h:
+        * wtf/RetainPtr.h:
+        * wtf/SimpleStats.h:
+        * wtf/Spectrum.h:
+        * wtf/StdLibExtras.h:
+        * wtf/TCPageMap.h:
+        * wtf/TemporaryChange.h:
+        * wtf/ThreadSafeRefCounted.h:
+        * wtf/Threading.h:
+        * wtf/ThreadingPrimitives.h:
+        * wtf/TypeTraits.h:
+        * wtf/TypedArrayBase.h:
+        * wtf/Uint16Array.h:
+        * wtf/Uint32Array.h:
+        * wtf/Uint8Array.h:
+        * wtf/Uint8ClampedArray.h:
+        * wtf/UnusedParam.h:
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        * wtf/dtoa/double-conversion.h:
+        * wtf/dtoa/utils.h:
+        * wtf/gobject/GRefPtr.h:
+        * wtf/gobject/GlibUtilities.h:
+        * wtf/text/AtomicString.h:
+        * wtf/text/AtomicStringImpl.h:
+        * wtf/text/CString.h:
+        * wtf/text/StringConcatenate.h:
+        * wtf/text/StringHash.h:
+        * wtf/text/WTFString.h:
+        * wtf/unicode/CharacterNames.h:
+        * wtf/unicode/UTF8.h:
+        * wtf/unicode/glib/UnicodeGLib.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWinCE.h:
+        * wtf/url/api/ParsedURL.h:
+        * wtf/url/api/URLString.h:
+        * wtf/wince/FastMallocWinCE.h:
+        * yarr/YarrJIT.cpp:
+
+2012-03-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype functions should throw if delete fails
+        https://bugs.webkit.org/show_bug.cgi?id=80467
+
+        Reviewed by Oliver Hunt.
+
+        All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw.
+        In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations
+        in JSArray.cpp. There are effectively three copies of each of the generic shift/unshift routines,
+        one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift
+        routines, for handling arrays with holes. These three copies should be unified.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+            - Added - shared copies of the shift/unshift functionality.
+        (JSC::arrayProtoFuncPop):
+            - should throw if the delete fails.
+        (JSC::arrayProtoFuncReverse):
+            - should throw if the delete fails.
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+            - use shift/unshift.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+            - Don't try to handle arrays with holes; return a value indicating
+              the generic routine should be used instead.
+        * runtime/JSArray.h:
+            - declaration for shiftCount/unshiftCount changed.
+        * tests/mozilla/js1_6/Array/regress-304828.js:
+            - this was asserting incorrect behaviour.
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Make the removal of transitive library dependencies work with CMake < 2.8.7.
+        https://bugs.webkit.org/show_bug.cgi?id=80469
+
+        Reviewed by Antonio Gomes.
+
+        * CMakeLists.txt: Manually set the LINK_INTERFACE_LIBRARIES target
+        property on the library being created.
+
+2012-03-06  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG BasicBlock should group the Phi nodes together and separate them
+        from the other nodes
+        https://bugs.webkit.org/show_bug.cgi?id=80361
+
+        Reviewed by Filip Pizlo.
+
+        This would make it more efficient to remove the redundant Phi nodes or
+        insert new Phi nodes for SSA, besides providing a cleaner BasicBlock structure.
+        This is performance neutral on SunSpider, V8 and Kraken.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::clobberStructures):
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::insertPhiNode):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-03-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GCActivityCallback timer should vary with the length of the previous GC
+        https://bugs.webkit.org/show_bug.cgi?id=80344
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp: Gave Heap the ability to keep track of the length of its last 
+        GC length so that the GC Activity Callback can use it.
+        (JSC::Heap::Heap):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (JSC::Heap::lastGCLength):
+        (Heap):
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC):
+        (JSC::DefaultGCActivityCallback::operator()): Use the length of the Heap's last 
+        GC to determine the length of our timer trigger (currently set at 100x the duration 
+        of the last GC).
+
+2012-03-06  Rob Buis  <rbuis@rim.com>
+
+        BlackBerry] Fix cast-align gcc warnings when compiling JSC
+        https://bugs.webkit.org/show_bug.cgi?id=80420
+
+        Reviewed by Gavin Barraclough.
+
+        Fix warnings given in Blackberry build.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        * wtf/RefCountedArray.h:
+        (WTF::RefCountedArray::Header::fromPayload):
+
+2012-03-06  Gavin Barraclough  <barraclough@apple.com>
+
+        writable/configurable not respected for some properties of Function/String/Arguments
+        https://bugs.webkit.org/show_bug.cgi?id=80436
+
+        Reviewed by Oliver Hunt.
+
+        Special properties should behave like regular properties.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+            - Mis-nested logic for making read-only properties non-live.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+            - arguments/length/caller are non-writable, non-configurable - reject appropriately.
+        (JSC::JSFunction::deleteProperty):
+            - Attempting to delete prototype/caller should fail.
+        (JSC::JSFunction::defineOwnProperty):
+            - Ensure prototype is reified on attempt to reify it.
+            - arguments/length/caller are non-writable, non-configurable - reject appropriately.
+        * runtime/JSFunction.h:
+            - added declaration for defineOwnProperty.
+        (JSFunction):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+            - length is non-writable, non-configurable - reject appropriately.
+
+2012-03-06  Ulan Degenbaev  <ulan@chromium.org>
+
+        TypedArray subarray call for subarray does not clamp the end index parameter properly
+        https://bugs.webkit.org/show_bug.cgi?id=80285
+
+        Reviewed by Kenneth Russell.
+
+        * wtf/ArrayBufferView.h:
+        (WTF::ArrayBufferView::calculateOffsetAndLength):
+
+2012-03-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109837.
+        http://trac.webkit.org/changeset/109837
+        https://bugs.webkit.org/show_bug.cgi?id=80399
+
+        breaks Mac Productions builds, too late to try and fix it
+        tonight (Requested by eseidel on #webkit).
+
+        * API/tests/JSNode.c:
+        * API/tests/JSNodeList.c:
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGOperations.cpp:
+        * heap/GCAssertions.h:
+        * heap/HandleHeap.h:
+        * heap/HandleStack.h:
+        * heap/MarkedSpace.h:
+        * heap/PassWeak.h:
+        * heap/Strong.h:
+        * heap/Weak.h:
+        * jit/HostCallReturnValue.cpp:
+        * jit/JIT.cpp:
+        * jit/JITStubs.cpp:
+        * jit/ThunkGenerators.cpp:
+        * parser/Lexer.cpp:
+        * runtime/Completion.cpp:
+        * runtime/Executable.cpp:
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        * runtime/JSVariableObject.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/WriteBarrier.h:
+        * tools/CodeProfile.cpp:
+        * tools/TieredMMapArray.h:
+        * yarr/YarrJIT.cpp:
+
+2012-03-06  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt][ARM] Speculative buildfix after r109834.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::and32):
+        (MacroAssemblerARM):
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix pt 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix pt 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        putByIndex should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=80335
+
+        Reviewed by Filip Pizlo.
+
+        Make the MethodTable PutByIndex trap take a boolean 'shouldThrow' parameter.
+
+        This is a largely mechanical change, simply adding an extra parameter to a number
+        of functions. Some call sites need perform additional exception checks, and
+        operationPutByValBeyondArrayBounds needs to know whether it is strict or not.
+
+        This patch doesn't fix a missing throw from some cases of shift/unshift (this is
+        an existing bug), I'll follow up with a third patch to handle that.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPropertyAtIndex):
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putByIndex):
+        * runtime/Arguments.h:
+        (Arguments):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/ClassInfo.h:
+        (MethodTable):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putByIndex):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        * runtime/JSArray.h:
+        (SparseArrayValueMap):
+        (JSArray):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::putByIndex):
+        * runtime/JSByteArray.h:
+        (JSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putByIndex):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::putByIndex):
+        * runtime/JSNotAnObject.h:
+        (JSNotAnObject):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        * runtime/JSObject.h:
+        (JSC::JSValue::putByIndex):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::putByIndex):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
+
+2012-03-05  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        PredictNone is incorrectly treated as isDoublePrediction
+        https://bugs.webkit.org/show_bug.cgi?id=80365
+
+        Reviewed by Filip Pizlo.
+
+        Also it is incorrectly treated as isFixedIndexedStorageObjectPrediction.
+
+        * bytecode/PredictedType.h:
+        (JSC::isFixedIndexedStorageObjectPrediction):
+        (JSC::isDoublePrediction):
+
+2012-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        The LLInt should work even when the JIT is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=80340
+        <rdar://problem/10922235>
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
+        (MacroAssemblerCodeRef):
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiNativeCall):
+        (JSC::JITThunks::ctiNativeConstruct):
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * runtime/Executable.h:
+        (NativeExecutable):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::parse):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * wtf/Platform.h:
+
+2012-03-05  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Checks for dead variables are not sufficient when fixing the expected
+        values in DFG OSR entry
+        https://bugs.webkit.org/show_bug.cgi?id=80371
+
+        Reviewed by Filip Pizlo.
+
+        A dead variable should be identified when there's no node referencing it.
+        But we currently failed to catch the case where there are some nodes
+        referencing a variable but those nodes are actually not referenced by
+        others so will be ignored in code generation. In such case we should
+        also consider that variable to be a dead variable in the block and fix
+        the expected values.
+        This is performance neutral on SunSpider, V8 and Kraken.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+
+2012-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt build.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSub32Constant):
+
+2012-03-05  Eric Seidel  <eric@webkit.org>
+
+        Update JavaScriptCore files to use fully-qualified WTF include paths
+        https://bugs.webkit.org/show_bug.cgi?id=79960
+
+        Reviewed by Adam Barth.
+
+        This change does 5 small/related things:
+         1. Updates JavaScriptCore.xcodeproj to install WTF headers into $BUILD/usr/local/include
+            (WebCore, WebKit were already setup to look there, but JavaScriptCore.xcodeproj
+            was not installing headers there.)
+         2. Makes JavaScriptCore targets include $BUILD/usr/local/include in their
+            header search path, as that's where the WTF headers will be installed.
+         3. Similarly updates JavaScriptCore.vcproj/copy-files.cmd to copy WTF headers to PrivateHeaders/wtf/*
+            in addition to the current behavior of flattening all headers to PrivateHeaders/*.h.
+         4. Updates a bunch of JSC files to use #include <wtf/Foo.h> instead of #include "Foo.h"
+            since soon the WTF headers will not be part of the JavaScriptCore Xcode project.
+         5. Makes build-webkit build the WTF XCode project by default.
+
+        * API/tests/JSNode.c:
+        * API/tests/JSNodeList.c:
+        * Configurations/Base.xcconfig:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGOperations.cpp:
+        * heap/GCAssertions.h:
+        * heap/HandleHeap.h:
+        * heap/HandleStack.h:
+        * heap/MarkedSpace.h:
+        * heap/PassWeak.h:
+        * heap/Strong.h:
+        * heap/Weak.h:
+        * jit/HostCallReturnValue.cpp:
+        * jit/JIT.cpp:
+        * jit/JITStubs.cpp:
+        * jit/ThunkGenerators.cpp:
+        * parser/Lexer.cpp:
+        * runtime/Completion.cpp:
+        * runtime/Executable.cpp:
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSStringBuilder.h:
+        * runtime/JSVariableObject.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/WriteBarrier.h:
+        * tools/CodeProfile.cpp:
+        * tools/TieredMMapArray.h:
+        * yarr/YarrJIT.cpp:
+
+2012-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Add basic support for constant blinding to the JIT
+        https://bugs.webkit.org/show_bug.cgi?id=80354
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds basic constant blinding support to the JIT, at the
+        MacroAssembler level.  This means all JITs in JSC (Yarr, baseline, and DFG)
+        get constant blinding.  Woo!
+
+        This patch only introduces blinding for Imm32, a later patch will do similar
+        for ImmPtr.  In order to make misuse of Imm32 as a trusted type essentially
+        impossible, we make TrustedImm32 a private parent of Imm32 and add an explicit
+        accessor that's needed to access the actual value.  This also means you cannot
+        accidentally pass an untrusted value to a function that does not perform
+        blinding.
+
+        To make everything work sensibly, this patch also corrects some code that was using
+        Imm32 when TrustedImm32 could be used, and refactors a few callers that use
+        untrusted immediates, so that they call slightly different varaints of the functions
+        that they used previously.  This is largely necessary to deal with x86-32 not having
+        sufficient registers to handle the additional work required when we choose to blind
+        a constant.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::asTrustedImm32):
+        (Imm32):
+        (JSC::AbstractMacroAssembler::beginUninterruptedSequence):
+        (JSC::AbstractMacroAssembler::endUninterruptedSequence):
+        (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
+        (AbstractMacroAssembler):
+        (JSC::AbstractMacroAssembler::inUninterruptedSequence):
+        (JSC::AbstractMacroAssembler::random):
+        (JSC::AbstractMacroAssembler::scratchRegisterForBlinding):
+        (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addressForPoke):
+        (MacroAssembler):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::convertInt32ToDouble):
+        (JSC::MacroAssembler::shouldBlind):
+        (JSC::MacroAssembler::BlindedImm32::BlindedImm32):
+        (BlindedImm32):
+        (JSC::MacroAssembler::keyForConstant):
+        (JSC::MacroAssembler::xorBlindConstant):
+        (JSC::MacroAssembler::additionBlindedConstant):
+        (JSC::MacroAssembler::andBlindedConstant):
+        (JSC::MacroAssembler::orBlindedConstant):
+        (JSC::MacroAssembler::loadXorBlindedConstant):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        (JSC::MacroAssembler::branchSub32):
+        (JSC::MacroAssembler::trustedImm32ForShift):
+        (JSC::MacroAssembler::lshift32):
+        (JSC::MacroAssembler::rshift32):
+        (JSC::MacroAssembler::urshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::scratchRegisterForBlinding):
+        (JSC::MacroAssemblerARMv7::shouldBlindForSpecificArch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::scratchRegisterForBlinding):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_div):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::updateTopCallFrame):
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emitSlow_op_jtrue):
+        * jit/JITStubCall.h:
+        (JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrack):
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        putByIndex should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=80335
+
+        Reviewed by Filip Pizlo.
+
+        We'll need to pass an additional parameter.
+
+        Part 1 - rename JSValue::put() for integer indices to JSValue::putByIndex()
+        to match the method in the MethodTable, make this take a parameter indicating
+        whether the put should throw. This fixes the cases where the base of the put
+        is a primitive.
+
+        * dfg/DFGOperations.cpp:
+        (DFG):
+        (JSC::DFG::putByVal):
+        (JSC::DFG::operationPutByValInternal):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSObject.h:
+        (JSC::JSValue::putByIndex):
+        * runtime/JSValue.cpp:
+        (JSC):
+        * runtime/JSValue.h:
+        (JSValue):
+
+2012-03-05  Sam Weinig  <sam@webkit.org>
+
+        Add support for hosting layers in the window server in WebKit2
+        <rdar://problem/10400246>
+        https://bugs.webkit.org/show_bug.cgi?id=80310
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Platform.h:
+        Add HAVE_LAYER_HOSTING_IN_WINDOW_SERVER.
+
+2012-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, attempted build fix for !ENABLE(JIT) after r109705.
+
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::applyMemoryUsageHeuristics):
+        * bytecode/ExecutionCounter.h:
+
+2012-03-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r109705.
+
+        * bytecode/ExecutionCounter.cpp:
+        * bytecode/ExecutionCounter.h:
+
+2012-03-05  Andy Wingo  <wingo@igalia.com>
+
+        Lexer: Specialize character predicates for LChar, UChar
+        https://bugs.webkit.org/show_bug.cgi?id=79677
+
+        Reviewed by Oliver Hunt.
+
+        This patch specializes isIdentStart, isIdentPart, isWhiteSpace,
+        and isLineTerminator to perform a more limited number of checks if
+        the lexer is being instantiated to work on LChar sequences.  This
+        is about a 1.5% win on the --parse-only suite, here.
+
+        * parser/Lexer.cpp:
+        (JSC::isLatin1): New static helper, specialized for LChar and
+        UChar.
+        (JSC::typesOfLatin1Characters): Rename from
+        typesOfASCIICharacters, and expand to the range of the LChar
+        type.  All uses of isASCII are changed to use isLatin1.  Generated
+        using libunistring.
+        (JSC::isNonLatin1IdentStart):
+        (JSC::isIdentStart):
+        (JSC::isNonLatin1IdentPart):
+        (JSC::isIdentPart):
+        (JSC::Lexer::shiftLineTerminator):
+        (JSC::Lexer::parseIdentifier):
+        (JSC::Lexer::parseIdentifierSlowCase):
+        (JSC::Lexer::parseStringSlowCase):
+        (JSC::Lexer::parseMultilineComment):
+        (JSC::Lexer::lex):
+        (JSC::Lexer::scanRegExp):
+        (JSC::Lexer::skipRegExp): Sprinkle static_cast<T>(_) around.
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace):
+        (JSC::Lexer::isLineTerminator):
+        * KeywordLookupGenerator.py:
+        (Trie.printAsC): Declare specialized isIdentPart static functions.
+
+2012-03-05  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-03-05  Andy Wingo  <wingo@igalia.com>
+
+        WTF: Micro-optimize cleanup of empty vectors and hash tables
+        https://bugs.webkit.org/show_bug.cgi?id=79903
+
+        Reviewed by Michael Saboff and Geoffrey Garen.
+
+        This patch speeds up cleanup of vectors and hash tables whose
+        backing store was never allocated.  This is the case by default
+        for most vectors / hash tables that never had any entries added.
+
+        The result for me is that calling checkSyntax 1000 times on
+        concat-jquery-mootools-prototype.js goes from 6.234s to 6.068s, a
+        2.4% speedup.
+
+        * wtf/HashTable.h:
+        (WTF::HashTable::~HashTable):
+        (WTF::::clear): Don't deallocate the storage or frob member
+        variables if there is no backing storage.
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::deallocateBuffer): Likewise.
+
+2012-03-04  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT heuristics should be hyperbolic
+        https://bugs.webkit.org/show_bug.cgi?id=80055
+        <rdar://problem/10922260>
+
+        Reviewed by Oliver Hunt.
+        
+        Added tracking of the amount of executable memory typically used for a bytecode
+        instruction. Modified the execution counter scheme to use this, and the amount
+        of free memory, to determine how long to wait before invoking the JIT.
+        
+        The result is that even if we bomb the VM with more code than can fit in our
+        executable memory pool, we still keep running and almost never run out of
+        executable memory - which ensures that if we have to JIT something critical, then
+        we'll likely have enough memory to do so. This also does not regress performance
+        on the three main benchmarks.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::predictedMachineCodeSize):
+        (JSC):
+        (JSC::CodeBlock::usesOpcode):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::checkIfJITThresholdReached):
+        (JSC::CodeBlock::dontJITAnytimeSoon):
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::llintExecuteCounter):
+        (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
+        (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
+        (JSC::CodeBlock::addressOfJITExecuteCounter):
+        (JSC::CodeBlock::offsetOfJITExecuteCounter):
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold):
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount):
+        (JSC::CodeBlock::jitExecuteCounter):
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached):
+        (JSC::CodeBlock::optimizeNextInvocation):
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon):
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::optimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon):
+        * bytecode/ExecutionCounter.cpp: Added.
+        (JSC):
+        (JSC::ExecutionCounter::ExecutionCounter):
+        (JSC::ExecutionCounter::checkIfThresholdCrossedAndSet):
+        (JSC::ExecutionCounter::setNewThreshold):
+        (JSC::ExecutionCounter::deferIndefinitely):
+        (JSC::ExecutionCounter::applyMemoryUsageHeuristics):
+        (JSC::ExecutionCounter::applyMemoryUsageHeuristicsAndConvertToInt):
+        (JSC::ExecutionCounter::hasCrossedThreshold):
+        (JSC::ExecutionCounter::setThreshold):
+        (JSC::ExecutionCounter::reset):
+        * bytecode/ExecutionCounter.h: Added.
+        (JSC):
+        (ExecutionCounter):
+        (JSC::ExecutionCounter::formattedTotalCount):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::allocateNewSpace):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC):
+        (JSC::ExecutableAllocator::memoryPressureMultiplier):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::memoryPressureMultiplier):
+        (JSC):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * llint/LowLevelInterpreter32_64.asm:
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * wtf/SimpleStats.h: Added.
+        (WTF):
+        (SimpleStats):
+        (WTF::SimpleStats::SimpleStats):
+        (WTF::SimpleStats::add):
+        (WTF::SimpleStats::operator!):
+        (WTF::SimpleStats::count):
+        (WTF::SimpleStats::sum):
+        (WTF::SimpleStats::sumOfSquares):
+        (WTF::SimpleStats::mean):
+        (WTF::SimpleStats::variance):
+        (WTF::SimpleStats::standardDeviation):
+
+2012-03-04  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Libraries are installed to /usr/lib and not /usr/lib64 on x86_64
+        https://bugs.webkit.org/show_bug.cgi?id=71507
+
+        Reviewed by Antonio Gomes.
+
+        * CMakeLists.txt: Use ${LIB_INSTALL_DIR} instead of hardcoding "lib".
+
+2012-03-04  David Kilzer  <ddkilzer@apple.com>
+
+        Fix build when the classic interpreter is enabled
+
+        Reviewed by Gavin Barraclough.
+
+        Fixes the following build error when running the "Generate
+        Derived Sources" build phase script:
+
+            offlineasm: Parsing JavaScriptCore/llint/LowLevelInterpreter.asm and ../../JSCLLIntOffsetsExtractor and creating assembly file LLIntAssembly.h.
+            ./JavaScriptCore/offlineasm/offsets.rb:145:in `offsetsAndConfigurationIndex': unhandled exception
+                    from JavaScriptCore/offlineasm/asm.rb:131
+            Command /bin/sh failed with exit code 1
+
+        Gavin's fix in r109674 avoided the #error statement in
+        JITStubs.h when compiling LLIntOffsetsExtractor.cpp, but it
+        caused the "Generate Derived Sources" build phase script to fail
+        when JavaScriptCore/offlineasm/asm.rb was run.  The solution is
+        to detect when the classic interpreter is being built and simply
+        exit early from asm.rb in that case.
+
+        * llint/LLIntOffsetsExtractor.cpp:
+        (JSC::LLIntOffsetsExtractor::dummy): Return NULL pointer if the
+        JIT is disabled.  Note that offsets.rb doesn't care about the
+        return value here, but instead it cares about finding the magic
+        values in the binary.  The magic values are no longer present
+        when the JIT is disabled.
+        * offlineasm/asm.rb: Catch MissingMagicValuesException and exit
+        early with a status message.
+        * offlineasm/offsets.rb:
+        (MissingMagicValuesException): Add new exception class.
+        (offsetsAndConfigurationIndex): Throw
+        MissingMagicValuesException when no magic values are found.
+
+2012-03-04  Jurij Smakov  <jurij@wooyd.org>
+
+        SPARC also needs aligned accesses.
+
+        Rubber-stamped by Gustavo Noronha Silva.
+
+        * wtf/Platform.h:
+
+2012-03-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed build fix.
+
+        * jit/JITStubs.h:
+            - Move ENABLE(JIT) to head of file.
+
+2012-03-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Split JSArray's [[Put]] & [[DefineOwnProperty]] traps.
+        https://bugs.webkit.org/show_bug.cgi?id=80217
+
+        Reviewed by Filip Pizlo.
+
+        putByIndex() provides similar behavior to put(), but for indexed property names.
+        Many places in ArrayPrototype call putByIndex() where they really mean to call
+        [[DefineOwnProperty]]. This is only okay due to a bug – putByIndex should be
+        calling numeric accessors (& respecting numeric read only properties) on the
+        prototype chain, but isn't. Add a new putDirectIndex (matching JSObject's
+        putDirect* methods), to correctly provide a fast [[DefineOwnProperty]] interface.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        * runtime/JSArray.cpp:
+        (JSC):
+        (JSC::reject):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        * runtime/JSArray.h:
+        (SparseArrayValueMap):
+        (JSArray):
+        (JSC::JSArray::putDirectIndex):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Implement the basis of KURLWTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=79600
+
+        Reviewed by Adam Barth.
+
+        Add an API to know if a ParsedURL is valid.
+
+        * wtf/url/api/ParsedURL.cpp:
+        (WTF::ParsedURL::ParsedURL):
+        (WTF):
+        (WTF::ParsedURL::isolatedCopy): This is needed by APIs moving URL objects between thread
+        and by KURL's detach() on write.
+        (WTF::ParsedURL::baseAsString):
+        (WTF::ParsedURL::segment):
+        Add a stronger constraint on accessors: the client of this API should never ask for the segments
+        on an invalid URL.
+        * wtf/url/api/ParsedURL.h:
+        (WTF):
+        (WTF::ParsedURL::ParsedURL):
+        (ParsedURL):
+        (WTF::ParsedURL::isValid):
+
+2012-03-03  Hans Wennborg  <hans@chromium.org>
+
+        Implement Speech JavaScript API
+        https://bugs.webkit.org/show_bug.cgi?id=80019
+
+        Reviewed by Adam Barth.
+
+        Add ENABLE_SCRIPTED_SPEECH.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        When getting the line number of a call into a call frame with no code block, it's
+        incorrect to rely on the returnPC
+        https://bugs.webkit.org/show_bug.cgi?id=80195
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+
+2012-03-02  Han Hojong  <hojong.han@samsung.com>
+
+        Expected results updated for checking type conversion
+        https://bugs.webkit.org/show_bug.cgi?id=80138
+
+        Reviewed by Gavin Barraclough.
+
+        * tests/mozilla/ecma/TypeConversion/9.3.1-3.js:
+
+2012-03-02  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Added USE(ZLIB) flag.
+
+        Reviewed by Kent Tamura.
+
+        * wtf/Platform.h:
+
+2012-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for platforms that have DFG_JIT disabled but PARALLEL_GC enabled.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+
+2012-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGCodeBlocks should not trace CodeBlocks that are also going to be traced by
+        virtue of being in the transitive closure
+        https://bugs.webkit.org/show_bug.cgi?id=80098
+ 
+        Reviewed by Anders Carlsson.
+        
+        If DFGCodeBlocks traces a CodeBlock that might also be traced via its owner Executable,
+        then you might have the visitAggregate() method called concurrently by multiple threads.
+        This is benign on 64-bit -- visitAggregate() and everything it calls turns out to be
+        racy and slightly imprecise but not unsound. But on 32-bit, visitAggregate() may crash
+        due to word tearing in ValueProfile bucket updates inside of computeUpdatedPrediction().
+        
+        It would seem that the fix is just to have DFGCodeBlocks not trace CodeBlocks that are
+        not jettisoned. But CodeBlocks may be jettisoned later during the GC, so it must trace
+        any CodeBlock that it knows to be live by virtue of it being reachable from the stack.
+        Hence the real fix is to make sure that concurrent calls into CodeBlock::visitAggregate()
+        don't lead to two threads racing over each other as they clobber state. This patch
+        achieves this with a simple CAS loop: whichever thread wins the CAS race (which is
+        trivially linearizable) will get to trace the CodeBlock; all other threads give up and
+        go home.
+        
+        Unfortunately there will be no new tests. It's possible to reproduce this maybe 1/10
+        times by running V8-v6's raytrace repeatedly, using the V8 harness hacked to rerun it
+        even when it's gotten sufficient counts. But that takes a while - sometimes up to a
+        minute to get a crash. I have no other reliable repro case.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (DFGData):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::clearMarks):
+
+2012-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        The JIT should not crash the entire process just because there is not enough executable
+        memory, if the LLInt is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79962
+
+        Reviewed by Csaba Osztrogonác.
+        
+        Fix for ARM, SH4.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::executableCopy):
+
+2012-03-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Revert my change. Broke builds.
+        Source/JavaScriptCore/wtf/Atomics.h:188: error: redefinition of 'bool WTF::weakCompareAndSwap(volatile uintptr_t*, uintptr_t, uintptr_t)'
+        Source/JavaScriptCore/wtf/Atomics.h:122: error: 'bool WTF::weakCompareAndSwap(volatile unsigned int*, unsigned int, unsigned i
+
+        * wtf/Atomics.h:
+        (WTF):
+        (WTF::weakCompareAndSwap):
+
+2012-03-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Gcc build fix.
+
+        Rubber-stamped by Filip Pizlo.
+
+        * wtf/Atomics.h:
+        (WTF):
+        (WTF::weakCompareAndSwap):
+
+2012-03-01  Gavin Barraclough  <barraclough@apple.com>
+
+        ES5.1-15.3.5.4. prohibits Function.caller from [[Get]]ting a strict caller
+        https://bugs.webkit.org/show_bug.cgi?id=80011
+
+        Reviewed by Oliver Hunt.
+
+        Also, fix getting the caller from within a bound function, for within a getter,
+        or setter (make our implementation match other browsers).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+            - Allow this to get the caller of host functions.
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+            - This should use getCallerInfo, and should skip over function bindings.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::callerGetter):
+            - This should never return a strict-mode function.
+
+2012-03-01  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG local CSE for a node can be terminated earlier
+        https://bugs.webkit.org/show_bug.cgi?id=80014
+
+        Reviewed by Filip Pizlo.
+
+        When one of the node's childredn is met in the process of back traversing
+        the nodes, we don't need to traverse the remaining nodes.
+        This is performance neutral on SunSpider, V8 and Kraken.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+
+2012-02-29  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG BasicBlocks should not require that their nodes have continuous indices in the graph
+        https://bugs.webkit.org/show_bug.cgi?id=79899
+
+        Reviewed by Filip Pizlo.
+
+        This will make it more convenient to insert nodes into the DFG.
+        With this capability we now place the Phi nodes in the corresponding
+        blocks.
+        Local CSE is modified to not to rely on the assumption of continuous
+        node indices in a block.
+        This is performance neutral on SunSpider, V8 and Kraken.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberStructures):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::forNode):
+        (AbstractState):
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        (ArithNodeFlagsInferencePhase):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::insertPhiNode):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::determineReachability):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        (CFAPhase):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (JSC::DFG::CSEPhase::endIndexForPureCSE):
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::impureCSE):
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        (CSEPhase):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::beginPhase):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-02-29  Filip Pizlo  <fpizlo@apple.com>
+
+        The JIT should not crash the entire process just because there is not
+        enough executable memory, if the LLInt is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79962
+        <rdar://problem/10922215>
+
+        Unreviewed, adding forgotten file.
+
+        * jit/JITCompilationEffort.h: Added.
+        (JSC):
+
+2012-02-29  Filip Pizlo  <fpizlo@apple.com>
+
+        The JIT should not crash the entire process just because there is not
+        enough executable memory, if the LLInt is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79962
+        <rdar://problem/10922215>
+
+        Reviewed by Gavin Barraclough.
+        
+        Added the notion of JITCompilationEffort. If we're JIT'ing as a result of
+        a tier-up, then we set it to JITCompilationCanFail. Otherwise it's
+        JITCompilationMustSucceed. This preserves the old behavior of LLInt is
+        disabled or if we're compiling something that can't be interpreted (like
+        an OSR exit stub).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (ARMAssembler):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::~LinkBuffer):
+        (LinkBuffer):
+        (JSC::LinkBuffer::didFailToAllocate):
+        (JSC::LinkBuffer::isValid):
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::performFinalization):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
+        * bytecode/CodeBlock.cpp:
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::jitCompile):
+        (CodeBlock):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::allocateNewSpace):
+        (JSC::ExecutableAllocator::allocate):
+        * jit/ExecutableAllocator.h:
+        (ExecutableAllocator):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        (JIT):
+        * jit/JITCompilationEffort.h: Added.
+        (JSC):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        * runtime/Executable.h:
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+
+2012-02-29  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] Get rid of the #ifdef mess in LayerTreeHost[Proxy]
+        https://bugs.webkit.org/show_bug.cgi?id=79501
+
+        Enable WTF_USE_UI_SIDE_COMPOSITING for Qt.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * wtf/Platform.h:
+
+2012-02-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        * tests/mozilla/ecma_2/RegExp/constructor-001.js:
+        * tests/mozilla/ecma_2/RegExp/function-001.js:
+        * tests/mozilla/ecma_2/RegExp/properties-001.js:
+            - Check in new test cases results.
+
+2012-02-29  Mark Rowe  <mrowe@apple.com>
+
+        Stop installing JSCLLIntOffsetsExtractor.
+
+        Replace the separate TestRegExp and TestAPI xcconfig files with a single ToolExecutable xcconfig file
+        that derives the product name from the target name. We can then use that xcconfig file for JSCLLIntOffsetsExtractor.
+        This has the results of setting SKIP_INSTALL = YES for JSCLLIntOffsetsExtractor.
+
+        While I was doing this fiddling I noticed that the JSCLLIntOffsetsExtractor target had a custom value
+        for USER_HEADER_SEARCH_PATHS to allow it to find LLIntDesiredOffsets.h. A better way of doing that is
+        to add LLIntDesiredOffsets.h to the Xcode project so that it'll be included in the header map. That
+        allows us to remove the override of USER_HEADER_SEARCH_PATHS entirely. So I did that too!
+
+        Reviewed by Filip Pizlo.
+
+        * Configurations/TestRegExp.xcconfig: Removed.
+        * Configurations/ToolExecutable.xcconfig: Renamed from Source/JavaScriptCore/Configurations/TestAPI.xcconfig.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        RefCounted::deprecatedTurnOffVerifier() should not be deprecated
+        https://bugs.webkit.org/show_bug.cgi?id=79864
+
+        Reviewed by Oliver Hunt.
+        
+        Removed the word "deprecated" from the name of this method, since this method
+        should not be deprecated. It works just fine as it is, and there is simply no
+        alternative to calling this method for many interesting JSC classes.
+
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::SharedSymbolTable):
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocatorHandle::MetaAllocatorHandle):
+        (WTF::MetaAllocator::allocate):
+        * wtf/RefCounted.h:
+        (RefCountedBase):
+        (WTF::RefCountedBase::turnOffVerifier):
+
+2012-02-29  Gavin Barraclough  <barraclough@apple.com>
+
+        'source' property of RegExp instance cannot be ""
+        https://bugs.webkit.org/show_bug.cgi?id=79938
+
+        Reviewed by Oliver Hunt.
+
+        15.10.6.4 specifies that RegExp.prototype.toString must return '/' + source + '/',
+        and also states that the result must be a valid RegularExpressionLiteral. '//' is
+        not a valid RegularExpressionLiteral (since it is a single line comment), and hence
+        source cannot ever validly be "". If the source is empty, return a different Pattern
+        that would match the same thing.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectSource):
+            - Do not return "" if the source is empty, this would lead to invalid behaviour in toString.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+            - No need to special case the empty string - this should be being done by 'source'.
+
+2012-02-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Writable attribute not set correctly when redefining an accessor to a data descriptor
+        https://bugs.webkit.org/show_bug.cgi?id=79931
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+            - use attributesOverridingCurrent instead of attributesWithOverride.
+        * runtime/PropertyDescriptor.cpp:
+        * runtime/PropertyDescriptor.h:
+            - remove attributesWithOverride - attributesOverridingCurrent does the same thing.
+
+2012-02-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Add JSCore symbol exports needed by wx port
+        https://bugs.webkit.org/show_bug.cgi?id=77280
+
+        Reviewed by Hajime Morita.
+
+        * wtf/ArrayBufferView.h:
+        * wtf/ExportMacros.h:
+
+2012-02-28  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Always build wtf as a static library.
+        https://bugs.webkit.org/show_bug.cgi?id=79857
+
+        Reviewed by Eric Seidel.
+
+        To help the efforts in bug 75673 to move WTF out of
+        JavaScriptCore, act more like the other ports and remove the
+        possibility of building WTF as a shared library.
+
+        It does not make much sense to, for example, ship WTF as a
+        separate .so with webkit-efl packages, and it should be small
+        enough not to cause problems during linking.
+
+        * wtf/CMakeLists.txt:
+
+2012-02-28  Dmitry Lomov  <dslomov@google.com>
+
+        [JSC] Implement ArrayBuffer transfer
+        https://bugs.webkit.org/show_bug.cgi?id=73493.
+        Implement ArrayBuffer transfer, per Khronos spec:  http://www.khronos.org/registry/typedarray/specs/latest/#9.
+        This brings parity with V8 implementation of transferable typed arrays.
+
+        Reviewed by Oliver Hunt.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Extra export.
+        * wtf/ArrayBuffer.h:
+        (ArrayBuffer): Added extra export.
+
+2012-02-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed. Build fix after recent LLInt additions.
+        
+        * wscript:
+
+2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor SpeculativeJIT::emitAllocateJSFinalObject
+        https://bugs.webkit.org/show_bug.cgi?id=79801
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Split emitAllocateJSFinalObject out to form this
+        function, which is more generic in that it can allocate a variety of classes.
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): Changed to use the new helper function.
+
+2012-02-28  Gavin Barraclough  <barraclough@apple.com>
+
+        [[Get]]/[[Put]] for primitives should not wrap on strict accessor call
+        https://bugs.webkit.org/show_bug.cgi?id=79588
+
+        Reviewed by Oliver Hunt.
+
+        In the case of [[Get]], this is a pretty trivial bug - just don't wrap
+        primitives at the point you call a getter.
+
+        For setters, this is a little more involved, since we have already wrapped
+        the value up in a synthesized object. Stop doing so. There is also a further
+        subtely, that in strict mode all attempts to create a new data property on
+        the object should throw.
+
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+            - [[Put]] to a string primitive should use JSValue::putToPrimitive.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Remove static function called in one place.
+        * runtime/JSObject.h:
+        (JSC::JSValue::put):
+            - [[Put]] to a non-cell JSValue should use JSValue::putToPrimitive.
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::synthesizePrototype):
+            - Add support for synthesizing the prototype of strings.
+        (JSC::JSValue::putToPrimitive):
+            - Added, implements [[Put]] for primitive bases, per 8.7.2.
+        * runtime/JSValue.h:
+        (JSValue):
+            - Add declaration for JSValue::putToPrimitive.
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+            - Don't call ToObject on primitive this values.
+
+2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Re-enable parallel GC on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=79837
+
+        Rubber stamped by Filip Pizlo.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions): We accidentally disabled parallel GC with this line,
+        so we removed it and things should go back to normal.
+
+2012-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Some run-javascriptcore-tests broken for 32-bit debug
+        https://bugs.webkit.org/show_bug.cgi?id=79844
+
+        Rubber stamped by Oliver Hunt.
+        
+        These assertions are just plain wrong for 32-bit. We could either have a massive
+        assertion that depends on value representation, that has to be changed every
+        time we change the JITs, resulting in a bug tail of debug-mode crashes, or we
+        could get rid of the assertions. I pick the latter.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2012-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Get rid of padding cruft in CopiedBlock
+        https://bugs.webkit.org/show_bug.cgi?id=79686
+
+        Reviewed by Filip Pizlo.
+
+        * heap/CopiedBlock.h:
+        (CopiedBlock): Removed the extra padding that was used for alignment purposes until 
+        the calculation of the payload offset into CopiedBlocks was redone recently.
+
+2012-02-28  Anders Carlsson  <andersca@apple.com>
+
+        Fix build with newer versions of clang.
+
+        Clang now warns since we're not passing a CFString literal to CFStringCreateWithFormatAndArguments,
+        but it's OK to ignore this warning since clang is also checking that the caller (vprintf_stderr_common)
+        takes a string literal.
+
+        * wtf/Assertions.cpp:
+
+2012-02-28  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add GMainLoop and GMainContext to be handled by GRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=79496
+
+        Reviewed by Martin Robinson.
+
+        Handle GMainLoop and GMainContext in GRefPtr, by calling
+        g_main_loop_(un)ref and g_main_context_(un)ref in the
+        implementation of the refGPtr and derefGPtr template functions.
+
+        * wtf/gobject/GRefPtr.cpp:
+        (WTF::refGPtr):
+        (WTF):
+        (WTF::derefGPtr):
+        * wtf/gobject/GRefPtr.h:
+        (WTF):
+        * wtf/gobject/GTypedefs.h:
+
+2012-02-28  Yong Li  <yoli@rim.com>
+
+        JSString::resolveRope() should report extra memory cost to the heap.
+        https://bugs.webkit.org/show_bug.cgi?id=79555
+
+        Reviewed by Michael Saboff.
+
+        At the time a JSString is constructed with fibers, it doesn't report
+        extra memory cost, which is reasonable because it hasn't allocate
+        new memory. However when the rope is resolved, it should report meory
+        cost for the new buffer.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+
+2012-02-27  Oliver Hunt  <oliver@apple.com>
+
+        sputnik/Unicode/Unicode_500/S7.2_A1.6_T1.html crashes in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=79728
+
+        Reviewed by Gavin Barraclough.
+
+        When initialising a chained get instruction we may end up in a state where
+        the instruction stream says we have a scopechain, but it has not yet been set
+        (eg. if allocating the StructureChain itself is what leads to the GC).  We could
+        re-order the allocation, but it occurs in a couple of places, so it seems less
+        fragile simply to null check the scopechain slot before we actually visit the slot.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitStructures):
+
+2012-02-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Old JIT's style of JSVALUE64 strict equality is subtly wrong
+        https://bugs.webkit.org/show_bug.cgi?id=79700
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::comparePtr):
+        (MacroAssemblerX86_64):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2012-02-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement support for op_negate and op_bitnot in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=79617
+
+        Reviewed by Filip Pizlo.
+
+        Add an ArithNegate op to the DFG JIT, to implement op_negate.
+
+        This patch also adds support for op_negate to the JSVALUE64 baseline JIT
+        (JSVALUE32_64 already had this), so that we can profile the slowpath usage.
+
+        This is a 2.5%-3% Sunspider progression and a 1% win on Kraken.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::sub_S):
+            - Added sub_S from immediate.
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::vneg):
+            - Added double negate.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::negateDouble):
+            - Added double negate.
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::branchNeg32):
+            - Added.
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+            - moved loadDouble, absDouble to common.
+        * assembler/MacroAssemblerX86Common.h:
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::absDouble):
+            - implementation can be shared.
+        (JSC::MacroAssemblerX86Common::negateDouble):
+            - Added.
+        (JSC::MacroAssemblerX86Common::loadDouble):
+            - allow absDouble to have a common implementation.
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+            - moved loadDouble, absDouble to common.
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+            - support ArithNegate.
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        (JSC::DFG::ArithNodeFlagsInferencePhase::propagate):
+            - support ArithNegate.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+            - support ArithNegate.
+        (JSC::DFG::ByteCodeParser::parseBlock):
+            - support op_negate.
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+            - support ArithNegate.
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+            - support op_negate.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::negateShouldSpeculateInteger):
+            - support ArithNegate.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArithNodeFlags):
+            - support ArithNegate.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+            - support ArithNegate.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+            - support ArithNegate.
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+            - support ArithNegate.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - support ArithNegate.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - support ArithNegate.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+            - Add support for op_negate in JSVALUE64.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+            - Add support for op_negate in JSVALUE64.
+
+2012-02-27  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Unreviewed. Build fix for linux-bot (qt) after r109021.
+
+        * runtime/Error.cpp:
+
+2012-02-27  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION (r108112): AWS Management Console at amazon.com fails to initialize
+        https://bugs.webkit.org/show_bug.cgi?id=79693
+
+        Reviewed by Filip Pizlo.
+
+        Alas we can't provide the stack trace as an array, as despite everyone wanting
+        an array, everyone arbitrarily creates the array by calling split on the stack
+        trace.  To create the array we would have provided them in the first place.
+
+        This changes the exception's stack property to a \n separated string.  To get the
+        old array just do <exception>.stack.split("\n").
+
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+
+2012-02-27  Gavin Barraclough  <barraclough@apple.com>
+
+        RegExp lastIndex should behave as a regular property
+        https://bugs.webkit.org/show_bug.cgi?id=79446
+
+        Reviewed by Sam Weinig.
+
+        lastIndex should be a regular data descriptor, with the attributes configurable:false,
+        enumerable:false, writable:true. As such, it should be possible to reconfigure writable
+        as false. If the lastIndex property is reconfigured to be read-only, we should respect
+        this correctly.
+
+        * runtime/CommonIdentifiers.h:
+            - Removed some unused identifiers, added lastIndex.
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::deleteProperty):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::getOwnPropertyNames):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::getPropertyNames):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::reject):
+            - helper function for defineOwnProperty.
+        (JSC::RegExpObject::defineOwnProperty):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::put):
+            - lastIndex is no longer a static value, provided specific handling.
+        (JSC::RegExpObject::match):
+            - Pass setLastIndex an ExecState, so it can throw if read-only.
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+            - Pass setLastIndex an ExecState, so it can throw if read-only.
+        (RegExpObjectData):
+            - Added lastIndexIsWritable.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+            - Pass setLastIndex an ExecState, so it can throw if read-only.
+
+2012-02-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement support for op_negate and op_bitnot in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=79617
+
+        Reviewed by Sam Weinig.
+
+        Remove op_bitnop - this is redundant, ~x === x^-1.
+        This is a fractional (<1%) progression.
+
+        Remove not32(X) from the MacroAssemblers - make this an optimization to add32(-1, X).
+        Remove CanReuse from the result type - this was unused.
+        Remove op_bitnot.
+
+        * assembler/MacroAssemblerARM.h:
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::xor32):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::xor32):
+        * assembler/MacroAssemblerMIPS.h:
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::xor32):
+        * assembler/MacroAssemblerSH4.h:
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::xor32):
+        * assembler/MacroAssemblerX86Common.h:
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::xor32):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC):
+        (JSC::BitwiseNotNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC):
+        * jit/JITStubs.cpp:
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter32_64.asm:
+        * parser/NodeConstructors.h:
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::SubNode::SubNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        * parser/Nodes.h:
+        (BitwiseNotNode):
+        (JSC::BitwiseNotNode::expr):
+        (JSC):
+        * parser/ResultType.h:
+        (ResultType):
+        (JSC::ResultType::numberTypeIsInt32):
+        (JSC::ResultType::stringOrNumberType):
+        (JSC::ResultType::forAdd):
+        (JSC::ResultType::forBitOp):
+
+2012-02-27  Michael Saboff  <msaboff@apple.com>
+
+        Error check regexp min quantifier
+        https://bugs.webkit.org/show_bug.cgi?id=70648
+
+        Reviewed by Gavin Barraclough.
+
+        Added checking for min or only quantifier being UINT_MAX.
+        When encountered this becomes a SyntaxError during parsing.
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parse):
+        (Parser):
+
+2012-02-27  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        Added ACCESSIBILITY_CONTEXT_MENUS.
+
+        * wtf/Platform.h:
+
+2012-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        LayoutTests/fast/xpath/xpath-functional-test.html is crashing in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=79616
+
+        Reviewed by Oliver Hunt.
+        
+        Guard against the fact that in JSVALUE64, JSValue().isCell() == true.
+
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::validate):
+
+2012-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support activations and nested functions
+        https://bugs.webkit.org/show_bug.cgi?id=79554
+
+        Reviewed by Sam Weinig.
+        
+        Fix 32-bit. The 32-bit function+activation code had some really weird
+        register reuse bugs.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Getting the instruction stream for a code block should not require two loads
+        https://bugs.webkit.org/show_bug.cgi?id=79608
+
+        Reviewed by Sam Weinig.
+        
+        Introduced the RefCountedArray class, which contains a single inline pointer
+        to a ref-counted non-resizeable vector backing store. This satisfies the
+        requirements of CodeBlock, which desires the ability to share instruction
+        streams with other CodeBlocks. It also reduces the number of loads required
+        for getting the instruction stream by one.
+        
+        This patch also gets rid of the bytecode discarding logic, since we don't
+        use it anymore and it's unlikely to ever work right with DFG or LLInt. And
+        I didn't feel like porting dead code to use RefCountedArray.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::instructionOffsetForNth):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::numberOfInstructions):
+        (JSC::CodeBlock::instructions):
+        (JSC::CodeBlock::instructionCount):
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        (JSC):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::Label::setLocation):
+        (JSC):
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::newLabel):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC):
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::instructions):
+        * bytecompiler/Label.h:
+        (JSC::Label::Label):
+        (Label):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        * llint/LowLevelInterpreter32_64.asm:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::codeBlockWithBytecodeFor):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        * wtf/RefCountedArray.h: Added.
+        (WTF):
+        (RefCountedArray):
+        (WTF::RefCountedArray::RefCountedArray):
+        (WTF::RefCountedArray::operator=):
+        (WTF::RefCountedArray::~RefCountedArray):
+        (WTF::RefCountedArray::size):
+        (WTF::RefCountedArray::data):
+        (WTF::RefCountedArray::begin):
+        (WTF::RefCountedArray::end):
+        (WTF::RefCountedArray::at):
+        (WTF::RefCountedArray::operator[]):
+        (Header):
+        (WTF::RefCountedArray::Header::size):
+        (WTF::RefCountedArray::Header::payload):
+        (WTF::RefCountedArray::Header::fromPayload):
+        * wtf/Platform.h:
+
+2012-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        StringLiteral and NumericLiteral are allowed as ObjectLiteral getter / setter name
+        https://bugs.webkit.org/show_bug.cgi?id=79571
+
+        Reviewed by Gavin Barraclough.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        * parser/Parser.cpp:
+        (JSC::::parseProperty):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+
+2012-02-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Implement fast path for op_new_array in the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=78612
+
+        Reviewed by Filip Pizlo.
+
+        heap/CopiedAllocator.h:
+        (CopiedAllocator): Friended the JIT to allow access to m_currentOffset.
+        * heap/CopiedSpace.h:
+        (CopiedSpace): Friended the JIT to allow access to isOversize.
+        (JSC::CopiedSpace::allocator):
+        * heap/Heap.h:
+        (JSC::Heap::storageAllocator): Added a getter for the CopiedAllocator class so the JIT
+        can use it for simple allocation i.e. when we can just bump the offset without having to 
+        do anything else.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases): Added new slow case for op_new_array for when
+        we have to bail out because the fast allocation path fails for whatever reason.
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicStorage): Added utility function that allows objects to 
+        allocate generic backing stores. This function is used by emitAllocateJSArray.
+        (JSC):
+        (JSC::JIT::emitAllocateJSArray): Added utility function that allows the client to 
+        more easily allocate JSArrays. This function is used by emit_op_new_array and I expect 
+        it will also be used for emit_op_new_array_buffer.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array): Changed to do inline allocation of JSArrays. Still does 
+        a stub call for oversize arrays.
+        (JSC):
+        (JSC::JIT::emitSlow_op_new_array): New slow path that just bails out to a stub call if we 
+        fail in any way on the fast path.
+        * runtime/JSArray.cpp:
+        (JSC):
+        * runtime/JSArray.h: Added lots of offset functions for all the fields that we need to 
+        initialize in the JIT.
+        (ArrayStorage):
+        (JSC::ArrayStorage::lengthOffset):
+        (JSC::ArrayStorage::numValuesInVectorOffset):
+        (JSC::ArrayStorage::allocBaseOffset):
+        (JSC::ArrayStorage::vectorOffset):
+        (JSArray):
+        (JSC::JSArray::sparseValueMapOffset):
+        (JSC::JSArray::subclassDataOffset):
+        (JSC::JSArray::indexBiasOffset):
+        (JSC):
+        (JSC::JSArray::storageSize): Moved this function from being a static function in the cpp file
+        to being a static function in the JSArray class. This move allows the JIT to call it to 
+        see what size it should allocate.
+
+2012-02-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for ENABLE(CLASSIC_INTERPRETER) after r108681.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC::Interpreter::getStackTrace):
+
+2012-02-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r108681.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+
+2012-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt assembly file should be split into 32-bit and 64-bit parts
+        https://bugs.webkit.org/show_bug.cgi?id=79584
+
+        Reviewed by Sam Weinig.
+        
+        Moved LowLevelInterpreter.asm to LowLevelInterpreter32_64.asm. Gave offlineasm
+        the ability to include files, and correctly track dependencies: it restricts
+        the include mechanism to using the same directory as the source file, and uses
+        the SHA1 hash of all .asm files in that directory as an input hash.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm: Added.
+            - This is just the entire contents of what was previously LowLevelInterpreter.asm
+        * llint/LowLevelInterpreter64.asm: Added.
+        * offlineasm/asm.rb:
+        * offlineasm/ast.rb:
+        * offlineasm/generate_offset_extractor.rb:
+        * offlineasm/parser.rb:
+        * offlineasm/self_hash.rb:
+
+2012-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Offlineasm should support X86_64
+        https://bugs.webkit.org/show_bug.cgi?id=79581
+
+        Reviewed by Oliver Hunt.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * offlineasm/backends.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/settings.rb:
+        * offlineasm/x86.rb:
+
+2012-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support activations and nested functions
+        https://bugs.webkit.org/show_bug.cgi?id=79554
+
+        Reviewed by Oliver Hunt.
+        
+        Wrote the simplest possible implementation of activations. Big speed-up on
+        code that uses activations, no speed-up on major benchmarks (SunSpider, V8,
+        Kraken) because they do not appear to have sufficient coverage over code
+        that uses activations.
+
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionFromValue):
+        * bytecode/PredictedType.h:
+        (JSC):
+        (JSC::isEmptyPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::buildOperandMapsIfNecessary):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::needsActivation):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::Node::storageAccessDataIndex):
+        (Node):
+        (JSC::DFG::Node::hasFunctionDeclIndex):
+        (JSC::DFG::Node::functionDeclIndex):
+        (JSC::DFG::Node::hasFunctionExprIndex):
+        (JSC::DFG::Node::functionExprIndex):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add an empty skeleton of KURL for WTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=78990
+
+        Reviewed by Adam Barth.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Export the relevant classes from WTFURL
+        so that can use them in WebCore.
+
+2012-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build for DFG disabled and LLInt enabled.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2012-02-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the CopiedBlock offset alignment in a cross platform fashion
+        https://bugs.webkit.org/show_bug.cgi?id=79556
+
+        Reviewed by Filip Pizlo.
+
+        Replaced m_payload with a payload() method that calculates the offset
+        of the payload with the proper alignment. This change allows us to 
+        avoid alignment-related issues in a cross-platform manner.
+
+        * heap/CopiedAllocator.h:
+        (JSC::CopiedAllocator::currentUtilization):
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::payload):
+        (CopiedBlock):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneFillingBlock):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::borrowBlock):
+        (JSC::CopiedSpace::allocateFromBlock):
+
+2012-02-24  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed, Windows build fix.  Changed signature in export to match
+        change made in r108858.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG support for op_new_regexp should be enabled
+        https://bugs.webkit.org/show_bug.cgi?id=79538
+
+        Reviewed by Oliver Hunt.
+        
+        No performance change.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGCommon.h:
+
+2012-02-24  Michael Saboff  <msaboff@apple.com>
+
+        ASSERT(position < 0) in JSC::Yarr::Interpreter::InputStream::readChecked
+        https://bugs.webkit.org/show_bug.cgi?id=73728
+
+        Reviewed by Gavin Barraclough.
+
+        Fixed the mixing of signed and unsigned character indeces in YARR
+        interpreter.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match): Added code to check for match longer than 2^31 and
+        return no match after resetting the offsets.
+        * yarr/YarrInterpreter.cpp: Changed to use unsigned for all character index
+        handling except when matching back references.
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::checkInput):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::InputStream::isAvailableInput):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::checkCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/YarrInterpreter.h:
+
+2012-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for builds where the DFG is disabled but the LLInt is
+        enabled.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+
+2012-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to handle variables getting captured
+        https://bugs.webkit.org/show_bug.cgi?id=79469
+
+        Reviewed by Oliver Hunt.
+        
+        Made captured variables work by placing a Flush on the SetLocal and
+        forcing the emission of the GetLocal even if copy propagation tells us
+        who has the value.
+        
+        Changed the CFA and various prediction codes to understand that we can't
+        really prove anything about captured variables. Well, we could in the
+        future by just looking at what side effects are happening, but in this
+        first cut we just assume that we can't reason about captured variables.
+        
+        Also added a mode where the DFG pretends that all variables and arguments
+        got captured. Used this mode to harden the code.
+        
+        This is performance neutral. Capturing all variables is a slow down, but
+        not too big of one. This seems to predict that when we add activation
+        support, the amount of speed benefit we'll get from increased coverage
+        will far outweigh the pessimism that we'll have to endure for captured
+        variables.
+
+        * bytecode/CodeType.h:
+        (JSC::codeTypeToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::merge):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flushArgument):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * dfg/DFGCommon.h:
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::needsActivation):
+        (Graph):
+        (JSC::DFG::Graph::argumentIsCaptured):
+        (JSC::DFG::Graph::localIsCaptured):
+        (JSC::DFG::Graph::isCaptured):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldGenerate):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (ValueSource):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2012-02-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Should not allow malformed \x escapes
+        https://bugs.webkit.org/show_bug.cgi?id=79462
+
+        Reviewed by Oliver Hunt.
+
+        * parser/Lexer.cpp:
+        (JSC::::parseString):
+        (JSC::::parseStringSlowCase):
+            - Prohibit malformed '\x' escapes
+        * tests/mozilla/ecma/Array/15.4.5.1-1.js:
+        * tests/mozilla/ecma/LexicalConventions/7.7.4.js:
+        * tests/mozilla/ecma_2/RegExp/hex-001.js:
+        * tests/mozilla/js1_2/regexp/hexadecimal.js:
+            - Remove erroneous test cases (correct behaviour is tested by LayoutTests/sputnik).
+
+2012-02-24  Daniel Bates  <dbates@webkit.org>
+
+        Fix change log entry for changeset r108819; add bug URL
+        https://bugs.webkit.org/show_bug.cgi?id=79504
+
+        Changeset r108819 is associated with bug #79504.
+
+        * ChangeLog
+
+2012-02-24  Daniel Bates  <dbates@webkit.org>
+
+        Substitute ENABLE(CLASSIC_INTERPRETER) for ENABLE(INTERPRETER) in Interpreter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79504
+
+        Reviewed by Oliver Hunt.
+
+        There are a few places in Interpreter.cpp that need to be updated to use
+        ENABLE(CLASSIC_INTERPRETER) following the renaming of ENABLE_INTERPRETER to
+        ENABLE_CLASSIC_INTERPRETER in changeset <http://trac.webkit.org/changeset/108020>
+        (https://bugs.webkit.org/show_bug.cgi?id=78791).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::getSourceURLFromCallFrame):
+
+2012-02-24  Adam Roben  <aroben@apple.com>
+
+        Undo the BUILDING_WTF part of r108808
+
+        This broke the build, which is obviously worse than the linker warning it was trying to
+        solve.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2012-02-24  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed symbols that are already
+        exported via JS_EXPORTDATA.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Define BUILDING_WTF. We
+        aren't actually building WTF, but we are statically linking it, so we need to define this
+        symbol so that we export WTF's exports.
+
+2012-02-24  Philippe Normand  <pnormand@igalia.com>
+
+        Fix GTK WebAudio build for WebKitGTK 1.7.90.
+
+        Patch by Priit Laes <plaes@plaes.org> on 2012-02-24
+        Rubber-stamped by Philippe Normand.
+
+        * GNUmakefile.list.am: Add Complex.h to the list of files so it
+        gets disted in the tarballs.
+
+2012-02-24  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt] Buildfix for "Zero out CopiedBlocks on initialization".
+        https://bugs.webkit.org/show_bug.cgi?id=79199
+
+        Ruber stamped by Csaba Osztrogonác.
+
+        Temporary fix since the new member wastes a little space on
+        64 bit systems. Although it is harmless, it is only needed
+        for 32 bit systems.
+
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+
+2012-02-24  Han Hojong  <hojong.han@samsung.com>
+
+        Remove useless jump instructions for short circuit
+        https://bugs.webkit.org/show_bug.cgi?id=75602
+
+        Reviewed by Michael Saboff.
+
+        Jump instruction is inserted to make short circuit, 
+        however it does nothing but moving to the next instruction.
+        Therefore useless jump instructions are removed, 
+        and jump list is moved into the case not for a short circuit,
+        so that only necessary instructions are added to JIT code
+        unless it has a 16 bit pattern character and an 8 bit string.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+
+2012-02-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108731.
+        http://trac.webkit.org/changeset/108731
+        https://bugs.webkit.org/show_bug.cgi?id=79464
+
+        Broke Chromium Win tests (Requested by bashi on #webkit).
+
+        * wtf/Platform.h:
+
+2012-02-24  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Enable requestAnimationFrame
+        https://bugs.webkit.org/show_bug.cgi?id=79408
+
+        Use timer implementation of requestAnimationFrame on BlackBerry.
+
+        Reviewed by Rob Buis.
+
+        * wtf/Platform.h:
+
+2012-02-24  Mathias Bynens  <mathias@qiwi.be>
+
+        `\u200c` and `\u200d` should be allowed in IdentifierPart, as per ES5
+        https://bugs.webkit.org/show_bug.cgi?id=78908
+
+        Add additional checks for zero-width non-joiner (0x200C) and
+        zero-width joiner (0x200D) characters.
+
+        Reviewed by Michael Saboff.
+
+        * parser/Lexer.cpp:
+        (JSC::isNonASCIIIdentPart)
+        * runtime/LiteralParser.cpp:
+        (JSC::::Lexer::lexIdentifier)
+
+2012-02-23  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Added USE(ZLIB) flag.
+
+        Reviewed by Kent Tamura.
+
+        * wtf/Platform.h:
+
+2012-02-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Zero out CopiedBlocks on initialization
+        https://bugs.webkit.org/show_bug.cgi?id=79199
+
+        Reviewed by Filip Pizlo.
+
+        Made CopyBlocks zero their payloads during construction. This allows 
+        JSArray to avoid having to manually clear its backing store upon allocation
+        and also alleviates any future pain with regard to the garbage collector trying 
+        to mark what it thinks are values in what is actually uninitialized memory.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::finishCreation):
+        (JSC::JSArray::tryFinishCreationUninitialized):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::unshiftCountSlowCase):
+
+2012-02-23  Oliver Hunt  <oliver@apple.com>
+
+        Make Interpreter::getStackTrace be able to generate the line number for the top callframe if none is provided
+        https://bugs.webkit.org/show_bug.cgi?id=79407
+
+        Reviewed by Gavin Barraclough.
+
+        Outside of exception handling, we don't know what our source line number is.  This
+        change allows us to pass -1 is as the initial line number, and get the correct line
+        number in the resultant stack trace.  We can't completely elide the initial line
+        number (yet) due to some idiosyncrasies of the exception handling machinery.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC):
+        (JSC::Interpreter::getStackTrace):
+
+2012-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit value profiling should have graceful handling of local variables and arguments
+        https://bugs.webkit.org/show_bug.cgi?id=79310
+
+        Reviewed by Gavin Barraclough.
+        
+        Previously, if we OSR exited because a prediction in a local was wrong, we'd
+        only realize what the true type of the local was if the regular value profiling
+        kicked in and told us. Unless the local was block-locally copy propagated, in
+        which case we'd know from an OSR exit profile.
+        
+        This patch adds OSR exit profiling to all locals and arguments. Now, if we OSR
+        exit because of a mispredicted local or argument type, we'll know what the type of
+        the local or argument should be immediately upon exiting.
+        
+        The way that local variable OSR exit profiling works is that we now have a lazily
+        added set of OSR-exit-only value profiles for exit sites that are BadType and that
+        cited a GetLocal as their value source. The value profiles are only added if the
+        OSR exit is taken, and are keyed by CodeBlock, bytecode index of the GetLocal, and
+        operand. The look-up is performed by querying the
+        CompressedLazyOperandValueProfileHolder in the CodeBlock, using a key that contains
+        the bytecode index and the operand. Because the value profiles are added at random
+        times, they are not sorted; instead they are just stored in an arbitrarily-ordered
+        SegmentedVector. Look-ups are made fast by "decompressing": the DFG::ByteCodeParser
+        creates a LazyOperandValueProfileParser, which turns the
+        CompressedLazyOperandValueProfileHolder's contents into a HashMap for the duration
+        of DFG parsing.
+        
+        Previously, OSR exits had a pointer to the ValueProfile that had the specFailBucket
+        into which values observed during OSR exit would be placed. Now it uses a lazy
+        thunk for a ValueProfile. I call this the MethodOfGettingAValueProfile. It may
+        either contain a ValueProfile inside it (which works for previous uses of OSR exit
+        profiling) or it may just have knowledge of how to go about creating the
+        LazyOperandValueProfile in the case that the OSR exit is actually taken. This
+        ensures that we never have to create NumOperands*NumBytecodeIndices*NumCodeBlocks
+        value profiling buckets unless we actually did OSR exit on every single operand,
+        in every single instruction, in each code block (that's probably unlikely).
+        
+        This appears to be neutral on the major benchmarks, but is a double-digit speed-up
+        on code deliberately written to have data flow that spans basic blocks and where
+        the code exhibits post-optimization polymorphism in a local variable.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::lazyOperandValueProfiles):
+        * bytecode/LazyOperandValueProfile.cpp: Added.
+        (JSC):
+        (JSC::CompressedLazyOperandValueProfileHolder::CompressedLazyOperandValueProfileHolder):
+        (JSC::CompressedLazyOperandValueProfileHolder::~CompressedLazyOperandValueProfileHolder):
+        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
+        (JSC::CompressedLazyOperandValueProfileHolder::add):
+        (JSC::LazyOperandValueProfileParser::LazyOperandValueProfileParser):
+        (JSC::LazyOperandValueProfileParser::~LazyOperandValueProfileParser):
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        (JSC::LazyOperandValueProfileParser::prediction):
+        * bytecode/LazyOperandValueProfile.h: Added.
+        (JSC):
+        (LazyOperandValueProfileKey):
+        (JSC::LazyOperandValueProfileKey::LazyOperandValueProfileKey):
+        (JSC::LazyOperandValueProfileKey::operator!):
+        (JSC::LazyOperandValueProfileKey::operator==):
+        (JSC::LazyOperandValueProfileKey::hash):
+        (JSC::LazyOperandValueProfileKey::bytecodeOffset):
+        (JSC::LazyOperandValueProfileKey::operand):
+        (JSC::LazyOperandValueProfileKey::isHashTableDeletedValue):
+        (JSC::LazyOperandValueProfileKeyHash::hash):
+        (JSC::LazyOperandValueProfileKeyHash::equal):
+        (LazyOperandValueProfileKeyHash):
+        (WTF):
+        (JSC::LazyOperandValueProfile::LazyOperandValueProfile):
+        (LazyOperandValueProfile):
+        (JSC::LazyOperandValueProfile::key):
+        (CompressedLazyOperandValueProfileHolder):
+        (LazyOperandValueProfileParser):
+        * bytecode/MethodOfGettingAValueProfile.cpp: Added.
+        (JSC):
+        (JSC::MethodOfGettingAValueProfile::fromLazyOperand):
+        (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
+        * bytecode/MethodOfGettingAValueProfile.h: Added.
+        (JSC):
+        (MethodOfGettingAValueProfile):
+        (JSC::MethodOfGettingAValueProfile::MethodOfGettingAValueProfile):
+        (JSC::MethodOfGettingAValueProfile::operator!):
+        * bytecode/ValueProfile.cpp: Removed.
+        * bytecode/ValueProfile.h:
+        (JSC):
+        (ValueProfileBase):
+        (JSC::ValueProfileBase::ValueProfileBase):
+        (JSC::ValueProfileBase::dump):
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        (JSC::MinimalValueProfile::MinimalValueProfile):
+        (ValueProfileWithLogNumberOfBuckets):
+        (JSC::ValueProfileWithLogNumberOfBuckets::ValueProfileWithLogNumberOfBuckets):
+        (JSC::ValueProfile::ValueProfile):
+        (JSC::getValueProfileBytecodeOffset):
+        (JSC::getRareCaseProfileBytecodeOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::injectLazyOperandPrediction):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueProfileFor):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        (Graph):
+        * dfg/DFGNode.h:
+        (Node):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
+        (VariableAccessData):
+
+2012-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix.
+
+        * llint/LLIntOffsetsExtractor.cpp:
+
+2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, disable LLINT for now and fix ENABLE defines for it.
+
+        * llint/LLIntOffsetsExtractor.cpp:
+        * wtf/Platform.h:
+
+2012-02-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix for non-Mac wx builds.
+
+        * runtime/DatePrototype.cpp:
+
+2012-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG's logic for emitting a Flush is too convoluted and contains an inaccurate comment
+        https://bugs.webkit.org/show_bug.cgi?id=79334
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::flush):
+
+2012-02-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Object.isSealed / Object.isFrozen don't work for native objects
+        https://bugs.webkit.org/show_bug.cgi?id=79331
+
+        Reviewed by Sam Weinig.
+
+        Need to inspect all properties, including static ones.
+        This exposes a couple of bugs in Array & Arguments:
+            - getOwnPropertyDescriptor doesn't correctly report the writable attribute of array length.
+            - Arguments object's defineOwnProperty does not handle callee/caller/length correctly.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+            - Add handling for callee/caller/length.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyDescriptor):
+            - report length's writability correctly.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+            - Add spec-based implementation for non-final objects.
+
+2012-02-23  Gavin Barraclough  <barraclough@apple.com>
+
+        pop of array hole should get from the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=79338
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+            - If the fast fast vector case fails, more closely follow the spec.
+
+2012-02-23  Yong Li  <yoli@rim.com>
+
+        JSString::outOfMemory() should ASSERT(isRope()) rather than !isRope()
+        https://bugs.webkit.org/show_bug.cgi?id=79268
+
+        Reviewed by Michael Saboff.
+
+        resolveRope() is the only caller of outOfMemory(), and it calls outOfMemory()
+        after it fails to allocate a buffer for m_value. So outOfMemory() should assert
+        isRope() rather than !isRope().
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::outOfMemory):
+
+2012-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS macro
+        https://bugs.webkit.org/show_bug.cgi?id=79371
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt:
+        * shell/CMakeLists.txt:
+        * wtf/CMakeLists.txt:
+
+2012-02-23  Aron Rosenberg  <arosenberg@logitech.com>
+
+        Fix the PRI macros used in WTF::String formatters to be compatible with Qt and Visual Studio 2005 and newer.
+        https://bugs.webkit.org/show_bug.cgi?id=76210
+
+        Add compile time check for Visual Studio 2005 or newer.
+
+        Reviewed by Simon Hausmann.
+
+        * os-win32/inttypes.h:
+
+2012-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement [[DefineOwnProperty]] for the arguments object
+        https://bugs.webkit.org/show_bug.cgi?id=79309
+
+        Reviewed by Sam Weinig.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deletePropertyByIndex):
+        (JSC::Arguments::deleteProperty):
+            - Deleting an argument should also delete the copy on the object, if any.
+        (JSC::Arguments::defineOwnProperty):
+            - Defining a property may override the live mapping.
+        * runtime/Arguments.h:
+        (Arguments):
+
+2012-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix Object.freeze for non-final objects.
+        https://bugs.webkit.org/show_bug.cgi?id=79286
+
+        Reviewed by Oliver Hunt.
+
+        For vanilla objects we implement this with a single transition, for objects
+        with special properties we should just follow the spec defined algorithm.
+
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+            - this does need to handle inextensible objects.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+            - Implement spec defined algorithm for non-final objects.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::freezeTransition):
+            - freeze should set m_hasReadOnlyOrGetterSetterPropertiesExcludingProto.
+        * runtime/Structure.h:
+        (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+        (JSC::Structure::setContainsReadOnlyProperties):
+        (Structure):
+            - renamed m_hasReadOnlyOrGetterSetterPropertiesExcludingProto.
+
+2012-02-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Allocations from CopiedBlocks should always be 8-byte aligned
+        https://bugs.webkit.org/show_bug.cgi?id=79271
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/CopiedAllocator.h:
+        (JSC::CopiedAllocator::allocate):
+        * heap/CopiedBlock.h: Changed to add padding so that the start of the payload is always 
+        guaranteed to be 8 byte aligned on both 64- and 32-bit platforms.
+        (CopiedBlock):
+        * heap/CopiedSpace.cpp: Changed all assertions of isPointerAligned to is8ByteAligned.
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::getFreshBlock):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::allocateFromBlock):
+        * runtime/JSArray.h:
+        (ArrayStorage): Added padding for ArrayStorage to make sure that it is always 8 byte 
+        aligned on both 64- and 32-bit platforms.
+        * wtf/StdLibExtras.h:
+        (WTF::is8ByteAligned): Added new utility function that functions similarly to the 
+        way isPointerAligned does, but it just always checks for 8 byte alignment.
+        (WTF):
+
+2012-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108456.
+        http://trac.webkit.org/changeset/108456
+        https://bugs.webkit.org/show_bug.cgi?id=79223
+
+        Broke fast/regex/pcre-test-4.html and cannot find anyone on
+        IRC (Requested by zherczeg on #webkit).
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterGreedy):
+
+2012-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108468.
+        http://trac.webkit.org/changeset/108468
+        https://bugs.webkit.org/show_bug.cgi?id=79219
+
+        Broke Chromium Win release build (Requested by bashi on
+        #webkit).
+
+        * wtf/Platform.h:
+
+2012-02-22  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Added USE(ZLIB) flag.
+
+        Reviewed by Kent Tamura.
+
+        * wtf/Platform.h:
+
+2012-02-22  Hojong Han  <hojong.han@samsung.com>
+
+        Short circuit fixed for a 16 bt pattern character and an 8 bit string.
+        https://bugs.webkit.org/show_bug.cgi?id=75602
+
+        Reviewed by Gavin Barraclough.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterGreedy):
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for systems with case sensitive disks.
+
+        * llint/LLIntOfflineAsmConfig.h:
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+        
+        Implemented an interpreter that uses the JIT's calling convention. This
+        interpreter is called LLInt, or the Low Level Interpreter. JSC will now
+        will start by executing code in LLInt and will only tier up to the old
+        JIT after the code is proven hot.
+        
+        LLInt is written in a modified form of our macro assembly. This new macro
+        assembly is compiled by an offline assembler (see offlineasm), which
+        implements many modern conveniences such as a Turing-complete CPS-based
+        macro language and direct access to relevant C++ type information
+        (basically offsets of fields and sizes of structs/classes).
+        
+        Code executing in LLInt appears to the rest of the JSC world "as if" it
+        were executing in the old JIT. Hence, things like exception handling and
+        cross-execution-engine calls just work and require pretty much no
+        additional overhead.
+        
+        This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
+        V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
+        V8, and Kraken, but appear to get a double-digit improvement on real-world
+        websites due to a huge reduction in the amount of JIT'ing.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/LinkBuffer.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
+        * bytecode/BytecodeConventions.h: Added.
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC):
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::operator!):
+        (CallLinkStatus):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC):
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (JSC):
+        (CodeBlock):
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::jitCompile):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addLLIntCallLinkInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::numberOfMethodCallLinkInfos):
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::dontJITAnytimeSoon):
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::llintExecuteCounter):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::wasSeenInJIT):
+        (GetByIdStatus):
+        * bytecode/Instruction.h:
+        (JSC):
+        (JSC::Instruction::Instruction):
+        (Instruction):
+        * bytecode/LLIntCallLinkInfo.h: Added.
+        (JSC):
+        (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
+        (LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::isLinked):
+        (JSC::LLIntCallLinkInfo::unlink):
+        * bytecode/MethodCallLinkStatus.cpp:
+        (JSC::MethodCallLinkStatus::computeFor):
+        * bytecode/Opcode.cpp:
+        (JSC):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (PutByIdStatus):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.h:
+        (JSC):
+        (JSC::Heap::firstAllocatorWithoutDestructors):
+        (Heap):
+        * heap/MarkStack.cpp:
+        (JSC::visitChildren):
+        * heap/MarkedAllocator.h:
+        (JSC):
+        (MarkedAllocator):
+        * heap/MarkedSpace.h:
+        (JSC):
+        (MarkedSpace):
+        (JSC::MarkedSpace::firstAllocator):
+        * interpreter/CallFrame.cpp:
+        (JSC):
+        (JSC::CallFrame::bytecodeOffsetForNonDFGCode):
+        (JSC::CallFrame::setBytecodeOffsetForNonDFGCode):
+        (JSC::CallFrame::currentVPC):
+        (JSC::CallFrame::setCurrentVPC):
+        (JSC::CallFrame::trueCallerFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hasReturnPC):
+        (JSC::ExecState::clearReturnPC):
+        (ExecState):
+        (JSC::ExecState::bytecodeOffsetForNonDFGCode):
+        (JSC::ExecState::currentVPC):
+        (JSC::ExecState::setCurrentVPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::~Interpreter):
+        (JSC):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        (JSC::Interpreter::classicEnabled):
+        * interpreter/RegisterFile.h:
+        (JSC):
+        (RegisterFile):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        * jit/HostCallReturnValue.cpp: Added.
+        (JSC):
+        (JSC::getHostCallReturnValueWithExecState):
+        * jit/HostCallReturnValue.h: Added.
+        (JSC):
+        (JSC::initializeHostCallReturnValue):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITCode.h:
+        (JSC::JITCode::isOptimizingJIT):
+        (JITCode):
+        (JSC::JITCode::isBaselineCode):
+        (JSC::JITCode::JITCode):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITExceptions.cpp:
+        (JSC::jitThrow):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        (JSC):
+        * jit/JSInterfaceJIT.h:
+        * llint: Added.
+        * llint/LLIntCommon.h: Added.
+        * llint/LLIntData.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::Data::Data):
+        (JSC::LLInt::Data::performAssertions):
+        (JSC::LLInt::Data::~Data):
+        * llint/LLIntData.h: Added.
+        (JSC):
+        (LLInt):
+        (Data):
+        (JSC::LLInt::Data::exceptionInstructions):
+        (JSC::LLInt::Data::opcodeMap):
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntEntrypoints.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntEntrypoints.h: Added.
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::getEntrypoint):
+        * llint/LLIntExceptions.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrowForThrownException):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntExceptions.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LLIntOfflineAsmConfig.h: Added.
+        * llint/LLIntOffsetsExtractor.cpp: Added.
+        (JSC):
+        (LLIntOffsetsExtractor):
+        (JSC::LLIntOffsetsExtractor::dummy):
+        (main):
+        * llint/LLIntSlowPaths.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::llint_trace_operand):
+        (JSC::LLInt::llint_trace_value):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::shouldJIT):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::resolveGlobal):
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        (JSC::LLInt::genericCall):
+        * llint/LLIntSlowPaths.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LLIntThunks.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::generateThunkWithJumpTo):
+        (JSC::LLInt::functionForCallEntryThunkGenerator):
+        (JSC::LLInt::functionForConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
+        (JSC::LLInt::evalEntryThunkGenerator):
+        (JSC::LLInt::programEntryThunkGenerator):
+        * llint/LLIntThunks.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LowLevelInterpreter.asm: Added.
+        * llint/LowLevelInterpreter.cpp: Added.
+        * llint/LowLevelInterpreter.h: Added.
+        * offlineasm: Added.
+        * offlineasm/armv7.rb: Added.
+        * offlineasm/asm.rb: Added.
+        * offlineasm/ast.rb: Added.
+        * offlineasm/backends.rb: Added.
+        * offlineasm/generate_offset_extractor.rb: Added.
+        * offlineasm/instructions.rb: Added.
+        * offlineasm/offset_extractor_constants.rb: Added.
+        * offlineasm/offsets.rb: Added.
+        * offlineasm/opt.rb: Added.
+        * offlineasm/parser.rb: Added.
+        * offlineasm/registers.rb: Added.
+        * offlineasm/self_hash.rb: Added.
+        * offlineasm/settings.rb: Added.
+        * offlineasm/transform.rb: Added.
+        * offlineasm/x86.rb: Added.
+        * runtime/CodeSpecializationKind.h: Added.
+        (JSC):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        (CommonSlowPaths):
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+        (JSC):
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::samplingDescription):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC):
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h: Added.
+        (JSC):
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+        * runtime/JSArray.h:
+        (JSC):
+        (JSArray):
+        * runtime/JSCell.h:
+        (JSC):
+        (JSCell):
+        * runtime/JSFunction.h:
+        (JSC):
+        (JSFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.h:
+        (JSC):
+        (JSGlobalObject):
+        * runtime/JSObject.h:
+        (JSC):
+        (JSObject):
+        (JSFinalObject):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC):
+        (JSPropertyNameIterator):
+        * runtime/JSString.h:
+        (JSC):
+        (JSString):
+        * runtime/JSTypeInfo.h:
+        (JSC):
+        (TypeInfo):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/JSValue.h:
+        (LLInt):
+        (JSValue):
+        * runtime/JSVariableObject.h:
+        (JSC):
+        (JSVariableObject):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * runtime/ScopeChain.h:
+        (JSC):
+        (ScopeChainNode):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC):
+        (Structure):
+        * runtime/StructureChain.h:
+        (JSC):
+        (StructureChain):
+        * wtf/InlineASM.h:
+        * wtf/Platform.h:
+        * wtf/SentinelLinkedList.h:
+        (SentinelLinkedList):
+        (WTF::SentinelLinkedList::isEmpty):
+        * wtf/text/StringImpl.h:
+        (JSC):
+        (StringImpl):
+
+2012-02-21  Oliver Hunt  <oliver@apple.com>
+
+        Unbreak double-typed arrays on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=79177
+
+        Reviewed by Gavin Barraclough.
+
+        The existing code had completely broken address arithmetic.
+
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::storeFloat):
+
+2012-02-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Should be able to reconfigure a non-configurable property as read-only
+        https://bugs.webkit.org/show_bug.cgi?id=79170
+
+        Reviewed by Sam Weinig.
+
+        See ES5.1 8.12.9 10.a.i - the spec prohibits making a read-only property writable,
+        but does not inhibit making a writable property read-only.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::setInDefineOwnProperty):
+        (JSGlobalData):
+        (JSC::JSGlobalData::isInDefineOwnProperty):
+            - Added flag, tracking whether we are in JSObject::defineOwnProperty.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+        (DefineOwnPropertyScope):
+            - Always allow properties to be deleted by DefineOwnProperty - assume it knows what it is doing!
+        (JSC::DefineOwnPropertyScope::DefineOwnPropertyScope):
+        (JSC::DefineOwnPropertyScope::~DefineOwnPropertyScope):
+            - Added RAII helper.
+        (JSC::JSObject::defineOwnProperty):
+            - Track on the globalData when we are in this method.
+
+2012-02-21  Oliver Hunt  <oliver@apple.com>
+
+        Make TypedArrays be available in commandline jsc
+        https://bugs.webkit.org/show_bug.cgi?id=79163
+
+        Reviewed by Gavin Barraclough.
+
+        Adds a compile time option to have jsc support a basic implementation
+        of the TypedArrays available in WebCore.  This lets us test the typed
+        array logic in the JIT witout having to build webcore.
+
+        * JSCTypedArrayStubs.h: Added.
+        (JSC):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (GlobalObject):
+        (GlobalObject::addConstructableFunction):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2012-02-21  Tom Sepez  <tsepez@chromium.org>
+
+        equalIgnoringNullity() only comparing half the bytes for equality
+        https://bugs.webkit.org/show_bug.cgi?id=79135
+
+        Reviewed by Adam Barth.
+
+        * wtf/text/StringImpl.h:
+        (WTF::equalIgnoringNullity):
+
+2012-02-21  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
+
+        Unnecessary preprocessor macros in MainThread.h/cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79083
+
+        Removed invalid/wrong PLATFORM(WINDOWS) preprocessor macro.
+
+        * wtf/MainThread.cpp:
+        (WTF):
+        * wtf/MainThread.h:
+        (WTF):
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the Snow Leopard build.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Sam Weinig  <sam@webkit.org>
+
+        Use libc++ when building with Clang on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=78981
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2012-02-21  Adam Roben  <aroben@apple.com>
+
+        Roll out r108309, r108323, and r108326
+
+        They broke the 32-bit Lion build.
+
+        Original bugs is <http://webkit.org/b/75812> <rdar://problem/10079694>.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/LinkBuffer.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecode/BytecodeConventions.h: Removed.
+        * bytecode/CallLinkStatus.cpp:
+        * bytecode/CallLinkStatus.h:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        * bytecode/GetByIdStatus.h:
+        * bytecode/Instruction.h:
+        * bytecode/LLIntCallLinkInfo.h: Removed.
+        * bytecode/MethodCallLinkStatus.cpp:
+        * bytecode/Opcode.cpp:
+        * bytecode/Opcode.h:
+        * bytecode/PutByIdStatus.cpp:
+        * bytecode/PutByIdStatus.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.h:
+        * heap/MarkStack.cpp:
+        * heap/MarkedAllocator.h:
+        * heap/MarkedSpace.h:
+        * interpreter/CallFrame.cpp:
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+        * interpreter/RegisterFile.h:
+        * jit/ExecutableAllocator.h:
+        * jit/HostCallReturnValue.cpp: Removed.
+        * jit/HostCallReturnValue.h: Removed.
+        * jit/JIT.cpp:
+        * jit/JITCode.h:
+        * jit/JITDriver.h:
+        * jit/JITExceptions.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+        * llint/LLIntCommon.h: Removed.
+        * llint/LLIntData.cpp: Removed.
+        * llint/LLIntData.h: Removed.
+        * llint/LLIntEntrypoints.cpp: Removed.
+        * llint/LLIntEntrypoints.h: Removed.
+        * llint/LLIntExceptions.cpp: Removed.
+        * llint/LLIntExceptions.h: Removed.
+        * llint/LLIntOfflineAsmConfig.h: Removed.
+        * llint/LLIntOffsetsExtractor.cpp: Removed.
+        * llint/LLIntSlowPaths.cpp: Removed.
+        * llint/LLIntSlowPaths.h: Removed.
+        * llint/LLIntThunks.cpp: Removed.
+        * llint/LLIntThunks.h: Removed.
+        * llint/LowLevelInterpreter.asm: Removed.
+        * llint/LowLevelInterpreter.cpp: Removed.
+        * llint/LowLevelInterpreter.h: Removed.
+        * offlineasm/armv7.rb: Removed.
+        * offlineasm/asm.rb: Removed.
+        * offlineasm/ast.rb: Removed.
+        * offlineasm/backends.rb: Removed.
+        * offlineasm/generate_offset_extractor.rb: Removed.
+        * offlineasm/instructions.rb: Removed.
+        * offlineasm/offset_extractor_constants.rb: Removed.
+        * offlineasm/offsets.rb: Removed.
+        * offlineasm/opt.rb: Removed.
+        * offlineasm/parser.rb: Removed.
+        * offlineasm/registers.rb: Removed.
+        * offlineasm/self_hash.rb: Removed.
+        * offlineasm/settings.rb: Removed.
+        * offlineasm/transform.rb: Removed.
+        * offlineasm/x86.rb: Removed.
+        * runtime/CodeSpecializationKind.h: Removed.
+        * runtime/CommonSlowPaths.h:
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        * runtime/ExecutionHarness.h: Removed.
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSString.h:
+        * runtime/JSTypeInfo.h:
+        * runtime/JSValue.cpp:
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+        * runtime/Options.cpp:
+        * runtime/Options.h:
+        * runtime/ScopeChain.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        * runtime/StructureChain.h:
+        * wtf/InlineASM.h:
+        * wtf/Platform.h:
+        * wtf/SentinelLinkedList.h:
+        * wtf/text/StringImpl.h:
+
+2012-02-21  Gustavo Noronha Silva  <kov@debian.org> and Bob Tracy  <rct@frus.com>
+
+        Does not build on IA64, SPARC and Alpha
+        https://bugs.webkit.org/show_bug.cgi?id=79047
+
+        Rubber-stamped by Kent Tamura.
+
+        * wtf/dtoa/utils.h: these architectures also have correct double
+        operations, so add them to the appropriate side of the check.
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix massive crashes in all tests introduced by previous build fix, and fix non-DFG build.
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+
+        Reviewed by Csaba Osztrogonác.
+
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        * jit/HostCallReturnValue.h:
+        (JSC::initializeHostCallReturnValue):
+
+2012-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempted build fix for ELF platforms.
+
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        (JSC::getHostCallReturnValueWithExecState):
+        * jit/HostCallReturnValue.cpp:
+        (JSC):
+        * jit/HostCallReturnValue.h:
+        (JSC::initializeHostCallReturnValue):
+
+2012-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be a triple-tier VM
+        https://bugs.webkit.org/show_bug.cgi?id=75812
+        <rdar://problem/10079694>
+
+        Reviewed by Gavin Barraclough.
+        
+        Implemented an interpreter that uses the JIT's calling convention. This
+        interpreter is called LLInt, or the Low Level Interpreter. JSC will now
+        will start by executing code in LLInt and will only tier up to the old
+        JIT after the code is proven hot.
+        
+        LLInt is written in a modified form of our macro assembly. This new macro
+        assembly is compiled by an offline assembler (see offlineasm), which
+        implements many modern conveniences such as a Turing-complete CPS-based
+        macro language and direct access to relevant C++ type information
+        (basically offsets of fields and sizes of structs/classes).
+        
+        Code executing in LLInt appears to the rest of the JSC world "as if" it
+        were executing in the old JIT. Hence, things like exception handling and
+        cross-execution-engine calls just work and require pretty much no
+        additional overhead.
+        
+        This interpreter is 2-2.5x faster than our old interpreter on SunSpider,
+        V8, and Kraken. With triple-tiering turned on, we're neutral on SunSpider,
+        V8, and Kraken, but appear to get a double-digit improvement on real-world
+        websites due to a huge reduction in the amount of JIT'ing.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/LinkBuffer.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        (MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::createFromExecutableAddress):
+        * bytecode/BytecodeConventions.h: Added.
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC):
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::operator!):
+        (CallLinkStatus):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC):
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (JSC):
+        (CodeBlock):
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::jitCompile):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addLLIntCallLinkInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::numberOfMethodCallLinkInfos):
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::dontJITAnytimeSoon):
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::llintExecuteCounter):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::wasSeenInJIT):
+        (GetByIdStatus):
+        * bytecode/Instruction.h:
+        (JSC):
+        (JSC::Instruction::Instruction):
+        (Instruction):
+        * bytecode/LLIntCallLinkInfo.h: Added.
+        (JSC):
+        (JSC::LLIntCallLinkInfo::LLIntCallLinkInfo):
+        (LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::isLinked):
+        (JSC::LLIntCallLinkInfo::unlink):
+        * bytecode/MethodCallLinkStatus.cpp:
+        (JSC::MethodCallLinkStatus::computeFor):
+        * bytecode/Opcode.cpp:
+        (JSC):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (PutByIdStatus):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.h:
+        (JSC):
+        (JSC::Heap::firstAllocatorWithoutDestructors):
+        (Heap):
+        * heap/MarkStack.cpp:
+        (JSC::visitChildren):
+        * heap/MarkedAllocator.h:
+        (JSC):
+        (MarkedAllocator):
+        * heap/MarkedSpace.h:
+        (JSC):
+        (MarkedSpace):
+        (JSC::MarkedSpace::firstAllocator):
+        * interpreter/CallFrame.cpp:
+        (JSC):
+        (JSC::CallFrame::bytecodeOffsetForNonDFGCode):
+        (JSC::CallFrame::setBytecodeOffsetForNonDFGCode):
+        (JSC::CallFrame::currentVPC):
+        (JSC::CallFrame::setCurrentVPC):
+        (JSC::CallFrame::trueCallerFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hasReturnPC):
+        (JSC::ExecState::clearReturnPC):
+        (ExecState):
+        (JSC::ExecState::bytecodeOffsetForNonDFGCode):
+        (JSC::ExecState::currentVPC):
+        (JSC::ExecState::setCurrentVPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::~Interpreter):
+        (JSC):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        (JSC::Interpreter::classicEnabled):
+        * interpreter/RegisterFile.h:
+        (JSC):
+        (RegisterFile):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        * jit/HostCallReturnValue.cpp: Added.
+        (JSC):
+        (JSC::getHostCallReturnValueWithExecState):
+        * jit/HostCallReturnValue.h: Added.
+        (JSC):
+        (JSC::initializeHostCallReturnValue):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITCode.h:
+        (JSC::JITCode::isOptimizingJIT):
+        (JITCode):
+        (JSC::JITCode::isBaselineCode):
+        (JSC::JITCode::JITCode):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITExceptions.cpp:
+        (JSC::jitThrow):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        (JSC):
+        * jit/JSInterfaceJIT.h:
+        * llint: Added.
+        * llint/LLIntCommon.h: Added.
+        * llint/LLIntData.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::Data::Data):
+        (JSC::LLInt::Data::performAssertions):
+        (JSC::LLInt::Data::~Data):
+        * llint/LLIntData.h: Added.
+        (JSC):
+        (LLInt):
+        (Data):
+        (JSC::LLInt::Data::exceptionInstructions):
+        (JSC::LLInt::Data::opcodeMap):
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntEntrypoints.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntEntrypoints.h: Added.
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::getEntrypoint):
+        * llint/LLIntExceptions.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrowForThrownException):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntExceptions.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LLIntOfflineAsmConfig.h: Added.
+        * llint/LLIntOffsetsExtractor.cpp: Added.
+        (JSC):
+        (LLIntOffsetsExtractor):
+        (JSC::LLIntOffsetsExtractor::dummy):
+        (main):
+        * llint/LLIntSlowPaths.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::llint_trace_operand):
+        (JSC::LLInt::llint_trace_value):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::shouldJIT):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::resolveGlobal):
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        (JSC::LLInt::genericCall):
+        * llint/LLIntSlowPaths.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LLIntThunks.cpp: Added.
+        (LLInt):
+        (JSC::LLInt::generateThunkWithJumpTo):
+        (JSC::LLInt::functionForCallEntryThunkGenerator):
+        (JSC::LLInt::functionForConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
+        (JSC::LLInt::evalEntryThunkGenerator):
+        (JSC::LLInt::programEntryThunkGenerator):
+        * llint/LLIntThunks.h: Added.
+        (JSC):
+        (LLInt):
+        * llint/LowLevelInterpreter.asm: Added.
+        * llint/LowLevelInterpreter.cpp: Added.
+        * llint/LowLevelInterpreter.h: Added.
+        * offlineasm: Added.
+        * offlineasm/armv7.rb: Added.
+        * offlineasm/asm.rb: Added.
+        * offlineasm/ast.rb: Added.
+        * offlineasm/backends.rb: Added.
+        * offlineasm/generate_offset_extractor.rb: Added.
+        * offlineasm/instructions.rb: Added.
+        * offlineasm/offset_extractor_constants.rb: Added.
+        * offlineasm/offsets.rb: Added.
+        * offlineasm/opt.rb: Added.
+        * offlineasm/parser.rb: Added.
+        * offlineasm/registers.rb: Added.
+        * offlineasm/self_hash.rb: Added.
+        * offlineasm/settings.rb: Added.
+        * offlineasm/transform.rb: Added.
+        * offlineasm/x86.rb: Added.
+        * runtime/CodeSpecializationKind.h: Added.
+        (JSC):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        (CommonSlowPaths):
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+        (JSC):
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::samplingDescription):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC):
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h: Added.
+        (JSC):
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+        * runtime/JSArray.h:
+        (JSC):
+        (JSArray):
+        * runtime/JSCell.h:
+        (JSC):
+        (JSCell):
+        * runtime/JSFunction.h:
+        (JSC):
+        (JSFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.h:
+        (JSC):
+        (JSGlobalObject):
+        * runtime/JSObject.h:
+        (JSC):
+        (JSObject):
+        (JSFinalObject):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC):
+        (JSPropertyNameIterator):
+        * runtime/JSString.h:
+        (JSC):
+        (JSString):
+        * runtime/JSTypeInfo.h:
+        (JSC):
+        (TypeInfo):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/JSValue.h:
+        (LLInt):
+        (JSValue):
+        * runtime/JSVariableObject.h:
+        (JSC):
+        (JSVariableObject):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * runtime/ScopeChain.h:
+        (JSC):
+        (ScopeChainNode):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC):
+        (Structure):
+        * runtime/StructureChain.h:
+        (JSC):
+        (StructureChain):
+        * wtf/InlineASM.h:
+        * wtf/Platform.h:
+        * wtf/SentinelLinkedList.h:
+        (SentinelLinkedList):
+        (WTF::SentinelLinkedList::isEmpty):
+        * wtf/text/StringImpl.h:
+        (JSC):
+        (StringImpl):
+
+2012-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, rolling out http://trac.webkit.org/changeset/108291
+        It completely broke the 32-bit JIT.
+
+        * heap/CopiedAllocator.h:
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/Heap.h:
+        (JSC::Heap::allocatorForObjectWithDestructor):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+        (JSC):
+        * runtime/JSArray.h:
+        (ArrayStorage):
+        (JSArray):
+
+2012-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        [[Put]] should throw if prototype chain contains a readonly property.
+        https://bugs.webkit.org/show_bug.cgi?id=79069
+
+        Reviewed by Oliver Hunt.
+
+        Currently we only check the base of the put, not the prototype chain.
+        Fold this check in with the test for accessors.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Updated to test all objects in the propotype chain for readonly properties.
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::putDescriptor):
+            - Record the presence of readonly properties on the structure.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            - hasGetterSetterPropertiesExcludingProto expanded to hasReadOnlyOrGetterSetterPropertiesExcludingProto.
+        * runtime/Structure.h:
+        (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+            - hasGetterSetterPropertiesExcludingProto expanded to hasReadOnlyOrGetterSetterPropertiesExcludingProto.
+        (JSC::Structure::setContainsReadOnlyProperties):
+            - Added.
+
+2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Implement fast path for op_new_array in the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=78612
+
+        Reviewed by Filip Pizlo.
+
+        * heap/CopiedAllocator.h:
+        (CopiedAllocator): Friended the JIT to allow access to m_currentOffset.
+        * heap/CopiedSpace.h:
+        (CopiedSpace): Friended the JIT to allow access to 
+        (JSC::CopiedSpace::allocator):
+        * heap/Heap.h:
+        (JSC::Heap::storageAllocator): Added a getter for the CopiedAllocator class so the JIT
+        can use it for simple allocation i.e. when we can just bump the offset without having to 
+        do anything else.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases): Added new slow case for op_new_array for when
+        we have to bail out because the fast allocation path fails for whatever reason.
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicStorage): Added utility function that allows objects to 
+        allocate generic backing stores. This function is used by emitAllocateJSArray.
+        (JSC):
+        (JSC::JIT::emitAllocateJSArray): Added utility function that allows the client to 
+        more easily allocate JSArrays. This function is used by emit_op_new_array and I expect 
+        it will also be used for emit_op_new_array_buffer.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array): Changed to do inline allocation of JSArrays. Still does 
+        a stub call for oversize arrays.
+        (JSC):
+        (JSC::JIT::emitSlow_op_new_array): Just bails out to a stub call if we fail in any way on 
+        the fast path.
+        * runtime/JSArray.cpp:
+        (JSC):
+        * runtime/JSArray.h: Added lots of offset functions for all the fields that we need to 
+        initialize in the JIT.
+        (ArrayStorage):
+        (JSC::ArrayStorage::lengthOffset):
+        (JSC::ArrayStorage::numValuesInVectorOffset):
+        (JSC::ArrayStorage::allocBaseOffset):
+        (JSC::ArrayStorage::vectorOffset):
+        (JSArray):
+        (JSC::JSArray::sparseValueMapOffset):
+        (JSC::JSArray::subclassDataOffset):
+        (JSC::JSArray::indexBiasOffset):
+        (JSC):
+        (JSC::JSArray::storageSize): Moved this function from being a static function in the cpp file
+        to being a static function in the JSArray class. This move allows the JIT to call it to 
+        see what size it should allocate.
+
+2012-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        DefineOwnProperty fails with numeric properties & Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=79059
+
+        Reviewed by Oliver Hunt.
+
+        ObjectPrototype caches whether it contains any numeric properties (m_hasNoPropertiesWithUInt32Names),
+        calls to defineOwnProperty need to update this cache.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put):
+        (JSC::ObjectPrototype::defineOwnProperty):
+        (JSC):
+        (JSC::ObjectPrototype::getOwnPropertySlotByIndex):
+        * runtime/ObjectPrototype.h:
+        (ObjectPrototype):
+
+2012-02-20  Pino Toscano  <pino@debian.org>
+
+        Does not build on GNU Hurd
+        https://bugs.webkit.org/show_bug.cgi?id=79045
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * wtf/Platform.h: define WTF_OS_HURD.
+        * wtf/ThreadIdentifierDataPthreads.cpp: adds a band-aid fix
+        for the lack of PTHREAD_KEYS_MAX definition, with a value which
+        should not cause issues.
+
+2012-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Undoing accidental changes
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+
+2012-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Factor out allocation in CopySpace into a separate CopyAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=78610
+
+        Reviewed by Oliver Hunt.
+
+        Added a new CopyAllocator class, which allows us to do allocations without 
+        having to load the current offset and store the current offset in the current 
+        block. This change will allow us to easily do inline assembly in the JIT for 
+        array allocations.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopiedAllocator.h: Added.
+        (JSC):
+        (CopiedAllocator):
+        (JSC::CopiedAllocator::currentBlock):
+        (JSC::CopiedAllocator::CopiedAllocator):
+        (JSC::CopiedAllocator::allocate):
+        (JSC::CopiedAllocator::fitsInCurrentBlock):
+        (JSC::CopiedAllocator::wasLastAllocation):
+        (JSC::CopiedAllocator::startedCopying):
+        (JSC::CopiedAllocator::resetCurrentBlock):
+        (JSC::CopiedAllocator::currentUtilization):
+        (JSC::CopiedAllocator::resetLastAllocation):
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+        * heap/CopiedSpace.cpp: Moved some stuff from CopiedSpaceInlineMethods to here because we 
+        weren't really getting any benefits from having such big functions in a header file.
+        (JSC::CopiedSpace::CopiedSpace):
+        (JSC):
+        (JSC::CopiedSpace::init):
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocate):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::getFreshBlock):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC):
+        (JSC::CopiedSpace::startedCopying):
+        (JSC::CopiedSpace::addNewBlock):
+        (JSC::CopiedSpace::allocateNewBlock):
+        (JSC::CopiedSpace::fitsInBlock):
+        (JSC::CopiedSpace::tryAllocate):
+        (JSC::CopiedSpace::allocateFromBlock):
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        * heap/HeapBlock.h:
+        (HeapBlock):
+
+2012-02-20  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix Visual Studio 2010 build.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+
+2012-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Move special __proto__ property to Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=78409
+
+        Reviewed by Oliver Hunt.
+
+        Re-implement this as a regular accessor property.  This has three key benefits:
+        1) It makes it possible for objects to be given properties named __proto__.
+        2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
+        3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+            - No need to prohibit functions named __proto__.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            - Add __proto__ accessor to Object.prototype.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+            - Definition of the __proto__ accessor functions.
+        * runtime/JSGlobalObjectFunctions.h:
+            - Declaration of the __proto__ accessor functions.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Remove the special handling for __proto__, there is still a check to allow for a fast guard for accessors excluding __proto__.
+        (JSC::JSObject::putDirectAccessor):
+            - Track on the structure whether an object contains accessors other than one for __proto__.
+        (JSC::JSObject::defineOwnProperty):
+            - No need to prohibit definition of own properties named __proto__.
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+            - Remove the special handling for __proto__.
+        (JSC::JSValue::get):
+            - Remove the special handling for __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+            - Remove the special handling for __proto__.
+        * runtime/JSValue.h:
+        (JSValue):
+            - Made synthesizePrototype public (this may be needed by the __proto__ getter).
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+            - Perform the security check & call prototype() directly.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
+        * runtime/Structure.h:
+        (JSC::Structure::hasGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+        (Structure):
+            - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
+
+2012-02-20  Michael Saboff  <msaboff@apple.com>
+
+        Update toLower and toUpper tests for Unicode 6.1 changes
+        https://bugs.webkit.org/show_bug.cgi?id=78923
+
+        Reviewed by Oliver Hunt.
+
+        * tests/mozilla/ecma/String/15.5.4.11-2.js: Updated the test
+        to handle a third set of results for updated Unicode 6.1
+        changes.
+        (getTestCases):
+        (TestCaseMultiExpected):
+        (writeTestCaseResultMultiExpected):
+        (getTestCaseResultMultiExpected):
+        (test):
+        (GetUnicodeValues):
+        (DecimalToHexString):
+
+2012-02-20  Andy Wingo  <wingo@igalia.com>
+
+        Remove unused features from CodeFeatures
+        https://bugs.webkit.org/show_bug.cgi?id=78804
+
+        Reviewed by Gavin Barraclough.
+
+        * parser/Nodes.h:
+        * parser/ASTBuilder.h:
+        (JSC::ClosureFeature):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::usesClosures):
+        Remove "ClosureFeature".  Since we track captured variables more
+        precisely, this bit doesn't do us any good.
+
+        (JSC::AssignFeature):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        (JSC::ASTBuilder::usesAssignment):
+        Similarly, remove AssignFeature.  It is unused.
+
+2012-02-19  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix style issues in DFG Phase classes
+        https://bugs.webkit.org/show_bug.cgi?id=78983
+
+        Reviewed by Ryosuke Niwa.
+
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp:
+        * dfg/DFGCFAPhase.cpp:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        Add a space before the colon in class declarations.
+
+2012-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-18  Sam Weinig  <sam@webkit.org>
+
+        Fix the libc++ build.
+
+        Reviewed by Anders Carlsson.
+
+        * heap/Weak.h:
+        Libc++'s nullptr emulation does not allow default construction
+        of the nullptr_t type. Work around this with the arguably clearer
+        just returning nullptr.
+
+2012-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGPropagator.cpp has too many things
+        https://bugs.webkit.org/show_bug.cgi?id=78956
+
+        Reviewed by Oliver Hunt.
+        
+        Added the notion of a DFG::Phase. Removed DFG::Propagator, and took its
+        various things and put them into separate files. These new phases follow
+        the naming convention "DFG<name>Phase" where <name> is a noun. They are
+        called via functions of the form "perform<name>".
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArithNodeFlagsInferencePhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performArithNodeFlagsInference):
+        * dfg/DFGArithNodeFlagsInferencePhase.h: Added.
+        (DFG):
+        * dfg/DFGCFAPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performCFA):
+        * dfg/DFGCFAPhase.h: Added.
+        (DFG):
+        * dfg/DFGCSEPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performCSE):
+        * dfg/DFGCSEPhase.h: Added.
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        * dfg/DFGPhase.h: Added.
+        (DFG):
+        (Phase):
+        (JSC::DFG::Phase::Phase):
+        (JSC::DFG::Phase::~Phase):
+        (JSC::DFG::Phase::globalData):
+        (JSC::DFG::Phase::codeBlock):
+        (JSC::DFG::Phase::profiledBlock):
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        (JSC::DFG::runPhase):
+        * dfg/DFGPredictionPropagationPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performPredictionPropagation):
+        * dfg/DFGPredictionPropagationPhase.h: Added.
+        (DFG):
+        * dfg/DFGPropagator.cpp: Removed.
+        * dfg/DFGPropagator.h: Removed.
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp: Added.
+        (DFG):
+        (JSC::DFG::performVirtualRegisterAllocation):
+        * dfg/DFGVirtualRegisterAllocationPhase.h: Added.
+        (DFG):
+
+2012-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Graph should have references to JSGlobalData, the CodeBlock being compiled, and
+        the CodeBlock that was used for profiling
+        https://bugs.webkit.org/show_bug.cgi?id=78954
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.h:
+        (JSC::baselineCodeBlockForOriginAndBaselineCodeBlock):
+        (JSC):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractState.h:
+        * dfg/DFGAssemblyHelpers.h:
+        (AssemblyHelpers):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::parse):
+        * dfg/DFGByteCodeParser.h:
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::Graph):
+        (Graph):
+        (JSC::DFG::Graph::getJSConstantPrediction):
+        (JSC::DFG::Graph::addShouldSpeculateInteger):
+        (JSC::DFG::Graph::isInt32Constant):
+        (JSC::DFG::Graph::isDoubleConstant):
+        (JSC::DFG::Graph::isNumberConstant):
+        (JSC::DFG::Graph::isBooleanConstant):
+        (JSC::DFG::Graph::isFunctionConstant):
+        (JSC::DFG::Graph::valueOfJSConstant):
+        (JSC::DFG::Graph::valueOfInt32Constant):
+        (JSC::DFG::Graph::valueOfNumberConstant):
+        (JSC::DFG::Graph::valueOfBooleanConstant):
+        (JSC::DFG::Graph::valueOfFunctionConstant):
+        (JSC::DFG::Graph::baselineCodeBlockFor):
+        (JSC::DFG::Graph::valueProfileFor):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JITCompiler):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::Propagator):
+        (JSC::DFG::Propagator::isNotNegZero):
+        (JSC::DFG::Propagator::isNotZero):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::doRoundOfDoubleVoting):
+        (JSC::DFG::Propagator::globalCFA):
+        (JSC::DFG::propagate):
+        * dfg/DFGPropagator.h:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isConstant):
+        (JSC::DFG::SpeculativeJIT::isJSConstant):
+        (JSC::DFG::SpeculativeJIT::isInt32Constant):
+        (JSC::DFG::SpeculativeJIT::isDoubleConstant):
+        (JSC::DFG::SpeculativeJIT::isNumberConstant):
+        (JSC::DFG::SpeculativeJIT::isBooleanConstant):
+        (JSC::DFG::SpeculativeJIT::isFunctionConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):
+        (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfJSConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+
+2012-02-17  Ahmad Sharif  <asharif.tools@gmail.com>
+
+        There is a warning in memset in glibc that gets triggered through a
+        warndecl when the fill-value of memset is a non-zero constant and the
+        size is zero. This warning is enabled when building with
+        -D_FORTIFY_SOURCE=2. This patch fixes the warning.
+
+        https://bugs.webkit.org/show_bug.cgi?id=78513
+
+        Reviewed by Alexey Proskuryakov
+
+        * wtf/Vector.h:
+
+2012-02-17  Kalev Lember  <kalevlember@gmail.com>
+
+        Remove unused parameters from WTF threading API
+        https://bugs.webkit.org/show_bug.cgi?id=78389
+
+        Reviewed by Adam Roben.
+
+        waitForThreadCompletion() had an out param 'void **result' to get the
+        'void *' returned by ThreadFunction. However, the implementation in
+        ThreadingWin.cpp ignored the out param, not filling it in. This had
+        led to a situation where none of the client code made use of the param
+        and just ignored it.
+
+        To clean this up, the patch changes the signature of ThreadFunction to
+        return void instead of void* and drops the the unused 'void **result'
+        parameter from waitForThreadCompletion. Also, all client code is
+        updated for the API change.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=78389 , even
+        though the change only affects internal API, Safari is using it
+        directly and we'll need to keep the old versions around for ABI
+        compatibility. For this, the patch adds compatibility wrappers with
+        the old ABI.
+
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::threadStartFunc):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        (SamplingThread):
+        * heap/Heap.cpp:
+        (JSC::Heap::~Heap):
+        (JSC::Heap::blockFreeingThreadStartFunc):
+        * heap/Heap.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
+        (JSC::MarkStackThreadSharedData::~MarkStackThreadSharedData):
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        * wtf/ParallelJobsGeneric.cpp:
+        (WTF::ParallelEnvironment::ThreadPrivate::workerThread):
+        * wtf/ParallelJobsGeneric.h:
+        (ThreadPrivate):
+        * wtf/ThreadFunctionInvocation.h: Update the signature of
+        ThreadFunction.
+        (WTF):
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint): Update for ThreadFunction signature change.
+        (WTF):
+        (WTF::ThreadFunctionWithReturnValueInvocation::ThreadFunctionWithReturnValueInvocation):
+        ABI compatibility function for Safari.
+        (ThreadFunctionWithReturnValueInvocation): Ditto.
+        (WTF::compatEntryPoint): Ditto.
+        (WTF::createThread): Ditto.
+        (WTF::waitForThreadCompletion): Ditto.
+        * wtf/Threading.h: Update the signature of ThreadFunction and
+        waitForThreadCompletion.
+        (WTF):
+        * wtf/ThreadingPthreads.cpp: Implement the new API.
+        (WTF::wtfThreadEntryPoint):
+        (WTF):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        * wtf/ThreadingWin.cpp: Implement the new API.
+        (WTF::wtfThreadEntryPoint):
+        (WTF::waitForThreadCompletion):
+
+2012-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Implement Error.stack
+        https://bugs.webkit.org/show_bug.cgi?id=66994
+
+        Reviewed by Gavin Barraclough.
+
+        Implement support for stack traces on exception objects.  This is a rewrite
+        of the core portion of the last stack walking logic, but the mechanical work
+        of adding the information to an exception comes from the original work by
+        Juan Carlos Montemayor Elosua.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        (JSC):
+        (JSC::getSourceURLFromCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (StackFrame):
+        (JSC::StackFrame::toString):
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionJSCStack):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setInferredName):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+        (JSC):
+
+2012-02-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename Bump* to Copy*
+        https://bugs.webkit.org/show_bug.cgi?id=78573
+
+        Reviewed by Geoffrey Garen.
+
+        Renamed anything with "Bump" in the name to have "Copied" instead.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/BumpBlock.h: Removed.
+        * heap/BumpSpace.cpp: Removed.
+        * heap/BumpSpace.h: Removed.
+        * heap/BumpSpaceInlineMethods.h: Removed.
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::genericAddPointer):
+        * heap/ConservativeRoots.h:
+        (ConservativeRoots):
+        * heap/CopiedBlock.h: Added.
+        (JSC):
+        (CopiedBlock):
+        (JSC::CopiedBlock::CopiedBlock):
+        * heap/CopiedSpace.cpp: Added.
+        (JSC):
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/CopiedSpace.h: Added.
+        (JSC):
+        (CopiedSpace):
+        (JSC::CopiedSpace::isInCopyPhase):
+        (JSC::CopiedSpace::totalMemoryAllocated):
+        (JSC::CopiedSpace::totalMemoryUtilized):
+        * heap/CopiedSpaceInlineMethods.h: Added.
+        (JSC):
+        (JSC::CopiedSpace::CopiedSpace):
+        (JSC::CopiedSpace::init):
+        (JSC::CopiedSpace::contains):
+        (JSC::CopiedSpace::pin):
+        (JSC::CopiedSpace::startedCopying):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::recycleBlock):
+        (JSC::CopiedSpace::getFreshBlock):
+        (JSC::CopiedSpace::borrowBlock):
+        (JSC::CopiedSpace::addNewBlock):
+        (JSC::CopiedSpace::allocateNewBlock):
+        (JSC::CopiedSpace::fitsInBlock):
+        (JSC::CopiedSpace::fitsInCurrentBlock):
+        (JSC::CopiedSpace::tryAllocate):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::allocateFromBlock):
+        (JSC::CopiedSpace::tryReallocate):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::isOversize):
+        (JSC::CopiedSpace::isPinned):
+        (JSC::CopiedSpace::oversizeBlockFor):
+        (JSC::CopiedSpace::blockFor):
+        * heap/Heap.cpp:
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::startCopying):
+        (JSC::SlotVisitor::allocateNewSpace):
+        (JSC::SlotVisitor::doneCopying):
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        * heap/SlotVisitor.h:
+        (SlotVisitor):
+        * runtime/JSArray.cpp:
+        * runtime/JSObject.cpp:
+
+2012-02-16  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Add JSC code profiling support on Linux x86
+        https://bugs.webkit.org/show_bug.cgi?id=78871
+
+        Reviewed by Gavin Barraclough.
+
+        We don't unwind the stack for now as we cannot guarantee all the
+        libraries are compiled without -fomit-frame-pointer.
+
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::sample):
+        * tools/CodeProfiling.cpp:
+        (JSC):
+        (JSC::profilingTimer):
+        (JSC::CodeProfiling::begin):
+        (JSC::CodeProfiling::end):
+
+2012-02-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed. Rolling out r107980, because it broke 32 bit platforms.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setInferredName):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+        (JSC):
+
+2012-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        ENABLE_INTERPRETER should be ENABLE_CLASSIC_INTERPRETER
+        https://bugs.webkit.org/show_bug.cgi?id=78791
+
+        Rubber stamped by Oliver Hunt.
+        
+        Just a renaming, nothing more. Also renamed COMPUTED_GOTO_INTERPRETER to
+        COMPUTED_GOTO_CLASSIC_INTERPRETER.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/AbstractPC.h:
+        (AbstractPC):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        (Interpreter):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (NativeExecutable):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+        * wtf/Platform.h:
+
+2012-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Made Weak<T> single-owner, adding PassWeak<T>
+        https://bugs.webkit.org/show_bug.cgi?id=78740
+
+        Reviewed by Sam Weinig.
+
+        This works basically the same way as OwnPtr<T> and PassOwnPtr<T>.
+
+        This clarifies the semantics of finalizers: It's ambiguous and probably
+        a bug to copy a finalizer (i.e., it's a bug to run a C++ destructor
+        twice), so I've made Weak<T> non-copyable. Anywhere we used to copy a 
+        Weak<T>, we now use PassWeak<T>.
+
+        This also makes Weak<T> HashMaps more efficient.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype): Use PassWeak<T> instead of set(), since 
+        set() is gone now.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Export!
+
+        * heap/PassWeak.h: Added.
+        (JSC):
+        (PassWeak):
+        (JSC::PassWeak::PassWeak):
+        (JSC::PassWeak::~PassWeak):
+        (JSC::PassWeak::get):
+        (JSC::::leakHandle):
+        (JSC::adoptWeak):
+        (JSC::operator==):
+        (JSC::operator!=): This is the Weak<T> version of PassOwnPtr<T>.
+
+        * heap/Weak.h:
+        (Weak):
+        (JSC::Weak::Weak):
+        (JSC::Weak::release):
+        (JSC::Weak::hashTableDeletedValue):
+        (JSC::=):
+        (JSC): Changed to be non-copyable, removing a lot of copying-related
+        APIs. Added hash traits so hash maps still work.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate): Use PassWeak<T>, as required by
+        our new hash map API.
+
+2012-02-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the broken viewport tests
+        https://bugs.webkit.org/show_bug.cgi?id=78774
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/WTFString.cpp:
+        (WTF):
+        (WTF::toDoubleType): Template-ized to allow other functions to specify whether they
+        want to allow trailing junk or not when calling strtod.
+        (WTF::charactersToDouble):
+        (WTF::charactersToFloat):
+        (WTF::charactersToFloatIgnoringJunk): Created new version of charactersToFloat that allows 
+        trailing junk.
+        * wtf/text/WTFString.h:
+        (WTF):
+
+2012-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Implement Error.stack
+        https://bugs.webkit.org/show_bug.cgi?id=66994
+
+        Reviewed by Gavin Barraclough.
+
+        Implement support for stack traces on exception objects.  This is a rewrite
+        of the core portion of the last stack walking logic, but the mechanical work
+        of adding the information to an exception comes from the original work by
+        Juan Carlos Montemayor Elosua.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        (JSC):
+        (JSC::getSourceURLFromCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (StackFrame):
+        (JSC::StackFrame::toString):
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionJSCStack):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setInferredName):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+        (JSC):
+
+2012-02-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Numerous trivial bugs in Object.defineProperty
+        https://bugs.webkit.org/show_bug.cgi?id=78777
+
+        Reviewed by Sam Weinig.
+
+        There are a handful of really trivial bugs, related to Object.defineProperty:
+            * Redefining an accessor with different attributes changes the attributes, but not the get/set functions!
+            * Calling an undefined setter should only throw in strict mode.
+            * When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
+            * Any attempt to redefine a non-configurable property of an array as configurable should be rejected.
+            * Object.defineProperties should call toObject on 'Properties' argument, rather than throwing if it is not an object.
+            * If preventExtensions has been called on an array, subsequent assignment beyond array bounds should fail.
+            * 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
+            * Should be able to redefine an non-writable, non-configurable property, with the same value and attributes.
+            * Should be able to define an non-configurable accessor.
+        These are mostly all one-line changes, e.g. inverted boolean checks, masking against wrong attribute.
+
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+            - Added ASSERT.
+            - Calling an undefined setter should only throw in strict mode.
+        (JSC::JSArray::putDescriptor):
+            - Should be able to define an non-configurable accessor.
+        (JSC::JSArray::defineOwnNumericProperty):
+            - Any attempt to redefine a non-configurable property of an array as configurable should be rejected.
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+            - If preventExtensions has been called on an array, subsequent assignment beyond array bounds should fail.
+        * runtime/JSArray.h:
+        (JSArray):
+            - made enterDictionaryMode public, called from JSObject.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Calling an undefined setter should only throw in strict mode.
+        (JSC::JSObject::preventExtensions):
+            - Put array objects into dictionary mode to handle this!
+        (JSC::JSObject::defineOwnProperty):
+            - Should be able to redefine an non-writable, non-configurable property, with the same value and attributes.
+            - Redefining an accessor with different attributes changes the attributes, but not the get/set functions!
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorDefineProperties):
+            - Object.defineProperties should call toObject on 'Properties' argument, rather than throwing if it is not an object.
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::attributesWithOverride):
+            - When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
+        (JSC::PropertyDescriptor::attributesOverridingCurrent):
+            - When redefining an accessor to a data decriptor, if writable is not specified we should default to false.
+        * runtime/Structure.cpp:
+        (JSC::Structure::freezeTransition):
+            - 'freezeTransition' shouldn't be setting the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
+        (JSC::Structure::isFrozen):
+            - 'isFrozen' shouldn't be checking the ReadOnly bit for accessor descriptors (we presently always keep this bit as 'false').
+
+2012-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not check the types of arguments that are dead
+        https://bugs.webkit.org/show_bug.cgi?id=78518
+
+        Reviewed by Geoff Garen.
+        
+        The argument checks are now elided if the corresponding SetArgument is dead,
+        and the abstract value of the argument is set to bottom (None, []). This is
+        performance neutral on the benchmarks we currently track.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+
+2012-02-15  Oliver Hunt  <oliver@apple.com>
+
+        Ensure that the DFG JIT always plants a CodeOrigin when making calls
+        https://bugs.webkit.org/show_bug.cgi?id=78763
+
+        Reviewed by Gavin Barraclough.
+
+        Make all calls plant a CodeOrigin prior to the actual
+        call.  Also clobbers the Interpreter with logic to ensure
+        that the interpreter always plants a bytecode offset.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (CallBeginToken):
+        (JSC::DFG::JITCompiler::beginJSCall):
+        (JSC::DFG::JITCompiler::beginCall):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::bytecodeOffsetForNonDFGCode):
+        (ExecState):
+        (JSC::ExecState::setBytecodeOffsetForNonDFGCode):
+        (JSC::ExecState::codeOriginIndexForDFG):
+
+2012-02-14  Oliver Hunt  <oliver@apple.com>
+
+        Fix Interpreter.
+
+        * runtime/Executable.cpp:
+        (JSC):
+        * runtime/Executable.h:
+        (ExecutableBase):
+
+2012-02-14  Matt Lilek  <mrl@apple.com>
+
+        Don't ENABLE_DASHBOARD_SUPPORT unconditionally on all Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78629
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for non-DFG platforms.
+
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+
+2012-02-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build and configuration goof.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::invert):
+        * dfg/DFGCommon.h:
+
+2012-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to emit code on control flow edges
+        https://bugs.webkit.org/show_bug.cgi?id=78515
+
+        Reviewed by Gavin Barraclough.
+        
+        This gets us a few steps closer to being able to perform global register allocation,
+        by allowing us to have landing pads on control flow edges. This will let us reshuffle
+        registers if it happens to be necessary due to different reg alloc decisions in
+        differen blocks.
+        
+        This also introduces the notion of a landing pad for OSR entry, which will allow us
+        to emit code that places data into registers when we're entering into the DFG from
+        the old JIT.
+        
+        Finally, this patch introduces a verification mode that checks that the landing pads
+        are actually emitted and do actually work as advertised. When verification is disabled,
+        this has no effect on behavior.
+
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::invert):
+        (JSC::MacroAssembler::isInvertible):
+        * dfg/DFGCommon.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::createOSREntries):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::linkOSREntries):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::branchDouble):
+        (JSC::DFG::SpeculativeJIT::branchDoubleNonZero):
+        (JSC::DFG::SpeculativeJIT::branch32):
+        (JSC::DFG::SpeculativeJIT::branchTest32):
+        (JSC::DFG::SpeculativeJIT::branchPtr):
+        (JSC::DFG::SpeculativeJIT::branchTestPtr):
+        (JSC::DFG::SpeculativeJIT::branchTest8):
+        (JSC::DFG::SpeculativeJIT::jump):
+        (JSC::DFG::SpeculativeJIT::haveEdgeCodeToEmit):
+        (JSC::DFG::SpeculativeJIT::emitEdgeCode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-02-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Assertion failure under JSC::DFG::AbstractState::execute loading economist.com
+        https://bugs.webkit.org/show_bug.cgi?id=78153
+        <rdar://problem/10861712> <rdar://problem/10861947>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+
+2012-02-14  Eric Seidel  <eric@webkit.org>
+
+        Upstream Android's additions to Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=78536
+
+        Reviewed by Adam Barth.
+
+        * wtf/Platform.h:
+
+2012-02-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Replace old strtod with new strtod
+        https://bugs.webkit.org/show_bug.cgi?id=68044
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Lexer.cpp: Added template argument. This version allows junk after numbers.
+        (JSC::::lex):
+        * runtime/JSGlobalObjectFunctions.cpp: Ditto.
+        (JSC::parseInt):
+        (JSC::jsStrDecimalLiteral):
+        * runtime/LiteralParser.cpp: Ditto.
+        (JSC::::Lexer::lexNumber):
+        * wtf/dtoa.cpp: Replaced old strtod with a new version that uses the new StringToDoubleConverter.
+        It takes a template argument to allow clients to determine statically whether it should allow 
+        junk after the numbers or not.
+        (WTF):
+        (WTF::strtod):
+        * wtf/dtoa.h:
+        (WTF):
+        * wtf/text/WTFString.cpp: Added template argument. This version does not allow junk after numbers.
+        (WTF::toDoubleType):
+
+2012-02-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        More windows build fixing
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Executing out of bounds in JSC::Yarr::YarrCodeBlock::execute / JSC::RegExp::match
+        https://bugs.webkit.org/show_bug.cgi?id=76315
+
+        Reviewed by Gavin Barraclough.
+
+        Perform a 3 byte compare using two comparisons, rather than trying to perform the
+        operation with a four byte load.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+
+2012-02-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Replace old strtod with new strtod
+        https://bugs.webkit.org/show_bug.cgi?id=68044
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Lexer.cpp: Added template argument. This version allows junk after numbers.
+        (JSC::::lex):
+        * runtime/JSGlobalObjectFunctions.cpp: Ditto.
+        (JSC::parseInt):
+        (JSC::jsStrDecimalLiteral):
+        * runtime/LiteralParser.cpp: Ditto.
+        (JSC::::Lexer::lexNumber):
+        * wtf/dtoa.cpp: Replaced old strtod with a new version that uses the new StringToDoubleConverter.
+        It takes a template argument to allow clients to determine statically whether it should allow 
+        junk after the numbers or not.
+        (WTF):
+        (WTF::strtod):
+        * wtf/dtoa.h:
+        (WTF):
+        * wtf/text/WTFString.cpp: Added template argument. This version does not allow junk after numbers.
+        (WTF::toDoubleType):
+
+2012-02-13  Sam Weinig  <sam@webkit.org>
+
+        Move JSC related assertions out of Assertions.h and into their own header
+        https://bugs.webkit.org/show_bug.cgi?id=78508
+
+        Reviewed by Gavin Barraclough.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add GCAssertions.h
+
+        * heap/GCAssertions.h: Added.
+        Move assertions here.
+
+        * runtime/WriteBarrier.h:
+        Add #include of GCAssertions.h
+
+        * wtf/Assertions.h:
+        Remove JSC related assertions.
+
+        * wtf/Compiler.h:
+        Add compiler check for __has_trivial_destructor.
+
+2012-02-13  Chao-ying Fu  <fu@mips.com>
+
+        Update MIPS patchOffsetGetByIdSlowCaseCall
+        https://bugs.webkit.org/show_bug.cgi?id=78392
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JIT.h:
+        (JIT):
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove obsolete #if from ThreadSpecific.h
+        https://bugs.webkit.org/show_bug.cgi?id=78485
+
+        Reviewed by Adam Roben.
+
+        Since alle platform use either pthread or Win32 for threading,
+        we can remove all PLATFORM() preprocessor statements.
+
+        * wtf/ThreadSpecific.h:
+        (ThreadSpecific):
+
+2012-02-13  Jessie Berlin  <jberlin@apple.com>
+
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-13  Sam Weinig  <sam@webkit.org>
+
+        Use C11's _Static_assert for COMPILE_ASSERT if it is available
+        https://bugs.webkit.org/show_bug.cgi?id=78506
+
+        Rubber-stamped by Antti Koivisto.
+
+        Use C11's _Static_assert for COMPILE_ASSERT if it is available to give slightly
+        better error messages.
+
+        * wtf/Assertions.h:
+        Use _Static_assert if it is available.
+
+        * wtf/Compiler.h:
+        Add COMPILER_SUPPORTS support for _Static_assert when using the LLVM Compiler.
+
+2012-02-13  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add GSList to the list of GObject types in GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=78487
+
+        Reviewed by Philippe Normand.
+
+        Handle the GSList type in GOwnPtr, by calling g_slist_free in the
+        implementation of the freeOwnedGPtr template function.
+
+        * wtf/gobject/GOwnPtr.cpp:
+        (WTF::GSList):
+        (WTF):
+        * wtf/gobject/GOwnPtr.h:
+        (WTF):
+        * wtf/gobject/GTypedefs.h:
+
+2012-02-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [EFL] Drop support for the Curl network backend.
+        https://bugs.webkit.org/show_bug.cgi?id=77874
+
+        Reviewed by Eric Seidel.
+
+        Nobody seems to be maintaining the Curl backend in WebCore, the
+        EFL port developers all seem to be using the Soup backend and the
+        port itself has many features which are only implemented for the
+        latter.
+
+        * wtf/PlatformEfl.cmake: Always build the gobject-dependent source
+        files.
+
+2012-02-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r107485.
+
+        * bytecode/PolymorphicPutByIdList.cpp:
+
+2012-02-13  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=78434
+        Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+        * runtime/ClassInfo.h:
+        (MethodTable):
+        (JSC):
+        * runtime/JSCell.cpp:
+        (JSC):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC):
+        * runtime/JSGlobalObjectFunctions.h:
+        (JSC):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSValue::get):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSValue.h:
+        (JSValue):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+        (JSC::Structure::setHasGetterSetterProperties):
+        (Structure):
+
+2012-02-12  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        KeywordLookupGenerator.py script fails in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=77886
+
+        Reviewed by Benjamin Poulain.
+
+        * parser/Keywords.table: Converted to LF-only.
+
+2012-02-12  Shinya Kawanaka  <shinyak@google.com>
+
+        Introduce ShadowRootList.
+        https://bugs.webkit.org/show_bug.cgi?id=78069
+
+        Reviewed by Hajime Morita.
+
+        DoublyLinkedList should have tail() method to take the last element.
+
+        * wtf/DoublyLinkedList.h:
+        (DoublyLinkedList):
+        (WTF::::tail):
+        (WTF):
+
+2012-02-12  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Move source files in WTF_HEADERS to WTF_SOURCES.
+        https://bugs.webkit.org/show_bug.cgi?id=78436
+
+        Reviewed by Daniel Bates.
+
+        * wtf/CMakeLists.txt: Move .cpp files from WTF_HEADERS to WTF_SOURCES,
+        and correctly sort the files which start with 'M'.
+
+2012-02-12  Sam Weinig  <sam@webkit.org>
+
+        Move the NumberOfCores.h/cpp files into the WTF group of JavaScriptCore.xcodeproj.
+
+        Rubber-stamped by Anders Carlsson.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-02-12  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Remove unused or empty variable definitions.
+        https://bugs.webkit.org/show_bug.cgi?id=78437
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt: Remove unused JavaScriptCore_HEADERS definition.
+        * shell/CMakeLists.txt: Remove unused JSC_HEADERS definition.
+        * wtf/CMakeLists.txt: Remove empty WTF_LIBRARIES definition, it will
+        be defined later by Platform*.cmake via LIST(APPEND WTF_LIBRARIES).
+
+2012-02-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT calls fprintf() instead of dataLog in terminateSpeculativeExecution()
+        https://bugs.webkit.org/show_bug.cgi?id=78431
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+
+2012-02-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add back WTFURL to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=77291
+
+        Reviewed by Adam Barth.
+
+        WTFURL was removed from WebKit in r86787.
+
+        This patch adds the code back to WTF with the following changes:
+        -Guard the feature with USE(WTFURL).
+        -Change the typename CHAR to CharacterType to follow recent WebKit conventions.
+        -Fix some coding style to make check-webkit-style happy.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Platform.h:
+        * wtf/url/api/ParsedURL.cpp: Added.
+        (WTF):
+        (WTF::ParsedURL::ParsedURL):
+        (WTF::ParsedURL::scheme):
+        (WTF::ParsedURL::username):
+        (WTF::ParsedURL::password):
+        (WTF::ParsedURL::host):
+        (WTF::ParsedURL::port):
+        (WTF::ParsedURL::path):
+        (WTF::ParsedURL::query):
+        (WTF::ParsedURL::fragment):
+        (WTF::ParsedURL::segment):
+        * wtf/url/api/ParsedURL.h: Added.
+        (WTF):
+        (ParsedURL):
+        (WTF::ParsedURL::spec):
+        * wtf/url/api/URLString.h: Added.
+        (WTF):
+        (URLString):
+        (WTF::URLString::URLString):
+        (WTF::URLString::string):
+        * wtf/url/src/RawURLBuffer.h: Added.
+        (WTF):
+        (RawURLBuffer):
+        (WTF::RawURLBuffer::RawURLBuffer):
+        (WTF::RawURLBuffer::~RawURLBuffer):
+        (WTF::RawURLBuffer::resize):
+        * wtf/url/src/URLBuffer.h: Added.
+        (WTF):
+        (URLBuffer):
+        (WTF::URLBuffer::URLBuffer):
+        (WTF::URLBuffer::~URLBuffer):
+        (WTF::URLBuffer::at):
+        (WTF::URLBuffer::set):
+        (WTF::URLBuffer::capacity):
+        (WTF::URLBuffer::length):
+        (WTF::URLBuffer::data):
+        (WTF::URLBuffer::setLength):
+        (WTF::URLBuffer::append):
+        (WTF::URLBuffer::grow):
+        * wtf/url/src/URLCharacterTypes.cpp: Added.
+        (WTF):
+        ():
+        * wtf/url/src/URLCharacterTypes.h: Added.
+        (WTF):
+        (URLCharacterTypes):
+        (WTF::URLCharacterTypes::isQueryChar):
+        (WTF::URLCharacterTypes::isIPv4Char):
+        (WTF::URLCharacterTypes::isHexChar):
+        ():
+        (WTF::URLCharacterTypes::isCharOfType):
+        * wtf/url/src/URLComponent.h: Added.
+        (WTF):
+        (URLComponent):
+        (WTF::URLComponent::URLComponent):
+        (WTF::URLComponent::fromRange):
+        (WTF::URLComponent::isValid):
+        (WTF::URLComponent::isNonEmpty):
+        (WTF::URLComponent::isEmptyOrInvalid):
+        (WTF::URLComponent::reset):
+        (WTF::URLComponent::operator==):
+        (WTF::URLComponent::begin):
+        (WTF::URLComponent::setBegin):
+        (WTF::URLComponent::length):
+        (WTF::URLComponent::setLength):
+        (WTF::URLComponent::end):
+        * wtf/url/src/URLEscape.cpp: Added.
+        (WTF):
+        ():
+        * wtf/url/src/URLEscape.h: Added.
+        (WTF):
+        (WTF::appendURLEscapedCharacter):
+        * wtf/url/src/URLParser.h: Added.
+        (WTF):
+        (URLParser):
+        ():
+        (WTF::URLParser::isPossibleAuthorityTerminator):
+        (WTF::URLParser::parseAuthority):
+        (WTF::URLParser::extractScheme):
+        (WTF::URLParser::parseAfterScheme):
+        (WTF::URLParser::parseStandardURL):
+        (WTF::URLParser::parsePath):
+        (WTF::URLParser::parsePathURL):
+        (WTF::URLParser::parseMailtoURL):
+        (WTF::URLParser::parsePort):
+        (WTF::URLParser::extractFileName):
+        (WTF::URLParser::extractQueryKeyValue):
+        (WTF::URLParser::isURLSlash):
+        (WTF::URLParser::shouldTrimFromURL):
+        (WTF::URLParser::trimURL):
+        (WTF::URLParser::consecutiveSlashes):
+        (WTF::URLParser::isPortDigit):
+        (WTF::URLParser::nextAuthorityTerminator):
+        (WTF::URLParser::parseUserInfo):
+        (WTF::URLParser::parseServerInfo):
+        * wtf/url/src/URLQueryCanonicalizer.h: Added.
+        (WTF):
+        (URLQueryCanonicalizer):
+        (WTF::URLQueryCanonicalizer::canonicalize):
+        (WTF::URLQueryCanonicalizer::isAllASCII):
+        (WTF::URLQueryCanonicalizer::isRaw8Bit):
+        (WTF::URLQueryCanonicalizer::appendRaw8BitQueryString):
+        (WTF::URLQueryCanonicalizer::convertToQueryEncoding):
+        * wtf/url/src/URLSegments.cpp: Added.
+        (WTF):
+        (WTF::URLSegments::length):
+        (WTF::URLSegments::charactersBefore):
+        * wtf/url/src/URLSegments.h: Added.
+        (WTF):
+        (URLSegments):
+        ():
+        (WTF::URLSegments::URLSegments):
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Old JIT put_by_id profiling counts every put_by_id_transition as taking slow path
+        https://bugs.webkit.org/show_bug.cgi?id=78430
+        <rdar://problem/10849469> <rdar://problem/10849684>
+
+        Reviewed by Gavin Barraclough.
+        
+        The old JIT's put_by_id transition caching involves repatching the slow call to
+        a generated stub. That means that the call is counted as "slow case". So, this
+        patch inserts code to decrement the slow case count if the stub succeeds.
+        
+        Looks like a ~1% speed-up on V8.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for Qt.
+
+        * wtf/DataLog.h:
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to send all JSC debug logging to a file
+        https://bugs.webkit.org/show_bug.cgi?id=78418
+
+        Reviewed by Sam Weinig.
+        
+        Introduced wtf/DataLog, which defines WTF::dataFile, WTF::dataLog,
+        and WTF::dataLogV. Changed all debugging- and profiling-related printfs
+        to use WTF::dataLog() or one of its friends. By default, debug logging
+        goes to stderr, unless you change the setting in wtf/DataLog.cpp.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::dumpLinkStatistics):
+        (JSC::LinkBuffer::dumpCode):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::vprintfStdoutInstr):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::stop):
+        (JSC::SamplingRegion::dumpInternal):
+        (JSC::SamplingTool::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCommon.h:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::printWhiteSpace):
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::propagateArithNodeFlagsForward):
+        (JSC::DFG::Propagator::propagateArithNodeFlagsBackward):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::propagatePredictionsForward):
+        (JSC::DFG::Propagator::propagatePredictionsBackward):
+        (JSC::DFG::Propagator::doRoundOfDoubleVoting):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::fixup):
+        (JSC::DFG::Propagator::startIndexForChildren):
+        (JSC::DFG::Propagator::endIndexForPureCSE):
+        (JSC::DFG::Propagator::setReplacement):
+        (JSC::DFG::Propagator::eliminate):
+        (JSC::DFG::Propagator::performNodeCSE):
+        (JSC::DFG::Propagator::localCSE):
+        (JSC::DFG::Propagator::allocateVirtualRegisters):
+        (JSC::DFG::Propagator::performBlockCFA):
+        (JSC::DFG::Propagator::performForwardCFA):
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::dump):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::dump):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::dump):
+        (JSC::DFG::SpeculativeJIT::checkConsistency):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * heap/Heap.cpp:
+        (JSC::Heap::destroy):
+        * heap/MarkedBlock.h:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintData):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::dumpRegExpTrace):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::matchCompareWithInterpreter):
+        * runtime/SamplingCounter.cpp:
+        (JSC::AbstractSamplingCounter::dump):
+        * runtime/SamplingCounter.h:
+        (JSC::DeletableSamplingCounter::~DeletableSamplingCounter):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::report):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::dumpInternal):
+        * wtf/CMakeLists.txt:
+        * wtf/DataLog.cpp: Added.
+        (WTF):
+        (WTF::initializeLogFileOnce):
+        (WTF::initializeLogFile):
+        (WTF::dataFile):
+        (WTF::dataLogV):
+        (WTF::dataLog):
+        * wtf/DataLog.h: Added.
+        (WTF):
+        * wtf/HashTable.cpp:
+        (WTF::HashTableStats::~HashTableStats):
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocator::dumpProfile):
+        * wtf/text/WTFString.cpp:
+        (String::show):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+
+2012-02-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Move special __proto__ property to Object.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=78409
+
+        Reviewed by Oliver Hunt.
+
+        Re-implement this as a regular accessor property.  This has three key benefits:
+        1) It makes it possible for objects to be given properties named __proto__.
+        2) Object.prototype.__proto__ can be deleted, preventing object prototypes from being changed.
+        3) This largely removes the magic used the implement __proto__, it can just be made a regular accessor property.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+            - No need to prohibit functions named __proto__.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            - Add __proto__ accessor to Object.prototype.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+            - Definition of the __proto__ accessor functions.
+        * runtime/JSGlobalObjectFunctions.h:
+            - Declaration of the __proto__ accessor functions.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+            - Remove the special handling for __proto__, there is still a check to allow for a fast guard for accessors excluding __proto__.
+        (JSC::JSObject::putDirectAccessor):
+            - Track on the structure whether an object contains accessors other than one for __proto__.
+        (JSC::JSObject::defineOwnProperty):
+            - No need to prohibit definition of own properties named __proto__.
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+            - Remove the special handling for __proto__.
+        (JSC::JSValue::get):
+            - Remove the special handling for __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+            - Remove the special handling for __proto__.
+        * runtime/JSValue.h:
+        (JSValue):
+            - Made synthesizePrototype public (this may be needed by the __proto__ getter).
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+            - Perform the security check & call prototype() directly.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
+        * runtime/Structure.h:
+        (JSC::Structure::hasGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+        (Structure):
+            - Added 'ExcludingProto' variant of the 'hasGetterSetterProperties' state.
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA assumes that a WeakJSConstant's structure is known
+        https://bugs.webkit.org/show_bug.cgi?id=78428
+        <rdar://problem/10849492> <rdar://problem/10849621>
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-02-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Qt debug build fix
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor): Platforms that don't use clang will allocate 
+        JSFinalObjects in the destuctor subspace, so we should remove this assert so it 
+        doesn't cause crashes.
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Old 32_64 JIT should assert that its use of map() is consistent with the DFG
+        OSR exit's expectations
+        https://bugs.webkit.org/show_bug.cgi?id=78419
+        <rdar://problem/10817121>
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::map):
+
+2012-02-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Reduce the reentrancy limit of the interpreter for the iOS simulator
+        https://bugs.webkit.org/show_bug.cgi?id=78400
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/Interpreter.h: Lowered the maximum reentrancy limit for large thread stacks.
+        (JSC):
+
+2012-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        [DFG] Misuse of WeakJSConstants in silentFillGPR code.
+        https://bugs.webkit.org/show_bug.cgi?id=78423
+        <rdar://problem/10849353> <rdar://problem/10804043>
+
+        Reviewed by Sam Weinig.
+        
+        The code was using Node::isConstant(), when it was supposed to use Node::hasConstant().
+        This patch is a surgical fix; the bigger problem is: why do we have isConstant() and
+        hasConstant() when hasConstant() is correct and isConstant() is almost always wrong?
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentFillGPR):
+
+2012-02-11  Sam Weinig  <sam@webkit.org>
+
+        Prepare JavaScriptCore to build with libc++
+        <rdar://problem/10426673>
+        https://bugs.webkit.org/show_bug.cgi?id=78424
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/NullPtr.cpp:
+        * wtf/NullPtr.h:
+        libc++ provides std::nullptr emulation, so we don't have to.
+
+2012-02-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have polymorphic put_by_id caching
+        https://bugs.webkit.org/show_bug.cgi?id=78062
+        <rdar://problem/10326439> <rdar://problem/10824839>
+
+        Reviewed by Oliver Hunt.
+        
+        Implemented polymorphic put_by_id caching in the DFG, and added much of the
+        machinery that would be needed to implement it in the old JIT as well.
+        
+        I decided against using the old PolymorphicAccessStructureList mechanism as
+        this didn't quite fit with put_by_id. In particular, I wanted the ability to
+        have one list that captured all relevant cases (including proto put_by_id
+        if we ever decided to do it). And I wanted the code to have better
+        encapsulation. And I didn't want to get confused by the fact that the
+        original (non-list) put_by_id cache may itself consist of a stub routine.
+        
+        This code is still sub-optimal (for example adding a replace to a list whose
+        previous elements are all transitions should just repatch the original code,
+        but here it will generate a stub) but it already generates a >20% speed-up
+        on V8-splay, leading to a 2% win overall in splay. Neutral elsewhere.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/PolymorphicPutByIdList.cpp: Added.
+        (JSC):
+        (JSC::PutByIdAccess::fromStructureStubInfo):
+        (JSC::PutByIdAccess::visitWeak):
+        (JSC::PolymorphicPutByIdList::PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::from):
+        (JSC::PolymorphicPutByIdList::~PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::isFull):
+        (JSC::PolymorphicPutByIdList::isAlmostFull):
+        (JSC::PolymorphicPutByIdList::addAccess):
+        (JSC::PolymorphicPutByIdList::visitWeak):
+        * bytecode/PolymorphicPutByIdList.h: Added.
+        (JSC):
+        (PutByIdAccess):
+        (JSC::PutByIdAccess::PutByIdAccess):
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::replace):
+        (JSC::PutByIdAccess::isSet):
+        (JSC::PutByIdAccess::operator!):
+        (JSC::PutByIdAccess::type):
+        (JSC::PutByIdAccess::isTransition):
+        (JSC::PutByIdAccess::isReplace):
+        (JSC::PutByIdAccess::oldStructure):
+        (JSC::PutByIdAccess::structure):
+        (JSC::PutByIdAccess::newStructure):
+        (JSC::PutByIdAccess::chain):
+        (JSC::PutByIdAccess::stubRoutine):
+        (PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
+        (JSC::PolymorphicPutByIdList::isEmpty):
+        (JSC::PolymorphicPutByIdList::size):
+        (JSC::PolymorphicPutByIdList::at):
+        (JSC::PolymorphicPutByIdList::operator[]):
+        (JSC::PolymorphicPutByIdList::kind):
+        * bytecode/PutKind.h: Added.
+        (JSC):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC):
+        (JSC::isPutByIdAccess):
+        (JSC::StructureStubInfo::initPutByIdList):
+        (StructureStubInfo):
+        (JSC::StructureStubInfo::reset):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        (DFG):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::appropriateGenericPutByIdFunction):
+        (JSC::DFG::appropriateListBuildingPutByIdFunction):
+        (DFG):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::dfgRepatchPutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        (JSC::DFG::dfgBuildPutByIdList):
+        (JSC::DFG::dfgResetPutByID):
+        * dfg/DFGRepatch.h:
+        (DFG):
+        * runtime/WriteBarrier.h:
+        (WriteBarrierBase):
+        (JSC::WriteBarrierBase::copyFrom):
+
+2012-02-10  Vineet Chaudhary  <rgf748@motorola.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=72756
+        DOMHTMLElement’s accessKey property is declared as available in WebKit version that didn’t have it 
+
+        Reviewed by Timothy Hatcher.
+
+        * API/WebKitAvailability.h: Added AVAILABLE_AFTER_WEBKIT_VERSION_5_1 and
+          AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_5_1 for the new versions.
+
+2012-02-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing windows build
+
+        Unreviewed build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-02-10  Adam Klein  <adamk@chromium.org>
+
+        Enable MUTATION_OBSERVERS by default on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=78196
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-02-10  Yong Li  <yoli@rim.com>
+
+        ENABLE(ASSEMBLER_WX_EXCLUSIVE): LinkBuffer can leave pages not marked as executable.
+        https://bugs.webkit.org/show_bug.cgi?id=76724
+
+        Reviewed by Rob Buis.
+
+        This issue only exists when both ENABLE(ASSEMBLER_WX_EXCLUSIVE) and ENABLE(BRANCH_COMPACTION) are on.
+        The size used to call makeExecutable can be smaller than the one that was used for makeWritable.
+        So it can leave pages behind that are not set back to default flags. When an assembly on one of those
+        pages is executed or JIT returns to those pages in the case it was already executing from there, the
+        software will crash.
+
+        * assembler/LinkBuffer.h: Add m_initialSize and use it in performFinalization().
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::performFinalization):
+        (LinkBuffer):
+
+2012-02-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Split MarkedSpace into destructor and destructor-free subspaces
+        https://bugs.webkit.org/show_bug.cgi?id=77761
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): Switched over to use destructor-free space.
+        * heap/Heap.h:
+        (JSC::Heap::allocatorForObjectWithoutDestructor): Added to give clients (e.g. the JIT) the ability to 
+        pick which subspace they want to allocate out of.
+        (JSC::Heap::allocatorForObjectWithDestructor): Ditto.
+        (Heap):
+        (JSC::Heap::allocateWithDestructor): Added private function for CellAllocator to use.
+        (JSC):
+        (JSC::Heap::allocateWithoutDestructor): Ditto.
+        * heap/MarkedAllocator.cpp: Added the cellsNeedDestruction flag to allocators so that they can allocate 
+        their MarkedBlocks correctly.
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::cellsNeedDestruction):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC):
+        (JSC::MarkedAllocator::init): Replaced custom set functions, which were only used upon initialization, with
+        an init function that does all of that stuff in fewer lines.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::recycle):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::callDestructor): Templatized, along with specializedSweep and sweepHelper, to make 
+        checking the m_cellsNeedDestructor flag faster and cleaner looking.
+        (JSC):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::cellsNeedDestruction):
+        (JSC):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData):
+        (JSC::TakeIfUnmarked::operator()):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (Subspace):
+        (JSC::MarkedSpace::allocatorFor): Needed function to differentiate between the two broad subspaces of 
+        allocators.
+        (JSC):
+        (JSC::MarkedSpace::destructorAllocatorFor): Ditto.
+        (JSC::MarkedSpace::allocateWithoutDestructor): Ditto.
+        (JSC::MarkedSpace::allocateWithDestructor): Ditto.
+        (JSC::MarkedSpace::forEachBlock):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h: Modified to use the proper allocator for JSFinalObjects and others.
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC::JIT::emitAllocateJSFunction):
+        * runtime/JSArray.cpp:
+        (JSC):
+        * runtime/JSArray.h:
+        (JSArray):
+        (JSC::JSArray::create):
+        (JSC):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSCell.h:
+        (JSCell):
+        (JSC):
+        (NeedsDestructor): Template struct that calculates at compile time whether the class in question requires 
+        destruction or not using the compiler type trait __has_trivial_destructor. allocateCell then checks this 
+        constant to decide whether to allocate in the destructor or destructor-free parts of the heap.
+        (JSC::allocateCell): 
+        * runtime/JSFunction.cpp:
+        (JSC):
+        * runtime/JSFunction.h:
+        (JSFunction):
+        * runtime/JSObject.cpp:
+        (JSC):
+        * runtime/JSObject.h:
+        (JSNonFinalObject):
+        (JSC):
+        (JSFinalObject):
+        (JSC::JSFinalObject::create):
+
+2012-02-10  Adrienne Walker  <enne@google.com>
+
+        Remove implicit copy constructor usage in HashMaps with OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=78071
+
+        Reviewed by Darin Adler.
+
+        Change the return type of emptyValue() in PairHashTraits to be the
+        actual type returned rather than the trait type to avoid an implicit
+        generation of the OwnPtr copy constructor. This happens for hash
+        traits involving OwnPtr where the empty value is not zero and each
+        hash bucket needs to be initialized with emptyValue().
+
+        Also, update StructureTransitionTable to use default hash traits
+        rather than rolling its own, in order to update it to handle
+        EmptyValueType.
+
+        Test: patch from bug 74154 compiles on Clang with this patch
+
+        * runtime/StructureTransitionTable.h:
+        (StructureTransitionTable):
+        * wtf/HashTraits.h:
+        (GenericHashTraits):
+        (PairHashTraits):
+        (WTF::PairHashTraits::emptyValue):
+
+2012-02-10  Aron Rosenberg  <arosenberg@logitech.com>
+
+        [Qt] Fix compiler warning in Visual Studio 2010 about TR1
+        https://bugs.webkit.org/show_bug.cgi?id=63642
+
+        Reviewed by Simon Hausmann.
+
+        * JavaScriptCore.pri:
+
+2012-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Yarr assert with regexp where alternative in *-quantified group matches empty
+        https://bugs.webkit.org/show_bug.cgi?id=67752        
+
+        Reviewed by Gavin Barraclough.
+
+        Added backtracking for the prior alternative if it matched
+        but didn't consume any input characters.
+
+        * yarr/YarrJIT.cpp:
+        (YarrOp): New jump.
+        (JSC::Yarr::YarrGenerator::generate): Emit conditional jump
+        when an alternative matches and no input was consumed.  Moved the
+        zero length match check for a set of alternatives to the alternative
+        code from the parentheses cases to the alternative end cases.
+        Converted the existing zero length checks in the parentheses cases
+        to runtime assertion checks.
+        (JSC::Yarr::YarrGenerator::backtrack): Link new jump to backtrack
+        to prior term.
+
+2012-02-10  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
+
+        [Qt] GC should be parallel on Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=73309
+
+        Reviewed by Zoltan Herczeg.
+
+        These changes made the parallel gc feature available for Qt port.
+        The implementation of "registerGCThread" and "isMainThreadOrGCThread",
+        and a local static function [initializeGCThreads] is moved from
+        MainThreadMac.mm to the common MainThread.cpp to make them available
+        for other platforms.
+
+        Measurement results:
+        V8           speed-up:  1.025x as fast  [From: 663.4ms  To: 647.0ms ]
+        V8 Splay     speed-up:  1.185x as fast  [From: 138.4ms  To: 116.8ms ]
+
+        Tested on Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz with 4-core.
+
+        * JavaScriptCore.order:
+        * wtf/MainThread.cpp:
+        (WTF::initializeMainThread):
+        (WTF):
+        (WTF::initializeGCThreads):
+        (WTF::registerGCThread):
+        (WTF::isMainThreadOrGCThread):
+        * wtf/MainThread.h:
+        (WTF):
+        * wtf/Platform.h:
+        * wtf/mac/MainThreadMac.mm:
+        (WTF):
+
+2012-02-09  Andy Wingo  <wingo@igalia.com>
+
+        Eliminate dead code in BytecodeGenerator::resolve()
+        https://bugs.webkit.org/show_bug.cgi?id=78242
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        BytecodeGenerator::shouldOptimizeLocals() is only true for
+        FunctionCode, and thus cannot be true for GlobalCode.
+
+2012-02-09  Andy Wingo  <wingo@igalia.com>
+
+        Remove BytecodeGenerator::isLocal
+        https://bugs.webkit.org/show_bug.cgi?id=78241
+
+        Minor refactor to BytecodeGenerator.
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::isLocal):
+        (JSC::BytecodeGenerator::isLocalConstant): Remove now-unused
+        methods.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure): Use the ResolveResult mechanism
+        instead of isLocal.  This will recognize more resolve nodes as
+        being pure.
+        (JSC::PrefixResolveNode::emitBytecode): Use isReadOnly on the
+        location instead of isLocalConstant.
+
+2012-02-09  Oliver Hunt  <oliver@apple.com>
+
+        The JS Parser scope object needs a VectorTrait specialization
+        https://bugs.webkit.org/show_bug.cgi?id=78308
+
+        Reviewed by Gavin Barraclough.
+
+        This showed up as a periodic crash in various bits of generated code
+        originally, but I've added an assertion in the bytecode generator
+        that makes the effected code much more crash-happy should it go
+        wrong again.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        (JSC):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::isValidScopedLookup):
+        (JSActivation):
+
+2012-02-08  Oliver Hunt  <oliver@apple.com>
+
+        Whoops, fix the build.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+
+2012-02-08  Oliver Hunt  <oliver@apple.com>
+
+        Fix issue encountered while debugging stacktraces
+        https://bugs.webkit.org/show_bug.cgi?id=78147
+
+        Reviewed by Gavin Barraclough.
+
+        Debugging is easier if we always ensure that we have a non-null
+        inferred name.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+
+2012-02-08  Oliver Hunt  <oliver@apple.com>
+
+        updateTopCallframe in the baseline JIT doesn't provide enough information to the stubs
+        https://bugs.webkit.org/show_bug.cgi?id=78145
+
+        Reviewed by Gavin Barraclough.
+
+        Fix the updateTopCallFrame helper to store additional information
+        that becomes necessary when we are trying to provide more stack
+        frame information.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::bytecodeOffsetForBaselineJIT):
+        (ExecState):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::updateTopCallFrame):
+
+2012-02-07  Robert Kroeger  <rjkroege@chromium.org>
+
+        [chromium] Remove the enable marcro for the no longer necessary Chromium
+        gesture recognizer.
+        https://bugs.webkit.org/show_bug.cgi?id=77492
+
+        Reviewed by Adam Barth.
+
+        * wtf/Platform.h:
+
+2012-02-07  Tony Chang  <tony@chromium.org>
+
+        merge DashboardSupportCSSPropertyNames.in into CSSPropertyNames.in
+        https://bugs.webkit.org/show_bug.cgi?id=78036
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE_DASHBOARD_SUPPORT to FEATURE_DEFINES.
+
+2012-02-07  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE] Use *bin* and *lib* directories for executable and libraries.
+        https://bugs.webkit.org/show_bug.cgi?id=77928
+
+        Reviewed by Daniel Bates.
+
+        CMake has used *Programs* directory for executable. In addition, shared libraries are being
+        built in source directory. It is better to set common places in order to maintain executable
+        and libraries. *bin* is for executable and *lib* is for library.
+
+        * shell/CMakeLists.txt: Change *Programs* with *bin*.
+
+2012-02-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Crash on http://www.rickshawbags.com/
+        https://bugs.webkit.org/show_bug.cgi?id=78045
+
+        Reviewed by Darin Adler.
+
+        Problem URL is: http://www.rickshawbags.com/customize/custom-bag#!thl=rickshaw/bag()
+        
+        This is a bug introduced by https://bugs.webkit.org/show_bug.cgi?id=71933,
+        isVariableObject() checks were excluding StaticScopeObjects, this patch
+        inadvertently changed them to be included.
+
+        * runtime/JSType.h:
+            - sort JSType enum such that StaticScopeObjectType comes before VariableObjectType,
+              and thus is excluded from isVariableObject() checks.
+
+2012-02-06  Jer Noble  <jer.noble@apple.com>
+
+        Use CMClock as a timing source for PlatformClock where available.
+        https://bugs.webkit.org/show_bug.cgi?id=77885
+
+        Reviewed by Eric Carlson.
+
+        * wtf/Platform.h: Added WTF_USE_COREMEDIA.
+
+2012-02-06  Filip Pizlo  <fpizlo@apple.com>
+
+        ValueToNumber and ValueToDouble nodes don't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=77855
+        <rdar://problem/10811325>
+
+        Reviewed by Gavin Barraclough.
+        
+        Removed ValueToNumber and ValueToDouble, because the only thing they were doing
+        was wasting registers.
+        
+        This looks like a 1% win on V8 (with a 5% win on crypto) and a 2-3% win on Kraken,
+        mostly due to a >10% win on gaussian-blur. No win anywhere else.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getToInt32):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::Node::hasArithNodeFlags):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::vote):
+        (JSC::DFG::Propagator::doRoundOfDoubleVoting):
+        (Propagator):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::canonicalize):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-02-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix after r106197.
+
+        * tools/CodeProfiling.cpp:
+        (JSC::CodeProfiling::notifyAllocator): getenv() isn't supported by WinCE. Don't call it.
+
+2012-02-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove JSObject defineGetter/defineSetter lookupGetter/lookupSetter
+        https://bugs.webkit.org/show_bug.cgi?id=77451
+
+        Reviewed by Sam Weinig.
+
+        These can now all be implemented in terms of defineOwnProperty & getPropertyDescriptor.
+        Also remove initializeGetterSetterProperty, since this is equivalent to putDirectAccessor.
+
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::defineOwnProperty):
+        * debugger/DebuggerActivation.h:
+        (DebuggerActivation):
+        * runtime/ClassInfo.h:
+        (MethodTable):
+        (JSC):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::finishCreation):
+        * runtime/JSCell.cpp:
+        (JSC):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineOwnProperty):
+        (JSC):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        * runtime/JSObject.cpp:
+        (JSC):
+        * runtime/JSObject.h:
+        (JSObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+
+2012-02-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-02-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG's child references from one node to another should have room for type information
+        https://bugs.webkit.org/show_bug.cgi?id=77797
+
+        Reviewed by Oliver Hunt.
+        
+        The DFG::Node::child fields now contain both a DFG::NodeIndex (which is just an unsigned)
+        and a DFG::UseKind (which is currently an effectively empty enum). They are encapsulated
+        together as a DFG::NodeUse, which can in most cases still be used as an index (for
+        example DFG::Graph, AbstractState, and SpeculativeJIT all accept NodeUse in most places
+        where they really want a NodeIndex).
+        
+        The NodeUse stores both the index and the UseKind without bloating the memory usage of
+        DFG::Node, since we really don't need full 32 bits for the NodeIndex (a DFG::Node is
+        roughly 11 words, so if we assume that we never want to use more than 1GB to DFG compile
+        something - likely a sensible assumption! - then we will only be able to have room for
+        about 24 million nodes, which means we only need about 24.5 bits for the node index).
+        Currently the DFG::NodeUse allocates 4 bits for the UseKind and 28 bits for the index,
+        but stores the index as a signed number to make NoNode work naturally. Hence we really
+        just have 27 bits for the index.
+        
+        This is performance-neutral on all benchmarks we track.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::forNode):
+        (AbstractState):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::addVarArgChild):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        * dfg/DFGCommon.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (Graph):
+        (JSC::DFG::Graph::operator[]):
+        (JSC::DFG::Graph::at):
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        (JSC::DFG::Graph::clearAndDerefChild1):
+        (JSC::DFG::Graph::clearAndDerefChild2):
+        (JSC::DFG::Graph::clearAndDerefChild3):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::getPrediction):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::child1):
+        (JSC::DFG::Node::child1Unchecked):
+        (JSC::DFG::Node::child2):
+        (JSC::DFG::Node::child3):
+        (JSC::DFG::Node::firstChild):
+        (JSC::DFG::Node::numChildren):
+        (JSC::DFG::Node::dumpChildren):
+        (Node):
+        * dfg/DFGNodeReferenceBlob.h: Added.
+        (DFG):
+        (NodeReferenceBlob):
+        (JSC::DFG::NodeReferenceBlob::NodeReferenceBlob):
+        (JSC::DFG::NodeReferenceBlob::child):
+        (JSC::DFG::NodeReferenceBlob::child1):
+        (JSC::DFG::NodeReferenceBlob::child2):
+        (JSC::DFG::NodeReferenceBlob::child3):
+        (JSC::DFG::NodeReferenceBlob::child1Unchecked):
+        (JSC::DFG::NodeReferenceBlob::initialize):
+        (JSC::DFG::NodeReferenceBlob::firstChild):
+        (JSC::DFG::NodeReferenceBlob::setFirstChild):
+        (JSC::DFG::NodeReferenceBlob::numChildren):
+        (JSC::DFG::NodeReferenceBlob::setNumChildren):
+        * dfg/DFGNodeUse.h: Added.
+        (DFG):
+        (NodeUse):
+        (JSC::DFG::NodeUse::NodeUse):
+        (JSC::DFG::NodeUse::indexUnchecked):
+        (JSC::DFG::NodeUse::index):
+        (JSC::DFG::NodeUse::setIndex):
+        (JSC::DFG::NodeUse::useKind):
+        (JSC::DFG::NodeUse::setUseKind):
+        (JSC::DFG::NodeUse::isSet):
+        (JSC::DFG::NodeUse::operator!):
+        (JSC::DFG::NodeUse::operator==):
+        (JSC::DFG::NodeUse::operator!=):
+        (JSC::DFG::NodeUse::shift):
+        (JSC::DFG::NodeUse::makeWord):
+        (JSC::DFG::operator==):
+        (JSC::DFG::operator!=):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::vote):
+        (JSC::DFG::Propagator::toDouble):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::canonicalize):
+        (JSC::DFG::Propagator::startIndex):
+        (JSC::DFG::Propagator::globalVarLoadElimination):
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::performSubstitution):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::use):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::at):
+        (JSC::DFG::SpeculativeJIT::canReuse):
+        (JSC::DFG::SpeculativeJIT::use):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::IntegerOperand::IntegerOperand):
+        (JSC::DFG::DoubleOperand::DoubleOperand):
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        (JSC::DFG::StorageOperand::StorageOperand):
+        (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-02-05  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE] Support javascriptcore test for EFL port. 
+        https://bugs.webkit.org/show_bug.cgi?id=77425
+
+        Reviewed by Daniel Bates.
+
+        Efl and WinCE as well as Blackberry port are now using Cmake as its build system
+        and they are share the make file to create jsc excutable. In order to run
+        "run-javascriptcore-tests", EFL port needs to change jsc installation configuration
+        with executable output directory(e.g. Programs). So, this patch change jsc installation
+        configuration only for EFL port.
+
+        * shell/CMakeLists.txt:
+
+2012-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::quantifyAtom):
+            - Fix comment.
+
+2012-02-04  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] CurrentTime: Reorder headers for win32
+        https://bugs.webkit.org/show_bug.cgi?id=77808
+
+        Reviewed by Martin Robinson.
+
+        In GTK+ win32 port, monotonicallyIncreasingTime() implementation is
+        based on g_get_monotonic_time(). Reorder headers to make sure glib.h
+        gets included even when the platform is win32.
+
+        CurrentTime.cpp: In function 'double WTF::monotonicallyIncreasingTime()':
+        CurrentTime.cpp:321:53: error: 'g_get_monotonic_time' was not declared in this scope
+        CurrentTime.cpp:322:1: warning: control reaches end of non-void function [-Wreturn-type]
+
+        * wtf/CurrentTime.cpp:
+
+2012-02-03  Anders Carlsson  <andersca@apple.com>
+
+        Prefix the typedef in WTF_MAKE_FAST_ALLOCATED with underscores
+        https://bugs.webkit.org/show_bug.cgi?id=77788
+
+        Reviewed by Andreas Kling.
+
+        The current typedef name, 'ThisIsHereToForceASemicolonAfterThisMacro', shows up when trying to 
+        code-complete 'this' in Xcode. Prefix the typedef with two underscores to stop this from happening.
+
+        * wtf/FastAllocBase.h:
+
+2012-02-03  Rob Buis  <rbuis@rim.com>
+
+        Fix alignment warnings in ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=55368
+
+        Reviewed by Filip Pizlo.
+
+        Use reinterpret_cast_ptr and static_cast to get rid of alignment issues in ARMv7 code.
+
+        * heap/HandleTypes.h:
+        (JSC::HandleTypes::getFromSlot):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::specializedSweep):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::forEachCell):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::unvalidatedGet):
+
+2012-02-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Build fix
+
+        Unreviewed build fix
+
+        Forgot to add a couple files.
+
+        * heap/MarkedAllocator.cpp: Added.
+        (JSC):
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::tryAllocate):
+        (JSC::MarkedAllocator::allocateSlowCase):
+        (JSC::MarkedAllocator::allocateBlock):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        * heap/MarkedAllocator.h: Added.
+        (JSC):
+        (DFG):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::cellSize):
+        (JSC::MarkedAllocator::heap):
+        (JSC::MarkedAllocator::setHeap):
+        (JSC::MarkedAllocator::setCellSize):
+        (JSC::MarkedAllocator::setMarkedSpace):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::allocate):
+        (JSC::MarkedAllocator::reset):
+        (JSC::MarkedAllocator::zapFreeList):
+        (JSC::MarkedAllocator::forEachBlock):
+
+2012-02-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor MarkedBlock::SizeClass into a separate class
+        https://bugs.webkit.org/show_bug.cgi?id=77600
+
+        Reviewed by Geoffrey Garen.
+
+        We pulled SizeClass out into its own class, named MarkedAllocator, and gave it
+        the responsibility of allocating objects from the collection of MarkedBlocks 
+        that it manages. Also limited the amount of coupling to internal data fields 
+        from other places, although it's mostly unavoidable in the JIT code.
+
+        Eventually MarkedAllocator will implement various policies to do with object 
+        management, e.g. whether or not to run destructors on objects that it manages.
+        MarkedSpace will manage a collection of MarkedAllocators with varying policies,
+        as it does now but to a larger extent. 
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        (JSC::Heap::resetAllocators):
+        * heap/Heap.h:
+        (JSC::Heap::allocatorForObject):
+        (Heap):
+        * heap/MarkedAllocator.cpp: Added.
+        (JSC):
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::tryAllocate):
+        (JSC::MarkedAllocator::allocateSlowCase):
+        (JSC::MarkedAllocator::allocateBlock):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        * heap/MarkedAllocator.h: Added.
+        (JSC):
+        (DFG):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::cellSize):
+        (JSC::MarkedAllocator::heap):
+        (JSC::MarkedAllocator::setHeap):
+        (JSC::MarkedAllocator::setCellSize):
+        (JSC::MarkedAllocator::setMarkedSpace):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::allocate):
+        (JSC::MarkedAllocator::reset):
+        (JSC::MarkedAllocator::zapFreeList):
+        (JSC::MarkedAllocator::forEachBlock):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData):
+        (JSC::TakeIfUnmarked::operator()):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::didAddBlock):
+        (JSC::MarkedSpace::didConsumeFreeList):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+
+2012-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Replace GNU linker script for exports with export macros in WTF/JSC
+        https://bugs.webkit.org/show_bug.cgi?id=77723
+
+        Reviewed by Tor Arne Vestbø.
+
+        * wtf/Platform.h: Enable use of export macros.
+
+2012-02-02  Hajime Morrita  <morrita@chromium.org>
+
+        Unreviewed, removing an unnecessarily JS_PRIVATE_EXPORT annotation.
+
+        * interpreter/Interpreter.h:
+        (Interpreter):
+
+2012-01-31  Hajime Morrita  <morrita@chromium.org>
+
+        [Mac] eliminate JavaScriptCore.exp
+        https://bugs.webkit.org/show_bug.cgi?id=72854
+
+        Reviewed by Darin Adler.
+
+        - Removed exp files and corresponding makefile entries.
+        - Changed the build configuration no to use exp file.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.JSVALUE32_64only.exp: Removed.
+        * JavaScriptCore.JSVALUE64only.exp: Removed.
+        * JavaScriptCore.exp: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Platform.h:
+
+2012-02-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Running a Web Worker on about:blank crashes the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=77593
+
+        Reviewed by Michael Saboff.
+
+        The method Interpreter::execute() was crashing on empty programs because
+        the assumption is made the source is not null.
+
+        This patch shortcut the execution when the String is null to avoid invalid
+        memory access.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2012-02-02  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Use win32 native threading
+        https://bugs.webkit.org/show_bug.cgi?id=77676
+
+        Reviewed by Martin Robinson.
+
+        r97269 switched from glib threading to pthreads, breaking win32 GTK+.
+        This is a follow up, removing some leftovers in ThreadSpecific.h and
+        switching win32 to use the native threading in ThreadingWin.cpp.
+
+        * GNUmakefile.list.am: Compile in win32 native threading support
+        * wtf/ThreadSpecific.h: Remove GTK+-specific definitions
+        (ThreadSpecific):
+        (WTF::::destroy):
+
+2012-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        retrieveCallerFromVMCode should call trueCallerFrame
+        https://bugs.webkit.org/show_bug.cgi?id=77684
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+
+2012-02-02  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Implement current executable path finding for win32
+        https://bugs.webkit.org/show_bug.cgi?id=77677
+
+        Reviewed by Martin Robinson.
+
+        The WTF helper for getting the binary path that was added in r101710
+        left out the win32 implementation. Fix this.
+
+        * wtf/gobject/GlibUtilities.cpp:
+        (getCurrentExecutablePath):
+
+2012-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Throwing away bytecode and then reparsing during DFG optimization is just
+        plain wrong and makes things crash
+        https://bugs.webkit.org/show_bug.cgi?id=77680
+        <rdar://problem/10798490>
+
+        Reviewed by Oliver Hunt.
+
+        This is the minimal surgical fix: it removes the code that triggered bytecode
+        throw-away. Once we're confident that this is a good idea, we can kill all of
+        the code that implements the feature.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::discardBytecodeLater):
+        (JSC::CodeBlock::addValueProfile):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+
+2012-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Release build debugging should be easier
+        https://bugs.webkit.org/show_bug.cgi?id=77669
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/ARMAssembler.h:
+        (ARMAssembler):
+        (JSC::ARMAssembler::debugOffset):
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::debugOffset):
+        (ARMInstructionFormatter):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::debugOffset):
+        * assembler/AbstractMacroAssembler.h:
+        (AbstractMacroAssembler):
+        (JSC::AbstractMacroAssembler::debugOffset):
+        * assembler/AssemblerBuffer.h:
+        (AssemblerBuffer):
+        (JSC::AssemblerBuffer::debugOffset):
+        * assembler/LinkBuffer.h:
+        (LinkBuffer):
+        (JSC::LinkBuffer::debugSize):
+        * assembler/MIPSAssembler.h:
+        (MIPSAssembler):
+        (JSC::MIPSAssembler::debugOffset):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::debugOffset):
+        (X86InstructionFormatter):
+        (JSC::X86Assembler::X86InstructionFormatter::debugOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/CodeOrigin.h:
+        (CodeOrigin):
+        (JSC):
+        (JSC::CodeOrigin::inlineStack):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * bytecode/DataFormat.h:
+        (JSC::dataFormatToString):
+        * bytecode/PredictedType.cpp:
+        (JSC):
+        (JSC::predictionToString):
+        * bytecode/PredictedType.h:
+        (JSC):
+        * bytecode/ValueRecovery.h:
+        (ValueRecovery):
+        (JSC::ValueRecovery::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC):
+        (JSC::BytecodeGenerator::setDumpsGeneratedCode):
+        (JSC::BytecodeGenerator::dumpsGeneratedCode):
+        (JSC::BytecodeGenerator::generate):
+        * dfg/DFGAbstractValue.h:
+        (StructureAbstractValue):
+        (JSC::DFG::StructureAbstractValue::dump):
+        (AbstractValue):
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGAssemblyHelpers.h:
+        (DFG):
+        (AssemblyHelpers):
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        * dfg/DFGFPRInfo.h:
+        (FPRInfo):
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h:
+        (GPRInfo):
+        (JSC::DFG::GPRInfo::debugName):
+        * dfg/DFGGraph.cpp:
+        (DFG):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::arithNodeFlagsAsString):
+        (Node):
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::dumpChildren):
+        * dfg/DFGOSRExit.cpp:
+        (DFG):
+        (JSC::DFG::OSRExit::dump):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * runtime/JSValue.cpp:
+        (JSC):
+        (JSC::JSValue::description):
+        * runtime/JSValue.h:
+        (JSValue):
+        * wtf/BitVector.cpp:
+        (WTF):
+        (WTF::BitVector::dump):
+        * wtf/BitVector.h:
+        (BitVector):
+
+2012-02-02  Oliver Hunt  <oliver@apple.com>
+
+        Getters and setters cause line numbers in errors/console.log to be offset for the whole file
+        https://bugs.webkit.org/show_bug.cgi?id=77675
+
+        Reviewed by Timothy Hatcher.
+
+        Our default literal parsing logic doesn't handle the extra work required for
+        getters and setters.  When it encounters one, it rolls back the lexer and 
+        then switches to a more complete parsing function.  Unfortunately it was only
+        winding back the character position, and was ignoring the line number and
+        other lexer data.  This led to every getter and setter causing the line number
+        to be incorrectly incremented leading to increasingly incorrect numbers for
+        the rest of the file.
+
+        * parser/Parser.cpp:
+        (JSC::::parseObjectLiteral):
+
+2012-02-02  Andy Wingo  <wingo@igalia.com>
+
+        Fix type punning warning in HashTable.h debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=77422
+
+        Reviewed by Gavin Barraclough.
+
+        * wtf/HashTable.h (WTF::HashTable::checkKey): Fix type punning
+        warning appearing in debug builds with gcc-4.6.2 on GNU/Linux.
+
+2012-02-01  Michael Saboff  <msaboff@apple.com>
+
+        Yarr crash with regexp replace
+        https://bugs.webkit.org/show_bug.cgi?id=67454
+
+        Reviewed by Gavin Barraclough.
+
+        Properly handle the case of a back reference to an unmatched
+        subpattern by always matching without consuming any characters.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+
+2012-02-01  Gavin Barraclough  <barraclough@apple.com>
+
+        calling function on catch block scope containing an eval result in wrong this value being passed
+        https://bugs.webkit.org/show_bug.cgi?id=77581
+
+        Reviewed by Oliver Hunt.
+
+        javascript:function F(){ return 'F' in this; }; try { throw F; } catch (e) { eval(""); alert(e()); }
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createTryStatement):
+        * parser/NodeConstructors.h:
+        (JSC::TryNode::TryNode):
+        * parser/Nodes.h:
+        (TryNode):
+        * parser/Parser.cpp:
+        (JSC::::parseTryStatement):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createTryStatement):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::isStaticScopeObject):
+        (JSC):
+
+2012-02-01  Oliver Hunt  <oliver@apple.com>
+
+        Add support for inferred function names
+        https://bugs.webkit.org/show_bug.cgi?id=77579
+
+        Reviewed by Gavin Barraclough.
+
+        Add new "inferred" names to function expressions, getters, and setters.
+        This property is not exposed to JS, so is only visible in the debugger
+        and profiler.
+
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::makeAssignNode):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setInferredName):
+        (JSC::FunctionBodyNode::inferredName):
+        (FunctionBodyNode):
+        * profiler/Profiler.cpp:
+        (JSC):
+        (JSC::Profiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::inferredName):
+        (FunctionExecutable):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::calculatedDisplayName):
+        (JSC):
+        (JSC::getCalculatedDisplayName):
+        * runtime/JSFunction.h:
+        (JSC):
+
+2012-02-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should fold double-to-int conversions
+        https://bugs.webkit.org/show_bug.cgi?id=77532
+
+        Reviewed by Oliver Hunt.
+        
+        Performance neutral on major benchmarks. But it makes calling V8's
+        Math.random() 4x faster.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::addOrFindConstant):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addConstant):
+        (CodeBlock):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getJSConstantForValue):
+        (JSC::DFG::ByteCodeParser::isInt32Constant):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateInteger):
+        (Graph):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::doRoundOfDoubleVoting):
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::valueOfNumberConstantAsInt32):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSValueInlineMethods.h:
+        (JSC::JSValue::asDouble):
+
+2012-02-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG graph dump for GetScopedVar should show the correct prediction
+        https://bugs.webkit.org/show_bug.cgi?id=77530
+
+        Reviewed by Geoff Garen.
+        
+        GetScopedVar has a heap prediction, not a variable prediction. But it does
+        have a variable. Hence we need to check for heap predictions before checking
+        for variable predictions.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+
+2012-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Replace JSArray destructor with finalizer
+        https://bugs.webkit.org/show_bug.cgi?id=77488
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.exp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::finalize): Added finalizer.
+        (JSC::JSArray::allocateSparseMap): Factored out code for allocating new sparse maps.
+        (JSC):
+        (JSC::JSArray::deallocateSparseMap): Factored out code for deallocating sparse maps.
+        (JSC::JSArray::enterDictionaryMode): Renamed enterSparseMode to enterDictionaryMode 
+        because the old name was confusing because we could have a sparse array that never 
+        called enterSparseMode.
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::setLengthWritable):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSArray):
+
+2012-02-01  Andy Wingo  <wingo@igalia.com>
+
+        Refactor identifier resolution in BytecodeGenerator
+        https://bugs.webkit.org/show_bug.cgi?id=76285
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ResolveResult): New class, to describe the storage
+        location corresponding to an identifier in a program.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve): New function, replacing
+        findScopedProperty.
+        (JSC::BytecodeGenerator::resolveConstDecl): New function,
+        encapsulating what ConstDeclNode::emitBytecode used to do.
+        (JSC::BytecodeGenerator::emitGetStaticVar):
+        (JSC::BytecodeGenerator::emitPutStaticVar): New functions,
+        corresponding to the old emitGetScopedVar and emitPutScopedVar.
+        (JSC::BytecodeGenerator::registerFor): Remove version that took an
+        Identifier&; replaced by ResolveResult::local().
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveWithThis): Change to accept a
+        "resolveResult" argument.  This is more clear, and reduces the
+        amount of double analysis happening at compile-time.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode): Refactor to use the new
+        ResolveResult structure.
+
+2012-02-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Implement Error.stack
+        https://bugs.webkit.org/show_bug.cgi?id=66994
+
+        Unreviewed, rolling out r106407.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+        (JSC):
+
+2012-01-31  Hajime Morrita  <morrita@chromium.org>
+
+        Add missing JS_PRIVATE_EXPORTs
+        https://bugs.webkit.org/show_bug.cgi?id=77507
+
+        Reviewed by Kevin Ollivier.
+
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * runtime/JSValue.h:
+        (JSValue):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::add):
+        * wtf/text/WTFString.h:
+        (WTF):
+
+2012-01-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Stop using -fomit-frame-pointer
+        https://bugs.webkit.org/show_bug.cgi?id=77403
+
+        Reviewed by Filip Pizlo.
+        
+        JavaScriptCore is too fast. I'm just the man to fix it.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2012-01-31  Michael Saboff  <msaboff@apple.com>
+
+        StringProtoFuncToUpperCase should call StringImpl::upper similar to StringProtoToLowerCase
+        https://bugs.webkit.org/show_bug.cgi?id=76647
+
+        Reviewed by Darin Adler.
+
+        Changed stringProtoFuncToUpperCase to call StringImpl::upper() in a manor similar
+        to stringProtoFuncToLowerCase().  Fixed StringImpl::upper() to handle to special
+        cases.  One case is s-sharp (0xdf) which converts to "SS".  The other case is 
+        for characters which become 16 bit values when converted to upper case.  For
+        those, we up convert the the source string and use the 16 bit path.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToUpperCase):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::upper):
+        * wtf/unicode/CharacterNames.h:
+        (smallLetterSharpS): New constant
+
+2012-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Remove unneeded sourceId property
+        https://bugs.webkit.org/show_bug.cgi?id=77495
+
+        Reviewed by Filip Pizlo.
+
+        sourceId isn't used anymore, so we'll just remove it.
+
+        * runtime/Error.cpp:
+        (JSC):
+        (JSC::addErrorInfo):
+        (JSC::hasErrorInfo):
+
+2012-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Implement Error.stack
+        https://bugs.webkit.org/show_bug.cgi?id=66994
+
+        Reviewed by Gavin Barraclough.
+
+        Original patch by Juan Carlos Montemayor Elosua:
+            This patch utilizes topCallFrame to create a stack trace when
+            an error is thrown. Users will also be able to use the stack()
+            command in jsc to get arrays with stack trace information.
+
+        Modified to be correct on ToT, with a variety of correctness,
+        performance, and security improvements.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerLine):
+        (JSC::getSourceURLFromCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::throwException):
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::toString):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionJSCStack):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+
+2012-01-31  Scott Graham  <scottmg@chromium.org>
+
+        [Chromium] Remove references to gyp cygwin build target
+        https://bugs.webkit.org/show_bug.cgi?id=77253
+
+        Reviewed by Julien Chaffraix.
+
+        Target dependency is no longer required, it's done earlier in the
+        build process.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2012-01-31  Michael Saboff  <msaboff@apple.com>
+
+        ASSERT(m_jumpsToLink.isEmpty()) failing in ARMv7Assembler dtor
+        https://bugs.webkit.org/show_bug.cgi?id=77443
+
+        Reviewed by Gavin Barraclough.
+
+        Removed failing ASSERT() and thus destructor.  The ASSERT isn't needed.
+        We are hitting it in the YARR JIT case where we bail out and go to the
+        interpreter with a partially JIT'ed function.  Since we haven't linked
+        the JIT'ed code, there is likely to be some unresolved jumps in the vector
+        when the ARMv7Assembler destructor is called.  For the case where we
+        complete the JIT process, we clear the vector at the end of
+        LinkBuffer::linkCode (LinkBuffer.h:292).
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+
+2012-01-31  Anders Carlsson  <andersca@apple.com>
+
+        Vector<T>::operator== shouldn't require T to have operator!=
+        https://bugs.webkit.org/show_bug.cgi?id=77448
+
+        Reviewed by Andreas Kling.
+
+        Change VectorComparer::compare to use !(a == b) instead of a != b since
+        it makes more sense for Vector::operator== to use the element's operator==.
+
+        * wtf/Vector.h:
+
+2012-01-30  Oliver Hunt  <oliver@apple.com>
+
+        get_by_val_arguments is broken in the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=77389
+
+        Reviewed by Gavin Barraclough.
+
+        When get_by_val had wad a value profile added, the same slot was not added to
+        get_by_val_arguments.  This broke the interpreter as the interpreter falls
+        back on its regular get_by_val implementation.
+
+        No tests are added as the interpreter is fairly broken in its
+        current state (multiple tests fail due to this bug).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        ():
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetArgumentByVal):
+
+2012-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Unexpected syntax error
+        https://bugs.webkit.org/show_bug.cgi?id=77340
+
+        Reviewed by Gavin Barraclough.
+
+        Function calls and new expressions have the same semantics for
+        assignment, so should simply share their lhs handling.
+
+        * parser/Parser.cpp:
+        (JSC::::parseMemberExpression):
+
+2012-01-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed ARMv7 build fix.
+
+        * tools/CodeProfiling.cpp:
+        (JSC):
+        (JSC::setProfileTimer):
+        (JSC::CodeProfiling::begin):
+        (JSC::CodeProfiling::end):
+
+2012-01-30  David Levin  <levin@chromium.org>
+
+        Using OS(WIN) or OS(MAC) should cause a build error.
+        https://bugs.webkit.org/show_bug.cgi?id=77162
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Expand them into something that will
+         cause a compile error.
+
+2012-01-30  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] OS(QNX) also has TM_GMTOFF, TM_ZONE, and TIMEGM
+        https://bugs.webkit.org/show_bug.cgi?id=77360
+
+        Reviewed by Rob Buis.
+
+        Turn on HAVE(TM_GMTOFF), HAVE(TM_ZONE), and HAVE(TIMEGM)
+        for OS(QNX).
+
+        * wtf/Platform.h:
+
+2012-01-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative Windows build fix.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (FunctionPtr):
+
+2012-01-30  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=77163
+        MacroAssemblerCodeRef.h uses OS(WIN) instead of OS(WINDOWS)
+
+        Rubber stamped by Geoff Garen
+
+        * assembler/MacroAssemblerCodeRef.h:
+
+2012-01-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed build fix for interpreter builds.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::sample):
+
+2012-01-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed build fix following bug#76855
+
+        * JavaScriptCore.exp:
+
+2012-01-30  Michael Saboff  <msaboff@apple.com>
+
+        CaseFoldingHash::hash() doesn't handle 8 bit strings directly
+        https://bugs.webkit.org/show_bug.cgi?id=76652
+
+        Reviewed by Andreas Kling.
+
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::hash): Added 8 bit string code path.
+
+2012-01-30  Michael Saboff  <msaboff@apple.com>
+
+        stringProtoFuncReplace converts 8 bit strings to 16 bit during replacement
+        https://bugs.webkit.org/show_bug.cgi?id=76651
+
+        Reviewed by Geoffrey Garen.
+
+        Made local function substituteBackreferencesSlow a template function
+        based on character width.  Cleaned up getCharacters() in both UString
+        and StringImpl.  Changed getCharacters<UChar> to up convert an 8 bit
+        string to 16 bits if necessary.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+        * runtime/UString.h:
+        (JSC::LChar):
+        (JSC::UChar):
+        * wtf/text/StringImpl.h:
+        (WTF::UChar):
+
+2012-01-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Clean up putDirect
+        https://bugs.webkit.org/show_bug.cgi?id=76232
+
+        Reviewed by Sam Weinig.
+
+        Part 3 - merge op_put_getter & op_put_setter.
+
+        Putting these separately is inefficient (and makes future optimiation,
+        e.g. making GetterSetter immutable) harder. Change to emit a single
+        op_put_getter_setter bytecode op. Ultimately we should probably be
+        able to merge this with put direct, to create a common op to initialize
+        object literal properties.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        ():
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutGetterSetter):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_getter_setter):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter_setter):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        ():
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectVirtual):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        ():
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+
+2012-01-30  Michael Saboff  <msaboff@apple.com>
+
+        Dromaeo tests call parseSimpleLengthValue() on 8 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=76649
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.exp: Added export for charactersToDouble.
+
+2012-01-30  Michael Saboff  <msaboff@apple.com>
+
+        WebCore decodeEscapeSequences unnecessarily converts 8 bit strings to 16 bit when decoding.
+        https://bugs.webkit.org/show_bug.cgi?id=76648
+
+        Reviewed by Geoffrey Garen.
+
+        Added a new overloaded append member that takes a String& argument, an offest
+        and a length to do direct sub string appending to a StringBuilder.
+
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::append):
+
+2012-01-29  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Custom written CSS lexer
+        https://bugs.webkit.org/show_bug.cgi?id=70107
+
+        Reviewed by Antti Koivisto and Oliver Hunt.
+
+        Add new helper functions for the custom written CSS lexer.
+
+        * wtf/ASCIICType.h:
+        (WTF::toASCIILowerUnchecked):
+        (WTF):
+        (WTF::isASCIIAlphaCaselessEqual):
+
+2012-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r105576-r105582): Web Inspector Crash in JSC::JSValue::toString(JSC::ExecState*) const
+        https://bugs.webkit.org/show_bug.cgi?id=77146
+        <rdar://problem/10770586>
+
+        Reviewed by Oliver Hunt.
+        
+        The old JIT expects that the result of the last operation is in the lastResultRegister.  The DFG JIT is
+        designed to correctly track the lastResultRegister by looking at SetLocal nodes.  However, when the DFG
+        JIT inlines a code block, it forgets that the inlined code block's result would have been placed in the
+        lastResultRegister.  Hence if we OSR exit on the first node following the end of an inlined code block
+        that had a return value, and that first node uses the return value, the old JIT will get massively
+        confused.  This patch takes a surgical approach: instead of making the DFG smarter, it makes the old
+        JIT slightly dumber.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_call_put_result):
+
+2012-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for Mac non-x64 platforms.
+
+        * tools/CodeProfiling.cpp:
+        (JSC):
+
+2012-01-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reserve 'let'
+        https://bugs.webkit.org/show_bug.cgi?id=77293
+
+        Rubber stamped by Oliver Hunt.
+
+        'let' may become a keyword in ES6.  We're going to try experimentally reserving it,
+        to see if this breaks the web.
+
+        * parser/Keywords.table:
+
+2012-01-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement a JIT-code aware sampling profiler for JSC
+        https://bugs.webkit.org/show_bug.cgi?id=76855
+
+        Reviewed by Oliver Hunt.
+
+        To enable the profiler, set the JSC_CODE_PROFILING environment variable to
+        1 (no tracing the C stack), 2 (trace one level of C code) or 3 (recursively
+        trace all samples).
+
+        The profiler requires -fomit-frame-pointer to be removed from the build flags.
+
+        * JavaScriptCore.exp:
+            - Removed an export.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Added new files
+        * bytecode/CodeBlock.cpp:
+            - For baseline codeblocks, cache the result of canCompileWithDFG.
+        * bytecode/CodeBlock.h:
+            - For baseline codeblocks, cache the result of canCompileWithDFG.
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::initializeAllocator):
+            - Notify the profiler when the allocator is created.
+        (JSC::ExecutableAllocator::allocate):
+            - Inform the allocated of the ownerUID.
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::initializeAllocator):
+            - Notify the profiler when the allocator is created.
+        (JSC::ExecutableAllocator::allocate):
+            - Inform the allocated of the ownerUID.
+        * jit/JITStubs.cpp:
+            - If profiling, don't mask the return address in JIT code.
+              (We do so to provide nicer backtraces in debug builds).
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+            - Notify the profiler of script evaluations.
+        * tools: Added.
+        * tools/CodeProfile.cpp: Added.
+        (JSC::symbolName):
+            - Helper function to get the name of a symbol in the framework.
+        (JSC::truncateTrace):
+            - Helper to truncate traces into methods know to have uninformatively deep stacks.
+        (JSC::CodeProfile::sample):
+            - Record a stack trace classifying samples.
+        (JSC::CodeProfile::report):
+            - {Print profiler output.
+        * tools/CodeProfile.h: Added.
+            - new class, captures a set of samples associated with an evaluated script,
+              and nested to record samples from subscripts.
+        * tools/CodeProfiling.cpp: Added.
+        (JSC::CodeProfiling::profilingTimer):
+            - callback fired then a timer event occurs.
+        (JSC::CodeProfiling::notifyAllocator):
+            - called when the executable allocator is constructed.
+        (JSC::CodeProfiling::getOwnerUIDForPC):
+            - helper to lookup the codeblock from an address in JIT code
+        (JSC::CodeProfiling::begin):
+            - enter a profiling scope.
+        (JSC::CodeProfiling::end):
+            - exit a profiling scope.
+        * tools/CodeProfiling.h: Added.
+            - new class, instantialed from Completion to define a profiling scope.
+        * tools/ProfileTreeNode.h: Added.
+            - new class, used to construct a tree of samples.
+        * tools/TieredMMapArray.h: Added.
+            - new class, a malloc-free vector (can be used while the main thread is suspended,
+              possibly holding the malloc heap lock).
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocatorHandle::MetaAllocatorHandle):
+        (WTF::MetaAllocator::allocate):
+            - Allow allocation handles to track information about their owner.
+        * wtf/MetaAllocator.h:
+        (MetaAllocator):
+            - Allow allocation handles to track information about their owner.
+        * wtf/MetaAllocatorHandle.h:
+        (MetaAllocatorHandle):
+        (WTF::MetaAllocatorHandle::ownerUID):
+            - Allow allocation handles to track information about their owner.
+        * wtf/OSAllocator.h:
+        (WTF::OSAllocator::reallocateCommitted):
+            - reallocate an existing, committed memory allocation.
+
+2012-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r106187.
+        http://trac.webkit.org/changeset/106187
+        https://bugs.webkit.org/show_bug.cgi?id=77276
+
+        The last rollout was a false charge. (Requested by morrita on
+        #webkit).
+
+        * runtime/ExceptionHelpers.h:
+        (InterruptedExecutionError):
+        * runtime/JSBoundFunction.h:
+        (JSBoundFunction):
+        * runtime/RegExp.h:
+        (RegExp):
+        * runtime/RegExpMatchesArray.h:
+        (RegExpMatchesArray):
+
+2012-01-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r106151.
+        http://trac.webkit.org/changeset/106151
+        https://bugs.webkit.org/show_bug.cgi?id=77275
+
+        may break windows build (Requested by morrita on #webkit).
+
+        * runtime/ExceptionHelpers.h:
+        (InterruptedExecutionError):
+        * runtime/JSBoundFunction.h:
+        (JSBoundFunction):
+        * runtime/RegExp.h:
+        (RegExp):
+        * runtime/RegExpMatchesArray.h:
+        (RegExpMatchesArray):
+
+2012-01-28  Filip Pizlo  <fpizlo@apple.com>
+
+        GC invoked while doing an old JIT property storage reallocation may lead
+        to an object that refers to a dead structure
+        https://bugs.webkit.org/show_bug.cgi?id=77273
+        <rdar://problem/10770565>
+
+        Reviewed by Gavin Barraclough.
+        
+        The put_by_id transition was already saving the old structure by virtue of
+        having the object on the stack, so that wasn't going to get deleted. But the
+        new structure was unprotected in the transition. I've now changed the
+        transition code to save the new structure, ensuring that the GC will know it
+        to be marked if invoked from within put_by_id_transition_realloc.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC):
+        ():
+
+2012-01-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r106167.
+        http://trac.webkit.org/changeset/106167
+        https://bugs.webkit.org/show_bug.cgi?id=77264
+
+        broke LayoutTests/fast/js/string-capitalization.html
+        (Requested by msaboff on #webkit).
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::upper):
+
+2012-01-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for interpreter platforms.
+
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+
+2012-01-27  Michael Saboff  <msaboff@apple.com>
+
+        StringProtoFuncToUpperCase should call StringImpl::upper similar to StringProtoToLowerCase
+        https://bugs.webkit.org/show_bug.cgi?id=76647
+
+        Reviewed by Geoffrey Garen.
+
+        Changed stringProtoFuncToUpperCase to call StringImpl::upper() is a manor similar
+        to stringProtoFuncToLowerCase().  Fixed StringImpl::upper() to handle the two
+        8 bit characters that when converted to upper case become 16 bit characters.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToLowerCase): Removed extra trailing whitespace.
+        (JSC::stringProtoFuncToUpperCase):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::upper):
+
+2012-01-27  Hajime Morita  <morrita@google.com>
+
+        [JSC] ThunkGenerators.cpp should hide its asm-defined symbols
+        https://bugs.webkit.org/show_bug.cgi?id=77244
+
+        Reviewed by Filip Pizlo.
+
+        * jit/ThunkGenerators.cpp: Added HIDE_SYMBOLS()
+        * wtf/InlineASM.h: Moved some duplicated macros from ThunkGenerators.cpp
+
+2012-01-27  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [JSC] Asm-originated symbols should be marked as hidden
+        https://bugs.webkit.org/show_bug.cgi?id=77150
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGOperations.cpp: The HIDE_SYMBOLS macros were present in the CPU(ARM) preprocessor branches,
+        but they were missing in the CPU(X86) and the CPU(X86_64) cases.
+
+2012-01-27  MORITA Hajime  <morrita@google.com>
+
+        [JSC] Some JS_EXPORTDATA may not be necessary.
+        https://bugs.webkit.org/show_bug.cgi?id=77145
+
+        Reviewed by Darin Adler.
+
+        Removed JS_EXPORTDATA attributes whose attributing symbols are
+        not exported on Mac port.
+        
+        * runtime/ExceptionHelpers.h:
+        (InterruptedExecutionError):
+        * runtime/JSBoundFunction.h:
+        (JSBoundFunction):
+        * runtime/RegExp.h:
+        (RegExp):
+        * runtime/RegExpMatchesArray.h:
+        (RegExpMatchesArray):
+
+2012-01-27  MORITA Hajime  <morrita@google.com>
+
+        [WTF] WTFString.h has some extra JS_EXPORT_PRIVATEs
+        https://bugs.webkit.org/show_bug.cgi?id=77113
+
+        Reviewed by Darin Adler.
+
+        * wtf/text/WTFString.h: Removed some WTF_EXPORT_PRIVATE attributes which we don't need to export.
+
+2012-01-27  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt][Mac] Build fails after adding ICU support (r105997).
+        https://bugs.webkit.org/show_bug.cgi?id=77118
+
+        Use Apple code path for unicode date formats on mac.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * runtime/DatePrototype.cpp:
+        ():
+
+2012-01-27  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add a GKeyFile especialization to GOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=77191
+
+        Reviewed by Martin Robinson.
+
+        * wtf/gobject/GOwnPtr.cpp:
+        (WTF::GKeyFile): Implement freeOwnedGPtr for GKeyFile.
+        * wtf/gobject/GOwnPtr.h: Add GKeyFile template.
+        * wtf/gobject/GTypedefs.h: Add forward declaration for GKeyFile.
+
+2012-01-25  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: should be possible to open function declaration from script popover
+        https://bugs.webkit.org/show_bug.cgi?id=76913
+
+        Added display function name and source location to the popover in scripts panel.
+        Now when a function is hovered user can navigate to its definition.
+
+        Reviewed by Pavel Feldman.
+
+        * JavaScriptCore/JavaScriptCore.exp
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSFunction.h:
+        (JSFunction):
+
+2012-01-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed. Build fix, wx uses the Mac ICU headers so we must match Mac behavior.
+        
+        * runtime/DatePrototype.cpp:
+        ():
+
+2012-01-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Merge AllocationSpace into MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=77116
+
+        Reviewed by Geoffrey Garen.
+
+        Merging AllocationSpace and MarkedSpace in preparation for future refactoring/enhancement to 
+        MarkedSpace allocation.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/AllocationSpace.cpp: Removed.
+        * heap/AllocationSpace.h: Removed.
+        * heap/BumpSpace.h:
+        (BumpSpace):
+        * heap/Heap.h:
+        (JSC::Heap::objectSpace):
+        (Heap):
+        ():
+        * heap/HeapBlock.h:
+        ():
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::tryAllocateHelper):
+        (JSC):
+        (JSC::MarkedSpace::tryAllocate):
+        (JSC::MarkedSpace::allocateSlowCase):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlocks):
+        (TakeIfUnmarked):
+        (JSC::TakeIfUnmarked::TakeIfUnmarked):
+        (JSC::TakeIfUnmarked::operator()):
+        (JSC::TakeIfUnmarked::returnValue):
+        (JSC::MarkedSpace::shrink):
+        (GatherDirtyCells):
+        (JSC::GatherDirtyCells::returnValue):
+        (JSC::GatherDirtyCells::GatherDirtyCells):
+        (JSC::GatherDirtyCells::operator()):
+        (JSC::MarkedSpace::gatherDirtyCells):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC::MarkedSpace::blocks):
+        (JSC::MarkedSpace::forEachCell):
+        (JSC):
+        (JSC::MarkedSpace::allocate):
+
+2012-01-26  Oliver Hunt  <oliver@apple.com>
+
+        MSVC bug fix.
+        <rdar://problem/10703671> MSVC generates bad code for enum compare.
+
+        RS=Geoff
+
+        Make bitfield large enough to work around MSVC's desire to make enums
+        signed types.
+
+        * bytecode/CallLinkInfo.h:
+        (CallLinkInfo):
+
+2012-01-26  Filip Pizlo  <fpizlo@apple.com>
+
+        All DFG helpers that may call out to arbitrary JS code must know where they
+        were called from due to inlining and call stack walking
+        https://bugs.webkit.org/show_bug.cgi?id=77070
+        <rdar://problem/10750834>
+
+        Reviewed by Geoff Garen.
+        
+        Changed the DFG to always record a code origin index in the tag of the argument
+        count (which we previously left blank for the benefit of LLInt, but is still
+        otherwise unused by the DFG), so that if we ever need to walk the stack accurately
+        we know where to start. In particular, if the current ExecState* points several
+        semantic call frames away from the true semantic call frame because we had
+        performed inlining, having the code origin index recorded means that we can reify
+        those call frames as necessary to give runtime/library code an accurate view of
+        the current JS state.
+        
+        This required several large but mechanical changes:
+        
+        - Calling a function from the DFG now plants a store32 instruction to store the
+          code origin index. But the indices of code origins were previously picked by
+          the DFG::JITCompiler after code generation completed. I changed this somewhat;
+          even though the code origins are put into the CodeBlock after code gen, the
+          code gen now knows a priori what their indices will be. Extensive assertions
+          are in place to ensure that the two don't get out of sync, in the form of the
+          DFG::CallBeginToken. Note that this mechanism has almost no effect on JS calls;
+          those don't need the code origin index set in the call frame because we can get
+          it by doing a binary search on the return PC.
+
+        - Stack walking now always calls trueCallFrame() first before beginning the walk,
+          since even the top call frame may be wrong. It still calls trueCallerFrame() as
+          before to get to the next frame, though trueCallerFrame() is now mostly a
+          wrapper around callerFrame()->trueCallFrame().
+          
+        - Because the mechanism for getting the code origin of a call frame is bimodal
+          (either the call frame knows its code origin because the code origin index was
+          set, or it's necessary to use the callee frame's return PC), I put in extra
+          mechanisms to determine whether your caller, or your callee, corresponds to
+          a call out of C++ code. Previously we just had the host call flag, but this is
+          insufficient as it does not cover the case of someone calling JSC::call(). But
+          luckily we can determine this just by looking at the return PC: if the return
+          PC is in range of the ctiTrampiline, then two things are true: this call
+          frame's PC will tell you nothing about where you came from in your caller, and
+          the caller already knows where it's at because it must have set the code origin
+          index (unless it's not DFG code, in which case we don't care because there is
+          no inlining to worry about).
+          
+        - During testing this revealed a simple off-by-one goof in DFG::ByteCodeParser's
+          inlining code, so I fixed it.
+
+        - Finally because I was tired of doing random #if's for checking if I should be
+          passing around an Instruction* or a ReturnAddressPtr, I created a class called
+          AbstractPC that holds whatever notion of a PC is appropriate for the current
+          execution environment. It's designed to work gracefully even if both the
+          interpreter and the JIT are compiled in, and should integrate nicely with the
+          LLInt.
+          
+        This is neutral on all benchmarks and fixes some nasty corner-case regressions of
+        evil code that uses combinations of getters/setters and function.arguments.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::codeOrigin):
+        (CodeBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (CallBeginToken):
+        (JSC::DFG::CallBeginToken::CallBeginToken):
+        (JSC::DFG::CallBeginToken::assertCodeOriginIndex):
+        (JSC::DFG::CallBeginToken::assertNoCodeOriginIndex):
+        (DFG):
+        (JSC::DFG::CallExceptionRecord::CallExceptionRecord):
+        (CallExceptionRecord):
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::nextCallBeginToken):
+        (JSC::DFG::JITCompiler::beginCall):
+        (JSC::DFG::JITCompiler::notifyCall):
+        (JSC::DFG::JITCompiler::addExceptionCheck):
+        (JSC::DFG::JITCompiler::addFastExceptionCheck):
+        * dfg/DFGOperations.cpp:
+        ():
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * interpreter/AbstractPC.cpp: Added.
+        (JSC):
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/AbstractPC.h: Added.
+        (JSC):
+        (AbstractPC):
+        (JSC::AbstractPC::AbstractPC):
+        (JSC::AbstractPC::hasJITReturnAddress):
+        (JSC::AbstractPC::jitReturnAddress):
+        (JSC::AbstractPC::hasInterpreterReturnAddress):
+        (JSC::AbstractPC::interpreterReturnAddress):
+        (JSC::AbstractPC::isSet):
+        (JSC::AbstractPC::operator!):
+        ():
+        * interpreter/CallFrame.cpp:
+        (JSC):
+        (JSC::CallFrame::trueCallFrame):
+        (JSC::CallFrame::trueCallerFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::abstractReturnPC):
+        (JSC::ExecState::codeOriginIndexForDFGWithInlining):
+        (ExecState):
+        (JSC::ExecState::trueCallFrame):
+        (JSC::ExecState::trueCallFrameFromVMCode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArgumentsFromVMCode):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        (JSC::Interpreter::findFunctionCallFrameFromVMCode):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        ():
+        * jit/JITStubs.cpp:
+        (JSC):
+        ():
+        * jit/JITStubs.h:
+        (JSC):
+        (JSC::returnAddressIsInCtiTrampoline):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+
+2012-01-26  Peter Varga  <pvarga@webkit.org>
+
+        Fix build when VERBOSE_SPECULATION_FAILURE is enabled in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=77104
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGOperations.cpp:
+        ():
+
+2012-01-26  Michael Saboff  <msaboff@apple.com>
+
+        String::latin1() should take advantage of 8 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=76646
+
+        Reviewed by Geoffrey Garen.
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::latin1): For 8 bit strings, use existing buffer
+        without conversion.
+
+2012-01-26  Michael Saboff  <msaboff@apple.com>
+
+        Dromaeo tests usage of StringImpl find routines cause 8->16 bit conversions
+        https://bugs.webkit.org/show_bug.cgi?id=76645
+
+        Reviewed by Geoffrey Garen.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::equalIgnoringCase): New LChar version.
+        (WTF::findInner): New helper function.
+        (WTF::StringImpl::find): Added 8 bit path.
+        (WTF::reverseFindInner): New helper funciton.
+        (WTF::StringImpl::reverseFind): Added 8 bit path.
+        (WTF::StringImpl::reverseFindIgnoringCase): Added 8 bit path.
+        * wtf/text/StringImpl.h:
+        (WTF):
+
+2012-01-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][Win] One more speculative buildfix after r105970.
+
+        * JavaScriptCore.pri:
+
+2012-01-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][Win] Speculative buildfix after r105970.
+
+        * JavaScriptCore.pri: Link lgdi for DeleteObject() and DeleteDC().
+
+2012-01-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r105982.
+        http://trac.webkit.org/changeset/105982
+        https://bugs.webkit.org/show_bug.cgi?id=77090
+
+        breaks the world (Requested by WildFox on #webkit).
+
+        * wtf/MainThread.cpp:
+        (WTF):
+        * wtf/Platform.h:
+        * wtf/mac/MainThreadMac.mm:
+        (WTF):
+        (WTF::registerGCThread):
+        (WTF::isMainThreadOrGCThread):
+
+2012-01-26  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
+
+        [Qt] GC should be parallel on Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=73309
+
+        Reviewed by Zoltan Herczeg.
+
+        These changes made the parallel gc feature available for Qt port.
+        The implementation of "registerGCThread" and "isMainThreadOrGCThread"
+        is moved from MainThreadMac.mm to the common MainThread.cpp to make
+        them available for other platforms.
+
+        Measurement results:
+        V8           speed-up:  1.071x as fast  [From: 746.1ms  To: 696.4ms ]
+        WindScorpion speed-up:  1.082x as fast  [From: 3490.4ms To: 3226.7ms]
+        V8 Splay     speed-up:  1.158x as fast  [From: 145.8ms  To: 125.9ms ]
+
+        Tested on Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz with 4-core.
+
+        * wtf/MainThread.cpp:
+        (WTF):
+        (WTF::registerGCThread):
+        (WTF::isMainThreadOrGCThread):
+        * wtf/Platform.h:
+        * wtf/mac/MainThreadMac.mm:
+
+2012-01-26  Andy Estes  <aestes@apple.com>
+
+        REGRESSION (r105555): Incorrect use of OS() macro breaks OwnPtr when used with Win32 data types
+        https://bugs.webkit.org/show_bug.cgi?id=77073
+
+        Reviewed by Ryosuke Niwa.
+        
+        r105555 changed PLATFORM(WIN) to OS(WIN), but WTF_OS_WIN isn't defined.
+        This should have been changed to OS(WINDOWS). This causes the
+        preprocessor to strip out Win32 data type overrides for deleteOwnedPtr,
+        causing allocations made by Win32 to be deleted by fastmalloc.
+
+        * wtf/OwnPtrCommon.h:
+        (WTF): Use OS(WINDOWS) instead of OS(WIN).
+
+2012-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Attempted Mac build fix after r105939.
+
+        * runtime/DatePrototype.cpp: Don't #include unicode/udat.h on Mac or iOS.
+        It isn't used on these platforms and isn't available in the ICU headers
+        for Mac.
+
+2012-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Build in to an alternate location when USE_STAGING_INSTALL_PATH is set.
+
+        <rdar://problem/10609417> Adopt USE_STAGING_INSTALL_PATH
+
+        Reviewed by David Kilzer.
+
+        * Configurations/Base.xcconfig: Define NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR, which contains
+        the path where JavaScriptCore is normally installed. Update JAVASCRIPTCORE_FRAMEWORKS_DIR
+        to point to the staged frameworks directory when USE_STAGING_INSTALL_PATH is set.
+        * Configurations/JavaScriptCore.xcconfig: Always set the framework's install name based on
+        the normal framework location. This prevents an incorrect install name from being used when
+        installing in to the staged frameworks directory.
+
+2012-01-25  Eli Fidler  <efidler@rim.com>
+
+        Implement Date.toLocaleString() using ICU
+        https://bugs.webkit.org/show_bug.cgi?id=76714
+
+        Reviewed by Darin Adler.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2012-01-25  Hajime Morita  <morrita@google.com>
+
+        ENABLE_SHADOW_DOM should be available via build-webkit --shadow-dom
+        https://bugs.webkit.org/show_bug.cgi?id=76863
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a feature flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-01-25  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Implement OSAllocator::commit/decommit.
+        BlackBerry port should support virtual memory decommiting.
+        https://bugs.webkit.org/show_bug.cgi?id=77013
+
+        Reviewed by Rob Buis.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        * wtf/Platform.h:
+
+2012-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Make DFG update topCallFrame
+        https://bugs.webkit.org/show_bug.cgi?id=76969
+
+        Reviewed by Filip Pizlo.
+
+        Add NativeCallFrameTracer to manage topCallFrame assignment
+        in the DFG operations, and make use of it.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        ():
+        * interpreter/Interpreter.h:
+        (JSC):
+        (NativeCallFrameTracer):
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+
+2012-01-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Inlining breaks call frame walking when the walking is done from outside the inlinee,
+        but inside a code block that had inlining
+        https://bugs.webkit.org/show_bug.cgi?id=76978
+        <rdar://problem/10720904>
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::codeOriginForReturn):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallerFrame):
+
+2012-01-24  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=76855
+        Implement a JIT-code aware sampling profiler for JSC
+
+        Reviewed by Oliver Hunt.
+
+        Add support to MetaAllocator.cpp to track all live handles in a map,
+        allowing lookup based on any address within the allocation.
+
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocatorTracker::notify):
+        (WTF::MetaAllocatorTracker::release):
+            - Track live handle objects in a map.
+        (WTF::MetaAllocator::release):
+            - Removed support for handles with null m_allocator (no longer used).
+            - Notify the tracker of handles being released.
+        (WTF::MetaAllocatorHandle::~MetaAllocatorHandle):
+            - Moved functionality out into MetaAllocator::release.
+        (WTF::MetaAllocatorHandle::shrink):
+            - Removed support for handles with null m_allocator (no longer used).
+        (WTF::MetaAllocator::MetaAllocator):
+            - Initialize m_tracker.
+        (WTF::MetaAllocator::allocate):
+            - Notify the tracker of new allocations.
+        * wtf/MetaAllocator.h:
+        (WTF::MetaAllocatorTracker::find):
+            - Lookup a MetaAllocatorHandle based on an address inside the allocation.
+        (WTF::MetaAllocator::trackAllocations):
+            - Register a callback object to track allocation state.
+        * wtf/MetaAllocatorHandle.h:
+            - Remove unused createSelfManagedHandle/constructor.
+        (WTF::MetaAllocatorHandle::key):
+            - Added, for use in RedBlackTree.
+
+2012-01-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Use copying collector for out-of-line JSObject property storage
+        https://bugs.webkit.org/show_bug.cgi?id=76665
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren): Changed to use copyAndAppend whenever the property storage is out-of-line.
+        Also added a temporary variable to avoid warnings from GCC.
+        (JSC::JSObject::allocatePropertyStorage): Changed to use tryAllocateStorage/tryReallocateStorage as opposed to 
+        operator new. Also added a temporary variable to avoid warnings from GCC.
+        * runtime/JSObject.h:
+
+2012-01-24  Geoffrey Garen  <ggaren@apple.com>
+
+        JSValue::toString() should return a JSString* instead of a UString
+        https://bugs.webkit.org/show_bug.cgi?id=76861
+
+        Fixed two failing layout tests after my last patch.
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort): Call value() after calling toString(), as
+        in all other cases.
+        
+        I missed this case because the JSString* type has a valid operator<,
+        so the compiler didn't complain.
+
+2012-01-24  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [V8] Add Uint8ClampedArray support
+        https://bugs.webkit.org/show_bug.cgi?id=76803
+
+        Reviewed by Kenneth Russell.
+
+        * wtf/ArrayBufferView.h:
+        (WTF::ArrayBufferView::isUnsignedByteClampedArray): Added.
+        * wtf/Uint8ClampedArray.h:
+        (WTF::Uint8ClampedArray::isUnsignedByteClampedArray): Overridden to return true.
+
+2012-01-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add WebKitDownload to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=72949
+
+        Reviewed by Martin Robinson.
+
+        * wtf/gobject/GOwnPtr.cpp:
+        (WTF::GTimer): Use g_timer_destroy() to free a GTimer.
+        * wtf/gobject/GOwnPtr.h: Add GTimer template.
+        * wtf/gobject/GTypedefs.h: Add GTimer forward declaration.
+
+2012-01-24  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for Qt LinuxSH4 build after r105698.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-01-23  Geoffrey Garen  <ggaren@apple.com>
+
+        JSValue::toString() should return a JSString* instead of a UString
+        https://bugs.webkit.org/show_bug.cgi?id=76861
+
+        Reviewed by Gavin Barraclough.
+        
+        This makes the common case -- toString() on a string -- faster and
+        inline-able. (Not a measureable speedup, but we can now remove a bunch
+        of duplicate hand-rolled code for this optimization.)
+        
+        This also clarifies the boundary between "C++ strings" and "JS strings".
+        
+        In all cases other than true, false, null, undefined, and multi-digit
+        numbers, the JS runtime was just retrieving a UString from a JSString,
+        so returning a JSString* is strictly better. In the other cases, we can
+        optimize to avoid creating a new JSString if we care to, but it doesn't
+        seem to be a big deal.
+
+        * JavaScriptCore.exp: Export!
+        
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        (runWithScripts):
+        (runInteractive):
+        * API/JSValueRef.cpp:
+        (JSValueToStringCopy):
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString): Call value() after calling toString(), to
+        convert from "JS string" (JSString*) to "C++ string" (UString), since
+        toString() no longer returns a "C++ string".
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationValueAddNotNumber):
+        * jit/JITStubs.cpp:
+        (op_add): Updated for removal of toPrimitiveString():
+        all '+' operands can use toString(), except for object operands, which
+        need to take a slow path to call toPrimitive().
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPush):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/DateConstructor.cpp:
+        (JSC::dateParse):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate): Call value() after calling toString(), as above.
+
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::create): Simplified down to one canonical create()
+        function, to make string handling easier.
+
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sort): Call value() after calling toString(), as above.
+
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h: Removed JSCell::toString() because JSValue does this
+        job now. Doing it in JSCell is slower (requires extra type checking), and
+        creates the misimpression that language-defined toString() behavior is
+        an implementation detail of JSCell.
+        
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape): Call value() after calling toString(), as above.
+
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::Stringifier::Stringifier):
+        (JSC::JSONProtoFuncParse): Removed some manual optimization that toString()
+        takes care of.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toString):
+        * runtime/JSObject.h: Updated to return JSString*.
+
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        (JSC::JSValue::toString): Removed, since I removed JSCell::toString().
+
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toStringSlowCase): Removed toPrimitiveString(), and re-
+        spawned toStringSlowCase() from its zombie corpse, since toPrimitiveString()
+        basically did what we want all the time. (Note that the toPrimitive()
+        preference changes from NoPreference to PreferString, because that's
+        how ToString is defined in the language. op_add does not want this behavior.)
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString): A little simpler, now that toString()
+        returns a JSString*.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable): More calls to value(), as above.
+
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase): Need to check for object before taking the toString()
+        fast path becuase adding an object to a string requires calling toPrimitive()
+        on the object, not toString(). (They differ in their preferred conversion
+        type.)
+
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsStringFromArguments): This code gets simpler, now that toString()
+        does the right thing.
+
+        (JSC::jsAdd): Now checks for object, just like jsAddSlowCase().
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorInput):
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString): More calls to value(), as above.
+
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        (JSC::callStringConstructor): This code gets simpler, now that toString()
+        does the right thing.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::replaceUsingStringSearch):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString): Some of this code gets simpler, now that toString()
+        does the right thing. More calls to value(), as above.
+
+2012-01-23  Luke Macpherson   <macpherson@chromium.org>
+
+        Unreviewed, rolling out r105676.
+        http://trac.webkit.org/changeset/105676
+        https://bugs.webkit.org/show_bug.cgi?id=76665
+
+        Breaks build on max due to compile warnings.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::finalize):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::allocatePropertyStorage):
+        * runtime/JSObject.h:
+
+2012-01-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Use copying collector for out-of-line JSObject property storage
+        https://bugs.webkit.org/show_bug.cgi?id=76665
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren): Changed to use copyAndAppend whenever the property storage is out-of-line.
+        (JSC::JSObject::allocatePropertyStorage): Changed to use tryAllocateStorage/tryReallocateStorage as opposed to 
+        operator new.
+        * runtime/JSObject.h:
+
+2012-01-23  Brian Weinstein  <bweinstein@apple.com>
+
+        More build fixing after r105646.
+
+        * JavaScriptCore.exp:
+
+2012-01-23  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=76855
+        Implement a JIT-code aware sampling profiler for JSC
+
+        Reviewed by Geoff Garen.
+
+        Step 2: generalize RedBlackTree. The profiler is going to want tio use
+        a RedBlackTree, allow this class to work with subclasses of
+        RedBlackTree::Node, Node should not need to know the names of the m_key
+        and m_value fields (the subclass can provide a key() accessor), and
+        RedBlackTree does not need to know anything about ValueType.
+
+        * JavaScriptCore.exp:
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocator::findAndRemoveFreeSpace):
+        (WTF::MetaAllocator::debugFreeSpaceSize):
+        (WTF::MetaAllocator::addFreeSpace):
+        * wtf/MetaAllocator.h:
+        (WTF::MetaAllocator::FreeSpaceNode::FreeSpaceNode):
+        (WTF::MetaAllocator::FreeSpaceNode::key):
+        * wtf/MetaAllocatorHandle.h:
+        (WTF::MetaAllocatorHandle::key):
+        * wtf/RedBlackTree.h:
+        (WTF::RedBlackTree::Node::successor):
+        (WTF::RedBlackTree::Node::predecessor):
+        (WTF::RedBlackTree::Node::parent):
+        (WTF::RedBlackTree::Node::setParent):
+        (WTF::RedBlackTree::Node::left):
+        (WTF::RedBlackTree::Node::setLeft):
+        (WTF::RedBlackTree::Node::right):
+        (WTF::RedBlackTree::Node::setRight):
+        (WTF::RedBlackTree::insert):
+        (WTF::RedBlackTree::remove):
+        (WTF::RedBlackTree::findExact):
+        (WTF::RedBlackTree::findLeastGreaterThanOrEqual):
+        (WTF::RedBlackTree::findGreatestLessThanOrEqual):
+        (WTF::RedBlackTree::first):
+        (WTF::RedBlackTree::last):
+        (WTF::RedBlackTree::size):
+        (WTF::RedBlackTree::treeMinimum):
+        (WTF::RedBlackTree::treeMaximum):
+        (WTF::RedBlackTree::treeInsert):
+        (WTF::RedBlackTree::leftRotate):
+        (WTF::RedBlackTree::rightRotate):
+        (WTF::RedBlackTree::removeFixup):
+
+2012-01-23  Andy Estes  <aestes@apple.com>
+
+        Fix the build after r105635.
+
+        * JavaScriptCore.exp:
+
+2012-01-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove StackBounds from JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=76310
+
+        Reviewed by Sam Weinig.
+
+        Removed StackBounds and the stack() function from JSGlobalData since it no 
+        longer accessed any members of JSGlobalData.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2012-01-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement a JIT-code aware sampling profiler for JSC
+        https://bugs.webkit.org/show_bug.cgi?id=76855
+
+        Rubber stanmped by Geoff Garen.
+
+        Mechanical change - pass CodeBlock through to the executable allocator,
+        such that we will be able to map ranges of JIT code back to their owner.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryCachePutByID):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+
+2012-01-23  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Basic enhancements to StringBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=67081
+
+        This change contains the following enhancements to StringBuilder,
+        for convenience, performance, testability, etc.:
+        - Change toStringPreserveCapacity() to const
+        - new public methods: capacity(), swap(), toAtomicString(), canShrink()
+          and append(const StringBuilder&)
+        - == and != opearators to compare StringBuilders and a StringBuilder/String
+
+        Unit tests: Tools/TestWebKitAPI/Tests/WTF/StringBuilder.cpp
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::SubstringTranslator::hash):
+        (WTF::SubstringTranslator::equal):
+        (WTF::SubstringTranslator::translate):
+        (WTF::AtomicString::add):
+        (WTF::AtomicString::addSlowCase):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::AtomicString):
+        (WTF::AtomicString::add):
+        * wtf/text/StringBuilder.cpp:
+        (WTF::StringBuilder::reifyString):
+        (WTF::StringBuilder::resize):
+        (WTF::StringBuilder::canShrink):
+        (WTF::StringBuilder::shrinkToFit):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::toString):
+        (WTF::StringBuilder::toStringPreserveCapacity):
+        (WTF::StringBuilder::toAtomicString):
+        (WTF::StringBuilder::isEmpty):
+        (WTF::StringBuilder::capacity):
+        (WTF::StringBuilder::is8Bit):
+        (WTF::StringBuilder::swap):
+        (WTF::equal):
+        (WTF::operator==):
+        (WTF::operator!=):
+        * wtf/text/StringImpl.h:
+
+2012-01-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files, remove deleted files and
+        fix indentation.
+
+2012-01-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for non-DFG platforms that error out on warn-unused-parameter.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/MethodCallLinkStatus.cpp:
+        (JSC::MethodCallLinkStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+
+2012-01-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for non-DFG platforms.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/MethodCallLinkStatus.cpp:
+        (JSC::MethodCallLinkStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+
+2012-01-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not have code that directly decodes the states of old JIT inline
+        cache data structures
+        https://bugs.webkit.org/show_bug.cgi?id=76768
+
+        Reviewed by Sam Weinig.
+        
+        Introduced new classes (like GetByIdStatus) that encapsulate the set of things
+        that the DFG would like to know about property accesses and calls. Whereas it
+        previously got this information by directly decoding the data structures used
+        by the old JIT for inline caching, it now uses these classes, which do the work
+        for it. This should make it somewhat more straight forward to introduce new
+        ways of profiling the same information.
+        
+        Also hoisted StructureSet into bytecode/ from dfg/, because it's now used by
+        code in bytecode/.
+        
+        Making this work right involved carefully ensuring that the heuristics for
+        choosing how to handle property accesses was at least as good as what we had
+        before, since I completely restructured that code. Currently the performance
+        looks neutral. Since I rewrote the code I did change some things that I never
+        liked before, like previously if a put_bu_id had executed exactly once then
+        we'd compile it as if it had taken slow-path. Executing once is special because
+        then the inline cache is not baked in, so there is no information about how the
+        DFG should optimize the code. Now this is rationalized: if the put_by_id does
+        not offer enough information to be optimized (i.e. had executed 0 or 1 times)
+        then we turn it into a forced OSR exit (i.e. a patch point). However, get_by_id
+        still has the old behavior; I left it that way because I didn't want to make
+        too many changes at once.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CallLinkStatus.cpp: Added.
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CallLinkStatus.h: Added.
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::operator!):
+        (JSC::CallLinkStatus::couldTakeSlowPath):
+        (JSC::CallLinkStatus::callTarget):
+        * bytecode/GetByIdStatus.cpp: Added.
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h: Added.
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::state):
+        (JSC::GetByIdStatus::isSet):
+        (JSC::GetByIdStatus::operator!):
+        (JSC::GetByIdStatus::isSimpleDirect):
+        (JSC::GetByIdStatus::takesSlowPath):
+        (JSC::GetByIdStatus::makesCalls):
+        (JSC::GetByIdStatus::structureSet):
+        (JSC::GetByIdStatus::offset):
+        * bytecode/MethodCallLinkStatus.cpp: Added.
+        (JSC::MethodCallLinkStatus::computeFor):
+        * bytecode/MethodCallLinkStatus.h: Added.
+        (JSC::MethodCallLinkStatus::MethodCallLinkStatus):
+        (JSC::MethodCallLinkStatus::isSet):
+        (JSC::MethodCallLinkStatus::operator!):
+        (JSC::MethodCallLinkStatus::needsPrototypeCheck):
+        (JSC::MethodCallLinkStatus::structure):
+        (JSC::MethodCallLinkStatus::prototypeStructure):
+        (JSC::MethodCallLinkStatus::function):
+        (JSC::MethodCallLinkStatus::prototype):
+        * bytecode/PutByIdStatus.cpp: Added.
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h: Added.
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (JSC::PutByIdStatus::state):
+        (JSC::PutByIdStatus::isSet):
+        (JSC::PutByIdStatus::operator!):
+        (JSC::PutByIdStatus::isSimpleReplace):
+        (JSC::PutByIdStatus::isSimpleTransition):
+        (JSC::PutByIdStatus::takesSlowPath):
+        (JSC::PutByIdStatus::oldStructure):
+        (JSC::PutByIdStatus::newStructure):
+        (JSC::PutByIdStatus::structureChain):
+        (JSC::PutByIdStatus::offset):
+        * bytecode/StructureSet.h: Added.
+        (JSC::StructureSet::StructureSet):
+        (JSC::StructureSet::clear):
+        (JSC::StructureSet::add):
+        (JSC::StructureSet::addAll):
+        (JSC::StructureSet::remove):
+        (JSC::StructureSet::contains):
+        (JSC::StructureSet::isSubsetOf):
+        (JSC::StructureSet::isSupersetOf):
+        (JSC::StructureSet::size):
+        (JSC::StructureSet::at):
+        (JSC::StructureSet::operator[]):
+        (JSC::StructureSet::last):
+        (JSC::StructureSet::predictionFromStructures):
+        (JSC::StructureSet::operator==):
+        (JSC::StructureSet::dump):
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGStructureSet.h: Removed.
+
+2012-01-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT compilation should not require ExecState
+        https://bugs.webkit.org/show_bug.cgi?id=76729
+        <rdar://problem/10731545>
+
+        Reviewed by Gavin Barraclough.
+        
+        Changed the relevant JIT driver functions to take JSGlobalData& instead of
+        ExecState*, since really they just needed the global data.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h:
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2012-01-20  David Levin  <levin@chromium.org>
+
+        Make OwnPtr<HDC> work for the Chromium Windows port.
+        https://bugs.webkit.org/show_bug.cgi?id=76738
+
+        Reviewed by Jian Li.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Added OwnPtrWin.cpp to the
+        Chromium Windows build.
+        * wtf/OwnPtrCommon.h: Changed from platform WIN to OS WIN for
+        OwnPtr<HDC> and similar constructs.
+
+2012-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed some regexp entry boilerplate code
+        https://bugs.webkit.org/show_bug.cgi?id=76687
+
+        Reviewed by Darin Adler.
+        
+        1% - 2% speedup on regexp tests, no change overall.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+            - ASSERT that our startIndex is non-negative, because anything less
+            would be uncivilized.
+            
+            - ASSERT that our input is not the null string for the same reason.
+
+            - No need to test for startOffset being past the end of the string,
+            since the regular expression engine will do this test for us.
+
+            - No need to initialize the output vector, since the regular expression
+            engine will fill it in for us.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::interpret):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+        
+            RegExp used to do these jobs for us, but now we do them for ourselves
+            because it's a better separation of concerns, and the JIT can do them
+            more efficiently than C++ code:
+
+            - Test for "past the end" before doing any matching -- otherwise
+            a* will match with zero length past the end of the string, which is wrong.
+
+            - Initialize the output vector before doing any matching.
+
+2012-01-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for no-DFG configuration.
+        Needed for <rdar://problem/10727689>.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitProfiledOpcode):
+        * jit/JIT.h:
+        (JSC::JIT::emitValueProfilingSite):
+
+2012-01-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Bytecode instructions that may have value profiling should have a direct inline
+        link to the ValueProfile instance
+        https://bugs.webkit.org/show_bug.cgi?id=76682
+        <rdar://problem/10727689>
+
+        Reviewed by Sam Weinig.
+        
+        Each opcode that gets value profiled now has a link to its ValueProfile. This
+        required rationalizing the emission of value profiles for opcode combos, like
+        op_method_check/op_get_by_id and op_call/op_call_put_result. It only makes
+        sense for one of them to have a value profile link, and it makes most sense
+        for it to be the one that actually sets the result. The previous behavior was
+        to have op_method_check profile for op_get_by_id when they were used together,
+        but otherwise for op_get_by_id to have its own profiles. op_call already did
+        the right thing; all profiling was done by op_call_put_result.
+        
+        But rationalizing this code required breaking some of the natural boundaries
+        that the code had; for instance the code in DFG that emits a GetById in place
+        of both op_method_check and op_get_by_id must now know that it's the latter of
+        those that has the value profile, while the first of those constitutes the OSR
+        target. Hence each CodeOrigin must now have two bytecode indices - one for
+        OSR exit and one for profiling.
+        
+        Finally this change required some refiddling of our optimization heuristics,
+        because now all code blocks have "more instructions" due to the value profile
+        slots.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::CodeOrigin):
+        (JSC::CodeOrigin::bytecodeIndexForValueProfile):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitProfiledOpcode):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::currentCodeOrigin):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueProfileFor):
+        * jit/JIT.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_call_put_result):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_call_put_result):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_get_global_var):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_get_global_var):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::callWithValueProfiling):
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions):
+
+2012-01-20  ChangSeok Oh  <shivamidow@gmail.com>
+
+        undefined reference to symbol eina_module_free
+        https://bugs.webkit.org/show_bug.cgi?id=76681
+
+        Reviewed by Martin Robinson.
+
+        eina_module_free has been used without including eina libraries after r104936.
+
+        * wtf/PlatformEfl.cmake: Add EINA_LIBRARIES.
+
+2012-01-19  Tony Chang  <tony@chromium.org>
+
+        [chromium] Remove an obsolete comment about features.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=76643
+
+        There can be only one features.gypi.
+
+        Reviewed by James Robinson.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2012-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Implicit creation of a regular expression should eagerly check for syntax errors
+        https://bugs.webkit.org/show_bug.cgi?id=76642
+
+        Reviewed by Oliver Hunt.
+        
+        This is a correctness fix and a slight optimization.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch): Check for syntax errors because that's the
+        correct behavior.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match): ASSERT that we aren't a syntax error. (One line
+        of code change, many lines of indentation change.)
+
+        Since we have no clients that try to match a RegExp that is a syntax error,
+        let's optimize out the check.
+
+2012-01-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Implement a new allocator for backing stores
+        https://bugs.webkit.org/show_bug.cgi?id=75181
+
+        Reviewed by Filip Pizlo.
+
+        We want to move away from using fastMalloc for the backing stores for 
+        some of our objects (e.g. JSArray, JSObject, JSString, etc).  These backing 
+        stores have a nice property in that they only have a single owner (i.e. a 
+        single pointer to them at any one time).  One way that we can take advantage 
+        of this property is to implement a simple bump allocator/copying collector, 
+        which will run alongside our normal mark/sweep collector, that only needs to 
+        update the single owner pointer rather than having to redirect an arbitrary 
+        number of pointers in from-space to to-space.
+
+        This plan can give us a number of benefits. We can beat fastMalloc in terms 
+        of both performance and memory usage, we can track how much memory we're using 
+        far more accurately than our rough estimation now through the use of 
+        reportExtraMemoryCost, and we can allocate arbitrary size objects (as opposed 
+        to being limited to size classes like we have been historically). This is also 
+        another step toward moving away from lazy destruction, which will improve our memory footprint.
+
+        We start by creating said allocator and moving the ArrayStorage for JSArray 
+        to use it rather than fastMalloc.
+
+        The design of the collector is as follows:
+        Allocation:
+        -The collector allocates 64KB chunks from the OS to use for object allocation.
+        -Each chunk contains an offset, a flag indicating if the block has been pinned, 
+         and a payload, along with next and prev pointers so that they can be put in DoublyLinkedLists.
+        -Any allocation greater than 64KB gets its own separate oversize block, which 
+         is managed separately from the rest.
+        -If the allocator receives a request for more than the remaining amount in the 
+         current block, it grabs a fresh block.
+        -Grabbing a fresh block means grabbing one off of the global free list (which is now 
+         shared between the mark/sweep allocator and the bump allocator) if there is one. 
+         If there isn't a new one we do one of two things: allocate a new block from the OS 
+         if we're not ready for a GC yet, or run a GC and then try again. If we still don't 
+         have enough space after the GC, we allocate a new block from the OS.
+
+        Garbage collection:
+        -At the start of garbage collection during conservative stack scanning, if we encounter 
+         what appears to be a pointer to a bump-allocated block of memory, we pin that block so 
+         that it will not be copied for this round of collection.
+        -We also pin any oversize blocks that we encounter, which effectively doubles as a 
+         "mark bit" for that block. Any oversize blocks that aren't pinned at the end of copying 
+         are given back to the OS.
+        -Marking threads are now also responsible for copying bump-allocated objects to newSpace
+        -Each marking thread has a private 64KB block into which it copies bump-allocated objects that it encounters.
+        -When that block fills up, the marking thread gives it back to the allocator and requests a new one.
+        -When all marking has concluded, each thread gives back its copy block, even if it isn't full.
+        -At the conclusion of copying (which is done by the end of the marking phase), we un-pin 
+         any pinned blocks and give any blocks left in from-space to the global free list.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/AllocationSpace.cpp:
+        (JSC::AllocationSpace::allocateSlowCase):
+        (JSC::AllocationSpace::allocateBlock):
+        (JSC::AllocationSpace::freeBlocks):
+        * heap/AllocationSpace.h:
+        (JSC::AllocationSpace::waterMark):
+        * heap/BumpBlock.h: Added.
+        (JSC::BumpBlock::BumpBlock):
+        * heap/BumpSpace.cpp: Added.
+        (JSC::BumpSpace::tryAllocateSlowCase):
+        * heap/BumpSpace.h: Added.
+        (JSC::BumpSpace::isInCopyPhase):
+        (JSC::BumpSpace::totalMemoryAllocated):
+        (JSC::BumpSpace::totalMemoryUtilized):
+        * heap/BumpSpaceInlineMethods.h: Added.
+        (JSC::BumpSpace::BumpSpace):
+        (JSC::BumpSpace::init):
+        (JSC::BumpSpace::contains):
+        (JSC::BumpSpace::pin):
+        (JSC::BumpSpace::startedCopying):
+        (JSC::BumpSpace::doneCopying):
+        (JSC::BumpSpace::doneFillingBlock):
+        (JSC::BumpSpace::recycleBlock):
+        (JSC::BumpSpace::getFreshBlock):
+        (JSC::BumpSpace::borrowBlock):
+        (JSC::BumpSpace::addNewBlock):
+        (JSC::BumpSpace::allocateNewBlock):
+        (JSC::BumpSpace::fitsInBlock):
+        (JSC::BumpSpace::fitsInCurrentBlock):
+        (JSC::BumpSpace::tryAllocate):
+        (JSC::BumpSpace::tryAllocateOversize):
+        (JSC::BumpSpace::allocateFromBlock):
+        (JSC::BumpSpace::tryReallocate):
+        (JSC::BumpSpace::tryReallocateOversize):
+        (JSC::BumpSpace::isOversize):
+        (JSC::BumpSpace::isPinned):
+        (JSC::BumpSpace::oversizeBlockFor):
+        (JSC::BumpSpace::blockFor):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::add):
+        * heap/ConservativeRoots.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::blockFreeingThreadMain):
+        (JSC::Heap::reportExtraMemoryCostSlowCase):
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        (JSC::Heap::releaseFreeBlocks):
+        * heap/Heap.h:
+        (JSC::Heap::waterMark):
+        (JSC::Heap::highWaterMark):
+        (JSC::Heap::setHighWaterMark):
+        (JSC::Heap::tryAllocateStorage):
+        (JSC::Heap::tryReallocateStorage):
+        * heap/HeapBlock.h: Added.
+        (JSC::HeapBlock::HeapBlock):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::startCopying):
+        (JSC::SlotVisitor::allocateNewSpace):
+        (JSC::SlotVisitor::copy):
+        (JSC::SlotVisitor::copyAndAppend):
+        (JSC::SlotVisitor::doneCopying):
+        * heap/MarkStack.h:
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::recycle):
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::SizeClass::resetAllocator):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::SlotVisitor):
+        * heap/TinyBloomFilter.h:
+        (JSC::TinyBloomFilter::reset):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::finishCreation):
+        (JSC::JSArray::tryFinishCreationUninitialized):
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::enterSparseMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::setLengthWritable):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::visitChildren):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::subclassData):
+        (JSC::JSArray::setSubclassData):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSArray.h:
+        (JSC::JSArray::inSparseMode):
+        (JSC::JSArray::isLengthWritable):
+        * wtf/CheckedBoolean.h: Added.
+        (CheckedBoolean::CheckedBoolean):
+        (CheckedBoolean::~CheckedBoolean):
+        (CheckedBoolean::operator bool):
+        * wtf/DoublyLinkedList.h:
+        (WTF::::push):
+        * wtf/StdLibExtras.h:
+        (WTF::isPointerAligned):
+
+2012-01-19  Joi Sigurdsson  <joi@chromium.org>
+
+        Enable use of precompiled headers in Chromium port on Windows.
+
+        Bug 76381 - Use precompiled headers in Chromium port on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=76381
+
+        Reviewed by Tony Chang.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Include WinPrecompile.gypi.
+
+2012-01-18  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
+
+        Cross-platform processor core counter fix
+        https://bugs.webkit.org/show_bug.cgi?id=76540
+
+        Reviewed by Zoltan Herczeg.
+
+        I attached "OS(FREEBSD)" to "#if OS(DARWIN) || OS(OPENBSD) || OS(NETBSD)"
+        and I removed the OS checking macros from ParallelJobsGeneric.cpp because
+        the NumberOfCores.cpp contains them for counting CPU cores.
+        The processor core counter patch located at
+        https://bugs.webkit.org/show_bug.cgi?id=76530
+
+        * wtf/NumberOfCores.cpp:
+        * wtf/ParallelJobsGeneric.cpp:
+
+2012-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Cross-platform processor core counter
+        https://bugs.webkit.org/show_bug.cgi?id=76530
+
+        Unreviewed cross-MinGW buildfix after r105270.
+
+        * wtf/NumberOfCores.cpp: Use windows.h instead of Windows.h.
+
+2012-01-18  Roland Takacs  <takacs.roland@stud.u-szeged.hu>
+
+        Cross-platform processor core counter
+        https://bugs.webkit.org/show_bug.cgi?id=76530
+
+        Reviewed by Zoltan Herczeg.
+
+        Two files have been created that include the processor core counter function.
+        It used to be in ParallelJobsGeneric.h/cpp before.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions):
+        * wtf/CMakeLists.txt:
+        * wtf/NumberOfCores.cpp: Added.
+        (WTF::numberOfProcessorCores):
+        * wtf/NumberOfCores.h: Added.
+        * wtf/ParallelJobsGeneric.cpp:
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        * wtf/ParallelJobsGeneric.h:
+
+2012-01-18  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] Consolidate layout test crash logging
+        https://bugs.webkit.org/show_bug.cgi?id=75088
+
+        Reviewed by Simon Hausmann.
+
+        Move backtrace generating logic into WTFReportBacktrace
+        and add a way to deinstall signal handlers if we know
+        that we have already printed the backtrace.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/Assertions.cpp:
+        (WTFLogLocker::WTFReportBacktrace):
+        (WTFLogLocker::WTFSetCrashHook):
+        (WTFLogLocker::WTFInvokeCrashHook):
+        * wtf/Assertions.h:
+
+2012-01-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Factored out some code into a helper function.
+        
+        I think this might help getting rid of omit-frame-pointer.
+
+        Reviewed by Sam Weinig.
+        
+        No benchmark change.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::removeUsingRegExpSearch): Moved to here...
+        (JSC::replaceUsingRegExpSearch): ...from here.
+
+2012-01-17  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Uint8ClampedArray support
+        https://bugs.webkit.org/show_bug.cgi?id=74455
+
+        Reviewed by Filip Pizlo.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionFromClassInfo):
+        * bytecode/PredictedType.h:
+        (JSC::isUint8ClampedArrayPrediction):
+        (JSC::isActionableMutableArrayPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::clampDoubleToByte):
+        (JSC::DFG::compileClampIntegerToByte):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.h:
+        * wtf/Forward.h:
+        * wtf/Uint8Array.h:
+        * wtf/Uint8ClampedArray.h: Added.
+        (WTF::Uint8ClampedArray::set):
+        (WTF::Uint8ClampedArray::create):
+        (WTF::Uint8ClampedArray::Uint8ClampedArray):
+        (WTF::Uint8ClampedArray::subarray):
+
+2012-01-17  Sam Weinig  <sam@webkit.org>
+
+        Add helper macro for forward declaring objective-c classes
+        https://bugs.webkit.org/show_bug.cgi?id=76485
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Compiler.h:
+        Add OBJC_CLASS macro which helps reduce code when forward declaring an
+        objective-c class in a header which can be included from both Objective-C
+        and non-Objective-C files.
+
+2012-01-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to do JS and custom getter caching
+        https://bugs.webkit.org/show_bug.cgi?id=76361
+
+        Reviewed by Csaba Osztrogonác.
+        
+        Fix for 32-bit.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-01-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to do JS and custom getter caching
+        https://bugs.webkit.org/show_bug.cgi?id=76361
+        <rdar://problem/10698060>
+
+        Reviewed by Geoff Garen.
+        
+        Added the ability to cache JS getter calls and custom getter calls in the DFG.
+        Most of this is pretty mundane, since the old JIT supported this functionality
+        as well. But a couple interesting things had to happen:
+        
+        - There are now two variants of GetById: GetById, which works as before, and
+          GetByIdFlush, which flushes registers prior to doing the GetById. Only
+          GetByIdFlush can be used for caching getters. We detect which GetById style
+          to use by looking at the inline caches of the old JIT.
+        
+        - Exception handling for getter calls planted in stubs uses a separate lookup
+          handler routine, which uses the CodeOrigin stored in the StructureStubInfo.
+          
+        This is a 40% speed-up in the Dromaeo DOM Traversal average. It removes all of
+        the DFG regressions we saw in Dromaeo. This is neutral on SunSpider, V8, and
+        Kraken.
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::willNeedFlush):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupResults):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+        (JSC::DFG::JITCompiler::addExceptionCheck):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-01-16  Jon Lee  <jonlee@apple.com>
+
+        Build fix for r105086.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2012-01-16  Jon Lee  <jonlee@apple.com>
+
+        Remove HTML notifications support on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=76401
+        <rdar://problem/10589881>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Platform.h: Define ENABLE_HTML_NOTIFICATIONS macro.
+
+2012-01-16  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] Fix QT_VERSION related warnings when building on Mac OS X
+        https://bugs.webkit.org/show_bug.cgi?id=76340
+
+        This bug was caused by r104826.
+        As already mentioned for https://bugs.webkit.org/show_bug.cgi?id=57239
+        we should not use "using namespace WebCore" in header files,
+        because it might cause ambiguous references.
+        This patch reverts the changes from r104826 and r104981
+        and removes the "using namespace WebCore" statement from
+        two header files.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * wtf/Platform.h:
+
+2012-01-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Fix typo.
+
+2012-01-16  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        Solaris Studio supports alignment macros too
+        https://bugs.webkit.org/show_bug.cgi?id=75453
+
+        Reviewed by Hajime Morita.
+
+        * wtf/Alignment.h:
+
+2012-01-16  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Build fix on 32bit if verbose debug is enabled in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=76351
+
+        Reviewed by Hajime Morita.
+
+        Mostly change "%lu" to "%zu" to print a "size_t" variable.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::endBasicBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+
+2012-01-15  Filip Pizlo  <fpizlo@apple.com>
+
+        The C calling convention logic in DFG::SpeculativeJIT should be available even
+        when not generating code for the DFG speculative path
+        https://bugs.webkit.org/show_bug.cgi?id=76355
+
+        Reviewed by Dan Bernstein.
+        
+        Moved all of the logic for placing C call arguments into the right place (stack
+        or registers) into a new class, DFG::CCallHelpers.  This class inherits from
+        AssemblyHelpers, another DFG grab-bag of helper functions.  I could have moved
+        this code into AssemblyHelpers, but decided against it, because I wanted to
+        limit the number of methods each class in the JIT has.  Hence now we have a
+        slightly odd organization of JIT classes in DFG: MacroAssembler (basic instruction
+        emission) <= AssemblyHelpers (some additional JS smarts) <= CCallHelpers
+        (understands calls to C functions) <= JITCompiler (can compile a graph to machine
+        code).  Each of these except for JITCompiler can be reused for stub compilation.
+        
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGCCallHelpers.h: Added.
+        (JSC::DFG::CCallHelpers::CCallHelpers):
+        (JSC::DFG::CCallHelpers::resetCallArguments):
+        (JSC::DFG::CCallHelpers::addCallArgument):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        (JSC::DFG::CCallHelpers::setupArgumentsExecState):
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (JSC::DFG::CCallHelpers::setupTwoStubArgs):
+        (JSC::DFG::CCallHelpers::setupStubArguments):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+2012-01-15  Pablo Flouret  <pablof@motorola.com>
+
+        Fix compilation errors on build-webkit --debug --no-video on mac.
+        https://bugs.webkit.org/show_bug.cgi?id=75867
+
+        Reviewed by Philippe Normand.
+
+        Make ENABLE_VIDEO_TRACK conditional on ENABLE_VIDEO, video track feature
+        doesn't build without video.
+
+        * wtf/Platform.h:
+
+2012-01-14  David Levin  <levin@chromium.org>
+
+        HWndDC should be in platform/win instead of wtf.
+        https://bugs.webkit.org/show_bug.cgi?id=76314
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+
+2012-01-13  David Levin  <levin@chromium.org>
+
+        check-webkit-style: should encourage the use of Own* classes for Windows DC.
+        https://bugs.webkit.org/show_bug.cgi?id=76227
+
+        Reviewed by Dirk Pranke.
+
+        * wtf/win/HWndDCWin.h:
+        (WTF::HwndDC::HwndDC): Add a way to do GetDCEx.
+        There are no users, but I want to catch this in check-webkit-style
+        and tell any users to use HwndDC to avoid leaks.
+
+2012-01-13  David Levin  <levin@chromium.org>
+
+        Header file is missing header guard.
+
+        Reviewed by Dirk Pranke.
+
+        * wtf/win/HWndDCWin.h: Added the guards.
+
+2012-01-13  Andy Wingo  <wingo@igalia.com>
+
+        Eval in strict mode does not need dynamic checks
+        https://bugs.webkit.org/show_bug.cgi?id=76286
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSActivation.cpp (JSC::JSActivation::JSActivation):
+        Eval in strict mode cannot introduce variables, so it not impose
+        the need for dynamic checks.
+
+2012-01-13  David Levin  <levin@chromium.org>
+
+        HWndDC is a better name than HwndDC.
+        https://bugs.webkit.org/show_bug.cgi?id=76281
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * wtf/win/HWndDCWin.h: Renamed from Source/JavaScriptCore/wtf/win/HwndDCWin.h.
+        (WTF::HWndDC::HWndDC):
+        (WTF::HWndDC::~HWndDC):
+        (WTF::HWndDC::operator HDC):
+
+2012-01-13  YoungTaeck Song  <youngtaeck.song@samsung.com>
+
+        [EFL] Add OwnPtr specialization for Eina_Module.
+        https://bugs.webkit.org/show_bug.cgi?id=76255
+
+        Reviewed by Andreas Kling.
+
+        Add an overload for deleteOwnedPtr(Eina_Module*) on EFL port.
+
+        * wtf/OwnPtrCommon.h:
+        * wtf/efl/OwnPtrEfl.cpp:
+        (WTF::deleteOwnedPtr):
+
+2012-01-13  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Unreviewed build fix after r104787 if JIT_VERBOSE_OSR is defined
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2012-01-12  Hajime Morrita  <morrita@chromium.org>
+
+        JavaScriptCore: Mark all exported symbols in the header file automatically.
+        https://bugs.webkit.org/show_bug.cgi?id=72855
+
+        Reviewed by Darin Adler.
+
+        Added WTF_EXPORT_PRIVATE and JS_EXPORT_PRIVATE based on JavaScriptCore.exp files.
+        The change is generated by a tool calledListExportables (https://github.com/omo/ListExportables)
+
+        * API/OpaqueJSString.h:
+        * bytecode/CodeBlock.h:
+        * bytecode/SamplingTool.h:
+        * debugger/Debugger.h:
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.h:
+        * heap/AllocationSpace.h:
+        * heap/HandleHeap.h:
+        * heap/Heap.h:
+        * heap/MachineStackMarker.h:
+        * heap/MarkStack.h:
+        * heap/VTableSpectrum.h:
+        * heap/WriteBarrierSupport.h:
+        * parser/Nodes.h:
+        * parser/ParserArena.h:
+        * profiler/Profile.h:
+        * runtime/ArgList.h:
+        * runtime/CallData.h:
+        * runtime/Completion.h:
+        * runtime/ConstructData.h:
+        * runtime/DateInstance.h:
+        * runtime/Error.h:
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionConstructor.h:
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.h:
+        * runtime/InternalFunction.h:
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalThis.h:
+        * runtime/JSLock.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+        * runtime/Lookup.h:
+        * runtime/MemoryStatistics.h:
+        * runtime/ObjectPrototype.h:
+        * runtime/Options.h:
+        * runtime/PropertyDescriptor.h:
+        * runtime/PropertyNameArray.h:
+        * runtime/PropertySlot.h:
+        * runtime/RegExp.h:
+        * runtime/RegExpObject.h:
+        * runtime/SamplingCounter.h:
+        * runtime/SmallStrings.h:
+        * runtime/StringObject.h:
+        * runtime/Structure.h:
+        * runtime/TimeoutChecker.h:
+        * runtime/UString.h:
+        * runtime/WriteBarrier.h:
+        * wtf/ArrayBufferView.h:
+        * wtf/ByteArray.h:
+        * wtf/CryptographicallyRandomNumber.h:
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+        * wtf/DecimalNumber.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/MD5.h:
+        * wtf/MainThread.h:
+        * wtf/MetaAllocator.h:
+        * wtf/MetaAllocatorHandle.h:
+        * wtf/OSAllocator.h:
+        * wtf/PageBlock.h:
+        * wtf/RandomNumber.h:
+        * wtf/RefCountedLeakCounter.h:
+        * wtf/SHA1.h:
+        * wtf/Threading.cpp:
+        * wtf/Threading.h:
+        * wtf/ThreadingPrimitives.h:
+        * wtf/WTFThreadData.h:
+        * wtf/dtoa.h:
+        * wtf/text/AtomicString.h:
+        * wtf/text/CString.h:
+        * wtf/text/StringBuilder.h:
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+        * wtf/unicode/Collator.h:
+        * wtf/unicode/UTF8.h:
+        * yarr/Yarr.h:
+        * yarr/YarrPattern.h:
+
+2012-01-12  MORITA Hajime  <morrita@google.com>
+
+        [Chromium] JSExportMacros.h should be visible.
+        https://bugs.webkit.org/show_bug.cgi?id=76147
+
+        Reviewed by Tony Chang.
+
+        * config.h:
+
+2012-01-12  David Levin  <levin@chromium.org>
+
+        HwndDC is a better name than OwnGetDC.
+        https://bugs.webkit.org/show_bug.cgi?id=76235
+
+        Reviewed by Dmitry Titov.
+
+        This is a better name for two reasons:
+        1. "Own" implies "delete". In this case, the final call is a release (ReleaseDC).
+        2. "Ref" would be a better name due to the release but the RefPtr (and OwnPtr)
+           classes always take something to hold on to. In this case, the object (the DC)
+           is created by the class once it is given a Window to ensure that the HDC
+           was actually created using GetDC.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * wtf/win/HwndDCWin.h: Renamed from Source/JavaScriptCore/wtf/win/OwnGetDCWin.h.
+        (WTF::HwndDC::HwndDC):
+        (WTF::HwndDC::~HwndDC):
+        (WTF::HwndDC::operator HDC):
+
+2012-01-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Clean up putDirect (part 2)
+        https://bugs.webkit.org/show_bug.cgi?id=76232
+
+        Reviewed by Sam Weinig.
+
+        Rename putWithAttributes to putDirectVirtual, to identify that this
+        has the same unchecked-DefineOwnProperty behaviour, change putDirectInternal
+        to be templated on an enum indicating which behaviour it is supposed to be
+        implementing, and change clients that are defining properties to call
+        putDirectInternal correctly.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::putDirectVirtual):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/ClassInfo.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::putDirectVirtual):
+        * runtime/JSActivation.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putDirectVirtual):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putDirectVirtual):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putDirectVirtual):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::initializeGetterSetterProperty):
+        (JSC::JSObject::defineSetter):
+        (JSC::putDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putOwnDataProperty):
+        (JSC::JSObject::putDirect):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::putDirectVirtual):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::putDirectVirtual):
+        * runtime/JSVariableObject.h:
+
+2012-01-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Clean up putDirect (part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=76232
+
+        Reviewed by Sam Weinig.
+
+        putDirect has ambiguous semantics, clean these up a bit.
+
+        putDirect generally behaves a bit like a fast defineOwnProperty, but one that
+        always creates the property, with no checking to validate the put it permitted.
+
+        It also encompasses two slightly different behaviors.
+        (1) a fast form of put for JSActivation, which doesn't have to handle searching
+            the prototype chain, getter/setter properties, or the magic __proto__ value.
+            Break this out as a new method, 'putOwnDataProperty'.
+        (2) the version of putDirect on JSValue will also check for overwriting ReadOnly
+            values, in strict mode. This is, however, not so smart on a few level, since
+            it is only called from op_put_by_id with direct set, which is only used with
+            an object as the base, and is only used to put new properties onto objects.
+
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putOwnDataProperty):
+        * runtime/JSValue.h:
+
+2012-01-12  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=76141
+        defineSetter/defineGetter may fail to update Accessor attribute
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::initializeGetterSetterProperty):
+        (JSC::JSObject::defineSetter):
+        * runtime/Structure.cpp:
+        (JSC::Structure::attributeChangeTransition):
+        * runtime/Structure.h:
+
+2012-01-12  David Levin  <levin@chromium.org>
+
+        [chromium] Fix DC leak in WebScreenInfoFactory.
+        https://bugs.webkit.org/show_bug.cgi?id=76203
+
+        Reviewed by Dmitry Titov.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Added OwnGetDCWin.h
+        * JavaScriptCore.gypi: Added OwnGetDCWin.h
+        * JavaScriptCore/wtf/win/OwnGetDCWin.h: Made an owner class for GetDC which needs ReleaseDC as opposed to DeleteDC.
+
+2012-01-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Allow accessor get/set property to be set to undefined
+        https://bugs.webkit.org/show_bug.cgi?id=76148
+
+        Reviewed by Oliver Hunt.
+
+        AccessorDescriptor properties may have their get & set properties defined to reference a function
+        (Callable object) or be set to undefined. Valid PropertyDescriptors created by toPropertyDescriptor
+        (defined from JS code via Object.defineProperty, etc) have get and set properties that are in one of
+        three states (1) nonexistent, (2) set to undefined, or (3) a function (any Callable object).
+
+        On the PropertyDescriptor object these three states are represneted by JSValue(), jsUndefined(), and
+        any JSObject* (with a constraint that this must be callable).
+
+        Logically the get/set property of an accessor descriptor on an object might be in any of the three
+        states above, but in practice there is no way to distinguish between the first two states. As such
+        we stor the get/set values in property storage in a JSObject* field, with 0 indicating absent or
+        undefined. When unboxing to a PropertyDescriptor, map this back to a JS undefined value.
+
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setSetter):
+            - Allow the getter/setter to be cleared.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putDescriptor):
+            - Changed to call getterObject/setterObject.
+        (JSC::JSArray::defineOwnNumericProperty):
+            - Added ASSERT.
+        * runtime/JSObject.cpp:
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+            - Changed to call getterObject/setterObject.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+            - getter/setter values read from properties on object are never missing, they will now be set as undefined by 'setDescriptor'.
+        (JSC::toPropertyDescriptor):
+            - Do not translate undefined->empty, this loses an important distinction between a get/set property being absent, or being explicitly set to undefined.
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::getterObject):
+        (JSC::PropertyDescriptor::setterObject):
+            - Accessors to convert the get/set property to an object pointer, converting undefined to 0.
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+            - Translate a getter/setter internally represented at 0 to undefined, indicating that it is present.
+        * runtime/PropertyDescriptor.h:
+            - Declare getterObject/setterObject.
+
+2012-01-12  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt][WK2][Mac] Conflict of MacTypes.h defining a Fixed type after r104560.
+        https://bugs.webkit.org/show_bug.cgi?id=76175
+
+        Defining ENABLE_CSS_FILTERS leads to ambiguous references
+        due to MacTypes.h being included.
+        Defining CF_OPEN_SOURCE works around this problem.
+
+        Reviewed by Simon Hausmann.
+
+        * wtf/Platform.h:
+
+2012-01-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Make the new WTF module build on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=76163
+
+        Reviewed by Tor Arne Vestbø.
+
+        * JavaScriptCore.pro: Removed wtf from the subdirs to build.
+
+2012-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock::m_executeCounter should be renamed to CodeBlock::m_jitExecuteCounter
+        https://bugs.webkit.org/show_bug.cgi?id=76144
+        <rdar://problem/10681711>
+
+        Rubber stamped by Gavin Barraclough.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addressOfJITExecuteCounter):
+        (JSC::CodeBlock::offsetOfJITExecuteCounter):
+        (JSC::CodeBlock::jitExecuteCounter):
+        (JSC::CodeBlock::optimizeNextInvocation):
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon):
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::optimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+
+2012-01-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Merge 'Getter'/'Setter' attributes into 'Accessor'
+        https://bugs.webkit.org/show_bug.cgi?id=76141
+
+        Reviewed by Filip Pizlo.
+
+        These are currently ambiguous (and used inconsistently). It would logically appear
+        that either being bit set implies that the corresponding type of accessor is present
+        but (a) we don't correctly enforce this, and (b) this means the attributes would not
+        be able to distinguish between a data descriptor and an accessor descriptor with
+        neither a getter nor setter defined (which is a descriptor permissible under the spec).
+        This ambiguity would lead to unsafe property caching behavior (though this does not
+        represent an actual current bug, since we are currently unable to create descriptors
+        that have neither a getter nor setter, it just prevents us from doing so).
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::createStrictModeCallerIfNecessary):
+        (JSC::Arguments::createStrictModeCalleeIfNecessary):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::JSArray::putDescriptor):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::finishCreation):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::initializeGetterSetterProperty):
+        (JSC::JSObject::defineSetter):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorDefineProperty):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        (JSC::PropertyDescriptor::setSetter):
+        (JSC::PropertyDescriptor::setGetter):
+        (JSC::PropertyDescriptor::attributesOverridingCurrent):
+
+2012-01-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Object.defineProperty([], 'length', {}) should not make length read-only
+        https://bugs.webkit.org/show_bug.cgi?id=76097
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+            - We should be checking writablePresent().
+
+2012-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Code duplication for invoking the JIT and DFG should be reduced
+        https://bugs.webkit.org/show_bug.cgi?id=76117
+        <rdar://problem/10680189>
+
+        Rubber stamped by Geoff Garen.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITDriver.h: Added.
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2012-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Bytecode dumping is broken for call opcodes (due to two new operands)
+        https://bugs.webkit.org/show_bug.cgi?id=75886
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp): Made a helper function, so I wouldn't have
+        to fix this more than once. The helper function skips the extra two operands
+        at the end of the opcode, used for optimization.
+        
+        (JSC::CodeBlock::dump): Used the helper function.
+
+        * bytecode/CodeBlock.h: Declared the helper function.
+
+2012-01-09  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: d3 Bullet Charts demo doesn't work (call with argument assignment is broken)
+        https://bugs.webkit.org/show_bug.cgi?id=75911
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeForLeftHandSide): Cleanup: No need to
+        explicitly cast to our return type in C++.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode): Make sure to copy our function
+        into a temporary register before evaluating our arguments, since argument
+        evaluation might include function calls or assignments that overwrite our callee by name.
+
+2012-01-11  Michael Saboff  <msaboff@apple.com>
+
+        v8-regexp spends 35% of its time allocating and copying internal regexp results data
+        https://bugs.webkit.org/show_bug.cgi?id=76079
+
+        Reviewed by Geoffrey Garen.
+
+        Added a new RegExpResults struct that has the input string, the number of
+        subexpressions and the output vector.  Changed RegExpConstructor to
+        include a RegExpConstructorPrivate instead of having a reference to one.
+        Changed RegExpMatchesArray to include a RegExpResults instead of a 
+        reference to a RegExpConstructorPrivate.  Created an overloaded assignment
+        operator to assign a RegExpConstructorPrivate to a RegExpResults.
+        Collectively this change is worth 24% performance improvement to v8-regexp.
+        
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpResult::operator=):
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::finishCreation):
+        (JSC::RegExpMatchesArray::~RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        (JSC::RegExpConstructor::arrayOfMatches):
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::RegExpConstructor::setInput):
+        (JSC::RegExpConstructor::input):
+        (JSC::RegExpConstructor::setMultiline):
+        (JSC::RegExpConstructor::multiline):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpResult::RegExpResult):
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::create):
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::getOwnPropertySlotByIndex):
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::putByIndex):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::deletePropertyByIndex):
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+
+2012-01-11  Eugene Girard  <girard@google.com>
+
+        Typo in error message: Unexpected token 'defualt'
+        https://bugs.webkit.org/show_bug.cgi?id=75105
+
+        Reviewed by Simon Fraser.
+
+        * parser/Parser.h:
+        (JSC::Parser::getTokenName):
+
+2012-01-11  Anders Carlsson  <andersca@apple.com>
+
+        Assertion failure in JSC::allocateCell trying to allocate a JSString
+        https://bugs.webkit.org/show_bug.cgi?id=76101
+
+        Reviewed by Adam Roben.
+
+        Remove the ExecutableBase::s_info and JSString::s_info static member variables  from the .def file and
+        export them explicitly using the JS_EXPORTDATA macro.
+
+        member variables explicitly using 
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/Executable.h:
+        * runtime/JSString.h:
+
+2012-01-10  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/10673792> jsc should install directly in to versioned Resources subfolder
+
+        This ensures that jsc ends up in a consistent location whether built in to the same DSTROOT
+        as JavaScriptCore.framework or in to a different one.
+
+        Rubber-stamped by Dan Bernstein.
+
+        * Configurations/JSC.xcconfig: Update INSTALL_PATH.
+
+2012-01-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG inlining block linking compares BlockIndex against bytecode index
+        https://bugs.webkit.org/show_bug.cgi?id=76018
+        <rdar://problem/10671979>
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+
+2012-01-10  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock.h declares too many things
+        https://bugs.webkit.org/show_bug.cgi?id=76001
+
+        Rubber stamped by Gavin Barraclough.
+        
+        Removed all non-CodeBlock type declarations from CodeBlock.h, and put them
+        into separate header files. Also removed all non-CodeBlock method implementations
+        from CodeBlock.cpp and put them into corresponding cpp files.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/RepatchBuffer.h:
+        * bytecode/CallLinkInfo.cpp: Added.
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CallLinkInfo.h: Added.
+        (JSC::CallLinkInfo::callTypeFor):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::~CallLinkInfo):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::getCallLinkInfoReturnLocation):
+        (JSC::getCallLinkInfoBytecodeIndex):
+        * bytecode/CallReturnOffsetToBytecodeOffset.h: Added.
+        (JSC::CallReturnOffsetToBytecodeOffset::CallReturnOffsetToBytecodeOffset):
+        (JSC::getCallReturnOffset):
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeType.h: Added.
+        * bytecode/ExpressionRangeInfo.h: Added.
+        * bytecode/GlobalResolveInfo.h: Added.
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        * bytecode/HandlerInfo.h: Added.
+        * bytecode/LineInfo.h: Added.
+        * bytecode/MethodCallLinkInfo.cpp: Added.
+        (JSC::MethodCallLinkInfo::reset):
+        * bytecode/MethodCallLinkInfo.h: Added.
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        (JSC::getMethodCallLinkInfoReturnLocation):
+        (JSC::getMethodCallLinkInfoBytecodeIndex):
+        * bytecode/StructureStubInfo.h:
+        (JSC::getStructureStubInfoReturnLocation):
+        (JSC::getStructureStubInfoBytecodeIndex):
+
+2012-01-10  Anders Carlsson  <andersca@apple.com>
+
+        Hang opening movie that requires authentication
+        https://bugs.webkit.org/show_bug.cgi?id=75989
+        <rdar://problem/9601915>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Functional.h:
+        Add function wrapper for a function that takes three parameters.
+
+2012-01-10  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock::m_numParameters should be encapsulated
+        https://bugs.webkit.org/show_bug.cgi?id=75985
+        <rdar://problem/10671020>
+
+        Reviewed by Oliver Hunt.
+        
+        Encapsulated CodeBlock::m_numParameters and hooked argument profile creation
+        into it.  This appears to be performance neutral.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::setNumParameters):
+        (JSC::CodeBlock::addParameter):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numParameters):
+        (JSC::CodeBlock::addressOfNumParameters):
+        (JSC::CodeBlock::offsetOfNumParameters):
+        (JSC::CodeBlock::numberOfArgumentValueProfiles):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addParameter):
+        (JSC::BytecodeGenerator::emitReturn):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::slideRegisterWindowForCall):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::arityCheckFor):
+        (JSC::lazyLinkFor):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2012-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix following https://bugs.webkit.org/show_bug.cgi?id=75935
+
+        Fix 32-bit builds.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+
+2012-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Do not allow Array length to be set if it is non-configurable
+        https://bugs.webkit.org/show_bug.cgi?id=75935
+
+        Reviewed by Sam Weinig.
+
+        Do not allow Array length to be set if it is non-configurable, and if the new
+        length is less than the old length then intervening properties should removed
+        in reverse order. Removal of properties should cease if an intervening indexed
+        property being removed is non-configurable.
+
+        * JavaScriptCore.exp:
+            - Removed export for setLength.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+            - JSArray::setLength now takes an ExecState*
+        (JSC::arrayProtoFuncSlice):
+            - JSArray::setLength now takes an ExecState*
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+            - JSArray::setLength now takes an ExecState*
+        (JSC::JSArray::put):
+            - JSArray::setLength now takes an ExecState*
+        (JSC::compareKeysForQSort):
+            - Keys extracted from the map can be stored as unsigneds.
+        (JSC::JSArray::getOwnPropertyNames):
+            - Keys extracted from the map can be stored as unsigneds.
+        (JSC::JSArray::setLength):
+            - Check lengthIsReadOnly(), rather than copying the entire map to iterate
+              over to determine which keys to remove, instead just copy the keys from
+              the map to a Vector. When inSparseMode sort the keys in the Vector so
+              that we can remove properties in reverse order.
+        * runtime/JSArray.h:
+            - JSArray::setLength now takes an ExecState*
+
+2012-01-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Use SameValue to compare property descriptor values
+        https://bugs.webkit.org/show_bug.cgi?id=75975
+
+        Reviewed by Sam Weinig.
+
+        Rather than strictEqual.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnNumericProperty):
+            - Missing configurablePresent() check.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+            - call sameValue.
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::sameValue):
+            - Moved from JSArray.cpp, fix NaN comparison.
+        (JSC::PropertyDescriptor::equalTo):
+            - call sameValue.
+        * runtime/PropertyDescriptor.h:
+            - Added declaration for sameValue.
+2012-01-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Error handling : in ISO8601 timezone
+        https://bugs.webkit.org/show_bug.cgi?id=75919
+
+        Reviewed by Sam Weinig.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+            - need to increment the string position.
+
+2012-01-09  Mark Rowe  <mrowe@apple.com>
+
+        JavaScriptCore executable targets shouldn't explicitly depend on the JavaScriptCore framework target
+        <http://webkit.org/b/75907> / <rdar://problem/10659862>
+
+        We'd like for it to be possible to build jsc without building JavaScriptCore.framework and the explicit
+        dependencies prevent this.
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-01-09  Adam Treat  <atreat@rim.com>
+
+        Log is a little to verbose for blackberry port
+        https://bugs.webkit.org/show_bug.cgi?id=75728
+
+        The BlackBerry::Platform::Log* functions take care of the call to vfprintf
+        which is resulting in unintentional noise in our logs.  Add a conditional
+        directive to fix.
+
+        Change to using BlackBerry::Platform::logStreamV which does not insert
+        threading info and newlines unlike BlackBerry::Platform::log.
+
+        Finally, add log locking and unlocking which the BlackBerry platform
+        uses to ensure that N threads do not trample on each other's logs.
+
+        Reviewed by Rob Buis.
+
+        * wtf/Assertions.cpp:
+        (WTFLogLocker::WTFReportAssertionFailure):
+        (WTFLogLocker::WTFReportAssertionFailureWithMessage):
+        (WTFLogLocker::WTFReportArgumentAssertionFailure):
+        (WTFLogLocker::WTFReportFatalError):
+        (WTFLogLocker::WTFReportError):
+        (WTFLogLocker::WTFLog):
+        (WTFLogLocker::WTFLogVerbose):
+
+2012-01-09  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75789
+        defineOwnProperty not implemented for Array objects
+
+        Reviewed by Sam Weinig.
+
+        Implements support for getter/setter & non-default attribute properties on arrays,
+        by forcing them into a dictionary-like 'SparseMode'. This fixes ~300 test-262
+        test failures.
+
+        * JavaScriptCore.exp:
+            - Updated exports.
+        * dfg/DFGOperations.cpp:
+            - JSArray::pop now requires an exec state.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+            - JSArray::pop now requires an exec state.
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::add):
+            - Add a potentially empty entry into the map.
+        (JSC::SparseArrayValueMap::put):
+            - Changed to call setter.
+        (JSC::SparseArrayEntry::get):
+            - calls getters.
+        (JSC::SparseArrayEntry::getNonSparseMode):
+            - does not call getters.
+        (JSC::JSArray::enterSparseMode):
+            - Convert into 'SparseMode' - removes the vectors, don't allow it to be recreated.
+        (JSC::JSArray::putDescriptor):
+            - Create a numeric property based on a descriptor.
+        (JSC::sameValue):
+            - See ES5.1 9.12.
+        (JSC::reject):
+            - Helper for the [[DefineOwnProperty]] algorithm.
+        (JSC::JSArray::defineOwnNumericProperty):
+            - Define an indexed property on an array object.
+        (JSC::JSArray::setLengthWritable):
+            - Marks the length read-only, enters SparseMode as necessary.
+        (JSC::JSArray::defineOwnProperty):
+            - Defines either an indexed property or 'length' on an array object.
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+            - Updated to correctly handle accessor descriptors & attributes.
+        (JSC::JSArray::getOwnPropertyDescriptor):
+            - Updated to correctly handle accessor descriptors & attributes.
+        (JSC::JSArray::put):
+            - Pass strict mode flag to setLength.
+        (JSC::JSArray::putByIndex):
+            - putByIndexBeyondVectorLength requires an ExecState* rather than a JSGloablData&.
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+            - Pass exec to SparseArrayValueMap::put.
+        (JSC::JSArray::deletePropertyByIndex):
+            - Do not allow deletion of non-configurable properties.
+        (JSC::compareKeysForQSort):
+            - used in implementation of getOwnPropertyNames.
+        (JSC::JSArray::getOwnPropertyNames):
+            - Properties in the sparse map should be iterated in order.
+        (JSC::JSArray::setLength):
+            - Updated to take a 'shouldThrow' flag, return a result indicating error.
+        (JSC::JSArray::pop):
+            - pop should throw an error if length is not writable, even if the array is empty.
+        (JSC::JSArray::push):
+            - putByIndexBeyondVectorLength requires an ExecState* rather than a JSGloablData&.
+        (JSC::JSArray::sort):
+            - Changed 'get' to 'getNonSparseMode' (can't be getters to call).
+        (JSC::JSArray::compactForSorting):
+            - Changed 'get' to 'getNonSparseMode' (can't be getters to call).
+        * runtime/JSArray.h:
+        (JSC::SparseArrayValueMap::lengthIsReadOnly):
+            - Check if the length is read only.
+        (JSC::SparseArrayValueMap::setLengthIsReadOnly):
+            - Mark the length as read only.
+        (JSC::SparseArrayValueMap::find):
+            - Moved into header.
+        (JSC::JSArray::isLengthWritable):
+            - Wraps SparseArrayValueMap::lengthIsReadOnly.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+            - Should be returning the result of putDescriptor.
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::attributesOverridingCurrent):
+            - Added attributesOverridingCurrent - this should probably be merged with attributesWithOverride.
+        * runtime/PropertyDescriptor.h:
+            - Added attributesOverridingCurrent.
+
+2012-01-09  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        There is no support for fastcall in Solaris Studio.
+        Fixes build on Solaris.
+        https://bugs.webkit.org/show_bug.cgi?id=75736
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JITStubs.h:
+
+2012-01-09  Pavel Heimlich  <tropikhajma@gmail.com>
+
+        Fix build failure on Solaris
+        https://bugs.webkit.org/show_bug.cgi?id=75733
+
+        Reviewed by Gavin Barraclough.
+
+        * wtf/ByteArray.h:
+
+2012-01-01  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Clean up some cruft from WTF's CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=75420
+
+        Reviewed by Daniel Bates.
+
+        * wtf/CMakeLists.txt: Remove the unused WTF_PORT_FLAGS variable; add
+        all needed paths to WTF_INCLUDE_DIRECTORIES in a single place.
+
+2012-01-08  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Fix compilation error about ListHashSetReverseIterator
+        https://bugs.webkit.org/show_bug.cgi?id=75372
+
+        Reviewed by Darin Adler.
+
+        There is a typo in class ListHashSetReverseIterator:
+        typedef ListHashSetConstIterator<ValueArg, inlineCapacity, HashArg> const_reverse_iterator;
+        Should be
+        typedef ListHashSetConstReverseIterator<ValueArg, inlineCapacity, HashArg> const_reverse_iterator;
+
+        * wtf/ListHashSet.h:
+
+2012-01-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        WinCE build fix after r104415.
+
+        * jit/JITExceptions.cpp:
+        * jit/JITExceptions.h:
+
+2012-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        The JIT's protocol for exception handling should be available to other parts of the system
+        https://bugs.webkit.org/show_bug.cgi?id=75808
+        <rdar://problem/10661025>
+
+        Reviewed by Oliver Hunt.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * jit/JITExceptions.cpp: Added.
+        (JSC::genericThrow):
+        (JSC::jitThrow):
+        * jit/JITExceptions.h: Added.
+        * jit/JITStubs.cpp:
+        * runtime/JSGlobalData.h:
+
+2012-01-06  Hajime Morrita  <morrita@chromium.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75296
+        JSString should not have JS_EXPORTCLASS annotation
+
+        Reviewed by Kevin Ollivier.
+
+        * runtime/JSString.h: Removed JS_EXPORTCLASS annotation.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Added missing symbols which were hidden by JS_EXPORTCLASS.
+
+2012-01-06  Michael Saboff  <msaboff@apple.com>
+
+        JSArray::pop() should compare SparseArrayValueMap::find() to SparseArrayValueMap::notFound()
+        https://bugs.webkit.org/show_bug.cgi?id=75757
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop): Changed map->end() to map->notFound().
+
+2012-01-06  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT stub slow paths that would be identical to that of an interpreter should be factored out
+        https://bugs.webkit.org/show_bug.cgi?id=75743
+        <rdar://problem/10657024>
+
+        Reviewed by Geoff Garen.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/CommonSlowPaths.h: Added.
+        (JSC::CommonSlowPaths::opInstanceOfSlow):
+        (JSC::CommonSlowPaths::opIn):
+        (JSC::CommonSlowPaths::opResolve):
+        (JSC::CommonSlowPaths::opResolveSkip):
+        (JSC::CommonSlowPaths::opResolveWithBase):
+        (JSC::CommonSlowPaths::opResolveWithThis):
+
+2012-01-06  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * wtf/TypeTraits.cpp:
+
+2012-01-05  Michael Saboff  <msaboff@apple.com>
+
+        Default HashTraits for Opcode don't work for Opcode = 0
+        https://bugs.webkit.org/show_bug.cgi?id=75595
+
+        Reviewed by Oliver Hunt.
+
+        Removed the populating of the m_opcodeIDTable table in the
+        case where the OpcodeID and Opcode are the same (m_enabled is false).
+        Instead we just cast the one type to the other.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcodeID):
+
+2012-01-06  Sam Weinig  <sam@webkit.org>
+
+        Add a DecayArray type trait as a first step towards merging OwnPtr and OwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=75737
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/TypeTraits.cpp:
+        * wtf/TypeTraits.h:
+        Added a DecayArray trait, that can convert T[] and T[3] -> T*. DecayArray
+        is composed of some helpers which are also exposed, Conditional<>, which
+        can provide one type or another based on a boolean predicate, IsArray<>
+        which can deduce array types, and RemoveExtent<>, which removes the extent
+        from an array type. 
+
+2012-01-06  Oliver Hunt  <oliver@apple.com>
+
+        GetByteArrayLength is incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=75735
+
+        Reviewed by Filip Pizlo.
+
+        Load the byte array length from the correct location.
+        This stops an existing test from hanging.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-01-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-01-06  Oliver Hunt  <oliver@apple.com>
+
+        DFG no longer optimises CanvasPixelArray
+        https://bugs.webkit.org/show_bug.cgi?id=75729
+
+        Reviewed by Gavin Barraclough.
+
+        Rename ByteArray (in its ClassInfo) to Uint8ClampedArray to match
+        the future name when we switch over to the new typed-array based
+        ImageData specification.
+
+        * runtime/JSByteArray.cpp:
+
+2012-01-06  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Use HashMap<OwnPtr> for SourceProviderCache items
+        https://bugs.webkit.org/show_bug.cgi?id=75346
+
+        Reviewed by Daniel Bates.
+
+        * parser/Parser.cpp:
+        * parser/SourceProviderCache.cpp:
+        (JSC::SourceProviderCache::clear):
+        (JSC::SourceProviderCache::add):
+        * parser/SourceProviderCache.h:
+
+2012-01-06  Sam Weinig  <sam@webkit.org>
+
+        Remove unused OwnFastMallocPtr class.
+        https://bugs.webkit.org/show_bug.cgi?id=75722
+
+        Reviewed by Geoffrey Garen.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/OwnFastMallocPtr.h: Removed.
+        * wtf/text/StringImpl.h:
+        * wtf/wtf.pro:
+
+2012-01-06  Benjamin Poulain  <bpoulain@webkit.org>
+
+        [Mac] Sort the resources of JavaScriptCore.xcodeproj and remove duplicates
+        https://bugs.webkit.org/show_bug.cgi?id=75631
+
+        Reviewed by Andreas Kling.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-01-06  Eric Seidel  <eric@webkit.org> and Gustavo Noronha Silva  <gustavo.noronha@collabora.com>
+
+        Make the new WTF module build on Gtk
+        https://bugs.webkit.org/show_bug.cgi?id=75669
+
+        * GNUmakefile.am:
+
+2012-01-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Remove un-needed VPATHs from project includes
+
+        Reviewed by Simon Hausmann.
+
+        * JavaScriptCore.pri:
+        * wtf/wtf.pri:
+
+2012-01-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Move listing of include paths and libs to pri files in sources
+
+        Includepaths are sometimes modified by non-Qt contributors so keeping
+        them in files inside Sources makes it more likely that they are updated
+        along with project files for the other ports.
+
+        Using pri files instead of prf files for this also has the benefit that
+        the include() from the main target file can be parsed and followed by
+        Qt Creator -- something that does not work with load().
+
+        Dependency from a target to a library through the WEBKIT variable are
+        handled through forwarding-files in Tools/qmake/mkspecs/modules, which
+        set the source root of the module and include the right pri file.
+
+        Ideally we'd use the variant of include() that takes an optional
+        namespace to read the variables into, or the fromfile() function,
+        but both of these add an overhead of about 40% on the total qmake
+        runtime, due to making a deep copy of all the variables in the
+        project or re-reading all the prf files from scratch.
+
+        Reviewed by Simon Hausmann.
+        Reviewed by Ossy.
+
+        * JavaScriptCore.pri: Renamed from Tools/qmake/mkspecs/features/javascriptcore.prf.
+        * Target.pri:
+        * wtf/wtf.pri: Renamed from Tools/qmake/mkspecs/features/wtf.prf.
+        * wtf/wtf.pro:
+
+2012-01-06  Hajime Morrita  <morrita@chromium.org>
+
+        WTF::String: Inline method shouldn't have WTF_EXPORT_PRIVATE
+        https://bugs.webkit.org/show_bug.cgi?id=75612
+
+        Reviewed by Kevin Ollivier.
+
+        * wtf/text/WTFString.h:
+        (WTF::String::findIgnoringCase):
+        (WTF::String::append):
+        (WTF::String::fromUTF8):
+        (WTF::String::fromUTF8WithLatin1Fallback):
+        (WTF::String::isHashTableDeletedValue):
+
+2012-01-05  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10633760> Update copyright strings
+
+        Reviewed by Mark Rowe.
+
+        * Info.plist:
+
+2012-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Date constructor handles infinite values incorrectly.
+        https://bugs.webkit.org/show_bug.cgi?id=70998
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+            - should be checking !finite rather then isnan.
+
+2012-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        date.toISOString produces incorrect results for dates with ms prior to 1970
+        https://bugs.webkit.org/show_bug.cgi?id=75684
+
+        Reviewed by Sam Weinig.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+
+2012-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype.lastIndexOf ignores undefined fromIndex.
+        https://bugs.webkit.org/show_bug.cgi?id=75678
+
+        Reviewed by Sam Weinig.
+
+        array.lastIndexOf(x, undefined) is equivalent to array.lastIndexOf(x, 0), not array.lastIndexOf(x)
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncLastIndexOf):
+            - should check argumnet count, rather than checking agument value for undefined.
+
+2012-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Date parsing is too restrictive.
+        https://bugs.webkit.org/show_bug.cgi?id=75671
+
+        Reviewed by Oliver Hunt.
+
+        ES5 date parsing currently requires all fields to be present, which does not match the spec (ES5.1 15.9.1.15).
+        The spec allow a date to be date only, or date + time.
+
+        The date portion on the should match: (pseudocode!:)
+            [(+|-)YY]YYYY[-MM[-DD]]
+        though we are slightly more liberal (permitted by the spec), allowing:
+            [+|-]Y+[-MM[-DD]]
+        The time portion should match:
+            THH:mm[:ss[.sss]][Z|(+|-)HH:mm]
+        again we're slightly more liberal, allowing:
+            THH:mm[:ss[.s+]][Z|(+|-)HH:mm]
+
+        * wtf/DateMath.cpp:
+        (WTF::parseES5DatePortion):
+            - Month/day fields are optional, default to 01.
+        (WTF::parseES5TimePortion):
+            - Hours/Minutes are requires, seconds/timezone are optional.
+        (WTF::parseES5DateFromNullTerminatedCharacters):
+            - Dates may be date only, or date + time.
+
+2012-01-05  Bruno Dilly  <bdilly@profusion.mobi>
+
+        [EFL] Undefined references to ICU_I18N symbols on WTF
+        https://bugs.webkit.org/show_bug.cgi?id=75642
+
+        Unreviewed build fix.
+
+        Add ${ICU_I18N_LIBRARIES} to WTF_LIBRARIES on wtf efl platform cmake.
+        Some undefined references were ucol_setAttribute_44, ucol_close_44,
+        ucol_getAttribute_44...
+
+        * wtf/PlatformEfl.cmake:
+
+2012-01-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Refined the fast path for StringImpl::hash()
+        https://bugs.webkit.org/show_bug.cgi?id=75178
+
+        Reviewed by Darin Adler.
+
+        Moved the hash calculation code into an out-of-line function to clean up
+        the hot path.
+
+        No measurable benchmark change, but this knocks some samples off in
+        Instruments, and I think this is a step toward removing -fomit-frame-pointer.
+        
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::hashSlowCase):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::hash): The patch.
+
+        * wtf/text/StringStatics.cpp:
+        (WTF::StringImpl::hashSlowCase): Abide by the cockamamie Windows build
+        scheme, which requires all out-of-line StringImpl functions used by
+        WebCore be defined in this file instead of StringImpl.cpp. (See http://trac.webkit.org/changeset/59187.)
+
+2012-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Literal tab in JSONString fails
+        https://bugs.webkit.org/show_bug.cgi?id=71772
+
+        Reviewed by Oliver Hunt.
+
+        rfc4627 does not allow literal tab characters in JSON source.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::isSafeStringCharacter):
+            - do not allow literal tab in StrictJSON mode.
+
+2012-01-05  Gavin Barraclough  <barraclough@apple.com>
+
+        push/shift fifo may consume excessive memory
+        https://bugs.webkit.org/show_bug.cgi?id=75610
+
+        Reviewed by Sam Weinig.
+
+        Array object commonly store data in a vector, consisting of a portion that is
+        in use, a pre-capacity (m_indexBias) and a post-capacity (the delta between
+        m_length and m_vectorLength). Calls to shift with grow the pre-capacity, and
+        the current algorithm for increaseVectorLength (used by push, or [[Put]]) will
+        never shrink the pre-capacity, so a push/shift fifo may consume an inordinate
+        amount of memory, whilst having a relatively small active length.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::increaseVectorLength):
+            - If m_indexBias is non-zero, decay it over time.
+
+2012-01-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        unshift/pop fifo may consume excessive memory
+        https://bugs.webkit.org/show_bug.cgi?id=75588
+
+        Reviewed by Zoltan Herczeg.
+
+        Buildfix after r104120.
+
+        * runtime/JSArray.cpp: Remove useless asserts, baecause unsigned expression >= 0 is always true
+        (JSC::JSArray::unshiftCount):
+
+2012-01-05  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Unreviewed gardening after r104134.
+
+        * wtf/Assertions.cpp:
+
+2012-01-05  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Unreviewed gardening after r75605.
+
+        Rubber stamped by NOBODY Csaba Osztrogonác.
+
+        * wtf/Assertions.cpp:
+
+2012-01-05  Benjamin Poulain  <benjamin@webkit.org>
+
+        Improve charactersAreAllASCII() to compare multiple characters at a time
+        https://bugs.webkit.org/show_bug.cgi?id=74063
+
+        Reviewed by Darin Adler.
+
+        A new header ASCIIFastPath.h contains the functions related to
+        the detection of ASCII by using machine words. Part of it comes from
+        WebCore's TextCodecASCIIFastPath.h.
+
+        The function charactersAreAllASCII() is moved to TextCodecASCIIFastPath.h
+        and is implemented with computer word comparison.
+        The gain over the previous implementation of charactersAreAllASCII() is of
+        the order of how many comparison are avoided (4x, 8x, 16x depending on the
+        format and the CPU type).
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/ASCIIFastPath.h: Added.
+        (WTF::isAlignedToMachineWord):
+        (WTF::alignToMachineWord):
+        (WTF::isAllASCII):
+        (WTF::charactersAreAllASCII):
+        * wtf/text/WTFString.h:
+        * wtf/wtf.pro:
+
+2012-01-05  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/75606> [Mac] WTF logging functions should output to both stderr and ASL
+
+        We should always log to both ASL and stderr on platforms where this won't result in launchd
+        duplicating the messages.
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/Assertions.cpp:
+        (vprintf_stderr_common):
+
+2012-01-05  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/75605> WTF logging functions should call vprintf_stderr_common only once per line
+
+        Several of the WTF logging functions make multiple calls to vprintf_stderr_common to output a
+        single line of text. This results in strangely formatted output if vprintf_stderr_common is
+        retargeted to an output device that is message-oriented (such as ASL) rather than stream-oriented
+        like stderr.
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/Assertions.cpp:
+        (vprintf_stderr_with_prefix): Helper function to prepend a given prefix on to the given format
+        string before handing it off to vprintf_stderr_common. This requires disabling warnings about
+        calling a printf-like function with a non-literal format string for this piece of code. It's
+        safe in this particular case as vprintf_stderr_with_prefix is only ever given a literal prefix.
+        (vprintf_stderr_with_trailing_newline): Helper function to append a trailling newline on to the
+        given format string if one does not already exist. It requires the same treatment with regards
+        to the non-literal format string warning.
+        (WTFReportAssertionFailureWithMessage): Switch to using vprintf_stderr_with_prefix.
+        (WTFReportBacktrace): Switch from calling fprintf directly to using fprintf_stderr_common.
+        (WTFReportFatalError): Switch to using vprintf_stderr_with_prefix.
+        (WTFReportError): Ditto.
+        (WTFLog): Switch to using vprintf_stderr_with_trailing_newline.
+        (WTFLogVerbose): Ditto.
+
+2012-01-04  Gavin Barraclough  <barraclough@apple.com>
+
+        unshift/pop fifo may consume excessive memory
+        https://bugs.webkit.org/show_bug.cgi?id=75588
+
+        Reviewed by Sam Weinig.
+
+        The Array object commonly store data in a vector, consisting of a portion that
+        is in use, a pre-capacity (m_indexBias) and a post-capacity (the delta between
+        m_length and m_vectorLength). Calls to pop with grow the post-capacity, and the
+        current algorithm for increasePrefixVectorLength (used by unshift) will never
+        stink the post-capacity, so a unshift/pop fifo may consume an inordinate amount
+        of memory, whilst having a relatively small active length.
+
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+            - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
+        (JSC::SparseArrayValueMap::put):
+            - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
+        (JSC::JSArray::increaseVectorLength):
+            - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>)
+        (JSC::JSArray::unshiftCountSlowCase):
+            - renamed from increaseVectorPrefixLength (this was a bad name, since it
+              also moved the ArrayStorage header), rewritten.
+        (JSC::JSArray::shiftCount):
+            - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>), count should be unsigned
+        (JSC::JSArray::unshiftCount):
+            - sizeof(JSValue) should be sizeof(WriteBarrier<Unknown>), count should be unsigned,
+              increaseVectorPrefixLength renamed to unshiftCountSlowCase
+        (JSC::JSArray::sortNumeric):
+        * runtime/JSArray.h:
+            - Updated function declarations, m_indexBias should be unsigned.
+
+2012-01-04  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/75604> All instances of JSC::ArgumentsData appear to be leaked by JSC::Arguments
+
+        Since JSC::Arguments has an OwnPtr for a member it needs to override destroy
+        to ensure that the correct destructor is invoked. This is necessary because
+        JSCell subclasses all intentionally have non-virtual destructors.
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::destroy):
+        * runtime/Arguments.h:
+
+2012-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, accidentally turned off the JIT in previous commit. Turning
+        it back on.
+
+        * wtf/Platform.h:
+
+2012-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Changed "return" to "break" in some macrology I introduced in
+        http://trac.webkit.org/changeset/104086. This is a benign change, as
+        "return" was technically correct for all uses of the macro.
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGGraph.cpp:
+        * wtf/Platform.h:
+
+2012-01-04  Michael Saboff  <msaboff@apple.com>
+
+        StructureStubInfo not reset when corresponding MethodCallLinkInfo is reset
+        https://bugs.webkit.org/show_bug.cgi?id=75583
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally): Find the corresponding
+        StructureStubInfo and reset the appropriate JIT and
+        the StructureStubInfo itself when reseting a MethodCallLinkInfo.
+
+2012-01-04  Michael Saboff  <msaboff@apple.com>
+
+        Invalid ASSERT() in DFGRepatch.cpp near line 385
+        https://bugs.webkit.org/show_bug.cgi?id=75584
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDProtoList): Fixed ASSERT to use ==.
+
+2012-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Incorrect use of DFG node reference counts when mutating the graph
+        https://bugs.webkit.org/show_bug.cgi?id=75580
+        <rdar://problem/10644607>
+
+        Reviewed by Oliver Hunt.
+        
+        Made deref(node) follow the pattern of ref(node), which it should have
+        to begin with.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::refChildren):
+        (JSC::DFG::Graph::derefChildren):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::deref):
+        (JSC::DFG::Graph::clearAndDerefChild1):
+        (JSC::DFG::Graph::clearAndDerefChild2):
+        (JSC::DFG::Graph::clearAndDerefChild3):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::deref):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixupNode):
+
+2012-01-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Introduce new qmake variable 'WEBKIT' for signaling dependencies
+
+        The custom qmake variable 'WEBKIT' is used for signaling that a
+        target depends in some way on other subproject of the WebKit
+        project. For now this is limited to the set of intermediate
+        libraries: wtf, javascriptcore, webcore, and webkit2.
+
+        This replaces the previous convension of using load(foo) for
+        just include paths, and CONFIG += foo to also link against foo.
+
+        Adding a dependency results in additional include paths being
+        available, and potentially linking to the library. This is
+        decided by the build system based on conditions such as what
+        kind of target is being built and the general build config.
+
+        An advantage to his approach is that it simplifies the individual
+        foo.prf files, for example by allowing us to use INCLUDEPATH +=
+        and LIBS += as normal instead of prepending.
+
+        Reviewed by Simon Hausmann.
+
+        * Target.pri:
+        * jsc.pro:
+        * wtf/wtf.pro:
+
+2012-01-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG: The assertion that a double-voted variable cannot become double-unvoted is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=75516
+        <rdar://problem/10640266>
+
+        Reviewed by Gavin Barraclough.
+        
+        Removed the offending assertion, since it was wrong.  Also hardened the code to make
+        this case less likely by first having the propagator fixpoint converge, and then doing
+        double voting combined with a second fixpoint.  This is neutral on benchmarks and
+        fixes the assertion in a fairly low-risk way (i.e. we won't vote a variable double
+        until we've converged to the conclusion that it really is double).
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagatePredictions):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
+
+2012-01-03  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r98196-98236): Incorrect layout of iGoogle with RSS feeds
+        https://bugs.webkit.org/show_bug.cgi?id=75303
+        <rdar://problem/10633533>
+
+        Reviewed by Gavin Barraclough.
+        
+        The this argument was not being kept alive in some cases during inlining and intrinsic
+        optimizations.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::emitFunctionCheck):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+
+2012-01-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-01-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-01-03  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75140
+
+        Reviewed by Sam Weinig.
+
+        Rewrite JSArray::putSlowCase to be much cleaner & simpler.
+
+        This rewrite only significantly changes behaviour for sparse array, specifically
+        in how sparse arrays are reified back to vector form. This does not affect arrays
+        with less than 10000 entries (since these always use a vector). The more common
+        cases of sparse array behavior (though large sparse arrays are rare) - arrays that
+        always remain sparse, and arrays that are filled in reverse sequential order -
+        should be just as fast or faster (since reification is simpler & no longer
+        requires map lookups) after these changes.
+
+        Simplifying this code allows all cases of putByIndex that need to grow the vector
+        to do so via increaseVectorLength, which means that this method can encapsulate
+        the policy of determining how the vector should be grown.
+
+        No performance impact.
+
+        * runtime/JSArray.cpp:
+        (JSC::isDenseEnoughForVector):
+            - any array of length <= MIN_SPARSE_ARRAY_INDEX is dense enough for a vector.
+        (JSC::JSArray::putByIndex):
+            - simplify & comment.
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+            - Re-written to be much clearer & simpler.
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::increaseVectorPrefixLength):
+            - add explicit checks against MAX_STORAGE_VECTOR_LENGTH, so clients do not need do so.
+        (JSC::JSArray::push):
+            - simplify & comment.
+        * runtime/JSArray.h:
+            - removed SparseArrayValueMap::take.
+
+2012-01-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-01-03  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75140
+
+        Reviewed by Sam Weinig.
+
+        Simplify JSArray creation - remove ArgsList/JSValue* create methods
+        (this functionality can be implemented in terms of tryCreateUninitialized).
+
+        * JavaScriptCore.exp:
+        * runtime/ArrayConstructor.cpp:
+            - use constructArray/constructEmptyArray instead of calling JSArray::create directly
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/JSArray.cpp:
+        * runtime/JSArray.h:
+            - removed ArgsList/JSValue* create methods
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+            - changed to be implemented in terms of JSArray::tryCreateUninitialized
+
+2012-01-03  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75429
+        ThrowTypeError should be a singleton object
+
+        Reviewed by Sam Weinig.
+
+        Per section 13.2.3 of the spec.
+        We could change setAccessorDescriptor to be able to share the global
+        GetterSetter object, rather than storing the accessor functions and
+        creating a new GetterSetter in defineProperty - but this won't be a
+        small change to PropertyDescriptors (and would probably mean making
+        GetterSetter objects immutable?) - so I'll leave that for another
+        patch.
+
+        * JavaScriptCore.exp:
+            - don't export setAccessorDescriptor
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::createStrictModeCallerIfNecessary):
+        (JSC::Arguments::createStrictModeCalleeIfNecessary):
+            - call throwTypeErrorGetterSetter instead of createTypeErrorFunction
+        * runtime/Error.cpp:
+        * runtime/Error.h:
+            - remove createTypeErrorFunction
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+            - remove unused createDescriptorForThrowingProperty
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+            - removed m_strictModeTypeErrorFunctionStructure.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::internalFunctionStructure):
+            - removed m_strictModeTypeErrorFunctionStructure.
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+            - changed to take a GetterSetter
+        * runtime/PropertyDescriptor.h:
+            - changed to take a GetterSetter
+
+2012-01-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Check in fixes for jsc tests following bug #75455.
+
+        * tests/mozilla/ecma/GlobalObject/15.1.2.2-1.js:
+        * tests/mozilla/ecma/GlobalObject/15.1.2.2-2.js:
+
+2012-01-02  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75452
+        If argument to Error is undefined, message is not set
+
+        Reviewed by Sam Weinig.
+
+        Per section 15.11.1.1 of the spec.
+
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::create):
+        (JSC::ErrorInstance::finishCreation):
+
+2012-01-02  Gavin Barraclough  <barraclough@apple.com>
+
+        ES5 prohibits parseInt from supporting octal
+        https://bugs.webkit.org/show_bug.cgi?id=75455
+
+        Reviewed by Sam Weinig.
+
+        See sections 15.1.2.2 and annex E.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+
+2012-01-02  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=55343
+        Global JSON should be configurable but isn't
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            - make JSON configurable
+
+2012-01-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Call instructions should leave room for linking information
+        https://bugs.webkit.org/show_bug.cgi?id=75422
+        <rdar://problem/10633985>
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+
+2011-12-31  Dan Bernstein  <mitz@apple.com>
+
+        Continue trying to fix the Windows build after r103823.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-12-31  Dan Bernstein  <mitz@apple.com>
+
+        Start trying to fix the Windows build after r103823.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-12-30  Anders Carlsson  <andersca@apple.com>
+
+        Add a ParamStorageTraits specialization for RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=75392
+
+        Reviewed by Daniel Bates.
+
+        * wtf/Functional.h:
+        Add a partial specialization of ParamStorageTraits for RetainPtr<T>.
+
+        * wtf/RetainPtr.h:
+        Bring in the retainPtr function template from WTF.
+
+2011-12-29  Sam Weinig  <sam@webkit.org>
+
+        It should be easier to iterate a Vector backwards
+        https://bugs.webkit.org/show_bug.cgi?id=75359
+
+        Reviewed by Anders Carlsson.
+
+        Adds Vector::rbegin(), Vector::rend(), and Vector::reversed(),
+        a new proxy driven way to access a vector backwards. One can use
+        reversed() in a range-based for loop like so:
+
+            for (auto val: myVector.reversed())
+                doSomething(val)
+
+        * wtf/Vector.h:
+        (WTF::Vector::~Vector):
+        Fix style.
+
+        (WTF::Vector::rbegin):
+        (WTF::Vector::rend):
+        Added using standard adaptor std::reverse_iterator.
+
+        (WTF::Vector::reversed):
+        (WTF::Vector::VectorReverseProxy::begin):
+        (WTF::Vector::VectorReverseProxy::end):
+        Add proxy similar to one used in HashMap for keys() and values()
+        which allows access to a Vector backwards for use in range-based
+        for loops.
+
+2011-12-29  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75140
+
+        Reviewed by Oliver Hunt.
+
+        Start cleaning up JSArray construction. JSArray has a set of create methods,
+        one of which (currently) takes a 'creation mode' enum parameter. Based on that
+        parameter, the constructor does one of two completely different things. If the
+        parameter is 'CreateInitialized' it creates an array, setting the length, but
+        does not eagerly allocate a storage vector of the specified length. A small
+        (BASE_VECTOR_LEN sized) initial vector will be allocated, and cleared, property
+        access to the vector will read the hole value (return undefined). The alternate
+        usage of this method ('CreateCompact') does something very different. It tries
+        to create an array of the requested length, and also allocates a storage vector
+        large enough to hold all properties. It does not clear the storage vector,
+        leaving the memory uninitialized and requiring the user to call a method
+        'uncheckedSetIndex' to initialize values in the vector.
+
+        This patch factors out these two behaviours, moving the 'CreateCompact' mode
+        into its own method, 'tryCreateUninitialized' (matching the naming for this
+        functionality in the string classes). 'tryCreateUninitialized' may return 0 if
+        memory allocation fails during construction of the object. The construction
+        pattern changes such that values added during initialization will be marked if
+        a GC is triggered during array allocation. 'CreateInitialized' no longer need
+        be passed to create a normal, fully constructed array with a length, and this
+        method is merged with the version of 'create' that does not take an initial
+        length (length parameter defaults to 0).
+
+        * JavaScriptCore.exp:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+            - removed 'CreateInitialized' argument
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+            - changed to call 'tryCreateUninitialized'
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+            - changed to call 'tryCreateUninitialized'
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+            - initialize m_storage to null; if construction fails, make destruction safe
+        (JSC::JSArray::finishCreation):
+            - merge versions of this method, takes an initialLength parameter defaulting to zero
+        (JSC::JSArray::tryFinishCreationUninitialized):
+            - version of 'finishCreation' that tries to eagerly allocate storage; may fail & return 0
+        (JSC::JSArray::~JSArray):
+            - check for null m_storage, in case array construction failed.
+        (JSC::JSArray::increaseVectorPrefixLength):
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+            - merge versions of this method, takes an initialLength parameter defaulting to zero
+        (JSC::JSArray::tryCreateUninitialized):
+            - version of 'create' that tries to eagerly allocate storage; may fail & return 0
+        (JSC::JSArray::initializeIndex):
+        (JSC::JSArray::completeInitialization):
+            - used in conjunction with 'tryCreateUninitialized' to initialize the array
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray):
+            - removed 'CreateInitialized' argument
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::finishCreation):
+            - removed 'CreateInitialized' argument
+
+2011-12-29  Anders Carlsson  <andersca@apple.com>
+
+        Add a retainPtr function template
+        https://bugs.webkit.org/show_bug.cgi?id=75365
+
+        Reviewed by Dan Bernstein.
+
+        This makes it easier to make a RetainPtr using template argument deduction, which
+        is useful when passing RetainPtr objects as function arguments.
+
+        * wtf/RetainPtr.h:
+        (WTF::retainPtr):
+
+2011-12-28  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        spill unboxed values in DFG 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=75291
+
+        Reviewed by Filip Pizlo.
+
+        Currently all the values are spilled as boxed in DFG 32_64, which is
+        not necessary and introduces additional stores/loads. Instead we
+        can spill them as unboxed if feasible. It can be applied to the
+        Integers, Cells and Booleans in DFG 32_64. Doubles are left as is
+        because they don't need to be boxed at all. The modifications to the
+        spill/fill and the OSR exit are required, as well as a bug fix to the
+        "isUnknownJS" logic.
+
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::displacedInRegisterFile):
+        (JSC::ValueRecovery::virtualRegister):
+        (JSC::ValueRecovery::dump):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::isUnknownJS):
+        (JSC::DFG::GenerationInfo::spill):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::isKnownNotBoolean):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentFillGPR):
+        (JSC::DFG::SpeculativeJIT::spill):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-28  Anders Carlsson  <andersca@apple.com>
+
+        Add an implicit block conversion operator to WTF::Function
+        https://bugs.webkit.org/show_bug.cgi?id=75325
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/Compiler.h:
+        Add a define for COMPILER_SUPPORTS(BLOCKS). It's only defined for clang, since the gcc blocks implementation
+        is buggy, especially when it comes to C++.
+
+        * wtf/Functional.h:
+        Add a block conversion operator that creates and returns an autoreleased block that will call the function when executed.
+
+2011-12-27  Anders Carlsson  <andersca@apple.com>
+
+        Add a new WTF::bind overload that takes 6 parameters
+        https://bugs.webkit.org/show_bug.cgi?id=75287
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Functional.h:
+
+2011-12-27  Sam Weinig  <sam@webkit.org>
+
+        Continue moving compiler feature checks to use the COMPILER_SUPPORTS() macro
+        https://bugs.webkit.org/show_bug.cgi?id=75268
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Compiler.h:
+        Add support for COMPILER_SUPPORTS(CXX_NULLPTR) and COMPILER_SUPPORTS(CXX_DELETED_FUNCTIONS).
+
+        * wtf/Noncopyable.h:
+        Use COMPILER_SUPPORTS(CXX_DELETED_FUNCTIONS).
+
+        * wtf/NullPtr.cpp:
+        * wtf/NullPtr.h:
+        Use COMPILER_SUPPORTS(CXX_NULLPTR). Remove support for HAVE(NULLPTR).
+
+        * wtf/RefPtr.h:
+        * wtf/RetainPtr.h:
+        Switch from HAVE(NULLPTR) to COMPILER_SUPPORTS(CXX_NULLPTR).
+
+2011-12-27  Anders Carlsson  <andersca@apple.com>
+
+        Misc fixes and cleanups in Functional.h
+        https://bugs.webkit.org/show_bug.cgi?id=75281
+
+        Reviewed by Andreas Kling.
+
+        - Reformat template declarations so that the class begins on a new line.
+        - Change the parameter template parameters to start at P1 instead of P0.
+        - Add function wrappers and bind overloads for 4 and 5 parameter functions.
+        - Change the Function call operator to be const so const functions can be called.
+
+        * wtf/Functional.h:
+
+2011-12-27  Tony Chang  <tony@chromium.org>
+
+        [chromium] Minor cleanup of gyp files.
+        https://bugs.webkit.org/show_bug.cgi?id=75269
+
+        Reviewed by Adam Barth.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: msvs_guid is no longer needed
+        and vim/emacs specific hooks should be added by the user.
+
+2011-12-27  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75260
+        Null name for host function can result in dereference of uninitialize memory
+
+        Reviewed by Filip Pizlo.
+
+        This is a recent regression in ToT, if the name passed to finishCreation of a host function is null,
+        we are currently skipping the putDirect, which leaves memory uninitialized. This patch reverts the
+        aspect of the change that introduced the issue.  It might be better if functions that don't have a
+        name don't have this property at all, but that's change should be separate from fixing the bug.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+            - Always initialize the name property.
+
+2011-12-27  Anders Carlsson  <andersca@apple.com>
+
+        Function should handle wrapping/unwrapping RefPtr and PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=75266
+
+        Reviewed by Sam Weinig.
+
+        Add ParamStorageTraits that can be used for deciding how bound parameters should be stored
+        and peeked at. For RefPtr we want to use the raw pointer when "peeking" to avoid ref-churn.
+        For PassRefPtr, we want to use RefPtr for storage but still use the raw pointer when peeking.
+
+        * wtf/Functional.h:
+        (WTF::ParamStorageTraits::wrap):
+        (WTF::ParamStorageTraits::unwrap):
+
+2011-12-27  Tony Chang  <tony@chromium.org>
+
+        [chromium] really enable wpo for WebCore libs and for WTF
+        https://bugs.webkit.org/show_bug.cgi?id=75264
+
+        Reviewed by Adam Barth.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: Enable WPO for wtf and yarr.
+
+2011-12-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Errk! OS X build fix.
+
+        * JavaScriptCore.exp:
+
+2011-12-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSObject.h:
+
+2011-12-26  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75231
+        Fail to throw in strict mode on assign to read only static properties
+
+        Reviewed by Filip Pizlo.
+
+        There are three bugs here:
+        * symbolTablePut should throw for strict mode accesses.
+        * lookupPut should throw for strict mode accesses.
+        * NumberConstructor should override put to call lookupPut, to trap assignment to readonly properties.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::put):
+        * runtime/JSActivation.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTablePut):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::put):
+        * runtime/NumberConstructor.h:
+
+2011-12-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix miss-commit of utf8 change.
+
+        Reviewed by Filip Pizlo
+
+        Eeep, patch as landed a while ago had no effect! - acidentally landed
+        modified version of patch used for performance testing.
+
+        (This isn't covered by layout tests because layour tests don't use jsc,
+        and the tests/mozilla tests use latin1, which was already supported!)
+
+        Landing changes as intended (and as originally reviewed).
+
+        * jsc.cpp:
+        (jscSource):
+
+2011-12-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for ARMv7.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load16Signed):
+        (JSC::MacroAssemblerARMv7::load8Signed):
+
+2011-12-26  Hajime Morrita  <morrita@google.com>
+
+        Rename WTF_INLINE, JS_INLINE to HIDDEN_INLINE
+        https://bugs.webkit.org/show_bug.cgi?id=74990
+
+        Reviewed by Kevin Ollivier.
+
+        * runtime/JSExportMacros.h: Removed JS_INLINE
+        * wtf/ExportMacros.h: Renamed WTF_INLINE to HIDDEN_INLINE
+
+2011-12-24  Filip Pizlo  <fpizlo@apple.com>
+
+        The ArgumentCount field in the CallFrame should have its tag left blank for other uses
+        https://bugs.webkit.org/show_bug.cgi?id=75199
+        <rdar://problem/10625105>
+        <rdar://problem/10625106>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::argumentCountIncludingThis):
+        (JSC::ExecState::setArgumentCountIncludingThis):
+        * interpreter/Register.h:
+        (JSC::Register::unboxedInt32):
+        (JSC::Register::unboxedBoolean):
+        (JSC::Register::unboxedCell):
+        (JSC::Register::payload):
+        (JSC::Register::tag):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileOpCall):
+
+2011-12-25  Andreas Kling  <awesomekling@apple.com>
+
+        Yarr: Avoid copying vectors in CharacterClassConstructor.
+        <http://webkit.org/b/75206>
+
+        Reviewed by Darin Adler.
+
+        Yarr::CharacterClassConstructor::charClass() was hot when loading twitter
+        feeds (1.2%), replace the usage of Vector::append() by swap() since we're
+        always clearing the source vector afterwards anyway.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+
+2011-12-24  Darin Adler  <darin@apple.com>
+
+        Specialize HashTraits for RefPtr to use PassRefPtr as "pass type" to reduce reference count churn
+        https://bugs.webkit.org/show_bug.cgi?id=72476
+
+        Reviewed by Sam Weinig.
+
+        * wtf/HashTraits.h: Defined PassInType and store function in HashTraits<RefPtr>.
+
+2011-12-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Inlined Yarr::execute
+        https://bugs.webkit.org/show_bug.cgi?id=75180
+
+        Reviewed reluctantly by Beth Dakin.
+        
+        Tiny speedup on SunSpider string tests. Removes some samples from
+        Instruments. A step toward removing -fomit-frame-pointer.
+
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::execute): ONE LINE FUNCTION, Y U NOT INLINED?!
+
+2011-12-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG loads from signed 8-bit and 16-bit typed arrays are broken
+        https://bugs.webkit.org/show_bug.cgi?id=75163
+
+        Reviewed by Geoffrey Garen.
+        
+        Added 8-bit and 16-bit signed loads. Because doing so on ARM is less trivial, I'm
+        currently disabling Int8Array and Int16Array optimizations on ARM.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load8Signed):
+        (JSC::MacroAssemblerX86Common::load16Signed):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movswl_mr):
+        (JSC::X86Assembler::movsbl_mr):
+        * bytecode/PredictedType.h:
+        (JSC::isActionableMutableArrayPrediction):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateInt8Array):
+        (JSC::DFG::Node::shouldSpeculateInt16Array):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+
+2011-12-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG does double-to-int conversion incorrectly when storing into int typed arrays
+        https://bugs.webkit.org/show_bug.cgi?id=75164
+        <rdar://problem/10557547>
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchTruncateDoubleToUint32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToUint32):
+        (JSC::MacroAssemblerX86Common::truncateDoubleToUint32):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+
+2011-12-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored String.prototype.replace
+        https://bugs.webkit.org/show_bug.cgi?id=75114
+        
+        Reviewed by Darin Adler.
+
+        No performance difference.
+        
+        I think this is a step toward removing -fomit-frame-pointer.
+
+        * runtime/JSString.cpp:
+        * runtime/JSString.h: Removed the test and special case for a single-character
+        search string because the standard path does this test and special case
+        for us. (As an aside, if we do come up with a unique single-character
+        replace optimization in future, it probably belongs in the replace function,
+        and not in JSString.)
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Split this mega-sized function into:
+        (JSC::replaceUsingStringSearch): - This reasonably sized function, and
+        (JSC::replaceUsingRegExpSearch): - This still mega-sized function.
+
+2011-12-23  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] REGRESSION(r103467): It broke fast/images/animated-gif-restored-from-bfcache.html
+        https://bugs.webkit.org/show_bug.cgi?id=75087
+
+        monotonicallyIncreasingTime needs to hava a higher resolution than milliseconds.
+
+        Reviewed by Darin Adler.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::monotonicallyIncreasingTime):
+
+2011-12-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not speculate array even when predictions say that the base is not an array
+        https://bugs.webkit.org/show_bug.cgi?id=75160
+        <rdar://problem/10622646>
+        <rdar://problem/10622649>
+
+        Reviewed by Oliver Hunt.
+        
+        Added the ability to call slow path when the base is known to not be an array.
+        Also rationalized the logic for deciding when the index is not an int, and
+        cleaned up the logic for deciding when to speculate typed array.
+        
+        Neutral for the most part, with odd speed-ups and slow-downs. The slow-downs can
+        likely be mitigated by having the notion of a polymorphic array access, where we
+        try, but don't speculate, to access the array one way before either trying some
+        other ways or calling slow path.
+
+        * bytecode/PredictedType.h:
+        (JSC::isActionableMutableArrayPrediction):
+        (JSC::isActionableArrayPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateInt8Array):
+        (JSC::DFG::Node::shouldSpeculateInt16Array):
+        (JSC::DFG::Node::shouldSpeculateInt32Array):
+        (JSC::DFG::Node::shouldSpeculateUint8Array):
+        (JSC::DFG::Node::shouldSpeculateUint16Array):
+        (JSC::DFG::Node::shouldSpeculateUint32Array):
+        (JSC::DFG::Node::shouldSpeculateFloat32Array):
+        (JSC::DFG::Node::shouldSpeculateFloat64Array):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::byValIsPure):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed - fix stylebot issues from last patch.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+
+2011-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=75151
+        Add attributes field to JSArray's SparseMap
+
+        Reviewed by Sam Weinig.
+
+        This will be necessary to be able to support non- writable/configurable/enumerable
+        properties, and helpful for getters/setters.
+
+        Added a concept of being 'inSparseMode' - this indicates the array has a non-standard
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+            - JSArray::sort methods not allowed on arrays that are 'inSparseMode'.
+              (must fall back to generic sort alogrithm).
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::finishCreation):
+            - moved reportedMapCapacity into the SparseArrayValueMap object.
+        (JSC::SparseArrayValueMap::find):
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::visitChildren):
+            - Added.
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::visitChildren):
+            - Updated for changes in SparseArrayValueMap.
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+            - Disallow on 'SparseMode' arrays.
+        * runtime/JSArray.h:
+        (JSC::SparseArrayEntry::SparseArrayEntry):
+            - An entry in the sparse array - value (WriteBarrier) + attributes.
+        (JSC::SparseArrayValueMap::SparseArrayValueMap):
+        (JSC::SparseArrayValueMap::sparseMode):
+        (JSC::SparseArrayValueMap::setSparseMode):
+            - Flags to track whether an Array is forced into SparseMode.
+        (JSC::SparseArrayValueMap::remove):
+        (JSC::SparseArrayValueMap::notFound):
+        (JSC::SparseArrayValueMap::isEmpty):
+        (JSC::SparseArrayValueMap::contains):
+        (JSC::SparseArrayValueMap::size):
+        (JSC::SparseArrayValueMap::begin):
+        (JSC::SparseArrayValueMap::end):
+            - accessors to the map
+        (JSC::SparseArrayValueMap::take):
+            - only for use on non-SpareMode arrays.
+        (JSC::JSArray::inSparseMode):
+            - Added.
+
+2011-12-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA sometimes generates an incorrect proof that a node is known to be a typed array
+        https://bugs.webkit.org/show_bug.cgi?id=75150
+        <rdar://problem/10621900>
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2011-12-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does exactly the wrong thing when doing strict equality on two known cells
+        https://bugs.webkit.org/show_bug.cgi?id=75138
+        <rdar://problem/10621526>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+
+2011-12-22  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Fix debug build with assertions disabled
+        https://bugs.webkit.org/show_bug.cgi?id=75075
+
+        Reviewed by Darin Adler.
+
+        Check whether assertions are disabled instead of NDEBUG
+        where appropriate to avoid "defined but not used" warnings.
+
+        * wtf/DateMath.cpp:
+        (WTF::initializeDates):
+
+2011-12-22  Mariusz Grzegorczyk  <mariusz.g@samsung.com>
+
+        [EFL] Missing plugins support for efl port
+        https://bugs.webkit.org/show_bug.cgi?id=44505
+
+        Reviewed by Anders Carlsson.
+
+        Add define of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH for efl port.
+
+        * wtf/Platform.h:
+
+2011-12-22  Wei Charles  <charles.wei@torchmobile.com.cn>
+
+        Remove un-used data member of LiteralParser::Lex::m_string
+        https://bugs.webkit.org/show_bug.cgi?id=68216
+
+        Reviewed by George Staikos.
+
+        * runtime/LiteralParser.h:
+
+2011-12-21  Dan Bernstein  <mitz@apple.com>
+
+        OS X build fix after r103488.
+
+        * JavaScriptCore.exp:
+
+2011-12-21  Konrad Piascik  <kpiascik@rim.com>
+
+        Implement the JavaScriptCore bindings for eventListenerHandlerLocation
+        https://bugs.webkit.org/show_bug.cgi?id=74313
+
+        Reviewed by Eric Seidel.
+
+        Updated project files to get Windows and Mac builds working.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-12-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ConvertThis optimizations do not honor the distinction between the global object and the global this object
+        https://bugs.webkit.org/show_bug.cgi?id=75058
+        <rdar://problem/10616612>
+        <rdar://problem/10617500>
+
+        Reviewed by Oliver Hunt.
+        
+        Added a call to toThisObject() in the DFG when planting a direct reference to the global this object.
+        Instead of adding a separate toThisObject() method on JSCell which does not take ExecState*, I reascribed
+        a new contract: if you're calling toThisObject() on JSObject or one of its subtypes, then the ExecState*
+        is optional.
+
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::globalThisObjectFor):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSObject.h:
+
+2011-12-21  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Implement montonicallyIncreasingClock() on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=62159
+
+        Reviewed by Darin Adler.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::monotonicallyIncreasingTime):
+
+2011-12-20  Filip Pizlo  <fpizlo@apple.com>
+
+        32_64 baseline JIT should attempt to convert division results to integers, and record when that fails
+        https://bugs.webkit.org/show_bug.cgi?id=74997
+        <rdar://problem/10612389>
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_div):
+
+2011-12-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JavaScriptCore should be consistent about how it reads and writes ArgumentCount
+        https://bugs.webkit.org/show_bug.cgi?id=74989
+        <rdar://problem/10612006>
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+
+2011-12-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Value Profiles for arguments should be more easily accessible to the interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=74984
+        <rdar://problem/10611364>
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setArgumentValueProfileSize):
+        (JSC::CodeBlock::numberOfArgumentValueProfiles):
+        (JSC::CodeBlock::valueProfileForArgument):
+        (JSC::CodeBlock::addValueProfile):
+        (JSC::CodeBlock::valueProfile):
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        (JSC::CodeBlock::totalNumberOfValueProfiles):
+        (JSC::CodeBlock::getFromAllValueProfiles):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::ValueProfile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+
+2011-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        JSC shell should accept utf8 input.
+
+        Reviewed by Filip Pizlo.
+
+        * jsc.cpp:
+        (jscSource):
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        (runWithScripts):
+        (runInteractive):
+
+2011-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Sam Weinig
+
+        * runtime/JSGlobalData.cpp:
+            - removed some dead code.
+
+2011-12-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Tightened up Vector<T>::append
+        https://bugs.webkit.org/show_bug.cgi?id=74906
+
+        Reviewed by Sam Weinig.
+
+        Not a measurable speedup, but code inspection shows better code generated,
+        and I believe this is a step toward turning off -fomit-frame-pointer.
+
+        * wtf/Vector.h:
+        (WTF::::append):
+        (WTF::::appendSlowCase): Split out the slow case into a separate function
+        to keep unnecessary instructions off the hot path. This means the hot
+        path can now be inlined more often.
+        
+        Removed some old MSVC7 cruft. Hopefully, we don't need to hang on to a
+        compiler work-around from 2007.
+
+2011-12-19  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Temporary GPR should not be lazily allocated in DFG JIT on X86
+        https://bugs.webkit.org/show_bug.cgi?id=74908
+
+        Reviewed by Filip Pizlo.
+
+        On X86, we used to allocate a temporary GPR lazily when it's really
+        used rather than defined. This may cause potential issues of
+        allocating registers inside control flow and result in problems in
+        subsequent code generation, for example the DFG JIT may think an
+        operand already being spilled (to satisfy the allocation request) and
+        generate code to read the data from memory, but the allocation and
+        spilling are in a branch which is not taken at runtime, so the
+        generated code is incorrect.
+
+        Although current DFG JIT code doesn't have this problematic pattern,
+        it's better to cut-off the root to avoid any potential issues in the
+        future.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::GPRTemporary::gpr):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-19  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Remove unused code for non-speculative Arith operations from DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=74905
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+
+2011-12-19  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=74903
+        Exceptions not thrown correctly from DFG JIT on 32bit
+
+        Reviewed by Oliver Hunt.
+
+        Arguments for lookupExceptionHandler are not setup correctly.
+        In the case of ARMv7 we rely on lr being preserved over a call,
+        this in invalid. On x86 we don't should be poking the arguments onto the stack!
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):
+        * dfg/DFGGPRInfo.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addExceptionCheck):
+        (JSC::DFG::JITCompiler::addFastExceptionCheck):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+
+2011-12-19  Filip Pizlo  <fpizlo@apple.com>
+
+        If we detect that we can use the JIT, don't use computed opcode lookups
+        https://bugs.webkit.org/show_bug.cgi?id=74899
+        <rdar://problem/10604551>
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2011-12-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build.
+
+        Unreviewed.
+
+        * wtf/ThreadSpecific.h: #include!
+
+2011-12-18  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to change the value of an Options variable without recompiling the world
+        https://bugs.webkit.org/show_bug.cgi?id=74807
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+
+2011-12-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r103250.
+        http://trac.webkit.org/changeset/103250
+        https://bugs.webkit.org/show_bug.cgi?id=74877
+
+        it still breaks codegen (Requested by olliej on #webkit).
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::byValIsPure):
+        (JSC::DFG::Propagator::clobbersWorld):
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-16  Oliver Hunt  <oliver@apple.com>
+
+        Rolling r103120 back in with merge errors corrected.
+
+        PutByVal[Alias] unnecessarily reloads the storage buffer
+        https://bugs.webkit.org/show_bug.cgi?id=74747
+
+        Reviewed by Gavin Barraclough.
+
+        Make PutByVal use GetIndexedStorage to load the storage buffer.
+        This required switching PutByVal to a vararg node (which is
+        responsible for most of the noise in this patch).  This fixes the
+        remaining portion of the kraken regression caused by the GetByVal
+        storage load elimination, and a 1-5% win on some of the sub tests of
+        the typed array benchmark at:
+        http://stepheneb.github.com/webgl-matrix-benchmarks/matrix_benchmark.html
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::byValIndexIsPure):
+        (JSC::DFG::Propagator::clobbersWorld):
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Placement new does an unnecessary NULL check
+        https://bugs.webkit.org/show_bug.cgi?id=74676
+
+        Reviewed by Sam Weinig.
+
+        We can define our own version, which skips the NULL check.
+        
+        Not a measurable speedup, but code inspection shows better code generated,
+        and I believe this is a step toward turning off -fomit-frame-pointer.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::create):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::create): Use the NotNull version of placement
+        new to skip the NULL check.
+
+        * API/JSCallbackObject.h: Removed a conflicting, unnecessaray placement new.
+
+        (JSC::JSCallbackObject::create):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::create):
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::grow):
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::allocate):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::recycle):
+        * jit/JITCode.h:
+        (JSC::JITCode::clear):
+        * jsc.cpp:
+        (GlobalObject::create):
+        * profiler/CallIdentifier.h:
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::create):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::create):
+        * runtime/BooleanConstructor.h:
+        (JSC::BooleanConstructor::create):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::create):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::create):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::create):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::create):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::create):
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::create):
+        * runtime/ErrorConstructor.h:
+        (JSC::ErrorConstructor::create):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+        * runtime/ExceptionHelpers.h:
+        (JSC::InterruptedExecutionError::create):
+        (JSC::TerminatedExecutionError::create):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::create):
+        (JSC::FunctionExecutable::create):
+        * runtime/FunctionConstructor.h:
+        (JSC::FunctionConstructor::create):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::create):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::create):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::create):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::create): Use the NotNull version of placement
+        new to skip the NULL check.
+
+        * runtime/JSCell.h: Removed a conflicting, unnecessaray placement new.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::create):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        * runtime/JSGlobalThis.h:
+        (JSC::JSGlobalThis::create):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::create):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::create):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::create):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createNull):
+        (JSC::RopeBuilder::create):
+        (JSC::RopeBuilder::createHasOtherOwner):
+        * runtime/MathObject.h:
+        (JSC::MathObject::create):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::create):
+        * runtime/NativeErrorPrototype.h:
+        (JSC::NativeErrorPrototype::create):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::create):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::create):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::create):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::create):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::create):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::createWithoutCaching):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::create):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::create):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::create):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::create):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::create):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::create):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::create):
+        * runtime/StringObject.h:
+        (JSC::StringObject::create):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::create):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::createStructure):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        * testRegExp.cpp:
+        (GlobalObject::create):
+        * wtf/BitVector.cpp:
+        (WTF::BitVector::OutOfLineBits::create): Use the NotNull version of placement
+        new to skip the NULL check.
+
+        * wtf/BumpPointerAllocator.h:
+        (WTF::BumpPointerPool::create): Standardized spacing to make grep easier.
+
+        * wtf/ByteArray.cpp:
+        (WTF::ByteArray::create):
+        * wtf/Deque.h:
+        (WTF::::append):
+        (WTF::::prepend): Use NotNull, as above.
+
+        * wtf/FastAllocBase.h: Added a placement new, since this class would otherwise
+        hide the name of the global placement new.
+
+        (WTF::fastNew): Standardized spacing. Most of these functions don't need
+        NotNull, since they check for NULL, and the optimizer can see that.
+
+        * wtf/HashTable.h:
+        * wtf/HashTraits.h:
+        (WTF::SimpleClassHashTraits::constructDeletedValue):
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocator::allocFreeSpaceNode): NotNull, as above.
+
+        * wtf/StdLibExtras.h:
+        (throw): This is our NotNull placement new. Declaring that we throw is
+        the C++ way to say that operator new will not return NULL.
+
+        * wtf/ThreadSpecific.h:
+        (WTF::T):
+        * wtf/Vector.h:
+        (WTF::::append):
+        (WTF::::tryAppend):
+        (WTF::::uncheckedAppend):
+        (WTF::::insert):
+        * wtf/text/AtomicStringHash.h:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::createUninitialized):
+        (WTF::StringImpl::reallocate):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::tryCreateUninitialized):
+        * wtf/text/StringStatics.cpp:
+        (WTF::AtomicString::init): Use NotNull, as above.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext): Standardized
+        spacing for easy grep.
+
+2011-12-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Enable <track> for Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=74838
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h:
+
+2011-12-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG is too sloppy with register allocation
+        https://bugs.webkit.org/show_bug.cgi?id=74835
+
+        Reviewed by Gavin Barraclough.
+        
+        Added assertions that at the end of a successfully generated basic block,
+        all use counts should be zero. This revealed a number of bugs:
+        
+        - Array length optimizations were turning a must-generate node into one
+          that is not must-generate, but failing to change the ref count
+          accordingly.
+          
+        - Indexed property storage optimizations were failing to deref their
+          children, or to deref the indexed property storage node itself. Also,
+          they used the Phantom node as a replacement. But the Phantom node is
+          must-generate, which was causing bizarre issues. So this introduces a
+          Nop node, which should be used in cases where you want a node that is
+          skipped and has no children.
+          
+        This does not have any significant performance effect, but it should
+        relieve some register pressure. The main thing this patch adds, though,
+        are the assertions, which should make it easier to do register allocation
+        related changes in the future.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::initConstant):
+        (JSC::DFG::GenerationInfo::initInteger):
+        (JSC::DFG::GenerationInfo::initJSValue):
+        (JSC::DFG::GenerationInfo::initCell):
+        (JSC::DFG::GenerationInfo::initBoolean):
+        (JSC::DFG::GenerationInfo::initDouble):
+        (JSC::DFG::GenerationInfo::initStorage):
+        (JSC::DFG::GenerationInfo::use):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::clearAndDerefChild1):
+        (JSC::DFG::Graph::clearAndDerefChild2):
+        (JSC::DFG::Graph::clearAndDerefChild3):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::deref):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove the duplicated code from ASCIICType.h
+        https://bugs.webkit.org/show_bug.cgi?id=74771
+
+        Reviewed by Andreas Kling.
+
+        Use isASCIIDigit() and isASCIIAlpha() instead of copying the code.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIDigit):
+        (WTF::isASCIIAlphanumeric):
+        (WTF::isASCIIHexDigit):
+
+2011-12-18  Anders Carlsson  <andersca@apple.com>
+
+        Set the main frame view scroll position asynchronously
+        https://bugs.webkit.org/show_bug.cgi?id=74823
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.exp:
+
+2011-12-10  Andreas Kling  <kling@webkit.org>
+
+        OpaqueJSClass: Remove RVCT2 workarounds.
+        <http://webkit.org/b/74250>
+
+        Reviewed by Benjamin Poulain.
+
+        We no longer need workarounds for the RVCT2 compiler since it was
+        only used for the Symbian port of WebKit which is now defunct.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+
+2011-12-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove the duplicated code from ASCIICType.h
+        https://bugs.webkit.org/show_bug.cgi?id=74771
+
+        Reviewed by Andreas Kling.
+
+        The functions were sharing similar code and were defined for the various input types.
+        Use templates instead to avoid code duplication.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCII):
+        (WTF::isASCIIAlpha):
+        (WTF::isASCIIAlphanumeric):
+        (WTF::isASCIIDigit):
+        (WTF::isASCIIHexDigit):
+        (WTF::isASCIILower):
+        (WTF::isASCIIOctalDigit):
+        (WTF::isASCIIPrintable):
+        (WTF::isASCIISpace):
+        (WTF::isASCIIUpper):
+        (WTF::toASCIILower):
+        (WTF::toASCIIUpper):
+        (WTF::toASCIIHexValue):
+        (WTF::lowerNibbleToASCIIHexDigit):
+        (WTF::upperNibbleToASCIIHexDigit):
+
+2011-12-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit may get confused about where in the scratch buffer it stored a value
+        https://bugs.webkit.org/show_bug.cgi?id=74695
+
+        Reviewed by Oliver Hunt.
+        
+        The code that reads from the scratch buffer now explicitly knows which locations to
+        read from. No new tests, since this patch covers a case so uncommon that I don't know
+        how to make a test for it.
+
+        * dfg/DFGOSRExitCompiler.h:
+        (JSC::DFG::OSRExitCompiler::badIndex):
+        (JSC::DFG::OSRExitCompiler::initializePoisoned):
+        (JSC::DFG::OSRExitCompiler::poisonIndex):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2011-12-16  Oliver Hunt  <oliver@apple.com>
+
+        PutByVal[Alias] unnecessarily reloads the storage buffer
+        https://bugs.webkit.org/show_bug.cgi?id=74747
+
+        Reviewed by Gavin Barraclough.
+
+        Make PutByVal use GetIndexedStorage to load the storage buffer.
+        This required switching PutByVal to a vararg node (which is
+        responsible for most of the noise in this patch).  This fixes the
+        remaining portion of the kraken regression caused by the GetByVal
+        storage load elimination, and a 1-5% win on some of the sub tests of
+        the typed array benchmark at:
+        http://stepheneb.github.com/webgl-matrix-benchmarks/matrix_benchmark.html
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::byValIndexIsPure):
+        (JSC::DFG::Propagator::clobbersWorld):
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-16  Daniel Bates  <dbates@rim.com>
+
+        Include BlackBerryPlatformLog.h instead of BlackBerryPlatformMisc.h
+
+        Rubber-stamped by Antonio Gomes.
+
+        BlackBerry::Platform::logV() is declared in BlackBerryPlatformLog.h. That is, it isn't
+        declared in BlackBerryPlatformMisc.h. Hence, we should include BlackBerryPlatformLog.h
+        instead of BlackBerryPlatformMisc.h.
+
+        * wtf/Assertions.cpp:
+
+2011-12-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize destructors
+        https://bugs.webkit.org/show_bug.cgi?id=74331
+
+        Reviewed by Geoffrey Garen.
+
+        This is a megapatch which frees us from the chains of virtual destructors.
+
+        In order to remove the virtual destructors, which are the last of the virtual 
+        functions, from the JSCell hierarchy, we need to add the ClassInfo pointer to 
+        the cell rather than to the structure because in order to be able to lazily call 
+        the static destroy() functions that will replace the virtual destructors, we 
+        need to be able to access the ClassInfo without the danger of the object's 
+        Structure being collected before the object itself.
+
+        After adding the ClassInfo to the cell, we can then begin to remove our use 
+        of vptrs for optimizations within the JIT and the GC.  When we have removed 
+        all of the stored vptrs from JSGlobalData, we can then also remove all of 
+        the related VPtrStealingHack code.
+
+        The replacement for virtual destructors will be to add a static destroy function 
+        pointer to the MethodTable stored in ClassInfo.  Any subclass of JSCell that has 
+        a non-trivial destructor will require its own static destroy function to static 
+        call its corresponding destructor, which will now be non-virtual.  In future 
+        patches we will slowly move away from destructors altogether as we make more and 
+        more objects backed by GC memory rather than malloc-ed memory.  The GC will now 
+        call the static destroy method rather than the virtual destructor.
+
+        As we go through the hierarchy and add static destroy functions to classes, 
+        we will also add a new assert, ASSERT_HAS_TRIVIAL_DESTRUCTOR, to those classes 
+        to which it applies.  The future goal is to eventually have every class have that assert.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::destroy): Add a destroy function to statically call 
+        ~JSCallbackConstructor because it has some extra destruction logic.
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp: Add trivial destructor assert for JSCallbackFunction.
+        * API/JSCallbackObject.cpp: Add a destroy function to statically call ~JSCallbackObject 
+        because it has a member OwnPtr that needs destruction.
+        (JSC::::destroy):
+        * API/JSCallbackObject.h:
+        * JavaScriptCore.exp: Add/remove necessary symbols for JSC.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Same for Windows symbols.
+        * debugger/DebuggerActivation.cpp: DebuggerActivation, for some strange reason, didn't 
+        have its own ClassInfo despite the fact that it overrides a number of MethodTable 
+        methods.  Added the ClassInfo, along with an assertion that its destructor is trivial.
+        * debugger/DebuggerActivation.h:
+        * dfg/DFGOperations.cpp: Remove global data first argument to isJSArray, isJSByteArray, 
+        isJSString, as it is no longer necessary.
+        (JSC::DFG::putByVal):
+        * dfg/DFGRepatch.cpp:  Ditto.  Also remove uses of jsArrayVPtr in favor of using the 
+        JSArray ClassInfo pointer.
+        (JSC::DFG::tryCacheGetByID):
+        * dfg/DFGSpeculativeJIT.cpp:  Replace uses of the old vptrs with new ClassInfo 
+        comparisons since we don't have vptrs anymore.
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h: Ditto.
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp: Ditto.
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp: Ditto.
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/Heap.cpp: Remove all uses of vptrs in GC optimizations and replace them with 
+        ClassInfo comparisons.
+        (JSC::Heap::Heap):
+        * heap/MarkStack.cpp: Ditto.
+        (JSC::MarkStackThreadSharedData::markingThreadMain):
+        (JSC::visitChildren):
+        (JSC::SlotVisitor::drain):
+        * heap/MarkStack.h: Ditto.
+        (JSC::MarkStack::MarkStack):
+        * heap/MarkedBlock.cpp: Ditto.
+        (JSC::MarkedBlock::callDestructor):
+        (JSC::MarkedBlock::specializedSweep):
+        * heap/MarkedBlock.h: Ditto.
+        * heap/SlotVisitor.h: Ditto.
+        (JSC::SlotVisitor::SlotVisitor):
+        * heap/VTableSpectrum.cpp: Now that we don't have vptrs, we can't count them.  
+        We'll have to rename this class and make it use ClassInfo ptrs in a future patch.
+        (JSC::VTableSpectrum::count):
+        * interpreter/Interpreter.cpp: Remove all global data arguments from isJSArray, 
+        etc. functions.
+        (JSC::loadVarargs):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.h: Remove vptr argument from emitAllocateBasicJSObject 
+        * jit/JITInlineMethods.h: Remove vptr planting, and add ClassInfo planting, 
+        remove all vtable related code.
+        (JSC::JIT::emitLoadCharacterString):
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC::JIT::emitAllocateJSFunction):
+        * jit/JITOpcodes.cpp: Replace vptr related branch code with corresponding ClassInfo.
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_convert_this):
+        * jit/JITOpcodes32_64.cpp: Ditto.
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_convert_this):
+        * jit/JITPropertyAccess.cpp: Ditto.
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp: Ditto.
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITStubs.cpp: Remove global data argument from isJSString, etc.
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/SpecializedThunkJIT.h: Replace vptr related stuff with ClassInfo stuff.
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        * runtime/ArrayConstructor.cpp: Add trivial destructor assert.
+        * runtime/ArrayPrototype.cpp: Remove global data argument from isJSArray.
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/BooleanConstructor.cpp: Add trivial destructor assert.
+        * runtime/BooleanObject.cpp: Ditto.
+        * runtime/BooleanPrototype.cpp: Ditto.
+        * runtime/ClassInfo.h: Add destroy function pointer to MethodTable.
+        * runtime/DateConstructor.cpp: Add trivial destructor assert.
+        * runtime/DateInstance.cpp: Add destroy function for DateInstance because it has a RefPtr 
+        that needs destruction.
+        (JSC::DateInstance::destroy):
+        * runtime/DateInstance.h:
+        * runtime/Error.cpp: Ditto (because of UString member).
+        (JSC::StrictModeTypeErrorFunction::destroy):
+        * runtime/Error.h:
+        * runtime/ErrorConstructor.cpp: Add trivial destructor assert.
+        * runtime/ErrorInstance.cpp: Ditto.
+        * runtime/ExceptionHelpers.cpp: Ditto.
+        * runtime/Executable.cpp: Add destroy functions for ExecutableBase and subclasses.
+        (JSC::ExecutableBase::destroy):
+        (JSC::NativeExecutable::destroy):
+        (JSC::ScriptExecutable::destroy):
+        (JSC::EvalExecutable::destroy):
+        (JSC::ProgramExecutable::destroy):
+        (JSC::FunctionExecutable::destroy):
+        * runtime/Executable.h:
+        * runtime/FunctionConstructor.cpp: Add trivial destructor assert.
+        * runtime/FunctionPrototype.cpp: Ditto. Also remove global data first arg from isJSArray.
+        (JSC::functionProtoFuncApply):
+        * runtime/GetterSetter.cpp: Ditto.
+        * runtime/InitializeThreading.cpp: Remove call to JSGlobalData::storeVPtrs since it no 
+        longer exists.
+        (JSC::initializeThreadingOnce):
+        * runtime/InternalFunction.cpp: Remove vtableAnchor function, add trivial destructor assert, 
+        remove first arg from isJSString.
+        (JSC::InternalFunction::displayName):
+        * runtime/InternalFunction.h: Remove VPtrStealingHack.
+        * runtime/JSAPIValueWrapper.cpp: Add trivial destructor assert.
+        * runtime/JSArray.cpp: Add static destroy to call ~JSArray.  Replace vptr checks in 
+        destructor with ClassInfo checks.
+        (JSC::JSArray::~JSArray):
+        (JSC::JSArray::destroy):
+        * runtime/JSArray.h: Remove VPtrStealingHack.  Remove globalData argument from isJSArray 
+        and change them to check the ClassInfo rather than the vptrs.
+        (JSC::isJSArray):
+        * runtime/JSBoundFunction.cpp: Add trival destructor assert. Remove first arg from isJSArray.
+        (JSC::boundFunctionCall):
+        (JSC::boundFunctionConstruct):
+        * runtime/JSByteArray.cpp: Add static destroy function, replace vptr checks with ClassInfo checks.
+        (JSC::JSByteArray::~JSByteArray):
+        (JSC::JSByteArray::destroy):
+        * runtime/JSByteArray.h: Remove VPtrStealingHack code.
+        (JSC::isJSByteArray):
+        * runtime/JSCell.cpp: Add trivial destructor assert.  Add static destroy function.
+        (JSC::JSCell::destroy):
+        * runtime/JSCell.h: Remove VPtrStealingHack code.  Add function for returning the offset 
+        of the ClassInfo pointer in the object for use by the JIT.  Add the ClassInfo pointer to 
+        the JSCell itself, and grab it from the Structure.  Remove the vptr and setVPtr functions, 
+        as they are no longer used.  Add a validatedClassInfo function to JSCell for any clients 
+        that want to verify, while in Debug mode, that the ClassInfo contained in the cell is the 
+        same one as that contained in the Structure.  This isn't used too often, because most of 
+        the places where we compare the ClassInfo to things can be called during destruction.  
+        Since the Structure is unreliable during the phase when destructors are being called, 
+        we can't call validatedClassInfo.
+        (JSC::JSCell::classInfoOffset):
+        (JSC::JSCell::structure):
+        (JSC::JSCell::classInfo):
+        * runtime/JSFunction.cpp: Remove VPtrStealingHack code.  Add static destroy, remove vtableAnchor, 
+        remove first arg from call to isJSString.
+        (JSC::JSFunction::destroy):
+        (JSC::JSFunction::displayName):
+        * runtime/JSFunction.h: 
+        * runtime/JSGlobalData.cpp: Remove all VPtr stealing code and storage, including storeVPtrs, 
+        as these vptrs are no longer needed in the codebase.
+        * runtime/JSGlobalData.h:
+        (JSC::TypedArrayDescriptor::TypedArrayDescriptor): Changed the TypedArrayDescriptor to use 
+        ClassInfo rather than the vptr.
+        * runtime/JSGlobalObject.cpp: Add static destroy function.
+        (JSC::JSGlobalObject::destroy):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalThis.cpp: Add trivial destructor assert.
+        * runtime/JSNotAnObject.cpp: Ditto.
+        * runtime/JSONObject.cpp: Ditto. Remove first arg from isJSArray calls.
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp: 
+        (JSC::JSFinalObject::destroy):
+        (JSC::JSNonFinalObject::destroy):
+        (JSC::JSObject::destroy):
+        * runtime/JSObject.h: Add trivial destructor assert for JSObject, remove vtableAnchor 
+        from JSNonFinalObject and JSFinalObject, add static destroy for JSFinalObject and 
+        JSNonFinalObject, add isJSFinalObject utility function similar to isJSArray, remove all VPtrStealingHack code.
+        (JSC::JSObject::finishCreation):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::isJSFinalObject):
+        * runtime/JSPropertyNameIterator.cpp: Add static destroy.
+        (JSC::JSPropertyNameIterator::destroy):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp: Ditto.
+        (JSC::JSStaticScopeObject::destroy):
+        * runtime/JSStaticScopeObject.h: Ditto. 
+        * runtime/JSString.cpp:
+        (JSC::JSString::destroy):
+        * runtime/JSString.h: Ditto. Remove VPtrStealingHack code. Also remove fixupVPtr code, 
+        since we no longer need to fixup vptrs.
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsNontrivialString):
+        (JSC::jsString):
+        (JSC::jsSubstring8):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        (JSC::jsStringBuilder):
+        (JSC::isJSString):
+        * runtime/JSVariableObject.cpp: 
+        (JSC::JSVariableObject::destroy):
+        * runtime/JSVariableObject.h: Ditto.
+        * runtime/JSWrapperObject.cpp:
+        * runtime/JSWrapperObject.h: Add trivial destructor assert.
+        * runtime/MathObject.cpp: Ditto.
+        * runtime/NativeErrorConstructor.cpp: Ditto.
+        * runtime/NumberConstructor.cpp: Ditto.
+        * runtime/NumberObject.cpp: Ditto.
+        * runtime/NumberPrototype.cpp: Ditto.
+        * runtime/ObjectConstructor.cpp: Ditto.
+        * runtime/ObjectPrototype.cpp: Ditto.
+        * runtime/Operations.h: Remove calls to fixupVPtr, remove first arg to isJSString.
+        (JSC::jsString):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        * runtime/RegExp.cpp: Add static destroy.
+        (JSC::RegExp::destroy):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.cpp: Add static destroy for RegExpConstructor and RegExpMatchesArray.
+        (JSC::RegExpConstructor::destroy):
+        (JSC::RegExpMatchesArray::destroy):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.cpp: Add static destroy.
+        (JSC::RegExpObject::destroy):
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.cpp: Add trivial destructor assert.
+        * runtime/ScopeChain.h:
+        * runtime/StrictEvalActivation.cpp: Ditto.
+        * runtime/StringConstructor.cpp:
+        * runtime/StringObject.cpp: Ditto. Remove vtableAnchor.
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp: Ditto.
+        * runtime/Structure.cpp: Add static destroy.
+        (JSC::Structure::destroy):
+        * runtime/Structure.h: Move JSCell::finishCreation and JSCell constructor into Structure.h 
+        because they need to have the full Structure type to access the ClassInfo to store in the JSCell.
+        (JSC::JSCell::setStructure):
+        (JSC::JSCell::validatedClassInfo):
+        (JSC::JSCell::JSCell):
+        (JSC::JSCell::finishCreation):
+        * runtime/StructureChain.cpp: Add static destroy.
+        (JSC::StructureChain::destroy):
+        * runtime/StructureChain.h:
+        * wtf/Assertions.h: Add new assertion ASSERT_HAS_TRIVIAL_DESTRUCTOR, which uses clangs 
+        ability to tell us when a class has a trivial destructor. We will use this assert 
+        more in future patches as we move toward having all JSC objects backed by GC memory, 
+        which means moving away from using destructors/finalizers.
+
+2011-12-15  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix 'make dist' in preparation for the GTK+ release.
+
+        * GNUmakefile.list.am: Add missing header.
+
+2011-12-15  Sam Weinig  <sam@webkit.org>
+
+        <rdar://problem/10552550> JavaScriptCore uses obsolete 'cpy' mnemonic in ARM assembly
+
+        Reviewed by Gavin Barraclough.
+
+        Original patch by Jim Grosbach.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        Replace uses of the 'cpy' mnemonic with 'mov'.
+
+2011-12-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Value profiling should distinguished between NaN and non-NaN doubles
+        https://bugs.webkit.org/show_bug.cgi?id=74682
+
+        Reviewed by Gavin Barraclough.
+        
+        Added PredictDoubleReal and PredictDoubleNaN. PredictDouble is now the union
+        of the two.
+
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionFromValue):
+        * bytecode/PredictedType.h:
+        (JSC::isDoubleRealPrediction):
+        (JSC::isDoublePrediction):
+
+2011-12-15  Anders Carlsson  <andersca@apple.com>
+
+        Regression (r102866): Navigating away from or closing a page with a plugin crashes
+        https://bugs.webkit.org/show_bug.cgi?id=74655
+        <rdar://problem/10590024>
+
+        Reviewed by Sam Weinig.
+
+        Rewrite HasRefAndDeref to work if ref and deref are implemented in base classes,
+        using a modified version of the technique described here:
+        http://groups.google.com/group/comp.lang.c++.moderated/msg/e5fbc9305539f699
+        
+        * wtf/Functional.h:
+
+2011-12-15  Andy Wingo  <wingo@igalia.com>
+
+        Warnings fixes in Interpreter.cpp and PrivateExecute.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=74624
+
+        Reviewed by Darin Adler.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Fix variables unused in
+        release mode.
+        * wtf/ParallelJobsGeneric.cpp:
+        (WTF::ParallelEnvironment::ParallelEnvironment): Fix
+        signed/unsigned comparison warning, with a cast.
+
+2011-12-15  Andy Wingo  <wingo@igalia.com>
+
+        Use more macrology in JSC::Options
+        https://bugs.webkit.org/show_bug.cgi?id=72938
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h: Use macros to ensure that all heuristics are
+        declared and have initializers.
+
+2011-12-15  Anders Carlsson  <andersca@apple.com>
+
+        Add ScrollingCoordinator class and ENABLE_THREADED_SCROLLING define
+        https://bugs.webkit.org/show_bug.cgi?id=74639
+
+        Reviewed by Andreas Kling.
+
+        Add ENABLE_THREADED_SCROLLING #define.
+
+        * wtf/Platform.h:
+
+2011-12-15  Anders Carlsson  <andersca@apple.com>
+
+        EventDispatcher should handle wheel events on the connection queue
+        https://bugs.webkit.org/show_bug.cgi?id=74627
+
+        Reviewed by Andreas Kling.
+
+        Add a BoundFunctionImpl specialization that takes three parameters.
+
+        * wtf/Functional.h:
+        (WTF::C::):
+        (WTF::R):
+        (WTF::bind):
+
+2011-12-14  Anders Carlsson  <andersca@apple.com>
+
+        Add WTF::Function to wtf/Forward.h
+        https://bugs.webkit.org/show_bug.cgi?id=74576
+
+        Reviewed by Adam Roben.
+
+        * jsc.cpp:
+        Work around a name conflict in the readline library.
+
+        * wtf/Forward.h:
+        Add Function.
+
+2011-12-15  Igor Oliveira  <igor.oliveira@openbossa.org>
+
+        [Qt] Support requestAnimationFrame API
+        https://bugs.webkit.org/show_bug.cgi?id=74528
+
+        Let Qt port use REQUEST_ANIMATION_FRAME_TIMER.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * wtf/Platform.h:
+
+2011-12-15  Andy Wingo  <wingo@igalia.com>
+
+        Minor refactor to Parser::parseTryStatement
+        https://bugs.webkit.org/show_bug.cgi?id=74507
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Parser.cpp (JSC::Parser::parseTryStatement): Use the
+        Parser's declareVariable instead of going directly to the scope.
+        This will facilitate future checks related to harmony block
+        scoping.
+
+2011-12-15  Andy Wingo  <wingo@igalia.com>
+
+        Rename JSC::Heuristics to JSC::Options
+        https://bugs.webkit.org/show_bug.cgi?id=72889
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/Options.cpp: Renamed from Source/JavaScriptCore/runtime/Heuristics.cpp.
+        * runtime/Options.h: Renamed from Source/JavaScriptCore/runtime/Heuristics.h.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::reoptimizationRetryCounter):
+        (JSC::CodeBlock::countReoptimization):
+        (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
+        (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeNextInvocation):
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon):
+        (JSC::CodeBlock::optimizeSoon):
+        (JSC::CodeBlock::largeFailCountThreshold):
+        (JSC::CodeBlock::largeFailCountThresholdForLoop):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackSegmentAllocator::allocate):
+        (JSC::MarkStackSegmentAllocator::shrinkReserve):
+        (JSC::MarkStackArray::MarkStackArray):
+        (JSC::MarkStackArray::donateSomeCellsTo):
+        (JSC::MarkStackArray::stealSomeCellsFrom):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::SlotVisitor::donateSlow):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
+        (JSC::MarkStack::addOpaqueRoot):
+        (JSC::MarkStackArray::canDonateSomeCells):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::donate):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce): Adapt callers and build systems.
+
+        * testRegExp.cpp:
+        (CommandLine::CommandLine):
+        * jsc.cpp:
+        (CommandLine::CommandLine):
+        Rename from Options, to avoid name conflict.
+
+2011-12-14  Sam Weinig  <sam@webkit.org>
+
+        Revert unintentional change to JavaScriptCore.def
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-12-14  Sam Weinig  <weinig@apple.com>
+
+        Remove whitespace from InheritedPropertySheets attributes in
+        vsprops files to appease the Visual Studio project migrator.
+
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFDebug.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscDebug.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscRelease.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops:
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops:
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops:
+        * JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops:
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiDebug.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiRelease.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops:
+
+2011-12-14  Anders Carlsson  <andersca@apple.com>
+
+        binding a member function should ref/deref the object pointer if needed
+        https://bugs.webkit.org/show_bug.cgi?id=74552
+
+        Reviewed by Sam Weinig.
+
+        Add a HasRefAndDeref helper class template which checks if a given class type has ref and deref
+        member functions which the right type. Use this to determine if we should ref/deref the first parameter.
+
+        * wtf/Functional.h:
+        (WTF::R):
+        (WTF::C::):
+        (WTF::RefAndDeref::ref):
+        (WTF::RefAndDeref::deref):
+
+2011-12-14  Hajime Morrita  <morrita@chromium.org>
+
+        JS_INLINE and WTF_INLINE should be visible from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=73191
+
+        - Moved Export related macro definitions from config.h to ExportMacros.h and JSExportMacros.h.
+        - Moved WTF_USE_JSC and WTF_USE_V8 from various config.h family to Platform.h.
+        - Replaced JS_EXPORTDATA in wtf moudule with newly introduced WTF_EXPORTDATA.
+
+        Reviewed by Kevin Ollivier.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h:
+        * runtime/JSExportMacros.h: Added.
+        * wtf/ExportMacros.h:
+        * wtf/Platform.h:
+        * wtf/WTFThreadData.h:
+        * wtf/text/AtomicString.h:
+        * wtf/text/StringStatics.cpp:
+
+2011-12-14  Anders Carlsson  <andersca@apple.com>
+
+        Work around a bug in the MSVC2005 compiler
+        https://bugs.webkit.org/show_bug.cgi?id=74550
+
+        Reviewed by Sam Weinig.
+
+        Add template parameters for the return types of the partial specializations of BoundFunctionImpl.
+
+        * wtf/Functional.h:
+        (WTF::R):
+
+2011-12-13  Jon Lee  <jonlee@apple.com>
+
+        Enable notifications on Mac.
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-12-14  David Kilzer  <ddkilzer@apple.com>
+
+        Remove definition of old ENABLE(YARR) macro
+        <http://webkit.org/b/74532>
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Removed ENABLE_YARR macros.
+
+2011-12-14  Anders Carlsson  <andersca@apple.com>
+
+        bind should handle member functions
+        https://bugs.webkit.org/show_bug.cgi?id=74529
+
+        Reviewed by Sam Weinig.
+
+        Add FunctionWrapper partial specializations for member function pointers.
+
+        * wtf/Functional.h:
+        (WTF::C::):
+
+2011-12-14  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG relies on returning a struct in registers
+        https://bugs.webkit.org/show_bug.cgi?id=74527
+
+        Reviewed by Geoff Garen.
+
+        This will not work on all platforms. Returning a uint64_t will more reliably achieve
+        what we want, on 32-bit platforms (on 64-bit, stick with the struct return).
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        (JSC::DFG::DFGHandler::dfgHandlerEncoded):
+
+2011-12-14  Anders Carlsson  <andersca@apple.com>
+
+        Add unary and binary bind overloads
+        https://bugs.webkit.org/show_bug.cgi?id=74524
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Functional.h:
+        (WTF::R):
+        (WTF::FunctionWrapper::ResultType):
+        (WTF::bind):
+
+2011-12-14  Anders Carlsson  <andersca@apple.com>
+
+        Add back the callOnMainThread overload that takes a WTF::Function
+        https://bugs.webkit.org/show_bug.cgi?id=74512
+
+        Reviewed by Darin Adler.
+
+        Add back the overload; the changes to WebCore should hopefully keep Windows building.
+
+        * wtf/MainThread.cpp:
+        (WTF::callFunctionObject):
+        (WTF::callOnMainThread):
+        * wtf/MainThread.h:
+
+2011-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should infer when local variables are doubles
+        https://bugs.webkit.org/show_bug.cgi?id=74480
+
+        Reviewed by Oliver Hunt.
+        
+        Introduced the notion that a local variable (though not an argument, yet!) can
+        be stored as a double, and will be guaranteed to always contain a double. This
+        requires more magic in the OSR (conversion in both entry and exit). The inference
+        is quite unorthodox: all uses of a variable vote on whether they think it should
+        be a double or a JSValue, based on how they use it. If they use it in an integer
+        or boxed value context, they vote JSValue. If they use it in a double context,
+        they vote double. This voting is interleaved in the propagator's fixpoint, so
+        that variables voted double then have a double prediction propagated from them.
+        This interleaving is needed because a variable that actually always contains an
+        integer that always gets used in arithmetic that involves doubles may end up
+        being voted double, which then means that all uses of the variable will see a
+        double rather than an integer.
+        
+        This is worth 18% to SunSpider/3d-cube, 7% to Kraken/audio-beat-detection, 7%
+        to Kraken/audio-fft, 6% to Kraken/imaging-darkroom, 20% to
+        Kraken/imaging-gaussian-blur, and just over 1% to Kraken/json-parse-financial.
+        It results in a 1% speed-up on SunSpider and a 4% speed-up in Kraken.  Similar
+        results on JSVALUE32_64, though with a bigger win on Kraken (5%) and no overall
+        win on SunSpider.
+
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::alreadyInRegisterFileAsUnboxedDouble):
+        (JSC::ValueRecovery::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::boxDouble):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::vote):
+        (JSC::DFG::Propagator::doRoundOfDoubleVoting):
+        (JSC::DFG::Propagator::propagatePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::clearVotes):
+        (JSC::DFG::VariableAccessData::vote):
+        (JSC::DFG::VariableAccessData::doubleVoteRatio):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
+        (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h:
+
+2011-12-13  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        Remove the callOnMainThread overload that takes a WTF::Function since it's not being used.
+
+        * wtf/MainThread.cpp:
+        * wtf/MainThread.h:
+
+2011-12-13  Anders Carlsson  <andersca@apple.com>
+
+        Add a very bare-bones implementation of bind and Function to WTF
+        https://bugs.webkit.org/show_bug.cgi?id=74462
+
+        Reviewed by Sam Weinig.
+
+        In order to make it easier to package up function calls and send them across
+        threads, add a (currently very simple) implementation of WTF::bind and WTF::Function to a new
+        wtf/Functional.h header.
+
+        Currently, all bind can do is bind a nullary function and return a Function object that can be called and copied,
+        but I'll add more as the need arises.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Functional.h: Added.
+        (WTF::R):
+        (WTF::FunctionImplBase::~FunctionImplBase):
+        (WTF::FunctionWrapper::ResultType):
+        (WTF::FunctionBase::isNull):
+        (WTF::FunctionBase::FunctionBase):
+        (WTF::FunctionBase::impl):
+        (WTF::bind):
+        * wtf/MainThread.cpp:
+        (WTF::callFunctionObject):
+        (WTF::callOnMainThread):
+        * wtf/MainThread.h:
+        * wtf/wtf.pro:
+
+2011-12-13  Geoffrey Garen  <ggaren@apple.com>
+
+        <rdar://problem/10577239> GC Crash introduced in r102545
+
+        Reviewed by Gavin Barraclough.
+        
+        MarkedArgumentBuffer was still marking items in forwards order, even though
+        the argument order has been reversed.
+        
+        I fixed this bug, and replaced address calculation code with some helper
+        functions -- mallocBase() and slotFor() -- so it stays fixed everywhere.
+
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::at):
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::MarkedArgumentBuffer::last):
+        (JSC::MarkedArgumentBuffer::slotFor):
+        (JSC::MarkedArgumentBuffer::mallocBase):
+
+2011-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit for UInt32ToNumber should roll forward, not roll backward
+        https://bugs.webkit.org/show_bug.cgi?id=74463
+
+        Reviewed by Gavin Barraclough.
+        
+        Implements roll-forward OSR exit for UInt32ToNumber, which requires ValueRecoveries knowing
+        how to execute the slow path of UInt32ToNumber.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::lastOSRExit):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::operator!=):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::uint32InGPR):
+        (JSC::ValueRecovery::gpr):
+        (JSC::ValueRecovery::dump):
+        * dfg/DFGAssemblyHelpers.cpp:
+        * dfg/DFGAssemblyHelpers.h:
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::valueRecoveryForOperand):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-13  Oliver Hunt  <oliver@apple.com>
+
+        Arguments object doesn't handle mutation of length property correctly
+        https://bugs.webkit.org/show_bug.cgi?id=74454
+
+        Reviewed by Gavin Barraclough.
+
+        Correct handling of arguments objects with overridden length property
+
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToArguments):
+        (JSC::Arguments::fillArgList):
+
+2011-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG GetByVal CSE rule should match PutByValAlias
+        https://bugs.webkit.org/show_bug.cgi?id=74390
+
+        Reviewed by Geoff Garen.
+        
+        Tiny win on some benchmarks. Maybe a 0.2% win on SunSpider.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::getByValLoadElimination):
+
+2011-12-13  Andy Wingo  <wingo@igalia.com>
+
+        Fix interpreter debug build.
+        https://bugs.webkit.org/show_bug.cgi?id=74439
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/ValueRecovery.h: Include stdio.h on debug builds.
+
+2011-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should know exactly why recompilation was triggered
+        https://bugs.webkit.org/show_bug.cgi?id=74362
+
+        Reviewed by Oliver Hunt.
+        
+        Each OSR exit is now individually counted, as well as counting the total number 
+        of OSR exits that occurred in a code block. If recompilation is triggered, we
+        check to see if there are OSR exit sites that make up a sufficiently large
+        portion of the total OSR exits that occurred. For any such OSR exit sites, we
+        add a description of the site (bytecode index, kind) to a data structure in the
+        corresponding baseline CodeBlock. Then, when we recompile the code, we immediately
+        know which speculations would be unwise based on the fact that previous such
+        speculations proved to be fruitless.
+        
+        This means 2% win on two of the SunSpider string tests, a 4% win on V8's deltablue,
+        and 5% on Kraken's imaging-darkroom. It is only a minor win in the averages, less
+        than 0.5%.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::exitProfile):
+        (JSC::CodeBlock::reoptimize):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/DFGExitProfile.cpp: Added.
+        (JSC::DFG::ExitProfile::ExitProfile):
+        (JSC::DFG::ExitProfile::~ExitProfile):
+        (JSC::DFG::ExitProfile::add):
+        (JSC::DFG::QueryableExitProfile::QueryableExitProfile):
+        (JSC::DFG::QueryableExitProfile::~QueryableExitProfile):
+        * bytecode/DFGExitProfile.h: Added.
+        (JSC::DFG::exitKindToString):
+        (JSC::DFG::exitKindIsCountable):
+        (JSC::DFG::FrequentExitSite::FrequentExitSite):
+        (JSC::DFG::FrequentExitSite::operator!):
+        (JSC::DFG::FrequentExitSite::operator==):
+        (JSC::DFG::FrequentExitSite::hash):
+        (JSC::DFG::FrequentExitSite::bytecodeOffset):
+        (JSC::DFG::FrequentExitSite::kind):
+        (JSC::DFG::FrequentExitSite::isHashTableDeletedValue):
+        (JSC::DFG::FrequentExitSiteHash::hash):
+        (JSC::DFG::FrequentExitSiteHash::equal):
+        (JSC::DFG::QueryableExitProfile::hasExitSite):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::baselineCodeBlockForOriginAndBaselineCodeBlock):
+        (JSC::DFG::AssemblyHelpers::baselineCodeBlockFor):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnByteArray):
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h:
+
+2011-12-13  Michael Saboff  <msaboff@apple.com>
+
+        Cleanup of StringImpl::equal in r102631 post commit
+        https://bugs.webkit.org/show_bug.cgi?id=74421
+
+        Reviewed by Darin Adler.
+
+        * wtf/text/AtomicString.h:
+        (WTF::operator==): Removed cast no longer needed.
+        * wtf/text/StringImpl.h:
+        (WTF::equal): Changed template to several overloaded methods.
+
+2011-12-12  Michael Saboff  <msaboff@apple.com>
+
+        Eliminate Duplicate word at a time equal code in StringImpl.cpp and StringHash.h
+        https://bugs.webkit.org/show_bug.cgi?id=73622
+
+        Reviewed by Oliver Hunt.
+
+        Moved equal(charType1 *, charType2, unsigned) template methods
+        from static StringImpl.cpp to StringImpl.h and then replaced the
+        processor specific character comparison code in StringHash::equal
+        with calls to these methods.
+
+        This change is worth 3% on SunSpider string-unpack-code as reported
+        by the SunSpider command line harness.  No other tests appear to
+        have measurable performance changes.
+
+        * wtf/text/AtomicString.h:
+        (WTF::operator==):
+        * wtf/text/StringHash.h:
+        (WTF::StringHash::equal):
+        * wtf/text/StringImpl.cpp:
+        * wtf/text/StringImpl.h:
+        (WTF::LChar):
+        (WTF::UChar):
+        (WTF::equal):
+
+2011-12-12  Filip Pizlo  <fpizlo@apple.com>
+
+        ARMv7 version of DFG soft modulo does register allocation inside of control flow
+        https://bugs.webkit.org/show_bug.cgi?id=74354
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+
+2011-12-12  Andy Wingo  <wingo@igalia.com>
+
+        Simplify autotools configure.ac
+        https://bugs.webkit.org/show_bug.cgi?id=74312
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: Add JSC_CPPFLAGS to javascriptcore_cppflags.
+
+2011-12-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG GetByVal CSE incorrectly assumes that a non-matching PutByVal cannot clobber
+        https://bugs.webkit.org/show_bug.cgi?id=74329
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::getByValLoadElimination):
+
+2011-12-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        WebKit does not enumerate over CSS properties in HTMLElement.style
+        https://bugs.webkit.org/show_bug.cgi?id=23946
+
+        Reviewed by Darin Adler.
+
+        Add a few exports to follow the JSCSSStyleDeclaration.cpp changes,
+        introduce an std::sort() comparator function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/WTFString.h:
+        (WTF::codePointCompareLessThan): Used by std::sort() to sort properties.
+
+2011-12-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Revert r102570 which broke SnowLeopard builders.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/WTFString.h:
+
+2011-12-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        WebKit does not enumerate over CSS properties in HTMLElement.style
+        https://bugs.webkit.org/show_bug.cgi?id=23946
+
+        Reviewed by Darin Adler.
+
+        Add a few exports to follow the JSCSSStyleDeclaration.cpp changes,
+        introduce an std::sort() comparator function.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/WTFString.h:
+        (WTF::codePointCompareLessThan): Used by std::sort() to sort properties.
+
+2011-12-12  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am:
+
+2011-12-11  Sam Weinig  <sam@webkit.org>
+
+        Fix another signed vs. unsigned warning
+
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
+
+2011-12-11  Sam Weinig  <sam@webkit.org>
+
+        Fix a signed vs. unsigned warning.
+
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        Cast inlineCapacity to an int to appease the warning. This is known OK
+        since inlineCapacity is defined to be 8.
+
+2011-12-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out *another* debugging change I committed accidentally.
+
+        Unreviewed.
+
+        * Configurations/Base.xcconfig:
+
+2011-12-11  Geoffrey Garen  <ggaren@apple.com>
+        
+        Rolled out a debug counter I committed accidentally.
+
+        Unreviewed.
+
+        * jit/JITStubs.cpp:
+        (JSC::arityCheckFor):
+
+2011-12-10  Geoffrey Garen  <ggaren@apple.com>
+
+        v8 benchmark takes 12-13 million function call slow paths due to extra arguments
+        https://bugs.webkit.org/show_bug.cgi?id=74244
+
+        Reviewed by Filip Pizlo.
+        
+        .arguments function of order the Reversed
+        
+        10% speedup on v8-raytrace, 1.7% speedup on v8 overall, neutral on Kraken
+        and SunSpider.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfileForArgument): Clarified that the interface
+        to this function is an argument number.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::isArgumentNumber): Switched to using CallFrame
+        helper functions for computing offsets for arguments, rather than doing
+        the math by hand.
+        
+        Switched to iterating argument offsets backwards (--) instead of forwards (++).
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::thisRegister):
+        (JSC::CallArguments::argumentRegister):
+        (JSC::CallArguments::registerOffset): Updated for arguments being reversed.
+
+        * bytecompiler/NodesCodegen.cpp: Allocate arguments in reverse order.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack): Use abstract argument indices
+        that just-in-time convert to bytecode operands (i.e., indexes in the register
+        file) through helper functions. This means only one piece of code needs
+        to know how arguments are laid out in the register file.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump): Ditto.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueProfileFor): Ditto.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction): The whole point of this patch:
+        Treat too many arguments as an arity match.
+
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::variableForIndex):
+        (JSC::DFG::OSRExit::operandForIndex): Use helper functions, as above.
+
+        * dfg/DFGOperands.h:
+        (JSC::DFG::operandToArgument):
+        (JSC::DFG::argumentToOperand): These are now the only two lines of code in
+        the DFG compiler that know how arguments are laid out in memory.
+
+        (JSC::DFG::Operands::operand):
+        (JSC::DFG::Operands::setOperand): Use helper functions, as above.
+
+        * dfg/DFGOperations.cpp: The whole point of this patch:
+        Treat too many arguments as an arity match.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall): Use helper functions, as above.
+        
+        Also, don't tag the caller frame slot as a cell, because it's not a cell.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall): Use helper functions, as above.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Use helper functions, as above.
+
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes): Use already-computed
+        argument virtual register instead of recomputing by hand.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callFrameSlot):
+        (JSC::DFG::SpeculativeJIT::argumentSlot):
+        (JSC::DFG::SpeculativeJIT::callFrameTagSlot):
+        (JSC::DFG::SpeculativeJIT::callFramePayloadSlot):
+        (JSC::DFG::SpeculativeJIT::argumentTagSlot):
+        (JSC::DFG::SpeculativeJIT::argumentPayloadSlot): Added a few helper
+        functions for dealing with callee arguments specifically. These still
+        build on top of our other helper functions, and have no direct knowledge
+        of how arguments are laid out in the register file.
+
+        (JSC::DFG::SpeculativeJIT::resetCallArguments):
+        (JSC::DFG::SpeculativeJIT::addCallArgument): Renamed argumentIndex to
+        argumentOffset to match CallFrame naming.
+
+        (JSC::DFG::SpeculativeJIT::valueSourceReferenceForOperand): Use helper
+        functions, as above.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::argumentOffset):
+        (JSC::ExecState::argumentOffsetIncludingThis):
+        (JSC::ExecState::argument):
+        (JSC::ExecState::setArgument):
+        (JSC::ExecState::thisArgumentOffset):
+        (JSC::ExecState::thisValue):
+        (JSC::ExecState::setThisValue):
+        (JSC::ExecState::offsetFor):
+        (JSC::ExecState::hostThisRegister):
+        (JSC::ExecState::hostThisValue): Added a bunch of helper functions for
+        computing where an argument is in the register file. Anything in the
+        runtime that needs to access arguments should use these helpers.
+
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setThis):
+        (JSC::CallFrameClosure::setArgument):
+        (JSC::CallFrameClosure::resetCallFrame): This stuff is a lot simpler, now
+        that too many arguments counts as an arity match and doesn't require
+        preserving two copies of our arguments.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::slideRegisterWindowForCall): Only need to do something
+        special if the caller provided too few arguments.
+        
+        Key simplification: We never need to maintain two copies of our arguments
+        anymore.
+
+        (JSC::eval):
+        (JSC::loadVarargs): Use helper functions.
+
+        (JSC::Interpreter::unwindCallFrame): Updated for new interface.
+
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall): Seriously, though: use helper
+        functions.
+
+        (JSC::Interpreter::privateExecute): No need to check for stack overflow
+        when calling host functions because they have zero callee registers.
+
+        (JSC::Interpreter::retrieveArguments): Explicitly tear off the arguments
+        object, since there's no special constructor for this anymore.
+
+        * interpreter/Interpreter.h: Reduced the C++ re-entry depth because some
+        workers tests were hitting stack overflow in some of my testing. We should
+        make this test more exact in future.
+
+        * interpreter/RegisterFile.h: Death to all runtime knowledge of argument
+        location that does not belong to the CallFrame class!
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile): I am a broken record and I use helper functions.
+        
+        Also, the whole point of this patch: Treat too many arguments as an arity match.
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs): Updated the argument copying math to use
+        helper functions, for backwards-correctness. Removed the condition
+        pertaining to declared argument count because, now that arguments are
+        always in just one place, this optimization is valid for all functions.
+        Standardized the if predicate for each line of the optimization. This might
+        fix a bug, but I couldn't get the bug to crash in practice.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_get_argument_by_val): Removed cti_op_create_arguments_no_params
+        optimization because it's no longer an optimization, now that arguments
+        are always contiguous in a known location.
+        
+        Updated argument access opcode math for backwards-correctness.
+
+        * jit/JITStubs.cpp:
+        (JSC::arityCheckFor): Updated just like slideRegisterWindowForCall. This
+        function is slightly different because it copies the call frame in
+        addition to the arguments. (In the Interpreter, the call frame is not
+        set up by this point.)
+
+        (JSC::lazyLinkFor): The whole point of this patch: Treat too many
+        arguments as an arity match.
+
+        (JSC::DEFINE_STUB_FUNCTION): Updated for new iterface to tearOff().
+
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::loadDoubleArgument):
+        (JSC::SpecializedThunkJIT::loadCellArgument):
+        (JSC::SpecializedThunkJIT::loadInt32Argument): Use helper functions! They
+        build strong bones and teeth!
+
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::at):
+        (JSC::MarkedArgumentBuffer::clear):
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::MarkedArgumentBuffer::removeLast):
+        (JSC::MarkedArgumentBuffer::last):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at): Updated for backwards-correctness. WTF::Vector doesn't
+        play nice with backwards-ness, so I changed to using manual allocation.
+        
+        Fixed a FIXME about not all values being marked in the case of out-of-line
+        arguments. I had to rewrite the loop anyway, and I didn't feel like
+        maintaining fidelity to its old bugs.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        (JSC::Arguments::copyToArguments):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlotByIndex):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::putByIndex):
+        (JSC::Arguments::put):
+        (JSC::Arguments::tearOff):
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::argument):
+        (JSC::Arguments::finishCreation): Secondary benefit of this patch: deleted
+        lots of tricky code designed to maintain two different copies of function
+        arguments. Now that arguments are always contiguous in one place in memory,
+        this complexity can go away.
+        
+        Reduced down to one create function for the Arguments class, from three.
+
+        Moved tearOff() into an out-of-line function because it's huge.
+        
+        Moved logic about whether to tear off eagerly into the Arguments class,
+        so we didn't have to duplicate it elsewhere.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::visitChildren): Renamed m_numParametersMinusThis to
+        m_numCapturedArgs because if the value really were m_numParametersMinusThis
+        we would be marking too much. (We shouldn't mark 'this' because it can't
+        be captured.) Also, use helper functions.
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::tearOff): Use helper functions.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArray.h: Use helper functions, as above.
+
+2011-12-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC testapi is crashing on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=74233
+
+        Reviewed by Sam Weinig.
+
+        Same error we've encountered before where we are calling the wrong version of 
+        visitChildren and objects that are still reachable aren't getting marked.
+        This problem will go away soon with the removal of vptrs for these sorts of 
+        optimizations in favor of using the ClassInfo, but for now we can simply give 
+        JSFinalObject a bogus virtual method that Visual Studio can't optimize away to
+        ensure that JSFinalObject will always have a unique vptr.  We don't have to worry 
+        about JSString or JSArray right now, which are the other two special cases for
+        visitChildren, since they already have their own virtual functions.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSObject.cpp:
+        (JSC::JSFinalObject::vtableAnchor):
+        * runtime/JSObject.h:
+
+2011-12-10  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Unused variable in YarrJIT.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=74237
+
+        Reviewed by Andreas Kling.
+
+        Variable is set but not used so we can remove it.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+
+2011-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ArithMul power-of-two case does not check for overflow
+        https://bugs.webkit.org/show_bug.cgi?id=74230
+
+        Reviewed by Gavin Barraclough.
+        
+        Disabled power-of-2 peephole optimization for multiplication, because it was wrong,
+        and any attempt to fix it would likely introduce code bloat and register pressure.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+
+2011-12-09  David Levin  <levin@chromium.org>
+
+        REGRESSION(r101863-r102042): Assertion hit: m_verifier.isSafeToUse() in RefCountedBase::ref in FunctionCodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=73886
+
+        Reviewed by Darin Adler.
+
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::SharedSymbolTable): Added deprecatedTurnOffVerifier for
+        another JavaScriptObject, since JavaScriptCore objects allow use on multiple threads.
+        Bug 58091 is about changing these deprecated calls to something else but that something
+        else will still need to be in all of these places.
+
+2011-12-09  Konrad Piascik  <kpiascik@rim.com>
+
+        Remove unnecessary file DissasemblerARM.cpp from build system
+        https://bugs.webkit.org/show_bug.cgi?id=74184
+
+        Reviewed by Daniel Bates.
+
+        * PlatformBlackBerry.cmake:
+
+2011-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG's interpretation of rare case profiles should be frequency-based not count-based
+        https://bugs.webkit.org/show_bug.cgi?id=74170
+
+        Reviewed by Geoff Garen.
+        
+        DFG optimizes for rare cases only when the rare case counter is above some threshold
+        and it also constitutes a large enough fraction of total function executions. Also
+        added some minor debug logic.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::executionEntryCount):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h:
+
+2011-12-09  Oliver Hunt  <oliver@apple.com>
+
+        PutByValAlias unnecessarily clobbers GetIndexedPropertyStorage
+        https://bugs.webkit.org/show_bug.cgi?id=74223
+
+        Reviewed by Geoffrey Garen.
+
+        Don't clobber GetIndexedPropertyStorage when we see PutByValAlias
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::getIndexedPropertyStorageLoadElimination):
+
+2011-12-09  David Levin  <levin@chromium.org>
+
+        Hash* iterators should allow comparison between const and const versions.
+        https://bugs.webkit.org/show_bug.cgi?id=73370
+
+        Reviewed by Darin Adler.
+
+        * wtf/HashTable.h: Add the operators needed to do this.
+        (WTF::HashTableConstIterator::operator==):
+        (WTF::HashTableConstIterator::operator!=):
+        (WTF::HashTableIterator::operator==):
+        (WTF::HashTableIterator::operator!=):
+        (WTF::operator==):
+        (WTF::operator!=):
+
+2011-12-09  Michael Saboff  <msaboff@apple.com>
+
+        YARR: Multi-character read optimization for 8bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=74191
+
+        Reviewed by Oliver Hunt.
+
+        Changed generatePatternCharacterOnce to generate
+        code for 1 to 4 characters in the 8 bit case.
+        This is worth 29% improvement on SunSpider regexp-dna test.
+        It provides no benefit to v8-regexp.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::generate): Spelling fix in comment.
+
+2011-12-09  David Levin  <levin@chromium.org>
+
+        Regression(r53595): Sync xhr requests in workers aren't terminated on worker close.
+        https://bugs.webkit.org/show_bug.cgi?id=71695
+
+        Reviewed by Zoltan Herczeg.
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::tryGetMessageIgnoringKilled): Added a way to get messages
+        even after the queue has been killed. This is useful when one wants to
+        kill a queue but then go through it to run clean up tasks from it.
+
+2011-12-09  Adrienne Walker  <enne@google.com>
+
+        Fix HashMap<..., OwnPtr<...> >::add compilation errors
+        https://bugs.webkit.org/show_bug.cgi?id=74159
+
+        Reviewed by Darin Adler.
+
+        Add a constructor to OwnPtr that takes the empty value (nullptr_t)
+        from HashTraits so that this function can compile.
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::OwnPtr):
+
+2011-12-09  Oliver Hunt  <oliver@apple.com>
+
+        Avoid reloading storage pointer for indexed properties unnecessarily
+        https://bugs.webkit.org/show_bug.cgi?id=74136
+
+        Reviewed by Filip Pizlo.
+
+        Add a node to represent loading property storage for indexed properties.
+        This allows us to reduce code generated for sequential access of arrays,
+        strings, etc.  This results in up to 5% improvement in code that is 
+        very heavy on indexed reads, such as matrix operations in typed arrays
+        and 20% faster on microbenchmarks.
+
+        Currently this is only supported by GetByVal and other similar indexed reads.
+
+        * bytecode/PredictedType.h:
+        (JSC::isFixedIndexedStorageObjectPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnByteArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-08  Fady Samuel  <fsamuel@chromium.org>
+
+        [Chromium] Enable viewport metatag
+        https://bugs.webkit.org/show_bug.cgi?id=73495
+
+        Reviewed by Darin Fisher.
+
+        * wtf/Platform.h: Added ENABLE(VIEWPORT) tag.
+
+2011-12-08  Adam Klein  <adamk@chromium.org>
+
+        Use HashMap<Node*, OwnPtr<...>> in ChildListMutationScope
+        https://bugs.webkit.org/show_bug.cgi?id=73964
+
+        Reviewed by Darin Adler.
+
+        * wtf/HashTraits.h: Add passOut(std::nullptr_t) to allow callers to use HashMap::take on a HashMap of OwnPtrs.
+
+2011-12-08  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=74005
+        fix unaligned access memory in generatePatternCharacterOnce function
+        for SH4 platforms.
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load16Unaligned):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load16Unaligned):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load16Unaligned):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::lshift32):
+        (JSC::MacroAssemblerSH4::load8):
+        (JSC::MacroAssemblerSH4::load16):
+        (JSC::MacroAssemblerSH4::load16Unaligned):
+        (JSC::MacroAssemblerSH4::branch8):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load16Unaligned):
+        * jit/JIT.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+
+2011-12-08  Michael Saboff  <msaboff@apple.com>
+
+        Add 8 bit paths for StringTypeAdapter classes
+        https://bugs.webkit.org/show_bug.cgi?id=73882
+
+        Reviewed by Darin Adler.
+
+        Added is8Bit() method and writeTo(LChar*) methods
+        to StringTypeAdapter<> classes.  The writeTo(LChar*)
+        method can be used if is8Bit() returns true.  The
+        non-native 8 bit classes contain ASSERT(is8Bit())
+        in their writeTo(LChar*).
+
+        Updated all of the various versions of tryMakeString() to
+        use 8 bit processing in the updated StringTypeAdapter<>
+        classes.
+
+        This has slight if any performance improvement on kraken.
+
+        * runtime/UStringConcatenate.h:
+        * wtf/text/StringConcatenate.h:
+        (WTF::tryMakeString):
+        * wtf/text/StringOperators.h:
+        (WTF::StringAppend::is8Bit):
+        (WTF::StringAppend::writeTo):
+
+2011-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE should know that CheckFunction is pure
+        https://bugs.webkit.org/show_bug.cgi?id=74044
+
+        Reviewed by Oliver Hunt.
+        
+        Possible slight win on V8, no regressions.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::checkFunctionElimination):
+
+2011-12-07  Michael Saboff  <msaboff@apple.com>
+
+        StringBuilderTest.Append and StringBuilderTest.ToStringPreserveCapacity are failing.
+        https://bugs.webkit.org/show_bug.cgi?id=73995
+
+        Reviewed by Geoffrey Garen.
+
+        Problem was that a call to characters on an StringImpl associated
+        with a StringBuilder that is being appended to gets stale.
+        Added a new m_valid16BitShadowlen that keeps the length of
+        the 16 bit shadow that has been upconverted or will be up converted
+        with the first getCharacters().  When StringBuilder::characters or
+        ::reifyString is called, further characters are upconverted if
+        we have a shadow16bit copy and the m_valid16BitShadowlen is updated.
+
+        * JavaScriptCore.exp:
+        * wtf/text/StringBuilder.cpp:
+        (WTF::StringBuilder::reifyString):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::StringBuilder):
+        (WTF::StringBuilder::characters):
+        (WTF::StringBuilder::clear): Cleaned up as part of the change.
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::getData16SlowCase):
+        (WTF::StringImpl::upconvertCharacters):
+        * wtf/text/StringImpl.h:
+
+2011-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Compare and Swap should be enabled on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=74023
+
+        Reviewed by Geoff Garen.
+        
+        Implemented weakCompareAndSwap in terms of LDREX/STREX and enabled PARALLEL_GC.
+        It gives the expected speed-up on multi-core ARMv7 devices.
+
+        * wtf/Atomics.h:
+        (WTF::weakCompareAndSwap):
+        * wtf/Platform.h:
+
+2011-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE is overzealous with GetByVal
+        https://bugs.webkit.org/show_bug.cgi?id=74042
+
+        Reviewed by Oliver Hunt.
+        
+        Made sure that the purity of GetByVal and the limited-clobber-itude of PutByVal
+        is tested in all places that matter.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::byValIsPure):
+        (JSC::DFG::Propagator::clobbersWorld):
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+
+2011-12-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r102267.
+        http://trac.webkit.org/changeset/102267
+        https://bugs.webkit.org/show_bug.cgi?id=74032
+
+        Breaks build on Chromium Mac Debug (Requested by aklein on
+        #webkit).
+
+        * wtf/HashTraits.h:
+
+2011-12-07  Adam Klein  <adamk@chromium.org>
+
+        Use HashMap<Node*, OwnPtr<...>> in ChildListMutationScope
+        https://bugs.webkit.org/show_bug.cgi?id=73964
+
+        Reviewed by Ryosuke Niwa.
+
+        * wtf/HashTraits.h: Add passOut(std::nullptr_t) to allow callers to use HashMap::take on an entry whose value is null.
+
+2011-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Non-Mac devices should benefit from a larger heap
+        https://bugs.webkit.org/show_bug.cgi?id=74015
+
+        Reviewed by Geoff Garen.
+        
+        Removed the ENABLE(LARGE_HEAP) option from Platform.h, since it was only used in
+        Heap.cpp, and got in the way of having more granular, per-platform control over
+        what the heap size should be. Bumped the heap size to 8MB on iOS (was 512KB).
+
+        * heap/Heap.cpp:
+        (JSC::GCTimer::heapSizeForHint):
+        * wtf/Platform.h:
+
+2011-11-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] V8 build fixes.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * yarr/yarr.pri: Don't rely on Source/JavaScriptCore being in
+        VPATH. Prefix SOURCES correctly and make sure that runtime/ is
+        in the include search path when building with v8.
+
+2011-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Zapping a block that is Marked leads to dead objects being mistaken for live ones
+        https://bugs.webkit.org/show_bug.cgi?id=73982
+
+        Reviewed by Geoff Garen.
+        
+        Changed the zapping code to ignore blocks that are Marked or Zapped. Additionally,
+        the code asserts that:
+        
+        - If we zap a Marked or Zapped block then the free list is empty, because this
+          can only happen if the block was never free-listed.
+          
+        - Zapping can only happen for Marked, Zapped, or FreeListed blocks, since Allocated
+          blocks are those that cannot be referred to by SizeClass::currentBlock (since
+          SizeClass::currentBlock only refers to blocks that are candidates for allocation,
+          and Allocated blocks are those who have been exhausted by allocation and will not
+          be allocated from again), and New blocks cannot be referred to by anything except
+          during a brief window inside the allocation slow-path.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::zapFreeList):
+
+2011-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG 32_64 call linking does not handle non-cell callees correctly
+        https://bugs.webkit.org/show_bug.cgi?id=73965
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
+2011-12-06  Sam Weinig  <sam@webkit.org>
+
+        Remove unintentional type name shadowing in the Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=73963
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall): Replace the parameter name FunctionExecutable,
+        which shadows the FunctionExecutable type name, with functionExecutable.
+
+2011-12-06  Michael Saboff  <msaboff@apple.com>
+
+        r102146 from 73875 broke fast/js/encode-URI-test.html
+        https://bugs.webkit.org/show_bug.cgi?id=73950
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncUnescape): Restructured to handle
+        the %uHHHH case to output the resulting character
+        and continue so that a failure in finding 4 hex
+        digits will fall through and output the '%'.
+        Due to style check, changed the temporary
+        character variable to a more descriptive name.
+
+2011-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        GC zapping logic could benefit from some more assertions
+        https://bugs.webkit.org/show_bug.cgi?id=73947
+
+        Reviewed by Gavin Barraclough.
+        
+        - If you're in a zapped block and you're zapped, then your mark bit should
+          never be set.
+          
+        - If you're being marked, then you should never be zapped.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isLive):
+        * runtime/Structure.h:
+        (JSC::MarkStack::internalAppend):
+
+2011-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Don't allocate register in typedarray control flow
+        https://bugs.webkit.org/show_bug.cgi?id=73944
+
+        Reviewed by Gavin Barraclough.
+
+        Move a temporary allocation outside of control flow.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+
+2011-12-06  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68328
+        The generator and intrinsic fields in HashTableValue/HashEntry and associated structures and methods are redundant
+
+        Reviewed by Geoff Garen.
+
+        Move the instrinsic enum out of the DFG, into runtime. Add entires for all host functions
+        that have an intrinsic in the form of a generated thunk. Remove the thunk pointer from the
+        hashtable, and make Intrinsic field no longer ifdef on JIT/DFG. In getHostFunction select
+        a thunk genertaor to use based on the Intrinsic.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_hash_table:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGIntrinsic.h: Removed.
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::intrinsic):
+        (JSC::NativeExecutable::intrinsic):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::intrinsicFor):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        * runtime/Intrinsic.h: Copied from Source/JavaScriptCore/dfg/DFGIntrinsic.h.
+        * runtime/JSGlobalData.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::intrinsic):
+
+2011-12-06  Michael Saboff  <msaboff@apple.com>
+
+        Add 8 bit paths to global object functions
+        https://bugs.webkit.org/show_bug.cgi?id=73875
+
+        Added 8 bit paths for converions methods.
+
+        This is worth 1.5% on kraken audio-oscillator,
+        1.6% on stanford-crypto-ccm and 2.5% on
+        stanford-crypto-sha256-iterative.  See bug for
+        a full report.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::decode): Split into a templated helper.
+        (JSC::parseInt): Split into a templated helper.
+        (JSC::parseFloat): Added an 8 bit path
+        (JSC::globalFuncEscape): Added 8 bit path
+        (JSC::globalFuncUnescape): Added 8 bit path
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::append): New append for LChar
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::append): New append for LChar
+
+2011-11-21  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Enable ParallelJobs by default
+        https://bugs.webkit.org/show_bug.cgi?id=70032
+
+        Reviewed by Zoltan Herczeg.
+
+        According to measurements on Mac and Linux it is a
+        considerable speedup for SVG on multicore.
+
+        Remove the ENABLE(PARALLEL_JOBS) guard.
+        Fix build on Windows and Chromium.
+
+        * JavaScriptCore.gypi:  Add the files to the build. It was
+        missing for the gyp build system.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Export symbols.
+        * wtf/ParallelJobs.h:
+        * wtf/ParallelJobsGeneric.cpp:
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::execute):
+        Deinline these to avoid exporting a lot of symbols.
+        These are non-trivial and called only once on a given object
+        so it doesn't seems to be worthwile to inline them.
+        Additionally fix a signed-unsigned comparison in the constructor.
+        * wtf/ParallelJobsGeneric.h:
+        * wtf/Platform.h:
+
+2011-12-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] build-jsc script doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=73910
+
+        Reviewed by Tor Arne Vestbø.
+
+        * JavaScriptCore.pro: Build WTF before JavaScriptCore and JSC
+        (moved from top-level WebKit.pro). Also add v8 scopes to only build
+        WTF during v8 builds.
+
+2011-12-05  Anders Carlsson  <andersca@apple.com>
+
+        Add HashMap::keys() and HashMap::values() for easy iteration of hash map keys and values in C++11.
+
+        Reviewed by Darin Adler.
+
+        * wtf/HashMap.h:
+
+2011-12-05  Michael Saboff  <msaboff@apple.com>
+
+        Create StringImpl::empty() as an 8 bit string
+        https://bugs.webkit.org/show_bug.cgi?id=73871
+
+        Reviewed by Oliver Hunt.
+
+        * wtf/text/StringStatics.cpp:
+        (WTF::StringImpl::empty): Changed to be an 8 bit string.
+
+2011-12-05  Darin Adler  <darin@apple.com>
+
+        Convert JSClassRef to use HashMap<OwnPtr>
+        https://bugs.webkit.org/show_bug.cgi?id=73780
+
+        Reviewed by Andreas Kling.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::getOwnPropertyNames): Use get() on the hash map
+        entries because the hash map now has an OwnPtr instead of a raw pointer.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass): No need to initialize m_staticValues and
+        m_staticFunctions since they are now OwnPtr. Use adoptPtr when allocating.
+        Removed the code that gets and deletes existing entries, and just use set,
+        which now handles deletion automatically due to it being OwnPtr.
+        (OpaqueJSClass::~OpaqueJSClass): Replaced code to do all the deletion
+        with assertion-only NDEBUG-only code.
+        (OpaqueJSClassContextData::OpaqueJSClassContextData): Use adoptPtr when
+        allocating. Use OwnPtr when adding. Removed unneeded code to set
+        staticValues and staticFunctions to 0. Removed unneeded destructor.
+        (OpaqueJSClass::staticValues): Added get call. Also removed unneeded local.
+        (OpaqueJSClass::staticFunctions): Ditto.
+        (OpaqueJSClass::prototype): Added use of adoptPtr.
+
+        * API/JSClassRef.h: Made the static values and static functions tables
+        use OwnPtr for the entries. Also used OwnPtr for the pointers to the
+        tables themselves. Also removed ~OpaqueJSClassContextData(), letting
+        the compiler generate it.
+
+2011-12-05  Oliver Hunt  <oliver@apple.com>
+
+        Land uncommitted bit of float array support
+        https://bugs.webkit.org/show_bug.cgi?id=73873
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+
+2011-12-05  Benjamin Poulain  <benjamin@webkit.org>
+
+        Update String::containsOnlyASCII() to handle 8 bits strings
+        https://bugs.webkit.org/show_bug.cgi?id=73799
+
+        Reviewed by Darin Adler.
+
+        Implement String::containsOnlyASCII() so that it does not
+        call String::characters().
+
+        * wtf/text/WTFString.h:
+        (WTF::String::containsOnlyASCII):
+
+2011-12-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for non-DFG platforms.
+
+        * dfg/DFGRepatch.h:
+
+2011-12-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Old JIT emits 32-bit offsets for put_by_id but sometimes patches them as if they
+        were compact offsets
+        https://bugs.webkit.org/show_bug.cgi?id=73861
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::resetPatchPutById):
+
+2011-12-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fixes for ARM.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::unreachableForPlatform):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::loadFloat):
+        (JSC::MacroAssemblerARMv7::storeFloat):
+        (JSC::MacroAssemblerARMv7::convertFloatToDouble):
+        (JSC::MacroAssemblerARMv7::convertDoubleToFloat):
+
+2011-12-05  Benjamin Poulain  <benjamin@webkit.org>
+
+        Update String::containsOnlyLatin1() to avoid converting to 16 bits
+        https://bugs.webkit.org/show_bug.cgi?id=73797
+
+        Reviewed by Andreas Kling.
+
+        When the String use 8bits StringImpl, there is no need to iterate
+        over the string.
+
+        The function charactersAreAllLatin1() is removed because it is not
+        used anywhere.
+
+        * wtf/text/WTFString.h:
+        (WTF::String::containsOnlyLatin1):
+
+2011-12-05  Michael Saboff  <msaboff@apple.com>
+
+        8 bit string work slows down Kraken json-stringify-tinderbox
+        https://bugs.webkit.org/show_bug.cgi?id=73457
+
+        Added 8 bit path to StringBuilder.  StringBuilder starts
+        assuming 8 bit contents and gets converted to 16 bit upon
+        seeing the first 16 bit character or string.  Split
+        appendUninitialiezed into an inlined fast and function call
+        slow case.
+
+        Factored out the processing of the UString argument from
+        Stringifier::appendQuotedString() to a static templated function
+        based on character size.
+
+        This change eliminates 5% of the 7% slowdown to json-stringify-tinderbox.
+        This change introduces a 4.8% slowdown to json-parse-financial.
+        This slowdown will be addressed in a subsequent patch to StringImpl::equal.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSONObject.cpp:
+        (JSC::appendStringToUStringBuilder):
+        (JSC::Stringifier::appendQuotedString):
+        * wtf/text/StringBuilder.cpp:
+        (WTF::StringBuilder::resize):
+        (WTF::StringBuilder::allocateBuffer):
+        (WTF::StringBuilder::allocateBufferUpConvert):
+        (WTF::LChar):
+        (WTF::UChar):
+        (WTF::StringBuilder::reserveCapacity):
+        (WTF::StringBuilder::appendUninitialized):
+        (WTF::StringBuilder::appendUninitializedSlow):
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::shrinkToFit):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::StringBuilder):
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::operator[]):
+        (WTF::StringBuilder::characters8):
+        (WTF::StringBuilder::characters16):
+        (WTF::StringBuilder::charactersBlah):
+        (WTF::LChar):
+        (WTF::UChar):
+
+2011-12-01  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=73624
+        JIT + INTERPRETER builds are broken
+
+        Reviewed by Geoff Garen, Sam Weinig.
+
+        These don't fallback to the interpreter correctly.
+        Thunk creation assumes that is the JIT is compiled in, then it is enabled.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::getHostFunction):
+
+2011-12-05  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        MacroAssemblerSH4 does not implement readCallTarget
+        https://bugs.webkit.org/show_bug.cgi?id=73434
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/MacroAssemblerSH4.h: Support for SH4.
+        (JSC::MacroAssemblerSH4::readCallTarget):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::readCallTarget):
+
+2011-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize strict equality
+        https://bugs.webkit.org/show_bug.cgi?id=73764
+
+        Reviewed by Oliver Hunt.
+        
+        1% speed-up on V8.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-03  Darin Adler  <darin@apple.com>
+
+        Use HashMap<OwnPtr> for ScriptSampleRecordMap
+        https://bugs.webkit.org/show_bug.cgi?id=73758
+
+        Reviewed by Andreas Kling.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::notifyOfScope): Added adoptPtr.
+        (JSC::SamplingTool::dump): Added get.
+        * bytecode/SamplingTool.h: Changed the value type of ScriptSampleRecordMap to be OwnPtr.
+
+2011-12-03  Darin Adler  <darin@apple.com>
+
+        Use HashMap<OwnPtr> for the opaqueJSClassData map
+        https://bugs.webkit.org/show_bug.cgi?id=73759
+
+        Reviewed by Andreas Kling.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::contextData): Update types.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Add an explicit clear of opaqueJSClassData to keep the
+        timing the same. If we didn't care about the order of operations, we could remove this, too.
+        * runtime/JSGlobalData.h: Use OwnPtr instead of raw pointer for the mapped type in the
+        opaqueJSClassData map.
+
+2011-12-03  Darin Adler  <darin@apple.com>
+
+        Change HashMap implementation to use the pass type and peek type from traits for the mapped value
+        https://bugs.webkit.org/show_bug.cgi?id=72474
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/HashMap.h: Added ReferenceTypeMaker struct template. Get PassInType, PassOutType,
+        and PeekType from the traits of the mapped value instead of hard-coding them here.
+        Changed inlineAdd to take a reference to the PassInType instead of the PassInType itself,
+        to accomodate a PassInType that can't be copied. Use the store, peek, and passOut
+        functions from the traits as well.
+
+        * wtf/HashTraits.h: Updated GenericHashTraits and HashTraits for OwnPtr to include
+        PassInType, PassOutType, PeekType, store, passOut, and peek. Before this, the file had
+        an earlier version that was just PassType, PeekType, pass, and peek. Also commented
+        the HashTraits for RefPtr to foreshadow some work we can do there.
+
+        * wtf/RefPtrHashMap.h: Same changes as HashMap.h.
+
+2011-12-02  David Levin  <levin@chromium.org>
+
+        Rename WTF class from TemporarilyChange to TemporaryChange.
+        https://bugs.webkit.org/show_bug.cgi?id=73479
+
+        Reviewed by Eric Seidel.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/TemporaryChange.h: Renamed from Source/JavaScriptCore/wtf/TemporarilyChange.h.
+        (WTF::TemporaryChange::TemporaryChange):
+        (WTF::TemporaryChange::~TemporaryChange):
+
+2011-12-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION (r99754): All layout tests crash on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=72305
+
+        Reviewed by Geoffrey Garen.
+
+        Fixes a crash in release builds on Windows.  Windows was optimizing the out-of-line virtual destructor in 
+        JSFunction away, which left it with no virtual functions.  Its vtable ptr was then identical to that of 
+        a different class, therefore the optimization in the visitChildren helper function in MarkedStack.cpp was calling an 
+        incorrect version of visitChildren on the object, which left its children unmarked, causing them to be 
+        collected when they were still reachable.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::vtableAnchor): Add a virtual function to JSFunction that Visual Studio can't optimize away.
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Add checks to make sure that all virtual pointers that we rely on for optimization
+        purposes are distinct from one another.
+
+2011-12-02  Oliver Hunt  <oliver@apple.com>
+
+        Improve float array support in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=73722
+
+        Reviewed by Gavin Barraclough.
+
+        Add basic support for float typed arrays in JSC.  This is currently
+        less optimal than it could be in the following ways:
+         * float32Array1[0] = float32Array2[0] (eg. an element by element copy) 
+           promotes float to double and then back to float.
+         * float64Array[0] will always perform NaN tests in order to prevent
+           signalling NaNs from entering the engine.
+
+        We also don't support Float32Array on ARMv7
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::loadFloat):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::storeFloat):
+        (JSC::MacroAssemblerARMv7::convertFloatToDouble):
+        (JSC::MacroAssemblerARMv7::convertDoubleToFloat):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::loadDouble):
+        (JSC::MacroAssemblerX86Common::loadFloat):
+        (JSC::MacroAssemblerX86Common::storeDouble):
+        (JSC::MacroAssemblerX86Common::storeFloat):
+        (JSC::MacroAssemblerX86Common::convertDoubleToFloat):
+        (JSC::MacroAssemblerX86Common::convertFloatToDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cvtsd2ss_rr):
+        (JSC::X86Assembler::cvtss2sd_rr):
+        (JSC::X86Assembler::movsd_rm):
+        (JSC::X86Assembler::movss_rm):
+        (JSC::X86Assembler::movsd_mr):
+        (JSC::X86Assembler::movss_mr):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateFloat32Array):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-12-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r101801.
+        http://trac.webkit.org/changeset/101801
+        https://bugs.webkit.org/show_bug.cgi?id=73667
+
+        Build is still broken (Requested by Ossy on #webkit).
+
+        * assembler/SH4Assembler.h:
+
+2011-12-01  Darin Adler  <darin@apple.com>
+
+        Prepare to deploy pass and peek types in the HashMap class
+        https://bugs.webkit.org/show_bug.cgi?id=73477
+
+        Reviewed by Adam Roben.
+
+        This patch adds private typedefs inside the HashMap class,
+        and uses them as appropriate. A future patch will actually
+        tie those typedefs to hash traits, which will allow us to
+        make HashMap work with OwnPtr mapped values and to optimize
+        how HashMap works with RefPtr mapped values.
+
+        Also changed the hash translator and adapter struct templates
+        to use template functions to simplify them and make them more
+        flexible.
+
+        Also removed some unused template arguments.
+
+        This goes out of its way to not change behavior. Future patches
+        will change the peek type to be a reference type, which will
+        reduce reference count churn a bit for hash tables with RefPtr
+        mapped values, and then do further optimizations for RefPtr
+        and OwnPtr by getting types from the hash traits.
+
+        * wtf/HashMap.h: Added MappedPassInType, MappedPassOutType,
+        and MappedPeekType typedefs, and used them for the arguments
+        and return types of the get, set, add, take, and inlineAdd
+        functions.
+        (WTF::HashMapTranslator): Changed this struct template to take
+        fewer arguments, and changed its member functions to be
+        function templates instead. This allows the compiler to
+        determine types more flexibly and also simplifies use of it.
+        (WTF::HashMapTranslatorAdapter): Ditto.
+        (WTF::HashMap::find): Updated to use new HashMapTranslatorAdapter.
+        Also reduced the arguments passed to the HashTable function template.
+        (WTF::HashMap::contains): Ditto.
+        (WTF::HashMap::inlineAdd): Ditto. Also take MappedPassInType.
+        (WTF::HashMap::set): Ditto.
+        (WTF::HashMap::add): Ditto.
+        (WTF::HashMap::inlineGet): Ditto, but return MappedPeekType.
+        (WTF::HashMap::get): Ditto.
+        (WTF::HashMap::take): Ditto, but return MappedPassOutType and use
+        that type in the implementation.
+        (WTF::deleteAllValues): Removed unneeded template arguments from
+        call to deleteAllPairSeconds.
+        (WTF::deleteAllKeys): Removed unneeded template arguments from
+        call to deleteAllPairFirsts.
+
+        * wtf/HashSet.h:
+        (WTF::IdentityExtractor): Changed this to be a struct rather than
+        a struct template, and replaced the extract function with a function
+        template. This allows the compiler to deduce the type.
+        (WTF::HashSetTranslatorAdapter): Changed this struct template to take
+        fewer arguments, and changed its member functions to be
+        function templates instead. This allows the compiler to
+        determine types more flexibly and also simplifies use of it.
+        (WTF::HashSet::find): Updated to use new HashSetTranslatorAdapter.
+        Also reduced the arguments passed to the HashTable function template.
+        (WTF::HashSet::contains): Ditto.
+        (WTF::HashSet::add): Ditto.
+
+        * wtf/HashTable.h:
+        (WTF::IdentityHashTranslator): Changed this struct template to take
+        fewer arguments, and changed its member functions to be
+        function templates instead. This allows the compiler to
+        determine types more flexibly and also simplifies use of it.
+        (WTF::HashTable::add): Reduced arguments passed to the function template.
+        (WTF::HashTable::find): Ditto, also reversed the template arguments so the
+        translator comes first so the compiler can deduce the other type.
+        (WTF::HashTable::contains): Ditto.
+        (WTF::HashTable::lookup): Ditto.
+        (WTF::HashTable::lookupForWriting): Ditto.
+        (WTF::HashTable::checkKey): Ditto.
+        (WTF::HashTable::fullLookupForWriting): Ditto.
+        (WTF::HashTable::add): Ditto.
+        (WTF::HashTable::addPassingHashCode): Ditto.
+        (WTF::HashTable::find): Ditto.
+        (WTF::HashTable::contains): Ditto.
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetNodeHashFunctions): Changed this struct template to take
+        fewer arguments, and changed its member functions to be function templates
+        instead. This allows the compiler to determine types more flexibly and
+        also simplifies use of it.
+        (WTF::ListHashSet::find): Reduced the arguments passed to the HashTable
+        functon template.
+        (WTF::ListHashSetTranslatorAdapter): Changed this struct template in the
+        same way we changed ListHashSetNodeHashFunctions above.
+        (WTF::ListHashSetTranslatorAdapter::equal):
+        (WTF::::contains):
+        (WTF::::add):
+        (WTF::::insertBefore):
+
+        * wtf/RefPtrHashMap.h: Updated comments. Removed the
+        RefPtrHashMapRawKeyTranslator struct template; we can use the
+        HashMapTranslator struct template from HashMap.h instead now that
+        it is more flexible. Added MappedPassInType, MappedPassOutType,
+        and MappedPeekType typedefs, and used them for the arguments
+        and return types of the get, inlineGet, set, add, take, and inlineAdd
+        functions. Changed the name of the RawKeyTranslator type to
+        Translator since it's now a class that can handle both raw keys
+        and conventional keys.
+        (WTF::HashMap::find): Changed to use Translator instead of RawKeyTranslator.
+        Reduced the arguments passed to the HashTable function template.
+        (WTF::HashMap::contains): Ditto.
+        (WTF::HashMap::inlineAdd): Ditto. Also take MappedPassInType.
+        (WTF::HashMap::set): Ditto.
+        (WTF::HashMap::add): Ditto.
+        (WTF::HashMap::inlineGet): Ditto, but return MappedPeekType.
+        (WTF::HashMap::get): Ditto.
+        (WTF::HashMap::take): Ditto, but return MappedPassOutType and use
+        that type in the implementation.
+        (WTF::deleteAllValues): Removed unneeded template arguments from
+        call to deleteAllPairSeconds.
+        (WTF::deleteAllKeys): Removed unneeded template arguments from
+        call to deleteAllPairFirsts.
+
+2011-12-02  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        MacroAssemblerSH4 does not implement readCallTarget
+        https://bugs.webkit.org/show_bug.cgi?id=73434
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::readCallTarget): Support for SH4.
+
+2011-12-02  Hajime Morrita  <morrita@chromium.org>
+
+        Unreviewed, rolling out r101751 and r101775.
+        http://trac.webkit.org/changeset/101751
+        http://trac.webkit.org/changeset/101775
+        https://bugs.webkit.org/show_bug.cgi?id=73191
+
+        breaks Windows build
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h:
+        * runtime/JSExportMacros.h: Removed.
+        * wtf/ExportMacros.h:
+        * wtf/Platform.h:
+        * wtf/WTFThreadData.h:
+        * wtf/text/AtomicString.h:
+        * wtf/text/StringStatics.cpp:
+
+2011-12-01  Hajime Morrita  <morrita@chromium.org>
+
+        JS_INLINE and WTF_INLINE should be visible from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=73191
+
+        - Moved Export related macro definitions from config.h to ExportMacros.h and JSExportMacros.h.
+        - Moved WTF_USE_JSC and WTF_USE_V8 from various config.h family to Platform.h.
+        - Replaced JS_EXPORTDATA in wtf moudule with newly introduced WTF_EXPORTDATA.
+
+        Reviewed by Kevin Ollivier.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h:
+        * runtime/JSExportMacros.h: Added.
+        * wtf/ExportMacros.h:
+        * wtf/Platform.h:
+        * wtf/WTFThreadData.h:
+        * wtf/text/AtomicString.h:
+        * wtf/text/StringStatics.cpp:
+
+2011-12-01  Michael Saboff  <msaboff@apple.com>
+
+        Changes proposed for 73457 slow down Kraken json-parse-financial
+        https://bugs.webkit.org/show_bug.cgi?id=73584
+
+        Restructured StringImpl::equal to take advantage of 8 or 4 bytes
+        at a time when possible.
+
+        This is worth ~3% on Kraken json-parse-financial. It provides 
+        ~2% on SunSpider string-unpack-code.
+
+        Reviewed by Sam Weinig.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::equal):
+
+2011-12-01  Oliver Hunt  <oliver@apple.com>
+
+        Support integer typed arrays in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=73608
+
+        Reviewed by Filip Pizlo.
+
+        Add support for all the integral typed arrays in the DFG JIT.
+        Currently this loads the contents of Uint32 arrays as doubles,
+        which is clearly not as efficient as it could be, but this is
+        still in the order of 10-20x faster than the existing behaviour.
+
+        This needed us to add support for writing 16bit values to the
+        macroassembler, and also to support double<->unsigned conversion.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::strh):
+        (JSC::ARMv7Assembler::vcvt_floatingPointToUnsigned):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::store16):
+        (JSC::MacroAssemblerARMv7::truncateDoubleToUint32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::store16):
+        (JSC::MacroAssemblerX86Common::truncateDoubleToUint32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movw_rm):
+        (JSC::X86Assembler::cvttsd2siq_rr):
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionFromClassInfo):
+        * bytecode/PredictedType.h:
+        (JSC::isInt8ArrayPrediction):
+        (JSC::isInt16ArrayPrediction):
+        (JSC::isInt32ArrayPrediction):
+        (JSC::isUint8ArrayPrediction):
+        (JSC::isUint16ArrayPrediction):
+        (JSC::isUint32ArrayPrediction):
+        (JSC::isFloat32ArrayPrediction):
+        (JSC::isFloat64ArrayPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateInt8Array):
+        (JSC::DFG::Node::shouldSpeculateInt16Array):
+        (JSC::DFG::Node::shouldSpeculateInt32Array):
+        (JSC::DFG::Node::shouldSpeculateUint8Array):
+        (JSC::DFG::Node::shouldSpeculateUint16Array):
+        (JSC::DFG::Node::shouldSpeculateUint32Array):
+        (JSC::DFG::Node::shouldSpeculateFloat32Array):
+        (JSC::DFG::Node::shouldSpeculateFloat64Array):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSGlobalData.h:
+
+2011-12-01  Benjamin Poulain  <benjamin@webkit.org>
+
+        URLs are encoded in UTF-8, then decoded as if they are Latin1
+        https://bugs.webkit.org/show_bug.cgi?id=71758
+
+        Reviewed by Darin Adler.
+
+        Add the operator == between a String and a Vector of char. The implementation
+        is the same as the comparison of String and char* but adds the length as a
+        parameter for comparing the strings.
+
+        * JavaScriptCore.exp:
+        * wtf/text/StringImpl.h:
+        (WTF::equal):
+        * wtf/text/WTFString.h:
+        (WTF::operator==):
+        (WTF::operator!=):
+
+2011-12-01  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Read fonts from the jhbuild root
+        https://bugs.webkit.org/show_bug.cgi?id=73487
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Read fonts from the jhbuild root instead of from the system. This will ensure
+        that all testers use the same fonts instead of leaving this up to luck.
+
+        * wtf/gobject/GlibUtilities.h: Add Assertions.h which was required for the WebKit2TestRunner.
+
+2011-12-01  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Add a helper function to find the current executable's path
+        https://bugs.webkit.org/show_bug.cgi?id=73473
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add a WTF helper which gets the binary path. This is currently only used
+        in WebKit2.
+
+        * GNUmakefile.list.am: Add the new file to the source list.
+        * wtf/gobject/GlibUtilities.cpp: Added.
+        (getCurrentExecutablePath):
+        * wtf/gobject/GlibUtilities.h: Added.
+
+2011-12-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r101691.
+        http://trac.webkit.org/changeset/101691
+        https://bugs.webkit.org/show_bug.cgi?id=73588
+
+        Tests fail on Chromium bots, early warning system warned
+        committer, please adjust test_expectations in patch (Requested
+        by scheib on #webkit).
+
+        * JavaScriptCore.exp:
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+
+2011-12-01  Filip Pizlo  <fpizlo@apple.com>
+
+        ARMv7 only allows for one-shot patching of compact offsets, while the
+        JIT expects to be able to repatch
+        https://bugs.webkit.org/show_bug.cgi?id=73548
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::setUInt7ForLoad):
+
+2011-11-30  Benjamin Poulain  <benjamin@webkit.org>
+
+        URLs are encoded in UTF-8, then decoded as if they are Latin1
+        https://bugs.webkit.org/show_bug.cgi?id=71758
+
+        Reviewed by Darin Adler.
+
+        Add the operator == between a String and a Vector of char. The implementation
+        is the same as the comparison of String and char* but adds the length as a
+        parameter for comparing the strings.
+
+        * JavaScriptCore.exp:
+        * wtf/text/StringImpl.h:
+        (WTF::equal):
+        * wtf/text/WTFString.h:
+        (WTF::operator==):
+        (WTF::operator!=):
+
+2011-11-30  Dmitry Lomov  <dslomov@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=73503
+        [Chromium][V8] Implement ArrayBuffer transfer in chromium.
+        Portions of this patch come from Luke Zarko.
+
+        Reviewed by David Levin.
+
+        * wtf/ArrayBuffer.cpp:
+        (WTF::ArrayBuffer::transfer): Changed prototype from pointers to RefPtr.
+        * wtf/ArrayBuffer.h:
+        (WTF::ArrayBufferContents::transfer): Changed prototype from pointers to RefPtr.
+        (WTF::ArrayBuffer::isNeutered):
+        * wtf/TypedArrayBase.h:
+        (WTF::TypedArrayBase::neuter):
+
+2011-12-01  Chao-ying Fu  <fu@mips.com>
+
+        MacroAssemblerMIPS does not implement readCallTarget
+        https://bugs.webkit.org/show_bug.cgi?id=73432
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::readCallTarget):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::readCallTarget):
+
+2011-12-01  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Remove wtf/qt/ThreadingQt.cpp from the gyp projects
+        https://bugs.webkit.org/show_bug.cgi?id=73527
+
+        Reviewed by Simon Hausmann.
+
+        wtf/qt/ThreadingQt.cpp was removed in r101477
+
+        * JavaScriptCore.gypi: remove wtf/qt/ThreadingQt.cpp
+
+2011-12-01  Filip Pizlo  <fpizlo@apple.com>
+
+        BitVector isInline check could fail
+        https://bugs.webkit.org/show_bug.cgi?id=70691
+
+        Reviewed by Gavin Barraclough.
+        
+        Switch back to using the high bit as the inline marker, to make
+        all of the bit indexing operations simpler. Computing the size in
+        words and in bytes of a bitvector, using the number of bits as
+        input is error-prone enough; and with the current approach to
+        solving the X86 bug we end up getting it wrong. Making it right
+        seems hard.
+        
+        So instead, to solve the original problem (the high bit may be
+        meaningful on 32-bit systems), the out-of-line storage pointer is
+        right-shifted by 1. Compared to the original BitVector code, this
+        is a much smaller change (just three lines).
+        
+        This solves a bug where the DFG was corrupting its call frame
+        because BitVector lost track of some bits.
+
+        * wtf/BitVector.cpp:
+        (WTF::BitVector::setSlow):
+        (WTF::BitVector::resizeOutOfLine):
+        * wtf/BitVector.h:
+        (WTF::BitVector::quickGet):
+        (WTF::BitVector::quickSet):
+        (WTF::BitVector::quickClear):
+        (WTF::BitVector::makeInlineBits):
+        (WTF::BitVector::isInline):
+        (WTF::BitVector::outOfLineBits):
+
+2011-11-30  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should make it easier to notice node boundaries in disassembly
+        https://bugs.webkit.org/show_bug.cgi?id=73509
+
+        Rubber-stamped by Gavin Barraclough
+        
+        If you set XOR_DEBUG_AID to 1 in DFGCommon.h, a pair of xor's will
+        be emitted at node boundaries, where the immediate being xor'd is the
+        node index.
+
+        * dfg/DFGCommon.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed ArgList iterators.
+
+        Reviewed by Gavin Barraclough.
+        
+        Another step toward reversing the argument order.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct): Switched from iterator to int.
+
+        * runtime/ArgList.h:
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::isEmpty): Removed iterators.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::finishCreation): Switched from iterator to int.
+
+2011-11-30  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        32 bit DFG should handle logicalNot slow case instead of simply bailing out
+        https://bugs.webkit.org/show_bug.cgi?id=73515
+
+        Reviewed by Filip Pizlo.
+
+        This improves Kraken performance by 14%, mainly due to ~3X improvement
+        on imaging-desaturate.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+
+2011-11-30  Max Vujovic  <mvujovic@adobe.com>
+
+        Some date values not handled consistently with IE/Firefox
+        https://bugs.webkit.org/show_bug.cgi?id=14176
+
+        Reviewed by Gavin Barraclough.
+
+        Changed time zone offset parsing behavior to match IE/Firefox/Opera's in
+        implementation dependent cases like "GMT-4".
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+
+2011-11-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        toStringCallback and valueOfCallback do not check the entire prototype chain for convertToType callback
+        https://bugs.webkit.org/show_bug.cgi?id=73368
+
+        Reviewed by Darin Adler.
+
+        We need to search the entire prototype chain for the convertToType callback, rather than just calling whatever
+        happens to be in the first class of the chain, which potentially could be null.
+
+        <rdar://problem/10493218>
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::toStringCallback):
+        (JSC::JSCallbackFunction::valueOfCallback):
+
+2011-11-29  Sam Weinig  <sam@webkit.org>
+
+        Add adoptCF and adoptNS convenience functions to RetainPtr.h
+        https://bugs.webkit.org/show_bug.cgi?id=73399
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/RetainPtr.h:
+        (WTF::adoptCF):
+        (WTF::adoptNS):
+        These adoption functions match the pattern we use in other
+        smart pointer classes.
+
+2011-11-30  Adam Roben  <aroben@apple.com>
+
+        Fix RetainPtr's move assignment operators
+
+        Fixes <http://webkit.org/b/73449> RetainPtr's move assignment operators don't modify the
+        pointer being assigned to
+
+        I didn't write a test for this because we don't have a way of unit testing C++11 code (see
+        <http://webkit.org/b/73448>).
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::operator=): Adopt the passed-in RetainPtr's underlying pointer, not our own
+        pointer.
+
+2011-11-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rolling out incorrect r101481.
+
+        * assembler/MIPSAssembler.h:
+        * assembler/MacroAssemblerMIPS.h:
+
+2011-11-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix compilation with MingW.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeCurrentThreadInternal): MingW doesn't support MSVC exception handling, so for
+        the time being make the thread name setting unimplemented for MingW.
+
+2011-11-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed propective build fix for Qt/Windows part 2 after r101477.
+
+        * wtf/ThreadSpecific.h: Fix the OS(WINDOWS) defines for the friend declaration for ThreadSpecific<T>::Data
+
+2011-11-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed propective build fix for Qt/Windows after r101477.
+
+        * wtf/ThreadSpecific.h: Use OS(WINDOWS) for declaring "destructor", as it's
+        only referenced from within another OS(WINDOWS) section.
+
+2011-11-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed speculative buildfix after r101457.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::readCallTarget):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::readCallTarget):
+
+2011-11-30  Andrew Wason  <rectalogic@rectalogic.com>
+
+        Replace Qt QThread threading back-end with pthread/Win32 threading back-ends
+        https://bugs.webkit.org/show_bug.cgi?id=72155
+
+        Reviewed by Simon Hausmann.
+
+        Use ThreadingPthreads and ThreadingWin instead of ThreadingQt.
+
+        * heap/MachineStackMarker.cpp:
+        * wtf/MainThread.cpp:
+        (WTF::initializeMainThread):
+        * wtf/Platform.h:
+        * wtf/ThreadSpecific.h: Drop QThreadStorage related code.
+        (WTF::::destroy):
+        * wtf/ThreadingPrimitives.h:
+        * wtf/qt/MainThreadQt.cpp: Drop Qt specific isMainThread().
+        (WTF::initializeMainThreadPlatform): Initialize MainThreadInvoker on main thread to avoid infecting secondary thread with QAdoptedThread.
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+        * wtf/qt/ThreadingQt.cpp: Removed.
+        * wtf/wtf.pro:
+
+2011-11-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        MacroAssemblerARM does not implement readCallTarget
+        https://bugs.webkit.org/show_bug.cgi?id=73413
+
+        Based on Filip Pizlo's patch.
+
+        Buildfix. Rubber-stamped by Gabor Loki.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::readCallTarget):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::readCallTarget):
+
+2011-11-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Resetting a put_by_id inline cache should preserve the "isDirect" bit
+        https://bugs.webkit.org/show_bug.cgi?id=73375
+
+        Reviewed by Gavin Barraclough.
+        
+        For the replace case, we can find out if it was direct by looking at the
+        slow call. For the transition case, we explicitly remember if it was
+        direct.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printStructureStubInfo):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::isPutByIdAccess):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCachePutByID):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::resetPatchPutById):
+        (JSC::JIT::isDirectPutById):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::resetPatchPutById):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+
+2011-11-29  Sam Weinig  <sam@webkit.org>
+
+        Remove RetainPtr::releaseRef
+        https://bugs.webkit.org/show_bug.cgi?id=73396
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/RetainPtr.h:
+        Be gone releaseRef! Long live leakRef!
+
+2011-11-29  Sam Weinig  <sam@webkit.org>
+
+        Add move semantics to RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=73393
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::RetainPtr):
+        Add a move constructor and move enabled assignment operators
+        to RetainPtr if the compiler being used supports rvalue
+        references. If the compiler does not support it, we fallback
+        to the copy semantics we have always had.
+
+2011-11-29  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG local CSE may cause incorrect reference counting for a node
+        https://bugs.webkit.org/show_bug.cgi?id=73390
+
+        Reviewed by Filip Pizlo.
+
+        When performing a node substitution, the ref count of the replaced
+        child will be increased, no matter whether the user node is skipped in
+        code generation or not. This will cause the reference count of the
+        replaced child never get the chance to become zero and so the
+        registers occupied by it cannot be reused simply without spilling, if
+        it's used by a "skipped" node.
+        This is a 1% gain on V8 benchmark, tested on IA32 Linux.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::performSubstitution):
+        (JSC::DFG::Propagator::performNodeCSE):
+
+2011-11-29  David Levin  <levin@chromium.org>
+
+        Add a way to revert a variable to its previous value after leaving a scope.
+        https://bugs.webkit.org/show_bug.cgi?id=73371
+
+        Reviewed by Adam Barth.
+
+        In case anyone from Chromium sees this, it is nearly identical to AutoReset
+        but if the same name were used, it causes unnecessary ambiguity.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/TemporarilyChange.h: Added.
+        (WTF::TemporarilyChange::TemporarilyChange):
+        (WTF::TemporarilyChange::~TemporarilyChange):
+
+2011-11-29  Sam Weinig  <sam@webkit.org>
+
+        Add COMPILER_SUPPORTS macro to allow for compiler feature testing
+        https://bugs.webkit.org/show_bug.cgi?id=73386
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Compiler.h:
+        Add COMPILER_SUPPORTS and #defines for C++11 variadic templates and
+        rvalue references for Clang.
+
+2011-11-29  Oliver Hunt  <oliver@apple.com>
+
+        Allow WebCore to describe typed arrays to JSC
+        https://bugs.webkit.org/show_bug.cgi?id=73355
+
+        Reviewed by Gavin Barraclough.
+
+        Allow globaldata to track the structure of typed arrays.
+
+        * runtime/JSGlobalData.h:
+        (JSC::TypedArrayDescriptor::TypedArrayDescriptor):
+
+2011-11-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG debugCall() mechanism only works on X86 and X86-64
+        https://bugs.webkit.org/show_bug.cgi?id=73282
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::debugCall):
+
+2011-11-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG non-X86 ArithDiv does speculation failure after mutating state,
+        without a value recovery
+        https://bugs.webkit.org/show_bug.cgi?id=73286
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fixes for ARM.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::readCallTarget):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::setupArgumentsWithExecState):
+
+2011-11-20  Roland Steiner  <rolandsteiner@chromium.org>
+
+        <style scoped>: add ENABLE(STYLE_SCOPED) flag to WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=72848
+
+        Add ENABLE_STYLE_SCOPED flag.
+
+        Reviewed by Dimitri Glazkov.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-11-28  Jon Lee  <jonlee@apple.com>
+
+        Create skeleton framework for notifications support in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=73253
+        <rdar://problem/10356943>
+
+        * Configurations/FeatureDefines.xcconfig: Split out ENABLE_NOTIFICATIONS based on platform.
+
+2011-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Fix gyp build
+
+        * JavaScriptCore.gypi:
+
+2011-11-28  Filip Pizlo  <fpizlo@apple.com>
+
+        GetById should not always speculate cell
+        https://bugs.webkit.org/show_bug.cgi?id=73181
+
+        Reviewed by Gavin Barraclough.
+        
+        GetById will now speculate cell if the predictions of the base are cell.
+        Otherwise it will do like the old JIT (and like the old non-speculative
+        DFG JIT): if not cell, go straight to slow-path but otherwise don't OSR
+        out. This is a 1% speed-up on SunSpider.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::setupArgumentsWithExecState):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Move typed array implementations into wtf
+        https://bugs.webkit.org/show_bug.cgi?id=73248
+
+        Reviewed by Sam Weinig.
+
+        Move typed array implementation files from WebCore to wtf.  Inline the
+        .cpp files for each of the array views to cut down on unnecessary exports
+        and function call overhead for trivial operations.
+
+        Added files to all the project files.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/ArrayBuffer.cpp: Renamed from Source/WebCore/html/canvas/Float32Array.cpp.
+        (WTF::ArrayBuffer::transfer):
+        (WTF::ArrayBuffer::addView):
+        (WTF::ArrayBuffer::removeView):
+        * wtf/ArrayBuffer.h: Renamed from Source/WebCore/html/canvas/ArrayBuffer.cpp.
+        (WTF::ArrayBufferContents::ArrayBufferContents):
+        (WTF::ArrayBufferContents::data):
+        (WTF::ArrayBufferContents::sizeInBytes):
+        (WTF::ArrayBufferContents::transfer):
+        (WTF::ArrayBuffer::~ArrayBuffer):
+        (WTF::ArrayBuffer::clampValue):
+        (WTF::ArrayBuffer::create):
+        (WTF::ArrayBuffer::ArrayBuffer):
+        (WTF::ArrayBuffer::data):
+        (WTF::ArrayBuffer::byteLength):
+        (WTF::ArrayBuffer::slice):
+        (WTF::ArrayBuffer::sliceImpl):
+        (WTF::ArrayBuffer::clampIndex):
+        (WTF::ArrayBufferContents::tryAllocate):
+        (WTF::ArrayBufferContents::~ArrayBufferContents):
+        * wtf/ArrayBufferView.cpp: Copied from Source/WebCore/bindings/js/JSArrayBufferCustom.cpp.
+        (WTF::ArrayBufferView::ArrayBufferView):
+        (WTF::ArrayBufferView::~ArrayBufferView):
+        (WTF::ArrayBufferView::neuter):
+        * wtf/ArrayBufferView.h: Renamed from Source/WebCore/html/canvas/ArrayBufferView.h.
+        (WTF::ArrayBufferView::isByteArray):
+        (WTF::ArrayBufferView::isUnsignedByteArray):
+        (WTF::ArrayBufferView::isShortArray):
+        (WTF::ArrayBufferView::isUnsignedShortArray):
+        (WTF::ArrayBufferView::isIntArray):
+        (WTF::ArrayBufferView::isUnsignedIntArray):
+        (WTF::ArrayBufferView::isFloatArray):
+        (WTF::ArrayBufferView::isDoubleArray):
+        (WTF::ArrayBufferView::isDataView):
+        (WTF::ArrayBufferView::buffer):
+        (WTF::ArrayBufferView::baseAddress):
+        (WTF::ArrayBufferView::byteOffset):
+        (WTF::ArrayBufferView::verifySubRange):
+        (WTF::ArrayBufferView::clampOffsetAndNumElements):
+        (WTF::ArrayBufferView::setImpl):
+        (WTF::ArrayBufferView::setRangeImpl):
+        (WTF::ArrayBufferView::zeroRangeImpl):
+        (WTF::ArrayBufferView::calculateOffsetAndLength):
+        * wtf/CMakeLists.txt:
+        * wtf/Float32Array.h: Renamed from Source/WebCore/html/canvas/Float32Array.h.
+        (WTF::Float32Array::set):
+        (WTF::Float32Array::item):
+        (WTF::Float32Array::isFloatArray):
+        (WTF::Float32Array::create):
+        (WTF::Float32Array::Float32Array):
+        (WTF::Float32Array::subarray):
+        * wtf/Float64Array.h: Renamed from Source/WebCore/html/canvas/Float64Array.h.
+        (WTF::Float64Array::set):
+        (WTF::Float64Array::item):
+        (WTF::Float64Array::isDoubleArray):
+        (WTF::Float64Array::create):
+        (WTF::Float64Array::Float64Array):
+        (WTF::Float64Array::subarray):
+        * wtf/Int16Array.h: Renamed from Source/WebCore/html/canvas/Int16Array.cpp.
+        (WTF::Int16Array::set):
+        (WTF::Int16Array::isShortArray):
+        (WTF::Int16Array::create):
+        (WTF::Int16Array::Int16Array):
+        (WTF::Int16Array::subarray):
+        * wtf/Int32Array.h: Renamed from Source/WebCore/html/canvas/Int32Array.cpp.
+        (WTF::Int32Array::set):
+        (WTF::Int32Array::isIntArray):
+        (WTF::Int32Array::create):
+        (WTF::Int32Array::Int32Array):
+        (WTF::Int32Array::subarray):
+        * wtf/Int8Array.h: Renamed from Source/WebCore/html/canvas/Int8Array.cpp.
+        (WTF::Int8Array::set):
+        (WTF::Int8Array::isByteArray):
+        (WTF::Int8Array::create):
+        (WTF::Int8Array::Int8Array):
+        (WTF::Int8Array::subarray):
+        * wtf/IntegralTypedArrayBase.h: Renamed from Source/WebCore/html/canvas/IntegralTypedArrayBase.h.
+        (WTF::IntegralTypedArrayBase::set):
+        (WTF::IntegralTypedArrayBase::item):
+        (WTF::IntegralTypedArrayBase::IntegralTypedArrayBase):
+        * wtf/TypedArrayBase.h: Renamed from Source/WebCore/html/canvas/TypedArrayBase.h.
+        (WTF::TypedArrayBase::data):
+        (WTF::TypedArrayBase::set):
+        (WTF::TypedArrayBase::setRange):
+        (WTF::TypedArrayBase::zeroRange):
+        (WTF::TypedArrayBase::length):
+        (WTF::TypedArrayBase::byteLength):
+        (WTF::TypedArrayBase::TypedArrayBase):
+        (WTF::TypedArrayBase::create):
+        (WTF::TypedArrayBase::subarrayImpl):
+        * wtf/Uint16Array.h: Renamed from Source/WebCore/html/canvas/Uint16Array.cpp.
+        (WTF::Uint16Array::set):
+        (WTF::Uint16Array::isUnsignedShortArray):
+        (WTF::Uint16Array::create):
+        (WTF::Uint16Array::Uint16Array):
+        (WTF::Uint16Array::subarray):
+        * wtf/Uint32Array.h: Renamed from Source/WebCore/html/canvas/Uint32Array.cpp.
+        (WTF::Uint32Array::set):
+        (WTF::Uint32Array::isUnsignedIntArray):
+        (WTF::Uint32Array::create):
+        (WTF::Uint32Array::Uint32Array):
+        (WTF::Uint32Array::subarray):
+        * wtf/Uint8Array.h: Renamed from Source/WebCore/html/canvas/Uint8Array.h.
+        (WTF::Uint8Array::set):
+        (WTF::Uint8Array::isUnsignedByteArray):
+        (WTF::Uint8Array::create):
+        (WTF::Uint8Array::Uint8Array):
+        (WTF::Uint8Array::subarray):
+        * wtf/wtf.pro:
+
+2011-11-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't try to optimize huge code blocks
+        https://bugs.webkit.org/show_bug.cgi?id=73187
+
+        Reviewed by Oliver Hunt.
+        
+        This unifies the heuristics used for deciding if a code block is too big
+        to optimize, and sets this heuristic to 1000, which is intuitively better
+        than numeric_limits<unsigned>::max(). It also results in what looks like
+        a speed-up on both SunSpider and V8 (in Tools/Scripts/bencher).
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h:
+
+2011-11-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Either remove the GetMethod node from the DFG backend, or find a use for it
+        https://bugs.webkit.org/show_bug.cgi?id=73178
+
+        Reviewed by Gavin Barraclough.
+        
+        More testing seemed to imply that the GetMethod code was indeed not profitable
+        in any major test. So, it's probably best to just remove it.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::MethodCallLinkInfo::reset):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGRepatch.cpp:
+        * dfg/DFGRepatch.h:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-28  Michael Saboff  <msaboff@apple.com>
+
+        Change set 101187 from bug 73154 removed already lower case optimization
+        https://bugs.webkit.org/show_bug.cgi?id=73174
+
+        Added back the "string is already lower case" optimization.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToLowerCase):
+
+2011-11-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed prospective build fix. Touch the file to trigger correct
+        rebuild on the Qt mips/sh4/sl bot.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2011-11-28  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Remove cruft from project file
+
+        Reviewed by Simon Hausmann.
+
+        * Target.pri:
+
+2011-11-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] WTF should be built as separate static library
+        https://bugs.webkit.org/show_bug.cgi?id=73201
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Target.pri: Don't claim to build WTF, as that would cause
+        the debug-with-shlibs build to not link in wtf.
+        * jsc.pro: Require wtf.
+        * wtf/wtf.pri: Removed.
+        * wtf/wtf.pro: Added. Pro file to build wtf statically.
+
+2011-11-28  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] JavaScriptCore generated sources should build in the DerivedSources directory
+        https://bugs.webkit.org/show_bug.cgi?id=73197
+
+        Reviewed by Philippe Normand.
+
+        Build all JavaScriptCore generated sources in DerivedSources.
+
+        * GNUmakefile.am: Update generation rules.
+        * GNUmakefile.list.am: Update source lists.
+
+2011-11-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not emit GetMethod node
+        https://bugs.webkit.org/show_bug.cgi?id=73175
+
+        Reviewed by Gavin Barraclough.
+        
+        Replaces all instances of the GetMethod node with GetById. This appears to
+        be a slight win on V8. This patch leaves GetMethod support in the code-base,
+        making this decision easy to reverse, for now.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2011-11-26  Hajime Morrita  <morrita@chromium.org>
+
+        Needs WTF_INLINE and JS_INLINE
+        https://bugs.webkit.org/show_bug.cgi?id=72853
+
+        Reviewed by Kevin Ollivier.
+
+        Added WTF_HIDDEN, WTF_INLINE and JS_INLINE which
+        indirect __attribute__((visibility("hidden"))
+
+        * config.h:
+        * wtf/ExportMacros.h:
+
+2011-11-25  Michael Saboff  <msaboff@apple.com>
+
+        String.prototype.toLower should be optimized for 8 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=73154
+
+        Changed stringProtoFuncToLowerCase to use StringImpl::lower() which has
+        been optimized for 8 bit strings.
+
+        This is worth ~7% to sunspider string.tagcloud.
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToLowerCase):
+
+2011-11-25  Michael Saboff  <msaboff@apple.com>
+
+        Array.toString always uses StringImpl::characters()
+        https://bugs.webkit.org/show_bug.cgi?id=72969
+
+        If all component strings are 8 bit, create an 8 bit result string for toString().
+
+        This appears to be performance neutral to sunspider and v8.
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
+2011-11-24  Michael Saboff  <msaboff@apple.com>
+
+        UString methods are not character size aware
+        https://bugs.webkit.org/show_bug.cgi?id=72975
+
+        Changed the UString number constructors to build 8 bit strings.
+        Modified the other methods to check string bitness and process
+        with 8 bits wherre appropriate.
+
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        (JSC::operator==):
+        (JSC::operator<):
+        (JSC::UString::ascii):
+
+2011-11-24  Michael Saboff  <msaboff@apple.com>
+
+        JavaScript string to number conversion functions use characters()
+        https://bugs.webkit.org/show_bug.cgi?id=72974
+
+        Change the various JS to number routines to process strings
+        using characters8() or characters16() as appropriate.
+        Implemented using static template methods.
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::isInfinity):
+        (JSC::jsHexIntegerLiteral):
+        (JSC::jsStrDecimalLiteral):
+        (JSC::toDouble):
+        (JSC::jsToNumber):
+
+2011-11-24  Michael Saboff  <msaboff@apple.com>
+
+        Empty JSStrings are created as 16 bit
+        https://bugs.webkit.org/show_bug.cgi?id=72968
+
+        Clear m_is8Bit flag for empty strings.
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::finishCreation):
+
+2011-11-24  Michael Saboff  <msaboff@apple.com>
+
+        Tune JSStringBuilder for 8 bit Strings
+        https://bugs.webkit.org/show_bug.cgi?id=72683
+
+        Changed JSStringBuilder to use 8 bit buffers until 16 bit data is added.
+        When 16 bit data is to be added, the 8 bit buffer is converted to 16 bit
+        and building continues with a 16 bit buffer.
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::JSStringBuilder):
+        (JSC::JSStringBuilder::append):
+        (JSC::JSStringBuilder::upConvert):
+        (JSC::JSStringBuilder::build):
+        * runtime/UString.h:
+        (JSC::UString::adopt):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::adopt):
+
+2011-11-24  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt]WK2][Mac] Use Mac port's IPC implementation instead of Unix sockets
+        https://bugs.webkit.org/show_bug.cgi?id=72495
+
+        Update defines to not use Unix Domain Sockets for platform Qt on Mac.
+        This enables Qt to reuse existing code for mach ports and Grand
+        Central Dispatch based IPC.
+
+        Reviewed by Simon Hausmann.
+
+        * wtf/Platform.h:
+
+2011-11-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] REGRESSION(r101131): WTF::scheduleDispatchFunctionsOnMainThread() doesn't work reliably
+
+        Reviewed by Andreas Kling.
+
+        We must make sure that the MainThreadInvoker object lives in the gui thread. There are a few
+        ways of doing that and this fix seems like the least intrusive one by simply pushing the
+        invoker to the gui thread if it's not there already.
+
+        * wtf/qt/MainThreadQt.cpp:
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2011-11-24  Patrick Gansterer  <paroga@webkit.org>
+
+        [Qt] Use QEvent for dispatchFunctionsFromMainThread()
+        https://bugs.webkit.org/show_bug.cgi?id=72704
+
+        Reviewed by Simon Hausmann.
+
+        Replace QMetaObject::invokeMethod with QCoreApplication::postEvent.
+        This is the same as what invokeMethod does internally, but reduces
+        the dependency on some internal QThread stuff.
+
+        * wtf/qt/MainThreadQt.cpp:
+        (WTF::MainThreadInvoker::MainThreadInvoker):
+        (WTF::MainThreadInvoker::event):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2011-11-23  George Staikos  <staikos@webkit.org>
+
+        Remove BlackBerry OS support from RandomNumberSeed, making QNX=UNIX.
+        https://bugs.webkit.org/show_bug.cgi?id=73028
+
+        Reviewed by Daniel Bates.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2011-11-23  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Add flags/precision arguments to String::number(double) to allow fine-grained control over the result string
+        https://bugs.webkit.org/show_bug.cgi?id=72793
+
+        Reviewed by Zoltan Herczeg.
+
+        This new code will be used in follow-up patches to replace the String::format("%.2f") usage in
+        platform/text/TextStream.cpp, and String::format("%.6lg") usage in svg/SVGPathStringBuilder.cpp.
+
+        The String::number(double) currently calls String::format("%.6lg") in trunk. In order to replace
+        this by a variant that properly rounds to six significant figures, JSC code could be refactored.
+        JSCs Number.toPrecision/toFixed uses wtf/dtoa/double-conversion which provides all features we need,
+        except truncating trailing zeros, needed to mimic the "g" format, which is either f or e but with
+        trailing zeros removed, producing shorter results. Changed the default signature to:
+
+        "static String number(double, unsigned = ShouldRoundSignificantFigures | ShouldTruncateTrailingZeros, unsigned precision = 6);".
+
+        In WebCore we can now replace String::format() calls like this:
+        String::format("%.2f", f) -> String::number(f, ShouldRoundDecimalPlaces, 2)
+        String::format("%.6lg", f) -> String::number(f)
+
+        The default parameters for precison & flags exactly match the format of the string produced now, except that the result
+        is rounded according to the rounding mode / formatting mode and precision. This paves the way towards reliable results
+        in the d="" attribute dumps of SVG paths  across platforms. The dtoa rounding code enforces a unique zero, resolving
+        all 0.0 vs. -0.0 issues currently seen on Windows, and some Gtk/Qt bots.
+
+        This patch needs a rebaseline of svg/dom/length-list-parser.html as we don't perfecly mimic the String::format() "lg" mode
+        result for exponentials, we used to return eg. "e-7" and now return "e-07" - the trailing zero truncation hasn't been
+        implemented for exponentials, as this really affects only this test and thus wasn't worth the trouble - in contrary the
+        trailing zero truncation is needed for thousands of other results in "f" notation, and thus needed to match the DRT results.
+
+        Here's a performance comparision using a JSC release build and some arbitary numbers:
+        Converting 123.456 using old approach took 95.527100ms. avg 0.000955ms/call.
+        Converting 123.456 using new approach took 28.126953ms. avg 0.000281ms/call.
+
+        Converting 123 using old approach took 85.411133ms. avg 0.000854ms/call.
+        Converting 123 using new approach took 24.190186ms. avg 0.000242ms/call.
+
+        Converting 0.1 using old approach took 92.622803ms. avg 0.000926ms/call.
+        Converting 0.1 using new approach took 23.317871ms. avg 0.000233ms/call.
+
+        Converting 1/i using old approach took 106.893066ms. avg 0.001069ms/call.
+        Converting 1/i using new approach took 27.164062ms. avg 0.000272ms/call.
+
+        For all numbers I've tested in RoundingSignificantFigures mode and 6 digit precision the speedup was at least 250%.
+
+        * JavaScriptCore.exp: Change String::number(double) signature.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Ditto.
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToFixed): Refactor this into numberToFixedPrecisionString(), move to wtf/dtoa.cpp.
+        (JSC::numberProtoFuncToPrecision): Ditto, refactor this into numberToFixedWidthString.
+        * wtf/dtoa.cpp: Moved fixedWidth/Precision helpers into dtoa, extend numberToFixedPrecisionString(). Add a mode which allows to truncate trailing zeros/decimal point.
+                        to make it possible to use them to generate strings that match the output from String::format("%6.lg"), while using our dtoas rounding facilities.
+        * wtf/dtoa.h:
+        * wtf/dtoa/utils.h: Expose new helper method, which allows us to truncate the result, before generating the output const char*.
+        (WTF::double_conversion::StringBuilder::SetPosition):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::number): Remove String::format("%6.lg") usage! Switch to rounding to six significant figures, while matching the output of String::format.
+        * wtf/text/WTFString.h:
+
+2011-11-23  Hajime Morrita  <morrita@chromium.org>
+
+        WTF::String has extra WTF_EXPORT_PRIVATE
+        https://bugs.webkit.org/show_bug.cgi?id=72858
+
+        Reviewed by Kevin Ollivier.
+
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+
+2011-11-23  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Move the top-level logic to the top-level directory.
+        https://bugs.webkit.org/show_bug.cgi?id=72685
+
+        Reviewed by Brent Fulgham.
+
+        * CMakeLists.txt: Point to the right Source/ directory.
+        * wtf/CMakeLists.txt: Ditto.
+
+2011-11-22  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Strength reduction for Mul and Mod operations for known constants in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=72878
+
+        Reviewed by Filip Pizlo.
+
+        Also the code should be commonly shared by both 32_64 and 64.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::nodeMayOverflow):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::fmodAsDFGOperation):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::isPowerOfTwo):
+        (JSC::DFG::logTwo):
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-22  Daniel Bates  <dbates@rim.com>
+
+        Add WTF infrastructure for the BlackBerry port
+        https://bugs.webkit.org/show_bug.cgi?id=72970
+
+        Reviewed by Antonio Gomes.
+
+        * wtf/Assertions.cpp: Added BlackBerry-specific logging directive.
+        * wtf/MathExtras.h:
+        (abs): Added; stdlib doesn't contain abs() on QNX.
+        * wtf/Platform.h: Define WTF_PLATFORM_BLACKBERRY and enable some platform features.
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator): For the BlackBerry port, we initialize
+        the bad pseudo random number generator using time(3) before initializing the
+        Mersenne Twister random number generator.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::createThreadInternal): Added.
+        * wtf/blackberry: Added.
+        * wtf/blackberry/MainThreadBlackBerry.cpp: Added.
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+        * wtf/text/WTFString.h: Added constructor and conversion operator for
+        BlackBerry WebString string object.
+
+2011-11-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r100988.
+        http://trac.webkit.org/changeset/100988
+        https://bugs.webkit.org/show_bug.cgi?id=72941
+
+        "Broke pixel tests on Chromium-Linux" (Requested by kbalazs on
+        #webkit).
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/ParallelJobs.h:
+        * wtf/ParallelJobsGeneric.cpp:
+        * wtf/ParallelJobsGeneric.h:
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::execute):
+        * wtf/Platform.h:
+
+2011-11-21  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Enable ParallelJobs by default
+        https://bugs.webkit.org/show_bug.cgi?id=70032
+
+        Reviewed by Zoltan Herczeg.
+
+        According to measurements on Mac and Linux it is a
+        considerable speedup for SVG on multicore.
+
+        Remove the ENABLE(PARALLEL_JOBS) guard.
+        Fix build on Windows and Chromium.
+
+        * JavaScriptCore.gypi:  Add the files to the build. It was
+        missing for the gyp build system.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Export symbols.
+        * wtf/ParallelJobs.h:
+        * wtf/ParallelJobsGeneric.cpp:
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::execute):
+        Deinline these to avoid exporting a lot of symbols.
+        These are non-trivial and called only once on a given object
+        so it doesn't seems to be worthwile to inline them.
+        Additionally fix a signed-unsigned comparison in the constructor.
+        * wtf/ParallelJobsGeneric.h:
+        * wtf/Platform.h:
+
+2011-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have richer debug output for CFA and phi processing
+        https://bugs.webkit.org/show_bug.cgi?id=72922
+
+        Reviewed by Gavin Barraclough.
+        
+        In the default verbose mode, we now print information about variable
+        state at the bottom of basic blocks in addition to the top, and we
+        also print local variable linking. In the verbose propagation mode,
+        the state of phi processing is dumped more richly and CFA merging (the
+        most subtle part of CFA) is traced as well.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::dump):
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::NodeIndexTraits::dump):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::dumpChildren):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperands.h:
+        (JSC::DFG::OperandValueTraits::dump):
+        (JSC::DFG::dumpOperands):
+
+2011-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Showing the data overlay in OpenStreetMap doesn't work, zooming partially broken
+        https://bugs.webkit.org/show_bug.cgi?id=71505
+
+        Reviewed by Gavin Barraclough.
+        
+        It turns out that we were corrupting phi nodes in case of overflow. The bug is
+        really obvious, but producing a test case that causes the badness is hard. Even
+        when the phi nodes do get corrupt, there's more that has to happen before it
+        causes incorrect execution - and I wasn't able to reproduce in any kind of
+        sensible reduced case.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+
+2011-11-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Speed up debug builds.
+        https://bugs.webkit.org/show_bug.cgi?id=72882
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Target.pri: Make BUILDING_JavaScriptCore available earlier, so it can be
+        used by the build system.
+
+2011-11-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r100913.
+        http://trac.webkit.org/changeset/100913
+        https://bugs.webkit.org/show_bug.cgi?id=72885
+
+        "Break Windows build" (Requested by kbalazs on #webkit).
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/ParallelJobs.h:
+        * wtf/ParallelJobsGeneric.cpp:
+        * wtf/ParallelJobsGeneric.h:
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::execute):
+        * wtf/Platform.h:
+
+2011-11-21  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Enable ParallelJobs by default
+        https://bugs.webkit.org/show_bug.cgi?id=70032
+
+        Reviewed by Zoltan Herczeg.
+
+        According to measurements on Mac and Linux it is a
+        considerable speedup for SVG on multicore.
+
+        Remove the ENABLE(PARALLEL_JOBS) guard.
+        Fix build on Windows and Chromium.
+
+        * JavaScriptCore.gypi:  Add the files to the build. It was
+        missing for the gyp build system.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Export symbols.
+        * wtf/ParallelJobs.h:
+        * wtf/ParallelJobsGeneric.cpp:
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::execute):
+        Deinline these to avoid exporting a lot of symbols.
+        These are non-trivial and called only once on a given object
+        so it doesn't seems to be worthwile to inline them.
+        Additionally fix a signed-unsigned comparison in the constructor.
+        * wtf/ParallelJobsGeneric.h:
+        * wtf/Platform.h:
+
+2011-11-21  Andy Wingo  <wingo@igalia.com>
+
+        Add .dir-locals.el file for better Emacs defaults
+        https://bugs.webkit.org/show_bug.cgi?id=72483
+
+        Reviewed by Xan Lopez.
+
+        * .dir-locals.el: Set appropriate directory-local variables for Emacs.
+
+2011-11-21  Filip Pizlo  <fpizlo@apple.com>
+        
+        Another attempt at a build fix.
+
+        * dfg/DFGRepatch.h:
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+
+2011-11-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed interpreter build fix.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * dfg/DFGRepatch.h:
+
+2011-11-20  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Improve modulo operation on 32bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=72501
+
+        Reviewed by Filip Pizlo.
+
+        Extend softModulo to support X86 and MIPS in baseline JIT.
+        Apply the same optimization to 32bit DFG JIT.
+        1% gain on Kraken, tested on Linux Core i7 Nehalem 32bit.
+
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::softModulo):
+        * wtf/Platform.h:
+
+2011-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Inline caches that refer to otherwise dead objects should be cleared
+        https://bugs.webkit.org/show_bug.cgi?id=72311
+
+        Reviewed by Geoff Garen.
+
+        DFG code blocks now participate in the weak reference harvester fixpoint
+        so that they only consider themselves to be live if either they are
+        currently executing, or their owner is live and all of their weak references
+        are live. If not, the relevant code blocks are jettisoned.
+
+        Inline caches in both the old JIT and the DFG are now cleared if any of
+        their references are not marked at the end of a GC.
+
+        This is performance-neutral on SunSpider, V8, and Kraken. With the clear-
+        all-code-on-GC policy that we currently have, it shows a slight reduction
+        in memory usage. If we turn that policy off, it's pretty easy to come up
+        with an example program that will cause ToT to experience linear heap
+        growth, while with this patch, the heap stays small and remains at a
+        constant size.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::readCallTarget):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::readCallTarget):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::readCallTarget):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::readCallTarget):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::performTracingFixpointIteration):
+        (JSC::CodeBlock::visitWeakReferences):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC::MethodCallLinkInfo::reset):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::reoptimize):
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::visitWeak):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::isGetByIdAccess):
+        (JSC::isPutByIdAccess):
+        (JSC::StructureStubInfo::reset):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchByIdSelfAccess):
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+        * dfg/DFGRepatch.h:
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::resetPatchGetById):
+        (JSC::JIT::resetPatchPutById):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::resetPatchGetById):
+        (JSC::JIT::resetPatchPutById):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrierBase::clearToMaxUnsigned):
+
+2011-11-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Showing the data overlay in OpenStreetMap doesn't work, zooming partially broken
+        https://bugs.webkit.org/show_bug.cgi?id=71505
+
+        Reviewed by Oliver Hunt.
+        
+        The bytecode generator was assuming that call_varargs never reuses the base register
+        (i.e. the function being called) for the result. This is no longer true.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2011-11-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG 32_64 should directly store double virtual registers on SetLocal
+        https://bugs.webkit.org/show_bug.cgi?id=72845
+
+        Reviewed by Oliver Hunt.
+        
+        2% win on Kraken.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-20  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Remove DFG::JITCodeGenerator from the gyp projects
+        https://bugs.webkit.org/show_bug.cgi?id=72842
+
+        Reviewed by Filip Pizlo.
+
+        dfg/DFGJITCodeGenerator.{h,cpp} were removed in r100244
+
+        * JavaScriptCore.gypi: remove dfg/DFGJITCodeGenerator.{h,cpp}
+
+2011-11-18  Daniel Bates  <dbates@rim.com>
+
+        Add CMake build infrastructure for the BlackBerry port
+        https://bugs.webkit.org/show_bug.cgi?id=72768
+
+        Reviewed by Antonio Gomes.
+
+        * PlatformBlackBerry.cmake: Added.
+        * shell/PlatformBlackBerry.cmake: Added.
+        * wtf/PlatformBlackBerry.cmake: Added.
+
+2011-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT fails speculation on InstanceOf if the base is not an object
+        https://bugs.webkit.org/show_bug.cgi?id=72709
+
+        Reviewed by Geoff Garen.
+        
+        InstanceOf already leverages the fact that we only allow the default
+        hasInstance implementation. So, if the base is predicted to possibly
+        be not an object and the CFA has not yet proven otherwise, InstanceOf
+        will abstain from speculating cell and instead return false if the
+        base is not a cell.
+        
+        This appears to be a 1% speed-up on V8 on the V8 harness. 3-4% or so
+        speed-up in earley-boyer. Neutral according to bencher on SunSpider,
+        V8, and Kraken. In 32-bit, it's a 0.5% win on SunSpider and a 1.9%
+        win on V8 even on my harness, due to a 12.5% win on earley-boyer.
+        
+        I also took this opportunity to make the code for InstanceOf common
+        between the two JITs. This was partially successful, in that the
+        "common code" has a bunch of #if's, but overall it seems like a code
+        size reduction.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Forgot to completely de-virtualize isDynamicScope
+        https://bugs.webkit.org/show_bug.cgi?id=72763
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSActivation.h: Removed virtual keyword.
+
+2011-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Crash in JSC::DFG::OSRExitCompiler::compileExit(JSC::DFG::OSRExit const&, JSC::DFG::SpeculationRecovery*)
+        https://bugs.webkit.org/show_bug.cgi?id=72292
+
+        Reviewed by Darin Adler.
+        
+        Fix this for 32_64.
+
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2011-11-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize ExecutableBase::intrinsic
+        https://bugs.webkit.org/show_bug.cgi?id=72548
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::intrinsic): Dynamic cast to NativeExecutable. If successful, call intrinsic, otherwise return default value. 
+        * runtime/Executable.h:
+        * runtime/JSCell.h:
+        (JSC::jsDynamicCast): Add jsDynamicCast that duplicates the functionality of dynamic_cast in C++ but uses ClassInfo
+        rather than requiring C++ RTTI.
+
+2011-11-18  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Remove duplicate dtoa files from CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=72711
+
+        Reviewed by Brent Fulgham.
+
+        * wtf/CMakeLists.txt:
+
+2011-11-17  Michael Saboff  <msaboff@apple.com>
+
+        [Qt] REGRESSION(r100510): Enable 8 Bit Strings in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=72602
+
+        Fixed StringImpl::foldCase by adding return in the case we need to handle
+        folding of 8 bit strings with Latin-1 characters.
+
+        Fixed case where StringImpl::replace was using a char temp instead of an
+        LChar temp.
+
+        Because of the second change, I changed other uses of char or
+        unsigned char to LChar.
+
+        Reviewed by Zoltan Herczeg.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::upper):
+        (WTF::StringImpl::foldCase):
+        (WTF::equal):
+        (WTF::equalIgnoringCase):
+        (WTF::StringImpl::replace):
+
+2011-11-17  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Move FAST_MALLOC specific lines from Platform*.cmake to CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=72644
+
+        Reviewed by Brent Fulgham.
+
+        All ports need to do the same determination about fast malloc. Move the CMake code from
+        platform specific files into the generic one, so that additional ports can reuse it.
+
+        * wtf/CMakeLists.txt:
+        * wtf/PlatformEfl.cmake:
+        * wtf/PlatformWinCE.cmake:
+
+2011-11-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add finalizer to JSActivation
+        https://bugs.webkit.org/show_bug.cgi?id=72575
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::finishCreation): Attach finalize function to objects during creation.
+        (JSC::JSActivation::finalize):
+        * runtime/JSActivation.h: Replaced virtual destructor with static finalize function.
+
+2011-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Code block jettisoning should be part of the GC's transitive closure
+        https://bugs.webkit.org/show_bug.cgi?id=72467
+
+        Reviewed by Geoff Garen.
+        
+        Replaced JettisonedCodeBlocks with DFGCodeBlocks. The latter knows about all
+        DFG code blocks (i.e. those that may be jettisoned, and may have inlined weak
+        references) and helps track what state each of those code blocks is in during
+        GC. The state consists of two flags; mayBeExecuting, which tells if the code block
+        is live from call frames; and isJettisoned, which tells if the code block is
+        not owned by any executable and thus should be deleted as soon as it is not
+        mayBeExecuting.
+        
+        - Not executing, Not jettisoned: The code block may or may not be reachable from
+          any executables, but it is owned by an executable, and hence should be
+          kept alive if its executable is live and if all of its weak references are
+          live. Otherwise it should be deleted during the current GC cycle, and its
+          outgoing references should not be scanned.
+          
+        - Not executing but jettisoned: The code block should be deleted as soon as
+          possible and none of its outgoing references should be scanned.
+          
+        - Executing but not jettisoned: The code block should be kept alive during this
+          GC cycle, and all of its outgoing references (including the weak ones)
+          should be scanned and marked strongly. The mayBeExecuting bit will be cleared at
+          the end of the GC cycle.
+          
+        - Executing and jettisoned: The code block should be kept alive during this
+          GC cycle, and all of its outgoing references (including the weak ones)
+          should be scanned and marked strongly. However, on the next GC cycle, it
+          will have its mayBeExecuting bit cleared and hence it will become a candidate
+          for immediate deletion provided it is not executing again.
+
+        This is performance-neutral.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::DFGData::DFGData):
+        (JSC::DFGCodeBlocks::mark):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::add):
+        * heap/ConservativeRoots.h:
+        * heap/DFGCodeBlocks.cpp: Added.
+        (JSC::DFGCodeBlocks::DFGCodeBlocks):
+        (JSC::DFGCodeBlocks::~DFGCodeBlocks):
+        (JSC::DFGCodeBlocks::jettison):
+        (JSC::DFGCodeBlocks::clearMarks):
+        (JSC::DFGCodeBlocks::deleteUnmarkedJettisonedCodeBlocks):
+        (JSC::DFGCodeBlocks::traceMarkedCodeBlocks):
+        * heap/DFGCodeBlocks.h: Added.
+        * heap/Heap.cpp:
+        (JSC::Heap::jettisonDFGCodeBlock):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/JettisonedCodeBlocks.cpp: Removed.
+        * heap/JettisonedCodeBlocks.h: Removed.
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h:
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+
+2011-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for 32-bit.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Some CachedCall cleanup, in preparation for reversing argument order.
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitWeakReferences): A build fix for the interpreter,
+        so I can test it.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall): Renamed argCount to argumentCount because
+        we are not that desperate for character saving.
+
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument): Adopted new 0-based argument indexing for
+        CallFrameClosure.
+
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setThis):
+        (JSC::CallFrameClosure::setArgument):
+        (JSC::CallFrameClosure::resetCallFrame): Provide 0-based argument indexing,
+        with an explicit setter for 'this', since that's how most clients think.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h: Change argCount to argumentCountIncludingThis,
+        for clarity.
+
+2011-11-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize ScriptExecutable::unlinkCalls
+        https://bugs.webkit.org/show_bug.cgi?id=72546
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::~FunctionExecutable): Added an empty explicit virtual destructor to prevent a very odd compilation error
+        due to the fact that the compiler was trying to generate the implicit inline destructor in every translation unit, some of which 
+        didn't have complete type information on the things that needed to be destructed in the implicit destructor.
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::createStructure): Used new type value from JSType
+        (JSC::ProgramExecutable::createStructure): Ditto
+        (JSC::FunctionExecutable::createStructure): Ditto
+        (JSC::ScriptExecutable::unlinkCalls): Condition upon the type value, cast and call the corresponding unlinkCalls implementation.
+        * runtime/JSType.h: Added new values for EvalExecutable, ProgramExecutable, and FunctionExecutable.  Remove explicit numbers, since 
+        that just adds noise to patches and they currently have no significance.
+
+2011-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC::CodeBlock should know which references generated by the DFG are weak
+        https://bugs.webkit.org/show_bug.cgi?id=72563
+
+        Reviewed by Geoff Garen.
+        
+        CodeBlock::m_dfgData now tracks weak references and weak reference transitions
+        (like ephemerons) generated by the DFG. The DFG makes sure to notify the
+        CodeBlock of all uses of weak references and weak reference transitions.
+        CodeBlock currently marks them strongly, since the weak marking logic is not
+        in place, yet.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::stronglyVisitWeakReferences):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::appendWeakReference):
+        (JSC::CodeBlock::shrinkWeakReferencesToFit):
+        (JSC::CodeBlock::appendWeakReferenceTransition):
+        (JSC::CodeBlock::shrinkWeakReferenceTransitionsToFit):
+        (JSC::CodeBlock::WeakReferenceTransition::WeakReferenceTransition):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::codeOriginOwner):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addWeakReference):
+        (JSC::DFG::JITCompiler::addWeakReferenceTransition):
+        (JSC::DFG::JITCompiler::branchWeakPtr):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-16  Michael Saboff  <msaboff@apple.com>
+
+        LayoutTests for Debug Builds Crashes in JavaScriptCore/yarr/YarrInterpreter.cpp(185)
+        https://bugs.webkit.org/show_bug.cgi?id=72561
+
+        Removed #if USE(JSC) and therefore the ASSERT_NOT_REACHED().
+        Simplified the code in the process.
+
+        Reviewed by James Robinson.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::CharAccess::CharAccess):
+        (JSC::Yarr::Interpreter::CharAccess::~CharAccess):
+
+2011-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Interpreter build fixes.
+
+        * bytecode/CodeBlock.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2011-11-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r100363.
+
+        * bytecode/CodeBlock.h:
+
+2011-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in r100375 and r100385 with 32-bit build fixed.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        * runtime/ArgList.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::finishCreation):
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructArray):
+
+2011-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG global variable CSE mishandles the cross-global-object inlining corner case
+        https://bugs.webkit.org/show_bug.cgi?id=72542
+
+        Reviewed by Geoff Garen.
+        
+        Moved code to get the global object for a code origin into CodeBlock, so it is
+        more broadly accessible. Fixed CSE to compare both the variable number, and the
+        global object, before deciding to perform elimination.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalObjectFor):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::globalObjectFor):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::globalVarLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+
+2011-11-16  Michael Saboff  <msaboff@apple.com>
+
+        Enable 8 Bit Strings in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=71337
+
+        This patch turns on 8 bit strings in StringImpl and enables
+        their use in JavaScriptCore. Some of the changes are to
+        turn on code that had been staged (Lexer.cpp, Identifier.cpp,
+        SmallStrings.cpp and some of StringImpl.{h,cpp}).
+        Other changes are minor fixes to make 8 bit strings work
+        (UString.h, StringImpl::getData16SlowCase()).
+        Changed StringBuffer to be a templated class based on character
+        type.  This change rippled into WebCore code as well.
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.exp:
+        * parser/Lexer.cpp:
+        (JSC::::append8): Changed to use 8 bit buffers.
+        (JSC::::parseIdentifier): Changed to use 8 bit buffers.
+        (JSC::::parseString): Changed to use 8 bit buffers.
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierCStringTranslator::translate): 8 bit version keeps data 8 bit
+        (JSC::Identifier::toUInt32FromCharacters): Templated helper.
+        (JSC::Identifier::toUInt32): Added 8 bit optimized path.
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage): Changed to be 8 bit strings
+        * runtime/UString.h:
+        (JSC::UString::characters): Now calls StringImpl::characters()
+        * wtf/Forward.h:
+        * wtf/text/StringBuffer.h: Made StringBuffer a template base on character type.
+        (WTF::StringBuffer::StringBuffer):
+        (WTF::StringBuffer::characters):
+        (WTF::StringBuffer::release):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::create):
+        (WTF::StringImpl::getData16SlowCase): Fixed null terminated case.
+        (WTF::StringImpl::removeCharacters): Added 8 bit path.
+        (WTF::StringImpl::simplifyMatchedCharactersToSpace):
+        (WTF::StringImpl::simplifyWhiteSpace):
+        (WTF::equal): Removed bug from code copied from null terminated version.
+        (WTF::StringImpl::adopt): Added 8 bit path.
+        (WTF::StringImpl::createWithTerminatingNullCharacter): Fixed 8 bi flag propagation.
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::StringImpl): Added new 8 bit constructor.
+        (WTF::StringImpl::characters8): Removed ASSERT_NOT_REACHED().
+        (WTF::getCharacters<LChar>): Added templated accessor for 8 bit strings.
+        (WTF::getCharacters<UChar>): Added templated accessor for 16 bit strings.
+        * wtf/text/WTFString.h:
+        (WTF::String::adopt): Changed to use StringBuffer template.
+
+2011-11-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize ExecutableBase::clearCodeVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=72337
+
+        Reviewed by Darin Adler.
+
+        Added static finalize functions to the subclasses of ExecutableBase that provide an implementation 
+        of clearCodeVirtual, changed all of the clearCodeVirtual methods to non-virtual clearCode method,
+        and had the finalize functions call the corresponding clearCode methods.
+
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode):
+        (JSC::NativeExecutable::finalize):
+        (JSC::EvalExecutable::finalize):
+        (JSC::EvalExecutable::clearCode):
+        (JSC::ProgramExecutable::finalize):
+        (JSC::ProgramExecutable::clearCode):
+        (JSC::FunctionExecutable::discardCode):
+        (JSC::FunctionExecutable::finalize):
+        (JSC::FunctionExecutable::clearCode):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::finishCreation):
+        (JSC::NativeExecutable::create):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::create):
+        (JSC::FunctionExecutable::create):
+
+2011-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        String new RegExp('\n').toString() returns is invalid RegularExpressionLiteral
+        https://bugs.webkit.org/show_bug.cgi?id=71572
+
+        Reviewed by Gavin Barraclough and Darin Adler.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectSource):
+
+2011-11-16  Darin Adler  <darin@apple.com>
+
+        Specialize HashTraits for OwnPtr to use PassOwnPtr and raw pointer
+        https://bugs.webkit.org/show_bug.cgi?id=72475
+
+        Reviewed by Adam Roben.
+
+        * wtf/HashTraits.h: Specialize HashTraits for OwnPtr.
+        Do overloads so we can pass a nullptr and also be sure to get the
+        raw pointer type from the OwnPtr template so we handle both forms
+        of OwnPtr: OwnPtr<T> and OwnPtr<T*>.
+
+2011-11-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Centralize hide_symbols and ensure all libs are built with symbol visibility & bsymbolic_functions
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Target.pri: Eliminate duplicated symbol stuff that lives now in default_post.prf.
+
+2011-11-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed, rolling out r100266.
+        http://trac.webkit.org/changeset/100266
+
+        Broke WTR.
+
+        * Target.pri:
+
+2011-11-16  Darin Adler  <darin@apple.com>
+
+        Add a "pass type" and "peek type" concept to HashTraits
+        https://bugs.webkit.org/show_bug.cgi?id=72473
+
+        Reviewed by Filip Pizlo.
+
+        * wtf/HashTraits.h: Added the pass type and peek type.
+        For OwnPtr, the pass type will be PassOwnPtr and the peek
+        type will be a raw pointer.
+
+2011-11-16  Darin Adler  <darin@apple.com>
+
+        Fix some hash traits that don't derive from the base hash traits
+        https://bugs.webkit.org/show_bug.cgi?id=72470
+
+        Reviewed by Filip Pizlo.
+
+        Hash traits structures need to derive from the base hash traits in
+        HashTraits.h, but some were not. This is needed for compatibility with
+        some additional traits we will be adding to make OwnPtr work with HashMap.
+
+        * runtime/Identifier.h: Make IdentifierMapIndexHashTraits derive from
+        HashTraits<int>. This enabled removal of all the members except for the
+        ones that control the empty value, because this is otherwise the same
+        as the standard int hash.
+
+        * runtime/SymbolTable.h: Changed SymbolTableIndexHashTraits to derive
+        from HashTraits<SymbolTableEntry> and removed redundant members.
+
+2011-11-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r100375 and r100385.
+        http://trac.webkit.org/changeset/100375
+        http://trac.webkit.org/changeset/100385
+        https://bugs.webkit.org/show_bug.cgi?id=72465
+
+        They broke 32 bit builds on Qt (Requested by ossy on #webkit).
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        * runtime/ArgList.h:
+        (JSC::ArgList::ArgList):
+        * runtime/JSArray.cpp:
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObject.h:
+
+2011-11-15  George Staikos  <staikos@webkit.org>
+
+        Remove the guard page from the addressable stack region on QNX.
+        https://bugs.webkit.org/show_bug.cgi?id=72455
+
+        Reviewed by Daniel Bates.
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2011-11-15  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8 bit Strings - Update utf8() and ascii() methods for 8 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=72323
+
+        Added 8 bit optimized paths for String and UString ascii() and utf8() methods.
+
+        Added String::characters8(), characters16() and is8Bit() helper methods.
+
+        Added an new Unicode::convertLatin1ToUTF8() method that works on
+        LChar (8 bit) strings that is a stripped down version of convertUTF16ToUTF8().
+
+        Reviewed by Geoff Garen.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        (JSC::UString::utf8):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::ascii):
+        (WTF::String::utf8):
+        * wtf/text/WTFString.h:
+        (WTF::String::characters8):
+        (WTF::String::characters16):
+        (WTF::String::is8Bit):
+        (WTF::LChar):
+        (WTF::UChar):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::convertLatin1ToUTF8):
+        * wtf/unicode/UTF8.h:
+        * wtf/unicode/Unicode.h:
+
+2011-11-15  Darin Adler  <darin@apple.com>
+
+        REGRESSION (r98887): ParserArena and Keywords leaking
+        https://bugs.webkit.org/show_bug.cgi?id=72428
+
+        Reviewed by Sam Weinig.
+
+        * parser/Lexer.h: Made Keywords destructor public since OwnPtr and PassOwnPtr
+        need to be able to destroy it.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::Parser): Use get now that parserArena is an OwnPtr.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Use adoptPtr to initialize OwnPtr members.
+
+        * runtime/JSGlobalData.h: Make parserArena and keywords be OwnPtr.
+
+2011-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed another use of ArgList that baked in the assumption that arguments
+        are forward in the regiter file.
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Use our new array creation API, instead of
+        working through ArgList.
+
+        * runtime/ArgList.h: Removed!
+
+2011-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed a use of ArgList that baked in the assumption that arguments
+        are forward in the regiter file.
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Use new API.
+
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice): No need to provide an arbitrary constructor --
+        getSlice can do the right thing by using its rights to private data.
+
+        * runtime/ArgList.h: Removed constructor that took a forward-contiguous
+        set of arguments.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::finishCreation):
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructArray): Added explicit support for creating an array from
+        a pre-allocated set of values, so we could stop relying on the ArgList
+        API we want to remove.
+
+2011-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Crash in JSC::DFG::OSRExitCompiler::compileExit(JSC::DFG::OSRExit const&, JSC::DFG::SpeculationRecovery*)
+        https://bugs.webkit.org/show_bug.cgi?id=72292
+
+        Reviewed by Geoff Garen.
+        
+        We need to be careful about how we look for the baseline CodeBlock if we're lazy-compiling
+        an OSR exit after our CodeBlock has been jettisoned. In short, use CodeBlock::baselineVersion()
+        instead of CodeBlock::alternative().
+        
+        No performance effect.
+        
+        No tests because all of our heuristics work very hard to make sure that this never happens in
+        the first place. OSR exits are rare by design, and jettisoning of CodeBlocks (i.e. recompilation)
+        is even rarer. Furthermore, OSR exits after a CodeBlock has been jettisoned is rarer still
+        because the whole point of jettisoning is to bring the probability of future OSR exits to as
+        close to zero as possible. But even that isn't enough to trigger this bug; it requires the OSR
+        exit after a jettison to be the first of its kind; our whole design tries to ensure that
+        CodeBlocks tend to OSR exit at a handful (i.e. 1 in most cases) of points, and since jettisoning
+        is triggered by OSR, in most sane cases the OSR exits after jettison will not require lazy OSR
+        compilation. So this is a truly evil case, and any test for it would be quite fragile.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::specializationKind):
+        (JSC::CodeBlock::largeFailCountThreshold):
+        (JSC::CodeBlock::largeFailCountThresholdForLoop):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
+        (JSC::DFG::AssemblyHelpers::baselineCodeBlockFor):
+        (JSC::DFG::AssemblyHelpers::baselineCodeBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2011-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Use MarkedArgumentBuffer to avoid making assumptions about argument order
+        https://bugs.webkit.org/show_bug.cgi?id=72418
+
+        Reviewed by Sam Weinig.
+        
+        A step toward reversing the argument order.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Walker::callReviver): Don't assume that ArgList wants to point
+        at arguments in forward order. Instead, use MarkedArgumentBuffer, which
+        will make the decision for us.
+
+2011-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should distinguish between constants in the constant pool and weak
+        constants added as artifacts of code generation
+        https://bugs.webkit.org/show_bug.cgi?id=72367
+
+        Reviewed by Geoff Garen.
+        
+        Added the notion of a WeakJSConstant, which is like a JSConstant except that
+        it can only refer to JSCell*. Currently all WeakJSConstants are also backed
+        by constants in the constant pool, since weak references originated from
+        machine code are not yet properly handled.
+        
+        Replaced CheckMethod, and MethodCheckData, with a combination of WeakJSConstant
+        and CheckStructure. This results in improved CSE, leading to a 1% win on V8.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::prepareToParseBlock):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::getJSConstantPrediction):
+        (JSC::DFG::Graph::valueOfJSConstant):
+        (JSC::DFG::Graph::valueOfInt32Constant):
+        (JSC::DFG::Graph::valueOfNumberConstant):
+        (JSC::DFG::Graph::valueOfBooleanConstant):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isWeakConstant):
+        (JSC::DFG::Node::hasConstant):
+        (JSC::DFG::Node::weakConstant):
+        (JSC::DFG::Node::valueOfJSConstant):
+        (JSC::DFG::Node::isInt32Constant):
+        (JSC::DFG::Node::isDoubleConstant):
+        (JSC::DFG::Node::isNumberConstant):
+        (JSC::DFG::Node::isBooleanConstant):
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-15  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8 bit Strings - Initial JS String Tuning
+        https://bugs.webkit.org/show_bug.cgi?id=72326
+
+        Added 8 bit optimized paths for the methods below.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring8):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharCodeAt):
+
+2011-11-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Result of Error.prototype.toString not ES5 conformant
+        https://bugs.webkit.org/show_bug.cgi?id=70889
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+
+2011-11-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Centralize hide_symbols and ensure all libs are built with symbol visibility & bsymbolic_functions
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Target.pri: Eliminate duplicated symbol stuff that lives now in default_post.prf.
+
+2011-11-15  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Remove DFGJITCompilerInlineMethods
+        https://bugs.webkit.org/show_bug.cgi?id=72366
+
+        Reviewed by Filip Pizlo.
+
+        Those methods are actually seldom used. Modify the few such places and
+        remove DFGJITCompilerInlineMethods stuffs totally.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant):
+        * dfg/DFGJITCompilerInlineMethods.h: Removed.
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentFillFPR):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::cachedGetMethod):
+
+2011-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT and DFG::JITCodeGenerator should be combined
+        https://bugs.webkit.org/show_bug.cgi?id=72348
+
+        Reviewed by Gavin Barraclough.
+        
+        Moved all of JITCodeGenerator into SpeculativeJIT.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGJITCodeGenerator.cpp: Removed.
+        * dfg/DFGJITCodeGenerator.h: Removed.
+        * dfg/DFGJITCodeGenerator32_64.cpp: Removed.
+        * dfg/DFGJITCodeGenerator64.cpp: Removed.
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryCachePutByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::clearGenerationInfo):
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        (JSC::DFG::SpeculativeJIT::isStrictInt32):
+        (JSC::DFG::SpeculativeJIT::isKnownInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::SpeculativeJIT::isKnownCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
+        (JSC::DFG::SpeculativeJIT::isKnownBoolean):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::markCellCard):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
+        (JSC::DFG::dataFormatString):
+        (JSC::DFG::SpeculativeJIT::dump):
+        (JSC::DFG::SpeculativeJIT::checkConsistency):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::GPRTemporary::adopt):
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::at):
+        (JSC::DFG::SpeculativeJIT::lock):
+        (JSC::DFG::SpeculativeJIT::unlock):
+        (JSC::DFG::SpeculativeJIT::canReuse):
+        (JSC::DFG::SpeculativeJIT::reuse):
+        (JSC::DFG::SpeculativeJIT::allocate):
+        (JSC::DFG::SpeculativeJIT::tryAllocate):
+        (JSC::DFG::SpeculativeJIT::fprAllocate):
+        (JSC::DFG::SpeculativeJIT::isFilled):
+        (JSC::DFG::SpeculativeJIT::isFilledDouble):
+        (JSC::DFG::SpeculativeJIT::use):
+        (JSC::DFG::SpeculativeJIT::selectScratchGPR):
+        (JSC::DFG::SpeculativeJIT::silentSpillGPR):
+        (JSC::DFG::SpeculativeJIT::silentSpillFPR):
+        (JSC::DFG::SpeculativeJIT::silentFillGPR):
+        (JSC::DFG::SpeculativeJIT::silentFillFPR):
+        (JSC::DFG::SpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::SpeculativeJIT::silentFillAllRegisters):
+        (JSC::DFG::SpeculativeJIT::boxDouble):
+        (JSC::DFG::SpeculativeJIT::unboxDouble):
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::isConstant):
+        (JSC::DFG::SpeculativeJIT::isJSConstant):
+        (JSC::DFG::SpeculativeJIT::isInt32Constant):
+        (JSC::DFG::SpeculativeJIT::isDoubleConstant):
+        (JSC::DFG::SpeculativeJIT::isNumberConstant):
+        (JSC::DFG::SpeculativeJIT::isBooleanConstant):
+        (JSC::DFG::SpeculativeJIT::isFunctionConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):
+        (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
+        (JSC::DFG::SpeculativeJIT::addressOfDoubleConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfJSConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant):
+        (JSC::DFG::SpeculativeJIT::isNullConstant):
+        (JSC::DFG::SpeculativeJIT::identifier):
+        (JSC::DFG::SpeculativeJIT::flushRegisters):
+        (JSC::DFG::SpeculativeJIT::isFlushed):
+        (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImmPtr):
+        (JSC::DFG::SpeculativeJIT::bitOp):
+        (JSC::DFG::SpeculativeJIT::shiftOp):
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::addressOfCallData):
+        (JSC::DFG::SpeculativeJIT::tagOfCallData):
+        (JSC::DFG::SpeculativeJIT::payloadOfCallData):
+        (JSC::DFG::SpeculativeJIT::integerResult):
+        (JSC::DFG::SpeculativeJIT::noResult):
+        (JSC::DFG::SpeculativeJIT::cellResult):
+        (JSC::DFG::SpeculativeJIT::booleanResult):
+        (JSC::DFG::SpeculativeJIT::jsValueResult):
+        (JSC::DFG::SpeculativeJIT::storageResult):
+        (JSC::DFG::SpeculativeJIT::doubleResult):
+        (JSC::DFG::SpeculativeJIT::initConstantInfo):
+        (JSC::DFG::SpeculativeJIT::resetCallArguments):
+        (JSC::DFG::SpeculativeJIT::addCallArgument):
+        (JSC::DFG::SpeculativeJIT::setupArguments):
+        (JSC::DFG::SpeculativeJIT::setupArgumentsExecState):
+        (JSC::DFG::SpeculativeJIT::setupArgumentsWithExecState):
+        (JSC::DFG::SpeculativeJIT::setupTwoStubArgs):
+        (JSC::DFG::SpeculativeJIT::setupStubArguments):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::SpeculativeJIT::setupResults):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        (JSC::DFG::SpeculativeJIT::addBranch):
+        (JSC::DFG::SpeculativeJIT::linkBranches):
+        (JSC::DFG::SpeculativeJIT::block):
+        (JSC::DFG::SpeculativeJIT::checkConsistency):
+        (JSC::DFG::SpeculativeJIT::BranchRecord::BranchRecord):
+        (JSC::DFG::IntegerOperand::IntegerOperand):
+        (JSC::DFG::IntegerOperand::~IntegerOperand):
+        (JSC::DFG::IntegerOperand::index):
+        (JSC::DFG::IntegerOperand::format):
+        (JSC::DFG::IntegerOperand::gpr):
+        (JSC::DFG::IntegerOperand::use):
+        (JSC::DFG::DoubleOperand::DoubleOperand):
+        (JSC::DFG::DoubleOperand::~DoubleOperand):
+        (JSC::DFG::DoubleOperand::index):
+        (JSC::DFG::DoubleOperand::fpr):
+        (JSC::DFG::DoubleOperand::use):
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        (JSC::DFG::JSValueOperand::~JSValueOperand):
+        (JSC::DFG::JSValueOperand::index):
+        (JSC::DFG::JSValueOperand::gpr):
+        (JSC::DFG::JSValueOperand::jsValueRegs):
+        (JSC::DFG::JSValueOperand::isDouble):
+        (JSC::DFG::JSValueOperand::fill):
+        (JSC::DFG::JSValueOperand::tagGPR):
+        (JSC::DFG::JSValueOperand::payloadGPR):
+        (JSC::DFG::JSValueOperand::fpr):
+        (JSC::DFG::JSValueOperand::use):
+        (JSC::DFG::StorageOperand::StorageOperand):
+        (JSC::DFG::StorageOperand::~StorageOperand):
+        (JSC::DFG::StorageOperand::index):
+        (JSC::DFG::StorageOperand::gpr):
+        (JSC::DFG::StorageOperand::use):
+        (JSC::DFG::GPRTemporary::~GPRTemporary):
+        (JSC::DFG::GPRTemporary::gpr):
+        (JSC::DFG::FPRTemporary::~FPRTemporary):
+        (JSC::DFG::FPRTemporary::fpr):
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        (JSC::DFG::GPRResult::GPRResult):
+        (JSC::DFG::GPRResult2::GPRResult2):
+        (JSC::DFG::FPRResult::FPRResult):
+        (JSC::DFG::FPRResult::lockedResult):
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeKnownConstantArithOp):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeBasicArithOp):
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::cachedGetMethod):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeKnownConstantArithOp):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeBasicArithOp):
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::cachedGetMethod):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * runtime/JSFunction.h:
+
+2011-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Weak reference harvesters should run to fixpoint
+        https://bugs.webkit.org/show_bug.cgi?id=72346
+
+        Reviewed by Oliver Hunt.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/ListableHandler.h:
+        (JSC::ListableHandler::next):
+        (JSC::ListableHandler::List::head):
+        (JSC::ListableHandler::List::removeNext):
+        (JSC::ListableHandler::List::removeAll):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::reset):
+        (JSC::SlotVisitor::harvestWeakReferences):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::isEmpty):
+
+2011-11-14  Oliver Hunt  <oliver@apple.com>
+
+        Start migrating typed array impl types to WTF
+        https://bugs.webkit.org/show_bug.cgi?id=72336
+
+        Reviewed by Geoffrey Garen.
+
+        Add typed array impls to WTF forwarding header.
+
+        * wtf/Forward.h:
+
+2011-11-14  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Add --css-grid-layout to build-webkit and the build systems
+        https://bugs.webkit.org/show_bug.cgi?id=72320
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-11-14  Geoffrey Garen  <ggaren@apple.com>
+
+        A little bit of arguments / activation cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=72339
+
+        Reviewed by Gavin Barraclough.
+        
+        Renamed copyRegisters => tearOff to match bytecode and other terminology.
+        
+        Renamed setActivation => didTearOffActivation to indicate that this is a
+        notification the object may choose to ignore. Moved "Should I ignore?"
+        code into the arguments object to avoid duplication elsewhere.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createAndTearOff):
+        (JSC::Arguments::didTearOffActivation):
+        (JSC::Arguments::finishCreationButDontTearOff):
+        (JSC::Arguments::finishCreation):
+        (JSC::Arguments::finishCreationAndTearOff):
+        (JSC::Arguments::tearOff):
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::tearOff): Moved Activation's code into its own header
+        because that's where it belongs.
+
+2011-11-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Should sign the jsc binary
+        https://bugs.webkit.org/show_bug.cgi?id=72332
+
+        Reviewed by David Kilzer.
+
+        * Configurations/JSC.xcconfig:
+        * entitlements.plist: Added.
+
+2011-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG's inline references to objects should be tracked
+        https://bugs.webkit.org/show_bug.cgi?id=72313
+
+        Reviewed by Gavin Barraclough.
+        
+        Added a pinCell() method in the parser that currently creates a
+        dummy constant in CodeBlock. Added calls to pinCell() wherever the
+        DFG would inline a constant reference that the original code would
+        not have referred to.
+        
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getCellConstantIndex):
+        (JSC::DFG::ByteCodeParser::pinCell):
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2011-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG put_by_id transition optimizations test the wrong structures
+        https://bugs.webkit.org/show_bug.cgi?id=72324
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::structureChainIsStillValid):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2011-11-14  Michael Saboff  <msaboff@apple.com>
+
+        Further changes and cleanup to JSString.h and cpp.
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope): Change PassRefPtr to RefPtr.  Eliminated exec in slow case calls.
+        (JSC::JSString::resolveRopeSlowCase8): Darin and I agreed that this should have 8 in name.
+        (JSC::JSString::resolveRopeSlowCase): Removed exec parameter.
+        * runtime/JSString.h:
+
+2011-11-14  Adam Barth  <abarth@webkit.org>
+
+        DateMath.cpp should not depend on JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=71747
+
+        Reviewed by Darin Adler.
+
+        This patch moves the JSC-specific parts of DateMath into JSDateMath in
+        JavaScriptCore.  There shouldn't be any behavior change.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConversion.cpp:
+        * runtime/DateInstance.cpp:
+        * runtime/DateInstanceCache.h:
+        * runtime/DatePrototype.cpp:
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSDateMath.cpp: Copied from Source/JavaScriptCore/wtf/DateMath.cpp.
+        (JSC::timeToMS):
+        (JSC::msToSeconds):
+        * runtime/JSDateMath.h: Copied from Source/JavaScriptCore/wtf/DateMath.h.
+        * wtf/DateMath.cpp:
+        (WTF::isLeapYear):
+        (WTF::msToDays):
+        (WTF::msToMinutes):
+        (WTF::msToHours):
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (WTF::makeRFC2822DateString):
+        * wtf/DateMath.h:
+
+2011-11-14  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8 bit strings - Add 8 bit handling to JSString Ropes
+        https://bugs.webkit.org/show_bug.cgi?id=72317
+
+        Added bit to track that a rope is made up of all 8 bit fibers.
+        Created an 8 bit path (fast and slow cases) to handle 8 bit 
+        only ropes.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::resolveRopeSlowCase8):
+        (JSC::JSString::resolveRopeSlowCase16):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::finishCreation):
+        (JSC::RopeBuilder::is8Bit):
+        (JSC::jsSubstring8):
+
+2011-11-14  Geoffrey Garen  <ggaren@apple.com>
+
+        A little bit of function call cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=72314
+
+        Reviewed by Oliver Hunt.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall): Renamed callFrame to registerOffset
+        because this value doesn't give you the offset of the callee's call frame.
+
+        (JSC::BytecodeGenerator::emitReturn): Tightened to use equality instead
+        of greater-than. Removed comment since its reasoning was wrong.
+        
+        (JSC::BytecodeGenerator::emitConstruct): Updated for rename mentioned above.
+
+        (JSC::BytecodeGenerator::isArgumentNumber): Provided a more precise way
+        to ask this question, giving the bytecode generator more freedom to change
+        internal implementation details.
+        
+        * bytecompiler/BytecodeGenerator.h: Reduced default vector capacity because
+        16 was overkill.
+        (JSC::CallArguments::registerOffset): Updated for rename mentioned above.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        (JSC::CallArguments::newArgument): Factored out argument allocation into
+        a helper function, so I can change it later.
+
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode): Use helper function mentioned above.
+
+2011-11-14  Tony Chang  <tony@chromium.org>
+
+        Remove the CSS3_FLEXBOX compile time flag and enable on all ports
+        https://bugs.webkit.org/show_bug.cgi?id=72196
+
+        Reviewed by Ojan Vafai.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-11-14  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/10424154> testRegExp should not be installed as part of JavaScriptCore
+
+        testRegExp and testapi.js were being installed in the JavaScriptCore framework.
+        As test-only tools they shouldn't be installed there by default, only when
+        FORCE_TOOL_INSTALL is set to YES.
+
+        This patch incorprorates a few related changes:
+        1) Make the jsc and testRegExp targets be configured via .xcconfig files.
+        2) Sets up testRegExp so that SKIP_INSTALL is YES by default, and only NO when
+           FORCE_TOOL_INSTALL is YES.
+        3) Switches the testapi target to using a script build phase to install testapi.js
+           so that the installation will be skipped when SKIP_INSTALL is YES. I'm not sure
+           why this isn't the built-in behavior when a Copy Files build phase has "Copy only
+           when installing" checked, but it doesn't seem to be.
+        4) Other random cleanup such as removing a bogus group that refers to files that do
+           not exist, moving testRegExp.cpp in to the tests group, etc.
+
+        Reviewed by Geoff Garen.
+
+        * Configurations/JSC.xcconfig: Added.
+        * Configurations/TestRegExp.xcconfig: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-11-14  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8 bit strings - Add 8 bit paths to StringImpl methods
+        https://bugs.webkit.org/show_bug.cgi?id=72290
+
+        Added 8 bit patchs to StringImpl to number and find methods.
+
+        Reviewed by Oliver Hunt.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::toIntStrict):
+        (WTF::StringImpl::toUIntStrict):
+        (WTF::StringImpl::toInt64Strict):
+        (WTF::StringImpl::toUInt64Strict):
+        (WTF::StringImpl::toIntPtrStrict):
+        (WTF::StringImpl::toInt):
+        (WTF::StringImpl::toUInt):
+        (WTF::StringImpl::toInt64):
+        (WTF::StringImpl::toUInt64):
+        (WTF::StringImpl::toIntPtr):
+        (WTF::StringImpl::toDouble):
+        (WTF::StringImpl::toFloat):
+        (WTF::StringImpl::find):
+        (WTF::StringImpl::reverseFind):
+        * wtf/text/WTFString.cpp:
+        (WTF::toIntegralType):
+        (WTF::lengthOfCharactersAsInteger):
+        (WTF::charactersToIntStrict):
+        (WTF::charactersToUIntStrict):
+        (WTF::charactersToInt64Strict):
+        (WTF::charactersToUInt64Strict):
+        (WTF::charactersToIntPtrStrict):
+        (WTF::charactersToInt):
+        (WTF::charactersToUInt):
+        (WTF::charactersToInt64):
+        (WTF::charactersToUInt64):
+        (WTF::charactersToIntPtr):
+        (WTF::toDoubleType):
+        (WTF::charactersToDouble):
+        (WTF::charactersToFloat):
+        * wtf/text/WTFString.h:
+        (WTF::find):
+        (WTF::reverseFind):
+
+2011-11-14  Vincent Scheib  <scheib@chromium.org>
+
+        Mouse Lock: Renaming to 'Pointer Lock': ENABLE Flags
+        https://bugs.webkit.org/show_bug.cgi?id=72286
+
+        Reviewed by Adam Barth.
+
+        * wtf/Platform.h:
+
+2011-11-14  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=72280
+
+        Rubber stamped by Geoff Garen.
+
+        Fix 32-bit Lion.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+
+2011-11-14  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit Build fix: declare virtual register indices to be int rather than
+        unsigned, since they can be positive or negative.
+        
+        For better clarity, explicitly use ReturnPC instead of -1 as the "invalid"
+        state, since we'll never load and operate on the ReturnPC as a JS value.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitLoad2):
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitStore):
+        (JSC::JIT::emitStoreInt32):
+        (JSC::JIT::emitStoreAndMapInt32):
+        (JSC::JIT::emitStoreCell):
+        (JSC::JIT::emitStoreBool):
+        (JSC::JIT::emitStoreDouble):
+        (JSC::JIT::map):
+        (JSC::JIT::unmap):
+        (JSC::JIT::isMapped):
+        (JSC::JIT::getMappedPayload):
+        (JSC::JIT::getMappedTag):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+
+2011-11-14  Michael Saboff  <msaboff@apple.com>
+
+        Remove unused m_data member from UStringSourceProvider
+        https://bugs.webkit.org/show_bug.cgi?id=72289
+
+        Removed unused m_data member from UStringSourceProvider.
+
+        Reviewed by Oliver Hunt.
+
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+
+2011-11-14  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8 Bit Strings: Templatize YARR Parser
+        https://bugs.webkit.org/show_bug.cgi?id=72288
+
+        Changed Yarr::Parser to be a template based on character type.
+
+        Reviewed by Oliver Hunt.
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::parse):
+
+2011-11-14  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit build fix: Removed unused declaration.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+
+2011-11-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Standardized the JS calling convention
+        https://bugs.webkit.org/show_bug.cgi?id=72221
+        
+        Reviewed by Oliver Hunt.
+
+        This patch standardizes the calling convention so that the caller always
+        sets up the callee's CallFrame. Adjustments for call type, callee type,
+        argument count, etc. now always take place after that initial setup.
+        
+        This is a step toward reversing the argument order, but also has these
+        immediate benefits (measured on x64):
+        
+        (1) 1% benchmark speedup across the board.
+        
+        (2) 50% code size reduction in baseline JIT function calls.
+        
+        (3) 1.5x speedup for single-dispatch .apply forwarding.
+        
+        (4) 1.1x speedup for multi-dispatch .apply forwarding.
+
+        This change affected the baseline JIT most, since the baseline JIT had
+        lots of ad hoc calling conventions for different caller / callee types.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr): Optimize compare to 0 into
+        a test, like other assemblers do. (I added some compares to 0, and didn't
+        want them to be slow.)
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Merged op_load_varargs into op_call_varargs so
+        op_call_varargs could share code generation with other forms of op_call.
+        This is also a small optimization, since op_*varargs no longer have to
+        pass arguments to each other through the register file.
+
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CodeBlock.h: Added a new call type: CallVarargs. This allows
+        us to link functions called through .apply syntax. We need to distinguish
+        CallVarargs from Call because CallVarargs changes its argument count
+        on each inovcation, so we must always link to the argument count checking
+        version of the callee.
+
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * bytecompiler/BytecodeGenerator.h: Merged op_load_varargs into op_call_varargs.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode): Ditto. Also, simplified
+        some of this bytecode generation to remove redundant copies.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall): Added a new call type: CallVarargs.
+        DFG doesn't support this type, but its code needs to change slightly
+        to accomodate a 3-state variable.
+
+        Stopped passing the argument count in regT1 because this is non-standard.
+        (The argument count goes in the CallFrame. This trades speed on the slow
+        path for speed and code size on the fast path, and simplicity on all paths.
+        A good trade, in my opinion.)
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction): Tweaked code to make CallFrame
+        setup more obvious when single-stepping. Also, updated for argument count
+        not being in regT1.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addJSCall):
+        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord): Added a new call
+        type: CallVarargs.
+
+        * dfg/DFGOperations.cpp: Do finish CallFrame setup in one place before
+        doing anything else. Don't check for stack overflow because we have no callee
+        registers, and our caller has already checked for its own registers.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkFor): We can link to our callee even if our argument
+        count doesn't match -- we just need to link to the argument count checking
+        version.
+
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setArgument): BUG FIX: When supplying too many
+        arguments from C++, we need to supply a full copy of the arguments prior
+        to the subset copy that matches our callee's argument count. (That is what
+        the standard calling convention would have produced in JS.) I would have
+        split this into its own patch, but I couldn't find a way to get the JIT
+        to fail a regression test in this area without my patch applied.
+
+        * interpreter/Interpreter.cpp: Let the true code bomb begin!
+
+        (JSC::eval): Fixed up this helper function to operate on eval()'s CallFrame,
+        and not eval()'s caller frame. We no longer leave the CallFrame pointing
+        to eval()'s caller during a call to eval(), since that is not standard.
+
+        (JSC::loadVarargs): Factored out a shared helper function for use by JIT
+        and interpreter because half the code means one quarter the bugs -- in my
+        programming, at least.
+
+        (JSC::Interpreter::execute): Removed a now-unused way to invoke eval.
+        
+        (JSC::Interpreter::privateExecute): Removed an invalid ASSERT following
+        putDirect, because it got in the way of my testing. (When putting a
+        function, the cached base of a PutPropertySlot can be 0 to signify "do
+        not optimize".)
+        
+        op_call_eval: Updated for new, standard eval calling convention.
+        
+        op_load_varargs: Merged op_load_varargs into op_call_varargs.
+
+        op_call_varags: Updated for new, standard eval calling convention. Don't
+        check for stack overflow because the loadVarargs helper function already
+        checked.
+
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::execute): Headers are fun and educational!
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::growSlowCase):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::grow): Factored out the slow case into a slow
+        case because it was cramping the style of my fast case.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile): Moved initialization of
+        RegisterFile::CodeBlock to make it more obvious when debugging. Removed
+        assumption that argument count is in regT1, as above. Removed call to
+        restoreArgumentReference() because the JITStubCall abstraction does this for us.
+
+        (JSC::JIT::linkFor): Link even if we miss on argument count, as above.
+
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_construct):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs): Share all function call code generation.
+        Don't count call_eval when accounting for linkable function calls because
+        eval doesn't link. (Its fast path is to perform the eval.)
+
+        (JSC::JIT::compileLoadVarargs): Ported this inline copying optimization
+        to our new calling convention. The key to this optimization is the
+        observation that, in a function that declares no arguments, if any
+        arguments are passed, they all end up right behind 'this'.
+
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase): Factored out eval for a little clarity.
+
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase): If you are still with me, dear reader,
+        this is the whole point of my patch. The caller now unconditionally moves
+        the CallFrame forward and fills in the data it knows before taking any
+        branches to deal with weird caller/callee pairs.
+        
+        This also means that there is almost no slow path for calls -- it all
+        gets folded into the shared virtual call stub. The only things remaining
+        in the slow path are the rare case counter and a call to the stub.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall): Updated for values being in
+        different registers or in memory, based on our new standard calling
+        convention.
+        
+        Added a shared path for calling out to CTI helper functions for non-JS
+        calls.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check): method_check emits its own code and
+        the following get_by_id's code, so it needs to add both when informing
+        result chaining of its result. This is important because the standard
+        calling convention can now take advantage of this chaining.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_construct): Observe, as I write all of my code a
+        second time, now with 64 bits.
+
+        * jit/JITStubs.cpp:
+        (JSC::throwExceptionFromOpCall):
+        (JSC::jitCompileFor):
+        (JSC::arityCheckFor):
+        (JSC::lazyLinkFor): A lot of mechanical changes here for one purpose:
+        Exceptions thrown in the middle of a function call now use a shared helper
+        function (throwExceptionFromOpCall). This function understands that the
+        CallFrame currently points to the callEE, and the exception must be
+        thrown by the callER. (The old calling convention would often still have
+        the CallFrame pointing at the callER at the point of an exception. That
+        is not the way of our new, standard calling convention.)
+
+        (JSC::op_call_eval): Finish standard CallFrame setup before calling 
+        our eval helper function, which now depends on that setup.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::length): Renamed numProvidedArguments() to length()
+        because that's what other objects call it, and the difference made our
+        new loadVarargs helper function hard to read.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal): Interpreter build
+        fixes.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply): Honor Arguments::MaxArguments even when
+        the .apply call_varargs optimization fails. (This bug appears on layout
+        tests when you disable the optimization.)
+
+2011-11-11  Jer Noble  <jer.noble@apple.com>
+
+        Implement MediaController.
+        https://bugs.webkit.org/show_bug.cgi?id=71408
+
+        Reviewed by Eric Carlson.
+
+        Change the definition of WTF_USE_COREAUDIO to exclude Windows completely, as 
+        CoreAudioClock.h is not available there.
+
+        * wtf/Platform.h:
+
+2011-11-14  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Remove dependency on pthread from FastMalloc
+        https://bugs.webkit.org/show_bug.cgi?id=72098
+
+        Reviewed by Adam Roben.
+
+        All pthread calls are already ported to native Windows calls.
+        Use the native version for all OS(WINDOWS) to remove the
+        runtime dependency on the pthread dll.
+
+        * wtf/FastMalloc.cpp:
+
+2011-11-14  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Replace use of QApplication with QGuiApplication.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * wtf/qt/compat/qguiapplication.h:
+        (QGuiApplication::styleHints): Introduce styleHints wrapper hack.
+
+2011-11-14  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck build.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2011-11-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: function remote objetct should provide access to function position in the script
+        https://bugs.webkit.org/show_bug.cgi?id=71808
+
+        Exposed accessor for function source code.
+
+        Reviewed by Pavel Feldman.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::sourceCode):
+        * runtime/JSFunction.h:
+
+2011-11-13  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Fix silent spilling/filling GPRs in DFG 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=72201
+
+        Reviewed by Gavin Barraclough.
+
+        Current silentSpillGPR/silentFillGPR may not work as expected for some
+        cases in 32_64. If there's a JSValue which was retained by two GPRs,
+        we may end up failing to spill/fill some GPRs or redundantly
+        spilling/filling some GPRs. For example, if we tend to exclude "eax"
+        from spilling while a JSValue is retained by both "eax" and "edx",
+        then "edx" won't be spilled as well (wrong). And if another JSValue is
+        retained by "ecx" and "ebx", both "ecx" and "ebx" will be spilled
+        twice. The similar problem applies to silentFillGPR.
+        The fix is to make silentSpillGPR/silentFillGPR more straightforward,
+        i.e., spilling/filling based on the GPR instead of the virtual
+        register. FPR spilling/filling is also modified accordingly to make it
+        consistent with GPR spilling/filling.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentSpillGPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillFPR):
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillAllRegisters):
+        (JSC::DFG::JITCodeGenerator::silentFillAllRegisters):
+
+2011-11-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        [Qt][Symbian] Remove support for WINSCW compiler
+        https://bugs.webkit.org/show_bug.cgi?id=70178
+
+        Reviewed by Chang Shu.
+
+        * API/JSStringRef.h:
+        * create_hash_table: Revert r45553.
+        * runtime/JSGlobalData.cpp: Revert r45553.
+        * runtime/LiteralParser.cpp: Remove WINSCW comment.
+        (JSC::LiteralParser::Lexer::lexString):
+        * runtime/Lookup.h: Revert r45553.
+        * runtime/Structure.h: Revert r48461.
+        * wtf/Alignment.h:
+        * wtf/Assertions.h: Revert r52337.
+        * wtf/Compiler.h:
+        * wtf/ListRefPtr.h: Revert r48988.
+        (WTF::ListRefPtr::~ListRefPtr):
+        * wtf/OwnArrayPtr.h: Revert r45911.
+        (WTF::OwnArrayPtr::operator UnspecifiedBoolType):
+        * wtf/PassOwnArrayPtr.h:
+        (WTF::PassOwnArrayPtr::operator UnspecifiedBoolType):
+        * wtf/PassRefPtr.h:
+        * wtf/StaticConstructors.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+
+2011-11-12  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Add ENABLE(DFG_JIT) around DFGCorrectableJumpPoint code.
+
+        * dfg/DFGCorrectableJumpPoint.cpp:
+        * dfg/DFGCorrectableJumpPoint.h:
+
+2011-11-12  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Move list of DFG source files into correct file
+        https://bugs.webkit.org/show_bug.cgi?id=72212
+
+        Reviewed by Daniel Bates.
+
+        The DFG files are platform independent. So move them from
+        the EFL specific file into the general CMakeLists.txt.
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake:
+
+2011-11-12  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix "unused variable" warning in JSLock
+        https://bugs.webkit.org/show_bug.cgi?id=72213
+
+        Reviewed by Anders Carlsson.
+
+        Use ASSERT_UNUSED() instead of ASSERT() to make sure
+        that the variable is also used in the release build.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+
+2011-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Update iOS compiler version.
+
+        Reviewed by David Kilzer.
+
+        * Configurations/CompilerVersion.xcconfig:
+            - Update compiler version.
+
+2011-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Update iOS port's configuration setting, particularly in Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=72187
+        
+        Reviewed by David Kilzer.
+
+        * interpreter/Interpreter.h:
+            - Lower the reentry depth.
+        * runtime/DatePrototype.cpp:
+            - iOS also uses CF.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::IncrementalScavenge):
+            - Update fastmalloc configuration for iOS.
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+            - Added flag.
+        * wtf/Platform.h:
+            - Update platform configuration for iOS.
+
+2011-11-11  David Kilzer  <ddkilzer@apple.com>
+
+        Only define BUILDING_ON_* and TARGETING_* macros when building for Mac OS X
+        <http://webkit.org/b/72175>
+
+        Reviewed by Joseph Pecoraro.
+
+        * wtf/Platform.h: Move the definition of the BUILDING_ON_* and
+        TARGETING_* macros to where the WTF_OS_MAC_OS_X macro is defined
+        so that they're only defined on Mac OS X builds.  Also include
+        Availability.h, which is needed on iOS builds.
+
+2011-11-11  Darin Adler  <darin@apple.com>
+
+        Remove all releaseRef implementations except for RetainPtr
+        https://bugs.webkit.org/show_bug.cgi?id=71423
+
+        Reviewed by Julien Chaffraix.
+
+        * API/JSRetainPtr.h: Removed releaseRef.
+        * wtf/PassRefPtr.h: Removed releaseRef.
+
+2011-11-11  Darin Adler  <darin@apple.com>
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Let a newer Xcode update this file.
+        If an older Xcode downgrades this file and we have a risk of some kind of
+        oscillating commit situation, please contact me so I know not to do this again.
+
+2011-11-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add jsCast to replace static_cast
+        https://bugs.webkit.org/show_bug.cgi?id=72071
+
+        Reviewed by Geoffrey Garen.
+
+        Added new jsCast and changed all of the static_cast sites in functions that 
+        are in the MethodTable to use jsCast instead.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::toStringCallback):
+        (JSC::JSCallbackFunction::valueOfCallback):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::className):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::getOwnPropertyDescriptor):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::deletePropertyByIndex):
+        (JSC::::getConstructData):
+        (JSC::::hasInstance):
+        (JSC::::getCallData):
+        (JSC::::getOwnPropertyNames):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::visitChildren):
+        (JSC::DebuggerActivation::className):
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putWithAttributes):
+        (JSC::DebuggerActivation::deleteProperty):
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        (JSC::DebuggerActivation::defineGetter):
+        (JSC::DebuggerActivation::defineSetter):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        (JSC::Arguments::getOwnPropertySlotByIndex):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::getOwnPropertyNames):
+        (JSC::Arguments::putByIndex):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deletePropertyByIndex):
+        (JSC::Arguments::deleteProperty):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        (JSC::ArrayConstructor::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        (JSC::BooleanPrototype::getOwnPropertyDescriptor):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertySlot):
+        (JSC::DateConstructor::getOwnPropertyDescriptor):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertySlot):
+        (JSC::DatePrototype::getOwnPropertyDescriptor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        (JSC::ErrorPrototype::getOwnPropertyDescriptor):
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode):
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putByIndex):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::visitChildren):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::hasInstance):
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlot):
+        (JSC::JSByteArray::getOwnPropertyDescriptor):
+        (JSC::JSByteArray::getOwnPropertySlotByIndex):
+        (JSC::JSByteArray::put):
+        (JSC::JSByteArray::putByIndex):
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSCell.h:
+        (JSC::JSCell::visitChildren):
+        (JSC::jsCast):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::getOwnPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::getConstructData):
+        * runtime/JSGlobalData.cpp:
+        (JSC::StackPreservingRecompiler::operator()):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::defineGetter):
+        (JSC::JSGlobalObject::defineSetter):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        (JSC::JSGlobalObject::clearRareData):
+        * runtime/JSGlobalThis.cpp:
+        (JSC::JSGlobalThis::visitChildren):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        (JSC::JSONObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::finalize):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::deletePropertyByIndex):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnPropertySlot):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::visitChildren):
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        (JSC::JSStaticScopeObject::getOwnPropertySlot):
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren):
+        (JSC::JSString::toThisObject):
+        (JSC::JSString::getOwnPropertySlot):
+        (JSC::JSString::getOwnPropertySlotByIndex):
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::deleteProperty):
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        (JSC::MathObject::getOwnPropertyDescriptor):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        (JSC::NumberPrototype::getOwnPropertyDescriptor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        (JSC::ObjectConstructor::getOwnPropertyDescriptor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put):
+        (JSC::ObjectPrototype::getOwnPropertySlotByIndex):
+        (JSC::ObjectPrototype::getOwnPropertySlot):
+        (JSC::ObjectPrototype::getOwnPropertyDescriptor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        (JSC::RegExpConstructor::getOwnPropertyDescriptor):
+        (JSC::RegExpConstructor::put):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::getOwnPropertySlotByIndex):
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::putByIndex):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::deletePropertyByIndex):
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildren):
+        (JSC::RegExpObject::getOwnPropertySlot):
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        (JSC::RegExpObject::put):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        (JSC::RegExpPrototype::getOwnPropertyDescriptor):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::visitChildren):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getOwnPropertySlot):
+        (JSC::StringConstructor::getOwnPropertyDescriptor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertySlot):
+        (JSC::StringObject::getOwnPropertySlotByIndex):
+        (JSC::StringObject::getOwnPropertyDescriptor):
+        (JSC::StringObject::deleteProperty):
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertySlot):
+        (JSC::StringPrototype::getOwnPropertyDescriptor):
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+
+2011-11-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Enable DFG JIT for ARMv7/iOS.
+
+        Rubber stamped by Oliver Hunt.
+
+        * wtf/Platform.h:
+            - enable DFG JIT for ARMv7/iOS.
+
+2011-11-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize supportsProfiling, supportsRichSourceInfo, shouldInterruptScript in JSGlobalObject
+        https://bugs.webkit.org/show_bug.cgi?id=72035
+
+        Reviewed by Geoffrey Garen.
+
+        De-virtualized the methods through the use of a new method table just for JSGlobalObject and subclasses.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecompiler/BytecodeGenerator.cpp: Changed call sites to use the new GlobalObjectMethodTable.
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * interpreter/Interpreter.cpp: Ditto.
+        (JSC::Interpreter::execute):
+        * runtime/JSGlobalObject.cpp: Added a static const GlobalObjectMethodTable with the correct function pointers.
+        * runtime/JSGlobalObject.h: Added a field in JSGlobalObject to keep track of the current method table.
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::globalObjectMethodTable): The new struct to contain the function pointers.
+        (JSC::JSGlobalObject::supportsProfiling): Made static to put in the method table.
+        (JSC::JSGlobalObject::supportsRichSourceInfo): Ditto.
+        (JSC::JSGlobalObject::shouldInterruptScript): Ditto.
+        * runtime/TimeoutChecker.cpp: Changed call sites to use the new GlobalObjectMethodTable for lookup.
+        (JSC::TimeoutChecker::didTimeOut):
+
+2011-11-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSGlobalObject::allowsAccessFrom
+        https://bugs.webkit.org/show_bug.cgi?id=71969
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSGlobalObject.h: Removed allowsAccessFrom from JSGlobalObject since it is exclusive to 
+        JSDOMWindowBase and WebScriptObject.
+
+2011-11-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r99950.
+        http://trac.webkit.org/changeset/99950
+        https://bugs.webkit.org/show_bug.cgi?id=72117
+
+        "Landed wrong patch by mistake" (Requested by yurys on
+        #webkit).
+
+        * JavaScriptCore.exp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+
+2011-11-11  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r99898.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2011-11-10  Dan Bernstein  <mitz@apple.com>
+
+        Disabling assertions breaks the debug build
+        https://bugs.webkit.org/show_bug.cgi?id=72091
+
+        Reviewed by Geoff Garen.
+
+        * dfg/DFGNode.h: Made hasIdentifier() available when assertions are
+        disabled. It is used in Graph::dump().
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren): Update m_isCheckingForDefaultMarkViolation
+        only if assertions are enabled.
+        * wtf/Deque.h:
+        (WTF::::checkIndexValidity): Changed ASSERT to ASSERT_UNUSED.
+        * wtf/ThreadRestrictionVerifier.h:
+        (WTF::ThreadRestrictionVerifier::setShared): Guarded the definition of
+        a local variable that is only used in an assertion.
+
+2011-11-10  Filip Pizlo  <fpizlo@apple.com>
+
+        JSString forgets to clear m_fibers when resolving ropes
+        https://bugs.webkit.org/show_bug.cgi?id=72089
+
+        Reviewed by Geoff Garen.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRopeSlowCase):
+
+2011-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG byte array support sometimes clamps values incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=71975
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+
+2011-11-10  Filip Pizlo  <fpizlo@apple.com>
+
+        ValueProfile/PredictedType contains dead code, and doesn't recognize functions
+        https://bugs.webkit.org/show_bug.cgi?id=72065
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+        
+        Added PredictFunction support, and did some cleaning up along the way.
+        ValueProfile no longer has statistics machinery, because we never used
+        it. Rearranged some bits in PredictedType to more easily make room for
+        one more object type. Changed some debug code to use more consistent
+        conventions (ByteArray becomes Bytearray so that if we ever have a
+        "Byte" prediction we don't get confused between a prediction that is
+        the union of Byte and Array and a prediction that indicates precisely
+        a ByteArray).
+
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionFromClassInfo):
+        * bytecode/PredictedType.h:
+        (JSC::isFunctionPrediction):
+        * bytecode/ValueProfile.cpp:
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+
+2011-11-10  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/72049> Specify testapi.js install path using JAVASCRIPTCORE_FRAMEWORKS_DIR
+
+        Reviewed by Joseph Pecoraro.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: The testapi.js
+        script should use JAVASCRIPTCORE_FRAMEWORKS_DIR in its dstPath
+        for installation.  Also removed "Versions/A/" from the path
+        since this is unneeded due the default symlinks present in the
+        framework.
+
+2011-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Add ARMv7 support to the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=72061
+
+        Reviewed by Geoff Garen.
+
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::preserveReturnAddressAfterCall):
+        (JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):
+        (JSC::DFG::AssemblyHelpers::emitPutImmediateToCallFrameHeader):
+        (JSC::DFG::AssemblyHelpers::boxDouble):
+        (JSC::DFG::AssemblyHelpers::unboxDouble):
+            - Add CPU(ARM) copies of these functions.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::spill):
+            - Fix matching of '}' re #if blocks, makes some tools happy.
+        (JSC::DFG::JITCodeGenerator::setupArguments):
+        (JSC::DFG::JITCodeGenerator::setupArgumentsWithExecState):
+        (JSC::DFG::JITCodeGenerator::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::JITCodeGenerator::appendCallSetResult):
+            - Add CPU(ARM) / 4 argument register copies of these functions.
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+            - Should use callOperation to plant a call to a DFG_OPERATION.
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+            - These methods need to plant a relinkable jump; we currently do so
+              using beginUninterruptedSequence() / endUninterruptedSequence().
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+            - Should use callOperation to plant a call to a DFG_OPERATION.
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+            - This method needs to plant a relinkable jump; we currently do so
+              using beginUninterruptedSequence() / endUninterruptedSequence().
+        (JSC::DFG::JITCompiler::compileBody):
+            - Add abstraction to retrieve the pc after a call.
+        * dfg/DFGOSRExitCompiler.cpp:
+            - Fix a bug - CodeLocationLabel needs a data address rather than an
+              executable one, but can just take a MacroAssemblerCodePtr instead!
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::compileClampDoubleToByte):
+            - Add FIXME comment to come back to! - bug#72054.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+            - Add missing method (ooops, required by bug#72047)
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+            - Need to wrap fmod on ARMv7.
+
+
+2011-11-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not reparse code that was just parsed
+        https://bugs.webkit.org/show_bug.cgi?id=71977
+
+        Reviewed by Geoff Garen.
+        
+        The instruction stream of a code block is now kept around until
+        the next GC. When doing either an optimizing compilation of an
+        executable, or inlining of an executable, we now try to find the
+        already preexisting bytecode. If we find it, we don't have to parse.
+        If we don't find it, we parse as before. Inlining takes the extra
+        step of caching code blocks, so if the same executable gets inlined
+        multiple times into the same caller, then we parse it at most once
+        even if prior to inlining that executable did not have any code
+        blocks with an instruction stream.
+        
+        Also fixed a silly bug where the strict mode for various operations
+        was being determined by looking at the machine code block rather
+        than the inlinee.
+
+        To enable the delete-on-next-GC policy, I introduced the notion
+        of an ultra weak finalizer, which anyone can register during
+        tracing. This is thread-safe (for parallel GC) and
+        stop-the-world-safe (so calls to free() are postponed until the
+        world is resumed). This required reusing some facilities previously
+        created for WeakReferenceHarvester, so I created a common utility
+        class. I also retweaked the handling of WeakReferenceHarvesters,
+        since they should be executed during stop-the-world since in the
+        future we may want to allow them to call drain().
+        
+        2% win on SunSpider. 2% win on V8, when run in my harness. Neutral
+        elsewhere.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::copyPostParseDataFrom):
+        (JSC::CodeBlock::copyPostParseDataFromAlternative):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::canProduceCopyWithBytecode):
+        (JSC::CodeBlock::discardBytecodeLater):
+        (JSC::CodeBlock::handleBytecodeDiscardingOpportunity):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::BytecodeDestructionBlocker::BytecodeDestructionBlocker):
+        (JSC::BytecodeDestructionBlocker::~BytecodeDestructionBlocker):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::strictModeFor):
+        * dfg/DFGByteCodeCache.h: Added.
+        (JSC::DFG::CodeBlockKey::CodeBlockKey):
+        (JSC::DFG::CodeBlockKey::operator==):
+        (JSC::DFG::CodeBlockKey::hash):
+        (JSC::DFG::CodeBlockKey::executable):
+        (JSC::DFG::CodeBlockKey::kind):
+        (JSC::DFG::CodeBlockKey::isHashTableDeletedValue):
+        (JSC::DFG::CodeBlockKeyHash::hash):
+        (JSC::DFG::CodeBlockKeyHash::equal):
+        (JSC::DFG::ByteCodeCache::ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/Heap.cpp:
+        (JSC::Heap::finalizeUnconditionally):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/ListableHandler.h: Added.
+        (JSC::ListableHandler::ListableHandler):
+        (JSC::ListableHandler::~ListableHandler):
+        (JSC::ListableHandler::List::List):
+        (JSC::ListableHandler::List::addNotThreadSafe):
+        (JSC::ListableHandler::List::addThreadSafe):
+        (JSC::ListableHandler::List::hasNext):
+        (JSC::ListableHandler::List::removeNext):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::SlotVisitor::harvestWeakReferences):
+        (JSC::SlotVisitor::finalizeUnconditionally):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::addWeakReferenceHarvester):
+        (JSC::MarkStack::addUnconditionalFinalizer):
+        * heap/SlotVisitor.h:
+        * heap/UnconditionalFinalizer.h: Added.
+        (JSC::UnconditionalFinalizer::~UnconditionalFinalizer):
+        * heap/WeakReferenceHarvester.h:
+        (JSC::WeakReferenceHarvester::WeakReferenceHarvester):
+        (JSC::WeakReferenceHarvester::~WeakReferenceHarvester):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::codeBlockWithBytecodeFor):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::profiledCodeBlockFor):
+
+2011-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Add ARMv7 register info for the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=72050
+
+        Reviewed by Geoff Garen.
+
+        * dfg/DFGFPRInfo.h:
+        (JSC::DFG::FPRInfo::toRegister):
+        (JSC::DFG::FPRInfo::toIndex):
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::GPRInfo::toRegister):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+
+2011-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        #ifdef CPU(X86) specific div/mod code in DFGSpeculativeJIT32_64
+        https://bugs.webkit.org/show_bug.cgi?id=72047
+
+        Reviewed by Geoff Garen.
+
+        We currently don't attempt to abstract divide through the macro assembler,
+        due to these instructions commonly having specific requirements. This means
+        there is architecture specific code in the JIT - #ifdef it, and provide a
+        common implementation.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::fmodAsDFGOperation):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Add ENABLE_VALUE_PROFILER support for ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=72043
+
+        Reviewed by Geoff Garen.
+
+        This requires us to make a bucketCounterRegister available; to do so we'll need to spill more registers on entry to JIT code.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+            - cleanup location of UNUSED_PARAM
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+        (JSC::JITThunks::JITThunks):
+        * jit/JITStubs.h:
+            - Update JITStackFrame structure & asm code to spill more registers.
+        * jit/JSInterfaceJIT.h:
+            - Assign a bucketCounterRegister.
+
+2011-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix sampling counters on ARMv7, move add64 functionality to macro assembler
+        https://bugs.webkit.org/show_bug.cgi?id=72040
+
+        Reviewed by Geoff Garen.
+
+        The ability to add an integer to a uint64_t in memory is poorly copied in
+        multiple places & ifdef'ed on architecture, addWithCarry32 is also a badly
+        designed interface since add32 is not required to set flags (we have no
+        concept of flags in the macro assembler interface).
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::add64):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add64):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add64):
+        * dfg/DFGAssemblyHelpers.cpp:
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::emitCount):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::writeBarrier):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitCount):
+
+011-11-10  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [CMAKE] Refactoring CMakeLists${PORT}.txt to Platform${PORT}.cmake
+        https://bugs.webkit.org/show_bug.cgi?id=56705
+
+        Reviewed by Adam Roben.
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake: Renamed from Source/JavaScriptCore/CMakeListsEfl.txt.
+        * PlatformWinCE.cmake: Renamed from Source/JavaScriptCore/CMakeListsWinCE.txt.
+        * shell/CMakeLists.txt:
+        * shell/PlatformEfl.cmake: Renamed from Source/JavaScriptCore/shell/CMakeListsEfl.txt.
+        * shell/PlatformWinCE.cmake: Renamed from Source/JavaScriptCore/shell/CMakeListsWinCE.txt.
+        * wtf/CMakeLists.txt:
+        * wtf/PlatformEfl.cmake: Renamed from Source/JavaScriptCore/wtf/CMakeListsEfl.txt.
+        * wtf/PlatformWinCE.cmake: Renamed from Source/JavaScriptCore/wtf/CMakeListsWinCE.txt.
+
+2011-11-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck build.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2011-11-09  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8 Bit Strings: Templatize JSC::LiteralParser class by character type
+        https://bugs.webkit.org/show_bug.cgi?id=71862
+
+        Changed LiteralParser to be templatized of character type.
+
+        Moved five enums out of class definition to work around a clang compiler defect.
+
+        Added lexIdentifier templated method to break out character specific versions.
+        Added static setParserTokenString templated method to handle setting approriately
+        sized string pointer.
+
+        To keep code in LiteralParser.cpp and keep LiteralParser.h small, the two
+        flavors of LiteralParser are explicitly instantiated at the end of
+        LiteralParser.cpp.
+
+        Reviewed by Oliver Hunt.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::execute):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::isJSONWhiteSpace):
+        (JSC::::tryJSONPParse):
+        (JSC::::makeIdentifier):
+        (JSC::::Lexer::lex):
+        (JSC::::Lexer::lexIdentifier):
+        (JSC::::Lexer::next):
+        (JSC::LChar):
+        (JSC::UChar):
+        (JSC::isSafeStringCharacter):
+        (JSC::::Lexer::lexString):
+        (JSC::::Lexer::lexNumber):
+        (JSC::::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::getErrorMessage):
+        (JSC::LiteralParser::tryLiteralParse):
+        (JSC::LiteralParser::Lexer::Lexer):
+        (JSC::LiteralParser::Lexer::currentToken):
+        (JSC::LiteralParser::Lexer::getErrorMessage):
+        * runtime/UString.h:
+        (JSC::LChar):
+        (JSC::UChar):
+        * wtf/text/StringBuilder.cpp:
+        (WTF::StringBuilder::append):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::append):
+
+2011-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Multiple CodeBlock should be able to share the same instruction
+        stream without copying
+        https://bugs.webkit.org/show_bug.cgi?id=71978
+
+        Reviewed by Oliver Hunt.
+        
+        This refactors CodeBlock::m_instructions to be a Vector boxed in a
+        ref-counted object, but otherwise does not take advantage of this.
+        
+        This is performance neutral.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasInstructions):
+        (JSC::CodeBlock::numberOfInstructions):
+        (JSC::CodeBlock::instructions):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+
+2011-11-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Renovate ARMv7 assembler/macro-assembler
+        https://bugs.webkit.org/show_bug.cgi?id=71982
+
+        Reviewed by Geoff Garen.
+
+        ARMv7Assembler:
+        * add support for strb (byte stores)
+        * rename the VMOV_CtoS opcodes (there are currently backwards!)
+        * add support for adc (add with carry)
+        * add support for vsqrt, vabs
+        * add support for vmov (between FPRs, and to/from GPR pairs).
+        * remove '_F64' postfixes from instructions (these aren't helpful, functions can already be distinguished by their signatures).
+        * rename vcvt_F64_S32  to vcvt_signedToFloatingPoint, the prior postfix was unhelpful in failing to distinguish the types (S32 indicates a single precision register, but the type could be float, int32, or uint32).
+        * rename vcvtr_S32_F64 to vcvt_floatingPointToSigned, as for previous, also vcvtr was the incorrect name for the operation (the emitted instruction truncates).
+
+        MacroAssemblerARMv7:
+        * add 3-operand versions of and32, lshift32, or32, rshift32, urshift32, sub32, xor32, 
+        * add store8, and store32 imm to base-index.
+        * fix load32WithCompactAddressOffsetPatch to work for all gprs (the fix is a little kludgy but functional; to do better we'll have to also fix the repatching code).
+        * Update supportsFloating* flags (all features now supported).
+        * add moveDouble, storeDouble to absolute address, addDouble to absolute address
+        * add 3-operand double operations.
+        * implement sqrtDouble/absDouble
+        * add branchTruncateDoubleToInt32, implement truncateDoubleToInt32
+        * move should do nothing if src == dest
+        * branchTest8-on-memory can be implemented in terms of branchTest32-on-register (branchTest8-on-register has been removed).
+        * add 3-operand branchAdd32, branchSub32, also branchAdd32 absolute address.
+
+2011-11-09  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=71873
+
+        Reviewed by Geoff Garen.
+
+        Incrementally re-landing these changes, trying to determine what went wrong.
+        (The whole patch failed tests on the build bot but worked locally.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+
+2011-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit code should be lazily generated
+        https://bugs.webkit.org/show_bug.cgi?id=71744
+
+        Reviewed by Gavin Barraclough.
+        
+        The OSR exit code is now generated the first time it is executed,
+        rather than right after speculative compilation. Because most OSR
+        exits are never taken, this should greatly reduce both code size
+        and compilation time.
+        
+        This is a 1% win on SunSpider, and a 1% win on V8 when running in
+        my harness. No change in V8 in V8's harness (due to the long runs,
+        so compile time is not an issue) and no change in Kraken (again,
+        long runs of small code so compile time has no measurable effect).
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::jump):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::jump):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jmp_m):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::createDFGDataIfNecessary):
+        (JSC::CodeBlock::appendDFGOSREntryData):
+        (JSC::CodeBlock::numberOfDFGOSREntries):
+        (JSC::CodeBlock::dfgOSREntryData):
+        (JSC::CodeBlock::dfgOSREntryDataForBytecodeIndex):
+        (JSC::CodeBlock::appendOSRExit):
+        (JSC::CodeBlock::appendSpeculationRecovery):
+        (JSC::CodeBlock::numberOfOSRExits):
+        (JSC::CodeBlock::numberOfSpeculationRecoveries):
+        (JSC::CodeBlock::osrExit):
+        (JSC::CodeBlock::speculationRecovery):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        * dfg/DFGCorrectableJumpPoint.cpp: Added.
+        (JSC::DFG::CorrectableJumpPoint::codeLocationForRepatch):
+        * dfg/DFGCorrectableJumpPoint.h: Added.
+        (JSC::DFG::CorrectableJumpPoint::CorrectableJumpPoint):
+        (JSC::DFG::CorrectableJumpPoint::switchToLateJump):
+        (JSC::DFG::CorrectableJumpPoint::correctInitialJump):
+        (JSC::DFG::CorrectableJumpPoint::correctLateJump):
+        (JSC::DFG::CorrectableJumpPoint::initialJump):
+        (JSC::DFG::CorrectableJumpPoint::lateJump):
+        (JSC::DFG::CorrectableJumpPoint::correctJump):
+        (JSC::DFG::CorrectableJumpPoint::getJump):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExit.cpp: Added.
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::dump):
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler.cpp: Added.
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        * dfg/DFGThunks.cpp: Added.
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+        * dfg/DFGThunks.h: Added.
+        * jit/JITCode.h:
+        (JSC::JITCode::dataAddressAtOffset):
+        * runtime/JSGlobalData.h:
+
+2011-11-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing build breakage
+
+        Unreviewed build fix
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-11-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSVariableObject::isDynamicScope
+        https://bugs.webkit.org/show_bug.cgi?id=71933
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h: Inlined and de-virtualized isDynamicScope
+        (JSC::JSActivation::isDynamicScope):
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h: Inlined and de-virtualized isDynamicScope
+        (JSC::JSGlobalObject::isDynamicScope):
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h: Inlined and de-virtualized isDynamicScope
+        (JSC::JSStaticScopeObject::createStructure): Changed createStructure to use new JSType
+        (JSC::JSStaticScopeObject::isDynamicScope):
+        * runtime/JSType.h: Added new type for JSStaticScopeObject
+        * runtime/JSVariableObject.cpp: De-virtualized and added an implementation that checks the 
+        object's type and calls the corresponding implementation.
+        (JSC::JSVariableObject::isDynamicScope):
+        * runtime/JSVariableObject.h:
+
+2011-11-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSGlobalObject::hasOwnPropertyForWrite
+        https://bugs.webkit.org/show_bug.cgi?id=71934
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGlobalObject.h: Removed the virtual-ness of hasOwnPropertyForWrite since nobody overrides it.
+
+2011-11-09  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=71873
+
+        Reviewed by Geoff Garen.
+
+        Incrementally re-landing these changes, trying to determine what went wrong.
+        (The whole patch failed tests on the build bot but worked locally.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::absDouble):
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::absDouble):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::absDouble):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::absDouble):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::absDouble):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/ThunkGenerators.cpp:
+        (JSC::absThunkGenerator):
+
+2011-11-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=71523
+
+        Reviewed by Sam Weinig.
+
+        Added getOwnPropertyDescriptor to the MethodTable, changed all of the 
+        virtual versions of getOwnPropertyDescriptor to static ones, and 
+        changed all of the call sites to the corresponding lookup in the MethodTable.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyDescriptor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyDescriptor):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        * runtime/Arguments.h:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getOwnPropertyDescriptor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertyDescriptor):
+        * runtime/BooleanPrototype.h:
+        * runtime/ClassInfo.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertyDescriptor):
+        * runtime/DateConstructor.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertyDescriptor):
+        * runtime/DatePrototype.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertyDescriptor):
+        * runtime/ErrorPrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyDescriptor):
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertyDescriptor):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyDescriptor):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertyDescriptor):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::vtableAnchor):
+        (JSC::JSObject::propertyIsEnumerable):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::getPropertyDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp: Removed getOwnPropertyDescriptor, since this seems to be a relic from a 
+        bygone era when getOwnPropertyDescriptor was rooted in JSCell rather than JSObject.  There were 
+        no call sites for this version of getOwnPropertyDescriptor in the entire project.
+        * runtime/JSString.h:
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticFunctionDescriptor):
+        (JSC::getStaticValueDescriptor):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertyDescriptor):
+        * runtime/MathObject.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertyDescriptor):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::getOwnPropertyDescriptor):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertyDescriptor):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertyDescriptor):
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertyDescriptor):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getOwnPropertyDescriptor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::vtableAnchor): Added to prevent a weak vtable.
+        (JSC::StringObject::getOwnPropertyDescriptor):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertyDescriptor):
+        * runtime/StringPrototype.h:
+
+2011-11-09  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=71873
+
+        Reviewed by Geoff Garen.
+
+        Incrementally re-landing these changes, trying to determine what went wrong.
+        (The whole patch failed tests on the build bot but worked locally.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARM::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARM::supportsFloatingPointAbs):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPoint):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointAbs):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::supportsFloatingPoint):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointAbs):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::supportsFloatingPoint):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointAbs):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::supportsFloatingPoint):
+        (JSC::MacroAssemblerX86::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerX86::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerX86::supportsFloatingPointAbs):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::supportsFloatingPoint):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointAbs):
+        * jit/ThunkGenerators.cpp:
+        (JSC::absThunkGenerator):
+
+2011-11-08  Darin Adler  <darin@apple.com>
+
+        Add code path in HashTable for emptyValueIsZero that does not require copying the empty value
+        https://bugs.webkit.org/show_bug.cgi?id=71875
+
+        Reviewed by Anders Carlsson.
+
+        This is a step along the path of making OwnPtr work as HashMap value types.
+
+        * wtf/Alignment.h: Moved the AlignedBufferChar and AlignedBuffer types from Vector.h here.
+        Also fixed include style. To include other WTF headers inside WTF, we use "" includes.
+        I did not change the code to fix style checker complaints.
+
+        * wtf/HashTable.h: Added includes as needed and fixed include style.
+        (WTF::doubleHash): Removed the uneeeded and inappropriate "static" in this function, which
+        gave it internal linkage for no good reason.
+        (WTF::HashTable::checkKey): Made this use AlignedBuffer for the deleted value check to avoid
+        construction/destruction problems instead of doing the trick where we construct and destroy
+        an empty value twice. It's cleaner and simpler and avoids copying the empty value.
+        (WTF::HashTable::initializeBucket): Specialized initializeBucket to use memset when the
+        empty value is zero rather than copying an empty value.
+
+        * wtf/Vector.h: Moved the AlignedBufferChar and AlignedBuffer types into Alignment.h.
+
+2011-11-09  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Buildfix for 32bit debug mode.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+
+2011-11-09  Andy Wingo  <wingo@igalia.com>
+
+        Enable the DFG JIT on X86-64 Linux platforms
+        https://bugs.webkit.org/show_bug.cgi?id=71373
+
+        Reviewed by Csaba Osztrogonác.
+
+        * wtf/Platform.h (ENABLE_DFG_JIT): Enable the DFG JIT on the
+        x86-64 GNU/Linux platform.
+        * CMakeListsEfl.txt: Add JSValue64 implementations to EFL build.
+
+2011-11-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Enable the DFG JIT on x86-64 Linux platforms
+        https://bugs.webkit.org/show_bug.cgi?id=71373
+
+        Enable DFG JIT by default on X86 Linux and Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=71686
+
+        Buildfix for stricter compilers: -Werror=unused-but-set-variable
+
+        Reviewed by Zoltan Herczeg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r99678.
+        http://trac.webkit.org/changeset/99678
+        https://bugs.webkit.org/show_bug.cgi?id=71882
+
+        broke the build with -Werror=unused-but-set-variable
+        (Requested by tronical_ on #webkit).
+
+        * CMakeListsEfl.txt:
+        * wtf/Platform.h:
+
+2011-11-09  Andy Wingo  <wingo@igalia.com>
+
+        Enable the DFG JIT on X86-64 Linux platforms
+        https://bugs.webkit.org/show_bug.cgi?id=71373
+
+        Reviewed by Filip Pizlo.
+
+        * wtf/Platform.h (ENABLE_DFG_JIT): Enable the DFG JIT on the
+        x86-64 GNU/Linux platform.
+        * CMakeListsEfl.txt: Add JSValue64 implementations to EFL build.
+
+2011-11-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::defineOwnProperty
+        https://bugs.webkit.org/show_bug.cgi?id=71429
+
+        Reviewed by Geoffrey Garen.
+
+        Added defineOwnProperty to the MethodTable, changed all the virtual 
+        implementations of defineOwnProperty to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::createStrictModeCallerIfNecessary):
+        (JSC::Arguments::createStrictModeCalleeIfNecessary):
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::defineOwnProperty):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorDefineProperty):
+        (JSC::defineProperties):
+
+2011-11-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Build system cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=71815
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * wtf/wtf.pri: Moved the glib dependency to javascriptcore.prf.
+
+2011-11-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Replace use of QApplication with QGuiApplication
+        https://bugs.webkit.org/show_bug.cgi?id=71794
+
+        Reviewed by Andreas Kling.
+
+        Add compat headers for use when building with Qt 4: QGuiApplication
+        is typedef'ed to QApplication.
+
+        * wtf/qt/compat/QGuiApplication: Added.
+        * wtf/qt/compat/qguiapplication.h: Added.
+
+2011-11-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r99647.
+        http://trac.webkit.org/changeset/99647
+        https://bugs.webkit.org/show_bug.cgi?id=71876
+
+        It broke jsc and layout tests on all bot (Requested by
+        Ossy_night on #webkit).
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARM::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARM::supportsDoubleBitops):
+        (JSC::MacroAssemblerARM::andnotDouble):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPoint):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARMv7::supportsDoubleBitops):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::andnotDouble):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPoint):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerMIPS::supportsDoubleBitops):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::supportsFloatingPoint):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerSH4::supportsDoubleBitops):
+        (JSC::MacroAssemblerSH4::andnotDouble):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::supportsFloatingPoint):
+        (JSC::MacroAssemblerX86::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerX86::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerX86::supportsDoubleBitops):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::andnotDouble):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::supportsFloatingPoint):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerX86_64::supportsDoubleBitops):
+        * assembler/X86Assembler.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/ThunkGenerators.cpp:
+        (JSC::absThunkGenerator):
+        * runtime/JSGlobalData.cpp:
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Better abstract 'abs' operation through the MacroAssembler.
+        https://bugs.webkit.org/show_bug.cgi?id=71873
+
+        Reviewed by Geoff Garen.
+
+        Currently the x86 specific instruction sequence to perform a double abs
+        is duplicated throughout the JITs / thunk generators.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPoint):
+        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARM::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARM::supportsFloatingPointAbs):
+        (JSC::MacroAssemblerARM::absDouble):
+            - Renamed supportsFloatingPointAbs, make these methods static so that
+              we can check the JIT's capabilites before we begin compilation.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPoint):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointAbs):
+            - Renamed supportsFloatingPointAbs, make these methods static so that
+              we can check the JIT's capabilites before we begin compilation.
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::absDouble):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPoint):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointAbs):
+            - Renamed supportsFloatingPointAbs, make these methods static so that
+              we can check the JIT's capabilites before we begin compilation.
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::supportsFloatingPoint):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointAbs):
+        (JSC::MacroAssemblerSH4::absDouble):
+            - Renamed supportsFloatingPointAbs, make these methods static so that
+              we can check the JIT's capabilites before we begin compilation.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::absDouble):
+        (JSC::MacroAssemblerX86::supportsFloatingPoint):
+        (JSC::MacroAssemblerX86::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerX86::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerX86::supportsFloatingPointAbs):
+            - Made supports* methods static so that we can check the JIT's
+              capabilites before we begin compilation. Added absDouble.
+        * assembler/MacroAssemblerX86Common.h:
+            - Removed andnotDouble, added s_maskSignBit.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::absDouble):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPoint):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointAbs):
+            - Made supports* methods static so that we can check the JIT's
+              capabilites before we begin compilation. Added absDouble.
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::andpd_rr):
+        (JSC::X86Assembler::andpd_mr):
+            - Added support for andpd instruction.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+            - Added checks for supportsFloatingPointAbs, supportsFloatingPointSqrt.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Switched to use doubleAbs, we can now also reuse the operand register for the result.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Switched to use doubleAbs, we can now also reuse the operand register for the result.
+        * jit/ThunkGenerators.cpp:
+            - Switched to use doubleAbs.
+        (JSC::absThunkGenerator):
+        * runtime/JSGlobalData.cpp:
+            - Declared MacroAssemblerX86Common::s_maskSignBit here.
+              This is a little ugly, but it doesn't seem worth adding a whole extra .cpp
+              to the compile for just one constant.
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Move duplicates of SYMBOL_STRING* macros to the single location
+        https://bugs.webkit.org/show_bug.cgi?id=71456
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        * wtf/InlineASM.h: Added.
+            - Moved asm related macros.
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Move code to handle 8bit regs from X86Assembler to MacroAssembler
+        https://bugs.webkit.org/show_bug.cgi?id=71867
+
+        Reviewed by Oliver Hunt.
+
+        This code is fine, but is in the wrong place really. X86 assembler should
+        basically just format up exactly the instruction you request - not expand
+        out to a set of instructions (that is what the macro assembler layer is
+        for!). For other 8-bit ops, on X86 we don't guard against clients accessing
+        the XH registers.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::store8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movb_rm):
+            - moved some code.
+
+2011-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for GTK.
+
+        * GNUmakefile.list.am:
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix.
+
+        * assembler/X86Assembler.h:
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Errrk, failed to commit this in last change.
+
+        * assembler/X86Assembler.h:
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove an unused method.
+
+        Rubber stamped by Geoff Garen.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBuffer.h:
+            - removed rewindToLabel.
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix OSR entry points to calculate offsets correctly WRT to branch compaction.
+        https://bugs.webkit.org/show_bug.cgi?id=71864
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::offsetOf):
+            - We use this to return the offsets into the code of the entry points.
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+            - Move the construction of the speculative JIT outside of
+              compileBody, such that it is still available to link the
+              OSR entry points at the point we are linking.
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+            - Pass the label of the block & linkbuffer into noticeOSREntry.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::linkOSREntries):
+            - Moved call to noticeOSREntry until we we linking.
+        * dfg/DFGSpeculativeJIT.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+            - Moved calculation of entries until we we linking.
+        * jit/JIT.h:
+            - Removed some members.
+
+2011-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit code should be generated by a separate compiler, not
+        related to DFG::JITCompiler
+        https://bugs.webkit.org/show_bug.cgi?id=71787
+
+        Reviewed by Gavin Barraclough.
+        
+        Moves the exitSpeculativeWithOSR() method from JITCompiler to
+        OSRExitCompiler::compileExit().
+
+        * CMakeListsEfl.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        * dfg/DFGJITCompiler32_64.cpp: Removed.
+        * dfg/DFGOSRExitCompiler.h: Added.
+        (JSC::DFG::OSRExitCompiler::OSRExitCompiler):
+        * dfg/DFGOSRExitCompiler32_64.cpp: Added.
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp: Added.
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * runtime/JSValue.h:
+
+2011-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Basic DFG definitions should be moved out of DFGNode.h
+        https://bugs.webkit.org/show_bug.cgi?id=71861
+
+        Rubber-stamped by Gavin Barraclough.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGCommon.h: Added.
+        (JSC::DFG::NodeIndexTraits::defaultValue):
+        * dfg/DFGNode.h:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGRegisterBank.h:
+
+2011-11-08  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8 Bit Strings: Templatize JSC::Parser class by Lexer type
+        https://bugs.webkit.org/show_bug.cgi?id=71761
+
+        Templatized Parser based on Lexer<T>. Moved two enums,
+        SourceElementsMode and FunctionRequirements out of Parser definition
+        to work around a clang compiler defect.
+
+        Cleaned up SourceCode data() to return StringImpl* and eliminated
+        the recently added stringData() virtual method.
+
+        To keep code in Parser.cpp and keep Parser.h small, the two flavors
+        of Parser are explicitly instantiated at the end of Parser.cpp.
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::appendSourceToError):
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::sourceCode):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::~Parser):
+        (JSC::::parseInner):
+        (JSC::::didFinishParsing):
+        (JSC::::allowAutomaticSemicolon):
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseDoWhileStatement):
+        (JSC::::parseWhileStatement):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parseSwitchClauses):
+        (JSC::::parseSwitchDefaultClause):
+        (JSC::::parseTryStatement):
+        (JSC::::parseDebuggerStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseStatement):
+        (JSC::::parseFormalParameters):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseIfStatement):
+        (JSC::::parseExpression):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseConditionalExpression):
+        (JSC::::isBinaryOperator):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::::parse):
+        (JSC::parse):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::data):
+        (JSC::SourceCode::subExpression):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::data):
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix PropertyAccessRecords in DFG JIT to take account of branch compaction.
+        https://bugs.webkit.org/show_bug.cgi?id=71855
+
+        Reviewed by Filip Pizlo.
+
+        The DFG JIT presently calculates a set of offsets early, before branches have been compacted.
+        This won't work on ARMv7.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::differenceBetweenCodePtr):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::locationOf):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+        (JSC::DFG::JITCompiler::addPropertyAccess):
+
+2011-11-08  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG JIT calculation of OSR entry points is not THUMB2 safe
+        https://bugs.webkit.org/show_bug.cgi?id=71852
+
+        Reviewed by Oliver Hunt.
+
+        Executable addresses are tagged with a low bit set to distinguish
+        between THUMB2 and traditional ARM.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * jit/JITCode.h:
+        (JSC::JITCode::executableAddressAtOffset):
+        (JSC::JITCode::start):
+        (JSC::JITCode::size):
+
+2011-11-08  Michael Saboff  <msaboff@apple.com>
+
+        JSC::Parser::Parser leaks Lexer member
+        https://bugs.webkit.org/show_bug.cgi?id=71847
+
+        Changed m_lexer member of Parser to be OwnPtr to fix a memory leak.
+
+        Reviewed by Oliver Hunt.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::Parser):
+        (JSC::Parser::parseFunctionBody):
+        * parser/Parser.h:
+
+2011-11-08  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Enable DFG JIT by default on X86 Linux and Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=71686
+
+        Reviewed by Filip Pizlo.
+
+        We can get 9% on SunSpider, 89% on Kraken and 37% on V8, on Linux X86.
+
+        * wtf/Platform.h:
+
+2011-11-08  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG 32_64 - update make lists for efl, gtk, and Qt ports with DFG change r99519
+        https://bugs.webkit.org/show_bug.cgi?id=71768
+
+        Reviewed by Geoffrey Garen.
+
+        Also includes a fix to make the newly introduced AssemblyHelpers
+        friend of JSValue as we need the Tag definitions.
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * runtime/JSValue.h:
+
+2011-11-07  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Fix gcc 4.4 compilation warnings in DFG 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=71762
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::registersMatched):
+
+2011-11-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG code base should allow for classes not related to DFG::JITCompiler
+        to use DFG idioms
+        https://bugs.webkit.org/show_bug.cgi?id=71746
+
+        Reviewed by Gavin Barraclough.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAssemblyHelpers.cpp: Added.
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        (JSC::DFG::AssemblyHelpers::emitCount):
+        (JSC::DFG::AssemblyHelpers::setSamplingFlag):
+        (JSC::DFG::AssemblyHelpers::clearSamplingFlag):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsInt32):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSInt32):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSNumber):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSDouble):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsCell):
+        * dfg/DFGAssemblyHelpers.h: Added.
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::graph):
+        * dfg/DFGJITCompiler32_64.cpp:
+        * dfg/DFGOSRExit.h: Added.
+        (JSC::DFG::SpeculationRecovery::SpeculationRecovery):
+        (JSC::DFG::SpeculationRecovery::type):
+        (JSC::DFG::SpeculationRecovery::dest):
+        (JSC::DFG::SpeculationRecovery::src):
+        (JSC::DFG::OSRExit::numberOfRecoveries):
+        (JSC::DFG::OSRExit::valueRecovery):
+        (JSC::DFG::OSRExit::isArgument):
+        (JSC::DFG::OSRExit::isVariable):
+        (JSC::DFG::OSRExit::argumentForIndex):
+        (JSC::DFG::OSRExit::variableForIndex):
+        (JSC::DFG::OSRExit::operandForArgument):
+        (JSC::DFG::OSRExit::operandForIndex):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-11-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Switch back to 1+1 value profiling buckets, since it didn't help on arewefastyet,
+        but it appears to help on other benchmarks.
+
+        Rubber stamped by Oliver Hunt.
+
+        * bytecode/ValueProfile.h:
+
+2011-11-07  Ariya Hidayat  <ariya@sencha.com>
+
+        "use strict" can not contain escape sequences or line continuation
+        https://bugs.webkit.org/show_bug.cgi?id=71532
+
+        Reviewed by Darin Adler.
+
+        Store the actual literal length (before the escapes and line
+        continuation are encoded) while parsing the directive and use it
+        for the directive comparison.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parseSourceElements):
+        (JSC::Parser::parseStatement):
+        * parser/Parser.h:
+
+2011-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG operationCreateThis slow path may get the wrong callee in case of inlining
+        https://bugs.webkit.org/show_bug.cgi?id=71647
+
+        Reviewed by Oliver Hunt.
+        
+        No new tests because I only saw this manifest itself when I had other bugs
+        leading to spurious slow path executions.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::putWithAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=71716
+
+        Reviewed by Darin Adler.
+
+        Added putWithAttributes to the MethodTable, changed all the virtual 
+        implementations of putWithAttributes to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::putWithAttributes):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/ClassInfo.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::putWithAttributes):
+        * runtime/JSActivation.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putWithAttributes):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putWithAttributes):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putWithAttributes):
+        (JSC::putDescriptor):
+        * runtime/JSObject.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::putWithAttributes):
+        * runtime/JSVariableObject.h:
+
+2011-11-07  Dmitry Lomov  <dslomov@google.com>
+
+        Unreviewed. Release build fix.
+
+        * parser/Lexer.cpp:
+        (JSC::assertCharIsIn8BitRange):
+
+2011-11-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Switch the value profiler back to 8 buckets, because we suspect that while this
+        is more expensive it's also more stable.
+
+        Rubber stamped by Geoff Garen.
+
+        * bytecode/ValueProfile.h:
+
+2011-11-07  Andrew Wason  <rectalogic@rectalogic.com>
+
+        Uninitialized Heap member var
+        https://bugs.webkit.org/show_bug.cgi?id=71722
+
+        Reviewed by Filip Pizlo.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap): Initialize m_blockFreeingThreadShouldQuit
+
+2011-11-07  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG 32_64 - registers cannot be reused arbitrarily if speculation failures are possible
+        https://bugs.webkit.org/show_bug.cgi?id=71684
+
+        Reviewed by Filip Pizlo.
+
+        Currently in DFG JIT, we try to reuse the physical register of an
+        operand for temporary usage if the current use of the operand is the
+        last use. But sometimes this can be wrong, for example if there are
+        possible speculation failures and we need to fallback to baseline JIT,
+        the value of the operand which is supposed to be hold in the physical
+        register can be modified by register reusing. The fixes the last
+        inspector failures in layout test on Mac 32-bit if switching on DFG.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r99436): Broke Snow Leopard debug build
+        https://bugs.webkit.org/show_bug.cgi?id=71713
+
+        Reviewed by Darin Adler.
+
+        Put the assertion in a template and use template specialization
+        to avoid warning when instantiated with UChar or LChar.
+
+        In the long term, we should have traits for unsigned integral types
+        and use that to specialize template instead of specializing it for UChar and LChar.
+
+        * parser/Lexer.cpp:
+        (JSC::assertCharIsIn8BitRange):
+        (JSC::::append8):
+
+2011-11-07  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [EFL] Support requestAnimationFrame API
+        https://bugs.webkit.org/show_bug.cgi?id=67112
+
+        Reviewed by Andreas Kling.
+
+        Let EFL port use REQUEST_ANIMATION_FRAME_TIMER.
+
+        * wtf/Platform.h:
+
+2011-11-07  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8 Bit Strings: Templatize JSC::Lexer class by character type
+        https://bugs.webkit.org/show_bug.cgi?id=71331
+
+        Change the Lexer class to be a template class based on the character
+        type of the source.  In the process updated the parseIdentifier()
+        and parseString() methods to create 8 bit strings where possible.
+        Also added some helper methods for accumulating temporary string
+        data in the 8 and 16 bit vectors.
+
+        Changed the SourceProvider::data() virtual method to return a
+        StringImpl* instead of a UChar*.
+
+        Updated the KeywordLookup generator to create code to match keywords
+        for both 8 and 16 bit source strings.
+
+        Due to a compiler bug (<rdar://problem/10194295>) moved enum
+        definition outside of Lexer class declaration.  Remove second enum
+        no longer needed.
+
+        Reviewed by Darin Adler.
+
+        * KeywordLookupGenerator.py:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * parser/Lexer.cpp:
+        (JSC::::Lexer):
+        (JSC::::~Lexer):
+        (JSC::::getInvalidCharMessage):
+        (JSC::::currentCharacter):
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::peek):
+        (JSC::::getUnicodeCharacter):
+        (JSC::::shiftLineTerminator):
+        (JSC::::lastTokenWasRestrKeyword):
+        (JSC::::record8):
+        (JSC::::append8):
+        (JSC::::append16):
+        (JSC::::record16):
+        (JSC::::parseIdentifier):
+        (JSC::::parseIdentifierSlowCase):
+        (JSC::::parseString):
+        (JSC::::parseStringSlowCase):
+        (JSC::::parseHex):
+        (JSC::::parseOctal):
+        (JSC::::parseDecimal):
+        (JSC::::parseNumberAfterDecimalPoint):
+        (JSC::::parseNumberAfterExponentIndicator):
+        (JSC::::parseMultilineComment):
+        (JSC::::nextTokenIsColon):
+        (JSC::::lex):
+        (JSC::::scanRegExp):
+        (JSC::::skipRegExp):
+        (JSC::::clear):
+        (JSC::::sourceCode):
+        * parser/Lexer.h:
+        (JSC::Lexer::append16):
+        (JSC::Lexer::currentOffset):
+        (JSC::Lexer::setOffsetFromCharOffset):
+        (JSC::::isWhiteSpace):
+        (JSC::::isLineTerminator):
+        (JSC::::convertHex):
+        (JSC::::convertUnicode):
+        (JSC::::makeIdentifier):
+        (JSC::::setCodeStart):
+        (JSC::::makeIdentifierLCharFromUChar):
+        (JSC::::lexExpectIdentifier):
+        * parser/Parser.cpp:
+        (JSC::Parser::Parser):
+        (JSC::Parser::parseProperty):
+        (JSC::Parser::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::makeIdentifier):
+        (JSC::IdentifierArena::makeIdentifierLCharFromUChar):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::subExpression):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::stringData):
+        * parser/SourceProviderCache.h:
+        * parser/SyntaxChecker.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierTable::add):
+        (JSC::IdentifierLCharFromUCharTranslator::hash):
+        (JSC::IdentifierLCharFromUCharTranslator::equal):
+        (JSC::IdentifierLCharFromUCharTranslator::translate):
+        (JSC::Identifier::add8):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::createLCharFromUChar):
+        (JSC::Identifier::canUseSingleCharacterString):
+        (JSC::IdentifierCharBufferTranslator::hash):
+        (JSC::IdentifierCharBufferTranslator::equal):
+        (JSC::IdentifierCharBufferTranslator::translate):
+        (JSC::Identifier::add):
+        (JSC::Identifier::equal):
+        (JSC::IdentifierTable::add):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::decode):
+        (JSC::parseIntOverflow):
+        (JSC::globalFuncUnescape):
+        * runtime/JSGlobalObjectFunctions.h:
+        (JSC::parseIntOverflow):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::tryJSONPParse):
+        (JSC::LiteralParser::Lexer::lexString):
+        * wtf/text/StringImpl.h:
+
+2011-11-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Put the jsc binary in 'bin' instead of leaving it deep in the build tree
+
+        Allows us to not package up the whole Source/JavaScriptCore directory for the
+        buildbots.
+
+        Reviewed-by Simon Hausmann.
+
+        * jsc.pro:
+
+2011-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r99374): GTK+ build of the jsc binary doesn't like the call
+        to initializeMainThread, and crashes
+        https://bugs.webkit.org/show_bug.cgi?id=71643
+
+        Reviewed by Sam Weinig.
+
+        * jsc.cpp:
+        (main):
+
+2011-11-06  Sam Weinig  <sam@webkit.org>
+
+        Add space missing from some class declarations
+        https://bugs.webkit.org/show_bug.cgi?id=71632
+
+        Reviewed by Anders Carlsson.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * bytecode/CodeBlock.h:
+        * dfg/DFGVariableAccessData.h:
+        * heap/VTableSpectrum.h:
+        * jit/ExecutableAllocator.cpp:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * wtf/MetaAllocatorHandle.h:
+        * wtf/UnionFind.h:
+
+2011-11-06  Sam Weinig  <sam@webkit.org>
+
+        Allow use of FINAL in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=71630
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        Don't warn about C++11 extensions used in C++98 mode.
+
+2011-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Value profiling should just use two buckets
+        https://bugs.webkit.org/show_bug.cgi?id=71619
+
+        Reviewed by Gavin Barraclough.
+        
+        Added one more configuration options (like Heuristics::minimumOptimizationDelay),
+        improved debugging in JIT optimization support, changed the number of buckets
+        in the value profile from 9 to 2, and wrote a more optimal value profiling path
+        in the old JIT to take advantage of this. It's still possible to play around with
+        larger numbers of buckets, and we should probably keep this for a little while
+        until we convince ourselves that using just two buckets is the right call.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/ValueProfile.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h:
+
+2011-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be able to sample itself in a more flexible way than just sampling flags
+        https://bugs.webkit.org/show_bug.cgi?id=71522
+
+        Reviewed by Gavin Barraclough.
+        
+        Added a construct that looks like SamplingRegion samplingRegion("name").
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingRegion::Locker::Locker):
+        (JSC::SamplingRegion::Locker::~Locker):
+        (JSC::SamplingRegion::sample):
+        (JSC::SamplingRegion::dump):
+        (JSC::SamplingRegion::dumpInternal):
+        (JSC::SamplingThread::threadStartFunc):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingRegion::SamplingRegion):
+        (JSC::SamplingRegion::~SamplingRegion):
+        (JSC::SamplingRegion::exchangeCurrent):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        * heap/VTableSpectrum.cpp:
+        (JSC::VTableSpectrum::countVPtr):
+        (JSC::VTableSpectrum::dump):
+        * heap/VTableSpectrum.h:
+        * jsc.cpp:
+        (main):
+        (runWithScripts):
+        * parser/Parser.h:
+        (JSC::parse):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * wtf/Atomics.h:
+        (WTF::weakCompareAndSwap):
+        * wtf/Platform.h:
+        * wtf/Spectrum.h: Added.
+        (WTF::Spectrum::Spectrum):
+        (WTF::Spectrum::add):
+        (WTF::Spectrum::get):
+        (WTF::Spectrum::begin):
+        (WTF::Spectrum::end):
+        (WTF::Spectrum::KeyAndCount::KeyAndCount):
+        (WTF::Spectrum::KeyAndCount::operator<):
+        (WTF::Spectrum::buildList):
+        * wtf/wtf.pri:
+
+2011-11-05  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-11-04  Sam Weinig  <sam@webkit.org>
+
+        Reduce the number of putWithAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=71597
+
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Remove exports of removed functions.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::putWithAttributes):
+        Calling the overload without the extra parameters does the same thing.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putWithAttributes):
+        * runtime/JSObject.h:
+        Remove four unused JSObject::putWithAttributes overloads and make one of the remaining
+        two overloads not virtual, since no one overrides it.
+
+2011-11-04  Pratik Solanki  <psolanki@apple.com>
+
+        sqrtDouble and andnotDouble should be declared noreturn
+        https://bugs.webkit.org/show_bug.cgi?id=71592
+
+        Reviewed by Sam Weinig.
+
+        * assembler/MacroAssemblerARMv7.h:
+
+2011-11-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::hasInstance
+        https://bugs.webkit.org/show_bug.cgi?id=71430
+
+        Reviewed by Darin Adler.
+
+        Added hasInstance to the MethodTable, changed all the virtual 
+        implementations of hasInstance to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance):
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ClassInfo.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::hasInstance):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::hasInstance):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        * runtime/JSObject.h:
+
+2011-11-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Refactor and clean up the qmake build system
+
+        The qmake build system has accumulated a bit of cruft and redundancy
+        over time. There's also a fairly tight coupling between how to build
+        the various targets, and _what_ to build, making it harder to add new
+        rules or sources. This patch aims to elevate these issues somewhat.
+
+        This is a short-list of the changes:
+
+          * The rules for how to build targets are now mostly contained as
+            prf-files in Tools/qmake/mkspecs/features. Using mkspecs also
+            allows us to do pre- and post-processing of each project file,
+            which helps to clean up the actual project files.
+
+          * Derived sources are no longer generated as a separate make-step
+            but is part of each target's project file as a subdir. Makefile
+            rules are used to ensure that we run make on the derived sources
+            before running qmake on the actual target makefile. This makes
+            it easier to keep a proper dependency between derived sources
+            and the target.
+
+          * We use GNU make and the compiler to generate dependencies on
+            UNIX-based systems running Qt 5. This allows us to lessen the
+            need to run qmake, which should reduce compile time.
+
+          * WebKit2 is now build by default if building with Qt 5. It can
+            be disabled by passing --no-webkit2 to build-webkit.
+
+        The result of these changes are hopefully a cleaner and easier
+        build system to modify, and faster build times due to no longer
+        running qmake on every single build. It's also a first step
+        towards possibly generating the list of sources using another
+        build system.
+
+        https://bugs.webkit.org/show_bug.cgi?id=71222
+
+        Reviewed by Simon Hausmann.
+
+        * DerivedSources.pri: Added.
+        * DerivedSources.pro: Removed.
+        * JavaScriptCore.pro:
+        * Target.pri: Copied from Source/JavaScriptCore/JavaScriptCore.pro.
+        * headers.pri: Removed.
+        * jsc.pro:
+        * wtf/wtf.pri:
+        * yarr/yarr.pri:
+
+2011-11-04  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        More code clean-up in DFG 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=71540
+
+        Remove unnecessary code duplications, and fix compilation warnings.
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::emitCount):
+        (JSC::DFG::JITCompiler::setSamplingFlag):
+        (JSC::DFG::JITCompiler::clearSamplingFlag):
+        (JSC::DFG::JITCompiler::jitAssertIsCell):
+        * dfg/DFGJITCompiler32_64.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        De-virtualize JSObject::hasInstance
+        https://bugs.webkit.org/show_bug.cgi?id=71430
+
+        Unreviewed rolling out r99238, because it made a test crash on all platform.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance):
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ClassInfo.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::hasInstance):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        * runtime/JSObject.h:
+
+2011-11-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::getPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=71306
+
+        Reviewed by Darin Adler.
+
+        Added getPropertyNames to the MethodTable, changed all the virtual 
+        implementations of getPropertyNames to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCopyPropertyNames):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getPropertyNames):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getPropertyNamesFromStructure):
+        * runtime/Structure.h:
+
+2011-11-03  Darin Adler  <darin@apple.com>
+
+        Change remaining callers of releaseRef to call leakRef
+        https://bugs.webkit.org/show_bug.cgi?id=71422
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::HashAndUTF8CharactersTranslator::translate): Use leakRef.
+
+2011-11-02  Darin Adler  <darin@apple.com>
+
+        Change remaining callers of releaseRef to call leakRef
+        https://bugs.webkit.org/show_bug.cgi?id=71422
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::HashAndUTF8CharactersTranslator::translate): Use leakRef.
+
+2011-11-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::hasInstance
+        https://bugs.webkit.org/show_bug.cgi?id=71430
+
+        Reviewed by Darin Adler.
+
+        Added hasInstance to the MethodTable, changed all the virtual 
+        implementations of hasInstance to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance):
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ClassInfo.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::hasInstance):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::hasInstance):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        * runtime/JSObject.h:
+
+2011-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT-specific code should be able to refer to register types even on JIT-disabled builds
+        https://bugs.webkit.org/show_bug.cgi?id=71498
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssembler.h:
+        (MacroAssembler::MacroAssembler):
+
+2011-11-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::className
+        https://bugs.webkit.org/show_bug.cgi?id=71428
+
+        Reviewed by Sam Weinig.
+
+        Added className to the MethodTable, changed all the virtual 
+        implementations of className to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::className):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::className):
+        * debugger/DebuggerActivation.h:
+        * jsc.cpp:
+        (GlobalObject::createStructure):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::className):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::className):
+        * runtime/JSObject.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * testRegExp.cpp:
+        (GlobalObject::createStructure):
+
+2011-11-02  Jer Noble  <jer.noble@apple.com>
+
+        Add Clock class and platform-specific implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=71341
+
+        Reviewed by Sam Weinig.
+
+        Add WTF_USE_COREAUDIO macro for use by PlatformClockCA.
+
+        * wtf/Platform.h:
+
+2011-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fixing win build. step2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-11-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fix windows build, step1
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-11-03  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: preserve script location for inline handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=71367
+
+        Makes SourceCode factories receive TextPosition instead of the line number;
+        Stores consistent position values in SourceCode and SourceProvider;
+
+        Reviewed by Yury Semikhatsky.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        * parser/SourceCode.h:
+        (JSC::makeSource):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::startPosition):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+
+2011-11-03  Kentaro Hara  <haraken@chromium.org>
+
+        Fixed wrong implementation of doubleValue % 2^{64}.
+        https://bugs.webkit.org/show_bug.cgi?id=67980
+
+        Reviewed by Hajime Morita.
+
+        fast/events/constructors/progress-event-constructor.html was failing
+        because of the wrong implementation of conversion from an ECMAScript value
+        to an IDL unsigned long long value (Spec: http://www.w3.org/TR/WebIDL/#es-unsigned-long-long).
+        In particular, the calculation of doubleValue % 2^{64} was wrong.
+        This patch implemented it correctly in doubleToInteger() in wtf/MathExtras.h.
+
+        * wtf/MathExtras.h:
+        (doubleToInteger): Implemented the spec correctly.
+
+2011-11-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r99089.
+        http://trac.webkit.org/changeset/99089
+        https://bugs.webkit.org/show_bug.cgi?id=71448
+
+        @plt postfix for math functions cause crash on Linux 32 (the
+        symbol is defined but it points to NULL) (Requested by
+        zherczeg on #webkit).
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        * jit/ThunkGenerators.cpp:
+
+2011-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG inlining breaks function.arguments[something] if the argument being
+        retrieved was subjected to DFG's unboxing optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=71436
+
+        Reviewed by Oliver Hunt.
+        
+        This makes inlined arguments retrieval use some of the same machinery as
+        OSR to determine where from, and how, to retrieve a value that the DFG
+        might have somehow squirreled away while the old JIT would put it in its
+        obvious location, using an obvious format.
+        
+        To that end, previously DFG-internal notions such as DataFormat,
+        VirtualRegister, and ValueRecovery are now in bytecode/ since they are
+        stored as part of InlineCallFrames.
+
+        * bytecode/CodeOrigin.h:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallerFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::inlineCallFrame):
+        * interpreter/Register.h:
+        (JSC::Register::asInlineCallFrame):
+        (JSC::Register::unboxedInt32):
+        (JSC::Register::unboxedBoolean):
+        (JSC::Register::unboxedCell):
+        * runtime/Arguments.h:
+        (JSC::Arguments::finishCreationAndCopyRegisters):
+
+2011-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        ValueRecovery should be moved out of the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=71439
+
+        Reviewed by Oliver Hunt.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/DataFormat.h: Added.
+        (JSC::dataFormatToString):
+        (JSC::needDataFormatConversion):
+        (JSC::isJSFormat):
+        (JSC::isJSInteger):
+        (JSC::isJSDouble):
+        (JSC::isJSCell):
+        (JSC::isJSBoolean):
+        * bytecode/ValueRecovery.h: Added.
+        (JSC::ValueRecovery::ValueRecovery):
+        (JSC::ValueRecovery::alreadyInRegisterFile):
+        (JSC::ValueRecovery::alreadyInRegisterFileAsUnboxedInt32):
+        (JSC::ValueRecovery::alreadyInRegisterFileAsUnboxedCell):
+        (JSC::ValueRecovery::alreadyInRegisterFileAsUnboxedBoolean):
+        (JSC::ValueRecovery::inGPR):
+        (JSC::ValueRecovery::inPair):
+        (JSC::ValueRecovery::inFPR):
+        (JSC::ValueRecovery::displacedInRegisterFile):
+        (JSC::ValueRecovery::constant):
+        (JSC::ValueRecovery::technique):
+        (JSC::ValueRecovery::isInRegisters):
+        (JSC::ValueRecovery::gpr):
+        (JSC::ValueRecovery::tagGPR):
+        (JSC::ValueRecovery::payloadGPR):
+        (JSC::ValueRecovery::fpr):
+        (JSC::ValueRecovery::virtualRegister):
+        (JSC::ValueRecovery::dump):
+        * bytecode/VirtualRegister.h: Added.
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::isJSFormat):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGVariableAccessData.h:
+
+2011-11-02  Sam Weinig  <sam@webkit.org>
+
+        Object.getOwnPropertyDescriptor() does not retrieve the getter/setter from a property on the window that has been overridden with a getter/setter
+        https://bugs.webkit.org/show_bug.cgi?id=71333
+
+        Reviewed by Gavin Barraclough.
+
+        Tested by fast/dom/getter-on-window-object2.html
+
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        The attributes returned from Structure::get do not include Getter or Setter, so
+        instead check if the value is a GetterSetter like we do elsewhere. If it is, update
+        the descriptor's attributes accordingly.
+
+2011-11-02  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        FunctionPtr should accept FASTCALL functions on X86
+        https://bugs.webkit.org/show_bug.cgi?id=71434
+
+        Reviewed by Filip Pizlo.
+
+        On X86 we sometimes use FASTCALL convention functions, for example the
+        cti functions, and we may need the pointers to such functions, e.g.,
+        in current DFG register file check and arity check, though long term
+        we may avoid such usage of cti calls in DFG.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+
+2011-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Inlined uses of the global object should use the right global object
+        https://bugs.webkit.org/show_bug.cgi?id=71427
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::globalObjectFor):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-11-02  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Remove some unnecessary loads/stores in DFG JIT 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=71090
+
+        Reviewed by Filip Pizlo.
+
+        In fillSpeculateCell and OSR exit, some unnecessary loads/stores can
+        be eliminated.
+
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+
+2011-11-02  Adam Klein  <adamk@chromium.org>
+
+        Replace usage of StringImpl with String where possible in CharacterData and Text
+        https://bugs.webkit.org/show_bug.cgi?id=71383
+
+        Reviewed by Darin Adler.
+
+        * wtf/text/WTFString.h:
+        (WTF::String::containsOnlyWhitespace): Added new method.
+
+2011-11-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::getOwnPropertyNames
+        https://bugs.webkit.org/show_bug.cgi?id=71307
+
+        Reviewed by Darin Adler.
+
+        Added getOwnPropertyNames to the MethodTable, changed all the virtual 
+        implementations of getOwnPropertyNames to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyNames):
+        * runtime/Arguments.h:
+        * runtime/ClassInfo.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertyNames):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertyNames):
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertyNames):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertyNames):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::~JSVariableObject):
+        (JSC::JSVariableObject::getOwnPropertyNames):
+        * runtime/JSVariableObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::defineProperties):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/StringObject.h:
+        * runtime/Structure.h:
+
+2011-11-02  Dean Jackson  <dino@apple.com>
+
+        Add ENABLE_CSS_SHADERS flag
+        https://bugs.webkit.org/show_bug.cgi?id=71394
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-11-02  Alexey Shabalin  <a.shabalin@gmail.com>
+
+        TEXTREL in libjavascriptcoregtk-1.0.so.0.11.0 on x86 (or i586)
+        https://bugs.webkit.org/show_bug.cgi?id=70610
+
+        Reviewed by Martin Robinson.
+
+        Properly annotate ASM on BSD and Linux x86 systems.
+
+        * dfg/DFGOperations.cpp: Add annotation for X86.
+        * jit/JITStubs.cpp: Ditto.
+        * jit/ThunkGenerators.cpp: Ditto.
+
+2011-11-02  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Missing Force8BitConstructor in 8-bit version of StringImpl::reallocate()
+        https://bugs.webkit.org/show_bug.cgi?id=71347
+
+        Reviewed by Geoffrey Garen.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::reallocate):
+
+2011-11-01  Darin Adler  <darin@apple.com>
+
+        Cut down on malloc/free a bit in the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=71343
+
+        Reviewed by Oliver Hunt.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::deallocateObjects): Call the destructors of
+        the deletable objects before freeing the pools. Don't call
+        fastFree on the deletable objects any more.
+
+        * parser/ParserArena.h:
+        (JSC::ParserArena::allocateDeletable): Use allocateFreeable
+        instead of fastMalloc here.
+
+2011-11-01  Sam Weinig  <sam@webkit.org>
+
+        Implement __lookupGetter__/__lookupSetter__ in terms of getPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=71336
+
+        Reviewed by Darin Adler.
+
+        * debugger/DebuggerActivation.cpp:
+        * debugger/DebuggerActivation.h:
+        Remove overrides of lookupGetter/lookupSetter, which are no longer needed
+        due to implementing getPropertyDescriptor.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        * runtime/JSObject.h:
+        De-virtualize lookupGetter/lookupSetter, and implement them in terms of
+        getPropertyDescriptor.
+
+2011-11-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::defineSetter
+        https://bugs.webkit.org/show_bug.cgi?id=71303
+
+        Reviewed by Darin Adler.
+
+        Added defineSetter to the MethodTable, changed all the virtual 
+        implementations of defineSetter to static ones, and replaced 
+        all call sites with corresponding lookups in the MethodTable.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::defineSetter):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::defineSetter):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineSetter):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineSetter):
+        (JSC::putDescriptor):
+        * runtime/JSObject.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineSetter):
+
+2011-11-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG inlining breaks function.arguments
+        https://bugs.webkit.org/show_bug.cgi?id=71329
+
+        Reviewed by Oliver Hunt.
+        
+        The DFG was forgetting to store code origin mappings for inlined
+        call sites. Some of the fast-path optimizations for
+        CallFrame::trueCallerFrame() were wrong. An assertion in Arguments
+        was wrong.
+        
+        I also took the opportunity to decrease code duplication between
+        DFG64 and DFG32_64, because I didn't feel like writing the same
+        code twice.
+
+        * bytecode/CodeBlock.h:
+        (JSC::ExecState::isInlineCallFrame):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler32_64.cpp:
+        * dfg/DFGNode.h:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallerFrame):
+        * interpreter/CallFrame.h:
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+
+2011-11-01  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        StringImpl::reallocate() should have a 8-bit version
+        https://bugs.webkit.org/show_bug.cgi?id=71210
+
+        Reviewed by Geoffrey Garen.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::reallocate):
+        * wtf/text/StringImpl.h:
+
+2011-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        The GC should be parallel
+        https://bugs.webkit.org/show_bug.cgi?id=70995
+
+        Reviewed by Geoff Garen.
+        
+        Added parallel tracing to the GC. This works by having local mark
+        stacks per thread, and a global shared one. Threads sometimes
+        donate cells from the mark stack to the global one if the heuristics
+        tell them that it's affordable to do so. Threads that have depleted
+        their local mark stacks try to steal some from the shared one.
+
+        Marking is now done using an atomic weak relaxed CAS (compare-and-swap).
+        
+        This is a 23% speed-up on V8-splay when I use 4 marking threads,
+        leading to a 3.5% speed-up on V8.
+        
+        It also appears that this reduces GC pause times on real websites by
+        more than half.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator):
+        (JSC::MarkStackSegmentAllocator::~MarkStackSegmentAllocator):
+        (JSC::MarkStackSegmentAllocator::allocate):
+        (JSC::MarkStackSegmentAllocator::release):
+        (JSC::MarkStackSegmentAllocator::shrinkReserve):
+        (JSC::MarkStackArray::MarkStackArray):
+        (JSC::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStackArray::expand):
+        (JSC::MarkStackArray::refill):
+        (JSC::MarkStackArray::donateSomeCellsTo):
+        (JSC::MarkStackArray::stealSomeCellsFrom):
+        (JSC::MarkStackThreadSharedData::markingThreadMain):
+        (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::MarkStackThreadSharedData::~MarkStackThreadSharedData):
+        (JSC::MarkStackThreadSharedData::reset):
+        (JSC::MarkStack::reset):
+        (JSC::SlotVisitor::donateSlow):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::MarkStack::mergeOpaqueRoots):
+        (JSC::SlotVisitor::harvestWeakReferences):
+        * heap/MarkStack.h:
+        (JSC::MarkStackSegment::data):
+        (JSC::MarkStackSegment::capacityFromSize):
+        (JSC::MarkStackSegment::sizeFromCapacity):
+        (JSC::MarkStackArray::postIncTop):
+        (JSC::MarkStackArray::preDecTop):
+        (JSC::MarkStackArray::setTopForFullSegment):
+        (JSC::MarkStackArray::setTopForEmptySegment):
+        (JSC::MarkStackArray::top):
+        (JSC::MarkStackArray::validatePrevious):
+        (JSC::MarkStack::addWeakReferenceHarvester):
+        (JSC::MarkStack::mergeOpaqueRootsIfNecessary):
+        (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::addOpaqueRoot):
+        (JSC::MarkStack::containsOpaqueRoot):
+        (JSC::MarkStack::opaqueRootCount):
+        (JSC::MarkStackArray::append):
+        (JSC::MarkStackArray::canRemoveLast):
+        (JSC::MarkStackArray::removeLast):
+        (JSC::MarkStackArray::isEmpty):
+        (JSC::MarkStackArray::canDonateSomeCells):
+        (JSC::MarkStackArray::size):
+        (JSC::ParallelModeEnabler::ParallelModeEnabler):
+        (JSC::ParallelModeEnabler::~ParallelModeEnabler):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::testAndSetMarked):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::donate):
+        (JSC::SlotVisitor::donateAndDrain):
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::SlotVisitor):
+        * heap/WeakReferenceHarvester.h:
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h:
+        * wtf/Atomics.h:
+        (WTF::weakCompareAndSwap):
+        * wtf/Bitmap.h:
+        (WTF::::Bitmap):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::testAndSet):
+        (WTF::::testAndClear):
+        (WTF::::concurrentTestAndSet):
+        (WTF::::concurrentTestAndClear):
+        (WTF::::clear):
+        (WTF::::clearAll):
+        (WTF::::nextPossiblyUnset):
+        (WTF::::findRunOfZeros):
+        (WTF::::count):
+        (WTF::::isEmpty):
+        (WTF::::isFull):
+        * wtf/MainThread.h:
+        (WTF::isMainThreadOrGCThread):
+        * wtf/Platform.h:
+        * wtf/ThreadSpecific.h:
+        (WTF::::isSet):
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeGCThreads):
+        (WTF::initializeMainThreadPlatform):
+        (WTF::initializeMainThreadToProcessMainThreadPlatform):
+        (WTF::registerGCThread):
+        (WTF::isMainThreadOrGCThread):
+
+2011-10-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::defaultValue
+        https://bugs.webkit.org/show_bug.cgi?id=71146
+
+        Reviewed by Sam Weinig.
+
+        Added defaultValue to the MethodTable.  Replaced all virtual versions of 
+        defaultValue with static versions.  Replaced all call sites with lookups in the 
+        MethodTable.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/ClassInfo.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::defaultValue):
+        (JSC::TerminatedExecutionError::defaultValue):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::defaultValue):
+        * runtime/JSCell.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::defaultValue):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defaultValue):
+        * runtime/JSObject.h:
+        (JSC::JSObject::toPrimitive):
+
+2011-10-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Interpreter build fix
+
+        Unreviewed build fix
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2011-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exits should add to value profiles
+        https://bugs.webkit.org/show_bug.cgi?id=71202
+
+        Reviewed by Oliver Hunt.
+        
+        Value profiles now have an extra special slot not used by the old JIT's
+        profiling, which is reserved for OSR exits.
+        
+        The DFG's OSR exit code now knows which register, node index, and value
+        profiling site was responsible for the (possibly flawed) information that
+        led to the OSR failure. This is somewhat opportunistic and imperfect;
+        if there's a lot of control flow between the value profiling site and the
+        OSR failure point, then this mechanism simply gives up. It also gives up
+        if the OSR failure is caused by either known deficiencies in the DFG
+        (like that we always assume that the index in a strict charCodeAt access
+        is within bounds) or where the OSR failure would be catalogues and
+        profiled through other means (like slow case counters).
+        
+        This patch also adds the notion of a JSValueRegs, which is either a
+        single register in JSVALUE64 or a pair in JSVALUE32_64. We should
+        probably move the 32_64 DFG towards using this, since it often makes it
+        easier to share code between 64 and 32_64.
+        
+        Also fixed a number of pathologies that this uncovered. op_method_check 
+        didn't have a value profiling site on the slow path. GetById should not
+        always force OSR exit if it never executed in the old JIT; we may be
+        able to infer its type if it's a array or string length get. Finally,
+        these changes benefit from a slight tweak to optimization delay
+        heuristics (profile fullness is now 0.35 instead of 0.25).
+        
+        3.8% speed-up on Kraken, mostly due to ~35% on both stanford-crypto-aes
+        and imaging-darkroom.
+
+        * bytecode/ValueProfile.cpp:
+        (JSC::ValueProfile::computeStatistics):
+        (JSC::ValueProfile::computeUpdatedPrediction):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::ValueProfile):
+        (JSC::ValueProfile::specFailBucket):
+        (JSC::ValueProfile::numberOfSamples):
+        (JSC::ValueProfile::isLive):
+        (JSC::ValueProfile::numberOfInt32s):
+        (JSC::ValueProfile::numberOfDoubles):
+        (JSC::ValueProfile::numberOfCells):
+        (JSC::ValueProfile::numberOfObjects):
+        (JSC::ValueProfile::numberOfFinalObjects):
+        (JSC::ValueProfile::numberOfStrings):
+        (JSC::ValueProfile::numberOfArrays):
+        (JSC::ValueProfile::numberOfBooleans):
+        (JSC::ValueProfile::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::JSValueRegs::JSValueRegs):
+        (JSC::DFG::JSValueRegs::operator!):
+        (JSC::DFG::JSValueRegs::gpr):
+        (JSC::DFG::JSValueSource::JSValueSource):
+        (JSC::DFG::JSValueSource::unboxedCell):
+        (JSC::DFG::JSValueSource::operator!):
+        (JSC::DFG::JSValueSource::isAddress):
+        (JSC::DFG::JSValueSource::offset):
+        (JSC::DFG::JSValueSource::base):
+        (JSC::DFG::JSValueSource::gpr):
+        (JSC::DFG::JSValueSource::asAddress):
+        (JSC::DFG::JSValueSource::notAddress):
+        (JSC::DFG::JSValueRegs::tagGPR):
+        (JSC::DFG::JSValueRegs::payloadGPR):
+        (JSC::DFG::JSValueSource::tagGPR):
+        (JSC::DFG::JSValueSource::payloadGPR):
+        (JSC::DFG::JSValueSource::hasKnownTag):
+        (JSC::DFG::JSValueSource::tag):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::jsValueRegs):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueProfileFor):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::JSValueOperand::jsValueRegs):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::valueProfileFor):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnByteArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_method_check):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_method_check):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/JSValue.h:
+
+2011-10-31  Sam Weinig  <sam@webkit.org>
+
+        Remove need for virtual JSObject::unwrappedObject
+        https://bugs.webkit.org/show_bug.cgi?id=71034
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.exp:
+        Update exports.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add JSGlobalThis.cpp.
+
+        * runtime/JSGlobalThis.cpp: Added.
+        (JSC::JSGlobalThis::visitChildren):
+        (JSC::JSGlobalThis::unwrappedObject):
+        * runtime/JSGlobalThis.h:
+        (JSC::JSGlobalThis::createStructure):
+        Move underlying object from JSDOMWindowShell down to JSGlobalThis
+        and corresponding visitChildren method.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::unwrappedObject):
+        Change unwrappedObject from virtual, to just needing an if check.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::isGlobalThis):
+        * runtime/JSType.h:
+        Add isGlobalThis predicate and type.
+
+2011-10-31  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        WTF::StringImpl::create(const char*, unsigned) calls itself
+        https://bugs.webkit.org/show_bug.cgi?id=71206
+
+        The original implementation just calls itself, causing infinite recursion.
+        Cast the first parameter to const LChar* to fix that.
+
+        Reviewed by Ryosuke Niwa.
+
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::create):
+
+2011-10-31  Andy Wingo  <wingo@igalia.com>
+
+        Fix DFG JIT compilation on Linux targets.
+        https://bugs.webkit.org/show_bug.cgi?id=70904
+
+        Reviewed by Darin Adler.
+
+        * jit/JITStubs.cpp (SYMBOL_STRING_RELOCATION): Simplify this
+        macro.
+
+        * dfg/DFGOperations.cpp (SYMBOL_STRING_RELOCATION): Copy the
+        simplified definition from jit/JITStubs.cpp.
+        (FUNCTION_WRAPPER_WITH_RETURN_ADDRESS, getHostCallReturnValue):
+        Use the macro to access trampoline targets through the PLT on PIC
+        systems, instead of introducing a text relocation.  Otherwise, the
+        library fails to link.
+
+2011-10-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSObject::defineGetter
+        https://bugs.webkit.org/show_bug.cgi?id=71134
+
+        Reviewed by Darin Adler.
+
+        Added defineGetter to the MethodTable.  Replaced all virtual versions of defineGetter
+        with static versions.  Replaced all call sites with lookups in the MethodTable.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::defineGetter):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::defineGetter):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineGetter):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::putDescriptor):
+        * runtime/JSObject.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+
+2011-10-31  Michael Saboff  <msaboff@apple.com>
+
+        Towards 8-bit Strings: Move Lexer and Parser Objects out of JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=71138
+
+        Restructure and movement of Lexer and Parser code.
+        Moved Lexer and Parser objects out of JSGlobalData.
+        Added a new ParserTokens class and instance to JSGlobalData that
+        have JavaScript token related definitions.
+        Replaced JSGlobalData arguments to Node classes with lineNumber,
+        as that was the only use of the JSGlobalData.
+        Combined JSParser and Parser classes into one class,
+        eliminating JSParser.h and .cpp.
+        Various supporting #include changes.
+
+        These mostly mechanical changes are done in preparation to
+        making the Lexer and Parser template classes.
+
+        Reviewed by Darin Adler.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::createSourceElements):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArguments):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createElementList):
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createClause):
+        (JSC::ASTBuilder::createClauseList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/JSParser.cpp: Removed.
+        * parser/JSParser.h: Removed.
+        * parser/Lexer.cpp:
+        (JSC::Keywords::Keywords):
+        (JSC::Lexer::Lexer):
+        (JSC::Lexer::~Lexer):
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::parseIdentifier):
+        * parser/Lexer.h:
+        (JSC::Keywords::isKeyword):
+        (JSC::Keywords::getKeyword):
+        (JSC::Keywords::~Keywords):
+        (JSC::Lexer::setIsReparsing):
+        (JSC::Lexer::isReparsing):
+        (JSC::Lexer::lineNumber):
+        (JSC::Lexer::setLastLineNumber):
+        (JSC::Lexer::lastLineNumber):
+        (JSC::Lexer::prevTerminator):
+        (JSC::Lexer::sawError):
+        (JSC::Lexer::getErrorMessage):
+        (JSC::Lexer::currentOffset):
+        (JSC::Lexer::setOffset):
+        (JSC::Lexer::setLineNumber):
+        (JSC::Lexer::sourceProvider):
+        (JSC::Lexer::isWhiteSpace):
+        (JSC::Lexer::isLineTerminator):
+        (JSC::Lexer::convertHex):
+        (JSC::Lexer::convertUnicode):
+        (JSC::Lexer::makeIdentifier):
+        (JSC::Lexer::lexExpectIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new):
+        (JSC::ParserArenaDeletable::operator new):
+        (JSC::ParserArenaRefCounted::ParserArenaRefCounted):
+        (JSC::Node::Node):
+        (JSC::ExpressionNode::ExpressionNode):
+        (JSC::StatementNode::StatementNode):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::RegExpNode::RegExpNode):
+        (JSC::ThisNode::ThisNode):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::ElementNode::ElementNode):
+        (JSC::ArrayNode::ArrayNode):
+        (JSC::PropertyNode::PropertyNode):
+        (JSC::PropertyListNode::PropertyListNode):
+        (JSC::ObjectLiteralNode::ObjectLiteralNode):
+        (JSC::BracketAccessorNode::BracketAccessorNode):
+        (JSC::DotAccessorNode::DotAccessorNode):
+        (JSC::ArgumentListNode::ArgumentListNode):
+        (JSC::ArgumentsNode::ArgumentsNode):
+        (JSC::NewExprNode::NewExprNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PrePostResolveNode::PrePostResolveNode):
+        (JSC::PostfixResolveNode::PostfixResolveNode):
+        (JSC::PostfixBracketNode::PostfixBracketNode):
+        (JSC::PostfixDotNode::PostfixDotNode):
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::DeleteValueNode::DeleteValueNode):
+        (JSC::VoidNode::VoidNode):
+        (JSC::TypeOfResolveNode::TypeOfResolveNode):
+        (JSC::TypeOfValueNode::TypeOfValueNode):
+        (JSC::PrefixResolveNode::PrefixResolveNode):
+        (JSC::PrefixBracketNode::PrefixBracketNode):
+        (JSC::PrefixDotNode::PrefixDotNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::UnaryOpNode::UnaryOpNode):
+        (JSC::UnaryPlusNode::UnaryPlusNode):
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::LogicalNotNode::LogicalNotNode):
+        (JSC::BinaryOpNode::BinaryOpNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::AddNode::AddNode):
+        (JSC::SubNode::SubNode):
+        (JSC::LeftShiftNode::LeftShiftNode):
+        (JSC::RightShiftNode::RightShiftNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        (JSC::LessNode::LessNode):
+        (JSC::GreaterNode::GreaterNode):
+        (JSC::LessEqNode::LessEqNode):
+        (JSC::GreaterEqNode::GreaterEqNode):
+        (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
+        (JSC::InstanceOfNode::InstanceOfNode):
+        (JSC::InNode::InNode):
+        (JSC::EqualNode::EqualNode):
+        (JSC::NotEqualNode::NotEqualNode):
+        (JSC::StrictEqualNode::StrictEqualNode):
+        (JSC::NotStrictEqualNode::NotStrictEqualNode):
+        (JSC::BitAndNode::BitAndNode):
+        (JSC::BitOrNode::BitOrNode):
+        (JSC::BitXOrNode::BitXOrNode):
+        (JSC::LogicalOpNode::LogicalOpNode):
+        (JSC::ConditionalNode::ConditionalNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::CommaNode::CommaNode):
+        (JSC::ConstStatementNode::ConstStatementNode):
+        (JSC::SourceElements::SourceElements):
+        (JSC::EmptyStatementNode::EmptyStatementNode):
+        (JSC::DebuggerStatementNode::DebuggerStatementNode):
+        (JSC::ExprStatementNode::ExprStatementNode):
+        (JSC::VarStatementNode::VarStatementNode):
+        (JSC::IfNode::IfNode):
+        (JSC::IfElseNode::IfElseNode):
+        (JSC::DoWhileNode::DoWhileNode):
+        (JSC::WhileNode::WhileNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ReturnNode::ReturnNode):
+        (JSC::WithNode::WithNode):
+        (JSC::LabelNode::LabelNode):
+        (JSC::ThrowNode::ThrowNode):
+        (JSC::TryNode::TryNode):
+        (JSC::ParameterNode::ParameterNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::CaseClauseNode::CaseClauseNode):
+        (JSC::ClauseListNode::ClauseListNode):
+        (JSC::CaseBlockNode::CaseBlockNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::ConstDeclNode::ConstDeclNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/NodeInfo.h:
+        * parser/Nodes.cpp:
+        (JSC::StatementNode::setLoc):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::Node::lineNo):
+        * parser/Parser.cpp:
+        (JSC::Parser::Parser):
+        (JSC::Parser::~Parser):
+        (JSC::Parser::parseInner):
+        (JSC::Parser::allowAutomaticSemicolon):
+        (JSC::Parser::parseSourceElements):
+        (JSC::Parser::parseVarDeclaration):
+        (JSC::Parser::parseConstDeclaration):
+        (JSC::Parser::parseDoWhileStatement):
+        (JSC::Parser::parseWhileStatement):
+        (JSC::Parser::parseVarDeclarationList):
+        (JSC::Parser::parseConstDeclarationList):
+        (JSC::Parser::parseForStatement):
+        (JSC::Parser::parseBreakStatement):
+        (JSC::Parser::parseContinueStatement):
+        (JSC::Parser::parseReturnStatement):
+        (JSC::Parser::parseThrowStatement):
+        (JSC::Parser::parseWithStatement):
+        (JSC::Parser::parseSwitchStatement):
+        (JSC::Parser::parseSwitchClauses):
+        (JSC::Parser::parseSwitchDefaultClause):
+        (JSC::Parser::parseTryStatement):
+        (JSC::Parser::parseDebuggerStatement):
+        (JSC::Parser::parseBlockStatement):
+        (JSC::Parser::parseStatement):
+        (JSC::Parser::parseFormalParameters):
+        (JSC::Parser::parseFunctionBody):
+        (JSC::Parser::parseFunctionInfo):
+        (JSC::Parser::parseFunctionDeclaration):
+        (JSC::LabelInfo::LabelInfo):
+        (JSC::Parser::parseExpressionOrLabelStatement):
+        (JSC::Parser::parseExpressionStatement):
+        (JSC::Parser::parseIfStatement):
+        (JSC::Parser::parseExpression):
+        (JSC::Parser::parseAssignmentExpression):
+        (JSC::Parser::parseConditionalExpression):
+        (JSC::isUnaryOp):
+        (JSC::Parser::isBinaryOperator):
+        (JSC::Parser::parseBinaryExpression):
+        (JSC::Parser::parseProperty):
+        (JSC::Parser::parseObjectLiteral):
+        (JSC::Parser::parseStrictObjectLiteral):
+        (JSC::Parser::parseArrayLiteral):
+        (JSC::Parser::parsePrimaryExpression):
+        (JSC::Parser::parseArguments):
+        (JSC::Parser::parseMemberExpression):
+        (JSC::Parser::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::isEvalNode):
+        (JSC::EvalNode):
+        (JSC::DepthManager::DepthManager):
+        (JSC::DepthManager::~DepthManager):
+        (JSC::ScopeLabelInfo::ScopeLabelInfo):
+        (JSC::Scope::Scope):
+        (JSC::Scope::startSwitch):
+        (JSC::Scope::endSwitch):
+        (JSC::Scope::startLoop):
+        (JSC::Scope::endLoop):
+        (JSC::Scope::inLoop):
+        (JSC::Scope::breakIsValid):
+        (JSC::Scope::continueIsValid):
+        (JSC::Scope::pushLabel):
+        (JSC::Scope::popLabel):
+        (JSC::Scope::getLabel):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::isFunction):
+        (JSC::Scope::isFunctionBoundary):
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareWrite):
+        (JSC::Scope::preventNewDecls):
+        (JSC::Scope::allowsNewDecls):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::useVariable):
+        (JSC::Scope::setNeedsFullActivation):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::getUncapturedWrittenVariables):
+        (JSC::Scope::getCapturedVariables):
+        (JSC::Scope::setStrictMode):
+        (JSC::Scope::strictMode):
+        (JSC::Scope::isValidStrictMode):
+        (JSC::Scope::shadowsArguments):
+        (JSC::Scope::copyCapturedVariablesToVector):
+        (JSC::Scope::saveFunctionInfo):
+        (JSC::Scope::restoreFunctionInfo):
+        (JSC::ScopeRef::ScopeRef):
+        (JSC::ScopeRef::operator->):
+        (JSC::ScopeRef::index):
+        (JSC::ScopeRef::hasContainingScope):
+        (JSC::ScopeRef::containingScope):
+        (JSC::Parser::AllowInOverride::AllowInOverride):
+        (JSC::Parser::AllowInOverride::~AllowInOverride):
+        (JSC::Parser::AutoPopScopeRef::AutoPopScopeRef):
+        (JSC::Parser::AutoPopScopeRef::~AutoPopScopeRef):
+        (JSC::Parser::AutoPopScopeRef::setPopped):
+        (JSC::Parser::currentScope):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::popScopeInternal):
+        (JSC::Parser::popScope):
+        (JSC::Parser::declareVariable):
+        (JSC::Parser::declareWrite):
+        (JSC::Parser::findCachedFunctionInfo):
+        (JSC::Parser::isFunctionBodyNode):
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::nextTokenIsColon):
+        (JSC::Parser::consume):
+        (JSC::Parser::getToken):
+        (JSC::Parser::match):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::tokenLine):
+        (JSC::Parser::tokenEnd):
+        (JSC::Parser::getTokenName):
+        (JSC::Parser::updateErrorMessageSpecialCase):
+        (JSC::Parser::updateErrorMessage):
+        (JSC::Parser::updateErrorWithNameAndMessage):
+        (JSC::Parser::startLoop):
+        (JSC::Parser::endLoop):
+        (JSC::Parser::startSwitch):
+        (JSC::Parser::endSwitch):
+        (JSC::Parser::setStrictMode):
+        (JSC::Parser::strictMode):
+        (JSC::Parser::isValidStrictMode):
+        (JSC::Parser::declareParameter):
+        (JSC::Parser::breakIsValid):
+        (JSC::Parser::continueIsValid):
+        (JSC::Parser::pushLabel):
+        (JSC::Parser::popLabel):
+        (JSC::Parser::getLabel):
+        (JSC::Parser::autoSemiColon):
+        (JSC::Parser::canRecurse):
+        (JSC::Parser::lastTokenEnd):
+        (JSC::Parser::DepthManager::DepthManager):
+        (JSC::Parser::DepthManager::~DepthManager):
+        (JSC::Parser::parse):
+        (JSC::parse):
+        * parser/ParserTokens.h: Added.
+        (JSC::JSTokenInfo::JSTokenInfo):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::subExpression):
+        * parser/SourceProviderCacheItem.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArguments):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::tryJSONPParse):
+
+2011-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r97118): Reproducible crash in JSCell::toPrimitive when adding
+        https://bugs.webkit.org/show_bug.cgi?id=71227
+
+        Reviewed by Oliver Hunt.
+        
+        No new tests, since while I can see exactly where the DFG went wrong on the
+        site in question from looking at the generated machine code, and while I can
+        certainly believe that such a scenario would happen, I cannot visualize how
+        to make it happen reproducibly. It requires an odd combination of double
+        values getting spilled and then refilled, but then reboxed at just the right
+        time so that the spilled value is an unboxed double while the in-register
+        value is a boxed double.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+
+2011-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        JSParser::parsePrimaryExpression should have an overflow check
+        https://bugs.webkit.org/show_bug.cgi?id=71197
+
+        Reviewed by Geoff Garen.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parsePrimaryExpression):
+
+2011-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ValueAdd(string, int) should not fail speculation
+        https://bugs.webkit.org/show_bug.cgi?id=71195
+
+        Reviewed by Geoff Garen.
+        
+        1% speed-up on V8.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldNotSpeculateInteger):
+        (JSC::DFG::Node::shouldSpeculateInteger):
+
+2011-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        The DFG inliner should not flush the callee
+        https://bugs.webkit.org/show_bug.cgi?id=71191
+
+        Reviewed by Oliver Hunt.
+        
+        0.6% speed-up on V8.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeOrigin.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallerFrameSlow):
+
+2011-10-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize isGlobalObject, isVariableObject, isActivationObject, and isErrorInstance in JSObject
+        https://bugs.webkit.org/show_bug.cgi?id=70968
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSCallbackObject.cpp: Added two specializations for createStructure that use different JSTypes in their
+        TypeInfo.  Had to also create a specialization for JSNonFinalObject, even JSGlobalObject was the only that 
+        needed it because Windows wouldn't build without it.
+        (JSC::::createStructure):
+        * API/JSCallbackObject.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/ErrorInstance.h: Removed virtual function and changed JSType provided to TypeInfo in createStructure. 
+        (JSC::ErrorInstance::createStructure):
+        * runtime/ErrorPrototype.h: Ditto
+        (JSC::ErrorPrototype::createStructure):
+        * runtime/JSActivation.h: Ditto
+        (JSC::JSActivation::createStructure):
+        * runtime/JSGlobalObject.h: Ditto
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSObject.h: De-virtualized functions.  They now check the JSType of the object for the corresponding type.
+        (JSC::JSObject::isGlobalObject):
+        (JSC::JSObject::isVariableObject):
+        (JSC::JSObject::isActivationObject):
+        (JSC::JSObject::isErrorInstance):
+        * runtime/JSType.h: Added new types for GlobalObject, VariableObject, ActivationObject, and ErrorInstance.
+        * runtime/JSVariableObject.cpp: Removed virtual function.
+        * runtime/JSVariableObject.h: Changed JSType provided to TypeInfo in createStructure.
+        (JSC::JSVariableObject::createStructure):
+
+2011-10-28  Pavel Feldman  <pfeldman@google.com>
+
+        Reset line numbers for scripts generated with document.write.
+        https://bugs.webkit.org/show_bug.cgi?id=71099
+
+        Reviewed by Yury Semikhatsky.
+
+        * wtf/text/TextPosition.h:
+        (WTF::OrdinalNumber::OrdinalNumber):
+
+2011-10-27  Daniel Bates  <dbates@rim.com>
+
+        CMake: Add support to optionally install the built JavaScript shell
+        https://bugs.webkit.org/show_bug.cgi?id=71062
+
+        Reviewed by Antonio Gomes.
+
+        Generate an installation rule for installing the JavaScript shell in
+        /bin (with respect to the prefix path) when SHOULD_INSTALL_JS_SHELL
+        is defined.
+
+        * shell/CMakeLists.txt:
+
+2011-10-27  Kentaro Hara  <haraken@chromium.org>
+
+        Generate WebKitCSSMatrix constructor for JSC by [Constructor] IDL
+        https://bugs.webkit.org/show_bug.cgi?id=70215
+
+        Reviewed by Adam Barth.
+
+        Added a method that judges if a given JSValue is empty.
+
+        Tests: transforms/svg-vs-css.xhtml
+               transforms/cssmatrix-2d-interface.xhtml
+               transforms/cssmatrix-3d-interface.xhtml
+
+        * runtime/JSValue.h:
+        * runtime/JSValueInlineMethods.h:
+        (JSC::JSValue::isEmpty):
+
+2011-10-27  Michael Saboff  <msaboff@apple.com>
+
+        ENH: Add 8 bit string support to JSC JIT
+        https://bugs.webkit.org/show_bug.cgi?id=71073
+
+        Changed the JIT String character access generation to create code
+        to check the character size and load8() or load16() as approriate.
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movzbl_mr):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadCharacterString):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JSInterfaceJIT.h:
+        (JSC::ThunkHelpers::stringImplFlagsOffset):
+        (JSC::ThunkHelpers::stringImpl8BitFlag):
+        * jit/ThunkGenerators.cpp:
+        (JSC::stringCharLoad):
+
+2011-10-27  Filip Pizlo  <fpizlo@apple.com>
+
+        If the bytecode generator emits code after the return in the first basic block,
+        DFG's inliner crashes
+        https://bugs.webkit.org/show_bug.cgi?id=71071
+
+        Reviewed by Gavin Barraclough.
+        
+        Removed some cruft dealing with parsing failures due to unsupported functionality
+        (that's never reached anymore due to it being caught in DFGCapabilities). This
+        allowed me to repurpose the bool return from parseBlock() to mean: true if we
+        should continue to parse, or false if we've already parsed all live code.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+
+2011-10-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Make FeatureDefines Identical Across OS X Projects
+        https://bugs.webkit.org/show_bug.cgi?id=71051
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-10-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Crash in JSC::Structure::materializePropertyMap when viewing Garden-O-Matic
+        https://bugs.webkit.org/show_bug.cgi?id=71045
+
+        Reviewed by Geoff Garen.
+        
+        Make sure that if a structure is pinned, it also has a property map.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::pin):
+        (JSC::Structure::copyPropertyTableForPinning):
+        * runtime/Structure.h:
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+
+2011-10-27  Michael Saboff  <msaboff@apple.com>
+
+        32bit build failure after r98624
+        https://bugs.webkit.org/show_bug.cgi?id=71064
+
+        Disambiguated operator overload with unsigned index (0u).
+
+        Reviewed by Sam Weinig.
+
+        * runtime/UString.h:
+        (JSC::operator==):
+
+2011-10-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Fix building on GNU/kFreeBSD
+        https://bugs.webkit.org/show_bug.cgi?id=71005
+
+        Reviewed by Darin Adler.
+
+        * config.h:
+        * wtf/Platform.h:
+
+2011-10-27  Michael Saboff  <msaboff@apple.com>
+
+        Investigate storing strings in 8-bit buffers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=66161
+
+        Investigate storing strings in 8-bit buffers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=66161
+
+        Added support for 8 bit string data in StringImpl.  Changed
+        (UChar*) m_data to m_data16.  Added char* m_data8 as a union
+        with m_data16.  Added UChar* m_copyData16 to the other union
+        to store a 16 bit copy of an 8 bit string when needed.
+        Added characters8() and characters16() accessor methods
+        that assume the caller has checked the underlying string type
+        via the new is8Bit() method. The characters() method will
+        return a UChar* of the string, materializing a 16 bit copy if the
+        string is an 8 bit string.  Added two flags, one for 8 bit buffer
+        and a second for a 16 bit copy for an 8 bit string.
+
+        Fixed method name typo (StringHasher::defaultCoverter()).
+
+        Over time the goal is to eliminate calls to characters() and
+        us the character8() and characters16() accessors.
+
+        This patch does not include changes that actually create 8 bit
+        strings. This is the first of at least 8 patches.  Subsequent
+        patches will be submitted for JIT changes, making the JSC lexer,
+        parser and literal parser, JavaScript string changes and
+        then changes in webcore to take advantage of the 8 bit strings.
+
+        This change is performance neutral for SunSpider and V8 when
+        run from the command line with "jsc".
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * parser/SourceProvider.h:
+        (JSC::UStringSourceProvider::data):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierCStringTranslator::equal):
+        (JSC::IdentifierCStringTranslator::translate):
+        (JSC::Identifier::add):
+        (JSC::Identifier::toUInt32):
+        * runtime/Identifier.h:
+        (JSC::Identifier::equal):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::resolveRopeSlowCase):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        * runtime/UString.cpp:
+        (JSC::UString::UString):
+        (JSC::equalSlowCase):
+        (JSC::UString::utf8):
+        * runtime/UString.h:
+        (JSC::UString::characters):
+        (JSC::UString::characters8):
+        (JSC::UString::characters16):
+        (JSC::UString::is8Bit):
+        (JSC::UString::operator[]):
+        (JSC::UString::find):
+        (JSC::operator==):
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::computeHash):
+        (WTF::StringHasher::defaultConverter):
+        * wtf/text/AtomicString.cpp:
+        (WTF::CStringTranslator::hash):
+        (WTF::CStringTranslator::equal):
+        (WTF::CStringTranslator::translate):
+        (WTF::AtomicString::add):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::AtomicString):
+        (WTF::AtomicString::contains):
+        (WTF::AtomicString::find):
+        (WTF::AtomicString::add):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::equalIgnoringCase):
+        * wtf/text/StringConcatenate.h:
+        * wtf/text/StringHash.h:
+        (WTF::StringHash::equal):
+        (WTF::CaseFoldingHash::hash):
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::~StringImpl):
+        (WTF::StringImpl::createUninitialized):
+        (WTF::StringImpl::create):
+        (WTF::StringImpl::getData16SlowCase):
+        (WTF::StringImpl::containsOnlyWhitespace):
+        (WTF::StringImpl::substring):
+        (WTF::StringImpl::characterStartingAt):
+        (WTF::StringImpl::lower):
+        (WTF::StringImpl::upper):
+        (WTF::StringImpl::fill):
+        (WTF::StringImpl::foldCase):
+        (WTF::StringImpl::stripMatchedCharacters):
+        (WTF::StringImpl::removeCharacters):
+        (WTF::StringImpl::simplifyMatchedCharactersToSpace):
+        (WTF::StringImpl::toIntStrict):
+        (WTF::StringImpl::toUIntStrict):
+        (WTF::StringImpl::toInt64Strict):
+        (WTF::StringImpl::toUInt64Strict):
+        (WTF::StringImpl::toIntPtrStrict):
+        (WTF::StringImpl::toInt):
+        (WTF::StringImpl::toUInt):
+        (WTF::StringImpl::toInt64):
+        (WTF::StringImpl::toUInt64):
+        (WTF::StringImpl::toIntPtr):
+        (WTF::StringImpl::toDouble):
+        (WTF::StringImpl::toFloat):
+        (WTF::equal):
+        (WTF::equalIgnoringCase):
+        (WTF::StringImpl::find):
+        (WTF::StringImpl::findIgnoringCase):
+        (WTF::StringImpl::reverseFind):
+        (WTF::StringImpl::replace):
+        (WTF::StringImpl::defaultWritingDirection):
+        (WTF::StringImpl::adopt):
+        (WTF::StringImpl::createWithTerminatingNullCharacter):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::StringImpl):
+        (WTF::StringImpl::create):
+        (WTF::StringImpl::create8):
+        (WTF::StringImpl::tryCreateUninitialized):
+        (WTF::StringImpl::flagsOffset):
+        (WTF::StringImpl::flagIs8Bit):
+        (WTF::StringImpl::dataOffset):
+        (WTF::StringImpl::is8Bit):
+        (WTF::StringImpl::characters8):
+        (WTF::StringImpl::characters16):
+        (WTF::StringImpl::characters):
+        (WTF::StringImpl::has16BitShadow):
+        (WTF::StringImpl::setHash):
+        (WTF::StringImpl::hash):
+        (WTF::StringImpl::copyChars):
+        (WTF::StringImpl::operator[]):
+        (WTF::StringImpl::find):
+        (WTF::StringImpl::findIgnoringCase):
+        (WTF::equal):
+        (WTF::equalIgnoringCase):
+        (WTF::StringImpl::isolatedCopy):
+        * wtf/text/WTFString.cpp:
+        (WTF::String::String):
+        (WTF::String::append):
+        (WTF::String::format):
+        (WTF::String::fromUTF8):
+        (WTF::String::fromUTF8WithLatin1Fallback):
+        * wtf/text/WTFString.h:
+        (WTF::String::find):
+        (WTF::String::findIgnoringCase):
+        (WTF::String::contains):
+        (WTF::String::append):
+        (WTF::String::fromUTF8):
+        (WTF::String::fromUTF8WithLatin1Fallback):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::equalIgnoringCase):
+        * wtf/unicode/Unicode.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::execute):
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::YarrCodeBlock::execute):
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::Parser):
+
+2011-10-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing windows build
+
+        Unreviewed build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-10-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add ability to check for presence of static members at compile time
+        https://bugs.webkit.org/show_bug.cgi?id=70986
+
+        Reviewed by Geoffrey Garen.
+
+        Added new CREATE_MEMBER_CHECKER macro to instantiate the template and the 
+        HAS_MEMBER_NAMED macro to use that template to check if the specified class 
+        does indeed have a method with that name.  This mechanism is not currently 
+        used anywhere, but will be in the future when adding virtual methods from 
+        JSObject to the MethodTable.
+
+        * runtime/ClassInfo.h:
+
+2011-10-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::toThisObject
+        https://bugs.webkit.org/show_bug.cgi?id=70958
+
+        Reviewed by Geoffrey Garen.
+
+        Converted all instances of toThisObject to static functions, 
+        added toThisObject to the MethodTable, and replaced all call sites
+        with a corresponding lookup in the MethodTable.
+
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/ClassInfo.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::toThisObject):
+        * runtime/JSActivation.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toThisObject):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::toThisObject):
+        * runtime/JSObject.h:
+        (JSC::JSValue::toThisObject):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::toThisObject):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::toThisObject):
+        * runtime/JSString.h:
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::toThisObject):
+        * runtime/StrictEvalActivation.h:
+
+2011-10-27  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Fix a small bug in callOperation after r98431
+        https://bugs.webkit.org/show_bug.cgi?id=70984
+
+        Reviewed by Geoffrey Garen.
+
+        TrustedImmPtr is not expecting "int" type parameters.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+
+2011-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Restore structure-clearing behaviour of allocateCell<>
+        https://bugs.webkit.org/show_bug.cgi?id=70976
+
+        Reviewed by Geoffrey Garen.
+
+        This restores the logic that allows the markstack to filter
+        live objects that have not yet been initialised.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::clearStructure):
+           Validation-safe method to clear a cell's structure.
+        (JSC::allocateCell):
+           Call the above method.
+        * runtime/Structure.h:
+        (JSC::MarkStack::internalAppend):
+           Don't visit cells that haven't been initialised.
+
+2011-10-26  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r97030): Cannot log in to progressive.com
+        https://bugs.webkit.org/show_bug.cgi?id=70094
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+
+2011-10-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove getOwnPropertySlotVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=70741
+
+        Reviewed by Geoffrey Garen.
+
+        Removed all declarations and definitions of getOwnPropertySlotVirtual.
+        Also replaced all call sites to getOwnPropertyVirtualVirtual with a 
+        corresponding lookup in the MethodTable.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyDescriptor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConstructor.h:
+        * runtime/DatePrototype.cpp:
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::create):
+        * runtime/ErrorPrototype.cpp:
+        * runtime/ErrorPrototype.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::getOwnPropertyNames):
+        (JSC::JSFunction::put):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::hasOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSValue::get):
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        * runtime/MathObject.cpp:
+        * runtime/MathObject.h:
+        (JSC::MathObject::create):
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::createStructure):
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        * runtime/StringPrototype.h:
+
+2011-10-26  Alejandro G. Castro  <alex@igalia.com>
+
+        [GTK] [WK2] Add WebKit2 distcheck support
+        https://bugs.webkit.org/show_bug.cgi?id=70933
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.list.am: Add MemoryStatistics.h to the sources list.
+
+2011-10-26  Michael Saboff  <msaboff@apple.com>
+
+        Increase StringImpl Flag Bits for 8 bit Strings
+        https://bugs.webkit.org/show_bug.cgi?id=70937
+
+        Increased the number of bits used for flags in StringImpl
+        from 6 to 8 bits. This frees up 2 flag bits that will be
+        used for 8-bit string support. Updated hash methods accordingly.
+        Changed hash value masking from the low bits to the high
+        bits.
+
+        Reviewed by Darin Adler.
+
+        * create_hash_table:
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::hash):
+        * wtf/text/StringImpl.h:
+
+2011-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        Reverted r98488, which caused the scripts’ status messages to be included in the generated
+        files.
+
+        * create_hash_table:
+        * create_jit_stubs:
+
+2011-10-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Don't print regular output to STDERR when generating hashtables and JIT stubs
+
+        Reviewed by Simon Hausmann.
+
+        * create_hash_table:
+        * create_jit_stubs:
+
+2011-10-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Split DFGJITCodeGenerator::callOperation methods
+        https://bugs.webkit.org/show_bug.cgi?id=70870
+
+        Reviewed by Filip Pizlo.
+
+        The DFGJITCodeGenerator currently contains two sets of callOperation methods.
+        One set works with the JSVALUE64 value representation and passes arguments in
+        registers (suitable for use on x86-64), and one set works with the JSVALUE32_64
+        value representation and passes arguments in memory  (suitable for use on x86).
+        By refactoring out the representation and calling convention specific aspects
+        of the code we can also configure the DFG JIT to operator on platforms that use
+        the JSVALUE32_64 value representation but pass arguments in registers.
+
+        On platforms supported by the JIT, the payload precedes the tag of a value in
+        argument/result ordering, as such, in order to make the setupResults method
+        generally applicable to return the results of a function that are returned in
+        two registers, the ordering of arguments to this function has been reversed -
+        as is the ordering of augments passed to setupArguments methods, with respect
+        to the ordering with which they are passed in to callOperation.
+        This inconsistency will be resolved in a later change when we combine the pairs
+        of arguments passed into callOperation, such that the function signatures can
+        be made consistent across the two value representations (the callOperation
+        methods will be passed a reference to a struct representing the JSValue
+        temporary, this will consist of two gprs on 32_64 and one on 64).
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::resetCallArguments):
+        (JSC::DFG::addCallArgument):
+            - moved, removed tag,payload version of this method.
+        (JSC::DFG::setupArguments):
+        (JSC::DFG::setupArgumentsExecState):
+        (JSC::DFG::setupArgumentsWithExecState):
+            - Calling convention specific portion of callOperation refactored out into these methods.
+        (JSC::DFG::callOperation):
+            - updated these methods to use setupArguments* methods.
+        (JSC::DFG::setupResults):
+            - setupResults is now passed payload,tag.
+        (JSC::DFG::appendCallWithExceptionCheckSetResult):
+            - Added fpr versions of this function.
+        (JSC::DFG::appendCallSetResult):
+            - Added versions of this function without exception check.
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+            - setupResults is now passed payload,tag.
+
+2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove deletePropertyVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=70738
+
+        Reviewed by Geoffrey Garen.
+
+        Removed all declarations and definitions of deletePropertyVirtual.
+        Also replaced all call sites to deletePropertyVirtual with a 
+        corresponding lookup in the MethodTable.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::deletePropertyByIndex):
+        * API/JSObjectRef.cpp:
+        (JSObjectDeleteProperty):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::deleteProperty):
+        * debugger/DebuggerActivation.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::deletePropertyByIndex):
+        * runtime/JSArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::deleteProperty):
+        (JSC::JSCell::deletePropertyByIndex):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+        * runtime/RegExpMatchesArray.h:
+        * runtime/StrictEvalActivation.cpp:
+        * runtime/StrictEvalActivation.h:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+
+2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove putVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=70740
+
+        Reviewed by Geoffrey Garen.
+
+        Removed all declarations and definitions of putVirtual.
+        Also replaced all call sites to putVirtual with a 
+        corresponding lookup in the MethodTable.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        (JSObjectSetPropertyAtIndex):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::put):
+        * debugger/DebuggerActivation.h:
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * runtime/Arguments.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::putByIndex):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSValue::put):
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
+
+2011-10-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Separate out function linking & exception check data structures.
+        https://bugs.webkit.org/show_bug.cgi?id=70858
+
+        Reviewed by Oliver Hunt.
+
+        This will make it easier to refactor the callOperation methods to spilt the value
+        representation specific handling from the cpu/calling-convention implementation.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::appendCallWithExceptionCheck):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::CallLinkRecord::CallLinkRecord):
+        (JSC::DFG::CallExceptionRecord::CallExceptionRecord):
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::notifyCall):
+        (JSC::DFG::JITCompiler::appendCall):
+        (JSC::DFG::JITCompiler::addExceptionCheck):
+        (JSC::DFG::JITCompiler::addFastExceptionCheck):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+
+2011-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Tiered compilation may introduce dangling pointers in constant buffers
+        https://bugs.webkit.org/show_bug.cgi?id=70854
+
+        Reviewed by Oliver Hunt.
+        
+        Tiered compilation now copies constant buffers, which fixes the regression in
+        https://bugs.webkit.org/show_bug.cgi?id=70246. No new tests because this
+        regression relies on a subtle interleaving of optimized compilation and garbage
+        collection, and cannot be reproduced in a simple test.
+        
+        This also adds some new debug support, which was used to fix this bug and is
+        likely to be useful in the future.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::copyDataFrom):
+        (JSC::CodeBlock::usesOpcode):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+
+2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing Windows build after r98367
+
+        Unreviewed build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-10-25  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Add missing DFG file entries to the make lists for GTK and Qt ports
+        https://bugs.webkit.org/show_bug.cgi?id=70806
+
+        Reviewed by Darin Adler.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pro:
+
+2011-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add getOwnPropertySlot to MethodTable
+        https://bugs.webkit.org/show_bug.cgi?id=69807
+
+        Reviewed by Oliver Hunt.
+
+        * JavaScriptCore.exp:
+        * runtime/ClassInfo.h: Added both versions of getOwnPropertySlot to the MethodTable.
+        * runtime/JSCell.h: Changed getOwnPropertySlot to be protected so other classes can 
+        reference it in their MethodTables.
+
+2011-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Need to support marking of multiple nested codeblocks when compiling
+        https://bugs.webkit.org/show_bug.cgi?id=70832
+
+        Reviewed by Gavin Barraclough.
+
+        When inlining a function we end up with multiple codeblocks being
+        compiled at the same time, so we need to support a list of live
+        codeblocks.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::startedCompiling):
+        (JSC::JSGlobalData::finishedCompiling):
+
+2011-10-24  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG JIT 32_64 - fillInteger should accept DataFormatJSInteger
+        https://bugs.webkit.org/show_bug.cgi?id=70798
+
+        Reviewed by Filip Pizlo.
+
+        When filling an integer for a known integer node (not speculated), it
+        should accept DataFormatJSInteger as well.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+
+2011-10-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: removed some cases of threadsafeCopy() that I missed in
+        my previous patch.
+
+        * JavaScriptCore.order:
+
+2011-10-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed SharedUChar and tightened language around its previous uses
+        https://bugs.webkit.org/show_bug.cgi?id=70698
+
+        Reviewed by David Levin.
+
+        - Removed SharedUChar because most of its functionality has moved into
+        other abstraction layers, and we want remaining clients to choose their
+        abstractions explicitly instead of relying on StringImpl to provide this
+        behavior implicitly, since we think they can sometimes make more efficient
+        choices.
+
+        - Renamed "threadSafeCopy" and "crossThreadCopy" to "isolatedCopy" because
+        the former names could give the impression that the resulting object was
+        thread-safe, but actually it's just an isolated copy, which is not
+        thread-safe by itself, but can be used to implement a thread-safe
+        algorithm through isolation.
+
+        * wtf/CrossThreadRefCounted.h: Removed.
+
+        * JavaScriptCore.exp: Export!
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::~StringImpl): Removed the stuff mentioned above.
+
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::length): Ditto.
+
+        (WTF::StringImpl::isolatedCopy): Inlined this, since it's now trivial.
+
+        * wtf/text/WTFString.cpp:
+        (WTF::String::isolatedCopy):
+        * wtf/text/WTFString.h: Updated for StringImpl changes.
+
+        * API/OpaqueJSString.h:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/OwnFastMallocPtr.h:
+        * wtf/RefCounted.h:
+        * wtf/SizeLimits.cpp:
+        * wtf/ThreadSafeRefCounted.h:
+        * wtf/wtf.pri:
+        * yarr/YarrPattern.h: Updated these files to accomodate removal of
+        CrossThreadRefCounted.h.
+
+2011-10-24  Oliver Hunt  <oliver@apple.com>
+
+        Crash in void JSC::validateCell<JSC::RegExp*>(JSC::RegExp*)
+        https://bugs.webkit.org/show_bug.cgi?id=70689
+
+        Reviewed by Filip Pizlo.
+
+        While performing codegen we need to make the GlobalData explicitly
+        aware of the codeblock being compiled, as compilation may trigger GC
+        and CodeBlock holds GC values, but has not yet been assigned to its
+        owner executable.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::~BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        * heap/AllocationSpace.cpp:
+        (JSC::AllocationSpace::allocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::startedCompiling):
+        (JSC::JSGlobalData::finishedCompiling):
+
+2011-10-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Object-or-other branch speculation may corrupt the state for OSR if the child of the
+        branch is an integer
+        https://bugs.webkit.org/show_bug.cgi?id=70777
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+
+2011-10-24  Filip Pizlo  <fpizlo@apple.com>
+
+        op_new_array_buffer is not inlined correctly
+        https://bugs.webkit.org/show_bug.cgi?id=70770
+
+        Reviewed by Oliver Hunt.
+        
+        Disabled inlining of op_new_array_buffer, for now.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineOpcode):
+
+2011-10-24  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Add boolean speculations to DFG JIT 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=70706
+
+        Reviewed by Filip Pizlo.
+
+        Different from the boolean speculations in DFG 64, the boolean
+        speculations in DFG 32_64 will use a 32bit GPR to hold the primitive
+        boolean instead of a JSBoolean. This choice is not only for
+        performance, but also to save a register as we're short of registers on
+        X86.
+        To accomplish this we make use of DataFormatBoolean, allow a value to
+        be represented as a primitive boolean and converted from/to a
+        JSBoolean.
+        This patch also fixes SpillOrder in 32_64, which should be different
+        from 64, and fixes needDataFormatConversion logic in 32_64.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTest32):
+            We don't expect byte test actually as it doesn't work for registers
+            esp..edi on X86.
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::needDataFormatConversion):
+        (JSC::DFG::GenerationInfo::initBoolean):
+        (JSC::DFG::GenerationInfo::gpr):
+        (JSC::DFG::GenerationInfo::fillInteger):
+        (JSC::DFG::GenerationInfo::fillBoolean):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::checkConsistency):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::use):
+        (JSC::DFG::JITCodeGenerator::silentSpillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::spill):
+        (JSC::DFG::cellResult):
+        (JSC::DFG::booleanResult):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::ValueRecovery::dump):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueSource::forPrediction):
+        (JSC::DFG::ValueRecovery::alreadyInRegisterFileAsUnboxedBoolean):
+        (JSC::DFG::ValueRecovery::inGPR):
+        (JSC::DFG::ValueRecovery::gpr):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing Windows build
+
+        Unreviewed build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-10-24  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        BitVector isInline check could fail
+        https://bugs.webkit.org/show_bug.cgi?id=70691
+
+        Reviewed by Geoffrey Garen.
+
+        Current BitVector uses the highest bit of m_bitsOrPointer to indicate
+        whether it's an inlined bit set or a pointer to an outOfLine bit set.
+        This check may fail in case the pointer also has the highest bit set,
+        which is surely possible on IA32 (Linux).
+        In this case the check failure can result in unexpected behaviors,
+        for example if the BitVector is incorrectly determined as having an
+        inlined bit set, then setting a bit exceeding maxInlineBits will wrongly
+        modify the memory adjacent to the BitVector object.
+        This fix is to use the lowest bit of m_bitsOrPointer to indicate inline
+        or outofline, based on the assumption that the pointer to OutOfLineBits
+        should be 4 or 8 byte aligned.
+        We could mark the lowest bit (bit 0) with 1 for inlined bit set,
+        and bits 1~bitsInPointer are used for bit set/test.
+        In this case we need do one bit more shift for bit set/test.
+
+        * wtf/BitVector.cpp:
+        (WTF::BitVector::resizeOutOfLine):
+        * wtf/BitVector.h:
+        (WTF::BitVector::quickGet):
+        (WTF::BitVector::quickSet):
+        (WTF::BitVector::quickClear):
+        (WTF::BitVector::makeInlineBits):
+        (WTF::BitVector::isInline):
+
+2011-10-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename static getOwnPropertySlot to getOwnPropertySlotByIndex
+        https://bugs.webkit.org/show_bug.cgi?id=70271
+
+        Reviewed by Darin Adler.
+
+        Renaming versions of getOwnPropertySlot that use an unsigned as the property
+        name to "getOwnPropertySlotByIndex" in preparation for adding them to the 
+        MethodTable, which requires unique names for each method.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlotVirtual):
+        (JSC::Arguments::getOwnPropertySlotByIndex):
+        * runtime/Arguments.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlotVirtual):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlotVirtual):
+        (JSC::JSByteArray::getOwnPropertySlotByIndex):
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertySlotVirtual):
+        (JSC::JSCell::getOwnPropertySlotByIndex):
+        * runtime/JSCell.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertySlotVirtual):
+        (JSC::JSNotAnObject::getOwnPropertySlotByIndex):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotVirtual):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlotVirtual):
+        (JSC::JSString::getOwnPropertySlotByIndex):
+        * runtime/JSString.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::getOwnPropertySlotVirtual):
+        (JSC::ObjectPrototype::getOwnPropertySlotByIndex):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlotVirtual):
+        (JSC::RegExpMatchesArray::getOwnPropertySlotByIndex):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertySlotVirtual):
+        (JSC::StringObject::getOwnPropertySlotByIndex):
+        * runtime/StringObject.h:
+
+2011-10-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Interpreter build fix after r98179.
+
+        * bytecode/CodeBlock.h:
+        Moved CodeBlock::baselineVersion() into ENABLE(JIT) block,
+        since it is only used there.
+
+2011-10-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a typo Darin spotted.
+
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::hash): Expelliarmus!
+
+2011-10-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed StringImpl::createStrippingNullCharacters
+        https://bugs.webkit.org/show_bug.cgi?id=70700
+
+        Reviewed by David Levin.
+        
+        It was unused.
+
+        * JavaScriptCore.exp:
+        * wtf/text/StringImpl.cpp:
+        * wtf/text/StringImpl.h:
+
+2011-10-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline constructors
+        https://bugs.webkit.org/show_bug.cgi?id=70675
+
+        Reviewed by Oliver Hunt.
+        
+        Adds support for inlining constructors. Also fixes two pathologies
+        uncovered along the way: CheckMethod claimed that it never returned a
+        result (causing CheckMethod -> SetLocal -> GetLocal sequences to
+        result in the GetLocal doing OSR exit), and get_by_id parsing never
+        checked if it was hot in slow path. Also fiddled with inlining
+        heuristics; it appears that for now, the more inlining, the happier
+        V8 is. Finally, a bug was uncovered where a silent spill of a boxed
+        integer that had previously been spilled unboxed causes the silent
+        fill to forget to unbox.
+        
+        This appears to be a 4% speed-up on V8 in their harness, or a 1%
+        speed-up in my harness. The difference is due to warm-up: in my
+        harness we see significant amounts of time spent in compilation, but
+        in V8's harness compilation gets amortizes. Profiling indicates that
+        we have the potential for a 5% win from basic optimizations like
+        generating OSR exits lazily and holding onto bytecode longer.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        (JSC::DFG::canInlineOpcode):
+        (JSC::DFG::mightInlineFunctionFor):
+        (JSC::DFG::canInlineFunctionFor):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        * runtime/Executable.h:
+        (JSC::isCall):
+        (JSC::ExecutableBase::intrinsicFor):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h:
+
+2011-10-23  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Remove RopeImpl.{h,cpp} from the gyp projects
+        https://bugs.webkit.org/show_bug.cgi?id=70703
+
+        Reviewed by Kent Tamura.
+
+        runtime/RopeImpl.{h,cpp} were removed in r97872, remove references
+        to these files from the gyp project files.
+
+        * JavaScriptCore.gypi:
+
+2011-10-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add deleteProperty to the MethodTable
+        https://bugs.webkit.org/show_bug.cgi?id=70162
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.exp:
+        * runtime/ClassInfo.h: Added both versions of deleteProperty to the MethodTable.
+        * runtime/JSFunction.h: Changed JSFunction::deleteProperty to 
+        be protected rather than private for subclasses who don't provide their own
+        implementation.
+
+2011-10-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove getConstructDataVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=70638
+
+        Reviewed by Darin Adler.
+
+        Removed all declarations and definitions of getConstructDataVirtual.
+        Also replaced all call sites to getConstructDataVirtual with a 
+        corresponding lookup in the MethodTable.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSObjectRef.cpp:
+        (JSObjectIsConstructor):
+        (JSObjectCallAsConstructor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayConstructor.h:
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConstructor.h:
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::getConstructData):
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionConstructor.h:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+        * runtime/JSObject.h:
+        (JSC::getConstructData):
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectConstructor.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringConstructor.h:
+
+2011-10-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the SL build.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): Cast
+        away int vs unisgned warning.
+
+2011-10-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Separated string lifetime bits from character buffer state bits
+        https://bugs.webkit.org/show_bug.cgi?id=70673
+
+        Reviewed by Anders Carlsson.
+        
+        Moved the static/immortal bit into the bottom bit of the refcount, and
+        moved all other bits into the high bits of the hash code.
+        
+        This is the first step toward a new Characters/PassString class, and it
+        makes ref/deref slightly more efficient.
+
+        * create_hash_table:
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::hash): Tweaked the string hashing function to leave
+        the top bits clear, so they can be used as flags.
+        
+        Fixed some small differences between the PERL copy of this function and
+        the C++ copy of this function, which could have in theory caused subtle
+        crashes.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::sharedBuffer):
+        (WTF::StringImpl::createWithTerminatingNullCharacter):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::StringImpl):
+        (WTF::StringImpl::cost): Renamed s_refCountFlagShouldReportedCost to
+        s_didReportExtraCost, since the original name was both self-contradictory
+        and used as a double-negative.
+
+        (WTF::StringImpl::isIdentifier):
+        (WTF::StringImpl::setIsIdentifier):
+        (WTF::StringImpl::hasTerminatingNullCharacter):
+        (WTF::StringImpl::isAtomic):
+        (WTF::StringImpl::setIsAtomic):
+        (WTF::StringImpl::setHash):
+        (WTF::StringImpl::rawHash):
+        (WTF::StringImpl::hasHash):
+        (WTF::StringImpl::existingHash):
+        (WTF::StringImpl::hash):
+        (WTF::StringImpl::hasOneRef):
+        (WTF::StringImpl::ref):
+        (WTF::StringImpl::deref):
+        (WTF::StringImpl::bufferOwnership):
+        (WTF::StringImpl::isStatic): Moved the static/immortal bit into the bottom
+        bit of the refcount. Now, all lifetime information lives in the refcount
+        field. Moved the other bits into the hash code field.
+
+2011-10-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG inlining sometimes fails to reset constant references
+        https://bugs.webkit.org/show_bug.cgi?id=70668
+
+        Reviewed by Anders Carlsson.
+        
+        Reset constant references when we need to (new block created) and not
+        when we don't (change of inlining depth).
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::prepareToParseBlock):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+
+2011-10-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have inlining
+        https://bugs.webkit.org/show_bug.cgi?id=69996
+
+        Reviewed by Oliver Hunt.
+        
+        Implements inlining that's hooked into the bytecode parser. Only
+        works for calls, for now, though nothing fundamentally prevents us
+        from inlining constructor calls. 2% overall speed-up on all
+        benchmarks. 7% speed-up on V8 (around 34% and 27% on deltablue and
+        richards respectively), neutral on Kraken and SunSpider. 
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::CodeBlock::setInstructionCount):
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::inlineDepthForCallFrame):
+        (JSC::CodeOrigin::inlineDepth):
+        (JSC::CodeOrigin::operator==):
+        (JSC::CodeOrigin::inlineStack):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::BasicBlock::ensureLocals):
+        (JSC::DFG::UnlinkedBlock::UnlinkedBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getDirect):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::setDirect):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::~InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::linkBlocks):
+        (JSC::DFG::ByteCodeParser::handleSuccessor):
+        (JSC::DFG::ByteCodeParser::determineReachability):
+        (JSC::DFG::ByteCodeParser::buildOperandMapsIfNecessary):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::canHandleOpcodes):
+        (JSC::DFG::canCompileOpcodes):
+        (JSC::DFG::canInlineOpcodes):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        (JSC::DFG::canInlineOpcode):
+        (JSC::DFG::canInlineOpcodes):
+        (JSC::DFG::canInlineFunctionForCall):
+        (JSC::DFG::canInlineFunctionForConstruct):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::printWhiteSpace):
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::GetBytecodeBeginForBlock::operator()):
+        (JSC::DFG::Graph::blockIndexForBytecodeOffset):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::decodedCodeMapFor):
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::debugCall):
+        (JSC::DFG::JITCompiler::baselineCodeBlockFor):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasVariableAccessData):
+        (JSC::DFG::Node::shouldGenerate):
+        * dfg/DFGOperands.h:
+        (JSC::DFG::Operands::ensureLocals):
+        (JSC::DFG::Operands::setLocal):
+        (JSC::DFG::Operands::getLocal):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallerFrameSlow):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::profiledCodeBlockFor):
+        (JSC::FunctionExecutable::parameterCount):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h:
+        * runtime/JSFunction.h:
+
+2011-10-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add put to the MethodTable
+        https://bugs.webkit.org/show_bug.cgi?id=70439
+
+        Reviewed by Oliver Hunt.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/ClassInfo.h: Added put and putByIndex to the MethodTable.
+        * runtime/JSFunction.h: Changed access modifier for put to protected since some
+        subclasses of JSFunction need to reference it in their MethodTables.
+
+2011-10-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add finalizer to JSObject
+        https://bugs.webkit.org/show_bug.cgi?id=70336
+
+        Reviewed by Darin Adler.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor): Skip the call to the destructor 
+        if we're a JSFinalObject, since the finalizer takes care of things.
+        * runtime/JSCell.h:
+        (JSC::JSCell::~JSCell): Remove the GC validation due to a conflict with 
+        future changes and the fact that we no longer always call the destructor, making 
+        the information provided less useful.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::finalize): Add finalizer for JSObject.
+        (JSC::JSObject::allocatePropertyStorage): The first time we need to allocate out-of-line
+        property storage, we add a finalizer to ourself.
+        * runtime/JSObject.h:
+
+2011-10-21  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Remove QtScript source code from WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=64088
+
+        Reviewed by Tor Arne Vestbø.
+
+        Removed dead code that isn't developed anymore.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * qt/api/QtScript.pro: Removed.
+        * qt/api/qscriptconverter_p.h: Removed.
+        * qt/api/qscriptengine.cpp: Removed.
+        * qt/api/qscriptengine.h: Removed.
+        * qt/api/qscriptengine_p.cpp: Removed.
+        * qt/api/qscriptengine_p.h: Removed.
+        * qt/api/qscriptfunction.cpp: Removed.
+        * qt/api/qscriptfunction_p.h: Removed.
+        * qt/api/qscriptoriginalglobalobject_p.h: Removed.
+        * qt/api/qscriptprogram.cpp: Removed.
+        * qt/api/qscriptprogram.h: Removed.
+        * qt/api/qscriptprogram_p.h: Removed.
+        * qt/api/qscriptstring.cpp: Removed.
+        * qt/api/qscriptstring.h: Removed.
+        * qt/api/qscriptstring_p.h: Removed.
+        * qt/api/qscriptsyntaxcheckresult.cpp: Removed.
+        * qt/api/qscriptsyntaxcheckresult.h: Removed.
+        * qt/api/qscriptsyntaxcheckresult_p.h: Removed.
+        * qt/api/qscriptvalue.cpp: Removed.
+        * qt/api/qscriptvalue.h: Removed.
+        * qt/api/qscriptvalue_p.h: Removed.
+        * qt/api/qscriptvalueiterator.cpp: Removed.
+        * qt/api/qscriptvalueiterator.h: Removed.
+        * qt/api/qscriptvalueiterator_p.h: Removed.
+        * qt/api/qtscriptglobal.h: Removed.
+        * qt/benchmarks/benchmarks.pri: Removed.
+        * qt/benchmarks/benchmarks.pro: Removed.
+        * qt/benchmarks/qscriptengine/qscriptengine.pro: Removed.
+        * qt/benchmarks/qscriptengine/tst_qscriptengine.cpp: Removed.
+        * qt/benchmarks/qscriptvalue/qscriptvalue.pro: Removed.
+        * qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp: Removed.
+        * qt/tests/qscriptengine/qscriptengine.pro: Removed.
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp: Removed.
+        * qt/tests/qscriptstring/qscriptstring.pro: Removed.
+        * qt/tests/qscriptstring/tst_qscriptstring.cpp: Removed.
+        * qt/tests/qscriptvalue/qscriptvalue.pro: Removed.
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp: Removed.
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h: Removed.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_comparison.cpp: Removed.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_init.cpp: Removed.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_istype.cpp: Removed.
+        * qt/tests/qscriptvalue/tst_qscriptvalue_generated_totype.cpp: Removed.
+        * qt/tests/qscriptvalueiterator/qscriptvalueiterator.pro: Removed.
+        * qt/tests/qscriptvalueiterator/tst_qscriptvalueiterator.cpp: Removed.
+        * qt/tests/tests.pri: Removed.
+        * qt/tests/tests.pro: Removed.
+
+2011-10-21  Zheng Liu  <zheng.z.liu@intel.com>
+
+        bytecompiler sometimes generates incorrect bytecode for put_by_id
+        https://bugs.webkit.org/show_bug.cgi?id=70403
+
+        Reviewed by Filip Pizlo.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+
+2011-10-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not try to predict argument types by looking at the values of
+        argument registers at the time of compilation
+        https://bugs.webkit.org/show_bug.cgi?id=70578
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.cpp:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h:
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::compileFor):
+        (JSC::FunctionExecutable::compileOptimizedFor):
+
+2011-10-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG call optimization handling will fail if the call had been unlinked due
+        to the callee being optimized
+        https://bugs.webkit.org/show_bug.cgi?id=70468
+
+        Reviewed by Geoff Garen.
+        
+        If a call had ever been linked, we remember this fact as well as the function
+        to which it was linked even if unlinkIncomingCalls() or unlinkCalls() are
+        called.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkFor):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkFor):
+
+2011-10-20  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG JIT 32_64 - Fix ByteArray speculation
+        https://bugs.webkit.org/show_bug.cgi?id=70571
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueSource::forPrediction):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-20  Vincent Scheib  <scheib@chromium.org>
+
+        MouseLock compile and run time flags.
+        https://bugs.webkit.org/show_bug.cgi?id=70530
+
+        Reviewed by Darin Fisher.
+
+        * wtf/Platform.h:
+
+2011-10-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename static deleteProperty to deletePropertyByIndex
+        https://bugs.webkit.org/show_bug.cgi?id=70257
+
+        Reviewed by Geoffrey Garen.
+
+        Renaming versions of deleteProperty that use an unsigned as the property
+        name to "deletePropertyByIndex" in preparation for adding them to the 
+        MethodTable, which requires unique names for each method.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::deletePropertyVirtual):
+        (JSC::::deletePropertyByIndex):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deletePropertyVirtual):
+        (JSC::Arguments::deletePropertyByIndex):
+        * runtime/Arguments.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::deletePropertyVirtual):
+        (JSC::JSArray::deletePropertyByIndex):
+        * runtime/JSArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::deletePropertyVirtual):
+        (JSC::JSCell::deletePropertyByIndex):
+        * runtime/JSCell.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::deletePropertyVirtual):
+        (JSC::JSNotAnObject::deletePropertyByIndex):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deletePropertyVirtual):
+        (JSC::JSObject::deletePropertyByIndex):
+        * runtime/JSObject.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::deletePropertyVirtual):
+        (JSC::RegExpMatchesArray::deletePropertyByIndex):
+
+2011-10-20  Filip Pizlo  <fpizlo@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=70482
+        DFG-related stubs in the old JIT should not be built if the DFG is disabled
+
+        Reviewed by Zoltan Herczeg.
+        
+        Aiming for a slight code size/build time reduction if the DFG is not in
+        play. This should also make further DFG development slightly easier since
+        the bodies of these JIT stubs can now safely refer to things that are only
+        declared when the DFG is enabled.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2011-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ConvertThis emits slow code when the source node is known to be,
+        but not predicted to be, a final object
+        https://bugs.webkit.org/show_bug.cgi?id=70466
+
+        Reviewed by Oliver Hunt.
+        
+        Added a new case in ConvertThis compilation.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Optimization triggers in the old JIT may sometimes fire repeatedly even
+        though there is no optimization to be done
+        https://bugs.webkit.org/show_bug.cgi?id=70467
+
+        Reviewed by Oliver Hunt.
+        
+        If optimize_from_ret does nothing, it delays the next optimization trigger.
+        This is performance-neutral.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Heuristics.cpp:
+        (JSC::Heuristics::initializeHeuristics):
+
+2011-10-19  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG JIT 32_64 - remove unnecessary double unboxings in fillDouble/fillSpeculateDouble
+        https://bugs.webkit.org/show_bug.cgi?id=70460
+
+        Reviewed by Filip Pizlo.
+
+        As pointed out by Gavin in bug #70418, when a value is already in memory
+        we can avoid loading it to two GPRs at first and then unboxing them to a FPR.
+        This gives 9% improvement on Kraken if without the change in bug #70418,
+        and 1% if based on the code with bug #70418 change.
+        Performance is neutral in V8 and SunSpider.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2011-10-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Poisoning of strict caller,arguments inappropriately poisoning "in"
+        https://bugs.webkit.org/show_bug.cgi?id=63398
+
+        Reviewed by Oliver Hunt.
+
+        This fixes the problem by correctly implementing the spec -
+        the error should actually be being thrown from a standard JS getter/setter.
+        This implements spec correct behaviour for strict mode JS functions & bound
+        functions, I'll follow up with a patch to do the same for arguments.
+
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::finishCreation):
+            - Add the poisoned caller/arguments properties.
+        * runtime/JSBoundFunction.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::put):
+            - If the caller/arguments are accessed on a strict mode function, lazily add the ThrowTypeError getter.
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createThrowTypeError):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::throwTypeErrorGetterSetter):
+            - Add a ThrowTypeError type, per ES5 13.2.3.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncThrowTypeError):
+        * runtime/JSGlobalObjectFunctions.h:
+            - Implementation of ThrowTypeError.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::initializeGetterSetterProperty):
+        * runtime/JSObject.h:
+            - This function adds a new property (must not exist already) that is an initialized getter/setter.
+
+2011-10-19  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG JIT 32_64 - improve double boxing/unboxing
+        https://bugs.webkit.org/show_bug.cgi?id=70418
+
+        Reviewed by Gavin Barraclough.
+
+        Double boxing/unboxing in DFG JIT 32_64 is currently implemented inefficiently,
+        which tries to exchange data through memory.
+        On X86 some SSE instructions can help us on such operations with better performance.
+        This improves 32-bit DFG performance by 29% on Kraken, 7% on SunSpider,
+        and 2% on V8, tested on Linux X86 (Core i7 Nehalem).
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::lshiftPacked):
+        (JSC::MacroAssemblerX86Common::rshiftPacked):
+        (JSC::MacroAssemblerX86Common::orPacked):
+        (JSC::MacroAssemblerX86Common::moveInt32ToPacked):
+        (JSC::MacroAssemblerX86Common::movePackedToInt32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movd_rr):
+        (JSC::X86Assembler::psllq_i8r):
+        (JSC::X86Assembler::psrlq_i8r):
+        (JSC::X86Assembler::por_rr):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::boxDouble):
+        (JSC::DFG::JITCodeGenerator::unboxDouble):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::boxDouble):
+        (JSC::DFG::JITCompiler::unboxDouble):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::convertToDouble):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-19  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [EFL] Fix DSO linkage of wtf_efl.
+
+        Unreviewed build fix.
+
+        Need to add -ldl to jsc_efl (requested by dladdr).
+
+        * wtf/CMakeListsEfl.txt:
+
+2011-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed StringImplBase, fusing it into StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=70443
+
+        Reviewed by Gavin Barraclough.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::StringImpl):
+        (WTF::StringImpl::ref):
+        (WTF::StringImpl::length):
+        * wtf/text/StringImplBase.h: Removed.
+        * wtf/wtf.pri: Removed!
+
+2011-10-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add getConstructData to the MethodTable
+        https://bugs.webkit.org/show_bug.cgi?id=70163
+
+        Reviewed by Geoffrey Garen.
+
+        Adding getConstructData to the MethodTable in order to be able to 
+        remove all calls to getConstructDataVirtual soon.  Part of the process 
+        of de-virtualizing JSCell.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/ClassInfo.h:
+
+2011-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Support CanvasPixelArray in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=70384
+
+        Reviewed by Filip Pizlo.
+
+        Add support for the old CanvasPixelArray optimisations to the
+        DFG.  This removes the regression seen in the DFG when using
+        a CPA.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::store8):
+        (JSC::MacroAssemblerX86Common::truncateDoubleToInt32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movb_rm):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp8):
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        (JSC::predictionFromClassInfo):
+        * bytecode/PredictedType.h:
+        (JSC::isByteArrayPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateByteArray):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::compileClampDoubleToByte):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForByteArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnByteArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::offsetOfStorage):
+        * wtf/ByteArray.cpp:
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::offsetOfSize):
+        (WTF::ByteArray::offsetOfData):
+
+2011-10-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Some rope cleanup following r97827
+        https://bugs.webkit.org/show_bug.cgi?id=70398
+
+        Reviewed by Oliver Hunt.
+
+        9% speedup on date-format-xparb, neutral overall.
+        
+        - Removed RopeImpl*.
+        - Removed JSString::m_fiberCount, since this can be deduced from other data.
+        - Renamed a jsString() variant to jsStringFromArguments for clarity.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.order:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed RopeImpl*.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadCharacterString):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        * jit/ThunkGenerators.cpp:
+        (JSC::stringCharLoad): Use a NULL m_value to signal rope-iness, instead
+        of testing m_fiberCount, since m_fiberCount is gone now.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::RopeBuilder::expand):
+        (JSC::JSString::visitChildren):
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::resolveRopeSlowCase):
+        (JSC::JSString::outOfMemory): Use a NULL fiber to indicate "last fiber
+        in the vector" instead of testing m_fiberCount, since m_fiberCount is gone now.
+
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::finishCreation):
+        (JSC::RopeBuilder::offsetOfLength):
+        (JSC::RopeBuilder::isRope):
+        (JSC::RopeBuilder::string): Removed m_fiberCount. Renamed
+        jsString => jsStringFromArguments for clarity.
+
+        * runtime/Operations.h:
+        (JSC::jsStringFromArguments): Renamed.
+
+        * runtime/RopeImpl.cpp: Removed.
+        * runtime/RopeImpl.h: Removed.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createEmptyString): Switched to StringImpl::empty,
+        which is slightly faster.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncConcat): Updated for rename.
+
+        * wtf/text/StringImplBase.h:
+        (WTF::StringImplBase::StringImplBase): Removed the concept of an invalid
+        StringImpl, since this was only used by RopeImpl, which is now gone.
+
+2011-10-19  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        [EFL] Fix DSO linkage of jsc_efl.
+        https://bugs.webkit.org/show_bug.cgi?id=70412
+
+        Unreviewed build fix.
+
+        Need to add -ldl to jsc_efl (requested by dladdr).
+
+        * shell/CMakeListsEfl.txt:
+
+2011-10-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out last Windows build fix because it was wrong.
+
+2011-10-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out last Windows build fix because it was wrong.
+
+2011-10-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix part of the Windows build.
+        
+        Export!
+
+2011-10-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Switched ropes from malloc memory to GC memory
+        https://bugs.webkit.org/show_bug.cgi?id=70364
+
+        Reviewed by Gavin Barraclough.
+
+        ~1% SunSpider speedup. Neutral elsewhere. Removes one cause for strings
+        having C++ destructors.
+
+        * heap/MarkStack.cpp:
+        (JSC::visitChildren): Call the JSString visitChildren function now,
+        since it's no longer a no-op.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::~JSString): Moved this destructor out of line because
+        it's called virtually, so there's no value to inlining.
+
+        (JSC::JSString::RopeBuilder::expand): Switched RopeBuilder to be a thin
+        initializing wrapper around JSString. JSString now represents ropes
+        directly, rather than relying on an underlying malloc object.
+
+        (JSC::JSString::visitChildren): Visit our rope fibers, since they're GC
+        objects now.
+
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::resolveRopeSlowCase):
+        (JSC::JSString::outOfMemory): Updated for operating on JSStrings instead
+        of malloc objects.
+
+        (JSC::JSString::replaceCharacter): Removed optimizations for substringing
+        ropes and replacing subsections of ropes. We want to reimplement versions
+        of these optimizations in the future, but this patch already has good
+        performance without them.
+
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::finishCreation):
+        (JSC::RopeBuilder::createNull):
+        (JSC::RopeBuilder::create):
+        (JSC::RopeBuilder::createHasOtherOwner):
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsNontrivialString):
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString): Lots of mechanical changes here. The two important
+        things are: (1) The fibers in JSString::m_fibers are JSStrings now, not
+        malloc objects; (2) I simplified the JSString constructor interface to
+        only accept PassRefPtr<StringImpl>, instead of variations on that like
+        UString, reducing refcount churn.
+
+        * runtime/JSValue.h:
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toPrimitiveString): Updated this function to return a
+        JSString instead of a UString, since that's what clients want now.
+
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createEmptyString): Updated for interface changes above.
+
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        * runtime/StringObject.h:
+        (JSC::StringObject::create): Don't create a new JSString if we already
+        have a JSString.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncConcat): Updated for interface changes above.
+
+2011-10-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Errrk, fix partial commit of r97825!
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+
+2011-10-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Date.prototype.toISOString fails to throw exception
+        https://bugs.webkit.org/show_bug.cgi?id=70394
+
+        Reviewed by Sam Weinig.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+            - Should throw a range error if the internal value is not finite.
+
+2011-10-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename static put to putByIndex
+        https://bugs.webkit.org/show_bug.cgi?id=70281
+
+        Reviewed by Geoffrey Garen.
+
+        Renaming versions of deleteProperty that use an unsigned as the property
+        name to "deletePropertyByIndex" in preparation for adding them to the 
+        MethodTable, which requires unique names for each method.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putVirtual):
+        (JSC::Arguments::putByIndex):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncMap):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        (JSC::JSArray::putVirtual):
+        (JSC::JSArray::putByIndex):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::putVirtual):
+        (JSC::JSByteArray::putByIndex):
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putVirtual):
+        (JSC::JSCell::putByIndex):
+        * runtime/JSCell.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::putVirtual):
+        (JSC::JSNotAnObject::putByIndex):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putVirtual):
+        (JSC::JSObject::putByIndex):
+        * runtime/JSObject.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::putVirtual):
+        (JSC::RegExpMatchesArray::putByIndex):
+
+2011-10-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype methods missing exception checks
+        https://bugs.webkit.org/show_bug.cgi?id=70360
+
+        Reviewed by Geoff Garen.
+
+        Missing exception checks after calls to the static getProperty helper,
+        these may result in the wrong exception being thrown (or an ASSERT being hit,
+        as is currently the case running test-262).
+
+        No performance impact.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+
+2011-10-18  Adam Barth  <abarth@webkit.org>
+
+        Always enable ENABLE(XPATH)
+        https://bugs.webkit.org/show_bug.cgi?id=70217
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-10-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Indexed arguments on the Arguments object should be enumerable.
+        https://bugs.webkit.org/show_bug.cgi?id=70302
+
+        Reviewed by Sam Weinig.
+
+        See ECMA-262 5.1 chapter 10.6 step 11b.
+        This is visible through a number of means, including Object.keys, Object.getOwnPropertyDescriptor, and operator in.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertyDescriptor):
+            - The 'enumerable' property should be true for indexed arguments.
+        (JSC::Arguments::getOwnPropertyNames):
+            - Don't guard the adding of indexed properties with 'IncludeDontEnumProperties'.
+
+2011-10-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Fix distcheck.
+
+        * GNUmakefile.list.am: fix a typo and add a missing header to the
+        list.
+
+2011-10-18  Balazs Kelemen  <kbalazs@webkit.org>
+
+        ParallelJobs: maximum number of threads should be determined dynamically
+        https://bugs.webkit.org/show_bug.cgi?id=68540
+
+        Reviewed by Zoltan Herczeg.
+
+        Add logic to determine the number of cores and use this as
+        the maximum number of threads. The implementation currently
+        covers Linux, Darwin, Windows, AIX, Solaris, OpenBSD and NetBSD.
+        The patch was tested on Linux, Mac and Windows which was enough to
+        cover all code path. It should work on the rest accoring to the
+        documentation of those OS's. The hard coded constant is still used
+        on uncovered OS's which should be fixed in the future.
+
+        * wtf/ParallelJobs.h: Removed the default value of the requestedJobNumber
+        argument because clients should always fill it and the 0 default value
+        was incorrect anyway.
+        (WTF::ParallelJobs::ParallelJobs):
+        * wtf/ParallelJobsGeneric.cpp:
+        (WTF::ParallelEnvironment::determineMaxNumberOfParallelThreads):
+        * wtf/ParallelJobsGeneric.h:
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+
+2011-10-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reverted r997709, this caused test failures.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasProperty):
+        (JSC::JSObject::hasOwnProperty):
+
+2011-10-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Rename deregister* to unregister*
+        https://bugs.webkit.org/show_bug.cgi?id=70272
+
+        Reviewed by Darin Adler.
+
+        Renamed deregisterWeakMap to unregisterWeakMap.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::unregisterWeakMap):
+
+2011-10-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Poisoning of strict caller/arguments inappropriately poisoning "in"
+        https://bugs.webkit.org/show_bug.cgi?id=63398
+
+        Reviewed by Sam Weinig.
+
+        The problem here is that the has[Own]Property methods get the slot rather than
+        the descriptor, and getting the slot may cause the property to be eagerly accessed.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - We don't expect hasProperty to ever throw. If it does, it won't get caught
+              (since it is after the exception check), so ASSERT to guard against this.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasProperty):
+        (JSC::JSObject::hasOwnProperty):
+            - These methods should not check for the presence of the descriptor; never get the value.
+
+2011-10-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Exception ordering in String.prototype.replace
+        https://bugs.webkit.org/show_bug.cgi?id=70290
+
+        If pattern is not a regexp, it should be converted toString before the replacement value has it's toString conversion called.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2011-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG bytecode parser should understand inline stacks
+        https://bugs.webkit.org/show_bug.cgi?id=70278
+
+        Reviewed by Oliver Hunt.
+        
+        The DFG bytecode parser is now capable of parsing multiple code blocks at
+        once. This remains turned off since not all inlining functionality is
+        implemented.       
+        
+        This required making a few changes elsewhere in the system. The bytecode
+        parser now may do some of the same things that the bytecode generator does,
+        like allocating constants and identifiers. Basic block linking relies on
+        bytecode indices, which are only meaningful within the context of one basic
+        block. This is fine, so long as linking is done eagerly whenever switching
+        from one code block to another.
+
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::CodeOrigin):
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getThis):
+        (JSC::DFG::ByteCodeParser::setThis):
+        (JSC::DFG::ByteCodeParser::currentCodeOrigin):
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::executable):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::~InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::linkBlocks):
+        (JSC::DFG::ByteCodeParser::setupPredecessors):
+        (JSC::DFG::ByteCodeParser::buildOperandMapsIfNecessary):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::GetBytecodeBeginForBlock::GetBytecodeBeginForBlock):
+        (JSC::DFG::GetBytecodeBeginForBlock::operator()):
+        (JSC::DFG::Graph::blockIndexForBytecodeOffset):
+        * dfg/DFGNode.h:
+        * runtime/Identifier.h:
+        (JSC::IdentifierMapIndexHashTraits::emptyValue):
+        * runtime/JSValue.h:
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearchWithFunctor):
+
+2011-10-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Incorrect behavior from String match/search & undefined pattern
+        https://bugs.webkit.org/show_bug.cgi?id=70286
+
+        Reviewed by Sam weinig.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+            - In case of undefined, pattern is "".
+        (JSC::stringProtoFuncSearch):
+            - In case of undefined, pattern is "".
+
+2011-10-17  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=70207
+        After deleting __defineSetter__, it is absent but appears in name list
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyNames):
+            - This should check whether static functions have been reified.
+
+2011-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix.
+
+        * JavaScriptCore.exp: Export!
+
+2011-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export!
+
+2011-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * heap/HandleStack.cpp: Added a missing #include.
+
+2011-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed no
+        longer existant symbol.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::shrinkAllocation): Cast to the right type.
+
+2011-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Simplified GC marking logic
+        https://bugs.webkit.org/show_bug.cgi?id=70258
+
+        Reviewed by Filip Pizlo.
+        
+        No perf. change.
+        
+        This is a first step toward GC allocating string backing stores, starting
+        with ropes. It also enables future simplifications and optimizations.
+        
+        - Replaced some complex mark stack logic with a simple linear stack of
+        JSCell pointers.
+        
+        - Replaced logic for short-circuiting marking based on JSType and/or
+        Structure flags with special cases for object, array, and string.
+        
+        - Fiddled with inlining for better codegen.
+
+        * JavaScriptCore.exp:
+        * heap/HandleStack.cpp: Build!
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap): Provide more vptrs to SlotVisitor, for use in marking.
+
+        * heap/HeapRootVisitor.h: Removed unused functions that no longer build.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::MarkStackArray):
+        (JSC::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStackArray::expand):
+        (JSC::MarkStackArray::shrinkAllocation):
+        (JSC::MarkStack::reset):
+        (JSC::visitChildren):
+        (JSC::SlotVisitor::drain):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::~MarkStack):
+        (JSC::MarkStackArray::append):
+        (JSC::MarkStackArray::removeLast):
+        (JSC::MarkStackArray::isEmpty):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendUnbarrieredPointer):
+        (JSC::MarkStack::internalAppend): Replaced complex mark set logic with
+        simple linear stack.
+
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::SlotVisitor): Updated for above changes.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildren):
+        * runtime/JSArray.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        * runtime/JSObject.h: Don't inline visitChildren; it's too big.
+
+        * runtime/Structure.h:
+        (JSC::MarkStack::internalAppend): Nixed the short-circuit for CompoundType
+        because it prevented strings from owning GC pointers.
+
+        * runtime/WriteBarrier.h:
+        (JSC::MarkStack::appendValues): No need to validate; internalAppend will
+        do that for us.
+
+2011-10-17  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r97536, part 3
+
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSObject.h:
+        Use JS_EXPORTDATA to export the s_info members.
+
+2011-10-17  Adam Roben  <aroben@apple.com>
+
+        Interpreter build fix after r97564
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        Moved declaration of globalData variable into ENABLE(JIT) blocks, since it is only used
+        there.
+
+2011-10-17  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r97536, part 2
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added back
+        JSC::setUpStaticFunctionSlot with its new mangled name. SOrted the rest of the file while I
+        was at it.
+
+2011-10-17  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r97536
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed export of
+        JSC::setUpStaticFunctionSlot, which no longer exists. Also removed incorrect exports of
+        s_info members, which need to be exported via JS_EXPORTDATA instead.
+
+2011-10-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Interpreter build fix after r97436, r97506, r97532 and r97537.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2011-10-16  Adam Barth  <abarth@webkit.org>
+
+        Always disable ENABLE(ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL) and delete associated code
+        https://bugs.webkit.org/show_bug.cgi?id=70216
+
+        Reviewed by Eric Seidel.
+
+        * wtf/Platform.h:
+
+2011-10-16  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] Remove PageAllocatorSymbian.h, OSAllocatorSymbian.cpp, gtk/ThreadingGtk.cpp from gyp project files
+        https://bugs.webkit.org/show_bug.cgi?id=70205
+
+        Reviewed by James Robinson.
+
+        wtf/PageAllocatorSymbian.h and wtf/OSAllocatorSymbian.cpp were removed in r97557.
+        wtf/gtk/ThreadingGtk.cpp was removed in r97269.
+
+        * JavaScriptCore.gypi:
+
+2011-10-16  Adam Barth  <abarth@webkit.org>
+
+        Always enable ENABLE(DOM_STORAGE)
+        https://bugs.webkit.org/show_bug.cgi?id=70189
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-10-15  Dan Horák <dan@danny.cz>
+
+        The s390 and s390x architectures both use 64-bit double type
+        that conforms to the IEEE-754 standard.
+
+        https://bugs.webkit.org/show_bug.cgi?id=69940
+
+        Reviewed by Gavin Barraclough.
+
+        * wtf/dtoa/utils.h:
+
+2011-10-14  Filip Pizlo  <fpizlo@apple.com>
+
+        FunctionExecutable should expose the ability to create unattached FunctionCodeBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=70157
+
+        Reviewed by Geoff Garen.
+        
+        Added FunctionExecutable::produceCodeBlockFor() and rewired compileForCallInternal()
+        and compileForConstructInternal() to use this method. This required more cleanly
+        exposing some of CodeBlock's tiering functionality and moving the CompilationKind
+        enum to Executable.h, as this was the easiest way to make it available to the
+        declarations/definitions of CodeBlock, FunctionExecutable, and BytecodeGenerator.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::copyDataFrom):
+        (JSC::CodeBlock::copyDataFromAlternative):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setAlternative):
+        * bytecompiler/BytecodeGenerator.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::codeBlockFor):
+
+2011-10-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        [Qt] [Symbian] Remove support for the Symbian platform for the QtWebKit port
+        https://bugs.webkit.org/show_bug.cgi?id=69920
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * heap/MarkStack.h:
+        (JSC::::shrinkAllocation):
+        * jit/ExecutableAllocator.cpp:
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * jit/JITStubs.cpp:
+        * jsc.pro:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/Atomics.h:
+        * wtf/MathExtras.h:
+        * wtf/OSAllocator.h:
+        (WTF::OSAllocator::decommitAndRelease):
+        * wtf/OSAllocatorSymbian.cpp: Removed.
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
+        * wtf/PageAllocation.h:
+        * wtf/PageAllocatorSymbian.h: Removed.
+        * wtf/PageBlock.cpp:
+        * wtf/Platform.h:
+        * wtf/StackBounds.cpp:
+        * wtf/wtf.pri:
+
+2011-10-15  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Trivial fix for a missing change in r97512
+        https://bugs.webkit.org/show_bug.cgi?id=70166
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::link):
+
+2011-10-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename getOwnPropertySlot to getOwnPropertySlotVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=69810
+
+        Reviewed by Geoffrey Garen.
+
+        Renamed the virtual version of getOwnPropertySlot to getOwnPropertySlotVirtual
+        in preparation for when we add the static getOwnPropertySlot to the MethodTable 
+        in ClassInfo.
+
+        Also added a few static getOwnPropertySlot functions where they had been overlooked 
+        before (especially in CodeGeneratorJS.pm).
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlotVirtual):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::getOwnPropertyDescriptor):
+        (JSC::::staticFunctionGetter):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertySlotVirtual):
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlotVirtual):
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/Arguments.h:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getOwnPropertySlotVirtual):
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlotVirtual):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertySlotVirtual):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertySlotVirtual):
+        * runtime/DateConstructor.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertySlotVirtual):
+        * runtime/DatePrototype.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertySlotVirtual):
+        * runtime/ErrorPrototype.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlotVirtual):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlotVirtual):
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSArray.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::getOwnPropertySlotVirtual):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlotVirtual):
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertySlotVirtual):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlotVirtual):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::getOwnPropertyNames):
+        (JSC::JSFunction::put):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::getOwnPropertySlotVirtual):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertySlotVirtual):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::JSONObject::getOwnPropertySlotVirtual):
+        (JSC::Walker::walk):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotVirtual):
+        (JSC::JSObject::getOwnPropertySlot):
+        (JSC::JSObject::hasOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnPropertySlotVirtual):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSValue::get):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::getOwnPropertySlotVirtual):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlotVirtual):
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+        (JSC::getStaticValueSlot):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlotVirtual):
+        * runtime/MathObject.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlotVirtual):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertySlotVirtual):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getOwnPropertySlotVirtual):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::getOwnPropertySlotVirtual):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlotVirtual):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlotVirtual):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlotVirtual):
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlotVirtual):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getOwnPropertySlotVirtual):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertySlotVirtual):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertySlotVirtual):
+        * runtime/StringPrototype.h:
+
+2011-10-14  Gavin Barraclough  <baraclough@apple.com>
+
+        Most built-in properties are not deletable
+        https://bugs.webkit.org/show_bug.cgi?id=61014
+
+        Reviewed by Filip Pizlo.
+
+        Our static hash tables don't allow for deleting properties.
+        This is the cause of a bunch of expected failures in LayoutTests/sputnik.
+
+        This fixes the problem by reifying all static functions immediately prior
+        to the first deletion.  Reification is tracked by a flag on the structure,
+        so properties will no longer 'bounce-back' on later access.
+
+        Theoretically there could probably also be an issue with custom accessor
+        properties, but we probably do not really require any of these to be
+        Configurable anyway. I'll follow up with a separate patch to address this.
+
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::hasStaticProperties):
+            - detects static property tables.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+            - call reifyStaticFunctions before deletion.
+        (JSC::JSObject::reifyStaticFunctions):
+            - If the class has static functions, set them up now.
+        * runtime/JSObject.h:
+        (JSC::JSObject::staticFunctionsReified):
+            - returns true if static functions have been reified,
+              and as such should no longer be added.
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+            - If static functions have been reified do not add.
+        * runtime/Lookup.h:
+        (JSC::HashTable::ConstIterator::ConstIterator):
+        (JSC::HashTable::ConstIterator::operator->):
+        (JSC::HashTable::ConstIterator::operator*):
+        (JSC::HashTable::ConstIterator::operator!=):
+        (JSC::HashTable::ConstIterator::operator++):
+        (JSC::HashTable::ConstIterator::skipInvalidKeys):
+        (JSC::HashTable::begin):
+        (JSC::HashTable::end):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticFunctionSlot):
+        (JSC::getStaticFunctionDescriptor):
+            - setUpStaticFunctionSlot may not add, returns a bool.
+        (JSC::lookupPut):
+            - remove redundant branch.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            - initialize new flag in constructors.
+        * runtime/Structure.h:
+        (JSC::Structure::staticFunctionsReified):
+        (JSC::Structure::setStaticFunctionsReified):
+            - added flag
+
+2011-10-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename virtual put to putVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=69851
+
+        Reviewed by Darin Adler.
+
+        Renamed virtual versions of put to putVirtual in prepration for 
+        adding the static put to the MethodTable in ClassInfo since the 
+        compiler gets mad if the virtual and static versions have the same 
+        name.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::putVirtual):
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        (JSObjectSetPropertyAtIndex):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::putVirtual):
+        (JSC::DebuggerActivation::put):
+        * debugger/DebuggerActivation.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putVirtual):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::putVirtual):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putVirtual):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::putVirtual):
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putVirtual):
+        (JSC::JSCell::put):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::putVirtual):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putVirtual):
+        (JSC::JSGlobalObject::putWithAttributes):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::putVirtual):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putVirtual):
+        (JSC::JSObject::put):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSValue::put):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::putVirtual):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::putVirtual):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::fillArrayInstance):
+        (JSC::RegExpConstructor::putVirtual):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::putVirtual):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::putVirtual):
+        * runtime/RegExpObject.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::putVirtual):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
+
+2011-10-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Reflective Arguments retrieval should be hardened for the
+        possibility of inlining
+        https://bugs.webkit.org/show_bug.cgi?id=70068
+
+        Reviewed by Oliver Hunt.
+        
+        CodeBlock can now track, as part of its RareData, the virtual inline
+        stack at callsites. CallFrame walking can now rematerialize "inline"
+        CallFrames by combining the meta-data in CodeBlock with the information
+        already in the JS stack. Arguments can now safely retrieve the
+        arguments from inline CallFrames.
+        
+        The DFG already had the notion of a "CodeOrigin" in preparation for
+        inlining. This notion will now be saved into the CodeBlock, if the DFG
+        had done inlining. So, CodeOrigin has been moved to bytecode/ and has
+        been changed to behave more like a struct since that is how it's
+        meant to be used.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::inlineCallFrames):
+        (JSC::CodeBlock::codeOrigins):
+        (JSC::CodeBlock::hasCodeOrigins):
+        (JSC::CodeBlock::codeOriginForReturn):
+        * bytecode/CodeOrigin.h: Added.
+        (JSC::CodeOrigin::CodeOrigin):
+        (JSC::CodeOrigin::isSet):
+        (JSC::getCallReturnOffsetForCodeOrigin):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGNode.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::isInlineCallFrame):
+        (JSC::CallFrame::trueCallerFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::inlineCallFrame):
+        (JSC::ExecState::setInlineCallFrame):
+        (JSC::ExecState::isInlineCallFrame):
+        (JSC::ExecState::trueCallerFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::findFunctionCallFrame):
+        * interpreter/Register.h:
+        (JSC::Register::operator=):
+        (JSC::Register::inlineCallFrame):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::finishCreationButDontCopyRegisters):
+        (JSC::Arguments::finishCreation):
+        (JSC::Arguments::finishCreationAndCopyRegisters):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::parameterCount):
+
+2011-10-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename virtual deleteProperty to deletePropertyVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=69884
+
+        Reviewed by Darin Adler.
+
+        Renamed virtual versions of deleteProperty to deletePropertyVirtual in prepration for 
+        adding the static deleteProperty to the MethodTable in ClassInfo since the 
+        compiler gets mad if the virtual and static versions have the same name.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::deletePropertyVirtual):
+        (JSC::::deleteProperty):
+        * API/JSObjectRef.cpp:
+        (JSObjectDeleteProperty):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::deletePropertyVirtual):
+        (JSC::DebuggerActivation::deleteProperty):
+        * debugger/DebuggerActivation.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deletePropertyVirtual):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::deletePropertyVirtual):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::deletePropertyVirtual):
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::deletePropertyVirtual):
+        (JSC::JSCell::deleteProperty):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::deletePropertyVirtual):
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::deletePropertyVirtual):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deletePropertyVirtual):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::deletePropertyVirtual):
+        * runtime/JSVariableObject.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::deletePropertyVirtual):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::deletePropertyVirtual):
+        * runtime/StrictEvalActivation.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deletePropertyVirtual):
+        * runtime/StringObject.h:
+
+2011-10-14  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Inherit settings from Chromium's envsetup.sh, address a NDK todo
+        https://bugs.webkit.org/show_bug.cgi?id=70028
+
+        Reviewed by Adam Barth.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-10-14  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG JIT 32_64 - Performance fix for ResolveGlobal
+        https://bugs.webkit.org/show_bug.cgi?id=70096
+
+        Reviewed by Gavin Barraclough.
+
+        Structure check of global object should be a pointer comparison
+        instead of a tag and payload pair comparison. This fix improves
+        SunSpider by 7% on Linux 32, with bitops-bitwise-and improved by 4.75X.
+        Also two trivial fixes for successful 32-bit build are included.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Speculation failures in ValueToInt32 are causing a 2x slow-down
+        in Kraken/stanford-crypto-pbkdf2
+        https://bugs.webkit.org/show_bug.cgi?id=70089
+
+        Reviewed by Gavin Barraclough.
+        
+        If we can't truncate to Int32 using machine code, then don't fail
+        speculation. Just call JSC::toInt32.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename virtual getConstructData to getConstructDataVirtual
+        https://bugs.webkit.org/show_bug.cgi?id=69872
+
+        Reviewed by Geoffrey Garen.
+
+        Renamed virtual getConstructData functions to getConstructDataVirtual to 
+        avoid conflicts when we add static getConstructData to the MethodTable.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::getConstructDataVirtual):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getConstructDataVirtual):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsConstructor):
+        (JSObjectCallAsConstructor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getConstructDataVirtual):
+        * runtime/ArrayConstructor.h:
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::getConstructDataVirtual):
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getConstructDataVirtual):
+        * runtime/DateConstructor.h:
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::getConstructDataVirtual):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::getConstructDataVirtual):
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::getConstructDataVirtual):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getConstructDataVirtual):
+        * runtime/JSCell.h:
+        (JSC::getConstructData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getConstructDataVirtual):
+        * runtime/JSFunction.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::getConstructDataVirtual):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getConstructDataVirtual):
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getConstructDataVirtual):
+        * runtime/ObjectConstructor.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getConstructDataVirtual):
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getConstructDataVirtual):
+        * runtime/StringConstructor.h:
+
+2011-10-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Rubber stamped Stephanie Lewis.
+        
+        DFG_ENABLE() macro was always returning false.
+
+        * dfg/DFGNode.h:
+
+2011-10-13  Gavin Barraclough  <baraclough@apple.com>
+
+        Speculative build fix for !DFG builds.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2011-10-13  Oliver Hunt  <oliver@apple.com>
+
+        Fix performance of ValueToInt32 node when predicting double
+        https://bugs.webkit.org/show_bug.cgi?id=70063
+
+        Reviewed by Filip Pizlo.
+
+        Currently we fail to inline double to int conversion when
+        performing a ValueToInt32 operation on a value we predict
+        to be a double.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+           Apply correct filter for the double prediction path
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+           Support double parameters even when value has been spilled.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+           Moved old valueToInt32 code to this function, and added
+           path for double prediction
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+           Made the two implementations of ValueToInt32 call a single
+           shared compileValueToInt32 function.
+
+2011-10-13  Chris Marrin  <cmarrin@apple.com>
+
+        Sync requestAnimationFrame callback to CVDisplayLink on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=68911
+
+        Reviewed by Simon Fraser.
+
+        Add REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR for implementations
+        that use the DisplayRefreshMonitor logic.
+
+        * wtf/Platform.h:
+
+2011-10-13  Gavin Barraclough  <baraclough@apple.com>
+
+        DFG JIT should not be using ENABLE macro to enable features
+        https://bugs.webkit.org/show_bug.cgi?id=70060
+
+        Reviewed by Oliver Hunt.
+
+        The ENABLE macro is only intended to be used to detect features that are configured
+        in Platform.h. Using its to detect settings defined in other headers is an error.
+
+        The problem is that the ENABLE macro checks if the value is defined, so will silently
+        return false if you fail to include the header defining the switch. This is not a problem
+        if (1) the settings are defined in the same header that defines the macro that tests them,
+        or (2) the header is included everywhere.  In the case of ENABLE settings defined in
+        Platform.h, both are true! To make this clear, add an explicit DFG_ENABLE macro.
+
+        * bytecode/CodeBlock.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCodeGenerator.cpp:
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGNode.h:
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::propagateArithNodeFlagsForward):
+        (JSC::DFG::Propagator::propagateArithNodeFlagsBackward):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::propagatePredictionsForward):
+        (JSC::DFG::Propagator::propagatePredictionsBackward):
+        (JSC::DFG::Propagator::propagatePredictions):
+        (JSC::DFG::Propagator::toDouble):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::fixup):
+        (JSC::DFG::Propagator::startIndexForChildren):
+        (JSC::DFG::Propagator::endIndexForPureCSE):
+        (JSC::DFG::Propagator::setReplacement):
+        (JSC::DFG::Propagator::eliminate):
+        (JSC::DFG::Propagator::performNodeCSE):
+        (JSC::DFG::Propagator::localCSE):
+        (JSC::DFG::Propagator::allocateVirtualRegisters):
+        (JSC::DFG::Propagator::performBlockCFA):
+        (JSC::DFG::Propagator::performForwardCFA):
+        (JSC::DFG::Propagator::globalCFA):
+        * dfg/DFGScoreBoard.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2011-10-13  Gavin Barraclough  <baraclough@apple.com>
+
+        terminateSpeculativeExecution for fillSpeculateDouble with DataFormatCell
+
+        Rubber stamped by Filip Pizlo
+
+        This is breaking fast/canvas/canvas-composite-alpha.html on 32_64 DFG JIT.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2011-10-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualized JSCell::toNumber
+        https://bugs.webkit.org/show_bug.cgi?id=69858
+
+        Reviewed by Sam Weinig.
+
+
+        Removed JSCallbackObject::toNumber because its no longer necessary since 
+        JSObject::toNumber now suffices since we implicitly add valueOf to an object's
+        prototype whenever a convertToType callback is provided.
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+        De-virtualized JSCell::toNumber, JSObject::toNumber, and JSString::toNumber.
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toNumber):
+        * runtime/JSCell.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+
+        Removed JSNotAnObject::toNumber because its result doesn't matter and it implements 
+        defaultValue, therefore JSObject::toNumber can cover its case.
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+
+2011-10-13  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Use realloc() to expand/shrink StringBuilder buffer
+        https://bugs.webkit.org/show_bug.cgi?id=69913
+
+        Reviewed by Darin Adler.
+
+        * wtf/text/StringBuilder.cpp:
+        (WTF::StringBuilder::reserveCapacity):
+        (WTF::StringBuilder::reallocateBuffer):
+        (WTF::StringBuilder::appendUninitialized):
+        (WTF::StringBuilder::shrinkToFit):
+        * wtf/text/StringBuilder.h:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::reallocate): Added to allow StringBuilder to reallocate the buffer.
+        * wtf/text/StringImpl.h:
+
+2011-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        If an Arguments object is being used to copy the arguments, then
+        make this explicit
+        https://bugs.webkit.org/show_bug.cgi?id=69995
+
+        Reviewed by Sam Weinig.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArguments):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createAndCopyRegisters):
+        (JSC::Arguments::finishCreationButDontCopyRegisters):
+        (JSC::Arguments::finishCreation):
+        (JSC::Arguments::finishCreationAndCopyRegisters):
+
+2011-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA does not filter structures aggressively enough.
+        https://bugs.webkit.org/show_bug.cgi?id=69989
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::clear):
+        (JSC::DFG::AbstractValue::makeTop):
+        (JSC::DFG::AbstractValue::clobberStructures):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::checkConsistency):
+
+2011-10-12  Adam Barth  <abarth@webkit.org>
+
+        Remove ENABLE(XHTMLMP) and associated code
+        https://bugs.webkit.org/show_bug.cgi?id=69729
+
+        Reviewed by David Levin.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-10-12  Gavin Barraclough  <baraclough@apple.com>
+
+        MacroAssemblerX86 8-bit register ops unsafe on CPU(X86)
+        https://bugs.webkit.org/show_bug.cgi?id=69978
+
+        Reviewed by Filip Pizlo.
+
+        Certain ops are unsafe if the register passed is esp..edi (will instead test/set the ).
+
+        compare32/test8/test32 Call setCC, which sets an 8-bit register - we can fix this by adding
+        a couple of xchg instructions.
+
+        branchTest8 with a register argument is also affected. In all cases this is currently used
+        this is testing a value that is correct to 32 or more bits, so we can simply switch these
+        to branchTest32 & remove the corresponding branchTest8 (this is desirable anyway, since the
+        32-bit form is cheaper to implement on platforms that don't have an 8-bit compare instruction).
+
+        This fixes the remaining fast/js failures with the DFG JIT 32_64.
+
+        * assembler/MacroAssemblerARMv7.h
+            - removed branchTest8.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::compare32):
+        (JSC::MacroAssemblerX86Common::test8):
+        (JSC::MacroAssemblerX86Common::test32):
+        (JSC::MacroAssemblerX86Common::set32):
+            - added set32 helper that is 'h' register safe.
+            - removed branchTest8.
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+            - switch uses of branchTest8 to branchTest32.
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+            - switch uses of branchTest8 to branchTest32.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+            - switch uses of branchTest8 to branchTest32.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+            - switch uses of branchTest8 to branchTest32.
+
+2011-10-12  Gavin Barraclough  <baraclough@apple.com>
+
+        Errrk, revert accidental commit!
+
+        * wtf/Platform.h:
+
+2011-10-12  Gavin Barraclough  <baraclough@apple.com>
+
+        Unreviewed, re-land changes from #69890, #69903.
+
+        These were reverted due to bug #69897, but #69903 fixed this problem.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+
+2011-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        ValueProfile::computeUpdatedPrediction doesn't merge statistics correctly
+        https://bugs.webkit.org/show_bug.cgi?id=69906
+
+        Reviewed by Gavin Barraclough.
+        
+        It turns out that the simplest fix is to switch computeUpdatedPredictions()
+        to using predictionFromValue() combined with mergePrediction(). Doing so
+        allowed me to kill off weakBuckets and visitWeakReferences(). Hence this
+        not only fixes a performance bug but kills off a lot of code that I never
+        liked to begin with.
+        
+        This appears to be a 1% win on V8.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionFromValue):
+        * bytecode/ValueProfile.cpp:
+        (JSC::ValueProfile::computeStatistics):
+        (JSC::ValueProfile::computeUpdatedPrediction):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::classInfo):
+        (JSC::ValueProfile::numberOfSamples):
+        (JSC::ValueProfile::isLive):
+        (JSC::ValueProfile::dump):
+
+2011-10-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::toString
+        https://bugs.webkit.org/show_bug.cgi?id=69677
+
+        Reviewed by Sam Weinig.
+
+        Removed toString from JSCallbackObject, since it is no 
+        longer necessary since we now implicitly add toString and valueOf
+        functions to object prototypes when a convertToType callback 
+        is provided, which is now the standard way to override toString 
+        and valueOf in the JSC C API.
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+        Removed toString from InterruptedExecutionError and 
+        TerminatedExecutionError and replaced it with defaultValue,
+        which JSObject::toString calls.  We'll probably have to de-virtualize 
+        defaultValue eventually, but we'll cross that bridge when we 
+        come to it.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::defaultValue):
+        (JSC::TerminatedExecutionError::defaultValue):
+        * runtime/ExceptionHelpers.h:
+
+        Removed toString from JSNotAnObject, since its return value doesn't
+        actually matter and JSObject::toString can cover it.
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+
+        De-virtualized JSCell::toString, JSObject::toString and JSString::toString.
+        Added handling of all cases for JSCell to JSCell::toString.
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toString):
+        * runtime/JSCell.h:
+
+2011-10-12  Oliver Hunt  <oliver@apple.com>
+
+        Global stringStructure caches its prototype chain, abandoning a web page
+        https://bugs.webkit.org/show_bug.cgi?id=69952
+
+        Reviewed by Filip Pizlo.
+
+        When visiting a structure, we don't keep the prototype chain
+        alive if we're not the structure for an object type.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+
+2011-10-12  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG JIT 32_64 - Fix ArrayPop
+        https://bugs.webkit.org/show_bug.cgi?id=69918
+
+        Reviewed by Filip Pizlo.
+
+        The storageLengthGPR is polluted by EmptyValueTag and later used to
+        index the array, which results in abnormal behaviors in execution.
+        This fix makes 32_64 DFG pass v8-deltablue and kraken
+        crypto-sha256-iterative on Linux ia32.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::store32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_i32m):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Fix build with GLib 2.31
+        https://bugs.webkit.org/show_bug.cgi?id=69840
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.list.am: removed ThreadingGtk.cpp.
+        * wtf/ThreadingPrimitives.h: remove GTK+-specific definitions.
+        * wtf/gobject/GOwnPtr.cpp: remove GCond and GMutex specializations.
+        * wtf/gobject/GOwnPtr.h: ditto.
+        * wtf/gobject/GTypedefs.h: remove GCond and GMutex forward declarations.
+        * wtf/gtk/ThreadingGtk.cpp: Removed.
+
+2011-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Layout tests crashing in DFG JIT code
+        https://bugs.webkit.org/show_bug.cgi?id=69897
+
+        Reviewed by Gavin Barraclough.
+        
+        Abstract value filtration didn't take into account cases where a structure
+        set filter, combined with predicted type knowledge, could lead to a stronger
+        filter for the structure abstract value.
+        
+        This bug would have been benign in release builds; it would have just meant
+        that the analysis was less precise and some optimization opportunities would
+        be missed. I have an ASSERT that is meant to catch such cases, and it was
+        triggering sporadically in one of the LayoutTests.
+
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::filter):
+
+2011-10-11  Gavin Barraclough  <baraclough@apple.com>
+
+        Unreviewed, temporarily reverted r97216 due to bug #69897.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+
+2011-10-11  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG 32_64 - fix silentFillGPR
+        https://bugs.webkit.org/show_bug.cgi?id=69903
+
+        Reviewed by Filip Pizlo.
+
+        Fix a small bug in silentFillGPR,
+        and add the newly introduced DFG file to CMakeListsEfl.
+
+        * CMakeListsEfl.txt:
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+
+2011-10-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG does not have flow-sensitive intraprocedural control flow analysis
+        https://bugs.webkit.org/show_bug.cgi?id=69690
+
+        Reviewed by Gavin Barraclough.
+
+        Implemented a control flow analysis (CFA). It currently propagates type
+        proofs only. For example, if all predecessors to a basic block have
+        checks that variable X is a JSFinalObject with structure 0xabcdef, then
+        this basic block will now know this fact and will know that it does not
+        have to emit either JSFinalObject checks or any structure checks since
+        the structure is precisely known. The CFA takes heap side-effects into
+        account (though somewhat conservatively), so that if the object pointed
+        to by variable X could have possibly undergone a structure transition
+        then this is reflected: the analysis may simply say that X's structure
+        is unknown.
+        
+        This also propagates a wealth of other type information which is
+        currently not being used. For example, we now know when a variable can
+        only hold doubles. Even if a variable may hold other types at different
+        points in its live range, we can still prove exactly when it will only
+        be double.
+        
+        There's a bunch of stuff that the CFA could do that it still does not
+        do, like precise handling of PutStructure (i.e. structure transitions),
+        precise handling of CheckFunction and CheckMethod, etc. So this is
+        very much intended to be a starting point rather than an end unto
+        itself.
+        
+        This is a 1% win on V8 (mostly due to a 3% win on richards and deltablue)
+        and a 1% win on Kraken (mostly due to a 6% win on imaging-desaturate).
+        Neutral on SunSpider.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ActionablePrediction.h: Removed.
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        * bytecode/PredictedType.h:
+        * dfg/DFGAbstractState.cpp: Added.
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::~AbstractState):
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::reset):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberStructures):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        (JSC::DFG::AbstractState::merge):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGAbstractState.h: Added.
+        (JSC::DFG::AbstractState::forNode):
+        (JSC::DFG::AbstractState::isValid):
+        * dfg/DFGAbstractValue.h: Added.
+        (JSC::DFG::StructureAbstractValue::StructureAbstractValue):
+        (JSC::DFG::StructureAbstractValue::clear):
+        (JSC::DFG::StructureAbstractValue::makeTop):
+        (JSC::DFG::StructureAbstractValue::top):
+        (JSC::DFG::StructureAbstractValue::add):
+        (JSC::DFG::StructureAbstractValue::addAll):
+        (JSC::DFG::StructureAbstractValue::contains):
+        (JSC::DFG::StructureAbstractValue::isSubsetOf):
+        (JSC::DFG::StructureAbstractValue::doesNotContainAnyOtherThan):
+        (JSC::DFG::StructureAbstractValue::isSupersetOf):
+        (JSC::DFG::StructureAbstractValue::filter):
+        (JSC::DFG::StructureAbstractValue::isClear):
+        (JSC::DFG::StructureAbstractValue::isTop):
+        (JSC::DFG::StructureAbstractValue::size):
+        (JSC::DFG::StructureAbstractValue::at):
+        (JSC::DFG::StructureAbstractValue::operator[]):
+        (JSC::DFG::StructureAbstractValue::last):
+        (JSC::DFG::StructureAbstractValue::predictionFromStructures):
+        (JSC::DFG::StructureAbstractValue::operator==):
+        (JSC::DFG::StructureAbstractValue::dump):
+        (JSC::DFG::AbstractValue::AbstractValue):
+        (JSC::DFG::AbstractValue::clear):
+        (JSC::DFG::AbstractValue::isClear):
+        (JSC::DFG::AbstractValue::makeTop):
+        (JSC::DFG::AbstractValue::clobberStructures):
+        (JSC::DFG::AbstractValue::isTop):
+        (JSC::DFG::AbstractValue::top):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::operator==):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::validate):
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGBasicBlock.h: Added.
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::BasicBlock::getBytecodeBegin):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::setupPredecessors):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::block):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGNode.h:
+        (JSC::DFG::NodeIndexTraits::defaultValue):
+        (JSC::DFG::Node::variableAccessData):
+        (JSC::DFG::Node::takenBytecodeOffsetDuringParsing):
+        (JSC::DFG::Node::notTakenBytecodeOffsetDuringParsing):
+        (JSC::DFG::Node::setTakenBlockIndex):
+        (JSC::DFG::Node::setNotTakenBlockIndex):
+        (JSC::DFG::Node::takenBlockIndex):
+        (JSC::DFG::Node::notTakenBlockIndex):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        * dfg/DFGOperands.h: Added.
+        (JSC::DFG::operandIsArgument):
+        (JSC::DFG::OperandValueTraits::defaultValue):
+        (JSC::DFG::Operands::Operands):
+        (JSC::DFG::Operands::numberOfArguments):
+        (JSC::DFG::Operands::numberOfLocals):
+        (JSC::DFG::Operands::argument):
+        (JSC::DFG::Operands::local):
+        (JSC::DFG::Operands::setLocal):
+        (JSC::DFG::Operands::setArgumentFirstTime):
+        (JSC::DFG::Operands::setLocalFirstTime):
+        (JSC::DFG::Operands::operand):
+        (JSC::DFG::Operands::setOperand):
+        (JSC::DFG::Operands::clear):
+        (JSC::DFG::dumpOperands):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::propagatePredictions):
+        (JSC::DFG::Propagator::performBlockCFA):
+        (JSC::DFG::Propagator::performForwardCFA):
+        (JSC::DFG::Propagator::globalCFA):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureSet.h:
+        (JSC::DFG::StructureSet::clear):
+        (JSC::DFG::StructureSet::predictionFromStructures):
+        (JSC::DFG::StructureSet::operator==):
+        (JSC::DFG::StructureSet::dump):
+        * dfg/DFGVariableAccessData.h: Added.
+
+2011-10-11  Gavin Barraclough  <baraclough@apple.com>
+
+        DFG JIT 32_64 - Fix silentFillGPR for non-integer constants.
+        https://bugs.webkit.org/show_bug.cgi?id=69890
+
+        Reviewed by Oliver Hunt.
+
+        Cell constants are currently hitting the valueOfInt32Constant case, there is no constant handling for JSValues.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+
+2011-10-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        GTK build fix attempt after r97197.
+
+        * wtf/BitVector.h:
+
+2011-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Remove unintentional logging.
+
+        * heap/Heap.cpp:
+
+2011-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Tidy up card walking logic
+        https://bugs.webkit.org/show_bug.cgi?id=69883
+
+        Reviewed by Gavin Barraclough.
+
+        Special case common cell sizes when walking a block's
+        cards.
+
+        * heap/CardSet.h:
+        (JSC::::testAndClear):
+        * heap/Heap.cpp:
+        (JSC::GCTimer::GCCounter::GCCounter):
+        (JSC::GCTimer::GCCounter::count):
+        (JSC::GCTimer::GCCounter::~GCCounter):
+        (JSC::Heap::markRoots):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::reset):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::visitCount):
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::append):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::gatherDirtyCellsWithSize):
+        (JSC::MarkedBlock::gatherDirtyCells):
+        * runtime/Structure.h:
+        (JSC::MarkStack::internalAppend):
+
+2011-10-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG virtual register allocator should be more aggressive in
+        reusing temporary slots
+        https://bugs.webkit.org/show_bug.cgi?id=69868
+
+        Reviewed by Oliver Hunt.
+        
+        1.2% win on V8, neutral elsewhere. The win is probably because it
+        increases precision of GC conservative scans.
+        
+        This required making the DFG::ScoreBoard operate over a bitvector
+        of preserved variables, rather than just a preserved variable
+        threshold. To do this, I improved the WTF::BitVector class to make
+        it more user-friendly. It still retains all previous functionality.
+        Also made changes to PackedIntVector to accomodate those changes.
+        Finally, this adds more debugging to the virtual register allocator
+        and to the OSR exit code, as this was necessary to track down bugs
+        in an earlier version of this patch.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::allocateVirtualRegisters):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::ScoreBoard):
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::allocate):
+        (JSC::DFG::ScoreBoard::use):
+        (JSC::DFG::ScoreBoard::highWatermark):
+        (JSC::DFG::ScoreBoard::dump):
+        (JSC::DFG::ScoreBoard::max):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueRecovery::dump):
+        * wtf/BitVector.cpp:
+        (WTF::BitVector::setSlow):
+        (WTF::BitVector::resizeOutOfLine):
+        (WTF::BitVector::dump):
+        * wtf/BitVector.h:
+        (WTF::BitVector::BitVector):
+        (WTF::BitVector::operator=):
+        (WTF::BitVector::quickGet):
+        (WTF::BitVector::quickSet):
+        (WTF::BitVector::quickClear):
+        (WTF::BitVector::get):
+        (WTF::BitVector::set):
+        (WTF::BitVector::clear):
+        * wtf/PackedIntVector.h:
+        (WTF::PackedIntVector::get):
+        (WTF::PackedIntVector::set):
+
+2011-10-11  Gavin Barraclough  <baraclough@apple.com>
+
+        DFG JIT 32_64 - Switch to cdecl calling convention.
+        https://bugs.webkit.org/show_bug.cgi?id=69863
+
+        Reviewed by Oliver Hunt.
+
+        This makes it easier to keep the stack correctly aligned, which is required on OS X.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+            - Provide default FunctionPtr constructors for CDECL functions on STDCALL platforms.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+            - Switch calls to poke arguments rather than pushing them.
+        (JSC::DFG::resetCallArguments):
+        (JSC::DFG::addCallArgument):
+        (JSC::DFG::addCallArgumentBoxed):
+            - Helper functions to stack up call arguments on X86.
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+            - Don't push, poke!
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+            - Don't push, poke!
+        * dfg/DFGOperations.cpp:
+            - Switch ReturnAddress wrappers to push return address last, update asm trampolines.
+        * dfg/DFGOperations.h:
+            - switch DFG_OPERATION to assert CDECL on STDCALL platforms.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::fmodWithCDecl):
+        (JSC::DFG::SpeculativeJIT::compile):
+            - On STDCALL platforms wrap fmod, since DFG_OPERATION wrappers are CDECL.
+
+2011-10-11  Gavin Barraclough  <baraclough@apple.com>
+
+        Switch RegisterSizedBoolean/dfgConvertJSValueToInt32 return type to size_t
+        https://bugs.webkit.org/show_bug.cgi?id=69821
+
+        Reviewed by Filip Pizlo.
+
+        Operations returning types Z (int32_t) and B (RegisterSizedBoolean - implemented as an
+        intptr_t) are indistinguishable on 32-bit Linux, preventing the DFG JIT from building.
+
+        dfgConvertJSValueToInt32 would be better returning a value known to be register sized, for
+        JSVALUE64 (we currently zero-extend in JIT code, potentially introducing an unnecessary
+        move), so by switching all associated operations to return a size_t we can fix the type
+        problem on Linux & make it a small tweak that removes an unnecessary instruction.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCompare):
+            - comparisons now return a size_t.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+            - Removed Z_DFGOperation_EJ form.
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+            - comparisons now return a size_t.
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+            - comparisons now return a size_t.
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+            - Change return types for comparison operations & dfgConvertJSValueToInt32 to size_t,
+              Both need to return values zero extended to fill a register.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+            - comparisons now return a size_t.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+            - comparisons now return a size_t.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+            - comparisons now return a size_t.
+
+2011-10-11  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Remove all references to QTDIR_build and standalone_package
+
+        Qt is now modularized, which means we no longer import WebKit into
+        the Qt source tree. Instead we use git submodules, and building
+        QtWebKit as "part of Qt" is really building QtWebKit as from trunk.
+
+        To decrease the number of buildsystem configurations we also remove
+        the standalone_package code-path used when we were providing tarballs
+        with the derived sources pre-generated.
+
+        Reviewed by Simon Hausmann.
+
+        * DerivedSources.pro:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2011-10-11  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Add missing copyright notice in DFG JIT files
+        https://bugs.webkit.org/show_bug.cgi?id=69809
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        * dfg/DFGJITCompiler32_64.cpp:
+        * dfg/DFGJITCompilerInlineMethods.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+
+2011-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JSVALUE64 spill/fill code should not box integers and doubles
+        https://bugs.webkit.org/show_bug.cgi?id=69782
+
+        Reviewed by Oliver Hunt.
+        
+        Added the notion of DataFormatInteger and DataFormatDouble to the spillFormat.
+        This required changing all of the places that spill registers (both silently
+        and not) and filling registers (both silently and on demand). It also required
+        changing OSR exit to recognize that a spilled value (DisplacedInRegisterFile)
+        may have the wrong format for the old JIT (unboxed int or double).
+        
+        This is a slight win on Kraken (0.25%) and neutral elsewhere.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::spill):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        (JSC::DFG::JITCodeGenerator::spill):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueRecovery::displacedInRegisterFile):
+        (JSC::DFG::ValueRecovery::virtualRegister):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+
+2011-10-10  Gavin Barraclough  <baraclough@apple.com>
+
+        DFG JIT switch dfgConvert methods to use callOperation
+        https://bugs.webkit.org/show_bug.cgi?id=69806
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        * dfg/DFGOperations.h:
+
+2011-10-10  Gavin Barraclough  <baraclough@apple.com>
+
+        Remove some unused methods from the DFG JIT.
+
+        Rubber stamped by Oliver Hunt
+
+        Thee methods were only used by the non-speculative JIT, and can be removed.
+
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        * dfg/DFGJITCodeGenerator64.cpp:
+            - removed:
+                nonSpeculativeAdd
+                nonSpeculativeArithSub
+                nonSpeculativeArithMod
+                nonSpeculativeCheckHasInstance
+                nonSpeculativeInstanceOf
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+            - removed:
+                operationArithMod
+                operationInstanceOf
+                operationThrowHasInstanceError
+
+2011-10-10  Gavin Barraclough  <baraclough@apple.com>
+
+        Switch most calls in DFGJITCodeGenerator to use callOperation.
+        https://bugs.webkit.org/show_bug.cgi?id=69802
+
+        Reviewed by Oliver Hunt.
+
+        Compares, add, mod are the easy cases.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeArithMod):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+
+2011-10-10  Gavin Barraclough  <baraclough@apple.com>
+
+        DFG: Switch GetById / PutById to use callOperation
+        https://bugs.webkit.org/show_bug.cgi?id=69795
+
+        Reviewed by Oliver Hunt.
+
+        Also make the take base as a cell, so 32_64 doesn't have to set up the cell tag.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::appropriatePutByIdFunction):
+
+2011-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSIoN (r95399): Web process hangs when opening documents on Google Docs
+        https://bugs.webkit.org/show_bug.cgi?id=69412
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+
+2011-10-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove getCallDataVirtual methods
+        https://bugs.webkit.org/show_bug.cgi?id=69186
+
+        Reviewed by Geoffrey Garen.
+
+        Removed all getCallDataVirtual methods and replaced their call sites 
+        with an explicit lookup in the MethodTable.
+
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayConstructor.h:
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConstructor.h:
+
+        Moved StrictModeTypeErrorFunction to Error.h in order to be able to include 
+        the class definition in JSGlobalObject.cpp.
+        * runtime/Error.cpp:
+        (JSC::createTypeErrorFunction):
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        (JSC::StrictModeTypeErrorFunction::create):
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getConstructData):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        (JSC::StrictModeTypeErrorFunction::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/FunctionPrototype.h:
+
+        To allow subclasses of InternalFunction (e.g. QtRuntimeMethod) to not have 
+        to declare their own ClassInfo if they don't override getCallData, provided 
+        an implementation that calls ASSERT_NOT_REACHED if called, providing roughly the same 
+        functionality as of the pure virtual method InternalFunction used to have.
+        Also made this new implementation protected rather than private for the same reason.
+        Also added an ASSERT in InternalFunction::finishCreation to make sure that whatever 
+        object is being created provides their own implementation of getCallData.  This 
+        just makes execution fail earlier in a place where the source of the error is 
+        easy to trace.  These ASSERTs are better than putting a null in the MethodTable because
+        they appear much more intentional to anybody who fails to provide their own 
+        implementation or who tries to explicitly call InternalFunction::getCallData.
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        (JSC::InternalFunction::getCallData):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+
+        Added a global structure to JSGlobalObject for StrictModeTypeErrorFunction to enable 
+        it to be reused rather than creating a new Structure every time we instantiate it.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::strictModeTypeErrorFunctionStructure):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/JSObject.h:
+        (JSC::getCallData):
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectConstructor.h:
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringConstructor.h:
+        * runtime/Structure.h:
+
+2011-10-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Switch last calls from DFGSpeculativeJIT to use callOperation.
+        https://bugs.webkit.org/show_bug.cgi?id=69780
+
+        Reviewed by Oliver Hunt.
+
+        Also, rename type in operations for booleans from Z to B, since Z is the mathematical symbol for integers.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCompare):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * wtf/Platform.h:
+
+2011-10-10  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        JSVALUE32_64 DFG JIT - bug fix for V8 benchmark cases "crypto" and "raytrace"
+        https://bugs.webkit.org/show_bug.cgi?id=69748
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetMethod):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+
+2011-10-10  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * wtf/MainThread.h: Pull in Platform.h since this file uses PLATFORM() macros.
+
+2011-10-10  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        JSVALUE32_64 DFG JIT - Bug fix for BranchNull
+        https://bugs.webkit.org/show_bug.cgi?id=69743
+
+        Reviewed by Darin Adler.
+
+        This fixes the error in access-binary-trees. All SunSpider cases passed.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
+
+2011-10-07  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG JIT: callOperation should return the Call.
+        https://bugs.webkit.org/show_bug.cgi?id=69682
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        (JSC::DFG::appendCallWithExceptionCheckSetResult):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::appendCall):
+        * wtf/Platform.h:
+
+2011-10-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r97045.
+        http://trac.webkit.org/changeset/97045
+        https://bugs.webkit.org/show_bug.cgi?id=69746
+
+        makes apple bots very crashy :( (Requested by kling on
+        #webkit).
+
+        * config.h:
+
+2011-10-10  Andreas Kling  <kling@webkit.org>
+
+        Shrink BorderValue.
+        https://bugs.webkit.org/show_bug.cgi?id=69521
+
+        Reviewed by Antti Koivisto.
+
+        * config.h: Touch to force full rebuild.
+
+2011-10-09  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Improve Null or Undefined test in 32_64 DFG
+        https://bugs.webkit.org/show_bug.cgi?id=69734
+
+        Reviewed by Darin Adler.
+
+        Currently Null or Undefined value test in 32_64 DFG will check
+        Null and Undefined tag separately and introduce one more branch.
+        It can be improved in the way how the baseline JIT is doing - by
+        relying on the fact that "UndefinedTag + 1 == NullTag and NullTag & 1".
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+
+2011-10-09  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        JSVALUE32_64 DFG JIT - Bug fix for ConvertThis
+        https://bugs.webkit.org/show_bug.cgi?id=69721
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-09  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Remove unused callOperation code of DFG JIT on X86
+        https://bugs.webkit.org/show_bug.cgi?id=69722
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+
+2011-10-09  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        JSVALUE32_64 DFG JIT - fillJSValue with a pair of GPRs should not set the registerFormat to be DataFormatJSDouble
+        https://bugs.webkit.org/show_bug.cgi?id=69720
+
+        Reviewed by Filip Pizlo.
+
+        In JSVALUE32_64 DFG, DataFormatJSDouble is assumed to be represented by
+        a FPR and will be used for further optimizations, though we currently
+        don't fully utilize it. For now when filling a JS value which was
+        spilled as a JSDouble with a pair of GPRs, we'll set the registerFormat
+        to DataFormatJS to avoid compilation errors.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+
+2011-10-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not always speculate that a ByVal access has an integer index
+        https://bugs.webkit.org/show_bug.cgi?id=69716
+
+        Reviewed by Oliver Hunt.
+        
+        1% win on SunSpider, neutral elsewhere.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGNode.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::byValHasIntBase):
+        (JSC::DFG::Propagator::clobbersWorld):
+        (JSC::DFG::Propagator::getMethodLoadElimination):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-09  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Fix value profiling in 32_64 JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69717
+
+        Reviewed by Filip Pizlo.
+
+        Current value profiling for 32_64 JIT is broken and cannot record
+        correct predicated types, which results in many speculation failures
+        in the 32_64 DFG JIT, fallbacks to baseline JIT, and re-optimizations
+        again and again. 
+        With this fix 32_64 DFG JIT can demonstrate real performance gains.
+
+        * bytecode/ValueProfile.cpp:
+        (JSC::ValueProfile::computeStatistics):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::classInfo):
+        (JSC::ValueProfile::numberOfSamples):
+        (JSC::ValueProfile::isLive):
+        (JSC::ValueProfile::numberOfInt32s):
+        (JSC::ValueProfile::numberOfDoubles):
+        (JSC::ValueProfile::numberOfBooleans):
+        (JSC::ValueProfile::dump):
+            Empty value check should be performed on decoded JSValue,
+            as for 32_64 empty value is not identical to encoded 0.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::callWithValueProfiling):
+            Record the right profiling result for 32_64.
+
+2011-10-09  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Remove 32 bit restrictions in DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69711
+
+        Reviewed by Filip Pizlo.
+
+        op_call/op_construct support was disabled for 32 bit DFG JIT because
+        there was regression in javascriptcore tests. Now the bugs are fixed
+        and there should be no regression. This makes 32 bit DFG have the same
+        capability as 64 bit DFG, and improves the coverage.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+
+2011-10-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::getConstructData
+        https://bugs.webkit.org/show_bug.cgi?id=69673
+
+        Reviewed by Geoffrey Garen.
+
+        Added static version of getConstructData to all classes that 
+        override it and changed the virtual versions to call the static 
+        versions.  This is the first step in de-virtualizing JSCell::getConstructData.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::getConstructData):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getConstructData):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getConstructData):
+        * runtime/ArrayConstructor.h:
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::getConstructData):
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getConstructData):
+        * runtime/DateConstructor.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::getConstructData):
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::getConstructData):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getConstructData):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getConstructData):
+        * runtime/JSFunction.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::getConstructData):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getConstructData):
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getConstructData):
+        * runtime/ObjectConstructor.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getConstructData):
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getConstructData):
+        * runtime/StringConstructor.h:
+
+2011-10-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::getOwnPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=69593
+
+        Reviewed by Geoffrey Garen.
+
+        Added static version of getOwnPropertySlot to every class that overrides
+        JSCell::getOwnPropertySlot.  The virtual versions now call the static versions.
+        This is the first step in de-virtualizing JSCell::getOwnPropertySlot.
+
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/Arguments.h:
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertySlot):
+        * runtime/DateConstructor.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertySlot):
+        * runtime/DatePrototype.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        * runtime/ErrorPrototype.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSArray.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::getOwnPropertySlot):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlot):
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertySlot):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::getOwnPropertySlot):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnPropertySlot):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::getOwnPropertySlot):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        * runtime/MathObject.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::getOwnPropertySlot):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getOwnPropertySlot):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertySlot):
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertySlot):
+        * runtime/StringPrototype.h:
+
+2011-10-08  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        JSVALUE32_64 DFG JIT - GetLocal should produce a cell result for Array predictions
+        https://bugs.webkit.org/show_bug.cgi?id=69699
+
+        Reviewed by Filip Pizlo.
+
+        It should match SetLocal where only payload is stored for array predictions.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-08  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        JSVALUE32_64 DFG JIT - Bug fixes for Branch and LogicalNot
+        https://bugs.webkit.org/show_bug.cgi?id=69702
+
+        Reviewed by Filip Pizlo.
+
+        There are some errors in generating code for Branch and LogicalNot,
+        when the operand is predicted as ObjectOrOther.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+
+2011-10-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96996.
+        http://trac.webkit.org/changeset/96996
+        https://bugs.webkit.org/show_bug.cgi?id=69697
+
+        It broke all tests on the Qt bot (Requested by Ossy_night on
+        #webkit).
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::getCallDataVirtual):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getCallDataVirtual):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getCallDataVirtual):
+        * runtime/ArrayConstructor.h:
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::getCallDataVirtual):
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getCallDataVirtual):
+        * runtime/DateConstructor.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        (JSC::StrictModeTypeErrorFunction::create):
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getConstructData):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getCallDataVirtual):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        (JSC::StrictModeTypeErrorFunction::createStructure):
+        (JSC::createTypeErrorFunction):
+        * runtime/Error.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::getCallDataVirtual):
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::getCallDataVirtual):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::getCallDataVirtual):
+        * runtime/FunctionPrototype.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getCallDataVirtual):
+        * runtime/JSCell.h:
+        (JSC::getCallData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getCallDataVirtual):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/JSObject.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::getCallDataVirtual):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getCallDataVirtual):
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getCallDataVirtual):
+        * runtime/ObjectConstructor.h:
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getCallDataVirtual):
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getCallDataVirtual):
+        * runtime/StringConstructor.h:
+        * runtime/Structure.h:
+
+2011-10-08  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG JIT - only Array predictions can result in unboxed cells in register file
+        https://bugs.webkit.org/show_bug.cgi?id=69695
+
+        Reviewed by Filip Pizlo.
+
+        In current DFG JIT, only array predictions can result in unboxed cells
+        in register file, not for the other cell predictions.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueSource::forPrediction):
+
+2011-10-07  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        bug fixes for ArrayPush and ArrayPop in 32_64 DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69696
+
+        Reviewed by Filip Pizlo.
+
+        On 32-bit, we should use TimesEight (8) instead of ScalePtr (4)
+        to compute the address of a JS array element.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::deleteProperty
+        https://bugs.webkit.org/show_bug.cgi?id=69659
+
+        Reviewed by Geoffrey Garen.
+
+        Added static version of both versions of put to all classes that 
+        override them and changed the virtual versions to call the static 
+        versions.  This is the first step in de-virtualizing JSCell::deleteProperty.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::deleteProperty):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::deleteProperty):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deleteProperty):
+        * runtime/Arguments.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::deleteProperty):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::deleteProperty):
+        * runtime/JSArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::deleteProperty):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::deleteProperty):
+        * runtime/JSFunction.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::deleteProperty):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+        * runtime/JSObject.h:
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::deleteProperty):
+        * runtime/JSVariableObject.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::deleteProperty):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::deleteProperty):
+        * runtime/StrictEvalActivation.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+        * runtime/StringObject.h:
+
+2011-10-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove getCallDataVirtual methods
+        https://bugs.webkit.org/show_bug.cgi?id=69186
+
+        Reviewed by Geoffrey Garen.
+
+        Removed all getCallDataVirtual methods and replaced their call sites 
+        with an explicit lookup in the MethodTable.
+
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayConstructor.h:
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConstructor.h:
+        * runtime/Error.cpp:
+        (JSC::createTypeErrorFunction):
+
+        Moved StrictModeTypeErrorFunction to Error.h in order to be able to include 
+        the class definition in JSGlobalObject.cpp.
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        (JSC::StrictModeTypeErrorFunction::create):
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getConstructData):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        (JSC::StrictModeTypeErrorFunction::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/FunctionPrototype.h:
+
+        To allow subclasses of InternalFunction (e.g. QtRuntimeMethod) to not have 
+        to declare their own ClassInfo if they don't override getCallData, provided 
+        an implementation that calls ASSERT_NOT_REACHED if called, providing roughly the same 
+        functionality as of the pure virtual method InternalFunction used to have.
+        Also made this new implementation protected rather than private for the same reason.
+        Also added an ASSERT in InternalFunction::finishCreation to make sure that whatever 
+        object is being created provides their own implementation of getCallData.  This 
+        just makes execution fail earlier in a place where the source of the error is 
+        easy to trace.  These ASSERTs are better than putting a null in the MethodTable because
+        they appear much more intentional to anybody who fails to provide their own 
+        implementation or who tries to explicitly call InternalFunction::getCallData.
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        (JSC::InternalFunction::getCallData):
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+
+        Added a global structure to JSGlobalObject for StrictModeTypeErrorFunction to enable 
+        it to be reused rather than creating a new Structure every time we instantiate it.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::strictModeTypeErrorFunctionStructure):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/JSObject.h:
+        (JSC::getCallData):
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectConstructor.h:
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringConstructor.h:
+        * runtime/Structure.h:
+
+2011-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Add missing break statement.
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+
+2011-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Support some string intrinsics in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69678
+
+        Reviewed by Gavin Barraclough.
+
+        Add support for charAt and charCodeAt intrinsics in the DFG.
+
+        * create_hash_table:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGIntrinsic.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::put
+        https://bugs.webkit.org/show_bug.cgi?id=69382
+
+        Reviewed by Geoffrey Garen.
+
+        Added static version of both versions of put to all classes that 
+        override them and changed the virtual versions to call the static 
+        versions.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::put):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::put):
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::put):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/JSObject.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::put):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::put):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::put):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::put):
+        * runtime/RegExpObject.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        * runtime/StringObject.h:
+
+2011-10-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Refactor DFG to make for use of callOperation
+        https://bugs.webkit.org/show_bug.cgi?id=69672
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+            - Added new callOperation calls, don't ASSERT flushed (use helpers for unexpected calls, too).
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+            - Switch operationNewObject/operationCreateThis to return Cells,
+            - Added C_DFGOperation_E/C_DFGOperation_EC/J_DFGOperation_EA/J_DFGOperation_EJA call types.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Replace code plating calls to operations to with calls to callOperation.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Replace code plating calls to operations to with calls to callOperation.
+
+2011-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Support string indexing in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=69671
+
+        Reviewed by Gavin Barraclough.
+
+        Emit code to support inline indexing of strings 
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+            Shared code to perform string indexing.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            Use compileGetByValOnString if we predict that the base object
+            is a string in GetByVal.
+        * runtime/JSString.h:
+        (JSC::JSString::offsetOfFiberCount):
+        (JSC::JSString::offsetOfValue):
+
+2011-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ConvertThis speculation logic is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=69663
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Verify that our call speculation is valid.
+
+        Reviewed by Filip Pizlo.
+
+        Before specialising an intrinsic we need to verify that
+        we our speculation is correct.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2011-10-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Unreviewed build correction for the build bot.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add the missing
+        Release_Cairo_CFLite and Debug_Cairo_CFLite targets so that
+        build-jsc can find the target it needs to run the JSC tests.
+
+2011-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Fix 32-bit build.
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2011-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Support direct calls to intrinsic functions
+        https://bugs.webkit.org/show_bug.cgi?id=69646
+
+        Reviewed by Gavin Barraclough.
+
+        Add support for optimising non-method_check calls
+        to intrinsic functions (eg. when Math.abs, etc are
+        cached in local variables). 
+
+        * bytecode/CodeBlock.h:
+        (JSC::getCallLinkInfoBytecodeIndex):
+            Support searching CallLinkInfos by bytecode index
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+            Add support for linked calls in addition to method_check
+            when searching for intrinsics
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasFunctionCheckData):
+        (JSC::DFG::Node::function):
+            Add ability to store a JSFunction* in a node - this is safe
+            as the function will be marked by the codeblock we're compiling
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::checkFunctionElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+            Add support for new CheckFunction node, and implement CSE pass.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            Rather trivial implementation of CheckFunction
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+            Need to propagate bytecode index for calls now.
+
+2011-10-07  Dominic Cooney  <dominicc@chromium.org>
+
+        [JSC] Disable ThreadRestrictionVerifier for JIT ExecutableMemoryHandles
+        https://bugs.webkit.org/show_bug.cgi?id=69599
+
+        Reviewed by Sam Weinig.
+
+        DFG JIT manipulates MetaAllocatorHandles across threads, eg in
+        allocating JITCode buffers on a background thread to execute a
+        proxy autoconfiguration PAC file but garbage collecting it in
+        response to allocation on the main thread. Disabling
+        ThreadRestrictionVerification until there is a verification scheme
+        that understands this handoff.
+
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocator::allocate):
+
+2011-10-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not always speculate that ConvertThis is operating on an object
+        https://bugs.webkit.org/show_bug.cgi?id=69570
+
+        Reviewed by Oliver Hunt.
+        
+        Mostly neutral, but with a slight regression in Kraken since it increases
+        coverage in DFG and thus reveals some performance pathologies (which I
+        prefer to think of as performance opportunities, in a good way).
+
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        * bytecode/PredictedType.h:
+        (JSC::isOtherPrediction):
+        (JSC::mergePredictions):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Windows build fix
+
+        Unreviewed build fix.  Weird runtime failures on Windows due to 
+        linking issues caused by the ClassInfo struct in JSByteArray not 
+        being declared with JS_EXPORTDATA.
+
+        * runtime/JSByteArray.h:
+
+2011-10-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure does not reset m_previous when pinning the property map
+        https://bugs.webkit.org/show_bug.cgi?id=69583
+
+        Reviewed by Gavin Barraclough.
+        
+        This is an 0.6% performance improvement in V8, and 0.2% overall.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::pin):
+        * runtime/Structure.h:
+
+2011-10-06  Anders Carlsson  <andersca@apple.com>
+
+        When building with clang, enable -Wglobal-constructors and -Wexit-time-destructors
+        https://bugs.webkit.org/show_bug.cgi?id=69586
+
+        Reviewed by Darin Adler.
+
+        * Configurations/Base.xcconfig:
+        Add -Wglobal-constructors and -Wexit-time-destructors when building with clang.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        When building with clang, we don't need to run the check-for-global-initializers and
+        check-for-exit-time-destructors anymore.
+
+        * jsc.cpp:
+        (runInteractive):
+        Move interpreterName into runInteractive.
+
+        * wtf/StdLibExtras.h:
+        When building with clang, disable the -Wglobal-constructors and -Wexit-time-destructors
+        warnings around the variable declaration.
+
+2011-10-06  Anders Carlsson  <andersca@apple.com>
+
+        Add DEFINE_DEBUG_ONLY_GLOBAL for globals that should be defined in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=69584
+
+        Reviewed by Darin Adler.
+
+        Add DEFINE_DEBUG_ONLY_GLOBAL macro.
+
+        * wtf/StdLibExtras.h:
+
+2011-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Write barrier shouldn't allocate temporaries inside control flow
+        https://bugs.webkit.org/show_bug.cgi?id=69582
+
+        Reviewed by Gavin Barraclough.
+
+        Reorder the code to avoid spill-related badness.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::writeBarrier):
+
+2011-10-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::shouldSpeculate methods are too complicated
+        https://bugs.webkit.org/show_bug.cgi?id=69560
+
+        Reviewed by Geoffrey Garen.
+        
+        Moved shouldSpeculate methods to DFG::Node, and cleaned them up to
+        just use node predictions.
+        
+        By itself this would have meant that SpeculativeJIT code would have
+        had to say things like m_jit.graph()[nodeIndex].shouldSpeculateXYZ().
+        So this adds an at(NodeIndex) method to JITCodeGenerator. I replaced
+        all uses of the m_jit.graph()[nodeIndex] idiom with at(nodeIndex).
+        
+        This is an 0.4% progression overall that shows up in all benchmarks,
+        for reasons unknown.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::at):
+        (JSC::DFG::JITCodeGenerator::canReuse):
+        (JSC::DFG::JITCodeGenerator::isFilled):
+        (JSC::DFG::JITCodeGenerator::isFilledDouble):
+        (JSC::DFG::JITCodeGenerator::use):
+        (JSC::DFG::JITCodeGenerator::silentSpillFPR):
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        (JSC::DFG::detectPeepHoleBranch):
+        (JSC::DFG::integerResult):
+        (JSC::DFG::noResult):
+        (JSC::DFG::cellResult):
+        (JSC::DFG::jsValueResult):
+        (JSC::DFG::storageResult):
+        (JSC::DFG::doubleResult):
+        (JSC::DFG::initConstantInfo):
+        (JSC::DFG::appendCallWithExceptionCheck):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateInteger):
+        (JSC::DFG::Node::shouldSpeculateDouble):
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        (JSC::DFG::Node::shouldNotSpeculateInteger):
+        (JSC::DFG::Node::shouldSpeculateFinalObject):
+        (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther):
+        (JSC::DFG::Node::shouldSpeculateArray):
+        (JSC::DFG::Node::shouldSpeculateArrayOrOther):
+        (JSC::DFG::Node::shouldSpeculateObject):
+        (JSC::DFG::Node::shouldSpeculateCell):
+        (JSC::DFG::Node::canSpeculateInteger):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownArray):
+        (JSC::DFG::SpeculativeJIT::isKnownString):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::convertToDouble):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-06  Gavin Peters  <gavinp@chromium.org>
+
+        REGRESSION (r96595): First frame in assertion backtraces is no longer labeled "1"
+        https://bugs.webkit.org/show_bug.cgi?id=69556
+
+        Reviewed by Adam Roben.
+
+        * wtf/Assertions.cpp:
+
+2011-10-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG implementation of UInt32ToNumber is missing a break statement
+        https://bugs.webkit.org/show_bug.cgi?id=69552
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed build fix for DFG JIT 32_64 release builds.
+
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGJITCompiler32_64.cpp:
+            - Remove three unused methods.
+
+2011-10-06  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG JIT 32_64 should check type of values being filled by fillSpeculateInt
+        https://bugs.webkit.org/show_bug.cgi?id=69549
+
+        Reviewed by Oliver Hunt.
+
+        This breaks sunspider/3d-cube.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+            - Speculation check on the tag. 
+
+2011-10-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Snow Leopard build fix
+
+        Unreviewed build fix
+
+        * JavaScriptCore.exp:
+
+2011-10-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Add explicit JSGlobalThis type.
+        https://bugs.webkit.org/show_bug.cgi?id=69478
+
+        Reviewed by Darin Adler.
+
+        JSC supports a split global object, as used by WebCore for the Window. As a stage
+        of making this visible to JSC, make it so that if the global this value is not the
+        global object itself, it must be a subclass of JSGlobalThis.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::finishCreation):
+            - Don't pass the thisValue to JSGlobalObject::finishCreation.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Added JSGlobalThis.h
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+            - Don't pass the thisValue to JSGlobalObject::finishCreation.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        (JSC::JSGlobalObject::finishCreation):
+            - finishCreation takes a JSGlobalThis, or thisValue is implicit.
+        * runtime/JSGlobalThis.h: Added.
+        (JSC::JSGlobalThis::create):
+        (JSC::JSGlobalThis::JSGlobalThis):
+        (JSC::JSGlobalThis::finishCreation):
+            - Thin wrapper on JSNonFinalObject to allow type checking.
+        * testRegExp.cpp:
+        (GlobalObject::finishCreation):
+            - Don't pass the thisValue to JSGlobalObject::finishCreation.
+
+2011-10-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC objects need to know their own cell size at runtime.
+        https://bugs.webkit.org/show_bug.cgi?id=69390
+
+        Reviewed by Geoffrey Garen.
+
+        Added the cellSize field to ClassInfo and the static calculation of 
+        size of each class to the CREATE_METHOD_TABLE macro, which will be 
+        renamed in a followup patch to make its name match its broader use.
+
+        Also added a few ClassInfo structs so that each object that is allocated has its 
+        correct size.  
+
+        * JavaScriptCore.exp:
+        * runtime/ClassInfo.h:
+
+        Changed JSByteArray s_defaultInfo to s_info so that the template will get the 
+        correct ClassInfo struct from it when it's allocated.
+        * runtime/JSByteArray.cpp:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.h:
+        (JSC::allocateCell):
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+        (JSC::JSCell::cellSize):
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/StrictEvalActivation.cpp:
+        * runtime/StrictEvalActivation.h:
+
+2011-10-06  Gavin Peters  <gavinp@chromium.org>
+
+        export new stack dumping method
+        https://bugs.webkit.org/show_bug.cgi?id=69018
+
+        The original landing of bug 69018 didn't export WTFGetBacktrace, so that when bug 69453 landed, the first use
+        of this function, many builds broke.  So here we add the exports, so that the function is usable.
+
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-10-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r96347): Build is broken with MSVC compiler if !PLATFORM(WINDOWS)
+        https://bugs.webkit.org/show_bug.cgi?id=69413
+
+        Reviewed by Darin Adler.
+
+        * assembler/MacroAssemblerCodeRef.h: Define STDCALL for MSVC in a proper way.
+
+2011-10-05  Filip Pizlo  <fpizlo@apple.com>
+
+        SpeculativeJIT::isKnownString() is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=69501
+
+        Reviewed by Oliver Hunt.
+        
+        Removed the wrong case (GetLocal predicted String) and added a case that
+        works (StrCat).
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isKnownString):
+
+2011-10-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Windows build fix attempt after r96760.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-10-05  Chris Rogers  <crogers@google.com>
+
+        Define a log2f() function for Windows in wtf/MathExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=69491
+
+        Reviewed by Darin Adler.
+
+        * wtf/MathExtras.h:
+        (log2f):
+
+2011-10-05  Jer Noble  <jer.noble@apple.com>
+
+        Enable WEB_AUDIO by default in the WebKit/mac port.
+        https://bugs.webkit.org/show_bug.cgi?id=68587
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2011-10-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Assertion hit in JSC::DFG::SpeculativeJIT::compile on SL bots
+        https://bugs.webkit.org/show_bug.cgi?id=69346
+
+        Reviewed by Oliver Hunt.
+        
+        Removed the assertion, since it was completely wrong for op_post_inc.
+        Short of having specialized PostInc nodes in the DFG, there is no
+        robust way of asserting what this assertion was trying to assert while
+        also supporting op_post_inc.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Added a simpler mechanism for registering one-off finalizers
+        https://bugs.webkit.org/show_bug.cgi?id=69466
+
+        Reviewed by Oliver Hunt.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::addFinalizer):
+        (JSC::Heap::FinalizerOwner::finalize):
+        * heap/Heap.h: New function for adding an arbitrary finalizer for an
+        arbitrary cell without declaring any special classes or Handles yourself.
+
+        * JavaScriptCore.exp: Fix build.
+
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode):
+        (JSC::ExecutableBase::clearCodeVirtual):
+        (JSC::EvalExecutable::clearCodeVirtual):
+        (JSC::ProgramExecutable::clearCodeVirtual):
+        (JSC::FunctionExecutable::discardCode):
+        (JSC::FunctionExecutable::clearCodeVirtual):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::finishCreation): Use the new mechanism for eager
+        finalization of executables.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::clearRareData):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createRareDataIfNeeded):
+        (JSC::JSGlobalObject::registerWeakMap): Use the new mechanism for eager
+        finalization of weak maps.
+
+2011-10-05  Adam Roben  <aroben@apple.com>
+
+        Ensure RetainPtr::hashTableDeletedValue returns a pointer, not a pointer to a pointer
+
+        RetainPtr's behavior of allowing the template parameter to be either a pointer type or a
+        pointed-to type confused us when we implemented hashTableDeletedValue.
+
+        Fixes <http://webkit.org/b/69414> <rdar://problem/10236833> Using RetainPtr as the key type
+        in HashMap/HashSet fails to compile
+
+        Reviewed by John Sullivan.
+
+        * wtf/RetainPtr.h:
+        (WTF::RetainPtr::hashTableDeletedValue): Changed to use the PtrType typedef rather than T*,
+        since T might itself be a pointer.
+
+        (WTF::PtrHash<RetainPtr<P> >): Updated this to use PtrType everywhere, even though T* didn't
+        seem to be causing a problem.
+
+2011-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Remove last vestiges of anonymous storage.
+
+        Reviewed by Gavin Barraclough.
+
+        One anonymous storage function escaped my prior purge of
+        this feature, this patch removes it.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        * runtime/JSObject.h:
+
+2011-10-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be capable of a broader range of speculations on branch and not
+        https://bugs.webkit.org/show_bug.cgi?id=69322
+
+        Reviewed by Oliver Hunt.
+        
+        * bytecode/PredictedType.h:
+        (JSC::isFinalObjectOrOtherPrediction):
+        (JSC::isArrayOrOtherPrediction):
+        * dfg/DFGJITCodeGenerator.cpp:
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::JITCodeGenerator):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateFinalObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateArrayOrOther):
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+
+2011-10-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96733.
+        http://trac.webkit.org/changeset/96733
+        https://bugs.webkit.org/show_bug.cgi?id=69454
+
+        Broke GCC for some reason (Requested by andersca on #webkit).
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetReverseIterator::ListHashSetReverseIterator):
+        (WTF::ListHashSetReverseIterator::get):
+        (WTF::ListHashSetReverseIterator::operator*):
+        (WTF::ListHashSetReverseIterator::operator->):
+        (WTF::ListHashSetReverseIterator::operator++):
+        (WTF::ListHashSetReverseIterator::operator--):
+        (WTF::ListHashSetReverseIterator::operator==):
+        (WTF::ListHashSetReverseIterator::operator!=):
+        (WTF::ListHashSetReverseIterator::operator const_reverse_iterator):
+        (WTF::ListHashSetReverseIterator::node):
+        (WTF::ListHashSetConstReverseIterator::ListHashSetConstReverseIterator):
+        (WTF::ListHashSetConstReverseIterator::get):
+        (WTF::ListHashSetConstReverseIterator::operator*):
+        (WTF::ListHashSetConstReverseIterator::operator->):
+        (WTF::ListHashSetConstReverseIterator::operator++):
+        (WTF::ListHashSetConstReverseIterator::operator--):
+        (WTF::ListHashSetConstReverseIterator::operator==):
+        (WTF::ListHashSetConstReverseIterator::operator!=):
+        (WTF::ListHashSetConstReverseIterator::node):
+        (WTF::::rbegin):
+        (WTF::::rend):
+        (WTF::::makeReverseIterator):
+        (WTF::::makeConstReverseIterator):
+
+2011-10-04  Oliver Hunt  <oliver@apple.com>
+
+        Add rudimentary filtering to write barriers
+        https://bugs.webkit.org/show_bug.cgi?id=69392
+
+        Reviewed by Filip Pizlo.
+
+        Add approximate filtering for write barriers based on the
+        target's mark bit.  Also add some macros to support dumping
+        GC phase timings.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::markCellCard):
+        * heap/Heap.cpp:
+        (JSC::GCTimer::GCTimerScope::GCTimerScope):
+        (JSC::GCTimer::GCTimerScope::~GCTimerScope):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+           Add phase timing information.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::offsetOfMarks):
+        (JSC::MarkedBlock::gatherDirtyCells):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+
+2011-10-05  Anders Carlsson  <andersca@apple.com>
+
+        Use std::reverse_iterator for ListHashSet reverse iterators
+        https://bugs.webkit.org/show_bug.cgi?id=69446
+
+        Reviewed by Darin Adler.
+
+        * wtf/ListHashSet.h:
+        Use the std::reverse_iterator iterator adaptor for the ListHashSet reverse iterators
+        and get rid of the ListHashSetReverseIterator and ListHashSetConstReverseIterator classes.
+
+2011-10-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Make Object.prototype getter/setter methods match ES5 behaviour
+        https://bugs.webkit.org/show_bug.cgi?id=69393
+
+        Reviewed by Sam Weinig.
+
+        The rest of Object.prototype no longer substitute Null/Undefined with the global object,
+        this is old ES3 behaviour. Remove it here too.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+
+2011-10-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Get rid of posixThread in MachineStackMarker::Thread
+        https://bugs.webkit.org/show_bug.cgi?id=54836
+
+        Reviewed by Oliver Hunt.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::getCurrentPlatformThread):
+        (JSC::equalThread):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeCurrentThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+
+2011-10-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed JSValue::toJSNumber
+        https://bugs.webkit.org/show_bug.cgi?id=69399
+
+        No perf. change.
+
+        toJSNumber() used to provide an implicit fast path for immediate numbers,
+        but those fast paths are all explicit now, so it's just cruft.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSValue.h:
+        * runtime/JSValueInlineMethods.h:
+
+2011-10-05  Gavin Peters  <gavinp@chromium.org>
+
+        REGRESSION (r96595): WTFReportBacktrace listed as the top frame in all assertion backtraces
+        https://bugs.webkit.org/show_bug.cgi?id=69424
+
+        Skip an extra frame in WTFReportBacktrace.  As well, I now don't count skipped frames in maxFrames,
+        so I've updated maxFrames to 31, as with one skipped frame the previous value was effectively
+        31 reported frames.
+
+        Reviewed by Adam Roben.
+
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2011-10-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r96595.
+
+        * wtf/Assertions.cpp:
+        RtlCaptureStackBackTrace() isn't available on WinCE.
+
+2011-10-04  Kent Tamura  <tkent@chromium.org>
+
+        Introduce feature flags for incomplete input types
+        https://bugs.webkit.org/show_bug.cgi?id=68971
+
+        Reviewed by Hajime Morita.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Add ENABLE_INPUT_TYPE_* flags. They are enabled only for iOS.
+
+2011-10-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Use an explicit cast when shortening.
+
+2011-10-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static ClassInfo structs to classes that override JSCell::getCallData
+        https://bugs.webkit.org/show_bug.cgi?id=69311
+
+        Reviewed by Darin Adler.
+
+        Added ClassInfo structs to each class that defined its own getCallData 
+        function but did not already have its own ClassInfo struct.  This is a 
+        necessary addition for when we switch over to looking up getCallData from 
+        the MethodTable in ClassInfo rather than doing the virtual call (which we 
+        are removing).  These new ClassInfo structs are public because we often 
+        use these structs in other areas of the code to uniquely identify JSC classes and 
+        to enforce runtime invariants based on those class identities using ASSERTs.
+        Also added new createStructure methods to those classes that didn't have 
+        them so that the new ClassInfo structs would be used when creating the Structures 
+        in these classes.
+
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanConstructor.h:
+        (JSC::BooleanConstructor::createStructure):
+
+        getCallData was not marked as static in StrictModeTypeErrorFunction.  
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::getCallDataVirtual):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        (JSC::StrictModeTypeErrorFunction::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorConstructor.h:
+        (JSC::ErrorConstructor::createStructure):
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionConstructor.h:
+        (JSC::FunctionConstructor::createStructure):
+        * runtime/FunctionPrototype.cpp:
+        * runtime/FunctionPrototype.h:
+
+2011-10-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Some JSValue cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=69320
+
+        Reviewed by Darin Adler.
+        
+        No measurable performance change.
+
+        Removed some JSValue::get* functions. get* used to be an optimization
+        when every value operation was a virtual function call: get* would combine
+        two virtual calls into one. Now, with non-virtual, inlined functions, get*
+        isn't faster, and may be slightly slower.
+
+        Merged getBoolean(bool&) and getBoolean() into asBoolean().
+
+        Merged uncheckedGetNumber(), getJSNumber() and getNumber() into
+        asNumber().
+
+        * runtime/JSValue.h:
+        * runtime/JSValueInlineMethods.h:
+        (JSC::JSValue::asNumber):
+        (JSC::JSValue::asBoolean): As promised!
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::toThisNumber):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf): Removed a bunch of uses of getJSNumber()
+        by switching to toThisNumber().
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toNumber):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueOfNumberConstant):
+        (JSC::DFG::Graph::valueOfBooleanConstant):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::internalNumber):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/JSArray.cpp:
+        (JSC::compareNumbersForQSort): Replaced getNumber() => isNumber() / asNumber().
+        getBoolean() => isBoolean() / asBoolean(), uncheckedGetNumber() => asNumber().
+
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h: Nixed getJSNumber().
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        * runtime/JSONObject.cpp:
+        (JSC::gap):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/NumberObject.cpp:
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/Operations.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd): Replaced getNumber() => isNumber() / asNumber().
+        getBoolean() => isBoolean() / asBoolean(), uncheckedGetNumber() => asNumber().
+
+2011-10-04  Scott Graham  <scottmg@chromium.org>
+
+        Add GAMEPAD feature flag
+        https://bugs.webkit.org/show_bug.cgi?id=66859
+
+        Reviewed by Darin Fisher.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        JITCodeGenerator should no longer have code that tries too hard
+        to be both speculative and non-speculative
+        https://bugs.webkit.org/show_bug.cgi?id=69321
+
+        Reviewed by Gavin Barraclough.
+        
+        Removed m_isSpeculative and speculationCheck() from JITCodeGenerator.
+        This required moving emitBranch() to SpeculativeJIT, since it was
+        the main user of that field and method. Other than trvial clean-ups
+        in emitBranch(), the code is unchanged (and still has some disparity
+        between 64 and 32_64, and still lacks some obvious optimizations).
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::JITCodeGenerator):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCodeGenerator64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+
+2011-10-04  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=69372
+        
+        [CSS3 Regions] Make sure overflow:visible lets content spill out of regions.
+        
+        Add support for reverse iteration to ListHashSet to support being able to walk them
+        backwards easily.
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/ListHashSet.h:
+        (WTF::ListHashSetReverseIterator::ListHashSetReverseIterator):
+        (WTF::ListHashSetReverseIterator::get):
+        (WTF::ListHashSetReverseIterator::operator*):
+        (WTF::ListHashSetReverseIterator::operator->):
+        (WTF::ListHashSetReverseIterator::operator++):
+        (WTF::ListHashSetReverseIterator::operator--):
+        (WTF::ListHashSetReverseIterator::operator==):
+        (WTF::ListHashSetReverseIterator::operator!=):
+        (WTF::ListHashSetReverseIterator::operator const_reverse_iterator):
+        (WTF::ListHashSetReverseIterator::node):
+        (WTF::ListHashSetConstReverseIterator::ListHashSetConstReverseIterator):
+        (WTF::ListHashSetConstReverseIterator::get):
+        (WTF::ListHashSetConstReverseIterator::operator*):
+        (WTF::ListHashSetConstReverseIterator::operator->):
+        (WTF::ListHashSetConstReverseIterator::operator++):
+        (WTF::ListHashSetConstReverseIterator::operator--):
+        (WTF::ListHashSetConstReverseIterator::operator==):
+        (WTF::ListHashSetConstReverseIterator::operator!=):
+        (WTF::ListHashSetConstReverseIterator::node):
+        (WTF::::rbegin):
+        (WTF::::rend):
+        (WTF::::makeReverseIterator):
+        (WTF::::makeConstReverseIterator):
+        (WTF::::makeConstIterator):
+
+2011-10-04  Gavin Peters  <gavinp@chromium.org>
+
+        fix gtk breakage caused by changeset 96595
+        https://bugs.webkit.org/show_bug.cgi?id=69371
+
+        ews did not catch build breakage in the gtk WebKitPluginProcess target; this patch removes
+        the pretty printer on gtk, which should fix the build on that platform.
+
+        Reviewed by NOBODY, this is a build fix.
+
+        * wtf/Assertions.cpp:
+
+2011-10-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96630.
+        http://trac.webkit.org/changeset/96630
+        https://bugs.webkit.org/show_bug.cgi?id=69368
+
+        Caused assertion failures in validateCell (Requested by
+        mhahnenberg on #webkit).
+
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanConstructor.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::getCallDataVirtual):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/FunctionPrototype.h:
+
+2011-10-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static ClassInfo structs to classes that override JSCell::getCallData
+        https://bugs.webkit.org/show_bug.cgi?id=69311
+
+        Reviewed by Darin Adler.
+
+        Added ClassInfo structs to each class that defined its own getCallData 
+        function but did not already have its own ClassInfo struct.  This is a 
+        necessary addition for when we switch over to looking up getCallData from 
+        the MethodTable in ClassInfo rather than doing the virtual call (which we 
+        are removing).  These new ClassInfo structs are public because we often 
+        use these structs in other areas of the code to uniquely identify JSC classes and 
+        to enforce runtime invariants based on those class identities using ASSERTs.
+
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanConstructor.h:
+
+        getCallData was not marked as static is StrictModeTypeErrorFunction.  
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::getCallDataVirtual):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/FunctionPrototype.h:
+
+2011-10-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Leopard build fix after r96613.
+
+        * wtf/Platform.h:
+
+2011-10-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Implicitly add toString and valueOf to prototype when convertToType callback is provided
+        https://bugs.webkit.org/show_bug.cgi?id=69156
+
+        Reviewed by Geoffrey Garen.
+
+        Added callbacks for toString and valueOf which are implicitly added to a client object's
+        prototype if they provide a convertToType callback when declaring their class through 
+        the JSC API.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::toStringCallback):
+        (JSC::JSCallbackFunction::valueOfCallback):
+        * API/JSCallbackFunction.h:
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/tests/testapi.js:
+
+2011-10-03  Jon Lee  <jonlee@apple.com>
+
+        Extend DOM WheelEvent to differentiate between physical and logical scroll directions
+        https://bugs.webkit.org/show_bug.cgi?id=68959
+        <rdar://problem/10036688>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/Platform.h: Added HAVE_INVERTED_WHEEL_EVENTS for Lion and later.
+
+2011-10-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        MinGW warning fix after r96286.
+
+        Avoid redefining STDCALL, because STDCALL is also defined in mingw32/include/windef.h:
+        #define __stdcall __attribute__((stdcall))
+        #define STDCALL __stdcall
+
+        Reviewed by Tor Arne Vestbø.
+
+        * assembler/MacroAssemblerCodeRef.h:
+
+2011-10-04  Gavin Peters  <gavinp@chromium.org>
+
+       add more stack dumping methods
+       https://bugs.webkit.org/show_bug.cgi?id=69018
+
+       In addition to WTFReportBacktrace, this adds the cross-platform WTFGetBacktrace, which lets
+       WebKit programmatically retrieve the current stack.  This is useful if you need to add more
+       reporting to field crash report uploads, if you're tracking down an irreproducable bug,
+       for instance.
+
+       Reviewed by Darin Adler.
+
+       * wtf/Assertions.cpp:
+       * wtf/Assertions.h:
+
+2011-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline Array.push and Array.pop
+        https://bugs.webkit.org/show_bug.cgi?id=69314
+
+        Reviewed by Geoff Garen.
+        
+        Fix 32-bit.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline Array.push and Array.pop
+        https://bugs.webkit.org/show_bug.cgi?id=69314
+
+        Reviewed by Oliver Hunt.
+        
+        1% speed-up in V8 due to 6% speed-up in V8-deltablue.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        * create_hash_table:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGIntrinsic.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::getMethodLoadElimination):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC ASSERT Opening the Web Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=69293
+
+        Reviewed by Oliver Hunt.
+        
+        If a polymorphic access structure list has a duplicated structure, then
+        don't crash.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2011-10-03  Gavin Barraclough  <barraclough@apple.com>
+
+        On X86, switch bucketCount into a register, timeoutCheck into memory
+        https://bugs.webkit.org/show_bug.cgi?id=69299
+
+        Reviewed by Geoff Garen.
+
+        We don't have sufficient registers to keep both in registers, and DFG JIT will trample esi;
+        it doesn't matter if the bucketCount gets stomped on (in fact it may add to randomness!),
+        but it if the timeoutCheck gets trashed we may make calls out to the timout_check stub
+        function too frequently (regressing performance). This patch has no perf impact on sunspider.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::branchAdd32):
+        (JSC::MacroAssemblerX86::branchSub32):
+            - Added branchSub32 with AbsoluteAddress.
+        * jit/JIT.cpp:
+        (JSC::JIT::emitTimeoutCheck):
+            - Keep timeout count in memory on X86.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+            - remove X86 specific code, switch bucket count back into a register.
+        * jit/JITStubs.cpp:
+            - Stop initializing esi (it is no longer the timeoutCheck!)
+        * jit/JSInterfaceJIT.h:
+            - change definition of esi to be the bucketCountRegister.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+            - Add timeoutCount as a property to global data (the counter should be per-thread).
+
+2011-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG backends don't have access to per-node predictions from the propagator
+        https://bugs.webkit.org/show_bug.cgi?id=69291
+
+        Reviewed by Oliver Hunt.
+        
+        Nodes now have two notion of predictions: the heap prediction, which is
+        what came directly from value profiling, and the propagator's predictions,
+        which arise out of abstract interpretation. Every node has a propagator
+        prediction, but not every node has a heap prediction; and there is no
+        guarantee that a node that has both will keep them consistent as the
+        propagator may have additional information available to it.
+        
+        This is performance neutral.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::getPrediction):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::getHeapPrediction):
+        (JSC::DFG::Node::predictHeap):
+        (JSC::DFG::Node::prediction):
+        (JSC::DFG::Node::predict):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::Propagator):
+        (JSC::DFG::Propagator::setPrediction):
+        (JSC::DFG::Propagator::mergePrediction):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::isPredictedNumerical):
+        (JSC::DFG::Propagator::logicalNotIsPure):
+        (JSC::DFG::Propagator::setReplacement):
+
+2011-10-03  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed, rolling out r96526.
+        http://trac.webkit.org/changeset/96526
+        https://bugs.webkit.org/show_bug.cgi?id=68587
+
+        WEB_AUDIO has numerous 64->32 bit casting warnings, causing
+        build breakages where -Wall is enabled.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2011-10-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed build fix for DFG JIT 32_64.
+
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should speculate more aggressively on obvious cases on
+        polymorphic get_by_id
+        https://bugs.webkit.org/show_bug.cgi?id=69235
+
+        Reviewed by Oliver Hunt.
+        
+        This implements trivial polymorphic get_by_id. It also fixes
+        problems in the CSE for CheckStructure in the put_by_id
+        transition case.
+        
+        Doing this required knowing whether a polymorphic get_by_id stub
+        was doing a direct access rather than a call of some kind.
+        
+        Slight speed-up on Kraken and SunSpider. 0.5% speed-up in the
+        scaled mean of all benchmarks.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addStructureSet):
+        (JSC::DFG::Graph::addStructureTransitionData):
+        * dfg/DFGNode.h:
+        (JSC::DFG::StructureTransitionData::StructureTransitionData):
+        (JSC::DFG::Node::hasStructureTransitionData):
+        (JSC::DFG::Node::structureTransitionData):
+        (JSC::DFG::Node::hasStructureSet):
+        (JSC::DFG::Node::structureSet):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureSet.h: Added.
+        (JSC::DFG::StructureSet::StructureSet):
+        (JSC::DFG::StructureSet::add):
+        (JSC::DFG::StructureSet::addAll):
+        (JSC::DFG::StructureSet::remove):
+        (JSC::DFG::StructureSet::contains):
+        (JSC::DFG::StructureSet::isSubsetOf):
+        (JSC::DFG::StructureSet::isSupersetOf):
+        (JSC::DFG::StructureSet::size):
+        (JSC::DFG::StructureSet::at):
+        (JSC::DFG::StructureSet::operator[]):
+        (JSC::DFG::StructureSet::last):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+
+2011-10-03  Jer Noble  <jer.noble@apple.com>
+
+        Enable WEB_AUDIO by default in the WebKit/mac port.
+        https://bugs.webkit.org/show_bug.cgi?id=68587
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2011-10-03  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Fix make distcheck build
+        https://bugs.webkit.org/show_bug.cgi?id=69243
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.list.am:
+
+2011-10-03  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Build fix: Qt::escape is deprecated in Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=69162
+
+        Use QString::toHtmlEscaped in the Qt5 case.
+
+        Reviewed by Andreas Kling.
+
+        * JavaScriptCore.pri:
+        * wtf/qt/UtilsQt.h: Added.
+        (escapeHtml):
+        * wtf/wtf.pri:
+
+2011-10-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        libdispatch based ParallelJobs is not enough parallel
+        https://bugs.webkit.org/show_bug.cgi?id=66378
+
+        Reviewed by Zoltan Herczeg.
+
+        Use the appropriate libdispatch API for our use case.
+        Throw away the hard coded limit of parallel threads
+        and use dispatch_apply with the default priority normal
+        queue istead of using our own custom serial queue (which
+        was a misuse of the API). Enabling PARALLEL_JOBS is now
+        a 60% win (2.63x as fast) on the methanol benchmark
+        (https://gitorious.org/methanol) with an SVG centric test set
+        while the old implementation was almost identical (less than 5% win).
+
+        * wtf/ParallelJobsLibdispatch.h:
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::execute):
+
+2011-10-02  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt]REGRESSION(r95912): It made sputnik tests flakey
+        https://bugs.webkit.org/show_bug.cgi?id=68990
+
+        Reviewed by Geoffrey Garen.
+
+        Changing signed char to int in r96354 solved the
+        problem. However transitionCount still returns
+        with a signed char and should be changed to int.
+
+        * runtime/Structure.h:
+        (JSC::Structure::transitionCount):
+
+2011-10-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG misses some obvious opportunities for common subexpression elimination
+        https://bugs.webkit.org/show_bug.cgi?id=69233
+
+        Reviewed by Oliver Hunt.
+        
+        0.7% speed-up on SunSpider.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::getMethodLoadElimination):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+
+2011-10-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Bug 67455 - Different regular expression result
+
+        Reviewed by Darin Adler.
+        
+        Fix a regression introduced in r72140. A return was added to the backtracking loop for
+        backtrackParentheses with QuantifierNonGreedy, so it always returns after one iteration.
+        This is incorrect. The additional return should only trigger to force an early return if
+        an error has occured.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParentheses):
+            - Simplify some nested if else logic.
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+            - Simplify some nested if else logic.
+            - Only return early from backtrackParentheses on success/error, not on failure.
+
+2011-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed redundant helper functions for allocating Strong handles
+        https://bugs.webkit.org/show_bug.cgi?id=69218
+
+        Reviewed by Sam Weinig.
+
+        * heap/Heap.h:
+        (JSC::Heap::handleHeap):
+        * runtime/JSGlobalData.h: Removed these helper functions, since they
+        just created indirection.
+
+        * heap/StrongInlines.h: Added. Broke out a header for inline functions
+        to resolve circular dependencies created by inlining. I'm told this is
+        the future for JavaScriptCore.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Go forth and build.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::set):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::setSingleTransition):
+        * heap/Local.h:
+        (JSC::::Local):
+        * heap/Strong.h:
+        (JSC::::Strong):
+        (JSC::::set):
+        * heap/Weak.h:
+        (JSC::Weak::Weak):
+        (JSC::Weak::set): Allocate handles directly instead of going through a
+        chain of forwarding functions.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/LiteralParser.cpp:
+        * runtime/RegExpCache.cpp: Updated for header changes.
+
+2011-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        All of JSC's heuristics should be in one place for easier tuning
+        https://bugs.webkit.org/show_bug.cgi?id=69201
+
+        Reviewed by Oliver Hunt.
+        
+        This makes it possible to change tiered compilation heuristics in
+        one place (Heuristics.cpp) without recompiling the whole project.
+        
+        It also makes it possible to enable setting heuristics using
+        environment variables. This is off by default. When turned on, it
+        makes tuning the system much easier.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * runtime/Heuristics.cpp: Added.
+        (JSC::Heuristics::parse):
+        (JSC::Heuristics::setHeuristic):
+        (JSC::Heuristics::initializeHeuristics):
+        * runtime/Heuristics.h: Added.
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+
+2011-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Support string length in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=69215
+
+        Reviewed by Geoff Garen.
+
+        Adds a GetStringLength node to the DFG so that we can support
+        string.length inline.
+
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isKnownString):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSString.h:
+        (JSC::JSString::offsetOfLength):
+
+2011-10-01  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        JSVALUE32_64 DFG JIT - unboxed integers and cells in register file must be reboxed before exiting from DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69205
+
+        Reviewed by Gavin Barraclough.
+
+        If there are unboxed integers and cells in register file (e.g. by SetLocal), 
+        they must be reboxed before exiting from the speculative DFG JIT execution.
+        This patch also adds a new ValueSourceKind (CellInRegisterFile) and a new
+        ValueRecoveryTechnique (AlreadyInRegisterFileAsCell).
+
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::ValueRecovery::dump):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueSource::forPrediction):
+        (JSC::DFG::ValueRecovery::alreadyInRegisterFileAsUnboxedCell):
+
+2011-10-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96421.
+        http://trac.webkit.org/changeset/96421
+        https://bugs.webkit.org/show_bug.cgi?id=69206
+
+        It broke Qt-WK2 build (Requested by ossy on #webkit).
+
+        * JavaScriptCore.pri:
+        * wtf/qt/UtilsQt.h: Removed.
+        * wtf/wtf.pri:
+
+2011-09-30  Daniel Bates  <dbates@webkit.org>
+
+        Attempt to fix the Apple Windows and WinCairo Debug builds after
+        <http://trac.webkit.org/changeset/96446> (https://bugs.webkit.org/show_bug.cgi?id=69203).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove the symbol
+        ?toStrictThisObject@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@@Z since the
+        corresponding function, JSValue::toStrictThisObject(), was removed.
+
+2011-09-30  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG operation results are not set correctly in JSVALUE32_64 DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69126
+
+        Reviewed by Gavin Barraclough.
+
+        The setupResults routine has the bug of reversing the source and destination. 
+        Also some other trivial (but stupid) bugs need to be fixed in JSVALUE32_64 DFG JIT.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::setupTwoStubArgs):
+        (JSC::DFG::setupResults):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+
+2011-09-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove toStrictThisObject, toThisString, toThisJSString
+        https://bugs.webkit.org/show_bug.cgi?id=69203
+
+        Rubber stamped by Sam Weinig
+
+        These are no longer used.
+
+        * JavaScriptCore.exp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSValue.h:
+        * runtime/StrictEvalActivation.cpp:
+        * runtime/StrictEvalActivation.h:
+
+2011-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG does not speculate aggressively enough on put_by_id
+        https://bugs.webkit.org/show_bug.cgi?id=69114
+
+        Reviewed by Oliver Hunt.
+
+        This adds new nodes along with optimizations for those nodes:
+        
+        GetPropertyStorage: CheckStructure used to do both the structure
+        check and retrieve the storage pointer. Now CheckStructure just
+        checks the structure, and GetPropertyStorage retrieves the
+        storage pointer.
+        
+        PutStructure: Changes the structure, and has the expected store
+        to load optimization with CheckStructure.
+        
+        PutByOffset: Directly sets the value. Has store to load
+        optimization with GetByOffset.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::writeBarrier):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasStructure):
+        (JSC::DFG::Node::hasStorageAccessData):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::impureCSE):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::getPropertyStorageLoadElimination):
+        (JSC::DFG::Propagator::eliminate):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-30  Gavin Barraclough  <barraclough@apple.com>
+
+        StringRecursionChecker should not work in terms of EncodedJSValue
+        https://bugs.webkit.org/show_bug.cgi?id=69188
+
+        Reviewed by Oliver Hunt.
+
+        0 is not the empty value on 32_64.
+        Code that casts literals to EncodedJSValues may be unsafe if we change our internal representation.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringRecursionChecker.cpp:
+        (JSC::StringRecursionChecker::throwStackOverflowError):
+        (JSC::StringRecursionChecker::emptyString):
+        * runtime/StringRecursionChecker.h:
+        (JSC::StringRecursionChecker::performCheck):
+        (JSC::StringRecursionChecker::earlyReturnValue):
+
+2011-09-30  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG JIT, Branch on integer can always be a 32-bit compare.
+        https://bugs.webkit.org/show_bug.cgi?id=69174
+
+        Reviewed by Sam Weinig.
+
+        if (shouldSpeculateInteger(node.child1()) && !isStrictInt32(node.child1())),
+        the JSVALUE64 JIT will currently compare all 64bits in the register, but in
+        these cases the DataFormat is always a JS boxed integer. In these cases we
+        can just compare the low 32bits anyway - no need to check the tag.
+        This allows the code to be unified with the JSVALUE32_64 JIT.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Need a sensible GGC policy
+
+        Reviewed by Geoff Garen.
+
+        This replaces the existing random collection policy
+        with a deterministic policy based on nursery size.
+
+        * heap/AllocationSpace.cpp:
+        (JSC::AllocationSpace::allocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocator):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::nurseryWaterMark):
+        (JSC::MarkedSpace::allocate):
+
+2011-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG 32-bit support for op_call and op_construct causes
+        run-javascriptcore-tests to fail
+        https://bugs.webkit.org/show_bug.cgi?id=69171
+
+        Reviewed by Gavin Barraclough.
+        
+        This fixes one obvious bug that was causing test failures (no
+        support for dummy slow case for op_add in 32_64), and disables
+        op_call and op_construct by default.        
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+
+2011-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Crash due to out of bounds read/write in MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=69148
+        
+        This was a case of being surprised by a poorly aritulcated cell size limit,
+        plus an incorrect ASSERT guarding the cell size limit.
+
+        Reviewed by Oliver Hunt.
+
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::sizeClassFor): Changed heap size ranges to be inclusive,
+        since it makes the ranges easier to understand.
+        
+        Bumped up the max cell size to support the use case in this bug. Since the
+        atomSize is much bigger than it used to be, there isn't much accounting
+        cost to handling more size classes.
+        
+        Switched to FixedArray, to help catch SizeClass indexing bugs in the future.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocator):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData): Updated for size ranges
+        being inclusive.
+
+2011-09-30  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Build fix: Qt::escape is deprecated in Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=69162
+
+        Use QString::toHtmlEscaped in the Qt5 case.
+
+        Reviewed by Andreas Kling.
+
+        * JavaScriptCore.pri:
+        * wtf/qt/UtilsQt.h: Added.
+        (escapeHtml):
+        * wtf/wtf.pri:
+
+2011-09-30  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Fix bug in getHostCallReturnValue of DFG JIT on X86
+        https://bugs.webkit.org/show_bug.cgi?id=69133
+
+        Reviewed by Gavin Barraclough.
+
+        We need to insert the additional argument in the stack slot before
+        return address instead of simply pushing it afterwards.
+        Also getHostCallReturnValue* should be attributed as stdcall
+        to make the stack cleaned up by the callee.
+
+        * dfg/DFGOperations.cpp:
+
+2011-09-30  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] wtf header files are unknown to Qt Creator
+        https://bugs.webkit.org/show_bug.cgi?id=69158
+
+        Adding the HEADERS variable in wtf.pri so that
+        the header files can be accessed easily.
+
+        Reviewed by Andreas Kling.
+
+        * wtf/wtf.pri:
+
+2011-09-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Merge some more of DFGSpeculativeJIT 32_64/64
+        https://bugs.webkit.org/show_bug.cgi?id=69164
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        * dfg/DFGJITCodeGenerator64.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add getCallData to MethodTable in ClassInfo
+        https://bugs.webkit.org/show_bug.cgi?id=69024
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+        Added the getCallData to the MethodTable in the ClassInfo struct.
+        * runtime/ClassInfo.h:
+
+2011-09-29  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Add op_call/op_constructor support to JSVALUE32_64 DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69120
+
+        Reviewed by Gavin Barraclough.
+
+        Improve the coverage of JSVALUE32_64 DFG JIT.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::tagOfCallData):
+        (JSC::DFG::payloadOfCallData):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+
+2011-09-29  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG JIT - register not unlocked after usage in ArithDiv
+        https://bugs.webkit.org/show_bug.cgi?id=69122
+
+        Reviewed by Geoffrey Garen.
+
+        Some allocated register is not unlocked after the usage in ArithDiv. 
+        Also there's a typo in "ENBALE_DFG_CONSISTENTCY_CHECK".
+
+        * dfg/DFGNode.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::toObject
+        https://bugs.webkit.org/show_bug.cgi?id=68937
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+        De-virtualized JSCell::toObject and changed its implementation to manually check the 
+        cases for JSString and JSObject rather than leaving it up to the virtual method call.
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toObject):
+        * runtime/JSCell.h:
+
+        Removed JSNotAnObject::toObject because the case for JSObject works for it.
+        Also removed JSObject::toObject because it was essentially the identity function,
+        which is not necessary since toObject is no longer virtual.
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+
+        De-virtualized JSObject::toObject and JSString::toObject.
+        * runtime/JSString.h:
+
+2011-09-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Start refactoring DFGSpeculativeJIT
+        https://bugs.webkit.org/show_bug.cgi?id=69112
+
+        Reviewed by Oliver Hunt.
+
+        Again, move JSVALUE64 code into a DFJSpeculativeJIT64.cpp
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::ValueRecovery::dump):
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::dump):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT64.cpp: Copied from Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp.
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Refactor out trivially duplicated code in DFGJITCodeGenerator.
+        https://bugs.webkit.org/show_bug.cgi?id=69109
+
+        Reviewed by Oliver Hunt.
+
+        Some code is trivially redundant between DFGJITCodeGenerator.cpp & DFGJITCodeGenerator32_64.cpp
+
+        Basically move a JSVALUE64 specific code into a new DFGJITCodeGenerator64.cpp, leave common code
+        in DFGJITCodeGenerator.cpp, and remove copies from DFGJITCodeGenerator32_64.cpp.
+
+        For some function differences are trivial & make more sense to ifdef individually, and some
+        Operand methods make more sense left in DFGJITCodeGenerator.cpp alongside similar constructors.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
+        (JSC::DFG::JITCodeGenerator::isKnownBoolean):
+        (JSC::DFG::JITCodeGenerator::writeBarrier):
+        (JSC::DFG::JITCodeGenerator::dump):
+        (JSC::DFG::JITCodeGenerator::checkConsistency):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        * dfg/DFGJITCodeGenerator64.cpp: Copied from Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp.
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::branchIfNotCell):
+        * dfg/DFGJITCompilerInlineMethods.h:
+
+2011-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should infer which uses of a variable are not aliased
+        https://bugs.webkit.org/show_bug.cgi?id=68593
+
+        Reviewed by Oliver Hunt.
+        
+        This separates how a variable is stored (i.e. its virtual register)
+        from how it's predicted. Each variable now takes a
+        VariableAccessData as its operand, instead of the virtual register.
+        The VariableAccessData stores the operand and the prediction. If
+        multiple uses of a variable are aliased, their VariableAccessDatas
+        are unified.
+        
+        This also adds tracking of which argument values are used. It
+        correctly observes that an argument value is not used, if the
+        argument is assigned to inside the function before being used.
+        
+        This also adds tracking of which variables are live at the head of
+        a basic block, and separates that from a variable being live at the
+        tail.
+        
+        Finally, this communicates to both OSR entry and OSR exit code how
+        a variable is predicted at a particular point in the code, rather
+        than just communicating how it was predicted in the entire code
+        block (since with this patch there is no longer the notion of a
+        variable having just one prediction for a code block).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ActionablePrediction.h: Added.
+        (JSC::actionablePredictionFromPredictedType):
+        (JSC::valueObeysPrediction):
+        (JSC::actionablePredictionToString):
+        (JSC::ActionablePredictions::ActionablePredictions):
+        (JSC::ActionablePredictions::setArgument):
+        (JSC::ActionablePredictions::argument):
+        (JSC::ActionablePredictions::setVariable):
+        (JSC::ActionablePredictions::variable):
+        (JSC::ActionablePredictions::argumentUpperBound):
+        (JSC::ActionablePredictions::variableUpperBound):
+        (JSC::ActionablePredictions::pack):
+        (JSC::ActionablePredictions::packVector):
+        * bytecode/CodeBlock.h:
+        * bytecode/PredictionTracker.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::newVariableAccessData):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::nameOfVariableAccessData):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::operandIsArgument):
+        (JSC::DFG::VariableRecord::setFirstTime):
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::getPrediction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasVariableAccessData):
+        (JSC::DFG::Node::hasLocal):
+        (JSC::DFG::Node::variableAccessData):
+        (JSC::DFG::Node::local):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueSource::ValueSource):
+        (JSC::DFG::ValueSource::forPrediction):
+        (JSC::DFG::ValueSource::isSet):
+        (JSC::DFG::ValueSource::kind):
+        (JSC::DFG::ValueSource::nodeIndex):
+        (JSC::DFG::ValueSource::nodeIndexFromKind):
+        (JSC::DFG::ValueSource::kindFromNodeIndex):
+        (JSC::DFG::SpeculativeJIT::isKnownArray):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * wtf/PackedIntVector.h: Added.
+        (WTF::PackedIntVector::PackedIntVector):
+        (WTF::PackedIntVector::operator=):
+        (WTF::PackedIntVector::size):
+        (WTF::PackedIntVector::ensureSize):
+        (WTF::PackedIntVector::resize):
+        (WTF::PackedIntVector::clearAll):
+        (WTF::PackedIntVector::get):
+        (WTF::PackedIntVector::set):
+        (WTF::PackedIntVector::mask):
+        * wtf/Platform.h:
+        * wtf/UnionFind.h: Added.
+        (WTF::UnionFind::UnionFind):
+        (WTF::UnionFind::find):
+        (WTF::UnionFind::unify):
+
+2011-09-29  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        * heap/AllocationSpace.h:
+
+2011-09-29  Oliver Hunt  <oliver@apple.com>
+
+        Add logic to collect dirty objects as roots
+        https://bugs.webkit.org/show_bug.cgi?id=69100
+
+        Reviewed by Geoff Garen.
+
+        This gives us the ability to walk all the MarkedBlocks in an
+        AllocationSpace and collect the dirty objects, and then use
+        them as GC roots.
+        
+        I also rearranged the order of these instructions because it
+        makes them smaller on some platforms with some card sizes.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::markCellCard):
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::markCellCard):
+        * heap/AllocationSpace.cpp:
+           Tidy up the write barrier logic a bit.
+        (JSC::MarkedBlock::gatherDirtyObjects):
+        (JSC::TakeIfDirty::returnValue):
+        (JSC::TakeIfDirty::TakeIfDirty):
+        (JSC::TakeIfDirty::operator()):
+        (JSC::AllocationSpace::gatherDirtyObjects):
+        * heap/AllocationSpace.h:
+        * heap/CardSet.h:
+        (JSC::::isCardMarked):
+        (JSC::::clearCard):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier):
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::visitChildren):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::setDirtyObject):
+        (JSC::MarkedBlock::addressOfCardFor):
+        * heap/SlotVisitor.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+           Tidy the write barrier a bit.
+
+2011-09-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        * dfg/DFGOperations.h:
+
+2011-09-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure transitions involving many (> 64) properties sometimes cause structure corruption
+        https://bugs.webkit.org/show_bug.cgi?id=69102
+
+        Reviewed by Darin Adler.
+        
+        Made m_offset an int instead of a signed char. Changed the code to ensure that transitions
+        don't lead to the dictionary kind being forgotten.
+        
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+
+2011-09-29  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        DFG operation calls should be stdcall in Linux JSVALUE32_64 DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69058
+
+        Reviewed by Gavin Barraclough.
+
+        Also Fixed the stdcall FunctionPtr constructors to make them compiled correctly on Linux
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+
+2011-09-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::visitChildrenVirtual and remove all other visitChildrenVirtual methods
+        https://bugs.webkit.org/show_bug.cgi?id=68839
+
+        Reviewed by Geoffrey Garen.
+
+        Removed the remaining visitChildrenVirtual methods.  This patch completes the process of 
+        de-virtualizing visitChildren.
+
+        * API/JSCallbackObject.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        * runtime/Arguments.h:
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        * runtime/GetterSetter.cpp:
+        * runtime/GetterSetter.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        * runtime/JSArray.h:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSValue.h:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+
+        Inlined the method table access and call to the visitChildren function (the only call sites 
+        to visitChildren are here).
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::visitChildren):
+
+        Changed the field name for the visitChildren function pointer to visitChildren (from 
+        visitChildrenFunctionPtr) to make call sites less verbose.
+        * runtime/ClassInfo.h:
+
+        Discovered JSBoundFunction doesn't have its own ClassInfo (it used JSFunction's ClassInfo) but 
+        overrides visitChildren, so it needs to have its own ClassInfo.
+        * runtime/JSBoundFunction.cpp:
+        * runtime/JSBoundFunction.h:
+
+        Had to move className up to make sure that the virtual destructor in JSObject wasn't 
+        the first non-inline virtual method in JSObject (as per the comment in the file).
+        Also moved JSCell::visitChildrenVirtual into JSObject.h in order for it be inline-able
+        to mitigate the cost of an extra method call.
+
+        Also added a convenience accessor function methodTable() to JSCell to return the MethodTable to make 
+        call sites more concise.  Implementation is inline in JSObject.h.
+        * runtime/JSObject.h:
+        (JSC::JSCell::methodTable):
+        * runtime/JSCell.h:
+
+        Added an out of line virtual destructor to JSWrapperObject and ScopeChainNode to 
+        appease the vtable gods.  It refused to compile if there were no virtual methods in 
+        both of these classes due to the presence of a weak vtable pointer.
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::~JSWrapperObject):
+        * runtime/JSWrapperObject.h:
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        * runtime/ScopeChain.h:
+
+2011-09-29  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Bug fixes for CreateThis, NewObject and GetByOffset in JSVALUE32_64 DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=69075
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-29  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        JSVALUE32_64 DFG JIT failed to be built on 32-bit Linux due to incorrect overloaded OpInfo constructor
+        https://bugs.webkit.org/show_bug.cgi?id=69054
+
+        Reviewed by Gavin Barraclough.
+
+        size_t is equal to uint32_t on most 32-bit platforms, except for Mac OS.
+
+        * dfg/DFGNode.h:
+
+2011-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG checkArgumentTypes fails to check boolean predictions
+        https://bugs.webkit.org/show_bug.cgi?id=69059
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+
+2011-09-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix pt 2 for r96286.
+
+        * assembler/MacroAssemblerCodeRef.h:
+
+2011-09-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix attempt for r96286.
+
+        * assembler/MacroAssemblerCodeRef.h:
+
+2011-09-28  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG JIT Operations on 32_64 should use stdcall calling convention.
+        https://bugs.webkit.org/show_bug.cgi?id=69046
+
+        Reviewed by Sam Weinig.
+
+        All calls out are expecting stdcall conventions, but the default on OS X are cdecl.
+        Leave D_DFGOperation_DD calls as the one exception, since we want to be able to link
+        directly to std library functions like fmod - leave these calls obeying the default
+        platform calling convention.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+            - Add implicit constructors for std calls.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+            - Make this work non-Mac platforms.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * dfg/DFGOperations.h:
+            - Mark all operations as stdcalls.
+
+2011-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT falls back on numerical comparisons when it does not
+        recognize a prediction
+        https://bugs.webkit.org/show_bug.cgi?id=68977
+
+        Reviewed by Geoffrey Garen.
+        
+        This fixes both the way comparison implementations are selected. It
+        also fixes a bug where comparisons other than equality (like < or >)
+        on objects are compiled as if the comparison was equality.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+
+2011-09-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement callOperation(D_DFGOperation_DD) for DFG JIT 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=69026
+
+        Reviewed by Sam Weinig.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::fstpl):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+
+2011-09-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Merge bug#68580, bug#68932 for DFG JIT with JSVALUE32_64
+        https://bugs.webkit.org/show_bug.cgi?id=69017
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-28  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64679
+        Fix bugs in Array.prototype this handling.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+            - These methods should throw if this value is undefined.
+
+2011-09-27  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Value profiling in baseline JIT for JSVALUE32_64
+        https://bugs.webkit.org/show_bug.cgi?id=68750
+
+        Reviewed by Geoff Garen.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_div):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_call_put_result):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_get_global_var):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::callWithValueProfiling):
+
+2011-09-28  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Wrong integer checks in JSVALUE32_64 DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=68985
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2011-09-28  Adam Barth  <abarth@webkit.org>
+
+        Remove empty directories.
+
+        * wtf/brew: Removed.
+        * wtf/unicode/brew: Removed.
+
+2011-09-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT cannot compile op_new_object, op_new_array,
+        op_new_array_buffer, or op_new_regexp
+        https://bugs.webkit.org/show_bug.cgi?id=68580
+
+        Reviewed by Oliver Hunt.
+        
+        This implements all four opcodes, but has op_new_regexp turns off
+        by default because it unveils some bad speculation logic when
+        compiling string-validate-input.
+        
+        With op_new_regexp turned off, this is a 5% win on Kraken and a
+        0.7% speed-up on V8. Neutral on SunSpider.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::callOperation):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasConstantBuffer):
+        (JSC::DFG::Node::startConstant):
+        (JSC::DFG::Node::numConstants):
+        (JSC::DFG::Node::hasRegexpIndex):
+        (JSC::DFG::Node::regexpIndex):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isKnownArray):
+
+2011-09-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should speculate more aggressively on reads of array.length
+        https://bugs.webkit.org/show_bug.cgi?id=68932
+
+        Reviewed by Oliver Hunt.
+        
+        This is a 2% speed-up on Kraken, neutral elsewhere.
+
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-27  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG JIT - merge changes between 95905 - 96175
+        https://bugs.webkit.org/show_bug.cgi?id=68963
+
+        Reviewed by Sam Weinig.
+
+        Merge missing changes from bug#68677, bug#68784, bug#68785.
+
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Get JSVALUE32_64 DFG JIT building on OS X.
+        https://bugs.webkit.org/show_bug.cgi?id=68961
+
+        Reviewed by Geoff Garen.
+
+        * Merge bug #68763 (DFG JIT should not eagerly initialize integer tags in the register file).
+        * Forward-declare functions in DFGOperations.cpp
+        * UNUSED_PARAM for unused arguments
+        * NO_RETURN for unimplemented function that ASSERT_NOT_REACHED
+        * Fix argument types handled by OpInfo constructor.
+        * Use SYMBOL_STRING instead of STRINGIZE for asm symbols.
+        * Add files to Xcode project.
+
+2011-09-27  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Bug fixes for GetById, PutById, and GetByOffset in JSVALUE32_64 DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=68755
+
+        Reviewed by Gavin Barraclough.
+
+        We need to load/store and repatch both tag and payload of a property
+        for GetById/PutById. Also reorder the loads of tag and payload for
+        GetByOffset as the result tag GPR could reuse the storage GPR.
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCodeGenerator32_64.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addPropertyAccess):
+        (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
+        * dfg/DFGJITCompiler32_64.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchByIdSelfAccess):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Macro assembler branch8 & 16 methods vary in treatment of upper bits
+        https://bugs.webkit.org/show_bug.cgi?id=68301
+
+        Reviewed by Sam Weinig.
+
+        Fix for branch16 - remove it!
+        No performance impact.
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerSH4.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+
+2011-09-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::getCallData
+        https://bugs.webkit.org/show_bug.cgi?id=68741
+
+        Reviewed by Darin Adler.
+
+        In this patch we just extract the bodies of the virtual getCallData methods
+        throughout the JSCell inheritance hierarchy out into static methods, which are 
+        now called from the virtual methods.  This is an intermediate step in trying to 
+        move the virtual-ness of getCallData into our own method table stored in 
+        ClassInfo.  We need to convert the methods to static methods because static methods 
+        can be represented as function pointers rather than pointers to member functions, and
+        function pointers are smaller and faster to call than pointers to member functions.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::getCallDataVirtual):
+        (JSC::JSCallbackFunction::getCallData):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getCallDataVirtual):
+        (JSC::::getCallData):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getCallDataVirtual):
+        (JSC::ArrayConstructor::getCallData):
+        * runtime/ArrayConstructor.h:
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::getCallDataVirtual):
+        (JSC::BooleanConstructor::getCallData):
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getCallDataVirtual):
+        (JSC::DateConstructor::getCallData):
+        * runtime/DateConstructor.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::getCallDataVirtual):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::getCallDataVirtual):
+        (JSC::ErrorConstructor::getCallData):
+        * runtime/ErrorConstructor.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::getCallDataVirtual):
+        (JSC::FunctionConstructor::getCallData):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::getCallDataVirtual):
+        (JSC::FunctionPrototype::getCallData):
+        * runtime/FunctionPrototype.h:
+        * runtime/InternalFunction.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getCallDataVirtual):
+        (JSC::JSCell::getCallData):
+        * runtime/JSCell.h:
+        (JSC::getCallData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getCallDataVirtual):
+        (JSC::JSFunction::getCallData):
+        * runtime/JSFunction.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::getCallDataVirtual):
+        (JSC::NativeErrorConstructor::getCallData):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getCallDataVirtual):
+        (JSC::NumberConstructor::getCallData):
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getCallDataVirtual):
+        (JSC::ObjectConstructor::getCallData):
+        * runtime/ObjectConstructor.h:
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getCallDataVirtual):
+        (JSC::RegExpConstructor::getCallData):
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getCallDataVirtual):
+        (JSC::StringConstructor::getCallData):
+        * runtime/StringConstructor.h:
+
+2011-09-27  Tim Horton  <timothy_horton@apple.com>
+
+        Rapidly refreshing a feMorphology[erode] with r=0 can sometimes cause display corruption
+        https://bugs.webkit.org/show_bug.cgi?id=68816
+        <rdar://problem/10186468>
+
+        Reviewed by Simon Fraser.
+        
+        Add ByteArray::clear, which zeros the memory in the ByteArray.
+
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::clear): Added.
+
+2011-09-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r96131.
+        http://trac.webkit.org/changeset/96131
+        https://bugs.webkit.org/show_bug.cgi?id=68927
+
+        It made 18+ tests crash on all platform (Requested by
+        Ossy_night on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        * interpreter/Interpreter.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+
+2011-09-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::getPrimitiveNumber
+        https://bugs.webkit.org/show_bug.cgi?id=68851
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+        Changed JSCell::getPrimitiveNumber to manually handle the dispatch for 
+        JSCells (JSObject and JSString in this case).
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getPrimitiveNumber):
+        * runtime/JSCell.h:
+
+        Removed JSNotAnObject::getPrimitiveNumber since its return value doesn't 
+        matter and it already implements defaultValue, so JSObject::getPrimitiveNumber
+        can cover the case for JSNotAnObject.
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+
+        De-virtualized JSObject::getPrimitiveNumber and JSString::getPrimitiveNumber 
+        and changed them to be const.  Also made JSString::getPrimitiveNumber public 
+        because it needs to be called from JSCell::getPrimitiveNumber and also since it's 
+        no longer virtual, we want people who have a more specific pointer (JSString* 
+        instead of JSCell*) to not have to pay the cost of a virtual method call.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPrimitiveNumber):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::getPrimitiveNumber):
+        * runtime/JSString.h:
+
+2011-09-27  Juan Carlos Montemayor Elosua  <j.mont@me.com>
+
+        Implement Error.stack
+        https://bugs.webkit.org/show_bug.cgi?id=66994
+
+        Reviewed by Oliver Hunt.
+
+        This patch utilizes topCallFrame to create a stack trace when
+        an error is thrown. Users will also be able to use the stack()
+        command in jsc to get arrays with stack trace information.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerLine):
+        (JSC::getSourceURLFromCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::throwException):
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::toString):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionJSCStack):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+
+2011-09-27  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Reorganize header files
+        https://bugs.webkit.org/show_bug.cgi?id=65616
+
+        Reviewed by Martin Robinson.
+
+        Install header files under $libwebkitgtkincludedir/JavaScriptCore.
+
+        * GNUmakefile.am: Use $libwebkitgtkincludedir.
+        * javascriptcoregtk.pc.in: Use webkitgtk-<api-version> as include dir.
+
+2011-09-26  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION (r95912): Conservative marking doesn't filter out pointers to
+        MarkedBlock metadata
+        https://bugs.webkit.org/show_bug.cgi?id=68860
+
+        Reviewed by Oliver Hunt.
+        
+        Bencher says no performance change, maybe a 7% speedup on kraken-imaging-darkroom.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isAtomAligned): Renamed atomMask to atomAlignment mask
+        because the mask doesn't produce the actual atom number.
+
+        (JSC::MarkedBlock::isLiveCell): Testing just for alignment isn't good
+        enough; we also need to test that a pointer is beyond the metadata section
+        of a MarkedBlock, to avoid treating random metadata as a JSCell.
+
+2011-09-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Make JSCell::toBoolean non-virtual
+        https://bugs.webkit.org/show_bug.cgi?id=67727
+
+        Reviewed by Geoffrey Garen.
+
+        JSCell::toBoolean now manually performs the toBoolean check for objects and strings (where 
+        before it was simply virtual and would crash if its implementation was called). 
+        Its descendants in JSObject and JSString have also been made non-virtual.  JSCell now
+        explicitly covers all cases of toBoolean, so having a virtual implementation of 
+        JSCell::toBoolean is no longer necessary.  This is part of a larger process of un-virtualizing JSCell.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        (JSC::JSCell::toBoolean):
+        (JSC::JSValue::toBoolean):
+
+2011-09-26  Chris Marrin  <cmarrin@apple.com>
+
+        Enable requestAnimationFrame on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=68397
+
+        Reviewed by Simon Fraser.
+
+        Enabled REQUEST_ANIMATION_FRAME_TIMER for Windows
+
+        * wtf/Platform.h:
+
+2011-09-26  Noel Gordon  <noel.gordon@gmail.com>
+
+        [Chromium] Remove DFGAliasTracker.h references from gyp project files
+        https://bugs.webkit.org/show_bug.cgi?id=68787
+
+        Reviewed by Geoffrey Garen.
+
+        DFG/DFGAliasTracker.h was removed in r95389.  Cleanup (remove) references
+        to that file from the gyp project files.
+
+        * JavaScriptCore.gypi:
+
+2011-09-26  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt]REGRESSION(r95865): It made 4 tests crash
+        https://bugs.webkit.org/show_bug.cgi?id=68780
+        
+        Reviewed by Oliver Hunt.
+
+        emitJumpSlowCaseIfNotJSCell(...) cannot be moved
+        away since the next load depends on it.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+
+2011-09-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add custom vtable struct to ClassInfo struct
+        https://bugs.webkit.org/show_bug.cgi?id=68567
+
+        Reviewed by Oliver Hunt.
+
+        Declared/defined the MethodTable struct and added it to the ClassInfo struct.
+        Also defined the CREATE_METHOD_TABLE macro to generate these method tables 
+        succinctly where they need to be defined.
+
+        Also added to it the first function to use this macro, visitChildren. 
+
+        This is part of the process of getting rid of all C++ virtual methods in JSCell.  
+        Eventually all virtual functions in JSCell that can't easily be converted to 
+        non-virtual functions will be put into this custom vtable structure.
+        * runtime/ClassInfo.h:
+
+        Added the CREATE_METHOD_TABLE macro call as the last argument to each of the 
+        ClassInfo structs declared in these classes.  This saves us from having to visit 
+        each s_info definition in the future when we add more methods to the MethodTable.
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObject.cpp:
+        * JavaScriptCore.exp:
+        * runtime/Arguments.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/BooleanObject.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateInstance.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/Executable.cpp:
+        * runtime/GetterSetter.cpp:
+        * runtime/InternalFunction.cpp:
+        * runtime/JSAPIValueWrapper.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSByteArray.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSString.cpp:
+        * runtime/MathObject.cpp:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/RegExp.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/ScopeChain.cpp:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/StringPrototype.cpp:
+        * runtime/Structure.cpp:
+        * runtime/StructureChain.cpp:
+
+        Had to make visitChildren and visitChildrenVirtual protected instead of private
+        because some of the subclasses of JSWrapperObject need access to JSWrapperObject's
+        visitChildren function pointer in their vtable since they don't provide their own
+        implementation. Same for RegExpObject.
+        * runtime/JSWrapperObject.h:
+        * runtime/RegExpObject.h:
+
+2011-09-25  Adam Barth  <abarth@webkit.org>
+
+        Finish removing PLATFORM(BREWMP) by removing associated code
+        https://bugs.webkit.org/show_bug.cgi?id=68779
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+        * wscript:
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocSize):
+        * wtf/Vector.h:
+        * wtf/brew: Removed.
+        * wtf/brew/MainThreadBrew.cpp: Removed.
+        * wtf/brew/OwnPtrBrew.cpp: Removed.
+        * wtf/brew/RefPtrBrew.h: Removed.
+        * wtf/brew/ShellBrew.h: Removed.
+        * wtf/brew/StringBrew.cpp: Removed.
+        * wtf/brew/SystemMallocBrew.h: Removed.
+        * wtf/unicode/brew: Removed.
+        * wtf/unicode/brew/UnicodeBrew.cpp: Removed.
+        * wtf/unicode/brew/UnicodeBrew.h: Removed.
+
+2011-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not count speculation successes correctly
+        https://bugs.webkit.org/show_bug.cgi?id=68785
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGOperations.cpp:
+
+2011-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG support for op_resolve_global is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=68786
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+
+2011-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG static prediction code is no longer needed and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=68784
+
+        Reviewed by Oliver Hunt.
+        
+        This gets rid of static prediction code, and ensures that we do not
+        try to compile code where dynamic predictions are not available.
+        This is accomplished by immediately performing an OSR exit wherever
+        a value is retrieved for which no predictions exist.
+        
+        This also adds value profiling for this on functions used for calls.
+        
+        The heuristics for deciding when to optimize code are also tweaked,
+        since it is now profitable to optimize sooner. This may need to be
+        tweaked further, but this patch only makes minimal changes.
+        
+        This results in a 16% speed-up on Kraken/ai-astar, leading to a 3%
+        overall win on Kraken.  It's neutral elsewhere.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/CodeBlock.h:
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        * bytecode/PredictedType.h:
+        (JSC::isCellPrediction):
+        (JSC::isObjectPrediction):
+        (JSC::isFinalObjectPrediction):
+        (JSC::isStringPrediction):
+        (JSC::isArrayPrediction):
+        (JSC::isInt32Prediction):
+        (JSC::isDoublePrediction):
+        (JSC::isNumberPrediction):
+        (JSC::isBooleanPrediction):
+        (JSC::mergePredictions):
+        * bytecode/PredictionTracker.h:
+        (JSC::PredictionTracker::predictArgument):
+        (JSC::PredictionTracker::predict):
+        (JSC::PredictionTracker::predictGlobalVar):
+        * bytecode/ValueProfile.cpp:
+        (JSC::ValueProfile::computeUpdatedPrediction):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::predictGlobalVar):
+        (JSC::DFG::Graph::getMethodCheckPrediction):
+        (JSC::DFG::Graph::getJSConstantPrediction):
+        (JSC::DFG::Graph::getPrediction):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::writeBarrier):
+        (JSC::DFG::JITCodeGenerator::emitBranch):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::getPrediction):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::valueOfJSConstantNode):
+        (JSC::DFG::Node::isInt32Constant):
+        (JSC::DFG::Node::isDoubleConstant):
+        (JSC::DFG::Node::isNumberConstant):
+        (JSC::DFG::Node::isBooleanConstant):
+        (JSC::DFG::Node::predict):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::Propagator):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::isPredictedNumerical):
+        (JSC::DFG::Propagator::logicalNotIsPure):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateInteger):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateNumber):
+        (JSC::DFG::SpeculativeJIT::shouldNotSpeculateInteger):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateFinalObject):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateArray):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateObject):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateCell):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2011-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT Construct opcode takes a this argument even though it's
+        not passed
+        https://bugs.webkit.org/show_bug.cgi?id=68782
+
+        Reviewed by Oliver Hunt.
+        
+        This is performance-neutral, mostly. It's a slight speed-up on
+        v8-splay.
+        
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCall):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+
+2011-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG tracking of the value in cachedResultRegister does not handle
+        op_mov correctly
+        https://bugs.webkit.org/show_bug.cgi?id=68781
+
+        Reviewed by Oliver Hunt.
+        
+        This takes the simplest approach: it makes the old JIT dumber rather
+        than making the DFG JIT smarter. This is performance-neutral.
+
+        * jit/JIT.h:
+        (JSC::JIT::canBeOptimized):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+
+2011-09-25  Adam Barth  <abarth@webkit.org>
+
+        Remove PLATFORM(HAIKU) and associated code
+        https://bugs.webkit.org/show_bug.cgi?id=68774
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+        * heap/MachineStackMarker.cpp:
+        * wtf/PageAllocation.h:
+        * wtf/Platform.h:
+        * wtf/StackBounds.cpp:
+        * wtf/haiku: Removed.
+        * wtf/haiku/MainThreadHaiku.cpp: Removed.
+        * wtf/haiku/StringHaiku.cpp: Removed.
+        * wtf/text/WTFString.h:
+
+2011-09-24  Adam Barth  <abarth@webkit.org>
+
+        Always enable ENABLE(OFFLINE_WEB_APPLICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=68767
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT implementation of put_by_val increments m_length instead of setting
+        it to index+1
+        https://bugs.webkit.org/show_bug.cgi?id=68766
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+
+2011-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        More build fixage.
+
+        * heap/ConservativeRoots.cpp: Our system of #includes, it is chaos.
+
+2011-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        The DFG should not attempt to guess types in the absence of value
+        profiles
+        https://bugs.webkit.org/show_bug.cgi?id=68677
+
+        Reviewed by Oliver Hunt.
+        
+        This adds the ForceOSRExit node, which is ignored by the propagator
+        and virtual register allocator (and hence ensuring that liveness analysis
+        works correctly), but forces terminateSpeculativeExecution() in the
+        back-end. This appears to be a slight speed-up on benchmark averages,
+        with ~5% swings on individual benchmarks, in both directions. But it's
+        never a regression on any average, and appears to be a ~1% progression
+        in the SunSpider average.
+        
+        This also adds a bit better debugging support in the old JIT and in DFG,
+        as this was necessary to debug the much more frequent OSR transitions
+        that occur with this change.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::getStrongPrediction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+
+2011-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Some Windows build fixage.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isLive): Show the compiler that all control paths
+        return a value. There, there, compiler. Everything's going to be OK.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::setVPtr): Oops! Unrename this function.
+
+2011-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Allocate new objects unmarked
+        https://bugs.webkit.org/show_bug.cgi?id=68764
+
+        Reviewed by Oliver Hunt.
+        
+        This is a pre-requisite to using the mark bit to determine object age.
+
+        ~2% v8 speedup, mostly due to a 12% v8-splay speedup.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isLive):
+        (JSC::MarkedBlock::isLiveCell): These two functions are the reason for
+        this patch. They can now determine object liveness without relying on
+        newly allocated objects having their mark bits set. Each MarkedBlock
+        now has a state variable that tells us how to determine whether its
+        cells are live. (This new state variable supercedes the old one about
+        destructor state. The rest of this patch is just refactoring to support
+        the invariants of this new state variable without introducing a
+        performance regression.)
+
+        (JSC::MarkedBlock::didConsumeFreeList): New function for updating interal
+        state when a block becomes fully allocated.
+
+        (JSC::MarkedBlock::clearMarks): Folded a state change to 'Marked' into
+        this function because, logically, clearing all mark bits is the first
+        step in saying "mark bits now exactly reflect object liveness".
+
+        (JSC::MarkedBlock::markCountIsZero): Renamed from isEmpty() to clarify
+        that this function only tells you about the mark bits, so it's only
+        meaningful if you've put the mark bits into a meaningful state before
+        calling it.
+
+        (JSC::MarkedBlock::forEachCell): Changed to use isLive() helper function
+        instead of testing mark bits, since mark bits are not always the right
+        way to find out if an object is live anymore. (New objects are live, but
+        not marked.)
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::recycle):
+        (JSC::MarkedBlock::MarkedBlock): Folded all initialization -- even
+        initialization when recycling an old block -- into the MarkedBlock
+        constructor, for simplicity.
+
+        (JSC::MarkedBlock::callDestructor): Inlined for speed. Always check for
+        a zapped cell before running a destructor, and always zap after
+        running a destructor. This does not seem to be expensive, and the
+        alternative just creates a too-confusing matrix of possible cell states
+        ((zombie undestructed cell + zombie destructed cell + zapped destructed
+        cell) * 5! permutations for progressing through block states = "Oh my!").
+
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep): Maintained and expanded a pre-existing
+        optimization to use template specialization to constant fold lots of
+        branches and elide certain operations entirely during a sweep. Merged
+        four or five functions that were logically about sweeping into this one
+        function pair, so there's only one way to do things now, it's
+        automatically correct, and it's always fast.
+
+        (JSC::MarkedBlock::zapFreeList): Renamed this function to be more explicit
+        about exactly what it does, and to honor the new block state system.
+
+        * heap/AllocationSpace.cpp:
+        (JSC::AllocationSpace::allocateBlock): Updated for rename.
+
+        (JSC::AllocationSpace::freeBlocks): Updated for changed interface.
+
+        (JSC::TakeIfUnmarked::TakeIfUnmarked):
+        (JSC::TakeIfUnmarked::operator()):
+        (JSC::TakeIfUnmarked::returnValue): Just like isEmpty() above, renamed
+        to clarify that this functor only tests the mark bits, so it's only
+        valid if you've put the mark bits into a meaningful state before
+        calling it.
+        
+        (JSC::AllocationSpace::shrink): Updated for rename.
+
+        * heap/AllocationSpace.h:
+        (JSC::AllocationSpace::canonicalizeCellLivenessData): Renamed to be a
+        little more specific about what we're making canonical.
+
+        (JSC::AllocationSpace::forEachCell): Updated for rename.
+
+        (JSC::AllocationSpace::forEachBlock): No need to canonicalize cell
+        liveness data before iterating blocks -- clients that want iterated
+        blocks to have valid cell lieveness data should make this call for
+        themselves. (And not all clients want it.)
+
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddPointer): Updated for rename. Removed
+        obsolete comment.
+
+        * heap/Heap.cpp:
+        (JSC::CountFunctor::ClearMarks::operator()): Removed call to notify...()
+        because clearMarks() now does that implicitly.
+
+        (JSC::Heap::destroy): Make sure to canonicalize before tear-down, since
+        tear-down tests cell liveness when running destructors.
+
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect): Moved weak reference harvesting out of markRoots()
+        and into collect, since it strictly depends on root marking, and does
+        not contribute to root marking.
+
+        (JSC::Heap::canonicalizeCellLivenessData): Renamed to be a little more
+        specific about what we're making canonical.
+
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell): No need to canonicalize cell liveness
+        data before iterating protected cells, since we know they're all live,
+        and don't need to test for it.
+
+        * heap/Local.h:
+        (JSC::::set): Can't make the same ASSERT we used to because we just don't
+        have the mark bits for it anymore. Perhaps we can bring this ASSERT back
+        in a weaker form in the future.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::addBlock):
+        (JSC::MarkedSpace::removeBlock): Updated for interface change.
+        (JSC::MarkedSpace::canonicalizeCellLivenessData): Renamed to be a little more
+        specific about what we're making canonical.
+
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::SizeClass::SizeClass):
+        (JSC::MarkedSpace::SizeClass::resetAllocator):
+        (JSC::MarkedSpace::SizeClass::zapFreeList): Simplified this allocator
+        functionality a bit. We now track only one block -- "currentBlock" --
+        and rely on its internal state to know whether it has more cells to
+        allocate.
+
+        * heap/Weak.h:
+        (JSC::Weak::set): Can't make the same ASSERT we used to because we just don't
+        have the mark bits for it anymore. Perhaps we can bring this ASSERT back
+        in a weaker form in the future.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::vptr):
+        (JSC::JSCell::zap):
+        (JSC::JSCell::isZapped):
+        (JSC::isZapped): Made zapping a property of JSCell, for a little abstraction.
+        In the future, exactly how a JSCell zaps itself will change, as the
+        internal representation of JSCell changes.
+
+2011-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should not eagerly initialize integer tags in the register file
+        https://bugs.webkit.org/show_bug.cgi?id=68763
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueRecovery::dump):
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueRecovery::alreadyInRegisterFileAsUnboxedInt32):
+        (JSC::DFG::OSRExit::operandForArgument):
+        (JSC::DFG::OSRExit::operandForIndex):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+
+2011-09-23  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Add JSVALUE32_64 support to DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=67460
+
+        Reviewed by Gavin Barraclough.
+
+        This is the initial attempt to add JSVALUE32_64 support to DFG JIT.
+        It's tested on IA32 Linux EFL port currently. It still cannot run
+        all the test cases and benchmarks so should be turned off now.
+        
+        The major work includes:
+        1) dealing with JSVALUE32_64 data format in DFG JIT;
+        2) bindings between 64-bit JS Value and 32-bit registers;
+        3) handling of function calls. Currently for DFG operation function
+        calls we follow the X86 cdecl calling convention on Linux, and the
+        implementation is in a naive way by pushing the arguments into stack
+        one by one.
+        
+        The known issues include:
+        1) some code duplicates unnecessarily, especially in Speculative JIT
+        code generation, where most of the operations on SpeculataInteger /
+        SpeculateDouble should be identical to the JSVALUE64 code. Refactoring
+        is needed in the future;
+        2) lack of op_call and op_construct support, comparing to current
+        JSVALUE64 DFG;
+        3) currently integer speculations assume to be StrictInt32;
+        4) lack of JSBoolean speculations;
+        5) boxing and unboxing doubles could be improved;
+        6) DFG X86 register description is different with the baseline JIT,
+        the timeoutCheckRegister is used for general purpose usage;
+        7) calls to runtime functions with primitive double parameters (e.g.
+        fmod) don't work. Support needs to be added to the assembler to
+        implement the mechanism of passing double parameters for X86 cdecl
+        convention.
+        
+        And there should be many other hidden bugs which should be exposed and
+        resolved in later debugging process.
+
+        * CMakeListsEfl.txt:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::loadDouble):
+        (JSC::MacroAssemblerX86::storeDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movsd_rm):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGFPRInfo.h:
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::GPRInfo::toRegister):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::needDataFormatConversion):
+        (JSC::DFG::GenerationInfo::initJSValue):
+        (JSC::DFG::GenerationInfo::initDouble):
+        (JSC::DFG::GenerationInfo::gpr):
+        (JSC::DFG::GenerationInfo::tagGPR):
+        (JSC::DFG::GenerationInfo::payloadGPR):
+        (JSC::DFG::GenerationInfo::fpr):
+        (JSC::DFG::GenerationInfo::fillJSValue):
+        (JSC::DFG::GenerationInfo::fillCell):
+        (JSC::DFG::GenerationInfo::fillDouble):
+        * dfg/DFGJITCodeGenerator.cpp:
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::allocate):
+        (JSC::DFG::JITCodeGenerator::use):
+        (JSC::DFG::JITCodeGenerator::registersMatched):
+        (JSC::DFG::JITCodeGenerator::silentSpillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillAllRegisters):
+        (JSC::DFG::JITCodeGenerator::silentFillAllRegisters):
+        (JSC::DFG::JITCodeGenerator::boxDouble):
+        (JSC::DFG::JITCodeGenerator::unboxDouble):
+        (JSC::DFG::JITCodeGenerator::spill):
+        (JSC::DFG::addressOfDoubleConstant):
+        (JSC::DFG::integerResult):
+        (JSC::DFG::jsValueResult):
+        (JSC::DFG::setupResults):
+        (JSC::DFG::callOperation):
+        (JSC::JSValueOperand::JSValueOperand):
+        (JSC::JSValueOperand::~JSValueOperand):
+        (JSC::JSValueOperand::isDouble):
+        (JSC::JSValueOperand::fill):
+        (JSC::JSValueOperand::tagGPR):
+        (JSC::JSValueOperand::payloadGPR):
+        (JSC::JSValueOperand::fpr):
+        (JSC::GPRTemporary::~GPRTemporary):
+        (JSC::GPRTemporary::gpr):
+        (JSC::GPRResult2::GPRResult2):
+        * dfg/DFGJITCodeGenerator32_64.cpp: Added.
+        (JSC::DFG::JITCodeGenerator::clearGenerationInfo):
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::fillStorage):
+        (JSC::DFG::JITCodeGenerator::useChildren):
+        (JSC::DFG::JITCodeGenerator::isStrictInt32):
+        (JSC::DFG::JITCodeGenerator::isKnownInteger):
+        (JSC::DFG::JITCodeGenerator::isKnownNumeric):
+        (JSC::DFG::JITCodeGenerator::isKnownCell):
+        (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
+        (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
+        (JSC::DFG::JITCodeGenerator::isKnownBoolean):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeArithMod):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCheckHasInstance):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeInstanceOf):
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::writeBarrier):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        (JSC::DFG::JITCodeGenerator::cachedGetMethod):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCompareNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeStrictEq):
+        (JSC::DFG::JITCodeGenerator::emitBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeLogicalNot):
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        (JSC::DFG::JITCodeGenerator::speculationCheck):
+        (JSC::DFG::dataFormatString):
+        (JSC::DFG::JITCodeGenerator::dump):
+        (JSC::DFG::JITCodeGenerator::checkConsistency):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::tagForGlobalVar):
+        (JSC::DFG::JITCompiler::payloadForGlobalVar):
+        (JSC::DFG::JITCompiler::appendCallWithExceptionCheck):
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant):
+        (JSC::DFG::JITCompiler::boxDouble):
+        (JSC::DFG::JITCompiler::unboxDouble):
+        (JSC::DFG::JITCompiler::addPropertyAccess):
+        (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
+        * dfg/DFGJITCompiler32_64.cpp: Added.
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        (JSC::DFG::JITCompiler::fillToJS):
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::jitAssertIsInt32):
+        (JSC::DFG::JITCompiler::jitAssertIsJSInt32):
+        (JSC::DFG::JITCompiler::jitAssertIsJSNumber):
+        (JSC::DFG::JITCompiler::jitAssertIsJSDouble):
+        (JSC::DFG::JITCompiler::jitAssertIsCell):
+        (JSC::DFG::JITCompiler::emitCount):
+        (JSC::DFG::JITCompiler::setSamplingFlag):
+        (JSC::DFG::JITCompiler::clearSamplingFlag):
+        * dfg/DFGJITCompilerInlineMethods.h: Added.
+        (JSC::DFG::JITCompiler::emitLoadTag):
+        (JSC::DFG::JITCompiler::emitLoadPayload):
+        (JSC::DFG::JITCompiler::emitLoad):
+        (JSC::DFG::JITCompiler::emitLoad2):
+        (JSC::DFG::JITCompiler::emitLoadDouble):
+        (JSC::DFG::JITCompiler::emitLoadInt32ToDouble):
+        (JSC::DFG::JITCompiler::emitStore):
+        (JSC::DFG::JITCompiler::emitStoreInt32):
+        (JSC::DFG::JITCompiler::emitStoreCell):
+        (JSC::DFG::JITCompiler::emitStoreBool):
+        (JSC::DFG::JITCompiler::emitStoreDouble):
+        * dfg/DFGNode.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryCachePutByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueRecovery::inGPR):
+        (JSC::DFG::ValueRecovery::inPair):
+        (JSC::DFG::ValueRecovery::tagGPR):
+        (JSC::DFG::ValueRecovery::payloadGPR):
+        * dfg/DFGSpeculativeJIT32_64.cpp: Added.
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::ValueRecovery::dump):
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::dump):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::convertToDouble):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::initializeVariableTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * runtime/JSValue.h:
+
+2011-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        wtf/BitVector.h has a variety of bugs which manifest when the
+        vector grows beyond 63 bits
+        https://bugs.webkit.org/show_bug.cgi?id=68746
+
+        Reviewed by Oliver Hunt.
+        
+        Out-of-lined slow path code in BitVector so that not every user
+        of CodeBlock ends up having to compile it. Fixed a variety of
+        index computation and size computation bugs.
+        
+        I have not seen these issues manifest themselves, but they are
+        blocking a patch that uses BitVector more aggressively.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/BitVector.cpp: Added.
+        (BitVector::BitVector):
+        (BitVector::operator=):
+        (BitVector::resize):
+        (BitVector::clearAll):
+        (BitVector::OutOfLineBits::create):
+        (BitVector::OutOfLineBits::destroy):
+        (BitVector::resizeOutOfLine):
+        * wtf/BitVector.h:
+        (WTF::BitVector::ensureSize):
+        (WTF::BitVector::get):
+        (WTF::BitVector::set):
+        (WTF::BitVector::clear):
+        (WTF::BitVector::byteCount):
+        (WTF::BitVector::OutOfLineBits::numWords):
+        (WTF::BitVector::OutOfLineBits::bits):
+        (WTF::BitVector::outOfLineBits):
+        * wtf/CMakeLists.txt:
+        * wtf/wtf.pri:
+
+2011-09-23  Adam Klein  <adamk@chromium.org>
+
+        Add ENABLE_MUTATION_OBSERVERS feature flag
+        https://bugs.webkit.org/show_bug.cgi?id=68732
+
+        Reviewed by Ojan Vafai.
+
+        This flag will guard an implementation of the "Mutation Observers" proposed in
+        http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/1622.html
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        De-virtualize JSCell::getJSNumber
+        https://bugs.webkit.org/show_bug.cgi?id=68651
+
+        Reviewed by Oliver Hunt.
+
+        Added a new JSType to check whether or not something is a 
+        NumberObject (which includes NumberPrototype) in TypeInfo::isNumberObject because there's not 
+        currently a better way to determine whether something is indeed a NumberObject.
+        Also de-virtualized JSCell::getJSNumber, having it check the TypeInfo 
+        for whether the object is a NumberObject or not.  This patch is part of 
+        the larger process of de-virtualizing JSCell.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::isNumberObject):
+        * runtime/JSValue.h:
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::getJSNumber):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::createStructure):
+
+2011-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Resolve opcodes should have value profiling.
+        https://bugs.webkit.org/show_bug.cgi?id=68723
+
+        Reviewed by Oliver Hunt.
+        
+        This adds value profiling to all forms of op_resolve in the
+        old JIT, and patches that information into the DFG along with
+        performing the appropriate type propagation.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::resolveGlobalDataIndex):
+        (JSC::DFG::Node::hasPrediction):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::callWithValueProfiling):
+
+2011-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-09-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Strict mode does not work in non-trivial nested functions.
+        https://bugs.webkit.org/show_bug.cgi?id=68740
+
+        Reviewed by Oliver Hunt.
+
+        Function-info caching does not preserve all state that it should.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::saveFunctionInfo):
+        (JSC::JSParser::Scope::restoreFunctionInfo):
+        (JSC::JSParser::parseFunctionInfo):
+        * parser/SourceProviderCacheItem.h:
+
+2011-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        ValueToDouble handling in prediction propagation should be ASSERT_NOT_REACHED
+        https://bugs.webkit.org/show_bug.cgi?id=68724
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+
+2011-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG implementation of PutScopedVar corrupts register allocation
+        https://bugs.webkit.org/show_bug.cgi?id=68735
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Make write barriers actually do something when enabled
+        https://bugs.webkit.org/show_bug.cgi?id=68717
+
+        Reviewed by Geoffrey Garen.
+
+        Add a basic card marking style write barrier to JSC (currently
+        turned off).  This requires two scratch registers in the JIT
+        so there was some register re-arranging to satisfy that requirement.
+        Happily this produced a minor perf bump in sunspider (~0.5%).
+
+        Turning the barriers on causes an overall regression of around 1.5%
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::store8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movb_i8m):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownNotCell):
+        (JSC::DFG::JITCodeGenerator::writeBarrier):
+        (JSC::DFG::JITCodeGenerator::markCellCard):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCachePutByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/CardSet.h: Added.
+        (JSC::CardSet::CardSet):
+        (JSC::::cardForAtom):
+        (JSC::::cardMarkedForAtom):
+        (JSC::::markCardForAtom):
+        * heap/Heap.cpp:
+        * heap/Heap.h:
+        (JSC::Heap::addressOfCardFor):
+        (JSC::Heap::writeBarrierFastCase):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::setDirtyObject):
+        (JSC::MarkedBlock::addressOfCardFor):
+        (JSC::MarkedBlock::offsetOfCards):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emitWriteBarrier):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_put_global_var):
+
+2011-09-23  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=68077
+        SH4 assemblers doesn't refer to executable memory handle.
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branch8):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::executableCopy):
+
+2011-09-23  Oliver Hunt  <oliver@apple.com>
+
+        PutScopedVar nodes should report that it has a var number
+        https://bugs.webkit.org/show_bug.cgi?id=68721
+
+        Reviewed by Anders Carlsson.
+
+        Another assertion fix.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasVarNumber):
+
+2011-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Add a bunch of unhandled node types to the propagator
+        https://bugs.webkit.org/show_bug.cgi?id=68716
+
+        Reviewed by Darin Adler.
+
+        Remove the ASSERT_NOT_REACHED() default for debug builds in the
+        prediction propagator, this way unhandled nodes will just cause
+        compile time failures rather than failing at some point in the
+        future.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+
+2011-09-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add static version of JSCell::visitChildren
+        https://bugs.webkit.org/show_bug.cgi?id=68404
+
+        Reviewed by Darin Adler.
+
+        In this patch we just extract the bodies of the virtual visitChildren methods
+        throughout the JSCell inheritance hierarchy out into static methods, which are 
+        now called from the virtual methods.  This is an intermediate step in trying to 
+        move the virtual-ness of visitChildren into our own custom vtable stored in 
+        ClassInfo.  We need to convert the methods to static methods in order to be 
+        able to more easily store and refer to them in our custom vtable since normal 
+        member methods store some implicit information in their types, making it 
+        impossible to store them generically in ClassInfo.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::visitChildrenVirtual):
+        (JSC::JSCallbackObject::visitChildren):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::visitChildrenVirtual):
+        (JSC::DebuggerActivation::visitChildren):
+        * debugger/DebuggerActivation.h:
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::visitChildren):
+        (JSC::SlotVisitor::drain):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildrenVirtual):
+        (JSC::Arguments::visitChildren):
+        * runtime/Arguments.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::visitChildrenVirtual):
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildrenVirtual):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildrenVirtual):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildrenVirtual):
+        (JSC::GetterSetter::visitChildren):
+        * runtime/GetterSetter.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildrenVirtual):
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildrenVirtual):
+        (JSC::JSArray::visitChildren):
+        * runtime/JSArray.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::visitChildrenVirtual):
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::visitChildrenVirtual):
+        (JSC::JSCell::visitChildren):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildrenVirtual):
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildrenVirtual):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildrenVirtual):
+        (JSC::JSObject::visitChildren):
+        * runtime/JSObject.h:
+        (JSC::JSObject::visitChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildrenVirtual):
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::visitChildrenVirtual):
+        (JSC::JSStaticScopeObject::visitChildren):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildrenVirtual):
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/JSWrapperObject.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildrenVirtual):
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildrenVirtual):
+        (JSC::RegExpObject::visitChildren):
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::visitChildrenVirtual):
+        (JSC::ScopeChainNode::visitChildren):
+        * runtime/ScopeChain.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildrenVirtual):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildrenVirtual):
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureChain.h:
+
+2011-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Node propagation doesn't handle PutScopedVar
+        https://bugs.webkit.org/show_bug.cgi?id=68713
+
+        Reviewed by Sam Weinig.
+
+        This was causing assertion failures.
+
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+
+2011-09-23  Anders Carlsson  <andersca@apple.com>
+
+        Make sure to define OVERRIDE and FINAL for older builds of clang.
+
+        * wtf/Compiler.h:
+
+2011-09-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement op_resolve_global in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=68704
+
+        Reviewed by Oliver Hunt.
+
+        This is performance neutral, but increases coverage.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::resolveInfoIndex):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-23  Mark Rowe  <mrowe@apple.com>
+
+        Define BUILDING_ON_LION / TARGETING_LION when appropriate in Platform.h.
+
+        * wtf/Platform.h:
+
+2011-09-22  Anders Carlsson  <andersca@apple.com>
+
+        We should add support for OVERRIDE and FINAL annotations
+        https://bugs.webkit.org/show_bug.cgi?id=68654
+
+        Reviewed by David Hyatt.
+
+        Add OVERRIDE and FINAL macros for compilers that support them.
+
+        * wtf/Compiler.h:
+
+2011-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        GetScopedVar should have value profiling
+        https://bugs.webkit.org/show_bug.cgi?id=68676
+
+        Reviewed by Oliver Hunt.
+        
+        Added GetScopedVar value profiling and predictin propagation.
+        Added GetScopeChain to CSE.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasPrediction):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::getScopeChainLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+
+2011-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        PPC build fix, part 3.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2011-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Another PPC build fix.
+
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+
+2011-09-22  Dean Jackson  <dino@apple.com>
+
+        Add ENABLE_CSS_FILTERS
+        https://bugs.webkit.org/show_bug.cgi?id=68652
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Incorrect this value passed to callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=68668
+
+        Reviewed by Oliver Hunt.
+
+        From Array/String prototype function.  Should be undefined, but
+        global object is passed instead (this is visible for strict callbacks).
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::sort):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2011-09-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Function.prototype.bind.length shoudl be 1.
+
+        Rubber stamped by Olier Hunt.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+
+2011-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        PPC build fix.
+
+        * bytecode/CodeBlock.h:
+
+2011-09-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt. 2
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-09-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix pt. 1
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not support to_primitive or strcat
+        https://bugs.webkit.org/show_bug.cgi?id=68582
+
+        Reviewed by Darin Adler.
+        
+        This adds functional support for to_primitive and strcat. It focuses
+        on minimizing the amount of code emitted on to_primitive (if we know
+        that it is a primitive or can speculate cheaply, then we omit the
+        slow path) and on keeping the implementation of strcat simple while
+        leveraging whatever optimizations we have already. In particular,
+        unlike the Call and Construct nodes which require extending the size
+        of the DFG's callee registers, StrCat takes advantage of the fact
+        that no JS code can run while StrCat is in progress and uses a
+        scratch buffer, rather than the register file, to store the list of
+        values to concatenate. This was done mainly to keep the code simple,
+        but there are probably other benefits to keeping call frame sizes
+        down. Essentially, this patch ensures that the presence of an
+        op_strcat does not mess up any other optimizations we might do while
+        ensuring that if you do execute it, it'll work about as well as you'd
+        expect.
+        
+        When combined with the previous patch for integer division, this is a
+        14% speed-up on Kraken. Without it, it would have been a 2% loss.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::callOperation):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        * dfg/DFGNode.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::scratchBufferForSize):
+
+2011-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should support integer division
+        https://bugs.webkit.org/show_bug.cgi?id=68597
+
+        Reviewed by Darin Adler.
+        
+        This adds support for ArithDiv speculating integer, and speculating
+        that the result is integer (i.e. remainder = 0).
+        
+        This is a 4% win on Kraken and a 1% loss on V8.
+
+        * bytecode/CodeBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArithNodeFlags):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+
+2011-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Implement put_scoped_var in the DFG jit
+        https://bugs.webkit.org/show_bug.cgi?id=68653
+
+        Reviewed by Gavin Barraclough.
+
+        Naive implementation of put_scoped_var.  Same story as the
+        get_scoped_var implementation, although I've hoisted scope
+        object acquisition into a separate dfg node.  Ideally in the
+        future we would reuse the resolved scope chain object, but
+        for now we don't.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasScopeChainDepth):
+        (JSC::DFG::Node::scopeChainDepth):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Implement Function.prototype.bind
+        https://bugs.webkit.org/show_bug.cgi?id=26382
+
+        Reviewed by Sam Weinig.
+
+        This patch provides a basic functional implementation
+        for Function.bind. It should (hopefully!) be fully
+        functionally correct, and the bound functions can be
+        called to quickly (since they are a subclass of
+        JSFunction, not InternalFunction), but we'll probably
+        want to follow up with some optimization work to keep
+        bound calls in JIT code.
+
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (GlobalObject::addFunction):
+        * runtime/CommonIdentifiers.h:
+        * runtime/ConstructData.h:
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::NativeExecutable):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncBind):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSBoundFunction.cpp: Added.
+        (JSC::boundFunctionCall):
+        (JSC::boundFunctionConstruct):
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::hasInstance):
+        (JSC::JSBoundFunction::getOwnPropertySlot):
+        (JSC::JSBoundFunction::getOwnPropertyDescriptor):
+        (JSC::JSBoundFunction::JSBoundFunction):
+        (JSC::JSBoundFunction::finishCreation):
+        * runtime/JSBoundFunction.h: Added.
+        (JSC::JSBoundFunction::targetFunction):
+        (JSC::JSBoundFunction::boundThis):
+        (JSC::JSBoundFunction::boundArgs):
+        (JSC::JSBoundFunction::createStructure):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::finishCreation):
+        (JSC::createDescriptorForThrowingProperty):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::boundFunctionStructure):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+
+2011-09-22  Oliver Hunt  <oliver@apple.com>
+
+        Implement get_scoped_var in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=68640
+
+        Reviewed by Gavin Barraclough.
+
+        Naive implementation of get_scoped_var in the DFG.  Essentially this
+        is the bare minimum required to get correct behaviour, so there's no
+        load/store coalescing or type profiling involved, even though these
+        would be wins.  No impact on SunSpider or V8.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasVarNumber):
+        (JSC::DFG::Node::hasScopeChainDepth):
+        (JSC::DFG::Node::scopeChainDepth):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-22  Adam Roben  <aroben@apple.com>
+
+        Remove FindSafari from all our .sln files
+
+        It isn't used anymore, so there's no point in building it.
+
+        Part of <http://webkit.org/b/68628> Remove FindSafari
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+
+2011-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        32-bit call code clobbers the function cell tag
+        https://bugs.webkit.org/show_bug.cgi?id=68606
+
+        Reviewed by Csaba Osztrogonác.
+        
+        This is a minimalistic fix: it simply emits code to restore the
+        cell tag on the slow path, if we know that we failed due to
+        emitCallIfNotType.
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+
+2011-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Add missing addPtr->add32 mapping for X86.
+
+        Rubber stamped by Sam Weinig.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+
+2011-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Add missing addDouble for AbsoluteAddress to X86
+
+        Rubber stamped by Geoff Garen.
+
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::addDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addsd_mr):
+        (JSC::X86Assembler::cvtsi2sd_rr):
+        (JSC::X86Assembler::cvtsi2sd_mr):
+
+2011-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix following fix for bug #68586.
+
+        * jit/JIT.cpp:
+        * jit/JITInlineMethods.h:
+
+2011-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should be able to compile op_throw
+        https://bugs.webkit.org/show_bug.cgi?id=68571
+
+        Reviewed by Geoffrey Garen.
+        
+        This compiles op_throw in the simplest way possible: it's an OSR
+        point back to the old JIT. This is a good step towards increasing
+        coverage, particularly on Kraken, but it's neutral because the
+        same functions that do throw also use some other unsupported
+        opcodes.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support continuous optimization
+        https://bugs.webkit.org/show_bug.cgi?id=68329
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds the ability to reoptimize a code block if speculation
+        failures happen frequently. 6% speed-up on Kraken, 1% slow-down
+        on V8, neutral on SunSpider.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getStrongPrediction):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        (JSC::DFG::getOSREntryDataBytecodeIndex):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::~ConservativeRoots):
+        (JSC::DummyMarkHook::mark):
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::genericAddSpan):
+        (JSC::ConservativeRoots::add):
+        * heap/ConservativeRoots.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::addJettisonCodeBlock):
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        * heap/JettisonedCodeBlocks.cpp: Added.
+        (JSC::JettisonedCodeBlocks::JettisonedCodeBlocks):
+        (JSC::JettisonedCodeBlocks::~JettisonedCodeBlocks):
+        (JSC::JettisonedCodeBlocks::addCodeBlock):
+        (JSC::JettisonedCodeBlocks::clearMarks):
+        (JSC::JettisonedCodeBlocks::deleteUnmarkedCodeBlocks):
+        (JSC::JettisonedCodeBlocks::traceCodeBlocks):
+        * heap/JettisonedCodeBlocks.h: Added.
+        (JSC::JettisonedCodeBlocks::mark):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+        (JSC::EvalExecutable::jettisonOptimizedCode):
+        (JSC::ProgramExecutable::jettisonOptimizedCode):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeForCall):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeForConstruct):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
+        * wtf/BitVector.h: Added.
+        (WTF::BitVector::BitVector):
+        (WTF::BitVector::~BitVector):
+        (WTF::BitVector::operator=):
+        (WTF::BitVector::size):
+        (WTF::BitVector::ensureSize):
+        (WTF::BitVector::resize):
+        (WTF::BitVector::clearAll):
+        (WTF::BitVector::get):
+        (WTF::BitVector::set):
+        (WTF::BitVector::clear):
+        (WTF::BitVector::bitsInPointer):
+        (WTF::BitVector::maxInlineBits):
+        (WTF::BitVector::byteCount):
+        (WTF::BitVector::makeInlineBits):
+        (WTF::BitVector::OutOfLineBits::numBits):
+        (WTF::BitVector::OutOfLineBits::numWords):
+        (WTF::BitVector::OutOfLineBits::bits):
+        (WTF::BitVector::OutOfLineBits::create):
+        (WTF::BitVector::OutOfLineBits::destroy):
+        (WTF::BitVector::OutOfLineBits::OutOfLineBits):
+        (WTF::BitVector::isInline):
+        (WTF::BitVector::outOfLineBits):
+        (WTF::BitVector::resizeOutOfLine):
+        (WTF::BitVector::bits):
+
+2011-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Add X86 GPRInfo for DFG JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=68586
+
+        Reviewed by Geoff Garen.
+
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::GPRInfo::toRegister):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+
+2011-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Should support value profiling on CPU(X86)
+        https://bugs.webkit.org/show_bug.cgi?id=68575
+
+        Reviewed by Sam Weinig.
+
+        Fix verbose profiling in ToT (SlowCaseProfile had been
+        partially renamed to RareCaseProfile), add in-memory
+        bucket counter for CPU(X86), move JIT::m_canBeOptimized
+        out of the DFG_JIT ifdef.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetRareCaseProfiles):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+
+2011-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG does not support compiling functions as constructors
+        https://bugs.webkit.org/show_bug.cgi?id=68500
+
+        Reviewed by Oliver Hunt.
+        
+        This adds support for compiling constructors to the DFG. It's a
+        1% speed-up on V8, mostly due to a 6% speed-up on early-boyer.
+        It's also a 13% win on access-binary-trees, but it's neutral in
+        the SunSpider and Kraken averages.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGNode.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::compileFor):
+        (JSC::FunctionExecutable::compileOptimizedFor):
+
+2011-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Replace jsFunctionVPtr compares with a type check on the Structure.
+        https://bugs.webkit.org/show_bug.cgi?id=68557
+
+        Reviewed by Oliver Hunt.
+
+        This will permit calls to still optimize to subclasses of JSFunction
+        that have the correct type (but a different C++ vptr).
+
+        This patch stops passing the globalData into numerous functions.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isFunctionConstant):
+        (JSC::DFG::Graph::valueOfFunctionConstant):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::isFunctionConstant):
+        (JSC::DFG::JITCompiler::valueOfFunctionConstant):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfNotType):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.h:
+        (JSC::isHostFunction):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        * runtime/JSObject.h:
+        (JSC::getJSFunction):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/JSType.h:
+
+2011-09-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed WTFTHREADDATA_MULTITHREADED, making it always true
+        https://bugs.webkit.org/show_bug.cgi?id=68549
+
+        Reviewed by Darin Adler.
+        
+        Another part of making threads exist in WebKit.
+
+        * wtf/WTFThreadData.cpp:
+        * wtf/WTFThreadData.h:
+        (WTF::wtfThreadData):
+
+2011-09-21  Dan Bernstein  <mitz@apple.com>
+
+        JavaScriptCore Part of: Prevent the WebKit frameworks from defining inappropriately-named Objective-C classes
+        https://bugs.webkit.org/show_bug.cgi?id=68451
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added a script build phase that invokes
+        check-for-inappropriate-objc-class-names, allowing only class names prefixed with "JS".
+
+2011-09-20  Gavin Barraclough  <barraclough@apple.com>
+
+        MacroAssembler fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=68494
+
+        Reviewed by Sam Weinig.
+
+        Add X86-64's 3 operand or32 to other MacroAssembler, fix load32's [const] void* mismatch
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::loadPtr):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::or32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::or32):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::or32):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::or32):
+        (JSC::MacroAssemblerSH4::load32):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::load32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::load32):
+
+2011-09-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Some Heap cleanup.
+
+        Reviewed by Beth Dakin.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::blessNewBlock): Removed blessNewBlockForSlowPath()
+        because it was unused; renamed blessNewBlockForFastPath() to blessNewBlock()
+        since there is only one now.
+
+        * heap/MarkedBlock.h: Removed ownerSet-related stuff since it was unused.
+        Updated mark bit overhead calculation. Deployed atomsPerBlock in one
+        place where we were recalculating it.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::addBlock): Updated for rename.
+
+2011-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT always speculates integer on modulo
+        https://bugs.webkit.org/show_bug.cgi?id=68485
+
+        Reviewed by Oliver Hunt.
+        
+        Added support for double modulo, which is a call to fmod().
+        Also added support for recording the old JIT's statistics
+        on op_mod and propagating them along the graph. Finally,
+        fixed a goof in the ArithNodeFlags propagation logic that
+        was made obvious when I started testing ArithMod.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArithNodeFlags):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-20  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [GTK] requestAnimationFrame support for gtk port
+        https://bugs.webkit.org/show_bug.cgi?id=66280
+
+        Reviewed by Martin Robinson.
+
+        Let GTK port use REQUEST_ANIMATION_FRAME_TIMER.
+
+        * wtf/Platform.h:
+
+2011-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT performs too many negative zero checks, and too many
+        overflow checks
+        https://bugs.webkit.org/show_bug.cgi?id=68430
+
+        Reviewed by Oliver Hunt.
+        
+        This adds comprehensive support for deciding how to perform an
+        arithmetic operations based on a combination of overflow profiling,
+        negative zero profiling, value profiling, and a static analysis of
+        how the results of these operations get used.
+        
+        This is a 72% speed-up on stanford-crypto-sha256-iterative, and a
+        2.5% speed-up on the Kraken average, a 1.4% speed-up on the V8
+        geomean, and neutral on SunSpider. It's also an 8.5% speed-up on
+        V8-crypto, because apparenty everything we do speeds up crypto.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::toNumber):
+        (JSC::DFG::ByteCodeParser::isSmallInt32Constant):
+        (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
+        (JSC::DFG::ByteCodeParser::weaklyPredictInt32):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
+        * dfg/DFGNode.h:
+        (JSC::DFG::nodeUsedAsNumber):
+        (JSC::DFG::nodeCanTruncateInteger):
+        (JSC::DFG::nodeCanIgnoreNegativeZero):
+        (JSC::DFG::nodeCanSpeculateInteger):
+        (JSC::DFG::arithNodeFlagsAsString):
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::hasArithNodeFlags):
+        (JSC::DFG::Node::rawArithNodeFlags):
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::arithNodeFlagsForCompare):
+        (JSC::DFG::Node::setArithNodeFlag):
+        (JSC::DFG::Node::mergeArithNodeFlags):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::isNotNegZero):
+        (JSC::DFG::Propagator::isNotZero):
+        (JSC::DFG::Propagator::propagateArithNodeFlags):
+        (JSC::DFG::Propagator::propagateArithNodeFlagsForward):
+        (JSC::DFG::Propagator::propagateArithNodeFlagsBackward):
+        (JSC::DFG::Propagator::propagateNodePredictions):
+        (JSC::DFG::Propagator::propagatePredictionsForward):
+        (JSC::DFG::Propagator::propagatePredictionsBackward):
+        (JSC::DFG::Propagator::toDouble):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::fixup):
+        (JSC::DFG::Propagator::startIndexForChildren):
+        (JSC::DFG::Propagator::endIndexForPureCSE):
+        (JSC::DFG::Propagator::pureCSE):
+        (JSC::DFG::Propagator::clobbersWorld):
+        (JSC::DFG::Propagator::setReplacement):
+        (JSC::DFG::Propagator::performNodeCSE):
+        (JSC::DFG::Propagator::localCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+
+2011-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Refactor Heap allocation logic into separate AllocationSpace class
+        https://bugs.webkit.org/show_bug.cgi?id=68409
+
+        Reviewed by Gavin Barraclough.
+
+        This patch hoists direct manipulation of the MarkedSpace and related
+        data out of Heap and into a separate class.  This will allow us to
+        have multiple allocation spaces in future, so easing the way towards
+        having GC'd backing stores for objects.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * heap/AllocationSpace.cpp: Added.
+        (JSC::AllocationSpace::tryAllocate):
+        (JSC::AllocationSpace::allocateSlowCase):
+        (JSC::AllocationSpace::allocateBlock):
+        (JSC::AllocationSpace::freeBlocks):
+        (JSC::TakeIfEmpty::TakeIfEmpty):
+        (JSC::TakeIfEmpty::operator()):
+        (JSC::TakeIfEmpty::returnValue):
+        (JSC::AllocationSpace::shrink):
+        * heap/AllocationSpace.h: Added.
+        (JSC::AllocationSpace::AllocationSpace):
+        (JSC::AllocationSpace::blocks):
+        (JSC::AllocationSpace::sizeClassFor):
+        (JSC::AllocationSpace::setHighWaterMark):
+        (JSC::AllocationSpace::highWaterMark):
+        (JSC::AllocationSpace::canonicalizeBlocks):
+        (JSC::AllocationSpace::resetAllocator):
+        (JSC::AllocationSpace::forEachCell):
+        (JSC::AllocationSpace::forEachBlock):
+        (JSC::AllocationSpace::allocate):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportExtraMemoryCostSlowCase):
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::clearMarks):
+        (JSC::Heap::sweep):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::objectTypeCounts):
+        (JSC::Heap::collect):
+        (JSC::Heap::canonicalizeBlocks):
+        (JSC::Heap::resetAllocator):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrink):
+        * heap/Heap.h:
+        (JSC::Heap::objectSpace):
+        (JSC::Heap::sizeClassForObject):
+        (JSC::Heap::allocate):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+        (JSC::JSGlobalData::releaseExecutableMemory):
+
+2011-09-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed BREWMP* platform #ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=68425
+        
+        BREWMP* has no maintainer, and this is dead code.
+
+        Reviewed by Darin Adler.
+
+        * heap/MarkStack.h:
+        (JSC::::shrinkAllocation):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/CurrentTime.cpp:
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastMallocSize):
+        * wtf/FastMalloc.h:
+        * wtf/MainThread.cpp:
+        * wtf/MathExtras.h:
+        * wtf/OwnPtrCommon.h:
+        * wtf/Platform.h:
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/text/WTFString.h:
+        * wtf/unicode/Unicode.h:
+
+2011-09-20  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r95523
+
+        * wtf/CheckedArithmetic.h: Added stdint.h so we can have int64_t defined.
+
+2011-09-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not speculate aggressively enough on GetById
+        https://bugs.webkit.org/show_bug.cgi?id=68320
+
+        Reviewed by Oliver Hunt.
+        
+        This adds the ability to access properties directly, by offset.
+        This optimization kicks in when at the time of DFG compilation,
+        it appears that the given get_by_id is self-cached by the old JIT.
+        Two new opcodes get introduced: CheckStructure and GetByOffset.
+        CheckStructure performs a speculation check on the object's
+        structure, and returns the storage pointer. GetByOffset performs
+        a direct read of the field from the storage pointer. Both
+        CheckStructure and GetByOffset can be CSE'd, so that we can
+        eliminate redundant structure checks, and redundant reads of the
+        same field.
+        
+        This is a 4% speed-up on V8, a 2% slow-down on Kraken, and
+        neutral on SunSpider.
+
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionFromClassInfo):
+        (JSC::predictionFromStructure):
+        (JSC::predictionFromCell):
+        * bytecode/PredictedType.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::dataFormatToString):
+        (JSC::DFG::needDataFormatConversion):
+        (JSC::DFG::GenerationInfo::initStorage):
+        (JSC::DFG::GenerationInfo::spill):
+        (JSC::DFG::GenerationInfo::fillStorage):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::getPrediction):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::fillStorage):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentSpillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::spill):
+        (JSC::DFG::JITCodeGenerator::storageResult):
+        (JSC::DFG::StorageOperand::StorageOperand):
+        (JSC::DFG::StorageOperand::~StorageOperand):
+        (JSC::DFG::StorageOperand::index):
+        (JSC::DFG::StorageOperand::gpr):
+        (JSC::DFG::StorageOperand::use):
+        * dfg/DFGNode.h:
+        (JSC::DFG::OpInfo::OpInfo):
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::hasPrediction):
+        (JSC::DFG::Node::hasStructure):
+        (JSC::DFG::Node::structure):
+        (JSC::DFG::Node::hasStorageAccessData):
+        (JSC::DFG::Node::storageAccessDataIndex):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNode):
+        (JSC::DFG::Propagator::globalVarLoadElimination):
+        (JSC::DFG::Propagator::getMethodLoadElimination):
+        (JSC::DFG::Propagator::checkStructureLoadElimination):
+        (JSC::DFG::Propagator::getByOffsetLoadElimination):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * wtf/StdLibExtras.h:
+        (WTF::safeCast):
+
+2011-09-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove toPrimitive from JSCell
+        https://bugs.webkit.org/show_bug.cgi?id=67875
+
+        Reviewed by Darin Adler.
+
+        Part of the refactoring process to un-virtualize JSCell.  We move 
+        all of the implicit functionality provided by the virtual toPrimitive method 
+        in JSCell to be explicit in JSValue::toPrimitive and JSCell:toPrimitive while 
+        also de-virtualizing JSCell::toPrimitive.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toPrimitive):
+        * runtime/JSCell.h:
+
+        We replace JSNotAnObject::toPrimitive with defaultValue, which it overrides from 
+        JSObject.  This pushes the virtual method further down, enabling us to get rid 
+        of the virtual call in JSCell.  Eventually we'll probably have to deal with this
+        again, but we'll cross that bridge when we come to it.
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::defaultValue):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+
+2011-09-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed ENABLE_LAZY_BLOCK_FREEING and related #ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=68424
+
+        As discussed on webkit-dev. All ports build with threads enabled in JSC now.
+        
+        This may break WinCE and other ports that have not built and tested with
+        this configuration. I've filed bugs for port maintainers. It's time for
+        WebKit to move forward.
+
+        Reviewed by Mark Rowe.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::blockFreeingThreadMain):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::releaseFreeBlocks):
+        * heap/Heap.h:
+        * wtf/Platform.h:
+
+2011-09-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed ENABLE_WTF_MULTIPLE_THREADS and related #ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=68423
+
+        As discussed on webkit-dev. All ports build with threads enabled in WTF now.
+        
+        This may break WinCE and other ports that have not built and tested with
+        this configuration. I've filed bugs for port maintainers. It's time for
+        WebKit to move forward.
+
+        Reviewed by Mark Rowe.
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
+        * wtf/FastMalloc.cpp:
+        * wtf/Platform.h:
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RefCountedLeakCounter.cpp:
+        (WTF::RefCountedLeakCounter::increment):
+        (WTF::RefCountedLeakCounter::decrement):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeThreading):
+        * wtf/dtoa.cpp:
+        (WTF::pow5mult):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeThreading):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeThreading):
+
+2011-09-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed ENABLE_JSC_MULTIPLE_THREADS and related #ifdefs.
+        https://bugs.webkit.org/show_bug.cgi?id=68422
+        
+        As discussed on webkit-dev. All ports build with threads enabled in JSC now.
+        
+        This may break WinCE and other ports that have not built and tested with
+        this configuration. I've filed bugs for port maintainers. It's time for
+        WebKit to move forward.
+
+        Reviewed by Sam Weinig.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        * API/JSContextRef.cpp:
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * heap/MachineStackMarker.h:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        (JSC::initializeThreading):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::makeUsableFromMultipleThreads):
+        * runtime/JSLock.cpp:
+        * runtime/Structure.cpp:
+        * wtf/Platform.h:
+
+2011-09-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r95493 and r95496.
+        http://trac.webkit.org/changeset/95493
+        http://trac.webkit.org/changeset/95496
+        https://bugs.webkit.org/show_bug.cgi?id=68418
+
+        Broke Windows build (Requested by rniwa on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * heap/AllocationSpace.cpp: Removed.
+        * heap/AllocationSpace.h: Removed.
+        * heap/Heap.cpp:
+        (JSC::CountFunctor::TakeIfEmpty::TakeIfEmpty):
+        (JSC::CountFunctor::TakeIfEmpty::operator()):
+        (JSC::CountFunctor::TakeIfEmpty::returnValue):
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportExtraMemoryCostSlowCase):
+        (JSC::Heap::tryAllocate):
+        (JSC::Heap::allocateSlowCase):
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::clearMarks):
+        (JSC::Heap::sweep):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::objectTypeCounts):
+        (JSC::Heap::collect):
+        (JSC::Heap::canonicalizeBlocks):
+        (JSC::Heap::resetAllocator):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrink):
+        * heap/Heap.h:
+        (JSC::Heap::markedSpace):
+        (JSC::Heap::forEachCell):
+        (JSC::Heap::forEachBlock):
+        (JSC::Heap::sizeClassFor):
+        (JSC::Heap::allocate):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+        (JSC::JSGlobalData::releaseExecutableMemory):
+
+2011-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Errrk, missed stylebot comments in last commit.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
+
+2011-09-19  Gavin Barraclough  <barraclough@apple.com>
+
+        String#split is buggy
+        https://bugs.webkit.org/show_bug.cgi?id=68348
+
+        Reviewed by Sam Weinig.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsStringWithReuse):
+            - added helper function to reuse original JSString value.
+        (JSC::stringProtoFuncSplit):
+            - Rewritten from the spec.
+        * tests/mozilla/ecma/String/15.5.4.8-2.js:
+        (getTestCases):
+            - This test is not ES5 compliant.
+
+2011-09-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed lots of friend declarations from JSCell, so we can more
+        effectively make use of private and protected.
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSCell.h: Removed MSVCBugWorkaround because it was a lot of
+        confusion for not much safety.
+        (JSC::JSCell::operator new): Made this public because it is used by a
+        few clients, and not really dangerous.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::createInheritorID):
+        (JSC::JSObject::allocatePropertyStorage):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::hasCustomProperties):
+        (JSC::JSObject::hasGetterSetterProperties):
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::isExtensible):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::finishCreation):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSCell::fastGetOwnProperty):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        (JSC::JSObject::visitChildrenDirect): Changed all use of m_structure to
+        structure() / setStructure(), so we don't have to be a friend of JSCell.
+
+        * runtime/Structure.h:
+        (JSC::JSCell::setStructure): Added, to avoid direct access by JSObject
+        to JSCell::m_structure.
+
+2011-09-19  Adam Barth  <abarth@webkit.org>
+
+        Always enable ENABLE(EVENTSOURCE)
+        https://bugs.webkit.org/show_bug.cgi?id=68414
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-19  Eli Fidler  <efidler@rim.com>
+
+        Enable JSC_MULTIPLE_THREADS for OS(QNX).
+        https://bugs.webkit.org/show_bug.cgi?id=68047
+
+        Reviewed by Daniel Bates.
+
+        SA_RESTART was required for SIGUSR2-based debugging, but is not
+        present on QNX. This debugging doesn't seem critical to
+        JSC_MULTIPLE_THREADS, so allow it to proceed.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        (JSC::freePlatformThreadRegisters):
+        * wtf/Platform.h: enable PTHREADS for OS(QNX)
+
+2011-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Refactor Heap allocation logic into separate AllocationSpace class
+        https://bugs.webkit.org/show_bug.cgi?id=68409
+
+        Reviewed by Gavin Barraclough.
+
+        This patch hoists direct manipulation of the MarkedSpace and related
+        data out of Heap and into a separate class.  This will allow us to
+        have multiple allocation spaces in future, so easing the way towards
+        having GC'd backing stores for objects.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * heap/AllocationSpace.cpp: Added.
+        (JSC::AllocationSpace::tryAllocate):
+        (JSC::AllocationSpace::allocateSlowCase):
+        (JSC::AllocationSpace::allocateBlock):
+        (JSC::AllocationSpace::freeBlocks):
+        (JSC::TakeIfEmpty::TakeIfEmpty):
+        (JSC::TakeIfEmpty::operator()):
+        (JSC::TakeIfEmpty::returnValue):
+        (JSC::AllocationSpace::shrink):
+        * heap/AllocationSpace.h: Added.
+        (JSC::AllocationSpace::AllocationSpace):
+        (JSC::AllocationSpace::blocks):
+        (JSC::AllocationSpace::sizeClassFor):
+        (JSC::AllocationSpace::setHighWaterMark):
+        (JSC::AllocationSpace::highWaterMark):
+        (JSC::AllocationSpace::canonicalizeBlocks):
+        (JSC::AllocationSpace::resetAllocator):
+        (JSC::AllocationSpace::forEachCell):
+        (JSC::AllocationSpace::forEachBlock):
+        (JSC::AllocationSpace::allocate):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportExtraMemoryCostSlowCase):
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::clearMarks):
+        (JSC::Heap::sweep):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::objectTypeCounts):
+        (JSC::Heap::collect):
+        (JSC::Heap::canonicalizeBlocks):
+        (JSC::Heap::resetAllocator):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrink):
+        * heap/Heap.h:
+        (JSC::Heap::objectSpace):
+        (JSC::Heap::sizeClassForObject):
+        (JSC::Heap::allocate):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+        (JSC::JSGlobalData::releaseExecutableMemory):
+
+2011-09-19  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r95310
+
+        * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added
+        include\private\JavaScriptCore to the include path so DFGIntrinsic.h can be found.
+
+2011-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculation failures should act as additional value profiles
+        https://bugs.webkit.org/show_bug.cgi?id=68335
+
+        Reviewed by Oliver Hunt.
+        
+        This adds slow-case counters to the old JIT. It also ensures that
+        negative zero in multiply is handled carefully. The old JIT
+        previously took slow path if the result of a multiply was zero,
+        which, without any changes, would cause the DFG to think that
+        every such multiply produced a double result.
+        
+        This also fixes a bug in the old JIT's handling of decrements. It
+        would take the slow path if the result was zero, but not if it
+        underflowed.
+        
+        By itself, this would be a 1% slow-down on V8 and Kraken. But then
+        I wrote optimizations in the DFG that take advantage of this new
+        information. It's no longer the case that every multiply needs to
+        do a check for negative zero; it only happens if the negative
+        zero is ignored.
+        
+        This results in a 12% speed-up on v8-crypto, for a 1.4% geomean
+        speed-up in V8. It's mostly neutral on Kraken. I can see an
+        0.5% slow-down and it appears to be significant.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetRareCaseProfiles):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/CodeBlock.h:
+        * bytecode/ValueProfile.h:
+        (JSC::RareCaseProfile::RareCaseProfile):
+        (JSC::getRareCaseProfileBytecodeOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNode):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::clobbersWorld):
+        (JSC::DFG::Propagator::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::linkDummySlowCase):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::addSlowCase):
+
+2011-09-19  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r94575
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Relinearized project dependencies. testRegExp
+        now builds just before FindSafari.
+
+2011-09-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r95466.
+        http://trac.webkit.org/changeset/95466
+        https://bugs.webkit.org/show_bug.cgi?id=68389
+
+        Incorrect version of the patch. (Requested by mhahnenberg on
+        #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toPrimitive):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toPrimitive):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+
+2011-09-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove toPrimitive from JSCell
+        https://bugs.webkit.org/show_bug.cgi?id=67875
+
+        Reviewed by Geoffrey Garen.
+
+        Part of the refactoring process to un-virtualize JSCell.  We move 
+        all of the implicit functionality provided by the virtual toPrimitive method 
+        in JSCell to be explicit in JSValue::toPrimitive and JSCell:toPrimitive while 
+        also de-virtualizing JSCell::toPrimitive.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toPrimitive):
+        * runtime/JSCell.h:
+
+        We replace JSNotAnObject::toPrimitive with defaultValue, which it overrides from 
+        JSObject.  This pushes the virtual method further down, enabling us to get rid 
+        of the virtual call in JSCell.  Eventually we'll probably have to deal with this
+        again, but we'll cross that bridge when we come to it.
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::defaultValue):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        (JSC::JSValue::toPrimitive):
+
+2011-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+
+2011-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Rename NewSpace.{h,cpp} to MarkedSpace.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=68376
+
+        Reviewed by Gavin Barraclough.
+
+        Renamed the the MarkedSpace files to match new name, and
+        updated the relevant references.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.h:
+        * heap/MarkedSpace.cpp: Renamed from Source/JavaScriptCore/heap/NewSpace.cpp.
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::addBlock):
+        (JSC::MarkedSpace::removeBlock):
+        (JSC::MarkedSpace::resetAllocator):
+        (JSC::MarkedSpace::canonicalizeBlocks):
+        * heap/MarkedSpace.h: Renamed from Source/JavaScriptCore/heap/NewSpace.h.
+        (JSC::MarkedSpace::waterMark):
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark):
+        (JSC::MarkedSpace::sizeClassFor):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::SizeClass::SizeClass):
+        (JSC::MarkedSpace::SizeClass::resetAllocator):
+        (JSC::MarkedSpace::SizeClass::canonicalizeBlock):
+        * runtime/JSCell.h:
+
+2011-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Rename NewSpace to MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=68375
+
+        Reviewed by Gavin Barraclough.
+
+        Rename NewSpace to a more accurate name, and update all uses.
+        This patch doesn't rename the files themselves as that will
+        just make the patch appear bigger than it is.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/Heap.cpp:
+        (JSC::CountFunctor::TakeIfEmpty::TakeIfEmpty):
+        (JSC::CountFunctor::TakeIfEmpty::operator()):
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportExtraMemoryCostSlowCase):
+        (JSC::Heap::tryAllocate):
+        (JSC::Heap::allocateSlowCase):
+        (JSC::Heap::collect):
+        (JSC::Heap::canonicalizeBlocks):
+        (JSC::Heap::resetAllocator):
+        (JSC::Heap::isValidAllocation):
+        (JSC::Heap::shrink):
+        * heap/Heap.h:
+        (JSC::Heap::markedSpace):
+        (JSC::Heap::sizeClassFor):
+        (JSC::Heap::allocate):
+        * heap/NewSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::addBlock):
+        (JSC::MarkedSpace::removeBlock):
+        (JSC::MarkedSpace::resetAllocator):
+        (JSC::MarkedSpace::canonicalizeBlocks):
+        * heap/NewSpace.h:
+        (JSC::MarkedSpace::waterMark):
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark):
+        (JSC::MarkedSpace::sizeClassFor):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::SizeClass::SizeClass):
+        (JSC::MarkedSpace::SizeClass::resetAllocator):
+        (JSC::MarkedSpace::SizeClass::canonicalizeBlock):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+
+2011-09-19  Peter Rybin  <peter.rybin@gmail.com>
+
+        TextPosition refactoring: Merge ZeroBasedNumber and OneBasedNumber classes
+        https://bugs.webkit.org/show_bug.cgi?id=63541
+
+        Reviewed by Adam Barth.
+
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::startPosition):
+        * wtf/text/TextPosition.h:
+        (WTF::OrdinalNumber::fromZeroBasedInt):
+        (WTF::OrdinalNumber::fromOneBasedInt):
+        (WTF::OrdinalNumber::OrdinalNumber):
+        (WTF::OrdinalNumber::zeroBasedInt):
+        (WTF::OrdinalNumber::oneBasedInt):
+        (WTF::OrdinalNumber::operator==):
+        (WTF::OrdinalNumber::operator!=):
+        (WTF::OrdinalNumber::first):
+        (WTF::OrdinalNumber::beforeFirst):
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+
+2011-09-19  Dan Bernstein  <mitz@apple.com>
+
+        JavaScriptCore part of [mac] WebKit contains Objective-C classes that are not prefixed with its standard prefixes
+        https://bugs.webkit.org/show_bug.cgi?id=68323
+
+        Reviewed by Sam Weinig.
+
+        Renamed WTFMainThreadCaller to JSWTFMainThreadCaller.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::initializeMainThreadPlatform):
+        (WTF::initializeMainThreadToProcessMainThreadPlatform):
+
+2011-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Remove direct property slot pointers from the instruction stream
+        https://bugs.webkit.org/show_bug.cgi?id=68373
+
+        Reviewed by Gavin Barraclough.
+
+        Use an indirect load to access prototype properties rather than directly
+        storing the property address in the instruction stream.  This should allow
+        further optimisations in future, and also provides a 0.5% win to sunspider.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        * runtime/JSObject.h:
+        (JSC::JSObject::addressOfPropertyStorage):
+
+2011-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Remove bump allocator
+        https://bugs.webkit.org/show_bug.cgi?id=68370
+
+        Reviewed by Sam Weinig.
+
+        Can't do anything with this allocator currently, and it's
+        increasing the complexity of the GC code.  Slight progression
+        on SunSpider, slight regression (undoing the original progression)
+        in V8.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/NewSpace.cpp:
+        (JSC::NewSpace::NewSpace):
+        * heap/NewSpace.h:
+        (JSC::NewSpace::allocate):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::visitChildrenDirect):
+        * runtime/StorageBarrier.h:
+        (JSC::StorageBarrier::set):
+
+2011-09-19  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Fix distcheck build
+        https://bugs.webkit.org/show_bug.cgi?id=68346
+
+        Reviewed by Philippe Normand.
+
+        * GNUmakefile.list.am:
+
+2011-09-19  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Fix distcheck build
+        https://bugs.webkit.org/show_bug.cgi?id=68241
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.list.am:
+
+2011-09-18  Dan Bernstein  <mitz@apple.com>
+
+        Removed ProfilerServer.
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/ProfilerServer.h: Removed.
+        * profiler/ProfilerServer.mm: Removed.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * wscript:
+
+2011-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should inline Math.min, Math.max, and Math.sqrt
+        https://bugs.webkit.org/show_bug.cgi?id=68318
+
+        Reviewed by Gavin Barraclough.
+        
+        Adds Math.min, Math.max, and Math.sqrt intrinsics. Adds support for
+        a function to have an intrinsic but not a thunk generator. This is
+        a 7% speed-up on access-nbody, and neutral elsewhere, mainly because
+        we're still not DFG compiling the bulk of the hot code in Kraken audio
+        benchmarks.
+
+        * create_hash_table:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGIntrinsic.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNode):
+        (JSC::DFG::Propagator::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+
+2011-09-18  Nico Weber  <thakis@chromium.org>
+
+        Remove two files from JavaScriptCore.gypi that were removed in r95240
+        https://bugs.webkit.org/show_bug.cgi?id=68327
+
+        Unreviewed, build warning fix.
+
+        * JavaScriptCore.gypi:
+
+2011-09-17  Oliver Hunt  <oliver@apple.com>
+
+        Remove special case handling of inline storage from the JIT
+        https://bugs.webkit.org/show_bug.cgi?id=68319
+
+        Reviewed by Gavin Barraclough.
+
+        Simplify logic used for reading and writing to property storage
+        by removing the special cases for inline storage.  This has no
+        perf impact.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryBuildGetByIDList):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+
+2011-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not have full block-local CSE
+        https://bugs.webkit.org/show_bug.cgi?id=68316
+
+        Reviewed by Oliver Hunt.
+        
+        This adds block-local CSE to the DFG. CSE runs in the propagator just after
+        type propagation. It is part of the propagator itself because it needs to
+        use the propagator's internal data structures to determine which operations
+        may have side effects. Because it changes the live-ranges of nodes, the
+        virtual register allocator had to be moved into the propagator so that it
+        runs after CSE. To ensure that the back-end knows to keep the inputs to
+        any eliminated node alive for OSR, a new node type, Phantom, was introduced.
+        It is a no-op but prolonges the live-range of its inputs.
+        
+        This is an 80% speed-up on imaging-gaussian-blur, and a 10% speed-up on
+        Kraken.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAliasTracker.h: Removed.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::MethodCheckData::operator==):
+        (JSC::DFG::MethodCheckData::operator!=):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasVirtualRegister):
+        (JSC::DFG::Node::setRefCount):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::Propagator):
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::propagateNode):
+        (JSC::DFG::Propagator::canonicalize):
+        (JSC::DFG::Propagator::computeStartIndex):
+        (JSC::DFG::Propagator::startIndex):
+        (JSC::DFG::Propagator::pureCSE):
+        (JSC::DFG::Propagator::globalVarLoadElimination):
+        (JSC::DFG::Propagator::getByValLoadElimination):
+        (JSC::DFG::Propagator::getMethodLoadElimination):
+        (JSC::DFG::Propagator::performSubstitution):
+        (JSC::DFG::Propagator::setReplacement):
+        (JSC::DFG::Propagator::performNodeCSE):
+        (JSC::DFG::Propagator::performBlockCSE):
+        (JSC::DFG::Propagator::localCSE):
+        (JSC::DFG::Propagator::allocateVirtualRegisters):
+        (JSC::DFG::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        method_check should repatch itself if it finds that the new structure(s)
+        are the result of transitions from the old structure(s)
+        https://bugs.webkit.org/show_bug.cgi?id=68294
+
+        Reviewed by Gavin Barraclough.
+        
+        Previously a patched method_check would slow-path to get_by_id. Now it
+        slow-paths to method_check_update, which attempts to correct the
+        method_check due to structure transitions before bailing to get_by_id.
+        
+        This is a 1-2% speed-up on some benchmarks and is not a slow-down
+        anywhere, leading to a 0.6% speed-up on the Kraken geomean.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * runtime/Structure.h:
+        (JSC::Structure::transitivelyTransitionedFrom):
+
+2011-09-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Touch Platform.h in the hope to fix SnowLeopard Intel Release (WebKit2 Tests).
+
+        * wtf/Platform.h:
+
+2011-09-16  Sam Weinig  <sam@webkit.org>
+
+        Rename APIValueWrapper type to APIValueWrapperType for consistency
+        https://bugs.webkit.org/show_bug.cgi?id=68306
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        Update name.
+
+        * runtime/JSType.h:
+        Update name and un-indent.
+
+        * runtime/Structure.h:
+        (JSC::JSCell::isAPIValueWrapper):
+        Update name.
+
+2011-09-16  Sam Weinig  <sam@webkit.org>
+
+        Remove unused isStrictModeFunction function
+        https://bugs.webkit.org/show_bug.cgi?id=68305
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::isStrictModeFunction):
+
+2011-09-16  Sam Weinig  <sam@webkit.org>
+
+        Cleanup JSTypeInfo a bit
+        https://bugs.webkit.org/show_bug.cgi?id=68289
+
+        Reviewed by Anders Carlsson.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        Replace direct access to flags() with predicate.
+
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::createStructure):
+        Pass FinalObjectType instead of using special IsJSFinalObject.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        Add additional assert that you should no object should OverridesHasInstance but not have ImplementsHasInstance set.
+
+        (JSC::TypeInfo::isFinalObject):
+        Added.
+
+        (JSC::TypeInfo::masqueradesAsUndefined):
+        (JSC::TypeInfo::implementsHasInstance):
+        (JSC::TypeInfo::isEnvironmentRecord):
+        (JSC::TypeInfo::overridesHasInstance):
+        (JSC::TypeInfo::implementsDefaultHasInstance):
+        (JSC::TypeInfo::overridesGetOwnPropertySlot):
+        (JSC::TypeInfo::overridesVisitChildren):
+        (JSC::TypeInfo::overridesGetPropertyNames):
+        (JSC::TypeInfo::prohibitsPropertyCaching):
+        (JSC::TypeInfo::isSetOnFlags1):
+        (JSC::TypeInfo::isSetOnFlags2):
+        Replace direct bit twiddling with helper functions.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        Use new isFinalObject() predicate.
+
+2011-09-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Unsigned bit shift fails under certain conditions in 32 bit builds
+        https://bugs.webkit.org/show_bug.cgi?id=68166
+
+        Reviewed by Geoff Garen.
+
+        The major bug here is that the slow case (which handles shifts of
+        doubles) doesn't check for negative results from an unsigned shift
+        (which should be unsigned, and as such can't be represented by a
+        signed integer immediate).  The implementation is also flawed for
+        shifts by negative shift amounts (treats as shift by zero).
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emitRightShiftSlowCase):
+
+2011-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed undetectable style.filter.
+
+        Reviewed by Sam Weinig.
+        
+        This feature was added in http://trac.webkit.org/changeset/15557 to
+        support housingmaps.com. But housingmaps.com no longer needs this hack,
+        we don't know of other websites that need it, and we don't know of
+        any other browsers that have implemented this feature.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSTypeInfo.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h: Removed.
+
+2011-09-15  Sam Weinig  <sam@webkit.org>
+
+        Prepare JSTypes for more Object subtypes
+        https://bugs.webkit.org/show_bug.cgi?id=68200
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::branchIfNotObject):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfNotObject):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::type):
+        (JSC::TypeInfo::isObject):
+        (JSC::TypeInfo::isFinal):
+        (JSC::TypeInfo::prohibitsPropertyCaching):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/Operations.cpp:
+        (JSC::jsIsObjectType):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::isObject):
+        (JSC::JSCell::isObject):
+
+2011-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in r95201 with test failure fixed.
+        
+        I missed two cases of jumpSlowToHot in rshift -- these cases need to be
+        sure to initialize regT1 to the int tag, since it will otherwise hold
+        the top 32 bits of a double.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitStoreAndMapInt32):
+
+2011-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed Windows build fix after 95318.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-09-16  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r95310
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added include\private\JavaScriptCore to the
+        include path so DFGIntrinsic.h can be found.
+
+2011-09-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Rationalize JSObject::putDirect* methods
+        https://bugs.webkit.org/show_bug.cgi?id=68274
+
+        Reviewed by Sam Weinig.
+        
+        Delete the *Function variants. These are overall inefficient,
+        in the way they get the name back from the function rather
+        than just passing it in.
+
+        * JavaScriptCore.exp:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (GlobalObject::addFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+
+2011-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2011-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for non-DFG builds.
+
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::finishCreation):
+
+2011-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should inline Math.abs
+        https://bugs.webkit.org/show_bug.cgi?id=68227
+
+        Reviewed by Oliver Hunt.
+        
+        This adds the ability to track intrinsic functions throughout the
+        host function infrastructure, so that the DFG can easily query
+        whether or not a call's target is intrinsic, and if so, which
+        intrinsic it is.
+        
+        On top of this, it adds Math.abs intrinsics to DFG. Call(Math.abs)
+        is transformed into ValueToNumber<-ArithAbs nodes. These nodes
+        then get optimized using the usual tricks.
+        
+        Also had to make a completely unrelated change to
+        DateInstanceCache.h in order to fix a preexisting alphabetical
+        sorting problem in JSGlobalData.h
+        
+        This results in a big win in imaging-gaussian-blur: 61% faster
+        than before. The net win on Kraken is around 13%.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_hash_table:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isFunctionConstant):
+        (JSC::DFG::Graph::valueOfFunctionConstant):
+        * dfg/DFGIntrinsic.h: Added.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::isFunctionConstant):
+        (JSC::DFG::JITCodeGenerator::valueOfFunctionConstant):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::isFunctionConstant):
+        (JSC::DFG::JITCompiler::valueOfFunctionConstant):
+        * dfg/DFGNode.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::intrinsic):
+        (JSC::NativeExecutable::intrinsic):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::intrinsic):
+
+2011-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: Reproducible crash below SlotVisitor::harvestWeakReferences
+        using Domino's online ordering
+        https://bugs.webkit.org/show_bug.cgi?id=68220
+
+        Reviewed by Oliver Hunt.
+        
+        Weak handle processing can result in new objects being marked, which
+        results in new WeakReferencesHarvesters being added. But weak
+        reference harvesters are only processed before weak handle processing,
+        so there's the risk that a weak reference harvester will persist
+        until the next collection, by which time it may have been deleted.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+
+2011-09-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r95201): It made two tests fail
+        https://bugs.webkit.org/show_bug.cgi?id=68230
+
+        Unreviewed rolling out r95201.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        * jit/JITInlineMethods.h:
+
+2011-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not optimize method_check
+        https://bugs.webkit.org/show_bug.cgi?id=68215
+
+        Reviewed by Oliver Hunt.
+        
+        MethodCallLinkInfo and StructureStubInfo are now searchable by
+        bytecodeIndex, so that DFG::ByteCodeParser can use that information
+        to determine how to optimize GetMethod.
+        
+        A new node op has been added to DFG: CheckMethod. This is a variant
+        of GetMethod that has been optimized for the case that GetMethod
+        always takes the fast path. CheckMethod results in only a very
+        small amount of code (two loads and two branches in the worst case,
+        one load and one branch in the best case). CheckMethod behaves as
+        if it were a constant.  
+        
+        Introduced the notion that a DFG node that is not JSConstant
+        behaves as a constant. CheckMethod uses this functionality.
+        
+        This is a 3% speed-up on Kraken, and a small speed-up on V8.
+        Appears to be neutral on SunSpider.
+
+        * bytecode/CodeBlock.h:
+        (JSC::getStructureStubInfoBytecodeIndex):
+        (JSC::getMethodCallLinkInfoBytecodeIndex):
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionFromCell):
+        (JSC::predictionFromValue):
+        * bytecode/PredictedType.h:
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::recordGetMethod):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::getMethodCheckPrediction):
+        (JSC::DFG::Graph::getPrediction):
+        (JSC::DFG::Graph::isConstant):
+        (JSC::DFG::Graph::isJSConstant):
+        (JSC::DFG::Graph::valueOfJSConstant):
+        (JSC::DFG::Graph::valueOfInt32Constant):
+        (JSC::DFG::Graph::valueOfNumberConstant):
+        (JSC::DFG::Graph::valueOfBooleanConstant):
+        (JSC::DFG::Graph::valueOfJSConstantNode):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
+        (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentSpillFPR):
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        (JSC::DFG::JITCompiler::fillToJS):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasConstant):
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::hasMethodCheckData):
+        (JSC::DFG::Node::methodCheckDataIndex):
+        (JSC::DFG::Node::valueOfJSConstant):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
+        (JSC::MethodCallCompilationInfo::MethodCallCompilationInfo):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::structureAddress):
+
+2011-09-15  Adam Barth  <abarth@webkit.org>
+
+        Rename ENABLE(DATABASE) to ENABLE(SQL_DATABASE)
+        https://bugs.webkit.org/show_bug.cgi?id=68205
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2011-09-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unzip initialization lists and constructors in JSCell hierarchy (7/7)
+        https://bugs.webkit.org/show_bug.cgi?id=68122
+
+        Reviewed by Geoffrey Garen.
+
+        Completed the seventh and final level of the refactoring to add finishCreation() 
+        methods to all classes within the JSCell hierarchy with non-trivial 
+        constructor bodies.
+
+        JSCallbackObject was missed in previous patches due to the fact that 
+        it's non-obvious (at least to my script) that it is in the JSCell hierarchy, so 
+        this is just a bit of retroactive cleanup.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::create):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+
+2011-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        The DFG non-speculative JIT is no longer used and should be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=68177
+
+        Reviewed by Geoffrey Garen.
+        
+        This removes the non-speculative JIT and everything that relied on it,
+        including the ability to turn on DFG but not tiered compilation the,
+        ability to perform speculation failure into non-speculative JIT code,
+        and the ability to statically terminate speculation.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoopHint):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getStrongPrediction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGenerationInfo.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCodeGenerator.cpp:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp: Removed.
+        * dfg/DFGNonSpeculativeJIT.h: Removed.
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGPropagator.cpp:
+        * dfg/DFGPropagator.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::osrExits):
+        (JSC::DFG::SpeculativeJIT::speculationRecovery):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::bottomTierJIT):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * wtf/Platform.h:
+
+2011-09-15  Eric Seidel  <eric@webkit.org>
+
+        Remove ENABLE(SVG_AS_IMAGE) since all major ports have it on by default
+        https://bugs.webkit.org/show_bug.cgi?id=68182
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT sometimes asserts that a value is not a number
+        even when it doesn't know anything about the number
+        https://bugs.webkit.org/show_bug.cgi?id=68189
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::isUnknownJS):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
+
+2011-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        All of the functionality in the non-speculative JIT should be
+        available to the speculative JIT via helper methods
+        https://bugs.webkit.org/show_bug.cgi?id=68186
+
+        Reviewed by Oliver Hunt.
+        
+        Stole all of the goodness from NonSpeculativeJIT and placed it
+        in JITCodeGenerator.  Left all of the badness (i.e. subtle code
+        duplication with SpeculativeJIT, etc).  This is in preparation
+        for removing the NonSpeculativeJIT entirely, but having its
+        goodness available for reuse in the SpeculativeJIT if necessary.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeValueToInt32):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeKnownConstantArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeBasicArithOp):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeArithMod):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCheckHasInstance):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeInstanceOf):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeAdd):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeArithSub):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+
+2011-09-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r95167.
+        http://trac.webkit.org/changeset/95167
+        https://bugs.webkit.org/show_bug.cgi?id=68191
+
+        Patch needs further work. (Requested by mhahnenberg on
+        #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toBoolean):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toBoolean):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toBoolean):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::toBoolean):
+
+2011-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for platforms that expect a linkable symbol
+        for primitive static const's.
+
+        * bytecode/CodeBlock.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+
+2011-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for assertion on existence of alternative
+        CodeBlock.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Value profiles collect no information for global variables
+        https://bugs.webkit.org/show_bug.cgi?id=68143
+
+        Reviewed by Geoffrey Garen.
+        
+        17% speed-up on string-fasta.  Neutral elsewhere.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getStrongPrediction):
+        (JSC::DFG::ByteCodeParser::stronglyPredict):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+
+2011-09-15  Eric Seidel  <eric@webkit.org>
+
+        Remove ENABLE_SVG_ANIMATION as all major ports have it on by default
+        https://bugs.webkit.org/show_bug.cgi?id=68022
+
+        Reviewed by Ryosuke Niwa.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Ooops, revert accidentally commited unreviewed changes.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        * jit/JSInterfaceJIT.h:
+        * runtime/JSValue.h:
+
+2011-09-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r95163.
+        http://trac.webkit.org/changeset/95163
+        https://bugs.webkit.org/show_bug.cgi?id=68180
+
+        [Qt] The QT_GCC_X variables were removed in Qt5 by accident.
+        (Requested by darktears on #webkit).
+
+        * JavaScriptCore.pro:
+
+2011-09-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix p1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        * jit/JSInterfaceJIT.h:
+        * runtime/JSValue.h:
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Tiered compilation should be enabled by default on platforms
+        that support the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=68136
+
+        Reviewed by Sam Weinig.
+        
+        Neutral on SunSpider, 4% speed-up on V8, and 19% speed-up on
+        Kraken.  Large progressions on some benchmarks, including
+        3x on imaging-desaturate.
+
+        * wtf/Platform.h:
+
+2011-09-15  Gavin Barraclough  <barraclough@apple.com>
+
+        devirtualize preventExtensions
+        https://bugs.webkit.org/show_bug.cgi?id=68176
+
+        Reviewed by Oliver Hunt.
+
+        This is virtual due to problems in JSFunction putting the prototype
+        property, but we can fix this problem a different way, just setting
+        the checkReadOnly flag to false in the put.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.h:
+
+2011-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Value chaining for JSValue32_64 bitops.
+
+        Reviewed by Sam Weinig.
+        
+        SunSpider says 2.3% faster, v8 ~1% faster (mostly due to crypto).
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitStoreAndMapInt32): New int32 helper function for stores
+        that can chain their results, which is the common case.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec): Deployed new function.
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec): Had to reorder these functions so they
+        computed their result values last, to make them elligible for chaining.
+
+2011-09-15  Adam Roben  <aroben@apple.com>
+
+        Clang build fix after r95172
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateFinalObject):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateArray):
+        Added parentheses to make precendence clear.
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG does not speculate aggressively enough on comparisons
+        https://bugs.webkit.org/show_bug.cgi?id=68138
+
+        Reviewed by Oliver Hunt.
+        
+        This is a 75% speed-up on Kraken/ai-astar.  It's a 1% win on
+        V8 and an 8.5% win on Kraken.  Neutral on SunSpider.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateFinalObject):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateArray):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateObject):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateCell):
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not leverage integer speculations on branches
+        https://bugs.webkit.org/show_bug.cgi?id=68140
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isStrictInt32):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-14  Gavin Barraclough  <barraclough@apple.com>
+
+        [n]stricteq code is bogus in JSValue32_64 JIT
+        https://bugs.webkit.org/show_bug.cgi?id=68141
+
+        Reviewed by Sam Weinig.
+
+        The code tries to check for both ints or cells, but this check also
+        catches cases where values that are undefined, null, etc (probably
+        was incorrectly assuming cell was the 2nd highest tag?).
+
+        Also, there is no need not to handle int on the fast path.
+        stricteq is just a case of comparing the payloads, if we:
+            * handle cases of differing tags on a slow path
+            * handle doubles a slow path
+            * handle both-are-string on a slow path
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+
+2011-09-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Make JSCell::toBoolean non-virtual
+        https://bugs.webkit.org/show_bug.cgi?id=67727
+
+        Reviewed by Sam Weinig.
+
+        JSCell::toBoolean now manually performs the toBoolean check for objects and strings (where 
+        before it was simply virtual and would crash if its implementation was called). 
+        Its descendants in JSObject and JSString have also been made non-virtual.  JSCell now
+        explicitly covers all cases of toBoolean, so having a virtual implementation of 
+        JSCell::toBoolean is no longer necessary.  This is part of a larger process of un-virtualizing JSCell.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        (JSC::JSCell::toBoolean):
+        (JSC::JSValue::toBoolean):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+
+2011-09-14  Alexis Menard  <alexis.menard@openbossa.org>
+
+        [Qt] Replace QT_GCC_X as they don't exist in Qt5 anymore.
+        https://bugs.webkit.org/show_bug.cgi?id=68114
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Use the new GCC_X variables defined in WebKit.pri to replace
+        the usage of QT_GCC_X.
+
+        * JavaScriptCore.pro:
+
+2011-09-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r95145.
+        http://trac.webkit.org/changeset/95145
+        https://bugs.webkit.org/show_bug.cgi?id=68139
+
+        The GTK+ build is working now, so revert this trial build fix.
+        (Requested by mrobinson on #webkit).
+
+        * GNUmakefile.list.am:
+
+2011-09-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Port MachineStackMarker to Windows ARM and MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=68068
+
+        Reviewed by Geoffrey Garen.
+
+        Use the correct memeber of the CONTEXT struct for the stackpointer for CPU(ARM) and CPU(MIPS).
+        Only query CONTEXT_INTEGER and CONTEXT_CONTROL, since CONTEXT_SEGMENTS isn't defined for
+        CPU(ARM) and CPU(MIPS) and the stackpointer is defined in the CONTEXT_CONTROL section for
+        CPU(ARM), CPU(X86) and CPU(X86_64) and in the CONTEXT_INTEGER section for CPU(MIPS).
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+
+2011-09-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT always speculates that ValueAdd is a numeric addition
+        https://bugs.webkit.org/show_bug.cgi?id=67956
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateNumber):
+
+2011-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Stop building BinarySemaphore to see if that's what's breaking the GTK+ build.
+
+        * GNUmakefile.list.am:
+
+2011-09-14  Anders Carlsson  <andersca@apple.com>
+
+        This is getting old. Yet another build fix attempt.
+
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+
+2011-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Yet another build fix attempt.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+
+2011-09-14  Anders Carlsson  <andersca@apple.com>
+
+        How I &quot;love&quot; Visual Studio...
+
+        Try to fix build again.
+
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+
+2011-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
+
+2011-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Add BinarySemaphore class from WebKit2 to WTF
+        https://bugs.webkit.org/show_bug.cgi?id=68132
+
+        Reviewed by Sam Weinig.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        Update build systems.
+
+        * wtf/threads: Added.
+        * wtf/threads/BinarySemaphore.cpp: Copied from Source/WebKit2/Platform/CoreIPC/BinarySemaphore.cpp.
+        * wtf/threads/BinarySemaphore.h: Copied from Source/WebKit2/Platform/CoreIPC/BinarySemaphore.h.
+        * wtf/threads/win: Added.
+        * wtf/threads/win/BinarySemaphoreWin.cpp: Copied from Source/WebKit2/Platform/CoreIPC/win/BinarySemaphoreWin.cpp.
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for Interpreter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2011-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Add wtf/threads and wtf/threads/win, so we can be sure that the EWS
+        bots can correctly build the patch in https://bugs.webkit.org/show_bug.cgi?id=68132
+
+        Rubber-stamped by Sam Weinig.
+
+        * wtf/threads: Added.
+        * wtf/threads/win: Added.
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT should not speculate integer if the value is always going to be
+        used as a double anyway
+        https://bugs.webkit.org/show_bug.cgi?id=68127
+
+        Reviewed by Oliver Hunt.
+        
+        Added a ValueToDouble node, which is a variant of ValueToNumber that
+        hints that it will only be used as a double and never as an integer.
+        Thus, it turns off integer speculation even if the value profiler
+        told us that the value source is an int. The logic for converting a
+        ValueToNumber into a ValueToDouble is found in Propagator.
+        
+        This appears to be a 22% speed-up in imaging-darkroom.
+
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::toDouble):
+        (JSC::DFG::Propagator::fixupNode):
+        (JSC::DFG::Propagator::fixup):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Tiered compilation heuristics do not account for value profile fullness
+        https://bugs.webkit.org/show_bug.cgi?id=68116
+
+        Reviewed by Oliver Hunt.
+        
+        Tiered compilation avoids invoking the DFG JIT if it finds that value
+        profiles contain insufficient information. Instead, it produces a
+        prediction from the current value profile, and then clears the value
+        profile. This allows the value profile to heat up from scratch for
+        some number of additional executions. The new profiles will then be
+        merged with the previous prediction. Once the amount of information
+        in predictions is enough according to heuristics in CodeBlock.cpp,
+        DFG optimization is allowed to proceed.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::visitWeakReferences):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/CodeBlock.h:
+        * bytecode/PredictedType.cpp:
+        (JSC::predictionToString):
+        * bytecode/PredictedType.h:
+        * bytecode/ValueProfile.cpp: Added.
+        (JSC::ValueProfile::computeStatistics):
+        (JSC::ValueProfile::computeUpdatedPrediction):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::ValueProfile):
+        (JSC::ValueProfile::classInfo):
+        (JSC::ValueProfile::numberOfSamples):
+        (JSC::ValueProfile::totalNumberOfSamples):
+        (JSC::ValueProfile::isLive):
+        (JSC::ValueProfile::numberOfInt32s):
+        (JSC::ValueProfile::numberOfDoubles):
+        (JSC::ValueProfile::numberOfBooleans):
+        (JSC::ValueProfile::dump):
+        (JSC::getValueProfileBytecodeOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::stronglyPredict):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not speculate that the child of LogicalNot is a boolean if
+        predictions tell us otherwise
+        https://bugs.webkit.org/show_bug.cgi?id=68118
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeLogicalNot):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix.  Turn off tiered compilation.
+
+        * wtf/Platform.h:
+
+2011-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Prediction tracking is not precise enough
+        https://bugs.webkit.org/show_bug.cgi?id=67993
+
+        Reviewed by Oliver Hunt.
+        
+        Added a richer set of type predictions, including JSFinalObject, JSString,
+        object that is not a JSFinalObject or JSArray (ObjectOther), some object
+        but we don't or care know what kind (SomeObject), definitely an object,
+        cell that is not an object or JSString, an value that is none of the above
+        (so either Undefined or Null). Made the propagator and value profiler work
+        with the new types.
+        
+        Performance is neutral, because the DFG JIT does not take advantage of this
+        new knowledge yet.
+        
+        In the process of writing predictionToString() (which is now considerably
+        more complex) I decided to finally add a BoundsCheckedPointer, which
+        should come in handy in other places, like at least the OSR scratch buffer
+        and the CompactJITCodeMap. It's great for cases where you want to
+        do pointer arithmetic, you want to have assertions about the
+        pointer not going out of bounds, but you don't want to write those
+        assertions yourself.
+        
+        This also required refactoring inherits(), since the ValueProfiler may
+        want to do the equivalent of inherits() but given two ClassInfo's.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PredictedType.cpp: Added.
+        (JSC::predictionToString):
+        (JSC::makePrediction):
+        (JSC::predictionFromValue):
+        * bytecode/PredictedType.h:
+        (JSC::isCellPrediction):
+        (JSC::isObjectPrediction):
+        (JSC::isFinalObjectPrediction):
+        (JSC::isStringPrediction):
+        (JSC::mergePredictions):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::numberOfObjects):
+        (JSC::ValueProfile::numberOfFinalObjects):
+        (JSC::ValueProfile::numberOfStrings):
+        (JSC::ValueProfile::probabilityOfObject):
+        (JSC::ValueProfile::probabilityOfFinalObject):
+        (JSC::ValueProfile::probabilityOfString):
+        (JSC::ValueProfile::dump):
+        (JSC::ValueProfile::Statistics::Statistics):
+        (JSC::ValueProfile::computeStatistics):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::stronglyPredict):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::predict):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::propagateNode):
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::isSubClassOf):
+        * runtime/JSObject.h:
+        (JSC::JSCell::inherits):
+        * wtf/BoundsCheckedPointer.h: Added.
+        (WTF::BoundsCheckedPointer::BoundsCheckedPointer):
+        (WTF::BoundsCheckedPointer::operator=):
+        (WTF::BoundsCheckedPointer::operator+=):
+        (WTF::BoundsCheckedPointer::operator-=):
+        (WTF::BoundsCheckedPointer::operator+):
+        (WTF::BoundsCheckedPointer::operator-):
+        (WTF::BoundsCheckedPointer::operator++):
+        (WTF::BoundsCheckedPointer::operator--):
+        (WTF::BoundsCheckedPointer::operator<):
+        (WTF::BoundsCheckedPointer::operator<=):
+        (WTF::BoundsCheckedPointer::operator>):
+        (WTF::BoundsCheckedPointer::operator>=):
+        (WTF::BoundsCheckedPointer::operator==):
+        (WTF::BoundsCheckedPointer::operator!=):
+        (WTF::BoundsCheckedPointer::operator!):
+        (WTF::BoundsCheckedPointer::get):
+        (WTF::BoundsCheckedPointer::operator*):
+        (WTF::BoundsCheckedPointer::operator[]):
+        (WTF::BoundsCheckedPointer::strcat):
+        (WTF::BoundsCheckedPointer::validate):
+        * wtf/CMakeLists.txt:
+
+2011-09-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Win32 builds with threads turned off
+        https://bugs.webkit.org/show_bug.cgi?id=67864
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.pri: Link pthread library on Windows platform.
+        * wtf/Platform.h: Enable multiple threads.
+
+2011-09-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unzip initialization lists and constructors in JSCell hierarchy (6/7)
+        https://bugs.webkit.org/show_bug.cgi?id=67692
+
+        Reviewed by Geoffrey Garen.
+
+        Completed the sixth level of the refactoring to add finishCreation() 
+        methods to all classes within the JSCell hierarchy with non-trivial 
+        constructor bodies.
+
+        This primarily consists of pushing the calls to finishCreation() down 
+        into the constructors of the subclasses of the fifth level of the hierarchy 
+        as well as pulling the finishCreation() calls out into the class's corresponding
+        create() method if it has one.  Doing both simultaneously allows us to 
+        maintain the invariant that the finishCreation() method chain is called exactly 
+        once during the creation of an object, since calling it any other number of 
+        times (0, 2, or more) will cause an assertion failure.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::create):
+        * jsc.cpp:
+        (GlobalObject::create):
+        (GlobalObject::GlobalObject):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::create):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        (JSC::BooleanConstructor::create):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::create):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::create):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::create):
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        (JSC::StrictModeTypeErrorFunction::create):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        (JSC::ErrorConstructor::create):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        (JSC::FunctionConstructor::create):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::create):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::create):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        (JSC::NativeErrorPrototype::finishCreation):
+        * runtime/NativeErrorPrototype.h:
+        (JSC::NativeErrorPrototype::create):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::create):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::create):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::create):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::create):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::create):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::create):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::create):
+
+2011-09-13  Eric Seidel  <eric@webkit.org>
+
+        Remove ENABLE_SVG_USE as <use> is required by HTML5
+        https://bugs.webkit.org/show_bug.cgi?id=68019
+
+        Reviewed by Ryosuke Niwa.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-14  Iain Merrick  <husky@google.com>
+
+        HashTraits.h should include template specialization for WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=67851
+
+        Ensure that the template specialization for HashTraits<String> is always
+        picked up. (Previously it was possible to include HashSet and String but
+        not the correct HashTraits, so you would get an inefficient template
+        instantiation.)
+
+        Reviewed by Darin Adler.
+
+        * wtf/HashTraits.h:
+        * wtf/text/StringHash.h:
+
+2011-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        SpeculativeJIT::shouldSpeculateInteger(NodeIndex, NodeIndex) should
+        return false if either node can be double
+        https://bugs.webkit.org/show_bug.cgi?id=67985
+
+        Reviewed by Geoffrey Garen.
+        
+        This is a 17% speed-up on 3d-cube.
+        
+        This required allowing us to check if a constant is double but not
+        integer, and making the shouldSpeculateInteger() check test for
+        any hints of doubly-ness in its operands. This also required
+        changing some terminology: previously "isDouble" often meant
+        "isDouble or isInt32".  Now "isDouble" means exactly what the name
+        suggests, and "isNumber" means "isDouble or isInt32".
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::toNumber):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::isJSFormat):
+        (JSC::DFG::isJSInteger):
+        (JSC::DFG::isJSDouble):
+        (JSC::DFG::isJSCell):
+        (JSC::DFG::isJSBoolean):
+        (JSC::DFG::GenerationInfo::isJSFormat):
+        (JSC::DFG::GenerationInfo::isJSInteger):
+        (JSC::DFG::GenerationInfo::isJSDouble):
+        (JSC::DFG::GenerationInfo::isJSCell):
+        (JSC::DFG::GenerationInfo::isJSBoolean):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isNumberConstant):
+        (JSC::DFG::Graph::valueOfNumberConstant):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::isKnownInteger):
+        (JSC::DFG::JITCodeGenerator::isKnownNumeric):
+        (JSC::DFG::JITCodeGenerator::isKnownCell):
+        (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
+        (JSC::DFG::JITCodeGenerator::isKnownBoolean):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        (JSC::DFG::JITCodeGenerator::isNumberConstant):
+        (JSC::DFG::JITCodeGenerator::valueOfNumberConstant):
+        (JSC::DFG::JITCodeGenerator::initConstantInfo):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillToJS):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::isNumberConstant):
+        (JSC::DFG::JITCompiler::valueOfNumberConstant):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isDoubleConstant):
+        (JSC::DFG::Node::isNumberConstant):
+        (JSC::DFG::Node::valueOfNumberConstant):
+        (JSC::DFG::Node::hasNumberResult):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isInteger):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::shouldNotSpeculateInteger):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateInteger):
+
+2011-09-13  Anders Carlsson  <andersca@apple.com>
+
+        Disable C++ exceptions when building with clang
+        https://bugs.webkit.org/show_bug.cgi?id=68031
+        <rdar://problem/9556880>
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig:
+
+2011-09-13  Eric Seidel  <eric@webkit.org>
+
+        Remove ENABLE_SVG_FOREIGN_OBJECT as it is a required part of HTML5
+        https://bugs.webkit.org/show_bug.cgi?id=68018
+
+        Reviewed by Ryosuke Niwa.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-09-13  Sam Weinig  <sam@webkit.org>
+
+        Object.getPrototypeOf should use JSValue::get()
+        https://bugs.webkit.org/show_bug.cgi?id=67973
+
+        Reviewed by Darin Adler.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        Pipe through JSValue::get() to allow overrides.
+
+2011-09-12  Filip Pizlo  <fpizlo@apple.com>
+
+        JavaScriptCore does not have baseline->speculative OSR
+        https://bugs.webkit.org/show_bug.cgi?id=67920
+
+        Reviewed by Oliver Hunt.
+        
+        This adds the ability to on-stack-replace (OSR) from code that is
+        running hot in the old JIT to code compiled by the new JIT.  This
+        ensures that long-running loops benefit from DFG optimization.
+        It also ensures that if code experiences a speculation failure
+        in DFG code, it has an opportunity to reenter the DFG once every
+        1,000 loop iterations or so.
+        
+        This results in a 2.88x speed-up on Kraken/imaging-desaturate,
+        and is a pure win on the main three benchmark suites (SunSpider,
+        V8, Kraken), when tiered compilation is enabled.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::ProgramCodeBlock::compileOptimized):
+        (JSC::EvalCodeBlock::compileOptimized):
+        (JSC::FunctionCodeBlock::compileOptimized):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        * bytecode/PredictedType.h: Added.
+        (JSC::isCellPrediction):
+        (JSC::isArrayPrediction):
+        (JSC::isInt32Prediction):
+        (JSC::isDoublePrediction):
+        (JSC::isNumberPrediction):
+        (JSC::isBooleanPrediction):
+        (JSC::isStrongPrediction):
+        (JSC::predictionToString):
+        (JSC::mergePredictions):
+        (JSC::mergePrediction):
+        (JSC::makePrediction):
+        * bytecode/PredictionTracker.h: Added.
+        (JSC::operandIsArgument):
+        (JSC::PredictionSlot::PredictionSlot):
+        (JSC::PredictionTracker::PredictionTracker):
+        (JSC::PredictionTracker::initializeSimilarTo):
+        (JSC::PredictionTracker::copyLocalsFrom):
+        (JSC::PredictionTracker::numberOfArguments):
+        (JSC::PredictionTracker::numberOfVariables):
+        (JSC::PredictionTracker::argumentOffsetForOperand):
+        (JSC::PredictionTracker::predictArgument):
+        (JSC::PredictionTracker::predict):
+        (JSC::PredictionTracker::predictGlobalVar):
+        (JSC::PredictionTracker::getArgumentPrediction):
+        (JSC::PredictionTracker::getPrediction):
+        (JSC::PredictionTracker::getGlobalVarPrediction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoopHint):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::getPrediction):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGNode.h:
+        * dfg/DFGOSREntry.cpp: Added.
+        (JSC::DFG::predictionIsValid):
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h: Added.
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGPredictionTracker.h: Removed.
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::mergeUse):
+        (JSC::DFG::Propagator::mergePrediction):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/CompactJITCodeMap.h:
+        (JSC::CompactJITCodeMap::numberOfEntries):
+        (JSC::CompactJITCodeMap::decode):
+        (JSC::CompactJITCodeMap::Decoder::Decoder):
+        (JSC::CompactJITCodeMap::Decoder::numberOfEntriesRemaining):
+        (JSC::CompactJITCodeMap::Decoder::read):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop_hint):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2011-09-12  Sam Weinig  <sam@webkit.org>
+
+        Don't allow setting __proto__ to be a getter or setter
+        https://bugs.webkit.org/show_bug.cgi?id=67982
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        Disallow setting a getter or setter on __proto__.
+
+2011-09-12  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        Guard access to UString::latin1() with USE(JSC) since it is defined in JavaScriptCore/runtime/UString.cpp, which
+        is currently only compiled in by ports that use JavaScriptCore.  This code is currently unreachable in builds so
+        no change in functionality.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::CharAccess::CharAccess):
+
+2011-09-09  Filip Pizlo  <fpizlo@apple.com>
+
+        JavaScriptCore does not have speculative->baseline OSR
+        https://bugs.webkit.org/show_bug.cgi?id=67826
+
+        Reviewed by Oliver Hunt.
+        
+        This adds the ability to bail out of DFG speculative JIT execution by
+        performing an on-stack replacement (OSR) that results in the control
+        flow going to the equivalent code generated by the old JIT.
+        
+        This required a number of new features, as well as taking advantage of
+        some features that happened to already be present:
+        
+        We already had a policy of storing the bytecode index for which a DFG
+        node was generated inside the DFG::Node class. This was previously
+        called exceptionInfo. It's now renamed to codeOrigin to reflect that
+        it's used for more than just excpetions. OSR uses this to figure out
+        which bytecode index to use to look up the machine code location in
+        the code generated by the old JIT that we should be jumping to.
+        
+        CodeBlock now stores a mapping between bytecode indices and machine
+        code offsets for code generated by the old JIT. This is implemented
+        by CompactJITCodeMap, which tries to compress this data a bit.  The
+        OSR compiler decodes this and uses it to find the machine code
+        locations it should be jumping to.
+        
+        We already had a mechanism that emitted SetLocal nodes in the DFG graph
+        that told us the time at which the old JIT would have stored something
+        into its register file, and the DFG::Node that corresponds to the value
+        that it would have stored. These SetLocal's were mostly dead-code-
+        eliminated, but our DCE leaves the nodes intact except for making them
+        have 0 as the ref count. This allows the OSR compiler to construct a
+        mapping between the state as it would have been seen by the old JIT
+        and the state as the DFG JIT sees it. The OSR compiler uses this to
+        generate code that reshapes the call frame so that it is like what the
+        old JIT would expect.
+        
+        Finally, when DFG_OSR is enabled (the default for TIERED_COMPILATION)
+        we no longer emit the non-speculative path.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::currentCodeOrigin):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        * dfg/DFGGPRInfo.h:
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::alive):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::appendCallWithExceptionCheck):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::CallRecord::CallRecord):
+        (JSC::DFG::JITCompiler::notifyCall):
+        (JSC::DFG::JITCompiler::appendCallWithExceptionCheck):
+        (JSC::DFG::JITCompiler::appendCallWithFastExceptionCheck):
+        (JSC::DFG::JITCompiler::addJSCall):
+        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
+        * dfg/DFGNode.h:
+        (JSC::DFG::CodeOrigin::CodeOrigin):
+        (JSC::DFG::CodeOrigin::isSet):
+        (JSC::DFG::CodeOrigin::bytecodeIndex):
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::child1Unchecked):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::ValueRecovery::dump):
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::ValueSource::ValueSource):
+        (JSC::DFG::ValueSource::isSet):
+        (JSC::DFG::ValueSource::nodeIndex):
+        (JSC::DFG::ValueRecovery::ValueRecovery):
+        (JSC::DFG::ValueRecovery::alreadyInRegisterFile):
+        (JSC::DFG::ValueRecovery::inGPR):
+        (JSC::DFG::ValueRecovery::inFPR):
+        (JSC::DFG::ValueRecovery::displacedInRegisterFile):
+        (JSC::DFG::ValueRecovery::constant):
+        (JSC::DFG::ValueRecovery::technique):
+        (JSC::DFG::ValueRecovery::gpr):
+        (JSC::DFG::ValueRecovery::fpr):
+        (JSC::DFG::ValueRecovery::virtualRegister):
+        (JSC::DFG::OSRExit::numberOfRecoveries):
+        (JSC::DFG::OSRExit::valueRecovery):
+        (JSC::DFG::OSRExit::isArgument):
+        (JSC::DFG::OSRExit::argumentForIndex):
+        (JSC::DFG::OSRExit::variableForIndex):
+        (JSC::DFG::OSRExit::operandForIndex):
+        (JSC::DFG::SpeculativeJIT::osrExits):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::valueSourceForOperand):
+        (JSC::DFG::SpeculativeJIT::setNodeIndexForOperand):
+        (JSC::DFG::SpeculativeJIT::valueSourceReferenceForOperand):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculationCheckIndexIterator::SpeculationCheckIndexIterator):
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * jit/CompactJITCodeMap.h: Added.
+        (JSC::BytecodeAndMachineOffset::BytecodeAndMachineOffset):
+        (JSC::BytecodeAndMachineOffset::getBytecodeIndex):
+        (JSC::BytecodeAndMachineOffset::getMachineCodeOffset):
+        (JSC::CompactJITCodeMap::~CompactJITCodeMap):
+        (JSC::CompactJITCodeMap::decode):
+        (JSC::CompactJITCodeMap::CompactJITCodeMap):
+        (JSC::CompactJITCodeMap::at):
+        (JSC::CompactJITCodeMap::decodeNumber):
+        (JSC::CompactJITCodeMap::Encoder::Encoder):
+        (JSC::CompactJITCodeMap::Encoder::~Encoder):
+        (JSC::CompactJITCodeMap::Encoder::append):
+        (JSC::CompactJITCodeMap::Encoder::finish):
+        (JSC::CompactJITCodeMap::Encoder::appendByte):
+        (JSC::CompactJITCodeMap::Encoder::encodeNumber):
+        (JSC::CompactJITCodeMap::Encoder::ensureCapacityFor):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::osrScratchBufferForSize):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+
+2011-09-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Re-enabled ENABLE(LAZY_BLOCK_FREEING).
+        
+        Reviewed by Stephanie Lewis.
+
+        I accidentally disabled this in r94890, causing a big performance regression.
+
+        * wtf/Platform.h:
+
+2011-09-12  Michael Saboff  <msaboff@apple.com>
+
+        Broken Build for ARM - lshift32() needs TrustedImm32 arg
+        https://bugs.webkit.org/show_bug.cgi?id=67965
+
+        Change lshift32(16, ARMRegisters::S1); to lshift32(TrustedImm32(16), ARMRegisters::S1);
+
+        Reviewed by Anders Carlsson.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch16):
+
+2011-09-12  Michael Saboff  <msaboff@apple.com>
+
+        Broken ARM build - missing semicolon in JavaScriptCore/assembler/MacroAssemblerARM.h
+        https://bugs.webkit.org/show_bug.cgi?id=67961
+
+        Added missing semicolon.
+
+        Reviewed by Ryosuke Niwa.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch16):
+
+2011-09-12  Michael Saboff  <msaboff@apple.com>
+
+        Update RegExp and related classes to use 8 bit strings when available
+        https://bugs.webkit.org/show_bug.cgi?id=67337
+
+        Modified both the Yarr interpreter and JIT to handle 8 bit subject strings.
+        The code paths are triggered by the UString::is8bit() method which currently
+        returns false.  Implemented JIT changes for all current architectures.
+        Tested X86_64 and ARM v7.
+
+        This includes some code that will likely change as we complete the
+        8 bit string changes.  This includes the way the raw buffer pointers
+        are accessed as well as replacing the CharAccess class with a
+        string interator returned from UString.
+
+        Fixed build breakage in testRegExp.cpp due to globalObject construction
+        changes.
+
+        Reviewed by Gavin Barraclough.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * testRegExp.cpp:
+        (GlobalObject::finishCreation):
+        (GlobalObject::GlobalObject):
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ubfx):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp12Reg40Imm3Reg4Imm20Imm5):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load8):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branch16):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load8):
+        (JSC::MacroAssemblerARMv7::branch16):
+        (JSC::MacroAssemblerARMv7::branch8):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load8):
+        (JSC::MacroAssemblerMIPS::branch8):
+        (JSC::MacroAssemblerMIPS::branch16):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load8):
+        (JSC::MacroAssemblerSH4::branch8):
+        (JSC::MacroAssemblerSH4::branch16):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load8):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branch8):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::extub):
+        (JSC::SH4Assembler::printInstr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpw_ir):
+        (JSC::X86Assembler::movzbl_mr):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileIfNecessary):
+        (JSC::RegExp::match):
+        (JSC::RegExp::matchCompareWithInterpreter):
+        * runtime/RegExp.h:
+        * runtime/UString.h:
+        (JSC::UString::is8Bit):
+        * yarr/Yarr.h:
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::CharAccess::CharAccess):
+        (JSC::Yarr::Interpreter::CharAccess::~CharAccess):
+        (JSC::Yarr::Interpreter::CharAccess::operator[]):
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::interpret):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::YarrGenerator::readCharacter):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateDotStarEnclosure):
+        (JSC::Yarr::YarrGenerator::YarrGenerator):
+        (JSC::Yarr::YarrGenerator::compile):
+        (JSC::Yarr::jitCompile):
+        (JSC::Yarr::execute):
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::YarrCodeBlock::has8BitCode):
+        (JSC::Yarr::YarrCodeBlock::has16BitCode):
+        (JSC::Yarr::YarrCodeBlock::set8BitCode):
+        (JSC::Yarr::YarrCodeBlock::set16BitCode):
+        (JSC::Yarr::YarrCodeBlock::execute):
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::Parser):
+
+2011-09-12  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt] Build fails after r94920 with strict compiler
+        https://bugs.webkit.org/show_bug.cgi?id=67928
+
+        Reviewed by Csaba Osztrogonác.
+
+        * wtf/RedBlackTree.h:
+        (WTF::RedBlackTree::insert): Remove dead variables updateStart and newSubTreeRoot.
+
+2011-09-12  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix after r94871.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * wtf/FastMalloc.cpp:
+        * wtf/RefCountedLeakCounter.h:
+
+2011-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGNode.h has macros that indicate the enabling of a feature, but
+        they do not use the ENABLE() idiom.
+        https://bugs.webkit.org/show_bug.cgi?id=67907
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::stronglyPredict):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCodeGenerator.cpp:
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::propagateNode):
+        (JSC::DFG::Propagator::propagateForward):
+        (JSC::DFG::Propagator::propagateBackward):
+        (JSC::DFG::propagate):
+        * dfg/DFGScoreBoard.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2011-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for chromium/mac & clang.
+
+        Fix the macro redefinition error by r94927, because chromium set
+        ENABLE_JSC_MULTIPLE_THREADS=0 in WebKit/chromium/features.gypi and
+        it is not PLATFORM(QT).
+         ../../JavaScriptCore/wtf/Platform.h:512:9: error: 'ENABLE_JSC_MULTIPLE_THREADS' macro redefined [-Werror]
+         #define ENABLE_JSC_MULTIPLE_THREADS 1
+         <command line>:43:9: note: previous definition is here
+         #define ENABLE_JSC_MULTIPLE_THREADS 0
+         1 error generated.
+
+        * wtf/Platform.h:
+
+2011-09-11  Sam Weinig  <sam@webkit.org>
+
+        Remove JSCell::isPropertyNameIterator(), it is unused
+        https://bugs.webkit.org/show_bug.cgi?id=67911
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSCell.h:
+        * runtime/JSPropertyNameIterator.h:
+
+2011-09-11  Sam Weinig  <sam@webkit.org>
+
+        De-virtualize JSCell::isAPIValueWrapper
+        https://bugs.webkit.org/show_bug.cgi?id=67909
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        Set the correct type on structure creation.
+
+        * runtime/JSCell.h:
+        Remove virtual keyword and default implementation.
+
+        * runtime/JSType.h:
+        Add type for APIValueWrapper. It must come after CompoundType since
+        the APIValueWrapper has children in need of marking.
+
+        * runtime/Structure.h:
+        (JSC::JSCell::isAPIValueWrapper):
+        Implement predicate using type info.
+
+2011-09-10  Sam Weinig  <sam@webkit.org>
+
+        De-virtualize JSCell::isGetterSetter, type information is available for it
+        https://bugs.webkit.org/show_bug.cgi?id=67902
+
+        Reviewed by Dan Bernstein.
+
+        * runtime/GetterSetter.cpp:
+        * runtime/GetterSetter.h:
+        Remove override of isGetterSetter.
+
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        De-virtualize and remove silly base implementation.
+
+        * runtime/Structure.h:
+        (JSC::JSCell::isGetterSetter):
+        Use type info to determine getter-setter-hood.
+
+2011-09-09  Oliver Hunt  <oliver@apple.com>
+
+        Remove support for anonymous storage from jsobjects
+        https://bugs.webkit.org/show_bug.cgi?id=67881
+
+        Reviewed by Sam Weinig.
+
+        Remove all use of anonymous slots, essentially a mechanical change
+        in JavaScriptCore
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::validateValue):
+        * heap/MarkStack.h:
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::createStructure):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::createStructure):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::finishCreation):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::createStructure):
+        * runtime/ExceptionHelpers.h:
+        (JSC::InterruptedExecutionError::createStructure):
+        (JSC::TerminatedExecutionError::createStructure):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSFinalObject::createStructure):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::createStructure):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::finishCreation):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::createStructure):
+        * runtime/RegExp.h:
+        (JSC::RegExp::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::createStructure):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::createStructure):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::get):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+
+2011-09-11  Jarred Nicholls  <jarred@sencha.com>
+
+        [Qt] Win32 build broken due to MachineStackMarker.cpp/.o failing to link against pthreads library
+        https://bugs.webkit.org/show_bug.cgi?id=67864
+        
+        Qt Win32 is not pthread compatible and cannot participate in multithreaded JSC or it fails to build.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * wtf/Platform.h:
+
+2011-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        ARM and MIPS assemblers still refer to executable pools.
+        https://bugs.webkit.org/show_bug.cgi?id=67903
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+
+2011-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        The executable allocator makes it difficult to free individual
+        chunks of executable memory
+        https://bugs.webkit.org/show_bug.cgi?id=66363
+
+        Reviewed by Oliver Hunt.
+        
+        Introduced a best-fit, balanced-tree based allocator. The allocator
+        required a balanced tree that does not allocate memory and that
+        permits the removal of individual nodes directly (as opposed to by
+        key); neither AVLTree nor WebCore's PODRedBlackTree supported this.
+        Changed all references to executable code to use a reference counted
+        handle.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::finalizeCode):
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+        (JSC::MacroAssemblerCodeRef::createSelfManagedCodeRef):
+        (JSC::MacroAssemblerCodeRef::executableMemory):
+        (JSC::MacroAssemblerCodeRef::code):
+        (JSC::MacroAssemblerCodeRef::size):
+        (JSC::MacroAssemblerCodeRef::operator!):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
+        * bytecode/CodeBlock.h:
+        * bytecode/Instruction.h:
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::tryCachePutByID):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::initializeAllocator):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::allocate):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::dumpProfile):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::dumpProfile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::initializeAllocator):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutableAllocator::allocate):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::dumpProfile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator !):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::start):
+        (JSC::JITCode::size):
+        (JSC::JITCode::getExecutableMemory):
+        (JSC::JITCode::HostFunction):
+        (JSC::JITCode::JITCode):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::JITThunks::ctiStub):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::dumpSampleData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getCTIStub):
+        * wtf/CMakeLists.txt:
+        * wtf/MetaAllocator.cpp: Added.
+        (WTF::MetaAllocatorHandle::MetaAllocatorHandle):
+        (WTF::MetaAllocatorHandle::~MetaAllocatorHandle):
+        (WTF::MetaAllocatorHandle::shrink):
+        (WTF::MetaAllocator::MetaAllocator):
+        (WTF::MetaAllocator::allocate):
+        (WTF::MetaAllocator::currentStatistics):
+        (WTF::MetaAllocator::findAndRemoveFreeSpace):
+        (WTF::MetaAllocator::addFreeSpaceFromReleasedHandle):
+        (WTF::MetaAllocator::addFreshFreeSpace):
+        (WTF::MetaAllocator::debugFreeSpaceSize):
+        (WTF::MetaAllocator::addFreeSpace):
+        (WTF::MetaAllocator::incrementPageOccupancy):
+        (WTF::MetaAllocator::decrementPageOccupancy):
+        (WTF::MetaAllocator::roundUp):
+        (WTF::MetaAllocator::allocFreeSpaceNode):
+        (WTF::MetaAllocator::freeFreeSpaceNode):
+        (WTF::MetaAllocator::dumpProfile):
+        * wtf/MetaAllocator.h: Added.
+        (WTF::MetaAllocator::bytesAllocated):
+        (WTF::MetaAllocator::bytesReserved):
+        (WTF::MetaAllocator::bytesCommitted):
+        (WTF::MetaAllocator::dumpProfile):
+        (WTF::MetaAllocator::~MetaAllocator):
+        * wtf/MetaAllocatorHandle.h: Added.
+        * wtf/RedBlackTree.h: Added.
+        (WTF::RedBlackTree::Node::Node):
+        (WTF::RedBlackTree::Node::successor):
+        (WTF::RedBlackTree::Node::predecessor):
+        (WTF::RedBlackTree::Node::reset):
+        (WTF::RedBlackTree::Node::parent):
+        (WTF::RedBlackTree::Node::setParent):
+        (WTF::RedBlackTree::Node::left):
+        (WTF::RedBlackTree::Node::setLeft):
+        (WTF::RedBlackTree::Node::right):
+        (WTF::RedBlackTree::Node::setRight):
+        (WTF::RedBlackTree::Node::color):
+        (WTF::RedBlackTree::Node::setColor):
+        (WTF::RedBlackTree::RedBlackTree):
+        (WTF::RedBlackTree::insert):
+        (WTF::RedBlackTree::remove):
+        (WTF::RedBlackTree::findExact):
+        (WTF::RedBlackTree::findLeastGreaterThanOrEqual):
+        (WTF::RedBlackTree::findGreatestLessThanOrEqual):
+        (WTF::RedBlackTree::first):
+        (WTF::RedBlackTree::last):
+        (WTF::RedBlackTree::size):
+        (WTF::RedBlackTree::isEmpty):
+        (WTF::RedBlackTree::treeMinimum):
+        (WTF::RedBlackTree::treeMaximum):
+        (WTF::RedBlackTree::treeInsert):
+        (WTF::RedBlackTree::leftRotate):
+        (WTF::RedBlackTree::rightRotate):
+        (WTF::RedBlackTree::removeFixup):
+        * wtf/wtf.pri:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::YarrCodeBlock::execute):
+        (JSC::Yarr::YarrCodeBlock::getAddr):
+
+2011-09-10  Sam Weinig  <sam@webkit.org>
+
+        Remove JSC::isZombie() function, it did nothing and was called by no-one.
+        https://bugs.webkit.org/show_bug.cgi?id=67901
+
+        Reviewed by Andy Estes.
+
+        * JavaScriptCore.exp:
+        * runtime/JSCell.cpp:
+        * runtime/JSValue.h:
+
+2011-09-10  Sam Weinig  <sam@webkit.org>
+
+        Add isInterruptedExecutionException and isTerminatedExecutionException predicates
+        https://bugs.webkit.org/show_bug.cgi?id=67892
+
+        Reviewed by Andy "First Time Reviewer" Estes.
+
+        * JavaScriptCore.exp:
+        Add symbols.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        Use new predicates.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::isInterruptedExecutionException):
+        (JSC::createTerminatedExecutionException):
+        (JSC::isTerminatedExecutionException):
+        * runtime/ExceptionHelpers.h:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        Add predicates.
+
+2011-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT completely undoes speculative compilation even in the case of
+        a partial static speculation failure
+        https://bugs.webkit.org/show_bug.cgi?id=67798
+
+        Reviewed by Geoffrey Garen.
+        
+        This is a regression with static speculation, so it is turned off by
+        default.  But it is a necessary prerequisite for further work on
+        dynamic speculation.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::clearGenerationInfo):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+
+2011-09-09  Chris Marrin  <cmarrin@apple.com>
+
+        requestAnimationFrame doesn't throttle on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=67171
+
+        Reviewed by Simon Fraser.
+
+        Added WTF_USE_REQUEST_ANIMATION_FRAME_TIMER to allow any platform to run
+        requestAnimationFrame callbacks on a Timer defined in ScriptedAnimationController.
+        Currently only enabled for PLATFORM(MAC)
+
+        * wtf/Platform.h:
+
+2011-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Removed ENABLE(SINGLE_THREADED) support, since it is always false
+        https://bugs.webkit.org/show_bug.cgi?id=67862
+
+        Next step toward making the baseline platform assumption that threads exist.
+
+        * wtf/wtf.pri:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Removed references to
+        ThreadingNone.cpp, which was only compiled in single-threaded mode.
+
+        * wtf/Platform.h:
+        * wtf/ThreadSpecific.h:
+        (WTF::::destroy):
+        * wtf/qt/ThreadingQt.cpp: Removed now-dead code.
+
+        * wtf/ThreadingNone.cpp: Removed.
+
+2011-09-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unzip initialization lists and constructors in JSCell hierarchy (5/7)
+        https://bugs.webkit.org/show_bug.cgi?id=67420
+
+        Reviewed by Geoffrey Garen.
+
+        Completed the fifth level of the refactoring to add finishCreation() 
+        methods to all classes within the JSCell hierarchy with non-trivial 
+        constructor bodies.
+
+        This primarily consists of pushing the calls to finishCreation() down 
+        into the constructors of the subclasses of the second level of the hierarchy 
+        as well as pulling the finishCreation() calls out into the class's corresponding
+        create() method if it has one.  Doing both simultaneously allows us to 
+        maintain the invariant that the finishCreation() method chain is called exactly 
+        once during the creation of an object, since calling it any other number of 
+        times (0, 2, or more) will cause an assertion failure.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::create):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction):
+        (JSC::JSCallbackFunction::finishCreation):
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        (JSC::::finishCreation):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::create):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (GlobalObject::GlobalObject):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::ArrayConstructor::finishCreation):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::create):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::BooleanConstructor::finishCreation):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::create):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        (JSC::BooleanPrototype::finishCreation):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::DateConstructor::finishCreation):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::create):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        (JSC::DatePrototype::finishCreation):
+        * runtime/DatePrototype.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        (JSC::ErrorConstructor::finishCreation):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        (JSC::FunctionConstructor::finishCreation):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::finishCreation):
+        * runtime/FunctionPrototype.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::create):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::create):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        (JSC::NativeErrorPrototype::finishCreation):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::NumberConstructor::finishCreation):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::create):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        (JSC::NumberPrototype::finishCreation):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/ObjectConstructor.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpConstructor::finishCreation):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::create):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::create):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        (JSC::StringConstructor::finishCreation):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        (JSC::StringObject::create):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        (JSC::StringPrototype::finishCreation):
+        * runtime/StringPrototype.h:
+
+2011-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Guard against double-#define for something already #defined
+        by the build system.
+
+        * wtf/Platform.h:
+
+2011-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Never #define ENABLE_SINGLE_THREADED, !ENABLE_JSC_MULTIPLE_THREADS, or
+        !ENABLE_WTF_MULTIPLE_THREADS
+        https://bugs.webkit.org/show_bug.cgi?id=67860
+
+        First step toward making the baseline platform assumption that threads
+        exist: Never #define ENABLE_SINGLE_THREADED, !ENABLE_JSC_MULTIPLE_THREADS,
+        or !ENABLE_WTF_MULTIPLE_THREADS.
+
+        * wtf/Platform.h:
+
+2011-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        [Qt] Remove common.pri
+        https://bugs.webkit.org/show_bug.cgi?id=67814
+
+        Reviewed by Andreas Kling.
+
+        * JavaScriptCore.pri:
+
+2011-09-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION(r94811): Assertion failure in 2 worker tests
+        https://bugs.webkit.org/show_bug.cgi?id=67829
+
+        Reviewed by Sam Weinig.
+
+        Fixing a couple tests that were broken due to the wrong values being 
+        set in the parent class pointers in the ClassInfo structs for 
+        TerminatedExecutionError and InterruptedExecutionError.
+
+        * runtime/ExceptionHelpers.cpp:
+
+2011-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Use bump allocator for initial property storage
+        https://bugs.webkit.org/show_bug.cgi?id=67494
+
+        Reviewed by Geoffrey Garen.
+
+        Use a bump allocator for initial allocation of property storage,
+        and promote to fastMalloc memory only if it survives a GC pass.
+
+        Comes out as a 1% win on v8, and is a useful step on the way to
+        GC allocation of all property storage.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (JSC::Heap::allocatePropertyStorage):
+        (JSC::Heap::inPropertyStorageNursery):
+        * heap/MarkedBlock.h:
+        * heap/NewSpace.cpp:
+        (JSC::NewSpace::NewSpace):
+        * heap/NewSpace.h:
+        (JSC::NewSpace::resetPropertyStorageNursery):
+        (JSC::NewSpace::allocatePropertyStorage):
+        (JSC::NewSpace::inPropertyStorageNursery):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        (JSC::JSObject::visitChildrenDirect):
+        * runtime/StorageBarrier.h: Added.
+        (JSC::StorageBarrier::StorageBarrier):
+        (JSC::StorageBarrier::set):
+        (JSC::StorageBarrier::operator->):
+        (JSC::StorageBarrier::operator*):
+        (JSC::StorageBarrier::operator[]):
+        (JSC::StorageBarrier::get):
+
+2011-09-08  Sam Weinig  <sam@webkit.org>
+
+        Remove the Completion object from JSC, I have never liked it
+        https://bugs.webkit.org/show_bug.cgi?id=67755
+
+        Reviewed by Gavin Barraclough.
+
+        - Removes the Completion object and replaces its use with out parameter exceptions.
+        - Remove ComplType and virtual exceptionType() function on JSObject. Replace with
+          ClassInfo for InterruptedExecutionError and TerminatedExecutionError.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        * jsc.cpp:
+        (functionLoad):
+        (functionCheckSyntax):
+        (runWithScripts):
+        (runInteractive):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::toString):
+        (JSC::TerminatedExecutionError::toString):
+        (JSC::createInterruptedExecutionException):
+        * runtime/ExceptionHelpers.h:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::InterruptedExecutionError::create):
+        (JSC::InterruptedExecutionError::createStructure):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        (JSC::TerminatedExecutionError::create):
+        (JSC::TerminatedExecutionError::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSObject.h:
+
+2011-09-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix.
+
+        * dfg/DFGCapabilities.cpp:
+
+2011-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Value profling and execution count profiling is performed even for
+        code that cannot be optimized
+        https://bugs.webkit.org/show_bug.cgi?id=67694
+
+        Reviewed by Gavin Barraclough.
+        
+        This is a 2% speed-up on V8 when tiered compilation is enabled.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::ProgramCodeBlock::canCompileWithDFG):
+        (JSC::EvalCodeBlock::canCompileWithDFG):
+        (JSC::FunctionCodeBlock::canCompileWithDFG):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGCapabilities.cpp: Added.
+        (JSC::DFG::canCompileOpcodes):
+        * dfg/DFGCapabilities.h: Added.
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canCompileEval):
+        (JSC::DFG::canCompileProgram):
+        (JSC::DFG::canCompileFunctionForCall):
+        (JSC::DFG::canCompileFunctionForConstruct):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::shouldEmitProfiling):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+
+2011-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT does not initialize integer tags for PredictInt32 temporaries
+        https://bugs.webkit.org/show_bug.cgi?id=67840
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::initializeVariableTypes):
+
+2011-09-08  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=67771
+
+        Fix sequenceGetByIdSlowCaseInstructionSpace, sequenceGetByIdSlowCaseConstantSpace
+        and patchOffsetGetByIdSlowCaseCall
+        and enables DOUBLE_CONVERSION_CORRECT_DOUBLE_OPERATIONS flag for SH4 platforms.
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JIT.h:
+        * wtf/dtoa/utils.h:
+
+2011-09-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove getUInt32 from JSCell
+        https://bugs.webkit.org/show_bug.cgi?id=67691
+
+        Reviewed by Oliver Hunt.
+
+         We don't use JSCell::getUInt32 anymore, so it has been removed.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+
+2011-09-07  Filip Pizlo  <fpizlo@apple.com>
+
+        PPC build fix.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+
+2011-09-07  Oliver Hunt  <oliver@apple.com>
+
+        Release mode build fix.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::create):
+
+2011-09-06  Oliver Hunt  <oliver@apple.com>
+
+        Remove JSObjectWithGlobalObject
+        https://bugs.webkit.org/show_bug.cgi?id=67689
+
+        Reviewed by Geoff Garen.
+
+        Remove JSObjectWithGlobalObject, and update code to stop using anonymous
+        storage to access the global object that a JSObject comes from.  Largely
+        mechanical change to remove the use of anonymous storage and JSObjectWithGlobalObject.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        (JSC::JSCallbackConstructor::finishCreation):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.cpp:
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::create):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        (JSC::::finishCreation):
+        (JSC::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchGetMethodFast):
+        (JSC::DFG::tryCacheGetMethod):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateJSFunction):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/DatePrototype.cpp:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        (JSC::InternalFunction::finishCreation):
+        * runtime/InternalFunction.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        (JSC::JSONObject::finishCreation):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::globalObject):
+        * runtime/JSObjectWithGlobalObject.cpp: Removed.
+        * runtime/JSObjectWithGlobalObject.h: Removed.
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::isValidCallee):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::MathObject::finishCreation):
+        * runtime/MathObject.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        (JSC::RegExpObject::finishCreation):
+        * runtime/RegExpObject.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::globalObject):
+
+2011-09-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Refactor JIT checks for ObjectType into helper functions.
+
+        Rubber stamped by Sam Weinig.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::branchIfNotObject):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfNotObject):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_create_this):
+
+2011-09-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r94627 and r94632.
+        http://trac.webkit.org/changeset/94627
+        http://trac.webkit.org/changeset/94632
+        https://bugs.webkit.org/show_bug.cgi?id=67698
+
+        It broke tests on GTK and Qt (Requested by Ossy on #webkit).
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::create):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction):
+        * API/JSCallbackFunction.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::create):
+        * debugger/DebuggerActivation.h:
+        * jsc.cpp:
+        (GlobalObject::constructorBody):
+        (GlobalObject::GlobalObject):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::create):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::create):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::create):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        (JSC::ErrorConstructor::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/FunctionPrototype.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::create):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::create):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::constructorBody):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        (JSC::NativeErrorPrototype::constructorBody):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::create):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::create):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::create):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        (JSC::StringObject::create):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+
+2011-09-06  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Replace usages of Vector<UChar> with existing StringBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=67079
+
+        Reviewed by Gavin Barraclough.
+
+        This is part of work to support 8-bit string buffers.
+        Adds StringBuilder::characters() because the original Vector<UChar>::data()
+        is widely used.
+        Sets the minimum size of buffer to 16 to prevent possible performance
+        regression. Further performance investigation should be done in
+        https://bugs.webkit.org/show_bug.cgi?id=67084.
+
+        * wtf/Forward.h:
+        * wtf/text/StringBuilder.cpp:
+        (WTF::StringBuilder::appendUninitialized): Sets minimum buffer size to 16 bytes.
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::operator[]):
+        (WTF::StringBuilder::characters): Added.
+
+2011-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix broken snow leopard build
+        https://bugs.webkit.org/show_bug.cgi?id=67693
+
+        Reviewed by Daniel Bates.
+
+        Removed unnecessary symbol export.
+
+        * JavaScriptCore.exp:
+
+2011-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not optimize booleans
+        https://bugs.webkit.org/show_bug.cgi?id=67670
+
+        Reviewed by Gavin Barraclough.
+        
+        This adds boolean value profiling, boolean prediction in the DFG,
+        boolean forward flow propagation in the DFGPropagator, boolean
+        data format in DFG generation info, and comprehensive optimizations
+        based on both boolean prediction and boolean generation info.
+        This is brings the speed-up on v8-richards to 12%, and gives slight
+        speed-ups elsewhere as well.
+        
+        Making this work right required navigating some subtleties in
+        value profiling.  Some functions get compiled with insufficient
+        information because some important path of the function never
+        executed.  In these cases, we wish to fall back on static
+        speculation.  But to do so, we need to ensure that predictions that
+        are inherent in the code (like that GetById almost certainly takes
+        a cell operand) are reflected in predictions that we make in
+        DFGPropagator.  Thus, DFGPropagator now does both backward and
+        forward flow, using a both forward and backward fixpoint.
+        
+        The backward flow in DFGPropagator is a separate static analysis,
+        and needs to keep a set of backward flow abstract values for
+        variables, arguments, and globals.  To make this easy, this patch
+        factors out DFGGraph's prediction tracking capability into
+        DFGPredictionTracker, which now gets used by both DFGGraph (for
+        forward flow predictions) and DFGPropagator (for backward flow
+        predictions).  Backward flow predictions eventually get merged
+        into forward flow ones, but the two are not equivalent: a forward
+        flow prediction is a superset of the backward flow prediction.
+        
+        Debugging these prediction issues required a better understanding
+        of where we fail speculation, and what our value predictions look
+        like.  This patch also adds optional verbose speculation failure
+        (so an informative printf fires whenever speculation failure occurs)
+        and slight improvements to the verbosity in other places.
+
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::numberOfBooleans):
+        (JSC::ValueProfile::probabilityOfBoolean):
+        (JSC::ValueProfile::dump):
+        (JSC::ValueProfile::computeStatistics):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::stronglyPredict):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::dataFormatToString):
+        (JSC::DFG::needDataFormatConversion):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::predictions):
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::predictGlobalVar):
+        (JSC::DFG::Graph::getPrediction):
+        (JSC::DFG::Graph::getGlobalVarPrediction):
+        (JSC::DFG::Graph::isBooleanConstant):
+        (JSC::DFG::Graph::valueOfBooleanConstant):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
+        (JSC::DFG::JITCodeGenerator::isKnownBoolean):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::emitBranch):
+        (JSC::DFG::JITCodeGenerator::speculationCheck):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::isBooleanConstant):
+        (JSC::DFG::JITCodeGenerator::valueOfBooleanConstant):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::debugCall):
+        (JSC::DFG::JITCompiler::isBooleanConstant):
+        (JSC::DFG::JITCompiler::valueOfBooleanConstant):
+        * dfg/DFGNode.h:
+        (JSC::DFG::isBooleanPrediction):
+        (JSC::DFG::predictionToString):
+        (JSC::DFG::mergePredictions):
+        (JSC::DFG::makePrediction):
+        (JSC::DFG::Node::isBooleanConstant):
+        (JSC::DFG::Node::valueOfBooleanConstant):
+        (JSC::DFG::Node::hasBooleanResult):
+        (JSC::DFG::Node::hasNumericResult):
+        (JSC::DFG::Node::predict):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionTracker.h: Added.
+        (JSC::DFG::operandIsArgument):
+        (JSC::DFG::PredictionSlot::PredictionSlot):
+        (JSC::DFG::PredictionTracker::PredictionTracker):
+        (JSC::DFG::PredictionTracker::initializeSimilarTo):
+        (JSC::DFG::PredictionTracker::numberOfArguments):
+        (JSC::DFG::PredictionTracker::numberOfVariables):
+        (JSC::DFG::PredictionTracker::argumentOffsetForOperand):
+        (JSC::DFG::PredictionTracker::predictArgument):
+        (JSC::DFG::PredictionTracker::predict):
+        (JSC::DFG::PredictionTracker::predictGlobalVar):
+        (JSC::DFG::PredictionTracker::getArgumentPrediction):
+        (JSC::DFG::PredictionTracker::getPrediction):
+        (JSC::DFG::PredictionTracker::getGlobalVarPrediction):
+        * dfg/DFGPropagator.cpp:
+        (JSC::DFG::Propagator::Propagator):
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::setPrediction):
+        (JSC::DFG::Propagator::mergeUse):
+        (JSC::DFG::Propagator::mergePrediction):
+        (JSC::DFG::Propagator::propagateNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        (JSC::DFG::SpeculateBooleanOperand::~SpeculateBooleanOperand):
+        (JSC::DFG::SpeculateBooleanOperand::index):
+        (JSC::DFG::SpeculateBooleanOperand::gpr):
+        (JSC::DFG::SpeculateBooleanOperand::use):
+        * runtime/JSGlobalData.h:
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+
+2011-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unzip initialization lists and constructors in JSCell hierarchy (5/7)
+        https://bugs.webkit.org/show_bug.cgi?id=67420
+
+        Reviewed by Geoffrey Garen.
+
+        Completed the fifth level of the refactoring to add finishCreation() 
+        methods to all classes within the JSCell hierarchy with non-trivial 
+        constructor bodies.
+
+        This primarily consists of pushing the calls to finishCreation() down 
+        into the constructors of the subclasses of the second level of the hierarchy 
+        as well as pulling the finishCreation() calls out into the class's corresponding
+        create() method if it has one.  Doing both simultaneously allows us to 
+        maintain the invariant that the finishCreation() method chain is called exactly 
+        once during the creation of an object, since calling it any other number of 
+        times (0, 2, or more) will cause an assertion failure.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::create):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction):
+        (JSC::JSCallbackFunction::finishCreation):
+        * API/JSCallbackFunction.h:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::create):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (GlobalObject::GlobalObject):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::ArrayConstructor::finishCreation):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::create):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::BooleanConstructor::finishCreation):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::create):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        (JSC::BooleanPrototype::finishCreation):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::DateConstructor::finishCreation):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::create):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        (JSC::DatePrototype::finishCreation):
+        * runtime/DatePrototype.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        (JSC::ErrorConstructor::finishCreation):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        (JSC::FunctionConstructor::finishCreation):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::finishCreation):
+        * runtime/FunctionPrototype.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::create):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::create):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        (JSC::NativeErrorPrototype::finishCreation):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::NumberConstructor::finishCreation):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::create):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        (JSC::NumberPrototype::finishCreation):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/ObjectConstructor.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpConstructor::finishCreation):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::create):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::create):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        (JSC::StringConstructor::finishCreation):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        (JSC::StringObject::create):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        (JSC::StringPrototype::finishCreation):
+        * runtime/StringPrototype.h:
+
+2011-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Accessibility tests crashing in BasicRawSentinelNode code
+        https://bugs.webkit.org/show_bug.cgi?id=67682
+
+        Reviewed by Geoffrey Garen.
+        
+        A CodeBlock should ensure that no other CodeBlocks have references to it after
+        it is destroyed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+
+2011-09-06  Yong Li  <yoli@rim.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=67486
+        This reverts r65993 which gives wrong results for rshift
+        in some corner cases (see the test).
+
+        Reviewed by Gavin Barraclough.
+
+        New test: fast/js/floating-point-truncate-rshift.html
+
+        * assembler/ARMAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+
+2011-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for r94559.
+        
+        Marked the relevant parameters as unused if !ENABLE(JIT), and surrounded
+        new out-of-line JIT-specific method definitions with !ENABLE(JIT).
+
+        * bytecode/CodeBlock.cpp:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+
+2011-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix broken PPC build due to new dtoa library
+        https://bugs.webkit.org/show_bug.cgi?id=67654
+
+        Reviewed by Dan Bernstein.
+
+        Added condition for PPC in the new dtoa compatibility check so that
+        building won't fail.
+
+        * wtf/dtoa/utils.h:
+
+2011-09-05  Oliver Hunt  <oliver@apple.com>
+
+        An object's structure should reference the global object responsible for its creation
+        https://bugs.webkit.org/show_bug.cgi?id=67624
+
+        Reviewed by Gavin Barraclough.
+
+        Add a reference to a GlobalObject to Structure, and update all calls to
+        Structure::create() to pass the global object that is the origin for that
+        structure.  For objects where the appropriate global object isn't available
+        at construction time (global object prototypes, etc), or objects that
+        logically don't have a global object (strings, etc) we just pass null.
+
+        This change is largely mechanical (passing a new globalObject parameter
+        around).
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::createStructure):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::createStructure):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::createStructure):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::createEmptyObjectStructure):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        (JSC::NativeErrorConstructor::constructorBody):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::createStructure):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::createStructure):
+        * runtime/RegExp.h:
+        (JSC::RegExp::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::createStructure):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::createStructure):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::globalObject):
+        (JSC::Structure::setGlobalObject):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+
+2011-09-06  Michael Saboff  <msaboff@apple.com>
+
+        Add windows changes for JSC:RegExp functional tests
+        https://bugs.webkit.org/show_bug.cgi?id=67521
+
+        Windows build changes for regular expression functional test.
+
+        Rubber-stamped by Gavin Barraclough.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/testRegExp: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpPostBuild.cmd: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpPreBuild.cmd: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpPreLink.cmd: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops: Added.
+
+2011-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        JavaScriptCore does not have tiered compilation
+        https://bugs.webkit.org/show_bug.cgi?id=67176
+
+        Reviewed by Gavin Barraclough.
+        
+        This adds the ability to have multiple CodeBlocks associated with
+        a particular role in an Executable.  These are stored in
+        descending order of compiler tier.  CodeBlocks are optimized when
+        a counter (m_executeCounter) that is incremented in loops and
+        epilogues becomes positive.  Optimizing means that all calls to
+        the old CodeBlock are unlinked.
+        
+        The DFG can now pull in predictions from ValueProfiles, and
+        propagate them along the graph.  To support the new phase while
+        maintaing some level of abstraction, a DFGDriver was introduced
+        that encapsulates how to run the DFG compiler.
+        
+        This is turned off by default because it's not yet a performance
+        win on all benchmarks.  It speeds up crypto and richards by
+        10% and 6% respectively, but still does not do as good of a job
+        as it could.  Notably, the DFG backend has not changed, and
+        is largely oblivious to the new information being made available
+        to it.
+        
+        When turned off (the default), this patch is performance neutral.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::branchAdd32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchAdd32):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CallLinkInfo::unlink):
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::clearEvalCache):
+        (JSC::replaceExistingEntries):
+        (JSC::CodeBlock::copyDataFromAlternative):
+        (JSC::ProgramCodeBlock::replacement):
+        (JSC::EvalCodeBlock::replacement):
+        (JSC::FunctionCodeBlock::replacement):
+        (JSC::ProgramCodeBlock::compileOptimized):
+        (JSC::EvalCodeBlock::compileOptimized):
+        (JSC::FunctionCodeBlock::compileOptimized):
+        * bytecode/CodeBlock.h:
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::dump):
+        (JSC::ValueProfile::computeStatistics):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::dynamicallyPredict):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::parse):
+        * dfg/DFGDriver.cpp: Added.
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h: Added.
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::predictGlobalVar):
+        (JSC::DFG::Graph::isConstant):
+        (JSC::DFG::Graph::isJSConstant):
+        (JSC::DFG::Graph::isInt32Constant):
+        (JSC::DFG::Graph::isDoubleConstant):
+        (JSC::DFG::Graph::valueOfJSConstant):
+        (JSC::DFG::Graph::valueOfInt32Constant):
+        (JSC::DFG::Graph::valueOfDoubleConstant):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::isConstant):
+        (JSC::DFG::JITCompiler::isJSConstant):
+        (JSC::DFG::JITCompiler::isInt32Constant):
+        (JSC::DFG::JITCompiler::isDoubleConstant):
+        (JSC::DFG::JITCompiler::valueOfJSConstant):
+        (JSC::DFG::JITCompiler::valueOfInt32Constant):
+        (JSC::DFG::JITCompiler::valueOfDoubleConstant):
+        * dfg/DFGNode.h:
+        (JSC::DFG::isCellPrediction):
+        (JSC::DFG::isNumberPrediction):
+        (JSC::DFG::predictionToString):
+        (JSC::DFG::mergePrediction):
+        (JSC::DFG::makePrediction):
+        (JSC::DFG::Node::valueOfJSConstant):
+        (JSC::DFG::Node::isInt32Constant):
+        (JSC::DFG::Node::isDoubleConstant):
+        (JSC::DFG::Node::valueOfInt32Constant):
+        (JSC::DFG::Node::valueOfDoubleConstant):
+        (JSC::DFG::Node::predict):
+        * dfg/DFGPropagation.cpp: Added.
+        (JSC::DFG::Propagator::Propagator):
+        (JSC::DFG::Propagator::fixpoint):
+        (JSC::DFG::Propagator::setPrediction):
+        (JSC::DFG::Propagator::mergePrediction):
+        (JSC::DFG::Propagator::propagateNode):
+        (JSC::DFG::Propagator::propagateForward):
+        (JSC::DFG::Propagator::propagateBackward):
+        (JSC::DFG::propagate):
+        * dfg/DFGPropagation.h: Added.
+        (JSC::DFG::propagate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkFor):
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::Node::Node):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkFor):
+        * jit/JIT.h:
+        (JSC::JIT::emitOptimizationCheck):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITCode.h:
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::bottomTierJIT):
+        (JSC::JITCode::topTierJIT):
+        (JSC::JITCode::nextTierJIT):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileOptimized):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::compileOptimizedFor):
+        * wtf/Platform.h:
+        * wtf/SentinelLinkedList.h:
+        (WTF::BasicRawSentinelNode::BasicRawSentinelNode):
+        (WTF::BasicRawSentinelNode::setPrev):
+        (WTF::BasicRawSentinelNode::setNext):
+        (WTF::BasicRawSentinelNode::prev):
+        (WTF::BasicRawSentinelNode::next):
+        (WTF::BasicRawSentinelNode::isOnList):
+        (WTF::::remove):
+        (WTF::::SentinelLinkedList):
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::push):
+
+2011-09-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r94445 and r94448.
+        http://trac.webkit.org/changeset/94445
+        http://trac.webkit.org/changeset/94448
+        https://bugs.webkit.org/show_bug.cgi?id=67595
+
+        It broke everything (Requested by ossy on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/NewSpace.cpp:
+        (JSC::NewSpace::NewSpace):
+        * heap/NewSpace.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        (JSC::JSObject::visitChildrenDirect):
+
+2011-09-05  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for r94452.
+
+        Add config.h as the first header to the cc files as required by the coding style.
+        Reuse macros from Assertions.h instead of adding addional #ifdefs.
+
+        * wtf/dtoa/bignum-dtoa.cc:
+        * wtf/dtoa/bignum.cc:
+        * wtf/dtoa/cached-powers.cc:
+        * wtf/dtoa/diy-fp.cc:
+        * wtf/dtoa/double-conversion.cc:
+        * wtf/dtoa/fast-dtoa.cc:
+        * wtf/dtoa/fixed-dtoa.cc:
+        * wtf/dtoa/strtod.cc:
+        * wtf/dtoa/utils.h:
+
+2011-09-05  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Fix the build
+
+        Rubber-stamped by Csaba Osztrogonác.
+
+        * wtf/dtoa/double-conversion.cc: Remove dead variable in file added in r94452.
+        The variable fractional_part is only set but never used.
+
+2011-09-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION (r94452): 20 http/tests tests failing on Qt Linux Release
+        https://bugs.webkit.org/show_bug.cgi?id=67562
+
+        Reviewed by Darin Adler.
+
+        Fixing the build (again which was broken by the dtoa patch.  Needed 
+        to make sure WTF::double_conversion::initialize() is called for Qt
+        as well as adding a check for WinCE in dtoa/utils.h
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * wtf/dtoa/cached-powers.cc:
+        * wtf/dtoa/utils.h:
+
+2011-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        ThunkGenerators does not convert positive double zero into integer zero
+        https://bugs.webkit.org/show_bug.cgi?id=67553
+
+        Reviewed by Gavin Barraclough.
+        
+        This is an 0.5% speed-up on V8 and neutral elsewhere.
+
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnDouble):
+
+2011-09-03  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Add wtf/dtoa directory to build.
+
+        * wscript:
+
+2011-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG variable predictions only work for local variables, not temporaries
+        https://bugs.webkit.org/show_bug.cgi?id=67554
+
+        Reviewed by Gavin Barraclough.
+        
+        This appears to be a slight speed-up in Kraken (0.3% but significant)
+        and neutral elsewhere.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+
+2011-09-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT speculation failure does recovery of additions in reverse and
+        doesn't rebox
+        https://bugs.webkit.org/show_bug.cgi?id=67551
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+
+2011-09-02  Filip Pizlo  <fpizlo@apple.com>
+
+        ValueProfile does not make it safe to introspect cell values
+        after garbage collection
+        https://bugs.webkit.org/show_bug.cgi?id=67354
+
+        Reviewed by Gavin Barraclough.
+        
+        ValueProfile buckets are now weak references, implemented using a
+        light-weight weak reference mechanism that this patch also adds (the
+        WeakReferenceHarvester).  If a cell stored in a ValueProfile bucket
+        is not marked, then the bucket is transformed into a Structure
+        pointer.  If the Structure is not marked either, then it is turned
+        into a ClassInfo pointer.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::visitWeakReferences):
+        * bytecode/CodeBlock.h:
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfile::ValueProfile):
+        (JSC::ValueProfile::classInfo):
+        (JSC::ValueProfile::numberOfInt32s):
+        (JSC::ValueProfile::numberOfDoubles):
+        (JSC::ValueProfile::numberOfCells):
+        (JSC::ValueProfile::numberOfArrays):
+        (JSC::ValueProfile::probabilityOfArray):
+        (JSC::ValueProfile::WeakBucket::WeakBucket):
+        (JSC::ValueProfile::WeakBucket::operator!):
+        (JSC::ValueProfile::WeakBucket::isEmpty):
+        (JSC::ValueProfile::WeakBucket::isClassInfo):
+        (JSC::ValueProfile::WeakBucket::isStructure):
+        (JSC::ValueProfile::WeakBucket::asStructure):
+        (JSC::ValueProfile::WeakBucket::asClassInfo):
+        (JSC::ValueProfile::WeakBucket::getClassInfo):
+        * heap/Heap.cpp:
+        (JSC::Heap::harvestWeakReferences):
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::harvestWeakReferences):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::addWeakReferenceHarvester):
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::appendUnbarrieredPointer):
+        * heap/SlotVisitor.h:
+        * heap/WeakReferenceHarvester.h: Added.
+        (JSC::WeakReferenceHarvester::WeakReferenceHarvester):
+        (JSC::WeakReferenceHarvester::~WeakReferenceHarvester):
+
+2011-09-02  Michael Saboff  <msaboff@apple.com>
+
+        Replace local implementation of string equals() methods with UString versions
+        https://bugs.webkit.org/show_bug.cgi?id=67342
+
+        In preparation to allowing StringImpl to be backed by 8 bit 
+        characters when appropriate, we need to eliminate or change the
+        usage of StringImpl::characters(). Change the uses of characters()
+        that are used to implement redundant equals() methods.
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::equal):
+        * runtime/Identifier.h:
+        (JSC::Identifier::equal):
+        * wtf/text/AtomicString.cpp:
+        (WTF::CStringTranslator::equal): Moved an optimized method to here.
+        (WTF::operator==):
+        * wtf/text/StringImpl.cpp:
+        (WTF::equal):
+        * wtf/text/StringImpl.h:
+
+2011-09-02  Michael Saboff  <msaboff@apple.com>
+
+        Add JSC:RegExp functional tests
+        https://bugs.webkit.org/show_bug.cgi?id=67339
+
+        Added new test driver program (testRegExp) and corresponding data file
+        along with build scripts changes.
+
+        Reviewed by Gavin Barraclough.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * testRegExp.cpp: Added.
+        (Options::Options):
+        (StopWatch::start):
+        (StopWatch::stop):
+        (StopWatch::getElapsedMS):
+        (RegExpTest::RegExpTest):
+        (GlobalObject::create):
+        (GlobalObject::className):
+        (GlobalObject::GlobalObject):
+        (main):
+        (cleanupGlobalData):
+        (testOneRegExp):
+        (scanString):
+        (parseRegExpLine):
+        (parseTestLine):
+        (runFromFiles):
+        (printUsageStatement):
+        (parseArguments):
+        (realMain):
+        * tests/regexp: Added.
+        * tests/regexp/RegExpTest.data: Added.
+
+2011-09-02  Michael Saboff  <msaboff@apple.com>
+
+        Add JSC:RegExp functional test data generator
+        https://bugs.webkit.org/show_bug.cgi?id=67519
+
+        Add a data generator for regular expressions.  To enable, change the
+        #undef REGEXP_FUNC_TEST_DATA_GEN to #define.  Then compile and use
+        regular expressions.  The resulting data will be in /tmp/RegExpTestsData.
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/RegExp.cpp:
+        (JSC::regExpFlags):
+        (JSC::RegExpFunctionalTestCollector::clearRegExp):
+        (JSC::RegExpFunctionalTestCollector::get):
+        (JSC::RegExpFunctionalTestCollector::outputOneTest):
+        (JSC::RegExpFunctionalTestCollector::RegExpFunctionalTestCollector):
+        (JSC::RegExpFunctionalTestCollector::~RegExpFunctionalTestCollector):
+        (JSC::RegExpFunctionalTestCollector::outputEscapedUString):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::matchCompareWithInterpreter):
+
+2011-09-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the broken build due to dtoa patch
+        https://bugs.webkit.org/show_bug.cgi?id=67534
+
+        Reviewed by Oliver Hunt.
+
+        Fixing the build.
+
+        * GNUmakefile.list.am:
+        * wtf/dtoa/bignum.cc:
+        * wtf/dtoa/fast-dtoa.cc:
+        * wtf/dtoa/utils.h:
+
+2011-09-02  Oliver Hunt  <oliver@apple.com>
+
+        Remove OldSpace classes
+        https://bugs.webkit.org/show_bug.cgi?id=67533
+
+        Reviewed by Gavin Barraclough.
+
+        Remove the unused OldSpace classes
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::writeBarrierSlowCase):
+        * heap/MarkedBlock.h:
+        * heap/OldSpace.cpp: Removed.
+        * heap/OldSpace.h: Removed.
+
+2011-09-02  James Robinson  <jamesr@chromium.org>
+
+        Compile fix for mac build.
+
+        * wtf/CheckedArithmetic.h:
+        (WTF::operator+):
+        (WTF::operator-):
+        (WTF::operator*):
+
+2011-08-30  Matthew Delaney  <mdelaney@apple.com>
+
+        Read out of bounds in sUnpremultiplyData_RGBA8888 / ImageBufferData::getData
+        https://bugs.webkit.org/show_bug.cgi?id=65352
+
+        Reviewed by Simon Fraser.
+
+        New test: fast/canvas/canvas-getImageData-large-crash.html
+
+        This patch prevents overflows from happening in getImageData, createImageData, and canvas creation
+        calls that specify widths and heights that end up overflowing the ints that we store those values in
+        as well as derived values such as area and maxX / maxY of the bounding rects involved. Overflow of integer
+        arithmetic is detected via the use of the new Checked type that was introduced in r94207. The change to JSC
+        is just to add a new helper method described below.
+
+        * wtf/MathExtras.h:
+        (isWithinIntRange): Reports if a float's value is within the range expressible by an int.
+
+2011-09-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Incorporate newer, faster dtoa library
+        https://bugs.webkit.org/show_bug.cgi?id=66346
+
+        Reviewed by Oliver Hunt.
+
+        Added new dtoa library at http://code.google.com/p/double-conversion/.
+        Replaced old call to dtoa.  The new library is much faster than the old one.
+        We still use the old dtoa for some stuff in WebCore as well as the old strtod, 
+        but we can phase these out eventually as well.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/InitializeThreading.cpp:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/UString.cpp:
+        (JSC::UString::number):
+        * wtf/CMakeLists.txt:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeThreading):
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+        * wtf/dtoa/COPYING: Added.
+        * wtf/dtoa/LICENSE: Added.
+        * wtf/dtoa/README: Added.
+        * wtf/dtoa/bignum-dtoa.cc: Added.
+        * wtf/dtoa/bignum-dtoa.h: Added.
+        * wtf/dtoa/bignum.cc: Added.
+        * wtf/dtoa/bignum.h: Added.
+        (WTF::double_conversion::Bignum::Times10):
+        (WTF::double_conversion::Bignum::Equal):
+        (WTF::double_conversion::Bignum::LessEqual):
+        (WTF::double_conversion::Bignum::Less):
+        (WTF::double_conversion::Bignum::PlusEqual):
+        (WTF::double_conversion::Bignum::PlusLessEqual):
+        (WTF::double_conversion::Bignum::PlusLess):
+        (WTF::double_conversion::Bignum::EnsureCapacity):
+        (WTF::double_conversion::Bignum::BigitLength):
+        * wtf/dtoa/cached-powers.cc: Added.
+        * wtf/dtoa/cached-powers.h: Added.
+        * wtf/dtoa/diy-fp.cc: Added.
+        * wtf/dtoa/diy-fp.h: Added.
+        (WTF::double_conversion::DiyFp::DiyFp):
+        (WTF::double_conversion::DiyFp::Subtract):
+        (WTF::double_conversion::DiyFp::Minus):
+        (WTF::double_conversion::DiyFp::Times):
+        (WTF::double_conversion::DiyFp::Normalize):
+        (WTF::double_conversion::DiyFp::f):
+        (WTF::double_conversion::DiyFp::e):
+        (WTF::double_conversion::DiyFp::set_f):
+        (WTF::double_conversion::DiyFp::set_e):
+        * wtf/dtoa/double-conversion.cc: Added.
+        * wtf/dtoa/double-conversion.h: Added.
+        (WTF::double_conversion::DoubleToStringConverter::DoubleToStringConverter):
+        (WTF::double_conversion::StringToDoubleConverter::StringToDoubleConverter):
+        * wtf/dtoa/double.h: Added.
+        (WTF::double_conversion::double_to_uint64):
+        (WTF::double_conversion::uint64_to_double):
+        (WTF::double_conversion::Double::Double):
+        (WTF::double_conversion::Double::AsDiyFp):
+        (WTF::double_conversion::Double::AsNormalizedDiyFp):
+        (WTF::double_conversion::Double::AsUint64):
+        (WTF::double_conversion::Double::NextDouble):
+        (WTF::double_conversion::Double::Exponent):
+        (WTF::double_conversion::Double::Significand):
+        (WTF::double_conversion::Double::IsDenormal):
+        (WTF::double_conversion::Double::IsSpecial):
+        (WTF::double_conversion::Double::IsNan):
+        (WTF::double_conversion::Double::IsInfinite):
+        (WTF::double_conversion::Double::Sign):
+        (WTF::double_conversion::Double::UpperBoundary):
+        (WTF::double_conversion::Double::NormalizedBoundaries):
+        (WTF::double_conversion::Double::value):
+        (WTF::double_conversion::Double::SignificandSizeForOrderOfMagnitude):
+        (WTF::double_conversion::Double::Infinity):
+        (WTF::double_conversion::Double::NaN):
+        (WTF::double_conversion::Double::DiyFpToUint64):
+        * wtf/dtoa/fast-dtoa.cc: Added.
+        * wtf/dtoa/fast-dtoa.h: Added.
+        * wtf/dtoa/fixed-dtoa.cc: Added.
+        * wtf/dtoa/fixed-dtoa.h: Added.
+        * wtf/dtoa/strtod.cc: Added.
+        * wtf/dtoa/strtod.h: Added.
+        * wtf/dtoa/utils.h: Added.
+        (WTF::double_conversion::Max):
+        (WTF::double_conversion::Min):
+        (WTF::double_conversion::StrLength):
+        (WTF::double_conversion::Vector::Vector):
+        (WTF::double_conversion::Vector::SubVector):
+        (WTF::double_conversion::Vector::length):
+        (WTF::double_conversion::Vector::is_empty):
+        (WTF::double_conversion::Vector::start):
+        (WTF::double_conversion::Vector::operator[]):
+        (WTF::double_conversion::Vector::first):
+        (WTF::double_conversion::Vector::last):
+        (WTF::double_conversion::StringBuilder::StringBuilder):
+        (WTF::double_conversion::StringBuilder::~StringBuilder):
+        (WTF::double_conversion::StringBuilder::size):
+        (WTF::double_conversion::StringBuilder::position):
+        (WTF::double_conversion::StringBuilder::Reset):
+        (WTF::double_conversion::StringBuilder::AddCharacter):
+        (WTF::double_conversion::StringBuilder::AddString):
+        (WTF::double_conversion::StringBuilder::AddSubstring):
+        (WTF::double_conversion::StringBuilder::AddPadding):
+        (WTF::double_conversion::StringBuilder::Finalize):
+        (WTF::double_conversion::StringBuilder::is_finalized):
+        (WTF::double_conversion::BitCast):
+        * wtf/wtf.pri:
+
+2011-09-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG graph has no way of distinguishing or reconciling between static
+        and dynamic predictions
+        https://bugs.webkit.org/show_bug.cgi?id=67343
+
+        Reviewed by Gavin Barraclough.
+        
+        PredictedType now stores the source of the prediction.  Merging predictions,
+        which was previously done with a bitwise or, is now done via the
+        mergePredictions (equivalent to |) and mergePrediction (equivalent to |=)
+        functions, which correctly handle combinations of static and dynamic.
+        
+        This is performance-neutral, since all predictions are currently static and
+        so the code has no visible effects.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::staticallyPredictArray):
+        (JSC::DFG::ByteCodeParser::staticallyPredictInt32):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::predictGlobalVar):
+        * dfg/DFGNode.h:
+        (JSC::DFG::isArrayPrediction):
+        (JSC::DFG::isInt32Prediction):
+        (JSC::DFG::isDoublePrediction):
+        (JSC::DFG::isDynamicPrediction):
+        (JSC::DFG::mergePredictions):
+        (JSC::DFG::mergePrediction):
+        (JSC::DFG::makePrediction):
+        (JSC::DFG::Node::predict):
+
+2011-09-02  Oliver Hunt  <oliver@apple.com>
+
+        Fix 32bit build.
+
+        * heap/NewSpace.h:
+        (JSC::NewSpace::allocatePropertyStorage):
+        (JSC::NewSpace::inPropertyStorageNursery):
+
+2011-09-02  Oliver Hunt  <oliver@apple.com>
+
+        Use bump allocator for initial property storage
+        https://bugs.webkit.org/show_bug.cgi?id=67494
+
+        Reviewed by Gavin Barraclough.
+
+        Switch to a bump allocator for the initial out of line
+        property storage.  This gives us slightly faster allocation
+        for short lived objects that need out of line storage at
+        the cost of an additional memcpy when the object survives
+        a GC pass.
+
+        No performance impact.
+
+        * JavaScriptCore.exp:
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (JSC::Heap::allocatePropertyStorage):
+        (JSC::Heap::inPropertyStorageNursary):
+        * heap/NewSpace.cpp:
+        (JSC::NewSpace::NewSpace):
+        * heap/NewSpace.h:
+        (JSC::NewSpace::resetPropertyStorageNursary):
+        (JSC::NewSpace::allocatePropertyStorage):
+        (JSC::NewSpace::inPropertyStorageNursary):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        (JSC::JSObject::visitChildrenDirect):
+
+2011-09-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
+        * JavaScriptCore.exp:
+
+2011-09-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unzip initialization lists and constructors in JSCell hierarchy (4/7)
+        https://bugs.webkit.org/show_bug.cgi?id=67174
+
+        Reviewed by Oliver Hunt.
+
+        Completed the fourth level of the refactoring to add finishCreation() 
+        methods to all classes within the JSCell hierarchy with non-trivial 
+        constructor bodies.
+
+        This primarily consists of pushing the calls to finishCreation() down 
+        into the constructors of the subclasses of the second level of the hierarchy 
+        as well as pulling the finishCreation() calls out into the class's corresponding
+        create() method if it has one.  Doing both simultaneously allows us to 
+        maintain the invariant that the finishCreation() method chain is called exactly 
+        once during the creation of an object, since calling it any other number of 
+        times (0, 2, or more) will cause an assertion failure.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        (JSC::JSCallbackConstructor::finishCreation):
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::create):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        (JSC::::finishCreation):
+        * JavaScriptCore.JSVALUE64only.exp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::create):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::createNoParameters):
+        (JSC::Arguments::Arguments):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        (JSC::BooleanObject::finishCreation):
+        * runtime/BooleanObject.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        (JSC::DateInstance::finishCreation):
+        * runtime/DateInstance.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        (JSC::ErrorPrototype::finishCreation):
+        * runtime/ErrorPrototype.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::InterruptedExecutionError::create):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        (JSC::TerminatedExecutionError::create):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::create):
+        (JSC::FunctionExecutable::create):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        (JSC::InternalFunction::finishCreation):
+        * runtime/InternalFunction.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::finishCreation):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::create):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::create):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::finishCreation):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        (JSC::JSNotAnObject::create):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        (JSC::JSONObject::finishCreation):
+        * runtime/JSONObject.h:
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSObjectWithGlobalObject.h:
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::create):
+        (JSC::JSStaticScopeObject::finishCreation):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::MathObject::finishCreation):
+        * runtime/MathObject.h:
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        (JSC::NumberObject::finishCreation):
+        * runtime/NumberObject.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::create):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::finishCreation):
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        (JSC::RegExpObject::finishCreation):
+        * runtime/RegExpObject.h:
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::create):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        (JSC::StringObject::finishCreation):
+        * runtime/StringObject.h:
+
+2011-09-01  Daniel Bates  <dbates@rim.com>
+
+        QNX GCC distribution doesn't support vasprintf()
+        https://bugs.webkit.org/show_bug.cgi?id=67423
+
+        Reviewed by Antonio Gomes.
+
+        * wtf/Platform.h: Don't enable HAVE_VASPRINTF when building with GCC on QNX.
+
+2011-09-01  Michael Saboff  <msaboff@apple.com>
+
+        Remove simple usage of UString::characters() from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=67340
+
+        In preparation to allowing StringImpl to be backed by 8 bit 
+        characters when appropriate, we need to eliminate or change the
+        usage of StringImpl::characters().  Most of the changes below
+        change s->characters()[0] to s[0].
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::processClauseList):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::jsToNumber):
+        (JSC::parseFloat):
+        * runtime/JSString.cpp:
+        (JSC::JSString::substringFromRope):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/RegExp.cpp:
+        (JSC::regExpFlags):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::operator[]):
+
+2011-09-01  Ada Chan  <adachan@apple.com>
+
+        Export fastMallocStatistics and Heap::objectTypeCounts for https://bugs.webkit.org/show_bug.cgi?id=67160.
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-09-01  Hao Zheng  <zhenghao@chromium.org>
+
+        Define PTHREAD_KEYS_MAX to fix Android port build.
+        https://bugs.webkit.org/show_bug.cgi?id=67362
+
+        Reviewed by Adam Barth.
+
+        PTHREAD_KEYS_MAX is not defined in bionic, so explicitly define it.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp:
+
+2011-08-31  Oliver Hunt  <oliver@apple.com>
+
+        Fix build.
+
+        * wtf/CheckedArithmetic.h:
+        (WTF::Checked::Checked):
+        (WTF::Checked::operator=):
+
+2011-08-31  Oliver Hunt  <oliver@apple.com>
+
+        fast/regex/overflow.html asserts in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=67326
+
+        Reviewed by Gavin Barraclough.
+
+        The deliberate overflows in these expressions don't interact nicely
+        with Checked<32bit-type> so we just bump up to Checked<int64_t> for the
+        intermediate calculations.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+
+2011-08-31  Jeff Miller  <jeffm@apple.com>
+
+        REGRESSION(92210): AVFoundation media engine is disabled on OS X
+        https://bugs.webkit.org/show_bug.cgi?id=67316
+
+        Move the definition of WTF_USE_AVFOUNDATION on the Mac back to JavaScriptCore/wtf/Platform.h,
+        since WebKit2 doesn't have access to WebCore/config.h on this platform. This reverts the
+        changes that were made in r92210.
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Added definition of WTF_USE_AVFOUNDATION on the Mac.
+
+2011-08-31  Peter Beverloo  <peter@chromium.org>
+
+        Add Android's platform specification and the right atomic functions.
+        https://bugs.webkit.org/show_bug.cgi?id=66687
+
+        Reviewed by Adam Barth.
+
+        * wtf/Atomics.h:
+        (WTF::atomicIncrement):
+        (WTF::atomicDecrement):
+        * wtf/Platform.h:
+
+2011-08-30  Oliver Hunt  <oliver@apple.com>
+
+        Add support for checked arithmetic
+        https://bugs.webkit.org/show_bug.cgi?id=67095
+
+        Reviewed by Sam Weinig.
+
+        Add a checked arithmetic class Checked<T> that provides overflow-safe
+        arithmetic over all integral types.  Checked<T> supports addition, subtraction
+        and multiplication, along with "bool" conversions and equality operators.
+
+        Checked<> can be used in either CRASH() on overflow or delayed failure modes,
+        although the default is to CRASH().
+
+        To ensure the code is actually in use (rather than checking in dead code) I've
+        made a couple of properties in YARR use Checked<int> and Checked<unsigned>
+        instead of raw value arithmetic.  This has resulted in a moderate set of changes,
+        to YARR - mostly adding .get() calls, but a couple of casts from unsigned long
+        to unsigned for some uses of sizeof, as Checked<> currently does not support
+        mixed signed-ness of types wider that 32 bits.
+
+        Happily the increased type safety of Checked<> means that it's not possible to
+        accidentally assign away precision, nor accidentally call integer overload of
+        a function instead of the bool version.
+
+        No measurable regression in performance, and SunSpider claims this patch to be
+        a progression of 0.3%.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CheckedArithmetic.h: Added.
+        (WTF::CrashOnOverflow::overflowed):
+        (WTF::CrashOnOverflow::clearOverflow):
+        (WTF::CrashOnOverflow::hasOverflowed):
+        (WTF::RecordOverflow::RecordOverflow):
+        (WTF::RecordOverflow::overflowed):
+        (WTF::RecordOverflow::clearOverflow):
+        (WTF::RecordOverflow::hasOverflowed):
+        (WTF::isInBounds):
+        (WTF::safeAdd):
+        (WTF::safeSub):
+        (WTF::safeMultiply):
+        (WTF::safeEquals):
+        (WTF::workAroundClangBug):
+        (WTF::Checked::Checked):
+        (WTF::Checked::operator=):
+        (WTF::Checked::operator++):
+        (WTF::Checked::operator--):
+        (WTF::Checked::operator!):
+        (WTF::Checked::operator UnspecifiedBoolType*):
+        (WTF::Checked::get):
+        (WTF::Checked::operator+=):
+        (WTF::Checked::operator-=):
+        (WTF::Checked::operator*=):
+        (WTF::Checked::operator==):
+        (WTF::Checked::operator!=):
+        (WTF::operator+):
+        (WTF::operator-):
+        (WTF::operator*):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::CheckInput):
+        (JSC::Yarr::ByteTerm::UncheckInput):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generateAssertionEOL):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassOnce):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
+        * yarr/YarrPattern.h:
+
+2011-08-31  Andrei Popescu  <andreip@google.com>
+
+        Investigate current uses of OS(ANDROID)
+        https://bugs.webkit.org/show_bug.cgi?id=66761
+
+        Unreviewed, build fix for ARM platforms.
+
+        * wtf/Platform.h:
+
+2011-08-31  Andrei Popescu  <andreip@google.com>
+
+        Investigate current uses of OS(ANDROID)
+        https://bugs.webkit.org/show_bug.cgi?id=66761
+
+        Reviewed by Darin Adler.
+
+        Remove the last legacy Android code.
+
+        No new tests needed as the code wasn't tested in the first place.
+
+        * wtf/Atomics.h:
+        * wtf/Platform.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::createThreadInternal):
+
+2011-08-30  Aaron Colwell  <acolwell@chromium.org>
+
+        Add MediaSource API to HTMLMediaElement
+        https://bugs.webkit.org/show_bug.cgi?id=64731
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-08-30  Oliver Hunt  <oliver@apple.com>
+
+        TypedArrays don't ensure that denormalised values are normalised
+        https://bugs.webkit.org/show_bug.cgi?id=67178
+
+        Reviewed by Gavin Barraclough.
+
+        Add a couple of assertions to jsNumber() to ensure that
+        we block signaling NaNs
+
+        * runtime/JSValue.h:
+        (JSC::jsDoubleNumber):
+        (JSC::jsNumber):
+
+2011-08-30  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+
+        [Qt] Do not unconditionally use pkg-config in .pro files
+        https://bugs.webkit.org/show_bug.cgi?id=67055
+
+        Reviewed by Andreas Kling.
+
+        Original patch from Rohan McGovern <rohan.mcgovern@nokia.com>
+
+        Using the first pkg-config in PATH is prone to errors when cross
+        compiling inside the Qt repository (using Qt's build-system).
+
+        This patch protect calls for pkg-config with
+        !contains(QT_CONFIG, no-pkg-config). no-pkg-config is added to
+        QT_CONFIG by Qt's 'configure' when cross-compiling on systems
+        without pkg-config.
+
+        The respective change in Qt's configure has been submited already.
+
+        No new tests as this is just a build change.
+
+        * wtf/wtf.pri: protect pkg-config calls
+
+2011-08-29  Daniel Bates  <dbates@webkit.org>
+
+        Add HAVE(VASPRINTF) macro to test for vasprintf() support
+        https://bugs.webkit.org/show_bug.cgi?id=67156
+
+        Reviewed by Darin Adler.
+
+        Encapsulate testing of vasprintf() support in a HAVE macro
+        instead of hardcoding the list of supported/unsupported
+        compilers at the call site.
+
+        * wtf/Platform.h:
+
+2011-08-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unzip initialization lists and constructors in JSCell hierarchy (3/7)
+        https://bugs.webkit.org/show_bug.cgi?id=67064
+
+        Reviewed by Darin Adler.
+
+        Completed the third level of the refactoring to add finishCreation() 
+        methods to all classes within the JSCell hierarchy with non-trivial 
+        constructor bodies.
+
+        This primarily consists of pushing the calls to finishCreation() down 
+        into the constructors of the subclasses of the second level of the hierarchy 
+        as well as pulling the finishCreation() calls out into the class's corresponding
+        create() method if it has one.  Doing both simultaneously allows us to 
+        maintain the invariant that the finishCreation() method chain is called exactly 
+        once during the creation of an object, since calling it any other number of 
+        times (0, 2, or more) will cause an assertion failure.
+
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::finishCreation):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::create):
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::createNoParameters):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::finishCreation):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::finishCreation):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        Moved the assignment of m_firstLine and m_lastLine into the 
+        FunctionExecutable::finishCreation() method in Executable.h
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::create):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::finishCreation):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::finishCreation):
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::finishCreation):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        * runtime/JSObject.h:
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        (JSC::JSObjectWithGlobalObject::finishCreation):
+        * runtime/JSObjectWithGlobalObject.h:
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        (JSC::JSVariableObject::finishCreation):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        (JSC::ObjectPrototype::finishCreation):
+        * runtime/ObjectPrototype.h:
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+
+2011-08-29  Andreas Kling  <kling@webkit.org>
+
+        Unreviewed build fix after r93990.
+
+        * wtf/HashTable.h:
+
+2011-08-29  Andreas Kling  <kling@webkit.org>
+
+        Viewing a post on reddit.com wastes a lot of memory on event listeners.
+        https://bugs.webkit.org/show_bug.cgi?id=67133
+
+        Reviewed by Darin Adler.
+
+        Add a minimum table size to the HashTraits, instead of having it hard coded.
+        The default value remains at 64, but can now be specialized.
+
+        * runtime/StructureTransitionTable.h:
+        * wtf/HashTable.h:
+        (WTF::HashTable::shouldShrink):
+        (WTF::::expand):
+        (WTF::::checkTableConsistencyExceptSize):
+        * wtf/HashTraits.h:
+
+2011-08-28  Jonathan Liu  <net147@gmail.com>
+
+        Fix build error when compiling with MinGW-w64 by disabling JIT
+        on Windows 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=61235
+
+        Reviewed by Gavin Barraclough.
+
+        The fixed mmap executable allocator for JIT on x86_64 requires
+        sys/mman.h which is not available on Windows.
+
+        * wtf/Platform.h:
+
+2011-08-27  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC::Executable is inconsistent about using weak handle finalizers
+        and destructors for releasing memory
+        https://bugs.webkit.org/show_bug.cgi?id=67072
+
+        Reviewed by Darin Adler.
+        
+        Moved more of the destruction of Executable state into the finalizer,
+        which also resulted in an opportunity to mostly combine this with
+        discardCode().  This also means that the finalizer is now enabled even
+        when the JIT is turned off.  This is performance neutral on SunSpider,
+        V8, and Kraken.
+
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode):
+        (JSC::ExecutableFinalizer::finalize):
+        (JSC::EvalExecutable::clearCode):
+        (JSC::ProgramExecutable::clearCode):
+        (JSC::FunctionExecutable::discardCode):
+        (JSC::FunctionExecutable::clearCode):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::finishCreation):
+
+2011-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG JIT - ArithMod may clobber operands.
+        https://bugs.webkit.org/show_bug.cgi?id=67085
+
+        Reviewed by Sam Weinig.
+
+        unboxDouble must be called on a temporary.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::boxDouble):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2011-08-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unzip initialization lists and constructors in JSCell hierarchy (2/7)
+        https://bugs.webkit.org/show_bug.cgi?id=66957
+
+        Reviewed by Darin Adler.
+
+        Completed the second level of the refactoring to add finishCreation()
+        methods to all classes within the JSCell hierarchy with non-trivial 
+        constructor bodies.
+
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::create):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::finishCreation):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::create):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::create):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSObject.h:
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSC::JSFinalObject::create):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSObject::JSObject):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::createWithoutCaching):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::create):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::finishCreation):
+        (JSC::Structure::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+
+2011-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        The GC does not have a facility for profiling the kinds of objects
+        that occupy the heap
+        https://bugs.webkit.org/show_bug.cgi?id=66849
+
+        Reviewed by Geoffrey Garen.
+        
+        Destructor calls and object scans are now optionally counted, per
+        vtable. When the heap is destroyed and profiling is enabled, the
+        counts are dumped, with care taken to print the names of classes
+        (modulo C++ mangling) sorted in descending commonality.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::destroy):
+        * heap/Heap.h:
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::visitChildren):
+        (JSC::SlotVisitor::drain):
+        * heap/MarkStack.h:
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor):
+        * heap/MarkedBlock.h:
+        * heap/VTableSpectrum.cpp: Added.
+        (JSC::VTableSpectrum::VTableSpectrum):
+        (JSC::VTableSpectrum::~VTableSpectrum):
+        (JSC::VTableSpectrum::countVPtr):
+        (JSC::VTableSpectrum::count):
+        (JSC::VTableAndCount::VTableAndCount):
+        (JSC::VTableAndCount::operator<):
+        (JSC::VTableSpectrum::dump):
+        * heap/VTableSpectrum.h: Added.
+        * wtf/Platform.h:
+
+2011-08-26  Juan C. Montemayor  <jmont@apple.com>
+
+        Update topCallFrame when calling host functions in the JIT
+        https://bugs.webkit.org/show_bug.cgi?id=67010
+
+        Reviewed by Oliver Hunt.
+        
+        The topCallFrame is not being updated when a host function is
+        called by the JIT. This causes problems when trying to create a
+        stack trace (https://bugs.webkit.org/show_bug.cgi?id=66994).
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+
+2011-08-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Get rid of frame life support timer
+        https://bugs.webkit.org/show_bug.cgi?id=66874
+
+        Reviewed by Geoff Garen.
+
+        * runtime/JSGlobalObject.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        globalExec() no longer needs to be virtual, its only override was in JSDOMWindowBase.
+
+2011-08-26  Chao-ying Fu  <fu@mips.com>
+
+        Fix MIPS patchOffsetGetByIdSlowCaseCall
+        https://bugs.webkit.org/show_bug.cgi?id=67046
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JIT.h:
+
+2011-08-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing broken build due to unused variables in release mode
+        https://bugs.webkit.org/show_bug.cgi?id=67004
+
+        Unreviewed, release build fix.
+
+        Fixing broken build due to unused variables in ASSERTs in release build.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::finishCreation):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::finishCreation):
+
+2011-08-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unzip initialization lists and constructors in JSCell hierarchy (1/7)
+        https://bugs.webkit.org/show_bug.cgi?id=66827
+
+        Reviewed by Geoffrey Garen.
+
+        Added finishCreation() methods to all immediately subclasses of JSCell with
+        non-empty constructors.  Part of a larger refactoring to "unzip" initialization
+        lists and constructor bodies.  Also renamed JSCell's constructorBody() method
+        to finishCreation().
+
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::constructorBody):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::constructorBody):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::JSCell):
+        (JSC::JSCell::JSCell::constructorBody):
+        * runtime/JSObject.h:
+        (JSC::JSObject::constructorBody):
+        (JSC::JSObject::JSObject):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::constructorBody):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::constructorBody):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::constructorBody):
+        * runtime/RegExp.h:
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::constructorBody):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::constructorBody):
+
+2011-08-25  Gabor Loki  <loki@webkit.org>
+
+        REGRESSION(r93755): It made 14 jsc test and ~500 layout test fail on Qt-ARM bot
+        https://bugs.webkit.org/show_bug.cgi?id=66956
+
+        Rebaseline constants for patching GetByIdSlowCaseCall on ARM.
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JIT.h:
+
+2011-08-24  Juan C. Montemayor  <jmont@apple.com>
+
+        Keep track of topCallFrame for Stack traces
+        https://bugs.webkit.org/show_bug.cgi?id=66571
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds a TopCallFrame to JSC in order to have that information
+        when an error is thrown to create a stack trace. The TopCallFrame is
+        updated throughout select points in the Interpreter and the JSC.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC::TopCallFrameSetter::TopCallFrameSetter):
+        (JSC::TopCallFrameSetter::~TopCallFrameSetter):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
+        * jit/JITStubs.cpp:
+        (JSC::throwExceptionFromOpCall):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::arityCheckFor):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2011-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        ErrorInstance::create sometimes has two heap object constructions
+        in flight at once
+        https://bugs.webkit.org/show_bug.cgi?id=66845
+
+        Reviewed by Darin Adler.
+        
+        The fix is simple since there is already a second create() method
+        that takes a UString.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::create):
+
+2011-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        There is no facility for profiling how the write barrier is used
+        https://bugs.webkit.org/show_bug.cgi?id=66747
+
+        Reviewed by Geoffrey Garen.
+        
+        Added facilities for the JIT to specify the kind of write barrier
+        being executed.  Added code for profiling the number of each kind
+        of barrier encountered.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::writeBarrier):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::emitCount):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::emitCount):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCachePutByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier):
+        * heap/WriteBarrierSupport.cpp: Added.
+        (JSC::WriteBarrierCounters::initialize):
+        * heap/WriteBarrierSupport.h: Added.
+        (JSC::WriteBarrierCounters::WriteBarrierCounters):
+        (JSC::WriteBarrierCounters::jitCounterFor):
+        (JSC::WriteBarrierCounters::countWriteBarrier):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emitWriteBarrier):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emitWriteBarrier):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+
+2011-08-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add checks to ensure allocation does not take place during initialization of GC-managed objects
+        https://bugs.webkit.org/show_bug.cgi?id=65288
+
+        Reviewed by Darin Adler.
+
+        Adding the new validation functionality.  In its current state, it will performs checks, 
+        but they don't fail unless you do allocation in the arguments to the parent constructor in the 
+        initialization list of a class.  The allocateCell() method turns on the global flag disallowing any new 
+        allocations, and the constructorBody() method in JSCell turns it off.  This way, allocation is still 
+        allowed in constructor bodies while other refactoring efforts continue.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::constructorBody):
+        (JSC::JSCell::JSCell::JSCell):
+        (JSC::JSCell::allocateCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::isInitializingObject):
+        (JSC::JSGlobalData::setInitializingObject):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+
+2011-08-23  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=55347
+        "name" and "message" enumerable on *Error.prototype
+
+        Reviewed by Sam Weinig.
+
+        The default value of a NativeErrorPrototype's message
+        property is "", not the name of the error.
+
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::create):
+        (JSC::NativeErrorConstructor::constructorBody):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        (JSC::NativeErrorPrototype::constructorBody):
+        * runtime/NativeErrorPrototype.h:
+        (JSC::NativeErrorPrototype::create):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::create):
+
+2011-08-23  Steve Block  <steveblock@google.com>
+
+        Remove last occurrences of PLATFORM(ANDROID)
+        https://bugs.webkit.org/show_bug.cgi?id=66763
+
+        Reviewed by Tony Gentilcore.
+
+        * wtf/Platform.h:
+
+2011-08-23  Steve Block  <steveblock@google.com>
+
+        Remove all mention of removed Android files from build scripts
+        https://bugs.webkit.org/show_bug.cgi?id=66755
+
+        Reviewed by Tony Gentilcore.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+
+2011-08-23  Adam Barth  <abarth@webkit.org>
+
+        Remove WebCore/editing/android and other Android-specific directories
+        https://bugs.webkit.org/show_bug.cgi?id=66739
+
+        Reviewed by Steve Block.
+
+        Now that Android shares more code with Chromium, we don't need these
+        Android-specific files.
+
+        * wtf/android: Removed.
+        * wtf/android/AndroidThreading.h: Removed.
+        * wtf/android/MainThreadAndroid.cpp: Removed.
+
+2011-08-23  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for compile error on Windows for r93560.
+
+        * runtime/SamplingCounter.h:
+
+2011-08-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Sampling counter support is in the bytecode directory
+        https://bugs.webkit.org/show_bug.cgi?id=66724
+
+        Reviewed by Darin Adler.
+        
+        Moved SamplingCounter to a separate header in runtime/.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SamplingTool.cpp:
+        * bytecode/SamplingTool.h:
+        * runtime/SamplingCounter.cpp: Added.
+        (JSC::AbstractSamplingCounter::dump):
+        * runtime/SamplingCounter.h: Added.
+        (JSC::AbstractSamplingCounter::count):
+        (JSC::AbstractSamplingCounter::addressOfCounter):
+        (JSC::AbstractSamplingCounter::init):
+        (JSC::SamplingCounter::SamplingCounter):
+        (JSC::GlobalSamplingCounter::name):
+        (JSC::DeletableSamplingCounter::DeletableSamplingCounter):
+        (JSC::DeletableSamplingCounter::~DeletableSamplingCounter):
+
+2011-08-21  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix 'make dist' for WebKitGTK+.
+
+        * GNUmakefile.list.am: Add a missing header to the sources list.
+
+2011-08-20  Filip Pizlo  <fpizlo@apple.com>
+
+        JavaScriptCore bytecompiler does not compute scope depth correctly
+        in the case of constant declarations
+        https://bugs.webkit.org/show_bug.cgi?id=66572
+
+        Reviewed by Oliver Hunt.
+        
+        Changed the handling of const to add the dynamic scope depth.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConstDeclNode::emitCodeSingle):
+
+2011-08-19  Daniel Bates  <dbates@webkit.org>
+
+        Only #include <signal.h> and require SA_RESTART when building with JSC_MULTIPLE_THREADS
+        https://bugs.webkit.org/show_bug.cgi?id=66617
+
+        Both <signal.h> and SA_RESTART usage are guarded behind ENABLE(JSC_MULTIPLE_THREADS).
+        But we cause a compile error if the platform doesn't support SA_RESTART regardless of
+        whether JSC_MULTIPLE_THREADS is enabled for the port. Instead, we shouldn't require
+        SA_RESTART support unless we are building with JSC_MULTIPLE_THREADS enabled.
+
+        Reviewed by Antonio Gomes.
+
+        * heap/MachineStackMarker.cpp:
+
+2011-08-19  Filip Pizlo  <fpizlo@apple.com>
+
+        The JSC JIT currently has no facility to profile and report
+        the types of values
+        https://bugs.webkit.org/show_bug.cgi?id=65901
+
+        Reviewed by Gavin Barraclough.
+        
+        Added the ability to profile the values seen at function calls (both
+        arguments and results) and heap loads.  This is done with emphasis
+        on performance.  A value profiling site consists of: add, and,
+        move, and store; no branching is necessary.  Each value profiling
+        site (called a ValueProfile) has a ring buffer of 8 recently-seen
+        values.  ValueProfiles are stored in the CodeBlock; there will be
+        one for each argument (excluding this) and each heap load or callsite.
+        Each time a value profiling site executes, it stores the value into
+        a pseudo-random element in the ValueProfile buffer.  The point is
+        that for frequently executed code, we will have 8 somewhat recent
+        values in the buffer and will be able to not only figure out what
+        type it is, but also to be able to reason about the actual values
+        if we wish to do so.
+        
+        This feature is currently disabled by default.  When enabled, it
+        results in a 3.7% slow-down on SunSpider.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addValueProfile):
+        (JSC::CodeBlock::numberOfValueProfiles):
+        (JSC::CodeBlock::valueProfile):
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        * bytecode/ValueProfile.h: Added.
+        (JSC::ValueProfile::ValueProfile):
+        (JSC::ValueProfile::numberOfSamples):
+        (JSC::ValueProfile::computeProbability):
+        (JSC::ValueProfile::numberOfInt32s):
+        (JSC::ValueProfile::numberOfDoubles):
+        (JSC::ValueProfile::numberOfCells):
+        (JSC::ValueProfile::probabilityOfInt32):
+        (JSC::ValueProfile::probabilityOfDouble):
+        (JSC::ValueProfile::probabilityOfCell):
+        (JSC::getValueProfileBytecodeOffset):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_call_put_result):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        * jit/JSInterfaceJIT.h:
+        * wtf/Platform.h:
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+        (WTF::genericBinarySearch):
+
+2011-08-19  Daniel Bates  <dbates@webkit.org>
+
+        Don't include DisallowCType.h when building on QNX
+        https://bugs.webkit.org/show_bug.cgi?id=66616
+
+        Reviewed by Antonio Gomes.
+
+        * config.h:
+
+2011-08-19  Daniel Bates  <dbates@webkit.org>
+
+        Implement ExecutableAllocator::cacheFlush() for QNX
+        https://bugs.webkit.org/show_bug.cgi?id=66611
+
+        Reviewed by Antonio Gomes.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2011-08-19  Daniel Bates  <dbates@webkit.org>
+
+        Implement WTF::atomic{Increment, Decrement}() for QNX
+        https://bugs.webkit.org/show_bug.cgi?id=66605
+
+        Reviewed by Darin Adler.
+
+        * wtf/Atomics.h:
+        (WTF::atomicIncrement):
+        (WTF::atomicDecrement):
+
+2011-08-19  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=66590
+        Re-name scrollbar painter types
+
+        Reviewed by Sam Weinig.
+
+        WTF_USE_WK_SCROLLBAR_PAINTER is now WTF_USE_SCROLLBAR_PAINTER since WK no longer 
+        applies.
+        * wtf/Platform.h:
+
+2011-08-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Move allocation in constructors into separate constructorBody() methods
+        https://bugs.webkit.org/show_bug.cgi?id=66265
+
+        Reviewed by Oliver Hunt.
+
+        Refactoring to put all allocations that need to be done after the object's 
+        initialization list has executed but before the object is ready for use 
+        into a separate constructorBody() method.  This method is still called by the constructor, 
+        so the patch doesn't resolve any potential issues, it's just to set up the code for further refactoring.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * jsc.cpp:
+        (GlobalObject::constructorBody):
+        (GlobalObject::GlobalObject):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::constructorBody):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        (JSC::ErrorPrototype::constructorBody):
+        * runtime/ErrorPrototype.h:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::constructorBody):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::constructorBody):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::constructorBody):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::constructorBody):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::constructorBody):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::constructorBody):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::constructorBody):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::constructorBody):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        (JSC::NativeErrorPrototype::constructorBody):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+        (JSC::StringObject::create):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::create):
+
+2011-08-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG non-speculative JIT does not inline the double case of ValueAdd
+        https://bugs.webkit.org/show_bug.cgi?id=66025
+
+        Reviewed by Gavin Barraclough.
+        
+        This is a 1.3% win on Kraken overall, with >=8% speed-ups on a few
+        benchmarks (imaging-darkroom, stanford-crypto-pbkdf2,
+        stanford-crypto-sha256-iterative).  It looks like it might have
+        a speed-up in SunSpider (though not statistically significant or
+        particularly reproducible) and a slight slow-down in V8 (0.14%,
+        not statistically significant).  It does slow down v8-crypto by
+        1.5%.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownInteger):
+        (JSC::DFG::JITCodeGenerator::isKnownNumeric):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+        * dfg/DFGOperations.cpp:
+
+2011-08-18  Filip Pizlo  <fpizlo@apple.com>
+
+        [jsfunfuzz] DFG speculative JIT does divide-by-zero checks incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=66426
+
+        Reviewed by Oliver Hunt.
+        
+        Changed the branchTestPtr to branchTest32.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-08-17  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=66379
+        implements load32WithCompactAddressOffsetPatch function 
+        and fixes store32 and moveWithPatch functions for SH4 platforms.
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::rshift32):
+        (JSC::MacroAssemblerSH4::store32):
+        (JSC::MacroAssemblerSH4::load32WithCompactAddressOffsetPatch):
+        (JSC::MacroAssemblerSH4::moveWithPatch):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::movlMemRegCompact):
+        (JSC::SH4Assembler::readPointer):
+        (JSC::SH4Assembler::repatchCompact):
+        * jit/JIT.h:
+
+2011-08-17  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC verbose debugging output sometimes doesn't work as expected.
+        https://bugs.webkit.org/show_bug.cgi?id=66107
+
+        Reviewed by Gavin Barraclough.
+        
+        Hardened the CodeBlock::dump() code so that it no longer crashes.  Improved
+        the DFG verbose code so that it prints slightly more useful information.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::debugSize):
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfRegExps):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+
+2011-08-16  Michael Saboff  <msaboff@apple.com>
+
+        Crash in Structure::visitChildren running iAd.js regression test suite under memory pressure
+        https://bugs.webkit.org/show_bug.cgi?id=66351
+
+        JIT::privateCompilePutByIdTransition expects that regT0 and regT1
+        have the basePayload and baseTag respectively.  In some cases,
+        we may get to this generated code with one or both of these
+        registers trash.  One know case is that regT0 on ARM may be
+        trashed as regT0 (r0) is also arg0 and can be overrun with sp due
+        to calls to JIT::restoreReturnAddress().  This patch uses the
+        values on the stack.  A longer term solution is to work out all
+        cases so that the register entry assumptions can assured.
+
+        While fixing this, also determined that the additional stack offset
+        of sizeof(void*) is not needed for ARM.
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2011-08-15  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=66263
+        DFG JIT does not always zero extend boolean result of DFG operations
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+            - Change bool return values to a 64-bit type.
+
+2011-08-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Crash accessing static property on sealed object
+        https://bugs.webkit.org/show_bug.cgi?id=66242
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+            - should only check isExtensible if checkReadOnly.
+
+2011-08-15  Sam Weinig  <sam@webkit.org>
+
+        Fix release build when building with Clang.
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::checkCurrentIdentifierTable):
+        Add NO_RETURN_DUE_TO_CRASH.
+
+2011-08-15  Oliver Varga  <Varga.Oliver@stud.u-szeged.hu>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Speed up SVGSMILElement::findInstanceTime.
+        https://bugs.webkit.org/show_bug.cgi?id=61025
+
+        Add a new parameter to StdlibExtras.h::binarySerarch function
+        to also handle cases when the array does not contain the key value.
+        This is needed for an svg function.
+
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+
+2011-08-13  Sam Weinig  <sam@webkit.org>
+
+        Add back 0xbbadbeef to CRASH to allow for old habits
+        https://bugs.webkit.org/show_bug.cgi?id=66190
+
+        Reviewed by David Kilzer.
+
+        * wtf/Assertions.h:
+        Add back the assignment to the memory address 0xbbadbeef in the CRASH
+        macro, as it does not cause issue in the clang static analyzer and many
+        people use its presence in crash reports to easily identify ASSERTs. 
+
+2011-08-13  Sam Weinig  <sam@webkit.org>
+
+        Fix a bunch of minor bugs caught by the clang static analyzer in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=66182
+
+        Reviewed by Dan Bernstein.
+
+        Fixes 10 warnings in JavaScriptCore and 2 in testapi.
+
+        * API/tests/testapi.c:
+        (main):
+        Remove dead variables.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        Initialize hasPrinted and silence an unused warning by casting to void (Ok here
+        since it is debug code and I want to keep it clear that if other cases are added,
+        the hasPrinted flag would be needed).
+
+        * wtf/dtoa.cpp:
+        (WTF::d2b):
+        The variable "de" in the else block is always zero, so there is no reason to
+        use it.
+
+2011-08-12  Sam Weinig  <sam@webkit.org>
+
+        Use __builtin_trap() for CRASH when building with clang
+        https://bugs.webkit.org/show_bug.cgi?id=66152
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/Assertions.h:
+        Add Clang specific CRASH macro that calls __builtin_trap() instead
+        of silly techniques to crash. This allows the static analyzer to understand
+        that we are intentionally crashing. As a result, we need to mark some functions
+        as not returning.
+
+        Also adds a macros that annotates a function as never returning due to ASSERT or CRASH.
+
+        * wtf/Compiler.h:
+        Add COMPILIER(CLANG) and fix some formatting and spelling mistakes.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::Internal::fastMallocMatchFailed):
+        Add NO_RETURN_DUE_TO_CRASH.
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
+        Add NO_RETURN_DUE_TO_ASSERT.
+
+2011-08-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT has inconsistent use of boxDouble and unboxDouble,
+        inconsistent use of assertions regarding doubles, and those
+        assertions are not turned on in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=66160
+
+        Reviewed by Gavin Barraclough.
+        
+        JIT assertions are now turned on in debug builds.  JIT
+        assertions are now used for boxing and unboxing doubles, and boxing
+        and unboxing no longer involves code duplication.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::boxDouble):
+        (JSC::DFG::JITCodeGenerator::unboxDouble):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::GeneralizedRegister::moveTo):
+        (JSC::DFG::GeneralizedRegister::swapWith):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::boxDouble):
+        (JSC::DFG::JITCompiler::unboxDouble):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::convertToDouble):
+
+2011-08-12  Mark Rowe  <mrowe@apple.com>
+
+        Be more forward-looking in the choice of compiler.
+
+        Rubber-stamped by Jon Honeycutt.
+
+        * Configurations/CompilerVersion.xcconfig:
+
+2011-08-12  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Fix non-pthreads build after r91906.
+        https://bugs.webkit.org/show_bug.cgi?id=66151
+
+        Reviewed by David Levin.
+
+        r91906 broke the non-pthreads GTK+ build by including a header which
+        doesn't exist. Fix it by including DateMath.h instead of DateMap.h.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+
+2011-08-12  Mark Rowe  <mrowe@apple.com>
+
+        Update some configuration settings that were missed back in r92432.
+
+        * Configurations/CompilerVersion.xcconfig:
+
+2011-08-12  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r91610?): Bing Maps fail to initialize (InvalidOperation:
+        Matrix3D.invert)
+        https://bugs.webkit.org/show_bug.cgi?id=66038
+
+        Reviewed by Gavin Barraclough.
+        
+        Simplest and lowest-impact fix for the case where the spilled format
+        of a DFG node differs from the register format: if the format is
+        converted then indicate that the spilled value is no longer valid
+        ("kill the spill").
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::killSpilled):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2011-08-12  Sam Weinig  <sam@webkit.org>
+
+        Move compiler specific macros to their own header
+        https://bugs.webkit.org/show_bug.cgi?id=66119
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        Add Compiler.h
+
+        * wtf/AlwaysInline.h:
+        Move the contents of this file (which no longer was just about ALWAYS_INLINE) to
+        Compiler.h.  We can remove this file in a later commit.
+
+        * wtf/Compiler.h: Added.
+        Put all compiler specific checks and features in this file.
+
+        * wtf/Platform.h:
+        Move COMPILER macro and definitions (and the odd WARN_UNUSED_RETURN compiler feature)
+        to Compiler.h.  Include Compiler.h since it is necessary.
+
+2011-08-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT-specific structure stub info code offset fields are signed
+        8-bit, but it is possible for the offsets to be greater than 127
+        https://bugs.webkit.org/show_bug.cgi?id=66122
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+
+2011-08-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT speculation failure code sometimes picks the wrong register
+        as a scratch register.
+        https://bugs.webkit.org/show_bug.cgi?id=66104
+
+        Reviewed by Gavin Barraclough.
+        
+        Hardened the code with more assertions and fixed the bug.  Now a
+        spilled register is only used for scratch if it also isn't being
+        used for shuffling.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::ShuffledRegister::handleNonCyclingPermutation):
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+
+2011-08-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r92880.
+        http://trac.webkit.org/changeset/92880
+        https://bugs.webkit.org/show_bug.cgi?id=66123
+
+        Breaks compile in VS2010 (Requested by jamesr_ on #webkit).
+
+        * wtf/PassRefPtr.h:
+
+2011-08-11  Mark Rowe  <mrowe@apple.com>
+
+        Don't conditionalize the use of -fomit-frame-pointer on compiler version as
+        all of our supported compilers are now new enough to have the same, sane behavior.
+
+        Rubber-stamped by Sam Weinig.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2011-08-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT verbose mode does not report the generated types of nodes
+        https://bugs.webkit.org/show_bug.cgi?id=65830
+
+        Reviewed by Sam Weinig.
+        
+        Added code that prints the type selected for each node's result.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::dataFormatToString):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-08-11  James Robinson  <jamesr@chromium.org>
+
+        nullptr can't be used for PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=66024
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::PassRefPtr):
+
+2011-08-11  Daniel Bates  <dbates@rim.com>
+
+        Removed unused variable in StackBounds::initialize() to resolve
+        compiler warning when building on QNX.
+        https://bugs.webkit.org/show_bug.cgi?id=66072
+
+        Reviewed by Antonio Gomes.
+
+        * wtf/StackBounds.cpp:
+        (WTF::StackBounds::initialize):
+
+2011-08-11  Devdatta Deshpande  <pwjd73@motorola.com>
+
+        Implementation of monotonically increasing clock on GTK
+        https://bugs.webkit.org/show_bug.cgi?id=62175
+
+        Reviewed by Martin Robinson.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::monotonicallyIncreasingTime):
+        The default implementation of monotonicallyIncreasingTime only
+        guarantees the result to be non-decreasing.
+        If the system time is changed to past then default implementation will
+        still fail and WebCore timers will not fire.
+
+2011-08-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed some incorrect code that was dead.
+
+        Reviewed by Oliver Hunt.
+
+        clearSingleTransition() wasn't resetting m_data. Luckily,
+        no one cares, because its caller was unused. Removed both.
+
+        * runtime/Structure.cpp:
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+
+2011-08-10  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r92670-r92744): WebKit crashes when opening Gmail
+        https://bugs.webkit.org/show_bug.cgi?id=66010
+
+        Reviewed by Oliver Hunt.
+        
+        Made sure that Construct calls use() on the this argument.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+
+2011-08-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC should always throw when function arg list is too long
+        https://bugs.webkit.org/show_bug.cgi?id=65869
+
+        Reviewed by Oliver Hunt.
+
+        Changed the behavior of the interpreter and JIT to throw an exception 
+        when too many arguments are passed rather than truncating the list.  Added 
+        a new method to create a "Too many arguments." exception used by this 
+        new functionality.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createTooManyParamsError):
+        * runtime/ExceptionHelpers.h:
+
+2011-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Make GC checks more aggressive in release builds
+        https://bugs.webkit.org/show_bug.cgi?id=66001
+
+        Reviewed by Gavin Barraclough.
+
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::visitStrongHandles):
+        (JSC::HandleHeap::visitWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::writeBarrier):
+        (JSC::HandleHeap::isLiveNode):
+        (JSC::HandleHeap::isValidWeakNode):
+           Increase handle heap validation logic, and make some of
+           the crashes trigger in release builds as well as debug.
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::allocate):
+        (JSC::HandleHeap::makeWeak):
+           Ditto
+        * runtime/JSGlobalData.cpp:
+        (WTF::Recompiler::operator()):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+           Fix GC bugs found while testing this patch
+
+2011-08-10  Oliver Hunt  <oliver@apple.com>
+
+        JSEvaluteScript does not return the correct object when given JSONP data
+        https://bugs.webkit.org/show_bug.cgi?id=66003
+
+        Reviewed by Gavin Barraclough.
+
+        Make sure we propagate the result of the function call rather than the
+        argument.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2011-08-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT heap prediction causes regressions when combined with
+        aggressive integer prediction
+        https://bugs.webkit.org/show_bug.cgi?id=65954
+
+        Reviewed by Gavin Barraclough.
+        
+        Disabled heap prediction, but did not remove the capability.
+        This improves V8 crypto performance by 20%.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+
+2011-08-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not speculative integers as aggressively as it should
+        https://bugs.webkit.org/show_bug.cgi?id=65949
+
+        Reviewed by Gavin Barraclough.
+        
+        Added a tree walk to propagate integer predictions through arithmetic
+        expressions.
+        
+        This is a 71% speed-up on Kraken's imaging-gaussian-blur, which
+        translates to a 19% speed-up on Kraken overall.  It's neutral on
+        other benchmarks.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::predictInt32):
+
+2011-08-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT has no way of propagating predictions to loads and calls
+        https://bugs.webkit.org/show_bug.cgi?id=65883
+
+        Reviewed by Gavin Barraclough.
+        
+        This introduces the capability to store predictions on graph
+        nodes.  To save space while being somewhat consistent, the
+        prediction is always stored in the second OpInfo slot (since
+        a GetById will use the first one for the identifier).  This
+        change is a natural extension of r92593 (global variable
+        prediction).
+        
+        This is a 1.5% win on V8 in the arithmetic mean, and a 0.6%
+        win on V8 in the geometric mean.  It is neutral on SunSpider
+        and Kraken.  Interestingly, on V8 it regresses crypto by 3%
+        while progressing deltablue and richards by 2.6% and 4.3%,
+        respectively.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::getPrediction):
+        * dfg/DFGNode.h:
+        (JSC::DFG::isCellPrediction):
+        (JSC::DFG::isArrayPrediction):
+        (JSC::DFG::isInt32Prediction):
+        (JSC::DFG::isDoublePrediction):
+        (JSC::DFG::isNumberPrediction):
+        (JSC::DFG::predictionToString):
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::hasPrediction):
+        (JSC::DFG::Node::getPrediction):
+        (JSC::DFG::Node::predict):
+
+2011-08-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT passes the this argument to constructors even though
+        it's not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=65943
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+
+2011-08-09  Chao-ying Fu  <fu@mips.com>
+
+        Fix one MIPS instruction to call JITStubThunked_##op
+        https://bugs.webkit.org/show_bug.cgi?id=65942
+
+        Reviewed by Gavin Barraclough.
+
+        Changed "bal" to "jalr" for a possible processor mode change from
+        MIPS32 to MIPS16.
+
+        * jit/JITStubs.cpp:
+
+2011-08-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT failure loading web site
+        https://bugs.webkit.org/show_bug.cgi?id=65930
+
+        Reviewed by Oliver Hunt.
+        
+        Put the use() call after the fpr()/gpr() calls, since doing otherwise
+        breaks the register allocator.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+
+2011-08-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add ParentClass typedef in all JSC classes
+        https://bugs.webkit.org/show_bug.cgi?id=65731
+
+        Reviewed by Oliver Hunt.
+
+        Just added the Base typedefs in all the classes that are a subclass of JSCell 
+        to point at their parent classes.  This is a change to support future changes to the way
+        constructors and destructors are implemented in JS objects, among other things.
+
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        (JSC::JSCallbackObject::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::JSCallbackObject):
+        (JSC::::init):
+        (JSC::::className):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::getOwnPropertyDescriptor):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::getConstructData):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::getCallData):
+        (JSC::::call):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::setPrivate):
+        (JSC::::getPrivate):
+        (JSC::::inherits):
+        (JSC::::getStaticValue):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * debugger/DebuggerActivation.h:
+        * jsc.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.h:
+        * runtime/Error.cpp:
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.h:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/Executable.h:
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.h:
+        * runtime/GetterSetter.h:
+        * runtime/InternalFunction.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSActivation.h:
+        * runtime/JSArray.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.h:
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.h:
+        * runtime/JSWrapperObject.h:
+        * runtime/MathObject.h:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::create):
+        * runtime/RegExpPrototype.h:
+        * runtime/ScopeChain.h:
+        * runtime/StrictEvalActivation.h:
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        * runtime/StringPrototype.h:
+        * runtime/Structure.h:
+        * runtime/StructureChain.h:
+
+2011-08-08  Oliver Hunt  <oliver@apple.com>
+
+        Using mprotect to create guard pages breaks our use of madvise to release executable memory
+        https://bugs.webkit.org/show_bug.cgi?id=65870
+
+        Reviewed by Gavin Barraclough.
+
+        Use mmap rather than mprotect to clear guard page permissions.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+
+2011-08-08  Oliver Hunt  <oliver@apple.com>
+
+        Non-extensibility does not prevent mutating [[Prototype]]
+        https://bugs.webkit.org/show_bug.cgi?id=65832
+
+        Reviewed by Gavin Barraclough.
+
+        Disallow mutation of __proto__ on objects that are not extensible.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+
+2011-08-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not track speculation decisions for global variables
+        https://bugs.webkit.org/show_bug.cgi?id=65825
+
+        Reviewed by Gavin Barraclough.
+        
+        Added the capability to track predictions for global variables, and
+        ensured that code can abstract over the source of prediction (local
+        versus global variable) wherever it is appropriate to do so.  Also
+        cleaned up the code in SpeculativeJIT that decides how to speculate
+        based on recorded predictions (for example instead of using isInteger,
+        which makes sense for local predictions where the GetLocal would
+        return an integer value, we now tend to use shouldSpeculateInteger,
+        which checks if the value is either already an integer or should be
+        speculated to be an integer).
+        
+        This is an 0.8% win on SunSpider, almost entirely thanks to a 25%
+        win on controlflow-recursive.  It's also a 4.8% win on v8-crypto.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::predictArray):
+        (JSC::DFG::ByteCodeParser::predictInt32):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::predictGlobalVar):
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::getGlobalVarPrediction):
+        (JSC::DFG::Graph::getPrediction):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateInteger):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateDouble):
+
+2011-08-07  Martin Robinson  <mrobinson@igalia.com>
+
+        Distribution fix for GTK+.
+
+        * GNUmakefile.list.am: Strip removed files from the source list.
+
+2011-08-06  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=65821
+        Don't form identifiers the first time a string is used as a property name.
+
+        Reviewed by Oliver Hunt.
+
+        This is a 1% win on SunSpider.
+
+        * dfg/DFGOperations.cpp:
+            - Use fastGetOwnProperty.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Use fastGetOwnProperty.
+        * runtime/JSCell.h:
+        * runtime/JSObject.h:
+        (JSC::JSCell::fastGetOwnProperty):
+            - Fast call to get a property without creating an identifier the first time.
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::findWithString):
+            - Add interface to look up by either strinsg or identifiers.
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+            - Add a get() call that takes a UString, not an Identifier.
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::hasHash):
+            - Add a call to check if the has has been set (to detect the first use as a property name).
+
+2011-08-06  Aron Rosenberg  <arosenberg@logitech.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Fix build with Intel compiler on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=65088
+
+        Intel compiler needs .lib suffixes instead of .a
+        Intel compiler doesn't support nullptr
+        Intel compiler supports unsized arrays
+
+        * JavaScriptCore.pri:
+        * jsc.cpp:
+        * wtf/ByteArray.h:
+        * wtf/NullPtr.h:
+
+2011-08-05  Gavin Barraclough  <barraclough@apple.com>
+
+        String replace with the empty string means string removal
+        https://bugs.webkit.org/show_bug.cgi?id=65799
+
+        Reviewed by Sam Weinig.
+
+        Optimization for String.prototype.replace([RegExp], ""), this improves v8-regexp by ~3%.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::stringProtoFuncReplace):
+
+2011-08-05  Noel Gordon  <noel.gordon@gmail.com>
+
+        [Chromium] Remove JSZombie references from gyp project files.
+        https://bugs.webkit.org/show_bug.cgi?id=65798
+
+        JSC runtime/JSZombie.{cpp,h} were removed in r92046.  Remove references to these
+        file names from the gyp projects.
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.gypi: zombies be gone.
+
+2011-08-05  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/65785> ThreadRestrictionVerifier needs a mode where an object
+        is tied to a particular dispatch queue
+
+        A RefCounted object can be opted in to this mode by calling setDispatchQueueForVerifier
+        with the dispatch queue it will be tied to. This will cause ThreadRestrictionVerifier
+        to ensure that all operations are performed on the given dispatch queue.
+
+        Reviewed by Anders Carlsson.
+
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::setDispatchQueueForVerifier):
+        * wtf/ThreadRestrictionVerifier.h:
+        (WTF::ThreadRestrictionVerifier::ThreadRestrictionVerifier):
+        (WTF::ThreadRestrictionVerifier::~ThreadRestrictionVerifier):
+        (WTF::ThreadRestrictionVerifier::setDispatchQueueMode):
+        (WTF::ThreadRestrictionVerifier::setShared):
+        (WTF::ThreadRestrictionVerifier::isSafeToUse):
+
+2011-08-05  Oliver Hunt  <oliver@apple.com>
+
+        Inline allocation of function objects
+        https://bugs.webkit.org/show_bug.cgi?id=65779
+
+        Reviewed by Gavin Barraclough.
+
+        Inline allocation and initilisation of function objects
+        in generated code.  This ended up being a 60-70% improvement
+        in function allocation performance.  This improvement shows
+        up as a ~2% improvement in 32bit sunspider and V8, but is a
+        wash on 64-bit.
+
+        We currently don't inline the allocation of named function
+        expressions, as that requires being able to gc allocate a
+        variable object.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::emitStoreCell):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC::JIT::emitAllocateJSFunction):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emitSlow_op_new_func):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emitSlow_op_new_func_exp):
+        * jit/JITOpcodes32_64.cpp:
+            Removed duplicate implementation of op_new_func and op_new_func_exp
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::offsetOfScopeChain):
+        (JSC::JSFunction::offsetOfExecutable):
+
+2011-08-04  David Levin  <levin@chromium.org>
+
+        CStringBuffer should have thread safety checks turned on.
+        https://bugs.webkit.org/show_bug.cgi?id=58093
+
+        Reviewed by Dmitry Titov.
+
+        * wtf/text/CString.h:
+        (WTF::CStringBuffer::CStringBuffer): Removed the ifdef that
+        turned this off for Chromium.
+
+2011-08-04  Mark Rowe  <mrowe@apple.com>
+
+        Future-proof Xcode configuration settings.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2011-08-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Interpreter can potentially GC in the middle of initializing a structure chain
+        https://bugs.webkit.org/show_bug.cgi?id=65638
+
+        Reviewed by Oliver Hunt.
+
+        Moved the allocation of a prototype StructureChain before the initialization of 
+        the structure chain within the interpreter that was causing intermittent GC crashes.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        * wtf/Platform.h:
+
+2011-08-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Eval handling attempts literal parsing even when the eval
+        string is in the cache
+        https://bugs.webkit.org/show_bug.cgi?id=65675
+
+        Reviewed by Oliver Hunt.
+        
+        This is a 25% speed-up on date-format-tofte and a 1.5% speed-up overall
+        in SunSpider.  It's neutral on V8.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        (JSC::EvalCodeCache::get):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+
+2011-08-03  Mark Rowe  <mrowe@apple.com>
+
+        Bring some order to FeatureDefines.xcconfig to make it easier to follow.
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-08-03  Mark Rowe  <mrowe@apple.com>
+
+        Clean up FeatureDefines.xcconfig to remove some unnecessary conditional settings
+
+        Reviewed by Dave Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC heap size improvement breaks build on some platforms due to
+        unused parameter
+        https://bugs.webkit.org/show_bug.cgi?id=65641
+
+        Reviewed by Darin Adler.
+        
+        Fix build on non-x86 platforms, by ensuring that the relevant
+        parameter always appears to be used even when it isn't.
+
+        * heap/Heap.cpp:
+
+2011-08-03  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Reorganize pkg-config files
+        https://bugs.webkit.org/show_bug.cgi?id=65548
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am:
+        * javascriptcoregtk.pc.in: Renamed from Source/WebKit/gtk/javascriptcoregtk.pc.in.
+
+2011-08-01  David Levin  <levin@chromium.org>
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        Reviewed by Dmitry Titov.
+
+        * GNUmakefile.list.am: Added new files to the build.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool): Turned off checks for this
+        due to not being able to figure out what was guarding it (bug 58091).
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider): Ditto.
+        * wtf/CMakeLists.txt: Added new files to the build.
+        * wtf/ThreadRestrictionVerifier.h: Added.
+        Everything is done in the header to avoid the issue with exports
+        that are only useful in debug but still needing to export them.
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Added checks using the non thread safe verifier.
+        and filed bug 58171 about making it stricter.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::setMutexForVerifier): Expose a way to change the checks to be based
+        on a mutex. This is in the header to avoid adding more exports from JavaScriptCore.
+        (WTF::RefCountedBase::deprecatedTurnOffVerifier): Temporary way to turn off verification.
+        Filed bug 58174 to remove this method.
+        (WTF::RefCountedBase::derefBase):
+        * wtf/SizeLimits.cpp: Adjusted the debug size check for RefCounted.
+        * wtf/text/CString.h:
+        (WTF::CStringBuffer::CStringBuffer): Turned off checks for this while a fix is being
+        done in Chromium (bug 58093).
+
+2011-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC may not be able to reuse partially-free blocks after a
+        full collection
+        https://bugs.webkit.org/show_bug.cgi?id=65585
+
+        Reviewed by Darin Adler.
+        
+        This fixes the linked list management bug.  This fix is performance
+        neutral on SunSpider.
+
+        * heap/NewSpace.cpp:
+        (JSC::NewSpace::removeBlock):
+
+2011-07-30  Oliver Hunt  <oliver@apple.com>
+
+        Simplify JSFunction creation for functions written in JS
+        https://bugs.webkit.org/show_bug.cgi?id=65422
+
+        Reviewed by Gavin Barraclough.
+
+        Remove hash lookups used to write name property and transition
+        function structure by caching the resultant structure and property
+        offset in JSGlobalObject.  This doesn't impact performance, but
+        we can use this change to make other improvements later.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::FunctionExecutable::jsName):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::namedFunctionStructure):
+        (JSC::JSGlobalObject::functionNameOffset):
+
+2011-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC uses dummy cells to avoid having to remember which cells
+        it has already destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=65556
+
+        Reviewed by Oliver Hunt.
+        
+        This gets rid of dummy cells, and ensures that it's not necessary
+        to invoke a destructor on cells that have already been swept.  In
+        the common case, a block knows that either all of its free cells
+        still need to have destructors called, or none of them do, which
+        minimizes the amount of branching that needs to happen per cell
+        when performing a sweep.
+        
+        This is performance neutral on SunSpider and V8.  It is meant as
+        a stepping stone to simplify the implementation of more
+        sophisticated sweeping algorithms.
+
+        * heap/Heap.cpp:
+        (JSC::CountFunctor::ClearMarks::operator()):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::initForCellSize):
+        (JSC::MarkedBlock::callDestructor):
+        (JSC::MarkedBlock::specializedReset):
+        (JSC::MarkedBlock::reset):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::produceFreeList):
+        (JSC::MarkedBlock::lazySweep):
+        (JSC::MarkedBlock::blessNewBlockForFastPath):
+        (JSC::MarkedBlock::blessNewBlockForSlowPath):
+        (JSC::MarkedBlock::canonicalizeBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::FreeCell::setNoObject):
+        (JSC::MarkedBlock::setDestructorState):
+        (JSC::MarkedBlock::destructorState):
+        (JSC::MarkedBlock::notifyMayHaveFreshFreeCells):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::JSCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::clearBuiltinStructures):
+        * runtime/JSGlobalData.h:
+        * runtime/Structure.h:
+
+2011-08-01  Michael Saboff  <msaboff@apple.com>
+
+        Virtual copying of FastMalloc allocated memory causes madvise MADV_FREE_REUSABLE errors
+        https://bugs.webkit.org/show_bug.cgi?id=65502
+
+        Reviewed by Anders Carlsson.
+
+        With the fix of the issues causing madvise MADV_FREE_REUSABLE to fail,
+        added an assert to the return code of madvise to catch any regressions.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+
+2011-08-02  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-08-02  Anders Carlsson  <andersca@apple.com>
+
+        Fix a Windows build error.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC is far too conservative about growing the heap size, particularly
+        on desktop platforms
+        https://bugs.webkit.org/show_bug.cgi?id=65438
+
+        Reviewed by Oliver Hunt.
+
+        The minimum heap size is now 16MB instead of 512KB, provided all of the
+        following are true:
+        a) ENABLE(LARGE_HEAP) is set, which currently only happens on
+           x86 targets, but could reasonably happen on any platform that is
+           known to have a decent amount of RAM.
+        b) JSGlobalData is initialized with HeapSize = LargeHeap, which
+           currently only happens when it's the JSDOMWindowBase in WebCore or
+           in the jsc command-line tool.
+           
+        This is a 4.1% speed-up on SunSpider.
+
+        * JavaScriptCore.exp:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * jsc.cpp:
+        (main):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createContextGroup):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::createLeaked):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        * wtf/Platform.h:
+
+2011-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC does a GC even when the heap still has free pages
+        https://bugs.webkit.org/show_bug.cgi?id=65445
+
+        Reviewed by Oliver Hunt.
+        
+        If the high watermark is not reached, then we allocate new blocks as
+        before.  If the current watermark does reach (or exceed) the high
+        watermark, then we check if there is a block on the free block pool.
+        If there is, we simply allocation from it.  If there isn't, we
+        invoke a collectin as before.  This effectively couples the elastic
+        scavenging to the collector's decision function.  That is, if an
+        application rapidly varies its heap usage (sometimes using more and
+        sometimes less) then the collector will not thrash as it used to.
+        But if heap usage drops and stays low then the scavenger thread and
+        the GC will eventually reach a kind of consensus: the GC will set
+        the watermark low because of low heap usage, and the scavenger thread
+        will steadily eliminate pages from the free page pool, until the size
+        of the free pool is below the high watermark.
+        
+        On command-line, this is neutral on SunSpider and Kraken and a 3% win
+        on V8.  In browser, this is a 1% win on V8 and neutral on the other
+        two.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::allocateSlowCase):
+        (JSC::Heap::allocateBlock):
+        * heap/Heap.h:
+
+2011-08-02  Jeff Miller  <jeffm@apple.com>
+
+        Move WTF_USE_AVFOUNDATION from JavaScriptCore/wtf/platform.h to WebCore/config.h
+        https://bugs.webkit.org/show_bug.cgi?id=65552
+        
+        Since this is a WebCore feature, there's no need to define it in JavaScriptCore/wtf/platform.h.
+
+        Reviewed by Adam Roben.
+
+        * wtf/Platform.h: Removed WTF_USE_AVFOUNDATION.
+
+2011-08-01  Jean-luc Brouillet  <jeanluc@chromium.org>
+
+        Removing old source files in gyp files that slow build
+        https://bugs.webkit.org/show_bug.cgi?id=65503
+
+        Reviewed by Adam Barth.
+
+        A number of stale files are listed in the gyp files. These slow the
+        build on Visual Studio 2010. Removing them.
+
+        * JavaScriptCore.gypi:
+
+2011-07-14  David Levin  <levin@chromium.org>
+
+        currentThread is too slow!
+        https://bugs.webkit.org/show_bug.cgi?id=64577
+
+        Reviewed by Darin Adler and Dmitry Titov.
+
+        The problem is that currentThread results in a pthread_once call which always takes a lock.
+        With this change, currentThread is 10% faster than isMainThread in release mode and only
+        5% slower than isMainThread in debug.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp:
+        (WTF::ThreadIdentifierData::initializeOnce): Remove the pthread once stuff
+        which is no longer needed because this is called from initializeThreading().
+        (WTF::ThreadIdentifierData::identifier): Remove the initializeKeyOnce call because
+        intialization of the pthread key should already be done.
+        (WTF::ThreadIdentifierData::initialize): Ditto.
+        * wtf/ThreadIdentifierDataPthreads.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): Acquire the pthread key here.
+
+2011-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT sometimes creates speculation check data structures that have
+        invalid information about the format of a register
+        https://bugs.webkit.org/show_bug.cgi?id=65490
+
+        Reviewed by Gavin Barraclough.
+        
+        The code now makes sure to (1) always have correct and up-to-date
+        information about register format at the time that a speculation
+        check is emitted, (2) assert that speculation data is correct
+        inside the speculation check implementation, and (3) avoid creating
+        speculation data altogether if compilation has already failed, since
+        at that point the format data is almost guaranteed to be bogus.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::EntryLocation::EntryLocation):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculationCheck::SpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+
+2011-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r92092): Build fails on 64 bit
+        https://bugs.webkit.org/show_bug.cgi?id=65458
+
+        Reviewed by Oliver Hunt.
+        
+        The build was broken because some compilers were smart enough to see
+        an array index out of bounds due to the decision fuction for when to
+        go from precise size classes to imprecise size classes being broken:
+        it would assume that sizes in the range 97..128 belonged to a precise
+        size class when in fact they belonged to an imprecise one.
+        
+        In fact, the code would have run correctly, by way of a fluke, because
+        though the 4th precise size class (for 97..128) didn't exist, the next
+        array over from m_preciseSizeClasses was m_impreciseSizeClasses, and
+        its first entry would have been a size class that is appropriate for
+        allocations in the range 97..128.  However, this relies on specific
+        ordering of fields in NewSpace, so it's still a bug.
+        
+        This fixes the bug by ensuring that allocations larger than 96 use
+        the imprecise size classes.
+
+        * heap/NewSpace.h:
+        (JSC::NewSpace::sizeClassFor):
+
+2011-07-31  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64679
+        Fix bugs in Array.prototype this handling.
+
+        Unreviewed - rolling out r91290.
+
+        Looks like the wild wild web isn't ready for this yet.
+
+        This change broke http://slides.html5rocks.com/#landing-slide.
+        Interestingly, this might only be due to our lack of bind support -
+        it looks like this site is calling  Array.prototype.slice as a part
+        of its bind implementation.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+
+2011-07-31  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC lays out size classes under wrong assumptions about expected
+        object size.
+        https://bugs.webkit.org/show_bug.cgi?id=65437
+
+        Reviewed by Oliver Hunt.
+        
+        Changed the atom size - which is both the smallest allocation size and
+        the smallest possible stepping unit for size class spacing - from
+        8 bytes to 4 pointer-size words.  This is a 1% win on SunSpider.
+
+        * heap/MarkedBlock.h:
+
+2011-07-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG non-speculative JIT does not optimize PutByVal
+        https://bugs.webkit.org/show_bug.cgi?id=65424
+
+        Reviewed by Gavin Barraclough.
+        
+        Added code to emit PutByVal inline fast path.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+
+2011-07-31  Filip Pizlo  <fpizlo@apple.com>
+
+        The JSC garbage collector returns memory to the operating system too
+        eagerly.
+        https://bugs.webkit.org/show_bug.cgi?id=65382
+
+        Reviewed by Oliver Hunt.
+        
+        This introduces a memory reuse model similar to the one in FastMalloc.
+        A periodic scavenger thread runs in the background and returns half the
+        free memory to the OS on each timer fire.  New block allocations first
+        attempt to get the memory from the collector's internal pool, reverting
+        to OS allocation only when this pool is empty.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::waitForRelativeTimeWhileHoldingLock):
+        (JSC::Heap::waitForRelativeTime):
+        (JSC::Heap::blockFreeingThreadStartFunc):
+        (JSC::Heap::blockFreeingThreadMain):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::releaseFreeBlocks):
+        * heap/Heap.h:
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::initForCellSize):
+        (JSC::MarkedBlock::reset):
+        * heap/MarkedBlock.h:
+        * wtf/Platform.h:
+
+2011-07-30  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT speculation failure pass sometimes forgets to emit code to
+        move certain registers.
+        https://bugs.webkit.org/show_bug.cgi?id=65421
+
+        Reviewed by Oliver Hunt.
+        
+        Restructured the offending loops (for gprs and fprs).  It's once again
+        possible to use spreadsheets on docs.google.com.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+
+2011-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove inclusion of MainThread.h from Threading.h
+        https://bugs.webkit.org/show_bug.cgi?id=65081
+
+        Reviewed by Darin Adler.
+
+        Add missing and remove unneeded include statements for MainThread.
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        * wtf/Threading.h:
+        * wtf/ThreadingPthreads.cpp:
+        * wtf/text/StringStatics.cpp:
+
+2011-07-30  Oliver Hunt  <oliver@apple.com>
+
+        Reduce the size of JSGlobalObject slightly
+        https://bugs.webkit.org/show_bug.cgi?id=65417
+
+        Reviewed by Dan Bernstein.
+
+        Push a few members that either aren't commonly used,
+        or aren't frequently accessed into a separate struct.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::WeakMapsFinalizer::finalize):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectRareData::JSGlobalObjectRareData):
+        (JSC::JSGlobalObject::createRareDataIfNeeded):
+        (JSC::JSGlobalObject::setProfileGroup):
+        (JSC::JSGlobalObject::profileGroup):
+        (JSC::JSGlobalObject::registerWeakMap):
+        (JSC::JSGlobalObject::deregisterWeakMap):
+
+2011-07-30  Balazs Kelemen  <kbalazs@webkit.org>
+
+        MessageQueue::waitForMessageFilteredWithTimeout can triggers an assertion
+        https://bugs.webkit.org/show_bug.cgi?id=65263
+
+        Reviewed by Dmitry Titov.
+
+        * wtf/Deque.h:
+        (WTF::::operator): Don't check the validity of an iterator
+        that will be reassigned right now.
+        * wtf/MessageQueue.h:
+        (WTF::::removeIf): Revert r51198 as I beleave this is the better
+        solution for the problem that was solved by that.
+
+2011-07-29  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC zombie support no longer works, and is likely no longer needed.
+        https://bugs.webkit.org/show_bug.cgi?id=65404
+
+        Reviewed by Darin Adler.
+        
+        This removes zombies, because they no longer work, are not tested, are
+        probably not needed, and are getting in the way of GC optimization
+        work.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Handle.h:
+        (JSC::HandleConverter::operator->):
+        (JSC::HandleConverter::operator*):
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::isValidWeakNode):
+        * heap/Heap.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::collect):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::clearMarks):
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        (JSC::Register::operator=):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        * runtime/JSCell.cpp:
+        (JSC::isZombie):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::clearBuiltinStructures):
+        * runtime/JSGlobalData.h:
+        * runtime/JSValue.h:
+        * runtime/JSValueInlineMethods.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSZombie.cpp: Removed.
+        * runtime/JSZombie.h: Removed.
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::setEarlyValue):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+        * wtf/Platform.h:
+
+2011-07-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT verbose mode provides no details about predictions
+        https://bugs.webkit.org/show_bug.cgi?id=65389
+
+        Reviewed by Darin Adler.
+        
+        Added a print-out of the predictions to the IR dump, with names as follows:
+        "p-bottom" = the parser made no predictions
+        "p-int32" = the parser predicted int32
+        ... (same for array, cell, double, number)
+        "p-top" = the parser made conflicting predictions which will be ignored.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::predictionToString):
+
+2011-07-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not have any way of undoing double speculation.
+        https://bugs.webkit.org/show_bug.cgi?id=65334
+
+        Reviewed by Gavin Barraclough.
+        
+        This adds code to do a branchConvertDoubleToInt on specualtion failure.
+        This is performance-neutral on most benchmarks but does result in
+        a slight improvement in Kraken.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::GeneralizedRegister::moveTo):
+        (JSC::DFG::GeneralizedRegister::swapWith):
+        (JSC::DFG::ShuffledRegister::handleNonCyclingPermutation):
+        (JSC::DFG::ShuffledRegister::handleCyclingPermutation):
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+
+2011-07-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Crash when opening docs.google.com
+        https://bugs.webkit.org/show_bug.cgi?id=65327
+
+        Reviewed by Gavin Barraclough.
+        
+        The speculative JIT was only checking whether a value is an array when
+        we had already checked that it was, rather then when we hadn't.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-28  Oliver Hunt  <oliver@apple.com>
+
+        *_list instructions are only used in one place, where the code is wrong.
+        https://bugs.webkit.org/show_bug.cgi?id=65348
+
+        Reviewed by Darin Adler.
+
+        Simply remove the instructions and all users.  Speeds up the interpreter
+        slightly due to code motion, but otherwise has no effect (because none
+        of the _list instructions are ever used).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::isPropertyAccess):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::visitStructures):
+        * bytecode/Instruction.h:
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2011-07-28  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=65325
+        Performance tweak to parseInt
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+            - This change may an existing optimization redundant,
+              cleanup from Darin's comments, plus fix existing bugs.
+
+2011-07-28  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=65325
+        Performance tweak to parseInt
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+            - parseInt applied to small positive numbers = floor.
+
+2011-07-28  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCallInternal):
+
+2011-07-28  Kent Tamura  <tkent@chromium.org>
+
+        Improve StringImpl::stripWhiteSpace() and simplifyWhiteSpace().
+        https://bugs.webkit.org/show_bug.cgi?id=65300
+
+        Reviewed by Darin Adler.
+
+        r91837 had performance regression of StringImpl::stripWhiteSpace()
+        and simplifyWhiteSpace(). This changes the code so that compilers
+        generates code equivalent to r91836 or piror.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::stripMatchedCharacters):
+        A template member function for stripWhiteSpace(). This function takes a functor.
+        (WTF::UCharPredicate):
+        A functor for generic predicate for single UChar argument.
+        (WTF::SpaceOrNewlinePredicate):
+        A special functor for isSpaceOrNewline().
+        (WTF::StringImpl::stripWhiteSpace):
+        Use stripmatchedCharacters().
+        (WTF::StringImpl::simplifyMatchedCharactersToSpace):
+        A template member function for simplifyWhiteSpace().
+        (WTF::StringImpl::simplifyWhiteSpace):
+        Use simplifyMatchedCharactersToSpace().
+        * wtf/text/StringImpl.h:
+
+2011-07-27  Dmitry Lomov  <dslomov@google.com>
+
+        [chromium] Turn on WTF_MULTIPLE_THREADS.
+        https://bugs.webkit.org/show_bug.cgi?id=61017
+        The patch turns on WTF_MULTIPLE_THREADS in chromium and 
+        pushes some relevant initializations from JSC::initializeThreading
+        to WTF::initializeThreading.
+
+        Reviewed by David Levin.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * wtf/FastMalloc.cpp:
+        (WTF::isForbidden):
+        (WTF::fastMallocForbid):
+        (WTF::fastMallocAllow):
+        * wtf/Platform.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        * wtf/ThreadingWin.cpp:
+        (WTF::initializeThreading):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::initializeThreading):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::initializeThreading):
+
+2011-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove operator new from JSCell
+        https://bugs.webkit.org/show_bug.cgi?id=64999
+
+        Reviewed by Oliver Hunt.
+
+        Removed the implementation of operator new in JSCell, so any further uses
+        will not successfully link.  Also removed any remaining uses of operator new.
+
+        * API/JSContextRef.cpp:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::create):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::create):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::create):
+
+2011-07-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG graph has no notion of double prediction.
+        https://bugs.webkit.org/show_bug.cgi?id=65234
+
+        Reviewed by Gavin Barraclough.
+        
+        Added the notion of PredictDouble, and PredictNumber, which is the least
+        upper bound of PredictInt32 and PredictDouble.  Least upper bound is
+        defined as the bitwise-or of two predictions.  Bottom is defined as 0,
+        and Top is defined as all bits being set.  Added the ability to explicitly
+        distinguish between a node having had a prediction associated with it,
+        and that prediction still being valid (i.e. no conflicting predictions
+        have also been added).  Used this to guard the speculative JIT from
+        speculating Int32 in cases where the graph knows that the value is
+        double, which currently only happens for GetLocal nodes on arguments
+        which were double at compile-time.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::isCellPrediction):
+        (JSC::DFG::isArrayPrediction):
+        (JSC::DFG::isInt32Prediction):
+        (JSC::DFG::isDoublePrediction):
+        (JSC::DFG::isNumberPrediction):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::initializeVariableTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isRegisterDataFormatDouble):
+
+2011-07-27  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=65294
+        DFG JIT - may speculate based on wrong arguments.
+
+        Reviewed by Oliver Hunt
+
+        In the case of a DFG compiled function calling to and compiling a second function that
+        also compiles through the DFG JIT (i.e. compilation triggered with DFGOperations.cpp),
+        we call compileFor passing the caller functions exec state, rather than the callee's.
+        This may lead to mis-optimization, since the DFG compiler will example the exec state's
+        arguments on the assumption that these will be passed to the callee - it is wanting the
+        callee exec state, not the caller's exec state.
+
+        Fixing this for all cases of compilation is tricksy, due to the way the numeric sort
+        function is compiled, & the structure of the calls in the Interpreter::execute methods.
+        Only fix for compilation from the JIT, in other calls don't speculate based on arguments
+        for now.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/Executable.cpp:
+        (JSC::tryDFGCompile):
+        (JSC::tryDFGCompileFunction):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileFor):
+
+2011-07-27  Oliver Hunt  <oliver@apple.com>
+
+        Handle callback oriented JSONP
+        https://bugs.webkit.org/show_bug.cgi?id=65271
+
+        Reviewed by Gavin Barraclough.
+
+        Handle the callback oriented versions of JSONP.  The Literal parser
+        now handles <Identifier> (. <Identifier>)* (jsonData).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::tryJSONPParse):
+        (JSC::LiteralParser::Lexer::lex):
+        * runtime/LiteralParser.h:
+
+2011-07-27  Stephanie Lewis  <slewis@apple.com>
+
+        Revert http://trac.webkit.org/changeset/90415.
+        Caused a 5% sunspider regression in-browser.
+
+        Unreviewed rollout.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::releaseExecutableMemory):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::invalidateCode):
+        * runtime/RegExp.h:
+
+2011-07-27  Shinya Kawanaka  <shinyak@google.com>
+
+        Added an interface to take IsWhiteSpaceFunctionPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=57746
+
+        Reviewed by Kent Tamura.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::stripWhiteSpace):
+          Added an interface to take IsWhiteSpaceFunctionPtr.
+        (WTF::StringImpl::simplifyWhiteSpace): ditto.
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.cpp:
+        (WTF::String::stripWhiteSpace): ditto.
+        (WTF::String::simplifyWhiteSpace): ditto.
+        * wtf/text/WTFString.h:
+
+2011-07-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT speculation failure code performs incorrect conversions in
+        the case where two registers need to be swapped.
+        https://bugs.webkit.org/show_bug.cgi?id=65233
+
+        Reviewed by Gavin Barraclough.
+        
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::GeneralizedRegister::swapWith):
+
+2011-07-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        reduce and reduceRight bind callback's this to null rather than undefined
+        https://bugs.webkit.org/show_bug.cgi?id=62264
+
+        Reviewed by Oliver Hunt.
+
+        Fixed Array.prototype.reduce and Array.prototype.reduceRight so that they behave correctly
+        when calling the callback function without an argument for this, which means it should 
+        be undefined according to ES 15.4.4.21 and 15.4.4.22.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+
+2011-07-26  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC command-line tool does not come with any facility for
+        measuring time precisely.
+        https://bugs.webkit.org/show_bug.cgi?id=65223
+
+        Reviewed by Gavin Barraclough.
+        
+        Exposed WTF::currentTime() as currentTimePrecise().
+
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionPreciseTime):
+
+2011-07-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT never emits inline double comparisons, even when it
+        would be obvious more efficient to do so.
+        https://bugs.webkit.org/show_bug.cgi?id=65212
+
+        Reviewed by Gavin Barraclough.
+        
+        This handles the obvious case of inlining double comparisons: it only addresses
+        the speculative JIT, and only for fused compare/branch sequences.  But it does
+        handle the case where both operands are double (and there is no slow path),
+        or where one operand is double and the other is unknown type (in which case it
+        attempts to unbox the double, otherwise taking slow path).  This is an 0.8%
+        speed-up on SunSpider.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertToDouble):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isRegisterDataFormatDouble):
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateInteger):
+
+2011-07-26  Filip Pizlo  <fpizlo@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64969
+        DFG JIT generates inefficient code for speculation failures.
+
+        Reviewed by Gavin Barraclough.
+        
+        This implements a speculation failure strategy where (1) values spilled on
+        non-speculative but not spilled on speculative are spilled, (2) values that
+        are in registers on both paths are rearranged without ever touching memory,
+        and (3) values spilled on speculative but not spilled on non-speculative are
+        filled.
+        
+        The register shuffling is the most interesting part of this patch.  It
+        constructs a permutation graph for registers.  Each node represents a
+        register, and each directed edge corresponds to the register's value having
+        to be moved to a different register as part of the shuffling.  This is a
+        directed graph where each node may only have 0 or 1 incoming edges, and
+        0 or 1 outgoing edges.  The algorithm then first finds maximal non-cyclic
+        subgraphs where all nodes in the subgraph are reachable from a start node.
+        Such subgraphs always resemble linked lists, and correspond to simply
+        moving the value in the second-to-last register into the last register, and
+        then moving the value in the third-to-last register into the second-to-last
+        register, and so on.  Once these subgraphs are taken care of, the remaining
+        subgraphs are cycles, and are handled using either (a) conversion or no-op
+        if the cycle involves one node, (b) swap if it involves two nodes, or (c)
+        a cyclic shuffle involving a scratch register if there are three or more
+        nodes.
+        
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::needDataFormatConversion):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::GeneralizedRegister::GeneralizedRegister):
+        (JSC::DFG::GeneralizedRegister::createGPR):
+        (JSC::DFG::GeneralizedRegister::createFPR):
+        (JSC::DFG::GeneralizedRegister::dump):
+        (JSC::DFG::GeneralizedRegister::findInSpeculationCheck):
+        (JSC::DFG::GeneralizedRegister::findInEntryLocation):
+        (JSC::DFG::GeneralizedRegister::previousDataFormat):
+        (JSC::DFG::GeneralizedRegister::nextDataFormat):
+        (JSC::DFG::GeneralizedRegister::convert):
+        (JSC::DFG::GeneralizedRegister::moveTo):
+        (JSC::DFG::GeneralizedRegister::swapWith):
+        (JSC::DFG::ShuffledRegister::ShuffledRegister):
+        (JSC::DFG::ShuffledRegister::isEndOfNonCyclingPermutation):
+        (JSC::DFG::ShuffledRegister::handleNonCyclingPermutation):
+        (JSC::DFG::ShuffledRegister::handleCyclingPermutation):
+        (JSC::DFG::ShuffledRegister::lookup):
+        (JSC::DFG::lookupForRegister):
+        (JSC::DFG::NodeToRegisterMap::Tuple::Tuple):
+        (JSC::DFG::NodeToRegisterMap::NodeToRegisterMap):
+        (JSC::DFG::NodeToRegisterMap::set):
+        (JSC::DFG::NodeToRegisterMap::end):
+        (JSC::DFG::NodeToRegisterMap::find):
+        (JSC::DFG::NodeToRegisterMap::clear):
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+        (JSC::DFG::JITCompiler::linkSpeculationChecks):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::EntryLocation::EntryLocation):
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculationCheck::SpeculationCheck):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-07-26  Oliver Hunt  <oliver@apple.com>
+
+        Buffer overflow creating error messages for JSON.parse
+        https://bugs.webkit.org/show_bug.cgi?id=65211
+
+        Reviewed by Darin Adler.
+
+        Parse string length to the UString constructor.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+
+2011-07-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor automatically generated JS DOM bindings to replace operator new with static create methods
+        https://bugs.webkit.org/show_bug.cgi?id=64732
+
+        Reviewed by Oliver Hunt.
+
+        Replacing the public constructors in the automatically generated JS DOM bindings with static 
+        create methods.  JSByteArray is used by several of these bindings in WebCore.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::create):
+        * runtime/JSByteArray.h:
+
+2011-07-26  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Unreviewed build fix for Qt/Linux.
+
+        On platforms with no glib and gstreamer we should not build javascriptcore
+        with the Glib support. This is related to http://trac.webkit.org/changeset/91752.
+
+        * wtf/wtf.pri:
+
+2011-07-26  Juan C. Montemayor  <jmont@apple.com>
+
+        JSON errors should be informative
+        https://bugs.webkit.org/show_bug.cgi?id=63339
+
+        Added error messages to the JSON Parser.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::getErrorMessage):
+        (JSC::LiteralParser::Lexer::sawError):
+        (JSC::LiteralParser::Lexer::getErrorMessage):
+
+2011-07-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r91746.
+        http://trac.webkit.org/changeset/91746
+        https://bugs.webkit.org/show_bug.cgi?id=65180
+
+        It broke SL build (Requested by Ossy on #webkit).
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::stripWhiteSpace):
+        (WTF::StringImpl::simplifyWhiteSpace):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.cpp:
+        * wtf/text/WTFString.h:
+
+2011-07-26  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Change default backend to use GStreamer on Linux and QuickTime on Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=63472
+
+        Enable the bits needed for GStreamer only when QtMultimedia is not used.
+
+        * wtf/wtf.pri:
+
+2011-07-26  Shinya Kawanaka  <shinyak@google.com>
+
+        Added an interface to take IsWhiteSpaceFunctionPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=57746
+
+        Reviewed by Kent Tamura.
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::stripWhiteSpace):
+          Added an interface to take IsWhiteSpaceFunctionPtr.
+        (WTF::StringImpl::simplifyWhiteSpace): ditto.
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.cpp:
+        (WTF::String::stripWhiteSpace): ditto.
+        (WTF::String::simplifyWhiteSpace): ditto.
+        * wtf/text/WTFString.h:
+
+2011-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG non-speculative JIT emits inefficient code for arithmetic
+        involving two registers
+        https://bugs.webkit.org/show_bug.cgi?id=65160
+
+        Reviewed by Gavin Barraclough.
+        
+        The non-speculative JIT now emits inline code for double arithmetic, but
+        still attempts integer arithmetic first.  This is a speed-up on SunSpider
+        (albeit a small one), and a large speed-up on Kraken.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+
+2011-07-25  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Build break with --debug after r89153.
+        https://bugs.webkit.org/show_bug.cgi?id=65150
+
+        Unreviewed build fix.
+
+        * wtf/CMakeListsEfl.txt: Add missing libraries.
+
+2011-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG non-speculative JIT emits obviously inefficient code for arithmetic
+        where one operand is a constant.
+        https://bugs.webkit.org/show_bug.cgi?id=65146
+
+        Reviewed by Gavin Barraclough.
+        
+        Changed the code to emit double arithmetic inline.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+
+2011-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT bytecode parser misuses pointers into objects allocated as part of a
+        WTF::Vector.
+        https://bugs.webkit.org/show_bug.cgi?id=65128
+
+        Reviewed by Gavin Barraclough.
+        
+        The bytecode parser code seems to be right to have a DFGNode& phiNode reference
+        into the graph, since this makes the code greatly more readable.  This patch
+        thus makes the minimal change necessary to make the code right: it uses a
+        pointer (to disambiguate between reloading the pointer and performing a
+        copy from one location of the vector to another) and reloads it after the
+        calls to addToGraph().
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+
+2011-07-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r91686.
+        http://trac.webkit.org/changeset/91686
+        https://bugs.webkit.org/show_bug.cgi?id=65144
+
+        1.5% regression in JSC (Requested by jmontemayor on #webkit).
+
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+
+2011-07-25  Jon Lee  <jonlee@apple.com>
+
+        Assertion called in ExecutableBase::generatedJITCodeForCall() when JIT is not available
+        https://bugs.webkit.org/show_bug.cgi?id=65132
+        <rdar://problem/9836297>
+        
+        Reviewed by Oliver Hunt.
+        
+        Make sure the JIT is available to use before running the following calls:
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkCalls): Added check, return early if JIT is not available.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addMethodCallLinkInfos): Added assertion.
+
+2011-07-25  Juan C. Montemayor  <jmont@apple.com>
+
+        JSON errors should be informative
+        https://bugs.webkit.org/show_bug.cgi?id=63339
+
+        Added error messages to the JSON Parser.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::getErrorMessage):
+        (JSC::LiteralParser::Lexer::sawError):
+        (JSC::LiteralParser::Lexer::getErrorMessage):
+
+2011-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        X86-64 assembler emits three instructions instead of two for certain
+        loads and stores.
+        https://bugs.webkit.org/show_bug.cgi?id=65095
+
+        Reviewed by Gavin Barraclough.
+        
+        Simply made these four methods in the assembler use the scratch register,
+        which they were previously avoiding.  It still optimizes for the case where
+        an absolute address memory accesses is using EAX.  This results in a slight
+        performance improvement.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::load32):
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::loadPtr):
+        (JSC::MacroAssemblerX86_64::storePtr):
+
+2011-07-25  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Implement EFL-specific current time and monotonicallyIncreasingTime.
+        https://bugs.webkit.org/show_bug.cgi?id=64354
+
+        Use ecore_time_unix_get which returns unix time as double type for currentTime
+        and ecore_time_get which uses monotonic clock for monotonicallyIncreasingTime.
+
+        Reviewed by Kent Tamura.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+        (WTF::monotonicallyIncreasingTime):
+
+2011-07-22  Sommer Panage  <panage@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        export JSContextCreateBacktrace as SPI in JSContextRefPrivate.h
+        https://bugs.webkit.org/show_bug.cgi?id=64981
+
+        UIAutomation for iOS would like to support a Javascript backtrace in our error logs.
+        Currently, the C API does not provide the tools to do this. However, the private API
+        does expose the necessary functionality to get a backtrace
+        (via Interpreter::retrieveLastCaller). We recognize this information may result in
+        failure in the cases of programs run by 'eval', stack frames beneath host function
+        call frames, and in programs run from other programs. Thus, we propose exporting our
+        JSContextCreateBacktrace in JSContextRefPrivate.h. This will provide us with the tools
+        we need while not advertising an API that isn't really ready for full use.
+
+        * API/JSContextRef.cpp:
+        * API/JSContextRefPrivate.h:
+        * JavaScriptCore.exp:
+
+
+2011-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=65051
+        DFG JIT - Enable by default for mac platform on x86-64.
+
+        Rubber Stamped by Geoff Garen.
+
+        This is now a performance progression.
+
+        * wtf/Platform.h:
+            - Removed definition of ENABLE_DFG_JIT_RESTRICTIONS.
+
+2011-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=65047
+        DFG JIT - Add support for op_resolve/op_resolve_base
+
+        Reviewed by Sam Weinig.
+
+        These are necessary for any significant eval code coverage
+        (and as such increase LayoutTest coverage).
+
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::recordResolve):
+            - Conservatively blow aliasing optimizations for now.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+            - Add support for op_resolve/op_resolve_base.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::callOperation):
+            - Add call with exec, identifer aguments.
+        * dfg/DFGNode.h:
+            - Add new node types.
+        (JSC::DFG::Node::hasIdentifier):
+            - Resolve nodes have identifiers, too!
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+            - Add generation for new Nodes.
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+            - Added new operations.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Add generation for new Nodes.
+
+2011-07-22  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=65036
+        Messing with the register allocation within flow control = badness.
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+            - Fix register allocation.
+
+2011-07-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Date.prototype.toISOString doesn't handle negative years or years > 9999 correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=63986
+
+        Reviewed by Geoffrey Garen.
+
+        Changed the implementation of Date.prototype.toISOString() to use the extended year
+        format (+/-yyyyyy) for years outside of [0,9999] to be in compliance with ES 15.9.1.15.1.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
+
+2011-07-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-07-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix after r91555.
+
+        * JavaScriptCore.exp:
+
+2011-07-21  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=19271
+        eliminate PIC branches by changing NaN handling in JSValue::toNumber
+
+        Reviewed by Sam Weinig.
+
+        Moving the non-numeric cases out of line seems to be a consistent
+        win on SunSpider for me, to the order of about 0.5%.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toNumber):
+            - Changed to only handle values that are already numbers, moce non-numeric cases out of line.
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toNumberSlowCase):
+            - Added toNumberSlowCase, handling non-numeric cases.
+        * runtime/JSValue.h:
+            - Add declaration of toNumberSlowCase.
+
+2011-07-21  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64875
+        Use of `yield` keyword is broken
+
+        Reviewed by Sam Weinig.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseIdentifier):
+            - The bug here is that a successful match of a RESERVED_IF_STRICT token from
+              parseKeyword is being nullified back to IDENT. The problem is that in the
+              case of IDENT matches parseKeyword should not move the lexer's input
+              position, but in the case of RESERVED_IF_STRICT it has done so.
+
+2011-07-21  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64900
+        Function.prototype.apply should accept an array-like object as its second argument
+
+        Reviewed by Sam Weinig.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+            - Remove the type error if object is not an array.
+
+2011-07-21  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64964
+        DFG JIT - Enable support for eval code
+
+        Reviewed by Sam Weinig.
+
+        This is basically the same as program code, to the JIT!
+
+        * bytecode/Opcode.cpp:
+        * bytecode/Opcode.h:
+            - Enable opcodeNames in !NDEBUG builds.
+        * dfg/DFGOperations.cpp:
+            - Fix a bug exposed by eval support, throw correct type error for new.
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+            - Enable DFG JIT for eval code.
+
+2011-07-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r91380.
+        http://trac.webkit.org/changeset/91380
+        https://bugs.webkit.org/show_bug.cgi?id=64924
+
+        Caused assertion failures in Chromium's IndexedDB tests
+        (Requested by rniwa on #webkit).
+
+        * wtf/ThreadIdentifierDataPthreads.cpp:
+        (WTF::ThreadIdentifierData::identifier):
+        (WTF::ThreadIdentifierData::initialize):
+        (WTF::ThreadIdentifierData::initializeKeyOnceHelper):
+        (WTF::ThreadIdentifierData::initializeKeyOnce):
+        * wtf/ThreadIdentifierDataPthreads.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+
+2011-07-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG non-speculative JIT does not use() the aliased GetByVal,
+        resulting in bloated use counts.
+        https://bugs.webkit.org/show_bug.cgi?id=64911
+
+        Reviewed by Gavin Barraclough.
+        
+        Inserted a call to use() for the aliased GetByVal.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+
+2011-07-20  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64909
+        DFG JIT - Missing ToInt32 conversions for double constants.
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::toInt32):
+            - We cannot trivially omit ToInt32 conversions on double constants.
+
+2011-07-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT sometimes claims to use compare operands twice, leading to
+        use count corruption.
+        https://bugs.webkit.org/show_bug.cgi?id=64903
+
+        Reviewed by Gavin Barraclough.
+        
+        Move the calls to use() in SpeculativeJIT::compare() so that they only happen
+        if the JITCodeGenerator's helper method (which also calls use()) is not called.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+
+2011-07-20  Oliver Hunt  <oliver@apple.com>
+
+        Don't throw away code when JSGarbageCollect API is called
+        https://bugs.webkit.org/show_bug.cgi?id=64894
+
+        Reviewed by Sam Weinig.
+
+        Just call collectAllGarbage.  That will clean up all unneeded
+        code without causing any pathological recompilation problems.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+
+2011-07-20  Oliver Hunt  <oliver@apple.com>
+
+        Codeblock doesn't visit cached structures in global resolve instructions
+        https://bugs.webkit.org/show_bug.cgi?id=64889
+
+        Reviewed by Sam Weinig.
+
+        Visit the global resolve instructions.  This fixes a couple
+        of random crashes seen in the jquery tests when using the
+        interpreter.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+
+2011-07-20  James Robinson  <jamesr@chromium.org>
+
+        Revert worker and WebKit2 runloops to use currentTime() for scheduling instead of the monotonic clock
+        https://bugs.webkit.org/show_bug.cgi?id=64841
+
+        Reviewed by Mark Rowe.
+
+        http://trac.webkit.org/changeset/91206 converted most of WebKit's deferred work scheduling to using the
+        monotonic clock instead of WTF::currentTime().  This broke many plugin tests on WebKit2 for reasons that are
+        unclear.  This reverts everything except for WebCore::ThreadTimers back to the previous behavior.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadCondition::timedWait):
+        * wtf/ThreadingWin.cpp:
+        (WTF::absoluteTimeToWaitTimeoutInterval):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadCondition::timedWait):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+2011-07-14  David Levin  <levin@chromium.org>
+
+        currentThread is too slow!
+        https://bugs.webkit.org/show_bug.cgi?id=64577
+
+        Reviewed by Darin Adler and Dmitry Titov.
+
+        The problem is that currentThread results in a pthread_once call which always takes a lock.
+        With this change, currentThread is 10% faster than isMainThread in release mode and only
+        5% slower than isMainThread in debug.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp:
+        (WTF::ThreadIdentifierData::initializeOnce): Remove the pthread once stuff
+        which is no longer needed because this is called from initializeThreading().
+        (WTF::ThreadIdentifierData::identifier): Remove the initializeKeyOnce call because
+        intialization of the pthread key should already be done.
+        (WTF::ThreadIdentifierData::initialize): Ditto.
+        * wtf/ThreadIdentifierDataPthreads.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): Acquire the pthread key here.
+
+2011-07-20  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+
+2011-07-19  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64678
+        Fix bugs in Object.prototype this handling.
+
+        Reviewed by Darin Adler.
+
+        Fix ES5.1 correctness issues identified by Mads Ager.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+            - ES5.1 expects toString of undefined/null to produce "[object Undefined]"/"[object Null]".
+
+2011-07-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        [JSC] WebKit allocates gigabytes of memory when doing repeated string concatenation
+        https://bugs.webkit.org/show_bug.cgi?id=63918
+
+        Reviewed by Darin Adler.
+
+        When allocating JSStrings during concatenation, we needed to call the Heap's reportExtraMemoryCost
+        method due to additional string copying within several of the constructors when dealing with 
+        UStrings.  This has been added to the UString version of the appendStringInConstruct method 
+        within the JSString class.
+
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+
+2011-07-19  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64679
+        Fix bugs in Array.prototype this handling.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+            - These methods should throw if this value is undefined.
+
+2011-07-19  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64677
+        Fix bugs in String.prototype this handling.
+
+        Reviewed by Oliver Hunt.
+
+        undefined/null this values should throw TypeErrors, not convert to
+        the global object, and primitive values should not be converted via
+        object types.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+            - These methods should throw if this value is undefined,
+              convert ToString directly, not via ToObject.
+
+2011-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT sometimes emits spill code even when the respective values
+        are never needed.
+        https://bugs.webkit.org/show_bug.cgi?id=64774
+
+        Reviewed by Gavin Barraclough.
+        
+        The main high-level change is that it is now easier to call use() on a
+        virtual register.  JSValueOperand and its other-typed relatives now have
+        a handy use() method, and jsValueResult() and friends now make it easier to
+        pass UseChildrenCalledExplicitly.
+        
+        The rest of this patch hoists the call to use() as high as possible for
+        all of those cases where either flushRegisters() or silentSpillAllRegisters()
+        may be called.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedGetMethod):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeStrictEq):
+        (JSC::DFG::JITCodeGenerator::emitBranch):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::use):
+        (JSC::DFG::JITCodeGenerator::integerResult):
+        (JSC::DFG::JITCodeGenerator::jsValueResult):
+        (JSC::DFG::IntegerOperand::use):
+        (JSC::DFG::DoubleOperand::use):
+        (JSC::DFG::JSValueOperand::use):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::valueToNumber):
+        (JSC::DFG::NonSpeculativeJIT::valueToInt32):
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculateStrictInt32Operand::use):
+        (JSC::DFG::SpeculateCellOperand::use):
+
+2011-07-19  Xan Lopez  <xlopez@igalia.com>
+
+        ARMv7 backend broken, lacks 3 parameter rshift32 method
+        https://bugs.webkit.org/show_bug.cgi?id=64571
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::rshift32): add missing rshift32 method.
+
+2011-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not optimize strict equality as effectively as the old JIT does.
+        https://bugs.webkit.org/show_bug.cgi?id=64759
+
+        Reviewed by Gavin Barraclough.
+        
+        This adds a more complete set of strict equality optimizations.  If either
+        operand is known numeric, then the code reverts to the old style of optimizing
+        (first try integer comparison).  Otherwise it uses the old JIT's trick of
+        first simultaneously checking if both operands are either numbers or cells;
+        if not then a fast path is taken.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeStrictEq):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-18  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64760
+        DFG JIT - Should be able to compile program code.
+
+        Reviewed by Geoff Garen.
+
+        Add support for op_end, hooks to compile program code in Executable.cpp.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+            - Add support for op_end
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+            - Added, separate out steps of compileFunction.
+        (JSC::DFG::JITCompiler::compile):
+            - Added, compile program code.
+        (JSC::DFG::JITCompiler::compileFunction):
+            - Sections separated out to helper functions.
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::JITCompiler):
+            - Added m_exceptionCheckCount.
+        * runtime/Executable.cpp:
+        (JSC::tryDFGCompile):
+        (JSC::tryDFGCompileFunction):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+            - Renamed tryDFGCompile to tryDFGCompileFunction, added tryDFGCompile to compile program code.
+
+2011-07-18  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64678
+        Fix bugs in Object.prototype this handling.
+
+        Reviewed by Oliver Hunt.
+
+        undefined/null this values should throw TypeErrors, not convert to the global object,
+        also, to toLocaleString should be calling the ToObject & invoking the object's toString
+        function, even for values that are already strings.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+
+2011-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC lazy sweep does not inline the common cases of cell destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=64745
+
+        Reviewed by Oliver Hunt.
+        
+        This inlines the case of JSFinalObject destruction.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::lazySweep):
+
+2011-07-18  Oliver Hunt  <oliver@apple.com>
+
+        Interpreter build-fix
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2011-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not optimize equal-null comparisons and branches.
+        https://bugs.webkit.org/show_bug.cgi?id=64659
+
+        Reviewed by Gavin Barraclough.
+        
+        Added a peephole-aware compare-to-null implementation to JITCodeGenerator,
+        which is used by both the speculative and non-speculative JIT.  Through
+        the use of the new isNullConstant helper, the two JITs invoke the
+        nonSpecualtiveCompareNull() helper instead of their regular comparison
+        helpers when compiling CompareEq.  Through the use of the new isKnownCell
+        helper, the compare-null code will skip the is-a-cell check if the
+        speculative JIT had been speculating cell.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownCell):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCompareNull):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::isNullConstant):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-18  James Robinson  <jamesr@chromium.org>
+
+        Timer scheduling should be based off the monotonic clock
+        https://bugs.webkit.org/show_bug.cgi?id=64544
+
+        Reviewed by Darin Adler.
+
+        Switches ThreadCondition::timedWait and related utility functions from currentTime() to
+        monotonicallyIncreasingTime().
+
+        Add WTF::monotonicallyIncreasingTime() to list of exported functions so it can be accessed from WebCore/WebKit.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadCondition::timedWait):
+        * wtf/ThreadingWin.cpp:
+        (WTF::absoluteTimeToWaitTimeoutInterval):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadCondition::timedWait):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+2011-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC JIT does not inline GC allocation fast paths
+        https://bugs.webkit.org/show_bug.cgi?id=64582
+
+        Reviewed by Oliver Hunt.
+
+        This addresses inlining allocation for the easiest-to-allocate cases:
+        op_new_object and op_create_this.  Inlining GC allocation fast paths
+        required three changes.  First, the JSGlobalData now saves the vtable
+        pointer of JSFinalObject, since that's what op_new_object and
+        op_create_this allocate.  Second, the Heap exposes a reference to
+        the appropriate SizeClass, so that the JIT may inline accesses
+        directly to the SizeClass for JSFinalObject allocations.  And third,
+        the JIT is extended with code to emit inline fast paths for GC
+        allocation.  A stub call is emitted in the case where the inline fast
+        path fails.
+
+        * heap/Heap.h:
+        (JSC::Heap::sizeClassFor):
+        (JSC::Heap::allocate):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateJSFinalObject):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSObject::offsetOfInheritorID):
+
+2011-07-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor JSC to replace JSCell::operator new with static create method
+        https://bugs.webkit.org/show_bug.cgi?id=64466
+
+        Reviewed by Oliver Hunt (oliver@apple.com) and Darin Adler (darin@apple.com).
+
+        First step in a longer refactoring process to remove the use of
+        operator new overloading in order to allocate GC objects and to replace
+        this method with static create methods for each individual type of heap-allocated
+        JS object.  This particular patch only deals with replacing uses of
+        operator new within JSC proper.  Future patches will remove it from the
+        parts that interface with the DOM.  Due to the DOM's continued dependence
+        on it, operator new has not actually been removed from JSCell.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::create):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::create):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::operator new):
+        (JSC::JSCallbackObject::create):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::createActivation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::create):
+        (GlobalObject::GlobalObject):
+        (functionRun):
+        (jscmain):
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::createNoParameters):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::create):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::create):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        (JSC::BooleanConstructor::create):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::create):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::create):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::create):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::create):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::create):
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (JSC::createEvalError):
+        (JSC::createRangeError):
+        (JSC::createReferenceError):
+        (JSC::createSyntaxError):
+        (JSC::createTypeError):
+        (JSC::createURIError):
+        (JSC::StrictModeTypeErrorFunction::create):
+        (JSC::createTypeErrorFunction):
+        * runtime/ErrorConstructor.h:
+        (JSC::ErrorConstructor::create):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::InterruptedExecutionError::create):
+        (JSC::createInterruptedExecutionException):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        (JSC::TerminatedExecutionError::create):
+        (JSC::createTerminatedExecutionException):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::create):
+        (JSC::NativeExecutable::create):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::create):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::make):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+        (JSC::FunctionConstructor::create):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::create):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::create):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::create):
+        (JSC::jsAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        * runtime/JSCell.h:
+        (JSC::JSCell::allocateCell):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::create):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::create):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::putDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::create):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSString.cpp:
+        (JSC::JSString::substringFromRope):
+        (JSC::JSString::replaceCharacter):
+        (JSC::StringObject::create):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::create):
+        (JSC::RopeBuilder::createHasOtherOwner):
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsNontrivialString):
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        (JSC::JSValue::synthesizePrototype):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/MathObject.h:
+        (JSC::MathObject::create):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::create):
+        * runtime/NativeErrorPrototype.h:
+        (JSC::NativeErrorPrototype::create):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::create):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::create):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::create):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::create):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::create):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::createWithoutCaching):
+        (JSC::RegExp::create):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::arrayOfMatches):
+        (JSC::constructRegExp):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::create):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::create):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::create):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::create):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::create):
+        (JSC::ScopeChainNode::push):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createEmptyString):
+        (JSC::SmallStrings::createSingleCharacterString):
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::create):
+        * runtime/StringObject.h:
+        (JSC::StringObject::create):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::create):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::createStructure):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+
+2011-07-17  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Refactor scheduleDispatchFunctionsOnMainThread to fix crash.
+        https://bugs.webkit.org/show_bug.cgi?id=64337
+
+        Replace ecore_timer_add to Ecore_Pipe.
+        This is needed because ecore_timer should not be called in a child thread,
+        but in the main thread.
+
+        Reviewed by Antonio Gomes.
+
+        * wtf/efl/MainThreadEfl.cpp:
+        (WTF::pipeObject):
+        (WTF::monitorDispatchFunctions):
+        (WTF::initializeMainThreadPlatform):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2011-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT operationCompareEqual does not inline JSValue::equalSlowCaseInline.
+        https://bugs.webkit.org/show_bug.cgi?id=64637
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGOperations.cpp:
+
+2011-07-16  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64657
+        Converted this value not preserved when accessed via direct eval.
+
+        Reviewed by Oliver Hunt.
+
+        Upon entry into a non-strict function, primitive this values should be boxed as Object types
+        (or substituted with the global object) - which is done by op_convert_this. However we only
+        do so where this is used lexically within the function (we omit the conversion op if not).
+        The problem comes if a direct eval (running within the function's scope) accesses the this
+        value.
+
+        We are safe in the case of a single eval, since the this object will be converted within
+        callEval, however the converted value is not preserved, and a new wrapper object is allocated
+        each time eval is invoked. This is inefficient and incorrect, since any changes to the wrapper
+        object will be lost between eval statements.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+            - If a function uses eval, we always need to convert this.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+            - Don't convert primitive values here - this is too late!
+        (JSC::Interpreter::privateExecute):
+            - Changed op_convert_this to call new isPrimitive method.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Changed op_convert_this to call new isPrimitive method.
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::isPrimitive):
+            - Added JSValue::isPrimitive.
+        * runtime/JSValue.h:
+            - Added JSValue::isPrimitive.
+
+2011-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT compare/branch code emits is-integer tests even when a value is
+        definitely not an integer.
+        https://bugs.webkit.org/show_bug.cgi?id=64654
+
+        Reviewed by Gavin Barraclough.
+        
+        Added the isKnownNotInteger() method, which returns true if a node is
+        definitely not an integer and will always fail any is-integer test.  Then
+        modified the compare and branch code to use this method; if it returns
+        true then is-int tests are omitted and the compiler always emits a slow
+        call.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCompare):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+
+2011-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT has dead code for slow calls for branches.
+        https://bugs.webkit.org/show_bug.cgi?id=64653
+
+        Reviewed by Gavin Barraclough.
+        
+        Removed SpeculativeJIT::compilePeepHoleCall.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-07-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * dfg/DFGGraph.h:
+
+2011-07-15  Gavin Barraclough  <barraclough@apple.com>
+
+        NativeError.prototype objects have [[Class]] of "Object" but should be "Error"
+        https://bugs.webkit.org/show_bug.cgi?id=55346
+
+        Reviewed by Sam Weinig.
+
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+            - Switch to putDirect since we're not the only ones tranitioning this Structure now.
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+            - Switch base class to ErrorPrototype.
+
+2011-07-15  Gavin Barraclough  <barraclough@apple.com>
+
+        DFG JIT - Where arguments passed are integers, speculate this.
+        https://bugs.webkit.org/show_bug.cgi?id=64630
+
+        Reviewed by Sam Weinig.
+
+        Presently the DFG JIT is overly aggressively predicting double.
+        Use a bit of dynamic information, and curtail this a little.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::predictArgumentTypes):
+            - Check for integer arguments.
+        * dfg/DFGGraph.h:
+            - Function declaration.
+        * runtime/Executable.cpp:
+        (JSC::tryDFGCompile):
+        (JSC::FunctionExecutable::compileForCallInternal):
+            - Add call to predictArgumentTypes.
+
+2011-07-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT is inconsistent about fusing branches and speculating
+        integer comparisons for branches.
+        https://bugs.webkit.org/show_bug.cgi?id=64573
+
+        Reviewed by Gavin Barraclough.
+        
+        This patch moves some of NonSpeculativeJIT's functionality up into the
+        JITCodeGenerator superclass so that it can be used from both JITs.  Now,
+        in cases where the speculative JIT doesn't want to speculate but still
+        wants to emit good code, it can reliably emit the same code sequence as
+        the non-speculative JIT.  This patch also extends the non-speculative
+        JIT's compare optimizations to include compare/branch fusing, and
+        extends the speculative JIT's compare optimizations to cover StrictEqual.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::isKnownInteger):
+        (JSC::DFG::JITCodeGenerator::isKnownNumeric):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativePeepholeBranch):
+        (JSC::DFG::JITCodeGenerator::nonSpeculativeCompare):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::detectPeepHoleBranch):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        * wtf/Platform.h:
+
+2011-07-14  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64250
+        Global strict mode function leaking global object as "this".
+
+        Reviewed by Oliver Hunt.
+
+        The root problem here is that we pass the wrong values into
+        calls, and then try to fix them up in the callee. Correct
+        behaviour per the spec is to pass in the value undefined,
+        as this unless either (1) the function call is based on an
+        explicit property access or (2) the base of the call comes
+        directly from a 'with'.
+
+        This change does away with the need for this conversion of
+        objects (non strict code should only box primitives), and
+        does away with all this conversion for strict functions.
+
+        This patch may have web compatibility ramifications, and may
+        require some advocacy.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * bytecode/Opcode.h:
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * bytecompiler/BytecodeGenerator.h:
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Change NeedsThisConversion check to test for JSString's vptr
+              (objects no longer need conversion).
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveThisAndProperty):
+            - Based on resolveBaseAndProperty, but produce correct this value.
+        (JSC::Interpreter::privateExecute):
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_with_this):
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+            - Change NeedsThisConversion check to test for JSString's vptr
+              (objects no longer need conversion).
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_with_this):
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+            - Change NeedsThisConversion check to test for JSString's vptr
+              (objects no longer need conversion).
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * jit/JITStubs.h:
+            - Removed op_convert_this_strict, added op_resolve_with_this.
+        * runtime/JSActivation.h:
+            - removed NeedsThisConversion flag, added IsEnvironmentRecord.
+        * runtime/JSStaticScopeObject.h:
+            - removed NeedsThisConversion flag, added IsEnvironmentRecord.
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createStructure):
+            - removed NeedsThisConversion.
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::isEnvironmentRecord):
+        (JSC::TypeInfo::overridesHasInstance):
+            - removed NeedsThisConversion flag, added IsEnvironmentRecord.
+        * runtime/JSValue.h:
+            - removed NeedsThisConversion.
+        * runtime/JSVariableObject.h:
+            - Corrected StructureFlags inheritance.
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::createStructure):
+            - Added IsEnvironmentRecord to StructureFlags, addded createStructure.
+        * runtime/Structure.h:
+            - removed NeedsThisConversion.
+        * tests/mozilla/ecma/String/15.5.4.6-2.js:
+        (getTestCases):
+            - Removed invalid test case.
+
+2011-07-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r91082, r91087, and r91089.
+        http://trac.webkit.org/changeset/91082
+        http://trac.webkit.org/changeset/91087
+        http://trac.webkit.org/changeset/91089
+        https://bugs.webkit.org/show_bug.cgi?id=64616
+
+        gtk tests are failing a lot after this change. (Requested by
+        dave_levin on #webkit).
+
+        * wtf/ThreadIdentifierDataPthreads.cpp:
+        (WTF::ThreadIdentifierData::identifier):
+        (WTF::ThreadIdentifierData::initialize):
+        (WTF::ThreadIdentifierData::initializeKeyOnceHelper):
+        (WTF::ThreadIdentifierData::initializeKeyOnce):
+        * wtf/ThreadIdentifierDataPthreads.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+
+2011-07-15  David Levin  <levin@chromium.org>
+
+        Another attempted build fix.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp: Add include to pick
+        up the definition of PTHREAD_KEYS_MAX.
+
+2011-07-15  David Levin  <levin@chromium.org>
+
+        Chromium build fix.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp: Add include to pick
+        up the definition of PTHREAD_KEYS_MAX.
+
+2011-07-14  David Levin  <levin@chromium.org>
+
+        currentThread is too slow!
+        https://bugs.webkit.org/show_bug.cgi?id=64577
+
+        Reviewed by Darin Adler and Dmitry Titov.
+
+        The problem is that currentThread results in a pthread_once call which always takes a lock.
+        With this change, currentThread is 10% faster than isMainThread in release mode and only
+        5% slower than isMainThread in debug.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp:
+        (WTF::ThreadIdentifierData::initializeOnce): Remove the pthread once stuff
+        which is no longer needed because this is called from initializeThreading().
+        (WTF::ThreadIdentifierData::identifier): Remove the initializeKeyOnce call because
+        intialization of the pthread key should already be done.
+        (WTF::ThreadIdentifierData::initialize): Ditto.
+        * wtf/ThreadIdentifierDataPthreads.h:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading): Acquire the pthread key here.
+
+2011-07-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not optimize Branch as well as it could.
+        https://bugs.webkit.org/show_bug.cgi?id=64574
+
+        Reviewed by Gavin Barraclough.
+        
+        This creates a common code path for emitting unfused branches, which does
+        no speculation, and only performs a slow call if absolutely necessary.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitBranch):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-14  Filip Pizlo  <fpizlo@apple.com>
+
+        GC allocation fast path has too many operations.
+        https://bugs.webkit.org/show_bug.cgi?id=64493
+
+        Reviewed by Darin Adler.
+        
+        Changed the timing of the lazy sweep so that it occurs when we land on
+        a previously-unsweeped block, rather than whenever we land on an unsweeped
+        cell.  After the per-block lazy sweep occurs, the block is turned into a
+        singly linked list of free cells.  The allocation fast path is now just a
+        load-branch-store to remove a cell from the head of the list.
+        
+        Additionally, this changes the way new blocks are allocated.  Previously,
+        they would be populated with dummy cells.  With this patch, they are
+        turned into a free list, which means that there will never be destructor
+        calls for allocations in fresh blocks.
+        
+        These changes result in a 1.9% speed-up on V8, and a 0.6% speed-up on
+        SunSpider.  There are no observed statistically significant slow-downs
+        on any individual benchmark.
+
+        * JavaScriptCore.exp:
+        * heap/Heap.cpp:
+        (JSC::Heap::allocateSlowCase):
+        (JSC::Heap::collect):
+        (JSC::Heap::canonicalizeBlocks):
+        (JSC::Heap::resetAllocator):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        (JSC::Heap::forEachCell):
+        (JSC::Heap::forEachBlock):
+        (JSC::Heap::allocate):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::lazySweep):
+        (JSC::MarkedBlock::blessNewBlockForFastPath):
+        (JSC::MarkedBlock::blessNewBlockForSlowPath):
+        (JSC::MarkedBlock::canonicalizeBlock):
+        * heap/MarkedBlock.h:
+        * heap/NewSpace.cpp:
+        (JSC::NewSpace::addBlock):
+        (JSC::NewSpace::canonicalizeBlocks):
+        * heap/NewSpace.h:
+        (JSC::NewSpace::allocate):
+        (JSC::NewSpace::SizeClass::SizeClass):
+        (JSC::NewSpace::SizeClass::canonicalizeBlock):
+        * heap/OldSpace.cpp:
+        (JSC::OldSpace::addBlock):
+
+2011-07-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT crashes on host constructor calls in debug mode.
+        https://bugs.webkit.org/show_bug.cgi?id=64562
+        
+        Reviewed by Gavin Barraclough.
+        
+        Fixed the relevant ASSERT.
+
+        * dfg/DFGOperations.cpp:
+
+2011-07-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT contains a FIXME for rewinding speculative code generation that
+        has already been fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=64022
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+
+2011-07-14  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Add OwnPtr specialization for Ecore_Pipe.
+        https://bugs.webkit.org/show_bug.cgi?id=64515
+
+        Add an overload for deleteOwnedPtr(Ecore_Pipe*) on EFL port.
+
+        Reviewed by Xan Lopez.
+
+        * wtf/OwnPtrCommon.h:
+        * wtf/efl/OwnPtrEfl.cpp:
+        (WTF::deleteOwnedPtr):
+
+2011-07-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT unnecessarily boxes and unboxes values during silent spilling.
+        https://bugs.webkit.org/show_bug.cgi?id=64068
+
+        Reviewed by Gavin Barraclough.
+        
+        Silent spilling and filling of registers is done during slow-path C
+        function calls.  The silent spill/fill logic does not affect register
+        allocation on paths that don't involve the C function call.
+        
+        This changes the silent spilling code to spill in unboxed form.  The
+        silent fill will refill in whatever form the register was spilled in.
+        For example, the silent spill code may choose not to spill the register
+        because it was already spilled previously, which would imply that it
+        was spilled in boxed form.  The filling code detects this and either
+        unboxes, or not, depending on what is appropriate.
+        
+        This change also results in a simplification of the silent spill/fill
+        API: silent spilling no longer needs to know about the set of registers
+        that cannot be trampled, since it never does boxing and hence does not
+        need a temporary register.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentSpillGPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillFPR):
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillAllRegisters):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::valueToNumber):
+        (JSC::DFG::NonSpeculativeJIT::valueToInt32):
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+        (JSC::DFG::NonSpeculativeJIT::compare):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-13  Michael Saboff  <msaboff@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64202
+        Enh: Improve handling of RegExp in the form of /.*blah.*/
+
+        Reviewed by Gavin Barraclough.
+
+        Added code to both the Yarr interpreter and JIT to handle
+        these expressions a little differently.  First off, the terms
+        in between the leading and trailing .*'s cannot capture and
+        also this enhancement is limited to single alternative expressions.
+        If an expression is of the right form with the aforementioned
+        restrictions, we process the inner terms and then look for the
+        beginning of the string and end of the string.  There is handling 
+        for multiline expressions to allow the beginning and end to be 
+        right after and right before newlines.
+
+        This enhancement speeds up expressions of this type 12x on
+        a MacBookPro.
+
+        Cleaned up 'case' statement indentation.
+
+        A new set of tests was added as LayoutTests/fast/regex/dotstar.html
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::InputStream::end):
+        (JSC::Yarr::Interpreter::matchDotStarEnclosure):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::assertionDotStarEnclosure):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::ByteTerm::DotStarEnclosure):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generateDotStarEnclosure):
+        (JSC::Yarr::YarrGenerator::backtrackDotStarEnclosure):
+        (JSC::Yarr::YarrGenerator::generateTerm):
+        (JSC::Yarr::YarrGenerator::backtrackTerm):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::YarrPatternConstructor::containsCapturingTerms):
+        (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
+        (JSC::Yarr::YarrPattern::compile):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm):
+
+2011-07-13  Xan Lopez  <xlopez@igalia.com>
+
+        [GTK] Fix distcheck
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.list.am: add missing files.
+
+2011-07-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not implement prototype chain or list caching for get_by_id.
+        https://bugs.webkit.org/show_bug.cgi?id=64147
+
+        Reviewed by Gavin Barraclough.
+        
+        This implements unified support for prototype caching, prototype chain
+        caching, and polymorphic (i.e. list) prototype and prototype chain
+        caching.  This is done by creating common code for emitting prototype
+        or chain access stubs, and having it factored out into
+        generateProtoChainAccessStub().  This function is called by
+        tryCacheGetByID once the latter determines that some form of prototype
+        access caching is necessary (i.e. the slot being accessed is not on the
+        base value but on some other object).
+        
+        Direct prototype list, and prototype chain list, caching is implemented by
+        linking the slow path to operationGetByIdProtoBuildList(), which uses the
+        same helper function (generateProtoChainAccessStub()) as tryCacheGetByID.
+        
+        This change required ensuring that the value in the scratchGPR field in
+        StructureStubInfo is preserved even after the stub info is in the
+        chain, or proto_list, states.  Hence scratchGPR was moved out of the union
+        and into the top-level of StructureStubInfo.
+        
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitRestoreScratch):
+        (JSC::DFG::linkRestoreScratch):
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::dfgBuildGetByIDProtoList):
+        (JSC::DFG::tryCachePutByID):
+        * dfg/DFGRepatch.h:
+
+2011-07-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Standardize WinCairo conditionalized code under PLATFORM macro.
+        https://bugs.webkit.org/show_bug.cgi?id=64377
+
+        Reviewed by Maciej Stachowiak.
+
+        * wtf/Platform.h: Update to use PLATFORM(WIN_CAIRO) for tests.
+
+2011-07-13  David Levin  <levin@chromium.org>
+
+        Possible race condition in ThreadIdentifierData::initializeKeyOnce and shouldCallRealDebugger.
+        https://bugs.webkit.org/show_bug.cgi?id=64465
+
+        Reviewed by Dmitry Titov.
+
+        There isn't a good way to test this as it is very highly unlikely to occur.
+
+        * wtf/ThreadIdentifierDataPthreads.cpp:
+        (WTF::ThreadIdentifierData::initializeKeyOnce): Since scoped static initialization
+        isn't thread-safe, change the initialization to be global.
+
+2011-07-12  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64424
+        Our direct eval behaviour deviates slightly from the spec.
+
+        Reviewed by Oliver Hunt.
+
+        The ES5 spec defines a concept of 'Direct Call to Eval' (see section 15.1.2.1.1), where
+        behaviour will differ from that of an indirect call (e.g. " { eval: window.eval }.eval();"
+        or "var a = eval; a();" are indirect calls), particularly in non-strict scopes variables
+        may be introduced into the caller's environment.
+
+        ES5 direct calls are any call where the callee function is provided by a reference, a base
+        of that Reference is an EnvironmentRecord (this corresponds to all productions
+        "PrimaryExpression: Identifier", see 10.2.2.1 GetIdentifierReference), and where the name
+        of the reference is "eval". This means any expression of the form "eval(...)", and that
+        calls the standard built in eval method from on the Global Object, is considered to be
+        direct.
+
+        In JavaScriptCore we are currently overly restrictive. We also check that the
+        EnvironmentRecord that is the base of the reference is the Declaractive Environment Record
+        at the root of the scope chain, corresponding to the Global Object - an "eval(..)" statement
+        that hits a var eval in a nested scope is not considered to be direct. This behaviour does
+        not emanate from the spec, and is incorrect.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            - Fixed direct eval check in op_call_eval.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Fixed direct eval check in op_call_eval.
+        * runtime/Executable.h:
+        (JSC::isHostFunction):
+            - Added check for host function with specific NativeFunction.
+
+2011-07-13  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        Broken build on QNX
+        https://bugs.webkit.org/show_bug.cgi?id=63717
+
+        QNX doesn't support pthread's SA_RESTART (required by
+        JSC_MULTIPLE_THREADS), JIT is broken at runtime and there a
+        few minor compilation errors here and there.
+
+        Original patch by Ritt Konstantin <ritt.ks@gmail.com>, also
+        tested by him on QNX v6.5 (x86)
+
+        * wtf/DateMath.cpp: fix usage of abs/labs
+        * wtf/Platform.h: Disable JIT and JSC_MULTIPLE_THREADS
+        * wtf/StackBounds.cpp: Add a couple of missing includes (and sort them)
+
+2011-07-12  Anders Carlsson  <andersca@apple.com>
+
+        If a compiler has nullptr support, include <cstddef> to get the nullptr_t definition
+        https://bugs.webkit.org/show_bug.cgi?id=64429
+
+        Include the cstddef which has the nullptr_t typedef according to the C++0x standard.
+
+        * wtf/NullPtr.h:
+
+2011-07-13  MORITA Hajime  <morrita@google.com>
+
+        Refactoring: Ignored ExceptionCode value should be less annoying.
+        https://bugs.webkit.org/show_bug.cgi?id=63688
+
+        Added ASSERT_AT macro.
+
+        Reviewed by Darin Adler.
+
+        * wtf/Assertions.h:
+
+2011-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not implement op_construct.
+        https://bugs.webkit.org/show_bug.cgi?id=64066
+
+        Reviewed by Gavin Barraclough.
+        
+        This is a fixed implementation of op_construct.  Constructor calls are implemented
+        by reusing almost all of the code for Call, with care taken to make sure that
+        where the are differences (like selecting different code blocks), those differences
+        are respected.  The two fixes over the last patch are: (1) make sure the
+        CodeBlock::unlinkCalls respects differences between Call and Construct, and (2)
+        make sure that virtualFor() in DFGOperations respects the CodeSpecializationKind
+        (either CodeForCall or CodeForConstruct) when invoking the compiler.
+
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::recordConstruct):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkFor):
+        * dfg/DFGRepatch.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkCalls):
+
+2011-07-12  Oliver Hunt  <oliver@apple.com>
+
+        Overzealous type validation in method_check
+        https://bugs.webkit.org/show_bug.cgi?id=64415
+
+        Reviewed by Gavin Barraclough.
+
+        method_check is essentially just a value look up
+        optimisation, but it internally stores the value
+        as a JSFunction, even though it never relies on
+        this fact.  Under GC validation however we end up
+        trying to enforce that assumption.  The fix is
+        simply to store the value as a correct supertype.
+
+        * bytecode/CodeBlock.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchGetMethodFast):
+        (JSC::DFG::tryCacheGetMethod):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2011-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        COLLECT_ON_EVERY_ALLOCATION no longer works.
+        https://bugs.webkit.org/show_bug.cgi?id=64388
+
+        Reviewed by Oliver Hunt.
+        
+        Added a flag to Heap that determines if it's safe to collect (which for now means that
+        JSGlobalObject has actually been initialized, but it should work for other things, too).
+        This allows JSGlobalObject to allocate even if the allocator wants to GC; instead of
+        GCing it just grows the heap, if necessary.
+        
+        Then changed Heap::allocate() to not recurse ad infinitum when
+        COLLECT_ON_EVERY_ALLOCATION is set.  This also makes the allocator generally more
+        resilient against bugs; this change allowed me to put in handy assertions, such as that
+        an allocation must succeed after either a collection or after a new block was added.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::tryAllocate):
+        (JSC::Heap::allocate):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (JSC::Heap::notifyIsSafeToCollect):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2011-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT put_by_id transition caching does not inform the GC about the structure and
+        prototype chain that it is referencing.
+        https://bugs.webkit.org/show_bug.cgi?id=64387
+
+        Reviewed by Gavin Barraclough.
+        
+        Fixed the relevant code in DFGRepatch to call StructureStubInfo::initPutByIdTransition().
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCachePutByID):
+
+2011-07-12  Adam Roben  <aroben@apple.com>
+
+        Ensure no intermediate WTF::Strings are created when concatenating with string literals
+
+        Fixes <http://webkit.org/b/63330> Concatenating string literals and WTF::Strings using
+        operator+ is suboptimal
+
+        Reviewed by Darin Adler.
+
+        * wtf/text/StringConcatenate.h:
+        (WTF::StringTypeAdapter<String>::writeTo): Added a macro that can be used for testing how
+        many WTF::Strings get copied while evaluating an operator+ expression.
+
+        * wtf/text/StringOperators.h:
+        (WTF::operator+): Changed the overload that takes a StringAppend to take it on the left-hand
+        side, since operator+ is left-associative. Having the StringAppend on the right-hand side
+        was causing us to make intermediate WTF::Strings when evaluating expressions that contained
+        multiple calls to operator+. Added some more overloads for that take a left-hand side of
+        const char* to resolve overload ambiguity for certain expressions. Added overloads that take
+        a left-hand side of const UChar* (matching the const char* overloads) so that wide string
+        literals don't first have to be converted to a WTF::String in operator+ expressions.
+
+2011-07-12  Adam Roben  <aroben@apple.com>
+
+        Unreviewed, rolling out r90811.
+        http://trac.webkit.org/changeset/90811
+        https://bugs.webkit.org/show_bug.cgi?id=61025
+
+        Several svg tests failing assertions beneath
+        SVGSMILElement::findInstanceTime
+
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+
+2011-07-12  Oliver Varga  <Varga.Oliver@stud.u-szeged.hu>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Speed up SVGSMILElement::findInstanceTime.
+        https://bugs.webkit.org/show_bug.cgi?id=61025
+
+        Add a new parameter to StdlibExtras.h::binarySerarch function
+        to also handle cases when the array does not contain the key value.
+        This is needed for an svg function.
+
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+
+2011-07-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT does not guard itself against floating point speculation
+        failures on non-floating-point constants.
+        https://bugs.webkit.org/show_bug.cgi?id=64330
+
+        Reviewed by Gavin Barraclough.
+        
+        Made fillSpeculateDouble immediate invoke terminateSpeculativeExecution() as
+        soon as it notices that it's speculating on something that is a non-numeric
+        JSConstant.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2011-07-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Speculative JIT does not always insert speculation checks when speculating
+        arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=64254
+
+        Reviewed by Gavin Barraclough.
+        
+        Changed the SetLocal instruction to always validate that the value being stored
+        into the local variable is an array, if that variable was marked PredictArray.
+        This is necessary since uses of arrays assume that if a PredictArray value is
+        in a local variable then the speculation check validating that the value is an
+        array was already performed.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-11  Gabor Loki  <loki@webkit.org>
+
+        Fix the condition of the optimized code in doubleTransfer
+        https://bugs.webkit.org/show_bug.cgi?id=64261
+
+        Reviewed by Zoltan Herczeg.
+
+        The condition of the optimized code in doubleTransfer is wrong. The
+        data transfer should be executed with four bytes aligned address.
+        VFP cannot perform unaligned memory access.
+
+        Reported by Jacob Bramley.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::doubleTransfer):
+
+2011-07-11  Gabor Loki  <loki@webkit.org>
+
+        Signed arithmetic bug in dataTransfer32.
+        https://bugs.webkit.org/show_bug.cgi?id=64257
+
+        Reviewed by Zoltan Herczeg.
+
+        An arithmetic bug is fixed. If the offset of dataTransfer is half of the
+        addressable memory space on a 32-bit machine (-2147483648 = 0x80000000)
+        a load instruction is emitted with a wrong zero offset.
+
+        Inspired by Jacob Bramley's patch from JaegerMonkey.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+
+2011-07-09  Thouraya Andolsi  <thouraya.andolsi@st.com>
+
+        Fix unaligned userspace access for SH4 platforms. 
+        https://bugs.webkit.org/show_bug.cgi?id=62993
+
+        * wtf/Platform.h:
+
+2011-07-09  Chao-ying Fu  <fu@mips.com>
+
+        Fix MIPS build due to readInt32 and readPointer
+        https://bugs.webkit.org/show_bug.cgi?id=63962
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::readInt32):
+        (JSC::MIPSAssembler::readPointer):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::rshift32):
+
+2011-07-08  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=64181
+        REGRESSION (r90602): Gmail doesn't load
+
+        Rolling out r90601, r90602.
+
+        * dfg/DFGAliasTracker.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addVarArgChild):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::dfgLinkCall):
+        * dfg/DFGRepatch.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+
+2011-07-08  Kalev Lember  <kalev@smartlink.ee>
+
+        Reviewed by Adam Roben.
+
+        Add missing _WIN32_WINNT and WINVER definitions
+        https://bugs.webkit.org/show_bug.cgi?id=59702
+
+        Moved _WIN32_WINNT and WINVER definitions to config.h so that they are
+        available for all source files.
+
+        In particular, wtf/FastMalloc.cpp uses CreateTimerQueueTimer and
+        DeleteTimerQueueTimer which are both guarded by
+        #if (_WIN32_WINNT >= 0x0500)
+        in MinGW headers.
+
+        * config.h:
+        * wtf/Assertions.cpp:
+
+2011-07-08  Chang Shu  <cshu@webkit.org>
+
+        Rename "makeSecure" to "fill" and remove the support for displaying last character
+        to avoid layering violatation.
+        https://bugs.webkit.org/show_bug.cgi?id=59114
+
+        Reviewed by Alexey Proskuryakov.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::fill):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+        (WTF::String::fill):
+
+2011-07-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        [WK2] Do not forward touch events to the web process when it does not need them
+        https://bugs.webkit.org/show_bug.cgi?id=64164
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add a convenience function to obtain a reference to the last element of a Deque.
+
+        * wtf/Deque.h:
+        (WTF::Deque::last):
+
+2011-07-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not implement op_construct.
+        https://bugs.webkit.org/show_bug.cgi?id=64066
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::recordConstruct):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkFor):
+        * dfg/DFGRepatch.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not implement get_by_id prototype caching.
+        https://bugs.webkit.org/show_bug.cgi?id=64077
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitRestoreScratch):
+        (JSC::DFG::linkRestoreScratch):
+        (JSC::DFG::tryCacheGetByID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::addressOfPropertyAtOffset):
+
+2011-07-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT method_check implementation does not link to optimized get_by_id
+        slow path.
+        https://bugs.webkit.org/show_bug.cgi?id=64073
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchGetMethodFast):
+
+2011-07-07  Oliver Hunt  <oliver@apple.com>
+
+        Encode jump and link sizes into the appropriate enums
+        https://bugs.webkit.org/show_bug.cgi?id=64123
+
+        Reviewed by Sam Weinig.
+
+        Finally kill off the out of line jump and link size arrays, 
+        so we can avoid icky loads and constant fold the linking arithmetic.
+
+        * assembler/ARMv7Assembler.cpp:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::jumpSizeDelta):
+        (JSC::ARMv7Assembler::computeJumpType):
+
+2011-07-06  Juan C. Montemayor  <jmont@apple.com>
+
+        ASSERT_NOT_REACHED running test 262
+        https://bugs.webkit.org/show_bug.cgi?id=63951
+        
+        Added a case to the switch statement where the code was failing. Fixed
+        some logic as well that gave faulty error messages.
+
+        Reviewed by Gavin Barraclough.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::getTokenName):
+        (JSC::JSParser::updateErrorMessageSpecialCase):
+        (JSC::JSParser::updateErrorMessage):
+
+2011-07-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT implementation of op_call results in regressions on sunspider
+        controlflow-recursive.
+        https://bugs.webkit.org/show_bug.cgi?id=64039
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::isSmallInt32Constant):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isInteger):
+
+2011-07-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not support method_check
+        https://bugs.webkit.org/show_bug.cgi?id=63972
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/CodeLocation.h:
+        (JSC::CodeLocationPossiblyNearCall::CodeLocationPossiblyNearCall):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::MethodCallLinkInfo::MethodCallLinkInfo):
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::recordGetMethod):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedGetMethod):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addMethodGet):
+        (JSC::DFG::JITCompiler::MethodGetRecord::MethodGetRecord):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchGetMethodFast):
+        (JSC::DFG::tryCacheGetMethod):
+        (JSC::DFG::dfgRepatchGetMethod):
+        * dfg/DFGRepatch.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrier::set):
+
+2011-07-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT op_call implementation will flush registers even when those registers are dead
+        https://bugs.webkit.org/show_bug.cgi?id=64023
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::integerResult):
+        (JSC::DFG::JITCodeGenerator::noResult):
+        (JSC::DFG::JITCodeGenerator::cellResult):
+        (JSC::DFG::JITCodeGenerator::jsValueResult):
+        (JSC::DFG::JITCodeGenerator::doubleResult):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculative JIT may crash when speculating int on a non-int JSConstant.
+        https://bugs.webkit.org/show_bug.cgi?id=64017
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-06  Dmitriy Vyukov  <dvyukov@google.com>
+
+        Reviewed by David Levin.
+
+        Allow substitution of dynamic annotations and prevent identical code folding by the linker.
+        https://bugs.webkit.org/show_bug.cgi?id=62443
+
+        * wtf/DynamicAnnotations.cpp:
+        (WTFAnnotateBenignRaceSized):
+        (WTFAnnotateHappensBefore):
+        (WTFAnnotateHappensAfter):
+
+2011-07-06  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Calls on 32 bit machines are failed after r90423
+        https://bugs.webkit.org/show_bug.cgi?id=63980
+
+        Reviewed by Gavin Barraclough.
+
+        Copy the necessary lines from JITCall.cpp.
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2011-07-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT virtual call implementation is inefficient.
+        https://bugs.webkit.org/show_bug.cgi?id=63974
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::generatedJITCodeForCallWithArityCheck):
+        (JSC::ExecutableBase::generatedJITCodeForConstructWithArityCheck):
+        (JSC::ExecutableBase::generatedJITCodeWithArityCheckFor):
+        (JSC::ExecutableBase::hasJITCodeForCall):
+        (JSC::ExecutableBase::hasJITCodeForConstruct):
+        (JSC::ExecutableBase::hasJITCodeFor):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::scopeUnchecked):
+
+2011-07-05  Oliver Hunt  <oliver@apple.com>
+
+        Force inlining of simple functions that show up as not being inlined
+        https://bugs.webkit.org/show_bug.cgi?id=63964
+
+        Reviewed by Gavin Barraclough.
+
+        Looking at profile data indicates the gcc is failing to inline a
+        number of trivial functions.  This patch hits the ones that show
+        up in profiles with the ALWAYS_INLINE hammer.
+
+        We also replace the memcpy() call in linking with a manual loop.
+        Apparently memcpy() is almost never faster than an inlined loop.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::add):
+        (JSC::ARMv7Assembler::add_S):
+        (JSC::ARMv7Assembler::ARM_and):
+        (JSC::ARMv7Assembler::asr):
+        (JSC::ARMv7Assembler::b):
+        (JSC::ARMv7Assembler::blx):
+        (JSC::ARMv7Assembler::bx):
+        (JSC::ARMv7Assembler::clz):
+        (JSC::ARMv7Assembler::cmn):
+        (JSC::ARMv7Assembler::cmp):
+        (JSC::ARMv7Assembler::eor):
+        (JSC::ARMv7Assembler::it):
+        (JSC::ARMv7Assembler::ldr):
+        (JSC::ARMv7Assembler::ldrCompact):
+        (JSC::ARMv7Assembler::ldrh):
+        (JSC::ARMv7Assembler::ldrb):
+        (JSC::ARMv7Assembler::lsl):
+        (JSC::ARMv7Assembler::lsr):
+        (JSC::ARMv7Assembler::movT3):
+        (JSC::ARMv7Assembler::mov):
+        (JSC::ARMv7Assembler::movt):
+        (JSC::ARMv7Assembler::mvn):
+        (JSC::ARMv7Assembler::neg):
+        (JSC::ARMv7Assembler::orr):
+        (JSC::ARMv7Assembler::orr_S):
+        (JSC::ARMv7Assembler::ror):
+        (JSC::ARMv7Assembler::smull):
+        (JSC::ARMv7Assembler::str):
+        (JSC::ARMv7Assembler::sub):
+        (JSC::ARMv7Assembler::sub_S):
+        (JSC::ARMv7Assembler::tst):
+        (JSC::ARMv7Assembler::linkRecordSourceComparator):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::oneWordOp5Reg3Imm8):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::oneWordOp5Imm5Reg3Reg3):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::oneWordOp7Reg3Reg3Reg3):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::oneWordOp8Imm8):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::oneWordOp8RegReg143):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::oneWordOp9Imm7):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::oneWordOp10Reg3Reg3):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp12Reg4FourFours):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp16FourFours):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp16Op16):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp5i6Imm4Reg4EncodedImm):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp12Reg4Reg4Imm12):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpOp):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpMemOp):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::ret):
+        (JSC::MacroAssemblerARMv7::moveWithPatch):
+        (JSC::MacroAssemblerARMv7::branchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::storePtrWithPatch):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::makeTailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+
+2011-07-05  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Make "Add optimised paths for a few maths functions" work on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=63893
+
+        Reviewed by Oliver Hunt.
+
+        Move the generated code to the .text section instead of .data section.
+        Fix alignment for the 32 bit thunk code.
+
+        * jit/ThunkGenerators.cpp:
+
+2011-07-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG JIT does not implement op_call.
+        https://bugs.webkit.org/show_bug.cgi?id=63858
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkCalls):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setNumberOfCallLinkInfos):
+        (JSC::CodeBlock::numberOfCallLinkInfos):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::lookupGetByVal):
+        (JSC::DFG::AliasTracker::recordCall):
+        (JSC::DFG::AliasTracker::equalIgnoringLaterNumericConversion):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::addVarArgChild):
+        (JSC::DFG::ByteCodeParser::predictInt32):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::allocateVirtualRegisters):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::opName):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::refChildren):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::useChildren):
+        (JSC::DFG::JITCodeGenerator::emitCall):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::addressOfCallData):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::CallRecord::CallRecord):
+        (JSC::DFG::JITCompiler::notifyCall):
+        (JSC::DFG::JITCompiler::appendCallWithFastExceptionCheck):
+        (JSC::DFG::JITCompiler::addJSCall):
+        (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
+        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::child1):
+        (JSC::DFG::Node::child2):
+        (JSC::DFG::Node::child3):
+        (JSC::DFG::Node::firstChild):
+        (JSC::DFG::Node::numChildren):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+        (JSC::DFG::NonSpeculativeJIT::compare):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkCall):
+        * dfg/DFGRepatch.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::calleeAsValue):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::jitType):
+        (JSC::JITCode::HostFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.h:
+
+2011-07-05  Oliver Hunt  <oliver@apple.com>
+
+        Initialize new MarkStack member
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+
+2011-07-05  Oliver Hunt  <oliver@apple.com>
+
+        Don't throw out compiled code repeatedly
+        https://bugs.webkit.org/show_bug.cgi?id=63960
+
+        Reviewed by Gavin Barraclough.
+
+        Stop throwing away all compiled code every time
+        we're told to do a full GC.  Instead unlink all
+        callsites during such GC passes to maximise the
+        number of collectable functions, but otherwise
+        leave compiled functions alone.
+
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::shouldUnlinkCalls):
+        (JSC::MarkStack::setShouldUnlinkCalls):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::recompileAllJSFunctions):
+        (JSC::JSGlobalData::releaseExecutableMemory):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::invalidateCode):
+        * runtime/RegExp.h:
+
+2011-07-05  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC JIT has code duplication for the handling of call and construct
+        https://bugs.webkit.org/show_bug.cgi?id=63957
+
+        Reviewed by Gavin Barraclough.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::linkFor):
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::jitCompileFor):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::arityCheckFor):
+        (JSC::lazyLinkFor):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::generatedJITCodeFor):
+        (JSC::FunctionExecutable::compileFor):
+        (JSC::FunctionExecutable::isGeneratedFor):
+        (JSC::FunctionExecutable::generatedBytecodeFor):
+        (JSC::FunctionExecutable::generatedJITCodeWithArityCheckFor):
+
+2011-07-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix following last patch.
+
+        * runtime/JSFunction.cpp:
+        (JSC::createPrototypeProperty):
+
+2011-07-05  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=63947
+        ASSERT running Object.preventExtensions(Math.sin)
+
+        Reviewed by Oliver Hunt.
+
+        This is due to calling scope() on a hostFunction as a part of
+        calling createPrototypeProperty to reify the prototype property.
+        But host functions don't have a prototype property anyway!
+
+        Prevent callling createPrototypeProperty on a host function.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::createPrototypeProperty):
+        (JSC::JSFunction::preventExtensions):
+
+2011-07-04  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=63880
+        Evaluation order of conversions of operands to >, >= incorrect.
+
+        Reviewed by Sam Weinig.
+
+        Add 'leftFirst' parameter to jsLess, jsLessEq matching that described in the ES5
+        spec. This allows these methods to be reused to perform >, >= relational compares
+        with correct ordering of type conversions.
+
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Operations.h:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+
+2011-07-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16652
+        Firefox and JavaScriptCore differ in Number.toString(integer)
+
+        Our arbitrary radix (2..36) toString conversion is inaccurate.
+        This is partly because it uses doubles to perform math that requires
+        higher accuracy, and partly becasue it does not attempt to correctly
+        detect where to terminate, instead relying on a simple 'epsilon'.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::decomposeDouble):
+            - helper function to extract sign, exponent, mantissa from IEEE doubles.
+        (JSC::Uint16WithFraction::Uint16WithFraction):
+            - helper class, u16int with infinite precision fraction, used to convert
+              the fractional part of the number to a string.
+        (JSC::Uint16WithFraction::operator*=):
+            - Multiply by a uint16.
+        (JSC::Uint16WithFraction::operator<):
+            - Compare two Uint16WithFractions.
+        (JSC::Uint16WithFraction::floorAndSubtract):
+            - Extract the integer portion of the number, and subtract it (clears the integer portion).
+        (JSC::Uint16WithFraction::comparePoint5):
+            - Compare to 0.5.
+        (JSC::Uint16WithFraction::sumGreaterThanOne):
+            - Passed a second Uint16WithFraction, returns true if the result of adding
+              the two values would be greater than one.
+        (JSC::Uint16WithFraction::isNormalized):
+            - Used by ASSERTs to consistency check internal representation.
+        (JSC::BigInteger::BigInteger):
+            - helper class, unbounded integer value, used to convert the integer part
+              of the number to a string.
+        (JSC::BigInteger::divide):
+            - Divide this value through by a uint32.
+        (JSC::BigInteger::operator!):
+            - test for zero.
+        (JSC::toStringWithRadix):
+            - Performs number to string conversion, with the given radix (2..36).
+        (JSC::numberProtoFuncToString):
+            - Changed to use toStringWithRadix.
+
+2011-07-04  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=63881
+        Need separate bytecodes for handling >, >= comparisons.
+
+        Reviewed by Oliver Hunt.
+
+        This clears the way to fix Bug#63880. We currently handle greater-than comparisons
+        as being using the corresponding op_less, etc opcodes.  This is incorrect with
+        respect to evaluation ordering of the implicit conversions performed on operands -
+        we should be calling ToPrimitive on the LHS and RHS operands to the greater than,
+        but instead convert RHS then LHS.
+
+        This patch adds opcodes for greater-than comparisons mirroring existing ones used
+        for less-than.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        * bytecompiler/NodesCodegen.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compare):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop_if_greater):
+        (JSC::JIT::emitSlow_op_loop_if_greater):
+        (JSC::JIT::emit_op_loop_if_greatereq):
+        (JSC::JIT::emitSlow_op_loop_if_greatereq):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jgreater):
+        (JSC::JIT::emit_op_jgreatereq):
+        (JSC::JIT::emit_op_jngreater):
+        (JSC::JIT::emit_op_jngreatereq):
+        (JSC::JIT::emitSlow_op_jgreater):
+        (JSC::JIT::emitSlow_op_jgreatereq):
+        (JSC::JIT::emitSlow_op_jngreater):
+        (JSC::JIT::emitSlow_op_jngreatereq):
+        (JSC::JIT::emit_compareAndJumpSlow):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/NodeConstructors.h:
+        (JSC::GreaterNode::GreaterNode):
+        (JSC::GreaterEqNode::GreaterEqNode):
+        * parser/Nodes.h:
+
+2011-07-03  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=63879
+        Reduce code duplication for op_jless, op_jlesseq, op_jnless, op_jnlesseq.
+
+        Reviewed by Sam Weinig.
+        
+        There is a lot of copy & paste code here; we can reduce duplication by making
+        a shared implementation.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::commute):
+            - Make these function platform agnostic.
+        * assembler/MacroAssemblerX86Common.h:
+            - Moved branch32/commute up to MacroAssembler.
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+            - Add an implementation matching that for op_loop_if_less, which just calls op_jless.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emitSlow_op_jlesseq):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+            - Common implmentations of these methods for JSVALUE64 & JSVALUE32_64.
+        (JSC::JIT::emit_compareAndJump):
+        (JSC::JIT::emit_compareAndJumpSlow):
+            - Internal implmementation of jless etc for JSVALUE64.
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_compareAndJump):
+        (JSC::JIT::emit_compareAndJumpSlow):
+            - Internal implmementation of jless etc for JSVALUE32_64.
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+            - Remove old implementation of emit_op_loop_if_lesseq.
+
+2011-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r90347.
+        http://trac.webkit.org/changeset/90347
+        https://bugs.webkit.org/show_bug.cgi?id=63886
+
+        Build breaks on Leopard, Chromium-win, WinCairo, and WinCE.
+        (Requested by tkent on #webkit).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/BigInteger.h: Removed.
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        * runtime/Uint16WithFraction.h: Removed.
+        * wtf/MathExtras.h:
+
+2011-06-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16652
+        Firefox and JavaScriptCore differ in Number.toString(integer)
+
+        Our arbitrary radix (2..36) toString conversion is inaccurate.
+        This is partly because it uses doubles to perform math that requires
+        higher accuracy, and partly becasue it does not attempt to correctly
+        detect where to terminate, instead relying on a simple 'epsilon'.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::decomposeDouble):
+            - helper function to extract sign, exponent, mantissa from IEEE doubles.
+        (JSC::Uint16WithFraction::Uint16WithFraction):
+            - helper class, u16int with infinite precision fraction, used to convert
+              the fractional part of the number to a string.
+        (JSC::Uint16WithFraction::operator*=):
+            - Multiply by a uint16.
+        (JSC::Uint16WithFraction::operator<):
+            - Compare two Uint16WithFractions.
+        (JSC::Uint16WithFraction::floorAndSubtract):
+            - Extract the integer portion of the number, and subtract it (clears the integer portion).
+        (JSC::Uint16WithFraction::comparePoint5):
+            - Compare to 0.5.
+        (JSC::Uint16WithFraction::sumGreaterThanOne):
+            - Passed a second Uint16WithFraction, returns true if the result of adding
+              the two values would be greater than one.
+        (JSC::Uint16WithFraction::isNormalized):
+            - Used by ASSERTs to consistency check internal representation.
+        (JSC::BigInteger::BigInteger):
+            - helper class, unbounded integer value, used to convert the integer part
+              of the number to a string.
+        (JSC::BigInteger::divide):
+            - Divide this value through by a uint32.
+        (JSC::BigInteger::operator!):
+            - test for zero.
+        (JSC::toStringWithRadix):
+            - Performs number to string conversion, with the given radix (2..36).
+        (JSC::numberProtoFuncToString):
+            - Changed to use toStringWithRadix.
+
+2011-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=63866
+        DFG JIT - implement instanceof
+
+        Reviewed by Sam Weinig.
+
+        Add ops CheckHasInstance & InstanceOf to implement bytecodes
+        op_check_has_instance & op_instanceof. This is an initial
+        functional implementation, performance is a wash. We can
+        follow up with changes to fuse the InstanceOf node with
+        a subsequant branch, as we do with other comparisons.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jitAssertIsCell):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::jitAssertIsCell):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-07-01  Oliver Hunt  <oliver@apple.com>
+
+        IE Web Workers demo crashes in JSC::SlotVisitor::visitChildren()
+        https://bugs.webkit.org/show_bug.cgi?id=63732
+
+        Reviewed by Gavin Barraclough.
+
+        Initialise the memory at the head of the new storage so that
+        GC is safe if triggered by reportExtraMemoryCost.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::increaseVectorPrefixLength):
+
+2011-07-01  Oliver Hunt  <oliver@apple.com>
+
+        GC sweep can occur before an object is completely initialised
+        https://bugs.webkit.org/show_bug.cgi?id=63836
+
+        Reviewed by Gavin Barraclough.
+
+        In rare cases it's possible for a GC sweep to occur while a
+        live, but not completely initialised object is on the stack.
+        In such a case we may incorrectly choose to mark it, even
+        though it has no children that need marking.
+
+        We resolve this by always zeroing out the structure of any
+        value returned from JSCell::operator new(), and making the
+        markstack tolerant of a null structure. 
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::~JSCell):
+        (JSC::JSCell::JSCell::operator new):
+        * runtime/Structure.h:
+        (JSC::MarkStack::internalAppend):
+
+2011-07-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DFG non-speculative JIT always performs slow C calls for div and mod.
+        https://bugs.webkit.org/show_bug.cgi?id=63684
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+
+2011-07-01  Juan C. Montemayor  <jmont@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Lexer error messages are currently appalling
+        https://bugs.webkit.org/show_bug.cgi?id=63340
+
+        Added error messages for the Lexer. These messages will be displayed
+        instead of the lexer error messages from the parser that are currently
+        shown.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::getInvalidCharMessage):
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        (JSC::Lexer::clear):
+        * parser/Lexer.h:
+        (JSC::Lexer::getErrorMessage):
+        (JSC::Lexer::setOffset):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+
+2011-07-01  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ScriptCodesFromICU.h to wtf/unicode and make necessary changes in
+        build files for ports not using ICU.
+        Add icu/unicode/uscript.h for ports using ICU. It's taken from 
+        ICU 3.6 (the version used on Mac OS 10.5)
+
+        http://bugs.webkit.org/show_bug.cgi?id=20797
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * icu/unicode/uscript.h: Added for UScriptCode enum.
+        * wtf/unicode/ScriptCodesFromICU.h: UScriptCode enum added.
+        * wtf/unicode/icu/UnicodeIcu.h:
+        * wtf/unicode/brew/UnicodeBrew.h:
+        * wtf/unicode/glib/UnicodeGLib.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWinCE.h:
+
+2011-07-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63819
+        Escaping of forwardslashes in strings incorrect if multiple exist.
+
+        The bug is in the parameters passed to a substring - should be
+        start & length, but we're passing start & end indices!
+
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectSource):
+
+2011-07-01  Adam Roben  <aroben@apple.com>
+
+        Roll out r90194
+        http://trac.webkit.org/changeset/90194
+        https://bugs.webkit.org/show_bug.cgi?id=63778
+
+        Fixes <http://webkit.org/b/63812> REGRESSION (r90194): Multiple tests intermittently failing
+        assertions in WriteBarrierBase<JSC::Structure>::get
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::~JSCell):
+
+2011-06-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add optimised paths for a few maths functions
+        https://bugs.webkit.org/show_bug.cgi?id=63757
+
+        Relanding as a Mac only patch.
+
+        This adds specialised thunks for Math.abs, Math.round, Math.ceil,
+        Math.floor, Math.log, and Math.exp as they are apparently more
+        important in real web content than we thought, which is somewhat
+        mind-boggling.  On average doubles the performance of the common
+        cases (eg. actually passing numbers in).  They're not as efficient
+        as they could be, but this way gives them the most portability.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsDoubleBitops):
+        (JSC::MacroAssemblerARM::andnotDouble):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsDoubleBitops):
+        (JSC::MacroAssemblerARMv7::andnotDouble):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::andnotDouble):
+        (JSC::MacroAssemblerMIPS::supportsDoubleBitops):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::supportsDoubleBitops):
+        (JSC::MacroAssemblerSH4::andnotDouble):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::supportsDoubleBitops):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::andnotDouble):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::supportsDoubleBitops):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::andnpd_rr):
+        * create_hash_table:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        (JSC::SpecializedThunkJIT::callDoubleToDouble):
+        * jit/ThunkGenerators.cpp:
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        * jit/ThunkGenerators.h:
+
+2011-07-01  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/63814> Fix clang build error in JITOpcodes32_64.cpp
+
+        Fixes the following build error in clang:
+
+            JavaScriptCore/jit/JITOpcodes32_64.cpp:741:36:{741:9-741:35}: error: operator '?:' has lower precedence than '+'; '+' will be evaluated first [-Werror,-Wparentheses,3]
+                 map(m_bytecodeOffset + dynamic ? OPCODE_LENGTH(op_resolve_global_dynamic) : OPCODE_LENGTH(op_resolve_global), dst, regT1, regT0);
+                     ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
+            JavaScriptCore/jit/JITOpcodes32_64.cpp:741:36: note: place parentheses around the '+' expression to silence this warning [3]
+                 map(m_bytecodeOffset + dynamic ? OPCODE_LENGTH(op_resolve_global_dynamic) : OPCODE_LENGTH(op_resolve_global), dst, regT1, regT0);
+                                                ^
+                     (                         )
+            fix-it:"JavaScriptCore/jit/JITOpcodes32_64.cpp":{741:9-741:9}:"("
+            fix-it:"JavaScriptCore/jit/JITOpcodes32_64.cpp":{741:35-741:35}:")"
+            JavaScriptCore/jit/JITOpcodes32_64.cpp:741:36:{741:28-741:94}: note: place parentheses around the '?:' expression to evaluate it first [3]
+                 map(m_bytecodeOffset + dynamic ? OPCODE_LENGTH(op_resolve_global_dynamic) : OPCODE_LENGTH(op_resolve_global), dst, regT1, regT0);
+                                        ~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+            1 error generated.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_global): Add parenthesis to make the
+        tertiary expression evaluate first.
+
+2011-07-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r90177 and r90179.
+        http://trac.webkit.org/changeset/90177
+        http://trac.webkit.org/changeset/90179
+        https://bugs.webkit.org/show_bug.cgi?id=63790
+
+        It caused crashes on Qt in debug mode (Requested by Ossy on
+        #webkit).
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARM::sqrtDouble):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointSqrt):
+        (JSC::MacroAssemblerARMv7::sqrtDouble):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::sqrtDouble):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointSqrt):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::sqrtDouble):
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        * create_hash_table:
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitLoadDouble):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        * jit/ThunkGenerators.h:
+
+2011-06-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Make GC validation clear cell structure on destruction
+        https://bugs.webkit.org/show_bug.cgi?id=63778
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::~JSCell):
+
+2011-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Added write barrier that was missing from put_by_id_transition
+        https://bugs.webkit.org/show_bug.cgi?id=63775
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::writeBarrier): Made this static with a
+        MacroAssembler& argument so our patching functions could use it.
+
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile): Updated for signature change.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCachePutByID): Missing barrier!
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Updated for signature change.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JSInterfaceJIT.h: Same game here. Removed storePtrWithWriteBarrier
+        because its meaning isn't clear -- maybe in the future we'll have a
+        clear way to pass all stores through a common function that guarantees
+        a write barrier, but that's not the case right now.
+
+2011-06-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DFG non-speculative JIT does not reuse registers when compiling comparisons.
+        https://bugs.webkit.org/show_bug.cgi?id=63565
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+        (JSC::DFG::NonSpeculativeJIT::compare):
+
+2011-06-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Added empty write barrier stubs in all the right places in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=63764
+        
+        SunSpider thinks this might be a 0.5% speedup. Meh.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::writeBarrier): Le stub.
+
+        (JSC::DFG::JITCodeGenerator::cachedPutById): Don't do anything special
+        for the case where base == scratch, since we now require base and scratch
+        to be not equal, for the sake of the write barrier.
+
+        * dfg/DFGJITCodeGenerator.h: Le stub.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile): Don't reuse the base register
+        as the scratch register, since that's incompatible with the write barrier,
+        which needs a distinct base and scratch.
+        
+        Do put the global object into a register before loading its var storage,
+        since it needs to be in a register for the write barrier to operate on it.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier): Second verse, same as the first.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_put_global_var): Deployed offsetOfRegisters() to more
+        places.
+
+        (JSC::JIT::emitWriteBarrier): Added a teeny tiny ASSERT so this function
+        is a little more than meaningless.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_put_global_var): Deployed offsetOfRegisters() to more
+        places.
+
+        (JSC::JIT::emitWriteBarrier): Added a teeny tiny ASSERT so this function
+        is a little more than meaningless.
+
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::offsetOfRegisters): Now used by the JIT, since
+        we put the global object in a register and only then load its var storage
+        by offset.
+
+        (JSC::JIT::emitWriteBarrier):
+
+2011-06-30  Oliver Hunt  <oliver@apple.com>
+
+        Fix ARMv6 build
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::rshift32):
+
+2011-06-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add optimised paths for a few maths functions
+        https://bugs.webkit.org/show_bug.cgi?id=63757
+
+        This adds specialised thunks for Math.abs, Math.round, Math.ceil,
+        Math.floor, Math.log, and Math.exp as they are apparently more
+        important in real web content than we thought, which is somewhat
+        mind-boggling.  On average doubles the performance of the common
+        cases (eg. actually passing numbers in).  They're not as efficient
+        as they could be, but this way gives them the most portability.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsDoubleBitops):
+        (JSC::MacroAssemblerARM::andnotDouble):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsDoubleBitops):
+        (JSC::MacroAssemblerARMv7::andnotDouble):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::andnotDouble):
+        (JSC::MacroAssemblerMIPS::supportsDoubleBitops):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::supportsDoubleBitops):
+        (JSC::MacroAssemblerSH4::andnotDouble):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::supportsDoubleBitops):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::andnotDouble):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::supportsDoubleBitops):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::andnpd_rr):
+        * create_hash_table:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        (JSC::SpecializedThunkJIT::callDoubleToDouble):
+        * jit/ThunkGenerators.cpp:
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        * jit/ThunkGenerators.h:
+
+2011-06-30  Cary Clark  <caryclark@google.com>
+
+        Reviewed by James Robinson.
+
+        Use Skia if Skia on Mac Chrome is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=62999
+
+        * wtf/Platform.h:
+        Add switch to use Skia if, externally,
+        Skia has been enabled by a gyp define.
+
+2011-06-30  Juan C. Montemayor  <jmont@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Web Inspector fails to display source for eval with syntax error
+        https://bugs.webkit.org/show_bug.cgi?id=63583
+
+        Web Inspector now displays a link to an eval statement that contains
+        a syntax error.
+
+        * parser/Parser.h:
+        (JSC::isEvalNode):
+        (JSC::EvalNode):
+        (JSC::Parser::parse):
+
+2011-06-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        X86Assembler does not encode byte registers in 64-bit mode correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=63665
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testb_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp8):
+
+2011-06-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r90102.
+        http://trac.webkit.org/changeset/90102
+        https://bugs.webkit.org/show_bug.cgi?id=63714
+
+        Lots of tests asserting beneath
+        SVGSMILElement::findInstanceTime (Requested by aroben on
+        #webkit).
+
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+
+2011-06-30  Oliver Varga  <Varga.Oliver@stud.u-szeged.hu>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Speed up SVGSMILElement::findInstanceTime.
+        https://bugs.webkit.org/show_bug.cgi?id=61025
+
+        Add a new parameter to StdlibExtras.h::binarySerarch function
+        to also handle cases when the array does not contain the key value.
+        This is needed for an svg function.
+
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+
+2011-06-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63669
+        DFG JIT - fix spectral-norm regression
+
+        The problem is a mis-speculation leading to us falling off the speculative path.
+        Make the speculation logic slightly smarter, don't predict int if one of the
+        operands is already loaded as a double (we use this logic already for compares).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::shouldSpeculateInteger):
+
+2011-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DFG JIT does not do put_by_id transition caching.
+        https://bugs.webkit.org/show_bug.cgi?id=63662
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addPropertyAccess):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::testPrototype):
+        (JSC::DFG::tryCachePutByID):
+
+2011-06-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a dummy write barrier emitting function in all the right places in the old JIT
+        https://bugs.webkit.org/show_bug.cgi?id=63667
+        
+        SunSpider reports no change.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_put_scoped_var): Do it.
+
+        (JSC::JIT::emit_op_put_global_var): Global object needs to be in a register
+        for the sake of the write barrier.
+
+        (JSC::JIT::emitWriteBarrier): Empty for now. Not for long!
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_put_scoped_var): Do it.
+
+        (JSC::JIT::emit_op_put_global_var): Global object needs to be in a register
+        for the sake of the write barrier.
+
+        (JSC::JIT::emitWriteBarrier): Empty for now. Not for long!
+
+2011-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DFG JIT does not perform get_by_id self list caching.
+        https://bugs.webkit.org/show_bug.cgi?id=63605
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::dfgBuildGetByIDList):
+        * dfg/DFGRepatch.h:
+
+2011-06-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DFG JIT lacks array.length caching.
+        https://bugs.webkit.org/show_bug.cgi?id=63505
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::tryAllocate):
+        (JSC::DFG::JITCodeGenerator::selectScratchGPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillAllRegisters):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addPropertyAccess):
+        (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::tryAllocate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+
+2011-06-28  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Warnings in JSC's JIT on 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=63259
+
+        Fairly straightforward, just use ASSERT_JIT_OFFSET_UNUSED when it applies.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+
+2011-06-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r89968.
+        http://trac.webkit.org/changeset/89968
+        https://bugs.webkit.org/show_bug.cgi?id=63581
+
+        Broke chromium windows compile (Requested by jamesr on
+        #webkit).
+
+        * wtf/Platform.h:
+
+2011-06-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix sampling build
+        https://bugs.webkit.org/show_bug.cgi?id=63579
+
+        Gets opcode sampling building again, doesn't seem to work alas
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::enableSampler):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+
+2011-06-28  Cary Clark  <caryclark@google.com>
+
+        Reviewed by James Robinson.
+
+        Use Skia if Skia on Mac Chrome is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=62999
+
+        * wtf/Platform.h:
+        Add switch to use Skia if, externally,
+        Skia has been enabled by a gyp define.
+
+2011-06-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        ASSERT when launching debug builds with interpreter and jit enabled
+        https://bugs.webkit.org/show_bug.cgi?id=63566
+
+        Add appropriate guards to the various Executable's memory reporting
+        logic.
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2011-06-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63563
+        DFG JIT - add support for double arith to speculative path
+
+        Add integer support for div & mod, add double support for div, mod,
+        add, sub & mul, dynamically selecting based on operand types.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::assembler):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateDoubleOperand::~SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateDoubleOperand::index):
+        (JSC::DFG::SpeculateDoubleOperand::fpr):
+
+2011-06-28  Oliver Hunt  <oliver@apple.com>
+
+        Fix interpreter build.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2011-06-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63561
+        DFG JIT - don't always assume integer in relational compare
+
+        If neither operand is known integer, or either is in double representation,
+        then at least use a function call (don't bail off the speculative path).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isDataFormatDouble):
+        (JSC::DFG::SpeculativeJIT::compareIsInteger):
+
+2011-06-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make constant array optimisation less strict about what constitutes a constant
+        https://bugs.webkit.org/show_bug.cgi?id=63554
+
+        Now allow string constants in array literals to actually be considered constant,
+        and so avoid codegen in array literals with strings in them.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addConstantBuffer):
+        (JSC::CodeBlock::constantBuffer):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstantBuffer):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitNewArray):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2011-06-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63560
+        DFG_JIT allow allocation of specific machine registers
+
+        This allow us to allocate the registers necessary to perform x86
+        idiv instructions for div/mod, and may be useful for shifts, too.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::allocate):
+        (JSC::DFG::GPRResult::GPRResult):
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::allocateSpecific):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isInteger):
+
+2011-06-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55040
+        RegExp constructor returns the argument regexp instead of a new object
+
+        Per 15.10.3.1, our current behaviour is correct if called as a function,
+        but incorrect when called as a constructor.
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        (JSC::constructWithRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+
+2011-06-28  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up integer clamping functions in MathExtras.h and support arbitrary numeric types and limits.
+        https://bugs.webkit.org/show_bug.cgi?id=63469
+
+        * wtf/MathExtras.h:
+        (defaultMinimumForClamp):
+        Version of std::numeric_limits::min() that returns the largest negative value for floating point types.
+        (defaultMaximumForClamp):
+        Symmetric alias for std::numeric_limits::max()
+        (clampTo):
+        New templated clamping function that supports arbitrary output types.
+        (clampToInteger):
+        Use new clampTo template.
+        (clampToFloat):
+        Use new clampTo template.
+        (clampToPositiveInteger):
+        Use new clampTo template.
+
+2011-06-28  Adam Roben  <aroben@apple.com>
+
+        Windows Debug build fix after r89885
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Exported
+        JSGlobalData::releaseExecutableMemory for jsc.exe's benefit.
+
+2011-06-28  Shinya Kawanaka  <shinyak@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Add const to show() method in WTFString and AtomicString.
+        https://bugs.webkit.org/show_bug.cgi?id=63515
+
+        The lack of const in show() method is painful when
+        doing something like printf-debug.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::show):
+        * wtf/text/AtomicString.h:
+        * wtf/text/WTFString.cpp:
+        (String::show):
+        * wtf/text/WTFString.h:
+
+2011-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix attempt after r89885.
+
+        * JavaScriptCore.exp:
+        * jsc.cpp:
+
+2011-06-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Support throwing away non-running code even while other code is running
+        https://bugs.webkit.org/show_bug.cgi?id=63485
+
+        Add a function to CodeBlock to support unlinking direct linked callsites,
+        and then with that in place add logic to discard code from any function
+        that is not currently on the stack.
+
+        The unlinking completely reverts any optimized call sites, such that they
+        may be relinked again in future.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::clearEvalCache):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::clear):
+        * heap/Heap.cpp:
+        (JSC::Heap::getConservativeRegisterRoots):
+        * heap/Heap.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrierBase::clear):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionReleaseExecutableMemory):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::unlinkCalls):
+        (JSC::ProgramExecutable::unlinkCalls):
+        (JSC::FunctionExecutable::discardCode):
+        (JSC::FunctionExecutable::unlinkCalls):
+        * runtime/Executable.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::SafeRecompiler::returnValue):
+        (JSC::SafeRecompiler::operator()):
+        (JSC::JSGlobalData::releaseExecutableMemory):
+
+2011-06-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler & Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=50554
+        RegExp.prototype.toString does not escape slashes
+
+        The problem here is that we don't escape forwards slashes when converting
+        a RegExp to a string. This means that RegExp("/").toString() is "///",
+        which is not a valid RegExp literal. Also, we return an invalid literal
+        for RegExp.prototype.toString() ("//", which is an empty single-line comment).
+
+        From ES5:
+        "NOTE: The returned String has the form of a RegularExpressionLiteral that
+        evaluates to another RegExp object with the same behaviour as this object."
+
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectSource):
+            - Escape forward slashes when getting the source of a RegExp.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+            - Remove unnecessary and erroneous hack to return "//" as the string
+            representation of RegExp.prototype. This is not a valid RegExp literal
+            (it is an empty single-line comment).
+
+2011-06-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63497
+        Add DEBUG_WITH_BREAKPOINT support to the DFG JIT.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-06-27  Juan C. Montemayor  <jmont@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Indirectly including TextPosition.h and XPathGrammar.h causes compile errors
+        https://bugs.webkit.org/show_bug.cgi?id=63392
+        
+        When both TextPosition.h and XPathGrammar.h are included a compile-error
+        is caused, since XPathGrammar.h defines a macro called NUMBER and 
+        TextPosition has a typedef named NUMBER.
+
+        * wtf/text/TextPosition.h:
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+
+2011-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DFG JIT does not perform put_by_id caching.
+        https://bugs.webkit.org/show_bug.cgi?id=63409
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedPutById):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addPropertyAccess):
+        (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchByIdSelfAccess):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::appropriatePutByIdFunction):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::dfgRepatchPutByID):
+        * dfg/DFGRepatch.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-06-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix. One more filed missing during distcheck, for
+        the MIPS build.
+
+        * GNUmakefile.list.am:
+
+2011-06-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DFG non-speculative JIT has potentially harmful speculations with respect to arithmetic operations.
+        https://bugs.webkit.org/show_bug.cgi?id=63347
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+            - Changed arithmetic operations to speculate in favor of integers.
+        (JSC::DFG::NonSpeculativeJIT::valueToNumber):
+        (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
+        (JSC::DFG::NonSpeculativeJIT::basicArithOp):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGOperations.cpp:
+            - Added slow-path routines for arithmetic that perform no speculation; the
+              non-speculative JIT will generate calls to these in cases where its
+              speculation fails.
+        * dfg/DFGOperations.h:
+
+2011-06-24  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Rob Buis.
+
+        Integrate SVG Fonts within GlyphPage concept, removing the special SVG code paths from Font, making it possible to reuse the simple text code path for SVG Fonts
+        https://bugs.webkit.org/show_bug.cgi?id=59085
+
+        * wtf/Platform.h: Force Qt-EWS into a full rebuild, otherwhise this patch breaks the EWS.
+
+2011-06-24  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Arm Assembler, Immediate stack offset values truncated to 8 bits for add & sub
+        https://bugs.webkit.org/show_bug.cgi?id=63345
+
+        The methods ARMThumbImmediate::getUInt9 and ARMThumbImmediate::getUInt10
+        return 9 and 10 bit quantities, therefore changed their return type from
+        uint8_t to uint16_t.  Also casted the places where they are used as they
+        are currently shifted and used as 7 or 8 bit values.
+
+        These methods are currently used for literals for stack offsets, 
+        including creating and destroying stack frames.  The prior truncation of
+        the upper bits caused stack frames to be too small, thus allowing a
+        JIT'ed function to access and overwrite stack space outside of the
+        incorrectly sized stack frame.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMThumbImmediate::getUInt9):
+        (JSC::ARMThumbImmediate::getUInt10):
+        (JSC::ARMv7Assembler::add):
+        (JSC::ARMv7Assembler::ldr):
+        (JSC::ARMv7Assembler::str):
+        (JSC::ARMv7Assembler::sub):
+        (JSC::ARMv7Assembler::sub_S):
+
+2011-06-24  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        releaseFastMallocFreeMemory doesn't adjust free counts for scavenger
+        https://bugs.webkit.org/show_bug.cgi?id=63015
+
+        Added code to adjust class TCMalloc_PageHeap variables free_committed_pages_ and
+        min_free_committed_pages_since_last_scavenge_ in ReleaseFreeList().  These 
+        adjustments are a bug.  These need to reflect the pages that are released
+        in ReleaseFreeLsit so that scavenge doesn't try to free that many pages as well.
+        Made ReleaseFreeList a member of TCMalloc_PageHeap in the process.  Updated
+        Check() and helper method CheckList() to check the number of actual free pages
+        with free_committed_pages_.
+
+        The symptom of the problem of the existing code is that the scavenger may
+        run unneccesarily without any real work to do, i.e. pages on the free lists.
+        The scanvenger would also end up freeing too many pages, that is going below 
+        the current 528 target free pages.
+
+        Note that the style of the changes was kept consistent with the
+        existing style.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::Check):
+        (WTF::TCMalloc_PageHeap::CheckList):
+        (WTF::TCMalloc_PageHeap::ReleaseFreeList):
+
+2011-06-24  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Match other clampTo* functions in style with clampToInteger(float)
+        function.
+        https://bugs.webkit.org/show_bug.cgi?id=53449
+
+        * wtf/MathExtras.h:
+        (clampToInteger):
+        (clampToFloat):
+        (clampToPositiveInteger):
+
+2011-06-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r89594.
+        http://trac.webkit.org/changeset/89594
+        https://bugs.webkit.org/show_bug.cgi?id=63316
+
+        It broke 5 tests on the Qt bot (Requested by Ossy_DC on
+        #webkit).
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * icu/unicode/uscript.h: Removed.
+        * wtf/unicode/ScriptCodesFromICU.h: Removed.
+        * wtf/unicode/brew/UnicodeBrew.h:
+        * wtf/unicode/glib/UnicodeGLib.h:
+        * wtf/unicode/icu/UnicodeIcu.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWinCE.h:
+
+2011-06-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        DFG non-speculative JIT should have obvious optimizations for GetById and GetByVal
+        https://bugs.webkit.org/show_bug.cgi?id=63173
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::cachedGetById):
+        * dfg/DFGJITCodeGenerator.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-06-23  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt again.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::readPointer):
+
+2011-06-23  Oliver Hunt  <oliver@apple.com>
+
+        Fix Qt Build
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::readPointer):
+
+2011-06-23  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63298
+        Replace Malloc with FastMalloc to match the rest of wtf.
+
+        * wtf/BlockStack.h:
+        (WTF::::~BlockStack):
+        (WTF::::grow):
+        (WTF::::shrink):
+
+2011-06-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add the ability to dynamically modify linked call sites
+        https://bugs.webkit.org/show_bug.cgi?id=63291
+
+        Add JITWriteBarrier as a writebarrier class that allows
+        reading and writing directly into the code stream.
+
+        This required adding logic to all the assemblers to allow
+        us to read values back out of the instruction stream.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::readPointer):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::readPointer):
+        (JSC::ARMv7Assembler::readInt32):
+        (JSC::ARMv7Assembler::decodeTwoWordOp5i6Imm4Reg4EncodedImmFirst):
+        (JSC::ARMv7Assembler::decodeTwoWordOp5i6Imm4Reg4EncodedImmSecond):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::readPointer):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::readInt32):
+        (JSC::MIPSAssembler::readPointer):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::operator!):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::readPCrelativeAddress):
+        (JSC::SH4Assembler::readPointer):
+        (JSC::SH4Assembler::readInt32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::readPointer):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::MethodCallLinkInfo::seenOnce):
+        (JSC::MethodCallLinkInfo::setSeen):
+        * heap/MarkStack.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchMethodCallProto):
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITWriteBarrier.h: Added.
+        (JSC::JITWriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::JITWriteBarrierBase::operator!):
+        (JSC::JITWriteBarrierBase::setFlagOnBarrier):
+        (JSC::JITWriteBarrierBase::isFlagged):
+        (JSC::JITWriteBarrierBase::setLocation):
+        (JSC::JITWriteBarrierBase::location):
+        (JSC::JITWriteBarrierBase::JITWriteBarrierBase):
+        (JSC::JITWriteBarrierBase::set):
+        (JSC::JITWriteBarrierBase::get):
+        (JSC::JITWriteBarrier::JITWriteBarrier):
+        (JSC::JITWriteBarrier::set):
+        (JSC::JITWriteBarrier::get):
+        (JSC::MarkStack::append):
+
+2011-06-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=61585
+        Crash running regexp /(?:(?=g))|(?:m).{2147483648,}/
+
+        This is due to use of int instead of unsigned, bad math around
+        the 2^31 boundary.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+            - Change some uses of int to unsigned, refactor compare logic to
+              restrict to the range 0..2^32-1 (rather than -2^32-1..2^32-1).
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generate):
+        (JSC::Yarr::YarrGenerator::backtrack):
+            - Ditto.
+
+2011-06-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=63218
+        DFG JIT - remove machine type guarantees from graph
+
+        The DFG JIT currently makes assumptions about the types of machine registers
+        that certain nodes will be loaded into. This will be broken as we generate
+        nodes to produce both integer and double code paths. Remove int<->double
+        conversions nodes. This design decision also gave rise to multiple types of
+        constant nodes, requiring separate handling for each type. Merge these back
+        into JSConstant.
+
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::equalIgnoringLaterNumericConversion):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getToInt32):
+        (JSC::DFG::ByteCodeParser::getToNumber):
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::toNumber):
+        (JSC::DFG::ByteCodeParser::isInt32Constant):
+        (JSC::DFG::ByteCodeParser::isDoubleConstant):
+        (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
+        (JSC::DFG::ByteCodeParser::valueOfDoubleConstant):
+        (JSC::DFG::ByteCodeParser::one):
+        (JSC::DFG::ByteCodeParser::predictInt32):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        (JSC::DFG::JITCodeGenerator::isJSConstant):
+        (JSC::DFG::JITCodeGenerator::isDoubleConstant):
+        (JSC::DFG::JITCodeGenerator::valueOfJSConstantAsImmPtr):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::isJSConstant):
+        (JSC::DFG::JITCompiler::isInt32Constant):
+        (JSC::DFG::JITCompiler::isDoubleConstant):
+        (JSC::DFG::JITCompiler::valueOfJSConstant):
+        (JSC::DFG::JITCompiler::valueOfInt32Constant):
+        (JSC::DFG::JITCompiler::valueOfDoubleConstant):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::isConstant):
+        (JSC::DFG::Node::notTakenBytecodeOffset):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::isKnownInteger):
+        (JSC::DFG::NonSpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-06-23  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add ScriptCodesFromICU.h to wtf/unicode and make necessary changes in
+        build files for ports not using ICU.
+        Add icu/unicode/uscript.h for ports using ICU. It's taken from 
+        ICU 3.6 (the version used on Mac OS 10.5)
+
+        http://bugs.webkit.org/show_bug.cgi?id=20797
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * icu/unicode/uscript.h: Added for UScriptCode enum.
+        * wtf/unicode/ScriptCodesFromICU.h: UScriptCode enum added.
+        * wtf/unicode/icu/UnicodeIcu.h:
+        * wtf/unicode/brew/UnicodeBrew.h:
+        * wtf/unicode/glib/UnicodeGLib.h:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        * wtf/unicode/wince/UnicodeWinCE.h:
+
+2011-06-23  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Andreas Kling.
+
+        [EFL][WK2] Add PLATFORM(EFL) to use UNIX_DOMAIN_SOCKETS.
+        https://bugs.webkit.org/show_bug.cgi?id=63228
+
+        * wtf/Platform.h: Add PLATFORM(EFL) guard.
+
+2011-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r89547.
+        http://trac.webkit.org/changeset/89547
+        https://bugs.webkit.org/show_bug.cgi?id=63252
+
+        "Chrmium crash on start" (Requested by yurys on #webkit).
+
+        * wtf/DynamicAnnotations.cpp:
+        (WTFAnnotateBenignRaceSized):
+        (WTFAnnotateHappensBefore):
+        (WTFAnnotateHappensAfter):
+        * wtf/DynamicAnnotations.h:
+
+2011-06-23  Timur Iskhodzhanov  <timurrrr@google.com>
+
+        Reviewed by David Levin.
+
+        Make dynamic annotations weak symbols and prevent identical code folding by the linker
+        https://bugs.webkit.org/show_bug.cgi?id=62443
+
+        * wtf/DynamicAnnotations.cpp:
+        (WTFAnnotateBenignRaceSized):
+        (WTFAnnotateHappensBefore):
+        (WTFAnnotateHappensAfter):
+        * wtf/DynamicAnnotations.h:
+
+2011-06-22  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Add a build flag for building with libxml2 and libxslt.
+        https://bugs.webkit.org/show_bug.cgi?id=63113
+
+        * wtf/Platform.h:
+
+2011-06-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r89489.
+        http://trac.webkit.org/changeset/89489
+        https://bugs.webkit.org/show_bug.cgi?id=63203
+
+        Broke chromium mac build on build.webkit.org (Requested by
+        abarth on #webkit).
+
+        * wtf/Platform.h:
+
+2011-06-22  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Use Skia if Skia on Mac Chrome is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=62999
+
+        * wtf/Platform.h:
+        Add switch to use Skia if, externally,
+        Skia has been enabled by a gyp define.
+
+2011-06-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/RegisterFile.h: Removed unnecessary #include <stdio.h>.
+
+2011-06-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed the conceit that global variables are local variables when running global code
+        https://bugs.webkit.org/show_bug.cgi?id=63106
+        
+        This is required for write barrier correctness.
+        
+        SunSpider reports about a 0.5% regression, mostly from bitops-bitwise-and.js.
+        I was able to reduce the regression with a tiny peephole optimization in
+        the bytecompiler, but not eliminate it. I'm committing this assuming
+        that turning on generational GC will win back at least 0.5%.
+
+        (FWIW, the DFG JIT can easily eliminate any regression by sharing loads of
+        the global object's var storage. I considered doing the same kind of
+        optimization in the existing JIT, but it seemed like moving in the wrong
+        direction.)
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator): Don't give global variables
+        negative indices, since they're no longer negatively offset from the
+        current stack frame.
+        
+        Do give global variables monotonically increasing positive indices, since
+        that's much easier to work with.
+        
+        Don't limit the number of optimizable global variables, since it's no
+        longer limited by the register file, since they're no longer stored in
+        the register file.
+
+        (JSC::BytecodeGenerator::registerFor): Global code never has any local
+        registers because a var in global code is actually a property of the
+        global object.
+
+        (JSC::BytecodeGenerator::constRegisterFor): Ditto.
+
+        (JSC::BytecodeGenerator::emitResolve): Did a tiny bit of constant
+        propagation and dead code elimination to speed up our compiles and
+        reduce WTFs / minute.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::registerFor): Removed special handling of globals.
+
+        (JSC::BytecodeGenerator::shouldOptimizeLocals): Don't optimize locals in
+        global code, since there are none.
+
+        (JSC::BytecodeGenerator::canOptimizeNonLocals): Do optimize non-locals
+        in global code (i.e., global vars), since there are some.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::execute):
+        * interpreter/Interpreter.h: Updated for deleted / renamed code.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots):
+        (JSC::RegisterFile::releaseExcessCapacity): Updated for deleted / renamed
+        data members.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::begin):
+        (JSC::RegisterFile::size):
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink): Removed all code and comments dealing with
+        global variables stored in the register file.
+
+        (JSC::RegisterFile::grow): Updated for same.
+        
+        Also, a slight correctness fix: Test the VM commit end, and not just the
+        in-use end, when checking for stack overflow. In theory, it's invalid to
+        commit past the end of your allocation, even if you never touch that
+        memory. This makes the usable size of the stack slightly smaller. No test
+        because we don't know of any case in practice where this crashes.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Updated for changes above.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resizeRegisters):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSGlobalObject.h: Simplified globals to have monotonically 
+        increasing indexes, always located in our external storage.
+
+2011-06-21  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed, rolling out r89401 and r89403.
+        http://trac.webkit.org/changeset/89401
+        http://trac.webkit.org/changeset/89403
+        https://bugs.webkit.org/show_bug.cgi?id=62970
+
+        Breaks mac build and mistakenly enables the spellcheck API
+
+        * Configurations/FeatureDefines.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-06-21  Kent Tamura  <tkent@chromium.org>
+
+        [Mac] Sort Xcode project files.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-06-20  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Spellcheck API should be build-able.
+        https://bugs.webkit.org/show_bug.cgi?id=62970
+
+        No new tests, changing only build related files
+        
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-06-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Moved 'const' off the global-variable-as-local-variable crack pipe
+        https://bugs.webkit.org/show_bug.cgi?id=63105
+        
+        This is necessary for moving the rest of the code off of same.
+        
+        Many problems remain in our handling of const. I have fixed none of them.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::scopeChain): New accessor, needed to enable
+        const to directly implement its unique scoping rules.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PrefixResolveNode::emitBytecode): Do specify that our resolve is
+        for writing, so we don't overwrite const variables.
+
+        (JSC::ConstDeclNode::emitCodeSingle): Don't assume that all declared const
+        variables are available as local variables, since this won't be the case
+        once global variables are not available as local variables. Instead, use
+        put_scoped_var in the case where there is no local variable. Like a local
+        variable, put_scoped_var succeeds even though const properties are
+        read-only, since put_scoped_var skips read-only checks. (Yay?)
+
+2011-06-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION(r89257): It broke 2 jscore tests (Requested by Ossy_away on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=63052
+
+        Release mode only failure, the stack overflow guards were getting there error
+        handling inlined, so that they were essentially causing their own demise.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::updateErrorMessage):
+        (JSC::JSParser::updateErrorWithNameAndMessage):
+
+2011-06-20  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed.
+
+        Rolled out r89233 and r89235 because of crashes in http/tests/misc/acid3.html on Snow Leopard and other platforms
+        https://bugs.webkit.org/show_bug.cgi?id=63022
+
+        * wtf/Platform.h:
+
+2011-06-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Disallow assigning into PassOwnArrayPtr, PassOwnPtr and PassRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=62940
+
+        Remove clear() and all assignment operators except one which now has a COMPILE_ASSERT.
+
+        * wtf/PassOwnArrayPtr.h:
+        (WTF::PassOwnArrayPtr::operator=):
+        * wtf/PassOwnPtr.h:
+        (WTF::PassOwnPtr::operator=):
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::operator=):
+        (WTF::NonNullPassRefPtr::operator=):
+
+2011-06-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r79060): Searching for a flight at united.com fails
+        https://bugs.webkit.org/show_bug.cgi?id=63003
+
+        This original change also broke Twitter, and we attempted to refine the fix to 
+        address that problem (http://trac.webkit.org/changeset/80542), but since it still breaks United,
+        we need to revert the change until we understand the problem better.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+
+2011-06-20  Juan C. Montemayor  <jmont@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        No context for javascript parse errors.
+        https://bugs.webkit.org/show_bug.cgi?id=62613
+        
+        Parse errors now show more details like:
+        "Unexpected token: ]"
+        or
+        "Expected token: while"
+        
+        For reserved names, numbers, indentifiers, strings, lexer errors, 
+        and EOFs, the following error messages are printed:
+        
+        "Use of reserved word: super"
+        "Unexpected number: 42"
+        "Unexpected identifier: "
+        "Unexpected string: "foobar""
+        "Invalid token character sequence: \u4023"
+        "Unexpected EOF"
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::consume):
+        (JSC::JSParser::getToken):
+        (JSC::JSParser::getTokenName):
+        (JSC::JSParser::updateErrorMessageSpecialCase):
+        (JSC::JSParser::updateErrorMessage):
+        (JSC::JSParser::updateErrorWithNameAndMessage):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseForStatement):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parsePrimaryExpression):
+        (JSC::JSParser::parseMemberExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+
+2011-06-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Rob Buis.
+
+        Integrate SVG Fonts within GlyphPage concept, removing the special SVG code paths from Font, making it possible to reuse the simple text code path for SVG Fonts
+        https://bugs.webkit.org/show_bug.cgi?id=59085
+
+        * wtf/Platform.h: Force Qt-EWS into a full rebuild, otherwhise this patch breaks the EWS.
+
+2011-06-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Correct logic for putting errors on the correct line when handling JSONP
+        https://bugs.webkit.org/show_bug.cgi?id=62962
+
+        Minor fix for the minor fix.  *sigh*
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2011-06-19  Oliver Hunt  <oliver@apple.com>
+
+        Minor fix to correct layout test results.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2011-06-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSONP is unnecessarily slow
+        https://bugs.webkit.org/show_bug.cgi?id=62920
+
+        JSONP has unfortunately become a fairly common idiom online, yet
+        it triggers very poor performance in JSC as we end up doing codegen
+        for a large number of property accesses that will
+           * only be run once, so the vast amount of logic we dump to handle
+             caching of accesses is unnecessary.
+           * We are doing codegen that is directly proportional to just
+             creating the object in the first place.
+
+        This patch extends the use of the literal parser to JSONP-like structures
+        in global code, handling a number of different forms I have seen online.
+        In an extreme case this improves performance of JSONP by more than 2x
+        due to removal of code generation and execution time, and a few optimisations
+        that I made to the parser itself.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::execute):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::isKeyword):
+        * parser/Lexer.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::tryJSONPParse):
+        (JSC::LiteralParser::makeIdentifier):
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::next):
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::tryLiteralParse):
+        (JSC::LiteralParser::Lexer::Lexer):
+
+2011-06-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r89184.
+        http://trac.webkit.org/changeset/89184
+        https://bugs.webkit.org/show_bug.cgi?id=62927
+
+        It broke 22 tests on all bot (Requested by Ossy_weekend on
+        #webkit).
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::execute):
+        * parser/Lexer.cpp:
+        * parser/Lexer.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::tryLiteralParse):
+        (JSC::LiteralParser::Lexer::Lexer):
+        (JSC::LiteralParser::Lexer::next):
+
+2011-06-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        JSONP is unnecessarily slow
+        https://bugs.webkit.org/show_bug.cgi?id=62920
+
+        JSONP has unfortunately become a fairly common idiom online, yet
+        it triggers very poor performance in JSC as we end up doing codegen
+        for a large number of property accesses that will
+           * only be run once, so the vast amount of logic we dump to handle
+             caching of accesses is unnecessary.
+           * We are doing codegen that is directly proportional to just
+             creating the object in the first place.
+
+        This patch extends the use of the literal parser to JSONP-like structures
+        in global code, handling a number of different forms I have seen online.
+        In an extreme case this improves performance of JSONP by more than 2x
+        due to removal of code generation and execution time, and a few optimisations
+        that I made to the parser itself.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::execute):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::isKeyword):
+        * parser/Lexer.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::tryJSONPParse):
+        (JSC::LiteralParser::makeIdentifier):
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::next):
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::tryLiteralParse):
+        (JSC::LiteralParser::Lexer::Lexer):
+
+2011-06-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Moved some property access JIT code into property access JIT files
+        https://bugs.webkit.org/show_bug.cgi?id=62906
+
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+
+2011-06-17  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-06-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Leopard build?
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-06-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added some write barrier action, compiled out by default
+        https://bugs.webkit.org/show_bug.cgi?id=62844
+
+        * JavaScriptCore.exp: Build!
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Fixed an incremental build
+        issue with Heap.cpp.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::writeBarrierSlowCase):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isAtomAligned):
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::atomNumber):
+        (JSC::MarkedBlock::ownerSetNumber):
+        (JSC::MarkedBlock::addOldSpaceOwner):
+        (JSC::MarkedBlock::OwnerSet::OwnerSet):
+        (JSC::MarkedBlock::OwnerSet::add):
+        (JSC::MarkedBlock::OwnerSet::clear):
+        (JSC::MarkedBlock::OwnerSet::size):
+        (JSC::MarkedBlock::OwnerSet::didOverflow):
+        (JSC::MarkedBlock::OwnerSet::owners): Added a basic write barrier that
+        tracks owners for regions within blocks. Currently unused.
+
+2011-06-17  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        Reviewed by Eric Seidel.
+
+        [EFL] Add some OwnPtr specializations for EFL types.
+        For now there are specializations for Ecore_Evas and Evas_Object.
+        https://bugs.webkit.org/show_bug.cgi?id=62877
+
+        * wtf/CMakeListsEfl.txt:
+        * wtf/OwnPtrCommon.h:
+        * wtf/efl/OwnPtrEfl.cpp: Added.
+        (WTF::deleteOwnedPtr):
+
+2011-06-17  Joone Hur  <joone.hur@collabora.co.uk>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Replace GdkRectangle by cairo_rectangle_int_t
+        https://bugs.webkit.org/show_bug.cgi?id=60687
+
+        Replace GdkRectangle by cairo_rectangle_int_t.
+
+        * wtf/gobject/GTypedefs.h: Replace GdkRectangle by cairo_rectangle_int_t.
+
+2011-06-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=53014
+        ES5 strict mode keyword restrictions aren't implemented
+
+        The following are future restricted words is strict mode code:
+            implements, interface, let, package, private, protected, public, static, yield
+
+        * parser/JSParser.h:
+            - Add RESERVED_IF_STRICT token.
+        * parser/Keywords.table:
+            - Add new future restricted words.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseIdentifier):
+            - Check for RESERVED_IF_STRICT; in nonstrict code this is converted to IDENT.
+        (JSC::Lexer::lex):
+            - Pass strictMode flag to parseIdentifier.
+        * parser/Lexer.h:
+            - parseIdentifier needs a strictMode flag.
+        * runtime/CommonIdentifiers.h:
+            - Add identifiers for new reserved words.
+
+2011-06-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23611
+        Multiline Javascript comments cause incorrect parsing of following script.
+
+        From the spec:
+        "A MultiLineComment [is] simply discarded if it contains no line terminator,
+        but if a MultiLineComment contains one or more line terminators, then it is
+        replaced with a single line terminator, which becomes part of the stream of
+        inputs for the syntactic grammar." 
+
+        This may result in behavioural changes, due to automatic semicolon insertion.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseMultilineComment):
+            - Set m_terminator is we see a line terminator in a multiline comment.
+
+2011-06-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=62824
+        DFG JIT - add support for branch-fusion of compareEq, JSValue comparisons in SpeculativeJIT
+
+        CompareEq of non-integer values is the most common cause of speculation failure.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+            - Support Equals.
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleEq):
+            - new! - peephole optimized Eq of JSValues.
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Add peephole optimization for CompareEq.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+            - Add support for dead nodes between compare & branch.
+        (JSC::DFG::SpeculativeJIT::isInteger):
+            - Added to determine which form of peephole to do in CompareEq.
+
+2011-06-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export another
+        symbol.
+
+        * bytecode/EvalCodeCache.h:
+        * heap/HandleHeap.h:
+        * heap/HeapRootVisitor.h:
+        * heap/NewSpace.h:
+        * runtime/ArgList.h:
+        * runtime/ScopeChain.h:
+        * runtime/SmallStrings.h:
+        * runtime/Structure.h: Stop forward-declaring things that don't really
+        exist anymore.
+
+2011-06-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Mac build: Removed and re-added SlotVisitor.h to the Xcode
+        project while crossing my fingers and facing west.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-06-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Removed an incorrect symbol on Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-06-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Removed an accidental commit from the future.
+
+        * CMakeLists.txt:
+
+2011-06-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Introduced SlotVisitor into the project
+        https://bugs.webkit.org/show_bug.cgi?id=62820
+        
+        This resolves a class vs typedef forward declaration issue, and gives all
+        exported symbols the correct names.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build!
+
+        * bytecode/EvalCodeCache.h:
+        * heap/HandleHeap.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        * heap/HeapRootVisitor.h: Replaced MarkStack with SlotVisitor. Now no
+        clients operate on a MarkStack.
+
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::visitChildren):
+        (JSC::SlotVisitor::drain):
+        * heap/SlotVisitor.h: Added.
+        (JSC::SlotVisitor::SlotVisitor): Used 'protected' and a little cheesy
+        inheritance to give SlotVisitor all the attributes of MarkStack without
+        making this change giant. Over time, we will move more behavior into
+        SlotVisitor and its subclasses.
+
+        * heap/MarkStack.h:
+        * heap/NewSpace.h: Replaced MarkStack with SlotVisitor. Now no
+        clients operate on a MarkStack.
+
+        * runtime/ArgList.h:
+        * runtime/JSCell.h:
+        * runtime/JSObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/SmallStrings.h:
+        * runtime/Structure.h: Replaced MarkStack with SlotVisitor. Now no
+        clients operate on a MarkStack.
+
+2011-06-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Reduce memory usage of resolve_global
+        https://bugs.webkit.org/show_bug.cgi?id=62765
+
+        If we have a large number of resolve_globals in a single
+        block start planting plain resolve instructions instead 
+        whenever we aren't in a loop.  This allows us to reduce
+        the code size for extremely large functions without
+        losing the performance benefits of op_resolve_global.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::globalResolveInfoCount):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        * bytecompiler/BytecodeGenerator.h:
+
+2011-06-16  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Fix building with CONFIG(use_system_icu)
+        https://bugs.webkit.org/show_bug.cgi?id=62744
+
+        Do not define WTF_USE_QT4_UNICODE if WTF_USE_ICU_UNICODE is set.
+
+        * wtf/Platform.h:
+
+2011-06-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Remove obsolete LOOSE_OWN_PTR code
+        https://bugs.webkit.org/show_bug.cgi?id=59909
+
+        The internal Apple dependency on this is gone now.
+
+        * wtf/OwnArrayPtr.h: Removed constructor that takes a raw pointer,
+        set function that takes a raw pointer.
+
+        * wtf/OwnPtr.h: Removed constructor that takes a raw pointer,
+        set functino that takes a raw pointer.
+
+        * wtf/PassOwnArrayPtr.h: Made constructor that takes a nullptr
+        and assignment operator that takes a nullptr unconditional.
+        Made constructor that takes a raw pointer private and explicit,
+        and removed assignment operator that takes a raw pointer.
+
+        * wtf/PassOwnPtr.h: Made assignment operator that takes a nullptr
+        unconditional. Made constructor that takes a raw pointer private
+        and explicit, and removed assignment operator that takes a raw pointer.
+
+2011-06-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Gavin Barraclough.
+
+        Make access-nseive ~9x faster on the non-speculative path by
+        adding special casing for doubles that can lossless-ly be converted
+        to a uint32_t in getByVal and putByVal. This avoids calls to stringification
+        and the hash lookup.  Long term, we should try and get property of a getByVal
+        and putByVal to be an integer immediate even in the non-speculative path.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        (JSC::DFG::operationPutByValInternal):
+
+2011-06-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r88719): 5by5.tv schedule is not visible
+        https://bugs.webkit.org/show_bug.cgi?id=62720
+
+        Problem here is that the lexer wasn't considering '$' to be
+        a valid character in an identifier.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::lexExpectIdentifier):
+
+2011-06-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Reduce the size of global_resolve
+        https://bugs.webkit.org/show_bug.cgi?id=62738
+
+        Reduce the code size of global_resolve in the JIT by replacing
+        multiple pointer loads with a single pointer move + two offset
+        loads.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+
+2011-06-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed an inavlid ASSERT I found while investigating
+        <rdar://problem/9580254> Crash in JSC::HandleHeap::finalizeWeakHandles + 92
+        https://bugs.webkit.org/show_bug.cgi?id=62699        
+
+        No test since we don't know of a way to get WebCore to deallocate the
+        next-to-finalize handle, which is also the last handle in the list,
+        while finalizing the second-to-last handle in the list.
+
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::deallocate): Don't ASSERT that m_nextToFinalize has a
+        non-0 next() after updating it, since it is valid to update m_nextToFinalize
+        to point to the tail sentinel.
+        
+        Do ASSERT that m_nextToFinalize has a non-0 next() before updating it,
+        since it is not valid to update m_nextToFinalize to point past the tail
+        sentinel.
+        
+        Also, use m_nextToFinalize consistently for clarity.
+
+2011-06-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43841
+        SegmentedVector::operator== typo
+
+        * wtf/SegmentedVector.h:
+        (WTF::SegmentedVectorIterator::operator==):
+        (WTF::SegmentedVectorIterator::operator!=):
+
+2011-06-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Constant array literals result in unnecessarily large amounts of code
+        https://bugs.webkit.org/show_bug.cgi?id=62658
+
+        Add a new version of op_new_array that simply copies values from a buffer
+        we hang off of the CodeBlock, rather than generating code to place each
+        entry into the registerfile, and then copying it from the registerfile into
+        the array.  This is a slight improvement on some sunspider tests, but no
+        measurable overall change.  That's okay though as our goal was to reduce
+        code size without hurting performance.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addImmediateBuffer):
+        (JSC::CodeBlock::immediateBuffer):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addImmediateBuffer):
+        (JSC::BytecodeGenerator::emitNewArray):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emit_op_new_array_buffer):
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+
+2011-06-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r88841.
+        http://trac.webkit.org/changeset/88841
+        https://bugs.webkit.org/show_bug.cgi?id=62672
+
+        Caused many tests to crash (Requested by rniwa on #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_array):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2011-06-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Constant array literals result in unnecessarily large amounts of code
+        https://bugs.webkit.org/show_bug.cgi?id=62658
+
+        Add a new version of op_new_array that simply copies values from a buffer
+        we hang off of the CodeBlock, rather than generating code to place each
+        entry into the registerfile, and then copying it from the registerfile into
+        the array.  This is a slight improvement on some sunspider tests, but no
+        measurable overall change.  That's okay though as our goal was to reduce
+        code size without hurting performance.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addImmediateBuffer):
+        (JSC::CodeBlock::immediateBuffer):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addImmediateBuffer):
+        (JSC::BytecodeGenerator::emitNewArray):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emit_op_new_array_buffer):
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+
+2011-06-14  Stephanie Lewis  <slewis@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        <rdar://problem/9511169>
+        Update order files.
+
+        * JavaScriptCore.order:
+
+2011-06-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix dumping of constants to have the correct constant number.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2011-06-14  Benjamin Poulain  <benjamin@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        KeywordLookupGenerator's Trie does not work with Python 3
+        https://bugs.webkit.org/show_bug.cgi?id=62635
+
+        With Python 3, dict.items() return an iterator. Since the iterator
+        protocol changed between Python 2 and 3, the easiest way to get the
+        values is to have something that use the iterator implicitely, like a
+        for() loop.
+
+        * KeywordLookupGenerator.py:
+
+2011-06-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix llocp and lvalp names in the lexer to something more meaningful
+        https://bugs.webkit.org/show_bug.cgi?id=62605
+
+        A simple rename
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseIdentifier):
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::lexExpectIdentifier):
+
+2011-06-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it possible to inline the common case of identifier lexing
+        https://bugs.webkit.org/show_bug.cgi?id=62600
+
+        Add a lexing function that expects to lex an "normal" alpha numeric
+        identifier (that ignores keywords) so it's possible to inline the
+        common parsing cases.  This comes out as a reasonable parsing speed
+        boost.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::nextExpectIdentifier):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseMemberExpression):
+        * parser/Lexer.cpp:
+        * parser/Lexer.h:
+        (JSC::Lexer::makeIdentifier):
+        (JSC::Lexer::lexExpectIdentifier):
+
+2011-06-13  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Distcheck fixes.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+
+2011-06-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make it possible to inline Identifier::equal
+        https://bugs.webkit.org/show_bug.cgi?id=62584
+
+        Move Identifier::equal to the Identifier header file.
+
+        * runtime/Identifier.cpp:
+        * runtime/Identifier.h:
+        (JSC::Identifier::equal):
+
+2011-06-13  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        rename ENABLE_NEW_FLEXBOX to ENABLE_CSS3_FLEXBOX
+        https://bugs.webkit.org/show_bug.cgi?id=62578
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-06-13  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        rename ENABLE_FLEXBOX to ENABLE_NEW_FLEXBOX
+        https://bugs.webkit.org/show_bug.cgi?id=62545
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-06-12  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r88604.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+
+2011-06-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16777
+
+        Remove #define NaN per Darin's comments.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseIntOverflow):
+        (JSC::parseInt):
+        (JSC::jsStrDecimalLiteral):
+        (JSC::jsToNumber):
+        (JSC::parseFloat):
+        * wtf/DateMath.cpp:
+        (WTF::equivalentYearForDST):
+        (WTF::parseES5DateFromNullTerminatedCharacters):
+        (WTF::parseDateFromNullTerminatedCharacters):
+        (WTF::timeClip):
+        (JSC::parseDateFromNullTerminatedCharacters):
+
+2011-06-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=62503
+        Remove JIT_OPTIMIZE_* switches
+
+        The alternative code paths are untested, and not well maintained.
+        These were useful when there was more churn in the JIT, but now
+        are a maintenance overhead. Time to move on, removing.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::softModulo):
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        * wtf/Platform.h:
+
+2011-06-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16777
+        Eliminate JSC::NaN and JSC::Inf
+
+        There's no good reason for -K-J-S- JSC to have its own NAN and infinity constants.
+        The ones in std::numeric_limits are perfectly good.
+        Remove JSC::Inf, JSC::NaN, switch some cases of (isnan || isinf) to !isfinite.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toNumber):
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        (JSValueToNumber):
+        * JavaScriptCore.exp:
+        * runtime/CachedTranscendentalFunction.h:
+        (JSC::CachedTranscendentalFunction::initialize):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceData::DateInstanceData):
+        (JSC::DateInstanceCache::reset):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::getPrimitiveNumber):
+        (JSC::JSCell::JSValue::toNumber):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncIsFinite):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toNumber):
+        * runtime/JSValue.cpp:
+        * runtime/JSValue.h:
+        * runtime/JSValueInlineMethods.h:
+        (JSC::jsNaN):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        * runtime/UString.cpp:
+        * wtf/DecimalNumber.h:
+        (WTF::DecimalNumber::DecimalNumber):
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+
+2011-06-10  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        add a compile guard ENABLE(FLEXBOX)
+        https://bugs.webkit.org/show_bug.cgi?id=62049
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-06-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55347
+        "name" and "message" enumerable on *Error.prototype
+
+        This arises from chapter 15 of the spec:
+            "Every other property described in this clause has the attributes
+            { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }
+            unless otherwise specified."
+        Standardized properties are not enumerable.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+
+2011-06-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Corrected header spelling.
+
+        * heap/OldSpace.h:
+
+2011-06-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added OldSpace to the project
+        https://bugs.webkit.org/show_bug.cgi?id=62417
+        
+        Currently unused.
+        
+        Added OldSpace, the ability to iterate NewSpace vs OldSpace, and a
+        per-block flag for testing whether you're in NewSpace vs OldSpace.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build!
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::inNewSpace):
+        (JSC::MarkedBlock::setInNewSpace): Added inNewSpace flag, for use in
+        write barrier.
+
+        * heap/NewSpace.cpp:
+        (JSC::NewSpace::addBlock):
+        (JSC::NewSpace::removeBlock):
+        * heap/NewSpace.h:
+        (JSC::NewSpace::forEachBlock): Added forEachBlock, to use for
+        NewSpace-specific operations.
+
+        * heap/OldSpace.cpp: Added.
+        (JSC::OldSpace::OldSpace):
+        (JSC::OldSpace::addBlock):
+        (JSC::OldSpace::removeBlock):
+        * heap/OldSpace.h: Added.
+        (JSC::OldSpace::forEachBlock): New class for holding promoted blocks.
+        Not in use yet.
+
+2011-06-09  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Make accelerated compositing build in Webkit-EFL
+        https://bugs.webkit.org/show_bug.cgi?id=62361
+
+        Add PLATFORM(EFL) to enable ACCELERATED_COMPOSITING on EFL port.
+
+        * wtf/Platform.h:
+
+2011-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 62405 - Fix integer overflow in Array.prototype.push
+
+        Fix geoff's review comments re static_cast.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPush):
+
+2011-06-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Factored MarkedBlock set management into a helper class with a fast case Bloom filter
+        https://bugs.webkit.org/show_bug.cgi?id=62413
+        
+        SunSpider reports a small speedup.
+        
+        This is in preparation for having ConservativeSet operate on arbitrary
+        sets of MarkedBlocks, and in preparation for conservative scanning
+        becoming proportionally more important than other GC activities.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build-o.
+
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::add):
+        * heap/ConservativeRoots.h:
+        (JSC::ConservativeRoots::ConservativeRoots): Operate on a MarkedBlockSet
+        directly, instead of a Heap, so we can operate on subsets of the Heap
+        instead.
+        
+        Use a TinyBloomFilter for single-cycle exclusion of most pointers. This
+        is particularly important since we expect not to find our subject pointer
+        in the MarkedBlock hash, and hash misses are more expensive than typical
+        hash lookups because they have high collision rates.
+        
+        No need for single-pointer add() to be public anymore, since nobody uses it.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        (JSC::Heap::forEachCell):
+        (JSC::Heap::forEachBlock): Use MarkedBlockSet since that's what
+        ConservativeRoots relies on.
+        
+        Nixed contains(), since nobody uses it anymore.
+
+        * heap/MarkedBlock.h:
+        (WTF::MarkedBlockHash::hash): Added a faster hash taking advantage of
+        the VM layout properties of MarkedBlocks.
+
+        * heap/MarkedBlockSet.h: Added.
+        (JSC::MarkedBlockSet::add):
+        (JSC::MarkedBlockSet::remove):
+        (JSC::MarkedBlockSet::recomputeFilter):
+        (JSC::MarkedBlockSet::filter):
+        (JSC::MarkedBlockSet::set):
+        * heap/TinyBloomFilter.h: Added.
+        (JSC::TinyBloomFilter::TinyBloomFilter):
+        (JSC::TinyBloomFilter::add):
+        (JSC::TinyBloomFilter::ruleOut): New helper class, used above.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots): No need to specifically
+        exclude values by tag -- the tiny bloom filter is already a register-register
+        compare, so adding another "rule out" factor just slows things down.
+
+2011-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 62405 - Fix integer overflow in Array.prototype.push
+
+        There are three integer overflows here, leading to safe (not a security risk)
+        but incorrect (non-spec-compliant) behaviour.
+
+        Two overflows occur when calculating the new length after pushing (one in the
+        fast version of push in JSArray, one in the generic version in ArrayPrototype).
+        The other occurs calculating indices to write to when multiple items are pushed.
+
+        These errors result in three test-262 failures.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPush):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        (JSC::JSArray::push):
+
+2011-06-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Add Vector::reverse()
+        https://bugs.webkit.org/show_bug.cgi?id=62393
+
+        * wtf/Vector.h:
+        (WTF::Vector::reverse): Added
+
+2011-06-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Factored a bunch of Heap functionality into stand-alone functors
+        https://bugs.webkit.org/show_bug.cgi?id=62337
+        
+        This is in preparation for making these functors operate on arbitrary
+        sets of MarkedBlocks.
+
+        * JavaScriptCore.exp: This file is a small tragedy.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Updated for type change and rename.
+
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::forEachStrongHandle): New function for iterating all
+        strong handles, so we can play along in the functor game.
+
+        * heap/Heap.cpp:
+        (JSC::CountFunctor::CountFunctor::CountFunctor):
+        (JSC::CountFunctor::CountFunctor::count):
+        (JSC::CountFunctor::CountFunctor::returnValue):
+        (JSC::CountFunctor::ClearMarks::operator()):
+        (JSC::CountFunctor::ResetAllocator::operator()):
+        (JSC::CountFunctor::Sweep::operator()):
+        (JSC::CountFunctor::MarkCount::operator()):
+        (JSC::CountFunctor::Size::operator()):
+        (JSC::CountFunctor::Capacity::operator()):
+        (JSC::CountFunctor::Count::operator()):
+        (JSC::CountFunctor::CountIfGlobalObject::operator()):
+        (JSC::CountFunctor::TakeIfEmpty::TakeIfEmpty):
+        (JSC::CountFunctor::TakeIfEmpty::operator()):
+        (JSC::CountFunctor::TakeIfEmpty::returnValue):
+        (JSC::CountFunctor::RecordType::RecordType):
+        (JSC::CountFunctor::RecordType::typeName):
+        (JSC::CountFunctor::RecordType::operator()):
+        (JSC::CountFunctor::RecordType::returnValue): These functors factor out
+        behavior that used to be in the functions below.
+
+        (JSC::Heap::clearMarks):
+        (JSC::Heap::sweep):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::protectedObjectCount):
+        (JSC::Heap::protectedObjectTypeCounts):
+        (JSC::Heap::objectTypeCounts):
+        (JSC::Heap::resetAllocator):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrink): Factored out behavior into the functors above.
+
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        (JSC::Heap::forEachCell):
+        (JSC::Heap::forEachBlock): Added forEach* iteration templates. I chose
+        functor-based templates instead of plain iterators because they're simpler
+        to implement in this case and they require a lot less code at the call site.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::VoidFunctor::returnValue): Default parent class for
+        trivial functors.
+
+        (JSC::MarkedBlock::forEachCell): Renamed forEach to forEachCell because
+        we have a few different kind of "for each" now.
+
+        * runtime/JSGlobalData.cpp:
+        (WTF::Recompile::operator()):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::recompileAllJSFunctions): Updated for type change and rename.
+
+        * runtime/JSGlobalData.h: Removed globalObjectCount because it was unused.
+
+2011-06-08  Mikołaj Małecki  <m.malecki@samsung.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Crash by buffer overrun crash when serializing inspector object tree.
+        https://bugs.webkit.org/show_bug.cgi?id=52791
+
+        No new tests. The problem can be reproduced by trying to create InspectorValue
+        from 1.0e-100 and call ->toJSONString() on this.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        export 2 functions DecimalNumber::bufferLengthForStringExponential and
+        DecimalNumber::toStringExponential.
+
+2011-06-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r88404.
+        http://trac.webkit.org/changeset/88404
+        https://bugs.webkit.org/show_bug.cgi?id=62342
+
+        broke win and mac build (Requested by tony^work on #webkit).
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-06-08  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] use gyp 'settings' type for settings target
+        https://bugs.webkit.org/show_bug.cgi?id=62323
+
+        The 'settings' gyp target type is for targets that exist solely
+        for their settings (no build rules).  The comment above this target
+        says it's for this, but it incorrectly uses 'none'.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-06-08  Sailesh Agrawal  <sail@chromium.org>
+
+        Reviewed by Mihai Parparita.
+
+        Chromium Mac: Enable overlay scrollbars
+        https://bugs.webkit.org/show_bug.cgi?id=59756
+
+        Enable WTF_USE_WK_SCROLLBAR_PAINTER for Chromium Mac. This allows us to use overlay scrollbars on future versions of Mac OS X.
+
+        * wtf/Platform.h:
+
+2011-06-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Add faster lookup cache for multi character identifiers
+        https://bugs.webkit.org/show_bug.cgi?id=62327
+
+        Add a non-hash lookup for mutiple character identifiers.  This saves us from
+        adding repeated identifiers to the ParserArena's identifier list as people
+        tend to not start all their variables and properties with the same character
+        and happily identifier locality works in our favour.
+
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::isEmpty):
+        (JSC::IdentifierArena::clear):
+        (JSC::IdentifierArena::makeIdentifier):
+
+2011-06-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Took some responsibilities away from NewSpace
+        https://bugs.webkit.org/show_bug.cgi?id=62325
+        
+        NewSpace is basically just an allocator now.
+        
+        Heap acts as a controller, responsible for managing the set of all
+        MarkedBlocks.
+        
+        This is in preparation for moving parts of the controller logic into
+        separate helper classes that can act on arbitrary sets of MarkedBlocks
+        that may or may not be in NewSpace.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::allocate):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::clearMarks):
+        (JSC::Heap::sweep):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::collect):
+        (JSC::Heap::resetAllocator):
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::freeBlocks):
+        (JSC::Heap::shrink): Moved the set of MarkedBlocks from NewSpace to Heap,
+        along with all functions that operate on the set of MarkedBlocks. Also
+        moved responsibility for deciding whether to allocate a new MarkedBlock,
+        and for allocating it.
+
+        * heap/Heap.h:
+        (JSC::Heap::contains):
+        (JSC::Heap::forEach): Ditto.
+
+        * heap/NewSpace.cpp:
+        (JSC::NewSpace::addBlock):
+        (JSC::NewSpace::removeBlock):
+        (JSC::NewSpace::resetAllocator):
+        * heap/NewSpace.h:
+        (JSC::NewSpace::waterMark):
+        (JSC::NewSpace::allocate): Ditto.
+
+2011-06-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Some more MarkedSpace => NewSpace renaming
+        https://bugs.webkit.org/show_bug.cgi?id=62305
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::reportExtraMemoryCostSlowCase):
+        (JSC::Heap::allocate):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::collect):
+        (JSC::Heap::isValidAllocation):
+        * heap/Heap.h:
+        (JSC::Heap::markedSpace):
+        (JSC::Heap::contains):
+        (JSC::Heap::forEach):
+        (JSC::Heap::allocate):
+        * runtime/JSCell.h:
+
+2011-06-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Add export macros to profiler headers.
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * profiler/Profiler.h:
+
+2011-06-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Add export symbols to parser headers.
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * parser/SourceProviderCache.h:
+
+2011-06-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Add export symbols to interpreter headers.
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * interpreter/Interpreter.h:
+
+2011-06-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Add export symbols to debugger headers.
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.h:
+
+2011-06-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Moved MarkedSpace.* to NewSpace.* in preparation for more renaming
+        https://bugs.webkit.org/show_bug.cgi?id=62268
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.h:
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp: Removed.
+        * heap/MarkedSpace.h: Removed.
+        * heap/NewSpace.cpp: Copied from Source/JavaScriptCore/heap/MarkedSpace.cpp.
+        * heap/NewSpace.h: Copied from Source/JavaScriptCore/heap/MarkedSpace.h.
+
+2011-06-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r88365.
+        http://trac.webkit.org/changeset/88365
+        https://bugs.webkit.org/show_bug.cgi?id=62301
+
+        windows bots broken (Requested by loislo_ on #webkit).
+
+        * JavaScriptCore.exp:
+
+2011-06-08  Ryan Sleevi  <rsleevi@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Suppress C++0x compat warnings when compiling Chromium port with GCC 4.6
+
+        Compiling Chromium port under GCC 4.6 produces warnings about nullptr
+        https://bugs.webkit.org/show_bug.cgi?id=62242
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-06-08  Ademar de Souza Reis Jr.  <ademar.reis@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        Webkit on SPARC Solaris has wrong endian
+        https://bugs.webkit.org/show_bug.cgi?id=29407
+
+        Bug 57256 fixed one crash on misaligned reads on sparc/solaris, but
+        there are more ocurrences of the same code pattern in webkit.
+
+        This patch includes the check on these other parts of the code.
+
+        This is a speculative fix, I don't have a sparc machine to test and
+        don't know which kind of test would trigger a crash (but it's quite
+        obvious that it's the same code duplicated in different files).
+
+        * runtime/UString.h:
+        (JSC::UStringHash::equal):
+        * wtf/text/StringHash.h:
+        (WTF::StringHash::equal):
+
+2011-06-08  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Build fix for building QtWebKit inside of Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=62280
+
+        Remove CONFIG=staticlib, because it causes the configure script to add -ljavascriptcore
+        into QtWebKit.prl.
+
+        No new tests, as this is just a build fix.
+
+        * JavaScriptCore.pri:
+
+2011-06-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Split 'reset' into 'collect' and 'resetAllocator'
+        https://bugs.webkit.org/show_bug.cgi?id=62267
+
+        * heap/Heap.cpp:
+        (JSC::Heap::allocate):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::resetAllocator):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::resetAllocator):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::resetAllocator):
+
+2011-06-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed some more marks to visits
+        https://bugs.webkit.org/show_bug.cgi?id=62254
+
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::visitStrongHandles):
+        (JSC::HandleHeap::visitWeakHandles):
+        * heap/HandleHeap.h:
+        * heap/HandleStack.cpp:
+        (JSC::HandleStack::visit):
+        * heap/HandleStack.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * heap/HeapRootVisitor.h:
+        (JSC::HeapRootVisitor::visit):
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+
+2011-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        https://bugs.webkit.org/show_bug.cgi?id=55537
+        Functions claim to have 'callee' which they actually don't (and shouldn't)
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyNames):
+
+2011-06-07  Juan C. Montemayor  <jmont@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make JSStaticFunction and JSStaticValue less "const"
+        https://bugs.webkit.org/show_bug.cgi?id=62222
+
+        * API/JSObjectRef.h:
+        * API/tests/testapi.c:
+        (checkConstnessInJSObjectNames):
+        (main):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=62240
+        DFG JIT - add support for for-loop array initialization.
+
+        Support put by val beyond vector length.
+        Add a operationPutByValBeyondArrayBounds operation, make
+        PutValVal call this if the vector length check fails.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentSpillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillAllRegisters):
+        (JSC::DFG::JITCodeGenerator::isDoubleConstantWithInt32Value):
+        (JSC::DFG::JITCodeGenerator::isJSConstantWithInt32Value):
+        (JSC::DFG::JITCodeGenerator::isIntegerConstant):
+        (JSC::DFG::JITCodeGenerator::valueOfIntegerConstant):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-06-06  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add monotonicallyIncreasingTime() to get monotonically increasing time
+        https://bugs.webkit.org/show_bug.cgi?id=37743
+
+        * wtf/CurrentTime.cpp: Add monotonicallyIncreasingTime() for mac and a fallback implementation that just wraps currentTime().
+        (WTF::monotonicallyIncreasingTime):
+        * wtf/CurrentTime.h: Add monotonicallyIncreasingTime().
+
+2011-06-06  Alexandru Chiculita  <achicu@adobe.com>
+
+        Reviewed by Kent Tamura.
+
+        Add ENABLE_CSS_EXCLUSIONS support for build-webkit script
+        https://bugs.webkit.org/show_bug.cgi?id=61628
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-06-06  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Kent Tamura.
+
+        Add ENABLE(CSS_REGIONS) guard for CSS Regions support
+        https://bugs.webkit.org/show_bug.cgi?id=61631
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-06-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix the GTK+ build.
+
+        * GNUmakefile.am: Add javascriptcore_cflags variable.
+
+2011-06-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Restore the PPC build and allow users to specify architectures
+        to build on Mac.
+
+        * wtf/Platform.h:
+
+2011-06-04  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed, MIPS build fix.
+
+        WebKitGTK+ tarball fails to build on MIPS.
+        https://buildd.debian.org/status/fetch.php?pkg=webkitgtk%2B&arch=mips&ver=1.4.0-1&stamp=1304786691
+
+        * GNUmakefile.list.am: Add missing MIPS-related file to the list
+        of files that are added to the tarball on make dist, and fix
+        sorting.
+
+2011-06-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix formatting of the output generated by KeywordLookupGenerator.py
+        https://bugs.webkit.org/show_bug.cgi?id=62083
+
+        - Uses correct year for copyright.
+        - Puts ending brace on same line as "else if"
+        - Puts starting brace of function on its own line.
+        - Adds some tasteful whitespace.
+        - Adds comments to make clear that scopes are ending
+        - Make macros actually split on two lines.
+
+        * KeywordLookupGenerator.py:
+
+2011-06-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        KeywordLookupGenerator.py spams stdout in Chromium Linux build
+        https://bugs.webkit.org/show_bug.cgi?id=62087
+
+        This action does not appear to be needed.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-06-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Lexer needs to provide Identifier for reserved words
+        https://bugs.webkit.org/show_bug.cgi?id=62086
+
+        Alas it is necessary to provide an Identifier reference for keywords
+        so that we can do the right thing when they're used in object literals.
+        We now keep Identifiers for all reserved words in the CommonIdentifiers
+        structure so that we can access them without a hash lookup.
+
+        * KeywordLookupGenerator.py:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseIdentifier):
+        * parser/Lexer.h:
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+
+2011-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add debug code to break on speculation failures.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGNode.h:
+
+2011-06-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=62082
+        DFG JIT - bug passing arguments that need swap
+
+        This is really just a typo.
+        When setting up the arguments for a call out to a C operation, we'll
+        fail to swap arguments where this is necessary. For example, in the
+        case of 2 arg calls, where the first argument is in %rdx & the second
+        is in %rsi we should swap (exec will be passed in %rdi), but we don't.
+
+        This can also affect function calls passing three arguments.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::setupTwoStubArgs):
+            - Call swap with the correct arguments.
+
+2011-06-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Force inlining of some hot lexer functions
+        https://bugs.webkit.org/show_bug.cgi?id=62079
+
+        Fix more GCC stupidity
+
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace):
+        (JSC::Lexer::isLineTerminator):
+
+2011-06-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        GCC not inlining some functions that it really should be
+        https://bugs.webkit.org/show_bug.cgi?id=62075
+
+        Add ALWAYS_INLINE to a number of parsing and lexing functions
+        that should always be inlined.  This gets us ~1.4% on my ad hoc
+        parser test.
+
+        * KeywordLookupGenerator.py:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::nextTokenIsColon):
+        (JSC::JSParser::consume):
+        (JSC::JSParser::match):
+        (JSC::JSParser::tokenStart):
+        (JSC::JSParser::tokenLine):
+        (JSC::JSParser::tokenEnd):
+        * parser/Lexer.cpp:
+        (JSC::isIdentPart):
+
+2011-06-03  Oliver Hunt  <oliver@apple.com>
+
+        Whoops, fix last minute bug.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseIdentifier):
+
+2011-06-03  Martin Robinson  <mrobinson@igalia.com>
+
+        Try to fix the GTK+ build.
+
+        * GNUmakefile.am: Clean up some spaces that should be tabs.
+        * GNUmakefile.list.am: Add KeywordLookup.h to the source list
+        and clean up some spaces that should be tabs.
+
+2011-06-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Improve keyword lookup
+        https://bugs.webkit.org/show_bug.cgi?id=61913
+
+        Rather than doing multiple hash lookups as we currently
+        do when trying to identify keywords we now use an 
+        automatically generated decision tree (essentially it's
+        a hard coded patricia trie).  We still use the regular
+        lookup table for the last few characters of an input as
+        this allows us to completely skip all bounds checks.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * KeywordLookupGenerator.py: Added.
+        * make-generated-sources.sh:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::internalShift):
+        (JSC::Lexer::shift):
+        (JSC::Lexer::parseIdentifier):
+        * parser/Lexer.h:
+
+2011-06-03  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Build flag for experimental ICU library support
+        https://bugs.webkit.org/show_bug.cgi?id=60786
+
+        Adds a build-time flag (CONFIG+=use_system_icu) that enables experimental 
+        ICU powered Unicode support. 
+
+        * JavaScriptCore.pri: Support for use_system_icu CONFIG flag.
+        * wtf/unicode/qt4/UnicodeQt4.h: Guard an include file with USE(ICU_UNICODE). 
+
+2011-06-03  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Build fix of QtWebKit 2.2 when inside Qt tree with GCC 4.6.
+        https://bugs.webkit.org/show_bug.cgi?id=61957
+
+        When building inside the Qt source tree, qmake always append the mkspecs
+        defines after ours. We have to workaround and make sure that we append 
+        our flags after the qmake variable used inside Qt. This workaround was provided 
+        by our qmake folks. We need to append in both case because qmake behave differently
+        when called with -spec or via SUBDIR+=. This patch unbreak r87950 on Mac for Qt port.
+
+        * JavaScriptCore.pro:
+
+2011-06-02  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added a method to generate RFC 2822 compliant date strings.
+        https://bugs.webkit.org/show_bug.cgi?id=7169
+
+        * wtf/DateMath.cpp:
+        (WTF::twoDigitStringFromNumber):
+        (WTF::makeRFC2822DateString):
+        * wtf/DateMath.h:
+
+2011-06-02  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Build fix of QtWebKit 2.2 when inside Qt tree with GCC 4.6.
+        https://bugs.webkit.org/show_bug.cgi?id=61957
+
+        When building inside the Qt source tree, qmake always append the mkspecs
+        defines after ours. We have to workaround and make sure that we append  
+        our flags after the qmake variable used inside Qt. This workaround was provided
+        by our qmake folks.
+
+        * JavaScriptCore.pro:
+
+2011-06-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Add single character lookup cache to IdentifierArena
+        https://bugs.webkit.org/show_bug.cgi?id=61879
+
+        Add a simple lookup cache for single ascii character
+        identifiers.  Produces around a 2% improvement in parse
+        time for my adhoc parser test.
+
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::IdentifierArena):
+        (JSC::IdentifierArena::clear):
+        (JSC::IdentifierArena::makeIdentifier):
+
+2011-05-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Freezing a function and its prototype causes browser to crash.
+        https://bugs.webkit.org/show_bug.cgi?id=61758
+
+        Make JSObject::preventExtensions virtual so that we can override it
+        and instantiate all lazy
+
+        * JavaScriptCore.exp:
+        * runtime/JSFunction.cpp:
+        (JSC::createPrototypeProperty):
+        (JSC::JSFunction::preventExtensions):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::seal):
+        (JSC::JSObject::seal):
+
+2011-06-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r87788.
+        http://trac.webkit.org/changeset/87788
+        https://bugs.webkit.org/show_bug.cgi?id=61856
+
+        breaks windows chromium canary (Requested by jknotten on
+        #webkit).
+
+        * wtf/DateMath.cpp:
+        (WTF::timeClip):
+        * wtf/DateMath.h:
+
+2011-06-01  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added a method to generate RFC 2822 compliant date strings.
+        https://bugs.webkit.org/show_bug.cgi?id=7169
+
+        * wtf/DateMath.cpp:
+        (WTF::twoDigitStringFromNumber):
+        (WTF::makeRFC2822DateString):
+        * wtf/DateMath.h:
+
+2011-05-31  Yong Li  <yoli@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=54807
+        We have been assuming plain bitfields (like "int a : 31") are always signed integers.
+        However some compilers can treat them as unsigned. For example, RVCT 4.0 states plain
+        bitfields (declared without either signed or unsigned qualifiers) are treats as unsigned.
+        http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0348c/Babjddhe.html
+        Although we can use "--signed-bitfields" flag to make RVCT 4.0 behave as most other compilers,
+        always using "signed"/"unsigned" qualifier to declare integral type bitfields is still a good
+        rule we should have in order to make our code independent from compilers and compiler flags.
+
+        No new test added because this change is not known to fix any issue.
+
+        * bytecode/StructureStubInfo.h:
+
+2011-05-30  Hojong Han  <hojong.han@samsung.com>
+
+        Reviewed by Geoffrey Garen.
+
+        [JSC] malfunction during arithmetic condition check with negative number (-2147483648)
+        https://bugs.webkit.org/show_bug.cgi?id=61416
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+        * tests/mozilla/ecma/Expressions/11.12-1.js:
+        (getTestCases):
+
+2011-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some heap refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=61704
+        
+        SunSpider says no change.
+
+        * JavaScriptCore.exp: Export!
+
+        * heap/Heap.cpp: COLLECT_ON_EVERY_ALLOCATION can actually do so now.
+
+        (JSC::Heap::Heap): Changed Heap sub-objects to point to the heap.
+
+        (JSC::Heap::allocate): Changed inline allocation code to only select the
+        size class, since this can be optimized out at compile time -- everything
+        else is now inlined into this out-of-line function.
+        
+        No need to duplicate ASSERTs made in our caller.
+
+        * heap/Heap.h:
+        (JSC::Heap::heap):
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::testAndClearMarked):
+        (JSC::Heap::setMarked): Call directly into MarkedBlock instead of adding
+        a layer of indirection through MarkedSpace.
+
+        (JSC::Heap::allocate): See above.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h: Changed Heap sub-objects to point to the heap.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::allocate): Updated to match changes above.
+
+2011-05-28  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX when building only the interpreter
+
+        Fixes the following compiler warning:
+
+            JavaScriptCore/runtime/JSGlobalData.cpp:462:6: error: no previous prototype for function 'releaseExecutableMemory' [-Werror,-Wmissing-prototypes,3]
+             void releaseExecutableMemory(JSGlobalData& globalData)
+                  ^
+
+        * jit/ExecutableAllocator.h: Moved declaration of
+        JSC::releaseExecutableMemory().
+
+2011-05-28  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX after r87527 with ENABLE(BRANCH_COMPACTION)
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode): Added missing argument.
+
+2011-05-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JS API is too aggressive about throwing exceptions for NULL get or set operations
+        https://bugs.webkit.org/show_bug.cgi?id=61678
+
+        * API/JSCallbackObject.h: Changed our staticValueGetter to a regular
+        function that returns a JSValue, so it can fail and still forward to
+        normal property lookup.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot): Don't throw an exception when failing to
+        access a static property -- just forward the access. This allows objects
+        to observe get/set operations but still let the JS object manage lifetime.
+
+        (JSC::::put): Ditto.
+
+        (JSC::::getStaticValue): Same as JSCallbackObject.h.
+
+        * API/tests/testapi.c:
+        (MyObject_set_nullGetForwardSet):
+        * API/tests/testapi.js: Updated tests to reflect slightly less strict
+        behavior, which matches headerdoc claims.
+
+2011-05-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Property caching is too aggressive for API objects
+        https://bugs.webkit.org/show_bug.cgi?id=61677
+
+        * API/JSCallbackObject.h: Opt in to ProhibitsPropertyCaching, since our
+        callback APIs allow the client to change its mind about our propertis at
+        any time.
+
+        * API/tests/testapi.c:
+        (PropertyCatchalls_getProperty):
+        (PropertyCatchalls_setProperty):
+        (PropertyCatchalls_getPropertyNames):
+        (PropertyCatchalls_class):
+        (main):
+        * API/tests/testapi.js: Some tests for dynamic API objects.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION): Opt out of property caching if the client
+        requires it.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::isFinal):
+        (JSC::TypeInfo::prohibitsPropertyCaching):
+        (JSC::TypeInfo::flags): Added a flag to track opting out of property
+        caching. Fixed an "&&" vs "&" typo that was previously harmless, but
+        is now harmful since m_flags2 can have more than one bit set.
+
+2011-05-27  Stephanie Lewis  <slewis@apple.com>
+
+        Unreviewed.
+
+        Fix a typo in the order_file flag.
+
+        * Configurations/Base.xcconfig:
+
+2011-05-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(ASSEMBLER) after r87527.
+
+        * runtime/JSGlobalData.cpp:
+        (JSGlobalData::JSGlobalData):
+
+2011-05-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Add a few validity assertions to JSCallbackObject
+        https://bugs.webkit.org/show_bug.cgi?id=61659
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::visitChildren):
+
+2011-05-27  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+
+2011-05-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Try to release unused executable memory when the FixedVMPool allocator is under pressure
+        https://bugs.webkit.org/show_bug.cgi?id=61651
+
+        Rather than crashing when full the FixedVMPool allocator now returns a null
+        allocation.  We replace the code that used to CRASH() on null allocations
+        with logic that asks the provided globalData to release any executable memory
+        that it can.  Currently this just means throwing away all regexp code, but
+        in future we'll try to be more aggressive.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::create):
+        (JSC::ExecutablePool::alloc):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::poolForSize):
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::alloc):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::releaseExecutableMemory):
+        (JSC::releaseExecutableMemory):
+        * runtime/JSGlobalData.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/RegExpCache.h:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Optimized ConservativeSet to avoid double-visiting objects
+        https://bugs.webkit.org/show_bug.cgi?id=61592
+        
+        SunSpider thinks this might be a 1% speedup
+
+        * heap/ConservativeRoots.h:
+        (JSC::ConservativeRoots::add): Use testAndClearMarked to avoid double-visiting
+        an object.
+
+        * heap/Heap.h:
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::testAndClearMarked):
+        (JSC::Heap::setMarked): Added testAndClearMarked. Changed argument type
+        to void*, since clients want to ask questions about arbitrary pointers
+        into the heap, even when they aren't known to be JSCells.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::testAndClearMarked):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::isMarked):
+        (JSC::MarkedSpace::testAndSetMarked):
+        (JSC::MarkedSpace::testAndClearMarked):
+        (JSC::MarkedSpace::setMarked):
+        (JSC::MarkedSpace::contains): Ditto.
+
+        * wtf/Bitmap.h:
+        (WTF::::testAndClear): New function for ConservativeRoots's inverted
+        marking pass.
+
+2011-05-27  Stephanie Lewis  <slewis@apple.com>
+
+        Rubber Stamped by Adam Roben.
+
+        Update Order Files.  Use -order_file flag since it can order more of the binary.
+
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.order:
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Renamed heapRootMarker to heapRootVisitor to match its class name
+        https://bugs.webkit.org/show_bug.cgi?id=61584
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some interdependency between Heap and SmallStrings by simplifying
+        the SmallStrings lifetime model
+        https://bugs.webkit.org/show_bug.cgi?id=61579
+        
+        SunSpider reports no change.
+        
+        Using Weak<T> could accomplish this too, but we're not sure it will give
+        us the performance we need. This is a first step, and it accomplishes
+        most of the value of using Weak<T>.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::reset): Finalize small strings just like other weak handles.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::finalize):
+        (JSC::SmallStrings::finalizeSmallStrings):
+        * runtime/SmallStrings.h: Make all small strings trivially weak, instead
+        of having an "all for one, one for all" memory model.
+
+2011-05-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make RegExpCache a weak map
+        https://bugs.webkit.org/show_bug.cgi?id=61554
+
+        Switch to a weak map for the regexp cache, and hide that
+        behaviour behind RegExp::create.
+
+        When a RegExp is compiled it attempts to add itself to
+        the "strong" cache.  This cache is a simple round-robin
+        buffer as was the old strong cache.  Happily this can
+        be smaller than the old strong cache as RegExps are only
+        added when they're compiled so it is under less pressure
+        to evict.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        (JSC::RegExp::gcShouldInvalidateCode):
+        (JSC::RegExp::hasCode):
+        (JSC::RegExp::key):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::RegExpCache):
+        (JSC::RegExpCache::isReachableFromOpaqueRoots):
+        (JSC::RegExpCache::finalize):
+        * runtime/RegExpCache.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Moved Heap-related functions out of JSCell.h and into respective header files
+        https://bugs.webkit.org/show_bug.cgi?id=61567
+
+        * heap/Heap.h:
+        (JSC::Heap::allocate):
+        (JSC::Heap::heap):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::allocate):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::sizeClassFor):
+        (JSC::MarkedSpace::allocate):
+        * runtime/JSCell.h:
+        (JSC::JSCell::destructor):
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-05-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [debug feature] WTFString should have show() method
+        https://bugs.webkit.org/show_bug.cgi?id=61149
+
+        Added String::show and AtomicString::show in NDEBUG.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::show):
+        * wtf/text/AtomicString.h:
+        * wtf/text/WTFString.cpp:
+        (String::show):
+        * wtf/text/WTFString.h:
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Factored out some Heap ASSERTs
+        https://bugs.webkit.org/show_bug.cgi?id=61565
+
+        * JavaScriptCore.exp:
+        * heap/Heap.cpp:
+        (JSC::isValidSharedInstanceThreadState):
+        (JSC::isValidThreadState):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::isValidAllocation):
+        * heap/Heap.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::Heap::allocate):
+
+2011-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=61508
+        DFG JIT - Add support for get by id self caching.
+
+        Change the call out to be an unexpected call (using silent spill/fill functions),
+        add a structure check & compact load to the JIT code, and add repatching mechanisms.
+        Since DFGOperations may want to be be implemented in asm, make these symbols be extern
+        "C". Add an asm wrapper to pass the return address to the optimizing get-by-id operation,
+        so that it can look up its StructureStubInfo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Added new files.
+        * bytecode/StructureStubInfo.h:
+            - Added 'unset' entries to union.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::appendCallWithExceptionCheck):
+            - Return the call, we need this to populate the StructureStubInfo.
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+            - Populate the CodebBlock's StructureStubInfo Vector.
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::appendCallWithExceptionCheck):
+            - Return the call, we need this to populate the StructureStubInfo.
+        (JSC::DFG::JITCompiler::addPropertyAccess):
+        (JSC::DFG::JITCompiler::PropertyAccessRecord::PropertyAccessRecord):
+            - Add structures to record property access info during compilation.
+        * dfg/DFGOperations.cpp:
+            - Made all external methods extern "C".
+        (JSC::DFG::operationPutByValInternal):
+            - Moved outside of the extern "C" block.
+        * dfg/DFGOperations.h:
+            - Made all external methods extern "C".
+        * dfg/DFGRepatch.cpp: Added.
+        (JSC::DFG::dfgRepatchCall):
+            - repatch a call to link to a new callee function.
+        (JSC::DFG::dfgRepatchGetByIdSelf):
+            - Modify the JIT code to optimize self accesses.
+        (JSC::DFG::tryCacheGetByID):
+            - Internal implementation of dfgRepatchGetByID (factor out failing cases).
+        (JSC::DFG::dfgRepatchGetByID):
+            - Used to optimize 'operationGetByIdOptimize' - repatches to 'operationGetById', and tries to optimize self accesses!
+        * dfg/DFGRepatch.h: Added.
+            - Expose dfgRepatchGetByID.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Changed implementation of GetById ops.
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in http://trac.webkit.org/changeset/87408 with Windows build fixed.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        * wtf/DoublyLinkedList.h:
+        (WTF::::DoublyLinkedListNode):
+        (WTF::::setPrev):
+        (WTF::::setNext):
+        (WTF::::prev):
+        (WTF::::next):
+        (WTF::::DoublyLinkedList):
+        (WTF::::isEmpty):
+        (WTF::::size):
+        (WTF::::clear):
+        (WTF::::head):
+        (WTF::::append):
+        (WTF::::remove):
+        (WTF::::removeHead):
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out http://trac.webkit.org/changeset/87408 because it broke the
+        Windows build.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::setPrev):
+        (JSC::MarkedBlock::setNext):
+        (JSC::MarkedBlock::prev):
+        (JSC::MarkedBlock::next):
+        * wtf/DoublyLinkedList.h:
+        (WTF::::DoublyLinkedList):
+        (WTF::::isEmpty):
+        (WTF::::head):
+        (WTF::::append):
+        (WTF::::remove):
+
+2011-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Provide a real owner when copying a property table, for the sake of
+        write barriers.
+        https://bugs.webkit.org/show_bug.cgi?id=61547
+        
+        No test because we can't enable the writeBarrier() ASSERT just yet.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+
+2011-05-26  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r87346
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Fixed up exports to match
+        reality.
+
+2011-05-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        ASSERT(isMainThread()) when using single threaded jsc executable
+        https://bugs.webkit.org/show_bug.cgi?id=60846
+
+        Remove the ASSERT since we do not have the concept of MainThread in JSC.
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
+
+2011-05-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=61506
+
+        Move the silent spill/fill methods in the DFG JIT to the JITCodeGenerator
+        so that they are available to the SpeculativeJIT.
+
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::silentSpillGPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillFPR):
+        (JSC::DFG::JITCodeGenerator::silentFillGPR):
+        (JSC::DFG::JITCodeGenerator::silentFillFPR):
+        (JSC::DFG::JITCodeGenerator::silentSpillAllRegisters):
+        (JSC::DFG::JITCodeGenerator::silentFillAllRegisters):
+        * dfg/DFGNonSpeculativeJIT.h:
+
+2011-05-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        An attempt to revive Windows bots.
+
+        * runtime/RegExp.cpp:
+        * runtime/RegExp.h:
+
+2011-05-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 61503 - Move population of CodeBlock::m_structureStubInfos into JIT
+
+        This data structure, used at runtime by the JIT, is currently unnecessarily populated
+        with default entries during byte compilation.
+
+        Aside from meaning that there is JIT specific code in the bytecompiler, this also ties
+        us to one entry per corresponding bytecode op, which may be undesirable. Instead,
+        populate this array from the JIT.
+
+        The type StructureStubInfo has two unused states, one for gets & one for puts. Unify
+        these, so that the class can have a default constructor (and to simply switch statements
+        in code walking over the table).
+
+        This change has ramification for the DFG JIT, in that the DFG JIT used this datastructure
+        to check for functions containing property access. Instead do so in the DFGByteCodeParser.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printStructureStubInfo):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setNumberOfStructureStubInfos):
+        (JSC::CodeBlock::numberOfStructureStubInfos):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        * runtime/Executable.cpp:
+        (JSC::tryDFGCompile):
+
+2011-05-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 61501 - Unify AbstractMacroAssembler::differenceBetween methods.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::Call::fromTailJump):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::Jump::isSet):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        (JSC::AbstractMacroAssembler::linkJump):
+        (JSC::AbstractMacroAssembler::getLinkerCallReturnOffset):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::link):
+        (JSC::LinkBuffer::locationOf):
+        (JSC::LinkBuffer::locationOfNearCall):
+        (JSC::LinkBuffer::returnAddressOffset):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::linkCall):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::linkCall):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::linkCall):
+        * assembler/MacroAssemblerSH4.cpp:
+        (JSC::MacroAssemblerSH4::linkCall):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::linkCall):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::linkCall):
+
+2011-05-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=61500
+        Add JSObject::offsetOfPropertyStorage
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        * runtime/JSObject.h:
+        (JSC::JSObject::offsetOfPropertyStorage):
+
+2011-05-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make RegExp GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=61490
+
+        Make RegExp GC allocated.  Basically mechanical change to replace
+        most use of [Pass]RefPtr<RegExp> with RegExp* or WriteBarrier<RegExp>
+        where actual ownership happens.
+
+        Made the RegExpCache use Strong<> references currently to avoid any
+        changes in behaviour.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addRegExp):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addRegExp):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        * bytecompiler/BytecodeGenerator.h:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::clearBuiltinStructures):
+        (JSC::JSGlobalData::addRegExpToTrace):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::invalidateCode):
+        * runtime/RegExp.h:
+        (JSC::RegExp::createStructure):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        (JSC::RegExpObject::visitChildren):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setRegExp):
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        (JSC::regExpProtoFuncCompile):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+
+2011-05-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Generate regexp code lazily
+        https://bugs.webkit.org/show_bug.cgi?id=61476
+
+        RegExp construction now simply validates the RegExp, it does
+        not perform actual codegen.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::recompile):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        (JSC::RegExp::recompileIfNecessary):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSplit):
+
+2011-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Removed MarkSetProperties because it was unused
+        https://bugs.webkit.org/show_bug.cgi?id=61418
+
+        * heap/MarkStack.h:
+        (JSC::MarkSet::MarkSet):
+        (JSC::MarkStack::append):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSArray.h:
+        (JSC::JSArray::visitChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/WriteBarrier.h:
+        (JSC::MarkStack::appendValues):
+
+2011-05-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make allocations with guard pages ensure that the allocation succeeded
+        https://bugs.webkit.org/show_bug.cgi?id=61453
+
+        Add null checks, and make PageBlock's operator bool() use
+        the realbase, rather than the start of usable memory.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+        * wtf/PageBlock.h:
+        (WTF::PageBlock::operator bool):
+        (WTF::PageBlock::PageBlock):
+
+2011-04-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Add JS_EXPORT_PRIVATE macro for exported methods in bytecompiler headers.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * bytecompiler/BytecodeGenerator.h:
+
+2011-05-24  Keishi Hattori  <keishi@webkit.org>
+
+        Reviewed by Kent Tamura.
+
+        Disable textfield implementation of <input type=color>. Add INPUT_COLOR feature flag. Add input color sanitizer.
+        https://bugs.webkit.org/show_bug.cgi?id=61273
+
+        * Configurations/FeatureDefines.xcconfig: Added COLOR_INPUT feature flag.
+
+2011-05-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Eric Seidel.
+
+        Add export macros to WTFString.h.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+        (WTF::String::findIgnoringCase):
+        (WTF::String::isHashTableDeletedValue):
+
+2011-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe fix the Mac build now?
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe fix the Mac build?
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Split HeapRootVisitor into its own class
+        https://bugs.webkit.org/show_bug.cgi?id=61399
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/HandleHeap.cpp:
+        * heap/HandleStack.cpp:
+        * heap/Heap.cpp:
+        * heap/HeapRootVisitor.h: Copied from Source/JavaScriptCore/heap/MarkStack.h.
+        * heap/MarkStack.h:
+        * runtime/ArgList.cpp:
+        * runtime/SmallStrings.cpp:
+
+2011-05-24  Jay Civelli  <jcivelli@chromium.org>
+
+        Rubberstamped by David Kilzer.
+
+        Updated some files that I forgot in my previous MHTML CL.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix the Mac build: Yes, please do remove these files, svn.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Let's just have one way to get the system page size, bokay?
+        https://bugs.webkit.org/show_bug.cgi?id=61384
+
+        * CMakeListsEfl.txt:
+        * CMakeListsWinCE.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: MarkStack[Platform].cpp
+        is gone completely now, since it only existed to provide a duplicate way
+        to access the system page size.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::reset):
+        * heap/MarkStack.h:
+        (JSC::::MarkStackArray):
+        (JSC::::shrinkAllocation): Use WTF::pageSize.
+
+        * heap/MarkStackPosix.cpp:
+        * heap/MarkStackSymbian.cpp:
+        * heap/MarkStackWin.cpp: Removed now-empty files.
+
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::reprotectRegion):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Use WTF::pageSize.
+
+        * wscript: Removed now-empty files.
+
+        * wtf/PageBlock.cpp:
+        (WTF::systemPageSize): Integrated questionable Symbian page size rule
+        from ExecutableAllocator, because that seems like what the original
+        author should have done.
+
+2011-05-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Interpreter crashes with gc validation enabled due to failure to mark initial cache structure
+        https://bugs.webkit.org/show_bug.cgi?id=61385
+
+        The interpreter uses the structure slot of get_by_id and put_by_id to hold
+        the initial structure it encountered so that it can identify whether a
+        given access is stable.
+
+        When marking though we only visit the slot when we've decided to cache, and
+        so this value could die.  This was "safe" as the value was only used for a
+        pointer compare, but it was incorrect.  We now just mark the slot like we
+        should have been doing already.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitStructures):
+
+2011-05-24  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed now-inline functions.
+
+2011-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: update the #if OS(WINDOWS) section to match my last patch.
+
+        * heap/MarkStack.h:
+        (JSC::::shrinkAllocation):
+
+2011-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Split out function definitions and class definitions from class
+        declarations in MarkStack.h, for readability.
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::~MarkStack):
+        (JSC::MarkStack::addOpaqueRoot):
+        (JSC::MarkStack::containsOpaqueRoot):
+        (JSC::MarkStack::opaqueRootCount):
+        (JSC::MarkSet::MarkSet):
+        (JSC::MarkStack::allocateStack):
+        (JSC::MarkStack::releaseStack):
+        (JSC::MarkStack::pageSize):
+        (JSC::::MarkStackArray):
+        (JSC::::~MarkStackArray):
+        (JSC::::expand):
+        (JSC::::append):
+        (JSC::::removeLast):
+        (JSC::::last):
+        (JSC::::isEmpty):
+        (JSC::::size):
+        (JSC::::shrinkAllocation):
+
+2011-05-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Avoid creating unnecessary identifiers and strings in the syntax checker
+        https://bugs.webkit.org/show_bug.cgi?id=61378
+
+        Selectively tell the lexer that there are some places it does not need to
+        do the real work of creating Identifiers for IDENT and STRING tokens.
+
+        Make parseString and parseIdentifier templatized on whether they should
+        do real work, or merely validate the tokens.
+
+        SunSpider --parse-only reports ~5-8% win depending on hardware.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createDotAccess):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::consume):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseExpression):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseConditionalExpression):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseProperty):
+        (JSC::JSParser::parseObjectLiteral):
+        (JSC::JSParser::parseArrayLiteral):
+        (JSC::JSParser::parseArguments):
+        (JSC::JSParser::parseMemberExpression):
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseIdentifier):
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createProperty):
+
+2011-05-23  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Safari often freezes when clicking "Return free memory" in Caches dialog
+        https://bugs.webkit.org/show_bug.cgi?id=61325
+
+        There are two fixes and improvement in instrumentation code used to find 
+        one of the problems.
+        Changed ReleaseFreeList() to set the "decommitted" bit when releasing
+        pages to the system and moving Spans from the normal list to the returned 
+        list.
+        Added a "not making forward progress" check to TCMalloc_PageHeap::scavenge
+        to eliminate an infinite loop if we can't meet the pagesToRelease target.
+        Added a check for the decommitted bit being set properly in 
+        TCMalloc_PageHeap::CheckList.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::scavenge):
+        (WTF::TCMalloc_PageHeap::Check):
+        (WTF::TCMalloc_PageHeap::CheckList):
+        (WTF::ReleaseFreeList):
+
+2011-05-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=61306
+
+        The begin characters optimization currently has issues (#61129),
+        and does not appear to still be a performance win. The prudent
+        next step seems to be to disable while we ascertain whether this
+        is still a useful performance optimization.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPattern::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::YarrPattern::reset):
+
+2011-05-23  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Remove safeFloatToInt() in FloatRect.cpp and replace with working version of clampToInteger()
+        https://bugs.webkit.org/show_bug.cgi?id=58216
+
+        * wtf/MathExtras.h:
+        (clampToInteger):
+        (clampToPositiveInteger):
+
+2011-05-23  Ruben  <chromium@hybridsource.org>
+
+        Reviewed by Tony Chang.
+
+        Chromium gyp patch to use new POSIX defines toolkit_uses_gtk and os_posix
+        https://bugs.webkit.org/show_bug.cgi?id=61219
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-05-23  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [SH4] AssemblerLabel does not name a type
+        https://bugs.webkit.org/show_bug.cgi?id=59927
+
+        SH4Assembler.h file shoold be included before AbstractMacroAssembler.h.
+
+        * assembler/MacroAssemblerSH4.h:
+
+2011-05-23  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Rubber stamped by Eric Seidel.
+
+        [CMAKE] Refactoring wtf related code.
+        https://bugs.webkit.org/show_bug.cgi?id=60146
+
+        Move wtf-files to Source/JavaScriptCore/wtf/CMakeLists.txt.
+
+        * CMakeLists.txt:
+        * CMakeListsEfl.txt:
+        * wtf/CMakeLists.txt:
+        * wtf/CMakeListsEfl.txt:
+
+2011-05-22  Adam Barth  <abarth@webkit.org>
+
+        Enable strict PassOwnPtr for everyone.  I expect this patch will need
+        some followups to make the GTK and EFL bots green again.
+
+        * wtf/PassOwnPtr.h:
+
+2011-05-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Reduce size of inline cache path of get_by_id on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=61221
+
+        This reduces the code size of get_by_id by 20 bytes
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ldrCompact):
+        (JSC::ARMv7Assembler::repatchCompact):
+        (JSC::ARMv7Assembler::setUInt7ForLoad):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
+        * jit/JIT.h:
+
+2011-05-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Zombies should "live" forever
+        https://bugs.webkit.org/show_bug.cgi?id=61170
+
+        Reusing zombie cells could still hide garbage
+        collected cell related bugs.
+
+        * JavaScriptCore.pro:
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::clearMarks):
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::isZombie):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::~JSZombie):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+
+2011-05-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/9472883> and https://bugs.webkit.org/show_bug.cgi?id=61203
+        Horrendous bug in callOnMainThreadAndWait
+
+        * wtf/MainThread.cpp:
+        (WTF::dispatchFunctionsFromMainThread): Before signaling the background thread with the
+          syncFlag condition, reacquire the mutex first.
+
+2011-05-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove unnecessary double->int conversion at the end of op_div
+        https://bugs.webkit.org/show_bug.cgi?id=61198
+
+        We don't attempt this conversion on 64bit, removing it actually speeds
+        up sunspider and v8 slightly, and it reduces code size.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_div):
+
+2011-05-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] remove <(library) variable
+        https://bugs.webkit.org/show_bug.cgi?id=61158
+
+        This was for a build experiment; we can just use the correct value now.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-05-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Interpreter uses wrong bytecode offset for determining exception handler
+        https://bugs.webkit.org/show_bug.cgi?id=61191
+
+        The bytecode offset given for the returnPC from the JIT is
+        actually the offset for the start of the instruction triggering
+        the call, whereas in the interpreter it is the actual return
+        VPC.  This means if the next instruction following a call was
+        in an exception region we would incorrectly redirect to its
+        handler.  Long term we want to completely redo how exceptions
+        are handled anyway so the simplest and lowest risk fix here is
+        to simply subtract one from the return vPC so that we have an
+        offset in the triggering instruction.
+
+        It turns out this is caught by a couple of tests already.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+
+2011-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        JIT requires VM overcommit (particularly on x86-64), Linux does not by default support this without swap?
+        https://bugs.webkit.org/show_bug.cgi?id=42756
+
+        Use the MAP_NORESERVE flag for mmap on Linux to skip the kernel
+        check of the available memory. This should give us an
+        overcommit-like behavior in most systems, which is what we want.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit): pass MAP_NORSERVE to mmap.
+
+2011-05-19  Gabor Loki  <loki@webkit.org>
+
+        Fix ARM build after r86919
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::nop):
+
+2011-05-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Randomise code starting location a little
+        https://bugs.webkit.org/show_bug.cgi?id=61161
+
+        Add a nop() function to the Assemblers so that we
+        can randomise code offsets slightly at no real cost.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::nop):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::nop):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::nop):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::nop):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::nop):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::nop):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::nop):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::nop):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * runtime/WeakRandom.h:
+        (JSC::WeakRandom::getUint32):
+
+2011-05-19  Oliver Hunt  <oliver@apple.com>
+
+        Fix windows build.
+
+        * wtf/OSAllocatorWin.cpp:
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::reserveAndCommit):
+
+2011-05-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add guard pages to each end of the memory region used by the fixedvm allocator
+        https://bugs.webkit.org/show_bug.cgi?id=61150
+
+        Add mechanism to notify the OSAllocator that pages at either end of an
+        allocation should be considered guard pages.  Update PageReservation,
+        PageAllocation, etc to handle this.
+
+        * JavaScriptCore.exp:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * wtf/OSAllocator.h:
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::reserveAndCommit):
+        * wtf/PageAllocation.h:
+        (WTF::PageAllocation::PageAllocation):
+        * wtf/PageAllocationAligned.h:
+        (WTF::PageAllocationAligned::PageAllocationAligned):
+        * wtf/PageBlock.h:
+        (WTF::PageBlock::PageBlock):
+        * wtf/PageReservation.h:
+        (WTF::PageReservation::reserve):
+        (WTF::PageReservation::reserveWithGuardPages):
+            Add a new function to make a reservation that will add guard
+            pages to the ends of an allocation.
+        (WTF::PageReservation::PageReservation):
+
+2011-05-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Executables release their JIT code as soon as they become dead
+        https://bugs.webkit.org/show_bug.cgi?id=61134
+
+        Add an ability to clear an Executable's jit code without requiring
+        it to be destroyed, and then call that from a finalizer.
+
+        * heap/Weak.h:
+        (JSC::Weak::Weak):
+        (JSC::Weak::leak):
+        * jit/JITCode.h:
+        (JSC::JITCode::clear):
+        * runtime/Executable.cpp:
+        (JSC::ExecutableFinalizer::finalize):
+        (JSC::ExecutableBase::executableFinalizer):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::clearExecutableCode):
+
+2011-05-19  Adam Roben  <aroben@apple.com>
+
+        Remove a redundant and broken data export
+
+        Data can't be exported from JavaScriptCore.dll by listing it in the .def file. The
+        JS_EXPORTDATA macro must be used instead. (In this case it was already being used, leading
+        to a linker warning about multiple definitions.)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed JSGlobalData::s_info.
+
+2011-05-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Some tests crashing in JSC::MarkStack::validateValue beneath ScriptController::clearWindowShell on SnowLeopard Intel Release (WebKit2 Tests)
+        https://bugs.webkit.org/show_bug.cgi?id=61064
+
+        Switch NonFinalObject to using WriteBarrier<> rather than WriteBarrierBase<>
+        for its inline storage.  This resolves the problem of GC occurring before
+        a subclass has initialised its anonymous storage.
+
+        * runtime/JSObject.h:
+
+2011-05-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Delete WTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=61084
+
+        It's been a year and we've failed to complete this project.  It's time
+        to throw in the towel.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url: Removed.
+        * wtf/url/api: Removed.
+        * wtf/url/api/ParsedURL.cpp: Removed.
+        * wtf/url/api/ParsedURL.h: Removed.
+        * wtf/url/api/URLString.h: Removed.
+        * wtf/url/src: Removed.
+        * wtf/url/src/RawURLBuffer.h: Removed.
+        * wtf/url/src/URLBuffer.h: Removed.
+        * wtf/url/src/URLCharacterTypes.cpp: Removed.
+        * wtf/url/src/URLCharacterTypes.h: Removed.
+        * wtf/url/src/URLComponent.h: Removed.
+        * wtf/url/src/URLEscape.cpp: Removed.
+        * wtf/url/src/URLEscape.h: Removed.
+        * wtf/url/src/URLParser.h: Removed.
+        * wtf/url/src/URLQueryCanonicalizer.h: Removed.
+        * wtf/url/src/URLSegments.cpp: Removed.
+        * wtf/url/src/URLSegments.h: Removed.
+        * wtf/url/wtfurl.gyp: Removed.
+
+2011-05-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        JSGlobalObject and some others do GC allocation during initialization, which can cause heap corruption
+        https://bugs.webkit.org/show_bug.cgi?id=61090
+
+        Remove the Structure-free JSGlobalObject constructor and instead always
+        pass the structure into the JSGlobalObject constructor.
+        Stop DebuggerActivation creating a new structure every time, and simply
+        use a single shared structure held by the GlobalData.
+
+        * API/JSContextRef.cpp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionRun):
+        (jscmain):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::clearBuiltinStructures):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+
+2011-05-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Disable gc validation in release builds
+        https://bugs.webkit.org/show_bug.cgi?id=60680
+
+        Add back the NDEBUG check
+
+        * wtf/Platform.h:
+
+2011-05-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out attempts to fix EFL build because they're not enough -- the
+        build script needs to be fixed.
+
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/ErrorPrototype.cpp:
+
+2011-05-17  Geoffrey Garen  <ggaren@apple.com>
+
+        More attempts to work around the EFL build system being borken.
+
+        * runtime/DateConstructor.cpp:
+        * runtime/ErrorPrototype.cpp:
+
+2011-05-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the EFL build.
+
+        * runtime/BooleanPrototype.cpp:
+
+2011-05-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolling back in r86653 with build fixed.
+
+        Reviewed by Gavin Barraclough and Oliver Hunt.
+
+        Global object initialization is expensive
+        https://bugs.webkit.org/show_bug.cgi?id=60933
+        
+        Changed a bunch of globals to allocate their properties lazily, and changed
+        the global object to allocate a bunch of its globals lazily.
+        
+        This reduces the footprint of a global object from 287 objects with 58
+        functions for 24K to 173 objects with 20 functions for 15K.
+
+        Large patch, but it's all mechanical.
+
+        * DerivedSources.make:
+        * JavaScriptCore.exp: Build!
+
+        * create_hash_table: Added a special case for fromCharCode, since it uses
+        a custom "thunk generator".
+
+        * heap/Heap.cpp:
+        (JSC::TypeCounter::operator()): Fixed a bug where the type counter would
+        overcount objects that were owned through more than one mechanism because
+        it was getting in the way of counting the results for this patch.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::arrayConstructorTable):
+        (JSC::ExecState::arrayPrototypeTable):
+        (JSC::ExecState::booleanPrototypeTable):
+        (JSC::ExecState::dateConstructorTable):
+        (JSC::ExecState::errorPrototypeTable):
+        (JSC::ExecState::globalObjectTable):
+        (JSC::ExecState::numberConstructorTable):
+        (JSC::ExecState::numberPrototypeTable):
+        (JSC::ExecState::objectPrototypeTable):
+        (JSC::ExecState::regExpPrototypeTable):
+        (JSC::ExecState::stringConstructorTable): Added new tables.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        (JSC::ArrayConstructor::getOwnPropertyDescriptor):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::createStructure):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        (JSC::BooleanPrototype::getOwnPropertyDescriptor):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::createStructure):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::DateConstructor::getOwnPropertySlot):
+        (JSC::DateConstructor::getOwnPropertyDescriptor):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::createStructure):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        (JSC::ErrorPrototype::getOwnPropertyDescriptor):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::createStructure): Standardized these objects
+        to use static tables for function properties.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h: Added new tables.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSGlobalObjectFunctions.h: Changed JSGlobalObject to use a
+        static table for its global functions. This required uninlining some
+        things to avoid a circular header dependency. However, those things
+        probably shouldn't have been inlined in the first place.
+        
+        Even more global object properties can be made lazy, but that requires
+        more in-depth changes.
+
+        * runtime/MathObject.cpp:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        (JSC::NumberPrototype::getOwnPropertyDescriptor):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::createStructure):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        (JSC::ObjectPrototype::put):
+        (JSC::ObjectPrototype::getOwnPropertySlot):
+        (JSC::ObjectPrototype::getOwnPropertyDescriptor):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::createStructure):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        (JSC::RegExpPrototype::getOwnPropertyDescriptor):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::createStructure):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        (JSC::StringConstructor::getOwnPropertySlot):
+        (JSC::StringConstructor::getOwnPropertyDescriptor):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::createStructure): Standardized these objects
+        to use static tables for function properties.
+
+2011-05-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        JSGlobalContextRelease should not trigger a synchronous garbage collection
+        https://bugs.webkit.org/show_bug.cgi?id=60990
+
+        * API/JSContextRef.cpp:
+        Change synchronous call to collectAllGarbage to a call to trigger the
+        activityCallback.
+
+2011-05-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Reduce code size for inline cache
+        https://bugs.webkit.org/show_bug.cgi?id=60942
+
+        This patch introduces the concept of a "compact" address that
+        allows individual architectures to control the maximum offset
+        used for the inline path of get_by_id.  This reduces the code
+        size of get_by_id by 3 bytes on x86 and x86_64 and slightly
+        improves performance on v8 tests.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::repatchCompact):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::repatchCompact):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::DataLabelCompact::DataLabelCompact):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        (JSC::AbstractMacroAssembler::repatchCompact):
+        * assembler/CodeLocation.h:
+        (JSC::CodeLocationDataLabelCompact::CodeLocationDataLabelCompact):
+        (JSC::CodeLocationCommon::dataLabelCompactAtOffset):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::locationOf):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::repatchCompact):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::loadPtrWithCompactAddressOffsetPatch):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load32WithCompactAddressOffsetPatch):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load32WithAddressOffsetPatch):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::repatchCompact):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::loadCompactWithAddressOffsetPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::loadPtrWithCompactAddressOffsetPatch):
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::repatch):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::repatchCompact):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_mr_disp8):
+        (JSC::X86Assembler::movq_mr_disp8):
+        (JSC::X86Assembler::repatchCompact):
+        (JSC::X86Assembler::setInt8):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp_disp8):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64_disp8):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::patchGetByIdSelf):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::patchGetByIdSelf):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+
+2011-05-16  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r86653.
+        http://trac.webkit.org/changeset/86653
+        https://bugs.webkit.org/show_bug.cgi?id=60944
+
+        "Caused regressions on Windows, OSX and EFL" (Requested by
+        yutak on #webkit).
+
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * create_hash_table:
+        * heap/Heap.cpp:
+        (JSC::TypeCounter::operator()):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::arrayTable):
+        (JSC::ExecState::numberTable):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addStaticGlobals):
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/MathObject.cpp:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        (JSC::ObjectPrototype::put):
+        (JSC::ObjectPrototype::getOwnPropertySlot):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+
+2011-05-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Global object initialization is expensive
+        https://bugs.webkit.org/show_bug.cgi?id=60933
+        
+        Changed a bunch of globals to allocate their properties lazily, and changed
+        the global object to allocate a bunch of its globals lazily.
+        
+        This reduces the footprint of a global object from 287 objects with 58
+        functions for 24K to 173 objects with 20 functions for 15K.
+
+        Large patch, but it's all mechanical.
+
+        * DerivedSources.make:
+        * JavaScriptCore.exp: Build!
+
+        * create_hash_table: Added a special case for fromCharCode, since it uses
+        a custom "thunk generator".
+
+        * heap/Heap.cpp:
+        (JSC::TypeCounter::operator()): Fixed a bug where the type counter would
+        overcount objects that were owned through more than one mechanism because
+        it was getting in the way of counting the results for this patch.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::arrayConstructorTable):
+        (JSC::ExecState::arrayPrototypeTable):
+        (JSC::ExecState::booleanPrototypeTable):
+        (JSC::ExecState::dateConstructorTable):
+        (JSC::ExecState::errorPrototypeTable):
+        (JSC::ExecState::globalObjectTable):
+        (JSC::ExecState::numberConstructorTable):
+        (JSC::ExecState::numberPrototypeTable):
+        (JSC::ExecState::objectPrototypeTable):
+        (JSC::ExecState::regExpPrototypeTable):
+        (JSC::ExecState::stringConstructorTable): Added new tables.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        (JSC::ArrayConstructor::getOwnPropertyDescriptor):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::createStructure):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        (JSC::ArrayPrototype::getOwnPropertyDescriptor):
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        (JSC::BooleanPrototype::getOwnPropertyDescriptor):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::createStructure):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::DateConstructor::getOwnPropertySlot):
+        (JSC::DateConstructor::getOwnPropertyDescriptor):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::createStructure):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        (JSC::ErrorPrototype::getOwnPropertyDescriptor):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::createStructure): Standardized these objects
+        to use static tables for function properties.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h: Added new tables.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSGlobalObjectFunctions.h: Changed JSGlobalObject to use a
+        static table for its global functions. This required uninlining some
+        things to avoid a circular header dependency. However, those things
+        probably shouldn't have been inlined in the first place.
+        
+        Even more global object properties can be made lazy, but that requires
+        more in-depth changes.
+
+        * runtime/MathObject.cpp:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        (JSC::NumberConstructor::getOwnPropertyDescriptor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        (JSC::NumberPrototype::getOwnPropertyDescriptor):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::createStructure):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        (JSC::ObjectPrototype::put):
+        (JSC::ObjectPrototype::getOwnPropertySlot):
+        (JSC::ObjectPrototype::getOwnPropertyDescriptor):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::createStructure):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        (JSC::RegExpPrototype::getOwnPropertyDescriptor):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::createStructure):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        (JSC::StringConstructor::getOwnPropertySlot):
+        (JSC::StringConstructor::getOwnPropertyDescriptor):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::createStructure): Standardized these objects
+        to use static tables for function properties.
+
+2011-05-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/60913> C++ exceptions should not be enabled when building with llvm-gcc-4.2
+        <rdar://problem/9446430>
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Fixed typo.
+
+2011-05-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        JSWeakObjectMap finalisation may occur while gc is in inconsistent state
+        https://bugs.webkit.org/show_bug.cgi?id=60908
+        <rdar://problem/9409491>
+
+        We need to ensure that we have called all the weak map finalizers while
+        the global object (and hence global context) is still in a consistent
+        state.  The best way to achieve this is to simply use a weak handle and
+        finalizer on the global object.
+
+        * JavaScriptCore.exp:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::WeakMapFinalizer::finalize):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::registerWeakMap):
+
+2011-05-16  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][WK2][Symbian] Shared memory implementation for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=55875
+
+        * wtf/Platform.h: Exclude Symbian OS from USE(UNIX_DOMAIN_SOCKETS) users
+
+2011-05-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=60866
+        Evaluation order broken for empty alternatives in subpatterns
+
+        Reverting https://bugs.webkit.org/show_bug.cgi?id=51395
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
+
+2011-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen & Michael Saboff.
+
+        https://bugs.webkit.org/show_bug.cgi?id=60860
+        Simplify backtracking in YARR JIT
+
+        YARR JIT currently performs a single pass of code generation over the pattern,
+        with special handling to allow the code generation for some backtracking code
+        out of line. We can simplify things by moving to a common mechanism whereby all
+        forwards matching code is generated in one pass, and all backtracking code is
+        generated in another. Backtracking code can be generated in reverse order, to
+        optimized the common fall-through case.
+
+        To make it easier to walk over the pattern, we can first convert to a more
+        byte-code like format before JIT generating. In time we should unify this with
+        the YARR interpreter to more closely unify the two.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::jumpIfNoAvailableInput):
+        (JSC::Yarr::YarrGenerator::YarrOp::YarrOp):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::BacktrackingState):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::append):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::fallthrough):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::link):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::linkTo):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::takeBacktracksToJumpList):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::isEmpty):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::linkDataLabels):
+        (JSC::Yarr::YarrGenerator::BacktrackingState::ReturnAddressRecord::ReturnAddressRecord):
+        (JSC::Yarr::YarrGenerator::generateAssertionBOL):
+        (JSC::Yarr::YarrGenerator::backtrackAssertionBOL):
+        (JSC::Yarr::YarrGenerator::generateAssertionEOL):
+        (JSC::Yarr::YarrGenerator::backtrackAssertionEOL):
+        (JSC::Yarr::YarrGenerator::matchAssertionWordchar):
+        (JSC::Yarr::YarrGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::YarrGenerator::backtrackAssertionWordBoundary):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassOnce):
+        (JSC::Yarr::YarrGenerator::backtrackCharacterClassOnce):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::backtrackCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateTerm):
+        (JSC::Yarr::YarrGenerator::backtrackTerm):
+        (JSC::Yarr::YarrGenerator::generate):
+        (JSC::Yarr::YarrGenerator::backtrack):
+        (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
+        (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
+        (JSC::Yarr::YarrGenerator::opCompileAlternative):
+        (JSC::Yarr::YarrGenerator::opCompileBody):
+        (JSC::Yarr::YarrGenerator::YarrGenerator):
+        (JSC::Yarr::YarrGenerator::compile):
+
+2011-05-15  Adam Barth  <abarth@webkit.org>
+
+        Enable strict PassOwnPtr on Qt.  (Build fixes to follow.)
+
+        * wtf/PassOwnPtr.h:
+
+2011-05-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Partial fix for <rdar://problem/9417875> REGRESSION: SunSpider ~17% slower
+        in browser than on command line
+        
+        This patch fixes a few issues in generated code that could unreasonably
+        prolong object lifetimes.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage): Throw away all function code before doing
+        a major collection. We want to clear polymorphic caches, since they can
+        keep alive large object graphs that have gone "stale". For the same reason,
+        but to a lesser extent, we also want to clear linked functions and other
+        one-off caches.
+
+        This has the side-benefit of reducing memory footprint from run-once
+        functions, and of allowing predictions and caches that have failed to
+        re-specialize.
+
+        Eventually, if compilation costs rise far enough, we may want a more
+        limited strategy for de-specializing code without throwing it away
+        completely, but this works for now, and it's the simplest solution.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * runtime/JSFunction.cpp: Made the host function stub cache weak --
+        otherwise it's effectively a memory leak that can seriously fragment the
+        GC and JIT heaps.
+
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::visitChildren): Cleared up some comments that confused
+        me when working with this code.
+
+2011-05-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make GC validation more aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=60802
+
+        This patch makes the checks performed under GC_VALIDATION
+        much more aggressive, and adds the checks to more places
+        in order to allow us to catch GC bugs much closer to the
+        point of failure.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::visitChildren):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedSpace.cpp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/GetterSetter.h:
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildren):
+        * runtime/JSCell.cpp:
+        (JSC::slowValidateCell):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::unvalidatedStructure):
+        (JSC::JSCell::JSCell::JSCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::slowValidateCell):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::visitChildren):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildren):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::visitChildren):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC::JSCell::classInfo):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureChain.h:
+        * runtime/WriteBarrier.h:
+        (JSC::validateCell):
+        (JSC::JSCell):
+        (JSC::JSGlobalObject):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::setMayBeNull):
+        (JSC::WriteBarrierBase::setEarlyValue):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::unvalidatedGet):
+        (JSC::WriteBarrier::WriteBarrier):
+        * wtf/Assertions.h:
+
+2011-05-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make GC validation more aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=60802
+
+        This patch makes the checks performed under GC_VALIDATION
+        much more aggressive, and adds the checks to more places
+        in order to allow us to catch GC bugs much closer to the
+        point of failure.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::visitChildren):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedSpace.cpp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/GetterSetter.h:
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildren):
+        * runtime/JSCell.cpp:
+        (JSC::slowValidateCell):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::unvalidatedStructure):
+        (JSC::JSCell::JSCell::JSCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::slowValidateCell):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::visitChildren):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildren):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::visitChildren):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC::JSCell::classInfo):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureChain.h:
+        * runtime/WriteBarrier.h:
+        (JSC::validateCell):
+        (JSC::JSCell):
+        (JSC::JSGlobalObject):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::setMayBeNull):
+        (JSC::WriteBarrierBase::setEarlyValue):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::unvalidatedGet):
+        (JSC::WriteBarrier::WriteBarrier):
+        * wtf/Assertions.h:
+
+2011-05-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r86469 and r86471, because they made hundreds tests crash on Qt.
+
+        Make GC validation more aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=60802
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::visitChildren):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedSpace.cpp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildren):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::JSCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::visitChildren):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildren):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::visitChildren):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC::Structure::createStructure):
+        (JSC::JSCell::classInfo):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureChain.h:
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrier::WriteBarrier):
+        * wtf/Assertions.h:
+
+2011-05-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make GC validation more aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=60802
+
+        This patch makes the checks performed under GC_VALIDATION
+        much more aggressive, and adds the checks to more places
+        in order to allow us to catch GC bugs much closer to the
+        point of failure.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::visitChildren):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedSpace.cpp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/GetterSetter.h:
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildren):
+        * runtime/JSCell.cpp:
+        (JSC::slowValidateCell):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::unvalidatedStructure):
+        (JSC::JSCell::JSCell::JSCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::slowValidateCell):
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::visitChildren):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildren):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::visitChildren):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC::JSCell::classInfo):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureChain.h:
+        * runtime/WriteBarrier.h:
+        (JSC::validateCell):
+        (JSC::JSCell):
+        (JSC::JSGlobalObject):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::setMayBeNull):
+        (JSC::WriteBarrierBase::setEarlyValue):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::unvalidatedGet):
+        (JSC::WriteBarrier::WriteBarrier):
+        * wtf/Assertions.h:
+
+2011-05-01  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
+
+        Reviewed by Steve Block.
+
+        [android] OS(ANDROID) does not imply PLATFORM(ANDROID)
+        https://bugs.webkit.org/show_bug.cgi?id=59888
+
+        It is possible to build QtWebKit and others for OS(ANDROID). Let
+        the buildsystem decide which platform is to be build.
+
+        * wtf/Platform.h:
+
+2011-05-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        XMLDocumentParserLibxml2 should play nice with strict OwnPtrs
+        https://bugs.webkit.org/show_bug.cgi?id=59394
+
+        This portion of the change introduces a PassTraits template, which
+        is used to enable takeFirst() to work for a Deque holding OwnPtrs,
+        and optimize it for a Deque holding RefPtrs. In the future it can
+        be deployed elsewhere to make our data structures work better with
+        our smart pointers.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/Deque.h:
+        (WTF::::takeFirst):
+        * wtf/PassTraits.h: Added.
+        (WTF::PassTraits::transfer):
+
+2011-05-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Revert r86334, it broke the win build. WinCE build is fixed even without this patch. WinCairo remains broken atm, everything else works.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-05-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        String operator+ reallocates unnecessarily when concatting > 2 strings
+        https://bugs.webkit.org/show_bug.cgi?id=58420
+
+        Try to fix WinCE/WinCairo linking by exporting three symbols, not sure whether it's correct though. Win worked just fine before.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-05-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Darin Adler.
+
+        String operator+ reallocates unnecessarily when concatting > 2 strings
+        https://bugs.webkit.org/show_bug.cgi?id=58420
+
+        Provide a faster String append operator.
+        Up until now, "String operator+(const String& a, const String& b)" copied String a into a temporary
+        object, and used a.append(b), which reallocates a new buffer of aLength+bLength. When concatting
+        N strings using operator+, this leads to N-1 reallocations.
+
+        Replace this with a flexible operator+ implementation, that avoids these reallocations.
+        When concatting a 'String' with any string type (char*, UChar, Vector<char>, String, AtomicString, etc..)
+        a StringAppend<String, T> object is created, which holds the intermediate string objects, and delays
+        creation of the final string, until operator String() is invoked.
+
+        template<typename T>
+        StringAppend<String, T> operator+(const String& string1, T string2)
+        {
+            return StringAppend<String, T>(string1, string2);
+        }
+
+        template<typename U, typename V, typename W>
+        StringAppend<U, StringAppend<V, W> > operator+(U string1, const StringAppend<V, W>& string2)
+        {
+            return StringAppend<U, StringAppend<V, W> >(string1, string2);
+        }
+
+        When concatting three strings - "String a, b, c; String result = a + b + c;" following happens:
+        first a StringAppend<String, String> object is created by operator+(const String& string1, String string2).
+        Then operator+(String string1, const StringAppend<String, String>& string2) is invoked, which returns
+        a StringAppend<String, StringAppend<String, String> > object.
+        Then operator String() is invoked, which allocates a StringImpl object, once, large enough to hold the
+        final string - it uses tryMakeString provided by StringConcatenate.h under the hoods, which guards us
+        against too big string allocations, etc.
+
+        Note that the second template, defines a recursive way to concat an arbitary number of strings
+        into a single String with just one allocation.
+
+        * GNUmakefile.list.am: Add StringOperators.h to build.
+        * JavaScriptCore.exp: Export WTF::emptyString(). Remove no longer needed symbols.
+        * JavaScriptCore.gypi: Add StringOperators.h to build.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * wtf/text/AtomicString.h: Pull in StringConcatenate.h at the end of the file.
+        * wtf/text/StringConcatenate.h: Conditionally include AtomicString.h to avoid a cyclic dependency. Pull in StringOperators.h at the end of the file.
+        * wtf/text/StringOperators.h: Added. This is never meant to be included directly, including either WTFString.h or AtomicString.h automatically pulls in this file.
+        (WTF::StringAppend::StringAppend):
+        (WTF::StringAppend::operator String):
+        (WTF::StringAppend::operator AtomicString):
+        (WTF::StringAppend::writeTo):
+        (WTF::StringAppend::length):
+        (WTF::operator+):
+        * wtf/text/WTFString.cpp: Remove operator+ implementations that use String::append(). 
+        (WTF::emptyString): Add new shared empty string free function.
+        * wtf/text/WTFString.h: Replace operator+ implementations by StringAppend template solution. Pull in AtomicString.h at the end of the file.
+
+2011-05-12  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, GTK build fix.
+
+        * wtf/Platform.h:
+
+2011-05-12  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Arm debug build failing on ARMAssembler::debugOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=60688
+
+        Related to svn rev 85523
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::debugOffset):
+
+2011-05-11  Igor Oliveira  <igor.oliveira@openbossa.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit does not build with GCCE
+        https://bugs.webkit.org/show_bug.cgi?id=60667
+
+        Allow compile WebKit with GCCE
+
+        * wtf/Alignment.h:
+        * wtf/Platform.h:
+
+2011-05-11  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Enable strict PassOwnPtr on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=60684
+
+        This should build cleanly now.
+
+        * wtf/PassOwnPtr.h:
+
+2011-05-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Protect JSC from WebCore executing JS during JS wrapper finalization
+        https://bugs.webkit.org/show_bug.cgi?id=60672
+        <rdar://problem/9350997>
+
+        Detect when we're trying to execute JS during GC and prevent the
+        execution from happening.  We also assert that this isn't happening
+        as it implies incorrect behaviour of an object's destructor.
+
+        * JavaScriptCore.exp:
+        * heap/Heap.cpp:
+        * heap/Heap.h:
+        (JSC::Heap::isBusy):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::isCollectorBusy):
+
+2011-05-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable gc mark validation in temporarily in release builds
+        https://bugs.webkit.org/show_bug.cgi?id=60678
+
+        Make it easier to turn the gc mark validation on and off, and
+        temporarily turn it on for all builds.
+
+        * heap/MarkStack.cpp:
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::internalAppend):
+        * runtime/WriteBarrier.h:
+        (JSC::MarkStack::appendValues):
+        * wtf/Platform.h:
+
+2011-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/9331651> REGRESSION: RPRVT grows by 1MB / sec @ dvd2blu.com
+        
+        SunSpider reports no change.
+
+        This bug was caused by changing Structure and Executable to being GC
+        objects, and by a long-standing bug that would thrash the global object
+        between dictionary and non-dictionary states.
+
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer): Don't
+        eagerly transition to dictionary -- this can cause pathological dictionary
+        churn, and it's not necessary, since objects know how to automatically
+        transition to dictionary when necessary.
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal): Be sure to report
+        extra cost from compilation, because it can be quite high. This is especially
+        important for program code, since DOM timers can repeatedly allocate
+        program code without allocating any other objects.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect): Don't transition to the uncacheable state
+        if the thing we're trying to remove doesn't exist. This can happen during
+        compilation, since the compiler needs to ensure that no pre-existing
+        conflicting definitions exist for certain declarations.
+
+2011-05-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make mark stack validation functions do something useful in a release build
+        https://bugs.webkit.org/show_bug.cgi?id=60645
+
+        Turn ASSERTs into actual if(...) CRASH(); statements.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::validateValue):
+
+2011-05-11  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Fix copy&paste error in comment.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator): the value is stored in
+        regT2, not regT1.
+
+2011-05-11  Adam Roben  <aroben@apple.com>
+
+        WinCE build fixes for strict PassOwnPtr
+
+        * wtf/unicode/CollatorDefault.cpp:
+        (WTF::Collator::userDefault): Use adoptPtr.
+
+2011-05-11  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
+
+        Unreviewed build fix.
+
+        [MIPS] Fix compilation of the MIPS JIT
+
+        Include the MIPSAssembler.h first to indirectly include
+        AssemblerBuffer.h before the AbstractMacroAssembler.h. This
+        order is used for the ARM and X86 MacroAssembler*.h
+
+        * assembler/MacroAssemblerMIPS.h:
+
+2011-05-11  Adam Roben  <aroben@apple.com>
+
+        Turn on strict PassOwnPtr on Windows
+
+        Fixes <http://webkit.org/b/60632> Windows should build with strict PassOwnPtr enabled
+
+        Reviewed by Adam Barth.
+
+        * wtf/PassOwnPtr.h:
+
+2011-05-10  Stephanie Lewis  <slewis@apple.com>
+
+        Unreviewed.
+
+        Revert accidental JavaScriptCore change in http://trac.webkit.org/changeset/86130
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2011-05-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Enable strict PassOwnPtr on Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=60502
+
+        Other platforms to follow.
+
+        * wtf/PassOwnPtr.h:
+
+2011-05-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed up some #include dependencies so the WriteBarrier class can actually call Heap::writeBarrier
+        https://bugs.webkit.org/show_bug.cgi?id=60532
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build!
+
+        * heap/Handle.h: Moved HandleTypes to its own header because that's the
+        WebKit style, and it was necessary to resolve a circular dependency
+        between Handle.h and WriteBarrier.h.
+
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier): Added an inline no-op writeBarrier(), to
+        verify that all the code is in the right place.
+
+        * heap/MarkStack.h: Moved WriteBarrier operations to WriteBarrier.h to
+        resolve a circular dependency.
+
+        * runtime/ArgList.h:
+        * runtime/JSCell.h: #include WriteBarrier.h since we don't get it for
+        free anymore.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::PropertyTable): Call the real writeBarrier()
+        function, now that it exists.
+
+        * runtime/SmallStrings.h: Removed a stray #include to resolve a circular
+        dependency.
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::set):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendValues): Updated to match the changes above.
+
+2011-05-10  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::validateValue):
+
+2011-05-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add some aggressive GC validation to debug builds.
+        https://bugs.webkit.org/show_bug.cgi?id=60601
+
+        When assertions are enabled we now do some validity checking
+        of objects being added to the mark stack.
+
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::PolymorphicStubInfo):
+        (JSC::PolymorphicAccessStructureList::visitAggregate):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::validateSet):
+        (JSC::MarkStack::validateValue):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::internalAppend):
+
+2011-05-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        http://bugs.webkit.org/show_bug.cgi?id=60509
+        Wrong type used for return value from strlen
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastStrDup): Use size_t. Also don't bother checking for failure since
+        fastMalloc won't return if it fails.
+
+2011-05-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CSP should block Function constructor
+        https://bugs.webkit.org/show_bug.cgi?id=60240
+
+        When eval is disabled, we need to block the use of the function
+        constructor.  However, the WebCore JSC bindings call the function
+        constructor directly to create inline event listeners.  To support that
+        use, this patch adds an entrypoint that bypasses the check for whether
+        eval is enabled.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+
+2011-05-09  Adam Roben  <aroben@apple.com>
+
+        Automatically touch WebKit.idl whenever any other WebKit1 IDL file changes
+
+        Fixes <http://webkit.org/b/60468> WebKit.idl needs to be manually touched whenever any other
+        WebKit1 IDL file changes to avoid build errors
+
+        Reviewed by Tim Hatcher.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        Updated for script rename.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/work-around-vs-dependency-tracking-bugs.py: Renamed
+        from react-to-vsprops-changes.py.
+        (top level): Moved a constant here from main.
+        (main): Moved most code from here to react_to_vsprops_changes. Added a call to the new
+        react_to_webkit1_interface_changes function.
+        (react_to_vsprops_changes): Moved code here from main. Updated to use the
+        TOP_LEVEL_DIRECTORY global. Moved some code from here to mtime_of_newest_file_matching_globa
+        and touch_if_older_than.
+        (react_to_webkit1_interface_changes): Added. Touches WebKit.idl if any other WebKit1 IDL
+        file has changed.
+        (mtime_of_newest_file_matching_glob): Added. Code came from main.
+        (touch_if_older_than): Added. Code came from main.
+
+2011-05-08  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make JSRetainPtr work with JSGlobalContextRefs.
+        https://bugs.webkit.org/show_bug.cgi?id=60452
+
+        Add specialized functions for JSRetain and JSRelease when dealing with JSGlobalContextRefs.
+
+        * API/JSRetainPtr.h:
+        (JSRetain):
+        (JSRelease):
+
+2011-05-07  Dawit Alemayehu  <adawit@kde.org>
+
+        Reviewed by Daniel Bates.
+
+        Fix compile with GCC 4.6.0
+        https://bugs.webkit.org/show_bug.cgi?id=60380
+
+        Remove unused local variable from code.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+
+2011-05-06  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Unreviewed build fix with gcc 4.6.0 on linux and c++0x support.
+
+        std::tr1::has_trivial_constructor is in <tr1/memory>.
+
+        * wtf/TypeTraits.h:
+
+2011-05-05  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added convenience methods to convert from a byte to hex ASCII digit
+        characters and vice-versa.
+        https://bugs.webkit.org/show_bug.cgi?id=59834
+
+        * wtf/ASCIICType.h:
+        (WTF::toASCIIHexValue):
+        (WTF::lowerNibbleToASCIIHexDigit):
+        (WTF::upperNibbleToASCIIHexDigit):
+
+2011-05-05  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Make QtWebKit build when using gcc 4.6.0
+        https://bugs.webkit.org/show_bug.cgi?id=60265
+
+        If QtWebKit is compiled with gcc 4.6.0 or later we don't want to deactivate
+        the c++0x support because it works.
+
+        * JavaScriptCore.pro:
+
+2011-05-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Geoffrey Garen.
+
+        Port MachineStackMarker.cpp to Windows x64
+        https://bugs.webkit.org/show_bug.cgi?id=60216
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::getPlatformThreadRegisters): the CONTEXT struct is usable also
+        on 64-bit Windows.
+        (JSC::otherThreadStackPointer): return the Rsp register on Windows x64.
+
+2011-05-04  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Martin Robinson.
+
+        Link libjavascriptcoregtk on Windows with winmm.dll
+        https://bugs.webkit.org/show_bug.cgi?id=60215
+
+        * GNUmakefile.am:
+
+2011-05-04  Tao Bai  <michaelbai@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Populate touch-icon url to FrameLoaderClient
+        https://bugs.webkit.org/show_bug.cgi?id=59143
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-05-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/9366557> Various crashes due to bad DFG codegen at canalplus.fr
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes): Removed a stray line of
+        code that accidentally survived the conversion to a switch statement,
+        causing a lot of important code not to run most of the time.
+
+        Since this is not a trivial finger-picking mistake, I will not call it a
+        typo.
+
+2011-05-04  Adam Roben  <aroben@apple.com>
+
+        Another attempted build fix
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::operator==):
+        (WTF::OwnPtr::operator!=):
+        * wtf/PassOwnPtr.h:
+        (WTF::PassOwnPtr::operator==):
+        (WTF::PassOwnPtr::operator!=):
+        Added a return statement. And made a tweak based on a suggestion from Anders Carlsson.
+
+2011-05-04  Adam Roben  <aroben@apple.com>
+
+        Try to fix Leopard, Qt, and probably others
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::operator==):
+        (WTF::OwnPtr::operator!=):
+        * wtf/PassOwnPtr.h:
+        (WTF::PassOwnPtr::operator==):
+        (WTF::PassOwnPtr::operator!=):
+        Try to get the compiler not to instantiate these function templates unnecessarily.
+
+2011-05-03  Adam Roben  <aroben@apple.com>
+
+        Disallow equality comparisons between [Pass]OwnPtrs
+
+        If you have two OwnPtrs that are equal, you've already lost. (Unless you're doing something
+        really sneaky, in which case you should stop!)
+
+        Fixes <http://webkit.org/b/60053> Testing OwnPtrs for equality should cause a compiler error
+
+        Reviewed by Anders Carlsson and Antti Koivisto.
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::operator==):
+        (WTF::OwnPtr::operator!=):
+        * wtf/PassOwnPtr.h:
+        (WTF::PassOwnPtr::operator==):
+        (WTF::PassOwnPtr::operator!=):
+        Added private equality operators that fail to compile when used. (When not used, the
+        compiler will skip over them because they are function templates.)
+
+2011-05-04  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Gavin Barraclough.
+
+        JITArithmetic.cpp produces a warning on a unused variable.
+        https://bugs.webkit.org/show_bug.cgi?id=60060
+
+        Just properly use what we already have converted.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+
+2011-05-04  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Geoffrey Garen.
+
+        JITPropertyAccess produces a unused but set variable warning in gcc 4.6.0.
+        https://bugs.webkit.org/show_bug.cgi?id=60050
+
+        This patch fix a compilation warning. The new warning scenario -Wunused-but-set-variable
+        in gcc 4.6.0 is included in -Wall and therefore stops the compilation when warnings are treated
+        as errors. The patch introduces a new macro ASSERT_JIT_OFFSET_UNUSED and ASSERT_WITH_MESSAGE_UNUSED
+        which copy the idea of ASSERT_UNUSED.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        * wtf/Assertions.h:
+        (assertWithMessageUnused):
+
+2011-04-29  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Implement FULLSCREEN_API on Windows, Part 4: Enable it
+        https://bugs.webkit.org/show_bug.cgi?id=59798
+
+        * wtf/Platform.h: Set ENABLE_FULLSCREEN_API on win.
+
+2011-05-03  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Eric Seidel.
+
+        Unused but set variable warning in MacroAssemberX86_64
+        https://bugs.webkit.org/show_bug.cgi?id=59482
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::tailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
+
+2011-05-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make malloc validation useful
+        https://bugs.webkit.org/show_bug.cgi?id=57502
+
+        Reland this patch (rolled out in 82905) without
+        turning it on by default.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::fastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::tryFastRealloc):
+        (WTF::fastRealloc):
+        (WTF::fastMallocSize):
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMallocStats::malloc):
+        (WTF::TCMallocStats::free):
+        (WTF::TCMallocStats::fastCalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::calloc):
+        (WTF::TCMallocStats::fastRealloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        (WTF::TCMallocStats::realloc):
+        (WTF::TCMallocStats::fastMallocSize):
+        * wtf/FastMalloc.h:
+        (WTF::Internal::fastMallocValidationHeader):
+        (WTF::Internal::fastMallocValidationSuffix):
+        (WTF::Internal::fastMallocMatchValidationType):
+        (WTF::Internal::setFastMallocMatchValidationType):
+        (WTF::fastMallocMatchValidateFree):
+        (WTF::fastMallocValidate):
+
+2011-05-03  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Anders Carlsson.
+
+        Compile error with GCC 4.6.0, tries to assign unsigned& to bitfield
+        https://bugs.webkit.org/show_bug.cgi?id=59261
+
+        Use unary '+' to force proper type detection in template arguments
+        with GCC 4.6.0. See bug report for more details.
+
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::remove): Use '+' to force precise type detection.
+        (JSC::StructureTransitionTable::add): ditto.
+        * runtime/Structure.h:
+        (JSC::StructureTransitionTable::keyForWeakGCMapFinalizer): ditto.
+
+2011-05-03  Jessie Berlin  <jberlin@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Revert r85550 and r85575.
+
+        Variables cannot be exported via the .def file. Instead, they should be annotated with
+        JS_EXPORTDATA.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        * runtime/Structure.h:
+        (JSC::Structure::typeInfo):
+        (JSC::Structure::previousID):
+        (JSC::Structure::propertyStorageCapacity):
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::get):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+
+2011-05-02  Adam Roben  <aroben@apple.com>
+
+        Allow implicit conversion from nullptr_t to PassOwnPtr
+
+        This makes it a lot easier to write code that just wants a null PassOwnPtr, especially in
+        strict PassOwnPtr mode.
+
+        Fixes <http://webkit.org/b/59964> Implicit conversion from std::nullptr_t to PassOwnPtr
+        doesn't work, but should
+
+        Reviewed by Adam Barth.
+
+        * wtf/PassOwnPtr.h:
+        (WTF::PassOwnPtr::PassOwnPtr): Added a non-explicit constructor that takes a nullptr_t.
+
+        * wtf/MessageQueue.h:
+        (WTF::::waitForMessageFilteredWithTimeout):
+        (WTF::::tryGetMessage):
+        Use the new implicit conversion.
+
+2011-05-02  Jessie Berlin  <jberlin@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove an assertion that Windows was hitting on launch.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        * runtime/Structure.h:
+        (JSC::Structure::typeInfo):
+        (JSC::Structure::previousID):
+        (JSC::Structure::propertyStorageCapacity):
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::get):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+
+2011-05-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/9371948> JavaScriptCore should build with GCC 4.2
+
+        * Configurations/CompilerVersion.xcconfig:
+
+2011-05-02  Gavin Barraclough  <barraclough@apple.com>
+
+        ARMv7 build fix.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+
+2011-05-02  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-05-02  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        crash in JSC::RegExp::match
+        https://bugs.webkit.org/show_bug.cgi?id=58922
+
+        Cleared chained backtrack data label when linking label even if that 
+        label doesn't chain itself.  This is needed so that subsequent 
+        backtrack data labels point to the next outer paren and not within 
+        the current paren.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::TermGenerationState::linkDataLabelToBacktrackIfExists):
+
+2011-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tiny bit of heap cleanup.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::contains): Tightened up an assertion and a comment.
+
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::globalData):
+        (JSC::MarkedSpace::highWaterMark):
+        (JSC::MarkedSpace::setHighWaterMark): Moved inlines out of the class
+        definition, for better clarity.
+
+2011-05-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Correct marking of interpreter data in mixed mode builds
+        https://bugs.webkit.org/show_bug.cgi?id=59962
+
+        We had a few places in mixed mode builds where we would not
+        track data used by the interpreter for marking.  This patch
+        corrects the problem and adds a number of assertions to catch
+        live Structures being collected.
+
+        * JavaScriptCore.exp:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::debugOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addStructureStubInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        * runtime/Structure.h:
+        (JSC::Structure::typeInfo):
+        (JSC::Structure::previousID):
+        (JSC::Structure::propertyStorageCapacity):
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::get):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+
+2011-05-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use native NullPtr when using GCC 4.6.0 and C++0x
+        https://bugs.webkit.org/show_bug.cgi?id=59252
+
+        GCC 4.6.0 has nullptr support, use it when possible.
+
+        * wtf/NullPtr.cpp: include config.h to pull in Platform.h before
+        NullPtr.h, since we need the GCC_VERSION_AT_LEAST definition.
+        * wtf/NullPtr.h: check for GCC >= 4.6.0 and C++0x in order to
+        use native nullptr.
+
+2011-05-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=59950
+        Clean up AssemblerBuffer to use a Vector internally.
+
+        AssemblerBuffer handles reallocing a byte array itself - stop that.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerLabel::AssemblerLabel):
+        (JSC::AssemblerLabel::labelAtOffset):
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::~AssemblerBuffer):
+        (JSC::AssemblerBuffer::isAvailable):
+        (JSC::AssemblerBuffer::ensureSpace):
+        (JSC::AssemblerBuffer::isAligned):
+        (JSC::AssemblerBuffer::putIntegral):
+        (JSC::AssemblerBuffer::putIntegralUnchecked):
+        (JSC::AssemblerBuffer::putByteUnchecked):
+        (JSC::AssemblerBuffer::putByte):
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putShort):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt):
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        (JSC::AssemblerBuffer::putInt64):
+        (JSC::AssemblerBuffer::codeSize):
+        (JSC::AssemblerBuffer::label):
+        (JSC::AssemblerBuffer::executableCopy):
+        (JSC::AssemblerBuffer::rewindToLabel):
+        (JSC::AssemblerBuffer::debugOffset):
+        (JSC::AssemblerBuffer::append):
+        (JSC::AssemblerBuffer::grow):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::linkCall):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::X86InstructionFormatter::rewindToLabel):
+
+2011-05-02  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Alexy Proskuryakov.
+
+        Avoid potential buffer overflow in WTFLog() and WTFLogVerbose()
+        https://bugs.webkit.org/show_bug.cgi?id=59949
+
+        * wtf/Assertions.cpp: Check for 0 or empty format string in WTFLog() and WTFLogVerbose().
+
+2011-05-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        StringImpl::endsWith has some insane code
+        https://bugs.webkit.org/show_bug.cgi?id=59900
+
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::endsWith):
+            - m_data shadows a member variable of the same name.
+
+2011-05-02  Gabor Loki  <loki@webkit.org>
+
+        Buildfix for ARM after r85448
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::loadBranchTarget):
+
+2011-05-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Strict-mode only reserved words not reserved
+        https://bugs.webkit.org/show_bug.cgi?id=55342
+
+        Fix line number tracking when we rollback the lexer.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseSourceElements):
+
+2011-05-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        ES5 Strict mode does not allow getter and setter for same propId
+        https://bugs.webkit.org/show_bug.cgi?id=57295
+
+        Simplify and correct the logic for strict mode object literals.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseStrictObjectLiteral):
+
+2011-05-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Assigning to function identifier under strict should throw
+        https://bugs.webkit.org/show_bug.cgi?id=59289
+
+        Add logic to StaticScopeObject to ensure we don't silently consume
+        writes to constant properties.
+
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+
+2011-05-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=59903
+        Use AssemblerLabel throughout Assembler classes, AssemblerBuffer
+
+        Creating a lable() into the AssemblerBuffer should return an AssemblerLabel,
+        not an unsigned int.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::label):
+        (JSC::ARMAssembler::loadBranchTarget):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::b):
+        (JSC::ARMv7Assembler::blx):
+        (JSC::ARMv7Assembler::bx):
+        (JSC::ARMv7Assembler::label):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::label):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::label):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::label):
+        (JSC::MIPSAssembler::relocateJumps):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::loadConstant):
+        (JSC::SH4Assembler::loadConstantUnReusable):
+        (JSC::SH4Assembler::call):
+        (JSC::SH4Assembler::jmp):
+        (JSC::SH4Assembler::jne):
+        (JSC::SH4Assembler::je):
+        (JSC::SH4Assembler::label):
+        (JSC::SH4Assembler::oneShortOp):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::call):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::X86InstructionFormatter::immediateRel32):
+        (JSC::X86Assembler::X86InstructionFormatter::label):
+
+2011-05-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Enable strict mode for OwnPtr and PassOwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=59428
+
+        * wtf/OwnPtr.h:
+
+2011-05-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Enable strict OwnPtr for PLATFORM(WIN)
+        https://bugs.webkit.org/show_bug.cgi?id=59881
+
+        * wtf/OwnPtr.h:
+
+2011-05-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=59896
+        Remove JmpSrc/JmpDst types.
+
+        The JmpSrc/JmpDst classes predate the MacroAssembler interface. Having these
+        object be per-assembler in unhelpful, causes unnecessary code duplication,
+        and prevents the AssemblerBuffer from providing a richer type for labels.
+        The limited semantic meaning that they did convey is undermined by the manner
+        in which their meanings have been overloaded (use of JmpSrc for Call, JmpDst
+        for data labels).
+
+        Jumps on ARMv7 have had additional information added to the object via the
+        ARMv7 JmpSrc. This data should probably be in the instruction stream. This
+        patch does not fix the problem, and moves the data (ifdefed) to
+        AbstractMacroAssembler::Jump (which is effectively where it was before!).
+        This at least closes the hole such that no further data may be added to JmpSrc,
+        but this is unfortunate, and should be cleaned up.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::label):
+        (JSC::ARMAssembler::align):
+        (JSC::ARMAssembler::loadBranchTarget):
+        (JSC::ARMAssembler::jmp):
+        (JSC::ARMAssembler::linkPointer):
+        (JSC::ARMAssembler::linkJump):
+        (JSC::ARMAssembler::linkCall):
+        (JSC::ARMAssembler::getRelocatedAddress):
+        (JSC::ARMAssembler::getDifferenceBetweenLabels):
+        (JSC::ARMAssembler::getCallReturnOffset):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::b):
+        (JSC::ARMv7Assembler::blx):
+        (JSC::ARMv7Assembler::bx):
+        (JSC::ARMv7Assembler::label):
+        (JSC::ARMv7Assembler::align):
+        (JSC::ARMv7Assembler::getRelocatedAddress):
+        (JSC::ARMv7Assembler::getDifferenceBetweenLabels):
+        (JSC::ARMv7Assembler::getCallReturnOffset):
+        (JSC::ARMv7Assembler::linkJump):
+        (JSC::ARMv7Assembler::linkCall):
+        (JSC::ARMv7Assembler::linkPointer):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Label::isSet):
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::linkPointer):
+        (JSC::AbstractMacroAssembler::getLinkerAddress):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerLabel::AssemblerLabel):
+        (JSC::AssemblerLabel::isSet):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::patch):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::label):
+        (JSC::MIPSAssembler::align):
+        (JSC::MIPSAssembler::getRelocatedAddress):
+        (JSC::MIPSAssembler::getDifferenceBetweenLabels):
+        (JSC::MIPSAssembler::getCallReturnOffset):
+        (JSC::MIPSAssembler::linkJump):
+        (JSC::MIPSAssembler::linkCall):
+        (JSC::MIPSAssembler::linkPointer):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchDouble):
+        (JSC::MacroAssemblerARMv7::branchDoubleZeroOrNaN):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::ret):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::tailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::branchTrue):
+        (JSC::MacroAssemblerMIPS::branchFalse):
+        (JSC::MacroAssemblerMIPS::branchEqual):
+        (JSC::MacroAssemblerMIPS::branchNotEqual):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::call):
+        (JSC::SH4Assembler::jmp):
+        (JSC::SH4Assembler::jne):
+        (JSC::SH4Assembler::je):
+        (JSC::SH4Assembler::label):
+        (JSC::SH4Assembler::align):
+        (JSC::SH4Assembler::linkJump):
+        (JSC::SH4Assembler::linkCall):
+        (JSC::SH4Assembler::linkPointer):
+        (JSC::SH4Assembler::getCallReturnOffset):
+        (JSC::SH4Assembler::getRelocatedAddress):
+        (JSC::SH4Assembler::getDifferenceBetweenLabels):
+        (JSC::SH4Assembler::patchPointer):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::call):
+        (JSC::X86Assembler::jmp):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::jne):
+        (JSC::X86Assembler::jnz):
+        (JSC::X86Assembler::je):
+        (JSC::X86Assembler::jz):
+        (JSC::X86Assembler::jl):
+        (JSC::X86Assembler::jb):
+        (JSC::X86Assembler::jle):
+        (JSC::X86Assembler::jbe):
+        (JSC::X86Assembler::jge):
+        (JSC::X86Assembler::jg):
+        (JSC::X86Assembler::ja):
+        (JSC::X86Assembler::jae):
+        (JSC::X86Assembler::jo):
+        (JSC::X86Assembler::jp):
+        (JSC::X86Assembler::js):
+        (JSC::X86Assembler::jCC):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::labelFor):
+        (JSC::X86Assembler::align):
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::linkPointer):
+        (JSC::X86Assembler::getCallReturnOffset):
+        (JSC::X86Assembler::getRelocatedAddress):
+        (JSC::X86Assembler::getDifferenceBetweenLabels):
+        (JSC::X86Assembler::rewindToLabel):
+        (JSC::X86Assembler::X86InstructionFormatter::immediateRel32):
+        (JSC::X86Assembler::X86InstructionFormatter::rewindToLabel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::atJumpTarget):
+        (JSC::JIT::emitGetVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jmp_scopes):
+
+2011-05-01  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix MIPS build due to the split of "Condition" enum
+        https://bugs.webkit.org/show_bug.cgi?id=59407
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::debugOffset):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::compare32):
+
+2011-04-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Enable strict OwnPtr for GTK
+        https://bugs.webkit.org/show_bug.cgi?id=59861
+
+        * wtf/OwnPtr.h:
+
+2011-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        ARMv7 build fix.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+
+2011-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 59869 - AssemblerBuffer cleanup - disambiguate size()
+
+        The method size() is called on the AssemblerBuffer both to acquire
+        the complete size of the code, and to get a position to use as a
+        label into the code. Instead, add an explicit 'label' method.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::codeSize):
+        (JSC::ARMAssembler::label):
+        (JSC::ARMAssembler::loadBranchTarget):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::b):
+        (JSC::ARMv7Assembler::blx):
+        (JSC::ARMv7Assembler::bx):
+        (JSC::ARMv7Assembler::label):
+        (JSC::ARMv7Assembler::codeSize):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::codeSize):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::data):
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::codeSize):
+        (JSC::AssemblerBuffer::label):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::newJmpSrc):
+        (JSC::MIPSAssembler::appendJump):
+        (JSC::MIPSAssembler::label):
+        (JSC::MIPSAssembler::codeSize):
+        (JSC::MIPSAssembler::relocateJumps):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::loadConstant):
+        (JSC::SH4Assembler::loadConstantUnReusable):
+        (JSC::SH4Assembler::call):
+        (JSC::SH4Assembler::jmp):
+        (JSC::SH4Assembler::jne):
+        (JSC::SH4Assembler::je):
+        (JSC::SH4Assembler::label):
+        (JSC::SH4Assembler::executableCopy):
+        (JSC::SH4Assembler::oneShortOp):
+        (JSC::SH4Assembler::codeSize):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::call):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::codeSize):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormatter::immediateRel32):
+        (JSC::X86Assembler::X86InstructionFormatter::codeSize):
+        (JSC::X86Assembler::X86InstructionFormatter::label):
+        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+
+2011-04-29  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-04-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CSP script-src should block eval
+        https://bugs.webkit.org/show_bug.cgi?id=59850
+
+        ggaren recommend a different approach to this patch, essentially
+        installing a new function for function-eval and changing the AST
+        representation of operator-eval to call function-eval.  However, I'm
+        not sure that approach is workable because the ASTBuilder doesn't know
+        about global objects, and there is added complication due to the cache.
+
+        This approach is more dynamic, adding a branch in EvalExecutable to
+        detect whether eval is current disabled in the lexical scope.  The spec
+        is slightly unclear about whether we should return undefined or throw
+        an exception.  I've asked Brandon to clarify the spec, but throwing an
+        exception seems natural.
+
+        * JavaScriptCore.exp:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::disableEval):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::isEvalEnabled):
+
+2011-04-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=59847
+        Remove linkOffset from LinkBuffer
+
+        This is redundant since removal of recompilation for exception info.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::linkCode):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+
+2011-04-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=59221
+        [RegexFuzz] Regression blocking testing
+
+        Okay, so the bug here is that when, in the case of a TypeParentheticalAssertion
+        node, emitDisjunction recursively calls to itself to emit the nested disjunction
+        the value of parenthesesInputCountAlreadyChecked is bogus (doesn't take into
+        account the uncheck that has just taken place).
+
+        Also, the special handling given to countToCheck in the case of parenthetical
+        assertions is nonsense, delete it, along with the isParentheticalAssertion argument.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2011-04-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Enable strict OwnPtr for Qt
+        https://bugs.webkit.org/show_bug.cgi?id=59667
+
+        * wtf/OwnPtr.h:
+
+2011-04-29  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Add ENABLE macro for WebKitAnimation
+        https://bugs.webkit.org/show_bug.cgi?id=59729
+
+        Add new feature to toggle WebKit Animation API.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Install testapi.js along side testapi
+        https://bugs.webkit.org/show_bug.cgi?id=59773
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add new build phase to copy testapi.js to install path of testapi
+        on install.
+
+2011-04-28  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove IMAGE_RESIZER related code.
+        https://bugs.webkit.org/show_bug.cgi?id=59735
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=59763
+        DFG JIT - Unify FPRReg & FPRegisterID
+
+        (Following on from GPRReg/RegisterID unification).
+
+        * dfg/DFGFPRInfo.h:
+        (JSC::DFG::FPRInfo::toRegister):
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::checkConsistency):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::boxDouble):
+        (JSC::DFG::JITCodeGenerator::unboxDouble):
+        (JSC::DFG::JITCodeGenerator::flushRegisters):
+        (JSC::DFG::JITCodeGenerator::isFlushed):
+        (JSC::DFG::JITCodeGenerator::setupTwoStubArgs):
+        (JSC::DFG::JITCodeGenerator::setupStubArguments):
+        (JSC::DFG::JITCodeGenerator::callOperation):
+        (JSC::DFG::GPRResult::lockedResult):
+        (JSC::DFG::FPRResult::lockedResult):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::EntryLocation::EntryLocation):
+        (JSC::DFG::NonSpeculativeJIT::valueToNumber):
+        (JSC::DFG::NonSpeculativeJIT::valueToInt32):
+        (JSC::DFG::NonSpeculativeJIT::numberToInt32):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        (JSC::DFG::NonSpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::NonSpeculativeJIT::silentFillAllRegisters):
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::iterator::regID):
+        (JSC::DFG::RegisterBank::iterator::debugName):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculationCheck::SpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-04-28  David Kilzer  <ddkilzer@apple.com>
+
+        Revert "<http://webkit.org/b/59705> WTF::postTimer() leaks a CFRunLoopTimerRef every time it's called"
+
+        This reverts commit r85195.  It was crashing DumpRenderTree on Lion.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::postTimer):
+
+2011-04-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove WML
+        https://bugs.webkit.org/show_bug.cgi?id=59678
+
+        Remove the WML configuration option from the Mac build system.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r85233 and r85235.
+        http://trac.webkit.org/changeset/85233
+        http://trac.webkit.org/changeset/85235
+        https://bugs.webkit.org/show_bug.cgi?id=59754
+
+        Causes issues with jsc. (Requested by dave_levin on #webkit).
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * wtf/CMakeLists.txt:
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref):
+        (WTF::RefCountedBase::hasOneRef):
+        (WTF::RefCountedBase::refCount):
+        (WTF::RefCountedBase::derefBase):
+        * wtf/SizeLimits.cpp:
+        * wtf/ThreadRestrictionVerifier.h: Removed.
+        * wtf/text/CString.h:
+        (WTF::CStringBuffer::CStringBuffer):
+
+2011-04-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 59740 - DFG JIT - Unify GPRReg & RegisterID
+
+        Currently we use a mix of enum values throughout the DFG JIT to  represent
+        gpr registers - the RegisterID provided by the MacroAssembler, and the
+        GPRReg enum giving the sequential register set over which the RegisterBank
+        allocates. Unify the two.
+
+        Patch to unify FPRReg in a similar fashion will follow.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGFPRInfo.h: Added.
+        (JSC::DFG::next):
+        (JSC::DFG::FPRBankInfo::toRegister):
+        (JSC::DFG::FPRBankInfo::toIndex):
+        * dfg/DFGGPRInfo.h: Added.
+        (JSC::DFG::GPRInfo::toRegister):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::dump):
+        (JSC::DFG::JITCodeGenerator::checkConsistency):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::boxDouble):
+        (JSC::DFG::JITCodeGenerator::unboxDouble):
+        (JSC::DFG::JITCodeGenerator::spill):
+        (JSC::DFG::JITCodeGenerator::flushRegisters):
+        (JSC::DFG::JITCodeGenerator::isFlushed):
+        (JSC::DFG::JITCodeGenerator::bitOp):
+        (JSC::DFG::JITCodeGenerator::shiftOp):
+        (JSC::DFG::JITCodeGenerator::setupTwoStubArgs):
+        (JSC::DFG::JITCodeGenerator::setupStubArguments):
+        (JSC::DFG::JITCodeGenerator::callOperation):
+        (JSC::DFG::IntegerOperand::gpr):
+        (JSC::DFG::DoubleOperand::gpr):
+        (JSC::DFG::GPRTemporary::gpr):
+        (JSC::DFG::FPRTemporary::gpr):
+        (JSC::DFG::GPRResult::lockedResult):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        (JSC::DFG::JITCompiler::fillToJS):
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::jitAssertIsInt32):
+        (JSC::DFG::JITCompiler::jitAssertIsJSInt32):
+        (JSC::DFG::JITCompiler::jitAssertIsJSNumber):
+        (JSC::DFG::JITCompiler::jitAssertIsJSDouble):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::preserveReturnAddressAfterCall):
+        (JSC::DFG::JITCompiler::restoreReturnAddressBeforeReturn):
+        (JSC::DFG::JITCompiler::emitGetFromCallFrameHeaderPtr):
+        (JSC::DFG::JITCompiler::emitPutToCallFrameHeader):
+        (JSC::DFG::JITCompiler::emitPutImmediateToCallFrameHeader):
+        (JSC::DFG::JITCompiler::addressForGlobalVar):
+        (JSC::DFG::JITCompiler::addressFor):
+        (JSC::DFG::JITCompiler::tagFor):
+        (JSC::DFG::JITCompiler::payloadFor):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::EntryLocation::EntryLocation):
+        (JSC::DFG::NonSpeculativeJIT::valueToNumber):
+        (JSC::DFG::NonSpeculativeJIT::valueToInt32):
+        (JSC::DFG::NonSpeculativeJIT::numberToInt32):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        (JSC::DFG::NonSpeculativeJIT::silentSpillGPR):
+        (JSC::DFG::NonSpeculativeJIT::silentSpillFPR):
+        (JSC::DFG::NonSpeculativeJIT::silentFillGPR):
+        (JSC::DFG::NonSpeculativeJIT::silentFillFPR):
+        (JSC::DFG::NonSpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::NonSpeculativeJIT::silentFillAllRegisters):
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::allocate):
+        (JSC::DFG::RegisterBank::retain):
+        (JSC::DFG::RegisterBank::release):
+        (JSC::DFG::RegisterBank::lock):
+        (JSC::DFG::RegisterBank::unlock):
+        (JSC::DFG::RegisterBank::isLocked):
+        (JSC::DFG::RegisterBank::name):
+        (JSC::DFG::RegisterBank::iterator::name):
+        (JSC::DFG::RegisterBank::iterator::isLocked):
+        (JSC::DFG::RegisterBank::iterator::release):
+        (JSC::DFG::RegisterBank::iterator::gpr):
+        (JSC::DFG::RegisterBank::iterator::debugName):
+        (JSC::DFG::RegisterBank::iterator::operator++):
+        (JSC::DFG::RegisterBank::iterator::operator!=):
+        (JSC::DFG::RegisterBank::iterator::index):
+        (JSC::DFG::RegisterBank::iterator::iterator):
+        (JSC::DFG::RegisterBank::begin):
+        (JSC::DFG::RegisterBank::end):
+        (JSC::DFG::RegisterBank::isLockedAtIndex):
+        (JSC::DFG::RegisterBank::nameAtIndex):
+        (JSC::DFG::RegisterBank::releaseAtIndex):
+        (JSC::DFG::RegisterBank::allocateInternal):
+        (JSC::DFG::RegisterBank::MapEntry::MapEntry):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculationCheck::SpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::initializeVariableTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculateIntegerOperand::gpr):
+
+2011-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove evil addressOfStructure() function
+        https://bugs.webkit.org/show_bug.cgi?id=59739
+
+        Remove the addressOfStructure function from JSCell, and update
+        callsites to use the same logic as testPrototype()
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        * runtime/JSCell.h:
+
+2011-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clean up testPrototype()
+        https://bugs.webkit.org/show_bug.cgi?id=59734
+
+        Remove direct pointer to the inside of a GC object and just do
+        the indirect load manually.  Doesn't effect sunspider but does
+        clean up the code quite a bit, and simplifies the handling of
+        GC values.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+
+2011-04-28  David Levin  <levin@chromium.org>
+
+        Build fix.
+
+        * wtf/RefCounted.h: Fix inverted ifdef.
+
+2011-04-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add asserts to RefCounted to make sure ref/deref happens on the right thread.
+        https://bugs.webkit.org/show_bug.cgi?id=31639
+
+        * GNUmakefile.list.am: Added new files to the build.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::ExecutablePool): Turned off checks for this
+        due to not being able to figure out what was guarding it (bug 58091).
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider): Ditto.
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp): Ditto.
+        * wtf/CMakeLists.txt: Added new files to the build.
+        * wtf/ThreadRestrictionVerifier.h: Added.
+        Everything is done in the header to avoid the issue with exports
+        that are only useful in debug but still needing to export them.
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Added checks using the non thread safe verifier.
+        and filed bug 58171 about making it stricter.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::setMutexForVerifier): Expose a way to change the checks to be based
+        on a mutex. This is in the header to avoid adding more exports from JavaScriptCore.
+        (WTF::RefCountedBase::deprecatedTurnOffVerifier): Temporary way to turn off verification.
+        Filed bug 58174 to remove this method.
+        (WTF::RefCountedBase::derefBase):
+        * wtf/SizeLimits.cpp: Adjusted the debug size check for RefCounted.
+        * wtf/text/CString.h:
+        (WTF::CStringBuffer::CStringBuffer): Turned off checks for this while a fix is being
+        done in Chromium's test_shell (bug 58093).
+
+2011-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the build.
+
+        * GNUmakefile.am: add -lpthread.
+
+2011-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Only need a single implementation of testPrototype
+        https://bugs.webkit.org/show_bug.cgi?id=59724
+
+        Remove excess copy of identical testPrototype() code
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+        * jit/JITPropertyAccess32_64.cpp:
+
+2011-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] Split JSC and WebCore builds
+        https://bugs.webkit.org/show_bug.cgi?id=19428
+
+        Build JavaScriptCore as a libtool shared library instead of a
+        private convenience library.
+
+        * GNUmakefile.am: define new jsc library and adapt to new name for
+        javascriptcore target.
+        * GNUmakefile.list.am: ditto.
+
+2011-04-28  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/59705> WTF::postTimer() leaks a CFRunLoopTimerRef every time it's called
+
+        Reviewed by Simon Fraser.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::postTimer): Use RetainPtr to plug the leak.
+
+2011-04-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Add way to install testapi in production builds
+        https://bugs.webkit.org/show_bug.cgi?id=59674
+
+        * Configurations/TestAPI.xcconfig: Copied from Configurations/JavaScriptCore.xcconfig.
+        Add configuration file for TestAPI. In addition to name, we now specify an install path
+        and allow SKIP_INSTALL to be overridden by setting FORCE_TOOL_INSTALL.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Remove in-project build settings and add missing configuration files. Added missing CompilerVersion.xcconfig
+        file.
+
+2011-04-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Enable strict OwnPtrs for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=59666
+
+        * wtf/OwnPtr.h:
+
+2011-04-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Add ability to remove keys from weakmap API
+        https://bugs.webkit.org/show_bug.cgi?id=59645
+
+        Add JSWeakObjectMapRemove API
+
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JSWeakObjectMapRefPrivate.h:
+        * JavaScriptCore.exp:
+
+2011-04-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Enable strict mode for OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=59428
+
+        This patch enables strict mode for OwnPtr on PLATFORM(MAC) only.
+
+        * wtf/OwnPtr.h:
+
+2011-04-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by David Levin.
+
+        Remove Android build system
+        https://bugs.webkit.org/show_bug.cgi?id=48111
+
+        This is to avoid the maintenance burden until the Android port is
+        fully upstreamed.
+
+        * Android.mk: Removed.
+        * Android.v8.wtf.mk: Removed.
+
+2011-04-27  Mark Rowe  <mrowe@apple.com>
+
+        Fix 32-bit build after r85036.
+
+        * wtf/Platform.h: USE(PLUGIN_HOST_PROCESS) is only true for 64-bit.
+
+2011-04-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix after r85036.
+
+        Readd non-dead code.
+
+        * wtf/OSAllocatorPosix.cpp:
+        (WTF::OSAllocator::reserveAndCommit):
+
+2011-04-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Kenneth Russell.
+
+        OwnPtr assignment operator should be private
+        https://bugs.webkit.org/show_bug.cgi?id=59487
+
+        Unfortunately we can't remove the copy constructor because of some
+        detail about gcc.  (The issue is documented in a comment already.)
+
+        * wtf/OwnPtr.h:
+
+2011-04-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84977.
+        http://trac.webkit.org/changeset/84977
+        https://bugs.webkit.org/show_bug.cgi?id=59568
+
+        caused crashes on the SL WK2 bots (Requested by jessieberlin
+        on #webkit).
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::tailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
+
+2011-04-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Rubberstamped by Eric Seidel.
+
+        Enable waf to be used to build other ports
+        https://bugs.webkit.org/show_bug.cgi?id=58213
+
+        * wscript:
+
+2011-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Remove Datagrid from the tree
+        https://bugs.webkit.org/show_bug.cgi?id=59543
+
+        * Configurations/FeatureDefines.xcconfig:
+        Remove feature.
+
+2011-04-26  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix incorrect use of OwnPtr<T*> in GCActivityCallback
+        https://bugs.webkit.org/show_bug.cgi?id=59559
+
+        * runtime/GCActivityCallback.h:
+
+2011-04-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Daniel Bates.
+
+        Unused but set variable warning in MacroAssembelX86_64
+        https://bugs.webkit.org/show_bug.cgi?id=59482
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::call): do not declare the label
+        variable if we are not going to use it.
+        (JSC::MacroAssemblerX86_64::tailRecursiveCall): ditto.
+        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall): ditto.
+
+2011-04-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Choose the compiler based on the Xcode version for Snow Leopard debug builds.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Added.
+
+2011-04-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Nixed special finalizer handling for WebCore strings
+        https://bugs.webkit.org/show_bug.cgi?id=59425
+        
+        SunSpider reports no change.
+        
+        Not needed anymore, since weak handles have finalizers.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::resolveRopeSlowCase):
+        (JSC::JSString::outOfMemory):
+        (JSC::JSString::substringFromRope):
+        (JSC::JSString::replaceCharacter): Updated for removal of union.
+
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::~JSString):
+        (JSC::RopeBuilder::appendStringInConstruct):
+        (JSC::RopeBuilder::appendValueInConstructAndIncrementLength): No need for
+        union or special constructor anymore.
+
+2011-04-26  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Speeding up SVG filters with multicore (SMP) support
+        https://bugs.webkit.org/show_bug.cgi?id=43903
+
+        Some SVG filters execute a huge number of pixel manipulations, which
+        cannot be sped up by graphics accelerators, since their algorithm is
+        too complex. Using the power of Symmetric Multi Processing (SMP) we
+        can split up a task to smaller (data independent) tasks, which can be
+        executed independently.
+
+        The ParallelJobs framework provides a simple way for distributed
+        programming. The framework is based on WebKit's threading infrastructure,
+        Open Multi-Processing's (OpenMP) API, and libdispatch API.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/ParallelJobs.h: Added.
+        (WTF::ParallelJobs::ParallelJobs):
+        (WTF::ParallelJobs::numberOfJobs):
+        (WTF::ParallelJobs::parameterForJob):
+        (WTF::ParallelJobs::executeJobs):
+        * wtf/ParallelJobsGeneric.cpp: Added.
+        (WTF::ParallelEnvironment::ThreadPrivate::tryLockFor):
+        (WTF::ParallelEnvironment::ThreadPrivate::executeJob):
+        (WTF::ParallelEnvironment::ThreadPrivate::waitForFinish):
+        (WTF::ParallelEnvironment::ThreadPrivate::workerThread):
+        * wtf/ParallelJobsGeneric.h: Added.
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::numberOfJobs):
+        (WTF::ParallelEnvironment::parameterForJob):
+        (WTF::ParallelEnvironment::executeJobs):
+        (WTF::ParallelEnvironment::ThreadPrivate::ThreadPrivate):
+        (WTF::ParallelEnvironment::ThreadPrivate::create):
+        * wtf/ParallelJobsLibdispatch.h: Added.
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::numberOfJobs):
+        (WTF::ParallelEnvironment::parameterForJob):
+        (WTF::ParallelEnvironment::executeJobs):
+        * wtf/ParallelJobsOpenMP.h: Added.
+        (WTF::ParallelEnvironment::ParallelEnvironment):
+        (WTF::ParallelEnvironment::numberOfJobs):
+        (WTF::ParallelEnvironment::parameterForJob):
+        (WTF::ParallelEnvironment::executeJobs):
+        * wtf/Platform.h:
+        * wtf/wtf.pri:
+
+2011-04-26  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Turn off make built-in implicit rules for derived sources makefile
+        https://bugs.webkit.org/show_bug.cgi?id=59418
+        
+        We don't use any of make's built-in implicit rules, turning them off
+        speeds up parsing of the makefile.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * gyp/generate-derived-sources.sh:
+
+2011-04-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Custom prototypes on DOM objects don't persist after garbage collection
+        https://bugs.webkit.org/show_bug.cgi?id=59412
+        
+        SunSpider reports no change.
+        
+        The hasCustomProperties() check didn't check for a custom prototype.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::hasCustomProperties): Changed to delegate to Structure
+        because it is the "truth" about an object's pedigree.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+        (JSC::Structure::didTransition): Track whether a Structure has ever
+        transitioned for any reason. If so, we have to assume that the object
+        holding it is custom in some way.
+
+2011-04-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=59405
+        DFG JIT - add type speculation for integer & array types, for vars & args.
+
+        If a var or argument is used as the base for a GetByVal or PutByVal access
+        we are speculating that it is of type Array (we only generate code on the
+        speculative path to perform array accesses). By typing the var or args slot
+        as Array, and checking on entry to the function (in the case of args), and
+        each time the local is written to, we can avoid a type check at each point
+        the array is accessed. This will typically hoist type checks out of loops.
+
+        Similarly, any local that is incremented or decremented, or is the input or
+        output or a bitwise operator, is likely to be an integer. By typing the
+        local as int32 we can avoid speculation checks on access, and tagging when
+        writing to the slot. All accesses can become 32bit instead of 64.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::predictArray):
+        (JSC::DFG::ByteCodeParser::predictInt32):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::PredictionSlot::PredictionSlot):
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::predict):
+        (JSC::DFG::Graph::getPrediction):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::tagFor):
+        (JSC::DFG::JITCompiler::payloadFor):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::initializeVariableTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        * runtime/Executable.cpp:
+        (JSC::tryDFGCompile):
+
+2011-04-25  David Levin  <levin@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Fix OwnPtr strict mode violation in MessageQueue.h
+        https://bugs.webkit.org/show_bug.cgi?id=59400
+
+        * wtf/MessageQueue.h:
+        (WTF::::waitForMessage):
+        (WTF::::waitForMessageFilteredWithTimeout):
+        (WTF::::tryGetMessage):
+
+2011-04-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        JavaScriptCore should play nice strict OwnPtrs
+        https://bugs.webkit.org/show_bug.cgi?id=59401
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+        * heap/Heap.cpp:
+        (JSC::TypeCounter::TypeCounter):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::Scope):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::GenerationState::addParenthesesTail):
+
+2011-04-25  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * wtf/ListHashSet.h:
+
+2011-04-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 59370 - DFG JIT - fix leak of BlocksBlocks
+        (put the blocks immediately into an OwnPtr).
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+
+2011-04-25  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix strict OwnPtr violations in ListHashSet and RenderLayerCompositor
+        https://bugs.webkit.org/show_bug.cgi?id=59353
+
+        * wtf/ListHashSet.h:
+        (WTF::::ListHashSet):
+
+2011-04-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix PassOwnPtr issues in Structure and JSGlobalData.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=59347
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/Structure.cpp:
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::createPropertyMap):
+        * runtime/Structure.h:
+
+2011-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make ClassInfo required when creating a Structure
+        https://bugs.webkit.org/show_bug.cgi?id=59340
+
+        Add ClassInfo to all those types which currently don't
+        have it, and add an assertion to Structure::create to
+        ensure that the provided classInfo is not null.
+
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/GetterSetter.cpp:
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/JSAPIValueWrapper.cpp:
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::JSCell::createDummyStructure):
+
+2011-04-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        PropertyMapHashTable.h should use adoptPtr instead of implicit conversions to PassRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=59342
+
+        This patch is to prepare for the strict OwnPtr hack-a-thon.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::copy):
+
+2011-04-25  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Rationalize MacroAssembler branch methods
+        https://bugs.webkit.org/show_bug.cgi?id=58950
+
+        split out the 'Condition' enum into 'RelationalCondition' and 'ResultCondition' 
+        and apply related changes (only for SH4 platforms).
+
+        * assembler/MacroAssemblerSH4.cpp:
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::compare32):
+        (JSC::MacroAssemblerSH4::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerSH4::branchDouble):
+        (JSC::MacroAssemblerSH4::branch32):
+        (JSC::MacroAssemblerSH4::branchTest8):
+        (JSC::MacroAssemblerSH4::branch8):
+        (JSC::MacroAssemblerSH4::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerSH4::test8):
+        (JSC::MacroAssemblerSH4::branch16):
+        (JSC::MacroAssemblerSH4::branchTest32):
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        (JSC::MacroAssemblerSH4::branchMul32):
+        (JSC::MacroAssemblerSH4::branchSub32):
+        (JSC::MacroAssemblerSH4::branchOr32):
+        (JSC::MacroAssemblerSH4::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerSH4::branchPtrWithPatch):
+        (JSC::MacroAssemblerSH4::SH4Condition):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::cmpEqImmR0):
+
+2011-04-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        PropertyMapHashTable should work with strict OwnPtr
+        https://bugs.webkit.org/show_bug.cgi?id=59337
+
+        This patch is in preparation for the strict OwnPtr hack-a-thon.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::addDeletedOffset):
+
+2011-04-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed MarkStack::deprecatedAppend, since it has no clients left.
+
+        * heap/MarkStack.h:
+
+2011-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 59287 - DFG JIT - Handle temporaries as vars, allowing support for ?:
+
+        SetLocals to temporaries will only be generated if they are used within other
+        blocks, due to the SSA based DCE.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::allocateVirtualRegisters):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+
+2011-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        Bug 59266 - DFG JIT - Add SSA style DCE
+
+        This works by making GetLocal nodes reference SetLocal nodes from prior blocks,
+        via intermediate Phi nodes. Whenever we add a GetLocal to the graph, also add a
+        matching child Phi, and add the Phi to a work queue to add references to prior
+        definitions once we have the full CFG & can determine predecessors. This process
+        is iterative, inserting new phis into predecessors as necessary.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processWorkQueue):
+        (JSC::DFG::ByteCodeParser::allocateVirtualRegisters):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::refChildren):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::ref):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::ref):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::dump):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-22  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add missing default constructors for HashMap iterator specializations.
+        https://bugs.webkit.org/show_bug.cgi?id=59250
+
+        * wtf/HashIterators.h:
+        * wtf/HashTable.h:
+        (WTF::HashTableConstIterator::HashTableConstIterator): Added cast
+        to help compiler find the function template.
+
+2011-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 59262 - DFG JIT - reduce size of VariableRecord
+
+        We never need both the get & set node, only the most recent
+        (which is always a set, if both exist).
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::VariableRecord::VariableRecord):
+
+2011-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 59254 - DFG JIT - retain VariableRecords for args/var in all basic blocks,
+        such that this information is available for DCE.  Also, since this enlarges the
+        size of BasicBlock, make Graph hold a vector of pointers to basic blocks, not a
+        vector of blocks.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::setupPredecessors):
+        (JSC::DFG::ByteCodeParser::allocateVirtualRegisters):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::VariableRecord::VariableRecord):
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::BasicBlock::getBytecodeBegin):
+        (JSC::DFG::Graph::blockIndexForBytecodeOffset):
+        (JSC::DFG::Graph::blockForBytecodeOffset):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+
+2011-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Errk, build fix.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Quick cleanup to SpeculativeJIT/NonSpeculativeJIT compile loop,
+        move out the call to checkConsistency().
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+
+2011-04-21  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Provide default constructors for HashMap iterators.
+        https://bugs.webkit.org/show_bug.cgi?id=59151
+
+        These will be used to implement an iterator over EventTarget's
+        listeners.
+
+        * wtf/HashTable.h:
+        (WTF::HashTableConstIteratorAdapter::HashTableConstIteratorAdapter):
+        (WTF::HashTableIteratorAdapter::HashTableIteratorAdapter):
+
+2011-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 59232 - DFG JIT - Add predecessor links to BasicBlocks
+
+        These will be necessary for DCE support.
+        Also factor allocateVirtualRegisters out into its own method.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setupPredecessors):
+        (JSC::DFG::ByteCodeParser::allocateVirtualRegisters):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::blockForBytecodeOffset):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isTerminal):
+
+2011-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Object.create creates uncachable objects
+        https://bugs.webkit.org/show_bug.cgi?id=59164
+
+        Use the prototype object's inheritorID, as we
+        should always have done
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::nullPrototypeObjectStructure):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorCreate):
+
+2011-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 59222 - DFG JIT - don't allocate virtual registers to nodes with no result
+
+        We currently allocate virtual registers to nodes which have no result - these are
+        clearly unused, and may result in us allocating a larger than necessary stack frame.
+
+        Encapsulate Node::virtualRegister such that we can ASSERT this is only called on
+        nodes that have results, and improve the quality of output from the consistency check.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        (JSC::DFG::JITCodeGenerator::dump):
+        (JSC::DFG::JITCodeGenerator::checkConsistency):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::canReuse):
+        (JSC::DFG::JITCodeGenerator::isFilled):
+        (JSC::DFG::JITCodeGenerator::isFilledDouble):
+        (JSC::DFG::JITCodeGenerator::use):
+        (JSC::DFG::JITCodeGenerator::integerResult):
+        (JSC::DFG::JITCodeGenerator::noResult):
+        (JSC::DFG::JITCodeGenerator::cellResult):
+        (JSC::DFG::JITCodeGenerator::jsValueResult):
+        (JSC::DFG::JITCodeGenerator::doubleResult):
+        (JSC::DFG::JITCodeGenerator::initConstantInfo):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        (JSC::DFG::JITCompiler::fillToJS):
+        (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::hasResult):
+        (JSC::DFG::Node::virtualRegister):
+        (JSC::DFG::Node::setVirtualRegister):
+        (JSC::DFG::Node::refCount):
+        (JSC::DFG::Node::ref):
+        (JSC::DFG::Node::deref):
+        (JSC::DFG::Node::adjustedRefCount):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::isKnownInteger):
+        (JSC::DFG::NonSpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::use):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Oliver Hunt.
+
+        Arrays should participate in global object forwarding fun
+        https://bugs.webkit.org/show_bug.cgi?id=59215
+
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        Add variants of constructArray that take a global object.
+
+2011-04-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84650 and r84654.
+        http://trac.webkit.org/changeset/84650
+        http://trac.webkit.org/changeset/84654
+        https://bugs.webkit.org/show_bug.cgi?id=59218
+
+        Broke Windows build (Requested by bweinstein on #webkit).
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::operator UnspecifiedBoolType*):
+        (JSC::HandleTypes::getFromSlot):
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::markStrongHandles):
+        (JSC::HandleHeap::markWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::writeBarrier):
+        (JSC::HandleHeap::protectedGlobalObjectCount):
+        (JSC::HandleHeap::isValidWeakNode):
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::copyWeak):
+        (JSC::HandleHeap::makeWeak):
+        (JSC::HandleHeap::Node::slot):
+        * heap/HandleStack.cpp:
+        (JSC::HandleStack::mark):
+        (JSC::HandleStack::grow):
+        * heap/HandleStack.h:
+        (JSC::HandleStack::zapTo):
+        (JSC::HandleStack::push):
+        * heap/Heap.cpp:
+        (JSC::HandleHeap::protectedObjectTypeCounts):
+        * heap/Local.h:
+        (JSC::::set):
+        * heap/Strong.h:
+        (JSC::Strong::set):
+        * heap/Weak.h:
+        (JSC::Weak::set):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::set):
+        * runtime/WriteBarrier.h:
+
+2011-04-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Part of Windows build fix from r84650.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make it harder to use HandleSlot incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=59205
+
+        Just add a little type fudging to make it harder to
+        incorrectly assign through a HandleSlot.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        * JavaScriptCore.exp:
+        * heap/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::operator UnspecifiedBoolType*):
+        (JSC::HandleTypes::getFromSlot):
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::markStrongHandles):
+        (JSC::HandleHeap::markWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::writeBarrier):
+        (JSC::HandleHeap::protectedGlobalObjectCount):
+        (JSC::HandleHeap::isValidWeakNode):
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::copyWeak):
+        (JSC::HandleHeap::makeWeak):
+        (JSC::HandleHeap::Node::slot):
+        * heap/HandleStack.cpp:
+        (JSC::HandleStack::mark):
+        (JSC::HandleStack::grow):
+        * heap/HandleStack.h:
+        (JSC::HandleStack::zapTo):
+        (JSC::HandleStack::push):
+        * heap/Heap.cpp:
+        (JSC::HandleHeap::protectedObjectTypeCounts):
+        * heap/Local.h:
+        (JSC::::set):
+        * heap/Strong.h:
+        (JSC::Strong::set):
+        * heap/Weak.h:
+        (JSC::Weak::set):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::set):
+        * runtime/WriteBarrier.h:
+        (JSC::OpaqueJSValue::toJSValue):
+        (JSC::OpaqueJSValue::toJSValueRef):
+        (JSC::OpaqueJSValue::fromJSValue):
+
+2011-04-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for ENABLE(INTERPRETER) after r84556.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+
+2011-04-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84583.
+        http://trac.webkit.org/changeset/84583
+        https://bugs.webkit.org/show_bug.cgi?id=59173
+
+        "broke
+        http://trac.webkit.org/export/84593/trunk/LayoutTests/fast/js
+        /Object-create.html" (Requested by ggaren on #webkit).
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorCreate):
+
+2011-04-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a feature define to allow <details> and <summary> to be disabled
+        https://bugs.webkit.org/show_bug.cgi?id=59118
+        <rdar://problem/9257045>
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Object.create creates uncachable objects
+        https://bugs.webkit.org/show_bug.cgi?id=59164
+
+        Use the prototype object's inheritorID, as we
+        should always have done
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorCreate):
+
+2011-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Start moving to a general visitor pattern for GC traversal
+        https://bugs.webkit.org/show_bug.cgi?id=59141
+
+        This is just a rename:
+            markChildren -> visitChildren
+            markAggregate -> visitAggregate
+            markStack -> visitor
+            MarkStack -> typedef'd to SlotVisitor
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::visitChildren):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        (JSC::JSCallbackObject::visitChildren):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitStructures):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        * bytecode/EvalCodeCache.h:
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::visitAggregate):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::visitAggregate):
+        * bytecode/StructureStubInfo.h:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::visitChildren):
+        * debugger/DebuggerActivation.h:
+        * heap/HandleHeap.cpp:
+        (JSC::WeakHandleOwner::isReachableFromOpaqueRoots):
+        (JSC::HandleHeap::markStrongHandles):
+        (JSC::HandleHeap::markWeakHandles):
+        * heap/HandleHeap.h:
+        * heap/HandleStack.cpp:
+        (JSC::HandleStack::mark):
+        * heap/HandleStack.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::visitChildren):
+        (JSC::MarkStack::drain):
+        * heap/MarkStack.h:
+        (JSC::HeapRootVisitor::HeapRootVisitor):
+        (JSC::HeapRootVisitor::mark):
+        (JSC::HeapRootVisitor::visitor):
+        * heap/MarkedSpace.h:
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        * runtime/ArgList.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        * runtime/Arguments.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildren):
+        * runtime/JSArray.h:
+        (JSC::JSArray::visitDirect):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::visitChildren):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::visitIfNeeded):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        * runtime/JSObject.h:
+        (JSC::JSObject::visitDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::visitChildren):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::overridesVisitChildren):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/JSWrapperObject.h:
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::visitChildren):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildren):
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::visitChildren):
+        * runtime/ScopeChain.h:
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::visitChildren):
+        * runtime/SmallStrings.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+
+2011-04-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84548.
+        http://trac.webkit.org/changeset/84548
+        https://bugs.webkit.org/show_bug.cgi?id=59144
+
+        Broke chromium-win build (Requested by aklein on #webkit).
+
+        * wtf/Platform.h:
+
+2011-04-21  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi] Worker File API calls that create Blobs fail in debug builds due to random number generator thread assertion
+        https://bugs.webkit.org/show_bug.cgi?id=55728
+
+        Enable WTF_MULTIPLE_THREADS for Chromium.
+
+        * wtf/Platform.h:
+
+2011-04-20  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSString::resolveRope inefficient for common 2 fiber case
+        https://bugs.webkit.org/show_bug.cgi?id=58994
+
+        Split JSString::resolveRope into three routines.
+        resolveRope allocates the new buffer and handles the 1 or 2
+        fiber case with single level fibers.
+        resolveRopeSlowCase handles the general case.
+        outOfMemory handles the rare out of memory exception case.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::resolveRope):
+        (JSC::JSString::resolveRopeSlowCase):
+        (JSC::JSString::outOfMemory):
+        * runtime/JSString.h:
+
+2011-04-20  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        Rename all uses of JSC_MULTIPLE_THREADS under wtf/... to WTF_MULTIPLE_THREADS
+        https://bugs.webkit.org/show_bug.cgi?id=59040
+
+        This will be used to fix https://bugs.webkit.org/show_bug.cgi?id=55728
+        by enabling WTF_MULTIPLE_THREADS for Chromium.
+
+        * wtf/CryptographicallyRandomNumber.cpp:
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomNumber):
+        (WTF::ARC4Stream::ARC4RandomNumberGenerator::randomValues):
+        * wtf/FastMalloc.cpp:
+        * wtf/Platform.h:
+        Enable WTF_MULTIPLE_THREADS whenever JSC_MULTIPLE_THREADS is enabled.
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RefCountedLeakCounter.cpp:
+        (WTF::RefCountedLeakCounter::increment):
+        (WTF::RefCountedLeakCounter::decrement):
+        * wtf/dtoa.cpp:
+        (WTF::pow5mult):
+
+2011-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen
+
+        Bug 59069 - DFG JIT - register allocate r8, r9, r10
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::gprToRegisterID):
+
+2011-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix - revert accidental change.
+
+        * wtf/Platform.h:
+
+2011-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add SAMPLING_FLAGS tool to DFG JIT.
+
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::addressOfFlags):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::setSamplingFlag):
+        (JSC::DFG::JITCompiler::clearSamplingFlag):
+        * dfg/DFGJITCompiler.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+        * wtf/Platform.h:
+
+2011-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 59022 - DFG JIT - Optimize branch-on-relational-compare
+
+        If a relational compare (< or <=) is immediately followed by a branch,
+        we can combine the two, avoiding generation of a boolean into a register.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::invert):
+        (JSC::MacroAssemblerX86Common::commute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::adjustedRefCount):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isJSConstantWithInt32Value):
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+
+2011-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        ARMv7 build fix II.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::softModulo):
+
+2011-04-20  Gavin Barraclough  <barraclough@apple.com>
+
+        ARMv7 build fix.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::test8):
+
+2011-04-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rationalize MacroAssembler branch methods
+        https://bugs.webkit.org/show_bug.cgi?id=58950
+
+        The MacroAssembler currently exposes x86's weird behaviour that the 'setcc'
+        instruction only sets the low 8 bits of a register. Stop that.
+
+        Having done so, to clarify remove the 'set32' prefix from test & compare
+        instructions - these methods all now set a full 32/64 bit register (Ptr size).
+        The size in the function name should indicate the amount of data being compared.
+
+        Also split out the 'Condition' enum into 'RelationalCondition' and
+        'ResultCondition'. The former is used in binary comparison, the latter is a unary
+        condition check on the result of an operation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::branch16):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::comparePtr):
+        (JSC::MacroAssembler::branchAddPtr):
+        (JSC::MacroAssembler::branchSubPtr):
+        (JSC::MacroAssembler::branchTest8):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARM::branch16):
+        (JSC::MacroAssemblerARM::branchTest8):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::branchMul32):
+        (JSC::MacroAssemblerARM::branchSub32):
+        (JSC::MacroAssemblerARM::branchNeg32):
+        (JSC::MacroAssemblerARM::branchOr32):
+        (JSC::MacroAssemblerARM::compare32):
+        (JSC::MacroAssemblerARM::test32):
+        (JSC::MacroAssemblerARM::test8):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::ARMCondition):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branch32):
+        (JSC::MacroAssemblerARMv7::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARMv7::branch16):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest32):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::branchAdd32):
+        (JSC::MacroAssemblerARMv7::branchMul32):
+        (JSC::MacroAssemblerARMv7::branchOr32):
+        (JSC::MacroAssemblerARMv7::branchSub32):
+        (JSC::MacroAssemblerARMv7::compare32):
+        (JSC::MacroAssemblerARMv7::test32):
+        (JSC::MacroAssemblerARMv7::test8):
+        (JSC::MacroAssemblerARMv7::branchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        (JSC::MacroAssemblerARMv7::armV7Condition):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branch8):
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::branch16):
+        (JSC::MacroAssemblerMIPS::branchTest32):
+        (JSC::MacroAssemblerMIPS::branchTest8):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+        (JSC::MacroAssemblerMIPS::branchOr32):
+        (JSC::MacroAssemblerMIPS::compare32):
+        (JSC::MacroAssemblerMIPS::test8):
+        (JSC::MacroAssemblerMIPS::test32):
+        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        (JSC::MacroAssemblerX86Common::branchNeg32):
+        (JSC::MacroAssemblerX86Common::branchOr32):
+        (JSC::MacroAssemblerX86Common::compare32):
+        (JSC::MacroAssemblerX86Common::test8):
+        (JSC::MacroAssemblerX86Common::test32):
+        (JSC::MacroAssemblerX86Common::x86Condition):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::comparePtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+
+2011-04-20  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Cleanup includepath adjustment for generated files
+        https://bugs.webkit.org/show_bug.cgi?id=58869
+
+        * JavaScriptCore.pri:  Add the directory of generated files to the include
+        path with absolute path to make it valid in the final build step.
+
+2011-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove unneeded deprecated methods from MarkStack
+        https://bugs.webkit.org/show_bug.cgi?id=58853
+
+        Remove deprecated methods
+
+        * heap/MarkStack.h:
+
+2011-04-19  Mark Rowe  <mrowe@apple.com>
+
+        Things work best when the Xcode project refers to the file at a path that exists.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-04-19  Renata Hodovan  <reni@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move the alignment related macros in Vector.h to new Alignment.h.
+        https://bugs.webkit.org/show_bug.cgi?id=56000
+
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Alignment.h: Added.
+        * wtf/CMakeLists.txt:
+        * wtf/Vector.h:
+
+2011-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
+
+        Remove the class an all functions that still exist to support it.
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+
+2011-04-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by David Levin
+
+        Add U+FEFF (Zero width no-break space) to CharacterNames.h.
+        It's added to the list of characters to treat as zero-width
+        in WebCore.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48860
+
+        * wtf/unicode/CharacterNames.h:
+
+2011-04-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] REGRESSION(84176): http/tests/xmlhttprequest/event-listener-gc.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=58871
+
+        Unreviewed, rolling out r84176, r84178, r84186, r84212 and r84231.
+        http://trac.webkit.org/changeset/84176 (original patch)
+        http://trac.webkit.org/changeset/84178 (original patch - part 2)
+        http://trac.webkit.org/changeset/84186 (build fix)
+        http://trac.webkit.org/changeset/84212
+        http://trac.webkit.org/changeset/84231 (skip failing test)
+
+        original bugs:
+         - https://bugs.webkit.org/show_bug.cgi?id=58718
+         - https://bugs.webkit.org/show_bug.cgi?id=58853
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::deprecatedAppendValues):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::deprecatedAppend):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::operator==):
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove unneeded deprecated methods from MarkStack
+        https://bugs.webkit.org/show_bug.cgi?id=58853
+
+        Remove deprecated methods
+
+        * heap/MarkStack.h:
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Off by one initialising repeat callframe
+        https://bugs.webkit.org/show_bug.cgi?id=58838
+        <rdar://problem/8756810>
+
+        If the end of a callframe made for a repeat call landed on
+        a page boundary the following page may not have been committed
+        which means that the off by one could lead to a crash.  However
+        it could only happen in this case and only on windows which is
+        why it was so hard to repro.  Alas given the steps needed to
+        reproduce are such that it's not really possible to make a
+        testcase.
+
+        This fix makes the code a little less squirrely by not trying
+        to avoid the unnecessary initialisation of |this|.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+
+2011-04-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 58829 - DFG JIT - Optimize add/sub immediate, multiply.
+
+        Add code generation for add/subtract instruction with immediate operands
+        (where a child is a constant), and don't bail to non-speculative if an
+        integer multiple results in a +0 result (only if it should be generating -0).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isDoubleConstantWithInt32Value):
+
+2011-04-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 58817 - DFG JIT - if speculative compilation fails, throw away code.
+
+        If we detect a logical conflict, throw away generated code,
+        and only compile through the NonSpeculativeJIT.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::rewindToLabel):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::rewindToOffset):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::rewindToLabel):
+        (JSC::X86Assembler::X86InstructionFormatter::rewindToLabel):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkSpeculationChecks):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculationCheckIndexIterator::SpeculationCheckIndexIterator):
+
+2011-04-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
+
+        As simple as it sounds.
+
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+
+2011-04-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        JSC no longer builds with Clang due to -Woverloaded-virtual warning
+        https://bugs.webkit.org/show_bug.cgi?id=58760
+
+        Rename Structure's specificValue overload of put to putSpecificValue to avoid
+        Clang's warning for overloading a virtual function.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::putSpecificValue):
+        * runtime/Structure.h:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Remove WTF_PLATFORM_SGL
+        https://bugs.webkit.org/show_bug.cgi?id=58743
+
+        WTF_PLATFORM_SGL and PLATFORM(SGL) are not used in the code anywhere.
+
+        * wtf/Platform.h:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CA) to USE(CA)
+        https://bugs.webkit.org/show_bug.cgi?id=58742
+
+        * wtf/Platform.h:
+
+2011-04-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename PLATFORM(CG) to USE(CG)
+        https://bugs.webkit.org/show_bug.cgi?id=58729
+
+        * wtf/Platform.h:
+
+2011-04-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Rename PLATFORM(CAIRO) to USE(CAIRO)
+        https://bugs.webkit.org/show_bug.cgi?id=55192
+
+        * wtf/Platform.h:
+        * wtf/gobject/GTypedefs.h:
+
+2011-04-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r84067.
+        http://trac.webkit.org/changeset/84067
+        https://bugs.webkit.org/show_bug.cgi?id=58724
+
+        qt build are failing. (Requested by loislo2 on #webkit).
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::operator==):
+
+2011-04-15  Shishir Agrawal  <shishir@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Add a flag to guard Page Visibility API changes.
+        https://bugs.webkit.org/show_bug.cgi?id=58464
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Errrk! - build fix from !x86-64.
+
+        * dfg/DFGNode.h:
+
+2011-04-15  David Levin  <levin@chromium.org>
+
+        Revert of r83974.
+
+        JavaScriptCore shouldn't depend on ../ThirdParty/gtest/xcode/gtest.xcodeproj
+        https://bugs.webkit.org/show_bug.cgi?id=58716
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/tests/RunAllWtfTests.cpp: Removed.
+        * wtf/tests/StringTests.cpp: Removed.
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove DeprecatedPtr
+        https://bugs.webkit.org/show_bug.cgi?id=58718
+
+        As simple as it sounds.
+
+        * heap/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/JSValue.h:
+        * runtime/WriteBarrier.h:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add a simple tool to gather statistics on whether functions
+        are completed through the new or old JIT.
+
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2011-04-15  Oliver Hunt  <oliver@apple.com>
+
+        GC allocate Structure
+        https://bugs.webkit.org/show_bug.cgi?id=58483
+
+        Rolling r83894 r83827 r83810 r83809 r83808 back in with
+        a workaround for the gcc bug seen by the gtk bots
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::markStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::MethodCallLinkInfo::setSeen):
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * heap/Handle.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * heap/Strong.h:
+        (JSC::Strong::Strong):
+        (JSC::Strong::set):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::uncachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::uncacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::storePtrWithWriteBarrier):
+        * jsc.cpp:
+        (cleanupGlobalData):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        (JSC::arrayProtoFuncSplice):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::createStructure):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::isZombie):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::JSCell):
+        (JSC::JSCell::JSCell::addressOfStructure):
+        (JSC::JSCell::JSCell::structure):
+        (JSC::JSCell::JSCell::markChildren):
+        (JSC::JSCell::JSValue::isZombie):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::clearBuiltinStructures):
+        (JSC::JSGlobalData::createLeaked):
+        * runtime/JSGlobalData.h:
+        (JSC::allocateGlobalHandle):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::markChildren):
+        (JSC::JSGlobalObject::copyGlobalsFrom):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::isValid):
+        (JSC::constructEmptyArray):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSFinalObject::create):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::constructEmptyObject):
+        (JSC::createEmptyObjectStructure):
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::setStructure):
+        (JSC::JSObject::inheritorID):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::transitionTo):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSObjectWithGlobalObject.cpp:
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::createStructure):
+        (JSC::JSObjectWithGlobalObject::JSObjectWithGlobalObject):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::Structure::setEnumerationCache):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSString):
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        (JSC::JSVariableObject::JSVariableObject):
+        (JSC::JSVariableObject::copyRegisterArray):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/JSZombie.cpp:
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::JSZombie):
+        (JSC::JSZombie::createStructure):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::markChildren):
+        (JSC::constructWithNativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::markChildren):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::createStructure):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::StructureTransitionTable::keyForWeakGCMapFinalizer):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        (JSC::StructureChain::markChildren):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::head):
+        (JSC::StructureChain::createStructure):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::WeakGCMapFinalizerCallback::finalizerContextFor):
+        (JSC::StructureTransitionTable::WeakGCMapFinalizerCallback::keyForFinalizer):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::slot):
+        (JSC::StructureTransitionTable::setMap):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::clearSingleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        * runtime/WeakGCMap.h:
+        (JSC::DefaultWeakGCMapFinalizerCallback::finalizerContextFor):
+        (JSC::DefaultWeakGCMapFinalizerCallback::keyForFinalizer):
+        (JSC::WeakGCMap::contains):
+        (JSC::WeakGCMap::find):
+        (JSC::WeakGCMap::remove):
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::finalize):
+        * runtime/WriteBarrier.h:
+        (JSC::writeBarrier):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+
+2011-04-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gavin Barraclough.
+
+        Correctly prefix symbols. Since gcc 4.5.0, Windows x64 symbols
+        are not prefixed by underscore anymore. This is consistent with
+        what MSVC does.
+        https://bugs.webkit.org/show_bug.cgi?id=58573
+
+        * jit/JITStubs.cpp:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 58705 - DFG JIT Add support for flow control (branch, jump).
+
+        Add support for control flow by breaking the CodeBlock up into multiple
+        basic blocks, generating code for each basic block in turn through the
+        speculative JIT & then the non-speculative JIT.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setTemporary):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::BasicBlock::getBytecodeOffset):
+        (JSC::DFG::Graph::blockIndexForBytecodeOffset):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::JITCodeGenerator):
+        (JSC::DFG::JITCodeGenerator::addBranch):
+        (JSC::DFG::JITCodeGenerator::linkBranches):
+        (JSC::DFG::JITCodeGenerator::BranchRecord::BranchRecord):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::isJump):
+        (JSC::DFG::Node::isBranch):
+        (JSC::DFG::Node::takenBytecodeOffset):
+        (JSC::DFG::Node::notTakenBytecodeOffset):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 58701 - DFG JIT - add GetLocal/SetLocal nodes
+
+        Use these for both access to arguments & local variables, adds ability
+        to set locals, such that values will persist between basic blocks.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::getThis):
+        (JSC::DFG::ByteCodeParser::setThis):
+        (JSC::DFG::ByteCodeParser::VariableRecord::VariableRecord):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::derefChildren):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasLocal):
+        (JSC::DFG::Node::local):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 58696 - DFG JIT split handling of vars/temporaries
+
+        Presently all callee registers are treated as having single block scope,
+        since the DFG JIT can only compile single block functions. In order to
+        expand the JIT to support control flow we will need to change to retaining
+        locals (but not temporaries) across basic block boundaries.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getVariable):
+        (JSC::DFG::ByteCodeParser::setVariable):
+        (JSC::DFG::ByteCodeParser::getTemporary):
+        (JSC::DFG::ByteCodeParser::setTemporary):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::getInt32Constant):
+        (JSC::DFG::ByteCodeParser::getDoubleConstant):
+        (JSC::DFG::ByteCodeParser::getJSConstant):
+        (JSC::DFG::ByteCodeParser::constantUndefined):
+        (JSC::DFG::ByteCodeParser::constantNull):
+        (JSC::DFG::ByteCodeParser::one):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        (JSC::DFG::parse):
+        * dfg/DFGNode.h:
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::ScoreBoard):
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::allocate):
+        (JSC::DFG::ScoreBoard::use):
+
+2011-04-15  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        globalObject moved to JSObjectWithGlobalObject.cpp inhibits inlining
+        https://bugs.webkit.org/show_bug.cgi?id=58677
+
+        Moved JSObjectWithGlobalObject::globalObject() to 
+        runtime/JSObjectWithGlobalObject.h to allow the compiler to inline
+        it for a performance benefit.  An equivalent instance had been in
+        a header file before r60057.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObjectWithGlobalObject.cpp:
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::globalObject):
+
+2011-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make JSNodeFilterCondition handle its lifetime correctly
+        https://bugs.webkit.org/show_bug.cgi?id=58622
+
+        Add export
+
+        * JavaScriptCore.exp:
+
+2011-04-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit2: Password field input does not switch to ASCII-compatible source
+        https://bugs.webkit.org/show_bug.cgi?id=58583
+        <rdar://problem/9059651>
+
+        * wtf/Platform.h: Removed WTF_USE_CARBON_SECURE_INPUT_MODE. It's now only used by Chromium,
+        and shouldn't be enabled on any other platforms, so there is no reason to make it
+        configurable via Platform.h.
+
+2011-04-15  Dmitry Lomov  <dslomov@google.com>
+
+        Reviewed by David Levin.
+
+        Add a sample test case for GTest framework
+        https://bugs.webkit.org/show_bug.cgi?id=58509
+
+        Add an example of GTest testcase, complete with a runner, to JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/tests/RunAllWtfTests.cpp: Added.
+        (main):
+        * wtf/tests/StringTests.cpp: Added.
+
+2011-04-15  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Renaming TRACK feature define to VIDEO_TRACK
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoffrey Garen.
+
+        Hide DFG_JIT_RESTRICTIONS behind ARITHMETIC_OP() macro, and rename
+        m_regressionGuard to m_parseFailed, such that it can be reused for
+        other failure cases.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parse):
+
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 58620 - DFG JIT - loading of arguments should not be lazy
+
+        This optimization is overly simplistic. It only works because we never
+        write out definitions to arguments (since we currently only compile
+        single block functions). Revert this for now, we may want to reintroduce
+        something like this again in the future, but it will need to be aware
+        how to schedule definitions to arguments versus lazy loads that have not
+        yet been performed.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::needsSpill):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillInteger):
+        (JSC::DFG::JITCodeGenerator::fillDouble):
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::initConstantInfo):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::fillNumericToDouble):
+        (JSC::DFG::JITCompiler::fillInt32ToInteger):
+        (JSC::DFG::JITCompiler::fillToJS):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::isKnownInteger):
+        (JSC::DFG::NonSpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 58600 - DFG JIT bugs in ValueToInt, PutByVal
+
+        The bug in PutByVal is that an operand is in JSValueOperand - when this
+        locks an integer into a register it will always retag the value without
+        checking if the register is already locked. This is a problem where the
+        value being stored by a PutByVal is the same as the subscript.
+        The subscript is locked into a register first, as a strict integer.
+        Locking the value results in the subscript being modified.
+
+        The bug in ValueToInt related to the function of sillentFillAllRegisters.
+        The problem is that this method will restore all register values from
+        prior to the call, overwriting the result of the call out. Allow a
+        register to be passed to specifically be excluded from being preserved.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::debugOffset):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::debugOffset):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::debugOffset):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::debugOffset):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::debugAddress):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::debugOffset):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::orPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::debugOffset):
+        (JSC::X86Assembler::X86InstructionFormatter::debugOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGenerationInfo.h:
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::fillJSValue):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::isConstant):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::isConstant):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::valueToNumber):
+        (JSC::DFG::NonSpeculativeJIT::valueToInt32):
+        (JSC::DFG::NonSpeculativeJIT::numberToInt32):
+        (JSC::DFG::NonSpeculativeJIT::isKnownInteger):
+        (JSC::DFG::NonSpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+        (JSC::DFG::NonSpeculativeJIT::silentSpillGPR):
+        (JSC::DFG::NonSpeculativeJIT::silentSpillFPR):
+        (JSC::DFG::NonSpeculativeJIT::silentFillGPR):
+        (JSC::DFG::NonSpeculativeJIT::silentFillFPR):
+        (JSC::DFG::NonSpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::NonSpeculativeJIT::silentFillAllRegisters):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2011-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Drain the mark stack while marking weak handles, not after.
+        https://bugs.webkit.org/show_bug.cgi?id=58574
+
+        Otherwise, items that would have caused more weak handle marking are
+        processed after all weak handle marking has finished, and referenced
+        weak handles get recycled.
+
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles): Removed looping from here, since we
+        want Heap::markRoots to be responsible for draining the mark stack.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots): Moved looping to here, as explained above.
+        
+        For efficiency's sake, drain the mark stack before starting to mark weak
+        handles. Otherwise, items drained while marking weak handles may force
+        an extra trip through the weak handle list.
+
+        For correctness's sake, drain the mark stack each time through the weak
+        handle list. Otherwise, opaque roots that would make weak handles reachable
+        are not discovered until after weak handle marking is over.
+
+2011-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make protected object list in caches window reflect reality
+        https://bugs.webkit.org/show_bug.cgi?id=58565
+
+        Make sure the heap includes objects protected by Strong handles
+        in its list of protected objects.
+
+        * heap/HandleHeap.h:
+        * heap/Heap.cpp:
+        (JSC::HandleHeap::protectedObjectTypeCounts):
+
+2011-04-14  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        Don't emit RegExp tables for chromium where they are not used
+        https://bugs.webkit.org/show_bug.cgi?id=58544
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * create_regex_tables: Added the "--notables" command line argument.
+
+2011-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix ASSERTs seen on Windows bots.
+
+        * wtf/HashTable.h:
+        (WTF::hashTableSwap): Force MSVC to use the right version of swap.
+
+2011-04-13  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [CMAKE] Separate DerivedSources.
+        https://bugs.webkit.org/show_bug.cgi?id=58427
+
+        * CMakeLists.txt: Change DERIVED_SOURCES_DIR to DERIVED_SOURCES_JAVASCRIPTCORE_DIR.
+
+2011-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Switched DOM wrappers to use HashMap of Weak<T> instead of WeakGCMap<T>
+        https://bugs.webkit.org/show_bug.cgi?id=58482
+        
+        This will allow wrappers to make individual decisions about their lifetimes.
+
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::copyWeak): New function for copying a weak handle.
+        It's wasn't previously possible to perform this operation using HandleHeap
+        API because the HandleHeap doesn't expose its underlying Node structure.
+
+        * heap/Local.h:
+        (JSC::::set):
+        * heap/Strong.h:
+        (JSC::Strong::set): Added ASSERTs to verify that dead objects are not
+        resurrected by placement into handles.
+
+        (JSC::swap): Added a swap helper, so use of Strong<T> inside a hash table
+        is efficient.
+
+        * heap/Weak.h:
+        (JSC::Weak::Weak): Fixed a bug where copying a weak pointer would not
+        copy its weak callback and context.
+
+        (JSC::Weak::operator=): Added an assignment operator, since the default
+        C++ assignment operator did the wrong thing.
+
+        (JSC::Weak::set): Added ASSERTs to verify that dead objects are not
+        resurrected by placement into handles.
+
+        (JSC::swap): Added a swap helper, so use of Strong<T> inside a hash table
+        is efficient, and can be done without copying, which is illegal during
+        the handle finalization phase.
+
+2011-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make PropertyMapEntry use a WriteBarrier for specificValue
+        https://bugs.webkit.org/show_bug.cgi?id=58407
+
+        Make PropertyMapEntry use a WriteBarrier for specificValue, and then
+        propagate the required JSGlobalData through all the methods it ends
+        up being needed.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectSetPrototype):
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::appendSourceToError):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorCreate):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::copy):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::put):
+        (JSC::Structure::getPropertyNames):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+
+2011-04-13  Paul Knight  <pknight@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        BACKTRACE() macro should check for Debug configuration in macro, not WTFReportBacktrace definition
+        https://bugs.webkit.org/show_bug.cgi?id=58405
+
+        The BACKTRACE() macro requires JavaScriptCore be built with a Debug
+        configuration in order for it to be enabled. Move the NDEBUG check to
+        the header so it will be enabled when the calling framework or
+        application is built with a Debug configuration, similar to how
+        ASSERT() and friends work.
+
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+
+2011-04-12  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58131
+
+        Provide a workaround for an obscure Studio 12 compiler bug, which
+        couldn't call src->~T() on a const T *src.
+
+        * wtf/Vector.h:
+
+2011-04-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58395
+        Exceptions thrown from property getters called from Array prototype functions can be missed
+
+        This is caught by an ASSERT in the top of Interpreter::executeCall.
+        Check for exceptions after accessing properties that could be getters.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+            - Add exception checks.
+
+2011-04-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make API callback objects use weak handles to run their finalizers
+        https://bugs.webkit.org/show_bug.cgi?id=58389
+
+        Make the API object's private data struct act as a finalizer for
+        an api object if the callback object has a API defined finalizer.
+
+        * API/JSCallbackObject.cpp:
+        (JSC::JSCallbackObjectData::finalize):
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::init):
+        * heap/Handle.h:
+
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Cleaned up hash traits, and added hash traits for handles
+        https://bugs.webkit.org/show_bug.cgi?id=58381
+
+        * heap/Handle.h:
+        (JSC::HandleBase::swap):
+        (JSC::Handle::Handle):
+        (JSC::Handle::swap): Implemented swap, so we can rehash efficiently, and
+        without creating new handles (which is not allowed during handle finalization).
+
+        * heap/Strong.h:
+        (JSC::Strong::swap): Use new SimpleClassHashTraits to avoid duplication.
+
+        * heap/Weak.h:
+        (JSC::Weak::isHashTableDeletedValue):
+        (JSC::Weak::Weak):
+        (JSC::Weak::swap):
+        (JSC::Weak::hashTableDeletedValue): Ditto.
+
+        * wtf/HashTraits.h:
+        (WTF::SimpleClassHashTraits::constructDeletedValue):
+        (WTF::SimpleClassHashTraits::isDeletedValue): Added SimpleClassHashTraits,
+        which are analogous to SimpleClassVectorTraits, since they are used in a
+        bunch of places.
+
+        * wtf/RetainPtr.h: Use new SimpleClassHashTraits to avoid duplication.
+
+        * wtf/text/StringHash.h: Use new SimpleClassHashTraits to avoid duplication.
+
+2011-04-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Cleaned up some Vector traits, and added missing Vector traits for handles
+        https://bugs.webkit.org/show_bug.cgi?id=58372
+
+        * heap/Local.h: Inherit from SimpleClassVectorTraits to avoid duplication.
+
+        * heap/Strong.h: Ditto.
+
+        * heap/Weak.h: Ditto.
+
+        * parser/JSParser.cpp: Fixed a traits error. No test case because this
+        particular trait is not currently exercised by the parser.
+
+        * runtime/UString.h: No need to override canInitializeWithMemset, since
+        our base class sets it to true.
+
+        * wtf/VectorTraits.h: Inherit from VectorTraitsBase to avoid duplication.
+
+        * wtf/text/WTFString.h: No need to override canInitializeWithMemset, since
+        our base class sets it to true.
+
+2011-04-12  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Enable JIT build for SH4 platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=58317
+        enable JIT build for QT backend  for SH4 platforms.
+
+        * JavaScriptCore.pro:
+        * wtf/Platform.h:
+
+2011-04-11  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=58289
+
+        Fix compilation on Solaris/Studio 12 C++ in wtf/FastMalloc.cpp,
+        WTF::TCMalloc_PageHeap::runScavengerThread(void*) expected to return a value.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_PageHeap::runScavengerThread):
+
+2011-04-11  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Headers used outside of JavaScriptCore need to be marked as private.
+
+2011-04-11  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix a few builds.
+        
+        Updated a few more build configurations for file moves.
+
+        * CMakeListsWinCE.txt:
+
+2011-04-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 58263 - Use EncodedValueDescriptor on both JSVALUE32_64, JSVALUE64
+
+        The JSJITInterface already uses EncodedValueDescriptor to access the tag/payload
+        separately on JSVALUE64, even though EncodedValueDescriptor is not used in
+        JSVALUE64's implementation of JSValue. Remove the separate definition for m_ptr
+        on X86_64. Using the union allows us to remove a layer of makeImmediate()/
+        immedaiteValue() methods.
+
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emitSlow_op_not):
+        * runtime/JSCell.h:
+        * runtime/JSValue.h:
+        * runtime/JSValueInlineMethods.h:
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::asCell):
+
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix a few builds.
+        
+        Updated a few more build configurations for file moves.
+
+        * CMakeListsEfl.txt:
+        * wscript:
+
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Updated a file name.
+
+        * CMakeLists.txt:
+
+2011-04-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+        
+        Moved remaining heap implementation files to the heap folder.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/ConservativeRoots.cpp: Copied from runtime/ConservativeSet.cpp.
+        * heap/ConservativeRoots.h: Copied from runtime/ConservativeSet.h.
+        * heap/Handle.h:
+        * heap/Heap.cpp:
+        * heap/MachineStackMarker.cpp: Copied from runtime/MachineStackMarker.cpp.
+        * heap/MachineStackMarker.h: Copied from runtime/MachineStackMarker.h.
+        * heap/MarkStack.cpp: Copied from runtime/MarkStack.cpp.
+        * heap/MarkStack.h: Copied from runtime/MarkStack.h.
+        * heap/MarkStackPosix.cpp: Copied from runtime/MarkStackPosix.cpp.
+        * heap/MarkStackSymbian.cpp: Copied from runtime/MarkStackSymbian.cpp.
+        * heap/MarkStackWin.cpp: Copied from runtime/MarkStackWin.cpp.
+        * heap/MarkedBlock.cpp: Copied from runtime/MarkedBlock.cpp.
+        * heap/MarkedBlock.h: Copied from runtime/MarkedBlock.h.
+        * heap/MarkedSpace.cpp: Copied from runtime/MarkedSpace.cpp.
+        * heap/MarkedSpace.h: Copied from runtime/MarkedSpace.h.
+        * interpreter/RegisterFile.cpp:
+        * runtime/ConservativeSet.cpp: Removed.
+        * runtime/ConservativeSet.h: Removed.
+        * runtime/MachineStackMarker.cpp: Removed.
+        * runtime/MachineStackMarker.h: Removed.
+        * runtime/MarkStack.cpp: Removed.
+        * runtime/MarkStack.h: Removed.
+        * runtime/MarkStackPosix.cpp: Removed.
+        * runtime/MarkStackSymbian.cpp: Removed.
+        * runtime/MarkStackWin.cpp: Removed.
+        * runtime/MarkedBlock.cpp: Removed.
+        * runtime/MarkedBlock.h: Removed.
+        * runtime/MarkedSpace.cpp: Removed.
+        * runtime/MarkedSpace.h: Removed.
+
+2011-04-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-04-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 58198 - Clean up JSValue implementation for JSVALUE64
+
+        Remove JSNumberCell, JSImmediate, unify some methods between JSVALUE32_64/JSVALUE64
+
+        JSNumberCell.h largely just contained the constructors for JSValue on JSVALUE64,
+        which should not have been here.  JSImmediate mostly contained uncalled methods,
+        along with the internal implementation of the JSValue constructors split unnecessarily
+        across a number of layers of function calls. These could largely be merged back
+        together. Many methods and constructors from JSVALUE32_64 and JSVALUE64 can by unified.
+
+        The .cpp files were empty.
+
+        Moving all these methods into JSValue.h seems to be a repro measurable regression, so
+        I have kept these methods in a separate JSValueInlineMethods.h. Adding the 64-bit tag
+        values as static const members of JSValue also measures as a repro regression, so I
+        have made these #defines.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+            - Removed class JSImmediate.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+            - Removed class JSImmediate.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Removed class JSImmediate.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+            - Removed class JSImmediate.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate):
+            - Removed class JSImmediate.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emitSlow_op_not):
+            - Removed class JSImmediate.
+        * jit/JSInterfaceJIT.h:
+            - Removed class JSImmediate.
+        * runtime/JSCell.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSImmediate.cpp: Removed.
+        * runtime/JSImmediate.h: Removed.
+        * runtime/JSNumberCell.cpp: Removed.
+        * runtime/JSNumberCell.h: Removed.
+            - Removed.
+        * runtime/JSObject.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSString.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * runtime/JSValue.h:
+            - Added tags for JSVALUE64, moved out some JSVALUE32_64 methods, unified with JSVALUE64.
+        * runtime/JSValueInlineMethods.h: Added.
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::asUInt32):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::JSValue::toJSNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::isDouble):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::tag):
+        (JSC::JSValue::payload):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::makeImmediate):
+        (JSC::JSValue::immediateValue):
+        (JSC::reinterpretDoubleToIntptr):
+        (JSC::reinterpretIntptrToDouble):
+            - Methods moved here from JSImmediate.h/JSNumberCell.h/JSValue.h.
+        * runtime/Operations.h:
+            - Removed JSImmediate.h, JSNumberCell.h.
+        * wtf/StdLibExtras.h:
+            - Export bitwise_cast.
+
+2011-04-11  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Oliver Hunt.
+
+        SH4 JIT SUPPORT.
+        https://bugs.webkit.org/show_bug.cgi?id=44329
+
+        Add JIT remaining part for SH4 platforms.
+
+        * assembler/MacroAssemblerSH4.h:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+
+2011-04-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Beth Dakin.
+
+        Moved Heap.h and Heap.cpp to the heap folder, because anything less 
+        would be uncivilized.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp: Copied from JavaScriptCore/runtime/Heap.cpp.
+        * heap/Heap.h: Copied from JavaScriptCore/runtime/Heap.h.
+        * runtime/Heap.cpp: Removed.
+        * runtime/Heap.h: Removed.
+
+2011-04-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove duplicated code from AtomicString::fromUTF8()
+        https://bugs.webkit.org/show_bug.cgi?id=53711
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/text/AtomicString.cpp:
+        (WTF::AtomicString::fromUTF8Internal):
+        * wtf/text/AtomicString.h:
+        (WTF::AtomicString::fromUTF8):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8):
+        * wtf/unicode/UTF8.h:
+
+2011-04-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed.
+
+        Fix build (at least on Lion) by adding some newish header files to
+        PrivateHeaders.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try recommitting some things svn left out of its last commit.
+
+        * heap/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::HandleBase):
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::setSlot):
+        (JSC::Handle::Handle):
+        * heap/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::isValidWeakNode):
+        * heap/HandleHeap.h:
+        (JSC::HandleHeap::globalData):
+
+2011-04-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A few heap-related renames and file moves.
+        
+        WeakGCPtr<T> => Weak<T>
+        Global<T> => Strong<T>
+        collector/ => heap/
+        collector/* => heap/*
+        runtime/WeakGCPtr.h => heap/Weak.h
+        
+        (Eventually, even more files should move into the heap directory. Like
+        Heap.h and Heap.cpp, for example.)
+
+        * API/JSClassRef.h:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SamplingTool.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * collector: Removed.
+        * collector/handles: Removed.
+        * collector/handles/Global.h: Removed.
+        * collector/handles/Handle.h: Removed.
+        * collector/handles/HandleHeap.cpp: Removed.
+        * collector/handles/HandleHeap.h: Removed.
+        * collector/handles/HandleStack.cpp: Removed.
+        * collector/handles/HandleStack.h: Removed.
+        * collector/handles/Local.h: Removed.
+        * collector/handles/LocalScope.h: Removed.
+        * heap: Copied from collector.
+        * heap/Handle.h: Copied from collector/handles/Handle.h.
+        * heap/HandleHeap.cpp: Copied from collector/handles/HandleHeap.cpp.
+        * heap/HandleHeap.h: Copied from collector/handles/HandleHeap.h.
+        * heap/HandleStack.cpp: Copied from collector/handles/HandleStack.cpp.
+        * heap/HandleStack.h: Copied from collector/handles/HandleStack.h.
+        * heap/Local.h: Copied from collector/handles/Local.h.
+        * heap/LocalScope.h: Copied from collector/handles/LocalScope.h.
+        * heap/Strong.h: Copied from collector/handles/Global.h.
+        (JSC::Strong::Strong):
+        (JSC::Strong::~Strong):
+        (JSC::Strong::operator=):
+        * heap/Weak.h: Copied from runtime/WeakGCPtr.h.
+        (JSC::Weak::Weak):
+        (JSC::Weak::~Weak):
+        * heap/handles: Removed.
+        * interpreter/RegisterFile.h:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * runtime/Structure.h:
+        * runtime/WeakGCPtr.h: Removed.
+
+2011-04-08  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r83335.
+        http://trac.webkit.org/changeset/83335
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+        GTK and QT bots are broken
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Ooops, typo, build fix.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+
+2011-04-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 58154 - Add support for comparison operators to the DFG JIT.
+
+        Add support for <, <=, ==, ===, and also !.  Add support for all corresponding
+        bytecode ops, including the not- and -null forms.  Initially add functionally
+        correct support, we'll revisit the performance.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::constantNull):
+        (JSC::DFG::ByteCodeParser::parse):
+            - Add support for parsing of bytecode opcodes, 
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::callOperation):
+            - Add new operation call types, return bool values.
+        * dfg/DFGNode.h:
+            - Add new node types.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+            - Add code generation for new nodes.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationCompareLess):
+        (JSC::DFG::operationCompareLessEq):
+        (JSC::DFG::operationCompareEq):
+        (JSC::DFG::operationCompareStrictEq):
+        (JSC::DFG::dfgConvertJSValueToBoolean):
+        * dfg/DFGOperations.h:
+            - Add operation callbacks to implement new ops.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+            - Add code generation for new nodes.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            - Switched to a simpler <0 check, rather than relying on an internal value in JSImmediate.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+            - Switched to a simpler <0 check, rather than relying on an internal value in JSImmediate.
+        * runtime/JSImmediate.h:
+            - Make tag values public, rather than relying on a friend - this matches JSVALUE32_64.
+
+2011-04-07  Anna Cavender  <annacc@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Setup ENABLE(TRACK) feature define
+        https://bugs.webkit.org/show_bug.cgi?id=53556
+
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [WK2][Qt][GTK] Introduce common use flag for the shared UNIX domain socket IPC implementation
+        https://bugs.webkit.org/show_bug.cgi?id=58030
+
+        * wtf/Platform.h: Introduce USE(UNIX_DOMAIN_SOCKETS) for WebKit2.
+
+2011-04-08  Adam Roben  <aroben@apple.com>
+
+        Clean build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Don't try to delete directories that
+        don't exist. Also switched from del /s to rmdir /s, which has the benefit of deleting the
+        directory itself in addition to the files it contains.
+
+2011-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Some Handle<T> cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=58109
+
+        * bytecode/SamplingTool.h: Sorted alphabetically because that's the
+        WebKit style. Added a Global.h #include that was previously missing
+        but harmless.
+
+        * collector/handles/Global.h:
+        (JSC::Global::Global): Added a null constructor. No need for a special
+        tag, and the tag is incompatible with some data structures.
+        
+        (JSC::Global::isHashTableDeletedValue):
+        (JSC::Global::~Global):
+        (JSC::Global::set):
+        (JSC::Global::operator=):
+        (JSC::Global::clear):
+        (JSC::Global::hashTableDeletedValue): Reordered constructors to be near
+        each other.
+
+        (JSC::Global::setWithWriteBarrier): Renamed internalSet to
+        setWithWriteBarrier for clarity, and funneled more code into using set
+        and setWithWriteBarrier to reduce duplication.
+
+        * collector/handles/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::HandleBase): Removed isEmpty(), since we already have
+        boolean and ! operators.
+
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::setSlot):
+        (JSC::Handle::Handle): Added general support for null Handles. This was
+        previously outlawed by ASSERTs, but our code has grown to support and
+        rely on null Handles.
+        
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::markWeakHandles):
+        (JSC::HandleHeap::finalizeWeakHandles):
+        (JSC::HandleHeap::isValidWeakNode): Migrated from isValidWeakHandle,
+        and beefed this up a bit.
+
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::globalData): Added accessor, used by some new set functions.
+
+        * collector/handles/Local.h: Moved hash traits to the bottom of the file,
+        since this file is about the Local class, not the traits.
+
+        (JSC::::Local): Updated for removal of invalidate().
+
+        (JSC::::operator): Deployed "using" to avoid a lot of this->
+        template funny business.
+
+        (JSC::::setWithSlotCheck): Renamed from internalSet, more specific now.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile): Updated to use null constructor.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::Structure::setEnumerationCache):
+        * runtime/Structure.h: Removed clearEnumerationCache
+        because it was an unused holdover from when the enumeration cache was
+        not a handle.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set): Finish initializing our handle before putting it
+        in the table. This seemed more logical, and at one point was required
+        to avoid triggering an ASSERT.
+
+        * runtime/WeakGCPtr.h: Inherit from Handle instead of rolling our own
+        handle-like behavior, to avoid duplication.
+
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::~WeakGCPtr):
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::clear):
+        (JSC::WeakGCPtr::set):
+        (JSC::WeakGCPtr::setWithWriteBarrier): Removed duplicate code and
+        standardized on Handle idioms.
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Martin Robinson.
+
+        Refactor Gtk build system to separate list of files
+        https://bugs.webkit.org/show_bug.cgi?id=58090
+
+        This is the first step towards generating part of the GTK build system
+        using GYP.  In the first iteration, our plan is to just generate the
+        list of files.  This patch is the first step, which is to separate out
+        the part of JavaScriptCore build system that we intend to generate from
+        the rest of the build system.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am: Added.
+
+2011-04-07  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Mapping booleans the same way as integers
+        https://bugs.webkit.org/show_bug.cgi?id=56913
+
+        Instead of having a seperate tag field for booleans,
+        the logical values are stored in the payload field
+        (for JSValue32_64 representation).
+
+        1.007x speedup on SunSpider.
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitStoreBool):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JSInterfaceJIT.h:
+        * runtime/JSValue.h:
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::getBoolean):
+
+2011-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add stub support for generating Gtk build system from gyp
+        https://bugs.webkit.org/show_bug.cgi?id=58086
+
+        This does not produce a buildable JavaScriptCore, but it
+        does allow running gyp/configure --port=gtk and having
+        it generate a gtk.Makefile which we can use for testing
+        the rest of the plumbing.
+
+        * gyp/gtk.gyp: Added.
+
+2011-04-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Revert ENABLE_TRACK patch due to compile failures.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2011-04-07  Adam Barth  <abarth@webkit.org>
+
+        Fix whitespace in GNUmakefile.am.
+
+        * GNUmakefile.am:
+
+2011-04-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix a couple of typos in comments that Darin spotted.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        * runtime/JSImmediate.h:
+
+2011-04-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+        Bug 58057 - Store boolean payload in low bit of JSImmediate
+
+        And remove some uncalled functions from JSImmediate.h
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_not):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::asInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::asUInt32):
+
+2011-04-07  Liang Qi  <liang.qi@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Enable webkit build with GCCE on Symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=57841
+
+        * wtf/MathExtras.h: GCCE compiler doesn't support those std static functions.
+
+2011-04-06  Dai Mikurube  <dmikurube@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add QUOTA build flag for unified quota API
+        https://bugs.webkit.org/show_bug.cgi?id=57918
+
+        * Configurations/FeatureDefines.xcconfig: Added QUOTA build flag
+
+2011-04-06  Kevin Ollivier  <kevino@theolliviers.com>
+        
+        Reviewed by Darin Adler.
+        
+        Make sure JS_EXPORT_PRIVATE is an empty define when we aren't using the export macros.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * config.h:
+
+2011-04-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Stop JSObject::isUsingInlineStorage() from using the structure
+        https://bugs.webkit.org/show_bug.cgi?id=57986
+
+        Make the isUsingInlineStorage() implementation just look at
+        whether the property storage is inside the object.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::JSObject):
+
+2011-04-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        Update comments documenting JSVALUE64/JSVALUE32_64 JSValue representations.
+
+        * runtime/JSImmediate.h:
+        * runtime/JSValue.h:
+
+2011-04-06  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        cmake: Fix build for ARMv7
+
+        * CMakeLists.txt: add missing file.
+
+2011-04-06  Liang Qi  <liang.qi@nokia.com>
+
+        Reviewed by Benjamin Poulain.
+
+        Correct a include file name.
+        https://bugs.webkit.org/show_bug.cgi?id=57839
+
+        * wtf/PageAllocatorSymbian.h: It should be case sensitive. This fix 
+        builds on Unix hosts.
+
+2011-04-06  Adam Roben  <aroben@apple.com>
+
+        Build fix after r83056
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Added property svn:executable.
+
+2011-04-06  Adam Roben  <aroben@apple.com>
+
+        Move JavaScriptCoreGenerated's file-copying logic out to a new script
+
+        Hopefully this will make it easier to modify this logic in the future. I also made the
+        script much quieter than the old logic, since it didn't seem helpful to see long lists of
+        filenames during the copying phase.
+
+        If we like this new style, we could copy it for our other projects.
+
+        Fixes <http://webkit.org/b/57950> JavaScriptCoreGenerated's file-copying logic is hard to
+        modify and noisy
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Moved logic to copy
+        files from here...
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: ...to here. (Added.)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Added copy-files.cmd
+        for convenience.
+
+2011-04-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Who likes export files? I do!
+
+2011-04-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Introduced the concept of opaque roots, in preparation for marking the DOM with them
+        https://bugs.webkit.org/show_bug.cgi?id=57903
+
+        * JavaScriptCore.exp: Who likes export files? I do!
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::isValidWeakHandle): Factored out a helper function for ASSERTs.
+
+        (JSC::WeakHandleOwner::~WeakHandleOwner): Moved from header to avoid
+        weak linkage problems.
+
+        (JSC::WeakHandleOwner::isReachableFromOpaqueRoots): New callback.
+        Currently unused.
+
+        (JSC::WeakHandleOwner::finalize): Switched from pure virtual to a
+        default empty implementation, since not all clients necessarily want
+        or need non-trivial finalizers.
+
+        (JSC::HandleHeap::markWeakHandles): Split updateWeakHandles into two
+        passes. The first pass marks all reachable weak handles. The second pass
+        finalizes all unreachable weak handles. This must be two passes because
+        we don't know the set of finalizable weak handles until we're done
+        marking all weak handles.
+
+        (JSC::HandleHeap::finalizeWeakHandles): Use new helper function.
+
+        * collector/handles/HandleHeap.h: Ditto.
+
+        * runtime/Heap.cpp: 
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::reset): Split out handle marking from handle finalization.
+
+        * runtime/MarkStack.cpp:
+        (JSC::MarkStack::reset):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::addOpaqueRoot):
+        (JSC::MarkStack::containsOpaqueRoot):
+        (JSC::MarkStack::opaqueRootCount):
+        (JSC::HeapRootMarker::markStack): New helper functions for managing the
+        set of opaque roots.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::finalize): Renamed to match parent class declaration.
+
+2011-04-05  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Build fix for YarrParser.h
+        https://bugs.webkit.org/show_bug.cgi?id=57822
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+
+2011-04-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Follow-up Windows build fix.
+        Don't skip react-to-vsprops-changes.py for all production builds,
+        only those initiated via JavaScriptCore.make.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2011-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r82849): 85,000+ JSC-related leaks seen on SnowLeopard Intel Leaks
+        https://bugs.webkit.org/show_bug.cgi?id=57857
+
+        Whoops, accidentally removed a deref().
+
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+
+2011-04-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Add per-configuration vsprops files.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Removed inheritance from common.vsprops.
+        Set production environment variable before calling make.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops: Added.
+
+2011-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make caches window show more info about non-jsobject GC values
+        https://bugs.webkit.org/show_bug.cgi?id=57874
+
+        Add ClassInfo to the various internal JS types that currently
+        don't have any, and make the text for caches window show the
+        classname for non-JSObject instances.
+
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/Heap.cpp:
+        (JSC::TypeCounter::typeName):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/ScopeChain.cpp:
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+
+2011-04-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        Cleanup StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=57836
+
+        Don't use PassRefPtr in local variables, properly store in RefPtrs and release on return.
+        Add a makeString() variant taking 9 arguments, needed by a follow-up patch.
+
+        * wtf/text/StringConcatenate.h:
+        (WTF::tryMakeString):
+        (WTF::makeString):
+
+2011-04-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82876.
+        http://trac.webkit.org/changeset/82876
+        https://bugs.webkit.org/show_bug.cgi?id=57816
+
+        Caused a lot of test crashes (Requested by tkent on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::fastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::tryFastRealloc):
+        (WTF::fastRealloc):
+        (WTF::fastMallocSize):
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMallocStats::malloc):
+        (WTF::TCMallocStats::free):
+        (WTF::TCMallocStats::fastCalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::calloc):
+        (WTF::TCMallocStats::fastRealloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        (WTF::TCMallocStats::realloc):
+        (WTF::TCMallocStats::fastMallocSize):
+        * wtf/FastMalloc.h:
+        (WTF::Internal::fastMallocMatchValidationType):
+        (WTF::Internal::fastMallocMatchValidationValue):
+        (WTF::Internal::setFastMallocMatchValidationType):
+        (WTF::fastMallocMatchValidateFree):
+        * wtf/Platform.h:
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Stop JSCell.h from including Structure.h
+        https://bugs.webkit.org/show_bug.cgi?id=57809
+
+        * runtime/GetterSetter.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toThisObject):
+        * runtime/JSString.h:
+        * runtime/ScopeChain.h:
+        * runtime/Structure.h:
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        (JSC::JSCell::classInfo):
+        (JSC::JSCell::createDummyStructure):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::MarkStack::internalAppend):
+        * runtime/StructureChain.h:
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Fix clang build.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Remove accidental change to Platform.h
+
+        * wtf/Platform.h:
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a weak-handle-related leak in RegisterFile
+        https://bugs.webkit.org/show_bug.cgi?id=57793
+
+        * interpreter/RegisterFile.cpp: Nixed leaky GlobalObjectNotifier.
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::GlobalObjectOwner::finalize):
+        (JSC::RegisterFile::RegisterFile): Replaced GlobalObjectNotifier with
+        a per-RegisterFile weak handle owner, which does not leak.
+
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::set): Allow set() to take a context argument, since
+        RegisterFile now needs this. (Seems like it was an accidental omission
+        all along.)
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make malloc validation useful
+        https://bugs.webkit.org/show_bug.cgi?id=57502
+
+        This patch changes FAST_MALLOC_MATCH_VALIDATION with a general
+        corruption check that tags the beginning and end of all allocations
+        to check for write overflows and overwrites the contents of
+        memory on free in order to (hopefully) show up use-after-free issues
+        sooner.
+
+        We also turn it on by default for debug builds.
+
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::tryFastMalloc):
+        (WTF::fastMalloc):
+        (WTF::tryFastCalloc):
+        (WTF::fastCalloc):
+        (WTF::fastFree):
+        (WTF::tryFastRealloc):
+        (WTF::fastRealloc):
+        (WTF::TCMalloc_PageHeap::isScavengerSuspended):
+        (WTF::TCMalloc_PageHeap::scheduleScavenger):
+        (WTF::TCMalloc_PageHeap::suspendScavenger):
+        (WTF::TCMalloc_PageHeap::signalScavenger):
+        (WTF::TCMallocStats::malloc):
+        (WTF::TCMallocStats::free):
+        (WTF::TCMallocStats::fastCalloc):
+        (WTF::TCMallocStats::tryFastCalloc):
+        (WTF::TCMallocStats::calloc):
+        (WTF::TCMallocStats::fastRealloc):
+        (WTF::TCMallocStats::tryFastRealloc):
+        (WTF::TCMallocStats::realloc):
+        * wtf/FastMalloc.h:
+        (WTF::Internal::fastMallocValidationHeader):
+        (WTF::Internal::fastMallocValidationSuffix):
+        (WTF::Internal::fastMallocMatchValidationType):
+        (WTF::Internal::setFastMallocMatchValidationType):
+        (WTF::fastMallocMatchValidateFree):
+        (WTF::fastMallocValidate):
+        * wtf/Platform.h:
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Renamed clearWeakPointers => updateWeakHandles and removed misleading comment
+        https://bugs.webkit.org/show_bug.cgi?id=57790
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::updateWeakHandles): Updated for rename.
+
+        * collector/handles/HandleHeap.h: Removed comment claiming that this
+        function should only be called during teardown, because it's actually
+        called after every GC pass.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots): Updated for rename.
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Standardized handling of handles for immediate values
+        https://bugs.webkit.org/show_bug.cgi?id=57788
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Don't check for null or non-cell
+        values here, because our write barrier guarantees that such values are
+        not in the weak list.
+
+        (JSC::HandleHeap::writeBarrier): Standardized on checking for null before
+        checking for cell, and on using early return instead of if/else.
+
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::deallocate):
+        (JSC::HandleHeap::makeWeak): Ditto.
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Removed a redundant variable from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57786
+        
+        Forgot to commit the file that actually removes the data member!
+        
+        * collector/handles/HandleHeap.h:
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed a redundant variable from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57786
+        
+        We don't need a specific variable to indicate that we're in the middle
+        of the finalization phase, since m_nextToFinalize already does this.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::HandleHeap):
+        (JSC::HandleHeap::clearWeakPointers):
+        (JSC::HandleHeap::writeBarrier):
+
+2011-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Renamed Finalizer => WeakHandleOwner (in preparation for adding a reachability callback)
+        https://bugs.webkit.org/show_bug.cgi?id=57775
+        
+        Also renamed noFinalizer => emptyWeakOwner, since this is really an
+        optimization for a weak owner with empty callbacks.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Updated for renames. Removed
+        redundant initialization of m_nextToFinalize. Moved deletion check inside
+        weak owner check, since the weak owner can't delete the node if there is
+        no weak owner!
+
+        * collector/handles/HandleHeap.h:
+        (JSC::WeakHandleOwner::~WeakHandleOwner):
+        (JSC::HandleHeap::makeWeak): Updated for renames.
+
+        (JSC::HandleHeap::hasWeakOwner): Changed getFinalizer to hasWeakOwner,
+        to clarify this function's role in assertions.
+
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::makeWeak):
+        (JSC::HandleHeap::Node::isWeak):
+        (JSC::HandleHeap::Node::weakOwner):
+        (JSC::HandleHeap::Node::weakOwnerContext):
+        (JSC::HandleHeap::Node::emptyWeakOwner):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::globalObjectCollectedNotifier):
+        * interpreter/RegisterFile.h:
+        * runtime/WeakGCMap.h:
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::set): Updated for renames.
+
+2011-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Fix WinCE build.
+
+        * bytecode/Instruction.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+
+2011-04-04  Adam Roben  <aroben@apple.com>
+
+        Delete mt.dep files when doing a clean build due to .vsprops file changes
+
+        Apparently this is yet another file that Visual Studio can't figure out it needs to rebuild.
+
+        Fixes <http://webkit.org/b/57777> r82850 failed to build on Windows Debug (Build)
+
+        Reviewed by Brian Weinstein.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Added dep to the list of extensions we look for when choosing files to delete.
+
+2011-04-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make StructureChain GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=56695
+
+        Make StructureChain GC allocated, and make the various owners
+        mark it correctly.
+
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * collector/handles/Handle.h:
+        (JSC::HandleConverter::operator->):
+        (JSC::HandleConverter::operator*):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::markAggregate):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        (JSC::StructureChain::~StructureChain):
+        (JSC::StructureChain::markChildren):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::createStructure):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+
+2011-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some complexity from HandleHeap
+        https://bugs.webkit.org/show_bug.cgi?id=57650
+        
+        Eliminated pointer-tagging flags.
+        
+        Tied being weak to having a finalizer (or at least a finalizer sentinel).
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers): Removed the special self-destroying
+        flag. It was unused. If we bring it back, we'll probably use a shared
+        autodeallocating finalizer instead.
+
+        * collector/handles/HandleHeap.h:
+        (JSC::HandleHeap::makeWeak): makeWeak and adding a finalizer are now
+        a single, atomic operation -- this makes the relationship between
+        finalizers and weak pointers clearer, and impossible to get wrong.
+
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::handleHeap): No more flags.
+
+        (JSC::HandleHeap::Node::makeWeak):
+        (JSC::HandleHeap::Node::isWeak): Ditto above. We use a special sentienl
+        value in the finalizer slot to indicate that a handle is weak but doesn't
+        require an external function call for finalization.
+
+2011-04-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed WeakGCMap::deprecatedRemove because it was deprecated and unused
+        https://bugs.webkit.org/show_bug.cgi?id=57648
+
+        * runtime/WeakGCMap.h:
+
+2011-04-01  Adam Roben  <aroben@apple.com>
+
+        Maintain the invariant that Lexer::m_current is set to -1 when at the end of the code buffer
+
+        Covered by existing tests.
+
+        Fixes <http://webkit.org/b/56699>.
+
+        Reviewed by Oliver Hunt.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::setOffset): Copied code from Lexer::shift to update m_current, because
+        supposedly the idiom that function uses is fast.
+
+2011-03-31  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Oliver Hunt.
+
+        SH4 JIT SUPPORT.
+        https://bugs.webkit.org/show_bug.cgi?id=44329
+
+        Add YARR support for SH4 platforms (disabled by default).
+
+        * GNUmakefile.am:
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerSH4.cpp: Added.
+        * assembler/MacroAssemblerSH4.h: Added.
+        * assembler/SH4Assembler.h: Added.
+        * yarr/YarrJIT.cpp:
+
+2011-03-30  Adam Roben  <aroben@apple.com>
+
+        Clean build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Serialized project dependencies so projects
+        don't try to build in parallel (which doesn't mesh with our buildfailed mechanism).
+
+2011-03-30  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r82500
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+
+2011-03-29  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Use the Accelerate vImage vectorized (un)premultiplyImageData functions for ImageBufferCG
+
+        https://bugs.webkit.org/show_bug.cgi?id=53134
+
+        * wtf/Platform.h: Added in WTF flag for using the Accelerate framework
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Share most vsprops between Release and Production builds in releaseproduction.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=57508
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscRelease.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiRelease.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops:
+
+2011-03-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Explicitly prevent testapi and minidom from being installed rather than relying
+        on Xcode's current behavior of not installing if INSTALL_PATH is not explicitly
+        set at the target level.
+
+        <rdar://problem/9206357>
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-03-30  Timur Iskhodzhanov  <timurrrr@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add some dynamic annotations to JavaScriptCore/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=53747
+
+        By using these annotations we can improve the precision of finding
+        WebKit errors using dynamic analysis tools like ThreadSanitizer and Valgrind.
+        These annotations don't affect the compiled binaries unless USE(DYNAMIC_ANNOTATIONS) is "1".
+
+        These files don't add new functionality, so don't need extra tests.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/DynamicAnnotations.cpp: Added.
+        (WTFAnnotateBenignRaceSized):
+        (WTFAnnotateHappensBefore):
+        (WTFAnnotateHappensAfter):
+        * wtf/DynamicAnnotations.h: Added.
+        * wtf/ThreadSafeRefCounted.h:
+        (WTF::ThreadSafeRefCountedBase::derefBase):
+        * wtf/text/StringStatics.cpp:
+        (WTF::StringImpl::empty):
+
+2011-03-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make StructureChain GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=56695
+
+        Make StructureChain GC allocated, and make the various owners
+        mark it correctly.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        (JSC::PolymorphicAccessStructureList::markAggregate):
+        (JSC::Instruction::Instruction):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::markAggregate):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::get):
+        (JSC::JSPropertyNameIterator::markChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+        * runtime/Structure.h:
+        (JSC::Structure::cachedPrototypeChainSlot):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::createStructure):
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Rename Windows configuration Release_LTCG to Production for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=57465
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops: Removed.
+
+2011-03-30  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add the NEXT_OPCODE() macro to the DFG-JIT parser
+        https://bugs.webkit.org/show_bug.cgi?id=57322
+
+        In JavaScriptCore we use macros to jump to the next opcode
+        (both in interpreter and JIT). This macro is added to the
+        DFG-JIT parser as well.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+
+2011-03-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ~25% regression on v8-splay in the SunSpider harness
+        https://bugs.webkit.org/show_bug.cgi?id=56128
+        
+        I'm not sure if this is the root cause of the regression Stephanie
+        measured, but it seems to get us back to previous v8-splay times.
+        
+        SunSpider reports no change. v8-splay says 41% faster.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Make marking proportional to 1X the size of the heap,
+        not .5X the size of the heap. When the heap is large, this makes a big
+        difference. (Our old heap growth policy matched this. You can see by
+        looking at resizeBlocks in revisions prior to r77699.)
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Use per-configuration vsprops in JavaScriptCore to avoid WebKitVSPropsRedirectionDir removal by MSVC IDE
+        https://bugs.webkit.org/show_bug.cgi?id=57350
+        
+        Visual Studio's IDE was removing instances of $(WebKitVSPropsRedirectionDir) from
+        InheritedPropertySheet rules in our vcproj files when the vcproj was edited from within
+        the IDE. To avoid this, add a separate vsprops file for each project configuration that
+        contains the required inherited property sheets.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTFDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/jsc/jscDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleaseLTCG.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapiDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiRelease.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseLTCG.vsprops: Added.
+
+2011-03-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r82173): Causes assertion and test failures in run-javascriptcore-tests on Windows (Requested by aroben on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=57333
+
+        constructDate now takes the global object explicitly as it may be called
+        by functions other than the constructor itself.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeDate):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::constructWithDateConstructor):
+        * runtime/DateConstructor.h:
+
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Benjamin Poulain.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41953
+
+        Fix compile error on Solaris 10/Sun Studio 12 CC emanating from MathExtras.h
+
+        * wtf/MathExtras.h:
+
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57231
+        Add conditional for SUNCC supporting alignment macros
+
+        Compile fix for Solaris 10/Sun Studio 12 CC
+
+        * wtf/Vector.h:
+
+2011-03-29  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57256
+
+        Fix crash on misaligned reads on Solaris 10/Sparc
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::equal):
+
+2011-03-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        instanceof Array test fails when using iframes
+        https://bugs.webkit.org/show_bug.cgi?id=17250
+
+        This is a problem with all built in constructors, the use of
+        lexicalGlobalObject rather than the constructors own 
+        global object reference means that a builtin will always use
+        the prototype from the lexical global object rather than that
+        of the constructors origin.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeRegExp):
+        * JavaScriptCore.exp:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateInstance.cpp:
+        * runtime/DateInstance.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructWithErrorConstructor):
+        (JSC::callErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructWithFunctionConstructor):
+        (JSC::callFunctionConstructor):
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnPropertySlot):
+        (JSC::JSCell::put):
+        (JSC::JSCell::deleteProperty):
+        (JSC::JSCell::toThisObject):
+        (JSC::JSCell::toObject):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::toObject):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toObject):
+        * runtime/JSNotAnObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toObject):
+        * runtime/JSObject.h:
+        * runtime/JSString.cpp:
+        (JSC::StringObject::create):
+        (JSC::JSString::toObject):
+        (JSC::JSString::toThisObject):
+        * runtime/JSString.h:
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::toThisObjectSlowCase):
+        (JSC::JSValue::synthesizeObject):
+        * runtime/JSValue.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::constructWithObjectConstructor):
+        (JSC::callObjectConstructor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        (JSC::constructWithRegExpConstructor):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        * runtime/StringObject.h:
+
+2011-03-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        REGRESSION [r78794-r79249] Allocation of memory is slow when number of active objects is large
+        https://bugs.webkit.org/show_bug.cgi?id=56823
+        
+        Partial fix for most of the problem. (TOT still shows a regression, though.)
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reportExtraMemoryCostSlowCase): Use highWaterMark(), instead of
+        capacity(), since capacity() is O(n) relative to the size of the heap.
+
+        In limited circumstances, capacity() is also worse than highWaterMark()
+        for measuring extra cost relative to heap size, since capacity() only
+        measures the *current* capacity of the heap, but the heap will grow if
+        necessary to attain highWaterMark().
+
+2011-03-28  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION(r82130): It made all tests crash (Requested by Ossy on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=57251
+
+        Build fix, had remnant of another patch in r82130
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+
+2011-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add additional immediate types to allow us to distinguish the source of a JIT immediate
+        https://bugs.webkit.org/show_bug.cgi?id=57190
+
+        Allow us to distinguish whether a JIT immediate is a value that we
+        control (TrustedImm32 and TrustedImmPtr) vs. ones that can be controlled
+        or influenced by code we are compiling.  Currently we do nothing with this
+        information -- this change is large and mechanical but would obscure any
+        logic changes that we would have made.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
+        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
+        (JSC::AbstractMacroAssembler::TrustedImm32::TrustedImm32):
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::setPtr):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::branchSubPtr):
+        (JSC::MacroAssembler::branchTest8):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::mul32):
+        (JSC::MacroAssemblerARM::or32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::urshift32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::push):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARM::branch16):
+        (JSC::MacroAssemblerARM::branchTest8):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::branchMul32):
+        (JSC::MacroAssemblerARM::branchSub32):
+        (JSC::MacroAssemblerARM::set32Compare32):
+        (JSC::MacroAssemblerARM::set8Compare32):
+        (JSC::MacroAssemblerARM::set32Test32):
+        (JSC::MacroAssemblerARM::set32Test8):
+        (JSC::MacroAssemblerARM::moveWithPatch):
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::storePtrWithPatch):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::add32):
+        (JSC::MacroAssemblerARMv7::and32):
+        (JSC::MacroAssemblerARMv7::lshift32):
+        (JSC::MacroAssemblerARMv7::mul32):
+        (JSC::MacroAssemblerARMv7::or32):
+        (JSC::MacroAssemblerARMv7::rshift32):
+        (JSC::MacroAssemblerARMv7::urshift32):
+        (JSC::MacroAssemblerARMv7::sub32):
+        (JSC::MacroAssemblerARMv7::xor32):
+        (JSC::MacroAssemblerARMv7::load32):
+        (JSC::MacroAssemblerARMv7::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARMv7::load16):
+        (JSC::MacroAssemblerARMv7::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARMv7::store32):
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::push):
+        (JSC::MacroAssemblerARMv7::move):
+        (JSC::MacroAssemblerARMv7::compare32):
+        (JSC::MacroAssemblerARMv7::test32):
+        (JSC::MacroAssemblerARMv7::branch32):
+        (JSC::MacroAssemblerARMv7::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerARMv7::branch16):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest32):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::branchAdd32):
+        (JSC::MacroAssemblerARMv7::branchMul32):
+        (JSC::MacroAssemblerARMv7::branchSub32):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::set32Compare32):
+        (JSC::MacroAssemblerARMv7::set8Compare32):
+        (JSC::MacroAssemblerARMv7::set32Test32):
+        (JSC::MacroAssemblerARMv7::set32Test8):
+        (JSC::MacroAssemblerARMv7::moveWithPatch):
+        (JSC::MacroAssemblerARMv7::branchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::storePtrWithPatch):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        (JSC::MacroAssemblerARMv7::setupArmAddress):
+        (JSC::MacroAssemblerARMv7::makeBaseIndexBase):
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::rshift32):
+        (JSC::MacroAssemblerMIPS::urshift32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::xor32):
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::push):
+        (JSC::MacroAssemblerMIPS::move):
+        (JSC::MacroAssemblerMIPS::branch8):
+        (JSC::MacroAssemblerMIPS::branch32):
+        (JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::branch16):
+        (JSC::MacroAssemblerMIPS::branchTest32):
+        (JSC::MacroAssemblerMIPS::branchTest8):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+        (JSC::MacroAssemblerMIPS::set8Compare32):
+        (JSC::MacroAssemblerMIPS::set32Compare32):
+        (JSC::MacroAssemblerMIPS::set32Test8):
+        (JSC::MacroAssemblerMIPS::set32Test32):
+        (JSC::MacroAssemblerMIPS::moveWithPatch):
+        (JSC::MacroAssemblerMIPS::branchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::storePtrWithPatch):
+        (JSC::MacroAssemblerMIPS::tailRecursiveCall):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add32):
+        (JSC::MacroAssemblerX86::addWithCarry32):
+        (JSC::MacroAssemblerX86::and32):
+        (JSC::MacroAssemblerX86::or32):
+        (JSC::MacroAssemblerX86::sub32):
+        (JSC::MacroAssemblerX86::store32):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::lshift32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::rshift32):
+        (JSC::MacroAssemblerX86Common::urshift32):
+        (JSC::MacroAssemblerX86Common::sub32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::store32):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::push):
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        (JSC::MacroAssemblerX86Common::set8Compare32):
+        (JSC::MacroAssemblerX86Common::set32Compare32):
+        (JSC::MacroAssemblerX86Common::set32Test8):
+        (JSC::MacroAssemblerX86Common::set32Test32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::and32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::sub32):
+        (JSC::MacroAssemblerX86_64::loadDouble):
+        (JSC::MacroAssemblerX86_64::addDouble):
+        (JSC::MacroAssemblerX86_64::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::tailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        (JSC::MacroAssemblerX86_64::andPtr):
+        (JSC::MacroAssemblerX86_64::orPtr):
+        (JSC::MacroAssemblerX86_64::subPtr):
+        (JSC::MacroAssemblerX86_64::xorPtr):
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::setPtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::moveWithPatch):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::callOperation):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jitAssertIsInt32):
+        (JSC::DFG::JITCompiler::emitCount):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::emitPutImmediateToCallFrameHeader):
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emitSlow_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitAdd32Constant):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSub32Constant):
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        (JSC::JIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JIT::emitLoadCharacterString):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+        (JSC::JIT::emitCount):
+        (JSC::JIT::sampleInstruction):
+        (JSC::JIT::sampleCodeBlock):
+        (JSC::JIT::emitStoreInt32):
+        (JSC::JIT::emitStoreCell):
+        (JSC::JIT::emitStoreBool):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_init_lazy_reg):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        (JSC::JIT::emit_op_new_regexp):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        (JSC::JIT::emit_op_new_func):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_push_new_scope):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::softModulo):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter):
+        (JSC::JIT::emit_op_put_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::addArgument):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::emitLoadDouble):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        (JSC::SpecializedThunkJIT::tagReturnAsJSCell):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charToString):
+        (JSC::powThunkGenerator):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+        (JSC::Yarr::YarrGenerator::storeToFrame):
+        (JSC::Yarr::YarrGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::YarrGenerator::ParenthesesTail::generateCode):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+        (JSC::Yarr::YarrGenerator::generateDisjunction):
+
+2011-03-28  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Fix the linking of jsc with MinGW after r81963.
+
+        * jsc.pro: add -l and remove the lib suffix.
+
+2011-03-27  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57170  Fix last elements
+        in an enum to remove a trailing comma. Sun Studio 12 CC errors out.
+
+        Compile fix only, no actual code change.
+
+        * wtf/MessageQueue.h:
+
+2011-03-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow defineOwnProperty to work on DOMObjects
+        https://bugs.webkit.org/show_bug.cgi?id=57129
+
+        Fix a couple of places where we uses getter()/setter() rather
+        than [gs]etterPresent().
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+
+2011-03-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash when paused at a breakpoint caused by inaccurate Activation records.
+        https://bugs.webkit.org/show_bug.cgi?id=57120
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Crash in debugger beneath MarkStack::drain @ me.com, ibm.com
+        https://bugs.webkit.org/show_bug.cgi?id=57080
+        <rdar://problem/8525907>
+
+        The crash was caused by changes in the executable after recompilation.
+
+        The fix is for the activation to copy the data it needs instead of
+        relying on the data in the executable.
+        
+        SunSpider and v8 report no change.
+
+        * runtime/Arguments.h:
+        (JSC::JSActivation::copyRegisters): Use our own data members instead of
+        reading data out of the executable.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation): Initialize our data members.
+
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        (JSC::JSActivation::isDynamicScope):
+        (JSC::JSActivation::argumentsGetter): Use our own data members instead of
+        reading data out of the executable.
+
+        * runtime/JSActivation.h: Added new data members to track data previously
+        tracked by the executable. Since I've removed the executable pointer,
+        on a 64bit system, I've only made activations bigger by an int.
+
+2011-03-25  David Kilzer  <ddkilzer@apple.com>
+
+        Remove duplicate entry from JavaScriptCore.exp
+
+        JSC::createStackOverflowError(JSC::ExecState*) was originally
+        exported in r60057, then duplicated in r60392.
+
+        * JavaScriptCore.exp: Removed duplicate entry.
+
+2011-03-25  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] MSVC Build Error - need to link advapi32.lib for jsc.exe
+        https://bugs.webkit.org/show_bug.cgi?id=56098
+
+        Need to link advapi32.lib for jsc.exe since wtf/OSRandomSource.cpp uses the Win32 Crypto API
+
+        * jsc.pro:
+
+2011-03-24  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF HexNumber.h
+        https://bugs.webkit.org/show_bug.cgi?id=56099
+
+        Introduce a set of functions that ease converting from a bye or a number to a hex string,
+        replacing several of these conversions and String::format("%x") usages all over WebCore.
+
+        * GNUmakefile.am: Add HexNumber.h to build.
+        * JavaScriptCore.exp: Export StringBuilder::reserveCapacity.
+        * JavaScriptCore.gypi: Add HexNumber.h to build.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export StringBuilder::reserveCapacity.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add HexNumber.h to build.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * wtf/CMakeLists.txt: Ditto.
+        * wtf/HexNumber.h: Added.
+        (WTF::Internal::hexDigitsForMode): Internal helper.
+        (WTF::appendByteAsHex): Free function, that appends a byte as hex string into a destination.
+        (WTF::placeByteAsHex): Ditto, but places the result using *foo++ = '..' or foo[index++] = '..'
+        (WTF::appendUnsignedAsHex): Free function, that appends a number as hex string into a destination.
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 2: Add new symobl.
+        
+        (I should have used the EWS bots for this!)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 1: Removed old symobl.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ensure that all compilation takes place within a dynamic global object scope
+        https://bugs.webkit.org/show_bug.cgi?id=57054
+        <rdar://problem/9083011>        
+
+        Otherwise, entry to the global object scope might throw away the code
+        we just compiled, causing a crash.
+
+        * JavaScriptCore.exp: Updated for signature change.
+
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Removed explicit compilation calls
+        here because (a) they took place outside a dynamic global object scope
+        and (b) they were redundant.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall): Updated for signature change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct): Declare our dynamic global object
+        scope earlier, to ensure that compilation takes place within it.
+
+        * runtime/Completion.cpp:
+        (JSC::evaluate): Removed explicit compilation calls here because (a)
+        they took place outside a dynamic global object scope and (b) they were
+        redundant.
+
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct): Added an ASSERT to
+        verify our new invariant that all compilation takes place within a
+        dynamic global object scope.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        * runtime/JSGlobalObject.h: Changed the signature of DynamicGlobalObjectScope
+        to require a JSGlobalData instead of an ExecState* since it is often
+        easier to provide the former, and the latter was not necessary.
+
+2011-03-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        REGRESSION (r79987-r80210): Crash in JSWeakObjectMapClear
+        https://bugs.webkit.org/show_bug.cgi?id=55671
+
+        This is no longer necessary, and it seems that with the new weakmap
+        model it's simply unsafe, so this reduces it to a no-op. 
+
+        * API/JSWeakObjectMapRefPrivate.cpp:
+
+2011-03-24  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20302
+        Correct implementation of signbit on Solaris
+
+        * wtf/MathExtras.h:
+        (signbit):
+
+2011-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7959320> Threads that use APIs above the BSD layer must be registered with the Obj-C GC.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeCurrentThreadInternal):
+
+2011-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Stop setting OTHER_OPTIONS in JavaScriptCore's Makefile.
+
+        It's not necessary to pass "-target All" as xcodebuild always builds the
+        first target in the project unless otherwise specified. The presence of
+        that option also breaks "make clean" since that results in both the
+        -target and -alltargets options being passed to xcodebuild.
+
+        * Makefile:
+
+2011-03-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: bring back Vector::contains that was removed as a part of roll back.
+
+        * wtf/Vector.h:
+        (WTF::::contains):
+
+2011-03-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81686.
+        http://trac.webkit.org/changeset/81686
+        https://bugs.webkit.org/show_bug.cgi?id=56914
+
+        Breaks webkit_tests in Chromium again. (Requested by pfeldman
+        on #webkit).
+
+        * wtf/Vector.h:
+
+2011-03-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        JavaScriptCore GYP build should work on a case-sensitive file system
+        https://bugs.webkit.org/show_bug.cgi?id=56911
+
+        The issue is that there are two UString.h headers, one named UString.h
+        and one named ustring.h.  This patch excludes ustring.h from the header
+        map to avoid confusion.  While I was editing this part of the GYP file,
+        I cleaned up the exclude rules to be more modern.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION (r78382): No scripts appear in the Web Inspector's Scripts
+        panel on Windows, and many inspector regression tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=54490
+        
+        The bug was caused by two different classes using the same name (Recompiler).
+
+        * debugger/Debugger.cpp:
+        * runtime/JSGlobalData.cpp:
+        (WTF::Recompiler::operator()): Put Recompiler in an anonymous namespace,
+        so our two recompilers' inline functions don't stomp each other at
+        link time.
+
+2011-03-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER.
+        <rdar://problem/8944718> 
+
+        * DerivedSources.make:
+        Remove generation of USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER.
+
+2011-03-22  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Add DFG module to build system (disabled by default).
+        https://bugs.webkit.org/show_bug.cgi?id=56845
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add support to build-webkit for building with gyp-generated project files
+        https://bugs.webkit.org/show_bug.cgi?id=56877
+
+        Found a couple missing Private headers while trying to make WebCore build.
+
+        * JavaScriptCore.gypi:
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to build JavaScriptCore and WebCore gyp builds outside of Source
+        https://bugs.webkit.org/show_bug.cgi?id=56867
+
+        This should make it possible to build the gyp-generated JavaScriptCore.xcodeproj
+        from a JavaScriptCore directory outside of Source.
+
+        * gyp/JavaScriptCore.gyp:
+        * gyp/run-if-exists.sh: Added.
+        * gyp/update-info-plist.sh: Added.
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add Profiling Configuration to JavaScriptCore gyp build
+        https://bugs.webkit.org/show_bug.cgi?id=56862
+
+        It appears this is identical to Release, but I suspect
+        there is someone/thing who uses the Profiling target
+        so we're adding it for completeness.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove os_win32_files variable from the GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56804
+
+        Now that our understanding of GYP is sufficiently advanced, we don't
+        need os_win32_files any more.  (Turns out Eric was right, as he always
+        is.)
+
+        * JavaScriptCore.gypi:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        GYP build of JavaScriptCore should be able to link from an empty WebKitBuild directory
+        https://bugs.webkit.org/show_bug.cgi?id=56803
+
+        Previously, we thought we should generate the derived source files in
+        the shared intermediate build products directory, but there are
+        assumptions built into other parts of the Mac build system that the
+        derived source files will be generated in a particular subdirectory of
+        the build products directory.
+
+        This patch is a partial revert of the change that moved the derived
+        source files to the shared intermediate directory.  After this patch,
+        the GYP build can build JavaScriptCore without help from the main
+        normal build system.
+
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+        * gyp/generate-derived-sources.sh:
+        * gyp/generate-dtrace-header.sh:
+
+2011-03-22  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Adding a contains method to Vector.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
+
+        * wtf/Vector.h:
+        (WTF::Vector::contains):
+
+2011-03-22  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix a bunch of typos in DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=56813
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::parse):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::setSpilled):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::setupStubArguments):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNonSpeculativeJIT.h:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::allocate):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::~ScoreBoard):
+        (JSC::DFG::ScoreBoard::allocate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Production configuration in GYP isn&apos;t set up correctly
+        https://bugs.webkit.org/show_bug.cgi?id=56786
+
+        Update JavaScriptCore.gyp with information mined from
+        JavaScriptCore.xcodeproj.
+
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-22  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r80096): Number type input unexpectedly rounds fractional values
+        https://bugs.webkit.org/show_bug.cgi?id=56367
+
+        Introduce clampToInteger(unsigned).
+        
+        * wtf/MathExtras.h:
+        (clampToInteger): Added.
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        GYP build should not have include paths that point within the source tree
+        https://bugs.webkit.org/show_bug.cgi?id=56788
+
+        Turns out we don't need these include paths anymore now that we have
+        header maps working properly.
+
+        * gyp/JavaScriptCore.gyp:
+            - Also, remove jsc.cpp from the excluded list because it's not part
+              of the jsc_files variable instead of the javascriptcore_files
+              variable.
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Solve the Assertions.cpp / -Wno-missing-format-attribute mystery
+        https://bugs.webkit.org/show_bug.cgi?id=56780
+
+        The reason we couldn't resolve this warning in the GYP build was that
+        the normal build disables this warning specifically for this file.
+        This patch takes the same approach as the previous patch to
+        WebCoreObjCExtras.mm in that it uses a pragma to suppress the warning
+        (rather than a build system configuration).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Remove the special-case for this file.
+        * gyp/JavaScriptCore.gyp:
+            - Remove the work-around for this issue.
+        * wtf/Assertions.cpp:
+            - Add a pragma disabling this warning for this file.
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build shouldn't crash on startup
+        https://bugs.webkit.org/show_bug.cgi?id=56776
+
+        Debug builds shouldn't define NDEBUG.  This same logic exists in the
+        project.pbxproj file.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-21  Robert Kroeger  <rjkroege@chromium.org>
+
+        Reviewed by Antonio Gomes.
+
+        Flag to enable/disable a GestureReocognizer framework
+
+        https://bugs.webkit.org/show_bug.cgi?id=49345
+
+        * wtf/Platform.h:
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add new files to JavaScriptCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=56766
+
+        * JavaScriptCore.gypi:
+
+2011-03-21  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81377.
+        http://trac.webkit.org/changeset/81377
+        https://bugs.webkit.org/show_bug.cgi?id=56765
+
+        WebPageSerializerTest.MultipleFrames is broken (Requested by
+        simonjam on #webkit).
+
+        * wtf/Vector.h:
+
+2011-03-21  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Extend constant pool to be able to store 16 bit instructions with a constant
+        https://bugs.webkit.org/show_bug.cgi?id=46796
+
+        The putShortWithConstantInt function inserts a 16 bit instruction which
+        refers a 32 bits constant or literal. This is a vital function for those
+        target which loads a PC relative value with a 16 bit instruction (like
+        Thumb-2 instruction set and SH4 architecture).
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putIntegral):
+        (JSC::AssemblerBuffer::putIntegralUnchecked):
+        * assembler/AssemblerBufferWithConstantPool.h:
+
+2011-03-21  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, GTK distcheck build fix.
+
+        * GNUmakefile.am:
+
+2011-03-20  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
+
+        No new tests. Exposes no new functionality.
+
+        * API/JSClassRef.h:
+        * API/OpaqueJSString.h:
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/Atomics.h:
+        * wtf/CMakeLists.txt:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::crossThreadCopy):
+        * wtf/ThreadSafeRefCounted.h: Copied from wtf/ThreadSafeShared.h.
+        (WTF::ThreadSafeRefCountedBase::ThreadSafeRefCountedBase):
+        (WTF::ThreadSafeRefCountedBase::ref):
+        (WTF::ThreadSafeRefCountedBase::refCount):
+        (WTF::ThreadSafeRefCountedBase::derefBase):
+        (WTF::ThreadSafeRefCounted::ThreadSafeRefCounted):
+        * wtf/ThreadSafeShared.h: Removed.
+        * wtf/Threading.h:
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove StringImpl::computeHash()
+        https://bugs.webkit.org/show_bug.cgi?id=49894
+
+        Replace remainig StringImpl::computeHash with StringImpl::computeHashStringHasher.
+
+        * wtf/text/AtomicString.cpp:
+        (WTF::CStringTranslator::hash):
+        (WTF::UCharBufferTranslator::hash):
+        (WTF::HashAndCharactersTranslator::hash):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::setHash):
+        (WTF::StringImpl::hash):
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename WTF::StringHasher methods
+        https://bugs.webkit.org/show_bug.cgi?id=53532
+
+        Rename createHash to computeHash and createBlobHash to hashMemory.
+        Also add a using WTF::StringHasher in the header file.
+
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierUCharBufferTranslator::hash):
+        * wtf/StringHasher.h:
+        (WTF::StringHasher::computeHash):
+        (WTF::StringHasher::hashMemory):
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::hash):
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::computeHash):
+        * wtf/unicode/UTF8.cpp:
+        (WTF::Unicode::calculateStringHashAndLengthFromUTF8Internal):
+
+2011-03-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [GTK] JSC crashes in 32bit Release bots after r80743
+        https://bugs.webkit.org/show_bug.cgi?id=56180
+        
+        The crash was caused by referencing GC memory from a GC destructor. This
+        is not safe because destruction time / order is not guaranteed.
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::create):
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileGenerator.h:
+        (JSC::ProfileGenerator::origin): Made ExecState* the first argument,
+        to match the rest of this class and JSC.
+        
+        Use a JSGlobalObject* instead of an ExecState* with an indirect reference
+        to a JSGlobalObject* to track our origin. This is simpler and more
+        efficient, and it removes the destruction order dependency that was causing
+        our crash.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::startProfiling): Updated for change to JSGlobalObject*.
+        (JSC::Profiler::stopProfiling): New function for stopping all profiles
+        for a given global object. This is more straight-forward than multiplexing
+        through the old function.
+
+        (JSC::dispatchFunctionToProfiles): Updated for change to JSGlobalObject*.
+        * profiler/Profiler.h: Ditto.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject): Ditto.
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable): Use a raw pointer instead of
+        PassRefPtr, like JSString does, since JSGlobalData owns the singleton
+        exectuable structure.
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed some string leaks seen on the buildbot
+        https://bugs.webkit.org/show_bug.cgi?id=56619
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::~PropertyTable): DEref!
+
+2011-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Crash in  JSC::MarkStack::drain Under Stress
+        https://bugs.webkit.org/show_bug.cgi?id=56470
+
+        We perform a number of gc allocations while when
+        we are setting up new globals in a piece of global
+        code.  We do this by adding new properties to the
+        symbol table, and then expanding the storage to fit
+        at the end.
+
+        If a GC happens during this time we will report an
+        incorrect size for the global object's symbol table
+        storage.
+
+        This patch corrects this by growing the storage size
+        before we starting adding entries to the symbol table.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resizeRegisters):
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Take local ownership of the Structure
+        we're using, since the Executable is not designed to own the Structure.
+
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+
+        Add missing register-register branchTest8 to MacroAssemblerX86Common/X86Assembler.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testb_rr):
+
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 56603 - DFG JIT related cleanup
+        Move node generation out to separate function, move binarySearch algorithm out
+        to StdLibExtras, fix Graph::dump() to print comma between non-node children,
+        even if there are no node children.
+
+        * bytecode/CodeBlock.h:
+        (JSC::getCallReturnOffset):
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
+        (JSC::CodeBlock::bytecodeOffset):
+            - Move binaryChop to binarySearch in StdLibExtras
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parse):
+        (JSC::DFG::parse):
+            - Make m_noArithmetic a member, initialize m_currentIndex in the constructor.
+        * dfg/DFGByteCodeParser.h:
+            - Change parse() to not take a start index (always 0).
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+            - Fix Graph::dump() to print comma between non-node children, even if there are no node children.
+        * dfg/DFGJITCodeGenerator.h:
+        (JSC::DFG::JITCodeGenerator::JITCodeGenerator):
+            - Initialize m_compileIndex in constructor.
+        * dfg/DFGNonSpeculativeJIT.cpp:
+        (JSC::DFG::NonSpeculativeJIT::compile):
+        * dfg/DFGNonSpeculativeJIT.h:
+            - Spilt out compilation of individual node.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationConvertThis):
+        * dfg/DFGOperations.h:
+            - Cleanup parameter name.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+            - Spilt out compilation of individual node.
+        * runtime/Executable.cpp:
+        (JSC::tryDFGCompile):
+            - Change parse() to not take a start index (always 0).
+        * wtf/StdLibExtras.h:
+        (WTF::binarySearch):
+            - Move binaryChop to binarySearch in StdLibExtras
+
+2011-03-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix clang build.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+
+2011-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        1 Structure leaked beneath JSGlobalData::storeVPtrs()
+        https://bugs.webkit.org/show_bug.cgi?id=56595
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs): Now that we have an executable, we need
+        to explicitly run its destructor.
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * JavaScriptCore.xcodeproj: Modified property svn:ignore.
+
+2011-03-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reverting r81197, breaks JIT + INTERPRETER build.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addStructureStubInfo):
+        * bytecode/Opcode.h:
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+
+2011-03-17  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add a COMPILER(SUNCC) define for Sun Studio 12. 
+        https://bugs.webkit.org/show_bug.cgi?56444
+        derived from patch 1 of 16 originally from https://bugs.webkit.org/show_bug.cgi?id=24932
+
+        * wtf/Platform.h:
+
+2011-03-17  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Adding a contains method to Vector.
+        https://bugs.webkit.org/show_bug.cgi?id=55859
+
+        * wtf/Vector.h:
+        (WTF::::operator):
+        (WTF::::contains):
+
+2011-03-17  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix the interpreter build.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Added globalData to inheritorID().
+
+2011-03-16  Sam Weinig  <sam@webkit.org>
+
+        Fix the interpreter build.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::privateExecute):
+        Remove .get()s.
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by James Robinson.
+
+        Remove USE(BUILTIN_UTF8_CODEC)
+        https://bugs.webkit.org/show_bug.cgi?id=56508
+
+        We added this recently when we were unsure about the stability of the
+        built-in UTF-8 codec.  However, the codec seems to be stable, so we
+        don't need the macro.
+
+        * wtf/Platform.h:
+
+2011-03-16  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make JIT build for ARM Thumb-2 with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=56440
+
+        Derived from a patch by Dave Tapuska.
+
+        Also, modify the RVCT stub template to indicate that it preserves 8 byte stack alignment.
+
+        * jit/JITStubs.cpp:
+
+2011-03-16  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Darin Adler.
+
+        Fix MIPS build with const *void
+        https://bugs.webkit.org/show_bug.cgi?id=56513
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::store32):
+
+2011-03-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unnecessary caller tracking shenanigans from CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=56483
+
+        This removes some leftover cruft from when we made CodeBlock
+        mark its callees.  Removing it gives us a 0.7% progression,
+        reducing the overall regression to ~1.3%.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Structure creation require a JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=56438
+
+        Mechanical change to make Structure::create require JSGlobalData&, and
+        require all users to provide the globalData.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSContextRef.cpp:
+        * JavaScriptCore.exp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionRun):
+        (jscmain):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::createDummyStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::createEmptyObjectStructure):
+        (JSC::JSObject::inheritorID):
+        * runtime/JSObjectWithGlobalObject.h:
+        (JSC::JSObjectWithGlobalObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+
+2011-03-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Some conservative root gathering cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=56447
+        
+        SunSpider says 0.5% - 1.8% faster.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h: New helper function for doing the
+        conservative gathering of the register file. It's still conservative,
+        since the register file may contain uninitialized values, but it's
+        moving-safe, because it only visits values tagged as pointers, so there's
+        no risk of mistaking an integer for a pointer and accidentally changing it.
+
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeRoots::add):
+        * runtime/ConservativeSet.h: Added a single-value add function, used above.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Separated machine stack conservative roots from
+        register file conservative roots because machine stack roots must be
+        pinned, but register file roots need not be pinned.
+        
+        Adopted new interface for passing the current stack extent to the machine
+        stack root gathering routine. This allows us to exclude marking-related
+        data structures on the stack, and thus avoid double-marking the set of
+        machine roots.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * runtime/MachineStackMarker.h: Added new interface, described above.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::firstAtom):
+        * wtf/StdLibExtras.h:
+        (WTF::roundUpToMultipleOf): Moved roundUpToMultipleOf so it could be used
+        by MachineStacks.
+
+2011-03-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A little bit of MarkStack cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=56443
+        
+        Moved MarkStack functions into MarkStack.h/.cpp.
+        
+        SunSpider reports no change.
+
+        * runtime/JSArray.h:
+        * runtime/JSCell.h: Moved from here...
+        * runtime/MarkStack.cpp:
+        (JSC::MarkStack::markChildren):
+        (JSC::MarkStack::drain): ...to here. Also, no need to inline drain. It's
+        a huge function, and not called many times.
+
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::~MarkStack): Moved near constructor, per style guide.
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::deprecatedAppend):
+        (JSC::MarkStack::internalAppend): Moved to here.
+
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed another deprecatedAppend
+        https://bugs.webkit.org/show_bug.cgi?id=56429
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::markStrongHandles):
+        * collector/handles/HandleHeap.h: Use HeapRootMarker, since handles are
+        marked directly by the Heap.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Ditto.
+
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed some more deprecated / unsafe append
+        https://bugs.webkit.org/show_bug.cgi?id=56428
+
+        * collector/handles/HandleStack.cpp:
+        (JSC::HandleStack::mark):
+        * collector/handles/HandleStack.h: Mark the handle stack using a HeapRoot
+        marker, since it's a heap root.
+        
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::markLists):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h: Ditto.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots): Added a mark call for marking the handle stack.
+        It seems like Oliver forgot this in his last patch. (!)
+
+        * runtime/MarkStack.h: Removed appendSlots, since it would allow an
+        object to embed JSValues directly instead of using WriteBarrier.
+
+        (JSC::MarkStack::append): Added a private append for a list of values.
+
+        (JSC::HeapRootMarker::mark): Access to the above.
+
+2011-03-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed a few more deprecatedAppends, and removed HeapRoot<T>
+        https://bugs.webkit.org/show_bug.cgi?id=56422
+        
+        Added HeapRootMarker, a privileged class for marking direct heap roots
+        that are iterated during each garbage collection. This is easier to use
+        and more reliable than HeapRoot<T>, so I've removed HeapRoot<T>.
+
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::exception):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Completion.cpp:
+        (JSC::evaluate): exception is no longer a HeapRoot<T>, so no need to
+        call .get() on it.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h: Updated to use HeapRootMarker.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkStack::append): Added private functions for
+        HeapRootMarker to use.
+
+        * runtime/JSGlobalData.h: exception is no longer a HeapRoot<T>.
+
+        * runtime/MarkStack.h:
+        (JSC::HeapRootMarker::HeapRootMarker):
+        (JSC::HeapRootMarker::mark): Added private functions for
+        HeapRootMarker to use.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::markChildren): Updated to use HeapRootMarker.
+
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::emptyString):
+        (JSC::SmallStrings::singleCharacterString):
+        (JSC::SmallStrings::singleCharacterStrings): Updated to use HeapRootMarker.
+
+        * runtime/WriteBarrier.h: Removed HeapRoot<T>.
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Made the global object moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56348
+        
+        SunSpider reports no change.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Removed a dubious comment that
+        suggested we do not need to visit all our references during GC, since
+        that is not true in a moving GC.
+
+        Re-sorted data members by type, removed one duplicate, and added back
+        the one missing mark I found.
+
+        * runtime/JSGlobalObject.h: Re-sorted data members by type.
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Introduce Local<T> to allow us to start moving to precise marking of locals
+        https://bugs.webkit.org/show_bug.cgi?id=56394
+
+        Introduce a new handle type, Local<T> and a scoping mechanism
+        LocalScope to allow us to start moving towards precise marking
+        of temporaries and local variables.
+
+        We also start to use the new Local<> type in the JSON stringifier
+        so that we can have some coverage of their behaviour in the initial
+        checkin.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * collector/handles/Handle.h:
+        (JSC::::asObject):
+        * collector/handles/HandleStack.cpp: Added.
+        (JSC::HandleStack::HandleStack):
+        (JSC::HandleStack::mark):
+        (JSC::HandleStack::grow):
+        * collector/handles/HandleStack.h: Added.
+        (JSC::HandleStack::enterScope):
+        (JSC::HandleStack::zapTo):
+        (JSC::HandleStack::leaveScope):
+        (JSC::HandleStack::push):
+        * collector/handles/Local.h: Added.
+        (JSC::Local::internalSet):
+        (JSC::::Local):
+        (JSC::::operator):
+        (JSC::LocalStack::LocalStack):
+        (JSC::LocalStack::peek):
+        (JSC::LocalStack::pop):
+        (JSC::LocalStack::push):
+        (JSC::LocalStack::isEmpty):
+        (JSC::LocalStack::size):
+        * collector/handles/LocalScope.h: Added.
+        (JSC::LocalScope::LocalScope):
+        (JSC::LocalScope::~LocalScope):
+        (JSC::LocalScope::release):
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::allocateLocalHandle):
+        (JSC::Heap::handleStack):
+        * runtime/JSCell.h:
+        (JSC::JSCell::::getString):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::allocateLocalHandle):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::Holder):
+        (JSC::Walker::Walker):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        (JSC::JSONStringify):
+        * runtime/JSONObject.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::appendValues):
+        (JSC::MarkStack::appendSlots):
+
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+
+        Bug 56420 - Remove ENABLE(JIT) code from ByteCompiler
+        Some methods have unnecessary differences in name/arguments for interpreter/JIT.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::HandlerInfo::HandlerInfo):
+        (JSC::CodeBlock::addPropertyAccessInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::globalResolveInfo):
+        * bytecode/Opcode.h:
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix broken assert in new code.
+
+        * dfg/DFGAliasTracker.h:
+        (JSC::DFG::AliasTracker::recordPutByVal):
+            - recordPutByVal is called for both PutByVal & PutByValAlias.
+
+2011-03-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        Removed redundant code from BytecodeGenerator.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+            - delete uncalled code missed when reparsing was removed.
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * API/JSBase.h:
+        * config.h:
+        * wtf/Assertions.h:
+        * wtf/ExportMacros.h: Added.
+        * wtf/Platform.h:
+
+2011-03-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        Buildfix when JIT is not enabled after r81079
+        https://bugs.webkit.org/show_bug.cgi?id=56361
+
+        * runtime/Executable.cpp:
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Made the global object moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56348
+        
+        SunSpider reports no change.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markChildren): Removed a dubious comment that
+        suggested we do not need to visit all our references during GC, since
+        that is not true in a moving GC.
+
+        Re-sorted data members by type, removed one duplicate, and added back
+        the one missing mark I found.
+
+        * runtime/JSGlobalObject.h: Re-sorted data members by type.
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Made JSWrapperObject and subclasses moving-GC-safe
+        https://bugs.webkit.org/show_bug.cgi?id=56346
+        
+        SunSpider reports no change.
+
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
+
+        * runtime/DateInstance.h: Don't set the OverridesMarkChildren flag because
+        we do not in fact override markChildren.
+
+        * runtime/DatePrototype.h: Declare an anonymous slot, since wrapper object
+        no longer does so for us. Also added an ASSERT to catch a latent bug,
+        where DatePrototype stomped on its base class's anonymous slot. Hard-coded
+        anonymous slots are a plague on our code. This doesn't cause any problems
+        in our existing code since the base class never reads the anonymous slot
+        it declares, but it caused crashes when I tried to start using the slot
+        in an initial version of this patch.
+
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue): Resolved a problem where
+        our internal value was stored in two places: an anonymous slot, and a
+        data member which was not always visited during GC. Now, we only use the
+        data member, and we always visit it. (Instead of relying on certain
+        subclasses to set the OverridesMarkChildren bit, we set it ourselves.)
+
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
+
+        * runtime/NumberObject.h: Removed meaningless declaration.
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject): No more need for JSGlobalData, since
+        we don't initialize the wrapped value in our constructor.
+
+        * runtime/StringObject.h: Don't set the OverridesMarkChildren flag because
+        we do not in fact override markChildren.
+
+        * runtime/StringPrototype.h: Declare an anonymous slot, since wrapper object
+        no longer does so for us. Also added an ASSERT to catch a latent bug,
+        where DatePrototype stomped on its base class's anonymous slot. Hard-coded
+        anonymous slots are a plague on our code.
+
+2011-03-14  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Look-ahead assertions with back references don’t work as expected
+        https://bugs.webkit.org/show_bug.cgi?id=56082
+
+        Changed parentheses assertion processing to temporarily back out the 
+        number of known characters after the assertion while processing the 
+        assertion.  This was done so that assertions don't fail due to 
+        checking the number of required characters as additional to the 
+        rest of the express since assertions don't "consume" input.
+        Added a byte code to uncheck characters to support the change.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::uncheckInput):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::ByteTerm::UncheckInput):
+
+2011-03-14  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Warning that round/roundf functions are already defined when compiled with RVCT 4 on symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=56133
+
+        Add condition to not compile webkit internal math round functions on RVCT compiler versions 
+        from 3.0.0 because they are already defined in compiler math library.
+
+        * wtf/MathExtras.h:
+
+2011-03-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen & Oliver Hunt.
+
+        Bug 56284 - Add a dataflow intermediate representation for use in JIT generation.
+
+        The JSC JIT presently generates code directly from the bytecode used by the interpreter.
+        This is not an optimal intermediate representation for JIT code generation, since it does
+        not capture liveness information of values, and provides little opportunity to perform
+        any static analysis for even primitive types. The JIT currently generates two code paths,
+        a fast path handling common cases, and a slower path handling less common operand types.
+        However the slow path jumps back into the fast path, meaning that information arising
+        from the earlier type checks cannot be propagated to later operations.
+
+        This patch adds:
+            * a dataflow intermediate representation capable of describing a single basic block
+              of operations,
+            * a mechanism to convert a simple, single-block bytecode functions to the new IR,
+            * and a JIT code generator capable of generating code from this representation.
+
+        The JIT generates two code paths, with the slower path not reentering the fast path
+        mid-block, allowing speculative optimizations to be made on the hot path, with type
+        information arising from these speculative decisions able to be propagated through the
+        dataflow. Code generation of both speculative and non-speculative paths exploits the type
+        and liveness information represented in the dataflow graph to attempt to avoid redundant
+        boxing and type-checking of values, and to remove unnecessary spills of temporary values
+        to the RegisterFile.
+
+        The dataflow JIT currently can only support a subset of bytecode operations, limited to
+        arithmetic, bit-ops, and basic property access. Functions that cannot be compiled by the
+        dataflow JIT will be run using the existing JIT. The coverage of the dataflow JIT will be
+        expanded to include, control-flow, function calls, and then the long-tail of remaining
+        bytecode instructions. The JIT presently only support JSVALUE64, and as a consequence of
+        this only supports x86-64.
+
+        The status of the dataflow JIT is currently work-in-progress. Limitations of the present
+        JIT code generation may cause performance regressions, particularly:
+            * the policy to only generate arithmetic code on the speculative path using integer
+              instructions, never using floating point.
+            * the policy to only generate arithmetic code on the non-speculative path using
+              floating point instructions, never using integer.
+            * always generating JSValue adds on the non-speculative path as a call out to a
+              C-function, never handling this in JIT code.
+            * always assuming by-Value property accesses on the speculative path to be array
+              accesses.
+            * generating all by-Value property accesses from the non-speculative path as a call
+              out to a C-function.
+            * generating all by-Indentifer property accesses as a call out to a C-function.
+        Due to these regressions, the code is landed in a state where it is disabled in most
+        cases by the ENABLE_DFG_JIT_RESTRICTIONS guard in Platform.h. As these regressions are
+        addressed, the JIT will be allowed to trigger in more cases.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Added new files to Xcode project.
+        * dfg: Added.
+            - Added directory for new code.
+        * dfg/DFGByteCodeParser.cpp: Added.
+        * dfg/DFGByteCodeParser.h: Added.
+            - Contruct a DFG::Graph representation from a bytecode CodeBlock.
+        * dfg/DFGGenerationInfo.h: Added.
+            - Track type & register information for VirtualRegisters during JIT code generation.
+        * dfg/DFGGraph.cpp: Added.
+        * dfg/DFGGraph.h: Added.
+            - Dataflow graph intermediate representation for code generation.
+        * dfg/DFGJITCodeGenerator.cpp: Added.
+        * dfg/DFGJITCodeGenerator.h: Added.
+            - Base class for SpeculativeJIT & NonSpeculativeJIT to share common functionality.
+        * dfg/DFGJITCompiler.cpp: Added.
+        * dfg/DFGJITCompiler.h: Added.
+            - Class responsible for driving code generation of speculativeJIT & non-speculative
+              code paths from the dataflow graph.
+        * dfg/DFGNonSpeculativeJIT.cpp: Added.
+        * dfg/DFGNonSpeculativeJIT.h: Added.
+            - Used to generate the non-speculative code path, this make no assumptions
+              about operand types.
+        * dfg/DFGOperations.cpp: Added.
+        * dfg/DFGOperations.h: Added.
+            - Helper functions called from the JIT generated code.
+        * dfg/DFGRegisterBank.h: Added.
+            - Used to track contents of physical registers during JIT code generation.
+        * dfg/DFGSpeculativeJIT.cpp: Added.
+        * dfg/DFGSpeculativeJIT.h: Added.
+            - Used to generate the speculative code path, this make assumptions about
+              operand types to enable optimization.
+        * runtime/Executable.cpp:
+            - Add code to attempt to use the DFG JIT to compile a function, with fallback
+              to the existing JIT.
+        * wtf/Platform.h:
+            - Added compile guards to enable the DFG JIT.
+
+2011-03-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed more cases of DeprecatedPtr (exception, SmallStrings)
+        https://bugs.webkit.org/show_bug.cgi?id=56332
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
+
+        * runtime/JSGlobalData.h: Use HeapRoot instead of DeprecatedPtr because
+        this reference is owned and managed directly by the heap.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::substringFromRope):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsStringWithFinalizer):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::markChildren):
+        (JSC::SmallStrings::clear):
+        (JSC::SmallStrings::count): Use a variable instead of a hard-coded
+        constant, to make this code less brittle.
+
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::singleCharacterString): Use HeapRoot instead of
+        DeprecatedPtr because these references are owned and managed directly by
+        the heap.
+        
+        Stop using FixedArray because we only want a very limited set
+        of classes to be able to use HeapRoot. (Replaced with manual ASSERTs.)
+
+        * runtime/WriteBarrier.h:
+        (JSC::operator==):
+        (JSC::WriteBarrier::WriteBarrier):
+        (JSC::HeapRoot::HeapRoot):
+        (JSC::HeapRoot::operator=): Added HeapRoot, which is allowed to set
+        without write barrier because we assume all HeapRoots are scanned during
+        all GC passes.
+
+2011-03-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben and Gavin Barraclough.
+
+        FileSystemWin.cpp needs listDirectory() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=56331
+        <rdar://problem/9126635>
+        
+        Give StringConcatenate the ability to deal with const UChar*'s as a String type to append.
+
+        * wtf/text/StringConcatenate.h:
+
+2011-03-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <http://webkit.org/b/56304> REGRESSION(r80892): 100,000+ leaks seen on the build bot
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::OpaqueJSClass): Don't leak any existing entry for the given name if
+        the class definition contains duplicates. This also removes what look to be leaks
+        of the StringImpl instances that are used as keys: the HashMap key type is a RefPtr
+        which retains / releases the instances at the appropriate time, so explicitly calling
+        ref is not necessary.
+
+2011-03-14  Oliver Hunt  <oliver@apple.com>
+
+        Fix windows build
+
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::tagFor):
+        (JSC::JSInterfaceJIT::payloadFor):
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
+        (JSC::JSInterfaceJIT::addressFor):
+
+2011-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
+
+        This patch makes sure that all JSCell pointers written to
+        the registerfile are correctly tagged as JSCells, and replaces
+        raw int usage with the immediate representation.
+
+        For performance, register pressure, and general saneness reasons
+        I've added abstractions for reading and writing the tag
+        and payload of integer registers directly for the JSVALUE64
+        encoding.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A few Heap-related renames (sans file moves, which should come next)
+        https://bugs.webkit.org/show_bug.cgi?id=56283
+        
+        ConservativeSet => ConservativeRoots. "Set" was misleading, since items
+        are not uniqued. Also, "Roots" is more specific about what's in the set.
+        
+        MachineStackMarker => MachineThreads. "Threads" is more descriptive of
+        the fact that this class maintains a set of all threads using JSC.
+        "Stack" was misleading, since this class traverses stacks and registers.
+        "Mark" was misleading, since this class doesn't mark anything anymore.
+        
+        registerThread => addCurrentThread. "Current" is more specific.
+        unregisterThread => removeCurrentThread. "Current" is more specific.
+        
+        "currentThreadRegistrar" => threadSpecific. The only point of this data
+        structure is to register a thread-specific destructor with a pointer to
+        this.
+        
+        "mark...Conservatively" => "gather". "Mark" is not true, since these
+        functions don't mark anything. "Conservatively" is redundant, since they
+        take "ConservativeRoots" as an argument.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        * JavaScriptCore.exp:
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeRoots::grow):
+        (JSC::ConservativeRoots::add):
+        * runtime/ConservativeSet.h:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::~ConservativeRoots):
+        (JSC::ConservativeRoots::size):
+        (JSC::ConservativeRoots::roots):
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        (JSC::Heap::machineThreads):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::makeUsableFromMultipleThreads):
+        * runtime/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::makeUsableFromMultipleThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        (JSC::MachineThreads::removeCurrentThread):
+        (JSC::MachineThreads::gatherFromCurrentThreadInternal):
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherFromOtherThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * runtime/MachineStackMarker.h:
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append):
+
+2011-03-13  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX for armv7 after r80969
+
+        Bug 56270 - The JIT 'friend's many classes in JSC; start unwinding this.
+        <https://bugs.webkit.org/show_bug.cgi?id=56270>
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32): Made void* address argument
+        const.
+        (JSC::MacroAssemblerARMv7::store32): Ditto.
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix the Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make sure to forward
+        ConervativeSet.h, since it's now visible when compiling other projects.
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed another case of DeprecatedPtr (ConservativeSet)
+        https://bugs.webkit.org/show_bug.cgi?id=56281
+        
+        The ConservativeSet is an internal data structure used during marking,
+        so direct pointers are fine.
+
+        * runtime/ConservativeSet.cpp:
+        (JSC::ConservativeSet::grow):
+        * runtime/ConservativeSet.h: Added some accessors, for use by MarkStack::append.
+        (JSC::ConservativeSet::~ConservativeSet): Fixed a typo where we calculated
+        the size of the set based on sizeof(DeprecatedPtr<T>*) instead of
+        sizeof(DeprecatedPtr<T>). I'm not sure if this had real-world implications or not.
+        (JSC::ConservativeSet::size):
+        (JSC::ConservativeSet::set): Use direct pointers, as stated above. 
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/MarkStack.h:
+        (JSC::MarkStack::append): Created a special case of append for
+        ConservativeSet. I didn't want to add back a generic "append JSCell*"
+        function, since other class might start using that wrong. (In the end,
+        this function might go away, since the Heap will want to do something
+        slightly more interesting with the conservative set, but this is OK for
+        now.)
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed another case of DeprecatedPtr (PutPropertySlot)
+        https://bugs.webkit.org/show_bug.cgi?id=56278
+
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::base): Direct pointer is fine for PutPropertySlot,
+        since it's a stack-allocated temporary.
+
+2011-03-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed one case of DeprecatedPtr (ScopeChainIterator)
+        https://bugs.webkit.org/show_bug.cgi?id=56277
+
+        * runtime/ScopeChain.h: Direct pointer is fine for ScopeChainIterator,
+        since it's a stack-allocated temporary.
+
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 56273 - Add three operand forms to MacroAssember operations.
+
+        Adding for X86(_64) for now, should be rolled out to other backends as necessary.
+        These may allow more efficient code generation in some cases, avoiding the need
+        for unnecessary register-register move instructions.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+            - marked these methods const.
+        (JSC::AbstractMacroAssembler::Jump::isSet):
+            - add a method to check whether a Jump object has been set to
+              reference an instruction, or is in a null, unset state. 
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+            - add non-explicit constructor, for FunctionPtr's to C/C++ functions.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::lshift32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::rshift32):
+        (JSC::MacroAssemblerX86Common::urshift32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::moveDouble):
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::divDouble):
+        (JSC::MacroAssemblerX86Common::subDouble):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+            - add three operand forms of these instructions.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::addDouble):
+        (JSC::MacroAssemblerX86_64::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86_64::loadPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpSrc::isSet):
+            - add a method to check whether a JmpSrc object has been set to
+              reference an instruction, or is in a null, unset state. 
+        (JSC::X86Assembler::movsd_rr):
+            - added FP register-register move.
+        (JSC::X86Assembler::linkJump):
+            - Add an assert to check jumps aren't linked more than once.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadInt32ToDouble):
+            - load integers to the FPU via regsiters on x86-64.
+
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
+
+        ARM build fix.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load32):
+
+2011-03-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 56270 - The JIT 'friend's many classes in JSC; start unwinding this.
+
+        The JIT need to 'friend' other classes in order to be able to calculate offsets
+        of various properties, or the absolute addresses of members within specific objects,
+        in order to JIT generate code that will access members within the class when run.
+
+        Instead of using friends in these cases, switch to providing specific accessor
+        methods to provide this information.  In the case of offsets, these can be static
+        functions, and in the case of pointers to members within a specific object these can
+        be const methods returning pointers to const values, to prevent clients from
+        modifying values otherwise encapsulated within classes.
+
+        * bytecode/SamplingTool.h:
+        * interpreter/Register.h:
+        * interpreter/RegisterFile.h:
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSTypeInfo.h:
+        * runtime/JSVariableObject.h:
+        * runtime/Structure.h:
+        * wtf/RefCounted.h:
+            - Change these classes to no longer friend the JIT, add accessors for member offsets.
+        * jit/JIT.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+            - Change the JIT to use class accessors, rather than taking object ofsets directly.
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+            - Since the accessors for objects members return const pointers to retain encapsulation,
+              methods generating code with absolute addresses must be able to handle const pointers
+              (the JIT doesn't write to these values, do dies treat the pointer to value as const
+              from within the C++ code of the JIT, if not at runtime!).
+
+2011-03-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80919.
+        http://trac.webkit.org/changeset/80919
+        https://bugs.webkit.org/show_bug.cgi?id=56251
+
+        all windows bots failed to compile this change (Requested by
+        loislo on #webkit).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/StructureStubInfo.cpp:
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::payloadFor):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+        * runtime/ArgList.cpp:
+        * runtime/DateConversion.cpp:
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/JSActivation.h:
+        (JSC::asActivation):
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSValue.h:
+        * runtime/JSZombie.cpp:
+        * runtime/MarkedBlock.cpp:
+        * runtime/MarkedSpace.cpp:
+        * runtime/PropertyNameArray.cpp:
+        * runtime/ScopeChain.h:
+        (JSC::ExecState::globalThisValue):
+        * wtf/DateMath.cpp:
+
+2011-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
+
+        This patch makes sure that all JSCell pointers written to
+        the registerfile are correctly tagged as JSCells, and replaces
+        raw int usage with the immediate representation.
+
+        For performance, register pressure, and general saneness reasons
+        I've added abstractions for reading and writing the tag
+        and payload of integer registers directly for the JSVALUE64
+        encoding.
+
+        * interpreter/Register.h:
+        (JSC::Register::withInt):
+        (JSC::Register::withCallee):
+        (JSC::Register::operator=):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_load_varargs):
+        (JSC::JIT::emitSlow_op_load_varargs):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::intPayloadFor):
+        (JSC::JSInterfaceJIT::intTagFor):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce project_dir variable and make paths a whole lot saner. Ok, a little bit saner.
+        https://bugs.webkit.org/show_bug.cgi?id=56231
+
+        * JavaScriptCore.gypi: Added project_dir variable.
+        * gyp/JavaScriptCore.gyp: Changed to use project_dir, rather than DEPTH/JavaScriptCore.
+        * gyp/generate-dtrace-header.sh: Changed to use project_dir.
+
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Start using derived sources correctly and link minidom with JavaScriptCore gyp project.
+        https://bugs.webkit.org/show_bug.cgi?id=56217
+
+        * gyp/JavaScriptCore.gyp: Added derived source files and passing of shared directory
+            to the scripts.
+        * gyp/generate-derived-sources.sh: Changed to use passed directory.
+        * gyp/generate-dtrace-header.sh: Ditto.
+
+2011-03-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8955589> Adopt AVFoundation media back end on Lion.
+
+        No new tests, existing media tests cover this.
+
+        * JavaScriptCore.exp: Export cancelCallOnMainThread
+        * wtf/Platform.h: Define WTF_USE_AVFOUNDATION.
+
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Tweak dylib paths and add dtrace header generation action to JavaScriptCore gyp project.
+        https://bugs.webkit.org/show_bug.cgi?id=56207
+
+        * JavaScriptCore.gypi: Added Tracing.d to the sources.
+        * gyp/generate-dtrace-header.sh: Added.
+        * gyp/JavaScriptCore.gyp: Updated dylib paths (now the project can see them),
+            and added DTrace header generating step.
+
+2011-03-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix allocation of native function with a cached thunk
+        https://bugs.webkit.org/show_bug.cgi?id=56127
+
+        Fix this race condition found while fixing zombies.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::clearWeakPointers):
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::markChildren):
+        * runtime/JSValue.h:
+        (JSC::JSValue::decode):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::createStructure):
+        * runtime/MarkedBlock.cpp:
+
+2011-03-10  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] fast/workers/stress-js-execution.html is crashing on Qt bot (intermittently)
+        https://bugs.webkit.org/show_bug.cgi?id=33008
+
+        Defining WTF_USE_PTHREAD_BASED_QT=1 for platforms where QThread uses pthread internally.
+        Symbian is excluded because pthread_kill does not work on it. Mac is excluded because
+        it has its own ways to do JSC threading.
+
+        Defining WTF_USE_PTHREADS inside MachineStackMarker.cpp if USE(PTHREAD_BASED_QT) is true.
+
+        * runtime/MachineStackMarker.cpp:
+        * wtf/Platform.h:
+
+2011-03-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 56077 - ES5 conformance issues with RegExp.prototype
+
+        There are three issues causing test failures in sputnik.
+
+        (1) lastIndex should be converted at the point it is used, not the point it is set (this is visible if valueOf is overridden).
+        (2) The 'length' property of the test/exec functions should be 1.
+        (3) If no input is specified, the input to test()/exec() is "undefined" (i.e. ToString(undefined)) - not RegExp.input.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::markChildren):
+            - Added to mark lastIndex
+        (JSC::regExpObjectLastIndex):
+        (JSC::setRegExpObjectLastIndex):
+            - lastIndex is now stored as a JSValue.
+        (JSC::RegExpObject::match):
+            - Use accessor methods to get/set lastIndex, add fast case for isUInt32 (don't convert to double).
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        (JSC::RegExpObject::setLastIndex):
+            - Set lastIndex, either from a size_t or a JSValue.
+        (JSC::RegExpObject::getLastIndex):
+            - Get lastIndex.
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+            - Initialize as a JSValue.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+            - Add test/exec properties with length 1.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+            - Do not read RegExp.input if none is provided.
+        * tests/mozilla/js1_2/regexp/RegExp_input.js:
+        * tests/mozilla/js1_2/regexp/RegExp_input_as_array.js:
+            - Update these tests (they relied on non-ES5 behaviour).
+
+2011-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in 80277 and 80280 with event handler layout test failures fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=55653        
+
+        The failures were caused by a last minute typo: assigning to currentEvent
+        instead of m_currentEvent.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * runtime/Arguments.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.h:
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+
+2011-03-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        jquery/manipulation.html fails after r80598
+        https://bugs.webkit.org/show_bug.cgi?id=56019
+
+        When linking a call, codeblock now takes ownership of the linked function
+        This removes the need for unlinking, and thus the incorrectness that was
+        showing up in these tests.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::setUnlinked):
+        (JSC::CodeBlock::addCaller):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::linkConstruct):
+        * jit/JIT.h:
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+
+2011-03-09  Daniel Bates  <dbates@rim.com>
+
+        Attempt to fix the WinCE build after changeset 80684 <http://trac.webkit.org/changeset/80684>
+        (Bug #56041<https://bugs.webkit.org/show_bug.cgi?id=56041>).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Substitute variable callFrame for exec in call to createSyntaxError().
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 56041 - RexExp constructor should only accept flags "gim"
+        Fix for issues introduced in r80667.
+
+        Invalid flags to a RegExp literal are a late syntax error!
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addRegExp):
+            - Pass a PassRefPtr<RegExp>
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addRegExp):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        * bytecompiler/BytecodeGenerator.h:
+            - Pass a PassRefPtr<RegExp>
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+            - Should not be ASSERTing that the flags are valid - this is a late(er) error.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            - Need to check for error from RegExp constructor.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+            - Need to check for error from RegExp constructor.
+        * runtime/RegExp.h:
+        (JSC::RegExp::isValid):
+            - Make isValid check that the regexp was created with valid flags.
+        * runtime/RegExpKey.h:
+            - Since we'll not create RegExp objects with invalid flags, separate out the deleted value.
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix part 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 56041 - RexExp constructor should only accept flags "gim"
+        We also should be passing the flags around as a bitfield rather than a string,
+        and should not have redundant, incompatible code for converting the string to a bitfield!
+
+        * JavaScriptCore.exp:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+            - Need to parse flags string to enum.
+        * runtime/RegExp.cpp:
+        (JSC::regExpFlags):
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+            - Add method to parse flags string to enum, change constructor/create args to take enum.
+        * runtime/RegExp.h:
+        (JSC::RegExp::global):
+        (JSC::RegExp::ignoreCase):
+        (JSC::RegExp::multiline):
+            - Change to use new enum values.
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+            - Changed to use regExpFlags enum instead of int/const UString&.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+            - Add use new enum parsing, check for error.
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+            - Pass NoFlags value instead of empty string.
+        (JSC::regExpProtoFuncCompile):
+            - Add use new enum parsing, check for error.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+            - Pass NoFlags value instead of empty string.
+
+2011-03-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Bug 55994 - Functions on Array.prototype should check length first.
+        These methods are designed to work on generic objects too, and if 'length'
+        is a getter that throws an exception, ensure this is correctly thrown
+        (even if other exceptions would be thrown, too).
+
+        Make the length check the first thing we do.
+        This change shows a progression on SunSpider on my machine, but this is likely bogus.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+
+2011-03-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make CodeBlock GC write barrier safe
+        https://bugs.webkit.org/show_bug.cgi?id=55910
+
+        In order to make CodeBlock WriteBarrier safe it was necessary
+        to make it have a single GC owner, and for that reason I have
+        made ExecutableBase a GC allocated object.  This required
+        updating their creation routines as well as all sites that hold
+        a reference to them.  GC objects that held Executable's have been
+        converted to WriteBarriers, and all other sites now use Global<>.
+
+        As an added benefit this gets rid of JSGlobalData's list of
+        GlobalCodeBlocks.
+
+        Perf testing shows a 0.5% progression on v8, vs. a 0.3% regression
+        on SunSpider.  Given none of the tests that show regressions
+        demonstrate a regression on their own, and sampling shows up nothing.
+        I suspect we're just getting one or two additional gc passes at
+        the end of the run.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::EvalCodeCache::markAggregate):
+        (JSC::CodeBlock::markAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::addConstant):
+        (JSC::CodeBlock::constantRegister):
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addFunctionDecl):
+        (JSC::CodeBlock::addFunctionExpr):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ExecState::r):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/SamplingTool.h:
+        (JSC::ScriptSampleRecord::ScriptSampleRecord):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadDouble):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::hostFunctionStub):
+        (JSC::JITThunks::clearHostFunctionStubs):
+        * jit/JITStubs.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::~FunctionExecutable):
+        (JSC::EvalExecutable::markChildren):
+        (JSC::ProgramExecutable::markChildren):
+        (JSC::FunctionExecutable::markChildren):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::VPtrHackExecutable::VPtrHackExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::create):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::markRoots):
+        * runtime/Heap.h:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::markChildren):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::markChildren):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::storeVPtrs):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSObject.cpp:
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::markChildren):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObjectData::JSStaticScopeObjectData):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        * runtime/JSZombie.cpp:
+        (JSC::JSZombie::leakedZombieStructure):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::createStructure):
+        * runtime/MarkedSpace.h:
+
+2011-03-07  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r79060): Timestamp is missing from tweets in twitter.
+        https://bugs.webkit.org/show_bug.cgi?id=55228
+
+        A change to the date parser to handle the case where the year is
+        specified before the time zone inadvertently started accepting strings
+        such as '+0000' as valid years. Those strings actually represent time
+        zones in an offset of hours and minutes from UTC, not years.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters): If the current character
+        in dateString is '+' or '-', do not try to parse the next token as a
+        year.
+
+2011-03-06  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Add SHA-1 for new WebSocket protocol
+        https://bugs.webkit.org/show_bug.cgi?id=55039
+
+        The code is based on Chromium's portable SHA-1 implementation
+        (src/base/sha1_portable.cc). Modifications were made in order
+        to make the code comply with WebKit coding style.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/MD5.cpp:
+        (WTF::MD5::MD5):
+        * wtf/SHA1.cpp: Added.
+        (WTF::testSHA1): This function will be run the first time SHA1
+        constructor is called. This function computes a few hash values
+        and checks the results in debug builds. However, constructor is
+        probably not a good place to run these tests, so we need to find
+        a good place for it (bug 55853).
+        (WTF::expectSHA1):
+        (WTF::f):
+        (WTF::k):
+        (WTF::rotateLeft):
+        (WTF::SHA1::SHA1):
+        (WTF::SHA1::addBytes):
+        (WTF::SHA1::computeHash):
+        (WTF::SHA1::finalize):
+        (WTF::SHA1::processBlock):
+        (WTF::SHA1::reset):
+        * wtf/SHA1.h: Added.
+        (WTF::SHA1::addBytes):
+        * wtf/wtf.pri:
+
+2011-03-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add Derived Sources to WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55813
+
+        Rename the action to be friendlier.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-04  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Need symbian version of cryptographicallyRandomValuesFromOS
+        https://bugs.webkit.org/show_bug.cgi?id=55782
+
+        Implement Symbian version of cryptographicallyRandomValuesFromOS
+
+        * wtf/OSRandomSource.cpp:
+        (WTF::cryptographicallyRandomValuesFromOS):
+
+2011-03-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 55815 - Should throw an exception from JSObject::defineOwnProperty if !isExtensible().
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnProperty):
+            Add missing check.
+
+2011-03-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by olliej.
+
+        Bug 54945 - The web page hangs towards the end of page load in Interpreter enabled javascript code in the latest webkit trunk.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            (1) don't infinite loop.
+            (2) goto 1.
+
+2011-03-04  Gavin Barraclough  <barraclough@apple.com>
+
+        cmake build fix.
+
+        * CMakeLists.txt:
+
+2011-03-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add Copy Files step to JavaScriptCore GYP build for apitest and minidom
+        https://bugs.webkit.org/show_bug.cgi?id=55798
+
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded round-trips through ../Source in the Chromium GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55795
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-03-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Use target_defaults to reduce boilerplate in GYP build system
+        https://bugs.webkit.org/show_bug.cgi?id=55790
+
+        Instead of setting up the configuration in each target, just defer to
+        target_defaults.  Also, removed a define that was redundant with the
+        xcconfig.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 55736 - Implement seal/freeze/preventExtensions for normal object types.
+        Provide basic functionallity from section 15.2.4 of ECMA-262.
+        This support will need expanding to cover arrays, too.
+
+        Shows a 0.5% progression on SunSpidey, this seems to be due to changing
+        ObjectConstructor to use a static table.
+
+        * DerivedSources.make:
+        * JavaScriptCore.exp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::objectConstructorTable):
+            Add a static table for ObjectConstructor.
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+            Add a static table for ObjectConstructor.
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            Add a static table for ObjectConstructor.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+            Transition the object's structure.
+        (JSC::JSObject::defineOwnProperty):
+            Check isExtensible.
+        * runtime/JSObject.h:
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::isExtensible):
+            These wrap method on structure.
+        (JSC::JSObject::putDirectInternal):
+            Check isExtensible.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        (JSC::ObjectConstructor::getOwnPropertyDescriptor):
+            Change ObjectConstructor to use a static table.
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+            Add new methods on Object.
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+            init/propagate  m_preventExtensions
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+            transition the structure, materializing the property map, setting m_preventExtensions & changing attributes.
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+            check attributes to detect if object is sealed/frozen.
+        * runtime/Structure.h:
+        (JSC::Structure::isExtensible):
+            checks the m_preventExtensions flag.
+
+2011-03-04  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Adopt VersionStamper tool for Windows WebKit DLLs
+        https://bugs.webkit.org/show_bug.cgi?id=55784
+        <rdar://problem/9021273>
+        
+        We now use a tool to stamp the version number onto the Apple WebKit DLLs
+        during the post-build step.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd:
+
+2011-03-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        JavaScriptCore GYP build should use a header map
+        https://bugs.webkit.org/show_bug.cgi?id=55712
+
+        This patch moves the os-win32 files into their own variable so that we
+        can use a header map in the Apple Mac Xcode build.  The problem is that
+        the header map searches the whole project rather than just the files
+        included in a given target.  Another solution to this problem is to
+        make GYP smarter about filtering out what files are added to the
+        project file.
+
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-03  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove LOOSE_PASS_OWN_ARRAY_PTR from PassOwnArrayPtr.h
+        https://bugs.webkit.org/show_bug.cgi?id=55554
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::copyGlobalsTo): Pass nullptr instead of 0.
+        (JSC::JSGlobalObject::resizeRegisters): Ditto; also use OwnArrayPtr instead of a raw pointer.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addStaticGlobals): Ditto.
+        * wtf/PassOwnArrayPtr.h: Removed #define LOOSE_PASS_OWN_ARRAY_PTR
+        (WTF::PassOwnArrayPtr::PassOwnArrayPtr): Added a constructor that takes nullptr_t.
+
+2011-03-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add jsc to JavaScriptCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55711
+
+        * JavaScriptCore.gypi:
+            - Move jsc.cpp into jsc_files because it's really part of the jsc
+              target.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - Remove extraneous files from the normal jsc build.  I probably
+              added these by mistake at some point.
+        * gyp/JavaScriptCore.gyp:
+            - Add the jsc target to the GYP file.
+
+2011-03-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add testapi to JavaScriptCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55707
+
+        The new testapi target is slightly incomplete.  There's a resource
+        copying step that we don't quite have yet.
+
+        This patch also cleans up some of the configuration issues in
+        JavaScriptCore.xcodeproj.  It seems kind of wordy to repeat these for
+        each target.  I suspect there's a more compact way of defining the
+        configurations, but this removes the "Default" configuration, which is
+        progress.
+
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Teach JavaScriptCore GYP build about private headers
+        https://bugs.webkit.org/show_bug.cgi?id=55532
+
+        This patch distinguishes between public and private framework headers
+        so that public headers are copied into the Headers directory and
+        private headers are copied into the PrivateHeaders directory.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out 80277 and 80280 because they caused event handler layout test
+        failures.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * runtime/Arguments.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.h:
+        * runtime/MarkedSpace.cpp:
+        * runtime/MarkedSpace.h:
+
+2011-03-03  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix. Alter order of headers included to make sure windows.h
+        is configured by wx, and skip Posix implementation file we don't use on Win.
+
+        * wscript:
+        * wtf/wx/StringWx.cpp:
+
+2011-03-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        JSVariableObject needs to use WriteBarrier for symboltable property storage
+        https://bugs.webkit.org/show_bug.cgi?id=55698
+
+        Replace the direct usage of Register in JSVariableObject (and descendents)
+        with WriteBarrier.  This requires updating the Arguments object to use
+        WriteBarrier as well.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::initialize):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::markChildren):
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::copyRegisters):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::markChildren):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::markChildren):
+        (JSC::JSGlobalObject::copyGlobalsFrom):
+        (JSC::JSGlobalObject::copyGlobalsTo):
+        (JSC::JSGlobalObject::resizeRegisters):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setRegisters):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::registerAt):
+        (JSC::JSVariableObject::JSVariableObjectData::JSVariableObjectData):
+        (JSC::JSVariableObject::symbolTableGet):
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        (JSC::JSVariableObject::copyRegisterArray):
+        (JSC::JSVariableObject::setRegisters):
+
+2011-03-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed obsolete symbol.
+
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::getOwnPropertySlot): Don't mark this function
+        inline -- it's virtual.
+
+2011-03-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Moved all variable object storage inline -- upping the object size limit to 1K
+        https://bugs.webkit.org/show_bug.cgi?id=55653
+
+        * JavaScriptCore.exp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * jit/JITOpcodes.cpp:
+        * runtime/Arguments.h:
+        * runtime/JSActivation.h: Removed out-of-line storage. Changed d-> to m_.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedSpace::sizeClassFor): Added an imprecise size class
+        to accomodate objects up to 1K.
+
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h: Removed out-of-line storage. Changed d-> to m_.
+
+        * runtime/JSObject.cpp: Don't ASSERT that JSFinalObject fills the maximum
+        object size, since it doesn't anymore.
+
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSVariableObject.h: Removed out-of-line storage. Changed d-> to m_.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h: Added an imprecise size class to accomodate objects up to 1K.
+
+2011-03-03  Timothy Hatcher  <timothy@apple.com>
+
+        Make APIShims usable from WebCore.
+
+        Reviewed by Oliver Hunt.
+
+        * ForwardingHeaders/JavaScriptCore/APIShims.h: Added.
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-03-03  Peter Varga  <pvarga@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Begin Characters Optimization Causes YARR Interpreter Errors
+        https://bugs.webkit.org/show_bug.cgi?id=55479
+
+        The addBeginTerm function is removed because it doesn't correctly handle those
+        cases when an "invalid" term has been
+        collected (e.g. CharacterClass). Move the removed function to the
+        setupAlternativeBeginTerms method's switch-case
+        where the non-allowed cases are correctly handled.
+
+        Reenable the Beginning Character Optimization in the YARR Interpreter again.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeBeginTerms):
+        (JSC::Yarr::YarrPattern::compile):
+
+2011-03-02  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebKit2: Use CFNetwork Sessions API.
+        https://bugs.webkit.org/show_bug.cgi?id=55435
+
+        Add the ability to create a Private Browsing storage session.
+
+        * wtf/Platform.h:
+        Add a new #define for using CF Storage Sessions.
+
+2011-03-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Remove "register slot" concept from PropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=55621
+
+        PropertySlot had already stopped storing Register "slots"
+        so this patch is simply removing that api entirely.
+        This exposed a problem in the ProgramNode constructor for
+        BytecodeGenerator where it reads from the registerfile
+        before it has initialised it.
+
+        This bug wasn't a problem before as we were merely testing
+        for property existence rather than the actual value, and
+        used to work because setRegisterSlot didn't check that the
+        provided slot contained an initialised value.
+
+        To get around this issue we now use symbolTableHasProperty
+        to do the symbol table check without trying to read the
+        RegisterFile.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::symbolTableHasProperty):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTableGet):
+        * runtime/PropertySlot.h:
+
+2011-03-02  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add feature define for data transfer items
+        https://bugs.webkit.org/show_bug.cgi?id=55510
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2011-03-02  Adam Roben  <aroben@apple.com>
+
+        Delete old .res files whenever any .vsprops file changes
+
+        Prospective fix for <http://webkit.org/b/55599> r80079 caused incremental Windows builds to
+        fail
+
+        Reviewed by Tony Chang.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/react-to-vsprops-changes.py:
+        (main): Restructured code to loop over a set of file extensions, deleting any old files that
+        have that extension. Now deletes .res files, too. (We previously deleted any file matching
+        *.manifest*, but that turned out to just be the union of *.manifest and *.res.)
+
+2011-03-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Teach JavaScriptCore GYP build how to build minidom
+        https://bugs.webkit.org/show_bug.cgi?id=55536
+
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        JavaScriptCore GYP build should copy some headers into the target framework
+        https://bugs.webkit.org/show_bug.cgi?id=55524
+
+        After this patch, all the framework headers are exported as public
+        headers.  We need to teach GYP how to handle private headers.
+
+        I struggled to determine how to store the information about whether a
+        header was public, private, or project (i.e., not exported).
+        Generally, the GYPI should just list the files, but it seemed siliy to
+        have an almost duplicated list of files in the GYP file itself.  If
+        this design doesn't scale, we might have to revisit it in the future.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80079.
+        http://trac.webkit.org/changeset/80079
+        https://bugs.webkit.org/show_bug.cgi?id=55547
+
+        "Broke the Win debug build?" (Requested by dcheng on #webkit).
+
+        * wtf/Platform.h:
+
+2011-03-01  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add feature define for data transfer items
+        https://bugs.webkit.org/show_bug.cgi?id=55510
+
+        * wtf/Platform.h:
+
+2011-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Joseph Pecoraro.
+
+        Misaligned memory access in CloneDeserializer on all ARM arch.
+        https://bugs.webkit.org/show_bug.cgi?id=48742
+
+        Add a CPU class for architectures that need aligned addresses
+        for memory access.
+
+        * wtf/Platform.h:
+
+2011-03-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add pre- and post-build actions for JavaScriptCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=55507
+
+        After this patch, we have all the steps for building the main
+        JavaScriptCore framework except the "copy headers" step, which I'll do
+        next.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-03-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rolled back in r79627 now that the underlying cause for it crashing is fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=55159
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocateSlowCase):
+        * runtime/Heap.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedSpace::sizeClassFor):
+        (JSC::JSCell::Heap::allocate):
+        (JSC::JSCell::JSCell::operator new):
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::SizeClass):
+
+2011-03-01  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Replace two script phases that do nothing but copy files with copy files build phases.
+
+        This speeds up the build by a few seconds on high-end Mac Pros.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2011-03-01  David Kilzer  <ddkilzer@apple.com>
+
+        Spring cleaning!
+
+        Rubber-stamped by Mark Rowe.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        (Copy Into Framework): Remove "set -x" and its comment.
+
+2011-03-01  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        TinyMCE not working in nightlies
+        https://bugs.webkit.org/show_bug.cgi?id=54978
+
+        Disabling setupBeginChars() to temporarily work arround the test 
+        failure.  Filed https://bugs.webkit.org/show_bug.cgi?id=55479
+        to track fixing the issue.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPattern::compile):
+
+2011-02-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport parsing no longer accepts "1.0;" value as valid.
+        https://bugs.webkit.org/show_bug.cgi?id=53705
+
+        Include a didReadNumber parameter to String -> float / double
+        conversion functions. This way, if the "ok" boolean out
+        parameter is false, you can check to see if there in fact
+        was a valid number parsed with garbage at the end. Examples
+        of that would be parsing "123x456" would have ok = false,
+        but didReadNumber = true.
+
+        * JavaScriptCore.exp:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::toDouble):
+        (WTF::StringImpl::toFloat):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.cpp:
+        (WTF::String::toDouble):
+        (WTF::String::toFloat):
+        (WTF::charactersToDouble):
+        (WTF::charactersToFloat):
+        * wtf/text/WTFString.h:
+
+2011-02-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Past-the-end writes in VM exceptions (caused crashes in r79627)
+        https://bugs.webkit.org/show_bug.cgi?id=55448
+        
+        Some exceptions had the wrong structures, so they misoverestimated their
+        inline storage sizes.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Use the right structure.
+
+        * runtime/JSObject.h:
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSFinalObject::JSFinalObject): ASSERT that our structure capacity
+        is correct to verify this doesn't happen again.
+
+2011-03-01  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Clean up the project files and move common options to WebKit.pri.
+
+        * JavaScriptCore.pri: Move options also needed in WebCore into WebKit.pri.
+        * JavaScriptCore.pro: Deduplicate options.
+        * jsc.pro: Ditto.
+
+2011-03-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Teach JavaScriptCore GYP build about DEPTH
+        https://bugs.webkit.org/show_bug.cgi?id=55425
+
+        In addition to teaching the JavaScriptCore GYP build about DEPTH, this
+        change overrides the GCC warning configuration to disable a warning
+        that's causing probems in Assertions.cpp.  With that warning disabled,
+        JavaScriptCore builds again.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-02-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r79948.
+        http://trac.webkit.org/changeset/79948
+        https://bugs.webkit.org/show_bug.cgi?id=55439
+
+        "caused crashes on the SL release bot" (Requested by ggaren on
+        #webkit).
+
+        * runtime/JSGlobalData.h:
+        * runtime/WriteBarrier.h:
+
+2011-02-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Darin Adler.
+
+        Bug 55423 - Clean up property tables in Structure
+
+        Encapsulate, reduce duplication of table search code,
+        and reduce the size of the tables (remove the index,
+        just maintain the tables in the correct order).
+
+        Shows a 0.5% - 1% progression on sunspider.
+
+        * JavaScriptCore.exp:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::isPowerOf2):
+        (JSC::nextPowerOf2):
+            bit ops used to calculate table size.
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (JSC::PropertyTable::ordered_iterator::operator++):
+        (JSC::PropertyTable::ordered_iterator::operator==):
+        (JSC::PropertyTable::ordered_iterator::operator!=):
+        (JSC::PropertyTable::ordered_iterator::operator*):
+        (JSC::PropertyTable::ordered_iterator::operator->):
+        (JSC::PropertyTable::ordered_iterator::ordered_iterator):
+            implementation of the iterator types
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::~PropertyTable):
+            constructors take an initial capacity for the table,
+            a table to copy, or both.
+        (JSC::PropertyTable::begin):
+        (JSC::PropertyTable::end):
+            create in-order iterators.
+        (JSC::PropertyTable::find):
+            search the hash table
+        (JSC::PropertyTable::add):
+            add a value to the hash table
+        (JSC::PropertyTable::remove):
+            remove a value from the hash table
+        (JSC::PropertyTable::size):
+        (JSC::PropertyTable::isEmpty):
+            accessors.
+        (JSC::PropertyTable::propertyStorageSize):
+        (JSC::PropertyTable::clearDeletedOffsets):
+        (JSC::PropertyTable::hasDeletedOffset):
+        (JSC::PropertyTable::getDeletedOffset):
+        (JSC::PropertyTable::addDeletedOffset):
+            cache deleted (available) offsets in the property storage array.
+        (JSC::PropertyTable::copy):
+            take a copy of the PropertyTable, potentially expanding the capacity.
+        (JSC::PropertyTable::sizeInMemory):
+            used for DEBUG build statistics
+        (JSC::PropertyTable::reinsert):
+        (JSC::PropertyTable::rehash):
+        (JSC::PropertyTable::tableCapacity):
+        (JSC::PropertyTable::deletedEntryIndex):
+        (JSC::PropertyTable::skipDeletedEntries):
+        (JSC::PropertyTable::table):
+        (JSC::PropertyTable::usedCount):
+        (JSC::PropertyTable::dataSize):
+        (JSC::PropertyTable::sizeForCapacity):
+        (JSC::PropertyTable::canInsert):
+            these methods provide internal implementation.
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::getPropertyNames):
+        (JSC::PropertyTable::checkConsistency):
+        (JSC::Structure::checkConsistency):
+            factored out code to PropertyMapHashTable.h
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::isEmpty):
+        (JSC::Structure::get):
+            factored out code to PropertyMapHashTable.h
+
+2011-02-28  Xan Lopez  <xlopez@igalia.com>
+
+        Another fix build :(
+
+        Fix typo.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::freePlatformThreadRegisters):
+
+2011-02-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix for Snow Leopard.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::freePlatformThreadRegisters):
+
+2011-02-28  Alejandro G. Castro  <alex@igalia.com>
+
+        Unreviewed, fix SnowLeopard compilation after r79952.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::freePlatformThreadRegisters):
+
+2011-02-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <http://webkit.org/b/55430> OwnArrayPtr.h's LOOSE_OWN_ARRAY_PTR results in link errors.
+
+        * wtf/OwnArrayPtr.h:
+        (WTF::::set): Implement OwnArrayPtr::set.
+
+2011-02-28  Martin Zoubek  <martin.zoubek@acision.com> and Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Multithread support for JSC on UNIX
+        https://bugs.webkit.org/show_bug.cgi?id=26838
+
+        Implement suspendThread() and resumeThread() for systems with
+        pthread.h using thread signal handler.
+
+        * runtime/MachineStackMarker.cpp:
+        (JSC::pthreadSignalHandlerSuspendResume):
+        (JSC::MachineStackMarker::Thread::Thread):
+        (JSC::getCurrentPlatformThread):
+        (JSC::suspendThread):
+        (JSC::resumeThread):
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        (JSC::freePlatformThreadRegisters):
+        (JSC::MachineStackMarker::markOtherThreadConservatively):
+        * wtf/Platform.h: Added Gtk port to use
+        ENABLE_JSC_MULTIPLE_THREADS.
+
+2011-02-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Stop using DeprecatedPtr for the global exception slot
+        https://bugs.webkit.org/show_bug.cgi?id=55424
+
+        Create GCRootPtr to signify that the exception slot is
+        a gcroot, and so is exempt from the usual writebarrier
+        restrictions.
+
+        * runtime/JSGlobalData.h:
+        * runtime/WriteBarrier.h:
+        (JSC::GCRootPtr::GCRootPtr):
+        (JSC::GCRootPtr::operator=):
+
+2011-02-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Use more xcconfig files in JavaScriptCore gyp build
+        https://bugs.webkit.org/show_bug.cgi?id=55391
+
+        The GYP experts tell me that we have have a total of two xcconfig
+        files: one for the xcodeproj as a whole and one for each target.  This
+        patch uses that technique to re-use the existing xcconfig files and
+        eliminate the duplication.
+
+        Technically, this patch introduces some build errors because the
+        xcconfig files assume that the xcodeproj file is one level higher in
+        the directory hierarchy.  Specifically, the xcodeproj file can no
+        longer find the Info.plist or the prefix header.  I plan to fix that in
+        a subsequent patch.
+
+        Also, this patch introduces the Release and Production configurations,
+        which should work correctly now.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-02-28  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Add symbol to export.
+
+2011-02-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make ScopeChainNode GC allocated
+        https://bugs.webkit.org/show_bug.cgi?id=55283
+
+        Simplify lifetime and other issues with the scopechain
+        by making it gc allocated.  This allows us to simplify
+        function exit and unwinding, as well as making the
+        current iterative refcounting go away.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::createActivation):
+        * bytecode/StructureStubInfo.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/Debugger.cpp:
+        (JSC::Recompiler::operator()):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::scopeChain):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::depth):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_end):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * runtime/ArgList.cpp:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        * runtime/DateConversion.cpp:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSChunk.cpp: Added.
+        * runtime/JSChunk.h: Added.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::markChildren):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getConstructData):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::scope):
+        (JSC::JSFunction::setScope):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::markChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::globalScopeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSZombie.cpp:
+        * runtime/MarkedBlock.cpp:
+        * runtime/MarkedSpace.cpp:
+        * runtime/PropertyNameArray.cpp:
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        (JSC::ScopeChainNode::localDepth):
+        (JSC::ScopeChainNode::markChildren):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::ScopeChainNode):
+        (JSC::ScopeChainNode::createStructure):
+        (JSC::ScopeChainNode::push):
+        (JSC::ScopeChainNode::pop):
+        (JSC::ScopeChainIterator::ScopeChainIterator):
+        (JSC::ScopeChainIterator::operator*):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChainIterator::operator++):
+        (JSC::ScopeChainNode::begin):
+        (JSC::ScopeChainNode::end):
+        (JSC::ExecState::globalData):
+        (JSC::ExecState::lexicalGlobalObject):
+        (JSC::ExecState::globalThisValue):
+        * runtime/ScopeChainMark.h:
+        * wtf/DateMath.cpp:
+
+2011-02-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement WTF::randomNumber in terms of WTF::cryptographicallyRandomNumber when possible
+        https://bugs.webkit.org/show_bug.cgi?id=55326
+
+        Currently, randomNumber does a bunch of platform-specific work that to
+        get a cryptographic randomness when available.  Instead, we should use
+        cryptographicallyRandomNumber, which abstracts this work.
+        Unfortunately, we can't remove all of the WTF::randomNumber
+        implementation because not every port has access to cryptographically
+        random numbers.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2011-02-27  Benjamin Poulain  <ikipou@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Eliminate DeprecatedPtrList from RenderBlock
+        https://bugs.webkit.org/show_bug.cgi?id=54972
+
+        Add methods find() and contains() using an adaptor to ListHashSet.
+        Those method are like the one of HashSet, they allow to find objects
+        based on a different key than the one used to define the set.
+
+        Add convenience methods for direct access to the head and tail of the list.
+        Those methods are providing similar API/behavior as Vector.
+
+        * wtf/ListHashSet.h:
+        (WTF::::first):
+        (WTF::::last):
+        (WTF::::removeLast):
+        (WTF::ListHashSetTranslatorAdapter::hash):
+        (WTF::ListHashSetTranslatorAdapter::equal):
+        (WTF::::find):
+        (WTF::::contains):
+
+2011-02-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Add support for DragonFly BSD
+        https://bugs.webkit.org/show_bug.cgi?id=54407
+
+        DragonFly BSD is based on FreeBSD, so handle it like FreeBSD.
+
+        * wtf/Platform.h:
+
+2011-02-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        JavaScriptCore should use the xcconfig file instead of importing that information into GYP
+        https://bugs.webkit.org/show_bug.cgi?id=55282
+
+        Technically, this breaks the build because I had removed one of the
+        warnings in this config file, but this change seems like an
+        improvement.
+
+        * gyp/JavaScriptCore.gyp:
+
+2011-02-26  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SH4 JIT SUPPORT
+        https://bugs.webkit.org/show_bug.cgi?id=44329
+
+        Provide an ExecutableAllocater::cacheFlush() implementation for
+        Linux/SH4.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2011-02-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r79627.
+        http://trac.webkit.org/changeset/79627
+        https://bugs.webkit.org/show_bug.cgi?id=55274
+
+        broke worker tests (Requested by olliej on #webkit).
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocate):
+        * runtime/Heap.h:
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell::operator new):
+        (JSC::JSCell::MarkedSpace::sizeClassFor):
+        (JSC::JSCell::MarkedSpace::allocate):
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::SizeClass):
+
+2011-02-25  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Leak in JSParser::Scope of ScopeLabelInfo Vector
+        https://bugs.webkit.org/show_bug.cgi?id=55249
+
+        Changed m_labels to be an OwnPtr<>.  Added VectorTraits
+        and Scope copy constructor to support this change.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::Scope::~Scope):
+
+2011-02-25  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        WebSocket uses insecure random numbers
+        https://bugs.webkit.org/show_bug.cgi?id=54714
+
+        * JavaScriptCore.exp: Export WTF::cryptographicallyRandomNumber()
+
+2011-02-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Move timeBeginPeriod into OS(WINDOWS) section
+        https://bugs.webkit.org/show_bug.cgi?id=55247
+
+        * jsc.cpp:
+        (main): timeBeginPeriod is available on all Windows versions and not compiler specific.
+
+2011-02-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r79695.
+
+        * jsc.cpp:
+        (main): SetErrorMode isn't available on WinCE.
+
+2011-02-25  Adam Roben  <aroben@apple.com>
+
+        Work around Cygwin's crash-suppression behavior
+
+        Cygwin calls ::SetErrorMode(SEM_FAILCRITICALERRORS), which any processes it launches will
+        inherit. This is bad for testing/debugging, as it causes the post-mortem debugger not to be
+        invoked. (Cygwin does this because it makes crashes more UNIX-y.) We reset the error mode
+        when our test apps launch to work around Cygwin's behavior.
+
+        Fixes <http://webkit.org/b/55222> Test apps crash silently (without invoking post-mortem
+        debugger) when launched from Cygwin 1.7
+
+        Reviewed by Darin Adler.
+
+        * API/tests/testapi.c: Added a now-needed #include.
+        (main):
+        * jsc.cpp:
+        (main):
+        Call ::SetErrorMode(0) to undo Cygwin's folly.
+
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Define NOMINMAX like many of our
+        other projects do so that windows.h won't define min/max macros that interfere with
+        std::numeric_limits<T>::min/max.
+
+2011-02-24  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add GYP project for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=55027
+
+        Again, this GYP files is very rough, but it succeeds in building
+        JavaScriptCore.  There's a lot more work to do here, especially in the
+        area of sharing with JavaScriptGlue.gyp.  This patch is more of a
+        checkpoint so that other folks can help out if they wish.
+
+        * gyp: Added.
+        * gyp/JavaScriptCore.gyp: Added.
+        * gyp/generate-derived-sources.sh: Added.
+
+2011-02-24  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add missing files to JavaScriptCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=55193
+
+        I forgot to add mm files in my previous patch.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+
+2011-02-24  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove unused parameter name in GCActivityCallback.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=55194
+
+        This change is not strictly required for the GYP-based build system,
+        but I noticed this error when working on the new build system.
+
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+
+2011-02-24  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add a USE() macro to control use of the built-in UTF8 codec
+        https://bugs.webkit.org/show_bug.cgi?id=55189
+
+        Defaults USE(BUILTIN_UTF8_CODEC) to true for all platforms except chromium, which controls the flag via features.gypi.
+
+        * wtf/Platform.h:
+
+2011-02-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Variable-sized allocation (but still capped at 64 bytes)
+        https://bugs.webkit.org/show_bug.cgi?id=55159
+        
+        SunSpider reports no change.
+
+        * JavaScriptCore.exp: Some day, I hope not to have to edit this file.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocateSlowCase): Split allocation into a fast and slow
+        case, so the fast case can inline size class selection and turn it into
+        a compile-time constant.
+        
+        Changed the collect-on-every allocation debugging switch to collect only
+        on every slow allocation, so you can still flip the switch without
+        recompiling the world. This may also be preferable for debugging purposes,
+        since collecting after every single allocation can be unusably slow,
+        and can mask problems by running destructors early.
+
+        * runtime/Heap.h: Ditto.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedSpace::sizeClassFor):
+        (JSC::JSCell::Heap::allocate):
+        (JSC::JSCell::JSCell::operator new): The inlining mentioned above.
+
+        * runtime/MarkedBlock.h: Dropped the block size from 256KB to 16KB. With
+        multiple size classes, allocating a full 256KB for the first allocation
+        in a given class can be pathologically wasteful. (8KB, or 4KB Mac and
+        8KB Windows, would be even better, but that seems to be a peformance
+        regression for now.)
+        
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::reset): There's more than one size class now, and its
+        cell size is not constant.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::SizeClass): Ditto.
+
+2011-02-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make WeakGCMap use new handle infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=55100
+
+        Remove old WeakGCMap implementation and move over to new handle
+        based logic.
+
+        This has a number of benefits, most notably it makes a WeakGCMap
+        always reflect the true state of the world by as all entries are
+        removed at the first gc cycle that makes them dead.  This allows
+        us to get rid of code in a wide variety of objects where the only
+        purpose was to remove themselves from maps.
+
+        It also means that we no longer need to have special "unchecked"
+        versions of any functions on WeakGCMap.  Alas in order to maintain
+        compatibility with the JSWeakObjectMapClear API it is still
+        necessary to have an api that resembles uncheckedRemove, this is
+        now deprecatedRemove and will be dealt with in a later patch.
+
+        In order to get correct semantics in WeakGCMap we need more
+        contextual information in the finalizer, so we've added an
+        abstract class based finaliser and a context parameter to the
+        calls.
+
+        The new an improved WeakGCMap also results in sigificantly more
+        churn in the weak handle lists so exposed some potential problems
+        during the post mark phase which have been rectified as well.
+
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JSWeakObjectMapRefPrivate.h:
+        * runtime/Heap.cpp:
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::protectedGlobalObjectCount):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::iterator::iterator):
+        (JSC::WeakGCMap::iterator::get):
+        (JSC::WeakGCMap::iterator::getSlot):
+        (JSC::WeakGCMap::iterator::operator++):
+        (JSC::WeakGCMap::iterator::operator==):
+        (JSC::WeakGCMap::iterator::operator!=):
+        (JSC::WeakGCMap::WeakGCMap):
+        (JSC::WeakGCMap::isEmpty):
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::get):
+        (JSC::WeakGCMap::getSlot):
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::take):
+        (JSC::WeakGCMap::size):
+        (JSC::WeakGCMap::deprecatedRemove):
+        (JSC::WeakGCMap::begin):
+        (JSC::WeakGCMap::end):
+        (JSC::WeakGCMap::~WeakGCMap):
+        (JSC::WeakGCMap::finalize):
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::set):
+
+2011-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make weaklist processing deal with weak handles being removed during the iteration
+        https://bugs.webkit.org/show_bug.cgi?id=55105
+
+        It is possible for the handle heap to end up in a broken state if
+        a handle's finalizer removes either the current or next handle
+        to be visited during the post-gc cleanup.  This patch removes that
+        problem by allowing the deallocate(Node*) routine to update the
+        iterator if it is called during finalization.
+
+        * collector/handles/HandleHeap.cpp:
+        (JSC::HandleHeap::HandleHeap):
+        (JSC::HandleHeap::updateAfterMark):
+        (JSC::HandleHeap::clearWeakPointers):
+        (JSC::HandleHeap::writeBarrier):
+        (JSC::HandleHeap::protectedGlobalObjectCount):
+        * collector/handles/HandleHeap.h:
+        (JSC::Finalizer::~Finalizer):
+        (JSC::HandleHeap::getFinalizer):
+        (JSC::HandleHeap::deallocate):
+        (JSC::HandleHeap::makeWeak):
+        (JSC::HandleHeap::makeSelfDestroying):
+        (JSC::HandleHeap::Node::Node):
+        (JSC::HandleHeap::Node::setFinalizer):
+        (JSC::HandleHeap::Node::finalizer):
+        (JSC::HandleHeap::Node::finalizerContext):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::setGlobalObject):
+        (JSC::GlobalObjectNotifier::finalize):
+        (JSC::RegisterFile::globalObjectCollectedNotifier):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * runtime/Heap.cpp:
+        (JSC::Heap::destroy):
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::WeakGCPtr):
+        (JSC::WeakGCPtr::set):
+
+2011-02-24  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        PatternAlternative leaked in YarrPatternConstructor::atomParenthesesEnd()
+        https://bugs.webkit.org/show_bug.cgi?id=55156
+
+        Added code to delete unneeded PatternAlternative after it is removed
+        from m_alternatives Vector.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
+
+2011-02-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        VectorBuffer should not call malloc(0)
+        https://bugs.webkit.org/show_bug.cgi?id=55091
+
+        Turns out the malloc() call which was so hot in:
+        https://bugs.webkit.org/show_bug.cgi?id=55005
+        was actually just malloc(0).
+
+        We shouldn't be calling malloc(0) anyway, since there is no need to
+        and it might actually do work on some systems.
+        I believe on Mac it ends up taking the standard spinlocks (expensive)
+        and the code on Brew actually does a malloc(1) instead.  Neither is desirable.
+
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::allocateBuffer):
+        (WTF::VectorBufferBase::tryAllocateBuffer):
+
+2011-02-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove obsolete PLATFORM(CI)
+        https://bugs.webkit.org/show_bug.cgi?id=55082
+
+        * wtf/Platform.h:
+
+2011-02-24  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Remove the GFile GOwnPtr specialization
+        https://bugs.webkit.org/show_bug.cgi?id=55154
+
+        Remove the GFile specialization of GOwnPtr. It's sufficient to use GRefPtr
+        to track GFiles since they are just regular reference-counted GObjects.
+
+        * wtf/gobject/GOwnPtr.cpp: Remove GFile specialization.
+        * wtf/gobject/GOwnPtr.h: Ditto.
+
+2011-02-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Rename PLATFORM(SKIA) to USE(SKIA)
+        https://bugs.webkit.org/show_bug.cgi?id=55090
+
+        * wtf/Platform.h:
+
+2011-02-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove pthreads dependecy for JSLock
+        https://bugs.webkit.org/show_bug.cgi?id=54832
+
+        JSLock is only needed to support an obsolete execution model where JavaScriptCore
+        automatically protected against concurrent access from multiple threads.
+        So it's safe to disable it on non-mac platforms where we don't have native pthreads.
+
+        * runtime/JSLock.cpp:
+
+2011-02-24  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix MIPS build with new patchOffsetPut/GetByIdPropertyMapOffset1/2 values
+        https://bugs.webkit.org/show_bug.cgi?id=54997
+
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2011-02-24  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] MinGW build fails to link
+        https://bugs.webkit.org/show_bug.cgi?id=55050
+
+        Prepend the libraries of subcomponents instead of appending them
+        to fix the library order according to the dependency of the libraries
+
+        * JavaScriptCore.pri: rename addJavaScriptCore to prependJavaScriptCore
+        * jsc.pro: ditto
+
+2011-02-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Deque<T> should support inline capacity
+        https://bugs.webkit.org/show_bug.cgi?id=55032
+
+        The title says it all.  There are currently no places
+        which use this code yet, however it's been tested in conjunction
+        with code for bug 55005.
+
+        This also adds an ASSERT that capacity is never 1.  If you were able
+        to set the capacity equal to 1, the Deque would just get confused
+        and happily append your item but still think it had size 0.
+
+        * wtf/Deque.h:
+        (WTF::DequeIterator::DequeIterator):
+        (WTF::DequeConstIterator::DequeConstIterator):
+        (WTF::DequeReverseIterator::DequeReverseIterator):
+        (WTF::DequeConstReverseIterator::DequeConstReverseIterator):
+        (WTF::::checkValidity):
+        (WTF::::checkIndexValidity):
+        (WTF::::invalidateIterators):
+        (WTF::::Deque):
+        (WTF::deleteAllValues):
+        (WTF::::operator):
+        (WTF::::destroyAll):
+        (WTF::::~Deque):
+        (WTF::::swap):
+        (WTF::::clear):
+        (WTF::::findIf):
+        (WTF::::expandCapacityIfNeeded):
+        (WTF::::expandCapacity):
+        (WTF::::takeFirst):
+        (WTF::::append):
+        (WTF::::prepend):
+        (WTF::::removeFirst):
+        (WTF::::remove):
+        (WTF::::addToIteratorsList):
+        (WTF::::removeFromIteratorsList):
+        (WTF::::DequeIteratorBase):
+        (WTF::::~DequeIteratorBase):
+        (WTF::::isEqual):
+        (WTF::::increment):
+        (WTF::::decrement):
+        (WTF::::after):
+        (WTF::::before):
+        * wtf/Vector.h:
+
+2011-02-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Ojan Vafai. 
+
+        Add missing files to JavaScriptCore.gypi 
+        https://bugs.webkit.org/show_bug.cgi?id=55020 
+
+        gypi files are supposed to list every file under the sun.  This patch 
+        adds some missing files and sorts the rest. 
+
+        * JavaScriptCore.gypi: 
+
+2011-02-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Refactored MarkedSpace to operate in terms of size classes
+        https://bugs.webkit.org/show_bug.cgi?id=55106
+        
+        SunSpider reports no change.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedSpace::sizeClassFor):
+        (JSC::JSCell::MarkedSpace::allocate): Delegate allocation based on size
+        class. Since these functions are inline, the compiler can constant fold
+        them.
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::cellSize):
+        (JSC::MarkedBlock::size): Factored out a cellSize() helper.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::allocateFromSizeClass):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::SizeClass::SizeClass):
+        (JSC::MarkedSpace::SizeClass::reset): Changed to operate in terms of
+        abstract SizeClass objects, which are independent linked lists of blocks
+        of a certain size class, instead of a single m_heap object.
+
+2011-02-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by James Robinson.
+
+        [Chromium] Use WebKitClient for OSRandomSource instead of trying to talk to the file system in the sandbox
+        https://bugs.webkit.org/show_bug.cgi?id=55093
+
+        Exclude OSRandomSource.cpp from the Chromium build.  This function is
+        implemented in WebKit/chromium/src instead.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2011-02-23  Oliver Hunt  <oliver@apple.com>
+
+        Roll out r64156 as it introduces incorrect behaviour.
+
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::setIndex):
+
+2011-02-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Moved the "nextAtom" allocation pointer into MarkedBlock for better encapsulation
+        https://bugs.webkit.org/show_bug.cgi?id=55079
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::reset): Moved Zombie sweeping here, up from MarkedSpace,
+        since we want Heap to logically control MarkedSpace. MarkedSpace should
+        never choose to sweep itself.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Updated for nextAtom becoming a
+        member of MarkedBlock. No need to reset nextAtom to firstAtom() when
+        we reach the end of a block, since there's now an explicit reset pass
+        during GC.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::reset): Added the nextAtom data member, and reordered
+        some data members to improve cache locality.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap): Removed nextAtom, and added an
+        explicit reset pass.
+
+2011-02-23  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed, rolling out r79428.
+        http://trac.webkit.org/changeset/79428
+        https://bugs.webkit.org/show_bug.cgi?id=54714
+
+        Does not work in the Chromium sandbox
+
+        * JavaScriptCore.exp:
+
+2011-02-23  Adam Roben  <aroben@apple.com>
+
+        Fix an off-by-one error in JSC::appendSourceToError
+
+        Looks like this bug has been around since the code was first added in r35245.
+
+        Fixes <http://webkit.org/b/55052> <rdar://problem/9043512> Crash in JSC::appendSourceToError
+        when running fast/dom/objc-big-method-name.html on Windows with full page heap enabled
+
+        Reviewed by Darin Adler.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::appendSourceToError): When trimming whitespace off the end of the string, examine the
+        character at stop-1 rather than at stop. At this point in the code, stop represents the
+        index just past the end of the characters we care about, and can even be just past the end
+        of the entire data buffer.
+
+2011-02-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Rolled back in r79367 with SnowLeopard Release bot crash fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=54999
+        
+        The crash was caused by failure to update the "nextBlock" pointer when
+        removing a block from the list while shrinking. The fix is to update the
+        "nextBlock" pointer.
+        
+        This crash was very rare because it only happened in cases where the very
+        first block in the heap contained no marked cells.
+
+2011-02-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Include frame numbers in backtraces.
+        https://bugs.webkit.org/show_bug.cgi?id=55060
+
+        * wtf/Assertions.cpp:
+
+2011-02-23  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        latest jsc for armv7 crashes in sunspider tests
+        https://bugs.webkit.org/show_bug.cgi?id=54667
+
+        Update JIT offset values in ARMv7 after r78732. Fixes crashes in
+        SunSpider and JavaScript tests.
+
+        * jit/JIT.h: update values.
+
+2011-02-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r79418.
+        http://trac.webkit.org/changeset/79418
+        https://bugs.webkit.org/show_bug.cgi?id=55043
+
+        "breaks shlib linux build" (Requested by morrita on #webkit).
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * JavaScriptCore.gypi:
+
+2011-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use DEFINE_STATIC_LOCAL for ignoreSetMutex in Structure.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=54831
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/Structure.cpp:
+        (JSC::ignoreSetMutex):
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::initializeThreading):
+        * runtime/Structure.h:
+
+2011-02-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename PLATFORM(CF) to USE(CF)
+        https://bugs.webkit.org/show_bug.cgi?id=53540
+
+        * runtime/DatePrototype.cpp:
+        * runtime/GCActivityCallbackCF.cpp:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * wtf/CurrentTime.cpp:
+        * wtf/Platform.h:
+        * wtf/text/AtomicString.h:
+        * wtf/text/StringImpl.h:
+        (WTF::StringImpl::computeHash):
+        * wtf/text/WTFString.h:
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+
+2011-02-23  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for Windows.
+
+        WebSocket uses insecure random numbers
+        https://bugs.webkit.org/show_bug.cgi?id=54714
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export WTF::cryptographicallyRandomNumber()
+
+2011-02-23  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        WebSocket uses insecure random numbers
+        https://bugs.webkit.org/show_bug.cgi?id=54714
+
+        * JavaScriptCore.exp: Export WTF::cryptographicallyRandomNumber()
+
+2011-02-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Ojan Vafai.
+
+        Add missing files to JavaScriptCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=55020
+
+        gypi files are supposed to list every file under the sun.  This patch
+        adds some missing files and sorts the rest.
+
+        * JavaScriptCore.gypi:
+
+2011-02-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r79367.
+        http://trac.webkit.org/changeset/79367
+        https://bugs.webkit.org/show_bug.cgi?id=55012
+
+        all layout tests are crashing on Snow Leopard (Requested by
+        rniwa on #webkit).
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * runtime/MarkedBlock.h:
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::collectorBlock):
+        * wtf/CMakeLists.txt:
+        * wtf/DoublyLinkedList.h: Removed.
+
+2011-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Manage MarkedBlocks in a linked list instead of a vector, so arbitrary removal is O(1)
+        https://bugs.webkit.org/show_bug.cgi?id=54999
+        
+        SunSpider reports no change.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: So many build systems, so little time.
+        * wtf/CMakeLists.txt:
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::setPrev):
+        (JSC::MarkedBlock::setNext):
+        (JSC::MarkedBlock::prev):
+        (JSC::MarkedBlock::next): Added linked list data members and accessors.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        (JSC::MarkedSpace::allocateBlock): Stop using vector, since it doesn't exist anymore.
+
+        (JSC::MarkedSpace::freeBlocks): New helper function for updating relevant
+        data structures when freeing blocks.
+
+        (JSC::MarkedSpace::allocate): Updated for nextBlock being a pointer and
+        not a vector index.
+
+        (JSC::MarkedSpace::shrink): Construct a temporary list of empties and
+        then free them, to avoid modifying our hash table while iterating it.
+        This wasn't a concern before because we were using indirect array
+        indexing, not direct pointer indexing.
+
+        (JSC::MarkedSpace::reset): Updated for nextBlock being a pointer and
+        not a vector index.
+
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap): Changed data type from vector to linked list.
+
+        * wtf/DoublyLinkedList.h: Added. New linked list class.
+        (WTF::::DoublyLinkedList):
+        (WTF::::isEmpty):
+        (WTF::::head):
+        (WTF::::append):
+        (WTF::::remove):
+
+2011-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 54988 - Re-create StructureTransitionTable class, encapsulate transition table
+
+        The Structure class keeps a table of transitions to derived Structure types. Since
+        this table commonly contains a single entry we employ an optimization where instead
+        of holding a map, we may hold a pointer directly to a single instance of the mapped
+        type. We use an additional bit of data to flag whether the pointer is currently
+        pointing to a table of transitions, or a singleton transition. Previously we had
+        commonly used a pattern of storing data in the low bits of pointers, but had moved
+        away from this since it causes false leaks to be reported by the leaks tool. However
+        in this case, the entries in the map are weak links - this pointer will never be
+        responsible for keeping an object alive.  As such we can use this approach provided
+        that the bit is set when a table is not in use (otherwise the table would appear to
+        be leaked).
+
+        Additionally, the transition table currently allows two entries to exist for a given
+        key - one specialized to a particular value, and one not specialized. This is
+        unnecessary, wasteful, and a little inconsistent. (If you create an entry for a
+        specialized value, then a non-specialized entry, both will exist.  If you create an
+        entry for a non-specialized value, then try to create a specialized entry, only a
+        non-specialized form will be allowed.)
+
+        This shows a small progression on v8.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::remove):
+        (JSC::StructureTransitionTable::add):
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::Hash::hash):
+        (JSC::StructureTransitionTable::Hash::equal):
+        (JSC::StructureTransitionTable::HashTraits::emptyValue):
+        (JSC::StructureTransitionTable::HashTraits::constructDeletedValue):
+        (JSC::StructureTransitionTable::HashTraits::isDeletedValue):
+        (JSC::StructureTransitionTable::StructureTransitionTable):
+        (JSC::StructureTransitionTable::~StructureTransitionTable):
+        (JSC::StructureTransitionTable::isUsingSingleSlot):
+        (JSC::StructureTransitionTable::map):
+        (JSC::StructureTransitionTable::setMap):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+
+2011-02-22  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Redesign the build system
+        https://bugs.webkit.org/show_bug.cgi?id=51339
+
+        Part 2.
+
+        Build WebCore as a static library, compile the WebKit API and WebKit2 API
+        in a final step and link to WebKit2, WebCore and JSC libraries to fix
+        linking issues resulting from stripped away symbols.
+
+        * JavaScriptCore.pri: Remove the workaround.
+
+2011-02-21  Adam Roben  <aroben@apple.com>
+
+        Fix linker warning on Windows
+
+        r79135 tried to export JSObject::s_info by adding it to JavaScriptCore.def. This is the
+        obvious way (since it's how we export functions), but unfortunately it doesn't work correct.
+        r79222 made us export it the right way (using the JS_EXPORTDATA macro), but forgot to remove
+        it from JavaScriptCore.def. This caused us to get linker warnings about exporting the symbol
+        multiple times.
+
+        Rubber-stamped by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed JSObject::s_info.
+
+2011-02-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebResourceCacheManager should be responsible for managing the CFURLCache as well
+        as the WebCore memory cache.
+        https://bugs.webkit.org/show_bug.cgi?id=54886
+        Part of <rdar://problem/8971738>
+
+        Add a new use flag for using the CFURLCache.
+
+        * wtf/Platform.h:
+
+2011-02-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Use ASSERT_JIT_OFFSET in JITPropertyAccess32_64.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=54901
+
+        * jit/JIT.h: swap actual and expected values in message, they were
+        reversed.
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall): use ASSERT_JIT_OFFSET instead of
+        a simple ASSERT.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check): ditto.
+        (JSC::JIT::compileGetByIdHotPath): ditto.
+        (JSC::JIT::compileGetByIdSlowCase): ditto.
+        (JSC::JIT::emit_op_put_by_id): ditto.
+
+2011-02-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Ruber stamped by Sam Weinig
+
+        Bug 54899 - Math.LOG10E should be 0.4342944819032518
+        This value is quoted in section 15.8.1.5 of the spec.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+
+2011-02-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 54894 - Make inheritance structure described by ClassInfo match C++ class hierarchy.
+
+        The ClassInfo objects describe an inheritance hierarchy, with each ClassInfo instance
+        containing a pointer to its parent class. These links should reflect the inheritance
+        hierarchy of C++ classes below JSObject. For the large part it does, but in some cases
+        entries in the C++ hierarchy are skipped over. This presently likely doesn't matter,
+        since intervening C++ classes may not have ClassInfo - but would be a potential bug
+        were ClassInfo were to be added.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObjectFunctions.h:
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/BooleanObject.cpp:
+        * runtime/DateInstance.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/InternalFunction.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.h:
+        * runtime/JSZombie.h:
+        * runtime/MathObject.cpp:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberObject.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/StringPrototype.cpp:
+
+2011-02-21  Adam Roben  <aroben@apple.com>
+
+        Export JSObject::s_info from JavaScriptCore.dll
+
+        This matches what we do for all other ClassInfo objects that WebCore needs access to.
+
+        Fixes <http://webkit.org/b/54881> REGRESSION (r79132): Lots of tests crashing in
+        JSCell::inherits on Windows
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSObject.h: Added JS_EXPORTDATA to s_info.
+
+2011-02-21  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Switched to compiler based detection, where the error actually is.
+
+        It is not the platform that needs the workaround, it is the compiler.
+
+        QtWebKit fails to compile on Windows XP with msvc-2008
+        https://bugs.webkit.org/show_bug.cgi?id=54746
+
+        * bytecode/CodeBlock.h:
+        * runtime/RegExpObject.h:
+
+2011-02-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=54839
+        Remove PrototypeFunction, NativeFunctionWrapper, and GlobalEvalFunction.
+
+        Historically, Native functions used to be represented by PrototypeFunctions, however
+        since introducing call optimizations to the JIT this has used JSFunctions for host
+        calls too. At the point this change was made, the interpreter continued to use
+        PrototypeFunctions, however since fallback from the JIT to interpreter was introduced
+        the interpreter has had to be able to run using host functions represented using
+        JSFunctions - leading to an unnecessary and redundant divergence in behaviour between 
+        interpreter only builds, and situations where the JIT has fallen back to interpreting.
+
+        NativeFunctionWrapper only existed to select between PrototypeFunction and JSFunction
+        for wrappers for host functions, and as such can also be removed.
+
+        GlobalEvalFunction is a redundant wrapper that happens to be derived from
+        PrototypeFunction. It existed to hold a reference to the global object - but since all
+        functions how derive from JSObjectWithGlobalObject, this no longer requires an
+        additional class to provide this functionality.
+
+        * JavaScriptCore.JSVALUE32_64only.exp:
+        * JavaScriptCore.JSVALUE64only.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Removed symbols / references to files.
+
+        * runtime/GlobalEvalFunction.cpp: Removed.
+        * runtime/GlobalEvalFunction.h: Removed.
+        * runtime/NativeFunctionWrapper.h: Removed.
+        * runtime/PrototypeFunction.cpp: Removed.
+        * runtime/PrototypeFunction.h: Removed.
+            Removed.
+
+        * runtime/Executable.cpp:
+        (JSC::NativeExecutable::~NativeExecutable):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::JSFunction::nativeFunction):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getCallData):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getCTIStub):
+            Added interpreter-friendly constructors for NativeExecutables.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        * interpreter/Interpreter.cpp:
+        * jit/JITStubs.cpp:
+        * jsc.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/BooleanPrototype.h:
+        * runtime/CallData.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConstructor.h:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/FunctionPrototype.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/Lookup.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/RegExpPrototype.h:
+        * runtime/SmallStrings.h:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringConstructor.h:
+            Removed use of redundant classes.
+
+2011-02-19  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix for Symbian.
+
+        [Symbian] Revert the removal of linking 
+        against hal after r79126.
+
+        Dependency on the hal library can not be removed 
+        as it is still used (e.g. in MarkStackSymbian.cpp).
+
+        * JavaScriptCore.pri:
+
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Interpreter build fix.
+
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/Lookup.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/StringConstructor.cpp:
+
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix!!
+
+        * JavaScriptCore.exp:
+
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix!!
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix!
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2011-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix!
+
+        * JavaScriptCore.exp:
+
+2011-02-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 54786 - Devirtualize JSCell::classInfo()
+
+        Instead of making a virtual function call, add a pointer to the ClassInfo
+        onto Structure.
+
+        This removes a virtual function call, and paves the way towards removing all
+        the createStructure methods, and StructureFlags/AnonymousSlotCount properties
+        (these should be able to move onto ClassInfo).
+
+        Calls to Structure::create must now pass a pointer to the ClassInfo for the
+        structure. All objects now have a ClassInfo pointer, non-object cell types
+        still do not.
+
+        Changes are most mechanical, involving three steps:
+            * Remove virtual classInfo() methods.
+            * Add &s_info parameter to calls to Structure::create.
+            * Rename ClassInfo static members on classes from 'info' to 's_info',
+              for consistency.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        * debugger/DebuggerActivation.h:
+        * debugger/DebuggerCallFrame.cpp:
+        * interpreter/Interpreter.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITOpcodes.cpp:
+        * jit/JITStubs.cpp:
+        * profiler/Profiler.cpp:
+        * runtime/Arguments.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanObject.cpp:
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateInstance.cpp:
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        * runtime/DatePrototype.h:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/FunctionPrototype.h:
+        * runtime/GetterSetter.h:
+        * runtime/GlobalEvalFunction.h:
+        * runtime/InternalFunction.cpp:
+        * runtime/InternalFunction.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        * runtime/JSArray.h:
+        * runtime/JSByteArray.cpp:
+        * runtime/JSByteArray.h:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        * runtime/JSONObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+        * runtime/JSObjectWithGlobalObject.h:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.h:
+        * runtime/JSWrapperObject.h:
+        * runtime/JSZombie.cpp:
+        * runtime/JSZombie.h:
+        * runtime/Lookup.cpp:
+        * runtime/MathObject.cpp:
+        * runtime/MathObject.h:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.cpp:
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/ScopeChain.cpp:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        * runtime/StringPrototype.cpp:
+        * runtime/StringPrototype.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+
+2011-02-19  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/54808> Change jsc target to build directly into JavaScriptCore.framework/Resources/jsc
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig: Added
+        JAVASCRIPTCORE_FRAMEWORKS_DIR variable.
+        * Configurations/JavaScriptCore.xcconfig: Used
+        JAVASCRIPTCORE_FRAMEWORKS_DIR to define INSTALL_PATH.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Set the INSTALL_PATH
+        for Production configuration of jsc target.
+        (Copy Into Framework): Removed old build phase.
+        (Fix Framework Reference): Renamed build phase to "Copy Into
+        Framework".  Added "set -x" call to make the script print the
+        commands it is running.  Added code to exit early for Production
+        builds since this was never intended for them.  Added code to
+        copy jsc into the JavaScriptCore.framework/Resources directory.
+
+2011-02-19  Siddharth Mathur  <siddharth.mathur@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Symbian] OSAllocator implementation for Symbian OS. 
+        Manages both data and code region requests. V8 and Sunspider tested
+        OK with interpreter. Not tested with JSC JIT yet as it has unrelated
+        failures. Also no thread safety yet.
+        https://bugs.webkit.org/show_bug.cgi?id=51128
+
+        * JavaScriptCore.pri: removed HAL linkage
+        * wtf/Bitmap.h:
+        (WTF::::findRunOfZeros): find run of zeros in a bitmap. quick n dirty
+        * wtf/OSAllocator.h:
+        (WTF::OSAllocator::decommitAndRelease): decommit explicitly 
+        * wtf/OSAllocatorSymbian.cpp: Impl. of OSAllocator interface 
+        (WTF::allocateCodeChunk): utility for code chunks
+        (WTF::deallocateCodeChunk): utility for code chunks
+        (WTF::dataAllocatorInstance): getter for data allocator instance
+        (WTF::OSAllocator::reserveUncommitted):
+        (WTF::OSAllocator::releaseDecommitted):
+        (WTF::OSAllocator::commit):
+        (WTF::OSAllocator::decommit):
+        (WTF::OSAllocator::reserveAndCommit):
+        (WTF::PageAllocatorSymbian::PageAllocatorSymbian): maps requests 
+        to one underlying Symbian chunk
+        (WTF::PageAllocatorSymbian::~PageAllocatorSymbian):
+        (WTF::PageAllocatorSymbian::reserve):
+        (WTF::PageAllocatorSymbian::release):
+        (WTF::PageAllocatorSymbian::commit):
+        (WTF::PageAllocatorSymbian::decommit):
+        (WTF::PageAllocatorSymbian::contains):
+        * wtf/PageAllocatorSymbian.h: Added.
+        (WTF::SymbianChunk::SymbianChunk): wrapper around RChunk  
+        (WTF::SymbianChunk::~SymbianChunk):
+        (WTF::SymbianChunk::contains):
+        
+2011-02-19  Yong Li  <yoli@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=54687
+        When being built with armcc, "int" bit fields are treated as
+        unsigned integers, which will fail the comparisons like "m_offset == -1".
+        Using "signed" fixes the problem.
+
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+
+2011-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Made MarkedSpace block iteration size-class agnostic
+        https://bugs.webkit.org/show_bug.cgi?id=54792
+        
+        SunSpider reports no change.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::forEach): Iterate blocks in hashing order instead of
+        size class list order. This is a much simpler convention in a world
+        of many different size classes.
+
+2011-02-18  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Added friend exception to Qt platform, which also compiles Windows.
+
+        QtWebKit fails to compile on Windows XP with msvc-2008
+        https://bugs.webkit.org/show_bug.cgi?id=54746
+
+        * bytecode/CodeBlock.h:
+        * runtime/RegExpObject.h:
+
+2011-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        (Rolled back in r79022 with crash fixed.)
+
+        Reviewed by Sam Weinig.
+
+        Use hashing instead of linear search in the conservative pointer test
+        https://bugs.webkit.org/show_bug.cgi?id=54767
+        
+        SunSpider reports no change.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy): No need to explicitly clear the blocks array,
+        since freeBlock removes items for us.
+
+        (JSC::MarkedSpace::freeBlock): Fixed a typo that always removed the last
+        block from the block set instead of the block being freed. Changed to
+        remove a block from our data structures before deallocating it, since
+        this is slightly cleaner.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Variable-sized objects will use more,
+        smaller blocks, so it's important for the contains check not to be O(n)
+        in the number of blocks.
+
+2011-02-18  chris reiss  <christopher.reiss@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        REGRESSION: Date.parse("Tue Nov 23 20:40:05 2010 GMT") returns NaN
+        https://bugs.webkit.org/show_bug.cgi?id=49989
+
+        updated test fast/js/script-tests/date-parse-test.js
+
+        * wtf/DateMath.cpp:
+        (WTF::parseDateFromNullTerminatedCharacters):
+
+2011-02-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r79022.
+        http://trac.webkit.org/changeset/79022
+        https://bugs.webkit.org/show_bug.cgi?id=54775
+
+        It broke the whole world (Requested by Ossy on #webkit).
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains):
+
+2011-02-18  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Dave Hyatt.
+
+        Add support for dir=auto
+        https://bugs.webkit.org/show_bug.cgi?id=50916
+
+        Change defaultWritingDirection() to return if the writing direction
+        was determined from a letter with strong directionality or not.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.order:
+        * wtf/text/StringImpl.cpp:
+        (WTF::StringImpl::defaultWritingDirection):
+        * wtf/text/StringImpl.h:
+        * wtf/text/WTFString.h:
+        (WTF::String::defaultWritingDirection):
+
+2011-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Use hashing instead of linear search in the conservative pointer test
+        https://bugs.webkit.org/show_bug.cgi?id=54767
+        
+        SunSpider reports no change.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Variable-sized objects will use more,
+        smaller blocks, so it's important for the contains check not to be O(n)
+        in the number of blocks.
+
+2011-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tightened some usage accounting code in MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=54761
+        
+        SunSpider reports no change.
+
+        * runtime/Heap.cpp:
+        (JSC::Heap::Heap): Initialize the marked space high water mark on
+        construction, instead of relying on some implicit subtleties to make
+        not initializing it work out OK.
+
+        * runtime/Heap.h: Fixed up includes.
+
+        * runtime/MarkedBlock.h: Made firstAtom() static so clients can call it
+        even without having allocated a block.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace): Don't pre-allocate a block, since this
+        would be prohibitively expensive with multiple size classes.
+
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::freeBlock): Track allocated blocks in a hash set,
+        since linear search in the contains check will be prohibitively
+        expensive once we're using lots of smaller blocks.
+
+        (JSC::MarkedSpace::allocate): Don't assume that we always have a block
+        allocated, since we don't anymore. (See above.)
+
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h: Updated for changes mentioned above.
+
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Made object allocation secretly variable-sized (Shhhh!)
+        https://bugs.webkit.org/show_bug.cgi?id=54721
+        
+        SunSpider reports no change.
+        
+        Internally, MarkedBlock now makes variable-sized allocations, even
+        though MarkedSpace doesn't take advantage of this yet.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock): No need to ASSERT that allocations are
+        fixed-sized.
+
+        * runtime/MarkedBlock.h: Shrunk the atom size so we can allocate things
+        that are not multiples of 64 bytes.
+
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed some math errors when when using variable-sized cells
+        https://bugs.webkit.org/show_bug.cgi?id=54717
+        
+        SunSpider reports no change.
+        
+        Computer Science Barbie says, "Math is not so hard afterall!"
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Round up when calculating the
+        minimum number of atoms required for a cell, since rounding down
+        will get you splinched.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::forEach): Changed a bunch of != tests to < tests
+        because m_endAtom is actually a fuzzy end -- iterating from firstAtom()
+        may not hit m_endAtom exactly.
+
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more abstraction for MarkedSpace::contains
+        https://bugs.webkit.org/show_bug.cgi?id=54715
+
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::contains): Added a contains function, so MarkedSpace
+        doesn't have to know how MarkedBlock tracks containment internally.
+
+        * runtime/MarkedSpace.h:
+        (JSC::MarkedSpace::contains): Call through to MarkedBlock to figure out
+        if a cell that seems to be in a block is valid.
+
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the invariant that the last cell in a block is always marked
+        https://bugs.webkit.org/show_bug.cgi?id=54713
+        
+        SunSpider reports no change.
+        
+        This adds one branch to allocation, but simplifies the mark invariant,
+        especially in a world of variable-sized cells. Now, it really is true
+        that any cell whose mark bit is set is a valid, live cell whose
+        constructor has run and whose destructor has not run.
+
+        * runtime/JSCell.h: 
+        (JSC::JSCell::MarkedBlock::allocate): Changed this do-while into a while
+        since we can no longer rely on a set mark bit to break out of this loop
+        before it reaches the end of the block.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep): 
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::markCount):
+        (JSC::MarkedBlock::forEach): No need to set a special last mark bit.
+
+2011-02-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r78856 and r78907.
+        http://trac.webkit.org/changeset/78856
+        http://trac.webkit.org/changeset/78907
+        https://bugs.webkit.org/show_bug.cgi?id=54705
+
+        These seem to break tests on 32-bit builds. (Requested by
+        aroben on #webkit).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * collector/handles/Global.h:
+        (JSC::Global::internalSet):
+        * collector/handles/Handle.h:
+        (JSC::HandleTypes::getFromSlot):
+        (JSC::HandleTypes::toJSValue):
+        (JSC::HandleTypes::validateUpcast):
+        (JSC::HandleConverter::operator->):
+        (JSC::HandleConverter::operator*):
+        (JSC::Handle::Handle):
+        (JSC::Handle::get):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortNumeric):
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        * runtime/SlotAccessor.h: Removed.
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::internalSet):
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::operator*):
+        (JSC::DeprecatedPtr::operator->):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator UnspecifiedBoolType*):
+        (JSC::DeprecatedPtr::operator!):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::operator*):
+        (JSC::WriteBarrierBase::operator->):
+        (JSC::WriteBarrierBase::clear):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+        (JSC::WriteBarrier::WriteBarrier):
+
+2011-02-17  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed.
+
+        [Qt] Buildfix.
+
+        * wtf/RetainPtr.h: Add missing PLATFORM(CF) guard.
+
+2011-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Made MarkedBlock variable-sized
+        https://bugs.webkit.org/show_bug.cgi?id=54692
+        
+        SunSpider reports no change.
+        
+        Each MarkedBlock is now composed of a set of fixed-sized atoms, with one
+        mark bit per atom. A given cell may be composed of one or more atoms.
+        
+        * runtime/Heap.cpp:
+        (JSC::Heap::allocate): Made fixed-sizedness a property of MarkedSpace,
+        bubbling it up from MarkedBlock, since MarkedBlock now supports variable-
+        sizedness.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::MarkedBlock::allocate): Removed use of CELLS_PER_BLOCK and
+        (implicit) one constants -- these quantities are not constant anymore.
+        Updated for switch from cell to atom.
+
+        * runtime/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::sweep):
+        * runtime/MarkedBlock.h:
+        (JSC::MarkedBlock::firstAtom):
+        (JSC::MarkedBlock::atoms):
+        (JSC::MarkedBlock::isAtomAligned):
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::size):
+        (JSC::MarkedBlock::capacity):
+        (JSC::MarkedBlock::atomNumber):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::setMarked):
+        (JSC::MarkedBlock::forEach): Same as above. Also removed use of CELL_SIZE
+        and BLOCK_SIZE, and switched away from calling arbitrary pointers cells.
+
+        * runtime/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocateBlock):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::reset):
+        * runtime/MarkedSpace.h:
+        (JSC::CollectorHeap::CollectorHeap):
+        (JSC::MarkedSpace::contains): Updated for renames. Made fixed-sizedness
+        a property of MarkedSpace.
+
+2011-02-17  Oliver Hunt  <oliver@apple.com>
+
+        Attempt to fix windows build
+
+        * runtime/WriteBarrier.h:
+
+2011-02-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Refactor WriteBarrier and DeprecatedPtr to have less code duplication.
+        https://bugs.webkit.org/show_bug.cgi?id=54608
+
+        Make use of the tricks used for Handle, et al to avoid duplicating all
+        of the logic for DeprecatedPtr and WriteBarrier simply to support known
+        vs. unknown types.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * collector/handles/Global.h:
+        (JSC::Global::internalSet):
+        * collector/handles/Handle.h:
+        (JSC::Handle::Handle):
+        (JSC::Handle::get):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortNumeric):
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        * runtime/SlotAccessor.h: Added.
+        (JSC::SlotTypes::getFromBaseType):
+        (JSC::SlotTypes::convertToBaseType):
+        (JSC::SlotTypes::getFromSlot):
+        (JSC::SlotTypes::toJSValue):
+        (JSC::SlotTypes::validateUpcast):
+        (JSC::SlotAccessor::operator->):
+        (JSC::SlotAccessor::operator*):
+        * runtime/WeakGCPtr.h:
+        (JSC::WeakGCPtr::get):
+        (JSC::WeakGCPtr::internalSet):
+        * runtime/WriteBarrier.h:
+        (JSC::DeprecatedPtr::DeprecatedPtr):
+        (JSC::DeprecatedPtr::get):
+        (JSC::DeprecatedPtr::slot):
+        (JSC::DeprecatedPtr::operator=):
+        (JSC::WriteBarrierTranslator::convertToStorage):
+        (JSC::WriteBarrierTranslator::convertFromStorage):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::get):
+        (JSC::WriteBarrierBase::clear):
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+        (JSC::WriteBarrier::WriteBarrier):
+
+2011-02-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Revert incorrect blind fix and restore previous working code.
+
+        * wtf/wx/StringWx.cpp:
+        (WTF::String::String):
+
+2011-02-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Intermittent crashes beneath MarkStack::drain
+        https://bugs.webkit.org/show_bug.cgi?id=54614
+        <rdar://problem/8971070>
+        
+        The crashes were caused by a GC happening after the global object's
+        property table had grown (due to compilation), but before the properties
+        had been fully initialized by program execution.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Explicitly resize the global
+        object's register storage immediately, without waiting for program
+        execution to do it for us. This ensures that the global object's count
+        of global variables is consistent with the size of its global variable
+        storage at all times, and it ensures that all global variables are
+        properly initialized from the get-go.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resizeRegisters):
+        * runtime/JSGlobalObject.h: Added a helper function for growing the
+        global object's register storage, and initializing new registers.
+
+== Rolled over to ChangeLog-2011-02-16 ==
diff --git a/ChangeLog-2012-10-02 b/ChangeLog-2012-10-02
new file mode 100644
index 0000000..ded22e6
--- /dev/null
+++ b/ChangeLog-2012-10-02
@@ -0,0 +1,20888 @@
+2012-10-02  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r128400): ASSERT (crash in release) @ app.asana.com
+        https://bugs.webkit.org/show_bug.cgi?id=98175
+
+        Reviewed by Oliver Hunt.
+
+        It's bad karma to create a new structure while stealing another structure's property table
+        while leaving the m_offset unset. Eventually someone will then steal your property table, and
+        then you won't know how many properties you have anymore.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::nonPropertyTransition):
+
+2012-10-02  Michael Saboff  <msaboff@apple.com>
+
+        Comment additions after r130109 
+
+        Rubber stamped by Geoffrey Garen.
+
+        Updated comments to how array storage works.
+
+        * runtime/ArrayStorage.h:
+        * runtime/JSArray.cpp:
+
+2012-10-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Block freeing thread should sleep indefinitely when there's no work to do
+        https://bugs.webkit.org/show_bug.cgi?id=98084
+
+        Reviewed by Geoffrey Garen.
+
+        Currently the block freeing thread wakes up once a second to check if there are any blocks 
+        for it to release back to the OS. This is wasteful. We should change it to sleep when it 
+        realizes there are no more blocks to free. Any thread that returns a block to the BlockAllocator 
+        should then notify the block freeing thread that there is more work to do now.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+        * heap/BlockAllocator.h:
+        (BlockAllocator):
+        (JSC::BlockAllocator::deallocate):
+
+2012-10-01  Michael Saboff  <msaboff@apple.com>
+
+        JSArray::unshiftCountSlowCase needs to clear array slots when adding space to end of array
+        https://bugs.webkit.org/show_bug.cgi?id=98101
+
+        Reviewed by Filip Pizlo.
+
+        Cleared new array entries when adding to end due to shifting contents to lower memory.  Also
+        checnaged the order of moving array contents and metadata in the shift left case to avoid
+        clobbering the metadata with array contents.  Optimized the to only make a memmove if the
+        count is non-zero.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::unshiftCount):
+
+2012-10-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Address a FIXME in JSArray::sort
+        https://bugs.webkit.org/show_bug.cgi?id=98080
+        <rdar://problem/12407844>
+
+        Reviewed by Oliver Hunt.
+
+        Get rid of fast sorting of sparse maps. I don't know that it's broken but I do know that we don't
+        have coverage for it. Then also address the FIXME in JSArray::sort regarding side-effecting
+        compare functions.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSArray):
+        * runtime/JSObject.h:
+        (JSC::JSObject::hasSparseMap):
+        (JSObject):
+
+2012-10-01  Jonathan Liu  <net147@gmail.com>
+
+        Remove unused sys/mman.h include
+        https://bugs.webkit.org/show_bug.cgi?id=97995
+
+        Reviewed by Kentaro Hara.
+
+        The sys/mman.h is not used and removing it improves portability as not
+        all systems have sys/mman.h.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2012-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION in m_graph[tailNodeIndex].op() == Flush || m_graph[tailNodeIndex].op() == SetLocal on plus.google.com
+        https://bugs.webkit.org/show_bug.cgi?id=97656
+
+        Reviewed by Mark Hahnenberg.
+
+        There were two bugs here:
+        
+        1) In case of multiple GetLocals to the same captured variable, the bytecode parser would linke the first,
+           rather than the last, of the GetLocals into the vars-at-tail table.
+        
+        2) The constant folding phase was asserting that any GetLocal it eliminates must be linked into the
+           vars-at-tail table, when for captured variables only the last of those should be.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2012-09-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGStructureHoistingPhase SetLocal assumes StructureTransitionWatchpoint has a structure set
+        https://bugs.webkit.org/show_bug.cgi?id=97810
+
+        Reviewed by Mark Hahnenberg.
+
+        No tests because this can't happen in ToT: the structure check hoisting phase runs before any
+        CFA or folding, so the only StructureTransitionWatchpoints it will see are the ones inserted
+        by the parser. But the parser will only insert StructureTransitinWatchpoints on constants, which
+        will not be subject to SetLocals.
+        
+        Still, it would be good to fix this in case things changed.
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-09-27  Mark Lam  <mark.lam@apple.com>
+
+        Put initializeHostCallReturnValue() behind #if ENABLE(JIT).
+        Fixes non JIT builds.
+        https://bugs.webkit.org/show_bug.cgi?id=97838.
+
+        Reviewed by John Sullivan.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2012-09-27  Mark Lam  <mark.lam@apple.com>
+
+        Fixed CallFrameClosure::resetCallFrame() to use the valid
+        range of argument index values.
+        https://bugs.webkit.org/show_bug.cgi?id=97836.
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/CallFrame.h:
+        (ExecState):
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::resetCallFrame):
+
+2012-09-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix usage of COMPILER() macros
+        https://bugs.webkit.org/show_bug.cgi?id=97642
+
+        Reviewed by Geoffrey Garen.
+
+        Add COMPILER(GCC) around compiler specific code and remove it from generic code.
+        This allows us to implement the DFG code for other compilers to in a next step.
+
+        * dfg/DFGOperations.cpp:
+        * jit/HostCallReturnValue.h:
+
+2012-09-27  Andreas Kling  <kling@webkit.org>
+
+        3.20MB below FunctionParameters::create() on Membuster3.
+        <http://webkit.org/b/97730>
+
+        Reviewed by Anders Carlsson.
+
+        Figure out the exact space needed for parameter identifiers and use reserveInitialCapacity().
+        Reduces memory consumption on Membuster3 by ~1.60 MB.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::FunctionParameters):
+
+2012-09-27  Csaba Osztrogonác  <ossy@webkit.org>, Tor Arne Vestbø  <vestbo@webkit.org>
+
+        [Qt] Enable the LLInt on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=95749
+
+        Reviewed by Simon Hausmann.
+
+        * DerivedSources.pri:
+        * JavaScriptCore.pro:
+        * LLIntOffsetsExtractor.pro: Added.
+        * Target.pri:
+
+2012-09-27  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Fix build with static JavaScriptCore library
+
+        * shell/CMakeLists.txt: Define STATICALLY_LINKED_WITH_JavaScriptCore if
+                                JavaScriptCore_LIBRARY_TYPE is set to STATIC.
+
+2012-09-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Proxy the global this in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=97734
+
+        Reviewed by Filip Pizlo.
+
+        Eeep – fix a bug - was leaving the global this proxy's structure's globalObject as 0,
+        and setting the proxy's prototype as the global object, rather than its prototype.
+
+        * jsc.cpp:
+        (GlobalObject::create):
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::createStructure):
+
+2012-09-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-09-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, 32-bit build fix.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2012-09-26  Filip Pizlo  <fpizlo@apple.com>
+
+        jneq_ptr shouldn't have a pointer
+        https://bugs.webkit.org/show_bug.cgi?id=97739
+
+        Reviewed by Oliver Hunt.
+
+        Slamming pointers directly into bytecode is sometimes cool, but in this case it's
+        unwieldy and confusing. Switched the instruction to use an enum instead. This has
+        zero effect on code gen behavior in the JITs. In the LLInt, there is now more
+        indirection, but that doesn't affect benchmarks.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (Instruction):
+        * bytecode/SpecialPointer.cpp: Added.
+        (JSC):
+        (JSC::actualPointerFor):
+        * bytecode/SpecialPointer.h: Added.
+        (JSC):
+        (JSC::pointerIsFunction):
+        (JSC::pointerIsCell):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::actualPointerFor):
+
+2012-09-26  Gavin Barraclough  <barraclough@apple.com>
+
+        REGRESSION (r129456): http/tests/security/xss-eval.html is failing on JSC platforms
+        https://bugs.webkit.org/show_bug.cgi?id=97529
+
+        Reviewed by Filip Pizlo.
+
+        A recent patch changed JSC's EvalError behaviour; bring this more into line with other browsers.
+
+        JSC currently throws an EvalError if you try to call eval with a this object that doesn't
+        match the given eval function. This does not match other browsers, which generally just
+        ignore the this value that was passed, and eval the string in the eval function's environment.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+            - Remove EvalError, ignore passed this value.
+
+2012-09-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Proxy the global this in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=97734
+
+        Reviewed by Oliver Hunt.
+
+        Having jsc diverge from WebCore here is not beneficial; it potentially masks bugs and/or performance
+        problems from command line testing.
+
+        * jsc.cpp:
+        (GlobalObject::create):
+            - Create a this value proxy for the global object.
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+            - Make setGlobalThis protected.
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::create):
+        (JSC::JSProxy::target):
+        (JSC::JSProxy::finishCreation):
+        (JSProxy):
+            - Allow proxy target to be a JSObject, add target to create method.
+
+2012-09-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-09-26  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject::ensureArrayStorage() ignores the possibility that extensions have been prevented
+        https://bugs.webkit.org/show_bug.cgi?id=97719
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC):
+        * runtime/JSObject.h:
+        (JSC::JSObject::ensureArrayStorage):
+        (JSObject):
+
+2012-09-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Generalize JSGlobalThis as JSProxy
+        https://bugs.webkit.org/show_bug.cgi?id=97716
+
+        Reviewed by Oliver Hunt.
+
+        Generalize JSGlobalThis as JSProxy and move proxying functionality up from the window shell into JSProxy.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::toThisObject):
+            - Hoist toThisObject from WebCore.
+        (JSC):
+        * runtime/JSGlobalObject.h:
+            - removed include.
+        (JSC::JSGlobalObject::finishCreation):
+            - JSGlobalThis -> JSObject
+        (JSGlobalObject):
+            - Hoist toThisObject from WebCore.
+        * runtime/JSGlobalThis.cpp: Removed.
+        * runtime/JSGlobalThis.h: Removed.
+        * runtime/JSObject.cpp:
+            - removed include.
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::isProxy):
+            - isGlobalThis -> isProxy
+            - GlobalThisType -> ProxyType
+        * runtime/JSProxy.cpp: Copied from Source/JavaScriptCore/runtime/JSGlobalThis.cpp.
+        (JSC):
+        (JSC::JSProxy::visitChildren):
+        (JSC::JSProxy::setTarget):
+        (JSC::JSProxy::className):
+        (JSC::JSProxy::getOwnPropertySlot):
+        (JSC::JSProxy::getOwnPropertySlotByIndex):
+        (JSC::JSProxy::getOwnPropertyDescriptor):
+        (JSC::JSProxy::put):
+        (JSC::JSProxy::putByIndex):
+        (JSC::JSProxy::putDirectVirtual):
+        (JSC::JSProxy::defineOwnProperty):
+        (JSC::JSProxy::deleteProperty):
+        (JSC::JSProxy::deletePropertyByIndex):
+        (JSC::JSProxy::getPropertyNames):
+        (JSC::JSProxy::getOwnPropertyNames):
+            - Class cretaed from JSGlobalThis, JSDOMWindowShell.
+        * runtime/JSProxy.h: Copied from Source/JavaScriptCore/runtime/JSGlobalThis.h.
+        (JSC::JSProxy::create):
+        (JSC::JSProxy::createStructure):
+        (JSProxy):
+        (JSC::JSProxy::target):
+        (JSC::JSProxy::JSProxy):
+            - Class cretaed from JSGlobalThis, JSDOMWindowShell.
+        * runtime/JSType.h:
+            - GlobalThisType -> ProxyType
+
+2012-09-26  Michael Saboff  <msaboff@apple.com>
+
+        Add ability for JSArray::unshiftCount to unshift in middle of an array
+        https://bugs.webkit.org/show_bug.cgi?id=97691
+
+        Reviewed by Filip Pizlo.
+
+        Changed JSArray::unshiftCount and unshiftCountSlowCase to handle unshifting from the middle of an
+        array.  Depending on where the unshift point is, either the front part of the array will be moved
+        "left" or the back part will be moved right.  Given that unshiftCount only works on contiguous
+        arrays it is safe to use memmove for the moves.
+
+        This change is worth 25% performance improvement on pdfjs.  It doesn't seem to have any impact on
+        any other benchmarks.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::unshift):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::unshiftCount):
+        * runtime/JSArray.h:
+        (JSArray):
+
+2012-09-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r129592.
+        http://trac.webkit.org/changeset/129592
+        https://bugs.webkit.org/show_bug.cgi?id=97670
+
+        Failures in Chromium security tests (Requested by schenney on
+        #webkit).
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+
+2012-09-25  Gavin Barraclough  <barraclough@apple.com>
+
+        REGRESSION (r129456): http/tests/security/xss-eval.html is failing on JSC platforms
+        https://bugs.webkit.org/show_bug.cgi?id=97529
+
+        Reviewed by Filip Pizlo.
+
+        A recent patch changed JSC's EvalError behaviour; bring this more into line with other browsers.
+
+        JSC currently throws an EvalError if you try to call eval with a this object that doesn't
+        match the given eval function. This does not match other browsers, which generally just
+        ignore the this value that was passed, and eval the string in the eval function's environment.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+            - Remove EvalError, ignore passed this value.
+
+2012-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ArrayPush, ArrayPop don't handle clobbering or having a bad time correctly
+        https://bugs.webkit.org/show_bug.cgi?id=97535
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        JSC should dump object size inference statistics
+        https://bugs.webkit.org/show_bug.cgi?id=97618
+
+        Reviewed by Filip Pizlo.
+
+        Added an option to dump object size inference statistics.
+
+        To see statistics on live objects:
+
+            jsc --showHeapStatistics=1
+
+        To see cumulative statistics on all objects ever allocated:
+
+            jsc --showHeapStatistics=1 --objectsAreImmortal=1
+
+            (This is useful for showing GC churn caused by over-allocation.)
+
+        To support this second mode, I refactored Zombies to separate out their
+        immortality feature so I could reuse it.
+
+        * heap/Heap.cpp:
+        (JSC::MarkObject): Helper for making things immortal. We have to checked
+        for being zapped because blocks start out in this state.
+
+        (JSC::StorageStatistics): Gather statistics by walking the heap. Ignore
+        arrays and hash tables for now because they're not our focus. (We'll
+        remove these exceptions in future.)
+
+        (JSC::Heap::collect): Moved zombify to the end so it wouldn't interfere
+        with statistics gathering.
+
+        (JSC::Heap::showStatistics):
+        (JSC::Heap::markAllObjects): Factored out helper, so statistics could
+        take advantage of immortal objects.
+
+        (Zombify): Don't mark immortal objects -- that's another class's job now.
+
+        (JSC::Zombify::operator()):
+        (JSC::Heap::zombifyDeadObjects): Take advantage of forEachDeadCell instead
+        of rolling our own.
+
+        * heap/Heap.h:
+        (Heap):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC::MarkedSpace::forEachDeadCell): Added, so clients don't have to do
+        the iteration logic themselves.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h: New options, listed above. Make sure to initialize
+        based on environment variable first, so we can override with specific settings.
+
+2012-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        We shouldn't use the optimized versions of shift/unshift if the user is doing crazy things to the array
+        https://bugs.webkit.org/show_bug.cgi?id=97603
+        <rdar://problem/12370864>
+
+        Reviewed by Gavin Barraclough.
+
+        You changed the length behind our backs? No optimizations for you then!
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::shiftCount):
+
+2012-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC bindings appear to sometimes ignore the possibility of arrays being in sparse mode
+        https://bugs.webkit.org/show_bug.cgi?id=95610
+
+        Reviewed by Oliver Hunt.
+
+        Add better support for quickly accessing the indexed storage from bindings.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::tryGetIndexQuickly):
+        (JSObject):
+        (JSC::JSObject::getDirectIndex):
+        (JSC::JSObject::getIndex):
+
+2012-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure check hoisting phase doesn't know about the side-effecting nature of Arrayify
+        https://bugs.webkit.org/show_bug.cgi?id=97537
+
+        Reviewed by Mark Hahnenberg.
+
+        No tests because if we use Arrayify then we also use PutByVal(BlankToXYZ), and the latter is
+        already known to be side-effecting. So this bug shouldn't have had any symptoms, as far as I
+        can tell.
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-09-25  Gavin Barraclough  <barraclough@apple.com>
+
+        Regression: put beyond vector length prefers prototype setters to sparse properties
+        https://bugs.webkit.org/show_bug.cgi?id=97593
+
+        Reviewed by Geoff Garen & Filip Pizlo.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+            - Check for self properties in the sparse map - if present, don't examine the protochain.
+
+2012-09-24  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=97530
+        Regression, freeze applied to numeric properties of non-array objects
+
+        Reviewed by Filip Pizlo.
+
+        Object.freeze has a fast implementation in JSObject, but this hasn't been updated to take into account numeric properties in butterflies.
+        For now, just fall back to the generic implementation if the object has numeric properties.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorFreeze):
+            - fallback if the object has a non-zero indexed property vector length.
+
+2012-09-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Bug in numeric accessors on global environment
+        https://bugs.webkit.org/show_bug.cgi?id=97526
+
+        Reviewed by Geoff Garen.
+
+        I've hit this assert in test262 in browser, but haven't yet worked out how to repro in a test case :-/
+        The sparsemap is failing to map back from the global object to the window shell.
+        A test case would need to resolve a numeric property name against the global environment.
+
+        (JSC::SparseArrayEntry::get):
+        (JSC::SparseArrayEntry::put):
+            - Add missing toThisObject calls.
+
+2012-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        SerializedScriptValue isn't aware of indexed storage, but should be
+        https://bugs.webkit.org/show_bug.cgi?id=97515
+        <rdar://problem/12361874>
+
+        Reviewed by Sam Weinig.
+
+        Export a method that WebCore now uses.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/JSObject.h:
+        (JSObject):
+
+2012-09-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove JSObject::unwrappedGlobalObject(), JSObject::unwrappedObject()
+        https://bugs.webkit.org/show_bug.cgi?id=97519
+
+        Reviewed by Geoff Garen.
+
+        unwrappedGlobalObject() was only needed because globalObject() doesn't always return a helpful result -
+        specifically for WebCore's window shell the structure's globalObject is set to null. We can fix this by
+        simply keeping the structure up to date as the window navigates, obviating the need for this function.
+
+        The only other use of unwrappedObject() came from globalFuncEval(), and this can be trivially removed
+        by flipping the way we perform this globalObject check (which we may also be able to remove!) - instead
+        of getting the globalObject from the provided this value & comparing to the expected globalObject, we
+        can get the this value from the expected globalObject, and compare to that provided.
+
+        * runtime/JSGlobalObject.cpp:
+            - Call globalObject() instead of unwrappedGlobalObject().
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+            - Changed to compare this object values, instead of globalObjects -
+              this means we only need to be able to map globalObject -> this,
+              and not vice versa.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::allowsAccessFrom):
+        (JSC::JSObject::createInheritorID):
+            - Call globalObject() instead of unwrappedGlobalObject().
+        * runtime/JSObject.h:
+        (JSObject):
+            - Removed unwrappedGlobalObject(), unwrappedObject().
+
+2012-09-24  Mark Lam  <mark.lam@apple.com>
+
+        Deleting the classic interpreter and cleaning up some build options.
+        https://bugs.webkit.org/show_bug.cgi?id=96969.
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/AbstractPC.h:
+        (AbstractPC):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::getSourceURLFromCallFrame):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::retrieveArgumentsFromVMCode):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcodeID):
+        (Interpreter):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        * offlineasm/asm.rb:
+        * offlineasm/offsets.rb:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        (NativeExecutable):
+        (JSC::NativeExecutable::finishCreation):
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::getHostFunction):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::canUseJIT):
+        (JSC::JSGlobalData::canUseRegExpJIT):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+
+2012-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Nested try/finally should not confuse the finally unpopper in BytecodeGenerator::emitComplexJumpScopes
+        https://bugs.webkit.org/show_bug.cgi?id=97508
+        <rdar://problem/12361132>
+
+        Reviewed by Sam Weinig.
+
+        We're reusing some vector for multiple iterations of a loop, but we were forgetting to clear its
+        contents from one iteration to the next. Hence if you did multiple iterations of finally unpopping
+        (like in a nested try/finally and a jump out of both of them) then you'd get a corrupted try
+        context stack afterwards.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+
+2012-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        ValueToInt32 bool case does bad things to registers
+        https://bugs.webkit.org/show_bug.cgi?id=97505
+        <rdar://problem/12356331>
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+
+2012-09-24  Mark Lam  <mark.lam@apple.com>
+
+        Add cloopDo instruction for debugging the llint C++ backend.
+        https://bugs.webkit.org/show_bug.cgi?id=97502.
+
+        Reviewed by Geoffrey Garen.
+
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/parser.rb:
+
+2012-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        JSArray::putByIndex asserts with readonly property on prototype
+        https://bugs.webkit.org/show_bug.cgi?id=97435
+        <rdar://problem/12357084>
+
+        Reviewed by Geoffrey Garen.
+
+        Boy, there were some problems:
+        
+        - putDirectIndex() should know that it can set the index quickly even if it's a hole and we're
+          in SlowPut mode, since that's the whole point of PutDirect.
+        
+        - We should have a fast path for putByIndex().
+        
+        - The LiteralParser should not use push(), since that may throw if we're having a bad time.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putByIndexInline):
+        (JSObject):
+        (JSC::JSObject::putDirectIndex):
+        * runtime/LiteralParser.cpp:
+        (JSC::::parse):
+
+2012-09-24  Mark Lam  <mark.lam@apple.com>
+
+        Added a missing "if VALUE_PROFILER" around an access to ArrayProfile record.
+        https://bugs.webkit.org/show_bug.cgi?id=97496.
+
+        Reviewed by Filip Pizlo.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Inlined activation tear-off in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=97487
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h: Activation tear-off is always inlined now, so I
+        removed its out-of-line implementation.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Inlined the variable copy and update
+        of JSVariableObject::m_registers. This usually turns into < 10 instructions,
+        which is close to pure win as compared to the operation function call.
+
+        * runtime/JSActivation.h:
+        (JSActivation):
+        (JSC::JSActivation::registersOffset):
+        (JSC::JSActivation::tearOff):
+        (JSC::JSActivation::isTornOff):
+        (JSC):
+        (JSC::JSActivation::storageOffset):
+        (JSC::JSActivation::storage): Tiny bit of refactoring so the JIT can
+        share the pointer math helper functions we use internally.
+
+2012-09-24  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        MIPS: store8 functions added to MacroAssembler.
+
+        MIPS store8 functions
+        https://bugs.webkit.org/show_bug.cgi?id=97243
+
+        Reviewed by Oliver Hunt.
+
+        Add MIPS store8 functions.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::lhu): New function.
+        (MIPSAssembler):
+        (JSC::MIPSAssembler::sb): New function.
+        (JSC::MIPSAssembler::sh): New function.
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::store8): New function.
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::store16): New function.
+
+2012-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        PutScopedVar should not be marked as clobbering the world
+        https://bugs.webkit.org/show_bug.cgi?id=97416
+
+        Reviewed by Filip Pizlo.
+
+        No performance change.
+
+        PutScopedVar doesn't have arbitrary side-effects, so it shouldn't be marked
+        as such.
+
+        * dfg/DFGNodeType.h:
+        (DFG):
+
+2012-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        I accidentally the whole 32-bit :(.
+
+        Unbreak the DFG in 32-bit with the 32-bit path I forgot in my last patch.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-09-23  Byungwoo Lee  <bw80.lee@gmail.com>
+
+        Fix build warnings : -Wunused-parameter, -Wparentheses, -Wuninitialized.
+        https://bugs.webkit.org/show_bug.cgi?id=97306
+
+        Reviewed by Benjamin Poulain.
+
+        Fix build warning about -Wunused-parameter on MachineStackMarker.cpp,
+        LLIntSlowPaths.cpp, DatePrototype.cpp, Options.cpp by using
+        UNUSED_PARAM() macro or remove parameter name.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::pthreadSignalHandlerSuspendResume):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::entryOSR):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/Options.cpp:
+        (JSC::computeNumberOfGCMarkers):
+
+2012-09-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Sorting a non-array creates propreties (spec-violation)
+        https://bugs.webkit.org/show_bug.cgi?id=25477
+
+        Reviewed by Oliver Hunt.
+
+        We're just calling get() to get properties, which is converting missing properties to
+        undefined. Hole values should be retained, and moved to the end of the array.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getOrHole):
+            - Helper function, returns JSValue() instead of undefined for missing properties.
+        (JSC::arrayProtoFuncSort):
+            - Implemented per 15.4.4.11, see comments above.
+
+2012-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        CSE for access to closure variables (get_/put_scoped_var)
+        https://bugs.webkit.org/show_bug.cgi?id=97414
+
+        Reviewed by Oliver Hunt.
+
+        I separated loading a scope from loading its storage pointer, so we can
+        CSE the storage pointer load. Then, I copied the global var CSE and adjusted
+        it for closure vars.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute): Renamed GetScopeChain => GetScope to
+        reflect renames from a few weeks ago.
+
+        Added a case for the storage pointer load, similar to object storage pointer load.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Added an independent node for
+        the storage pointer.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::scopedVarStoreElimination):
+        (JSC::DFG::CSEPhase::getScopeLoadElimination):
+        (JSC::DFG::CSEPhase::getScopeRegistersLoadElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE): Copied globalVarLoad/StoreElimination
+        and adapted the same logic to closure vars.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasScopeChainDepth):
+        (JSC::DFG::Node::scope):
+        (Node):
+        * dfg/DFGNodeType.h:
+        (DFG): GetScopedVar and GetGlobalVar are no longer MustGenerate. I'm not
+        sure why they ever were. But these are simple load operations so, if they're
+        unused, they're truly dead.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Updated for renames and split-out
+        node for getting the storage pointer.
+
+2012-09-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolled out a line I committed by accident.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2012-09-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Optimized closures that capture arguments
+        https://bugs.webkit.org/show_bug.cgi?id=97358
+
+        Reviewed by Oliver Hunt.
+
+        Previously, the activation object was responsible for capturing all
+        arguments in a way that was convenient for the arguments object. Now,
+        we move all captured variables into a contiguous region in the stack,
+        allocate an activation for exactly that size, and make the arguments
+        object responsible for knowing all the places to which arguments could
+        have moved.
+
+        This seems like the right tradeoff because
+
+            (a) Closures are common and long-lived, so we want them to be small.
+
+            (b) Our primary strategy for optimizing the arguments object is to make
+            it go away. If you're allocating arguments objects, you're already having
+            a bad time.
+
+            (c) It's common to use either the arguments object or named argument
+            closure, but not both.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::argumentsRegister):
+        (JSC::CodeBlock::activationRegister):
+        (JSC::CodeBlock::isCaptured):
+        (JSC::CodeBlock::argumentIndexAfterCapture): m_numCapturedVars is gone
+        now -- we have an explicit range instead.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Move captured arguments
+        into the captured region of local variables for space efficiency. Record
+        precise data about where they moved for the sake of the arguments object.
+
+        Some of this data was previously wrong, but it didn't cause any problems
+        because the arguments weren't actually moving.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables): Don't
+        assume that captured vars are in any particular location -- always ask
+        the CodeBlock. This is better encapsulation.
+
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): I rename things sometimes.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff): Account for a particularly nasty edge case.
+
+        (JSC::Arguments::didTearOffActivation): Don't allocate our slow arguments
+        data on tear-off. We need to allocate it eagerly instead, since we need
+        to know about displaced, captured arguments during access before tear-off.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::allocateSlowArguments):
+        (JSC::Arguments::argument): Tell our slow arguments array where all arguments
+        are, even if they are not captured. This simplifies some things, so we don't
+        have to account explicitly for the full matrix of (not torn off, torn off)
+        * (captured, not captured).
+
+        (JSC::Arguments::finishCreation): Allocate our slow arguments array eagerly
+        because we need to know about displaced, captured arguments during access
+        before tear-off.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::parameterCount):
+        (FunctionExecutable):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSActivation.h:
+        (JSActivation):
+        (JSC::JSActivation::create):
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::registerOffset):
+        (JSC::JSActivation::tearOff):
+        (JSC::JSActivation::allocationSize):
+        (JSC::JSActivation::isValid): This is really the point of the patch. All
+        the pointer math in Activations basically boils away, since we always
+        copy a contiguous region of captured variables now.
+
+        * runtime/SymbolTable.h:
+        (JSC::SlowArgument::SlowArgument):
+        (SlowArgument):
+        (SharedSymbolTable):
+        (JSC::SharedSymbolTable::captureCount):
+        (JSC::SharedSymbolTable::SharedSymbolTable): AllOfTheThings capture mode
+        is gone now -- that's the point of the patch. indexIfCaptured gets renamed
+        to index because we always have an index, even if not captured. (The only
+        time when the index is meaningless is when we're Deleted.)
+
+2012-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Eeeep - broke early boyer in bug#97382
+        https://bugs.webkit.org/show_bug.cgi?id=97383
+
+        Rubber stamped by Sam Weinig.
+
+        missed a child3 -> child2!
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+
+2012-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Pedantic test in Mozilla's JavaScript test suite fails. function-001.js function-001-n.js
+        https://bugs.webkit.org/show_bug.cgi?id=27219
+
+        Reviewed by Sam Weinig.
+
+        These tests are just wrong.
+        See ECMA 262 A.5, FunctionDelcaration does not require a semicolon.
+
+        * tests/mozilla/expected.html:
+        * tests/mozilla/js1_2/function/function-001-n.js:
+        * tests/mozilla/js1_3/Script/function-001-n.js:
+        * tests/mozilla/js1_3/regress/function-001-n.js:
+
+2012-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove redundant argument to op_instanceof
+        https://bugs.webkit.org/show_bug.cgi?id=97382
+
+        Reviewed by Geoff Garen.
+
+        No longer needed after my last change.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        instanceof should not get the prototype for non-default HasInstance
+        https://bugs.webkit.org/show_bug.cgi?id=68656
+
+        Reviewed by Oliver Hunt.
+
+        Instanceof is currently implemented as a sequance of three opcodes:
+            check_has_instance
+            get_by_id(prototype)
+            op_instanceof
+        There are three interesting types of base value that instanceof can be applied to:
+            (A) Objects supporting default instanceof behaviour (functions, other than those created with bind)
+            (B) Objects overriding the default instancecof behaviour with a custom one (API objects, bound functions)
+            (C) Values that do not respond to the [[HasInstance]] trap.
+        Currently check_has_instance handles case (C), leaving the op_instanceof opcode to handle (A) & (B). There are
+        two problems with this apporach. Firstly, this is suboptimal for case (A), since we have to check for
+        hasInstance support twice (once in check_has_instance, then for default behaviour in op_instanceof). Secondly,
+        this means that in cases (B) we also perform the get_by_id, which is both suboptimal and an observable spec
+        violation.
+
+        The fix here is to move handing of non-default instanceof (cases (B)) to the check_has_instance op, leaving
+        op_instanceof to handle only cases (A).
+
+        * API/JSCallbackObject.h:
+        (JSCallbackObject):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::customHasInstance):
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor):
+            - renamed hasInstance to customHasInstance
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+            - added additional parameters to check_has_instance opcode
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+            - added additional parameters to check_has_instance opcode
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCheckHasInstance):
+            - added additional parameters to check_has_instance opcode
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+            - added additional parameters to check_has_instance opcode
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+            - added additional parameters to check_has_instance opcode
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+            - added additional parameters to check_has_instance opcode
+        * interpreter/Interpreter.cpp:
+        (JSC::isInvalidParamForIn):
+        (JSC::Interpreter::privateExecute):
+            - Add handling for non-default instanceof to op_check_has_instance
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitArrayProfilingSiteForBytecodeIndex):
+            - Fixed no-LLInt no_DFG build
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+            - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+            - no need to check for ImplementsDefaultHasInstance.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+            - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+            - no need to check for ImplementsDefaultHasInstance.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+            - Add handling for non-default instanceof to op_check_has_instance
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+            - move check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance.
+        * runtime/ClassInfo.h:
+        (MethodTable):
+        (JSC):
+            - renamed hasInstance to customHasInstance
+        * runtime/CommonSlowPaths.h:
+        (CommonSlowPaths):
+            - removed opInstanceOfSlow (this was whittled down to one function call!)
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::customHasInstance):
+        * runtime/JSBoundFunction.h:
+        (JSBoundFunction):
+            - renamed hasInstance to customHasInstance, reimplemented.
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::customHasInstance):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        (JSC):
+        (JSC::JSObject::defaultHasInstance):
+        * runtime/JSObject.h:
+        (JSObject):
+
+2012-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix ARM build.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::store8):
+        (MacroAssemblerARMv7):
+        * offlineasm/armv7.rb:
+
+2012-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r128400): Opening Google Web Fonts page hangs or crashes
+        https://bugs.webkit.org/show_bug.cgi?id=97328
+
+        Reviewed by Mark Hahnenberg.
+
+        It's a bad idea to emit stub code that reallocates property storage when we're in indexed
+        storage mode. DFGRepatch.cpp knew this and had the appropriate check in one of the places,
+        but it didn't have it in all of the places.
+        
+        This change also adds some more handy disassembly support, which I used to find the bug.
+
+        * assembler/LinkBuffer.h:
+        (JSC):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        * jit/JITStubRoutine.h:
+        (JSC):
+
+2012-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE assumes that a holy PutByVal does not interfere with GetArrayLength, when it clearly does
+        https://bugs.webkit.org/show_bug.cgi?id=97373
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::getArrayLengthElimination):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGGraph.h:
+        (Graph):
+
+2012-09-21  Chris Rogers  <crogers@google.com>
+
+        Add Web Audio support for deprecated/legacy APIs
+        https://bugs.webkit.org/show_bug.cgi?id=97050
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-09-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Global Math object should be configurable but isn't
+        https://bugs.webkit.org/show_bug.cgi?id=55343
+
+        Reviewed by Oliver Hunt.
+
+        This has no performance impact.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            - Make 'Math' a regular property.
+
+2012-09-21  Chao-ying Fu  <fu@mips.com>
+
+        Add MIPS or32 function
+        https://bugs.webkit.org/show_bug.cgi?id=97157
+
+        Reviewed by Gavin Barraclough.
+
+        Add a missing or32 function.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::or32): New function.
+        (MacroAssemblerMIPS):
+
+2012-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        CHECK_ARRAY_CONSISTENCY isn't being used or tested, so we should remove it
+        https://bugs.webkit.org/show_bug.cgi?id=97260
+
+        Rubber stamped by Geoffrey Garen.
+        
+        Supporting it will become difficult as we add more indexing types. It makes more
+        sense to kill, especially since we don't appear to use it or test it, ever.
+
+        * runtime/ArrayConventions.h:
+        (JSC):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * runtime/ArrayStorage.h:
+        (JSC::ArrayStorage::copyHeaderFromDuringGC):
+        (ArrayStorage):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/JSArray.cpp:
+        (JSC::createArrayButterflyInDictionaryIndexingMode):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSArray):
+        (JSC::createArrayButterfly):
+        (JSC::JSArray::tryCreateUninitialized):
+        (JSC::constructArray):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC):
+        * runtime/JSObject.h:
+        (JSC::JSObject::initializeIndex):
+        (JSObject):
+
+2012-09-20  Mark Lam  <mark.lam@apple.com>
+
+        Fixed a missing semicolon in the C++ llint backend.
+        https://bugs.webkit.org/show_bug.cgi?id=97252.
+
+        Reviewed by Geoff Garen.
+
+        * offlineasm/cloop.rb:
+
+2012-09-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored the interpreter and JIT so they don't dictate closure layout
+        https://bugs.webkit.org/show_bug.cgi?id=97221
+
+        Reviewed by Oliver Hunt.
+
+        Capture may change the location of an argument for space efficiency. This
+        patch removes static assumptions about argument location from the interpreter
+        and JIT.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::argumentIndexAfterCapture):
+        (JSC::ExecState::argumentAfterCapture): Factored out a helper function
+        so the compiler could share this logic.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode): Don't emit optimized bracket
+        access on arguments if a parameter has been captured by name. This case is
+        rare and, where I've seen it in the wild, the optimization mostly failed
+        anyway due to arguments escape, so I didn't feel like writing and testing
+        five copies of the code that would handle it in the baseline engines.
+
+        The DFG can still synthesize this optimization even if we don't emit the
+        optimized bytecode for it.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::symbolTableFor):
+        (AssemblyHelpers): Use the right helper function to account for the fact
+        that a parameter may have been captured by name and moved.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): ASSERT that we haven't inlined
+        a .apply on captured arguments. Once we do start inlining such things,
+        we'll need to do a little bit of math here to get them right.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Added support for bracket access on
+        an arguments object where arguments have also been captured by name. We
+        load the true index of the argument from a side vector. Arguments elision
+        is very powerful in the DFG, so I wanted to keep it working, even in this
+        rare case.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs): Use the right helper function to account for the fact
+        that a parameter may have been captured by name and moved.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs): Don't use the inline copy loop if some
+        of our arguments have moved, since it would copy stale values. (We still
+        optimize the actual call, and elide the arguments object.)
+
+2012-09-20  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        [Qt] r129045 broke the ARM build
+        https://bugs.webkit.org/show_bug.cgi?id=97195
+
+        Reviewed by Zoltan Herczeg.
+
+        Implementing missing store8 function.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::store8):
+        (MacroAssemblerARM):
+
+2012-09-19  Geoffrey Garen  <ggaren@apple.com>
+
+        OSR exit sometimes neglects to create the arguments object
+        https://bugs.webkit.org/show_bug.cgi?id=97162
+
+        Reviewed by Filip Pizlo.
+
+        No performance change.
+
+        I don't know of any case where this is a real problem in TOT, but it
+        will become a problem if we start compiling eval, with, or catch, and/or
+        sometimes stop doing arguments optimizations in the bytecode.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run): Account for a
+        CreateArguments that has transformed into PhantomArguments. We used to
+        clear our reference to the CreateArguments node, but now we hold onto it, 
+        so we need to account for it transforming.
+
+        Don't replace a SetLocal(CreateArguments) with a SetLocal(JSValue())
+        because that doesn't leave enough information behind for OSR exit to do
+        the right thing. Instead, maintain our reference to CreateArguments, and
+        rely on CreateArguments transforming into PhantomArguments after
+        optimization. SetLocal(PhantomArguments) is efficient, and it's a marker
+        for OSR exit to create the arguments object.
+
+        Don't ASSERT that all PhantomArguments are unreferenced because we now
+        leave them in the graph as SetLocal(PhantomArguments), and that's harmless.
+
+        * dfg/DFGArgumentsSimplificationPhase.h:
+        (NullableHashTraits):
+        (JSC::DFG::NullableHashTraits::emptyValue): Export our special hash table
+        for inline call frames so the OSR exit compiler can use it.
+
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit): Don't load the 'arguments'
+        register to decide if we need to create the arguments object. Optimization
+        may have eliminated the initializing store to this register, in which
+        case we'll load garbage. Instead, use the global knowledge that all call
+        frames that optimized out 'arguments' now need to create it, and use a hash
+        table to make sure we do so only once per call frame.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): SetLocal(PhantomArguments) is unique
+        because we haven't just changed a value's format or elided a load or store;
+        instead, we've replaced an object with JSValue(). We could try to account
+        for this in a general way, but for now it's a special-case optimization,
+        so we give it a specific OSR hint instead.
+
+2012-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r128802): It made some JS tests crash
+        https://bugs.webkit.org/show_bug.cgi?id=97001
+
+        Reviewed by Mark Hahnenberg.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+
+2012-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not assume that a ByVal access is generic just because it was unprofiled
+        https://bugs.webkit.org/show_bug.cgi?id=97088
+
+        Reviewed by Geoffrey Garen.
+        
+        We were not disambiguating between "Undecided" in the sense that the array profile
+        has no useful information versus "Undecided" in the sense that the array profile
+        knows that the access has not executed. That's an important distinction, since
+        the former form of "Undecided" means that we should consult value profiling, while
+        the latter means that we should force exit unless the value profiling indicates
+        that the access must be generic (base is not cell or property is not int).
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::refineArrayMode):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::canCSEStorage):
+        (JSC::DFG::modeIsSpecific):
+        (JSC::DFG::modeSupportsLength):
+        (JSC::DFG::benefitsFromStructureCheck):
+
+2012-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not emit PutByVal hole case unless it has to
+        https://bugs.webkit.org/show_bug.cgi?id=97080
+
+        Reviewed by Geoffrey Garen.
+
+        This causes us to generate less code for typical PutByVal's. But if profiling tells us
+        that the hole case is being hit, we generate the same code as we would have generated
+        before. This seems like a slight speed-up across the board.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::store8):
+        (MacroAssemblerARMv7):
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::store8):
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::store8):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::movb_i8m):
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::ArrayProfile):
+        (JSC::ArrayProfile::addressOfMayStoreToHole):
+        (JSC::ArrayProfile::mayStoreToHole):
+        (ArrayProfile):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (JSC::DFG::mayStoreToHole):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase):
+        (JSC):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-09-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not call out to C++ every time that it tries to put to an object that doesn't yet have array storage
+        https://bugs.webkit.org/show_bug.cgi?id=96983
+
+        Reviewed by Oliver Hunt.
+
+        Introduce more polymorphism into the DFG's array mode support. Use that to
+        introduce the notion of effectul array modes, where the check for the mode
+        will perform actions necessary to ensure that we have the mode we want, if
+        the object is not already in that mode. Also added profiling support for
+        checking if an object is of a type that would not allow us to create array
+        storage (like a typed array or a string for example).
+        
+        This is a ~2x speed-up on loops that transform an object that did not have
+        indexed storage into one that does.
+
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::ArrayProfile):
+        (JSC::ArrayProfile::mayInterceptIndexedAccesses):
+        (ArrayProfile):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromObserved):
+        (DFG):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (JSC::DFG::modeUsesButterfly):
+        (JSC::DFG::isSlowPutAccess):
+        (JSC::DFG::benefitsFromStructureCheck):
+        (JSC::DFG::isEffectful):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArrayMode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Arguments.h:
+        (Arguments):
+        * runtime/JSNotAnObject.h:
+        (JSNotAnObject):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::ensureArrayStorage):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+
+2012-09-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Include PhantomArguments in DFGDisassembly
+        https://bugs.webkit.org/show_bug.cgi?id=97043
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+
+2012-09-18  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r128802): It made some JS tests crash
+        https://bugs.webkit.org/show_bug.cgi?id=97001
+
+        Reviewed by Mark Hahnenberg.
+
+        IndexingHeaderInlineMethods was incorrectly assuming that if the HasArrayStorage bit is clear, then that means that indexing payload capacity is zero.
+
+        * runtime/IndexingHeaderInlineMethods.h:
+        (JSC::IndexingHeader::preCapacity):
+        (JSC::IndexingHeader::indexingPayloadSizeInBytes):
+
+2012-09-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Use WTF::HasTrivialDestructor instead of compiler-specific versions in JSC::NeedsDestructor
+        https://bugs.webkit.org/show_bug.cgi?id=96980
+
+        Reviewed by Benjamin Poulain.
+
+        * runtime/JSCell.h:
+        (JSC):
+        (NeedsDestructor):
+
+2012-09-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGOperations doesn't use NativeCallFrameTracer in enough places
+        https://bugs.webkit.org/show_bug.cgi?id=96987
+
+        Reviewed by Mark Hahnenberg.
+
+        Anything that can GC should use it.
+
+        * dfg/DFGOperations.cpp:
+
+2012-09-18  Mark Lam  <mark.lam@apple.com>
+
+        Not reviewed. Attempt at greening the WinCairo bot. Touching
+        LowLevelInterpreter.asm to trigger a rebuild of LLIntDesiredOffsets.
+        https://bugs.webkit.org/show_bug.cgi?id=96992.
+
+        * llint/LowLevelInterpreter.asm:
+
+2012-09-18  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        [Qt] REGRESSION(r128790): It broke the ARM build
+        https://bugs.webkit.org/show_bug.cgi?id=96968
+
+        Reviewed by Filip Pizlo.
+
+        Implement the missing or32 method in the MacroAssemblerARM.h.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::or32):
+        (MacroAssemblerARM):
+
+2012-09-18  Mark Lam  <mark.lam@apple.com>
+
+        Fix for WinCairo builds.
+        https://bugs.webkit.org/show_bug.cgi?id=96992.
+
+        Reviewed by Filip Pizlo.
+
+        Adding additional vcproj build targets in LLIntDesiredOffsets.vcproj,
+        LLIntOffsetsExtractor.vcproj, and LLIntAssembly.vcproj to match those
+        in jsc.vcproj.
+
+        * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj:
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj:
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj:
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebugAll.vsprops: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebugCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.vsprops: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorReleaseCairoCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorReleasePGO.vsprops: Added.
+
+2012-09-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix sloppy English in comment.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC):
+
+2012-09-17  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r128826 and r128813.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC):
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSCallbackConstructor):
+        * API/JSCallbackObject.cpp:
+        (JSC):
+        (JSC::::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::create):
+        (JSCallbackObject):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * GNUmakefile.list.am:
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        * heap/Heap.cpp:
+        (JSC::Heap::isSafeToSweepStructures):
+        (JSC):
+        * heap/Heap.h:
+        (JSC::Heap::allocatorForObjectWithDestructor):
+        (Heap):
+        (JSC::Heap::allocateWithDestructor):
+        (JSC::Heap::allocateStructure):
+        (JSC):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::sweepNextBlock):
+        (JSC::IncrementalSweeper::startSweeping):
+        (JSC::IncrementalSweeper::willFinishSweeping):
+        (JSC::IncrementalSweeper::structuresCanBeSwept):
+        (JSC):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::cellsNeedDestruction):
+        (JSC::MarkedAllocator::onlyContainsStructures):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::init):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedBlock.h:
+        (JSC):
+        (MarkedBlock):
+        (JSC::MarkedBlock::cellsNeedDestruction):
+        (JSC::MarkedBlock::onlyContainsStructures):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::freeBlock):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (Subspace):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::destructorAllocatorFor):
+        (JSC::MarkedSpace::allocateWithDestructor):
+        (JSC::MarkedSpace::allocateStructure):
+        (JSC::MarkedSpace::forEachBlock):
+        * heap/SlotVisitor.cpp:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC::JIT::emitAllocateJSArray):
+        * jsc.cpp:
+        (GlobalObject::create):
+        * runtime/Arguments.cpp:
+        (JSC):
+        * runtime/Arguments.h:
+        (Arguments):
+        (JSC::Arguments::Arguments):
+        * runtime/ErrorPrototype.cpp:
+        (JSC):
+        * runtime/Executable.h:
+        * runtime/InternalFunction.cpp:
+        (JSC):
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (InternalFunction):
+        * runtime/JSCell.h:
+        (JSC):
+        (JSC::allocateCell):
+        * runtime/JSDestructibleObject.h: Removed.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::createRareDataIfNeeded):
+        (JSC::JSGlobalObject::create):
+        * runtime/JSGlobalThis.h:
+        (JSGlobalThis):
+        (JSC::JSGlobalThis::JSGlobalThis):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSScope.cpp:
+        (JSC):
+        * runtime/JSString.h:
+        (JSC):
+        * runtime/JSWrapperObject.h:
+        (JSWrapperObject):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp:
+        (JSC):
+        * runtime/NameInstance.h:
+        (NameInstance):
+        * runtime/RegExp.h:
+        * runtime/RegExpObject.cpp:
+        (JSC):
+        * runtime/SparseArrayValueMap.h:
+        * runtime/Structure.h:
+        (JSC::Structure):
+        (JSC::JSCell::classInfo):
+        (JSC):
+        * runtime/StructureChain.h:
+        * runtime/SymbolTable.h:
+        * testRegExp.cpp:
+        (GlobalObject::create):
+
+2012-09-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored the arguments object so it doesn't dictate closure layout
+        https://bugs.webkit.org/show_bug.cgi?id=96955
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.h:
+        (JSC::ExecState::argumentAfterCapture): Helper function for accessing an
+        argument that has been moved for capture.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Generate metadata for arguments
+        that are captured. We don't move any arguments yet, but we do use this
+        metadata to tell the arguments object if an argument is stored in the
+        activation.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Updated for the arguments object not
+        malloc'ing a separate backing store, and for a rename from deletedArguments
+        to slowArguments.
+
+        * interpreter/CallFrame.h:
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Updated for small interface changes.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        (JSC::Arguments::copyToArguments):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlotByIndex):
+        (JSC::Arguments::createStrictModeCallerIfNecessary):
+        (JSC::Arguments::createStrictModeCalleeIfNecessary):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::getOwnPropertyNames):
+        (JSC::Arguments::putByIndex):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deletePropertyByIndex):
+        (JSC::Arguments::deleteProperty):
+        (JSC::Arguments::defineOwnProperty):
+        (JSC::Arguments::tearOff): Moved all data inline into the object, for speed,
+        and refactored all internal argument accesses to use helper functions, so
+        we can change the implementation without changing lots of code.
+
+        (JSC::Arguments::didTearOffActivation): This function needs to account
+        for arguments that were moved by the activation object. We do this accounting
+        through a side vector that tells us where our arguments will be in the
+        activation.
+
+        (JSC::Arguments::tearOffForInlineCallFrame):
+        * runtime/Arguments.h:
+        (Arguments):
+        (JSC::Arguments::length):
+        (JSC::Arguments::isTornOff):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::allocateSlowArguments):
+        (JSC::Arguments::tryDeleteArgument):
+        (JSC::Arguments::trySetArgument):
+        (JSC::Arguments::tryGetArgument):
+        (JSC::Arguments::isDeletedArgument):
+        (JSC::Arguments::isArgument):
+        (JSC::Arguments::argument):
+        (JSC::Arguments::finishCreation):
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        (JSActivation):
+        (JSC::JSActivation::captureStart):
+        (JSC::JSActivation::storageSize):
+        (JSC::JSActivation::registerOffset):
+        (JSC::JSActivation::isValid): The activation object is no longer responsible
+        for copying extra arguments provided by the caller. The argumnents object
+        does this instead. This means we can allocate and initialize an activation
+        without worrying about the call frame's argument count.
+
+        * runtime/SymbolTable.h:
+        (JSC::SlowArgument::SlowArgument):
+        (SlowArgument):
+        (JSC):
+        (JSC::SharedSymbolTable::parameterCount):
+        (SharedSymbolTable):
+        (JSC::SharedSymbolTable::slowArguments):
+        (JSC::SharedSymbolTable::setSlowArguments): Added data structures to back
+        the algorithms above.
+
+2012-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        32-bit LLInt get_by_val does vector length checks incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=96893
+        <rdar://problem/12311678>
+
+        Reviewed by Mark Hahnenberg.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2012-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        We don't have a bad enough time if an object's prototype chain crosses global objects
+        https://bugs.webkit.org/show_bug.cgi?id=96962
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC):
+
+2012-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix a broken assertion in offlineasm.
+
+        * offlineasm/armv7.rb:
+        * offlineasm/backends.rb:
+
+2012-09-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Delayed structure sweep can leak structures without bound
+        https://bugs.webkit.org/show_bug.cgi?id=96546
+
+        Reviewed by Gavin Barraclough.
+
+        This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only
+        allocators. We now have separate allocators for our three types of objects: those objects with no destructors,
+        those objects with destructors and with immortal structures, and those objects with destructors that don't have 
+        immortal structures. All of the objects of the third type (destructors without immortal structures) now 
+        inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores 
+        the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction.
+
+        * API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor.
+        (JSC):
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSCallbackConstructor):
+        * API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for 
+        JSCallbackObject<JSGlobalObject>, since JSGlobalObject also uses a finalizer.
+        (JSC):
+        (JSC::::create): We need to move the create function for JSCallbackObject<JSGlobalObject> out of line so we can add 
+        the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides 
+        to subclass this. We use this same technique for many other subclasses of JSGlobalObject.
+        (JSC::::createStructure):
+        * API/JSCallbackObject.h:
+        (JSCallbackObject):
+        (JSC):
+        * API/JSClassRef.cpp: Change all the JSCallbackObject<JSNonFinalObject> to use JSDestructibleObject instead.
+        (OpaqueJSClass::prototype):
+        * API/JSObjectRef.cpp: Ditto.
+        (JSObjectMake):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSValueRef.cpp: Ditto.
+        (JSValueIsObjectOfClass):
+        * API/JSWeakObjectMapRefPrivate.cpp: Ditto.
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG.
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        * heap/Heap.cpp:
+        (JSC):
+        * heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function 
+        since it's always safe to sweep Structures now.
+        (JSC::Heap::allocatorForObjectWithNormalDestructor): 
+        (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor):
+        (Heap):
+        (JSC::Heap::allocateWithNormalDestructor):
+        (JSC):
+        (JSC::Heap::allocateWithImmortalStructureDestructor):
+        * heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the 
+        IncrementalSweeper since it's always safe to sweep Structures now.
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::sweepNextBlock):
+        (JSC::IncrementalSweeper::startSweeping):
+        (JSC::IncrementalSweeper::willFinishSweeping):
+        (JSC):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add 
+        tracking of the specific destructor type of allocator. 
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::destructorType):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::init):
+        * heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping. 
+        We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls.
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedBlock.h:
+        (JSC):
+        (JSC::MarkedBlock::allocator):
+        (JSC::MarkedBlock::destructorType):
+        * heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace.
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::freeBlock):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor):
+        (JSC::MarkedSpace::normalDestructorAllocatorFor):
+        (JSC::MarkedSpace::allocateWithImmortalStructureDestructor):
+        (JSC::MarkedSpace::allocateWithNormalDestructor):
+        (JSC::MarkedSpace::forEachBlock):
+        * heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function.
+        * jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC::JIT::emitAllocateJSArray):
+        * jsc.cpp: 
+        (GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from 
+        JSDestructibleObject.
+        * runtime/Arguments.cpp: Inherit from JSDestructibleObject.
+        (JSC):
+        * runtime/Arguments.h:
+        (Arguments):
+        (JSC::Arguments::Arguments):
+        * runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor.
+        (JSC):
+        * runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures.
+        (JSC):
+        * runtime/InternalFunction.cpp: Inherit from JSDestructibleObject.
+        (JSC):
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (InternalFunction):
+        * runtime/JSCell.h: Added the NEEDS_DESTRUCTOR  macro to make it easier for classes to indicate that instead of being 
+        allocated in a destructor MarkedAllocator that they will handle their destruction themselves through the 
+        use of a finalizer.
+        (JSC):
+        (HasImmortalStructure): New template to help us determine at compile-time if a particular class 
+        should be allocated in the immortal structure MarkedAllocator. The default value is false. In order 
+        to be allocated in the immortal structure allocator, classes must specialize this template. Also added 
+        a macro to make it easier for classes to specialize the template.
+        (JSC::allocateCell): Use the appropriate allocator depending on the destructor type.
+        * runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be 
+        accessed safely when the object is being destroyed.
+        (JSC):
+        (JSDestructibleObject):
+        (JSC::JSDestructibleObject::classInfo):
+        (JSC::JSDestructibleObject::JSDestructibleObject):
+        (JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe.
+        * runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all 
+        of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well.
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one 
+        for the m_rareData field when it's created.
+        (JSC::JSGlobalObject::create):
+        (JSC):
+        * runtime/JSGlobalThis.h: Inherit from JSDestructibleObject.
+        (JSGlobalThis):
+        (JSC::JSGlobalThis::JSGlobalThis):
+        * runtime/JSPropertyNameIterator.h: Has an immortal Structure.
+        (JSC):
+        * runtime/JSScope.cpp:
+        (JSC):
+        * runtime/JSString.h: Has an immortal Structure.
+        (JSC):
+        * runtime/JSWrapperObject.h: Inherit from JSDestructibleObject.
+        (JSWrapperObject):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp: Cleaning up some of the inheritance stuff.
+        (JSC):
+        * runtime/NameInstance.h: Inherit from JSDestructibleObject.
+        (NameInstance):
+        * runtime/RegExp.h: Has immortal Structure.
+        (JSC):
+        * runtime/RegExpObject.cpp: Inheritance cleanup.
+        (JSC):
+        * runtime/SparseArrayValueMap.h: Has immortal Structure.
+        (JSC):
+        * runtime/Structure.h: Has immortal Structure.
+        (JSC):
+        * runtime/StructureChain.h: Ditto.
+        (JSC):
+        * runtime/SymbolTable.h: Ditto.
+        (SharedSymbolTable):
+        (JSC):
+
+2012-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        If a prototype has indexed setters and its instances have indexed storage, then all put_by_val's should have a bad time
+        https://bugs.webkit.org/show_bug.cgi?id=96596
+
+        Reviewed by Gavin Barraclough.
+
+        Added comprehensive support for accessors and read-only indexed properties on the
+        prototype chain. This is done without any performance regression on benchmarks that
+        we're aware of, by having the entire VM's strategy with respect to arrays tilted
+        heavily in favor of:
+        
+        - The prototype chain of JSArrays never having any accessors or read-only indexed
+          properties. If that changes, you're going to have a bad time.
+        
+        - Prototypes of non-JSArray objects either having no indexed accessors or read-only
+          indexed properties, or, having those indexed accessor thingies inserted before
+          any instance object (i.e. object with that prototype as its prototype) is created.
+          If you add indexed accessors or read-only indexed properties to an object that is
+          already used as a prototype, you're going to have a bad time.
+        
+        See below for the exact definition of having a bad time.
+        
+        Put another way, "fair" uses of indexed accessors and read-only indexed properties
+        are:
+        
+        - Put indexed accessors and read-only indexed properties on an object that is never
+          used as a prototype. This will slow down accesses to that object, but will not
+          have any effect on any other object.
+        
+        - Put those indexed accessor thingies on an object before it is used as a prototype
+          and then start instantiating objects that claim that object as their prototype.
+          This will slightly slow down indexed stores to the instance objects, and greatly
+          slow down all indexed accesses to the prototype, but will have no other effect.
+        
+        In short, "fair" uses only affect the object itself and any instance objects. But
+        if you start using indexed accessors in more eclectic ways, you're going to have
+        a bad time.
+        
+        Specifically, if an object that may be used as a prototype has an indexed accessor
+        added, the VM performs a whole-heap scan to find all objects that belong to the
+        same global object as the prototype you modified. If any of those objects has
+        indexed storage, their indexed storage is put into slow-put mode, just as if their
+        prototype chain had indexed accessors. This will happen even for objects that do
+        not currently have indexed accessors in their prototype chain. As well, all JSArray
+        allocations are caused to create arrays with slow-put storage, and all future
+        allocations of indexed storage for non-JSArray objects are also flipped to slow-put
+        mode. Note there are two aspects to having a bad time: (i) the whole-heap scan and
+        (ii) the poisoning of all indexed storage in the entire global object. (i) is
+        necessary for correctness. If we detect that an object that may be used as a
+        prototype has had an indexed accessor or indexed read-only property inserted into
+        it, then we need to ensure that henceforth all instances of that object inspect
+        the prototype chain whenever an indexed hole is stored to. But by default, indexed
+        stores do no such checking because doing so would be unnecessarily slow. So, we must
+        find all instances of the affected object and flip them into a different array
+        storage mode that omits all hole optimizations. Since prototypes never keep a list
+        of instance objects, the only way to find those objects is a whole-heap scan. But
+        (i) alone would be a potential disaster, if a program frequently allocated an
+        object without indexed accessors, then allocated a bunch of objects that used that
+        one as their prototype, and then added indexed accessors to the prototype. So, to
+        prevent massive heap scan storms in such awkward programs, having a bad time also
+        implies (ii): henceforth *all* objects belonging to that global object will use
+        slow put indexed storage, so that we don't ever have to scan the heap again. Note
+        that here we are using the global object as just an approximation of a program
+        module; it may be worth investigating in the future if other approximations can be
+        used instead.
+
+        * bytecode/ArrayProfile.h:
+        (JSC):
+        (JSC::arrayModeFromStructure):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (JSC::DFG::isSlowPutAccess):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateJSArray):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoFuncSort):
+        * runtime/IndexingType.h:
+        (JSC):
+        (JSC::hasIndexedProperties):
+        (JSC::hasIndexingHeader):
+        (JSC::hasArrayStorage):
+        (JSC::shouldUseSlowPut):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+        (JSC::JSGlobalObject::haveABadTime):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::addressOfArrayStructure):
+        (JSC::JSGlobalObject::havingABadTimeWatchpoint):
+        (JSC::JSGlobalObject::isHavingABadTime):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::resetInheritorID):
+        (JSC::JSObject::inheritorID):
+        (JSC::JSObject::allowsAccessFrom):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::unwrappedGlobalObject):
+        (JSC::JSObject::notifyUsedAsPrototype):
+        (JSC::JSObject::createInheritorID):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::mayBeUsedAsPrototype):
+        (JSObject):
+        (JSC::JSObject::mayInterceptIndexedAccesses):
+        (JSC::JSObject::getArrayLength):
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::completeInitialization):
+        (JSC::JSObject::inSparseIndexingMode):
+        (JSC::JSObject::arrayStorage):
+        (JSC::JSObject::arrayStorageOrNull):
+        (JSC::JSObject::ensureArrayStorage):
+        (JSC):
+        (JSC::JSValue::putByIndex):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        (JSC):
+        * runtime/JSValue.h:
+        (JSValue):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::finishCreation):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayEntry::put):
+        (JSC):
+        * runtime/SparseArrayValueMap.h:
+        (JSC):
+        (SparseArrayEntry):
+        * runtime/Structure.cpp:
+        (JSC::Structure::anyObjectInChainMayInterceptIndexedAccesses):
+        (JSC):
+        (JSC::Structure::suggestedIndexingTransition):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::mayInterceptIndexedAccesses):
+        * runtime/StructureTransitionTable.h:
+        (JSC::newIndexingType):
+
+2012-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Array profiling has convergence issues
+        https://bugs.webkit.org/show_bug.cgi?id=96891
+
+        Reviewed by Gavin Barraclough.
+
+        Now each array profiling site merges in the indexing type it observed into
+        the m_observedArrayModes bitset. The ArrayProfile also uses this to detect
+        cases where the structure must have gone polymorphic (if the bitset is
+        polymorphic then the structure must be). This achieves something like the
+        best of both worlds: on the one hand, we get a probabilistic structure that
+        we can use to optimize the monomorphic structure case, but on the other hand,
+        we get an accurate view of the set of types that were encountered.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::or32):
+        (MacroAssemblerARMv7):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::or32):
+        (MacroAssemblerX86):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::or32):
+        (MacroAssemblerX86_64):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::orl_rm):
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::addressOfArrayModes):
+        (JSC::ArrayProfile::structureIsPolymorphic):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC):
+        (JSC::JIT::emitArrayProfilingSite):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-09-17  Mark Lam  <mark.lam@apple.com>
+
+        Not reviewed. Added svn:eol-style native to unbreak some build bots.
+        https://bugs.webkit.org/show_bug.cgi?id=96175.
+
+        * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: Added property svn:eol-style.
+
+2012-09-16  Mark Lam  <mark.lam@apple.com>
+
+        Added MSVC project changes to enable building the llint.
+        https://bugs.webkit.org/show_bug.cgi?id=96175.
+
+        Reviewed by Geoff Garen.
+
+        This only adds the ability to build the llint, but currently, only the
+        C++ backend is supported. By default, the Windows port will remain
+        running with the baseline JIT.  The llint will not be enabled.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/LLIntAssembly: Added.
+        * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.make: Added.
+        * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: Added.
+        * JavaScriptCore.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Added.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets: Added.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Added.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: Added.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.vsprops: Added.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.vsprops: Added.
+
+2012-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject.cpp and JSArray.cpp have inconsistent tests for the invalid array index case
+        https://bugs.webkit.org/show_bug.cgi?id=96878
+
+        Reviewed by Sam Weinig.
+
+        Removed the uses of UNLIKELY() because I don't believe they are buying us anything,
+        since we're already on the slow path. Also found other places where we're testing for
+        the invalid array index case using unusual predicates rather than just using
+        MAX_ARRAY_INDEX. With this change, I believe that all of our tests for invalid
+        array indices (i.e. indices that should be treated as non-indexed properties)
+        uniformly use MAX_ARRAY_INDEX and PropertyName::NotAnIndex.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::push):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::defineOwnIndexedProperty):
+
+2012-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Following the Butterfly refactoring, the comment for lastArraySize was not updated
+        https://bugs.webkit.org/show_bug.cgi?id=96877
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSObject.cpp:
+        (JSC):
+
+2012-09-15  Mark Lam  <mark.lam@apple.com>
+
+        Fixed JSLock to use the platform abstraction for Mutex instead of
+        depending on pthreads.
+        https://bugs.webkit.org/show_bug.cgi?id=96858.
+
+        Reviewed by Filip Pizlo.
+
+        This fixes a synchronization problem on the Windows port and makes
+        it more reliable when running the layout tests.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSLock.cpp:
+        (JSC):
+        (JSC::GlobalJSLock::GlobalJSLock):
+        (JSC::GlobalJSLock::~GlobalJSLock):
+        (JSC::GlobalJSLock::initialize):
+        * runtime/JSLock.h:
+        (GlobalJSLock):
+        (JSLock):
+
+2012-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure check hoisting fails to consider the possibility of conflicting checks on the source of the first assignment to the hoisted variable
+        https://bugs.webkit.org/show_bug.cgi?id=96872
+
+        Reviewed by Oliver Hunt.
+
+        This does a few related things:
+        
+        - It turns off the use of ForceOSRExit for sure-to-fail CheckStructures, because
+          I noticed that this would sometimes happen for a ForwardCheckStructure. The
+          problem is that ForceOSRExit exits backwards, not forwards. Since the code that
+          led to those ForceOSRExit's being inserted was written out of paranoia rather
+          than need, I removed it. Specifically, I removed the m_isValid = false code
+          for CheckStructure/StructureTransitionWatchpoint in AbstractState.
+        
+        - If a structure check causes a structure set to go empty, we don't want a
+          PutStructure to revive the set. It should instead be smart enough to realize 
+          that an empty set implies that the code can't execute. This was the only "bug"
+          that the use of m_isValid = false was preventing.
+        
+        - Finally, the main change: structure check hoisting looks at the source of the
+          SetLocals on structure-check-hoistable variables and ensures that the source
+          is not checked with a conflicting structure. This is O(n^2) but it does not
+          show up at all in performance tests.
+        
+        The first two parts of this change were auxiliary bugs that were revealed by
+        the structure check hoister doing bad things.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        All of the things in SparseArrayValueMap should be out-of-line
+        https://bugs.webkit.org/show_bug.cgi?id=96854
+
+        Reviewed by Andy Estes.
+
+        Those inline methods were buying us nothing.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSArray.cpp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSObject.cpp:
+        * runtime/RegExpMatchesArray.cpp:
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::SparseArrayValueMap):
+        (JSC):
+        (JSC::SparseArrayValueMap::~SparseArrayValueMap):
+        (JSC::SparseArrayValueMap::finishCreation):
+        (JSC::SparseArrayValueMap::create):
+        (JSC::SparseArrayValueMap::destroy):
+        (JSC::SparseArrayValueMap::createStructure):
+        (JSC::SparseArrayValueMap::add):
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayEntry::get):
+        (JSC::SparseArrayEntry::getNonSparseMode):
+        (JSC::SparseArrayValueMap::visitChildren):
+        * runtime/SparseArrayValueMapInlineMethods.h: Removed.
+
+2012-09-14  Mike West  <mkwst@chromium.org>
+
+        JSC should throw a more descriptive exception when blocking 'eval' via CSP.
+        https://bugs.webkit.org/show_bug.cgi?id=94331
+
+        Reviewed by Geoffrey Garen.
+
+        Unless explicitly whitelisted, the 'script-src' Content Security Policy
+        directive blocks 'eval' and 'eval'-like constructs such as
+        'new Function()'. When 'eval' is encountered in code, an 'EvalError' is
+        thrown, but the associated message is poor: "Eval is disabled" doesn't
+        give developers enough information about why their code isn't behaving
+        as expected.
+
+        This patch adds an 'errorMessage' parameter to the JavaScriptCore method
+        used to disable 'eval'; ContentSecurityPolicy has the opportunity to
+        pass in a more detailed and descriptive error that contains more context
+        for the developer.
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+            Drop the hard-coded "Eval is disabled" error message in favor of
+            reading the error message off the global object.
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::getCallData):
+            Drop the hard-coded "Function constructor is disabled" error message
+            in favor of reading the error message off the global object.
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::evalEnabled):
+            Making this accessor method const.
+        (JSC::JSGlobalObject::evalDisabledErrorMessage):
+            Accessor for the error message set via 'setEvalDisabled'.
+        (JSC::JSGlobalObject::setEvalEnabled):
+            Adding an 'errorMessage' parameter which is stored on the global
+            object, and used when exceptions are thrown.
+
+2012-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        bbc homepage crashes immediately
+        https://bugs.webkit.org/show_bug.cgi?id=96812
+        <rdar://problem/12081386>
+
+        Reviewed by Oliver Hunt.
+
+        If you use the old storage pointer to write to space you thought was newly allocated,
+        you're going to have a bad time.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCount):
+
+2012-09-14  Adam Barth  <abarth@webkit.org>
+
+        Remove webkitPostMessage
+        https://bugs.webkit.org/show_bug.cgi?id=96577
+
+        Reviewed by Ojan Vafai.
+
+        Add ENABLE_LEGACY_VENDOR_PREFIXES flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-09-14  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make force_static_libs_as_shared work on Mac OS
+
+        We had to move a few LIBS += around that were in the wrong place,
+        and not caught when everything was just linked into the final
+        QtWebKit library.
+
+        Reviewed by Simon Hausmann.
+
+        * jsc.pro: No need for AppKit, we get it from WTF.pri
+
+2012-09-14  Kevin Funk  <kevin.funk@kdab.com>
+
+        Fix interpreter build
+        https://bugs.webkit.org/show_bug.cgi?id=96617
+
+        Reviewed by Simon Hausmann.
+
+        Make compile.
+
+        * interpreter/Interpreter.cpp:
+
+2012-09-14  Parth Patel  <parpatel@rim.com>
+
+        [BlackBerry] Switching from Slogger to Slogger2 requires changes in CMakeList of 
+        webkit in order to include libraries of slog2
+        https://bugs.webkit.org/show_bug.cgi?id=96391
+
+        Reviewed by Yong Li.
+
+        Changes in Cmake files of JavaScriptCore of webkit to include slog2 libs in build 
+        files of webkit in response to switching from Slogger to Slogger2.
+
+        * shell/PlatformBlackBerry.cmake:
+
+2012-09-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove the Zapped BlockState
+        https://bugs.webkit.org/show_bug.cgi?id=96708
+
+        Reviewed by Geoffrey Garen.
+
+        The Zapped block state is rather confusing. It indicates that a block is in one of two different states that we 
+        can't tell the difference between:
+
+        1) I have run all destructors of things that are zapped, and I have not allocated any more objects. This block 
+           is ready for reclaiming if you so choose.
+        2) I have run all the destructors of things that are zapped, but I have allocated more stuff since then, so it 
+           is not safe to reclaim this block.
+
+        This state adds a lot of complexity to our state transition model for MarkedBlocks. We should get rid of it. 
+        We can replace this state by making sure mark bits represent all of the liveness information we need when running 
+        our conservative stack scan. Instead of zapping the free list when canonicalizing cell liveness data prior to 
+        a conservative scan, we can instead mark all objects in the block except for those in the free list. This should 
+        incur no performance penalty since we're doing it on a very small O(1) number of blocks at the beginning of the collection. 
+
+        For the time being we still need to use zapping to determine whether we have run an object's destructor or not.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): Renaming stuff.
+        * heap/MarkedAllocator.h: Renamed zapFreeList to canonicalizeCellLivenessData to match.
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::canonicalizeCellLivenessData): Same as old zapFreeList, but just call canonicalize instead.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::specializedSweep): Remove the check for Zapped block stuff. Also change the block state to Marked 
+        instead of Zapped if we're not producing a FreeList since that's the only other state that really makes any sense.
+        (JSC::MarkedBlock::sweepHelper): Remove Zapped related code.
+        (SetAllMarksFunctor): Functor to set all the mark bits in the block since there's not a simple function to call on 
+        the Bitmap itself.
+        (JSC::SetAllMarksFunctor::operator()):
+        (JSC):
+        (JSC::MarkedBlock::canonicalizeCellLivenessData): Remove all the stuff for Zapped. For FreeListed, set all the mark bits
+        and then clear the ones for the objects in the FreeList. This ensures that only the things that were in the FreeList 
+        are considered to be dead by the conservative scan, just like if we were to have zapped the FreeList like before. 
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::clearMarked): Add function to clear individual mark bits, since we need that functionality now.
+        (JSC):
+        (JSC::MarkedBlock::isLive): Remove code for Zapped stuff. Marked handles all interesting cases now.
+        (JSC::MarkedBlock::forEachCell): Add new iterator function that iterates over all cells in the block, regardless of 
+        whether they're live or a dead.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::canonicalizeCellLivenessData): Change to call the renamed canonicalize function. 
+
+2012-09-13  Kevin Funk  <kevin.funk@kdab.com>
+
+        Make compile with both OS(WINCE) and PLATFORM(QT) support
+        https://bugs.webkit.org/show_bug.cgi?id=95536
+
+        Reviewed by Simon Hausmann.
+
+        Do not link against advapi32 on wince
+
+        * jsc.pro:
+
+2012-09-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored the DFG to make fewer assumptions about variable capture
+        https://bugs.webkit.org/show_bug.cgi?id=96680
+
+        Reviewed by Gavin Barraclough.
+
+        A variable capture optimization patch I'm working on broke DFG
+        correctness and the arguments simplification optimization phase, so I've
+        refactored both to make fewer assumptions about variable capture.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isCaptured): This is the new One True Way to find out
+        if a variable was captured. This gives us a single point of maintenance
+        as we chagne capture behavior.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::clobberCapturedVars): Don't assume that captured
+        variables have any particular location. Instead, ask the One True Function.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): Mechanical
+        changes to separate being captured from being 'arguments'. What used
+        to be
+                if (captured)
+                        if (arguments)
+                                x
+                        y
+        is now
+                if (arguments)
+                        x
+                        y
+                else if (captured)
+                        y
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Use the One True Function.
+
+2012-09-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        Improve the SourceProvider hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=95635
+
+        Reviewed by Geoffrey Garen.
+
+        SourceProvider was designed to have subclasses magically handling the data without
+        decoding all of it. The virtual methods length() and getRange() were based
+        on these assumptions.
+
+        In practice, the magic was in our head, there is no implementation that takes
+        advantage of that.
+
+        SourceProvider is modified to adopt WebCore's ScriptSourceProvider::source() and base
+        everything on it.
+        The code using SourceProvider is also simplified.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::appendSourceToError): Keep a reference to the string instead of querying it for
+        each time it is used.
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::sourceCode):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::subExpression):
+        * parser/SourceProvider.h:
+        (SourceProvider):
+        (JSC::SourceProvider::getRange):
+
+2012-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG: Dead GetButterfly's shouldn't be subject to CSE
+        https://bugs.webkit.org/show_bug.cgi?id=96707
+        <rdar://problem/12296311>
+
+        Reviewed by Oliver Hunt.
+        
+        There were a number of cases of this that creeped into the CSE: it would
+        match something even though it was dead.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getScopeChainLoadElimination):
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+
+2012-09-13  Oliver Hunt  <oliver@apple.com>
+
+        Make global const initialisation explicit in the bytecode
+        https://bugs.webkit.org/show_bug.cgi?id=96711
+
+        Reviewed by Gavin Barraclough.
+
+        Added op_init_global_const to make initialisation of global const
+        fields explicit.  This will help us keep correct semantics in the
+        upcoming variable resolution refactoring.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitInitGlobalConst):
+        (JSC):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConstDeclNode::emitCodeSingle):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-09-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename forEachCell to forEachLiveCell
+        https://bugs.webkit.org/show_bug.cgi?id=96685
+
+        Reviewed by Oliver Hunt.
+
+        forEachCell actually only iterates over live cells. We should rename it to 
+        reflect what it actually does. This is also helpful because we want to add a new 
+        forEachCell that actually does iterate each and every cell in a MarkedBlock 
+        regardless of whether or not it is live.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * heap/Heap.cpp:
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::objectTypeCounts):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::forEachLiveCell):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC::MarkedSpace::forEachLiveCell):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::releaseExecutableMemory):
+
+2012-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        [Qt][Win] REGRESSION(r128400): It broke the build
+        https://bugs.webkit.org/show_bug.cgi?id=96617
+
+        Reviewed by Simon Hausmann.
+
+        Changed "JSC::Array" to "JSC::ArrayClass" because it's not used often enough
+        for the brevity to be beneficial, and because "Array" causes too much namespace
+        pollution.
+
+        * runtime/IndexingType.h:
+        (JSC):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getArrayLength):
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::inSparseIndexingMode):
+        (JSC::JSObject::ensureArrayStorage):
+
+2012-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Testing whether indexing type is ArrayWithArrayStorage should not compare against ArrayWithArrayStorage
+        https://bugs.webkit.org/show_bug.cgi?id=96611
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-09-09  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should have property butterflies
+        https://bugs.webkit.org/show_bug.cgi?id=91933
+
+        Reviewed by Geoffrey Garen.
+
+        This changes the JSC object model. Previously, all objects had fast lookup for
+        named properties. Integer indexed properties were only fast if you used a
+        JSArray. With this change, all objects have fast indexed properties. This is
+        accomplished without any space overhead by using a bidirectional object layout,
+        aka butterflies. Each JSObject has a m_butterfly pointer where previously it
+        had a m_outOfLineStorage pointer. To the left of the location pointed to by
+        m_butterfly, we place all named out-of-line properties. To the right, we place
+        all indexed properties along with indexing meta-data. Though, some indexing
+        meta-data is placed in the 8-byte word immediately left of the pointed-to
+        location; this is in anticipation of the indexing meta-data being small enough
+        in the common case that m_butterfly always points to the first indexed
+        property.
+        
+        This is performance neutral, except on tests that use indexed properties on
+        plain objects, where the speed-up is in excess of an order of magnitude.
+        
+        One notable aspect of what this change brings is that it allows indexing
+        storage to morph over time. Currently this is only used to allow all non-array
+        objects to start out without any indexed storage. But it could be used for
+        some kinds of array type inference in the future.
+
+        * API/JSCallbackObject.h:
+        (JSCallbackObject):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlotByIndex):
+        (JSC):
+        (JSC::::getOwnNonIndexPropertyNames):
+        * API/JSObjectRef.cpp:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ArrayProfile.h:
+        (JSC):
+        (JSC::arrayModeFromStructure):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAdjacencyList.h:
+        (JSC::DFG::AdjacencyList::AdjacencyList):
+        (AdjacencyList):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (JSC::DFG::modeUsesButterfly):
+        (JSC::DFG::modeIsJSArray):
+        (JSC::DFG::isInBoundsAccess):
+        (JSC::DFG::modeSupportsLength):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::addNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (Node):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryBuildPutByIdList):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateBasicStorage):
+        (JSC::JIT::emitAllocateJSArray):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emitSlow_op_new_array):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::deletePropertyByIndex):
+        (JSC::Arguments::defineOwnProperty):
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayConventions.h: Added.
+        (JSC):
+        (JSC::isDenseEnoughForVector):
+        (JSC::indexingHeaderForArray):
+        (JSC::baseIndexingHeaderForArray):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::create):
+        (JSC):
+        (JSC::ArrayPrototype::ArrayPrototype):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/ArrayPrototype.h:
+        (ArrayPrototype):
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/ArrayStorage.h: Added.
+        (JSC):
+        (ArrayStorage):
+        (JSC::ArrayStorage::ArrayStorage):
+        (JSC::ArrayStorage::from):
+        (JSC::ArrayStorage::butterfly):
+        (JSC::ArrayStorage::indexingHeader):
+        (JSC::ArrayStorage::length):
+        (JSC::ArrayStorage::setLength):
+        (JSC::ArrayStorage::vectorLength):
+        (JSC::ArrayStorage::setVectorLength):
+        (JSC::ArrayStorage::copyHeaderFromDuringGC):
+        (JSC::ArrayStorage::inSparseMode):
+        (JSC::ArrayStorage::lengthOffset):
+        (JSC::ArrayStorage::vectorLengthOffset):
+        (JSC::ArrayStorage::numValuesInVectorOffset):
+        (JSC::ArrayStorage::vectorOffset):
+        (JSC::ArrayStorage::indexBiasOffset):
+        (JSC::ArrayStorage::sparseMapOffset):
+        (JSC::ArrayStorage::sizeFor):
+        * runtime/Butterfly.h: Added.
+        (JSC):
+        (Butterfly):
+        (JSC::Butterfly::Butterfly):
+        (JSC::Butterfly::totalSize):
+        (JSC::Butterfly::fromBase):
+        (JSC::Butterfly::offsetOfIndexingHeader):
+        (JSC::Butterfly::offsetOfPublicLength):
+        (JSC::Butterfly::offsetOfVectorLength):
+        (JSC::Butterfly::indexingHeader):
+        (JSC::Butterfly::propertyStorage):
+        (JSC::Butterfly::indexingPayload):
+        (JSC::Butterfly::arrayStorage):
+        (JSC::Butterfly::offsetOfPropertyStorage):
+        (JSC::Butterfly::indexOfPropertyStorage):
+        (JSC::Butterfly::base):
+        * runtime/ButterflyInlineMethods.h: Added.
+        (JSC):
+        (JSC::Butterfly::createUninitialized):
+        (JSC::Butterfly::create):
+        (JSC::Butterfly::createUninitializedDuringCollection):
+        (JSC::Butterfly::base):
+        (JSC::Butterfly::growPropertyStorage):
+        (JSC::Butterfly::growArrayRight):
+        (JSC::Butterfly::resizeArray):
+        (JSC::Butterfly::unshift):
+        (JSC::Butterfly::shift):
+        * runtime/ClassInfo.h:
+        (MethodTable):
+        (JSC):
+        * runtime/IndexingHeader.h: Added.
+        (JSC):
+        (IndexingHeader):
+        (JSC::IndexingHeader::offsetOfIndexingHeader):
+        (JSC::IndexingHeader::offsetOfPublicLength):
+        (JSC::IndexingHeader::offsetOfVectorLength):
+        (JSC::IndexingHeader::IndexingHeader):
+        (JSC::IndexingHeader::vectorLength):
+        (JSC::IndexingHeader::setVectorLength):
+        (JSC::IndexingHeader::publicLength):
+        (JSC::IndexingHeader::setPublicLength):
+        (JSC::IndexingHeader::from):
+        (JSC::IndexingHeader::fromEndOf):
+        (JSC::IndexingHeader::propertyStorage):
+        (JSC::IndexingHeader::arrayStorage):
+        (JSC::IndexingHeader::butterfly):
+        * runtime/IndexingHeaderInlineMethods.h: Added.
+        (JSC):
+        (JSC::IndexingHeader::preCapacity):
+        (JSC::IndexingHeader::indexingPayloadSizeInBytes):
+        * runtime/IndexingType.h: Added.
+        (JSC):
+        (JSC::hasIndexingHeader):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::visitChildren):
+        (JSC::JSActivation::getOwnNonIndexPropertyNames):
+        * runtime/JSActivation.h:
+        (JSActivation):
+        (JSC::JSActivation::tearOff):
+        * runtime/JSArray.cpp:
+        (JSC):
+        (JSC::createArrayButterflyInDictionaryIndexingMode):
+        (JSC::JSArray::setLengthWritable):
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnNonIndexPropertyNames):
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC):
+        (JSArray):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::length):
+        (JSC::JSArray::createStructure):
+        (JSC::JSArray::isLengthWritable):
+        (JSC::createArrayButterfly):
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::boundFunctionCall):
+        (JSC::boundFunctionConstruct):
+        (JSC::JSBoundFunction::finishCreation):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getOwnNonIndexPropertyNames):
+        (JSC):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSFunction.h:
+        (JSFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC):
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSFinalObject::visitChildren):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::createInitialArrayStorage):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::fillGetterPropertySlot):
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::allocateSparseIndexMap):
+        (JSC::JSObject::deallocateSparseIndexMap):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::checkIndexingConsistency):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::putDescriptor):
+        (JSC::JSObject::putDirectMayBeIndex):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::JSObject::defineOwnProperty):
+        (JSC::JSObject::getOwnPropertySlotSlow):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getArrayLength):
+        (JSObject):
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::putDirectIndex):
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::completeInitialization):
+        (JSC::JSObject::inSparseIndexingMode):
+        (JSC::JSObject::butterfly):
+        (JSC::JSObject::outOfLineStorage):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::indexingShouldBeSparse):
+        (JSC::JSObject::butterflyOffset):
+        (JSC::JSObject::butterflyAddress):
+        (JSC::JSObject::arrayStorage):
+        (JSC::JSObject::arrayStorageOrZero):
+        (JSC::JSObject::ensureArrayStorage):
+        (JSC::JSObject::checkIndexingConsistency):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC):
+        (JSC::JSObject::setButterfly):
+        (JSC::JSObject::setButterflyWithoutChangingStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::offsetInButterfly):
+        (JSC::offsetRelativeToPatchedStorage):
+        (JSC::indexRelativeToBase):
+        (JSC::offsetRelativeToBase):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSSymbolTableObject):
+        * runtime/JSTypeInfo.h:
+        (JSC):
+        (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero):
+        (JSC::TypeInfo::overridesGetPropertyNames):
+        * runtime/LiteralParser.cpp:
+        (JSC::::parse):
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        (JSC):
+        * runtime/ObjectPrototype.h:
+        (ObjectPrototype):
+        * runtime/PropertyOffset.h:
+        (JSC::offsetInOutOfLineStorage):
+        * runtime/PropertyStorage.h: Added.
+        (JSC):
+        * runtime/PutDirectIndexMode.h: Added.
+        (JSC):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC):
+        (JSC::RegExpMatchesArray::create):
+        (JSC::RegExpMatchesArray::finishCreation):
+        * runtime/RegExpMatchesArray.h:
+        (RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::createStructure):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnNonIndexPropertyNames):
+        * runtime/RegExpObject.h:
+        (RegExpObject):
+        * runtime/Reject.h: Added.
+        (JSC):
+        (JSC::reject):
+        * runtime/SparseArrayValueMap.cpp: Added.
+        (JSC):
+        * runtime/SparseArrayValueMap.h: Added.
+        (JSC):
+        (SparseArrayEntry):
+        (JSC::SparseArrayEntry::SparseArrayEntry):
+        (SparseArrayValueMap):
+        (JSC::SparseArrayValueMap::sparseMode):
+        (JSC::SparseArrayValueMap::setSparseMode):
+        (JSC::SparseArrayValueMap::lengthIsReadOnly):
+        (JSC::SparseArrayValueMap::setLengthIsReadOnly):
+        (JSC::SparseArrayValueMap::find):
+        (JSC::SparseArrayValueMap::remove):
+        (JSC::SparseArrayValueMap::notFound):
+        (JSC::SparseArrayValueMap::isEmpty):
+        (JSC::SparseArrayValueMap::contains):
+        (JSC::SparseArrayValueMap::size):
+        (JSC::SparseArrayValueMap::begin):
+        (JSC::SparseArrayValueMap::end):
+        * runtime/SparseArrayValueMapInlineMethods.h: Added.
+        (JSC):
+        (JSC::SparseArrayValueMap::SparseArrayValueMap):
+        (JSC::SparseArrayValueMap::~SparseArrayValueMap):
+        (JSC::SparseArrayValueMap::finishCreation):
+        (JSC::SparseArrayValueMap::create):
+        (JSC::SparseArrayValueMap::destroy):
+        (JSC::SparseArrayValueMap::createStructure):
+        (JSC::SparseArrayValueMap::add):
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayEntry::get):
+        (JSC::SparseArrayEntry::getNonSparseMode):
+        (JSC::SparseArrayValueMap::visitChildren):
+        * runtime/StorageBarrier.h: Removed.
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::putByIndex):
+        (JSC):
+        (JSC::StringObject::deletePropertyByIndex):
+        * runtime/StringObject.h:
+        (StringObject):
+        * runtime/StringPrototype.cpp:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::indexingType):
+        (JSC::Structure::indexingTypeIncludingHistory):
+        (JSC::Structure::indexingTypeOffset):
+        (JSC::Structure::create):
+        * runtime/StructureTransitionTable.h:
+        (JSC):
+        (JSC::toAttributes):
+        (JSC::newIndexingType):
+        (JSC::StructureTransitionTable::Hash::hash):
+        * tests/mozilla/js1_6/Array/regress-304828.js:
+
+2012-09-12  Mark Lam  <mark.lam@apple.com>
+
+        Refactor Opcodes to distinguish between core and extension opcodes.
+        https://bugs.webkit.org/show_bug.cgi?id=96466.
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/Opcode.h:
+        (JSC): Added FOR_EACH_CORE_OPCODE_ID() macro.
+        * llint/LowLevelInterpreter.h:
+        (JSC): Auto-generate llint opcode aliases using the
+            FOR_EACH_CORE_OPCODE_ID() macro.
+
+2012-09-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Second step to fixing the Windows build: Add new symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-09-11  Geoffrey Garen  <ggaren@apple.com>
+
+        First step to fixing the Windows build: Remove old symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-09-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Don't allocate a backing store just for a function's name
+        https://bugs.webkit.org/show_bug.cgi?id=96468
+
+        Reviewed by Oliver Hunt.
+
+        Treat function.name like function.length etc., and use a custom getter.
+        This saves space in closures.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        * debugger/DebuggerCallFrame.h:
+        (DebuggerCallFrame): Updated for interface change.
+
+        * runtime/Executable.h:
+        (JSC::JSFunction::JSFunction): Do a little inlining.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation): Gone now. That's the point of the patch.
+
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        (JSC::JSFunction::nameGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::getOwnPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty): Added custom accessors for .name
+        just like .length and others.
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::create):
+        (JSFunction): Updated for interface changes.
+
+2012-09-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        IncrementalSweeper should not sweep/free Zapped blocks
+        https://bugs.webkit.org/show_bug.cgi?id=96464
+
+        Reviewed by Filip Pizlo.
+
+        This is not beneficial in terms of performance because there isn't any way a block can emerge
+        in the Zapped state from a call to Heap::collect() unless we run an eager sweep on it, in which 
+        case we've already run all the destructors we possibly can. This also causes bugs since we don't 
+        take zapped-ness into account when determining whether or not a block is empty to free it. The 
+        incremental sweeper can then accidentally free blocks that it thinks are empty but are in fact 
+        zapped with still-live objects in them.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::needsSweeping): It is only valid to sweep a block if it is in the Marked state.
+
+2012-09-11  Geoffrey Garen  <ggaren@apple.com>
+
+        JSActivation should inline allocate its registers, and eliminate
+        'arguments' registers in the common case
+        https://bugs.webkit.org/show_bug.cgi?id=96427
+
+        Reviewed by Filip Pizlo.
+
+        This cuts the size class for simple closures down to 64 bytes.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Set the usesNonStrictEval
+        flag, which is new. Use a more specific test for whether a function
+        uses 'arguments', so we can avoid allocating, initializing, and tearing
+        off those registers in the common case. Distinguish between capturing
+        arguments and not, so we can avoid allocating space for arguments in
+        the torn-off object.
+
+        We can make this even more general in the future, with some bytecode
+        generator refactoring.
+
+        (JSC::BytecodeGenerator::resolve): Updated for new interface.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::symbolTable): Updated some types.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::isValidAllocation): Allow large allocations, now that they
+        are both supported and used.
+
+        * heap/Heap.h:
+        (Heap): Added a new form of allocateCell that specifies the full size
+        of the allocation, to allow for extra space on the end.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::argumentOffset):
+        (JSC::ExecState::argumentOffsetIncludingThis):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame): Refactored this code to be more
+        specific about tearing off 'arguments' vs activations. This is something
+        I forgot in my last patch, and it is required now that we can have
+        acitvations without 'arguments' registers.
+
+        * runtime/Arguments.h:
+        (JSC::Arguments::setRegisters): No need for setRegisters anymore because
+        the activation object's storage doesn't change.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation): Initialize our storage manually because
+        it's not declared to the C++ compiler.
+
+        (JSC::JSActivation::visitChildren): No copyAndAppend because our storage
+        is not out-of-line anymore.
+
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::getOwnPropertyDescriptor):
+        (JSC::JSActivation::argumentsGetter): Refactored isTornOff() testing to
+        avoid using a data member and to avoid hard-coding any offset assumptions.
+
+        * runtime/JSActivation.h:
+        (JSC):
+        (JSActivation):
+        (JSC::JSActivation::create):
+        (JSC::JSActivation::isDynamicScope):
+        (JSC::JSActivation::captureStart):
+        (JSC::JSActivation::storageSize):
+        (JSC::JSActivation::storageSizeInBytes):
+        (JSC::JSActivation::registerOffset):
+        (JSC::JSActivation::tearOff):
+        (JSC::JSActivation::isTornOff):
+        (JSC::JSActivation::storage):
+        (JSC::JSActivation::allocationSize):
+        (JSC::JSActivation::isValid): New helper functions for doing the math
+        on our inline storage. Note that in the "AllOfTheThings" tear-off case,
+        the number of things is not known at compile time, so we store the
+        number in the argument count register. We can't just copy the raw contents
+        of the register beacuse we need a value that is safe for precise marking,
+        and the value in the register file has an invalid tag.
+
+        * runtime/JSCell.h:
+        (JSC::allocateCell): New function for allocating with extra storage
+        on the end.
+
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::finishCreation):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        (JSVariableObject): Make it easier for subclasses to use their symbol
+        tables during construction, by passing the table as a constructor argument.
+
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::usesNonStrictEval):
+        (JSC::SharedSymbolTable::setUsesNonStrictEval):
+        (SharedSymbolTable):
+        (JSC::SharedSymbolTable::captureMode):
+        (JSC::SharedSymbolTable::setCaptureMode):
+        (JSC::SharedSymbolTable::captureStart):
+        (JSC::SharedSymbolTable::setCaptureStart):
+        (JSC::SharedSymbolTable::captureEnd):
+        (JSC::SharedSymbolTable::setCaptureEnd):
+        (JSC::SharedSymbolTable::parameterCountIncludingThis):
+        (JSC::SharedSymbolTable::setParameterCountIncludingThis):
+        (JSC::SharedSymbolTable::SharedSymbolTable): Added data members to more
+        precisely describe what kind of capture is in play, and to avoid having
+        data members in the activation. We expect N activations per symbol table,
+        so this can be a big savings in heavy closure usage.
+
+2012-09-11  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Fix build break with LLINT on 32bit machine after r128219
+        https://bugs.webkit.org/show_bug.cgi?id=96461
+
+        Unreviewed build fix.
+
+        * llint/LowLevelInterpreter32_64.asm: Fixed typo.
+
+2012-09-11  Michael Saboff  <msaboff@apple.com>
+
+        Build fixed for http://trac.webkit.org/changeset/128243
+
+        Rubber stamped by Stephanie Lewis.
+
+        Added missing include file needed by 96422.
+
+        * icu/unicode/unorm2.h: Added.
+
+2012-09-11  Michael Saboff  <msaboff@apple.com>
+
+        Build fixed for http://trac.webkit.org/changeset/128243
+
+        Rubber stamped by Stephanie Lewis.
+
+        Added missing include file needed by 96422.
+
+        * icu/unicode/ptypes.h: Added.
+
+2012-09-11  Michael Saboff  <msaboff@apple.com>
+
+        Update ICU header files to more recent version
+        https://bugs.webkit.org/show_bug.cgi?id=96422
+
+        Reviewed by Geoff Garen.
+
+        Updated ICU header files to 4.6.1.  Modifications made as part of the merge are:
+        platform.h - Changed ifndef / define / endif for U_HAVE_UINT8_T, U_HAVE_UINT16_T, U_HAVE_UINT32_T,
+            U_HAVE_UINT64_T, U_IS_BIG_ENDIAN and U_ENABLE_TRACING to match the existing platform.h
+        putil.h (line 132) - Changes defined(U_WINDOWS) to defined(WIN32) || defined(OS2) to match existing putil.h
+        ustring.h (line 945) - Wrapped macro argument cs with { (const UChar *)cs } to match existing ustring.h
+        utypes.h (line 545) - Changed defined(U_WINDOWS) to defined(WIN32) to match existing utypes.h
+
+        * icu/unicode/localpointer.h: Added.
+        * icu/unicode/parseerr.h:
+        * icu/unicode/platform.h:
+        * icu/unicode/putil.h:
+        * icu/unicode/uchar.h:
+        * icu/unicode/ucnv.h:
+        * icu/unicode/ucnv_err.h:
+        * icu/unicode/ucol.h:
+        * icu/unicode/uconfig.h:
+        * icu/unicode/uenum.h:
+        * icu/unicode/uiter.h:
+        * icu/unicode/uloc.h:
+        * icu/unicode/umachine.h:
+        * icu/unicode/unorm.h:
+        * icu/unicode/urename.h:
+        * icu/unicode/uscript.h:
+        * icu/unicode/uset.h:
+        * icu/unicode/ustring.h:
+        * icu/unicode/utf.h:
+        * icu/unicode/utf16.h:
+        * icu/unicode/utf8.h:
+        * icu/unicode/utypes.h:
+        * icu/unicode/uvernum.h: Added.
+        * icu/unicode/uversion.h:
+
+2012-09-11  Matt Lilek  <mrl@apple.com>
+
+        OS X port should compile with newer versions of clang
+        https://bugs.webkit.org/show_bug.cgi?id=96434
+
+        m_identIsVarDecl is unused - remove it.
+
+        Reviewed by Anders Carlsson.
+
+        * parser/NodeConstructors.h:
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.h:
+        (ForInNode):
+
+2012-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt should optimize and profile array length accesses
+        https://bugs.webkit.org/show_bug.cgi?id=96417
+
+        Reviewed by Oliver Hunt.
+
+        This fixes the following hole in our array profiling strategy, where the array
+        is large (more than 1000 elements):
+        
+        for (var i = 0; i < array.length; ++i) ...
+        
+        The peeled use of array.length (in the array prologue) will execute only once
+        before DFG optimization kicks in from the loop's OSR point. Since it executed
+        only once, it executed in the LLInt. And prior to this patch, the LLInt did
+        not profile array.length accesses - so the DFG will assume, based on the lack
+        of profiling, that the access is in fact not an access to the JSArray length
+        property. That could then impede our ability to hoist the array structure
+        check, and may make us pessimistic in other ways as well, since the generic
+        GetById used for the array length access will be viewed as a side-effecting
+        operation.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-09-11  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [EFL] Rewrite the EFL-related Find modules
+        https://bugs.webkit.org/show_bug.cgi?id=95237
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * CMakeLists.txt: Stop setting the LINK_FLAGS property.
+        * PlatformEfl.cmake: Ditto.
+        * shell/PlatformEfl.cmake: Ditto.
+
+2012-09-11  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [EFL] Unreviewed build fix after r128065.
+
+        * CMakeLists.txt: Link against WTF for FastMalloc symbols, which
+        are needed when building with SYSTEM_MALLOC off.
+
+2012-09-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove m_classInfo from JSCell
+        https://bugs.webkit.org/show_bug.cgi?id=96311
+
+        Reviewed by Oliver Hunt.
+
+        Now that no one is using the ClassInfo in JSCell, we can remove it for the greater good. This is a 1.5% win on v8v7 and 
+        a 1.7% win on kraken, and is an overall performance progression.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Had to rearrange the order of when we take things off the free list 
+        and when we store the Structure in the object because we would clobber the free list otherwise. This made it not okay for 
+        the structure argument and the scratch register to alias one another. Also removed the store of the ClassInfo pointer in the
+        object. Yay!
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp: Since it's no longer okay for for the scratch register and structure register to alias 
+        one another as stated above, had to add an extra temporary for passing the Structure.
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp: Ditto.
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject): Similar changes to DFG's inline allocation except that it removed the object from 
+        the free list first, so no changes were necessary there.
+        * llint/LowLevelInterpreter.asm: Change the constants for amount of inline storage to match PropertyOffset.h and remove 
+        the store of the ClassInfo pointer during inline allocation.
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSCell.h: Remove the m_classInfo field and associated methods.
+        (JSCell):
+        * runtime/JSObject.h:
+        (JSObject):
+        * runtime/PropertyOffset.h: Expand the number of inline storage properties to take up the extra space that we're freeing 
+        with the removal of the ClassInfo pointer.
+        (JSC):
+        * runtime/Structure.h:
+        (JSC):
+        (JSC::JSCell::JSCell):
+        (JSC::JSCell::finishCreation):
+
+2012-09-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Added large allocation support to MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=96214
+
+        Originally reviewed by Oliver Hunt, then I added a design revision by
+        suggested by Phil Pizlo.
+
+        I expanded the imprecise size classes to cover up to 32KB, then added
+        an mmap-based allocator for everything bigger. There's a lot of tuning
+        we could do in these size classes, but currently they're almost
+        completely unused, so I haven't done any tuning.
+
+        Subtle point: the large allocator is a degenerate case of our free list
+        logic. Its list only ever contains zero or one items.
+
+        * heap/Heap.h:
+        (JSC::Heap::allocateStructure): Pipe in size information.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): Handle the case where we
+        find a free item in the sweep list but the item isn't big enough. This
+        can happen in the large allocator because it mixes sizes.
+
+        (JSC::MarkedAllocator::tryAllocate):
+        (JSC::MarkedAllocator::allocateSlowCase): More piping.
+
+        (JSC::MarkedAllocator::allocateBlock): Handle the oversize case.
+
+        (JSC::MarkedAllocator::addBlock): I moved the call to didAddBlock here
+        because it made more sense.
+
+        * heap/MarkedAllocator.h:
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::allocate):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::freeBlock):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::destructorAllocatorFor):
+        (JSC::MarkedSpace::allocateWithoutDestructor):
+        (JSC::MarkedSpace::allocateWithDestructor):
+        (JSC::MarkedSpace::allocateStructure):
+        (JSC::MarkedSpace::forEachBlock):
+        * runtime/Structure.h:
+        (JSC::Structure): More piping.
+
+2012-09-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows (32-bit) build.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_tear_off_arguments):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_tear_off_arguments): Get operands 1 and 2, not 1 and 1. :(
+
+        Also took this opportunity to rename to indicate that these values are
+        not destinations anymore.
+
+2012-09-10  Geoffrey Garen  <ggaren@apple.com>
+
+        DFG misses arguments tear-off for function.arguments if 'arguments' is used
+        https://bugs.webkit.org/show_bug.cgi?id=96227
+
+        Reviewed by Gavin Barraclough.
+
+        We've decided not to allow function.arguments to alias the local
+        'arguments' object, or a local var or function named 'arguments'.
+        Aliasing complicates the implementation (cf, this bug) and can produce
+        surprising behavior for web programmers.
+
+        Eliminating the aliasing has the side-effect of fixing this bug.
+
+        The compatibilty story: function.arguments is deprecated, was never
+        specified, and throws an exception in strict mode, so we expect it to
+        disappear over time. Firefox does not alias to 'arguments'; Chrome
+        does, but not if you use eval or with; IE does; Safari did.
+
+        * dfg/DFGByteCodeParser.cpp: Noticed a little cleanup while verifying
+        this code. Use the CodeBlock method for better encapsulation.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArgumentsFromVMCode): Behavior change: don't
+        alias.
+
+        * tests/mozilla/js1_4/Functions/function-001.js:
+        (TestFunction_4): Updated test expectations for changed behavior.
+
+2012-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        offlineasm has some impossible to implement, and unused, instructions
+        https://bugs.webkit.org/show_bug.cgi?id=96310
+
+        Reviewed by Mark Hahnenberg.
+
+        * offlineasm/armv7.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2012-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored op_tear_off* to support activations that don't allocate space for 'arguments'
+        https://bugs.webkit.org/show_bug.cgi?id=96231
+
+        Reviewed by Gavin Barraclough.
+
+        This is a step toward smaller activations.
+
+        As a side-effect, this patch eliminates a load and branch from the hot path
+        of activation tear-off by moving it to the cold path of arguments tear-off. Our
+        optimizing assumptions are that activations are common and that reifying the
+        arguments object is less common.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName): Updated for new opcode lengths.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstantValue): Added support for JSValue()
+        in the bytecode, which we use when we have 'arguments' but no activation.
+
+        (JSC::BytecodeGenerator::emitReturn): Always emit tear_off_arguments
+        if we've allocated the arguments registers. This allows tear_off_activation
+        not to worry about the arguments object anymore.
+
+        Also, pass the activation and arguments values directly to these opcodes
+        instead of requiring the opcodes to infer the values through special
+        registers. This gives us more flexibility to move or eliminate registers.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        (Node): Updated for new opcode lengths.
+
+        * dfg/DFGOperations.cpp: Activation tear-off doesn't worry about the
+        arguments object anymore. If 'arguments' is in use and reified, it's
+        responsible for aliasing back to the activation object in tear_off_arguments.
+
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Don't pass the arguments object to
+        activation tear-off; do pass the activation object to arguments tear-off.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Ditto.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Same change in a few more execution engines.
+
+2012-09-10  Patrick Gansterer  <paroga@webkit.org>
+
+        [JSC] Use StringBuilder::appendNumber() instead of String::number()
+        https://bugs.webkit.org/show_bug.cgi?id=96236
+
+        Reviewed by Benjamin Poulain.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+
+2012-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Combine MarkStack and SlotVisitor into single class
+        https://bugs.webkit.org/show_bug.cgi?id=96043
+
+        Reviewed by Geoff Garen.
+
+        Move all of MarkStack into SlotVisitor. The remaining stuff in MarkStack.cpp actually has to do 
+        with MarkStack management/allocation. Cleaned up a few of the header files while I was at it.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        * dfg/DFGCommon.h:
+        * heap/GCThreadSharedData.cpp:
+        * heap/GCThreadSharedData.h:
+        (GCThreadSharedData):
+        * heap/HeapRootVisitor.h:
+        * heap/MarkStack.cpp:
+        (JSC):
+        * heap/MarkStack.h:
+        (JSC):
+        (MarkStackSegment):
+        (JSC::MarkStackSegment::data):
+        (JSC::MarkStackSegment::capacityFromSize):
+        (JSC::MarkStackSegment::sizeFromCapacity):
+        (MarkStackSegmentAllocator):
+        (MarkStackArray):
+        * heap/MarkStackInlineMethods.h:
+        (JSC::MarkStackArray::postIncTop):
+        (JSC):
+        (JSC::MarkStackArray::preDecTop):
+        (JSC::MarkStackArray::setTopForFullSegment):
+        (JSC::MarkStackArray::setTopForEmptySegment):
+        (JSC::MarkStackArray::top):
+        (JSC::MarkStackArray::validatePrevious):
+        (JSC::MarkStackArray::append):
+        (JSC::MarkStackArray::canRemoveLast):
+        (JSC::MarkStackArray::removeLast):
+        (JSC::MarkStackArray::isEmpty):
+        (JSC::MarkStackArray::size):
+        * heap/SlotVisitor.cpp: Added.
+        (JSC):
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::~SlotVisitor):
+        (JSC::SlotVisitor::setup):
+        (JSC::SlotVisitor::reset):
+        (JSC::SlotVisitor::append):
+        (JSC::visitChildren):
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        (JSC::SlotVisitor::startCopying):
+        (JSC::SlotVisitor::allocateNewSpaceSlow):
+        (JSC::SlotVisitor::allocateNewSpaceOrPin):
+        (JSC::JSString::tryHashConstLock):
+        (JSC::JSString::releaseHashConstLock):
+        (JSC::JSString::shouldTryHashConst):
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::copyAndAppend):
+        (JSC::SlotVisitor::doneCopying):
+        (JSC::SlotVisitor::harvestWeakReferences):
+        (JSC::SlotVisitor::finalizeUnconditionalFinalizers):
+        (JSC::SlotVisitor::validate):
+        * heap/SlotVisitor.h:
+        (JSC):
+        (SlotVisitor):
+        (JSC::SlotVisitor::sharedData):
+        (JSC::SlotVisitor::isEmpty):
+        (JSC::SlotVisitor::visitCount):
+        (JSC::SlotVisitor::resetChildCount):
+        (JSC::SlotVisitor::childCount):
+        (JSC::SlotVisitor::incrementChildCount):
+        (ParallelModeEnabler):
+        (JSC::ParallelModeEnabler::ParallelModeEnabler):
+        (JSC::ParallelModeEnabler::~ParallelModeEnabler):
+        * heap/SlotVisitorInlineMethods.h:
+        (JSC::SlotVisitor::append):
+        (JSC):
+        (JSC::SlotVisitor::appendUnbarrieredPointer):
+        (JSC::SlotVisitor::appendUnbarrieredValue):
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::addWeakReferenceHarvester):
+        (JSC::SlotVisitor::addUnconditionalFinalizer):
+        (JSC::SlotVisitor::addOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRoot):
+        (JSC::SlotVisitor::opaqueRootCount):
+        (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary):
+        (JSC::SlotVisitor::mergeOpaqueRootsIfProfitable):
+        (JSC::SlotVisitor::donate):
+        (JSC::SlotVisitor::donateAndDrain):
+        * jit/JITWriteBarrier.h:
+        (JSC::SlotVisitor::append):
+        * jit/JumpReplacementWatchpoint.cpp:
+        * runtime/JSCell.h:
+        * runtime/Structure.h:
+        (JSC::SlotVisitor::internalAppend):
+        * runtime/WriteBarrier.h:
+        (JSC):
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::appendValues):
+        * yarr/YarrJIT.cpp:
+
+2012-09-10  Hojong Han  <hojong.han@samsung.com>
+
+        [EFL] JIT memory usage is not retrieved
+        https://bugs.webkit.org/show_bug.cgi?id=96095
+
+        Reviewed by Geoffrey Garen.
+
+        Fill JITBytes for EFL port.
+
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+
+2012-09-10  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [CMake][EFL] Enable the LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=92682
+
+        Reviewed by Csaba Osztrogonác.
+
+        Generate the headers needed by LLint when LLint is enabled.
+
+        * CMakeLists.txt:
+
+2012-09-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-09-09  Mark Lam  <mark.lam@apple.com>
+
+        Fixed a few llint C++ interpreter bugs.
+        https://bugs.webkit.org/show_bug.cgi?id=96127.
+
+        Reviewed by Geoffrey Garen.
+
+        * llint/LLIntCLoop.h:
+            CLoop::execute()'s bootstrapOpcodeId does not need a default
+            value. There is no case when this function is called without
+            that parameter being specified.
+        * llint/LowLevelInterpreter.asm:
+            Moved the dispatchAfterCall() call to where it is needed.
+            For the C_LOOP back-end, it generates unreachable code. 
+        * llint/LowLevelInterpreter.cpp:
+            #include <wtf/Assertions.h> because LLIntAssembly.h needs it.
+        (JSC):
+            Fixed bug in SIGN_BIT32() macro.
+            Placate a MSVC warning for t0, and t1 being uninitialized.
+        (JSC::CLoop::execute):
+            The bootstrapOpcodeId arg should always be specified.
+            MSVC doesn't like UNUSED_PARAM() for labels. Switch to using
+                the new UNUSED_LABEL() macro.
+        * offlineasm/cloop.rb:
+        * offlineasm/generate_offset_extractor.rb:
+            Resolved a compiler warning found via MSVC.
+
+2012-09-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Add StringBuilder::appendNumber() and use it
+        https://bugs.webkit.org/show_bug.cgi?id=96030
+
+        Reviewed by Eric Seidel.
+
+        Also fix a bunch of append() vs. appendLiteral() issues in the surrounding code.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::toString):
+
+2012-09-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Make the String initialization on the function side of String::number()
+        https://bugs.webkit.org/show_bug.cgi?id=95940
+
+        Reviewed by Benjamin Poulain.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out <http://trac.webkit.org/changeset/127939> because it broke
+        fast/js/named-function-expression.html.
+
+            Refactored bytecode generator initialization to support moving captured vars around
+            https://bugs.webkit.org/show_bug.cgi?id=96159
+
+            Reviewed by Gavin Barraclough.
+
+2012-09-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        LLInt buildfix for case sensitive filesystems
+        https://bugs.webkit.org/show_bug.cgi?id=96099
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter.cpp: Fix filenames.
+
+2012-09-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        Rename the ustring() accessor to string()
+        https://bugs.webkit.org/show_bug.cgi?id=95919
+
+        Reviewed by Geoffrey Garen.
+
+        Rename ustring() to string() to make the accessor name more logical after
+        r127191.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeFunction):
+        (JSObjectCopyPropertyNames):
+        * API/JSProfilerPrivate.cpp:
+        (JSStartProfiling):
+        (JSEndProfiling):
+        * API/JSValueRef.cpp:
+        (JSValueMakeString):
+        (JSValueMakeFromJSONString):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::string):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString):
+        * bytecode/CodeBlock.cpp:
+        (JSC::idName):
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::processClauseList):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::addFunction):
+        (GlobalObject::addConstructableFunction):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createRegExp):
+        * parser/Parser.cpp:
+        (JSC::::parsePrimaryExpression):
+        * parser/Parser.h:
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::useVariable):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createRegExp):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::finishCreation):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/Identifier.h:
+        (JSC::Identifier::string):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::calculatedDisplayName):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSONObject.cpp:
+        (JSC::PropertyNameForFunctionCall::value):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::finishCreation):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolveBase):
+        * runtime/JSString.h:
+        (JSC::inlineJSValueNotStringtoString):
+        * runtime/LiteralParser.cpp:
+        (JSC::::parse):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::finishCreation):
+
+2012-09-07  Gavin Barraclough  <barraclough@apple.com>
+
+        CALLFRAME_OFFSET and EXCEPTION_OFFSET are same in ctiTrampoline on ARM Thumb2
+        https://bugs.webkit.org/show_bug.cgi?id=82013
+
+        Reviewed by Geoff Garen.
+
+        Neither of these values need to be stored. At all.
+
+        * jit/JITStubs.cpp:
+        (JSC):
+        (JSC::ctiTrampoline):
+        (JSC::JITThunks::JITThunks):
+            - Nothing to see here. Move along.
+
+2012-09-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r127938.
+        http://trac.webkit.org/changeset/127938
+        https://bugs.webkit.org/show_bug.cgi?id=96166
+
+        It broke the build (Requested by smfr on #webkit).
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC):
+        (JSC::CLoop::execute):
+        * offlineasm/cloop.rb:
+
+2012-09-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored bytecode generator initialization to support moving captured vars around
+        https://bugs.webkit.org/show_bug.cgi?id=96159
+
+        Reviewed by Gavin Barraclough.
+
+        This patch separates the stages of allocating registers, declaring identifiers
+        in the symbol table, and initializing registers, so you can change
+        allocation decisions without breaking the world.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Call a set of helper functions
+        instead of inlining all the code, to help clarity.
+
+        (JSC::BytecodeGenerator::allocateCapturedVars):
+        (JSC::BytecodeGenerator::allocateUncapturedVars):
+        (JSC::BytecodeGenerator::allocateActivationVar):
+        (JSC::BytecodeGenerator::allocateArgumentsVars):
+        (JSC::BytecodeGenerator::allocateCalleeVarUndeclared):
+        (JSC::BytecodeGenerator::declareParameters):
+        (JSC::BytecodeGenerator::declareCallee):
+        (JSC::BytecodeGenerator::initCalleeVar):
+        (JSC::BytecodeGenerator::initArgumentsVars):
+        (JSC::BytecodeGenerator::initActivationVar):
+        (JSC::BytecodeGenerator::initThisParameter):
+        (JSC::BytecodeGenerator::initFunctionDeclarations):
+        (JSC::BytecodeGenerator::declareParameter):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::createActivationIfNecessary): Factored these
+        helper functions out from pre-existing code.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::addVar):
+        * parser/Nodes.h:
+        (JSC::DeclarationStacks::VarDeclaration::VarDeclaration):
+        (VarDeclaration):
+        (JSC::DeclarationStacks::FunctionDeclaration::FunctionDeclaration):
+        (FunctionDeclaration): Declaration stacks get a little more data now,
+        to support allocating registers before putting things in the symbol
+        table. I'm convinced that we should eventually just expand the symbol
+        table to understand these things.
+
+2012-09-07  Mark Lam  <mark.lam@apple.com>
+
+        Fix a llint C++ interpreter bugs.
+        https://bugs.webkit.org/show_bug.cgi?id=96127.
+
+        Reviewed by Filip Pizlo.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC):
+        (JSC::CLoop::execute):
+        * offlineasm/cloop.rb:
+
+2012-09-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Object.prototype.__define{G,S}etter__ with non-callable second parameter should throw TypeError instead of SyntaxError
+        https://bugs.webkit.org/show_bug.cgi?id=93873
+
+        Reviewed by Sam Weinig.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+            - throw TypeError instead of SyntaxError
+        (JSC::objectProtoFuncDefineSetter):
+            - throw TypeError instead of SyntaxError
+
+2012-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC should have a zombie mode
+        https://bugs.webkit.org/show_bug.cgi?id=96047
+
+        Reviewed by Geoffrey Garen.
+
+        To aid clients of JSC while they are debugging memory issues, we should add a zombie 
+        mode that scribbles into objects in the MarkedSpace after they are found to be dead 
+        to prevent a sort of "use after free" situation. As a first cut we should support a 
+        mode that just scribbles on objects prior to their being reused (i.e. while they are 
+        "zombies") and a mode in which, in addition to scribbling on zombies, once an object 
+        has been marked its mark bit will never be cleared, thus giving us "immortal" zombies.
+
+        These two modes will be enabled through the use of environment variables. For now these 
+        will be "JSZombieEnabled" and "JSImmortalZombieEnabled". Setting them to any value will 
+        result in the use of the appropriate mode.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect): Zombifies dead objects at the end of collection if zombie mode is enabled.
+        (ZombifyCellFunctor):
+        (JSC::ZombifyCellFunctor::ZombifyCellFunctor): Sets marked bits for dead objects if in immortal mode and writes 0xbbadbeef into them.
+        (JSC::ZombifyCellFunctor::operator()):
+        (JSC):
+        (ZombifyBlockFunctor):
+        (JSC::ZombifyBlockFunctor::operator()):
+        (JSC::Heap::zombifyDeadObjects): Eagerly sweeps so that we don't write garbage into an object before it 
+        is finalized/destroyed.
+        * heap/Heap.h:
+        (Heap):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::forEachDeadCell): Used to iterate over dead cells at the end of collection if zombie mode is enabled.
+        (JSC):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+        (JSC):
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in <http://trac.webkit.org/changeset/127698> with a fix for
+        fast/dom/HTMLScriptElement/script-reexecution-pretty-diff.html, which
+        is to make sure that function declarations don't put their names in scope.
+
+        Reviewed by Gavin Barraclough.
+
+            Named functions should not allocate scope objects for their names
+            https://bugs.webkit.org/show_bug.cgi?id=95659
+
+            Reviewed by Oliver Hunt.
+
+2012-09-06  Michael Saboff  <msaboff@apple.com>
+
+        16 bit JSRopeString up converts an 8 bit fibers to 16 bits during resolution
+        https://bugs.webkit.org/show_bug.cgi?id=95810
+
+        Reviewed by Benjamin Poulain.
+
+        Added 8 bit path that copies the contents of an 8 bit fiber to the 16 bit buffer
+        when resolving a 16 bit rope.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeSlowCase):
+
+2012-09-06  Gavin Barraclough  <barraclough@apple.com>
+
+        JS test suite puts incorrect limitations on Function.toString()
+        https://bugs.webkit.org/show_bug.cgi?id=3975
+
+        Reviewed by Geoff Garen.
+
+        The result of function toString is implementation defined;
+        these test cases were looking for specific whitespace formatting
+        that matches mozilla's, and for redundant braces to be inserted
+        around if/else blocks. Stop that.
+
+        * tests/mozilla/expected.html:
+        * tests/mozilla/js1_2/function/tostring-1.js:
+        (simplify):
+            - reduce whitespace differences
+        * tests/mozilla/js1_2/function/tostring-2.js:
+        (simplify):
+            - reduce whitespace differences
+        (TestOr):
+        (TestAnd):
+            - added braces to match expected output
+
+2012-09-06  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Performance regressions on 32-bit platforms with revisions 125637 and 126387
+        https://bugs.webkit.org/show_bug.cgi?id=95953
+
+        Reviewed by Filip Pizlo.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val): Fix the typo.
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out <http://trac.webkit.org/changeset/127698> because it broke
+        fast/dom/HTMLScriptElement/script-reexecution-pretty-diff.html
+
+            Named functions should not allocate scope objects for their names
+            https://bugs.webkit.org/show_bug.cgi?id=95659
+
+            Reviewed by Oliver Hunt.
+
+2012-09-06  Mark Lam  <mark.lam@apple.com>
+
+        Renamed useYarrJIT() option to useRegExpJIT(). Also fixed regression in
+        which inadvertantly allows the ASM llint to use the baseline JIT when
+        useRegExpJIT() is true.
+        https://bugs.webkit.org/show_bug.cgi?id=95918.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler):
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::canUseJIT):
+        (JSC::JSGlobalData::canUseRegExpJIT):
+        (JSGlobalData):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+        (JSC):
+
+2012-09-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for Interpreter after r127698.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Named functions should not allocate scope objects for their names
+        https://bugs.webkit.org/show_bug.cgi?id=95659
+
+        Reviewed by Oliver Hunt.
+
+        In most cases, we can merge a function expression's name into its symbol
+        table. This reduces memory footprint per closure from three objects
+        (function + activation + name scope) to two (function + activation),
+        speeds up closure allocation, and speeds up recursive calls.
+
+        In the case of a named function expression that contains a non-strict
+        eval, the rules are so bat-poop crazy that I don't know how to model
+        them without an extra object. Since functions now default to not having
+        such an object, this case needs to allocate the object on function
+        entry.
+
+        Therefore, this patch makes the slow case a bit slower so the fast case
+        can be faster and more memory-efficient. (Note that the slow case already
+        allocates an activation on entry, and until recently also allocated a
+        scope chain node on entry, so adding one allocation on entry shouldn't
+        break the bank.)
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Caught a missed initializer. No behavior change.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Put the callee in static scope
+        during compilation so it doesn't need to be in dynamic scope at runtime.
+
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::addCallee): Helper functions for either statically
+        resolving the callee or adding a dynamic scope that will resolve to it,
+        depending on whether you're in the fast path.
+
+        We move the callee into a var location if it's captured because activations
+        prefer to have contiguous ranges of captured variables.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::registerFor):
+        (BytecodeGenerator):
+
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): This is the point of the patch: remove
+        one allocation in the case of a named function expression.
+
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        * parser/Parser.h:
+        (JSC::Scope::declareCallee):
+        (Scope):
+        (Parser):
+        (JSC::parse):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::fromGlobalCode): Pipe the callee's name through
+        the parser so we get accurate information on whether the callee was captured.
+
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::create):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::finishCreation): I had to refactor function
+        creation to support the following function constructor quirk: the function
+        gets a name, but its name is not in lexical scope.
+
+        To simplify this, FunctionExecutable now automatically extracts all the
+        data it needs from the parsed node. The special "fromGlobalCode" path
+        used by the function constructor creates an anonymous function, and then
+        quirkily sets the value used by the .name property to be non-null, even
+        though the parsed name is null.
+
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::JSNameScope): Added support for explicitly specifying
+        your container scope. The compiler uses this for named function expressions.
+
+2012-09-05  Gavin Barraclough  <barraclough@apple.com>
+
+        a = data[a]++; sets the wrong key in data
+        https://bugs.webkit.org/show_bug.cgi?id=91270
+
+        Reviewed by Oliver Hunt.
+
+        Postfix inc/dec is unsafely using finalDestination, can trample base/subscript prior to the result being put.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+            - Remove redundant parens.
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+            - Refactored to use tempDestination instead of finalDestination.
+        (JSC::PrefixNode::emitBracket):
+        (JSC::PrefixNode::emitDot):
+            - Should be using emitPreIncOrDec.
+
+2012-09-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Bug, assignment within subscript of prefix/postfix increment of bracket access
+        https://bugs.webkit.org/show_bug.cgi?id=95913
+
+        Reviewed by Oliver Hunt.
+
+        javascript:alert((function(){ var a = { x:1 }; var b = { x:1 }; a[a=b,"x"]++; return a.x; })())
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PrefixNode::emitBracket):
+            - Should check for assigments in the subscript when loading the base.
+        * parser/Nodes.h:
+        (JSC::BracketAccessorNode::subscriptHasAssignments):
+        (BracketAccessorNode):
+            - Used by emitBracket methods.
+
+2012-09-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Merge prefix/postfix nodes
+        https://bugs.webkit.org/show_bug.cgi?id=95898
+
+        Reviewed by Geoff Garen.
+
+        Simplify the AST.
+        This will also mean we have access to m_subscriptHasAssignments when generating a prefix/postfix op applied to a bracket access.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+            - was PostfixResolveNode::emitBytecode
+        (JSC::PostfixNode::emitBracket):
+            - was PostfixBracketNode::emitBytecode
+        (JSC::PostfixNode::emitDot):
+            - was PostfixDotNode::emitBytecode
+        (JSC::PostfixNode::emitBytecode):
+            - was PostfixErrorNode::emitBytecode, call resolve/bracket/dot version as appropriate.
+        (JSC::PrefixNode::emitResolve):
+            - was PrefixResolveNode::emitBytecode
+        (JSC::PrefixNode::emitBracket):
+            - was PrefixBracketNode::emitBytecode
+        (JSC::PrefixNode::emitDot):
+            - was PrefixDotNode::emitBytecode
+        (JSC::PrefixNode::emitBytecode):
+            - was PrefixErrorNode::emitBytecode, call resolve/bracket/dot version as appropriate.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makePrefixNode):
+            - Just makes a PrefixNode!
+        (JSC::ASTBuilder::makePostfixNode):
+            - Just makes a PostfixNode!
+        * parser/NodeConstructors.h:
+        (JSC::PostfixNode::PostfixNode):
+            - Added, merge of PostfixResolveNode/PostfixBracketNode/PostfixDotNode/PostfixErrorNode.
+        (JSC::PrefixNode::PrefixNode):
+            - Added, merge of PrefixResolveNode/PrefixBracketNode/PrefixDotNode/PrefixErrorNode.
+        * parser/Nodes.h:
+        (PostfixNode):
+            - Added, merge of PostfixResolveNode/PostfixBracketNode/PostfixDotNode/PostfixErrorNode.
+        (PrefixNode):
+            - Added, merge of PrefixResolveNode/PrefixBracketNode/PrefixDotNode/PrefixErrorNode.
+
+2012-09-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of JSCell::classInfoOffset() from tryCacheGetByID
+        https://bugs.webkit.org/show_bug.cgi?id=95860
+
+        Reviewed by Oliver Hunt.
+
+        We should just do the indirection through the Structure instead.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Throw exceptions when assigning to const in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=95894
+
+        Reviewed by Oliver Hunt.
+
+        Currently, this never happens; but it will start happening once the
+        callee is a local const register. In this patch, there's no change in
+        behavior.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded): Helper function
+        for doing the throwing.
+        * bytecompiler/BytecodeGenerator.h:
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode): Call the helper function.
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored callee access in the DFG to support it in the general case
+        https://bugs.webkit.org/show_bug.cgi?id=95887
+
+        Reviewed by Phil Pizlo and Gavin Barraclough.
+
+        To support named function expressions, the DFG needs to understand the
+        callee register being used in arbitrary expressions, and not just
+        create_this.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getDirect): 
+        (JSC::DFG::ByteCodeParser::getCallee): Remap access to the callee register
+        into a GetCallee node. Otherwise, we get confused and think we have a
+        negatively indexed argument.
+
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand): Inlining also
+        needs to remap, but to the callee in the inline frame, and not the caller's
+        callee.
+
+        (JSC::DFG::ByteCodeParser::parseBlock): Since we support the callee in
+        the general case now, there's no need to handle it in a special way for
+        create_this.
+
+2012-09-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of JSCell::classInfoOffset() from virtualForThunkGenerator
+        https://bugs.webkit.org/show_bug.cgi?id=95821
+
+        Reviewed by Oliver Hunt.
+
+        We can replace the load of the ClassInfo from the object with a load from the Structure.
+
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::virtualForThunkGenerator):
+
+2012-09-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Fix the uses of String::operator+=() for Mac
+        https://bugs.webkit.org/show_bug.cgi?id=95818
+
+        Reviewed by Dan Bernstein.
+
+        * jsc.cpp:
+        (functionJSCStack): Use StringBuilder to create the stack dump, it is faster
+        and avoid String::operator+=().
+
+        * parser/Parser.h:
+        (JSC::Parser::updateErrorMessageSpecialCase):
+        (JSC::Parser::updateErrorMessage):
+        (JSC::Parser::updateErrorWithNameAndMessage):
+        Use the String operators (and makeString) to concatenate the strings.
+
+2012-09-05  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        DFG JIT doesn't work properly on ARM hardfp
+        https://bugs.webkit.org/show_bug.cgi?id=95684
+
+        Reviewed by Filip Pizlo.
+
+        Add hardfp support to DFG JIT. The patch is created with the
+        help of Zoltan Herczeg.
+
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        * dfg/DFGFPRInfo.h:
+        (FPRInfo):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+
+2012-09-04  Mark Lam  <mark.lam@apple.com>
+
+        Allow the YarrJIT to use the assembler even when useJIT() is false.
+        Introduce the useYarrJIT() option.
+        https://bugs.webkit.org/show_bug.cgi?id=95809.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+        (JSC):
+
+2012-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        inc/dec behave incorrectly operating on a resolved const
+        https://bugs.webkit.org/show_bug.cgi?id=95815
+
+        Reviewed by Geoff Garen.
+
+        There are two bugs here.
+
+        (1) When the value being incremented is const, and the result is ignored, we assume this cannot be observed, and emit no code.
+            However if the value being incremented is not a primitive & has a valueOf conversion, then this should be being called.
+
+        (2) In the case of a pre-increment of a const value where the result is not ignored, we'll move +/-1 to the destination, then
+            add the resolved const value being incremented to this. This is problematic if the destination is a local, and the const
+            value being incremented has a valueOf conversion that throws - the destination will be modified erroneously. Instead, we
+            need to use a temporary location.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+            - always at least perform a toNumber conversion, use tempDestination when reducing inc/dec to an add +/-1.
+
+2012-09-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound
+        https://bugs.webkit.org/show_bug.cgi?id=95717
+
+        Reviewed by Oliver Hunt.
+        
+        Rolling back in after fixing the negative index case.
+
+        Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already
+        there so we should just use it!
+
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-09-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r127503.
+        http://trac.webkit.org/changeset/127503
+        https://bugs.webkit.org/show_bug.cgi?id=95788
+
+        broke some tests (fast/js/dfg-negative-array-index, fast/js
+        /dfg-put-by-val-setter-then-get-by-val) (Requested by thorton
+        on #webkit).
+
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-09-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        Improve JSC use of Strings after the UString->String change
+        https://bugs.webkit.org/show_bug.cgi?id=95633
+
+        Reviewed by Geoffrey Garen.
+
+        This patch improve the use of strings in the JSC runtime.
+
+        The initialization of Identifier is left for future patches.
+
+        The improvements are the following:
+        -5% faster to raise one of the modified exception.
+        -3 times faster to execute Boolean::toString()
+
+        Most of the changes are just about using the new methods
+        for string literals.
+
+        With the changes, the binary on x86_64 gets 176 bytes smaller.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::CodeBlock::nameForRegister):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncReverse):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString): Instead of instanciating new strings, reuse the
+        keywords available in SmallStrings. Avoiding the creation of the JSString and StringImpl
+        makes the method significantly faster.
+
+        * runtime/DateConversion.cpp:
+        (JSC::formatDateTime):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::formateDateInstance):
+        (JSC::dateProtoFuncToISOString):
+        Change the way we use snprintf() for clarity and performance.
+
+        Instead of allocating one extra byte to put a zero "just in case", we use the size returned
+        by snprintf().
+        To prevent any overflow from a programming mistake, we explicitely test for overflow and
+        return an empty string.
+
+        (JSC::dateProtoFuncToJSON):
+        * runtime/Error.cpp:
+        (JSC::createNotEnoughArgumentsError):
+        (JSC::throwTypeError):
+        (JSC::throwSyntaxError):
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::finishCreation):
+        (JSC::errorProtoFuncToString):
+        Using a null String is correct because (8) uses jsString(), (9) tests for a length of 0.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::defaultValue):
+        (JSC::TerminatedExecutionError::defaultValue):
+        (JSC::createStackOverflowError):
+        (JSC::createOutOfMemoryError):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::create):
+        Using a null String for the name is correct because InternalFunction uses jsString()
+        to create the name value.
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        There is no need to create an empty string for a null string, jsString() handle both
+        cases as empty JSString.
+
+        * runtime/JSArray.cpp:
+        (JSC::reject):
+        (JSC::SparseArrayValueMap::put):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation): Same issue as InternalFunction::finishCreation.
+
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler): Use CFSTR() instead of CFStringCreateWithCString().
+        CFStringCreateWithCString() copy the content and may choose to decode the data.
+        CFSTR() is much more efficient.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        JSFunction uses jsString() to create the name, we can use null strings instead
+        of creating empty strings.
+
+        (JSC::JSGlobalObject::createThrowTypeError): ditto.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSString.cpp:
+        Return an empty JSString to avoid the creation of a temporary empty String.
+
+        (JSC::JSRopeString::getIndexSlowCase):
+        * runtime/JSString.h:
+        (JSC): Remove the versions of jsNontrivialString() taking a char*. All the callers
+        have been replaced by calls using ASCIILiteral.
+
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/LiteralParser.cpp:
+        (JSC::::Lexer::lex):
+        (JSC::::Lexer::lexString):
+        (JSC::::Lexer::lexNumber):
+        (JSC::::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::getErrorMessage):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncToString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::reject):
+        (JSC::regExpObjectSource):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+
+2012-09-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound
+        https://bugs.webkit.org/show_bug.cgi?id=95717
+
+        Reviewed by Oliver Hunt.
+
+        Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already
+        there so we should just use it!
+
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-09-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Extend the coverage of the Custom Allocation Framework in WTF and in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=95737
+
+        Reviewed by Eric Seidel.
+
+        Add WTF_MAKE_FAST_ALLOCATED macro to the following class declarations because these are instantiated by operator new.
+
+        * wtf/CryptographicallyRandomNumber.cpp: CryptographicallyRandomNumber is instantiated at wtf/CryptographicallyRandomNumber.cpp:162.
+
+        * heap/MachineStackMarker.cpp:
+        (MachineThreads::Thread): Thread is instantiated at heap/MachineStackMarker.cpp:196.
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (FixedVMPoolExecutableAllocator): FixedVMPoolExecutableAllocator is instantiated at jit/ExecutableAllocatorFixedVMPool.cpp:111
+        * parser/SourceProviderCache.h:
+        (SourceProviderCache): SourceProviderCache is instantiated at parser/SourceProvider.h:49.
+        * parser/SourceProviderCacheItem.h:
+        (SourceProviderCacheItem): SourceProviderCacheItem is instantiated at parser/Parser.cpp:843.
+        * runtime/GCActivityCallback.h:
+        (GCActivityCallback): GCActivityCallback is instantiated at runtime/GCActivityCallback.h:96.
+        * tools/CodeProfile.h:
+        (CodeProfile): CodeProfile is instantiated at JavaScriptCore/tools/CodeProfiling.cpp:140.
+
+2012-09-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove uses of ClassInfo from SpeculativeJIT::compileObjectOrOtherLogicalNot
+        https://bugs.webkit.org/show_bug.cgi?id=95510
+
+        Reviewed by Oliver Hunt.
+
+        More refactoring to get rid of ClassInfo checks in the DFG.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+
+2012-09-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for ENABLE(CLASSIC_INTERPRETER) after r127393.
+
+        * interpreter/Interpreter.h:
+
+2012-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed failures seen on Linux bots.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h: push_*_scope doesn't have a destination operand anymore.
+        Accordingly, update these places in the baseline JIT, which I missed in my last patch.
+
+2012-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored scope chain opcodes to support optimization for named function expressions
+        https://bugs.webkit.org/show_bug.cgi?id=95658
+
+        Reviewed by Sam Weinig.
+
+        Renamed
+            push_scope => push_with_scope
+            push_new_scope => push_name_scope
+        to clarify the difference between them.
+
+        Changed push_with_scope and push_name_scope not to save the new scope in
+        a temporary register, since doing so made optimization harder.
+
+        (The old behavior was a hold-over from when the scope chain wasn't
+        a GC object, and wouldn't be marked otherwise. Now, the scope chain is
+        marked because it is a GC object pointed to by the call frame.)
+
+        Changed push_name_scope to accept an operand specifying the attributes
+        for the named property, instead of assuming DontDelete, because a named
+        function expression needs ReadOnly|DontDelete.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::highestUsedRegister): Removed this function,
+        which used to be related to preserving saved scope object temporaries,
+        because it had no callers.
+
+2012-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back out a piece of <http://trac.webkit.org/changeset/127293>
+        because it broke inspector tests on Windows.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+2012-09-01  Mark Lam  <mark.lam@apple.com>
+
+        LLInt C loop backend.
+        https://bugs.webkit.org/show_bug.cgi?id=91052.
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::bytecodeOffset):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC):
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.h:
+        (JITStackFrame):
+        (JSC):
+        * llint/LLIntCLoop.cpp: Added.
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::CLoop::initialize):
+        (JSC::LLInt::CLoop::catchRoutineFor):
+        (JSC::LLInt::CLoop::hostCodeEntryFor):
+        (JSC::LLInt::CLoop::jsCodeEntryWithArityCheckFor):
+        (JSC::LLInt::CLoop::jsCodeEntryFor):
+        * llint/LLIntCLoop.h: Added.
+        (JSC):
+        (LLInt):
+        (CLoop):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::initialize):
+        * llint/LLIntData.h:
+        (JSC):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntOpcode.h:
+        * llint/LLIntThunks.cpp:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        (LLInt):
+        (JSC::LLInt::Ints2Double):
+        (JSC):
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter.h:
+        (JSC):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/asm.rb:
+        * offlineasm/backends.rb:
+        * offlineasm/cloop.rb: Added.
+        * offlineasm/instructions.rb:
+        * runtime/Executable.h:
+        (ExecutableBase):
+        (JSC::ExecutableBase::hostCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
+        (JSC::ExecutableBase::catchRoutineFor):
+        (NativeExecutable):
+        * runtime/JSValue.h:
+        (JSC):
+        (LLInt):
+        (JSValue):
+        * runtime/JSValueInlineMethods.h:
+        (JSC):
+        (JSC::JSValue::JSValue):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+
+2012-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * runtime/JSActivation.h:
+        (JSActivation):
+
+2012-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::setGlobalThis):
+        (JSC):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSScope::globalThis):
+        (JSC):
+        (JSC::JSGlobalObject::globalThis):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::visitChildren):
+        * runtime/JSScope.h:
+        (JSScope):
+        (JSC::JSScope::JSScope):
+        (JSC::JSScope::globalObject):
+        (JSC::JSScope::globalData):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+
+2012-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back out a piece of <http://trac.webkit.org/changeset/127293>
+        because it broke Window inspector tests.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * runtime/JSActivation.h:
+        (JSActivation):
+
+2012-08-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, attempt to fix Windows, take two.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, attempt to fix Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-31  Filip Pizlo  <fpizlo@apple.com>
+
+        JSArray::putDirectIndex should by default behave like JSObject::putDirect
+        https://bugs.webkit.org/show_bug.cgi?id=95630
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        * runtime/JSArray.h:
+        (SparseArrayValueMap):
+        (JSArray):
+        (JSC::JSArray::putDirectIndex):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::reifyAllProperties):
+        (JSC::RegExpMatchesArray::reifyMatchProperty):
+        * runtime/StringPrototype.cpp:
+        (JSC::splitStringByOneCharacterImpl):
+        (JSC::stringProtoFuncSplit):
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::strictEvalActivationStructure):
+        (JSC::JSGlobalObject::activationStructure):
+        (JSC::JSGlobalObject::nameScopeStructure):
+
+2012-08-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of ClassInfo in SpeculativeJIT::emitBranch
+        https://bugs.webkit.org/show_bug.cgi?id=95623
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::globalData):
+        (JSC):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::addAllocator):
+        * heap/WeakSet.h:
+        (WeakSet):
+        (JSC::WeakSet::WeakSet):
+        (JSC::WeakSet::globalData):
+        * runtime/JSGlobalData.h:
+        (JSC::WeakSet::heap):
+        (JSC):
+
+2012-08-31  Mark Lam  <mark.lam@apple.com>
+
+        Refactor LLInt and supporting code in preparation for the C Loop backend.
+        https://bugs.webkit.org/show_bug.cgi?id=95531.
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow): Use ExecutableBase::catchRoutineFor() to fetch
+            fetch the catch routine for a thrown exception.  This will allow
+            us to redefine that for the C loop later, and still keep this
+            code readable.
+        * llint/LLIntOfflineAsmConfig.h: Moved ASM macros to
+            LowLevelInterpreter.cpp which is the only place they are used. This
+            will make it more convenient to redefine them for the C loop later.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall): Use ExecutableBase's hostCodeEntry()
+            jsCodeEntryFor(), and jsCodeWithArityCheckEntryFor() for computing
+            the entry points to functions being called.
+        * llint/LLIntSlowPaths.h:
+        (SlowPathReturnType):
+        (JSC::LLInt::encodeResult):
+        (LLInt):
+        (JSC::LLInt::decodeResult): Added.  Needed by LLInt C Loop later.
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/asm.rb: Disambiguate between opcodes and other labels.
+        * offlineasm/config.rb:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::hostCodeEntryFor): Added.
+        (ExecutableBase):
+        (JSC::ExecutableBase::jsCodeEntryFor): Added.
+        (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): Added.
+        (JSC::ExecutableBase::catchRoutineFor): Added.
+        * runtime/JSValueInlineMethods.h:
+        (JSC):
+
+2012-08-31  Tony Chang  <tony@chromium.org>
+
+        Remove ENABLE_CSS3_FLEXBOX compile time flag
+        https://bugs.webkit.org/show_bug.cgi?id=95382
+
+        Reviewed by Ojan Vafai.
+
+        Everyone is already enabling this by default and the spec has stablized.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Rolled out http://trac.webkit.org/changeset/127293 because it broke
+        inspector tests on Windows.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Shrink activation objects by half
+        https://bugs.webkit.org/show_bug.cgi?id=95591
+
+        Reviewed by Sam Weinig.
+
+        Removed the global object, global data, and global this pointers from
+        JSScope, and changed an int to a bitfield. This gets the JSActivation
+        class down to 64 bytes, which in practice cuts it in half by getting it
+        out of the 128 byte size class.
+
+        Now, it's one extra indirection to get these pointers. These pointers
+        aren't accessed by JIT code, so I thought there would be no cost to the
+        extra indirection. However, some C++-heavy SunSpider tests regressed a
+        bit in an early version of the patch, which added even more indirection.
+        This suggests that calls to exec->globalData() and/or exec->lexicalGlobalObject()
+        are common and probably duplicated in lots of places, and could stand
+        further optimization in C++.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute): Test against the specific activation
+        for our global object, since there's no VM-shared activation structure
+        anymore. This is guaranteed to have the same success rate as the old test
+        because activation scope is fixed at compile time.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::globalData):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::addAllocator):
+        * heap/WeakSet.h:
+        (WeakSet):
+        (JSC::WeakSet::WeakSet):
+        (JSC::WeakSet::globalData): Store a JSGlobalData* instead of a Heap*
+        because JSGlobalData->Heap is just a constant fold in the addressing
+        mode, while Heap->JSGlobalData is an extra pointer dereference. (These
+        objects should eventually just merge.)
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global_dynamic): See DFGAbstractState.cpp.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Load the activation structure from
+        the code block instead of the global data because the structure is not
+        VM-shared anymore. (See DFGAbstractState.cpp.)
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSActivation): This is the point of the patch: Remove the data.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): No longer VM-shared. (See DFGAbstractState.cpp.)
+
+        (JSC::WeakSet::heap): (See WeakSet.h.)
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::setGlobalThis):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::strictEvalActivationStructure):
+        (JSC::JSGlobalObject::activationStructure):
+        (JSC::JSGlobalObject::nameScopeStructure):
+        (JSC::JSScope::globalThis):
+        (JSC::JSGlobalObject::globalThis): Data that used to be in the JSScope
+        class goes here now, so it's not duplicated across all activations.
+
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::visitChildren): This is the point of the patch: Remove the data.
+
+        * runtime/JSScope.h:
+        (JSScope):
+        (JSC::JSScope::JSScope):
+        (JSC::JSScope::globalObject):
+        (JSC::JSScope::globalData):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation): Simplified now that
+        we don't need to pass so much data to JSScope.
+
+2012-08-31  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for WinCE after r127191.
+
+        * bytecode/JumpTable.h:
+
+2012-08-30  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILURE in JSC::JSGlobalData::float32ArrayDescriptor when running fast/js/dfg-float64array.html
+        https://bugs.webkit.org/show_bug.cgi?id=95398
+
+        Reviewed by Mark Hahnenberg.
+
+        Trying to get the build failure to be a bit more informative.
+
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: add some #includes that, for some reason, only the Qt linker requires.
+
+        * runtime/BooleanObject.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/NameInstance.cpp:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix the Qt build: Removed a now-dead variable.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2012-08-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        Ambiguous operator[]  after r127191 on some compiler
+        https://bugs.webkit.org/show_bug.cgi?id=95509
+
+        Reviewed by Simon Fraser.
+
+        On some compilers, the operator[] conflicts with the Obj-C++ operators. This attempts to solve
+        the issue.
+
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsSubstring8):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: Remove the inline keyword at the declaration
+        site. 
+
+        The Qt compiler seems to be confused, complaining about these functions
+        not being defined in a translation unit, even though no generated code
+        in the unit calls these functions. Maybe removing the keyword at the
+        declaration site will change its mind.
+
+        This shouldn't change the inlining decision at all: the definition is
+        still inline.
+
+        * interpreter/CallFrame.h:
+        (ExecState):
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Undo Qt build fix guess, since it breaks other builds.
+
+        * runtime/JSArray.h:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: add an #include to JSArray.h, since
+        it's included by some of the files Qt complains about, and
+        some of is functions call the functions Qt complains about.
+
+        * runtime/JSArray.h:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Second step toward fixing the Windows build: Add new symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: add an #include.
+
+        * bytecode/GetByIdStatus.cpp:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        First step toward fixing the Windows build: Remove old symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Use one object instead of two for closures, eliminating ScopeChainNode
+        https://bugs.webkit.org/show_bug.cgi?id=95501
+
+        Reviewed by Filip Pizlo.
+
+        This patch removes ScopeChainNode, and moves all the data and related
+        functions that used to be in ScopeChainNode into JSScope.
+
+        Most of this patch is mechanical changes to use a JSScope* where we used
+        to use a ScopeChainNode*. I've only specifically commented about items
+        that were non-mechanical.
+
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h: Don't require an explicit scope chain argument
+        when evaluating code. Clients never wanted anything other than the
+        global scope, and other arbitrary scopes probably wouldn't work
+        correctly, anyway.
+
+        * runtime/JSScope.cpp:
+        * runtime/JSScope.h:
+        (JSC::JSScope::JSScope): JSScope now requires the data we used to pass to
+        ScopeChainNode, so it can link itself into the scope chain correctly.
+
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::create):
+        (JSC::JSWithScope::JSWithScope): JSWithScope gets an extra constructor
+        for specifically supplying your own scope chain. The DOM needs this
+        interface for setting up the scope chain for certain event handlers.
+        Other clients always just push the JSWithScope to the head of the current
+        scope chain.
+
+2012-08-30  Mark Lam  <mark.lam@apple.com>
+
+        Render unto #ifdef's that which belong to them.
+        https://bugs.webkit.org/show_bug.cgi?id=95482.
+
+        Reviewed by Filip Pizlo.
+
+        Refining / disambiguating between #ifdefs and adding some. For
+        example, ENABLE(JIT) is conflated with ENABLE(LLINT) in some places.
+        Also, we need to add ENABLE(COMPUTED_GOTO_OPCODES) to indicate that we
+        want interpreted opcodes to use COMPUTED GOTOs apart from ENABLE(LLINT)
+        and ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER). Also cleaned up #ifdefs
+        in certain places which were previously incorrect.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * config.h:
+        * dfg/DFGOperations.cpp:
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        (Interpreter):
+        * jit/HostCallReturnValue.h:
+        * jit/JITCode.h:
+        (JITCode):
+        * jit/JITExceptions.cpp:
+        * jit/JITExceptions.h:
+        * jit/JSInterfaceJIT.h:
+        * llint/LLIntData.h:
+        (JSC::LLInt::getOpcode):
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntOffsetsExtractor.cpp:
+        (JSC::LLIntOffsetsExtractor::dummy):
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+
+2012-08-30  JungJik Lee  <jungjik.lee@samsung.com>
+
+        [EFL][WK2] Add WebMemorySampler feature.
+        https://bugs.webkit.org/show_bug.cgi?id=91214
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WebMemorySampler collects Javascript stack and JIT memory usage in globalMemoryStatistics.
+
+        * PlatformEfl.cmake:
+
+2012-08-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        Replace JSC::UString by WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=95271
+
+        Reviewed by Geoffrey Garen.
+
+        Having JSC::UString and WTF::String increase the complexity of working on WebKit, and
+        add useless conversions in the bindings. It also cause some code bloat.
+
+        The performance advantages of UString have been ported over in previous patches. This patch
+        is the last step: getting rid of UString.
+
+        In addition to the simplified code, this also reduce the binary size by 15kb on x86_64.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * runtime/Identifier.h:
+        (JSC::Identifier::ustring):
+        To avoid changing everything at once, the function named ustring() were kept as is. They
+        will be renamed in a follow up patch.
+
+        * runtime/JSString.h:
+        (JSC::JSString::string):
+        (JSC::JSValue::toWTFString):
+        (JSC::inlineJSValueNotStringtoString):
+        (JSC::JSValue::toWTFStringInline):
+        Since JSValue::toString() already exist (and return the JSString), the direct accessor is renamed
+        to ::toWTFString(). We may change ::string() to ::jsString() and ::toWTFString() to ::toString()
+        in the future.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow): Replace the use of UString::getCharacters<>() by String::getCharactersWithUpconvert<>().
+
+2012-08-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove uses of ClassInfo in StrictEq and CompareEq in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=93401
+
+        Reviewed by Filip Pizlo.
+
+        Another incremental step in removing the dependence on ClassInfo pointers in object headers.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isCellOrOtherSpeculation):
+        (JSC):
+        * dfg/DFGAbstractState.cpp: Updated the CFA to reflect the changes to the backend.
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::shouldSpeculateString): Added this new function since it was conspicuously absent.
+        (JSC::DFG::Node::shouldSpeculateNonStringCellOrOther): Also add this function for use in the CFA.
+        * dfg/DFGSpeculativeJIT.cpp: Refactored how we handle CompareEq and CompareStrictEq in the DFG. We now just 
+        check for Strings by comparing the object's Structure to the global Structure for strings. We only 
+        check for MasqueradesAsUndefined if the watchpoint has fired. These changes allow us to remove our 
+        uses of the ClassInfo pointer for compiling these nodes.
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp: Same changes for 32 bit as for 64 bit.
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2012-08-30  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Implement IncrementalSweeper for PLATFORM(BLACKBERRY)
+        https://bugs.webkit.org/show_bug.cgi?id=95469
+
+        Reviewed by Rob Buis.
+
+        RIM PR# 200595.
+        Share most code with USE(CF) and implement timer-related methods
+        for PLATFORM(BLACKBERRY).
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC):
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::create):
+        (JSC::IncrementalSweeper::scheduleTimer):
+        (JSC::IncrementalSweeper::cancelTimer):
+        (JSC::IncrementalSweeper::doSweep):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+
+2012-08-30  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken classic intrpreter build.
+        https://bugs.webkit.org/show_bug.cgi?id=95484.
+
+        Reviewed by Filip Pizlo.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-08-30  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        Build warning : -Wsign-compare on DFGByteCodeParser.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=95418
+
+        Reviewed by Filip Pizlo.
+
+        There is a build warning '-Wsign-compare' on
+        findArgumentPositionForLocal() in DFGByteCodeParser.cpp.
+
+        For removing this warning, casting statement is added explicitly.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::findArgumentPosition):
+
+2012-08-30  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Set timer client on platform timer used in HeapTimer
+        https://bugs.webkit.org/show_bug.cgi?id=95464
+
+        Reviewed by Rob Buis.
+
+        Otherwise the timer won't work.
+
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::HeapTimer):
+
+2012-08-30  Julien BRIANCEAU   <jbrianceau@nds.com>
+
+        [sh4] Add missing implementation for JavaScriptCore JIT
+        https://bugs.webkit.org/show_bug.cgi?id=95452
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::isCompactPtrAlignedAddressOffset):
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::add32):
+        (JSC::MacroAssemblerSH4::convertibleLoadPtr):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::labelIgnoringWatchpoints):
+        (SH4Assembler):
+        (JSC::SH4Assembler::replaceWithLoad):
+        (JSC::SH4Assembler::replaceWithAddressComputation):
+
+2012-08-30  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Eliminate build warnings
+        https://bugs.webkit.org/show_bug.cgi?id=95338
+
+        Reviewed by Filip Pizlo.
+
+        static_cast to the same type to eliminate the build time warnings.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::flushWithoutBarrier):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+
+2012-08-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of ClassInfo from compileGetByValOnArguments and compileGetArgumentsLength
+        https://bugs.webkit.org/show_bug.cgi?id=95131
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): We don't need this speculation check. We can replace it 
+        with an assert to guarantee this.
+
+2012-08-29  Mark Lam  <mark.lam@apple.com>
+
+        Refactoring LLInt::Data.
+        https://bugs.webkit.org/show_bug.cgi?id=95316.
+
+        Reviewed by Geoff Garen.
+
+        This change allows its opcodeMap to be easily queried from any function
+        without needing to go through a GlobalData object.  It also introduces
+        the LLInt::getCodePtr() methods that will be used by the LLInt C loop
+        later to redefine how llint symbols (opcodes and trampoline glue
+        labels) get resolved.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
+        (MacroAssemblerCodeRef):
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::adjustPCIfAtCallSite):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/Opcode.h:
+            Remove the 'const' to simplify things and avoid having to do
+            additional casts and #ifdefs in many places.
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForLLInt):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::initialize):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        * llint/LLIntData.cpp:
+        (LLInt):
+        (JSC::LLInt::initialize):
+        * llint/LLIntData.h:
+        (JSC):
+        (LLInt):
+        (Data):
+        (JSC::LLInt::exceptionInstructions):
+        (JSC::LLInt::opcodeMap):
+        (JSC::LLInt::getOpcode):
+        (JSC::LLInt::getCodePtr):
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::returnToThrowForThrownException):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::handleHostCall):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce): Initialize the singleton LLInt data.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): Removed the now unneeded LLInt::Data instance in
+            JSGlobalData.
+        * runtime/JSValue.h:
+        (JSValue):
+
+2012-08-29  Gavin Barraclough  <barraclough@apple.com>
+
+        PutById uses DataLabel32, not DataLabelCompact
+        https://bugs.webkit.org/show_bug.cgi?id=95245
+
+        Reviewed by Geoff Garen.
+
+        JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now,
+        since they currently both do the same thing, but if we were to ever make compact mean
+        8-bit this could be a real problem. Also, relying on the object still being in eax
+        on entry to the transition stub isn't very robust - added nonArgGPR1 to at least make
+        this explicit.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+            - copy regT0 to nonArgGPR1
+        (JSC::JIT::privateCompilePutByIdTransition):
+            - DataLabelCompact -> DataLabel32
+        (JSC::JIT::resetPatchPutById):
+            - reload regT0 from nonArgGPR1
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+            - added nonArgGPR1
+
+2012-08-28  Yong Li  <yoli@rim.com>
+
+        ExecutableAllocator should be destructed after Heap
+        https://bugs.webkit.org/show_bug.cgi?id=95244
+
+        Reviewed by Rob Buis.
+
+        RIM PR# 199364.
+        Make ExecutableAllocator the first member in JSGlobalData.
+        Existing Web Worker tests can show the issue.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2012-08-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export!
+
+2012-08-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Introduced JSWithScope, making all scope objects subclasses of JSScope
+        https://bugs.webkit.org/show_bug.cgi?id=95295
+
+        Reviewed by Filip Pizlo.
+
+        This is a step toward removing ScopeChainNode. With a uniform representation
+        for objects in the scope chain, we can move data from ScopeChainNode
+        into JSScope.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri: Build!
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Use an explicit JSWithScope object
+        for 'with' statements. Since 'with' can put any object in the scope
+        chain, we'll need an adapter object to hold the data ScopeChainNode
+        currently holds.
+
+        (JSGlobalData): Support for JSWithScope.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::objectAtScope):
+        * runtime/JSScope.h: Check for and unwrap JSWithScope.
+
+        * runtime/JSType.h: Support for JSWithScope.
+
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StrictEvalActivation.h:
+        (StrictEvalActivation): Inherit from JSScope, to make the scope chain uniform.
+
+        * runtime/JSWithScope.cpp: Added.
+        (JSC::JSWithScope::visitChildren):
+        * runtime/JSWithScope.h: Added.
+        (JSWithScope):
+        (JSC::JSWithScope::create):
+        (JSC::JSWithScope::object):
+        (JSC::JSWithScope::createStructure):
+        (JSC::JSWithScope::JSWithScope): New adapter object. Since this object
+        is never exposed to scripts, it doesn't need any meaningful implementation
+        of property access or other callbacks.
+
+2012-08-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r126962.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-08-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Added JSScope::objectInScope(), and refactored callers to use it
+        https://bugs.webkit.org/show_bug.cgi?id=95281
+
+        Reviewed by Gavin Barraclough.
+
+        This is a step toward removing ScopeChainNode. We need a layer of
+        indirection so that 'with' scopes can proxy for an object.
+        JSScope::objectInScope() will be that layer.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl): . vs ->
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::resolveSkip):
+        (JSC::JSScope::resolveGlobalDynamic):
+        (JSC::JSScope::resolveBase):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis): Added JSScope::objectAtScope() calls.
+
+        * runtime/JSScope.h:
+        (JSScope):
+        (JSC::JSScope::objectAtScope):
+        (JSC):
+        (ScopeChainIterator):
+        (JSC::ScopeChainIterator::ScopeChainIterator):
+        (JSC::ScopeChainIterator::get):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChainIterator::operator++):
+        (JSC::ScopeChainIterator::operator==):
+        (JSC::ScopeChainIterator::operator!=):
+        (JSC::ScopeChainNode::begin):
+        (JSC::ScopeChainNode::end): I moved ScopeChainIterator to this file
+        to resolve a circular #include problem. Eventually, I'll probably rename
+        it to JSScope::iterator, so I think it belongs here.
+
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        (JSC::ScopeChainNode::localDepth): . vs ->
+
+        * runtime/ScopeChain.h:
+        (ScopeChainNode): I made the 'object' data member private because it's
+        no longer safe to access -- you need to call JSScope::objectAtScope()
+        instead.
+
+        The JITs need to be friends because of the private declaration.
+
+        Subtly, JIT/LLInt code is correct without any changes because JIT/LLInt
+        code never compiles direct access to a with scope.
+
+2012-08-28  Mark Lam  <mark.lam@apple.com>
+
+        Adding support for adding LLInt opcode extensions.  This will be needed
+        by the LLInt C loop interpreter later.
+        https://bugs.webkit.org/show_bug.cgi?id=95277.
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+        * llint/LLIntOpcode.h: Added.
+        * llint/LowLevelInterpreter.h:
+
+2012-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Rolled out r126928, this broke stuff :'-(
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::resetPatchPutById):
+
+2012-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        PutById uses DataLabel32, not DataLabelCompact
+        https://bugs.webkit.org/show_bug.cgi?id=95245
+
+        Reviewed by Geoff Garen.
+
+        JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now,
+        since they currently both do the same thing, but if we were to ever make compact mean
+        8-bit this could be a real problem. Also, don't rely on the object still being in eax
+        on entry to the transition stub – this isn't very robust.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+            - DataLabelCompact -> DataLabel32
+        (JSC::JIT::resetPatchPutById):
+            - reload regT0 from the stack
+
+2012-08-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r126914.
+        http://trac.webkit.org/changeset/126914
+        https://bugs.webkit.org/show_bug.cgi?id=95239
+
+        it breaks everything and fixes nothing (Requested by pizlo on
+        #webkit).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-08-28  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt should not rely on ordering of global labels
+        https://bugs.webkit.org/show_bug.cgi?id=95221
+
+        Reviewed by Oliver Hunt.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-08-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Rename first/second to key/value in HashMap iterators
+        https://bugs.webkit.org/show_bug.cgi?id=82784
+
+        Reviewed by Eric Seidel.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-08-28  Geoffrey Garen  <ggaren@apple.com>
+
+        GCC warning in JSActivation is causing Mac EWS errors
+        https://bugs.webkit.org/show_bug.cgi?id=95103
+
+        Reviewed by Sam Weinig.
+
+        Try to fix a strict aliasing violation by using bitwise_cast. The
+        union in the cast should signal to the compiler that aliasing between
+        types is happening.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+
+2012-08-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: svn add two files I forgot in my last patch.
+
+2012-08-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored and consolidated variable resolution functions
+        https://bugs.webkit.org/show_bug.cgi?id=95166
+
+        Reviewed by Filip Pizlo.
+
+        This patch does a few things:
+
+        (1) Introduces a new class, JSScope, which is the base class for all
+        objects that represent a scope in the scope chain.
+
+        (2) Refactors and consolidates duplicate implementations of variable
+        resolution into the JSScope class.
+
+        (3) Renames JSStaticScopeObject to JSNameScope because, as distinct from
+        something like a 'let' scope, JSStaticScopeObject only has storage for a
+        single name.
+
+        These changes makes logical sense to me as-is. I will also use them in an
+        upcoming optimization.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri: Build!
+
+        * bytecode/CodeBlock.cpp:
+        (JSC): Build fix for LLInt-only builds.
+
+        * bytecode/GlobalResolveInfo.h:
+        (GlobalResolveInfo): Use PropertyOffset to be consistent with other parts
+        of the engine.
+
+        * bytecompiler/NodesCodegen.cpp:
+        * dfg/DFGOperations.cpp: Use the shared code in JSScope instead of rolling
+        our own.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h: Use the shared code in JSScope instead of rolling
+        our own.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Use the shared code in JSScope instead of rolling
+        our own.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt): Use the shared code in JSScope instead of rolling our own. Note
+        that one of these slow paths calls the wrong helper function. I left it
+        that way to avoid a behavior change in a refactoring patch.
+
+        * parser/Nodes.cpp: Updated for rename.
+
+        * runtime/CommonSlowPaths.h:
+        (CommonSlowPaths): Removed resolve slow paths because were duplicative.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): Updated for renames.
+
+        * runtime/JSNameScope.cpp: Copied from Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp.
+        (JSC):
+        (JSC::JSNameScope::visitChildren):
+        (JSC::JSNameScope::toThisObject):
+        (JSC::JSNameScope::put):
+        (JSC::JSNameScope::getOwnPropertySlot):
+        * runtime/JSNameScope.h: Copied from Source/JavaScriptCore/runtime/JSStaticScopeObject.h.
+        (JSC):
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::createStructure):
+        (JSNameScope):
+        (JSC::JSNameScope::JSNameScope):
+        (JSC::JSNameScope::isDynamicScope): Used do-webcore-rename script here.
+        It is fabulous!
+
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::isNameScopeObject): More rename.
+
+        * runtime/JSScope.cpp: Added.
+        (JSC):
+        (JSC::JSScope::isDynamicScope):
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::resolveSkip):
+        (JSC::JSScope::resolveGlobal):
+        (JSC::JSScope::resolveGlobalDynamic):
+        (JSC::JSScope::resolveBase):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis):
+        * runtime/JSScope.h: Added.
+        (JSC):
+        (JSScope):
+        (JSC::JSScope::JSScope): All the code here is a port from the
+        Interpreter.cpp implementations of this functionality.
+
+        * runtime/JSStaticScopeObject.cpp: Removed.
+        * runtime/JSStaticScopeObject.h: Removed.
+
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC):
+        * runtime/JSSymbolTableObject.h:
+        (JSSymbolTableObject):
+        * runtime/JSType.h: Updated for rename.
+
+        * runtime/Operations.h:
+        (JSC::resolveBase): Removed because it was duplicative.
+
+2012-08-28  Alban Browaeys <prahal@yahoo.com>
+
+        [GTK] LLint build fails with -g -02
+        https://bugs.webkit.org/show_bug.cgi?id=90098
+
+        Reviewed by Filip Pizlo.
+
+        Avoid duplicate offsets for llint, discarding them.
+
+        * offlineasm/offsets.rb:
+
+2012-08-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r126836.
+        http://trac.webkit.org/changeset/126836
+        https://bugs.webkit.org/show_bug.cgi?id=95163
+
+        Broke all Apple ports, EFL, and Qt. (Requested by tkent on
+        #webkit).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-08-27  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Rename first/second to key/value in HashMap iterators
+        https://bugs.webkit.org/show_bug.cgi?id=82784
+
+        Reviewed by Eric Seidel.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-08-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure check hoisting should abstain if the OSR entry's must-handle value for the respective variable has a different structure
+        https://bugs.webkit.org/show_bug.cgi?id=95141
+        <rdar://problem/12170401>
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of ClassInfo from SpeculativeJIT::compileGetByValOnArguments
+        https://bugs.webkit.org/show_bug.cgi?id=95131
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): We don't need this speculation check. We can replace it 
+        with an assert to guarantee this.
+
+2012-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Remove opcode definition autogen for now
+        https://bugs.webkit.org/show_bug.cgi?id=95148
+
+        Reviewed by Mark Hahnenberg.
+
+        This isn't worth doing at the moment.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/OpcodeDefinitions.h: Removed.
+        * bytecode/opcodes: Removed.
+        * opcode_definition_generator.py: Removed.
+        * opcode_generator.py: Removed.
+        * opcode_parser.py: Removed.
+
+2012-08-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove uses of TypedArray ClassInfo from SpeculativeJIT::checkArgumentTypes
+        https://bugs.webkit.org/show_bug.cgi?id=95112
+
+        Reviewed by Filip Pizlo.
+
+        Removing these checks since we no longer need them.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+
+2012-08-27  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add ECMAScript Number to String conversion to WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=95016
+
+        Reviewed by Geoffrey Garen.
+
+        Rename UString::number(double) to UString::numberToStringECMAScript(double) to
+        differenciate it from the fixed-width conversion performed by String::number().
+
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::makeNumericIdentifier):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        * runtime/UString.cpp:
+        (JSC::UString::numberToStringECMAScript):
+        * runtime/UString.h:
+        (UString):
+
+2012-08-27  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        Rename RegisterProtocolHandler API to NavigatorContentUtils
+        https://bugs.webkit.org/show_bug.cgi?id=94920
+
+        Reviewed by Adam Barth.
+
+        ENABLE_REGISTER_PROTOCOL_HANDLER is renamed to ENABLE_NAVIGATOR_CONTENT_UTILS.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix for builds without VALUE_PROFILING. I had forgotten that shouldEmitProfiling()
+        is designed to return true if DFG_JIT is disabled. I should be using canBeOptimized() instead.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2012-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Don't allocate space for arguments and call frame if arguments aren't captured
+        https://bugs.webkit.org/show_bug.cgi?id=95024
+
+        Reviewed by Phil Pizlo.
+
+        27% on v8-real-earley.
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::registerOffset): The offset is zero if we're skipping
+        the arguments and call frame because "offset" means space reserved for
+        those things.
+
+        (JSC::JSActivation::tearOff): Don't copy the scope chain and callee. We
+        don't need them for anything, and we're no longer guaranteed to have
+        space for them.
+
+2012-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed the NULL checks from visitChildren functions
+        https://bugs.webkit.org/show_bug.cgi?id=95021
+
+        Reviewed by Oliver Hunt.
+
+        As of http://trac.webkit.org/changeset/126624, all values are NULL-checked
+        during GC, so explicit NULL checks aren't needed anymore.
+
+2011-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed a JSC-specific hack from the web inspector
+        https://bugs.webkit.org/show_bug.cgi?id=95033
+
+        Reviewed by Filip Pizlo.
+
+        Added support for what the web inspector really wanted instead.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut): Added some explanation for these
+        checks, which were non-obvious to me.
+
+        (JSC::JSActivation::getOwnPropertySlot): It's impossible to access the
+        arguments property of an activation after it's been torn off, since the
+        only way to tear off an activation is to instantiate a new function,
+        which has its own arguments property in scope. However, the inspector
+        get special access to activations, and may try to perform this access,
+        so we need a special guard to maintain coherence and avoid crashing in
+        case the activation optimized out the arguments property.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::getOwnPropertyDescriptor): Provide getOwnPropertyNames
+        and getOwnPropertyDescriptor implementations, to meet the web inspector's
+        needs. (User code can never call these.)
+
+2012-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Finally inlining should correctly track the catch context
+        https://bugs.webkit.org/show_bug.cgi?id=94986
+        <rdar://problem/11753784>
+
+        Reviewed by Sam Weinig.
+
+        This fixes two behaviors:
+        
+        1) Throwing from a finally block. Previously, we would seem to reenter the finally
+           block - though only once.
+        
+        2) Executing a finally block from some nested context, for example due to a
+           'continue', 'break', or 'return' in the try. This would execute the finally
+           block in the context of of the try block, which could lead to either scope depth
+           mismatches or reexecutions of the finally block on throw, similarly to (1) but
+           for different reasons.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::pushTry):
+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
+        * bytecompiler/BytecodeGenerator.h:
+        (FinallyContext):
+        (TryData):
+        (JSC):
+        (TryContext):
+        (TryRange):
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+
+2012-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Array type checks and storage accesses should be uniformly represented and available to CSE
+        https://bugs.webkit.org/show_bug.cgi?id=95013
+
+        Reviewed by Oliver Hunt.
+
+        This uniformly breaks up all array accesses into up to three parts:
+        
+        1) The type check, using a newly introduced CheckArray node, in addition to possibly
+           a CheckStructure node. We were already inserting the CheckStructure prior to this
+           patch. The CheckArray node will be automatically eliminated if the thing it was
+           checking for had already been checked for, either intentionally (a CheckStructure
+           inserted based on the array profile of this access) or accidentally (some checks,
+           typically a CheckStructure, inserted for some unrelated operations). The
+           CheckArray node may not be inserted if the array type is non-specific (Generic or
+           ForceExit).
+        
+        2) The storage load using GetIndexedPropertyStorage. Previously, this only worked for
+           GetByVal. Now it works for all array accesses. The storage load may not be
+           inserted if the mode of array access does not permit CSE of storage loads (like
+           non-specific modes or Arguments).
+        
+        3) The access itself: one of GetByVal, PutByVal, PutByValAlias, ArrayPush, ArrayPop,
+           GetArrayLength, StringCharAt, or StringCharCodeAt.
+        
+        This means that the type check can be subjected to CSE even if the CFA isn't smart
+        enough to reason about it (yet!). It also means that the storage load can always be
+        subjected to CSE; previously CSE on storage load only worked for array loads and not
+        other forms of access. Finally, it removes the bizarre behavior that
+        GetIndexedPropertyStorage previously had: previously, it was responsible for the type
+        check in some cases, but not others; this made reasoning about the CFA really
+        confusing.
+        
+        This change also disables late refinement of array mode, since I decided that
+        supporting that feature is both confusing and likely unprofitable. The array modes are
+        now locked in in the first fixup run after prediction propagation. Of course,
+        refinements from Generic to something else would not have been a problem; we could
+        reenable those if we thought we really needed to.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromStructure):
+        (DFG):
+        (JSC::DFG::refineArrayMode):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (JSC::DFG::modeIsJSArray):
+        (JSC::DFG::lengthNeedsStorage):
+        (JSC::DFG::modeIsSpecific):
+        (JSC::DFG::modeSupportsLength):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::performCSE):
+        * dfg/DFGCSEPhase.h:
+        (DFG):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (DFG):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::collectGarbage):
+        * dfg/DFGGraph.h:
+        (Graph):
+        (JSC::DFG::Graph::vote):
+        (JSC::DFG::Graph::substitute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArrayMode):
+        (JSC::DFG::Node::setArrayMode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhase.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGGraph.h has a bogus comment about the nature of StorageAccessData
+        https://bugs.webkit.org/show_bug.cgi?id=95035
+
+        Reviewed by Oliver Hunt.
+
+        The comment is both wrong (storage access instructions don't reference CheckStructure)
+        and highly redundant: of course it's the case that two structures may have the same
+        identifier. Our interference analyses currently don't care about this and make the
+        conservative assumptions when necessary (same identifier, same object -> must be same
+        property; same identifier, may be same object -> may be the same property). Better to
+        remove the bogus comment since the code that operates over this data structure is
+        fairly self-explanatory already.
+
+        * dfg/DFGGraph.h:
+        (StorageAccessData):
+
+2012-08-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Try a little harder to fix the Linux build.
+
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+
+2012-08-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Linux build.
+
+        * runtime/JSActivation.cpp:
+
+2012-08-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Don't use malloc / destructors for activation objects
+        https://bugs.webkit.org/show_bug.cgi?id=94897
+
+        Reviewed by Oliver Hunt.
+
+        65% faster on v8-real-earley.
+
+        Lots of boilerplate here, but the jist is this:
+
+        (1) Use CopiedSpace instead of malloc to allocate the activation's
+        backing store.
+
+        (2) Use MarkedSpace instead of ref-counting to allocate the symbol table.
+
+        (3) ==> No more destructor.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable):
+        (CodeBlock):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (FunctionCodeBlock): SymbolTable is a GC object now, so it gets a write
+        barrier and visit calls instead of ref-counting. I changed all CodeBlocks
+        to use shared symbol tables because the distinction between shared and
+        unshared hurt my head.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        (JSC::BytecodeGenerator::emitPutStaticVar):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Sometimes, a period just wants
+        to be an arrow. And then C++ is there to accommodate.
+
+        * jit/JITDriver.h:
+        (JSC::jitCompileFunctionIfAppropriate):
+        * runtime/Arguments.h:
+        (ArgumentsData):
+        (JSC::Arguments::setRegisters):
+        (Arguments):
+        (JSC::Arguments::argument):
+        (JSC::Arguments::finishCreation):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::symbolTable):
+        (FunctionExecutable):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareFunctionForExecution): I changed from WriteBarrier to
+        WriteBarrierBase so activations could reuse StorageBarrier and PropertyStorage.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::finishCreation): Allocate the symbol table here,
+        after we're fully constructed, to avoid GC during initialization.
+
+        (JSC::JSActivation::visitChildren):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        (JSActivation):
+        (JSC::JSActivation::registerOffset):
+        (JSC):
+        (JSC::JSActivation::registerArraySize):
+        (JSC::JSActivation::registerArraySizeInBytes):
+        (JSC::JSActivation::tearOff): Tear-off zero-initializes all uncopied
+        registers. This makes it safe to copyAndAppend the full buffer in
+        visitChildren, without any extra checks.
+
+        * runtime/JSCell.h:
+        (JSCell): Moved a shared default set of flags into this base class, so
+        I could use it in a few places.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): New structure for symbol tables.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::symbolTableHasProperty): We don't need an inline
+        symbol table -- JSSymbolTableObject will GC allocate one for us.
+
+        * runtime/JSObject.h:
+        (JSObject):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC):
+        (JSC::JSStaticScopeObject::visitChildren): NULL check our register store
+        because finishCreation allocates an object now, so we may get marked
+        before we've assigned to our register store.
+
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::finishCreation):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSStaticScopeObject): No more destructor for this object, either, since
+        it no longer embeds a hash table.
+
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::visitChildren):
+        (JSC::JSSymbolTableObject::deleteProperty):
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::symbolTable):
+        (JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::finishCreation):
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes): SymbolTableObject allocates a symbol
+        table automatically if one isn't provided. (Activations provide their
+        own, which they get from compiled code.)
+
+        * runtime/JSVariableObject.cpp:
+        (JSC):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::registerAt):
+        (JSC::JSVariableObject::addressOfRegisters):
+        (JSVariableObject):
+        (JSC::JSVariableObject::JSVariableObject):
+        (JSC::JSVariableObject::finishCreation): Removed a bunch of obsolete code.
+        Activations manage their registers directly now.
+
+        * runtime/StorageBarrier.h:
+        (StorageBarrier):
+        (JSC::StorageBarrier::operator!):
+
+        * runtime/SymbolTable.cpp:
+        (JSC):
+        (JSC::SharedSymbolTable::destroy):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::create):
+        (SharedSymbolTable):
+        (JSC::SharedSymbolTable::createStructure):
+        (JSC::SharedSymbolTable::SharedSymbolTable): Boilerplat code to
+        make shared symbol table GC-allocated.
+
+2012-08-25  Filip Pizlo  <fpizlo@apple.com>
+
+        op_call should have ArrayProfiling for the benefit of array intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=95014
+
+        Reviewed by Sam Weinig.
+
+        This is a performance-neutral change that just adds the profiling but does not
+        use it, yet. If in the future we wanted to make this kind of profiling cheaper
+        we could move it into specialized thunks for the relevant array intrinsics, but
+        I figure that if this much simpler change gives us what we need without any
+        discernable performance penalty then that's for the best.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-08-25  Filip Pizlo  <fpizlo@apple.com>
+
+        The redundant phi elimination phase is not used and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=95006
+
+        Reviewed by Dan Bernstein.
+
+        Just removing dead code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGDriver.cpp:
+        * dfg/DFGRedundantPhiEliminationPhase.cpp: Removed.
+        * dfg/DFGRedundantPhiEliminationPhase.h: Removed.
+
+2012-08-24  Benjamin Poulain  <bpoulain@apple.com>
+
+        Unify Number to StringImpl conversion
+        https://bugs.webkit.org/show_bug.cgi?id=94879
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::UString::number):
+        Update UString to directly use the common NumberToString implementation.
+
+2012-08-24  Oliver Hunt  <oliver@apple.com>
+
+        Always null check cells before marking
+        https://bugs.webkit.org/show_bug.cgi?id=94968
+
+        Reviewed by Geoffrey Garen.
+
+        Originally we tried to minimise null checks by only null checking values
+        that we knew could be null, however given that we can't ever guarantee
+        when a GC will happen, we're better off just always assuming that a null
+        check will be necessary.  This results in a much less fragile code base
+        as we can add GC allocations to object initialisers without having to
+        subsequently worry about whether the object we are initialising will need
+        to add a bunch of null checks in its visitChildren implementation.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/MarkStackInlineMethods.h:
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendUnbarrieredPointer):
+        * runtime/Structure.h:
+        (JSC::MarkStack::internalAppend):
+
+2012-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Autogenerate Opcode definitions
+        https://bugs.webkit.org/show_bug.cgi?id=94840
+
+        Reviewed by Gavin Barraclough.
+
+        Start the process of autogenerating the code emission for the bytecode.
+        We'll just start with automatic generation of the list of Opcodes as that
+        requires the actual definition of the opcodes, and the logic for parsing
+        them.
+
+        Due to some rather annoying dependency cycles, this initial version has
+        the OpcodeDefinitions.h file checked into the tree, although with some
+        work I hope to be able to fix that.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+          Include OpcodeDefinitions.h as our definitive source of info
+          about the opcodes.
+        * bytecode/OpcodeDefinitions.h: Added.
+          Autogenerated file
+        * bytecode/opcodes: Added.
+          The new opcode definition file
+        * opcode_definition_generator.py: Added.
+        (generateOpcodeDefinition):
+        (generate):
+          Module that generates the content for OpcodeDefinitions.h
+        * opcode_generator.py: Added.
+        (printUsage):
+        (main):
+          Driver script
+        * opcode_parser.py: Added.
+          Simple parser for the opcode definitions.
+
+2011-08-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling out r126505.
+        http://trac.webkit.org/changeset/126505
+        https://bugs.webkit.org/show_bug.cgi?id=94840
+
+        Caused testapi to crash on launch
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/OpcodeDefinitions.h: Removed.
+        * bytecode/opcodes: Removed.
+        * opcode_definition_generator.py: Removed.
+        * opcode_generator.py: Removed.
+        * opcode_parser.py: Removed.
+
+2012-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Autogenerate Opcode definitions
+        https://bugs.webkit.org/show_bug.cgi?id=94840
+
+        Reviewed by Gavin Barraclough.
+
+        Start the process of autogenerating the code emission for the bytecode.
+        We'll just start with automatic generation of the list of Opcodes as that
+        requires the actual definition of the opcodes, and the logic for parsing
+        them.
+
+        Due to some rather annoying dependency cycles, this initial version has
+        the OpcodeDefinitions.h file checked into the tree, although with some
+        work I hope to be able to fix that.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+          Include OpcodeDefinitions.h as our definitive source of info
+          about the opcodes.
+        * bytecode/OpcodeDefinitions.h: Added.
+          Autogenerated file
+        * bytecode/opcodes: Added.
+          The new opcode definition file
+        * opcode_definition_generator.py: Added.
+        (generateOpcodeDefinition):
+        (generate):
+          Module that generates the content for OpcodeDefinitions.h
+        * opcode_generator.py: Added.
+        (printUsage):
+        (main):
+          Driver script
+        * opcode_parser.py: Added.
+          Simple parser for the opcode definitions.
+
+2012-08-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Change behavior of MasqueradesAsUndefined to better accommodate DFG changes
+        https://bugs.webkit.org/show_bug.cgi?id=93884
+
+        Reviewed by Filip Pizlo.
+
+        With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of  
+        MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines,  
+        we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined  
+        objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject).  
+        For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not  
+        masquerade as undefined within frame B, but it will continue to masquerade in frame A. 
+
+        There are two primary changes that are taking place here. One is to thread the ExecState* through  
+        JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's  
+        JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two  
+        are distinct, then the object cannot MasqueradeAsUndefined. 
+
+        The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined 
+        flag in the Structure is checked. For C++ code, this check has been factored into its own function in  
+        Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has  
+        had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed  
+        through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers 
+        that are MasqueradesAsUndefined.
+
+        * API/JSValueRef.cpp:
+        (JSValueToBoolean):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/Watchpoint.h:
+        (WatchpointSet):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::callFrame):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncSome):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint):
+        * runtime/JSString.h:
+        (JSC::JSCell::toBoolean):
+        (JSC::JSValue::toBoolean):
+        * runtime/JSValue.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        * runtime/Operations.h:
+        (JSC):
+        (JSC::JSValue::equalSlowCaseInline):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorMultiline):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::globalObjectOffset):
+        (JSC::Structure::masqueradesAsUndefined):
+        (JSC):
+
+2012-08-23  Mark Rowe  <mrowe@apple.com>
+
+        Make JavaScriptCore build with the latest version of clang.
+
+        Reviewed by Dan Bernstein.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads): The m_heap member is only used within
+        assertions, so guard its initialization with !ASSERT_DISABLED.
+        * heap/MachineStackMarker.h:
+        (MachineThreads): Ditto for its declaration.
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::JITStubCall): The m_returnType member is only used within
+        assertions or if we're using JSVALUE32_64, so guard its uses with the appropriate
+        #if.
+        (JITStubCall): Ditto.
+
+2012-08-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Serialization of JavaScript values does not appear to respect new HTML5 Structured Clone semantics
+        https://bugs.webkit.org/show_bug.cgi?id=65292
+
+        Reviewed by Oliver Hunt.
+
+        Add function to construct a StringObject from a JSValue.
+        Similar functions already exist for NumberObject and
+        BooleanObject for example.
+
+        Export several symbols so address linking errors in
+        WebCore.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/BooleanObject.h:
+        (BooleanObject):
+        * runtime/NumberObject.h:
+        (NumberObject):
+        (JSC):
+        * runtime/StringObject.cpp:
+        (JSC::constructString):
+        (JSC):
+        * runtime/StringObject.h:
+        (JSC):
+
+2012-08-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Array accesses should remember what kind of array they are predicted to access
+        https://bugs.webkit.org/show_bug.cgi?id=94448
+
+        Reviewed by Gavin Barraclough.
+
+        Introduced the notion of DFG::Array::Mode, stored in node.arrayMode(), which allows nodes
+        to remember how they decided to access arrays. This permits the bytecode parser to "lock in"
+        the mode of access if it has profiling at its disposal, and it also allows the prediction
+        propagator to do a fixup of the array mode later in the optimization fixpoint.
+        
+        This patch adds a healthy amount of new capability (specifically the ability of the parser
+        to lock in an array mode regardless of type predictions) and it also blows away a lot of
+        messy code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayMode.cpp: Added.
+        (DFG):
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::refineArrayMode):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h: Added.
+        (DFG):
+        (JSC::DFG::canCSEStorage):
+        (JSC::DFG::modeForPut):
+        (JSC::DFG::modesCompatibleForStorageLoad):
+        (JSC::DFG::modeSupportsLength):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getArrayModeWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArrayMode):
+        (Node):
+        (JSC::DFG::Node::arrayMode):
+        (JSC::DFG::Node::setArrayMode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculateArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-22  Geoffrey Garen  <ggaren@apple.com>
+
+        ThreadRestrictionVerifier should be opt-in, not opt-out
+        https://bugs.webkit.org/show_bug.cgi?id=94761
+
+        Reviewed by Mark Hahnenberg.
+
+        Removed explicit calls to disable the verifier, since it's off by default now.
+
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (SourceProvider):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::SharedSymbolTable):
+
+2012-08-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Separate MarkStackThreadSharedData from MarkStack
+        https://bugs.webkit.org/show_bug.cgi?id=94294
+
+        Reviewed by Filip Pizlo.
+
+        MarkStackThreadSharedData is soon going to have data to allow for a parallel copying 
+        mode too, so to separate our concerns we should split it out into its own set of files 
+        and rename it to GCThreadSharedData. For now this is purely a cosmetic refactoring.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/GCThreadSharedData.cpp: Added.
+        (JSC):
+        (JSC::GCThreadSharedData::resetChildren):
+        (JSC::GCThreadSharedData::childVisitCount):
+        (JSC::GCThreadSharedData::markingThreadMain):
+        (JSC::GCThreadSharedData::markingThreadStartFunc):
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::~GCThreadSharedData):
+        (JSC::GCThreadSharedData::reset):
+        * heap/GCThreadSharedData.h: Added.
+        (JSC):
+        (GCThreadSharedData):
+        * heap/Heap.h:
+        (Heap):
+        * heap/ListableHandler.h:
+        (ListableHandler):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::~MarkStack):
+        * heap/MarkStack.h:
+        (JSC):
+        (MarkStack):
+        (JSC::MarkStack::sharedData):
+        * heap/MarkStackInlineMethods.h: Added.
+        (JSC):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendUnbarrieredPointer):
+        (JSC::MarkStack::appendUnbarrieredValue):
+        (JSC::MarkStack::internalAppend):
+        (JSC::MarkStack::addWeakReferenceHarvester):
+        (JSC::MarkStack::addUnconditionalFinalizer):
+        (JSC::MarkStack::addOpaqueRoot):
+        (JSC::MarkStack::containsOpaqueRoot):
+        (JSC::MarkStack::opaqueRootCount):
+        * heap/SlotVisitor.h:
+        (JSC):
+        (SlotVisitor):
+        (JSC::SlotVisitor::SlotVisitor):
+
+2012-08-22  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Fix JSC build when DFG-JIT is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=94694
+
+        Reviewed by Csaba Osztrogonác.
+
+        Adding an appropriate guard for fixing the build.
+
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC):
+
+2012-08-21  Mark Lam  <mark.lam@apple.com>
+
+        Introducing the VMInspector for VM debugging use.
+        https://bugs.webkit.org/show_bug.cgi?id=94613.
+
+        Reviewed by Filip Pizlo.
+
+        Adding some utility functions for debugging the VM. This code is
+        presently #ifdef'd out by default.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        (ExecState):
+        * interpreter/VMInspector.cpp: Added.
+        (JSC):
+        (JSC::VMInspector::getTypeName):
+        (JSC::VMInspector::dumpFrame0):
+        (JSC::VMInspector::dumpFrame):
+        (JSC::VMInspector::countFrames):
+        * interpreter/VMInspector.h: Added.
+        (JSC):
+        (VMInspector):
+
+2012-08-21  Filip Pizlo  <fpizlo@apple.com>
+
+        A patchable GetById right after a watchpoint should have the appropriate nop padding
+        https://bugs.webkit.org/show_bug.cgi?id=94635
+
+        Reviewed by Mark Hahnenberg.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::padBeforePatch):
+        (AbstractMacroAssembler):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
+        (JSC::MacroAssemblerARMv7::moveWithPatch):
+        (JSC::MacroAssemblerARMv7::patchableJump):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::load32WithCompactAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::loadCompactWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::loadPtrWithCompactAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::moveWithPatch):
+        * jit/JumpReplacementWatchpoint.cpp:
+        (JSC::JumpReplacementWatchpoint::fireInternal):
+
+2012-08-20  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken non-JIT build.
+        https://bugs.webkit.org/show_bug.cgi?id=94564.
+
+        Reviewed by Filip Pizlo.
+
+        Added some UNUSED_PARAM() macros to make the compiler happy.
+
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2012-08-20  Mark Lam  <mark.lam@apple.com>
+
+        Fixed erroneous line number for LLint frame when throwing exceptions.
+        https://bugs.webkit.org/show_bug.cgi?id=94051.
+
+        Reviewed by Filip Pizlo.
+
+        For LLInt frames, before throwing an exception, adjust the PC from the
+        return PC back to the call PC if we are indeed at a call site.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::adjustPCIfAtCallSite):
+        (JSC):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::fixupPCforExceptionIfNeeded):
+        (LLInt):
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+
+2012-08-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html on 32-bit
+        https://bugs.webkit.org/show_bug.cgi?id=94538
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2012-08-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html crashes on 32-bit
+        https://bugs.webkit.org/show_bug.cgi?id=94026
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+
+2012-08-19  Filip Pizlo  <fpizlo@apple.com>
+
+        The relationship between abstract values and structure transition watchpoints should be rationalized
+        https://bugs.webkit.org/show_bug.cgi?id=94205
+
+        Reviewed by Geoffrey Garen.
+
+        This patch does a number of things related to the handling of the abstract values
+        arrising from values with structures known to be watchpointable:
+        
+        - This rationalizes the relationship between the structure that we know an object
+          to have *right now* based on having executed a check against that structure, and
+          the structure that we know the object could have *in the future* based on a type
+          check executed in the past over a structure that was watchpointable.
+        
+        - We use the above to assert that structure transition watchpoints are being used
+          soundly.
+        
+        - We use the above to strength reduce CheckStructure into StructureTransitionWatchpoint
+          whenever possible.
+        
+        - This rationalizes the handling of CFA over constants that appeared in the bytecode.
+          If at compile-time the constant has a watchpointable structure, then we can prove
+          what structures it may have in the future. The analysis uses this to both assert
+          that structure transition watchpoints are being used correctly, and to find
+          opportunities for using them more aggressively.
+        
+        The net effect of all of these changes is that OSR entry should work more smoothly.
+        It may also be a slight win due to strength reductions, though most of those strength
+        reductions would have already been done by the parser and the structure check hoister.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractValue.h:
+        (DFG):
+        (JSC::DFG::AbstractValue::clear):
+        (JSC::DFG::AbstractValue::isClear):
+        (JSC::DFG::AbstractValue::makeTop):
+        (JSC::DFG::AbstractValue::clobberStructures):
+        (JSC::DFG::AbstractValue::isTop):
+        (JSC::DFG::AbstractValue::setFuturePossibleStructure):
+        (AbstractValue):
+        (JSC::DFG::AbstractValue::filterFuturePossibleStructure):
+        (JSC::DFG::AbstractValue::setMostSpecific):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::operator==):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::filterValueByType):
+        (JSC::DFG::AbstractValue::validateType):
+        (JSC::DFG::AbstractValue::validate):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+        (Node):
+        (JSC::DFG::Node::hasStructure):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationWatchpoint):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpointWithConditionalDirection):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculateArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureAbstractValue.h: Added.
+        (DFG):
+        (StructureAbstractValue):
+        (JSC::DFG::StructureAbstractValue::StructureAbstractValue):
+        (JSC::DFG::StructureAbstractValue::clear):
+        (JSC::DFG::StructureAbstractValue::makeTop):
+        (JSC::DFG::StructureAbstractValue::top):
+        (JSC::DFG::StructureAbstractValue::add):
+        (JSC::DFG::StructureAbstractValue::addAll):
+        (JSC::DFG::StructureAbstractValue::contains):
+        (JSC::DFG::StructureAbstractValue::isSubsetOf):
+        (JSC::DFG::StructureAbstractValue::doesNotContainAnyOtherThan):
+        (JSC::DFG::StructureAbstractValue::isSupersetOf):
+        (JSC::DFG::StructureAbstractValue::filter):
+        (JSC::DFG::StructureAbstractValue::isClear):
+        (JSC::DFG::StructureAbstractValue::isTop):
+        (JSC::DFG::StructureAbstractValue::isClearOrTop):
+        (JSC::DFG::StructureAbstractValue::isNeitherClearNorTop):
+        (JSC::DFG::StructureAbstractValue::size):
+        (JSC::DFG::StructureAbstractValue::at):
+        (JSC::DFG::StructureAbstractValue::operator[]):
+        (JSC::DFG::StructureAbstractValue::last):
+        (JSC::DFG::StructureAbstractValue::speculationFromStructures):
+        (JSC::DFG::StructureAbstractValue::hasSingleton):
+        (JSC::DFG::StructureAbstractValue::singleton):
+        (JSC::DFG::StructureAbstractValue::operator==):
+        (JSC::DFG::StructureAbstractValue::dump):
+        (JSC::DFG::StructureAbstractValue::topValue):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-17  Filip Pizlo  <fpizlo@apple.com>
+
+        The current state of the call frame should be taken into account in the DFG for both predictions and proofs
+        https://bugs.webkit.org/show_bug.cgi?id=94412
+
+        Reviewed by Geoffrey Garen.
+
+        This ensures that no matter how smart the DFG gets, it'll always know through
+        which entrypoint OSR will try to enter, and with which values it will attempt
+        to do so. For prologue OSR, this has no effect other than adding the current
+        arguments to the argument predictions. For loop OSR, this makes our treatment
+        of the loop slightly more conservative - just conservative enough to ensure
+        that OSR succeeds.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::ProgramCodeBlock::compileOptimized):
+        (JSC::EvalCodeBlock::compileOptimized):
+        (JSC::FunctionCodeBlock::compileOptimized):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::setMostSpecific):
+        (AbstractValue):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h:
+        (DFG):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::Graph):
+        (Graph):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileOptimized):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::compileOptimizedFor):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+
+2012-08-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE should be more honest about when it changed the IR
+        https://bugs.webkit.org/show_bug.cgi?id=94408
+
+        Reviewed by Geoffrey Garen.
+
+        The CSE phase now always returns true if it changed the IR.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+
+2012-08-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG is still too pessimistic about what constitutes a side-effect on array accesses
+        https://bugs.webkit.org/show_bug.cgi?id=94309
+
+        Reviewed by Geoffrey Garen.
+
+        This change means that even if structure transition watchpoints are not used for
+        hoisting of clobbered structure checks, we still retain good performance on the
+        benchmarks we care about. That's important, since butterflies will likely make
+        most array structures not watchpointable.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-17  Milian Wolff  <milian.wolff@kdab.com>
+
+        [Qt] QNX build fails due to ctype usage in system headers
+        https://bugs.webkit.org/show_bug.cgi?id=93849
+
+        Reviewed by Simon Hausmann.
+
+        Move the check for whether DisallowCType should be active or not
+        to the DisallowCType.h header. This way, we can update the list
+        of platforms or OSes which do not work with this header in a
+        central place. All users can now safely include the header
+        and do not need to place custom guards around it.
+
+        * config.h:
+
+2012-08-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap
+        https://bugs.webkit.org/show_bug.cgi?id=93872
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Target.pri: Add missing JSWeakObjectMap file to build.
+
+2012-08-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure check hoisting should be less expensive
+        https://bugs.webkit.org/show_bug.cgi?id=94201
+
+        Reviewed by Mark Hahnenberg.
+
+        This appears like a broad win on short-running programs.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::compareAndSwap):
+        (Graph):
+        (JSC::DFG::Graph::substitute):
+        (JSC::DFG::Graph::substituteGetLocal):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-16  Filip Pizlo  <fpizlo@apple.com>
+
+        All op_resolve_global instructions should end up in the list of global resolve instructions
+        https://bugs.webkit.org/show_bug.cgi?id=94247
+        <rdar://problem/12103500>
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+
+2012-08-15  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        [css3-text] Add CSS3 Text decoration compile flag
+        https://bugs.webkit.org/show_bug.cgi?id=93863
+
+        Reviewed by Julien Chaffraix.
+
+        This patch handles the compile flag implementation, which will come disabled by
+        default, thus not exposing the CSS3 text decoration features to the web, unless
+        when explicitly enabling it with "--css3-text-decoration" build parameter.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r125687.
+        http://trac.webkit.org/changeset/125687
+        https://bugs.webkit.org/show_bug.cgi?id=94147
+
+        It broke the whole world (Requested by Ossy_night on #webkit).
+
+        * API/JSValueRef.cpp:
+        (JSValueToBoolean):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/Watchpoint.h:
+        (WatchpointSet):
+        * debugger/DebuggerCallFrame.h:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncSome):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        * runtime/JSString.h:
+        (JSC::JSCell::toBoolean):
+        (JSC::JSValue::toBoolean):
+        * runtime/JSValue.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        * runtime/Operations.h:
+        (JSC):
+        (JSC::JSValue::equalSlowCaseInline):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorMultiline):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/Structure.h:
+
+2012-08-15  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Buildfix after r125541
+        https://bugs.webkit.org/show_bug.cgi?id=94097
+
+        Reviewed by Filip Pizlo.
+
+        r125541 has broken the traditional ARM port build of JSC.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::xor32):
+
+2012-08-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Change behavior of MasqueradesAsUndefined to better accommodate DFG changes
+        https://bugs.webkit.org/show_bug.cgi?id=93884
+
+        Reviewed by Geoffrey Garen.
+
+        With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of 
+        MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, 
+        we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined 
+        objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). 
+        For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not 
+        masquerade as undefined within frame B, but it will continue to masquerade in frame A.
+
+        There are two primary changes that are taking place here. One is to thread the ExecState* through 
+        JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's 
+        JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two 
+        are distinct, then the object cannot MasqueradeAsUndefined.
+
+        The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined
+        flag in the Structure is checked. For C++ code, this check has been factored into its own function in 
+        Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has 
+        had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed 
+        through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers
+        that are MasqueradesAsUndefined.
+
+        * API/JSValueRef.cpp:
+        (JSValueToBoolean):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/Watchpoint.h:
+        (WatchpointSet):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::callFrame):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncSome):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint):
+        * runtime/JSString.h:
+        (JSC::JSCell::toBoolean):
+        (JSC::JSValue::toBoolean):
+        * runtime/JSValue.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        * runtime/Operations.h:
+        (JSC):
+        (JSC::JSValue::equalSlowCaseInline):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorMultiline):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::globalObjectOffset):
+        (JSC::Structure::masqueradesAsUndefined):
+        (JSC):
+
+2012-08-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for !ENABLE(DFG_JIT)
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-08-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Array checks should use the structure, not the class info
+        https://bugs.webkit.org/show_bug.cgi?id=93150
+
+        Reviewed by Mark Hahnenberg.
+
+        This changes all array checks used in array accesses (get, put, get length,
+        push, pop) to use the structure, not the class info. Additionally, these
+        checks in the LLInt and baseline JIT record the structure in an ArrayProfile,
+        so that the DFG can know exactly what structure to check for.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ArrayProfile.cpp: Added.
+        (JSC):
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        * bytecode/ArrayProfile.h: Added.
+        (JSC):
+        (JSC::arrayModeFromStructure):
+        (ArrayProfile):
+        (JSC::ArrayProfile::ArrayProfile):
+        (JSC::ArrayProfile::bytecodeOffset):
+        (JSC::ArrayProfile::addressOfLastSeenStructure):
+        (JSC::ArrayProfile::observeStructure):
+        (JSC::ArrayProfile::expectedStructure):
+        (JSC::ArrayProfile::structureIsPolymorphic):
+        (JSC::ArrayProfile::hasDefiniteStructure):
+        (JSC::ArrayProfile::observedArrayModes):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::getArrayProfile):
+        (JSC):
+        (JSC::CodeBlock::getOrAddArrayProfile):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::executionEntryCount):
+        (JSC::CodeBlock::numberOfArrayProfiles):
+        (JSC::CodeBlock::arrayProfiles):
+        (JSC::CodeBlock::addArrayProfile):
+        (CodeBlock):
+        * bytecode/Instruction.h:
+        (JSC):
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetArgumentByVal):
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::hasSingleton):
+        (StructureAbstractValue):
+        (JSC::DFG::StructureAbstractValue::singleton):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateArray):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::classInfoOffset):
+
+2012-08-14  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Rename functions in the ARM port of DFG-JIT for better code readability.
+        https://bugs.webkit.org/show_bug.cgi?id=93609
+
+        Reviewed by Zoltan Herczeg.
+
+        Rename functions in the ARM port of DFG-JIT for better code
+        readability, and for following the WebKit coding style
+        wherever it is possible.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::genInt):
+        (JSC::ARMAssembler::getImm):
+        (JSC::ARMAssembler::moveImm):
+        (JSC::ARMAssembler::encodeComplexImm):
+        (JSC::ARMAssembler::dataTransfer32):
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        (JSC::ARMAssembler::dataTransfer16):
+        (JSC::ARMAssembler::baseIndexTransfer16):
+        (JSC::ARMAssembler::dataTransferFloat):
+        (JSC::ARMAssembler::baseIndexTransferFloat):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::bitAnd):
+        (JSC::ARMAssembler::bitAnds):
+        (JSC::ARMAssembler::eor):
+        (JSC::ARMAssembler::eors):
+        (JSC::ARMAssembler::sub):
+        (JSC::ARMAssembler::subs):
+        (JSC::ARMAssembler::rsb):
+        (JSC::ARMAssembler::rsbs):
+        (JSC::ARMAssembler::add):
+        (JSC::ARMAssembler::adds):
+        (JSC::ARMAssembler::adc):
+        (JSC::ARMAssembler::adcs):
+        (JSC::ARMAssembler::sbc):
+        (JSC::ARMAssembler::sbcs):
+        (JSC::ARMAssembler::rsc):
+        (JSC::ARMAssembler::rscs):
+        (JSC::ARMAssembler::tst):
+        (JSC::ARMAssembler::teq):
+        (JSC::ARMAssembler::cmp):
+        (JSC::ARMAssembler::cmn):
+        (JSC::ARMAssembler::orr):
+        (JSC::ARMAssembler::orrs):
+        (JSC::ARMAssembler::mov):
+        (JSC::ARMAssembler::movw):
+        (JSC::ARMAssembler::movt):
+        (JSC::ARMAssembler::movs):
+        (JSC::ARMAssembler::bic):
+        (JSC::ARMAssembler::bics):
+        (JSC::ARMAssembler::mvn):
+        (JSC::ARMAssembler::mvns):
+        (JSC::ARMAssembler::mul):
+        (JSC::ARMAssembler::muls):
+        (JSC::ARMAssembler::mull):
+        (JSC::ARMAssembler::vmov_f64):
+        (JSC::ARMAssembler::vadd_f64):
+        (JSC::ARMAssembler::vdiv_f64):
+        (JSC::ARMAssembler::vsub_f64):
+        (JSC::ARMAssembler::vmul_f64):
+        (JSC::ARMAssembler::vcmp_f64):
+        (JSC::ARMAssembler::vsqrt_f64):
+        (JSC::ARMAssembler::vabs_f64):
+        (JSC::ARMAssembler::vneg_f64):
+        (JSC::ARMAssembler::ldrImmediate):
+        (JSC::ARMAssembler::ldrUniqueImmediate):
+        (JSC::ARMAssembler::dtrUp):
+        (JSC::ARMAssembler::dtrUpRegister):
+        (JSC::ARMAssembler::dtrDown):
+        (JSC::ARMAssembler::dtrDownRegister):
+        (JSC::ARMAssembler::halfDtrUp):
+        (JSC::ARMAssembler::halfDtrUpRegister):
+        (JSC::ARMAssembler::halfDtrDown):
+        (JSC::ARMAssembler::halfDtrDownRegister):
+        (JSC::ARMAssembler::doubleDtrUp):
+        (JSC::ARMAssembler::doubleDtrDown):
+        (JSC::ARMAssembler::push):
+        (JSC::ARMAssembler::pop):
+        (JSC::ARMAssembler::poke):
+        (JSC::ARMAssembler::peek):
+        (JSC::ARMAssembler::vmov_vfp64):
+        (JSC::ARMAssembler::vmov_arm64):
+        (JSC::ARMAssembler::vmov_vfp32):
+        (JSC::ARMAssembler::vmov_arm32):
+        (JSC::ARMAssembler::vcvt_f64_s32):
+        (JSC::ARMAssembler::vcvt_s32_f64):
+        (JSC::ARMAssembler::vcvt_u32_f64):
+        (JSC::ARMAssembler::vcvt_f64_f32):
+        (JSC::ARMAssembler::vcvt_f32_f64):
+        (JSC::ARMAssembler::clz):
+        (JSC::ARMAssembler::lslRegister):
+        (JSC::ARMAssembler::lsrRegister):
+        (JSC::ARMAssembler::asrRegister):
+        (JSC::ARMAssembler::align):
+        (JSC::ARMAssembler::loadBranchTarget):
+        (JSC::ARMAssembler::vmov):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::mul32):
+        (JSC::MacroAssemblerARM::or32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::urshift32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::countLeadingZeros32):
+        (JSC::MacroAssemblerARM::convertibleLoadPtr):
+        (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::pop):
+        (JSC::MacroAssemblerARM::push):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::swap):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::mull32):
+        (JSC::MacroAssemblerARM::branchSub32):
+        (JSC::MacroAssemblerARM::compare32):
+        (JSC::MacroAssemblerARM::test32):
+        (JSC::MacroAssemblerARM::load32):
+        (JSC::MacroAssemblerARM::relativeTableJump):
+        (JSC::MacroAssemblerARM::moveWithPatch):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::moveDouble):
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::sqrtDouble):
+        (JSC::MacroAssemblerARM::absDouble):
+        (JSC::MacroAssemblerARM::negateDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::convertFloatToDouble):
+        (JSC::MacroAssemblerARM::convertDoubleToFloat):
+        (JSC::MacroAssemblerARM::branchDouble):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
+        (JSC::MacroAssemblerARM::truncateDoubleToInt32):
+        (JSC::MacroAssemblerARM::truncateDoubleToUint32):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerARM::branchDoubleNonZero):
+        (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
+
+2012-08-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed, rolling out r125444.
+        http://trac.webkit.org/changeset/125444
+        https://bugs.webkit.org/show_bug.cgi?id=93872
+
+        Broke some tests
+
+        * Target.pri:
+
+2012-08-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap
+        https://bugs.webkit.org/show_bug.cgi?id=93872
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Target.pri: Add missing JSWeakObjectMap file to build.
+
+2012-08-13  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [CMake] Remove glib-related Find modules and write single new one instead.
+        https://bugs.webkit.org/show_bug.cgi?id=93786
+
+        Reviewed by Rob Buis.
+
+        * shell/PlatformEfl.cmake: Use GLIB_* instead of Glib_*.
+
+2012-08-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Doesn't build with ENABLE_JIT=0
+        https://bugs.webkit.org/show_bug.cgi?id=85042
+
+        Reviewed by Eric Seidel.
+
+        Include headers without which CallFrame.h does not build, and
+        fix gcc warning about comparing unsigned int with 0.
+
+        * dfg/DFGDriver.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::isOpcode):
+
+2012-08-10  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] GCActivityCallback should always schedule GC even allocated bytes is a small number
+        https://bugs.webkit.org/show_bug.cgi?id=93650
+
+        Reviewed by Rob Buis.
+
+        Even a small number of allocated JS objects could hold expensive resources.
+
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC::DefaultGCActivityCallback::didAllocate):
+
+2012-08-09  Yong Li  <yoli@rim.com>
+
+        [QNX] Implement getCPUTime() for OS(QNX)
+        https://bugs.webkit.org/show_bug.cgi?id=93516
+
+        Reviewed by George Staikos.
+
+        Implement getCPUTime() with CLOCK_THREAD_CPUTIME_ID so it will tell
+        exactly how long the current thread has spent without being impacted
+        by other things.
+
+        * runtime/TimeoutChecker.cpp:
+        (JSC::getCPUTime):
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Use char* instead of LChar* for the public interface of String construction from literals
+        https://bugs.webkit.org/show_bug.cgi?id=93402
+
+        Reviewed by Michael Saboff.
+
+        Update JSC' Identifier to use StringImpl::createFromLiteral with a char*.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierASCIIStringTranslator::translate):
+
+2012-08-08  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove ce_time.(cpp|h) from list of source files
+        https://bugs.webkit.org/show_bug.cgi?id=93446
+
+        Reviewed by Simon Hausmann.
+
+        r125004 removed the last dependency on functions defined in ce_time.cpp.
+
+        * Target.pri:
+
+2012-08-08  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Use GetTimeZoneInformation() for getting the timezone name
+        https://bugs.webkit.org/show_bug.cgi?id=91936
+
+        Reviewed by Ryosuke Niwa.
+
+        The MS CRT implementation of strftime calls the same functions in the background.
+        Using them directly avoids the overhead of parsing the format string and removes
+        the dependency on strftime() for WinCE where this function does not exist.
+
+        * runtime/DateConversion.cpp:
+        (JSC::formatTime):
+
+2012-08-07  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Refactor magic numbers in the ARM port of DFG-JIT
+        https://bugs.webkit.org/show_bug.cgi?id=93348
+
+        Reviewed by Eric Seidel.
+
+        Introduce new names for hard-coded magic numbers.
+        Refactor constant with confusing names to more descriptive ones.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::patchConstantPoolLoad):
+        (JSC::ARMAssembler::getOp2):
+        (JSC::ARMAssembler::genInt):
+        (JSC::ARMAssembler::getImm):
+        (JSC::ARMAssembler::moveImm):
+        (JSC::ARMAssembler::encodeComplexImm):
+        (JSC::ARMAssembler::dataTransfer32):
+        (JSC::ARMAssembler::dataTransfer16):
+        (JSC::ARMAssembler::dataTransferFloat):
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::emitInstruction):
+        (JSC::ARMAssembler::ands_r):
+        (JSC::ARMAssembler::eors_r):
+        (JSC::ARMAssembler::subs_r):
+        (JSC::ARMAssembler::rsbs_r):
+        (JSC::ARMAssembler::adds_r):
+        (JSC::ARMAssembler::adcs_r):
+        (JSC::ARMAssembler::sbcs_r):
+        (JSC::ARMAssembler::rscs_r):
+        (JSC::ARMAssembler::tst_r):
+        (JSC::ARMAssembler::teq_r):
+        (JSC::ARMAssembler::cmp_r):
+        (JSC::ARMAssembler::cmn_r):
+        (JSC::ARMAssembler::orrs_r):
+        (JSC::ARMAssembler::movs_r):
+        (JSC::ARMAssembler::bics_r):
+        (JSC::ARMAssembler::mvns_r):
+        (JSC::ARMAssembler::muls_r):
+        (JSC::ARMAssembler::ldr_imm):
+        (JSC::ARMAssembler::ldr_un_imm):
+        (JSC::ARMAssembler::dtr_u):
+        (JSC::ARMAssembler::dtr_ur):
+        (JSC::ARMAssembler::dtr_dr):
+        (JSC::ARMAssembler::dtrh_u):
+        (JSC::ARMAssembler::dtrh_ur):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::push_r):
+        (JSC::ARMAssembler::pop_r):
+        (JSC::ARMAssembler::getLdrImmAddress):
+        (JSC::ARMAssembler::getLdrImmAddressOnPool):
+        (JSC::ARMAssembler::patchConstantPoolLoad):
+        (JSC::ARMAssembler::repatchCompact):
+        (JSC::ARMAssembler::replaceWithJump):
+        (JSC::ARMAssembler::replaceWithLoad):
+        (JSC::ARMAssembler::replaceWithAddressComputation):
+        (JSC::ARMAssembler::getOp2Byte):
+        (JSC::ARMAssembler::getOp2Half):
+        (JSC::ARMAssembler::getImm16Op2):
+        (JSC::ARMAssembler::placeConstantPoolBarrier):
+        (JSC::ARMAssembler::getConditionalField):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::branch32):
+        (JSC::MacroAssemblerARM::branchTest32):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+
+2012-08-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        Use the initialization from literal for JSC's Identifiers
+        https://bugs.webkit.org/show_bug.cgi?id=93193
+
+        Reviewed by Geoffrey Garen.
+
+        This patches modify Identifier ot take advantage of the new initialization from literal.
+
+        In addition to the memory savings (~600bytes per instance), this gives us a 2% speed
+        improvement on CommonIdentifiers on average.
+
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        Null and empty strings are forbidden for literal initialization. Use the most efficient constructors
+        instead of a literal.
+
+        * runtime/Identifier.cpp:
+        (IdentifierASCIIStringTranslator):
+        Rename IdentifierCStringTranslator to IdentifierASCIIStringTranslator to make the text encoding
+        explicit.
+        (JSC::IdentifierASCIIStringTranslator::hash):
+        (JSC::IdentifierASCIIStringTranslator::equal):
+        (JSC::IdentifierASCIIStringTranslator::translate): Use the fast initialization from literal.
+        (JSC::Identifier::add):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+
+2012-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt][Win] Remove pthreads linkage
+
+        Reviewed by Csaba Osztrogonác.
+
+        After r124823 linkage to pthreads is not needed anymore for the Windows
+        build.
+
+        * JavaScriptCore.pri:
+
+2012-08-07  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Refactor emit*Inst functions and introduce toARMWord functions in DFG-JIT's traditional ARM port
+        https://bugs.webkit.org/show_bug.cgi?id=93266
+
+        Reviewed by Csaba Osztrogonác.
+
+        First part of a bigger refactoring issue trying to make traditional
+        ARM DFG-JIT port easier to read and understand.
+
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::emitInstruction):
+        (JSC::ARMAssembler::emitDoublePrecisionInstruction):
+        (JSC::ARMAssembler::emitSinglePrecisionInstruction):
+        (JSC::ARMAssembler::and_r):
+        (JSC::ARMAssembler::ands_r):
+        (JSC::ARMAssembler::eor_r):
+        (JSC::ARMAssembler::eors_r):
+        (JSC::ARMAssembler::sub_r):
+        (JSC::ARMAssembler::subs_r):
+        (JSC::ARMAssembler::rsb_r):
+        (JSC::ARMAssembler::rsbs_r):
+        (JSC::ARMAssembler::add_r):
+        (JSC::ARMAssembler::adds_r):
+        (JSC::ARMAssembler::adc_r):
+        (JSC::ARMAssembler::adcs_r):
+        (JSC::ARMAssembler::sbc_r):
+        (JSC::ARMAssembler::sbcs_r):
+        (JSC::ARMAssembler::rsc_r):
+        (JSC::ARMAssembler::rscs_r):
+        (JSC::ARMAssembler::tst_r):
+        (JSC::ARMAssembler::teq_r):
+        (JSC::ARMAssembler::cmp_r):
+        (JSC::ARMAssembler::cmn_r):
+        (JSC::ARMAssembler::orr_r):
+        (JSC::ARMAssembler::orrs_r):
+        (JSC::ARMAssembler::mov_r):
+        (JSC::ARMAssembler::movw_r):
+        (JSC::ARMAssembler::movt_r):
+        (JSC::ARMAssembler::movs_r):
+        (JSC::ARMAssembler::bic_r):
+        (JSC::ARMAssembler::bics_r):
+        (JSC::ARMAssembler::mvn_r):
+        (JSC::ARMAssembler::mvns_r):
+        (JSC::ARMAssembler::mul_r):
+        (JSC::ARMAssembler::muls_r):
+        (JSC::ARMAssembler::mull_r):
+        (JSC::ARMAssembler::vmov_f64_r):
+        (JSC::ARMAssembler::vadd_f64_r):
+        (JSC::ARMAssembler::vdiv_f64_r):
+        (JSC::ARMAssembler::vsub_f64_r):
+        (JSC::ARMAssembler::vmul_f64_r):
+        (JSC::ARMAssembler::vcmp_f64_r):
+        (JSC::ARMAssembler::vsqrt_f64_r):
+        (JSC::ARMAssembler::vabs_f64_r):
+        (JSC::ARMAssembler::vneg_f64_r):
+        (JSC::ARMAssembler::ldr_imm):
+        (JSC::ARMAssembler::ldr_un_imm):
+        (JSC::ARMAssembler::dtr_u):
+        (JSC::ARMAssembler::dtr_ur):
+        (JSC::ARMAssembler::dtr_d):
+        (JSC::ARMAssembler::dtr_dr):
+        (JSC::ARMAssembler::dtrh_u):
+        (JSC::ARMAssembler::dtrh_ur):
+        (JSC::ARMAssembler::dtrh_d):
+        (JSC::ARMAssembler::dtrh_dr):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::fdtr_d):
+        (JSC::ARMAssembler::push_r):
+        (JSC::ARMAssembler::pop_r):
+        (JSC::ARMAssembler::vmov_vfp64_r):
+        (JSC::ARMAssembler::vmov_arm64_r):
+        (JSC::ARMAssembler::vmov_vfp32_r):
+        (JSC::ARMAssembler::vmov_arm32_r):
+        (JSC::ARMAssembler::vcvt_f64_s32_r):
+        (JSC::ARMAssembler::vcvt_s32_f64_r):
+        (JSC::ARMAssembler::vcvt_u32_f64_r):
+        (JSC::ARMAssembler::vcvt_f64_f32_r):
+        (JSC::ARMAssembler::vcvt_f32_f64_r):
+        (JSC::ARMAssembler::vmrs_apsr):
+        (JSC::ARMAssembler::clz_r):
+        (JSC::ARMAssembler::bx):
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::linkJump):
+        (JSC::ARMAssembler::toARMWord):
+        (ARMAssembler):
+
+2012-08-06  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Remove dependency on pthread from MachineStackMarker
+        https://bugs.webkit.org/show_bug.cgi?id=68429
+
+        Reviewed by Geoffrey Garen.
+
+        Windows has no support for calling a destructor for thread specific data.
+        Since we need more control over creating and deleting thread specific keys
+        we can not simply extend WTF::ThreadSpecific with this functionality.
+
+        All thread specific keys created via the new API get stored in a list.
+        After a thread function finished we iterate over this list and call
+        the registered destructor for every item if needed.
+
+        * heap/MachineStackMarker.cpp:  Use the new functions instead of pthread directly.
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::makeUsableFromMultipleThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        * heap/MachineStackMarker.h:
+        (MachineThreads):
+
+2012-08-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Unify JSC date and time formating functions
+        https://bugs.webkit.org/show_bug.cgi?id=92282
+
+        Reviewed by Geoffrey Garen.
+
+        Replace the existing functions for formating GregorianDateTime
+        with one single function. This removes some code duplications
+        in DatePrototype and is a preperation to fix encoding issues,
+        since we can add UChar* values to the resulting string now.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/DateConversion.cpp:
+        (JSC::formatDateTime):
+        * runtime/DateConversion.h:
+        (JSC):
+        * runtime/DatePrototype.cpp:
+        (JSC::formateDateInstance):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToGMTString):
+
+2012-08-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-08-05  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement setting breakpoints by line:column
+        https://bugs.webkit.org/show_bug.cgi?id=53003
+
+        Reviewed by Geoffrey Garen.
+
+        Add a counter to Lexer to record the column info of each Token. Add a column parameter to
+        op_debug, cti_op_debug, and _llint_op_debug byte-code command.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::Lexer::currentColumnNumber):
+        (JSC::::lexExpectIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        (JSC::ExpressionNode::ExpressionNode):
+        (JSC::StatementNode::StatementNode):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::RegExpNode::RegExpNode):
+        (JSC::ThisNode::ThisNode):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::ArrayNode::ArrayNode):
+        (JSC::PropertyListNode::PropertyListNode):
+        (JSC::ObjectLiteralNode::ObjectLiteralNode):
+        (JSC::BracketAccessorNode::BracketAccessorNode):
+        (JSC::DotAccessorNode::DotAccessorNode):
+        (JSC::ArgumentListNode::ArgumentListNode):
+        (JSC::NewExprNode::NewExprNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PrePostResolveNode::PrePostResolveNode):
+        (JSC::PostfixResolveNode::PostfixResolveNode):
+        (JSC::PostfixBracketNode::PostfixBracketNode):
+        (JSC::PostfixDotNode::PostfixDotNode):
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::DeleteValueNode::DeleteValueNode):
+        (JSC::VoidNode::VoidNode):
+        (JSC::TypeOfResolveNode::TypeOfResolveNode):
+        (JSC::TypeOfValueNode::TypeOfValueNode):
+        (JSC::PrefixResolveNode::PrefixResolveNode):
+        (JSC::PrefixBracketNode::PrefixBracketNode):
+        (JSC::PrefixDotNode::PrefixDotNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::UnaryOpNode::UnaryOpNode):
+        (JSC::UnaryPlusNode::UnaryPlusNode):
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::LogicalNotNode::LogicalNotNode):
+        (JSC::BinaryOpNode::BinaryOpNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::AddNode::AddNode):
+        (JSC::SubNode::SubNode):
+        (JSC::LeftShiftNode::LeftShiftNode):
+        (JSC::RightShiftNode::RightShiftNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        (JSC::LessNode::LessNode):
+        (JSC::GreaterNode::GreaterNode):
+        (JSC::LessEqNode::LessEqNode):
+        (JSC::GreaterEqNode::GreaterEqNode):
+        (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
+        (JSC::InstanceOfNode::InstanceOfNode):
+        (JSC::InNode::InNode):
+        (JSC::EqualNode::EqualNode):
+        (JSC::NotEqualNode::NotEqualNode):
+        (JSC::StrictEqualNode::StrictEqualNode):
+        (JSC::NotStrictEqualNode::NotStrictEqualNode):
+        (JSC::BitAndNode::BitAndNode):
+        (JSC::BitOrNode::BitOrNode):
+        (JSC::BitXOrNode::BitXOrNode):
+        (JSC::LogicalOpNode::LogicalOpNode):
+        (JSC::ConditionalNode::ConditionalNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::CommaNode::CommaNode):
+        (JSC::ConstStatementNode::ConstStatementNode):
+        (JSC::EmptyStatementNode::EmptyStatementNode):
+        (JSC::DebuggerStatementNode::DebuggerStatementNode):
+        (JSC::ExprStatementNode::ExprStatementNode):
+        (JSC::VarStatementNode::VarStatementNode):
+        (JSC::IfNode::IfNode):
+        (JSC::IfElseNode::IfElseNode):
+        (JSC::DoWhileNode::DoWhileNode):
+        (JSC::WhileNode::WhileNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ReturnNode::ReturnNode):
+        (JSC::WithNode::WithNode):
+        (JSC::LabelNode::LabelNode):
+        (JSC::ThrowNode::ThrowNode):
+        (JSC::TryNode::TryNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::ConstDeclNode::ConstDeclNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC::StatementNode::setLoc):
+        (JSC):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (Node):
+        (JSC::Node::columnNo):
+        (ExpressionNode):
+        (StatementNode):
+        (JSC::StatementNode::column):
+        (NullNode):
+        (BooleanNode):
+        (NumberNode):
+        (StringNode):
+        (RegExpNode):
+        (ThisNode):
+        (ResolveNode):
+        (ArrayNode):
+        (PropertyListNode):
+        (ObjectLiteralNode):
+        (BracketAccessorNode):
+        (DotAccessorNode):
+        (ArgumentListNode):
+        (NewExprNode):
+        (EvalFunctionCallNode):
+        (FunctionCallValueNode):
+        (FunctionCallResolveNode):
+        (FunctionCallBracketNode):
+        (FunctionCallDotNode):
+        (CallFunctionCallDotNode):
+        (ApplyFunctionCallDotNode):
+        (PrePostResolveNode):
+        (PostfixResolveNode):
+        (PostfixBracketNode):
+        (PostfixDotNode):
+        (PostfixErrorNode):
+        (DeleteResolveNode):
+        (DeleteBracketNode):
+        (DeleteDotNode):
+        (DeleteValueNode):
+        (VoidNode):
+        (TypeOfResolveNode):
+        (TypeOfValueNode):
+        (PrefixResolveNode):
+        (PrefixBracketNode):
+        (PrefixDotNode):
+        (PrefixErrorNode):
+        (UnaryOpNode):
+        (UnaryPlusNode):
+        (NegateNode):
+        (BitwiseNotNode):
+        (LogicalNotNode):
+        (BinaryOpNode):
+        (MultNode):
+        (DivNode):
+        (ModNode):
+        (AddNode):
+        (SubNode):
+        (LeftShiftNode):
+        (RightShiftNode):
+        (UnsignedRightShiftNode):
+        (LessNode):
+        (GreaterNode):
+        (LessEqNode):
+        (GreaterEqNode):
+        (ThrowableBinaryOpNode):
+        (InstanceOfNode):
+        (InNode):
+        (EqualNode):
+        (NotEqualNode):
+        (StrictEqualNode):
+        (NotStrictEqualNode):
+        (BitAndNode):
+        (BitOrNode):
+        (BitXOrNode):
+        (LogicalOpNode):
+        (ConditionalNode):
+        (ReadModifyResolveNode):
+        (AssignResolveNode):
+        (ReadModifyBracketNode):
+        (AssignBracketNode):
+        (AssignDotNode):
+        (ReadModifyDotNode):
+        (AssignErrorNode):
+        (CommaNode):
+        (ConstDeclNode):
+        (ConstStatementNode):
+        (BlockNode):
+        (EmptyStatementNode):
+        (DebuggerStatementNode):
+        (ExprStatementNode):
+        (VarStatementNode):
+        (IfNode):
+        (IfElseNode):
+        (DoWhileNode):
+        (WhileNode):
+        (ForNode):
+        (ForInNode):
+        (ContinueNode):
+        (BreakNode):
+        (ReturnNode):
+        (WithNode):
+        (LabelNode):
+        (ThrowNode):
+        (TryNode):
+        (ScopeNode):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        (FuncExprNode):
+        (FuncDeclNode):
+        (SwitchNode):
+        * parser/Parser.cpp:
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseDoWhileStatement):
+        (JSC::::parseWhileStatement):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseDebuggerStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseIfStatement):
+        (JSC::::parseExpression):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseConditionalExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::tokenLine):
+        (JSC::Parser::tokenEnd):
+        (JSC::Parser::tokenLocation):
+        (Parser):
+        (JSC::Parser::getTokenName):
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenLocation::JSTokenLocation):
+        (JSTokenLocation):
+        (JSToken):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2012-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
+        https://bugs.webkit.org/show_bug.cgi?id=92691
+
+        Reviewed by Mark Hahnenberg.
+
+        The state of the stubs was changing after we determined the type (by virtue of the slow path
+        function that was called), since the get or put (in this case put) could cause arbitrary
+        side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
+        function to determine what to do, but an easier fix for now is to have the slow path give up
+        if its assumptions were invalidated by a side effect.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2012-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction
+        https://bugs.webkit.org/show_bug.cgi?id=93162
+
+        Reviewed by Mark Hahnenberg.
+
+        This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded
+        by a ForceOSRExit if the value profile had no data.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2012-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::StructureCheckHoistingPhase keeps a Node& around for too long
+        https://bugs.webkit.org/show_bug.cgi?id=93157
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Move getLocalTime() as static inline function to DateMath
+        https://bugs.webkit.org/show_bug.cgi?id=92955
+
+        Reviewed by Ryosuke Niwa.
+
+        getCurrentLocalTime() and getLocalTime() has been superseded with the
+        GregorianDateTime class. So we can move it into DateMath.cpp as an static inline
+        function. This allows us to remove the dependecy on time() and localtime()
+        for Windows CE, where this functions require the ce_time library to work.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes
+        https://bugs.webkit.org/show_bug.cgi?id=91074
+
+        Reviewed by Mark Hahnenberg.
+
+        Fixes a bug where the speculative JIT was performing an unnecessary speculation that the
+        CFA had proven shouldn't be performed, leading to asserts that a node should not have
+        exit sites. This is a debug-only assert with no release symptom - we were just emitting
+        a check that was not reachable.
+        
+        Also found, and fixed, a bug where structure check hoisting was slightly confusing the
+        CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which
+        would make the backend happy - but the CFA would produce subtly wrong results.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isOtherOrEmptySpeculation):
+        (JSC):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2012-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove all uses of ClassInfo for JSStrings in JIT code
+        https://bugs.webkit.org/show_bug.cgi?id=92935
+
+        Reviewed by Geoffrey Garen.
+
+        This is the first step in removing our dependence on in-object ClassInfo pointers
+        in JIT code. Most of the changes are to check the Structure, which is unique for 
+        JSString primitives.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromClassInfo):
+        (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure
+        since there wasn't a JSGlobalData immediately available to grab the JSString 
+        Structure out of.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitLoadCharacterString):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_convert_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_convert_this):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        * jit/ThunkGenerators.cpp:
+        (JSC::stringCharLoad):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+
+2012-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex"
+        in a method signature is painfully redundant.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2012-08-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGSpeculativeJIT.h has too many inline method bodies
+        https://bugs.webkit.org/show_bug.cgi?id=92957
+
+        Reviewed by Antti Koivisto.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124406.
+        http://trac.webkit.org/changeset/124406
+        https://bugs.webkit.org/show_bug.cgi?id=92951
+
+        it set the Mac bots on fire (Requested by pizlo on #webkit).
+
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::::lexExpectIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        (JSC::ExpressionNode::ExpressionNode):
+        (JSC::StatementNode::StatementNode):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::RegExpNode::RegExpNode):
+        (JSC::ThisNode::ThisNode):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::ArrayNode::ArrayNode):
+        (JSC::PropertyListNode::PropertyListNode):
+        (JSC::ObjectLiteralNode::ObjectLiteralNode):
+        (JSC::BracketAccessorNode::BracketAccessorNode):
+        (JSC::DotAccessorNode::DotAccessorNode):
+        (JSC::ArgumentListNode::ArgumentListNode):
+        (JSC::NewExprNode::NewExprNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PrePostResolveNode::PrePostResolveNode):
+        (JSC::PostfixResolveNode::PostfixResolveNode):
+        (JSC::PostfixBracketNode::PostfixBracketNode):
+        (JSC::PostfixDotNode::PostfixDotNode):
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::DeleteValueNode::DeleteValueNode):
+        (JSC::VoidNode::VoidNode):
+        (JSC::TypeOfResolveNode::TypeOfResolveNode):
+        (JSC::TypeOfValueNode::TypeOfValueNode):
+        (JSC::PrefixResolveNode::PrefixResolveNode):
+        (JSC::PrefixBracketNode::PrefixBracketNode):
+        (JSC::PrefixDotNode::PrefixDotNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::UnaryOpNode::UnaryOpNode):
+        (JSC::UnaryPlusNode::UnaryPlusNode):
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::LogicalNotNode::LogicalNotNode):
+        (JSC::BinaryOpNode::BinaryOpNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::AddNode::AddNode):
+        (JSC::SubNode::SubNode):
+        (JSC::LeftShiftNode::LeftShiftNode):
+        (JSC::RightShiftNode::RightShiftNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        (JSC::LessNode::LessNode):
+        (JSC::GreaterNode::GreaterNode):
+        (JSC::LessEqNode::LessEqNode):
+        (JSC::GreaterEqNode::GreaterEqNode):
+        (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
+        (JSC::InstanceOfNode::InstanceOfNode):
+        (JSC::InNode::InNode):
+        (JSC::EqualNode::EqualNode):
+        (JSC::NotEqualNode::NotEqualNode):
+        (JSC::StrictEqualNode::StrictEqualNode):
+        (JSC::NotStrictEqualNode::NotStrictEqualNode):
+        (JSC::BitAndNode::BitAndNode):
+        (JSC::BitOrNode::BitOrNode):
+        (JSC::BitXOrNode::BitXOrNode):
+        (JSC::LogicalOpNode::LogicalOpNode):
+        (JSC::ConditionalNode::ConditionalNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::CommaNode::CommaNode):
+        (JSC::ConstStatementNode::ConstStatementNode):
+        (JSC::EmptyStatementNode::EmptyStatementNode):
+        (JSC::DebuggerStatementNode::DebuggerStatementNode):
+        (JSC::ExprStatementNode::ExprStatementNode):
+        (JSC::VarStatementNode::VarStatementNode):
+        (JSC::IfNode::IfNode):
+        (JSC::IfElseNode::IfElseNode):
+        (JSC::DoWhileNode::DoWhileNode):
+        (JSC::WhileNode::WhileNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ReturnNode::ReturnNode):
+        (JSC::WithNode::WithNode):
+        (JSC::LabelNode::LabelNode):
+        (JSC::ThrowNode::ThrowNode):
+        (JSC::TryNode::TryNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::ConstDeclNode::ConstDeclNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC):
+        (JSC::StatementNode::setLoc):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (Node):
+        (ExpressionNode):
+        (StatementNode):
+        (NullNode):
+        (BooleanNode):
+        (NumberNode):
+        (StringNode):
+        (RegExpNode):
+        (ThisNode):
+        (ResolveNode):
+        (ArrayNode):
+        (PropertyListNode):
+        (ObjectLiteralNode):
+        (BracketAccessorNode):
+        (DotAccessorNode):
+        (ArgumentListNode):
+        (NewExprNode):
+        (EvalFunctionCallNode):
+        (FunctionCallValueNode):
+        (FunctionCallResolveNode):
+        (FunctionCallBracketNode):
+        (FunctionCallDotNode):
+        (CallFunctionCallDotNode):
+        (ApplyFunctionCallDotNode):
+        (PrePostResolveNode):
+        (PostfixResolveNode):
+        (PostfixBracketNode):
+        (PostfixDotNode):
+        (PostfixErrorNode):
+        (DeleteResolveNode):
+        (DeleteBracketNode):
+        (DeleteDotNode):
+        (DeleteValueNode):
+        (VoidNode):
+        (TypeOfResolveNode):
+        (TypeOfValueNode):
+        (PrefixResolveNode):
+        (PrefixBracketNode):
+        (PrefixDotNode):
+        (PrefixErrorNode):
+        (UnaryOpNode):
+        (UnaryPlusNode):
+        (NegateNode):
+        (BitwiseNotNode):
+        (LogicalNotNode):
+        (BinaryOpNode):
+        (MultNode):
+        (DivNode):
+        (ModNode):
+        (AddNode):
+        (SubNode):
+        (LeftShiftNode):
+        (RightShiftNode):
+        (UnsignedRightShiftNode):
+        (LessNode):
+        (GreaterNode):
+        (LessEqNode):
+        (GreaterEqNode):
+        (ThrowableBinaryOpNode):
+        (InstanceOfNode):
+        (InNode):
+        (EqualNode):
+        (NotEqualNode):
+        (StrictEqualNode):
+        (NotStrictEqualNode):
+        (BitAndNode):
+        (BitOrNode):
+        (BitXOrNode):
+        (LogicalOpNode):
+        (ConditionalNode):
+        (ReadModifyResolveNode):
+        (AssignResolveNode):
+        (ReadModifyBracketNode):
+        (AssignBracketNode):
+        (AssignDotNode):
+        (ReadModifyDotNode):
+        (AssignErrorNode):
+        (CommaNode):
+        (ConstDeclNode):
+        (ConstStatementNode):
+        (BlockNode):
+        (EmptyStatementNode):
+        (DebuggerStatementNode):
+        (ExprStatementNode):
+        (VarStatementNode):
+        (IfNode):
+        (IfElseNode):
+        (DoWhileNode):
+        (WhileNode):
+        (ForNode):
+        (ForInNode):
+        (ContinueNode):
+        (BreakNode):
+        (ReturnNode):
+        (WithNode):
+        (LabelNode):
+        (ThrowNode):
+        (TryNode):
+        (ScopeNode):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        (FuncExprNode):
+        (FuncDeclNode):
+        (SwitchNode):
+        * parser/Parser.cpp:
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseDoWhileStatement):
+        (JSC::::parseWhileStatement):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseDebuggerStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseIfStatement):
+        (JSC::::parseExpression):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseConditionalExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::tokenLine):
+        (JSC::Parser::tokenEnd):
+        (JSC::Parser::getTokenName):
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenInfo::JSTokenInfo):
+        (JSTokenInfo):
+        (JSToken):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2012-08-01  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement setting breakpoints by line:column
+        https://bugs.webkit.org/show_bug.cgi?id=53003
+
+        Reviewed by Geoffrey Garen.
+
+        Add a counter in lexer to record the column of each token. Debugger will use column info
+        in "Pretty Print" debug mode of Inspector.
+
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::appendBinaryOperation):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::Lexer::currentColumnNumber):
+        (JSC::::lexExpectIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        (JSC::ExpressionNode::ExpressionNode):
+        (JSC::StatementNode::StatementNode):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::RegExpNode::RegExpNode):
+        (JSC::ThisNode::ThisNode):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::ArrayNode::ArrayNode):
+        (JSC::PropertyListNode::PropertyListNode):
+        (JSC::ObjectLiteralNode::ObjectLiteralNode):
+        (JSC::BracketAccessorNode::BracketAccessorNode):
+        (JSC::DotAccessorNode::DotAccessorNode):
+        (JSC::ArgumentListNode::ArgumentListNode):
+        (JSC::NewExprNode::NewExprNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PrePostResolveNode::PrePostResolveNode):
+        (JSC::PostfixResolveNode::PostfixResolveNode):
+        (JSC::PostfixBracketNode::PostfixBracketNode):
+        (JSC::PostfixDotNode::PostfixDotNode):
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::DeleteValueNode::DeleteValueNode):
+        (JSC::VoidNode::VoidNode):
+        (JSC::TypeOfResolveNode::TypeOfResolveNode):
+        (JSC::TypeOfValueNode::TypeOfValueNode):
+        (JSC::PrefixResolveNode::PrefixResolveNode):
+        (JSC::PrefixBracketNode::PrefixBracketNode):
+        (JSC::PrefixDotNode::PrefixDotNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::UnaryOpNode::UnaryOpNode):
+        (JSC::UnaryPlusNode::UnaryPlusNode):
+        (JSC::NegateNode::NegateNode):
+        (JSC::BitwiseNotNode::BitwiseNotNode):
+        (JSC::LogicalNotNode::LogicalNotNode):
+        (JSC::BinaryOpNode::BinaryOpNode):
+        (JSC::MultNode::MultNode):
+        (JSC::DivNode::DivNode):
+        (JSC::ModNode::ModNode):
+        (JSC::AddNode::AddNode):
+        (JSC::SubNode::SubNode):
+        (JSC::LeftShiftNode::LeftShiftNode):
+        (JSC::RightShiftNode::RightShiftNode):
+        (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode):
+        (JSC::LessNode::LessNode):
+        (JSC::GreaterNode::GreaterNode):
+        (JSC::LessEqNode::LessEqNode):
+        (JSC::GreaterEqNode::GreaterEqNode):
+        (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode):
+        (JSC::InstanceOfNode::InstanceOfNode):
+        (JSC::InNode::InNode):
+        (JSC::EqualNode::EqualNode):
+        (JSC::NotEqualNode::NotEqualNode):
+        (JSC::StrictEqualNode::StrictEqualNode):
+        (JSC::NotStrictEqualNode::NotStrictEqualNode):
+        (JSC::BitAndNode::BitAndNode):
+        (JSC::BitOrNode::BitOrNode):
+        (JSC::BitXOrNode::BitXOrNode):
+        (JSC::LogicalOpNode::LogicalOpNode):
+        (JSC::ConditionalNode::ConditionalNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::CommaNode::CommaNode):
+        (JSC::ConstStatementNode::ConstStatementNode):
+        (JSC::EmptyStatementNode::EmptyStatementNode):
+        (JSC::DebuggerStatementNode::DebuggerStatementNode):
+        (JSC::ExprStatementNode::ExprStatementNode):
+        (JSC::VarStatementNode::VarStatementNode):
+        (JSC::IfNode::IfNode):
+        (JSC::IfElseNode::IfElseNode):
+        (JSC::DoWhileNode::DoWhileNode):
+        (JSC::WhileNode::WhileNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ReturnNode::ReturnNode):
+        (JSC::WithNode::WithNode):
+        (JSC::LabelNode::LabelNode):
+        (JSC::ThrowNode::ThrowNode):
+        (JSC::TryNode::TryNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::ConstDeclNode::ConstDeclNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC::StatementNode::setLoc):
+        (JSC):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (Node):
+        (JSC::Node::columnNo):
+        (ExpressionNode):
+        (StatementNode):
+        (JSC::StatementNode::column):
+        (NullNode):
+        (BooleanNode):
+        (NumberNode):
+        (StringNode):
+        (RegExpNode):
+        (ThisNode):
+        (ResolveNode):
+        (ArrayNode):
+        (PropertyListNode):
+        (ObjectLiteralNode):
+        (BracketAccessorNode):
+        (DotAccessorNode):
+        (ArgumentListNode):
+        (NewExprNode):
+        (EvalFunctionCallNode):
+        (FunctionCallValueNode):
+        (FunctionCallResolveNode):
+        (FunctionCallBracketNode):
+        (FunctionCallDotNode):
+        (CallFunctionCallDotNode):
+        (ApplyFunctionCallDotNode):
+        (PrePostResolveNode):
+        (PostfixResolveNode):
+        (PostfixBracketNode):
+        (PostfixDotNode):
+        (PostfixErrorNode):
+        (DeleteResolveNode):
+        (DeleteBracketNode):
+        (DeleteDotNode):
+        (DeleteValueNode):
+        (VoidNode):
+        (TypeOfResolveNode):
+        (TypeOfValueNode):
+        (PrefixResolveNode):
+        (PrefixBracketNode):
+        (PrefixDotNode):
+        (PrefixErrorNode):
+        (UnaryOpNode):
+        (UnaryPlusNode):
+        (NegateNode):
+        (BitwiseNotNode):
+        (LogicalNotNode):
+        (BinaryOpNode):
+        (MultNode):
+        (DivNode):
+        (ModNode):
+        (AddNode):
+        (SubNode):
+        (LeftShiftNode):
+        (RightShiftNode):
+        (UnsignedRightShiftNode):
+        (LessNode):
+        (GreaterNode):
+        (LessEqNode):
+        (GreaterEqNode):
+        (ThrowableBinaryOpNode):
+        (InstanceOfNode):
+        (InNode):
+        (EqualNode):
+        (NotEqualNode):
+        (StrictEqualNode):
+        (NotStrictEqualNode):
+        (BitAndNode):
+        (BitOrNode):
+        (BitXOrNode):
+        (LogicalOpNode):
+        (ConditionalNode):
+        (ReadModifyResolveNode):
+        (AssignResolveNode):
+        (ReadModifyBracketNode):
+        (AssignBracketNode):
+        (AssignDotNode):
+        (ReadModifyDotNode):
+        (AssignErrorNode):
+        (CommaNode):
+        (ConstDeclNode):
+        (ConstStatementNode):
+        (BlockNode):
+        (EmptyStatementNode):
+        (DebuggerStatementNode):
+        (ExprStatementNode):
+        (VarStatementNode):
+        (IfNode):
+        (IfElseNode):
+        (DoWhileNode):
+        (WhileNode):
+        (ForNode):
+        (ForInNode):
+        (ContinueNode):
+        (BreakNode):
+        (ReturnNode):
+        (WithNode):
+        (LabelNode):
+        (ThrowNode):
+        (TryNode):
+        (ScopeNode):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        (FuncExprNode):
+        (FuncDeclNode):
+        (SwitchNode):
+        * parser/Parser.cpp:
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseDoWhileStatement):
+        (JSC::::parseWhileStatement):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseDebuggerStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseIfStatement):
+        (JSC::::parseExpression):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseConditionalExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::tokenLine):
+        (JSC::Parser::tokenEnd):
+        (JSC::Parser::tokenLocation):
+        (Parser):
+        (JSC::Parser::getTokenName):
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenLocation::JSTokenLocation):
+        (JSTokenLocation):
+        (JSToken):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2012-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should hoist structure checks
+        https://bugs.webkit.org/show_bug.cgi?id=92696
+
+        Reviewed by Gavin Barraclough.
+
+        This hoists structure checks in the same way that we would hoist array checks, but with added
+        complexity to cope with the fact that the structure of an object may change. This is handled
+        by performing a side effects analysis over the region in which the respective variable is
+        live. If a structure clobbering side effect may happen then we either hoist the structure
+        checks and fall back on structure transition watchpoints (if the watchpoint set is still
+        valid), or we avoid hoisting altogether.
+        
+        Doing this required teaching the CFA that we may have an expectation that an object has a
+        particular structure even after structure clobbering happens, in the sense that structure
+        proofs that were cobbered can be revived using watchpoints. CFA must know about this so that
+        OSR entry may know about it, since we cannot allow entry to happen if the variable has a
+        clobbered structure proof, will have a watchpoint to revive the proof, and the variable in
+        the baseline JIT has a completely unrelated structure.
+        
+        This is mostly performance neutral.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::isSet):
+        (JSC::ValueRecovery::operator!):
+        (ValueRecovery):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberWorld):
+        (DFG):
+        (JSC::DFG::AbstractState::clobberCapturedVars):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::clear):
+        (JSC::DFG::AbstractValue::isClear):
+        (JSC::DFG::AbstractValue::makeTop):
+        (JSC::DFG::AbstractValue::isTop):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::operator==):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::validate):
+        (JSC::DFG::AbstractValue::validateForEntry):
+        (AbstractValue):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::vote):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+        (Node):
+        (JSC::DFG::Node::hasStructureSet):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateCellOperand::gpr):
+        (SpeculateCellOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp: Added.
+        (DFG):
+        (StructureCheckHoistingPhase):
+        (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase):
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        (JSC::DFG::StructureCheckHoistingPhase::clobber):
+        (CheckData):
+        (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
+        (JSC::DFG::performStructureCheckHoisting):
+        * dfg/DFGStructureCheckHoistingPhase.h: Added.
+        (DFG):
+        * dfg/DFGVariableAccessData.h:
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
+        (JSC::DFG::VariableAccessData::structureCheckHoistingFailed):
+        (JSC::DFG::VariableAccessData::clearVotes):
+        (JSC::DFG::VariableAccessData::vote):
+        (JSC::DFG::VariableAccessData::voteRatio):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        * runtime/Options.h:
+        (JSC):
+
+2012-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should distinguish between PutByVal's that clobber the world and ones that don't
+        https://bugs.webkit.org/show_bug.cgi?id=92923
+
+        Reviewed by Mark Hahnenberg.
+
+        This is performance-neutral. I also confirmed that it's neutral if we make the
+        clobbering variant (PutByValSafe) clobber all knowledge of what is an array,
+        which should feed nicely into work on removing uses of ClassInfo.
+
+        * bytecode/DFGExitProfile.h:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define.
+
+2012-08-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace WTF::getCurrentLocalTime() with GregorianDateTime::setToCurrentLocalTime()
+        https://bugs.webkit.org/show_bug.cgi?id=92286
+
+        Reviewed by Geoffrey Garen.
+
+        Add a method to GregorianDateTime to set its values to the current locale time.
+        Replacing all occurrences of getCurrentLocalTime with the new function allows
+        us to remove getCurrentLocalTime in a next step.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        C++ code should get ClassInfo from the Structure
+        https://bugs.webkit.org/show_bug.cgi?id=92892
+
+        Reviewed by Geoffrey Garen.
+
+        In our march to remove ClassInfo from our JSCell object headers, we can switch 
+        C++ code over to grabbing the ClassInfo from the Structure since it is finally 
+        safe to do so now that Structure access is safe during finalization/destruction. 
+        The remaining JIT code changes can be done in a separate patch.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more 
+        since the Structure should still be valid at this point.
+        * heap/WeakSetInlines.h:
+        (JSC::WeakBlock::finalize): Ditto.
+        * runtime/JSCell.h:
+        (JSC):
+        * runtime/Structure.h:
+        (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be 
+        inline. Use a different method of getting the JSCell's Structure based on 
+        whether we're in GC_VALIDATION mode or not, since always using get() will cause 
+        infinite recursion in GC_VALIDATION mode.
+        (JSC):
+
+2012-07-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block
+        https://bugs.webkit.org/show_bug.cgi?id=92819
+
+        Reviewed by Geoffrey Garen.
+
+        If we are forced to allocate a new block for Structures because we are unable to safely 
+        sweep our pre-existing Structure blocks, we should sweep another random block so that we 
+        can start sweeping Structure blocks sooner.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock.
+        (JSC):
+        (JSC::IncrementalSweeper::sweepNextBlock): 
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep 
+        our Structure blocks, call sweepNextBlock instead.
+
+2012-07-31  Sam Weinig  <sam@webkit.org>
+
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe fix the GCC build.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): Accommodate incorrect parsing in GCC.
+
+2012-07-31  Sam Weinig  <sam@webkit.org>
+
+        Stop masking 8 bits off of the visited link hash. We need all the bits!
+        https://bugs.webkit.org/show_bug.cgi?id=92799
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierCStringTranslator::hash):
+        (JSC::IdentifierLCharFromUCharTranslator::hash):
+        * runtime/Identifier.h:
+        (JSC::IdentifierCharBufferTranslator::hash):
+        Update for new function names.
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe break the Windows build.
+
+        Reviewed by Anders Carlsson.
+
+        Formally objected to by Sam Weinig.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives.
+
+2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Structures should be swept after all other objects
+        https://bugs.webkit.org/show_bug.cgi?id=92679
+
+        Reviewed by Filip Pizlo.
+
+        In order to get rid of ClassInfo from our objects, we need to be able to safely get the 
+        ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the 
+        Structure, but currently it is not safe to do so because the order of destruction of objects 
+        is not guaranteed to sweep objects before their corresponding Structure. We can fix this by 
+        sweeping Structures after everything else.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
+        If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is 
+        safe to sweep structures since we'll always do Structures last anyways due to the ordering of 
+        MarkedSpace::forEachBlock.
+        (JSC):
+        (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
+        calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out 
+        these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() 
+        calls during lastChanceToFinalize().
+        * heap/Heap.h:
+        (Heap):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
+        This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
+        the first time.
+        (JSC):
+        (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we 
+        make our first pass. We now null out the slots as we sweep them so that we can quickly find the 
+        Structures during the second pass.
+        (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
+        (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify 
+        the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can 
+        assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock 
+        iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
+        (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
+        * heap/IncrementalSweeper.h: Add declarations for new stuff.
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and 
+        if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing 
+        the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that 
+        will sweep some number of other blocks in place of the current block to mitigate the cost of the floating 
+        Structure garbage.
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no 
+        longer valid to allocate from, so we set the current block to null.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
+        at an unsafe time.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
+        (JSC): 
+        * heap/MarkedSpace.h:
+        (JSC):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix all the other builds I just broke. Maybe fix the Windows build.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): WTF?
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe fix the Windows build.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): WTF?
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Maybe fix the Windows build.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): WTF?
+
+2012-07-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed some public data and casting from the Heap
+        https://bugs.webkit.org/show_bug.cgi?id=92777
+
+        Reviewed by Oliver Hunt.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::releaseFreeBlocks):
+        (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class
+        since HeapBlock is a template, and not a class, now. Call destroy()
+        instead of monkeying around with DeadBlock's internal data because
+        encapsulation is good.
+
+        * heap/BlockAllocator.h:
+        (DeadBlock): Added a class to represent a dead block, since HeapBlock is
+        a template now, and can't be instantiated directly.
+
+        (JSC::DeadBlock::DeadBlock):
+        (JSC::DeadBlock::create):
+        (BlockAllocator):
+        (JSC::BlockAllocator::allocate):
+        (JSC::BlockAllocator::deallocate): Use the DeadBlock class because
+        encapsulation is good.
+
+        * heap/CopiedBlock.h:
+        (CopiedBlock::destroy): No need for a destroy() function, since we
+        inherit one now.
+
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::payloadEnd):
+        (JSC::CopiedBlock::capacity): Updated for some encapsulation inside
+        HeapBlock.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::~CopiedSpace):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::size):
+        (JSC::CopiedSpace::capacity):
+        (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer
+        necessary, now that our list and its nodes have the right type.
+
+        * heap/CopiedSpace.h: Use the right type in our data structures because
+        it improves clarity.
+
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it.
+
+        * heap/HeapBlock.h:
+        (HeapBlock): Made this a class template so we can return the right type
+        in linked list operations. Made our data private because encapsulation
+        is good.
+
+        (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate
+        duplicate destroy() functions in our subclasses.
+
+        (JSC::HeapBlock::allocation): Added an accessor so we can hide our data.
+        By using const, this accessor prevents clients from accidentally deleting
+        our allocation.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::isPagedOut):
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is
+        no longer necessary, now that our list and its nodes have the right type.
+
+        * heap/MarkedAllocator.h:
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::reset):
+        (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting.
+
+        * heap/MarkedBlock.cpp: 
+        (JSC::MarkedBlock::destroy): Removed this function because our parent
+        class provides it for us now.
+
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::capacity): Updated for encapsulation.
+
+2012-07-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit profiling has unusual oversights
+        https://bugs.webkit.org/show_bug.cgi?id=92728
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-07-31  Chao-ying Fu  <fu@mips.com>
+
+        Add MIPS add32 function
+        https://bugs.webkit.org/show_bug.cgi?id=91522
+
+        Reviewed by Oliver Hunt.
+
+        Add isCompactPtrAlignedAddressOffset.
+        Add a new version of add32 that accepts AbsoluteAddress as inputs.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New.
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs.
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124123.
+        http://trac.webkit.org/changeset/124123
+        https://bugs.webkit.org/show_bug.cgi?id=92700
+
+        ASSERT crashes terminate webkit Layout tests (Requested by
+        msaboff on #webkit).
+
+        * heap/Heap.cpp:
+        * heap/Heap.h:
+        (Heap):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doSweep):
+        (JSC::IncrementalSweeper::startSweeping):
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::zapFreeList):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedSpace.cpp:
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::sweep):
+        (JSC):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData):
+
+2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Structures should be swept after all other objects
+        https://bugs.webkit.org/show_bug.cgi?id=92679
+
+        Reviewed by Filip Pizlo.
+
+        In order to get rid of ClassInfo from our objects, we need to be able to safely get the 
+        ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the 
+        Structure, but currently it is not safe to do so because the order of destruction of objects 
+        is not guaranteed to sweep objects before their corresponding Structure. We can fix this by 
+        sweeping Structures after everything else.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
+        If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is 
+        safe to sweep structures since we'll always do Structures last anyways due to the ordering of 
+        MarkedSpace::forEachBlock.
+        (JSC):
+        (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
+        calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out 
+        these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() 
+        calls during lastChanceToFinalize().
+        * heap/Heap.h:
+        (Heap):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
+        This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
+        the first time.
+        (JSC):
+        (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we 
+        make our first pass. We now null out the slots as we sweep them so that we can quickly find the 
+        Structures during the second pass.
+        (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
+        (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify 
+        the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can 
+        assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock 
+        iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
+        (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
+        * heap/IncrementalSweeper.h: Add declarations for new stuff.
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and 
+        if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing 
+        the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that 
+        will sweep some number of other blocks in place of the current block to mitigate the cost of the floating 
+        Structure garbage.
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no 
+        longer valid to allocate from, so we set the current block to null.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
+        at an unsafe time.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
+        (JSC): 
+        * heap/MarkedSpace.h:
+        (JSC):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
+
+2012-07-29  Filip Pizlo  <fpizlo@apple.com>
+
+        PropertyNameArray::m_shouldCache is only assigned and never used
+        https://bugs.webkit.org/show_bug.cgi?id=92598
+
+        Reviewed by Dan Bernstein.
+
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (PropertyNameArray):
+
+2012-07-29  Rik Cabanier  <cabanier@adobe.com>
+
+        Add ENABLE_CSS_COMPOSITING flag
+        https://bugs.webkit.org/show_bug.cgi?id=92553
+
+        Reviewed by Dirk Schulze.
+
+        Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Split functionality of MarkedAllocator::m_currentBlock
+        https://bugs.webkit.org/show_bug.cgi?id=92550
+
+        Reviewed by Filip Pizlo.
+
+        MarkedAllocator::m_currentBlock serves two purposes right now; it indicates the block that is currently 
+        being used for allocation and the beginning of the list of blocks that need to be swept. We should split 
+        these two functionalities into two separate fields.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): Use m_blocksToSweep instead of m_currentBlock as the 
+        initializer/reference of the loop. Only change m_currentBlock when we know what the result will be.
+        (JSC::MarkedAllocator::addBlock): When we add a new block we know that both m_blocksToSweep and 
+        m_currentBlock are null. In order to preserve the invariant that m_currentBlock <= m_blocksToSweep, 
+        we assign both of them to point to the new block.
+        (JSC::MarkedAllocator::removeBlock): We need a separate check to see if the block we're removing is 
+        m_blocksToSweep and if so, advance it to the next block in the list.
+        * heap/MarkedAllocator.h:
+        (MarkedAllocator): Initialize m_blocksToSweep.
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::reset): We set m_blocksToSweep to be the head of our list. This function is called
+        at the end of a collection, so all of the blocks in our allocator need to be swept. We need to sweep a 
+        block before we can start allocating, so m_currentBlock is set to null. We also set the freeList to 
+        the empty FreeList to emphasize the fact that we can't start allocating until we do some sweeping.
+
+2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Increase inline storage for JSFinalObjects by one
+        https://bugs.webkit.org/show_bug.cgi?id=92526
+
+        Reviewed by Geoffrey Garen.
+
+        Now that we've removed the inheritorID from objects, we can increase our inline storage for JSFinalObjects on 
+        64-bit platforms by 1.
+
+        * llint/LowLevelInterpreter.asm: Change the constant.
+        * runtime/PropertyOffset.h: Change the constant.
+        (JSC):
+
+2012-07-27  Jer Noble  <jer.noble@apple.com>
+
+        Support a rational time class for use by media elements.
+        https://bugs.webkit.org/show_bug.cgi?id=88787
+
+        Re-export WTF::MediaTime from JavaScriptCore.
+
+        Reviewed by Eric Carlson.
+
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-07-26  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject::reallocateStorageIfNecessary is neither used nor defined
+        https://bugs.webkit.org/show_bug.cgi?id=92417
+
+        Reviewed by Mark Rowe.
+
+        * runtime/JSObject.h:
+        (JSObject):
+
+2012-07-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Allocate Structures in a separate part of the Heap
+        https://bugs.webkit.org/show_bug.cgi?id=92420
+
+        Reviewed by Filip Pizlo.
+
+        To fix our issue with destruction/finalization of Structures before their objects, we can move Structures to a separate 
+        part of the Heap that will be swept after all other objects. This first patch will just be separating Structures 
+        out into their own separate MarkedAllocator. Everything else will behave identically.
+
+        * heap/Heap.h: New function to allocate Structures in the Heap.
+        (Heap):
+        (JSC):
+        (JSC::Heap::allocateStructure):
+        * heap/MarkedAllocator.cpp: Pass whether or not we're allocated Structures to the MarkedBlock.
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedAllocator.h: Add tracking for whether or not we're allocating only Structures.
+        (JSC::MarkedAllocator::onlyContainsStructures):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::init):
+        * heap/MarkedBlock.cpp: Add tracking for whether or not we're allocating only Structures. We need this to be able to 
+        distinguish the various MarkedBlock types in MarkedSpace::allocatorFor(MarkedBlock*).
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::onlyContainsStructures):
+        (JSC):
+        * heap/MarkedSpace.cpp: Include the new Structure allocator in all the places that all the other allocators are used/modified.
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData):
+        (JSC::MarkedSpace::isPagedOut):
+        * heap/MarkedSpace.h: Add new MarkedAllocator just for Structures.
+        (MarkedSpace):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::allocateStructure):
+        (JSC):
+        (JSC::MarkedSpace::forEachBlock):
+        * runtime/Structure.h: Move all of the functions that call allocateCell<Structure> down below the explicit template specialization
+        for allocateCell<Structure>. The new inline specialization for allocateCell directly calls the allocateStructure() function in the
+        Heap.
+        (Structure):
+        (JSC::Structure):
+        (JSC):
+        (JSC::Structure::create):
+        (JSC::Structure::createStructure):
+
+2012-07-26  Filip Pizlo  <fpizlo@apple.com>
+
+        JSArray has methods that are neither used nor defined
+        https://bugs.webkit.org/show_bug.cgi?id=92416
+
+        Reviewed by Simon Fraser.
+
+        * runtime/JSArray.h:
+        (JSArray):
+
+2012-07-26  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt][ARM]ARMAssembler needs buildfix afert r123417
+        https://bugs.webkit.org/show_bug.cgi?id=92086
+
+        Reviewed by Csaba Osztrogonác.
+
+        The ARM implementation of this should be optimized code path
+        is covered by a non-optimized code path. This patch fixes this,
+        and adds a new function which returns with the offset range.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::readPointer):
+        (ARMAssembler):
+        (JSC::ARMAssembler::repatchInt32):
+        (JSC::ARMAssembler::repatchCompact):
+        * assembler/MacroAssemblerARM.h:
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::isCompactPtrAlignedAddressOffset):
+        (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
+
+2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Build fix for 32-bit after r123682
+
+        * runtime/JSObject.h: Need to pad out JSObjects on 32-bit so that they're the correct size since
+        we only removed one 4-byte word and we need to be 8-byte aligned.
+        (JSObject):
+
+2012-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC object copying APIs should allow for greater flexibility
+        https://bugs.webkit.org/show_bug.cgi?id=92316
+
+        Reviewed by Mark Hahnenberg.
+
+        It's now the case that visitChildren() methods can directly pin and allocate in new space during copying.
+        They can also do the copying and marking themselves. This new API is only used for JSObjects for now.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::allocateNewSpaceSlow):
+        (JSC::SlotVisitor::allocateNewSpaceOrPin):
+        (JSC):
+        (JSC::SlotVisitor::copyAndAppend):
+        * heap/MarkStack.h:
+        (MarkStack):
+        (JSC::MarkStack::appendUnbarrieredValue):
+        (JSC):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlineMethods.h: Added.
+        (JSC):
+        (JSC::SlotVisitor::checkIfShouldCopyAndPinOtherwise):
+        (JSC::SlotVisitor::allocateNewSpace):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitOutOfLineStorage):
+        (JSC):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSFinalObject::visitChildren):
+        * runtime/JSObject.h:
+        (JSObject):
+
+2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove JSObject::m_inheritorID
+        https://bugs.webkit.org/show_bug.cgi?id=88378
+
+        Reviewed by Filip Pizlo.
+
+        This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
+        and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
+        Instead use a private named value in the object's property storage.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
+        * llint/LowLevelInterpreter.asm: No need m_inheritorID to initialize!
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): Added private name 'm_inheritorIDKey'.
+        * runtime/JSGlobalThis.cpp:
+        (JSC::JSGlobalThis::setUnwrappedObject): resetInheritorID is now passed a JSGlobalData&.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren): No m_inheritorID to be marked.
+        (JSC::JSFinalObject::visitChildren): No m_inheritorID to be marked.
+        (JSC::JSObject::createInheritorID): Store the newly created inheritorID in the property map. Make sure 
+        it's got the DontEnum attribute!!
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::resetInheritorID): Remove the inheritorID from property storage.
+        (JSC):
+        (JSC::JSObject::inheritorID): Read the inheritorID from property storage.
+
+2012-07-25  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Create a specialized pair for use in HashMap iterators
+        https://bugs.webkit.org/show_bug.cgi?id=92137
+
+        Reviewed by Ryosuke Niwa.
+
+        Update a couple of sites that relied on the fact that "contents" of iterators were
+        std::pairs.
+
+        * profiler/Profile.cpp:
+        (JSC): This code kept a vector of the pairs that were the "contents" of the iterators. This
+        is changed to use a KeyValuePair. We make use HashCount's ValueType (which represents only
+        the key) to get the proper key parameter for KeyValuePair.
+        * tools/ProfileTreeNode.h:
+        (ProfileTreeNode): Use HashMap::ValueType to declare the type of the contents of the hash
+        instead of declaring it manually. This will make use of the new KeyValuePair.
+
+2012-07-25  Patrick Gansterer  <paroga@webkit.org>
+
+        REGRESSION(r123505): Date.getYear() returns the same as Date.getFullYear()
+        https://bugs.webkit.org/show_bug.cgi?id=92218
+
+        Reviewed by Csaba Osztrogonác.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncGetYear): Added the missing offset of 1900 to the return value.
+
+2012-07-24  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r123417): It made tests assert/crash on 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=92088
+
+        Reviewed by Mark Hahnenberg.
+
+        The pointer arithmetic was wrong, because negative numbers are hard to think about.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+
+2012-07-24  Patrick Gansterer  <paroga@webkit.org>
+
+        Store the full year in GregorianDateTime
+        https://bugs.webkit.org/show_bug.cgi?id=92067
+
+        Reviewed by Geoffrey Garen.
+
+        Use the full year instead of the offset from year 1900
+        for the year member variable of GregorianDateTime.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateUTC):
+        * runtime/DateConversion.cpp:
+        (JSC::formatDate):
+        (JSC::formatDateUTCVariant):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/JSDateMath.cpp:
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+
+2012-07-24  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Build fix after r123417.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Move GregorianDateTime from JSC to WTF namespace
+        https://bugs.webkit.org/show_bug.cgi?id=91948
+
+        Reviewed by Geoffrey Garen.
+
+        Moving GregorianDateTime into the WTF namespace allows us to us to
+        use it in WebCore too. The new class has the same behaviour as the
+        old struct. Only the unused timeZone member has been removed.
+
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConversion.cpp:
+        * runtime/DateConversion.h:
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSDateMath.h:
+
+2012-07-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Property storage should grow in reverse address direction, to support butterflies
+        https://bugs.webkit.org/show_bug.cgi?id=91788
+
+        Reviewed by Geoffrey Garen.
+
+        Changes property storage to grow to the left, and changes the property storage pointer to point
+        one 8-byte word (i.e. JSValue) to the right of the first value in the storage.
+        
+        Also improved debug support somewhat, by adding a describe() function to the jsc command-line,
+        and a slow mode of object access in LLInt.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::repatchCompact):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset):
+        (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset):
+        (JSC::MacroAssemblerX86Common::repatchCompact):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::repatchCompact):
+        * bytecode/CodeBlock.cpp:
+        (JSC::dumpStructure):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddPointer):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::pinIfNecessary):
+        (JSC):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDescribe):
+        * llint/LLIntCommon.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        (JSC::JSFinalObject::visitChildren):
+        (JSC::JSObject::growOutOfLineStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        * runtime/JSValue.h:
+        (JSValue):
+        * runtime/PropertyOffset.h:
+        (JSC::offsetInOutOfLineStorage):
+
+2012-07-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG is too aggressive in performing the specific value optimization on loads
+        https://bugs.webkit.org/show_bug.cgi?id=92034
+
+        Reviewed by Mark Hahnenberg.
+
+        This ensures that we don't do optimizations based on a structure having a specific
+        value, if there is no way to detect that the value is despecified. This is the
+        case for dictionaries, since despecifying a value in a dictionary does not lead to
+        a transition and so cannot be caught by either structure checks or structure
+        transition watchpoints.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForStructure):
+
+2012-07-23  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=92002
+
+        Reviewed by Mark Hahnenberg.
+        
+        In the process of changing the nature of local variable typing, I forgot to modify one of the places where
+        we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 2 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Turn on ENABLE_CSS_STICKY_POSITION.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Move JSC::parseDate() from DateConversion to JSDateMath
+        https://bugs.webkit.org/show_bug.cgi?id=91982
+
+        Reviewed by Geoffrey Garen.
+
+        Moveing this function into the other files removes the dependency
+        on JSC spcific classes in DateConversion.{cpp|h}.
+
+        * runtime/DateConversion.cpp:
+        * runtime/DateConversion.h:
+        (JSC):
+        * runtime/JSDateMath.cpp:
+        (JSC::parseDate):
+        (JSC):
+        * runtime/JSDateMath.h:
+        (JSC):
+
+2012-07-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Part 1 of: Implement sticky positioning
+        https://bugs.webkit.org/show_bug.cgi?id=90046
+
+        Reviewed by Ojan Vafai.
+
+        Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
+        
+        Sort the ENABLE_CSS lines in the file. Make sure all the flags
+        are in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-23  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Implement GCActivityCallback with platform timer
+        https://bugs.webkit.org/show_bug.cgi?id=90175
+
+        Reviewed by Rob Buis.
+
+        Use JSLock when performing GC to avoid assertions.
+
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC::DefaultGCActivityCallback::doWork):
+
+2012-07-23  Kent Tamura  <tkent@chromium.org>
+
+        Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
+        https://bugs.webkit.org/show_bug.cgi?id=91941
+
+        Reviewed by Kentaro Hara.
+
+        A flag name for an elmement should be ENABLE_*_ELEMENT.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-22  Kent Tamura  <tkent@chromium.org>
+
+        Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT
+        https://bugs.webkit.org/show_bug.cgi?id=91928
+
+        Reviewed by Kentaro Hara.
+
+        A flag name for an elmement should be ENABLE_*_ELEMENT.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-21  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Use GetDateFormat and GetTimeFormat instead of strftime
+        https://bugs.webkit.org/show_bug.cgi?id=83436
+
+        Reviewed by Brent Fulgham.
+
+        The MS CRT implementation of strftime calls the same two functions.
+        Using them directly avoids the overhead of parsing the format string and removes
+        the dependency on strftime() for WinCE where this function does not exist.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2012-07-20  Kent Tamura  <tkent@chromium.org>
+
+        Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT
+        https://bugs.webkit.org/show_bug.cgi?id=91846
+
+        Reviewed by Kentaro Hara.
+
+        A flag name for an elmement should be ENABLE_*_ELEMENT.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-20  Han Shen  <shenhan@google.com>
+
+        [Chromium] Compilation fails under gcc 4.7
+        https://bugs.webkit.org/show_bug.cgi?id=90227
+
+        Reviewed by Tony Chang.
+
+        Disable warnings about c++0x compatibility in gcc newer than 4.6.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2012-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG cell checks should be hoisted
+        https://bugs.webkit.org/show_bug.cgi?id=91717
+
+        Reviewed by Geoffrey Garen.
+
+        The DFG has always had the policy of hoisting array and integer checks to
+        the point of variable assignment. Eventually, we added doubles and booleans
+        to the mix. But cells should really be part of this as well, particularly
+        for 32-bit where accessing a known-type variable is dramatically cheaper
+        than accessing a variable whose types is only predicted but otherwise
+        unproven.
+        
+        This appears to be a definite speed-up for V8 on 32-bit, a possible speed-up
+        for Kraken, and a possible slow-down for V8 on 64-bit (around 0.2% if at
+        all). Any slow-downs can, and should, be addressed by making the hoisting
+        logic cognizant of variables that are never used in a manner that requires
+        type checks, and by sinking argument checks to the point(s) of first use.
+        
+        To make this work I had to change some OSR machinery, and special-case the
+        type predictions of the 'this' argument for constructors. OSR exit normally
+        assumes that arguments are boxed, which happens to be true because the
+        type prediction used for check hoisting is LUB'd with the type of the
+        argument that was passed in - so either the arguments are always stored to
+        with the full tag+payload, or if only the payload is stored then the tag
+        matches whatever the caller would have set. But not so with the 'this'
+        argument for constructors, which is not initialized by the caller. We
+        could make this more precise by having argument types for OSR be inferred
+        using similar machinery to other locals, but I figured that for this patch
+        I should use the surgical fix.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (MacroAssemblerX86_64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testq_rm):
+        (X86Assembler):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isCreatedThisArgument):
+        (Graph):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::forSpeculation):
+
+2012-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Fast path of storage resize should be removed from property storage reallocation, since it is only useful for arrays
+        https://bugs.webkit.org/show_bug.cgi?id=91796
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::growOutOfLineStorage):
+
+2012-07-19  Mark Lam  <mark.lam@apple.com>
+
+        Bug fixes and enhancements for OfflineASM annotation system.
+        https://bugs.webkit.org/show_bug.cgi?id=91690
+
+        Reviewed by Filip Pizlo.
+
+        * offlineasm/armv7.rb: added default handling of Instruction lower().
+        * offlineasm/asm.rb: added more support for annotations and more pretty printing.
+        * offlineasm/ast.rb: added more support for annotations.
+        * offlineasm/config.rb: added $preferredCommentStartColumn, simplified $enableInstrAnnotations.
+        * offlineasm/parser.rb: added more support for annotations.
+        * offlineasm/transform.rb: added more support for annotations.
+        * offlineasm/x86.rb: added default handling of Instruction lower().
+
+2012-07-19  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT)
+        https://bugs.webkit.org/show_bug.cgi?id=91243
+
+        Reviewed by Geoffrey Garen.
+
+        Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer.
+
+        * runtime/JSGlobalData.h:
+        (JSC):
+
+2012-07-19  Mark Lam  <mark.lam@apple.com>
+
+        Fixed broken ENABLE_JIT=0 build.
+        https://bugs.webkit.org/show_bug.cgi?id=91725
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/Watchpoint.cpp:
+        * heap/JITStubRoutineSet.h:
+        (JSC):
+        (JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::~JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::add):
+        (JSC::JITStubRoutineSet::clearMarks):
+        (JSC::JITStubRoutineSet::mark):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
+
+2012-07-19  Kristóf Kosztyó  <kkristof@inf.u-szeged.hu>
+
+        [Qt] Unreviewed buildfix after r123042.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+
+2012-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should emit inline code for property storage (re)allocation
+        https://bugs.webkit.org/show_bug.cgi?id=91597
+
+        Reviewed by Oliver Hunt.
+
+        This adds two new ops to the DFG IR: AllocatePropertyStorage and
+        ReallocatePropertyStorage. It enables these to interact properly with
+        CSE so that a GetPropertyStorage on something for which we have
+        obviously done a (Re)AllocatePropertyStorage will result in the
+        GetPropertyStorage being eliminated. Other than that, the code
+        emitted for these ops is identical to the code we were emitting in
+        the corresponding PutById stub.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasStructureTransitionData):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Structure.cpp:
+        (JSC::nextOutOfLineStorageCapacity):
+        * runtime/Structure.h:
+        (JSC):
+
+2012-07-16  Oliver Hunt  <oliver@apple.com>
+
+        dumpCallFrame is broken in ToT
+        https://bugs.webkit.org/show_bug.cgi?id=91444
+
+        Reviewed by Gavin Barraclough.
+
+        Various changes have been made to the SF calling convention, but
+        dumpCallFrame has not been updated to reflect these changes.
+        That resulted in both bogus information, as well as numerous
+        assertions of sadness.
+
+        This patch makes dumpCallFrame actually work again and adds the
+        wonderful feature of telling you the name of the variable that a
+        register reflects, or what value it contains.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::nameForRegister):
+            A really innefficient mechanism for finding the name of a local register.
+            This should only ever be used by debug code so this should be okay.
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+            Debug builds no longer throw away a functions symbol table, this allows
+            us to actually perform a register# to name mapping
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+            We weren't propogating the bytecode offset here leading to assertions
+            in debug builds when dumping bytecode of DFG compiled code.
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::dumpRegisters):
+             Rework to actually be correct.
+        (JSC::getCallerInfo):
+             Return the byteocde offset as well now, given we have to determine it
+             anyway.
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDumpCallFrame):
+             Give debug builds of JSC a method for calling dumpCallFrame so we can
+             inspect a callframe without requiring us to break in a debugger.
+
+2012-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG 32-bit PutById transition stub storage reallocation case copies the first pointer of each JSValue instead of the whole JSValue
+        https://bugs.webkit.org/show_bug.cgi?id=91599
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitPutTransitionStub):
+
+2012-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order
+        https://bugs.webkit.org/show_bug.cgi?id=91576
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitPutTransitionStub):
+
+2012-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        [Qt] REGRESSION(r122768, r122771): They broke jquery/data.html and inspector/elements/edit-dom-actions.html
+        https://bugs.webkit.org/show_bug.cgi?id=91476
+
+        Reviewed by Mark Hahnenberg.
+
+        The 32-bit repatching code was not correctly adapted to the new world where there may not always
+        be an available scratch register. Fixed it by ensuring that the scratch register we select does
+        not overlap with the value tag.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::emitPutReplaceStub):
+
+2012-07-17  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Unreviewed buildfix from Zoltan Herczeg after 122768.
+
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+
+2012-07-17  David Barr  <davidbarr@chromium.org>
+
+        Introduce ENABLE_CSS_IMAGE_ORIENTATION compile flag
+        https://bugs.webkit.org/show_bug.cgi?id=89055
+
+        Reviewed by Kent Tamura.
+
+        The css3-images module is at candidate recommendation.
+        http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation
+
+        Add a configuration option for CSS image-orientation support, disabling it by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out 122790 because it broke the Windows build. I'm not
+        sure what to do with exported symbols that are predicated on NDEBUG.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+
+2012-07-16  Oliver Hunt  <oliver@apple.com>
+
+        dumpCallFrame is broken in ToT
+        https://bugs.webkit.org/show_bug.cgi?id=91444
+
+        Reviewed by Gavin Barraclough.
+
+        Various changes have been made to the SF calling convention, but
+        dumpCallFrame has not been updated to reflect these changes.
+        That resulted in both bogus information, as well as numerous
+        assertions of sadness.
+
+        This patch makes dumpCallFrame actually work again and adds the
+        wonderful feature of telling you the name of the variable that a
+        register reflects, or what value it contains.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::nameForRegister):
+            A really innefficient mechanism for finding the name of a local register.
+            This should only ever be used by debug code so this should be okay.
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+            Debug builds no longer throw away a functions symbol table, this allows
+            us to actually perform a register# to name mapping
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+            We weren't propogating the bytecode offset here leading to assertions
+            in debug builds when dumping bytecode of DFG compiled code.
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::dumpRegisters):
+             Rework to actually be correct.
+        (JSC::getCallerInfo):
+             Return the byteocde offset as well now, given we have to determine it
+             anyway.
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDumpCallFrame):
+             Give debug builds of JSC a method for calling dumpCallFrame so we can
+             inspect a callframe without requiring us to break in a debugger.
+
+2012-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, adding forgotten files.
+
+        * dfg/DFGRegisterSet.h: Added.
+        (DFG):
+        (RegisterSet):
+        (JSC::DFG::RegisterSet::RegisterSet):
+        (JSC::DFG::RegisterSet::asPOD):
+        (JSC::DFG::RegisterSet::copyInfo):
+        (JSC::DFG::RegisterSet::set):
+        (JSC::DFG::RegisterSet::setGPRByIndex):
+        (JSC::DFG::RegisterSet::clear):
+        (JSC::DFG::RegisterSet::get):
+        (JSC::DFG::RegisterSet::getGPRByIndex):
+        (JSC::DFG::RegisterSet::getFreeGPR):
+        (JSC::DFG::RegisterSet::setFPRByIndex):
+        (JSC::DFG::RegisterSet::getFPRByIndex):
+        (JSC::DFG::RegisterSet::setByIndex):
+        (JSC::DFG::RegisterSet::getByIndex):
+        (JSC::DFG::RegisterSet::numberOfSetGPRs):
+        (JSC::DFG::RegisterSet::numberOfSetFPRs):
+        (JSC::DFG::RegisterSet::numberOfSetRegisters):
+        (JSC::DFG::RegisterSet::setBit):
+        (JSC::DFG::RegisterSet::clearBit):
+        (JSC::DFG::RegisterSet::getBit):
+        * dfg/DFGScratchRegisterAllocator.h: Added.
+        (DFG):
+        (ScratchRegisterAllocator):
+        (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        (JSC::DFG::ScratchRegisterAllocator::lock):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
+        (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
+        (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+
+2012-07-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG PutById transition should handle storage allocation, and inline it
+        https://bugs.webkit.org/show_bug.cgi?id=91337
+
+        Reviewed by Oliver Hunt.
+
+        This enables the patching of DFG PutById to handle the out-of-line storage
+        allocation case. Furthermore, it inlines out-of-line storage allocation (and
+        reallocation) into the generated stubs.  
+        
+        To do this, this patch adds the ability to store the relevant register
+        allocation state (i.e. the set of in-use registers) in the structure stub
+        info so that the stub generation code can more flexibly select scratch
+        registers: sometimes it needs none, sometimes one - or sometimes up to
+        three. Moreover, to make the stub generation register allocation simple and
+        maintainable, this patch introduces a reusable scratch register allocator
+        class. This register allocator understands that some registers are in use by
+        the main path code and so must be spilled as necessary, other registers are
+        locked for use in the stub itself and so cannot even be spilled, while still
+        others may be allocated for scratch purposes. A scratch register that is
+        used must be spilled. If a register is locked, it cannot be used as a
+        scratch register. If a register is used, it can be used as a scratch
+        register so long as it is spilled.
+        
+        This is a sub-1% speed-up on V8 and neutral elsewhere.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerCodeRef.h:
+        (FunctionPtr):
+        (JSC::FunctionPtr::FunctionPtr):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGGPRInfo.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+        (PropertyAccessRecord):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::isInUse):
+        (RegisterBank):
+        * dfg/DFGRegisterSet.h: Added.
+        (DFG):
+        (RegisterSet):
+        (JSC::DFG::RegisterSet::RegisterSet):
+        (JSC::DFG::RegisterSet::asPOD):
+        (JSC::DFG::RegisterSet::copyInfo):
+        (JSC::DFG::RegisterSet::set):
+        (JSC::DFG::RegisterSet::setGPRByIndex):
+        (JSC::DFG::RegisterSet::clear):
+        (JSC::DFG::RegisterSet::get):
+        (JSC::DFG::RegisterSet::getGPRByIndex):
+        (JSC::DFG::RegisterSet::getFreeGPR):
+        (JSC::DFG::RegisterSet::setFPRByIndex):
+        (JSC::DFG::RegisterSet::getFPRByIndex):
+        (JSC::DFG::RegisterSet::setByIndex):
+        (JSC::DFG::RegisterSet::getByIndex):
+        (JSC::DFG::RegisterSet::numberOfSetGPRs):
+        (JSC::DFG::RegisterSet::numberOfSetFPRs):
+        (JSC::DFG::RegisterSet::numberOfSetRegisters):
+        (JSC::DFG::RegisterSet::setBit):
+        (JSC::DFG::RegisterSet::clearBit):
+        (JSC::DFG::RegisterSet::getBit):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * dfg/DFGScratchRegisterAllocator.h: Added.
+        (DFG):
+        (ScratchRegisterAllocator):
+        (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        (JSC::DFG::ScratchRegisterAllocator::lock):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
+        (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
+        (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::usedRegisters):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/CopiedAllocator.h:
+        (CopiedAllocator):
+        (JSC::CopiedAllocator::fastPathShouldSucceed):
+        (JSC):
+
+2012-07-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Add dfg switch to create_jit_stubs script
+        https://bugs.webkit.org/show_bug.cgi?id=91256
+
+        Reviewed by Geoffrey Garen.
+
+        * create_jit_stubs: Add a switch to enable or disable the generation of
+                            stub functions in #if ENABLE(DFG_JIT) conditions.
+
+2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Unreviewed buildfix after r122729. Typo fix.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+
+2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Unreviewed buildfix from Zoltan Herczeg after r122677.
+        Implement missing add32 function to MacroAssemblerARM.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (MacroAssemblerARM):
+
+2012-07-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG PutByVal opcodes should accept more than 3 operands
+        https://bugs.webkit.org/show_bug.cgi?id=91332
+
+        Reviewed by Oliver Hunt.
+
+        Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them
+        4 or more operands in the future.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        (JSC::DFG::Graph::varArgNumChildren):
+        (Graph):
+        (JSC::DFG::Graph::numChildren):
+        (JSC::DFG::Graph::varArgChild):
+        (JSC::DFG::Graph::child):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-07-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize and optimize storage allocation
+        https://bugs.webkit.org/show_bug.cgi?id=91303
+
+        Reviewed by Oliver Hunt.
+
+        This implements a backwards bump allocator for copied space storage
+        allocation, shown in pseudo-code below:
+        
+            pointer bump(size) {
+                pointer tmp = allocator->remaining;
+                tmp -= size;
+                if (tmp < 0)
+                    fail;
+                allocator->remaining = tmp;
+                return allocator->payloadEnd - tmp - size;
+            }
+
+        The advantage of this allocator is that it:
+        
+        - Only requires one comparison in the common case where size is known to
+          not be huge, and this comparison can be done by checking the sign bit
+          of the subtraction.
+        
+        - Can be implemented even when only one register is available. This
+          register is reused for both temporary storage during allocation and
+          for the result.
+        
+        - Preserves the behavior that memory in a block is filled in from lowest
+          address to highest address, which allows for a cheap reallocation fast
+          path.
+        
+        - Is resilient against the block used for allocation being the last one
+          in virtual memory, thereby otherwise leading to the risk of overflow
+          in the bump pointer, despite only doing one branch.
+        
+        In order to implement this allocator using the smallest possible chunk
+        of code, I refactored the copied space code so that all of the allocation
+        logic is in CopiedAllocator, and all of the state is in either
+        CopiedBlock or CopiedAllocator. This should make changing the allocation
+        fast path easier in the future.
+        
+        In order to do this, I needed to add some new assembler support,
+        particularly for various forms of add(address, register) and negPtr().
+        
+        This is performance neutral. The purpose of this change is to facilitate
+        further inlining of storage allocation without having to reserve
+        additional registers or emit too much code.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (MacroAssembler):
+        (JSC::MacroAssembler::negPtr):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::add32):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add32):
+        (MacroAssemblerX86):
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        (JSC::MacroAssemblerX86_64::negPtr):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::addq_mr):
+        (JSC::X86Assembler::negq_r):
+        * heap/CopiedAllocator.h:
+        (CopiedAllocator):
+        (JSC::CopiedAllocator::isValid):
+        (JSC::CopiedAllocator::CopiedAllocator):
+        (JSC::CopiedAllocator::tryAllocate):
+        (JSC):
+        (JSC::CopiedAllocator::tryReallocate):
+        (JSC::CopiedAllocator::forceAllocate):
+        (JSC::CopiedAllocator::resetCurrentBlock):
+        (JSC::CopiedAllocator::setCurrentBlock):
+        (JSC::CopiedAllocator::currentCapacity):
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+        (JSC::CopiedBlock::create):
+        (JSC::CopiedBlock::zeroFillWilderness):
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::payloadEnd):
+        (JSC):
+        (JSC::CopiedBlock::payloadCapacity):
+        (JSC::CopiedBlock::data):
+        (JSC::CopiedBlock::dataEnd):
+        (JSC::CopiedBlock::dataSize):
+        (JSC::CopiedBlock::wilderness):
+        (JSC::CopiedBlock::wildernessEnd):
+        (JSC::CopiedBlock::wildernessSize):
+        (JSC::CopiedBlock::size):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocate):
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::startedCopying):
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        (JSC::CopiedSpace::allocateBlock):
+        (JSC::CopiedSpace::tryAllocate):
+        (JSC):
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::startCopying):
+        (JSC::SlotVisitor::allocateNewSpace):
+        (JSC::SlotVisitor::doneCopying):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::SlotVisitor):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicStorage):
+        (JSC::JIT::emitAllocateJSArray):
+
+2012-07-13  Mark Lam  <mark.lam@apple.com>
+
+        OfflineASM Pretty printing and commenting enhancements.
+        https://bugs.webkit.org/show_bug.cgi?id=91281
+
+        Reviewed by Filip Pizlo.
+
+        Added some minor pretty printing in the OfflineASM.
+        Also added infrastruture for adding multiple types of comments and
+        annotations with the ability to enable/disable them in the generated
+        output as desired.
+
+        * GNUmakefile.list.am: add new file config.rb.
+        * llint/LLIntOfflineAsmConfig.h:
+          Added OFFLINE_ASM_BEGIN, OFFLINE_ASM_END, and OFFLINE_ASM_LOCAL_LABEL macros.
+          This will allow us to redefine these for other backends later.
+        * llint/LowLevelInterpreter32_64.asm:
+          Add a small example of instruction annotations for now.
+        * llint/LowLevelInterpreter64.asm:
+          Add a small example of instruction annotations for now.
+        * offlineasm/armv7.rb: Added handling of annotations.
+        * offlineasm/asm.rb:
+          Added machinery to dump the new comments and annotations.
+          Also added some indentations to make the output a little prettier.
+        * offlineasm/ast.rb: Added annotation field in class Instruction. 
+        * offlineasm/backends.rb:
+        * offlineasm/config.rb: Added.
+          Currently only contains commenting options.  This file is meant to be
+          a centralized place for build config values much like config.h for
+          JavaScriptCore.
+        * offlineasm/generate_offset_extractor.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/offsets.rb:
+        * offlineasm/opt.rb:
+        * offlineasm/parser.rb: Parse and record annotations.
+        * offlineasm/registers.rb:
+        * offlineasm/self_hash.rb:
+        * offlineasm/settings.rb:
+        * offlineasm/transform.rb:
+        * offlineasm/x86.rb: Added handling of annotations.
+
+2012-07-13  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILED: use.useKind() != DoubleUse
+        https://bugs.webkit.org/show_bug.cgi?id=91082
+
+        Reviewed by Geoffrey Garen.
+
+        The implementation of Branch() was unwisely relying on register allocation state
+        to decide what speculations to perform. That's never correct.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122640.
+        http://trac.webkit.org/changeset/122640
+        https://bugs.webkit.org/show_bug.cgi?id=91298
+
+        LLInt apparently does not expect to mark these (Requested by
+        olliej on #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitStructures):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+
+2012-07-13  Oliver Hunt  <oliver@apple.com>
+
+        LLInt fails to mark structures stored in the bytecode
+        https://bugs.webkit.org/show_bug.cgi?id=91296
+
+        Reviewed by Geoffrey Garen.
+
+        LLInt stores structures in the bytecode, so we need to visit the appropriate
+        instructions as we would if we were running in the classic interpreter.
+        This requires adding additional checks for the LLInt specific opcodes, and
+        the lint specific variants of operand ordering. 
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitStructures):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+
+2012-07-13  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Implement GCActivityCallback with platform timer
+        https://bugs.webkit.org/show_bug.cgi?id=90175
+
+        Reviewed by Rob Buis.
+
+        Implement GCActivityCallback and HeapTimer for BlackBerry port.
+
+        * heap/HeapTimer.cpp:
+        (JSC):
+        (JSC::HeapTimer::HeapTimer):
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::timerDidFire):
+        (JSC::HeapTimer::synchronize):
+        (JSC::HeapTimer::invalidate):
+        (JSC::HeapTimer::didStartVMShutdown):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC):
+        (JSC::DefaultGCActivityCallback::doWork):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+        (JSC::DefaultGCActivityCallback::willCollect):
+        (JSC::DefaultGCActivityCallback::cancel):
+
+2012-07-13  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Fix compilation of DFGRepatch.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=91241
+
+        Reviewed by Geoffrey Garen.
+
+        Use intptr_t instead of uintptr_t when calling CodeLocationCommon::dataLabelPtrAtOffset(int)
+        to fix MSVC "unary minus operator applied to unsigned type, result still unsigned" warning.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+
+2012-07-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix ARM_TRADITIONAL JIT for COMPILER(MSVC) and COMPILER(RVCT) after r121885
+        https://bugs.webkit.org/show_bug.cgi?id=91238
+
+        Reviewed by Zoltan Herczeg.
+
+        r121885 changed the assembler instruction only for COMPILER(GCC).
+        Use the same instructions for the other compilers too.
+
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::ctiTrampolineEnd):
+        (JSC::ctiVMThrowTrampoline):
+
+2012-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG property access stubs should use structure transition watchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=91135
+
+        Reviewed by Geoffrey Garen.
+
+        This adds a Watchpoint subclass that will clear a structure stub (i.e.
+        a property access stub) when fired. The DFG stub generation code now
+        uses this optimization.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::resetStub):
+        (JSC::CodeBlock::resetStubInternal):
+        * bytecode/CodeBlock.h:
+        (JSC):
+        (CodeBlock):
+        * bytecode/StructureStubClearingWatchpoint.cpp: Added.
+        (JSC):
+        (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
+        (JSC::StructureStubClearingWatchpoint::push):
+        (JSC::StructureStubClearingWatchpoint::fireInternal):
+        (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo):
+        (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
+        (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
+        * bytecode/StructureStubClearingWatchpoint.h: Added.
+        (JSC):
+        (StructureStubClearingWatchpoint):
+        (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
+        (WatchpointsOnStructureStubInfo):
+        (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo):
+        (JSC::WatchpointsOnStructureStubInfo::codeBlock):
+        (JSC::WatchpointsOnStructureStubInfo::stubInfo):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::reset):
+        (JSC::StructureStubInfo::addWatchpoint):
+        (StructureStubInfo):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::addStructureTransitionCheck):
+        (DFG):
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::emitPutTransitionStub):
+        * jit/JumpReplacementWatchpoint.h:
+
+2012-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA may get overzealous in loops that have code that must exit
+        https://bugs.webkit.org/show_bug.cgi?id=91188
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure that if the CFA assumes that an operation must exit, then it will always exit
+        no matter what happens after. That's necessary to preserve soundness.
+        
+        Remove a broken fixup done by the DFG simplifier, where it was trying to say that the
+        variable-at-head was the first access in the second block in the merge, if the first
+        block did not read the variable. That's totally wrong, if the first block was in fact
+        doing a phantom read. I removed that fixup and instead hardened the rest of the
+        compiler.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::endBasicBlock):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
+        (JSC::DFG::ConstantFoldingPhase::run):
+        (ConstantFoldingPhase):
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+
+2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Implement MemoryUsageSupport
+        https://bugs.webkit.org/show_bug.cgi?id=91094
+
+        Reviewed by Adam Barth.
+
+        Compile in MemoryStatistics so we can make use of the interface.
+
+        * Target.pri:
+
+2012-07-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove dead code after r122392.
+        https://bugs.webkit.org/show_bug.cgi?id=91049
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
+2012-07-11  Adenilson Cavalcanti  <cavalcantii@gmail.com>
+
+        Build fix + remove dead code
+        https://bugs.webkit.org/show_bug.cgi?id=91039
+
+        Reviewed by Filip Pizlo.
+
+        An unused variable was breaking compilation (thanks to warnings being treated as errors).
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
+2012-07-11  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/91024> Build against the latest SDK when targeting older OS X versions.
+
+        Reviewed by Dan Bernstein.
+
+        The deployment target is already set to the version that we're targeting, and it's that setting
+        which determines which functionality from the SDK is available to us.
+
+        * Configurations/Base.xcconfig:
+
+2012-07-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have fast virtual calls
+        https://bugs.webkit.org/show_bug.cgi?id=90924
+
+        Reviewed by Gavin Barraclough.
+        
+        Implements virtual call support in the style of the old JIT, with the
+        caveat that we still use the same slow path for both InternalFunction
+        calls and JSFunction calls. Also rationalized the way that our
+        CodeOrigin indices tie into exception checks (previously it was a
+        strange one-to-one mapping with fairly limited assertions; now it's a
+        one-to-many mapping for CodeOrigins to exception checks, respectively).
+        I also took the opportunity to clean up
+        CallLinkInfo::callReturnLocation, which previously was either a Call or
+        a NearCall. Now it's just a NearCall. As well, exceptions during slow
+        path call resolution are now handled by returning an exception throwing
+        thunk rather than returning null. And finally, I made a few things
+        public that were previously private-with-lots-of-friends, because I
+        truly despise the thought of listing each thunk generating function as
+        a friend of JSValue and friends.
+        
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CallLinkInfo.h:
+        (CallLinkInfo):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::CodeOrigin):
+        (JSC::CodeOrigin::isSet):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::CCallHelpers):
+        * dfg/DFGGPRInfo.h:
+        (GPRInfo):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::CallBeginToken::CallBeginToken):
+        (JSC::DFG::CallBeginToken::~CallBeginToken):
+        (CallBeginToken):
+        (JSC::DFG::CallBeginToken::set):
+        (JSC::DFG::CallBeginToken::registerWithExceptionCheck):
+        (JSC::DFG::CallBeginToken::codeOrigin):
+        (JSC::DFG::CallExceptionRecord::CallExceptionRecord):
+        (CallExceptionRecord):
+        (JSC::DFG::JITCompiler::currentCodeOriginIndex):
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::beginCall):
+        (JSC::DFG::JITCompiler::notifyCall):
+        (JSC::DFG::JITCompiler::prepareForExceptionCheck):
+        (JSC::DFG::JITCompiler::addExceptionCheck):
+        (JSC::DFG::JITCompiler::addFastExceptionCheck):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::emitPointerValidation):
+        (DFG):
+        (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
+        (JSC::DFG::slowPathFor):
+        (JSC::DFG::linkForThunkGenerator):
+        (JSC::DFG::linkCallThunkGenerator):
+        (JSC::DFG::linkConstructThunkGenerator):
+        (JSC::DFG::virtualForThunkGenerator):
+        (JSC::DFG::virtualCallThunkGenerator):
+        (JSC::DFG::virtualConstructThunkGenerator):
+        * dfg/DFGThunks.h:
+        (DFG):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkFor):
+        * runtime/Executable.h:
+        (ExecutableBase):
+        (JSC::ExecutableBase::offsetOfJITCodeFor):
+        (JSC::ExecutableBase::offsetOfNumParametersFor):
+        * runtime/JSValue.h:
+        (JSValue):
+
+2012-07-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Accidentally used the wrong license (3-clause instead of 2-clause) in some
+        files I just committed.
+
+        Rubber stamped by Oliver Hunt.
+
+        * bytecode/Watchpoint.cpp:
+        * bytecode/Watchpoint.h:
+        * jit/JumpReplacementWatchpoint.cpp:
+        * jit/JumpReplacementWatchpoint.h:
+
+2012-07-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Watchpoints and jump replacement should be decoupled
+        https://bugs.webkit.org/show_bug.cgi?id=91016
+
+        Reviewed by Oliver Hunt.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC):
+        (Label):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::appendWatchpoint):
+        (JSC::CodeBlock::watchpoint):
+        (DFGData):
+        * bytecode/Watchpoint.cpp:
+        (JSC):
+        * bytecode/Watchpoint.h:
+        (JSC::Watchpoint::Watchpoint):
+        (Watchpoint):
+        (JSC::Watchpoint::fire):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        * jit/JumpReplacementWatchpoint.cpp: Added.
+        (JSC):
+        (JSC::JumpReplacementWatchpoint::correctLabels):
+        (JSC::JumpReplacementWatchpoint::fireInternal):
+        * jit/JumpReplacementWatchpoint.h: Added.
+        (JSC):
+        (JumpReplacementWatchpoint):
+        (JSC::JumpReplacementWatchpoint::JumpReplacementWatchpoint):
+        (JSC::JumpReplacementWatchpoint::setDestination):
+
+2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed build fix. Don't try to build udis86_itab.c since it's included by 
+        another file.
+
+        * wscript:
+
+2012-07-11  Chao-ying Fu  <fu@mips.com>
+
+        Add MIPS convertibleLoadPtr and other functions
+        https://bugs.webkit.org/show_bug.cgi?id=90714
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::labelIgnoringWatchpoints):
+        (MIPSAssembler):
+        (JSC::MIPSAssembler::replaceWithLoad):
+        (JSC::MIPSAssembler::replaceWithAddressComputation):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::convertibleLoadPtr):
+        (MacroAssemblerMIPS):
+
+2012-07-11  Anders Carlsson  <andersca@apple.com>
+
+        Add -Wtautological-compare and -Wsign-compare warning flags
+        https://bugs.webkit.org/show_bug.cgi?id=90994
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig:
+
+2012-07-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        Simplify the copying of JSC ARMv7's LinkRecord
+        https://bugs.webkit.org/show_bug.cgi?id=90930
+
+        Reviewed by Filip Pizlo.
+
+        The class LinkRecord is used by value everywhere in ARMv7Assembler. The compiler uses
+        memmove() to move the objects.
+
+        The problem is memmove() is overkill for this object, moving the value can be done with
+        3 load-store. This patch adds an operator= to the class doing more efficient copying.
+        This reduces the link time by 19%.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
+        (JSC::ARMv7Assembler::LinkRecord::operator=):
+        (JSC::ARMv7Assembler::LinkRecord::from):
+        (JSC::ARMv7Assembler::LinkRecord::setFrom):
+        (JSC::ARMv7Assembler::LinkRecord::to):
+        (JSC::ARMv7Assembler::LinkRecord::type):
+        (JSC::ARMv7Assembler::LinkRecord::linkType):
+        (JSC::ARMv7Assembler::LinkRecord::setLinkType):
+        (JSC::ARMv7Assembler::LinkRecord::condition):
+
+2012-07-11  Andy Wingo  <wingo@igalia.com>
+
+        jsc: Parse options before creating global data
+        https://bugs.webkit.org/show_bug.cgi?id=90975
+
+        Reviewed by Filip Pizlo.
+
+        This patch moves the options parsing in "jsc" before the creation
+        of the JSGlobalData, so that --useJIT=no has a chance to take
+        effect.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments): Refactor to be a class, and take
+        argc and argv as constructor arguments.
+        (jscmain): Move arg parsing before JSGlobalData creation.
+
+2012-07-10  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r122166): It made 170 tests crash on 32 bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=90852
+
+        Reviewed by Zoltan Herczeg.
+        
+        If we can't use the range filter, we should still make sure that the
+        address is remotely sane, otherwise the hashtables will assert.
+
+        * jit/JITStubRoutine.h:
+        (JSC::JITStubRoutine::passesFilter):
+
+2012-07-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG recompilation heuristics should be based on count, not rate
+        https://bugs.webkit.org/show_bug.cgi?id=90146
+
+        Reviewed by Oliver Hunt.
+        
+        Rolling r121511 back in after fixing the DFG's interpretation of op_div
+        profiling, with Gavin's rubber stamp.
+
+        This removes a bunch of code that was previously trying to prevent spurious
+        reoptimizations if a large enough majority of executions of a code block did
+        not result in OSR exit. It turns out that this code was purely harmful. This
+        patch removes all of that logic and replaces it with a dead-simple
+        heuristic: if you exit more than N times (where N is an exponential function
+        of the number of times the code block has already been recompiled) then we
+        will recompile.
+        
+        This appears to be a broad ~1% win on many benchmarks large and small.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::couldTakeSpecialFastCase):
+        (CodeBlock):
+        (JSC::CodeBlock::osrExitCounter):
+        (JSC::CodeBlock::countOSRExit):
+        (JSC::CodeBlock::addressOfOSRExitCounter):
+        (JSC::CodeBlock::offsetOfOSRExitCounter):
+        (JSC::CodeBlock::adjustedExitCountThreshold):
+        (JSC::CodeBlock::exitCountThresholdForReoptimization):
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::setThreshold):
+        * bytecode/ExecutionCounter.h:
+        (ExecutionCounter):
+        (JSC::ExecutionCounter::clippedThreshold):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Options.h:
+        (JSC):
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/121511
+        It made in-browser V8v7 10% slower.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::countSpeculationSuccess):
+        (JSC::CodeBlock::countSpeculationFailure):
+        (JSC::CodeBlock::speculativeSuccessCounter):
+        (JSC::CodeBlock::speculativeFailCounter):
+        (JSC::CodeBlock::forcedOSRExitCounter):
+        (JSC::CodeBlock::addressOfSpeculativeSuccessCounter):
+        (JSC::CodeBlock::addressOfSpeculativeFailCounter):
+        (JSC::CodeBlock::addressOfForcedOSRExitCounter):
+        (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter):
+        (JSC::CodeBlock::offsetOfSpeculativeFailCounter):
+        (JSC::CodeBlock::offsetOfForcedOSRExitCounter):
+        (JSC::CodeBlock::largeFailCountThreshold):
+        (JSC::CodeBlock::largeFailCountThresholdForLoop):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::setThreshold):
+        * bytecode/ExecutionCounter.h:
+        (ExecutionCounter):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Options.h:
+        (JSC):
+
+2012-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG may get stuck in an infinite fix point if it constant folds a mispredicted node
+        https://bugs.webkit.org/show_bug.cgi?id=90829
+        <rdar://problem/11823843>
+
+        Reviewed by Oliver Hunt.
+        
+        If a node is shown to have been mispredicted during CFA, then don't allow constant
+        folding to make the graph even more degenerate. Instead, pull back on constant folding
+        and allow the normal OSR machinery to fix our profiling so that a future recompilation
+        doesn't see the same mistake.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::trySetConstant):
+        (AbstractState):
+        * dfg/DFGPhase.h:
+        (JSC::DFG::Phase::name):
+        (Phase):
+        (JSC::DFG::runAndLog):
+        (DFG):
+        (JSC::DFG::runPhase):
+
+2012-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to jettison JIT stub routines even if they are currently running
+        https://bugs.webkit.org/show_bug.cgi?id=90731
+
+        Reviewed by Gavin Barraclough.
+        
+        This gives the GC awareness of all JIT-generated stubs for inline caches. That
+        means that if you want to delete a JIT-generated stub, you don't have to worry
+        about whether or not it is currently running: if there is a chance that it might
+        be, the GC will kindly defer deletion until non-running-ness is proved.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/Instruction.h:
+        (JSC):
+        (PolymorphicStubInfo):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::fromStructureStubInfo):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::replace):
+        (JSC::PutByIdAccess::stubRoutine):
+        (PutByIdAccess):
+        (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::reset):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * heap/ConservativeRoots.cpp:
+        (JSC):
+        (DummyMarkHook):
+        (JSC::DummyMarkHook::mark):
+        (JSC::ConservativeRoots::add):
+        (CompositeMarkHook):
+        (JSC::CompositeMarkHook::CompositeMarkHook):
+        (JSC::CompositeMarkHook::mark):
+        * heap/ConservativeRoots.h:
+        (JSC):
+        (ConservativeRoots):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * heap/JITStubRoutineSet.cpp: Added.
+        (JSC):
+        (JSC::JITStubRoutineSet::JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::~JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::add):
+        (JSC::JITStubRoutineSet::clearMarks):
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
+        * heap/JITStubRoutineSet.h: Added.
+        (JSC):
+        (JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::mark):
+        * heap/MachineStackMarker.h:
+        (JSC):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h:
+        (JSC):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC):
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        * jit/GCAwareJITStubRoutine.cpp: Added.
+        (JSC):
+        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
+        (JSC::GCAwareJITStubRoutine::deleteFromGC):
+        (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal):
+        (JSC::createJITStubRoutine):
+        * jit/GCAwareJITStubRoutine.h: Added.
+        (JSC):
+        (GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::markRequiredObjects):
+        (MarkingGCAwareJITStubRoutineWithOneObject):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubRoutine.cpp: Added.
+        (JSC):
+        (JSC::JITStubRoutine::~JITStubRoutine):
+        (JSC::JITStubRoutine::observeZeroRefCount):
+        * jit/JITStubRoutine.h: Added.
+        (JSC):
+        (JITStubRoutine):
+        (JSC::JITStubRoutine::JITStubRoutine):
+        (JSC::JITStubRoutine::createSelfManagedRoutine):
+        (JSC::JITStubRoutine::code):
+        (JSC::JITStubRoutine::asCodePtr):
+        (JSC::JITStubRoutine::ref):
+        (JSC::JITStubRoutine::deref):
+        (JSC::JITStubRoutine::startAddress):
+        (JSC::JITStubRoutine::endAddress):
+        (JSC::JITStubRoutine::addressStep):
+        (JSC::JITStubRoutine::canPerformRangeFilter):
+        (JSC::JITStubRoutine::filteringStartAddress):
+        (JSC::JITStubRoutine::filteringExtentSize):
+        (JSC::JITStubRoutine::passesFilter):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122107.
+        http://trac.webkit.org/changeset/122107
+        https://bugs.webkit.org/show_bug.cgi?id=90794
+
+        Build failure on Mac debug bots (Requested by falken_ on
+        #webkit).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        gcc build fix after r121925.
+
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::finishCreation):
+
+2012-07-08  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt][ARM] Implementing missing macro assembler instructions after r121925
+        https://bugs.webkit.org/show_bug.cgi?id=90657
+
+        Reviewed by Csaba Osztrogonác.
+
+        Implementing convertibleLoadPtr, replaceWithLoad and
+        replaceWithAddressComputation.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::replaceWithLoad):
+        (ARMAssembler):
+        (JSC::ARMAssembler::replaceWithAddressComputation):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::convertibleLoadPtr):
+        (MacroAssemblerARM):
+
+2012-07-06  Filip Pizlo  <fpizlo@apple.com>
+
+        WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap
+        https://bugs.webkit.org/show_bug.cgi?id=90703
+
+        Reviewed by Michael Saboff.
+        
+        It turns out that in my object model refactoring, I managed to fix get_by_pname in all
+        execution engines except 64-bit baseline JIT.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_pname):
+
+2012-07-06  Pravin D  <pravind.2k4@gmail.com>
+
+        Build Error on Qt Linux build
+        https://bugs.webkit.org/show_bug.cgi?id=90699
+
+        Reviewed by Laszlo Gombos.
+
+        * parser/Parser.cpp:
+        (JSC::::parseForStatement):
+        Removed unused boolean variable as this was causing build error on Qt Linux.
+
+2012-07-06  Nuno Lopes  <nlopes@apple.com>
+
+        Fix build with recent clang.
+        https://bugs.webkit.org/show_bug.cgi?id=90634
+
+        Reviewed by Oliver Hunt.
+
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (SpecializedThunkJIT):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/NodeConstructors.h:
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.h:
+        (FunctionCallResolveNode):
+        (PostfixErrorNode):
+        (PrefixErrorNode):
+        (ReadModifyResolveNode):
+        (AssignResolveNode):
+        (AssignErrorNode):
+        (ForNode):
+        (ForInNode):
+        * parser/Parser.cpp:
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseForStatement):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createForLoop):
+
+2012-07-06  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=90656
+
+        Reviewed by Csaba Osztrogonác.
+
+        Typo fixes.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        Rename getOp2Byte() -> getOp2Half()
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
+        Add a necessary space.
+        * jit/JITStubs.cpp:
+        (JSC):
+        Revert INLINE_ARM_FUNCTION macro.
+
+2012-07-05  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms
+        https://bugs.webkit.org/show_bug.cgi?id=90658
+
+        Reviewed by Zoltan Herczeg.
+        
+        Under the new object model, out-of-line property accesses such as those
+        in ResolveGlobal must account for the fact that the offset to the Kth
+        property is represented by K + inlineStorageCapacity. Hence, the property
+        loads in ResolveGlobal must have an additional -inlineStorageCapacity *
+        sizeof(JSValue) offset.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-07-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed 64 bit buildfix after r121925.
+
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+
+2012-07-05  Michael Saboff  <msaboff@apple.com>
+
+        JSString::tryHashConstLock() fails to get exclusive lock
+        https://bugs.webkit.org/show_bug.cgi?id=90639
+
+        Reviewed by Oliver Hunt.
+
+        Added check that the string is already locked even before compare and swap.
+
+        * heap/MarkStack.cpp:
+        (JSC::JSString::tryHashConstLock):
+
+2012-07-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Inline property storage should not be wasted when it is exhausted
+        https://bugs.webkit.org/show_bug.cgi?id=90347
+
+        Reviewed by Gavin Barraclough.
+        
+        Previously, if we switched an object from using inline storage to out-of-line
+        storage, we would abandon the inline storage. This would have two main implications:
+        (i) all accesses to the object, even for properties that were previously in inline
+        storage, must now take an extra indirection; and (ii) we waste a non-trivial amount
+        of space since we must allocate additional out-of-line storage to hold properties
+        that would have fit in the inline storage. There's also the copying cost when
+        switching to out-of-line storage - we must copy all inline properties into ouf-of-line
+        storage.
+        
+        This patch changes the way that object property storage works so that we can use both
+        inline and out-of-line storage concurrently. This is accomplished by introducing a
+        new notion of property offset. This PropertyOffset is a 32-bit signed integer and it
+        behaves as follows:
+        
+        offset == -1: invalid offset, indicating a property that does not exist.
+        
+        0 <= offset <= inlineStorageCapacity: offset into inline storage.
+        
+        inlineStorageCapacity < offset: offset into out-of-line storage.
+        
+        Because non-final objects don't have inline storage, the only valid PropertyOffsets
+        for those objects' properties are -1 or > inlineStorageCapacity.
+        
+        This now means that the decision to use inline or out-of-line storage for an access is
+        made based on the offset, rather than the structure. It also means that any access
+        where the offset is a variable must have an extra branch, unless the type of the
+        object is also known (if it's known to be a non-final object then we can just assert
+        that the offset is >= inlineStorageCapacity).
+        
+        This looks like a big Kraken speed-up and a slight V8 speed-up.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::ldrWide8BitImmediate):
+        (JSC::ARMv7Assembler::replaceWithLoad):
+        (JSC::ARMv7Assembler::replaceWithAddressComputation):
+        * assembler/AbstractMacroAssembler.h:
+        (AbstractMacroAssembler):
+        (ConvertibleLoadLabel):
+        (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel):
+        (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet):
+        (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
+        (JSC::AbstractMacroAssembler::replaceWithLoad):
+        (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
+        * assembler/CodeLocation.h:
+        (JSC):
+        (CodeLocationCommon):
+        (CodeLocationConvertibleLoad):
+        (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
+        (JSC::CodeLocationCommon::convertibleLoadAtOffset):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * assembler/LinkBuffer.h:
+        (LinkBuffer):
+        (JSC::LinkBuffer::locationOf):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::convertibleLoadPtr):
+        (MacroAssemblerX86):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::convertibleLoadPtr):
+        (MacroAssemblerX86_64):
+        * assembler/RepatchBuffer.h:
+        (RepatchBuffer):
+        (JSC::RepatchBuffer::replaceWithLoad):
+        (JSC::RepatchBuffer::replaceWithAddressComputation):
+        (JSC::RepatchBuffer::setLoadInstructionIsActive):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::replaceWithLoad):
+        (X86Assembler):
+        (JSC::X86Assembler::replaceWithAddressComputation):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::offset):
+        (GetByIdStatus):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (JSC::PutByIdStatus::offset):
+        (PutByIdStatus):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC):
+        (JSC::computeForStructure):
+        * bytecode/ResolveGlobalStatus.h:
+        (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
+        (JSC::ResolveGlobalStatus::offset):
+        (ResolveGlobalStatus):
+        * bytecode/StructureSet.h:
+        (StructureSet):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+        (PropertyAccessRecord):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchByIdSelfAccess):
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/MarkStack.cpp:
+        (JSC::visitChildren):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        * jit/JIT.h:
+        (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/x86.rb:
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::functionNameOffset):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        (JSC):
+        (JSC::JSFinalObject::visitChildren):
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::hasInlineStorage):
+        (JSC::JSObject::inlineStorageUnsafe):
+        (JSC::JSObject::inlineStorage):
+        (JSC::JSObject::outOfLineStorage):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::addressOfOutOfLineStorage):
+        (JSC::JSObject::finishCreation):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSFinalObject):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSObject::offsetOfOutOfLineStorage):
+        (JSC::JSObject::setOutOfLineStorage):
+        (JSC::JSObject::JSObject):
+        (JSC):
+        (JSC::JSCell::fastGetOwnProperty):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::offsetRelativeToPatchedStorage):
+        (JSC::indexRelativeToBase):
+        (JSC::offsetRelativeToBase):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::getOffset):
+        (JSC::JSPropertyNameIterator::finishCreation):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Options.cpp:
+        (JSC):
+        (JSC::Options::initialize):
+        * runtime/PropertyMapHashTable.h:
+        (PropertyMapEntry):
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (PropertyTable):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::getDeletedOffset):
+        (JSC::PropertyTable::addDeletedOffset):
+        (JSC::PropertyTable::nextOffset):
+        (JSC):
+        (JSC::PropertyTable::sizeInMemory):
+        * runtime/PropertyOffset.h: Added.
+        (JSC):
+        (JSC::checkOffset):
+        (JSC::validateOffset):
+        (JSC::isValidOffset):
+        (JSC::isInlineOffset):
+        (JSC::isOutOfLineOffset):
+        (JSC::offsetInInlineStorage):
+        (JSC::offsetInOutOfLineStorage):
+        (JSC::offsetInRespectiveStorage):
+        (JSC::numberOfOutOfLineSlotsForLastOffset):
+        (JSC::numberOfSlotsForLastOffset):
+        (JSC::nextPropertyOffsetFor):
+        (JSC::firstPropertyOffsetFor):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::cachedOffset):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::cachedOffset):
+        (PutPropertySlot):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::nextOutOfLineStorageCapacity):
+        (JSC::Structure::growOutOfLineCapacity):
+        (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::get):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::previousID):
+        (JSC::Structure::outOfLineCapacity):
+        (JSC::Structure::outOfLineSizeForKnownFinalObject):
+        (JSC::Structure::outOfLineSizeForKnownNonFinalObject):
+        (JSC::Structure::outOfLineSize):
+        (JSC::Structure::hasInlineStorage):
+        (JSC::Structure::inlineCapacity):
+        (JSC::Structure::inlineSizeForKnownFinalObject):
+        (JSC::Structure::inlineSize):
+        (JSC::Structure::totalStorageSize):
+        (JSC::Structure::totalStorageCapacity):
+        (JSC::Structure::firstValidOffset):
+        (JSC::Structure::lastValidOffset):
+        (JSC::Structure::isValidOffset):
+        (JSC::Structure::isEmpty):
+        (JSC::Structure::transitionCount):
+        (JSC::Structure::get):
+
+2012-07-05  Oliver Hunt  <oliver@apple.com>
+
+        JSObjectCallAsFunction should thisConvert the provided thisObject
+        https://bugs.webkit.org/show_bug.cgi?id=90628
+
+        Reviewed by Gavin Barraclough.
+
+        Perform this conversion on the provided this object.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+
+2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt] Unreviewed buildfix after r121886. Typo fix.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+
+2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Port DFG JIT to traditional ARM
+        https://bugs.webkit.org/show_bug.cgi?id=90198
+
+        Reviewed by Filip Pizlo.
+
+        This patch contains the macro assembler part of the
+        DFG JIT support on ARM systems with fixed 32 bit instruction
+        width. A large amount of old code was refactored, and the ARMv4
+        or lower support is removed from the macro assembler.
+
+        Sunspider is improved by 8%, and V8 is 92%.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        (JSC):
+        (JSC::ARMAssembler::dataTransfer16):
+        (JSC::ARMAssembler::baseIndexTransfer16):
+        (JSC::ARMAssembler::dataTransferFloat):
+        (JSC::ARMAssembler::baseIndexTransferFloat):
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::ARMAssembler):
+        (JSC::ARMAssembler::emitInst):
+        (JSC::ARMAssembler::vmov_f64_r):
+        (ARMAssembler):
+        (JSC::ARMAssembler::vabs_f64_r):
+        (JSC::ARMAssembler::vneg_f64_r):
+        (JSC::ARMAssembler::ldr_imm):
+        (JSC::ARMAssembler::ldr_un_imm):
+        (JSC::ARMAssembler::dtr_u):
+        (JSC::ARMAssembler::dtr_ur):
+        (JSC::ARMAssembler::dtr_d):
+        (JSC::ARMAssembler::dtr_dr):
+        (JSC::ARMAssembler::dtrh_u):
+        (JSC::ARMAssembler::dtrh_ur):
+        (JSC::ARMAssembler::dtrh_d):
+        (JSC::ARMAssembler::dtrh_dr):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::fdtr_d):
+        (JSC::ARMAssembler::push_r):
+        (JSC::ARMAssembler::pop_r):
+        (JSC::ARMAssembler::poke_r):
+        (JSC::ARMAssembler::peek_r):
+        (JSC::ARMAssembler::vmov_vfp64_r):
+        (JSC::ARMAssembler::vmov_arm64_r):
+        (JSC::ARMAssembler::vmov_vfp32_r):
+        (JSC::ARMAssembler::vmov_arm32_r):
+        (JSC::ARMAssembler::vcvt_u32_f64_r):
+        (JSC::ARMAssembler::vcvt_f64_f32_r):
+        (JSC::ARMAssembler::vcvt_f32_f64_r):
+        (JSC::ARMAssembler::clz_r):
+        (JSC::ARMAssembler::bkpt):
+        (JSC::ARMAssembler::bx):
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::labelIgnoringWatchpoints):
+        (JSC::ARMAssembler::labelForWatchpoint):
+        (JSC::ARMAssembler::label):
+        (JSC::ARMAssembler::getLdrImmAddress):
+        (JSC::ARMAssembler::replaceWithJump):
+        (JSC::ARMAssembler::maxJumpReplacementSize):
+        (JSC::ARMAssembler::getOp2Byte):
+        (JSC::ARMAssembler::getOp2Half):
+        (JSC::ARMAssembler::RM):
+        (JSC::ARMAssembler::RS):
+        (JSC::ARMAssembler::RD):
+        (JSC::ARMAssembler::RN):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::mul32):
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::urshift32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::load8):
+        (JSC::MacroAssemblerARM::load8Signed):
+        (JSC::MacroAssemblerARM::load16):
+        (JSC::MacroAssemblerARM::load16Signed):
+        (JSC::MacroAssemblerARM::load32):
+        (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::store8):
+        (JSC::MacroAssemblerARM::store16):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::jump):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::mull32):
+        (JSC::MacroAssemblerARM::branchMul32):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::compare32):
+        (JSC::MacroAssemblerARM::test32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::loadFloat):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeFloat):
+        (JSC::MacroAssemblerARM::storeDouble):
+        (JSC::MacroAssemblerARM::moveDouble):
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::absDouble):
+        (JSC::MacroAssemblerARM::negateDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::convertFloatToDouble):
+        (JSC::MacroAssemblerARM::convertDoubleToFloat):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
+        (JSC::MacroAssemblerARM::truncateDoubleToInt32):
+        (JSC::MacroAssemblerARM::truncateDoubleToUint32):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerARM::branchDoubleNonZero):
+        (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
+        (JSC::MacroAssemblerARM::invert):
+        (JSC::MacroAssemblerARM::replaceWithJump):
+        (JSC::MacroAssemblerARM::maxJumpReplacementSize):
+        (JSC::MacroAssemblerARM::call32):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::label):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        (JSC::DFG::AssemblyHelpers::boxDouble):
+        (JSC::DFG::AssemblyHelpers::unboxDouble):
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        * dfg/DFGFPRInfo.h:
+        (DFG):
+        * dfg/DFGGPRInfo.h:
+        (DFG):
+        (GPRInfo):
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        * jit/JITStubs.cpp:
+        (JSC):
+        * jit/JITStubs.h:
+        (JITStackFrame):
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+
+2012-07-04  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
+        https://bugs.webkit.org/show_bug.cgi?id=40118
+
+        Reviewed by Yong Li.
+
+        Added member functions to expose function name, urlString, and line #.
+        Refactored toString to make use of these member functions to reduce
+        duplicated code for future maintenance.
+
+        Manually tested refactoring of toString by tracing thrown exceptions.
+
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::toString):
+        (JSC::StackFrame::friendlySourceURL):
+        (JSC::StackFrame::friendlyFunctionName):
+        (JSC::StackFrame::friendlyLineNumber):
+
+2012-07-04  Andy Wingo  <wingo@igalia.com>
+
+        [GTK] Enable parallel GC
+        https://bugs.webkit.org/show_bug.cgi?id=90568
+
+        Reviewed by Martin Robinson.
+
+        * runtime/Options.cpp: Include <algorithm.h> for std::min.
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing.
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-03  Michael Saboff  <msaboff@apple.com>
+
+        Enh: Hash Const JSString in Backing Stores to Save Memory
+        https://bugs.webkit.org/show_bug.cgi?id=86024
+
+        Reviewed by Oliver Hunt.
+
+        During garbage collection, each marking thread keeps a HashMap of
+        strings.  While visiting via MarkStack::copyAndAppend(), we check to
+        see if the string we are visiting is already in the HashMap.  If not
+        we add it. If so, we change the reference to the current string we're
+        visiting to the prior string.
+
+        To reduce the performance impact of this change, two throttles have
+        ben added.  1) We only try hash consting if a significant number of new 
+        strings have been created since the last hash const.  Currently this is
+        set at 100 strings.  2) If a string is unique at the end of a marking
+        it will not be checked during further GC phases. In some cases this
+        won't catch all duplicates, but we are trying to catch the growth of
+        duplicate strings.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::resetChildren):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::MarkStackThreadSharedData::reset):
+        (JSC::MarkStack::setup): Check to see if enough strings have been created
+        to hash const.
+        (JSC::MarkStack::reset): Added call to clear m_uniqueStrings.
+        (JSC::JSString::tryHashConstLock): New method to lock JSString for
+        hash consting.
+        (JSC::JSString::releaseHashConstLock): New unlock method.
+        (JSC::JSString::shouldTryHashConst): Set of checks to see if we should
+        try to hash const the string.
+        (JSC::MarkStack::internalAppend): New method that performs the hash consting.
+        (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash
+        consting internalAppend().
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        (MarkStack):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::haveEnoughNewStringsToHashConst):
+        (JSC::JSGlobalData::resetNewStringsSinceLastHashConst):
+        * runtime/JSString.h:
+        (JSString): Changed from using bool flags to using an unsigned
+        m_flags field.  This works better with the weakCompareAndSwap in
+        JSString::tryHashConstLock(). Changed the 8bitness setting and
+        checking to use new accessors.
+        (JSC::JSString::JSString):
+        (JSC::JSString::finishCreation):
+        (JSC::JSString::is8Bit): Updated for new m_flags.
+        (JSC::JSString::setIs8Bit): New setter.
+        New hash const flags accessors:
+        (JSC::JSString::isHashConstSingleton):
+        (JSC::JSString::clearHashConstSingleton):
+        (JSC::JSString::setHashConstSingleton):
+        (JSC::JSRopeString::finishCreation):
+        (JSC::JSRopeString::append):
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * JavaScriptCore.gyp/.gitignore:
+
+2012-07-03  Mark Lam  <mark.lam@apple.com>
+
+        Add ability to symbolically set and dump JSC VM options.
+        See comments in runtime/Options.h for details on how the options work.
+        https://bugs.webkit.org/show_bug.cgi?id=90420
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * assembler/LinkBuffer.h:
+        (JSC):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::reoptimizationRetryCounter):
+        (JSC::CodeBlock::countReoptimization):
+        (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
+        (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon):
+        (JSC::CodeBlock::exitCountThresholdForReoptimization):
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
+        * bytecode/ExecutionCounter.h:
+        (JSC::ExecutionCounter::clippedThreshold):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::shouldShowDisassembly):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackSegmentAllocator::allocate):
+        (JSC::MarkStackSegmentAllocator::shrinkReserve):
+        (JSC::MarkStackArray::MarkStackArray):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
+        (JSC::MarkStack::addOpaqueRoot):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::donate):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * jsc.cpp:
+        (printUsageStatement):
+        (parseArguments):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/Options.cpp:
+        (JSC):
+        (JSC::overrideOptionWithHeuristic):
+        (JSC::Options::initialize):
+        (JSC::Options::setOption):
+        (JSC::Options::dumpAllOptions):
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+        (JSC):
+        (Options):
+        (EntryInfo):
+
+2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
+
+        [Qt][Win] Fix broken QtWebKit5.lib linking
+        https://bugs.webkit.org/show_bug.cgi?id=88321
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF
+        when building JavaScriptCore, if both are packaged in the same DLL, instead
+        of relying on the code to handle this.
+        The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same
+        except for a check in Source/JavaScriptCore/config.h.
+
+        Keeping the old way for the WX port as requested by the port's contributors.
+        For non-Windows ports there is no difference between IMPORT and EXPORT, no
+        change is needed.
+
+        * API/JSBase.h:
+          JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+          Make sure that JavaScriptCore uses import symbols of WTF for the Win port.
+        * runtime/JSExportMacros.h:
+
+2012-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit value recoveries should be computed lazily
+        https://bugs.webkit.org/show_bug.cgi?id=82155
+
+        Reviewed by Gavin Barraclough.
+        
+        This change aims to reduce one aspect of DFG compile times: the fact
+        that we currently compute the value recoveries for each local and
+        argument on every speculation check. We compile many speculation checks,
+        so this can add up quick. The strategy that this change takes is to
+        have the DFG save just enough information about how the compiler is
+        choosing to represent state, that the DFG::OSRExitCompiler can reify
+        the value recoveries lazily.
+        
+        This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere.
+        
+        I also took the opportunity to fix the sampling regions profiler (it
+        was missing an export macro) and to put in more sampling regions in
+        the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is
+        false).
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::shrinkDFGDataToFit):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::minifiedDFG):
+        (JSC::CodeBlock::variableEventStream):
+        (DFGData):
+        * bytecode/Operands.h:
+        (JSC::Operands::hasOperand):
+        (Operands):
+        (JSC::Operands::size):
+        (JSC::Operands::at):
+        (JSC::Operands::operator[]):
+        (JSC::Operands::isArgument):
+        (JSC::Operands::isVariable):
+        (JSC::Operands::argumentForIndex):
+        (JSC::Operands::variableForIndex):
+        (JSC::Operands::operandForIndex):
+        (JSC):
+        (JSC::dumpOperands):
+        * bytecode/SamplingTool.h:
+        (SamplingRegion):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::parse):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::performCFA):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::performCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::performFixup):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::GenerationInfo):
+        (JSC::DFG::GenerationInfo::initConstant):
+        (JSC::DFG::GenerationInfo::initInteger):
+        (JSC::DFG::GenerationInfo::initJSValue):
+        (JSC::DFG::GenerationInfo::initCell):
+        (JSC::DFG::GenerationInfo::initBoolean):
+        (JSC::DFG::GenerationInfo::initDouble):
+        (JSC::DFG::GenerationInfo::initStorage):
+        (GenerationInfo):
+        (JSC::DFG::GenerationInfo::noticeOSRBirth):
+        (JSC::DFG::GenerationInfo::use):
+        (JSC::DFG::GenerationInfo::spill):
+        (JSC::DFG::GenerationInfo::setSpilled):
+        (JSC::DFG::GenerationInfo::fillJSValue):
+        (JSC::DFG::GenerationInfo::fillCell):
+        (JSC::DFG::GenerationInfo::fillInteger):
+        (JSC::DFG::GenerationInfo::fillBoolean):
+        (JSC::DFG::GenerationInfo::fillDouble):
+        (JSC::DFG::GenerationInfo::fillStorage):
+        (JSC::DFG::GenerationInfo::appendFill):
+        (JSC::DFG::GenerationInfo::appendSpill):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGMinifiedGraph.h: Added.
+        (DFG):
+        (MinifiedGraph):
+        (JSC::DFG::MinifiedGraph::MinifiedGraph):
+        (JSC::DFG::MinifiedGraph::at):
+        (JSC::DFG::MinifiedGraph::append):
+        (JSC::DFG::MinifiedGraph::prepareAndShrink):
+        (JSC::DFG::MinifiedGraph::setOriginalGraphSize):
+        (JSC::DFG::MinifiedGraph::originalGraphSize):
+        * dfg/DFGMinifiedNode.cpp: Added.
+        (DFG):
+        (JSC::DFG::MinifiedNode::fromNode):
+        * dfg/DFGMinifiedNode.h: Added.
+        (DFG):
+        (JSC::DFG::belongsInMinifiedGraph):
+        (MinifiedNode):
+        (JSC::DFG::MinifiedNode::MinifiedNode):
+        (JSC::DFG::MinifiedNode::index):
+        (JSC::DFG::MinifiedNode::op):
+        (JSC::DFG::MinifiedNode::hasChild1):
+        (JSC::DFG::MinifiedNode::child1):
+        (JSC::DFG::MinifiedNode::hasConstant):
+        (JSC::DFG::MinifiedNode::hasConstantNumber):
+        (JSC::DFG::MinifiedNode::constantNumber):
+        (JSC::DFG::MinifiedNode::hasWeakConstant):
+        (JSC::DFG::MinifiedNode::weakConstant):
+        (JSC::DFG::MinifiedNode::getIndex):
+        (JSC::DFG::MinifiedNode::compareByNodeIndex):
+        (JSC::DFG::MinifiedNode::hasChild):
+        * dfg/DFGNode.h:
+        (Node):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler.h:
+        (OSRExitCompiler):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::performPredictionPropagation):
+        * dfg/DFGRedundantPhiEliminationPhase.cpp:
+        (JSC::DFG::performRedundantPhiElimination):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+        (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::use):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::recordSetLocal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueRecoveryOverride.h: Added.
+        (DFG):
+        (ValueRecoveryOverride):
+        (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
+        * dfg/DFGValueSource.cpp: Added.
+        (DFG):
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h: Added.
+        (DFG):
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::valueSourceKindToDataFormat):
+        (JSC::DFG::isInRegisterFile):
+        (ValueSource):
+        (JSC::DFG::ValueSource::ValueSource):
+        (JSC::DFG::ValueSource::forPrediction):
+        (JSC::DFG::ValueSource::forDataFormat):
+        (JSC::DFG::ValueSource::isSet):
+        (JSC::DFG::ValueSource::kind):
+        (JSC::DFG::ValueSource::isInRegisterFile):
+        (JSC::DFG::ValueSource::dataFormat):
+        (JSC::DFG::ValueSource::valueRecovery):
+        (JSC::DFG::ValueSource::nodeIndex):
+        (JSC::DFG::ValueSource::nodeIndexFromKind):
+        (JSC::DFG::ValueSource::kindFromNodeIndex):
+        * dfg/DFGVariableEvent.cpp: Added.
+        (DFG):
+        (JSC::DFG::VariableEvent::dump):
+        (JSC::DFG::VariableEvent::dumpFillInfo):
+        (JSC::DFG::VariableEvent::dumpSpillInfo):
+        * dfg/DFGVariableEvent.h: Added.
+        (DFG):
+        (VariableEvent):
+        (JSC::DFG::VariableEvent::VariableEvent):
+        (JSC::DFG::VariableEvent::reset):
+        (JSC::DFG::VariableEvent::fillGPR):
+        (JSC::DFG::VariableEvent::fillPair):
+        (JSC::DFG::VariableEvent::fillFPR):
+        (JSC::DFG::VariableEvent::spill):
+        (JSC::DFG::VariableEvent::death):
+        (JSC::DFG::VariableEvent::setLocal):
+        (JSC::DFG::VariableEvent::movHint):
+        (JSC::DFG::VariableEvent::kind):
+        (JSC::DFG::VariableEvent::nodeIndex):
+        (JSC::DFG::VariableEvent::dataFormat):
+        (JSC::DFG::VariableEvent::gpr):
+        (JSC::DFG::VariableEvent::tagGPR):
+        (JSC::DFG::VariableEvent::payloadGPR):
+        (JSC::DFG::VariableEvent::fpr):
+        (JSC::DFG::VariableEvent::virtualRegister):
+        (JSC::DFG::VariableEvent::operand):
+        (JSC::DFG::VariableEvent::variableRepresentation):
+        * dfg/DFGVariableEventStream.cpp: Added.
+        (DFG):
+        (JSC::DFG::VariableEventStream::logEvent):
+        (MinifiedGenerationInfo):
+        (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo):
+        (JSC::DFG::MinifiedGenerationInfo::update):
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * dfg/DFGVariableEventStream.h: Added.
+        (DFG):
+        (VariableEventStream):
+        (JSC::DFG::VariableEventStream::appendAndLog):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::performVirtualRegisterAllocation):
+
+2012-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
+        https://bugs.webkit.org/show_bug.cgi?id=90407
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+
+2012-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Array.prototype.pop should throw if property is not configurable
+        https://bugs.webkit.org/show_bug.cgi?id=75788
+
+        Rubber Stamped by Oliver Hunt.
+
+        No real bug here any more, but the error we throw sometimes has a misleading message.
+ 
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+
+2012-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject wastes too much memory on unused property slots
+        https://bugs.webkit.org/show_bug.cgi?id=90255
+
+        Reviewed by Mark Hahnenberg.
+        
+        Rolling back in after applying a simple fix: it appears that
+        JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more
+        property storage than necessary. Fixing this appears to resolve the crash.
+        
+        This does a few things:
+        
+        - JSNonFinalObject no longer has inline property storage.
+        
+        - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
+          or 2x the inline storage for JSFinalObject.
+        
+        - Property storage is only reallocated if it needs to be. Previously, we
+          would reallocate the property storage on any transition where the original
+          structure said shouldGrowProperyStorage(), but this led to spurious
+          reallocations when doing transitionless property adds and there are
+          deleted property slots available. That in turn led to crashes, because we
+          would switch to out-of-line storage even if the capacity matched the
+          criteria for inline storage.
+        
+        - Inline JSFunction allocation is killed off because we don't have a good
+          way of inlining property storage allocation. This didn't hurt performance.
+          Killing off code is better than fixing it if that code wasn't doing any
+          good.
+        
+        This looks like a 1% progression on V8.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC):
+        (JSC::JIT::emit_op_new_func_exp):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSObject):
+        (JSC::JSObject::finishCreation):
+        (JSC):
+        (JSC::JSNonFinalObject::hasInlineStorage):
+        (JSNonFinalObject):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSC::JSFinalObject::hasInlineStorage):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSObject::offsetOfInlineStorage):
+        (JSC::JSObject::setPropertyStorage):
+        (JSC::Structure::inlineStorageCapacity):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::nextPropertyStorageCapacity):
+        (JSC):
+        (JSC::Structure::growPropertyStorageCapacity):
+        (JSC::Structure::suggestedNewPropertyStorageSize):
+        * runtime/Structure.h:
+        (JSC::Structure::putWillGrowPropertyStorage):
+        (Structure):
+
+2012-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Webkit crashes in DFG on Google Docs when creating a new document
+        https://bugs.webkit.org/show_bug.cgi?id=90209
+
+        Reviewed by Gavin Barraclough.
+        
+        Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a
+        captured variable.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
+2012-06-30  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed, rolling out r121605.
+        http://trac.webkit.org/changeset/121605
+        https://bugs.webkit.org/show_bug.cgi?id=90336
+
+        Changes caused flaky crashes in sputnik/Unicode tests on Apple
+        WK1 and GTK Linux builders
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC):
+        (JSC::JIT::emitAllocateJSFunction):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emitSlow_op_new_func):
+        (JSC):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emitSlow_op_new_func_exp):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSObject):
+        (JSC::JSObject::finishCreation):
+        (JSC):
+        (JSNonFinalObject):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSFinalObject):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSObject::offsetOfInlineStorage):
+        (JSC::JSObject::setPropertyStorage):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC):
+        (JSC::Structure::growPropertyStorageCapacity):
+        (JSC::Structure::suggestedNewPropertyStorageSize):
+        * runtime/Structure.h:
+        (JSC::Structure::shouldGrowPropertyStorage):
+        (JSC::Structure::propertyStorageSize):
+
+2012-06-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove warning about protected values when the Heap is being destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=90302
+
+        Reviewed by Geoffrey Garen.
+
+        Having to do book-keeping about whether values allocated from a certain 
+        VM are or are not protected makes the JSC API much more difficult to use 
+        correctly. Clients should be able to throw an entire VM away and not have 
+        to worry about unprotecting all of the values that they protected earlier.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+
+2012-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject wastes too much memory on unused property slots
+        https://bugs.webkit.org/show_bug.cgi?id=90255
+
+        Reviewed by Mark Hahnenberg.
+        
+        This does a few things:
+        
+        - JSNonFinalObject no longer has inline property storage.
+        
+        - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
+          or 2x the inline storage for JSFinalObject.
+        
+        - Property storage is only reallocated if it needs to be. Previously, we
+          would reallocate the property storage on any transition where the original
+          structure said shouldGrowProperyStorage(), but this led to spurious
+          reallocations when doing transitionless property adds and there are
+          deleted property slots available. That in turn led to crashes, because we
+          would switch to out-of-line storage even if the capacity matched the
+          criteria for inline storage.
+        
+        - Inline JSFunction allocation is killed off because we don't have a good
+          way of inlining property storage allocation. This didn't hurt performance.
+          Killing off code is better than fixing it if that code wasn't doing any
+          good.
+        
+        This looks like a 1% progression on V8.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC):
+        (JSC::JIT::emit_op_new_func_exp):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSObject):
+        (JSC::JSObject::finishCreation):
+        (JSC):
+        (JSC::JSNonFinalObject::hasInlineStorage):
+        (JSNonFinalObject):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSC::JSFinalObject::hasInlineStorage):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSObject::offsetOfInlineStorage):
+        (JSC::JSObject::setPropertyStorage):
+        (JSC::Structure::inlineStorageCapacity):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::nextPropertyStorageCapacity):
+        (JSC):
+        (JSC::Structure::growPropertyStorageCapacity):
+        (JSC::Structure::suggestedNewPropertyStorageSize):
+        * runtime/Structure.h:
+        (JSC::Structure::putWillGrowPropertyStorage):
+        (Structure):
+
+2012-06-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG recompilation heuristics should be based on count, not rate
+        https://bugs.webkit.org/show_bug.cgi?id=90146
+
+        Reviewed by Oliver Hunt.
+        
+        This removes a bunch of code that was previously trying to prevent spurious
+        reoptimizations if a large enough majority of executions of a code block did
+        not result in OSR exit. It turns out that this code was purely harmful. This
+        patch removes all of that logic and replaces it with a dead-simple
+        heuristic: if you exit more than N times (where N is an exponential function
+        of the number of times the code block has already been recompiled) then we
+        will recompile.
+        
+        This appears to be a broad ~1% win on many benchmarks large and small.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::osrExitCounter):
+        (JSC::CodeBlock::countOSRExit):
+        (CodeBlock):
+        (JSC::CodeBlock::addressOfOSRExitCounter):
+        (JSC::CodeBlock::offsetOfOSRExitCounter):
+        (JSC::CodeBlock::adjustedExitCountThreshold):
+        (JSC::CodeBlock::exitCountThresholdForReoptimization):
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::setThreshold):
+        * bytecode/ExecutionCounter.h:
+        (ExecutionCounter):
+        (JSC::ExecutionCounter::clippedThreshold):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+
+2012-06-28  Mark Lam  <mark.lam@apple.com>
+
+        Adding a commenting utility to record BytecodeGenerator comments
+        with opcodes that are emitted.  Presently, the comments can only
+        be constant strings.  Adding comments for opcodes is optional.
+        If a comment is added, the comment will be printed following the
+        opcode when CodeBlock::dump() is called.
+
+        This utility is disabled by default, and is only meant for VM
+        development purposes.  It should not be enabled for product builds.
+
+        To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h
+        to 1.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90095
+
+        Reviewed by Geoffrey Garen.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment.
+        (JSC):
+        (JSC::CodeBlock::printUnaryOp): Add comment dumps.
+        (JSC::CodeBlock::printBinaryOp): Add comment dumps.
+        (JSC::CodeBlock::printConditionalJump): Add comment dumps.
+        (JSC::CodeBlock::printCallOp): Add comment dumps.
+        (JSC::CodeBlock::printPutByIdOp): Add comment dumps.
+        (JSC::CodeBlock::dump): Add comment dumps.
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::commentForBytecodeOffset):
+            Finds the comment for an opcode if available.
+        (JSC::CodeBlock::dumpBytecodeComments):
+            For debugging whether comments are collected.
+            It is not being called anywhere.
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::bytecodeComments):
+        * bytecode/Comment.h: Added.
+        (JSC):
+        (Comment):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitOpcode): Calls emitComment().
+        (JSC):
+        (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock.
+        (JSC::BytecodeGenerator::prependComment):
+            Registers a comment for emitComemnt() to use later.
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitComment):
+        (JSC::BytecodeGenerator::prependComment):
+            These are inlined versions of these functions that nullify them
+            when ENABLE_BYTECODE_COMMENTS is 0.
+        (JSC::BytecodeGenerator::comments):
+
+2012-06-28  Oliver Hunt  <oliver@apple.com>
+
+        32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
+        https://bugs.webkit.org/show_bug.cgi?id=90127
+
+        Reviewed by Filip Pizlo.
+
+        The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads
+        correctly.  This patch fixes this by killing the fill info in the GenerationInfo
+        when the spillFormat doesn't guarantee the value is a double.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2012-06-28  Kent Tamura  <tkent@chromium.org>
+
+        Classify form control states by their owner forms
+        https://bugs.webkit.org/show_bug.cgi?id=89950
+
+        Reviewed by Hajime Morita.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Expose WTF::StringBuilder::canShrink()
+
+2012-06-27  Michael Saboff  <msaboff@apple.com>
+
+        [Win] jscore-tests flakey
+        https://bugs.webkit.org/show_bug.cgi?id=88118
+
+        Reviewed by Jessie Berlin.
+
+        jsDriver.pl on windows intermittently doesn't get the returned value from jsc,
+        instead it gets 126.  Added a new option to jsc (-x) which prints the exit
+        code before exiting.  jsDriver.pl uses this option on Windows and parses the
+        exit code output for the exit code, removing it before comparing the actual
+        and expected outputs.  Filed a follow on "FIXME" defect:
+        [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl
+        https://bugs.webkit.org/show_bug.cgi?id=90119
+
+        * jsc.cpp:
+        (CommandLine::CommandLine):
+        (CommandLine):
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+        * tests/mozilla/jsDriver.pl:
+        (execute_tests):
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121359.
+        http://trac.webkit.org/changeset/121359
+        https://bugs.webkit.org/show_bug.cgi?id=90115
+
+        Broke many inspector tests (Requested by jpfau on #webkit).
+
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::toString):
+
+2012-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on
+        https://bugs.webkit.org/show_bug.cgi?id=90053
+        <rdar://problem/11764613>
+
+        Reviewed by Mark Hahnenberg.
+        
+        The problem is that the code was assuming that the recovery should be Undefined if the source of
+        the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a
+        UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive.
+        In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this
+        was already in place but the fast check for !shouldGenerate() broke it.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+
+2012-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG disassembly should be easier to read
+        https://bugs.webkit.org/show_bug.cgi?id=90106
+
+        Reviewed by Mark Hahnenberg.
+        
+        Did a few things:
+        
+        - Options::showDFGDisassembly now shows OSR exit disassembly as well.
+        
+        - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder
+          to read.
+        
+        - DFG graph disassembly view shows a few additional node types that turn out to be
+          essential for understanding OSR exits.
+        
+        Put together, these changes reinforce the philosophy that anything needed for computing
+        OSR exit is just as important as the machine code itself. Of course, we still don't take
+        that philosophy to its full extreme - for example Phantom nodes are not dumped. We may
+        revisit that in the future.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * assembler/LinkBuffer.h:
+        (JSC):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        * API/APIShims.h:
+        (APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to 
+        determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the 
+        HeapTimer class because timerDidFire could run after somebody has started to tear down that particular 
+        JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after 
+        its destruction has begun. 
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (APIEntryShim):
+        (JSC::APIEntryShim::~APIEntryShim):
+        (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
+        Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
+        and before we've released it, which can only done in APIEntryShim.
+        (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRelease):
+        (JSContextCreateBacktrace):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::collect):
+        (JSC::Heap::setActivityCallback):
+        (JSC::Heap::activityCallback):
+        (JSC::Heap::sweeper):
+        * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they 
+        are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
+        and the IncrementalSweeper to make sure they're the last things that get initialized during construction to 
+        prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
+        (Heap):
+        * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::invalidate):
+        (JSC):
+        (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread 
+        that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the 
+        HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
+        (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
+        out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
+        but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case 
+        we were interrupted between releasing our mutex and trying to grab the APILock.
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles 
+        all of that for us. 
+        (JSC::IncrementalSweeper::create):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::reap):
+        * jsc.cpp:
+        (functionGC):
+        (functionReleaseExecutableMemory):
+        (jscmain):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/GCActivityCallback.h:
+        (DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
+        that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity 
+        it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the 
+        APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
+        (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
+        (JSC::JSGlobalData::sharedInstanceInternal):
+        * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and 
+        de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
+        (JSGlobalData):
+        (JSC::JSGlobalData::apiLock):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSLock.cpp:
+        (JSC):
+        (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
+        (JSC::GlobalJSLock::~GlobalJSLock):
+        (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that 
+        it can successfully unlock it later without it disappearing from underneath it.
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::~JSLock):
+        (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for 
+        actually waiting for long periods. 
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        (JSC::JSLock::grabAllLocks):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC):
+        (GlobalJSLock):
+        (JSLockHolder):
+        (JSLock):
+        (DropAllLocks):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        * testRegExp.cpp:
+        (realMain):
+
+2012-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        x86 disassembler confuses immediates with addresses
+        https://bugs.webkit.org/show_bug.cgi?id=90099
+
+        Reviewed by Mark Hahnenberg.
+        
+        Prepend "$" to immediates to disambiguate between immediates and addresses. This is in
+        accordance with the gas and AT&T syntax.
+
+        * disassembler/udis86/udis86_syn-att.c:
+        (gen_operand):
+
+2012-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions):
+
+2012-06-27  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
+        https://bugs.webkit.org/show_bug.cgi?id=40118
+
+        Reviewed by Yong Li.
+
+        Added member functions to expose function name, urlString, and line #.
+        Refactored toString to make use of these member functions to reduce
+        duplicated code for future maintenance.
+
+        Manually tested refactoring of toString by tracing thrown exceptions.
+
+        * interpreter/Interpreter.h:
+        (StackFrame):
+        (JSC::StackFrame::toString):
+        (JSC::StackFrame::friendlySourceURL):
+        (JSC::StackFrame::friendlyFunctionName):
+        (JSC::StackFrame::friendlyLineNumber):
+
+2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove redundant c++11 warning suppression code
+
+        This is already handled in default_post.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Target.pri:
+
+2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Add missing heades to HEADERS
+
+        For JavaScriptCore there aren't any Qt specific files, so we include all
+        headers for easy editing in Qt Creator.
+
+        Reviewed by Simon Hausmann.
+
+        * Target.pri:
+
+2012-06-26  Dominic Cooney  <dominicc@chromium.org>
+
+        [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
+        https://bugs.webkit.org/show_bug.cgi?id=90029
+
+        Reviewed by Adam Barth.
+
+        * gyp: Removed.
+        * gyp/generate-derived-sources.sh: Removed.
+        * gyp/generate-dtrace-header.sh: Removed.
+        * gyp/run-if-exists.sh: Removed.
+        * gyp/update-info-plist.sh: Removed.
+
+2012-06-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reduced (but did not eliminate) use of "berzerker GC"
+        https://bugs.webkit.org/show_bug.cgi?id=89237
+
+        Reviewed by Gavin Barraclough.
+
+        (PART 2)
+
+        This part turns off "berzerker GC" and turns on incremental shrinking.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doSweep): Free or shrink after sweeping to
+        maintain the behavior we used to get from the occasional berzerker GC,
+        which would run all finalizers and then free or shrink all blocks
+        synchronously.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::needsSweeping): Sweep zapped blocks, too. It's always
+        safe to sweep a zapped block (that's the point of zapping), and it's
+        sometimes profitable. For example, consider this case: Block A does some
+        allocation (transitioning Block A from Marked to FreeListed), then GC
+        happens (transitioning Block A to Zapped), then all objects in Block A
+        are free, then the incremental sweeper visits Block A. If we skipped
+        Zapped blocks, we'd skip Block A, even though it would be profitable to
+        run its destructors and free its memory.
+
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::doWork): Don't sweep eagerly; we'll do
+        this incrementally.
+
+2012-06-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG PutByValAlias is too aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=90026
+        <rdar://problem/11751830>
+
+        Reviewed by Gavin Barraclough.
+        
+        For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect
+        performance by much.
+        
+        For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access
+        is within bounds. This also has the effect of making our out-of-bounds handling consistent
+        with WebCore.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+
+2012-06-26  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Add JSC statistics into about:memory
+        https://bugs.webkit.org/show_bug.cgi?id=89779
+
+        Reviewed by Rob Buis.
+
+        Fix non-JIT build on BlackBerry broken by r121196.
+
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+
+2012-06-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::operationNewArray is unnecessarily slow, and may use the wrong array
+        prototype when inlined
+        https://bugs.webkit.org/show_bug.cgi?id=89821
+
+        Reviewed by Geoffrey Garen.
+        
+        Fixes all array allocations to use the right structure, and hence the right prototype. Adds
+        inlining of new Array(...) with a non-zero number of arguments. Optimizes allocations of
+        empty arrays.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSArray.h:
+        (JSC):
+        (JSC::constructArray):
+        * runtime/JSGlobalObject.h:
+        (JSC):
+        (JSC::constructArray):
+
+2012-06-26  Filip Pizlo  <fpizlo@apple.com>
+
+        New fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html fails on 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=89953
+
+        Reviewed by Zoltan Herczeg.
+        
+        DFG 32-bit JIT was confused about the difference between a predicted type and a
+        proven type. This is easy to get confused about, since a local that is predicted int32
+        almost always means that the local must be an int32 since speculations are hoisted to
+        stores to locals. But that is less likely to be the case for arguments, where there is
+        an additional least-upper-bounding step: any store to an argument with a weird type
+        may force the argument to be any type.
+        
+        This patch basically duplicates the functionality in DFGSpeculativeJIT64.cpp for
+        GetLocal: the decision of whether to load a local as an int32 (or as an array, or as
+        a boolean) is made based on the AbstractValue::m_type, which is a type proof, rather
+        than the VariableAccessData::prediction(), which is a predicted type.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-06-25  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should try to make profiling deterministic because otherwise reproducing failures is
+        nearly impossible
+        https://bugs.webkit.org/show_bug.cgi?id=89940
+
+        Rubber stamped by Gavin Barraclough.
+        
+        This rolls out the part of http://trac.webkit.org/changeset/121215 that introduced randomness
+        into the system. Now, instead of randomizing the tier-up threshold, we always set it to an
+        artificially low (and statically predetermined!) value. This gives most of the benefit of
+        threshold randomization without actually making the system behave completely differently on
+        each invocation.
+
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::setThreshold):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+
+2012-06-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Value profiling should use tier-up threshold randomization to get more coverage
+        https://bugs.webkit.org/show_bug.cgi?id=89802
+
+        Reviewed by Gavin Barraclough.
+        
+        This patch causes both LLInt and Baseline JIT code to take the OSR slow path several
+        times before actually doing OSR. If we take the OSR slow path before the execution
+        count threshold is reached, then we just call CodeBlock::updateAllPredictions() to
+        compute the current latest least-upper-bound SpecType of all values seen in each
+        ValueProfile.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        (JSC):
+        (JSC::CodeBlock::updateAllPredictions):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::llintExecuteCounter):
+        (JSC::CodeBlock::jitExecuteCounter):
+        (CodeBlock):
+        (JSC::CodeBlock::updateAllPredictions):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::setThreshold):
+        (JSC::ExecutionCounter::status):
+        (JSC):
+        * bytecode/ExecutionCounter.h:
+        (JSC::ExecutionCounter::count):
+        (ExecutionCounter):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::weakRandomInteger):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * runtime/WeakRandom.h:
+        (WeakRandom):
+        (JSC::WeakRandom::seedUnsafe):
+
+2012-06-25  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Add JSC statistics into about:memory
+        https://bugs.webkit.org/show_bug.cgi?id=89779
+
+        Reviewed by Rob Buis.
+
+        Add MemoryStatistics.cpp into build, and fill JITBytes for BlackBerry port.
+
+        * PlatformBlackBerry.cmake:
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+
+2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121058.
+        http://trac.webkit.org/changeset/121058
+        https://bugs.webkit.org/show_bug.cgi?id=89809
+
+        Patch causes plugins tests to crash in GTK debug builds
+        (Requested by zdobersek on #webkit).
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (APIEntryShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRelease):
+        (JSContextCreateBacktrace):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::collect):
+        (JSC::Heap::setActivityCallback):
+        (JSC::Heap::activityCallback):
+        (JSC::Heap::sweeper):
+        * heap/Heap.h:
+        (Heap):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::invalidate):
+        (JSC::HeapTimer::timerDidFire):
+        (JSC):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doWork):
+        (JSC::IncrementalSweeper::create):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::reap):
+        * jsc.cpp:
+        (functionGC):
+        (functionReleaseExecutableMemory):
+        (jscmain):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/GCActivityCallback.h:
+        (DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::sharedInstance):
+        (JSC::JSGlobalData::sharedInstanceInternal):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSLock.cpp:
+        (JSC):
+        (JSC::createJSLockCount):
+        (JSC::JSLock::lockCount):
+        (JSC::setLockCount):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC):
+        (JSLock):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::~JSLock):
+        (DropAllLocks):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        * testRegExp.cpp:
+        (realMain):
+
+2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
+        https://bugs.webkit.org/show_bug.cgi?id=89781
+
+        Reviewed by Dean Jackson.
+
+        Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-06-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG tier-up should happen in prologues, not epilogues
+        https://bugs.webkit.org/show_bug.cgi?id=89752
+
+        Reviewed by Geoffrey Garen.
+
+        This change has two outcomes:
+        
+        1) Slightly reduces the likelihood that a function will be optimized both
+        standalone and via inlining.  Previously, if you had a call sequence like foo() 
+        calls bar() exactly once, and nobody else calls bar(), then bar() would get
+        optimized first (because it returns first) and then foo() gets optimized.  If foo()
+        can inline bar() then that means that bar() gets optimized twice.  But now, if we
+        optimize in prologues, then foo() will be optimized first.  If it inlines bar(),
+        that means that there will no longer be any calls to bar().
+        
+        2) It lets us kill some code in JITStubs.  Epilogue tier-up was very different from
+        loop tier-up, since epilogue tier-up should not attempt OSR.  But prologue tier-up
+        requires OSR (albeit really easy OSR since it's the top of the compilation unit),
+        so it becomes just like loop tier-up.  As a result, we now have one optimization
+        hook (cti_optimize) instead of two (cti_optimize_from_loop and
+        cti_optimize_from_ret).
+        
+        As a consequence of not having an optimization check in epilogues, the OSR exit
+        code must now trigger reoptimization itself instead of just signaling the epilogue
+        check to fire.
+        
+        This also adds the ability to count the number of DFG compilations, which was
+        useful for debugging this patch and might be useful for other things in the future.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reoptimize):
+        (JSC):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGDriver.cpp:
+        (DFG):
+        (JSC::DFG::getNumCompilations):
+        (JSC::DFG::compile):
+        * dfg/DFGDriver.h:
+        (DFG):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_enter):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_enter):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+
+2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Gavin Barraclough.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * API/APIShims.h:
+        (APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to 
+        determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the 
+        HeapTimer class because timerDidFire could run after somebody has started to tear down that particular 
+        JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after 
+        its destruction has begun. 
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed.
+        (JSC::APIEntryShim::APIEntryShim):
+        (APIEntryShim):
+        (JSC::APIEntryShim::~APIEntryShim):
+        (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
+        Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
+        and before we've released it, which can only done in APIEntryShim.
+        (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRelease):
+        (JSContextCreateBacktrace):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::collect):
+        (JSC::Heap::setActivityCallback):
+        (JSC::Heap::activityCallback):
+        (JSC::Heap::sweeper):
+        * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they 
+        are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
+        and the IncrementalSweeper to make sure they're the last things that get initialized during construction to 
+        prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
+        (Heap):
+        * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::invalidate):
+        (JSC):
+        (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread 
+        that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the 
+        HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
+        (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
+        out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
+        but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case 
+        we were interrupted between releasing our mutex and trying to grab the APILock.
+        * heap/HeapTimer.h: 
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles 
+        all of that for us. 
+        (JSC::IncrementalSweeper::create):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::reap):
+        * jsc.cpp:
+        (functionGC):
+        (functionReleaseExecutableMemory):
+        (jscmain):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/GCActivityCallback.h:
+        (DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
+        that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity 
+        it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the 
+        APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
+        (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
+        (JSC::JSGlobalData::sharedInstanceInternal):
+        * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and 
+        de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
+        (JSGlobalData):
+        (JSC::JSGlobalData::apiLock):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSLock.cpp:
+        (JSC):
+        (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
+        (JSC::GlobalJSLock::~GlobalJSLock):
+        (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that 
+        it can successfully unlock it later without it disappearing from underneath it.
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::~JSLock):
+        (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for 
+        actually waiting for long periods. 
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock): 
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        (JSC::JSLock::grabAllLocks):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC):
+        (GlobalJSLock):
+        (JSLockHolder):
+        (JSLock):
+        (DropAllLocks):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        * testRegExp.cpp:
+        (realMain):
+
+2012-06-22  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
+        https://bugs.webkit.org/show_bug.cgi?id=88853
+
+        Reviewed by Steve Block.
+
+        The Android exclusions were necessary to fix a gyp generation error, as
+        the gcc_version variable wasn't being defined for Android. Remove these
+        exceptions when Chromium is able to define the gcc_version variable.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2012-06-21  Filip Pizlo  <fpizlo@apple.com>
+
+        op_resolve_global should not prevent DFG inlining
+        https://bugs.webkit.org/show_bug.cgi?id=89726
+
+        Reviewed by Gavin Barraclough.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/GlobalResolveInfo.h:
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        (GlobalResolveInfo):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline 'new Array()'
+        https://bugs.webkit.org/show_bug.cgi?id=89632
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds support for treating InternalFunction like intrinsics. The code
+        to do so is actually quite clean, so I don't feel bad about perpetuating
+        the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy.
+        
+        Currently this newfound power is only used to inline 'new Array()'.
+        
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isInternalFunctionConstant):
+        (JSC::DFG::Graph::valueOfInternalFunctionConstant):
+
+2012-06-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Adding copyrights to new files.
+
+        * heap/HeapTimer.cpp:
+        * heap/HeapTimer.h:
+        * heap/IncrementalSweeper.cpp:
+        * heap/IncrementalSweeper.h:
+
+2012-06-21  Arnaud Renevier  <arno@renevier.net>
+
+        make sure headers are included only once per file
+        https://bugs.webkit.org/show_bug.cgi?id=88922
+
+        Reviewed by Alexey Proskuryakov.
+
+        * bytecode/CodeBlock.h:
+        * heap/MachineStackMarker.cpp:
+        * runtime/JSVariableObject.h:
+
+2012-06-21  Ryuan Choi  <ryuan.choi@gmail.com>
+
+        [EFL][WK2] Make WebKit2/Efl headers and resources installable.
+        https://bugs.webkit.org/show_bug.cgi?id=88207
+
+        Reviewed by Chang Shu.
+
+        * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin"
+
+2012-06-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reduced (but did not eliminate) use of "berzerker GC"
+        https://bugs.webkit.org/show_bug.cgi?id=89237
+
+        Reviewed by Gavin Barraclough.
+
+        (PART 1)
+
+        This patch turned out to be crashy, so I'm landing the non-crashy bits
+        first.
+
+        This part is pre-requisite refactoring. I didn't actually turn off
+        "berzerker GC" or turn on incremental shrinking.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when
+        we throw away the block we're currently allocating out of. Otherwise, we'll
+        allocate out of a stale free list.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::Free::Free):
+        (JSC::Free::operator()):
+        (JSC::Free::returnValue): Refactored this functor to use a shared helper
+        function, so we can share our implementation with the incremental sweeper.
+
+        Also changed to freeing individual blocks immediately instead of linking
+        them into a list for later freeing. This makes the programming interface
+        simpler, and it's slightly more efficient to boot.
+
+        (JSC::MarkedSpace::~MarkedSpace): Updated for rename.
+
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior
+        with the incremental sweeper.
+
+        (JSC::MarkedSpace::shrink): Updated for new functor behavior.
+
+        * heap/MarkedSpace.h: Statically typed languages are awesome.
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize ResolveGlobal
+        https://bugs.webkit.org/show_bug.cgi?id=89617
+
+        Reviewed by Oliver Hunt.
+        
+        This adds inlining of ResolveGlobal accesses that are known monomorphic. It also
+        adds the specific function optimization to ResolveGlobal, when it is inlined. And,
+        it makes internal functions act like specific functions, since that will be the
+        most common use-case of this optimization.
+        
+        This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing
+        with this optimization, which is to completely inline common "globally resolved"
+        function and constructor calls, like "new Array()".
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::numberOfGlobalResolveInfos):
+        * bytecode/GlobalResolveInfo.h:
+        (JSC::getGlobalResolveInfoBytecodeOffset):
+        (JSC):
+        * bytecode/ResolveGlobalStatus.cpp: Added.
+        (JSC):
+        (JSC::computeForStructure):
+        (JSC::computeForLLInt):
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.h: Added.
+        (JSC):
+        (ResolveGlobalStatus):
+        (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
+        (JSC::ResolveGlobalStatus::state):
+        (JSC::ResolveGlobalStatus::isSet):
+        (JSC::ResolveGlobalStatus::operator!):
+        (JSC::ResolveGlobalStatus::isSimple):
+        (JSC::ResolveGlobalStatus::takesSlowPath):
+        (JSC::ResolveGlobalStatus::structure):
+        (JSC::ResolveGlobalStatus::offset):
+        (JSC::ResolveGlobalStatus::specificValue):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * runtime/JSObject.cpp:
+        (JSC::getCallableObjectSlow):
+        (JSC):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putDirectVirtual):
+        (JSC::JSObject::putDirectAccessor):
+        * runtime/JSObject.h:
+        (JSC):
+        (JSC::getCallableObject):
+        (JSC::JSObject::putOwnDataProperty):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Functions on global objects should be specializable
+        https://bugs.webkit.org/show_bug.cgi?id=89615
+
+        Reviewed by Oliver Hunt.
+        
+        I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343,
+        and it didn't. Bug 33343 was the reason why we disabled global object function specialization
+        to begin with. So I'm guessing this is safe.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        build-webkit failure due to illegal 32-bit integer constants in code
+        generated by offlineasm
+        https://bugs.webkit.org/show_bug.cgi?id=89347
+
+        Reviewed by Geoffrey Garen.
+        
+        The offending constants are the magic numbers used by offlineasm to find
+        offsets in the generated machine code. Added code to turn them into what
+        the C++ compiler will believe to be valid 32-bit values.
+
+        * offlineasm/offsets.rb:
+
+2012-06-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Made the incremental sweeper more aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=89527
+
+        Reviewed by Oliver Hunt.
+
+        This is a pre-requisite to getting rid of "berzerker GC" because we need
+        the sweeper to reclaim memory in a timely fashion, or we'll see a memory
+        footprint regression.
+
+        * heap/IncrementalSweeper.h:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable,
+        no need to use a data member to record it.
+
+        (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a
+        small time slice. This is better than sweeping only one block per timer
+        fire because that strategy has a heavy timer overhead, and artificially
+        delays memory reclamation.
+
+2012-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to print disassembly interleaved with the IR
+        https://bugs.webkit.org/show_bug.cgi?id=89551
+
+        Reviewed by Geoffrey Garen.
+        
+        This change also removes running Dominators unconditionally on every DFG
+        compile. Dominators are designed to be computed on-demand, and currently
+        the only demand is graph dumps.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::labelIgnoringWatchpoints):
+        (ARMv7Assembler):
+        * assembler/AbstractMacroAssembler.h:
+        (AbstractMacroAssembler):
+        (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::labelIgnoringWatchpoints):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::shouldShowDisassembly):
+        (DFG):
+        * dfg/DFGDisassembler.cpp: Added.
+        (DFG):
+        (JSC::DFG::Disassembler::Disassembler):
+        (JSC::DFG::Disassembler::dump):
+        (JSC::DFG::Disassembler::dumpDisassembly):
+        * dfg/DFGDisassembler.h: Added.
+        (DFG):
+        (Disassembler):
+        (JSC::DFG::Disassembler::setStartOfCode):
+        (JSC::DFG::Disassembler::setForBlock):
+        (JSC::DFG::Disassembler::setForNode):
+        (JSC::DFG::Disassembler::setEndOfMainPath):
+        (JSC::DFG::Disassembler::setEndOfCode):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::amountOfNodeWhiteSpace):
+        (DFG):
+        (JSC::DFG::Graph::printNodeWhiteSpace):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (DFG):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::setStartOfCode):
+        (JSC::DFG::JITCompiler::setForBlock):
+        (JSC::DFG::JITCompiler::setForNode):
+        (JSC::DFG::JITCompiler::setEndOfMainPath):
+        (JSC::DFG::JITCompiler::setEndOfCode):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::willHaveCodeGen):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+
+2012-06-19  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be able to show disassembly for all generated JIT code
+        https://bugs.webkit.org/show_bug.cgi?id=89536
+
+        Reviewed by Gavin Barraclough.
+        
+        Now instead of doing linkBuffer.finalizeCode(), you do
+        FINALIZE_CODE(linkBuffer, (... explanation ...)). FINALIZE_CODE() then
+        prints your explanation and the disassembled code, if
+        Options::showDisassembly is set to true.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/LinkBuffer.cpp: Added.
+        (JSC):
+        (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::performFinalization):
+        (JSC::LinkBuffer::dumpLinkStatistics):
+        (JSC::LinkBuffer::dumpCode):
+        * assembler/LinkBuffer.h:
+        (LinkBuffer):
+        (JSC):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodeRef::tryToDisassemble):
+        (MacroAssemblerCodeRef):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+        * disassembler/Disassembler.h:
+        (JSC):
+        (JSC::tryToDisassemble):
+        * disassembler/UDis86Disassembler.cpp:
+        (JSC::tryToDisassemble):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCode.h:
+        (JSC::JITCode::tryToDisassemble):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::generateThunkWithJumpTo):
+        (JSC::LLInt::functionForCallEntryThunkGenerator):
+        (JSC::LLInt::functionForConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
+        (JSC::LLInt::evalEntryThunkGenerator):
+        (JSC::LLInt::programEntryThunkGenerator):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+
+2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        [Qt][Mac] REGRESSION(r120742): It broke the build
+        https://bugs.webkit.org/show_bug.cgi?id=89516
+
+        Reviewed by Geoffrey Garen.
+
+        Removing GCActivityCallbackCF.cpp because it doesn't mesh well with cross-platform 
+        code on Darwin (e.g. Qt). We now use plain ol' vanilla ifdefs to handle platforms 
+        without CF support. These if-defs will probably disappear in the future when we 
+        use cross-platform timers in HeapTimer.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/GCActivityCallback.cpp:
+        (JSC):
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::doWork):
+        (JSC::DefaultGCActivityCallback::scheduleTimer):
+        (JSC::DefaultGCActivityCallback::cancelTimer):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+        (JSC::DefaultGCActivityCallback::willCollect):
+        (JSC::DefaultGCActivityCallback::cancel):
+        * runtime/GCActivityCallbackCF.cpp: Removed.
+
+2012-06-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA forgets to notify subsequent phases of found constants if it proves LogicalNot to be a constant
+        https://bugs.webkit.org/show_bug.cgi?id=89511
+        <rdar://problem/11700089>
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-06-19  Mark Lam  <mark.lam@apple.com>
+
+        CodeBlock::needsCallReturnIndices() is no longer needed.
+        https://bugs.webkit.org/show_bug.cgi?id=89490
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::needsCallReturnIndices): removed.
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2012-06-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+
+2012-06-17  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to look at disassembly
+        https://bugs.webkit.org/show_bug.cgi?id=89319
+
+        Reviewed by Sam Weinig.
+        
+        This imports the udis86 disassembler library. The library is placed
+        behind an abstraction in disassembler/Disassembler.h, so that we can
+        in the future use other disassemblers (for other platforms) whenever
+        appropriate. As a first step, the disassembler is being invoked for
+        DFG verbose dumps.
+        
+        If we ever want to merge a new version of udis86 in the future, I've
+        made notes about changes I made to the library in
+        disassembler/udis86/differences.txt.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * disassembler: Added.
+        * disassembler/Disassembler.h: Added.
+        (JSC):
+        (JSC::tryToDisassemble):
+        * disassembler/UDis86Disassembler.cpp: Added.
+        (JSC):
+        (JSC::tryToDisassemble):
+        * disassembler/udis86: Added.
+        * disassembler/udis86/differences.txt: Added.
+        * disassembler/udis86/itab.py: Added.
+        (UdItabGenerator):
+        (UdItabGenerator.__init__):
+        (UdItabGenerator.toGroupId):
+        (UdItabGenerator.genLookupTable):
+        (UdItabGenerator.genLookupTableList):
+        (UdItabGenerator.genInsnTable):
+        (genItabH):
+        (genItabH.UD_ITAB_H):
+        (genItabC):
+        (genItab):
+        (main):
+        * disassembler/udis86/optable.xml: Added.
+        * disassembler/udis86/ud_opcode.py: Added.
+        (UdOpcodeTables):
+        (UdOpcodeTables.sizeOfTable):
+        (UdOpcodeTables.nameOfTable):
+        (UdOpcodeTables.updateTable):
+        (UdOpcodeTables.Insn):
+        (UdOpcodeTables.Insn.__init__):
+        (UdOpcodeTables.Insn.__init__.opcode):
+        (UdOpcodeTables.parse):
+        (UdOpcodeTables.addInsnDef):
+        (UdOpcodeTables.print_table):
+        (UdOpcodeTables.print_tree):
+        * disassembler/udis86/ud_optable.py: Added.
+        (UdOptableXmlParser):
+        (UdOptableXmlParser.parseDef):
+        (UdOptableXmlParser.parse):
+        (printFn):
+        (parse):
+        (main):
+        * disassembler/udis86/udis86.c: Added.
+        (ud_init):
+        (ud_disassemble):
+        (ud_set_mode):
+        (ud_set_vendor):
+        (ud_set_pc):
+        (ud):
+        (ud_insn_asm):
+        (ud_insn_off):
+        (ud_insn_hex):
+        (ud_insn_ptr):
+        (ud_insn_len):
+        * disassembler/udis86/udis86.h: Added.
+        * disassembler/udis86/udis86_decode.c: Added.
+        (eff_adr_mode):
+        (ud_lookup_mnemonic):
+        (decode_prefixes):
+        (modrm):
+        (resolve_operand_size):
+        (resolve_mnemonic):
+        (decode_a):
+        (decode_gpr):
+        (resolve_gpr64):
+        (resolve_gpr32):
+        (resolve_reg):
+        (decode_imm):
+        (decode_modrm_reg):
+        (decode_modrm_rm):
+        (decode_o):
+        (decode_operand):
+        (decode_operands):
+        (clear_insn):
+        (resolve_mode):
+        (gen_hex):
+        (decode_insn):
+        (decode_3dnow):
+        (decode_ssepfx):
+        (decode_ext):
+        (decode_opcode):
+        (ud_decode):
+        * disassembler/udis86/udis86_decode.h: Added.
+        (ud_itab_entry_operand):
+        (ud_itab_entry):
+        (ud_lookup_table_list_entry):
+        (sse_pfx_idx):
+        (mode_idx):
+        (modrm_mod_idx):
+        (vendor_idx):
+        (is_group_ptr):
+        (group_idx):
+        * disassembler/udis86/udis86_extern.h: Added.
+        * disassembler/udis86/udis86_input.c: Added.
+        (inp_buff_hook):
+        (inp_file_hook):
+        (ud):
+        (ud_set_user_opaque_data):
+        (ud_get_user_opaque_data):
+        (ud_set_input_buffer):
+        (ud_set_input_file):
+        (ud_input_skip):
+        (ud_input_end):
+        (ud_inp_next):
+        (ud_inp_back):
+        (ud_inp_peek):
+        (ud_inp_move):
+        (ud_inp_uint8):
+        (ud_inp_uint16):
+        (ud_inp_uint32):
+        (ud_inp_uint64):
+        * disassembler/udis86/udis86_input.h: Added.
+        * disassembler/udis86/udis86_itab_holder.c: Added.
+        * disassembler/udis86/udis86_syn-att.c: Added.
+        (opr_cast):
+        (gen_operand):
+        (ud_translate_att):
+        * disassembler/udis86/udis86_syn-intel.c: Added.
+        (opr_cast):
+        (gen_operand):
+        (ud_translate_intel):
+        * disassembler/udis86/udis86_syn.c: Added.
+        * disassembler/udis86/udis86_syn.h: Added.
+        (mkasm):
+        * disassembler/udis86/udis86_types.h: Added.
+        (ud_operand):
+        (ud):
+        * jit/JITCode.h:
+        (JITCode):
+        (JSC::JITCode::tryToDisassemble):
+
+2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GCActivityCallback and IncrementalSweeper should share code
+        https://bugs.webkit.org/show_bug.cgi?id=89400
+
+        Reviewed by Geoffrey Garen.
+
+        A lot of functionality is duplicated between GCActivityCallback and IncrementalSweeper. 
+        We should extract the common functionality out into a separate class that both of them 
+        can inherit from. This refactoring will be an even greater boon when we add the ability 
+        to shut these two agents down in a thread-safe fashion
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap): Move initialization down so that the JSGlobalData has a valid Heap when 
+        we're initializing the GCActivityCallback and the IncrementalSweeper.
+        * heap/Heap.h:
+        (Heap):
+        * heap/HeapTimer.cpp: Added.
+        (JSC):
+        (JSC::HeapTimer::HeapTimer): Initialize the various base class data that
+        DefaultGCActivityCallback::commonConstructor() used to do.
+        (JSC::HeapTimer::~HeapTimer): Call to invalidate().
+        (JSC::HeapTimer::synchronize): Same functionality as the old DefaultGCActivityCallback::synchronize().
+        Virtual so that non-CF subclasses can override.
+        (JSC::HeapTimer::invalidate): Tears down the runloop timer to prevent any future firing.
+        (JSC::HeapTimer::timerDidFire): Callback to pass to the timer function. Casts and calls the virtual doWork().
+        * heap/HeapTimer.h: Added. This is the class that serves as the common base class for 
+        both GCActivityCallback and IncrementalSweeper. It handles setting up and tearing down run loops and synchronizing 
+        across threads for its subclasses. 
+        (JSC):
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp: Changes to accomodate the extraction of common functionality 
+        between IncrementalSweeper and GCActivityCallback into a common ancestor.
+        (JSC):
+        (JSC::IncrementalSweeper::doWork): 
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::cancelTimer):
+        (JSC::IncrementalSweeper::create):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::doWork):
+        * runtime/GCActivityCallback.h:
+        (GCActivityCallback):
+        (JSC::GCActivityCallback::willCollect):
+        (JSC::GCActivityCallback::GCActivityCallback):
+        (JSC):
+        (DefaultGCActivityCallback): Remove the platform data struct. The platform data should be kept in 
+        the class itself so as to be accessible by doWork(). Most of the platform data for CF is kept in 
+        HeapTimer anyways, so we only need the m_delay field now.
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC):
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::doWork):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+        * runtime/GCActivityCallbackCF.cpp:
+        (JSC):
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::doWork):
+        (JSC::DefaultGCActivityCallback::scheduleTimer):
+        (JSC::DefaultGCActivityCallback::cancelTimer):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+        (JSC::DefaultGCActivityCallback::willCollect):
+        (JSC::DefaultGCActivityCallback::cancel):
+
+
+2012-06-19  Mike West  <mkwst@chromium.org>
+
+        Introduce ENABLE_CSP_NEXT configuration flag.
+        https://bugs.webkit.org/show_bug.cgi?id=89300
+
+        Reviewed by Adam Barth.
+
+        The 1.0 draft of the Content Security Policy spec is just about to
+        move to Last Call. We'll hide work on the upcoming 1.1 spec behind
+        this ENABLE flag, disabled by default.
+
+        Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-06-18  Mark Lam  <mark.lam@apple.com>
+
+        Changed JSC to always record line number information so that error.stack
+        and window.onerror() can report proper line numbers.
+        https://bugs.webkit.org/show_bug.cgi?id=89410
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit): m_lineInfo is now available unconditionally.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addLineInfo):
+        (JSC::CodeBlock::hasLineInfo): Unused.  Now removed.
+        (JSC::CodeBlock::needsCallReturnIndices):
+        (CodeBlock):
+        (RareData):  Hoisted m_lineInfo out of m_rareData.  m_lineInfo is now
+        filled in unconditionally.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::addLineInfo):
+
+2012-06-18  Andy Estes  <aestes@apple.com>
+
+        Fix r120663, which didn't land the change that was reviewed.
+
+2012-06-18  Andy Estes  <aestes@apple.com>
+
+        [JSC] In JSGlobalData.cpp, enableAssembler() sometimes leaks two CF objects
+        https://bugs.webkit.org/show_bug.cgi?id=89415
+
+        Reviewed by Sam Weinig.
+
+        In the case where canUseJIT was a non-NULL CFBooleanRef,
+        enableAssembler() would leak both canUseJITKey and canUseJIT by
+        returning before calling CFRelease. Fix this by using RetainPtr.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler):
+
+2012-06-17  Geoffrey Garen  <ggaren@apple.com>
+
+        GC copy phase spends needless cycles zero-filling blocks
+        https://bugs.webkit.org/show_bug.cgi?id=89128
+
+        Reviewed by Gavin Barraclough.
+
+        We only need to zero-fill when we're allocating memory that might not
+        get fully initialized before GC.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::createNoZeroFill):
+        (JSC::CopiedBlock::create): Added a way to create without zero-filling.
+        This is our optimization.
+
+        (JSC::CopiedBlock::zeroFillToEnd):
+        (JSC::CopiedBlock::CopiedBlock): Split zero-filling out from creation,
+        so we can sometimes create without zero-filling.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::init):
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        (JSC::CopiedSpace::doneCopying): Renamed addNewBlock to allocateBlock()
+        to clarify that the new block is always newly-allocated.
+
+        (JSC::CopiedSpace::doneFillingBlock): Make sure to zero-fill to the end
+        of a block that might be used in the future for allocation. (Most of the
+        time, this is a no-op, since we've already filled the block completely.)
+
+        (JSC::CopiedSpace::getFreshBlock): Removed this function because the
+        abstraction of "allocation must succeed" is no longer useful.
+
+        * heap/CopiedSpace.h: Updated declarations to match.
+
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase): New function, which
+        knows that it can skip zero-filling.
+
+        Added tighter scoping to our lock, to improve parallelism.
+
+        (JSC::CopiedSpace::allocateBlock): Folded getFreshBlock functionality
+        into this function, for simplicity.
+
+        * heap/MarkStack.cpp:
+        (JSC::SlotVisitor::startCopying):
+        (JSC::SlotVisitor::allocateNewSpace): Use our new zero-fill-free helper
+        function for great good.
+
+2012-06-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should attempt to use structure watchpoints for all inlined get_by_id's and put_by_id's
+        https://bugs.webkit.org/show_bug.cgi?id=89316
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2012-06-15  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Put platform-specific GC policy in GCActivityCallback
+        https://bugs.webkit.org/show_bug.cgi?id=89236
+
+        Reviewed by Rob Buis.
+
+        Add GCActivityCallbackBlackBerry.cpp and implement platform-specific
+        low memory GC policy there.
+
+        * PlatformBlackBerry.cmake:
+        * heap/Heap.h:
+        (JSC::Heap::isSafeToCollect): Added.
+        * runtime/GCActivityCallbackBlackBerry.cpp: Added.
+        (JSC):
+        (JSC::DefaultGCActivityCallbackPlatformData::DefaultGCActivityCallbackPlatformData):
+        (DefaultGCActivityCallbackPlatformData):
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+        (JSC::DefaultGCActivityCallback::willCollect):
+        (JSC::DefaultGCActivityCallback::synchronize):
+        (JSC::DefaultGCActivityCallback::cancel):
+
+2012-06-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to set watchpoints on structure transitions in the
+        method check prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=89058
+
+        Adding the same assertion to 32-bit that I added to 64-bit. This change
+        does not affect correctness but it's a good thing for assertion coverage.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-06-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to set watchpoints on structure transitions in the
+        method check prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=89058
+
+        Reviewed by Gavin Barraclough.
+        
+        This adds the ability to set watchpoints on Structures, and then does
+        the most modest thing we can do with this ability: the DFG now sets
+        watchpoints on structure transitions in the prototype chain of method
+        checks.
+        
+        This appears to be a >1% speed-up on V8.
+
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::containsOnly):
+        (StructureSet):
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::WatchpointSet):
+        (JSC::InlineWatchpointSet::add):
+        (JSC):
+        (JSC::InlineWatchpointSet::inflateSlow):
+        (JSC::InlineWatchpointSet::freeFat):
+        * bytecode/Watchpoint.h:
+        (WatchpointSet):
+        (JSC):
+        (InlineWatchpointSet):
+        (JSC::InlineWatchpointSet::InlineWatchpointSet):
+        (JSC::InlineWatchpointSet::~InlineWatchpointSet):
+        (JSC::InlineWatchpointSet::hasBeenInvalidated):
+        (JSC::InlineWatchpointSet::isStillValid):
+        (JSC::InlineWatchpointSet::startWatching):
+        (JSC::InlineWatchpointSet::notifyWrite):
+        (JSC::InlineWatchpointSet::isFat):
+        (JSC::InlineWatchpointSet::fat):
+        (JSC::InlineWatchpointSet::inflate):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCommon.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isCellConstant):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addWeakReferences):
+        (JITCompiler):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasStructure):
+        (Node):
+        (JSC::DFG::Node::structure):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+        (JSC::Structure::transitionWatchpointSetHasBeenInvalidated):
+        (Structure):
+        (JSC::Structure::transitionWatchpointSetIsStillValid):
+        (JSC::Structure::addTransitionWatchpoint):
+        (JSC::Structure::notifyTransitionFromThisStructure):
+        (JSC::JSCell::setStructure):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::attemptToWatch):
+
+2012-06-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to set watchpoints on global variables
+        https://bugs.webkit.org/show_bug.cgi?id=88692
+
+        Reviewed by Geoffrey Garen.
+        
+        Rolling back in after fixing Windows build issues, and implementing
+        branchTest8 for the Qt port's strange assemblers.
+        
+        This implements global variable constant folding by allowing the optimizing
+        compiler to set a "watchpoint" on globals that it wishes to constant fold.
+        If the watchpoint fires, then an OSR exit is forced by overwriting the
+        machine code that the optimizing compiler generated with a jump.
+        
+        As such, this patch is adding quite a bit of stuff:
+        
+        - Jump replacement on those hardware targets supported by the optimizing
+          JIT. It is now possible to patch in a jump instruction over any recorded
+          watchpoint label. The jump must be "local" in the sense that it must be
+          within the range of the largest jump distance supported by a one
+          instruction jump.
+          
+        - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
+          that records the location where a jump must be inserted and the
+          destination to which it should jump. Watchpoints can be added to a
+          WatchpointSet. The WatchpointSet can be fired all at once, which plants
+          all jumps. WatchpointSet also remembers if it had ever been invalidated,
+          which allows for monotonicity: we typically don't want to optimize using
+          watchpoints on something for which watchpoints had previously fired. The
+          act of notifying a WatchpointSet has a trivial fast path in case no
+          Watchpoints are registered (one-byte load+branch).
+        
+        - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
+          except that you don't have to emit branches. But, you need to know what
+          WatchpointSet to add the resulting Watchpoint to. Not everything that
+          you could write a speculationCheck() for will have a WatchpointSet that
+          would get notified if the condition you were speculating against became
+          invalid.
+          
+        - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
+          do so without incurring any space overhead for those entries that don't
+          have WatchpointSets.
+          
+        - The bytecode generator infers all global function variables to be
+          watchable, and makes all stores perform the WatchpointSet's write check,
+          and marks all loads as being potentially watchable (i.e. you can compile
+          them to a watchpoint and a constant).
+        
+        Put together, this allows for fully sleazy inlining of calls to globally
+        declared functions. The inline prologue will no longer contain the load of
+        the function, or any checks of the function you're calling. I.e. it's
+        pretty much like the kind of inlining you would see in Java or C++.
+        Furthermore, the watchpointing functionality is built to be fairly general,
+        and should allow setting watchpoints on all sorts of interesting things
+        in the future.
+        
+        The sleazy inlining means that we will now sometimes inline in code paths
+        that have never executed. Previously, to inline we would have either had
+        to have executed the call (to read the call's inline cache) or have
+        executed the method check (to read the method check's inline cache). Now,
+        we might inline when the callee is a watched global variable. This
+        revealed some humorous bugs. First, constant folding disagreed with CFA
+        over what kinds of operations can clobber (example: code path A is dead
+        but stores a String into variable X, all other code paths store 0 into
+        X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
+        clobbering constant, but constant folding thought it was clobbering
+        because it saw the String prediction). Second, inlining would crash if
+        the inline callee had not been compiled. This patch fixes both bugs,
+        since otherwise run-javascriptcore-tests would report regressions.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::ARMv7Assembler):
+        (JSC::ARMv7Assembler::labelForWatchpoint):
+        (JSC::ARMv7Assembler::label):
+        (JSC::ARMv7Assembler::replaceWithJump):
+        (JSC::ARMv7Assembler::maxJumpReplacementSize):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC):
+        (AbstractMacroAssembler):
+        (Label):
+        (JSC::AbstractMacroAssembler::watchpointLabel):
+        (JSC::AbstractMacroAssembler::readPointer):
+        * assembler/AssemblerBuffer.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchTest8):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::replaceWithJump):
+        (JSC::MacroAssemblerARM::maxJumpReplacementSize):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load8Signed):
+        (JSC::MacroAssemblerARMv7::load16Signed):
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::replaceWithJump):
+        (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchTest8):
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::replaceWithJump):
+        (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchTest8):
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::replaceWithJump):
+        (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::branchTest8):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::replaceWithJump):
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::X86Assembler):
+        (X86Assembler):
+        (JSC::X86Assembler::cmpb_im):
+        (JSC::X86Assembler::testb_im):
+        (JSC::X86Assembler::labelForWatchpoint):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::replaceWithJump):
+        (JSC::X86Assembler::maxJumpReplacementSize):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::appendOSRExit):
+        (JSC::CodeBlock::appendSpeculationRecovery):
+        (CodeBlock):
+        (JSC::CodeBlock::appendWatchpoint):
+        (JSC::CodeBlock::numberOfWatchpoints):
+        (JSC::CodeBlock::watchpoint):
+        (DFGData):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        (JSC::DFG::exitKindIsCountable):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForChain):
+        * bytecode/Instruction.h:
+        (Instruction):
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/Watchpoint.cpp: Added.
+        (JSC):
+        (JSC::Watchpoint::~Watchpoint):
+        (JSC::Watchpoint::correctLabels):
+        (JSC::Watchpoint::fire):
+        (JSC::WatchpointSet::WatchpointSet):
+        (JSC::WatchpointSet::~WatchpointSet):
+        (JSC::WatchpointSet::add):
+        (JSC::WatchpointSet::notifyWriteSlow):
+        (JSC::WatchpointSet::fireAllWatchpoints):
+        * bytecode/Watchpoint.h: Added.
+        (JSC):
+        (Watchpoint):
+        (JSC::Watchpoint::Watchpoint):
+        (JSC::Watchpoint::setDestination):
+        (WatchpointSet):
+        (JSC::WatchpointSet::isStillValid):
+        (JSC::WatchpointSet::hasBeenInvalidated):
+        (JSC::WatchpointSet::startWatching):
+        (JSC::WatchpointSet::notifyWrite):
+        (JSC::WatchpointSet::addressOfIsWatched):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetStaticVar):
+        (JSC::BytecodeGenerator::emitPutStaticVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberStructures):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        (JSC::DFG::AbstractState::didClobber):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::globalVarStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        * dfg/DFGCorrectableJumpPoint.h:
+        (JSC::DFG::CorrectableJumpPoint::isSet):
+        (CorrectableJumpPoint):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifierNumberForCheck):
+        (Node):
+        (JSC::DFG::Node::identifierNumberForCheck):
+        (JSC::DFG::Node::hasRegisterPointer):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::appendCall):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_global_var_check):
+        (JSC):
+        (JSC::JIT::emitSlow_op_put_global_var_check):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_global_var_check):
+        (JSC):
+        (JSC::JIT::emitSlow_op_put_global_var_check):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSObject):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/SymbolTable.cpp: Added.
+        (JSC):
+        (JSC::SymbolTableEntry::copySlow):
+        (JSC::SymbolTableEntry::freeFatEntrySlow):
+        (JSC::SymbolTableEntry::couldBeWatched):
+        (JSC::SymbolTableEntry::attemptToWatch):
+        (JSC::SymbolTableEntry::addressOfIsWatched):
+        (JSC::SymbolTableEntry::addWatchpoint):
+        (JSC::SymbolTableEntry::notifyWriteSlow):
+        (JSC::SymbolTableEntry::inflateSlow):
+        * runtime/SymbolTable.h:
+        (JSC):
+        (SymbolTableEntry):
+        (Fast):
+        (JSC::SymbolTableEntry::Fast::Fast):
+        (JSC::SymbolTableEntry::Fast::isNull):
+        (JSC::SymbolTableEntry::Fast::getIndex):
+        (JSC::SymbolTableEntry::Fast::isReadOnly):
+        (JSC::SymbolTableEntry::Fast::getAttributes):
+        (JSC::SymbolTableEntry::Fast::isFat):
+        (JSC::SymbolTableEntry::SymbolTableEntry):
+        (JSC::SymbolTableEntry::~SymbolTableEntry):
+        (JSC::SymbolTableEntry::operator=):
+        (JSC::SymbolTableEntry::isNull):
+        (JSC::SymbolTableEntry::getIndex):
+        (JSC::SymbolTableEntry::getFast):
+        (JSC::SymbolTableEntry::getAttributes):
+        (JSC::SymbolTableEntry::isReadOnly):
+        (JSC::SymbolTableEntry::watchpointSet):
+        (JSC::SymbolTableEntry::notifyWrite):
+        (FatEntry):
+        (JSC::SymbolTableEntry::FatEntry::FatEntry):
+        (JSC::SymbolTableEntry::isFat):
+        (JSC::SymbolTableEntry::fatEntry):
+        (JSC::SymbolTableEntry::inflate):
+        (JSC::SymbolTableEntry::bits):
+        (JSC::SymbolTableEntry::freeFatEntry):
+        (JSC::SymbolTableEntry::pack):
+        (JSC::SymbolTableEntry::isValidIndex):
+
+2012-06-13  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120172.
+        http://trac.webkit.org/changeset/120172
+        https://bugs.webkit.org/show_bug.cgi?id=88976
+
+        The patch causes compilation failures on Gtk, Qt and Apple Win
+        bots (Requested by zdobersek on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::nop):
+        (JSC::ARMv7Assembler::label):
+        (JSC::ARMv7Assembler::readPointer):
+        (ARMv7Assembler):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC):
+        (AbstractMacroAssembler):
+        (Label):
+        * assembler/AssemblerBuffer.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::nop):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerSH4.h:
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpb_im):
+        (JSC::X86Assembler::codeSize):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::appendOSRExit):
+        (JSC::CodeBlock::appendSpeculationRecovery):
+        (DFGData):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        (JSC::DFG::exitKindIsCountable):
+        * bytecode/Instruction.h:
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/Watchpoint.cpp: Removed.
+        * bytecode/Watchpoint.h: Removed.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetStaticVar):
+        (JSC::BytecodeGenerator::emitPutStaticVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberStructures):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArguments):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::globalVarStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        * dfg/DFGCorrectableJumpPoint.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasRegisterPointer):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSObject):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/SymbolTable.cpp: Removed.
+        * runtime/SymbolTable.h:
+        (JSC):
+        (JSC::SymbolTableEntry::isNull):
+        (JSC::SymbolTableEntry::getIndex):
+        (SymbolTableEntry):
+        (JSC::SymbolTableEntry::getAttributes):
+        (JSC::SymbolTableEntry::isReadOnly):
+        (JSC::SymbolTableEntry::pack):
+        (JSC::SymbolTableEntry::isValidIndex):
+
+2012-06-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to set watchpoints on global variables
+        https://bugs.webkit.org/show_bug.cgi?id=88692
+
+        Reviewed by Geoffrey Garen.
+        
+        This implements global variable constant folding by allowing the optimizing
+        compiler to set a "watchpoint" on globals that it wishes to constant fold.
+        If the watchpoint fires, then an OSR exit is forced by overwriting the
+        machine code that the optimizing compiler generated with a jump.
+        
+        As such, this patch is adding quite a bit of stuff:
+        
+        - Jump replacement on those hardware targets supported by the optimizing
+          JIT. It is now possible to patch in a jump instruction over any recorded
+          watchpoint label. The jump must be "local" in the sense that it must be
+          within the range of the largest jump distance supported by a one
+          instruction jump.
+          
+        - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
+          that records the location where a jump must be inserted and the
+          destination to which it should jump. Watchpoints can be added to a
+          WatchpointSet. The WatchpointSet can be fired all at once, which plants
+          all jumps. WatchpointSet also remembers if it had ever been invalidated,
+          which allows for monotonicity: we typically don't want to optimize using
+          watchpoints on something for which watchpoints had previously fired. The
+          act of notifying a WatchpointSet has a trivial fast path in case no
+          Watchpoints are registered (one-byte load+branch).
+        
+        - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
+          except that you don't have to emit branches. But, you need to know what
+          WatchpointSet to add the resulting Watchpoint to. Not everything that
+          you could write a speculationCheck() for will have a WatchpointSet that
+          would get notified if the condition you were speculating against became
+          invalid.
+          
+        - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
+          do so without incurring any space overhead for those entries that don't
+          have WatchpointSets.
+          
+        - The bytecode generator infers all global function variables to be
+          watchable, and makes all stores perform the WatchpointSet's write check,
+          and marks all loads as being potentially watchable (i.e. you can compile
+          them to a watchpoint and a constant).
+        
+        Put together, this allows for fully sleazy inlining of calls to globally
+        declared functions. The inline prologue will no longer contain the load of
+        the function, or any checks of the function you're calling. I.e. it's
+        pretty much like the kind of inlining you would see in Java or C++.
+        Furthermore, the watchpointing functionality is built to be fairly general,
+        and should allow setting watchpoints on all sorts of interesting things
+        in the future.
+        
+        The sleazy inlining means that we will now sometimes inline in code paths
+        that have never executed. Previously, to inline we would have either had
+        to have executed the call (to read the call's inline cache) or have
+        executed the method check (to read the method check's inline cache). Now,
+        we might inline when the callee is a watched global variable. This
+        revealed some humorous bugs. First, constant folding disagreed with CFA
+        over what kinds of operations can clobber (example: code path A is dead
+        but stores a String into variable X, all other code paths store 0 into
+        X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
+        clobbering constant, but constant folding thought it was clobbering
+        because it saw the String prediction). Second, inlining would crash if
+        the inline callee had not been compiled. This patch fixes both bugs,
+        since otherwise run-javascriptcore-tests would report regressions.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::ARMv7Assembler):
+        (JSC::ARMv7Assembler::labelForWatchpoint):
+        (JSC::ARMv7Assembler::label):
+        (JSC::ARMv7Assembler::replaceWithJump):
+        (JSC::ARMv7Assembler::maxJumpReplacementSize):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC):
+        (AbstractMacroAssembler):
+        (Label):
+        (JSC::AbstractMacroAssembler::watchpointLabel):
+        * assembler/AssemblerBuffer.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::replaceWithJump):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::maxJumpReplacementSize):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::replaceWithJump):
+        (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::replaceWithJump):
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::replaceWithJump):
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::branchTest8):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::replaceWithJump):
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::X86Assembler):
+        (X86Assembler):
+        (JSC::X86Assembler::cmpb_im):
+        (JSC::X86Assembler::testb_im):
+        (JSC::X86Assembler::labelForWatchpoint):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::replaceWithJump):
+        (JSC::X86Assembler::maxJumpReplacementSize):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::appendOSRExit):
+        (JSC::CodeBlock::appendSpeculationRecovery):
+        (CodeBlock):
+        (JSC::CodeBlock::appendWatchpoint):
+        (JSC::CodeBlock::numberOfWatchpoints):
+        (JSC::CodeBlock::watchpoint):
+        (DFGData):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        (JSC::DFG::exitKindIsCountable):
+        * bytecode/Instruction.h:
+        (Instruction):
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/Watchpoint.cpp: Added.
+        (JSC):
+        (JSC::Watchpoint::~Watchpoint):
+        (JSC::Watchpoint::correctLabels):
+        (JSC::Watchpoint::fire):
+        (JSC::WatchpointSet::WatchpointSet):
+        (JSC::WatchpointSet::~WatchpointSet):
+        (JSC::WatchpointSet::add):
+        (JSC::WatchpointSet::notifyWriteSlow):
+        (JSC::WatchpointSet::fireAllWatchpoints):
+        * bytecode/Watchpoint.h: Added.
+        (JSC):
+        (Watchpoint):
+        (JSC::Watchpoint::Watchpoint):
+        (JSC::Watchpoint::setDestination):
+        (WatchpointSet):
+        (JSC::WatchpointSet::isStillValid):
+        (JSC::WatchpointSet::hasBeenInvalidated):
+        (JSC::WatchpointSet::startWatching):
+        (JSC::WatchpointSet::notifyWrite):
+        (JSC::WatchpointSet::addressOfIsWatched):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetStaticVar):
+        (JSC::BytecodeGenerator::emitPutStaticVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberStructures):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        (JSC::DFG::AbstractState::didClobber):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::globalVarStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        * dfg/DFGCorrectableJumpPoint.h:
+        (JSC::DFG::CorrectableJumpPoint::isSet):
+        (CorrectableJumpPoint):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifierNumberForCheck):
+        (Node):
+        (JSC::DFG::Node::identifierNumberForCheck):
+        (JSC::DFG::Node::hasRegisterPointer):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::appendCall):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_global_var_check):
+        (JSC):
+        (JSC::JIT::emitSlow_op_put_global_var_check):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_global_var_check):
+        (JSC):
+        (JSC::JIT::emitSlow_op_put_global_var_check):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSObject):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/SymbolTable.cpp: Added.
+        (JSC):
+        (JSC::SymbolTableEntry::copySlow):
+        (JSC::SymbolTableEntry::freeFatEntrySlow):
+        (JSC::SymbolTableEntry::couldBeWatched):
+        (JSC::SymbolTableEntry::attemptToWatch):
+        (JSC::SymbolTableEntry::addressOfIsWatched):
+        (JSC::SymbolTableEntry::addWatchpoint):
+        (JSC::SymbolTableEntry::notifyWriteSlow):
+        (JSC::SymbolTableEntry::inflateSlow):
+        * runtime/SymbolTable.h:
+        (JSC):
+        (SymbolTableEntry):
+        (Fast):
+        (JSC::SymbolTableEntry::Fast::Fast):
+        (JSC::SymbolTableEntry::Fast::isNull):
+        (JSC::SymbolTableEntry::Fast::getIndex):
+        (JSC::SymbolTableEntry::Fast::isReadOnly):
+        (JSC::SymbolTableEntry::Fast::getAttributes):
+        (JSC::SymbolTableEntry::Fast::isFat):
+        (JSC::SymbolTableEntry::SymbolTableEntry):
+        (JSC::SymbolTableEntry::~SymbolTableEntry):
+        (JSC::SymbolTableEntry::operator=):
+        (JSC::SymbolTableEntry::isNull):
+        (JSC::SymbolTableEntry::getIndex):
+        (JSC::SymbolTableEntry::getFast):
+        (JSC::SymbolTableEntry::getAttributes):
+        (JSC::SymbolTableEntry::isReadOnly):
+        (JSC::SymbolTableEntry::watchpointSet):
+        (JSC::SymbolTableEntry::notifyWrite):
+        (FatEntry):
+        (JSC::SymbolTableEntry::FatEntry::FatEntry):
+        (JSC::SymbolTableEntry::isFat):
+        (JSC::SymbolTableEntry::fatEntry):
+        (JSC::SymbolTableEntry::inflate):
+        (JSC::SymbolTableEntry::bits):
+        (JSC::SymbolTableEntry::freeFatEntry):
+        (JSC::SymbolTableEntry::pack):
+        (JSC::SymbolTableEntry::isValidIndex):
+
+2012-06-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed build fix for ARMv7 debug builds.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+
+2012-06-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix for case-sensitive file systems: use the right case.
+
+        * heap/ListableHandler.h:
+
+2012-06-11  Geoffrey Garen  <ggaren@apple.com>
+
+        GC should be 1.7X faster
+        https://bugs.webkit.org/show_bug.cgi?id=88840
+
+        Reviewed by Oliver Hunt.
+
+        I profiled, and removed anything that showed up as a concurrency
+        bottleneck. Then, I added 3 threads to our max thread count, since we
+        can scale up to more threads now.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        (JSC::BlockAllocator::~BlockAllocator):
+        (JSC::BlockAllocator::releaseFreeBlocks):
+        (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
+        (JSC::BlockAllocator::waitForRelativeTime):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+        * heap/BlockAllocator.h:
+        (BlockAllocator):
+        (JSC::BlockAllocator::allocate):
+        (JSC::BlockAllocator::deallocate): Use a spin lock for the common case
+        where we're just popping a linked list. (A pthread mutex would sleep our
+        thread even if the lock were only contended for a microsecond.) 
+
+        Scope the lock to avoid holding it while allocating VM, since that's a
+        slow activity and it doesn't modify any of our data structures.
+
+        We still use a pthread mutex to handle our condition variable since we
+        have to, and it's not a hot path.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::CopiedSpace):
+        (JSC::CopiedSpace::doneFillingBlock):
+        * heap/CopiedSpace.h:
+        (JSC::CopiedSpace::CopiedSpace): Use a spin lock for the to space lock,
+        since it just guards linked list and hash table manipulation.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator):
+        (JSC::MarkStackSegmentAllocator::allocate):
+        (JSC::MarkStackSegmentAllocator::release):
+        (JSC::MarkStackSegmentAllocator::shrinkReserve): Use a spin lock, since
+        we're just managing a linked list.
+
+        (JSC::MarkStackArray::donateSomeCellsTo): Changed donation to be proportional
+        to our current stack size. This fixes cases where we used to donate too
+        much. Interestingly, donating too much was starving the donor (when it
+        ran out of work later) *and* the recipient (since it had to wait on a
+        long donation operation to complete before it could acquire the lock).
+
+        In the worst case, we're still guaranteed to donate N cells in roughly log N time.
+
+        This change also fixes cases where we used to donate too little, since
+        we would always keep a fixed minimum number of cells. In the worst case,
+        with N marking threads, would could have N large object graph roots in
+        our stack for the duration of GC, and scale to only 1 thread.
+
+        It's an interesting observation that a single object in the mark stack
+        might represent an arbitrarily large object graph -- and only the act
+        of marking can find out.
+
+        (JSC::MarkStackArray::stealSomeCellsFrom): Steal in proportion to idle
+        threads. Once again, this fixes cases where constants could cause us
+        to steal too much or too little.
+
+        (JSC::SlotVisitor::donateKnownParallel): Always wake up other threads
+        if they're idle. We can afford to do this because we're conservative
+        about when we donate.
+
+        (JSC::SlotVisitor::drainFromShared):
+        * heap/MarkStack.h:
+        (MarkStackSegmentAllocator):
+        (MarkStackArray):
+        (JSC):
+        * heap/SlotVisitor.h: Merged the "should I donate?" decision into a
+        single function, for simplicity.
+
+        * runtime/Options.cpp:
+        (minimumNumberOfScansBetweenRebalance): Reduced the delay before donation
+        a lot. We can afford to do this because, in the common case, donation is
+        a single branch that decides not to donate. 
+
+        (cpusToUse): Use more CPUs now, since we scale better now.
+
+        * runtime/Options.h:
+        (Options): Removed now-unused variables.
+
+2012-06-12  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(120121): inspector tests crash in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=88941
+
+        Reviewed by Geoffrey Garen.
+        
+        The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've
+        already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't
+        is that the second way depends on the node referring to other nodes in the to-be-jettisoned
+        block. After fixup they potentially will refer to nodes in the block being merged to.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
+2012-06-12  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
+        https://bugs.webkit.org/show_bug.cgi?id=87334
+
+        Reviewed by Geoffrey Garen.
+
+        Add a copy member function to JSC::HasTable. This function will copy all data
+        members except for *table* which contains thread specific data that prevents
+        up copying it. When you want to copy a JSC::HashTable that was constructed
+        on another thread you should call JSC::HashTable::copy().
+
+        * runtime/Lookup.h:
+        (JSC::HashTable::copy):
+        (HashTable):
+
+2012-06-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double
+        until after CFG simplification
+        https://bugs.webkit.org/show_bug.cgi?id=88927
+        <rdar://problem/11513971>
+
+        Reviewed by Geoffrey Garen.
+        
+        Speculation fixup needs to run if simplification did things, because simplification can change
+        predictions - particularly if you had a control flow path that stored weird things into a
+        variable, but that path got axed by the simplifier.
+        
+        Running fixup in the fixpoint requires making it idempotent, which it previously wasn't. Only
+        one place needed to be changed, namely the un-MustGenerate-ion of ValueToInt32.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2012-06-12  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object
+        https://bugs.webkit.org/show_bug.cgi?id=88783
+        <rdar://problem/11640299>
+
+        Reviewed by Geoffrey Garen.
+        
+        If you don't keep alive the base of an object access over the various checks
+        you do for the prototype chain, you're going to have a bad time.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+
+2012-06-12  Hojong Han  <hojong.han@samsung.com>
+
+        Property names of the built-in object cannot be retrieved 
+        after trying to delete one of its properties
+        https://bugs.webkit.org/show_bug.cgi?id=86461
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+
+2012-06-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE][EFL] Remove duplicated executable output path
+        https://bugs.webkit.org/show_bug.cgi?id=88765
+
+        Reviewed by Daniel Bates.
+
+        CMake files for EFL port have redefined executable output path. However, EFL port doesn't
+        need to define again because it is already defined in top-level CMake file.
+
+        * shell/CMakeLists.txt:
+
+2012-06-11  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck issues.
+
+        * GNUmakefile.list.am: Remove non existent header file.
+
+2012-06-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r119844 and r119925.
+
+        * runtime/Executable.h:
+        (ExecutableBase):
+        (JSC::ExecutableBase::clearCodeVirtual):
+
+2012-06-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r119844.
+
+        * runtime/Executable.h:
+        (ExecutableBase):
+        (JSC):
+
+2012-06-09  Dominic Cooney  <dominicc@chromium.org>
+
+        [Chromium] Remove JavaScriptCore dependencies from gyp
+        https://bugs.webkit.org/show_bug.cgi?id=88510
+
+        Reviewed by Adam Barth.
+
+        Chromium doesn't support JSC any more and there doesn't seem to be
+        a strong interest in using GYP as the common build system in other
+        ports.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp: WebCore still depends on YARR interpreter.
+        * JavaScriptCore.gypi: Only include YARR source.
+        * gyp/JavaScriptCore.gyp: Removed.
+        * gyp/gtk.gyp: Removed.
+
+2012-06-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in part2 of r118646.
+
+        This patch removes eager finalization.
+
+        Weak pointer finalization should be lazy
+        https://bugs.webkit.org/show_bug.cgi?id=87599
+
+        Reviewed by Sam Weinig.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect): Don't finalize eagerly -- we'll do it lazily.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep): Do sweep weak sets when sweeping a block,
+        since we won't get another chance.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::sweepWeakSet):
+        * heap/MarkedSpace.cpp:
+        (MarkedSpace::WeakSetSweep):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::sweepWeakSets): Removed now-unused code.
+
+2012-06-09  Sukolsak Sakshuwong  <sukolsak@google.com>
+
+        Add UNDO_MANAGER flag
+        https://bugs.webkit.org/show_bug.cgi?id=87908
+
+        Reviewed by Tony Chang.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-06-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in part1 of r118646.
+
+        This patch includes everything necessary for lazy finalization, but
+        keeps eager finalization enabled for the time being.
+
+        Weak pointer finalization should be lazy
+        https://bugs.webkit.org/show_bug.cgi?id=87599
+
+        Reviewed by Sam Weinig.
+
+        * heap/MarkedBlock.cpp:
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::resetAllocator):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::resetAllocators):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
+        It will happen automatically when a weak set is swept. It's simpler to
+        have only one canonical way for this to happen, and it wasn't buying
+        us anything to do it eagerly.
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
+        the sweep would be a no-op. If even one finalizer is pending, we need to
+        run it, since we won't get another chance.
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::sweep): This loop can be simpler now that
+        WeakBlock::sweep() does what we mean.
+        Reset our allocator after a sweep because this is the optimal time to
+        start trying to recycle old weak pointers.
+        (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
+        allocator because we've swept already, and forcing a new sweep would be
+        wasteful.
+        * heap/WeakSet.h:
+        (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
+        because the shrink may have removed the block the allocator was going to
+        allocate out of.
+
+2012-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Unreviewed roll out r119795.
+        
+        This broke jquery/core.html
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalThis.cpp:
+        (JSC::JSGlobalThis::setUnwrappedObject):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::resetInheritorID):
+        (JSC):
+        (JSC::JSObject::offsetOfInheritorID):
+        (JSC::JSObject::inheritorID):
+
+2012-06-08  Filip Pizlo  <fpizlo@apple.com>
+
+        PredictedType should be called SpeculatedType
+        https://bugs.webkit.org/show_bug.cgi?id=88477
+
+        Unreviewed, fix a renaming goof from http://trac.webkit.org/changeset/119660.
+        I accidentally renamed ByteCodeParser::getPrediction to
+        ByteCodeParser::getSpeculation.  That was not the intent. This changes it
+        back.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2012-06-08  Andy Wingo  <wingo@igalia.com>
+
+        Explictly mark stubs called by JIT as being internal
+        https://bugs.webkit.org/show_bug.cgi?id=88552
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * jit/HostCallReturnValue.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/ThunkGenerators.cpp:
+        * llint/LLIntSlowPaths.h: Mark a bunch of stubs as being
+        WTF_INTERNAL.  Change most calls to SYMBOL_STRING_RELOCATION to
+        LOCAL_REFERENCE, or GLOBAL_REFERENCE in the case of the wrappers
+        to truly global symbols.
+        * offlineasm/asm.rb: Generate LOCAL_REFERENCE instead of
+        SYMBOL_STRING_RELOCATION.
+
+2012-06-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Don't rely on weak pointers for eager CodeBlock finalization
+        https://bugs.webkit.org/show_bug.cgi?id=88465
+
+        Reviewed by Gavin Barraclough.
+
+        This is incompatible with lazy weak pointer finalization.
+
+        I considered just making CodeBlock finalization lazy-friendly, but it
+        turns out that the heap is already way up in CodeBlock's business when
+        it comes to finalization, so I decided to finish the job and move full
+        responsibility for CodeBlock finalization into the heap.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Maybe this
+        will build.
+
+        * debugger/Debugger.cpp: Updated for rename.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode): Renamed for consistency. Fixed a bug
+        where we would not delete code for a code block that had been previously
+        jettisoned. I don't know if this happens in practice -- I mostly did
+        this to improve consistency with deleteUnmarkedCompiledCode.
+
+        (JSC::Heap::deleteUnmarkedCompiledCode): New function, responsible for
+        eager finalization of unmarked code blocks.
+
+        (JSC::Heap::collect): Updated for rename. Updated to call
+        deleteUnmarkedCompiledCode(), which takes care of jettisoned DFG code
+        blocks too.
+
+        (JSC::Heap::addCompiledCode): Renamed, since this points to all code
+        now, not just functions.
+
+        * heap/Heap.h:
+        (Heap): Keep track of all user code, not just functions. This is a
+        negligible additional overhead, since most code is function code.
+
+        * runtime/Executable.cpp:
+        (JSC::*::finalize): Removed these functions, since we don't rely on
+        weak pointer finalization anymore.
+
+        (JSC::FunctionExecutable::FunctionExecutable): Moved linked-list stuff
+        into base class so all executables can be in the list.
+
+        (JSC::EvalExecutable::clearCode):
+        (JSC::ProgramExecutable::clearCode):
+        (JSC::FunctionExecutable::clearCode): All we need to do is delete our
+        CodeBlock -- that will delete all of its internal data structures.
+
+        (JSC::FunctionExecutable::clearCodeIfNotCompiling): Factored out a helper
+        function to improve clarity.
+
+        * runtime/Executable.h:
+        (JSC::ExecutableBase): Moved linked-list stuff
+        into base class so all executables can be in the list.
+
+        (JSC::NativeExecutable::create):
+        (NativeExecutable):
+        (ScriptExecutable):
+        (JSC::ScriptExecutable::finishCreation):
+        (JSC::EvalExecutable::create):
+        (EvalExecutable):
+        (JSC::ProgramExecutable::create):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::create): Don't use a finalizer -- the heap
+        will call us back to destroy our code block.
+
+        (JSC::FunctionExecutable::discardCode): Renamed to clearCodeIfNotCompiling()
+        for clarity.
+
+        (JSC::FunctionExecutable::isCompiling): New helper function, for clarity.
+
+        (JSC::ScriptExecutable::clearCodeVirtual): New helper function, since
+        the heap needs to make polymorphic calls to clear code.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::StackPreservingRecompiler::operator()):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
+        renames.
+
+2012-06-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline prototype chain accesses, and do the right things if the
+        specific function optimization is available
+        https://bugs.webkit.org/show_bug.cgi?id=88594
+
+        Reviewed by Gavin Barraclough.
+        
+        Looks like a 3% win on V8.
+
+        * bytecode/CodeBlock.h:
+        (JSC::Structure::prototypeForLookup):
+        (JSC):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::isSimple):
+        (JSC::GetByIdStatus::chain):
+        (JSC::GetByIdStatus::specificValue):
+        (GetByIdStatus):
+        * bytecode/StructureSet.h:
+        (StructureSet):
+        (JSC::StructureSet::singletonStructure):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+
+2012-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove JSObject::m_inheritorID
+        https://bugs.webkit.org/show_bug.cgi?id=88378
+
+        Reviewed by Geoff Garen.
+
+        This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
+        and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
+        Instead use a private named value in the object's property storage.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+            - No need m_inheritorID to initialize!
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+            - No need m_inheritorID to initialize!
+        * llint/LowLevelInterpreter.asm:
+            - No need m_inheritorID to initialize!
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+            - Added private name 'm_inheritorIDKey'.
+        * runtime/JSGlobalThis.cpp:
+        (JSC::JSGlobalThis::setUnwrappedObject):
+            - resetInheritorID is now passed a JSGlobalData&.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+            - No m_inheritorID to be marked.
+        (JSC::JSObject::createInheritorID):
+            - Store the newly created inheritorID in the property map.
+        * runtime/JSObject.h:
+        (JSC::JSObject::resetInheritorID):
+            - Remove the inheritorID from property storage.
+        (JSC::JSObject::inheritorID):
+            - Read the inheritorID from property storage.
+
+2012-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Math.pow on iOS does not support denormal numbers.
+        https://bugs.webkit.org/show_bug.cgi?id=88592
+
+        Reviewed by Filip Pizlo.
+
+        Import an implementation from fdlibm, detect cases where it is safe to use the system
+        implementation & where we should fall back to fdlibm.
+
+        * runtime/MathObject.cpp:
+        (JSC::isDenormal):
+        (JSC::isEdgeCase):
+        (JSC::mathPow):
+            - On iOS, detect cases where denormal support may be required & use fdlibm in these cases.
+        (JSC::mathProtoFuncPow):
+            - Changed to use mathPow.
+        (JSC::fdlibmScalbn):
+        (JSC::fdlibmPow):
+            - These functions imported from fdlibm; original style retained to ease future merging.
+
+2012-06-07  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r119441.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-06-07  Andy Wingo  <wingo@igalia.com>
+
+        Unreviewed build fix after r119593.
+
+        * llint/LLIntOfflineAsmConfig.h (OFFLINE_ASM_GLOBAL_LABEL): Fix
+        uses of "name" to be "label", the macro's parameter.  Otherwise we
+        serialize mentions of the literal symbol "name" into the objcode.
+        Causes a build error using GNU ld (not gold).
+
+2012-06-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Chromium build fix attempt. Why do we need to list these files in gyp!?
+
+        * JavaScriptCore.gypi:
+
+2012-06-06  Filip Pizlo  <fpizlo@apple.com>
+
+        PredictedType should be called SpeculatedType
+        https://bugs.webkit.org/show_bug.cgi?id=88477
+
+        Rubber stamped by Gavin Barraclough.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::prediction):
+        * bytecode/LazyOperandValueProfile.h:
+        (LazyOperandValueProfileParser):
+        * bytecode/PredictedType.cpp: Removed.
+        * bytecode/PredictedType.h: Removed.
+        * bytecode/SpeculatedType.cpp: Copied from Source/JavaScriptCore/bytecode/PredictedType.cpp.
+        (JSC::speculationToString):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromClassInfo):
+        (JSC::speculationFromStructure):
+        (JSC::speculationFromCell):
+        (JSC::speculationFromValue):
+        * bytecode/SpeculatedType.h: Copied from Source/JavaScriptCore/bytecode/PredictedType.h.
+        (JSC):
+        (JSC::isAnySpeculation):
+        (JSC::isCellSpeculation):
+        (JSC::isObjectSpeculation):
+        (JSC::isFinalObjectSpeculation):
+        (JSC::isFinalObjectOrOtherSpeculation):
+        (JSC::isFixedIndexedStorageObjectSpeculation):
+        (JSC::isStringSpeculation):
+        (JSC::isArraySpeculation):
+        (JSC::isFunctionSpeculation):
+        (JSC::isInt8ArraySpeculation):
+        (JSC::isInt16ArraySpeculation):
+        (JSC::isInt32ArraySpeculation):
+        (JSC::isUint8ArraySpeculation):
+        (JSC::isUint8ClampedArraySpeculation):
+        (JSC::isUint16ArraySpeculation):
+        (JSC::isUint32ArraySpeculation):
+        (JSC::isFloat32ArraySpeculation):
+        (JSC::isFloat64ArraySpeculation):
+        (JSC::isArgumentsSpeculation):
+        (JSC::isActionableIntMutableArraySpeculation):
+        (JSC::isActionableFloatMutableArraySpeculation):
+        (JSC::isActionableTypedMutableArraySpeculation):
+        (JSC::isActionableMutableArraySpeculation):
+        (JSC::isActionableArraySpeculation):
+        (JSC::isArrayOrOtherSpeculation):
+        (JSC::isMyArgumentsSpeculation):
+        (JSC::isInt32Speculation):
+        (JSC::isDoubleRealSpeculation):
+        (JSC::isDoubleSpeculation):
+        (JSC::isNumberSpeculation):
+        (JSC::isBooleanSpeculation):
+        (JSC::isOtherSpeculation):
+        (JSC::isEmptySpeculation):
+        (JSC::mergeSpeculations):
+        (JSC::mergeSpeculation):
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::speculationFromStructures):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::ValueProfileBase):
+        (JSC::ValueProfileBase::dump):
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        (ValueProfileBase):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::speculateInt32Unary):
+        (JSC::DFG::AbstractState::speculateNumberUnary):
+        (JSC::DFG::AbstractState::speculateBooleanUnary):
+        (JSC::DFG::AbstractState::speculateInt32Binary):
+        (JSC::DFG::AbstractState::speculateNumberBinary):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::filter):
+        (JSC::DFG::StructureAbstractValue::speculationFromStructures):
+        (JSC::DFG::AbstractValue::AbstractValue):
+        (JSC::DFG::AbstractValue::clear):
+        (JSC::DFG::AbstractValue::isClear):
+        (JSC::DFG::AbstractValue::makeTop):
+        (JSC::DFG::AbstractValue::clobberStructures):
+        (JSC::DFG::AbstractValue::isTop):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::validateIgnoringValue):
+        (JSC::DFG::AbstractValue::validate):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::dump):
+        (AbstractValue):
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::ArgumentPosition::ArgumentPosition):
+        (JSC::DFG::ArgumentPosition::mergeArgumentAwareness):
+        (JSC::DFG::ArgumentPosition::prediction):
+        (ArgumentPosition):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::getSpeculationWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getSpeculation):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::nameOfVariableAccessData):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::getJSConstantSpeculation):
+        (JSC::DFG::Graph::isPredictedNumerical):
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::getSpeculation):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::getHeapPrediction):
+        (JSC::DFG::Node::predictHeap):
+        (JSC::DFG::Node::prediction):
+        (JSC::DFG::Node::predict):
+        (JSC::DFG::Node::shouldSpeculateInteger):
+        (JSC::DFG::Node::shouldSpeculateDouble):
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        (JSC::DFG::Node::shouldSpeculateBoolean):
+        (JSC::DFG::Node::shouldSpeculateFinalObject):
+        (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther):
+        (JSC::DFG::Node::shouldSpeculateArray):
+        (JSC::DFG::Node::shouldSpeculateArguments):
+        (JSC::DFG::Node::shouldSpeculateInt8Array):
+        (JSC::DFG::Node::shouldSpeculateInt16Array):
+        (JSC::DFG::Node::shouldSpeculateInt32Array):
+        (JSC::DFG::Node::shouldSpeculateUint8Array):
+        (JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
+        (JSC::DFG::Node::shouldSpeculateUint16Array):
+        (JSC::DFG::Node::shouldSpeculateUint32Array):
+        (JSC::DFG::Node::shouldSpeculateFloat32Array):
+        (JSC::DFG::Node::shouldSpeculateFloat64Array):
+        (JSC::DFG::Node::shouldSpeculateArrayOrOther):
+        (JSC::DFG::Node::shouldSpeculateObject):
+        (JSC::DFG::Node::shouldSpeculateCell):
+        (Node):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::setPrediction):
+        (JSC::DFG::PredictionPropagationPhase::mergePrediction):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+        * dfg/DFGSpeculativeJIT.h:
+        (DFG):
+        (JSC::DFG::ValueSource::forSpeculation):
+        (SpeculativeJIT):
+        (GPRTemporary):
+        (FPRTemporary):
+        (JSC::DFG::SpecDoubleOperand::SpecDoubleOperand):
+        (JSC::DFG::SpecDoubleOperand::~SpecDoubleOperand):
+        (JSC::DFG::SpecDoubleOperand::fpr):
+        (JSC::DFG::SpecCellOperand::SpecCellOperand):
+        (JSC::DFG::SpecCellOperand::~SpecCellOperand):
+        (JSC::DFG::SpecCellOperand::gpr):
+        (JSC::DFG::SpecBooleanOperand::SpecBooleanOperand):
+        (JSC::DFG::SpecBooleanOperand::~SpecBooleanOperand):
+        (JSC::DFG::SpecBooleanOperand::gpr):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpecDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpecCell):
+        (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpecDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpecCell):
+        (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::predict):
+        (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
+        (JSC::DFG::VariableAccessData::prediction):
+        (JSC::DFG::VariableAccessData::argumentAwarePrediction):
+        (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
+        (VariableAccessData):
+
+2012-06-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Global object variable accesses should not require an extra load
+        https://bugs.webkit.org/show_bug.cgi?id=88385
+
+        Reviewed by Gavin Barraclough and Geoffrey Garen.
+        
+        Previously, if you wanted to access a global variable, you'd first have
+        to load the register array from the appropriate global object and then
+        either load or store at an offset to the register array. This is because
+        JSGlobalObject inherited from JSVariableObject, and JSVariableObject is
+        designed with the pessimistic assumption that its register array may
+        point into the call stack. This is never the case for global objects.
+        Hence, even though the global object may add more registers at any time,
+        it does not need to store them in a contiguous array. It can use a
+        SegmentedVector or similar.
+        
+        This patch refactors global objects and variable objects as follows:
+        
+        - The functionality to track variables in an indexable array using a
+          SymbolTable to map names to indices is moved into JSSymbolTableObject,
+          which is now a supertype of JSVariableObject. JSVariableObject is now
+          just a holder for a registers array and implements the registerAt()
+          method that is left abstract in JSSymbolTableObject. Because all users
+          of JSVariableObject know whether they are a JSStaticScopeObject,
+          JSActivation, or JSGlobalObject, this "abstract" method is not virtual;
+          instead the utility methods that would call registerAt() are now
+          template functions that require you to know statically what subtype of
+          JSSymbolTableObject you're using (JSVariableObject or something else),
+          so that registerAt() can be statically bound.
+        
+        - A new class is added called JSSegmentedVariableObject, which only
+          differs from JSVariableObject in how it allocates registers. It uses a
+          SegmentedVector instead of manually managing a pointer to a contiguous
+          slab of registers. This changes the interface somewhat; for example
+          with JSVariableObject if you wanted to add a register you had to do
+          it yourself since the JSVariableObject didn't know how the registers
+          array ought to be allocated. With JSSegmentedVariableObject you can
+          just call addRegisters(). JSSegmentedVariableObject preserves the
+          invariant that once you get a pointer into a register, that pointer
+          will continue to be valid so long as the JSSegmentedVariableObject is
+          alive. This allows the JITs and interpreters to skip the extra load.
+        
+        - JSGlobalObject now inherits from JSSegmentedVariableObject. For now
+          (and possibly forever) it is the only subtype of this new class.
+        
+        - The bytecode format is changed so that get_global_var and
+          put_global_var have a pointer to the register directly rather than
+          having an index. A convenience method is provided in
+          JSSegmentedVariableObject to get the index given a a pointer, which is
+          used for assertions and debug dumps.
+        
+        This appears to be a 1% across the board win.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Instruction.h:
+        (Instruction):
+        (JSC::Instruction::Instruction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::registerPointer):
+        (JSC):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::retrieveLastUnaryOp):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        (JSC::BytecodeGenerator::emitGetStaticVar):
+        (JSC::BytecodeGenerator::emitPutStaticVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (ResolveResult):
+        (BytecodeGenerator):
+        * dfg/DFGAssemblyHelpers.h:
+        (AssemblyHelpers):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::globalVarStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::globalObjectFor):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasVarNumber):
+        (Node):
+        (JSC::DFG::Node::hasRegisterPointer):
+        (JSC::DFG::Node::registerPointer):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::isWriteBarrierEnabled):
+        (JSC):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSGlobalObject.cpp:
+        (JSC):
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putDirectVirtual):
+        (JSC::JSGlobalObject::defineOwnProperty):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        (JSC::JSGlobalObject::getOwnPropertyDescriptor):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC):
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
+        * runtime/JSSegmentedVariableObject.cpp: Added.
+        (JSC):
+        (JSC::JSSegmentedVariableObject::findRegisterIndex):
+        (JSC::JSSegmentedVariableObject::addRegisters):
+        (JSC::JSSegmentedVariableObject::visitChildren):
+        * runtime/JSSegmentedVariableObject.h: Added.
+        (JSC):
+        (JSSegmentedVariableObject):
+        (JSC::JSSegmentedVariableObject::registerAt):
+        (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject):
+        (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+        (JSC::JSSegmentedVariableObject::finishCreation):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putDirectVirtual):
+        (JSC::JSStaticScopeObject::getOwnPropertySlot):
+        * runtime/JSSymbolTableObject.cpp: Added.
+        (JSC):
+        (JSC::JSSymbolTableObject::destroy):
+        (JSC::JSSymbolTableObject::deleteProperty):
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        (JSC::JSSymbolTableObject::putDirectVirtual):
+        (JSC::JSSymbolTableObject::isDynamicScope):
+        * runtime/JSSymbolTableObject.h: Added.
+        (JSC):
+        (JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::symbolTable):
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::finishCreation):
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/JSVariableObject.cpp:
+        (JSC):
+        * runtime/JSVariableObject.h:
+        (JSVariableObject):
+        (JSC::JSVariableObject::JSVariableObject):
+        (JSC::JSVariableObject::finishCreation):
+        (JSC):
+        * runtime/WriteBarrier.h:
+
+2012-06-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG arguments access slow path should not crash if the arguments haven't been created
+        https://bugs.webkit.org/show_bug.cgi?id=88471
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-06-06  Michael Saboff  <msaboff@apple.com>
+
+        ENH: Add Logging to GC Marking Phase
+        https://bugs.webkit.org/show_bug.cgi?id=88364
+
+        Reviewed by Filip Pizlo.
+
+        Log GC marking to stderr or a file.  The logging in controlled
+        with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h.
+        If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is
+        logged to a file otherwise it is logged to stderr.
+
+        When logging is enabled, the GC is built single threaded since the
+        log output from the various threads isn't buffered and output in a
+        thread safe manner.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::resetChildren):
+        (JSC::MarkStackThreadSharedData::childVisitCount):
+        (JSC::MarkStackThreadSharedData::markingThreadMain):
+        (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::MarkStackThreadSharedData::reset):
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        (MarkStack):
+        (JSC::MarkStack::sharedData):
+        (JSC::MarkStack::resetChildCount):
+        (JSC::MarkStack::childCount):
+        (JSC::MarkStack::incrementChildCount):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::visitChildren):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::className):
+        * runtime/JSCell.h:
+        (JSCell):
+        (JSC::JSCell::visitChildren):
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren):
+        * runtime/JSString.h:
+        (JSString):
+        * runtime/Structure.h:
+        (JSC::MarkStack::internalAppend):
+
+2012-06-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Assigning to a static property should not change iteration order
+        https://bugs.webkit.org/show_bug.cgi?id=88401
+
+        Reviewed by Geoff Garen.
+
+        A specific iteration order is not defined by the spec, but test-262 somewhat tenuously
+        requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js
+
+        Whilst it is not clear that this behavior really arises from the specification, it
+        would seem like common sense to conform to this.
+
+        The problem here is that we allow properties in the structure to shadow those in the
+        static table, and we iterate the properties in the structure first - which means that
+        as values of existing properties are modified, their iteration order changes too.
+
+        The easy fix is to iterate the properties from the static table first. This has a
+        further benefit, since it will mean that user added properties will come after those
+        present in the static table (respected the expected insertion-order).
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyNames):
+            - Iterate static properties first.
+
+2012-06-06  Andy Wingo  <wingo@igalia.com>
+
+        Ensure consistent order of evaluation in LLInt slow paths
+        https://bugs.webkit.org/show_bug.cgi?id=88409
+
+        Reviewed by Geoffrey Garen.
+
+        * llint/LLIntSlowPaths.cpp:
+        (slow_path_mul)
+        (slow_path_sub)
+        (slow_path_div)
+        (slow_path_mod)
+        (slow_path_lshift)
+        (slow_path_rshift)
+        (slow_path_urshift)
+        (slow_path_bitand)
+        (slow_path_bitor)
+        (slow_path_bitxor): Avoid calling toNumber, toInt32, or toUInt32
+        multiple times without intervening sequence points.  Fixes
+        fast/js/exception-sequencing-binops.html with GCC 4.7 on x86-64
+        Linux, which reordered evaluation of the arguments to fmod.
+
+2012-06-06  Andy Wingo  <wingo@igalia.com>
+
+        [GTK] Enable the LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=88315
+
+        Reviewed by Filip Pizlo.
+
+        * GNUmakefile.am: Add rules to generate LLIntDesiredOffsets.h and
+        LLIntAssembly.h.
+        * GNUmakefile.list.am: Add offlineasm and llint files to the
+        dist.  Add LLInt source files to the build.
+        * llint/LowLevelInterpreter.asm (crash): Generate a store of
+        0xbbadbeef to a register, not to a constant.  Otherwise, gas was
+        failing to assemble result.
+        * offlineasm/asm.rb (labelReference): Generate a
+        SYMBOL_STRING_RELOCATION instead of a SYMBOL_STRING, so that we go
+        through the PLT on ELF systems.
+
+2012-06-06  Andy Wingo  <wingo@igalia.com>
+
+        REGRESSION (r106478): None of the Paper.js JavaScript examples work
+        https://bugs.webkit.org/show_bug.cgi?id=87158
+
+        Reviewed by Michael Saboff.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve): If we have to bail out to
+        dynamicResolve(), only skip static scopes from the head of the
+        scope chain.  Before, we were also skipping activations with
+        direct eval as well, which was incorrect.
+
+2012-06-06  Dan Bernstein  <mitz@apple.com>
+
+        Reverted r119567, the fix for <http://webkit.org/b/88378>, because it broke the 32-bit build.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalThis.cpp:
+        (JSC::JSGlobalThis::setUnwrappedObject):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::resetInheritorID):
+        (JSC):
+        (JSC::JSObject::offsetOfInheritorID):
+        (JSC::JSObject::inheritorID):
+
+2012-06-05  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Improve Math.round and Math.floor intrinsic
+        https://bugs.webkit.org/show_bug.cgi?id=88314
+
+        Reviewed by Filip Pizlo.
+
+        Currently we call a native function from the JIT code to complete the
+        "round" and "floor" operations. We could inline some fast paths
+        especially for those positive values on the platforms where floating
+        point truncation is supported.
+        This brings 3% gain on Kraken, especially 32% on audio-oscillator,
+        and slight win on SunSpider, measured on IA32.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::floorThunkGenerator):
+        (JSC):
+        (JSC::roundThunkGenerator):
+
+2012-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove JSObject::m_inheritorID
+        https://bugs.webkit.org/show_bug.cgi?id=88378
+
+        Reviewed by Geoff Garen.
+
+        This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
+        and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
+        Instead use a private named value in the object's property storage.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+            - No need m_inheritorID to initialize!
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+            - No need m_inheritorID to initialize!
+        * llint/LowLevelInterpreter.asm:
+            - No need m_inheritorID to initialize!
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+            - Added private name 'm_inheritorIDKey'.
+        * runtime/JSGlobalThis.cpp:
+        (JSC::JSGlobalThis::setUnwrappedObject):
+            - resetInheritorID is now passed a JSGlobalData&.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+            - No m_inheritorID to be marked.
+        (JSC::JSObject::createInheritorID):
+            - Store the newly created inheritorID in the property map.
+        * runtime/JSObject.h:
+        (JSC::JSObject::resetInheritorID):
+            - Remove the inheritorID from property storage.
+        (JSC::JSObject::inheritorID):
+            - Read the inheritorID from property storage.
+
+2012-06-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFG simplification should not attempt to deref nodes inside of an unreachable subgraph
+        https://bugs.webkit.org/show_bug.cgi?id=88362
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::fixPhis):
+        (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
+
+2012-06-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Entry into JSC should CRASH() if the Heap is busy
+        https://bugs.webkit.org/show_bug.cgi?id=88355
+
+        Reviewed by Geoffrey Garen.
+
+        Interpreter::execute() returns jsNull() right now if we try to enter it while 
+        the Heap is busy (e.g. with a collection), which is okay, but some code paths 
+        that call Interpreter::execute() allocate objects before checking if the Heap 
+        is busy. Attempting to execute JS code while the Heap is busy should not be 
+        allowed and should be enforced by a release-mode CRASH() to prevent vague, 
+        unhelpful backtraces later on if somebody makes a mistake. Normally, recursively 
+        executing JS code is okay, e.g. for evals, but it should not occur during a 
+        Heap allocation or collection because the Heap is not guaranteed to be in a 
+        consistent state (especially during collections). We are protected from 
+        executing JS on the same Heap concurrently on two separate threads because 
+        they must each take a JSLock first. However, we are not protected from reentrant 
+        execution of JS on the same thread because JSLock allows reentrancy. Therefore, 
+        we should fail early if we detect an entrance into JS code while the Heap is busy.
+
+        * heap/Heap.cpp: Changed Heap::collect so that it sets the m_operationInProgress field 
+        at the beginning of collection and then unsets it at the end so that it is set at all 
+        times throughout the duration of a collection rather than sporadically during various 
+        phases. There is no reason to unset during a collection because our collector does 
+        not currently support running additional JS between the phases of a collection.
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute): Crash if the Heap is busy.
+        * runtime/Completion.cpp: Crash if the Heap is busy. We do it here before we call 
+        Interpreter::execute() because we do some allocation prior to calling execute() which 
+        could cause Heap corruption if, for example, that allocation caused a collection.
+        (JSC::evaluate):
+
+2012-06-05  Dongwoo Im  <dw.im@samsung.com>
+
+        Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'.
+        https://bugs.webkit.org/show_bug.cgi?id=73176
+
+        Reviewed by Adam Barth.
+
+        Two more APIs are added in Custom Scheme Handler specification.
+        http://dev.w3.org/html5/spec/Overview.html#custom-handlers
+        One is 'isProtocolHandlerRegistered' to query whether the specific URL
+        is registered or not.
+        The other is 'unregisterProtocolHandler' to remove the registered URL.
+
+        * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'.
+
+2012-06-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFG simplification should correct the variables at the head of the predecessor block
+        https://bugs.webkit.org/show_bug.cgi?id=88284
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
+2012-06-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed.
+
+        Rolled out r119364 because it's still causing crashes (when running
+        v8-earley in release builds of DRT)
+
+        This time for sure!
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::resetAllocator):
+        (JSC):
+        * heap/MarkedSpace.cpp:
+        (JSC::ResetAllocator::operator()):
+        (JSC):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::sweepWeakSets):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::sweep):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::sweep):
+        (JSC::WeakSet::tryFindAllocator):
+        * heap/WeakSet.h:
+        (JSC::WeakSet::shrink):
+
+2012-06-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG arguments simplification should have rationalized handling of TearOffArguments
+        https://bugs.webkit.org/show_bug.cgi?id=88206
+
+        Reviewed by Geoffrey Garen.
+        
+        - Accesses to the unmodified arguments register ought to have the same effect on
+          alias/escape analysis of arguments as accesses to the mutable arguments register.
+        
+        - The existence of TearOffArguments should not get in the way of arguments aliasing.
+        
+        - TearOffArguments should be eliminated if CreateArguments is eliminated.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+
+2012-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove enabledProfilerReference
+        https://bugs.webkit.org/show_bug.cgi?id=88258
+
+        Reviewed by Michael Saboff.
+
+        Make the enabled profiler a member of JSGlobalData, and switch code that accesses it to do so directly
+        via the JSGlobalData, rather than holding a Profiler** reference to it. Do not pass the Profiler**
+        reference to JIT code. This patch does not change the stack layout on entry into JIT code (passing an
+        unused void* instead), since this is an intrusive change better handled in a separate patch.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITCode.h:
+        (JSC::JITCode::execute):
+            - Don't pass Profiler** to JIT code.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITStubs.cpp:
+        (JSC):
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+        (JSC::JITThunks::JITThunks):
+        (JSC::DEFINE_STUB_FUNCTION):
+            - For ARM_THUMB2, rename ENABLE_PROFILER_REFERENCE_OFFSET to FIRST_STACK_ARGUMENT (which is how it is being used).
+            - For MIPS, remove ENABLE_PROFILER_REFERENCE_OFFSET.
+        * jit/JITStubs.h:
+        (JITStackFrame):
+        (JSC):
+            - Renamed enabledProfilerReference to unusedX.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * profiler/Profiler.cpp:
+        (JSC):
+        (JSC::Profiler::startProfiling):
+        (JSC::Profiler::stopProfiling):
+        * profiler/Profiler.h:
+        (Profiler):
+            - Removed s_sharedEnabledProfilerReference, enabledProfilerReference().
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSC::JSGlobalData::enabledProfiler):
+        (JSGlobalData):
+            - Added m_enabledProfiler, enabledProfiler().
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+
+2012-06-04  Filip Pizlo  <fpizlo@apple.com>
+
+        get_argument_by_val should be profiled everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=88205
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2012-06-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG arguments simplification takes unkindly to direct accesses to the arguments register
+        https://bugs.webkit.org/show_bug.cgi?id=88261
+
+        Reviewed by Geoffrey Garen.
+        
+        Fixed arguments simplification for direct accesses to the arguments register, which may
+        arise if CSE had not run. Fixed CSE so that it does run prior to arguments simplification,
+        by making it a full-fledged member of the fixpoint. Fixed other issues in arguments
+        simplification, like realizing that it needs to bail if there is a direct assignment to
+        the arguments register, and failing to turn CreateArguments into PhantomArguments. Also
+        fixed CSE's handling of store elimination of captured locals in the presence of a
+        GetMyArgumentByVal (or one of its friends), and fixed CSE to correctly fixup variables at
+        tail if the Flush it removes is the last operation on a local in a basic block.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::run):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (CSEPhase):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+
+2012-06-04  Anders Carlsson  <andersca@apple.com>
+
+        Fix a struct/class mismatch.
+
+        * heap/Handle.h:
+        (Handle):
+
+2012-06-04  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: FeatureDefines.xcconfig should match across projects
+
+        * Configurations/FeatureDefines.xcconfig:
+        - Add missing ENABLE_LEGACY_CSS_VENDOR_PREFIXES.
+
+2012-06-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Weak pointer finalization should be lazy
+        https://bugs.webkit.org/show_bug.cgi?id=87599
+
+        Reviewed by Sam Weinig.
+
+        This time for sure!
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect): Don't sweep eagerly -- we'll sweep lazily instead.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep): Sweep our weak set before we sweep our other
+        destructors -- this is our last chance to run weak set finalizers before
+        we recycle our memory.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::resetAllocator):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::resetAllocators):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
+        It will happen automatically when a weak set is swept. It's simpler to
+        have only one canonical way for this to happen, and it wasn't buying
+        us anything to do it eagerly.
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
+        the sweep would be a no-op. If even one finalizer is pending, we need to
+        run it, since we won't get another chance.
+
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::sweep): This loop can be simpler now that
+        WeakBlock::sweep() does what we mean.
+
+        Reset our allocator after a sweep because this is the optimal time to
+        start trying to recycle old weak pointers.
+
+        (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
+        allocator because we've swept already, and forcing a new sweep would be
+        wasteful.
+
+        * heap/WeakSet.h:
+        (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
+        because the shrink may have removed the block the allocator was going to
+        allocate out of.
+
+2012-06-02  Filip Pizlo  <fpizlo@apple.com>
+
+        If the DFG bytecode parser detects that op_method_check has gone polymorphic, it
+        shouldn't revert all the way to GetById/GetByIdFlush
+        https://bugs.webkit.org/show_bug.cgi?id=88176
+
+        Reviewed by Geoffrey Garen.
+        
+        Refactored the code so that the op_method_check case of the parser gracefully falls
+        through to all of the goodness of the normal op_get_by_id case.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2012-06-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables
+        https://bugs.webkit.org/show_bug.cgi?id=87929
+
+        Reviewed by Geoffrey Garen.
+        
+        Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions.
+        
+        This required a bunch of changes:
+        
+        - The obvious change is making CSE essentially ignore whether or not the set of
+          operations between the Flush and the SetLocal can exit, and instead focus on whether or
+          not that set of operations can clobber the world or access local variables. This code
+          is now refactored to return a set of flags indicating any of these events, and the CSE
+          decides what to do based on those flags. If the set of operations is non-clobbering
+          and non-accessing, then the Flush is turned into a Phantom on the child of the
+          SetLocal. This expands the liveness of the relevant variable but virtually guarantees
+          that it will be register allocated and not flushed to the stack. So, yeah, this patch
+          is a lot of work to save a few stores to the stack.
+        
+        - Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if
+          it was a no-op if you were holding onto a CFA abstract state. But this would make the
+          CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the
+          constant folding phase into something more broad; it now fixes up
+          CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are
+          no-ops.
+        
+        - Arguments simplification was previously relying on this very strange PhantomArguments
+          node, which had two different meanings: for normal execution it meant the empty value
+          but for OSR exit it meant that the arguments should be reified. This produces problems
+          when set SetLocals to the captured arguments registers are CSE'd away, since we'd be
+          triggering reification of arguments without having initialized the arguments registers
+          to empty. The cleanest solution was to fix PhantomArguments to have one meaning:
+          namely, arguments reification on OSR exit. Hence, this patch changes arguments
+          simplification to change SetLocal of CreateArguments on the arguments registers to be
+          a SetLocal of Empty.
+        
+        - Argument value recoveries were previously derived from the value source of the
+          arguments at the InlineStart. But that relies on all SetLocals to arguments having
+          been flushed. It's possible that we could have elided the SetLocal to the arguments
+          at the callsite because there were subsequent SetLocals to the arguments inside of the
+          callee, in which case the InlineStart would get the wrong information. Hence, this
+          patch changes argument value recovery computation to operate over the ArgumentPositions
+          directly.
+        
+        - But that doesn't actually work, because previously, there was no way to link an
+          InlineStart back to the corresponding ArgumentPositions, at least not without some
+          ugliness. So this patch instates the rule that the m_argumentPositions vector consists
+          of disjoint subsequences such that each subsequence corresponds to an inline callsite
+          and can be identified by its first index, and within each subsequence are the
+          ArgumentPositions of all of the arguments ordered by argument index. This required
+          flipping the order in which ArgumentPositions are added to the vector, and giving
+          InlineStart an operand that indicates the start of that inline callsite's
+          ArgumentPosition subsequence.
+        
+        - This patch also revealed a nasty bug in the reification of arguments in inline call
+          frames on OSR exit. Since the reification was happening after the values of virtual
+          registers were recovered, the value recoveries of the inline arguments were wrong.
+          Hence using operationCreateInlinedArguments is wrong. For example a value recovery
+          might say that you have to box a double, but if we had already boxed it then boxing
+          it a second time will result in garbage. The specific case of this bug was this patch
+          uncovered was that now it is possible for an inline call frame to not have any valid
+          value recoveries for any inline arguments, if the optimization elides all argument
+          flushes, while at the same time optimizing away arguments creation. Then OSR exit
+          would try to recover the arguments using the inline call frame, which had bogus
+          information, and humorous crashes would ensue. This patch fixes this issue by moving
+          arguments reification to after call frame reification, so that arguments reification
+          can always use operationCreateArguments instead of operationCreateInlinedArguments.
+        
+        - This patch may turn a Flush into a Phantom. That's kind of the whole point. But that
+          broke forward speculation checks, which knew to look for a Flush prior to a SetLocal
+          but didn't know that there could alternatively be a Phantom in place of the Flush.
+          This patch fixes that by augmenting the forward speculation check logic.
+        
+        - Finally, in the process of having fun with all of the above, I realized that my DFG
+          validation was not actually running on every phase like I had originally designed it
+          to. In fact it was only running just after bytecode parsing. I initially tried to
+          make it run in every phase but found that this causes some tests to timeout
+          (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in
+          release mode validation never runs, (ii) in debug mode validation will run just
+          after parsing and just before the backend, and (iii) it's possible with a simple
+          switch to enable validation to run on every phase.
+        
+        Luckily all of the above issues were already covered by the 77 or so DFG-specific
+        layout tests. Hence, this patch does not introduce any new tests despite being so
+        meaty.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::ArgumentPosition::prediction):
+        (JSC::DFG::ArgumentPosition::doubleFormatState):
+        (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
+        (ArgumentPosition):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult):
+        (SetLocalStoreEliminationResult):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::hasArgumentPositionStart):
+        (JSC::DFG::Node::argumentPositionStart):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPhase.cpp:
+        (DFG):
+        * dfg/DFGPhase.h:
+        (Phase):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-06-02  Geoffrey Garen  <ggaren@apple.com>
+
+        DOM string cache should hash pointers, not characters
+        https://bugs.webkit.org/show_bug.cgi?id=88175
+
+        Reviewed by Phil Pizlo and Sam Weinig.
+
+        * heap/Weak.h:
+        (JSC::weakAdd):
+        (JSC::weakRemove): Made these function templates slightly more generic
+        to accommodate new client types.
+
+2012-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA should know that PutByVal can clobber the world
+        https://bugs.webkit.org/show_bug.cgi?id=88155
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA should mark basic blocks as having constants if local accesses yield constants
+        https://bugs.webkit.org/show_bug.cgi?id=88153
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG arguments simplification phase uses a node.codeOrigin after appending a node
+        https://bugs.webkit.org/show_bug.cgi?id=88151
+
+        Reviewed by Geoffrey Garen.
+        
+        The right thing to do is to save the CodeOrigin before appending to the graph.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+
+2012-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on
+        a value that is proved to be a number, predicted to be an int32, but not proved to be an int32
+        https://bugs.webkit.org/show_bug.cgi?id=88146
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+
+2012-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG constant folding search for the last local access skips the immediately previous local access
+        https://bugs.webkit.org/show_bug.cgi?id=88141
+
+        Reviewed by Michael Saboff.
+        
+        If you use a loop in the style of:
+
+        for (i = start; i--;)
+
+        then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'.
+        Hence the following is probably wrong:
+        
+        for (i = start - 1; i--;)
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+
+2012-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG constant folding should be OK with GetLocal of captured variables having a constant
+        https://bugs.webkit.org/show_bug.cgi?id=88137
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+
+2012-05-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSGlobalObject does not mark m_privateNameStructure
+        https://bugs.webkit.org/show_bug.cgi?id=88023
+
+        Rubber stamped by Gavin Barraclough.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren): We need to mark this so it doesn't get 
+        inadvertently garbage collected.
+
+2012-05-31  Erik Arvidsson  <arv@chromium.org>
+
+        Make DOM Exceptions Errors
+        https://bugs.webkit.org/show_bug.cgi?id=85078
+
+        Reviewed by Oliver Hunt.
+
+        WebIDL mandates that exceptions should have Error.prototype on its prototype chain.
+
+        For JSC we have access to the Error.prototype from the binding code.
+
+        For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we
+        set the prototype as needed.
+
+        Updated test: fast/dom/DOMException/prototype-object.html
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC):
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::errorPrototype):
+
+2012-05-31  Andy Wingo  <wingo@igalia.com>
+
+        Fix reference to unset variable in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=87981
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSONObject.cpp (Stringifier::Holder::Holder):
+        Initialize m_size in debug mode, as we check it later in an assert.
+
+2012-05-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Heap should sweep incrementally
+        https://bugs.webkit.org/show_bug.cgi?id=85429
+
+        We shouldn't have to wait for the opportunistic GC timer to fire in order 
+        to call object destructors. Instead, we should incrementally sweep some 
+        subset of the blocks requiring sweeping periodically. We tie this sweeping 
+        to a timer rather than to collections because we want to reclaim this memory 
+        even if we stop allocating. This way, our memory usage scales smoothly with 
+        actual use, regardless of whether we've recently done an opportunistic GC or not.
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::collect): We no longer sweep during a full sweep. We only shrink now,
+        which we will switch over to being done during incremental sweeping too as soon as
+        all finalizers can be run lazily (and, by extension, incrementally). 
+        (JSC::Heap::sweeper):
+        (JSC):
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * heap/IncrementalSweeper.cpp: Added.
+        (JSC):
+        (JSC::IncrementalSweeper::timerDidFire): The IncrementalSweeper works very similarly to 
+        GCActivityCallback. It is tied to a run-loop based timer that fires periodically based 
+        on how long the previous sweep increment took to run. The IncrementalSweeper doesn't do 
+        anything if the platform doesn't support CoreFoundation.
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::~IncrementalSweeper):
+        (JSC::IncrementalSweeper::create):
+        (JSC::IncrementalSweeper::scheduleTimer):
+        (JSC::IncrementalSweeper::cancelTimer):
+        (JSC::IncrementalSweeper::doSweep): Iterates over the snapshot of the MarkedSpace taken 
+        during the last collection, checking to see which blocks need sweeping. If it successfully 
+        gets to the end of the blocks that need sweeping then it cancels the timer.
+        (JSC::IncrementalSweeper::startSweeping): We take a snapshot of the Heap and store it in 
+        a Vector that the incremental sweep will iterate over. We also reset our index into this Vector.
+        * heap/IncrementalSweeper.h: Added.
+        (JSC):
+        (IncrementalSweeper):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::needsSweeping): If a block is in the Marked state it needs sweeping 
+        to be usable and to run any destructors that need to be run.
+
+2012-05-30  Patrick Gansterer  <paroga@webkit.org>
+
+        [WINCE] Fix JSString after r115516.
+        https://bugs.webkit.org/show_bug.cgi?id=87892
+
+        Reviewed by Geoffrey Garen.
+
+        r115516 splitted JSString into two classes, with addition nested classes.
+        Add a workaround for the WinCE compiler since it can't resolve the friend class
+        declerations corretly and denies the access to protected members of JSString.
+
+        * runtime/JSString.h:
+        (JSC::JSRopeString::RopeBuilder::append):
+        (JSC::JSRopeString::append):
+        (JSRopeString):
+
+2012-05-30  Oliver Hunt  <oliver@apple.com>
+
+        Really provide error information with the inspector disabled
+        https://bugs.webkit.org/show_bug.cgi?id=87910
+
+        Reviewed by Filip Pizlo.
+
+        Don't bother checking for anything other than pre-existing error info.
+        In the absence of complete line number information you'll only get the
+        line a function starts on, but at least it's something.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2012-05-30  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt broken on x86-32 with JIT turned off
+        https://bugs.webkit.org/show_bug.cgi?id=87906
+
+        Reviewed by Geoffrey Garen.
+        
+        Fixed the code to not clobber registers that contain important things, like the call frame.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2012-05-30  Filip Pizlo  <fpizlo@apple.com>
+
+        ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
+        https://bugs.webkit.org/show_bug.cgi?id=87887
+
+        Reviewed by Darin Adler.
+        
+        Better fix - we now never call SourceProvider::asID() if SourceProvider* is 0.
+
+        * parser/Nodes.h:
+        (JSC::ScopeNode::sourceID):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::providerID):
+        (SourceCode):
+        * parser/SourceProvider.h:
+        (SourceProvider):
+        (JSC::SourceProvider::asID):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::sourceID):
+
+2012-05-30  Filip Pizlo  <fpizlo@apple.com>
+
+        ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
+        https://bugs.webkit.org/show_bug.cgi?id=87887
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::asID):
+
+2012-05-30  Oliver Hunt  <oliver@apple.com>
+
+        DFG does not correctly handle exceptions caught in the LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=87885
+
+        Reviewed by Filip Pizlo.
+
+        Make the DFG use genericThrow, rather than reimplementing a small portion of it.
+        Also make the LLInt slow paths validate that their PC is correct.
+
+        * dfg/DFGOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+
+2012-05-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA should infer types and values of captured variables
+        https://bugs.webkit.org/show_bug.cgi?id=87813
+
+        Reviewed by Gavin Barraclough.
+        
+        Slight speed-up in V8/earley-boyer (~1%).
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::argumentsAreCaptured):
+        (JSC::CodeBlock::argumentIsCaptured):
+        (CodeBlock):
+        * dfg/DFGAbstractState.cpp:
+        (DFG):
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::clobberWorld):
+        (JSC::DFG::AbstractState::clobberStructures):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        (JSC::DFG::AbstractState::merge):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::variables):
+        (AbstractState):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r117823.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2012-05-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r118868.
+        http://trac.webkit.org/changeset/118868
+        https://bugs.webkit.org/show_bug.cgi?id=87828
+
+        introduced ~20 crashes on Mac and Qt bots (Requested by pizlo_
+        on #webkit).
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::sweepWeakSet):
+        (JSC):
+        * heap/MarkedSpace.cpp:
+        (JSC::SweepWeakSet::operator()):
+        (JSC):
+        (JSC::MarkedSpace::sweepWeakSets):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+
+2012-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in r118646, now that
+        https://bugs.webkit.org/show_bug.cgi?id=87784 is fixed.
+
+        http://trac.webkit.org/changeset/118646
+        https://bugs.webkit.org/show_bug.cgi?id=87599
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * heap/MarkedBlock.h:
+        (JSC):
+        * heap/MarkedSpace.cpp:
+        (JSC):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+
+2012-05-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should keep captured variables alive until the (inline) return.
+        https://bugs.webkit.org/show_bug.cgi?id=87205
+
+        Reviewed by Gavin Barraclough.
+        
+        Changes the way we do flushing for captured variables and arguments. Instead of flushing
+        each SetLocal immediately, we flush at kill points. So a SetLocal will cause a Flush of
+        whatever was live in the variable previously, and a return will cause a Flush of all
+        captured variables and all arguments.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setDirect):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForArgument):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::findArgumentPosition):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+
+2012-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        WeakGCMap should be lazy-finalization-safe
+        https://bugs.webkit.org/show_bug.cgi?id=87784
+
+        Reviewed by Darin Adler.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and
+        not Weak<T>, we need to verify manually that the WeakImpl is live before
+        we return its payload.
+
+2012-05-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CopiedSpace::doneCopying could start another collection
+        https://bugs.webkit.org/show_bug.cgi?id=86538
+
+        Reviewed by Geoffrey Garen.
+
+        It's possible that if we don't have anything at the head of to-space 
+        after a collection and the BlockAllocator doesn't have any fresh blocks 
+        to give us right now we could start another collection while still in 
+        the middle of the first collection when we call CopiedSpace::addNewBlock(). 
+
+        One way to resolve this would be to have Heap::shouldCollect() check that 
+        m_operationInProgress is NoOperation. This would prevent the path in 
+        getFreshBlock() that starts the collection if we're already in the middle of one.
+
+        I could not come up with a test case to reproduce this crash on ToT.
+
+        * heap/Heap.h:
+        (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle
+        of a collection, i.e. the current operation should be NoOperation.
+
+2012-05-29  David Barr  <davidbarr@chromium.org>
+
+        Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag
+        https://bugs.webkit.org/show_bug.cgi?id=87685
+
+        Reviewed by Eric Seidel.
+
+        Add a configuration option for CSS image-resolution support, disabling it by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r118646.
+        http://trac.webkit.org/changeset/118646
+        https://bugs.webkit.org/show_bug.cgi?id=87691
+
+        broke V8 raytrace benchmark (Requested by pizlo_ on #webkit).
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::sweepWeakSet):
+        (JSC):
+        * heap/MarkedSpace.cpp:
+        (JSC::SweepWeakSet::operator()):
+        (JSC):
+        (JSC::MarkedSpace::sweepWeakSets):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+
+2012-05-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not generate code for code that the CFA proves to be unreachable
+        https://bugs.webkit.org/show_bug.cgi?id=87682
+
+        Reviewed by Sam Weinig.
+        
+        This also fixes a small performance bug where CFA was not marking blocks
+        as having constants (and hence not triggering constant folding) if the only
+        constants were on GetLocals.
+        
+        And fixing that bug revealed another bug: constant folding was assuming that
+        a GetLocal must be the first access to a local in a basic block. This isn't
+        true. The first access may be a Flush. This patch fixes that issue using the
+        safest approach possible, since we don't need to be clever for something that
+        only happens in one of our benchmarks.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-28  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-05-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Weak pointer finalization should be lazy
+        https://bugs.webkit.org/show_bug.cgi?id=87599
+
+        Reviewed by Darin Adler.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect): Don't force immediate finalization -- it will
+        happen lazily.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep): Sweep a block's weak set when sweeping the
+        block. The weak set may not have been swept yet, and this is our last
+        chance to run weak finalizers before we recycle the memory they reference.
+
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedBlock::sweepWeakSets):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::sweepWeakSets): Nixed sweepWeakSets because it's unused
+        now.
+
+2012-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        WebKit should be lazy-finalization-safe (esp. the DOM) v2
+        https://bugs.webkit.org/show_bug.cgi?id=87581
+
+        Reviewed by Oliver Hunt.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor):
+        * heap/WeakBlock.h:
+        * heap/WeakSetInlines.h:
+        (JSC::WeakBlock::finalize): Since we don't guarantee destruction order,
+        it's not valid to access GC pointers like the Structure pointer during
+        finalization. We NULL out the structure pointer in debug builds to try
+        to make this programming mistake more obvious.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::destroy):
+        * API/JSCallbackObject.cpp:
+        (JSC::::destroy):
+        (JSC::JSCallbackObjectData::finalize):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::destroy):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::destroy):
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::destroy):
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::destroy):
+        (JSC::NativeExecutable::destroy):
+        (JSC::ScriptExecutable::destroy):
+        (JSC::EvalExecutable::destroy):
+        (JSC::ProgramExecutable::destroy):
+        (JSC::FunctionExecutable::destroy):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::destroy):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::destroy):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::destroy):
+        * runtime/JSString.cpp:
+        (JSC::JSString::destroy):
+        * runtime/JSVariableObject.cpp:
+        (JSC::JSVariableObject::destroy):
+        * runtime/NameInstance.cpp:
+        (JSC::NameInstance::destroy):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::destroy):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::destroy):
+        * runtime/Structure.cpp:
+        (JSC::Structure::destroy):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::destroy): Use static_cast instead of jsCast because
+        jsCast does Structure-based validation, and our Structure is not guaranteed
+        to be alive when we get finalized.
+
+2012-05-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE should eliminate redundant WeakJSConstants
+        https://bugs.webkit.org/show_bug.cgi?id=87179
+
+        Reviewed by Gavin Barraclough.
+        
+        Merged r118141 from dfgopt.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::weakConstantCSE):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::weakConstant):
+
+2012-05-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE should do redundant store elimination
+        https://bugs.webkit.org/show_bug.cgi?id=87161
+
+        Reviewed by Oliver Hunt.
+        
+        Merge r118138 from dfgopt.
+        
+        This patch adds redundant store elimination. For example, consider this
+        code:
+        
+        o.x = 42;
+        o.x = 84;
+        
+        If o.x is speculated to be a well-behaved field, the first assignment is
+        unnecessary, since the second just overwrites it. We would like to
+        eliminate the first assignment in these cases. The need for this
+        optimization arises mostly from stores that our runtime requires. For
+        example:
+        
+        o = {f:1, g:2, h:3};
+        
+        This will have four assignments to the structure for the newly created
+        object - one assignment for the empty structure, one for {f}, one for
+        {f, g}, and one for {f, g, h}. We would like to only have the last of
+        those assigments in this case.
+        
+        Intriguingly, doing so for captured variables breaks the way arguments
+        simplification used to work. Consider that prior to either arguments
+        simplification or store elimination we will have IR that looks like:
+        
+        a: SetLocal(r0, Empty)
+        b: SetLocal(r1, Empty)
+        c: GetLocal(r0)
+        d: CreateArguments(@c)
+        e: SetLocal(r0, @d)
+        f: SetLocal(r1, @d)
+        
+        Then redundant store elimination will eliminate the stores that
+        initialize the arguments registers to Empty, but then arguments
+        simplification eliminates the stores that initialize the arguments to
+        the newly created arguments - and at this point we no longer have any
+        stores to the arguments register, leading to hilarious crashes. This
+        patch therefore changes arguments simplification to replace
+        CreateArguments with JSConstant(Empty) rather than eliminating the
+        SetLocals. But this revealed bugs where arguments simplification was
+        being overzealous, so I fixed those bugs.
+        
+        This is a minor speed-up on V8/early and a handful of other tests.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::uncheckedActivationRegister):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::globalVarStoreElimination):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::uncheckedActivationRegisterFor):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isPhantomArguments):
+        (Node):
+        (JSC::DFG::Node::hasConstant):
+        (JSC::DFG::Node::valueOfJSConstant):
+        (JSC::DFG::Node::hasStructureTransitionData):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ConvertThis should just be a CheckStructure if the structure is known
+        https://bugs.webkit.org/show_bug.cgi?id=87057
+
+        Reviewed by Gavin Barraclough.
+        
+        Merged r118021 from dfgopt.
+        
+        This gives ValueProfile the ability to track singleton values - i.e. profiling
+        sites that always see the same value.
+        
+        That is then used to profile the structure in op_convert_this.
+        
+        This is then used to optimize op_convert_this into a CheckStructure if the
+        structure is always the same.
+        
+        That then results in better CSE in inlined code that uses 'this', since
+        previously we couldn't CSE accesses on 'this' from different inline call frames.
+        
+        Also fixed a bug where we were unnecessarily flushing 'this'.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
+        * bytecode/LazyOperandValueProfile.h:
+        (CompressedLazyOperandValueProfileHolder):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::ValueProfileBase):
+        (JSC::ValueProfileBase::dump):
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        (ValueProfileBase):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSValue.h:
+        (JSValue):
+        * runtime/Structure.h:
+        (JSC::JSValue::structureOrUndefined):
+        (JSC):
+
+2012-05-24  Tim Horton  <timothy_horton@apple.com>
+
+        Add feature defines for web-facing parts of CSS Regions and Exclusions
+        https://bugs.webkit.org/show_bug.cgi?id=87442
+        <rdar://problem/10887709>
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        WebKit should be lazy-finalization-safe (esp. the DOM)
+        https://bugs.webkit.org/show_bug.cgi?id=87456
+
+        Reviewed by Filip Pizlo.
+
+        Lazy finalization adds one twist to weak pointer use:
+
+                A HashMap of weak pointers may contain logically null entries.
+                (Weak pointers behave as-if null once their payloads die.)
+                Insertion must not assume that a pre-existing entry is
+                necessarily valid, and iteration must not assume that all
+                entries can be dereferenced.
+
+        (Previously, I thought that it also added a second twist:
+
+                A demand-allocated weak pointer may replace a dead payload
+                before the payload's finalizer runs. In that case, when the
+                payload's finalizer runs, the payload has already been
+                overwritten, and the finalizer should not clear the payload,
+                which now points to something new.
+
+        But that's not the case here, since we cancel the old payload's
+        finalizer when we over-write it. I've added ASSERTs to verify this
+        assumption, in case it ever changes.)
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype): No need to specify null; that's the default.
+
+        * API/JSWeakObjectMapRefPrivate.cpp: Use remove, since take() is gone.
+
+        * heap/PassWeak.h:
+        (WeakImplAccessor::was): This is no longer a debug-only function, since
+        it's required to reason about lazily finalized pointers.
+
+        * heap/Weak.h:
+        (JSC::weakAdd):
+        (JSC::weakRemove):
+        (JSC::weakClear): Added these helper functions for the common idioms of
+        what clients want to do in their weak pointer finalizers.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::hostFunctionStub): Use the new idioms. Otherwise, we
+        would return NULL for a "zombie" executable weak pointer that was waiting
+        for finalization (item (2)), and finalizing a dead executable weak pointer
+        would potentially destroy a new, live one (item (1)).
+
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::finalize): Ditto.
+
+        (JSC::RegExpCache::invalidateCode): Check for null while iterating. (See
+        item (2).)
+
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::add): Use get and set instead of add and
+        contains, since add and contains are not compatible with lazy finalization.
+
+        * runtime/WeakGCMap.h:
+        (WeakGCMap):
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::remove): Removed a bunch of code that was incompatible with
+        lazy finalization because I didn't feel like making it compatible, and I had
+        no way to test it.
+
+2012-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
+        https://bugs.webkit.org/show_bug.cgi?id=87327
+
+        Reviewed by Geoffrey Garen.
+        
+        If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a
+        set containing >=2 elements, you're going to have a bad time.
+        
+        That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order
+        to save space and speed up convergence. So filtering has no effect in this case, which made
+        the code think that the abstract value was proving that the structure check was unnecessary.
+        The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the
+        right thingies for TOP and >=2 elements.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64
+        https://bugs.webkit.org/show_bug.cgi?id=87378
+
+        Reviewed by Gavin Barraclough.
+        
+        - Captured variable tracking forgot did not consistently handle arguments, leading to OSR
+          badness.
+        
+        - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (CSEPhase):
+        (JSC::DFG::performCSE):
+        * dfg/DFGCSEPhase.h:
+        (DFG):
+        * dfg/DFGCommon.h:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::resetExitStates):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGPhase.h:
+        (DFG):
+        (JSC::DFG::runPhase):
+
+2012-05-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Made WeakSet per-block instead of per-heap
+        https://bugs.webkit.org/show_bug.cgi?id=87401
+
+        Reviewed by Oliver Hunt.
+
+        This allows us fast access to the set of all weak pointers for a block,
+        which is a step toward lazy finalization.
+
+        No performance change.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::lastChanceToFinalize): Removed the per-heap weak set, since
+        it's per-block now.
+
+        (JSC::Heap::markRoots): Delegate weak set visiting to the marked space,
+        since it knows how to iterate all blocks.
+
+        (JSC::Heap::collect): Moved the reaping outside of markRoots, since it
+        doesn't mark anything.
+
+        Make sure to reset allocators after shrinking, since shrinking may
+        deallocate the current allocator.
+
+        * heap/Heap.h:
+        (Heap): No more per-heap weak set, since it's per-block now.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::lastChanceToFinalize): Migrated finalization logic
+        here from the heap, so the heap doesn't need to know about our internal
+        data structures like our weak set.
+
+        (JSC::MarkedBlock::heap):
+        (JSC::MarkedBlock::weakSet):
+        (JSC::MarkedBlock::shrink):
+        (JSC::MarkedBlock::resetAllocator):
+        (JSC::MarkedBlock::visitWeakSet):
+        (JSC::MarkedBlock::reapWeakSet):
+        (JSC::MarkedBlock::sweepWeakSet):
+        * heap/MarkedSpace.cpp:
+        (JSC::VisitWeakSet::VisitWeakSet):
+        (JSC::VisitWeakSet::operator()):
+        (VisitWeakSet):
+        (JSC):
+        (JSC::ReapWeakSet::operator()):
+        (JSC::SweepWeakSet::operator()):
+        (JSC::LastChanceToFinalize::operator()):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+        (JSC::ResetAllocator::operator()):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        (JSC::MarkedSpace::sweepWeakSets):
+        (JSC::Shrink::operator()):
+        (JSC::MarkedSpace::shrink):
+        * heap/MarkedSpace.h:
+        (MarkedSpace): Make sure to account for our weak sets when sweeping,
+        shrinking, etc.
+
+        * heap/WeakSet.cpp:
+        (JSC):
+        * heap/WeakSet.h:
+        (WeakSet):
+        (JSC::WeakSet::heap):
+        (JSC):
+        (JSC::WeakSet::lastChanceToFinalize):
+        (JSC::WeakSet::visit):
+        (JSC::WeakSet::reap):
+        (JSC::WeakSet::shrink):
+        (JSC::WeakSet::resetAllocator): Inlined some things since they're called
+        once per block now instead of once per heap.
+
+        * heap/WeakSetInlines.h:
+        (JSC::WeakSet::allocate): Use the per-block weak set since there is no
+        per-heap weak set anymore.
+
+2012-05-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix arm build
+
+        Rubber stamped by Geoff Garen
+
+        * dfg/DFGGPRInfo.h:
+        (GPRInfo):
+
+2012-05-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Move cacheFlush from ExecutableAllocator to Assembler classes
+        https://bugs.webkit.org/show_bug.cgi?id=87420
+
+        Reviewed by Oliver Hunt.
+
+        Makes more sense there, & remove a pile of #ifdefs.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC):
+        (JSC::ARMAssembler::cacheFlush):
+        * assembler/ARMAssembler.h:
+        (ARMAssembler):
+        (JSC::ARMAssembler::cacheFlush):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::relinkJump):
+        (JSC::ARMv7Assembler::cacheFlush):
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::setUInt7ForLoad):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::cacheFlush):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::performFinalization):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::relinkJump):
+        (JSC::MIPSAssembler::relinkCall):
+        (JSC::MIPSAssembler::repatchInt32):
+        (JSC::MIPSAssembler::cacheFlush):
+        (MIPSAssembler):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::repatchCompact):
+        (JSC::SH4Assembler::cacheFlush):
+        (SH4Assembler):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::cacheFlush):
+        * jit/ExecutableAllocator.cpp:
+        (JSC):
+        * jit/ExecutableAllocator.h:
+        (ExecutableAllocator):
+
+2012-05-24  John Mellor  <johnme@chromium.org>
+
+        Font Boosting: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        Reviewed by Adam Barth.
+
+        Add ENABLE_FONT_BOOSTING.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        cti_vm_throw gets kicked out by gcc 4.6 -flto
+        https://bugs.webkit.org/show_bug.cgi?id=56088
+
+        Reviewed by Darin Adler.
+
+        Add REFERENCED_FROM_ASM to functions only referenced from assembler.
+
+        * dfg/DFGOperations.cpp:
+        * jit/HostCallReturnValue.h:
+        * jit/JITStubs.h:
+        * jit/ThunkGenerators.cpp:
+
+2012-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
+        https://bugs.webkit.org/show_bug.cgi?id=87350
+
+        Reviewed by Maciej Stachowiak.
+        
+        The dfgopt branch introduced the notion of a local variable being killed because it was aliased
+        to the Arguments object as in cases like:
+        
+        var a = arguments;
+        return a.length;
+        
+        This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
+        OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
+        dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
+        ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
+        them as variables that need arguments reification.
+        
+        This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
+        end up being treated as reified arguments objects, while variables that are dead but not aliased to
+        arguments are treated as tip of tree would have treated them (initialize to Undefined).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-24  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed 32 bit buildfix after r118325.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): Use ASSERT_UNUSED instead ASSERT.
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG operationTearOffActivation should return after handling the null activation case
+        https://bugs.webkit.org/show_bug.cgi?id=87348
+        <rdar://problem/11522295>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGOperations.cpp:
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, merge the arguments fix in r118138 to get bots green.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+
+2012-05-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA should record if a node can OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=86905
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r117931 from dfgopt.
+        
+        Adds a NodeFlag that denotes nodes that are known to not have OSR exits.
+        This ought to aid any backwards analyses that need to know when a
+        backward flow merge might happen due to a side exit.
+        
+        Also added assertions into speculationCheck() that ensure that we did not
+        mark a node as non-exiting and then promptly compile in an exit. This
+        helped catch some minor bugs where we were doing unnecessary speculation
+        checks.
+        
+        This is a perf-neutral change. The speculation checks that this removes
+        were not on hot paths of major benchmarks.
+
+        * bytecode/PredictedType.h:
+        (JSC):
+        (JSC::isAnyPrediction):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::speculateInt32Unary):
+        (AbstractState):
+        (JSC::DFG::AbstractState::speculateNumberUnary):
+        (JSC::DFG::AbstractState::speculateBooleanUnary):
+        (JSC::DFG::AbstractState::speculateInt32Binary):
+        (JSC::DFG::AbstractState::speculateNumberBinary):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::mergeFlags):
+        (JSC::DFG::Node::filterFlags):
+        (Node):
+        (JSC::DFG::Node::setCanExit):
+        (JSC::DFG::Node::canExit):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not do unnecessary indirections when storing to objects
+        https://bugs.webkit.org/show_bug.cgi?id=86959
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r117819 from dfgopt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize aliased uses of the Arguments object of the current call frame
+        https://bugs.webkit.org/show_bug.cgi?id=86552
+
+        Reviewed by Geoff Garen.
+        
+        Merged r117542 and r117543 from dfgopt.
+        
+        Performs must-alias and escape analysis on uses of CreateArguments, and if
+        a variable is must-aliased to CreateArguments and does not escape, then we
+        turn all uses of that variable into direct arguments accesses.
+        
+        36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::uncheckedArgumentsRegister):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::argumentsThatWereNotCreated):
+        (ValueRecovery):
+        (JSC::ValueRecovery::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAdjacencyList.h:
+        (AdjacencyList):
+        (JSC::DFG::AdjacencyList::removeEdgeFromBag):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (ArgumentsSimplificationPhase):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
+        (AssemblyHelpers):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
+        * dfg/DFGGPRInfo.h:
+        (GPRInfo):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::collectGarbage):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (Graph):
+        (JSC::DFG::Graph::executableFor):
+        (JSC::DFG::Graph::argumentsRegisterFor):
+        (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler.h:
+        (JSC::DFG::OSRExitCompiler::OSRExitCompiler):
+        (OSRExitCompiler):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::ValueSource::dump):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::isArgumentsAlias):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGCapabilities should not try to get an arguments register from code blocks that don't have one
+        https://bugs.webkit.org/show_bug.cgi?id=87332
+
+        Reviewed by Andy Estes.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineOpcode):
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have sparse conditional constant propagation
+        https://bugs.webkit.org/show_bug.cgi?id=86580
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r117370 from dfgopt.
+        
+        This enhances CFA so that if it suspects at any point during the fixpoint that a
+        branch will only go one way, then it only propagates in that one way.
+        
+        This vastly increases the opportunities for CFG simplification. For example, it
+        enables us to evaporate this loop:
+        
+        for (var i = 0; i < 1; ++i) doThings(i);
+        
+        As a result, it uncovered loads of bugs in the CFG simplifier. In particular:
+        
+        - Phi fixup was assuming that all Phis worth fixing up are shouldGenerate().
+          That's not true; we also fixup Phis that are dead.
+          
+        - GetLocal fixup was assuming that it's only necessary to rewire links to a
+          GetLocal, and that the GetLocal's own links don't need to be rewired. Untrue,
+          because the GetLocal may not be rewirable (first block has no GetLocal for r42
+          but second block does have a GetLocal), in which case it will refer to a Phi
+          in the second block. We need it to refer to a Phi from the first block to
+          ensure that subsequent transformations work.
+          
+        - Tail operand fixup was ignoring the fact that Phis in successors may contain
+          references to the children of our tail variables. Hence, successor Phi child
+          substitution needs to use the original second block variable table as its
+          prior, rather than trying to reconstruct the prior later (since by that point
+          the children of the second block's tail variables will have been fixed up, so
+          we will not know what the prior would have been).
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::reset):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::branchDirectionToString):
+        (AbstractState):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
+        (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
+        (OperandSubstitution):
+        (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::recordPossibleIncomingReference):
+        (CFGSimplificationPhase):
+        (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::changeEdge):
+
+2012-05-23  Ojan Vafai  <ojan@chromium.org>
+
+        add back the ability to disable flexbox
+        https://bugs.webkit.org/show_bug.cgi?id=87147
+
+        Reviewed by Tony Chang.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Windows build.
+
+        * bytecode/CodeBlock.h:
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canCompileOpcodes):
+        * dfg/DFGCommon.h:
+        (DFG):
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize inlined uses of arguments.length and arguments[i]
+        https://bugs.webkit.org/show_bug.cgi?id=86327
+
+        Reviewed by Gavin Barraclough.
+        
+        Merged r117017 from dfgopt.
+        
+        Turns inlined uses of arguments.length into a constant.
+        
+        Turns inlined uses of arguments[constant] into a direct reference to the
+        argument.
+        
+        Big win on micro-benchmarks. Not yet a win on V8 because the hot uses of
+        arguments.length and arguments[i] are aliased. I'll leave the aliasing
+        optimizations to a later patch.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/DFGExitProfile.h:
+        (FrequentExitSite):
+        (JSC::DFG::FrequentExitSite::FrequentExitSite):
+        (JSC::DFG::QueryableExitProfile::hasExitSite):
+        (QueryableExitProfile):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentsSimplificationPhase.cpp: Added.
+        (DFG):
+        (ArgumentsSimplificationPhase):
+        (JSC::DFG::ArgumentsSimplificationPhase::ArgumentsSimplificationPhase):
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::performArgumentsSimplification):
+        * dfg/DFGArgumentsSimplificationPhase.h: Added.
+        (DFG):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::executableFor):
+        (DFG):
+        * dfg/DFGAssemblyHelpers.h:
+        (AssemblyHelpers):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::executableFor):
+        (Graph):
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToConstant):
+        (JSC::DFG::Node::convertToGetLocalUnlinked):
+        (Node):
+        (JSC::DFG::Node::unlinkedLocal):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to optimize foo.apply(bar, arguments)
+        https://bugs.webkit.org/show_bug.cgi?id=86306
+
+        Reviewed by Gavin Barraclough.
+        
+        Merge r116912 from dfgopt.
+        
+        Enables compilation of op_jneq_ptr and some forms of op_call_varargs.
+        
+        Also includes a bunch of bug fixes that were made necessary by the increased
+        pressure on the CFG simplifier.
+        
+        This is a 1-2% win on V8.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::ProgramCodeBlock::canCompileWithDFGInternal):
+        (JSC::EvalCodeBlock::canCompileWithDFGInternal):
+        (JSC::FunctionCodeBlock::canCompileWithDFGInternal):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::canCompileWithDFG):
+        (JSC::CodeBlock::canCompileWithDFGState):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::debugFail):
+        (DFG):
+        (JSC::DFG::canHandleOpcodes):
+        (JSC::DFG::canCompileOpcodes):
+        (JSC::DFG::canInlineOpcodes):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        (DFG):
+        (JSC::DFG::canCompileOpcodes):
+        (JSC::DFG::canCompileEval):
+        (JSC::DFG::canCompileProgram):
+        (JSC::DFG::canCompileFunctionForCall):
+        (JSC::DFG::canCompileFunctionForConstruct):
+        * dfg/DFGCommon.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (Validate):
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::checkOperand):
+        (JSC::DFG::Validate::reportValidationContext):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::sample):
+
+2012-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored WeakBlock to use malloc, clarify behavior
+        https://bugs.webkit.org/show_bug.cgi?id=87318
+
+        Reviewed by Filip Pizlo.
+
+        We want to use malloc so we can make these smaller than 4KB,
+        since an individual MarkedBlock will usually have fewer than
+        4KB worth of weak pointers.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots): Renamed visitLiveWeakImpls to visit, since
+        we no longer need to distinguish from "visitDeadWeakImpls".
+
+        Renamed "visitDeadWeakImpls" to "reap" because we're not actually
+        doing any visiting -- we're just tagging things as dead.
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::destroy):
+        (JSC::WeakBlock::WeakBlock): Malloc!
+
+        (JSC::WeakBlock::visit):
+        (JSC::WeakBlock::reap): Renamed as above.
+
+        * heap/WeakBlock.h:
+        (WeakBlock): Reduced to 3KB, as explained above.
+
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::visit):
+        (JSC::WeakSet::reap):
+        * heap/WeakSet.h:
+        (WeakSet): Updated for renames, and to match WebKit style.
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Use after free in JSC::DFG::ByteCodeParser::processPhiStack
+        https://bugs.webkit.org/show_bug.cgi?id=87312
+        <rdar://problem/11518848>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::parse):
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to make C function calls from DFG code on ARM in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=87313
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2012-05-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to inline functions that use arguments reflectively
+        https://bugs.webkit.org/show_bug.cgi?id=86132
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r116838 from dfgopt.
+        
+        This turns on inlining of functions that use arguments reflectively, but it
+        does not do any of the obvious optimizations that this exposes. I'll save that
+        for another patch - the important thing for now is that this contains all of
+        the plumbing necessary to make this kind of inlining sound even in bizarro
+        cases like an inline callee escaping the arguments object to parts of the
+        inline caller where the arguments are otherwise dead. Or even more fun cases
+        like where you've inlined to an inline stack that is three-deep, and the
+        function on top of the inline stack reflectively accesses the arguments of a
+        function that is in the middle of the inline stack. Any subsequent
+        optimizations that we do for the obvious cases of arguments usage in inline
+        functions will have to take care not to break the baseline functionality that
+        this patch plumbs together.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
+        (AssemblyHelpers):
+        * dfg/DFGByteCodeParser.cpp:
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/CallFrame.cpp:
+        (JSC):
+        (JSC::CallFrame::someCodeBlockForPossiblyInlinedCode):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        (JSC::ExecState::someCodeBlockForPossiblyInlinedCode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::retrieveArgumentsFromVMCode):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        (JSC):
+        (JSC::Arguments::tearOffForInlineCallFrame):
+        * runtime/Arguments.h:
+        (Arguments):
+        (JSC::Arguments::create):
+        (JSC::Arguments::finishCreation):
+        (JSC):
+
+2012-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Every OSR exit on ARM results in a crash
+        https://bugs.webkit.org/show_bug.cgi?id=87307
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+
+2012-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored heap tear-down to use normal value semantics (i.e., destructors)
+        https://bugs.webkit.org/show_bug.cgi?id=87302
+
+        Reviewed by Oliver Hunt.
+
+        This is a step toward incremental DOM finalization.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::~CopiedSpace):
+        * heap/CopiedSpace.h:
+        (CopiedSpace): Just use our destructor, instead of relying on the heap
+        to send us a special message at a special time.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap): Use OwnPtr for m_markListSet because this is not Sparta.
+
+        (JSC::Heap::~Heap): No need for delete or freeAllBlocks because normal
+        destructors do this work automatically now.
+
+        (JSC::Heap::lastChanceToFinalize): Just call lastChanceToFinalize on our
+        sub-objects, and assume it does the right thing. This improves encapsulation,
+        so we can add items requiring finalization to our sub-objects.
+
+        * heap/Heap.h: Moved m_blockAllocator to get the right destruction order.
+
+        * heap/MarkedSpace.cpp:
+        (Take):
+        (JSC):
+        (JSC::Take::Take):
+        (JSC::Take::operator()):
+        (JSC::Take::returnValue): Moved to the top of the file so it can be used
+        in another function.
+
+        (JSC::MarkedSpace::~MarkedSpace): Delete all outstanding memory, like a good
+        destructor should.
+
+        (JSC::MarkedSpace::lastChanceToFinalize): Moved some code here from the heap,
+        since it pertains to our internal implementation details.
+
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::lastChanceToFinalize):
+        * heap/WeakBlock.h:
+        (WeakBlock):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::lastChanceToFinalize):
+        * heap/WeakSet.h:
+        (WeakSet): Stop using a special freeAllBlocks() callback and just implement
+        lastChanceToFinalize.
+
+2011-05-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Encapsulated some calculations for whether portions of the heap are empty
+        https://bugs.webkit.org/show_bug.cgi?id=87210
+
+        Reviewed by Gavin Barraclough.
+
+        This is a step toward incremental DOM finalization.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::~Heap): Explicitly call freeAllBlocks() instead of relying
+        implicitly on all blocks thinking they're empty. In future, we may
+        choose to tear down the heap without first setting all data structures
+        to "empty".
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::gatherDirtyCells): Renamed markCountIsZero to isEmpty,
+        in preparation for making it check for outstanding finalizers in addition
+        to marked cells.
+
+        * heap/MarkedSpace.cpp:
+        (Take):
+        (JSC::Take::Take):
+        (JSC::Take::operator()):
+        (JSC::Take::returnValue):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::freeAllBlocks): Refactored the "Take" functor to support
+        a conditional isEmpty check, so it dould be shared by shrink() and freeAllBlocks().
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::WeakBlock):
+        (JSC::WeakBlock::visitLiveWeakImpls):
+        (JSC::WeakBlock::visitDeadWeakImpls):
+        * heap/WeakBlock.h:
+        (WeakBlock):
+        (JSC::WeakBlock::isEmpty):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::sweep):
+        (JSC::WeakSet::shrink): Use isEmpty(), in preparation for changes in
+        its implementation.
+
+2012-05-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove references to $$QT_SOURCE_TREE
+
+        With a modularized Qt, it's ambigious. What we really want is qtbase,
+        which qtcore is a proxy for (we assume it will always live in qtbase).
+
+        Reviewed by Tor Arne Vestbø.
+
+        * JavaScriptCore.pri:
+        * Target.pri:
+
+2012-05-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should allow inlining in case of certain arity mismatches
+        https://bugs.webkit.org/show_bug.cgi?id=86059
+
+        Reviewed by Geoff Garen.
+        
+        Merge r116620 from dfgopt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+
+2012-05-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG variable capture analysis should work even if the variables arose through inlining
+        https://bugs.webkit.org/show_bug.cgi?id=85945
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r116555 from dfgopt.
+        
+        This just changes how the DFG queries whether a variable is captured. It does not
+        change any user-visible behavior.
+        
+        As part of this change, I further solidified the policy that the CFA behaves in an
+        undefined way for captured locals and queries about their values will not yield
+        reliable results. This will likely be changed in the future, but for now it makes
+        sense.
+        
+        One fun part about this change is that it recognizes that the same variable may
+        be both captured and not, at the same time, because their live interval spans
+        inlining boundaries. This only happens in the case of arguments to functions that
+        capture their arguments, and this change treats them with just the right touch of
+        conservatism: they will be treated as if captured by the caller as well as the 
+        callee.
+        
+        Finally, this also adds captured variable reasoning to the InlineCallFrame, which
+        I thought might be useful for later tooling.
+        
+        This is perf-neutral, since it does it does not make the DFG take advantage of this
+        new functionality in any way. In particular, it is still the case that the DFG will
+        not inline functions that use arguments reflectively or that create activations.
+
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::needsActivation):
+        (JSC::CodeBlock::argumentIsCaptured):
+        (JSC::CodeBlock::localIsCaptured):
+        (JSC::CodeBlock::isCaptured):
+        * bytecode/CodeOrigin.h:
+        (InlineCallFrame):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::merge):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::newVariableAccessData):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flushArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (CFGSimplificationPhase):
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
+        * dfg/DFGCommon.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::nameOfVariableAccessData):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::needsActivation):
+        (JSC::DFG::Graph::usesArguments):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeIsCaptured):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::isCaptured):
+
+2012-05-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support op_get_argument_by_val and op_get_arguments_length
+        https://bugs.webkit.org/show_bug.cgi?id=85911
+
+        Reviewed by Oliver Hunt.
+        
+        Merged r116467 from dfgopt.
+        
+        This adds a simple and relatively conservative implementation of op_get_argument_by_val
+        and op_get_arguments_length. We can optimize these later. For now it's great to have
+        the additional coverage.
+        
+        This patch appears to be perf-neutral.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::addressFor):
+        (JSC::DFG::AssemblyHelpers::tagFor):
+        (JSC::DFG::AssemblyHelpers::payloadFor):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-05-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support op_tear_off_arguments
+        https://bugs.webkit.org/show_bug.cgi?id=85847
+
+        Reviewed by Michael Saboff.
+        
+        Merged r116378 from dfgopt.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-05-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CopiedSpace::contains doesn't check for oversize blocks
+        https://bugs.webkit.org/show_bug.cgi?id=87180
+
+        Reviewed by Geoffrey Garen.
+
+        When doing a conservative scan we use CopiedSpace::contains to determine if a particular 
+        address points into the CopiedSpace. Currently contains() only checks if the address 
+        points to a block in to-space, which means that pointers to oversize blocks may not get scanned. 
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        * heap/CopiedSpace.h: Refactored CopiedSpace so that all blocks (oversize and to-space) are 
+        in a single hash set and bloom filter for membership testing.
+        (CopiedSpace):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::contains): We check for the normal block first. Since the oversize blocks are
+        only page aligned, rather than block aligned, we have to re-mask the ptr to check if it's in 
+        CopiedSpace. Also added a helper function of the same name that takes a CopiedBlock* and checks
+        if it's in CopiedSpace so that check isn't typed out twice.
+        (JSC):
+        (JSC::CopiedSpace::startedCopying):
+        (JSC::CopiedSpace::addNewBlock):
+
+2012-05-22  Geoffrey Garen  <ggaren@apple.com>
+
+        CopiedBlock and MarkedBlock should have proper value semantics (i.e., destructors)
+        https://bugs.webkit.org/show_bug.cgi?id=87172
+
+        Reviewed by Oliver Hunt and Phil Pizlo.
+
+        This enables MarkedBlock to own non-trivial sub-objects that require
+        destruction. It also fixes a FIXME about casting a CopiedBlock to a
+        MarkedBlock at destroy time.
+
+        CopiedBlock and MarkedBlock now accept an allocation chunk at create
+        time and return it at destroy time. Their client is expected to
+        allocate, recycle, and destroy these chunks.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::releaseFreeBlocks):
+        (JSC::BlockAllocator::blockFreeingThreadMain): Don't call MarkedBlock::destroy
+        because we expect that to be called before a block is put on our free
+        list now. Do manually deallocate our allocation chunk because that's
+        our job now.
+
+        * heap/BlockAllocator.h:
+        (BlockAllocator):
+        (JSC::BlockAllocator::allocate): Allocate never fails now. This is a
+        cleaner abstraction because only one object does all the VM allocation
+        and deallocation. Caching is an implementation detail.
+
+        (JSC::BlockAllocator::deallocate): We take an allocation chunk argument
+        instead of a block because we now expect the block to have been destroyed 
+        before we recycle its memory. For convenience, we still use the HeapBlock
+        class as our linked list node. This is OK because HeapBlock is a POD type.
+
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+        (JSC::CopiedBlock::create):
+        (JSC::CopiedBlock::destroy):
+        (JSC::CopiedBlock::CopiedBlock): Added proper create and destroy functions,
+        to match MarkedBlock.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::getFreshBlock):
+        (JSC::CopiedSpace::freeAllBlocks):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::recycleBlock): Make sure to call destroy before
+        returning a block to the BlockAllocator. Otherwise, our destructors
+        won't run. (If we get this wrong now, we'll get a compile error.)
+
+        * heap/HeapBlock.h:
+        (JSC::HeapBlock::HeapBlock): const!
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock): No need to distinguish between
+        create and recycle -- MarkedBlock always accepts memory allocated by
+        its client now.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create): Don't allocate memory -- we assume that we're
+        passed already-allocated memory, to clarify the responsibility for VM
+        recycling.
+
+        (JSC::MarkedBlock::destroy): Do run our destructor before giving back
+        our VM -- that is the whole point of this patch.
+
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        * heap/MarkedSpace.cpp: const!
+
+        (JSC::MarkedSpace::freeBlocks): Make sure to call destroy before
+        returning a block to the BlockAllocator. Otherwise, our destructors
+        won't run. (If we get this wrong now, we'll get a compile error.)
+
+== Rolled over to ChangeLog-2012-05-22 ==
diff --git a/ChangeLog-2013-04-24 b/ChangeLog-2013-04-24
new file mode 100644
index 0000000..d3b5d15
--- /dev/null
+++ b/ChangeLog-2013-04-24
@@ -0,0 +1,29044 @@
+2013-04-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA filters CheckFunction in a really weird way, and assumes that the function's structure won't change
+        https://bugs.webkit.org/show_bug.cgi?id=115077
+
+        Reviewed by Oliver Hunt.
+        
+        The filtering did three things that are unusual:
+        
+        1) AbstractValue::filterByValue() assumed that the passed value's structure wouldn't change, in
+           the sense that at it assumed it could use that value's *current* structure to do structure
+           filtering. Filtering by structure only makes sense if you can prove that the given value will
+           always have that structure (for example by either using a watchpoing or emitting code that
+           checks that structure at run-time).
+        
+        2) AbstractValue::filterByValue() and the CheckFunction case in AbstractState::executeEffects()
+           tried to invalidate the CFA based on whether the filtration led to an empty value. This is
+           well-intentioned, but it's not how the CFA currently works. It's inconsistent with other
+           parts of the CFA. We shouldn't introduce this feature into just one kind of filtration and
+           not have it elsewhere.
+        
+        3) The attempt to detect when the value was empty was actually implemented incorrectly. It
+           relied on AbstractValue::validate(). That method says that a concrete value does not belong
+           to the abstract value if it has a different structure. This makes sense for the other place
+           where AbstractValue::validate() is called: during OSR entry, where we are talking about a
+           JSValue that we see *right now*. It doesn't make sense in the CFA, since in the CFA any
+           value we observe in the code is a value whose structure may change when the code starts
+           running, and so we cannot use the value's current structure to infer things about the code
+           when it starts running.
+        
+        I fixed the above problems by (1) changing filterByValue() to not filter the structure, (2)
+        changing filterByValue() and the CheckFunction case to not invalidate the CFA, and (3)
+        making sure that nobody else was misusing AbstractValue::validate() (they weren't).
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::filterByValue):
+
+2013-04-23  Oliver Hunt  <oliver@apple.com>
+
+        Default ParserError() initialiser doesn't initialise all fields
+        https://bugs.webkit.org/show_bug.cgi?id=115074
+
+        Reviewed by Joseph Pecoraro.
+
+        Only the jsc command prompt depended on this, but we'll fix it to
+        be on the safe side.
+
+        * parser/ParserError.h:
+        (JSC::ParserError::ParserError):
+
+2013-04-23  Christophe Dumez  <ch.dumez@sisa.samsung.com>
+
+        Global constructors should be configurable and not enumerable
+        https://bugs.webkit.org/show_bug.cgi?id=110573
+
+        Reviewed by Geoffrey Garen.
+
+        Update JSObject::deleteProperty() so that mark to set the property
+        value to undefined if it is in static hashtable of properties. The
+        previous code was not doing anything in this case and this meant
+        we could not remove builtin DOMWindow properties such as
+        "ProgressEvent" even if marked as Deletable.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+        * runtime/Lookup.h:
+        (JSC):
+        (JSC::putEntry):
+        (JSC::lookupPut):
+
+2013-04-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Filled out more cases of branch folding in bytecode when emitting
+        expressions into a branching context
+        https://bugs.webkit.org/show_bug.cgi?id=115057
+
+        Reviewed by Filip Pizlo.
+
+        This covers a few cases like:
+
+            - while (true) { }
+            - while (1) { }
+            - if (x) break;
+            - if (x) continue;
+            - if (boolean_expr == boolean_const) { }
+            - if (boolean_expr == 1_or_0) { }
+            - if (bitop == 1_or_0) { }
+
+        This also works, but will bring shame on your family:
+
+            - while ("hello world") { }
+
+        No change on the benchmarks we track, but a 2.5X speedup on a microbenchmark
+        that uses these techniques.
+
+        * JavaScriptCore.order: Order!
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::shouldEmitDebugHooks): Updated ancillary code
+        for interface simplifications.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConstantNode::emitBytecodeInConditionContext): Constants can
+        jump unconditionally when used within a condition context.
+
+        (JSC::ConstantNode::emitBytecode):
+        (JSC::StringNode::jsValue): Gave constants a common base class so I
+        could implement their codegen just once.
+
+        (JSC::BinaryOpNode::emitBytecodeInConditionContext):
+        (JSC::canFoldToBranch):
+        (JSC::BinaryOpNode::tryFoldToBranch): Fold (!/=)= and (!/=)== where
+        appropriate. A lot of cases are not appropriate because of the surprising
+        type conversion semantics of ==. For example, if (number == true) { } is
+        not the same as if (number) { } because the former will up-convert true
+        to number and then do numeric comparison.
+
+        (JSC::singleStatement):
+        (JSC::IfElseNode::tryFoldBreakAndContinue):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::ContinueNode::trivialTarget):
+        (JSC::BreakNode::trivialTarget): Fold "if (expression) break" and
+        "if (expression) continue" into direct jumps from expression.
+
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::createIfStatement):
+        * parser/NodeConstructors.h:
+        (JSC::ConstantNode::ConstantNode):
+        (JSC):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::IfElseNode::IfElseNode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isConstant):
+        (JSC::ExpressionNode::isBoolean):
+        (JSC::StatementNode::isBreak):
+        (JSC::StatementNode::isContinue):
+        (ConstantNode):
+        (JSC::ConstantNode::isPure):
+        (JSC::ConstantNode::isConstant):
+        (NullNode):
+        (JSC::NullNode::jsValue):
+        (JSC::BooleanNode::value):
+        (JSC::BooleanNode::isBoolean):
+        (JSC::BooleanNode::jsValue):
+        (JSC::NumberNode::value):
+        (NumberNode):
+        (JSC::NumberNode::jsValue):
+        (StringNode):
+        (BinaryOpNode):
+        (IfElseNode):
+        (ContinueNode):
+        (JSC::ContinueNode::isContinue):
+        (BreakNode):
+        (JSC::BreakNode::isBreak):
+        * parser/Parser.cpp:
+        (JSC::::parseIfStatement):
+        * parser/ResultType.h:
+        (JSC::ResultType::definitelyIsBoolean):
+        (ResultType):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::pureToBoolean):
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::pureToBoolean): Updated for interface changes above.
+
+2013-04-23  Mark Lam  <mark.lam@apple.com>
+
+        Simplify the baseline JIT loop hint call site.
+        https://bugs.webkit.org/show_bug.cgi?id=115052.
+
+        Reviewed by Geoffrey Garen.
+
+        Moved the watchdog timer check after the JIT optimization check. This
+        ensures that the JIT opimization counter is incremented on every loop
+        hint even if the watchdog timer fires.
+
+        Removed the code that allows the JIT OSR to happen if the watchdog
+        timer fires but does not result in a termination. It is extremely rare
+        that the JIT optimization counter would trigger an OSR on the same pass
+        as when the watchdog timer fire. If it does happen, we'll simply hold
+        off on servicing the watchdog timer until the next pass (because it's
+        not time critical).
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_hint):
+        (JSC::JIT::emitSlow_op_loop_hint):
+
+2013-04-23  Roger Fong  <roger_fong@apple.com>
+
+        AppleWin build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2013-04-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Update public header documentation
+        https://bugs.webkit.org/show_bug.cgi?id=114841
+
+        Reviewed by Geoffrey Garen.
+
+        Added documentation for the newly added object lifetime-related stuff.
+
+        * API/JSManagedValue.h:
+        * API/JSVirtualMachine.h:
+
+2013-04-22  Mark Lam  <mark.lam@apple.com>
+
+        Fix a typo in MacroAssemblerARMv7.h.
+        https://bugs.webkit.org/show_bug.cgi?id=115011.
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/ARMAssembler.h: Fix a comment.
+        * assembler/ARMv7Assembler.h: Added some comments.
+        * assembler/MacroAssemblerARMv7.h:
+          - ARMAssembler::PL should be ARMv7Assembler::ConditionPL.
+
+2013-04-22  Julien Brianceau  <jbrianceau@nds.com>
+
+        Add branchAdd32 missing implementation in SH4 base JIT.
+        This should fix SH4 build, broken since r148893.
+        https://bugs.webkit.org/show_bug.cgi?id=114993.
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        (MacroAssemblerSH4):
+
+2013-04-22  Benjamin Poulain  <bpoulain@apple.com>
+
+        Windows build fix after r148921
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-22  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the memory instrumentation code
+        https://bugs.webkit.org/show_bug.cgi?id=114931
+
+        Reviewed by Andreas Kling.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-22  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken 32-bit build to green the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=114968.
+
+        Unreviewed.
+
+        Basically, I moved a JIT::emit_op_loop_hint() and JIT::emitSlow_op_loop_hint()
+        into common code where they belong, instead of the 64-bit specific section.
+
+        Also fixed some SH4 assertions failures which were also caused by
+        https://bugs.webkit.org/show_bug.cgi?id=114963. Thanks to Julien Brianceau
+        for pointing this out.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        * jit/JITOpcodes.cpp:
+        (JSC):
+        (JSC::JIT::emit_op_loop_hint):
+        (JSC::JIT::emitSlow_op_loop_hint):
+
+2013-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Perform null check before trying to use the result of readline()
+
+        RS=Gavin
+
+        * jsc.cpp:
+        (runInteractive):
+
+2013-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Fix assertions to account for new Vector layout
+
+        RS=Gavin
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+
+2013-04-22  Mark Lam  <mark.lam@apple.com>
+
+        Change baseline JIT watchdog timer check to use the proper fast slow path
+        infrastructure.
+        https://bugs.webkit.org/show_bug.cgi?id=114963.
+
+        Reviewed by Oliver Hunt.
+
+        Edit: The PositiveOrZero condition is added because it is needed for
+        the JIT optimization check. Previously, the JIT check branches around
+        the slow path if the test result is 'Signed' i.e. negative. Since we
+        now need to test for a condition that branches to the slow path (not
+        around it), we need the complement of 'Signed / Negative' i.e. Positive
+        or zero.
+
+        SH4 parts contributed by Julien Brianceau.
+
+        * assembler/ARMAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/SH4Assembler.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::emitEnterOptimizationCheck):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::emitEnterOptimizationCheck):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_hint):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        (JSC::JIT::emit_op_enter):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_enter):
+
+2013-04-22  Andreas Kling  <akling@apple.com>
+
+        Shrink baseline size of WTF::Vector on 64-bit by switching to unsigned capacity and size.
+        <http://webkit.org/b/97268>
+        <rdar://problem/12376519>
+
+        Reviewed by Sam Weinig.
+
+        Update LLInt WTF::Vector offset constants to match the new memory layout.
+
+        * llint/LowLevelInterpreter.asm:
+
+2013-04-21  Oliver Hunt  <oliver@apple.com>
+
+        JS Lexer and Parser should be more informative when they encounter errors
+        https://bugs.webkit.org/show_bug.cgi?id=114924
+
+        Reviewed by Filip Pizlo.
+
+        Add new tokens to represent the various ways that parsing and lexing have failed.
+        This gives us the ability to produce better error messages in some cases,
+        and to indicate whether or not the failure was due to invalid source, or simply
+        early termination.
+
+        The jsc prompt now makes use of this so that you can write functions that
+        are more than one line long.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * jsc.cpp:
+        (stringFromUTF):
+        (jscSource):
+        (runInteractive):
+        * parser/Lexer.cpp:
+        (JSC::::parseFourDigitUnicodeHex):
+        (JSC::::parseIdentifierSlowCase):
+        (JSC::::parseString):
+        (JSC::::parseStringSlowCase):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (UnicodeHexValue):
+        (JSC::Lexer::UnicodeHexValue::UnicodeHexValue):
+        (JSC::Lexer::UnicodeHexValue::valueType):
+        (JSC::Lexer::UnicodeHexValue::isValid):
+        (JSC::Lexer::UnicodeHexValue::value):
+        (Lexer):
+        * parser/Parser.h:
+        (JSC::Parser::getTokenName):
+        (JSC::Parser::updateErrorMessageSpecialCase):
+        (JSC::::parse):
+        * parser/ParserError.h:
+        (ParserError):
+        (JSC::ParserError::ParserError):
+        * parser/ParserTokens.h:
+        * runtime/Completion.cpp:
+        (JSC):
+        (JSC::checkSyntax):
+        * runtime/Completion.h:
+        (JSC):
+
+2013-04-21  Mark Lam  <mark.lam@apple.com>
+
+        Refactor identical inline functions in JSVALUE64 and JSVALUE32_64 sections
+        out into the common section.
+        https://bugs.webkit.org/show_bug.cgi?id=114910.
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+2013-04-20  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        LLint should be able to use x87 instead of SSE for floating pointer
+        https://bugs.webkit.org/show_bug.cgi?id=112239
+
+        Reviewed by Filip Pizlo.
+
+        Implements LLInt floating point operations in x87, to ensure we support
+        x86 without SSE2.
+
+        X86 (except 64bit) now defaults to using x87 instructions in order to
+        support all 32bit x86 back to i686. The implementation uses the fucomi
+        instruction from i686 which sets the new minimum.
+
+        The FPU registers must always be empty on entering or exiting a function.
+        We make sure to only use two X87 registers, and they are always emptied
+        before calling deeper functions or returning from the LLInt.
+
+        * jit/JITStubs.cpp:
+        (JSC): Empty FPU registers before exiting.
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2013-04-19  Roger Fong  <roger_fong@apple.com>
+
+        Remove uses of WebKit_Source from AppleWin build in JavaScriptCore.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+        * JavaScriptCore.vcxproj/build-generated-files.sh:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+
+2013-04-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        Rename JSStringJoiner::build() to join()
+        https://bugs.webkit.org/show_bug.cgi?id=114845
+
+        Reviewed by Geoffrey Garen.
+
+        The method name build() came from StringBuilder history. It does not make much
+        sense on the StringJoiner.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::join):
+        * runtime/JSStringJoiner.h:
+        (JSStringJoiner):
+
+2013-04-19  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. WebKit_Source is incorrectly set.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+
+2013-04-19  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] JSCore.gir.in has a few problems
+        https://bugs.webkit.org/show_bug.cgi?id=114710
+
+        Reviewed by Philippe Normand.
+
+        * GNUmakefile.am: Add the gobject introspection steps for JavaScriptCore here,
+        because they are shared between WebKit1 and WebKit2.
+        * JavaScriptCore.gir.in: Added. Moved from the WebKit1 directory. Now written
+        as foreign interfaces and referencing the javascriptcoregtk library.
+
+2013-04-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        Use StringJoiner to create the JSString of arrayProtoFuncToString
+        https://bugs.webkit.org/show_bug.cgi?id=114779
+
+        Reviewed by Geoffrey Garen.
+
+        The function arrayProtoFuncToString was just a glorified JSStringJoiner.
+        This patch replaces it by JSStringJoiner to simplify the code and enjoy any optimization
+        made on JSStringJoiner.
+
+        For some reason, this makes the execution 3.4% faster, despite having almost identical code.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
+2013-04-18  Oliver Hunt  <oliver@apple.com>
+
+        StackFrame::column() returning bogus value
+        https://bugs.webkit.org/show_bug.cgi?id=114840
+
+        Reviewed by Gavin Barraclough.
+
+        Don't add one part of the expression offset to the other part of the expression.
+        Make StackFrame::toString() include the column info.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::StackFrame::expressionInfo):
+        (JSC::StackFrame::toString):
+
+2013-04-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Crash beneath JSC::JIT::privateCompileSlowCases @ stephenrdonaldson.com
+        https://bugs.webkit.org/show_bug.cgi?id=114774
+
+        Reviewed by Geoffrey Garen.
+
+        We're not linking up all of the slow cases in the baseline JIT when compiling put_to_base.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_put_to_base):
+
+2013-04-18  Mark Lam  <mark.lam@apple.com>
+
+        Interpreter entry points should throw the TerminatedExecutionException from the caller frame.
+        https://bugs.webkit.org/show_bug.cgi?id=114816.
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+
+2013-04-18  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        LLInt ARM backend should not use the d8 register as scratch register
+        https://bugs.webkit.org/show_bug.cgi?id=114811
+
+        Reviewed by Filip Pizlo.
+
+        The d8 register must preserved across function calls and should
+        not used as scratch register. Changing it to d6.
+
+        * offlineasm/arm.rb:
+
+2013-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed HeapTimer::synchronize
+        https://bugs.webkit.org/show_bug.cgi?id=114832
+
+        Reviewed by Mark Hahnenberg.
+
+        HeapTimer::synchronize was a flawed attempt to make HeapTimer thread-safe.
+        Instead, we use proper locking now.
+
+        This is a slight API change, since the GC timer will now only fire in the
+        run loop that created the JS VM, even if another run loop later executes
+        some JS.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        * heap/HeapTimer.cpp:
+        (JSC):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+
+2013-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Renamed JSGlobalData to VM
+        https://bugs.webkit.org/show_bug.cgi?id=114777
+
+        Reviewed by Phil Pizlo.
+
+        * API/APICast.h:
+        (JSC):
+        (toJS):
+        (toRef):
+        * API/APIShims.h:
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (APIEntryShim):
+        (JSC::APIEntryShim::~APIEntryShim):
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::~APICallbackShim):
+        (APICallbackShim):
+        * API/JSAPIWrapperObject.h:
+        (JSAPIWrapperObject):
+        * API/JSAPIWrapperObject.mm:
+        (JSC::::createStructure):
+        (JSC::JSAPIWrapperObject::JSAPIWrapperObject):
+        (JSC::JSAPIWrapperObject::finishCreation):
+        (JSC::JSAPIWrapperObject::visitChildren):
+        * API/JSBase.cpp:
+        (JSGarbageCollect):
+        (JSReportExtraMemoryCost):
+        (JSSynchronousGarbageCollectForDebugging):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        (JSC::JSCallbackConstructor::finishCreation):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::finishCreation):
+        (JSC::JSCallbackFunction::create):
+        * API/JSCallbackFunction.h:
+        (JSCallbackFunction):
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.cpp:
+        (JSC::::create):
+        (JSC::::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSCallbackObject):
+        (JSC::JSCallbackObject::setPrivateProperty):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        (JSC::::finishCreation):
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        (OpaqueJSClass::prototype):
+        * API/JSClassRef.h:
+        (OpaqueJSClassContextData):
+        * API/JSContext.mm:
+        (-[JSContext setException:]):
+        (-[JSContext initWithGlobalContextRef:]):
+        (+[JSContext contextWithGlobalContextRef:]):
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        (JSContextGroupRelease):
+        (JSGlobalContextCreate):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRetain):
+        (JSGlobalContextRelease):
+        (JSContextGetGroup):
+        (JSContextCreateBacktrace):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray):
+        (OpaqueJSPropertyNameArray):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::create):
+        (OpaqueJSScript::vm):
+        (OpaqueJSScript::OpaqueJSScript):
+        (OpaqueJSScript):
+        (parseScript):
+        * API/JSVirtualMachine.mm:
+        (scanExternalObjectGraph):
+        * API/JSVirtualMachineInternal.h:
+        (JSC):
+        * API/JSWrapperMap.mm:
+        (makeWrapper):
+        * API/ObjCCallbackFunction.h:
+        (JSC::ObjCCallbackFunction::createStructure):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunction::create):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::identifier):
+        * API/OpaqueJSString.h:
+        (JSC):
+        (OpaqueJSString):
+        * GNUmakefile.list.am:
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * KeywordLookupGenerator.py:
+        (Trie.printSubTreeAsC):
+        * Target.pri:
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (ARMAssembler):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::executableCopy):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::linkCode):
+        * assembler/LinkBuffer.h:
+        (JSC):
+        (JSC::LinkBuffer::LinkBuffer):
+        (LinkBuffer):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::executableCopy):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CallLinkInfo.h:
+        (CallLinkInfo):
+        * bytecode/CodeBlock.cpp:
+        (JSC::dumpStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::visitStructures):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::createActivation):
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::findClosureCallForReturnPC):
+        (JSC::ProgramCodeBlock::jettisonImpl):
+        (JSC::EvalCodeBlock::jettisonImpl):
+        (JSC::FunctionCodeBlock::jettisonImpl):
+        (JSC::CodeBlock::predictedMachineCodeSize):
+        (JSC::CodeBlock::usesOpcode):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::appendWeakReference):
+        (JSC::CodeBlock::appendWeakReferenceTransition):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::setGlobalData):
+        (JSC::CodeBlock::vm):
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        (JSC::CodeBlock::addConstant):
+        (JSC::CodeBlock::setConstantRegisters):
+        (CodeBlock):
+        (JSC::CodeBlock::WeakReferenceTransition::WeakReferenceTransition):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::getSlow):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (GetByIdStatus):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::initialize):
+        (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
+        * bytecode/PolymorphicAccessStructureList.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::replace):
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::computePreciseJumpTargets):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (JSC):
+        (PutByIdStatus):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForStructure):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        (JSC::ScriptSampleRecord::ScriptSampleRecord):
+        (SamplingTool):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::link):
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::create):
+        (UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::finishCreation):
+        (JSC::UnlinkedFunctionExecutable::createStructure):
+        (JSC::UnlinkedCodeBlock::addRegExp):
+        (JSC::UnlinkedCodeBlock::addConstant):
+        (JSC::UnlinkedCodeBlock::addFunctionDecl):
+        (JSC::UnlinkedCodeBlock::addFunctionExpr):
+        (JSC::UnlinkedCodeBlock::vm):
+        (UnlinkedCodeBlock):
+        (JSC::UnlinkedCodeBlock::finishCreation):
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock):
+        (JSC::UnlinkedProgramCodeBlock::create):
+        (JSC::UnlinkedProgramCodeBlock::addFunctionDeclaration):
+        (JSC::UnlinkedProgramCodeBlock::UnlinkedProgramCodeBlock):
+        (JSC::UnlinkedProgramCodeBlock::createStructure):
+        (JSC::UnlinkedEvalCodeBlock::create):
+        (JSC::UnlinkedEvalCodeBlock::UnlinkedEvalCodeBlock):
+        (JSC::UnlinkedEvalCodeBlock::createStructure):
+        (JSC::UnlinkedFunctionCodeBlock::create):
+        (JSC::UnlinkedFunctionCodeBlock::UnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionCodeBlock::createStructure):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::expectedFunctionForIdentifier):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::vm):
+        (JSC::BytecodeGenerator::propertyNames):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::InstanceOfNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/Debugger.h:
+        (JSC):
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::finishCreation):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::create):
+        (JSC::DebuggerActivation::createStructure):
+        (DebuggerActivation):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
+        (JSC::DFG::AssemblyHelpers::vm):
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
+        (AssemblyHelpers):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGByteCodeParser.h:
+        (JSC):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::CCallHelpers):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::canHandleOpcodes):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::reportToProfiler):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGDriver.h:
+        (JSC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        (JSC::DFG::operationPutByValInternal):
+        (JSC::getHostCallReturnValueWithExecState):
+        * dfg/DFGPhase.h:
+        (JSC::DFG::Phase::vm):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        (JSC::DFG::linkSlowFor):
+        (JSC::DFG::dfgLinkFor):
+        (JSC::DFG::dfgLinkSlowFor):
+        (JSC::DFG::dfgLinkClosureCall):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileFromCharCode):
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        (JSC::DFG::SpeculativeJIT::compileStringEquality):
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::prepareForExternalCall):
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+        (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
+        (JSC::DFG::slowPathFor):
+        (JSC::DFG::linkForThunkGenerator):
+        (JSC::DFG::linkCallThunkGenerator):
+        (JSC::DFG::linkConstructThunkGenerator):
+        (JSC::DFG::linkClosureCallThunkGenerator):
+        (JSC::DFG::virtualForThunkGenerator):
+        (JSC::DFG::virtualCallThunkGenerator):
+        (JSC::DFG::virtualConstructThunkGenerator):
+        * dfg/DFGThunks.h:
+        (JSC):
+        (DFG):
+        * heap/BlockAllocator.h:
+        (JSC):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        (JSC::CopiedSpace::tryReallocate):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::tryAllocate):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::reset):
+        * heap/GCThreadSharedData.h:
+        (JSC):
+        (GCThreadSharedData):
+        * heap/HandleSet.cpp:
+        (JSC::HandleSet::HandleSet):
+        (JSC::HandleSet::~HandleSet):
+        (JSC::HandleSet::grow):
+        * heap/HandleSet.h:
+        (JSC):
+        (HandleSet):
+        (JSC::HandleSet::vm):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC):
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::stack):
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::deleteAllCompiledCode):
+        (JSC::Heap::collect):
+        (JSC::Heap::isValidAllocation):
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        (JSC::Heap::vm):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::HeapTimer):
+        (JSC::HeapTimer::timerDidFire):
+        (JSC::HeapTimer::timerEvent):
+        * heap/HeapTimer.h:
+        (JSC):
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::sweepNextBlock):
+        (JSC::IncrementalSweeper::willFinishSweeping):
+        (JSC::IncrementalSweeper::create):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/Local.h:
+        (Local):
+        (JSC::::Local):
+        (JSC::LocalStack::LocalStack):
+        (JSC::LocalStack::push):
+        (LocalStack):
+        * heap/LocalScope.h:
+        (JSC):
+        (LocalScope):
+        (JSC::LocalScope::LocalScope):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::addCurrentThread):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::vm):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::setup):
+        * heap/Strong.h:
+        (JSC):
+        (Strong):
+        (JSC::Strong::operator=):
+        * heap/StrongInlines.h:
+        (JSC::::Strong):
+        (JSC::::set):
+        * heap/SuperRegion.h:
+        (JSC):
+        * heap/WeakSet.cpp:
+        * heap/WeakSet.h:
+        (WeakSet):
+        (JSC::WeakSet::WeakSet):
+        (JSC::WeakSet::vm):
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/AbstractPC.h:
+        (JSC):
+        (AbstractPC):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        (JSC::ExecState::clearException):
+        (JSC::ExecState::clearSupplementaryExceptionInfo):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::hadException):
+        (JSC::ExecState::propertyNames):
+        (JSC::ExecState::emptyList):
+        (JSC::ExecState::interpreter):
+        (JSC::ExecState::heap):
+        (JSC::ExecState::arrayConstructorTable):
+        (JSC::ExecState::arrayPrototypeTable):
+        (JSC::ExecState::booleanPrototypeTable):
+        (JSC::ExecState::dateTable):
+        (JSC::ExecState::dateConstructorTable):
+        (JSC::ExecState::errorPrototypeTable):
+        (JSC::ExecState::globalObjectTable):
+        (JSC::ExecState::jsonTable):
+        (JSC::ExecState::mathTable):
+        (JSC::ExecState::numberConstructorTable):
+        (JSC::ExecState::numberPrototypeTable):
+        (JSC::ExecState::objectConstructorTable):
+        (JSC::ExecState::privateNamePrototypeTable):
+        (JSC::ExecState::regExpTable):
+        (JSC::ExecState::regExpConstructorTable):
+        (JSC::ExecState::regExpPrototypeTable):
+        (JSC::ExecState::stringConstructorTable):
+        (JSC::ExecState::abstractReturnPC):
+        * interpreter/CallFrameClosure.h:
+        (CallFrameClosure):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::eval):
+        (JSC::loadVarargs):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::appendSourceToError):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::retrieveArgumentsFromVMCode):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (JSC::TopCallFrameSetter::TopCallFrameSetter):
+        (JSC::TopCallFrameSetter::~TopCallFrameSetter):
+        (TopCallFrameSetter):
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        (Interpreter):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        * interpreter/JSStack.h:
+        (JSC):
+        * jit/ClosureCallStubRoutine.cpp:
+        (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
+        * jit/ClosureCallStubRoutine.h:
+        (ClosureCallStubRoutine):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::allocate):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        (ExecutableAllocator):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::allocate):
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
+        (JSC::createJITStubRoutine):
+        * jit/GCAwareJITStubRoutine.h:
+        (GCAwareJITStubRoutine):
+        (MarkingGCAwareJITStubRoutineWithOneObject):
+        (JSC):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkFor):
+        (JSC::JIT::linkSlowCall):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        (JSC::JIT::compileClosureCall):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileGetByVal):
+        (JSC::JIT::compilePutByVal):
+        (JSC::JIT::compileCTINativeCall):
+        (JSC::JIT::compilePatchGetArrayLength):
+        (JIT):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCode.h:
+        (JSC):
+        (JSC::JITCode::execute):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        (JSC::jitThrow):
+        * jit/JITExceptions.h:
+        (JSC):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitLoadCharacterString):
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emitSlow_op_convert_this):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC):
+        (JSC::performPlatformSpecificJITAssertions):
+        (JSC::tryCachePutByID):
+        (JSC::tryCacheGetByID):
+        (JSC::returnToThrowTrampoline):
+        (JSC::throwExceptionFromOpCall):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        (JSC::putByVal):
+        * jit/JITStubs.h:
+        (JSC):
+        (JITStackFrame):
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::ctiNativeCall):
+        (JSC::JITThunks::ctiNativeConstruct):
+        (JSC::JITThunks::ctiStub):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+        (JSC):
+        (JITThunks):
+        * jit/JITWriteBarrier.h:
+        (JSC):
+        (JSC::JITWriteBarrierBase::set):
+        (JSC::JITWriteBarrier::set):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerator.h:
+        (JSC):
+        * jit/ThunkGenerators.cpp:
+        (JSC::generateSlowCaseFor):
+        (JSC::linkForGenerator):
+        (JSC::linkCallGenerator):
+        (JSC::linkConstructGenerator):
+        (JSC::linkClosureCallGenerator):
+        (JSC::virtualForGenerator):
+        (JSC::virtualCallGenerator):
+        (JSC::virtualConstructGenerator):
+        (JSC::stringLengthTrampolineGenerator):
+        (JSC::nativeForGenerator):
+        (JSC::nativeCallGenerator):
+        (JSC::nativeConstructGenerator):
+        (JSC::stringCharLoad):
+        (JSC::charToString):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        * jit/ThunkGenerators.h:
+        (JSC):
+        * jsc.cpp:
+        (GlobalObject):
+        (GlobalObject::create):
+        (GlobalObject::createStructure):
+        (GlobalObject::finishCreation):
+        (GlobalObject::addFunction):
+        (GlobalObject::addConstructableFunction):
+        (functionDumpCallFrame):
+        (functionJSCStack):
+        (functionReleaseExecutableMemory):
+        (functionRun):
+        (main):
+        (runWithScripts):
+        (jscmain):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntData.h:
+        (JSC):
+        (Data):
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntEntrypoints.h:
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::getEntrypoint):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::llint_trace_operand):
+        (JSC::LLInt::llint_trace_value):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::shouldJIT):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::generateThunkWithJumpTo):
+        (JSC::LLInt::functionForCallEntryThunkGenerator):
+        (JSC::LLInt::functionForConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
+        (JSC::LLInt::evalEntryThunkGenerator):
+        (JSC::LLInt::programEntryThunkGenerator):
+        * llint/LLIntThunks.h:
+        (JSC):
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/cloop.rb:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::createSourceElements):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArguments):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createElementList):
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createClause):
+        (JSC::ASTBuilder::createClauseList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::addVar):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::Scope::Scope):
+        (JSC::ASTBuilder::createNumber):
+        (ASTBuilder):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/Lexer.cpp:
+        (JSC::Keywords::Keywords):
+        (JSC::::Lexer):
+        (JSC::::parseIdentifier):
+        (JSC::::parseIdentifierSlowCase):
+        * parser/Lexer.h:
+        (JSC::Keywords::isKeyword):
+        (JSC::Keywords::getKeyword):
+        (Keywords):
+        (Lexer):
+        (JSC::::makeIdentifier):
+        (JSC::::makeRightSizedIdentifier):
+        (JSC::::makeIdentifierLCharFromUChar):
+        (JSC::::makeLCharIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new):
+        (JSC::ParserArenaDeletable::operator new):
+        (JSC::ParserArenaRefCounted::ParserArenaRefCounted):
+        (JSC::PropertyNode::PropertyNode):
+        (JSC::ContinueNode::ContinueNode):
+        (JSC::BreakNode::BreakNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (ParserArenaFreeable):
+        (ParserArenaDeletable):
+        (ParserArenaRefCounted):
+        (ArrayNode):
+        (ForInNode):
+        (ContinueNode):
+        (BreakNode):
+        (ScopeNode):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseInner):
+        (JSC::::parseSourceElements):
+        (JSC::::parseTryStatement):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseProperty):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC):
+        (JSC::Scope::Scope):
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareParameter):
+        (Scope):
+        (Parser):
+        (JSC::Parser::pushScope):
+        (JSC::::parse):
+        (JSC::parse):
+        * parser/ParserArena.h:
+        (IdentifierArena):
+        (JSC::IdentifierArena::makeIdentifier):
+        (JSC::IdentifierArena::makeIdentifierLCharFromUChar):
+        (JSC::IdentifierArena::makeNumericIdentifier):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::startProfiling):
+        (JSC::LegacyProfiler::stopProfiling):
+        * profiler/LegacyProfiler.h:
+        (JSC):
+        * profiler/ProfilerBytecode.cpp:
+        (JSC::Profiler::Bytecode::toJS):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
+        (JSC::Profiler::BytecodeSequence::addSequenceProperties):
+        * profiler/ProfilerBytecodes.cpp:
+        (JSC::Profiler::Bytecodes::toJS):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerCompiledBytecode.cpp:
+        (JSC::Profiler::CompiledBytecode::toJS):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::Database):
+        (JSC::Profiler::Database::toJS):
+        (JSC::Profiler::Database::toJSON):
+        * profiler/ProfilerDatabase.h:
+        (Database):
+        * profiler/ProfilerOSRExit.cpp:
+        (JSC::Profiler::OSRExit::toJS):
+        * profiler/ProfilerOrigin.cpp:
+        (JSC::Profiler::Origin::toJS):
+        * profiler/ProfilerProfiledBytecodes.cpp:
+        (JSC::Profiler::ProfiledBytecodes::toJS):
+        * runtime/ArgList.h:
+        (MarkedArgumentBuffer):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putByIndex):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        (JSC::Arguments::defineOwnProperty):
+        (JSC::Arguments::tearOff):
+        (JSC::Arguments::didTearOffActivation):
+        (JSC::Arguments::tearOffForInlineCallFrame):
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::createStructure):
+        (Arguments):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::trySetArgument):
+        (JSC::Arguments::finishCreation):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::createStructure):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        (BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::finishCreation):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        (JSC::BooleanConstructor::createStructure):
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        (JSC::BooleanObject::finishCreation):
+        * runtime/BooleanObject.h:
+        (BooleanObject):
+        (JSC::BooleanObject::create):
+        (JSC::BooleanObject::createStructure):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        (JSC::BooleanPrototype::finishCreation):
+        (JSC::booleanProtoFuncToString):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::createStructure):
+        * runtime/Butterfly.h:
+        (JSC):
+        (Butterfly):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::createUninitialized):
+        (JSC::Butterfly::create):
+        (JSC::Butterfly::growPropertyStorage):
+        (JSC::Butterfly::createOrGrowArrayRight):
+        (JSC::Butterfly::growArrayRight):
+        (JSC::Butterfly::resizeArray):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC):
+        (JSC::SourceCodeValue::SourceCodeValue):
+        (CodeCache):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC):
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        (CommonIdentifiers):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::createStructure):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        (JSC::DateInstance::finishCreation):
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DateInstance.h:
+        (DateInstance):
+        (JSC::DateInstance::create):
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (JSC::createEvalError):
+        (JSC::createRangeError):
+        (JSC::createReferenceError):
+        (JSC::createSyntaxError):
+        (JSC::createTypeError):
+        (JSC::createURIError):
+        (JSC::addErrorInfo):
+        (JSC::throwError):
+        * runtime/Error.h:
+        (JSC):
+        (JSC::StrictModeTypeErrorFunction::create):
+        (JSC::StrictModeTypeErrorFunction::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::finishCreation):
+        * runtime/ErrorConstructor.h:
+        (JSC::ErrorConstructor::createStructure):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        (JSC::ErrorInstance::create):
+        (ErrorInstance):
+        (JSC::ErrorInstance::finishCreation):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        (JSC::ErrorPrototype::finishCreation):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::createStructure):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createTerminatedExecutionException):
+        * runtime/ExceptionHelpers.h:
+        (JSC):
+        (JSC::InterruptedExecutionError::InterruptedExecutionError):
+        (JSC::InterruptedExecutionError::create):
+        (JSC::InterruptedExecutionError::createStructure):
+        (JSC::TerminatedExecutionError::TerminatedExecutionError):
+        (JSC::TerminatedExecutionError::create):
+        (JSC::TerminatedExecutionError::createStructure):
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::EvalExecutable::compileOptimized):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::EvalExecutable::jettisonOptimizedCode):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::ProgramExecutable::jettisonOptimizedCode):
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeForCall):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeForConstruct):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::finishCreation):
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::NativeExecutable::finishCreation):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::finishCreation):
+        (JSC::EvalExecutable::compile):
+        (EvalExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::create):
+        (ProgramExecutable):
+        (JSC::ProgramExecutable::compile):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::compileForCall):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
+        (JSC::FunctionExecutable::createStructure):
+        (JSC::JSFunction::JSFunction):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::finishCreation):
+        * runtime/FunctionConstructor.h:
+        (JSC::FunctionConstructor::createStructure):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::finishCreation):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncBind):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::doWork):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+        * runtime/GCActivityCallback.h:
+        (JSC::GCActivityCallback::GCActivityCallback):
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::doWork):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::create):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setSetter):
+        (JSC::GetterSetter::createStructure):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::add8):
+        (JSC::Identifier::addSlowCase):
+        (JSC::Identifier::from):
+        (JSC::Identifier::checkCurrentIdentifierTable):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::createLCharFromUChar):
+        (Identifier):
+        (JSC::Identifier::add):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        (JSC::InternalFunction::finishCreation):
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (InternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        (JSC::JSAPIValueWrapper::finishCreation):
+        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putDirectVirtual):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSActivation):
+        (JSC::JSActivation::create):
+        (JSC::JSActivation::createStructure):
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::tearOff):
+        * runtime/JSArray.cpp:
+        (JSC::createArrayButterflyInDictionaryIndexingMode):
+        (JSC::JSArray::setLengthWritable):
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        (JSC::ContiguousTypeAccessor::setWithValue):
+        (JSC::JSArray::sortCompactedVector):
+        (JSC::JSArray::sortVector):
+        * runtime/JSArray.h:
+        (JSC::JSArray::JSArray):
+        (JSArray):
+        (JSC::JSArray::shiftCountForShift):
+        (JSC::JSArray::unshiftCountForShift):
+        (JSC::JSArray::createStructure):
+        (JSC::createContiguousArrayButterfly):
+        (JSC::createArrayButterfly):
+        (JSC):
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        (JSC::constructArray):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::JSBoundFunction):
+        * runtime/JSBoundFunction.h:
+        (JSC::JSBoundFunction::createStructure):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/JSCJSValue.h:
+        (JSC):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::JSCell):
+        (JSC::JSCell::finishCreation):
+        (JSC::allocateCell):
+        (JSC::JSCell::setStructure):
+        (JSC::JSCell::fastGetOwnProperty):
+        * runtime/JSDateMath.cpp:
+        (JSC::getDSTOffset):
+        (JSC::getUTCOffset):
+        (JSC::parseDate):
+        * runtime/JSDestructibleObject.h:
+        (JSC::JSDestructibleObject::JSDestructibleObject):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::finishCreation):
+        (JSC::JSFunction::createAllocationProfile):
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::deleteProperty):
+        * runtime/JSFunction.h:
+        (JSFunction):
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::setScope):
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp: Removed.
+        * runtime/JSGlobalData.h: Removed.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::setGlobalThis):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::putDirectVirtual):
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+        (JSC::JSGlobalObject::haveABadTime):
+        (JSC::JSGlobalObject::createThrowTypeError):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::finishCreation):
+        (JSC::JSGlobalObject::vm):
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::ExecState::dynamicGlobalObject):
+        (JSC::constructEmptyArray):
+        (DynamicGlobalObjectScope):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSLock.cpp:
+        (JSC::JSLockHolder::JSLockHolder):
+        (JSC::JSLockHolder::init):
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::willDestroyGlobalData):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC):
+        (JSLockHolder):
+        (JSLock):
+        (JSC::JSLock::vm):
+        (DropAllLocks):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::createStructure):
+        (JSC::JSNameScope::finishCreation):
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::JSNotAnObject):
+        (JSC::JSNotAnObject::create):
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        (JSC::JSONObject::finishCreation):
+        (Holder):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::Holder):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::Walker):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        (JSC::JSONStringify):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::createInitialArrayStorage):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::genericConvertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToContiguous):
+        (JSC::JSObject::rageConvertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::convertUndecidedForValue):
+        (JSC::JSObject::convertInt32ForValue):
+        (JSC::JSObject::setIndexQuicklyToUndecided):
+        (JSC::JSObject::convertInt32ToDoubleOrContiguousWhilePerformingSetIndex):
+        (JSC::JSObject::convertDoubleToContiguousWhilePerformingSetIndex):
+        (JSC::JSObject::ensureInt32Slow):
+        (JSC::JSObject::ensureDoubleSlow):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::rageEnsureContiguousSlow):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        (JSC::JSObject::putDirectVirtual):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::allocateSparseIndexMap):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectNativeFunction):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::putDescriptor):
+        (JSC::JSObject::putDirectMayBeIndex):
+        (JSC::DefineOwnPropertyScope::DefineOwnPropertyScope):
+        (JSC::DefineOwnPropertyScope::~DefineOwnPropertyScope):
+        (DefineOwnPropertyScope):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::putByIndexInline):
+        (JSC::JSObject::putDirectIndex):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::ensureInt32):
+        (JSC::JSObject::ensureDouble):
+        (JSC::JSObject::ensureContiguous):
+        (JSC::JSObject::rageEnsureContiguous):
+        (JSC::JSObject::ensureArrayStorage):
+        (JSC::JSObject::finishCreation):
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::ensureLength):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSFinalObject::create):
+        (JSC::JSObject::setButterfly):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putOwnDataProperty):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::finishCreation):
+        (JSC::StructureRareData::setEnumerationCache):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setTarget):
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::create):
+        (JSC::JSProxy::createStructure):
+        (JSC::JSProxy::JSProxy):
+        (JSC::JSProxy::finishCreation):
+        (JSProxy):
+        * runtime/JSScope.cpp:
+        (JSC::executeResolveOperations):
+        (JSC::JSScope::resolveContainingScopeInternal):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis):
+        (JSC::JSScope::resolvePut):
+        * runtime/JSScope.h:
+        (JSScope):
+        (JSC::JSScope::JSScope):
+        (JSC::JSScope::vm):
+        (JSC::ExecState::vm):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+        (JSC::JSSegmentedVariableObject::finishCreation):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::RopeBuilder::expand):
+        (JSC::StringObject::create):
+        * runtime/JSString.h:
+        (JSC):
+        (JSString):
+        (JSC::JSString::JSString):
+        (JSC::JSString::finishCreation):
+        (JSC::JSString::create):
+        (JSC::JSString::createHasOtherOwner):
+        (JSC::JSString::createStructure):
+        (JSRopeString):
+        (JSC::JSRopeString::RopeBuilder::RopeBuilder):
+        (JSC::JSRopeString::RopeBuilder::append):
+        (RopeBuilder):
+        (JSC::JSRopeString::JSRopeString):
+        (JSC::JSRopeString::finishCreation):
+        (JSC::JSRopeString::append):
+        (JSC::JSRopeString::createNull):
+        (JSC::JSRopeString::create):
+        (JSC::jsEmptyString):
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsNontrivialString):
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsSubstring8):
+        (JSC::jsOwnedString):
+        (JSC::jsStringBuilder):
+        (JSC::inlineJSValueNotStringtoString):
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::build):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::finishCreation):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::create):
+        (JSC::JSWithScope::createStructure):
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/JSWrapperObject.h:
+        (JSWrapperObject):
+        (JSC::JSWrapperObject::createStructure):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/LiteralParser.cpp:
+        (JSC::::tryJSONPParse):
+        (JSC::::makeIdentifier):
+        (JSC::::parse):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashTable::initializeIfNeeded):
+        (JSC::HashTable::entry):
+        (JSC::HashTable::begin):
+        (JSC::HashTable::end):
+        (HashTable):
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::MathObject::finishCreation):
+        (JSC::mathProtoFuncSin):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/MemoryStatistics.cpp:
+        * runtime/MemoryStatistics.h:
+        * runtime/NameConstructor.cpp:
+        (JSC::NameConstructor::finishCreation):
+        (JSC::constructPrivateName):
+        * runtime/NameConstructor.h:
+        (JSC::NameConstructor::createStructure):
+        * runtime/NameInstance.cpp:
+        (JSC::NameInstance::NameInstance):
+        * runtime/NameInstance.h:
+        (JSC::NameInstance::createStructure):
+        (JSC::NameInstance::create):
+        (NameInstance):
+        (JSC::NameInstance::finishCreation):
+        * runtime/NamePrototype.cpp:
+        (JSC::NamePrototype::NamePrototype):
+        (JSC::NamePrototype::finishCreation):
+        * runtime/NamePrototype.h:
+        (JSC::NamePrototype::createStructure):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::finishCreation):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+        (JSC::constructWithNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        (JSC::NumberObject::finishCreation):
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        (NumberObject):
+        (JSC::NumberObject::create):
+        (JSC::NumberObject::createStructure):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        (JSC::NumberPrototype::finishCreation):
+        (JSC::integerValueToString):
+        (JSC::numberProtoFuncToString):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::createStructure):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        (JSC::constructEmptyObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        (JSC::ObjectPrototype::finishCreation):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::createStructure):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        * runtime/Operations.h:
+        (JSC):
+        (JSC::jsString):
+        (JSC::jsStringFromArguments):
+        (JSC::normalizePrototypeChainForChainAccess):
+        (JSC::normalizePrototypeChain):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (JSC::PropertyTable::createStructure):
+        (PropertyTable):
+        (JSC::PropertyTable::copy):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::vm):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (PropertyNameArray):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::create):
+        (JSC::PropertyTable::clone):
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::emptyObjectStructureForPrototype):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::finishCreation):
+        (JSC::RegExp::createWithoutCaching):
+        (JSC::RegExp::create):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileIfNecessary):
+        (JSC::RegExp::match):
+        (JSC::RegExp::compileMatchOnly):
+        (JSC::RegExp::compileIfNecessaryMatchOnly):
+        * runtime/RegExp.h:
+        (JSC):
+        (RegExp):
+        (JSC::RegExp::createStructure):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::RegExpCache):
+        (JSC::RegExpCache::addToStrongCache):
+        * runtime/RegExpCache.h:
+        (RegExpCache):
+        * runtime/RegExpCachedResult.cpp:
+        (JSC::RegExpCachedResult::lastResult):
+        (JSC::RegExpCachedResult::setInput):
+        * runtime/RegExpCachedResult.h:
+        (JSC::RegExpCachedResult::RegExpCachedResult):
+        (JSC::RegExpCachedResult::record):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpConstructor::finishCreation):
+        (JSC::constructRegExp):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        (RegExpConstructor):
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::create):
+        (JSC::RegExpMatchesArray::finishCreation):
+        (JSC::RegExpMatchesArray::reifyAllProperties):
+        * runtime/RegExpMatchesArray.h:
+        (RegExpMatchesArray):
+        (JSC::RegExpMatchesArray::createStructure):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        (JSC::RegExpObject::finishCreation):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::create):
+        (JSC::RegExpObject::setRegExp):
+        (JSC::RegExpObject::setLastIndex):
+        (JSC::RegExpObject::createStructure):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::createStructure):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::initializeCommonStrings):
+        (JSC::SmallStrings::createEmptyString):
+        (JSC::SmallStrings::createSingleCharacterString):
+        (JSC::SmallStrings::initialize):
+        * runtime/SmallStrings.h:
+        (JSC):
+        (JSC::SmallStrings::singleCharacterString):
+        (SmallStrings):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::SparseArrayValueMap):
+        (JSC::SparseArrayValueMap::finishCreation):
+        (JSC::SparseArrayValueMap::create):
+        (JSC::SparseArrayValueMap::createStructure):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayEntry::put):
+        * runtime/SparseArrayValueMap.h:
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::create):
+        (JSC::StrictEvalActivation::createStructure):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::finishCreation):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::createStructure):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        (JSC::StringObject::finishCreation):
+        (JSC::constructString):
+        * runtime/StringObject.h:
+        (JSC::StringObject::create):
+        (JSC::StringObject::createStructure):
+        (StringObject):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        (JSC::StringPrototype::finishCreation):
+        (JSC::removeUsingRegExpSearch):
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSplit):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/StringRecursionChecker.h:
+        (JSC::StringRecursionChecker::performCheck):
+        (JSC::StringRecursionChecker::~StringRecursionChecker):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::add):
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::allocateRareData):
+        (JSC::Structure::cloneRareDataFrom):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::finishCreation):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::setGlobalObject):
+        (JSC::Structure::setObjectToStringValue):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+        (JSC::Structure::setPreviousID):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::createStructure):
+        (JSC::StructureChain::finishCreation):
+        (StructureChain):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::create):
+        (JSC::Structure::createStructure):
+        (JSC::Structure::get):
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::propertyTable):
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::createStructure):
+        (JSC::StructureRareData::create):
+        (JSC::StructureRareData::clone):
+        (JSC::StructureRareData::StructureRareData):
+        * runtime/StructureRareData.h:
+        (StructureRareData):
+        * runtime/StructureRareDataInlines.h:
+        (JSC::StructureRareData::setPreviousID):
+        (JSC::StructureRareData::setObjectToStringValue):
+        * runtime/StructureTransitionTable.h:
+        (StructureTransitionTable):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::create):
+        (JSC::SharedSymbolTable::createStructure):
+        (JSC::SharedSymbolTable::SharedSymbolTable):
+        * runtime/VM.cpp: Copied from Source/JavaScriptCore/runtime/JSGlobalData.cpp.
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        (JSC::VM::createContextGroup):
+        (JSC::VM::create):
+        (JSC::VM::createLeaked):
+        (JSC::VM::sharedInstanceExists):
+        (JSC::VM::sharedInstance):
+        (JSC::VM::sharedInstanceInternal):
+        (JSC::VM::getHostFunction):
+        (JSC::VM::ClientData::~ClientData):
+        (JSC::VM::resetDateCache):
+        (JSC::VM::startSampling):
+        (JSC::VM::stopSampling):
+        (JSC::VM::discardAllCode):
+        (JSC::VM::dumpSampleData):
+        (JSC::VM::addSourceProviderCache):
+        (JSC::VM::clearSourceProviderCaches):
+        (JSC::VM::releaseExecutableMemory):
+        (JSC::releaseExecutableMemory):
+        (JSC::VM::gatherConservativeRoots):
+        (JSC::VM::addRegExpToTrace):
+        (JSC::VM::dumpRegExpTrace):
+        * runtime/VM.h: Copied from Source/JavaScriptCore/runtime/JSGlobalData.h.
+        (VM):
+        (JSC::VM::isSharedInstance):
+        (JSC::VM::usingAPI):
+        (JSC::VM::isInitializingObject):
+        (JSC::VM::setInitializingObjectClass):
+        (JSC::WeakSet::heap):
+        * runtime/WriteBarrier.h:
+        (JSC):
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::setMayBeNull):
+        (JSC::WriteBarrierBase::setEarlyValue):
+        (JSC::WriteBarrier::WriteBarrier):
+        * testRegExp.cpp:
+        (GlobalObject):
+        (GlobalObject::create):
+        (GlobalObject::createStructure):
+        (GlobalObject::finishCreation):
+        (main):
+        (testOneRegExp):
+        (parseRegExpLine):
+        (runFromFiles):
+        (realMain):
+        * yarr/YarrInterpreter.h:
+        (BytecodePattern):
+        * yarr/YarrJIT.cpp:
+        (YarrGenerator):
+        (JSC::Yarr::YarrGenerator::compile):
+        (JSC::Yarr::jitCompile):
+        * yarr/YarrJIT.h:
+        (JSC):
+
+2013-04-18  Xuefei Ren  <xren@blackberry.com>
+
+        remove build warning(unused parameter)
+        https://bugs.webkit.org/show_bug.cgi?id=114670
+
+        Reviewed by Rob Buis.
+
+        remove warning in Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp
+
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC::DefaultGCActivityCallback::didAllocate):
+
+2013-04-18  Jonathan Liu  <net147@gmail.com>
+
+        Implement JIT for MinGW-w64 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=114580
+
+        Reviewed by Jocelyn Turcotte.
+
+        * jit/JITStubs.cpp:
+        (JSC):
+
+2013-04-17  Mark Lam  <mark.lam@apple.com>
+
+        Avoid using a branch range that is too far for some CPU architectures.
+        https://bugs.webkit.org/show_bug.cgi?id=114782.
+
+        Reviewed by David Kilzer.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-04-17  Julien Brianceau  <jbrianceau@nds.com>
+
+        Fix SH4 build (broken since r148639).
+        https://bugs.webkit.org/show_bug.cgi?id=114773.
+
+        Allow longer displacements for specific branches in SH4 LLINT.
+
+        Reviewed by Oliver Hunt.
+
+        * offlineasm/sh4.rb:
+
+2013-04-14  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. More Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-14  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-17  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken build. Replaced a static const with a #define.
+        https://bugs.webkit.org/show_bug.cgi?id=114577.
+
+        Unreviewed.
+
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::Watchdog):
+        (JSC::Watchdog::isEnabled):
+
+2013-04-17  Mark Lam  <mark.lam@apple.com>
+
+        Add LLINT and baseline JIT support for timing out scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=114577.
+
+        Reviewed by Geoffrey Garen.
+
+        Introduces the new Watchdog class which is used to track script
+        execution time, and initiate script termination if needed.
+
+        * API/JSContextRef.cpp:
+        (internalScriptTimeoutCallback):
+        (JSContextGroupSetExecutionTimeLimit):
+        (JSContextGroupClearExecutionTimeLimit):
+        * API/JSContextRefPrivate.h:
+        - Added new script execution time limit APIs.
+        * API/tests/testapi.c:
+        (currentCPUTime):
+        (shouldTerminateCallback):
+        (cancelTerminateCallback):
+        (extendTerminateCallback):
+        (main):
+        - Added new API tests for script execution time limit.
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoopHint):
+        - loop hints are needed for the llint as well. Hence, it will be
+          emitted unconditionally.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        - Added checks for script termination before entering script code.
+        * jit/JIT.cpp:
+        (JSC::JIT::emitWatchdogTimerCheck):
+        * jit/JIT.h:
+        (JSC::JIT::emit_op_loop_hint):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION(void, handle_watchdog_timer)):
+        * jit/JITStubs.h:
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::doThrow):
+        - Factored out some common code from returnToThrow() and callToThrow().
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL(slow_path_handle_watchdog_timer)):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwTerminatedExecutionException):
+        - Also removed the now unused InterruptedExecutionException.
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        - Added watchdog, and removed the now obsolete Terminator.
+        * runtime/Terminator.h: Removed.
+        * runtime/Watchdog.cpp: Added.
+        (JSC::Watchdog::Watchdog):
+        (JSC::Watchdog::~Watchdog):
+        (JSC::Watchdog::setTimeLimit):
+        (JSC::Watchdog::didFire):
+        (JSC::Watchdog::isEnabled):
+        (JSC::Watchdog::fire):
+        (JSC::Watchdog::arm):
+        (JSC::Watchdog::disarm):
+        (JSC::Watchdog::startCountdownIfNeeded):
+        (JSC::Watchdog::startCountdown):
+        (JSC::Watchdog::stopCountdown):
+        (JSC::Watchdog::Scope::Scope):
+        (JSC::Watchdog::Scope::~Scope):
+        * runtime/Watchdog.h: Added.
+        (Watchdog):
+        (JSC::Watchdog::didFire):
+        (JSC::Watchdog::timerDidFireAddress):
+        (JSC::Watchdog::isArmed):
+        (Watchdog::Scope):
+        * runtime/WatchdogMac.cpp: Added.
+        (JSC::Watchdog::initTimer):
+        (JSC::Watchdog::destroyTimer):
+        (JSC::Watchdog::startTimer):
+        (JSC::Watchdog::stopTimer):
+        * runtime/WatchdogNone.cpp: Added.
+        (JSC::Watchdog::initTimer):
+        (JSC::Watchdog::destroyTimer):
+        (JSC::Watchdog::startTimer):
+        (JSC::Watchdog::stopTimer):
+
+2013-04-14  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. VS2010 Windows build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
+
+2013-04-14  Roger Fong  <roger_fong@apple.com>
+
+        Copy make-file-export-generator script to the the Source folders of the projects that use it.
+        <rdar://problem/13675604>
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/make-export-file-generator: Copied from Source/WebCore/make-export-file-generator.
+
+2013-04-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows, WinCairo] Stop individually building WTF files in JSC.
+        https://bugs.webkit.org/show_bug.cgi?id=114705
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        Export additional String/fastMalloc symbols needed by JSC program.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Don't manually build
+        WTF implementation files (a second time!) in this project.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        Export additional String/fastMalloc symbols needed by JSC program.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Don't manually
+        build WTF implementation files (a second time!) in this project.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters: Ditto.
+
+2013-04-17  Mark Lam  <mark.lam@apple.com>
+
+        releaseExecutableMemory() should canonicalize cell liveness data before
+        it scans the GC roots.
+        https://bugs.webkit.org/show_bug.cgi?id=114733.
+
+        Reviewed by Mark Hahnenberg.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::canonicalizeCellLivenessData):
+        * heap/Heap.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::releaseExecutableMemory):
+
+2013-04-16  Commit Queue  <rniwa@webkit.org>
+
+        Unreviewed, rolling out r148576.
+        http://trac.webkit.org/changeset/148576
+        https://bugs.webkit.org/show_bug.cgi?id=114714
+
+        WebCore is building some of these same files (Requested by
+        bfulgham on #webkit).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters:
+
+2013-04-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows, WinCairo] Stop individually building WTF files in JSC.
+        https://bugs.webkit.org/show_bug.cgi?id=114705
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        Export additional String/fastMalloc symbols needed by JSC program.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Don't manually build
+        WTF implementation files (a second time!) in this project.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        Export additional String/fastMalloc symbols needed by JSC program.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Don't manually
+        build WTF implementation files (a second time!) in this project.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters: Ditto.
+
+2013-04-16  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Do not use JAVASCRIPTCORE_DIR in add_custom_command() of JavaScriptCore project
+        https://bugs.webkit.org/show_bug.cgi?id=114265
+
+        Reviewed by Brent Fulgham.
+
+        Use CMAKE_CURRENT_SOURCE_DIR instead, since it provides the same value and is more
+        understandable. Also move the GENERATE_HASH_LUT macro into the CMakeLists.txt
+        of JavaScriptCore to avoid the usage of JAVASCRIPTCORE_DIR there too.
+
+        * CMakeLists.txt:
+
+2013-04-16  Anders Carlsson  <andersca@apple.com>
+
+        Another Windows build fix attempt.
+
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2013-04-16  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * runtime/JSGlobalData.h:
+
+2013-04-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows] Unreviewed VS2010 build correction.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
+        Specify proper link library to avoid mixture of ICU 4.0 and 4.6
+        symbols during link.
+
+2013-04-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Windows clean build fix after r148479.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-15  Anders Carlsson  <andersca@apple.com>
+
+        ScriptWrappable subclasses shouldn't have to include WeakInlines.h
+        https://bugs.webkit.org/show_bug.cgi?id=114641
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move back the Weak constructor, destructor and clear() to Weak.h. Add a new weakClearSlowCase function
+        and put it in Weak.cpp.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/Weak.cpp: Added.
+        * heap/Weak.h:
+        * heap/WeakInlines.h:
+        * heap/WeakSetInlines.h:
+
+2013-04-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        HeapTimer lifetime should be less complicated
+        https://bugs.webkit.org/show_bug.cgi?id=114529
+
+        Reviewed by Oliver Hunt.
+
+        Right now our HeapTimer lifetime is rather complicated. HeapTimers are "owned" by the JSGlobalData, 
+        but there's an issue in that there can be races between a thread that is trying to tear down a JSGlobalData 
+        and the HeapTimer's fire function. Our current code for tearing down HeapTimers is an intricate and delicate 
+        dance which probably contains subtle bugs.
+
+        We can make our lives easier by changing things around a bit. 
+
+        1) We should free the API lock from being solely owned by the JSGlobalData so we don't have to worry about 
+           grabbing the lock out of invalid memory when our HeapTimer callback fires. 
+
+        2) We should also make it so that we deref the JSGlobalData first, then unlock the API lock so that when we 
+           have the lock, the JSGlobalData is in one of two states: fully valid or completely destroyed, and we know exactly which one. 
+
+        3) The JSLock can tell us this information by keeping a back pointer to the JSGlobalData. When the JSGlobalData's 
+           destructor is called, it clears this pointer in the JSLock. Other clients of the API lock can then check 
+           this pointer to determine whether or not the JSGlobalData is still around.
+
+        4) The CFRunLoopTimer will use the API lock as its context rather than the HeapTimer itself. The only way 
+           the HeapTimer's callback can get to the HeapTimer is through the API lock's JSGlobalData pointer.
+
+        5) The CFRunLoopTimerContext struct has two fields for retain and release callbacks for the context's info field. 
+           We'll provide these callbacks to ref() and deref() the JSLock as necessary. Thus, the timer becomes the other 
+           owner of the JSLock apart from the JSGlobalData.
+
+        * API/APIShims.h: Remove the cruft that was required by the previous design, such as RefGlobalDataTag.
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APIEntryShim::~APIEntryShim): Protect the API lock with a RefPtr, deref the JSGlobalData, which could destroy it,
+        then unlock the API lock. This ordering prevents others from obtaining the API lock while the JSGlobalData is in the 
+        middle of being torn down.
+        (JSC::APIEntryShim::init): We now take the lock, then ref the JSGlobalData, which is the opposite order of when we 
+        tear down the shim.
+        * heap/Heap.cpp:
+        (JSC::Heap::setActivityCallback): Use PassOwnPtr now.
+        (JSC::Heap::activityCallback): Ditto.
+        (JSC::Heap::sweeper): Ditto.
+        (JSC):
+        * heap/Heap.h:
+        (Heap):
+        * heap/HeapTimer.cpp:
+        (JSC::retainAPILock): Retain callback for CFRunLoopTimerContext struct.
+        (JSC::releaseAPILock): Release callback for the CFRunLoopTimerContext struct.
+        (JSC::HeapTimer::HeapTimer): Use the API lock as the context's info field rather than the HeapTimer.
+        (JSC::HeapTimer::timerDidFire): Grab the API lock. Return early if the JSGlobalData has already been destroyed.
+        Otherwise, figure out which kind of HeapTimer we are based on the CFRunLoopTimerRef passed to the callback and 
+        call the HeapTimer's callback.
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::create): PassOwnPtr all the things.
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * jsc.cpp:
+        (jscmain): We use an APIEntryShim instead of a RefPtr for the JSGlobalData because we need to 
+        tear down the JSGlobalData while we still hold the lock, which the APIEntryShim handles correctly.
+        * runtime/GCActivityCallback.h:
+        (DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData): Notify the API lock that the JSGlobalData is being torn down.
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::apiLock):
+        * runtime/JSLock.cpp:
+        (JSC::JSLockHolder::JSLockHolder): Ref, then lock (just like the API shim).
+        (JSC):
+        (JSC::JSLock::willDestroyGlobalData):
+        (JSC::JSLockHolder::init):
+        (JSC::JSLockHolder::~JSLockHolder): Protect, deref, then unlock (just like the API shim).
+        (JSC::JSLock::JSLock):
+        * runtime/JSLock.h: Add back pointer to the JSGlobalData and a callback for when the JSGlobalData is being
+        torn down that clears this pointer to notify other clients (i.e. timer callbacks) that the JSGlobalData is no
+        longer valid.
+        (JSLockHolder):
+        (JSLock):
+        (JSC::JSLock::globalData):
+        * testRegExp.cpp:
+        (realMain): We use an APIEntryShim instead of a RefPtr for the JSGlobalData because we need to 
+        tear down the JSGlobalData while we still hold the lock, which the APIEntryShim handles correctly.
+
+2013-04-15  Julien Brianceau  <jbrianceau@nds.com>
+
+        LLInt SH4 backend implementation
+        https://bugs.webkit.org/show_bug.cgi?id=112886
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        * jit/JITStubs.cpp:
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * offlineasm/arm.rb:
+        * offlineasm/ast.rb:
+        * offlineasm/backends.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/mips.rb:
+        * offlineasm/risc.rb:
+        * offlineasm/sh4.rb: Added.
+
+2013-04-15  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add WTF_USE_*_UNICODE variables
+        https://bugs.webkit.org/show_bug.cgi?id=114556
+
+        Reviewed by Brent Fulgham.
+
+        WTF_USE_ICU_UNICODE and WTF_USE_WCHAR_UNICODE are used to
+        reduce duplication in the platform specific CMake files.
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake:
+
+2013-04-13  Patrick Gansterer  <paroga@webkit.org>
+
+        Add missing export macro to SymbolTableEntry::freeFatEntrySlow()
+
+        * runtime/SymbolTable.h:
+        (SymbolTableEntry):
+
+2013-04-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Block freeing thread should call Region::destroy instead of delete
+        https://bugs.webkit.org/show_bug.cgi?id=114544
+
+        Reviewed by Oliver Hunt.
+
+        Since Region doesn't have a virtual destructor, calling delete will not properly clean up all of 
+        the state of the Region. We should call destroy() instead.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::releaseFreeRegions):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+
+2013-04-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        Merge CharacterClassTable into CharacterClass
+        https://bugs.webkit.org/show_bug.cgi?id=114409
+
+        Reviewed by Darin Adler.
+
+        CharacterClassTable is only a pointer and a boolean.
+        It is a little overkill to make a separate allocation
+        for that.
+
+        * create_regex_tables:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        * yarr/YarrPattern.h:
+        (CharacterClass):
+        (JSC::Yarr::CharacterClass::CharacterClass):
+
+2013-04-11  Michael Saboff  <msaboff@apple.com>
+
+        Added UNLIKELY() suggested in https://bugs.webkit.org/show_bug.cgi?id=114366
+        after checking in the original change. 
+
+        Rubber-stamped by Jessie Berlin.
+
+        * dfg/DFGOperations.cpp:
+
+2013-04-10  Benjamin Poulain  <benjamin@webkit.org>
+
+        Unify JSC Parser's error and error message
+        https://bugs.webkit.org/show_bug.cgi?id=114363
+
+        Reviewed by Geoffrey Garen.
+
+        The parser kept the error state over two attributes:
+        error and errorMessage. They were changed in sync,
+        but had some discrepancy (for example, the error message
+        was always defined to something).
+
+        This patch unifies the two. There is an error if
+        if the error message is non-null or if the parsing finished
+        before the end.
+
+        This also gets rid of the allocation of the error message
+        when instantiating a parser.
+
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseInner):
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseForStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parsePrimaryExpression):
+        * parser/Parser.h:
+        (JSC::Parser::updateErrorMessage):
+        (JSC::Parser::updateErrorWithNameAndMessage):
+        (JSC::Parser::hasError):
+        (Parser):
+
+2013-04-10  Oliver Hunt  <oliver@apple.com>
+
+        Set trap is not being called for API objects
+        https://bugs.webkit.org/show_bug.cgi?id=114403
+
+        Reviewed by Anders Carlsson.
+
+        Intercept putByIndex on the callback object and add tests
+        to make sure we don't regress in future.
+
+        * API/JSCallbackObject.h:
+        (JSCallbackObject):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::putByIndex):
+        (JSC):
+        * API/tests/testapi.c:
+        (PropertyCatchalls_setProperty):
+        * API/tests/testapi.js:
+
+2013-04-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        Mass remove all the empty directories
+
+        Rubberstamped by Ryosuke Niwa.
+
+        * qt/api: Removed.
+        * qt/benchmarks/qscriptengine: Removed.
+        * qt/benchmarks/qscriptvalue: Removed.
+        * qt/tests/qscriptengine: Removed.
+        * qt/tests/qscriptstring: Removed.
+        * qt/tests/qscriptvalue: Removed.
+        * qt/tests/qscriptvalueiterator: Removed.
+
+2013-04-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=114235
+
+        Reviewed by Filip Pizlo.
+
+        If the object doesn't have any properties but the prototype does, we'll assume those prototype properties are 
+        accessible in the base object's backing store, which is bad.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::setNumCacheableSlotsForObject):
+        (JSC::PropertyNameArray::setBaseObject):
+        (PropertyNameArray):
+
+2013-04-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove code duplicates from MacroAssemblerARM
+        https://bugs.webkit.org/show_bug.cgi?id=104457
+
+        Reviewed by Oliver Hunt.
+
+        Reuse some existing methods to avoid duplicated code.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::store8):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::swap):
+        (JSC::MacroAssemblerARM::add32):
+        (JSC::MacroAssemblerARM::sub32):
+
+2013-04-10  Michael Saboff  <msaboff@apple.com>
+
+        DFG: Negative size for new Array() interpreted as large unsigned int
+        https://bugs.webkit.org/show_bug.cgi?id=114366
+
+        Reviewed by Oliver Hunt.
+
+        Added new check in operationNewArrayWithSize() for a negative
+        size.  If size is negative throw a "RangeError: Array size is not a
+        small enough positive integer" exception.
+
+        * dfg/DFGOperations.cpp:
+
+2013-04-10  peavo@outlook.com  <peavo@outlook.com>
+
+        WinCairo build fails to link.
+        https://bugs.webkit.org/show_bug.cgi?id=114358
+
+        Reviewed by Brent Fulgham.
+
+        Export the symbol WTF::MD5::checksum().
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-08  Anders Carlsson  <andersca@apple.com>
+
+        Remove unneeded headers from FrameLoader.h
+        https://bugs.webkit.org/show_bug.cgi?id=114223
+
+        Reviewed by Geoffrey Garen.
+
+        Update for WTF changes.
+
+        * bytecode/SpeculatedType.h:
+        * runtime/JSCJSValue.h:
+
+2013-04-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed bitrotted TimeoutChecker code
+        https://bugs.webkit.org/show_bug.cgi?id=114336
+
+        Reviewed by Alexey Proskuryakov.
+
+        This mechanism hasn't worked for a while.
+
+        MarkL is working on a new version of this feature with a distinct
+        implementation.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShim::~APIEntryShim):
+        (JSC::APIEntryShim::init):
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGGPRInfo.h:
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Walker::walk):
+        * runtime/TimeoutChecker.cpp: Removed.
+        * runtime/TimeoutChecker.h: Removed.
+
+2013-04-10  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION (r148073): WebKit Nightly r148082 crashes on launch in JSObjectSetPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=114341
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make JSObjectSetPrivate use uncheckedToJS as some clients
+        clear their private data during finalization for some reason.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrivate):
+
+2013-04-09  Oliver Hunt  <oliver@apple.com>
+
+        Add liveness tests to JSC API entry points
+        https://bugs.webkit.org/show_bug.cgi?id=114318
+
+        Reviewed by Geoffrey Garen.
+
+        Add simple checks for the existence of a method table on any
+        JSCells passed across the API.  This in turn forces a structure
+        validity test.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+        (unsafeToJS):
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrivate):
+
+2013-04-09  Oliver Hunt  <oliver@apple.com>
+
+        Rollout last patch as it destroyed everything
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+
+2013-04-09  Oliver Hunt  <oliver@apple.com>
+
+        Add liveness tests to JSC API entry points
+        https://bugs.webkit.org/show_bug.cgi?id=114318
+
+        Reviewed by Filip Pizlo.
+
+        Add simple checks for the existence of a method table on any
+        JSCells passed across the API.  This in turn forces a structure
+        validity test.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+
+2013-04-09  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        LLInt conditional branch compilation fault on MIPS.
+        https://bugs.webkit.org/show_bug.cgi?id=114264
+
+        Reviewed by Filip Pizlo.
+
+        Fix conditional branch compilation in LLInt offlineasm.
+
+        * offlineasm/mips.rb:
+
+2013-04-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=114235
+
+        Reviewed by Geoffrey Garen.
+
+        Due to the way that numCacheableSlots is currently calculated, checking an object's prototype for enumerable 
+        properties causes us not to cache any properties at all. We should only cache properties on the object itself
+        since we currently don't take advantage of any sort of name caching for properties in the prototype chain.
+        This fix undoes a ~2% SunSpider regression caused by http://trac.webkit.org/changeset/147570.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+
+2013-04-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove yarr.gyp
+        https://bugs.webkit.org/show_bug.cgi?id=114247
+
+        Reviewed by Benjamin Poulain.
+
+        * yarr/yarr.gyp: Removed.
+
+2013-04-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove JavaScriptCore.gyp/gypi
+        https://bugs.webkit.org/show_bug.cgi?id=114238
+
+        Reviewed by Benjamin Poulain.
+
+        * JavaScriptCore.gyp: Removed.
+        * JavaScriptCore.gyp/.gitignore: Removed.
+        * JavaScriptCore.gypi: Removed.
+
+2013-04-08  Vahag Vardanyan  <vaag@ispras.ru>
+
+        Adds fromCharCode intrinsic support.
+        https://bugs.webkit.org/show_bug.cgi?id=104807
+
+        Reviewed by Oliver Hunt.
+
+        Switch to using fromCharCode intrinsic instead of call operation in some cases.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileFromCharCode):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC):
+        * runtime/StringConstructor.h:
+        (JSC):
+
+2013-04-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove HTML Notification
+        https://bugs.webkit.org/show_bug.cgi?id=114231
+
+        Reviewed by Ryosuke Niwa.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-04-05  Roger Fong  <roger_fong@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to inline string equality comparisons
+        https://bugs.webkit.org/show_bug.cgi?id=114224
+
+        Reviewed by Oliver Hunt.
+        
+        Inline 8-bit string equality, go to slow path for 16-bit strings. 2x speed-up for string equality
+        comparisons on 8-bit strings. 20-50% speed-up on JSRegress/HashMap tests. 30% speed-up on
+        string-fasta. 2% speed-up on SunSpider overall. Some small speed-ups elsewhere.
+
+        This is a gnarly change but we have loads of test coverage already between the HashMap tests and
+        preexisting DFG string equality tests (which appear to have been designed to test OSR exits, but
+        also give us good overall coverage on string equality behavior).
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileStringEquality):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2013-04-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Stop #include-ing all of JavaScriptCore in every DOM-related file
+        https://bugs.webkit.org/show_bug.cgi?id=114220
+
+        Reviewed by Sam Weinig.
+
+        I separated WeakInlines.h from Weak.h so WebCore data types that need
+        to declare a Weak<T> data member don't have to #include all of the
+        infrastructure for accessing that data member.
+
+        This also required separating Weak<T> from PassWeak<T> by removing the
+        WeakImplAccessor class template and pushing code down into its subclasses.
+
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/UnlinkedCodeBlock.h:
+        * heap/PassWeak.h:
+        (JSC):
+        (PassWeak):
+        (JSC::::PassWeak):
+        (JSC::::operator):
+        (JSC::::get):
+        * heap/SlotVisitorInlines.h:
+        * heap/Weak.h:
+        (JSC):
+        (Weak):
+        * heap/WeakInlines.h: Copied from Source/JavaScriptCore/heap/Weak.h.
+        (JSC):
+        (JSC::::Weak):
+        (JSC::::operator):
+        (JSC::::get):
+        (JSC::::was):
+        (JSC::weakClear):
+        * jit/JITThunks.h:
+        * runtime/RegExpCache.h:
+        * runtime/Structure.h:
+        * runtime/WeakGCMap.h:
+
+2013-04-05  Roger Fong  <roger_fong@apple.com>
+
+        Windows build fix fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-04-05  Roger Fong  <roger_fong@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-08  Oliver Hunt  <oliver@apple.com>
+
+        Make resolve more robust in the face of lookup misses
+        https://bugs.webkit.org/show_bug.cgi?id=114211
+
+        Reviewed by Filip Pizlo.
+
+        This simply short circuits the resolve operations in the
+        event that we don't find a path to a property.  There's no
+        repro case for this happening unfortunately.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2013-04-08  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+
+2013-04-08  Justin Haygood  <jhaygood@reaktix.com>
+
+        Allow KeywordLookupGenerator.py to work on Windows with Windows style line endings
+        https://bugs.webkit.org/show_bug.cgi?id=63234
+
+        Reviewed by Oliver Hunt.
+
+        * KeywordLookupGenerator.py:
+        (parseKeywords):
+
+2013-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r146669): Assertion hit in JSC::DFG::SpeculativeJIT::fillSpeculateCell() running webgl tests
+        https://bugs.webkit.org/show_bug.cgi?id=114129
+        <rdar://problem/13594898>
+
+        Reviewed by Darin Adler.
+        
+        The check to see if we need a cell check when simplifying a GetById or PutById needs to be hoisted to
+        above where we abstractly execute the instruction, since after we abstracting execute it, it will
+        seem like it no longer needs the cell check.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2013-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Add bounds checking for WTF::Vector::operator[]
+        https://bugs.webkit.org/show_bug.cgi?id=89600
+
+        Reviewed by Filip Pizlo.
+
+        Make a few JSC classes opt-out of release mode bounds checking.
+
+        * assembler/AssemblerBuffer.h:
+        (AssemblerBuffer):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (AssemblerBufferWithConstantPool):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC):
+        (JSC::replaceExistingEntries):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
+        (JSC::CodeBlock::callReturnIndexVector):
+        (JSC::CodeBlock::codeOrigins):
+        (RareData):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedEvalCodeBlock::adoptVariables):
+        (UnlinkedEvalCodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (CallArguments):
+        (JSC::BytecodeGenerator::instructions):
+        (BytecodeGenerator):
+        * bytecompiler/StaticPropertyAnalysis.h:
+        (JSC::StaticPropertyAnalysis::create):
+        (JSC::StaticPropertyAnalysis::StaticPropertyAnalysis):
+        (StaticPropertyAnalysis):
+        * bytecompiler/StaticPropertyAnalyzer.h:
+        (StaticPropertyAnalyzer):
+        (JSC::StaticPropertyAnalyzer::StaticPropertyAnalyzer):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        * runtime/ArgList.h:
+        (MarkedArgumentBuffer):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+
+2013-04-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        Use Vector::reserveInitialCapacity() when possible in JavaScriptCore runtime
+        https://bugs.webkit.org/show_bug.cgi?id=114111
+
+        Reviewed by Andreas Kling.
+
+        Almost all the code was already using Vector::reserveInitialCapacity()
+        and Vector::uncheckedAppend(). Fix the remaining parts.
+
+        * runtime/ArgList.h:
+        (MarkedArgumentBuffer): The type VectorType is unused.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        Move the variable closer to where it is needed.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWithArrayStorage):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyNames):
+
+2013-04-07  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove references to Skia and V8 from CMake files
+        https://bugs.webkit.org/show_bug.cgi?id=114130
+
+        Reviewed by Geoffrey Garen.
+
+        * shell/PlatformBlackBerry.cmake:
+
+2013-04-07  David Kilzer  <ddkilzer@apple.com>
+
+        Remove the rest of SVG_DOM_OBJC_BINDINGS
+        <http://webkit.org/b/114112>
+
+        Reviewed by Geoffrey Garen.
+
+        * Configurations/FeatureDefines.xcconfig:
+        - Remove ENABLE_SVG_DOM_OBJC_BINDINGS macro.
+
+2013-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Inspector should display information about non-object exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=114123
+
+        Reviewed by Adele Peterson.
+
+        Make sure we store the right stack information, even when throwing
+        a primitive.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearSupplementaryExceptionInfo):
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC::Interpreter::throwException):
+
+2013-04-06  Oliver Hunt  <oliver@apple.com>
+
+        Unify the many and varied stack trace mechanisms, and make the result sane.
+        https://bugs.webkit.org/show_bug.cgi?id=114072
+
+        Reviewed by Filip Pizlo.
+
+        Makes JSC::StackFrame record the bytecode offset and other necessary data
+        rather than requiring us to perform eager evaluation of the line number, etc.
+        Then remove most of the users of retrieveLastCaller, as most of them were
+        using it to create a stack trace in a fairly incomplete and inefficient way.
+
+        StackFrame now also has a couple of helpers to get the line and column info.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getBytecodeOffsetForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::StackFrame::line):
+        (JSC::StackFrame::column):
+        (JSC::StackFrame::expressionInfo):
+        (JSC::StackFrame::toString):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        * interpreter/Interpreter.h:
+        (StackFrame):
+        (Interpreter):
+        * runtime/Error.cpp:
+        (JSC::throwError):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+
+2013-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed v8 bindings hooks from IDL files
+        https://bugs.webkit.org/show_bug.cgi?id=114091
+
+        Reviewed by Anders Carlsson and Sam Weinig.
+
+        * heap/HeapStatistics.h:
+
+2013-04-03  Roger Fong  <roger_fong@apple.com>
+
+        Windows VS2010 build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-06  Zan Dobersek  <zdobersek@igalia.com>
+
+        Remove the remaining PLATFORM(CHROMIUM) guard in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=114082
+
+        Reviewed by Ryosuke Niwa.
+
+        * runtime/JSExportMacros.h: Remove the remaining PLATFORM(CHROMIUM) guard.
+
+2013-04-06  Ed Bartosh  <bartosh@gmail.com>
+
+        --minimal build fails with error: control reaches end of non-void function
+        https://bugs.webkit.org/show_bug.cgi?id=114085
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.cpp: return 0 if JIT is not enabled
+        (JSC::getBytecodeOffsetForCallFrame):
+
+2013-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        Added back a symbol that is exported.
+
+2013-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        Removed symbols that aren't exported.
+
+2013-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out 147820 and 147818 because they caused plugins tests to ASSERT
+        https://bugs.webkit.org/show_bug.cgi?id=114094
+
+        Reviewed by Anders Carlsson.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        * interpreter/Interpreter.h:
+        (StackFrame):
+        (JSC::StackFrame::toString):
+        (JSC::StackFrame::friendlyLineNumber):
+        (Interpreter):
+        * runtime/Error.cpp:
+        (JSC::throwError):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+
+2013-04-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix after r146932.
+
+        * profiler/ProfilerDatabase.cpp:
+        (Profiler):
+
+2013-04-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Do not call getenv() on Windows CE where it does not exist.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2013-04-05  Benjamin Poulain  <benjamin@webkit.org>
+
+        Second attempt to fix the Windows bot
+
+        Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Attempt to fix the Windows bot
+
+        Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        r147825 removed the symbol for nullptr_t. Add it back.
+
+2013-04-02  Roger Fong  <roger_fong@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getBytecodeOffsetForCallFrame):
+
+2013-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Unify the many and varied stack trace mechanisms, and make the result sane.
+        https://bugs.webkit.org/show_bug.cgi?id=114072
+
+        Reviewed by Filip Pizlo.
+
+        Makes JSC::StackFrame record the bytecode offset and other necessary data
+        rather than requiring us to perform eager evaluation of the line number, etc.
+        Then remove most of the users of retrieveLastCaller, as most of them were
+        using it to create a stack trace in a fairly incomplete and inefficient way.
+
+        StackFrame now also has a couple of helpers to get the line and column info.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getBytecodeOffsetForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::StackFrame::line):
+        (JSC::StackFrame::column):
+        (JSC::StackFrame::expressionInfo):
+        (JSC::StackFrame::toString):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+        * interpreter/Interpreter.h:
+        (StackFrame):
+        (Interpreter):
+        * runtime/Error.cpp:
+        (JSC::throwError):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+
+2013-04-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        tryCacheGetByID sets StructureStubInfo accessType to an incorrect value
+        https://bugs.webkit.org/show_bug.cgi?id=114068
+
+        Reviewed by Geoffrey Garen.
+
+        In the case where we have a non-Value cacheable property, we set the StructureStubInfo accessType to 
+        get_by_id_self, but then we don't patch self and instead patch in a get_by_id_self_fail. This leads to 
+        incorrect profiling data so when the DFG compiles the function, it uses a GetByOffset rather than a GetById, 
+        which leads to loading a GetterSetter directly out of an object.
+
+        * jit/JITStubs.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2013-04-05  Filip Pizlo  <fpizlo@apple.com>
+
+        If CallFrame::trueCallFrame() knows that it's about to read garbage instead of a valid CodeOrigin/InlineCallFrame, then it should give up and return 0 and all callers should be robust against this
+        https://bugs.webkit.org/show_bug.cgi?id=114062
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::canGetCodeOrigin):
+        (CodeBlock):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::getStackTrace):
+
+2013-04-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Made USE(JSC) unconditional
+        https://bugs.webkit.org/show_bug.cgi?id=114058
+
+        Reviewed by Anders Carlsson.
+
+        * config.h:
+
+2013-04-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, rolling out http://trac.webkit.org/changeset/147729
+
+        It's causing a bunch of breakage on some more strict compilers:
+        <inline asm>:1267:2: error: ambiguous instructions require an explicit suffix (could be 'ficomps', or 'ficompl')
+
+        * offlineasm/x86.rb:
+
+2013-04-05  Roger Fong  <roger_fong@apple.com>
+
+        More VS2010 solution makefile fixes.
+        <rdar://problem/13588964>
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+
+2013-04-05  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        LLint should be able to use x87 instead of SSE for floating pointer
+
+        https://bugs.webkit.org/show_bug.cgi?id=112239
+
+        Reviewed by Filip Pizlo.
+
+        Implements LLInt floating point operations in x87, to ensure we support
+        x86 without SSE2.
+
+        X86 (except 64bit) now defaults to using x87 instructions in order to
+        support all 32bit x86 back to i686. The implementation uses the fucomi
+        instruction from i686 which sets the new minimum.
+
+        * offlineasm/x86.rb:
+
+2013-04-04  Christophe Dumez  <ch.dumez@sisa.samsung.com>
+
+        Unreviewed EFL build fix.
+
+        We had undefined reference to `JSC::CodeOrigin::maximumBytecodeIndex'.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::findClosureCallForReturnPC):
+        (JSC::CodeBlock::bytecodeOffset):
+
+2013-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Stop pretending that statements return a value
+        https://bugs.webkit.org/show_bug.cgi?id=113969
+
+        Reviewed by Oliver Hunt.
+
+        Expressions have an intrinsic value, which they return to their parent
+        in the AST.
+
+        Statements just execute for effect in sequence.
+
+        This patch moves emitBytecode into the ExpressionNode and StatementNode
+        subclasses, and changes the SatementNode subclass to return void. This
+        eliminates some cruft where we used to return 0, or try to save a bogus
+        register and return it, as if a statement had a consuming parent in the
+        AST.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::BlockNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::CaseClauseNode::emitBytecode):
+        (JSC::CaseBlockNode::emitBytecodeForBlock):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ScopeNode::emitStatementsBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::FuncDeclNode::emitBytecode):
+        * parser/NodeConstructors.h:
+        (JSC::PropertyListNode::PropertyListNode):
+        (JSC::ArgumentListNode::ArgumentListNode):
+        * parser/Nodes.h:
+        (Node):
+        (ExpressionNode):
+        (StatementNode):
+        (ConstStatementNode):
+        (BlockNode):
+        (EmptyStatementNode):
+        (DebuggerStatementNode):
+        (ExprStatementNode):
+        (VarStatementNode):
+        (IfNode):
+        (IfElseNode):
+        (DoWhileNode):
+        (WhileNode):
+        (ForNode):
+        (ForInNode):
+        (ContinueNode):
+        (BreakNode):
+        (ReturnNode):
+        (WithNode):
+        (LabelNode):
+        (ThrowNode):
+        (TryNode):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        (FuncDeclNode):
+        (CaseBlockNode):
+        (SwitchNode):
+
+2013-04-04  Oliver Hunt  <oliver@apple.com>
+
+        Exception stack unwinding doesn't handle inline callframes correctly
+        https://bugs.webkit.org/show_bug.cgi?id=113952
+
+        Reviewed by Geoffrey Garen.
+
+        The basic problem here is that the exception stack unwinding was
+        attempting to be "clever" and avoid doing a correct stack walk
+        as it "knew" inline callframes couldn't have exception handlers.
+
+        This used to be safe as the exception handling machinery was
+        designed to fail gently and just claim that no handler existed.
+        This was "safe" and even "correct" inasmuch as we currently
+        don't run any code with exception handlers through the dfg.
+
+        This patch fixes the logic by simply making everything uniformly
+        use the safe stack walking machinery, and making the correct
+        boundary checks occur everywhere that they should.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::findClosureCallForReturnPC):
+        (JSC::CodeBlock::bytecodeOffset):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::retrieveCallerFromVMCode):
+
+2013-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed a defunct comment
+        https://bugs.webkit.org/show_bug.cgi?id=113948
+
+        Reviewed by Oliver Hunt.
+
+        This is also a convenient way to test the EWS.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC):
+
+2013-04-04  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Remove the gyp build
+        https://bugs.webkit.org/show_bug.cgi?id=113942
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Removed.
+        * JavaScriptCore.gyp/redirect-stdout.sh: Removed.
+
+2013-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Simplified bytecode generation by merging prefix and postfix nodes
+        https://bugs.webkit.org/show_bug.cgi?id=113925
+
+        Reviewed by Filip Pizlo.
+
+        PostfixNode now inherits from PrefixNode, so when we detect that we're
+        in a context where postifx and prefix are equivalent, PostFixNode can
+        just call through to PrefixNode codegen, instead of duplicating the
+        logic.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+        * parser/NodeConstructors.h:
+        (JSC::PostfixNode::PostfixNode):
+        * parser/Nodes.h:
+        (JSC):
+        (PrefixNode):
+        (PostfixNode):
+
+2013-04-04  Andras Becsi  <andras.becsi@digia.com>
+
+        Fix the build with GCC 4.8
+        https://bugs.webkit.org/show_bug.cgi?id=113147
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        Initialize JSObject* exception to suppress warnings that make
+        the build fail because of -Werror=maybe-uninitialized.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+
+2013-04-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        get_by_pname can become confused when iterating over objects with static properties
+        https://bugs.webkit.org/show_bug.cgi?id=113831
+
+        Reviewed by Geoffrey Garen.
+
+        get_by_pname doesn't take static properties into account when using a JSPropertyNameIterator to directly 
+        access an object's backing store. One way to fix this is to not cache any properties when iterating over 
+        objects with static properties. This patch fixes the bug that was originally reported on swisscom.ch.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::numCacheableSlots):
+        (JSC::PropertyNameArray::setNumCacheableSlots):
+        (PropertyNameArray):
+
+2013-04-02  Geoffrey Garen  <ggaren@apple.com>
+
+        DFG should compile a little sooner
+        https://bugs.webkit.org/show_bug.cgi?id=113835
+
+        Unreviewed.
+
+        Rolled out r147511 because it was based on incorrect performance
+        measurement.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::optimizationThresholdScalingFactor):
+
+2013-04-02  Geoffrey Garen  <ggaren@apple.com>
+
+        DFG should compile a little sooner
+        https://bugs.webkit.org/show_bug.cgi?id=113835
+
+        Reviewed by Michael Saboff.
+
+        2% speedup on SunSpider.
+
+        2% speedup on JSRegress.
+
+        Neutral on Octane, v8, and Kraken.
+
+        The worst-hit single sub-test is kraken-stanford-crypto-ccm.js, which gets
+        18% slower. Since Kraken is neutral overall in its preferred mean, I
+        think that's OK for now.
+
+        (Our array indexing speculation fails pathologically on
+        kraken-stanford-crypto-ccm.js. Compiling sooner is a regression because
+        it triggers those failures sooner. I'm going to file some follow-up bugs
+        explaining how to fix our speculations on this sub-test, at which point
+        compiling earlier should become a slight speedup on Kraken overall.)
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::optimizationThresholdScalingFactor): I experimented
+        with a few different options, including reducing the coefficient 'a'.
+        A simple linear reduction on instruction count worked best.
+
+2013-04-01  Benjamin Poulain  <benjamin@webkit.org>
+
+        Use Vector::reserveInitialCapacity and Vector::uncheckedAppend for JSC's APIs
+        https://bugs.webkit.org/show_bug.cgi?id=113651
+
+        Reviewed by Andreas Kling.
+
+        This removes a bunch of branches on initialization and when
+        filling the vector.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::construct):
+        (JSC::::call):
+        * API/JSObjectRef.cpp:
+        (JSObjectCopyPropertyNames):
+
+2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fixing borked VS 2010 project file
+
+        Unreviewed bot greening.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        One more Windows build fix
+
+        Unreviewed.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        More build fallout fixes.
+
+        Unreviewed build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: Add new export symbols.
+        * heap/SuperRegion.cpp: Windows didn't like "LLU". 
+
+2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        r147324 broke the world
+        https://bugs.webkit.org/show_bug.cgi?id=113704
+
+        Unreviewed build fix.
+
+        Remove a bunch of unused variables and use the correctly sized types for 32-bit platforms.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        * heap/BlockAllocator.h:
+        (BlockAllocator):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        * heap/SuperRegion.cpp:
+        (JSC::SuperRegion::SuperRegion):
+        * heap/SuperRegion.h:
+        (SuperRegion):
+
+2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        32-bit Windows build fix
+
+        Unreviewed build fix.
+
+        * heap/SuperRegion.cpp:
+        * heap/SuperRegion.h: Use uint64_t instead of size_t.
+        (SuperRegion):
+
+2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        EFL build fix
+
+        Unreviewed build fix.
+
+        * CMakeLists.txt:
+
+2013-03-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Regions should be allocated from the same contiguous segment of virtual memory
+        https://bugs.webkit.org/show_bug.cgi?id=113662
+
+        Reviewed by Filip Pizlo.
+
+        Instead of letting the OS spread our Regions all over the place, we should allocate them all within 
+        some range of each other. This change will open the door to some other optimizations, e.g. doing simple 
+        range checks for our write barriers and compressing JSCell pointers to 32-bits.
+
+        Added new SuperRegion class that encapsulates allocating Regions from a contiguous reserved chunk of 
+        virtual address space. It functions very similarly to the FixedVMPoolExecutableAllocator class used by the JIT.
+
+        Also added two new subclasses of Region, NormalRegion and ExcessRegion. 
+        
+        NormalRegion is the type of Region that is normally allocated when there is available space remaining 
+        in the SuperRegion. If we ever run out of space in the SuperRegion, we fall back to allocating 
+        ExcessRegions, which are identical to how Regions have behaved up until now, i.e. they contain a 
+        PageAllocationAligned.
+
+        We only use the SuperRegion (and NormalRegions) on 64-bit systems, since it doesn't make sense to reserve the 
+        entire 4 GB address space on 32-bit systems just for the JS heap.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        * heap/BlockAllocator.h:
+        (JSC):
+        (BlockAllocator):
+        (JSC::BlockAllocator::allocate):
+        (JSC::BlockAllocator::allocateCustomSize):
+        (JSC::BlockAllocator::deallocateCustomSize):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC):
+        (JSC::Heap::didExceedFixedHeapSizeLimit):
+        * heap/Heap.h:
+        (Heap):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        * heap/Region.h:
+        (Region):
+        (JSC):
+        (NormalRegion):
+        (JSC::NormalRegion::base):
+        (JSC::NormalRegion::size):
+        (ExcessRegion):
+        (JSC::ExcessRegion::base):
+        (JSC::ExcessRegion::size):
+        (JSC::NormalRegion::NormalRegion):
+        (JSC::NormalRegion::tryCreate):
+        (JSC::NormalRegion::tryCreateCustomSize):
+        (JSC::NormalRegion::reset):
+        (JSC::ExcessRegion::ExcessRegion):
+        (JSC::ExcessRegion::~ExcessRegion):
+        (JSC::ExcessRegion::create):
+        (JSC::ExcessRegion::createCustomSize):
+        (JSC::ExcessRegion::reset):
+        (JSC::Region::Region):
+        (JSC::Region::initializeBlockList):
+        (JSC::Region::create):
+        (JSC::Region::createCustomSize):
+        (JSC::Region::~Region):
+        (JSC::Region::destroy):
+        (JSC::Region::reset):
+        (JSC::Region::deallocate):
+        (JSC::Region::base):
+        (JSC::Region::size):
+        * heap/SuperRegion.cpp: Added.
+        (JSC):
+        (JSC::SuperRegion::SuperRegion):
+        (JSC::SuperRegion::getAlignedBase):
+        (JSC::SuperRegion::allocateNewSpace):
+        (JSC::SuperRegion::notifyNeedPage):
+        (JSC::SuperRegion::notifyPageIsFree):
+        * heap/SuperRegion.h: Added.
+        (JSC):
+        (SuperRegion):
+
+2013-04-01  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove an unused variable from the ARMv7 Assembler
+        https://bugs.webkit.org/show_bug.cgi?id=113653
+
+        Reviewed by Andreas Kling.
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+
+2013-03-31  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] Yarr should build using a separate GYP file from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=113652
+
+        Reviewed by Nico Weber.
+
+        This patch moves JavaScriptCore.gyp to yarr.gyp because Chromium only
+        uses this GYP file to build yarr.
+
+        * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp:
+        * JavaScriptCore.gypi:
+        * yarr/yarr.gyp: Renamed from Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp.
+
+2013-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix a comment. While thinking about TBAA for array accesses,
+        I realized that we have to be super careful about aliasing of typed arrays.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+
+2013-03-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Move Region into its own header
+        https://bugs.webkit.org/show_bug.cgi?id=113617
+
+        Reviewed by Geoffrey Garen.
+
+        BlockAllocator.h is getting a little crowded. We should move the Region class into its own 
+        header, since it's pretty independent from the BlockAllocator.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/BlockAllocator.h:
+        (JSC):
+        * heap/Region.h: Added.
+        (JSC):
+        (DeadBlock):
+        (JSC::DeadBlock::DeadBlock):
+        (Region):
+        (JSC::Region::blockSize):
+        (JSC::Region::isFull):
+        (JSC::Region::isEmpty):
+        (JSC::Region::isCustomSize):
+        (JSC::Region::create):
+        (JSC::Region::createCustomSize):
+        (JSC::Region::Region):
+        (JSC::Region::~Region):
+        (JSC::Region::reset):
+        (JSC::Region::allocate):
+        (JSC::Region::deallocate):
+
+2013-03-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Remove -[JSManagedValue managedValueWithValue:owner:]
+        https://bugs.webkit.org/show_bug.cgi?id=113602
+
+        Reviewed by Geoffrey Garen.
+
+        Since we put the primary way of keeping track of external object graphs (i.e. "managed" references) 
+        in JSVirtualMachine, there is some overlap in the functionality of that interface and JSManagedValue.
+        Specifically, we no longer need the methods that include an owner, since ownership is now tracked 
+        by JSVirtualMachine. These JSManagedValues will become weak pointers unless they are used 
+        with [JSVirtualMachine addManagedReference:withOwner:], in which case their lifetime is tied to that 
+        of their owner.
+
+        * API/JSManagedValue.h:
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue init]):
+        (-[JSManagedValue initWithValue:]):
+        (JSManagedValueHandleOwner::isReachableFromOpaqueRoots):
+        * API/JSVirtualMachine.mm:
+        (getInternalObjcObject):
+        * API/tests/testapi.mm:
+        (-[TextXYZ setOnclick:]):
+        (-[TextXYZ dealloc]):
+
+2013-03-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Simplified bytecode generation by unforking "condition context" codegen
+        https://bugs.webkit.org/show_bug.cgi?id=113554
+
+        Reviewed by Mark Hahnenberg.
+
+        Now, a node that establishes a condition context can always ask its child
+        nodes to generate into that context.
+
+        This has a few advantages:
+
+        (*) Removes a bunch of code;
+
+        (*) Optimizes a few missed cases like "if (!(x < 2))", "if (!!x)", and
+        "if (!x || !y)";
+
+        (*) Paves the way to removing more opcodes.
+
+        * bytecode/Opcode.h:
+        (JSC): Separated out the branching opcodes for clarity.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ExpressionNode::emitBytecodeInConditionContext): All expressions
+        can be emitted in a condition context now -- the default behavior is
+        to branch based on the expression's value.
+
+        (JSC::LogicalNotNode::emitBytecodeInConditionContext):
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isSubtract):
+        (ExpressionNode):
+        (LogicalNotNode):
+        (LogicalOpNode): Removed lots of code for handling expressions
+        that couldn't generate into a condition context because all expressions
+        can now.
+
+2013-03-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Simplified the bytecode by removing op_loop and op_loop_if_*
+        https://bugs.webkit.org/show_bug.cgi?id=113548
+
+        Reviewed by Filip Pizlo.
+
+        Regular jumps will suffice.
+
+        These opcodes are identical to branches, except they also do timeout
+        checking. That style of timeout checking has been broken for a long 
+        time, and when we add back timeout checking, it won't use these opcodes.
+
+        * JavaScriptCore.order:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::computePreciseJumpTargets):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        (JSC):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-03-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Simplified the bytecode by removing op_jmp_scopes
+        https://bugs.webkit.org/show_bug.cgi?id=113545
+
+        Reviewed by Filip Pizlo.
+
+        We already have op_pop_scope and op_jmp, so we don't need op_jmp_scopes.
+        Using op_jmp_scopes was also adding a "jump to self" to codegen for
+        return statements, which was pretty silly.
+
+        * JavaScriptCore.order:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::computePreciseJumpTargets):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::emitPopScopes):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+
+2013-03-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Safari hangs during test262 run in CodeCache::pruneSlowCase
+        https://bugs.webkit.org/show_bug.cgi?id=113469
+
+        Reviewed by Geoffrey Garen.
+
+        We can end up hanging for quite some time if we add a lot of small keys to the CodeCache.
+        By the time we get around to pruning the cache, we have a potentially tens or hundreds of 
+        thousands of small entries, which can cause a noticeable hang when pruning them.
+
+        To fix this issue we added a hard cap to the number of entries in the cache because we 
+        could potentially have to remove every element in the map.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCacheMap::pruneSlowCase): We need to prune until we're both under the hard cap and the
+        capacity in bytes.
+        * runtime/CodeCache.h:
+        (CodeCacheMap):
+        (JSC::CodeCacheMap::numberOfEntries): Convenience accessor function to the number of entries in 
+        the map that does the cast to size_t of m_map.size() for us. 
+        (JSC::CodeCacheMap::canPruneQuickly): Checks that the total number is under the hard cap. We put this 
+        check inside a function to more accurately describe why we're doing the check and to abstract out 
+        the actual calculation in case we want to coalesce calls to pruneSlowCase in the future.
+        (JSC::CodeCacheMap::prune): Check the number of entries against our hard cap. If it's greater than
+        the cap then we need to drop down to pruneSlowCase.
+
+2013-03-28  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed build fix for the EFL and GTK ports.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCacheMap::pruneSlowCase): Pass a 0 casted to the int64_t type instead of 0LL
+        to the std::max call so the arguments' types match.
+
+2013-03-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed build fix: Removed a dead field.
+
+        Pointed out by Mark Lam.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (ByteCodeParser):
+
+2013-03-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed build fix: Removed a dead field.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (ByteCodeParser):
+
+2013-03-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed some dead code in the DFG bytecode parser
+        https://bugs.webkit.org/show_bug.cgi?id=113472
+
+        Reviewed by Sam Weinig.
+
+        Now that Phi creation and liveness analysis are separate passes, we can
+        remove the vestiges of code that used to do that in the bytecode
+        parser.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::parse):
+
+2013-03-27  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT and DFG should NaN-check loads from Float32 arrays
+        https://bugs.webkit.org/show_bug.cgi?id=113462
+        <rdar://problem/13490804>
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+
+2013-03-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CodeCache::m_capacity can becoming negative, producing undefined results in pruneSlowCase
+        https://bugs.webkit.org/show_bug.cgi?id=113453
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCacheMap::pruneSlowCase): We make sure that m_minCapacity doesn't drop below zero now.
+        This prevents m_capacity from doing the same.
+
+2013-03-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should use CheckStructure for typed array checks whenever possible
+        https://bugs.webkit.org/show_bug.cgi?id=113374
+
+        Reviewed by Geoffrey Garen.
+        
+        We used to do the right thing, but it appears that this regressed at some point. Since the
+        FixupPhase now has the ability to outright remove spurious CheckStructures on array
+        operations, it is profitable for the ByteCodeParser to insert CheckStructures whenver there
+        is a chance that it might be profitable, and when the profiling tells us what structure to
+        check.
+        
+        Also added some code for doing ArrayProfile debugging.
+        
+        This is a slightly speed-up. Maybe 3% on Mandreel.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::benefitsFromStructureCheck):
+
+2013-03-27  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] Remove Qt specific WorkQueueItem definitions.
+        https://bugs.webkit.org/show_bug.cgi?id=112891
+
+        This patch is preparation work for removing
+        WorkQueue related code from TestRunnerQt and
+        replacing it with generic TestRunner code.
+
+        Reviewed by Benjamin Poulain.
+
+        * API/JSStringRefQt.cpp:
+        (JSStringCreateWithQString):
+            Adding a convenience function to create a
+            JSStringRef from a QString.
+        * API/JSStringRefQt.h:
+
+2013-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: Sometimes, operations on proven strings ignore changes to the string prototype
+        https://bugs.webkit.org/show_bug.cgi?id=113353
+        <rdar://problem/13510778>
+
+        Reviewed by Mark Hahnenberg and Geoffrey Garen.
+        
+        ToString should call speculateStringObject() even if you know that it's a string object, since
+        it calls it to also get the watchpoint. Note that even with this change, if you do
+        Phantom(Check:StringObject:@a), it might get eliminated just because we proved that @a is a
+        string object (thereby eliminating the prototype watchpoint); that's fine since ToString is
+        MustGenerate and never decays to Phantom.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateStringObject):
+        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+
+2013-03-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=112106
+
+        Rubber stamped by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): Get rid of the case for constants because
+        we would have done constant folding anyways on a ValueToInt32.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.
+
+2013-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC_enableProfiler=true should also cause JSGlobalData to save the profiler output somewhere
+        https://bugs.webkit.org/show_bug.cgi?id=113144
+
+        Reviewed by Geoffrey Garen.
+        
+        Forgot to include Geoff's requested change in the original commit.
+
+        * profiler/ProfilerDatabase.cpp:
+        (Profiler):
+
+2013-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC_enableProfiler=true should also cause JSGlobalData to save the profiler output somewhere
+        https://bugs.webkit.org/show_bug.cgi?id=113144
+
+        Reviewed by Geoffrey Garen.
+        
+        Added the ability to save profiler output with JSC_enableProfiler=true. It will save it
+        to the current directory, or JSC_PROFILER_PATH if the latter was specified.
+        
+        This works by saving the Profiler::Database either when it is destroyed or atexit(),
+        whichever happens first.
+        
+        This allows use of the profiler from any WebKit client.
+
+        * jsc.cpp:
+        (jscmain):
+        * profiler/ProfilerDatabase.cpp:
+        (Profiler):
+        (JSC::Profiler::Database::Database):
+        (JSC::Profiler::Database::~Database):
+        (JSC::Profiler::Database::registerToSaveAtExit):
+        (JSC::Profiler::Database::addDatabaseToAtExit):
+        (JSC::Profiler::Database::removeDatabaseFromAtExit):
+        (JSC::Profiler::Database::performAtExitSave):
+        (JSC::Profiler::Database::removeFirstAtExitDatabase):
+        (JSC::Profiler::Database::atExitCallback):
+        * profiler/ProfilerDatabase.h:
+        (JSC::Profiler::Database::databaseID):
+        (Database):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2013-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        ArrayMode should not consider SpecOther when refining the base
+        https://bugs.webkit.org/show_bug.cgi?id=113271
+
+        Reviewed by Geoffrey Garen.
+        
+        9% speed-up on Octane/pdfjs.
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+
+2013-03-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix unused parameter warnings in JITInlines.h
+        https://bugs.webkit.org/show_bug.cgi?id=112560
+
+        Reviewed by Zoltan Herczeg.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::beginUninterruptedSequence):
+        (JSC::JIT::endUninterruptedSequence):
+        (JSC):
+
+2013-03-25  Kent Tamura  <tkent@chromium.org>
+
+        Rename ENABLE_INPUT_TYPE_DATETIME
+        https://bugs.webkit.org/show_bug.cgi?id=113254
+
+        Reviewed by Kentaro Hara.
+
+        Rename ENABLE_INPUT_TYPE_DATETIME to ENABLE_INPUT_TYPE_DATETIME_INCOMPLETE.
+        Actually I'd like to remove the code, but we shouldn't remove it yet
+        because we shipped products with it on some platforms.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-03-25  Mark Lam  <mark.lam@apple.com>
+
+        Offlineasm cloop backend compiles op+branch incorrectly.
+        https://bugs.webkit.org/show_bug.cgi?id=113146.
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGRepatch.h:
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+        - These functions never return when the DFG is dsiabled, not just when
+          asserts are enabled. Changing the attribute from NO_RETURN_DUE_TO_ASSERT
+          to NO_RETURN.
+        * llint/LLIntOfflineAsmConfig.h:
+        - Added some #defines needed to get the cloop building again.
+        * offlineasm/cloop.rb:
+        - Fix cloopEmitOpAndBranchIfOverflow() and cloopEmitOpAndBranch() to
+          emit code that unconditionally executes the specified operation before
+          doing the conditional branch.
+
+2013-03-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject::enterDictionaryIndexingMode doesn't have a case for ALL_BLANK_INDEXING_TYPES
+        https://bugs.webkit.org/show_bug.cgi?id=113236
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::enterDictionaryIndexingMode): We forgot blank indexing types.
+
+2013-03-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        HandleSet should use HeapBlocks for storing handles
+        https://bugs.webkit.org/show_bug.cgi?id=113145
+
+        Reviewed by Geoffrey Garen.
+
+        * GNUmakefile.list.am: Build project changes.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Ditto.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * heap/BlockAllocator.cpp: Rename the RegionSet to m_fourKBBlockRegionSet because there are 
+        too many block types to include them all in the name now.
+        (JSC::BlockAllocator::BlockAllocator):
+        * heap/BlockAllocator.h:
+        (BlockAllocator): Add the appropriate override for regionSetFor.
+        (JSC::WeakBlock):
+        (JSC::MarkStackSegment):
+        (JSC::HandleBlock):
+        * heap/HandleBlock.h: Added.
+        (HandleBlock): New class for HandleBlocks.
+        (JSC::HandleBlock::blockFor): Static method to get the block of the given HandleNode pointer. Allows
+        us to quickly figure out which HandleSet the HandleNode belongs to without storing the pointer to it
+        in the HandleNode.
+        (JSC::HandleBlock::handleSet): Getter.
+        * heap/HandleBlockInlines.h: Added.
+        (JSC::HandleBlock::create):
+        (JSC::HandleBlock::HandleBlock):
+        (JSC::HandleBlock::payloadEnd):
+        (JSC::HandleBlock::payload):
+        (JSC::HandleBlock::nodes):
+        (JSC::HandleBlock::nodeAtIndex):
+        (JSC::HandleBlock::nodeCapacity):
+        * heap/HandleSet.cpp:
+        (JSC::HandleSet::~HandleSet): 
+        (JSC::HandleSet::grow):
+        * heap/HandleSet.h:
+        (HandleNode): Move the internal Node class from HandleSet to be its own public class so it can be 
+        used by HandleBlock.
+        (HandleSet): Add a typedef so that Node refers to the new HandleNode class.
+        (JSC::HandleSet::toHandle):
+        (JSC::HandleSet::toNode):
+        (JSC::HandleSet::allocate):
+        (JSC::HandleSet::deallocate):
+        (JSC::HandleNode::HandleNode):
+        (JSC::HandleNode::slot):
+        (JSC::HandleNode::handleSet): Use the new blockFor static function to get the right HandleBlock and lookup 
+        the HandleSet.
+        (JSC::HandleNode::setPrev):
+        (JSC::HandleNode::prev):
+        (JSC::HandleNode::setNext):
+        (JSC::HandleNode::next):
+        (JSC::HandleSet::forEachStrongHandle):
+        * heap/Heap.h: Friend HandleSet so that it can access the BlockAllocator when allocating HandleBlocks.
+
+2013-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX (r145119): Make JSValue* properties default to (assign)
+        <rdar://problem/13380794>
+
+        Reviewed by Mark Hahnenberg.
+
+        Fixes the following build failures:
+
+            Source/JavaScriptCore/API/tests/testapi.mm:106:1: error: no 'assign', 'retain', or 'copy' attribute is specified - 'assign' is assumed [-Werror,-Wobjc-property-no-attribute]
+            @property JSValue *onclick;
+            ^
+            Source/JavaScriptCore/API/tests/testapi.mm:106:1: error: default property attrib ute 'assign' not appropriate for non-GC object [-Werror,-Wobjc-property-no-attribute]
+            Source/JavaScriptCore/API/tests/testapi.mm:107:1: error: no 'assign', 'retain', or 'copy' attribute is specified - 'assign' is assumed [-Werror,-Wobjc-property-no-attribute]
+            @property JSValue *weakOnclick;
+            ^
+            Source/JavaScriptCore/API/tests/testapi.mm:107:1: error: default property attribute 'assign' not appropriate for non-GC object [-Werror,-Wobjc-property-no-attribute]
+            4 errors generated.
+
+        * API/tests/testapi.mm: Default to (assign) for JSValue*
+        properties.
+
+2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        testLeakingPrototypesAcrossContexts added in r146682 doesn't compile on Win and fails on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=113125
+
+        Reviewed by Mark Hahnenberg
+
+        Remove the test added in r146682 as it's now failing on Mac.
+        This is the test that was causing a compilation failure on Windows.
+
+        * API/tests/testapi.c:
+        (main):
+
+2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Fix the typo: WIN -> WINDOWS.
+
+        * API/tests/testapi.c:
+        (main):
+
+2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        I really can't figure out what's wrong with this one.
+        Temporarily disable the test added by r146682 on Windows since it doesn't compile.
+
+        * API/tests/testapi.c:
+        (main):
+
+2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Another build fix (after r146693) for r146682.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-03-22  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. AppleWin build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+
+2013-03-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        -[TinyDOMNode dealloc] should call [super dealloc] when ARC is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=113054
+
+        Reviewed by Geoffrey Garen.
+
+        * API/tests/testapi.mm:
+        (-[TinyDOMNode dealloc]):
+
+2013-03-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        opaqueJSClassData should be cached on JSGlobalObject, not the JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=113086
+
+        Reviewed by Geoffrey Garen.
+
+        opaqueJSClassData stores cached prototypes for JSClassRefs in the C API. It doesn't make sense to 
+        share these prototypes within a JSGlobalData across JSGlobalObjects, and in fact doing so will cause 
+        a leak of the original JSGlobalObject that these prototypes were created in. Therefore we should move 
+        this cache to JSGlobalObject where it belongs and where it won't cause memory leaks.
+
+        * API/JSBase.cpp: Needed to add an extern "C" so that testapi.c can use the super secret GC function.
+        * API/JSClassRef.cpp: We now grab the cached context data from the global object rather than the global data.
+        (OpaqueJSClass::contextData):
+        * API/JSClassRef.h: Remove this header because it's unnecessary and causes circular dependencies.
+        * API/tests/testapi.c: Added a new test that makes sure that using the same JSClassRef in two different contexts
+        doesn't cause leaks of the original global object.
+        (leakFinalize):
+        (nestedAllocateObject): This is a hack to bypass the conservative scan of the GC, which was unnecessarily marking
+        objects and keeping them alive, ruining the test result.
+        (testLeakingPrototypesAcrossContexts):
+        (main):
+        * API/tests/testapi.mm: extern "C" this so we can continue using it here.
+        * runtime/JSGlobalData.cpp: Remove JSClassRef related stuff.
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.h: Add the stuff that JSGlobalData had. We add it to JSGlobalObjectRareData so that 
+        clients who don't use the C API don't have to pay the memory cost of this extra HashMap.
+        (JSGlobalObject):
+        (JSGlobalObjectRareData):
+        (JSC::JSGlobalObject::opaqueJSClassData):
+
+2013-03-19  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Add support for building the WebCore bindings to the gyp build
+        https://bugs.webkit.org/show_bug.cgi?id=112638
+
+        Reviewed by Nico Weber.
+
+        * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Export all include directories to direct
+        dependents and fix the indentation of the libjavascriptcore target.
+
+2013-03-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix some minor issues in the DFG's profiling of heap accesses
+        https://bugs.webkit.org/show_bug.cgi?id=113010
+
+        Reviewed by Goeffrey Garen.
+        
+        1) If a CodeBlock gets jettisoned by GC, we should count the exit sites.
+
+        2) If a CodeBlock clears a structure stub during GC, it should record this, and
+        the DFG should prefer to not inline that access (i.e. treat it as if it had an
+        exit site).
+
+        3) If a PutById was seen by the baseline JIT, and the JIT attempted to cache it,
+        but it chose not to, then assume that it will take slow path.
+
+        4) If we frequently exited because of a structure check on a weak constant,
+        don't try to inline that access in the future.
+
+        5) Treat all exits that were counted as being frequent.
+        
+        81% speed-up on Octane/gbemu. Small speed-ups elsewhere, and no regressions.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC):
+        (JSC::CodeBlock::resetStubDuringGCInternal):
+        (JSC::CodeBlock::reoptimize):
+        (JSC::CodeBlock::jettison):
+        (JSC::ProgramCodeBlock::jettisonImpl):
+        (JSC::EvalCodeBlock::jettisonImpl):
+        (JSC::FunctionCodeBlock::jettisonImpl):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (StructureStubInfo):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
+        (OSRExit):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Options.h:
+        (JSC):
+
+2013-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG folding of PutById to SimpleReplace should consider the specialized function case
+        https://bugs.webkit.org/show_bug.cgi?id=113093
+
+        Reviewed by Geoffrey Garen and Mark Hahnenberg.
+
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+
+2013-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX (r146558): Build testapi.mm with ARC enabled for armv7s
+        <http://webkit.org/b/112608>
+
+        Fixes the following build failure:
+
+            Source/JavaScriptCore/API/tests/testapi.mm:205:1: error: method possibly missing a [super dealloc] call [-Werror,-Wobjc-missing-super-calls]
+            }
+            ^
+            1 error generated.
+
+        * Configurations/ToolExecutable.xcconfig: Enable ARC for armv7s
+        architecture.
+
+2013-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        Revert "BUILD FIX (r146558): Call [super dealloc] from -[TinyDOMNode dealloc]"
+
+        This fixes a build failure introduced by this change:
+
+            Source/JavaScriptCore/API/tests/testapi.mm:206:6: error: ARC forbids explicit message send of 'dealloc'
+                [super dealloc];
+                 ^     ~~~~~~~
+            1 error generated.
+
+        Not sure why this didn't fail locally on my Mac Pro.
+
+        * API/tests/testapi.mm:
+        (-[TinyDOMNode dealloc]): Remove call to [super dealloc].
+
+2013-03-22  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX (r146558): Call [super dealloc] from -[TinyDOMNode dealloc]
+        <http://webkit.org/b/112608>
+
+        Fixes the following build failure:
+
+            Source/JavaScriptCore/API/tests/testapi.mm:205:1: error: method possibly missing a [super dealloc] call [-Werror,-Wobjc-missing-super-calls]
+            }
+            ^
+            1 error generated.
+
+        * API/tests/testapi.mm:
+        (-[TinyDOMNode dealloc]): Call [super dealloc].
+
+2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Leak bots erroneously report JSC::WatchpointSet as leaking
+        https://bugs.webkit.org/show_bug.cgi?id=107781
+
+        Reviewed by Filip Pizlo.
+
+        Since leaks doesn't support tagged pointers, avoid using it by flipping the bit flag to indicate
+        the entry is "fat". We set the flag when the entry is NOT fat; i.e. slim.
+
+        Replaced FatFlag by SlimFlag and initialized m_bits with this flag to indicate that the entry is
+        initially "slim".
+
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::copySlow): Don't set FatFlag since it has been replaced by SlimFlag.
+        (JSC::SymbolTableEntry::inflateSlow): Ditto.
+
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTableEntry::Fast::Fast): Set SlimFlag by default.
+        (JSC::SymbolTableEntry::Fast::isNull): Ignore SlimFlag.
+        (JSC::SymbolTableEntry::Fast::isFat): An entry is fat when m_bits is not entirely zero and SlimFlag
+        is not set.
+
+        (JSC::SymbolTableEntry::SymbolTableEntry): Set SlimFlag by default.
+        (JSC::SymbolTableEntry::SymbolTableEntry::getFast): Set SlimFlag when creating Fast from a fat entry.
+        (JSC::SymbolTableEntry::isNull): Ignore SlimFlag.
+        (JSC::SymbolTableEntry::FatEntry::FatEntry): Strip SlimFlag.
+        (JSC::SymbolTableEntry::isFat): An entry is fat when m_bits is not entirely zero and SlimFlag is unset.
+        (JSC::SymbolTableEntry::fatEntry): Don't strip FatFlag as this flag doesn't exist anymore.
+        (JSC::SymbolTableEntry::pack): Preserve SlimFlag.
+
+        (JSC::SymbolTableIndexHashTraits): empty value is no longer zero so don't set emptyValueIsZero true.
+
+2013-03-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Need a good way to preserve custom properties on JS wrappers
+        https://bugs.webkit.org/show_bug.cgi?id=112608
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, we just use a weak map, which means that garbage collection can cause a wrapper to 
+        disappear if it isn't directly exported to JavaScript.
+
+        The most straightforward and safe way (with respect to garbage collection and concurrency) is to have 
+        clients add and remove their external references along with their owners. Effectively, the client is 
+        recording the structure of the external object graph so that the garbage collector can make sure to 
+        mark any wrappers that are reachable through either the JS object graph of the external Obj-C object 
+        graph. By keeping these wrappers alive, this has the effect that custom properties on these wrappers 
+        will also remain alive.
+
+        The rule for if an object needs to be tracked by the runtime (and therefore whether the client should report it) is as follows:
+        For a particular object, its references to its children should be added if:
+        1. The child is referenced from JavaScript.
+        2. The child contains references to other objects for which (1) or (2) are true.
+
+        * API/JSAPIWrapperObject.mm:
+        (JSAPIWrapperObjectHandleOwner::finalize):
+        (JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots): A wrapper object is kept alive only if its JSGlobalObject
+        is marked and its corresponding Objective-C object was added to the set of opaque roots.
+        (JSC::JSAPIWrapperObject::visitChildren): We now call out to scanExternalObjectGraph, which handles adding all Objective-C
+        objects to the set of opaque roots.
+        * API/JSAPIWrapperObject.h:
+        (JSAPIWrapperObject):
+        * API/JSContext.mm: Moved dealloc to its proper place in the main implementation.
+        (-[JSContext dealloc]):
+        * API/JSVirtualMachine.h:
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine initWithContextGroupRef:]):
+        (-[JSVirtualMachine dealloc]):
+        (getInternalObjcObject): Helper funciton to get the Objective-C object out of JSManagedValues or JSValues if there is one.
+        (-[JSVirtualMachine addManagedReference:withOwner:]): Adds the Objective-C object to the set of objects 
+        owned by the owner object in that particular virtual machine.
+        (-[JSVirtualMachine removeManagedReference:withOwner:]): Removes the relationship between the two objects.
+        (-[JSVirtualMachine externalObjectGraph]):
+        (scanExternalObjectGraph): Does a depth-first search of the external object graph in a particular virtual machine starting at
+        the specified root. Each new object it encounters it adds to the set of opaque roots. These opaque roots will keep their 
+        corresponding wrapper objects alive if they have them. 
+        * API/JSManagedReferenceInternal.h: Added.
+        * API/JSVirtualMachine.mm: Added the per-JSVirtualMachine map between objects and the objects they own, which is more formally
+        known as that virtual machine's external object graph.
+        * API/JSWrapperMap.mm:
+        (-[JSWrapperMap dealloc]): We were leaking this before :-(
+        (-[JSVirtualMachine initWithContextGroupRef:]):
+        (-[JSVirtualMachine dealloc]):
+        (-[JSVirtualMachine externalObjectGraph]):
+        * API/JSVirtualMachineInternal.h:
+        * API/tests/testapi.mm: Added two new tests using the TinyDOMNode class. The first tests that a custom property added to a wrapper 
+        doesn't vanish after GC, even though that wrapper isn't directly accessible to the JS garbage collector but is accessible through 
+        the external Objective-C object graph. The second test makes sure that adding an object to the external object graph with the same 
+        owner doesn't cause any sort of problems.
+        (+[TinyDOMNode sharedVirtualMachine]):
+        (-[TinyDOMNode init]):
+        (-[TinyDOMNode dealloc]):
+        (-[TinyDOMNode appendChild:]):
+        (-[TinyDOMNode numberOfChildren]):
+        (-[TinyDOMNode childAtIndex:]):
+        (-[TinyDOMNode removeChildAtIndex:]):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/SlotVisitor.h:
+        (SlotVisitor):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::containsOpaqueRootTriState): Added a new method to SlotVisitor to allow scanExternalObjectGraph to have a 
+        thread-safe view of opaque roots during parallel marking. The set of opaque roots available to any one SlotVisitor isn't guaranteed
+        to be 100% correct, but that just results in a small duplication of work in scanExternalObjectGraph. To indicate this change for
+        false negatives we return a TriState that's either true or mixed, but never false.
+
+2013-03-21  Mark Lam  <mark.lam@apple.com>
+
+        Fix O(n^2) op_debug bytecode charPosition to column computation.
+        https://bugs.webkit.org/show_bug.cgi?id=112957.
+
+        Reviewed by Geoffrey Garen.
+
+        The previous algorithm does a linear reverse scan of the source string
+        to find the line start for any given char position. This results in a
+        O(n^2) algortithm when the source string has no line breaks.
+
+        The new algorithm computes a line start column table for a
+        SourceProvider on first use. This line start table is used to fix up
+        op_debug's charPosition operand into a column operand when an
+        UnlinkedCodeBlock is linked into a CodeBlock. The initialization of
+        the line start table is O(n), and the CodeBlock column fix up is
+        O(log(n)).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): 
+        (JSC::CodeBlock::CodeBlock): - do column fix up.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::debug): - no need to do column fixup anymore.
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/SourceProvider.cpp:
+        (JSC::SourceProvider::lineStarts):
+        (JSC::charPositionExtractor):
+        (JSC::SourceProvider::charPositionToColumnNumber):
+        - initialize line start column table if needed.
+        - look up line start for the given char position.
+        * parser/SourceProvider.h:
+
+2013-03-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC profiler should have an at-a-glance report of the success of DFG optimization
+        https://bugs.webkit.org/show_bug.cgi?id=112988
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::Compilation):
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerCompilation.h:
+        (JSC::Profiler::Compilation::noticeInlinedGetById):
+        (JSC::Profiler::Compilation::noticeInlinedPutById):
+        (JSC::Profiler::Compilation::noticeInlinedCall):
+        (Compilation):
+        * runtime/CommonIdentifiers.h:
+
+2013-03-21  Mark Lam  <mark.lam@apple.com>
+
+        Fix lexer charPosition computation when "rewind"ing the lexer.
+        https://bugs.webkit.org/show_bug.cgi?id=112952.
+
+        Reviewed by Michael Saboff.
+
+        Changed the Lexer to no longer keep a m_charPosition. Instead, we compute
+        currentCharPosition() from m_code and m_codeStartPlusOffset, where
+        m_codeStartPlusOffset is the SourceProvider m_codeStart + the SourceCode
+        start offset. This ensures that the charPosition is always in sync with
+        m_code.
+
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::currentCharPosition):
+        (JSC::::lexExpectIdentifier):
+
+2013-03-21  Alberto Garcia  <agarcia@igalia.com>
+
+        [BlackBerry] GCActivityCallback: replace JSLock with JSLockHolder
+        https://bugs.webkit.org/show_bug.cgi?id=112448
+
+        Reviewed by Xan Lopez.
+
+        This changed in r121381.
+
+        * runtime/GCActivityCallbackBlackBerry.cpp:
+        (JSC::DefaultGCActivityCallback::doWork):
+
+2013-03-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: wrapperClass holds a static JSClassRef, which causes JSGlobalObjects to leak
+        https://bugs.webkit.org/show_bug.cgi?id=112856
+
+        Reviewed by Geoffrey Garen.
+
+        Through a very convoluted path that involves the caching of prototypes on the JSClassRef, we can leak 
+        JSGlobalObjects when inserting an Objective-C object into multiple independent JSContexts.
+
+        * API/JSAPIWrapperObject.cpp: Removed.
+        * API/JSAPIWrapperObject.h:
+        (JSAPIWrapperObject):
+        * API/JSAPIWrapperObject.mm: Copied from Source/JavaScriptCore/API/JSAPIWrapperObject.cpp. Made this an
+        Objective-C++ file so that we can call release on the wrappedObject. Also added a WeakHandleOwner for 
+        JSAPIWrapperObjects. This will also be used in a future patch for https://bugs.webkit.org/show_bug.cgi?id=112608.
+        (JSAPIWrapperObjectHandleOwner):
+        (jsAPIWrapperObjectHandleOwner):
+        (JSAPIWrapperObjectHandleOwner::finalize): This finalize replaces the old finalize that was done through
+        the C API.
+        (JSC::JSAPIWrapperObject::finishCreation): Allocate the WeakImpl. Balanced in finalize.
+        (JSC::JSAPIWrapperObject::setWrappedObject): We now do the retain of the wrappedObject here rather than in random
+        places scattered around JSWrapperMap.mm
+        * API/JSObjectRef.cpp: Added some ifdefs for platforms that don't support the Obj-C API.
+        (JSObjectGetPrivate): Ditto.
+        (JSObjectSetPrivate): Ditto.
+        (JSObjectGetPrivateProperty): Ditto.
+        (JSObjectSetPrivateProperty): Ditto.
+        (JSObjectDeletePrivateProperty): Ditto.
+        * API/JSValueRef.cpp: Ditto.
+        (JSValueIsObjectOfClass): Ditto.
+        * API/JSWrapperMap.mm: Remove wrapperClass().
+        (objectWithCustomBrand): Change to no longer use a parent class, which was only used to give the ability to 
+        finalize wrapper objects.
+        (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]): Change to no longer use wrapperClass(). 
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): Ditto.
+        (tryUnwrapObjcObject): We now check if the object inherits from JSAPIWrapperObject.
+        * API/tests/testapi.mm: Added a test that exports an Objective-C object to two different JSContexts and makes 
+        sure that the first one is collected properly by using a weak JSManagedValue for the wrapper in the first JSContext.
+        * CMakeLists.txt: Build file modifications.
+        * GNUmakefile.list.am: Ditto.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Ditto.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * runtime/JSGlobalObject.cpp: More ifdefs for unsupported platforms.
+        (JSC::JSGlobalObject::reset): Ditto.
+        (JSC::JSGlobalObject::visitChildren): Ditto.
+        * runtime/JSGlobalObject.h: Ditto.
+        (JSGlobalObject): Ditto.
+        (JSC::JSGlobalObject::objcCallbackFunctionStructure): Ditto.
+
+2013-03-21  Anton Muhin  <antonm@chromium.org>
+
+        Unreviewed, rolling out r146483.
+        http://trac.webkit.org/changeset/146483
+        https://bugs.webkit.org/show_bug.cgi?id=111695
+
+        Breaks debug builds.
+
+        * bytecode/GlobalResolveInfo.h: Removed property svn:mergeinfo.
+
+2013-03-21  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Implement LLInt for CPU(ARM_TRADITIONAL)
+        https://bugs.webkit.org/show_bug.cgi?id=97589
+
+        Reviewed by Zoltan Herczeg.
+
+        Enable LLInt for ARMv5 and ARMv7 traditional as well.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * offlineasm/arm.rb:
+        * offlineasm/backends.rb:
+        * offlineasm/instructions.rb:
+
+2013-03-20  Cosmin Truta  <ctruta@blackberry.com>
+
+        [QNX][ARM] REGRESSION(r135330): Various failures in Octane
+        https://bugs.webkit.org/show_bug.cgi?id=112863
+
+        Reviewed by Yong Li.
+
+        This was fixed in http://trac.webkit.org/changeset/146396 on Linux only.
+        Enable this fix on QNX.
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::replaceWithJump):
+        (JSC::ARMv7Assembler::maxJumpReplacementSize):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
+
+2013-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of JSString.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/JSString.h:
+
+2013-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        "" + x where x is not a string should be optimized by the DFG to some manner of ToString conversion
+        https://bugs.webkit.org/show_bug.cgi?id=112845
+
+        Reviewed by Mark Hahnenberg.
+        
+        I like to do "" + x. So I decided to make DFG recognize it, and related idioms.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToPrimitive):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::fixupToString):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::resultOfToPrimitive):
+        (DFG):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPredictionPropagationPhase.h:
+        (DFG):
+
+2013-03-20  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        ARMv7 replaceWithJump ASSERT failure after r135330.
+        https://bugs.webkit.org/show_bug.cgi?id=103146
+
+        Reviewed by Filip Pizlo.
+
+        On Linux, the 24 bit distance range of jumps sometimes does not
+        enough to cover all targets addresses. This patch supports jumps
+        outside of this range using a mov/movt/bx 10 byte long sequence.
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::revertJumpTo_movT3movtcmpT2):
+        (JSC::ARMv7Assembler::nopw):
+        (JSC::ARMv7Assembler::label):
+        (JSC::ARMv7Assembler::replaceWithJump):
+        (JSC::ARMv7Assembler::maxJumpReplacementSize):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
+
+2013-03-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Fix over-releasing in allocateConstructorAndPrototypeWithSuperClassInfo:
+        https://bugs.webkit.org/show_bug.cgi?id=112832
+
+        Reviewed by Geoffrey Garen.
+
+        If either the m_constructor or m_prototype (but not both) is collected, we will call 
+        allocateConstructorAndPrototypeWithSuperClassInfo, which will create a new object to replace the one 
+        that was collected, but at the end of the method we call release on both of them. 
+        This is incorrect since we autorelease the JSValue in the case that the object doesn't need to be 
+        reallocated. Thus we'll end up overreleasing later during the drain of the autorelease pool.
+
+        * API/JSWrapperMap.mm:
+        (objectWithCustomBrand): We no longer alloc here. We instead call the JSValue valueWithValue class method,
+        which autoreleases for us.
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We no longer call release on the 
+        constructor or prototype JSValues.
+        * API/tests/testapi.mm: Added a new test that crashes on ToT due to over-releasing.
+
+2013-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        It's called "Hash Consing" not "Hash Consting"
+        https://bugs.webkit.org/show_bug.cgi?id=112768
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        See http://en.wikipedia.org/wiki/Hash_consing
+
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::reset):
+        * heap/GCThreadSharedData.h:
+        (GCThreadSharedData):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::setup):
+        (JSC::SlotVisitor::reset):
+        (JSC::JSString::tryHashConsLock):
+        (JSC::JSString::releaseHashConsLock):
+        (JSC::JSString::shouldTryHashCons):
+        (JSC::SlotVisitor::internalAppend):
+        * heap/SlotVisitor.h:
+        (SlotVisitor):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::haveEnoughNewStringsToHashCons):
+        (JSC::JSGlobalData::resetNewStringsSinceLastHashCons):
+        * runtime/JSString.h:
+        (JSC::JSString::finishCreation):
+        (JSString):
+        (JSC::JSString::isHashConsSingleton):
+        (JSC::JSString::clearHashConsSingleton):
+        (JSC::JSString::setHashConsSingleton):
+
+2013-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG implementation of op_strcat should inline rope allocations
+        https://bugs.webkit.org/show_bug.cgi?id=112780
+
+        Reviewed by Oliver Hunt.
+        
+        This gets rid of the StrCat node and adds a MakeRope node. The MakeRope node can
+        take either two or three operands, and allocates a rope string with either two or
+        three fibers. (The magic choice of three children for non-VarArg nodes happens to
+        match exactly with the magic choice of three fibers for rope strings.)
+        
+        ValueAdd on KnownString is replaced with MakeRope with two children.
+        
+        StrCat gets replaced by an appropriate sequence of MakeRope's.
+        
+        MakeRope does not do the dynamic check to see if its children are empty strings.
+        This is replaced by a static check, instead. The downside is that we may use more
+        memory if the strings passed to MakeRope turn out to dynamically be empty. The
+        upside is that we do fewer checks in the cases where either the strings are not
+        empty, or where the strings are statically known to be empty. I suspect both of
+        those cases are more common, than the case where the string is dynamically empty.
+        
+        This also results in some badness for X86. MakeRope needs six registers if it is
+        allocating a three-rope. We don't have six registers to spare on X86. Currently,
+        the code side-steps this problem by just never usign three-ropes in optimized
+        code on X86. All other architectures, including X86_64, don't have this problem.
+        
+        This is a shocking speed-up. 9% progressions on both V8/splay and
+        SunSpider/date-format-xparb. 1% progression on V8v7 overall, and ~0.5% progression
+        on SunSpider. 2x speed-up on microbenchmarks that test op_strcat.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGAdjacencyList.h:
+        (AdjacencyList):
+        (JSC::DFG::AdjacencyList::removeEdge):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::createToString):
+        (JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
+        (JSC::DFG::FixupPhase::convertStringAddUse):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::convertToMakeRope):
+        (JSC::DFG::FixupPhase::fixupMakeRope):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateCellOperand::~SpeculateCellOperand):
+        (JSC::DFG::SpeculateCellOperand::gpr):
+        (JSC::DFG::SpeculateCellOperand::use):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSString.h:
+        (JSRopeString):
+
+2013-03-20  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Implement and32 on MIPS platform
+        https://bugs.webkit.org/show_bug.cgi?id=112665
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::and32): Added missing method.
+        (MacroAssemblerMIPS):
+
+2013-03-20  Mark Lam  <mark.lam@apple.com>
+
+        Fix incorrect debugger column number value.
+        https://bugs.webkit.org/show_bug.cgi?id=112741.
+
+        Reviewed by Oliver Hunt.
+
+        1. In lexer, parser, and debugger code, renamed column to charPosition.
+        2. Convert the charPosition to the equivalent column number before
+           passing it to the debugger.
+        3. Changed ScopeNodes to take both a startLocation and an endLocation.
+           This allows FunctionBodyNodes, ProgramNodes, and EvalNodess to emit
+           correct debug hooks with correct starting line and column numbers.
+        4. Fixed the Lexer to not reset the charPosition (previously
+           columnNumber) in Lexer::lex().
+
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::debug):
+        - convert charPosition to column for the debugger.
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.cpp:
+        (DEFINE_STUB_FUNCTION(void, op_debug)):
+        * llint/LLIntSlowPaths.cpp:
+        (LLINT_SLOW_PATH_DECL(slow_op_debug)):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        * parser/Lexer.cpp:
+        (JSC::::setCode):
+        (JSC::::internalShift):
+        (JSC::::shift):
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::currentCharPosition):
+        (Lexer):
+        (JSC::::lexExpectIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        * parser/Nodes.cpp:
+        (JSC::StatementNode::setLoc):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::Node::charPosition):
+        (Node):
+        (StatementNode):
+        (JSC::StatementNode::lastLine):
+        (ScopeNode):
+        (JSC::ScopeNode::startLine):
+        (JSC::ScopeNode::startCharPosition):
+        (ProgramNode):
+        (EvalNode):
+        (FunctionBodyNode):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenLocation::JSTokenLocation):
+        (JSTokenLocation):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionBody):
+
+2013-03-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r146089): It broke 20 sputnik tests on ARM traditional and Thumb2
+        https://bugs.webkit.org/show_bug.cgi?id=112676
+
+        Rubber-stamped by Filip Pizlo.
+
+        Add one more EABI_32BIT_DUMMY_ARG to make DFG JIT ARM EABI compatible
+        again after r146089 similar to https://bugs.webkit.org/show_bug.cgi?id=84449
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+2013-03-19  Michael Saboff  <msaboff@apple.com>
+
+        Crash when loading http://www.jqchart.com/jquery/gauges/RadialGauge/LiveData
+        https://bugs.webkit.org/show_bug.cgi?id=112694
+
+        Reviewed by Filip Pizlo.
+
+        We were trying to convert an NewArray to a Phantom, but convertToPhantom doesn't handle
+        nodes with variable arguments.  Added code to insert a Phantom node in front of all the
+        live children of a var args node.  Added ASSERT not var args for convertToPhantom to
+        catch any other similar cases.  Added a new convertToPhantomUnchecked() for converting 
+        var arg nodes.
+
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::setOpAndDefaultNonExitFlags): Added ASSERT(!(m_flags & NodeHasVarArgs))
+        (JSC::DFG::Node::setOpAndDefaultNonExitFlagsUnchecked):
+        (JSC::DFG::Node::convertToPhantomUnchecked):
+
+2013-03-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Crash in SpeculativeJIT::fillSpeculateIntInternal<false> on http://bellard.org/jslinux
+        https://bugs.webkit.org/show_bug.cgi?id=112738
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixIntEdge): We shouldn't be killing this node because it could be
+        referenced by other people.
+
+2013-03-19  Oliver Hunt  <oliver@apple.com>
+
+        RELEASE_ASSERT fires in exception handler lookup
+
+        RS=Geoff Garen.
+
+        Temporarily switch this RELEASE_ASSERT into a regular ASSERT 
+        as currently this is producing fairly bad crashiness.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+
+2013-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize StringObject.length and StringOrStringObject.length
+        https://bugs.webkit.org/show_bug.cgi?id=112658
+
+        Reviewed by Mark Hahnenberg.
+        
+        Implemented by injecting a ToString(StringObject:@a) or ToString(StringOrStringObject:@a) prior
+        to GetArrayLength with ArrayMode(Array::String) if @a is predicted StringObject or
+        StringOrStringObject.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::createToString):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
+        (JSC::DFG::FixupPhase::convertStringAddUse):
+
+2013-03-19  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Implement and32 on ARMv7 and ARM traditional platforms
+        https://bugs.webkit.org/show_bug.cgi?id=112663
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::and32): Add missing method.
+        (MacroAssemblerARM):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::and32): Add missing method.
+        (MacroAssemblerARMv7):
+
+2013-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ToString generic cases should work correctly
+        https://bugs.webkit.org/show_bug.cgi?id=112654
+        <rdar://problem/13447250>
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-03-18  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix for 32 bit builds.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-03-18  Michael Saboff  <msaboff@apple.com>
+
+        EFL: Unsafe branch detected in compilePutByValForFloatTypedArray()
+        https://bugs.webkit.org/show_bug.cgi?id=112609
+
+        Reviewed by Geoffrey Garen.
+
+        Created local valueFPR and scratchFPR and filled them with valueOp.fpr() and scratch.fpr()
+        respectively so that if valueOp.fpr() causes a spill during allocation, it occurs before the
+        branch and also to follow convention.  Added register allocation checks to FPRTemporary.
+        Cleaned up a couple of other places to follow the "AllocatVirtualRegType foo, get machine
+        reg from foo" pattern.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::fprAllocate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::convertToDouble):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline binary string concatenations (i.e. ValueAdd with string children)
+        https://bugs.webkit.org/show_bug.cgi?id=112599
+
+        Reviewed by Oliver Hunt.
+        
+        This does as advertised: if you do x + y where x and y are strings, you'll get
+        a fast inlined JSRopeString allocation (along with whatever checks are necessary).
+        It also does good things if either x or y (or both) are StringObjects, or some
+        other thing like StringOrStringObject. It also lays the groundwork for making this
+        fast if either x or y are numbers, or some other reasonably-cheap-to-convert
+        value.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::isStringObjectUse):
+        (JSC::DFG::FixupPhase::convertStringAddUse):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        * runtime/JSString.h:
+        (JSC::JSString::offsetOfFlags):
+        (JSString):
+        (JSRopeString):
+        (JSC::JSRopeString::offsetOfFibers):
+
+2013-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC_NATIVE_FUNCTION() takes an identifier for the name and then uses #name, which is unsafe if name was already #define'd to something else
+        https://bugs.webkit.org/show_bug.cgi?id=112639
+
+        Reviewed by Michael Saboff.
+        
+        Change it to take a string instead.
+
+        * runtime/JSObject.h:
+        (JSC):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::finishCreation):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2013-03-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Get build working under VS2010.
+        https://bugs.webkit.org/show_bug.cgi?id=112604
+
+        Reviewed by Tim Horton.
+
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Use CFLite-specific
+        build target (standard version links against CoreFoundation.lib
+        instead of CFLite.lib).
+        * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiDebugCFLite.props: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiReleaseCFLite.props: Added.
+
+2013-03-18  Roger Fong  <roger_fong@apple.com>
+
+        AppleWin VS2010 Debug configuration build fix..
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+
+2013-03-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Get build working under VS2010.
+        https://bugs.webkit.org/show_bug.cgi?id=112604
+
+        Reviewed by Tim Horton.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add build targets for
+        Debug_WinCairo and Release_WinCairo using CFLite.
+        * JavaScriptCore.vcxproj/JavaScriptCoreCFLite.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
+        Add Debug_WinCairo and Release_WinCairo build targets to
+        make sure headers are copied to proper build folder.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Ditto.
+        * JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props: Added.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        Add Debug_WinCairo and Release_WinCairo build targets to
+        make sure headers are copied to proper build folder.
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        Ditto.
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        Ditto.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Ditto.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Ditto.
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Ditto.
+
+2013-03-18  Michael Saboff  <msaboff@apple.com>
+
+        Potentially unsafe register allocations in DFG code generation
+        https://bugs.webkit.org/show_bug.cgi?id=112477
+
+        Reviewed by Geoffrey Garen.
+
+        Moved allocation of temporary GPRs to be before any generated branches in the functions below.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+
+2013-03-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG string conversions and allocations should be inlined
+        https://bugs.webkit.org/show_bug.cgi?id=112376
+
+        Reviewed by Geoffrey Garen.
+        
+        This turns new String(), String(), String.prototype.valueOf(), and
+        String.prototype.toString() into intrinsics. It gives the DFG the ability to handle
+        conversions from StringObject to JSString and vice-versa, and also gives it the
+        ability to handle cases where a variable may be either a StringObject or a JSString.
+        To do this, I added StringObject to value profiling (and removed the stale
+        distinction between Myarguments and Foreignarguments). I also cleaned up ToPrimitive
+        handling, using some of the new functionality but also taking advantage of the
+        existence of Identity(String:@a).
+        
+        This is a 2% SunSpider speed-up. Also there are some speed-ups on V8v7 and Kraken.
+        On microbenchmarks that stress new String() this is a 14x speed-up.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::hasExitSite):
+        (JSC):
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::ExitProfile::hasExitSite):
+        (DFG):
+        * bytecode/DFGExitProfile.h:
+        (ExitProfile):
+        (JSC::DFG::ExitProfile::hasExitSite):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromClassInfo):
+        * bytecode/SpeculatedType.h:
+        (JSC):
+        (JSC::isStringObjectSpeculation):
+        (JSC::isStringOrStringObjectSpeculation):
+        * create_hash_table:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::filterEdgeByUse):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::emitArgumentPhantoms):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::shift):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::hasGlobalExitSite):
+        (Graph):
+        (JSC::DFG::Graph::hasExitSite):
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToToString):
+        (Node):
+        (JSC::DFG::Node::hasStructure):
+        (JSC::DFG::Node::shouldSpeculateStringObject):
+        (JSC::DFG::Node::shouldSpeculateStringOrStringObject):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileNewStringObject):
+        (JSC::DFG::SpeculativeJIT::speculateObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateStringObject):
+        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::regExpPrototypeTable):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSDestructibleObject.h:
+        (JSDestructibleObject):
+        (JSC::JSDestructibleObject::classInfoOffset):
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+        (JSC):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::allocationSize):
+        (JSWrapperObject):
+        (JSC::JSWrapperObject::internalValueOffset):
+        (JSC::JSWrapperObject::internalValueCellOffset):
+        * runtime/StringPrototype.cpp:
+        (JSC):
+        (JSC::StringPrototype::finishCreation):
+        (JSC::StringPrototype::create):
+        * runtime/StringPrototype.h:
+        (StringPrototype):
+
+2013-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        ObjectPrototype properties should be eagerly created rather than lazily via static tables
+        https://bugs.webkit.org/show_bug.cgi?id=112539
+
+        Reviewed by Oliver Hunt.
+        
+        This is the first part of https://bugs.webkit.org/show_bug.cgi?id=112233. Rolling this
+        in first since it's the less-likely-to-be-broken part.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::objectConstructorTable):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectNativeFunction):
+        (JSC):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/ObjectPrototype.cpp:
+        (JSC):
+        (JSC::ObjectPrototype::finishCreation):
+        (JSC::ObjectPrototype::create):
+        * runtime/ObjectPrototype.h:
+        (ObjectPrototype):
+
+2013-03-16  Pratik Solanki  <psolanki@apple.com>
+
+        Disable High DPI Canvas on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=112511
+
+        Reviewed by Joseph Pecoraro.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-03-15  Andreas Kling  <akling@apple.com>
+
+        Don't also clone StructureRareData when cloning Structure.
+        <http://webkit.org/b/111672>
+
+        Reviewed by Mark Hahnenberg.
+
+        We were cloning a lot of StructureRareData with only the previousID pointer set since
+        the enumerationCache is not shared between clones.
+
+        Let the Structure copy constructor decide whether it wants to clone the rare data.
+        The decision is made by StructureRareData::needsCloning() and will currently always
+        return false, since StructureRareData only holds on to caches at present.
+        This may change in the future as more members are added to StructureRareData.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::cloneRareDataFrom):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::create):
+
+2013-03-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Roll out r145838
+        https://bugs.webkit.org/show_bug.cgi?id=112458
+
+        Unreviewed. Requested by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * dfg/DFGOperations.cpp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::objectPrototypeTable):
+        * jit/JITStubs.cpp:
+        (JSC::getByVal):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSCell.cpp:
+        (JSC):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSCellInlines.h:
+        (JSC):
+        (JSC::JSCell::fastGetOwnProperty):
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSObject.cpp:
+        (JSC):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/ObjectPrototype.cpp:
+        (JSC):
+        (JSC::ObjectPrototype::finishCreation):
+        (JSC::ObjectPrototype::getOwnPropertySlot):
+        (JSC::ObjectPrototype::getOwnPropertyDescriptor):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::create):
+        (ObjectPrototype):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::findWithString):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+
+2013-03-15  Michael Saboff  <msaboff@apple.com>
+
+        Cleanup of DFG and Baseline JIT debugging code
+        https://bugs.webkit.org/show_bug.cgi?id=111871
+
+        Reviewed by Geoffrey Garen.
+
+        Fixed various debug related issue in baseline and DFG JITs. See below.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkClosureCall): Used pointerDump() to handle when calleeCodeBlock is NULL.
+        * dfg/DFGScratchRegisterAllocator.h: Now use ScratchBuffer::activeLengthPtr() to get
+        pointer to scratch register length.
+        (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkConsistency): Added missing case labels for DataFormatOSRMarker,
+        DataFormatDead, and DataFormatArguments and made them RELEASE_ASSERT_NOT_REACHED();
+        * jit/JITCall.cpp:
+        (JSC::JIT::privateCompileClosureCall): Used pointerDump() to handle when calleeCodeBlock is NULL.
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::privateCompileClosureCall): Used pointerDump() to handle when calleeCodeBlock is NULL.
+        * runtime/JSGlobalData.h:
+        (JSC::ScratchBuffer::ScratchBuffer): Fixed buffer allocation alignment to
+        be on a double boundary.
+        (JSC::ScratchBuffer::setActiveLength):
+        (JSC::ScratchBuffer::activeLength):
+        (JSC::ScratchBuffer::activeLengthPtr):
+
+2013-03-15  Michael Saboff  <msaboff@apple.com>
+
+        Add runtime check for improper register allocations in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=112380
+
+        Reviewed by Geoffrey Garen.
+
+        Added framework to check for register allocation within a branch source - target range.  All register allocations
+        are saved using the offset in the code stream where the allocation occurred.  Later when a jump is linked, the
+        currently saved register allocations are checked to make sure that they didn't occur in the range of code that was
+        jumped over.  This protects against the case where an allocation could have spilled register contents to free up 
+        a register and that spill only occurs on one path of a many through the code.  A subsequent fill of the spilled
+        register may load garbage.  See https://bugs.webkit.org/show_bug.cgi?id=111777 for one such bug.
+        This code is protected by the compile time check of #if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION).
+        The check is only done during the processing of SpeculativeJIT::compile(Node* node) and its callees.
+ 
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Jump::link): Invoke register allocation checks using source and target of link.
+        (JSC::AbstractMacroAssembler::Jump::linkTo): Invoke register allocation checks using source and target of link.
+        (AbstractMacroAssembler):
+        (RegisterAllocationOffset): New helper class to store the instruction stream offset and compare against a 
+        jump range.
+        (JSC::AbstractMacroAssembler::RegisterAllocationOffset::RegisterAllocationOffset):
+        (JSC::AbstractMacroAssembler::RegisterAllocationOffset::check):
+        (JSC::AbstractMacroAssembler::addRegisterAllocationAtOffset):
+        (JSC::AbstractMacroAssembler::clearRegisterAllocationOffsets): 
+        (JSC::AbstractMacroAssembler::checkRegisterAllocationAgainstBranchRange):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::allocate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-03-14  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION(r145000): Crash loading arstechnica.com when Safari Web Inspector is open
+        https://bugs.webkit.org/show_bug.cgi?id=111868
+
+        Reviewed by Antti Koivisto.
+
+        Don't allow non-local property lookup when the debugger is enabled.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+
+2013-03-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Objective-C functions exposed to JavaScript have the wrong type (object instead of function)
+        https://bugs.webkit.org/show_bug.cgi?id=105892
+
+        Reviewed by Geoffrey Garen.
+
+        Changed ObjCCallbackFunction to subclass JSCallbackFunction which already has all of the machinery to call
+        functions using the C API. Since ObjCCallbackFunction is now a JSCell, we changed the old implementation of
+        ObjCCallbackFunction to be the internal implementation and keep track of all the proper data so that we 
+        don't have to put all of that in the header, which will now be included from C++ files (e.g. JSGlobalObject.cpp).
+
+        * API/JSCallbackFunction.cpp: Change JSCallbackFunction to allow subclassing. Originally it was internally
+        passing its own Structure up the chain of constructors, but we now want to be able to pass other Structures as well.
+        (JSC::JSCallbackFunction::JSCallbackFunction):
+        (JSC::JSCallbackFunction::create):
+        * API/JSCallbackFunction.h:
+        (JSCallbackFunction):
+        * API/JSWrapperMap.mm: Changed interface to tryUnwrapBlock.
+        (tryUnwrapObjcObject):
+        * API/ObjCCallbackFunction.h:
+        (ObjCCallbackFunction): Moved into the JSC namespace, just like JSCallbackFunction.
+        (JSC::ObjCCallbackFunction::createStructure): Overridden so that the correct ClassInfo gets used since we have 
+        a destructor.
+        (JSC::ObjCCallbackFunction::impl): Getter for the internal impl.
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunctionImpl::ObjCCallbackFunctionImpl): What used to be ObjCCallbackFunction is now 
+        ObjCCallbackFunctionImpl. It handles the Objective-C specific parts of managing callback functions.
+        (JSC::ObjCCallbackFunctionImpl::~ObjCCallbackFunctionImpl):
+        (JSC::objCCallbackFunctionCallAsFunction): Same as the old one, but now it casts to ObjCCallbackFunction and grabs the impl 
+        rather than using JSObjectGetPrivate.
+        (JSC::ObjCCallbackFunction::ObjCCallbackFunction): New bits to allow being part of the JSCell hierarchy.
+        (JSC::ObjCCallbackFunction::create):
+        (JSC::ObjCCallbackFunction::destroy):
+        (JSC::ObjCCallbackFunctionImpl::call): Handles the actual invocation, just like it used to.
+        (objCCallbackFunctionForInvocation):
+        (tryUnwrapBlock): Changed to check the ClassInfo for inheritance directly, rather than going through the C API call.
+        * API/tests/testapi.mm: Added new test to make sure that doing Function.prototype.toString.call(f) won't result in 
+        an error when f is an Objective-C method or block underneath the covers.
+        * runtime/JSGlobalObject.cpp: Added new Structure for ObjCCallbackFunction.
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::objcCallbackFunctionStructure):
+
+2013-03-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Nested dictionaries are not converted properly in the Objective-C binding
+        https://bugs.webkit.org/show_bug.cgi?id=112377
+
+        Reviewed by Oliver Hunt.
+
+        Accidental reassignment of the root task in the container conversion logic was causing the last 
+        array or dictionary processed to be returned in the case of nested containers.
+
+        * API/JSValue.mm:
+        (containerValueToObject):
+        * API/tests/testapi.mm:
+
+2013-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject fast by-string access optimizations should work even on the prototype chain, and even when the result is undefined
+        https://bugs.webkit.org/show_bug.cgi?id=112233
+
+        Reviewed by Oliver Hunt.
+        
+        Extended the existing fast access path for String keys to work over the entire prototype chain,
+        not just the self access case. This will fail as soon as it sees an object that intercepts
+        getOwnPropertySlot, so this patch also ensures that ObjectPrototype does not fall into that
+        category. This is accomplished by making ObjectPrototype eagerly reify all of its properties.
+        This is safe for ObjectPrototype because it's so common and we expect all of its properties to
+        be reified for any interesting programs anyway. A new idiom for adding native functions to
+        prototypes is introduced, which ought to work well for any other prototypes that we wish to do
+        this conversion for.
+        
+        This is a >60% speed-up in the case that you frequently do by-string lookups that "miss", i.e.
+        they don't turn up anything.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * dfg/DFGOperations.cpp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::objectConstructorTable):
+        * jit/JITStubs.cpp:
+        (JSC::getByVal):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getByStringSlow):
+        (JSC):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSCellInlines.h:
+        (JSC):
+        (JSC::JSCell::getByStringAndKey):
+        (JSC::JSCell::getByString):
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectNativeFunction):
+        (JSC):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/ObjectPrototype.cpp:
+        (JSC):
+        (JSC::ObjectPrototype::finishCreation):
+        (JSC::ObjectPrototype::create):
+        * runtime/ObjectPrototype.h:
+        (ObjectPrototype):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::findWithString):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+        (JSC):
+
+2013-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG bytecode parser is too aggressive about getting rid of GetLocals on captured variables
+        https://bugs.webkit.org/show_bug.cgi?id=112287
+        <rdar://problem/13342340>
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+
+2013-03-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Threaded HTML Parser is missing feature define flags in all but Chromium port's build files
+        https://bugs.webkit.org/show_bug.cgi?id=112277
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-03-13  Csaba Osztrogonác  <ossy@webkit.org>
+
+        LLINT C loop warning fix for GCC
+        https://bugs.webkit.org/show_bug.cgi?id=112145
+
+        Reviewed by Filip Pizlo.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+
+2013-02-13  Simon Hausmann  <simon.hausmann@digia.com>
+
+        Add support for convenient conversion from JSStringRef to QString
+        https://bugs.webkit.org/show_bug.cgi?id=109694
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        Add JSStringCopyQString helper function that allows for the convenient
+        extraction of a QString out of a JSStringRef.
+
+        * API/JSStringRefQt.cpp: Added.
+        (JSStringCopyQString):
+        * API/JSStringRefQt.h: Added.
+        * API/OpaqueJSString.h:
+        (OpaqueJSString):
+        (OpaqueJSString::qString):
+        (OpaqueJSString::OpaqueJSString):
+        * Target.pri:
+
+2013-03-13  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Token 'not' is ignored in the offlineasm.
+        https://bugs.webkit.org/show_bug.cgi?id=111568
+
+        Reviewed by Filip Pizlo.
+
+        * offlineasm/parser.rb: Build the Not AST node if the 'not' token is found.
+
+2013-03-12  Tim Horton  <timothy_horton@apple.com>
+
+        WTF uses macros for exports. Try to fix the Windows build. Unreviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Array.prototype.sort should at least try to be PTIME even when the array is in some bizarre mode
+        https://bugs.webkit.org/show_bug.cgi?id=112187
+        <rdar://problem/13393550>
+
+        Reviewed by Michael Saboff and Gavin Barraclough.
+        
+        If we have an array-like object in crazy mode passed into Array.prototype.sort, and its length is large,
+        then first copy all elements into a separate, compact, un-holy array and sort that. Then copy back.
+        This means that sorting will be at worst O(n^2) in the actual number of things in the array, rather than
+        O(n^2) in the array's length.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::attemptFastSort):
+        (JSC::performSlowSort):
+        (JSC):
+        (JSC::arrayProtoFuncSort):
+
+2013-03-12  Tim Horton  <timothy_horton@apple.com>
+
+        Try to fix the Windows build.
+
+        Not reviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-03-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        Not reviewed.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        Export a thing.
+
+2013-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Harden JSStringJoiner
+        https://bugs.webkit.org/show_bug.cgi?id=112093
+
+        Reviewed by Filip Pizlo.
+
+        Harden JSStringJoiner, make it use our CheckedArithmetic
+        class to simplify everything.
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::build):
+        * runtime/JSStringJoiner.h:
+        (JSStringJoiner):
+        (JSC::JSStringJoiner::JSStringJoiner):
+        (JSC::JSStringJoiner::append):
+
+2013-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG generic array access cases should not be guarded by CheckStructure even of the profiling tells us that it could be
+        https://bugs.webkit.org/show_bug.cgi?id=112183
+
+        Reviewed by Oliver Hunt.
+        
+        Slight speed-up on string-unpack-code.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::findAndRemoveUnnecessaryStructureCheck):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+
+2013-03-12  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=112141
+        LLInt CLoop backend misses Double2Ints() on 32bit architectures
+
+        Reviewed by Filip Pizlo.
+
+        Implement Double2Ints() in CLoop backend of LLInt on 32bit architectures.
+
+        * llint/LowLevelInterpreter.cpp:
+        (LLInt):
+        (JSC::LLInt::Double2Ints):
+        * offlineasm/cloop.rb:
+
+2013-03-12  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Making more sophisticated cache flush on ARM Linux platform
+        https://bugs.webkit.org/show_bug.cgi?id=111854
+
+        Reviewed by Zoltan Herczeg.
+
+        The cache flush on ARM Linux invalidates whole pages
+        instead of just the required area.
+
+        * assembler/ARMAssembler.h:
+        (ARMAssembler):
+        (JSC::ARMAssembler::linuxPageFlush):
+        (JSC::ARMAssembler::cacheFlush):
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::linuxPageFlush):
+        (JSC::ARMv7Assembler::cacheFlush):
+
+2013-03-12  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Renaming the armv7.rb LLINT backend to arm.rb
+        https://bugs.webkit.org/show_bug.cgi?id=110565
+
+        Reviewed by Zoltan Herczeg.
+
+        This is the first step of a unified ARM backend for
+        all ARM 32 bit architectures in LLInt.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * LLIntOffsetsExtractor.pro:
+        * offlineasm/arm.rb: Copied from Source/JavaScriptCore/offlineasm/armv7.rb.
+        * offlineasm/armv7.rb: Removed.
+        * offlineasm/backends.rb:
+        * offlineasm/risc.rb:
+
+2013-03-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r145482): It broke 33 jsc tests and zillion layout tests on all platform
+        https://bugs.webkit.org/show_bug.cgi?id=112112
+
+        Reviewed by Oliver Hunt.
+
+        Rolling out https://trac.webkit.org/changeset/145482 to unbreak the bots.
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::build):
+        * runtime/JSStringJoiner.h:
+        (JSStringJoiner):
+        (JSC::JSStringJoiner::JSStringJoiner):
+        (JSC::JSStringJoiner::append):
+
+2013-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG prediction propagation phase should not rerun forward propagation if double voting has already converged
+        https://bugs.webkit.org/show_bug.cgi?id=111920
+
+        Reviewed by Oliver Hunt.
+        
+        I don't know why we weren't exiting early after double voting if !m_changed.
+        
+        This change also removes backwards propagation from the voting fixpoint, since at that
+        point short-circuiting loops is probably not particularly profitable. Profiling shows
+        that this reduces the time spent in prediction propagation even further.
+        
+        This change appears to be a 1% SunSpider speed-up.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::run):
+
+2013-03-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG overflow check elimination is too smart for its own good
+        https://bugs.webkit.org/show_bug.cgi?id=111832
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+        
+        Rolling this back in after fixing accidental misuse of JSValue. The code was doing value < someInt
+        rather than value.asInt32() < someInt. This "worked" when isWithinPowerOfTwo wasn't templatized.
+        It worked by always being false and always disabling the relvant optimization.
+        
+        This improves overflow check elimination in three ways:
+        
+        1) It reduces the amount of time the compiler will spend doing it.
+        
+        2) It fixes bugs where overflow check elimination was overzealous. Precisely, for a binary operation
+           over @a and @b where both @a and @b will type check that their inputs (@a->children, @b->children)
+           are int32's and then perform a possibly-overflowing operation, we must be careful not to assume
+           that @a's non-int32 parts don't matter if at the point that @a runs we have as yet not proved that
+           @b->children are int32's and that hence @b might produce a large enough result that doubles would
+           start chopping low bits. The specific implication of this is that for a binary operation to not
+           propagate that it cares about non-int32 parts (NodeUsedAsNumber), we must prove that at least one
+           of the inputs is guaranteed to produce a result within 2^32 and that there won't be a tower of such
+           operations large enough to ultimately produce a double greater than 2^52 (roughly). We achieve the
+           latter by disabling this optimization for very large basic blocks. It's noteworthy that blocks that
+           large won't even make it into the DFG currently.
+        
+        3) It makes the overflow check elimination more precise for cases where the inputs to an Add or Sub
+           are the outputs of a bit-op. For example in (@a + (@b | 0)) | 0, we don't need to propagate
+           NodeUsedAsNumber to either @a or @b.
+        
+        This is neutral on V8v7 and a slight speed-up on compile time benchmarks.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGBackwardsPropagationPhase.cpp: Added.
+        (DFG):
+        (BackwardsPropagationPhase):
+        (JSC::DFG::BackwardsPropagationPhase::BackwardsPropagationPhase):
+        (JSC::DFG::BackwardsPropagationPhase::run):
+        (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
+        (JSC::DFG::BackwardsPropagationPhase::isNotZero):
+        (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoForConstant):
+        (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoNonRecursive):
+        (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
+        (JSC::DFG::BackwardsPropagationPhase::mergeDefaultFlags):
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        (JSC::DFG::performBackwardsPropagation):
+        * dfg/DFGBackwardsPropagationPhase.h: Added.
+        (DFG):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::run):
+        (JSC::DFG::CPSRethreadingPhase::clearIsLoadedFrom):
+        (CPSRethreadingPhase):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        (DFG):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeIsLoadedFrom):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::setIsLoadedFrom):
+        (JSC::DFG::VariableAccessData::isLoadedFrom):
+
+2013-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Harden JSStringJoiner
+        https://bugs.webkit.org/show_bug.cgi?id=112093
+
+        Reviewed by Filip Pizlo.
+
+        Harden JSStringJoiner, make it use our CheckedArithmetic
+        class to simplify everything.
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::build):
+        * runtime/JSStringJoiner.h:
+        (JSStringJoiner):
+        (JSC::JSStringJoiner::JSStringJoiner):
+        (JSC::JSStringJoiner::append):
+
+2013-03-11  Michael Saboff  <msaboff@apple.com>
+
+        Crash beneath operationCreateInlinedArguments running fast/js/dfg-create-inlined-arguments-in-closure-inline.html (32-bit only)
+        https://bugs.webkit.org/show_bug.cgi?id=112067
+
+        Reviewed by Geoffrey Garen.
+
+        We weren't setting the tag in SetCallee.  Therefore set it to CellTag.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Make SegmentedVector Noncopyable
+        https://bugs.webkit.org/show_bug.cgi?id=112059
+
+        Reviewed by Geoffrey Garen.
+
+        Copying a SegmentedVector is very expensive, and really shouldn't
+        be necessary.  So I've taken the one place where we currently copy
+        and replaced it with a regular Vector, and replaced the address
+        dependent logic with a indexing ref instead.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::newLabelScope):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/LabelScope.h:
+        (JSC):
+        (JSC::LabelScopePtr::LabelScopePtr):
+        (LabelScopePtr):
+        (JSC::LabelScopePtr::operator=):
+        (JSC::LabelScopePtr::~LabelScopePtr):
+        (JSC::LabelScopePtr::operator*):
+        (JSC::LabelScopePtr::operator->):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+
+2013-03-10  Andreas Kling  <akling@apple.com>
+
+        SpeculativeJIT should use OwnPtr<SlowPathGenerator>.
+        <http://webkit.org/b/111942>
+
+        Reviewed by Anders Carlsson.
+
+        There's no need to include DFGSlowPathGenerator.h from the header as long as the destructor is out-of-line,
+        so let's use OwnPtr instead of raw pointers + deleteAllValues().
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::~SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2013-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r145299.
+        http://trac.webkit.org/changeset/145299
+        https://bugs.webkit.org/show_bug.cgi?id=111928
+
+        compilation failure with recent clang
+        (DFGBackwardsPropagationPhase.cpp:132:35: error: comparison of
+        constant 10 with expression of type 'bool' is always false)
+        (Requested by thorton on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGBackwardsPropagationPhase.cpp: Removed.
+        * dfg/DFGBackwardsPropagationPhase.h: Removed.
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::run):
+        (CPSRethreadingPhase):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        (DFG):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::isNotZero):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (VariableAccessData):
+
+2013-03-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG overflow check elimination is too smart for its own good
+        https://bugs.webkit.org/show_bug.cgi?id=111832
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+        
+        This improves overflow check elimination in three ways:
+        
+        1) It reduces the amount of time the compiler will spend doing it.
+        
+        2) It fixes bugs where overflow check elimination was overzealous. Precisely, for a binary operation
+           over @a and @b where both @a and @b will type check that their inputs (@a->children, @b->children)
+           are int32's and then perform a possibly-overflowing operation, we must be careful not to assume
+           that @a's non-int32 parts don't matter if at the point that @a runs we have as yet not proved that
+           @b->children are int32's and that hence @b might produce a large enough result that doubles would
+           start chopping low bits. The specific implication of this is that for a binary operation to not
+           propagate that it cares about non-int32 parts (NodeUsedAsNumber), we must prove that at least one
+           of the inputs is guaranteed to produce a result within 2^32 and that there won't be a tower of such
+           operations large enough to ultimately produce a double greater than 2^52 (roughly). We achieve the
+           latter by disabling this optimization for very large basic blocks. It's noteworthy that blocks that
+           large won't even make it into the DFG currently.
+        
+        3) It makes the overflow check elimination more precise for cases where the inputs to an Add or Sub
+           are the outputs of a bit-op. For example in (@a + (@b | 0)) | 0, we don't need to propagate
+           NodeUsedAsNumber to either @a or @b.
+        
+        This is neutral on V8v7 and a slight speed-up on compile time benchmarks.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGBackwardsPropagationPhase.cpp: Added.
+        (DFG):
+        (BackwardsPropagationPhase):
+        (JSC::DFG::BackwardsPropagationPhase::BackwardsPropagationPhase):
+        (JSC::DFG::BackwardsPropagationPhase::run):
+        (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
+        (JSC::DFG::BackwardsPropagationPhase::isNotZero):
+        (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoForConstant):
+        (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoNonRecursive):
+        (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
+        (JSC::DFG::BackwardsPropagationPhase::mergeDefaultFlags):
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        (JSC::DFG::performBackwardsPropagation):
+        * dfg/DFGBackwardsPropagationPhase.h: Added.
+        (DFG):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::run):
+        (JSC::DFG::CPSRethreadingPhase::clearIsLoadedFrom):
+        (CPSRethreadingPhase):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        (DFG):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeIsLoadedFrom):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::setIsLoadedFrom):
+        (JSC::DFG::VariableAccessData::isLoadedFrom):
+
+2013-03-08  Roger Fong  <roger_fong@apple.com>
+
+        Makefile fixes.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+
+2013-03-08  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Cache flush problem on ARMv7 JSC
+        https://bugs.webkit.org/show_bug.cgi?id=111441
+
+        Reviewed by Zoltan Herczeg.
+
+        Not proper cache flush causing random crashes on ARMv7 Linux with V8 tests.
+        The problem is similar to https://bugs.webkit.org/show_bug.cgi?id=77712.
+        Change the cache fulsh mechanism similar to ARM traditinal and revert the
+        temporary fix.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::cacheFlush):
+
+2013-03-07  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION (r143759): 40% JSBench regression, 20% Octane/closure regression, 40% Octane/jquery regression, 2% Octane regression
+        https://bugs.webkit.org/show_bug.cgi?id=111797
+
+        Reviewed by Oliver Hunt.
+
+        The bot's testing configuration stresses the cache's starting guess
+        of 1MB.
+
+        This patch removes any starting guess, and just uses wall clock time
+        to discover the initial working set size of an app, in code size.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCacheMap::pruneSlowCase): Update our timer as we go.
+
+        Also fixed a bug where pruning from 0 to 0 would hang -- that case is
+        a possibility now that we start with a capacity of 0.
+
+        * runtime/CodeCache.h:
+        (CodeCacheMap):
+        (JSC::CodeCacheMap::CodeCacheMap):
+        (JSC::CodeCacheMap::add):
+        (JSC::CodeCacheMap::prune): Don't prune if we're in the middle of
+        discovering the working set size of an app, in code size.
+
+2013-03-07  Michael Saboff  <msaboff@apple.com>
+
+        Crash when updating predictions below JSC::arrayProtoFuncForEach on tuaw.com article
+        https://bugs.webkit.org/show_bug.cgi?id=111777
+
+        Reviewed by Filip Pizlo.
+
+        Moved register allocations to be above any generated control flow so that any
+        resulting spill would be visible to all subsequently generated code.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not get corrupted IR in the case of code that is dead, unreachable, and contains a chain of nodes that use each other in an untyped way
+        https://bugs.webkit.org/show_bug.cgi?id=111783
+
+        Reviewed by Mark Hahnenberg.
+        
+        Unreachable code is not touched by CFA and so thinks that even untyped uses are checked.
+        But dead untyped uses don't need checks and hence don't need to be Phantom'd. The DCE knew
+        this in findTypeCheckRoot() but not in eliminateIrrelevantPhantomChildren(), leading to a
+        Phantom node that had another Phantom node as one of its kids.
+
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
+
+2013-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        The DFG fixpoint is not strictly profitable, and should be straight-lined
+        https://bugs.webkit.org/show_bug.cgi?id=111764
+
+        Reviewed by Oliver Hunt and Geoffrey Garen.
+        
+        The DFG previously ran optimizations to fixpoint because there exists a circular dependency:
+        
+        CSE depends on CFG simplification: CFG simplification merges blocks, and CSE is block-local.
+        
+        CFG simplification depends on CFA and constant folding: constant folding reveals branches on
+        constants.
+        
+        CFA depends on CSE: CSE reveals must-alias relationships by proving that two operations
+        always produce identical values.
+        
+        Arguments simplification also depends on CSE, but it ought not depend on anything else.
+        
+        Hence we get a cycle like: CFA -> folding -> CFG -> CSE -> CFA.
+        
+        Note that before we had sparse conditional CFA, we also had CFA depending on CFG. This ought
+        not be the case anymore: CFG simplification should not by itself lead to better CFA results.
+        
+        My guess is that the weakest link in this cycle is CFG -> CSE. CSE cuts both ways: if you
+        CSE too much then you increase register pressure. Hence it's not clear that you always want
+        to CSE after simplifying control flow. This leads to an order of optimization as follows:
+        
+        CSE -> arguments -> CFA -> folding -> CFG
+        
+        This is a 2.5% speed-up on SunSpider, a 4% speed-up on V8Spider, a possible 0.3% slow-down
+        on V8v7, nothing on Kraken, and 1.2% speed-up in the JSRegress geomean. I'll take a 2.5%
+        speed-up over a 0.3% V8v7 speed-up.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+
+2013-03-07  Roger Fong  <roger_fong@apple.com>
+
+        Build fix for AppleWin VS2010.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2013-03-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Need a good way to reference event handlers without causing cycles
+        https://bugs.webkit.org/show_bug.cgi?id=111088
+
+        Reviewed by Geoffrey Garen.
+
+        JSManagedValue is like a special kind of weak value. When you create a JSManagedValue, you can
+        supply an Objective-C object as its "owner". As long as the Objective-C owner object remains
+        alive and its wrapper remains accessible to the JSC garbage collector (e.g. by being marked by 
+        the global object), the reference to the JavaScript value is strong. As soon as the Objective-C
+        owner is deallocated or its wrapper becomes inaccessible to the garbage collector, the reference
+        becomes weak.
+
+        If you do not supply an owner or you use the weakValueWithValue: convenience class method, the
+        returned JSManagedValue behaves as a normal weak reference.
+
+        This new class allows clients to maintain references to JavaScript values in the Objective-C
+        heap without creating reference cycles/leaking memory.
+
+        * API/JSAPIWrapperObject.cpp: Added.
+        (JSC):
+        (JSC::::createStructure):
+        (JSC::JSAPIWrapperObject::JSAPIWrapperObject): This is a special JSObject for the Objective-C API that knows
+        for the purposes of garbage collection/marking that it wraps an opaque Objective-C object.
+        (JSC::JSAPIWrapperObject::visitChildren): We add the pointer to the wrapped Objective-C object to the set of
+        opaque roots so that the weak handle owner for JSManagedValues can find it later.
+        * API/JSAPIWrapperObject.h: Added.
+        (JSC):
+        (JSAPIWrapperObject):
+        (JSC::JSAPIWrapperObject::wrappedObject):
+        (JSC::JSAPIWrapperObject::setWrappedObject):
+        * API/JSBase.cpp:
+        (JSSynchronousGarbageCollect):
+        * API/JSBasePrivate.h:
+        * API/JSCallbackObject.cpp:
+        (JSC):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::destroy): Moved this to the header so that we don't get link errors with JSAPIWrapperObject.
+        * API/JSContext.mm:
+        (-[JSContext initWithVirtualMachine:]): We weren't adding manually allocated/initialized JSVirtualMachine objects to 
+        the global cache of virtual machines. The init methods handle this now rather than contextWithGlobalContextRef, since 
+        not everyone is guaranteed to use the latter.
+        (-[JSContext initWithGlobalContextRef:]):
+        (+[JSContext contextWithGlobalContextRef:]):
+        * API/JSManagedValue.h: Added.
+        * API/JSManagedValue.mm: Added.
+        (JSManagedValueHandleOwner):
+        (managedValueHandleOwner):
+        (+[JSManagedValue weakValueWithValue:]):
+        (+[JSManagedValue managedValueWithValue:owner:]):
+        (-[JSManagedValue init]): We explicitly call the ARC entrypoints to initialize/get the weak owner field since we don't 
+        use ARC when building our framework.
+        (-[JSManagedValue initWithValue:]):
+        (-[JSManagedValue initWithValue:owner:]):
+        (-[JSManagedValue dealloc]):
+        (-[JSManagedValue value]):
+        (-[JSManagedValue weakOwner]):
+        (JSManagedValueHandleOwner::isReachableFromOpaqueRoots): If the Objective-C owner is still alive (i.e. loading the weak field
+        returns non-nil) and that value was added to the set of opaque roots by the wrapper for that Objective-C owner, then the the 
+        JSObject to which the JSManagedObject refers is still alive.
+        * API/JSObjectRef.cpp: We have to add explicit checks for the JSAPIWrapperObject, just like the other types of JSCallbackObjects.
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSValue.mm:
+        (objectToValueWithoutCopy):
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass):
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine initWithContextGroupRef:]):
+        (+[JSVirtualMachine virtualMachineWithContextGroupRef:]):
+        * API/JSWrapperMap.mm:
+        (wrapperFinalize):
+        (makeWrapper): This is our own internal version of JSObjectMake which creates JSAPIWrapperObjects, the Obj-C API 
+        version of JSCallbackObjects.
+        (createObjectWithCustomBrand):
+        (-[JSObjCClassInfo wrapperForObject:]):
+        (tryUnwrapObjcObject):
+        * API/JavaScriptCore.h:
+        * API/tests/testapi.mm: Added new tests for the strong and weak uses of JSManagedValue in the context of an 
+        onclick handler for an Objective-C object inserted into a JSContext.
+        (-[TextXYZ setWeakOnclick:]):
+        (-[TextXYZ setOnclick:]):
+        (-[TextXYZ weakOnclick]):
+        (-[TextXYZ onclick]):
+        (-[TextXYZ click]):
+        * CMakeLists.txt: Various build system additions.
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalObject.cpp: Added the new canonical Structure for the JSAPIWrapperObject class.
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::objcWrapperObjectStructure):
+
+2013-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        ConvertThis should be turned into Identity based on predictions in Fixup, rather than based on proofs in ConstantFolding
+        https://bugs.webkit.org/show_bug.cgi?id=111674
+
+        Reviewed by Oliver Hunt.
+        
+        This gets rid of the speculated forms of ConvertThis in the backend, and has Fixup
+        convert them to either Identity(Object:@child) if the child is predicted object, or
+        Phantom(Other:@child) ; WeakJSConstant(global this object) if it's predicted Other.
+        
+        The goal of this is to ensure that the optimization fixpoint doesn't create
+        Identity's, since doing so requires a rerun of CSE. So far this isn't a speed-up
+        but I'm hoping this will be a step towards reducing the need to rerun the fixpoint
+        so as to ultimately reduce compile times.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGAssemblyHelpers.h:
+        (AssemblyHelpers):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::globalThisObjectFor):
+        (Graph):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::convertToIdentity):
+        (JSC::DFG::Node::convertToWeakConstant):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-03-07  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Children method in LLINT AST Not class should return [@child]
+        https://bugs.webkit.org/show_bug.cgi?id=90740
+
+        Reviewed by Filip Pizlo.
+
+        * offlineasm/ast.rb: Fixed the return value of the children method in the Not AST class.
+
+2013-03-05  Oliver Hunt  <oliver@apple.com>
+
+        Bring back eager resolution of function scoped variables
+        https://bugs.webkit.org/show_bug.cgi?id=111497
+
+        Reviewed by Geoffrey Garen.
+
+        This reverts the get/put_scoped_var part of the great non-local
+        variable resolution refactoring.  This still leaves all the lazy
+        variable resolution logic as it's necessary for global property
+        resolution, and i don't want to make the patch bigger than it
+        already is.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC):
+        (UnlinkedFunctionExecutable):
+        (UnlinkedCodeBlock):
+        (JSC::UnlinkedCodeBlock::usesGlobalObject):
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister):
+        (JSC::UnlinkedCodeBlock::globalObjectRegister):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetStaticVar):
+        (JSC::BytecodeGenerator::emitPutStaticVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ResolveResult::lexicalResolve):
+        (JSC::ResolveResult::isStatic):
+        (JSC::ResolveResult::depth):
+        (JSC::ResolveResult::index):
+        (ResolveResult):
+        (JSC::ResolveResult::ResolveResult):
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::debugFail):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC):
+        (JSC::JIT::emit_op_put_scoped_var):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC):
+        (JSC::JIT::emit_op_put_scoped_var):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        * runtime/CodeCache.h:
+        (JSC):
+        (CodeCache):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+
+2013-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/144989
+        
+        I think we want the assertion that I removed.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::merge):
+        (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+
+2013-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::AbstractState::merge() is still more complicated than it needs to be
+        https://bugs.webkit.org/show_bug.cgi?id=111619
+
+        Reviewed by Mark Hahnenberg.
+        
+        This method is the one place where we still do some minimal amount of liveness pruning, but the style with
+        which it is written is awkward, and it makes an assertion about variablesAtTail that will be invalidated
+        by https://bugs.webkit.org/show_bug.cgi?id=111539.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::merge):
+        (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+
+2013-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not run full CSE after the optimization fixpoint, since it really just wants store elimination
+        https://bugs.webkit.org/show_bug.cgi?id=111536
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        The fixpoint will do aggressive load elimination and pure CSE. There's no need to do it after the fixpoint.
+        On the other hand, the fixpoint does not profit from doing store elimination (except for SetLocal/Flush).
+        Previously we had CSE do both, and had it avoid doing some store elimination during the fixpoint by querying
+        the fixpoint state. This changes CSE to be templated on mode - either NormalCSE or StoreElimination - so
+        that we explicitly put it into one of those modes depending on where we call it from. The goal is to reduce
+        time spent doing load elimination after the fixpoint, since that is just wasted cycles.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (JSC::DFG::CSEPhase::run):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        (JSC::DFG::performCSE):
+        (DFG):
+        (JSC::DFG::performStoreElimination):
+        * dfg/DFGCSEPhase.h:
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+
+2013-03-06  Andreas Kling  <akling@apple.com>
+
+        Pack Structure members better.
+        <http://webkit.org/b/111593>
+        <rdar://problem/13359200>
+
+        Reviewed by Mark Hahnenberg.
+
+        Shrink Structure by 8 bytes (now at 104 bytes) on 64-bit by packing the members better.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+        (Structure):
+
+2013-03-06  Andreas Kling  <akling@apple.com>
+
+        Unreviewed, fix Windows build after r144910.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2013-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not check if nodes are shouldGenerate prior to DCE
+        https://bugs.webkit.org/show_bug.cgi?id=111520
+
+        Reviewed by Geoffrey Garen.
+        
+        All nodes are live before DCE. We don't need to check that they aren't, because they
+        definitely will be.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::int32ToDoubleCSE):
+        (JSC::DFG::CSEPhase::constantCSE):
+        (JSC::DFG::CSEPhase::weakConstantCSE):
+        (JSC::DFG::CSEPhase::getCalleeLoadElimination):
+        (JSC::DFG::CSEPhase::getArrayLengthElimination):
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
+        (JSC::DFG::CSEPhase::globalVarStoreElimination):
+        (JSC::DFG::CSEPhase::scopedVarStoreElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2013-03-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix unused parameter warnings in ARM assembler
+        https://bugs.webkit.org/show_bug.cgi?id=111433
+
+        Reviewed by Kentaro Hara.
+
+        * assembler/ARMAssembler.h: Remove unreachable revertJump() after r143346.
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::moveIntsToDouble): Remove unused scratch parameter instead of UNUSED_PARAM.
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32): Remove unused fpTemp parameter.
+        (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch): Remove unused parameters.
+
+2013-03-06  Andreas Kling  <akling@apple.com>
+
+        Unused Structure property tables waste 14MB on Membuster.
+        <http://webkit.org/b/110854>
+        <rdar://problem/13292104>
+
+        Reviewed by Geoffrey Garen.
+
+        Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
+        14 MB progression on Membuster3.
+
+        This time it should stick; I've been through all the tests with COLLECT_ON_EVERY_ALLOCATION.
+        The issue with the last version was that Structure::m_offset could be used uninitialized
+        when re-materializing a previously GC'd property table, causing some sanity checks to fail.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+
+            Added PropertyTable.cpp.
+
+        * runtime/PropertyTable.cpp: Added.
+        (JSC::PropertyTable::create):
+        (JSC::PropertyTable::clone):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::destroy):
+        (JSC::PropertyTable::~PropertyTable):
+        (JSC::PropertyTable::visitChildren):
+
+            Moved marking of property table values here from Structure::visitChildren().
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::get):
+
+            Move m_cell to a local before using it multiple times. This avoids a multiple-access race when
+            Structure::checkOffsetConsistency() is used in assertions on the main thread while a marking thread
+            zaps the property table.
+
+        * runtime/Structure.h:
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::propertyTable):
+
+            Added a getter for the Structure's PropertyTable that ASSERTs GC currently isn't active.
+            Because GC can zap an unpinned property table at any time, it's not entirely safe to access it.
+            Renamed the variable itself to m_propertyTableUnsafe to force call sites into explaining themselves.
+
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::checkOffsetConsistency):
+
+            Moved these out of Structure.h to break header dependency cycle between Structure/PropertyTable.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+
+            Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.
+
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+
+            Added for setting up the property table in a new transition, this code is now shared between
+            addPropertyTransition() and nonPropertyTransition().
+
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+            Add a global propertyTableStructure.
+
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::createStructure):
+        (JSC::PropertyTable::copy):
+
+            Make PropertyTable a GC object.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::pin):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        (JSC::Structure::checkConsistency):
+
+2013-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of the invert argument to SpeculativeJIT::jumpSlowForUnwantedArrayMode
+        https://bugs.webkit.org/show_bug.cgi?id=105624
+
+        Reviewed by Oliver Hunt.
+        
+        All callers pass invert = false, which is the default value of the argument. So, get
+        rid of the argument and fold away all code that checks it.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2013-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix an incorrect comment. The comment was a holdover from a work-in-progress version of this code.
+
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+
+2013-03-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG DCE might eliminate checks unsoundly
+        https://bugs.webkit.org/show_bug.cgi?id=109389
+
+        Reviewed by Oliver Hunt.
+        
+        This gets rid of all eager reference counting, and does all dead code elimination
+        in one phase - the DCEPhase. This phase also sets up the node reference counts,
+        which are then used not just for DCE but also register allocation and stack slot
+        allocation.
+        
+        Doing this required a number of surgical changes in places that previously relied
+        on always having liveness information. For example, the structure check hoisting
+        phase must now consult whether a VariableAccessData is profitable for unboxing to
+        make sure that it doesn't try to do hoisting on set SetLocals. The arguments
+        simplification phase employs its own light-weight liveness analysis. Both phases
+        previously just used reference counts.
+        
+        The largest change is that now, dead nodes get turned into Phantoms. Those
+        Phantoms will retain those child edges that are not proven. This ensures that any
+        type checks performed by a dead node remain even after the node is killed. On the
+        other hand, this Phantom conversion means that we need special handling for
+        SetLocal. I decided to make the four forms of SetLocal explicit:
+        
+        MovHint(@a, rK): Just indicates that node @a contains the value that would have
+             now been placed into virtual register rK. Does not actually cause @a to be
+             stored into rK. This would have previously been a dead SetLocal with @a
+             being live. MovHints are always dead.
+        
+        ZombieHint(rK): Indicates that at this point, register rK will contain a dead
+             value and OSR should put Undefined into it. This would have previously been
+             a dead SetLocal with @a being dead also. ZombieHints are always dead.
+        
+        MovHintAndCheck(@a, rK): Identical to MovHint except @a is also type checked,
+             according to whatever UseKind the edge to @a has. The type check is always a
+             forward exit. MovHintAndChecks are always live, since they are
+             NodeMustGenerate. Previously this would have been a dead SetLocal with a
+             live @a, and the check would have disappeared. This is one of the bugs that
+             this patch solves.
+        
+        SetLocal(@a, rK): This still does exactly what it does now, if the SetLocal is
+             live.
+        
+        Basically this patch makes it so that dead SetLocals eventually decay to MovHint,
+        ZombieHint, or MovHintAndCheck depending on the situation. If the child @a is
+        also dead, then you get a ZombieHint. If the child @a is live but the SetLocal
+        has a type check and @a's type hasn't been proven to have that type then you get
+        a MovHintAndCheck. Otherwise you get a MovHint.
+        
+        This is performance neutral.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (ArgumentsSimplificationPhase):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGBasicBlock.h:
+        (BasicBlock):
+        * dfg/DFGBasicBlockInlines.h:
+        (DFG):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::insertPhiNode):
+        (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::run):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::run):
+        (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCommon.cpp:
+        (WTF::printInternal):
+        (WTF):
+        * dfg/DFGCommon.h:
+        (WTF):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
+        * dfg/DFGDCEPhase.cpp: Added.
+        (DFG):
+        (DCEPhase):
+        (JSC::DFG::DCEPhase::DCEPhase):
+        (JSC::DFG::DCEPhase::run):
+        (JSC::DFG::DCEPhase::findTypeCheckRoot):
+        (JSC::DFG::DCEPhase::countEdge):
+        (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
+        (JSC::DFG::performDCE):
+        * dfg/DFGDCEPhase.h: Added.
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        (JSC::DFG::FixupPhase::truncateConstantToInt32):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dump):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::changeChild):
+        (JSC::DFG::Graph::changeEdge):
+        (JSC::DFG::Graph::compareAndSwap):
+        (JSC::DFG::Graph::clearAndDerefChild):
+        (JSC::DFG::Graph::performSubstitution):
+        (JSC::DFG::Graph::performSubstitutionForEdge):
+        (Graph):
+        (JSC::DFG::Graph::substitute):
+        * dfg/DFGInsertionSet.h:
+        (InsertionSet):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::convertToConstant):
+        (JSC::DFG::Node::convertToGetLocalUnlinked):
+        (JSC::DFG::Node::containsMovHint):
+        (Node):
+        (JSC::DFG::Node::hasVariableAccessData):
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compileMovHintAndCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::shouldConsiderForHoisting):
+        (StructureCheckHoistingPhase):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+
+2013-03-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: JSValue should implement init and return nil in exceptional cases
+        https://bugs.webkit.org/show_bug.cgi?id=111487
+
+        Reviewed by Darin Adler.
+
+        * API/JSValue.mm:
+        (-[JSValue init]): We return nil here because there is no way to get the instance into a coherent state
+        without a JSContext.
+        (-[JSValue initWithValue:inContext:]): Similarly, we should also return nil here if either of the arguments is 0.
+
+2013-03-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r144708.
+        http://trac.webkit.org/changeset/144708
+        https://bugs.webkit.org/show_bug.cgi?id=111447
+
+        random assertion crashes in inspector tests on qt+mac bots
+        (Requested by kling on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC):
+        (JSC::PropertyTable::~PropertyTable):
+        (JSC::PropertyTable::copy):
+        * runtime/PropertyTable.cpp: Removed.
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::pin):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        (JSC::Structure::visitChildren):
+        (JSC::Structure::checkConsistency):
+        * runtime/Structure.h:
+        (JSC):
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+        (JSC::Structure::checkOffsetConsistency):
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::get):
+
+2013-03-05  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX (r144698): Only enable SPEECH_SYNTHESIS for Mac
+        <http://webkit.org/b/106742>
+
+        Fixes the following build failures:
+
+            Undefined symbols for architecture i386:
+              "__ZTVN7WebCore25PlatformSpeechSynthesizerE", referenced from:
+                  __ZN7WebCore25PlatformSpeechSynthesizerC2EPNS_31PlatformSpeechSynthesizerClientE in PlatformSpeechSynthesizer.o
+              NOTE: a missing vtable usually means the first non-inline virtual member function has no definition.
+              "__ZN7WebCore25PlatformSpeechSynthesizer19initializeVoiceListEv", referenced from:
+                  __ZN7WebCore25PlatformSpeechSynthesizerC2EPNS_31PlatformSpeechSynthesizerClientE in PlatformSpeechSynthesizer.o
+            ld: symbol(s) not found for architecture i386
+
+        * Configurations/FeatureDefines.xcconfig:
+        - Fix definition of ENABLE_ENCRYPTED_MEDIA_V2_macosx to match
+          other FeatureDefines.xcconfig files.
+        - Only set ENABLE_SPEECH_SYNTHESIS for the macosx platform.
+
+2013-03-04  Andreas Kling  <akling@apple.com>
+
+        Unused Structure property tables waste 14MB on Membuster.
+        <http://webkit.org/b/110854>
+        <rdar://problem/13292104>
+
+        Reviewed by Geoffrey Garen.
+
+        Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
+        14 MB progression on Membuster3.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+
+            Added PropertyTable.cpp.
+
+        * runtime/PropertyTable.cpp: Added.
+        (JSC::PropertyTable::create):
+        (JSC::PropertyTable::clone):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::destroy):
+        (JSC::PropertyTable::~PropertyTable):
+        (JSC::PropertyTable::visitChildren):
+
+            Moved marking of property table values here from Structure::visitChildren().
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::get):
+
+            Move m_cell to a local before using it multiple times. This avoids a multiple-access race when
+            Structure::checkOffsetConsistency() is used in assertions on the main thread while a marking thread
+            zaps the property table.
+
+        * runtime/Structure.h:
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::propertyTable):
+
+            Added a getter for the Structure's PropertyTable that ASSERTs GC currently isn't active.
+            Because GC can zap an unpinned property table at any time, it's not entirely safe to access it.
+            Renamed the variable itself to m_propertyTableUnsafe to force call sites into explaining themselves.
+
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::checkOffsetConsistency):
+
+            Moved these out of Structure.h to break header dependency cycle between Structure/PropertyTable.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+
+            Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.
+
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+            Add a global propertyTableStructure.
+
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::createStructure):
+        (JSC::PropertyTable::copy):
+
+            Make PropertyTable a GC object.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::pin):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        (JSC::Structure::checkConsistency):
+
+2013-03-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Support WebSpeech - Speech Synthesis
+        https://bugs.webkit.org/show_bug.cgi?id=106742
+
+        Reviewed by Simon Fraser.
+
+        Enable speech synthesis for the Mac.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-03-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove contextInternalContext from JSContextInternal.h
+        https://bugs.webkit.org/show_bug.cgi?id=111356
+
+        Reviewed by Geoffrey Garen.
+
+        We don't need it any more since we have globalContextRef in JSContext.
+
+        * API/JSContext.mm:
+        * API/JSContextInternal.h:
+        * API/JSValue.mm:
+        (+[JSValue valueWithBool:inContext:]):
+        (+[JSValue valueWithDouble:inContext:]):
+        (+[JSValue valueWithInt32:inContext:]):
+        (+[JSValue valueWithUInt32:inContext:]):
+        (+[JSValue valueWithNewObjectInContext:]):
+        (+[JSValue valueWithNewArrayInContext:]):
+        (+[JSValue valueWithNewRegularExpressionFromPattern:flags:inContext:]):
+        (+[JSValue valueWithNewErrorFromMessage:inContext:]):
+        (+[JSValue valueWithNullInContext:]):
+        (+[JSValue valueWithUndefinedInContext:]):
+        (-[JSValue toBool]):
+        (-[JSValue toDouble]):
+        (-[JSValue toNumber]):
+        (-[JSValue toString]):
+        (-[JSValue toDate]):
+        (-[JSValue toArray]):
+        (-[JSValue toDictionary]):
+        (-[JSValue valueForProperty:]):
+        (-[JSValue setValue:forProperty:]):
+        (-[JSValue deleteProperty:]):
+        (-[JSValue hasProperty:]):
+        (-[JSValue valueAtIndex:]):
+        (-[JSValue setValue:atIndex:]):
+        (-[JSValue isUndefined]):
+        (-[JSValue isNull]):
+        (-[JSValue isBoolean]):
+        (-[JSValue isNumber]):
+        (-[JSValue isString]):
+        (-[JSValue isObject]):
+        (-[JSValue isEqualToObject:]):
+        (-[JSValue isEqualWithTypeCoercionToObject:]):
+        (-[JSValue isInstanceOf:]):
+        (-[JSValue callWithArguments:]):
+        (-[JSValue constructWithArguments:]):
+        (-[JSValue invokeMethod:withArguments:]):
+        (valueToObject):
+        (objectToValueWithoutCopy):
+        (objectToValue):
+        (-[JSValue initWithValue:inContext:]):
+        (-[JSValue dealloc]):
+        (-[JSValue description]):
+        * API/JSWrapperMap.mm:
+        (createObjectWithCustomBrand):
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
+        (-[JSObjCClassInfo wrapperForObject:]):
+        (-[JSWrapperMap jsWrapperForObject:]):
+        * API/ObjCCallbackFunction.mm:
+        (ObjCCallbackFunction::call):
+        (objCCallbackFunctionForInvocation):
+
+2013-03-04  Andreas Kling  <akling@apple.com>
+
+        Add simple vector traits for JSC::Identifier.
+        <http://webkit.org/b/111323>
+
+        Reviewed by Geoffrey Garen.
+
+        Identifiers are really just Strings, giving them simple vector traits makes
+        Vector move them with memcpy() instead of churning the refcounts.
+
+        * runtime/Identifier.h:
+        (WTF):
+
+2013-03-04  Kunihiko Sakamoto  <ksakamoto@chromium.org>
+
+        Add build flag for FontLoader
+        https://bugs.webkit.org/show_bug.cgi?id=111289
+
+        Reviewed by Benjamin Poulain.
+
+        Add ENABLE_FONT_LOAD_EVENTS build flag (disabled by default).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-03-03  Andreas Kling  <akling@apple.com>
+
+        Shrink JSC::HashTable entries.
+        <http://webkit.org/b/111275>
+        <rdar://problem/13333511>
+
+        Reviewed by Anders Carlsson.
+
+        Move the Intrinsic value out of the function-specific part of the union,
+        and store it next to m_attributes. Reduces the size of HashEntry by 8 bytes.
+
+        990 kB progression on Membuster3. (PTUS: 797 kB)
+
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::intrinsic):
+        (HashEntry):
+
+2013-03-01  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: testapi should link to Foundation, not CoreFoundation
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Change testapi to
+        link to Foundation.framework instead of CoreFoundation.framework
+        since it uses NS types.
+
+2013-03-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Passing JS functions to Objective-C callbacks causes JSValue to leak
+        https://bugs.webkit.org/show_bug.cgi?id=107836
+
+        Reviewed by Oliver Hunt.
+
+        We've decided to remove support for this feature from the API because there's no way to automatically manage 
+        the memory for clients in a satisfactory manner. Clients can still pass JS functions to Objective-C methods, 
+        but the methods must accept plain JSValues instead of Objective-C blocks.
+
+        We now ignore functions that are part of a protocol that inherits from JSExport that accept blocks as arguments.
+
+        * API/JSBlockAdaptor.h: Removed.
+        * API/JSBlockAdaptor.mm: Removed.
+        * API/ObjCCallbackFunction.mm:
+        (ArgumentTypeDelegate::typeBlock): Return nil to signal that we want to ignore this function when copying it
+        to the object from the protocol.
+        * API/tests/testapi.mm: Added a test to make sure that we ignore methods declared as part of a JSExport-ed protocol
+        that have block arguments.
+        (-[TestObject bogusCallback:]):
+        * JavaScriptCore.gypi: Updated build files.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Branch(LogicalNot) peephole should not try to optimize and work-around the case where LogicalNot may be otherwise live
+        https://bugs.webkit.org/show_bug.cgi?id=111209
+
+        Reviewed by Oliver Hunt.
+        
+        Even if it is then everything will work just fine. It's not necessary to check the ref count here.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2013-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE phase shouldn't rely on ref count of nodes, since it doesn't have to
+        https://bugs.webkit.org/show_bug.cgi?id=111205
+
+        Reviewed by Oliver Hunt.
+        
+        I don't understand the intuition behind setLocalStoreElimination() validating that the SetLocal's ref count
+        is 1. I believe this is a hold-over from when setLocalStoreElimination() would match one SetLocal to another,
+        and then try to eliminate the first SetLocal. But that's not how it works now. Now, setLocalStoreElimination()
+        is actually Flush elimination: it eliminates any Flush that anchors a SetLocal if it proves that every path
+        from the SetLocal to the Flush is devoid of operations that may observe the local. It doesn't actually kill
+        the SetLocal itself: if the SetLocal is live because of other things (other Flushes or GetLocals in other
+        basic blocks), then the SetLocal will naturally still be alive because th Flush was only keeping the SetLocal
+        alive by one count rather than being solely responsible for its liveness.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+
+2013-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename MovHint to MovHintEvent so I can create a NodeType called MovHint
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        This is similar to the SetLocal/SetLocalEvent naming scheme, where SetLocal is the
+        NodeType and SetLocalEvent is the VariableEventKind.
+
+        * dfg/DFGVariableEvent.cpp:
+        (JSC::DFG::VariableEvent::dump):
+        * dfg/DFGVariableEvent.h:
+        (JSC::DFG::VariableEvent::movHint):
+        (JSC::DFG::VariableEvent::id):
+        (JSC::DFG::VariableEvent::operand):
+        (VariableEvent):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+
+2013-03-01  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [JSC] Fix sign comparison warning/error after r144340.
+        https://bugs.webkit.org/show_bug.cgi?id=111164
+
+        Reviewed by Mark Hahnenberg.
+
+        gcc (both 4.2.1 and 4.7.2) complain about comparing signed and
+        unsigned terms (clang accepts it just fine).
+
+        Work around that by casting the 1 to an uintptr_t as well.
+
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::makeWord):
+
+2013-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA should not do liveness pruning
+        https://bugs.webkit.org/show_bug.cgi?id=111119
+
+        Reviewed by Mark Hahnenberg.
+        
+        It adds complexity and probably buys nothing.  Moreover, I'm transitioning to having
+        liveness only available at the bitter end of compilation, so this will stop working
+        after https://bugs.webkit.org/show_bug.cgi?id=109389 anyway.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+
+2013-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't try to emit profiling if you don't have the DFG JIT.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * jit/JIT.h:
+        (JSC::JIT::shouldEmitProfiling):
+
+2013-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Phantom node should be honest about the fact that it can exit
+        https://bugs.webkit.org/show_bug.cgi?id=111115
+
+        Reviewed by Mark Hahnenberg.
+        
+        The chances of this having cause serious issues are low, since most clients of the
+        NodeDoesNotExit flag run after CFA and CFA updates this properly. But one possible
+        case of badness is if the ByteCodeParser inserted a Phantom with a type check in
+        between a LogicalNot and a Branch; then that peephole optimization in Fixup might
+        go slightly wrong.
+
+        * dfg/DFGNodeType.h:
+        (DFG):
+
+2013-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add casts in DFGGPRInfo.h to suppress warnings
+        https://bugs.webkit.org/show_bug.cgi?id=111104
+
+        Reviewed by Filip Pizlo.
+
+        With certain flags on, we get compiler warnings on ARM. We should do the proper casts to make these warnings go away.
+
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+
+2013-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be easy to determine if a DFG node exits forward or backward when doing type checks
+        https://bugs.webkit.org/show_bug.cgi?id=111102
+
+        Reviewed by Mark Hahnenberg.
+        
+        This adds a NodeExitsForward flag, which tells you the exit directionality of
+        type checks performed by the node. Even if you convert the node to a Phantom
+        and use the Edge UseKind for type checks, you'll still get the same exit
+        directionality that the original node would have wanted.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::setOpAndDefaultNonExitFlags):
+        (JSC::DFG::Node::convertToPhantom):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::backwardSpeculationCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::backwardTypeCheck):
+        (JSC::DFG::SpeculativeJIT::typeCheck):
+        (JSC::DFG::SpeculativeJIT::forwardTypeCheck):
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateIntegerOperand::gpr):
+        (SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateDoubleOperand::fpr):
+        (SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateCellOperand::gpr):
+        (SpeculateCellOperand):
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        (JSC::DFG::SpeculateBooleanOperand::gpr):
+        (SpeculateBooleanOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock::valueProfile() has a bogus assertion
+        https://bugs.webkit.org/show_bug.cgi?id=111106
+        <rdar://problem/13131427>
+
+        Reviewed by Mark Hahnenberg.
+        
+        This was just a bad assertion: m_bytecodeOffset == -1 means that the value profile is constructed but not initialized.
+        ValueProfile constructs itself in a safe way; you can call any method you want on a constructed but not initialized
+        ValueProfile. CodeBlock first constructs all ValueProfiles (by growing the ValueProfile vector) and then initializes
+        their m_bytecodeOffset later. This is necessary because the initialization is linking bytecode instructions to their
+        ValueProfiles, so at that point we don't want the ValueProfile vector to resize, which implies that we want all of
+        them to already be constructed. A GC can happen during this phase, and the GC may want to walk all ValueProfiles.
+        This is safe, but one of the ValueProfile getters (CodeBlock::valueProfile()) was asserting that any value profile
+        you get has had its m_bytecodeOffset initialized. This need not be the case and nothing will go wrong if it isn't.
+
+        The solution is to remove the assertion, which I believe was put there to ensure that my m_valueProfiles refactoring
+        a long time ago was sound: it used to be that a ValueProfile with m_bytecodeOffset == -1 was an argument profile; now
+        all argument profiles are in m_argumentValueProfiles instead. I think it's safe to say that this refactoring was done
+        soundly since it was a long time ago. So we should kill the assertion - I don't see an easy way to make the assertion
+        sound with respect to the GC-during-CodeBlock-construction issue, and I don't believe that the assertion is buying us
+        anything at this point.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfile):
+
+2013-02-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA should leave behind information in Edge that says if the Edge's type check is proven to succeed
+        https://bugs.webkit.org/show_bug.cgi?id=110840
+
+        Reviewed by Mark Hahnenberg.
+        
+        This doesn't add any observable functionality to the compiler, yet. But it does give
+        every phase that runs after CFA the ability to know, in O(1) time, whether an edge
+        will need to execute a type check.
+
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::filterEdgeByUse):
+        (JSC::DFG::AbstractState::filterByType):
+        * dfg/DFGCommon.cpp:
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::isProved):
+        (DFG):
+        (JSC::DFG::proofStatusForIsProved):
+        (WTF):
+        * dfg/DFGEdge.cpp:
+        (JSC::DFG::Edge::dump):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::Edge):
+        (JSC::DFG::Edge::setNode):
+        (JSC::DFG::Edge::useKindUnchecked):
+        (JSC::DFG::Edge::setUseKind):
+        (Edge):
+        (JSC::DFG::Edge::proofStatusUnchecked):
+        (JSC::DFG::Edge::proofStatus):
+        (JSC::DFG::Edge::setProofStatus):
+        (JSC::DFG::Edge::isProved):
+        (JSC::DFG::Edge::needsCheck):
+        (JSC::DFG::Edge::shift):
+        (JSC::DFG::Edge::makeWord):
+
+2013-02-28  Simon Hausmann  <simon.hausmann@digia.com>
+
+        [Qt][Mac] Fix massive parallel builds
+
+        Reviewed by Tor Arne Vestbø.
+
+        There exists a race condition that LLIntDesiredOffsets.h is written to
+        by two parllel instances of the ruby script. This patch ensures that similar to the output file,
+        the generated file is also prefixed according to the build configuration.
+
+        * LLIntOffsetsExtractor.pro:
+
+2013-02-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r144168.
+        http://trac.webkit.org/changeset/144168
+        https://bugs.webkit.org/show_bug.cgi?id=111019
+
+        It broke the build and tronical is unavailable (Requested by
+        Ossy_night on #webkit).
+
+        * LLIntOffsetsExtractor.pro:
+
+2013-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Disable some unsound DFG DCE
+        https://bugs.webkit.org/show_bug.cgi?id=110948
+
+        Reviewed by Michael Saboff.
+        
+        DCE of bitops is not sound since the bitops might call some variant of valueOf.
+        
+        This used to work right because ValueToInt32 was MustGenerate. From the DFG IR
+        standpoint it feels weird to make ValueToInt32 be MustGenerate since that node is
+        implemented entirely as a pure conversion. If we ever gave the DFG the ability to
+        do effectful bitops, we would most likely implement them as special nodes not
+        related to the ValueToInt32 and bitop nodes we have now.
+        
+        This change is performance neutral.
+
+        * dfg/DFGNodeType.h:
+        (DFG):
+
+2013-02-27  Glenn Adams  <glenn@skynav.com>
+
+        Add ENABLE_CSS3_TEXT_LINE_BREAK flag.
+        https://bugs.webkit.org/show_bug.cgi?id=110944
+
+        Reviewed by Dean Jackson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-02-27  Julien Brianceau   <jbrianceau@nds.com>
+
+        Fix build when DFG_JIT is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=110991
+
+        Reviewed by Csaba Osztrogonác.
+
+        * jit/JIT.h:
+        (JSC::JIT::canBeOptimizedOrInlined):
+
+2013-02-27  Simon Hausmann  <simon.hausmann@digia.com>
+
+        [Qt][Mac] Fix massive parallel builds
+
+        Reviewed by Tor Arne Vestbø.
+
+        There exists a race condition that LLIntDesiredOffsets.h is written to
+        by two parllel instances of the ruby script. This patch ensures that similar to the output file,
+        the generated file is also prefixed according to the build configuration.
+
+        * LLIntOffsetsExtractor.pro:
+
+2013-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit doesn't know which virtual register to use for the last result register for post_inc and post_dec
+        https://bugs.webkit.org/show_bug.cgi?id=109036
+        <rdar://problem/13292139>
+
+        Reviewed by Gavin Barraclough.
+        
+        This was a two-fold problem:
+        
+        1) post_inc/dec has two results - the new value of the variable, and the old value of the variable. DFG OSR exit
+           assumed that the "last result" used for the Baseline JIT's register allocation would be the new value. It was
+           wrong in this assumption.
+        
+        2) The Baseline JIT knew to disable its last result optimization in cases where it might confuse the DFG. But it
+           was doing this only for code blocks that could be totally optimized, but not code blocks that could only be
+           optimized when inlined.
+        
+        This patch introduces a more rigorous notion of when the Baseline JIT emits profiling, when it does extra work
+        to account for the possibility of OSR exit, and when it does extra work to account for the possibility of OSR
+        entry. These notions are called shouldEmitProfiling(), canBeOptimizedOrInlined(), and canBeOptimized(),
+        respectively.
+        
+        This is performance-neutral and fixes the reported bug. It probably fixes other bugs as well, since previously
+        we for example weren't doing the more conservative implementation of op_mov in the Baseline JIT for code blocks
+        that could be inlined but not optimized. So, if such a code block OSR exited at just the right point, you'd get
+        symptoms similar to this bug.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGCommon.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compilePatchGetArrayLength):
+        (JSC::JIT::canBeOptimizedOrInlined):
+        (JIT):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emit_op_call_put_result):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitArrayProfilingSite):
+        (JSC::JIT::map):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2013-02-26  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. AppleWin VS2010 build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        The DFG backend's and OSR's decision to unbox a variable should be based on whether it's used in a typed context
+        https://bugs.webkit.org/show_bug.cgi?id=110433
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        This introduces the equivalent of a liveness analysis, except for type checking.
+        A variable is said to be "profitable for unboxing" (i.e. live at a type check)
+        if there exists a type check on a GetLocal of that variable, and the type check
+        is consistent with the variable's prediction. Variables that are not profitable
+        for unboxing aren't unboxed. Previously they would have been.
+        
+        This is a slight speed-up on some things but mostly neutral.
+
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::ArgumentPosition::ArgumentPosition):
+        (JSC::DFG::ArgumentPosition::mergeShouldNeverUnbox):
+        (JSC::DFG::ArgumentPosition::mergeArgumentPredictionAwareness):
+        (JSC::DFG::ArgumentPosition::mergeArgumentUnboxingAwareness):
+        (ArgumentPosition):
+        (JSC::DFG::ArgumentPosition::isProfitableToUnbox):
+        (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::checkAndSet):
+        (DFG):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::alwaysUnboxSimplePrimitives):
+        (JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeIsCaptured):
+        (JSC::DFG::VariableAccessData::mergeIsProfitableToUnbox):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::isProfitableToUnbox):
+        (JSC::DFG::VariableAccessData::shouldUnboxIfPossible):
+        (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
+        (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
+        (JSC::DFG::VariableAccessData::mergeFlags):
+
+2013-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Web Inspector: REGRESSION: [JSC] SourceProvider reuses IDs
+        https://bugs.webkit.org/show_bug.cgi?id=99674
+
+        Reviewed by Gavin Barraclough.
+
+        Simple incrementing counter for SourceProvider IDs.  Uses a
+        lock to incrementing the counter so we don't increment reuse
+        counter values or reassign the ID for a given SourceProvider.
+
+        * parser/SourceProvider.cpp:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC):
+        (JSC::SourceProvider::getID):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::asID):
+        (SourceProvider):
+
+2013-02-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r144074.
+        http://trac.webkit.org/changeset/144074
+        https://bugs.webkit.org/show_bug.cgi?id=110897
+
+        Causing 20+ crashes on Mac (Requested by bradee-oh on
+        #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC):
+        (JSC::PropertyTable::~PropertyTable):
+        (JSC::PropertyTable::copy):
+        * runtime/PropertyTable.cpp: Removed.
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC):
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::checkOffsetConsistency):
+        (Structure):
+        * runtime/StructureInlines.h:
+
+2013-02-26  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. AppleWin VS2010 build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
+
+2013-02-26  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix; use correct macro for platform name in FeatureDefines.xcconfig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-02-26  Michael Saboff  <msaboff@apple.com>
+
+        Potential crash in YARR JIT generated code when building 64 bit
+        https://bugs.webkit.org/show_bug.cgi?id=110893
+
+        Reviewed by Gavin Barraclough.
+
+        The ABI doesn't define the behavior for the upper bits of a value that takes less than 64 bits.
+        Therefore, we zero extend both the count and length registers to assure that these unsigned values
+        don't have garbage upper bits.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generateEnter):
+
+2013-02-26  Andreas Kling  <akling@apple.com>
+
+        Unused Structure property tables waste 14MB on Membuster.
+        <http://webkit.org/b/110854>
+        <rdar://problem/13292104>
+
+        Reviewed by Filip Pizlo.
+
+        Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
+        14 MB progression on Membuster3.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+
+            Added PropertyTable.cpp.
+
+        * runtime/PropertyTable.cpp: Added.
+        (JSC::PropertyTable::create):
+        (JSC::PropertyTable::clone):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::destroy):
+        (JSC::PropertyTable::~PropertyTable):
+        (JSC::PropertyTable::visitChildren):
+
+            Moved marking of property table values here from Structure::visitChildren().
+
+        * runtime/StructureInlines.h:
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::checkOffsetConsistency):
+
+            Moved these to StructureInlines.h to break header dependency cycle between Structure/PropertyTable.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+
+            Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.
+
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::createStructure):
+        (JSC::PropertyTable::copy):
+
+2013-02-26  Andreas Kling  <akling@apple.com>
+
+        Unreviewed, rolling out r144054.
+        http://trac.webkit.org/changeset/144054
+        https://bugs.webkit.org/show_bug.cgi?id=110854
+
+        broke builds
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC):
+        (JSC::PropertyTable::~PropertyTable):
+        (JSC::PropertyTable::copy):
+        * runtime/PropertyTable.cpp: Removed.
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC):
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::checkOffsetConsistency):
+        (Structure):
+        * runtime/StructureInlines.h:
+
+2013-02-26  Andreas Kling  <akling@apple.com>
+
+        Unused Structure property tables waste 14MB on Membuster.
+        <http://webkit.org/b/110854>
+        <rdar://problem/13292104>
+
+        Reviewed by Filip Pizlo.
+
+        Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
+        14 MB progression on Membuster3.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+
+            Added PropertyTable.cpp.
+
+        * runtime/PropertyTable.cpp: Added.
+        (JSC::PropertyTable::create):
+        (JSC::PropertyTable::clone):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::destroy):
+        (JSC::PropertyTable::~PropertyTable):
+        (JSC::PropertyTable::visitChildren):
+
+            Moved marking of property table values here from Structure::visitChildren().
+
+        * runtime/StructureInlines.h:
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::checkOffsetConsistency):
+
+            Moved these to StructureInlines.h to break header dependency cycle between Structure/PropertyTable.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+
+            Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.
+
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::createStructure):
+        (JSC::PropertyTable::copy):
+
+2013-02-26  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        Implement JIT on Windows 64 bits
+        https://bugs.webkit.org/show_bug.cgi?id=107965
+
+        Reviewed by Simon Hausmann.
+
+        1. MSVC doesn't support inline assembly for 64 bits, implements the trampoline in a separate ASM file.
+
+        2. Windows 64 bits has a different calling convention than other OSes following the AMD64 ABI.
+        Differences that we have to handle here:
+        - Registers passed parameters are RCX, RDX, R8 and R9 instead of RDI, RSI, RDX, RCX, R8 and R9
+        - RDI and RSI must be preserved by callee
+        - Only return values <= 8 bytes can be returned by register (RDX can't be used to return a second word)
+        - There is no red-zone after RIP on the stack, but instead 4 reserved words before it
+
+        * Target.pri:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JSC):
+        (JITStackFrame):
+        (JSC::JITStackFrame::returnAddressSlot):
+        * jit/JITStubsMSVC64.asm: Added.
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * yarr/YarrJIT.cpp:
+        (YarrGenerator):
+        (JSC::Yarr::YarrGenerator::generateEnter):
+        (JSC::Yarr::YarrGenerator::generateReturn):
+
+2013-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Kill another analyzer warning in javascriptcore
+        https://bugs.webkit.org/show_bug.cgi?id=110802
+
+        Reviewed by Benjamin Poulain.
+
+        Add null checks.
+        
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::startProfiling):
+        (JSC::LegacyProfiler::stopProfiling):
+
+2013-02-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r144004.
+        http://trac.webkit.org/changeset/144004
+        https://bugs.webkit.org/show_bug.cgi?id=110858
+
+        This iOS change is outdated (Requested by notbenjamin on
+        #webkit).
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        (BytecodeGenerator):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        * parser/Parser.h:
+        (JSC::Parser::canRecurse):
+        (Parser):
+
+2013-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r143654): some jquery test asserts on 32 bit debug build
+        https://bugs.webkit.org/show_bug.cgi?id=110756
+
+        Reviewed by Geoffrey Garen.
+        
+        TypeOf does speculations manually, so it should mark its JSValueOperand as doing ManualOperandSpeculation.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Upstream iOS Stack bound checking
+        https://bugs.webkit.org/show_bug.cgi?id=110813
+
+        Reviewed by Filip Pizlo.
+
+        On iOS, the StackBounds cannot be cached because the stack
+        can be in one of two threads (the web thread or the UI thread).
+
+        We simply always consider the current stack bound when testing
+        stack boundaries.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        (BytecodeGenerator):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        * parser/Parser.h:
+        (JSC::Parser::canRecurse):
+        (Parser):
+
+2013-02-25  Michael Saboff  <msaboff@apple.com>
+
+        For JSVALUE32_64, maxOffsetRelativeToPatchedStorage() doesn't compute the maximum negative offset
+        https://bugs.webkit.org/show_bug.cgi?id=110828
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSObject.h:
+        (JSC::maxOffsetRelativeToPatchedStorage): Only add the OBJECT_OFFSETOF(tag) for positive offsets.
+        That way this function will return the offset farthest from 0 needed to access either the payload
+        or tag.
+
+2013-02-25  Jeffrey Pfau  <jpfau@apple.com>
+
+        Optionally partition cache to prevent using cache for tracking
+        https://bugs.webkit.org/show_bug.cgi?id=110269
+
+        Reviewed by Maciej Stachowiak.
+
+        * Configurations/FeatureDefines.xcconfig: Add defines for cache partitioning and public suffix list usage
+
+2013-02-25  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. VS2010 solution build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
+
+2013-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Edge should have more bits for UseKind, and DFG::Allocator should be simpler
+        https://bugs.webkit.org/show_bug.cgi?id=110722
+
+        Reviewed by Oliver Hunt.
+        
+        This rolls out the DFG::Allocator part of http://trac.webkit.org/changeset/143654,
+        and changes Edge to have more room for UseKinds and possibly other things.
+        
+        This is performance-neutral on both 32-bit and 64-bit. It reduces the size of
+        DFG::Node on 64-bit (by virtue of getting rid of the 16-byte alignment of Node)
+        and increases it slightly on 32-bit (by 4 bytes total - 16-byte alignment led to
+        80 bytes, but the base size of Node plus the 12 bytes of new m_encodedWords in
+        Edge gets 84 bytes). But, it will mean that we don't have to increase Node by
+        another 16 bytes if we ever want to add more UseKinds or other things to Edge.
+
+        * dfg/DFGAllocator.h:
+        (DFG):
+        (Allocator):
+        (JSC::DFG::Allocator::Region::headerSize):
+        (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
+        (JSC::DFG::Allocator::Region::data):
+        (JSC::DFG::Allocator::Region::isInThisRegion):
+        (JSC::DFG::::Allocator):
+        (JSC::DFG::::~Allocator):
+        (JSC::DFG::::allocate):
+        (JSC::DFG::::free):
+        (JSC::DFG::::freeAll):
+        (JSC::DFG::::reset):
+        (JSC::DFG::::indexOf):
+        (JSC::DFG::::allocatorOf):
+        (JSC::DFG::::bumpAllocate):
+        (JSC::DFG::::freeListAllocate):
+        (JSC::DFG::::allocateSlow):
+        (JSC::DFG::::freeRegionsStartingAt):
+        (JSC::DFG::::startBumpingIn):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::Edge):
+        (Edge):
+        (JSC::DFG::Edge::node):
+        (JSC::DFG::Edge::setNode):
+        (JSC::DFG::Edge::useKindUnchecked):
+        (JSC::DFG::Edge::setUseKind):
+        (JSC::DFG::Edge::operator==):
+        (JSC::DFG::Edge::operator!=):
+        (JSC::DFG::Edge::makeWord):
+        * dfg/DFGNodeAllocator.h:
+        (DFG):
+
+2013-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        The DFG special case checks for isCreatedThisArgument are fragile
+        https://bugs.webkit.org/show_bug.cgi?id=110535
+
+        Reviewed by Oliver Hunt.
+        
+        There may be many situations in which we want to force a variable to never be
+        unboxed. Capturing is one such case, and the created this argument is another.
+        Previously all code that dealt with this issue had to query both scenarios.
+        
+        Now DFG::VariableAccessData knows these things. You just have to ask
+        VariableAccessData for whether a variable should be unboxed. Anyone wishing to
+        force a variable to never be unboxed just tells VariableAccessData.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (DFG):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (CFGSimplificationPhase):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeIsCaptured):
+        (JSC::DFG::VariableAccessData::mergeShouldNeverUnbox):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::shouldNeverUnbox):
+        (JSC::DFG::VariableAccessData::shouldUnboxIfPossible):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
+        (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
+
+2013-02-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Do one lookup per code cache insertion instead of two
+        https://bugs.webkit.org/show_bug.cgi?id=110674
+
+        Reviewed by Sam Weinig.
+
+        Deployed the idiomatic "add null value" trick to avoid a second hash
+        lookup when inserting an item.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCacheMap::pruneSlowCase): Factored this into a helper function
+        to improve clarity and get some code off the hot path.
+
+        (JSC::CodeCache::getCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Use the add() API
+        to avoid two hash lookups. Be sure to remove items if parsing fails,
+        otherwise we'll leave nulls in the table. (I'm guessing that caching parse
+        errors is not a win.)
+
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeValue::SourceCodeValue):
+        (CodeCacheMap):
+        (JSC::CodeCacheMap::add): Combined find() and set() into add().
+
+        (JSC::CodeCacheMap::remove):
+        (JSC::CodeCacheMap::age):
+        (JSC::CodeCacheMap::prune): Refactored to support above changes.
+
+2013-02-25  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [BlackBerry][ARM] Fix cast-align warnings in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=110738
+
+        Reviewed by Rob Buis.
+
+        Use reinterpret_cast_ptr instead of reinterpret_cast for
+        pointers.
+
+        * dfg/DFGOperations.cpp:
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::zeroFillWilderness):
+        * heap/WeakBlock.h:
+        (JSC::WeakBlock::asWeakImpl):
+        (JSC::WeakBlock::asFreeCell):
+        (JSC::WeakBlock::weakImpls):
+        * heap/WeakImpl.h:
+        (JSC::WeakImpl::asWeakImpl):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::disableErrorStackReserve):
+        * interpreter/JSStack.h:
+        (JSC::JSStack::reservationEnd):
+        * runtime/ArrayStorage.h:
+        (JSC::ArrayStorage::from):
+        * runtime/Butterfly.h:
+        (JSC::Butterfly::indexingPayload):
+        * runtime/IndexingHeader.h:
+        (JSC::IndexingHeader::propertyStorage):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::tearOff):
+        (JSC::JSActivation::isTornOff):
+        (JSC::JSActivation::storage):
+
+2013-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT::speculateNumber() should just use SpeculateDoubleOperand instead of doing its own thing
+        https://bugs.webkit.org/show_bug.cgi?id=110659
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        This simplifies the code, and also has the effect that if speculateNumber() is called
+        prior to someone actually using the number in a double context, then the number will
+        already be up-converted to double and ready to go.
+
+        Previously if this ever came up, the subsequent use would have to again branch to see
+        if the value is tagged as int or tagged as double.
+
+        On the other hand, if you ever did speculateNumber() and then used the value as a
+        JSValue, this will be a slow down now.
+
+        I suspect that the former (speculateNumber() and then use as number) is more likely
+        than the latter (speculateNumber() and then use as JSValue).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+
+2013-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG FixupPhase should have one common hook for knowing if a node is ever being speculated a certain way
+        https://bugs.webkit.org/show_bug.cgi?id=110650
+
+        Reviewed by Mark Hahnenberg.
+        
+        Changes almost all calls to edge.setUseKind(kind) to be
+        setUseKindAndUnboxIfProfitable<kind>(edge). This will allow us to use the latter
+        as a hook for deciding which locals to unbox (webkit.org/b/110433).
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+
+2013-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r143654): some fast/js test crashes on 32 bit build
+        https://bugs.webkit.org/show_bug.cgi?id=110590
+
+        Reviewed by Mark Hahnenberg.
+        
+        In compileValueToInt32, the refactoring in r143654 undid one of the fixes from
+        r143314 due to a merge goof.
+        
+        In speculateNumber, we were simply forgetting to indicate that we need a
+        ManualOperandSpeculation on a JSValueOperand. ManualOperandSpeculation should
+        be passed whenever you will be performing the type checks yourself rather than
+        using the operand class to do it for you.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+
+2013-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Fix the 32-bit build by using the right data type in more places.
+
+        * runtime/CodeCache.h:
+        (CodeCacheMap):
+
+2013-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Fix the 32-bit build by using the right data type.
+
+        * runtime/CodeCache.h:
+        (JSC::CodeCacheMap::find):
+
+2013-02-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Code cache size should adapt to workload
+        https://bugs.webkit.org/show_bug.cgi?id=110560
+
+        Reviewed by Antti Koivisto.
+
+        (*) 5% PLT arithmetic mean speedup
+        (*) 10% PLT geometric mean speedup
+        (*) 3.4X microbenchmark speedup
+        (*) Reduces initial cache capacity by 16X
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::CodeCache): Updated for interface change.
+
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeValue::SourceCodeValue):
+        (SourceCodeValue): Turned the cache value into a struct so it can track its age.
+
+        (CodeCacheMap):
+        (JSC::CodeCacheMap::CodeCacheMap):
+        (JSC::CodeCacheMap::find):
+        (JSC::CodeCacheMap::set):
+        (JSC::CodeCacheMap::clear):
+        (JSC::CodeCacheMap::pruneIfNeeded):
+        (CodeCache): Grow and shrink in response to usage.
+
+2013-02-21  Jessie Berlin  <jberlin@apple.com>
+
+        Fix a typo that broke the 32 bit build.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-21  Michael Saboff  <msaboff@apple.com>
+
+        25-30% regression in V8 RayTrace test in 32 bit builds with JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=110539
+
+        Reviewed by Filip Pizlo.
+
+        Change the scale used to lookup pointers in JSGlobalObject::m_specialPointers to be 4 bytes for
+        the 32 bit version of the interpreter.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2013-02-21  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Add executable property to cmd file.
+        Required for executable files to maintain their executable permissions over svn.
+
+        * JavaScriptCore.vcxproj/copy-files.cmd: Added property svn:executable.
+
+2013-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Object allocation profiling will refuse to create objects with more than JSFinalObject::maxInlineCapacity() inline slots, but JSFunction::allocationProfile() asserts that the number of inline slots is always what it asked for
+        https://bugs.webkit.org/show_bug.cgi?id=110519
+        <rdar://problem/13218566>
+
+        Reviewed by Geoffrey Garen.
+        
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::allocationProfile):
+
+2013-02-21  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Build fix for VS2010 WebKit solution.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not change its mind about what type speculations a node does, by encoding the checks in the NodeType, UseKind, and ArrayMode
+        https://bugs.webkit.org/show_bug.cgi?id=109371
+
+        Reviewed by Oliver Hunt.
+        
+        FixupPhase now locks in the speculations that each node will do. The DFG then
+        remembers those speculations, and doesn't change its mind about them even if the
+        graph is transformed - for example if a node's child is repointed to a different
+        node as part of CSE, CFG simplification, or folding. Each node ensures that it
+        executes the speculations promised by its edges. This is true even for Phantom
+        nodes.
+        
+        This still leaves some craziness on the table for future work, like the
+        elimination of speculating SetLocal's due to CFG simplification
+        (webkit.org/b/109388) and elimination of nodes via DCE (webkit.org/b/109389).
+        
+        In all, this allows for a huge simplification of the DFG. Instead of having to
+        execute the right speculation heuristic each time you want to decide what a node
+        does (for example Node::shouldSpeculateInteger(child1, child2) &&
+        node->canSpeculateInteger()), you just ask for the use kinds of its children
+        (typically node->binaryUseKind() == Int32Use). Because the use kinds are
+        discrete, you can often just switch over them. This makes many parts of the code
+        more clear than they were before.
+        
+        Having UseKinds describe the speculations being performed also makes it far
+        easier to perform analyses that need to know what speculations are done. This is
+        so far only used to simplify large parts of the CFA.
+        
+        To have a larger vocabulary of UseKinds, this also changes the node allocator to
+        be able to round up Node sizes to the nearest multiple of 16.
+        
+        This appears to be neutral on benchmarks, except for some goofy speed-ups, like
+        8% on Octane/box2d.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::startExecuting):
+        (DFG):
+        (JSC::DFG::AbstractState::executeEdges):
+        (JSC::DFG::AbstractState::verifyEdge):
+        (JSC::DFG::AbstractState::verifyEdges):
+        (JSC::DFG::AbstractState::executeEffects):
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        (JSC::DFG::AbstractState::filterEdgeByUse):
+        (JSC::DFG::AbstractState::filterByType):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::filter):
+        * dfg/DFGAdjacencyList.h:
+        (JSC::DFG::AdjacencyList::AdjacencyList):
+        (JSC::DFG::AdjacencyList::child):
+        (JSC::DFG::AdjacencyList::setChild):
+        (JSC::DFG::AdjacencyList::reset):
+        (JSC::DFG::AdjacencyList::firstChild):
+        (JSC::DFG::AdjacencyList::setFirstChild):
+        (JSC::DFG::AdjacencyList::numChildren):
+        (JSC::DFG::AdjacencyList::setNumChildren):
+        (AdjacencyList):
+        * dfg/DFGAllocator.h:
+        (DFG):
+        (Allocator):
+        (JSC::DFG::Allocator::cellSize):
+        (JSC::DFG::Allocator::Region::headerSize):
+        (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
+        (JSC::DFG::Allocator::Region::payloadSize):
+        (JSC::DFG::Allocator::Region::payloadBegin):
+        (JSC::DFG::Allocator::Region::payloadEnd):
+        (JSC::DFG::Allocator::Region::isInThisRegion):
+        (JSC::DFG::::Allocator):
+        (JSC::DFG::::~Allocator):
+        (JSC::DFG::::allocate):
+        (JSC::DFG::::free):
+        (JSC::DFG::::freeAll):
+        (JSC::DFG::::reset):
+        (JSC::DFG::::indexOf):
+        (JSC::DFG::::allocatorOf):
+        (JSC::DFG::::bumpAllocate):
+        (JSC::DFG::::freeListAllocate):
+        (JSC::DFG::::allocateSlow):
+        (JSC::DFG::::freeRegionsStartingAt):
+        (JSC::DFG::::startBumpingIn):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCommon.h:
+        (DFG):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGEdge.cpp:
+        (JSC::DFG::Edge::dump):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::useKindUnchecked):
+        (JSC::DFG::Edge::useKind):
+        (JSC::DFG::Edge::shift):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::truncateConstantToInt32):
+        (JSC::DFG::FixupPhase::truncateConstantsIfNecessary):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        * dfg/DFGGraph.cpp:
+        (DFG):
+        (JSC::DFG::Graph::refChildren):
+        (JSC::DFG::Graph::derefChildren):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        (JSC::DFG::Graph::performSubstitution):
+        (JSC::DFG::Graph::isPredictedNumerical):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
+        (DFG):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::convertToGetByOffset):
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        (JSC::DFG::Node::child1):
+        (JSC::DFG::Node::child2):
+        (JSC::DFG::Node::child3):
+        (JSC::DFG::Node::binaryUseKind):
+        (Node):
+        (JSC::DFG::Node::isBinaryUseKind):
+        * dfg/DFGNodeAllocator.h:
+        (DFG):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::typeCheck):
+        (JSC::DFG::SpeculativeJIT::forwardTypeCheck):
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::speculateInt32):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+        (JSC::DFG::SpeculativeJIT::speculateBoolean):
+        (JSC::DFG::SpeculativeJIT::speculateCell):
+        (JSC::DFG::SpeculativeJIT::speculateObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateNotCell):
+        (JSC::DFG::SpeculativeJIT::speculateOther):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
+        (JSC::DFG::SpeculativeJIT::needsTypeCheck):
+        (JSC::DFG::IntegerOperand::IntegerOperand):
+        (JSC::DFG::IntegerOperand::edge):
+        (IntegerOperand):
+        (JSC::DFG::IntegerOperand::node):
+        (JSC::DFG::IntegerOperand::gpr):
+        (JSC::DFG::IntegerOperand::use):
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        (JSValueOperand):
+        (JSC::DFG::JSValueOperand::edge):
+        (JSC::DFG::JSValueOperand::node):
+        (JSC::DFG::JSValueOperand::gpr):
+        (JSC::DFG::JSValueOperand::fill):
+        (JSC::DFG::JSValueOperand::use):
+        (JSC::DFG::StorageOperand::StorageOperand):
+        (JSC::DFG::StorageOperand::edge):
+        (StorageOperand):
+        (JSC::DFG::StorageOperand::node):
+        (JSC::DFG::StorageOperand::gpr):
+        (JSC::DFG::StorageOperand::use):
+        (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
+        (SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateIntegerOperand::edge):
+        (JSC::DFG::SpeculateIntegerOperand::node):
+        (JSC::DFG::SpeculateIntegerOperand::gpr):
+        (JSC::DFG::SpeculateIntegerOperand::use):
+        (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
+        (SpeculateStrictInt32Operand):
+        (JSC::DFG::SpeculateStrictInt32Operand::edge):
+        (JSC::DFG::SpeculateStrictInt32Operand::node):
+        (JSC::DFG::SpeculateStrictInt32Operand::gpr):
+        (JSC::DFG::SpeculateStrictInt32Operand::use):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateDoubleOperand::edge):
+        (JSC::DFG::SpeculateDoubleOperand::node):
+        (JSC::DFG::SpeculateDoubleOperand::fpr):
+        (JSC::DFG::SpeculateDoubleOperand::use):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (SpeculateCellOperand):
+        (JSC::DFG::SpeculateCellOperand::edge):
+        (JSC::DFG::SpeculateCellOperand::node):
+        (JSC::DFG::SpeculateCellOperand::gpr):
+        (JSC::DFG::SpeculateCellOperand::use):
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        (JSC::DFG::SpeculateBooleanOperand::edge):
+        (SpeculateBooleanOperand):
+        (JSC::DFG::SpeculateBooleanOperand::node):
+        (JSC::DFG::SpeculateBooleanOperand::gpr):
+        (JSC::DFG::SpeculateBooleanOperand::use):
+        (DFG):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * dfg/DFGUseKind.cpp: Added.
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h: Added.
+        (DFG):
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isNumerical):
+        (WTF):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::reportValidationContext):
+
+2013-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Need a way to use the Objective-C JavaScript API with WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=106059
+
+        Reviewed by Geoffrey Garen.
+        
+        * API/JSBase.h: Renamed enable flag for API.
+        * API/JSBlockAdaptor.h: Using new flag.
+        * API/JSBlockAdaptor.mm: Ditto.
+        * API/JSContext.h: Add convenience C API conversion function for JSGlobalContextRef.
+        * API/JSContext.mm: 
+        (-[JSContext JSGlobalContextRef]): Implementation of C API convenience function.
+        (-[JSContext initWithVirtualMachine:]): We don't use the m_apiData field any more.
+        (-[JSContext initWithGlobalContextRef:]): init method for allocating new JSContexts given a JSGlobalContextRef.
+        (-[JSContext dealloc]): No more m_apiData.
+        (-[JSContext wrapperForObjCObject:]): Renamed wrapperForObject. 
+        (-[JSContext wrapperForJSObject:]): Fetches or allocates the JSValue for the specified JSValueRef in this JSContext.
+        (+[JSContext contextWithGlobalContextRef:]): Helper function to grab the lightweight JSContext wrapper for a given
+        JSGlobalContextRef from the global wrapper cache or allocate a new one if there isn't already one.
+        * API/JSContextInternal.h: New flag, new method declaration for initWithGlobalContextRef.
+        * API/JSExport.h: New flag.
+        * API/JSValue.h: New flag and new C API convenience method.
+        * API/JSValue.mm:
+        (-[JSValue JSValueRef]): Implementation of the C API convenience method.
+        (objectToValueWithoutCopy):
+        (+[JSValue valueWithValue:inContext:]): We now ask the JSContext for an Objective-C JSValue wrapper, which it can cache
+        in its internal JSWrapperMap.
+        * API/JSValueInternal.h:
+        * API/JSVirtualMachine.h:
+        * API/JSVirtualMachine.mm: Added global cache that maps JSContextGroupRef -> JSVirtualMachine lightweight wrappers.
+        (wrapperCacheLock):
+        (initWrapperCache):
+        (+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]):
+        (+[JSVMWrapperCache wrapperForJSContextGroupRef:]):
+        (-[JSVirtualMachine init]):
+        (-[JSVirtualMachine initWithContextGroupRef:]):
+        (-[JSVirtualMachine dealloc]):
+        (+[JSVirtualMachine virtualMachineWithContextGroupRef:]):
+        (-[JSVirtualMachine contextForGlobalContextRef:]):
+        (-[JSVirtualMachine addContext:forGlobalContextRef:]):
+        * API/JSVirtualMachineInternal.h:
+        * API/JSWrapperMap.h:
+        * API/JSWrapperMap.mm:
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We use the JSObjectSetPrototype C API call because 
+        setting the __proto__ property causes all sorts of bad things to happen behind the scenes, which can cause crashes based on 
+        when it gets called.
+        (-[JSWrapperMap initWithContext:]):
+        (-[JSWrapperMap jsWrapperForObject:]):
+        (-[JSWrapperMap objcWrapperForJSValueRef:]):
+        * API/JavaScriptCore.h:
+        * API/ObjCCallbackFunction.h:
+        * API/ObjCCallbackFunction.mm:
+        (ObjCCallbackFunction::ObjCCallbackFunction): We never actually should have retained the target in the case that we had a 
+        block as a callback. Blocks are initially allocated on the stack and are only moved to the heap if we call their copy method.
+        Retaining the block on the stack was a bad idea because if that stack frame ever went away and we called the block later, 
+        we'd crash and burn.
+        (ObjCCallbackFunction::setContext): We need a new setter for when the weak reference to a JSContext inside an ObjCCallbackFunction
+        disappears, we can allocate a new one in its place.
+        (ObjCCallbackFunction):
+        (objCCallbackFunctionCallAsFunction): Reset the callback's context if it's ever destroyed.
+        (objCCallbackFunctionForInvocation): Again, don't set the __proto__ property because it uses black magic that can cause us to crash
+        depending on when this is called.
+        (objCCallbackFunctionForBlock): Here is where we copy the block to the heap when we're first creating the callback object for it.
+        * API/tests/testapi.c:
+        (main):
+        * API/tests/testapi.mm: We're going to get rid of the automatic block conversion, since that is causing leaks. I changed it 
+        here in this test just so that it wouldn't mask any other potential leaks. Also modified some of the tests since JSContexts are 
+        just lightweight wrappers now, we're not guaranteed to get the same pointer back from the call to [JSValue context] as the one 
+        that the value was created in.
+        (-[TestObject callback:]):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): No more m_apiData.
+        * runtime/JSGlobalData.h: Ditto.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject): Ditto.
+        * runtime/JSGlobalObject.h:
+
+2013-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT::compileInt32ToDouble() has an unnecessary case for constant operands
+        https://bugs.webkit.org/show_bug.cgi?id=110309
+
+        Reviewed by Sam Weinig.
+        
+        It used to be necessary, back when we didn't have constant folding. Now we have
+        constant folding. So we don't need it.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+
+2013-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG inlines Resolves that it doesn't know how to handle correctly
+        https://bugs.webkit.org/show_bug.cgi?id=110405
+
+        Reviewed by Geoffrey Garen.
+        
+        Don't try to be clever: if there's a failing resolve, we can't inline it, period.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineResolveOperations):
+        (JSC::DFG::canInlineOpcode):
+
+2013-02-20  Roger Fong  <roger_fong@apple.com>
+
+        Get VS2010 Solution B&I ready.
+        <rdar://problem/1322988>
+
+        Rubberstamped by Timothy Horton.        
+        
+        Add Production configuration. 
+        Add a JavaScriptCore submit solution with a DebugSuffix configuration. 
+        Modify JavaScriptCore.make as necessary.
+        
+        * JavaScriptCore.vcxproj/JavaScriptCore.make: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCore.sln: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Copied from Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.sln.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorProduction.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreProduction.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.props: Added.
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props:
+        * JavaScriptCore.vcxproj/jsc/jscProduction.props: Added.
+        * JavaScriptCore.vcxproj/jsc/jscRelease.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpProduction.props: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
+        * JavaScriptCore.vcxproj/testapi/testapiProduction.props: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiRelease.props:
+
+2013-02-19  Jer Noble  <jer.noble@apple.com>
+
+        EME: Enable both ENCRYPTED_MEDIA and ENCRYPTED_MEDIA_V2 until clients transition to the new API.
+        https://bugs.webkit.org/show_bug.cgi?id=110284
+
+        Reviewed by Eric Carlson.
+
+        Re-enable the ENCRYPTED_MEDIA flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-02-20  Dirk Schulze  <krit@webkit.org>
+
+        Enable CANVAS_PATH flag
+        https://bugs.webkit.org/show_bug.cgi?id=108508
+
+        Reviewed by Simon Fraser.
+
+        Enable CANVAS_PATH flag on trunk.
+
+        Existing tests cover the feature.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-02-19  Mark Rowe  <mrowe@apple.com>
+
+        Unreviewed, uninteresting change to test a theory about bad dependency handling.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString): Remove an unnecessary else clause.
+
+2013-02-19  Oliver Hunt  <oliver@apple.com>
+
+        Silence some analyzer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=110281
+
+        Reviewed by Mark Hahnenberg.
+
+        The static analyzer believes that callerCodeBlock can be null,
+        based on other code performing null tests.  This should not
+        ever be the case, but we'll add RELEASE_ASSERTs to make it
+        obvious if we're ever wrong.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+
+2013-02-19  Oliver Hunt  <oliver@apple.com>
+
+        Don't force everything to be blinded in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=110279
+
+        Reviewed by Mark Hahnenberg.
+
+        Switch to an explicit flag for indicating that we want
+        every constant to be blinded.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlind):
+
+2013-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of Opcode.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/Opcode.h:
+
+2013-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Moved PolymorphicAccessStructureList into its own file.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Instruction.h:
+        (JSC):
+        * bytecode/PolymorphicAccessStructureList.h: Added.
+        (JSC):
+        (PolymorphicAccessStructureList):
+        (PolymorphicStubInfo):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::PolymorphicStubInfo):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::visitWeak):
+        * bytecode/StructureStubInfo.h:
+
+2013-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of Instruction.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/Instruction.h:
+
+2013-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling in r143348.
+        http://trac.webkit.org/changeset/143348
+        https://bugs.webkit.org/show_bug.cgi?id=110242
+
+        The bug was that isEmptyValue() was returning true for the deleted value.
+        Fixed this and simplified things further by delegating to m_sourceCode
+        for both isNull() and isHashTableDeletedValue(), so they can't be out of
+        sync.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::isHashTableDeletedValue):
+        (JSC::SourceCodeKey::hash):
+        (JSC::SourceCodeKey::length):
+        (JSC::SourceCodeKey::isNull):
+        (JSC::SourceCodeKey::operator==):
+        (SourceCodeKey):
+
+2013-02-15  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Improve gyp build JavaScriptCore code generation
+        https://bugs.webkit.org/show_bug.cgi?id=109969
+
+        Reviewed by Dirk Pranke.
+
+        Switch away from using DerivedSources.make when building JavaScriptCore generated
+        sources. This bring a couple advantages, such as building the sources in parallel,
+        but requires us to list the generated sources more than once.
+
+        * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Add rules for generating JavaScriptCore sources.
+        * JavaScriptCore.gyp/generate-derived-sources.sh: Added.
+        * JavaScriptCore.gyp/redirect-stdout.sh: Added.
+
+2013-02-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r143348.
+        http://trac.webkit.org/changeset/143348
+        https://bugs.webkit.org/show_bug.cgi?id=110242
+
+        "Caused a deleted value sentinel crash on the layout tests"
+        (Requested by ggaren on #webkit).
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::isHashTableDeletedValue):
+        (JSC::SourceCodeKey::hash):
+        (JSC::SourceCodeKey::length):
+        (JSC::SourceCodeKey::isNull):
+        (JSC::SourceCodeKey::operator==):
+        (SourceCodeKey):
+
+2013-02-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        HeapBlock::destroy should issue warning if result is unused
+        https://bugs.webkit.org/show_bug.cgi?id=110233
+
+        Reviewed by Oliver Hunt.
+
+        To enforce the fact that we need to return blocks to the BlockAllocator after calling destroy, 
+        we should add WARN_UNUSED_RETURN to HeapBlock::destroy and any other destroy functions in its subclasses.
+
+        * heap/HeapBlock.h:
+
+2013-02-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        WeakSet::removeAllocator leaks WeakBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=110228
+
+        Reviewed by Geoffrey Garen.
+
+        We need to return the WeakBlock to the BlockAllocator after the call to WeakBlock::destroy.
+
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::removeAllocator):
+
+2013-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Save space on keys in the CodeCache
+        https://bugs.webkit.org/show_bug.cgi?id=110179
+
+        Reviewed by Oliver Hunt.
+
+        Share the SourceProvider's string instead of making our own copy. This
+        chops off 16MB - 32MB from the CodeCache's memory footprint when full.
+        (It's 16MB when the strings are LChar, and 32MB when they're UChar.)
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h: Removed a defunct enum value.
+
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::isHashTableDeletedValue):
+        (SourceCodeKey):
+        (JSC::SourceCodeKey::hash):
+        (JSC::SourceCodeKey::length):
+        (JSC::SourceCodeKey::isNull):
+        (JSC::SourceCodeKey::string):
+        (JSC::SourceCodeKey::operator==): Store a SourceCode instead of a String
+        so we can share our string with our SourceProvider. Cache our hash so
+        we don't have to re-decode our string just to re-hash the table.
+
+2013-02-19  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        revertBranchPtrWithPatch is incorrect on ARM traditional
+        https://bugs.webkit.org/show_bug.cgi?id=110201
+
+        Reviewed by Oliver Hunt.
+
+        Revert two instructions back to their original value.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::revertBranchPtrWithPatch):
+        (ARMAssembler):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
+
+2013-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r143241): It made 27 layout tests crash on 32 bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=110184
+
+        Reviewed by Zoltan Herczeg.
+        
+        32-bit backend was making all sorts of crazy assumptions, which happened to mostly
+        not break things prior to http://trac.webkit.org/changeset/143241. This brings the
+        32-bit backend's type speculation fully into compliance with what the 64-bit
+        backend does.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+
+2013-02-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for Apple Windows. Second stage.
+        Add missed export statement.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-02-18  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-02-18  Darin Adler  <darin@apple.com>
+
+        Remove unneeded explicit function template arguments.
+        https://bugs.webkit.org/show_bug.cgi?id=110043
+
+        Reviewed by Ryosuke Niwa.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierASCIIStringTranslator::hash): Let the compiler deduce the type
+        when calling computeHashAndMaskTop8Bits.
+        (JSC::IdentifierLCharFromUCharTranslator::hash): Ditto.
+        * runtime/Identifier.h:
+        (JSC::IdentifierCharBufferTranslator::hash): Ditto.
+2013-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Shrank the SourceProvider cache
+        https://bugs.webkit.org/show_bug.cgi?id=110158
+
+        Reviewed by Oliver Hunt.
+
+        CodeCache is now our primary source cache, so a long-lived SourceProvider
+        cache is a waste. I measured this as a 10MB Membuster win; with more
+        precise instrumentation, Andreas estimated it as up to 30MB.
+
+        I didn't eliminate the SourceProvider cache because it's still useful
+        in speeding up uncached parsing of scripts with large nested functions
+        (i.e., all scripts).
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect): Discard all source provider caches after GC. This
+        is a convenient place to do so because it's reasonably soon after initial
+        parsing without being immediate.
+
+        * parser/Parser.cpp:
+        (JSC::::Parser): Updated for interface change: The heap now owns the
+        source provider cache, since most SourceProviders are not expected to
+        have one by default, and the heap is responsible for throwing them away.
+
+        (JSC::::parseInner): No need to update statistics on cache size, since
+        we're going to throw it away no matter what.
+
+        (JSC::::parseFunctionInfo): Reduced the minimum function size to 16. This
+        is a 27% win on a new parsing micro-benchmark I've added. Now that the
+        cache is temporary, we don't have to worry so much about its memory
+        footprint.
+
+        * parser/Parser.h:
+        (Parser): Updated for interface changes.
+
+        * parser/SourceProvider.cpp:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::~SourceProvider):
+        * parser/SourceProvider.h:
+        (JSC):
+        (SourceProvider): SourceProvider doesn't own its cache anymore because
+        the cache is temporary.
+
+        * parser/SourceProviderCache.cpp:
+        (JSC::SourceProviderCache::clear):
+        (JSC::SourceProviderCache::add):
+        * parser/SourceProviderCache.h:
+        (JSC::SourceProviderCache::SourceProviderCache):
+        (SourceProviderCache):
+        * parser/SourceProviderCacheItem.h:
+        (SourceProviderCacheItem): No need to update statistics on cache size,
+        since we're going to throw it away no matter what.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::addSourceProviderCache):
+        (JSC):
+        (JSC::JSGlobalData::clearSourceProviderCaches):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData): Moved the cache here so it's easier to throw away.
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG backend Branch handling has duplicate code and dead code
+        https://bugs.webkit.org/show_bug.cgi?id=110162
+
+        Reviewed by Mark Hahnenberg.
+        
+        Streamline the code, and make the 64 backend's optimizations make more sense
+        (i.e. not be dead code).
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-18  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows] Unreviewed VS2010 build correction after r143273.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing source
+        file SourceProvider.cpp.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Add missing exports.
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure::flattenDictionaryStructure should compute max offset in a manner that soundly handles the case where the property list becomes empty
+        https://bugs.webkit.org/show_bug.cgi?id=110155
+        <rdar://problem/13233773>
+
+        Reviewed by Mark Rowe.
+        
+        This was a rookie mistake.  It was doing:
+        
+        for (blah) {
+            m_offset = foo // foo's monotonically increase in the loop
+        }
+        
+        as a way of computing max offset for all of the properties.  Except what if the loop doesn't
+        execute because there are no properties?  Well, then, you're going to have a bogus m_offset.
+        
+        The solution is to initialize m_offset at the top of the loop.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+
+2013-02-18  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        MIPS DFG implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=101328
+
+        Reviewed by Oliver Hunt.
+
+        DFG implementation for MIPS.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::MIPSAssembler):
+        (JSC::MIPSAssembler::sllv):
+        (JSC::MIPSAssembler::movd):
+        (MIPSAssembler):
+        (JSC::MIPSAssembler::negd):
+        (JSC::MIPSAssembler::labelForWatchpoint):
+        (JSC::MIPSAssembler::label):
+        (JSC::MIPSAssembler::vmov):
+        (JSC::MIPSAssembler::linkDirectJump):
+        (JSC::MIPSAssembler::maxJumpReplacementSize):
+        (JSC::MIPSAssembler::revertJumpToMove):
+        (JSC::MIPSAssembler::replaceWithJump):
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::poke):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+        (JSC::MacroAssemblerMIPS::mul32):
+        (JSC::MacroAssemblerMIPS::or32):
+        (JSC::MacroAssemblerMIPS::rshift32):
+        (JSC::MacroAssemblerMIPS::urshift32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (JSC::MacroAssemblerMIPS::xor32):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::jump):
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        (JSC::MacroAssemblerMIPS::branchSub32):
+        (JSC::MacroAssemblerMIPS::branchNeg32):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::moveDouble):
+        (JSC::MacroAssemblerMIPS::swapDouble):
+        (JSC::MacroAssemblerMIPS::subDouble):
+        (JSC::MacroAssemblerMIPS::mulDouble):
+        (JSC::MacroAssemblerMIPS::divDouble):
+        (JSC::MacroAssemblerMIPS::negateDouble):
+        (JSC::MacroAssemblerMIPS::branchEqual):
+        (JSC::MacroAssemblerMIPS::branchNotEqual):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToUint32):
+        (JSC::MacroAssemblerMIPS::truncateDoubleToInt32):
+        (JSC::MacroAssemblerMIPS::truncateDoubleToUint32):
+        (JSC::MacroAssemblerMIPS::branchDoubleNonZero):
+        (JSC::MacroAssemblerMIPS::branchDoubleZeroOrNaN):
+        (JSC::MacroAssemblerMIPS::invert):
+        (JSC::MacroAssemblerMIPS::replaceWithJump):
+        (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
+        * dfg/DFGAssemblyHelpers.h:
+        (AssemblyHelpers):
+        (JSC::DFG::AssemblyHelpers::preserveReturnAddressAfterCall):
+        (JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        * dfg/DFGFPRInfo.h:
+        (DFG):
+        (FPRInfo):
+        (JSC::DFG::FPRInfo::toRegister):
+        (JSC::DFG::FPRInfo::toIndex):
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h:
+        (DFG):
+        (GPRInfo):
+        (JSC::DFG::GPRInfo::toRegister):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+        * runtime/JSGlobalData.h:
+        (JSC::ScratchBuffer::allocationSize):
+        (ScratchBuffer):
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT::isKnownXYZ methods should use CFA rather than other things
+        https://bugs.webkit.org/show_bug.cgi?id=110092
+
+        Reviewed by Geoffrey Garen.
+        
+        These methods were previously using GenerationInfo and other things to try to
+        gain information that the CFA could give away for free, if you asked kindly
+        enough.
+        
+        Also fixed CallLinkStatus's dump() method since it was making an invalid
+        assertion: we most certainly can have a status where the structure is non-null
+        and the executable is null, like if we're dealing with an InternalFunction.
+        
+        Also removed calls to isKnownNotXYZ from fillSpeculateABC methods in 32_64. I
+        don't know why that was there. But it was causing asserts if the value was
+        empty - i.e. we had already exited unconditionally but we didn't know it. I
+        could have fixed this by introducing another form of isKnownNotXYZ which was
+        tolerant of empty values, but I didn't feel like fixing code that I knew to be
+        unnecessary. (More deeply, isKnownNotCell, for example, really asks: "do you
+        know that this value can never be a cell?" while some of the previous uses
+        wanted to ask: "do you know that this is a value that is not a cell?". The
+        former is "true" if the value is a contradiction [i.e. BOTTOM], while the
+        latter is "false" for contradictions, since contradictions are not values.)
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::dump):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isKnownInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
+        (JSC::DFG::SpeculativeJIT::isKnownNotCell):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::dump):
+
+2013-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of DFG::DoubleOperand and simplify ValueToInt32
+        https://bugs.webkit.org/show_bug.cgi?id=110072
+
+        Reviewed by Geoffrey Garen.
+        
+        ValueToInt32 had a side-effecting path, which was not OSR-friendly: an OSR after
+        the side-effect would lead to the side-effect re-executing. I got rid of that path
+        and replaced it with an optimization for the case where the input is speculated
+        number-or-other. This makes idioms like null|0 and true|0 work as expected, and
+        get optimized appropriately.
+        
+        Also got rid of DoubleOperand. Replaced all remaining uses of it with
+        SpeculateDoubleOperand. Because the latter asserts that the Edge is a DoubleUse
+        edge and the remaining uses of DoubleOperand are all for untyped uses, I worked
+        around the assertion by setting the UseKind to DoubleUse by force. This is sound,
+        since all existing assertions for DoubleUse are actually asserting that we're not
+        converting a value to double unexpectedly. But all of these calls to
+        SpeculateDoubleOperand are when the operand is already known to be represented as
+        double, so there is no conversion.
+        
+        This is neutral on benchmarks, except stanford-crypto-ccm, which speeds up a
+        little. Mostly, this is intended to delete a bunch of code. DoubleOperand was
+        equivalent to the replace-edge-with-DoubleUse trick that I'm using now, except it
+        involved a _lot_ more code.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (DFG):
+        (FPRTemporary):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (DFG):
+
+2013-02-18  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        [Qt] Mountain Lion buildfix after r143147.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * runtime/DateConstructor.cpp:
+
+2013-02-18  Zan Dobersek  <zdobersek@igalia.com>
+
+        Stop placing std::isfinite and std::signbit inside the global scope
+        https://bugs.webkit.org/show_bug.cgi?id=109817
+
+        Reviewed by Darin Adler.
+
+        Prefix calls to the isfinite and signbit methods with std:: as the two
+        methods are no longer being imported into the global scope.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlindDouble):
+        * offlineasm/cloop.rb:
+        * runtime/BigInteger.h:
+        (JSC::BigInteger::BigInteger):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DatePrototype.cpp:
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncIsFinite):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncMax): Also include an opportunistic style fix.
+        (JSC::mathProtoFuncMin): Ditto.
+        * runtime/NumberPrototype.cpp:
+        (JSC::toStringWithRadix):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        * runtime/Uint16WithFraction.h:
+        (JSC::Uint16WithFraction::Uint16WithFraction):
+
+2013-02-18  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        [Qt] Mountain Lion buildfix after r143147.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * runtime/DateInstance.cpp:
+
+2013-02-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed speculative build fix for Apple Win bots.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of StructureStubInfo.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/StructureStubInfo.h:
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of JSGlobalObject.h and JSGlobalObjectFunctions.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.h:
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indention of Operations.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/Operations.h:
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove DFG::SpeculativeJIT::isKnownNumeric(), since it's not called from anywhere.
+
+        Rubber stamped by Andy Estes.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove DFG::SpeculativeJIT::isStrictInt32(), since it's not called from anywhere.
+
+        Rubber stampted by Andy Estes.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2013-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove dead code for ValueToNumber from the DFG.
+
+        Rubber stamped by Andy Estes.
+        
+        We killed ValueToNumber at some point, but forgot to kill all of the backend support
+        for it.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+
+2013-02-17  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix for JSVALUE32_64 builds after r143147.
+
+        * jit/JIT.h:
+
+2013-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Move all Structure out-of-line inline methods to StructureInlines.h
+        https://bugs.webkit.org/show_bug.cgi?id=110024
+
+        Rubber stamped by Mark Hahnenberg and Sam Weinig.
+        
+        This was supposed to be easy.
+        
+        But, initially, there was a Structure inline method in CodeBlock.h, and moving that
+        into StructureInlines.h meant that Operations.h included CodeBlock.h. This would
+        cause WebCore build failures, because CodeBlock.h transitively included the JSC
+        parser (via many, many paths), and the JSC parser defines tokens using enumeration
+        elements that CSSGrammar.cpp (generated by bison) would #define. For example,
+        bison would give CSSGrammar.cpp a #define FUNCTION 123, and would do so before
+        including anything interesting. The JSC parser would have an enum that included
+        FUNCTION as an element. Hence the JSC parser included into CSSGrammar.cpp would have
+        a token element called FUNCTION declared in an enumeration, but FUNCTION was
+        #define'd to 123, leading to a parser error.
+        
+        Wow.
+        
+        So I removed all transitive include paths from CodeBlock.h to the JSC Parser. I
+        believe I was able to do so without out-of-lining anything interesting or performance
+        critical. This is probably a purely good thing to have done: it will be nice to be
+        able to make changes to the parser without having to compile the universe.
+        
+        Of course, doing this caused a bunch of other things to not compile, since a bunch of
+        headers relied on things being implicitly included for them when they transitively
+        included the parser. I fixed a lot of that.
+        
+        Finally, I ended up removing the method that depended on CodeBlock.h from
+        StructureInlines.h, and putting it in Structure.cpp. That might seem like all of this
+        was a waste of time, except that I suspect it was a worthwhile forcing function for
+        cleaning up a bunch of cruft.
+        
+        * API/JSCallbackFunction.cpp:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.h:
+        (JSC):
+        * bytecode/EvalCodeCache.h:
+        * bytecode/SamplingTool.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::parameterCount):
+        (JSC):
+        * bytecode/UnlinkedCodeBlock.h:
+        (UnlinkedFunctionExecutable):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/Label.h:
+        (JSC):
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGByteCodeParser.h:
+        * dfg/DFGFPRInfo.h:
+        * dfg/DFGRegisterBank.h:
+        * heap/HandleStack.cpp:
+        * jit/JITWriteBarrier.h:
+        * parser/Nodes.h:
+        (JSC):
+        * parser/Parser.h:
+        * parser/ParserError.h: Added.
+        (JSC):
+        (JSC::ParserError::ParserError):
+        (ParserError):
+        (JSC::ParserError::toErrorObject):
+        * parser/ParserModes.h:
+        * parser/SourceProvider.cpp: Added.
+        (JSC):
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::~SourceProvider):
+        * parser/SourceProvider.h:
+        (JSC):
+        (SourceProvider):
+        * runtime/ArrayPrototype.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/Executable.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        (JSC):
+        * runtime/Operations.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::prototypeForLookup):
+        (JSC):
+        * runtime/Structure.h:
+        (JSC):
+        * runtime/StructureInlines.h: Added.
+        (JSC):
+        (JSC::Structure::create):
+        (JSC::Structure::createStructure):
+        (JSC::Structure::get):
+        (JSC::Structure::masqueradesAsUndefined):
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::Structure::transitivelyTransitionedFrom):
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::isValid):
+        * runtime/StructureRareData.cpp:
+
+2013-02-17  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Windows build fix.
+
+        * runtime/CodeCache.h:
+        (CodeCacheMap):
+
+2013-02-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Code cache should be explicit about what it caches
+        https://bugs.webkit.org/show_bug.cgi?id=110039
+
+        Reviewed by Oliver Hunt.
+
+        This patch makes the code cache more explicit in two ways:
+
+        (1) The cache caches top-level scripts. Any sub-functions executed as a
+        part of a script are cached with it and evicted with it.
+
+        This simplifies things by eliminating out-of-band sub-function tracking,
+        and fixes pathological cases where functions for live scripts would be
+        evicted in favor of functions for dead scripts, and/or high probability
+        functions executed early in script lifetime would be evicted in favor of
+        low probability functions executed late in script lifetime, due to LRU.
+
+        Statistical data from general browsing and PLT confirms that caching
+        functions independently of scripts is not profitable.
+
+        (2) The cache tracks script size, not script count.
+
+        This reduces the worst-case cache size by a factor of infinity.
+
+        Script size is a reasonable first-order estimate of in-memory footprint 
+        for a cached script because there are no syntactic constructs that have
+        super-linear memory footprint.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock): Moved this function out of the cache
+        because it does not consult the cache, and is not managed by it.
+
+        (JSC::UnlinkedFunctionExecutable::visitChildren): Visit our code blocks
+        because they are strong references now, rather than weak, a la (1).
+
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor): Updated for interface changes.
+
+        * bytecode/UnlinkedCodeBlock.h:
+        (UnlinkedFunctionExecutable):
+        (UnlinkedFunctionCodeBlock): Strong now, not weak, a la (1).
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::CodeCache):
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::length):
+        (SourceCodeKey):
+        (CodeCacheMap):
+        (JSC::CodeCacheMap::CodeCacheMap):
+        (JSC::CodeCacheMap::find):
+        (JSC::CodeCacheMap::set):
+        (JSC::CodeCacheMap::clear):
+        (CodeCache):
+        (JSC::CodeCache::clear): Removed individual function tracking, due to (1).
+        Added explicit character counting, for (2).
+
+        You might think 16000000 characters is a lot. It is. But this patch
+        didn't establish that limit -- it just took the existing limit and
+        made it more visible. I intend to reduce the size of the cache in a
+        future patch.
+
+2013-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove support for bytecode comments, since it doesn't build, and hasn't been used in a while.
+        https://bugs.webkit.org/show_bug.cgi?id=110035
+
+        Rubber stamped by Andreas Kling.
+        
+        There are other ways of achieving the same effect, like adding print statements to the bytecode generator.
+        The fact that this feature doesn't build and nobody noticed implies that it's probably not a popular
+        feature. As well, the amount of wiring that was required for it was quite big considering its relatively
+        modest utility.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/Comment.h: Removed.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitOpcode):
+        (JSC):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::symbolTable):
+
+2013-02-16  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows] Unreviewed Visual Studio 2010 build fix after r143117
+
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Reference new path to property sheets.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+        Build correction after new operator == added.
+
+2013-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of Structure.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/Structure.h:
+
+2013-02-16  Christophe Dumez  <ch.dumez@sisa.samsung.com>
+
+        Unreviewed build fix.
+
+        Export symbol for new CString operator== operator to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-02-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure should be more methodical about the relationship between m_offset and m_propertyTable
+        https://bugs.webkit.org/show_bug.cgi?id=109978
+
+        Reviewed by Mark Hahnenberg.
+        
+        Allegedly, the previous relationship was that either m_propertyTable or m_offset
+        would be set, and if m_propertyTable was not set you could rebuild it.  In reality,
+        we would sometimes "reset" both: some transitions wouldn't set m_offset, and other
+        transitions would clear the previous structure's m_propertyTable.  So, in a
+        structure transition chain of A->B->C you could have:
+
+        A transitions to B: B doesn't copy m_offset but does copy m_propertyTable, because
+            that seemed like a good idea at the time (this was a common idiom in the code).
+        B transitions to C: C steals B's m_propertyTable, leaving B with neither a
+            m_propertyTable nor a m_offset.
+
+        Then we would ask for the size of the property storage of B and get the answer
+        "none".  That's not good.
+
+        Now, there is a new relationship, which, hopefully, should fix things: m_offset is
+        always set and always refers to the maximum offset ever used by the property table.
+        From this, you can infer both the inline and out-of-line property size, and
+        capacity.  This is accomplished by having PropertyTable::add() take a
+        PropertyOffset reference, which must be Structure::m_offset.  It will update this
+        offset.  As well, all transitions now copy m_offset.  And we frequently assert
+        (using RELEASE_ASSERT) that the m_offset matches what m_propertyTable would tell
+        you.  Hence if you ever modify the m_propertyTable, you'll also update the offset.
+        If you ever copy the property table, you'll also copy the offset.  Life should be
+        good, I think.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::add):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::checkConsistency):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        (JSC::PropertyTable::checkConsistency):
+        * runtime/Structure.h:
+        (JSC):
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::outOfLineCapacity):
+        (JSC::Structure::outOfLineSize):
+        (JSC::Structure::isEmpty):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+        (Structure):
+        (JSC::Structure::checkOffsetConsistency):
+
+2013-02-15  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Spread the gyp build files throughout the tree
+        https://bugs.webkit.org/show_bug.cgi?id=109960
+
+        Reviewed by Dirk Pranke.
+
+        * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Renamed from Source/WebKit/gtk/gyp/JavaScriptCore.gyp.
+        * JavaScriptCore.gyp/generate-derived-sources.sh: Renamed from Source/WebKit/gtk/gyp/generate-derived-sources.sh.
+
+2013-02-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SpeculativeJIT64 should be more precise about when it's dealing with a cell (even though it probably doesn't matter)
+        https://bugs.webkit.org/show_bug.cgi?id=109625
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Merged the global function cache into the source code cache
+        https://bugs.webkit.org/show_bug.cgi?id=108660
+
+        Reviewed by Sam Weinig.
+
+        Responding to review comments by Darin Adler.
+
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::SourceCodeKey): Don't initialize m_name and m_flags
+        in the hash table deleted value because they're meaningless.
+
+2013-02-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG AbstractState should filter operands to NewArray more precisely
+        https://bugs.webkit.org/show_bug.cgi?id=109900
+
+        Reviewed by Mark Hahnenberg.
+        
+        NewArray for primitive indexing types speculates that the inputs are the appropriate
+        primitives. Now, the CFA filters the abstract state accordingly, as well.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2013-02-15  Andreas Kling  <akling@apple.com>
+
+        Yarr: Use OwnPtr to make pattern/disjunction/character-class ownership clearer.
+        <http://webkit.org/b/109218>
+
+        Reviewed by Benjamin Poulain.
+
+        - Let classes that manage lifetime of other objects hold on to them with OwnPtr instead of raw pointers.
+        - Placed some strategic Vector::shrinkToFit(), ::reserveInitialCapacity() and ::swap().
+
+        668 kB progression on Membuster3.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        (ByteCompiler):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        (BytecodePattern):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
+        (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
+        (JSC::Yarr::YarrGenerator::opCompileBody):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::reset):
+        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::YarrPatternConstructor::copyDisjunction):
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
+        (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
+        (JSC::Yarr::YarrPatternConstructor::optimizeBOL):
+        (JSC::Yarr::YarrPatternConstructor::containsCapturingTerms):
+        (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::PatternDisjunction::addNewAlternative):
+        (PatternDisjunction):
+        (YarrPattern):
+        (JSC::Yarr::YarrPattern::reset):
+        (JSC::Yarr::YarrPattern::newlineCharacterClass):
+        (JSC::Yarr::YarrPattern::digitsCharacterClass):
+        (JSC::Yarr::YarrPattern::spacesCharacterClass):
+        (JSC::Yarr::YarrPattern::wordcharCharacterClass):
+        (JSC::Yarr::YarrPattern::nondigitsCharacterClass):
+        (JSC::Yarr::YarrPattern::nonspacesCharacterClass):
+        (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
+
+2013-02-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Merged the global function cache into the source code cache
+        https://bugs.webkit.org/show_bug.cgi?id=108660
+
+        Reviewed by Sam Weinig.
+
+        This has a few benefits:
+
+            (*) Saves a few kB by removing a second cache data structure.
+
+            (*) Reduces the worst case memory usage of the cache by 1.75X. (Heavy
+            use of 'new Function' and other techniques could cause us to fill
+            both root caches, and they didn't trade off against each other.)
+
+            (*) Paves the way for future improvements based on a non-trivial
+            cache key (for example, shrinkable pointer to the key string, and
+            more precise cache size accounting).
+
+        Also cleaned up the cache implementation and simplified it a bit.
+
+        * heap/Handle.h:
+        (HandleBase):
+        * heap/Strong.h:
+        (Strong): Build!
+
+        * runtime/CodeCache.cpp:
+        (JSC):
+        (JSC::CodeCache::getCodeBlock):
+        (JSC::CodeCache::generateFunctionCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        (JSC::CodeCache::usedFunctionCode): Updated for three interface changes:
+
+            (*) SourceCodeKey is a class, not a pair.
+
+            (*) Table values are abstract pointers, since they can be executables
+            or code blocks. (In a future patch, I'd like to change this so we
+            always store only code blocks. But that's too much for one patch.)
+
+            (*) The cache function is named "set" because it always overwrites
+            unconditionally.
+
+        * runtime/CodeCache.h:
+        (CacheMap):
+        (JSC::CacheMap::find):
+        (JSC::CacheMap::set):
+        (JSC::CacheMap::clear): Added support for specifying hash traits, so we
+        can use a SourceCodeKey.
+
+        Removed side table and random number generator to save space and reduce
+        complexity. Hash tables are already random, so we don't need another source
+        of randomness.
+
+        (SourceCodeKey):
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::isHashTableDeletedValue):
+        (JSC::SourceCodeKey::hash):
+        (JSC::SourceCodeKey::isNull):
+        (JSC::SourceCodeKey::operator==):
+        (JSC::SourceCodeKeyHash::hash):
+        (JSC::SourceCodeKeyHash::equal):
+        (SourceCodeKeyHash):
+        (SourceCodeKeyHashTraits):
+        (JSC::SourceCodeKeyHashTraits::isEmptyValue): A SourceCodeKey is just a
+        fancy triplet: source code string; function name (or null, for non-functions);
+        and flags. Flags and function name distinguish between functions and programs
+        with identical code, so they can live in the same cache.
+
+        I chose to use the source code string as the primary hashing reference
+        because it's likely to be unique. We can use profiling to choose another
+        technique in future, if collisions between functions and programs prove
+        to be hot. I suspect they won't.
+
+        (JSC::CodeCache::clear):
+        (CodeCache): Removed the second cache.
+
+        * heap/Handle.h:
+        (HandleBase):
+        * heap/Strong.h:
+        (Strong):
+        * runtime/CodeCache.cpp:
+        (JSC):
+        (JSC::CodeCache::getCodeBlock):
+        (JSC::CodeCache::generateFunctionCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        (JSC::CodeCache::usedFunctionCode):
+        * runtime/CodeCache.h:
+        (JSC):
+        (CacheMap):
+        (JSC::CacheMap::find):
+        (JSC::CacheMap::set):
+        (JSC::CacheMap::clear):
+        (SourceCodeKey):
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::isHashTableDeletedValue):
+        (JSC::SourceCodeKey::hash):
+        (JSC::SourceCodeKey::isNull):
+        (JSC::SourceCodeKey::operator==):
+        (JSC::SourceCodeKeyHash::hash):
+        (JSC::SourceCodeKeyHash::equal):
+        (SourceCodeKeyHash):
+        (SourceCodeKeyHashTraits):
+        (JSC::SourceCodeKeyHashTraits::isEmptyValue):
+        (JSC::CodeCache::clear):
+        (CodeCache):
+
+2013-02-14  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, set svn:eol-style native for .sln, .vcproj, and .vsprops files.
+        https://bugs.webkit.org/show_bug.cgi?id=96934
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops: Added property svn:eol-style.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops: Added property svn:eol-style.
+
+2013-02-14  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, set svn:eol-style CRLF for .sln files.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
+
+2013-02-14  David Kilzer  <ddkilzer@apple.com>
+
+        [Mac] Clean up WARNING_CFLAGS
+        <http://webkit.org/b/109747>
+        <rdar://problem/13208373>
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Use
+        GCC_WARN_64_TO_32_BIT_CONVERSION to enable and disable
+        -Wshorten-64-to-32 rather than WARNING_CFLAGS.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
+
+2013-02-13  Anders Carlsson  <andersca@apple.com>
+
+        Better build fix.
+
+        * API/tests/testapi.c:
+        (assertEqualsAsNumber):
+        (main):
+
+2013-02-13  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Build fix.
+
+        * API/tests/testapi.c:
+        (assertEqualsAsNumber):
+        (main):
+
+2013-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Yet another build fix
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2013-02-13  Zan Dobersek  <zdobersek@igalia.com>
+
+        The 'global isinf/isnan' compiler quirk required when using clang with libstdc++
+        https://bugs.webkit.org/show_bug.cgi?id=109325
+
+        Reviewed by Anders Carlsson.
+
+        Prefix calls to the isinf and isnan methods with std::, declaring we want to use the
+        two methods as they're provided by the C++ standard library being used.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::constantNaN):
+        * offlineasm/cloop.rb:
+        * runtime/DateConstructor.cpp:
+        (JSC::dateUTC): Also include an opportunistic style fix.
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toInteger):
+        * runtime/JSDateMath.cpp:
+        (JSC::getUTCOffset):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        (JSC::parseDate):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncIsNaN):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::sameValue):
+
+2013-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Change another use of (SpecCell & ~SpecString) to SpecObject.
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2013-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        ForwardInt32ToDouble is not in DFG::MinifiedNode's list of relevant node types
+        https://bugs.webkit.org/show_bug.cgi?id=109726
+
+        Reviewed by Mark Hahnenberg.
+        
+        If you add it to the list of relevant node types, you also need to make sure
+        it's listed as either hasChild or one of the other kinds. Otherwise you get
+        an assertion. This is causing test failures in run-javascriptcore-tests.
+
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::MinifiedNode::hasChild):
+
+2013-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        Rearranged the code somewhat to reduce the number of
+        DFG related ifdefs.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2013-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        ForwardInt32ToDouble is not in DFG::MinifiedNode's list of relevant node types
+        https://bugs.webkit.org/show_bug.cgi?id=109726
+
+        Reviewed by Gavin Barraclough.
+        
+        This is asymptomatic because ForwardInt32ToDouble is only used in SetLocals, in
+        which case the value is already stored to the stack.  Still, we should fix this.
+
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+
+2013-02-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG LogicalNot/Branch peephole removal and inversion ignores the possibility of things exiting
+        https://bugs.webkit.org/show_bug.cgi?id=109489
+
+        Reviewed by Mark Hahnenberg.
+        
+        If things can exit between the LogicalNot and the Branch then don't peephole.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2013-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Remove unnecessary indirection to non-local variable access operations
+        https://bugs.webkit.org/show_bug.cgi?id=109724
+
+        Reviewed by Filip Pizlo.
+
+        Linked bytecode now stores a direct pointer to the resolve operation
+        vectors, so the interpreter no longer needs a bunch of indirection to
+        to perform non-local lookup.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/Instruction.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGGraph.h:
+        (ResolveGlobalData):
+        (ResolveOperationData):
+        (PutToBaseOperationData):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_put_to_base):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emitSlow_op_resolve):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emitSlow_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emitSlow_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_put_to_base):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_put_to_base):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+
+2013-02-13  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        replaceWithJump should not decrease the offset by 1 on ARM traditional.
+        https://bugs.webkit.org/show_bug.cgi?id=109689
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::replaceWithJump):
+
+2013-02-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [iOS] Enable PAGE_VISIBILITY_API
+        https://bugs.webkit.org/show_bug.cgi?id=109399
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-02-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Renamed SpecObjectMask to SpecObject.
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        "SpecObjectMask" is a weird name considering that a bunch of the other speculated
+        types are also masks, but don't have "Mask" in the name.
+
+        * bytecode/SpeculatedType.h:
+        (JSC):
+        (JSC::isObjectSpeculation):
+        (JSC::isObjectOrOtherSpeculation):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2013-02-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA doesn't filter precisely enough for CompareStrictEq
+        https://bugs.webkit.org/show_bug.cgi?id=109618
+
+        Reviewed by Mark Hahnenberg.
+        
+        The backend speculates object for this case, but the CFA was filtering on
+        (SpecCell & ~SpecString) | SpecOther.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2013-02-12  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the gyp build of JavaScriptCore.
+
+        * JavaScriptCore.gypi: Added some missing DFG files to the source list.
+
+2013-02-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r142387.
+        http://trac.webkit.org/changeset/142387
+        https://bugs.webkit.org/show_bug.cgi?id=109601
+
+        caused all layout and jscore tests on windows to fail
+        (Requested by kling on #webkit).
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (UnlinkedCodeBlock):
+
+2013-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CompareEq optimization should be retuned
+        https://bugs.webkit.org/show_bug.cgi?id=109545
+
+        Reviewed by Mark Hahnenberg.
+        
+        - Made the object-to-object equality case work again by hoisting the if statement
+          for it. Previously, object-to-object equality would be compiled as
+          object-to-object-or-other.
+        
+        - Added AbstractState guards for most of the type checks that the object equality
+          code uses.
+        
+        Looks like a hint of a speed-up on all of the things.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2013-02-12  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        JSC asserting with long parameter list functions in debug mode on ARM traditional
+        https://bugs.webkit.org/show_bug.cgi?id=109565
+
+        Reviewed by Zoltan Herczeg.
+
+        Increase the value of sequenceGetByIdSlowCaseInstructionSpace to 80.
+
+        * jit/JIT.h:
+
+2013-02-11  Oliver Hunt  <oliver@apple.com>
+
+        Make JSC API more NULL tolerant
+        https://bugs.webkit.org/show_bug.cgi?id=109515
+
+        Reviewed by Mark Hahnenberg.
+
+        We do so much marshalling for the C API these days anyway that a single null
+        check isn't a performance issue.  Yet the existing "null is unsafe" behaviour
+        leads to crashes in embedding applications whenever there's an untested code
+        path, so it seems having defined behaviour is superior.
+
+        * API/APICast.h:
+        (toJS):
+        (toJSForGC):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        (JSObjectIsConstructor):
+        (JSObjectCallAsConstructor):
+        * API/tests/testapi.c:
+        (main):
+
+2013-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, adding a FIXME to remind ourselves of a bug.
+        https://bugs.webkit.org/show_bug.cgi?id=109487
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+
+2013-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Strange bug in DFG OSR in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=109491
+
+        Reviewed by Mark Hahnenberg.
+        
+        Int32ToDouble was being injected after a side-effecting operation and before a SetLocal. Anytime we
+        inject something just before a SetLocal we should be aware that the previous operation may have been
+        a side-effect associated with the current code origin. Hence, we should use a forward exit.
+        Int32ToDouble does not do forward exits by default.
+        
+        This patch adds a forward-exiting form of Int32ToDouble, for use in SetLocal Int32ToDouble injections.
+        Changed the CSE and other things to treat these nodes identically, but for the exit strategy to be
+        distinct (Int32ToDouble -> backward, ForwardInt32ToDouble -> forward). The use of the NodeType for
+        signaling exit direction is not "great" but it's what we use in other places already (like
+        ForwardCheckStructure).
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::int32ToDoubleCSE):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCommon.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+
+2013-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        NonStringCell and Object are practically the same thing for the purpose of speculation
+        https://bugs.webkit.org/show_bug.cgi?id=109492
+
+        Reviewed by Mark Hahnenberg.
+        
+        Removed isNonStringCellSpeculation, and made all callers use isObjectSpeculation.
+        
+        Changed isNonStringCellOrOtherSpeculation to be isObjectOrOtherSpeculation.
+        
+        I believe this is correct because even weird object types like JSNotAnObject end up
+        being "objects" from the standpoint of our typesystem. Anyway, the assumption that
+        "is cell but not a string" equates to "object" is an assumption that is already made
+        in other places in the system so there's little value in being paranoid about it.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isObjectSpeculation):
+        (JSC::isObjectOrOtherSpeculation):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::shouldSpeculateObjectOrOther):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
+        https://bugs.webkit.org/show_bug.cgi?id=109387
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        Lock in the decision to use a non-speculative constant comparison as early as possible
+        and don't let the CFA change it by folding constants. This might be a performance
+        penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
+        the other hand it completely side-steps the unsoundness that the bug speaks of.
+        
+        Rolling back in after adding 32-bit path.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG TypeOf implementation should have its backend code aligned to what the CFA does
+        https://bugs.webkit.org/show_bug.cgi?id=109385
+
+        Reviewed by Sam Weinig.
+        
+        The problem was that if we ended up trying to constant fold, but didn't succeed
+        because of prediction mismatches, then we would also fail to do filtration.
+        
+        Rearranged the control flow in the CFA to fix that.
+        
+        As far as I know, this is asymptomatic - it's sort of OK for the CFA to prove less
+        things, which is what the bug was.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2013-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r142491.
+        http://trac.webkit.org/changeset/142491
+        https://bugs.webkit.org/show_bug.cgi?id=109470
+
+        broke the 32 bit build (Requested by jessieberlin on #webkit).
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
+        https://bugs.webkit.org/show_bug.cgi?id=109387
+
+        Reviewed by Oliver Hunt.
+        
+        Lock in the decision to use a non-speculative constant comparison as early as possible
+        and don't let the CFA change it by folding constants. This might be a performance
+        penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
+        the other hand it completely side-steps the unsoundness that the bug speaks of.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed fix after r13954 for !ENABLE(JIT) builds.
+
+        * llint/LowLevelInterpreter.cpp:
+
+2013-02-11  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        JSC build failing with verbose debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=109441
+
+        Reviewed by Darin Adler.
+
+        Fixing some verbose messages which caused build errors.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+
+2013-02-10  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the GTK+ gyp build
+
+        * JavaScriptCore.gypi: Update the source list to accurately
+        reflect what's in the repository and remove the offsets extractor
+        from the list of JavaScriptCore files. It's only used to build
+        the extractor binary.
+
+2013-02-09  Andreas Kling  <akling@apple.com>
+
+        Shrink-wrap UnlinkedCodeBlock members.
+        <http://webkit.org/b/109368>
+
+        Reviewed by Oliver Hunt.
+
+        Rearrange the members of UnlinkedCodeBlock to avoid unnecessary padding on 64-bit.
+        Knocks ~600 KB off of the Membuster3 peak.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (UnlinkedCodeBlock):
+
+2013-02-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should allow phases to break Phi's and then have one phase to rebuild them
+        https://bugs.webkit.org/show_bug.cgi?id=108414
+
+        Reviewed by Mark Hahnenberg.
+        
+        Introduces two new DFG forms: LoadStore and ThreadedCPS. These are described in
+        detail in DFGCommon.h.
+        
+        Consequently, DFG phases no longer have to worry about preserving data flow
+        links between basic blocks. It is generally always safe to request that the
+        graph be dethreaded (Graph::dethread), which brings it into LoadStore form, where
+        the data flow is implicit. In this form, only liveness-at-head needs to be
+        preserved.
+        
+        All of the machinery for "threading" the graph to introduce data flow between
+        blocks is now moved out of the bytecode parser and into the CPSRethreadingPhase.
+        All phases that previously did this maintenance themselves now just rely on
+        being able to dethread the graph. The one exception is the structure check
+        hoising phase, which operates over a threaded graph and preserves it, for the
+        sake of performance.
+        
+        Also moved two other things into their own phases: unification (previously found
+        in the parser) and prediction injection (previously found in various places).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/Operands.h:
+        (Operands):
+        (JSC::Operands::sizeFor):
+        (JSC::Operands::atFor):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        * dfg/DFGAllocator.h:
+        (JSC::DFG::::allocateSlow):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGBasicBlockInlines.h:
+        (DFG):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::killUnreachable):
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        (CFGSimplificationPhase):
+        (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCPSRethreadingPhase.cpp: Added.
+        (DFG):
+        (CPSRethreadingPhase):
+        (JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
+        (JSC::DFG::CPSRethreadingPhase::run):
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        (JSC::DFG::CPSRethreadingPhase::clearVariablesAtHeadAndTail):
+        (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
+        (JSC::DFG::CPSRethreadingPhase::addPhi):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocal):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeSetLocal):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocal):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeSetArgument):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlocks):
+        (JSC::DFG::CPSRethreadingPhase::propagatePhis):
+        (JSC::DFG::CPSRethreadingPhase::PhiStackEntry::PhiStackEntry):
+        (PhiStackEntry):
+        (JSC::DFG::CPSRethreadingPhase::phiStackFor):
+        (JSC::DFG::performCPSRethreading):
+        * dfg/DFGCPSRethreadingPhase.h: Added.
+        (DFG):
+        * dfg/DFGCSEPhase.cpp:
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCommon.cpp:
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::logCompilationChanges):
+        (DFG):
+        (WTF):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dethread):
+        (JSC::DFG::Graph::collectGarbage):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::performSubstitution):
+        (Graph):
+        (JSC::DFG::Graph::performSubstitutionForEdge):
+        (JSC::DFG::Graph::convertToConstant):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomLocal):
+        (Node):
+        (JSC::DFG::Node::convertToGetLocal):
+        (JSC::DFG::Node::hasVariableAccessData):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::beginPhase):
+        * dfg/DFGPhase.h:
+        (JSC::DFG::runAndLog):
+        * dfg/DFGPredictionInjectionPhase.cpp: Added.
+        (DFG):
+        (PredictionInjectionPhase):
+        (JSC::DFG::PredictionInjectionPhase::PredictionInjectionPhase):
+        (JSC::DFG::PredictionInjectionPhase::run):
+        (JSC::DFG::performPredictionInjection):
+        * dfg/DFGPredictionInjectionPhase.h: Added.
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::run):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * dfg/DFGUnificationPhase.cpp: Added.
+        (DFG):
+        (UnificationPhase):
+        (JSC::DFG::UnificationPhase::UnificationPhase):
+        (JSC::DFG::UnificationPhase::run):
+        (JSC::DFG::performUnification):
+        * dfg/DFGUnificationPhase.h: Added.
+        (DFG):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::dumpGraphIfAppropriate):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dump):
+        * runtime/JSString.h:
+        (JSString):
+        * runtime/Options.h:
+        (JSC):
+
+2013-02-08  Jer Noble  <jer.noble@apple.com>
+
+        Bring WebKit up to speed with latest Encrypted Media spec.
+        https://bugs.webkit.org/show_bug.cgi?id=97037
+
+        Reviewed by Eric Carlson.
+
+        Define the ENABLE_ENCRYPTED_MEDIA_V2 setting.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-02-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Objective-C API for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=105889
+
+        Reviewed by Joseph Pecoraro
+
+        Following up on review comments, mostly typos.
+
+        * API/JSBlockAdaptor.h:
+        * API/JSBlockAdaptor.mm:
+        (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
+        * API/JSContext.h:
+        * API/JSExport.h:
+        * API/JSValue.h:
+        * API/JSValue.mm:
+        * API/JSWrapperMap.mm:
+        (selectorToPropertyName):
+        (-[JSWrapperMap classInfoForClass:]):
+        (-[JSWrapperMap wrapperForObject:]):
+
+2013-02-08  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Add an experimental gyp build
+        https://bugs.webkit.org/show_bug.cgi?id=109003
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * JavaScriptCore.gypi: Update the list of source files to include those
+        necessary for the GTK+ build.
+
+2013-02-08  Andreas Kling  <akling@apple.com>
+
+        JSC: Lower minimum PropertyTable size.
+        <http://webkit.org/b/109247>
+
+        Reviewed by Darin Adler.
+
+        Lower the minimum table size for PropertyTable from 16 to 8.
+        3.32 MB progression on Membuster3 (a ~13% reduction in memory used by PropertyTables.)
+
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::sizeForCapacity):
+
+2013-02-07  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. More VS2010 WebKit solution touchups.
+        Make JavaScriptCoreExports.def.in be treated as a custom build file so that changes to it cause the exports to be rebuilt.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-02-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: testapi.mm should use ARC
+        https://bugs.webkit.org/show_bug.cgi?id=107838
+
+        Reviewed by Mark Rowe.
+
+        Removing the changes to the Xcode project file and moving the equivalent flags into 
+        the ToolExecutable xcconfig file.
+
+        * Configurations/ToolExecutable.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-02-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows] Unreviewed Visual Studio 2010 build fixes after r142179.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Correct changed symbols
+        * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Removed autogenerated file.
+
+2013-02-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ByteCodeParser should do surgical constant folding to reduce load on the optimization fixpoint
+        https://bugs.webkit.org/show_bug.cgi?id=109000
+
+        Reviewed by Oliver Hunt.
+        
+        Previously our source parser's ASTBuilder did some surgical constant folding, but it
+        didn't cover some cases.  It was particularly incapable of doing constant folding for
+        cases where we do some minimal loop peeling in the bytecode generator - since it
+        didn't "see" those constants prior to the peeling.  Example:
+
+        for (var i = 0; i < 4; ++i)
+            things;
+
+        This will get peeled just a bit by the bytecode generator, so that the "i < 4" is
+        duplicated both at the top of the loop and the bottom.  This means that we have a
+        constant comparison: "0 < 4", which the bytecode generator emits without any further
+        thought.
+
+        The DFG optimization fixpoint of course folds this and simplifies the CFG 
+        accordingly, but this incurs a compile-time cost.  The purpose of this change is to
+        do some surgical constant folding in the DFG's bytecode parser, so that such
+        constructs reduce load on the CFG simplifier and the optimization fixpoint.  The goal
+        is not to cover all cases, since the DFG CFA and CFG simplifier have a powerful
+        sparse conditional constant propagation that we can always fall back on. Instead the
+        goal is to cover enough cases that for common small functions we don't have to
+        perform such transformations, thereby reducing compile times.
+        
+        This also refactors m_inlineStackEntry->m_inlineCallFrame to be a handy method call
+        and also adds the notion of a TriState-based JSValue::pureToBoolean(). Both of these
+        things are used by the folder.
+        
+        As well, care has been taken to make sure that the bytecode parser only does folding
+        that is statically provable, and that doesn't arise out of speculation. This means
+        we cannot fold on data flow that crosses inlining boundaries. On the other hand, the
+        folding that the bytecode parser uses doesn't require phantoming anything. Such is
+        the trade-off: for anything that we do need phantoming, we defer it to the
+        optimization fixpoint.
+        
+        Slight SunSpider speed-up.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::inlineCallFrame):
+        (JSC::DFG::ByteCodeParser::currentCodeOrigin):
+        (JSC::DFG::ByteCodeParser::canFold):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::getScope):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isStronglyProvedConstantIn):
+        (Node):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::pureToBoolean):
+        (JSC):
+
+2013-02-07  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Invalid code is generated for storing constants with baseindex addressing modes on ARM traditional.
+        https://bugs.webkit.org/show_bug.cgi?id=109050
+
+        Reviewed by Oliver Hunt.
+
+        The S! scratch register is reused, but it should contain the constant value.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        (JSC::ARMAssembler::baseIndexTransfer16):
+
+2013-02-07  Andras Becsi  <andras.becsi@digia.com>
+
+        [Qt] Use GNU ar's thin archive format for intermediate static libs
+        https://bugs.webkit.org/show_bug.cgi?id=109052
+
+        Reviewed by Jocelyn Turcotte.
+
+        Adjust project files that used activeBuildConfig()
+        to use targetSubDir().
+
+        * JavaScriptCore.pri:
+        * LLIntOffsetsExtractor.pro:
+        * Target.pri:
+
+2013-02-06  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Touchups to VS2010 WebKit solution.
+        Fix an export generator script, modify some property sheets, add resouce file.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
+        * JavaScriptCore.vcxproj/resource.h: Added.
+
+2013-02-06  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: Native Memory Instrumentation: assign class name to the heap graph node automatically
+        https://bugs.webkit.org/show_bug.cgi?id=107262
+
+        Reviewed by Yury Semikhatsky.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-02-06  Mike West  <mkwst@chromium.org>
+
+        Add an ENABLE_NOSNIFF feature flag.
+        https://bugs.webkit.org/show_bug.cgi?id=109029
+
+        Reviewed by Jochen Eisinger.
+
+        This new flag will control the behavior of 'X-Content-Type-Options: nosniff'
+        when processing script and other resource types.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        put_to_base should emit a Phantom for "value" across the ForceOSRExit
+        https://bugs.webkit.org/show_bug.cgi?id=108998
+
+        Reviewed by Oliver Hunt.
+
+        Otherwise, the OSR exit compiler could clobber it, which would lead to badness.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::tallyFrequentExitSites): Build fixes for when DFG debug logging is enabled.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Added extra Phantoms for the "value" field where needed.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Ditto.
+
+2013-02-05  Michael Saboff  <msaboff@apple.com>
+
+        Crash at JSC::call when loading www.gap.com with JSVALUE32_64 Enabled
+        https://bugs.webkit.org/show_bug.cgi?id=108991
+
+        Reviewed by Oliver Hunt.
+
+        Changed the restoration from calleeGPR to nonArgGPR0 because the restoration of the return location
+        may step on calleeGPR is it happen to be nonArgGPR2.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkClosureCall):
+
+2013-02-05  Roger Fong  <roger_fong@apple.com>
+
+        Add a JavaScriptCore Export Generator project.
+        https://bugs.webkit.org/show_bug.cgi?id=108971.
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Added.
+
+2013-02-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have a precise view of jump targets
+        https://bugs.webkit.org/show_bug.cgi?id=108868
+
+        Reviewed by Oliver Hunt.
+        
+        Previously, the DFG relied entirely on the CodeBlock's jump targets list for
+        determining when to break basic blocks. This worked great, except sometimes it
+        would be too conservative since the CodeBlock just says where the bytecode
+        generator inserted labels.
+        
+        This change keeps the old jump target list in CodeBlock since it is still
+        valuable to the baseline JIT, but switches the DFG to use its own jump target
+        calculator. This ought to reduce pressure on the DFG simplifier, which would
+        previously do a lot of work to try to merge redundantly created basic blocks.
+        It appears to be a 1% progression on SunSpider.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/PreciseJumpTargets.cpp: Added.
+        (JSC):
+        (JSC::addSimpleSwitchTargets):
+        (JSC::computePreciseJumpTargets):
+        * bytecode/PreciseJumpTargets.h: Added.
+        (JSC):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+
+2013-02-01  Roger Fong  <roger_fong@apple.com>
+
+        Make ConfigurationBuildDir include directories precede WebKitLibraries in JSC.
+        https://bugs.webkit.org/show_bug.cgi?id=108693.
+
+        Rubberstamped by Timothy Horton.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Structure::m_outOfLineCapacity is unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=108206
+
+        Reviewed by Darin Adler.
+
+        Simplifying the utility functions that we use since we don't need a 
+        bunch of fancy templates for this one specific call site.
+
+        * runtime/Structure.h:
+        (JSC::Structure::outOfLineCapacity):
+
+2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: testapi.mm should use ARC
+        https://bugs.webkit.org/show_bug.cgi?id=107838
+
+        Reviewed by Oliver Hunt.
+
+        In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs.
+        We should enable ARC, since that is what most of our clients will be using. We use Xcode project 
+        settings to make sure we don't try to compile ARC on 32-bit.
+
+        * API/tests/testapi.mm:
+        (+[TestObject testObject]):
+        (testObjectiveCAPI):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-02-05  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows] Unreviewed VS2010 Build Correction after r141651
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing
+        StructureRareData.h and StructureRareData.cpp files.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+
+2013-02-05  Michael Saboff  <msaboff@apple.com>
+
+        r141788 won't build due to not having all changes needed by Node* change
+        https://bugs.webkit.org/show_bug.cgi?id=108944
+
+        Reviewed by David Kilzer.
+
+        Fixed three instances of integerResult(..., m_compileIndex) to be integerResult(..., node).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
+
+2013-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r141809.
+        http://trac.webkit.org/changeset/141809
+        https://bugs.webkit.org/show_bug.cgi?id=108860
+
+        ARC isn't supported on 32-bit. (Requested by mhahnenberg on
+        #webkit).
+
+        * API/tests/testapi.mm:
+        (+[TestObject testObject]):
+        (testObjectiveCAPI):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: testapi.mm should use ARC
+        https://bugs.webkit.org/show_bug.cgi?id=107838
+
+        Reviewed by Oliver Hunt.
+
+        In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs. 
+        We should enable ARC, since that is what most of our clients will be using.
+
+        * API/tests/testapi.mm:
+        (-[TestObject init]):
+        (-[TestObject dealloc]):
+        (+[TestObject testObject]):
+        (testObjectiveCAPI):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: ObjCCallbackFunction should retain the target of its NSInvocation
+        https://bugs.webkit.org/show_bug.cgi?id=108843
+
+        Reviewed by Darin Adler.
+
+        Currently, ObjCCallbackFunction doesn't retain the target of its NSInvocation. It needs to do 
+        this to prevent crashes when trying to invoke a callback later on.
+
+        * API/ObjCCallbackFunction.mm:
+        (ObjCCallbackFunction::ObjCCallbackFunction):
+        (ObjCCallbackFunction::~ObjCCallbackFunction):
+
+2013-02-04  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix GTK+ 'make dist' in preparation for the 1.11.5 release.
+
+        * GNUmakefile.list.am: Update the source lists.
+
+2013-02-04  Michael Saboff  <msaboff@apple.com>
+
+        For ARMv7s use integer divide instruction for divide and modulo when possible
+        https://bugs.webkit.org/show_bug.cgi?id=108840
+
+        Reviewed in person by Filip Pizlo.
+
+        Added ARMv7s integer divide path for ArithDiv and ArithMod where operands and results are integer.
+        This is patterned after the similar code for X86.  Also added modulo power of 2 optimization
+        that uses logical and.  Added sdiv and udiv to the ARMv7 disassembler.  Put all the changes
+        behind #if CPU(APPLE_ARMV7S). 
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::sdiv):
+        (JSC::ARMv7Assembler::udiv):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::isARMv7s):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        Check PrivateHeaders/JSBasePrivate.h for inappropriate macros
+        <http://webkit.org/b/108749>
+
+        Reviewed by Joseph Pecoraro.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add
+        PrivateHeaders/JSBasePrivate.h to list of headers to check in
+        "Check for Inappropriate Macros in External Headers" build phase
+        script.
+
+2013-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        Remove duplicate entries from JavaScriptCore Xcode project
+
+            $ uniq Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | diff -u - Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | patch -p0 -R
+            patching file Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Remove duplicates.
+
+2013-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        Sort JavaScriptCore Xcode project file
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-02-03  David Kilzer  <ddkilzer@apple.com>
+
+        Upstream ENABLE_PDFKIT_PLUGIN settting
+        <http://webkit.org/b/108792>
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig: Disable PDFKIT_PLUGIN
+        on iOS since PDFKit is a Mac-only framework.
+
+2013-02-02  Andreas Kling  <akling@apple.com>
+
+        Vector should consult allocator about ideal size when choosing capacity.
+        <http://webkit.org/b/108410>
+        <rdar://problem/13124002>
+
+        Reviewed by Benjamin Poulain.
+
+        Remove assertion about Vector capacity that won't hold anymore since capacity()
+        may not be what you passed to reserveCapacity().
+        Also export WTF::fastMallocGoodSize() for Windows builds.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2013-02-02  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Adopt the WinCE port to new CMake
+        https://bugs.webkit.org/show_bug.cgi?id=108754
+
+        Reviewed by Laszlo Gombos.
+
+        * os-win32/WinMain.cpp: Removed.
+        * shell/PlatformWinCE.cmake: Removed.
+
+2013-02-02  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/108745> WTF shouldn't use a script build phase to detect the presence of headers when the compiler can do it for us
+
+        Reviewed by Sam Weinig.
+
+        * DerivedSources.make: Remove an obsolete Makefile rule. This should have been removed when the use
+        of the generated file moved to WTF.
+
+2013-02-02  David Kilzer  <ddkilzer@apple.com>
+
+        Upstream iOS FeatureDefines
+        <http://webkit.org/b/108753>
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+        - ENABLE_DEVICE_ORIENTATION: Add iOS configurations.
+        - ENABLE_PLUGIN_PROXY_FOR_VIDEO: Ditto.
+        - FEATURE_DEFINES: Add ENABLE_PLUGIN_PROXY_FOR_VIDEO.  Add
+          PLATFORM_NAME variant to reduce future merge conflicts. 
+
+2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Structure::m_enumerationCache should be moved to StructureRareData
+        https://bugs.webkit.org/show_bug.cgi?id=108723
+
+        Reviewed by Oliver Hunt.
+
+        m_enumerationCache is only used by objects whose properties are iterated over, so not every Structure needs this 
+        field and it can therefore be moved safely to StructureRareData to help with memory savings.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSPropertyNameIterator):
+        (JSC::Register::propertyNameIterator):
+        (JSC::StructureRareData::enumerationCache): Add to JSPropertyNameIterator.h so that it can see the correct type.
+        (JSC::StructureRareData::setEnumerationCache): Ditto.
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyWithoutTransition): Use the enumerationCache() getter rather than accessing the field.
+        (JSC::Structure::removePropertyWithoutTransition): Ditto.
+        (JSC::Structure::visitChildren): We no longer have to worry about marking the m_enumerationCache field.
+        * runtime/Structure.h: 
+        (JSC::Structure::setEnumerationCache): Move the old accessors back since we don't have to have any knowledge of 
+        the JSPropertyNameIterator type.
+        (JSC::Structure::enumerationCache): Ditto.
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::visitChildren): Mark the new m_enumerationCache field.
+        * runtime/StructureRareData.h: Add new functions/fields.
+        (StructureRareData):
+
+2013-02-01  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. JavaScriptCore VS2010 project cleanup.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+
+2013-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r141662.
+        http://trac.webkit.org/changeset/141662
+        https://bugs.webkit.org/show_bug.cgi?id=108738
+
+        it's an incorrect change since processPhiStack will
+        dereference dangling BasicBlock pointers (Requested by pizlo
+        on #webkit).
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+
+2013-02-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Eliminate dead blocks sooner in the DFG::ByteCodeParser to make clear that you don't need to hold onto them during Phi construction
+        https://bugs.webkit.org/show_bug.cgi?id=108717
+
+        Reviewed by Mark Hahnenberg.
+        
+        I think this makes the code clearer. It doesn't change behavior.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+
+2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Structure should have a StructureRareData field to save space
+        https://bugs.webkit.org/show_bug.cgi?id=108659
+
+        Reviewed by Oliver Hunt.
+
+        Many of the fields in Structure are used in a subset of all total Structures; however, all Structures must 
+        pay the memory cost of those fields, regardless of whether they use them or not. Since we can have potentially 
+        many Structures on a single page (e.g. bing.com creates ~1500 Structures), it would be profitable to 
+        refactor Structure so that not every Structure has to pay the memory costs for these infrequently used fields.
+
+        To accomplish this, we can create a new StructureRareData class to house these seldom used fields which we 
+        can allocate on demand whenever a Structure requires it. This StructureRareData can itself be a JSCell, and 
+        can do all the marking of the fields for the Structure. The StructureRareData field will be part of a union 
+        with m_previous to minimize overhead. We'll add a new field to JSTypeInfo to indicate that the Structure has 
+        a StructureRareData field. During transitions, a Structure will clone its previous Structure's StructureRareData 
+        if it has one. There could be some potential for optimizing this process, but the initial implementation will 
+        be dumb since we'd be paying these overhead costs for each Structure anyways.
+
+        Initially we'll only put two fields in the StructureRareData to avoid a memory regression. Over time we'll 
+        continue to move fields from Structure to StructureRareData. Optimistically, this could potentially reduce our 
+        Structure memory footprint by up to around 75%. It could also clear the way for removing destructors from 
+        Structures (and into StructureRareData).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGRepatch.cpp: Includes for linking purposes.
+        * jit/JITStubs.cpp:
+        * jsc.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * runtime/JSCellInlines.h: Added ifdef guards.
+        * runtime/JSGlobalData.cpp: New Structure for StructureRareData class.
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSTypeInfo.h: New flag to indicate whether or not a Structure has a StructureRareData field.
+        (JSC::TypeInfo::flags):
+        (JSC::TypeInfo::structureHasRareData):
+        * runtime/ObjectPrototype.cpp:
+        * runtime/Structure.cpp: We use a combined WriteBarrier<JSCell> field m_previousOrRareData to avoid compiler issues.
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::Structure): 
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::pin):
+        (JSC::Structure::allocateRareData): Handles allocating a brand new StructureRareData field.
+        (JSC::Structure::cloneRareDataFrom): Handles cloning a StructureRareData field from another. Used during Structure 
+        transitions.
+        (JSC::Structure::visitChildren): We no longer have to worry about marking m_objectToStringValue.
+        * runtime/Structure.h:
+        (JSC::Structure::previousID): Checks the structureHasRareData flag to see where it should get the previous Structure.
+        (JSC::Structure::objectToStringValue): Reads the value from the StructureRareData. If it doesn't exist, returns 0.
+        (JSC::Structure::setObjectToStringValue): Ensures that we have a StructureRareData field, then forwards the function 
+        call to it.
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::setPreviousID): Checks for StructureRareData and forwards if necessary.
+        (Structure):
+        (JSC::Structure::clearPreviousID): Ditto.
+        (JSC::Structure::create):
+        * runtime/StructureRareData.cpp: Added. All of the basic functionality of a JSCell with the fields that we've moved 
+        from Structure and the functions required to access/modify those fields as Structure would have done.
+        (JSC):
+        (JSC::StructureRareData::createStructure):
+        (JSC::StructureRareData::create):
+        (JSC::StructureRareData::clone):
+        (JSC::StructureRareData::StructureRareData):
+        (JSC::StructureRareData::visitChildren):
+        * runtime/StructureRareData.h: Added.
+        (JSC):
+        (StructureRareData):
+        * runtime/StructureRareDataInlines.h: Added.
+        (JSC):
+        (JSC::StructureRareData::previousID):
+        (JSC::StructureRareData::setPreviousID):
+        (JSC::StructureRareData::clearPreviousID):
+        (JSC::Structure::previous): Handles the ugly casting to get the value of the right type of m_previousOrRareData.
+        (JSC::Structure::rareData): Ditto.
+        (JSC::StructureRareData::objectToStringValue):
+        (JSC::StructureRareData::setObjectToStringValue):
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGRepatch.cpp:
+        * jit/JITStubs.cpp:
+        * jsc.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * runtime/JSCellInlines.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSTypeInfo.h:
+        (JSC):
+        (JSC::TypeInfo::flags):
+        (JSC::TypeInfo::structureHasRareData):
+        * runtime/ObjectPrototype.cpp:
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::pin):
+        (JSC::Structure::allocateRareData):
+        (JSC):
+        (JSC::Structure::cloneRareDataFrom):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC::Structure::previousID):
+        (JSC::Structure::objectToStringValue):
+        (JSC::Structure::setObjectToStringValue):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::setPreviousID):
+        (Structure):
+        (JSC::Structure::clearPreviousID):
+        (JSC::Structure::previous):
+        (JSC::Structure::rareData):
+        (JSC::Structure::create):
+        * runtime/StructureRareData.cpp: Added.
+        (JSC):
+        (JSC::StructureRareData::createStructure):
+        (JSC::StructureRareData::create):
+        (JSC::StructureRareData::clone):
+        (JSC::StructureRareData::StructureRareData):
+        (JSC::StructureRareData::visitChildren):
+        * runtime/StructureRareData.h: Added.
+        (JSC):
+        (StructureRareData):
+        * runtime/StructureRareDataInlines.h: Added.
+        (JSC):
+        (JSC::StructureRareData::previousID):
+        (JSC::StructureRareData::setPreviousID):
+        (JSC::StructureRareData::clearPreviousID):
+        (JSC::StructureRareData::objectToStringValue):
+        (JSC::StructureRareData::setObjectToStringValue):
+
+2013-02-01  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        offlineasm BaseIndex handling is broken on ARM due to MIPS changes
+        https://bugs.webkit.org/show_bug.cgi?id=108261
+
+        Reviewed by Filip Pizlo.
+
+        offlineasm BaseIndex handling fix on MIPS.
+
+        * offlineasm/mips.rb:
+        * offlineasm/risc.rb:
+
+2013-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed an unused function: JSGlobalObject::createFunctionExecutableFromGlobalCode
+        https://bugs.webkit.org/show_bug.cgi?id=108657
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+
+2013-02-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Added TriState to WTF and started using it in one place
+        https://bugs.webkit.org/show_bug.cgi?id=108628
+
+        Reviewed by Beth Dakin.
+
+        * runtime/PrototypeMap.h:
+        (JSC::PrototypeMap::isPrototype): Use TriState instead of boolean. In
+        response to review feedback, this is an attempt to clarify that our
+        'true' condition is actually just a 'maybe'.
+
+        * runtime/PrototypeMap.h:
+        (PrototypeMap):
+        (JSC::PrototypeMap::isPrototype):
+
+2013-02-01  Alexis Menard  <alexis@webkit.org>
+
+        Enable unprefixed CSS transitions by default.
+        https://bugs.webkit.org/show_bug.cgi?id=108216
+
+        Reviewed by Dean Jackson.
+
+        Rename the flag CSS_TRANSFORMS_ANIMATIONS_TRANSITIONS_UNPREFIXED
+        to CSS_TRANSFORMS_ANIMATIONS_UNPREFIXED which will be used later to 
+        guard the unprefixing work for CSS Transforms and animations.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::CFGSimplificationPhase::keepOperandAlive() conflates liveness and availability
+        https://bugs.webkit.org/show_bug.cgi?id=108580
+
+        Reviewed by Oliver Hunt.
+        
+        This is a harmless bug in that it only results in us keeping a bit too many things
+        for OSR.  But it's worth fixing so that the code is consistent.
+
+        keepOperandAlive() is called when block A has a branch to blocks B and C, but the
+        A->B edge is proven to never be taken and we want to optimize the code to have A
+        unconditionally jump to C.  In that case, for the purposes of OSR, we need to
+        preserve the knowledge that the state that B expected to be live incoming from A
+        ought still to be live up to the point of where the A->B,C branch used to be.  The
+        way we keep things alive is by using the variablesAtTail of A (i.e., we use the
+        knowledge of in what manner A made state available to B and C).  The way we choose
+        which state should be kept alive ought to be chosen by the variablesAtHead of B
+        (i.e. the things B says it needs from its predecessors, including A), except that
+        keepOperandAlive() was previously just using variablesAtTail of A for this
+        purpose.
+        
+        The fix is to have keepOperandAlive() use both liveness and availability in its
+        logic. It should use liveness (i.e. B->variablesAtHead) to decide what to keep
+        alive, and it should use availability (i.e. A->variablesAtTail) to decide how to
+        keep it alive.
+        
+        This might be a microscopic win on some programs, but it's mainly intended to be
+        a code clean-up so that I don't end up scratching my head in confusion the next
+        time I look at this code.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        (JSC::DFG::CFGSimplificationPhase::jettisonBlock):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
+2013-01-31  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION (r141192): Crash beneath cti_op_get_by_id_generic @ discussions.apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=108576
+
+        Reviewed by Filip Pizlo.
+
+        This was a long-standing bug. The DFG would destructively reuse a register
+        in op_convert_this, but:
+
+            * The bug only presented during speculation failure for type Other
+
+            * The bug presented by removing the low bits of a pointer, which
+            used to be harmless, since all objects were so aligned anyway.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Don't reuse our this register as
+        our scratch register. The whole point of our scratch register is to
+        avoid destructively modifying our this register. I'm pretty sure this
+        was a copy-paste error.
+
+2013-01-31  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-01-31  Jessie Berlin  <jberlin@apple.com>
+
+        Rolling out r141407 because it is causing crashes under
+        WTF::TCMalloc_Central_FreeList::FetchFromSpans() in Release builds.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: JSContext exception property causes reference cycle
+        https://bugs.webkit.org/show_bug.cgi?id=107778
+
+        Reviewed by Darin Adler.
+
+        JSContext has a (retain) JSValue * exception property which, when non-null, creates a 
+        reference cycle (since the JSValue * holds a strong reference back to the JSContext *).
+
+        * API/JSContext.mm: Instead of JSValue *, we now use a plain JSValueRef, which eliminates the reference cycle.
+        (-[JSContext initWithVirtualMachine:]):
+        (-[JSContext setException:]):
+        (-[JSContext exception]):
+
+2013-01-31  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed build fix. Win7 port.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-01-31  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Disable ENABLE_FULLSCREEN_API on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=108250
+
+        Reviewed by Benjamin Poulain.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Fix insertion of values greater than the max index allowed by the spec
+        https://bugs.webkit.org/show_bug.cgi?id=108264
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a bug, added a test to the API tests, cleaned up some code.
+
+        * API/JSValue.h: Changed some of the documentation on setValue:atIndex: to indicate that 
+        setting values at indices greater than UINT_MAX - 1 wont' affect the length of JS arrays.
+        * API/JSValue.mm:
+        (-[JSValue valueAtIndex:]): We weren't returning when we should have been.
+        (-[JSValue setValue:atIndex:]): Added a comment about why we do the early check for being larger than UINT_MAX.
+        (objectToValueWithoutCopy): Removed two redundant cases that were already checked previously.
+        * API/tests/testapi.mm:
+
+2013-01-30  Andreas Kling  <akling@apple.com>
+
+        Vector should consult allocator about ideal size when choosing capacity.
+        <http://webkit.org/b/108410>
+        <rdar://problem/13124002>
+
+        Reviewed by Benjamin Poulain.
+
+        Remove assertion about Vector capacity that won't hold anymore since capacity()
+        may not be what you passed to reserveCapacity().
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2013-01-30  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG bytecode parser should have more assertions about the status of local accesses
+        https://bugs.webkit.org/show_bug.cgi?id=108417
+
+        Reviewed by Mark Hahnenberg.
+        
+        Assert some things that we already know to be true, just to reassure ourselves that they are true.
+        This is meant as a prerequisite for https://bugs.webkit.org/show_bug.cgi?id=108414, which will
+        make these rules even stricter.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+
+2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: JSContext's dealloc causes ASSERT due to ordering of releases
+        https://bugs.webkit.org/show_bug.cgi?id=107978
+
+        Reviewed by Filip Pizlo.
+
+        We need to add the Identifier table save/restore in JSContextGroupRelease so that we 
+        have the correct table if we end up destroying the JSGlobalData/Heap.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupRelease):
+
+2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: exceptionHandler needs to be released in JSContext dealloc
+        https://bugs.webkit.org/show_bug.cgi?id=108378
+
+        Reviewed by Filip Pizlo.
+
+        JSContext has a (copy) exceptionHandler property that it doesn't release in dealloc. 
+        That sounds like the potential for a leak. It should be released.
+
+        * API/JSContext.mm:
+        (-[JSContext dealloc]):
+
+2013-01-30  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(140504): pure CSE no longer matches things, 10% regression on Kraken
+        https://bugs.webkit.org/show_bug.cgi?id=108366
+
+        Reviewed by Geoffrey Garen and Mark Hahnenberg.
+        
+        This was a longstanding bug that was revealed by http://trac.webkit.org/changeset/140504.
+        Pure CSE requires that the Node::flags() that may affect the behavior of a node match,
+        when comparing a possibly redundant node to its possible replacement. It was doing this
+        by comparing Node::arithNodeFlags(), which as the name might appear to suggest, returns
+        just those flag bits that correspond to actual node behavior and not auxiliary things.
+        Unfortunately, Node::arithNodeFlags() wasn't actually masking off the irrelevant bits.
+        This worked prior to r140504 because CSE itself didn't mutate the flags, so there was a
+        very high probability that matching nodes would also have completely identical flag bits
+        (even the ones that aren't relevant to arithmetic behavior, like NodeDoesNotExit). But
+        r140504 moved one of CSE's side-tables (m_relevantToOSR) into a flag bit for quicker
+        access. These bits would be mutated as the CSE ran over a basic block, in such a way that
+        there was a very high probability that the possible replacement would already have the
+        bit set, while the redundant node did not have the bit set. Since Node::arithNodeFlags()
+        returned all of the bits, this would cause CSEPhase::pureCSE() to reject the match
+        almost every time.
+        
+        The solution is to make Node::arithNodeFlags() do as its name suggests: only return those
+        flags that are relevant to arithmetic behavior. This patch introduces a new mask that
+        represents those bits, and includes NodeBehaviorMask and NodeBackPropMask, which are both
+        used for queries on Node::arithNodeFlags(), and both affect arithmetic code gen. None of
+        the other flags are relevant to Node::arithNodeFlags() since they either correspond to
+        information already conveyed by the opcode (like NodeResultMask, NodeMustGenerate,
+        NodeHasVarArgs, NodeClobbersWorld, NodeMightClobber) or information that doesn't affect
+        the result that the node will produce or any of the queries performed on the result of
+        Node::arithNodeFlags (NodeDoesNotExit and of course NodeRelevantToOSR).
+        
+        This is a 10% speed-up on Kraken, undoing the regression from r140504.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+
+2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Structure::m_outOfLineCapacity is unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=108206
+
+        Reviewed by Geoffrey Garen.
+
+        We can calculate our out of line capacity by using the outOfLineSize and our knowledge about our resize policy.
+        According to GDB, this knocks Structures down from 136 bytes to 128 bytes (I'm guessing the extra bytes are from
+        better alignment of object fields), which puts Structures in a smaller size class. Woohoo! Looks neutral on our 
+        benchmarks.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC):
+        (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::outOfLineCapacity):
+        (JSC::Structure::totalStorageCapacity):
+
+2013-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Be a little more conservative about emitting table-based switches
+        https://bugs.webkit.org/show_bug.cgi?id=108292
+
+        Reviewed by Filip Pizlo.
+
+        Profiling shows we're using op_switch in cases where it's a regression.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC):
+        (JSC::length):
+        (JSC::CaseBlockNode::tryTableSwitch):
+        (JSC::CaseBlockNode::emitBytecodeForBlock):
+        * parser/Nodes.h:
+        (CaseBlockNode):
+
+2013-01-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r140983.
+        http://trac.webkit.org/changeset/140983
+        https://bugs.webkit.org/show_bug.cgi?id=108277
+
+        Unfortunately, this API has one last client (Requested by
+        abarth on #webkit).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=107839
+
+        Reviewed by Geoffrey Garen.
+
+        Fixing several ASSERTs that were incorrect along with some of the reallocation of m_prototype and 
+        m_constructor that they were based on.
+
+        * API/JSWrapperMap.mm:
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We now only allocate those
+        fields that are null (i.e. have been collected or have never been allocated to begin with).
+        (-[JSObjCClassInfo reallocateConstructorAndOrPrototype]): Renamed to better indicate that we're 
+        reallocating one or both of the prototype/constructor combo.
+        (-[JSObjCClassInfo wrapperForObject:]): Call new reallocate function.
+        (-[JSObjCClassInfo constructor]): Ditto.
+
+2013-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Make precise size classes more precise
+        https://bugs.webkit.org/show_bug.cgi?id=108270
+
+        Reviewed by Mark Hahnenberg.
+
+        Size inference makes this profitable.
+
+        I chose 8 byte increments because JSString is 24 bytes. Otherwise, 16
+        byte increments might be better.
+
+        * heap/Heap.h:
+        (Heap): Removed firstAllocatorWithoutDestructors because it's unused now.
+
+        * heap/MarkedBlock.h:
+        (MarkedBlock): Updated constants.
+
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC): Also reduced the maximum precise size class because my testing
+        has shown that the smaller size classes are much more common. This
+        offsets some of the size class explosion caused by reducing the precise
+        increment.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions): No need for this ASSERT anymore
+        because we don't rely on firstAllocatorWithoutDestructors anymore, since
+        we pick size classes dynamically now.
+
+2013-01-29  Oliver Hunt  <oliver@apple.com>
+
+        Add some hardening to methodTable()
+        https://bugs.webkit.org/show_bug.cgi?id=108253
+
+        Reviewed by Mark Hahnenberg.
+
+        When accessing methodTable() we now always make sure that our
+        structure _could_ be valid.  Added a separate method to get a
+        classes methodTable during destruction as it's not possible to
+        validate the structure at that point.  This separation might
+        also make it possible to improve the performance of methodTable
+        access more generally in future.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::methodTableForDestruction):
+        (JSC):
+        (JSC::JSCell::methodTable):
+
+2013-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        offlineasm BaseIndex handling is broken on ARM due to MIPS changes
+        https://bugs.webkit.org/show_bug.cgi?id=108261
+
+        Reviewed by Oliver Hunt.
+        
+        Backends shouldn't override each other's methods. That's not cool.
+
+        * offlineasm/mips.rb:
+
+2013-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        cloop.rb shouldn't use a method called 'dump' for code generation
+        https://bugs.webkit.org/show_bug.cgi?id=108251
+
+        Reviewed by Mark Hahnenberg.
+        
+        Revert http://trac.webkit.org/changeset/141178 and rename 'dump' to 'clDump'.
+        
+        Also made trivial build fixes for !ENABLE(JIT).
+
+        * offlineasm/cloop.rb:
+        * runtime/Executable.h:
+        (ExecutableBase):
+        (JSC::ExecutableBase::intrinsicFor):
+        * runtime/JSGlobalData.h:
+
+2013-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed GGC because it has been disabled for a long time
+        https://bugs.webkit.org/show_bug.cgi?id=108245
+
+        Reviewed by Filip Pizlo.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/CardSet.h: Removed.
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isWriteBarrierEnabled):
+        (JSC):
+        (JSC::Heap::writeBarrier):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC):
+        * heap/MarkedSpace.cpp:
+        (JSC):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+
+2013-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove redundant AST dump method from cloop.rb, since they are already defined in ast.rb
+        https://bugs.webkit.org/show_bug.cgi?id=108247
+
+        Reviewed by Oliver Hunt.
+        
+        Makes offlineasm dumping easier to read and less likely to cause assertion failures.
+        Also fixes the strange situation where cloop.rb and ast.rb both defined dump methods,
+        but cloop.rb was winning.
+
+        * offlineasm/cloop.rb:
+
+2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=107839
+
+        Reviewed by Oliver Hunt.
+
+        JSContext has a JSWrapperMap, which has an NSMutableDictionary m_classMap, which has values that 
+        are JSObjCClassInfo objects, which have strong references to two JSValue *'s, m_prototype and 
+        m_constructor, which in turn have strong references to the JSContext, creating a reference cycle. 
+        We should make m_prototype and m_constructor Weak<JSObject>. This gets rid of the strong reference 
+        to the JSContext and also prevents clients from accidentally creating reference cycles by assigning 
+        to the prototype of the constructor. If Weak<JSObject> fields are ever garbage collected, we will 
+        reallocate them.
+
+        * API/JSContext.mm:
+        (-[JSContext wrapperMap]):
+        * API/JSContextInternal.h:
+        * API/JSWrapperMap.mm:
+        (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
+        (-[JSObjCClassInfo dealloc]):
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
+        (-[JSObjCClassInfo allocateConstructorAndPrototype]):
+        (-[JSObjCClassInfo wrapperForObject:]):
+        (-[JSObjCClassInfo constructor]):
+
+2013-01-29  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION (r140594): RELEASE_ASSERT_NOT_REACHED in JSC::Interpreter::execute
+        https://bugs.webkit.org/show_bug.cgi?id=108097
+
+        Reviewed by Geoffrey Garen.
+
+        LiteralParser was accepting a bogus 'var a.b = c' statement
+
+        * runtime/LiteralParser.cpp:
+        (JSC::::tryJSONPParse):
+
+2013-01-29  Oliver Hunt  <oliver@apple.com>
+
+        Force debug builds to do bounds checks on contiguous property storage
+        https://bugs.webkit.org/show_bug.cgi?id=108212
+
+        Reviewed by Mark Hahnenberg.
+
+        Add a ContiguousData type that we use to represent contiguous property
+        storage.  In release builds it is simply a pointer to the correct type,
+        but in debug builds it also carries the data length and performs bounds
+        checks.  This means we don't have to add as many manual bounds assertions
+        when performing operations over contiguous data.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/ArrayStorage.h:
+        (ArrayStorage):
+        (JSC::ArrayStorage::vector):
+        * runtime/Butterfly.h:
+        (JSC::ContiguousData::ContiguousData):
+        (ContiguousData):
+        (JSC::ContiguousData::operator[]):
+        (JSC::ContiguousData::data):
+        (JSC::ContiguousData::length):
+        (JSC):
+        (JSC::Butterfly::contiguousInt32):
+        (Butterfly):
+        (JSC::Butterfly::contiguousDouble):
+        (JSC::Butterfly::contiguous):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortNumericVector):
+        (ContiguousTypeAccessor):
+        (JSC::ContiguousTypeAccessor::getAsValue):
+        (JSC::ContiguousTypeAccessor::setWithValue):
+        (JSC::ContiguousTypeAccessor::replaceDataReference):
+        (JSC):
+        (JSC::JSArray::sortCompactedVector):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArray.h:
+        (JSArray):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::genericConvertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToContiguous):
+        (JSC::JSObject::rageConvertDoubleToContiguous):
+        (JSC::JSObject::ensureInt32Slow):
+        (JSC::JSObject::ensureDoubleSlow):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::rageEnsureContiguousSlow):
+        (JSC::JSObject::ensureLengthSlow):
+        * runtime/JSObject.h:
+        (JSC::JSObject::ensureInt32):
+        (JSC::JSObject::ensureDouble):
+        (JSC::JSObject::ensureContiguous):
+        (JSC::JSObject::rageEnsureContiguous):
+        (JSObject):
+        (JSC::JSObject::indexingData):
+        (JSC::JSObject::currentIndexingData):
+
+2013-01-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows, WinCairo] Unreviewed build fix after r141050
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Update symbols
+        to match JavaScriptCore.vcproj version.
+
+2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Implement GCActivityCallback
+        https://bugs.webkit.org/show_bug.cgi?id=103998
+
+        Reviewed by Simon Hausmann.
+
+        Implements the activity triggered garbage collector.
+
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::scheduleTimer):
+        (JSC::DefaultGCActivityCallback::cancelTimer):
+        * runtime/GCActivityCallback.h:
+        (GCActivityCallback):
+        (DefaultGCActivityCallback):
+
+2013-01-29  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        Compilation warning in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=108178
+
+        Reviewed by Kentaro Hara.
+
+        Fixed 'comparison between signed and unsigned integer' warning in JSC::Structure constructor.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+
+2013-01-29  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
+
+        [Qt] Fix the JSC build on Mac
+
+        Unreviewed, build fix.
+
+        * heap/HeapTimer.h:
+        Qt on Mac has USE(CF) true, and should use the CF HeapTimer in that case.
+
+2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Implement IncrementalSweeper and HeapTimer
+        https://bugs.webkit.org/show_bug.cgi?id=103996
+
+        Reviewed by Simon Hausmann.
+
+        Implements the incremental sweeping garbage collection for the Qt platform.
+
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::HeapTimer):
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::timerEvent):
+        (JSC::HeapTimer::synchronize):
+        (JSC::HeapTimer::invalidate):
+        (JSC::HeapTimer::didStartVMShutdown):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::scheduleTimer):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+
+2013-01-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not use a graph that is a vector, Nodes shouldn't move after allocation, and we should always refer to nodes by Node*
+        https://bugs.webkit.org/show_bug.cgi?id=106868
+
+        Reviewed by Oliver Hunt.
+        
+        This adds a pool allocator for Nodes, and uses that instead of a Vector. Changes all
+        uses of Node& and NodeIndex to be simply Node*. Nodes no longer have an index except
+        for debugging (Node::index(), which is not guaranteed to be O(1)).
+        
+        1% speed-up on SunSpider, presumably because this improves compile times.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/DataFormat.h:
+        (JSC::dataFormatToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::booleanResult):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGAbstractState.h:
+        (DFG):
+        (JSC::DFG::AbstractState::forNode):
+        (AbstractState):
+        (JSC::DFG::AbstractState::speculateInt32Unary):
+        (JSC::DFG::AbstractState::speculateNumberUnary):
+        (JSC::DFG::AbstractState::speculateBooleanUnary):
+        (JSC::DFG::AbstractState::speculateInt32Binary):
+        (JSC::DFG::AbstractState::speculateNumberBinary):
+        (JSC::DFG::AbstractState::trySetConstant):
+        * dfg/DFGAbstractValue.h:
+        (AbstractValue):
+        * dfg/DFGAdjacencyList.h:
+        (JSC::DFG::AdjacencyList::AdjacencyList):
+        (JSC::DFG::AdjacencyList::initialize):
+        * dfg/DFGAllocator.h: Added.
+        (DFG):
+        (Allocator):
+        (JSC::DFG::Allocator::Region::size):
+        (JSC::DFG::Allocator::Region::headerSize):
+        (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
+        (JSC::DFG::Allocator::Region::data):
+        (JSC::DFG::Allocator::Region::isInThisRegion):
+        (JSC::DFG::Allocator::Region::regionFor):
+        (Region):
+        (JSC::DFG::::Allocator):
+        (JSC::DFG::::~Allocator):
+        (JSC::DFG::::allocate):
+        (JSC::DFG::::free):
+        (JSC::DFG::::freeAll):
+        (JSC::DFG::::reset):
+        (JSC::DFG::::indexOf):
+        (JSC::DFG::::allocatorOf):
+        (JSC::DFG::::bumpAllocate):
+        (JSC::DFG::::freeListAllocate):
+        (JSC::DFG::::allocateSlow):
+        (JSC::DFG::::freeRegionsStartingAt):
+        (JSC::DFG::::startBumpingIn):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::originalArrayStructure):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        * dfg/DFGArrayMode.h:
+        (ArrayMode):
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::node):
+        (JSC::DFG::BasicBlock::isInPhis):
+        (JSC::DFG::BasicBlock::isInBlock):
+        (BasicBlock):
+        * dfg/DFGBasicBlockInlines.h:
+        (DFG):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getDirect):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::setDirect):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::setPair):
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::getToInt32):
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::getJSConstantForValue):
+        (JSC::DFG::ByteCodeParser::getJSConstant):
+        (JSC::DFG::ByteCodeParser::getCallee):
+        (JSC::DFG::ByteCodeParser::getThis):
+        (JSC::DFG::ByteCodeParser::setThis):
+        (JSC::DFG::ByteCodeParser::isJSConstant):
+        (JSC::DFG::ByteCodeParser::isInt32Constant):
+        (JSC::DFG::ByteCodeParser::valueOfJSConstant):
+        (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
+        (JSC::DFG::ByteCodeParser::constantUndefined):
+        (JSC::DFG::ByteCodeParser::constantNull):
+        (JSC::DFG::ByteCodeParser::one):
+        (JSC::DFG::ByteCodeParser::constantNaN):
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::insertPhiNode):
+        (JSC::DFG::ByteCodeParser::addVarArgChild):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::ConstantRecord::ConstantRecord):
+        (ConstantRecord):
+        (JSC::DFG::ByteCodeParser::PhiStackEntry::PhiStackEntry):
+        (PhiStackEntry):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::setIntrinsicResult):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::getScope):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::fixPhis):
+        (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
+        (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
+        (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::dump):
+        (OperandSubstitution):
+        (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::recordNewTarget):
+        (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::canonicalize):
+        (JSC::DFG::CSEPhase::endIndexForPureCSE):
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::constantCSE):
+        (JSC::DFG::CSEPhase::weakConstantCSE):
+        (JSC::DFG::CSEPhase::getCalleeLoadElimination):
+        (JSC::DFG::CSEPhase::getArrayLengthElimination):
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
+        (JSC::DFG::CSEPhase::globalVarStoreElimination):
+        (JSC::DFG::CSEPhase::scopedVarStoreElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        (JSC::DFG::CSEPhase::checkExecutableElimination):
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performSubstitution):
+        (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        (CSEPhase):
+        * dfg/DFGCommon.cpp: Added.
+        (DFG):
+        (JSC::DFG::NodePointerTraits::dump):
+        * dfg/DFGCommon.h:
+        (DFG):
+        (JSC::DFG::NodePointerTraits::defaultValue):
+        (NodePointerTraits):
+        (JSC::DFG::verboseCompilationEnabled):
+        (JSC::DFG::shouldDumpGraphAtEachPhase):
+        (JSC::DFG::validationEnabled):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::Disassembler):
+        (JSC::DFG::Disassembler::createDumpList):
+        (JSC::DFG::Disassembler::dumpDisassembly):
+        * dfg/DFGDisassembler.h:
+        (JSC::DFG::Disassembler::setForNode):
+        (Disassembler):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGEdge.cpp: Added.
+        (DFG):
+        (JSC::DFG::Edge::dump):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::Edge):
+        (JSC::DFG::Edge::node):
+        (JSC::DFG::Edge::operator*):
+        (JSC::DFG::Edge::operator->):
+        (Edge):
+        (JSC::DFG::Edge::setNode):
+        (JSC::DFG::Edge::useKind):
+        (JSC::DFG::Edge::setUseKind):
+        (JSC::DFG::Edge::isSet):
+        (JSC::DFG::Edge::shift):
+        (JSC::DFG::Edge::makeWord):
+        (JSC::DFG::operator==):
+        (JSC::DFG::operator!=):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupBlock):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        (FixupPhase):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::GenerationInfo):
+        (JSC::DFG::GenerationInfo::initConstant):
+        (JSC::DFG::GenerationInfo::initInteger):
+        (JSC::DFG::GenerationInfo::initJSValue):
+        (JSC::DFG::GenerationInfo::initCell):
+        (JSC::DFG::GenerationInfo::initBoolean):
+        (JSC::DFG::GenerationInfo::initDouble):
+        (JSC::DFG::GenerationInfo::initStorage):
+        (GenerationInfo):
+        (JSC::DFG::GenerationInfo::node):
+        (JSC::DFG::GenerationInfo::noticeOSRBirth):
+        (JSC::DFG::GenerationInfo::use):
+        (JSC::DFG::GenerationInfo::appendFill):
+        (JSC::DFG::GenerationInfo::appendSpill):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::~Graph):
+        (DFG):
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::amountOfNodeWhiteSpace):
+        (JSC::DFG::Graph::printNodeWhiteSpace):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::refChildren):
+        (JSC::DFG::Graph::derefChildren):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        (JSC::DFG::Graph::collectGarbage):
+        (JSC::DFG::Graph::determineReachability):
+        (JSC::DFG::Graph::resetExitStates):
+        * dfg/DFGGraph.h:
+        (Graph):
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        (JSC::DFG::Graph::changeChild):
+        (JSC::DFG::Graph::compareAndSwap):
+        (JSC::DFG::Graph::clearAndDerefChild):
+        (JSC::DFG::Graph::clearAndDerefChild1):
+        (JSC::DFG::Graph::clearAndDerefChild2):
+        (JSC::DFG::Graph::clearAndDerefChild3):
+        (JSC::DFG::Graph::convertToConstant):
+        (JSC::DFG::Graph::getJSConstantSpeculation):
+        (JSC::DFG::Graph::addSpeculationMode):
+        (JSC::DFG::Graph::valueAddSpeculationMode):
+        (JSC::DFG::Graph::arithAddSpeculationMode):
+        (JSC::DFG::Graph::addShouldSpeculateInteger):
+        (JSC::DFG::Graph::mulShouldSpeculateInteger):
+        (JSC::DFG::Graph::negateShouldSpeculateInteger):
+        (JSC::DFG::Graph::isConstant):
+        (JSC::DFG::Graph::isJSConstant):
+        (JSC::DFG::Graph::isInt32Constant):
+        (JSC::DFG::Graph::isDoubleConstant):
+        (JSC::DFG::Graph::isNumberConstant):
+        (JSC::DFG::Graph::isBooleanConstant):
+        (JSC::DFG::Graph::isCellConstant):
+        (JSC::DFG::Graph::isFunctionConstant):
+        (JSC::DFG::Graph::isInternalFunctionConstant):
+        (JSC::DFG::Graph::valueOfJSConstant):
+        (JSC::DFG::Graph::valueOfInt32Constant):
+        (JSC::DFG::Graph::valueOfNumberConstant):
+        (JSC::DFG::Graph::valueOfBooleanConstant):
+        (JSC::DFG::Graph::valueOfFunctionConstant):
+        (JSC::DFG::Graph::valueProfileFor):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        (JSC::DFG::Graph::numSuccessors):
+        (JSC::DFG::Graph::successor):
+        (JSC::DFG::Graph::successorForCondition):
+        (JSC::DFG::Graph::isPredictedNumerical):
+        (JSC::DFG::Graph::byValIsPure):
+        (JSC::DFG::Graph::clobbersWorld):
+        (JSC::DFG::Graph::varArgNumChildren):
+        (JSC::DFG::Graph::numChildren):
+        (JSC::DFG::Graph::varArgChild):
+        (JSC::DFG::Graph::child):
+        (JSC::DFG::Graph::voteNode):
+        (JSC::DFG::Graph::voteChildren):
+        (JSC::DFG::Graph::substitute):
+        (JSC::DFG::Graph::substituteGetLocal):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
+        (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::Insertion::Insertion):
+        (JSC::DFG::Insertion::element):
+        (Insertion):
+        (JSC::DFG::InsertionSet::insert):
+        (InsertionSet):
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::setForNode):
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant):
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGLongLivedState.cpp: Added.
+        (DFG):
+        (JSC::DFG::LongLivedState::LongLivedState):
+        (JSC::DFG::LongLivedState::~LongLivedState):
+        (JSC::DFG::LongLivedState::shrinkToFit):
+        * dfg/DFGLongLivedState.h: Added.
+        (DFG):
+        (LongLivedState):
+        * dfg/DFGMinifiedID.h:
+        (JSC::DFG::MinifiedID::MinifiedID):
+        (JSC::DFG::MinifiedID::node):
+        * dfg/DFGMinifiedNode.cpp:
+        (JSC::DFG::MinifiedNode::fromNode):
+        * dfg/DFGMinifiedNode.h:
+        (MinifiedNode):
+        * dfg/DFGNode.cpp: Added.
+        (DFG):
+        (JSC::DFG::Node::index):
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::Node::Node):
+        (Node):
+        (JSC::DFG::Node::convertToGetByOffset):
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::ref):
+        (JSC::DFG::Node::shouldSpeculateInteger):
+        (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
+        (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
+        (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
+        (JSC::DFG::Node::shouldSpeculateFinalObject):
+        (JSC::DFG::Node::shouldSpeculateArray):
+        (JSC::DFG::Node::dumpChildren):
+        (WTF):
+        * dfg/DFGNodeAllocator.h: Added.
+        (DFG):
+        (operator new ):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        (SpeculationFailureDebugInfo):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhase.cpp:
+        (DFG):
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        * dfg/DFGPhase.h:
+        (Phase):
+        (JSC::DFG::runAndLog):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::setPrediction):
+        (JSC::DFG::PredictionPropagationPhase::mergePrediction):
+        (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
+        (JSC::DFG::PredictionPropagationPhase::isNotZero):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
+        (JSC::DFG::PredictionPropagationPhase::propagateForward):
+        (JSC::DFG::PredictionPropagationPhase::propagateBackward):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::ScoreBoard):
+        (JSC::DFG::ScoreBoard::use):
+        (JSC::DFG::ScoreBoard::useIfHasResult):
+        (ScoreBoard):
+        * dfg/DFGSilentRegisterSavePlan.h:
+        (JSC::DFG::SilentRegisterSavePlan::SilentRegisterSavePlan):
+        (JSC::DFG::SilentRegisterSavePlan::node):
+        (SilentRegisterSavePlan):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::SlowPathGenerator):
+        (JSC::DFG::SlowPathGenerator::generate):
+        (SlowPathGenerator):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
+        (JSC::DFG::SpeculativeJIT::silentSpill):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        (JSC::DFG::SpeculativeJIT::isStrictInt32):
+        (JSC::DFG::SpeculativeJIT::isKnownInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownNumeric):
+        (JSC::DFG::SpeculativeJIT::isKnownCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::canReuse):
+        (JSC::DFG::SpeculativeJIT::isFilled):
+        (JSC::DFG::SpeculativeJIT::isFilledDouble):
+        (JSC::DFG::SpeculativeJIT::use):
+        (JSC::DFG::SpeculativeJIT::isConstant):
+        (JSC::DFG::SpeculativeJIT::isJSConstant):
+        (JSC::DFG::SpeculativeJIT::isInt32Constant):
+        (JSC::DFG::SpeculativeJIT::isDoubleConstant):
+        (JSC::DFG::SpeculativeJIT::isNumberConstant):
+        (JSC::DFG::SpeculativeJIT::isBooleanConstant):
+        (JSC::DFG::SpeculativeJIT::isFunctionConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):
+        (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfNumberConstantAsInt32):
+        (JSC::DFG::SpeculativeJIT::addressOfDoubleConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfJSConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant):
+        (JSC::DFG::SpeculativeJIT::isNullConstant):
+        (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::integerResult):
+        (JSC::DFG::SpeculativeJIT::noResult):
+        (JSC::DFG::SpeculativeJIT::cellResult):
+        (JSC::DFG::SpeculativeJIT::booleanResult):
+        (JSC::DFG::SpeculativeJIT::jsValueResult):
+        (JSC::DFG::SpeculativeJIT::storageResult):
+        (JSC::DFG::SpeculativeJIT::doubleResult):
+        (JSC::DFG::SpeculativeJIT::initConstantInfo):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        (JSC::DFG::SpeculativeJIT::isInteger):
+        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
+        (JSC::DFG::SpeculativeJIT::setNodeForOperand):
+        (JSC::DFG::IntegerOperand::IntegerOperand):
+        (JSC::DFG::IntegerOperand::node):
+        (JSC::DFG::IntegerOperand::gpr):
+        (JSC::DFG::IntegerOperand::use):
+        (IntegerOperand):
+        (JSC::DFG::DoubleOperand::DoubleOperand):
+        (JSC::DFG::DoubleOperand::node):
+        (JSC::DFG::DoubleOperand::fpr):
+        (JSC::DFG::DoubleOperand::use):
+        (DoubleOperand):
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        (JSC::DFG::JSValueOperand::node):
+        (JSC::DFG::JSValueOperand::gpr):
+        (JSC::DFG::JSValueOperand::fill):
+        (JSC::DFG::JSValueOperand::use):
+        (JSValueOperand):
+        (JSC::DFG::StorageOperand::StorageOperand):
+        (JSC::DFG::StorageOperand::node):
+        (JSC::DFG::StorageOperand::gpr):
+        (JSC::DFG::StorageOperand::use):
+        (StorageOperand):
+        (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateIntegerOperand::node):
+        (JSC::DFG::SpeculateIntegerOperand::gpr):
+        (JSC::DFG::SpeculateIntegerOperand::use):
+        (SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
+        (JSC::DFG::SpeculateStrictInt32Operand::node):
+        (JSC::DFG::SpeculateStrictInt32Operand::gpr):
+        (JSC::DFG::SpeculateStrictInt32Operand::use):
+        (SpeculateStrictInt32Operand):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateDoubleOperand::node):
+        (JSC::DFG::SpeculateDoubleOperand::fpr):
+        (JSC::DFG::SpeculateDoubleOperand::use):
+        (SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateCellOperand::node):
+        (JSC::DFG::SpeculateCellOperand::gpr):
+        (JSC::DFG::SpeculateCellOperand::use):
+        (SpeculateCellOperand):
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        (JSC::DFG::SpeculateBooleanOperand::node):
+        (JSC::DFG::SpeculateBooleanOperand::gpr):
+        (JSC::DFG::SpeculateBooleanOperand::use):
+        (SpeculateBooleanOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureAbstractValue.h:
+        (StructureAbstractValue):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * dfg/DFGValidate.cpp:
+        (DFG):
+        (Validate):
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::reportValidationContext):
+        * dfg/DFGValidate.h:
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::ValueSource):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * runtime/FunctionExecutableDump.cpp: Added.
+        (JSC):
+        (JSC::FunctionExecutableDump::dump):
+        * runtime/FunctionExecutableDump.h: Added.
+        (JSC):
+        (FunctionExecutableDump):
+        (JSC::FunctionExecutableDump::FunctionExecutableDump):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (DFG):
+        (JSGlobalData):
+        * runtime/Options.h:
+        (JSC):
+
+2013-01-28  Laszlo Gombos  <l.gombos@samsung.com>
+
+        Collapse testing for a list of PLATFORM() into OS() and USE() tests
+        https://bugs.webkit.org/show_bug.cgi?id=108018
+
+        Reviewed by Eric Seidel.
+
+        No functional change as "OS(DARWIN) && USE(CF)" equals to the
+        following platforms: MAC, WX, QT and CHROMIUM. CHROMIUM
+        is not using JavaScriptCore. 
+
+        * runtime/DatePrototype.cpp:
+        (JSC):
+
+2013-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Static size inference for JavaScript objects
+        https://bugs.webkit.org/show_bug.cgi?id=108093
+
+        Reviewed by Phil Pizlo.
+
+        * API/JSObjectRef.cpp:
+        * JavaScriptCore.order:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Pay the tax man.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): op_new_object and op_create_this now
+        have an extra inferredInlineCapacity argument. This is the statically
+        inferred inline capacity, just from analyzing source text. op_new_object
+        also gets a pointer to an allocation profile. (For op_create_this, the
+        profile is in the construtor function.)
+
+        (JSC::CodeBlock::CodeBlock): Link op_new_object.
+
+        (JSC::CodeBlock::stronglyVisitStrongReferences): Mark our profiles.
+
+        * bytecode/CodeBlock.h:
+        (CodeBlock): Removed some dead code. Added object allocation profiles.
+
+        * bytecode/Instruction.h:
+        (JSC): New union type, since an instruction operand may point to an
+        object allocation profile now.
+
+        * bytecode/ObjectAllocationProfile.h: Added.
+        (JSC):
+        (ObjectAllocationProfile):
+        (JSC::ObjectAllocationProfile::offsetOfAllocator):
+        (JSC::ObjectAllocationProfile::offsetOfStructure):
+        (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
+        (JSC::ObjectAllocationProfile::isNull):
+        (JSC::ObjectAllocationProfile::initialize):
+        (JSC::ObjectAllocationProfile::structure):
+        (JSC::ObjectAllocationProfile::inlineCapacity):
+        (JSC::ObjectAllocationProfile::clear):
+        (JSC::ObjectAllocationProfile::visitAggregate):
+        (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount): New class
+        for tracking a prediction about object allocation: structure, inline
+        capacity, allocator to use.
+
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName): Updated instruction sizes.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC):
+        (JSC::UnlinkedCodeBlock::addObjectAllocationProfile):
+        (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles):
+        (UnlinkedCodeBlock): Unlinked support for allocation profiles.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Kill all remaining analyses at the
+        end of codegen, since this is our last opportunity.
+
+        (JSC::BytecodeGenerator::BytecodeGenerator): Added a static property
+        analyzer to bytecode generation. It tracks initializing assignments and
+        makes a guess about how many will happen.
+
+        (JSC::BytecodeGenerator::newObjectAllocationProfile):
+        (JSC):
+        (JSC::BytecodeGenerator::emitProfiledOpcode):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitPutGetterSetter):
+        (JSC::BytecodeGenerator::emitGetArgumentByVal):
+        (JSC::BytecodeGenerator::emitGetByVal): Added hooks to the static property
+        analyzer, so it can observe allocations and stores.
+
+        (JSC::BytecodeGenerator::emitCreateThis): Factored this into a helper
+        function because it was a significant amount of logic, and I wanted to
+        add to it.
+
+        (JSC::BytecodeGenerator::emitNewObject):
+        (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitConstruct): Added a hook to profiled opcodes
+        to track their stores, in case a store kills a profiled allocation. Since
+        profiled opcodes are basically the only interesting stores we do, this
+        is a convenient place to notice any store that might kill an allocation.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator): As above.
+
+        * bytecompiler/StaticPropertyAnalysis.h: Added.
+        (JSC):
+        (StaticPropertyAnalysis):
+        (JSC::StaticPropertyAnalysis::create):
+        (JSC::StaticPropertyAnalysis::addPropertyIndex):
+        (JSC::StaticPropertyAnalysis::record):
+        (JSC::StaticPropertyAnalysis::propertyIndexCount):
+        (JSC::StaticPropertyAnalysis::StaticPropertyAnalysis): Simple helper
+        class for tracking allocations and stores.
+
+        * bytecompiler/StaticPropertyAnalyzer.h: Added.
+        (StaticPropertyAnalyzer):
+        (JSC::StaticPropertyAnalyzer::StaticPropertyAnalyzer):
+        (JSC::StaticPropertyAnalyzer::createThis):
+        (JSC::StaticPropertyAnalyzer::newObject):
+        (JSC::StaticPropertyAnalyzer::putById):
+        (JSC::StaticPropertyAnalyzer::mov):
+        (JSC::StaticPropertyAnalyzer::kill): Helper class for observing allocations
+        and stores and making an inline capacity guess. The heuristics here are
+        intentionally minimal because we don't want this one class to try to
+        re-create something like a DFG or a runtime analysis. If we discover that
+        we need those kinds of analyses, we should just replace this class with
+        something else.
+
+        This class tracks multiple registers that alias the same object -- that
+        happens a lot, when moving locals into temporary registers -- but it
+        doesn't track control flow or multiple objects that alias the same register.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute): Updated for rename.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Updated for inline capacity and
+        allocation profile.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasInlineCapacity):
+        (Node):
+        (JSC::DFG::Node::inlineCapacity):
+        (JSC::DFG::Node::hasFunction): Give the graph a good way to represent
+        inline capacity for an allocation.
+
+        * dfg/DFGNodeType.h:
+        (DFG): Updated for rename.
+
+        * dfg/DFGOperations.cpp: Updated for interface change.
+
+        * dfg/DFGOperations.h: We pass the inline capacity to the slow case as
+        an argument. This is the simplest way, since it's stored as a bytecode operand.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate): Updated for rename.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID): Fixed a horrible off-by-one-half bug that only
+        appears when doing an inline cached load for property number 64 on a 32-bit
+        system. In JSVALUE32_64 land, "offsetRelativeToPatchedStorage" is the
+        offset of the 64bit JSValue -- but we'll actually issue two loads, one for
+        the payload at that offset, and one for the tag at that offset + 4. We need
+        to ensure that both loads have a compact representation, or we'll corrupt
+        the instruction stream.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Lots of refactoring to support
+        passing an allocator to our allocation function, and/or passing a Structure
+        as a register instead of an immediate.
+
+        * heap/MarkedAllocator.h:
+        (DFG):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::offsetOfFreeListHead): Added an accessor to simplify
+        JIT code generation of allocation from an arbitrary allocator.
+
+        * jit/JIT.h:
+        (JSC):
+        * jit/JITInlines.h:
+        (JSC):
+        (JSC::JIT::emitAllocateJSObject):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this): Same refactoring as done for the DFG.
+
+        * jit/JITStubs.cpp:
+        (JSC::tryCacheGetByID): Fixed the same bug mentioned above.
+
+        (JSC::DEFINE_STUB_FUNCTION): Updated for interface changes.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions): Updated for interface changes.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Same refactoring as for the JITs.
+
+        * profiler/ProfilerBytecode.cpp:
+        * profiler/ProfilerBytecodes.cpp:
+        * profiler/ProfilerCompilation.cpp:
+        * profiler/ProfilerCompiledBytecode.cpp:
+        * profiler/ProfilerDatabase.cpp:
+        * profiler/ProfilerOSRExit.cpp:
+        * profiler/ProfilerOrigin.cpp:
+        * profiler/ProfilerProfiledBytecodes.cpp: Include ObjectConstructor.h
+        because that's where createEmptyObject() lives now.
+
+        * runtime/Executable.h:
+        (JSC::JSFunction::JSFunction): Updated for rename.
+
+        * runtime/JSCellInlines.h:
+        (JSC::allocateCell): Updated to match the allocator selection code in
+        the JIT, so it's clearer that both are correct.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::createAllocationProfile):
+        (JSC::JSFunction::visitChildren):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        (JSC::JSFunction::getConstructData):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::offsetOfScopeChain):
+        (JSC::JSFunction::offsetOfExecutable):
+        (JSC::JSFunction::offsetOfAllocationProfile):
+        (JSC::JSFunction::allocationProfile):
+        (JSFunction):
+        (JSC::JSFunction::tryGetAllocationProfile):
+        (JSC::JSFunction::addAllocationProfileWatchpoint): Changed inheritorID
+        data member to be an ObjectAllocationProfile, which includes a pointer
+        to the desired allocator. This simplifies JIT code, since we don't have
+        to compute the allocator on the fly. I verified by code inspection that
+        JSFunction is still only 64 bytes.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::dateStructure): No direct pointer to the empty
+        object structure anymore, because now clients need to specify how much
+        inline capacity they want.
+
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.h:
+        (JSC):
+        (JSFinalObject):
+        (JSC::JSFinalObject::defaultInlineCapacity):
+        (JSC::JSFinalObject::maxInlineCapacity):
+        (JSC::JSFinalObject::createStructure): A little refactoring to try to 
+        clarify where some of these constants derive from.
+
+        (JSC::maxOffsetRelativeToPatchedStorage): Used for bug fix, above.
+
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setTarget): Ugly, but effective.
+
+        * runtime/LiteralParser.cpp:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::constructWithObjectConstructor):
+        (JSC::callObjectConstructor):
+        (JSC::objectConstructorCreate): Updated for interface changes.
+
+        * runtime/ObjectConstructor.h:
+        (JSC::constructEmptyObject): Clarified your options for how to allocate
+        an empty object, to emphasize what things can actually vary.
+
+        * runtime/PropertyOffset.h: These constants have moved because they're
+        really higher level concepts to do with the layout of objects and the
+        collector. PropertyOffset is just an abstract number line, independent
+        of those things.
+
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::emptyObjectStructureForPrototype):
+        (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
+        * runtime/PrototypeMap.h:
+        (PrototypeMap): The map key is now a pair of prototype and inline capacity,
+        since Structure encodes inline capacity.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::copyPropertyTableForPinning):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::totalStorageSize):
+        (JSC::Structure::transitionCount):
+        (JSC::Structure::create): Fixed a nasty refactoring bug that only shows
+        up after enabling variable-sized inline capacities: we were passing our
+        type info where our inline capacity was expected. The compiler didn't
+        notice because both have type int :(.
+
+2013-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Add more assertions to the property storage use in arrays
+        https://bugs.webkit.org/show_bug.cgi?id=107728
+
+        Reviewed by Filip Pizlo.
+
+        Add a bunch of assertions to array and object butterfly
+        usage.  This should make debugging somewhat easier.
+
+        I also converted a couple of assertions to release asserts
+        as they were so low cost it seemed a sensible thing to do.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortVector):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getHolyIndexQuickly):
+
+2013-01-28  Adam Barth  <abarth@webkit.org>
+
+        Remove webkitNotifications.createHTMLNotification
+        https://bugs.webkit.org/show_bug.cgi?id=107598
+
+        Reviewed by Benjamin Poulain.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-28  Michael Saboff  <msaboff@apple.com>
+
+        Cleanup ARM version of debugName() in DFGFPRInfo.h
+        https://bugs.webkit.org/show_bug.cgi?id=108090
+
+        Reviewed by David Kilzer.
+
+        Fixed debugName() so it will compile by adding static_cast<int> and missing commas.
+
+        * dfg/DFGFPRInfo.h:
+        (JSC::DFG::FPRInfo::debugName):
+
+2013-01-27  Andreas Kling  <akling@apple.com>
+
+        JSC: FunctionParameters are memory hungry.
+        <http://webkit.org/b/108033>
+        <rdar://problem/13094803>
+
+        Reviewed by Sam Weinig.
+
+        Instead of inheriting from Vector<Identifier>, make FunctionParameters a simple fixed-size array
+        with a custom-allocating create() function. Removes one step of indirection and cuts memory usage
+        roughly in half.
+
+        2.73 MB progression on Membuster3.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::paramString):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::create):
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FunctionParameters::~FunctionParameters):
+        * parser/Nodes.h:
+        (FunctionParameters):
+        (JSC::FunctionParameters::size):
+        (JSC::FunctionParameters::at):
+        (JSC::FunctionParameters::identifiers):
+
+2013-01-27  Andreas Kling  <akling@apple.com>
+
+        JSC: SourceProviderCache is memory hungry.
+        <http://webkit.org/b/108029>
+        <rdar://problem/13094806>
+
+        Reviewed by Sam Weinig.
+
+        Use fixed-size arrays for SourceProviderCacheItem's lists of captured variables.
+        Since the lists never change after the object is created, there's no need to keep them in Vectors
+        and we can instead create the whole cache item in a single allocation.
+
+        13.37 MB progression on Membuster3.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Scope::copyCapturedVariablesToVector):
+        (JSC::Scope::fillParametersForSourceProviderCache):
+        (JSC::Scope::restoreFromSourceProviderCache):
+        * parser/SourceProviderCacheItem.h:
+        (SourceProviderCacheItemCreationParameters):
+        (SourceProviderCacheItem):
+        (JSC::SourceProviderCacheItem::approximateByteSize):
+        (JSC::SourceProviderCacheItem::usedVariables):
+        (JSC::SourceProviderCacheItem::writtenVariables):
+        (JSC::SourceProviderCacheItem::~SourceProviderCacheItem):
+        (JSC::SourceProviderCacheItem::create):
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+
+2013-01-27  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
+
+        Fixing atomicIncrement implementation for Windows by dropping support before XP SP2.
+        https://bugs.webkit.org/show_bug.cgi?id=106740
+
+        Reviewed by Benjamin Poulain.
+
+        * config.h:
+
+2013-01-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG variable event stream shouldn't use NodeIndex
+        https://bugs.webkit.org/show_bug.cgi?id=107996
+
+        Reviewed by Oliver Hunt.
+        
+        Introduce the notion of a DFG::MinifiedID, which is just a unique ID of a DFG Node.
+        Internally it currently uses a NodeIndex, but we could change this without having
+        to recode all of the users of MinifiedID. This effectively decouples the OSR exit
+        compiler's way of identifying nodes from the speculative JIT's way of identifying
+        nodes, and should make it easier to make changes to the speculative JIT's internals
+        in the future.
+        
+        Also changed variable event stream logging to exclude information about births and
+        deaths of constants, since the OSR exit compiler never cares about which register
+        holds a constant; if a value is constant then the OSR exit compiler can reify it.
+        
+        Also changed the variable event stream's value recovery computation to use a
+        HashMap keyed by MinifiedID rather than a Vector indexed by NodeIndex.
+        
+        This appears to be performance-neutral. It's primarily meant as a small step
+        towards https://bugs.webkit.org/show_bug.cgi?id=106868.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::GenerationInfo):
+        (JSC::DFG::GenerationInfo::initConstant):
+        (JSC::DFG::GenerationInfo::initInteger):
+        (JSC::DFG::GenerationInfo::initJSValue):
+        (JSC::DFG::GenerationInfo::initCell):
+        (JSC::DFG::GenerationInfo::initBoolean):
+        (JSC::DFG::GenerationInfo::initDouble):
+        (JSC::DFG::GenerationInfo::initStorage):
+        (JSC::DFG::GenerationInfo::noticeOSRBirth):
+        (JSC::DFG::GenerationInfo::use):
+        (JSC::DFG::GenerationInfo::appendFill):
+        (JSC::DFG::GenerationInfo::appendSpill):
+        (GenerationInfo):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGMinifiedGraph.h:
+        (JSC::DFG::MinifiedGraph::at):
+        (MinifiedGraph):
+        * dfg/DFGMinifiedID.h: Added.
+        (DFG):
+        (MinifiedID):
+        (JSC::DFG::MinifiedID::MinifiedID):
+        (JSC::DFG::MinifiedID::operator!):
+        (JSC::DFG::MinifiedID::nodeIndex):
+        (JSC::DFG::MinifiedID::operator==):
+        (JSC::DFG::MinifiedID::operator!=):
+        (JSC::DFG::MinifiedID::operator<):
+        (JSC::DFG::MinifiedID::operator>):
+        (JSC::DFG::MinifiedID::operator<=):
+        (JSC::DFG::MinifiedID::operator>=):
+        (JSC::DFG::MinifiedID::hash):
+        (JSC::DFG::MinifiedID::dump):
+        (JSC::DFG::MinifiedID::isHashTableDeletedValue):
+        (JSC::DFG::MinifiedID::invalidID):
+        (JSC::DFG::MinifiedID::otherInvalidID):
+        (JSC::DFG::MinifiedID::fromBits):
+        (JSC::DFG::MinifiedIDHash::hash):
+        (JSC::DFG::MinifiedIDHash::equal):
+        (MinifiedIDHash):
+        (WTF):
+        * dfg/DFGMinifiedNode.cpp:
+        (JSC::DFG::MinifiedNode::fromNode):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::MinifiedNode::id):
+        (JSC::DFG::MinifiedNode::child1):
+        (JSC::DFG::MinifiedNode::getID):
+        (JSC::DFG::MinifiedNode::compareByNodeIndex):
+        (MinifiedNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::setNodeIndexForOperand):
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::ValueSource):
+        (JSC::DFG::ValueSource::isSet):
+        (JSC::DFG::ValueSource::kind):
+        (JSC::DFG::ValueSource::id):
+        (ValueSource):
+        (JSC::DFG::ValueSource::idFromKind):
+        (JSC::DFG::ValueSource::kindFromID):
+        * dfg/DFGVariableEvent.cpp:
+        (JSC::DFG::VariableEvent::dump):
+        (JSC::DFG::VariableEvent::dumpFillInfo):
+        (JSC::DFG::VariableEvent::dumpSpillInfo):
+        * dfg/DFGVariableEvent.h:
+        (JSC::DFG::VariableEvent::fillGPR):
+        (JSC::DFG::VariableEvent::fillPair):
+        (JSC::DFG::VariableEvent::fillFPR):
+        (JSC::DFG::VariableEvent::spill):
+        (JSC::DFG::VariableEvent::death):
+        (JSC::DFG::VariableEvent::movHint):
+        (JSC::DFG::VariableEvent::id):
+        (VariableEvent):
+        * dfg/DFGVariableEventStream.cpp:
+        (DFG):
+        (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * dfg/DFGVariableEventStream.h:
+        (VariableEventStream):
+
+2013-01-25  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Rename LLInt projects folder and make appropriate changes to solutions.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcxproj/LLInt: Copied from JavaScriptCore.vcxproj/LLInt.vcproj.
+        * JavaScriptCore.vcxproj/LLInt.vcproj: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.make: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj.user: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj.user: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj.user: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Removed.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Removed.
+
+2013-01-24  Roger Fong  <roger_fong@apple.com>
+
+        VS2010 JavascriptCore: Clean up property sheets, add a JSC solution, add testRegExp and testAPI projects.
+        https://bugs.webkit.org/show_bug.cgi?id=106987
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.sln: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreCF.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props:
+        * JavaScriptCore.vcxproj/jsc/jscDebug.props:
+        * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
+        * JavaScriptCore.vcxproj/testRegExp: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props: Added.
+        * JavaScriptCore.vcxproj/testapi: Added.
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Added.
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters: Added.
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiDebug.props: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiPostBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiRelease.props: Added.
+
+2013-01-24  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-01-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::JITCompiler::getSpeculation() methods are badly named and superfluous
+        https://bugs.webkit.org/show_bug.cgi?id=107860
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+
+2013-01-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Rename JSValue.h/APIJSValue.h to JSCJSValue.h/JSValue.h
+        https://bugs.webkit.org/show_bug.cgi?id=107327
+
+        Reviewed by Filip Pizlo.
+
+        We're renaming these two files, so we have to replace the names everywhere.
+
+        * API/APICast.h:
+        * API/APIJSValue.h: Removed.
+        * API/JSBlockAdaptor.mm:
+        * API/JSStringRefCF.cpp:
+        * API/JSValue.h: Copied from Source/JavaScriptCore/API/APIJSValue.h.
+        * API/JSValue.mm:
+        * API/JSValueInternal.h:
+        * API/JSValueRef.cpp:
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JavaScriptCore.h:
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CallLinkStatus.h:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/MethodOfGettingAValueProfile.h:
+        * bytecode/ResolveGlobalStatus.cpp:
+        * bytecode/ResolveGlobalStatus.h:
+        * bytecode/SpeculatedType.h:
+        * bytecode/ValueRecovery.h:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGNode.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * heap/CopiedBlock.h:
+        * heap/HandleStack.cpp:
+        * heap/HandleTypes.h:
+        * heap/WeakImpl.h:
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        * interpreter/VMInspector.h:
+        * jit/HostCallReturnValue.cpp:
+        * jit/HostCallReturnValue.h:
+        * jit/JITCode.h:
+        * jit/JITExceptions.cpp:
+        * jit/JITExceptions.h:
+        * jit/JSInterfaceJIT.h:
+        * llint/LLIntCLoop.h:
+        * llint/LLIntData.h:
+        * llint/LLIntSlowPaths.cpp:
+        * profiler/ProfilerBytecode.h:
+        * profiler/ProfilerBytecodeSequence.h:
+        * profiler/ProfilerBytecodes.h:
+        * profiler/ProfilerCompilation.h:
+        * profiler/ProfilerCompiledBytecode.h:
+        * profiler/ProfilerDatabase.h:
+        * profiler/ProfilerOSRExit.h:
+        * profiler/ProfilerOSRExitSite.h:
+        * profiler/ProfilerOrigin.h:
+        * profiler/ProfilerOriginStack.h:
+        * runtime/ArgList.cpp:
+        * runtime/CachedTranscendentalFunction.h:
+        * runtime/CallData.h:
+        * runtime/Completion.h:
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateInstance.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSCJSValue.cpp: Copied from Source/JavaScriptCore/runtime/JSValue.cpp.
+        * runtime/JSCJSValue.h: Copied from Source/JavaScriptCore/runtime/JSValue.h.
+        (JSValue):
+        * runtime/JSCJSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlines.h.
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSStringJoiner.h:
+        * runtime/JSValue.cpp: Removed.
+        * runtime/JSValue.h: Removed.
+        * runtime/JSValueInlines.h: Removed.
+        * runtime/LiteralParser.h:
+        * runtime/Operations.h:
+        * runtime/PropertyDescriptor.h:
+        * runtime/PropertySlot.h:
+        * runtime/Protect.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/Structure.h:
+
+2013-01-23  Oliver Hunt  <oliver@apple.com>
+
+        Harden JSC a bit with RELEASE_ASSERT
+        https://bugs.webkit.org/show_bug.cgi?id=107766
+
+        Reviewed by Mark Hahnenberg.
+
+        Went through and replaced a pile of ASSERTs that were covering
+        significantly important details (bounds checks, etc) where
+        having the checks did not impact release performance in any
+        measurable way.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::exceptionHandler):
+        (JSC::CodeBlock::codeOrigin):
+        (JSC::CodeBlock::immediateSwitchJumpTable):
+        (JSC::CodeBlock::characterSwitchJumpTable):
+        (JSC::CodeBlock::stringSwitchJumpTable):
+        (JSC::CodeBlock::setIdentifiers):
+        (JSC::baselineCodeBlockForInlineCallFrame):
+        (JSC::ExecState::uncheckedR):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::inlineStack):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::CodeOrigin):
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGScratchRegisterAllocator.h:
+        (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::allocate):
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::integerResult):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::ValueSource::ValueSource):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        (JSC::BlockAllocator::releaseFreeRegions):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::collect):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitLoad):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_resolve_operations):
+        * jit/JITStubRoutine.cpp:
+        (JSC::JITStubRoutine::observeZeroRefCount):
+        * jit/JITStubs.cpp:
+        (JSC::returnToThrowTrampoline):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::deleteProperty):
+        (JSC::Arguments::defineOwnProperty):
+        (JSC::Arguments::didTearOffActivation):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::growPropertyStorage):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC::CacheMap::add):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::EvalExecutable::unlinkCalls):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::ProgramExecutable::unlinkCalls):
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::unlinkCalls):
+        (JSC::NativeExecutable::hashFor):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        * runtime/IndexingHeader.h:
+        (JSC::IndexingHeader::setVectorLength):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::jsStrDecimalLiteral):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::getIndexSlowCase):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
+
+2013-01-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Constant folding an access to an uncaptured variable that is captured later in the same basic block shouldn't lead to assertion failures
+        https://bugs.webkit.org/show_bug.cgi?id=107750
+        <rdar://problem/12387265>
+
+        Reviewed by Mark Hahnenberg.
+        
+        The point of this assertion was that if there is no variable capturing going on, then there should only be one GetLocal
+        for the variable anywhere in the basic block. But if there is some capturing, then we'll have an unbounded number of
+        GetLocals. The assertion was too imprecise for the latter case. I want to keep this assertion, so I introduced a
+        checker that verifies this precisely: if there are any captured accesses to the variable anywhere at or after the
+        GetLocal we are eliminating, then we allow redundant GetLocals.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (ConstantFoldingPhase):
+        (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
+
+2013-01-23  Oliver Hunt  <oliver@apple.com>
+
+        Replace ASSERT_NOT_REACHED with RELEASE_ASSERT_NOT_REACHED in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=107736
+
+        Reviewed by Mark Hahnenberg.
+
+        Mechanical change with no performance impact.
+
+        * API/JSBlockAdaptor.mm:
+        (BlockArgumentTypeDelegate::typeVoid):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::construct):
+        (JSC::::call):
+        * API/JSScriptRef.cpp:
+        * API/ObjCCallbackFunction.mm:
+        (ArgumentTypeDelegate::typeVoid):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::replaceWithLoad):
+        (JSC::ARMv7Assembler::replaceWithAddressComputation):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::invert):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::countLeadingZeros32):
+        (JSC::MacroAssemblerARM::divDouble):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::absDouble):
+        (JSC::MacroAssemblerMIPS::replaceWithJump):
+        (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::absDouble):
+        (JSC::MacroAssemblerSH4::replaceWithJump):
+        (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::shllImm8r):
+        (JSC::SH4Assembler::shlrImm8r):
+        (JSC::SH4Assembler::cmplRegReg):
+        (JSC::SH4Assembler::branch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::replaceWithLoad):
+        (JSC::X86Assembler::replaceWithAddressComputation):
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CodeBlock.cpp:
+        (JSC::debugHookName):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::usesOpcode):
+        * bytecode/DataFormat.h:
+        (JSC::needDataFormatConversion):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        (JSC::exitKindIsCountable):
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
+        * bytecode/Opcode.h:
+        (JSC::opcodeLength):
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::fromStructureStubInfo):
+        (JSC::PutByIdAccess::visitWeak):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC::BytecodeGenerator::emitGetLocalVar):
+        (JSC::BytecodeGenerator::beginSwitch):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::canHandleOpcodes):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::useKindToString):
+        * dfg/DFGDoubleFormatState.h:
+        (JSC::DFG::mergeDoubleFormatStates):
+        (JSC::DFG::doubleFormatStateToString):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::valueOfJSConstant):
+        (JSC::DFG::Node::successor):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGNodeType.h:
+        (JSC::DFG::defaultFlags):
+        * dfg/DFGRepatch.h:
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::call):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::silentSpill):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::bitOp):
+        (JSC::DFG::SpeculativeJIT::shiftOp):
+        (JSC::DFG::SpeculativeJIT::integerResult):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::valueRecovery):
+        * dfg/DFGVariableEvent.cpp:
+        (JSC::DFG::VariableEvent::dump):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * heap/BlockAllocator.h:
+        (JSC::BlockAllocator::regionSetFor):
+        * heap/GCThread.cpp:
+        (JSC::GCThread::gcThreadMain):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isLive):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::inlineCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        (JSC::getStackFrameCodeType):
+        (JSC::Interpreter::execute):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::notifyPageIsFree):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::isDirectPutById):
+        * jit/JITStubs.cpp:
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * parser/Lexer.cpp:
+        (JSC::::lex):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::emitBytecodeInConditionContext):
+        * parser/Parser.h:
+        (JSC::Parser::getTokenName):
+        (JSC::Parser::updateErrorMessageSpecialCase):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOffForInlineCallFrame):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/Executable.cpp:
+        (JSC::samplingDescription):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::unlinkCalls):
+        * runtime/Identifier.cpp:
+        (JSC):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::getCallData):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::push):
+        (JSC::JSArray::sort):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::defaultValue):
+        (JSC::JSCell::getOwnPropertyNames):
+        (JSC::JSCell::getOwnNonIndexPropertyNames):
+        (JSC::JSCell::className):
+        (JSC::JSCell::getPropertyNames):
+        (JSC::JSCell::customHasInstance):
+        (JSC::JSCell::putDirectVirtual):
+        (JSC::JSCell::defineOwnProperty):
+        (JSC::JSCell::getOwnPropertyDescriptor):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::put):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::tryGetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuicklyForPutDirect):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::hasSparseMap):
+        (JSC::JSObject::inSparseIndexingMode):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::isDynamicScope):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::putDirectVirtual):
+        * runtime/JSSymbolTableObject.h:
+        (JSSymbolTableObject):
+        * runtime/LiteralParser.cpp:
+        (JSC::::parse):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+        * runtime/StructureTransitionTable.h:
+        (JSC::newIndexingType):
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::sample):
+        * yarr/YarrCanonicalizeUCS2.h:
+        (JSC::Yarr::getCanonicalPair):
+        (JSC::Yarr::areCanonicallyEquivalent):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generateTerm):
+        (JSC::Yarr::YarrGenerator::backtrackTerm):
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):
+
+2013-01-23  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, set svn:eol-style to CRLF on Windows .sln files.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
+
+2013-01-23  Oliver Hunt  <oliver@apple.com>
+
+        Replace numerous manual CRASH's in JSC with RELEASE_ASSERT
+        https://bugs.webkit.org/show_bug.cgi?id=107726
+
+        Reviewed by Filip Pizlo.
+
+        Fairly manual change from if (foo) CRASH(); to RELEASE_ASSERT(!foo);
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        * bytecode/CodeBlockHash.cpp:
+        (JSC::CodeBlockHash::CodeBlockHash):
+        * heap/BlockAllocator.h:
+        (JSC::Region::create):
+        (JSC::Region::createCustomSize):
+        * heap/GCAssertions.h:
+        * heap/HandleSet.cpp:
+        (JSC::HandleSet::visitStrongHandles):
+        (JSC::HandleSet::writeBarrier):
+        * heap/HandleSet.h:
+        (JSC::HandleSet::allocate):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::validate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::allocateNewSpace):
+        (JSC::ExecutableAllocator::allocate):
+        * jit/ExecutableAllocator.h:
+        (JSC::roundUpAllocationSize):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        (JSC::ExecutableAllocator::allocate):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::createUninitialized):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/JSArray.h:
+        (JSC::constructArray):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::slowValidateCell):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::createArrayStorage):
+        * tools/TieredMMapArray.h:
+        (JSC::TieredMMapArray::append):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::interpret):
+
+2013-01-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Convert CSE phase to not rely too much on NodeIndex
+        https://bugs.webkit.org/show_bug.cgi?id=107616
+
+        Reviewed by Geoffrey Garen.
+        
+        - Instead of looping over the graph (which assumes that you can simply loop over all
+          nodes without considering blocks first) to reset node.replacement, do that in the
+          loop that sets up relevantToOSR, just before running CSE on the block.
+        
+        - Instead of having a relevantToOSR bitvector indexed by NodeIndex, made
+          NodeRelevantToOSR be a NodeFlag. We had exactly one bit left in NodeFlags, so I did
+          some reshuffling to fit it in.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        (CSEPhase):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGNodeType.h:
+        (DFG):
+
+2013-01-21  Kentaro Hara  <haraken@chromium.org>
+
+        Implement UIEvent constructor
+        https://bugs.webkit.org/show_bug.cgi?id=107430
+
+        Reviewed by Adam Barth.
+
+        Editor's draft: https://dvcs.w3.org/hg/d4e/raw-file/tip/source_respec.htm
+
+        UIEvent constructor is implemented under a DOM4_EVENTS_CONSTRUCTOR flag,
+        which is enabled on Safari and Chromium for now.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-22  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed VS2010 build fix following r140259.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2013-01-22  Roger Fong  <roger_fong@apple.com>
+
+        JavaScriptCore property sheets, project files and modified build scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=106987
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCore.resources: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCore.resources/Info.plist: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreCF.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd: Added.
+        * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.make: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Added.
+        * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Added.
+        * JavaScriptCore.vcxproj/build-generated-files.sh: Added.
+        * JavaScriptCore.vcxproj/copy-files.cmd: Added.
+        * JavaScriptCore.vcxproj/jsc: Added.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Added.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters: Added.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.user: Added.
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props: Added.
+        * JavaScriptCore.vcxproj/jsc/jscDebug.props: Added.
+        * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/jsc/jscPreBuild.cmd: Added.
+        * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd: Added.
+        * JavaScriptCore.vcxproj/jsc/jscRelease.props: Added.
+        * config.h:
+
+2013-01-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Enable Page Visibility (PAGE_VISIBILITY_API)
+        https://bugs.webkit.org/show_bug.cgi?id=107230
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-22  Tobias Netzel  <tobias.netzel@googlemail.com>
+
+        Yarr JIT isn't big endian compatible
+        https://bugs.webkit.org/show_bug.cgi?id=102897
+
+        Reviewed by Oliver Hunt.
+
+        This patch was tested in the current mozilla codebase only and has passed the regexp tests there.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+
+2013-01-22  David Kilzer  <ddkilzer@apple.com>
+
+        Fix DateMath.cpp to compile with -Wshorten-64-to-32
+        <http://webkit.org/b/107503>
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSDateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters): Remove unneeded
+        static_cast<int>().
+
+2013-01-22  Tim Horton  <timothy_horton@apple.com>
+
+        PDFPlugin: Build PDFPlugin everywhere, enable at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=107117
+
+        Reviewed by Alexey Proskuryakov.
+
+        Since PDFLayerController SPI is all forward-declared, the plugin should build
+        on all Mac platforms, and can be enabled at runtime.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-21  Justin Schuh  <jschuh@chromium.org>
+
+        [CHROMIUM] Suppress c4267 build warnings for Win64 targets
+        https://bugs.webkit.org/show_bug.cgi?id=107499
+
+        Reviewed by Abhishek Arya.
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+
+2013-01-21  Dirk Schulze  <dschulze@adobe.com>
+
+        Add build flag for Canvas's Path object (disabled by default)
+        https://bugs.webkit.org/show_bug.cgi?id=107473
+
+        Reviewed by Dean Jackson.
+
+        Add CANVAS_PATH build flag to build systems.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Weak GC maps should be easier to use
+        https://bugs.webkit.org/show_bug.cgi?id=107312
+
+        Reviewed by Sam Weinig.
+
+        Follow-up fix.
+
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::emptyObjectStructureForPrototype): Restored this
+        ASSERT, which was disabled because of a bug in WeakGCMap.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::add): We can't pass our passed-in value to add() because
+        a PassWeak() clears itself when passed to another function. So, we pass
+        nullptr instead, and fix things up afterwards.
+
+2013-01-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed.
+
+        Temporarily disabling this ASSERT to get the bots green
+        while I investigate a fix.
+
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::emptyObjectStructureForPrototype):
+
+2013-01-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Inserting a node into the DFG graph should not require five lines of code
+        https://bugs.webkit.org/show_bug.cgi?id=107381
+
+        Reviewed by Sam Weinig.
+        
+        This adds fairly comprehensive support for inserting a node into a DFG graph in one
+        method call. A common example of this is:
+        
+        m_insertionSet.insertNode(indexInBlock, DontRefChildren, DontRefNode, SpecNone, ForceOSRExit, codeOrigin);
+        
+        The arguments to insert() specify what reference counting you need to have happen
+        (RefChildren => recursively refs all children, RefNode => non-recursively refs the node
+        that was created), the prediction to set (SpecNone is a common default), followed by
+        the arguments to the Node() constructor. InsertionSet::insertNode() and similar methods
+        (Graph::addNode() and BasicBlock::appendNode()) all use a common variadic template
+        function macro from DFGVariadicFunction.h. Also, all of these methods will automatically
+        non-recursively ref() the node being created if the flags say NodeMustGenerate.
+        
+        In all, this new mechanism retains the flexibility of the old approach (you get to
+        manage ref counts yourself, albeit in less code) while ensuring that most code that adds
+        nodes to the graph now needs less code to do it.
+        
+        In the future, we should revisit the reference counting methodology in the DFG: we could
+        do like most compilers and get rid of it entirely, or we could make it automatic. This
+        patch doesn't attempt to make any such major changes, and only seeks to simplify the
+        technique we were already using (manual ref counting).
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Operands.h:
+        (JSC::dumpOperands):
+        * dfg/DFGAdjacencyList.h:
+        (AdjacencyList):
+        (JSC::DFG::AdjacencyList::kind):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGBasicBlock.h:
+        (DFG):
+        (BasicBlock):
+        * dfg/DFGBasicBlockInlines.h: Added.
+        (DFG):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
+        (ConstantFoldingPhase):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::FixupPhase):
+        (JSC::DFG::FixupPhase::fixupBlock):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::ref):
+        (Graph):
+        * dfg/DFGInsertionSet.h:
+        (DFG):
+        (JSC::DFG::Insertion::Insertion):
+        (JSC::DFG::Insertion::element):
+        (Insertion):
+        (JSC::DFG::InsertionSet::InsertionSet):
+        (JSC::DFG::InsertionSet::insert):
+        (InsertionSet):
+        (JSC::DFG::InsertionSet::execute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (Node):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * dfg/DFGVariadicFunction.h: Added.
+
+2013-01-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Track inheritance structures in a side table, instead of using a private
+        name in each prototype
+        https://bugs.webkit.org/show_bug.cgi?id=107378
+
+        Reviewed by Sam Weinig and Phil Pizlo.
+
+        This is a step toward object size inference.
+
+        Using a side table frees us to use a more complex key (a pair of
+        prototype and expected inline capacity).
+
+        It also avoids ruining inline caches for prototypes. (Adding a new private
+        name for a new inline capacity would change the prototype's structure,
+        possibly firing watchpoints, making inline caches go polymorphic, and
+        generally causing us to have a bad time.)
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri: Buildage.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation): Updated to use new side table API.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::cacheInheritorID): Updated to use new side table API.
+
+        (JSC::JSFunction::visitChildren): Fixed a long-standing bug where JSFunction
+        forgot to visit one of its data members (m_cachedInheritorID). This
+        wasn't a user-visible problem before because JSFunction would always
+        visit its .prototype property, which visited its m_cachedInheritorID.
+        But now, function.prototype only weakly owns function.m_cachedInheritorID.
+
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): Added the map, taking care to make sure that its
+        destructor would run after the heap destructor.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset): Updated to use new side table API.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::setPrototype):
+        * runtime/JSObject.h:
+        (JSObject): Updated to use new side table API, and removed lots of code
+        that used to manage the per-object private name.
+
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setTarget):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::finishCreation): Updated to use new side table API.
+
+        * runtime/PrototypeMap.cpp: Added.
+        (JSC):
+        (JSC::PrototypeMap::addPrototype):
+        (JSC::PrototypeMap::emptyObjectStructureForPrototype):
+        * runtime/PrototypeMap.h: Added.
+        (PrototypeMap):
+        (JSC::PrototypeMap::isPrototype):
+        (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype): New side table.
+        This is a simple weak map, mapping an object to the structure you should
+        use when inheriting from that object. (In future, inline capacity will
+        be a part of the mapping.)
+
+        I used two maps to preserve existing behavior that allowed us to speculate
+        about an object becoming a prototype, even if it wasn't one at the moment.
+        However, I suspect that behavior can be removed without harm.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::contains):
+        (WeakGCMap): I would rate myself a 6 / 10 in C++.
+
+2013-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Removed duplicate references to two headers in the project files.
+
+        Rubber-stamped by Mark Rowe.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix for building JSC with DFG_ENABLE_DEBUG_PROPAGATION_VERBOSE enabled in DFGCommon.h.
+        Fixes the case where the argument node in fixupNode is freed due to the Vector storage being reallocated.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2013-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix for release builds when DFG_ENABLE_DEBUG_PROPAGATION_VERBOSE is set to 1 in DFGCommon.h.
+
+        * dfg/DFGCFAPhase.cpp: Added #include "Operations.h"
+
+2013-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Change set r140201 broke editing/selection/move-by-word-visually-multi-line.html
+        https://bugs.webkit.org/show_bug.cgi?id=107340
+
+        Reviewed by Filip Pizlo.
+
+        Due to the change landed in r140201, more nodes might end up
+        generating Int32ToDouble nodes.  Therefore, changed the JSVALUE64
+        constant path of compileInt32ToDouble() to use the more
+        restrictive isInt32Constant() check on the input.  This check was
+        the same as the existing ASSERT() so the ASSERT was eliminated.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+
+2013-01-18  Viatcheslav Ostapenko  <sl.ostapenko@samsung.com>
+
+        Weak GC maps should be easier to use
+        https://bugs.webkit.org/show_bug.cgi?id=107312
+
+        Reviewed by Ryosuke Niwa.
+
+        Build fix for linux platforms after r140194.
+
+        * runtime/WeakGCMap.h:
+        (WeakGCMap):
+
+2013-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Harden ArithDiv of integers fix-up by inserting Int32ToDouble node directly
+        https://bugs.webkit.org/show_bug.cgi?id=107321
+
+        Reviewed by  Filip Pizlo.
+
+        Split out the Int32ToDouble node insertion from fixDoubleEdge() and used it directly when we're fixing up
+        an ArithDiv node with integer inputs and output for platforms that don't have integer division.
+        Since we are checking that our inputs should be ints, we can just insert the Int32ToDouble node
+        without any further checks.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+
+2013-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Fix up of ArithDiv nodes for non-x86 CPUs is broken
+        https://bugs.webkit.org/show_bug.cgi?id=107309
+
+        Reviewed by  Filip Pizlo.
+
+        Changed the logic so that we insert an Int32ToDouble node when the existing edge is not SpecDouble.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+
+2013-01-18  Dan Bernstein  <mitz@apple.com>
+
+        Tried to fix the build after r140194.
+
+        * API/JSWrapperMap.mm:
+        (-[JSWrapperMap wrapperForObject:]):
+
+2013-01-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Update documentation for JSValue and JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=107313
+
+        Reviewed by Geoffrey Garen.
+
+        After changing the semantics of object lifetime we need to update the API documentation to reflect the new semantics.
+
+        * API/APIJSValue.h:
+        * API/JSContext.h:
+
+2013-01-18  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        r134080 causes heap problem on linux systems where PAGESIZE != 4096
+        https://bugs.webkit.org/show_bug.cgi?id=102828
+
+        Reviewed by Mark Hahnenberg.
+
+        Make MarkStackSegment::blockSize as the capacity of segments of a MarkStackArray.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * heap/MarkStack.cpp:
+        (JSC):
+        (JSC::MarkStackArray::MarkStackArray):
+        (JSC::MarkStackArray::expand):
+        (JSC::MarkStackArray::donateSomeCellsTo):
+        (JSC::MarkStackArray::stealSomeCellsFrom):
+        * heap/MarkStack.h:
+        (JSC::MarkStackSegment::data):
+        (CapacityFromSize):
+        (MarkStackArray):
+        * heap/MarkStackInlines.h:
+        (JSC::MarkStackArray::setTopForFullSegment):
+        (JSC::MarkStackArray::append):
+        (JSC::MarkStackArray::isEmpty):
+        (JSC::MarkStackArray::size):
+        * runtime/Options.h:
+        (JSC):
+
+2013-01-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Weak GC maps should be easier to use
+        https://bugs.webkit.org/show_bug.cgi?id=107312
+
+        Reviewed by Sam Weinig.
+
+        This patch changes WeakGCMap to not use a WeakImpl finalizer to remove
+        items from the map, and to instead have the map automatically remove
+        stale items itself upon insertion. This has a few advantages:
+
+        (1) WeakGCMap is now compatible with all the specializations you would
+        use for HashMap.
+
+        (2) There's no need for clients to write special finalization munging
+        functions.
+
+        (3) Clients can specify custom value finalizers if they like.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: Def!
+
+        * API/JSWeakObjectMapRefPrivate.cpp: Setter no longer requires a global
+        data, since we've reduced interdependency.
+
+        * heap/Handle.h: No more need to forward declare, since we've reduced
+        interdependency.
+
+        * heap/Weak.h:
+        (Weak): Use explicit so we can assign directly to a weak map iterator
+        without ambiguity between Weak<T> and PassWeak<T>.
+
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::add): See above.
+
+        * runtime/Structure.h:
+        (JSC):
+        * runtime/StructureTransitionTable.h:
+        (StructureTransitionTable): Bad code goes away, programmer happy.
+
+        * runtime/WeakGCMap.h:
+        (JSC):
+        (WeakGCMap):
+        (JSC::WeakGCMap::WeakGCMap):
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::find):
+        (JSC::WeakGCMap::contains):
+        (JSC::WeakGCMap::gcMap):
+        (JSC::WeakGCMap::gcMapIfNeeded): Inherit from HashMap and override any
+        function that might observe a Weak<T> that has died, just enough to
+        make such items appear as if they are not in the table.
+
+2013-01-18  Michael Saboff  <msaboff@apple.com>
+
+        Refactor isPowerOf2() and add getLSBSet()
+        https://bugs.webkit.org/show_bug.cgi?id=107306
+
+        Reviewed by Filip Pizlo.
+
+        Moved implementation of isPowerOf2() to new hasOneBitSet() in wtf/MathExtras.h.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::isPowerOf2):
+
+2013-01-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Clean up JSValue.mm
+        https://bugs.webkit.org/show_bug.cgi?id=107163
+
+        Reviewed by Darin Adler.
+
+        m_context is no longer weak, so there is now a lot of dead code in in JSValue.mm, and a wasted message send 
+        on every API call.  In the head of just about every method in JSValue.mm we're doing:
+
+        JSContext *context = [self context];
+        if (!context)
+            return nil;
+
+        This is getting a retained copy of the context, which is no longer necessary now m_context is no longer weak.  
+        We can just delete all these lines from all functions doing this, and where they were referring to the local 
+        variable 'context', instead we can just access m_context directly.
+
+        Since we're already going to be modifying most of JSValue.mm, we'll also do the following:
+
+        1) context @property is no longer weak – the context property is declared as:
+
+            @property(readonly, weak) JSContext *context;
+
+        This is really only informative (since we're not presently synthesizing the ivar), but it is now misleading. 
+        We should change it to:
+
+            @property(readonly, retain) JSContext *context;
+
+        2) the JSContext ivar and accessor can be automatically generated.  Since we're no longer doing anything 
+        special with m_context, we can just let the compiler handle the ivar for us.  We'll delete:
+
+            JSContext *m_context;
+
+        and:
+
+            - (JSContext *)context
+            {
+                return m_context;
+        
+            }
+
+        and find&replace "m_context" to "_context" in JSValue.mm.
+
+        * API/APIJSValue.h:
+        * API/JSValue.mm:
+        (-[JSValue toObject]):
+        (-[JSValue toBool]):
+        (-[JSValue toDouble]):
+        (-[JSValue toNumber]):
+        (-[JSValue toString]):
+        (-[JSValue toDate]):
+        (-[JSValue toArray]):
+        (-[JSValue toDictionary]):
+        (-[JSValue valueForProperty:]):
+        (-[JSValue setValue:forProperty:]):
+        (-[JSValue deleteProperty:]):
+        (-[JSValue hasProperty:]):
+        (-[JSValue defineProperty:descriptor:]):
+        (-[JSValue valueAtIndex:]):
+        (-[JSValue setValue:atIndex:]):
+        (-[JSValue isUndefined]):
+        (-[JSValue isNull]):
+        (-[JSValue isBoolean]):
+        (-[JSValue isNumber]):
+        (-[JSValue isString]):
+        (-[JSValue isObject]):
+        (-[JSValue isEqualToObject:]):
+        (-[JSValue isEqualWithTypeCoercionToObject:]):
+        (-[JSValue isInstanceOf:]):
+        (-[JSValue callWithArguments:]):
+        (-[JSValue constructWithArguments:]):
+        (-[JSValue invokeMethod:withArguments:]):
+        (-[JSValue objectForKeyedSubscript:]):
+        (-[JSValue setObject:forKeyedSubscript:]):
+        (-[JSValue initWithValue:inContext:]):
+        (-[JSValue dealloc]):
+        (-[JSValue description]):
+
+2013-01-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: Clean up JSValue
+        https://bugs.webkit.org/show_bug.cgi?id=107156
+
+        Reviewed by Oliver Hunt.
+
+        JSContext m_protectCounts, protect, unprotect are all now unnecessary overhead, and should all be removed.  
+        These exist to handle the context going away before the value does; the context needs to be able to unprotect 
+        values early.  Since the value is now keeping the context alive there is no longer any danger of this happening; 
+        instead we should just protect/unprotect the value in JSValue's init/dealloc methods.
+
+        * API/JSContext.mm:
+        (-[JSContext dealloc]):
+        * API/JSContextInternal.h:
+        * API/JSValue.mm:
+        (-[JSValue initWithValue:inContext:]):
+        (-[JSValue dealloc]):
+
+2013-01-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Node::ref() and Node::deref() should not return bool, and should have postfixRef variants
+        https://bugs.webkit.org/show_bug.cgi?id=107147
+
+        Reviewed by Mark Hahnenberg.
+        
+        This small refactoring will enable a world where ref() returns Node*, which is useful for
+        https://bugs.webkit.org/show_bug.cgi?id=106868.  Also, while this refactoring does lead to
+        slightly less terse code, it's also slightly more self-explanatory.  I could never quite
+        remember what the meaning of the bool return from ref() and deref() was.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::collectGarbage):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::ref):
+        (JSC::DFG::Graph::deref):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::ref):
+        (Node):
+        (JSC::DFG::Node::postfixRef):
+        (JSC::DFG::Node::deref):
+        (JSC::DFG::Node::postfixDeref):
+
+2013-01-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Added svn:ignore=*.pyc, so that ud_opcode.pyc and ud_optable.pyc don't show up
+        in svn stat.
+
+        * disassembler/udis86: Added property svn:ignore.
+
+2013-01-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG 32_64 backend doesn't check for hasArrayStorage() in NewArrayWithSize
+        https://bugs.webkit.org/show_bug.cgi?id=107081
+
+        Reviewed by Michael Saboff.
+
+        This bug led to the 32_64 backend emitting contiguous allocation code to allocate
+        ArrayStorage arrays. This then led to all manner of heap corruption, since
+        subsequent array accesses would be accessing the contiguous array "as if" it was
+        an arraystorage array.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-01-16  Jonathan Liu  <net147@gmail.com>
+
+        Add missing sys/mman.h include on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=98089
+
+        Reviewed by Darin Adler.
+
+        The madvise function and MADV_FREE constant require sys/mman.h.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2013-01-15  Michael Saboff  <msaboff@apple.com>
+
+        DFG X86: division in the used-as-int case doesn't correctly check for -2^31/-1
+        https://bugs.webkit.org/show_bug.cgi?id=106978
+
+        Reviewed by Filip Pizlo.
+
+        Changed the numerator equal to -2^31 check to just return if we expect an integer
+        result, since the check is after we have determined that the denominator is -1.
+        The int result of -2^31 / -1 is -2^31, so just return the numerator as the result.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
+
+2013-01-15  Levi Weintraub  <leviw@chromium.org>
+
+        Unreviewed, rolling out r139792.
+        http://trac.webkit.org/changeset/139792
+        https://bugs.webkit.org/show_bug.cgi?id=106970
+
+        Broke the windows build.
+
+        * bytecode/GlobalResolveInfo.h: Removed property svn:mergeinfo.
+
+2013-01-15  Pratik Solanki  <psolanki@apple.com>
+
+        Use MADV_FREE_REUSABLE to return JIT memory to OS
+        https://bugs.webkit.org/show_bug.cgi?id=106830
+        <rdar://problem/11437701>
+
+        Reviewed by Geoffrey Garen.
+
+        Use MADV_FREE_REUSABLE to return JIT memory on OSes that have the underlying madvise bug
+        fixed.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::notifyPageIsFree):
+
+2013-01-15  Levi Weintraub  <leviw@chromium.org>
+
+        Unreviewed, rolling out r139790.
+        http://trac.webkit.org/changeset/139790
+        https://bugs.webkit.org/show_bug.cgi?id=106948
+
+        The patch is failing its own test.
+
+        * bytecode/GlobalResolveInfo.h: Removed property svn:mergeinfo.
+
+2013-01-15  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Autotools] Unify JavaScriptCore sources list, regardless of target OS
+        https://bugs.webkit.org/show_bug.cgi?id=106007
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Include the Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp target
+        in the general sources list as it is guarded by the ENABLE_EXECUTABLE_ALLOCATOR_FIXED
+        feature define. This define is only used on 64-bit architecture and indirectly depends
+        on enabling either JIT or YARR JIT feature. Both of these defines are disabled on
+        Windows OS when using 64-bit architecture so there's no need to add this target to
+        sources only when the target OS is Windows.
+
+        * GNUmakefile.list.am:
+
+2013-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not forget that it had proved something to be a constant during a merge just because it's merging against the empty value
+        https://bugs.webkit.org/show_bug.cgi?id=106727
+
+        Reviewed by Oliver Hunt.
+        
+        The problem was this statement:
+        
+        if (m_value != other.m_value)
+            m_value = JSValue();
+        
+        This is well-intentioned, in the sense that if we want our abstract value (i.e. this) to become the superset of the other
+        abstract value, and the two abstract values have proven different constants, then our abstract value should rescind its
+        claim that it has been proven to be constant. But this misses the special case that if the other abstract value is
+        completely clear (meaning that it wishes to contribute zero information and so the superset operation shouldn't change
+        this), it will have a clear m_value. So, the code prior to this patch would rescind the constant proof even though it
+        didn't have to.
+        
+        This comes up rarely and I don't believe it will be a performance win, but it is good to have the CFA been consistently
+        precise as often as possible.
+
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::merge):
+
+2013-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Python implementation reports "MemoryError" instead of doing things
+        https://bugs.webkit.org/show_bug.cgi?id=106690
+
+        Reviewed by Oliver Hunt.
+        
+        The bug was that the CFA was assuming that a variable is dead at the end of a basic block and hence doesn't need to
+        be merged to the next block if the last mention of the variable was dead. This is almost correct, except that it
+        doesn't work if the last mention is a GetLocal - the GetLocal itself may be dead, but that doesn't mean that the
+        variable is dead - it may still be live. The appropriate thing to do is to look at the GetLocal's Phi. If the
+        variable is used in the next block then the next block will have a reference to the last mention in our block unless
+        that last mention is a GetLocal, in which case it will link to the Phi. Doing it this way captures everything that
+        the CFA wants: if the last use is a live GetLocal then the CFA needs to consider the GetLocal itself for possible
+        refinements to the proof of the value in the variable, but if the GetLocal is dead, then this must mean that the
+        variable is not mentioned in the block but may still be "passed through" it, which is what the Phi will tell us.
+        Note that it is not possible for the GetLocal to refer to anything other than a Phi, and it is also not possible
+        for the last mention of a variable to be a dead GetLocal while there are other mentions that aren't dead - if
+        there had been SetLocals or GetLocals prior to the dead one then the dead one wouldn't have been emitted by the
+        parser.
+        
+        This also fixes a similar bug in the handling of captured variables. If a variable is captured, then it doesn't
+        matter if the last mention is dead, or not. Either way, we already know that a captured variable will be live in
+        the next block, so we must merge it no matter what.
+        
+        Finally, this change makes the output of Operands dumping a bit more verbose: it now prints the variable name next
+        to each variable's dump. I've often found the lack of this information confusing particularly for operand dumps
+        that involve a lot of variables.
+
+        * bytecode/Operands.h:
+        (JSC::dumpOperands):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+
+2013-01-14  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Fix vcproj file. Missing file tag after http://trac.webkit.org/changeset/139541.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2013-01-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG phases that store per-node information should store it in Node itself rather than using a secondary vector
+        https://bugs.webkit.org/show_bug.cgi?id=106753
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::forNode):
+        (AbstractState):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (JSC::DFG::CSEPhase::performSubstitution):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (CSEPhase):
+        * dfg/DFGNode.h:
+        (Node):
+
+2013-01-12  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed build fix.
+
+        * API/JSBlockAdaptor.mm:
+        * API/JSContext.mm:
+        * API/JSValue.mm:
+
+2013-01-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed 64 bit buildfix after r139496.
+
+        * dfg/DFGOperations.cpp:
+
+2013-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, speculative build fix.
+
+        * API/JSWrapperMap.mm:
+
+2013-01-10  Filip Pizlo  <fpizlo@apple.com>
+
+        JITThunks should not compile only because of luck
+        https://bugs.webkit.org/show_bug.cgi?id=105696
+
+        Rubber stamped by Sam Weinig and Geoffrey Garen.
+        
+        This patch was supposed to just move JITThunks into its own file. But then I
+        realized that there is a horrible circular dependency chain between JSCell,
+        JSGlobalData, CallFrame, and Weak, which only works because of magical include
+        order in JITStubs.h, and the fact that JSGlobalData.h includes JITStubs.h
+        before it includes JSCell or JSValue.
+        
+        I first tried to just get JITThunks.h to just magically do the same pointless
+        includes that JITStubs.h had, but then I decided to actually fix the underflying
+        problem, which was that JSCell needed CallFrame, CallFrame needed JSGlobalData,
+        JSGlobalData needed JITThunks, JITThunks needed Weak, and Weak needed JSCell.
+        Now, all of JSCell's outgoing dependencies are placed in JSCellInlines.h. This
+        also gave me an opportunity to move JSValue inline methods from JSCell.h into
+        JSValueInlines.h. But to make this really work, I needed to remove includes of
+        *Inlines.h from other headers (CodeBlock.h for example included JSValueInlines.h,
+        which defeats the whole entire purpose of having an Inlines.h file), and I needed
+        to add includes of *Inlines.h into a bunch of .cpp files. I did this mostly by
+        having .cpp files include Operations.h. In future, if you're adding a .cpp file
+        to JSC, you'll almost certainly have to include Operations.h unless you enjoy
+        link errors.
+
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObject.cpp:
+        * API/JSClassRef.cpp:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSScriptRef.cpp:
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * JSCTypedArrayStubs.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ArrayAllocationProfile.cpp:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/GetByIdStatus.cpp:
+        * bytecode/LazyOperandValueProfile.cpp:
+        * bytecode/ResolveGlobalStatus.cpp:
+        * bytecode/SpeculatedType.cpp:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * debugger/Debugger.cpp:
+        * debugger/DebuggerActivation.cpp:
+        * debugger/DebuggerCallFrame.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGArrayMode.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        * dfg/DFGDriver.cpp:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
+        (JSC::DFG::SpeculativeJIT::silentSpill):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        * dfg/DFGVariableEventStream.cpp:
+        * heap/CopiedBlock.h:
+        * heap/CopiedSpace.cpp:
+        * heap/HandleSet.cpp:
+        * heap/Heap.cpp:
+        * heap/HeapStatistics.cpp:
+        * heap/SlotVisitor.cpp:
+        * heap/WeakBlock.cpp:
+        * interpreter/CallFrame.cpp:
+        * interpreter/CallFrame.h:
+        * jit/ClosureCallStubRoutine.cpp:
+        * jit/GCAwareJITStubRoutine.cpp:
+        * jit/JIT.cpp:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITCode.h:
+        * jit/JITExceptions.cpp:
+        * jit/JITStubs.h:
+        * jit/JITThunks.h:
+        * jsc.cpp:
+        * llint/LLIntExceptions.cpp:
+        * profiler/LegacyProfiler.cpp:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/ProfilerBytecode.cpp:
+        * profiler/ProfilerBytecodeSequence.cpp:
+        * profiler/ProfilerBytecodes.cpp:
+        * profiler/ProfilerCompilation.cpp:
+        * profiler/ProfilerCompiledBytecode.cpp:
+        * profiler/ProfilerDatabase.cpp:
+        * profiler/ProfilerOSRExit.cpp:
+        * profiler/ProfilerOSRExitSite.cpp:
+        * profiler/ProfilerOrigin.cpp:
+        * profiler/ProfilerOriginStack.cpp:
+        * profiler/ProfilerProfiledBytecodes.cpp:
+        * runtime/ArgList.cpp:
+        * runtime/Arguments.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanObject.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/CallData.cpp:
+        * runtime/CodeCache.cpp:
+        * runtime/Completion.cpp:
+        * runtime/ConstructData.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateInstance.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/Error.cpp:
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/Executable.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/GetterSetter.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/InternalFunction.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSBoundFunction.cpp:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC):
+        * runtime/JSCellInlines.h: Added.
+        (JSC):
+        (JSC::JSCell::JSCell):
+        (JSC::JSCell::finishCreation):
+        (JSC::JSCell::structure):
+        (JSC::JSCell::visitChildren):
+        (JSC::allocateCell):
+        (JSC::isZapped):
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        (JSC::JSCell::isGetterSetter):
+        (JSC::JSCell::isProxy):
+        (JSC::JSCell::isAPIValueWrapper):
+        (JSC::JSCell::setStructure):
+        (JSC::JSCell::methodTable):
+        (JSC::JSCell::inherits):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        (JSC::JSCell::fastGetOwnProperty):
+        (JSC::JSCell::toBoolean):
+        * runtime/JSDateMath.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+        (JSC):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSLock.cpp:
+        * runtime/JSNameScope.cpp:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.h:
+        (JSC):
+        * runtime/JSProxy.cpp:
+        * runtime/JSScope.cpp:
+        * runtime/JSSegmentedVariableObject.cpp:
+        * runtime/JSString.h:
+        (JSC):
+        * runtime/JSStringJoiner.cpp:
+        * runtime/JSSymbolTableObject.cpp:
+        * runtime/JSValue.cpp:
+        * runtime/JSValueInlines.h:
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC):
+        (JSC::JSValue::isUInt32):
+        (JSC::JSValue::asUInt32):
+        (JSC::JSValue::asNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isEmpty):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32):
+        (JSC::JSValue::isDouble):
+        (JSC::JSValue::isTrue):
+        (JSC::JSValue::isFalse):
+        (JSC::JSValue::tag):
+        (JSC::JSValue::payload):
+        (JSC::JSValue::asInt32):
+        (JSC::JSValue::asDouble):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::asBoolean):
+        (JSC::reinterpretDoubleToInt64):
+        (JSC::reinterpretInt64ToDouble):
+        (JSC::JSValue::isString):
+        (JSC::JSValue::isPrimitive):
+        (JSC::JSValue::isGetterSetter):
+        (JSC::JSValue::isObject):
+        (JSC::JSValue::getString):
+        (JSC::::getString):
+        (JSC::JSValue::getObject):
+        (JSC::JSValue::getUInt32):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::toNumber):
+        (JSC::JSValue::toObject):
+        (JSC::JSValue::isFunction):
+        (JSC::JSValue::inherits):
+        (JSC::JSValue::toThisObject):
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        (JSC::JSValue::putByIndex):
+        (JSC::JSValue::structureOrUndefined):
+        (JSC::JSValue::equal):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSWithScope.cpp:
+        * runtime/JSWrapperObject.cpp:
+        * runtime/LiteralParser.cpp:
+        * runtime/Lookup.cpp:
+        * runtime/NameConstructor.cpp:
+        * runtime/NameInstance.cpp:
+        * runtime/NamePrototype.cpp:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorPrototype.cpp:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberObject.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/Operations.h:
+        (JSC):
+        * runtime/PropertySlot.cpp:
+        * runtime/RegExp.cpp:
+        * runtime/RegExpCache.cpp:
+        * runtime/RegExpCachedResult.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpMatchesArray.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/SmallStrings.cpp:
+        * runtime/SparseArrayValueMap.cpp:
+        * runtime/StrictEvalActivation.cpp:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/StringRecursionChecker.cpp:
+        * runtime/Structure.h:
+        (JSC):
+        * runtime/StructureChain.cpp:
+        * runtime/TimeoutChecker.cpp:
+        * testRegExp.cpp:
+
+2013-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        If you use Phantom to force something to be live across an OSR exit, you should put it after the OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=106724
+
+        Reviewed by Oliver Hunt.
+        
+        In cases where we were getting it wrong, I think it was benign because we would either already have an
+        OSR exit prior to there, or the operand would be a constant.  But still, it's good to get this right.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2013-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Phantom(GetLocal) should be treated as relevant to OSR
+        https://bugs.webkit.org/show_bug.cgi?id=106715
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performBlockCSE):
+
+2013-01-11  Pratik Solanki  <psolanki@apple.com>
+
+        Fix function name typo ProgramExecutable::initalizeGlobalProperties()
+        https://bugs.webkit.org/show_bug.cgi?id=106701
+
+        Reviewed by Geoffrey Garen.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/Executable.h:
+
+2013-01-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        testapi is failing with a block-related error in the Objc API
+        https://bugs.webkit.org/show_bug.cgi?id=106055
+
+        Reviewed by Filip Pizlo.
+
+        Same bug as in testapi.mm. We need to actually call the static block, rather than casting the block to a bool.
+
+        * API/ObjCCallbackFunction.mm:
+        (blockSignatureContainsClass):
+
+2013-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a run-time option to print bytecode at DFG compile time
+        https://bugs.webkit.org/show_bug.cgi?id=106704
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * runtime/Options.h:
+        (JSC):
+
+2013-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to enable verbose printing of each OSR exit at run-time (rather than compile-time) and it should print register state
+        https://bugs.webkit.org/show_bug.cgi?id=106700
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGAssemblyHelpers.h:
+        (DFG):
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        * dfg/DFGCommon.h:
+        * dfg/DFGOSRExit.h:
+        (DFG):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * runtime/Options.h:
+        (JSC):
+
+2013-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed getDirectLocation and offsetForLocation and all their uses
+        https://bugs.webkit.org/show_bug.cgi?id=106692
+
+        Reviewed by Filip Pizlo.
+
+        getDirectLocation() and its associated offsetForLocation() relied on
+        detailed knowledge of the rules of PropertyOffset, JSObject, and
+        Structure, which is a hard thing to reverse-engineer reliably. Luckily,
+        it wasn't needed, and all clients either wanted a true value or a
+        PropertyOffset. So, I refactored accordingly.
+
+        * dfg/DFGOperations.cpp: Renamed putDirectOffset to putDirect, to clarify
+        that we are not putting an offset.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot): Get a value instead of a value
+        pointer, since we never wanted a pointer to begin with.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot): Use a PropertyOffset instead of a pointer,
+        so we don't have to reverse-engineer the offset from the pointer.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::resetInheritorID):
+        (JSC::JSObject::inheritorID):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::fillGetterPropertySlot):
+        (JSC::JSObject::getOwnPropertyDescriptor): Renamed getDirectOffset and
+        putDirectOffset, as explaind above. We want to use the name "getDirectOffset"
+        for when the thing you're getting is the offset.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectOffset): Changed getDirectLocation to getDirectOffset,
+        since clients really wants PropertyOffsets and not locations.
+
+        (JSObject::offsetForLocation): Removed this function because it was hard
+        to get right.
+
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectUndefined):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/JSScope.cpp:
+        (JSC::executeResolveOperations):
+        (JSC::JSScope::resolvePut):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::putToPrimitive): Updated for renames.
+
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot): Use a PropertyOffset instead of a pointer,
+        so we don't have to reverse-engineer the offset from the pointer.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure): Updated for renames.
+
+2013-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed an unused version of getDirectLocation
+        https://bugs.webkit.org/show_bug.cgi?id=106691
+
+        Reviewed by Gavin Barraclough.
+
+        getDirectLocation is a weird operation. Removing the unused version is
+        the easy part.
+
+        * runtime/JSObject.h:
+        (JSObject):
+
+2013-01-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C objects that are passed to JavaScript leak (until the JSContext is destroyed)
+        https://bugs.webkit.org/show_bug.cgi?id=106056
+
+        Reviewed by Darin Adler.
+
+        * API/APIJSValue.h:
+        * API/JSValue.mm: Make the reference to the JSContext strong.
+        (-[JSValue context]):
+        (-[JSValue initWithValue:inContext:]):
+        (-[JSValue dealloc]):
+        * API/JSWrapperMap.mm: Make the reference back from wrappers to Obj-C objects weak instead of strong.
+        Also add an explicit WeakGCMap in the JSWrapperMap rather than using Obj-C associated object API which 
+        was causing memory leaks.
+        (wrapperClass):
+        (-[JSObjCClassInfo wrapperForObject:]):
+        (-[JSWrapperMap initWithContext:]):
+        (-[JSWrapperMap dealloc]):
+        (-[JSWrapperMap wrapperForObject:]):
+
+2013-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed some bogus PropertyOffset ASSERTs
+        https://bugs.webkit.org/show_bug.cgi?id=106686
+
+        Reviewed by Gavin Barraclough.
+
+        The ASSERTs were passing a JSType instead of an inlineCapacity, due to
+        an incomplete refactoring.
+
+        The compiler didn't catch this because both types are int underneath.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructure): Validate against
+        our inline capacity, as we intended.
+
+2013-01-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Rename propertyOffsetFor => offsetForPropertyNumber
+        https://bugs.webkit.org/show_bug.cgi?id=106685
+
+        Reviewed by Gavin Barraclough.
+
+        Since the argument is just a typedef and not an object, I wanted to clarify the meaning.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::nextOffset): Updated for rename.
+
+        * runtime/PropertyOffset.h:
+        (JSC::offsetForPropertyNumber): Renamed. Also changed some PropertyOffset variables
+        to plain ints, because they're not actually on the PropertyOffsets number line.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::lastValidOffset): Updated for rename.
+
+2013-01-10  Zan Dobersek  <zandobersek@gmail.com>
+
+        Remove the ENABLE_ANIMATION_API feature define occurences
+        https://bugs.webkit.org/show_bug.cgi?id=106544
+
+        Reviewed by Simon Fraser.
+
+        The Animation API code was removed in r137243. The ENABLE_ANIMATION_API
+        feature define handling still lingers in various build systems and configurations
+        but is of no use, so it should be removed.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-09  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Just move the JavaScriptCore exports file around in the vcproj to make things clearer.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2013-01-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Dont use a node reference after appending to the graph.
+        https://bugs.webkit.org/show_bug.cgi?id=103305
+        <rdar://problem/12753096>
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+
+2013-01-09  Roger Fong  <roger_fong@apple.com>
+
+        Rename export files to make them more easily findable.
+        https://bugs.webkit.org/show_bug.cgi?id=98695.
+
+        Reviewed by Timothy Horton.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def.
+
+2013-01-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add mips.rb to offlineasm_nosources.
+
+2013-01-08  Oliver Hunt  <oliver@apple.com>
+
+        Support op_typeof in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=98898
+
+        Reviewed by Filip Pizlo.
+
+        Adds a TypeOf node to the DFG to support op_typeof.
+
+        To avoid adding too much GC horror, this also makes the
+        common strings portion of the SmallString cache strongly
+        referenced.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+          We try to determine the result early here, and substitute in a constant.
+          Otherwise we leave the node intact, and set the result type to SpecString.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+          Parse op_typeof
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+          TypeOf nodes can be subjected to pure CSE
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+          We can handle typeof.
+        * dfg/DFGNodeType.h:
+        (DFG):
+          Define the node.
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+          Add operationTypeOf to support the non-trivial cases.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+          Actual codegen
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC):
+        * runtime/Operations.h:
+        (JSC):
+          Some refactoring to allow us to get the type string for an
+          object without needing a callframe.
+
+
+2013-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG shouldn't treat the 'this' argument as being captured if a code block uses arguments
+        https://bugs.webkit.org/show_bug.cgi?id=106398
+        <rdar://problem/12439776>
+
+        Reviewed by Mark Hahnenberg.
+        
+        This is a possible optimization for inlined calls, and fixes crashes for inlined constructors, in the case
+        that the inlined code used arguments. The problem was that assuming that 'this' was captured implies the
+        assumption that it was initialized by the caller, which is wrong for constructors and this.
+        
+        Also added a pretty essential DFG IR validation rule: we shouldn't have any live locals at the top of the
+        root block. This helps to catch this bug: our assumption that 'this' was captured in an inlined constructor
+        that used arguments led to liveness for the temporary that would have held 'this' in the caller being
+        propagated all the way up to the entrypoint of the function.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isCaptured):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::reportValidationContext):
+        (Validate):
+        (JSC::DFG::Validate::dumpGraphIfAppropriate):
+
+2013-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r138921): Crash in JSC::Arguments::create
+        https://bugs.webkit.org/show_bug.cgi?id=106329
+        <rdar://problem/12974196>
+
+        Reviewed by Mark Hahnenberg.
+        
+        Arguments::finishCreation() that takes an InlineCallFrame* needs to understand that the callee can
+        be unset, indicating that the callee needs to be loaded from the true call frame. This adds a
+        method to InlineCallFrame to do just that.
+
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::calleeForCallFrame):
+        * bytecode/CodeOrigin.h:
+        (InlineCallFrame):
+        * runtime/Arguments.h:
+        (JSC::Arguments::finishCreation):
+
+2013-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG initrinsic handling should ensure that we backwards propagate the fact that all operands may escape
+        https://bugs.webkit.org/show_bug.cgi?id=106365
+
+        Reviewed by Mark Hahnenberg.
+        
+        Use the fact that Phantom means that things escaped, and just insert Phantoms for all
+        of the operands.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+
+2013-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        If array allocation profiling causes a new_array to allocate double arrays, then the holes should end up being correctly initialized
+        https://bugs.webkit.org/show_bug.cgi?id=106363
+
+        Reviewed by Mark Hahnenberg.
+
+        * runtime/JSArray.h:
+        (JSC::JSArray::tryCreateUninitialized):
+
+2013-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should backwards-propagate NodeUsedAsValue for Phantom
+        https://bugs.webkit.org/show_bug.cgi?id=106299
+
+        Reviewed by Mark Hahnenberg.
+        
+        This is currently benign because Phantom is only inserted by the bytecode parser for
+        things that already happen to be used in contexts that backwards propagate
+        NodeUsedAsValue. But that doesn't change the fact that the semantics of Phantom are
+        that the value can be arbitrarily used by the baseline JIT.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2013-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize closure call heuristics and profiling
+        https://bugs.webkit.org/show_bug.cgi?id=106270
+
+        Reviewed by Oliver Hunt.
+        
+        Did a number of things:
+        
+        - CallLinkInfo now remembers if it was ever a closure call, and CallLinkStatus uses
+          this. Reduces the likelihood that we will inline a closure call as if it was a
+          normal call.
+        
+        - Made InlineCallFrame print inferred function names, and refactored
+          CodeBlock::inferredName() to better use FunctionExecutable's API.
+        
+        - Made bytecode dumping print frequent exit sites that led to recompilation.
+        
+        - Made bytecode dumping for op_call and op_construct print what the CallLinkStatus
+          saw.
+        
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (CallLinkInfo):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::inferredName):
+        (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
+        (JSC::CodeBlock::printCallOp):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::dump):
+        (JSC::InlineCallFrame::inferredName):
+        (JSC):
+        (JSC::InlineCallFrame::dumpBriefFunctionInformation):
+        (JSC::InlineCallFrame::dump):
+        * bytecode/CodeOrigin.h:
+        (InlineCallFrame):
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::ExitProfile::exitSitesFor):
+        (DFG):
+        * bytecode/DFGExitProfile.h:
+        (ExitProfile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2013-01-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Sorted the xcodeproj file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, it should be possible to build JSC on ARM.
+
+        * API/JSBase.h:
+        * jit/JITStubs.cpp:
+        (JSC::performPlatformSpecificJITAssertions):
+        (JSC):
+        * jit/JITStubs.h:
+        (JSC):
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::JITThunks):
+        * jit/JITThunks.h:
+        (JITThunks):
+        * offlineasm/armv7.rb:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2013-01-07  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        MIPS LLInt implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=99706
+
+        Reviewed by Filip Pizlo.
+
+        LLInt implementation for MIPS.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::jump):
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        * jit/JITStubs.cpp:
+        (JSC):
+        * jit/JITStubs.h:
+        (JITStackFrame):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * offlineasm/backends.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/mips.rb: Added.
+
+2013-01-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        testapi is failing with a block-related error in the Objc API
+        https://bugs.webkit.org/show_bug.cgi?id=106055
+
+        Reviewed by Geoffrey Garen.
+
+        Casting a block to a bool will always return true, which isn't the behavior that is intended here.
+        Instead we need to call the block, but C semantics don't allow this, so we need to change 
+        testapi.m to be Objective-C++ and therefore testapi.mm.
+
+        * API/tests/testapi.m: Removed.
+        * API/tests/testapi.mm: Copied from Source/JavaScriptCore/API/tests/testapi.m.
+        (blockSignatureContainsClass):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-01-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Simplify slow case profiling
+        https://bugs.webkit.org/show_bug.cgi?id=106208
+
+        Reviewed by Mark Rowe.
+        
+        Removing the minimum execution ratio portion of slow case profiling, which allows
+        the removal of a field from CodeBlock. This appears to be performance neutral,
+        implying that the complexity incurred by the previous heuristic was purely
+        harmful: it made the code more complicated, and it made CodeBlock larger, without
+        resulting in any measurable benefits.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::couldTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * runtime/Options.h:
+
+2013-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline closure calls
+        https://bugs.webkit.org/show_bug.cgi?id=106067
+
+        Reviewed by Gavin Barraclough.
+        
+        This adds initial support for inlining closure calls to the DFG. A call is considered
+        to be a closure call when the JSFunction* varies, but always has the same executable.
+        We already have closure call inline caching in both JITs, which works by checking that
+        the callee has an expected structure (as a cheap way of detecting that it is in fact
+        a JSFunction) and an expected executable. Closure call inlining uses profiling data
+        aggregated by CallLinkStatus to decide when to specialize the call to the particular
+        structure/executable, and inline the call rather than emitting a call sequence. When
+        we choose to do a closure inline rather than an ordinary inline, a number of things
+        change about how inlining is performed:
+        
+        - The inline is guarded by a CheckStructure/CheckExecutable rather than a
+          CheckFunction.
+        
+        - Instead of propagating a constant value for the scope, we emit GetMyScope every time
+          that the scope is needed, which loads the scope from a local variable. We do similar
+          things for the callee.
+        
+        - The prologue of the inlined code includes SetMyScope and SetCallee nodes to eagerly
+          plant the scope and callee into the "true call frame", i.e. the place on the stack
+          where the call frame would have been if the call had been actually performed. This
+          allows GetMyScope/GetCallee to work as they would if the code wasn't inlined. It
+          also allows for trivial handling of scope and callee for call frame reconstruction
+          upon stack introspection and during OSR.
+        
+        - A new node called GetScope is introduced, which just gets the scope of a function.
+          This node has the expected CSE support. This allows for the
+          SetMyScope(GetScope(@function)) sequence to set up the scope in the true call frame.
+        
+        - GetMyScope/GetCallee CSE can match against SetMyScope/SetCallee, which means that
+          the GetMyScope/GetCallee nodes emitted during parsing are often removed during CSE,
+          if we can prove that it is safe to do so.
+        
+        - Inlining heuristics are adjusted to grok the cost of inlining a closure. We are
+          less likely to inline a closure call than we are to inline a normal call, since we
+          end up emitting more code for closures due to CheckStructure, CheckExecutable,
+          GetScope, SetMyScope, and SetCallee.
+        
+        Additionally, I've fixed the VariableEventStream to ensure that we don't attempt to
+        plant Undefined into the true call frames. This was previously a harmless oversight,
+        but it becomes quite bad if OSR is relying on the scope/callee already having been
+        set and not subsequently clobbered by the OSR itself.
+        
+        This is a ~60% speed-up on programs that frequently make calls to closures. It's
+        neutral on V8v7 and other major benchmark suites.
+        
+        The lack of a definite speed-up is likely due the fact that closure inlining currently
+        does not do any cardinality [1] optimizations. We don't observe when a closure was
+        constructed within its caller, and so used the scope from its caller; and furthermore
+        we have no facility to detect when the scope is single. All scoped variable accesses
+        are assumed to be multiple instead. A subsequent step will be to ensure that closure
+        call inlining will be single and loving it.
+        
+        [1] Single and loving it: Must-alias analysis for higher-order languages. Suresh
+            Jagannathan, Peter Thiemann, Stephen Weeks, and Andrew Wright. In POPL '98.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::dump):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::isClosureCall):
+        (CallLinkStatus):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::globalObjectFor):
+        (JSC):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::getCalleeLoadElimination):
+        (JSC::DFG::CSEPhase::checkExecutableElimination):
+        (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::mightInlineFunctionForClosureCall):
+        * dfg/DFGCapabilities.h:
+        (DFG):
+        (JSC::DFG::mightInlineFunctionForClosureCall):
+        (JSC::DFG::canInlineFunctionForClosureCall):
+        (JSC::DFG::canInlineFunctionFor):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::hasExecutable):
+        (JSC::DFG::Node::executable):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * runtime/Options.h:
+        (JSC):
+
+2013-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Data flow paths that carry non-numbers, non-undefined, non-null values should not cause subtractions and arithmetic additions (i.e. ++) to speculate double
+        https://bugs.webkit.org/show_bug.cgi?id=106190
+
+        Reviewed by Sam Weinig.
+        
+        The problem is that the DFG logic for deciding when to speculate integer was
+        confusing the special case of ValueAdd (where non-numeric values should cause us
+        to not speculate integer, because we want to fall off into the generic case) with
+        the more normal case of ArithAdd and ArithSub (where we want to speculate integer
+        unless we have evidence that the operands are doubles, since the DFG doesn't have
+        generic handling of non-numeric arithmetic). Prior to this change doing a - b where
+        either a or b were possibly non-numeric would always force the subtraction to be
+        done using doubles.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addSpeculationMode):
+        (Graph):
+        (JSC::DFG::Graph::valueAddSpeculationMode):
+        (JSC::DFG::Graph::arithAddSpeculationMode):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
+
+2013-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should trust array profiling over value profiling
+        https://bugs.webkit.org/show_bug.cgi?id=106155
+
+        Reviewed by Gavin Barraclough.
+        
+        The real problem is that prediction propagation is not flow-sensitive. We had code
+        like:
+        
+        var a = (some load from memory); // returns either an array or false
+        if (a)
+            a[i] = v;
+        
+        Because 'a' could be 'false', we were emitting a fully generic unoptimized PutByVal.
+        This patch changes ArrayMode to ignore the type of the base of an array access, if
+        array profiling tells us that the array access can be optimized.
+        
+        In the future, we could probably make this work even better with some flow
+        sensitivity in the prediction propagator, but I also tend to think that this is a
+        more robust overall solution. If we ever did want to support array accesses on
+        array-or-false then we should change the array profiler to be able to tell us that
+        this is what is going on.
+        
+        3.7% speed-up on V8/earley.
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+
+2013-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize exit site profiling for calls
+        https://bugs.webkit.org/show_bug.cgi?id=106150
+
+        Reviewed by Sam Weinig.
+        
+        This adds two new exit kinds for calls: BadFunction and BadExecutable. The latter is not used
+        yet, but is already integrated with profiling. CheckFunction uses a BadFunction speculation
+        instead of BadCache, now. This allows CallLinkStatus to turn itself into a closure call status
+        if we had a BadFunction exit site but the CallLinkInfo told us to use a non-closure call. This
+        might happen if we had call unlinking that led to information loss along the way.
+        
+        No performance impact. This is meant as another step towards inlining closure calls.
+
+        * bytecode/CallLinkStatus.cpp:
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::setIsProved):
+        (JSC::CallLinkStatus::setHasBadFunctionExitSite):
+        (CallLinkStatus):
+        (JSC::CallLinkStatus::setHasBadCacheExitSite):
+        (JSC::CallLinkStatus::setHasBadExecutableExitSite):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-01-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not elide CheckStructure if it's needed to perform a cell check
+        https://bugs.webkit.org/show_bug.cgi?id=106074
+
+        Reviewed by Ryosuke Niwa.
+        
+        The problem here was that the constant folding phase was misinterpreting the meaning of the sets
+        in DFG::AbstractValue.  AbstractValue describes a constraint on the values that a variable (i.e.
+        a DFG Node, or a virtual register, i.e. local or argument) may have. It does so by containing
+        four sets: the set of JSValues (either empty, the singleton set containing one JSValue, or the
+        set of all JSValues); the set of "current known" structures, i.e. the set of structures that you
+        already know that this value may have right now (also either empty, the singleton set, or the set
+        of all structures); the set of "future possible" structures, i.e. the set of structures that this
+        value could have in the future if none of the structure transition watchpoints for those
+        structures had fired (also empty, singleton, or all); and the set of types, which is a
+        SpeculatedType bitmask. The correct way to interpret the sets is to think of the AbstractValue as
+        the intersection of these three sets of values:
+        
+        - The set of JSValues that have a type that belongs to the m_type set.
+        - If m_value is not the empty value then: the set of all JSValues that are == m_value;
+                                            else: the set of all JSValues.
+          where '==' is as defined by JSValue::operator==.
+        - Union of { the set of all cells that have a structure that belongs to m_currentKnownStructure }
+               and { the set of all JSValues that are not cells }.
+        
+        You can then further intersect this set with the following set, if you guard the code with
+        watchpoints on all structures in the m_futurePossibleStructure:
+        
+        - Union of { the set of all cells that have a structure that belongs to m_futurePossibleStructure }
+               and { the set of all JSValues that are not cells }.
+        
+        One way to think of this is that m_currentKnownStructure is filtered by m_futurePossibleStructure
+        (i.e. is set to the intersection of m_currentKnownStructure and m_futurePossibleStructure), if the
+        code for which you're doing this is always preceded by watchpoints on all structures in
+        m_futurePossibleStructure, and is always before any side-effects that could change the structures
+        of objects.
+        
+        The incorrect optimization related to CheckStructure. CheckStructure checks that the value is a
+        cell, and that it has a particular structure. It was incorrectly assuming that you could eliminate
+        the CheckStructure, if m_currentKnownStructure contained the structure that CheckStructure was
+        checking. But this is not the case, since m_currentKnownStructure does not prove that the value is
+        a cell with a particular structure; it only proves that if the value was a cell then it would have
+        a particular structure. Hence, to eliminate CheckStructure, it is also necessary to check that
+        AbstractValue::m_type contains only cells (i.e. isCellSpeculation(m_type) == true).
+        
+        It wasn't doing that, and this changes makes sure that it does do that.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2013-01-04  Adam Klein  <adamk@chromium.org>
+
+        Remove ENABLE_MUTATION_OBSERVERS #define
+        https://bugs.webkit.org/show_bug.cgi?id=105459
+
+        Reviewed by Ryosuke Niwa.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-01-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ByteCodeCache serves little or no purpose ever since we decided to keep bytecode around permanently
+        https://bugs.webkit.org/show_bug.cgi?id=106058
+
+        Reviewed by Michael Saboff.
+        
+        All baseline code blocks now always have bytecode, so the bytecode cache's ability to minimize the
+        number of times that the DFG produces bytecode sequences for code blocks is superfluous.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGByteCodeCache.h: Removed.
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * runtime/Executable.cpp:
+        (JSC):
+        * runtime/Executable.h:
+        (FunctionExecutable):
+
+2013-01-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build for DFG JIT disabled.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpValueProfiling):
+        (JSC::CodeBlock::dumpArrayProfiling):
+        * runtime/Executable.cpp:
+        (JSC):
+        (JSC::ExecutableBase::intrinsic):
+
+2013-01-03  Filip Pizlo  <fpizlo@apple.com>
+
+        CallLinkStatus should be aware of closure calls, and the DFG bytecode parser should use that as its sole internal notion of how to optimize calls
+        https://bugs.webkit.org/show_bug.cgi?id=106027
+
+        Reviewed by Mark Hahnenberg.
+        
+        Previously, the DFG bytecode parser had its own internal notion of exactly what CallLinkStatus was
+        meant to do, in the form of a CallType, expectedFunction, intrinsic, etc. This change makes CallLinkStatus
+        smart enough to do all of that, and also gives it the ability to understand closure calls.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC):
+        (JSC::CallLinkStatus::function):
+        (JSC::CallLinkStatus::internalFunction):
+        (JSC::CallLinkStatus::intrinsicFor):
+        (JSC::CallLinkStatus::setIsProved):
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::dump):
+        * bytecode/CallLinkStatus.h:
+        (JSC):
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (CallLinkStatus):
+        (JSC::CallLinkStatus::takesSlowPath):
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::isClosureCall):
+        (JSC::CallLinkStatus::callTarget):
+        (JSC::CallLinkStatus::executable):
+        (JSC::CallLinkStatus::structure):
+        (JSC::CallLinkStatus::isProved):
+        (JSC::CallLinkStatus::canOptimize):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueOfFunctionConstant):
+
+2013-01-02  Simon Hausmann  <simon.hausmann@digia.com>
+
+        [MinGW-w64] Centralize workaround for pow() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=105925
+
+        Reviewed by Sam Weinig.
+
+        As suggested by Sam, move the MinGW-w64 workaround into MathExtras.h
+        away from the JSC usage.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathPow):
+
+2013-01-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Objective-C API for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=105889
+
+        Reviewed by Geoff Garen.
+
+        Fixes for more issues raised by Darin.
+
+        * API/JSBlockAdaptor.mm:
+        (BlockArgument):
+        (BlockArgumentStruct::BlockArgumentStruct):
+        (BlockArgumentTypeDelegate::typeStruct):
+        (BlockResult):
+        (BlockResultStruct::BlockResultStruct):
+        (buildBlockSignature):
+        (-[JSBlockAdaptor initWithBlockSignatureFromProtocol:]):
+        (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
+            - fix * position for Objective-C types
+        * API/JSContext.h:
+            - fix * position for Objective-C types
+        * API/JSContext.mm:
+        (-[JSContext initWithVirtualMachine:]):
+        (-[JSContext virtualMachine]):
+        (contextInternalContext):
+            - fix * position for Objective-C types
+        (-[JSContext dealloc]):
+        (-[JSContext protect:]):
+        (-[JSContext unprotect:]):
+            - HashMap<JSValueRef, size_t> -> HashCountedSet<JSValueRef>
+        * API/JSContextInternal.h:
+        (WeakContextRef):
+            - fix * position for Objective-C types
+        * API/JSValue.mm:
+        (valueToString):
+            - fix * position for Objective-C types
+        (isNSBoolean):
+            - Added helper to check for booleans.
+        (objectToValueWithoutCopy):
+            - Added contextRef
+            - fix * position for Objective-C types
+            - Remove @YES, @NO literal usage, use isNSBoolean instead
+        (objectToValue):
+            - Added contextRef
+        (+[JSValue valueWithValue:inContext:]):
+        (-[JSValue initWithValue:inContext:]):
+            - fix * position for Objective-C types
+        (createStructHandlerMap):
+        (handerForStructTag):
+            - getStructTagHandler -> handerForStructTag
+            - Split out createStructHandlerMap
+            - strncmp -> memcmp
+            - String(type).impl() -> StringImpl::create(type)
+        (+[JSValue selectorForStructToValue:]):
+        (+[JSValue selectorForValueToStruct:]):
+            - getStructTagHandler -> handerForStructTag
+        (typeToValueInvocationFor):
+        (valueToTypeInvocationFor):
+            - fix * position for Objective-C types
+        * API/JSValueInternal.h:
+            - fix * position for Objective-C types
+        * API/JSVirtualMachineInternal.h:
+            - fix * position for Objective-C types
+        * API/JSWrapperMap.h:
+            - fix * position for Objective-C types
+        * API/JSWrapperMap.mm:
+        (selectorToPropertyName):
+        (createObjectWithCustomBrand):
+        (createRenameMap):
+        (putNonEnumerable):
+        (copyMethodsToObject):
+        (copyPrototypeProperties):
+        (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
+        (-[JSWrapperMap initWithContext:]):
+        (-[JSWrapperMap wrapperForObject:]):
+        (getJSExportProtocol):
+            - fix * position for Objective-C types
+        * API/ObjCCallbackFunction.h:
+            - fix * position for Objective-C types
+        * API/ObjCCallbackFunction.mm:
+        (CallbackArgument):
+        (CallbackArgumentStruct::CallbackArgumentStruct):
+            - fix * position for Objective-C types
+        (CallbackArgumentBlockCallback::createAdoptingJSBlockAdaptor):
+            - Added to make adopt explicit
+        (CallbackArgumentBlockCallback):
+        (CallbackArgumentBlockCallback::CallbackArgumentBlockCallback):
+        (ArgumentTypeDelegate::typeBlock):
+            - Call createAdoptingJSBlockAdaptor
+        (ArgumentTypeDelegate::typeStruct):
+        (CallbackResult):
+        (CallbackResultStruct::CallbackResultStruct):
+        (ResultTypeDelegate::typeStruct):
+        (ObjCCallbackFunction::ObjCCallbackFunction):
+        (ObjCCallbackFunction::context):
+        (objCCallbackFunctionForInvocation):
+        (objCCallbackFunctionForMethod):
+        (objCCallbackFunctionForBlock):
+            - fix * position for Objective-C types
+        * API/ObjcRuntimeExtras.h:
+        (protocolImplementsProtocol):
+        (forEachProtocolImplementingProtocol):
+        (forEachMethodInProtocol):
+        (forEachPropertyInProtocol):
+            - fix * position for Objective-C types
+        * API/tests/testapi.m:
+        (-[TestObject testArgumentTypesWithInt:double:boolean:string:number:array:dictionary:]):
+        (testObjectiveCAPI):
+            - fix * position for Objective-C types
+
+2013-01-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Some renaming in the CodeCache
+        https://bugs.webkit.org/show_bug.cgi?id=105966
+
+        Reviewed by Gavin Barraclough.
+
+        CodeBlockKey => SourceCodeKey because the key is not a CodeBlock.
+
+        m_recentlyUsedFunctionCode => m_recentlyUsedFunctions to match other names.
+
+        GlobalFunctionKey => FunctionKey because the key is not unique to globalness.
+
+        m_cachedGlobalFunctions => m_globalFunctions because "cached" is redundant
+        for data members in an object called "CodeCache".
+
+        kMaxRootCodeBlockEntries => kMaxRootEntries because there are no non-CodeBlock
+        entries in a CodeBlock cache.
+
+        kMaxFunctionCodeBlocks => kMaxChildFunctionEntries to clarify that this
+        number models a parent-child relationship.
+
+        Also removed the initial "k" from enum constants. That's an interesting
+        style for calling out constants, but it's not the WebKit style.
+
+        Finally, a behavior change: Use MaxRootEntries for the limit on global
+        functions, and not MaxChildFunctionEntries. Previously, there was an
+        unused constant that seemed to have been intended for this purpose.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::makeSourceCodeKey):
+        (JSC::CodeCache::getCodeBlock):
+        (JSC::CodeCache::generateFunctionCodeBlock):
+        (JSC::CodeCache::makeFunctionKey):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        (JSC::CodeCache::usedFunctionCode):
+        * runtime/CodeCache.h:
+        (JSC::CodeCache::clear):
+
+2013-01-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG inlining machinery should be robust against the inline callee varying while the executable stays the same
+        https://bugs.webkit.org/show_bug.cgi?id=105953
+
+        Reviewed by Mark Hahnenberg.
+        
+        This institutes the policy that if InlineCallFrame::callee is null, then the callee and scope have already
+        been stored into the true call frame (i.e. the place where the call frame of the inlined call would have
+        been) and so any attempt to access the callee or scope should do a load instead of assuming that the value
+        is constant. This wires the changes through the bytecode parser, the stack scanning logic, and the compiler
+        optimization phases and backends.
+
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::dump):
+        * bytecode/CodeOrigin.h:
+        (CodeOrigin):
+        (InlineCallFrame):
+        (JSC::InlineCallFrame::isClosureCall):
+        (JSC::CodeOrigin::stackOffset):
+        (JSC):
+        * dfg/DFGAssemblyHelpers.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::get):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::getScope):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCSEPhase.cpp:
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::genericPureCSE):
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::pureCSERequiringSameInlineCallFrame):
+        (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallFrame):
+
+2013-01-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Objective-C API for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=105889
+
+        Reviewed by Geoff Garen.
+
+        Fixes for a number of issues raised by Darin.
+
+        * API/APIJSValue.h:
+            - Fix typos in comment
+            - Add newline before NS_CLASS_AVAILABLE(10_9, NA)
+            - cls -> expectedClass
+            - key type for -setObject:forKeyedSubscript: is now NSObject <NSCopying> *
+        * API/JSBase.h:
+            - JS_OBJC_API_ENABLED no longer implies __OBJC__
+        * API/JSBlockAdaptor.mm:
+        (BlockArgumentStruct::BlockArgumentStruct):
+        (BlockArgumentStruct):
+            - mark virtual functions as virtual, override, and private
+            - refactor out buffer allocation for struct types
+        (BlockArgumentTypeDelegate::typeVoid):
+        (BlockArgumentTypeDelegate::typeBlock):
+        (BlockArgumentTypeDelegate::typeStruct):
+            - return nil -> return 0
+        (BlockResultStruct::BlockResultStruct):
+        (BlockResultStruct):
+            - mark virtual functions as virtual, override, and private
+            - refactor out buffer allocation for struct types
+        (buildBlockSignature):
+            - %lu is not an appropriate format specifier for NSInteger
+        (-[JSBlockAdaptor initWithBlockSignatureFromProtocol:]):
+            - nil check [super init]
+        (-[JSBlockAdaptor blockMatchesSignature:]):
+        (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
+            - ctx -> contextRef
+        * API/JSContext.h:
+            - Fix typos in comment
+            - Add newline before NS_CLASS_AVAILABLE(10_9, NA)
+            - key type for -setObject:forKeyedSubscript: is now NSObject <NSCopying> *
+        * API/JSContext.mm:
+        (-[JSContext initWithVirtualMachine:]):
+            - nil check [super init]
+        (+[JSContext currentArguments]):
+            - args -> argumentArray
+        (-[JSContext setObject:forKeyedSubscript:]):
+            - key type for -setObject:forKeyedSubscript: is now NSObject <NSCopying> *
+        (-[JSContext dealloc]):
+        (-[JSContext protect:]):
+        (-[JSContext unprotect:]):
+            - m_protected -> m_protectCounts
+        * API/JSValue.mm:
+        (-[JSValue toObjectOfClass:]):
+            - cls -> expectedClass
+        (-[JSValue toBool]):
+        (-[JSValue deleteProperty:]):
+        (-[JSValue hasProperty:]):
+        (-[JSValue isUndefined]):
+        (-[JSValue isNull]):
+        (-[JSValue isBoolean]):
+        (-[JSValue isNumber]):
+        (-[JSValue isString]):
+        (-[JSValue isObject]):
+        (-[JSValue isEqualToObject:]):
+        (-[JSValue isEqualWithTypeCoercionToObject:]):
+        (-[JSValue isInstanceOf:]):
+            - removed ? YES : NO
+        (-[JSValue callWithArguments:]):
+        (-[JSValue constructWithArguments:]):
+        (-[JSValue invokeMethod:withArguments:]):
+            - args -> argumentArray
+        (+[JSValue valueWithPoint:inContext:]):
+        (+[JSValue valueWithRange:inContext:]):
+        (+[JSValue valueWithRect:inContext:]):
+        (+[JSValue valueWithSize:inContext:]):
+            - [NSNumber numberWithFloat:] -> @()
+        (-[JSValue objectForKeyedSubscript:]):
+        (-[JSValue setObject:forKeyedSubscript:]):
+            - key type for -setObject:forKeyedSubscript: is now NSObject <NSCopying> *
+        (JSContainerConvertor):
+        (JSContainerConvertor::isWorkListEmpty):
+        (JSContainerConvertor::convert):
+        (ObjcContainerConvertor):
+        (ObjcContainerConvertor::isWorkListEmpty):
+            - remove WTF::
+            - isWorkListEmpty is const
+        (objectToValue):
+            -  use fast enumeration
+        (-[JSValue initWithValue:inContext:]):
+            - nil check [super init]
+        (getStructTagHandler):
+            - m_structHandlers -> structHandlers
+        * API/JSVirtualMachine.h:
+            - Add newline before NS_CLASS_AVAILABLE(10_9, NA)
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine init]):
+            - nil check [super init]
+        * API/JSWrapperMap.mm:
+        (selectorToPropertyName):
+        (copyPrototypeProperties):
+            - remove WTF::
+            - use static_cast
+        (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
+        (-[JSWrapperMap initWithContext:]):
+            - nil check [super init]
+        (-[JSWrapperMap wrapperForObject:]):
+        (tryUnwrapObjcObject):
+            - enable ASSERT
+        (getJSExportProtocol):
+        (getNSBlockClass):
+            - remove if check on initializing static
+        * API/JavaScriptCore.h:
+            - JS_OBJC_API_ENABLED no longer implies __OBJC__
+        * API/ObjCCallbackFunction.mm:
+        (CallbackArgumentOfClass):
+        (CallbackArgumentOfClass::~CallbackArgumentOfClass):
+        (CallbackArgumentStruct::CallbackArgumentStruct):
+        (CallbackArgumentStruct):
+        (CallbackArgumentBlockCallback):
+            - mark virtual functions as virtual, override, and private
+            - refactor out buffer allocation for struct types
+        (ArgumentTypeDelegate::typeVoid):
+        (ArgumentTypeDelegate::typeOfClass):
+        (ArgumentTypeDelegate::typeStruct):
+            - return nil -> return 0
+        (CallbackResultStruct::CallbackResultStruct):
+        (CallbackResultStruct):
+            - mark virtual functions as virtual, override, and private
+            - refactor out buffer allocation for struct types
+        (ResultTypeDelegate::typeStruct):
+            - return nil -> return 0
+        (ObjCCallbackFunction):
+            - remove WTF::
+        (objCCallbackFunctionFinalize):
+            - use static_cast
+        (objCCallbackFunctionCallAsFunction):
+            - Fix typos in comment
+        (createObjCCallbackFunctionClass):
+        (objCCallbackFunctionClass):
+            - Split out createObjCCallbackFunctionClass from objCCallbackFunctionClass
+        (ObjCCallbackFunction::call):
+            - ctx -> contextRef
+        (blockSignatureContainsClass):
+            - Remove tri-state enum.
+        (skipNumber):
+            - isdigit -> isASCIIDigit 
+        (objCCallbackFunctionForInvocation):
+            - clean up & comment blockSignatureContainsClass() usage
+        (tryUnwrapBlock):
+            - use static_cast
+        * API/ObjcRuntimeExtras.h:
+        (forEachProtocolImplementingProtocol):
+        (forEachMethodInClass):
+        (forEachMethodInProtocol):
+        (forEachPropertyInProtocol):
+            - Remove WTF::
+            - Remove if (count) checks
+        (skipPair):
+            - NSUInteger -> size_t
+        (StringRange):
+        (StringRange::operator const char*):
+        (StringRange::get):
+        (StructBuffer):
+        (StructBuffer::StructBuffer):
+        (StructBuffer::~StructBuffer):
+        (StructBuffer::operator void*):
+            - Added helper for creating an aligned buffer, used by struct conversion invocations.
+        (parseObjCType):
+            - *(position++) -> *position++
+        * API/tests/testapi.c:
+            - PLATFORM(MAC) -> JS_OBJC_API_ENABLED
+        * API/tests/testapi.m:
+        (blockSignatureContainsClass):
+            - Remove tri-state enum.
+        (testObjectiveCAPI):
+            - Added more result type checks.
+
+2013-01-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not use the InlineCallFrame's callee when it could have used the executable istead
+        https://bugs.webkit.org/show_bug.cgi?id=105947
+
+        Reviewed by Mark Hahnenberg.
+        
+        We shouldn't use the callee to get the executable when we have the executable already. Not only
+        does this make the logic more clear, but it also allows for a world where the executable is known
+        but the callee isn't.
+
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::strictModeFor):
+
+2013-01-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG inliner should not use the callee's bytecode variable for resolving references to the callee in inlined code
+        https://bugs.webkit.org/show_bug.cgi?id=105938
+
+        Reviewed by Mark Hahnenberg.
+        
+        This simplifies a bunch of code for referring to the callee. It also ought to simplify how we do
+        closure call inlining: for inlined closure call frames we will simply require that the callee is
+        already stashed on the stack in the Callee slot in the inline call frame header.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getDirect):
+        (JSC::DFG::ByteCodeParser::get):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+
+2013-01-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Another Windows port build fix attempt. Try not exporting this symbol from JSC
+        since it's also compiled in WebCore.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2013-01-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        One more unreviewed buildfix after r138609.
+
+        * jit/JITCall.cpp: Add a missing include.
+
+2013-01-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix after r138609.
+
+        * jit/JITCall32_64.cpp: Add a missing include.
+
+2013-01-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should have closure call caching
+        https://bugs.webkit.org/show_bug.cgi?id=105900
+
+        Reviewed by Gavin Barraclough.
+        
+        This is not a speed-up by itself, but is meant to allow the DFG inliner to
+        accurately discern between closure calls and non-closure calls, so that it can
+        do closure call inlining in the future.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::isClosureCall):
+        (CallLinkStatus):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkFor):
+        (JSC::JIT::linkSlowCall):
+        * jit/JIT.h:
+        (JSC::JIT::compileClosureCall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::linkClosureCallGenerator):
+        * jit/ThunkGenerators.h:
+
+2013-01-01  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/12942239> Update copyright strings
+
+        Reviewed by Sam Weinig.
+
+        * Info.plist:
+
+2012-12-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Objective-C API for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=105889
+
+        Reviewed by Filip Pizlo.
+
+        For a detailed description of the API implemented here, see:
+            JSContext.h
+            APIJSValue.h
+            JSVirtualMachine.h
+            JSExport.h
+        Still to do -
+            (1) Shoud rename APIJSValue.h -> JSValue.h (but we'll have to rename JSValue.h first).
+            (2) Numerous FIXMEs, all with separate bugs filed.
+
+        * API/APIJSValue.h: Added.
+            - this Objective-C class is used to reference a JavaScript object.
+        * API/JSBase.h:
+            - added JS_OBJC_API_ENABLED macro to control ObjC API support.
+        * API/JSBlockAdaptor.h: Added.
+            - this Objective-C class is used in creating a special NSBlock proxying a JavaScript function.
+        * API/JSBlockAdaptor.mm: Added.
+        (BlockArgument):
+        (BlockArgument::~BlockArgument):
+        (BlockArgumentBoolean):
+        (BlockArgumentBoolean::get):
+        (BlockArgumentNumeric):
+        (BlockArgumentNumeric::get):
+        (BlockArgumentId):
+        (BlockArgumentId::get):
+        (BlockArgumentStruct):
+        (BlockArgumentStruct::BlockArgumentStruct):
+        (BlockArgumentStruct::~BlockArgumentStruct):
+        (BlockArgumentStruct::get):
+            - decoded arguent type information of a JSBlockAdaptor.
+        (BlockArgumentTypeDelegate):
+        (BlockArgumentTypeDelegate::typeInteger):
+        (BlockArgumentTypeDelegate::typeDouble):
+        (BlockArgumentTypeDelegate::typeBool):
+        (BlockArgumentTypeDelegate::typeVoid):
+        (BlockArgumentTypeDelegate::typeId):
+        (BlockArgumentTypeDelegate::typeOfClass):
+        (BlockArgumentTypeDelegate::typeBlock):
+        (BlockArgumentTypeDelegate::typeStruct):
+            - delegate for use in conjunction with parseObjCType.
+        (BlockResult):
+        (BlockResult::~BlockResult):
+        (BlockResultVoid):
+        (BlockResultVoid::set):
+        (BlockResultInteger):
+        (BlockResultInteger::set):
+        (BlockResultDouble):
+        (BlockResultDouble::set):
+        (BlockResultBoolean):
+        (BlockResultBoolean::set):
+        (BlockResultStruct):
+        (BlockResultStruct::BlockResultStruct):
+        (BlockResultStruct::~BlockResultStruct):
+        (BlockResultStruct::set):
+            - decoded result type information of a JSBlockAdaptor.
+        (buildBlockSignature):
+            - partial step in constructing a signature with stack offset information from one without.
+        (-[JSBlockAdaptor initWithBlockSignatureFromProtocol:]):
+            - constructor.
+        (-[JSBlockAdaptor blockMatchesSignature:]):
+            - check whether signature strings match, where only one contains stack frame offsets.
+        (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
+            - use the adaptor to create a special forwarding block.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::inherits):
+            - add missing braces to multiline for statement.
+        * API/JSContext.h: Added.
+            - this Objective-C class is used to reference a JavaScript context.
+        * API/JSContext.mm: Added.
+        (-[JSContext init]):
+            - constructor.
+        (-[JSContext initWithVirtualMachine:]):
+            - construct in a given VM (JSGlobalData).
+        (-[JSContext evaluateScript:]):
+        (-[JSContext globalObject]):
+            - evaluate a script, global object accessor.
+        (+[JSContext currentContext]):
+        (+[JSContext currentThis]):
+        (+[JSContext currentArguments]):
+            - These methods obtain context, this, arguments from within a callback.
+        (-[JSContext virtualMachine]):
+            - implementation for .virtualMachine property.
+        (-[JSContext objectForKeyedSubscript:]):
+        (-[JSContext setObject:forKeyedSubscript:]):
+            - support for subscript property access.
+        (contextInternalContext):
+            - internal accessor to m_context.
+        (-[JSContext dealloc]):
+            - desctructor.
+        (-[JSContext notifyException:]):
+        (-[JSContext valueFromNotifyException:]):
+        (-[JSContext boolFromNotifyException:]):
+            - internal method to record an exception was thrown.
+        (-[JSContext beginCallbackWithData:thisValue:argumentCount:arguments:]):
+        (-[JSContext endCallbackWithData:]):
+            - internal methods to push/pop a callback record.
+        (-[JSContext protect:]):
+        (-[JSContext unprotect:]):
+            - internal methods to add a value to a protect set (used to protect the internal property of JSValue).
+        (-[JSContext wrapperForObject:]):
+            - internal method to create a wrapper object.
+        (WeakContextRef::WeakContextRef):
+        (WeakContextRef::~WeakContextRef):
+        (WeakContextRef::get):
+        (WeakContextRef::set):
+            - Helper class to implement a weak reference to a JSContext.
+        * API/JSContextInternal.h: Added.
+        (CallbackData):
+        (WeakContextRef):
+            - see API/JSContext.mm for description of internal methods.
+        * API/JSExport.h: Added.
+            - Provides JSExport protocol & JSExportAs macro.
+        * API/JSValue.mm: Added.
+        (+[JSValue valueWithObject:inContext:]):
+        (+[JSValue valueWithBool:inContext:]):
+        (+[JSValue valueWithDouble:inContext:]):
+        (+[JSValue valueWithInt32:inContext:]):
+        (+[JSValue valueWithUInt32:inContext:]):
+        (+[JSValue valueWithNewObjectInContext:]):
+        (+[JSValue valueWithNewArrayInContext:]):
+        (+[JSValue valueWithNewRegularExpressionFromPattern:flags:inContext:]):
+        (+[JSValue valueWithNewErrorFromMessage:inContext:]):
+        (+[JSValue valueWithNullInContext:]):
+        (+[JSValue valueWithUndefinedInContext:]):
+            - Constructors.
+        (-[JSValue toObject]):
+        (-[JSValue toObjectOfClass:]):
+        (-[JSValue toBool]):
+        (-[JSValue toDouble]):
+        (-[JSValue toInt32]):
+        (-[JSValue toUInt32]):
+        (-[JSValue toNumber]):
+        (-[JSValue toString]):
+        (-[JSValue toDate]):
+        (-[JSValue toArray]):
+        (-[JSValue toDictionary]):
+            - Conversion to Objective-C types.
+        (-[JSValue valueForProperty:]):
+        (-[JSValue setValue:forProperty:]):
+        (-[JSValue deleteProperty:]):
+        (-[JSValue hasProperty:]):
+        (-[JSValue defineProperty:descriptor:]):
+            - Property access by property name.
+        (-[JSValue valueAtIndex:]):
+        (-[JSValue setValue:atIndex:]):
+            - Property access by index.
+        (-[JSValue isUndefined]):
+        (-[JSValue isNull]):
+        (-[JSValue isBoolean]):
+        (-[JSValue isNumber]):
+        (-[JSValue isString]):
+        (-[JSValue isObject]):
+            - Test JavaScript type.
+        (-[JSValue isEqualToObject:]):
+        (-[JSValue isEqualWithTypeCoercionToObject:]):
+        (-[JSValue isInstanceOf:]):
+            - ===, ==, instanceof operators.
+        (-[JSValue callWithArguments:]):
+        (-[JSValue constructWithArguments:]):
+        (-[JSValue invokeMethod:withArguments:]):
+            - Call & construct.
+        (-[JSValue context]):
+            - implementation for .context property.
+        (-[JSValue toPoint]):
+        (-[JSValue toRange]):
+        (-[JSValue toRect]):
+        (-[JSValue toSize]):
+        (+[JSValue valueWithPoint:inContext:]):
+        (+[JSValue valueWithRange:inContext:]):
+        (+[JSValue valueWithRect:inContext:]):
+        (+[JSValue valueWithSize:inContext:]):
+            - Support for NS struct types.
+        (-[JSValue objectForKeyedSubscript:]):
+        (-[JSValue objectAtIndexedSubscript:]):
+        (-[JSValue setObject:forKeyedSubscript:]):
+        (-[JSValue setObject:atIndexedSubscript:]):
+            - support for subscript property access.
+        (isDate):
+        (isArray):
+            - internal helper functions to check for instances of JS Date, Array types.
+        (JSContainerConvertor):
+        (Task):
+        (JSContainerConvertor::JSContainerConvertor):
+        (JSContainerConvertor::isWorkListEmpty):
+        (JSContainerConvertor::convert):
+        (JSContainerConvertor::add):
+        (JSContainerConvertor::take):
+            - helper class for tracking state while converting to Array/Dictionary objects.
+        (valueToObjectWithoutCopy):
+        (containerValueToObject):
+        (valueToObject):
+        (valueToNumber):
+        (valueToString):
+        (valueToDate):
+        (valueToArray):
+        (valueToDictionary):
+            - function for converting JavaScript values to Objective-C objects.
+        (ObjcContainerConvertor):
+        (ObjcContainerConvertor::ObjcContainerConvertor):
+        (ObjcContainerConvertor::isWorkListEmpty):
+        (ObjcContainerConvertor::convert):
+        (ObjcContainerConvertor::add):
+        (ObjcContainerConvertor::take):
+            - helper class for tracking state while converting to Array/Dictionary values.
+        (objectToValueWithoutCopy):
+        (objectToValue):
+        (valueInternalValue):
+            - function for converting Objective-C objects to JavaScript values.
+        (+[JSValue valueWithValue:inContext:]):
+        (-[JSValue initWithValue:inContext:]):
+            - internal constructors.
+        (StructTagHandler):
+        (getStructTagHandler):
+        (+[JSValue selectorForStructToValue:]):
+        (+[JSValue selectorForValueToStruct:]):
+            - methods to tracking struct types that support conversion to/from JSValue.
+        (-[JSValue dealloc]):
+            - destructor.
+        (-[JSValue description]):
+            - Objective-C to-NSString conversion.
+        (typeToValueInvocationFor):
+        (valueToTypeInvocationFor):
+            - create invocation objects for conversion to/from JSValue.
+        * API/JSValueInternal.h: Added.
+            - see API/JSValue.mm for description of internal methods.
+        * API/JSVirtualMachine.h: Added.
+            - this Objective-C class is used to reference a JavaScript virtual machine (JSGlobalData).
+        * API/JSVirtualMachine.mm: Added.
+        (-[JSVirtualMachine init]):
+        (-[JSVirtualMachine dealloc]):
+            - constructor & destructor.
+        (getGroupFromVirtualMachine):
+            - internal accessor for m_group property.
+        * API/JSVirtualMachineInternal.h: Added.
+            - see API/JSVirtualMachine.mm for description of internal methods.
+        * API/JSWrapperMap.h: Added.
+        * API/JSWrapperMap.mm: Added.
+        (wrapperClass):
+            - singleton root for detction (& unwrapping) of wrapper objects.
+        (selectorToPropertyName):
+            - default selector to property name conversion.
+        (createObjectWithCustomBrand):
+            - creates a JSObject with a custom NativeBrand (class name).
+        (createRenameMap):
+            - parse @optional properties of a JSExport protocol.
+        (putNonEnumerable):
+            - property put with enumerable=false.
+        (copyMethodsToObject):
+            - iterate methods in a protocol; add functions to a JSObject.
+        (parsePropertyAttributes):
+            - examine protocol property metadata.
+        (makeSetterName):
+            - "foo" -> "setFoo"
+        (copyPrototypeProperties):
+            - create properties on a Protocol object reflecting the instance methods & properties of a protocol.
+        (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
+        (-[JSObjCClassInfo dealloc]):
+        (-[JSObjCClassInfo wrapperForObject:]):
+        (-[JSObjCClassInfo constructor]):
+            - cache the Protocol/Constructor objects for an Objective-C type.
+        (-[JSWrapperMap initWithContext:]):
+        (-[JSWrapperMap dealloc]):
+            - constructor & desctructor.
+        (-[JSWrapperMap classInfoForClass:]):
+            - maps Class -> JSObjCClassInfo.
+        (-[JSWrapperMap wrapperForObject:]):
+            - cretae or retrieve a cached wrapper value for an object.
+        (tryUnwrapObjcObject):
+            - check whether a value is a wrapper object; unwrap if so.
+        * API/JavaScriptCore.h:
+            - Added includes for new API headers.
+        * API/ObjCCallbackFunction.h: Added.
+            - this class is used to wrap Objective-C instance methods, class methods & blocks as JSFunction objects.
+        * API/ObjCCallbackFunction.mm: Added.
+        (CallbackArgument):
+        (CallbackArgument::~CallbackArgument):
+        (CallbackArgumentBoolean):
+        (CallbackArgumentBoolean::set):
+        (CallbackArgumentInteger):
+        (CallbackArgumentInteger::set):
+        (CallbackArgumentDouble):
+        (CallbackArgumentDouble::set):
+        (CallbackArgumentJSValue):
+        (CallbackArgumentJSValue::set):
+        (CallbackArgumentId):
+        (CallbackArgumentId::set):
+        (CallbackArgumentOfClass):
+        (CallbackArgumentOfClass::CallbackArgumentOfClass):
+        (CallbackArgumentOfClass::~CallbackArgumentOfClass):
+        (CallbackArgumentOfClass::set):
+        (CallbackArgumentNSNumber):
+        (CallbackArgumentNSNumber::set):
+        (CallbackArgumentNSString):
+        (CallbackArgumentNSString::set):
+        (CallbackArgumentNSDate):
+        (CallbackArgumentNSDate::set):
+        (CallbackArgumentNSArray):
+        (CallbackArgumentNSArray::set):
+        (CallbackArgumentNSDictionary):
+        (CallbackArgumentNSDictionary::set):
+        (CallbackArgumentStruct):
+        (CallbackArgumentStruct::CallbackArgumentStruct):
+        (CallbackArgumentStruct::~CallbackArgumentStruct):
+        (CallbackArgumentStruct::set):
+        (CallbackArgumentBlockCallback):
+        (CallbackArgumentBlockCallback::CallbackArgumentBlockCallback):
+        (CallbackArgumentBlockCallback::~CallbackArgumentBlockCallback):
+        (CallbackArgumentBlockCallback::set):
+            - decoded arguent type information of a ObjCCallbackFunction.
+        (ArgumentTypeDelegate):
+        (ArgumentTypeDelegate::typeInteger):
+        (ArgumentTypeDelegate::typeDouble):
+        (ArgumentTypeDelegate::typeBool):
+        (ArgumentTypeDelegate::typeVoid):
+        (ArgumentTypeDelegate::typeId):
+        (ArgumentTypeDelegate::typeOfClass):
+        (ArgumentTypeDelegate::typeBlock):
+        (ArgumentTypeDelegate::typeStruct):
+            - delegate for use in conjunction with parseObjCType.
+        (CallbackResult):
+        (CallbackResult::~CallbackResult):
+        (CallbackResultVoid):
+        (CallbackResultVoid::get):
+        (CallbackResultId):
+        (CallbackResultId::get):
+        (CallbackResultNumeric):
+        (CallbackResultNumeric::get):
+        (CallbackResultBoolean):
+        (CallbackResultBoolean::get):
+        (CallbackResultStruct):
+        (CallbackResultStruct::CallbackResultStruct):
+        (CallbackResultStruct::~CallbackResultStruct):
+        (CallbackResultStruct::get):
+            - decoded result type information of a ObjCCallbackFunction.
+        (ResultTypeDelegate):
+        (ResultTypeDelegate::typeInteger):
+        (ResultTypeDelegate::typeDouble):
+        (ResultTypeDelegate::typeBool):
+        (ResultTypeDelegate::typeVoid):
+        (ResultTypeDelegate::typeId):
+        (ResultTypeDelegate::typeOfClass):
+        (ResultTypeDelegate::typeBlock):
+        (ResultTypeDelegate::typeStruct):
+            - delegate for use in conjunction with parseObjCType.
+        (ObjCCallbackFunction):
+        (ObjCCallbackFunction::ObjCCallbackFunction):
+        (ObjCCallbackFunction::~ObjCCallbackFunction):
+            - constructor & destructor.
+        (ObjCCallbackFunction::context):
+            - accessor.
+        (ObjCCallbackFunction::wrappedBlock):
+            - attemmpt to unwrap a block object.
+        (objCCallbackFunctionFinalize):
+        (objCCallbackFunctionCallAsFunction):
+        (objCCallbackFunctionClass):
+            - JSClassRef used to represent ObjCCallbackFunction objects.
+        (ObjCCallbackFunction::call):
+        (blockSignatureContainsClass):
+            - helper function to determine if we're running on a recent Clang.
+        (skipNumber):
+            - helper used in parsing signature strings.
+        (objCCallbackFunctionForInvocation):
+        (objCCallbackFunctionForMethod):
+        (objCCallbackFunctionForBlock):
+            - functions to try to create ObjCCallbackFunction instances for methods/blocks.
+        (tryUnwrapBlock):
+            - attemmpt to unwrap a block object.
+        * API/ObjcRuntimeExtras.h: Added.
+        (protocolImplementsProtocol):
+        (forEachProtocolImplementingProtocol):
+        (forEachMethodInClass):
+        (forEachMethodInProtocol):
+        (forEachPropertyInProtocol):
+            - functions used in reflecting on Objective-C types.
+        (skipPair):
+            - parsing helper used by parseObjCType, scans for matching parentheses.
+        (StringRange):
+        (StringRange::StringRange):
+        (StringRange::~StringRange):
+        (StringRange::operator const char*):
+        (StringRange::get):
+            - Helper class - create a c string copy of a range of an existing string.
+        (parseObjCType):
+            - function to parse Objective-C type strings, makes callbacks to a deleagte.
+        * API/tests/testapi.c:
+        (main):
+            - added call to testObjectiveCAPI (in testapi.m).
+        * API/tests/testapi.m: Added.
+        (+[ParentObject parentTest]):
+        (+[TestObject testObject]):
+        (+[TestObject classTest]):
+        (-[TestObject getString]):
+        (-[TestObject testArgumentTypesWithInt:double:boolean:string:number:array:dictionary:]):
+        (-[TestObject callback:]):
+        (-[TextXYZ test:]):
+            - test object, used in various test vases.
+        (checkResult):
+            - helper function.
+        (blockSignatureContainsClass):
+            - helper function to determine if we're running on a recent Clang.
+        (testObjectiveCAPI):
+            - new test cases.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - added new files.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+            - added m_apiData - provide convenient storage for use by the API.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+            - added m_apiData - provide convenient storage for use by the API.
+
+2012-12-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        One more unreviwed holiday MIPS and SH4 buildfixes after r138516.
+
+        * jit/ThunkGenerators.cpp:
+
+2012-12-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviwed holiday ARM and SH4 buildfixes after r138516.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+
+2012-12-26  Filip Pizlo  <fpizlo@apple.com>
+
+        All JIT stubs should go through the getCTIStub API
+        https://bugs.webkit.org/show_bug.cgi?id=105750
+
+        Reviewed by Sam Weinig.
+        
+        Previously JITThunks had two sets of thunks: one static set stored in a struct,
+        which was filled by JIT::privateCompileCTITrampolines, and another set stored in
+        a HashMap. Moreover, the code to generate the code for the CTI trampoline struct
+        had loads of copy-paste between JSVALUE32_64 and JSVALUE64, and was total
+        unmodular with respect to calls versus constructors, among other things.
+                  
+        This changeset removes this struct and rationalizes the code that generates those
+        thunks. All of thunks are now generated through the getCTIStub HashMap API. All
+        thunks for the baseline JIT now use the JSInterfaceJIT and have their codegen
+        located in ThunkGenerators.cpp. All thunks now share as much code as possible -
+        it turns out that they are almost 100% identical between 32_64 and 64, so that
+        works out great. A bunch of call vs. construct duplication was eliminated. And,
+        most of the call link versus virtual call duplication was also eliminated.
+        
+        This does not change behavior but it does make it easier to add more thunks in
+        the future.
+
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkFor):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlines.h:
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC):
+        * jit/JITStubs.cpp:
+        (JSC::tryCacheGetByID):
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::ctiNativeCall):
+        (JSC::JITThunks::ctiNativeConstruct):
+        (JSC):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+        (JSC):
+        (JITThunks):
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+        (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
+        (JSC):
+        (JSC::JSInterfaceJIT::emitFastArithIntToImmNoCheck):
+        (JSC::JSInterfaceJIT::emitJumpIfNotType):
+        (JSC::JSInterfaceJIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JSInterfaceJIT::emitPutToCallFrameHeader):
+        (JSC::JSInterfaceJIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JSInterfaceJIT::emitPutCellToCallFrameHeader):
+        (JSC::JSInterfaceJIT::preserveReturnAddressAfterCall):
+        (JSC::JSInterfaceJIT::restoreReturnAddressBeforeReturn):
+        (JSC::JSInterfaceJIT::restoreArgumentReference):
+        * jit/ThunkGenerators.cpp:
+        (JSC::generateSlowCaseFor):
+        (JSC):
+        (JSC::linkForGenerator):
+        (JSC::linkCallGenerator):
+        (JSC::linkConstructGenerator):
+        (JSC::virtualForGenerator):
+        (JSC::virtualCallGenerator):
+        (JSC::virtualConstructGenerator):
+        (JSC::stringLengthTrampolineGenerator):
+        (JSC::nativeForGenerator):
+        (JSC::nativeCallGenerator):
+        (JSC::nativeConstructGenerator):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        * jit/ThunkGenerators.h:
+        (JSC):
+        * runtime/Executable.h:
+        (NativeExecutable):
+        (JSC::NativeExecutable::nativeFunctionFor):
+        (JSC::NativeExecutable::offsetOfNativeFunctionFor):
+
+2012-12-25  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE] Remove header files in JavaScriptCore/CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=105753
+
+        Reviewed by Laszlo Gombos.
+
+        * CMakeLists.txt: Remove header files in source list.
+
+2012-12-25  Filip Pizlo  <fpizlo@apple.com>
+
+        JITThunks should be in its own file
+        https://bugs.webkit.org/show_bug.cgi?id=105744
+
+        Rubber stamped by Sam Weinig.
+        
+        Moved JITThunks into its own file and removed some static methods from it
+        that were not related to what JITThunks currently does. Performed various
+        pagan rituals to get it to build - apparently there is a circular dependency
+        between JSCell, Weak, and JITThunks, which magically resolves itself if you
+        make sure to first include Register.h. Making it so that fewer pagan rituals
+        need to be performed if this code changes in the future is covered by
+        https://bugs.webkit.org/show_bug.cgi?id=105696.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * jit/JITStubs.cpp:
+        (JSC::tryCachePutByID):
+        (JSC::tryCacheGetByID):
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+        (JSC::returnAddressIsInCtiTrampoline):
+        * jit/JITThunks.cpp: Added.
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::~JITThunks):
+        (JSC::JITThunks::ctiStub):
+        (JSC::JITThunks::hostFunctionStub):
+        (JSC::JITThunks::clearHostFunctionStubs):
+        * jit/JITThunks.h: Added.
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualConstructLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiVirtualConstruct):
+        (JSC::JITThunks::ctiNativeCall):
+        (JSC::JITThunks::ctiNativeConstruct):
+        * jit/ThunkGenerator.h: Added.
+        * jit/ThunkGenerators.cpp:
+        * jit/ThunkGenerators.h:
+        * runtime/JSGlobalData.h:
+
+2012-12-25  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed follow-up for r138455.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-12-24  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed compilation fix for r138452.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-12-24  Laszlo Gombos  <l.gombos@samsung.com>
+
+        Remove wtf/Platform.h includes from {c|cpp} files
+        https://bugs.webkit.org/show_bug.cgi?id=105678
+
+        Reviewed by Kentaro Hara.
+
+        Remove wtf/Platform.h from the include list as it is already
+        included in config.h.
+
+        * disassembler/udis86/udis86.c:
+        * disassembler/udis86/udis86_decode.c:
+        * disassembler/udis86/udis86_input.c:
+        * disassembler/udis86/udis86_itab_holder.c:
+        * disassembler/udis86/udis86_syn-att.c:
+        * disassembler/udis86/udis86_syn-intel.c:
+        * disassembler/udis86/udis86_syn.c:
+        * heap/VTableSpectrum.cpp:
+
+2012-12-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Arrayify slow path should be out-of-line
+        https://bugs.webkit.org/show_bug.cgi?id=105400
+
+        Reviewed by Gavin Barraclough.
+        
+        The interesting bit of this change is allowing out-of-line slow path generators
+        to emit speculation checks. This is accomplished by having a version of
+        speculationCheck() that returns a jump placeholder instead of taking a jump (or
+        jump list) as an argument. You can then fill in that jump placeholder at a
+        later time, so long as you do it before OSR exit linking. Slow path generators
+        run before linking, so that just naturally ends up working.
+        
+        This isn't really a big win, but we know that out-of-lining slow paths is
+        generally a good thing to do, so it's fair to assume that this is a move in the
+        right direction.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGArrayifySlowPathGenerator.h: Added.
+        (DFG):
+        (ArrayifySlowPathGenerator):
+        (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
+        (JSC::DFG::ArrayifySlowPathGenerator::generateInternal):
+        * dfg/DFGOSRExitJumpPlaceholder.cpp: Added.
+        (DFG):
+        (JSC::DFG::OSRExitJumpPlaceholder::fill):
+        * dfg/DFGOSRExitJumpPlaceholder.h: Added.
+        (DFG):
+        (OSRExitJumpPlaceholder):
+        (JSC::DFG::OSRExitJumpPlaceholder::OSRExitJumpPlaceholder):
+        (JSC::DFG::OSRExitJumpPlaceholder::operator!):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2012-12-20  Oliver Hunt  <oliver@apple.com>
+
+        Finally found the problem.  Using the wrong JSContextGroup.
+
+        * API/tests/testapi.c:
+        (main):
+
+2012-12-20  Oliver Hunt  <oliver@apple.com>
+
+        Try to convince bots to be happy with testapi.
+
+        * API/JSScriptRefPrivate.h:
+
+2012-12-20  Michael Saboff  <msaboff@apple.com>
+
+        JIT: Change uninitialized pointer value -1 to constant
+        https://bugs.webkit.org/show_bug.cgi?id=105576
+
+        Rubber stamped by Gavin Barraclough.
+
+        Changed the use of -1 as a pointer value in the JITs to be the constant unusedPointer defined in the
+        new file jit/UnusedPointer.h.  Made it's value 0xd1e7beef, which is a bad pointer on most architectures
+        because it is odd, and to distinguish it from other common values.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::resetPatchGetById):
+        (JSC::JIT::resetPatchPutById):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::resetPatchGetById):
+        (JSC::JIT::resetPatchPutById):
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrierBase::clearToUnusedPointer):
+        (JSC::JITWriteBarrierBase::get):
+        * jit/UnusedPointer.h: Added.
+
+2012-12-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG shouldn't emit CheckStructure on array accesses if exit profiling tells it not to
+        https://bugs.webkit.org/show_bug.cgi?id=105577
+
+        Reviewed by Mark Hahnenberg.
+        
+        I don't know why this wasn't there from the beginning.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+
+2012-12-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG speculation checks that take JumpList should consolidate OSRExits
+        https://bugs.webkit.org/show_bug.cgi?id=105401
+
+        Reviewed by Oliver Hunt.
+
+        Change OSRExitCompilationInfo to always contain a JumpList, and change JumpList
+        to be more compact. This way, a speculationCheck that takes a JumpList only has
+        to emit one OSRExit structure, and one OSRExit landing pad.
+        
+        The downside is that we get less precise information about *where* we exited
+        from. So, this also includes changes to the profiler to be more relaxed about
+        what an ExitSite is.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JumpList):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (DFG):
+        (JSC::DFG::JITCompiler::appendExitInfo):
+        (JITCompiler):
+        * dfg/DFGOSRExitCompilationInfo.h:
+        (OSRExitCompilationInfo):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::addOSRExitSite):
+        * profiler/ProfilerCompilation.h:
+        (Compilation):
+        * profiler/ProfilerOSRExitSite.cpp:
+        (JSC::Profiler::OSRExitSite::toJS):
+        * profiler/ProfilerOSRExitSite.h:
+        (JSC::Profiler::OSRExitSite::OSRExitSite):
+        (JSC::Profiler::OSRExitSite::codeAddress):
+        (OSRExitSite):
+
+2012-12-19  Oliver Hunt  <oliver@apple.com>
+
+        Fix some incorrect tests in testapi.c
+
+        Reviewed by Simon Fraser.
+
+        * API/tests/testapi.c:
+        (main):
+
+2012-12-19  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject::ensure<IndexingType> should gracefully handle InterceptsGetOwn..., and should never be called when the 'this' is not an object
+        https://bugs.webkit.org/show_bug.cgi?id=105468
+
+        Reviewed by Mark Hahnenberg, Oliver Hunt, and Gavin Barraclough.
+
+        Changed JSObject::ensure<IndexingType> methods to gracefully handle
+        InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero. Most of them handle it by returning
+        null as a result of indexingShouldBeSparse() returning true, while ensureArrayStorage handles it
+        by entering dictionary indexing mode, which forces the object to behave correctly even if there
+        is proxying or weird prototype stuff going on.
+        
+        Changed DFGOperations entrypoints to reject non-objects, so that JSObject doesn't have to deal
+        with pretending to be JSString. In particular, this would go wrong in the ArrayStorage case
+        since we'd try to resize a butterfly on a JSString, but JSString has something other than
+        m_butterfly at that offset.
+        
+        Finally, removed all InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero from JIT code
+        since those are now redundant.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::ensureInt32Slow):
+        (JSC::JSObject::ensureDoubleSlow):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        * runtime/JSObject.h:
+        (JSObject):
+
+2012-12-19  Oliver Hunt  <oliver@apple.com>
+
+        Tidy up JSScriptRef API
+        https://bugs.webkit.org/show_bug.cgi?id=105470
+
+        Reviewed by Anders Carlsson.
+
+        People found the API's use of a context confusing, so we'll switch to a JSContextGroup based
+        API, and drop a number of the unnecessary uses of contexts.
+
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::globalData):
+        (parseScript):
+        * API/JSScriptRefPrivate.h:
+        * API/tests/testapi.c:
+        (main):
+
+2012-12-19  Alexis Menard  <alexis@webkit.org>
+
+        Implement CSS parsing for CSS transitions unprefixed.
+        https://bugs.webkit.org/show_bug.cgi?id=104804
+
+        Reviewed by Dean Jackson.
+
+        Add a new flag ENABLE_CSS_TRANSFORMS_ANIMATIONS_TRANSITIONS_UNPREFIXED
+        to cover the work of unprefixing Transforms, Animations and 
+        Transitions. It will let the possibility of each ports to turn it off 
+        in their release branches until we're confident that these CSS 
+        properties are ready to be unprefixed.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-12-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Proxies should set InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero
+        https://bugs.webkit.org/show_bug.cgi?id=105379
+
+        Reviewed by Gavin Barraclough.
+
+        Forgetting to set this flag led to the DFG trying to ensure array storage on a proxy. I've
+        now hardened the code with a release assertion as well as fixing the bug. A release assertion
+        is appropriate here since this is slow-path code.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::ensureInt32Slow):
+        (JSC::JSObject::ensureDoubleSlow):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::ensureArrayStorageSlowNoCheck):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        * runtime/JSObject.h:
+        (JSObject):
+        * runtime/JSProxy.h:
+        (JSProxy):
+
+2012-12-18  Oliver Hunt  <oliver@apple.com>
+
+        Add a JSScriptRef API to JSC so that we can allow API users to avoid the full cost of reparsing everytime the execute a script.
+        https://bugs.webkit.org/show_bug.cgi?id=105340
+
+        Reviewed by Gavin Barraclough.
+
+        This patch adds a (currently private) API to allow users of the JSC API to create a JSScript object
+        that references a reusable version of the script that they wish to evaluate.  This can help us avoid
+        numeorus copies that are otherwise induced by our existing API and gives us an opaque object that we
+        can hang various caches off.  Currently this is simply a simple SourceProvider, but in future we may
+        be able to add more caching without requiring new/replacement APIs. 
+
+        * API/JSScriptRef.cpp: Added.
+        * API/JSScriptRefPrivate.h: Added.
+        * API/tests/testapi.c:
+          Add tests for new APIs.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-12-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode incorrectly checks for non-array array storage when it should be checking for array array storage
+        https://bugs.webkit.org/show_bug.cgi?id=105365
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+
+2012-12-18  Filip Pizlo  <fpizlo@apple.com>
+
+        SunSpider/date-format-tofte shouldn't compile each of the tiny worthless eval's only to OSR exit in the prologue every time
+        https://bugs.webkit.org/show_bug.cgi?id=105335
+
+        Reviewed by Geoffrey Garen.
+
+        The first thing I did was restructure the logic of canInlineResolveOperations(),
+        because I didn't understand it. This was relevant because the OSR exits are
+        caused by a resolve that the DFG cannot handle.
+        
+        I was then going to make it so that we didn't compile the resolve at all, but
+        realized that this would not be the best fix: it didn't seem sensible to me to
+        be optimizing these evals after only 60 invocations. Evals should have a higher
+        threshold, since they often contain code for which the baseline JIT does a
+        pretty good job already (if all you've got is a single heap access or a single
+        hard-to-inline call, then the baseline JIT has got you covered), and typically
+        if we see one eval code block we expect to see more (from the same eval site):
+        so our typical low threshold could lead to a *lot* of compilation. As such, the
+        main effect of this patch is to introduce an evalThresholdMultiplier, which is
+        now set to 10.
+        
+        This is a ~5% speed-up on data-format-tofte. No regressions anywhere as far as
+        I can see.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::codeTypeThresholdMultiplier):
+        (JSC):
+        (JSC::CodeBlock::optimizationThresholdScalingFactor):
+        (JSC::CodeBlock::exitCountThresholdForReoptimization):
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineResolveOperations):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * runtime/Options.h:
+        (JSC):
+
+2012-12-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Convert indexingTypeToString to IndexingTypeDump
+        https://bugs.webkit.org/show_bug.cgi?id=105351
+
+        Reviewed by Mark Hahnenberg.
+
+        This gets rid of another case of static char buffer[thingy].
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * runtime/IndexingType.cpp:
+        (JSC::dumpIndexingType):
+        * runtime/IndexingType.h:
+        (JSC):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::dump):
+
+2012-12-18  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=102579
+        [mac] Enable scaled cursors
+
+        Reviewed by Dean Jackson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-12-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Restrictions on oversize CopiedBlock allocations should be relaxed
+        https://bugs.webkit.org/show_bug.cgi?id=105339
+
+        Reviewed by Filip Pizlo.
+
+        Currently the DFG has a single branch in the inline allocation path for property/array storage where 
+        it checks to see if the number of bytes requested will fit in the current block. This does not match 
+        what the C++ allocation path does; it checks if the requested number of bytes is oversize, and then 
+        if it's not, it tries to fit it in the current block. The garbage collector assumes that ALL allocations 
+        that are greater than 16KB are in oversize blocks. Therefore, this mismatch can lead to crashes when 
+        the collector tries to perform some operation on a CopiedBlock.
+
+        To avoid adding an extra branch to the inline allocation path in the JIT, we should make it so that 
+        oversize blocks are allocated on the same alignment boundaries so that there is a single mask to find 
+        the block header of any CopiedBlock (rather than two, one for normal and one for oversize blocks), and 
+        we should figure out if a block is oversize by some other method than just whatever the JSObject says 
+        it is. One way we could record this info Region of the block, since we allocate a one-off Region for 
+        oversize blocks.
+
+        * heap/BlockAllocator.h:
+        (JSC::Region::isCustomSize): 
+        (Region):
+        (JSC::Region::createCustomSize):
+        (JSC::Region::Region):
+        (JSC::BlockAllocator::deallocateCustomSize):
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+        (JSC::CopiedBlock::isOversize): 
+        (JSC):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocate):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        * heap/CopiedSpace.h:
+        (CopiedSpace): 
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::contains):
+        (JSC::CopiedSpace::tryAllocate):
+        (JSC):
+        * heap/CopyVisitor.h:
+        (CopyVisitor):
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::checkIfShouldCopy):
+        (JSC::CopyVisitor::didCopy):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+
+2012-12-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Add Build Phase to Check Headers for Inappropriate Macros (Platform.h macros)
+        https://bugs.webkit.org/show_bug.cgi?id=104279
+
+        Reviewed by David Kilzer.
+
+        Add a build phase to check the public JavaScriptCore headers for
+        inappropriate macros.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-12-18  Michael Saboff  <msaboff@apple.com>
+
+        [Qt] Fix the ARMv7 build after r137976
+        https://bugs.webkit.org/show_bug.cgi?id=105270
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add default value for Jump parameter to fix build.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+
+2012-12-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Constant fold !{number} in the parser
+        https://bugs.webkit.org/show_bug.cgi?id=105232
+
+        Reviewed by Filip Pizlo.
+
+        Typically, we wait for hot execution and constant fold in the DFG.
+        However, !0 and !1 are common enough in minifiers that it can be good
+        to get them out of the way early, for faster/smaller parsing and startup.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createLogicalNot): !{literal} is super simple, especially
+        since there's no literal form of NaN or Inf.
+
+2012-12-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG is too aggressive eliding overflow checks for additions involving large constants
+        https://bugs.webkit.org/show_bug.cgi?id=105239
+
+        Reviewed by Gavin Barraclough.
+
+        If we elide overflow checks on an addition (or subtraction) involving a larger-than-2^32 immediate,
+        then make sure that the non-constant child of the addition knows that he's got to do an overflow
+        check, by flowing the UsedAsNumber property at him.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addSpeculationMode):
+        (Graph):
+        (JSC::DFG::Graph::addShouldSpeculateInteger):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2012-12-17  Michael Saboff  <msaboff@apple.com>
+
+        DFG: Refactor DFGCorrectableJumpPoint to reduce size of OSRExit data
+        https://bugs.webkit.org/show_bug.cgi?id=105237
+
+        Reviewed by Filip Pizlo.
+
+        Replaced DFGCorrectableJumpPoint with OSRExitCompilationInfo which is used and kept alive only while we are
+        compiling in the DFG.  Moved the patchable branch offset directly into OSRExit.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/AbstractMacroAssembler.h:
+        * dfg/DFGCorrectableJumpPoint.cpp: Removed.
+        * dfg/DFGCorrectableJumpPoint.h: Removed.
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::appendExitJump):
+        (JITCompiler):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::setPatchableCodeOffset):
+        (JSC::DFG::OSRExit::getPatchableCodeOffsetAsJump):
+        (JSC::DFG::OSRExit::codeLocationForRepatch):
+        (JSC::DFG::OSRExit::correctJump):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompilationInfo.h: Added.
+        (OSRExitCompilationInfo):
+        (JSC::DFG::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        (JSC::DFG::OSRExitCompilationInfo::failureJump):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+
+2012-12-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG is too aggressive with eliding overflow checks in loops
+        https://bugs.webkit.org/show_bug.cgi?id=105226
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+
+        If we see a variable's live range cross basic block boundaries, conservatively assume that it may
+        be part of a data-flow back-edge, and as a result, we may have entirely integer operations that
+        could lead to the creation of an integer that is out of range of 2^52 (the significand of a double
+        float). This does not seem to regress any of the benchmarks we care about, and it fixes the bug.
+        
+        In future we may want to actually look at whether or not there was a data-flow back-edge instead
+        of being super conservative about it. But we have no evidence, yet, that this would help us on
+        real code.
+
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2012-12-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Butterfly::growArrayRight shouldn't be called on null Butterfly objects
+        https://bugs.webkit.org/show_bug.cgi?id=105221
+
+        Reviewed by Filip Pizlo.
+
+        Currently we depend upon the fact that Butterfly::growArrayRight works with null Butterfly 
+        objects purely by coincidence. We should add a new static function that null checks the old 
+        Butterfly object and creates a new one if it's null, or calls growArrayRight if it isn't for 
+        use in the couple of places in JSObject that expect such behavior to work.
+
+        * runtime/Butterfly.h:
+        (Butterfly):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::createOrGrowArrayRight):
+        (JSC):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createArrayStorage):
+
+2012-12-17  Filip Pizlo  <fpizlo@apple.com>
+
+        javascript integer overflow
+        https://bugs.webkit.org/show_bug.cgi?id=104967
+
+        Reviewed by Mark Hahnenberg.
+
+        Fix PutScopedVar backward flow.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2012-12-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize array profiling for out-of-bounds and hole cases
+        https://bugs.webkit.org/show_bug.cgi?id=105139
+
+        Reviewed by Geoffrey Garen.
+
+        This makes ArrayProfile track whether or not we had out-of-bounds, which allows
+        for more precise decision-making in the DFG.
+        
+        Also cleaned up ExitKinds for out-of-bounds and hole cases to make it easier to
+        look at them in the profiler.
+        
+        Slight speed-up (5-8%) on SunSpider/crypto-md5.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        (JSC::ArrayProfile::briefDescription):
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::ArrayProfile):
+        (JSC::ArrayProfile::addressOfOutOfBounds):
+        (JSC::ArrayProfile::expectedStructure):
+        (JSC::ArrayProfile::structureIsPolymorphic):
+        (JSC::ArrayProfile::outOfBounds):
+        (JSC::ArrayProfile::polymorphicStructure):
+        * bytecode/CodeBlock.cpp:
+        (JSC::dumpChain):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        (JSC::exitKindIsCountable):
+        * bytecode/ExitKind.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::emitArrayProfileOutOfBoundsSpecialCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-12-17  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        Implement add64 for MIPS assembler after r136601
+        https://bugs.webkit.org/show_bug.cgi?id=104106
+
+        Reviewed by Zoltan Herczeg.
+
+        Added add64 function to MacroAssebler of MIPS.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::add64):
+        (MacroAssemblerMIPS):
+
+2012-12-17  Jonathan Liu  <net147@gmail.com>
+
+        Fix Math.pow implementation with MinGW-w64
+        https://bugs.webkit.org/show_bug.cgi?id=105087
+
+        Reviewed by Simon Hausmann.
+
+        The MinGW-w64 runtime has different behaviour for pow()
+        compared to other C runtimes. This results in the following
+        test262 tests failing with the latest MinGW-w64 runtime:
+        - S15.8.2.13_A14
+        - S15.8.2.13_A16
+        - S15.8.2.13_A20
+        - S15.8.2.13_A22
+
+        Handle the special cases that are different with MinGW-w64.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathPow):
+
+2012-12-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Bytecode dumping should show rare case profiles
+        https://bugs.webkit.org/show_bug.cgi?id=105133
+
+        Reviewed by Geoffrey Garen.
+
+        Refactored the dumper to call dumpBytecodeCommandAndNewLine in just one place,
+        rather than in all of the places. Changed the rare case profile getters to use
+        tryBinarySearch rather than binarySearch, so that they can be used speculatively
+        even if you don't know that the bytecode has rare case profiles. This actually
+        increases our assertion level, since it means that in release builds we will get
+        null and crash rather than getting some random adjacent profile. And then this
+        adds some printing of the rare case profiles.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::beginDumpProfiling):
+        (JSC):
+        (JSC::CodeBlock::dumpValueProfiling):
+        (JSC::CodeBlock::dumpArrayProfiling):
+        (JSC::CodeBlock::dumpRareCaseProfile):
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset):
+        (JSC::CodeBlock::specialFastCaseProfileForBytecodeOffset):
+
+2012-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to rationalize and simplify WTF::binarySearch
+        https://bugs.webkit.org/show_bug.cgi?id=104890
+
+        Reviewed by Maciej Stachowiak.
+
+        Switch to using the new binarySearch() API. No change in behavior.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::codeOriginForReturn):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getByValInfo):
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::dfgOSREntryDataForBytecodeIndex):
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset):
+        (JSC::CodeBlock::specialFastCaseProfileForBytecodeOffset):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::blockIndexForBytecodeOffset):
+        * dfg/DFGMinifiedGraph.h:
+        (JSC::DFG::MinifiedGraph::at):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::indexForBytecodeIndex):
+
+2012-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't assert that flags <= 0x3ff in JSTypeInfo
+        https://bugs.webkit.org/show_bug.cgi?id=104988
+
+        Reviewed by Sam Weinig.
+
+        This assertion doesn't accomplish anything other than crashes.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2012-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Named lookups on HTML documents produce inconsistent results in JavaScriptCore bindings
+        https://bugs.webkit.org/show_bug.cgi?id=104623
+
+        Reviewed by Geoffrey Garen.
+
+        Add the notion of objects that HasImpureGetOwnPropertySlot, and use that to inhibit prototype chain caching
+        in some cases. This appears to be perf-neutral on benchmarks that we track.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSTypeInfo.h:
+        (JSC):
+        (JSC::TypeInfo::hasImpureGetOwnPropertySlot):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChainForChainAccess):
+
+2012-12-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/137683.
+        It broke gmail.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC):
+        * runtime/Operations.h:
+        (JSC):
+
+2012-13-11  Oliver Hunt  <oliver@apple.com>
+
+        Support op_typeof in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=98898
+
+        Reviewed by Filip Pizlo.
+
+        Adds a TypeOf node to the DFG to support op_typeof. 
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+          We try to determine the result early here, and substitute in a constant.
+          Otherwise we leave the node intact, and set the result type to SpecString.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+          Parse op_typeof
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+          TypeOf nodes can be subjected to pure CSE
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+          We can handle typeof.
+        * dfg/DFGNodeType.h:
+        (DFG):
+          Define the node.
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+          Add operationTypeOf to support the non-trivial cases.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+          Actual codegen
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC):
+        * runtime/Operations.h:
+        (JSC):
+          Some refactoring to allow us to get the type string for an
+          object without needing a callframe.
+
+2012-12-12  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR exit compiler should emit code for resetting the execution counter that matches the logic of ExecutionCounter.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=104791
+
+        Reviewed by Oliver Hunt.
+
+        The OSR exit compiler wants to make it so that every OSR exit does the equivalent
+        of:
+        
+        codeBlock->m_jitExecuteCounter.setNewThreshold(
+            codeBlock->counterValueForOptimizeAfterLongWarmUp());
+        
+        This logically involves:
+        
+        - Resetting the counter to zero.
+        - Setting m_activeThreshold to counterValueForOptimizeAfterLongWarmUp().
+        - Figuring out the scaled threshold, subtracting the count so far (which is zero,
+          so this part is a no-op), and clipping (ExecuteCounter::clippedThreshold()).
+        - Setting m_counter to the negated clipped threshold.
+        - Setting m_totalCount to the previous count so far (which is zero) plus the
+          clipped threshold.
+        
+        Because of the reset, which sets the count-so-far to zero, this amounts to:
+        
+        - Setting m_activeThreshold to counterValueForOptimizeAfterLongWarmUp().
+        - Figuring out the clipped scaled threshold.
+        - Setting m_counter to the negated clipped scaled threshold.
+        - Setting m_totalCount to the (positive) clipped scaled threshold.
+        
+        The code was previously not doing this, but now is. This is performance neutral.
+        The only change in behavior over what the code was previously doing (setting the
+        m_counter to the negated scaled threshold, without clipping, and then setting
+        the m_totalCount to the clipped scaled threshold) is that this will respond more
+        gracefully under memory pressure and will ensure that we get more value profile
+        LUBing before triggering recompilation. More LUBing is almost always a good
+        thing.
+
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+
+2012-12-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: Native Memory Instrumentation: remove fake root MemoryObjectInfo.
+        https://bugs.webkit.org/show_bug.cgi?id=104796
+
+        Reviewed by Yury Semikhatsky.
+
+        It was not a good idea to introduce a fake root MemoryObjectInfo.
+        It makes a problem when we visit an object without its own MemoryObjectType.
+
+        Example: RenderBox has a global pointer to a hash map.
+        HashMap doesn't have its own object type because it is a generic container.
+        It will inherit object type from the fake root memory object info.
+        The same could happen for another container in another class with other MemoryObjectType.
+
+        This fact forces me to create custom process method for root objects
+        because they need to have their own MemoryObjectInfo with customisable memory object type.
+
+        Drive by fix: InstrumentedPointer* was replaced with Wrapper* because actually it is using
+        for instrumented and not instrumented object classes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-12-11  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Implement add64 for ARM traditional assembler after r136601
+        https://bugs.webkit.org/show_bug.cgi?id=104103
+
+        Reviewed by Zoltan Herczeg.
+
+        Implement add64 function for ARM traditional macroassembler.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add64):
+        (MacroAssemblerARM):
+
+2012-12-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed. Fix build with DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::tallyFrequentExitSites):
+
+2012-12-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Profiler should show bytecode dumps as they would have been visible to the JITs, including the profiling data that the JITs would see
+        https://bugs.webkit.org/show_bug.cgi?id=104647
+
+        Reviewed by Oliver Hunt.
+
+        Adds more profiling data to bytecode dumps, and adds the ability to do a secondary
+        bytecode dump for each JIT compilation of a code block. This is relevant because both
+        the bytecodes, and the profiling data, may change after some number of executions.
+        
+        Also fixes some random dumping code to use PrintStream& rather than
+        static const char[thingy].
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ArrayProfile.cpp:
+        (JSC::dumpArrayModes):
+        (JSC::ArrayProfile::briefDescription):
+        * bytecode/ArrayProfile.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::dumpValueProfiling):
+        (JSC::CodeBlock::dumpArrayProfiling):
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::briefDescription):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * profiler/ProfilerBytecodeSequence.cpp: Added.
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
+        (JSC::Profiler::BytecodeSequence::~BytecodeSequence):
+        (JSC::Profiler::BytecodeSequence::indexForBytecodeIndex):
+        (JSC::Profiler::BytecodeSequence::forBytecodeIndex):
+        (JSC::Profiler::BytecodeSequence::addSequenceProperties):
+        * profiler/ProfilerBytecodeSequence.h: Added.
+        (JSC::Profiler::BytecodeSequence::size):
+        (JSC::Profiler::BytecodeSequence::at):
+        * profiler/ProfilerBytecodes.cpp:
+        (JSC::Profiler::Bytecodes::Bytecodes):
+        (JSC::Profiler::Bytecodes::toJS):
+        * profiler/ProfilerBytecodes.h:
+        (JSC::Profiler::Bytecodes::instructionCount):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::addProfiledBytecodes):
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerCompilation.h:
+        (JSC::Profiler::Compilation::profiledBytecodesSize):
+        (JSC::Profiler::Compilation::profiledBytecodesAt):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        * profiler/ProfilerDatabase.h:
+        * profiler/ProfilerProfiledBytecodes.cpp: Added.
+        (JSC::Profiler::ProfiledBytecodes::ProfiledBytecodes):
+        (JSC::Profiler::ProfiledBytecodes::~ProfiledBytecodes):
+        (JSC::Profiler::ProfiledBytecodes::toJS):
+        * profiler/ProfilerProfiledBytecodes.h: Added.
+        (JSC::Profiler::ProfiledBytecodes::bytecodes):
+        * runtime/CommonIdentifiers.h:
+
+2012-12-11  Oswald Buddenhagen  <oswald.buddenhagen@digia.com>
+
+        [Qt] delete dead include paths
+
+        Reviewed by Simon Hausmann.
+
+        followup to https://bugs.webkit.org/show_bug.cgi?id=93446
+
+        * JavaScriptCore.pri:
+
+2012-12-11  Julien BRIANCEAU   <jbrianceau@nds.com>
+
+        Implement add64 for SH4 assembler to fix build after r136601
+        https://bugs.webkit.org/show_bug.cgi?id=104377
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::add64):
+        (MacroAssemblerSH4):
+
+2012-12-10  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: make sure each edge is reported only once
+        https://bugs.webkit.org/show_bug.cgi?id=104630
+
+        Reviewed by Pavel Feldman.
+
+        Changed exported symbols for MemoryInstrumentation.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-12-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't OSR exit just because a string is a rope
+        https://bugs.webkit.org/show_bug.cgi?id=104621
+
+        Reviewed by Michael Saboff.
+
+        Slight SunSpider speed-up at around the 0.7% level. This patch does the obvious
+        thing of calling a slow path to resolve ropes rather than OSR exiting if the
+        string is a rope.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::getIndexedPropertyStorageMayTriggerGC):
+        (ArrayMode):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+2012-12-10  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed distcheck fix.
+
+        * GNUmakefile.list.am:
+
+2012-12-10  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC profiling and debug dump code should use inferred names when possible
+        https://bugs.webkit.org/show_bug.cgi?id=104519
+
+        Reviewed by Oliver Hunt.
+
+        This does as advertised: the profiler now knows the inferred name of all code blocks,
+        and all uses of CodeBlock::dump() dump it along with the hash.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::inferredName):
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * bytecode/CodeBlock.h:
+        * profiler/ProfilerBytecodes.cpp:
+        (JSC::Profiler::Bytecodes::Bytecodes):
+        (JSC::Profiler::Bytecodes::toJS):
+        * profiler/ProfilerBytecodes.h:
+        (JSC::Profiler::Bytecodes::inferredName):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::addBytecodes):
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        * profiler/ProfilerDatabase.h:
+        * runtime/CommonIdentifiers.h:
+
+2012-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Profiler should say things about OSR exits
+        https://bugs.webkit.org/show_bug.cgi?id=104497
+
+        Reviewed by Oliver Hunt.
+
+        This adds support for profiling OSR exits. For each exit that is taken, the profiler
+        records the machine code address that the exit occurred on, the exit kind, the origin
+        stack, and the number of times that it happened.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/AbstractMacroAssembler.h:
+        (Jump):
+        (JSC::AbstractMacroAssembler::Jump::label):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::saveCompilation):
+        (CodeBlock):
+        (JSC::CodeBlock::compilation):
+        (DFGData):
+        * bytecode/DFGExitProfile.h:
+        (DFG):
+        * bytecode/ExitKind.cpp: Added.
+        (JSC):
+        (JSC::exitKindToString):
+        (JSC::exitKindIsCountable):
+        (WTF):
+        (WTF::printInternal):
+        * bytecode/ExitKind.h: Added.
+        (JSC):
+        (WTF):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JumpReplacementWatchpoint.h:
+        (JSC::JumpReplacementWatchpoint::sourceLabel):
+        (JumpReplacementWatchpoint):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::addOSRExitSite):
+        (Profiler):
+        (JSC::Profiler::Compilation::addOSRExit):
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerCompilation.h:
+        (Compilation):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::newCompilation):
+        * profiler/ProfilerDatabase.h:
+        (Database):
+        * profiler/ProfilerOSRExit.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::OSRExit::OSRExit):
+        (JSC::Profiler::OSRExit::~OSRExit):
+        (JSC::Profiler::OSRExit::toJS):
+        * profiler/ProfilerOSRExit.h: Added.
+        (Profiler):
+        (OSRExit):
+        (JSC::Profiler::OSRExit::id):
+        (JSC::Profiler::OSRExit::origin):
+        (JSC::Profiler::OSRExit::exitKind):
+        (JSC::Profiler::OSRExit::isWatchpoint):
+        (JSC::Profiler::OSRExit::counterAddress):
+        (JSC::Profiler::OSRExit::count):
+        * profiler/ProfilerOSRExitSite.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::OSRExitSite::toJS):
+        * profiler/ProfilerOSRExitSite.h: Added.
+        (Profiler):
+        (OSRExitSite):
+        (JSC::Profiler::OSRExitSite::OSRExitSite):
+        (JSC::Profiler::OSRExitSite::codeAddress):
+        * runtime/CommonIdentifiers.h:
+
+2012-12-10  Alexis Menard  <alexis@webkit.org>
+
+        [CSS3 Backgrounds and Borders] Remove CSS3_BACKGROUND feature flag.
+        https://bugs.webkit.org/show_bug.cgi?id=104539
+
+        Reviewed by Antonio Gomes.
+
+        As discussed on webkit-dev it is not needed to keep this feature flag 
+        as support for <position> type is a small feature that is already 
+        implemented by three other UAs. It was useful while landing this 
+        feature as partial bits were landed one after one.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ArrayPush/Pop should not pass their second child as the index for blessArrayOperation()
+        https://bugs.webkit.org/show_bug.cgi?id=104500
+
+        Reviewed by Oliver Hunt.
+
+        Slight across-the-board speed-up.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2012-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should scale the optimization threshold for a code block according to the cost of compiling it
+        https://bugs.webkit.org/show_bug.cgi?id=104406
+
+        Reviewed by Oliver Hunt.
+
+        We've long known that we want to scale the execution count threshold needed for the DFG
+        to kick in to scale according to some estimate of the cost of compiling that code block.
+        This institutes a relationship like this:
+        
+        threshold = thresholdSetting * (a * sqrt(instructionCount + b) + abs(c * instructionCount) + d
+        
+        Where a, b, c, d are coefficients derived from fitting the above expression to various
+        data points, which I chose based on looking at one benchmark (3d-cube) and from my
+        own intuitions.
+        
+        Making this work well also required changing the thresholdForOptimizeAfterLongWarmUp
+        from 5000 to 1000.
+        
+        This is a >1% speed-up on SunSpider, a >3% speed-up on V8Spider, ~1% speed-up on V8v7,
+        neutral on Octane, and neutral on Kraken.
+        
+        I also out-of-lined a bunch of methods related to these heuristics, because I couldn't
+        stand having them defined in the header anymore. I also made improvements to debugging
+        code because I needed it for tuning this change.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::sourceCodeForTools):
+        (JSC::CodeBlock::sourceCodeOnOneLine):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::reoptimizationRetryCounter):
+        (JSC::CodeBlock::countReoptimization):
+        (JSC::CodeBlock::optimizationThresholdScalingFactor):
+        (JSC::clipThreshold):
+        (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
+        (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
+        (JSC::CodeBlock::counterValueForOptimizeSoon):
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached):
+        (JSC::CodeBlock::optimizeNextInvocation):
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon):
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::optimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon):
+        (JSC::CodeBlock::adjustedExitCountThreshold):
+        (JSC::CodeBlock::exitCountThresholdForReoptimization):
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        * bytecode/CodeBlock.h:
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::hasCrossedThreshold):
+        * bytecode/ReduceWhitespace.cpp: Added.
+        (JSC::reduceWhitespace):
+        * bytecode/ReduceWhitespace.h: Added.
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dumpHeader):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dumpHeader):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        * runtime/Options.h:
+
+2012-12-07  Jonathan Liu  <net147@gmail.com>
+
+        Add missing forward declaration for JSC::ArrayAllocationProfile
+        https://bugs.webkit.org/show_bug.cgi?id=104425
+
+        Reviewed by Kentaro Hara.
+
+        The header for the JSC::ArrayConstructor class is missing a forward
+        declaration for the JSC::ArrayAllocationProfile class which causes
+        compilation to fail when compiling with MinGW-w64.
+
+        * runtime/ArrayConstructor.h:
+        (JSC):
+
+2012-12-07  Jonathan Liu  <net147@gmail.com>
+
+        Add missing const qualifier to JSC::CodeBlock::getJITType()
+        https://bugs.webkit.org/show_bug.cgi?id=104424
+
+        Reviewed by Laszlo Gombos.
+
+        JSC::CodeBlock::getJITType() has the const qualifier when JIT is
+        enabled but is missing the const qualifier when JIT is disabled.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getJITType):
+
+2012-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Make function code cache proportional to main codeblock cache
+        https://bugs.webkit.org/show_bug.cgi?id=104420
+
+        Reviewed by Geoffrey Garen.
+
+        Makes the constants determining the recently used function cache proportional
+        to the number of root codeblocks in the cache.  Also renames the constants to
+        make them more clear.
+     
+        * runtime/CodeCache.h:
+
+2012-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Strange results calculating a square root in a loop
+        https://bugs.webkit.org/show_bug.cgi?id=104247
+        <rdar://problem/12826880>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed the CFG simplification phase to ignore dead GetLocals in the first of the blocks
+        under the merge. This fixes the assertion, and is also cleaner: our general rule is
+        to not "revive" things that we've already proved to be dead.
+        
+        Also fixed some rotted debug code.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-12-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Crash in JSC::Bindings::RootObject::globalObject() sync'ing notes in Evernote
+        https://bugs.webkit.org/show_bug.cgi?id=104321
+        <rdar://problem/12770497>
+
+        Reviewed by Sam Weinig.
+
+        Work around a JSValueUnprotect(NULL) in Evernote.
+
+        * API/JSValueRef.cpp:
+        (evernoteHackNeeded):
+        (JSValueUnprotect):
+
+2012-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Incorrect inequality for checking whether a statement is within bounds of a handler
+        https://bugs.webkit.org/show_bug.cgi?id=104313
+        <rdar://problem/12808934>
+
+        Reviewed by Geoffrey Garen.
+
+        The most relevant change is in handlerForBytecodeOffset(), which fixes the inequality
+        used for checking whether a handler is pertinent to the current instruction. '<' is
+        correct, but '<=' isn't, since the 'end' is not inclusive.
+        
+        Also found, and addressed, a benign goof in how the finally inliner works: sometimes
+        we will have end > start. This falls out naturally from how the inliner works and how
+        we pop scopes in the bytecompiler, but it's sufficiently surprising that, to avoid any
+        future confusion, I added a comment and some code to prune those handlers out. Because
+        of how the handler resolution works, these handlers would have been skipped anyway.
+        
+        Also made various fixes to debugging code, which was necessary for tracking this down.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * bytecompiler/Label.h:
+        (JSC::Label::bind):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::handleHostCall):
+
+2012-12-06  Rick Byers  <rbyers@chromium.org>
+
+        CSS cursor property should support webkit-image-set
+        https://bugs.webkit.org/show_bug.cgi?id=99493
+
+        Reviewed by Beth Dakin.
+
+        Add ENABLE_MOUSE_CURSOR_SCALE (disabled by default)
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-12-06  Laszlo Gombos  <l.gombos@samsung.com>
+
+        [CMake] Consolidate list of files to build for JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=104287
+
+        Reviewed by Gyuyoung Kim.
+
+        Add MemoryStatistics.cpp and ExecutableAllocator.cpp to the common
+        list of files and remove them from the port specific lists.
+
+        * CMakeLists.txt:
+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * PlatformWinCE.cmake:
+
+2012-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Tell heap that we've released all the compiled code.
+
+        Reviewed by Geoff Garen.
+
+        When we discard compiled code, inform the heap that we've
+        released an entire object graph.  This informs the heap that
+        it might want to perform a GC soon.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::discardAllCode):
+
+2012-12-06  Laszlo Gombos  <l.gombos@samsung.com>
+
+        [EFL] Remove ENABLE_GLIB_SUPPORT CMake variable
+        https://bugs.webkit.org/show_bug.cgi?id=104278
+
+        Reviewed by Brent Fulgham.
+
+        The conditional is not required as it is always set for EFL.
+
+        * PlatformEfl.cmake:
+
+2012-12-06  Oliver Hunt  <oliver@apple.com>
+
+        Build fix, last patch rolled out logic that is now needed on ToT.
+
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::setFunctionStart):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setFunctionStart):
+        (JSC::FunctionBodyNode::functionStart):
+        (FunctionBodyNode):
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::setFunctionStart):
+
+2012-12-05  Oliver Hunt  <oliver@apple.com>
+
+        Remove harmful string->function cache
+        https://bugs.webkit.org/show_bug.cgi?id=104193
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove the string->function code cache that turned out to actually
+        be quite harmful.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionCodeBlock):
+        * runtime/CodeCache.h:
+        (JSC::CodeCache::clear):
+
+2012-12-05  Halton Huo  <halton.huo@intel.com>
+
+        [CMake] Unify coding style for CMake files
+        https://bugs.webkit.org/show_bug.cgi?id=103605
+
+        Reviewed by Laszlo Gombos.
+
+        Update cmake files(.cmake, CMakeLists.txt) with following style rules:
+        1. Indentation
+        1.1 Use spaces, not tabs.
+        1.2 Four spaces as indent.
+        2. Spacing
+        2.1 Place one space between control statements and their parentheses.
+            For eg, if (), else (), elseif (), endif (), foreach (),
+            endforeach (), while (), endwhile (), break ().
+        2.2 Do not place spaces between function and macro statements and
+            their parentheses. For eg, macro(), endmacro(), function(),
+            endfunction().
+        2.3 Do not place spaces between a command or function or macro and its
+            parentheses, or between a parenthesis and its content. For eg,
+            message("testing") not message( "testing") or message ("testing" )
+        2.4 No space at line ending.
+        3. Lowercase when call commands macros and functions. For eg,
+           add_executable() not ADD_EXECUTABLE(), set() not SET().
+
+        * CMakeLists.txt:
+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * PlatformWinCE.cmake:
+        * shell/CMakeLists.txt:
+        * shell/PlatformBlackBerry.cmake:
+        * shell/PlatformEfl.cmake:
+        * shell/PlatformWinCE.cmake:
+
+2012-12-05  Oliver Hunt  <oliver@apple.com>
+
+        Empty parse cache when receiving a low memory warning
+        https://bugs.webkit.org/show_bug.cgi?id=104161
+
+        Reviewed by Filip Pizlo.
+
+        This adds a function to the globaldata to empty all code related data
+        structures (code in the heap and the code cache).
+        It also adds a function to allow the CodeCache to actually be cleared
+        at all. 
+
+        * runtime/CodeCache.h:
+        (CacheMap):
+        (JSC::CacheMap::clear):
+        (JSC::CodeCache::clear):
+        (CodeCache):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::discardAllCode):
+        (JSC):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2012-12-05  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC profiler should not count executions of op_call_put_result because doing so changes DFG codegen
+        https://bugs.webkit.org/show_bug.cgi?id=104102
+
+        Reviewed by Oliver Hunt.
+
+        This removes op_call_put_result from profiling, since profiling it has an effect on
+        codegen. This fix enables all of SunSpider, V8, and Kraken to be profiled with the
+        new profiler.
+        
+        To make this all fit together, the profiler now also reports in its output the exact
+        bytecode opcode name for each instruction (in addition to the stringified dump of that
+        bytecode), so that tools that grok the output can take note of op_call_put_result and
+        work around the fact that it has no counts.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * profiler/ProfilerBytecode.cpp:
+        (JSC::Profiler::Bytecode::toJS):
+        * profiler/ProfilerBytecode.h:
+        (JSC::Profiler::Bytecode::Bytecode):
+        (JSC::Profiler::Bytecode::opcodeID):
+        (Bytecode):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        * runtime/CommonIdentifiers.h:
+
+2012-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        display-profiler-output should be able to show source code
+        https://bugs.webkit.org/show_bug.cgi?id=104073
+
+        Reviewed by Oliver Hunt.
+
+        Modify the profiler database to store source code. For functions, we store the
+        function including the function signature.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::unlinkedCodeBlock):
+        (CodeBlock):
+        * profiler/ProfilerBytecodes.cpp:
+        (JSC::Profiler::Bytecodes::Bytecodes):
+        (JSC::Profiler::Bytecodes::toJS):
+        * profiler/ProfilerBytecodes.h:
+        (Bytecodes):
+        (JSC::Profiler::Bytecodes::sourceCode):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::addBytecodes):
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        * profiler/ProfilerDatabase.h:
+        (Database):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Executable.h:
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::unlinkedExecutable):
+
+2012-12-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should be able to report profiling data associated with the IR dumps and disassembly
+        https://bugs.webkit.org/show_bug.cgi?id=102999
+
+        Reviewed by Gavin Barraclough.
+
+        Added a new profiler to JSC. It's simply called "Profiler" in anticipation of it
+        ultimately replacing the previous profiling infrastructure. This profiler counts the
+        number of times that a bytecode executes in various engines, and will record both the
+        counts and all disassembly and bytecode dumps, into a database that can be at any
+        time turned into either a JS object using any global object or global data of your
+        choice, or can be turned into a JSON string, or saved to a file.
+        
+        Currently the only use of this is the new '-p <file>' flag to the jsc command-line.
+        
+        The profiler is always compiled in and normally incurs no execution time cost, but is
+        only activated when you create a Profiler::Database and install it in
+        JSGlobalData::m_perBytecodeProfiler. From that point on, all code blocks will be
+        compiled along with disassembly and bytecode dumps stored into the Profiler::Database,
+        and all code blocks will have execution counts, which are also stored in the database.
+        The database will continue to keep information about code blocks alive even after they
+        are otherwise GC'd.
+        
+        This currently still has some glitches, like the fact that it only counts executions
+        in the JITs. Doing execution counting in the LLInt might require a bit of a rethink
+        about how the counting is expressed - currently it is implicit in bytecode, so there
+        is no easy way to "turn it on" in the LLInt. Also, right now there is no information
+        recorded about OSR exits or out-of-line stubs. But, even so, it's quite cool, and
+        gives you a peek into what JSC is doing that would otherwise not be possible.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::baselineVersion):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::baselineCodeBlock):
+        (JSC):
+        * bytecode/CodeOrigin.h:
+        (InlineCallFrame):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dump):
+        (DFG):
+        (JSC::DFG::Disassembler::reportToProfiler):
+        (JSC::DFG::Disassembler::dumpHeader):
+        (JSC::DFG::Disassembler::append):
+        (JSC::DFG::Disassembler::createDumpList):
+        * dfg/DFGDisassembler.h:
+        (Disassembler):
+        (JSC::DFG::Disassembler::DumpedOp::DumpedOp):
+        (DumpedOp):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::hasExecutionCounter):
+        (JSC::DFG::Node::executionCounter):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dump):
+        (JSC::JITDisassembler::reportToProfiler):
+        (JSC):
+        (JSC::JITDisassembler::dumpHeader):
+        (JSC::JITDisassembler::firstSlowLabel):
+        (JSC::JITDisassembler::dumpVectorForInstructions):
+        (JSC::JITDisassembler::dumpForInstructions):
+        (JSC::JITDisassembler::reportInstructions):
+        * jit/JITDisassembler.h:
+        (JITDisassembler):
+        (DumpedOp):
+        * jsc.cpp:
+        (CommandLine::CommandLine):
+        (CommandLine):
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        (jscmain):
+        * profiler/ProfilerBytecode.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::Bytecode::toJS):
+        * profiler/ProfilerBytecode.h: Added.
+        (Profiler):
+        (Bytecode):
+        (JSC::Profiler::Bytecode::Bytecode):
+        (JSC::Profiler::Bytecode::bytecodeIndex):
+        (JSC::Profiler::Bytecode::description):
+        (JSC::Profiler::getBytecodeIndexForBytecode):
+        * profiler/ProfilerBytecodes.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::Bytecodes::Bytecodes):
+        (JSC::Profiler::Bytecodes::~Bytecodes):
+        (JSC::Profiler::Bytecodes::indexForBytecodeIndex):
+        (JSC::Profiler::Bytecodes::forBytecodeIndex):
+        (JSC::Profiler::Bytecodes::dump):
+        (JSC::Profiler::Bytecodes::toJS):
+        * profiler/ProfilerBytecodes.h: Added.
+        (Profiler):
+        (Bytecodes):
+        (JSC::Profiler::Bytecodes::append):
+        (JSC::Profiler::Bytecodes::id):
+        (JSC::Profiler::Bytecodes::hash):
+        (JSC::Profiler::Bytecodes::size):
+        (JSC::Profiler::Bytecodes::at):
+        * profiler/ProfilerCompilation.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::Compilation::Compilation):
+        (JSC::Profiler::Compilation::~Compilation):
+        (JSC::Profiler::Compilation::addDescription):
+        (JSC::Profiler::Compilation::executionCounterFor):
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerCompilation.h: Added.
+        (Profiler):
+        (Compilation):
+        (JSC::Profiler::Compilation::bytecodes):
+        (JSC::Profiler::Compilation::kind):
+        * profiler/ProfilerCompilationKind.cpp: Added.
+        (WTF):
+        (WTF::printInternal):
+        * profiler/ProfilerCompilationKind.h: Added.
+        (Profiler):
+        (WTF):
+        * profiler/ProfilerCompiledBytecode.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::CompiledBytecode::CompiledBytecode):
+        (JSC::Profiler::CompiledBytecode::~CompiledBytecode):
+        (JSC::Profiler::CompiledBytecode::toJS):
+        * profiler/ProfilerCompiledBytecode.h: Added.
+        (Profiler):
+        (CompiledBytecode):
+        (JSC::Profiler::CompiledBytecode::originStack):
+        (JSC::Profiler::CompiledBytecode::description):
+        * profiler/ProfilerDatabase.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::Database::Database):
+        (JSC::Profiler::Database::~Database):
+        (JSC::Profiler::Database::addBytecodes):
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        (JSC::Profiler::Database::notifyDestruction):
+        (JSC::Profiler::Database::newCompilation):
+        (JSC::Profiler::Database::toJS):
+        (JSC::Profiler::Database::toJSON):
+        (JSC::Profiler::Database::save):
+        * profiler/ProfilerDatabase.h: Added.
+        (Profiler):
+        (Database):
+        * profiler/ProfilerExecutionCounter.h: Added.
+        (Profiler):
+        (ExecutionCounter):
+        (JSC::Profiler::ExecutionCounter::ExecutionCounter):
+        (JSC::Profiler::ExecutionCounter::address):
+        (JSC::Profiler::ExecutionCounter::count):
+        * profiler/ProfilerOrigin.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::Origin::Origin):
+        (JSC::Profiler::Origin::dump):
+        (JSC::Profiler::Origin::toJS):
+        * profiler/ProfilerOrigin.h: Added.
+        (JSC):
+        (Profiler):
+        (Origin):
+        (JSC::Profiler::Origin::Origin):
+        (JSC::Profiler::Origin::operator!):
+        (JSC::Profiler::Origin::bytecodes):
+        (JSC::Profiler::Origin::bytecodeIndex):
+        (JSC::Profiler::Origin::operator!=):
+        (JSC::Profiler::Origin::operator==):
+        (JSC::Profiler::Origin::hash):
+        (JSC::Profiler::Origin::isHashTableDeletedValue):
+        (JSC::Profiler::OriginHash::hash):
+        (JSC::Profiler::OriginHash::equal):
+        (OriginHash):
+        (WTF):
+        * profiler/ProfilerOriginStack.cpp: Added.
+        (Profiler):
+        (JSC::Profiler::OriginStack::OriginStack):
+        (JSC::Profiler::OriginStack::~OriginStack):
+        (JSC::Profiler::OriginStack::append):
+        (JSC::Profiler::OriginStack::operator==):
+        (JSC::Profiler::OriginStack::hash):
+        (JSC::Profiler::OriginStack::dump):
+        (JSC::Profiler::OriginStack::toJS):
+        * profiler/ProfilerOriginStack.h: Added.
+        (JSC):
+        (Profiler):
+        (OriginStack):
+        (JSC::Profiler::OriginStack::OriginStack):
+        (JSC::Profiler::OriginStack::operator!):
+        (JSC::Profiler::OriginStack::size):
+        (JSC::Profiler::OriginStack::fromBottom):
+        (JSC::Profiler::OriginStack::fromTop):
+        (JSC::Profiler::OriginStack::isHashTableDeletedValue):
+        (JSC::Profiler::OriginStackHash::hash):
+        (JSC::Profiler::OriginStackHash::equal):
+        (OriginStackHash):
+        (WTF):
+        * runtime/CommonIdentifiers.h:
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/Options.h:
+        (JSC):
+
+2012-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename Profiler to LegacyProfiler
+        https://bugs.webkit.org/show_bug.cgi?id=104031
+
+        Rubber stamped by Mark Hahnenberg
+
+        Make room in the namespace for https://bugs.webkit.org/show_bug.cgi?id=102999.
+
+        * API/JSProfilerPrivate.cpp:
+        (JSStartProfiling):
+        (JSEndProfiling):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * profiler/LegacyProfiler.cpp: Added.
+        (JSC):
+        (JSC::LegacyProfiler::profiler):
+        (JSC::LegacyProfiler::startProfiling):
+        (JSC::LegacyProfiler::stopProfiling):
+        (JSC::dispatchFunctionToProfiles):
+        (JSC::LegacyProfiler::willExecute):
+        (JSC::LegacyProfiler::didExecute):
+        (JSC::LegacyProfiler::exceptionUnwind):
+        (JSC::LegacyProfiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/LegacyProfiler.h: Added.
+        (JSC):
+        (LegacyProfiler):
+        (JSC::LegacyProfiler::currentProfiles):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/ProfileNode.cpp:
+        * profiler/Profiler.cpp: Removed.
+        * profiler/Profiler.h: Removed.
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSC::JSGlobalData::enabledProfiler):
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+
+2012-12-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline code blocks that use scoped variable access
+        https://bugs.webkit.org/show_bug.cgi?id=103974
+
+        Reviewed by Oliver Hunt.
+
+        This mostly just turns on something we could have done all along, but also adds a few key
+        necessities to make this right:
+        
+        1) Constant folding of SkipScope, since if we inline with a known JSFunction* then the
+           scope is constant.
+        
+        2) Interference analysis for GetLocal<->PutScopedVar and SetLocal<->GetScopedVar.
+        
+        This is not meant to be a speed-up on major benchmarks since we don't yet inline most
+        closure calls for entirely unrelated reasons. But on toy programs it can be >2x faster.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getScope):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (JSC::DFG::CSEPhase::scopedVarStoreElimination):
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineResolveOperations):
+
+2012-12-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Replace JSValue::description() with JSValue::dump(PrintStream&)
+        https://bugs.webkit.org/show_bug.cgi?id=103866
+
+        Reviewed by Darin Adler.
+
+        JSValue now has a dump() method. Anywhere that you would have wanted to use
+        description(), you can either do toCString(value).data(), or if the callee
+        is a print()/dataLog() method then you just pass the value directly.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::dump):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::dump):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * jsc.cpp:
+        (functionDescribe):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_trace_value):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::dump):
+        * runtime/JSValue.h:
+
+2012-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        jsc command line tool's support for typed arrays should be robust against array buffer allocation errors
+        https://bugs.webkit.org/show_bug.cgi?id=104020
+        <rdar://problem/12802478>
+
+        Reviewed by Mark Hahnenberg.
+
+        Check for null buffers, since that's what typed array allocators are supposed to do. WebCore does it,
+        and that is indeed the contract of ArrayBuffer and TypedArrayBase.
+
+        * JSCTypedArrayStubs.h:
+        (JSC):
+
+2012-12-03  Peter Rybin  <prybin@chromium.org>
+
+        Web Inspector: make ASSERTION FAILED: foundPropertiesCount == object->size() more useful
+        https://bugs.webkit.org/show_bug.cgi?id=103254
+
+        Reviewed by Pavel Feldman.
+
+        Missing symbol WTFReportFatalError is added to the linker list.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-12-03  Alexis Menard  <alexis@webkit.org>
+
+        [Mac] Enable CSS3 background-position offset by default.
+        https://bugs.webkit.org/show_bug.cgi?id=103905
+
+        Reviewed by Simon Fraser.
+
+        Turn the flag on by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-12-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should trigger rage conversion from double to contiguous if it sees a GetByVal on Double being used in an integer context
+        https://bugs.webkit.org/show_bug.cgi?id=103858
+
+        Reviewed by Gavin Barraclough.
+
+        A rage conversion from double to contiguous is one where you try to convert each
+        double to an int32.
+
+        This is probably not the last we'll hear of rage conversion from double to contiguous.
+        It may be better to do this right during parsing, which will result in fewer cases of
+        Arrayification. But even so, this looks like a straight win already - 1% speed-up on
+        Kraken, no major regression anywhere else.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        (JSC::DFG::arrayConversionToString):
+        (JSC::DFG::ArrayMode::dump):
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::withConversion):
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::doesConversion):
+        (WTF):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupBlock):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (FixupPhase):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * runtime/JSObject.cpp:
+        (JSC):
+        (JSC::JSObject::genericConvertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToContiguous):
+        (JSC::JSObject::rageConvertDoubleToContiguous):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::rageEnsureContiguousSlow):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::rageEnsureContiguous):
+
+2012-12-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE should not keep alive things that aren't relevant to OSR
+        https://bugs.webkit.org/show_bug.cgi?id=103849
+
+        Reviewed by Oliver Hunt.
+
+        Most Phantom nodes are inserted by CSE, and by default have the same children as the
+        node that CSE had eliminated. This change makes CSE inspect all Phantom nodes (both
+        those it creates and those that were created by other phases) to see if they have
+        children that are redundant - i.e. children that are not interesting to OSR, which
+        is the only reason why Phantoms exist in the first place. Being relevant to OSR is
+        defined as one of: (1) you're a Phi, (2) you're a SetLocal, (3) somewhere between
+        your definition and the Phantom there was a SetLocal that referred to you.
+        
+        This is a slight speed-up in a few places.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (JSC::DFG::CSEPhase::run):
+        (JSC::DFG::CSEPhase::performSubstitution):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+
+2012-12-02  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to build and run with DFG_ENABLE(PROPAGATION_VERBOSE)
+        https://bugs.webkit.org/show_bug.cgi?id=103848
+
+        Reviewed by Sam Weinig.
+
+        Fix random dataLog() and print() statements.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-12-01  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock should be able to dump bytecode to something other than WTF::dataFile()
+        https://bugs.webkit.org/show_bug.cgi?id=103832
+
+        Reviewed by Oliver Hunt.
+
+        Add a PrintStream& argument to all of the CodeBlock bytecode dumping methods.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::dumpStructure):
+        (JSC::dumpChain):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dumpForInstructions):
+
+2012-11-30  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Unreviewed speculative Mac build fix after r136232
+
+        Update the include path so that LLIntAssembly.h is picked up.
+        The bot didn't break until later when a clean build was triggered.
+
+        * JavaScriptCore.pri:
+
+2012-11-30  Oliver Hunt  <oliver@apple.com>
+
+        Optimise more cases of op_typeof
+        https://bugs.webkit.org/show_bug.cgi?id=103783
+
+        Reviewed by Mark Hahnenberg.
+
+        Increase our coverage of typeof based typechecks by
+        making sure that the codegenerators always uses
+        consistent operand ordering when feeding typeof operations
+        into equality operations.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+        (JSC::StrictEqualNode::emitBytecode):
+
+2012-11-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize and clean up DFG handling of scoped accesses
+        https://bugs.webkit.org/show_bug.cgi?id=103715
+
+        Reviewed by Oliver Hunt.
+
+        Previously, we had a GetScope node that specified the depth to which you wanted
+        to travel to get a JSScope, and the backend implementation of the node would
+        perform all of the necessary footwork, including potentially skipping the top
+        scope if necessary, and doing however many loads were needed. But there were
+        strange things. First, if you had accesses at different scope depths, then the
+        loads to get to the common depth could not be CSE'd - CSE would match only
+        GetScope's that had identical depth. Second, GetScope would be emitted even if
+        we already had the scope, for example in put_to_base. And finally, even though
+        the ResolveOperations could tell us whether or not we had to skip the top scope,
+        the backend would recompute this information itself, often pessimistically.
+        
+        This eliminates GetScope and replaces it with the following:
+        
+        GetMyScope: just get the JSScope from the call frame header. This will forever
+        mean getting the JSScope associated with the machine call frame; it will not
+        mean getting the scope of an inlined function. Or at least that's the intent.
+        
+        SkipTopScope: check if there is an activation, and if so, skip a scope. This
+        takes a scope as a child and returns a scope.
+        
+        SkipScope: skip one scope level.
+        
+        The bytecode parser now emits the right combination of the above, and
+        potentially emits multiple SkipScope's, based on the ResolveOperations.
+        
+        This change also includes some fixups to debug logging. We now always print
+        the ExecutableBase* in addition to the CodeBlock* in the CodeBlock's dump,
+        and we are now more verbose when dumping CodeOrigins and InlineCallFrames.
+        
+        This is performance-neutral. It's just meant to be a clean-up.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::inlineStack):
+        (JSC::CodeOrigin::dump):
+        (JSC):
+        (JSC::InlineCallFrame::dump):
+        * bytecode/CodeOrigin.h:
+        (CodeOrigin):
+        (InlineCallFrame):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getScope):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (JSC::DFG::CSEPhase::scopedVarStoreElimination):
+        (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGNode.h:
+        (Node):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dump):
+
+2012-11-30  Oliver Hunt  <oliver@apple.com>
+
+        Add direct string->function code cache
+        https://bugs.webkit.org/show_bug.cgi?id=103764
+
+        Reviewed by Michael Saboff.
+
+        A fairly logically simple patch.  We now track the start of the
+        unique portion of a functions body, and use that as our key for
+        unlinked function code.  This allows us to cache identical code
+        in different contexts, leading to a small but consistent improvement
+        on the benchmarks we track.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::functionStartOffset):
+        (UnlinkedFunctionExecutable):
+        * parser/ASTBuilder.h:
+        (ASTBuilder):
+        (JSC::ASTBuilder::setFunctionStart):
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::setFunctionStart):
+        (JSC::FunctionBodyNode::functionStart):
+        (FunctionBodyNode):
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Parser::findCachedFunctionInfo):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::setFunctionStart):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::generateFunctionCodeBlock):
+        (JSC::CodeCache::getFunctionCodeBlock):
+        (JSC::CodeCache::usedFunctionCode):
+        * runtime/CodeCache.h:
+
+2012-11-30  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Crash in conversion of empty OpaqueJSString to Identifier 
+        https://bugs.webkit.org/show_bug.cgi?id=101867
+
+        Reviewed by Michael Saboff.
+
+        The constructor call used for both null and empty OpaqueJSStrings results
+        in an assertion voilation and crash. This patch instead uses the Identifier
+        constructors which are specifically for null and empty Identifier.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::identifier):
+
+2012-11-30  Tor Arne Vestbø  <tor.arne.vestbo@digia.com>
+
+        [Qt] Place the LLIntOffsetsExtractor binaries in debug/release subdirs on Mac
+
+        Otherwise we'll end up using the same LLIntAssembly.h for both build
+        configs of JavaScriptCore -- one of them which will be for the wrong
+        config.
+
+        Reviewed by Simon Hausmann.
+
+        * LLIntOffsetsExtractor.pro:
+
+2012-11-30  Julien BRIANCEAU   <jbrianceau@nds.com>
+
+        [sh4] Fix compilation warnings in JavaScriptCore JIT for sh4 arch
+        https://bugs.webkit.org/show_bug.cgi?id=103378
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchTest32):
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        (JSC::MacroAssemblerSH4::branchMul32):
+        (JSC::MacroAssemblerSH4::branchSub32):
+        (JSC::MacroAssemblerSH4::branchOr32):
+
+2012-11-29  Rafael Weinstein  <rafaelw@chromium.org>
+
+        [HTMLTemplateElement] Add feature flag
+        https://bugs.webkit.org/show_bug.cgi?id=103694
+
+        Reviewed by Adam Barth.
+
+        This flag will guard the implementation of the HTMLTemplateElement.
+        http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/templates/index.html
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-29  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be easy to find code blocks in debug dumps
+        https://bugs.webkit.org/show_bug.cgi?id=103623
+
+        Reviewed by Goeffrey Garen.
+
+        This gives CodeBlock a relatively strong, but also relatively compact, hash. We compute
+        it lazily so that it only impacts run-time when debug support is enabled. We stringify
+        it smartly so that it's short and easy to type. We base it on the source code so that
+        the optimization level is irrelevant. And, we use SHA1 since it's already in our code
+        base. Now, when a piece of code wants to print some debugging to say that it's operating
+        on some code block, it can use this CodeBlockHash instead of memory addresses.
+
+        This also takes CodeBlock debugging into the new world of print() and dataLog(). In
+        particular, CodeBlock::dump() corresponds to the thing you want printed if you do:
+
+        dataLog("I heart ", *myCodeBlock);
+
+        Probably, you want to just print some identifying information at this point rather than
+        the full bytecode dump. So, the existing CodeBlock::dump() has been renamed to
+        CodeBlock::dumpBytecode(), and CodeBlock::dump() now prints the CodeBlockHash plus just
+        a few little tidbits.
+        
+        Here's an example of CodeBlock::dump() output:
+        
+        EkILzr:[0x103883a00, BaselineFunctionCall]
+        
+        EkILzr is the CodeBlockHash. 0x103883a00 is the CodeBlock's address in memory. The other
+        part is self-explanatory.
+
+        Finally, this new notion of CodeBlockHash is available for other purposes like bisecting
+        breakage. As such CodeBlockHash has all of the comparison operator overloads. When
+        bisecting in DFGDriver.cpp, you can now say things like:
+        
+        if (codeBlock->hash() < CodeBlockHash("CAAAAA"))
+            return false;
+        
+        And yes, CAAAAA is near the median hash, and the largest one is smaller than E99999. Such
+        is life when you use base 62 to encode a 32-bit number.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CallLinkInfo.h:
+        (CallLinkInfo):
+        (JSC::CallLinkInfo::specializationKind):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hash):
+        (JSC):
+        (JSC::CodeBlock::dumpAssumingJITType):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::reoptimize):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::specializationKind):
+        (CodeBlock):
+        (JSC::CodeBlock::getJITType):
+        * bytecode/CodeBlockHash.cpp: Added.
+        (JSC):
+        (JSC::CodeBlockHash::CodeBlockHash):
+        (JSC::CodeBlockHash::dump):
+        * bytecode/CodeBlockHash.h: Added.
+        (JSC):
+        (CodeBlockHash):
+        (JSC::CodeBlockHash::CodeBlockHash):
+        (JSC::CodeBlockHash::hash):
+        (JSC::CodeBlockHash::operator==):
+        (JSC::CodeBlockHash::operator!=):
+        (JSC::CodeBlockHash::operator<):
+        (JSC::CodeBlockHash::operator>):
+        (JSC::CodeBlockHash::operator<=):
+        (JSC::CodeBlockHash::operator>=):
+        * bytecode/CodeBlockWithJITType.h: Added.
+        (JSC):
+        (CodeBlockWithJITType):
+        (JSC::CodeBlockWithJITType::CodeBlockWithJITType):
+        (JSC::CodeBlockWithJITType::dump):
+        * bytecode/CodeOrigin.cpp: Added.
+        (JSC):
+        (JSC::CodeOrigin::inlineDepthForCallFrame):
+        (JSC::CodeOrigin::inlineDepth):
+        (JSC::CodeOrigin::inlineStack):
+        (JSC::InlineCallFrame::hash):
+        * bytecode/CodeOrigin.h:
+        (InlineCallFrame):
+        (JSC::InlineCallFrame::specializationKind):
+        (JSC):
+        * bytecode/CodeType.cpp: Added.
+        (WTF):
+        (WTF::printInternal):
+        * bytecode/CodeType.h:
+        (WTF):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::dump):
+        * bytecode/ExecutionCounter.h:
+        (ExecutionCounter):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::dfgLinkClosureCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpCallFrame):
+        * jit/JITCode.cpp: Added.
+        (WTF):
+        (WTF::printInternal):
+        * jit/JITCode.h:
+        (JSC::JITCode::jitType):
+        (WTF):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dump):
+        (JSC::JITDisassembler::dumpForInstructions):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/CodeSpecializationKind.cpp: Added.
+        (WTF):
+        (WTF::printInternal):
+        * runtime/CodeSpecializationKind.h:
+        (JSC::specializationFromIsCall):
+        (JSC):
+        (JSC::specializationFromIsConstruct):
+        (WTF):
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::hashFor):
+        (JSC):
+        (JSC::NativeExecutable::hashFor):
+        (JSC::ScriptExecutable::hashFor):
+        * runtime/Executable.h:
+        (ExecutableBase):
+        (NativeExecutable):
+        (ScriptExecutable):
+        (JSC::ScriptExecutable::source):
+
+2012-11-29  Michael Saboff  <msaboff@apple.com>
+
+        Speculative Windows build fix after r136086.
+
+        Unreviewed build fix.
+
+        Suspect that ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z needs to be removed from Windows
+        export list since the symbol was removed in r136086.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-11-28  Filip Pizlo  <fpizlo@apple.com>
+
+        SpeculatedType dumping should not use the static char buffer[thingy] idiom
+        https://bugs.webkit.org/show_bug.cgi?id=103584
+
+        Reviewed by Michael Saboff.
+
+        Changed SpeculatedType to be "dumpable" by saying things like:
+        
+        dataLog("thingy = ", SpeculationDump(thingy))
+        
+        Removed the old stringification functions, and changed all code that referred to them
+        to use the new dataLog()/print() style.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::dumpSpeculationAbbreviated):
+        * bytecode/SpeculatedType.h:
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::dump):
+        * bytecode/VirtualRegister.h:
+        (WTF::printInternal):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGStructureAbstractValue.h:
+        * dfg/DFGVariableAccessDataDump.cpp: Added.
+        (JSC::DFG::VariableAccessDataDump::VariableAccessDataDump):
+        (JSC::DFG::VariableAccessDataDump::dump):
+        * dfg/DFGVariableAccessDataDump.h: Added.
+        (VariableAccessDataDump):
+
+2012-11-28  Michael Saboff  <msaboff@apple.com>
+
+        Change Bytecompiler s_dumpsGeneratedCode to an Options value
+        https://bugs.webkit.org/show_bug.cgi?id=103588
+
+        Reviewed by Filip Pizlo.
+
+        Moved the control of dumping bytecodes to Options::dumpGeneratedBytecodes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/Options.h:
+
+2012-11-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Copying phase should use work lists
+        https://bugs.webkit.org/show_bug.cgi?id=101390
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        * heap/BlockAllocator.h: New RegionSet for CopyWorkListSegments.
+        (BlockAllocator):
+        (JSC::CopyWorkListSegment):
+        * heap/CopiedBlock.h: Added a per-block CopyWorkList to keep track of the JSCells that need to be revisited during the copying
+        phase to copy their backing stores.
+        (CopiedBlock):
+        (JSC::CopiedBlock::CopiedBlock): 
+        (JSC::CopiedBlock::didSurviveGC):
+        (JSC::CopiedBlock::didEvacuateBytes): There is now a one-to-one relationship between GCThreads and the CopiedBlocks they're 
+        responsible for evacuating, we no longer need any of that fancy compare and swap stuff. 
+        (JSC::CopiedBlock::pin):
+        (JSC::CopiedBlock::hasWorkList): 
+        (JSC::CopiedBlock::workList):
+        * heap/CopiedBlockInlines.h: Added.
+        (JSC::CopiedBlock::reportLiveBytes): Since we now have to grab a SpinLock to perform operations on the CopyWorkList during marking,
+        we don't need to do any of that fancy compare and swap stuff we were doing for tracking live bytes.
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::pin):
+        * heap/CopyVisitor.cpp:
+        (JSC::CopyVisitor::copyFromShared): We now iterate over a range of CopiedBlocks rather than MarkedBlocks and revisit the cells in those
+        blocks' CopyWorkLists.
+        * heap/CopyVisitor.h:
+        (CopyVisitor):
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::visitCell): The function responsible for calling the correct copyBackingStore() function for each JSCell from 
+        a CopiedBlock's CopyWorkList.
+        (JSC::CopyVisitor::didCopy): We no longer need to check if the block is empty here because we know exactly when we're done 
+        evacuating a CopiedBlock, which is when we've gone through all of the CopiedBlock's CopyWorkList.
+        * heap/CopyWorkList.h: Added.
+        (CopyWorkListSegment): Individual chunk of a CopyWorkList that is allocated from the BlockAllocator.
+        (JSC::CopyWorkListSegment::create):
+        (JSC::CopyWorkListSegment::size):
+        (JSC::CopyWorkListSegment::isFull):
+        (JSC::CopyWorkListSegment::get):
+        (JSC::CopyWorkListSegment::append):
+        (JSC::CopyWorkListSegment::CopyWorkListSegment):
+        (JSC::CopyWorkListSegment::data):
+        (JSC::CopyWorkListSegment::endOfBlock):
+        (CopyWorkListIterator): Responsible for giving CopyVisitors a contiguous notion of access across the separate CopyWorkListSegments
+        that make up each CopyWorkList.
+        (JSC::CopyWorkListIterator::get):
+        (JSC::CopyWorkListIterator::operator*):
+        (JSC::CopyWorkListIterator::operator->):
+        (JSC::CopyWorkListIterator::operator++):
+        (JSC::CopyWorkListIterator::operator==):
+        (JSC::CopyWorkListIterator::operator!=):
+        (JSC::CopyWorkListIterator::CopyWorkListIterator):
+        (CopyWorkList): Data structure that keeps track of the JSCells that need copying in a particular CopiedBlock.
+        (JSC::CopyWorkList::CopyWorkList):
+        (JSC::CopyWorkList::~CopyWorkList):
+        (JSC::CopyWorkList::append):
+        (JSC::CopyWorkList::begin):
+        (JSC::CopyWorkList::end):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData): We no longer use the m_blockSnapshot from the Heap during the copying phase.
+        (JSC::GCThreadSharedData::didStartCopying): We now copy the set of all blocks in the CopiedSpace to a separate vector for 
+        iterating over during the copying phase since the set stored in the CopiedSpace will change as blocks are evacuated and 
+        recycled throughout the copying phase.
+        * heap/GCThreadSharedData.h:
+        (GCThreadSharedData): 
+        * heap/Heap.h:
+        (Heap):
+        * heap/SlotVisitor.h: We now need to know the object who is being marked that has a backing store so that we can store it 
+        in a CopyWorkList to revisit later during the copying phase.
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+
+2012-11-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Disassembly methods should be able to disassemble to any PrintStream& rather than always using WTF::dataFile()
+        https://bugs.webkit.org/show_bug.cgi?id=103492
+
+        Reviewed by Mark Hahnenberg.
+
+        Switched disassembly code to use PrintStream&, and to use print() rather than printf().
+
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dump):
+        (DFG):
+        (JSC::DFG::Disassembler::dumpDisassembly):
+        * dfg/DFGDisassembler.h:
+        (Disassembler):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::printWhiteSpace):
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::printNodeWhiteSpace):
+        (JSC::DFG::Graph::dump):
+        (DFG):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dump):
+        (JSC::JITDisassembler::dumpForInstructions):
+        (JSC::JITDisassembler::dumpDisassembly):
+        * jit/JITDisassembler.h:
+        (JITDisassembler):
+
+2012-11-28  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to say dataLog("count = ", count, "\n") instead of dataLogF("count = %d\n", count)
+        https://bugs.webkit.org/show_bug.cgi?id=103009
+
+        Reviewed by Michael Saboff.
+
+        Instead of converting all of JSC to use the new dataLog()/print() methods, I just changed
+        one place: dumping of abstract values. This is mainly just to ensure that the code I
+        added to WTF is actually doing things.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::dump):
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::dump):
+        (WTF):
+        (WTF::printInternal):
+
+2012-11-28  Oliver Hunt  <oliver@apple.com>
+
+        Make source cache include more information about the function extent.
+        https://bugs.webkit.org/show_bug.cgi?id=103552
+
+        Reviewed by Gavin Barraclough.
+
+        Add a bit more information to the source cache.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+           Store the function start offset
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        (SourceProviderCacheItem):
+           Add additional field for the start of the real function string, and re-arrange
+           fields to avoid growing the struct.
+
+2012-11-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Convert some remaining uses of FILE* to PrintStream&.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::dump):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::dump):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::dumpChildren):
+
+2012-11-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation in JSValue.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/JSValue.h:
+
+2012-11-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SetLocal should use forwardSpeculationCheck instead of its own half-baked version of same
+        https://bugs.webkit.org/show_bug.cgi?id=103353
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        Made it possible to use forward speculations for most of the operand classes. Changed the conditional
+        direction parameter from being 'bool isForward' to an enum (SpeculationDirection). Changed SetLocal
+        to use forward speculations and got rid of its half-baked version of same.
+        
+        Also added the ability to force the DFG's disassembler to dump all nodes, even ones that are dead.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dump):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateIntegerOperand::gpr):
+        (SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateDoubleOperand::fpr):
+        (SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (JSC::DFG::SpeculateCellOperand::gpr):
+        (SpeculateCellOperand):
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        (JSC::DFG::SpeculateBooleanOperand::gpr):
+        (SpeculateBooleanOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Options.h:
+        (JSC):
+
+2012-11-26  Daniel Bates  <dbates@webkit.org>
+
+        Substitute "allSeparators8Bit" for "allSeperators8Bit" in JSC::jsSpliceSubstringsWithSeparators()
+        <https://bugs.webkit.org/show_bug.cgi?id=103303>
+
+        Reviewed by Simon Fraser.
+
+        Fix misspelled word, "Seperators" [sic], in a local variable name in JSC::jsSpliceSubstringsWithSeparators().
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+
+2012-11-26  Daniel Bates  <dbates@webkit.org>
+
+        JavaScript fails to handle String.replace() with large replacement string
+        https://bugs.webkit.org/show_bug.cgi?id=102956
+        <rdar://problem/12738012>
+
+        Reviewed by Oliver Hunt.
+
+        Fix an issue where we didn't check for overflow when computing the length
+        of the result of String.replace() with a large replacement string.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+
+2012-11-26  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt] Fix the LLInt build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=97587
+
+        Reviewed by Simon Hausmann.
+
+        * DerivedSources.pri:
+        * JavaScriptCore.pro:
+
+2012-11-26  Oliver Hunt  <oliver@apple.com>
+
+        32-bit build fix.  Move the method decalration outside of the X86_64 only section.
+
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::shouldConsiderBlinding):
+
+2012-11-26  Oliver Hunt  <oliver@apple.com>
+
+        Don't blind all the things.
+        https://bugs.webkit.org/show_bug.cgi?id=102572
+
+        Reviewed by Gavin Barraclough.
+
+        No longer blind all the constants in the instruction stream.  We use a
+        simple non-deterministic filter to avoid blinding everything.  Also modified
+        the basic integer blinding logic to avoid blinding small negative values.
+
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::shouldConsiderBlinding):
+        (JSC::MacroAssembler::shouldBlind):
+
+2012-11-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject::copyButterfly doesn't handle undecided indexing types correctly
+        https://bugs.webkit.org/show_bug.cgi?id=102573
+
+        Reviewed by Filip Pizlo.
+
+        We don't do any copying into the newly allocated vector and we don't zero-initialize CopiedBlocks 
+        during the copying phase, so we end up with uninitialized memory in arrays which have undecided indexing 
+        types. We should just do the actual memcpy from the old block to the new one. 
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly): Just do the same thing that we do for other contiguous indexing types.
+
+2012-11-26  Julien BRIANCEAU   <jbrianceau@nds.com>
+
+        [sh4] JavaScriptCore JIT build is broken since r135330
+        Add missing implementation for sh4 arch.
+        https://bugs.webkit.org/show_bug.cgi?id=103145
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::canJumpReplacePatchableBranchPtrWithPatch):
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::startOfBranchPtrWithPatchOnRegister):
+        (JSC::MacroAssemblerSH4::revertJumpReplacementToBranchPtrWithPatch):
+        (JSC::MacroAssemblerSH4::startOfPatchableBranchPtrWithPatchOnAddress):
+        (JSC::MacroAssemblerSH4::revertJumpReplacementToPatchableBranchPtrWithPatch):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::revertJump):
+        (SH4Assembler):
+        (JSC::SH4Assembler::printInstr):
+
+2012-11-26  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Use load64 instead of loadPtr to load a JSValue on JSVALUE64 platforms
+        https://bugs.webkit.org/show_bug.cgi?id=100909
+
+        Reviewed by Brent Fulgham.
+
+        This is a (trivial) fix after r132701.
+
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2012-11-26  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        [Qt][ARM] REGRESSION(r130826): It made 33 JSC test and 466 layout tests crash
+        https://bugs.webkit.org/show_bug.cgi?id=98857
+
+        Reviewed by Zoltan Herczeg.
+
+        Implement a new version of patchableBranch32 to fix crashing JSC
+        tests.
+
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::patchableBranch32):
+        (MacroAssemblerARM):
+
+2012-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Any function that can log things should be able to easily log them to a memory buffer as well
+        https://bugs.webkit.org/show_bug.cgi?id=103000
+
+        Reviewed by Sam Weinig.
+
+        Change all users of WTF::dataFile() to expect a PrintStream& rather than a FILE*.
+
+        * bytecode/Operands.h:
+        (JSC::OperandValueTraits::dump):
+        (JSC::dumpOperands):
+        (JSC):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::NodeIndexTraits::dump):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::dump):
+        * dfg/DFGVariableEvent.cpp:
+        (JSC::DFG::VariableEvent::dump):
+        (JSC::DFG::VariableEvent::dumpFillInfo):
+        (JSC::DFG::VariableEvent::dumpSpillInfo):
+        * dfg/DFGVariableEvent.h:
+        (VariableEvent):
+        * disassembler/Disassembler.h:
+        (JSC):
+        (JSC::tryToDisassemble):
+        * disassembler/UDis86Disassembler.cpp:
+        (JSC::tryToDisassemble):
+
+2012-11-23  Alexis Menard  <alexis@webkit.org>
+
+        [CSS3 Backgrounds and Borders] Implement new CSS3 background-position parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=102104
+
+        Reviewed by Julien Chaffraix.
+
+        Protect the new feature behind a feature flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-23  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Fix the ARM traditional build after r135330
+        https://bugs.webkit.org/show_bug.cgi?id=102871
+
+        Reviewed by Zoltan Herczeg.
+
+        Added missing functionality to traditional ARM architecture.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::revertJump):
+        (ARMAssembler):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatchOnAddress):
+        (JSC::MacroAssemblerARM::startOfBranchPtrWithPatchOnRegister):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
+
+2012-11-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Memory instrumentation: extract MemoryObjectInfo declaration into a separate file
+        https://bugs.webkit.org/show_bug.cgi?id=102510
+
+        Reviewed by Pavel Feldman.
+
+        Added new symbols for the methods that have moved into .../wtf/MemoryInstrumentation.cpp
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-11-23  Julien BRIANCEAU   <jbrianceau@nds.com>
+
+        [sh4] JavaScriptCore JIT build is broken since r130839
+        Add missing implementation for sh4 arch.
+        https://bugs.webkit.org/show_bug.cgi?id=101479
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load8Signed):
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::load16Signed):
+        (JSC::MacroAssemblerSH4::store8):
+        (JSC::MacroAssemblerSH4::store16):
+        (JSC::MacroAssemblerSH4::moveDoubleToInts):
+        (JSC::MacroAssemblerSH4::moveIntsToDouble):
+        (JSC::MacroAssemblerSH4::loadFloat):
+        (JSC::MacroAssemblerSH4::loadDouble):
+        (JSC::MacroAssemblerSH4::storeFloat):
+        (JSC::MacroAssemblerSH4::storeDouble):
+        (JSC::MacroAssemblerSH4::addDouble):
+        (JSC::MacroAssemblerSH4::convertFloatToDouble):
+        (JSC::MacroAssemblerSH4::convertDoubleToFloat):
+        (JSC::MacroAssemblerSH4::urshift32):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::sublRegReg):
+        (JSC::SH4Assembler::subvlRegReg):
+        (JSC::SH4Assembler::floatfpulfrn):
+        (JSC::SH4Assembler::fldsfpul):
+        (JSC::SH4Assembler::fstsfpul):
+        (JSC::SH4Assembler::dcnvsd):
+        (SH4Assembler):
+        (JSC::SH4Assembler::movbRegMem):
+        (JSC::SH4Assembler::sizeOfConstantPool):
+        (JSC::SH4Assembler::linkJump):
+        (JSC::SH4Assembler::printInstr):
+        (JSC::SH4Assembler::printBlockInstr):
+
+2012-11-22  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        Fix the MIPS build after r135330
+        https://bugs.webkit.org/show_bug.cgi?id=102872
+
+        Reviewed by Gavin Barraclough.
+
+        Revert/replace functions added to MIPS port.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::revertJumpToMove):
+        (MIPSAssembler):
+        (JSC::MIPSAssembler::replaceWithJump):
+        * assembler/MacroAssemblerMIPS.h:
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::startOfBranchPtrWithPatchOnRegister):
+        (JSC::MacroAssemblerMIPS::revertJumpReplacementToBranchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatchOnAddress):
+
+2012-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename dataLog() and dataLogV() to dataLogF() and dataLogFV()
+        https://bugs.webkit.org/show_bug.cgi?id=103001
+
+        Rubber stamped by Dan Bernstein.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        (JSC::LinkBuffer::dumpLinkStatistics):
+        (JSC::LinkBuffer::dumpCode):
+        * assembler/LinkBuffer.h:
+        (JSC):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::vprintfStdoutInstr):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::dumpStructure):
+        (JSC::dumpChain):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::reoptimize):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        (JSC::CodeBlock::dumpValueProfiles):
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::stop):
+        (JSC::SamplingRegion::dumpInternal):
+        (JSC::SamplingTool::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::processPhiStack):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        (JSC::DFG::CFAPhase::performForwardCFA):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
+        (JSC::DFG::CFGSimplificationPhase::fixPhis):
+        (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
+        (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::endIndexForPureCSE):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::debugFail):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dump):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixDoubleEdge):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::printWhiteSpace):
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::predictArgumentTypes):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::beginPhase):
+        * dfg/DFGPhase.h:
+        (JSC::DFG::runAndLog):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::propagateForward):
+        (JSC::DFG::PredictionPropagationPhase::propagateBackward):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::dump):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::use):
+        (JSC::DFG::ScoreBoard::dump):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::generate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        (JSC::DFG::SpeculativeJIT::dump):
+        (JSC::DFG::SpeculativeJIT::checkConsistency):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * dfg/DFGValidate.cpp:
+        (Validate):
+        (JSC::DFG::Validate::reportValidationContext):
+        (JSC::DFG::Validate::dumpData):
+        (JSC::DFG::Validate::dumpGraphIfAppropriate):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::logEvent):
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * heap/Heap.cpp:
+        * heap/HeapStatistics.cpp:
+        (JSC::HeapStatistics::logStatistics):
+        (JSC::HeapStatistics::showObjectStatistics):
+        * heap/MarkStack.h:
+        * heap/MarkedBlock.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::validate):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dump):
+        (JSC::JITDisassembler::dumpForInstructions):
+        * jit/JITStubRoutine.h:
+        (JSC):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JumpReplacementWatchpoint.cpp:
+        (JSC::JumpReplacementWatchpoint::fireInternal):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_trace_operand):
+        (JSC::LLInt::llint_trace_value):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        * profiler/Profile.cpp:
+        (JSC::Profile::debugPrintData):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::dumpRegExpTrace):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::matchCompareWithInterpreter):
+        * runtime/SamplingCounter.cpp:
+        (JSC::AbstractSamplingCounter::dump):
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpStatistics):
+        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::report):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::dumpInternal):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+
+2012-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to say disassemble(stuff) instead of having to say if (!tryToDisassemble(stuff)) dataLog("I failed")
+        https://bugs.webkit.org/show_bug.cgi?id=103010
+
+        Reviewed by Anders Carlsson.
+
+        You can still say tryToDisassemble(), which will tell you if it failed; you can then
+        decide what to do instead. But it's better to say disassemble(), which will just print
+        the instruction ranges if tryToDisassemble() failed. This is particularly appropriate
+        since that's what all previous users of tryToDisassemble() would have done in some
+        form or another.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dumpDisassembly):
+        * disassembler/Disassembler.cpp: Added.
+        (JSC):
+        (JSC::disassemble):
+        * disassembler/Disassembler.h:
+        (JSC):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dumpDisassembly):
+
+2012-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        dumpOperands() claims that it needs a non-const Operands& when that is completely false
+        https://bugs.webkit.org/show_bug.cgi?id=103005
+
+        Reviewed by Eric Carlson.
+
+        * bytecode/Operands.h:
+        (JSC::dumpOperands):
+        (JSC):
+
+2012-11-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT's disassembly should be just as pretty as the DFG's
+        https://bugs.webkit.org/show_bug.cgi?id=102873
+
+        Reviewed by Sam Weinig.
+
+        Integrated the CodeBlock's bytecode dumper with the JIT's disassembler. Also fixed
+        some type goof-ups (instructions are not in a Vector<Instruction> so using a Vector
+        iterator makes no sense) and stream-lined some things (you don't actually need a
+        full-fledged ExecState* to dump bytecode).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dump):
+        (JSC):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpCallFrame):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITDisassembler.cpp: Added.
+        (JSC):
+        (JSC::JITDisassembler::JITDisassembler):
+        (JSC::JITDisassembler::~JITDisassembler):
+        (JSC::JITDisassembler::dump):
+        (JSC::JITDisassembler::dumpForInstructions):
+        (JSC::JITDisassembler::dumpDisassembly):
+        * jit/JITDisassembler.h: Added.
+        (JSC):
+        (JITDisassembler):
+        (JSC::JITDisassembler::setStartOfCode):
+        (JSC::JITDisassembler::setForBytecodeMainPath):
+        (JSC::JITDisassembler::setForBytecodeSlowPath):
+        (JSC::JITDisassembler::setEndOfSlowPath):
+        (JSC::JITDisassembler::setEndOfCode):
+
+2012-11-21  Daniel Bates  <dbates@webkit.org>
+
+        JavaScript fails to concatenate large strings
+        <https://bugs.webkit.org/show_bug.cgi?id=102963>
+
+        Reviewed by Michael Saboff.
+
+        Fixes an issue where we inadvertently didn't check the length of
+        a JavaScript string for overflow.
+
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsStringFromArguments):
+
+2012-11-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to cache closure calls (part 2/2)
+        https://bugs.webkit.org/show_bug.cgi?id=102662
+
+        Reviewed by Gavin Barraclough.
+
+        Added caching of calls where the JSFunction* varies, but the Structure* and ExecutableBase*
+        stay the same. This is accomplished by replacing the branch that compares against a constant
+        JSFunction* with a jump to a closure call stub. The closure call stub contains a fast path,
+        and jumps slow directly to the virtual call thunk.
+
+        Looks like a 1% win on V8v7.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CallLinkInfo.h:
+        (CallLinkInfo):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::getCallLinkInfoBytecodeIndex):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC):
+        (JSC::CodeBlock::findClosureCallForReturnPC):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::codeOriginForReturn):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getCallLinkInfo):
+        (CodeBlock):
+        (JSC::CodeBlock::isIncomingCallAlreadyLinked):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addJSCall):
+        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
+        (JSCallRecord):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::linkSlowFor):
+        (DFG):
+        (JSC::DFG::dfgLinkFor):
+        (JSC::DFG::dfgLinkSlowFor):
+        (JSC::DFG::dfgLinkClosureCall):
+        * dfg/DFGRepatch.h:
+        (DFG):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGThunks.cpp:
+        (DFG):
+        (JSC::DFG::linkClosureCallThunkGenerator):
+        * dfg/DFGThunks.h:
+        (DFG):
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::jitStubRoutines):
+        * heap/JITStubRoutineSet.h:
+        (JSC::JITStubRoutineSet::size):
+        (JSC::JITStubRoutineSet::at):
+        (JITStubRoutineSet):
+        * jit/ClosureCallStubRoutine.cpp: Added.
+        (JSC):
+        (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
+        (JSC::ClosureCallStubRoutine::~ClosureCallStubRoutine):
+        (JSC::ClosureCallStubRoutine::markRequiredObjectsInternal):
+        * jit/ClosureCallStubRoutine.h: Added.
+        (JSC):
+        (ClosureCallStubRoutine):
+        (JSC::ClosureCallStubRoutine::structure):
+        (JSC::ClosureCallStubRoutine::executable):
+        (JSC::ClosureCallStubRoutine::codeOrigin):
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
+        * jit/GCAwareJITStubRoutine.h:
+        (GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::isClosureCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2012-11-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to cache closure calls (part 1/2)
+        https://bugs.webkit.org/show_bug.cgi?id=102662
+
+        Reviewed by Gavin Barraclough.
+
+        Add ability to revert a jump replacement back to
+        branchPtrWithPatch(Condition, RegisterID, TrustedImmPtr). This is meant to be
+        a mandatory piece of functionality for all assemblers. I also renamed some of
+        the functions for reverting jump replacements back to
+        patchableBranchPtrWithPatch(Condition, Address, TrustedImmPtr), so as to avoid
+        confusion.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::BadReg):
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::revertJumpTo_movT3):
+        * assembler/LinkBuffer.h:
+        (JSC):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::startOfBranchPtrWithPatchOnRegister):
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatchOnAddress):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::startOfBranchPtrWithPatchOnRegister):
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatchOnAddress):
+        (JSC::MacroAssemblerX86::revertJumpReplacementToBranchPtrWithPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::startOfBranchPtrWithPatchOnRegister):
+        (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatchOnAddress):
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::startOfBranchPtrWithPatchOnRegister):
+        (RepatchBuffer):
+        (JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatchOnAddress):
+        (JSC::RepatchBuffer::revertJumpReplacementToBranchPtrWithPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::revertJumpTo_cmpl_ir_force32):
+        (X86Assembler):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::replaceWithJump):
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+
+2012-11-20  Yong Li  <yoli@rim.com>
+
+        [ARMv7] Neither linkCall() nor linkPointer() should flush code.
+        https://bugs.webkit.org/show_bug.cgi?id=99213
+
+        Reviewed by George Staikos.
+
+        LinkBuffer doesn't need to flush code during linking. It will
+        eventually flush the whole executable. Fixing this gives >%5
+        sunspider boost (on QNX).
+
+        Also make replaceWithLoad() and replaceWithAddressComputation() flush
+        only when necessary.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::linkCall):
+        (JSC::ARMv7Assembler::linkPointer):
+        (JSC::ARMv7Assembler::relinkCall):
+        (JSC::ARMv7Assembler::repatchInt32):
+        (JSC::ARMv7Assembler::repatchPointer):
+        (JSC::ARMv7Assembler::replaceWithLoad): Flush only after it did write.
+        (JSC::ARMv7Assembler::replaceWithAddressComputation): Flush only after it did write.
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::setPointer):
+
+2012-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove support for ARMv7 errata from the jump code
+        https://bugs.webkit.org/show_bug.cgi?id=102759
+
+        Reviewed by Oliver Hunt.
+
+        The jump replacement code was wrong to begin with since it wasn't doing
+        a cache flush on the inserted padding. And, to my knowledge, we don't need
+        this anymore, so this patch removes all errata code from the ARMv7 port.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::replaceWithJump):
+        (JSC::ARMv7Assembler::maxJumpReplacementSize):
+        (JSC::ARMv7Assembler::canBeJumpT3):
+        (JSC::ARMv7Assembler::canBeJumpT4):
+
+2012-11-19  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Create JavaScriptCore ForwardingHeaders
+        https://bugs.webkit.org/show_bug.cgi?id=92665
+
+        Reviewed by Brent Fulgham.
+
+        When using CMake to build the Windows port, we need
+        to generate the forwarding headers with it too.
+
+        * CMakeLists.txt:
+
+2012-11-19  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        Add PROXIMITY_EVENTS feature
+        https://bugs.webkit.org/show_bug.cgi?id=102658
+
+        Reviewed by Kentaro Hara.
+
+        Add PROXIMITY_EVENTS feature to xcode project for JavaScriptCore.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-18  Dan Bernstein  <mitz@apple.com>
+
+        Try to fix the DFG build after r135099.
+
+        * dfg/DFGCommon.h:
+        (JSC::DFG::shouldShowDisassembly):
+
+2012-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix for !ENABLE(DFG_JIT).
+
+        * dfg/DFGCommon.h:
+        (JSC::DFG::shouldShowDisassembly):
+        (DFG):
+
+2012-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should have more logging in structure-related code
+        https://bugs.webkit.org/show_bug.cgi?id=102630
+
+        Reviewed by Simon Fraser.
+
+        - JSValue::description() now tells you if something is a structure, and if so,
+          what kind of structure it is.
+        
+        - Jettisoning logic now tells you why things are being jettisoned.
+        
+        - It's now possible to turn off GC-triggered jettisoning entirely.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::reoptimize):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/Options.h:
+        (JSC):
+
+2012-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG constant folding phase should say 'changed = true' whenever it changes the graph
+        https://bugs.webkit.org/show_bug.cgi?id=102550
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2012-11-17  Elliott Sprehn  <esprehn@chromium.org>
+
+        Expose JSObject removeDirect and PrivateName to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=102546
+
+        Reviewed by Geoffrey Garen.
+
+        Export removeDirect for use in WebCore so JSDependentRetained works.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Given a PutById or GetById with a proven structure, the DFG should be able to emit a PutByOffset or GetByOffset instead
+        https://bugs.webkit.org/show_bug.cgi?id=102327
+
+        Reviewed by Mark Hahnenberg.
+
+        If the profiler tells us that a GetById or PutById may be polymorphic but our
+        control flow analysis proves that it isn't, we should trust the control flow
+        analysis over the profiler. This arises in cases where GetById or PutById were
+        inlined: the inlined function may have been called from other places that led
+        to polymorphism, but in the current inlined context, there is no polymorphism.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        (JSC):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (GetByIdStatus):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        (JSC):
+        * bytecode/PutByIdStatus.h:
+        (JSC):
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (PutByIdStatus):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::bestProvenStructure):
+        (AbstractValue):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        (ConstantFoldingPhase):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToGetByOffset):
+        (Node):
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::hasStorageResult):
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeChain):
+        (JSC):
+        (JSC::Structure::isValid):
+        * runtime/Operations.h:
+        (JSC::isPrototypeChainNormalized):
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::transitionDidInvolveSpecificValue):
+
+2012-11-16  Tony Chang  <tony@chromium.org>
+
+        Remove ENABLE_CSS_HIERARCHIES since it's no longer in use
+        https://bugs.webkit.org/show_bug.cgi?id=102554
+
+        Reviewed by Andreas Kling.
+
+        As mentioned in https://bugs.webkit.org/show_bug.cgi?id=79939#c41 ,
+        we're going to revist this feature once additional vendor support is
+        achieved.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for WinCE after r133688.
+
+        Use numeric_limits<uint32_t>::max() instead of UINT32_MAX.
+
+        * runtime/CodeCache.h:
+        (JSC::CacheMap::CacheMap):
+
+2012-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        ClassInfo.h should have correct indentation.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        ClassInfo.h had some true creativity in its use of whitespace. Some things within
+        the namespace were indented four spaces and others where not. One #define had its
+        contents indented four spaces, while another didn't. I applied the following rule:
+        
+        - Non-macro things in the namespace should not be indented (that's our current
+          accepted practice).
+        
+        - Macros should never be indented but if they are multi-line then their subsequent
+          bodies should be indented four spaces. I believe that is consistent with what we
+          do elsewhere.
+
+        * runtime/ClassInfo.h:
+        (JSC):
+        (MethodTable):
+        (ClassInfo):
+        (JSC::ClassInfo::propHashTable):
+        (JSC::ClassInfo::isSubClassOf):
+        (JSC::ClassInfo::hasStaticProperties):
+
+2012-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should copy propagate trivially no-op ConvertThis
+        https://bugs.webkit.org/show_bug.cgi?id=102445
+
+        Reviewed by Oliver Hunt.
+
+        Copy propagation is always a good thing, since it reveals must-alias relationships
+        to the CFA and CSE. This accomplishes copy propagation for ConvertThis by first
+        converting it to an Identity node (which is done by the constant folder since it
+        has access to CFA results) and then performing substitution of references to
+        Identity with references to Identity's child in the CSE.
+        
+        I'm not aiming for a big speed-up here; I just think that this will be useful for
+        the work on https://bugs.webkit.org/show_bug.cgi?id=102327.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        CallData.h should have correct indentation.
+
+        Rubber stamped by Mark Hahneberg.
+
+        * runtime/CallData.h:
+        (JSC):
+
+2012-11-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove methodCallDummy since it is not used anymore.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+
+2012-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure should be able to easily tell if the prototype chain might intercept a store
+        https://bugs.webkit.org/show_bug.cgi?id=102326
+
+        Reviewed by Geoffrey Garen.
+
+        This improves our ability to reason about the correctness of the more optimized
+        prototype chain walk in JSObject::put(), while also making it straight forward to
+        check if the prototype chain will do strange things to a property store by just
+        looking at the structure.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/Structure.cpp:
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+
+2012-11-15  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [CMake] Do not regenerate LLIntAssembly.h on every incremental build
+        https://bugs.webkit.org/show_bug.cgi?id=102248
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Update LLIntAssembly.h's mtime after running asm.rb to make the build
+        system dependency tracking consistent.
+
+        * CMakeLists.txt:
+
+2012-11-15  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Fix compiler warnings about signed/unsigned comparison on i386
+        https://bugs.webkit.org/show_bug.cgi?id=102249
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add casting to unsigned to shut up gcc warnings. Build was broken on
+        JSVALUE32_64 ports compiling with -Werror.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+
+2012-11-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows, WinCairo] Unreviewed build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Missed one of the exports that was part of the WebKit2.def.
+
+2012-11-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows, WinCairo] Correct build failure.
+        https://bugs.webkit.org/show_bug.cgi?id=102302
+
+        WebCore symbols were mistakenly added to the JavaScriptCore
+        library definition file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove
+        WebCore symbols that were incorrectly added to the export file.
+
+2012-11-14  Mark Lam  <mark.lam@apple.com>
+
+        Change JSEventListener::m_jsFunction to be a weak ref.
+        https://bugs.webkit.org/show_bug.cgi?id=101989.
+
+        Reviewed by Geoffrey Garen.
+
+        Added infrastructure for scanning weak ref slots.
+
+        * heap/SlotVisitor.cpp: Added #include "SlotVisitorInlines.h".
+        * heap/SlotVisitor.h:
+        (SlotVisitor): Added SlotVisitor::appendUnbarrieredWeak().
+        * heap/SlotVisitorInlines.h: Added #include "Weak.h".
+        (JSC::SlotVisitor::appendUnbarrieredWeak): Added.
+        * heap/Weak.h:
+        (JSC::operator==): Added operator==() for Weak.
+        * runtime/JSCell.h: Removed #include "SlotVisitorInlines.h".
+        * runtime/JSObject.h: Added #include "SlotVisitorInlines.h".
+
+2012-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Read-only properties created with putDirect() should tell the structure that there are read-only properties
+        https://bugs.webkit.org/show_bug.cgi?id=102292
+
+        Reviewed by Gavin Barraclough.
+
+        This mostly affects things like function.length.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2012-11-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't access Node& after adding nodes to the graph.
+        https://bugs.webkit.org/show_bug.cgi?id=102005
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2012-11-14  Valery Ignatyev  <valery.ignatyev@ispras.ru>
+
+        Replace (typeof(x) != <"object", "undefined", ...>) with
+        !(typeof(x) == <"object",..>). Later is_object, is_<...>  bytecode operation
+        will be used.
+
+        https://bugs.webkit.org/show_bug.cgi?id=98893
+
+        Reviewed by Filip Pizlo.
+
+        This eliminates expensive  typeof implementation and
+        allows to use DFG optimizations, which doesn't support 'typeof'.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BinaryOpNode::emitBytecode):
+
+2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        [Qt][ARM]REGRESSION(r133985): It broke the build
+        https://bugs.webkit.org/show_bug.cgi?id=101740
+
+        Reviewed by Csaba Osztrogonác.
+
+        Changed the emitGenericContiguousPutByVal to accept the additional IndexingType argument.
+        This information was passed as a template parameter.        
+
+        * jit/JIT.h:
+        (JSC::JIT::emitInt32PutByVal):
+        (JSC::JIT::emitDoublePutByVal):
+        (JSC::JIT::emitContiguousPutByVal):
+        (JIT):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGenericContiguousPutByVal):
+
+2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Fix the MIPS build after r134332
+        https://bugs.webkit.org/show_bug.cgi?id=102227
+
+        Reviewed by Csaba Osztrogonác.
+
+        Added missing methods for the MacroAssemblerMIPS, based on the MacroAssemblerARMv7.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::canJumpReplacePatchableBranchPtrWithPatch):
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch):
+
+2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Fix the [-Wreturn-type] warning in JavaScriptCore/assembler/MacroAssemblerARM.h
+        https://bugs.webkit.org/show_bug.cgi?id=102206
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add a return value for the function to suppress the warning.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatch):
+
+2012-11-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r134599.
+        http://trac.webkit.org/changeset/134599
+        https://bugs.webkit.org/show_bug.cgi?id=102225
+
+        It broke the 32 bit EFL build (Requested by Ossy on #webkit).
+
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+
+2012-11-14  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        [Qt][ARM]REGRESSION(r133985): It broke the build
+        https://bugs.webkit.org/show_bug.cgi?id=101740
+
+        Reviewed by Csaba Osztrogonác.
+
+        Template function body moved to fix VALUE_PROFILER disabled case.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+
+2012-11-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CreateThis should be able to statically account for the structure of the object it creates, if profiling indicates that this structure is always the same
+        https://bugs.webkit.org/show_bug.cgi?id=102017
+
+        Reviewed by Geoffrey Garen.
+
+        This adds a watchpoint in JSFunction on the cached inheritor ID. It also changes
+        NewObject to take a structure as an operand (previously it implicitly used the owning
+        global object's empty object structure). Any GetCallee where the callee is predictable
+        is turned into a CheckFunction + WeakJSConstant, and any CreateThis on a WeakJSConstant
+        where the inheritor ID watchpoint is still valid is turned into an InheritorIDWatchpoint
+        followed by a NewObject. NewObject already accounts for the structure it uses for object
+        creation in the CFA.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::checkFunctionElimination):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasFunction):
+        (JSC::DFG::Node::function):
+        (JSC::DFG::Node::hasStructure):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Executable.h:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSBoundFunction.cpp:
+        (JSC):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::tryGetKnownInheritorID):
+        (JSFunction):
+        (JSC::JSFunction::addInheritorIDWatchpoint):
+
+2012-11-13  Filip Pizlo  <fpizlo@apple.com>
+
+        JSFunction and its descendants should be destructible
+        https://bugs.webkit.org/show_bug.cgi?id=102062
+
+        Reviewed by Mark Hahnenberg.
+
+        This will make it easy to place an InlineWatchpointSet inside JSFunction. In the
+        future, we could make JSFunction non-destructible again by making a version of
+        WatchpointSet that is entirely GC'd, but this seems like overkill for now.
+        
+        This is performance-neutral.
+
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::destroy):
+        (JSC):
+        * runtime/JSBoundFunction.h:
+        (JSBoundFunction):
+        * runtime/JSFunction.cpp:
+        (JSC):
+        (JSC::JSFunction::destroy):
+        * runtime/JSFunction.h:
+        (JSFunction):
+
+2012-11-13  Cosmin Truta  <ctruta@rim.com>
+
+        Uninitialized fields in class JSLock
+        https://bugs.webkit.org/show_bug.cgi?id=101695
+
+        Reviewed by Mark Hahnenberg.
+
+        Initialize JSLock::m_ownerThread and JSLock::m_lockDropDepth.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::JSLock):
+
+2012-11-13  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Fix the ARM traditional build after r134332
+        https://bugs.webkit.org/show_bug.cgi?id=102044
+
+        Reviewed by Zoltan Herczeg.
+
+        Added missing methods for the MacroAssemblerARM, based on the MacroAssemblerARMv7.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::canJumpReplacePatchableBranchPtrWithPatch):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch):
+
+2012-11-12  Filip Pizlo  <fpizlo@apple.com>
+
+        op_get_callee should have value profiling
+        https://bugs.webkit.org/show_bug.cgi?id=102047
+
+        Reviewed by Sam Weinig.
+
+        This will allow us to detect if the callee is always the same, which is probably
+        the common case for a lot of constructors.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_callee):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_callee):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-11-12  Filip Pizlo  <fpizlo@apple.com>
+
+        The act of getting the callee during 'this' construction should be explicit in bytecode
+        https://bugs.webkit.org/show_bug.cgi?id=102016
+
+        Reviewed by Michael Saboff.
+
+        This is mostly a rollout of http://trac.webkit.org/changeset/116673, but also includes
+        changes to have create_this use the result of get_callee.
+        
+        No performance or behavioral impact. This is just meant to allow us to profile
+        get_callee in the future.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_callee):
+        (JSC):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_callee):
+        (JSC):
+        (JSC::JIT::emit_op_create_this):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-11-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix ARMv7 build.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
+
+2012-11-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Patching of jumps to stubs should use jump replacement rather than branch destination overwrite
+        https://bugs.webkit.org/show_bug.cgi?id=101909
+
+        Reviewed by Geoffrey Garen.
+
+        This saves a few instructions in inline cases, on those architectures where it is
+        easy to figure out where to put the jump replacement. Sub-1% speed-up across the
+        board.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::canJumpReplacePatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::canJumpReplacePatchableBranchPtrWithPatch):
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::canJumpReplacePatchableBranchPtrWithPatch):
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatch):
+        (RepatchBuffer):
+        (JSC::RepatchBuffer::replaceWithJump):
+        (JSC::RepatchBuffer::revertJumpReplacementToPatchableBranchPtrWithPatch):
+        * assembler/X86Assembler.h:
+        (X86Assembler):
+        (JSC::X86Assembler::revertJumpTo_movq_i64r):
+        (JSC::X86Assembler::revertJumpTo_cmpl_im_force32):
+        (X86InstructionFormatter):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::replaceWithJump):
+        (DFG):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+
+2012-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ArithMul overflow check elimination is too aggressive
+        https://bugs.webkit.org/show_bug.cgi?id=101871
+
+        Reviewed by Oliver Hunt.
+
+        The code was ignoring the fact that ((a * b) | 0) == (((a | 0) * (b | 0)) | 0)
+        only holds if a * b < 2^53. So, I changed it to only enable the optimization
+        when a < 2^22 and b is an int32 (and vice versa), using a super trivial peephole
+        analysis to prove the inequality. I considered writing an epic forward flow
+        formulation that tracks the ranges of integer values but then I thought better
+        of it.
+        
+        This also rewires the ArithMul integer speculation logic. Previously, we would
+        assume that an ArithMul was only UsedAsNumber if it escaped, and separately we
+        would decide whether to speculate integer based on a proof of the <2^22
+        inequality. Now, we treat the double rounding behavior of ArithMul as if the
+        result was UsedAsNumber even if it did not escape. Then we try to prove that
+        double rounding cannot happen by attemping to prove that a < 2^22. This then
+        feeds back into the decision of whether or not to speculate integer (if we fail
+        to prove a < 2^22 then we're UsedAsNumber, and if we're also MayOverflow then
+        that forces double speculation).
+        
+        No performance impact. It just fixes a bug.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::mulShouldSpeculateInteger):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
+        (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2012-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not emit function checks if we've already proved that the operand is that exact function
+        https://bugs.webkit.org/show_bug.cgi?id=101885
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::filterByValue):
+        (AbstractValue):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2012-11-12  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][JSC] ScriptProfileNode::callUID needs not to be [Custom]
+        https://bugs.webkit.org/show_bug.cgi?id=101892
+
+        Reviewed by Adam Barth.
+
+        Added callUID(), which enables us to kill custom bindings for ScriptProfileNode::callUID.
+
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::callUID):
+
+2012-11-12  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header.
+
+2012-11-11  Michael Pruett  <michael@68k.org>
+
+        Fix assertion failure in JSObject::tryGetIndexQuickly()
+        https://bugs.webkit.org/show_bug.cgi?id=101869
+
+        Reviewed by Filip Pizlo.
+
+        Currently JSObject::tryGetIndexQuickly() triggers an assertion
+        failure when the object has an undecided indexing type. This
+        case should be treated the same as a blank indexing type.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::tryGetIndexQuickly):
+
+2012-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG register allocation should be greedy rather than round-robin
+        https://bugs.webkit.org/show_bug.cgi?id=101870
+
+        Reviewed by Geoffrey Garen.
+
+        This simplifies the code, reduces some code duplication, and shows some slight
+        performance improvements in a few places, likely due to the fact that lower-numered
+        registers also typically have smaller encodings.
+
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::RegisterBank):
+        (JSC::DFG::RegisterBank::tryAllocate):
+        (JSC::DFG::RegisterBank::allocate):
+        (JSC::DFG::RegisterBank::allocateInternal):
+        (RegisterBank):
+
+2012-11-11  Kenichi Ishibashi  <bashi@chromium.org>
+
+        WTFString::utf8() should have a mode of conversion to use replacement character
+        https://bugs.webkit.org/show_bug.cgi?id=101678
+
+        Reviewed by Alexey Proskuryakov.
+
+        Follow the change on String::utf8()
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode): Pass String::StrictConversion instead of true to String::utf8().
+
+2012-11-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize out the NaN check on loads from double arrays if the array prototype chain is having a great time
+        https://bugs.webkit.org/show_bug.cgi?id=101718
+
+        Reviewed by Geoffrey Garen.
+
+        If we're reading from a JSArray in double mode, where the array's structure is
+        primordial (all aspects of the structure are unchanged except for indexing type),
+        and the result of the load is used in arithmetic that is known to not distinguish
+        between NaN and undefined, then we should not emit a NaN check. Looks like a 5%
+        win on navier-stokes.
+        
+        Also fixed an OpInfo initialization goof for String ops that was revealed by this
+        change.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::arraySpeculationToString):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::isSaneChain):
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::isInBounds):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::nodeFlagsAsString):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
+        (JSC):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+
+2012-11-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG constant folding and CFG simplification should be smart enough to know that if a logical op's operand is proven to have a non-masquerading structure then it always evaluates to true
+        https://bugs.webkit.org/show_bug.cgi?id=101511
+
+        Reviewed by Geoffrey Garen.
+        
+        This is the second attempt at this patch, which fixes the !"" case.
+
+        To make life easier, this moves BranchDirection into BasicBlock so that after
+        running the CFA, we always know, for each block, what direction the CFA
+        proved. CFG simplification now both uses and preserves cfaBranchDirection in
+        its transformations.
+        
+        Also made both LogicalNot and Branch check whether the operand is a known cell
+        with a known structure, and if so, made them do the appropriate folding.
+        
+        5% speed-up on V8/raytrace because it makes raytrace's own null checks
+        evaporate (i.e. idioms like 'if (!x) throw "unhappiness"') thanks to the fact
+        that we were already doing structure check hoisting.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGBranchDirection.h: Added.
+        (DFG):
+        (JSC::DFG::branchDirectionToString):
+        (JSC::DFG::isKnownDirection):
+        (JSC::DFG::branchCondition):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
+2012-11-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r133971.
+        http://trac.webkit.org/changeset/133971
+        https://bugs.webkit.org/show_bug.cgi?id=101839
+
+        Causes WebProcess to hang at 100% on www.apple.com (Requested
+        by kling on #webkit).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::branchDirectionToString):
+        (AbstractState):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGBranchDirection.h: Removed.
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
+2012-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        If the DFG ArrayMode says that an access is on an OriginalArray, then the checks should always enforce this
+        https://bugs.webkit.org/show_bug.cgi?id=101720
+
+        Reviewed by Mark Hahnenberg.
+
+        Previously, "original" arrays was just a hint that we could find the structure
+        of the array if we needed to even if the array profile didn't have it due to
+        polymorphism. Now, "original" arrays are a property that is actually checked:
+        if an array access has ArrayMode::arrayClass() == Array::OriginalArray, then we
+        can be sure that the code performing the access is dealing with not just a
+        JSArray, but a JSArray that has no named properties, no indexed accessors, and
+        the ArrayPrototype as its prototype. This will be useful for optimizations that
+        are being done as part of https://bugs.webkit.org/show_bug.cgi?id=101720.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::originalArrayStructure):
+        (DFG):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        * dfg/DFGArrayMode.h:
+        (JSC):
+        (DFG):
+        (JSC::DFG::ArrayMode::withProfile):
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::benefitsFromOriginalArray):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+
+2012-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of BooleanPrototype.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/BooleanPrototype.h:
+
+2012-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of BooleanObject.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/BooleanObject.h:
+
+2012-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of BooleanConstructor.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/BooleanConstructor.h:
+
+2012-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of BatchedTransitionOptimizer.h
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/BatchedTransitionOptimizer.h:
+
+2012-11-09  Oliver Hunt  <oliver@apple.com>
+
+        So Thingy probably isn't the best name for a class, so
+        renamed to CacheMap.
+
+        RS=Geoff
+
+        * runtime/CodeCache.h:
+        (JSC::CacheMap::CacheMap):
+
+2012-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        ArrayPrototype should start out with a blank indexing type
+        https://bugs.webkit.org/show_bug.cgi?id=101719
+
+        Reviewed by Mark Hahnenberg.
+
+        This allows us to track if the array prototype ever ends up with indexed
+        properties.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::create):
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        (ArrayPrototype):
+        (JSC::ArrayPrototype::createStructure):
+
+2012-11-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MarkStackArray should use the BlockAllocator instead of the MarkStackSegmentAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=101642
+
+        Reviewed by Filip Pizlo.
+
+        MarkStackSegmentAllocator is like a miniature version of the BlockAllocator. Now that the BlockAllocator has support 
+        for a variety of block sizes, we should get rid of the MarkStackSegmentAllocator in favor of the BlockAllocator.
+
+        * heap/BlockAllocator.h: Add new specializations of regionSetFor for the new MarkStackSegments.
+        (JSC):
+        (JSC::MarkStackSegment):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::reset):
+        * heap/GCThreadSharedData.h:
+        (GCThreadSharedData):
+        * heap/MarkStack.cpp: 
+        (JSC::MarkStackArray::MarkStackArray): We now have a doubly linked list of MarkStackSegments, so we need to refactor 
+        all the places that used the old custom tail/previous logic.
+        (JSC::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStackArray::expand):
+        (JSC::MarkStackArray::refill):
+        (JSC::MarkStackArray::donateSomeCellsTo): Refactor to use the new linked list.
+        (JSC::MarkStackArray::stealSomeCellsFrom): Ditto.
+        * heap/MarkStack.h:
+        (JSC):
+        (MarkStackSegment):
+        (JSC::MarkStackSegment::MarkStackSegment):
+        (JSC::MarkStackSegment::sizeFromCapacity):
+        (MarkStackArray):
+        * heap/MarkStackInlines.h:
+        (JSC::MarkStackSegment::create):
+        (JSC):
+        (JSC::MarkStackArray::postIncTop):
+        (JSC::MarkStackArray::preDecTop):
+        (JSC::MarkStackArray::setTopForFullSegment):
+        (JSC::MarkStackArray::setTopForEmptySegment):
+        (JSC::MarkStackArray::top):
+        (JSC::MarkStackArray::validatePrevious):
+        (JSC::MarkStackArray::append):
+        (JSC::MarkStackArray::removeLast):
+        (JSC::MarkStackArray::isEmpty):
+        (JSC::MarkStackArray::size):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+
+2012-11-09  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        [Qt] r133953 broke the ARM_TRADITIONAL build
+        https://bugs.webkit.org/show_bug.cgi?id=101706
+
+        Reviewed by Csaba Osztrogonác.
+
+        Fix for both hardfp and softfp.
+
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+
+2012-11-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r134051.
+        http://trac.webkit.org/changeset/134051
+        https://bugs.webkit.org/show_bug.cgi?id=101757
+
+        It didn't fix the build (Requested by Ossy on #webkit).
+
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+
+2012-11-09  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        [Qt] r133953 broke the ARM_TRADITIONAL build
+        https://bugs.webkit.org/show_bug.cgi?id=101706
+
+        Reviewed by Csaba Osztrogonác.
+
+        Fix the ARM_TRADITIONAL build after r133953
+
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+
+2012-11-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Fix the LLINT build from ARMv7 platform
+        https://bugs.webkit.org/show_bug.cgi?id=101712
+
+        Reviewed by Simon Hausmann.
+
+        Enable generating of LLIntAssembly.h on ARM platforms.
+
+        * DerivedSources.pri:
+        * JavaScriptCore.pro:
+
+2012-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        ArrayPrototype.h should have correct indentation
+
+        Rubber stamped by Sam Weinig.
+
+        * runtime/ArrayPrototype.h:
+
+2012-11-08  Mark Lam  <mark.lam@apple.com>
+
+        Renamed ...InlineMethods.h files to ...Inlines.h.
+        https://bugs.webkit.org/show_bug.cgi?id=101145.
+
+        Reviewed by Geoffrey Garen.
+
+        This is only a refactoring effort to rename the files. There are no
+        functionality changes.
+
+        * API/JSObjectRef.cpp:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        * dfg/DFGOperations.cpp:
+        * heap/ConservativeRoots.cpp:
+        * heap/CopiedBlock.h:
+        * heap/CopiedSpace.cpp:
+        * heap/CopiedSpaceInlineMethods.h: Removed.
+        * heap/CopiedSpaceInlines.h: Copied from Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h.
+        * heap/CopyVisitor.cpp:
+        * heap/CopyVisitorInlineMethods.h: Removed.
+        * heap/CopyVisitorInlines.h: Copied from Source/JavaScriptCore/heap/CopyVisitorInlineMethods.h.
+        * heap/GCThread.cpp:
+        * heap/GCThreadSharedData.cpp:
+        * heap/HandleStack.cpp:
+        * heap/Heap.cpp:
+        * heap/HeapRootVisitor.h:
+        * heap/MarkStack.cpp:
+        * heap/MarkStackInlineMethods.h: Removed.
+        * heap/MarkStackInlines.h: Copied from Source/JavaScriptCore/heap/MarkStackInlineMethods.h.
+        * heap/SlotVisitor.cpp:
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlineMethods.h: Removed.
+        * heap/SlotVisitorInlines.h: Copied from Source/JavaScriptCore/heap/SlotVisitorInlineMethods.h.
+        * jit/HostCallReturnValue.cpp:
+        * jit/JIT.cpp:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITInlineMethods.h: Removed.
+        * jit/JITInlines.h: Copied from Source/JavaScriptCore/jit/JITInlineMethods.h.
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jsc.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ButterflyInlineMethods.h: Removed.
+        * runtime/ButterflyInlines.h: Copied from Source/JavaScriptCore/runtime/ButterflyInlineMethods.h.
+        * runtime/IndexingHeaderInlineMethods.h: Removed.
+        * runtime/IndexingHeaderInlines.h: Copied from Source/JavaScriptCore/runtime/IndexingHeaderInlineMethods.h.
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSValueInlineMethods.h: Removed.
+        * runtime/JSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlineMethods.h.
+        * runtime/LiteralParser.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/Operations.h:
+        * runtime/RegExpMatchesArray.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/StringPrototype.cpp:
+
+2012-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        ArrayConstructor.h should have correct indentation
+
+        Rubber stamped by Sam Weinig.
+
+        * runtime/ArrayConstructor.h:
+
+2012-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should know that int == null is always false
+        https://bugs.webkit.org/show_bug.cgi?id=101665
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+
+2012-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Arguments.h should have correct indentation
+
+        Rubber stamped by Sam Weinig.
+
+        * runtime/Arguments.h:
+
+2012-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to JIT compile get_by_vals and put_by_vals even if the DFG is disabled.
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::chooseArrayMode):
+
+2012-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        op_call should have LLInt call link info even if the DFG is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=101672
+
+        Reviewed by Oliver Hunt.
+
+        Get rid of the evil uses of fall-through.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2012-11-08  Oliver Hunt  <oliver@apple.com>
+
+        Improve effectiveness of function-level caching
+        https://bugs.webkit.org/show_bug.cgi?id=101667
+
+        Reviewed by Filip Pizlo.
+
+        Added a random-eviction based cache for unlinked functions, and switch
+        UnlinkedFunctionExecutable's code references to Weak<>, thereby letting
+        us remove the explicit UnlinkedFunctionExecutable::clearCode() calls that
+        were being triggered by GC.
+
+        Refactored the random eviction part of the CodeCache into a separate data
+        structure so that I didn't have to duplicate the code again, and then used
+        that for the new function cache.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::clearCodeForRecompilation):
+        (UnlinkedFunctionExecutable):
+        * debugger/Debugger.cpp:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getCodeBlock):
+        (JSC::CodeCache::generateFunctionCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        (JSC::CodeCache::usedFunctionCode):
+        (JSC):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilationIfNotCompiling):
+        (JSC::FunctionExecutable::clearCode):
+        * runtime/Executable.h:
+        (FunctionExecutable):
+
+2012-11-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG constant folding and CFG simplification should be smart enough to know that if a logical op's operand is proven to have a non-masquerading structure then it always evaluates to true
+        https://bugs.webkit.org/show_bug.cgi?id=101511
+
+        Reviewed by Oliver Hunt.
+
+        To make life easier, this moves BranchDirection into BasicBlock so that after
+        running the CFA, we always know, for each block, what direction the CFA
+        proved. CFG simplification now both uses and preserves cfaBranchDirection in
+        its transformations.
+        
+        Also made both LogicalNot and Branch check whether the operand is a known cell
+        with a known structure, and if so, made them do the appropriate folding.
+        
+        5% speed-up on V8/raytrace because it makes raytrace's own null checks
+        evaporate (i.e. idioms like 'if (!x) throw "unhappiness"') thanks to the fact
+        that we were already doing structure check hoisting.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (BasicBlock):
+        * dfg/DFGBranchDirection.h: Added.
+        (DFG):
+        (JSC::DFG::branchDirectionToString):
+        (JSC::DFG::isKnownDirection):
+        (JSC::DFG::branchCondition):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
+2012-11-08  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [JSC] HTML extensions to String.prototype should escape " as &quot; in argument values
+        https://bugs.webkit.org/show_bug.cgi?id=90667
+
+        Reviewed by Benjamin Poulain.
+
+        Escape quotation mark as &quot; in argument values to:
+        - String.prototype.anchor(name)
+        - String.prototype.fontcolor(color)
+        - String.prototype.fontsize(size)
+        - String.prototype.link(href)
+
+        This behavior matches Chromium/V8 and Firefox/Spidermonkey
+        implementations and is requited by:
+        http://mathias.html5.org/specs/javascript/#escapeattributevalue
+
+        This also fixes a potential security risk (XSS vector).
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+
+2012-11-08  Anders Carlsson  <andersca@apple.com>
+
+        HeapStatistics::s_pauseTimeStarts and s_pauseTimeEnds should be Vectors
+        https://bugs.webkit.org/show_bug.cgi?id=101651
+
+        Reviewed by Andreas Kling.
+
+        HeapStatistics uses Deques when Vectors would work just as good.
+
+        * heap/HeapStatistics.cpp:
+        * heap/HeapStatistics.h:
+        (HeapStatistics):
+
+2012-11-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not assume that something is a double just because it might be undefined
+        https://bugs.webkit.org/show_bug.cgi?id=101438
+
+        Reviewed by Oliver Hunt.
+
+        This changes all non-bitop arithmetic to (a) statically expect that variables are
+        defined prior to use in arithmetic and (b) not fall off into double paths just
+        because a value may not be a number. This is accomplished with two new notions of
+        speculation:
+        
+        shouldSpeculateIntegerExpectingDefined: Should we speculate that the value is an
+        integer if we ignore undefined (i.e. SpecOther) predictions?
+        
+        shouldSpeculateIntegerForArithmetic: Should we speculate that the value is an
+        integer if we ignore non-numeric predictions?
+        
+        This is a ~2x speed-up on programs that seem to our prediction propagator to have
+        paths in which otherwise numeric variables are undefined.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt32SpeculationForArithmetic):
+        (JSC):
+        (JSC::isInt32SpeculationExpectingDefined):
+        (JSC::isDoubleSpeculationForArithmetic):
+        (JSC::isNumberSpeculationExpectingDefined):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateInteger):
+        (JSC::DFG::Graph::mulShouldSpeculateInteger):
+        (JSC::DFG::Graph::negateShouldSpeculateInteger):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
+        (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
+        (Node):
+        (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
+        (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
+        (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+
+2012-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should infer when indexed storage contains only integers or doubles
+        https://bugs.webkit.org/show_bug.cgi?id=98606
+
+        Reviewed by Oliver Hunt.
+
+        This adds two new indexing types: int32 and double. It also adds array allocation profiling,
+        which allows array allocations to converge to allocating arrays using those types to which
+        those arrays would have been converted.
+        
+        20% speed-up on navier-stokes. 40% speed-up on various Kraken DSP tests. Some slow-downs too,
+        but a performance win overall on all benchmarks we track.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeArray):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/AbstractMacroAssembler.h:
+        (JumpList):
+        (JSC::AbstractMacroAssembler::JumpList::JumpList):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jnp):
+        (X86Assembler):
+        (JSC::X86Assembler::X86InstructionFormatter::emitRex):
+        * bytecode/ArrayAllocationProfile.cpp: Added.
+        (JSC):
+        (JSC::ArrayAllocationProfile::updateIndexingType):
+        * bytecode/ArrayAllocationProfile.h: Added.
+        (JSC):
+        (ArrayAllocationProfile):
+        (JSC::ArrayAllocationProfile::ArrayAllocationProfile):
+        (JSC::ArrayAllocationProfile::selectIndexingType):
+        (JSC::ArrayAllocationProfile::updateLastAllocation):
+        (JSC::ArrayAllocationProfile::selectIndexingTypeFor):
+        (JSC::ArrayAllocationProfile::updateLastAllocationFor):
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::updatedObservedArrayModes):
+        (JSC):
+        * bytecode/ArrayProfile.h:
+        (JSC):
+        (JSC::arrayModesInclude):
+        (JSC::shouldUseSlowPutArrayStorage):
+        (JSC::shouldUseFastArrayStorage):
+        (JSC::shouldUseContiguous):
+        (JSC::shouldUseDouble):
+        (JSC::shouldUseInt32):
+        (ArrayProfile):
+        * bytecode/ByValInfo.h:
+        (JSC::isOptimizableIndexingType):
+        (JSC::jitArrayModeForIndexingType):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        (JSC):
+        (JSC::CodeBlock::updateAllValueProfilePredictions):
+        (JSC::CodeBlock::updateAllArrayPredictions):
+        (JSC::CodeBlock::updateAllPredictions):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::numberOfArrayAllocationProfiles):
+        (JSC::CodeBlock::addArrayAllocationProfile):
+        (JSC::CodeBlock::updateAllValueProfilePredictions):
+        (JSC::CodeBlock::updateAllArrayPredictions):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * bytecode/Instruction.h:
+        (JSC):
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/SpeculatedType.h:
+        (JSC):
+        (JSC::isRealNumberSpeculation):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC):
+        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile):
+        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles):
+        (UnlinkedCodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::newArrayAllocationProfile):
+        (JSC):
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        (JSC::DFG::ArrayMode::refine):
+        (DFG):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        (JSC::DFG::arrayTypeToString):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::withType):
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::withTypeAndConversion):
+        (JSC::DFG::ArrayMode::usesButterfly):
+        (JSC::DFG::ArrayMode::isSpecific):
+        (JSC::DFG::ArrayMode::supportsLength):
+        (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        (JSC::DFG::CallArrayAllocatorSlowPathGenerator::generateInternal):
+        (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::generateInternal):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGNode.h:
+        (NewArrayBufferData):
+        (JSC::DFG::Node::hasIndexingType):
+        (Node):
+        (JSC::DFG::Node::indexingType):
+        (JSC::DFG::Node::setIndexingType):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        (SpeculateIntegerOperand):
+        (JSC::DFG::SpeculateIntegerOperand::use):
+        (SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateDoubleOperand::use):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.h:
+        (JSC::JIT::emitInt32GetByVal):
+        (JIT):
+        (JSC::JIT::emitInt32PutByVal):
+        (JSC::JIT::emitDoublePutByVal):
+        (JSC::JIT::emitContiguousPutByVal):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        * jit/JITInlineMethods.h:
+        (JSC::arrayProfileSaw):
+        (JSC::JIT::chooseArrayMode):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emit_op_new_array_with_size):
+        (JSC::JIT::emit_op_new_array_buffer):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitDoubleGetByVal):
+        (JSC):
+        (JSC::JIT::emitContiguousGetByVal):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitContiguousGetByVal):
+        (JSC::JIT::emitDoubleGetByVal):
+        (JSC):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/x86.rb:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayConstructor.h:
+        (JSC):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        * runtime/Butterfly.h:
+        (JSC::Butterfly::contiguousInt32):
+        (JSC::Butterfly::contiguousDouble):
+        (JSC::Butterfly::fromContiguous):
+        * runtime/ButterflyInlineMethods.h:
+        (JSC::Butterfly::createUninitializedDuringCollection):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/IndexingHeaderInlineMethods.h:
+        (JSC::IndexingHeader::indexingPayloadSizeInBytes):
+        * runtime/IndexingType.cpp:
+        (JSC::leastUpperBoundOfIndexingTypes):
+        (JSC):
+        (JSC::leastUpperBoundOfIndexingTypeAndType):
+        (JSC::leastUpperBoundOfIndexingTypeAndValue):
+        (JSC::indexingTypeToString):
+        * runtime/IndexingType.h:
+        (JSC):
+        (JSC::hasUndecided):
+        (JSC::hasInt32):
+        (JSC::hasDouble):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        (JSC::compareNumbersForQSortWithInt32):
+        (JSC):
+        (JSC::compareNumbersForQSortWithDouble):
+        (JSC::JSArray::sortNumericVector):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sortCompactedVector):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::sortVector):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSArray):
+        (JSC::createContiguousArrayButterfly):
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+        (JSC::JSGlobalObject::haveABadTime):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::originalArrayStructureForIndexingType):
+        (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
+        (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
+        (JSC::JSGlobalObject::isOriginalArrayStructure):
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::convertUndecidedForValue):
+        (JSC::JSObject::convertInt32ForValue):
+        (JSC::JSObject::setIndexQuicklyToUndecided):
+        (JSC::JSObject::convertInt32ToDoubleOrContiguousWhilePerformingSetIndex):
+        (JSC::JSObject::convertDoubleToContiguousWhilePerformingSetIndex):
+        (JSC::JSObject::ensureInt32Slow):
+        (JSC::JSObject::ensureDoubleSlow):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::countElements):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getArrayLength):
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::tryGetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuicklyForPutDirect):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::hasSparseMap):
+        (JSC::JSObject::inSparseIndexingMode):
+        (JSObject):
+        (JSC::JSObject::ensureInt32):
+        (JSC::JSObject::ensureDouble):
+        (JSC::JSObject::ensureLength):
+        (JSC::JSObject::indexingData):
+        (JSC::JSObject::currentIndexingData):
+        (JSC::JSObject::getHolyIndexQuickly):
+        (JSC::JSObject::relevantLength):
+        (JSC::JSObject::currentRelevantLength):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/LiteralParser.cpp:
+        (JSC::::parse):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSplit):
+        * runtime/Structure.cpp:
+        (JSC::Structure::nonPropertyTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::newIndexingType):
+
+2012-11-08  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        ASSERT problem on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=100589
+
+        Reviewed by Oliver Hunt.
+
+        ASSERT fix for MIPS arch.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_resolve_operations):
+
+2012-11-08  Michael Saboff  <msaboff@apple.com>
+
+        OpaqueJSClassContextData() should use StringImpl::isolatedCopy() to make string copies
+        https://bugs.webkit.org/show_bug.cgi?id=101507
+
+        Reviewed by Andreas Kling.
+
+        Changed to use isolatedCopy() for key Strings.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+
+2012-11-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        WeakBlocks should be HeapBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=101411
+
+        Reviewed by Oliver Hunt.
+
+        Currently WeakBlocks use fastMalloc memory. They are very similar to the other HeapBlocks, however, 
+        so we should change them to being allocated with the BlockAllocator.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        * heap/BlockAllocator.h: Added a new RegionSet for WeakBlocks.
+        (JSC):
+        (BlockAllocator):
+        (JSC::WeakBlock):
+        * heap/Heap.h: Friended WeakSet to allow access to the BlockAllocator.
+        (Heap):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create): Refactored to use HeapBlocks rather than fastMalloc.
+        (JSC::WeakBlock::WeakBlock):
+        * heap/WeakBlock.h: Changed the WeakBlock size to 4 KB so that it divides evenly into the Region size.
+        (JSC):
+        (WeakBlock):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::~WeakSet):
+        (JSC::WeakSet::addAllocator):
+
+2012-11-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Indentation of ArgList.h is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=101441
+
+        Reviewed by Andreas Kling.
+
+        Just unindented by 4 spaces.
+
+        * runtime/ArgList.h:
+
+2012-11-07  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        [Qt][ARM] REGRESSION(r133688): It made all JSC and layout tests crash on ARM traditional platform
+        https://bugs.webkit.org/show_bug.cgi?id=101465
+
+        Reviewed by Oliver Hunt.
+
+        Fix failing javascriptcore tests on ARM after r133688
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2012-11-06  Oliver Hunt  <oliver@apple.com>
+
+        Reduce parser overhead in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=101127
+
+        Reviewed by Filip Pizlo.
+
+        An exciting journey into the world of architecture in which our hero
+        adds yet another layer to JSC codegeneration.
+
+        This patch adds a marginally more compact form of bytecode that is
+        free from any data specific to a given execution context, and that
+        does store any data structures necessary for execution.  To actually
+        execute this UnlinkedBytecode we still need to instantiate a real
+        CodeBlock, but this is a much faster linear time operation than any
+        of the earlier parsing or code generation passes.
+
+        As the unlinked code is context free we can then simply use a cache
+        from source to unlinked code mapping to completely avoid all of the
+        old parser overhead.  The cache is currently very simple and memory
+        heavy, using the complete source text as a key (rather than SourceCode
+        or equivalent), and a random eviction policy.
+
+        This seems to produce a substantial win when loading identical content
+        in different contexts.
+
+        * API/tests/testapi.c:
+        (main):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+            Moved a number of fields, and a bunch of logic to UnlinkedCodeBlock.h/cpp
+        * bytecode/Opcode.h:
+            Added a global const init no op instruction needed to get correct
+            behaviour without any associated semantics.
+        * bytecode/UnlinkedCodeBlock.cpp: Added.
+        * bytecode/UnlinkedCodeBlock.h: Added.
+            A fairly shallow, GC allocated version of the old CodeBlock
+            classes with a 32bit instruction size, and just metadata
+            size tracking.
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+            Replace direct access to m_symbolTable with access through
+            symbolTable().  ProgramCode no longer has a symbol table at
+            all so some previously unconditional (and pointless) uses
+            of symbolTable get null checks.
+            A few other changes to deal with type changes due to us generating
+            unlinked code (eg. pointer free, so profile indices rather than
+            pointers).
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCapabilities.h:
+            Support global_init_nop        
+        * interpreter/Interpreter.cpp:
+            Now get the ProgramExecutable to initialise new global properties
+            before starting execution.        
+        * jit/JIT.cpp:
+        * jit/JITDriver.h:
+        * jit/JITStubs.cpp:
+        * llint/LLIntData.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+            Adding init_global_const_nop everywhere else
+        * parser/Parser.h:
+        * parser/ParserModes.h: Added.
+        * parser/ParserTokens.h:
+            Parser no longer needs a global object or callframe to function        
+        * runtime/CodeCache.cpp: Added.
+        * runtime/CodeCache.h: Added.
+            A simple, random eviction, Source->UnlinkedCode cache        
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+            Executables now reference their unlinked counterparts, and
+            request code specifically for the target global object.        
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+            GlobalData now owns a CodeCache and a set of new structures
+            for the unlinked code types.  
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+            Utility functions used by executables to perform compilation
+ 
+        * runtime/JSType.h:
+          Add new JSTypes for unlinked code
+
+2012-11-06  Michael Saboff  <msaboff@apple.com>
+
+        JSStringCreateWithCFString() Should create an 8 bit String if possible
+        https://bugs.webkit.org/show_bug.cgi?id=101104
+
+        Reviewed by Darin Adler.
+
+        Try converting the CFString to an 8 bit string using CFStringGetBytes(...,
+        kCFStringEncodingISOLatin1, ...) and return the 8 bit string if successful.
+        If not proceed with 16 bit conversion.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2012-11-06  Oliver Hunt  <oliver@apple.com>
+
+        Reduce direct m_symbolTable usage in CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=101391
+
+        Reviewed by Sam Weinig.
+
+        Simple refactoring.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isCaptured):
+
+2012-11-06  Michael Saboff  <msaboff@apple.com>
+
+        Lexer::scanRegExp, create 8 bit pattern and flag Identifiers from 16 bit source when possible
+        https://bugs.webkit.org/show_bug.cgi?id=101013
+
+        Reviewed by Darin Adler.
+
+        Changed scanRegExp so that it will create 8 bit identifiers from 8 bit sources and from 16 bit sources
+        whan all the characters are 8 bit.  Using two templated helpers, the "is all 8 bit" check is only performed
+        on 16 bit sources.  The first helper is orCharacter() that will accumulate the or value of all characters
+        only for 16 bit sources.  Replaced the helper Lexer::makeIdentifierSameType() with Lexer::makeRightSizedIdentifier().
+
+        * parser/Lexer.cpp:
+        (JSC::orCharacter<LChar>): Explicit template that serves as a placeholder.
+        (JSC::orCharacter<UChar>): Explicit template that actually or accumulates characters.
+        (JSC::Lexer::scanRegExp):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::Lexer::makeRightSizedIdentifier<LChar>): New template that always creates an 8 bit Identifier.
+        (JSC::Lexer::makeRightSizedIdentifier<UChar>): New template that creates an 8 bit Identifier for 8 bit
+        data in a 16 bit source.
+
+2012-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Indentation of JSCell.h is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=101379
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        Just removed four spaces on a bunch of lines.
+
+        * runtime/JSCell.h:
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Indentation of JSObject.h is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=101313
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        Just unindented code, since namespace bodies shouldn't be indented.
+
+        * runtime/JSObject.h:
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Indentation of JSArray.h is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=101314
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        Just removing the indentation inside the namespace body.
+
+        * runtime/JSArray.h:
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not fall down to patchable GetById just because a prototype had things added to it
+        https://bugs.webkit.org/show_bug.cgi?id=101299
+
+        Reviewed by Geoffrey Garen.
+
+        This looks like a slight win on V8v7 and SunSpider.
+
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of method_check
+        https://bugs.webkit.org/show_bug.cgi?id=101147
+
+        Reviewed by Geoffrey Garen.
+
+        op_method_check no longer buys us anything, since get_by_id proto caching
+        gives just as much profiling information and the DFG inlines monomorphic
+        proto accesses anyway.
+        
+        This also has the potential for a speed-up since it makes parsing of
+        profiling data easier. No longer do we have to deal with the confusion of
+        the get_by_id portion of a method_check appearing monomorphic even though
+        we're really dealing with a bimorphic access (method_check specializes for
+        one case and get_by_id for another).
+
+        This looks like a 1% speed-up on both SunSpider and V8v7.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::unlinkCalls):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::callLinkInfo):
+        (CodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/MethodCallLinkInfo.cpp: Removed.
+        * bytecode/MethodCallLinkInfo.h: Removed.
+        * bytecode/MethodCallLinkStatus.cpp: Removed.
+        * bytecode/MethodCallLinkStatus.h: Removed.
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::PropertyStubCompilationInfo::slowCaseInfo):
+        (PropertyStubCompilationInfo):
+        (JSC):
+        (JIT):
+        * jit/JITPropertyAccess.cpp:
+        (JSC):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::compileGetByIdSlowCase):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC):
+        (JSC::JIT::compileGetByIdSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LowLevelInterpreter.asm:
+
+2012-11-05  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Refactor LLInt64 to distinguish the pointer operations from the 64-bit integer operations
+        https://bugs.webkit.org/show_bug.cgi?id=100321
+
+        Reviewed by Filip Pizlo.
+
+        We have refactored the MacroAssembler and JIT compilers to distinguish
+        the pointer operations from the 64-bit integer operations (see bug #99154).
+        Now we want to do the similar work for LLInt, and the goal is same as
+        the one mentioned in 99154.
+
+        This is the second part of the modification: in the low level interpreter,
+        changing the operations on 64-bit integers to use the "<foo>q" instructions.
+        This also removes some unused/meaningless "<foo>p" instructions.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/armv7.rb:
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2012-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Prototype chain caching should check that the path from the base object to the slot base involves prototype hops only
+        https://bugs.webkit.org/show_bug.cgi?id=101276
+
+        Reviewed by Gavin Barraclough.
+
+        Changed normalizePrototypeChain() to report an invalid prototype chain if any object is a proxy.
+        This catches cases where our prototype chain checks would have been insufficient to guard against
+        newly introduced properties, despecialized properties, or deleted properties in the chain of
+        objects involved in the access.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Operations.h:
+        (JSC):
+        (JSC::normalizePrototypeChain):
+
+2012-11-05  Dima Gorbik  <dgorbik@apple.com>
+
+        Back out controversial changes from Bug 98665.
+        https://bugs.webkit.org/show_bug.cgi?id=101244
+
+        Reviewed by David Kilzer.
+
+        Backing out changes from Bug 98665 until further discussions take place on rules for including Platform.h in Assertions.h.
+
+        * API/tests/minidom.c:
+        * API/tests/testapi.c:
+
+2012-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Reduce the verbosity of referring to QNaN in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=101174
+
+        Reviewed by Geoffrey Garen.
+
+        Introduces a #define QNaN in JSValue.h, and replaces all previous uses of
+        std::numeric_limits<double>::quiet_NaN() with QNaN.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        (JSValueToNumber):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        * runtime/CachedTranscendentalFunction.h:
+        (JSC::CachedTranscendentalFunction::initialize):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceData::DateInstanceData):
+        (JSC::DateInstanceCache::reset):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::defaultValue):
+        (JSC::TerminatedExecutionError::defaultValue):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getPrimitiveNumber):
+        * runtime/JSDateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::resetDateCache):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        (JSC::jsStrDecimalLiteral):
+        (JSC::toDouble):
+        (JSC::jsToNumber):
+        (JSC::parseFloat):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toNumberSlowCase):
+        * runtime/JSValue.h:
+        (JSC):
+        * runtime/JSValueInlineMethods.h:
+        (JSC::jsNaN):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+
+2012-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should use structure watchpoints whenever possible
+        https://bugs.webkit.org/show_bug.cgi?id=101146
+
+        Reviewed by Sam Weinig.
+
+        No speed-up yet except on toy programs. I think that it will start to show
+        speed-ups with https://bugs.webkit.org/show_bug.cgi?id=101147, which this is
+        a step towards.
+
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::addStructureTransitionCheck):
+        (JSC):
+        (JSC::JIT::testPrototype):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2012-11-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] udis86_itab.c is always regenerated
+        https://bugs.webkit.org/show_bug.cgi?id=100756
+
+        Reviewed by Simon Hausmann.
+
+        * DerivedSources.pri: Generate sources to the generated directory.
+        * disassembler/udis86/differences.txt:
+        * disassembler/udis86/itab.py: Add --outputDir option.
+        (UdItabGenerator.__init__):
+        (genItabH):
+        (genItabC):
+        (main):
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt 32-bit put_by_val ArrayStorage case should use the right register (t3, not t2) for the index in the publicLength updating path
+        https://bugs.webkit.org/show_bug.cgi?id=101118
+
+        Reviewed by Gavin Barraclough.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Node::converToStructureTransitionWatchpoint should take kindly to ArrayifyToStructure
+        https://bugs.webkit.org/show_bug.cgi?id=101117
+
+        Reviewed by Gavin Barraclough.
+
+        We have logic to convert ArrayifyToStructure to StructureTransitionWatchpoint, which is awesome, except
+        that previously convertToStructureTransitionWatchpoint was (a) asserting that it never saw an
+        ArrayifyToStructure and (b) would incorrectly create a ForwardStructureTransitionWatchpoint if it did.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT::typedArrayDescriptor should use the Float64Array descriptor for Float64Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=101114
+
+        Reviewed by Gavin Barraclough.
+
+        As in https://bugs.webkit.org/show_bug.cgi?id=101112, this was only wrong when Float64Array descriptors
+        hadn't been initialized yet. That happens rarely, but when it does happen, we would crash.
+        
+        This would also become much more wrong if we ever put type size info (num bytes, etc) in the descriptor
+        and used that directly. So it's good to fix it.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT::privateCompileGetByVal should use the uint8ClampedArrayDescriptor for compiling accesses to Uint8ClampedArrays
+        https://bugs.webkit.org/show_bug.cgi?id=101112
+
+        Reviewed by Gavin Barraclough.
+
+        The only reason why the code was wrong to use uint8ArrayDescriptor instead is that if we're just using
+        Uint8ClampedArrays then the descriptor for Uint8Array may not have been initialized.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByVal):
+
+2012-11-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MarkedBlocks should use something other than the mark bits to indicate liveness for newly allocated objects
+        https://bugs.webkit.org/show_bug.cgi?id=100877
+
+        Reviewed by Filip Pizlo.
+
+        Currently when we canonicalize cell liveness data in MarkedBlocks, we set the mark bit for every cell in the 
+        block except for those in the free list. This allows us to consider objects that were allocated since the 
+        previous collection to be considered live until they have a chance to be properly marked by the collector.
+
+        If we want to use the mark bits to signify other types of information, e.g. using sticky mark bits for generational 
+        collection, we will have to keep track of newly allocated objects in a different fashion when we canonicalize cell liveness.
+
+        One method would be to allocate a separate set of bits while canonicalizing liveness data. These bits would 
+        track the newly allocated objects in the block separately from those objects who had already been marked. We would 
+        then check these bits, along with the mark bits, when determining liveness. 
+
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::isLive): We now check for the presence of the newlyAllocated Bitmap.
+        (JSC):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::specializedSweep): We clear the newlyAllocated Bitmap if we're creating a free list. This 
+        will happen if we canonicalize liveness data for some other reason than collection (e.g. forEachCell) and 
+        then start allocating again.
+        (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor): 
+        (SetNewlyAllocatedFunctor):
+        (JSC::SetNewlyAllocatedFunctor::operator()): We set the newlyAllocated bits for all the objects 
+        that aren't already marked. We undo the bits for the objects in the free list later in canonicalizeCellLivenessData.
+        (JSC::MarkedBlock::canonicalizeCellLivenessData): We should never have a FreeListed block with a newlyAllocated Bitmap.
+        We allocate the new Bitmap, set the bits for all the objects that aren't already marked, and then unset all of the 
+        bits for the items currently in the FreeList.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::clearMarks): We clear the newlyAllocated bitmap if it exists because at this point we don't need it
+        any more.
+        (JSC::MarkedBlock::isEmpty): If we have some objects that are newlyAllocated, we are not empty.
+        (JSC::MarkedBlock::isNewlyAllocated): 
+        (JSC):
+        (JSC::MarkedBlock::setNewlyAllocated):
+        (JSC::MarkedBlock::clearNewlyAllocated):
+        (JSC::MarkedBlock::isLive): We now check the newlyAllocated Bitmap, if it exists, when determining liveness of a cell in 
+        a block that is Marked.
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::visit): We need to make sure we don't finalize objects that are in the newlyAllocated Bitmap.
+        (JSC::WeakBlock::reap): Ditto.
+
+2012-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT::privateCompileGetByVal should use MacroAssemblerCodePtr::createFromExecutableAddress like JIT::privateCompilePutByVal
+        https://bugs.webkit.org/show_bug.cgi?id=101109
+
+        Reviewed by Gavin Barraclough.
+
+        This fixes crashes on ARMv7 resulting from the return address already being tagged with the THUMB2 bit.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByVal):
+
+2012-11-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable SUBPIXEL_LAYOUT on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=101076
+
+        Reviewed by Dave Hyatt.
+
+        Define ENABLE_SUBPIXEL_LAYOUT and include it in FEATURE_DEFINES.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-02  Michael Saboff  <msaboff@apple.com>
+
+        RegExp.prototype.toString Should Produce an 8 bit JSString if possible.
+        https://bugs.webkit.org/show_bug.cgi?id=101003
+
+        Reviewed by Geoffrey Garen.
+
+        Took the logic of regExpObjectSource() and created two templated helpers that uses the
+        source character type when appending to the StringBuilder.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::appendLineTerminatorEscape): Checks line terminate type to come up with escaped version.
+        (JSC::regExpObjectSourceInternal): Templated version of original.
+        (JSC::regExpObjectSource): Wrapper function.
+
+2012-11-02  Adam Barth  <abarth@webkit.org>
+
+        ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
+        https://bugs.webkit.org/show_bug.cgi?id=100711
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-11-02  Simon Hausmann  <simon.hausmann@digia.com>
+
+        [Qt] Fix build on Windows when Qt is configured with -release
+        https://bugs.webkit.org/show_bug.cgi?id=101041
+
+        Reviewed by Jocelyn Turcotte.
+
+        When Qt is configured with -debug or -release, the release/debug build of for example
+        QtCore is not available by default. For LLIntExtractor we always need to build debug
+        _and_ release versions, but we do not actually need any Qt libraries nor qtmain(d).lib.
+        Therefore we can disable all these features but need to keep $$QT.core.includes in the
+        INCLUDEPATH for some defines from qglobal.h.
+
+        * LLIntOffsetsExtractor.pro:
+
+2012-11-01  Mark Lam  <mark.lam@apple.com>
+
+        A llint workaround for a toolchain issue.
+        https://bugs.webkit.org/show_bug.cgi?id=101012.
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter.asm:
+          - use a local label to workaround the toolchain issue with undeclared
+            global labels.
+
+2012-11-01  Oliver Hunt  <oliver@apple.com>
+
+        Remove GlobalObject constant register that is typically unused
+        https://bugs.webkit.org/show_bug.cgi?id=101005
+
+        Reviewed by Geoffrey Garen.
+
+        The GlobalObject constant register is frequently allocated even when it
+        is not used, it is also getting in the way of some other optimisations.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+
+2012-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG optimized string access code should be enabled
+        https://bugs.webkit.org/show_bug.cgi?id=100825
+
+        Reviewed by Oliver Hunt.
+
+        - Removes prediction checks from the parser.
+        
+        - Fixes the handling of array mode refinement for strings. I.e. we don't do
+          any refinement - we already know it's going to be a string. We could
+          revisit this in the future, but for now the DFG lacks the ability to
+          handle any array modes other than Array::String for string intrinsics, so
+          this is as good as it gets.
+        
+        - Removes uses of isBlahSpeculation for checking if a mode is already
+          checked. isBlahSpeculation implicitly checks if the SpeculatedType is not
+          BOTTOM ("empty"), which breaks for checking if a mode is already checked
+          since a mode may already be "checked" in the sense that we've proven that
+          the code is unreachable.
+        
+        ~1% speed-up on V8v7, mostly from a speed-up on crypto, which uses string
+        intrinsics in one of the hot functions.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::speculationChecked):
+        (JSC):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+
+2012-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Sparse array size threshold should be increased to 100000
+        https://bugs.webkit.org/show_bug.cgi?id=100827
+
+        Reviewed by Oliver Hunt.
+
+        This enables the use of contiguous arrays in programs that previously
+        couldn't use them. And I so far can't see any examples of this being
+        a downside. To the extent that there is a downside, it ought to be
+        addressed by GC: https://bugs.webkit.org/show_bug.cgi?id=100828
+
+        * runtime/ArrayConventions.h:
+        (JSC):
+
+2012-10-31  Mark Lam  <mark.lam@apple.com>
+
+        C++ llint 64-bit backend needs to zero extend results of int32 operations.
+        https://bugs.webkit.org/show_bug.cgi?id=100899.
+
+        Reviewed by Filip Pizlo.
+
+        llint asm instructions ending in "i" for a 64-bit machine expects the
+        high 32-bit of registers to be zero'ed out when a 32-bit instruction
+        writes into a register. Fixed the C++ llint to honor this.
+
+        Fixed the index register used in BaseIndex addressing to be of size
+        intptr_t as expected.
+
+        Updated CLoopRegister to handle different endiannesss configurations.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoopRegister::clearHighWord):
+          - new method to clear the high 32-bit of a 64-bit register.
+            It's a no-op for the 32-bit build. 
+        (CLoopRegister):
+          - CLoopRegister now takes care of packing and byte endianness order.
+        (JSC::CLoop::execute): - Added an assert.
+        * offlineasm/cloop.rb:
+          - Add calls to clearHighWord() wherever needed.
+
+2012-10-31  Mark Lam  <mark.lam@apple.com>
+
+        A JSC printf (support for %J+s and %b).
+        https://bugs.webkit.org/show_bug.cgi?id=100566.
+
+        Reviewed by Michael Saboff.
+
+        Added VMInspector::printf(), fprintf(), sprintf(), and snprintf().
+        - %b prints ints as boolean TRUE (non-zero) or FALSE (zero).
+        - %Js prints a WTF::String* like a %s prints a char*.
+          Also works for 16bit WTF::Strings (prints wchar_t* using %S).
+        - '+' is a modifier meaning 'use verbose mode', and %J+s is an example
+          of its use.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/VMInspector.cpp:
+        (FormatPrinter):
+        (JSC::FormatPrinter::~FormatPrinter):
+        (JSC::FormatPrinter::print):
+        (JSC::FormatPrinter::printArg):
+        (JSC::FormatPrinter::printWTFString):
+        (JSC::FileFormatPrinter::FileFormatPrinter):
+        (JSC::FileFormatPrinter::printArg):
+        (JSC::StringFormatPrinter::StringFormatPrinter):
+        (JSC::StringFormatPrinter::printArg):
+        (JSC::StringNFormatPrinter::StringNFormatPrinter):
+        (JSC::StringNFormatPrinter::printArg):
+        (JSC::VMInspector::fprintf):
+        (JSC::VMInspector::printf):
+        (JSC::VMInspector::sprintf):
+        (JSC::VMInspector::snprintf):
+        * interpreter/VMInspector.h:
+        (VMInspector):
+
+2012-10-31  Mark Lam  <mark.lam@apple.com>
+
+        64-bit llint PC offset can be negative: using an unsigned shift is a bug.
+        https://bugs.webkit.org/show_bug.cgi?id=100896.
+
+        Reviewed by Filip Pizlo.
+
+        Fixed the PC offset divisions in the 64-bit llint asm to use rshift instead of urshift.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2012-10-30  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        glsl-function-atan.html WebGL conformance test fails after https://bugs.webkit.org/show_bug.cgi?id=99154
+        https://bugs.webkit.org/show_bug.cgi?id=100789
+
+        Reviewed by Filip Pizlo.
+
+        We accidently missed a bitwise double to int64 conversion.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentFill):
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Follow up to better coordinate with iOS feature defines. Make:
+
+          - ENABLE_FILTERS always on
+          - ENABLE_INPUT_* iphonesimulator values point to the iphoneos values
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Sync up FeatureDefine Configuration Files
+        https://bugs.webkit.org/show_bug.cgi?id=100171
+
+        Reviewed by David Kilzer.
+
+        Ensure an identical FeatureDefine files across all projects. Changes:
+
+          - ENABLE_CSS_BOX_DECORATION_BREAK should be in all
+          - ENABLE_PDFKIT_PLUGIN should be in all
+          - ENABLE_RESOLUTION_MEDIA_QUERY should be in all
+          - ENABLE_ENCRYPTED_MEDIA should be in all
+          - ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING with corrected value
+          - Some alphabetical ordering cleanup
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Arrays can change IndexingType in the middle of sorting
+        https://bugs.webkit.org/show_bug.cgi?id=100773
+
+        Reviewed by Filip Pizlo.
+
+        Instead of giving up, we just fetch the appropriate vector based on the current 
+        IndexingType of the array.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortVector):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::currentIndexingData):
+        (JSC::JSObject::currentRelevantLength):
+
+2012-10-29  Anders Carlsson  <andersca@apple.com>
+
+        Build WebKit as C++11 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=100720
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/Base.xcconfig:
+        Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::beginSwitch):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add8):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/JSONObject.cpp:
+        (JSC::appendStringToStringBuilder):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingStringSearch):
+        Add static_casts to prevent implicit type conversions in non-constant initializer lists.
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Simplify Xcode configuration settings that used to vary between OS versions.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+
+2012-10-28  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to unsupported OS and Xcode versions.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig: Removed.
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/Version.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2012-10-29  Michael Saboff  <msaboff@apple.com>
+
+        Non-special escape character sequences cause JSC::Lexer::parseString to create 16 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=100576
+
+        Reviewed by Darin Adler.
+
+        Changed singleEscape() processing to be based on a lookup of a static table.  The table
+        covers ASCII characters SPACE through DEL.  If a character can be a single character escape,
+        then the table provides the non-zero result of that escape.  Updated the result of
+        singleEscape to be an LChar to make the table as small as possible.
+        Added a new test fast/js/normal-character-escapes-in-string-literals.html to validated
+        the behavior.
+
+        * parser/Lexer.cpp:
+        (JSC::singleEscape):
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::parseStringSlowCase):
+
+2012-10-29  Enrica Casucci  <enrica@apple.com>
+
+        Add ENABLE_USERSELECT_ALL feature flag.
+        https://bugs.webkit.org/show_bug.cgi?id=100559
+
+        Reviewed by Eric Seidel.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to emit effectful structure checks
+        https://bugs.webkit.org/show_bug.cgi?id=99260
+
+        Reviewed by Oliver Hunt.
+
+        This change allows us to find out if an array access that has gone polymorphic
+        is operating over known structures - i.e. the primordial array structures of the
+        global object that the code block containing the array access belongs to. We
+        term this state "OriginalArray" for short. The fact that the access has gone
+        polymorphic means that the array profile will not be able to report the set of
+        structures it had seen - but if it can tell us that all of the structures were
+        primordial then it just so happens that we can deduce what the structure set
+        would have been by just querying the code block's global object. This allows us
+        to emit an ArrayifyToStructure instead of an Arrayify if we find that we need to
+        do conversions. The fast path of an ArrayifyToStructure is exactly like the fast
+        path of a CheckStructure and is mostly subject to the same optimizations. It
+        also burns one fewer registers.
+        
+        Essentially the notion of OriginalArray is a super cheap way of getting the
+        array profile to tell us a structure set instead of a singleton structure.
+        Currently, the array profile can only tell us the structure seen at an array
+        access if there was exactly one structure. If there were multiple structures, it
+        won't tell us anything other than the array modes and other auxiliary profiling
+        data (whether there were stores to holes, for example). With OriginalArray, we
+        cheaply get a structure set if all of the structures were primordial for the
+        code block's global object, since in that case the array mode set (ArrayModes)
+        can directly tell us the structure set. In the future, we might consider adding
+        complete structure sets to the array profiles, but I suspect that we would hit
+        diminishing returns if we did so - it would only help if we have array accesses
+        that are both polymorphic and are cross-global-object accesses (rare) or if the
+        arrays had named properties or other structure transitions that are unrelated to
+        indexing type (also rare).
+        
+        This also does away with Arrayify (and the new ArrayifyToStructure) returning
+        the butterfly pointer. This turns out to be faster and easier to CSE.
+        
+        And, this also changes constant folding to be able to eliminate CheckStructure,
+        ForwardCheckStructure, and ArrayifyToStructure in addition to being able to
+        transform them into structure transition watchpoints. This is great for
+        ArrayifyToStructure because then CSE and CFA know that there is no side effect.
+        Converting CheckStructure and ForwardCheckStructure to also behave this way is
+        just a matter of elegance.
+        
+        This has no performance impact right now. It's intended to alleviate some of the
+        regressions seen in the early implementation of
+        https://bugs.webkit.org/show_bug.cgi?id=98606.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        * bytecode/ArrayProfile.h:
+        (JSC):
+        (JSC::ArrayProfile::ArrayProfile):
+        (ArrayProfile):
+        (JSC::ArrayProfile::usesOriginalArrayStructures):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        (JSC::DFG::arrayClassToString):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::withProfile):
+        (JSC::DFG::ArrayMode::isJSArray):
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::isJSArrayWithOriginalStructure):
+        (JSC::DFG::ArrayMode::supportsLength):
+        (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getScopeRegistersLoadElimination):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasStructure):
+        (JSC::DFG::Node::hasArrayMode):
+        (JSC::DFG::Node::arrayMode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::isOriginalArrayStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::nonPropertyTransition):
+
+2012-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        There should not be blind spots in array length array profiling
+        https://bugs.webkit.org/show_bug.cgi?id=100620
+
+        Reviewed by Oliver Hunt.
+
+        I don't think this has any performance impact. But it's good to not have random
+        programs occasionally emit a GetById for array length accesses.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+
+2012-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, make always-true enum-to-int comparisons use casts.
+
+        * dfg/DFGFPRInfo.h:
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::JSValueSource::tagGPR):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2012-10-27  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR exit compilation should defend against argument recoveries from code blocks that are no longer on the inline stack
+        https://bugs.webkit.org/show_bug.cgi?id=100601
+
+        Reviewed by Oliver Hunt.
+
+        This happened to me while I was fixing bugs for https://bugs.webkit.org/show_bug.cgi?id=100599.
+        I'm not sure how to reproduce this.
+
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::baselineCodeBlockFor):
+        (AssemblyHelpers):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2012-10-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Array::Mode needs to be cleaned up
+        https://bugs.webkit.org/show_bug.cgi?id=100599
+
+        Reviewed by Oliver Hunt.
+
+        Turn the previous massive Array::Mode enum into a class that contains four
+        fields, the type, whether it's a JSArray, the level of speculation, and the
+        kind of conversion to perform.
+        
+        No performance or behavioral change.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        (JSC::DFG::ArrayMode::refine):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        (JSC::DFG::arrayTypeToString):
+        (JSC::DFG::arrayClassToString):
+        (DFG):
+        (JSC::DFG::arraySpeculationToString):
+        (JSC::DFG::arrayConversionToString):
+        (JSC::DFG::ArrayMode::toString):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::ArrayMode):
+        (JSC::DFG::ArrayMode::type):
+        (JSC::DFG::ArrayMode::arrayClass):
+        (JSC::DFG::ArrayMode::speculation):
+        (JSC::DFG::ArrayMode::conversion):
+        (JSC::DFG::ArrayMode::asWord):
+        (JSC::DFG::ArrayMode::fromWord):
+        (JSC::DFG::ArrayMode::withSpeculation):
+        (JSC::DFG::ArrayMode::usesButterfly):
+        (JSC::DFG::ArrayMode::isJSArray):
+        (JSC::DFG::ArrayMode::isInBounds):
+        (JSC::DFG::ArrayMode::mayStoreToHole):
+        (JSC::DFG::ArrayMode::isOutOfBounds):
+        (JSC::DFG::ArrayMode::isSlowPut):
+        (JSC::DFG::ArrayMode::canCSEStorage):
+        (JSC::DFG::ArrayMode::lengthNeedsStorage):
+        (JSC::DFG::ArrayMode::modeForPut):
+        (JSC::DFG::ArrayMode::isSpecific):
+        (JSC::DFG::ArrayMode::supportsLength):
+        (JSC::DFG::ArrayMode::benefitsFromStructureCheck):
+        (JSC::DFG::ArrayMode::doesConversion):
+        (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
+        (JSC::DFG::ArrayMode::operator==):
+        (JSC::DFG::ArrayMode::operator!=):
+        (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
+        (JSC::DFG::canCSEStorage):
+        (JSC::DFG::lengthNeedsStorage):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getArrayLengthElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arrayMode):
+        (JSC::DFG::Node::setArrayMode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-27  Dan Bernstein  <mitz@apple.com>
+
+        REAL_PLATFORM_NAME build setting is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=100587
+
+        Reviewed by Mark Rowe.
+
+        Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
+        to PLATFORM_NAME.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/CompilerVersion.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JSC.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/ToolExecutable.xcconfig:
+
+2012-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Forward OSR calculation is wrong in the presence of multiple SetLocals, or a mix of SetLocals and Phantoms
+        https://bugs.webkit.org/show_bug.cgi?id=100461
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        This does a couple of things. First, it removes the part of the change in r131822 that made the forward
+        OSR exit calculator capable of handling multiple SetLocals. That change was wrong, because it would
+        blindly assume that all SetLocals had the same ValueRecovery, and would ignore the possibility that if
+        there is no value recovery then a ForwardCheckStructure on the first SetLocal would not know how to
+        recover the state associated with the second SetLocal. Then, it introduces the invariant that any bytecode
+        op that decomposes into multiple SetLocals must first emit dead SetLocals as hints and then emit a second
+        set of SetLocals to actually do the setting of the locals. This means that if a ForwardCheckStructure (or
+        any other hoisted forward speculation) is inserted, it will always be inserted on the second set of
+        SetLocals (since hoisting only touches the live ones), at which point OSR will already know about the
+        mov hints implied by the first set of (dead) SetLocals. This gives us the behavior we wanted, namely, that
+        a ForwardCheckStructure applied to a variant set by a resolve_with_base-like operation can correctly do a
+        forward exit while also ensuring that prior to exiting we set the appropriate locals.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+
+2012-10-26  Simon Hausmann  <simon.hausmann@digia.com>
+
+        [Qt] Fix the LLInt build on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=97648
+
+        Reviewed by Tor Arne Vestbø.
+
+        The main change for the port on Windows is changing the way offsets are extracted
+        and the LLIntAssembly.h is generated to accomodate release and debug configurations.
+
+        Firstly the LLIntOffsetsExtractor binary is now built as-is (no DESTDIR set) and
+        placed into debug\LLIntOffsetsExtractor.exe and release\LLIntOffsetsExtractor.exe
+        on Windows debug_and_release builds. On other patforms it remainds in the regular
+        out directory.
+
+        Secondly the LLIntAssembly.h files must be different for different build types,
+        so the LLIntAssembly.h generator in DerivedSources.pri operates no on the extractor
+        binary files as input. Using a simple exists() check we verify the presence of either
+        a regular, a debug\LLIntOffsetsExtractor and a release\LLIntOffsetsExtractor binary
+        and process all of them. The resulting assembly files consequently end up in
+        generated\debug\LLIntAssembly.h and generated\release\LLIntAssembly.h.
+
+        In Target.pri we have to also make sure that those directories are in the include
+        path according to the release or debug configuration.
+
+        Lastly a small tweak - swapping WTF.pri and JSC.pri inclusions - in the
+        LLIntOffsetsExtractor build was needed to make sure that we include
+        JavaScriptCore/config.h instead of WTF/config.h, required to fix the
+        build issues originally pasted in bug #97648.
+
+        * DerivedSources.pri:
+        * JavaScriptCore.pro:
+        * LLIntOffsetsExtractor.pro:
+        * Target.pri:
+
+2012-10-26  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        [Qt] Enable JSC's disassembler on x86, x86_64 Linux
+        https://bugs.webkit.org/show_bug.cgi?id=100386
+
+        Reviewed by Simon Hausmann.
+
+        It works fine on Linux x86, x86_64 just needs to be enabled in the
+        QtWebKit build system.
+
+        * DerivedSources.pri:
+        * JavaScriptCore.pri:
+        * Target.pri:
+
+2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        Add feature flags for CSS Device Adaptation
+        https://bugs.webkit.org/show_bug.cgi?id=95960
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-26  Simon Hausmann  <simon.hausmann@digia.com>
+
+        [WIN] Make LLInt offsets extractor work on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=100369
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Open the input file explicitly in binary mode to prevent ruby/Windows from thinking that
+        it's a text mode file that needs even new line conversions. The binary mode parameter is
+        ignored on other platforms.
+
+        * offlineasm/offsets.rb:
+
+2012-10-25  Michael Saboff  <msaboff@apple.com>
+
+        SymbolTableIndexHashTraits::needsDestruction should be set to true
+        https://bugs.webkit.org/show_bug.cgi?id=100437
+
+        Reviewed by Mark Hahnenberg.
+
+        For correctness, set SymbolTableIndexHashTraits::needsDestruction to true since SymbolTableEntry's do
+        need to have their destructor called due to the possibility of rare data.
+
+        * runtime/SymbolTable.h:
+        (SymbolTableIndexHashTraits):
+
+2012-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Arrayify elimination should replace it with GetButterfly rather than Phantom
+        https://bugs.webkit.org/show_bug.cgi?id=100441
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        Made array profiler's to-string helper behave correctly.
+        
+        Made Arrayify elimination do the right thing (convert to GetButterfly).
+        
+        Made CFA's interference analysis track clobbered array modes correctly, mostly by
+        simplifying the machinery.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::arrayModesToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::clobberArrayModes):
+        (AbstractValue):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2012-10-25  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r131793-r131826): Crash going to wikifonia.org
+        https://bugs.webkit.org/show_bug.cgi?id=100281
+
+        Reviewed by Oliver Hunt.
+
+        Restore something that got lost in the resolve refactoring: the ability to give up on life if
+        we see a resolve of 'arguments'.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolveContainingScopeInternal):
+
+2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Conditionalize XHR timeout support
+        https://bugs.webkit.org/show_bug.cgi?id=100356
+
+        Reviewed by Adam Barth.
+
+        Adding XHR_TIMEOUT feature to conditionalize this on ports without network backend support.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-25  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r131836): failures in list styles tests on EFL, GTK
+        https://bugs.webkit.org/show_bug.cgi?id=99824
+
+        Reviewed by Oliver Hunt.
+
+        Saved start of string since it is modified by call convertUTF8ToUTF16().
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithUTF8CString):
+
+2012-10-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG NewArrayBuffer node should keep its data in a structure on the side to free up one of the opInfos
+        https://bugs.webkit.org/show_bug.cgi?id=100328
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGNode.h:
+        (NewArrayBufferData):
+        (DFG):
+        (JSC::DFG::Node::newArrayBufferData):
+        (Node):
+        (JSC::DFG::Node::startConstant):
+        (JSC::DFG::Node::numConstants):
+
+2012-10-25  Mark Lam  <mark.lam@apple.com>
+
+        Update the C++ llint to work with the latest op_resolve... changes.
+        https://bugs.webkit.org/show_bug.cgi?id=100345.
+
+        Reviewed by Oliver Hunt.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        - emit opcode name as label when not using COMPUTED_GOTOs. The new op_resolve
+          opcodes have jumps to these labels.
+        - declare all opcode labels as UNUSED_LABEL()s to keep the compiler happy
+          for opcodes that are not referenced by anyone.
+        * offlineasm/asm.rb:
+        - strip llint_ prefix from opcode names used as labels.
+
+2012-10-24  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Refactor LLInt64 to distinguish the pointer operations from the 64-bit integer operations
+        https://bugs.webkit.org/show_bug.cgi?id=100321
+
+        Reviewed by Filip Pizlo.
+
+        We have refactored the MacroAssembler and JIT compilers to distinguish
+        the pointer operations from the 64-bit integer operations (see bug #99154).
+        Now we want to do the similar work for LLInt, and the goal is same as
+        the one mentioned in 99154.
+
+        This is the first part of the modification: in the offline assembler,
+        adding the support of the "<foo>q" instructions which will be used for
+        64-bit integer operations.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2012-10-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG compileBlahBlahByVal methods for Contiguous and ArrayStorage have only one caller and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=100311
+
+        Reviewed by Mark Hahnenberg.
+
+        Just trying to simplify things before I make them more complicated again.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-23  Andreas Kling  <kling@webkit.org>
+
+        CodeBlock: Give m_putToBaseOperations an inline capacity.
+        <http://webkit.org/b/100190>
+        <rdar://problem/12562466>
+
+        Reviewed by Oliver Hunt.
+
+        Since the CodeBlock constructor always inserts a single PutToBaseOperation, but there's no
+        guarantee that more will follow, give the m_putToBaseOperations vector an inline capacity of 1.
+        There are 4009 of these Vectors on Membuster3, and only 126 of them have more than a single entry.
+
+        This change yields a 1.90MB reduction in memory usage.
+
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+
+2012-10-23  Christophe Dumez  <christophe.dumez@intel.com>
+
+        Regression(r132143): Assertion hit in JSC::Interpreter::StackPolicy::StackPolicy(JSC::Interpreter&, const WTF::StackBounds&)
+        https://bugs.webkit.org/show_bug.cgi?id=100109
+
+        Reviewed by Oliver Hunt.
+
+        Fix possible integer overflow in StackPolicy constructor by
+        using size_t type instead of int for stack sizes. The value
+        returned by StackBounds::size() is of type size_t but was
+        assigned to an int, which may overflow.
+
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::Interpreter::StackPolicy::StackPolicy):
+
+2012-10-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-10-23  Mark Lam  <mark.lam@apple.com>
+
+        Make topCallFrame reliable.
+        https://bugs.webkit.org/show_bug.cgi?id=98928.
+
+        Reviewed by Geoffrey Garen.
+
+        - VM entry points and the GC now uses topCallFrame.
+        - The callerFrame value in CallFrames are now always the previous
+          frame on the stack, except for the first frame which has a
+          callerFrame of 0 (not counting the HostCallFrameFlag).
+          Hence, we can now traverse every frame on the stack all the way
+          back to the first frame.
+        - GlobalExec's will no longer be used as the callerFrame values in
+          call frames.
+        - Added fences and traps for debugging the JSStack in debug builds.
+
+        * bytecode/SamplingTool.h:
+        (SamplingTool):
+        (JSC::SamplingTool::CallRecord::CallRecord):
+        * dfg/DFGOperations.cpp:
+        - Fixed 2 DFG helper functions to flush topCallFrame as expected.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::prepareForExternalCall):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callerFrameNoFlags):
+        (ExecState):
+        (JSC::ExecState::argIndexForRegister):
+        (JSC::ExecState::getArgumentUnsafe):
+        * interpreter/CallFrameClosure.h:
+        (CallFrameClosure):
+        * interpreter/Interpreter.cpp:
+        (JSC):
+        (JSC::eval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::endRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::gatherConservativeRoots):
+        (JSC::JSStack::disableErrorStackReserve):
+        * interpreter/JSStack.h:
+        (JSC):
+        (JSStack):
+        (JSC::JSStack::installFence):
+        (JSC::JSStack::validateFence):
+        (JSC::JSStack::installTrapsAfterFrame):
+        * interpreter/JSStackInlines.h: Added.
+        (JSC):
+        (JSC::JSStack::getTopOfFrame):
+        (JSC::JSStack::getTopOfStack):
+        (JSC::JSStack::getStartOfFrame):
+        (JSC::JSStack::pushFrame):
+        (JSC::JSStack::popFrame):
+        (JSC::JSStack::generateFenceValue):
+        (JSC::JSStack::installFence):
+        (JSC::JSStack::validateFence):
+        (JSC::JSStack::installTrapsAfterFrame):
+        * jit/JITStubs.cpp:
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        - Set frame->codeBlock to 0 for both the above because they are called
+          with partially intitialized frames (cb uninitialized), but may
+          trigger a GC.
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2012-10-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Array::Undecided should be called DFG::Array::SelectUsingPredictions
+        https://bugs.webkit.org/show_bug.cgi?id=100052
+
+        Reviewed by Oliver Hunt.
+
+        No functional change, just renaming. It's a clearer name that more accurately
+        reflects the meaning, and it eliminates the namespace confusion that will happen
+        with the Undecided indexing type in https://bugs.webkit.org/show_bug.cgi?id=98606
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::refineArrayMode):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::canCSEStorage):
+        (JSC::DFG::modeIsSpecific):
+        (JSC::DFG::modeSupportsLength):
+        (JSC::DFG::benefitsFromStructureCheck):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-22  Mark Lam  <mark.lam@apple.com>
+
+        Change stack recursion checks to be based on stack availability.
+        https://bugs.webkit.org/show_bug.cgi?id=99872.
+
+        Reviewed by Filip Pizlo and Geoffrey Garen.
+
+        - Remove m_reentryDepth, ThreadStackType which are now obsolete.
+        - Replaced the reentryDepth checks with a StackBounds check.
+        - Added the Interpreter::StackPolicy class to compute a reasonable
+          stack capacity requirement given the native stack that the
+          interpreter is executing on at that time.
+        - Reserved an amount of JSStack space for the use of error handling
+          and enable its use (using Interpreter::ErrorHandlingMode) when
+          we're about to throw or report an exception.
+        - Interpreter::StackPolicy also allows more native stack space
+          to be used when in ErrorHandlingMode. This is needed in the case
+          of native stack overflows.
+        - Fixed the parser so that it throws a StackOverflowError instead of
+          a SyntaxError when it encounters a stack overflow.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        (JSGlobalContextCreateInGroup):
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::ErrorHandlingMode::ErrorHandlingMode):
+        (JSC):
+        (JSC::Interpreter::ErrorHandlingMode::~ErrorHandlingMode):
+        (JSC::Interpreter::StackPolicy::StackPolicy):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC):
+        (Interpreter):
+        (ErrorHandlingMode):
+        (StackPolicy):
+        (JSC::Interpreter::StackPolicy::requiredCapacity):
+        * interpreter/JSStack.cpp:
+        (JSC):
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::growSlowCase):
+        (JSC::JSStack::enableErrorStackReserve):
+        (JSC::JSStack::disableErrorStackReserve):
+        * interpreter/JSStack.h:
+        (JSStack):
+        (JSC::JSStack::reservationEnd):
+        (JSC):
+        * jsc.cpp:
+        (jscmain):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        * parser/Parser.h:
+        (Parser):
+        (JSC::::parse):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwStackOverflowError):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createContextGroup):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::createLeaked):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        (JSC):
+        (JSGlobalData):
+        * runtime/StringRecursionChecker.h:
+        (JSC::StringRecursionChecker::performCheck):
+        * testRegExp.cpp:
+        (realMain):
+
+2012-10-20  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix 'make dist' for the GTK+ port
+
+        * GNUmakefile.list.am: Add missing files to the source list.
+
+2012-10-21  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [CMake][JSC] Depend on risc.rb to decide when to run the LLInt scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=99917
+
+        Reviewed by Geoffrey Garen.
+
+        Depend on the newly-added risc.rb to make sure we always run the
+        LLInt scripts when one of them changes.
+
+        * CMakeLists.txt:
+
+2012-10-20  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt backends of non-ARM RISC platforms should be able to share code with the existing ARMv7 backend
+        https://bugs.webkit.org/show_bug.cgi?id=99745
+
+        Reviewed by Geoffrey Garen.
+
+        This moves all of the things in armv7.rb that I thought are generally useful out
+        into risc.rb. It also separates some phases (branch ops is separated into one
+        phase that does sensible things, and another that does things that are painfully
+        ARM-specific), and removes ARM assumptions from others by using a callback to
+        drive exactly what lowering must happen. The goal here is to minimize the future
+        maintenance burden of LLInt by ensuring that the various platforms share as much
+        lowering code as possible.
+
+        * offlineasm/armv7.rb:
+        * offlineasm/risc.rb: Added.
+
+2012-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have some facility for recognizing redundant CheckArrays and Arrayifies
+        https://bugs.webkit.org/show_bug.cgi?id=99287
+
+        Reviewed by Mark Hahnenberg.
+
+        Adds reasoning about indexing type sets (i.e. ArrayModes) to AbstractValue, which
+        then enables us to fold away CheckArray's and Arrayify's that are redundant.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::arrayModesToString):
+        (JSC):
+        * bytecode/ArrayProfile.h:
+        (JSC):
+        (JSC::mergeArrayModes):
+        (JSC::arrayModesAlreadyChecked):
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::arrayModesFromStructures):
+        (StructureSet):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::AbstractValue):
+        (JSC::DFG::AbstractValue::clear):
+        (JSC::DFG::AbstractValue::isClear):
+        (JSC::DFG::AbstractValue::makeTop):
+        (JSC::DFG::AbstractValue::clobberStructures):
+        (AbstractValue):
+        (JSC::DFG::AbstractValue::setMostSpecific):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::operator==):
+        (JSC::DFG::AbstractValue::merge):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::filterArrayModes):
+        (JSC::DFG::AbstractValue::validate):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::dump):
+        (JSC::DFG::AbstractValue::clobberArrayModes):
+        (JSC::DFG::AbstractValue::clobberArrayModesSlow):
+        (JSC::DFG::AbstractValue::setFuturePossibleStructure):
+        (JSC::DFG::AbstractValue::filterFuturePossibleStructure):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::modeAlreadyChecked):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::arrayModesFor):
+        (DFG):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::arrayify):
+
+2012-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should not inline array allocations, to make them easier to instrument
+        https://bugs.webkit.org/show_bug.cgi?id=99905
+
+        Reviewed by Mark Hahnenberg.
+
+        This will make it easier to instrument array allocations for the purposes of profiling.
+        It also allows us to kill off a bunch of code. And, this doesn't appear to hurt
+        performance at all. That's expected because these days any hot allocation will end up
+        in the DFG JIT, which does inline these allocations.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array):
+
+2012-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Fix some of the regression cause by the non-local variable reworking
+        https://bugs.webkit.org/show_bug.cgi?id=99896
+
+        Reviewed by Filip Pizlo.
+
+        The non0local variable reworking led to some of the optimisations performed by
+        the bytecode generator being dropped.  This in turn put more pressure on the DFG
+        optimisations.  This exposed a short coming in our double speculation propogation.
+        Now we try to distinguish between places where we should SpecDoubleReal vs generic
+        SpecDouble.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (PredictionPropagationPhase):
+        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
+        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPredictions):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2012-10-19  Michael Saboff  <msaboff@apple.com>
+
+        Lexer should create 8 bit Identifiers for RegularExpressions and ASCII identifiers
+        https://bugs.webkit.org/show_bug.cgi?id=99855
+
+        Reviewed by Filip Pizlo.
+
+        Added makeIdentifier helpers that will always make an 8 bit Identifier or make an
+        Identifier that is the same size as the template parameter.  Used the first in the fast
+        path when looking for a JS identifier and the second when scanning regular expressions.
+
+        * parser/Lexer.cpp:
+        (JSC::::scanRegExp):
+        * parser/Lexer.h:
+        (Lexer):
+        (JSC::::makeIdentifierSameType):
+        (JSC::::makeLCharIdentifier):
+        (JSC::::lexExpectIdentifier):
+
+2012-10-19  Mark Lam  <mark.lam@apple.com>
+
+        Added WTF::StackStats mechanism.
+        https://bugs.webkit.org/show_bug.cgi?id=99805.
+
+        Reviewed by Geoffrey Garen.
+
+        Added StackStats checkpoints and probes.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::append):
+        (JSC::visitChildren):
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::harvestWeakReferences):
+        (JSC::SlotVisitor::finalizeUnconditionalFinalizers):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * parser/Parser.h:
+        (JSC::Parser::canRecurse):
+        * runtime/StringRecursionChecker.h:
+        (StringRecursionChecker):
+
+2012-10-19  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION(r131822): It made 500+ tests crash on 32 bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=99814
+
+        Reviewed by Filip Pizlo.
+
+        Call the correct macro in 32bit. 
+
+        * llint/LowLevelInterpreter.asm:
+
+2012-10-19  Dongwoo Joshua Im  <dw.im@samsung.com>
+
+        Rename ENABLE_CSS3_TEXT_DECORATION to ENABLE_CSS3_TEXT
+        https://bugs.webkit.org/show_bug.cgi?id=99804
+
+        Reviewed by Julien Chaffraix.
+
+        CSS3 text related properties will be implemented under this flag,
+        including text decoration, text-align-last, and text-justify.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-18  Anders Carlsson  <andersca@apple.com>
+
+        Clean up RegExpKey
+        https://bugs.webkit.org/show_bug.cgi?id=99798
+
+        Reviewed by Darin Adler.
+
+        RegExpHash doesn't need to be a class template specialization when the class template is specialized
+        for JSC::RegExpKey only. Make it a nested class of RegExp instead. Also, make operator== a friend function
+        so Hash::equal can see it.
+
+        * runtime/RegExpKey.h:
+        (JSC::RegExpKey::RegExpKey):
+        (JSC::RegExpKey::operator==):
+        (RegExpKey):
+        (JSC::RegExpKey::Hash::hash):
+        (JSC::RegExpKey::Hash::equal):
+        (Hash):
+
+2012-10-19  Mark Lam  <mark.lam@apple.com>
+
+        Bot greening: Follow up to r131877 to fix the Windows build.
+        https://bugs.webkit.org/show_bug.cgi?id=99739.
+
+        Not reviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-10-19  Mark Lam  <mark.lam@apple.com>
+
+        Bot greening: Attempt to fix broken Window build after r131836.
+        https://bugs.webkit.org/show_bug.cgi?id=99739.
+
+        Not reviewed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-10-19  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Unreviewed fix after r131868.
+
+        On JSVALUE64 platforms, JSValue constants can be Imm64 instead of ImmPtr for JIT compilers.
+
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2012-10-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline array profiling should be less accurate, and DFG OSR exit should update array profiles on CheckArray and CheckStructure failure
+        https://bugs.webkit.org/show_bug.cgi?id=99261
+
+        Reviewed by Oliver Hunt.
+
+        This makes array profiling stochastic, like value profiling. The point is to avoid
+        noticing one-off indexing types that we'll never see again, but instead to:
+        
+        Notice the big ones: We want the DFG to compile based on the things that happen with
+        high probability. So, this change makes array profiling do like value profiling and
+        only notice a random subsampling of indexing types that flowed through an array
+        access. Prior to this patch array profiles noticed all indexing types and weighted
+        them identically.
+        
+        Bias the recent: Often an array access will see awkward indexing types during the
+        first handful of executions because of artifacts of program startup. So, we want to
+        bias towards the indexing types that we saw most recently. With this change, array
+        profiling does like value profiling and usually tells use a random sampling that
+        is biased to what happened recently.
+        
+        Have a backup plan: The above two things don't work by themselves because our
+        randomness is not that random (nor do we care enough to make it more random), and
+        because some procedures will have a <1/10 probability event that we must handle
+        without bailing because it dominates a hot loop. So, like value profiling, this
+        patch makes array profiling use OSR exits to tell us why we are bailing out, so
+        that we don't make the same mistake again in the future.
+        
+        This change also makes the way that the 32-bit OSR exit compiler snatches scratch
+        registers more uniform. We don't need a scratch buffer when we can push and pop.
+
+        * bytecode/DFGExitProfile.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitArrayProfilingSite):
+        * llint/LowLevelInterpreter.asm:
+
+2012-10-18  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        [Qt] REGRESSION(r131858): It broke the ARM build
+        https://bugs.webkit.org/show_bug.cgi?id=99809
+
+        Reviewed by Csaba Osztrogonác.
+
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+
+2012-10-18  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Refactor MacroAssembler interfaces to differentiate the pointer operands from the 64-bit integer operands
+        https://bugs.webkit.org/show_bug.cgi?id=99154
+
+        Reviewed by Gavin Barraclough.
+
+        In current JavaScriptCore implementation for JSVALUE64 platform (i.e.,
+        the X64 platform), we assume that the JSValue size is same to the
+        pointer size, and thus EncodedJSValue is simply type defined as a
+        "void*". In the JIT compiler, we also take this assumption and invoke
+        the same macro assembler interfaces for both JSValue and pointer
+        operands. We need to differentiate the operations on pointers from the
+        operations on JSValues, and let them invoking different macro
+        assembler interfaces. For example, we now use the interface of
+        "loadPtr" to load either a pointer or a JSValue, and we need to switch
+        to using "loadPtr" to load a pointer and some new "load64" interface
+        to load a JSValue. This would help us supporting other JSVALUE64
+        platforms where pointer size is not necessarily 64-bits, for example
+        x32 (bug #99153).
+
+        The major modification I made is to introduce the "*64" interfaces in
+        the MacroAssembler for those operations on JSValues, keep the "*Ptr"
+        interfaces for those operations on real pointers, and go through all
+        the JIT compiler code to correct the usage.
+
+        This is the second part of the work, i.e, to correct the usage of the
+        new MacroAssembler interfaces in the JIT compilers, which also means
+        that now EncodedJSValue is defined as a 64-bit integer, and the "*64"
+        interfaces are used for it.
+
+        * assembler/MacroAssembler.h: JSValue immediates should be in Imm64 instead of ImmPtr.
+        (MacroAssembler):
+        (JSC::MacroAssembler::shouldBlind):
+        * dfg/DFGAssemblyHelpers.cpp: Correct the JIT compilers usage of the new interfaces.
+        (JSC::DFG::AssemblyHelpers::jitAssertIsInt32):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSInt32):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSNumber):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSDouble):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsCell):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::emitPutToCallFrameHeader):
+        (JSC::DFG::AssemblyHelpers::branchIfNotCell):
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        (JSC::DFG::AssemblyHelpers::boxDouble):
+        (JSC::DFG::AssemblyHelpers::unboxDouble):
+        (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGScratchRegisterAllocator.h:
+        (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+        * dfg/DFGSilentRegisterSavePlan.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::silentSpill):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::branch64):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::convertToDouble):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
+        (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compileContiguousGetByVal):
+        (JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal):
+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
+        (JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+        (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
+        (JSC::DFG::slowPathFor):
+        (JSC::DFG::virtualForThunkGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_compareAndJumpSlow):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_div):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h: Have some clean-up work as well.
+        (JSC):
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        (JSC::JIT::emitGetFromCallFrameHeader64):
+        (JSC::JIT::emitAllocateJSArray):
+        (JSC::JIT::emitValueProfilingSite):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfBothJSCells):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateIntegers):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_is_boolean):
+        (JSC::JIT::emit_op_is_number):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_not):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_throw_static_error):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_init_lazy_reg):
+        (JSC::JIT::emitSlow_op_convert_this):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emit_op_put_to_base):
+        (JSC::JIT::emit_resolve_operations):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitContiguousGetByVal):
+        (JSC::JIT::emitArrayStorageGetByVal):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::emit_op_init_global_const_check):
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * jit/JITStubCall.h:
+        (JITStubCall):
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::callWithValueProfiling):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfImmediateNumber):
+        (JSC::JSInterfaceJIT::emitJumpIfNotImmediateNumber):
+        (JSC::JSInterfaceJIT::emitLoadJSCell):
+        (JSC::JSInterfaceJIT::emitLoadInt32):
+        (JSC::JSInterfaceJIT::emitLoadDouble):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/JSValue.h: Define JSVALUE64 EncodedJSValue as int64_t, which is also unified with JSVALUE32_64.
+        (JSC):
+        * runtime/JSValueInlineMethods.h: New implementation of some JSValue methods to make them more conformant
+        with the new rule that "JSValue is a 64-bit integer rather than a pointer" for JSVALUE64 platforms.
+        (JSC):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::reinterpretDoubleToInt64):
+        (JSC::reinterpretInt64ToDouble):
+        (JSC::JSValue::asDouble):
+
+2012-10-18  Michael Saboff  <msaboff@apple.com>
+
+        convertUTF8ToUTF16() Should Check for ASCII Input
+        ihttps://bugs.webkit.org/show_bug.cgi?id=99739
+
+        Reviewed by Geoffrey Garen.
+
+        Using the updated convertUTF8ToUTF16() , we can determine if is makes more sense to 
+        create a string using the 8 bit source.  Added a new OpaqueJSString::create(LChar*, unsigned).
+        Had to add a cast n JSStringCreateWithCFString to differentiate which create() to call.
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithUTF8CString):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::create):
+        (OpaqueJSString):
+        (OpaqueJSString::OpaqueJSString):
+
+2012-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Unbreak jsc tests.  Last minute "clever"-ness is clearly just not
+        a good plan.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2012-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Bytecode should not have responsibility for determining how to perform non-local resolves
+        https://bugs.webkit.org/show_bug.cgi?id=99349
+
+        Reviewed by Gavin Barraclough.
+
+        This patch removes lexical analysis from the bytecode generation.  This allows
+        us to delay lookup of a non-local variables until the lookup is actually necessary,
+        and simplifies a lot of the resolve logic in BytecodeGenerator.
+
+        Once a lookup is performed we cache the lookup information in a set of out-of-line
+        buffers in CodeBlock.  This allows subsequent lookups to avoid unnecessary hashing,
+        etc, and allows the respective JITs to recreated optimal lookup code.
+
+        This is currently still a performance regression in LLInt, but most of the remaining
+        regression is caused by a lot of indirection that I'll remove in future work, as well
+        as some work necessary to allow LLInt to perform in line instruction repatching.
+        We will also want to improve the behaviour of the baseline JIT for some of the lookup
+        operations, however this patch was getting quite large already so I'm landing it now
+        that we've reached the bar of "performance-neutral".
+
+        Basic browsing seems to work.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitStructures):
+        (JSC):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addResolve):
+        (JSC::CodeBlock::addPutToBase):
+        (CodeBlock):
+        (JSC::CodeBlock::resolveOperations):
+        (JSC::CodeBlock::putToBaseOperation):
+        (JSC::CodeBlock::numberOfResolveOperations):
+        (JSC::CodeBlock::numberOfPutToBaseOperations):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::globalObjectConstant):
+        (JSC::CodeBlock::setGlobalObjectConstant):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForStructure):
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.h:
+        (JSC):
+        (ResolveGlobalStatus):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetLocalVar):
+        (JSC::BytecodeGenerator::emitInitGlobalConst):
+        (JSC::BytecodeGenerator::emitPutToBase):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ResolveResult::registerResolve):
+        (JSC::ResolveResult::dynamicResolve):
+        (ResolveResult):
+        (JSC::ResolveResult::ResolveResult):
+        (JSC):
+        (NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::~NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::resolved):
+        (JSC::NonlocalResolveInfo::put):
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::getResolveOperations):
+        (JSC::BytecodeGenerator::getResolveWithThisOperations):
+        (JSC::BytecodeGenerator::getResolveBaseOperations):
+        (JSC::BytecodeGenerator::getResolveBaseForPutOperations):
+        (JSC::BytecodeGenerator::getResolveWithBaseForPutOperations):
+        (JSC::BytecodeGenerator::getPutToBaseOperation):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineResolveOperations):
+        (DFG):
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGGraph.h:
+        (ResolveGlobalData):
+        (ResolveOperationData):
+        (DFG):
+        (PutToBaseOperationData):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::resolveOperationsDataIndex):
+        (Node):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::resolveOperations):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::putToBaseOperation):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_put_to_base):
+        (JSC):
+        (JSC::JIT::emit_resolve_operations):
+        (JSC::JIT::emitSlow_link_resolve_operations):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emitSlow_op_resolve):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emitSlow_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emitSlow_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_put_to_base):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_put_to_base):
+        (JSC):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::emit_op_init_global_const_check):
+        (JSC::JIT::emitSlow_op_init_global_const_check):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::emit_op_init_global_const_check):
+        (JSC::JIT::emitSlow_op_init_global_const_check):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSScope.cpp:
+        (JSC::LookupResult::base):
+        (JSC::LookupResult::value):
+        (JSC::LookupResult::setBase):
+        (JSC::LookupResult::setValue):
+        (LookupResult):
+        (JSC):
+        (JSC::setPutPropertyAccessOffset):
+        (JSC::executeResolveOperations):
+        (JSC::JSScope::resolveContainingScopeInternal):
+        (JSC::JSScope::resolveContainingScope):
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::resolveBase):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis):
+        (JSC::JSScope::resolvePut):
+        (JSC::JSScope::resolveGlobal):
+        * runtime/JSScope.h:
+        (JSScope):
+        * runtime/JSVariableObject.cpp:
+        (JSC):
+        * runtime/JSVariableObject.h:
+        (JSVariableObject):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyAccessesAreCacheable):
+        (Structure):
+
+2012-10-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Live oversize copied blocks should count toward overall heap fragmentation
+        https://bugs.webkit.org/show_bug.cgi?id=99548
+
+        Reviewed by Filip Pizlo.
+
+        The CopiedSpace uses overall heap fragmentation to determine whether or not it should do any copying. 
+        Currently it doesn't include live oversize CopiedBlocks in the calculation, but it should. We should 
+        treat them as 100% utilized, since running a copying phase won't be able to free/compact any of their 
+        memory. We can also free any dead oversize CopiedBlocks while we're iterating over them, rather than 
+        iterating over them again at the end of the copying phase.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::startedCopying):
+        (JSC::CopiedSpace::doneCopying): Also removed a branch when iterating over from-space at the end of 
+        copying. Since we eagerly recycle blocks as soon as they're fully evacuated, we should see no
+        unpinned blocks in from-space at the end of copying.
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::recycleBorrowedBlock):
+        * heap/CopyVisitorInlineMethods.h:
+        (JSC::CopyVisitor::checkIfShouldCopy):
+
+2012-10-18  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Build fix after r131701 and r131777.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-10-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Race condition between GCThread and main thread during copying phase
+        https://bugs.webkit.org/show_bug.cgi?id=99641
+
+        Reviewed by Filip Pizlo.
+
+        When a GCThread returns from copyFromShared(), it then calls doneCopying(), which returns 
+        its borrowed CopiedBlock to the CopiedSpace. This final block allows the CopiedSpace to 
+        continue and finish the cleanup of the copying phase. However, the GCThread can loop back 
+        around, see that m_currentPhase is still "Copy", and try to go through the copying phase again. 
+        This can cause all sorts of issues. To fix this, we should add a cyclic barrier to GCThread::waitForNextPhase().
+
+        * heap/GCThread.cpp:
+        (JSC::GCThread::waitForNextPhase): All GCThreads will wait when they finish one iteration until the main thread 
+        notifies them to move down to the second while loop, where they wait for the next GCPhase to start. They also 
+        decrement the m_numberOfActiveGCThreads counter as they begin to wait for the next phase and increment it as 
+        they enter the next phase. This allows the main thread to wait in endCurrentPhase() until all the threads have 
+        finished the current phase and are waiting on the next phase to begin. Without the counter, there would be 
+        no way to ensure that every thread was available for each GCPhase.
+        (JSC::GCThread::gcThreadMain): We now use the m_phaseLock to synchronize with the main thread when we're being created.
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData): As we create each GCThread, we increment the m_numberOfActiveGCThreads
+        counter. When we are done creating the threads, we wait until they're all waiting for the next GCPhase. This prevents 
+        us from leaving some GCThreads behind during the first GCPhase, which could hurt us on our very short-running 
+        benchmarks (e.g. SunSpider).
+        (JSC::GCThreadSharedData::~GCThreadSharedData):
+        (JSC::GCThreadSharedData::startNextPhase): We atomically swap the two flags, m_gcThreadsShouldWait and m_currentPhase, 
+        so that if the threads finish very quickly, they will wait until the main thread is ready to end the current phase.
+        (JSC::GCThreadSharedData::endCurrentPhase): Here atomically we swap the two flags again to allow the threads to 
+        advance to waiting on the next GCPhase. We wait until all of the GCThreads have settled into the second wait loop
+        before allowing the main thread to continue. This prevents us from leaving one of the GCThreads stuck in the first 
+        wait loop if we were to call startNextPhase() before it had time to wake up and move on to the second wait loop.
+        (JSC):
+        (JSC::GCThreadSharedData::didStartMarking): We now use startNextPhase() to properly swap the flags.
+        (JSC::GCThreadSharedData::didFinishMarking): Ditto for endCurrentPhase().
+        (JSC::GCThreadSharedData::didStartCopying): Ditto.
+        (JSC::GCThreadSharedData::didFinishCopying): Ditto.
+        * heap/GCThreadSharedData.h:
+        (GCThreadSharedData):
+        * heap/Heap.cpp: 
+        (JSC::Heap::copyBackingStores): No reason to use the extra reference.
+
+2012-10-18  Pablo Flouret  <pablof@motorola.com>
+
+        Implement css3-conditional's @supports rule
+        https://bugs.webkit.org/show_bug.cgi?id=86146
+
+        Reviewed by Antti Koivisto.
+
+        * Configurations/FeatureDefines.xcconfig:
+            Add an ENABLE_CSS3_CONDITIONAL_RULES flag.
+
+2012-10-18  Michael Saboff  <msaboff@apple.com>
+
+        Make conversion between JSStringRef and WKStringRef work without character size conversions
+        https://bugs.webkit.org/show_bug.cgi?id=99727
+
+        Reviewed by Anders Carlsson.
+
+        Export the string() method for use in WebKit.
+
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::string):
+
+2012-10-18  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [CMake] Avoid unnecessarily running the LLInt generation commands.
+        https://bugs.webkit.org/show_bug.cgi?id=99708
+
+        Reviewed by Rob Buis.
+
+        As described in the comments in the change itself, in some cases
+        the Ruby generation scripts used when LLInt is on would each be
+        run twice in every build even if nothing had changed.
+
+        Fix that by not setting the OBJECT_DEPENDS property of some source
+        files to depend on the generated headers; instead, they are now
+        just part of the final binaries/libraries which use them.
+
+        * CMakeLists.txt:
+
+2012-10-17  Zoltan Horvath  <zoltan@webkit.org>
+
+        Remove the JSHeap memory measurement of the PageLoad performacetests since it creates bogus JSGlobalDatas
+        https://bugs.webkit.org/show_bug.cgi?id=99609 
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove the implementation since it creates bogus JSGlobalDatas in the layout tests.
+
+        * heap/HeapStatistics.cpp:
+        (JSC):
+        * heap/HeapStatistics.h:
+        (HeapStatistics):
+
+2012-10-17  Sam Weinig  <sam@webkit.org>
+
+        Attempt to fix the build.
+
+        * bytecode/GlobalResolveInfo.h: Copied from bytecode/GlobalResolveInfo.h.
+
+2012-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r130826 or r130828): Twitter top bar is dysfunctional
+        https://bugs.webkit.org/show_bug.cgi?id=99577
+        <rdar://problem/12518883>
+
+        Reviewed by Mark Hahnenberg.
+
+        It turns out that it's a good idea to maintain the invariants of your object model, such as that
+        elements past publicLength should have the hole value.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-17  Anders Carlsson  <andersca@apple.com>
+
+        Clean up Vector.h
+        https://bugs.webkit.org/show_bug.cgi?id=99622
+
+        Reviewed by Benjamin Poulain.
+
+        Fix fallout from removing std::max and std::min using declarations.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncIndexOf):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
+
+2012-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Committing new files is so overrated.
+
+        * bytecode/ResolveOperation.h: Added.
+        (JSC):
+        (JSC::ResolveOperation::getAndReturnScopedVar):
+        (JSC::ResolveOperation::checkForDynamicEntriesBeforeGlobalScope):
+        (ResolveOperation):
+        (JSC::ResolveOperation::getAndReturnGlobalVar):
+        (JSC::ResolveOperation::getAndReturnGlobalProperty):
+        (JSC::ResolveOperation::resolveFail):
+        (JSC::ResolveOperation::skipTopScopeNode):
+        (JSC::ResolveOperation::skipScopes):
+        (JSC::ResolveOperation::returnGlobalObjectAsBase):
+        (JSC::ResolveOperation::setBaseToGlobal):
+        (JSC::ResolveOperation::setBaseToUndefined):
+        (JSC::ResolveOperation::setBaseToScope):
+        (JSC::ResolveOperation::returnScopeAsBase):
+        (JSC::PutToBaseOperation::PutToBaseOperation):
+
+2012-10-17  Michael Saboff  <msaboff@apple.com>
+
+        StringPrototype::jsSpliceSubstringsWithSeparators() doesn't optimally handle 8 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=99230
+
+        Reviewed by Geoffrey Garen.
+
+        Added code to select characters8() or characters16() on the not all 8 bit path for both the 
+        processing of the source and the separators.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+
+2012-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Array and object allocations via 'new Object' or 'new Array' should be inlined in bytecode to allow allocation site profiling
+        https://bugs.webkit.org/show_bug.cgi?id=99557
+
+        Reviewed by Geoffrey Garen.
+
+        Removed an inaccurate and misleading comment as per Geoff's review. (I forgot
+        to make this change as part of http://trac.webkit.org/changeset/131644).
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+
+2012-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Bytecode should not have responsibility for determining how to perform non-local resolves
+        https://bugs.webkit.org/show_bug.cgi?id=99349
+
+        Reviewed by Gavin Barraclough.
+
+        This patch removes lexical analysis from the bytecode generation.  This allows
+        us to delay lookup of a non-local variables until the lookup is actually necessary,
+        and simplifies a lot of the resolve logic in BytecodeGenerator.
+
+        Once a lookup is performed we cache the lookup information in a set of out-of-line
+        buffers in CodeBlock.  This allows subsequent lookups to avoid unnecessary hashing,
+        etc, and allows the respective JITs to recreated optimal lookup code.
+
+        This is currently still a performance regression in LLInt, but most of the remaining
+        regression is caused by a lot of indirection that I'll remove in future work, as well
+        as some work necessary to allow LLInt to perform in line instruction repatching.
+        We will also want to improve the behaviour of the baseline JIT for some of the lookup
+        operations, however this patch was getting quite large already so I'm landing it now
+        that we've reached the bar of "performance-neutral".
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitStructures):
+        (JSC):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addResolve):
+        (JSC::CodeBlock::addPutToBase):
+        (CodeBlock):
+        (JSC::CodeBlock::resolveOperations):
+        (JSC::CodeBlock::putToBaseOperation):
+        (JSC::CodeBlock::numberOfResolveOperations):
+        (JSC::CodeBlock::numberOfPutToBaseOperations):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::globalObjectConstant):
+        (JSC::CodeBlock::setGlobalObjectConstant):
+        * bytecode/GlobalResolveInfo.h: Removed.
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForStructure):
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.h:
+        (JSC):
+        (ResolveGlobalStatus):
+        * bytecode/ResolveOperation.h: Added.
+          The new types and logic we use to perform the cached lookups.
+        (JSC):
+        (ResolveOperation):
+        (JSC::ResolveOperation::getAndReturnScopedVar):
+        (JSC::ResolveOperation::checkForDynamicEntriesBeforeGlobalScope):
+        (JSC::ResolveOperation::getAndReturnGlobalVar):
+        (JSC::ResolveOperation::getAndReturnGlobalProperty):
+        (JSC::ResolveOperation::resolveFail):
+        (JSC::ResolveOperation::skipTopScopeNode):
+        (JSC::ResolveOperation::skipScopes):
+        (JSC::ResolveOperation::returnGlobalObjectAsBase):
+        (JSC::ResolveOperation::setBaseToGlobal):
+        (JSC::ResolveOperation::setBaseToUndefined):
+        (JSC::ResolveOperation::setBaseToScope):
+        (JSC::ResolveOperation::returnScopeAsBase):
+        (JSC::PutToBaseOperation::PutToBaseOperation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetLocalVar):
+        (JSC::BytecodeGenerator::emitInitGlobalConst):
+        (JSC::BytecodeGenerator::emitPutToBase):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ResolveResult::registerResolve):
+        (JSC::ResolveResult::dynamicResolve):
+        (ResolveResult):
+        (JSC::ResolveResult::ResolveResult):
+        (JSC):
+        (NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::~NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::resolved):
+        (JSC::NonlocalResolveInfo::put):
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::getResolveOperations):
+        (JSC::BytecodeGenerator::getResolveWithThisOperations):
+        (JSC::BytecodeGenerator::getResolveBaseOperations):
+        (JSC::BytecodeGenerator::getResolveBaseForPutOperations):
+        (JSC::BytecodeGenerator::getResolveWithBaseForPutOperations):
+        (JSC::BytecodeGenerator::getPutToBaseOperation):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileResolveOperations):
+        (DFG):
+        (JSC::DFG::canCompilePutToBaseOperation):
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGGraph.h:
+        (ResolveGlobalData):
+        (ResolveOperationData):
+        (DFG):
+        (PutToBaseOperationData):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::resolveOperationsDataIndex):
+        (Node):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::resolveOperations):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::putToBaseOperation):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_put_to_base):
+        (JSC):
+        (JSC::JIT::emit_resolve_operations):
+        (JSC::JIT::emitSlow_link_resolve_operations):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emitSlow_op_resolve):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emitSlow_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emitSlow_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_put_to_base):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_put_to_base):
+        (JSC):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::emit_op_init_global_const_check):
+        (JSC::JIT::emitSlow_op_init_global_const_check):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::emit_op_init_global_const_check):
+        (JSC::JIT::emitSlow_op_init_global_const_check):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSScope.cpp:
+        (JSC::LookupResult::base):
+        (JSC::LookupResult::value):
+        (JSC::LookupResult::setBase):
+        (JSC::LookupResult::setValue):
+        (LookupResult):
+        (JSC):
+        (JSC::setPutPropertyAccessOffset):
+        (JSC::executeResolveOperations):
+        (JSC::JSScope::resolveContainingScopeInternal):
+        (JSC::JSScope::resolveContainingScope):
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::resolveBase):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis):
+        (JSC::JSScope::resolvePut):
+        (JSC::JSScope::resolveGlobal):
+        * runtime/JSScope.h:
+        (JSScope):
+        * runtime/JSVariableObject.cpp:
+        (JSC):
+        * runtime/JSVariableObject.h:
+        (JSVariableObject):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyAccessesAreCacheable):
+        (Structure):
+
+2012-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Array and object allocations via 'new Object' or 'new Array' should be inlined in bytecode to allow allocation site profiling
+        https://bugs.webkit.org/show_bug.cgi?id=99557
+
+        Reviewed by Geoffrey Garen.
+
+        This uses the old jneq_ptr trick to allow for the bytecode to "see" that the
+        operation in question is what we almost certainly know it to be.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/SpecialPointer.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::expectedFunctionForIdentifier):
+        (JSC):
+        (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_array_with_size):
+        (JSC):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        (JSC):
+        * runtime/ArrayConstructor.h:
+        (JSC):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+
+2012-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT op_get_by_pname should call cti_get_by_val_generic and not cti_get_by_val
+        https://bugs.webkit.org/show_bug.cgi?id=99631
+        <rdar://problem/12483221>
+
+        Reviewed by Mark Hahnenberg.
+
+        cti_get_by_val assumes that the return address has patching metadata associated with it, which won't
+        be true for op_get_by_pname. cti_get_by_val_generic makes no such assumptions.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_pname):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_by_pname):
+
+2012-10-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Block freeing thread should sleep indefinitely when there's no work to do
+        https://bugs.webkit.org/show_bug.cgi?id=98084
+
+        Reviewed by Geoffrey Garen.
+
+        r130212 didn't fully fix the problem.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::blockFreeingThreadMain): We would just continue to the next iteration if 
+        we found that we had zero blocks to copy. We should move the indefinite wait up to where that 
+        check is done so that we properly detect the "no more blocks to copy, wait for more" condition.
+
+2012-10-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, rolling out r131516 and r131550.
+        http://trac.webkit.org/changeset/131516
+        http://trac.webkit.org/changeset/131550
+        https://bugs.webkit.org/show_bug.cgi?id=99349
+
+        It caused zillion different problem on different platforms
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::isGlobalResolve):
+        (JSC::instructionOffsetForNth):
+        (JSC::printGlobalResolveInfo):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitStructures):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::globalResolveInfo):
+        (JSC::CodeBlock::numberOfGlobalResolveInfos):
+        (JSC::CodeBlock::globalResolveInfoCount):
+        * bytecode/GlobalResolveInfo.h: Copied from Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp.
+        (JSC):
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        (GlobalResolveInfo):
+        (JSC::getGlobalResolveInfoBytecodeOffset):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC):
+        (JSC::computeForStructure):
+        (JSC::computeForLLInt):
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.h:
+        (JSC):
+        (ResolveGlobalStatus):
+        * bytecode/ResolveOperation.h: Removed.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC::ResolveResult::registerPointer):
+        (JSC):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetStaticVar):
+        (JSC::BytecodeGenerator::emitInitGlobalConst):
+        (JSC::BytecodeGenerator::emitPutStaticVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ResolveResult::registerResolve):
+        (JSC::ResolveResult::dynamicResolve):
+        (JSC::ResolveResult::lexicalResolve):
+        (JSC::ResolveResult::indexedGlobalResolve):
+        (JSC::ResolveResult::dynamicIndexedGlobalResolve):
+        (JSC::ResolveResult::globalResolve):
+        (JSC::ResolveResult::dynamicGlobalResolve):
+        (JSC::ResolveResult::type):
+        (JSC::ResolveResult::index):
+        (JSC::ResolveResult::depth):
+        (JSC::ResolveResult::globalObject):
+        (ResolveResult):
+        (JSC::ResolveResult::isStatic):
+        (JSC::ResolveResult::isIndexed):
+        (JSC::ResolveResult::isScoped):
+        (JSC::ResolveResult::isGlobal):
+        (JSC::ResolveResult::ResolveResult):
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGGraph.h:
+        (ResolveGlobalData):
+        (DFG):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        (JSC):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        (JSC::JIT::emit_op_get_global_var_watchable):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve):
+        (JSC):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        (JSC::JIT::emitSlow_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve):
+        (JSC):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_skip):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emitSlow_op_resolve_global):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_put_global_var_check):
+        (JSC::JIT::emitSlow_op_put_global_var_check):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_get_global_var):
+        (JSC::JIT::emit_op_put_global_var):
+        (JSC::JIT::emit_op_put_global_var_check):
+        (JSC::JIT::emitSlow_op_put_global_var_check):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::resolveSkip):
+        (JSC::JSScope::resolveGlobal):
+        (JSC::JSScope::resolveGlobalDynamic):
+        (JSC::JSScope::resolveBase):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis):
+        * runtime/JSScope.h:
+        (JSScope):
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+        * runtime/Structure.h:
+
+2012-10-16  Dongwoo Joshua Im  <dw.im@samsung.com>
+
+        [GTK] Fix build break - ResolveOperations.h is not in WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=99538
+
+        Unreviewed build fix.
+
+        There are some files including ResolveOperations.h which is not exist at all.
+
+        * GNUmakefile.list.am: s/ResolveOperations.h/ResolveOperation.h/
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: s/ResolveOperations.h/ResolveOperation.h/
+
+2012-10-16  Jian Li  <jianli@chromium.org>
+
+        Rename feature define ENABLE_WIDGET_REGION to ENABLE_DRAGGBALE_REGION
+        https://bugs.webkit.org/show_bug.cgi?id=98975
+
+        Reviewed by Adam Barth.
+
+        Renaming is needed to better match with the draggable region code. 
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Bytecode should not have responsibility for determining how to perform non-local resolves
+        https://bugs.webkit.org/show_bug.cgi?id=99349
+
+        Reviewed by Gavin Barraclough.
+
+        This patch removes lexical analysis from the bytecode generation.  This allows
+        us to delay lookup of a non-local variables until the lookup is actually necessary,
+        and simplifies a lot of the resolve logic in BytecodeGenerator.
+
+        Once a lookup is performed we cache the lookup information in a set of out-of-line
+        buffers in CodeBlock.  This allows subsequent lookups to avoid unnecessary hashing,
+        etc, and allows the respective JITs to recreated optimal lookup code.
+
+        This is currently still a performance regression in LLInt, but most of the remaining
+        regression is caused by a lot of indirection that I'll remove in future work, as well
+        as some work necessary to allow LLInt to perform in line instruction repatching.
+        We will also want to improve the behaviour of the baseline JIT for some of the lookup
+        operations, however this patch was getting quite large already so I'm landing it now
+        that we've reached the bar of "performance-neutral".
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitStructures):
+        (JSC):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addResolve):
+        (JSC::CodeBlock::addPutToBase):
+        (CodeBlock):
+        (JSC::CodeBlock::resolveOperations):
+        (JSC::CodeBlock::putToBaseOperation):
+        (JSC::CodeBlock::numberOfResolveOperations):
+        (JSC::CodeBlock::numberOfPutToBaseOperations):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::globalObjectConstant):
+        (JSC::CodeBlock::setGlobalObjectConstant):
+        * bytecode/GlobalResolveInfo.h: Removed.
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForStructure):
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.h:
+        (JSC):
+        (ResolveGlobalStatus):
+        * bytecode/ResolveOperation.h: Added.
+          The new types and logic we use to perform the cached lookups.
+        (JSC):
+        (ResolveOperation):
+        (JSC::ResolveOperation::getAndReturnScopedVar):
+        (JSC::ResolveOperation::checkForDynamicEntriesBeforeGlobalScope):
+        (JSC::ResolveOperation::getAndReturnGlobalVar):
+        (JSC::ResolveOperation::getAndReturnGlobalProperty):
+        (JSC::ResolveOperation::resolveFail):
+        (JSC::ResolveOperation::skipTopScopeNode):
+        (JSC::ResolveOperation::skipScopes):
+        (JSC::ResolveOperation::returnGlobalObjectAsBase):
+        (JSC::ResolveOperation::setBaseToGlobal):
+        (JSC::ResolveOperation::setBaseToUndefined):
+        (JSC::ResolveOperation::setBaseToScope):
+        (JSC::ResolveOperation::returnScopeAsBase):
+        (JSC::PutToBaseOperation::PutToBaseOperation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::ResolveResult::checkValidity):
+        (JSC):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
+        (JSC::BytecodeGenerator::emitResolveWithThis):
+        (JSC::BytecodeGenerator::emitGetLocalVar):
+        (JSC::BytecodeGenerator::emitInitGlobalConst):
+        (JSC::BytecodeGenerator::emitPutToBase):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ResolveResult::registerResolve):
+        (JSC::ResolveResult::dynamicResolve):
+        (ResolveResult):
+        (JSC::ResolveResult::ResolveResult):
+        (JSC):
+        (NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::~NonlocalResolveInfo):
+        (JSC::NonlocalResolveInfo::resolved):
+        (JSC::NonlocalResolveInfo::put):
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::getResolveOperations):
+        (JSC::BytecodeGenerator::getResolveWithThisOperations):
+        (JSC::BytecodeGenerator::getResolveBaseOperations):
+        (JSC::BytecodeGenerator::getResolveBaseForPutOperations):
+        (JSC::BytecodeGenerator::getResolveWithBaseForPutOperations):
+        (JSC::BytecodeGenerator::getPutToBaseOperation):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (DFG):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileResolveOperations):
+        (DFG):
+        (JSC::DFG::canCompilePutToBaseOperation):
+        (JSC::DFG::canCompileOpcode):
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGGraph.h:
+        (ResolveGlobalData):
+        (ResolveOperationData):
+        (DFG):
+        (PutToBaseOperationData):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::resolveOperationsDataIndex):
+        (Node):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::resolveOperations):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::putToBaseOperation):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_put_to_base):
+        (JSC):
+        (JSC::JIT::emit_resolve_operations):
+        (JSC::JIT::emitSlow_link_resolve_operations):
+        (JSC::JIT::emit_op_resolve):
+        (JSC::JIT::emitSlow_op_resolve):
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emitSlow_op_resolve_base):
+        (JSC::JIT::emit_op_resolve_with_base):
+        (JSC::JIT::emitSlow_op_resolve_with_base):
+        (JSC::JIT::emit_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_resolve_with_this):
+        (JSC::JIT::emitSlow_op_put_to_base):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_put_to_base):
+        (JSC):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::emit_op_init_global_const_check):
+        (JSC::JIT::emitSlow_op_init_global_const_check):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::emit_op_init_global_const_check):
+        (JSC::JIT::emitSlow_op_init_global_const_check):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSScope.cpp:
+        (JSC::LookupResult::base):
+        (JSC::LookupResult::value):
+        (JSC::LookupResult::setBase):
+        (JSC::LookupResult::setValue):
+        (LookupResult):
+        (JSC):
+        (JSC::setPutPropertyAccessOffset):
+        (JSC::executeResolveOperations):
+        (JSC::JSScope::resolveContainingScopeInternal):
+        (JSC::JSScope::resolveContainingScope):
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::resolveBase):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis):
+        (JSC::JSScope::resolvePut):
+        (JSC::JSScope::resolveGlobal):
+        * runtime/JSScope.h:
+        (JSScope):
+        * runtime/JSVariableObject.cpp:
+        (JSC):
+        * runtime/JSVariableObject.h:
+        (JSVariableObject):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyAccessesAreCacheable):
+        (Structure):
+
+2012-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Accidental switch fall-through in DFG::FixupPhase
+        https://bugs.webkit.org/show_bug.cgi?id=96956
+        <rdar://problem/12313242>
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2012-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        GetScopedVar CSE matches dead GetScopedVar's leading to IR corruption
+        https://bugs.webkit.org/show_bug.cgi?id=99470
+        <rdar://problem/12363698>
+
+        Reviewed by Mark Hahnenberg.
+
+        All it takes is to follow the "if (!shouldGenerate) continue" idiom and everything will be OK.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::globalVarLoadElimination):
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+
+2012-10-16  Dima Gorbik  <dgorbik@apple.com>
+
+        Remove Platform.h include from the header files.
+        https://bugs.webkit.org/show_bug.cgi?id=98665
+
+        Reviewed by Eric Seidel.
+
+        We don't want other clients that include WebKit headers to know about Platform.h.
+
+        * API/tests/minidom.c:
+        * API/tests/testapi.c:
+
+2012-10-16  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        Add missing MIPS functions to assembler.
+        https://bugs.webkit.org/show_bug.cgi?id=98856
+
+        Reviewed by Oliver Hunt.
+
+        Implement missing functions in MacroAssemblerMIPS and MIPSAssembler.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::lb):
+        (MIPSAssembler):
+        (JSC::MIPSAssembler::lh):
+        (JSC::MIPSAssembler::cvtds):
+        (JSC::MIPSAssembler::cvtsd):
+        (JSC::MIPSAssembler::vmov):
+        * assembler/MacroAssemblerMIPS.h:
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::load8Signed):
+        (JSC::MacroAssemblerMIPS::load16Signed):
+        (JSC::MacroAssemblerMIPS::moveDoubleToInts):
+        (JSC::MacroAssemblerMIPS::moveIntsToDouble):
+        (JSC::MacroAssemblerMIPS::loadFloat):
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeFloat):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        (JSC::MacroAssemblerMIPS::addDouble):
+        (JSC::MacroAssemblerMIPS::convertFloatToDouble):
+        (JSC::MacroAssemblerMIPS::convertDoubleToFloat):
+
+2012-10-16  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        MIPS assembler coding-style fix.
+        https://bugs.webkit.org/show_bug.cgi?id=99359
+
+        Reviewed by Oliver Hunt.
+
+        Coding style fix of existing MIPS assembler header files.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::addiu):
+        (JSC::MIPSAssembler::addu):
+        (JSC::MIPSAssembler::subu):
+        (JSC::MIPSAssembler::mul):
+        (JSC::MIPSAssembler::andInsn):
+        (JSC::MIPSAssembler::andi):
+        (JSC::MIPSAssembler::nor):
+        (JSC::MIPSAssembler::orInsn):
+        (JSC::MIPSAssembler::ori):
+        (JSC::MIPSAssembler::xorInsn):
+        (JSC::MIPSAssembler::xori):
+        (JSC::MIPSAssembler::slt):
+        (JSC::MIPSAssembler::sltu):
+        (JSC::MIPSAssembler::sltiu):
+        (JSC::MIPSAssembler::sll):
+        (JSC::MIPSAssembler::sllv):
+        (JSC::MIPSAssembler::sra):
+        (JSC::MIPSAssembler::srav):
+        (JSC::MIPSAssembler::srl):
+        (JSC::MIPSAssembler::srlv):
+        (JSC::MIPSAssembler::lbu):
+        (JSC::MIPSAssembler::lw):
+        (JSC::MIPSAssembler::lwl):
+        (JSC::MIPSAssembler::lwr):
+        (JSC::MIPSAssembler::lhu):
+        (JSC::MIPSAssembler::sb):
+        (JSC::MIPSAssembler::sh):
+        (JSC::MIPSAssembler::sw):
+        (JSC::MIPSAssembler::addd):
+        (JSC::MIPSAssembler::subd):
+        (JSC::MIPSAssembler::muld):
+        (JSC::MIPSAssembler::divd):
+        (JSC::MIPSAssembler::lwc1):
+        (JSC::MIPSAssembler::ldc1):
+        (JSC::MIPSAssembler::swc1):
+        (JSC::MIPSAssembler::sdc1):
+        (MIPSAssembler):
+        (JSC::MIPSAssembler::relocateJumps):
+        (JSC::MIPSAssembler::linkWithOffset):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::add32):
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::sub32):
+        (MacroAssemblerMIPS):
+        (JSC::MacroAssemblerMIPS::load8):
+        (JSC::MacroAssemblerMIPS::load32):
+        (JSC::MacroAssemblerMIPS::load32WithUnalignedHalfWords):
+        (JSC::MacroAssemblerMIPS::load16):
+        (JSC::MacroAssemblerMIPS::store8):
+        (JSC::MacroAssemblerMIPS::store16):
+        (JSC::MacroAssemblerMIPS::store32):
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::test8):
+        (JSC::MacroAssemblerMIPS::test32):
+
+2012-10-16  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Refactor MacroAssembler interfaces to differentiate the pointer operands from the 64-bit integer operands
+        https://bugs.webkit.org/show_bug.cgi?id=99154
+
+        Reviewed by Gavin Barraclough.
+
+        In current JavaScriptCore implementation for JSVALUE64 platform (i.e.,
+        the X64 platform), we assume that the JSValue size is same to the
+        pointer size, and thus EncodedJSValue is simply type defined as a
+        "void*". In the JIT compiler, we also take this assumption and invoke
+        the same macro assembler interfaces for both JSValue and pointer
+        operands. We need to differentiate the operations on pointers from the
+        operations on JSValues, and let them invoking different macro
+        assembler interfaces. For example, we now use the interface of
+        "loadPtr" to load either a pointer or a JSValue, and we need to switch
+        to using "loadPtr" to load a pointer and some new "load64" interface
+        to load a JSValue. This would help us supporting other JSVALUE64
+        platforms where pointer size is not necessarily 64-bits, for example
+        x32 (bug #99153).
+
+        The major modification I made is to introduce the "*64" interfaces in
+        the MacroAssembler for those operations on JSValues, keep the "*Ptr"
+        interfaces for those operations on real pointers, and go through all
+        the JIT compiler code to correct the usage.
+
+        This is the first part of the work, i.e, to add the *64 interfaces to
+        the MacroAssembler.
+
+        * assembler/AbstractMacroAssembler.h: Add the Imm64 interfaces.
+        (AbstractMacroAssembler):
+        (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64):
+        (TrustedImm64):
+        (JSC::AbstractMacroAssembler::Imm64::Imm64):
+        (Imm64):
+        (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64):
+        * assembler/MacroAssembler.h: map <foo>Ptr methods to <foo>64 for X86_64.
+        (MacroAssembler):
+        (JSC::MacroAssembler::peek64):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::poke64):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::negPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::rotateRightPtr):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::loadPtrWithCompactAddressOffsetPatch):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::movePtrToDouble):
+        (JSC::MacroAssembler::moveDoubleToPtr):
+        (JSC::MacroAssembler::comparePtr):
+        (JSC::MacroAssembler::testPtr):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::branchAddPtr):
+        (JSC::MacroAssembler::branchSubPtr):
+        (JSC::MacroAssembler::shouldBlindDouble):
+        (JSC::MacroAssembler::shouldBlind):
+        (JSC::MacroAssembler::RotatedImm64::RotatedImm64):
+        (RotatedImm64):
+        (JSC::MacroAssembler::rotationBlindConstant):
+        (JSC::MacroAssembler::loadRotationBlindedConstant):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::and64):
+        (JSC::MacroAssembler::store64):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
+        (MacroAssemblerX86Common):
+        (JSC::MacroAssemblerX86Common::move):
+        * assembler/MacroAssemblerX86_64.h: Add the <foo>64 methods for X86_64.
+        (JSC::MacroAssemblerX86_64::branchAdd32):
+        (JSC::MacroAssemblerX86_64::add64):
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::and64):
+        (JSC::MacroAssemblerX86_64::neg64):
+        (JSC::MacroAssemblerX86_64::or64):
+        (JSC::MacroAssemblerX86_64::rotateRight64):
+        (JSC::MacroAssemblerX86_64::sub64):
+        (JSC::MacroAssemblerX86_64::xor64):
+        (JSC::MacroAssemblerX86_64::load64):
+        (JSC::MacroAssemblerX86_64::load64WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::load64WithCompactAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::store64):
+        (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::move64ToDouble):
+        (JSC::MacroAssemblerX86_64::moveDoubleTo64):
+        (JSC::MacroAssemblerX86_64::compare64):
+        (JSC::MacroAssemblerX86_64::branch64):
+        (JSC::MacroAssemblerX86_64::branchTest64):
+        (JSC::MacroAssemblerX86_64::test64):
+        (JSC::MacroAssemblerX86_64::branchAdd64):
+        (JSC::MacroAssemblerX86_64::branchSub64):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+
+2012-10-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Make CopiedSpace and MarkedSpace regions independent
+        https://bugs.webkit.org/show_bug.cgi?id=99222
+
+        Reviewed by Filip Pizlo.
+
+        Right now CopiedSpace and MarkedSpace have the same block size and share the same regions, 
+        but there's no reason that they can't have different block sizes while still sharing the 
+        same underlying regions. We should factor the two "used" lists of regions apart so that 
+        MarkedBlocks and CopiedBlocks can be different sizes. Regions will still be a uniform size 
+        so that when they become empty they may be shared between the CopiedSpace and the MarkedSpace, 
+        since benchmarks indicate that sharing is a boon for performance.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::BlockAllocator):
+        * heap/BlockAllocator.h:
+        (JSC):
+        (Region):
+        (JSC::Region::create): We now have a fixed size for Regions so that empty regions can continue to 
+        be shared between the MarkedSpace and CopiedSpace. Once they are used for a specific type of block,
+        however, they can only be used for that type of block until they become empty again.
+        (JSC::Region::createCustomSize):
+        (JSC::Region::Region):
+        (JSC::Region::~Region):
+        (JSC::Region::reset):
+        (BlockAllocator):
+        (JSC::BlockAllocator::RegionSet::RegionSet):
+        (RegionSet):
+        (JSC::BlockAllocator::tryAllocateFromRegion): We change this function so that it correctly 
+        moves blocks between empty, partial, and full lists.
+        (JSC::BlockAllocator::allocate):
+        (JSC::BlockAllocator::allocateCustomSize):
+        (JSC::BlockAllocator::deallocate): Ditto.
+        (JSC::CopiedBlock):
+        (JSC::MarkedBlock):
+        (JSC::BlockAllocator::regionSetFor): We use this so that we can use the same allocate/deallocate
+        functions with different RegionSets. We specialize the function for each type of block that we 
+        want to allocate.
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        * heap/HeapBlock.h:
+        (HeapBlock):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock): For oversize MarkedBlocks, if the block size gets too big we can 
+        underflow the endAtom, which will cause us to segfault when we try to sweep a block. If we're a 
+        custom size MarkedBlock we need to calculate endAtom so it doesn't underflow.
+
+2012-10-14  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT::JIT fails to initialize all of its fields
+        https://bugs.webkit.org/show_bug.cgi?id=99283
+
+        Reviewed by Andreas Kling.
+
+        There were two groups of such fields, all of which are eventually initialized
+        prior to use inside of privateCompile(). But it's safer to make sure that they
+        are initialized in the constructor as well, since we may use the JIT to do a
+        stub compile without calling into privateCompile().
+        
+        Unsigned index fields for dynamic repatching meta-data: this change
+        initializes them to UINT_MAX, so we should crash if we try to use those
+        indices without initializing them.
+        
+        Boolean flags for value profiling: this change initializes them to false, so
+        we at worst turn off value profiling.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+
+2012-10-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        We should avoid weakCompareAndSwap when parallel GC is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=99331
+
+        Reviewed by Filip Pizlo.
+
+        CopiedBlock::reportLiveBytes and didEvacuateBytes uses weakCompareAndSwap, which some platforms 
+        don't support. For platforms that don't have parallel GC enabled, we should just use a normal store.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        (JSC::CopiedBlock::didEvacuateBytes):
+
+2012-10-15  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-10-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should handle polymorphic array modes by eagerly transforming arrays into the most general applicable form
+        https://bugs.webkit.org/show_bug.cgi?id=99269
+
+        Reviewed by Geoffrey Garen.
+
+        This kills off a bunch of code for "polymorphic" array modes in the DFG. It should
+        also be a performance win for code that uses a lot of array storage arrays.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (JSC::DFG::modeUsesButterfly):
+        (JSC::DFG::modeIsJSArray):
+        (JSC::DFG::mayStoreToTail):
+        (JSC::DFG::mayStoreToHole):
+        (JSC::DFG::canCSEStorage):
+        (JSC::DFG::modeSupportsLength):
+        (JSC::DFG::benefitsFromStructureCheck):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-14  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(126886): Fat binary builds don't know how to handle architecture variants to which the LLInt is agnostic
+        https://bugs.webkit.org/show_bug.cgi?id=99270
+
+        Reviewed by Geoffrey Garen.
+
+        The fix is to hash cons the offsets based on configuration index, not the offsets
+        themselves.
+
+        * offlineasm/offsets.rb:
+
+2012-10-13  Filip Pizlo  <fpizlo@apple.com>
+
+        IndexingType should not have a bit for each type
+        https://bugs.webkit.org/show_bug.cgi?id=98997
+
+        Reviewed by Oliver Hunt.
+
+        Somewhat incidentally, the introduction of butterflies led to each indexing
+        type being represented by a unique bit. This is superficially nice since it
+        allows you to test if a structure corresponds to a particular indexing type
+        by saying !!(structure->indexingType() & TheType). But the downside is that
+        given the 8 bits we have for the m_indexingType field, that leaves only a
+        small number of possible indexing types if we have one per bit.
+        
+        This changeset changes the indexing type to be:
+        
+        Bit #1: Tells you if you're an array.
+        
+        Bits #2 - #5: 16 possible indexing types, including the blank type for
+            objects that don't have indexed properties.
+        
+        Bits #6-8: Auxiliary bits that we could use for other things. Currently we
+            just use one of those bits, for MayHaveIndexedAccessors.
+        
+        This is performance-neutral, and is primarily intended to give us more
+        breathing room for introducing new inferred array modes.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::jumps):
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::patchableBranch32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::patchableBranch32):
+        (MacroAssemblerARMv7):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::modeAlreadyChecked):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateJSArray):
+        (JSC::JIT::chooseArrayMode):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitContiguousGetByVal):
+        (JSC::JIT::emitArrayStorageGetByVal):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitContiguousGetByVal):
+        (JSC::JIT::emitArrayStorageGetByVal):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/IndexingType.h:
+        (JSC):
+        (JSC::hasIndexedProperties):
+        (JSC::hasContiguous):
+        (JSC::hasFastArrayStorage):
+        (JSC::hasArrayStorage):
+        (JSC::shouldUseSlowPut):
+        * runtime/JSGlobalObject.cpp:
+        (JSC):
+        * runtime/StructureTransitionTable.h:
+        (JSC::newIndexingType):
+
+2012-10-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG structure check hoisting should attempt to ignore side effects and make transformations that are sound even in their presence
+        https://bugs.webkit.org/show_bug.cgi?id=99262
+
+        Reviewed by Oliver Hunt.
+
+        This hugely simplifies the structure check hoisting phase. It will no longer be necessary
+        to modify it when the effectfulness of operations changes. This also enables the hoister
+        to hoist effectful things in the future.
+        
+        The downside is that the hoister may end up adding strictly more checks than were present
+        in the original code, if the code truly has a lot of side-effects. I don't see evidence
+        of this happening. This patch does have some speed-ups and some slow-downs, but is
+        neutral in the average, and the slow-downs do not appear to have more structure checks
+        than ToT.
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (StructureCheckHoistingPhase):
+        (CheckData):
+        (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
+
+2012-10-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix the build of universal binary with ARMv7s of JavaScriptCore
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+
+2012-10-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Array length array profiling is broken in the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=99258
+
+        Reviewed by Oliver Hunt.
+
+        The code generator for array length stubs calls into
+        emitArrayProfilingSiteForBytecodeIndex(), which emits profiling only if
+        canBeOptimized() returns true. But m_canBeOptimized is only initialized during
+        full method compiles, so in a stub compile it may (or may not) be false, meaning
+        that we may, or may not, get meaningful profiling info.
+        
+        This appeared to not affect too many programs since the LLInt has good array
+        length array profiling.
+
+        * jit/JIT.h:
+        (JSC::JIT::compilePatchGetArrayLength):
+
+2012-10-14  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for WinCE after r131089.
+
+        WinCE does not support getenv().
+
+        * runtime/Options.cpp:
+        (JSC::overrideOptionWithHeuristic):
+
+2012-10-12  Kangil Han  <kangil.han@samsung.com>
+
+        Fix build error on DFGSpeculativeJIT32_64.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=99234
+
+        Reviewed by Anders Carlsson.
+
+        Seems BUG 98608 causes build error on 32bit machine so fix it.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Contiguous array allocation should always be inlined
+        https://bugs.webkit.org/show_bug.cgi?id=98608
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+
+        This inlines contiguous array allocation in the most obvious way possible.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branchSubPtr):
+        (MacroAssembler):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (MacroAssemblerX86_64):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (CCallHelpers):
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h: Added.
+        (DFG):
+        (CallArrayAllocatorSlowPathGenerator):
+        (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator):
+        (JSC::DFG::CallArrayAllocatorSlowPathGenerator::generateInternal):
+        (CallArrayAllocatorWithVariableSizeSlowPathGenerator):
+        (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
+        (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::generateInternal):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Race condition during CopyingPhase can lead to deadlock
+        https://bugs.webkit.org/show_bug.cgi?id=99226
+
+        Reviewed by Filip Pizlo.
+
+        The main thread calls startCopying() for each of the GCThreads at the beginning of the copy phase. 
+        It then proceeds to start copying. If copying completes before one of the GCThreads wakes up, the 
+        main thread will set m_currentPhase back to NoPhase, the GCThread will wake up, see that there's 
+        nothing to do, and then it will go back to sleep without ever calling CopyVisitor::doneCopying() 
+        to return its borrowed block to the CopiedSpace. CopiedSpace::doneCopying() will then sleep forever 
+        waiting on the block.
+
+        The fix for this is to make sure we call CopiedSpace::doneCopying() on the main thread before we 
+        call GCThreadSharedData::didFinishCopying(), which sets the m_currentPhase flag to NoPhase. This 
+        way we will wait until all threads have woken up and given back their borrowed blocks before 
+        clearing the flag.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::copyBackingStores):
+
+2012-10-12  Anders Carlsson  <andersca@apple.com>
+
+        Move macros from Parser.h to Parser.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=99217
+
+        Reviewed by Andreas Kling.
+
+        There are a bunch of macros in Parser.h that are only used in Parser.cpp. Move them to Parser.cpp
+        so they won't pollute the global namespace.
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        (JSC):
+
+2012-10-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Another build fix after r131213
+
+        Added some symbol magic to placate the linker on some platforms.
+
+        * JavaScriptCore.order:
+
+2012-10-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Build fix after r131213
+
+        Removed an unused variable that was making compilers unhappy.
+
+        * heap/GCThread.cpp:
+        (JSC::GCThread::GCThread):
+        * heap/GCThread.h:
+        (GCThread):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+
+2012-10-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Copying collection shouldn't require O(live bytes) memory overhead
+        https://bugs.webkit.org/show_bug.cgi?id=98792
+
+        Reviewed by Filip Pizlo.
+
+        Currently our copying collection occurs simultaneously with the marking phase. We'd like 
+        to be able to reuse CopiedBlocks as soon as they become fully evacuated, but this is not 
+        currently possible because we don't know the liveness statistics of each old CopiedBlock 
+        until marking/copying has already finished. Instead, we have to allocate additional memory 
+        from the OS to use as our working set of CopiedBlocks while copying. We then return the 
+        fully evacuated old CopiedBlocks back to the block allocator, thus giving our copying phase 
+        an O(live bytes) overhead.
+
+        To fix this, we should instead split the copying phase apart from the marking phase. This 
+        way we have full liveness data for each CopiedBlock during the copying phase so that we 
+        can reuse them the instant they become fully evacuated. With the additional liveness data 
+        that each CopiedBlock accumulates, we can add some additional heuristics to the collector. 
+        For example, we can calculate our global Heap fragmentation and only choose to do a copying 
+        phase if that fragmentation exceeds some limit. As another example, we can skip copying 
+        blocks that are already above a particular fragmentation limit, which allows older objects 
+        to coalesce into blocks that are rarely copied.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopiedBlock.h:
+        (CopiedBlock):
+        (JSC::CopiedBlock::CopiedBlock): Added support for tracking live bytes in a CopiedBlock in a 
+        thread-safe fashion.
+        (JSC::CopiedBlock::reportLiveBytes): Adds a number of live bytes to the block in a thread-safe 
+        fashion using compare and swap.
+        (JSC):
+        (JSC::CopiedBlock::didSurviveGC): Called when a block survives a single GC without being 
+        evacuated. This could be called for a couple reasons: (a) the block was pinned or (b) we 
+        decided not to do any copying. A block can become pinned for a few reasons: (1) a pointer into 
+        the block was found during the conservative scan. (2) the block was deemed full enough to 
+        not warrant any copying. (3) The block is oversize and was found to be live. 
+        (JSC::CopiedBlock::didEvacuateBytes): Called when some number of bytes are copied from this 
+        block. If the number of live bytes ever hits zero, the block will return itself to the 
+        BlockAllocator to be recycled.
+        (JSC::CopiedBlock::canBeRecycled): Indicates that a block has no live bytes and can be 
+        immediately recycled. This is used for blocks that are found to have zero live bytes at the 
+        beginning of the copying phase.
+        (JSC::CopiedBlock::shouldEvacuate): This function returns true if the current fragmentation 
+        of the block is above our fragmentation threshold, and false otherwise.
+        (JSC::CopiedBlock::isPinned): Added an accessor for the pinned flag
+        (JSC::CopiedBlock::liveBytes): 
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::CopiedSpace):
+        (JSC::CopiedSpace::doneFillingBlock): Changed so that we can exchange our filled block for a 
+        fresh block. This avoids the situation where a thread returns its borrowed block, it's the last 
+        borrowed block, so CopiedSpace thinks that copying has completed, and it starts doing all of the 
+        copying phase cleanup. In actuality, the thread wanted another block after returning the current 
+        block. So we allow the thread to atomically exchange its block for another block.
+        (JSC::CopiedSpace::startedCopying): Added the calculation of global Heap fragmentation to 
+        determine if the copying phase should commence. We include the MarkedSpace in our fragmentation 
+        calculation by assuming that the MarkedSpace is 0% fragmented since we can reuse any currently 
+        free memory in it (i.e. we ignore any internal fragmentation in the MarkedSpace). While we're 
+        calculating the fragmentation of CopiedSpace, we also return any free blocks we find along the 
+        way (meaning liveBytes() == 0).
+        (JSC):
+        (JSC::CopiedSpace::doneCopying): We still have to iterate over all the blocks, regardless of
+        whether the copying phase took place or not so that we can reset all of the live bytes counters 
+        and un-pin any pinned blocks.
+        * heap/CopiedSpace.h:
+        (CopiedSpace):
+        (JSC::CopiedSpace::shouldDoCopyPhase):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::recycleEvacuatedBlock): This function is distinct from recycling a borrowed block 
+        because a borrowed block hasn't been added to the CopiedSpace yet, but an evacuated block is still
+        currently in CopiedSpace, so we have to make sure we properly remove all traces of the block from 
+        CopiedSpace before returning it to BlockAllocator.
+        (JSC::CopiedSpace::recycleBorrowedBlock): Renamed to indicate the distinction mentioned above.
+        * heap/CopyVisitor.cpp: Added.
+        (JSC):
+        (JSC::CopyVisitor::CopyVisitor):
+        (JSC::CopyVisitor::copyFromShared): Main function for any thread participating in the copying phase.
+        Grabs chunks of MarkedBlocks from the shared list and copies the backing store of anybody who needs
+        it until there are no more chunks to copy.
+        * heap/CopyVisitor.h: Added.
+        (JSC):
+        (CopyVisitor):
+        * heap/CopyVisitorInlineMethods.h: Added.
+        (JSC):
+        (GCCopyPhaseFunctor):
+        (JSC::GCCopyPhaseFunctor::GCCopyPhaseFunctor):
+        (JSC::GCCopyPhaseFunctor::operator()):
+        (JSC::CopyVisitor::checkIfShouldCopy): We don't have to check shouldEvacuate() because all of those 
+        checks are done during the marking phase.
+        (JSC::CopyVisitor::allocateNewSpace): 
+        (JSC::CopyVisitor::allocateNewSpaceSlow):
+        (JSC::CopyVisitor::startCopying): Initialization function for a thread that is about to start copying.
+        (JSC::CopyVisitor::doneCopying):
+        (JSC::CopyVisitor::didCopy): This callback is called by an object that has just successfully copied its
+        backing store. It indicates to the CopiedBlock that somebody has just finished evacuating some number of 
+        bytes from it, and, if the CopiedBlock now has no more live bytes, can be recycled immediately.
+        * heap/GCThread.cpp: Added.
+        (JSC):
+        (JSC::GCThread::GCThread): This is a new class that encapsulates a single thread responsible for participating 
+        in a specific set of GC phases. Currently, that set of phases includes Mark, Copy, and Exit. Each thread 
+        monitors a shared variable in its associated GCThreadSharedData. The main thread updates this m_currentPhase
+        variable as collection progresses through the various phases. Parallel marking still works exactly like it 
+        has. In other words, the "run loop" for each of the GC threads sits above any individual phase, thus keeping 
+        the separate phases of the collector orthogonal.
+        (JSC::GCThread::threadID):
+        (JSC::GCThread::initializeThreadID):
+        (JSC::GCThread::slotVisitor):
+        (JSC::GCThread::copyVisitor):
+        (JSC::GCThread::waitForNextPhase):
+        (JSC::GCThread::gcThreadMain):
+        (JSC::GCThread::gcThreadStartFunc):
+        * heap/GCThread.h: Added.
+        (JSC):
+        (GCThread):
+        * heap/GCThreadSharedData.cpp: The GCThreadSharedData now has a list of GCThread objects rather than raw 
+        ThreadIdentifiers.
+        (JSC::GCThreadSharedData::resetChildren):
+        (JSC::GCThreadSharedData::childVisitCount):
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::~GCThreadSharedData):
+        (JSC::GCThreadSharedData::reset):
+        (JSC::GCThreadSharedData::didStartMarking): Callback to let the GCThreadSharedData know that marking has 
+        started and updates the m_currentPhase variable and notifies the GCThreads accordingly.
+        (JSC::GCThreadSharedData::didFinishMarking): Ditto for finishing marking. 
+        (JSC::GCThreadSharedData::didStartCopying): Ditto for starting the copying phase.
+        (JSC::GCThreadSharedData::didFinishCopying): Ditto for finishing copying. 
+        * heap/GCThreadSharedData.h:
+        (JSC):
+        (GCThreadSharedData):
+        (JSC::GCThreadSharedData::getNextBlocksToCopy): Atomically gets the next chunk of work for a copying thread.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        (JSC):
+        (JSC::Heap::copyBackingStores): Responsible for setting up the copying phase, notifying the copying threads, 
+        and doing any copying work if necessary.
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (Heap):
+        (JSC):
+        (JSC::CopyFunctor::CopyFunctor):
+        (CopyFunctor):
+        (JSC::CopyFunctor::operator()):
+        * heap/IncrementalSweeper.cpp: Changed the incremental sweeper to have a reference to the list of MarkedBlocks 
+        that need sweeping, since this now resides in the Heap so that it can be easily shared by the GCThreads.
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::startSweeping):
+        * heap/IncrementalSweeper.h:
+        (JSC):
+        (IncrementalSweeper):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::setup):
+        (JSC::SlotVisitor::drainFromShared): We no longer do any copying-related work here.
+        (JSC):
+        * heap/SlotVisitor.h:
+        (SlotVisitor):
+        * heap/SlotVisitorInlineMethods.h:
+        (JSC):
+        (JSC::SlotVisitor::copyLater): Notifies the CopiedBlock that there are some live bytes that may need 
+        to be copied.
+        * runtime/Butterfly.h:
+        (JSC):
+        (Butterfly):
+        * runtime/ButterflyInlineMethods.h:
+        (JSC::Butterfly::createUninitializedDuringCollection): Uses the new CopyVisitor.
+        * runtime/ClassInfo.h:
+        (MethodTable): Added new "virtual" function copyBackingStore to method table.
+        (JSC):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::copyBackingStore): Default implementation that does nothing.
+        (JSC):
+        * runtime/JSCell.h:
+        (JSC):
+        (JSCell):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly): Does the actual copying of the butterfly.
+        (JSC):
+        (JSC::JSObject::visitButterfly): Calls copyLater for the butterfly.
+        (JSC::JSObject::copyBackingStore): 
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSCell::methodTable):
+        (JSC::JSCell::inherits):
+        * runtime/Options.h: Added two new constants, minHeapUtilization and minCopiedBlockUtilization, 
+        to govern the amount of fragmentation we allow before doing copying.
+        (JSC):
+
+2012-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG array allocation calls should not return an encoded JSValue
+        https://bugs.webkit.org/show_bug.cgi?id=99196
+
+        Reviewed by Mark Hahnenberg.
+
+        The array allocation operations now return a pointer instead. This makes it
+        easier to share code between 32-bit and 64-bit.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-01  Jer Noble  <jer.noble@apple.com>
+
+        Enable ENCRYPTED_MEDIA support on Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=98044
+
+        Reviewed by Anders Carlsson.
+
+        Enable the ENCRYPTED_MEDIA flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed. It should be possible to build JSC on ARMv7.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::patchableBranchPtr):
+
+2012-10-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        BlockAllocator should use regions as its VM allocation abstraction
+        https://bugs.webkit.org/show_bug.cgi?id=99107
+
+        Reviewed by Geoffrey Garen.
+
+        Currently the BlockAllocator allocates a single block at a time directly from the OS. Our block 
+        allocations are on the large-ish side (64 KB) to amortize across many allocations the expense of 
+        mapping new virtual memory from the OS. These large blocks are then shared between the MarkedSpace 
+        and the CopiedSpace. This design makes it difficult to vary the size of the blocks in different 
+        parts of the Heap while still allowing us to amortize the VM allocation costs.
+
+        We should redesign the BlockAllocator so that it has a layer of indirection between blocks that are 
+        used by the allocator/collector and our primary unit of VM allocation from the OS. In particular, 
+        the BlockAllocator should allocate Regions of virtual memory from the OS, which are then subdivided 
+        into one or more Blocks to be used in our custom allocators. This design has the following nice properties:
+
+        1) We can remove the knowledge of PageAllocationAligned from HeapBlocks. Each HeapBlock will now 
+           only know what Region it belongs to. The Region maintains all the metadata for how to allocate 
+           and deallocate virtual memory from the OS.
+
+        2) We can easily allocate in larger chunks than we need to satisfy a particular request for a Block. 
+           We can then continue to amortize our VM allocation costs while allowing for smaller block sizes, 
+           which should increase locality in the mutator when allocating, lazy sweeping, etc.
+
+        3) By encapsulating the logic of where our memory comes from inside of the Region class, we can more 
+           easily transition over to allocating VM from a specific range of pre-reserved address space. This 
+           will be a necessary step along the way to 32-bit pointers.
+
+        This particular patch will not change the size of MarkedBlocks or CopiedBlocks, nor will it change how 
+        much VM we allocate per failed Block request. It only sets up the data structures that we need to make 
+        these changes in future patches.
+
+        Most of the changes in this patch relate to the addition of the Region class to be used by the 
+        BlockAllocator and the threading of changes made to BlockAllocator's interface through to the call sites.
+
+        * heap/BlockAllocator.cpp: The BlockAllocator now has three lists that track the three disjoint sets of
+        Regions that it cares about: empty regions, partially full regions, and completely full regions. 
+        Empty regions have no blocks currently in use and can be freed immediately if the freeing thread 
+        determines they should be. Partial regions have some blocks used, but aren't completely in use yet. 
+        These regions are preferred for recycling before empty regions to mitigate fragmentation within regions.
+        Completely full regions are no longer able to be used for allocations. Regions move between these 
+        three lists as they are created and their constituent blocks are allocated and deallocated.
+        (JSC::BlockAllocator::BlockAllocator):
+        (JSC::BlockAllocator::~BlockAllocator):
+        (JSC::BlockAllocator::releaseFreeRegions):
+        (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
+        (JSC::BlockAllocator::waitForRelativeTime):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+        * heap/BlockAllocator.h:
+        (JSC):
+        (DeadBlock):
+        (JSC::DeadBlock::DeadBlock):
+        (Region):
+        (JSC::Region::blockSize):
+        (JSC::Region::isFull):
+        (JSC::Region::isEmpty):
+        (JSC::Region::create): This function is responsible for doing the actual VM allocation. This should be the 
+        only function in the entire JSC object runtime that calls out the OS for virtual memory allocation.
+        (JSC::Region::Region):
+        (JSC::Region::~Region):
+        (JSC::Region::allocate):
+        (JSC::Region::deallocate):
+        (BlockAllocator):
+        (JSC::BlockAllocator::tryAllocateFromRegion): Helper function that encapsulates checking a particular list 
+        of regions for a free block.
+        (JSC::BlockAllocator::allocate):
+        (JSC::BlockAllocator::allocateCustomSize): This function is responsible for allocating one-off custom size 
+        regions for use in oversize allocations in both the MarkedSpace and the CopiedSpace. These regions are not 
+        tracked by the BlockAllocator. The only pointer to them is in the HeapBlock that is returned. These regions 
+        contain exactly one block.
+        (JSC::BlockAllocator::deallocate):
+        (JSC::BlockAllocator::deallocateCustomSize): This function is responsible for deallocating one-off custom size
+        regions. The regions are deallocated back to the OS eagerly.
+        * heap/CopiedBlock.h: Re-worked CopiedBlocks to use Regions instead of PageAllocationAligned.
+        (CopiedBlock):
+        (JSC::CopiedBlock::createNoZeroFill):
+        (JSC::CopiedBlock::create):
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::payloadEnd):
+        (JSC::CopiedBlock::capacity):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::~CopiedSpace):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::doneCopying):
+        * heap/CopiedSpaceInlineMethods.h:
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        (JSC::CopiedSpace::allocateBlock):
+        * heap/HeapBlock.h:
+        (JSC::HeapBlock::destroy):
+        (JSC::HeapBlock::HeapBlock):
+        (JSC::HeapBlock::region):
+        (HeapBlock):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::capacity):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+
+2012-10-11  Filip Pizlo  <fpizlo@apple.com>
+
+        UInt32ToNumber and OSR exit should be aware of copy propagation and correctly recover both versions of a variable that was subject to a UInt32ToNumber cast
+        https://bugs.webkit.org/show_bug.cgi?id=99100
+        <rdar://problem/12480955>
+
+        Reviewed by Michael Saboff and Mark Hahnenberg.
+
+        Fixed by forcing UInt32ToNumber to use a different register. This "undoes" the copy propagation that we
+        would have been doing, since it has no performance effect in this case and has the benefit of making the
+        OSR exit compiler a lot simpler.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+
+2012-10-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed some more static assumptions about inline object capacity
+        https://bugs.webkit.org/show_bug.cgi?id=98603
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Use JSObject::allocationSize()
+        for a little more flexibility. We still pass it a constant inline capacity
+        because the JIT doesn't have a strategy for selecting a size class based
+        on non-constant capacity yet. "INLINE_STORAGE_CAPACITY" is a marker for
+        code that makes static assumptions about object size.
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Ditto for the rest of our many execution engines.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::allocationSize):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSFinalObject::create): New helper function for computing object
+        size dynamically, since we plan to have objects of different sizes.
+
+        (JSC::JSFinalObject::JSFinalObject): Note that our m_inlineStorage used
+        to auto-generate an implicit C++ constructor with default null initialization.
+        This memory is not observed in its uninitialized state, and our LLInt and
+        JIT allocators do not initialize it, so I did not add any explicit code
+        to do so, now that the implicit code is gone.
+
+        (JSC::JSObject::offsetOfInlineStorage): Changed the math here to match
+        inlineStorageUnsafe(), since we can rely on an explicit data member anymore.
+
+2012-10-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Enable RUNTIME_HEURISTICS all the time, for easier testing
+        https://bugs.webkit.org/show_bug.cgi?id=99090
+
+        Reviewed by Filip Pizlo.
+
+        I find myself using this a lot, and there doesn't seem to be an obvious
+        reason to compile it out, since it only runs once at startup.
+
+        * runtime/Options.cpp:
+        (JSC::overrideOptionWithHeuristic):
+        (JSC::Options::initialize):
+        * runtime/Options.h: Removed the #ifdef.
+
+2012-10-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed ASSERT_CLASS_FITS_IN_CELL
+        https://bugs.webkit.org/show_bug.cgi?id=97634
+
+        Reviewed by Mark Hahnenberg.
+
+        Our collector now supports arbitrarily sized objects, so the ASSERT is not needed.
+
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObject.cpp:
+        * heap/MarkedSpace.h:
+        * jsc.cpp:
+        * runtime/Arguments.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanObject.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/Error.cpp:
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/InternalFunction.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSBoundFunction.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalThis.cpp:
+        * runtime/JSNameScope.cpp:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSScope.cpp:
+        * runtime/JSWithScope.cpp:
+        * runtime/JSWrapperObject.cpp:
+        * runtime/MathObject.cpp:
+        * runtime/NameConstructor.cpp:
+        * runtime/NamePrototype.cpp:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorPrototype.cpp:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpMatchesArray.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/StringPrototype.cpp:
+        * testRegExp.cpp: Removed the ASSERT.
+
+2012-10-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline code blocks that use new_array_buffer
+        https://bugs.webkit.org/show_bug.cgi?id=98996
+
+        Reviewed by Geoffrey Garen.
+
+        This adds plumbing to drop in constant buffers from the inlinees to the inliner.
+        It's smart about not duplicating buffers needlessly but doesn't try to completely
+        hash-cons them, either.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfConstantBuffers):
+        (JSC::CodeBlock::addConstantBuffer):
+        (JSC::CodeBlock::constantBufferAsVector):
+        (JSC::CodeBlock::constantBuffer):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (ConstantBufferKey):
+        (JSC::DFG::ConstantBufferKey::ConstantBufferKey):
+        (JSC::DFG::ConstantBufferKey::operator==):
+        (JSC::DFG::ConstantBufferKey::hash):
+        (JSC::DFG::ConstantBufferKey::isHashTableDeletedValue):
+        (JSC::DFG::ConstantBufferKey::codeBlock):
+        (JSC::DFG::ConstantBufferKey::index):
+        (DFG):
+        (JSC::DFG::ConstantBufferKeyHash::hash):
+        (JSC::DFG::ConstantBufferKeyHash::equal):
+        (ConstantBufferKeyHash):
+        (WTF):
+        (ByteCodeParser):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canInlineOpcode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-10-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Pageload tests should measure memory usage
+        https://bugs.webkit.org/show_bug.cgi?id=93958
+
+        Reviewed by Ryosuke Niwa.
+
+        Add JS Heap and Heap memory measurement to PageLoad tests.
+
+        * heap/HeapStatistics.cpp:
+        (JSC::HeapStatistics::usedJSHeap): Add new private function to expose the used JS Heap size.
+        (JSC):
+        * heap/HeapStatistics.h:
+        (HeapStatistics): Add new private function to expose the used JS Heap size.
+
+2012-10-10  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        RegisterFile to JSStack rename fix for a struct member.
+
+        Compilation problem in debug build on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=98808
+
+        Reviewed by Alexey Proskuryakov.
+
+        In ASSERT conditions structure field name "registerFile" was replaced
+        with type name "JSStack" and it should be "stack".
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks): structure member name fix.
+
+2012-10-10  Michael Saboff  <msaboff@apple.com>
+
+        After r130344, OpaqueJSString::string() shouldn't directly return the wrapped String
+        https://bugs.webkit.org/show_bug.cgi?id=98801
+
+        Reviewed by Geoffrey Garen.
+
+        Return a copy of the wrapped String so that the wrapped string cannot be turned into 
+        an Identifier.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::string):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString):
+
+2012-10-10  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Add moveDoubleToInts and moveIntsToDouble to MacroAssemblerARM
+        https://bugs.webkit.org/show_bug.cgi?id=98855
+
+        Reviewed by Filip Pizlo.
+
+        Implement the missing moveDoubleToInts and moveIntsToDouble
+        methods in the MacroAssemblerARM after r130839.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::moveDoubleToInts):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::moveIntsToDouble):
+
+2012-10-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Typed arrays should not be 20x slower in the baseline JIT than in the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=98605
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        This adds typed array get_by_val/put_by_val patching to the baseline JIT. It's
+        a big (~40%) win on benchmarks that have trouble staying in the DFG JIT. Even
+        if we fix those benchmarks, this functionality gives us the insurance that we
+        typically desire with all speculative optimizations: even if we bail to
+        baseline, we're still reasonably performant.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/MacroAssembler.cpp: Added.
+        (JSC):
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::patchableBranchPtr):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::moveDoubleToInts):
+        (JSC::MacroAssemblerARMv7::moveIntsToDouble):
+        (JSC::MacroAssemblerARMv7::patchableBranchPtr):
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::moveDoubleToInts):
+        (JSC::MacroAssemblerX86::moveIntsToDouble):
+        * bytecode/ByValInfo.h:
+        (JSC::hasOptimizableIndexingForClassInfo):
+        (JSC):
+        (JSC::hasOptimizableIndexing):
+        (JSC::jitArrayModeForClassInfo):
+        (JSC::jitArrayModeForStructure):
+        (JSC::ByValInfo::ByValInfo):
+        (ByValInfo):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (DFG):
+        * dfg/DFGAssemblyHelpers.h:
+        (AssemblyHelpers):
+        (JSC::DFG::AssemblyHelpers::boxDouble):
+        (JSC::DFG::AssemblyHelpers::unboxDouble):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompilePutByVal):
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+        (JSC):
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::typedArrayDescriptor):
+        * runtime/TypedArrayDescriptor.h: Added.
+        (JSC):
+        (JSC::TypedArrayDescriptor::TypedArrayDescriptor):
+        (TypedArrayDescriptor):
+
+2012-10-09  Michael Saboff  <msaboff@apple.com>
+
+        Add tests to testapi for null OpaqueJSStrings
+        https://bugs.webkit.org/show_bug.cgi?id=98805
+
+        Reviewed by Geoffrey Garen.
+
+        Added tests that check that OpaqueJSString, which is wrapped via JSStringRef, properly returns
+        null strings and that a null string in a JSStringRef will return a NULL JSChar* and 0 length
+        via the JSStringGetCharactersPtr() and JSStringGetLength() APIs respectively. Added a check that 
+        JSValueMakeFromJSONString() properly handles a null string as well.
+
+        * API/tests/testapi.c:
+        (main):
+
+2012-10-09  Jian Li  <jianli@chromium.org>
+
+        Update the CSS property used to support draggable regions.
+        https://bugs.webkit.org/show_bug.cgi?id=97156
+
+        Reviewed by Adam Barth.
+
+        The CSS property to support draggable regions, guarded under
+        WIDGET_REGION is now disabled from Mac WebKit, in order not to cause
+        confusion with DASHBOARD_SUPPORT feature.
+
+        * Configurations/FeatureDefines.xcconfig: Disable WIDGET_REGION feature.
+
+2012-10-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, adding forgotten files.
+
+        * bytecode/ByValInfo.h: Added.
+        (JSC):
+        (JSC::isOptimizableIndexingType):
+        (JSC::jitArrayModeForIndexingType):
+        (JSC::ByValInfo::ByValInfo):
+        (ByValInfo):
+        (JSC::getByValInfoBytecodeIndex):
+        * runtime/IndexingType.cpp: Added.
+        (JSC):
+        (JSC::indexingTypeToString):
+
+2012-10-08  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should infer when indexed storage is contiguous, and optimize for it
+        https://bugs.webkit.org/show_bug.cgi?id=97288
+
+        Reviewed by Mark Hahnenberg.
+
+        This introduces a new kind of indexed property storage called Contiguous,
+        which has the following properties:
+        
+        - No header bits beyond IndexedHeader. This results in a 16 byte reduction
+          in memory usage per array versus an ArrayStorage array. It also means
+          that the total memory usage for an empty array is now just 3 * 8 on both
+          32-bit and 64-bit. Of that, only 8 bytes are array-specific; the rest is
+          our standard object header overhead.
+        
+        - No need for hole checks on store. This results in a ~4% speed-up on
+          Kraken and a ~1% speed-up on V8v7.
+        
+        - publicLength <= vectorLength. This means that doing new Array(blah)
+          immediately allocates room for blah elements.
+        
+        - No sparse map or index bias.
+        
+        If you ever do things to an array that would require publicLength >
+        vectorLength, a sparse map, or index bias, then we switch to ArrayStorage
+        mode. This seems to never happen in any benchmark we track, and is unlikely
+        to happen very frequently on any website.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::append):
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::patchableBranchTest32):
+        * bytecode/ByValInfo.h: Added.
+        (JSC):
+        (JSC::isOptimizableIndexingType):
+        (JSC::jitArrayModeForIndexingType):
+        (JSC::ByValInfo::ByValInfo):
+        (ByValInfo):
+        (JSC::getByValInfoBytecodeIndex):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::getByValInfo):
+        (JSC::CodeBlock::setNumberOfByValInfos):
+        (JSC::CodeBlock::numberOfByValInfos):
+        (JSC::CodeBlock::byValInfo):
+        * bytecode/SamplingTool.h:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (JSC::DFG::modeUsesButterfly):
+        (JSC::DFG::modeIsJSArray):
+        (JSC::DFG::isInBoundsAccess):
+        (JSC::DFG::mayStoreToTail):
+        (JSC::DFG::mayStoreToHole):
+        (JSC::DFG::modeIsPolymorphic):
+        (JSC::DFG::polymorphicIncludesContiguous):
+        (JSC::DFG::polymorphicIncludesArrayStorage):
+        (JSC::DFG::canCSEStorage):
+        (JSC::DFG::modeSupportsLength):
+        (JSC::DFG::benefitsFromStructureCheck):
+        (JSC::DFG::isEffectful):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getArrayLengthElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
+        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileContiguousGetByVal):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal):
+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
+        (JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileContiguousGetByVal):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal):
+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
+        (JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (SamplingScope):
+        (JSC::SamplingScope::SamplingScope):
+        (JSC::SamplingScope::~SamplingScope):
+        (JSC):
+        (JSC::Interpreter::execute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::ByValCompilationInfo::ByValCompilationInfo):
+        (ByValCompilationInfo):
+        (JSC):
+        (JIT):
+        (JSC::JIT::compileGetByVal):
+        (JSC::JIT::compilePutByVal):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateJSArray):
+        (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase):
+        (JSC):
+        (JSC::arrayProfileSaw):
+        (JSC::JIT::chooseArrayMode):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emitSlow_op_new_array):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC):
+        (JSC::JIT::emitContiguousGetByVal):
+        (JSC::JIT::emitArrayStorageGetByVal):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC):
+        (JSC::JIT::emitContiguousGetByVal):
+        (JSC::JIT::emitArrayStorageGetByVal):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::getByVal):
+        (JSC):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::putByVal):
+        * jit/JITStubs.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayConventions.h:
+        (JSC::isDenseEnoughForVector):
+        * runtime/ArrayPrototype.cpp:
+        (JSC):
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/Butterfly.h:
+        (Butterfly):
+        (JSC::Butterfly::fromPointer):
+        (JSC::Butterfly::pointer):
+        (JSC::Butterfly::publicLength):
+        (JSC::Butterfly::vectorLength):
+        (JSC::Butterfly::setPublicLength):
+        (JSC::Butterfly::setVectorLength):
+        (JSC::Butterfly::contiguous):
+        (JSC::Butterfly::fromContiguous):
+        * runtime/ButterflyInlineMethods.h:
+        (JSC::Butterfly::unshift):
+        (JSC::Butterfly::shift):
+        * runtime/IndexingHeaderInlineMethods.h:
+        (JSC::IndexingHeader::indexingPayloadSizeInBytes):
+        * runtime/IndexingType.cpp: Added.
+        (JSC):
+        (JSC::indexingTypeToString):
+        * runtime/IndexingType.h:
+        (JSC):
+        (JSC::hasContiguous):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::setLength):
+        (JSC):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        (JSC::JSArray::sortNumericVector):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sortCompactedVector):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::sortVector):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::shiftCountForShift):
+        (JSC::JSArray::shiftCountForSplice):
+        (JSArray):
+        (JSC::JSArray::shiftCount):
+        (JSC::JSArray::unshiftCountForShift):
+        (JSC::JSArray::unshiftCountForSplice):
+        (JSC::JSArray::unshiftCount):
+        (JSC::JSArray::isLengthWritable):
+        (JSC::createContiguousArrayButterfly):
+        (JSC):
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC):
+        (JSC::JSGlobalObject::haveABadTime):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::arrayStructureWithArrayStorage):
+        (JSC::JSGlobalObject::addressOfArrayStructureWithArrayStorage):
+        (JSC::constructEmptyArray):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC::JSObject::ensureIndexedStorageSlow):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthContiguousWithoutAttributes):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::countElementsInContiguous):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureContiguousLengthSlow):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getArrayLength):
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::tryGetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuicklyForPutDirect):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::hasSparseMap):
+        (JSC::JSObject::inSparseIndexingMode):
+        (JSObject):
+        (JSC::JSObject::ensureContiguous):
+        (JSC::JSObject::ensureIndexedStorage):
+        (JSC::JSObject::ensureContiguousLength):
+        (JSC::JSObject::indexingData):
+        (JSC::JSObject::relevantLength):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::description):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Structure.cpp:
+        (JSC::Structure::needsSlowPutIndexing):
+        (JSC):
+        (JSC::Structure::suggestedArrayStorageTransition):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureTransitionTable.h:
+        (JSC::newIndexingType):
+
+2012-10-09  Michael Saboff  <msaboff@apple.com>
+
+        After r130344, OpaqueJSString::identifier() adds wrapped String to identifier table
+        https://bugs.webkit.org/show_bug.cgi?id=98693
+        REGRESSION (r130344): Install failed in Install Environment
+        <rdar://problem/12450118>
+
+        Reviewed by Mark Rowe.
+
+        Use Identifier(LChar*, length) or Identifier(UChar*, length) constructors so that we don't
+        add the String instance in the OpaqueJSString to any identifier tables.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::identifier):
+
+2012-10-08  Mark Lam  <mark.lam@apple.com>
+
+        Renamed RegisterFile to JSStack, and removed prototype of the
+        previously deleted Interpreter::privateExecute().
+        https://bugs.webkit.org/show_bug.cgi?id=98717.
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/BytecodeConventions.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::alreadyInJSStack):
+        (JSC::ValueRecovery::alreadyInJSStackAsUnboxedInt32):
+        (JSC::ValueRecovery::alreadyInJSStackAsUnboxedCell):
+        (JSC::ValueRecovery::alreadyInJSStackAsUnboxedBoolean):
+        (JSC::ValueRecovery::alreadyInJSStackAsUnboxedDouble):
+        (JSC::ValueRecovery::displacedInJSStack):
+        (JSC::ValueRecovery::isAlreadyInJSStack):
+        (JSC::ValueRecovery::virtualRegister):
+        (JSC::ValueRecovery::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::registerFor):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
+        (JSC::DFG::AssemblyHelpers::emitPutToCallFrameHeader):
+        (JSC::DFG::AssemblyHelpers::emitPutImmediateToCallFrameHeader):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getDirect):
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGGenerationInfo.h:
+        (GenerationInfo):
+        (JSC::DFG::GenerationInfo::needsSpill):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::beginCall):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::spill):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
+        (JSC::DFG::slowPathFor):
+        (JSC::DFG::virtualForThunkGenerator):
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::valueSourceKindToDataFormat):
+        (JSC::DFG::isInJSStack):
+        (JSC::DFG::ValueSource::forSpeculation):
+        (JSC::DFG::ValueSource::isInJSStack):
+        (JSC::DFG::ValueSource::valueRecovery):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * heap/Heap.cpp:
+        (JSC::Heap::stack):
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::stack):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::calleeAsValue):
+        (JSC::ExecState::callee):
+        (JSC::ExecState::codeBlock):
+        (JSC::ExecState::scope):
+        (JSC::ExecState::callerFrame):
+        (JSC::ExecState::returnPC):
+        (JSC::ExecState::hasReturnPC):
+        (JSC::ExecState::clearReturnPC):
+        (JSC::ExecState::bytecodeOffsetForNonDFGCode):
+        (JSC::ExecState::setBytecodeOffsetForNonDFGCode):
+        (JSC::ExecState::inlineCallFrame):
+        (JSC::ExecState::codeOriginIndexForDFG):
+        (JSC::ExecState::currentVPC):
+        (JSC::ExecState::setCurrentVPC):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScope):
+        (JSC::ExecState::init):
+        (JSC::ExecState::argumentCountIncludingThis):
+        (JSC::ExecState::offsetFor):
+        (JSC::ExecState::setArgumentCountIncludingThis):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock):
+        (JSC::ExecState::setReturnPC):
+        (JSC::ExecState::setInlineCallFrame):
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::slideRegisterWindowForCall):
+        (JSC::eval):
+        (JSC::loadVarargs):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::endRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::stack):
+        (Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC):
+        * interpreter/JSStack.cpp: Copied from Source/JavaScriptCore/interpreter/RegisterFile.cpp.
+        (JSC::stackStatisticsMutex):
+        (JSC::JSStack::~JSStack):
+        (JSC::JSStack::growSlowCase):
+        (JSC::JSStack::gatherConservativeRoots):
+        (JSC::JSStack::releaseExcessCapacity):
+        (JSC::JSStack::initializeThreading):
+        (JSC::JSStack::committedByteCount):
+        (JSC::JSStack::addToCommittedByteCount):
+        * interpreter/JSStack.h: Copied from Source/JavaScriptCore/interpreter/RegisterFile.h.
+        (JSStack):
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::shrink):
+        (JSC::JSStack::grow):
+        * interpreter/RegisterFile.cpp: Removed.
+        * interpreter/RegisterFile.h: Removed.
+        * interpreter/VMInspector.cpp:
+        (JSC::VMInspector::dumpFrame):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC):
+        (JIT):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC):
+        (JSC::JITCode::execute):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutCellToCallFrameHeader):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        (JSC::JIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        (JSC::JIT::updateTopCallFrame):
+        (JSC::JIT::unmap):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emit_op_get_arguments_length):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        * jit/JITStubs.cpp:
+        (JSC::ctiTrampoline):
+        (JSC::JITThunks::JITThunks):
+        (JSC):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC):
+        (JITStackFrame):
+        * jit/JSInterfaceJIT.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::genericCall):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOffForInlineCallFrame):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::globalExec):
+        * runtime/JSGlobalObject.h:
+        (JSC):
+        (JSGlobalObject):
+        * runtime/JSLock.cpp:
+        (JSC):
+        * runtime/JSVariableObject.h:
+        (JSVariableObject):
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+
+2012-10-08  Kiran Muppala  <cmuppala@apple.com>
+
+        Throttle DOM timers on hidden pages.
+        https://bugs.webkit.org/show_bug.cgi?id=98474
+
+        Reviewed by Maciej Stachowiak.
+
+        Add HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-08  Michael Saboff  <msaboff@apple.com>
+
+        After r130344, OpaqueJSString() creates an empty string which should be a null string
+        https://bugs.webkit.org/show_bug.cgi?id=98417
+
+        Reviewed by Sam Weinig.
+
+        Changed create() of a null string to return 0. This is the same behavior as before r130344.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::create):
+
+2012-10-07  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Rename first/second to key/value in HashMap iterators
+        https://bugs.webkit.org/show_bug.cgi?id=82784
+
+        Reviewed by Eric Seidel.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnNonIndexPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnNonIndexPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-10-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC should have a way to gather and log Heap memory use and pause times
+        https://bugs.webkit.org/show_bug.cgi?id=98431
+
+        Reviewed by Geoffrey Garen.
+
+        In order to improve our infrastructure for benchmark-driven development, we should 
+        have a centralized method of gathering and logging various statistics about the state 
+        of the JS heap. This would allow us to create and to use other tools to analyze the 
+        output of the VM after running various workloads.
+
+        The first two statistics that might be interesting is memory use by JSC and GC pause 
+        times. We can control whether this recording happens through the use of the Options 
+        class, allowing us to either use environment variables or command line flags.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::collect): If we finish a collection and are still over our set GC heap size, 
+        we end the program immediately and report an error. Also added recording of pause times.
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::shouldCollect): When we set a specific GC heap size through Options, we 
+        ignore all other heuristics on when we should collect and instead only ask if we're 
+        greater than the amount specified in the Option value. This allows us to view time/memory 
+        tradeoffs more clearly.
+        * heap/HeapStatistics.cpp: Added.
+        (JSC):
+        (JSC::HeapStatistics::initialize):
+        (JSC::HeapStatistics::recordGCPauseTime):
+        (JSC::HeapStatistics::logStatistics):
+        (JSC::HeapStatistics::exitWithFailure):
+        (JSC::HeapStatistics::reportSuccess):
+        (JSC::HeapStatistics::parseMemoryAmount):
+        (StorageStatistics):
+        (JSC::StorageStatistics::StorageStatistics):
+        (JSC::StorageStatistics::operator()):
+        (JSC::StorageStatistics::objectWithOutOfLineStorageCount):
+        (JSC::StorageStatistics::objectCount):
+        (JSC::StorageStatistics::storageSize):
+        (JSC::StorageStatistics::storageCapacity):
+        (JSC::HeapStatistics::showObjectStatistics): Moved the old showHeapStatistics (renamed to showObjectStatistics) 
+        to try to start collecting our various memory statistics gathering/reporting mechanisms scattered throughout the 
+        codebase into one place.
+        * heap/HeapStatistics.h: Added.
+        (JSC):
+        (HeapStatistics):
+        * jsc.cpp:
+        (main):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce): We need to initialize our data structures for recording 
+        statistics if necessary.
+        * runtime/Options.cpp: Add new Options for the various types of statistics we'll be gathering.
+        (JSC::parse):
+        (JSC):
+        (JSC::Options::initialize): Initialize the various new options using environment variables.
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+        (JSC):
+
+2012-10-04  Rik Cabanier  <cabanier@adobe.com>
+
+        Turn Compositing on by default in WebKit build
+        https://bugs.webkit.org/show_bug.cgi?id=98315
+
+        Reviewed by Simon Fraser.
+
+        enable -webkit-blend-mode on trunk.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-10-04  Michael Saboff  <msaboff@apple.com>
+
+        Crash in Safari at com.apple.JavaScriptCore: WTF::StringImpl::is8Bit const + 12
+        https://bugs.webkit.org/show_bug.cgi?id=98433
+
+        Reviewed by Jessie Berlin.
+
+        The problem is due to a String with a null StringImpl (i.e. a null string).
+        Added a length check before the is8Bit() check since length() checks for a null StringImpl.  Changed the
+        characters16() call to characters() since it can handle a null StringImpl as well.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+
+2012-10-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        Use copyLCharsFromUCharSource() for IdentifierLCharFromUCharTranslator translation
+        https://bugs.webkit.org/show_bug.cgi?id=98335
+
+        Reviewed by Michael Saboff.
+
+        Michael Saboff added an optimized version of UChar->LChar conversion in r125846.
+        Use this function in JSC::Identifier.
+
+        * runtime/Identifier.cpp:
+        (JSC::IdentifierLCharFromUCharTranslator::translate):
+
+2012-10-04  Michael Saboff  <msaboff@apple.com>
+
+        After r130344, OpaqueJSString() creates a empty string which should be a null string
+        https://bugs.webkit.org/show_bug.cgi?id=98417
+
+        Reviewed by Alexey Proskuryakov.
+
+        Removed the setting of enclosed string to an empty string from default constructor.
+        Before changeset r130344, the semantic was the default constructor produced a null
+        string.
+
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::OpaqueJSString):
+
+2012-10-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Add missing LLInt dependencies to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=98394
+
+        Reviewed by Geoffrey Garen.
+
+        * DerivedSources.pri:
+        * LLIntOffsetsExtractor.pro:
+
+2012-10-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Next step toward fixing Windows: add new symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-10-03  Geoffrey Garen  <ggaren@apple.com>
+
+        First step toward fixing Windows: remove old symbol.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-10-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed the assumption that "final" objects have a fixed number of inline slots
+        https://bugs.webkit.org/show_bug.cgi?id=98332
+
+        Reviewed by Filip Pizlo.
+
+        This is a step toward object size inference.
+
+        I replaced the inline storage capacity constant with a data member per
+        structure, set the the maximum supported value for the constant to 100,
+        then fixed what broke. (Note that even though this patch increases the
+        theoretical maximum inline capacity, it doesn't change any actual inline
+        capacity.)
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset): These functions just get a rename:
+        the constant they need is the first out of line offset along the offset
+        number line, which is not necessarily the same thing (and is, in this
+        patch, never the same thing) as the inline capacity of any given object.
+
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITPropertyAccess32_64.cpp: This function changes functionality,
+        since it needs to convert from the abstract offset number line to an
+        actual offset in memory, and it can't assume that inline and out-of-line
+        offsets are contiguous on the number line.
+
+        (JSC::JIT::compileGetDirectOffset): Updated for rename.
+
+        (JSC::JIT::emit_op_get_by_pname): Same as emit_op_get_by_pname above.
+
+        * llint/LowLevelInterpreter.asm: Updated to mirror changes in PropertyOffset.h,
+        since we duplicate values from there.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Just like the JIT, most things are just
+        renames, and get_by_pname changes to do more math. I also standardized
+        offset calculations to use a hard-coded "-2", to match the JIT. This
+        isn't really better, but it makes global search and replace easier,
+        should we choose to refactor this code not to hard-code constants.
+
+        I also renamed loadPropertyAtVariableOffsetKnownNotFinal to
+        loadPropertyAtVariableOffsetKnownNotInline in order to sever the assumption
+        that inline capacity is tied to object type, and I changed the 64bit LLInt
+        to use this -- not using this previously seems to have been an oversight.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        (JSC::JSFinalObject::visitChildren):
+        * runtime/JSObject.h:
+        (JSC::JSObject::offsetForLocation):
+        (JSNonFinalObject):
+        (JSC::JSFinalObject::createStructure):
+        (JSFinalObject):
+        (JSC::JSFinalObject::finishCreation): Updated for above changes.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::finishCreation): Store the inline capacity
+        of our object, since it's not a constant.
+
+        (JSC::JSPropertyNameIterator::getOffset): Removed. This function was
+        wrong. Luckily, it was also unused, since the C++ interpreter is gone.
+
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable): Use a helper function instead of hard-coding assumptions
+        about object types.
+
+        (JSC::PropertyTable::nextOffset):
+        * runtime/PropertyOffset.h:
+        (JSC):
+        (JSC::checkOffset):
+        (JSC::validateOffset):
+        (JSC::isInlineOffset):
+        (JSC::numberOfSlotsForLastOffset):
+        (JSC::propertyOffsetFor): Refactored these functions to take inline capacity
+        as an argument, since it's not fixed at compile time anymore.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::putSpecificValue):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::outOfLineCapacity):
+        (JSC::Structure::hasInlineStorage):
+        (JSC::Structure::inlineCapacity):
+        (JSC::Structure::inlineSize):
+        (JSC::Structure::firstValidOffset):
+        (JSC::Structure::lastValidOffset):
+        (JSC::Structure::create): Removed some hard-coded assumptions about inline
+        capacity and object type, and replaced with more liberal use of helper functions.
+
+2012-10-03  Michael Saboff  <msaboff@apple.com>
+
+        OpaqueJSString doesn't optimally handle 8 bit strings
+        https://bugs.webkit.org/show_bug.cgi?id=98300
+
+        Reviewed by Geoffrey Garen.
+
+        Change OpaqueJSString to store and manage a String instead of a UChar buffer.
+        The member string is a copy of any string used during creation.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::create):
+        (OpaqueJSString::identifier):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::characters):
+        (OpaqueJSString::length):
+        (OpaqueJSString::string):
+        (OpaqueJSString::OpaqueJSString):
+        (OpaqueJSString):
+
+2012-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Array.splice should be fast when it is used to remove elements other than the very first
+        https://bugs.webkit.org/show_bug.cgi?id=98236
+
+        Reviewed by Michael Saboff.
+
+        Applied the same technique that was used to optimize the unshift case of splice in
+        http://trac.webkit.org/changeset/129676.  This is a >20x speed-up on programs that
+        use splice for element removal.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::shiftCount):
+        * runtime/JSArray.h:
+        (JSArray):
+
+2012-09-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Delayed structure sweep can leak structures without bound
+        https://bugs.webkit.org/show_bug.cgi?id=96546
+
+        Reviewed by Geoffrey Garen.
+
+        This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only
+        allocators. We now have separate allocators for our three types of objects: those objects with no destructors,
+        those objects with destructors and with immortal structures, and those objects with destructors that don't have 
+        immortal structures. All of the objects of the third type (destructors without immortal structures) now 
+        inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores 
+        the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction.
+
+        * API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor.
+        (JSC):
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSCallbackConstructor):
+        * API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for 
+        JSCallbackObject<JSGlobalObject>, since JSGlobalObject also uses a finalizer.
+        (JSC):
+        (JSC::::create): We need to move the create function for JSCallbackObject<JSGlobalObject> out of line so we can add 
+        the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides 
+        to subclass this. We use this same technique for many other subclasses of JSGlobalObject.
+        (JSC::::createStructure):
+        * API/JSCallbackObject.h:
+        (JSCallbackObject):
+        (JSC):
+        * API/JSClassRef.cpp: Change all the JSCallbackObject<JSNonFinalObject> to use JSDestructibleObject instead.
+        (OpaqueJSClass::prototype):
+        * API/JSObjectRef.cpp: Ditto.
+        (JSObjectMake):
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSValueRef.cpp: Ditto.
+        (JSValueIsObjectOfClass):
+        * API/JSWeakObjectMapRefPrivate.cpp: Ditto.
+        * JSCTypedArrayStubs.h:
+        (JSC):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG.
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
+        * heap/Heap.cpp:
+        (JSC):
+        * heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function 
+        since it's always safe to sweep Structures now.
+        (JSC::Heap::allocatorForObjectWithNormalDestructor): 
+        (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor):
+        (Heap):
+        (JSC::Heap::allocateWithNormalDestructor):
+        (JSC):
+        (JSC::Heap::allocateWithImmortalStructureDestructor):
+        * heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the 
+        IncrementalSweeper since it's always safe to sweep Structures now.
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::sweepNextBlock):
+        (JSC::IncrementalSweeper::startSweeping):
+        (JSC::IncrementalSweeper::willFinishSweeping):
+        (JSC):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add 
+        tracking of the specific destructor type of allocator. 
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::destructorType):
+        (MarkedAllocator):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::init):
+        * heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping. 
+        We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls.
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedBlock.h:
+        (JSC):
+        (JSC::MarkedBlock::allocator):
+        (JSC::MarkedBlock::destructorType):
+        * heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace.
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::canonicalizeCellLivenessData):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::freeBlock):
+        * heap/MarkedSpace.h:
+        (MarkedSpace):
+        (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor):
+        (JSC::MarkedSpace::normalDestructorAllocatorFor):
+        (JSC::MarkedSpace::allocateWithImmortalStructureDestructor):
+        (JSC::MarkedSpace::allocateWithNormalDestructor):
+        (JSC::MarkedSpace::forEachBlock):
+        * heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function.
+        * jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC::JIT::emitAllocateJSArray):
+        * jsc.cpp: 
+        (GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from 
+        JSDestructibleObject.
+        * runtime/Arguments.cpp: Inherit from JSDestructibleObject.
+        (JSC):
+        * runtime/Arguments.h:
+        (Arguments):
+        (JSC::Arguments::Arguments):
+        * runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor.
+        (JSC):
+        * runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures.
+        (JSC):
+        * runtime/InternalFunction.cpp: Inherit from JSDestructibleObject.
+        (JSC):
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (InternalFunction):
+        * runtime/JSCell.h: Added two static bools, needsDestruction and hasImmortalStructure, that classes can override 
+        to indicate at compile time which part of the heap they should be allocated in.
+        (JSC::allocateCell): Use the appropriate allocator depending on the destructor type.
+        * runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be 
+        accessed safely when the object is being destroyed.
+        (JSC):
+        (JSDestructibleObject):
+        (JSC::JSDestructibleObject::classInfo):
+        (JSC::JSDestructibleObject::JSDestructibleObject):
+        (JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe.
+        * runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all 
+        of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well.
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one 
+        for the m_rareData field when it's created.
+        (JSC::JSGlobalObject::create):
+        (JSC):
+        * runtime/JSGlobalThis.h: Inherit from JSDestructibleObject.
+        (JSGlobalThis):
+        (JSC::JSGlobalThis::JSGlobalThis):
+        * runtime/JSPropertyNameIterator.h: Has an immortal Structure.
+        (JSC):
+        * runtime/JSScope.cpp:
+        (JSC):
+        * runtime/JSString.h: Has an immortal Structure.
+        (JSC):
+        * runtime/JSWrapperObject.h: Inherit from JSDestructibleObject.
+        (JSWrapperObject):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp: Cleaning up some of the inheritance stuff.
+        (JSC):
+        * runtime/NameInstance.h: Inherit from JSDestructibleObject.
+        (NameInstance):
+        * runtime/RegExp.h: Has immortal Structure.
+        (JSC):
+        * runtime/RegExpObject.cpp: Inheritance cleanup.
+        (JSC):
+        * runtime/SparseArrayValueMap.h: Has immortal Structure.
+        (JSC):
+        * runtime/Structure.h: Has immortal Structure.
+        (JSC):
+        * runtime/StructureChain.h: Ditto.
+        (JSC):
+        * runtime/SymbolTable.h: Ditto.
+        (SharedSymbolTable):
+        (JSC):
+
+== Rolled over to ChangeLog-2012-10-02 ==
diff --git a/ChangeLog-2013-10-13 b/ChangeLog-2013-10-13
new file mode 100644
index 0000000..4be5c95
--- /dev/null
+++ b/ChangeLog-2013-10-13
@@ -0,0 +1,29141 @@
+2013-10-13  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Lion build.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2013-10-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a feature define for SubtleCrypto
+        https://bugs.webkit.org/show_bug.cgi?id=122683
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-10-12  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix potential register trampling in JIT since r157313.
+        https://bugs.webkit.org/show_bug.cgi?id=122691
+
+        Reviewed by Michael Saboff.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2013-10-12  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Add missing spaces in JITStubsSH4.h
+        https://bugs.webkit.org/show_bug.cgi?id=122690
+
+        Reviewed by Andreas Kling.
+
+        * jit/JITStubsSH4.h: Space between string concatenation is mandatory with C++11
+
+2013-10-12  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Add missing test32 implementation in macro assembler.
+        https://bugs.webkit.org/show_bug.cgi?id=122689
+
+        Reviewed by Andreas Kling.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::test32):
+
+2013-10-11  Darin Adler  <darin@apple.com>
+
+        Change most call sites to call ICU directly instead of through WTF::Unicode
+        https://bugs.webkit.org/show_bug.cgi?id=122635
+
+        Reviewed by Alexey Proskuryakov.
+
+        * parser/Lexer.cpp:
+        (JSC::isNonLatin1IdentStart): Take a UChar since that's what the only caller wants to pass.
+        Use U_GET_GC_MASK instead of WTF::Unicode::category.
+        (JSC::isNonLatin1IdentPart): Ditto.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace): Use u_charType instead of WTF::Unicode::isSeparatorSpace.
+
+        * runtime/JSFunction.cpp: Removed "using namespace" for WTF::Unicode, this will no longer
+        compile since this doesn't include anything that defines that namespace.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::isStrWhiteSpace): Use u_charType instead of WTF::Unicode::isSeparatorSpace.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter): Use u_tolower and u_toupper instead of
+        Unicode::toLower and Unicode::toUpper. Also added some assertions since this code assumes
+        it can convert any UChar to lowercase or uppercase in another UChar, with no risk of needing
+        a UChar32 for the result. I guess that's probably true, but it would be good to know in a
+        debug build if not.
+
+2013-10-11  Nadav Rotem  <nrotem@apple.com>
+
+        DFG: Add JIT support for  LogicalNot(String/StringIdent)
+        https://bugs.webkit.org/show_bug.cgi?id=122627
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStringZeroLength):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+
+2013-10-11  Filip Pizlo  <fpizlo@apple.com>
+
+        sunspider-1.0/math-spectral-norm.js.dfg-eager occasionally fails with Trap 5 (i.e int $3)
+        https://bugs.webkit.org/show_bug.cgi?id=122462
+
+        Reviewed by Mark Hahnenberg.
+        
+        This fixes two bugs, both of which led to GetByVal on Int32 trapping because the
+        array no longer had Int32 shape but the check wasn't executed:
+        
+        1) We weren't snapshotting the structures of mustHandleValues. This led to an awesome
+           race where if a mustHandleValue JSValue's structure changed on the main thread
+           between runs of the AI, the AI would contradict each other and things would just
+           get corrupted in funny ways.
+        
+        2) The constant folder has a long standing bug! It will fold a node to a constant if
+           the AI proved it to be a constant. But it's possible that the original node also
+           proved things about the constant's structure. In that case "folding" to a
+           JSConstant actually loses information since JSConstant doesn't guarantee anything
+           about a constant's structure. There are various things we could do here to ensure
+           that a folded constant's structure doesn't change, and that if it does, we
+           deoptimize the code. But for now we can just make this sound by disabling folding
+           in this pathological case.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+
+2013-10-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix handling of indirect stackmap locations in FTL OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=122666
+
+        Reviewed by Mark Hahnenberg.
+        
+        With this change, the llvm.webkit.stackmap-based OSR exit only fails one test, down from
+        five tests previously.
+
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::gpr): It's OK to call this method when kind() == Indirect, so asserting that isGPR() is wrong; change to assert that involvesGPR().
+        (JSC::FTL::Location::restoreInto): Stack-related registers aren't saved to the scratch buffer, so use them directly.
+        * ftl/FTLLocation.h: Add comment about requirements for stack layout.
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStubWithOSRExitStackmap): Make enough room on the stack so that saveAllRegisters() has a scratchpad to save things to. Without this, saveAllRegisters() may clobber a spilled value.
+
+2013-10-11  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r157307.
+        http://trac.webkit.org/changeset/157307
+        https://bugs.webkit.org/show_bug.cgi?id=122671
+
+        Many assertion failures (Requested by ap on #webkit).
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::arrayIteratorNextThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::createIteratorResult):
+        (JSC::arrayIteratorPrototypeNext):
+        * runtime/Intrinsic.h:
+        * runtime/JSArrayIterator.cpp:
+        (JSC::JSArrayIterator::finishCreation):
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+
+2013-10-11  Mark Lam  <mark.lam@apple.com>
+
+        Transition op_new_* JITStubs to JIT operations.
+        https://bugs.webkit.org/show_bug.cgi?id=122460.
+
+        Reviewed by Michael Saboff.
+
+        Also:
+        - Removed the redundant operationNewFunctionExpression().  It is identical to
+          operationNewFunctionNoCheck().
+        - Sorted JIT operation signature keys in the comment in JITOperations.h.
+        - Removed the unused returnValue2Register definition for X86_64.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_new_array):
+        (JSC::JIT::emit_op_new_array_with_size):
+        (JSC::JIT::emit_op_new_array_buffer):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_new_object):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+
+2013-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Separate out array iteration intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=122656
+
+        Reviewed by Michael Saboff.
+
+        Separate out the intrinsics for key and values iteration
+        of arrays.
+
+        This requires moving moving array iteration into the iterator
+        instance, rather than the prototype, but this is essentially
+        unobservable so we'll live with it for now.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::arrayIteratorNextThunkGenerator):
+        (JSC::arrayIteratorNextKeyThunkGenerator):
+        (JSC::arrayIteratorNextValueThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        * runtime/Intrinsic.h:
+        * runtime/JSArrayIterator.cpp:
+        (JSC::JSArrayIterator::finishCreation):
+        (JSC::createIteratorResult):
+        (JSC::arrayIteratorNext):
+        (JSC::arrayIteratorNextKey):
+        (JSC::arrayIteratorNextValue):
+        (JSC::arrayIteratorNextGeneric):
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+
+2013-10-11  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to JSGenericTypedArrayViewPrototype.
+        <https://webkit.org/b/122632>
+
+        Reviewed by Sam Weinig.
+
+        This code was only using the ExecState to find the VM.
+
+2013-10-11  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Fix build after r157209.
+        https://bugs.webkit.org/show_bug.cgi?id=122643
+
+        Reviewed by Ryosuke Niwa.
+
+        * assembler/MacroAssemblerSH4.h: Add framePointerRegister declaration.
+        * assembler/SH4Assembler.h: Add firstRegister() declaration.
+        (JSC::SH4Assembler::firstRegister):
+
+2013-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL shouldn't pass i1's into llvm.webkit.stackmap's
+        https://bugs.webkit.org/show_bug.cgi?id=122629
+        <rdar://problem/15203037>
+
+        Reviewed by Sam Weinig and Nadav Rotem.
+        
+        LLVM's stackmap support requires that we only pass operands with legal types (i.e. types
+        that are hardware-representable). i1, which the FTL previously used for Booleans, is not
+        legal.
+        
+        We have two options: either add support in LLVM to legalize stackmap operands, or add
+        support to the FTL to legalize stackmap operands. It's easier to fix this in FTL, and
+        that's what this patch does.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+
+2013-10-09  Oliver Hunt  <oliver@apple.com>
+
+        Further improve ArrayIterator performance
+        https://bugs.webkit.org/show_bug.cgi?id=122575
+
+        Reviewed by Mark Hahnenberg.
+
+        Add an assembly thunk for ArrayIterator.@@next so that we
+        can avoid marshalling costs when iterating arrays.
+
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::loadSpecificClassArgument):
+        * jit/ThunkGenerators.cpp:
+        (JSC::arrayIteratorNextThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        * runtime/Intrinsic.h:
+        * runtime/JSArrayIterator.h:
+        (JSC::JSArrayIterator::offsetOfIterationKind):
+        (JSC::JSArrayIterator::offsetOfIteratedObject):
+        (JSC::JSArrayIterator::offsetOfNextIndex):
+        * runtime/JSCJSValue.h:
+        (JSC::JSValue::offsetOfPayload):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::iteratorResultStructureOffset):
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+
+2013-10-10  Michael Saboff  <msaboff@apple.com>
+
+        transition cti_op_* methods returning int to JIT operations.
+        https://bugs.webkit.org/show_bug.cgi?id=122563
+
+        Reviewed by Oliver Hunt.
+
+        Moved serveral operationCompare* functions from DFGOperations to JITOperations as well as changing
+        dfgConvertJSValueToBoolean to operationConvertJSValueToBoolean so that they can be shared with the baseline JIT.
+        Added JITOperation operationHasProperty().  Added needed callOperation helpers and transitioned baseline JIT code
+        to use the new operations.
+        
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emitSlow_op_jlesseq):
+        (JSC::JIT::emitSlow_op_jgreater):
+        (JSC::JIT::emitSlow_op_jgreatereq):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jngreater):
+        (JSC::JIT::emitSlow_op_jngreatereq):
+        (JSC::JIT::emit_compareAndJumpSlow):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_compareAndJumpSlow):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2013-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR exit using llvm.webkit.stackmap should pass more tests
+        https://bugs.webkit.org/show_bug.cgi?id=122518
+
+        Reviewed by Mark Hahnenberg.
+        
+        - Make the X86Assembler capable of dealing with all XMM registers.
+        
+        - Make the StackMaps code on WebKit's side capable of dealing with XMM registers.
+        
+        - Factor out most of the smarts of StackMaps::Location into a self-contained object.
+          Previously you needed both StackMaps::Location and a StackMaps reference to do most
+          things since the Location might have referred to a constant. Now you can just get a
+          self-contained Location object.
+        
+        - Fix a bug where OSR exit generation thunk generator was assuming that the call frame
+          register is already in argumentGPR0. In the future, the call frame will just be the
+          machine FP and we won't have to do anything special. But for now the "call frame" is
+          just a normal value in LLVM IR and may end up in any register. Make the OSR exit
+          generation thunk generator polymorphic over the call frame argument's Location.
+        
+        - Move the stuff that depends on the polymorphic OSR exit generation thunk generator
+          into the finalizer, since generating and linking one of those thunks requires a cache
+          flush and we need to do that on the main thread.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::firstRegister):
+        (JSC::ARMv7Assembler::lastRegister):
+        (JSC::ARMv7Assembler::firstFPRegister):
+        (JSC::ARMv7Assembler::lastFPRegister):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::firstFPRegister):
+        (JSC::AbstractMacroAssembler::lastFPRegister):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::nextFPRegister):
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::firstFPRegister):
+        (JSC::X86Assembler::lastFPRegister):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        (JSC::FTL::ExitThunkGenerator::emitThunks):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLocation.cpp: Added.
+        (JSC::FTL::Location::forStackmaps):
+        (JSC::FTL::Location::dump):
+        (JSC::FTL::Location::involvesGPR):
+        (JSC::FTL::Location::isGPR):
+        (JSC::FTL::Location::gpr):
+        (JSC::FTL::Location::isFPR):
+        (JSC::FTL::Location::fpr):
+        (JSC::FTL::Location::restoreInto):
+        (WTF::printInternal):
+        * ftl/FTLLocation.h: Added.
+        (JSC::FTL::Location::Location):
+        (JSC::FTL::Location::forRegister):
+        (JSC::FTL::Location::forIndirect):
+        (JSC::FTL::Location::forConstant):
+        (JSC::FTL::Location::kind):
+        (JSC::FTL::Location::hasDwarfRegNum):
+        (JSC::FTL::Location::dwarfRegNum):
+        (JSC::FTL::Location::hasOffset):
+        (JSC::FTL::Location::offset):
+        (JSC::FTL::Location::hasConstant):
+        (JSC::FTL::Location::constant):
+        (JSC::FTL::Location::operator!):
+        (JSC::FTL::Location::isHashTableDeletedValue):
+        (JSC::FTL::Location::operator==):
+        (JSC::FTL::Location::hash):
+        (JSC::FTL::LocationHash::hash):
+        (JSC::FTL::LocationHash::equal):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::linkOSRExitsAndCompleteInitializationBlocks):
+        * ftl/FTLSaveRestore.cpp:
+        (JSC::FTL::bytesForFPRs):
+        (JSC::FTL::requiredScratchMemorySizeInBytes):
+        (JSC::FTL::offsetOfFPR):
+        (JSC::FTL::saveAllRegisters):
+        (JSC::FTL::restoreAllRegisters):
+        * ftl/FTLSaveRestore.h:
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Location::restoreInto):
+        * ftl/FTLStackMaps.h:
+        * ftl/FTLState.h:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationWithoutStackMapThunkGenerator):
+        (JSC::FTL::osrExitGenerationWithStackMapThunkGenerator):
+        * ftl/FTLThunks.h:
+        (JSC::FTL::generateIfNecessary):
+        (JSC::FTL::Thunks::getOSRExitGenerationThunk):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2013-10-09  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL: Soft-link LLVM as a workaround for LLVM's static initializers and exit-time destructors
+        https://bugs.webkit.org/show_bug.cgi?id=122566
+
+        Reviewed by Mark Rowe.
+        
+        The JSC project now builds a libllvmForJSC.dylib. If FTL is enabled, this
+        gets copied into JavaScriptCore.framework/Versions/A/Libraries. JSC will
+        load the dylib by finding it using NSBundle APIs and then doing dlopen().
+        That will only happen lazily, when something happens that requires LLVM.
+        
+        This mostly takes care of LLVM static initialization overhead by deferring
+        it until it's really needed.
+        
+        This takes care of LLVM's exit-time destructors because inside
+        libllvmForJSC.dylib, we override __cxa_atexit.
+        
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/LLVMForJSC.xcconfig: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * disassembler/LLVMDisassembler.cpp:
+        (JSC::tryToDisassembleWithLLVM):
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::voidType):
+        (JSC::FTL::int1Type):
+        (JSC::FTL::int8Type):
+        (JSC::FTL::int16Type):
+        (JSC::FTL::int32Type):
+        (JSC::FTL::int64Type):
+        (JSC::FTL::intPtrType):
+        (JSC::FTL::floatType):
+        (JSC::FTL::doubleType):
+        (JSC::FTL::pointerType):
+        (JSC::FTL::structType):
+        (JSC::FTL::functionType):
+        (JSC::FTL::typeOf):
+        (JSC::FTL::mdKindID):
+        (JSC::FTL::mdString):
+        (JSC::FTL::mdNode):
+        (JSC::FTL::setMetadata):
+        (JSC::FTL::addFunction):
+        (JSC::FTL::setLinkage):
+        (JSC::FTL::setFunctionCallingConv):
+        (JSC::FTL::getParam):
+        (JSC::FTL::constInt):
+        (JSC::FTL::constReal):
+        (JSC::FTL::constIntToPtr):
+        (JSC::FTL::constBitCast):
+        (JSC::FTL::appendBasicBlock):
+        (JSC::FTL::insertBasicBlock):
+        (JSC::FTL::buildPhi):
+        (JSC::FTL::addIncoming):
+        (JSC::FTL::buildAlloca):
+        (JSC::FTL::buildAdd):
+        (JSC::FTL::buildSub):
+        (JSC::FTL::buildMul):
+        (JSC::FTL::buildDiv):
+        (JSC::FTL::buildRem):
+        (JSC::FTL::buildNeg):
+        (JSC::FTL::buildFAdd):
+        (JSC::FTL::buildFSub):
+        (JSC::FTL::buildFMul):
+        (JSC::FTL::buildFDiv):
+        (JSC::FTL::buildFRem):
+        (JSC::FTL::buildFNeg):
+        (JSC::FTL::buildAnd):
+        (JSC::FTL::buildOr):
+        (JSC::FTL::buildXor):
+        (JSC::FTL::buildShl):
+        (JSC::FTL::buildAShr):
+        (JSC::FTL::buildLShr):
+        (JSC::FTL::buildNot):
+        (JSC::FTL::buildLoad):
+        (JSC::FTL::buildStore):
+        (JSC::FTL::buildSExt):
+        (JSC::FTL::buildZExt):
+        (JSC::FTL::buildFPToSI):
+        (JSC::FTL::buildFPToUI):
+        (JSC::FTL::buildSIToFP):
+        (JSC::FTL::buildUIToFP):
+        (JSC::FTL::buildIntCast):
+        (JSC::FTL::buildFPCast):
+        (JSC::FTL::buildIntToPtr):
+        (JSC::FTL::buildPtrToInt):
+        (JSC::FTL::buildBitCast):
+        (JSC::FTL::buildICmp):
+        (JSC::FTL::buildFCmp):
+        (JSC::FTL::buildCall):
+        (JSC::FTL::setTailCall):
+        (JSC::FTL::buildExtractValue):
+        (JSC::FTL::buildSelect):
+        (JSC::FTL::buildBr):
+        (JSC::FTL::buildCondBr):
+        (JSC::FTL::buildSwitch):
+        (JSC::FTL::addCase):
+        (JSC::FTL::buildRet):
+        (JSC::FTL::buildUnreachable):
+        (JSC::FTL::dumpModule):
+        (JSC::FTL::verifyModule):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLFail.cpp:
+        (JSC::FTL::fail):
+        * ftl/FTLJITCode.h:
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLink.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::~Output):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::appendTo):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        (JSC::FTL::State::~State):
+        * ftl/WebKitLLVMLibraryAnchor.cpp: Removed.
+        * jsc.cpp:
+        (jscmain):
+        * llvm: Added.
+        * llvm/InitializeLLVM.cpp: Added.
+        (JSC::initializeLLVM):
+        * llvm/InitializeLLVM.h: Added.
+        * llvm/InitializeLLVMMac.mm: Added.
+        (JSC::initializeLLVMImpl):
+        * llvm/InitializeLLVMPOSIX.cpp: Added.
+        (JSC::initializeLLVMPOSIX):
+        * llvm/InitializeLLVMPOSIX.h: Added.
+        * llvm/LLVMAPI.cpp: Added.
+        * llvm/LLVMAPI.h: Added.
+        * llvm/LLVMAPIFunctions.h: Added.
+        * llvm/LLVMHeaders.h: Added.
+        * llvm/library: Added.
+        * llvm/library/LLVMAnchor.cpp: Added.
+        * llvm/library/LLVMExports.cpp: Added.
+        (initializeAndGetJSCLLVMAPI):
+        * llvm/library/LLVMOverrides.cpp: Added.
+        (__cxa_atexit):
+        * llvm/library/config_llvm.h: Added.
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/Options.h:
+
+2013-10-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        currentThis and currentArguments crash if called from outside a callback
+        https://bugs.webkit.org/show_bug.cgi?id=122620
+
+        Reviewed by Filip Pizlo.
+
+        The documentation for these methods claims that they will return nil if called 
+        from somewhere other than an API callback, but currently they both crash.
+
+        * API/JSContext.mm:
+        (+[JSContext currentThis]):
+        (+[JSContext currentArguments]):
+        * API/tests/testapi.mm:
+
+2013-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Minor clean-ups in the JSC Xcode project.
+
+        Rubber stamped by Mark Rowe.
+        
+        - When we copy the jsc binary into the framework,
+          $(BUILT_PRODUCTS_DIR)/JavaScriptCore.framework/Resources/jsc is the *output* file not
+          the input file. The input file is $(BUILT_PRODUCTS_DIR)/jsc.
+        
+        - Correct capitalization of "JavaScriptcore.framework" in a comment in a shell script in
+          the project.
+        
+        Roll back in after confirming that Mark's fixes make this work right.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-10-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CallbackData unnecessarily caches the JSValue for currentThis
+        https://bugs.webkit.org/show_bug.cgi?id=122616
+
+        Reviewed by Oliver Hunt.
+
+        CallbackData implements its own version of caching the JSValue* for the JSValueRef it stores. 
+        +[JSValue valueWithJSValueRef:inContext:] already does caching, thus obviating the need for 
+        CallbackData to do its own caching.
+
+        * API/JSContext.mm:
+        (+[JSContext currentThis]):
+        (-[JSContext beginCallbackWithData:thisValue:argumentCount:arguments:]):
+        (-[JSContext endCallbackWithData:]):
+        * API/JSContextInternal.h:
+
+2013-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out r157193. It broke some builds.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-10-10  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/13341666> WebKit should always build against an SDK.
+
+        Have all projects default to building against the OS X Internal SDK for the Production
+        configuration. For the Debug and Release configurations, look for UseInternalSDK.xcconfig
+        to determine whether the OS X Internal SDK should be used. If not, use the normal OS X SDK.
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2013-10-10  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/13871507> JavaScriptCore fails to build with C++ 98 conformance changes
+
+        Reviewed by Andreas Kling.
+
+        * heap/VTableSpectrum.cpp:
+        (JSC::VTableSpectrum::dump): strrchr returns a const char* when passed one.
+        Update the type of the local variable to accommodate that.
+
+2013-10-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: blocks aren't callable via 'new'
+        https://bugs.webkit.org/show_bug.cgi?id=122561
+
+        Reviewed by Oliver Hunt.
+
+        Currently the only way for clients to vend new native objects to JavaScript code 
+        is via factory methods in the form of exported class methods or blocks. Blocks can 
+        be called like normal functions from JavaScript code, but they cannot be invoked 
+        with 'new'. This would give a simple way for clients to expose constructor-like 
+        behavior to their JavaScript code.
+
+        This patch adds the ability for blocks to be invoked as if they were a constructor.
+        Blocks invoked as constructors are required to return an object. If the block doesn't
+        return an object then an error is thrown. The 'this' object is not provided to the 
+        block and must be created within the block itself. 
+
+        This patch also unifies the native 'construct' callback used in both the C and Obj-C
+        APIs under the APICallbackFunction struct, similar to how we unified the 'call' callback
+        between ObjCCallbackFunction and JSCallbackFunction before.
+
+        This patch also adds tests to make sure that different blocks generate objects that
+        correctly behave when queried with instanceof. It also makes sure that the correct 
+        JS exception is thrown when a block fails to return an object.
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call):
+        (JSC::APICallbackFunction::construct):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::getConstructData):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::constructCallback):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::functionCallback):
+        * API/ObjCCallbackFunction.h:
+        (JSC::ObjCCallbackFunction::functionCallback):
+        (JSC::ObjCCallbackFunction::constructCallback):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::objCCallbackFunctionCallAsConstructor):
+        (JSC::ObjCCallbackFunction::ObjCCallbackFunction):
+        (JSC::ObjCCallbackFunction::create):
+        (JSC::ObjCCallbackFunction::getConstructData):
+        * API/tests/testapi.mm:
+
+2013-10-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should be able to do simple OSR exits using llvm.webkit.stackmap
+        https://bugs.webkit.org/show_bug.cgi?id=122538
+
+        Reviewed by Oliver Hunt.
+        
+        This gives the FTL the ability to OSR exit using the llvm.webkit.stackmap intrinsic.
+        
+        - The FTL compiles all OSR exit calls as calls to llvm.webkit.stackmap with a unique
+          ID, passing a requested size that is big enough for own jump replacement.
+        
+        - After LLVM compilation, we parse the new LLVM stackmap section.
+        
+        - For all llvm.webkit.stackmaps that we used for OSR exits, we do a jumpReplacement,
+          which targets exit thunks that we generate.
+        
+        - If an exit thunk fires, it causes JSC to compile an exit off-ramp that uses a
+          combination of the JSC-internal OSR exit accounting (FTL::ExitValue and friends) and
+          LLVM stackmap's accounting of where data actually ended up (register, indirect,
+          constant) to reconstruct bytecode state.
+        
+        This still has shortcomings; for example it cannot handle XMM or YMM registers. Handling
+        YMM registers will require adding some basic YMM support to our assemblers - really we
+        just need the ability to move a YMM's value into a GPR.
+        
+        This patch preserves all of the old, intrinsic-less, FTL OSR exit support. Hence it
+        manages to pass all existing FTL tests even despite its incompleteness. I think that's
+        the right way to go since this is already a big patch, and anyway it would be great to
+        keep the intrinsic-less FTL OSR exit support so long as the LLVM side of this hasn't
+        landed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::firstRegister):
+        (JSC::AbstractMacroAssembler::lastRegister):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::isStackRelated):
+        (JSC::MacroAssembler::firstRealRegister):
+        (JSC::MacroAssembler::nextRegister):
+        (JSC::MacroAssembler::secondRealRegister):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::firstRegister):
+        (JSC::X86Assembler::lastRegister):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * ftl/FTLCArgumentGetter.cpp:
+        (JSC::FTL::CArgumentGetter::loadNextAndBox):
+        * ftl/FTLCArgumentGetter.h:
+        (JSC::FTL::CArgumentGetter::loadNextDoubleIntoGPR):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateCodeSection):
+        (JSC::FTL::mmAllocateDataSection):
+        (JSC::FTL::dumpDataSection):
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        (JSC::FTL::compile):
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        (JSC::FTL::ExitThunkGenerator::emitThunks):
+        * ftl/FTLExitThunkGenerator.h:
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::isInJSStackSomehow):
+        (JSC::FTL::ExitValue::valueFormat):
+        * ftl/FTLFail.cpp:
+        (JSC::FTL::fail):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLJITCode.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::generateExitThunks):
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::linkOSRExitsAndCompleteInitializationBlocks):
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompilationInfo.h:
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStubWithOSRExitStackmap):
+        (JSC::FTL::compileStubWithoutOSRExitStackmap):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLSaveRestore.cpp: Added.
+        (JSC::FTL::bytesForGPRs):
+        (JSC::FTL::requiredScratchMemorySizeInBytes):
+        (JSC::FTL::offsetOfGPR):
+        (JSC::FTL::saveAllRegisters):
+        (JSC::FTL::restoreAllRegisters):
+        * ftl/FTLSaveRestore.h: Added.
+        * ftl/FTLStackMaps.cpp: Added.
+        (JSC::FTL::readObject):
+        (JSC::FTL::StackMaps::Constant::parse):
+        (JSC::FTL::StackMaps::Constant::dump):
+        (JSC::FTL::StackMaps::Location::parse):
+        (JSC::FTL::StackMaps::Location::dump):
+        (JSC::FTL::StackMaps::Location::involvesGPR):
+        (JSC::FTL::StackMaps::Location::isGPR):
+        (JSC::FTL::StackMaps::Location::gpr):
+        (JSC::FTL::StackMaps::Location::restoreInto):
+        (JSC::FTL::StackMaps::Record::parse):
+        (JSC::FTL::StackMaps::Record::dump):
+        (JSC::FTL::StackMaps::parse):
+        (JSC::FTL::StackMaps::dump):
+        (JSC::FTL::StackMaps::dumpMultiline):
+        (JSC::FTL::StackMaps::getRecordMap):
+        (WTF::printInternal):
+        * ftl/FTLStackMaps.h: Added.
+        * ftl/FTLState.h:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        * ftl/FTLValueFormat.cpp:
+        (JSC::FTL::reboxAccordingToFormat):
+        * ftl/FTLValueFormat.h:
+        * runtime/DataView.cpp:
+        (JSC::DataView::create):
+        * runtime/DataView.h:
+        (JSC::DataView::read):
+        * runtime/Options.h:
+
+2013-10-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Minor clean-ups in the JSC Xcode project.
+
+        Rubber stamped by Mark Rowe.
+        
+        - When we copy the jsc binary into the framework,
+          $(BUILT_PRODUCTS_DIR)/JavaScriptCore.framework/Resources/jsc is the *output* file not
+          the input file. The input file is $(BUILT_PRODUCTS_DIR)/jsc.
+        
+        - Correct capitalization of "JavaScriptcore.framework" in a comment in a shell script in
+          the project.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-10-09  Julien Brianceau  <jbriance@cisco.com>
+
+        [arm] Inverted src and dest FP registers in DFG speculative JIT when using hardfp.
+        https://bugs.webkit.org/show_bug.cgi?id=122555
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+
+2013-10-08  Michael Saboff  <msaboff@apple.com>
+
+        Transition call and construct JITStubs to CCallHelper functions
+        https://bugs.webkit.org/show_bug.cgi?id=122453
+
+        Reviewed by Geoffrey Garen.
+
+        Transitioned cti_op_call_eval to operationCallEval.  Migrated baseline JIT to use the same 
+        call thunks as the DFG.  Eliminated all of the "oldStyle" thunks and related functions.
+
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkFor):
+        (JSC::JIT::linkSlowCall):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperationWithCallFrameRollbackOnException):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/ThunkGenerators.cpp:
+        * jit/ThunkGenerators.h:
+
+2013-10-09  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Fix lots of unused parameter warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=122545
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::revertJumpReplacementToPatchableBranchPtrWithPatch):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::andlImm8r):
+        (JSC::SH4Assembler::orlImm8r):
+        (JSC::SH4Assembler::xorlImm8r):
+        (JSC::SH4Assembler::cmpEqImmR0):
+        (JSC::SH4Assembler::testlImm8r):
+        (JSC::SH4Assembler::movwPCReg):
+        (JSC::SH4Assembler::movwMemReg):
+        (JSC::SH4Assembler::movbMemReg):
+        (JSC::SH4Assembler::printInstr):
+        (JSC::SH4Assembler::printBlockInstr):
+
+2013-10-09  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Add sh4 support when building with CMake.
+        https://bugs.webkit.org/show_bug.cgi?id=122542
+
+        Reviewed by Csaba Osztrogonác.
+
+        * CMakeLists.txt:
+
+2013-10-08  Oliver Hunt  <oliver@apple.com>
+
+        Convert for-of iteration to in-band signalling so we can trivially avoid unnecessary object allocation
+        https://bugs.webkit.org/show_bug.cgi?id=122532
+
+        Reviewed by Michael Saboff.
+
+        Switch for-of enumeration to use in band signalling to determine the end
+        of iteration.  This allows us to trivially remove an otherwise unnecessary
+        object allocation, and paves the way for optimised thunks in future.
+
+        We can re-add explicit .next() functions in future that would marshall
+        the true iteration functions, but for now we'll ignore them.
+
+        This results in a huge improvement in the performance of for-of (in the order
+        of 2x) but there's still a long way to go in order to get the performance to
+        a satisfactory level.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForOfNode::emitBytecode):
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::createIteratorResult):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::addSlowCase):
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::create):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2013-10-08  Alex Christensen  <achristensen@webkit.org>
+
+        Fixed compile errors while compiling without the JIT enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=122530
+
+        Reviewed by Brent Fulgham.
+
+        * jit/JITOperations.cpp:
+        Protected with #if ENABLE(JIT) like the rest of the JIT source.
+
+2013-10-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSManagedValue should be able to store non-object JSValues
+        https://bugs.webkit.org/show_bug.cgi?id=122351
+
+        Reviewed by Oliver Hunt.
+
+        We decided not to support this because we thought it didn't make sense to have a 
+        "weak" JSValue that wasn't an object.
+
+        Our general thought process was if you have a JSObject-ObjC object pair (i.e. an 
+        Obj-C object that you exported to JavaScript-land), it makes more sense to store 
+        a non-object JSValue on the JavaScript-land version of the object rather than as 
+        an ivar in the Objective-C object.
+
+        In retrospect, this may not have been a good decision at least w.r.t. consistency 
+        in client code. If you're storing a bag of JSValues off an Obj-C object, you'd 
+        like to store all of them either in ObjC-land or JavaScript-land, but doing some 
+        in one and some in the other doesn't sound too good. Also, what if the object you 
+        want to hang these values off of doesn't have a corresponding object in JavaScript-
+        land in which to store them?
+
+        The solution is to fix JSManagedValue to be able to reference non-object JSValues. 
+        Right now, all JSManagedValues contain a Weak<JSObject>. We'll change this so that
+        they can contain either a non-cell JSValue or a JSObject*, along with a weak 
+        reference to the JSGlobalObject for reconstructing a JSValue later on.
+
+        * API/JSManagedValue.mm:
+        (PrimitiveOrObject::PrimitiveOrObject):
+        (PrimitiveOrObject::~PrimitiveOrObject):
+        (PrimitiveOrObject::clear):
+        (PrimitiveOrObject::isClear):
+        (PrimitiveOrObject::isSet):
+        (PrimitiveOrObject::isPrimitive):
+        (PrimitiveOrObject::isObject):
+        (PrimitiveOrObject::setPrimitive):
+        (PrimitiveOrObject::setObject):
+        (PrimitiveOrObject::object):
+        (PrimitiveOrObject::primitive):
+        (-[JSManagedValue initWithValue:]):
+        (-[JSManagedValue value]):
+        (-[JSManagedValue disconnectValue]):
+
+2013-10-08  Robert Plociennik  <r.plociennik@samsung.com>
+
+        JavaScriptCore fails to build
+        https://bugs.webkit.org/show_bug.cgi?id=122440
+
+        Reviewed by Darin Adler.
+
+        Compilation fails in debug due to 'comparison of unsigned expression >= 0 is
+        always true'.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::positionForCallFrame): Removed the offending ASSERTS.
+
+2013-10-07  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to JSNotAnObject constructor.
+        <https://webkit.org/b/122474>
+
+        Reviewed by Sam Weinig.
+
+        JSNotAnObject was only using the ExecState to find the VM.
+
+2013-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL memory allocator should be able to allocate data sections in non-executable memory
+        https://bugs.webkit.org/show_bug.cgi?id=116189
+
+        Reviewed by Sam Weinig.
+        
+        Use a RefCountedArray<int64_t> for data sections. This works out great because
+        RefCountedArray<> knows its own size and because the reference counting makes passing
+        it around very easy (you don't have to stress out about ownership).
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::addDataSection):
+        * ftl/FTLJITCode.h:
+        (JSC::FTL::JITCode::dataSections):
+
+2013-10-07  Roger Fong  <roger_fong@apple.com>
+
+        Modify JavascriptCore makefile for x64 build.
+        https://bugs.webkit.org/show_bug.cgi?id=122467.
+        <rdar://problem/15169174>.
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+
+2013-10-07  Nadav Rotem  <nrotem@apple.com>
+
+        FTL: Optimize IsString(@2<String>) -> JSConst(true) + Phantom()
+        https://bugs.webkit.org/show_bug.cgi?id=122363
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2013-10-04  Michael Saboff  <msaboff@apple.com>
+
+        Transition stack check JITStubs to CCallHelper functions
+        https://bugs.webkit.org/show_bug.cgi?id=122289
+
+        Reviewed by Filip Pizlo.
+
+        Replaced jit stubs cti_stack_check, cti_op_call_arityCheck and cti_op_construct_arityCheck with
+        jit operations operationStackCheck, operationCallArityCheck & operationConstructArityCheck.
+        Added new callOperationWithCallFrameRollbackOnException() in baseline and DFG JITs to call
+        these new functions.  Added code to unwind one frame in JIT::privateCompileExceptionHandlers() 
+        and JITCompiler::compileExceptionHandlers() for these cases that need to throw exceptions in
+        their caller frame when the stack is exhausted.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::andPtr): Added to handle masking a pointer with a literal.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::and64): Added to handle masking a pointer with a literal.
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::linkFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::exceptionCheckWithCallFrameRollback):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperationWithCallFrameRollbackOnException):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnException):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnExceptionSetResult):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hostCallFrameFlag):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::jitAssertIsNull):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::jitAssertIsNull):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JIT.h:
+        (JSC::JIT::exceptionCheckWithCallFrameRollback):
+        * jit/JITInlines.h:
+        (JSC::JIT::appendCallWithCallFrameRollbackOnException):
+        (JSC::JIT::callOperationWithCallFrameRollbackOnException):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2013-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILED: isUInt32() in jsc-layout-tests.yaml/js/script-tests/dfg-uint32-to-number-in-middle-of-copy-propagation.js.layout-dfg-eager-no-cjit
+        https://bugs.webkit.org/show_bug.cgi?id=122419
+
+        Reviewed by Oliver Hunt.
+        
+        AI was using JSValue::asUInt32() incorrectly. That method presumes that the input is
+        both a int32 and a uint32 (it's in the range [0, 2^31)). The UInt32ToNumber node is
+        instead dealing with an input that is always represented as a int32 but that has the
+        meaning of a uint32 - so AI should use JSValue::asInt32() and then do the cast.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+
+2013-10-07  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Jump over maxJumpReplacementSize in revertJumpToMove.
+        https://bugs.webkit.org/show_bug.cgi?id=120007
+
+        Reviewed by Oliver Hunt.
+
+        Jump over maxJumpReplacementSize in revertJumpToMove, even if there is no constant
+        value within the area. This patch fixes debug ASSERTs failures for sh4 architecture.
+
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::revertJumpToMove):
+
+2013-10-06  Anders Carlsson  <andersca@apple.com>
+
+        Add OVERRIDE and virtual where appropriate
+        https://bugs.webkit.org/show_bug.cgi?id=122439
+
+        Reviewed by Antti Koivisto.
+
+        * API/JSAPIWrapperObject.mm:
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::~JSCallbackObjectData):
+        * API/JSManagedValue.mm:
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::~OpaqueJSScript):
+        * bytecode/CodeBlock.h:
+        * bytecode/StructureStubClearingWatchpoint.h:
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        * dfg/DFGFailedFinalizer.h:
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGSaneStringGetByValSlowPathGenerator.h:
+        * dfg/DFGSlowPathGenerator.h:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * heap/Heap.h:
+        * heap/IncrementalSweeper.h:
+        * heap/SuperRegion.h:
+        * jit/ClosureCallStubRoutine.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/GCAwareJITStubRoutine.h:
+        * jit/JITCode.h:
+        * jit/JITStubs.cpp:
+        * jit/JITToDFGDeferredCompilationCallback.h:
+        * jit/JumpReplacementWatchpoint.h:
+        * parser/Nodes.h:
+        * runtime/DataView.h:
+        * runtime/GCActivityCallback.h:
+        * runtime/GenericTypedArrayView.h:
+        * runtime/RegExpCache.h:
+        * runtime/SimpleTypedArrayController.h:
+        * runtime/WeakMapData.h:
+
+2013-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Trap 5 (most likely int $3) in jsc-layout-tests.yaml/js/script-tests/integer-division-neg2tothe32-by-neg1.js.layout-dfg-eager-no-cjit
+        https://bugs.webkit.org/show_bug.cgi?id=122420
+
+        Reviewed by Michael Saboff.
+        
+        For the (-2^31/-1)|0 case, we were returning the left operand (i.e. -2^31) but we were
+        failing to account for the possibility that this operand has high-bit garbage and
+        int32Result() requires that the high bits are zero.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+
+2013-10-06  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILED: bitwise_cast<WriteBarrier<Unknown>*>(callFrame) == m_registers in jsc-layout-tests.yaml/js/script-tests/dfg-inline-arguments-capture-throw-exception.js.layout-dfg-eager-no-cjit
+        https://bugs.webkit.org/show_bug.cgi?id=122418
+
+        Reviewed by Oliver Hunt.
+
+        This is pretty awesome. With stack compression, Arguments created in the DFG will point
+        their m_registers pointers into a different slab of stack than they would have in byte
+        code.
+
+        Hence OSR exit must repoint any Arguments objects' m_registers pointers. It previously
+        neglected to do so. This patch fixes that.
+        
+        Fixing this unveiled another bug: the stack reversal broke the reification of inlined
+        phantom arguments.
+        
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Arguments.h:
+        (JSC::Arguments::offsetOfNumArguments):
+        (JSC::Arguments::offsetOfRegisters):
+        (JSC::Arguments::offsetOfSlowArgumentData):
+        (JSC::Arguments::offsetOfOverrodeLength):
+
+2013-10-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Unified test infrastructure via the jsc shell
+        https://bugs.webkit.org/show_bug.cgi?id=120696
+
+        Reviewed by Oliver Hunt.
+        
+        Add a mozilla-tests.yaml list. This is autogenerated by create-mozilla-js-test-list.
+        I think it's better to leave this checked in; we may even just edit it directly in
+        the future. Also generating it is not cheap.
+        
+        Fix some low-hanging fruit bugs that I caught by introducing more test coverage.
+        
+        - We were not emitting labels for CFA-unreachable blocks, which caused link errors.
+          It's possible for a CFA-unreachable block to be jumped to, if the thing that causes
+          it to be unreachable is a speculation in a Branch or peephole compare.
+        
+        - The register allocation assertions didn't handle peephole branches correctly. Since
+          the peephole branch handling returns early from compile(), the clearBlahbittyBlah()
+          method wasn't being called.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * tests/mozilla/mozilla-tests.yaml: Added.
+
+2013-10-05  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to StringObject constructor.
+        <https://webkit.org/b/122395>
+
+        Reviewed by Sam Weinig.
+
+        StringObject() only uses the ExecState to find the VM.
+
+2013-10-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Compress DFG stack layout
+        https://bugs.webkit.org/show_bug.cgi?id=122024
+
+        Reviewed by Oliver Hunt.
+        
+        The DFG needs to be able to store things at a known offset from frame pointer so that
+        the runtime can read those things. Prior to this patch, the DFG would use the exact
+        offsets that the bytecode asked for, even in the case of inlining, where it would use
+        the callsite stack offset to shift all of the inlined function's variables over just as
+        they would have been if a bytecode interpreter had really made the call.
+        
+        But this won't work once WebKit-LLVM integration is complete. LLVM has no notion of
+        storing things at a fixed offset from the frame pointer. We could try to hack LLVM to do
+        that, but it would seriously complicate LLVM's stack layout. But what we might be able
+        to do is have LLVM tell us (via an addressof intrinsic and a side-channel) where some
+        alloca landed relative to the frame pointer. Hence if the DFG can put all of its flushed
+        variables in a contiguous range that can be expressed to LLVM as a struct that we
+        alloca, then all of this can still work just fine.
+        
+        Previously the flushed variables didn't fit in a contiguous range, but this patch makes
+        them contiguous by allowing the stack layout to be compressed.
+        
+        What this really means is that there is now a distinction between where the DFG saw a
+        variable stored in bytecode and where it will actually store it in the resulting machine
+        code. Henceforth when the DFG says "local" or "virtual register" it means the variable
+        according to bytecode (with the stack offsetting for inlined code as before), but when
+        it says "machine local" or "machine virtual register" it means the actual place where it
+        will store things in the resulting machine code. All of the OSR exit, inlined arguments,
+        captured variables, and various stack unwinding machine now knows about all of this.
+        
+        Note that the DFG's abstract interpretation still uses bytecode variables rather than
+        machine variables. Same for CSE and abstract heaps. This makes sense since it means that
+        we don't have to decide on machine variable allocation just to do those optimizations.
+        
+        The decision of what a local's machine location becomes is deferred to very late in
+        compilation. We only need to assign machine locations to variables that must be stored
+        to the stack. It's now mandatory to run some kind of "stack layout phase" that makes the
+        decision and updates all data structures.
+        
+        So far the way that this is being used is just to compress the DFG stack layout, which
+        is something that we should have done anyway, a long time ago. And the compression isn't
+        even that good - the current StackLayoutPhase just identifies local indices that are
+        unused in machine code and slides all other variables towards zero. This doesn't achieve
+        particularly good compression but it is better than nothing. Note that this phase makes
+        it seem like the bytecode-machine mapping is based on bytecode local indices; for
+        example if bytecode local 4 is mapped to machine local 3 then it always will be. That's
+        true for the current StackLayoutPhase but it _will not_ be true for all possible stack
+        layout phases and it would be incorrect to assume that it should be true. This is why
+        the current data structures have each VariableAccessData hold its own copy of the
+        machine virtual register, and also have each InlineCallFrame report their own machine
+        virtual registers for the various things. The DFG backend is likely to always use the
+        dumb StackLayoutPhase since it is very cheap to run, but the FTL backend is likely to
+        eventually get a better one, where we do some kind of constraint-based coloring: we
+        institute constraints where some VariableAccessData's must have the same indices as some
+        other ones, and also must be right next to some other ones; then we process all
+        VariableAccessData's and attempt to assign them machine locals while preserving those
+        constraints. This could lead to two VariableAccessDatas for the same bytecode local
+        ending up with different machine locals.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::isCaptured):
+        (JSC::CodeBlock::framePointerOffsetToGetActivationRegisters):
+        (JSC::CodeBlock::machineSlowArguments):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasSlowArguments):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::dump):
+        (JSC::InlineCallFrame::calleeForCallFrame):
+        (JSC::InlineCallFrame::dumpInContext):
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::InlineCallFrame):
+        (JSC::InlineCallFrame::calleeConstant):
+        * bytecode/Operands.h:
+        (JSC::Operands::indexForOperand):
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::SSAData::SSAData):
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCommon.h:
+        * dfg/DFGCommonData.h:
+        (JSC::DFG::CommonData::CommonData):
+        * dfg/DFGDesiredWriteBarriers.cpp:
+        (JSC::DFG::DesiredWriteBarrier::trigger):
+        * dfg/DFGDesiredWriteBarriers.h:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        (JSC::DFG::FlushLivenessAnalysisPhase::run):
+        (JSC::DFG::FlushLivenessAnalysisPhase::process):
+        (JSC::DFG::FlushLivenessAnalysisPhase::reportError):
+        * dfg/DFGFlushedAt.cpp: Added.
+        (JSC::DFG::FlushedAt::dump):
+        (JSC::DFG::FlushedAt::dumpInContext):
+        * dfg/DFGFlushedAt.h: Added.
+        (JSC::DFG::FlushedAt::FlushedAt):
+        (JSC::DFG::FlushedAt::operator!):
+        (JSC::DFG::FlushedAt::format):
+        (JSC::DFG::FlushedAt::virtualRegister):
+        (JSC::DFG::FlushedAt::operator==):
+        (JSC::DFG::FlushedAt::operator!=):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::bytecodeRegisterForArgument):
+        (JSC::DFG::Graph::argumentsRegisterFor):
+        (JSC::DFG::Graph::machineArgumentsRegisterFor):
+        (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
+        (JSC::DFG::Graph::activationRegister):
+        (JSC::DFG::Graph::uncheckedActivationRegister):
+        (JSC::DFG::Graph::machineActivationRegister):
+        (JSC::DFG::Graph::uncheckedMachineActivationRegister):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToGetLocalUnlinked):
+        (JSC::DFG::Node::convertToGetLocal):
+        (JSC::DFG::Node::machineLocal):
+        (JSC::DFG::Node::hasUnlinkedMachineLocal):
+        (JSC::DFG::Node::setUnlinkedMachineLocal):
+        (JSC::DFG::Node::unlinkedMachineLocal):
+        (JSC::DFG::Node::hasInlineStartData):
+        (JSC::DFG::Node::inlineStartData):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        (JSC::DFG::OSREntryReshuffling::OSREntryReshuffling):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::ScoreBoard):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::createOSREntries):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::calleeFrameOffset):
+        (JSC::DFG::SpeculativeJIT::callFrameSlot):
+        (JSC::DFG::SpeculativeJIT::argumentSlot):
+        (JSC::DFG::SpeculativeJIT::callFrameTagSlot):
+        (JSC::DFG::SpeculativeJIT::callFramePayloadSlot):
+        (JSC::DFG::SpeculativeJIT::argumentTagSlot):
+        (JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
+        (JSC::DFG::SpeculativeJIT::framePointerOffsetToGetActivationRegisters):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::recordSetLocal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp: Added.
+        (JSC::DFG::StackLayoutPhase::StackLayoutPhase):
+        (JSC::DFG::StackLayoutPhase::run):
+        (JSC::DFG::performStackLayout):
+        * dfg/DFGStackLayoutPhase.h: Added.
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::machineLocal):
+        (JSC::DFG::VariableAccessData::flushedAt):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::inJSStack):
+        (JSC::FTL::ExitValue::inJSStackAsInt32):
+        (JSC::FTL::ExitValue::inJSStackAsInt52):
+        (JSC::FTL::ExitValue::inJSStackAsDouble):
+        (JSC::FTL::ExitValue::virtualRegister):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetArgument):
+        (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLValueSource.cpp:
+        (JSC::FTL::ValueSource::dump):
+        * ftl/FTLValueSource.h:
+        (JSC::FTL::ValueSource::ValueSource):
+        (JSC::FTL::ValueSource::kind):
+        (JSC::FTL::ValueSource::operator!):
+        (JSC::FTL::ValueSource::node):
+        (JSC::FTL::ValueSource::virtualRegister):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::readInlinedFrame):
+        (JSC::StackVisitor::Frame::createArguments):
+        (JSC::StackVisitor::Frame::existingArguments):
+        * interpreter/StackVisitor.h:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::addressFor):
+        (JSC::AssemblyHelpers::tagFor):
+        (JSC::AssemblyHelpers::payloadFor):
+        (JSC::AssemblyHelpers::offsetOfArgumentsIncludingThis):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        * runtime/Arguments.h:
+        (JSC::Arguments::allocateSlowArguments):
+        (JSC::Arguments::tryDeleteArgument):
+        (JSC::Arguments::isDeletedArgument):
+        (JSC::Arguments::isArgument):
+        (JSC::Arguments::argument):
+        (JSC::Arguments::finishCreation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveArgumentsFunctor::operator()):
+
+2013-10-05  Anders Carlsson  <andersca@apple.com>
+
+        Remove createOwned
+        https://bugs.webkit.org/show_bug.cgi?id=122388
+
+        Reviewed by Darin Adler.
+
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::save):
+
+2013-10-05  Darin Adler  <darin@apple.com>
+
+        Cut down on use of String::number
+        https://bugs.webkit.org/show_bug.cgi?id=122382
+
+        Reviewed by Anders Carlsson.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::putByIndex): Use Identifier::from instead of calling
+        String::number and creating an identifier from that. Can save creating and then
+        destroying a string if an identifier already exists.
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlotByIndex): Ditto.
+        (JSC::Arguments::getOwnPropertyNames): Ditto.
+        (JSC::Arguments::putByIndex): Ditto.
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::::getOwnPropertyNames): Ditto.
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames): Ditto.
+
+2013-10-04  Mark Lam  <mark.lam@apple.com>
+
+        Change ScriptDebugServer to use DebuggerCallFrame instead of JavaScriptCallFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=121969.
+
+        Reviewed by Geoffrey Garen.
+
+        1. Make JavaScriptCallFrame a thin shell around the DebuggerCallFrame.
+           DebuggerCallFrame now tracks whether it is valid instead of needing
+           JavaScriptCallFrame do it.
+        2. ScriptDebugServer now only instantiates an DebuggerCallFrame when needed
+           just before it pauses and calls back to its client, and then invalidates
+           it immediately when the callback returns. Every subsequent callback to
+           the client will use a new instance of the DebuggerCallFrame.
+        3. Similarly, ScriptDebugServer now only creates a JavaScriptCallFrame when
+           it "pauses".
+        4. DebuggerCallFrame only creates its caller DebuggerCallFrame when
+           it is needed i.e. when the client calls callerFrame(). Similarly,
+           JavaScriptCallFrame only creates its caller when it's requested.
+        5. DebuggerCallFrame's line() and column() now returns a base-zero int.
+        6. WebScriptDebugDelegate now only caches the functionName of the frame
+           instead of the entire DebuggerCallFrame because that is all that is
+           needed.
+        7. Also removed evaluateInGlobalCallFrame() which is not used anywhere.
+
+        * debugger/Debugger.cpp:
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::callerFrame):
+        (JSC::DebuggerCallFrame::dynamicGlobalObject):
+        (JSC::DebuggerCallFrame::sourceId):
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::scope):
+        (JSC::DebuggerCallFrame::type):
+        (JSC::DebuggerCallFrame::thisValue):
+        (JSC::DebuggerCallFrame::evaluate):
+        (JSC::DebuggerCallFrame::evaluateWithCallFrame):
+        (JSC::DebuggerCallFrame::invalidate):
+        (JSC::DebuggerCallFrame::positionForCallFrame):
+        (JSC::DebuggerCallFrame::sourceIdForCallFrame):
+        (JSC::DebuggerCallFrame::thisValueForCallFrame):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::create):
+        (JSC::DebuggerCallFrame::exec):
+        (JSC::DebuggerCallFrame::line):
+        (JSC::DebuggerCallFrame::column):
+        (JSC::DebuggerCallFrame::position):
+        (JSC::DebuggerCallFrame::isValid):
+        * interpreter/StackVisitor.cpp:
+
+2013-10-04  Brent Fulgham  <bfulgham@apple.com>
+
+        Silence compiler warning when building 64-bit (on Windows)
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JSInterfaceJIT.h: Add a static cast for assignment.
+
+2013-10-04  Nadav Rotem  <nrotem@apple.com>
+
+        FTL: Add support for ValueToInt32(bool(x))
+        https://bugs.webkit.org/show_bug.cgi?id=122346
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+
+2013-10-04  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        * runtime/JSArrayIterator.cpp:
+
+2013-10-04  Oliver Hunt  <oliver@apple.com>
+
+        Support for-of syntax
+        https://bugs.webkit.org/show_bug.cgi?id=122339
+
+        Reviewed by Geoffrey Garen.
+
+        Add support for for-of syntax to JSC.  As part of doing this I had to make
+        us support unique empty strings as identifiers.  In a follow on patch i'm
+        going to remove the distinction entirely as it's purely a complicating
+        separation.
+
+        Otherwise the logic here is fairly self-explanatory.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::emitCall):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        (JSC::ForOfNode::emitBytecode):
+        * jit/JITOperations.cpp:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createForOfLoop):
+        * parser/NodeConstructors.h:
+        (JSC::EnumerationNode::EnumerationNode):
+        (JSC::ForInNode::ForInNode):
+        (JSC::ForOfNode::ForOfNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseForStatement):
+        * parser/Parser.h:
+        (JSC::Parser::isofToken):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createForOfLoop):
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::arrayIteratorPrototypeIterate):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::create):
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Identifier.h:
+        (JSC::Identifier::from):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContext):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectNativeFunction):
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+
+2013-10-04  Michael Saboff  <msaboff@apple.com>
+
+        FTL::OSRExit::convertToForward() shouldn't misuse Operands<>::operator[]
+        https://bugs.webkit.org/show_bug.cgi?id=122336
+
+        Reviewed by Geoffrey Garen.
+
+        Changed code in change set r156900 to use the operand() accessor instead of operator[].
+
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::convertToForward):
+
+2013-10-04  Michael Saboff  <msaboff@apple.com>
+
+        FTL: Crash in OSRExit::convertToForward() using VirtualRegister.offset() as array index
+        https://bugs.webkit.org/show_bug.cgi?id=122332
+
+        Reviewed by Oliver Hunt.
+
+        Changed the uses of .offset(), which returns a negative number for locals, to be
+        toLocal() which returns a local's ordinal number.
+
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::convertToForward):
+
+2013-10-04  Michael Saboff  <msaboff@apple.com>
+
+        Add callOperation to Baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=122306
+
+        Reviewed by Geoffrey Garen.
+
+        Created baseline JIT compatible versions for a few flavors of callOperation().
+        Migrated cti_op_new_regexp() and its caller to callOperation(operationNewRegexp()).
+
+        * dfg/DFGOperations.cpp: Moved operationNewRegexp() to JITOperations
+        * dfg/DFGOperations.h:
+        * jit/JIT.h:
+        (JSC::JIT::appendCall):
+        * jit/JITInlines.h:
+        (JSC::JIT::appendCallWithExceptionCheck):
+        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_regexp):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+
+2013-10-03  Mark Rowe  <mrowe@apple.com>
+
+        REGRESSION (r156811): WebCore rebuilds from scratch when doing an incremental build
+
+        The change in r156811 resulted in several public headers in the JavaScriptCore framework having their modification
+        date touched on every build, even if their contents had not changed. This resulted in a large portion of WebCore
+        needing to rebuilt after an incremental build of JavaScriptCore.
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Have unifdef generate its output to a temporary file. If its exit status
+        indicates that the content did not change, remove the temporary file. If the content changed, moved the temporary file
+        over the destination.
+
+2013-10-03  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed gardening.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Clean up the
+        paths for various files added outside of Visual Studio. They are all
+        displayed in the root of the project, rather than the proper sub-folder.
+
+2013-10-03  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Update solutions and projects to support 64-bit builds.
+        https://bugs.webkit.org/show_bug.cgi?id=122225
+
+        Reviewed by Anders Carlsson.
+
+        Revise ordering of CPU(X86) and CPU(X86_64) tests, because MSVC always defines
+        both when targeting a 64-bit build.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Add an x64 target
+        for 64-bit builds.
+
+2013-10-03  Michael Saboff  <msaboff@apple.com>
+
+        Eliminate unused JITStub function declarations
+        https://bugs.webkit.org/show_bug.cgi?id=122288
+
+        Reviewed by Geoffrey Garen.
+
+        Removed unused JITStub declarations.
+
+        * jit/JITStubs.h:
+
+2013-10-03  Sergio Correia  <sergio.correia@openbossa.org>
+
+        [EFL] [DEBUG] JavaScriptCore fails to build
+        https://bugs.webkit.org/show_bug.cgi?id=122267
+
+        Reviewed by Michael Saboff.
+
+        Build fails due to an expression containing comparison between signed
+        and unsigned integer.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions): Add cast to avoid signed vs.
+        unsigned comparison warning.
+
+2013-10-03  Nadav Rotem  <nrotem@apple.com>
+
+        DFG: ConstProp the pattern ValueToInt32(Bool(x)) -> Int32(x)
+        https://bugs.webkit.org/show_bug.cgi?id=122263
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+
+2013-10-02  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r156811): Objective-C JavaScriptCore API test failing on Mountain Lion bots
+        https://bugs.webkit.org/show_bug.cgi?id=122260
+
+        Reviewed by Mark Rowe.
+
+        For the API to work, the tests need to be compiled with a newer version of the LLVM
+        compiler. Until the bots are updated to that version, disable the tests on 10.8.
+
+        * API/tests/testapi.mm:
+
+2013-10-02  Mark Lam  <mark.lam@apple.com>
+
+        Make LLINT exception stack unwinding consistent with the JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=122255.
+
+        Reviewed by Filip Pizlo.
+
+        Previously, the CommonSlowPaths code is expected to behave in an
+        inconsistent way in terms of whether to unwind the stack when handling
+        exceptions or not. For the LLINT, the slow path should unwind the stack
+        before returning. For the JIT, the slow path should not unwind the stack.
+        This can result in the stack being unwound twice when the exception
+        being handled is a TerminationException.
+
+        This patch fixes the LLINT's expectation so that it expects the same
+        slow path behavior as the JIT does.
+
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPathsExceptions.cpp:
+        (JSC::CommonSlowPaths::interpreterThrowInCaller):
+
+2013-10-02  Filip Pizlo  <fpizlo@apple.com>
+
+        The DFG should use always DFG::Graph methods for determining where special registers are
+        https://bugs.webkit.org/show_bug.cgi?id=122248
+
+        Reviewed by Michael Saboff.
+        
+        This makes it possible to have the DFG use different registers than the other engines
+        for things like activation and arguments.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::activationRegister):
+        (JSC::DFG::Graph::uncheckedActivationRegister):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::baselineArgumentsRegisterFor):
+
+2013-10-02  Dan Bernstein  <mitz@apple.com>
+
+        The Objective-C API should be available in 10.8 builds
+        https://bugs.webkit.org/show_bug.cgi?id=122245
+
+        Reviewed by Mark Rowe.
+
+        Enabled the Objective-C API when building on OS X 10.8 with the modern Objective-C runtime,
+        but kept the availability attributes in API headers for 10.9 and later as they were.
+
+        * API/JSBase.h: When JSC_OBJC_API_AVAILABLE_MAC_OS_X_1080 is defined, made
+        JSC_OBJC_API_ENABLED true on 10.8 and above.
+        * API/JSContext.h: When JSC_OBJC_API_AVAILABLE_MAC_OS_X_1080 is defined, marked the class
+        as available on all OS X versions.
+        * API/JSManagedValue.h: Ditto.
+        * API/JSValue.h: Ditto.
+        * API/JSVirtualMachine.h: Ditto.
+        * Configurations/Base.xcconfig: Added JSC_OBJC_API_AVAILABLE_MAC_OS_X_1080 to
+        GCC_PREPROCESSOR_DEFINITIONS.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added a script build phase to unifdef the
+        above header files with JSC_OBJC_API_AVAILABLE_MAC_OS_X_1080 either defined or not based on
+        the OS X version we are targeting.
+
+2013-10-02  Michael Saboff  <msaboff@apple.com>
+
+        Make Baseline JIT exception handling work like the DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=122244
+
+        Reviewed by Filip Pizlo.
+
+        Added a jump list (m_exceptionChecks) to JIT as a common place for exception processing within
+        generated code.  Added exceptionCheck() helpers that check for an exception which add a branch
+        to the list.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JIT.h:
+        (JSC::JIT::exceptionCheck):
+
+2013-10-02  Oliver Hunt  <oliver@apple.com>
+
+        Fix MSVC build
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+
+2013-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Optimized VM access from C++ code
+        https://bugs.webkit.org/show_bug.cgi?id=122241
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSScope.h:
+        (JSC::JSScope::vm): Use MarkedBlock instead of Heap, since both have a
+        pointer to the VM, and Heap is one extra load.
+
+2013-10-02  Michael Saboff  <msaboff@apple.com>
+
+        The LLInt should not use JITStackFrame
+        https://bugs.webkit.org/show_bug.cgi?id=122231
+
+        Reviewed by Filip Pizlo.
+
+        Replaced uses of JITStackFrame::vm with code to either access the vm via the CodeBlock from
+        known JavaScript call frames or via the JSScope* for host call frames.  This eliminates
+        all uses of JITStackFrame from the LLInt.
+
+        * heap/MarkedBlock.h: Made LLIntOffsetsExtractor a friend to access member offsets.
+        * heap/WeakSet.h: Made LLIntOffsetsExtractor a friend to access member offsets.
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions): Added an ASSERT for the newly added MarkedBlockMask
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Implement Array key, value and entries iterators
+        https://bugs.webkit.org/show_bug.cgi?id=122195
+
+        Reviewed by Filip Pizlo.
+
+        Add implementation of ES6 Array iterators for keys(), values() and entries()
+
+        Fairly self explanatory as we just need a simple implementation so that we can
+        implement and test other features.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/ArrayIteratorConstructor.cpp: Added.
+        (JSC::ArrayIteratorConstructor::finishCreation):
+        * runtime/ArrayIteratorConstructor.h: Added.
+        (JSC::ArrayIteratorConstructor::create):
+        (JSC::ArrayIteratorConstructor::createStructure):
+        (JSC::ArrayIteratorConstructor::ArrayIteratorConstructor):
+        * runtime/ArrayIteratorPrototype.cpp: Added.
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::createIteratorResult):
+        (JSC::arrayIteratorPrototypeNext):
+        * runtime/ArrayIteratorPrototype.h: Added.
+        (JSC::ArrayIteratorPrototype::create):
+        (JSC::ArrayIteratorPrototype::createStructure):
+        (JSC::ArrayIteratorPrototype::ArrayIteratorPrototype):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncValues):
+        (JSC::arrayProtoFuncEntries):
+        (JSC::arrayProtoFuncKeys):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Identifier.h:
+        (JSC::Identifier::createEmptyUnique):
+        * runtime/JSArrayIterator.cpp: Added.
+        (JSC::JSArrayIterator::finishCreation):
+        * runtime/JSArrayIterator.h: Added.
+        (JSC::JSArrayIterator::createStructure):
+        (JSC::JSArrayIterator::create):
+        (JSC::JSArrayIterator::iterationKind):
+        (JSC::JSArrayIterator::iteratedObject):
+        (JSC::JSArrayIterator::nextIndex):
+        (JSC::JSArrayIterator::setNextIndex):
+        (JSC::JSArrayIterator::finish):
+        (JSC::JSArrayIterator::JSArrayIterator):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::iteratorResultStructure):
+
+2013-10-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        get_callee and to_this aren't properly cleared during finalizeUnconditionally
+        https://bugs.webkit.org/show_bug.cgi?id=122224
+
+        Reviewed by Geoffrey Garen.
+
+        Even though there is code to clear unmarked inline cache objects in finalizeUnconditionally,
+        it will never run because get_callee and to_this weren't added to the proper Vector in the 
+        UnlinkedCodeBlock that is iterated during finalizeUnconditionally.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCreateThis):
+
+2013-09-25  Oliver Hunt  <oliver@apple.com>
+
+        Implement prefixed-destructuring assignment
+        https://bugs.webkit.org/show_bug.cgi?id=121930
+
+        Reviewed by Mark Hahnenberg.
+
+        Relanding with fix after rollout - it helps to not completely destroy
+        optimisations for no reason.
+
+2013-10-02  Nadav Rotem  <nrotem@apple.com>
+
+        FTL: Refactor compileArithDiv and compileArithMod into one function.
+        https://bugs.webkit.org/show_bug.cgi?id=122205
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileAddSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDivMod):
+
+2013-10-02  Anders Carlsson  <andersca@apple.com>
+
+        Get rid of Qt code from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=122223
+
+        Reviewed by Oliver Hunt.
+
+        * API/JSStringRefQt.cpp: Removed.
+        * API/JSStringRefQt.h: Removed.
+        * API/OpaqueJSString.h:
+        * DerivedSources.pri: Removed.
+        * JavaScriptCore.pri: Removed.
+        * JavaScriptCore.pro: Removed.
+        * LLIntOffsetsExtractor.pro: Removed.
+        * Target.pri: Removed.
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::urshift32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::shouldBlindForSpecificArch):
+        * assembler/MacroAssemblerX86Common.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::timerEvent):
+        * heap/HeapTimer.h:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::scheduleTimer):
+        * heap/IncrementalSweeper.h:
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSub32Constant):
+        * jsc.cpp:
+        (main):
+        * jsc.pro: Removed.
+        * runtime/DateConstructor.cpp:
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::cancelTimer):
+        * runtime/GCActivityCallback.h:
+        * testRegExp.cpp:
+        (main):
+        * yarr/yarr.pri: Removed.
+
+2013-10-01  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should use the new version of LLVM MCJIT memory manager APIs that take a SectionName
+        https://bugs.webkit.org/show_bug.cgi?id=122193
+
+        Reviewed by Geoffrey Garen.
+        
+        Update our usage of the LLVM C API since the API is about to change.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateCodeSection):
+        (JSC::FTL::mmAllocateDataSection):
+
+2013-10-01  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(156464): 50% regression on SunSpider/string-fasta
+        https://bugs.webkit.org/show_bug.cgi?id=122202
+
+        Unreviewed, roll out r156464.
+        
+        This is a progression on string-fasta, since it fixes the regression.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::paramString):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitBytecode):
+        (JSC::FuncExprNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::addVar):
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        (JSC::ParameterNode::ParameterNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::create):
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FunctionParameters::~FunctionParameters):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isDotAccessorNode):
+        (JSC::CommaNode::append):
+        (JSC::ParameterNode::ident):
+        (JSC::FunctionParameters::at):
+        (JSC::FunctionParameters::identifiers):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseFormalParameters):
+        (JSC::::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+        (JSC::Parser::declareParameter):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/JSONObject.cpp:
+        * runtime/JSONObject.h:
+
+2013-10-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Variable event stream (for DFG OSR exit) should be explicit about where on the stack a SetLocal put a value
+        https://bugs.webkit.org/show_bug.cgi?id=122178
+
+        Reviewed by Geoffrey Garen.
+        
+        Now if the DFG stores the value of a variable into the stack explicitly via a SetLocal,
+        it will record where on the stack it stored the value in addition to recording where on
+        the stack the bytecode would have done the SetLocal. Previously it just recorded the
+        format and the bytecode variable. Recording just the bytecode variable is currently fine
+        since the DFG always executes SetLocal's to the same stack location that the bytecode
+        would have used. But that prevents stack compression (webkit.org/b/122024) so this patch
+        allows the SetLocal to say both the bytecode variable that we're speaking of and the
+        actual stack location to which the SetLocal stored the value.
+        
+        This had to touch a lot of code, so I took the opportunity to also resolve
+        webkit.org/b/108019.
+
+        * bytecode/Operands.h:
+        (JSC::Operands::hasOperand):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::dataFormatFor):
+        * dfg/DFGMinifiedID.h:
+        (JSC::DFG::MinifiedID::bits):
+        (JSC::DFG::MinifiedID::invalidID):
+        (JSC::DFG::MinifiedID::otherInvalidID):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::recordSetLocal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::ValueSource):
+        (JSC::DFG::ValueSource::forFlushFormat):
+        (JSC::DFG::ValueSource::forDataFormat):
+        (JSC::DFG::ValueSource::isSet):
+        (JSC::DFG::ValueSource::kind):
+        (JSC::DFG::ValueSource::valueRecovery):
+        (JSC::DFG::ValueSource::id):
+        (JSC::DFG::ValueSource::virtualRegister):
+        * dfg/DFGVariableEvent.cpp:
+        (JSC::DFG::VariableEvent::dump):
+        (JSC::DFG::VariableEvent::dumpSpillInfo):
+        * dfg/DFGVariableEvent.h:
+        (JSC::DFG::VariableEvent::fillGPR):
+        (JSC::DFG::VariableEvent::fillPair):
+        (JSC::DFG::VariableEvent::fillFPR):
+        (JSC::DFG::VariableEvent::spill):
+        (JSC::DFG::VariableEvent::death):
+        (JSC::DFG::VariableEvent::setLocal):
+        (JSC::DFG::VariableEvent::movHint):
+        (JSC::DFG::VariableEvent::id):
+        (JSC::DFG::VariableEvent::gpr):
+        (JSC::DFG::VariableEvent::tagGPR):
+        (JSC::DFG::VariableEvent::payloadGPR):
+        (JSC::DFG::VariableEvent::fpr):
+        (JSC::DFG::VariableEvent::spillRegister):
+        (JSC::DFG::VariableEvent::bytecodeRegister):
+        (JSC::DFG::VariableEvent::machineRegister):
+        (JSC::DFG::VariableEvent::variableRepresentation):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+
+2013-10-01  Nadav Rotem  <nrotem@apple.com>
+
+        FTL: split overflow checks into non-overflow arithmetic and an additional call to the overflow intrinsic check.
+        https://bugs.webkit.org/show_bug.cgi?id=122170
+
+        Reviewed by Filip Pizlo.
+
+        Overflow intrinsics are preventing SCEV and other LLVM analysis passes from analyzing loops. This patch changes the FTL-IR gen by splitting arithmetic calculations into two parts:
+        1. Generate the arithmetic calculation (that may overflow)
+        2. Generate the overflow check (that is only used by the OSR-exit logic).
+
+        We trust LLVM (SelectionDAG) to merge these calculations into a single opcode.
+
+        This JS function:
+
+        function foo() {
+            for (i=0; i < 10000000; i++) { }
+        }
+
+        Is now compiled into this LLVM-IR: 
+
+        "OSR exit continuation for @24<Int32>":           ; preds = %"Block #0", %"OSR exit continuation for @24<Int32>2"
+          %4 = phi i64 [ %10, %"OSR exit continuation for @24<Int32>2" ], [ -281474976710656, %"Block #0" ]
+          %5 = trunc i64 %4 to i32
+          %6 = add i32 %5, 1
+          %7 = tail call { i32, i1 } @llvm.sadd.with.overflow.i32(i32 %5, i32 1)
+          %8 = extractvalue { i32, i1 } %7, 1
+          br i1 %8, label %"OSR exit failCase for @24<Int32>1", label %"OSR exit continuation for @24<Int32>2"
+
+         And into this assembly:
+
+        LBB0_1:                                 ## %OSR exit continuation for @24<Int32>
+                                        ## =>This Inner Loop Header: Depth=1
+            movl  %ecx, %esi
+            incl  %esi
+            jo  LBB0_4
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileAddSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+
+2013-10-01  Nadav Rotem  <nrotem@apple.com>
+
+        Consolidate multiple OSRExit calls into one.
+        https://bugs.webkit.org/show_bug.cgi?id=122168
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+
+2013-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        SpeculativeJIT::m_arguments/m_variables are vestiges of a time long gone
+        https://bugs.webkit.org/show_bug.cgi?id=122140
+
+        Reviewed by Darin Adler.
+        
+        Just killing code.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::recordSetLocal):
+
+2013-10-01  Daniel Bates  <dabates@apple.com>
+
+        [iOS] JavaScriptCore fails to build with newer versions of clang
+        https://bugs.webkit.org/show_bug.cgi?id=122162
+
+        Reviewed by Darin Adler.
+
+        * runtime/GCActivityCallback.cpp: Add !PLATFORM(IOS)-guard around constant pagingTimeOut
+        as we don't compile the code that uses it on iOS.
+
+2013-09-30  Sam Weinig  <sam@webkit.org>
+
+        Remove support for DOMFileSystem
+        https://bugs.webkit.org/show_bug.cgi?id=122137
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-09-30  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/15114974> Assertion failure under -[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:] if no classes conform to JSExport
+        https://bugs.webkit.org/show_bug.cgi?id=122124
+
+        Reviewed by Darin Adler.
+
+        * API/JSWrapperMap.mm: Defined an empty class that conforms to the JSExport protocol, to
+        ensure that the protocol is always registered with the runtime by the time
+        getJSExportProtocol() is called.
+
+2013-09-30  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the code guarded by STYLE_SCOPED
+        https://bugs.webkit.org/show_bug.cgi?id=122123
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-09-30  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to ObjectPrototype constructor.
+        <https://webkit.org/b/122116>
+
+        Reviewed by Geoffrey Garen.
+
+        The ObjectPrototype constructor was only using the ExecState to get
+        to the VM.
+
+2013-09-30  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of JSGlobalObject to MathObject constructor.
+        <https://webkit.org/b/122119>
+
+        Reviewed by Geoffrey Garen.
+
+        The MathObject constructor was only using the global object to get
+        to the VM. finishCreation() still uses it to set up functions.
+
+2013-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of the AlreadyInJSStack recoveries since they are totally redundant with the DisplacedInJSStack recoveries
+        https://bugs.webkit.org/show_bug.cgi?id=122065
+
+        Reviewed by Mark Hahnenberg.
+        
+        This mostly just kills a bunch of code.
+        
+        But incidentaly while killing that code, I uncovered a bug in our FTL OSR entrypoint
+        creation phase. The phase inserts a sequence of SetLocal(ExtractOSREntryLocal) nodes.
+        If we hoist some type check into the local, then we might inject a conversion node
+        between the ExtractOSREntryLocal and the SetLocal - for example we might put in a
+        Int32ToDouble node. But currently the FixupPhase will make all conversion nodes placed
+        on an edge of a SetLocal use forward exit. This then confuses the OSR exit machinery.
+        When OSR exit sees a forward exit, it tries to "roll forward" execution from the exiting
+        node to the first node that has a different CodeOrigin. This only works if the nodes
+        after the forward exit are MovHints or other tnings that the OSR exit compiler can
+        forward-execute. But here, it will see a bunch of SetLocal and ExtractOSREntryLocal
+        nodes for the same bytecode index. Two possible solutions exist. We could teach the
+        forward-execution logic how to deal with multiple SetLocals and ExtractOSREntryLocals.
+        This would be a lot of complexity; right now it just needs to deal with exactly one
+        SetLocal-like operation. The alternative is to make sure that the conversion node that
+        we inject ends up exiting *backward* rather than forward.
+        
+        But making the conversion nodes exit backward is somewhat tricky. Before this patch,
+        conversion nodes always exit forward for SetLocals and backwards otherwise. It turns out
+        that the solution is to rationalize how we choose the speculation direciton for a
+        conversion node. The conversion node's speculation direction should be the same as the
+        speculation direction of the node for which it is doing a conversion. Since SetLocal's
+        already exit forward by default, this policy preserves our previous behavior. But it
+        also allows the OSR entrypoint creation phase to make its SetLocals exit backward
+        instead.
+        
+        Of course, if the SetLocal(ExtractOSREntryLocal) sequences exit backward, then we need
+        to make sure that the OSR exit machine knows that the local variables are indeed live.
+        Consider that if we have:
+        
+            a: ExtractOSREntryLocal(loc1)
+            b: SetLocal(@a, loc1)
+            c: ExtractOSRentryLocal(loc2)
+            d: SetLocal(@c, loc2)
+        
+        Without additional magic, the exit at @b will think that loc2 is dead and the OSR exit
+        compiler will clobber loc2 with Undefined. So we need to make sure that we actually
+        emit code like:
+        
+            a: ExtractOSREntryLocal(loc1)
+            b: ExtractOSREntryLocal(loc2)
+            c: SetLocal(@a, loc1)
+            d: SetLocal(@b, loc2)
+            e: SetLocal(@a, loc1)
+            f: SetLocal(@b, loc2)
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeOrigin.h:
+        * bytecode/ValueRecovery.cpp: Added.
+        (JSC::ValueRecovery::recover):
+        (JSC::ValueRecovery::dumpInContext):
+        (JSC::ValueRecovery::dump):
+        * bytecode/ValueRecovery.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::fixEdge):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::speculationDirection):
+        (JSC::DFG::Node::setSpeculationDirection):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::valueRecovery):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateMachineInt):
+        * interpreter/Register.h:
+        (JSC::Register::unboxedStrictInt52):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        * runtime/Arguments.h:
+
+2013-09-30  Alex Christensen  <alex.christensen@flexsim.com>
+
+        Win64 compile fix after r1256490.
+        https://bugs.webkit.org/show_bug.cgi?id=122117
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITStubsMSVC64.asm:
+        Implemented getHostCallReturnValue for Windows x86_64 processors.
+
+2013-09-30  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of JSGlobalObject to RegExp constructor.
+        <https://webkit.org/b/122113>
+
+        Reviewed by Darin Adler.
+
+        RegExps don't need anything from the global object during their
+        construction and only use it to get to the VM. Reduce loads by
+        simply passing the VM around instead.
+
+        JSC release binary size -= 120 bytes(!)
+
+2013-09-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix compilation for COMPILER(MSVC) && !CPU(X86) after r156490.
+        https://bugs.webkit.org/show_bug.cgi?id=122102
+
+        Reviewed by Geoffrey Garen.
+
+        _AddressOfReturnAddress() is supported for all platforms of
+        ths Microsoft compiler, so we can use it for !CPU(X86) too.
+
+        * jit/JITOperationWrappers.h:
+
+2013-09-30  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Unreviewed. Build fix for DEBUG_VERBOSE mode after r156511.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+
+2013-09-30  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Unreviewed. Speculative build fix on ARMv7 Thumb2 after r156490.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::fmodAsDFGOperation):
+
+2013-09-29  Nadav Rotem  <nrotem@apple.com>
+
+        FTL: refactor compileAdd and compileArithSub into one function.
+        https://bugs.webkit.org/show_bug.cgi?id=122081
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileAddSub):
+
+2013-09-29  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of JSGlobalObject to function constructors.
+        <https://webkit.org/b/122082>
+
+        Reviewed by Darin Adler.
+
+        Functions don't need anything from the global object during their
+        construction and only use it to get to the VM. Reduce loads by
+        simply passing the VM around instead.
+
+        This patch is mostly mechanical, I just changed the signature of
+        InternalFunction and worked my way from there until it built.
+
+        JSC release binary size -= 4840 bytes.
+
+2013-09-29  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of JSGlobalObject to ArrayPrototype constructor.
+        <https://webkit.org/b/122079>
+
+        Reviewed by Geoffrey Garen.
+
+        ArrayPrototype doesn't need the global object for anything during
+        construction, so reduce the amount of loads by just passing the VM.
+
+2013-09-29  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to simple builtin constructors.
+        <https://webkit.org/b/122077>
+
+        Reviewed by Sam Weinig.
+
+        None of the simple builtins need the ExecState for anything during
+        their construction, so reduce the amount of loads by just passing
+        the VM around instead.
+
+2013-09-29  Nadav Rotem  <nrotem@apple.com>
+
+        Refactor code for finding x86 scratch register.
+        https://bugs.webkit.org/show_bug.cgi?id=122072
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::getUnusedRegister):
+        (JSC::MacroAssemblerX86Common::store8):
+        (JSC::MacroAssemblerX86Common::store16):
+
+2013-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Take Xcode's advice and enable some extra warnings.
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-09-28  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to JSFunction constructors.
+        <https://webkit.org/b/122014>
+
+        Reviewed by Geoffrey Garen.
+
+        JSFunction doesn't need the ExecState for anything during its
+        construction, so reduce the amount of loads by just passing the
+        VM around instead.
+
+        Factored out putDirectNonIndexAccessor() from the existing
+        putDirectAccessor() to avoid snowballing the patch (and because
+        it's kinda neat to avoid the extra branch.)
+
+        JSC release binary size -= 9680 bytes.
+
+2013-09-28  Mark Rowe  <mrowe@apple.com>
+
+        JavaScriptCore fails to build with newer versions of clang.
+
+        Reviewed by Sam Weinig.
+
+        * interpreter/Interpreter.cpp: Remove an unused function.
+        * parser/SourceProvider.cpp: Ditto.
+        * runtime/GCActivityCallback.cpp: #if a constant that's only used on non-CF platforms.
+        * runtime/JSCJSValue.cpp: Remove an unused constant.
+        * runtime/JSString.cpp: Ditto.
+
+2013-09-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of SetMyScope/SetCallee; use normal variables for the scope and callee of inlined call frames of closures
+        https://bugs.webkit.org/show_bug.cgi?id=122047
+
+        Reviewed by Oliver Hunt.
+        
+        Currently we have the DFG reserve space for inline call frames at exactly the same stack
+        offsets that you would have gotten if the baseline interpreter/JIT had made the calls.
+        We need to get rid of that. One of the weirder parts of this is that we have special DFG
+        operations for accessing these inlined call frame headers. It's really hard for any
+        analysis of DFG IR to see what the liveness of any of those frame header "variables" is;
+        the liveness behaves like flushed arguments (it's all live until end of the inlinee) but
+        we don't have anything like a Flush node for those special variables.
+        
+        This patch gets rid of the special operations for accessing inline call frame headers.
+        GetMyScope and GetCallee still remain, and are only for accessing the machine call
+        frame's scope/callee entries. The inline call frame's scope/callee now behave like
+        normal variables, and have Flush behavior just like inline arguments.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getDirect):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::setDirect):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::getScope):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getCalleeLoadElimination):
+        (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-09-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Deoptimize 32-bit deoptimization
+        https://bugs.webkit.org/show_bug.cgi?id=122025
+
+        Reviewed by Oliver Hunt.
+        
+        Just simplifying a bunch of code. I don't want the old, super-complicated,
+        deoptimization code to get in the way of changes I'll be making to DFG stack layout.
+
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::inGPR):
+        (JSC::ValueRecovery::isInRegisters):
+        (JSC::ValueRecovery::gpr):
+        (JSC::ValueRecovery::dumpInContext):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2013-09-27  Alex Christensen  <alex.christensen@flexsim.com>
+
+        Fixed Win64 build after r156184.
+        https://bugs.webkit.org/show_bug.cgi?id=121994
+
+        Reviewed by Oliver Hunt.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupTwoStubArgsGPR):
+        (JSC::CCallHelpers::setupTwoStubArgsFPR):
+        Renamed from setupTwoStubArgs.
+        Visual Studio x64 compiler fails to see that this is an overloaded template function.
+        (JSC::CCallHelpers::setupStubArguments):
+        (JSC::CCallHelpers::setupArguments):
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        Use setupTwoStubArgsGPR or setupTwoStubArgsFPR instead of setupTwoStubArgs.
+
+2013-09-27  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        LLInt alignment problem on ARM in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=122012
+
+        Reviewed by Michael Saboff.
+
+        Force GCC to put the LLInt code to .text section.
+
+        * llint/LowLevelInterpreter.cpp:
+
+2013-09-06  Jer Noble  <jer.noble@apple.com>
+
+        [Mac] Implement the media controls in JavaScript.
+        https://bugs.webkit.org/show_bug.cgi?id=120895
+
+        Reviewed by Dean Jackson.
+
+        Define and turn on ENABLE_MEDIA_CONTROLS_SCRIPT.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-09-27  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to JSDateMath functions.
+        <https://webkit.org/b/121997>
+
+        Reviewed by Geoffrey Garen.
+
+        The JSC date math functions only need the VM, so pass that from
+        callers instead of the whole ExecState.
+
+2013-09-26  Andreas Kling  <akling@apple.com>
+
+        GetterSetter construction should take a VM instead of ExecState.
+        <https://webkit.org/b/121993>
+
+        Reviewed by Sam Weinig.
+
+        Pass VM& instead of ExecState* to GetterSetter. Updated surrounding
+        code at touched sites to cache VM in a local for fewer loads.
+
+        JSC release binary size -= 4120 bytes.
+
+2013-09-26  Oliver Hunt  <oliver@apple.com>
+
+        Make GCC happy
+
+        * parser/Parser.h:
+
+2013-09-25  Oliver Hunt  <oliver@apple.com>
+
+        Implement prefixed-destructuring assignment
+        https://bugs.webkit.org/show_bug.cgi?id=121930
+
+        Reviewed by Mark Hahnenberg.
+
+        Relanding with fix after rollout
+
+2013-09-26  Michael Saboff  <msaboff@apple.com>
+
+        VirtualRegister should be a class
+        https://bugs.webkit.org/show_bug.cgi?id=121732
+
+        Reviewed by Geoffrey Garen.
+
+        This is a refactoring change.  Changed VirtualRegister from an enum to a class.
+        Moved Operands::operandIsArgument(), operandToArgument(), argumentToOperand()
+        and the similar functions for locals to VirtualRegister class.
+
+        This is in preparation for changing the offset for the first local register from
+        0 to -1.  This is needed since most native calling conventions have the architected
+        frame pointer (e.g. %rbp for X86) point at the slot that stores the previous frame
+        pointer.  Local values start below that address.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/Instruction.h:
+        * bytecode/LazyOperandValueProfile.h:
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        * bytecode/Operands.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecode/ValueRecovery.h:
+        * bytecode/VirtualRegister.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/RegisterID.h:
+        * debugger/DebuggerCallFrame.cpp:
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * dfg/DFGArgumentPosition.h:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCode.cpp:
+        * dfg/DFGNode.h:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGRegisterBank.h:
+        * dfg/DFGScoreBoard.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGValidate.cpp:
+        * dfg/DFGValueRecoveryOverride.h:
+        * dfg/DFGVariableAccessData.h:
+        * dfg/DFGVariableEvent.h:
+        * dfg/DFGVariableEventStream.cpp:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * ftl/FTLExitArgumentForOperand.h:
+        * ftl/FTLLink.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        * ftl/FTLOSREntry.cpp:
+        * ftl/FTLOSRExit.cpp:
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        * jit/AssemblyHelpers.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITInlines.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubs.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * profiler/ProfilerBytecodeSequence.cpp:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/JSActivation.cpp:
+
+2013-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Work around another MSVC bug.
+
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::emptyObjectStructureForPrototype):
+
+2013-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Attempt to fix the FTL build.
+
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::IndexedAbstractHeap::atSlow):
+
+2013-09-26  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to many finishCreation() functions.
+        <https://webkit.org/b/121975>
+
+        Reviewed by Sam Weinig.
+
+        Reduce unnecessary loads by passing the VM to object creation
+        functions that don't need the ExecState.
+
+        There are tons of opportunities in this area, I'm just scratching
+        the surface.
+
+2013-09-26  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r156464 and r156480.
+        http://trac.webkit.org/changeset/156464
+        http://trac.webkit.org/changeset/156480
+        https://bugs.webkit.org/show_bug.cgi?id=121981
+
+        Leaking too much and killing buildbot. (Requested by xenon on
+        #webkit).
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::paramString):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitBytecode):
+        (JSC::FuncExprNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::addVar):
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        (JSC::ParameterNode::ParameterNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::create):
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FunctionParameters::~FunctionParameters):
+        * parser/Nodes.h:
+        (JSC::CommaNode::append):
+        (JSC::ParameterNode::ident):
+        (JSC::FunctionParameters::at):
+        (JSC::FunctionParameters::identifiers):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseFormalParameters):
+        (JSC::::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/JSONObject.cpp:
+        * runtime/JSONObject.h:
+
+2013-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+
+2013-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Change a couple of HashMap value types from OwnPtr to std::unique_ptr
+        https://bugs.webkit.org/show_bug.cgi?id=121973
+
+        Reviewed by Andreas Kling.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * API/JSClassRef.h:
+        * bytecode/SamplingTool.h:
+        * ftl/FTLAbstractHeap.h:
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+        * parser/SourceProviderCache.cpp:
+        (JSC::SourceProviderCache::add):
+        * parser/SourceProviderCache.h:
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::create):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::executionCounterFor):
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerCompilation.h:
+        * runtime/JSGlobalObject.h:
+
+2013-09-26  Mark Lam  <mark.lam@apple.com>
+
+        Move DFG inline caching logic into jit/.
+        https://bugs.webkit.org/show_bug.cgi?id=121749.
+
+        Reviewed by Geoffrey Garen.
+
+        Relanding http://trac.webkit.org/changeset/156235 after rebasing to latest
+        revision and fixing build breakages on Windows.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator):
+        (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * dfg/DFGOperations.h:
+        (JSC::DFG::operationNewTypedArrayWithSizeForType):
+        (JSC::DFG::operationNewTypedArrayWithOneArgumentForType):
+        * dfg/DFGRegisterSet.h: Removed.
+        * dfg/DFGRepatch.cpp: Removed.
+        * dfg/DFGRepatch.h: Removed.
+        * dfg/DFGScratchRegisterAllocator.h: Removed.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGThunks.h:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        * ftl/FTLOSRExitCompiler.h:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::writeBarrier):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkFor):
+        (JSC::JIT::linkSlowCall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITOperationWrappers.h: Copied from Source/JavaScriptCore/jit/JITOperationWrappers.h.
+        * jit/JITOperations.cpp: Copied from Source/JavaScriptCore/jit/JITOperations.cpp.
+        (JSC::getHostCallReturnValueWithExecState):
+        * jit/JITOperations.h: Copied from Source/JavaScriptCore/jit/JITOperations.h.
+        * jit/RegisterSet.h: Copied from Source/JavaScriptCore/jit/RegisterSet.h.
+        * jit/Repatch.cpp: Copied from Source/JavaScriptCore/jit/Repatch.cpp.
+        (JSC::tryBuildGetByIDList):
+        * jit/Repatch.h: Copied from Source/JavaScriptCore/jit/Repatch.h.
+        * jit/ScratchRegisterAllocator.h: Copied from Source/JavaScriptCore/jit/ScratchRegisterAllocator.h.
+        * jit/ThunkGenerators.cpp:
+        (JSC::oldStyleGenerateSlowCaseFor):
+        (JSC::oldStyleLinkForGenerator):
+        (JSC::oldStyleLinkCallGenerator):
+        (JSC::oldStyleLinkConstructGenerator):
+        (JSC::oldStyleLinkClosureCallGenerator):
+        (JSC::oldStyleVirtualForGenerator):
+        (JSC::oldStyleVirtualCallGenerator):
+        (JSC::oldStyleVirtualConstructGenerator):
+        (JSC::emitPointerValidation):
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::slowPathFor):
+        (JSC::linkForThunkGenerator):
+        (JSC::linkCallThunkGenerator):
+        (JSC::linkConstructThunkGenerator):
+        (JSC::linkClosureCallThunkGenerator):
+        (JSC::virtualForThunkGenerator):
+        (JSC::virtualCallThunkGenerator):
+        (JSC::virtualConstructThunkGenerator):
+        * jit/ThunkGenerators.h:
+
+2013-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Remove PassWeak.h
+        https://bugs.webkit.org/show_bug.cgi?id=121971
+
+        Reviewed by Geoffrey Garen.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/PassWeak.h: Removed.
+        * heap/WeakInlines.h:
+
+2013-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Stop using PassWeak
+        https://bugs.webkit.org/show_bug.cgi?id=121968
+
+        Reviewed by Sam Weinig.
+
+        * heap/Weak.h:
+        Remove all knowledge of PassWeak.
+
+        (JSC::Weak::Weak):
+        These constructors don't need to be explicit.
+
+        * heap/WeakInlines.h:
+        (JSC::weakAdd):
+        Change Value to be an rvalue reference and use std::forward.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        Remove PassWeak.
+
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        Use Weak instead of PassWeak.
+
+        * runtime/SimpleTypedArrayController.cpp:
+        Change add and set to take Weak by value and std::move into place.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::get):
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::add):
+
+2013-09-26  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r156474.
+        http://trac.webkit.org/changeset/156474
+        https://bugs.webkit.org/show_bug.cgi?id=121966
+
+        Broke the builds. (Requested by xenon on #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::createActivation):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/CodeBlock.h:
+        (JSC::unmodifiedArgumentsRegister):
+        (JSC::CodeBlock::isKnownNotImmediate):
+        (JSC::CodeBlock::setThisRegister):
+        (JSC::CodeBlock::thisRegister):
+        (JSC::CodeBlock::setArgumentsRegister):
+        (JSC::CodeBlock::argumentsRegister):
+        (JSC::CodeBlock::uncheckedArgumentsRegister):
+        (JSC::CodeBlock::setActivationRegister):
+        (JSC::CodeBlock::activationRegister):
+        (JSC::CodeBlock::uncheckedActivationRegister):
+        (JSC::CodeBlock::usesArguments):
+        (JSC::CodeBlock::isCaptured):
+        * bytecode/Instruction.h:
+        * bytecode/LazyOperandValueProfile.h:
+        (JSC::LazyOperandValueProfileKey::LazyOperandValueProfileKey):
+        (JSC::LazyOperandValueProfileKey::operator!):
+        (JSC::LazyOperandValueProfileKey::hash):
+        (JSC::LazyOperandValueProfileKey::operand):
+        (JSC::LazyOperandValueProfileKey::isHashTableDeletedValue):
+        (JSC::LazyOperandValueProfile::LazyOperandValueProfile):
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        (JSC::MethodOfGettingAValueProfile::fromLazyOperand):
+        (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
+        * bytecode/Operands.h:
+        (JSC::localToOperand):
+        (JSC::operandIsLocal):
+        (JSC::operandToLocal):
+        (JSC::operandIsArgument):
+        (JSC::operandToArgument):
+        (JSC::argumentToOperand):
+        (JSC::Operands::operand):
+        (JSC::Operands::hasOperand):
+        (JSC::Operands::setOperand):
+        (JSC::Operands::operandForIndex):
+        (JSC::Operands::setOperandFirstTime):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::setThisRegister):
+        (JSC::UnlinkedCodeBlock::setActivationRegister):
+        (JSC::UnlinkedCodeBlock::setArgumentsRegister):
+        (JSC::UnlinkedCodeBlock::usesArguments):
+        (JSC::UnlinkedCodeBlock::argumentsRegister):
+        (JSC::UnlinkedCodeBlock::usesGlobalObject):
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister):
+        (JSC::UnlinkedCodeBlock::globalObjectRegister):
+        (JSC::UnlinkedCodeBlock::thisRegister):
+        (JSC::UnlinkedCodeBlock::activationRegister):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::displacedInJSStack):
+        (JSC::ValueRecovery::virtualRegister):
+        (JSC::ValueRecovery::dumpInContext):
+        * bytecode/VirtualRegister.h:
+        (WTF::printInternal):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::newRegister):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC::BytecodeGenerator::emitGetArgumentsLength):
+        (JSC::BytecodeGenerator::emitGetArgumentByVal):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitReturn):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::registerFor):
+        * bytecompiler/RegisterID.h:
+        (JSC::RegisterID::RegisterID):
+        (JSC::RegisterID::setIndex):
+        (JSC::RegisterID::index):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisObject):
+        * dfg/DFGAbstractHeap.h:
+        (JSC::DFG::AbstractHeap::Payload::Payload):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        (JSC::DFG::::clobberCapturedVars):
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::ArgumentPosition::dump):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::newVariableAccessData):
+        (JSC::DFG::ByteCodeParser::getDirect):
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::setDirect):
+        (JSC::DFG::ByteCodeParser::set):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::findArgumentPosition):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::getToInt32):
+        (JSC::DFG::ByteCodeParser::getThis):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+        (JSC::DFG::ByteCodeParser::emitArgumentPhantoms):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocal):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocal):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeSetArgument):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        (JSC::DFG::FlushLivenessAnalysisPhase::setForNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::argumentsRegisterFor):
+        (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
+        (JSC::DFG::Graph::uncheckedActivationRegisterFor):
+        (JSC::DFG::Graph::valueProfileFor):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::convertToGetLocalUnlinked):
+        (JSC::DFG::Node::hasVirtualRegister):
+        (JSC::DFG::Node::virtualRegister):
+        (JSC::DFG::Node::setVirtualRegister):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGRegisterBank.h:
+        (JSC::DFG::RegisterBank::tryAllocate):
+        (JSC::DFG::RegisterBank::allocateSpecific):
+        (JSC::DFG::RegisterBank::retain):
+        (JSC::DFG::RegisterBank::isInUse):
+        (JSC::DFG::RegisterBank::dump):
+        (JSC::DFG::RegisterBank::releaseAtIndex):
+        (JSC::DFG::RegisterBank::allocateInternal):
+        (JSC::DFG::RegisterBank::MapEntry::MapEntry):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::allocate):
+        (JSC::DFG::ScoreBoard::use):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::checkConsistency):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::allocate):
+        (JSC::DFG::SpeculativeJIT::fprAllocate):
+        (JSC::DFG::SpeculativeJIT::silentSpillAllRegistersImpl):
+        (JSC::DFG::SpeculativeJIT::flushRegisters):
+        (JSC::DFG::SpeculativeJIT::isFlushed):
+        (JSC::DFG::SpeculativeJIT::argumentSlot):
+        (JSC::DFG::SpeculativeJIT::argumentTagSlot):
+        (JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
+        (JSC::DFG::SpeculativeJIT::valueSourceForOperand):
+        (JSC::DFG::SpeculativeJIT::setNodeForOperand):
+        (JSC::DFG::SpeculativeJIT::valueSourceReferenceForOperand):
+        (JSC::DFG::SpeculativeJIT::recordSetLocal):
+        (JSC::DFG::SpeculativeJIT::generationInfoFromVirtualRegister):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::validateCPS):
+        (JSC::DFG::Validate::checkOperand):
+        (JSC::DFG::Validate::reportValidationContext):
+        * dfg/DFGValueRecoveryOverride.h:
+        (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::operand):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
+        (JSC::DFG::VariableAccessData::flushFormat):
+        * dfg/DFGVariableEvent.h:
+        (JSC::DFG::VariableEvent::spill):
+        (JSC::DFG::VariableEvent::setLocal):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * ftl/FTLExitArgumentForOperand.h:
+        (JSC::FTL::ExitArgumentForOperand::ExitArgumentForOperand):
+        (JSC::FTL::ExitArgumentForOperand::operand):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArgument):
+        (JSC::FTL::LowerDFGToLLVM::compileExtractOSREntryLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::observeMovHint):
+        (JSC::FTL::LowerDFGToLLVM::addressFor):
+        (JSC::FTL::LowerDFGToLLVM::payloadFor):
+        (JSC::FTL::LowerDFGToLLVM::tagFor):
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::convertToForward):
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::unwindCallFrame):
+        (JSC::Interpreter::unwind):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::addressFor):
+        (JSC::AssemblyHelpers::tagFor):
+        (JSC::AssemblyHelpers::payloadFor):
+        (JSC::AssemblyHelpers::argumentsRegisterFor):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_enter):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+
+2013-09-26  Oliver Hunt  <oliver@apple.com>
+
+        Attempt to fix MSVC build
+
+        * parser/Parser.cpp:
+        (JSC::::createBindingPattern):
+        (JSC::::parseDeconstructionPattern):
+        * parser/Parser.h:
+
+2013-09-26  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] JSValue* exception is unused since r70703 in JITStackFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=121962
+
+        This is a cosmetic change, but it could avoid people reading sh4 part to
+        waste time to understand why there is a JSValue* here.
+
+        Reviewed by Darin Adler.
+
+        * jit/JITStubs.h:
+
+2013-09-26  Anders Carlsson  <andersca@apple.com>
+
+        WeakGCMap should not inherit from HashMap
+        https://bugs.webkit.org/show_bug.cgi?id=121964
+
+        Reviewed by Geoffrey Garen.
+
+        Add the HashMap as a member variable instead and implement the missing member functions.
+
+        * runtime/WeakGCMap.h:
+
+2013-09-25  Michael Saboff  <msaboff@apple.com>
+
+        VirtualRegister should be a class
+        https://bugs.webkit.org/show_bug.cgi?id=121732
+
+        Reviewed by Geoffrey Garen.
+
+        This is a refactoring change.  Changed VirtualRegister from an enum to a class.
+        Moved Operands::operandIsArgument(), operandToArgument(), argumentToOperand()
+        and the similar functions for locals to VirtualRegister class.
+
+        This is in preparation for changing the offset for the first local register from
+        0 to -1.  This is needed since most native calling conventions have the architected
+        frame pointer (e.g. %rbp for X86) point at the slot that stores the previous frame
+        pointer.  Local values start below that address.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/Instruction.h:
+        * bytecode/LazyOperandValueProfile.h:
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        * bytecode/Operands.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecode/ValueRecovery.h:
+        * bytecode/VirtualRegister.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/RegisterID.h:
+        * debugger/DebuggerCallFrame.cpp:
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * dfg/DFGArgumentPosition.h:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCode.cpp:
+        * dfg/DFGNode.h:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGRegisterBank.h:
+        * dfg/DFGScoreBoard.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGValidate.cpp:
+        * dfg/DFGValueRecoveryOverride.h:
+        * dfg/DFGVariableAccessData.h:
+        * dfg/DFGVariableEvent.h:
+        * dfg/DFGVariableEventStream.cpp:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * ftl/FTLExitArgumentForOperand.h:
+        * ftl/FTLLink.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        * ftl/FTLOSREntry.cpp:
+        * ftl/FTLOSRExit.cpp:
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        * jit/AssemblyHelpers.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        * jit/JITInlines.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITStubs.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * profiler/ProfilerBytecodeSequence.cpp:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/JSActivation.cpp:
+
+2013-09-26  Anders Carlsson  <andersca@apple.com>
+
+        Weak should have a move constructor and move assignment operator
+        https://bugs.webkit.org/show_bug.cgi?id=121963
+
+        Reviewed by Oliver Hunt.
+
+        This is the first step towards getting rid of PassWeak.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * heap/Weak.h:
+        * heap/WeakInlines.h:
+        (JSC::::Weak):
+        (JSC::::leakImpl):
+        * runtime/SimpleTypedArrayController.cpp:
+        (JSC::SimpleTypedArrayController::toJS):
+
+2013-09-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        op_to_this shouldn't use value profiling
+        https://bugs.webkit.org/show_bug.cgi?id=121920
+
+        Reviewed by Geoffrey Garen.
+
+        Currently it's the only opcode that uses m_singletonValue, which is unnecessary. Our current plan is 
+        to remove m_singletonValue so that GenGC can have a simpler story for handling CodeBlocks/FunctionExecutables 
+        during nursery collections.
+
+        This patch adds an inline cache for the Structure of to_this so it no longer depends on the ValueProfile's
+        m_singletonValue. Since nobody uses m_singletonValue now, this patch also removes m_singletonValue from
+        ValueProfile.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        (JSC::CodeBlock::updateAllValueProfilePredictions):
+        (JSC::CodeBlock::updateAllPredictions):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::updateAllValueProfilePredictions):
+        (JSC::CodeBlock::updateAllPredictions):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
+        * bytecode/LazyOperandValueProfile.h:
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::ValueProfileBase):
+        (JSC::ValueProfileBase::briefDescription):
+        (JSC::ValueProfileBase::dump):
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_to_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+
+2013-09-25  Oliver Hunt  <oliver@apple.com>
+
+        Implement prefixed-destructuring assignment
+        https://bugs.webkit.org/show_bug.cgi?id=121930
+
+        Reviewed by Mark Hahnenberg.
+
+        This is mostly simple - the semantics of deconstruction are already
+        present in the language, so most of the complexity (if you call it
+        that) is addition of new AST nodes, and parsing the syntax.
+
+        In order to get correct semantics for the parameter lists, FunctionParameters
+        now needs to store refcounted references to the parameter patterns.
+        There's also a little work to ensure that variable creation and assignment
+        occurs in the correct order while the BytecodeGenerator is being constructed. 
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::paramString):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitBytecode):
+        (JSC::DeconstructingAssignmentNode::emitBytecode):
+        (JSC::DeconstructionPatternNode::~DeconstructionPatternNode):
+        (JSC::ArrayPatternNode::emitBytecode):
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        (JSC::ArrayPatternNode::toString):
+        (JSC::ArrayPatternNode::collectBoundIdentifiers):
+        (JSC::ObjectPatternNode::toString):
+        (JSC::ObjectPatternNode::emitBytecode):
+        (JSC::ObjectPatternNode::collectBoundIdentifiers):
+        (JSC::BindingNode::emitBytecode):
+        (JSC::BindingNode::toString):
+        (JSC::BindingNode::collectBoundIdentifiers):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::addVar):
+        (JSC::ASTBuilder::createDeconstructingAssignment):
+        (JSC::ASTBuilder::createArrayPattern):
+        (JSC::ASTBuilder::appendArrayPatternSkipEntry):
+        (JSC::ASTBuilder::appendArrayPatternEntry):
+        (JSC::ASTBuilder::createObjectPattern):
+        (JSC::ASTBuilder::appendObjectPatternEntry):
+        (JSC::ASTBuilder::createBindingLocation):
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        (JSC::ParameterNode::ParameterNode):
+        (JSC::ForInNode::ForInNode):
+        (JSC::DeconstructionPatternNode::DeconstructionPatternNode):
+        (JSC::ArrayPatternNode::ArrayPatternNode):
+        (JSC::ArrayPatternNode::create):
+        (JSC::ObjectPatternNode::ObjectPatternNode):
+        (JSC::ObjectPatternNode::create):
+        (JSC::BindingNode::create):
+        (JSC::BindingNode::BindingNode):
+        (JSC::DeconstructingAssignmentNode::DeconstructingAssignmentNode):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::create):
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FunctionParameters::~FunctionParameters):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isDeconstructionNode):
+        (JSC::ArrayNode::elements):
+        (JSC::CommaNode::append):
+        (JSC::ParameterNode::pattern):
+        (JSC::FunctionParameters::at):
+        (JSC::FunctionParameters::patterns):
+        (JSC::DeconstructionPatternNode::isBindingNode):
+        (JSC::DeconstructionPatternNode::emitDirectBinding):
+        (JSC::ArrayPatternNode::appendIndex):
+        (JSC::ObjectPatternNode::appendEntry):
+        (JSC::ObjectPatternNode::Entry::Entry):
+        (JSC::BindingNode::boundProperty):
+        (JSC::BindingNode::isBindingNode):
+        (JSC::DeconstructingAssignmentNode::bindings):
+        (JSC::DeconstructingAssignmentNode::isLocation):
+        (JSC::DeconstructingAssignmentNode::isDeconstructionNode):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::createBindingPattern):
+        (JSC::::parseDeconstructionPattern):
+        (JSC::::parseForStatement):
+        (JSC::::parseFormalParameters):
+        (JSC::::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::Scope::declareBoundParameter):
+        (JSC::Parser::declareBoundParameter):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::addVar):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/JSONObject.cpp:
+        (JSC::escapeStringToBuilder):
+        * runtime/JSONObject.h:
+
+2013-09-25  Brady Eidson  <beidson@apple.com>
+
+        Enable the IndexedDB build on Mac, but leave the feature non-functional
+        https://bugs.webkit.org/show_bug.cgi?id=121918
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-09-25  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r156432.
+        http://trac.webkit.org/changeset/156432
+        https://bugs.webkit.org/show_bug.cgi?id=121932
+
+        some integer conversion things that need brady to fix
+        (Requested by thorton on #webkit).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-09-25  Anders Carlsson  <andersca@apple.com>
+
+        Move KeyValuePairTraits inside HashMap
+        https://bugs.webkit.org/show_bug.cgi?id=121931
+
+        Reviewed by Sam Weinig.
+
+        * tools/ProfileTreeNode.h:
+
+2013-09-25  Brady Eidson  <beidson@apple.com>
+
+        Enable the IndexedDB build on Mac, but leave the feature non-functional
+        https://bugs.webkit.org/show_bug.cgi?id=121918
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-09-25  Brady Eidson  <beidson@apple.com>
+
+        FeatureDefine.xcconfig cleanup (They should all be identical).
+        https://bugs.webkit.org/show_bug.cgi?id=121921
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-09-25  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for WinCE after r155098.
+
+        Windows CE does not support getenv().
+
+        * jsc.cpp:
+        (main):
+
+2013-09-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        op_get_callee shouldn't use value profiling
+        https://bugs.webkit.org/show_bug.cgi?id=121821
+
+        Reviewed by Filip Pizlo.
+
+        Currently it's one of the two opcodes that uses m_singletonValue, which is unnecessary. 
+        Our current plan is to remove m_singletonValue so that GenGC can have a simpler story 
+        for handling CodeBlocks/FunctionExecutables during nursery collections.
+
+        Instead of using a ValueProfile op_get_callee now has a simple inline cache of the most 
+        recent JSFunction that we saw.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCreateThis):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emitSlow_op_get_callee):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emitSlow_op_get_callee):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+
+2013-09-24  Mark Lam  <mark.lam@apple.com>
+
+        Change JSC debug hooks to pass a CallFrame* instead of a DebuggerCallFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=121867.
+
+        Reviewed by Geoffrey Garen.
+
+        1. Removed the need for passing the line and column info to the debug hook
+           callbacks. We now get the line and column info from the CallFrame.
+
+        2. Simplify BytecodeGenerator::emitDebugHook() to only take 1 line number
+           argument. The caller can determine whether to pass in the first or last
+           line number of the block of source code as appropriate.
+           Note: we still need to pass in the line and column info to emitDebugHook()
+           because it uses this info to emit expression info which is later used by
+           the StackVisitor to determine the line and column info for its "pc".
+
+        3. Pass the exceptionValue explicitly to the exception() debug hook
+           callback. It should not be embedded in the CallFrame / DebuggerCallFrame.
+
+        4. Change the op_debug opcode size to 2 (from 5) since we've removing 3 arg
+           values. Update the LLINT and JIT code to handle this.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::LineAndColumnFunctor::operator()):
+        (JSC::LineAndColumnFunctor::line):
+        (JSC::LineAndColumnFunctor::column):
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::clear):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::line):
+        (JSC::DebuggerCallFrame::column):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::UnwindFunctor::UnwindFunctor):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::unwind):
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+
+2013-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Crashing under JSC::DFG::SpeculativeJIT::spill visiting citicards.com
+        https://bugs.webkit.org/show_bug.cgi?id=121844
+
+        Reviewed by Mark Hahnenberg.
+        
+        Fix some int52 bugs that caused this.
+
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::dumpInContext): There's no such thing as int53.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::spill): Actually spill int52's, instead of hitting an assert and crashing.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal): Use the right format (from before when we clobber it).
+
+2013-09-24  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/14971518> WebKit should build against the Xcode default toolchain when targeting OS X 10.8
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2013-09-23  Patrick Gansterer  <paroga@webkit.org>
+
+        use NOMINMAX instead of #define min min
+        https://bugs.webkit.org/show_bug.cgi?id=73563
+
+        Reviewed by Brent Fulgham.
+
+        Use NOMINMAX instead of #define min/max as a cleaner
+        way of ensuring that Windows system header files don't
+        define min/max as macro in the first place.
+
+        * config.h:
+
+2013-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Never use ReturnPC for exception handling and quit using exception check indices as a lame replica of the CodeOrigin index
+        https://bugs.webkit.org/show_bug.cgi?id=121734
+
+        Reviewed by Mark Hahnenberg.
+        
+        Exception handling can deduce where the exception was thrown from by looking at the
+        code origin that was stored into the call frame header. There is no need to pass any
+        additional meta-data into the exception throwing logic. But the DFG was still doing it
+        anyway.
+        
+        This removes all of the logic to pass extra meta-data into lookupExceptionHandler()
+        and friends. It simplifies a lot of code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::codeOrigins):
+        (JSC::CodeBlock::hasCodeOrigins):
+        (JSC::CodeBlock::canGetCodeOrigin):
+        (JSC::CodeBlock::codeOrigin):
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::InlineCallFrame):
+        * bytecode/InlineCallFrameSet.cpp: Added.
+        (JSC::InlineCallFrameSet::InlineCallFrameSet):
+        (JSC::InlineCallFrameSet::~InlineCallFrameSet):
+        (JSC::InlineCallFrameSet::add):
+        (JSC::InlineCallFrameSet::shrinkToFit):
+        * bytecode/InlineCallFrameSet.h: Added.
+        (JSC::InlineCallFrameSet::isEmpty):
+        (JSC::InlineCallFrameSet::size):
+        (JSC::InlineCallFrameSet::at):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::addCodeOrigin):
+        (JSC::DFG::CommonData::shrinkToFit):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGDesiredWriteBarriers.cpp:
+        (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
+        (JSC::DFG::DesiredWriteBarrier::trigger):
+        * dfg/DFGDesiredWriteBarriers.h:
+        (JSC::DFG::DesiredWriteBarriers::add):
+        (JSC::DFG::initializeLazyWriteBarrierForInlineCallFrameExecutable):
+        (JSC::DFG::initializeLazyWriteBarrierForInlineCallFrameCallee):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::emitStoreCodeOrigin):
+        (JSC::DFG::JITCompiler::exceptionCheck):
+        (JSC::DFG::JITCompiler::fastExceptionCheck):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCall):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::callPreflight):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitExceptionCheck):
+
+2013-09-23  Oliver Hunt  <oliver@apple.com>
+
+        CodeLoad performance regression
+
+        Reviewed by Filip Pizlo.
+
+        Temporarily remove the ExpressionInfo compression until we can
+        work out how to make it not clobber performance.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::addExpressionInfo):
+        * bytecode/UnlinkedCodeBlock.h:
+
+2013-09-23  Patrick Gansterer  <paroga@webkit.org>
+
+        Cleanup CMake files in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=121762
+
+        Reviewed by Gyuyoung Kim.
+
+        Sort files and unify style.
+
+        * CMakeLists.txt:
+        * shell/CMakeLists.txt:
+        * shell/PlatformBlackBerry.cmake:
+        * shell/PlatformEfl.cmake:
+
+2013-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of CodeBlock::RareData::callReturnIndexVector and most of the evil that it introduced
+        https://bugs.webkit.org/show_bug.cgi?id=121766
+
+        Reviewed by Andreas Kling.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        (JSC::DFG::JITCompiler::link):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2013-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Interpreter::unwind() has no need for the bytecodeOffset
+        https://bugs.webkit.org/show_bug.cgi?id=121755
+
+        Reviewed by Oliver Hunt.
+        
+        It was only using the bytecodeOffset for some debugger stuff, but the debugger could
+        just get the bytecodeOffset the same way the rest of the machinery does: by using the
+        CallFrame's location.
+        
+        It turns out that a lot of really ugly code was in place just to supply this
+        bytecodeOffset. This patch kills most of that code, and allows us to kill even more
+        code in a future patch - though most likely that killage will involve further
+        refactorings as well, see https://bugs.webkit.org/show_bug.cgi?id=121734.
+
+        * dfg/DFGOperations.cpp:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::bytecodeOffset):
+        (JSC::CallFrame::codeOrigin):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwind):
+        * interpreter/Interpreter.h:
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITExceptions.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::cti_vm_handle_exception):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::doThrow):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntExceptions.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPathsExceptions.cpp:
+        (JSC::CommonSlowPaths::interpreterThrowInCaller):
+        * runtime/CommonSlowPathsExceptions.h:
+
+2013-09-21  Darin Adler  <darin@apple.com>
+
+        Add ExecState::uncheckedArgument and use where possible to shrink a bit
+        https://bugs.webkit.org/show_bug.cgi?id=121750
+
+        Reviewed by Andreas Kling.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::uncheckedArgument): Added. Like argument, but with an
+        assertion rather than a runtime check.
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call): Use uncheckedArgument because we are
+        already in a loop over arguments, so don't need a range check.
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback): Ditto.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::construct): Ditto.
+        (JSC::JSCallbackObject::call): Ditto.
+        * jsc.cpp:
+        (functionPrint): Ditto.
+        (functionRun): Ditto.
+        (functionSetSamplingFlags): Ditto.
+        (functionClearSamplingFlags): Ditto.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat): Ditto.
+        (JSC::arrayProtoFuncPush): Use uncheckedArgument because there is already
+        code that explicitly checks argumentCount.
+        (JSC::arrayProtoFuncSplice): Ditto.
+        (JSC::arrayProtoFuncUnShift): Ditto.
+        (JSC::arrayProtoFuncReduce): Ditto.
+        (JSC::arrayProtoFuncReduceRight): Ditto.
+        (JSC::arrayProtoFuncLastIndexOf): Ditto.
+        * runtime/DatePrototype.cpp:
+        (JSC::fillStructuresUsingTimeArgs): Ditto.
+        (JSC::fillStructuresUsingDateArgs): Ditto.
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer): Ditto.
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice): Ditto.
+        * runtime/JSBoundFunction.cpp:
+        (JSC::boundFunctionCall): Ditto.
+        (JSC::boundFunctionConstruct): Ditto.
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData): Ditto.
+        (JSC::setData): Ditto.
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayView): Ditto.
+        * runtime/JSGenericTypedArrayViewPrototypeInlines.h:
+        (JSC::genericTypedArrayViewProtoFuncSet): Ditto.
+        (JSC::genericTypedArrayViewProtoFuncSubarray): Ditto.
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse): Ditto.
+        (JSC::JSONProtoFuncStringify): Ditto.
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise): Ditto.
+        (JSC::JSPromiseConstructorFuncFulfill): Ditto.
+        (JSC::JSPromiseConstructorFuncResolve): Ditto.
+        (JSC::JSPromiseConstructorFuncReject): Ditto.
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncMax): Ditto.
+        (JSC::mathProtoFuncMin): Ditto.
+
+        * runtime/NameConstructor.cpp:
+        (JSC::constructPrivateName): Removed unneeded check of argumentCout
+        that simply repeats what argument already does.
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor): Ditto.
+        (JSC::Interpreter::callNativeErrorConstructor): Ditto.
+
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor): Use uncheckedArgument since
+        there is already code that explicitly checks argument count.
+        (JSC::callNumberConstructor): Ditto.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorCreate): Small refactoring to not call argument(0)
+        three times.
+
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet): Use uncheckedArgument since we are already in a loop
+        over arguments.
+
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase): In a loop.
+        (JSC::stringFromCharCode): Already checked count.
+        (JSC::constructWithStringConstructor): Ditto.
+        (JSC::callStringConstructor): Ditto.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncConcat): Already checked count.
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::numberOfDFGCompiles): Ditto.
+        (JSC::setNeverInline): Ditto.
+
+2013-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove the notion that a CallFrame can have a pointer to an InlineCallFrame, since that doesn't happen anymore
+        https://bugs.webkit.org/show_bug.cgi?id=121753
+
+        Reviewed by Darin Adler.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::bytecodeOffsetFromCodeOriginIndex):
+        * interpreter/CallFrame.h:
+        * interpreter/Register.h:
+
+2013-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix the revert.
+
+        * dfg/DFGRepatch.cpp:
+
+2013-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, revert http://trac.webkit.org/changeset/156235. It won't work on Windows.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator):
+        (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * dfg/DFGOperations.h:
+        (JSC::DFG::operationNewTypedArrayWithSizeForType):
+        (JSC::DFG::operationNewTypedArrayWithOneArgumentForType):
+        * dfg/DFGRegisterSet.h: Added.
+        (JSC::DFG::RegisterSet::RegisterSet):
+        (JSC::DFG::RegisterSet::asPOD):
+        (JSC::DFG::RegisterSet::copyInfo):
+        (JSC::DFG::RegisterSet::set):
+        (JSC::DFG::RegisterSet::setGPRByIndex):
+        (JSC::DFG::RegisterSet::clear):
+        (JSC::DFG::RegisterSet::get):
+        (JSC::DFG::RegisterSet::getGPRByIndex):
+        (JSC::DFG::RegisterSet::getFreeGPR):
+        (JSC::DFG::RegisterSet::setFPRByIndex):
+        (JSC::DFG::RegisterSet::getFPRByIndex):
+        (JSC::DFG::RegisterSet::setByIndex):
+        (JSC::DFG::RegisterSet::getByIndex):
+        (JSC::DFG::RegisterSet::numberOfSetGPRs):
+        (JSC::DFG::RegisterSet::numberOfSetFPRs):
+        (JSC::DFG::RegisterSet::numberOfSetRegisters):
+        (JSC::DFG::RegisterSet::setBit):
+        (JSC::DFG::RegisterSet::clearBit):
+        (JSC::DFG::RegisterSet::getBit):
+        * dfg/DFGRepatch.cpp: Added.
+        (JSC::DFG::repatchCall):
+        (JSC::DFG::repatchByIdSelfAccess):
+        (JSC::DFG::addStructureTransitionCheck):
+        (JSC::DFG::replaceWithJump):
+        (JSC::DFG::emitRestoreScratch):
+        (JSC::DFG::linkRestoreScratch):
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::repatchGetByID):
+        (JSC::DFG::getPolymorphicStructureList):
+        (JSC::DFG::patchJumpToGetByIdStub):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::buildGetByIDList):
+        (JSC::DFG::appropriateGenericPutByIdFunction):
+        (JSC::DFG::appropriateListBuildingPutByIdFunction):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::repatchPutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        (JSC::DFG::buildPutByIdList):
+        (JSC::DFG::tryRepatchIn):
+        (JSC::DFG::repatchIn):
+        (JSC::DFG::linkSlowFor):
+        (JSC::DFG::linkFor):
+        (JSC::DFG::linkClosureCall):
+        (JSC::DFG::resetGetByID):
+        (JSC::DFG::resetPutByID):
+        (JSC::DFG::resetIn):
+        * dfg/DFGRepatch.h: Added.
+        (JSC::DFG::resetGetByID):
+        (JSC::DFG::resetPutByID):
+        (JSC::DFG::resetIn):
+        * dfg/DFGScratchRegisterAllocator.h: Added.
+        (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        (JSC::DFG::ScratchRegisterAllocator::lock):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
+        (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
+        (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::emitPointerValidation):
+        (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
+        (JSC::DFG::slowPathFor):
+        (JSC::DFG::linkForThunkGenerator):
+        (JSC::DFG::linkCallThunkGenerator):
+        (JSC::DFG::linkConstructThunkGenerator):
+        (JSC::DFG::linkClosureCallThunkGenerator):
+        (JSC::DFG::virtualForThunkGenerator):
+        (JSC::DFG::virtualCallThunkGenerator):
+        (JSC::DFG::virtualConstructThunkGenerator):
+        * dfg/DFGThunks.h:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        * ftl/FTLOSRExitCompiler.h:
+        * jit/AssemblyHelpers.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::linkFor):
+        (JSC::JIT::linkSlowCall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITOperationWrappers.h: Removed.
+        * jit/JITOperations.cpp: Removed.
+        * jit/JITOperations.h: Removed.
+        * jit/RegisterSet.h: Removed.
+        * jit/Repatch.cpp: Removed.
+        * jit/Repatch.h: Removed.
+        * jit/ScratchRegisterAllocator.h: Removed.
+        * jit/ThunkGenerators.cpp:
+        (JSC::generateSlowCaseFor):
+        (JSC::linkForGenerator):
+        (JSC::linkCallGenerator):
+        (JSC::linkConstructGenerator):
+        (JSC::linkClosureCallGenerator):
+        (JSC::virtualForGenerator):
+        (JSC::virtualCallGenerator):
+        (JSC::virtualConstructGenerator):
+        * jit/ThunkGenerators.h:
+
+2013-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Move DFG inline caching logic into jit/
+        https://bugs.webkit.org/show_bug.cgi?id=121749
+
+        Rubber stamped by Sam Weinig.
+        
+        We want to get rid of the baseline JIT's inline caching machinery and have it use the
+        DFG's instead. But before we do that we need to move the DFG's inline caching machine
+        out from behind its ENABLE(DFG_JIT) guards and make it available to the whole system.
+        This patch does that:
+        
+        - dfg/DFGRepatch becomes jit/Repatch.
+        
+        - The thunks used by the DFG IC go into jit/ThunkGenerators, instead of dfg/DFGThunks.
+        
+        - The operations used by the DFG IC go into jit/JITOperations, instead of
+          dfg/DFGOperations.
+        
+        - The old JIT's thunk generators for calls are renamed to reduce confusion. Previously
+          it was easy to know which generators belong to which JIT because the old JIT used
+          JSC::virtualCallBlah and the DFG used JSC::DFG::virtualCallBlah, but that's not the
+          case anymore. Note that the old JIT's thunk generators will die in a future patch.
+        
+        No functional changes beyond those moves.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator):
+        (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * dfg/DFGOperations.h:
+        (JSC::DFG::operationNewTypedArrayWithSizeForType):
+        (JSC::DFG::operationNewTypedArrayWithOneArgumentForType):
+        * dfg/DFGRegisterSet.h: Removed.
+        * dfg/DFGRepatch.cpp: Removed.
+        * dfg/DFGRepatch.h: Removed.
+        * dfg/DFGScratchRegisterAllocator.h: Removed.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGThunks.h:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::writeBarrier):
+        * jit/JIT.cpp:
+        (JSC::JIT::linkFor):
+        (JSC::JIT::linkSlowCall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITOperationWrappers.h: Added.
+        * jit/JITOperations.cpp: Added.
+        * jit/JITOperations.h: Added.
+        * jit/RegisterSet.h: Added.
+        (JSC::RegisterSet::RegisterSet):
+        (JSC::RegisterSet::asPOD):
+        (JSC::RegisterSet::copyInfo):
+        (JSC::RegisterSet::set):
+        (JSC::RegisterSet::setGPRByIndex):
+        (JSC::RegisterSet::clear):
+        (JSC::RegisterSet::get):
+        (JSC::RegisterSet::getGPRByIndex):
+        (JSC::RegisterSet::getFreeGPR):
+        (JSC::RegisterSet::setFPRByIndex):
+        (JSC::RegisterSet::getFPRByIndex):
+        (JSC::RegisterSet::setByIndex):
+        (JSC::RegisterSet::getByIndex):
+        (JSC::RegisterSet::numberOfSetGPRs):
+        (JSC::RegisterSet::numberOfSetFPRs):
+        (JSC::RegisterSet::numberOfSetRegisters):
+        (JSC::RegisterSet::setBit):
+        (JSC::RegisterSet::clearBit):
+        (JSC::RegisterSet::getBit):
+        * jit/Repatch.cpp: Added.
+        (JSC::repatchCall):
+        (JSC::repatchByIdSelfAccess):
+        (JSC::addStructureTransitionCheck):
+        (JSC::replaceWithJump):
+        (JSC::emitRestoreScratch):
+        (JSC::linkRestoreScratch):
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::getPolymorphicStructureList):
+        (JSC::patchJumpToGetByIdStub):
+        (JSC::tryBuildGetByIDList):
+        (JSC::buildGetByIDList):
+        (JSC::appropriateGenericPutByIdFunction):
+        (JSC::appropriateListBuildingPutByIdFunction):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        (JSC::tryCachePutByID):
+        (JSC::repatchPutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::buildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::repatchIn):
+        (JSC::linkSlowFor):
+        (JSC::linkFor):
+        (JSC::linkClosureCall):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::resetIn):
+        * jit/Repatch.h: Added.
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::resetIn):
+        * jit/ScratchRegisterAllocator.h: Added.
+        (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        (JSC::ScratchRegisterAllocator::lock):
+        (JSC::ScratchRegisterAllocator::allocateScratch):
+        (JSC::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::ScratchRegisterAllocator::didReuseRegisters):
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        (JSC::ScratchRegisterAllocator::desiredScratchBufferSize):
+        (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+        * jit/ThunkGenerators.cpp:
+        (JSC::oldStyleGenerateSlowCaseFor):
+        (JSC::oldStyleLinkForGenerator):
+        (JSC::oldStyleLinkCallGenerator):
+        (JSC::oldStyleLinkConstructGenerator):
+        (JSC::oldStyleLinkClosureCallGenerator):
+        (JSC::oldStyleVirtualForGenerator):
+        (JSC::oldStyleVirtualCallGenerator):
+        (JSC::oldStyleVirtualConstructGenerator):
+        (JSC::emitPointerValidation):
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::slowPathFor):
+        (JSC::linkForThunkGenerator):
+        (JSC::linkCallThunkGenerator):
+        (JSC::linkConstructThunkGenerator):
+        (JSC::linkClosureCallThunkGenerator):
+        (JSC::virtualForThunkGenerator):
+        (JSC::virtualCallThunkGenerator):
+        (JSC::virtualConstructThunkGenerator):
+        * jit/ThunkGenerators.h:
+
+2013-09-21  Anders Carlsson  <andersca@apple.com>
+
+        Fix the non-DFG build.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::r):
+
+2013-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of IsInlinedCodeTag and its associated methods since it's unused
+        https://bugs.webkit.org/show_bug.cgi?id=121737
+
+        Reviewed by Sam Weinig.
+        
+        This was meant to be easy, but I kept wondering if it was safe to remove the
+        inline call frame check in Arguments::tearOff(). The check was clearly dead
+        since the bit wasn't being set anywhere.
+        
+        It turns out that the unwindCallFrame() function was relying on tearOff()
+        doing the right thing for inlined code, but it wasn't even passing it an
+        inline call frame. I fixed this by having unwindCallFrame() inlining check,
+        while also making sure that the code uses the right operand index for the
+        arguments register.
+
+        * interpreter/CallFrame.h:
+        * interpreter/CallFrameInlines.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::r):
+        * interpreter/StackVisitor.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+
+2013-09-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        (un)shiftCountWithAnyIndexingType will start over in the middle of copying if it sees a hole
+        https://bugs.webkit.org/show_bug.cgi?id=121717
+
+        Reviewed by Oliver Hunt.
+
+        This bug caused the array to become corrupted. We now check for holes before we start moving things, 
+        and start moving things only once we've determined that there are none.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+
+2013-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r156047): WebCore hangs inside JSC::toInt32(double)
+        https://bugs.webkit.org/show_bug.cgi?id=121648
+
+        Reviewed by Mark Hahnenberg.
+        
+        The Int52<->StrictInt52 conversion did the opposite fill() than what it was
+        supposed to. For example when converting a Int52 to a StrictInt52 it would fill
+        as Int52, and vice-versa.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+
+2013-09-20  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION(r153215): New iCloud site crashes
+        https://bugs.webkit.org/show_bug.cgi?id=121710
+
+        Reviewed by Filip Pizlo.
+
+        Don't claim to be able to rely on the arguments structure, use the Arguments
+        speculation type
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+
+2013-09-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Clobberize phase forgets to indicate that it writes GCState for several node types
+        https://bugs.webkit.org/show_bug.cgi?id=121702
+
+        Reviewed by Oliver Hunt.
+
+        Added read and write for GCState to the nodes that could end up allocating (and thereby
+        cause a garbage collection).
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2013-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Move CCallHelpers and AssemblyHelpers into jit/ and have JSInterfaceJIT use them
+        https://bugs.webkit.org/show_bug.cgi?id=121637
+
+        Rubber stamped by Michael Saboff.
+        
+        Also moved GPRInfo/FPRInfo into jit/. Rolling back in after fixing JIT-only build
+        and tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::dumpInContext):
+        * dfg/DFGAssemblyHelpers.cpp: Removed.
+        * dfg/DFGAssemblyHelpers.h: Removed.
+        * dfg/DFGBinarySwitch.h:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCCallHelpers.h: Removed.
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGFPRInfo.h: Removed.
+        * dfg/DFGGPRInfo.h: Removed.
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOSRExitCompilerCommon.h:
+        * dfg/DFGRegisterBank.h:
+        * dfg/DFGRegisterSet.h:
+        * dfg/DFGRepatch.cpp:
+        * dfg/DFGSilentRegisterSavePlan.h:
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGVariableEvent.cpp:
+        * ftl/FTLCArgumentGetter.h:
+        (JSC::FTL::CArgumentGetter::CArgumentGetter):
+        (JSC::FTL::CArgumentGetter::loadNext8):
+        (JSC::FTL::CArgumentGetter::loadNext32):
+        (JSC::FTL::CArgumentGetter::loadNext64):
+        (JSC::FTL::CArgumentGetter::loadNextPtr):
+        (JSC::FTL::CArgumentGetter::loadNextDouble):
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLExitThunkGenerator.h:
+        * ftl/FTLLink.cpp:
+        * ftl/FTLThunks.cpp:
+        * jit/AssemblyHelpers.cpp: Copied from Source/JavaScriptCore/dfg/DFGAssemblyHelpers.cpp.
+        * jit/AssemblyHelpers.h: Copied from Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h.
+        (JSC::AssemblyHelpers::AssemblyHelpers):
+        (JSC::AssemblyHelpers::debugCall):
+        * jit/CCallHelpers.h: Copied from Source/JavaScriptCore/dfg/DFGCCallHelpers.h.
+        * jit/FPRInfo.h: Copied from Source/JavaScriptCore/dfg/DFGFPRInfo.h.
+        (WTF::printInternal):
+        * jit/GPRInfo.h: Copied from Source/JavaScriptCore/dfg/DFGGPRInfo.h.
+        (WTF::printInternal):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::JSInterfaceJIT):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::linkForGenerator):
+        (JSC::virtualForGenerator):
+        (JSC::stringLengthTrampolineGenerator):
+        (JSC::nativeForGenerator):
+        (JSC::arityFixup):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        (JSC::imulThunkGenerator):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::generateThunkWithJumpTo):
+        * runtime/JSCJSValue.h:
+
+2013-09-20  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Inline method exported
+        https://bugs.webkit.org/show_bug.cgi?id=121664
+
+        Reviewed by Darin Adler.
+
+        WatchDog::didFire() is marked as an exported symbol eventhough it is
+        defined inline. This breaks the build on MinGW since it results in dllimport
+        being declared on a definition.
+
+        * runtime/Watchdog.h:
+        (JSC::Watchdog::didFire):
+
+2013-09-20  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Use COMPILE_DEFINITIONS target property for setting BUILDING_* defines
+        https://bugs.webkit.org/show_bug.cgi?id=121672
+
+        Reviewed by Gyuyoung Kim.
+
+        Since the scope of add_definitions() is always a whole file, we need to use
+        target properties instead to set definitions only for specific targets.
+
+        * CMakeLists.txt:
+
+2013-09-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r156120.
+        http://trac.webkit.org/changeset/156120
+        https://bugs.webkit.org/show_bug.cgi?id=121651
+
+        Broke windows runtime and all tests (Requested by bfulgham on
+        #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::dumpInContext):
+        * dfg/DFGAssemblyHelpers.cpp: Renamed from Source/JavaScriptCore/jit/AssemblyHelpers.cpp.
+        (JSC::DFG::AssemblyHelpers::executableFor):
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        (JSC::DFG::AssemblyHelpers::setSamplingFlag):
+        (JSC::DFG::AssemblyHelpers::clearSamplingFlag):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsInt32):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSInt32):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSNumber):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSDouble):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsCell):
+        (JSC::DFG::AssemblyHelpers::jitAssertHasValidCallFrame):
+        * dfg/DFGAssemblyHelpers.h: Renamed from Source/JavaScriptCore/jit/AssemblyHelpers.h.
+        (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
+        (JSC::DFG::AssemblyHelpers::codeBlock):
+        (JSC::DFG::AssemblyHelpers::vm):
+        (JSC::DFG::AssemblyHelpers::assembler):
+        (JSC::DFG::AssemblyHelpers::preserveReturnAddressAfterCall):
+        (JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):
+        (JSC::DFG::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
+        (JSC::DFG::AssemblyHelpers::emitPutToCallFrameHeader):
+        (JSC::DFG::AssemblyHelpers::emitPutImmediateToCallFrameHeader):
+        (JSC::DFG::AssemblyHelpers::branchIfNotCell):
+        (JSC::DFG::AssemblyHelpers::addressFor):
+        (JSC::DFG::AssemblyHelpers::tagFor):
+        (JSC::DFG::AssemblyHelpers::payloadFor):
+        (JSC::DFG::AssemblyHelpers::branchIfNotObject):
+        (JSC::DFG::AssemblyHelpers::selectScratchGPR):
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsInt32):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSInt32):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSNumber):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsJSDouble):
+        (JSC::DFG::AssemblyHelpers::jitAssertIsCell):
+        (JSC::DFG::AssemblyHelpers::jitAssertHasValidCallFrame):
+        (JSC::DFG::AssemblyHelpers::boxDouble):
+        (JSC::DFG::AssemblyHelpers::unboxDouble):
+        (JSC::DFG::AssemblyHelpers::boxInt52):
+        (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
+        (JSC::DFG::AssemblyHelpers::emitCount):
+        (JSC::DFG::AssemblyHelpers::globalObjectFor):
+        (JSC::DFG::AssemblyHelpers::strictModeFor):
+        (JSC::DFG::AssemblyHelpers::baselineCodeBlockFor):
+        (JSC::DFG::AssemblyHelpers::baselineCodeBlock):
+        (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
+        (JSC::DFG::AssemblyHelpers::symbolTableFor):
+        (JSC::DFG::AssemblyHelpers::offsetOfLocals):
+        (JSC::DFG::AssemblyHelpers::offsetOfArgumentsIncludingThis):
+        * dfg/DFGBinarySwitch.h:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCCallHelpers.h: Renamed from Source/JavaScriptCore/jit/CCallHelpers.h.
+        (JSC::DFG::CCallHelpers::CCallHelpers):
+        (JSC::DFG::CCallHelpers::resetCallArguments):
+        (JSC::DFG::CCallHelpers::addCallArgument):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        (JSC::DFG::CCallHelpers::setupArgumentsExecState):
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        (JSC::DFG::CCallHelpers::setupTwoStubArgs):
+        (JSC::DFG::CCallHelpers::setupStubArguments):
+        (JSC::DFG::CCallHelpers::setupResults):
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGFPRInfo.h: Renamed from Source/JavaScriptCore/jit/FPRInfo.h.
+        (JSC::DFG::FPRInfo::toRegister):
+        (JSC::DFG::FPRInfo::toIndex):
+        (JSC::DFG::FPRInfo::toArgumentRegister):
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h: Renamed from Source/JavaScriptCore/jit/GPRInfo.h.
+        (JSC::DFG::JSValueRegs::JSValueRegs):
+        (JSC::DFG::JSValueRegs::payloadOnly):
+        (JSC::DFG::JSValueRegs::operator!):
+        (JSC::DFG::JSValueRegs::gpr):
+        (JSC::DFG::JSValueRegs::payloadGPR):
+        (JSC::DFG::JSValueSource::JSValueSource):
+        (JSC::DFG::JSValueSource::unboxedCell):
+        (JSC::DFG::JSValueSource::operator!):
+        (JSC::DFG::JSValueSource::isAddress):
+        (JSC::DFG::JSValueSource::offset):
+        (JSC::DFG::JSValueSource::base):
+        (JSC::DFG::JSValueSource::gpr):
+        (JSC::DFG::JSValueSource::asAddress):
+        (JSC::DFG::JSValueSource::notAddress):
+        (JSC::DFG::JSValueRegs::tagGPR):
+        (JSC::DFG::JSValueSource::tagGPR):
+        (JSC::DFG::JSValueSource::payloadGPR):
+        (JSC::DFG::JSValueSource::hasKnownTag):
+        (JSC::DFG::JSValueSource::tag):
+        (JSC::DFG::GPRInfo::toRegister):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+        (JSC::DFG::GPRInfo::toArgumentRegister):
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOSRExitCompilerCommon.h:
+        * dfg/DFGRegisterBank.h:
+        * dfg/DFGRegisterSet.h:
+        * dfg/DFGRepatch.cpp:
+        * dfg/DFGSilentRegisterSavePlan.h:
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGVariableEvent.cpp:
+        * ftl/FTLCArgumentGetter.h:
+        (JSC::FTL::CArgumentGetter::CArgumentGetter):
+        (JSC::FTL::CArgumentGetter::loadNext8):
+        (JSC::FTL::CArgumentGetter::loadNext32):
+        (JSC::FTL::CArgumentGetter::loadNext64):
+        (JSC::FTL::CArgumentGetter::loadNextPtr):
+        (JSC::FTL::CArgumentGetter::loadNextDouble):
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLExitThunkGenerator.h:
+        * ftl/FTLLink.cpp:
+        * ftl/FTLThunks.cpp:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::preserveReturnAddressAfterCall):
+        (JSC::JSInterfaceJIT::restoreReturnAddressBeforeReturn):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::linkForGenerator):
+        (JSC::virtualForGenerator):
+        (JSC::stringLengthTrampolineGenerator):
+        (JSC::nativeForGenerator):
+        (JSC::arityFixup):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        (JSC::imulThunkGenerator):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::generateThunkWithJumpTo):
+        * runtime/JSCJSValue.h:
+
+2013-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Windows build part 2. m_jitCodeMap should always be there.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::jitCodeMap):
+
+2013-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove some of the tautologies in DFGRepatch function naming.
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        For example change DFG::dfgLinkFor() to be DFG::linkFor().
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::repatchCall):
+        (JSC::DFG::repatchByIdSelfAccess):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::repatchGetByID):
+        (JSC::DFG::buildGetByIDList):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::repatchPutByID):
+        (JSC::DFG::buildPutByIdList):
+        (JSC::DFG::repatchIn):
+        (JSC::DFG::linkFor):
+        (JSC::DFG::linkSlowFor):
+        (JSC::DFG::linkClosureCall):
+        (JSC::DFG::resetGetByID):
+        (JSC::DFG::resetPutByID):
+        (JSC::DFG::resetIn):
+        * dfg/DFGRepatch.h:
+        (JSC::DFG::resetGetByID):
+        (JSC::DFG::resetPutByID):
+        (JSC::DFG::resetIn):
+
+2013-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Windows build. ScratchBuffer should always be available regardless of
+        ENABLE_DFG_JIT.
+
+        * runtime/VM.h:
+
+2013-09-19  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Add more iOS logic to the JavaScriptCore build configuration files
+        https://bugs.webkit.org/show_bug.cgi?id=121635
+
+        Reviewed by Geoffrey Garen.
+
+        Towards building JavaScriptCore for both OS X and iOS using the same
+        set of configuration files, add more iOS logic.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/JSC.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/ToolExecutable.xcconfig:
+
+2013-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Move CCallHelpers and AssemblyHelpers into jit/ and have JSInterfaceJIT use them
+        https://bugs.webkit.org/show_bug.cgi?id=121637
+
+        Rubber stamped by Michael Saboff.
+        
+        Also moved GPRInfo/FPRInfo into jit/.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::dumpInContext):
+        * dfg/DFGAssemblyHelpers.cpp: Removed.
+        * dfg/DFGAssemblyHelpers.h: Removed.
+        * dfg/DFGBinarySwitch.h:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCCallHelpers.h: Removed.
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGFPRInfo.h: Removed.
+        * dfg/DFGGPRInfo.h: Removed.
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOSRExitCompilerCommon.h:
+        * dfg/DFGRegisterBank.h:
+        * dfg/DFGRegisterSet.h:
+        * dfg/DFGRepatch.cpp:
+        * dfg/DFGSilentRegisterSavePlan.h:
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGVariableEvent.cpp:
+        * ftl/FTLCArgumentGetter.h:
+        (JSC::FTL::CArgumentGetter::CArgumentGetter):
+        (JSC::FTL::CArgumentGetter::loadNext8):
+        (JSC::FTL::CArgumentGetter::loadNext32):
+        (JSC::FTL::CArgumentGetter::loadNext64):
+        (JSC::FTL::CArgumentGetter::loadNextPtr):
+        (JSC::FTL::CArgumentGetter::loadNextDouble):
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLExitThunkGenerator.h:
+        * ftl/FTLLink.cpp:
+        * ftl/FTLThunks.cpp:
+        * jit/AssemblyHelpers.cpp: Copied from Source/JavaScriptCore/dfg/DFGAssemblyHelpers.cpp.
+        * jit/AssemblyHelpers.h: Copied from Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h.
+        (JSC::AssemblyHelpers::AssemblyHelpers):
+        (JSC::AssemblyHelpers::debugCall):
+        * jit/CCallHelpers.h: Copied from Source/JavaScriptCore/dfg/DFGCCallHelpers.h.
+        * jit/FPRInfo.h: Copied from Source/JavaScriptCore/dfg/DFGFPRInfo.h.
+        (WTF::printInternal):
+        * jit/GPRInfo.h: Copied from Source/JavaScriptCore/dfg/DFGGPRInfo.h.
+        (WTF::printInternal):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::JSInterfaceJIT):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::linkForGenerator):
+        (JSC::virtualForGenerator):
+        (JSC::stringLengthTrampolineGenerator):
+        (JSC::nativeForGenerator):
+        (JSC::arityFixup):
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        (JSC::imulThunkGenerator):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::generateThunkWithJumpTo):
+        * runtime/JSCJSValue.h:
+
+2013-09-19  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Substitute UNREACHABLE_FOR_PLATFORM() for RELEASE_ASSERT_NOT_REACHED()
+
+        Rubber-stamped by Joseph Pecoraro.
+
+        Use UNREACHABLE_FOR_PLATFORM() instead of RELEASE_ASSERT_NOT_REACHED() in
+        the non-x86/x86-64 variant of JIT::emitSlow_op_mod() so as to avoid a missing
+        noreturn warning in Clang while simultaneously asserting unreachable code.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+
+2013-09-19  Michael Saboff  <msaboff@apple.com>
+
+        JSC: X86 disassembler shows 16, 32 and 64 bit displacements as unsigned
+        https://bugs.webkit.org/show_bug.cgi?id=121625
+
+        Rubber-stamped by Filip Pizlo.
+
+        Chenged 16, 32 and 64 bit offsets to be signed.  Kept the original tab indented
+        spacing to match the rest of the file.
+
+        * disassembler/udis86/udis86_syn-att.c:
+        (gen_operand):
+
+2013-09-19  Daniel Bates  <dabates@apple.com>
+
+        Remove names of unused arguments from the non-x86/x86-64 function prototype
+        for JIT::emitSlow_op_mod()
+
+        Rubber-stamped by Ryosuke Niwa.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_mod):
+
+2013-09-18  Sam Weinig  <sam@webkit.org>
+
+        Replace use of OwnArrayPtr<Foo> with std::unique_ptr<Foo[]> in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=121583
+
+        Reviewed by Anders Carlsson.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        * API/JSStringRefQt.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dumpDisassembly):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        * runtime/Arguments.h:
+        (JSC::Arguments::isTornOff):
+        (JSC::Arguments::allocateSlowArguments):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSSegmentedVariableObject.h:
+        * runtime/JSVariableObject.h:
+        * runtime/PropertyNameArray.h:
+        * runtime/RegExp.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::finishCreation):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::setSlowArguments):
+
+2013-09-18  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix after r156064.
+
+        * jsc.cpp:
+        (jscmain): Need a temporary to perform '&' in VS2010.
+
+2013-09-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Give 'jsc' commandline an option to disable deleting the VM.
+
+        Reviewed by Mark Hahnenberg.
+
+        * jsc.cpp:
+        (jscmain):
+        * runtime/Options.h:
+
+2013-09-18  Anders Carlsson  <andersca@apple.com>
+
+        RefPtrHashMap should work with move only types
+        https://bugs.webkit.org/show_bug.cgi?id=121564
+
+        Reviewed by Andreas Kling.
+
+        * runtime/VM.cpp:
+        (JSC::VM::addSourceProviderCache):
+
+2013-09-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename OperationInProgress to HeapOperation and move it out of Heap.h into its own header
+        https://bugs.webkit.org/show_bug.cgi?id=121534
+
+        Reviewed by Geoffrey Garen.
+
+        OperationInProgress is a silly name. 
+
+        Many parts of the Heap would like to know what HeapOperation is currently underway, but 
+        since they are included in Heap.h they can't directly reference HeapOperation if it also 
+        lives in Heap.h. The simplest thing to do is to give HeapOperation its own header. While 
+        a bit overkill, it simplifies including it wherever its needed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        (JSC::CodeBlock::updateAllValueProfilePredictions):
+        (JSC::CodeBlock::updateAllPredictions):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::updateAllValueProfilePredictions):
+        (JSC::CodeBlock::updateAllPredictions):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
+        * bytecode/LazyOperandValueProfile.h:
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        * heap/Heap.h:
+        * heap/HeapOperation.h: Added.
+
+2013-09-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support Int52 for local variables
+        https://bugs.webkit.org/show_bug.cgi?id=121064
+
+        Reviewed by Oliver Hunt.
+        
+        This adds Int52 support for local variables to the DFG and FTL. It's a speed-up on
+        programs that have local int32 overflows but where a larger int representation can
+        prevent us from having to convert all the way up to double.
+        
+        It's a small speed-up for now. But we're just supporting Int52 for a handful of
+        operations (add, sub, mul, neg, compare, bitops, typed array access) and this lays
+        the groundwork for adding Int52 to JSValue, which will probably be a bigger
+        speed-up.
+        
+        The basic approach is:
+        
+        - We have a notion of Int52 in our typesystem. Int52 doesn't belong to BytecodeTop
+          or HeapTop - i.e. it doesn't arise from JSValues.
+        
+        - DFG treats Int52 as being part of its FullTop and will treat it as being a
+          subtype of double unless instructed otherwise.
+        
+        - Prediction propagator creates Int52s whenever we have a node going doubly but due
+          to large values rather than fractional values, and that node is known to be able
+          to produce Int52 natively in the DFG backend.
+        
+        - Fixup phase converts edges to MachineIntUses in nodes that are known to be able
+          to deal with Int52, and where we have a subtype of Int32|Int52 as the predicted
+          input.
+        
+        - The DFG backend and FTL LLVM IR lowering have two notions of Int52s - ones that
+          are left-shifted by 16 (great for overflow checks) and ones that are
+          sign-extended. Both backends know how to convert between Int52s and the other
+          representations.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::rshift64):
+        (JSC::MacroAssemblerX86_64::mul64):
+        (JSC::MacroAssemblerX86_64::branchMul64):
+        (JSC::MacroAssemblerX86_64::branchNeg64):
+        (JSC::MacroAssemblerX86_64::convertInt64ToDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::imulq_rr):
+        (JSC::X86Assembler::cvtsi2sdq_rr):
+        * bytecode/DataFormat.h:
+        (JSC::dataFormatToString):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/OperandsInlines.h:
+        (JSC::::dumpInContext):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromValue):
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt32SpeculationForArithmetic):
+        (JSC::isInt52Speculation):
+        (JSC::isMachineIntSpeculationForArithmetic):
+        (JSC::isInt52AsDoubleSpeculation):
+        (JSC::isBytecodeRealNumberSpeculation):
+        (JSC::isFullRealNumberSpeculation):
+        (JSC::isBytecodeNumberSpeculation):
+        (JSC::isFullNumberSpeculation):
+        (JSC::isBytecodeNumberSpeculationExpectingDefined):
+        (JSC::isFullNumberSpeculationExpectingDefined):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::alreadyInJSStackAsUnboxedInt52):
+        (JSC::ValueRecovery::inGPR):
+        (JSC::ValueRecovery::displacedInJSStack):
+        (JSC::ValueRecovery::isAlreadyInJSStack):
+        (JSC::ValueRecovery::gpr):
+        (JSC::ValueRecovery::virtualRegister):
+        (JSC::ValueRecovery::dumpInContext):
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::needsTypeCheck):
+        (JSC::DFG::AbstractInterpreter::filterByType):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::couldBeType):
+        (JSC::DFG::AbstractValue::isType):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::validateType):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::boxInt52):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::enableInt52):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::fixupBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::fixupUntypedSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::fixEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        * dfg/DFGFlushFormat.cpp:
+        (WTF::printInternal):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::resultFor):
+        (JSC::DFG::useKindFor):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::initInt52):
+        (JSC::DFG::GenerationInfo::initStrictInt52):
+        (JSC::DFG::GenerationInfo::isFormat):
+        (JSC::DFG::GenerationInfo::isInt52):
+        (JSC::DFG::GenerationInfo::isStrictInt52):
+        (JSC::DFG::GenerationInfo::fillInt52):
+        (JSC::DFG::GenerationInfo::fillStrictInt52):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::mulShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::negateShouldSpeculateMachineInt):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        (JSC::DFG::MinifiedNode::hasChild):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
+        (JSC::DFG::Node::canSpeculateInt52):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::nodeCanSpeculateInt52):
+        * dfg/DFGNodeType.h:
+        (JSC::DFG::permitsOSRBackwardRewiring):
+        (JSC::DFG::forwardRewiringSelectionScore):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSilentRegisterSavePlan.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::speculateMachineInt):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::canReuse):
+        (JSC::DFG::SpeculativeJIT::isFilled):
+        (JSC::DFG::SpeculativeJIT::isFilledDouble):
+        (JSC::DFG::SpeculativeJIT::use):
+        (JSC::DFG::SpeculativeJIT::isKnownInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
+        (JSC::DFG::SpeculativeJIT::int52Result):
+        (JSC::DFG::SpeculativeJIT::strictInt52Result):
+        (JSC::DFG::SpeculativeJIT::initConstantInfo):
+        (JSC::DFG::SpeculativeJIT::isInteger):
+        (JSC::DFG::SpeculativeJIT::betterUseStrictInt52):
+        (JSC::DFG::SpeculativeJIT::generationInfo):
+        (JSC::DFG::SpeculateInt52Operand::SpeculateInt52Operand):
+        (JSC::DFG::SpeculateInt52Operand::~SpeculateInt52Operand):
+        (JSC::DFG::SpeculateInt52Operand::edge):
+        (JSC::DFG::SpeculateInt52Operand::node):
+        (JSC::DFG::SpeculateInt52Operand::gpr):
+        (JSC::DFG::SpeculateInt52Operand::use):
+        (JSC::DFG::SpeculateStrictInt52Operand::SpeculateStrictInt52Operand):
+        (JSC::DFG::SpeculateStrictInt52Operand::~SpeculateStrictInt52Operand):
+        (JSC::DFG::SpeculateStrictInt52Operand::edge):
+        (JSC::DFG::SpeculateStrictInt52Operand::node):
+        (JSC::DFG::SpeculateStrictInt52Operand::gpr):
+        (JSC::DFG::SpeculateStrictInt52Operand::use):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::SpeculateWhicheverInt52Operand):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::~SpeculateWhicheverInt52Operand):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::edge):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::node):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::gpr):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::use):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::format):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::boxInt52):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileInt52Compare):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleInt52Branch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isNumerical):
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::valueSourceKindToDataFormat):
+        (JSC::DFG::ValueSource::forFlushFormat):
+        (JSC::DFG::ValueSource::valueRecovery):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        (JSC::DFG::VariableAccessData::flushFormat):
+        * ftl/FTLCArgumentGetter.cpp:
+        (JSC::FTL::CArgumentGetter::loadNextAndBox):
+        * ftl/FTLCArgumentGetter.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::inJSStackAsInt52):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileAdd):
+        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLess):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLessEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreater):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreaterEq):
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowInt52):
+        (JSC::FTL::LowerDFGToLLVM::lowStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::betterUseStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::bestInt52Kind):
+        (JSC::FTL::LowerDFGToLLVM::opposite):
+        (JSC::FTL::LowerDFGToLLVM::lowWhicheverInt52):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToInt32):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToDouble):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToJSValue):
+        (JSC::FTL::LowerDFGToLLVM::setInt52WithStrictValue):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToInt52):
+        (JSC::FTL::LowerDFGToLLVM::int52ToStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        (JSC::FTL::LowerDFGToLLVM::setInt52):
+        (JSC::FTL::LowerDFGToLLVM::setStrictInt52):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::addWithOverflow64):
+        (JSC::FTL::Output::subWithOverflow64):
+        (JSC::FTL::Output::mulWithOverflow64):
+        * ftl/FTLValueFormat.cpp:
+        (WTF::printInternal):
+        * ftl/FTLValueFormat.h:
+        * ftl/FTLValueSource.cpp:
+        (JSC::FTL::ValueSource::dump):
+        * ftl/FTLValueSource.h:
+        * interpreter/Register.h:
+        (JSC::Register::unboxedInt52):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOffForInlineCallFrame):
+        * runtime/IndexingType.cpp:
+        (JSC::leastUpperBoundOfIndexingTypeAndType):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isMachineInt):
+        (JSC::JSValue::asMachineInt):
+
+2013-09-17  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r155771): js/stack-overflow-arrity-catch.html is crashing on non-Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=121376
+
+        Reviewed by Oliver Hunt.
+
+        Fix stack grow() call for stack growing down.  This should catch running out of stack space before
+        we try to move the frame down due to arity mismatch.
+
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+
+2013-09-18  Andreas Kling  <akling@apple.com>
+
+        YARR: Put UCS2 canonicalization tables in read-only memory.
+        <https://webkit.org/b/121547>
+
+        Reviewed by Sam Weinig.
+
+        These tables never mutate so mark them const.
+
+2013-09-18  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r156019 and r156020.
+        http://trac.webkit.org/changeset/156019
+        http://trac.webkit.org/changeset/156020
+        https://bugs.webkit.org/show_bug.cgi?id=121540
+
+        Broke tests (Requested by ap on #webkit).
+
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        * bytecode/DataFormat.h:
+        (JSC::dataFormatToString):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/OperandsInlines.h:
+        (JSC::::dumpInContext):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromValue):
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt32SpeculationForArithmetic):
+        (JSC::isInt48Speculation):
+        (JSC::isMachineIntSpeculationForArithmetic):
+        (JSC::isInt48AsDoubleSpeculation):
+        (JSC::isRealNumberSpeculation):
+        (JSC::isNumberSpeculation):
+        (JSC::isNumberSpeculationExpectingDefined):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::inGPR):
+        (JSC::ValueRecovery::displacedInJSStack):
+        (JSC::ValueRecovery::isAlreadyInJSStack):
+        (JSC::ValueRecovery::gpr):
+        (JSC::ValueRecovery::virtualRegister):
+        (JSC::ValueRecovery::dumpInContext):
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::needsTypeCheck):
+        (JSC::DFG::AbstractInterpreter::filterByType):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::validateType):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::unboxDouble):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::canonicalize):
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::fixEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        * dfg/DFGFlushFormat.cpp:
+        (WTF::printInternal):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::resultFor):
+        (JSC::DFG::useKindFor):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::initInt32):
+        (JSC::DFG::GenerationInfo::fillInt32):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::mulShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::negateShouldSpeculateMachineInt):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        (JSC::DFG::MinifiedNode::hasChild):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
+        (JSC::DFG::Node::canSpeculateInt48):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::nodeCanSpeculateInt48):
+        * dfg/DFGNodeType.h:
+        (JSC::DFG::forwardRewiringSelectionScore):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::shortOperandsDump):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSilentRegisterSavePlan.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::canReuse):
+        (JSC::DFG::SpeculativeJIT::isFilled):
+        (JSC::DFG::SpeculativeJIT::isFilledDouble):
+        (JSC::DFG::SpeculativeJIT::use):
+        (JSC::DFG::SpeculativeJIT::boxDouble):
+        (JSC::DFG::SpeculativeJIT::isKnownInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
+        (JSC::DFG::SpeculativeJIT::int32Result):
+        (JSC::DFG::SpeculativeJIT::initConstantInfo):
+        (JSC::DFG::SpeculativeJIT::isInteger):
+        (JSC::DFG::SpeculativeJIT::generationInfoFromVirtualRegister):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isNumerical):
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::valueSourceKindToDataFormat):
+        (JSC::DFG::ValueSource::forFlushFormat):
+        (JSC::DFG::ValueSource::valueRecovery):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        (JSC::DFG::VariableAccessData::flushFormat):
+        * ftl/FTLCArgumentGetter.cpp:
+        (JSC::FTL::CArgumentGetter::loadNextAndBox):
+        * ftl/FTLCArgumentGetter.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLExitValue.h:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileAdd):
+        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLess):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLessEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreater):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreaterEq):
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        (JSC::FTL::LowerDFGToLLVM::setInt32):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::mulWithOverflow32):
+        * ftl/FTLValueFormat.cpp:
+        (WTF::printInternal):
+        * ftl/FTLValueFormat.h:
+        * ftl/FTLValueSource.cpp:
+        (JSC::FTL::ValueSource::dump):
+        * ftl/FTLValueSource.h:
+        * interpreter/Register.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOffForInlineCallFrame):
+        * runtime/IndexingType.cpp:
+        (JSC::leastUpperBoundOfIndexingTypeAndType):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+
+2013-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix 32-bit build.
+
+        * runtime/JSCJSValue.h:
+
+2013-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should support Int52 for local variables
+        https://bugs.webkit.org/show_bug.cgi?id=121064
+
+        Reviewed by Oliver Hunt.
+        
+        This adds Int52 support for local variables to the DFG and FTL. It's a speed-up on
+        programs that have local int32 overflows but where a larger int representation can
+        prevent us from having to convert all the way up to double.
+        
+        It's a small speed-up for now. But we're just supporting Int52 for a handful of
+        operations (add, sub, mul, neg, compare, bitops, typed array access) and this lays
+        the groundwork for adding Int52 to JSValue, which will probably be a bigger
+        speed-up.
+        
+        The basic approach is:
+        
+        - We have a notion of Int52 in our typesystem. Int52 doesn't belong to BytecodeTop
+          or HeapTop - i.e. it doesn't arise from JSValues.
+        
+        - DFG treats Int52 as being part of its FullTop and will treat it as being a
+          subtype of double unless instructed otherwise.
+        
+        - Prediction propagator creates Int52s whenever we have a node going doubly but due
+          to large values rather than fractional values, and that node is known to be able
+          to produce Int52 natively in the DFG backend.
+        
+        - Fixup phase converts edges to MachineIntUses in nodes that are known to be able
+          to deal with Int52, and where we have a subtype of Int32|Int52 as the predicted
+          input.
+        
+        - The DFG backend and FTL LLVM IR lowering have two notions of Int52s - ones that
+          are left-shifted by 16 (great for overflow checks) and ones that are
+          sign-extended. Both backends know how to convert between Int52s and the other
+          representations.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::rshift64):
+        (JSC::MacroAssemblerX86_64::mul64):
+        (JSC::MacroAssemblerX86_64::branchMul64):
+        (JSC::MacroAssemblerX86_64::branchNeg64):
+        (JSC::MacroAssemblerX86_64::convertInt64ToDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::imulq_rr):
+        (JSC::X86Assembler::cvtsi2sdq_rr):
+        * bytecode/DataFormat.h:
+        (JSC::dataFormatToString):
+        * bytecode/OperandsInlines.h:
+        (JSC::::dumpInContext):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromValue):
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt32SpeculationForArithmetic):
+        (JSC::isMachineIntSpeculationForArithmetic):
+        (JSC::isBytecodeRealNumberSpeculation):
+        (JSC::isFullRealNumberSpeculation):
+        (JSC::isBytecodeNumberSpeculation):
+        (JSC::isFullNumberSpeculation):
+        (JSC::isBytecodeNumberSpeculationExpectingDefined):
+        (JSC::isFullNumberSpeculationExpectingDefined):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::alreadyInJSStackAsUnboxedInt52):
+        (JSC::ValueRecovery::inGPR):
+        (JSC::ValueRecovery::displacedInJSStack):
+        (JSC::ValueRecovery::isAlreadyInJSStack):
+        (JSC::ValueRecovery::gpr):
+        (JSC::ValueRecovery::virtualRegister):
+        (JSC::ValueRecovery::dumpInContext):
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::needsTypeCheck):
+        (JSC::DFG::AbstractInterpreter::filterByType):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::couldBeType):
+        (JSC::DFG::AbstractValue::isType):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::validateType):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::boxInt52):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::enableInt52):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::fixupUntypedSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::fixEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        * dfg/DFGFlushFormat.cpp:
+        (WTF::printInternal):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::resultFor):
+        (JSC::DFG::useKindFor):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::initInt52):
+        (JSC::DFG::GenerationInfo::initStrictInt52):
+        (JSC::DFG::GenerationInfo::isFormat):
+        (JSC::DFG::GenerationInfo::isInt52):
+        (JSC::DFG::GenerationInfo::isStrictInt52):
+        (JSC::DFG::GenerationInfo::fillInt52):
+        (JSC::DFG::GenerationInfo::fillStrictInt52):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::mulShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::negateShouldSpeculateMachineInt):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        (JSC::DFG::MinifiedNode::hasChild):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGNodeType.h:
+        (JSC::DFG::forwardRewiringSelectionScore):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSilentRegisterSavePlan.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::speculateMachineInt):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::canReuse):
+        (JSC::DFG::SpeculativeJIT::isFilled):
+        (JSC::DFG::SpeculativeJIT::isFilledDouble):
+        (JSC::DFG::SpeculativeJIT::use):
+        (JSC::DFG::SpeculativeJIT::isKnownInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
+        (JSC::DFG::SpeculativeJIT::int52Result):
+        (JSC::DFG::SpeculativeJIT::strictInt52Result):
+        (JSC::DFG::SpeculativeJIT::initConstantInfo):
+        (JSC::DFG::SpeculativeJIT::isInteger):
+        (JSC::DFG::SpeculativeJIT::betterUseStrictInt52):
+        (JSC::DFG::SpeculativeJIT::generationInfo):
+        (JSC::DFG::SpeculateInt52Operand::SpeculateInt52Operand):
+        (JSC::DFG::SpeculateInt52Operand::~SpeculateInt52Operand):
+        (JSC::DFG::SpeculateInt52Operand::edge):
+        (JSC::DFG::SpeculateInt52Operand::node):
+        (JSC::DFG::SpeculateInt52Operand::gpr):
+        (JSC::DFG::SpeculateInt52Operand::use):
+        (JSC::DFG::SpeculateStrictInt52Operand::SpeculateStrictInt52Operand):
+        (JSC::DFG::SpeculateStrictInt52Operand::~SpeculateStrictInt52Operand):
+        (JSC::DFG::SpeculateStrictInt52Operand::edge):
+        (JSC::DFG::SpeculateStrictInt52Operand::node):
+        (JSC::DFG::SpeculateStrictInt52Operand::gpr):
+        (JSC::DFG::SpeculateStrictInt52Operand::use):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::SpeculateWhicheverInt52Operand):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::~SpeculateWhicheverInt52Operand):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::edge):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::node):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::gpr):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::use):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::format):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::boxInt52):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileInt52Compare):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleInt52Branch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isNumerical):
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::valueSourceKindToDataFormat):
+        (JSC::DFG::ValueSource::forFlushFormat):
+        (JSC::DFG::ValueSource::valueRecovery):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        (JSC::DFG::VariableAccessData::flushFormat):
+        * ftl/FTLCArgumentGetter.cpp:
+        (JSC::FTL::CArgumentGetter::loadNextAndBox):
+        * ftl/FTLCArgumentGetter.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::inJSStackAsInt52):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileAdd):
+        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLess):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLessEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreater):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreaterEq):
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowInt52):
+        (JSC::FTL::LowerDFGToLLVM::lowStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::betterUseStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::bestInt52Kind):
+        (JSC::FTL::LowerDFGToLLVM::opposite):
+        (JSC::FTL::LowerDFGToLLVM::Int52s::operator[]):
+        (JSC::FTL::LowerDFGToLLVM::lowWhicheverInt52):
+        (JSC::FTL::LowerDFGToLLVM::lowWhicheverInt52s):
+        (JSC::FTL::LowerDFGToLLVM::lowOpposingInt52s):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToInt32):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToDouble):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToJSValue):
+        (JSC::FTL::LowerDFGToLLVM::setInt52WithStrictValue):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToInt52):
+        (JSC::FTL::LowerDFGToLLVM::int52ToStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        (JSC::FTL::LowerDFGToLLVM::setInt52):
+        (JSC::FTL::LowerDFGToLLVM::setStrictInt52):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::addWithOverflow64):
+        (JSC::FTL::Output::subWithOverflow64):
+        (JSC::FTL::Output::mulWithOverflow64):
+        * ftl/FTLValueFormat.cpp:
+        (WTF::printInternal):
+        * ftl/FTLValueFormat.h:
+        * ftl/FTLValueSource.cpp:
+        (JSC::FTL::ValueSource::dump):
+        * ftl/FTLValueSource.h:
+        * interpreter/Register.h:
+        (JSC::Register::unboxedInt52):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOffForInlineCallFrame):
+        * runtime/IndexingType.cpp:
+        (JSC::leastUpperBoundOfIndexingTypeAndType):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isMachineInt):
+        (JSC::JSValue::asMachineInt):
+
+2013-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Use CheckStructure for checking the types of typed arrays whenever possible
+        https://bugs.webkit.org/show_bug.cgi?id=121514
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        (JSC::DFG::ArrayMode::refine):
+        (JSC::DFG::ArrayMode::originalArrayStructure):
+        (JSC::DFG::arrayClassToString):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::ArrayMode):
+        (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::isOriginalTypedArrayStructure):
+
+2013-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should use the (x & 0x7fffffff) trick for doing overflow and neg-zero checks on negation in one go
+        https://bugs.webkit.org/show_bug.cgi?id=121520
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+
+2013-09-17  Andreas Kling  <akling@apple.com>
+
+        Pack create_hash_table tables better.
+        <https://webkit.org/b/121517>
+
+        Reviewed by Sam Weinig.
+
+        Reduces JavaScriptCore binary size by 4648 bytes.
+
+        * create_hash_table:
+        * runtime/Lookup.h:
+
+            Reorder HashTableValue members to avoid unnecessary padding.
+
+2013-09-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        DFG doesn't properly keep scope alive for op_put_to_scope
+        https://bugs.webkit.org/show_bug.cgi?id=121519
+
+        Reviewed by Michael Saboff.
+
+        This was a latent bug that can't actually occur in ToT. It was uncovered by causing slow 
+        path calls in the baseline JIT for op_put_to_scope in places where we couldn't before (but 
+        which were necessary for gen GC).
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2013-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't GC while OSR compiling
+        https://bugs.webkit.org/show_bug.cgi?id=121513
+
+        Reviewed by Mark Hahnenberg.
+        
+        Fixes some rare crashes that I see in ConservativeRoots, while in a GC from OSR exit
+        compilation.
+
+        * dfg/DFGOSRExitCompiler.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+
+2013-09-17  Alberto Garcia  <berto@igalia.com>
+
+        Unreviewed make distcheck fix.
+
+        * GNUmakefile.list.am:
+
+2013-09-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MarkedBlocks shouldn't be put in Allocated state if they didn't produce a FreeList
+        https://bugs.webkit.org/show_bug.cgi?id=121236
+
+        Reviewed by Geoffrey Garen.
+
+        Right now, after a collection all MarkedBlocks are in the Marked block state. When lazy sweeping 
+        happens, if a block returns an empty free list after being swept, we call didConsumeFreeList(), 
+        which moves the block into the Allocated block state. This happens to both the block that was 
+        just being allocated out of (i.e. m_currentBlock) as well as any blocks who are completely full. 
+        We should distinguish between these two cases: m_currentBlock should transition to 
+        Allocated (because we were just allocating out of it) and any subsequent block that returns an 
+        empty free list should transition back to the Marked state. This will make the block state more 
+        consistent with the actual state the block is in, and it will also allow us to speed up moving 
+        all blocks the the Marked state during generational collection.
+
+        Added new RAII-style HeapIterationScope class that notifies the Heap when it is about to be 
+        iterated and when iteration has finished. Any clients that need accurate liveness data when 
+        iterating over the Heap now need to use a HeapIterationScope so that the state of Heap can 
+        be properly restored after they are done iterating. No new GC-allocated objects can be created 
+        until this object goes out of scope.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp: 
+        (JSC::Debugger::recompileAllJSFunctions): Added HeapIterationScope for the Recompiler iteration.
+        * heap/Heap.cpp:
+        (JSC::Heap::willStartIterating): Callback used by HeapIterationScope to indicate that iteration of 
+        the Heap is about to begin. This will cause cell liveness data to be canonicalized by calling stopAllocating.
+        (JSC::Heap::didFinishIterating): Same, but indicates that iteration has finished.
+        (JSC::Heap::globalObjectCount): Used HeapIterationScope.
+        (JSC::Heap::objectTypeCounts): Ditto.
+        (JSC::Heap::markDeadObjects): Ditto.
+        (JSC::Heap::zombifyDeadObjects): Ditto.
+        * heap/Heap.h:
+        * heap/HeapIterationScope.h: Added. New RAII-style object for indicating to the Heap that it's about
+        to be iterated or that iteration has finished.
+        (JSC::HeapIterationScope::HeapIterationScope):
+        (JSC::HeapIterationScope::~HeapIterationScope):
+        * heap/HeapStatistics.cpp:
+        (JSC::HeapStatistics::showObjectStatistics): Used new HeapIterationScope.
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper): We now treat the case where we have just finished 
+        allocating out of the current block differently from the case where we sweep a block and it 
+        returns an empty free list. This was the primary point of this patch.
+        (JSC::MarkedAllocator::allocateSlowCase): ASSERT that nobody is currently iterating the Heap 
+        when allocating.
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::reset): All allocators are reset after every collection. We need to make 
+        sure that the m_lastActiveBlock gets cleared, which it might not always because we don't call 
+        takeCanonicalizedBlock on blocks in the large allocators.
+        (JSC::MarkedAllocator::stopAllocating): We shouldn't already have a last active block,
+        so ASSERT as much.
+        (JSC::MarkedAllocator::resumeAllocating): Do the opposite of what stopAllocating
+        does. So, if we don't have a m_lastActiveBlock then we don't have to worry about undoing anything
+        done by stopAllocating. If we do, then we call resumeAllocating on the block, which returns the FreeList
+        as it was prior to stopping allocation. We then set the current block to the last active block and 
+        clear the last active block. 
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::resumeAllocating): Any block resuming allocation should be in 
+        the Marked state, so ASSERT as much. We always allocate a m_newlyAllocated Bitmap if we're
+        FreeListed, so if we didn't allocate one then we know we were Marked when allocation was stopped,
+        so just return early with an empty FreeList. If we do have a non-null m_newlyAllocated Bitmap
+        then we need to be swept in order to rebuild our FreeList.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::didConsumeEmptyFreeList): This is called if we ever sweep a block and get back
+        an empty free list. Instead of transitioning to the Allocated state, we now go straight back to the 
+        Marked state. This makes sense because we weren't actually allocated out of, so we shouldn't be in 
+        the allocated state. Also added some ASSERTs to make sure that we're in the state that we expect: all of
+        our mark bits should be set and we should not have a m_newlyAllocated Bitmap.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::forEachAllocator): Added a new functor-style iteration method so that we can 
+        easily iterate over each allocator for, e.g., stopping and resuming allocators without
+        duplicating code. 
+        (JSC::StopAllocatingFunctor::operator()): New functors for use with forEachAllocator.
+        (JSC::MarkedSpace::stopAllocating): Ditto.
+        (JSC::ResumeAllocatingFunctor::operator()): Ditto.
+        (JSC::MarkedSpace::resumeAllocating): Ditto.
+        (JSC::MarkedSpace::willStartIterating): Callback that notifies MarkedSpace that it is being iterated.
+        Does some ASSERTs, sets a flag, canonicalizes cell liveness data by calling stopAllocating.
+        (JSC::MarkedSpace::didFinishIterating): Ditto, but to signal that iteration has completed.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::iterationInProgress): Returns true if a HeapIterationScope is currently active.
+        (JSC::MarkedSpace::forEachLiveCell): Accepts a HeapIterationScope to enforce the rule that you have to 
+        create one prior to iterating over the Heap.
+        (JSC::MarkedSpace::forEachDeadCell): Ditto.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::haveABadTime): Changed to use new HeapIterationScope.
+        * runtime/VM.cpp:
+        (JSC::VM::releaseExecutableMemory): Ditto.
+
+2013-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Inlining should work in debug mode (i.e. Executable::newCodeBlock() should call recordParse())
+        https://bugs.webkit.org/show_bug.cgi?id=121444
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGArgumentPosition.h: Fix a bug discovered by reenabling inlining. ArgumentPosition may point to the non-canonical VariableAccessData but users of someVariable() want the canonical one.
+        (JSC::DFG::ArgumentPosition::someVariable):
+        * runtime/Executable.cpp: Call recordParse() so that the Executable knows things about itself (like if it has captured variables). Otherwise those fields are uninitialized.
+        (JSC::ScriptExecutable::newCodeBlockFor):
+
+2013-09-16  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        Aligned argument signatures of setupArgumentsWithExecState are missing on MIPS.
+        https://bugs.webkit.org/show_bug.cgi?id=121439
+
+        Reviewed by Geoffrey Garen.
+
+        Missing implementations of setupArgumentsWithExecState added.
+
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+
+2013-09-16  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Fix typo in subp implementation in LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=121438
+
+        Reviewed by Andreas Kling.
+
+        * offlineasm/sh4.rb:
+
+2013-09-16  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Handle subp opcode with 3 operands and bpbeq opcode in LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=121412
+
+        Reviewed by Andreas Kling.
+
+        * offlineasm/sh4.rb:
+
+2013-09-15  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed make distcheck fix.
+
+        * GNUmakefile.list.am:
+
+2013-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Deoptimize deoptimization: make DFGOSRExitCompiler64.cpp more hackable
+        https://bugs.webkit.org/show_bug.cgi?id=121374
+
+        Reviewed by Geoffrey Garen.
+        
+        This reduces the size of DFGOSRExitCompiler64.cpp by almost 50%, and makes it
+        super easy to add new recovery kinds. For recoveries that involve reboxing, it
+        allows you to keep most of the code common between the on-stack and in-reg
+        cases: they all get funneled through the "load from scratch buffer, convert,
+        and then store to stack" logic.
+        
+        This opens up a bunch of possibilities. It'll make adding Int48 much easier,
+        and it probably will come in handy as we do various DFG stack layout changes in
+        support of the FTL.
+
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::dumpInContext):
+        (JSC::ValueRecovery::dump):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::shortOperandsDump):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+
+2013-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be easy to add new nodes that do OSR forward rewiring in both DFG and FTL
+        https://bugs.webkit.org/show_bug.cgi?id=121371
+
+        Reviewed by Sam Weinig.
+        
+        Forward rewiring is a tricky part of OSR that handles the following:
+        
+            a: Something(...)
+               SetLocal(@a, locX)
+            b: Int32ToDouble(@a)
+            c: SomethingThatExits(@b)
+               <no further uses of @a or @b>
+
+        Note that at @c, OSR will think that locX->@a, but @a will be dead. So it must be
+        smart enough to find @b, which contains an equivalent value. It must do this for
+        any identity functions we support. Currently we support four such functions.
+        
+        Currently the code for doing this is basically duplicated between the DFG and the
+        FTL. Also both versions of the code have some really weirdly written logic for
+        picking the "best" identity function to use.
+        
+        We should fix this by simply having a way to ask "is this node an identity
+        function, and if so, then how good is it?"  Then both the DFG and FTL could use
+        this and have no hard-wired knowledge of those identity functions.
+        
+        While we're at it, this also changes some terminology because I found the use of
+        the word "needs" confusing. Note that this retains the somewhat confusing behavior
+        that we don't search all possible forward/backward uses. We only search one step
+        in each direction. This is because we only need to handle cases that FixupPhase
+        and the parser insert. All other code that tries to insert intermediate conversion
+        nodes should ensure to Phantom the original node. For example, the following
+        transformation is illegal:
+        
+        Before:
+            x: SomethingThatExits(@a)
+        
+        After:
+            w: Conversion(@a)
+            x: SomethingThatExits(@w)
+        
+        The correct form of that transformation is one of these:
+        
+        Correct #1:
+        
+            v: DoAllChecks(@a) // exit here
+            w: Conversion(@a)
+            x: Something(@w) // no exit
+        
+        Correct #2:
+        
+            w: Conversion(@a)
+            x: SomethingThatExits(@w)
+            y: Phantom(@a)
+        
+        Correct #3:
+        
+            w: Conversion(@a)
+            x: SomethingThatExits(@w, @a)
+        
+        Note that we use #3 for some heap accesses, but of course it requires that the
+        node you're using has an extra slot for a "dummy" use child.
+        
+        Broadly speaking though, such transformations should be relegated to something
+        below DFG IR, like LLVM IR.
+
+        * dfg/DFGNodeType.h:
+        (JSC::DFG::forwardRewiringSelectionScore):
+        (JSC::DFG::needsOSRForwardRewiring):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+
+2013-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename IntegerBranch/IntegerCompare to Int32Branch/Int32Compare.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleInt32Branch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32Compare):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32Compare):
+
+2013-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename SpeculativeJIT::integerResult() to int32Result().
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithIMul):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::int32Result):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-09-13  Michael Saboff  <msaboff@apple.com>
+
+        FTL JIT broke after r155711
+        https://bugs.webkit.org/show_bug.cgi?id=121332
+
+        Reviewed by Geoffrey Garen.
+
+        Fixed OSR entry to use the local variable's index instead of its VirtualRegister.
+        Initialized ExitArgumentForOperand::m_operand to InvalidVirtualRegister instead of -1.
+        Fixed compileCallOrConstruct() to update locals on callframe going down.
+        Fixed prepareOSREntry() to grow stack down if needed.
+
+        * ftl/FTLExitArgumentForOperand.h:
+        (JSC::FTL::ExitArgumentForOperand::ExitArgumentForOperand):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileExtractOSREntryLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+
+2013-09-13  Anders Carlsson  <andersca@apple.com>
+
+        Avoid a couple of zero-sized fastMalloc calls
+        https://bugs.webkit.org/show_bug.cgi?id=121333
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCopyCFString):
+        Return an empty constant CFStringRef if the JSStringRef is empty.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        Don't allocate an empty m_jsStrings array if m_jsStringsSize is 0.
+
+2013-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG AI assumes that ToThis can never return non-object if it is passed an object, and operationToThis will get the wrong value of isStrictMode() if there's inlining
+        https://bugs.webkit.org/show_bug.cgi?id=121330
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+        
+        Also print whether a function is strict mode in debug dumps.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::dumpInContext):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-09-13  Anders Carlsson  <andersca@apple.com>
+
+        Use nullptr instead of 0 in calls to HashMap::add
+        https://bugs.webkit.org/show_bug.cgi?id=121322
+
+        Reviewed by Sam Weinig.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+
+2013-09-13  Oliver Hunt  <oliver@apple.com>
+
+        Try to kill initialiser expression in for-in statements
+        https://bugs.webkit.org/show_bug.cgi?id=121311
+
+        Reviewed by Gavin Barraclough.
+
+        We'd like to get rid of this pointless initialiser expression
+        in for-in statements.  Unfortunately we have to keep the no_in
+        variant of expression parsing to avoid ambiguity in the grammar.
+        There's a possibility that this will need to be rolled out, but
+        we'll need to live on it to see.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createForInLoop):
+        * parser/NodeConstructors.h:
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::::parseForStatement):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createForInLoop):
+
+2013-09-12  Michael Saboff  <msaboff@apple.com>
+
+        fourthTier: Change JSStack to grow from high to low addresses
+        https://bugs.webkit.org/show_bug.cgi?id=118758
+
+        Reviewed by Oliver Hunt.
+
+        Changed the JSC stack to grow down.  Effectively the JSC stack frame is flipped from
+        what it was.  See JSStack.h for the new offsets.  Changed JSStack begin() and end()
+        to be getBaseOfStack() and getLimitOfStack().  Most of the changes are address or offset
+        calculation changes.  Decoupled a local register ordinal (loop variable or array index)
+        from the offset into the callFrame using localToOperand() and the inverse operandToLocal().
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::trustedImm32ForShift):
+        (JSC::MacroAssembler::lshiftPtr): Added to create scaled addresses with a negative index
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::lshift64): Added to create scaled addresses with a negative index
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::shlq_i8r): Added to create scaled addresses with a negative index
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+        (JSC::unmodifiedArgumentsRegister):
+        (JSC::CodeBlock::isCaptured):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::stackOffset):
+        * bytecode/Operands.h:
+        (JSC::localToOperand):
+        (JSC::operandIsLocal):
+        (JSC::operandToLocal):
+        (JSC::operandIsArgument):
+        (JSC::operandToArgument):
+        (JSC::argumentToOperand):
+        * bytecode/VirtualRegister.h: Made InvalidVirtualRegister a positive value that fits in
+        31 bits since it can be placed into the 31 bit field "stackOffset" in struct InlineCallFrame.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::newRegister):
+        (JSC::BytecodeGenerator::emitNewArray):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::registerOffset):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::allocate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callFrameSlot):
+        (JSC::DFG::SpeculativeJIT::argumentSlot):
+        (JSC::DFG::SpeculativeJIT::callFrameTagSlot):
+        (JSC::DFG::SpeculativeJIT::callFramePayloadSlot):
+        (JSC::DFG::SpeculativeJIT::argumentTagSlot):
+        (JSC::DFG::SpeculativeJIT::argumentPayloadSlot):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::reportValidationContext):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddSpan):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::frameExtentInternal):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        (JSC::ExecState::argumentOffset):
+        (JSC::ExecState::argumentOffsetIncludingThis):
+        (JSC::ExecState::argIndexForRegister):
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        (JSC::Interpreter::dumpRegisters):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::~JSStack):
+        (JSC::JSStack::growSlowCase):
+        (JSC::JSStack::gatherConservativeRoots):
+        (JSC::JSStack::releaseExcessCapacity):
+        (JSC::JSStack::disableErrorStackReserve):
+        * interpreter/JSStack.h:
+        (JSC::JSStack::getBaseOfStack):
+        (JSC::JSStack::getLimitOfStack):
+        (JSC::JSStack::size):
+        (JSC::JSStack::end):
+        (JSC::JSStack::containsAddress):
+        (JSC::JSStack::lowAddress):
+        (JSC::JSStack::highAddress):
+        (JSC::JSStack::reservationEnd):
+        (JSC::JSStack::shrink):
+        (JSC::JSStack::grow):
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::getTopOfFrame):
+        (JSC::JSStack::pushFrame):
+        (JSC::JSStack::popFrame):
+        (JSC::JSStack::installTrapsAfterFrame):
+        * interpreter/StackVisitor.cpp:
+        (JSC::inlinedFrameOffset):
+        (JSC::StackVisitor::readInlinedFrame):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::throwExceptionFromOpCall):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/ThunkGenerators.cpp:
+        (JSC::arityFixup):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::genericCall):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::slotFor):
+        (JSC::MarkedArgumentBuffer::mallocBase):
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::registersOffset):
+        (JSC::JSActivation::tearOff):
+        (JSC::JSActivation::isValidIndex):
+        * runtime/JSArray.h:
+        (JSC::constructArrayNegativeIndexed): New method to create an array from registers that grow down.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::globalExec):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructArrayNegativeIndexed):
+        * runtime/JSString.h:
+        * runtime/Operations.h:
+        (JSC::jsStringFromRegisterArray):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::captureCount):
+
+2013-09-13  Csaba Osztrogonác  <ossy@webkit.org>
+
+        ARM EABI hardfp buildfix after r155675
+        https://bugs.webkit.org/show_bug.cgi?id=121287
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+
+2013-09-13  Youngho Yoo  <youngho33.yoo@lge.com>
+
+        Fixed crash in V8 benchmark suite in ARM,softp,EABI environment. 
+        https://bugs.webkit.org/show_bug.cgi?id=117281
+
+        Reviewed by Michael Saboff.
+
+        Fix the missing EABI_32BIT_DUMMY_ARG in FPRReg using callOperation function.
+
+        Test 1 : fast/js/array-with-double-assign.html
+        Test 2 : fast/js/array-with-double-push.html
+
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+2013-09-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Int32Operand and fillInt32() should go away and all uses should be replaced with SpeculateInt32Operand
+        https://bugs.webkit.org/show_bug.cgi?id=121268
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+
+2013-09-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Web Inspector shouldn't artificially allocate the arguments object in functions that don't use it
+        https://bugs.webkit.org/show_bug.cgi?id=121206
+        <rdar://problem/6911886>
+
+        Reviewed by Joseph Pecoraro.
+
+        This is a step toward better tools, and a 23% speedup in a simple
+        JavaScript benchmark run with the Web Inspector open.
+
+        We want the Web Inspector to be fast, and we want it to produce reliable
+        CPU and memory profiles. We can't do that if just opening the Web Inspector
+        incurs huge CPU/memory penalties like the arguments object.
+
+        Also, since use of the 'arguments' identifier is an API for allocating
+        an object, I think it's good for the UI to let developers know when
+        they've invoked that API and when they haven't.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): No need to allocate the
+        arguments object artificially for the debugger's sake. The activation
+        object no longer assumes that the stack frame is laid out for one.
+
+        (Long-term, this code will move out of the activation object, into a
+        special object for interfacing with the debugger.)
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnNonIndexPropertyNames):
+        (JSC::JSActivation::getOwnPropertySlot): Don't advertise or provide an
+        arguments object if the user function didn't include one. The bytecode
+        generator will not have laid out the stack frame to support one.
+
+        (Eventually, we do want the Web Inspector to see an arguments
+        object in scope in the console. That's a one-line change in JSActivation,
+        but it's blocked by https://bugs.webkit.org/show_bug.cgi?id=121208.)
+
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h: Removed this obsolete performance
+        work-around. C++ property access to an activation object is no longer
+        hot.
+
+2013-09-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rolling out r155632
+
+        Broke some tests.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        * heap/MarkedBlock.h:
+
+2013-09-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Qt build fix. Add a return to make the compiler happy.
+
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::JSValueRegs::gpr):
+
+2013-09-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::GenerationInfo init/fill methods shouldn't duplicate a bunch of logic
+        https://bugs.webkit.org/show_bug.cgi?id=121253
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::initGPR):
+        (JSC::DFG::GenerationInfo::initInt32):
+        (JSC::DFG::GenerationInfo::initJSValue):
+        (JSC::DFG::GenerationInfo::initCell):
+        (JSC::DFG::GenerationInfo::initBoolean):
+        (JSC::DFG::GenerationInfo::initStorage):
+        (JSC::DFG::GenerationInfo::fillGPR):
+        (JSC::DFG::GenerationInfo::fillJSValue):
+        (JSC::DFG::GenerationInfo::fillCell):
+        (JSC::DFG::GenerationInfo::fillInt32):
+        (JSC::DFG::GenerationInfo::fillBoolean):
+        (JSC::DFG::GenerationInfo::fillStorage):
+
+2013-09-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix mispelling (Specualte -> Speculate) that I introduced in an
+        earlier patch.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculateInt32Operand::gpr):
+        (JSC::DFG::SpeculateStrictInt32Operand::gpr):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
+
+2013-09-12  Filip Pizlo  <fpizlo@apple.com>
+
+        GPRTemporary's reuse constructor should be templatized to reduce code duplication, and the bool to denote tag or payload should be replaced with an enum
+        https://bugs.webkit.org/show_bug.cgi?id=121250
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::JSValueRegs::gpr):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileStringEquality):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::JSValueOperand::gpr):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSCJSValue.h:
+
+2013-09-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MarkedBlocks shouldn't be put in Allocated state if they didn't produce a FreeList
+        https://bugs.webkit.org/show_bug.cgi?id=121236
+
+        Reviewed by Geoffrey Garen.
+
+        Right now, after a collection all MarkedBlocks are in the Marked block state. When lazy sweeping 
+        happens, if a block returns an empty free list after being swept, we call didConsumeFreeList(), 
+        which moves the block into the Allocated block state. This happens to both the block that was 
+        just being allocated out of (i.e. m_currentBlock) as well as any blocks who are completely full. 
+        We should distinguish between these two cases: m_currentBlock should transition to 
+        Allocated (because we were just allocating out of it) and any subsequent block that returns an 
+        empty free list should transition back to the Marked state. This will make the block state more 
+        consistent with the actual state the block is in, and it will also allow us to speed up moving 
+        all blocks to the Marked state during generational collection.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::didConsumeEmptyFreeList):
+
+2013-09-12  Mark Lam  <mark.lam@apple.com>
+
+        Change debug hooks to pass sourceID and position info via the DebuggerCallFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=121214.
+
+        Reviewed by Geoffrey Garen.
+
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::sourceId):
+        (JSC::DebuggerCallFrame::clear):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::line):
+        (JSC::DebuggerCallFrame::column):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::Interpreter::unwind):
+        (JSC::Interpreter::debug):
+
+2013-09-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Add back c++11 features removed by buildfixes after all ports did the switch
+        https://bugs.webkit.org/show_bug.cgi?id=119266
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::~Worklist):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::codeType):
+        (JSC::StackVisitor::Frame::functionName):
+        (JSC::StackVisitor::Frame::sourceURL):
+        (JSC::StackVisitor::Frame::print):
+
+2013-09-12  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        Remove home-brewed nullptr
+        https://bugs.webkit.org/show_bug.cgi?id=119624
+
+        Reviewed by Anders Carlsson.
+
+        The standard C++11 nullptr and std::nullptr_t type should be used now.
+
+        * heap/PassWeak.h:
+        * heap/Weak.h:
+
+2013-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename initInteger() to initInt32()
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::initInt32):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::integerResult):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename IntegerOperand to Int32Operand and fillInteger() to fillInt32().
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::fillInt32):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::Int32Operand::Int32Operand):
+        (JSC::DFG::Int32Operand::~Int32Operand):
+        (JSC::DFG::Int32Operand::gpr):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInt32):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::fillSpecualteInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInt32):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::fillSpecualteInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2013-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        FixupPhase should always call fixEdge() exactly once for every edge
+        https://bugs.webkit.org/show_bug.cgi?id=121211
+
+        Reviewed by Geoffrey Garen.
+        
+        Previously we only call fixEdge() on edges that we want to make typed. UntypedUse
+        edges don't get fixEdge() called. This makes it difficult to add functionality in
+        fixEdge() that runs for UntypedUses. It's difficult to remember to call fixEdge()
+        for every edge that we don't want to turn into a typed edge; in an alternative
+        universe where we did this, it would mean that every case in FixupPhase would
+        have to make a fixEdge() call for *every* edge even ones that it doesn't want to
+        modify.
+        
+        This patch takes a different path. fixEdge() must never be called explicitly with
+        UntypedUse. fixEdge() should be used to set the UseKind of edges. Consequently,
+        all that FixupPhase has to do is call fixEdge<UntypedUse>(edge) for every edge
+        that was still UntypedUse after we are done processing a node.
+        
+        This is cheap and easy to implement and ought to be easy to maintain. We won't
+        have a need to call fixEdge<UntypedUse>(edge) explicitly, so depending on that is
+        only natural.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::observeUntypedEdge):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+
+2013-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        FixupPhase's setUseKindAndUnboxBlahbittyblah and fixDoubleEdge methods should be merged and given intuitive names
+        https://bugs.webkit.org/show_bug.cgi?id=121202
+
+        Reviewed by Geoffrey Garen.
+        
+        Got rid of a method whose name was so descriptive that I couldn't ever remember
+        it. And despite the descriptive name, I always had to look at its implementation
+        to remind myself what it did, anyway.
+        
+        Now that method is called fixEdge(). This is a good name because we're in a phase
+        called FixupPhase, and we call this fixEdge() method on pretty much every edge.
+        For the Int48 work, it makes more sense for this method to be a kind of hook into
+        which we can place various things: it's just a way of observing edges that need
+        attention.
+        
+        As part of this refactoring, I also fold fixDoubleEdge into fixEdge. This makes
+        sense because previously it was never correct to call fixDoubleEdge with non-
+        double use kinds; and conversely it was never correct to call fixEdge with double
+        use kinds.
+        
+        Also I found that isDouble() in DFGUseKind.h would return true for KnownInt32Use.
+        That's almost certainly wrong, and removing that behavior doesn't fail any tests.
+        I'm assuming that was just a bug.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToPrimitive):
+        (JSC::DFG::FixupPhase::fixupToString):
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::fixEdge):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        (JSC::DFG::FixupPhase::convertToGetArrayLength):
+        (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::isDouble):
+
+2013-09-11  Mark Lam  <mark.lam@apple.com>
+
+        Fixed indentation in JSC Debugger header files.
+        https://bugs.webkit.org/show_bug.cgi?id=121203.
+
+        Reviewed by Ryosuke Niwa.
+
+        * debugger/Debugger.h:
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::create):
+        (JSC::DebuggerActivation::createStructure):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::callFrame):
+        (JSC::DebuggerCallFrame::dynamicGlobalObject):
+        (JSC::DebuggerCallFrame::scope):
+        (JSC::DebuggerCallFrame::exception):
+
+2013-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove needsDataFormatConversion because it is unused.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/DataFormat.h:
+
+2013-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename fillSpeculateInt to fillSpeculateInt32.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculateInt32Operand::gpr):
+        (JSC::DFG::SpeculateStrictInt32Operand::gpr):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpecualteInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpecualteInt32):
+        (JSC::DFG::SpeculativeJIT::fillSpecualteInt32Strict):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpecualteInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpecualteInt32):
+        (JSC::DFG::SpeculativeJIT::fillSpecualteInt32Strict):
+
+2013-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename DataFormatInteger to DataFormatInt32.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/DataFormat.h:
+        (JSC::dataFormatToString):
+        (JSC::needDataFormatConversion):
+        (JSC::isJSInt32):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::inGPR):
+        (JSC::ValueRecovery::displacedInJSStack):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::initInteger):
+        (JSC::DFG::GenerationInfo::isJSInt32):
+        (JSC::DFG::GenerationInfo::fillInteger):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::checkConsistency):
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::integerResult):
+        (JSC::DFG::SpeculativeJIT::jsValueResult):
+        (JSC::DFG::SpeculativeJIT::isInteger):
+        (JSC::DFG::IntegerOperand::format):
+        (JSC::DFG::SpeculateInt32Operand::format):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::valueSourceKindToDataFormat):
+
+2013-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Int32ToDouble should be predicted SpecInt48 and predictions should have nothing to do with constant folding
+        https://bugs.webkit.org/show_bug.cgi?id=121141
+
+        Reviewed by Oliver Hunt.
+        
+        Just changing Int32ToDouble to be predicted SpecInt48 breaks constant folding on that
+        node because of soooper old code that prevented constant folding on mismatched
+        predictions. Kill that code.
+
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::setConstant):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+
+2013-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        VariableAccessData::flushFormat() should be the universal way of deciding how to speculate on stores to locals and how locals are formatted
+        https://bugs.webkit.org/show_bug.cgi?id=121142
+
+        Reviewed by Geoffrey Garen.
+        
+        Make everyone rely on VariableAccessData::flushFormat() instead of trying to
+        compute that information from scratch. The FTL already used flushFormat(), now
+        the DFG does, too.
+
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::ArgumentPosition::someVariable):
+        (JSC::DFG::ArgumentPosition::flushFormat):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInlineStart):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::forFlushFormat):
+        * dfg/DFGVariableAccessDataDump.cpp:
+        (JSC::DFG::VariableAccessDataDump::dump):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+
+2013-09-11  Oliver Hunt  <oliver@apple.com>
+
+        Partial Information Leakage in Hash Table implementations (PrivateName)
+        https://bugs.webkit.org/show_bug.cgi?id=120663
+
+        Reviewed by Michael Saboff.
+
+        Undo change to the PropertyTable in my last patch, instead lets just
+        use a random value as the initial hash for unique strings.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::findWithString):
+        (JSC::PropertyTable::rehash):
+
+2013-09-11  Oliver Hunt  <oliver@apple.com>
+
+        Partial Information Leakage in Hash Table implementations (PrivateName)
+        https://bugs.webkit.org/show_bug.cgi?id=120663
+
+        Reviewed by Michael Saboff.
+
+        These hashtables mix keys that are hashed on pointers or user controlled
+        data.  To prevent any potential information leak we mask the keys with
+        a per table entropy value.
+
+        * runtime/MapData.cpp:
+        (JSC::MapData::MapData):
+        (JSC::MapData::find):
+        (JSC::MapData::add):
+        (JSC::MapData::remove):
+        * runtime/MapData.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::findWithString):
+        (JSC::PropertyTable::rehash):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::PropertyTable):
+
+2013-09-11  Sam Weinig  <sam@webkit.org>
+
+        MapData and WeakMapData don't need to be objects
+        https://bugs.webkit.org/show_bug.cgi?id=121167
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::mapStructure):
+        Remove MapData and WeakMapData structures (they moved to VM with other non-object Structures).
+
+        * runtime/JSMap.cpp:
+        (JSC::JSMap::finishCreation):
+        * runtime/JSMap.h:
+        (JSC::JSMap::create):
+        * runtime/JSSet.cpp:
+        (JSC::JSSet::finishCreation):
+        * runtime/JSSet.h:
+        (JSC::JSSet::create):
+        * runtime/JSWeakMap.cpp:
+        (JSC::JSWeakMap::finishCreation):
+        * runtime/JSWeakMap.h:
+        (JSC::JSWeakMap::create):
+        Update to not pass a global object to the MapData or WeakMapData Structure.
+
+        * runtime/MapData.cpp:
+        (JSC::MapData::MapData):
+        * runtime/MapData.h:
+        (JSC::MapData::create):
+        (JSC::MapData::createStructure):
+        * runtime/WeakMapData.cpp:
+        (JSC::WeakMapData::WeakMapData):
+        (JSC::WeakMapData::set): Change to take a VM rather than a CallFrame, as that it all it needs.
+        * runtime/WeakMapData.h:
+        (JSC::WeakMapData::create):
+        (JSC::WeakMapData::createStructure):
+        Instead of inheriting from JSDestructibleObject, inherit from JSCell and mark self as needing destruction
+        and having an immortal structure.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        Add MapData and WeakMapData Structures.
+
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::protoFuncWeakMapSet):
+        Pass a VM rather than an ExecState.
+
+2013-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Propagate the Int48 stuff into the prediction propagator.
+        https://bugs.webkit.org/show_bug.cgi?id=121132
+
+        Reviewed by Mark Hahnenberg.
+        
+        This still has no effect on codegen since Int48 still looks like a Double right now.
+
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromValue):
+        * bytecode/SpeculatedType.h:
+        (JSC::isMachineIntSpeculation):
+        (JSC::isMachineIntSpeculationExpectingDefined):
+        (JSC::isMachineIntSpeculationForArithmetic):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::mulShouldSpeculateInt32):
+        (JSC::DFG::Graph::mulShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::negateShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::hasExitSite):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateMachineInt):
+        (JSC::DFG::Node::shouldSpeculateMachineIntForArithmetic):
+        (JSC::DFG::Node::shouldSpeculateMachineIntExpectingDefined):
+        (JSC::DFG::Node::canSpeculateInt48):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::nodeCanSpeculateInt48):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2013-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Be explicit about backwards propagation properties that care about escaping to bytecode, as opposed to just escaping within DFG code.
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        We need to care about escaping to bytecode if we're doing a lossy optimization,
+        i.e. the optimization means we produce less information and so we can't rescue
+        ourselves during OSR exit.
+        
+        We only need to care about escaping within the DFG code (and can ignore what
+        might happen in bytecode) if we're doing an optimization that is lossless, i.e.
+        we can always still reconstruct the values that bytecode wants.
+        
+        Example #1:
+        
+            Large int32 + int32 which overflows. We want to optimize away the overflow
+            check and just do a 32-bit add.
+            
+            This is lossy; the result should have one extra bit but we simply throw
+            that bit away by doing a check-less 32-bit add. Hence we need to know that 
+            even the bytecode wouldn't have cared about that bit. This is true in cases
+            like (a + b) | 0.
+        
+        Example #2:
+        
+            Larbe int32 + int32 which overflows. We want to optimize away the overflow
+            check by doing a 64-bit add.
+            
+            This is lossless. We can always convert the resulting 64-bit int back to a
+            double if that's what bytecode wants. Hence we only need to know that the
+            DFG code won't want to do something to this value that would make 64-bit
+            ints either unprofitable or unsound.
+        
+        The backwards propagator's notions of flags (NodeUsedAsValue, etc) are for lossy
+        optimizations and so should be named in a way that reflects this. This patch
+        calls then NodeBytecodeUsesAsValue, etc.
+        
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::mergeDefaultFlags):
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInt32):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::bytecodeUsesAsNumber):
+        (JSC::DFG::bytecodeCanTruncateInteger):
+        (JSC::DFG::bytecodeCanIgnoreNegativeZero):
+        (JSC::DFG::nodeMayNegZero):
+        (JSC::DFG::nodeCanSpeculateInt32):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileAdd):
+        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+
+2013-09-10  Chris Curtis  <chris_curtis@apple.com>
+
+        WebKit crashes when trying to send a msg via 'today's birthdays' dialogue box on Facebook
+        https://bugs.webkit.org/show_bug.cgi?id=120612#add_comment
+        Reviewed by Geoffrey Garen.
+
+        The codeBlock was assumed to exist when appendSourceToMessage was set.
+        This was an invalid assumption. I added a check to ensure that there is a
+        valid codeBlock before accessing it.
+
+        * API/tests/testapi.c:
+        (valueToObjectExceptionCallAsFunction):
+        (valueToObjectExceptionTest):
+        (main):
+        * runtime/VM.cpp:
+        (JSC::VM::throwException):
+
+2013-09-10  Mark Lam  <mark.lam@apple.com>
+
+        Fix some indentation in Interpreter.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=121136.
+
+        Reviewed by Darin Adler.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::operator()):
+
+2013-09-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MapData has some issues
+        https://bugs.webkit.org/show_bug.cgi?id=121118
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/CopiedBlock.h: Added some debug-only consistency checking logic. We now make sure that 
+        m_liveBytes is consistent with another field, m_liveObjects. m_liveObjects is the number of 
+        "objects" that currently reside in the CopiedBlock. If we have zero live bytes then we should have
+        zero live objects. The converse and the inverse should also be true.
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::didSurviveGC):
+        (JSC::CopiedBlock::didEvacuateBytes):
+        (JSC::CopiedBlock::canBeRecycled):
+        (JSC::CopiedBlock::shouldEvacuate):
+        (JSC::CopiedBlock::liveBytes):
+        (JSC::CopiedBlock::checkConsistency):
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::didCopy):
+        * runtime/MapData.cpp:
+        (JSC::MapData::replaceAndPackBackingStore): Renamed parameter to be consistent with its meaning.
+        (JSC::MapData::replaceBackingStore): Ditto. Also removed an unnecessary local variable.
+        (JSC::MapData::visitChildren): Before we passed the size of the MapData to copyLater(), which 
+        was wrong. Now we pass capacity * sizeof(Entry).
+        (JSC::MapData::copyBackingStore): Before when we reassigned the newly copied backing store, we 
+        set the capacity (in elements) to the size (in bytes) of the backing store. This made us think 
+        we're way bigger than we actually are. Now we just pass the old capacity in.
+        * runtime/MapData.h:
+        (JSC::MapData::capacityInBytes): Helper function to calculate the size of the backing store.
+
+2013-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        We should say Int32 when we mean Int32. Saying Integer is just weird.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToPrimitive):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::truncateConstantsIfNecessary):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addSpeculationMode):
+        (JSC::DFG::Graph::valueAddSpeculationMode):
+        (JSC::DFG::Graph::arithAddSpeculationMode):
+        (JSC::DFG::Graph::addShouldSpeculateInt32):
+        (JSC::DFG::Graph::mulShouldSpeculateInt32):
+        (JSC::DFG::Graph::negateShouldSpeculateInt32):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInt32):
+        (JSC::DFG::Graph::mulImmediateShouldSpeculateInt32):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateInt32):
+        (JSC::DFG::Node::shouldSpeculateInt32ForArithmetic):
+        (JSC::DFG::Node::shouldSpeculateInt32ExpectingDefined):
+        (JSC::DFG::Node::canSpeculateInt32):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::nodeCanSpeculateInt32):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithIMul):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        (JSC::DFG::SpeculativeJIT::speculateInt32):
+        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculateInt32Operand::SpeculateInt32Operand):
+        (JSC::DFG::SpeculateInt32Operand::~SpeculateInt32Operand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+
+2013-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Introduce a SpecInt48 type and be more careful about what we mean by "Top"
+        https://bugs.webkit.org/show_bug.cgi?id=121116
+
+        Reviewed by Oliver Hunt.
+        
+        SpecInt48 will mean that we have something that would be a double if it was a JSValue,
+        but it's profitable to represent it as something other than a double.
+        
+        SpecInt48AsDouble means that it has a value that could have been represented like
+        SpecInt48, but we're making a heuristic decision not to do it.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt48Speculation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        (JSC::DFG::::clobberCapturedVars):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::filter):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::makeHeapTop):
+        (JSC::DFG::AbstractValue::makeBytecodeTop):
+        (JSC::DFG::AbstractValue::isHeapTop):
+        (JSC::DFG::AbstractValue::heapTop):
+        (JSC::DFG::AbstractValue::validateType):
+        (JSC::DFG::AbstractValue::validate):
+        (JSC::DFG::AbstractValue::makeTop):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+
+2013-09-09  Oliver Hunt  <oliver@apple.com>
+
+        Support WeakMap
+        https://bugs.webkit.org/show_bug.cgi?id=120912
+
+        Reviewed by Geoffrey Garen.
+
+        Add support for ES6 WeakMap.  Add the cluster of boilerplate
+        classes around the core WeakMapData class.
+
+        WeakMapData is a simple object->value hash table that uses a
+        combo of WeakReferenceHarvester to conditionally keep the weak
+        value reference live, and UnconditionalFinalizer to clean the
+        dead keys from the table post-GC.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::weakMapDataStructure):
+        * runtime/JSWeakMap.cpp: Added.
+        (JSC::JSWeakMap::finishCreation):
+        (JSC::JSWeakMap::visitChildren):
+        * runtime/JSWeakMap.h: Added.
+        (JSC::JSWeakMap::createStructure):
+        (JSC::JSWeakMap::create):
+        (JSC::JSWeakMap::weakMapData):
+        (JSC::JSWeakMap::JSWeakMap):
+        * runtime/WeakMapConstructor.cpp: Added.
+        (JSC::WeakMapConstructor::finishCreation):
+        (JSC::constructWeakMap):
+        (JSC::WeakMapConstructor::getConstructData):
+        (JSC::WeakMapConstructor::getCallData):
+        * runtime/WeakMapConstructor.h: Added.
+        (JSC::WeakMapConstructor::create):
+        (JSC::WeakMapConstructor::createStructure):
+        (JSC::WeakMapConstructor::WeakMapConstructor):
+        * runtime/WeakMapData.cpp: Added.
+        (JSC::WeakMapData::WeakMapData):
+        (JSC::WeakMapData::finishCreation):
+        (JSC::WeakMapData::destroy):
+        (JSC::WeakMapData::visitChildren):
+        (JSC::WeakMapData::set):
+        (JSC::WeakMapData::get):
+        (JSC::WeakMapData::remove):
+        (JSC::WeakMapData::contains):
+        (JSC::WeakMapData::clear):
+        (JSC::WeakMapData::DeadKeyCleaner::visitWeakReferences):
+        (JSC::WeakMapData::DeadKeyCleaner::finalizeUnconditionally):
+        * runtime/WeakMapData.h: Added.
+        (JSC::WeakMapData::create):
+        (JSC::WeakMapData::createStructure):
+        (JSC::WeakMapData::DeadKeyCleaner::DeadKeyCleaner):
+        * runtime/WeakMapPrototype.cpp: Added.
+        (JSC::WeakMapPrototype::finishCreation):
+        (JSC::getWeakMapData):
+        (JSC::protoFuncWeakMapClear):
+        (JSC::protoFuncWeakMapDelete):
+        (JSC::protoFuncWeakMapGet):
+        (JSC::protoFuncWeakMapHas):
+        (JSC::protoFuncWeakMapSet):
+        * runtime/WeakMapPrototype.h: Added.
+        (JSC::WeakMapPrototype::create):
+        (JSC::WeakMapPrototype::createStructure):
+        (JSC::WeakMapPrototype::WeakMapPrototype):
+
+2013-09-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: [JSC] Caught exception is treated as uncaught
+        https://bugs.webkit.org/show_bug.cgi?id=93607
+
+        Reviewed by Geoff Garen.
+
+        Check up the entire call stack to see if there is an exception handler.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::GetExceptionHandlerFunctor::GetExceptionHandlerFunctor):
+        (JSC::GetExceptionHandlerFunctor::handler):
+        (JSC::GetExceptionHandlerFunctor::operator()):
+
+2013-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        SpecType should have SpecInt48AsDouble
+        https://bugs.webkit.org/show_bug.cgi?id=121065
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromValue):
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt48AsDoubleSpeculation):
+        (JSC::isIntegerSpeculation):
+        (JSC::isDoubleRealSpeculation):
+
+2013-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't GC while in the OSR-triggered jettison code
+        https://bugs.webkit.org/show_bug.cgi?id=121106
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGOperations.cpp:
+
+2013-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        jsc commandline's run() function should take extra arguments
+        https://bugs.webkit.org/show_bug.cgi?id=121098
+
+        Reviewed by Michael Saboff.
+
+        * jsc.cpp:
+        (functionRun):
+
+2013-09-09  Michael Saboff  <msaboff@apple.com>
+
+        There should be one "invalid" virtual register constant
+        https://bugs.webkit.org/show_bug.cgi?id=121057
+
+        Reviewed by Filip Pizlo.
+
+        Unify all references to an invalid virtual register to be the enum InvalidVirtualRegister.
+        Changed the value of InvalidVirtualRegister to be maximum integer value.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setArgumentsRegister):
+        (JSC::CodeBlock::usesArguments):
+        * bytecode/LazyOperandValueProfile.h:
+        (JSC::LazyOperandValueProfileKey::LazyOperandValueProfileKey):
+        (JSC::LazyOperandValueProfileKey::operator!):
+        (JSC::LazyOperandValueProfileKey::isHashTableDeletedValue):
+        (JSC::LazyOperandValueProfile::LazyOperandValueProfile):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::usesArguments):
+        (JSC::UnlinkedCodeBlock::usesGlobalObject):
+        * bytecode/VirtualRegister.h:
+
+2013-09-09  Michael Saboff  <msaboff@apple.com>
+
+        Change virtual register function arguments from unsigned to int
+        https://bugs.webkit.org/show_bug.cgi?id=121055
+
+        Reviewed by Filip Pizlo.
+
+        This is a largely mechanical change.  This changes function paramaters and local variables used to
+        represent bytecode operands from being unsigned to be int.
+
+        * bytecode/CodeOrigin.h:
+        * dfg/DFGByteCodeParser.cpp:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITInlines.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubCall.h:
+
+2013-09-09  Michael Saboff  <msaboff@apple.com>
+
+        Add local to/from operand helpers similar to argument to/from operand2
+        https://bugs.webkit.org/show_bug.cgi?id=121056
+
+        Reviewed by Geoffrey Garen.
+
+        Added localToOperand(), operandToLocal() and operandIsLocal() to Operands.h, very similar to
+        argumentToOperand(), et al.  Used the new helpers everywhere where an index into a data
+        structure is intended instead of the actual virtual register offset.  When the stack is
+        changed to grow down, local register offsets can be negative.  Also added the helper
+        DFG::SpeculativeJIT::generationInfoFromVirtualRegister() for the common case accessing 
+        m_generationInfo[operandToLocal(val)].
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/Operands.h:
+        (JSC::localToOperand):
+        (JSC::operandIsLocal):
+        (JSC::operandToLocal):
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGScoreBoard.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::generationInfoFromVirtualRegister):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGValidate.cpp:
+        * dfg/DFGVariableEventStream.cpp:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * jit/JITInlines.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+
+2013-09-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, disable GC logging.
+
+        * heap/Heap.cpp:
+
+2013-09-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CopiedSpace::startedCopying should not call MarkedSpace::capacity
+        https://bugs.webkit.org/show_bug.cgi?id=121045
+
+        Reviewed by Geoffrey Garen.
+
+        MarkedSpace::capacity() iterates every block in MarkedSpace. Instead we should just 
+        keep track of our total capacity in MarkedSpace as we add and remove MarkedBlocks.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::didAddBlock):
+        (JSC::MarkedSpace::capacity):
+
+2013-09-09  Michael Saboff  <msaboff@apple.com>
+
+        Wrong for SlowPathCall to load callFrame reg from vm.topCallFrame after call
+        https://bugs.webkit.org/show_bug.cgi?id=120537
+
+        Reviewed by Geoffrey Garen.
+
+        Changed JITSlowPathCall::call() to update vm.topCallFrame from the callFrameRegister instead of the
+        other way around.
+
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+
+2013-08-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSArray::shiftCountWithArrayStorage doesn't change indexBias when shifting the last element in m_vector
+        https://bugs.webkit.org/show_bug.cgi?id=120389
+
+        Reviewed by Michael Saboff.
+
+        Went through and cleaned up shiftCountWithArrayStorage. Gave meaningful variable names
+        and commented the confusing parts. This led to realizing how to fix this bug, which has
+        been done. The issue was that we were modifying the vector length unconditionally, even
+        when we weren't logically changing the length of the vector. Instead, we should only modify
+        the vector length when we modify the index bias.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::shiftCountWithArrayStorage):
+
+2013-09-08  Anders Carlsson  <andersca@apple.com>
+
+        Begin moving off of TypeTraits.h
+        https://bugs.webkit.org/show_bug.cgi?id=121006
+
+        Reviewed by Darin Adler.
+
+        Convert uses of WTF type traits to STL type traits.
+
+        * heap/PassWeak.h:
+        * runtime/JSCell.h:
+        (JSC::jsCast):
+        (JSC::jsDynamicCast):
+        * runtime/WriteBarrier.h:
+        (JSC::validateCell):
+
+2013-09-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Calculating the size of the Heap should not require walking over it
+        https://bugs.webkit.org/show_bug.cgi?id=120910
+
+        Reviewed by Geoffrey Garen.
+
+        Currently Heap::size() is O(sizeof(Heap)). This is too expensive to 
+        call during a collection. We should keep a count of visited and copied 
+        bytes as each collection progresses so as to avoid re-walking the Heap 
+        at the end of collection.
+
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::childBytesVisited):
+        (JSC::GCThreadSharedData::childBytesCopied):
+        * heap/GCThreadSharedData.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::sizeAfterCollect):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::reset):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::bytesVisited):
+        (JSC::SlotVisitor::bytesCopied):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::copyLater):
+
+2013-09-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Clearing MarkedBlock::m_newlyAllocated should be separate from MarkedBlock::clearMarks
+        https://bugs.webkit.org/show_bug.cgi?id=121007
+
+        Reviewed by Oliver Hunt.
+
+        We call clearMarks on every MarkedBlock in the Heap, whereas we only need to clear 
+        m_newlyAllocated for the m_currentBlock at the time of the last canonicalizeCellLiveness() 
+        for each MarkedAllocator. We also need to call it on every block in the largeAllocators 
+        because each one of their blocks is canonicalized as it is used.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::getAndClearCanonicalizedBlock):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::canonicalizeCellLivenessData):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::lastChanceToFinalize):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::clearNewlyAllocated):
+        * heap/MarkedSpace.cpp:
+        (JSC::clearNewlyAllocatedInBlock):
+        (JSC::ClearNewlyAllocated::operator()):
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        * heap/MarkedSpace.h:
+
+2013-09-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support typed array PutByVal
+        https://bugs.webkit.org/show_bug.cgi?id=120972
+
+        Reviewed by Oliver Hunt.
+
+        Due to increased FTL coverage, this revealed a bug in LICM where we were trying to
+        have AI execute the tail of a block that !cfaDidFinish. We don't need to execute AI
+        for such blocks since LICM will bail for them anyway, and AI asserts that cfaDidFinish
+        is true.
+
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildFPToUI):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::doubleToInt32):
+        (JSC::FTL::LowerDFGToLLVM::doubleToUInt32):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::fpToUInt):
+        (JSC::FTL::Output::fpToUInt32):
+        (JSC::FTL::Output::store8):
+        (JSC::FTL::Output::store16):
+        (JSC::FTL::Output::storeFloat):
+
+2013-09-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support basic closure operations
+        https://bugs.webkit.org/show_bug.cgi?id=120987
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyScope):
+        (JSC::FTL::LowerDFGToLLVM::compileSkipScope):
+        (JSC::FTL::LowerDFGToLLVM::compileGetClosureRegisters):
+        (JSC::FTL::LowerDFGToLLVM::compileGetClosureVar):
+        (JSC::FTL::LowerDFGToLLVM::compilePutClosureVar):
+
+2013-09-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Only run FTL tests if we have the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=120974
+
+        Reviewed by Geoffrey Garen.
+        
+        The test infrastructure is now smart enough to not pass --useExperimentalFTL=true
+        unless it knows that we have the FTL.
+
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+
+2013-09-07  Anders Carlsson  <andersca@apple.com>
+
+        Get rid of PassOwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=120964
+
+        Reviewed by Andreas Kling.
+
+        Use OwnArrayPtr instead of PassOwnArrayPtr.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::setSlowArguments):
+
+2013-09-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support typed array GetByVal and related ops
+        https://bugs.webkit.org/show_bug.cgi?id=120965
+
+        Reviewed by Oliver Hunt.
+        
+        This adds support for typed array instantiations of the following DFG IR ops:
+        
+        - GetByVal
+        
+        - GetIndexedPropertyStorage
+        
+        - CheckArray
+        
+        - GetArrayLength
+        
+        This also adds CheckArray for Int32/Double/Contiguous arrays.
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::toIndexingShape):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::shapeMask):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::floatType):
+        (JSC::FTL::buildSExt):
+        (JSC::FTL::buildFPCast):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckArray):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::isArrayType):
+        (JSC::FTL::LowerDFGToLLVM::hasClassInfo):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::constIntPtr):
+        (JSC::FTL::Output::signExt):
+        (JSC::FTL::Output::fpCast):
+        (JSC::FTL::Output::loadFloat):
+
+2013-09-07  Anders Carlsson  <andersca@apple.com>
+
+        VectorMover should use std::move
+        https://bugs.webkit.org/show_bug.cgi?id=120959
+
+        Reviewed by Geoffrey Garen.
+
+        Work around a bug in GCC by changing the type of the callType bitfield 
+        in CallLinkInfo to be unsigned instead of CallType.
+
+        * bytecode/CallLinkInfo.h:
+
+2013-09-07  Anders Carlsson  <andersca@apple.com>
+
+        Get rid of FastAllocBase.h
+        https://bugs.webkit.org/show_bug.cgi?id=120952
+
+        Reviewed by Antti Koivisto.
+
+        Include FastMalloc.h instead of FastAllocBase.h.
+
+        * assembler/LinkBuffer.h:
+        * bytecode/CodeBlock.h:
+        * bytecode/StructureStubClearingWatchpoint.h:
+        * dfg/DFGFinalizer.h:
+        * dfg/DFGLongLivedState.h:
+        * dfg/DFGSlowPathGenerator.h:
+        * ftl/FTLAbstractHeap.h:
+        * heap/JITStubRoutineSet.h:
+        * jit/CompactJITCodeMap.h:
+        * profiler/ProfilerDatabase.h:
+        * profiler/ProfilerExecutionCounter.h:
+
+2013-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support Call/Construct in the worst way possible
+        https://bugs.webkit.org/show_bug.cgi?id=120916
+
+        Reviewed by Oliver Hunt.
+        
+        This adds support for Call/Construct by just calling out to C code that uses
+        the JSC::call/JSC::construct runtime functions for making calls. This is slow
+        and terrible, but it dramatically extends FTL coverage.
+        
+        Supporting calls in a meaningful way meant also supporting
+        GlobalVarWatchpoint.
+        
+        The extension of coverage helped to find a bunch of bugs:
+        
+        - ObjectOrOtherUse was claimed to be supported in the FTL but speculate()
+          didn't support it. That means that any node with an ObjectOrOtherUse edge
+          that got DCE'd would cause the FTL to ICE.
+        
+        - There was a bad fall-through compileCompareStrictEq() that led to ICE.
+        
+        - The OSR exit reconstruction code was assuming it could do fast checks on
+          node->child1() before even determining the type of node; that crashes if
+          the node is HasVarArgs. Fixed by checking HasVarArgs first.
+        
+        - The OSR exit compiler was using the wrong peekOffset for CArgumentGetter.
+          The default is 1, which assumes that you didn't push anything onto the
+          stack after getting called. The OSR exit thunks push FP, so the offset
+          should be 2.
+        
+        This passes stress tests and is probably huge performance regression if you
+        --useExperimentalFTL=true. The regression will be fixed in
+        https://bugs.webkit.org/show_bug.cgi?id=113621.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGlobalVarWatchpoint):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+
+2013-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        jsc shell should destroy VM as a workaround for LLVM's exit-time destructors
+        https://bugs.webkit.org/show_bug.cgi?id=120921
+
+        Reviewed by Oliver Hunt.
+        
+        LLVM's exit-time destructors will fire when we exit. If there is an on-going
+        FTL compile at exit, which will happen if the VM that triggered the compile
+        isn't shut down, then we will crash.
+        
+        We should get rid of LLVM's exit-time destructors. But before we do that, we
+        should just do a clean VM shutdown to suppress spurious crashes. This will
+        help in expanding LLVM coverage for now.
+
+        * jsc.cpp:
+        (jscmain):
+
+2013-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL ArithMod Int32Use doesn't check for negative zero correctly
+        https://bugs.webkit.org/show_bug.cgi?id=120905
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+
+2013-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL ArithNeg Int32Use doesn't check negative zero
+        https://bugs.webkit.org/show_bug.cgi?id=120900
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+
+2013-09-06  Anders Carlsson  <andersca@apple.com>
+
+        Stop using fastNew/fastDelete in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=120898
+
+        Reviewed by Oliver Hunt.
+
+        Change all the hash table members in ExecState to be OwnPtrs and use
+        adoptPtr instead. Also, since none of the hash tables can be null, change their getters
+        to return references and propagate the reference types wherever we know that a HashTable can't be null.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::arrayConstructorTable):
+        (JSC::ExecState::arrayPrototypeTable):
+        (JSC::ExecState::booleanPrototypeTable):
+        (JSC::ExecState::dataViewTable):
+        (JSC::ExecState::dateTable):
+        (JSC::ExecState::dateConstructorTable):
+        (JSC::ExecState::errorPrototypeTable):
+        (JSC::ExecState::globalObjectTable):
+        (JSC::ExecState::jsonTable):
+        (JSC::ExecState::numberConstructorTable):
+        (JSC::ExecState::numberPrototypeTable):
+        (JSC::ExecState::objectConstructorTable):
+        (JSC::ExecState::privateNamePrototypeTable):
+        (JSC::ExecState::regExpTable):
+        (JSC::ExecState::regExpConstructorTable):
+        (JSC::ExecState::regExpPrototypeTable):
+        (JSC::ExecState::stringConstructorTable):
+        (JSC::ExecState::promisePrototypeTable):
+        (JSC::ExecState::promiseConstructorTable):
+        (JSC::ExecState::promiseResolverPrototypeTable):
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::propHashTable):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+        (JSC::getStaticValueSlot):
+        (JSC::lookupPut):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h:
+
+2013-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Concurrent FTL causes !hasOptimizedReplacement() asserts in cti_optimize
+        https://bugs.webkit.org/show_bug.cgi?id=120890
+
+        Reviewed by Mark Hahnenberg.
+        
+        Don't install an FTL code block if the DFG code block has already been jettisoned.
+
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
+
+2013-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(149636, merged in 153145): ToThis conversion doesn't work in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=120781
+
+        Reviewed by Mark Hahnenberg.
+        
+        Roll this back in with a build fix.
+        
+        - Use some method table hacks to detect if the CheckStructure optimization is
+          valid for to_this.
+        
+        - Introduce a FinalObjectUse and use it for ToThis->Identity conversion.
+        
+        This looks like it might be perf-neutral on the major benchmarks, but it
+        introduces some horrible performance cliffs. For example if you add methods to
+        the Array prototype, you'll get horrible performance cliffs. As in virtual calls
+        to C++ every time you call a JS function even if it's inlined.
+        LongSpider/3d-cube appears to hit this.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::emitPutTransitionStub):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateFinalObject):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+
+2013-09-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Introduce a way to run benchmarks and JSRegress as stress tests with different jsc command-line options
+        https://bugs.webkit.org/show_bug.cgi?id=120808
+
+        Reviewed by Mark Hahnenberg and rubber stamped by Geoffrey Garen.
+        
+        Allow --useExperimentalFTL=true even if FTL isn't built since this simplifies
+        testing.
+
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+
+2013-09-06  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed build fix for the GTK port when building with FTL JIT enabled.
+
+        * GNUmakefile.list.am: Add the missing files to the build.
+
+2013-09-05  Oliver Hunt  <oliver@apple.com>
+
+        Make it simpler to introduce new data types to the global object
+        https://bugs.webkit.org/show_bug.cgi?id=120801
+
+        Reviewed by Gavin Barraclough.
+
+        Add an iterator macro that lists all the "simple" ES types (e.g. type
+        consists of instance, constructor, and prototype classes).  So that
+        we don't need to have every new type litter JSGlobalObject.{cpp,h} with
+        members, accessors, and manual GC visiting.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+
+2013-09-05  Mark Rowe  <mrowe@apple.com>
+        
+        Roll out r155149 since it broke the build.
+
+2013-09-05  Michael Saboff  <msaboff@apple.com>
+
+        Cleanup formatting of byte code debug output
+        Source/JavaScriptCore/ChangeLog
+
+        Rubber stamped by Filip Pizlo.
+
+        Put the formatting of the byte code offset and operation into one common function to
+        simplify and unify formatting.  Changed CodeBlock::registerName() to return
+        "thist" for argument register 0, "argN" for other argument registers and "locN" for
+        local registers.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::printLocationAndOp):
+        (JSC::CodeBlock::printLocationOpAndRegisterOperand):
+
+2013-09-05  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(149636, merged in 153145): ToThis conversion doesn't work in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=120781
+
+        Reviewed by Mark Hahnenberg.
+        
+        - Use some method table hacks to detect if the CheckStructure optimization is
+          valid for to_this.
+        
+        - Introduce a FinalObjectUse and use it for ToThis->Identity conversion.
+        
+        This looks like it might be perf-neutral on the major benchmarks, but it
+        introduces some horrible performance cliffs. For example if you add methods to
+        the Array prototype, you'll get horrible performance cliffs. As in virtual calls
+        to C++ every time you call a JS function even if it's inlined.
+        LongSpider/3d-cube appears to hit this.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateFinalObject):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+
+2013-09-05  Anders Carlsson  <andersca@apple.com>
+
+        GCAssertions.h should use STL type traits and static_assert
+        https://bugs.webkit.org/show_bug.cgi?id=120785
+
+        Reviewed by Andreas Kling.
+
+        There's no need to rely on compiler specific support to figure out if a class is trivially destructable,
+        we can just use type traits from STL. Do this, fix the assert macro to use static_assert directly and
+        rename it from ASSERT_HAS_TRIVIAL_DESTRUCTOR to STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE to clarify that
+        it's a static assert and to match the STL nomenclature.
+        
+        * API/JSCallbackFunction.cpp:
+        * debugger/DebuggerActivation.cpp:
+        * heap/GCAssertions.h:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanObject.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/GetterSetter.cpp:
+        * runtime/InternalFunction.cpp:
+        * runtime/JSAPIValueWrapper.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSCell.cpp:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.cpp:
+        * runtime/JSPromiseConstructor.cpp:
+        * runtime/JSPromisePrototype.cpp:
+        * runtime/JSPromiseResolverConstructor.cpp:
+        * runtime/JSPromiseResolverPrototype.cpp:
+        * runtime/JSProxy.cpp:
+        * runtime/JSScope.cpp:
+        * runtime/JSWrapperObject.cpp:
+        * runtime/MathObject.cpp:
+        * runtime/NameConstructor.cpp:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/StrictEvalActivation.cpp:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/StringPrototype.cpp:
+
+2013-09-05  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix for DebugSuffix target.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Don't build 64-bit assembly in 32-bit build.
+        Also correct 'filters' file so that files appear in categories that match their on-disk locations.
+
+2013-09-04  Filip Pizlo  <fpizlo@apple.com>
+
+        jsc tests should have timeouts
+        https://bugs.webkit.org/show_bug.cgi?id=120725
+
+        Reviewed by Geoffrey Garen.
+        
+        Add the timeout logic directly to 'jsc' because that's easier to do than
+        writing shell/perl code for it.
+
+        * jsc.cpp:
+        (timeoutThreadMain):
+        (main):
+
+2013-09-04  Filip Pizlo  <fpizlo@apple.com>
+
+        fast/js/dfg-* tests should wait for the concurrent JIT
+        https://bugs.webkit.org/show_bug.cgi?id=120723
+
+        Reviewed by Geoffrey Garen.
+        
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::numberOfDFGCompiles): This should also handle constructors.
+
+2013-09-04  Filip Pizlo  <fpizlo@apple.com>
+
+        run-fast-jsc should work with new-school fast/js tests that loop until the DFG tiers up
+        https://bugs.webkit.org/show_bug.cgi?id=120697
+
+        Reviewed by Mark Hahnenberg.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::numberOfDFGCompiles):
+        (JSC::setNeverInline):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionNeverInlineFunction):
+        (functionNumberOfDFGCompiles):
+        * runtime/TestRunnerUtils.cpp: Added.
+        (JSC::getExecutable):
+        (JSC::numberOfDFGCompiles):
+        (JSC::setNeverInline):
+        * runtime/TestRunnerUtils.h: Added.
+
+2013-09-04  Mark Lam  <mark.lam@apple.com>
+
+        Renamed StackIterator to StackVisitor.
+        https://bugs.webkit.org/show_bug.cgi?id=120706.
+
+        Reviewed by Geoffrey Garen.
+
+        Also did some minor refactoring:
+        - Renamed StackIterator::iterate() to StackVisitor::visit().
+        - Make StackVisitor::visit() a static method.
+        - Move the instantiation of the StackVisitor instance into StackVisitor::visit()
+          from CallFrame::iterate().
+        - Removed StackIterator::resetIterator() and inline its body into the
+          StackVisitor constructor since this is the only remaining caller of it.
+
+        * API/JSContextRef.cpp:
+        (BacktraceFunctor::operator()):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::iterate):
+        * interpreter/Interpreter.cpp:
+        (JSC::DumpRegisterFunctor::operator()):
+        (JSC::unwindCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::UnwindFunctor::operator()):
+        * interpreter/Interpreter.h:
+        * interpreter/StackIterator.cpp: Removed.
+        * interpreter/StackIterator.h: Removed.
+        * interpreter/StackVisitor.cpp: Copied from Source/JavaScriptCore/interpreter/StackIterator.cpp.
+        (JSC::StackVisitor::StackVisitor):
+        (JSC::StackVisitor::gotoNextFrame):
+        (JSC::StackVisitor::readFrame):
+        (JSC::StackVisitor::readNonInlinedFrame):
+        (JSC::StackVisitor::readInlinedFrame):
+        (JSC::StackVisitor::Frame::codeType):
+        (JSC::StackVisitor::Frame::functionName):
+        (JSC::StackVisitor::Frame::sourceURL):
+        (JSC::StackVisitor::Frame::toString):
+        (JSC::StackVisitor::Frame::arguments):
+        (JSC::StackVisitor::Frame::computeLineAndColumn):
+        (JSC::StackVisitor::Frame::retrieveExpressionInfo):
+        (JSC::StackVisitor::Frame::setToEnd):
+        (JSC::StackVisitor::Frame::print):
+        (DebugPrintFrameFunctor::operator()):
+        * interpreter/StackVisitor.h: Copied from Source/JavaScriptCore/interpreter/StackIterator.h.
+        (JSC::StackVisitor::visit):
+        * jsc.cpp:
+        (FunctionJSCStackFunctor::operator()):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::AddParentForConsoleStartFunctor::operator()):
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveArgumentsFunctor::operator()):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::GlobalFuncProtoGetterFunctor::operator()):
+        (JSC::GlobalFuncProtoSetterFunctor::operator()):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+
+2013-09-04  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed Build fix for Windows DebugSuffix configuration.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2013-09-04  Mark Lam  <mark.lam@apple.com>
+
+        Refining the StackIterator callback interface.
+        https://bugs.webkit.org/show_bug.cgi?id=120695.
+
+        Reviewed by Geoffrey Garen.
+
+        Introduce CallFrame::iterate() which instantiates a StackIterator and
+        invoke its iterate() method with the passed in functor. The only place
+        where the client code gets access to the StackIterator now is as an
+        argument to the client's functor.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * interpreter/CallFrame.cpp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::iterate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::unwind):
+        * interpreter/StackIterator.cpp:
+        (JSC::StackIterator::StackIterator):
+        (DebugPrintFrameFunctor::DebugPrintFrameFunctor):
+        (DebugPrintFrameFunctor::operator()):
+        (debugPrintCallFrame):
+        (debugPrintStack):
+        * interpreter/StackIterator.h:
+        (JSC::StackIterator::iterate):
+        * jsc.cpp:
+        (functionJSCStack):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * runtime/JSFunction.cpp:
+        (JSC::retrieveArguments):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        (JSC::retrieveCallerFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+
+2013-09-04  Benjamin Poulain  <benjamin@webkit.org>
+
+        JSGenericTypedArrayViewConstructor.h is referenced twice in the XCode project build section, causing warnings
+        https://bugs.webkit.org/show_bug.cgi?id=120698
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-09-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        ASSERT in MarkedAllocator::allocateSlowCase is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=120639
+
+        Reviewed by Oliver Hunt.
+
+        ASSERT(!m_heap->shouldCollect()) is no longer true due to our use of the GC 
+        deferral mechanism. We could technically be beyond our byte allocation limit, 
+        but still not try to collect due to deferral. This patch amends shouldCollect() 
+        to return false if GC is currently deferred.
+
+        * heap/Heap.h:
+        (JSC::Heap::shouldCollect):
+
+2013-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        The DFG should be able to tier-up and OSR enter into the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=112838
+
+        Reviewed by Mark Hahnenberg.
+        
+        This adds the ability for the DFG to tier-up into the FTL. This works in both
+        of the expected tier-up modes:
+        
+        Replacement: frequently called functions eventually have their entrypoint
+        replaced with one that goes into FTL-compiled code. Note, this will be a
+        slow-down for now since we don't yet have LLVM calling convention integration.
+        
+        OSR entry: code stuck in hot loops gets OSR'd into the FTL from the DFG.
+        
+        This means that if the DFG detects that a function is an FTL candidate, it
+        inserts execution counting code similar to the kind that the baseline JIT
+        would use. If you trip on a loop count in a loop header that is an OSR
+        candidate (it's not an inlined loop), we do OSR; otherwise we do replacement.
+        OSR almost always also implies future replacement.
+        
+        OSR entry into the FTL is really cool. It uses a specialized FTL compile of
+        the code, where early in the DFG pipeline we replace the original root block
+        with an OSR entrypoint block that jumps to the pre-header of the hot loop.
+        The OSR entrypoint loads all live state at the loop pre-header using loads
+        from a scratch buffer, which gets populated by the runtime's OSR entry
+        preparation code (FTL::prepareOSREntry()). This approach appears to work well
+        with all of our subsequent optimizations, including prediction propagation,
+        CFA, and LICM. LLVM seems happy with it, too. Best of all, it works naturally
+        with concurrent compilation: when we hit the tier-up trigger we spawn a
+        compilation plan at the bytecode index from which we triggered; once the
+        compilation finishes the next trigger will try to enter, at that bytecode
+        index. If it can't - for example because the code has moved on to another
+        loop - then we just try again. Loops that get hot enough for OSR entry (about
+        25,000 iterations) will probably still be running when a concurrent compile
+        finishes, so this doesn't appear to be a big problem.
+        
+        This immediately gives us a 70% speed-up on imaging-gaussian-blur. We could
+        get a bigger speed-up by adding some more intelligence and tweaking LLVM to
+        compile code faster. Those things will happen eventually but this is a good
+        start. Probably this code will see more tuning as we get more coverage in the
+        FTL JIT, but I'll worry about that in future patches.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        (JSC::DFG::compile):
+        * dfg/DFGDriver.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::killBlockAndItsContents):
+        (JSC::DFG::Graph::killUnreachableBlocks):
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        (JSC::DFG::JITCode::checkIfOptimizationThresholdReached):
+        (JSC::DFG::JITCode::optimizeNextInvocation):
+        (JSC::DFG::JITCode::dontOptimizeAnytimeSoon):
+        (JSC::DFG::JITCode::optimizeAfterWarmUp):
+        (JSC::DFG::JITCode::optimizeSoon):
+        (JSC::DFG::JITCode::forceOptimizationSlowPathConcurrently):
+        (JSC::DFG::JITCode::setOptimizationThresholdBasedOnCompilationResult):
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+        (JSC::DFG::LoopPreHeaderCreationPhase::run):
+        * dfg/DFGLoopPreHeaderCreationPhase.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasUnlinkedLocal):
+        (JSC::DFG::Node::unlinkedLocal):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntrypointCreationPhase.cpp: Added.
+        (JSC::DFG::OSREntrypointCreationPhase::OSREntrypointCreationPhase):
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        (JSC::DFG::performOSREntrypointCreation):
+        * dfg/DFGOSREntrypointCreationPhase.h: Added.
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp: Added.
+        (JSC::DFG::TierUpCheckInjectionPhase::TierUpCheckInjectionPhase):
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        (JSC::DFG::performTierUpCheckInjection):
+        * dfg/DFGTierUpCheckInjectionPhase.h: Added.
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp: Added.
+        (JSC::DFG::ToFTLDeferredCompilationCallback::ToFTLDeferredCompilationCallback):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::~ToFTLDeferredCompilationCallback):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::create):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
+        * dfg/DFGToFTLDeferredCompilationCallback.h: Added.
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp: Added.
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::~ToFTLForOSREntryDeferredCompilationCallback):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::create):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h: Added.
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::globalWorklist):
+        * dfg/DFGWorklist.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCapabilities.h:
+        * ftl/FTLForOSREntryJITCode.cpp: Added.
+        (JSC::FTL::ForOSREntryJITCode::ForOSREntryJITCode):
+        (JSC::FTL::ForOSREntryJITCode::~ForOSREntryJITCode):
+        (JSC::FTL::ForOSREntryJITCode::ftlForOSREntry):
+        (JSC::FTL::ForOSREntryJITCode::initializeEntryBuffer):
+        * ftl/FTLForOSREntryJITCode.h: Added.
+        (JSC::FTL::ForOSREntryJITCode::entryBuffer):
+        (JSC::FTL::ForOSREntryJITCode::setBytecodeIndex):
+        (JSC::FTL::ForOSREntryJITCode::bytecodeIndex):
+        (JSC::FTL::ForOSREntryJITCode::countEntryFailure):
+        (JSC::FTL::ForOSREntryJITCode::entryFailureCount):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileExtractOSREntryLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+        (JSC::FTL::LowerDFGToLLVM::addWeakReference):
+        * ftl/FTLOSREntry.cpp: Added.
+        (JSC::FTL::prepareOSREntry):
+        * ftl/FTLOSREntry.h: Added.
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::crashNonTerminal):
+        (JSC::FTL::Output::crash):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * interpreter/Register.h:
+        (JSC::Register::unboxedDouble):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitEnterOptimizationCheck):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::ftlForOSREntry):
+        * jit/JITCode.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::ensureWorklist):
+        * runtime/VM.h:
+
+2013-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock memory cost reporting should be rationalized
+        https://bugs.webkit.org/show_bug.cgi?id=120615
+
+        Reviewed by Darin Adler.
+        
+        Report the size of the instruction stream, and then remind the GC that we're
+        using memory when we trace.
+        
+        This is a slight slow-down on some JSBench tests because it makes us GC a
+        bit more frequently. But I think it's well worth it; if we really want those
+        tests to GC less frequently then we can achieve that through other kinds of
+        tuning. It's better that the GC knows that CodeBlocks do in fact use memory;
+        what it does with that information is a somewhat orthogonal question.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+
+2013-09-03  Mark Lam  <mark.lam@apple.com>
+
+        Converting StackIterator to a callback interface.
+        https://bugs.webkit.org/show_bug.cgi?id=120564.
+
+        Reviewed by Filip Pizlo.
+
+        * API/JSContextRef.cpp:
+        (BacktraceFunctor::BacktraceFunctor):
+        (BacktraceFunctor::operator()):
+        (JSContextCreateBacktrace):
+        * interpreter/CallFrame.cpp:
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::DumpRegisterFunctor::DumpRegisterFunctor):
+        (JSC::DumpRegisterFunctor::operator()):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::unwindCallFrame):
+        (JSC::GetStackTraceFunctor::GetStackTraceFunctor):
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::stackTraceAsString):
+        (JSC::UnwindFunctor::UnwindFunctor):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::unwind):
+        * interpreter/Interpreter.h:
+        * interpreter/StackIterator.cpp:
+        (JSC::StackIterator::numberOfFrames):
+        (JSC::StackIterator::gotoFrameAtIndex):
+        (JSC::StackIterator::gotoNextFrameWithFilter):
+        (JSC::StackIterator::resetIterator):
+        (JSC::StackIterator::Frame::print):
+        (debugPrintCallFrame):
+        (DebugPrintStackFunctor::operator()):
+        (debugPrintStack): Added for debugging convenience.
+        * interpreter/StackIterator.h:
+        (JSC::StackIterator::Frame::index):
+        (JSC::StackIterator::iterate):
+        * jsc.cpp:
+        (FunctionJSCStackFunctor::FunctionJSCStackFunctor):
+        (FunctionJSCStackFunctor::operator()):
+        (functionJSCStack):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::AddParentForConsoleStartFunctor::AddParentForConsoleStartFunctor):
+        (JSC::AddParentForConsoleStartFunctor::foundParent):
+        (JSC::AddParentForConsoleStartFunctor::operator()):
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveArgumentsFunctor::RetrieveArgumentsFunctor):
+        (JSC::RetrieveArgumentsFunctor::result):
+        (JSC::RetrieveArgumentsFunctor::operator()):
+        (JSC::retrieveArguments):
+        (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
+        (JSC::RetrieveCallerFunctionFunctor::result):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        (JSC::retrieveCallerFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
+        (JSC::GlobalFuncProtoGetterFunctor::result):
+        (JSC::GlobalFuncProtoGetterFunctor::operator()):
+        (JSC::globalFuncProtoGetter):
+        (JSC::GlobalFuncProtoSetterFunctor::GlobalFuncProtoSetterFunctor):
+        (JSC::GlobalFuncProtoSetterFunctor::allowsAccess):
+        (JSC::GlobalFuncProtoSetterFunctor::operator()):
+        (JSC::globalFuncProtoSetter):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::result):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+        (JSC::objectConstructorGetPrototypeOf):
+
+2013-09-03  Oliver Hunt  <oliver@apple.com>
+
+        Support structured clone of Map and Set
+        https://bugs.webkit.org/show_bug.cgi?id=120654
+
+        Reviewed by Simon Fraser.
+
+        Make xcode copy the required headers, and add appropriate export attributes
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSMap.h:
+        * runtime/JSSet.h:
+        * runtime/MapData.h:
+
+2013-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Support the "json" responseType and JSON response entity in XHR
+        https://bugs.webkit.org/show_bug.cgi?id=73648
+
+        Reviewed by Oliver Hunt.
+
+        Based on the patch written by Jarred Nicholls.
+
+        Add JSC::JSONParse. This function will be used in XMLHttpRequest.response of type 'json'.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONParse):
+        * runtime/JSONObject.h:
+
+2013-09-02  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock::jettison() should be implicit
+        https://bugs.webkit.org/show_bug.cgi?id=120567
+
+        Reviewed by Oliver Hunt.
+        
+        This is a risky change from a performance standpoint, but I believe it's
+        necessary. This makes all CodeBlocks get swept by GC. Nobody but the GC
+        can delete CodeBlocks because the GC always holds a reference to them.
+        Once a CodeBlock reaches just one reference (i.e. the one from the GC)
+        then the GC will free it only if it's not on the stack.
+        
+        This allows me to get rid of the jettisoning logic. We need this for FTL
+        tier-up. Well; we don't need it, but it will help prevent a lot of bugs.
+        Previously, if you wanted to to replace one code block with another, you
+        had to remember to tell the GC that the previous code block is
+        "jettisoned". We would need to do this when tiering up from DFG to FTL
+        and when dealing with DFG-to-FTL OSR entry code blocks. There are a lot
+        of permutations here - tiering up to the FTL, OSR entering into the FTL,
+        deciding that an OSR entry code block is not relevant anymore - just to
+        name a few. In each of these cases we'd have to jettison the previous
+        code block. It smells like a huge source of future bugs.
+        
+        So I made jettisoning implicit by making the GC always watch out for a
+        CodeBlock being owned solely by the GC.
+        
+        This change is performance neutral.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
+        (JSC::CodeBlockSet::mark):
+        * dfg/DFGCommonData.h:
+        (JSC::DFG::CommonData::CommonData):
+        * heap/CodeBlockSet.cpp: Added.
+        (JSC::CodeBlockSet::CodeBlockSet):
+        (JSC::CodeBlockSet::~CodeBlockSet):
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::clearMarks):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        (JSC::CodeBlockSet::traceMarked):
+        * heap/CodeBlockSet.h: Added.
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::add):
+        * heap/ConservativeRoots.h:
+        * heap/DFGCodeBlocks.cpp: Removed.
+        * heap/DFGCodeBlocks.h: Removed.
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::deleteAllCompiledCode):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        * heap/Heap.h:
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::gatherConservativeRoots):
+        * interpreter/JSStack.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode):
+        * runtime/Executable.h:
+        * runtime/VM.h:
+
+2013-09-02  Darin Adler  <darin@apple.com>
+
+        [Mac] No need for HardAutorelease, which is same as CFBridgingRelease
+        https://bugs.webkit.org/show_bug.cgi?id=120569
+
+        Reviewed by Andy Estes.
+
+        * API/JSValue.mm:
+        (valueToString): Use CFBridgingRelease.
+
+2013-08-30  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock refactoring broke profile dumping
+        https://bugs.webkit.org/show_bug.cgi?id=120551
+
+        Reviewed by Michael Saboff.
+        
+        Fix the bug, and did a big clean-up of how Executable returns CodeBlocks. A lot
+        of the problems we have with code like CodeBlock::baselineVersion() is that we
+        were trying *way too hard* to side-step the fact that Executable can't return a
+        CodeBlock*. Previously it could only return CodeBlock&, so if it didn't have a
+        CodeBlock yet, you were screwed. And if you didn't know, or weren't sure, if it
+        did have a CodeBlock, you were really going to have a bad time. Also it really
+        bugs me that the methods were called generatedBytecode(). In all other contexts
+        if you ask for a CodeBlock, then method to call is codeBlock(). So I made all
+        of those changes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::ProgramCodeBlock::replacement):
+        (JSC::EvalCodeBlock::replacement):
+        (JSC::FunctionCodeBlock::replacement):
+        (JSC::CodeBlock::globalObjectFor):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::hash):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::isExecutableScript):
+        (JSC::JITCode::isLowerTier):
+        * jit/JITStubs.cpp:
+        (JSC::lazyLinkFor):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::codeBlock):
+        (JSC::ProgramExecutable::codeBlock):
+        (JSC::FunctionExecutable::eitherCodeBlock):
+        (JSC::FunctionExecutable::codeBlockForCall):
+        (JSC::FunctionExecutable::codeBlockForConstruct):
+        (JSC::FunctionExecutable::codeBlockFor):
+        * runtime/FunctionExecutableDump.cpp:
+        (JSC::FunctionExecutableDump::dump):
+
+2013-08-30  Oliver Hunt  <oliver@apple.com>
+
+        Implement ES6 Set class
+        https://bugs.webkit.org/show_bug.cgi?id=120549
+
+        Reviewed by Filip Pizlo.
+
+        We simply reuse the MapData type from JSMap making the
+        it much simpler.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setStructure):
+        * runtime/JSSet.cpp: Added.
+        (JSC::JSSet::visitChildren):
+        (JSC::JSSet::finishCreation):
+        * runtime/JSSet.h: Added.
+        (JSC::JSSet::createStructure):
+        (JSC::JSSet::create):
+        (JSC::JSSet::mapData):
+        (JSC::JSSet::JSSet):
+        * runtime/SetConstructor.cpp: Added.
+        (JSC::SetConstructor::finishCreation):
+        (JSC::callSet):
+        (JSC::constructSet):
+        (JSC::SetConstructor::getConstructData):
+        (JSC::SetConstructor::getCallData):
+        * runtime/SetConstructor.h: Added.
+        (JSC::SetConstructor::create):
+        (JSC::SetConstructor::createStructure):
+        (JSC::SetConstructor::SetConstructor):
+        * runtime/SetPrototype.cpp: Added.
+        (JSC::SetPrototype::finishCreation):
+        (JSC::getMapData):
+        (JSC::setProtoFuncAdd):
+        (JSC::setProtoFuncClear):
+        (JSC::setProtoFuncDelete):
+        (JSC::setProtoFuncForEach):
+        (JSC::setProtoFuncHas):
+        (JSC::setProtoFuncSize):
+        * runtime/SetPrototype.h: Added.
+        (JSC::SetPrototype::create):
+        (JSC::SetPrototype::createStructure):
+        (JSC::SetPrototype::SetPrototype):
+
+2013-08-30  Oliver Hunt  <oliver@apple.com>
+
+        Make JSValue bool conversion less dangerous
+        https://bugs.webkit.org/show_bug.cgi?id=120505
+
+        Reviewed by Darin Adler.
+
+        Replaces JSValue::operator bool() with a operator UnspecifiedBoolType* as
+        we do elsewhere.  Then fix the places where terrible type coercion was
+        happening.  All of the changes made had no fundamental behavioural impact
+        as they were coercion results that were ignored (returning undefined 
+        after an exception).  
+
+        * dfg/DFGOperations.cpp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hadException):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::operator UnspecifiedBoolType*):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::equalTo)
+
+2013-08-30  Chris Curtis  <chris_curtis@apple.com>
+
+        Cleaning errorDescriptionForValue after r154839
+        https://bugs.webkit.org/show_bug.cgi?id=120531
+        
+        Reviewed by Darin Adler.
+        
+        Changed the assert to ASSERT_NOT_REACHED, now that r154839 has landed. errorDescriptionForValue 
+        can assert again that the parameterized JSValue is !isEmpty().
+        
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue):
+
+2013-08-30  Antti Koivisto  <antti@apple.com>
+
+        Remove code behind ENABLE(DIALOG_ELEMENT)
+        https://bugs.webkit.org/show_bug.cgi?id=120467
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-08-29  Andreas Kling  <akling@apple.com>
+
+        De-bork Qt build.
+
+        * Target.pri:
+
+2013-08-29  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix attempt for Windows.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        Renamed JSMapConstructor and JSMapPrototype.
+
+2013-08-29  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Fix build break after r154861
+        https://bugs.webkit.org/show_bug.cgi?id=120503
+
+        Reviewed by Geoffrey Garen.
+
+        Unreviewed build fix attempt for GTK, Qt Windows and CMake based ports.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * Target.pri:
+        * runtime/MapData.h:
+        (JSC::MapData::KeyType::KeyType):
+
+2013-08-29  Andreas Kling  <akling@apple.com>
+
+        CodeBlock: LLIntCallLinkInfo vector can be sized-to-fit at creation.
+        <https://webkit.org/b/120487>
+
+        Reviewed by Oliver Hunt.
+
+        CodeBlock::m_llintCallLinkInfos never changes size after creation, so make it a Vector
+        instead of a SegmentedVector. Use resizeToFit() instead of grow() since we know the
+        exact amount of space needed.
+
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+
+2013-08-29  Oliver Hunt  <oliver@apple.com>
+
+        Fix issues found by MSVC (which also happily fixes an unintentional pessimisation)
+
+        * runtime/MapData.h:
+        (JSC::MapData::KeyType::KeyType):
+
+2013-08-29  Oliver Hunt  <oliver@apple.com>
+
+
+        Implement ES6 Map object
+        https://bugs.webkit.org/show_bug.cgi?id=120333
+
+        Reviewed by Geoffrey Garen.
+
+        Implement support for the ES6 Map type and related classes.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopyToken.h: Add a new token to track copying the backing store
+        * runtime/CommonIdentifiers.h: Add new identifiers
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+            Add new structures and prototypes
+
+        * runtime/JSMap.cpp: Added.
+        * runtime/JSMap.h: Added.
+            New JSMap class to represent a Map instance
+
+        * runtime/MapConstructor.cpp: Added.
+        * runtime/MapConstructor.h: Added.
+            The Map constructor
+
+        * runtime/MapData.cpp: Added.
+        * runtime/MapData.h: Added.
+            The most interesting data structure.  The roughly corresponds
+            to the ES6 notion of MapData.  It provides the core JSValue->JSValue
+            map implementation.  We implement it using 2 hashtables and a flat
+            table.  Due to the different semantics of string comparisons vs.
+            all others we need have one map keyed by String and the other by
+            generic JSValue.  The actual table is represented more or less
+            exactly as described in the ES6 draft - a single contiguous list of
+            key/value pairs.  The entire map could be achieved with just this
+            table, however we need the HashMaps in order to maintain O(1) lookup.
+
+            Deleted values are simply cleared as the draft says, however the
+            implementation compacts the storage on copy as long as the are no
+            active iterators.
+
+        * runtime/MapPrototype.cpp: Added.
+        * runtime/MapPrototype.h: Added.
+            Implement Map prototype functions
+
+        * runtime/VM.cpp:
+            Add new structures.
+
+2013-08-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Teach DFG::Worklist and its clients that it may be reused for different kinds of compilations
+        https://bugs.webkit.org/show_bug.cgi?id=120489
+
+        Reviewed by Geoffrey Garen.
+        
+        If the baseline JIT hits an OSR entry trigger into the DFG and we already have a
+        DFG compilation but we've also started one or more FTL compilations, then we
+        shouldn't get confused. Previously we would have gotten confused because we would
+        see an in-process deferred compile (the FTL compile) and also an optimized
+        replacement (the DFG code).
+        
+        If the baseline JIT hits an OSR entry trigger into the DFG and we previously
+        did two things in this order: triggered a tier-up compilation from the DFG into
+        the FTL, and then jettisoned the DFG code because it exited a bunch, then we
+        shouldn't be confused by the presence of an in-process deferred compile (the FTL
+        compile). Previously we would have waited for that compile to finish; but the more
+        sensible thing to do is to let it complete and then invalidate it, while at the
+        same time enqueueing a DFG compile to create a new, more valid, DFG code block.
+        
+        If the DFG JIT hits a loop OSR entry trigger (into the FTL) and it has already
+        triggered an FTL compile for replacement, then it should fire off a second compile
+        instead of thinking that it can wait for that one to finish. Or vice-versa. We
+        need to allow for two FTL compiles to be enqueued at the same time (one for
+        replacement and one for OSR entry in a loop).
+        
+        Then there's also the problem that DFG::compile() is almost certainly going to be
+        the hook for triggering both DFG compiles and the two kinds of FTL compiles, but
+        right now there is no way to tell it which one you want.
+        
+        This fixes these problems and removes a bunch of potential confusion by making the
+        key for a compile in the DFG::Worklist be a CompilationMode (one of DFGMode,
+        FTLMode, or FTLForOSREntryMode). That mode is also passed to DFG::compile().
+        
+        Awkwardly, this still leaves us in a no DFG->FTL tier-up situation - so
+        DFG::compile() is always passed DFGMode and then it might do an FTL compile if
+        possible. Fixing that is a bigger issue for a later changeset.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached):
+        * dfg/DFGCompilationKey.cpp: Added.
+        (JSC::DFG::CompilationKey::dump):
+        * dfg/DFGCompilationKey.h: Added.
+        (JSC::DFG::CompilationKey::CompilationKey):
+        (JSC::DFG::CompilationKey::operator!):
+        (JSC::DFG::CompilationKey::isHashTableDeletedValue):
+        (JSC::DFG::CompilationKey::profiledBlock):
+        (JSC::DFG::CompilationKey::mode):
+        (JSC::DFG::CompilationKey::operator==):
+        (JSC::DFG::CompilationKey::hash):
+        (JSC::DFG::CompilationKeyHash::hash):
+        (JSC::DFG::CompilationKeyHash::equal):
+        * dfg/DFGCompilationMode.cpp: Added.
+        (WTF::printInternal):
+        * dfg/DFGCompilationMode.h: Added.
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        (JSC::DFG::compile):
+        * dfg/DFGDriver.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::key):
+        * dfg/DFGPlan.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::enqueue):
+        (JSC::DFG::Worklist::compilationState):
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::runThread):
+        * dfg/DFGWorklist.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2013-08-29  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix after r154847.
+        If you are going to exclude promises, actually exclude the build components.
+
+        * interpreter/CallFrame.h: Exclude promise declarations
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset): Exclude promise code.
+        (JSC::JSGlobalObject::visitChildren): Ditto.
+        * runtime/VM.cpp: Ditto.
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h:
+
+2013-08-29  Sam Weinig  <sam@webkit.org>
+
+        Add ENABLE guards for Promises
+        https://bugs.webkit.org/show_bug.cgi?id=120488
+
+        Reviewed by Andreas Kling.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSPromise.cpp:
+        * runtime/JSPromise.h:
+        * runtime/JSPromiseCallback.cpp:
+        * runtime/JSPromiseCallback.h:
+        * runtime/JSPromiseConstructor.cpp:
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromisePrototype.cpp:
+        * runtime/JSPromisePrototype.h:
+        * runtime/JSPromiseResolver.cpp:
+        * runtime/JSPromiseResolver.h:
+        * runtime/JSPromiseResolverConstructor.cpp:
+        * runtime/JSPromiseResolverConstructor.h:
+        * runtime/JSPromiseResolverPrototype.cpp:
+        * runtime/JSPromiseResolverPrototype.h:
+
+2013-08-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix FTL build.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::callCheck):
+
+2013-08-29  Julien Brianceau  <jbriance@cisco.com>
+
+        REGRESSION(r153222, 32-bit): NULL JSValue() seen when running peacekeeper benchmark.
+        https://bugs.webkit.org/show_bug.cgi?id=120080
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_argument_by_val): Revert changes introduced by r153222 in this function.
+
+2013-08-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Kill code that became dead after http://trac.webkit.org/changeset/154833
+
+        Rubber stamped by Oliver Hunt.
+
+        * dfg/DFGDriver.h:
+
+2013-08-29  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock's magic for scaling tier-up thresholds should be more reusable
+        https://bugs.webkit.org/show_bug.cgi?id=120486
+
+        Reviewed by Oliver Hunt.
+        
+        Removed the counterValueForBlah() methods and exposed the reusable scaling logic
+        as a adjustedCounterValue() method.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::adjustedCounterValue):
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::optimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::handleExitCounts):
+
+2013-08-29  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock::prepareForExecution() is silly
+        https://bugs.webkit.org/show_bug.cgi?id=120453
+
+        Reviewed by Oliver Hunt.
+        
+        Instead of saying:
+        
+            codeBlock->prepareForExecution(stuff, BaselineJIT, more stuff)
+        
+        we should just say:
+        
+            JIT::compile(stuff, codeBlock, more stuff);
+        
+        And similarly for the LLInt and DFG.
+        
+        This kills a bunch of code, since CodeBlock::prepareForExecution() is just a
+        wrapper that uses the JITType argument to call into the appropriate execution
+        engine, which is what the user wanted to do in the first place.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        (JSC::DFG::compile):
+        * dfg/DFGDriver.h:
+        (JSC::DFG::tryCompile):
+        * dfg/DFGOSRExitPreparation.cpp:
+        (JSC::DFG::prepareCodeOriginForOSRExit):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::globalWorklist):
+        * dfg/DFGWorklist.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntEntrypoint.cpp: Copied from Source/JavaScriptCore/llint/LLIntEntrypoints.cpp.
+        (JSC::LLInt::setFunctionEntrypoint):
+        (JSC::LLInt::setEvalEntrypoint):
+        (JSC::LLInt::setProgramEntrypoint):
+        (JSC::LLInt::setEntrypoint):
+        * llint/LLIntEntrypoint.h: Copied from Source/JavaScriptCore/llint/LLIntEntrypoints.h.
+        * llint/LLIntEntrypoints.cpp: Removed.
+        * llint/LLIntEntrypoints.h: Removed.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+
+2013-08-29  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fixed broken non-DFG build.
+        https://bugs.webkit.org/show_bug.cgi?id=120481.
+
+        Not reviewed.
+
+        * interpreter/StackIterator.h:
+
+2013-08-29  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock compilation and installation should be simplified and rationalized
+        https://bugs.webkit.org/show_bug.cgi?id=120326
+
+        Reviewed by Oliver Hunt.
+        
+        Rolling r154804 back in after fixing no-LLInt build.
+        
+        Previously Executable owned the code for generating JIT code; you always had
+        to go through Executable. But often you also had to go through CodeBlock,
+        because ScriptExecutable couldn't have virtual methods, but CodeBlock could.
+        So you'd ask CodeBlock to do something, which would dispatch through a
+        virtual method that would select the appropriate Executable subtype's method.
+        This all meant that the same code would often be duplicated, because most of
+        the work needed to compile something was identical regardless of code type.
+        But then we tried to fix this, by having templatized helpers in
+        ExecutionHarness.h and JITDriver.h. The result was that if you wanted to find
+        out what happened when you asked for something to be compiled, you'd go on a
+        wild ride that started with CodeBlock, touched upon Executable, and then
+        ricocheted into either ExecutionHarness or JITDriver (likely both).
+        
+        Another awkwardness was that for concurrent compiles, the DFG::Worklist had
+        super-special inside knowledge of what JITStubs.cpp's cti_optimize would have
+        done once the compilation finished.
+        
+        Also, most of the DFG JIT drivers assumed that they couldn't install the
+        JITCode into the CodeBlock directly - instead they would return it via a
+        reference, which happened to be a reference to the JITCode pointer in
+        Executable. This was super weird.
+        
+        Finally, there was no notion of compiling code into a special CodeBlock that
+        wasn't used for handling calls into an Executable. I'd like this for FTL OSR
+        entry.
+        
+        This patch solves these problems by reducing all of that complexity into just
+        three primitives:
+        
+        - Executable::newCodeBlock(). This gives you a new code block, either for call
+          or for construct, and either to serve as the baseline code or the optimized
+          code. The new code block is then owned by the caller; Executable doesn't
+          register it anywhere. The new code block has no JITCode and isn't callable,
+          but it has all of the bytecode.
+        
+        - CodeBlock::prepareForExecution(). This takes the CodeBlock's bytecode and
+          produces a JITCode, and then installs the JITCode into the CodeBlock. This
+          method takes a JITType, and always compiles with that JIT. If you ask for
+          JITCode::InterpreterThunk then you'll get JITCode that just points to the
+          LLInt entrypoints. Once this returns, it is possible to call into the
+          CodeBlock if you do so manually - but the Executable still won't know about
+          it so JS calls to that Executable will still be routed to whatever CodeBlock
+          is associated with the Executable.
+        
+        - Executable::installCode(). This takes a CodeBlock and makes it the code-for-
+          entry for that Executable. This involves unlinking the Executable's last
+          CodeBlock, if there was one. This also tells the GC about any effect on
+          memory usage and does a bunch of weird data structure rewiring, since
+          Executable caches some of CodeBlock's fields for the benefit of virtual call
+          fast paths.
+        
+        This functionality is then wrapped around three convenience methods:
+        
+        - Executable::prepareForExecution(). If there is no code block for that
+          Executable, then one is created (newCodeBlock()), compiled
+          (CodeBlock::prepareForExecution()) and installed (installCode()).
+        
+        - CodeBlock::newReplacement(). Asks the Executable for a new CodeBlock that
+          can serve as an optimized replacement of the current one.
+        
+        - CodeBlock::install(). Asks the Executable to install this code block.
+        
+        This patch allows me to kill *a lot* of code and to remove a lot of
+        specializations for functions vs. not-functions, and a lot of places where we
+        pass around JITCode references and such. ExecutionHarness and JITDriver are
+        both gone. Overall this patch has more red than green.
+        
+        It also allows me to work on FTL OSR entry and tier-up:
+        
+        - FTL tier-up: this will involve DFGOperations.cpp asking the DFG::Worklist
+          to do some compilation, but it will require the DFG::Worklist to do
+          something different than what JITStubs.cpp would want, once the compilation
+          finishes. This patch introduces a callback mechanism for that purpose.
+        
+        - FTL OSR entry: this will involve creating a special auto-jettisoned
+          CodeBlock that is used only for FTL OSR entry. The new set of primitives
+          allows for this: Executable can vend you a fresh new CodeBlock, and you can
+          ask that CodeBlock to compile itself with any JIT of your choosing. Or you
+          can take that CodeBlock and compile it yourself. Previously the act of
+          producing a CodeBlock-for-optimization and the act of compiling code for it
+          were tightly coupled; now you can separate them and you can create such
+          auto-jettisoned CodeBlocks that are used for a one-shot OSR entry.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::prepareForExecutionImpl):
+        (JSC::CodeBlock::prepareForExecution):
+        (JSC::CodeBlock::prepareForExecutionAsynchronously):
+        (JSC::CodeBlock::install):
+        (JSC::CodeBlock::newReplacement):
+        (JSC::FunctionCodeBlock::jettisonImpl):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasBaselineJITProfiling):
+        * bytecode/DeferredCompilationCallback.cpp: Added.
+        (JSC::DeferredCompilationCallback::DeferredCompilationCallback):
+        (JSC::DeferredCompilationCallback::~DeferredCompilationCallback):
+        * bytecode/DeferredCompilationCallback.h: Added.
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::tryCompile):
+        * dfg/DFGDriver.h:
+        (JSC::DFG::tryCompile):
+        * dfg/DFGFailedFinalizer.cpp:
+        (JSC::DFG::FailedFinalizer::finalize):
+        (JSC::DFG::FailedFinalizer::finalizeFunction):
+        * dfg/DFGFailedFinalizer.h:
+        * dfg/DFGFinalizer.h:
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGOSRExitPreparation.cpp:
+        (JSC::DFG::prepareCodeOriginForOSRExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::notifyReady):
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        (JSC::DFG::Plan::finalizeAndNotifyCallback):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::runThread):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalize):
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * heap/Heap.h:
+        (JSC::Heap::isDeferred):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JITDriver.h: Removed.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        * jit/JITToDFGDeferredCompilationCallback.cpp: Added.
+        (JSC::JITToDFGDeferredCompilationCallback::JITToDFGDeferredCompilationCallback):
+        (JSC::JITToDFGDeferredCompilationCallback::~JITToDFGDeferredCompilationCallback):
+        (JSC::JITToDFGDeferredCompilationCallback::create):
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
+        * jit/JITToDFGDeferredCompilationCallback.h: Added.
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::setFunctionEntrypoint):
+        (JSC::LLInt::setEvalEntrypoint):
+        (JSC::LLInt::setProgramEntrypoint):
+        * llint/LLIntEntrypoints.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::setUpCall):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CompilationResult.cpp:
+        (WTF::printInternal):
+        * runtime/CompilationResult.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode):
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor):
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor):
+        (JSC::ExecutableBase::offsetOfNumParametersFor):
+        (JSC::ScriptExecutable::prepareForExecution):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
+        * runtime/ExecutionHarness.h: Removed.
+
+2013-08-29  Mark Lam  <mark.lam@apple.com>
+
+        Change StackIterator to not require writes to the JS stack.
+        https://bugs.webkit.org/show_bug.cgi?id=119657.
+
+        Reviewed by Geoffrey Garen.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        - Removed references to StackIteratorPrivate.h.
+        * interpreter/StackIterator.cpp:
+        (JSC::StackIterator::numberOfFrames):
+        (JSC::StackIterator::gotoFrameAtIndex):
+        (JSC::StackIterator::gotoNextFrame):
+        (JSC::StackIterator::resetIterator):
+        (JSC::StackIterator::find):
+        (JSC::StackIterator::readFrame):
+        (JSC::StackIterator::readNonInlinedFrame):
+        - Reads in the current CallFrame's data for non-inlined frames.
+        (JSC::inlinedFrameOffset):
+        - Convenience function to compute the inlined frame offset based on the
+          CodeOrigin. If the offset is 0, then we're looking at the physical frame.
+          Otherwise, it's an inlined frame.
+        (JSC::StackIterator::readInlinedFrame):
+        - Determines the inlined frame's caller frame. Will read in the caller
+          frame if it is also an inlined frame i.e. we haven't reached the
+          outer most frame yet. Otherwise, will call readNonInlinedFrame() to
+          read on the outer most frame.
+          This is based on the old StackIterator::Frame::logicalFrame().
+        (JSC::StackIterator::updateFrame):
+        - Reads the data of the caller frame of the current one. This function
+          is renamed and moved from the old StackIterator::Frame::logicalCallerFrame(),
+          but is now simplified because it delegates to the readInlinedFrame()
+          to get the caller for inlined frames.
+        (JSC::StackIterator::Frame::arguments):
+        - Fixed to use the inlined frame versions of Arguments::create() and
+          Arguments::tearOff() when the frame is an inlined frame.
+        (JSC::StackIterator::Frame::print):
+        (debugPrintCallFrame):
+        (debugPrintStack):
+        - Because sometimes, we want to see the whole stack while debugging.
+        * interpreter/StackIterator.h:
+        (JSC::StackIterator::Frame::argumentCount):
+        (JSC::StackIterator::Frame::callerFrame):
+        (JSC::StackIterator::Frame::callee):
+        (JSC::StackIterator::Frame::scope):
+        (JSC::StackIterator::Frame::codeBlock):
+        (JSC::StackIterator::Frame::bytecodeOffset):
+        (JSC::StackIterator::Frame::inlinedFrameInfo):
+        (JSC::StackIterator::Frame::isJSFrame):
+        (JSC::StackIterator::Frame::isInlinedFrame):
+        (JSC::StackIterator::Frame::callFrame):
+        (JSC::StackIterator::Frame::Frame):
+        (JSC::StackIterator::Frame::~Frame):
+        - StackIterator::Frame now caches commonly used accessed values from
+          the CallFrame. It still delegates argument queries to the CallFrame.
+        (JSC::StackIterator::operator*):
+        (JSC::StackIterator::operator->):
+        (JSC::StackIterator::operator!=):
+        (JSC::StackIterator::operator++):
+        (JSC::StackIterator::end):
+        (JSC::StackIterator::operator==):
+        * interpreter/StackIteratorPrivate.h: Removed.
+
+2013-08-29  Chris Curtis  <chris_curtis@apple.com>
+
+        VM::throwException() crashes reproducibly in testapi with !ENABLE(JIT)
+        https://bugs.webkit.org/show_bug.cgi?id=120472
+
+        Reviewed by Filip Pizlo.
+        
+        With the JIT disabled, interpreterThrowInCaller was attempting to throw an error, 
+        but the topCallFrame was not set yet. By passing the error object into interpreterThrowInCaller
+        throwException can be called when topCallFrame is set.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPathsExceptions.cpp:
+        (JSC::CommonSlowPaths::interpreterThrowInCaller):
+        * runtime/CommonSlowPathsExceptions.h:
+
+        Renamed genericThrow -> genericUnwind, because this function no longer has the ability
+        to throw errors. It unwinds the stack in order to report them. 
+        * dfg/DFGOperations.cpp:
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        (JSC::jitThrowNew):
+        (JSC::jitThrow):
+        * jit/JITExceptions.h:
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::doThrow):
+    
+2013-08-29  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r154804.
+        http://trac.webkit.org/changeset/154804
+        https://bugs.webkit.org/show_bug.cgi?id=120477
+
+        Broke Windows build (assumes LLInt features not enabled on
+        this build) (Requested by bfulgham on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::reoptimize):
+        (JSC::ProgramCodeBlock::replacement):
+        (JSC::EvalCodeBlock::replacement):
+        (JSC::FunctionCodeBlock::replacement):
+        (JSC::ProgramCodeBlock::compileOptimized):
+        (JSC::ProgramCodeBlock::replaceWithDeferredOptimizedCode):
+        (JSC::EvalCodeBlock::compileOptimized):
+        (JSC::EvalCodeBlock::replaceWithDeferredOptimizedCode):
+        (JSC::FunctionCodeBlock::compileOptimized):
+        (JSC::FunctionCodeBlock::replaceWithDeferredOptimizedCode):
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::jitType):
+        (JSC::CodeBlock::jitCompile):
+        * bytecode/DeferredCompilationCallback.cpp: Removed.
+        * bytecode/DeferredCompilationCallback.h: Removed.
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        (JSC::DFG::tryFinalizePlan):
+        * dfg/DFGDriver.h:
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        (JSC::DFG::tryFinalizePlan):
+        * dfg/DFGFailedFinalizer.cpp:
+        (JSC::DFG::FailedFinalizer::finalize):
+        (JSC::DFG::FailedFinalizer::finalizeFunction):
+        * dfg/DFGFailedFinalizer.h:
+        * dfg/DFGFinalizer.h:
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGOSRExitPreparation.cpp:
+        (JSC::DFG::prepareCodeOriginForOSRExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::finalize):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::runThread):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalize):
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * heap/Heap.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JITDriver.h: Added.
+        (JSC::jitCompileIfAppropriateImpl):
+        (JSC::jitCompileFunctionIfAppropriateImpl):
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        * jit/JITToDFGDeferredCompilationCallback.cpp: Removed.
+        * jit/JITToDFGDeferredCompilationCallback.h: Removed.
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntEntrypoints.h:
+        (JSC::LLInt::getEntrypoint):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::setUpCall):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CompilationResult.cpp:
+        (WTF::printInternal):
+        * runtime/CompilationResult.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileOptimized):
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::EvalExecutable::replaceWithDeferredOptimizedCode):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::ProgramExecutable::replaceWithDeferredOptimizedCode):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeForCall):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeForConstruct):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor):
+        (JSC::ExecutableBase::offsetOfNumParametersFor):
+        (JSC::ExecutableBase::catchRoutineFor):
+        (JSC::EvalExecutable::compile):
+        (JSC::ProgramExecutable::compile):
+        (JSC::FunctionExecutable::compileForCall):
+        (JSC::FunctionExecutable::compileForConstruct):
+        (JSC::FunctionExecutable::compileFor):
+        (JSC::FunctionExecutable::compileOptimizedFor):
+        (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeFor):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h: Added.
+        (JSC::prepareForExecutionImpl):
+        (JSC::prepareFunctionForExecutionImpl):
+        (JSC::installOptimizedCode):
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+        (JSC::replaceWithDeferredOptimizedCode):
+
+2013-08-28  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock compilation and installation should be simplified and rationalized
+        https://bugs.webkit.org/show_bug.cgi?id=120326
+
+        Reviewed by Oliver Hunt.
+        
+        Previously Executable owned the code for generating JIT code; you always had
+        to go through Executable. But often you also had to go through CodeBlock,
+        because ScriptExecutable couldn't have virtual methods, but CodeBlock could.
+        So you'd ask CodeBlock to do something, which would dispatch through a
+        virtual method that would select the appropriate Executable subtype's method.
+        This all meant that the same code would often be duplicated, because most of
+        the work needed to compile something was identical regardless of code type.
+        But then we tried to fix this, by having templatized helpers in
+        ExecutionHarness.h and JITDriver.h. The result was that if you wanted to find
+        out what happened when you asked for something to be compiled, you'd go on a
+        wild ride that started with CodeBlock, touched upon Executable, and then
+        ricocheted into either ExecutionHarness or JITDriver (likely both).
+        
+        Another awkwardness was that for concurrent compiles, the DFG::Worklist had
+        super-special inside knowledge of what JITStubs.cpp's cti_optimize would have
+        done once the compilation finished.
+        
+        Also, most of the DFG JIT drivers assumed that they couldn't install the
+        JITCode into the CodeBlock directly - instead they would return it via a
+        reference, which happened to be a reference to the JITCode pointer in
+        Executable. This was super weird.
+        
+        Finally, there was no notion of compiling code into a special CodeBlock that
+        wasn't used for handling calls into an Executable. I'd like this for FTL OSR
+        entry.
+        
+        This patch solves these problems by reducing all of that complexity into just
+        three primitives:
+        
+        - Executable::newCodeBlock(). This gives you a new code block, either for call
+          or for construct, and either to serve as the baseline code or the optimized
+          code. The new code block is then owned by the caller; Executable doesn't
+          register it anywhere. The new code block has no JITCode and isn't callable,
+          but it has all of the bytecode.
+        
+        - CodeBlock::prepareForExecution(). This takes the CodeBlock's bytecode and
+          produces a JITCode, and then installs the JITCode into the CodeBlock. This
+          method takes a JITType, and always compiles with that JIT. If you ask for
+          JITCode::InterpreterThunk then you'll get JITCode that just points to the
+          LLInt entrypoints. Once this returns, it is possible to call into the
+          CodeBlock if you do so manually - but the Executable still won't know about
+          it so JS calls to that Executable will still be routed to whatever CodeBlock
+          is associated with the Executable.
+        
+        - Executable::installCode(). This takes a CodeBlock and makes it the code-for-
+          entry for that Executable. This involves unlinking the Executable's last
+          CodeBlock, if there was one. This also tells the GC about any effect on
+          memory usage and does a bunch of weird data structure rewiring, since
+          Executable caches some of CodeBlock's fields for the benefit of virtual call
+          fast paths.
+        
+        This functionality is then wrapped around three convenience methods:
+        
+        - Executable::prepareForExecution(). If there is no code block for that
+          Executable, then one is created (newCodeBlock()), compiled
+          (CodeBlock::prepareForExecution()) and installed (installCode()).
+        
+        - CodeBlock::newReplacement(). Asks the Executable for a new CodeBlock that
+          can serve as an optimized replacement of the current one.
+        
+        - CodeBlock::install(). Asks the Executable to install this code block.
+        
+        This patch allows me to kill *a lot* of code and to remove a lot of
+        specializations for functions vs. not-functions, and a lot of places where we
+        pass around JITCode references and such. ExecutionHarness and JITDriver are
+        both gone. Overall this patch has more red than green.
+        
+        It also allows me to work on FTL OSR entry and tier-up:
+        
+        - FTL tier-up: this will involve DFGOperations.cpp asking the DFG::Worklist
+          to do some compilation, but it will require the DFG::Worklist to do
+          something different than what JITStubs.cpp would want, once the compilation
+          finishes. This patch introduces a callback mechanism for that purpose.
+        
+        - FTL OSR entry: this will involve creating a special auto-jettisoned
+          CodeBlock that is used only for FTL OSR entry. The new set of primitives
+          allows for this: Executable can vend you a fresh new CodeBlock, and you can
+          ask that CodeBlock to compile itself with any JIT of your choosing. Or you
+          can take that CodeBlock and compile it yourself. Previously the act of
+          producing a CodeBlock-for-optimization and the act of compiling code for it
+          were tightly coupled; now you can separate them and you can create such
+          auto-jettisoned CodeBlocks that are used for a one-shot OSR entry.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::prepareForExecution):
+        (JSC::CodeBlock::install):
+        (JSC::CodeBlock::newReplacement):
+        (JSC::FunctionCodeBlock::jettisonImpl):
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasBaselineJITProfiling):
+        * bytecode/DeferredCompilationCallback.cpp: Added.
+        (JSC::DeferredCompilationCallback::DeferredCompilationCallback):
+        (JSC::DeferredCompilationCallback::~DeferredCompilationCallback):
+        * bytecode/DeferredCompilationCallback.h: Added.
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::tryCompile):
+        * dfg/DFGDriver.h:
+        (JSC::DFG::tryCompile):
+        * dfg/DFGFailedFinalizer.cpp:
+        (JSC::DFG::FailedFinalizer::finalize):
+        (JSC::DFG::FailedFinalizer::finalizeFunction):
+        * dfg/DFGFailedFinalizer.h:
+        * dfg/DFGFinalizer.h:
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGOSRExitPreparation.cpp:
+        (JSC::DFG::prepareCodeOriginForOSRExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        (JSC::DFG::Plan::finalizeAndNotifyCallback):
+        * dfg/DFGPlan.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalize):
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * heap/Heap.h:
+        (JSC::Heap::isDeferred):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JITDriver.h: Removed.
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        * jit/JITToDFGDeferredCompilationCallback.cpp: Added.
+        (JSC::JITToDFGDeferredCompilationCallback::JITToDFGDeferredCompilationCallback):
+        (JSC::JITToDFGDeferredCompilationCallback::~JITToDFGDeferredCompilationCallback):
+        (JSC::JITToDFGDeferredCompilationCallback::create):
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
+        * jit/JITToDFGDeferredCompilationCallback.h: Added.
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::setFunctionEntrypoint):
+        (JSC::LLInt::setEvalEntrypoint):
+        (JSC::LLInt::setProgramEntrypoint):
+        * llint/LLIntEntrypoints.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::setUpCall):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CompilationResult.cpp:
+        (WTF::printInternal):
+        * runtime/CompilationResult.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode):
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor):
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::prepareForExecution):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
+        * runtime/ExecutionHarness.h: Removed.
+
+2013-08-28  Chris Curtis  <chris_curtis@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=119548
+        Refactoring Exception throws.
+        
+        Reviewed by Geoffrey Garen.
+        
+        Gardening of exception throws. The act of throwing an exception was being handled in 
+        different ways depending on whether the code was running in the LLint, Baseline JIT, 
+        or the DFG Jit. This made development in the vm exception and error objects difficult.
+        
+         * runtime/VM.cpp:
+        (JSC::appendSourceToError): 
+        This function moved from the interpreter into the VM. It views the developers code
+        (if there is a codeBlock) to extract what was trying to be evaluated when the error
+        occurred.
+        
+        (JSC::VM::throwException):
+        This function takes in the error object and sets the following:
+            1: The VM's exception stack
+            2: The VM's exception 
+            3: Appends extra information on the error message(via appendSourceToError)
+            4: The error object's line number
+            5: The error object's column number
+            6: The error object's sourceURL
+            7: The error object's stack trace (unless it already exists because the developer 
+                created the error object). 
+
+        (JSC::VM::getExceptionInfo):
+        (JSC::VM::setExceptionInfo):
+        (JSC::VM::clearException):
+        (JSC::clearExceptionStack):
+        * runtime/VM.h:
+        (JSC::VM::exceptionOffset):
+        (JSC::VM::exception):
+        (JSC::VM::addressOfException):
+        (JSC::VM::exceptionStack):
+        VM exception and exceptionStack are now private data members.
+
+        * interpreter/Interpreter.h:
+        (JSC::ClearExceptionScope::ClearExceptionScope):
+        Created this structure to temporarily clear the exception within the VM. This 
+        needed to see if addition errors occur when setting the debugger as we are 
+        unwinding the stack.
+
+         * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwind): 
+        Removed the code that would try to add error information if it did not exist. 
+        All of this functionality has moved into the VM and all error information is set 
+        at the time the error occurs. 
+
+        The rest of these functions reference the new calling convention to throw an error.
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::defaultValue):
+        (JSC::::put):
+        (JSC::::putByIndex):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::customHasInstance):
+        (JSC::::call):
+        (JSC::::getStaticValue):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::callCheck):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearException):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::hadException):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::loadVarargs):
+        (JSC::stackTraceAsString):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC::ClearExceptionScope::ClearExceptionScope):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_catch):
+        * jit/JITStubs.cpp:
+        (JSC::returnToThrowTrampoline):
+        (JSC::throwExceptionFromOpCall):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::jitCompileFor):
+        (JSC::lazyLinkFor):
+        (JSC::putByVal):
+        (JSC::cti_vm_handle_exception):
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * jsc.cpp:
+        (functionRun):
+        (functionLoad):
+        (functionCheckSyntax):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::doThrow):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/CommonSlowPathsExceptions.cpp:
+        (JSC::CommonSlowPaths::interpreterThrowInCaller):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        (JSC::throwTypeError):
+        (JSC::throwSyntaxError):
+        * runtime/Error.h:
+        (JSC::throwVMError):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        (JSC::throwStackOverflowError):
+        (JSC::throwTerminatedExecutionException):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::create):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::put):
+        (JSC::JSArray::push):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::synthesizePrototype):
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::::create):
+        (JSC::::createUninitialized):
+        (JSC::::validateRange):
+        (JSC::::setWithSpecificType):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::put):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::throwTypeError):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/StringRecursionChecker.cpp:
+        (JSC::StringRecursionChecker::throwStackOverflowError):
+
+2013-08-28  Zan Dobersek  <zdobersek@igalia.com>
+
+        [GTK] Add support for building JSC with FTL JIT enabled
+        https://bugs.webkit.org/show_bug.cgi?id=120270
+
+        Reviewed by Filip Pizlo.
+
+        * GNUmakefile.am: Add LLVM_LIBS to the list of linker flags and LLVM_CFLAGS to the list of
+        compiler flags for the JSC library.
+        * GNUmakefile.list.am: Add the missing build targets.
+        * ftl/FTLAbbreviations.h: Include the <cstring> header and use std::strlen. This avoids compilation
+        failures when using the Clang compiler with the libstdc++ standard library.
+        (JSC::FTL::mdKindID):
+        (JSC::FTL::mdString):
+
+2013-08-23  Andy Estes  <aestes@apple.com>
+
+        Fix issues found by the Clang Static Analyzer
+        https://bugs.webkit.org/show_bug.cgi?id=120230
+
+        Reviewed by Darin Adler.
+
+        * API/JSValue.mm:
+        (valueToString): Don't leak every CFStringRef when in Objective-C GC.
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunctionImpl::~ObjCCallbackFunctionImpl): Don't
+        release m_invocation's target since NSInvocation will do it for us on
+        -dealloc.
+        (objCCallbackFunctionForBlock): Tell NSInvocation to retain its target
+        and -release our reference to the copied block.
+        * API/tests/minidom.c:
+        (createStringWithContentsOfFile): Free buffer before returning.
+        * API/tests/testapi.c:
+        (createStringWithContentsOfFile): Ditto.
+
+2013-08-26  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix after r154629.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing build files.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2013-08-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Windows build fix attempt after r154629.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+
+2013-08-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage does a check on the length of the ArrayStorage after possible reallocing it
+        https://bugs.webkit.org/show_bug.cgi?id=120278
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+
+2013-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indention of Executable.h.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/Executable.h:
+
+2013-08-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Object.defineProperty should be able to create a PropertyDescriptor where m_attributes == 0
+        https://bugs.webkit.org/show_bug.cgi?id=120314
+
+        Reviewed by Darin Adler.
+
+        Currently with the way that defineProperty works, we leave a stray low bit set in 
+        PropertyDescriptor::m_attributes in the following code:
+
+        var o = {};
+        Object.defineProperty(o, 100, {writable:true, enumerable:true, configurable:true, value:"foo"});
+        
+        This is due to the fact that the lowest non-zero attribute (ReadOnly) is represented as 1 << 1 
+        instead of 1 << 0. We then calculate the default attributes as (DontDelete << 1) - 1, which is 0xF, 
+        but only the top three bits mean anything. Even in the case above, the top three bits are set 
+        to 0 but the bottom bit remains set, which causes us to think m_attributes is non-zero.
+
+        Since some of these attributes and their corresponding values are exposed in the JavaScriptCore 
+        framework's public C API, it's safer to just change how we calculate the default value, which is
+        where the weirdness was originating from in the first place.
+
+        * runtime/PropertyDescriptor.cpp:
+
+2013-08-24  Sam Weinig  <sam@webkit.org>
+
+        Add support for Promises
+        https://bugs.webkit.org/show_bug.cgi?id=120260
+
+        Reviewed by Darin Adler.
+
+        Add an initial implementation of Promises - http://dom.spec.whatwg.org/#promises.
+        - Despite Promises being defined in the DOM, the implementation is being put in JSC
+          in preparation for the Promises eventually being defined in ECMAScript.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        Add new files.
+
+        * jsc.cpp:
+        Update jsc's GlobalObjectMethodTable to stub out the new QueueTaskToEventLoop callback. This mean's
+        you can't quite use Promises with with the command line tool yet.
+    
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::promisePrototypeTable):
+        (JSC::ExecState::promiseConstructorTable):
+        (JSC::ExecState::promiseResolverPrototypeTable):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h:
+        Add supporting code for the new static lookup tables.
+
+        * runtime/CommonIdentifiers.h:
+        Add 3 new identifiers, "Promise", "PromiseResolver", and "then".
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        Add supporting code Promise and PromiseResolver's constructors and structures.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::TaskContext::~TaskContext):
+        Add a new callback to the GlobalObjectMethodTable to post a task on the embedder's runloop.
+
+        (JSC::JSGlobalObject::promisePrototype):
+        (JSC::JSGlobalObject::promiseResolverPrototype):
+        (JSC::JSGlobalObject::promiseStructure):
+        (JSC::JSGlobalObject::promiseResolverStructure):
+        (JSC::JSGlobalObject::promiseCallbackStructure):
+        (JSC::JSGlobalObject::promiseWrapperCallbackStructure):
+        Add supporting code Promise and PromiseResolver's constructors and structures.
+
+        * runtime/JSPromise.cpp: Added.
+        * runtime/JSPromise.h: Added.
+        * runtime/JSPromiseCallback.cpp: Added.
+        * runtime/JSPromiseCallback.h: Added.
+        * runtime/JSPromiseConstructor.cpp: Added.
+        * runtime/JSPromiseConstructor.h: Added.
+        * runtime/JSPromisePrototype.cpp: Added.
+        * runtime/JSPromisePrototype.h: Added.
+        * runtime/JSPromiseResolver.cpp: Added.
+        * runtime/JSPromiseResolver.h: Added.
+        * runtime/JSPromiseResolverConstructor.cpp: Added.
+        * runtime/JSPromiseResolverConstructor.h: Added.
+        * runtime/JSPromiseResolverPrototype.cpp: Added.
+        * runtime/JSPromiseResolverPrototype.h: Added.
+        Add Promise implementation.
+
+2013-08-26  Zan Dobersek  <zdobersek@igalia.com>
+
+        Plenty of -Wcast-align warnings in KeywordLookup.h
+        https://bugs.webkit.org/show_bug.cgi?id=120316
+
+        Reviewed by Darin Adler.
+
+        * KeywordLookupGenerator.py: Use reinterpret_cast instead of a C-style cast when casting
+        the character pointers to types of larger size. This avoids spewing lots of warnings
+        in the KeywordLookup.h header when compiling with the -Wcast-align option.
+
+2013-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        RegExpMatchesArray should not call [[put]]
+        https://bugs.webkit.org/show_bug.cgi?id=120317
+
+        Reviewed by Oliver Hunt.
+
+        This will call accessors on the JSObject/JSArray prototypes - so adding an accessor or read-only
+        property called index or input to either of these prototypes will result in broken behavior.
+
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::reifyAllProperties):
+            - put -> putDirect
+
+2013-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        FloatTypedArrayAdaptor::toJSValue should almost certainly not use jsNumber() since that attempts int conversions
+        https://bugs.webkit.org/show_bug.cgi?id=120228
+
+        Reviewed by Oliver Hunt.
+        
+        It turns out that there were three problems:
+        
+        - Using jsNumber() meant that we were converting doubles to integers and then
+          possibly back again whenever doing a set() between floating point arrays.
+        
+        - Slow-path accesses to double typed arrays were slower than necessary because
+          of the to-int conversion attempt.
+        
+        - The use of JSValue as an intermediate for converting between differen types
+          in typedArray.set() resulted in worse code than I had previously expected.
+        
+        This patch solves the problem by using template double-dispatch to ensure that
+        that C++ compiler sees the simplest possible combination of casts between any
+        combination of typed array types, while still preserving JS and typed array
+        conversion semantics. Conversions are done as follows:
+        
+            SourceAdaptor::convertTo<TargetAdaptor>(value)
+        
+        Internally, convertTo() calls one of three possible methods on TargetAdaptor,
+        with one method for each of int32_t, uint32_t, and double. This means that the
+        C++ compiler will at worst see a widening cast to one of those types followed
+        by a narrowing conversion (not necessarily a cast - may have clamping or the
+        JS toInt32() function).
+        
+        This change doesn't just affect typedArray.set(); it also affects slow-path
+        accesses to typed arrays as well. This patch also adds a bunch of new test
+        coverage.
+        
+        This change is a ~50% speed-up on typedArray.set() involving floating point
+        types.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/GenericTypedArrayView.h:
+        (JSC::GenericTypedArrayView::set):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::setData):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble):
+        (JSC::JSGenericTypedArrayView::setIndexQuickly):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::::setWithSpecificType):
+        (JSC::::set):
+        * runtime/ToNativeFromValue.h: Added.
+        (JSC::toNativeFromValue):
+        * runtime/TypedArrayAdaptors.h:
+        (JSC::IntegralTypedArrayAdaptor::toJSValue):
+        (JSC::IntegralTypedArrayAdaptor::toDouble):
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32):
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32):
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromDouble):
+        (JSC::IntegralTypedArrayAdaptor::convertTo):
+        (JSC::FloatTypedArrayAdaptor::toJSValue):
+        (JSC::FloatTypedArrayAdaptor::toDouble):
+        (JSC::FloatTypedArrayAdaptor::toNativeFromInt32):
+        (JSC::FloatTypedArrayAdaptor::toNativeFromUint32):
+        (JSC::FloatTypedArrayAdaptor::toNativeFromDouble):
+        (JSC::FloatTypedArrayAdaptor::convertTo):
+        (JSC::Uint8ClampedAdaptor::toJSValue):
+        (JSC::Uint8ClampedAdaptor::toDouble):
+        (JSC::Uint8ClampedAdaptor::toNativeFromInt32):
+        (JSC::Uint8ClampedAdaptor::toNativeFromUint32):
+        (JSC::Uint8ClampedAdaptor::toNativeFromDouble):
+        (JSC::Uint8ClampedAdaptor::convertTo):
+
+2013-08-24  Dan Bernstein  <mitz@apple.com>
+
+        [mac] link against libz in a more civilized manner
+        https://bugs.webkit.org/show_bug.cgi?id=120258
+
+        Reviewed by Darin Adler.
+
+        * Configurations/JavaScriptCore.xcconfig: Removed “-lz” from OTHER_LDFLAGS_BASE.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added libz.dylib to the JavaScriptCore target’s
+        Link Binary With Libraries build phase.
+
+2013-08-23  Laszlo Papp  <lpapp@kde.org>
+
+        Failure building with python3
+        https://bugs.webkit.org/show_bug.cgi?id=106645
+
+        Reviewed by Benjamin Poulain.
+
+        Use print functions instead of python statements to be compatible with python 3.X and 2.7 as well.
+        Archlinux has been using python3 and that is what causes issues while packaging QtWebKit along with Qt5.
+
+        * disassembler/udis86/itab.py:
+        (UdItabGenerator.genInsnTable):
+        * disassembler/udis86/ud_opcode.py:
+        (UdOpcodeTables.print_table):
+        * disassembler/udis86/ud_optable.py:
+        (UdOptableXmlParser.parseDef):
+        (UdOptableXmlParser.parse):
+        (printFn):
+
+2013-08-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Incorrect TypedArray#set behavior
+        https://bugs.webkit.org/show_bug.cgi?id=83818
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        This was so much fun! typedArray.set() is like a memmove on steroids, and I'm
+        not smart enough to figure out optimal versions for *all* of the cases. But I
+        did come up with optimal implementations for most of the cases, and I wrote
+        spec-literal code (i.e. copy via a transfer buffer) for the cases I'm not smart
+        enough to write optimal code for.
+
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::hasArrayBuffer):
+        * runtime/JSArrayBufferViewInlines.h:
+        (JSC::JSArrayBufferView::buffer):
+        (JSC::JSArrayBufferView::existingBufferInButterfly):
+        (JSC::JSArrayBufferView::neuter):
+        (JSC::JSArrayBufferView::byteOffset):
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::::setWithSpecificType):
+        (JSC::::set):
+        (JSC::::existingBuffer):
+
+2013-08-23  Alex Christensen  <achristensen@apple.com>
+
+        Re-separating Win32 and Win64 builds.
+        https://bugs.webkit.org/show_bug.cgi?id=120178
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
+        Pass PlatformArchitecture as a command line parameter to bash scripts.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
+        * JavaScriptCore.vcxproj/build-generated-files.sh:
+        Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
+
+2013-08-22  Filip Pizlo  <fpizlo@apple.com>
+
+        build-jsc --ftl-jit should work
+        https://bugs.webkit.org/show_bug.cgi?id=120194
+
+        Reviewed by Oliver Hunt.
+
+        * Configurations/Base.xcconfig: CPPFLAGS should include FEATURE_DEFINES
+        * Configurations/JSC.xcconfig: The 'jsc' tool includes headers where field layout may depend on FEATURE_DEFINES
+        * Configurations/ToolExecutable.xcconfig: All other tools include headers where field layout may depend on FEATURE_DEFINES
+        * ftl/FTLLowerDFGToLLVM.cpp: Build fix
+        (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
+
+2013-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Re-sort xcode project file
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Support in memory compression of rarely used data
+        https://bugs.webkit.org/show_bug.cgi?id=120143
+
+        Reviewed by Gavin Barraclough.
+
+        Include zlib in LD_FLAGS and make UnlinkedCodeBlock make use of CompressibleVector.  This saves ~200k on google maps.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::addExpressionInfo):
+        * bytecode/UnlinkedCodeBlock.h:
+
+2013-08-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject and JSArray code shouldn't have to tiptoe around garbage collection
+        https://bugs.webkit.org/show_bug.cgi?id=120179
+
+        Reviewed by Geoffrey Garen.
+
+        There are many places in the code for JSObject and JSArray where they are manipulating their 
+        Butterfly/Structure, e.g. after expanding their out-of-line backing storage via allocating. Within 
+        these places there are certain "critical sections" where a GC would be disastrous. Gen GC looks 
+        like it will make this dance even more intricate. To make everybody's lives easier we should use 
+        the DeferGC mechanism in these functions to make these GC critical sections both obvious in the 
+        code and trivially safe. Deferring collections will usually only last marginally longer, thus we 
+        should not incur any additional overhead.
+
+        * heap/Heap.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCountSlowCase):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+
+2013-08-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Update LLVM binary drops and scripts to the latest version from SVN
+        https://bugs.webkit.org/show_bug.cgi?id=120184
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2013-08-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Don't leak registers for redeclared variables
+        https://bugs.webkit.org/show_bug.cgi?id=120174
+
+        Reviewed by Geoff Garen.
+
+        We currently always allocate registers for new global variables, but these are wasted when the variable is being redeclared.
+        Only allocate new registers when necessary.
+
+        No performance impact.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+            - Don't allocate the register here.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+            - Allocate the register here instead.
+
+2013-08-22  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120128
+        Remove putDirectVirtual
+
+        Unreviewed, checked in commented out code. :-(
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+            - delete commented out code
+
+2013-08-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Error.stack should not be enumerable
+        https://bugs.webkit.org/show_bug.cgi?id=120171
+
+        Reviewed by Oliver Hunt.
+
+        Breaks ECMA tests.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finishCreation):
+            - None -> DontEnum
+
+2013-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120128
+        Remove putDirectVirtual
+
+        Reviewed by Sam Weinig.
+
+        This could most generously be described as 'vestigial'.
+        No performance impact.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+            - changed to use defineOwnProperty
+        * debugger/DebuggerActivation.cpp:
+        * debugger/DebuggerActivation.h:
+            - remove putDirectVirtual
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+            - changed to use defineOwnProperty
+        * runtime/ClassInfo.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+        * runtime/JSProxy.cpp:
+        * runtime/JSProxy.h:
+        * runtime/JSSymbolTableObject.cpp:
+        * runtime/JSSymbolTableObject.h:
+            - remove putDirectVirtual
+        * runtime/PropertyDescriptor.h:
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+            - added constructor for convenience
+
+2013-08-22  Chris Curtis  <chris_curtis@apple.com>
+
+        errorDescriptionForValue() should not assume error value is an Object
+        https://bugs.webkit.org/show_bug.cgi?id=119812
+
+        Reviewed by Geoffrey Garen.
+
+        Added a check to make sure that the JSValue was an object before casting it as an object. Also, in case the parameterized JSValue
+        has no type, the function now returns the empty string. 
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue):
+
+2013-08-22  Julien Brianceau  <jbrianceau@nds.com>
+
+        Fix P_DFGOperation_EJS call for MIPS and ARM EABI.
+        https://bugs.webkit.org/show_bug.cgi?id=120107
+
+        Reviewed by Yong Li.
+
+        EncodedJSValue parameters must be aligned to even registers for MIPS and ARM EABI.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+2013-08-21  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r154416.
+        http://trac.webkit.org/changeset/154416
+        https://bugs.webkit.org/show_bug.cgi?id=120147
+
+        Broke Windows builds (Requested by rniwa on #webkit).
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
+        * JavaScriptCore.vcxproj/build-generated-files.sh:
+
+2013-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Clarify var/const/function declaration
+        https://bugs.webkit.org/show_bug.cgi?id=120144
+
+        Reviewed by Sam Weinig.
+
+        Add methods to JSGlobalObject to declare vars, consts, and functions.
+
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/Executable.h:
+            - Moved declaration code to JSGlobalObject
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+            - internal implementation of addVar, addConst, addFunction
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addVar):
+        (JSC::JSGlobalObject::addConst):
+        (JSC::JSGlobalObject::addFunction):
+            - Added methods to declare vars, consts, and functions
+
+2013-08-21  Yi Shen  <max.hong.shen@gmail.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=119900
+        Exception in global setter doesn't unwind correctly
+
+        Reviewed by Geoffrey Garen.
+
+        Call VM_THROW_EXCEPTION_AT_END in op_put_to_scope if the setter throws exception.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2013-08-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename/refactor setButterfly/setStructure
+        https://bugs.webkit.org/show_bug.cgi?id=120138
+
+        Reviewed by Geoffrey Garen.
+
+        setButterfly becomes setStructureAndButterfly.
+
+        Also removed the Butterfly* argument from setStructure and just implicitly
+        used m_butterfly internally since that's what every single client of setStructure
+        was doing already.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::genericConvertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::setStructureAndButterfly):
+        (JSC::JSObject::setStructure):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+
+2013-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120127
+        Remove JSObject::propertyIsEnumerable
+
+        Unreviewed typo fix
+
+        * runtime/JSObject.h:
+            - fix typo
+
+2013-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120139
+        PropertyDescriptor argument to define methods should be const
+
+        Rubber stamped by Sam Weinig.
+
+        This should never be modified, and this way we can use rvalues.
+
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::defineOwnProperty):
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+        * runtime/Arguments.h:
+        * runtime/ClassInfo.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        * runtime/JSArray.h:
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::defineOwnProperty):
+        * runtime/JSArrayBuffer.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::defineOwnProperty):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::defineOwnProperty):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSFunction.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineOwnProperty):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::defineOwnProperty):
+        * runtime/JSProxy.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::defineOwnProperty):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::defineOwnProperty):
+        * runtime/RegExpObject.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/StringObject.h:
+            - make PropertyDescriptor const
+
+2013-08-21  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: Crash under JITCompiler::link while loading Gmail
+        https://bugs.webkit.org/show_bug.cgi?id=119872
+
+        Reviewed by Mark Hahnenberg.
+        
+        Apparently, unsigned + signed = unsigned. Work around it with a cast.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2013-08-21  Alex Christensen  <achristensen@apple.com>
+
+        <https://webkit.org/b/120137> Separating Win32 and Win64 builds.
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
+        Pass PlatformArchitecture as a command line parameter to bash scripts.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
+        * JavaScriptCore.vcxproj/build-generated-files.sh:
+        Use PlatformArchitecture from command line to determine which object directory to use (obj32 or obj64).
+
+2013-08-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Assertion failure in JSC::SlotVisitor::copyLater when marking JSDataView
+        https://bugs.webkit.org/show_bug.cgi?id=120099
+
+        Reviewed by Mark Hahnenberg.
+        
+        JSDataView should not store the ArrayBuffer* in the butterfly indexing header, since
+        JSDataView may have ordinary JS indexed properties.
+
+        * runtime/ClassInfo.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        (JSC::JSArrayBufferView::finishCreation):
+        * runtime/JSArrayBufferView.h:
+        (JSC::hasArrayBuffer):
+        * runtime/JSArrayBufferViewInlines.h:
+        (JSC::JSArrayBufferView::buffer):
+        (JSC::JSArrayBufferView::neuter):
+        (JSC::JSArrayBufferView::byteOffset):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::slowDownAndWasteMemory):
+        * runtime/JSCell.h:
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::JSDataView):
+        (JSC::JSDataView::create):
+        (JSC::JSDataView::slowDownAndWasteMemory):
+        * runtime/JSDataView.h:
+        (JSC::JSDataView::buffer):
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::::visitChildren):
+        (JSC::::slowDownAndWasteMemory):
+
+2013-08-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove incorrect ASSERT from CopyVisitor::visitItem
+
+        Rubber stamped by Filip Pizlo.
+
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::visitItem):
+
+2013-08-21  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120127
+        Remove JSObject::propertyIsEnumerable
+
+        Reviewed by Sam Weinig.
+
+        This method is just a wart - it contains unnecessary const-casting, function call overhead, and LOC.
+
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+            - remove propertyIsEnumerable
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+            - Move implementation here using getOwnPropertyDescriptor directly.
+
+2013-08-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline new typedArray()
+        https://bugs.webkit.org/show_bug.cgi?id=120022
+
+        Reviewed by Oliver Hunt.
+        
+        Adds inlining of typed array allocations in the DFG. Any operation of the
+        form:
+        
+            new foo(blah)
+        
+        or:
+        
+            foo(blah)
+        
+        where 'foo' is a typed array constructor and 'blah' is exactly one argument,
+        is turned into the NewTypedArray intrinsic. Later, of child1 (i.e. 'blah')
+        is predicted integer, we generate inline code for an allocation. Otherwise
+        it turns into a call to an operation that behaves like the constructor would
+        if it was passed one argument (i.e. it may wrap a buffer or it may create a
+        copy or another array, or it may allocate an array of that length).
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromTypedArrayType):
+        (JSC::speculationFromClassInfo):
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasTypedArrayType):
+        (JSC::DFG::Node::typedArrayType):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::newTypedArrayWithSize):
+        (JSC::DFG::newTypedArrayWithOneArgument):
+        * dfg/DFGOperations.h:
+        (JSC::DFG::operationNewTypedArrayWithSizeForType):
+        (JSC::DFG::operationNewTypedArrayWithOneArgumentForType):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        * runtime/JSArray.h:
+        (JSC::JSArray::allocationSize):
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::allocationSize):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::allocationSize):
+        * runtime/TypedArrayType.cpp:
+        (JSC::constructorClassInfoForType):
+        * runtime/TypedArrayType.h:
+        (JSC::indexToTypedArrayType):
+
+2013-08-21  Julien Brianceau  <jbrianceau@nds.com>
+
+        <https://webkit.org/b/120106> Fix V_DFGOperation_EJPP signature in DFG.
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGOperations.h:
+
+2013-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120093
+        Remove getOwnPropertyDescriptor trap
+
+        Reviewed by Geoff Garen.
+
+        All implementations of this method are now called via the method table, and equivalent in behaviour.
+        Remove all duplicate implementations (and the method table trap), and add a single member function implementation on JSObject.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * debugger/DebuggerActivation.cpp:
+        * debugger/DebuggerActivation.h:
+        * runtime/Arguments.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ArrayPrototype.h:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/BooleanPrototype.h:
+            - remove getOwnPropertyDescriptor
+        * runtime/ClassInfo.h:
+            - remove getOwnPropertyDescriptor from MethodTable
+        * runtime/DateConstructor.cpp:
+        * runtime/DateConstructor.h:
+        * runtime/DatePrototype.cpp:
+        * runtime/DatePrototype.h:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/ErrorPrototype.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSArray.cpp:
+        * runtime/JSArray.h:
+        * runtime/JSArrayBuffer.cpp:
+        * runtime/JSArrayBuffer.h:
+        * runtime/JSArrayBufferView.cpp:
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        * runtime/JSDataView.cpp:
+        * runtime/JSDataView.h:
+        * runtime/JSDataViewPrototype.cpp:
+        * runtime/JSDataViewPrototype.h:
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.cpp:
+        * runtime/JSONObject.h:
+            - remove getOwnPropertyDescriptor
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::propertyIsEnumerable):
+            - switch to call new getOwnPropertyDescriptor member function
+        (JSC::JSObject::getOwnPropertyDescriptor):
+            - new, based on imlementation from GET_OWN_PROPERTY_DESCRIPTOR_IMPL
+        (JSC::JSObject::defineOwnNonIndexProperty):
+            - switch to call new getOwnPropertyDescriptor member function
+        * runtime/JSObject.h:
+        * runtime/JSProxy.cpp:
+        * runtime/JSProxy.h:
+        * runtime/NamePrototype.cpp:
+        * runtime/NamePrototype.h:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        * runtime/NumberPrototype.h:
+            - remove getOwnPropertyDescriptor
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+            - switch to call new getOwnPropertyDescriptor member function
+        * runtime/ObjectConstructor.h:
+            - remove getOwnPropertyDescriptor
+        * runtime/PropertyDescriptor.h:
+            - remove GET_OWN_PROPERTY_DESCRIPTOR_IMPL
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.cpp:
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        * runtime/StringObject.h:
+            - remove getOwnPropertyDescriptor
+
+2013-08-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        <https://webkit.org/b/120079> Flattening a dictionary can cause CopiedSpace corruption
+
+        Reviewed by Oliver Hunt.
+
+        When we flatten an object in dictionary mode, we compact its properties. If the object 
+        had out-of-line storage in the form of a Butterfly prior to this compaction, and after 
+        compaction its properties fit inline, the object's Structure "forgets" that the object 
+        has a non-zero Butterfly pointer. During GC, we check the Butterfly and reportLiveBytes 
+        with bytes = 0, which causes all sorts of badness in CopiedSpace.
+
+        Instead, after we flatten a dictionary, if properties fit inline we should clear the 
+        Butterfly pointer so that the GC doesn't get confused later.
+
+        This patch does this clearing, and it also adds JSObject::checkStructure, which overrides
+        JSCell::checkStructure to add an ASSERT that makes sure that the Structure being assigned
+        agrees with the whether or not the object has a Butterfly. Also added an ASSERT to check
+        that the number of bytes reported to SlotVisitor::copyLater is non-zero.
+
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::genericConvertDoubleToContiguous):
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::setButterfly):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructure):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+
+2013-08-20  Alex Christensen  <achristensen@apple.com>
+
+        Compile fix for Win64 after r154156.
+
+        Rubber stamped by Oliver Hunt.
+
+        * jit/JITStubsMSVC64.asm:
+        Renamed ctiVMThrowTrampolineSlowpath to ctiVMHandleException and
+        cti_vm_throw_slowpath to cti_vm_handle_exception.
+
+2013-08-20  Alex Christensen  <achristensen@apple.com>
+
+        <https://webkit.org/b/120076> More work towards a Win64 build
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
+        Use PlatformArchitecture macro instead of bin32, lib32, and obj32.
+
+2013-08-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        <https://webkit.org/b/119919> Concurrent JIT crashes in various fast/js/dfg-* tests while the main thread is setting innerHTML
+
+        Reviewed by Geoffrey Garen.
+
+        More fixes for WriteBarrier deferral during concurrent JIT-ing. This patch makes the use of DesiredWriteBarriers class and the 
+        initializeLazyWriteBarrierFor* wrapper functions more sane. 
+
+        Refactored DesiredWriteBarrier to require an owner, a type, a CodeBlock, and an index. The type indicates how to use the CodeBlock
+        and index when triggering the WriteBarrier at the end of compilation. 
+
+        The client code of initializeLazy* is now responsible for creating the WriteBarrier that will be initialized as well as passing
+        in the relevant index to be used at the end of compilation. Things were kind of muddled before in that one function did a 
+        little extra work that really shouldn't have been its responsibility.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGDesiredWriteBarriers.cpp:
+        (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
+        (JSC::DFG::DesiredWriteBarrier::trigger):
+        * dfg/DFGDesiredWriteBarriers.h:
+        (JSC::DFG::DesiredWriteBarriers::add):
+        (JSC::DFG::initializeLazyWriteBarrierForInlineCallFrameExecutable):
+        (JSC::DFG::initializeLazyWriteBarrierForInlineCallFrameCallee):
+        (JSC::DFG::initializeLazyWriteBarrierForConstant):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::truncateConstantToInt32):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::constantRegisterForConstant):
+
+2013-08-20  Michael Saboff  <msaboff@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120075
+        REGRESSION (r128400): BBC4 website not displaying pictures
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::createStructure): Changed the array IndexingType to be ArrayWithSlowPutArrayStorage
+        so that the match results will be reified before any other modification to the results array.
+
+2013-08-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Incorrect behavior on emscripten-compiled cube2hash
+        https://bugs.webkit.org/show_bug.cgi?id=120033
+
+        Reviewed by Mark Hahnenberg.
+        
+        If PutClosureVar is may-aliased to another PutClosureVar or GetClosureVar
+        then we should bail attempts to CSE.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (JSC::DFG::CSEPhase::scopedVarStoreElimination):
+
+2013-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120073
+        Remove use of GOPD from JSFunction::defineProperty
+
+        Reviewed by Oliver Hunt.
+
+        Call getOwnPropertySlot to check for existing properties instead.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::defineOwnProperty):
+            - getOwnPropertyDescriptor -> getOwnPropertySlot
+
+2013-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120067
+        Remove getPropertyDescriptor
+
+        Reviewed by Oliver Hunt.
+
+        This is used by lookupGetter/lookupSetter - this can easily bee replaced by getPropertySlot.
+        Since we'll be getting the GetterSetter from the slot in the setter case, rename isGetter() to isAccessor().
+
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+            - remove getPropertyDescriptor
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+            - replace call to getPropertyDescriptor with getPropertySlot
+        * runtime/PropertyDescriptor.h:
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isAccessor):
+        (JSC::PropertySlot::isCacheableGetter):
+        (JSC::PropertySlot::getterSetter):
+            - rename isGetter() to isAccessor()
+
+2013-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120054
+        Remove some dead code following getOwnPropertyDescriptor cleanup
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/Lookup.h:
+        (JSC::getStaticFunctionSlot):
+            - remove getStaticPropertyDescriptor, getStaticFunctionDescriptor, getStaticValueDescriptor.
+
+2013-08-20  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120052
+        Remove custom getOwnPropertyDescriptor for JSProxy
+
+        Reviewed by Geoff Garen.
+
+        GET_OWN_PROPERTY_DESCRIPTOR_IMPL runs afoul with JSProxy due to the workaround for JSDOMWindow's broken behavior.
+        Because the window object incorrectly searches the prototype chain in getOwnPropertySlot we check that the base
+        object matches, but in the case of JSProxy we can end up comparing the window object to the window shell & falsely
+        assuming this is a prototype property. Add toThis conversion to correctly identify proxied own access. I've kept
+        the original slotBase check as a fast case, and also so that direct access on JSDOMWindow still works.
+
+        * runtime/JSProxy.cpp:
+            - Remove custom getOwnPropertyDescriptor implementation.
+        * runtime/PropertyDescriptor.h:
+            - Modify own property access check to perform toThis conversion.
+
+2013-08-20  Alex Christensen  <achristensen@apple.com>
+
+        Use PlatformArchitecture to distinguish between 32-bit and 64-bit builds on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=119512
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
+        Replaced obj32, bin32, and lib32 with macros for 64-bit build.
+
+2013-08-20  Julien Brianceau  <jbrianceau@nds.com>
+
+        <https://webkit.org/b/120062> Missing ensureSpace call in sh4 baseline JIT.
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        branchPtrWithPatch() of baseline JIT must ensure that space is available for its
+        instructions and two constants now DFG is enabled for sh4 architecture.
+        These missing ensureSpace calls lead to random crashes.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchPtrWithPatch):
+
+2013-08-19  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120034
+        Remove custom getOwnPropertyDescriptor for global objects
+
+        Reviewed by Geoff Garen.
+
+        Fix attributes of JSC SynbolTableObject entries, ensure that cross frame access is safe, and suppress prototype chain walk.
+
+        * runtime/JSGlobalObject.cpp:
+            - Remove custom getOwnPropertyDescriptor implementation.
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+            - The symbol table does not store the DontDelete attribute, we should be adding it back in.
+        * runtime/PropertyDescriptor.h:
+            - JSDOMWindow walks the prototype chain on own access. This is bad, but for now workaround for the getOwnPropertyDescriptor case.
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::setUndefined):
+            - This is used by WebCore when blocking access to properties on cross-frame access.
+              Mark blocked properties as read-only, non-configurable to prevent defineProperty.
+
+2013-08-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should inline typedArray.byteOffset
+        https://bugs.webkit.org/show_bug.cgi?id=119962
+
+        Reviewed by Oliver Hunt.
+        
+        This adds a new node, GetTypedArrayByteOffset, which inlines
+        typedArray.byteOffset.
+        
+        Also, I improved a bunch of the clobbering logic related to typed arrays
+        and clobbering in general. For example, PutByOffset/PutStructure are not
+        clobber-world so they can be handled by most default cases in CSE. Also,
+        It's better to use the 'Class_field' notation for typed arrays now that
+        they no longer involve magical descriptor thingies.
+
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::neverNeedsStorage):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::getTypedArrayByteOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
+        (JSC::DFG::FixupPhase::convertToGetArrayLength):
+        (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        * runtime/ArrayBuffer.h:
+        (JSC::ArrayBuffer::offsetOfData):
+        * runtime/Butterfly.h:
+        (JSC::Butterfly::offsetOfArrayBuffer):
+        * runtime/IndexingHeader.h:
+        (JSC::IndexingHeader::offsetOfArrayBuffer):
+
+2013-08-18  Filip Pizlo  <fpizlo@apple.com>
+
+        <https://webkit.org/b/119994> DFG new Array() inlining could get confused about global objects
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+
+2013-08-18  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=119995
+        Start removing custom implementations of getOwnPropertyDescriptor
+
+        Reviewed by Oliver Hunt.
+
+        This can now typically implemented in terms of getOwnPropertySlot.
+        Add a macro to PropertyDescriptor to define an implementation of GOPD in terms of GOPS.
+        Switch over most classes in JSC & the WebCore bindings generator to use this.
+
+        * API/JSCallbackObjectFunctions.h:
+        * debugger/DebuggerActivation.cpp:
+        * runtime/Arguments.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSArrayBuffer.cpp:
+        * runtime/JSArrayBufferView.cpp:
+        * runtime/JSCell.cpp:
+        * runtime/JSDataView.cpp:
+        * runtime/JSDataViewPrototype.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.cpp:
+        * runtime/NamePrototype.cpp:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectConstructor.cpp:
+            - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
+        * runtime/PropertyDescriptor.h:
+            - Added GET_OWN_PROPERTY_DESCRIPTOR_IMPL macro.
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isValue):
+        (JSC::PropertySlot::isGetter):
+        (JSC::PropertySlot::isCustom):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::isCacheableGetter):
+        (JSC::PropertySlot::isCacheableCustom):
+        (JSC::PropertySlot::attributes):
+        (JSC::PropertySlot::getterSetter):
+            - Add accessors necessary to convert PropertySlot to descriptor.
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpMatchesArray.cpp:
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringObject.cpp:
+            - Implement getOwnPropertySlot in terms of GET_OWN_PROPERTY_DESCRIPTOR_IMPL.
+
+2013-08-19  Michael Saboff  <msaboff@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120015 DFG 32Bit: Crash loading "Classic" site @ translate.google.com
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell): Added checks for spillFormat being
+        DataFormatInteger or DataFormatDouble similar to what is in the 64 bit code and in
+        all versions of fillSpeculateBoolean().
+
+2013-08-19  Michael Saboff  <msaboff@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=120020 Change Set 154207 causes wrong register to be used for 32 bit tests
+
+        Reviewed by Benjamin Poulain.
+
+        Change branshTest32 to only use the byte for 8 bit test on the lower 4 registers.
+        Registers 4 through 7 as byte regisers are ah, ch, dh and bh instead of sp, bp, si and di.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTest32):
+
+2013-08-16  Oliver Hunt  <oliver@apple.com>
+
+        <https://webkit.org/b/119860> Crash during exception unwinding
+
+        Reviewed by Filip Pizlo.
+
+        Add an "Unreachable" NodeType, and then rearrange op_throw and op_throw_reference_error
+        to plant Throw or ThrowReferenceError followed by a flush and then the Unreachable node.
+
+        We need this so that Throw and ThrowReferenceError no longer need to be treated as
+        terminals and the subsequent flush keeps the activation (and other registers) live.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isTerminal):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-08-19  Víctor Manuel Jáquez Leal  <vjaquez@igalia.com>
+
+        <https://webkit.org/b/120008> [GTK][ARM] javascriptcore compilation is broken
+
+        Reviewed by Oliver Hunt.
+
+        Guard the compilation of these files only if DFG_JIT is enabled.
+
+        * dfg/DFGDesiredTransitions.cpp:
+        * dfg/DFGDesiredTransitions.h:
+        * dfg/DFGDesiredWeakReferences.cpp:
+        * dfg/DFGDesiredWeakReferences.h:
+        * dfg/DFGDesiredWriteBarriers.cpp:
+        * dfg/DFGDesiredWriteBarriers.h:
+
+2013-08-17  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r154218): DFG::FixupPhase no longer turns GetById's child1 into CellUse
+        https://bugs.webkit.org/show_bug.cgi?id=119961
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2013-08-18  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=119972
+        Add attributes field to PropertySlot
+
+        Reviewed by Geoff Garen.
+
+        For all JSC types, this makes getOwnPropertyDescriptor redundant.
+        There will be a bit more hacking required in WebCore to remove GOPD whilst maintaining current behaviour.
+        (Current behaviour is in many ways broken, particularly in that GOPD & GOPS are inconsistent, but we should fix incrementally).
+
+        No performance impact.
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCacheableCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+            - These mathods now all require 'attributes'.
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+            - Added variants of getDirect, getDirectOffset that return the attributes.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlotByIndex):
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::getOwnPropertySlot):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::getOwnPropertySlot):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::getOwnPropertySlot):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::getOwnPropertySlotByIndex):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticValueSlot):
+        (JSC::getStaticValueDescriptor):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayEntry::get):
+            - Pass attributes to PropertySlot::set* methods.
+
+2013-08-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        <https://webkit.org/b/119919> Concurrent JIT crashes in various fast/js/dfg-* tests while the main thread is setting innerHTML
+
+        Reviewed by Filip Pizlo.
+
+        Added a new mode for DesiredWriteBarrier that allows it to track a position in a 
+        Vector of WriteBarriers rather than the specific address. The fact that we were 
+        arbitrarily storing into a Vector's backing store for constants at the end of 
+        compilation after the Vector could have resized was causing crashes.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::constants):
+        (JSC::CodeBlock::addConstantLazily):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addConstant):
+        * dfg/DFGDesiredWriteBarriers.cpp:
+        (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
+        (JSC::DFG::DesiredWriteBarrier::trigger):
+        (JSC::DFG::initializeLazyWriteBarrierForConstant):
+        * dfg/DFGDesiredWriteBarriers.h:
+        (JSC::DFG::DesiredWriteBarriers::add):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::truncateConstantToInt32):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::constantRegisterForConstant):
+
+2013-08-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should optimize typedArray.byteLength
+        https://bugs.webkit.org/show_bug.cgi?id=119909
+
+        Reviewed by Oliver Hunt.
+        
+        This adds typedArray.byteLength inlining to the DFG, and does so without changing
+        the IR: byteLength is turned into GetArrayLength followed by BitLShift. This is
+        legal since the byteLength of a typed array cannot exceed
+        numeric_limits<int32_t>::max().
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::typedArrayTypeFromSpeculation):
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::toArrayType):
+        * dfg/DFGArrayMode.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
+        (JSC::DFG::FixupPhase::attemptToMakeGetByteLength):
+        (JSC::DFG::FixupPhase::convertToGetArrayLength):
+        (JSC::DFG::FixupPhase::prependGetArrayLength):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::constantRegisterForConstant):
+        (JSC::DFG::Graph::convertToConstant):
+        * runtime/TypedArrayType.h:
+        (JSC::logElementSize):
+        (JSC::elementSize):
+
+2013-08-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG optimizes out strict mode arguments tear off
+        https://bugs.webkit.org/show_bug.cgi?id=119504
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+        
+        Don't do the optimization for strict mode.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::pruneObviousArgumentCreations):
+
+2013-08-16  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] x86: improve code generation for xxxTest32
+        https://bugs.webkit.org/show_bug.cgi?id=119876
+
+        Reviewed by Geoffrey Garen.
+
+        Try to use testb whenever possible when testing for an immediate value.
+
+        When the input is an address and an offset, we can tweak the mask
+        and offset to be able to generate testb for any byte of the mask.
+
+        When the input is a register, we can use testb if we are only interested
+        in testing the low bits.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::test32):
+        (JSC::MacroAssemblerX86Common::generateTest32):
+
+2013-08-16  Mark Lam  <mark.lam@apple.com>
+
+        <https://bugs.webkit.org/show_bug.cgi?id=119913> Baseline JIT gives erroneous
+        error message that an object is not a constructor though it expects a function
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2013-08-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Object properties added using dot syntax (o.f = ...) from code that isn't in eval should be less likely to cause an object to become a dictionary
+        https://bugs.webkit.org/show_bug.cgi?id=119897
+
+        Reviewed by Oliver Hunt.
+        
+        6-10x speed-up on microbenchmarks that create large static objects. 40-65% speed-up
+        on Octane/gbemu. 3% overall speed-up on Octane. No slow-downs anywhere; our ability
+        to turn objects into dictionaries when you're storing using bracket syntax or using
+        eval is still in place.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::putByIdContext):
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::context):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        * runtime/Structure.h:
+
+2013-08-16  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        <https://webkit.org/b/119742> REGRESSION(FTL): Fix register usage in mips implementation of ctiVMHandleException
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        ctiVMHandleException must jump/return using register ra (r31).
+
+        * jit/JITStubsMIPS.h:
+
+2013-08-16  Julien Brianceau  <jbrianceau@nds.com>
+
+        <https://webkit.org/b/119879> Fix sh4 build after r154156.
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        Fix typo in JITStubsSH4.h file.
+
+        * jit/JITStubsSH4.h:
+
+2013-08-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        <https://webkit.org/b/119833> Concurrent compilation thread should not trigger WriteBarriers
+
+        Reviewed by Oliver Hunt.
+
+        The concurrent compilation thread should interact minimally with the Heap, including not 
+        triggering WriteBarriers. This is a prerequisite for generational GC.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::addOrFindConstant):
+        (JSC::CodeBlock::findConstant):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addConstantLazily):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getJSConstantForValue):
+        (JSC::DFG::ByteCodeParser::constantUndefined):
+        (JSC::DFG::ByteCodeParser::constantNull):
+        (JSC::DFG::ByteCodeParser::one):
+        (JSC::DFG::ByteCodeParser::constantNaN):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::notifyCompilingStructureTransition):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGDesiredTransitions.cpp: Added.
+        (JSC::DFG::DesiredTransition::DesiredTransition):
+        (JSC::DFG::DesiredTransition::reallyAdd):
+        (JSC::DFG::DesiredTransitions::DesiredTransitions):
+        (JSC::DFG::DesiredTransitions::~DesiredTransitions):
+        (JSC::DFG::DesiredTransitions::addLazily):
+        (JSC::DFG::DesiredTransitions::reallyAdd):
+        * dfg/DFGDesiredTransitions.h: Added.
+        * dfg/DFGDesiredWeakReferences.cpp: Added.
+        (JSC::DFG::DesiredWeakReferences::DesiredWeakReferences):
+        (JSC::DFG::DesiredWeakReferences::~DesiredWeakReferences):
+        (JSC::DFG::DesiredWeakReferences::addLazily):
+        (JSC::DFG::DesiredWeakReferences::reallyAdd):
+        * dfg/DFGDesiredWeakReferences.h: Added.
+        * dfg/DFGDesiredWriteBarriers.cpp: Added.
+        (JSC::DFG::DesiredWriteBarrier::DesiredWriteBarrier):
+        (JSC::DFG::DesiredWriteBarrier::trigger):
+        (JSC::DFG::DesiredWriteBarriers::DesiredWriteBarriers):
+        (JSC::DFG::DesiredWriteBarriers::~DesiredWriteBarriers):
+        (JSC::DFG::DesiredWriteBarriers::addImpl):
+        (JSC::DFG::DesiredWriteBarriers::trigger):
+        * dfg/DFGDesiredWriteBarriers.h: Added.
+        (JSC::DFG::DesiredWriteBarriers::add):
+        (JSC::DFG::initializeLazyWriteBarrier):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::truncateConstantToInt32):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::convertToConstant):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addWeakReference):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::reallyAdd):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrier::WriteBarrier):
+
+2013-08-15  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix x86 32bits build after r154158
+
+        * assembler/X86Assembler.h: Add missing #ifdef for the x86_64 instructions.
+
+2013-08-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix attempt after r154156.
+
+        * jit/JITStubs.cpp:
+        (JSC::cti_vm_handle_exception): encode!
+
+2013-08-15  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] x86: Use inc and dec when possible
+        https://bugs.webkit.org/show_bug.cgi?id=119831
+
+        Reviewed by Geoffrey Garen.
+
+        When incrementing or decrementing by an immediate of 1, use the insctructions
+        inc and dec instead of add and sub.
+        The instructions have good timing and their encoding is smaller.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::sub32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add64):
+        (JSC::MacroAssemblerX86_64::sub64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::dec_r):
+        (JSC::X86Assembler::decq_r):
+        (JSC::X86Assembler::inc_r):
+        (JSC::X86Assembler::incq_r):
+
+2013-08-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Sometimes, the DFG uses a GetById for typed array length accesses despite profiling data that indicates that it's a typed array length access
+        https://bugs.webkit.org/show_bug.cgi?id=119874
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        It was a confusion between heuristics in DFG::ArrayMode that are assuming that
+        you'll use ForceExit if array profiles are empty, the JIT creating empty profiles
+        sometimes for typed array length accesses, and the FixupPhase assuming that a
+        ForceExit ArrayMode means that it should continue using a generic GetById.
+
+        This fixes the confusion.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2013-08-15  Mark Lam  <mark.lam@apple.com>
+
+        Fix crash when performing activation tearoff.
+        https://bugs.webkit.org/show_bug.cgi?id=119848
+
+        Reviewed by Oliver Hunt.
+
+        The activation tearoff crash was due to a bug in the baseline JIT.
+        If we have a scenario where the a baseline JIT frame calls a LLINT
+        frame, an exception may be thrown while in the LLINT.
+
+        Interpreter::throwException() which handles the exception will unwind
+        all frames until it finds a catcher or sees a host frame. When we
+        return from the LLINT to the baseline JIT code, the baseline JIT code
+        errorneously sets topCallFrame to the value in its call frame register,
+        and starts unwinding the stack frames that have already been unwound.
+
+        The fix is:
+        1. Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
+           This is a more accurate description of what this runtime function
+           is supposed to do i.e. it handles the exception which include doing
+           nothing (if there are no more frames to unwind).
+        2. Fix up topCallFrame values so that the HostCallFrameFlag is never
+           set on it.
+        3. Reloading the call frame register from topCallFrame when we're
+           returning from a callee and detect exception handling in progress.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        - Ensure that topCallFrame is not set with the HostCallFrameFlag.
+        (JSC::Interpreter::getStackTrace):
+        * interpreter/Interpreter.h:
+        (JSC::TopCallFrameSetter::TopCallFrameSetter):
+        (JSC::TopCallFrameSetter::~TopCallFrameSetter):
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        - Ensure that topCallFrame is not set with the HostCallFrameFlag.
+        * jit/JIT.h:
+        * jit/JITExceptions.cpp:
+        (JSC::uncaughtExceptionHandler):
+        - Convenience function to get the handler for uncaught exceptions.
+        * jit/JITExceptions.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::reloadCallFrameFromTopCallFrame):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
+        * jit/JITStubs.cpp:
+        (JSC::throwExceptionFromOpCall):
+        - Ensure that topCallFrame is not set with the HostCallFrameFlag.
+        (JSC::cti_vm_handle_exception):
+        - Check for the case when there are no more frames to unwind.
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsMIPS.h:
+        * jit/JITStubsSH4.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+        - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+        - reload cfr from topcallFrame when handling an exception.
+        - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        - reload cfr from topcallFrame when handling an exception.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        - Ensure that topCallFrame is not set with the HostCallFrameFlag.
+
+2013-08-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove some code duplication.
+        
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+
+2013-08-15  Julien Brianceau  <jbrianceau@nds.com>
+
+        [DFG] isDouble() and isNumerical() should return true with KnownNumberUse UseKind.
+        https://bugs.webkit.org/show_bug.cgi?id=119794
+
+        Reviewed by Filip Pizlo.
+
+        This patch fixes ASSERTs failures in debug builds for sh4 and mips architecture.
+
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::isNumerical):
+        (JSC::DFG::isDouble):
+
+2013-08-15  Filip Pizlo  <fpizlo@apple.com>
+
+        http://trac.webkit.org/changeset/154120 accidentally changed DFGCapabilities to read the resolve type from operand 4, not 3; it should be 3.
+
+        Rubber stamped by Oliver Hunt.
+        
+        This was causing some test crashes for me.
+
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+
+2013-08-15  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Clear up improper export declaration.
+
+        * runtime/ArrayBufferView.h:
+
+2013-08-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, remove some unnecessary periods from exceptions.
+
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+
+2013-08-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix 32-bit build.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-08-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Typed arrays should be rewritten
+        https://bugs.webkit.org/show_bug.cgi?id=119064
+
+        Reviewed by Oliver Hunt.
+        
+        Typed arrays were previously deficient in several major ways:
+        
+        - They were defined separately in WebCore and in the jsc shell. The two
+          implementations were different, and the jsc shell one was basically wrong.
+          The WebCore one was quite awful, also.
+        
+        - Typed arrays were not visible to the JIT except through some weird hooks.
+          For example, the JIT could not ask "what is the Structure that this typed
+          array would have if I just allocated it from this global object". Also,
+          it was difficult to wire any of the typed array intrinsics, because most
+          of the functionality wasn't visible anywhere in JSC.
+        
+        - Typed array allocation was brain-dead. Allocating a typed array involved
+          two JS objects, two GC weak handles, and three malloc allocations.
+        
+        - Neutering. It involved keeping tabs on all native views but not the view
+          wrappers, even though the native views can autoneuter just by asking the
+          buffer if it was neutered anytime you touch them; while the JS view
+          wrappers are the ones that you really want to reach out to.
+        
+        - Common case-ing. Most typed arrays have one buffer and one view, and
+          usually nobody touches the buffer. Yet we created all of that stuff
+          anyway, using data structures optimized for the case where you had a lot
+          of views.
+        
+        - Semantic goofs. Typed arrays should, in the future, behave like ES
+          features rather than DOM features, for example when it comes to exceptions.
+          Firefox already does this and I agree with them.
+        
+        This patch cleanses our codebase of these sins:
+        
+        - Typed arrays are almost entirely defined in JSC. Only the lifecycle
+          management of native references to buffers is left to WebCore.
+        
+        - Allocating a typed array requires either two GC allocations (a cell and a
+          copied storage vector) or one GC allocation, a malloc allocation, and a
+          weak handle (a cell and a malloc'd storage vector, plus a finalizer for the
+          latter). The latter is only used for oversize arrays. Remember that before
+          it was 7 allocations no matter what.
+        
+        - Typed arrays require just 4 words of overhead: Structure*, Butterfly*,
+          mode/length, void* vector. Before it was a lot more than that - remember,
+          there were five additional objects that did absolutely nothing for anybody.
+        
+        - Native views aren't tracked by the buffer, or by the wrappers. They are
+          transient. In the future we'll probably switch to not even having them be
+          malloc'd.
+        
+        - Native array buffers have an efficient way of tracking all of their JS view
+          wrappers, both for neutering, and for lifecycle management. The GC
+          special-cases native array buffers. This saves a bunch of grief; for example
+          it means that a JS view wrapper can refer to its buffer via the butterfly,
+          which would be dead by the time we went to finalize.
+        
+        - Typed array semantics now match Firefox, which also happens to be where the
+          standards are going. The discussion on webkit-dev seemed to confirm that
+          Chrome is also heading in this direction. This includes making
+          Uint8ClampedArray not a subtype of Uint8Array, and getting rid of
+          ArrayBufferView as a JS-visible construct.
+        
+        This is up to a 10x speed-up on programs that allocate a lot of typed arrays.
+        It's a 1% speed-up on Octane. It also opens up a bunch of possibilities for
+        further typed array optimizations in the JSC JITs, including inlining typed
+        array allocation, inlining more of the accessors, reducing the cost of type
+        checks, etc.
+        
+        An additional property of this patch is that typed arrays are mostly
+        implemented using templates. This deduplicates a bunch of code, but does mean
+        that we need some hacks for exporting s_info's of template classes. See
+        JSGenericTypedArrayView.h and JSTypedArrays.cpp. Those hacks are fairly
+        low-impact compared to code duplication.
+        
+        Automake work courtesy of Zan Dobersek <zdobersek@igalia.com>.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * JSCTypedArrayStubs.h: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/ByValInfo.h:
+        (JSC::hasOptimizableIndexingForClassInfo):
+        (JSC::jitArrayModeForClassInfo):
+        (JSC::typedArrayTypeForJITArrayMode):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromClassInfo):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::toTypedArrayType):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::typedArrayType):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/CopyToken.h:
+        * heap/DeferGC.h:
+        (JSC::DeferGCForAWhile::DeferGCForAWhile):
+        (JSC::DeferGCForAWhile::~DeferGCForAWhile):
+        * heap/GCIncomingRefCounted.h: Added.
+        (JSC::GCIncomingRefCounted::GCIncomingRefCounted):
+        (JSC::GCIncomingRefCounted::~GCIncomingRefCounted):
+        (JSC::GCIncomingRefCounted::numberOfIncomingReferences):
+        (JSC::GCIncomingRefCounted::incomingReferenceAt):
+        (JSC::GCIncomingRefCounted::singletonFlag):
+        (JSC::GCIncomingRefCounted::hasVectorOfCells):
+        (JSC::GCIncomingRefCounted::hasAnyIncoming):
+        (JSC::GCIncomingRefCounted::hasSingleton):
+        (JSC::GCIncomingRefCounted::singleton):
+        (JSC::GCIncomingRefCounted::vectorOfCells):
+        * heap/GCIncomingRefCountedInlines.h: Added.
+        (JSC::::addIncomingReference):
+        (JSC::::filterIncomingReferences):
+        * heap/GCIncomingRefCountedSet.h: Added.
+        (JSC::GCIncomingRefCountedSet::size):
+        * heap/GCIncomingRefCountedSetInlines.h: Added.
+        (JSC::::GCIncomingRefCountedSet):
+        (JSC::::~GCIncomingRefCountedSet):
+        (JSC::::addReference):
+        (JSC::::sweep):
+        (JSC::::removeAll):
+        (JSC::::removeDead):
+        * heap/Heap.cpp:
+        (JSC::Heap::addReference):
+        (JSC::Heap::extraSize):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::collect):
+        (JSC::Heap::decrementDeferralDepth):
+        (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
+        * heap/Heap.h:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::dataViewTable):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompilePutByVal):
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * runtime/ArrayBuffer.cpp:
+        (JSC::ArrayBuffer::transfer):
+        * runtime/ArrayBuffer.h:
+        (JSC::ArrayBuffer::createAdopted):
+        (JSC::ArrayBuffer::ArrayBuffer):
+        (JSC::ArrayBuffer::gcSizeEstimateInBytes):
+        (JSC::ArrayBuffer::pin):
+        (JSC::ArrayBuffer::unpin):
+        (JSC::ArrayBufferContents::tryAllocate):
+        * runtime/ArrayBufferView.cpp:
+        (JSC::ArrayBufferView::ArrayBufferView):
+        (JSC::ArrayBufferView::~ArrayBufferView):
+        (JSC::ArrayBufferView::setNeuterable):
+        * runtime/ArrayBufferView.h:
+        (JSC::ArrayBufferView::isNeutered):
+        (JSC::ArrayBufferView::buffer):
+        (JSC::ArrayBufferView::baseAddress):
+        (JSC::ArrayBufferView::byteOffset):
+        (JSC::ArrayBufferView::verifySubRange):
+        (JSC::ArrayBufferView::clampOffsetAndNumElements):
+        (JSC::ArrayBufferView::calculateOffsetAndLength):
+        * runtime/ClassInfo.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/DataView.cpp: Added.
+        (JSC::DataView::DataView):
+        (JSC::DataView::create):
+        (JSC::DataView::wrap):
+        * runtime/DataView.h: Added.
+        (JSC::DataView::byteLength):
+        (JSC::DataView::getType):
+        (JSC::DataView::get):
+        (JSC::DataView::set):
+        * runtime/Float32Array.h:
+        * runtime/Float64Array.h:
+        * runtime/GenericTypedArrayView.h: Added.
+        (JSC::GenericTypedArrayView::data):
+        (JSC::GenericTypedArrayView::set):
+        (JSC::GenericTypedArrayView::setRange):
+        (JSC::GenericTypedArrayView::zeroRange):
+        (JSC::GenericTypedArrayView::zeroFill):
+        (JSC::GenericTypedArrayView::length):
+        (JSC::GenericTypedArrayView::byteLength):
+        (JSC::GenericTypedArrayView::item):
+        (JSC::GenericTypedArrayView::checkInboundData):
+        (JSC::GenericTypedArrayView::getType):
+        * runtime/GenericTypedArrayViewInlines.h: Added.
+        (JSC::::GenericTypedArrayView):
+        (JSC::::create):
+        (JSC::::createUninitialized):
+        (JSC::::subarray):
+        (JSC::::wrap):
+        * runtime/IndexingHeader.h:
+        (JSC::IndexingHeader::arrayBuffer):
+        (JSC::IndexingHeader::setArrayBuffer):
+        * runtime/Int16Array.h:
+        * runtime/Int32Array.h:
+        * runtime/Int8Array.h:
+        * runtime/JSArrayBuffer.cpp: Added.
+        (JSC::JSArrayBuffer::JSArrayBuffer):
+        (JSC::JSArrayBuffer::finishCreation):
+        (JSC::JSArrayBuffer::create):
+        (JSC::JSArrayBuffer::createStructure):
+        (JSC::JSArrayBuffer::getOwnPropertySlot):
+        (JSC::JSArrayBuffer::getOwnPropertyDescriptor):
+        (JSC::JSArrayBuffer::put):
+        (JSC::JSArrayBuffer::defineOwnProperty):
+        (JSC::JSArrayBuffer::deleteProperty):
+        (JSC::JSArrayBuffer::getOwnNonIndexPropertyNames):
+        * runtime/JSArrayBuffer.h: Added.
+        (JSC::JSArrayBuffer::impl):
+        (JSC::toArrayBuffer):
+        * runtime/JSArrayBufferConstructor.cpp: Added.
+        (JSC::JSArrayBufferConstructor::JSArrayBufferConstructor):
+        (JSC::JSArrayBufferConstructor::finishCreation):
+        (JSC::JSArrayBufferConstructor::create):
+        (JSC::JSArrayBufferConstructor::createStructure):
+        (JSC::constructArrayBuffer):
+        (JSC::JSArrayBufferConstructor::getConstructData):
+        (JSC::JSArrayBufferConstructor::getCallData):
+        * runtime/JSArrayBufferConstructor.h: Added.
+        * runtime/JSArrayBufferPrototype.cpp: Added.
+        (JSC::arrayBufferProtoFuncSlice):
+        (JSC::JSArrayBufferPrototype::JSArrayBufferPrototype):
+        (JSC::JSArrayBufferPrototype::finishCreation):
+        (JSC::JSArrayBufferPrototype::create):
+        (JSC::JSArrayBufferPrototype::createStructure):
+        * runtime/JSArrayBufferPrototype.h: Added.
+        * runtime/JSArrayBufferView.cpp: Added.
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        (JSC::JSArrayBufferView::JSArrayBufferView):
+        (JSC::JSArrayBufferView::finishCreation):
+        (JSC::JSArrayBufferView::getOwnPropertySlot):
+        (JSC::JSArrayBufferView::getOwnPropertyDescriptor):
+        (JSC::JSArrayBufferView::put):
+        (JSC::JSArrayBufferView::defineOwnProperty):
+        (JSC::JSArrayBufferView::deleteProperty):
+        (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
+        (JSC::JSArrayBufferView::finalize):
+        * runtime/JSArrayBufferView.h: Added.
+        (JSC::JSArrayBufferView::sizeOf):
+        (JSC::JSArrayBufferView::ConstructionContext::operator!):
+        (JSC::JSArrayBufferView::ConstructionContext::structure):
+        (JSC::JSArrayBufferView::ConstructionContext::vector):
+        (JSC::JSArrayBufferView::ConstructionContext::length):
+        (JSC::JSArrayBufferView::ConstructionContext::mode):
+        (JSC::JSArrayBufferView::ConstructionContext::butterfly):
+        (JSC::JSArrayBufferView::mode):
+        (JSC::JSArrayBufferView::vector):
+        (JSC::JSArrayBufferView::length):
+        (JSC::JSArrayBufferView::offsetOfVector):
+        (JSC::JSArrayBufferView::offsetOfLength):
+        (JSC::JSArrayBufferView::offsetOfMode):
+        * runtime/JSArrayBufferViewInlines.h: Added.
+        (JSC::JSArrayBufferView::slowDownAndWasteMemoryIfNecessary):
+        (JSC::JSArrayBufferView::buffer):
+        (JSC::JSArrayBufferView::impl):
+        (JSC::JSArrayBufferView::neuter):
+        (JSC::JSArrayBufferView::byteOffset):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::slowDownAndWasteMemory):
+        (JSC::JSCell::getTypedArrayImpl):
+        * runtime/JSCell.h:
+        * runtime/JSDataView.cpp: Added.
+        (JSC::JSDataView::JSDataView):
+        (JSC::JSDataView::create):
+        (JSC::JSDataView::createUninitialized):
+        (JSC::JSDataView::set):
+        (JSC::JSDataView::typedImpl):
+        (JSC::JSDataView::getOwnPropertySlot):
+        (JSC::JSDataView::getOwnPropertyDescriptor):
+        (JSC::JSDataView::slowDownAndWasteMemory):
+        (JSC::JSDataView::getTypedArrayImpl):
+        (JSC::JSDataView::createStructure):
+        * runtime/JSDataView.h: Added.
+        * runtime/JSDataViewPrototype.cpp: Added.
+        (JSC::JSDataViewPrototype::JSDataViewPrototype):
+        (JSC::JSDataViewPrototype::create):
+        (JSC::JSDataViewPrototype::createStructure):
+        (JSC::JSDataViewPrototype::getOwnPropertySlot):
+        (JSC::JSDataViewPrototype::getOwnPropertyDescriptor):
+        (JSC::getData):
+        (JSC::setData):
+        (JSC::dataViewProtoFuncGetInt8):
+        (JSC::dataViewProtoFuncGetInt16):
+        (JSC::dataViewProtoFuncGetInt32):
+        (JSC::dataViewProtoFuncGetUint8):
+        (JSC::dataViewProtoFuncGetUint16):
+        (JSC::dataViewProtoFuncGetUint32):
+        (JSC::dataViewProtoFuncGetFloat32):
+        (JSC::dataViewProtoFuncGetFloat64):
+        (JSC::dataViewProtoFuncSetInt8):
+        (JSC::dataViewProtoFuncSetInt16):
+        (JSC::dataViewProtoFuncSetInt32):
+        (JSC::dataViewProtoFuncSetUint8):
+        (JSC::dataViewProtoFuncSetUint16):
+        (JSC::dataViewProtoFuncSetUint32):
+        (JSC::dataViewProtoFuncSetFloat32):
+        (JSC::dataViewProtoFuncSetFloat64):
+        * runtime/JSDataViewPrototype.h: Added.
+        * runtime/JSFloat32Array.h: Added.
+        * runtime/JSFloat64Array.h: Added.
+        * runtime/JSGenericTypedArrayView.h: Added.
+        (JSC::JSGenericTypedArrayView::byteLength):
+        (JSC::JSGenericTypedArrayView::byteSize):
+        (JSC::JSGenericTypedArrayView::typedVector):
+        (JSC::JSGenericTypedArrayView::canGetIndexQuickly):
+        (JSC::JSGenericTypedArrayView::canSetIndexQuickly):
+        (JSC::JSGenericTypedArrayView::getIndexQuicklyAsNativeValue):
+        (JSC::JSGenericTypedArrayView::getIndexQuicklyAsDouble):
+        (JSC::JSGenericTypedArrayView::getIndexQuickly):
+        (JSC::JSGenericTypedArrayView::setIndexQuicklyToNativeValue):
+        (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble):
+        (JSC::JSGenericTypedArrayView::setIndexQuickly):
+        (JSC::JSGenericTypedArrayView::canAccessRangeQuickly):
+        (JSC::JSGenericTypedArrayView::typedImpl):
+        (JSC::JSGenericTypedArrayView::createStructure):
+        (JSC::JSGenericTypedArrayView::info):
+        (JSC::toNativeTypedView):
+        * runtime/JSGenericTypedArrayViewConstructor.h: Added.
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h: Added.
+        (JSC::::JSGenericTypedArrayViewConstructor):
+        (JSC::::finishCreation):
+        (JSC::::create):
+        (JSC::::createStructure):
+        (JSC::constructGenericTypedArrayView):
+        (JSC::::getConstructData):
+        (JSC::::getCallData):
+        * runtime/JSGenericTypedArrayViewInlines.h: Added.
+        (JSC::::JSGenericTypedArrayView):
+        (JSC::::create):
+        (JSC::::createUninitialized):
+        (JSC::::validateRange):
+        (JSC::::setWithSpecificType):
+        (JSC::::set):
+        (JSC::::getOwnPropertySlot):
+        (JSC::::getOwnPropertyDescriptor):
+        (JSC::::put):
+        (JSC::::defineOwnProperty):
+        (JSC::::deleteProperty):
+        (JSC::::getOwnPropertySlotByIndex):
+        (JSC::::putByIndex):
+        (JSC::::deletePropertyByIndex):
+        (JSC::::getOwnNonIndexPropertyNames):
+        (JSC::::getOwnPropertyNames):
+        (JSC::::visitChildren):
+        (JSC::::copyBackingStore):
+        (JSC::::slowDownAndWasteMemory):
+        (JSC::::getTypedArrayImpl):
+        * runtime/JSGenericTypedArrayViewPrototype.h: Added.
+        * runtime/JSGenericTypedArrayViewPrototypeInlines.h: Added.
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncSubarray):
+        (JSC::::JSGenericTypedArrayViewPrototype):
+        (JSC::::finishCreation):
+        (JSC::::create):
+        (JSC::::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrayBufferPrototype):
+        (JSC::JSGlobalObject::arrayBufferStructure):
+        (JSC::JSGlobalObject::typedArrayStructure):
+        * runtime/JSInt16Array.h: Added.
+        * runtime/JSInt32Array.h: Added.
+        * runtime/JSInt8Array.h: Added.
+        * runtime/JSTypedArrayConstructors.cpp: Added.
+        * runtime/JSTypedArrayConstructors.h: Added.
+        * runtime/JSTypedArrayPrototypes.cpp: Added.
+        * runtime/JSTypedArrayPrototypes.h: Added.
+        * runtime/JSTypedArrays.cpp: Added.
+        * runtime/JSTypedArrays.h: Added.
+        * runtime/JSUint16Array.h: Added.
+        * runtime/JSUint32Array.h: Added.
+        * runtime/JSUint8Array.h: Added.
+        * runtime/JSUint8ClampedArray.h: Added.
+        * runtime/Operations.h:
+        * runtime/Options.h:
+        * runtime/SimpleTypedArrayController.cpp: Added.
+        (JSC::SimpleTypedArrayController::SimpleTypedArrayController):
+        (JSC::SimpleTypedArrayController::~SimpleTypedArrayController):
+        (JSC::SimpleTypedArrayController::toJS):
+        * runtime/SimpleTypedArrayController.h: Added.
+        * runtime/Structure.h:
+        (JSC::Structure::couldHaveIndexingHeader):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::hasIndexingHeader):
+        * runtime/TypedArrayAdaptors.h: Added.
+        (JSC::IntegralTypedArrayAdaptor::toNative):
+        (JSC::IntegralTypedArrayAdaptor::toJSValue):
+        (JSC::IntegralTypedArrayAdaptor::toDouble):
+        (JSC::FloatTypedArrayAdaptor::toNative):
+        (JSC::FloatTypedArrayAdaptor::toJSValue):
+        (JSC::FloatTypedArrayAdaptor::toDouble):
+        (JSC::Uint8ClampedAdaptor::toNative):
+        (JSC::Uint8ClampedAdaptor::toJSValue):
+        (JSC::Uint8ClampedAdaptor::toDouble):
+        (JSC::Uint8ClampedAdaptor::clamp):
+        * runtime/TypedArrayController.cpp: Added.
+        (JSC::TypedArrayController::TypedArrayController):
+        (JSC::TypedArrayController::~TypedArrayController):
+        * runtime/TypedArrayController.h: Added.
+        * runtime/TypedArrayDescriptor.h: Removed.
+        * runtime/TypedArrayInlines.h: Added.
+        * runtime/TypedArrayType.cpp: Added.
+        (JSC::classInfoForType):
+        (WTF::printInternal):
+        * runtime/TypedArrayType.h: Added.
+        (JSC::toIndex):
+        (JSC::isTypedView):
+        (JSC::elementSize):
+        (JSC::isInt):
+        (JSC::isFloat):
+        (JSC::isSigned):
+        (JSC::isClamped):
+        * runtime/TypedArrays.h: Added.
+        * runtime/Uint16Array.h:
+        * runtime/Uint32Array.h:
+        * runtime/Uint8Array.h:
+        * runtime/Uint8ClampedArray.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h:
+
+2013-08-15  Oliver Hunt  <oliver@apple.com>
+
+        <https://webkit.org/b/119830> Assigning to a readonly global results in DFG byte code parse failure
+
+        Reviewed by Filip Pizlo.
+
+        Make sure dfgCapabilities doesn't report a Dynamic put as
+        being compilable when we don't actually support it.  
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+
+2013-08-15  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Incorrect DLL Linkage for JSC ArrayBuffer and ArrayBufferView
+        https://bugs.webkit.org/show_bug.cgi?id=119847
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/ArrayBuffer.h: Switch from WTF_EXPORT_PRIVATE to JS_EXPORT_PRIVATE
+        * runtime/ArrayBufferView.h: Ditto.
+
+2013-08-15  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=119843
+        PropertySlot::setValue is ambiguous
+
+        Reviewed by Geoff Garen.
+
+        There are three different versions of PropertySlot::setValue, one for cacheable properties, and two that are used interchangeably and inconsistently.
+        The problematic variants are the ones that just take a value, and one that takes a value and also the object containing the property.
+        Unify on always providing the object, and remove the version that just takes a value.
+        This always works except for JSString, where we optimize out the object (logically we should be instantiating a temporary StringObject on every property access).
+        Provide a version of setValue that takes a JSString as the owner of the property.
+        We won't store this, but it makes it clear that this interface should only be used from JSString.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        * JSCTypedArrayStubs.h:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlotByIndex):
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayEntry::get):
+            - Pass object containing property to PropertySlot::setValue
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::setValue):
+            - Logically, the base of a string property access is a temporary StringObject, but we optimize that away.
+        (JSC::PropertySlot::setUndefined):
+            - removed setValue(JSValue), added setValue(JSString*, JSValue)
+
+2013-08-15  Oliver Hunt  <oliver@apple.com>
+
+        Remove bogus assertion.
+
+        RS=Filip Pizlo
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+
+2013-08-15  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        REGRESSION(r148790) Made 7 tests fail on x86 32bit
+        https://bugs.webkit.org/show_bug.cgi?id=114913
+
+        Reviewed by Filip Pizlo.
+
+        The X87 register was not freed before some calls. Instead
+        of inserting resetX87Registers to the last call sites,
+        the two X87 registers are now freed in every call.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2013-08-14  Michael Saboff  <msaboff@apple.com>
+
+        Fixed jit on Win64.
+        https://bugs.webkit.org/show_bug.cgi?id=119601
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JITStubsMSVC64.asm: Added ctiVMThrowTrampolineSlowpath implementation.
+        * jit/JSInterfaceJIT.h: Added thirdArgumentRegister.
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call): Added correct calling convention for Win64.
+
+2013-08-14  Alex Christensen  <achristensen@apple.com>
+
+        Compile fix for Win64 with jit disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=119804
+
+        Reviewed by Michael Saboff.
+
+        * offlineasm/cloop.rb: Added std:: before isnan.
+
+2013-08-14  Julien Brianceau  <jbrianceau@nds.com>
+
+        DFG_JIT implementation for sh4 architecture.
+        https://bugs.webkit.org/show_bug.cgi?id=119737
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::invert):
+        (JSC::MacroAssemblerSH4::add32):
+        (JSC::MacroAssemblerSH4::and32):
+        (JSC::MacroAssemblerSH4::lshift32):
+        (JSC::MacroAssemblerSH4::mul32):
+        (JSC::MacroAssemblerSH4::or32):
+        (JSC::MacroAssemblerSH4::rshift32):
+        (JSC::MacroAssemblerSH4::sub32):
+        (JSC::MacroAssemblerSH4::xor32):
+        (JSC::MacroAssemblerSH4::store32):
+        (JSC::MacroAssemblerSH4::swapDouble):
+        (JSC::MacroAssemblerSH4::storeDouble):
+        (JSC::MacroAssemblerSH4::subDouble):
+        (JSC::MacroAssemblerSH4::mulDouble):
+        (JSC::MacroAssemblerSH4::divDouble):
+        (JSC::MacroAssemblerSH4::negateDouble):
+        (JSC::MacroAssemblerSH4::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerSH4::branchTruncateDoubleToUint32):
+        (JSC::MacroAssemblerSH4::truncateDoubleToUint32):
+        (JSC::MacroAssemblerSH4::swap):
+        (JSC::MacroAssemblerSH4::jump):
+        (JSC::MacroAssemblerSH4::branchNeg32):
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        (JSC::MacroAssemblerSH4::branchMul32):
+        (JSC::MacroAssemblerSH4::urshift32):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::SH4Assembler):
+        (JSC::SH4Assembler::labelForWatchpoint):
+        (JSC::SH4Assembler::label):
+        (JSC::SH4Assembler::debugOffset):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::preserveReturnAddressAfterCall):
+        (JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupArguments):
+        (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
+        * dfg/DFGFPRInfo.h:
+        (JSC::DFG::FPRInfo::toRegister):
+        (JSC::DFG::FPRInfo::toIndex):
+        (JSC::DFG::FPRInfo::debugName):
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::GPRInfo::toRegister):
+        (JSC::DFG::GPRInfo::toIndex):
+        (JSC::DFG::GPRInfo::debugName):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * jit/JITStubs.h:
+        * jit/JITStubsSH4.h:
+
+2013-08-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build.
+
+        * API/JSValue.mm:
+        (isDate):
+        (isArray):
+        * API/JSWrapperMap.mm:
+        (tryUnwrapObjcObject):
+        * API/ObjCCallbackFunction.mm:
+        (tryUnwrapBlock):
+
+2013-08-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Foo::s_info should be Foo::info(), so that you can change how the s_info is actually linked
+        https://bugs.webkit.org/show_bug.cgi?id=119770
+
+        Reviewed by Mark Hahnenberg.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::finishCreation):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::finishCreation):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.cpp:
+        (JSC::::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::finishCreation):
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/ObjCCallbackFunction.h:
+        (JSC::ObjCCallbackFunction::createStructure):
+        * JSCTypedArrayStubs.h:
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::function):
+        (JSC::CallLinkStatus::internalFunction):
+        * bytecode/CodeBlock.h:
+        (JSC::baselineCodeBlockForInlineCallFrame):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromClassInfo):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        (JSC::UnlinkedCodeBlock::visitChildren):
+        (JSC::UnlinkedProgramCodeBlock::visitChildren):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::createStructure):
+        (JSC::UnlinkedProgramCodeBlock::createStructure):
+        (JSC::UnlinkedEvalCodeBlock::createStructure):
+        (JSC::UnlinkedFunctionCodeBlock::createStructure):
+        * debugger/Debugger.cpp:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::visitChildren):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isInternalFunctionConstant):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::compileNewStringObject):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::virtualForThunkGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        * jsc.cpp:
+        (GlobalObject::createStructure):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::createCallIdentifier):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::asArguments):
+        (JSC::Arguments::finishCreation):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::arrayConstructorIsArray):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::createStructure):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::attemptFastSort):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/BooleanConstructor.h:
+        (JSC::BooleanConstructor::createStructure):
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::finishCreation):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        (JSC::asBooleanObject):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::finishCreation):
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::createStructure):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::createStructure):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::finishCreation):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        (JSC::asDateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::formateDateInstance):
+        (JSC::DatePrototype::finishCreation):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::createStructure):
+        * runtime/ErrorConstructor.h:
+        (JSC::ErrorConstructor::createStructure):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finishCreation):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::finishCreation):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::createStructure):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::isTerminatedExecutionException):
+        * runtime/ExceptionHelpers.h:
+        (JSC::TerminatedExecutionError::createStructure):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        (JSC::ExecutableBase::hashFor):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::EvalExecutable::createStructure):
+        (JSC::ProgramExecutable::createStructure):
+        (JSC::FunctionExecutable::compileFor):
+        (JSC::FunctionExecutable::compileOptimizedFor):
+        (JSC::FunctionExecutable::createStructure):
+        * runtime/FunctionConstructor.h:
+        (JSC::FunctionConstructor::createStructure):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncBind):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::asInternalFunction):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        (JSC::asActivation):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::asArray):
+        (JSC::isJSArray):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::finishCreation):
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSBoundFunction.h:
+        (JSC::JSBoundFunction::createStructure):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContext):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isFunction):
+        * runtime/JSCell.h:
+        (JSC::jsCast):
+        (JSC::jsDynamicCast):
+        * runtime/JSCellInlines.h:
+        (JSC::allocateCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        (JSC::JSFunction::visitChildren):
+        (JSC::skipOverBoundFunctions):
+        (JSC::JSFunction::callerGetter):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::slowValidateCell):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::visitChildren):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::finishCreation):
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::Holder):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::getCallableObjectSlow):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::copyBackingStore):
+        (JSC::JSFinalObject::visitChildren):
+        (JSC::JSObject::ensureInt32Slow):
+        (JSC::JSObject::ensureDoubleSlow):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        (JSC::JSObject::createStructure):
+        (JSC::JSNonFinalObject::createStructure):
+        (JSC::JSFinalObject::createStructure):
+        (JSC::isJSFinalObject):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::visitChildren):
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::createStructure):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::visitChildren):
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::visitChildren):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        (JSC::isJSString):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::visitChildren):
+        * runtime/JSVariableObject.h:
+        * runtime/JSWithScope.cpp:
+        (JSC::JSWithScope::visitChildren):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::createStructure):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NameConstructor.h:
+        (JSC::NameConstructor::createStructure):
+        * runtime/NameInstance.h:
+        (JSC::NameInstance::createStructure):
+        (JSC::NameInstance::finishCreation):
+        * runtime/NamePrototype.cpp:
+        (JSC::NamePrototype::finishCreation):
+        (JSC::privateNameProtoFuncToString):
+        * runtime/NamePrototype.h:
+        (JSC::NamePrototype::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::createStructure):
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::finishCreation):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::finishCreation):
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::createStructure):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::finishCreation):
+        * runtime/ObjectPrototype.h:
+        (JSC::ObjectPrototype::createStructure):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::createStructure):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::visitChildren):
+        * runtime/RegExp.h:
+        (JSC::RegExp::createStructure):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::finishCreation):
+        (JSC::RegExpConstructor::visitChildren):
+        (JSC::constructRegExp):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        (JSC::asRegExpConstructor):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::visitChildren):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::createStructure):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::finishCreation):
+        (JSC::RegExpObject::visitChildren):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        (JSC::asRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::createStructure):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::createStructure):
+        * runtime/SparseArrayValueMap.h:
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::createStructure):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::createStructure):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::finishCreation):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        (JSC::asStringObject):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSplit):
+        * runtime/StringPrototype.h:
+        (JSC::StringPrototype::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::get):
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        (JSC::Structure::typeInfo):
+        (JSC::Structure::previousID):
+        (JSC::Structure::outOfLineSize):
+        (JSC::Structure::totalStorageCapacity):
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::createStructure):
+        (JSC::StructureRareData::visitChildren):
+        * runtime/StructureRareData.h:
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::createStructure):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::StackPreservingRecompiler::operator()):
+        (JSC::VM::releaseExecutableMemory):
+        * runtime/WriteBarrier.h:
+        (JSC::validateCell):
+        * testRegExp.cpp:
+        (GlobalObject::createStructure):
+
+2013-08-13  Arunprasad Rajkumar  <arurajku@cisco.com>
+
+        [WTF] [JSC] Replace currentTime() with monotonicallyIncreasingTime() in all possible places
+        https://bugs.webkit.org/show_bug.cgi?id=119762
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        * jsc.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+        * testRegExp.cpp:
+        (StopWatch::start):
+        (StopWatch::stop):
+
+2013-08-13  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Prepare LLINT for DFG_JIT implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=119755
+
+        Reviewed by Oliver Hunt.
+
+        * LLIntOffsetsExtractor.pro: Add sh4.rb dependency.
+        * offlineasm/sh4.rb:
+            - Handle storeb opcode.
+            - Make relative jumps when possible using braf opcode.
+            - Update bmulio implementation to be consistent with baseline JIT.
+            - Remove useless code from leap opcode.
+            - Fix incorrect comment.
+
+2013-08-13  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Prepare baseline JIT for DFG_JIT implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=119758
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerSH4.h:
+            - Introduce a loadEffectiveAddress function to avoid code duplication.
+            - Add ASSERTs and clean code.
+        * assembler/SH4Assembler.h:
+            - Prepare DFG_JIT implementation.
+            - Add ASSERTs.
+        * jit/JITStubs.cpp:
+            - Add SH4 specific call for assertions.
+        * jit/JITStubs.h:
+            - Cosmetic change.
+        * jit/JITStubsSH4.h:
+            - Use constants to be more flexible with sh4 JIT stack frame.
+        * jit/JSInterfaceJIT.h:
+            - Cosmetic change.
+
+2013-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Harden executeConstruct against incorrect return types from host functions
+        https://bugs.webkit.org/show_bug.cgi?id=119757
+
+        Reviewed by Mark Hahnenberg.
+
+        Add logic to guard against bogus return types.  There doesn't seem to be any
+        class in webkit that does this wrong, but the typed array stubs in debug JSC
+        do exhibit this bad behaviour.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeConstruct):
+
+2013-08-13  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Fix C++11 build with gcc 4.4 and 4.5
+        https://bugs.webkit.org/show_bug.cgi?id=119736
+
+        Reviewed by Anders Carlsson.
+
+        Don't force C++11 mode off anymore.
+
+        * Target.pri:
+
+2013-08-12  Oliver Hunt  <oliver@apple.com>
+
+        Remove CodeBlock's notion of adding identifiers entirely
+        https://bugs.webkit.org/show_bug.cgi?id=119708
+
+        Reviewed by Geoffrey Garen.
+
+        Remove addAdditionalIdentifier entirely, including the bogus assertion.
+        Move the addition of identifiers to DFGPlan::reallyAdd
+
+        * bytecode/CodeBlock.h:
+        * dfg/DFGDesiredIdentifiers.cpp:
+        (JSC::DFG::DesiredIdentifiers::reallyAdd):
+        * dfg/DFGDesiredIdentifiers.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::reallyAdd):
+        (JSC::DFG::Plan::finalize):
+        * dfg/DFGPlan.h:
+
+2013-08-12  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * runtime/JSCell.h:
+
+2013-08-12  Oliver Hunt  <oliver@apple.com>
+
+        Move additionalIdentifiers into DFGCommonData as only the optimising JITs use them
+        https://bugs.webkit.org/show_bug.cgi?id=119705
+
+        Reviewed by Geoffrey Garen.
+
+        Relatively trivial refactoring
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfAdditionalIdentifiers):
+        (JSC::CodeBlock::addAdditionalIdentifier):
+        (JSC::CodeBlock::identifier):
+        (JSC::CodeBlock::numberOfIdentifiers):
+        * dfg/DFGCommonData.h:
+
+2013-08-12  Oliver Hunt  <oliver@apple.com>
+
+        Stop making unnecessary copy of CodeBlock Identifier Vector
+        https://bugs.webkit.org/show_bug.cgi?id=119702
+
+        Reviewed by Michael Saboff.
+
+        Make CodeBlock simply use a separate Vector for additional Identifiers
+        and use the UnlinkedCodeBlock for the initial set of identifiers.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::dumpStructure):
+        (JSC::dumpChain):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfIdentifiers):
+        (JSC::CodeBlock::numberOfAdditionalIdentifiers):
+        (JSC::CodeBlock::addAdditionalIdentifier):
+        (JSC::CodeBlock::identifier):
+        * dfg/DFGDesiredIdentifiers.cpp:
+        (JSC::DFG::DesiredIdentifiers::reallyAdd):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2013-08-08  Mark Lam  <mark.lam@apple.com>
+
+        Restoring use of StackIterator instead of Interpreter::getStacktrace().
+        https://bugs.webkit.org/show_bug.cgi?id=119575.
+
+        Reviewed by Oliver Hunt.
+
+        * interpreter/Interpreter.h:
+        - Made getStackTrace() private.
+        * interpreter/StackIterator.cpp:
+        (JSC::StackIterator::StackIterator):
+        (JSC::StackIterator::numberOfFrames):
+        - Computes the number of frames by iterating through the whole stack
+          from the starting frame. The iterator will save its current frame
+          position before counting the frames, and then restoring it after
+          the counting.
+        (JSC::StackIterator::gotoFrameAtIndex):
+        (JSC::StackIterator::gotoNextFrame):
+        (JSC::StackIterator::resetIterator):
+        - Points the iterator to the starting frame.
+        * interpreter/StackIteratorPrivate.h:
+
+2013-08-08  Mark Lam  <mark.lam@apple.com>
+
+        Moved ErrorConstructor and NativeErrorConstructor helper functions into
+        the Interpreter class.
+        https://bugs.webkit.org/show_bug.cgi?id=119576.
+
+        Reviewed by Oliver Hunt.
+
+        This change is needed to prepare for making Interpreter::getStackTrace()
+        private. It does not change the behavior of the code, only the lexical
+        scoping.
+
+        * interpreter/Interpreter.h:
+        - Added helper functions for ErrorConstructor and NativeErrorConstructor.
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        (JSC::ErrorConstructor::getConstructData):
+        (JSC::Interpreter::callErrorConstructor):
+        (JSC::ErrorConstructor::getCallData):
+        - Don't want ErrorConstructor to call Interpreter::getStackTrace()
+          directly. So, we moved the helper functions into the Interpreter
+          class.
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor):
+        (JSC::NativeErrorConstructor::getConstructData):
+        (JSC::Interpreter::callNativeErrorConstructor):
+        (JSC::NativeErrorConstructor::getCallData):
+        - Don't want NativeErrorConstructor to call Interpreter::getStackTrace()
+          directly. So, we moved the helper functions into the Interpreter
+          class.
+
+2013-08-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        32-bit code gen for TypeOf doesn't properly update the AbstractInterpreter state
+        https://bugs.webkit.org/show_bug.cgi?id=119555
+
+        Reviewed by Geoffrey Garen.
+
+        It uses a speculationCheck where it should be using a DFG_TYPE_CHECK like the 64-bit backend does.
+        This was causing crashes on maps.google.com in 32-bit debug builds.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-08-06  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(FTL merge): Assertion fail on 32 bit with enabled DFG JIT
+        https://bugs.webkit.org/show_bug.cgi?id=119405
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString): For X86 32 bit, construct an indexed address
+        ourselves to save a register and then load from it.
+
+2013-08-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG FixupPhase should insert Int32ToDouble nodes for number uses in NewArray, and SpeculativeJIT 64-bit should not try to coerce integer constants to double constants
+        https://bugs.webkit.org/show_bug.cgi?id=119528
+
+        Reviewed by Geoffrey Garen.
+
+        Either of the two fixes would solve the crash I saw. Basically, for best performance, we want the DFG register allocator to track double uses and non-double
+        uses of a node separately, and we accomplish this by inserting Int32ToDouble nodes in the FixupPhase. But even if FixupPhase fails to do this, we still want
+        the DFG register allocator to do the right thing: if it encounters a double use of an integer, it should perform a conversion and preserve the original
+        format of the value (namely, that it was an integer). For constants, the best format to preserve is None, so that future integer uses rematerialize the int
+        from scratch. This only affects the 64-bit backend; the 32-bit backend was already doing the right thing.
+
+        This also fixes some more debug dumping code, and adds some stronger assertions for integer arrays.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::tryGetIndexQuickly):
+
+2013-08-08  Stephanie Lewis  <slewis@apple.com>
+
+        <rdar://problem/14680524> REGRESSION(153806): Crash @ yahoo.com when WebKit is built with a .order file
+
+        Unreviewed.
+
+        Ensure llint symbols are in source order.
+
+        * JavaScriptCore.order:
+
+2013-08-06  Mark Lam  <mark.lam@apple.com>
+
+        Assertion failure in emitExpressionInfo when reloading with Web Inspector open.
+        https://bugs.webkit.org/show_bug.cgi?id=119532.
+
+        Reviewed by Oliver Hunt.
+
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        - Just need to initialize the Parser's JSTokenLocation's initial line and
+          startOffset as well during Parser construction.
+
+2013-08-06  Stephanie Lewis  <slewis@apple.com>
+
+        Update Order Files for Safari
+        <rdar://problem/14517392>
+
+        Unreviewed.
+
+        * JavaScriptCore.order:
+
+2013-08-04  Sam Weinig  <sam@webkit.org>
+
+        Remove support for HTML5 MicroData
+        https://bugs.webkit.org/show_bug.cgi?id=119480
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-08-05  Oliver Hunt  <oliver@apple.com>
+
+        Delay Arguments creation in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=119505
+
+        Reviewed by Geoffrey Garen.
+
+        Make use of the write tracking performed by the parser to
+        allow us to know if we're modifying the parameters to a function.
+        Then use that information to make strict mode function opt out
+        of eager arguments creation.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitReturn):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::shouldTearOffArgumentsEagerly):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::modifiesParameter):
+        * parser/Parser.cpp:
+        (JSC::::parseInner):
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::getCapturedVariables):
+        (JSC::Parser::declareWrite):
+        * parser/ParserModes.h:
+
+2013-08-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Remove useless code from COMPILER(RVCT) JITStubs
+        https://bugs.webkit.org/show_bug.cgi?id=119521
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITStubsARMv7.h:
+        (JSC::ctiVMThrowTrampoline): "ldr r6, [sp, #PRESERVED_R6_OFFSET]" was called twice.
+        (JSC::ctiOpThrowNotCaught): Ditto.
+
+2013-07-23  David Farler  <dfarler@apple.com>
+
+        Provide optional OTHER_CFLAGS, OTHER_CPPFLAGS, OTHER_LDFLAGS additions for building with ASAN
+        https://bugs.webkit.org/show_bug.cgi?id=117762
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/DebugRelease.xcconfig:
+        Add ASAN_OTHER_CFLAGS, CPLUSPLUSFLAGS, LDFLAGS.
+        * Configurations/JavaScriptCore.xcconfig:
+        Add ASAN_OTHER_LDFLAGS.
+        * Configurations/ToolExecutable.xcconfig:
+        Don't use ASAN for build tools.
+
+2013-08-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for ARM MSVC after r153222 and r153648.
+
+        * jit/JITStubsARM.h: Added ctiVMThrowTrampolineSlowpath.
+
+2013-08-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for ARM MSVC after r150109.
+
+        Read the stub template from a header files instead of the JITStubs.cpp.
+
+        * CMakeLists.txt:
+        * DerivedSources.pri:
+        * create_jit_stubs:
+
+2013-08-05  Oliver Hunt  <oliver@apple.com>
+
+        Move TypedArray implementation into JSC
+        https://bugs.webkit.org/show_bug.cgi?id=119489
+
+        Reviewed by Filip Pizlo.
+
+        Move TypedArray implementation into JSC in advance of re-implementation
+
+        * GNUmakefile.list.am:
+        * JSCTypedArrayStubs.h:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/ArrayBuffer.cpp: Renamed from Source/WTF/wtf/ArrayBuffer.cpp.
+        (JSC::ArrayBuffer::transfer):
+        (JSC::ArrayBuffer::addView):
+        (JSC::ArrayBuffer::removeView):
+        * runtime/ArrayBuffer.h: Renamed from Source/WTF/wtf/ArrayBuffer.h.
+        (JSC::ArrayBufferContents::ArrayBufferContents):
+        (JSC::ArrayBufferContents::data):
+        (JSC::ArrayBufferContents::sizeInBytes):
+        (JSC::ArrayBufferContents::transfer):
+        (JSC::ArrayBufferContents::copyTo):
+        (JSC::ArrayBuffer::isNeutered):
+        (JSC::ArrayBuffer::~ArrayBuffer):
+        (JSC::ArrayBuffer::clampValue):
+        (JSC::ArrayBuffer::create):
+        (JSC::ArrayBuffer::createUninitialized):
+        (JSC::ArrayBuffer::ArrayBuffer):
+        (JSC::ArrayBuffer::data):
+        (JSC::ArrayBuffer::byteLength):
+        (JSC::ArrayBuffer::slice):
+        (JSC::ArrayBuffer::sliceImpl):
+        (JSC::ArrayBuffer::clampIndex):
+        (JSC::ArrayBufferContents::tryAllocate):
+        (JSC::ArrayBufferContents::~ArrayBufferContents):
+        * runtime/ArrayBufferView.cpp: Renamed from Source/WTF/wtf/ArrayBufferView.cpp.
+        (JSC::ArrayBufferView::ArrayBufferView):
+        (JSC::ArrayBufferView::~ArrayBufferView):
+        (JSC::ArrayBufferView::neuter):
+        * runtime/ArrayBufferView.h: Renamed from Source/WTF/wtf/ArrayBufferView.h.
+        (JSC::ArrayBufferView::buffer):
+        (JSC::ArrayBufferView::baseAddress):
+        (JSC::ArrayBufferView::byteOffset):
+        (JSC::ArrayBufferView::setNeuterable):
+        (JSC::ArrayBufferView::isNeuterable):
+        (JSC::ArrayBufferView::verifySubRange):
+        (JSC::ArrayBufferView::clampOffsetAndNumElements):
+        (JSC::ArrayBufferView::setImpl):
+        (JSC::ArrayBufferView::setRangeImpl):
+        (JSC::ArrayBufferView::zeroRangeImpl):
+        (JSC::ArrayBufferView::calculateOffsetAndLength):
+        * runtime/Float32Array.h: Renamed from Source/WTF/wtf/Float32Array.h.
+        (JSC::Float32Array::set):
+        (JSC::Float32Array::getType):
+        (JSC::Float32Array::create):
+        (JSC::Float32Array::createUninitialized):
+        (JSC::Float32Array::Float32Array):
+        (JSC::Float32Array::subarray):
+        * runtime/Float64Array.h: Renamed from Source/WTF/wtf/Float64Array.h.
+        (JSC::Float64Array::set):
+        (JSC::Float64Array::getType):
+        (JSC::Float64Array::create):
+        (JSC::Float64Array::createUninitialized):
+        (JSC::Float64Array::Float64Array):
+        (JSC::Float64Array::subarray):
+        * runtime/Int16Array.h: Renamed from Source/WTF/wtf/Int16Array.h.
+        (JSC::Int16Array::getType):
+        (JSC::Int16Array::create):
+        (JSC::Int16Array::createUninitialized):
+        (JSC::Int16Array::Int16Array):
+        (JSC::Int16Array::subarray):
+        * runtime/Int32Array.h: Renamed from Source/WTF/wtf/Int32Array.h.
+        (JSC::Int32Array::getType):
+        (JSC::Int32Array::create):
+        (JSC::Int32Array::createUninitialized):
+        (JSC::Int32Array::Int32Array):
+        (JSC::Int32Array::subarray):
+        * runtime/Int8Array.h: Renamed from Source/WTF/wtf/Int8Array.h.
+        (JSC::Int8Array::getType):
+        (JSC::Int8Array::create):
+        (JSC::Int8Array::createUninitialized):
+        (JSC::Int8Array::Int8Array):
+        (JSC::Int8Array::subarray):
+        * runtime/IntegralTypedArrayBase.h: Renamed from Source/WTF/wtf/IntegralTypedArrayBase.h.
+        (JSC::IntegralTypedArrayBase::set):
+        (JSC::IntegralTypedArrayBase::IntegralTypedArrayBase):
+        * runtime/TypedArrayBase.h: Renamed from Source/WTF/wtf/TypedArrayBase.h.
+        (JSC::TypedArrayBase::data):
+        (JSC::TypedArrayBase::set):
+        (JSC::TypedArrayBase::setRange):
+        (JSC::TypedArrayBase::zeroRange):
+        (JSC::TypedArrayBase::length):
+        (JSC::TypedArrayBase::byteLength):
+        (JSC::TypedArrayBase::item):
+        (JSC::TypedArrayBase::checkInboundData):
+        (JSC::TypedArrayBase::TypedArrayBase):
+        (JSC::TypedArrayBase::create):
+        (JSC::TypedArrayBase::createUninitialized):
+        (JSC::TypedArrayBase::subarrayImpl):
+        (JSC::TypedArrayBase::neuter):
+        * runtime/Uint16Array.h: Renamed from Source/WTF/wtf/Uint16Array.h.
+        (JSC::Uint16Array::getType):
+        (JSC::Uint16Array::create):
+        (JSC::Uint16Array::createUninitialized):
+        (JSC::Uint16Array::Uint16Array):
+        (JSC::Uint16Array::subarray):
+        * runtime/Uint32Array.h: Renamed from Source/WTF/wtf/Uint32Array.h.
+        (JSC::Uint32Array::getType):
+        (JSC::Uint32Array::create):
+        (JSC::Uint32Array::createUninitialized):
+        (JSC::Uint32Array::Uint32Array):
+        (JSC::Uint32Array::subarray):
+        * runtime/Uint8Array.h: Renamed from Source/WTF/wtf/Uint8Array.h.
+        (JSC::Uint8Array::getType):
+        (JSC::Uint8Array::create):
+        (JSC::Uint8Array::createUninitialized):
+        (JSC::Uint8Array::Uint8Array):
+        (JSC::Uint8Array::subarray):
+        * runtime/Uint8ClampedArray.h: Renamed from Source/WTF/wtf/Uint8ClampedArray.h.
+        (JSC::Uint8ClampedArray::getType):
+        (JSC::Uint8ClampedArray::create):
+        (JSC::Uint8ClampedArray::createUninitialized):
+        (JSC::Uint8ClampedArray::zeroFill):
+        (JSC::Uint8ClampedArray::set):
+        (JSC::Uint8ClampedArray::Uint8ClampedArray):
+        (JSC::Uint8ClampedArray::subarray):
+        * runtime/VM.h:
+
+2013-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Copied space should be able to handle more than one copied backing store per JSCell
+        https://bugs.webkit.org/show_bug.cgi?id=119471
+
+        Reviewed by Mark Hahnenberg.
+        
+        This allows a cell to call copyLater() multiple times for multiple different
+        backing stores, and then have copyBackingStore() called exactly once for each
+        of those. A token tells it which backing store to copy. All backing stores
+        must be named using the CopyToken, an enumeration which currently cannot
+        exceed eight entries.
+        
+        When copyBackingStore() is called, it's up to the callee to (a) use the token
+        to decide what to copy and (b) call its base class's copyBackingStore() in
+        case the base class had something that needed copying. The only exception is
+        that JSCell never asks anything to be copied, and so if your base is JSCell
+        then you don't have to do anything.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopiedBlock.h:
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        * heap/CopyToken.h: Added.
+        * heap/CopyVisitor.cpp:
+        (JSC::CopyVisitor::copyFromShared):
+        * heap/CopyVisitor.h:
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::visitItem):
+        * heap/CopyWorkList.h:
+        (JSC::CopyWorklistItem::CopyWorklistItem):
+        (JSC::CopyWorklistItem::cell):
+        (JSC::CopyWorklistItem::token):
+        (JSC::CopyWorkListSegment::get):
+        (JSC::CopyWorkListSegment::append):
+        (JSC::CopyWorkListSegment::data):
+        (JSC::CopyWorkListIterator::get):
+        (JSC::CopyWorkListIterator::operator*):
+        (JSC::CopyWorkListIterator::operator->):
+        (JSC::CopyWorkList::append):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater):
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::copyBackingStore):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::copyBackingStore):
+        * runtime/JSObject.h:
+
+2013-08-05  Zan Dobersek  <zdobersek@igalia.com>
+
+        [Automake] Define ENABLE_JIT through the Autoconf header
+        https://bugs.webkit.org/show_bug.cgi?id=119445
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: Remove JSC_CPPFLAGS from the cpp flags for the JSC library.
+
+2013-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        hasIndexingHeader() ought really to be a property of an object and its structure, not just its structure
+        https://bugs.webkit.org/show_bug.cgi?id=119470
+
+        Reviewed by Oliver Hunt.
+        
+        Structure can still tell you if the object "could" (in the conservative sense)
+        have an indexing header; that's used by the compiler.
+        
+        Most of the time if you want to know if there's an indexing header, you ask the
+        JSObject.
+        
+        In some cases, the JSObject wants to know if it would have an indexing header if
+        it had a different structure; then it uses Structure::hasIndexingHeader(JSCell*).
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::create):
+        (JSC::Butterfly::growPropertyStorage):
+        (JSC::Butterfly::growArrayRight):
+        (JSC::Butterfly::resizeArray):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::visitButterfly):
+        * runtime/JSObject.h:
+        (JSC::JSObject::hasIndexingHeader):
+        (JSC::JSObject::setButterfly):
+        * runtime/Structure.h:
+        (JSC::Structure::couldHaveIndexingHeader):
+        (JSC::Structure::hasIndexingHeader):
+
+2013-08-02  Chris Curtis  <chris_curtis@apple.com>
+
+        Give the error object's stack property accessor attributes.
+        https://bugs.webkit.org/show_bug.cgi?id=119404
+
+        Reviewed by Geoffrey Garen.
+        
+        Changed the attributes of error object's stack property to allow developers to write
+        and delete the stack property. This will match the functionality of Chrome. Firefox  
+        allows developers to write the error's stack, but not delete it. 
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finishCreation):
+
+2013-08-02  Oliver Hunt  <oliver@apple.com>
+
+        Incorrect type speculation reported by ToPrimitive
+        https://bugs.webkit.org/show_bug.cgi?id=119458
+
+        Reviewed by Mark Hahnenberg.
+
+        Make sure that we report the correct type possibilities for the output
+        from ToPrimitive
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+
+2013-08-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove no-arguments constructor to PropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=119460
+
+        Reviewed by Geoff Garen.
+
+        This constructor was unsafe if getValue is subsequently called,
+        and the property is a getter. Simplest to just remove it.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::defineOwnProperty):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyDescriptor):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineOwnProperty):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::put):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasProperty):
+        (JSC::JSObject::hasOwnProperty):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertyDescriptor):
+        (JSC::getStaticFunctionDescriptor):
+        (JSC::getStaticValueDescriptor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::defineProperties):
+        * runtime/PropertySlot.h:
+
+2013-08-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        DFG validation can cause assertion failures due to dumping
+        https://bugs.webkit.org/show_bug.cgi?id=119456
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hasHash):
+        (JSC::CodeBlock::isSafeToComputeHash):
+        (JSC::CodeBlock::hash):
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * bytecode/CodeBlock.h:
+
+2013-08-02  Chris Curtis  <chris_curtis@apple.com>
+
+        Have vm's exceptionStack match java's vm's exceptionStack.
+        https://bugs.webkit.org/show_bug.cgi?id=119362
+
+        Reviewed by Geoffrey Garen.
+        
+        The error object's stack is only updated if it does not exist yet. This matches 
+        the functionality of other browsers, and Java VMs. 
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC::Interpreter::throwException):
+        * runtime/VM.cpp:
+        (JSC::VM::clearExceptionStack):
+        * runtime/VM.h:
+        (JSC::VM::lastExceptionStack):
+
+2013-08-02  Julien Brianceau  <jbrianceau@nds.com>
+
+        REGRESSION(FTL): Fix mips implementation of ctiVMThrowTrampolineSlowpath.
+        https://bugs.webkit.org/show_bug.cgi?id=119447
+
+        Reviewed by Geoffrey Garen.
+
+        Fix .cpload, update call frame and do not restore registers from JIT stack frame in
+        mips implementation of ctiVMThrowTrampolineSlowpath. This change is similar to
+        r153583 (sh4) and r153648 (ARM).
+
+        * jit/JITStubsMIPS.h:
+
+2013-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        hasIndexingHeader should be a property of the Structure, not just the IndexingType
+        https://bugs.webkit.org/show_bug.cgi?id=119422
+
+        Reviewed by Oliver Hunt.
+        
+        This simplifies some code and also allows Structure to claim that an object
+        has an indexing header even if it doesn't have indexed properties.
+        
+        I also changed some calls to use hasIndexedProperties() since in some cases,
+        that's what we actually meant. Currently the two are synonyms.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::create):
+        (JSC::Butterfly::growPropertyStorage):
+        (JSC::Butterfly::growArrayRight):
+        (JSC::Butterfly::resizeArray):
+        * runtime/IndexingType.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::setPrototype):
+        * runtime/JSObject.h:
+        (JSC::JSObject::setButterfly):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/Structure.h:
+        (JSC::Structure::hasIndexingHeader):
+
+2013-08-02  Julien Brianceau  <jbrianceau@nds.com>
+
+        REGRESSION: ARM still crashes after change set r153612.
+        https://bugs.webkit.org/show_bug.cgi?id=119433
+
+        Reviewed by Michael Saboff.
+
+        Update call frame and do not restore registers from JIT stack frame in ARM and ARMv7
+        implementations of ctiVMThrowTrampolineSlowpath. This change is similar to r153583
+        for sh4 architecture.
+
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+
+2013-08-02  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r153612): It made jsc and layout tests crash
+        https://bugs.webkit.org/show_bug.cgi?id=119440
+
+        Reviewed by Csaba Osztrogonác.
+
+        Made the changes if changeset r153612 only apply to 32 bit builds.
+
+        * jit/JITExceptions.cpp:
+        * jit/JITExceptions.h:
+        * jit/JITStubs.cpp:
+        (JSC::cti_vm_throw_slowpath):
+        * jit/JITStubs.h:
+
+2013-08-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Add JSCTestRunnerUtils to the list of forwarding headers to fix build.
+
+        * CMakeLists.txt:
+
+2013-08-01  Ruth Fong  <ruth_fong@apple.com>
+
+        [Forms: color] <input type='color'> popover color well implementation
+        <rdar://problem/14411008> and https://bugs.webkit.org/show_bug.cgi?id=119356
+
+        Reviewed by Benjamin Poulain.
+
+        * Configurations/FeatureDefines.xcconfig: Added and enabled INPUT_TYPE_COLOR_POPOVER.
+
+2013-08-01  Oliver Hunt  <oliver@apple.com>
+
+        DFG is not enforcing correct ordering of ToString conversion in MakeRope
+        https://bugs.webkit.org/show_bug.cgi?id=119408
+
+        Reviewed by Filip Pizlo.
+
+        Construct ToString and Phantom nodes in advance of MakeRope
+        nodes to ensure that ordering is ensured, and correct values
+        will be reified on OSR exit.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2013-08-01  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION: Crash beneath cti_vm_throw_slowpath due to invalid CallFrame pointer
+        https://bugs.webkit.org/show_bug.cgi?id=119140
+
+        Reviewed by Filip Pizlo.
+
+        Ensure that ExceptionHandler is returned by functions in two registers by encoding the value as a 64 bit int.
+
+        * jit/JITExceptions.cpp:
+        (JSC::encode):
+        * jit/JITExceptions.h:
+        * jit/JITStubs.cpp:
+        (JSC::cti_vm_throw_slowpath):
+        * jit/JITStubs.h:
+
+2013-08-01  Julien Brianceau  <jbrianceau@nds.com>
+
+        REGRESSION(FTL): Fix sh4 implementation of ctiVMThrowTrampolineSlowpath.
+        https://bugs.webkit.org/show_bug.cgi?id=119391
+
+        Reviewed by Csaba Osztrogonác.
+
+        * jit/JITStubsSH4.h: Fix ctiVMThrowTrampolineSlowpath implementation:
+            - Call frame is in r14 register.
+            - Do not restore registers from JIT stack frame here.
+
+2013-07-31  Gavin Barraclough  <barraclough@apple.com>
+
+        More cleanup in PropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=119359
+
+        Reviewed by Geoff Garen.
+
+        m_slotBase is overloaded to store the (receiver) thisValue and the object that contains the property,
+        This is confusing, and means that slotBase cannot be typed correctly (can only be a JSObject).
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+            - No need to ASSERT slotBase is an object.
+        * jit/JITStubs.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+            - No need to ASSERT slotBase is an object.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::fillGetterPropertySlot):
+            - Pass an object through to setGetterSlot.
+        * runtime/JSObject.h:
+        (JSC::PropertySlot::getValue):
+            - Moved from PropertySlot (need to know anout JSObject).
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+            - update per member name changes
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+            - Argument to constructor set to 'thisValue'.
+        (JSC::PropertySlot::slotBase):
+            - This returns a JSObject*.
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCacheableCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+            - slotBase is a JSObject*, make setGetterSlot set slotBase for consistency.
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayEntry::get):
+            - Pass an object through to setGetterSlot.
+        * runtime/SparseArrayValueMap.h:
+            - Pass an object through to setGetterSlot.
+
+2013-07-31  Yi Shen  <max.hong.shen@gmail.com>
+
+        Reduce JSC API static value setter/getter overhead.
+        https://bugs.webkit.org/show_bug.cgi?id=119277
+
+        Reviewed by Geoffrey Garen.
+
+        Add property name to the static value entry, so that OpaqueJSString::create() doesn't
+        need to get called every time when set or get the static value.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::putByIndex):
+        (JSC::::getStaticValue):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        * API/JSClassRef.h:
+        (StaticValueEntry::StaticValueEntry):
+
+2013-07-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Use emptyString instead of String("")
+        https://bugs.webkit.org/show_bug.cgi?id=119335
+
+        Reviewed by Darin Adler.
+
+        Use emptyString() instead of String("") because it is better style and
+        faster. This is a followup to r116908, removing all occurrences of
+        String("") from WebKit.
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+
+2013-07-31  Ruth Fong  <ruth_fong@apple.com>
+
+        <input type=color> Mac UI behaviour
+        <rdar://problem/10269922> and https://bugs.webkit.org/show_bug.cgi?id=61276
+
+        Reviewed by Brady Eidson.
+
+        * Configurations/FeatureDefines.xcconfig: Enabled INPUT_TYPE_COLOR.
+
+2013-07-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        DFG doesn't account for inlining of functions with switch statements that haven't been executed by the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=119349
+
+        Reviewed by Geoffrey Garen.
+
+        Prior to this patch, the baseline JIT was responsible for resizing the ctiOffsets Vector for 
+        SimpleJumpTables to be equal to the size of the branchOffsets Vector. The DFG implicitly relied
+        on code it compiled with any switch statements to have been run in the baseline JIT first. 
+        However, if the DFG chooses to inline a function that has never been compiled by the baseline 
+        JIT then this resizing never happens and we crash at link time in the DFG.
+
+        We can fix this by also doing the resize in the DFG to catch this case.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+
+2013-07-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Speculative Windows build fix.
+
+        Reviewed by NOBODY
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::getIndexSlowCase):
+        * runtime/JSString.h:
+
+2013-07-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Some cleanup in JSValue::get
+        https://bugs.webkit.org/show_bug.cgi?id=119343
+
+        Reviewed by Geoff Garen.
+
+        JSValue::get is implemented to:
+            1) Check if the value is a cell – if not, synthesize a prototype to search,
+            2) call getOwnPropertySlot on the cell,
+            3) if this returns false, cast to JSObject to get the prototype, and walk the prototype chain.
+        By all rights this should crash when passed a string and accessing a property that does not exist, because
+        the string is a cell, getOwnPropertySlot should return false, and the cast to JSObject should be unsafe.
+        To work around this, JSString::getOwnPropertySlot actually implements 'get' functionality - searching the
+        prototype chain, and faking out a return value of undefined if no property is found.
+
+        This is a huge hazard, since fixing JSString::getOwnPropertySlot or calling getOwnPropertySlot on cells
+        from elsewhere would introduce bugs. Fortunately it is only ever called in this one place.
+
+        The fix here is to move getOwnPropertySlot onto JSObjecte and end this madness - cells don't have property
+        slots anyway.
+
+        Interesting changes are in JSCJSValueInlines.h, JSString.cpp - the rest is pretty much all JSCell -> JSObject.
+
+2013-07-31  Michael Saboff  <msaboff@apple.com>
+
+        [Win] JavaScript crash.
+        https://bugs.webkit.org/show_bug.cgi?id=119339
+
+        Reviewed by Mark Hahnenberg.
+
+        * jit/JITStubsX86.h: Implement ctiVMThrowTrampoline and
+        ctiVMThrowTrampolineSlowpath the same way as the gcc x86 version does.
+
+2013-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GetByVal on Arguments does the wrong size load when checking the Arguments object length
+        https://bugs.webkit.org/show_bug.cgi?id=119281
+
+        Reviewed by Geoffrey Garen.
+
+        This leads to out of bounds accesses and subsequent crashes.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-07-30  Oliver Hunt  <oliver@apple.com>
+
+        Add an assertion to SpeculateCellOperand
+        https://bugs.webkit.org/show_bug.cgi?id=119276
+
+        Reviewed by Michael Saboff.
+
+        More assertions are better
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-07-30  Mark Lam  <mark.lam@apple.com>
+
+        Fix problems with divot and lineStart mismatches.
+        https://bugs.webkit.org/show_bug.cgi?id=118662.
+
+        Reviewed by Oliver Hunt.
+
+        r152494 added the recording of lineStart values for divot positions.
+        This is needed for the computation of column numbers. Similarly, it also
+        added the recording of line numbers for the divot positions. One problem
+        with the approach taken was that the line and lineStart values were
+        recorded independently, and hence were not always guaranteed to be
+        sampled at the same place that the divot position is recorded. This
+        resulted in potential mismatches that cause some assertions to fail.
+
+        The solution is to introduce a JSTextPosition abstraction that records
+        the divot position, line, and lineStart as a single quantity. Wherever
+        we record the divot position as an unsigned int previously, we now record
+        its JSTextPosition which captures all 3 values in one go. This ensures
+        that the captured line and lineStart will always match the captured divot
+        position.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThrowableExpressionData::emitThrowReferenceError):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::DeleteBracketNode::emitBytecode):
+        (JSC::DeleteDotNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::PrefixNode::emitBracket):
+        (JSC::PrefixNode::emitDot):
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::InstanceOfNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * parser/ASTBuilder.h:
+        - Replaced ASTBuilder::PositionInfo with JSTextPosition.
+        (JSC::ASTBuilder::BinaryOpInfo::BinaryOpInfo):
+        (JSC::ASTBuilder::AssignmentInfo::AssignmentInfo):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::appendBinaryExpressionInfo):
+        (JSC::ASTBuilder::appendUnaryToken):
+        (JSC::ASTBuilder::unaryTokenStackLastStart):
+        (JSC::ASTBuilder::assignmentStackAppend):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::setExceptionLocation):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * parser/Lexer.cpp:
+        (JSC::::lex):
+        - Added support for capturing the appropriate JSTextPositions instead
+          of just the character offset.
+        * parser/Lexer.h:
+        (JSC::Lexer::currentPosition):
+        (JSC::::lexExpectIdentifier):
+        - Added support for capturing the appropriate JSTextPositions instead
+          of just the character offset.
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PostfixNode::PostfixNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::PrefixNode::PrefixNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::WithNode::WithNode):
+        (JSC::ForInNode::ForInNode):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * parser/Nodes.cpp:
+        (JSC::StatementNode::setLoc):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * parser/Nodes.h:
+        (JSC::Node::lineNo):
+        (JSC::Node::startOffset):
+        (JSC::Node::lineStartOffset):
+        (JSC::Node::position):
+        (JSC::ThrowableExpressionData::ThrowableExpressionData):
+        (JSC::ThrowableExpressionData::setExceptionSourceCode):
+        (JSC::ThrowableExpressionData::divot):
+        (JSC::ThrowableExpressionData::divotStart):
+        (JSC::ThrowableExpressionData::divotEnd):
+        (JSC::ThrowableSubExpressionData::ThrowableSubExpressionData):
+        (JSC::ThrowableSubExpressionData::setSubexpressionInfo):
+        (JSC::ThrowableSubExpressionData::subexpressionDivot):
+        (JSC::ThrowableSubExpressionData::subexpressionStart):
+        (JSC::ThrowableSubExpressionData::subexpressionEnd):
+        (JSC::ThrowablePrefixedSubExpressionData::ThrowablePrefixedSubExpressionData):
+        (JSC::ThrowablePrefixedSubExpressionData::setSubexpressionInfo):
+        (JSC::ThrowablePrefixedSubExpressionData::subexpressionDivot):
+        (JSC::ThrowablePrefixedSubExpressionData::subexpressionStart):
+        (JSC::ThrowablePrefixedSubExpressionData::subexpressionEnd):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseInner):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        (JSC::::didFinishParsing):
+        - Remove setting of m_lastLine value. We always pass in the value from
+          m_lastLine anyway. So, this assignment is effectively a nop.
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseTryStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::LabelInfo::LabelInfo):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::getToken):
+        (JSC::Parser::tokenStartPosition):
+        (JSC::Parser::tokenEndPosition):
+        (JSC::Parser::lastTokenEndPosition):
+        (JSC::::parse):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+        * parser/ParserTokens.h:
+        (JSC::JSTextPosition::JSTextPosition):
+        (JSC::JSTextPosition::operator+):
+        (JSC::JSTextPosition::operator-):
+        (JSC::JSTextPosition::operator int):
+        - Added JSTextPosition.
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+        - Use JSTextPosition instead of passing line and lineStart explicitly.
+
+2013-07-29  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files to compilation.
+        * bytecode/CodeBlock.cpp: Add a ENABLE(FTL_JIT) #if block to
+        include FTL header files not included in the compilation.
+        * dfg/DFGDriver.cpp: Ditto.
+        * dfg/DFGPlan.cpp: Ditto.
+
+2013-07-29  Chris Curtis  <chris_curtis@apple.com>
+
+        Eager stack trace for error objects.
+        https://bugs.webkit.org/show_bug.cgi?id=118918
+
+        Reviewed by Geoffrey Garen.
+        
+        Chrome and Firefox give error objects the stack property and we wanted to match
+        that functionality. This allows developers to see the stack without throwing an object.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finishCreation):
+         For error objects that are not thrown as an exception, we pass the stackTrace in 
+         as a parameter. This allows the error object to have the stack property.
+        
+        * interpreter/Interpreter.cpp:
+        (JSC::stackTraceAsString):
+        Helper function used to eliminate duplicate code.
+
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        When an error object is created by the user the vm->exceptionStack is not set.
+        If the user throws this error object later the stack that is in the error object 
+        may not be the correct stack for the throw, so when we set the vm->exception stack,
+        the stack property on the error object is set as well.
+        
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructWithErrorConstructor):
+        (JSC::callErrorConstructor):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::constructWithNativeErrorConstructor):
+        (JSC::callNativeErrorConstructor):
+        These functions indicate that the user created an error object. For all error objects 
+        that the user explicitly creates, the topCallFrame is at a new frame created to 
+        handle the user's call. In this case though, the error object needs the caller's 
+        frame to create the stack trace correctly.
+        
+        * interpreter/Interpreter.h:
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::create):
+
+2013-07-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Some cleanup in PropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=119189
+
+        Reviewed by Geoff Garen.
+
+        PropertySlot represents a property in one of four states - value, getter, custom, or custom-index.
+        The state is currently tracked redundantly by two mechanisms - the custom getter function (m_getValue)
+        is set to a special value to indicate the type (other than custom), and the type is also tracked by
+        an enum - but only if cacheable. Cacheability can typically be determined by the value of m_offset
+        (this is invalidOffset if not cacheable).
+
+            * Internally, always track the type of the property using an enum value, PropertyType.
+            * Use m_offset to indicate cacheable.
+            * Keep the external interface (CachedPropertyType) unchanged.
+            * Better pack data into the m_data union.
+
+        Performance neutral.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+            - cachedPropertyType() -> isCacheable*()
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+            - cachedPropertyType() -> isCacheable*()
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+            - cachedPropertyType() -> isCacheable*()
+        * jit/JITStubs.cpp:
+        (JSC::tryCacheGetByID):
+            - cachedPropertyType() -> isCacheable*()
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+            - cachedPropertyType() -> isCacheable*()
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+            - refactoring described above.
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::isCacheableGetter):
+        (JSC::PropertySlot::isCacheableCustom):
+        (JSC::PropertySlot::cachedOffset):
+        (JSC::PropertySlot::customGetter):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCacheableCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::setUndefined):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::setBase):
+            - refactoring described above.
+
+2013-07-28  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION: Crash when opening Facebook.com
+        https://bugs.webkit.org/show_bug.cgi?id=119155
+
+        Reviewed by Andreas Kling.
+
+        Scope nodes are always objects, so we should be using SpecObjectOther
+        rather than SpecCellOther.  Marking Scopes as CellOther leads to a
+        contradiction in the CFA, resulting in bogus codegen.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2013-07-26  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION(FTL?): Crashes in plugin tests
+        https://bugs.webkit.org/show_bug.cgi?id=119141
+
+        Reviewed by Michael Saboff.
+
+        Re-export getStackTrace
+
+        * interpreter/Interpreter.h:
+
+2013-07-26  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: Crash when opening a message on Gmail
+        https://bugs.webkit.org/show_bug.cgi?id=119105
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        - GetById patching in the DFG needs to be more disciplined about how it derives the
+          slow path.
+        
+        - Fix some dumping code thread safety issues.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::dump):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::getPolymorphicStructureList):
+        (JSC::DFG::tryBuildGetByIDList):
+
+2013-07-26  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        [mips] Fix LLINT build for mips backend
+        https://bugs.webkit.org/show_bug.cgi?id=119152
+
+        Reviewed by Oliver Hunt.
+
+        * offlineasm/mips.rb:
+
+2013-07-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Setting a large numeric property on an object causes it to allocate a huge backing store
+        https://bugs.webkit.org/show_bug.cgi?id=118914
+
+        Reviewed by Geoffrey Garen.
+
+        There are two distinct actions that we're trying to optimize for:
+
+        new Array(100000);
+
+        and:
+
+        a = [];
+        a[100000] = 42;
+        
+        In the first case, the programmer has indicated that they expect this Array to be very big, 
+        so they should get a contiguous array up until some threshold, above which we perform density 
+        calculations to see if it is indeed dense enough to warrant being contiguous.
+        
+        In the second case, the programmer hasn't indicated anything about the size of the Array, so 
+        we should be more conservative and assume it should be sparse until we've proven otherwise.
+        
+        Currently both of those cases are handled by MIN_SPARSE_ARRAY_INDEX. We should distinguish 
+        between them for the purposes of not over-allocating large backing stores like we see on 
+        http://www.peekanalytics.com/burgerjoints/
+        
+        The way that we'll do this is to keep the MIN_SPARSE_ARRAY_INDEX for the first case, and 
+        introduce a new heuristic for the second case. If we are putting to an index above a certain 
+        threshold (say, 1000) and it is beyond the length of the array, then we will use a sparse 
+        map instead. So for example, in the second case above the empty array has a blank indexing 
+        type and a length of 0. We put-by-val to an index > 1000 and > a.length, so we'll use a sparse map.
+
+        This fix is ~800x speedup on the accompanying regression test :-o
+
+        * runtime/ArrayConventions.h:
+        (JSC::indexIsSufficientlyBeyondLengthForSparseMap):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+
+2013-07-26  Julien Brianceau  <jbrianceau@nds.com>
+
+        REGRESSION(FTL): Fix lots of crashes in sh4 baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=119148
+
+        Reviewed by Csaba Osztrogonác.
+
+        * jit/JSInterfaceJIT.h: "secondArgumentRegister" is wrong for sh4.
+        * llint/LowLevelInterpreter32_64.asm: "move t0, a0" is missing
+        in nativeCallTrampoline for sh4. Reuse MIPS implementation to avoid
+        code duplication.
+
+2013-07-26  Julien Brianceau  <jbrianceau@nds.com>
+
+        REGRESSION(FTL): Crash in sh4 baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=119138
+
+        Reviewed by Csaba Osztrogonác.
+
+        This crash is due to incomplete report of r150146 and r148474.
+
+        * jit/JITStubsSH4.h:
+
+2013-07-26  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed.
+
+        * Target.pri: Adding missing DFG files to the Qt build.
+
+2013-07-25  Csaba Osztrogonác  <ossy@webkit.org>
+
+        GTK and Qt buildfix after the intrusive win buildfix r153360.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+
+2013-07-25  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed, fix build break after r153360.
+
+        * CMakeLists.txt: Add CommonSlowPathsExceptions.cpp.
+
+2013-07-25  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed build fix, AppleWin port.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+
+2013-07-25  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Followup to r153360.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2013-07-25  Michael Saboff  <msaboff@apple.com>
+
+        [Windows] Speculative build fix.
+
+        Moved interpreterThrowInCaller() out of LLintExceptions.cpp into new CommonSlowPathsExceptions.cpp
+        that is always compiled.  Made LLInt::returnToThrow() conditional on LLINT being enabled.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * llint/LLIntExceptions.cpp:
+        * llint/LLIntExceptions.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPathsExceptions.cpp: Added.
+        (JSC::CommonSlowPaths::interpreterThrowInCaller):
+        * runtime/CommonSlowPathsExceptions.h: Added.
+
+2013-07-25  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing IntendedStructureChange.h,.cpp and
+        parser/SourceCode.h,.cpp.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+
+2013-07-25  Anders Carlsson  <andersca@apple.com>
+
+        ASSERT(m_vm->apiLock().currentThreadIsHoldingLock()); fails for Safari on current ToT
+        https://bugs.webkit.org/show_bug.cgi?id=119108
+
+        Reviewed by Mark Hahnenberg.
+
+        Add a currentThreadIsHoldingAPILock() function to VM that checks if the current thread is the exclusive API thread.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::collect):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/VM.h:
+        (JSC::VM::currentThreadIsHoldingAPILock):
+
+2013-07-25  Zan Dobersek  <zdobersek@igalia.com>
+
+        REGRESSION(FTL): Most layout tests crashes
+        https://bugs.webkit.org/show_bug.cgi?id=119089
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution): Move prepareForExecutionImpl call into its own statement. This prevents the GCC-compiled
+        code to create the PassOwnPtr<JSC::JITCode> (intended as a parameter to the installOptimizedCode call) from the jitCode
+        RefPtr<JSC::JITCode> parameter before the latter was actually given a proper value through the prepareForExecutionImpl call.
+        Currently it's created beforehand and therefor holds a null pointer before it's anchored as the JIT code in
+        JSC::CodeBlock::setJITCode, which later indirectly causes assertions in JSC::CodeBlock::jitCompile.
+        (JSC::prepareFunctionForExecution): Ditto for prepareFunctionForExecutionImpl.
+
+2013-07-25  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props: Add missing 'ftl'
+        include path.
+
+2013-07-25  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add some missing files:
+        runtime/VM.h,.cpp; Remove deleted JSGlobalData.h,.cpp.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+
+2013-07-25  Oliver Hunt  <oliver@apple.com>
+
+        Make all jit & non-jit combos build cleanly
+        https://bugs.webkit.org/show_bug.cgi?id=119102
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::counterValueForOptimizeSoon):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::numberOfDFGCompiles):
+
+2013-07-25  Oliver Hunt  <oliver@apple.com>
+
+        32 bit portion of load validation logic
+        https://bugs.webkit.org/show_bug.cgi?id=118878
+
+        Reviewed by NOBODY (Build fix).
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-07-25  Oliver Hunt  <oliver@apple.com>
+
+        More 32bit build fixes
+
+        - Apparnetly some compilers don't track the fastcall directive everywhere we expect
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call):
+        * bytecode/CodeBlock.cpp:
+        * runtime/Structure.cpp:
+
+2013-07-25  Yi Shen  <max.hong.shen@gmail.com>
+
+        Optimize the thread locks for API Shims
+        https://bugs.webkit.org/show_bug.cgi?id=118573
+
+        Reviewed by Geoffrey Garen.
+
+        Remove the thread lock from API Shims if the VM has an exclusive thread (e.g. the VM 
+        only used by WebCore's main thread).
+
+        * API/APIShims.h:
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::APICallbackShim):
+        * runtime/JSLock.cpp:
+        (JSC::JSLockHolder::JSLockHolder):
+        (JSC::JSLockHolder::init):
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2013-07-25  Christophe Dumez  <ch.dumez@sisa.samsung.com>
+
+        Unreviewed build fix after r153218.
+
+        Broke the EFL port build with gcc 4.7.
+
+        * interpreter/StackIterator.cpp:
+        (JSC::printif):
+
+2013-07-25  Julien Brianceau  <jbrianceau@nds.com>
+
+        Build fix: add missing #include.
+        https://bugs.webkit.org/show_bug.cgi?id=119087
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        * bytecode/ArrayProfile.cpp:
+
+2013-07-25  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed, build fix on the EFL port.
+
+        * CMakeLists.txt: Added JSCTestRunnerUtils.cpp.
+
+2013-07-25  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Add missing store8(TrustedImm32, void*) implementation in baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=119083
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::store8):
+
+2013-07-25  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Fix test build after FTL upstream
+
+        Unreviewed build fix.
+
+        * Target.pri:
+
+2013-07-25  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        [Qt] Build fix after FTL.
+
+        Un Reviewed build fix.
+
+        * Target.pri:
+        * interpreter/StackIterator.cpp:
+        (JSC::StackIterator::Frame::print):
+
+2013-07-25  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Unreviewed build fix after FTL upstream.
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::~Worklist):
+
+2013-07-25  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed, build fix on the EFL port.
+
+        * CMakeLists.txt:
+        Added SourceCode.cpp and removed BlackBerry file.
+        * jit/JITCode.h:
+        (JSC::JITCode::nextTierJIT):
+        Fixed to build break because of -Werror=return-type
+        * parser/Lexer.cpp: Includes JSFunctionInlines.h
+        * runtime/JSScope.h:
+        (JSC::makeType):
+        Fixed to build break because of -Werror=return-type
+
+2013-07-25  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        Unreviewed build fixing after FTL upstream.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+
+2013-07-25  Julien Brianceau  <jbrianceau@nds.com>
+
+        Add missing implementation of bxxxnz in sh4 LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=119079
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        * offlineasm/sh4.rb:
+
+2013-07-25  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Unreviewed, build fix on the Qt port.
+
+        * Target.pri: Add additional build files for the FTL.
+
+2013-07-25  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        Unreviewed buildfix after FTL upstream..
+
+        * interpreter/StackIterator.cpp:
+        (JSC::StackIterator::Frame::codeType):
+        (JSC::StackIterator::Frame::functionName):
+        (JSC::StackIterator::Frame::sourceURL):
+        (JSC::StackIterator::Frame::logicalFrame):
+
+2013-07-25  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed.
+
+        * heap/CopyVisitor.cpp: Include CopiedSpaceInlines header so the CopiedSpace::recycleEvacuatedBlock
+        method is not left undefined, causing build failures on (at least) the GTK port.
+
+2013-07-25  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed, further build fixing on the GTK port.
+
+        * GNUmakefile.list.am: Add CompilationResult source files to the build.
+
+2013-07-25  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed GTK build fixing.
+
+        * GNUmakefile.am: Make the shared libjsc library depend on any changes to the build target list.
+        * GNUmakefile.list.am: Add additional build targets for files that were introduced by the FTL branch merge.
+
+2013-07-25  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Buildfix after this error:
+        error: 'pathName' may be used uninitialized in this function [-Werror=uninitialized]
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+
+2013-07-25  Csaba Osztrogonác  <ossy@webkit.org>
+
+        One more buildfix after FTL upstream.
+
+        Return a dummy value after RELEASE_ASSERT_NOT_REACHED() to make GCC happy.
+
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::getValue):
+        (JSC::DFG::LazyJSValue::strictEqual):
+
+2013-07-25  Julien Brianceau  <jbrianceau@nds.com>
+
+        Fix "Unhandled opcode localAnnotation" build error in sh4 and mips LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=119076
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        * offlineasm/mips.rb:
+        * offlineasm/sh4.rb:
+
+2013-07-25  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed GTK build fix.
+
+        * GNUmakefile.list.am: Adding JSCTestRunnerUtils files to the build.
+
+2013-07-25  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed. Further build fixing for the GTK port. Adding the forwarding header
+        for JSCTestRunnerUtils.h as required by the DumpRenderTree compilation.
+
+        * ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h: Added.
+
+2013-07-25  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed. Fixing the GTK build after the FTL merging by updating the build targets list.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+
+2013-07-25  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        Unreviewed buildfix after FTL upstream.
+
+        * runtime/JSScope.h:
+        (JSC::needsVarInjectionChecks):
+
+2013-07-25  Csaba Osztrogonác  <ossy@webkit.org>
+
+        One more fix after FTL upstream.
+
+        * Target.pri:
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+
+2013-07-24  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix after FTL upstream.
+
+        Add ftl directory as include path.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.pri:
+
+2013-07-24  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix after FTL upstream for non C++11 builds.
+
+        * interpreter/CallFrame.h:
+        * interpreter/StackIteratorPrivate.h:
+        (JSC::StackIterator::end):
+
+2013-07-24  Oliver Hunt  <oliver@apple.com>
+
+        Endeavour to fix CMakelist builds
+
+        * CMakeLists.txt:
+
+2013-07-24  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG IR dumps should be easier to read
+        https://bugs.webkit.org/show_bug.cgi?id=119050
+
+        Reviewed by Mark Hahnenberg.
+        
+        Added a DumpContext that includes support for printing an endnote
+        that describes all structures in full, while the main flow of the
+        dump just uses made-up names for the structures. This is helpful
+        since Structure::dump() may print a lot. The stuff it prints is
+        useful, but if it's all inline with the surrounding thing you're        
+        dumping (often, a node in the DFG), then you get a ridiculously
+        long print-out. All classes that dump structures (including
+        Structure itself) now have dumpInContext() methods that use
+        inContext() for dumping anything that might transitively print a
+        structure. If Structure::dumpInContext() is called with a NULL
+        context, it just uses dump() like before. Hence you don't have to
+        know anything about DumpContext unless you want to.
+        
+        inContext(*structure, context) dumps something like %B4:Array,
+        and the endnote will have something like:
+        
+            %B4:Array    = 0x10e91a180:[Array, {Edge:100, Normal:101, Line:102, NumPx:103, LastPx:104}, ArrayWithContiguous, Proto:0x10e99ffe0]
+        
+        where B4 is the inferred name that StringHashDumpContext came up
+        with.
+        
+        Also shortened a bunch of other dumps, removing information that
+        isn't so important.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ArrayProfile.cpp:
+        (JSC::dumpArrayModes):
+        * bytecode/CodeBlockHash.cpp:
+        (JSC):
+        (JSC::CodeBlockHash::CodeBlockHash):
+        (JSC::CodeBlockHash::dump):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::dumpInContext):
+        (JSC):
+        (JSC::InlineCallFrame::dumpInContext):
+        (JSC::InlineCallFrame::dump):
+        * bytecode/CodeOrigin.h:
+        (CodeOrigin):
+        (InlineCallFrame):
+        * bytecode/Operands.h:
+        (JSC::OperandValueTraits::isEmptyForDump):
+        (Operands):
+        (JSC::Operands::dump):
+        (JSC):
+        * bytecode/OperandsInlines.h: Added.
+        (JSC):
+        (JSC::::dumpInContext):
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::dumpInContext):
+        (JSC::StructureSet::dump):
+        (StructureSet):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::dump):
+        (DFG):
+        (JSC::DFG::AbstractValue::dumpInContext):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::operator!):
+        (AbstractValue):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCommon.cpp:
+        * dfg/DFGCommon.h:
+        (JSC::DFG::NodePointerTraits::isEmptyForDump):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::createDumpList):
+        * dfg/DFGDisassembler.h:
+        (Disassembler):
+        * dfg/DFGFlushFormat.h:
+        (WTF::inContext):
+        (WTF):
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::dumpInContext):
+        (JSC::DFG::LazyJSValue::dump):
+        (DFG):
+        * dfg/DFGLazyJSValue.h:
+        (LazyJSValue):
+        * dfg/DFGNode.h:
+        (JSC::DFG::nodeMapDump):
+        (WTF::inContext):
+        (WTF):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::dumpInContext):
+        (JSC::DFG::StructureAbstractValue::dump):
+        (StructureAbstractValue):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        (JSC::FTL::ExitValue::dump):
+        (FTL):
+        * ftl/FTLExitValue.h:
+        (ExitValue):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        * ftl/FTLValueSource.cpp:
+        (JSC::FTL::ValueSource::dumpInContext):
+        (FTL):
+        * ftl/FTLValueSource.h:
+        (ValueSource):
+        * runtime/DumpContext.cpp: Added.
+        (JSC):
+        (JSC::DumpContext::DumpContext):
+        (JSC::DumpContext::~DumpContext):
+        (JSC::DumpContext::isEmpty):
+        (JSC::DumpContext::dump):
+        * runtime/DumpContext.h: Added.
+        (JSC):
+        (DumpContext):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dump):
+        (JSC):
+        (JSC::JSValue::dumpInContext):
+        * runtime/JSCJSValue.h:
+        (JSC):
+        (JSValue):
+        * runtime/Structure.cpp:
+        (JSC::Structure::dumpInContext):
+        (JSC):
+        (JSC::Structure::dumpBrief):
+        (JSC::Structure::dumpContextHeader):
+        * runtime/Structure.h:
+        (JSC):
+        (Structure):
+
+2013-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should do a high-level LICM before going to FTL
+        https://bugs.webkit.org/show_bug.cgi?id=118749
+
+        Reviewed by Oliver Hunt.
+        
+        Implements LICM hoisting for nodes that never write anything and never read
+        things that are clobbered by the loop. There are some other preconditions for
+        hoisting, see DFGLICMPhase.cpp.
+
+        Also did a few fixes:
+        
+        - ClobberSet::add was failing to switch Super entries to Direct entries in
+          some cases.
+        
+        - DFGClobberize.cpp needed to #include "Operations.h".
+        
+        - DCEPhase needs to process the graph in reverse DFS order, when we're in SSA.
+        
+        - AbstractInterpreter can now execute a Node without knowing its indexInBlock.
+          Knowing the indexInBlock is an optional optimization that all other clients
+          of AI still opt into, but LICM doesn't.
+        
+        This makes the FTL a 2.19x speed-up on imaging-gaussian-blur.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreter.h:
+        (AbstractInterpreter):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        (JSC::DFG::::execute):
+        (DFG):
+        (JSC::DFG::::clobberWorld):
+        (JSC::DFG::::clobberStructures):
+        * dfg/DFGAtTailAbstractState.cpp: Added.
+        (DFG):
+        (JSC::DFG::AtTailAbstractState::AtTailAbstractState):
+        (JSC::DFG::AtTailAbstractState::~AtTailAbstractState):
+        (JSC::DFG::AtTailAbstractState::createValueForNode):
+        (JSC::DFG::AtTailAbstractState::forNode):
+        * dfg/DFGAtTailAbstractState.h: Added.
+        (DFG):
+        (AtTailAbstractState):
+        (JSC::DFG::AtTailAbstractState::initializeTo):
+        (JSC::DFG::AtTailAbstractState::forNode):
+        (JSC::DFG::AtTailAbstractState::variables):
+        (JSC::DFG::AtTailAbstractState::block):
+        (JSC::DFG::AtTailAbstractState::isValid):
+        (JSC::DFG::AtTailAbstractState::setDidClobber):
+        (JSC::DFG::AtTailAbstractState::setIsValid):
+        (JSC::DFG::AtTailAbstractState::setBranchDirection):
+        (JSC::DFG::AtTailAbstractState::setFoundConstants):
+        (JSC::DFG::AtTailAbstractState::haveStructures):
+        (JSC::DFG::AtTailAbstractState::setHaveStructures):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::insertBeforeLast):
+        * dfg/DFGBasicBlockInlines.h:
+        (DFG):
+        * dfg/DFGClobberSet.cpp:
+        (JSC::DFG::ClobberSet::add):
+        (JSC::DFG::ClobberSet::addAll):
+        * dfg/DFGClobberize.cpp:
+        (JSC::DFG::doesWrites):
+        * dfg/DFGClobberize.h:
+        (DFG):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::DCEPhase):
+        (JSC::DFG::DCEPhase::run):
+        (JSC::DFG::DCEPhase::fixupBlock):
+        (DCEPhase):
+        * dfg/DFGEdgeDominates.h: Added.
+        (DFG):
+        (EdgeDominates):
+        (JSC::DFG::EdgeDominates::EdgeDominates):
+        (JSC::DFG::EdgeDominates::operator()):
+        (JSC::DFG::EdgeDominates::result):
+        (JSC::DFG::edgesDominate):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGLICMPhase.cpp: Added.
+        (LICMPhase):
+        (JSC::DFG::LICMPhase::LICMPhase):
+        (JSC::DFG::LICMPhase::run):
+        (JSC::DFG::LICMPhase::attemptHoist):
+        (DFG):
+        (JSC::DFG::performLICM):
+        * dfg/DFGLICMPhase.h: Added.
+        (DFG):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2013-07-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG Nodes should be able to abstractly tell you what they read and what they write
+        https://bugs.webkit.org/show_bug.cgi?id=118910
+
+        Reviewed by Sam Weinig.
+        
+        Add the notion of AbstractHeap to the DFG. This is analogous to the AbstractHeap in
+        the FTL, except that the FTL's AbstractHeaps are used during LLVM lowering and are
+        engineered to obey LLVM TBAA logic. The FTL's AbstractHeaps are also engineered to
+        be inexpensive to use (they just give you a TBAA node) but expensive to create (you
+        create them all up front). FTL AbstractHeaps also don't actually give you the
+        ability to reason about aliasing; they are *just* a mechanism for lowering to TBAA.
+        The DFG's AbstractHeaps are engineered to be both cheap to create and cheap to use.
+        They also give you aliasing machinery. The DFG AbstractHeaps are represented
+        internally by a int64_t. Many comparisons between them are just integer comaprisons.
+        AbstractHeaps form a three-level hierarchy (World is the supertype of everything,
+        Kind with a TOP payload is a direct subtype of World, and Kind with a non-TOP
+        payload is the direct subtype of its corresponding TOP Kind).
+        
+        Add the notion of a ClobberSet. This is the set of AbstractHeaps that you had
+        clobbered. It represents the set that results from unifying a bunch of
+        AbstractHeaps, and is intended to quickly answer overlap questions: does the given
+        AbstractHeap overlap any AbstractHeap in the ClobberSet? To this end, if you add an
+        AbstractHeap to a set, it "directly" adds the heap itself, and "super" adds all of
+        its ancestors. An AbstractHeap is said to overlap a set if any direct or super
+        member is equal to it, or if any of its ancestors are equal to a direct member.
+        
+        Example #1:
+        
+            - I add Variables(5). I.e. Variables is the Kind and 5 is the payload. This
+              is a subtype of Variables, which is a subtype of World.
+            - You query Variables. I.e. Variables with a TOP payload, which is the
+              supertype of Variables(X) for any X, and a subtype of World.
+            
+            The set will have Variables(5) as a direct member, and Variables and World as
+            super members. The Variables query will immediately return true, because
+            Variables is indeed a super member.
+        
+        Example #2:
+        
+            - I add Variables(5)
+            - You query NamedProperties
+            
+            NamedProperties is not a member at all (neither direct or super). We next
+            query World. World is a member, but it's a super member, so we return false.
+        
+        Example #3:
+        
+            - I add Variables
+            - You query Variables(5)
+            
+            The set will have Variables as a direct member, and World as a super member.
+            The Variables(5) query will not find Variables(5) in the set, but then it
+            will query Variables. Variables is a direct member, so we return true.
+        
+        Example #4:
+        
+            - I add Variables
+            - You query NamedProperties(5)
+            
+            Neither NamedProperties nor NamedProperties(5) are members. We next query
+            World. World is a member, but it's a super member, so we return false.
+        
+        Overlap queries require that either the heap being queried is in the set (either
+        direct or super), or that one of its ancestors is a direct member. Another way to
+        think about how this works is that two heaps A and B are said to overlap if
+        A.isSubtypeOf(B) or B.isSubtypeOf(A). This is sound since heaps form a
+        single-inheritance heirarchy. Consider that we wanted to implement a set that holds
+        heaps and answers the question, "is any member in the set an ancestor (i.e.
+        supertype) of some other heap". We would have the set contain the heaps themselves,
+        and we would satisfy the query "A.isSubtypeOfAny(set)" by walking the ancestor
+        chain of A, and repeatedly querying its membership in the set. This is what the
+        "direct" members of our set do. Now consider the other part, where we want to ask if
+        any member of the set is a descendent of a heap, or "A.isSupertypeOfAny(set)". We
+        would implement this by implementing set.add(B) as adding not just B but also all of
+        B's ancestors; then we would answer A.isSupertypeOfAny(set) by just checking if A is
+        in the set. With two such sets - one that answers isSubtypeOfAny() and another that
+        answers isSupertypeOfAny() - we could answer the "do any of my heaps overlap your
+        heap" question. ClobberSet does this, but combines the two sets into a single
+        HashMap. The HashMap's value, "direct", means that the key is a member of both the
+        supertype set and the subtype set; if it's false then it's only a member of one of
+        them.
+        
+        Finally, this adds a functorized clobberize() method that adds the read and write
+        clobbers of a DFG::Node to read and write functors. Common functors for adding to
+        ClobberSets, querying overlap, and doing nothing are provided. Convenient wrappers
+        are also provided. This allows you to say things like:
+        
+            ClobberSet set;
+            addWrites(graph, node1, set);
+            if (readsOverlap(graph, node2, set))
+                // We know that node1 may write to something that node2 may read from.
+        
+        Currently this facility is only used to improve graph dumping, but it will be
+        instrumental in both LICM and GVN. In the future, I want to completely kill the
+        NodeClobbersWorld and NodeMightClobber flags, and eradicate CSEPhase's hackish way
+        of accomplishing almost exactly what AbstractHeap gives you.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractHeap.cpp: Added.
+        (DFG):
+        (JSC::DFG::AbstractHeap::Payload::dump):
+        (JSC::DFG::AbstractHeap::dump):
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGAbstractHeap.h: Added.
+        (DFG):
+        (AbstractHeap):
+        (Payload):
+        (JSC::DFG::AbstractHeap::Payload::Payload):
+        (JSC::DFG::AbstractHeap::Payload::top):
+        (JSC::DFG::AbstractHeap::Payload::isTop):
+        (JSC::DFG::AbstractHeap::Payload::value):
+        (JSC::DFG::AbstractHeap::Payload::valueImpl):
+        (JSC::DFG::AbstractHeap::Payload::operator==):
+        (JSC::DFG::AbstractHeap::Payload::operator!=):
+        (JSC::DFG::AbstractHeap::Payload::operator<):
+        (JSC::DFG::AbstractHeap::Payload::isDisjoint):
+        (JSC::DFG::AbstractHeap::Payload::overlaps):
+        (JSC::DFG::AbstractHeap::AbstractHeap):
+        (JSC::DFG::AbstractHeap::operator!):
+        (JSC::DFG::AbstractHeap::kind):
+        (JSC::DFG::AbstractHeap::payload):
+        (JSC::DFG::AbstractHeap::isDisjoint):
+        (JSC::DFG::AbstractHeap::overlaps):
+        (JSC::DFG::AbstractHeap::supertype):
+        (JSC::DFG::AbstractHeap::hash):
+        (JSC::DFG::AbstractHeap::operator==):
+        (JSC::DFG::AbstractHeap::operator!=):
+        (JSC::DFG::AbstractHeap::operator<):
+        (JSC::DFG::AbstractHeap::isHashTableDeletedValue):
+        (JSC::DFG::AbstractHeap::payloadImpl):
+        (JSC::DFG::AbstractHeap::encode):
+        (JSC::DFG::AbstractHeapHash::hash):
+        (JSC::DFG::AbstractHeapHash::equal):
+        (AbstractHeapHash):
+        (WTF):
+        * dfg/DFGClobberSet.cpp: Added.
+        (DFG):
+        (JSC::DFG::ClobberSet::ClobberSet):
+        (JSC::DFG::ClobberSet::~ClobberSet):
+        (JSC::DFG::ClobberSet::add):
+        (JSC::DFG::ClobberSet::addAll):
+        (JSC::DFG::ClobberSet::contains):
+        (JSC::DFG::ClobberSet::overlaps):
+        (JSC::DFG::ClobberSet::clear):
+        (JSC::DFG::ClobberSet::direct):
+        (JSC::DFG::ClobberSet::super):
+        (JSC::DFG::ClobberSet::dump):
+        (JSC::DFG::ClobberSet::setOf):
+        (JSC::DFG::addReads):
+        (JSC::DFG::addWrites):
+        (JSC::DFG::addReadsAndWrites):
+        (JSC::DFG::readsOverlap):
+        (JSC::DFG::writesOverlap):
+        * dfg/DFGClobberSet.h: Added.
+        (DFG):
+        (ClobberSet):
+        (JSC::DFG::ClobberSet::isEmpty):
+        (ClobberSetAdd):
+        (JSC::DFG::ClobberSetAdd::ClobberSetAdd):
+        (JSC::DFG::ClobberSetAdd::operator()):
+        (ClobberSetOverlaps):
+        (JSC::DFG::ClobberSetOverlaps::ClobberSetOverlaps):
+        (JSC::DFG::ClobberSetOverlaps::operator()):
+        (JSC::DFG::ClobberSetOverlaps::result):
+        * dfg/DFGClobberize.cpp: Added.
+        (DFG):
+        (JSC::DFG::didWrites):
+        * dfg/DFGClobberize.h: Added.
+        (DFG):
+        (JSC::DFG::clobberize):
+        (NoOpClobberize):
+        (JSC::DFG::NoOpClobberize::NoOpClobberize):
+        (JSC::DFG::NoOpClobberize::operator()):
+        (CheckClobberize):
+        (JSC::DFG::CheckClobberize::CheckClobberize):
+        (JSC::DFG::CheckClobberize::operator()):
+        (JSC::DFG::CheckClobberize::result):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+
+2013-07-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: It should be easy to figure out which blocks nodes belong to
+        https://bugs.webkit.org/show_bug.cgi?id=118957
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGGraph.cpp:
+        (DFG):
+        (JSC::DFG::Graph::initializeNodeOwners):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGNode.h:
+
+2013-07-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: NodeExitsForward shouldn't be duplicated in NodeType
+        https://bugs.webkit.org/show_bug.cgi?id=118956
+
+        Reviewed by Sam Weinig.
+        
+        We had two way of expressing that something exits forward: the NodeExitsForward
+        flag and the word 'Forward' in the NodeType. That's kind of dumb. This patch
+        makes it just be a flag.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::int32ToDoubleCSE):
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        (JSC::DFG::MinifiedNode::hasChild):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+        (JSC::DFG::Node::hasStructureSet):
+        (JSC::DFG::Node::hasStructure):
+        (JSC::DFG::Node::hasArrayMode):
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        (JSC::DFG::needsOSRForwardRewiring):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+
+2013-07-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: It should be possible for a DFG::Node to claim to exit to one CodeOrigin, but then claim that it belongs to a different CodeOrigin for all other purposes
+        https://bugs.webkit.org/show_bug.cgi?id=118946
+
+        Reviewed by Geoffrey Garen.
+        
+        We want to decouple the exit target code origin of a node from the code origin
+        for all other purposes. The purposes of code origins are:
+        
+        - Where the node will exit, if it exits. The exit target should be consistent with
+          the surrounding nodes, in that if you just looked at the code origins of nodes in
+          the graph, they would be consistent with the code origins in bytecode. This is
+          necessary for live-at-bytecode analyses to work, and to preserve the original
+          bytecode semantics when exiting.
+        
+        - What kind of code the node came from, for semantics thingies. For example, we
+          might use the code origin to find the node's global object for doing an original
+          array check. Or we might use it to determine if the code is in strict mode. Or
+          other similar things. When we use the code origin in this way, we're basically
+          using it as a way of describing the node's meta-data without putting it into the
+          node directly, to save space. In the absurd extreme you could imagine nodes not
+          even having NodeTypes or NodeFlags, and just using the CodeOrigin to determine
+          what bytecode the node originated from. We won't do that, but you can think of
+          this use of code origins as just a way of compressing meta-data.
+        
+        - What code origin we should supply profiling to, if we exit. This is closely
+          related to the semantics thingies, in that the exit profiling is a persistent
+          kind of semantic meta-data that survives between recompiles, and the only way to
+          do that is to ascribe it to the original bytecode via the code origin.
+        
+        If we hoist a node, we need to change the exit target code origin, but we must not
+        change the code origin for other purposes. The best way to do this is to decouple
+        the two kinds of code origin.
+        
+        OSR exit data structures already do this, because they may edit the exit target
+        code origin while keeping the code origin for profiling intact. This happens for
+        forward exits. So, we just need to thread separation all the way back to DFG::Node.
+        That's what this patch does.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (Node):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::OSRExitBase):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (LowerDFGToLLVM):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::OSRExit):
+        * ftl/FTLOSRExit.h:
+        (OSRExit):
+
+2013-07-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: each DFG node that relies on other nodes to do their type checks should be able to tell you if those type checks happened
+        https://bugs.webkit.org/show_bug.cgi?id=118866
+
+        Reviewed by Sam Weinig.
+        
+        Adds a safeToExecute() method that takes a node and an abstract state and tells you
+        if the node will run without crashing under that state.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * dfg/DFGCFAPhase.cpp:
+        (CFAPhase):
+        (JSC::DFG::CFAPhase::CFAPhase):
+        (JSC::DFG::CFAPhase::run):
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        (JSC::DFG::CFAPhase::performForwardCFA):
+        * dfg/DFGSafeToExecute.h: Added.
+        (DFG):
+        (SafeToExecuteEdge):
+        (JSC::DFG::SafeToExecuteEdge::SafeToExecuteEdge):
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::SafeToExecuteEdge::result):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::isValidOffset):
+        (StructureAbstractValue):
+        * runtime/Options.h:
+        (JSC):
+
+2013-07-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should be able to generate LLVM IR that uses an intrinsic for OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=118948
+
+        Reviewed by Sam Weinig.
+        
+        - Add the ability to generate LLVM IR but then not use it, via --llvmAlwaysFails=true.
+          This allows doing "what if" experiments with IR generation, even if the generated IR
+          can't yet execute.
+        
+        - Add an OSR exit path that just calls an intrinsic that combines the branch and the
+          off-ramp.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * ftl/FTLFail.cpp: Added.
+        (FTL):
+        (JSC::FTL::fail):
+        * ftl/FTLFail.h: Added.
+        (FTL):
+        * ftl/FTLIntrinsicRepository.h:
+        (FTL):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        * runtime/Options.h:
+        (JSC):
+
+2013-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: StringObjectUse uses structures, and CSE should know that
+        https://bugs.webkit.org/show_bug.cgi?id=118940
+
+        Reviewed by Geoffrey Garen.
+        
+        This is asymptomatic right now, but we should fix it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        * dfg/DFGEdgeUsesStructure.h: Added.
+        (DFG):
+        (EdgeUsesStructure):
+        (JSC::DFG::EdgeUsesStructure::EdgeUsesStructure):
+        (JSC::DFG::EdgeUsesStructure::operator()):
+        (JSC::DFG::EdgeUsesStructure::result):
+        (JSC::DFG::edgesUseStructure):
+        * dfg/DFGUseKind.h:
+        (DFG):
+        (JSC::DFG::usesStructure):
+
+2013-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: String GetByVal out-of-bounds handling is so wrong
+        https://bugs.webkit.org/show_bug.cgi?id=118935
+
+        Reviewed by Geoffrey Garen.
+        
+        Bunch of String GetByVal out-of-bounds fixes:
+        
+        - Even if the string proto chain is sane, we need to watch out for negative
+          indices. They may get values or call getters in the prototypes, since proto
+          sanity doesn't check for negative indexed properties, as they are not
+          technically indexed properties.
+        
+        - GetByVal String out-of-bounds does in fact clobberWorld(). CSE should be
+          given this information.
+        
+        - GetByVal String out-of-bounds does in fact clobberWorld(). CFA should be
+          given this information.
+        
+        Also fixed some other things:
+        
+        - If the DFG is disabled, the testRunner should pretend that we've done a
+          bunch of DFG compiles. That's necessary to prevent the tests from timing
+          out.
+        
+        - Disassembler shouldn't try to dump source code since it's not safe in the
+          concurrent JIT.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::numberOfDFGCompiles):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dumpHeader):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        * dfg/DFGSaneStringGetByValSlowPathGenerator.h: Added.
+        (DFG):
+        (SaneStringGetByValSlowPathGenerator):
+        (JSC::DFG::SaneStringGetByValSlowPathGenerator::SaneStringGetByValSlowPathGenerator):
+        (JSC::DFG::SaneStringGetByValSlowPathGenerator::generateInternal):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+
+2013-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Structure::isValidOffset() should be able to tell you if you're loading a valid JSValue, and not just not crashing
+        https://bugs.webkit.org/show_bug.cgi?id=118911
+
+        Reviewed by Geoffrey Garen.
+        
+        We could also have a separate method like "willNotCrash(offset)", but that's not
+        what isValidOffset() is intended to mean.
+
+        * runtime/Structure.h:
+        (JSC::Structure::isValidOffset):
+
+2013-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Structure should be able to tell you if it's valid to load at a given offset from any object with that structure
+        https://bugs.webkit.org/show_bug.cgi?id=118878
+
+        Reviewed by Oliver Hunt.
+        
+        - Change Structure::isValidOffset() to actually answer the question "If I attempted
+          to load from an object of this structure, at this offset, would I commit suicide
+          or would I get back some kind of value?"
+        
+        - Change StorageAccessData::offset to use a PropertyOffset. It should have been that
+          way from the start.
+        
+        - Fix PutStructure so that it sets haveStructures in all of the cases that it should.
+        
+        - Make GetByOffset also reference the base object in addition to the butterfly.
+        
+        The future use of this power will be to answer questions like "If I hoisted this
+        GetByOffset or PutByOffset to this point, would it cause crashes, or would it be
+        fine?"
+        
+        I don't currently plan to use this power to perform validation, since the CSE has
+        the power to eliminate CheckStructure's that the CFA wouldn't be smart enough to
+        remove - both in the case of StructureSets where size >= 2 and in the case of
+        CheckStructures that match across PutStructures. At first I tried to write a
+        validator that was aware of this, but the validation code got way too complicated
+        and I started having nightmares of spurious assertion bugs being filed against me.
+        
+        This also changes some of the code for how we hash FunctionExecutable's for debug
+        dumps, since that code still had some thread-safety issues. Basically, the
+        concurrent JIT needs to use the CodeBlock's precomputed hash and never call anything
+        that could transitively try to compute the hash from the source code. The source
+        code is a string that may be lazily computed, and that involves all manner of thread
+        unsafe things.
+
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::hash):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::handlePutByOffset):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (StorageAccessData):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToGetByOffset):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByOffset):
+        * runtime/FunctionExecutableDump.cpp:
+        (JSC::FunctionExecutableDump::dump):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::isValidOffset):
+
+2013-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: AbstractInterpreter should explicitly ask AbstractState to create new AbstractValues for newly born nodes
+        https://bugs.webkit.org/show_bug.cgi?id=118880
+
+        Reviewed by Sam Weinig.
+        
+        It should be possible to have an AbstractState that is backed by a HashMap. But to
+        do this, the AbstractInterpreter should explicitly ask for new nodes to be added to
+        the map, since otherwise the idiom of getting a reference to the AbstractValue
+        returned by forNode() would cause really subtle memory corruption bugs.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGInPlaceAbstractState.h:
+        (JSC::DFG::InPlaceAbstractState::createValueForNode):
+        (InPlaceAbstractState):
+
+2013-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Decouple the way that CFA stores its state from the way it does abstract interpretation
+        https://bugs.webkit.org/show_bug.cgi?id=118835
+
+        Reviewed by Oliver Hunt.
+        
+        This separates AbstractState into two things:
+        
+        - InPlaceAbstractState, which can tell you the abstract state of anything you
+          might care about, and uses the old AbstractState's algorithms and data
+          structures for doing so.
+        
+        - AbstractInterpreter<AbstractStateType>, which can execute a DFG::Node* with
+          respect to an AbstractStateType. Currently we always use
+          AbstractStateType = InPlaceAbstractState. But we could drop in an other
+          class that supports basic primitives like forNode() and variables().
+        
+        This is important because:
+        
+        - We want to hoist things out of loops.
+
+        - We don't know what things rely on what type checks.
+
+        - We only want to hoist type checks out of loops if they aren't clobbered.
+
+        - We may want to still hoist things that depended on those type checks, if it's
+          safe to do those things based on the CFA state at the tail of the loop
+          pre-header.
+
+        - We don't want things to rely on their type checks by way of a token, because
+          that's just weird.
+
+        So, we want to be able to have a special form of the CFA that can
+        incrementally update a basic block's state-at-tail, and we want to be able to
+        do this for multiple blocks simultaneously. This requires *not* storing the
+        per-node state in the nodes themselves, but instead using the at-tail HashMap
+        directly.
+
+        Hence we need to have a way of making the abstract interpreter (i.e.
+        AbstractState::execute) polymorphic with respect to state representation. Put
+        another way, we need to separate the way that abstract state is represented
+        from the way DFG IR is abstractly interpreted.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreter.h: Added.
+        (DFG):
+        (AbstractInterpreter):
+        (JSC::DFG::AbstractInterpreter::forNode):
+        (JSC::DFG::AbstractInterpreter::variables):
+        (JSC::DFG::AbstractInterpreter::needsTypeCheck):
+        (JSC::DFG::AbstractInterpreter::filterEdgeByUse):
+        (JSC::DFG::AbstractInterpreter::filter):
+        (JSC::DFG::AbstractInterpreter::filterArrayModes):
+        (JSC::DFG::AbstractInterpreter::filterByValue):
+        (JSC::DFG::AbstractInterpreter::trySetConstant):
+        (JSC::DFG::AbstractInterpreter::filterByType):
+        * dfg/DFGAbstractInterpreterInlines.h: Added.
+        (DFG):
+        (JSC::DFG::::AbstractInterpreter):
+        (JSC::DFG::::~AbstractInterpreter):
+        (JSC::DFG::::booleanResult):
+        (JSC::DFG::::startExecuting):
+        (JSC::DFG::::executeEdges):
+        (JSC::DFG::::verifyEdge):
+        (JSC::DFG::::verifyEdges):
+        (JSC::DFG::::executeEffects):
+        (JSC::DFG::::execute):
+        (JSC::DFG::::clobberWorld):
+        (JSC::DFG::::clobberCapturedVars):
+        (JSC::DFG::::clobberStructures):
+        (JSC::DFG::::dump):
+        (JSC::DFG::::filter):
+        (JSC::DFG::::filterArrayModes):
+        (JSC::DFG::::filterByValue):
+        * dfg/DFGAbstractState.cpp: Removed.
+        * dfg/DFGAbstractState.h: Removed.
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::CFAPhase):
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        (CFAPhase):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (ConstantFoldingPhase):
+        * dfg/DFGInPlaceAbstractState.cpp: Added.
+        (DFG):
+        (JSC::DFG::InPlaceAbstractState::InPlaceAbstractState):
+        (JSC::DFG::InPlaceAbstractState::~InPlaceAbstractState):
+        (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
+        (JSC::DFG::setLiveValues):
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+        (JSC::DFG::InPlaceAbstractState::reset):
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        (JSC::DFG::InPlaceAbstractState::merge):
+        (JSC::DFG::InPlaceAbstractState::mergeToSuccessors):
+        (JSC::DFG::InPlaceAbstractState::mergeVariableBetweenBlocks):
+        * dfg/DFGInPlaceAbstractState.h: Added.
+        (DFG):
+        (InPlaceAbstractState):
+        (JSC::DFG::InPlaceAbstractState::forNode):
+        (JSC::DFG::InPlaceAbstractState::variables):
+        (JSC::DFG::InPlaceAbstractState::block):
+        (JSC::DFG::InPlaceAbstractState::didClobber):
+        (JSC::DFG::InPlaceAbstractState::isValid):
+        (JSC::DFG::InPlaceAbstractState::setDidClobber):
+        (JSC::DFG::InPlaceAbstractState::setIsValid):
+        (JSC::DFG::InPlaceAbstractState::setBranchDirection):
+        (JSC::DFG::InPlaceAbstractState::setFoundConstants):
+        (JSC::DFG::InPlaceAbstractState::haveStructures):
+        (JSC::DFG::InPlaceAbstractState::setHaveStructures):
+        * dfg/DFGMergeMode.h: Added.
+        (DFG):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::backwardTypeCheck):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
+        (JSC::DFG::SpeculativeJIT::speculateStringObject):
+        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::needsTypeCheck):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (FTL):
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::appendTypeCheck):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateNumber):
+        (JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
+        (LowerDFGToLLVM):
+
+2013-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG shouldn't create CheckStructures for array accesses except if the ArrayMode implies an original array access
+        https://bugs.webkit.org/show_bug.cgi?id=118867
+
+        Reviewed by Mark Hahnenberg.
+        
+        This allows us to kill off a bunch of code in the parser, in fixup, and to simplify
+        ArrayProfile.
+
+        It also makes it easier to ask any array-using node how to create its type check.
+        
+        Doing this required fixing a bug in LowLevelInterpreter64, where it was storing into
+        an array profile, thinking that it was storing into a value profile. Reshuffling the
+        fields in ArrayProfile revealed this.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        (JSC::ArrayProfile::briefDescriptionWithoutUpdating):
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::ArrayProfile):
+        (ArrayProfile):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::updateAllArrayPredictions):
+        (JSC::CodeBlock::updateAllPredictions):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::updateAllArrayPredictions):
+        * dfg/DFGArrayMode.h:
+        (ArrayMode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayModeConsideringSlowPath):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * llint/LowLevelInterpreter64.asm:
+
+2013-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: CFA should consider live-at-head for clobbering and dumping
+        https://bugs.webkit.org/show_bug.cgi?id=118857
+
+        Reviewed by Mark Hahnenberg.
+        
+        - clobberStructures() was not considering nodes live-at-head when in SSA
+          form. This means it would fail to clobber some structures.
+        
+        - dump() was not considering nodes live-at-head when in SSA form. This
+          means it wouldn't dump everything that you might be interested in.
+        
+        - AbstractState::m_currentNode is a useless variable and we should get
+          rid of it.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::reset):
+        (JSC::DFG::AbstractState::startExecuting):
+        (JSC::DFG::AbstractState::clobberStructures):
+        (JSC::DFG::AbstractState::dump):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+
+2013-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Add a phase to create loop pre-headers
+        https://bugs.webkit.org/show_bug.cgi?id=118778
+
+        Reviewed by Oliver Hunt.
+        
+        Add a loop pre-header creation phase. Any loop that doesn't already have
+        just one predecessor that isn't part of the loop has a pre-header
+        prepended. All non-loop predecessors then jump to that pre-header.
+        
+        Also fix a handful of bugs:
+        
+        - DFG::Analysis should set m_valid before running the analysis, since that
+          makes it easier to use ASSERT(m_valid) in the analysis' methods, which
+          may be called by the analysis before the analysis completes. NaturalLoops
+          does this with loopsOf().
+        
+        - NaturalLoops::headerOf() was missing a check for innerMostLoopOf()
+          returning 0, since that'll happen if the block isn't in any loop.
+        
+        - Change BlockInsertionSet to dethread the graph, since anyone using it
+          will want to do so.
+        
+        - Change dethreading to ignore SSA form graphs.
+        
+        This also adds NaturalLoops::belongsTo(), which I always used in the
+        pre-header creation phase. I didn't end up using it but I'll probably use
+        it in the near future.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAnalysis.h:
+        (JSC::DFG::Analysis::computeIfNecessary):
+        * dfg/DFGBlockInsertionSet.cpp:
+        (JSC::DFG::BlockInsertionSet::execute):
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dethread):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp: Added.
+        (DFG):
+        (LoopPreHeaderCreationPhase):
+        (JSC::DFG::LoopPreHeaderCreationPhase::LoopPreHeaderCreationPhase):
+        (JSC::DFG::LoopPreHeaderCreationPhase::run):
+        (JSC::DFG::performLoopPreHeaderCreation):
+        * dfg/DFGLoopPreHeaderCreationPhase.h: Added.
+        (DFG):
+        * dfg/DFGNaturalLoops.h:
+        (NaturalLoop):
+        (JSC::DFG::NaturalLoops::headerOf):
+        (JSC::DFG::NaturalLoops::innerMostLoopOf):
+        (JSC::DFG::NaturalLoops::innerMostOuterLoop):
+        (JSC::DFG::NaturalLoops::belongsTo):
+        (NaturalLoops):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2013-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Rationalize Node::replacement
+        https://bugs.webkit.org/show_bug.cgi?id=118774
+
+        Reviewed by Oliver Hunt.
+        
+        - Clearing of replacements is now done in Graph::clearReplacements().
+        
+        - New nodes now have replacement set to 0.
+        
+        - Node::replacement is now part of a 'misc' union. I'll be putting at least
+          one other field into that union as part of LICM work (see
+          https://bugs.webkit.org/show_bug.cgi?id=118749).
+
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::run):
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::run):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+        * dfg/DFGGraph.cpp:
+        (DFG):
+        (JSC::DFG::Graph::clearReplacements):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::performSubstitutionForEdge):
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+
+2013-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: NaturalLoops should be able to quickly answer questions like "what loops own this basic block"
+        https://bugs.webkit.org/show_bug.cgi?id=118750
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGBasicBlock.h:
+        (BasicBlock):
+        * dfg/DFGNaturalLoops.cpp:
+        (JSC::DFG::NaturalLoops::compute):
+        (JSC::DFG::NaturalLoops::loopsOf):
+        * dfg/DFGNaturalLoops.h:
+        (DFG):
+        (JSC::DFG::NaturalLoop::NaturalLoop):
+        (NaturalLoop):
+        (JSC::DFG::NaturalLoop::index):
+        (JSC::DFG::NaturalLoop::isOuterMostLoop):
+        (JSC::DFG::NaturalLoop::addBlock):
+        (JSC::DFG::NaturalLoops::headerOf):
+        (JSC::DFG::NaturalLoops::innerMostLoopOf):
+        (NaturalLoops):
+        (JSC::DFG::NaturalLoops::innerMostOuterLoop):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2013-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: don't GC when shutting down the VM
+        https://bugs.webkit.org/show_bug.cgi?id=118751
+
+        Reviewed by Mark Hahnenberg.
+
+        * heap/Heap.h:
+        (Heap):
+        * runtime/VM.cpp:
+        (JSC::VM::~VM):
+
+2013-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should have an SSA form for use by FTL
+        https://bugs.webkit.org/show_bug.cgi?id=118338
+
+        Reviewed by Mark Hahnenberg.
+        
+        Adds an SSA form to the DFG. We can convert ThreadedCPS form into SSA form
+        after breaking critical edges. The conversion algorithm follows Aycock and
+        Horspool, and the SSA form itself follows something I've done before, where
+        instead of having Phi functions specify input nodes corresponding to block
+        predecessors, we instead have Upsilon functions in the predecessors that
+        specify which value in that block goes into which subsequent Phi. Upsilons
+        don't have to dominate Phis (usually they don't) and they correspond to a
+        non-SSA "mov" into the Phi's "variable". This gives all of the good
+        properties of SSA, while ensuring that a bunch of CFG transformations don't
+        have to be SSA-aware.
+        
+        So far the only DFG phases that are SSA-aware are DCE and CFA. CFG
+        simplification is probably SSA-aware by default, though I haven't tried it.
+        Constant folding probably needs a few tweaks, but is likely ready. Ditto
+        for CSE, though it's not clear that we'd want to use block-local CSE when
+        we could be doing GVN.
+        
+        Currently only the FTL can generate code from the SSA form, and there is no
+        way to convert from SSA to ThreadedCPS or LoadStore. There probably will
+        never be such a capability.
+        
+        In order to handle OSR exit state in the SSA, we place MovHints at Phi
+        points. Other than that, you can reconstruct state-at-exit by forward
+        propagating MovHints. Note that MovHint is the new SetLocal in SSA.
+        SetLocal and GetLocal only survive into SSA if they are on captured
+        variables, or in the case of flushes. A "live SetLocal" will be
+        NodeMustGenerate and will always correspond to a flush. Computing the
+        state-at-exit requires running SSA liveness analysis, OSR availability
+        analysis, and flush liveness analysis. The FTL runs all of these prior to
+        generating code. While OSR exit continues to be tricky, much of the logic
+        is now factored into separate phases and the backend has to do less work
+        to reason about what happened outside of the basic block that is being
+        lowered.
+        
+        Conversion from DFG SSA to LLVM SSA is done by ensuring that we generate
+        code in depth-first order, thus guaranteeing that a node will always be
+        lowered (and hence have a LValue) before any of the blocks dominated by
+        that node's block have code generated. For Upsilon/Phi, we just use
+        alloca's. We could do something more clever there, but it's probably not
+        worth it, at least not now.
+        
+        Finally, while the SSA form is currently only being converted to LLVM IR,
+        there is nothing that prevents us from considering other backends in the
+        future - with the caveat that this form is designed to be first lowered to
+        a lower-level SSA before actual machine code generation commences. So we
+        ought to either use LLVM (the intended path) or we will have to write our
+        own SSA low-level backend.
+        
+        This runs all of the code that the FTL was known to run previously. No
+        change in performance for now. But it does open some exciting
+        possibilities!
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Operands.h:
+        (JSC::OperandValueTraits::dump):
+        (JSC::Operands::fill):
+        (Operands):
+        (JSC::Operands::clear):
+        (JSC::Operands::operator==):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::setLiveValues):
+        (DFG):
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::executeEffects):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        (JSC::DFG::AbstractState::merge):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGAdjacencyList.h:
+        (JSC::DFG::AdjacencyList::justOneChild):
+        (AdjacencyList):
+        * dfg/DFGBasicBlock.cpp: Added.
+        (DFG):
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::BasicBlock::~BasicBlock):
+        (JSC::DFG::BasicBlock::ensureLocals):
+        (JSC::DFG::BasicBlock::isInPhis):
+        (JSC::DFG::BasicBlock::isInBlock):
+        (JSC::DFG::BasicBlock::removePredecessor):
+        (JSC::DFG::BasicBlock::replacePredecessor):
+        (JSC::DFG::BasicBlock::dump):
+        (JSC::DFG::BasicBlock::SSAData::SSAData):
+        (JSC::DFG::BasicBlock::SSAData::~SSAData):
+        * dfg/DFGBasicBlock.h:
+        (BasicBlock):
+        (JSC::DFG::BasicBlock::operator[]):
+        (JSC::DFG::BasicBlock::successor):
+        (JSC::DFG::BasicBlock::successorForCondition):
+        (SSAData):
+        * dfg/DFGBasicBlockInlines.h:
+        (DFG):
+        * dfg/DFGBlockInsertionSet.cpp: Added.
+        (DFG):
+        (JSC::DFG::BlockInsertionSet::BlockInsertionSet):
+        (JSC::DFG::BlockInsertionSet::~BlockInsertionSet):
+        (JSC::DFG::BlockInsertionSet::insert):
+        (JSC::DFG::BlockInsertionSet::insertBefore):
+        (JSC::DFG::BlockInsertionSet::execute):
+        * dfg/DFGBlockInsertionSet.h: Added.
+        (DFG):
+        (BlockInsertionSet):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::run):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+        * dfg/DFGCommon.cpp:
+        (WTF::printInternal):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::doesKill):
+        (DFG):
+        (JSC::DFG::killStatusForDoesKill):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp: Added.
+        (DFG):
+        (CriticalEdgeBreakingPhase):
+        (JSC::DFG::CriticalEdgeBreakingPhase::CriticalEdgeBreakingPhase):
+        (JSC::DFG::CriticalEdgeBreakingPhase::run):
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        (JSC::DFG::performCriticalEdgeBreaking):
+        * dfg/DFGCriticalEdgeBreakingPhase.h: Added.
+        (DFG):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        (JSC::DFG::DCEPhase::findTypeCheckRoot):
+        (JSC::DFG::DCEPhase::countNode):
+        (DCEPhase):
+        (JSC::DFG::DCEPhase::countEdge):
+        (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGEdge.cpp:
+        (JSC::DFG::Edge::dump):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::Edge):
+        (JSC::DFG::Edge::setNode):
+        (JSC::DFG::Edge::useKindUnchecked):
+        (JSC::DFG::Edge::setUseKind):
+        (JSC::DFG::Edge::setProofStatus):
+        (JSC::DFG::Edge::willNotHaveCheck):
+        (JSC::DFG::Edge::willHaveCheck):
+        (Edge):
+        (JSC::DFG::Edge::killStatusUnchecked):
+        (JSC::DFG::Edge::killStatus):
+        (JSC::DFG::Edge::setKillStatus):
+        (JSC::DFG::Edge::doesKill):
+        (JSC::DFG::Edge::doesNotKill):
+        (JSC::DFG::Edge::shift):
+        (JSC::DFG::Edge::makeWord):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGFlushFormat.cpp: Added.
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGFlushFormat.h: Added.
+        (DFG):
+        (JSC::DFG::resultFor):
+        (JSC::DFG::useKindFor):
+        (WTF):
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp: Added.
+        (DFG):
+        (FlushLivenessAnalysisPhase):
+        (JSC::DFG::FlushLivenessAnalysisPhase::FlushLivenessAnalysisPhase):
+        (JSC::DFG::FlushLivenessAnalysisPhase::run):
+        (JSC::DFG::FlushLivenessAnalysisPhase::process):
+        (JSC::DFG::FlushLivenessAnalysisPhase::setForNode):
+        (JSC::DFG::FlushLivenessAnalysisPhase::flushFormat):
+        (JSC::DFG::performFlushLivenessAnalysis):
+        * dfg/DFGFlushLivenessAnalysisPhase.h: Added.
+        (DFG):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (DFG):
+        (JSC::DFG::Graph::addForDepthFirstSort):
+        (JSC::DFG::Graph::getBlocksInDepthFirstOrder):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::convertToConstant):
+        (JSC::DFG::Graph::valueProfileFor):
+        (Graph):
+        * dfg/DFGInsertionSet.h:
+        (DFG):
+        (JSC::DFG::InsertionSet::execute):
+        * dfg/DFGLivenessAnalysisPhase.cpp: Added.
+        (DFG):
+        (LivenessAnalysisPhase):
+        (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
+        (JSC::DFG::LivenessAnalysisPhase::run):
+        (JSC::DFG::LivenessAnalysisPhase::process):
+        (JSC::DFG::LivenessAnalysisPhase::addChildUse):
+        (JSC::DFG::performLivenessAnalysis):
+        * dfg/DFGLivenessAnalysisPhase.h: Added.
+        (DFG):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::hasVariableAccessData):
+        (DFG):
+        * dfg/DFGNode.h:
+        (DFG):
+        (Node):
+        (JSC::DFG::Node::hasLocal):
+        (JSC::DFG::Node::variableAccessData):
+        (JSC::DFG::Node::hasPhi):
+        (JSC::DFG::Node::phi):
+        (JSC::DFG::Node::takenBlock):
+        (JSC::DFG::Node::notTakenBlock):
+        (JSC::DFG::Node::successor):
+        (JSC::DFG::Node::successorForCondition):
+        (JSC::DFG::nodeComparator):
+        (JSC::DFG::nodeListDump):
+        (JSC::DFG::nodeMapDump):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp: Added.
+        (DFG):
+        (OSRAvailabilityAnalysisPhase):
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::OSRAvailabilityAnalysisPhase):
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        (JSC::DFG::performOSRAvailabilityAnalysis):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.h: Added.
+        (DFG):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSSAConversionPhase.cpp: Added.
+        (DFG):
+        (SSAConversionPhase):
+        (JSC::DFG::SSAConversionPhase::SSAConversionPhase):
+        (JSC::DFG::SSAConversionPhase::run):
+        (JSC::DFG::SSAConversionPhase::forwardPhiChildren):
+        (JSC::DFG::SSAConversionPhase::forwardPhi):
+        (JSC::DFG::SSAConversionPhase::forwardPhiEdge):
+        (JSC::DFG::SSAConversionPhase::deduplicateChildren):
+        (JSC::DFG::SSAConversionPhase::addFlushedLocalOp):
+        (JSC::DFG::SSAConversionPhase::addFlushedLocalEdge):
+        (JSC::DFG::performSSAConversion):
+        * dfg/DFGSSAConversionPhase.h: Added.
+        (DFG):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (Validate):
+        (JSC::DFG::Validate::validateCPS):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::flushFormat):
+        (VariableAccessData):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::LowerDFGToLLVM::compileJSConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileWeakJSConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArgument):
+        (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileAdd):
+        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAbs):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compileBitAnd):
+        (JSC::FTL::LowerDFGToLLVM::compileBitOr):
+        (JSC::FTL::LowerDFGToLLVM::compileBitXor):
+        (JSC::FTL::LowerDFGToLLVM::compileBitRShift):
+        (JSC::FTL::LowerDFGToLLVM::compileBitLShift):
+        (JSC::FTL::LowerDFGToLLVM::compileBitURShift):
+        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
+        (JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble):
+        (JSC::FTL::LowerDFGToLLVM::compileGetButterfly):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileGetGlobalVar):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEqConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEqConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLess):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLessEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreater):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreaterEq):
+        (JSC::FTL::LowerDFGToLLVM::compileLogicalNot):
+        (JSC::FTL::LowerDFGToLLVM::speculateBackward):
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::lowStorage):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateBoolean):
+        (JSC::FTL::LowerDFGToLLVM::isLive):
+        (JSC::FTL::LowerDFGToLLVM::use):
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        (JSC::FTL::LowerDFGToLLVM::linkOSRExitsAndCompleteInitializationBlocks):
+        (JSC::FTL::LowerDFGToLLVM::setInt32):
+        (JSC::FTL::LowerDFGToLLVM::setJSValue):
+        (JSC::FTL::LowerDFGToLLVM::setBoolean):
+        (JSC::FTL::LowerDFGToLLVM::setStorage):
+        (JSC::FTL::LowerDFGToLLVM::setDouble):
+        (JSC::FTL::LowerDFGToLLVM::isValid):
+        * ftl/FTLLoweredNodeValue.h: Added.
+        (FTL):
+        (LoweredNodeValue):
+        (JSC::FTL::LoweredNodeValue::LoweredNodeValue):
+        (JSC::FTL::LoweredNodeValue::isSet):
+        (JSC::FTL::LoweredNodeValue::operator!):
+        (JSC::FTL::LoweredNodeValue::value):
+        (JSC::FTL::LoweredNodeValue::block):
+        * ftl/FTLValueFromBlock.h:
+        (JSC::FTL::ValueFromBlock::ValueFromBlock):
+        (ValueFromBlock):
+        * ftl/FTLValueSource.cpp:
+        (JSC::FTL::ValueSource::dump):
+        * ftl/FTLValueSource.h:
+
+2013-07-11  Mark Lam  <mark.lam@apple.com>
+
+        Resurrect the CLoop LLINT on the FTL branch.
+        https://bugs.webkit.org/show_bug.cgi?id=118144.
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::jitType):
+          - Fix the CodeBlock jitType to be InterpreterThunk when !ENABLE_JIT.
+        * bytecode/JumpTable.h:
+        (JSC::SimpleJumpTable::clear):
+        * interpreter/StackIterator.cpp:
+        (JSC::StackIterator::Frame::bytecodeOffset):
+        (JSC::StackIterator::Frame::print):
+        * jit/JITCode.cpp:
+        (JSC):
+        * jit/JITExceptions.cpp:
+        (JSC::getExceptionLocation):
+        * llint/LowLevelInterpreter.cpp:
+        * offlineasm/cloop.rb:
+        * runtime/Structure.cpp:
+
+2013-07-08  Filip Pizlo  <fpizlo@apple.com>
+
+        NaturalLoops + Profiler = Crash
+        https://bugs.webkit.org/show_bug.cgi?id=118486
+
+        Reviewed by Geoffrey Garen.
+        
+        I borked dominators in:
+        http://trac.webkit.org/changeset/152431/branches/dfgFourthTier/Source/JavaScriptCore/dfg/DFGDominators.h
+        
+        This patch also adds some debug support, and fixes the loop that adds a block to
+        an already-existing natural loop. Note that we currently don't take that path in
+        most programs, but it will arise, for example if you use 'continue' - though you'd
+        have to use it rather cleverly since the bytecode will not jump to the loop header
+        in most uses of 'continue'.
+
+        * dfg/DFGDominators.cpp:
+        (JSC::DFG::Dominators::dump):
+        (DFG):
+        * dfg/DFGDominators.h:
+        (JSC::DFG::Dominators::dominates):
+        (Dominators):
+        * dfg/DFGNaturalLoops.cpp:
+        (JSC::DFG::NaturalLoops::compute):
+
+2013-07-08  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG::AbstractState::beginBasicBlock() should set m_haveStructures if any of the valuesAtHead have either a current known structure or a non-top/non-bottom array modes
+        https://bugs.webkit.org/show_bug.cgi?id=118489
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/ArrayProfile.h:
+        (JSC::arrayModesAreClearOrTop):
+        (JSC):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::hasClobberableState):
+        (AbstractValue):
+
+2013-07-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CheckArray should call the right version of filterArrayModes
+        https://bugs.webkit.org/show_bug.cgi?id=118488
+
+        Reviewed by Filip Pizlo.
+
+        Currently in the CFA CheckArray doesn't call the right filterArrayMode which can cause 
+        the CFA to ignore when it sees a contradiction.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+
+2013-07-07  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Graph::clearAndDerefChild() makes no sense anymore, and neither does Nop
+        https://bugs.webkit.org/show_bug.cgi?id=118452
+
+        Reviewed by Sam Weinig.
+        
+        Noticed that ArgumentsSimplificationPhase was converting something to a Nop and then
+        resetting its children using clearAndDerefChild(). Using Nop instead of Phantom is a
+        holdover from back when we needed a no-MustGenerate no-op. We don't anymore. Using
+        clearAndDerefChild() was necessary back when we did eager reference counting. We
+        don't need to do that anymore, and in fact clearAndDerefChild() appeared to not do
+        any reference counting, so it was badly named to begin with.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-07-04  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should better report its compile-times and it should be able to run in a mode where it doesn't spend time generating OSR exits
+        https://bugs.webkit.org/show_bug.cgi?id=118401
+
+        Reviewed by Sam Weinig.
+        
+        Add two new OSR exit modes, which are useful only for playing with compile times:
+        
+        - All OSR exits are llvm.trap().
+        
+        - OSR exits don't take arguments and have no exit value marshaling.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+        (Plan):
+        * ftl/FTLIntrinsicRepository.h:
+        (FTL):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::trap):
+        * runtime/Options.h:
+        (JSC):
+
+2013-07-04  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should refer to BasicBlocks by BasicBlock* and not BlockIndex
+        https://bugs.webkit.org/show_bug.cgi?id=118339
+
+        Reviewed by Michael Saboff.
+        
+        This accomplishes two goals:
+
+        1) Simplifies a bunch of code. You can now much more directly get to a successor
+           or predecessor, since you just get the pointer directly. The backend(s) always
+           hold onto a pointer to the block they're on, so you don't have to do work to
+           get the block from the index.
+        
+        2) It allows for the possibility of inserting blocks into the program.
+           Previously, if you did that, you'd have to edit all references to blocks since
+           those references would have outdated indexing after an insertion. Now, if you
+           change the indexing, you just have to invalidate some analyses and make sure
+           that you change each block's BasicBlock::index accordingly.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::endBasicBlock):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::run):
+        * dfg/DFGBasicBlock.h:
+        (DFG):
+        (JSC::DFG::BasicBlock::BasicBlock):
+        (JSC::DFG::BasicBlock::size):
+        (JSC::DFG::BasicBlock::isEmpty):
+        (JSC::DFG::BasicBlock::at):
+        (JSC::DFG::BasicBlock::operator[]):
+        (JSC::DFG::BasicBlock::last):
+        (JSC::DFG::BasicBlock::resize):
+        (JSC::DFG::BasicBlock::grow):
+        (BasicBlock):
+        (JSC::DFG::BasicBlock::append):
+        (JSC::DFG::BasicBlock::numSuccessors):
+        (JSC::DFG::BasicBlock::successor):
+        (JSC::DFG::BasicBlock::successorForCondition):
+        (JSC::DFG::BasicBlock::dump):
+        (UnlinkedBlock):
+        (JSC::DFG::UnlinkedBlock::UnlinkedBlock):
+        (JSC::DFG::getBytecodeBeginForBlock):
+        (JSC::DFG::blockForBytecodeOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::linkBlocks):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        (JSC::DFG::CFAPhase::performForwardCFA):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::convertToJump):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlocks):
+        (JSC::DFG::CPSRethreadingPhase::propagatePhis):
+        (CPSRethreadingPhase):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::run):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::Disassembler):
+        (JSC::DFG::Disassembler::createDumpList):
+        * dfg/DFGDisassembler.h:
+        (JSC::DFG::Disassembler::setForBlockIndex):
+        * dfg/DFGDominators.cpp:
+        (JSC::DFG::Dominators::compute):
+        (JSC::DFG::Dominators::iterateForBlock):
+        * dfg/DFGDominators.h:
+        (JSC::DFG::Dominators::dominates):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::handleSuccessor):
+        (JSC::DFG::Graph::determineReachability):
+        (JSC::DFG::Graph::resetReachability):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::numBlocks):
+        (JSC::DFG::Graph::block):
+        (JSC::DFG::Graph::lastBlock):
+        (Graph):
+        (JSC::DFG::Graph::appendBlock):
+        (JSC::DFG::Graph::killBlock):
+        (DFG):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::setForBlockIndex):
+        * dfg/DFGNaturalLoops.cpp:
+        (JSC::DFG::NaturalLoop::dump):
+        (JSC::DFG::NaturalLoops::compute):
+        (JSC::DFG::NaturalLoops::loopsOf):
+        * dfg/DFGNaturalLoops.h:
+        (JSC::DFG::NaturalLoop::NaturalLoop):
+        (JSC::DFG::NaturalLoop::addBlock):
+        (JSC::DFG::NaturalLoop::header):
+        (JSC::DFG::NaturalLoop::at):
+        (JSC::DFG::NaturalLoop::operator[]):
+        (JSC::DFG::NaturalLoop::contains):
+        (NaturalLoop):
+        (JSC::DFG::NaturalLoops::headerOf):
+        (NaturalLoops):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::SwitchCase::SwitchCase):
+        (JSC::DFG::SwitchCase::withBytecodeIndex):
+        (SwitchCase):
+        (JSC::DFG::SwitchCase::targetBytecodeIndex):
+        (JSC::DFG::SwitchData::SwitchData):
+        (JSC::DFG::SwitchData::setFallThroughBytecodeIndex):
+        (JSC::DFG::SwitchData::fallThroughBytecodeIndex):
+        (SwitchData):
+        (JSC::DFG::Node::setTakenBlock):
+        (JSC::DFG::Node::setNotTakenBlock):
+        (JSC::DFG::Node::takenBlock):
+        (JSC::DFG::Node::notTakenBlock):
+        (JSC::DFG::Node::successor):
+        (JSC::DFG::Node::successorForCondition):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagateForward):
+        (JSC::DFG::PredictionPropagationPhase::propagateBackward):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::createOSREntries):
+        (JSC::DFG::SpeculativeJIT::linkOSREntries):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+        (JSC::DFG::SpeculativeJIT::addBranch):
+        (JSC::DFG::SpeculativeJIT::linkBranches):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::nextBlock):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::branchDouble):
+        (JSC::DFG::SpeculativeJIT::branchDoubleNonZero):
+        (JSC::DFG::SpeculativeJIT::branch32):
+        (JSC::DFG::SpeculativeJIT::branchTest32):
+        (JSC::DFG::SpeculativeJIT::branch64):
+        (JSC::DFG::SpeculativeJIT::branch8):
+        (JSC::DFG::SpeculativeJIT::branchPtr):
+        (JSC::DFG::SpeculativeJIT::branchTestPtr):
+        (JSC::DFG::SpeculativeJIT::branchTest8):
+        (JSC::DFG::SpeculativeJIT::jump):
+        (JSC::DFG::SpeculativeJIT::addBranch):
+        (JSC::DFG::SpeculativeJIT::StringSwitchCase::StringSwitchCase):
+        (StringSwitchCase):
+        (JSC::DFG::SpeculativeJIT::BranchRecord::BranchRecord):
+        (BranchRecord):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::disableHoistingAcrossOSREntries):
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::checkOperand):
+        (JSC::DFG::Validate::reportValidationContext):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileJump):
+        (JSC::FTL::LowerDFGToLLVM::compileBranch):
+        (JSC::FTL::LowerDFGToLLVM::lowBlock):
+
+2013-07-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add a helpful comment for why DCE is needed in the FTL.
+
+        I believe I've now twice down the experiment of disabling DCE in the FTL,
+        only to realize that this can't work, and that DCE is needed. I'd kind of
+        like to not make that mistake again.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2013-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG::Node::m_opInfo2 should also be a uintptr_t
+        https://bugs.webkit.org/show_bug.cgi?id=118340
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+
+2013-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix 32-bit build.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::comparePtr):
+        (MacroAssembler):
+        * dfg/DFGBinarySwitch.cpp:
+        (JSC::DFG::BinarySwitch::advance):
+        * dfg/DFGBinarySwitch.h:
+        (JSC::DFG::BinarySwitch::caseValue):
+
+2013-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Have fewer Arrayify's
+        https://bugs.webkit.org/show_bug.cgi?id=118335
+
+        Reviewed by Mark Hahnenberg.
+        
+        A lot of Arrayify's arise because some program saw Int32 arrays early on in
+        execution, but then they all got converted to Double arrays and the program
+        will never see Int32 arrays ever again. Prior to this change you would always
+        have an Arrayify in this case. But with this change, the first time that an
+        ArrayProfile is about to go polymorphic in computeUpdatedPrediction(), it
+        instead forcibly monomorphises itself to the latest-seen structure.
+        Thereafter it will never again perform this monomorphisation. This is
+        controlled by ArrayProfile::m_didPerformFirstRunPruning. This is a 5%
+        speed-up on Kraken/imaging-gaussian-blur with the FTL enabled, and it
+        unblocks a bunch of stuff we want to do in the future because it makes a
+        bunch of loops effect-free.
+        
+        We will still want to implement Arrayify hoisting in the future, but this is
+        great anyway because it's better to not have Arrayifications than it is to
+        have hoisted Arrayifications.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        (JSC::ArrayProfile::briefDescription):
+        (JSC):
+        (JSC::ArrayProfile::briefDescriptionWithoutUpdating):
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::ArrayProfile):
+        (ArrayProfile):
+
+2013-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: add option to disable OSR entry in loops
+        https://bugs.webkit.org/show_bug.cgi?id=118329
+
+        Reviewed by Mark Hahnenberg.
+        
+        This adds that option, and also makes the OSR exit reoptimization trigger rely less on
+        OSR entry failing. Now even if we never attempt OSR entry but our execution counter gets
+        high after a small number of OSR exits, we will recompile.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_hint):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * runtime/Options.h:
+        (JSC):
+
+2013-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: since the FTL disassembly hacks cannot distinguish between code and data, the LLVM disassembler symbol table callback should be able to deal gracefully with arbitrary garbage
+        https://bugs.webkit.org/show_bug.cgi?id=118313
+
+        Reviewed by Mark Hahnenberg.
+        
+        Give it a mode where we can still crash on unrecognized reference types, so that we might
+        implement them in the future, but by default just print some stuff and keep going.
+
+        * disassembler/LLVMDisassembler.cpp:
+        (JSC):
+        (JSC::symbolLookupCallback):
+
+2013-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should use the equivalent of llvm opt -O2 by default
+        https://bugs.webkit.org/show_bug.cgi?id=118311
+
+        Reviewed by Mark Hahnenberg.
+        
+        Use a PassManagerBuilder instead of rolling our own.
+        
+        This boosts our speed-up by another 5% or so.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * runtime/Options.h:
+        (JSC):
+
+2013-07-01  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should run LICM after AA setup
+        https://bugs.webkit.org/show_bug.cgi?id=118277
+
+        Reviewed by Maciej Stachowiak.
+        
+        LICM queries alias analysis. Hence, just like GVN, it should run after
+        we have set up the alias analysis.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+
+2013-07-01  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should run AA passes before GVN
+        https://bugs.webkit.org/show_bug.cgi?id=118276
+
+        Rubber stamped by Geoffrey Garen.
+        
+        These enable load elimination in GVN.
+        
+        Immediately gives us a speed-up on a bunch of benchmarks I hacked to run
+        properly in the FTL. One example is 20% on imaging-gaussian-blur. (Fair
+        warning: the stock version of that benchmark won't see speed-ups -
+        probably slow-downs instead - because the FTL can't do OSR entry yet.)
+        Another example is the findGraphNode function, which now sees a 7%
+        speed-up, and that's without even doing LICM or other good things.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+
+2013-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Make Graph::substituteGetLocal() out-of-line
+
+        Rubber stamped by Geoffrey Garen.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::substituteGetLocal):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (Graph):
+
+2013-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should know how to find natural loops
+        https://bugs.webkit.org/show_bug.cgi?id=118152
+
+        Reviewed by Mark Hahnenberg.
+        
+        There are a bunch of things we can do when we know where the loops are.
+        Previously we didn't. With this patch, we do.
+        
+        This patch adds the classic dominator based natural loop finder.
+        
+        The only client of this right now is the DFG::Disassembler. It prints out
+        a summary of the analysis for each block.
+        
+        This will become more important when I do
+        https://bugs.webkit.org/show_bug.cgi?id=118151, which definitely requires
+        this kind of analysis, at least if we want to do the optimization over
+        DFG IR (and I'm pretty sure we do).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAnalysis.h: Added.
+        (DFG):
+        (Analysis):
+        (JSC::DFG::Analysis::Analysis):
+        (JSC::DFG::Analysis::invalidate):
+        (JSC::DFG::Analysis::computeIfNecessary):
+        (JSC::DFG::Analysis::isValid):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::createDumpList):
+        * dfg/DFGDominators.cpp:
+        (JSC::DFG::Dominators::Dominators):
+        (JSC::DFG::Dominators::compute):
+        * dfg/DFGDominators.h:
+        (Dominators):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::invalidateCFG):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGNaturalLoops.cpp: Added.
+        (DFG):
+        (JSC::DFG::NaturalLoop::dump):
+        (JSC::DFG::NaturalLoops::NaturalLoops):
+        (JSC::DFG::NaturalLoops::~NaturalLoops):
+        (JSC::DFG::NaturalLoops::compute):
+        (JSC::DFG::NaturalLoops::loopsOf):
+        (JSC::DFG::NaturalLoops::dump):
+        * dfg/DFGNaturalLoops.h: Added.
+        (DFG):
+        (NaturalLoop):
+        (JSC::DFG::NaturalLoop::NaturalLoop):
+        (JSC::DFG::NaturalLoop::addBlock):
+        (JSC::DFG::NaturalLoop::header):
+        (JSC::DFG::NaturalLoop::size):
+        (JSC::DFG::NaturalLoop::at):
+        (JSC::DFG::NaturalLoop::operator[]):
+        (JSC::DFG::NaturalLoop::contains):
+        (NaturalLoops):
+        (JSC::DFG::NaturalLoops::numLoops):
+        (JSC::DFG::NaturalLoops::loop):
+        (JSC::DFG::NaturalLoops::headerOf):
+
+2013-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: JSC's disassembly infrastructure should be able to disassemble the code that LLVM generates
+        https://bugs.webkit.org/show_bug.cgi?id=118148
+
+        Reviewed by Anders Carlsson.
+        
+        Oh boy. UDis86 cannot disassemble the AVX (or whatever it's called) stuff
+        that LLVM generates for floating point. So the right decision is to
+        switch to the LLVM disassembler, right? Wrong!! LLVM's disassembler
+        cannot disassemble the load-from-absolute-address-into-%rax instructions
+        that our JIT generates quite a lot of.
+        
+        So, this keeps the UDis86 disassembler, but adds the LLVM disassembler,
+        and requires the caller of disassemble() to hint which one is likely to
+        be less wrong for the given code.
+        
+        Maybe in the future LLVM will catch up to UDis86, but it's definitely not
+        there right now.
+        
+        This now allows us to disassemble all of the code that LLVM generates.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * disassembler/Disassembler.cpp:
+        (JSC::disassemble):
+        * disassembler/Disassembler.h:
+        (JSC::tryToDisassemble):
+        (JSC):
+        * disassembler/LLVMDisassembler.cpp: Added.
+        (JSC):
+        (JSC::symbolLookupCallback):
+        (JSC::tryToDisassembleWithLLVM):
+        * disassembler/LLVMDisassembler.h: Added.
+        (JSC):
+        (JSC::tryToDisassembleWithLLVM):
+        * disassembler/UDis86Disassembler.cpp:
+        (JSC::tryToDisassembleWithUDis86):
+        * disassembler/UDis86Disassembler.h: Added.
+        (JSC):
+        (JSC::tryToDisassembleWithUDis86):
+        * disassembler/X86Disassembler.cpp: Added.
+        (JSC):
+        (JSC::tryToDisassemble):
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.h:
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLLVMHeaders.h: Removed.
+        * ftl/FTLLink.cpp:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/Options.h:
+        (JSC):
+
+2013-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should be able to dump disassembly
+        https://bugs.webkit.org/show_bug.cgi?id=118141
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+
+2013-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build for LLVM ToT.
+
+        This doesn't affect those using the binary drops, but if you're building from
+        LLVM ToT you'll get link errors. These arise because we expect there to be a
+        libLLVMArchive, but that is no longer built by LLVM ToT. This casues the linker
+        to fall back on the system's libLLVMArchive, which is incompatible with the
+        other LLVM libs we pull in.
+        
+        Also, we didn't need that library anyway and shouldn't have been linking
+        against it.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2013-06-26  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support hole/OOB PutByVal's
+        https://bugs.webkit.org/show_bug.cgi?id=118112
+
+        Reviewed by Geoffrey Garen.
+        
+        Added a common code generator for the out-of-bounds case that is reused by
+        all contiguous-like arrays (Int32, Double, Contiguous).
+        
+        This is relatively straight-forward, except that it's the first time that
+        the FTL has to call DFG operations that take more than two arguments.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::functionType):
+        (JSC::FTL::buildCall):
+        * ftl/FTLAbstractHeapRepository.h:
+        (FTL):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        (FTL):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::contiguousPutByValOutOfBounds):
+        (JSC::FTL::LowerDFGToLLVM::vmCall):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::call):
+
+2013-06-26  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL::canCompile(Graph&) should not consider nodes that won't be compiled
+        https://bugs.webkit.org/show_bug.cgi?id=118097
+
+        Reviewed by Mark Hahnenberg.
+        
+        This increases coverage to include programs that have unprofiled paths. Those paths will
+        often have nodes that appear to do untyped speculations, and the FTL sometimes doesn't
+        support those; except that it doesn't matter since the reason why they were untyped is
+        that they were unprofiled and anyway we won't run them because we'll exit before them.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+
+2013-06-26  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support ArrayifyToStructure
+        https://bugs.webkit.org/show_bug.cgi?id=118095
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        (FTL):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+        (LowerDFGToLLVM):
+
+2013-06-26  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support ForwardCheckStructure/ForwardStructureTransitionWatchpoint and doing so shouldn't break V8/crypto
+        https://bugs.webkit.org/show_bug.cgi?id=118091
+
+        Reviewed by Mark Hahnenberg.
+        
+        I was going to just add ForwardCheckStructure/ForwardStructureTransitionWatchpoint support,
+        which is trivial. But doing so increases coverage a lot, and revealed long-standing bugs in
+        the FTL. I then fixed those bugs, also:
+        
+        - The FTL should not attempt to compile a block that is not reachable according to the CFA.
+          This is analogous to terminating basic block compilation if the CFA becomes !isValid().
+          Attempting to compile such a block means that you're running on broken CFA state, and the
+          CFA will become inconsistent with the code you're generating, leading to some
+          strangeness. For example, the FTL relies on the CFA to tell it that we gave up compiling
+          a node and hence don't have LValue's for that node (by virtue of us giving up due to
+          !isValid()). But the CFA's isValid() bit will not be set correctly for blocks that
+          weren't visited by the CFA at all, and the CFA expects you to know this because it
+          expects that you already checked BasicBlock::cfaHasVisited.
+        
+        - SetLocal needs to change the ValueSource of the operand to indicate that its value has
+          been stashed in the local (i.e. the "reference" corresponding to the operand in FTL
+          speak). This is because although OSR exit already knows that the value of the operand is
+          stored in the Node, and it already knows what LValue corresponds to the node, OSR exit
+          will also assume that if the Node dies then the value-at-exit for that operand should be
+          Dead (i.e. jsUndefined). But the Node dying, and the local dying, are two distinct
+          things; in particular the local always outlives the Node in the case of a SetLocal. So,
+          we just need to have SetLocal have the ValueSource be BlahInLocal rather than HaveNode,
+          to ensure that OSR exit knows that the darn thing is really live until the end of the
+          basic block, as opposed to until whenever the Node dies (which could be at any time).
+        
+        - PutByOffset was erroneously storing to an offset from the base object, rather than an
+          offset from the storage. Note that the storage will be the base object (exactly - i.e.
+          same node, same value) for inline stores, but will be a distinct thing for out-of-line
+          stores.
+        
+        - At-head set-up of OSR exit state was using ValueInLocals for variables forced double,
+          when it should have been using DoubleInLocals.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByOffset):
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+
+2013-06-26  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support PutByVal
+        https://bugs.webkit.org/show_bug.cgi?id=118075
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+
+2013-06-25  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Convert versus AsIs should have no bearing on whether we can do the SaneChain optimization for double array GetByVals
+        https://bugs.webkit.org/show_bug.cgi?id=118028
+
+        Reviewed by Sam Weinig.
+        
+        The SaneChain optimization allows us to get rid of the NaN check on loading from
+        a double array, if the result is used in an arithmetic op that wouldn't
+        distinguish between NaN and undefined. Normally the NaN check would be needed
+        because NaN is the hole marker.
+        
+        The SaneChain optimization definitely requires that you're an Original array,
+        since we need to watchpoint the array prototype chain. And so it also needs to
+        be a JSArray, and not an object that has indexed double properties. We also
+        require an in-bounds access, since the backend is only capable of the
+        optimization in the in-bounds case (though we could extend it to OOB in the
+        future). But whether the array is being converted or is as-is isn't relevant.
+        Either way, if it's a double original array in-bounds access by the time that
+        the array check (or conversion!) completes, we can do the optimization.
+        
+        Ever-so-slight speed-up on Kraken/imaging-gaussian-blur.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2013-06-25  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should support switch_string
+        https://bugs.webkit.org/show_bug.cgi?id=117967
+
+        Reviewed by Sam Weinig.
+        
+        Add a reusable binary switch creator.
+        
+        Implement switch on string using three modes:
+        
+        - Binary switch on StringImpl* in the case of identifiers.
+        
+        - Trie of binary switches on characters in the case of a not-too-big
+          switch over not-too-big 8-bit strings.
+        
+        - Hash lookup if all else fails.
+        
+        Anywhere from a 2x to 3x speed-up on microbenchmarks that stress
+        string switches. 25-35% speed-up on HashMap tests. 4% speed-up on
+        pdfjs.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/JumpTable.h:
+        (StringJumpTable):
+        (JSC::StringJumpTable::clear):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGBinarySwitch.cpp: Added.
+        (DFG):
+        (JSC::DFG::BinarySwitch::BinarySwitch):
+        (JSC::DFG::BinarySwitch::advance):
+        (JSC::DFG::BinarySwitch::build):
+        * dfg/DFGBinarySwitch.h: Added.
+        (DFG):
+        (BinarySwitch):
+        (JSC::DFG::BinarySwitch::caseIndex):
+        (JSC::DFG::BinarySwitch::caseValue):
+        (JSC::DFG::BinarySwitch::fallThrough):
+        (JSC::DFG::BinarySwitch::Case::Case):
+        (Case):
+        (JSC::DFG::BinarySwitch::Case::operator<):
+        (JSC::DFG::BinarySwitch::BranchCode::BranchCode):
+        (BranchCode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::getValue):
+        (JSC::DFG::equalToStringImpl):
+        (DFG):
+        (JSC::DFG::LazyJSValue::strictEqual):
+        (JSC::DFG::LazyJSValue::dump):
+        * dfg/DFGLazyJSValue.h:
+        (JSC::DFG::LazyJSValue::knownStringImpl):
+        (LazyJSValue):
+        (JSC::DFG::LazyJSValue::stringImpl):
+        (JSC::DFG::LazyJSValue::switchLookupValue):
+        * dfg/DFGNode.cpp:
+        (WTF::printInternal):
+        * dfg/DFGNode.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+        (JSC::DFG::SpeculativeJIT::StringSwitchCase::operator<):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::emitBinarySwitchStringRecurse):
+        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
+        (JSC::DFG::SpeculativeJIT::emitSwitchString):
+        (JSC::DFG::SpeculativeJIT::emitSwitch):
+        (JSC::DFG::SpeculativeJIT::addBranch):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::branch8):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::StringSwitchCase::StringSwitchCase):
+        (StringSwitchCase):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        * runtime/Options.h:
+        (JSC):
+
+2013-06-24  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Count external memory usage towards heap footprint
+        https://bugs.webkit.org/show_bug.cgi?id=117948
+
+        Reviewed by Geoffrey Garen.
+
+        Currently just count strings. Strings get counted in such a way that we won't re-count strings
+        that are aliased, by dividing by the reference count. This then ups the GC footprint and allows
+        the collector to appropriately amortize itself.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::size):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (Heap):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExtraMemoryUsage):
+        (JSC):
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren):
+
+2013-06-23  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should optimize identifier string equality
+        https://bugs.webkit.org/show_bug.cgi?id=117920
+
+        Reviewed by Sam Weinig.
+        
+        This is a 20% speed-up for string equality comparisons when both strings are
+        identifiers.
+        
+        This is important for two reasons:
+        
+        1) Using strings as enumerations is an idiom. A great example is typeof. It
+           would be great if this performed better.
+        
+        2) When I implement switch_string in the DFG, it would be great to optimize
+           the case where the switched-on value is an identifier. That would involve
+           a simple binary switch rather than a more complicated trie-switch over
+           characters.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromCell):
+        * bytecode/SpeculatedType.h:
+        (JSC):
+        (JSC::isStringIdentSpeculation):
+        (JSC::isStringSpeculation):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateStringIdent):
+        (Node):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileStringEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringIdentEquality):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
+        (JSC::DFG::SpeculativeJIT::speculateStringIdent):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+
+2013-06-22  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG shouldn't exit just because a String GetByVal went out-of-bounds
+        https://bugs.webkit.org/show_bug.cgi?id=117906
+
+        Reviewed by Mark Hahnenberg.
+        
+        This does the obvious thing, but also makes sure that out-of-bounds accesses
+        don't fall off into a C call, but try to do the fast thing if the prototype
+        chain is sane. We ought to probably do this for other array accesses in the
+        future, as well, since it's so darn easy.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::objectPrototypeIsSane):
+        (JSC):
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+
+2013-06-22  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: GC's put_by_id transition fixpoint should converge more quickly
+        https://bugs.webkit.org/show_bug.cgi?id=117912
+
+        Reviewed by Mark Hahnenberg.
+
+        This was a rookie mistake. The GC does a classic forward data flow fixpoint. These work well so long as you
+        iterate the program in program order, or at least something close to program order. Because I enjoy reverse
+        loops ("while (n--) blah"), I ended up iterating in *reverse* of program order which ensured worst-case
+        pathologies every single time. And unsurprisingly, this slowed down a program, namely pdfjs.
+
+        Flipping the loops to iterate forward fixes a 90% regression in Octane/pdfjs and is otherwise neutral.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::propagateTransitions):
+
+2013-06-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should CSE MakeRope
+        https://bugs.webkit.org/show_bug.cgi?id=117905
+
+        Reviewed by Geoffrey Garen.
+        
+        Adds MakeRope to the CSE phase and removes the comment that says that
+        we could do it but aren't doing it.
+        
+        Also fixed SpeculatedType dumping so that if you have a Cell type then
+        it just prints "Cell" and if you just have Object then it just prints
+        "Object", instead of printing the long list of types.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+
+2013-06-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should't exit just because it GetByVal'd a big character
+        https://bugs.webkit.org/show_bug.cgi?id=117899
+
+        Reviewed by Mark Hahnenberg.
+        
+        Add a slow path. Also clarify handling of GetByVal in PutStructure elimination.
+        Previously it would fail due to canExit() but now we can also fail because
+        GetByVal(String) can allocate. Just make it so GetByVal is totally poisoned, in
+        a very explicit way.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+
+2013-06-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Small strings shouldn't get GC'd
+        https://bugs.webkit.org/show_bug.cgi?id=117897
+
+        Reviewed by Mark Hahnenberg.
+        
+        Kill off the code needed to allocate them lazily and finalize them.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsSubstring8):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerValueToString):
+        * runtime/SmallStrings.cpp:
+        (JSC):
+        (JSC::SmallStrings::initializeCommonStrings):
+        (JSC::SmallStrings::visitStrongReferences):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::singleCharacterString):
+        (SmallStrings):
+
+2013-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Structure should have a dump()
+        https://bugs.webkit.org/show_bug.cgi?id=117859
+
+        Reviewed by Geoffrey Garen.
+        
+        This is pretty cool. Anywhere we previously printed Structure pointers in dumps,
+        we now print a bunch of other info as well. For example, for an object literal
+        like "{f:42, g:64, h:24}", when we print the structure we'll now get:
+
+            0x107a0af80:[Object, {f:0, g:1, h:2}, NonArray, Proto:0x107a8fff0]
+        
+        This also changes a bunch of places to use the dump method.
+
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::dump):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dump):
+        * runtime/Structure.cpp:
+        (JSC::Structure::dump):
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+
+2013-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: There should only be one table of SimpleJumpTables
+        https://bugs.webkit.org/show_bug.cgi?id=117856
+
+        Reviewed by Geoffrey Garen.
+        
+        Having multiple tables of SimpleJumpTables just means we have to duplicate a
+        ton of code. This patch deduplicates all of it.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfSwitchJumpTables):
+        (JSC::CodeBlock::addSwitchJumpTable):
+        (JSC::CodeBlock::switchJumpTable):
+        (JSC::CodeBlock::clearSwitchJumpTables):
+        (RareData):
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC):
+        (JSC::computePreciseJumpTargets):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::shrinkToFit):
+        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables):
+        (JSC::UnlinkedCodeBlock::addSwitchJumpTable):
+        (JSC::UnlinkedCodeBlock::switchJumpTable):
+        (RareData):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC):
+        (JSC::prepareJumpTableForSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        * dfg/DFGByteCodeParser.cpp:
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
+        (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should clear character switch jump tables
+        https://bugs.webkit.org/show_bug.cgi?id=117852
+
+        Reviewed by Sam Weinig.
+        
+        The FTL just uses LLVM's switch, which results in LLVM allocating its own switch
+        jump tables as needed.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearCharacterSwitchJumpTables):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+
+2013-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support SwitchChar
+        https://bugs.webkit.org/show_bug.cgi?id=117849
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds Switch(SwitchChar) to the FTL and also implicitly does some other things.
+        SwitchChar requires calling a slow path to resolve ropes. Previously the FTL had no
+        support for calling slow paths, and we avoided adding coverage that would require
+        that. Well, this patch adds the ability to call slow paths and just uses that for
+        resolving ropes for SwitchChar. Also SwitchChar required adding awareness of strings,
+        so I did that, too.
+
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::addCodeOrigin):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.cpp:
+        (WTF):
+        (WTF::printInternal):
+        * dfg/DFGNode.h:
+        (WTF):
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::int16Type):
+        (JSC::FTL::constInt):
+        * ftl/FTLAbstractHeapRepository.h:
+        (FTL):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        (CommonValues):
+        * ftl/FTLIntrinsicRepository.cpp:
+        (JSC::FTL::IntrinsicRepository::IntrinsicRepository):
+        (FTL):
+        * ftl/FTLIntrinsicRepository.h:
+        (FTL):
+        (IntrinsicRepository):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::transferAndCheckArguments):
+        (JSC::FTL::LowerDFGToLLVM::compileJump):
+        (JSC::FTL::LowerDFGToLLVM::compileBranch):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::buildSwitch):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lowString):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::isObject):
+        (JSC::FTL::LowerDFGToLLVM::isNotString):
+        (JSC::FTL::LowerDFGToLLVM::isString):
+        (JSC::FTL::LowerDFGToLLVM::isNotObject):
+        (JSC::FTL::LowerDFGToLLVM::speculateObject):
+        (JSC::FTL::LowerDFGToLLVM::speculateString):
+        (JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
+        (JSC::FTL::LowerDFGToLLVM::vmCall):
+        (JSC::FTL::LowerDFGToLLVM::callPreflight):
+        (JSC::FTL::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::LowerDFGToLLVM::lowBlock):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::constInt8):
+        (JSC::FTL::Output::constInt32):
+        (JSC::FTL::Output::constIntPtr):
+        (JSC::FTL::Output::constInt64):
+        (JSC::FTL::Output::load16):
+        (JSC::FTL::Output::isNull):
+        (JSC::FTL::Output::notNull):
+        (JSC::FTL::Output::testIsZero32):
+        (JSC::FTL::Output::testNonZero32):
+        (Output):
+        (JSC::FTL::Output::operation):
+        (JSC::FTL::Output::crash):
+
+2013-06-18  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should have switch_char
+        https://bugs.webkit.org/show_bug.cgi?id=117710
+
+        Reviewed by Michael Saboff.
+        
+        Add op_switch_char. Most of this is fairly simple, except for the whole
+        LazyJSValue thing.
+        
+        It's long been the case that anytime you wanted the DFG to speak of a string
+        that didn't appear in the constant pool, you would have a hard time since
+        the DFG isn't allowed to allocate in the GC heap. For example, if you know
+        that you want to speak of a single character string, you might find that
+        the one you wanted to speak of had been GC'd. Another example is if you
+        wanted to add constant folding for string concatenation - something we don't
+        have yet but will want eventually.
+        
+        I solve this by finally adding the notion of LazyJSValue. In the future I
+        anticipate using this for a variety of string-related things. The idea here
+        is that the DFG can either say that it already knows what the value is, or
+        it can describe the value. For example, in this patch I needed to be able to
+        describe single-character strings.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/JumpTable.h:
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::JSValueRegs::payloadGPR):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::jumpTable):
+        (DFG):
+        (JSC::DFG::JITCompiler::numberOfJumpTables):
+        (JSC::DFG::JITCompiler::linkSwitches):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * dfg/DFGLazyJSValue.cpp: Added.
+        (DFG):
+        (JSC::DFG::LazyJSValue::getValue):
+        (JSC::DFG::equalToSingleCharacter):
+        (JSC::DFG::LazyJSValue::strictEqual):
+        (JSC::DFG::LazyJSValue::dump):
+        * dfg/DFGLazyJSValue.h: Added.
+        (DFG):
+        (LazyJSValue):
+        (JSC::DFG::LazyJSValue::LazyJSValue):
+        (JSC::DFG::LazyJSValue::singleCharacterString):
+        (JSC::DFG::LazyJSValue::tryGetValue):
+        (JSC::DFG::LazyJSValue::value):
+        (JSC::DFG::LazyJSValue::character):
+        (JSC::DFG::LazyJSValue::switchLookupValue):
+        * dfg/DFGNode.h:
+        (JSC::DFG::SwitchCase::SwitchCase):
+        (SwitchCase):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
+        (JSC::DFG::SpeculativeJIT::emitSwitchImmIntJump):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
+        (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump):
+        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+        (JSC::DFG::SpeculativeJIT::emitSwitch):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+
+2013-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor ObjCCallbackFunction to inherit directly from InternalFunction
+        https://bugs.webkit.org/show_bug.cgi?id=117595
+
+        Reviewed by Geoffrey Garen.
+
+        * API/APICallbackFunction.h: Added. New struct that allows JSCallbackFunction and 
+        ObjCCallbackFunction to share their host call() implementation through the magic of 
+        templates.
+        (JSC::APICallbackFunction::call):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::getCallData): Changed to get the template-ized version of 
+        the host function.
+        * API/JSCallbackFunction.h:
+        * API/ObjCCallbackFunction.h: Now inherits directly from InternalFunction.
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunction::ObjCCallbackFunction):
+        (JSC::ObjCCallbackFunction::getCallData): Ditto.
+        * GNUmakefile.list.am: Build files!
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-06-19  Michael Saboff  <msaboff@apple.com>
+
+        fourthTier: Arity fixup should be done while on same stack
+        https://bugs.webkit.org/show_bug.cgi?id=117102
+
+        Reviewed by Oliver Hunt.
+
+        Removed the fixup part of op_call_arityCheck() and op_construct_arityCheck() and moved it to
+        a thunk for the JITs and as assembly for the llint.  This patch provides the plumbing needed to
+        move to the C stack for JS execution.  The fixup thunk and llint code would need to be change to
+        work with a stack that grows down when we do move to the C stack.
+        
+        Due to an issue with the offline assembler, I moved the const at the top of LowLevelInterpreter64.asm
+        and LowLevelInterpreter32_64.asm to LowLevelInterpreter.asm.  The problem is that a const defined in
+        one file that are used in a macro doesn't resolve the const if the macro is used in another file.  This
+        seemed like the quickest path.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::linkFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::arityFixup):
+        * jit/ThunkGenerators.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+
+2013-06-19  Michael Saboff  <msaboff@apple.com>
+
+        FTL: arm build is broken in ToT
+        https://bugs.webkit.org/show_bug.cgi?id=117800
+
+        Unreviewed build fixes.
+
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler): Merge of r147941
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod): Moved variable declaration back inside #ifdef where used.
+
+2013-06-17  Michael Saboff  <msaboff@apple.com>
+
+        FTL: Add another temp register regT4 to JSInterfaceJIT
+        https://bugs.webkit.org/show_bug.cgi?id=117719
+
+        Reviewed by Geoffrey Garen.
+
+        Made the dedicated bucketCounterRegister to be regT4 and then used regT4 wherever
+        bucketCounterRegister had been used.  Since it is masked whenever it is used and
+        we are looking for some randomness in the register anyway, we can use it without
+        any issues.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emitPutCallResult):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitPutCallResult):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitValueProfilingSite):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_this):
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_callee):
+        (JSC::JIT::emit_op_to_this):
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::callWithValueProfiling):
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+
+2013-06-17  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support Switch
+        https://bugs.webkit.org/show_bug.cgi?id=117704
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearImmediateSwitchJumpTables):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildFPToSI):
+        (JSC::FTL::buildSwitch):
+        (JSC::FTL::addCase):
+        (FTL):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (LowerDFGToLLVM):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::fpToInt):
+        (JSC::FTL::Output::fpToInt32):
+        (Output):
+        (JSC::FTL::Output::switchInstruction):
+        * ftl/FTLSwitchCase.h: Added.
+        (FTL):
+        (SwitchCase):
+        (JSC::FTL::SwitchCase::SwitchCase):
+        (JSC::FTL::SwitchCase::value):
+        (JSC::FTL::SwitchCase::target):
+
+2013-06-15  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Add CFG simplification for Switch
+        https://bugs.webkit.org/show_bug.cgi?id=117677
+
+        Reviewed by Mark Hahnenberg.
+        
+        This is for completeness. It only speeds up a microbenchmark at this point.
+        Broadly, we want all control constructs to be known to the CFG simplifier.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::convertToJump):
+        (CFGSimplificationPhase):
+        (JSC::DFG::CFGSimplificationPhase::noBlocks):
+        (JSC::DFG::CFGSimplificationPhase::oneBlock):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * runtime/JSCJSValue.h:
+        (JSValue):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::pureStrictEqual):
+        (JSC):
+
+2013-06-13  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should support op_switch_imm
+        https://bugs.webkit.org/show_bug.cgi?id=117559
+
+        Reviewed by Oliver Hunt.
+        
+        Implement integer (i.e. immediate) switches in the DFG. Reduce the minimum
+        threshold for using op_switch.
+        
+        Also get rid of edge code support, since we haven't used it in the year since
+        I introduced it. It was supposed to allow us to break critical edges late in
+        the backend, thus enabling global register allocation from an SSA-form graph.
+        But we aren't doing that so I figure we should just kill the code for now. It
+        would have made implementing switch harder.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::timesPtr):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::dumpWithName):
+        (MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::dump):
+        (MacroAssemblerCodeRef):
+        (JSC::MacroAssemblerCodeRef::dump):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/JumpTable.h:
+        (SimpleJumpTable):
+        (JSC::SimpleJumpTable::clear):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        (JSC::DFG::AbstractState::mergeToSuccessors):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGCommon.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::determineReachability):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::blockHeads):
+        * dfg/DFGNode.h:
+        (DFG):
+        (JSC::DFG::SwitchCase::SwitchCase):
+        (SwitchCase):
+        (SwitchData):
+        (JSC::DFG::SwitchData::SwitchData):
+        (Node):
+        (JSC::DFG::Node::isSwitch):
+        (JSC::DFG::Node::isTerminal):
+        (JSC::DFG::Node::switchData):
+        (JSC::DFG::Node::numSuccessors):
+        (JSC::DFG::Node::successor):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::createOSREntries):
+        (JSC::DFG::SpeculativeJIT::emitSwitchImmIntJump):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
+        (JSC::DFG::SpeculativeJIT::emitSwitch):
+        (JSC::DFG::SpeculativeJIT::linkBranches):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::branchDouble):
+        (JSC::DFG::SpeculativeJIT::branchDoubleNonZero):
+        (JSC::DFG::SpeculativeJIT::branch32):
+        (JSC::DFG::SpeculativeJIT::branchTest32):
+        (JSC::DFG::SpeculativeJIT::branch64):
+        (JSC::DFG::SpeculativeJIT::branchPtr):
+        (JSC::DFG::SpeculativeJIT::branchTestPtr):
+        (JSC::DFG::SpeculativeJIT::branchTest8):
+        (JSC::DFG::SpeculativeJIT::jump):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * parser/Nodes.h:
+        (CaseBlockNode):
+
+2013-06-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Concurrent JIT shouldn't try to recompute the CodeBlockHash as part of debug dumps, since doing so may fail if dealing with a CachedScript that doesn't have its script string handy
+        https://bugs.webkit.org/show_bug.cgi?id=117676
+
+        Reviewed by Sam Weinig.
+
+        CodeBlock now caches m_hash, and the DFG Driver will force its computation if we're doing debug dumps of any kind.
+        
+        Also made sure that CodeBlock::CodeBlock initializes all of its fields; it was previously missing the
+        initialization of m_capabilityLevelState.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hash):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/CodeBlockHash.cpp:
+        (JSC::CodeBlockHash::CodeBlockHash):
+        * bytecode/CodeBlockHash.h:
+        (CodeBlockHash):
+        (JSC::CodeBlockHash::isSet):
+        (JSC::CodeBlockHash::operator!):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+
+2013-06-11  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should support op_in and it should use patching to make it fast
+        https://bugs.webkit.org/show_bug.cgi?id=117385
+
+        Reviewed by Geoffrey Garen.
+        
+        Implement op_in in the DFG and give it patching. The code we generate is just
+        a jump on the hot path, and the slow paths generate stubs and link the jump to
+        them. I didn't want to bother with patching structures and load offsets and
+        the like, although I probably could have.
+        
+        This is a ginormous speed-up on microbenchmarks for "in", obviously.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpAssumingJITType):
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::structureStubInfoLessThan):
+        (JSC):
+        (JSC::CodeBlock::sortStructureStubInfos):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::isInAccess):
+        (JSC):
+        (StructureStubInfo):
+        (JSC::StructureStubInfo::initInList):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCCallHelpers.h:
+        (JSC::DFG::CCallHelpers::setupResults):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGPRInfo.h:
+        (JSC::DFG::JSValueRegs::payloadOnly):
+        (JSValueRegs):
+        (JSC::DFG::JSValueRegs::JSValueRegs):
+        (JSC::DFG::JSValueRegs::operator!):
+        (JSC::DFG::JSValueSource::operator!):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::InRecord::InRecord):
+        (InRecord):
+        (DFG):
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::addIn):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryRepatchIn):
+        (DFG):
+        (JSC::DFG::dfgRepatchIn):
+        (JSC::DFG::dfgResetIn):
+        * dfg/DFGRepatch.h:
+        (DFG):
+        (JSC::DFG::dfgResetIn):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::CallSlowPathGenerator::CallSlowPathGenerator):
+        (JSC::DFG::CallSlowPathGenerator::tearDown):
+        (JSC::DFG::CallResultAndNoArgumentsSlowPathGenerator::generateInternal):
+        (JSC::DFG::CallResultAndOneArgumentSlowPathGenerator::generateInternal):
+        (JSC::DFG::CallResultAndTwoArgumentsSlowPathGenerator::generateInternal):
+        (JSC::DFG::CallResultAndThreeArgumentsSlowPathGenerator::generateInternal):
+        (JSC::DFG::CallResultAndFourArgumentsSlowPathGenerator::generateInternal):
+        (JSC::DFG::CallResultAndFiveArgumentsSlowPathGenerator::generateInternal):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        (DFG):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::extractResult):
+        (DFG):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        (JSC::DFG::JSValueOperand::tagGPR):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dump):
+        * runtime/JSString.h:
+        (JSString):
+        (JSC::JSString::tryGetValueImpl):
+        (JSC):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChainForChainAccess):
+
+2013-06-12  Geoffrey Garen  <ggaren@apple.com>
+
+        The Math object should not be polymorphic
+        https://bugs.webkit.org/show_bug.cgi?id=117576
+
+        Reviewed by Oliver Hunt.
+
+        Fill in the Math object eagerly, to avoid its structure changing during
+        execution. There are lots of ways to skin this cat; this one seemed
+        easiest, and justified given the relative hotness of math operations.
+
+        20% speedup on DSP-filtrr tests, small speedups on a few Kraken tests.
+
+        * DerivedSources.make:
+        * JavaScriptCore.order:
+        * create_hash_table:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::jsonTable): Removed the Math object's static table.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectNativeFunctionWithoutTransition):
+        * runtime/JSObject.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        * runtime/MathObject.h:
+        (JSC::MathObject::create): Set up the Math object at construction time.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h: Removed the Math object's static table.
+
+2013-06-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolled back in http://trac.webkit.org/changeset/151342.
+
+        I filled in the missing return register loads, and tests
+        seem to pass now.
+
+                2013-06-07  Michael Saboff  <msaboff@apple.com>
+
+                        fourthTier: The baseline jit and LLint should use common slow paths
+                        https://bugs.webkit.org/show_bug.cgi?id=116889
+
+2013-06-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/151342
+        It broke Kraken crypto tests in debug build. That results in a pretty bad
+        loss of test coverage.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_inc):
+        (JSC::JIT::emitSlow_op_dec):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitSlow_op_div):
+        (JSC::JIT::emitSlow_op_sub):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_inc):
+        (JSC::JIT::emitSlow_op_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitSlow_op_div):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITExceptions.cpp:
+        (JSC):
+        (JSC::genericThrow):
+        * jit/JITExceptions.h:
+        (ExceptionHandler):
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emitSlow_op_create_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emitSlow_op_to_number):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emitSlow_op_to_number):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_create_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC):
+        * jit/JITStubs.h:
+        (JSC):
+        * jit/JITStubsARM.h:
+        (JSC):
+        * jit/JITStubsARMv7.h:
+        (JSC):
+        * jit/JITStubsMIPS.h:
+        (JSC):
+        * jit/JITStubsSH4.h:
+        (JSC):
+        * jit/JITStubsX86.h:
+        (JSC):
+        * jit/JITStubsX86_64.h:
+        (JSC):
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+        * jit/SlowPathCall.h: Removed.
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        (SlowPathReturnType):
+        (JSC::LLInt::encodeResult):
+        (JSC::LLInt::decodeResult):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp: Removed.
+        * runtime/CommonSlowPaths.h:
+        * runtime/JSCJSValue.h:
+        (JSValue):
+
+2013-06-07  Michael Saboff  <msaboff@apple.com>
+
+        fourthTier: The baseline jit and LLint should use common slow paths
+        https://bugs.webkit.org/show_bug.cgi?id=116889
+
+        Reviewed by Filip Pizlo.
+
+        Moved the llint_slow_paths that return JSValue along with several others to CommonSlowPaths.cpp.
+        Eliminated the related JIT stubs.  Changes the baseline JIT to call these new common stubs.
+        Added a simple slow path call class that uses argument registers or the stack instead of
+        JITStackFrame.  Changes the exception mechanism for to check for an exception after making
+        a slowpath call instead of returning to the handler directly form the slowpath function.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_inc):
+        (JSC::JIT::emitSlow_op_dec):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitSlow_op_div):
+        (JSC::JIT::emitSlow_op_sub):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_inc):
+        (JSC::JIT::emitSlow_op_dec):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitSlow_op_div):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITExceptions.cpp:
+        (JSC::getExceptionLocation):
+        (JSC::genericThrow):
+        (JSC::jitThrowNew):
+        * jit/JITExceptions.h:
+        (ExceptionHandler):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emitSlow_op_create_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emitSlow_op_to_number):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emitSlow_op_to_number):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_create_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::cti_vm_throw_slowpath):
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsMIPS.h:
+        * jit/JITStubsSH4.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+        * jit/SlowPathCall.h: Added.
+        (JITSlowPathCall):
+        (JSC::JITSlowPathCall::JITSlowPathCall):
+        (JSC::JITSlowPathCall::call):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        * llint/LLIntSlowPaths.h:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp: Added.
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (SlowPathReturnType):
+        (JSC::encodeResult):
+        (JSC::decodeResult):
+        * runtime/JSCJSValue.h:
+        (JSValue):
+
+2013-06-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in <http://trac.webkit.org/changeset/151363>.
+
+        Rubber stamped by Phil Pizlo.
+
+        The ASSERTs were due to the bytecode parser performing a
+        StructureTransitionWatchpoint optimization in a case where the CFA
+        wouldn't because the CFA could prove that the watchpoint would contradict
+        a preceding CheckStructure.
+
+        I fixed this by removing the bytecode parser optimization: now, we fully
+        rely on CFA and constant folding to optimize structure checks when
+        possible.
+
+        I verified that there's no performance change vs doing the optimization
+        in the bytecode parser. (The optimization is very simple, so this is not
+        surprising.)
+
+2013-06-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        isContravenedByStructure is backwards
+        https://bugs.webkit.org/show_bug.cgi?id=117366
+
+        We should be checking if arrayModeForStructure(structure) is a 
+        subset of arrayModesThatPassFiltering(), not the other way around.
+        Also renamed isContravenedByStructure to better reflect what the 
+        function is trying to determine.
+
+        Rubber stamped by Filip Pizlo.
+
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::structureWouldPassArrayModeFiltering):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheckAccountingForArrayMode):
+        (JSC::DFG::ArrayTypeCheck::isContravenedByValue):
+
+2013-06-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        isContravenedByStructure is backwards
+        https://bugs.webkit.org/show_bug.cgi?id=117366
+
+        We should be checking if arrayModeForStructure(structure) is a 
+        subset of arrayModesThatPassFiltering(), not the other way around.
+        Also renamed isContravenedByStructure to better reflect what the 
+        function is trying to determine.
+
+        Rubber stamped by Filip Pizlo.
+
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::structureWouldPassArrayModeFiltering):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheckAccountingForArrayMode):
+        (JSC::DFG::ArrayTypeCheck::isContravenedByValue):
+
+2013-06-11  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Type check hoisting phase has a dead if statement
+        https://bugs.webkit.org/show_bug.cgi?id=117510
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+
+2013-06-10  Mark Lam  <mark.lam@apple.com>
+
+        Introducing the StackIterator class.
+        https://bugs.webkit.org/show_bug.cgi?id=117390.
+
+        Reviewed by Geoffrey Garen.
+
+        The StackIterator class is meant to unify the way we iterate the JS
+        stack. It also makes it so that we don't have to copy the frame data
+        into the intermediate StackFrame struct before processing it.
+        Unfortunately we still can't get rid of StackFrame because it is used
+        to record frame information for the Exception stack that is expected
+        to persist beyond when the frames have been popped off the JS stack.
+
+        The StackIterator will iterate over all "logical" frames (i.e. including
+        inlined frames). As it iterates the JS stack, if it encounters a DFG
+        frame that has inlined frames, the iterator will canonicalize the
+        inlined frames before returning. Once canonicalized, the frame can be
+        read like any other frame.
+
+        The StackIterator implements a Frame class that inherits from CallFrame.
+        The StackIterator::Frame serves as reader of the CallFrame that makes
+        it easier to access information about the frame. The StackIterator::Frame
+        only adds functions, and no additional data fields.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::begin):
+        (JSC::CallFrame::beginAt):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setInlineCallFrame):
+        (ExecState):
+        (JSC::ExecState::end):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * interpreter/StackIterator.cpp: Added.
+        (JSC::StackIterator::StackIterator):
+        (JSC::StackIterator::beginAt):
+        (JSC::StackIterator::gotoNextFrame):
+        - Based on the deleted Interpreter::findFunctionCallFrameFromVMCode().
+        (JSC::StackIterator::findFrameForFunction):
+        - Based on the deleted Interpreter::retrieveCallerFromVMCode().
+        (JSC::StackIterator::Frame::codeType):
+        - Based on the deleted getStackFrameCodeType().
+        (JSC::StackIterator::Frame::functionName):
+        - Based on StackFrame::friendlyFunctionName().
+        (JSC::StackIterator::Frame::sourceURL):
+        - Based on StackFrame::friendlySourceURL().
+        (JSC::StackIterator::Frame::toString):
+        - Based on StackFrame::toString().
+        (JSC::StackIterator::Frame::bytecodeOffset):
+        (JSC::StackIterator::Frame::line):
+        - Based on StackFrame::line().
+        (JSC::StackIterator::Frame::column):
+        - Based on StackFrame::column().
+        (JSC::StackIterator::Frame::arguments):
+        - Based on the deleted Interpreter::retrieveArgumentsFromVMCode().
+        (JSC::StackIterator::Frame::retrieveExpressionInfo):
+        - Based on StackFrame::expressionInfo().
+        (JSC::StackIterator::Frame::logicalFrame):
+        - Based on the now deleted CallFrame::trueCallFrame().
+        (JSC::StackIterator::Frame::logicalCallerFrame):
+        - Based on the now deleted CallFrame::trueCallerFrame().
+        (JSC::jitTypeName):
+        (JSC::printIndents):
+        (JSC::printif):
+        (JSC::StackIterator::Frame::print):
+        (debugPrintCallFrame):
+        - Prints the contents of the frame for debugging purposes.
+          There are 2 versions that can be used as follows:
+
+          1. When you have a valid StackIterator, you can print
+             the current frame's content using the print instance
+             method:
+                 iter->print(indentLevel);
+
+          2. When you have a CallFrame* that you want to dump from a debugger
+             console, you can print its content as follows:
+                 (gdb) call debugPrintCallFrame(callFrame)
+
+          A sample of the output looks like this:
+
+              frame 0x1510c70b0 {
+                 name 'shouldBe'
+                 sourceURL 'testapi.js'
+                 hostFlag 0
+                 isInlinedFrame 0
+                 callee 0x15154efb0
+                 returnPC 0x10ed0786d
+                 callerFrame 0x1510c7058
+                 logicalCallerFrame 0x1510c7058
+                 rawLocationBits 27 0x1b
+                 codeBlock 0x7fe79b037200
+                    bytecodeOffset 27 0x1b / 210
+                    line 46
+                    column 20
+                    jitType 3 <BaselineJIT> isOptimizingJIT 0
+                    hasCodeOrigins 0
+              }
+
+        * interpreter/StackIterator.h: Added.
+        (StackIterator::Frame):
+        (JSC::StackIterator::Frame::create):
+        (JSC::StackIterator::Frame::isJSFrame):
+        (JSC::StackIterator::Frame::callFrame):
+        * interpreter/StackIteratorPrivate.h: Added.
+        (StackIterator):
+        (JSC::StackIterator::operator*):
+        (JSC::StackIterator::operator->):
+        (JSC::StackIterator::operator==):
+        (JSC::StackIterator::operator!=):
+        (JSC::StackIterator::operator++):
+        (JSC::StackIterator::end):
+        (JSC::StackIterator::empty):
+        * jsc.cpp:
+        (functionJSCStack):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/ProfileNode.h:
+        (ProfileNode):
+        * runtime/JSFunction.cpp:
+        (JSC::retrieveArguments):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::skipOverBoundFunctions):
+        (JSC::retrieveCallerFunction):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        * runtime/Operations.h:
+
+2013-06-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Marge trunk r146653.
+
+    2013-03-22  Filip Pizlo  <fpizlo@apple.com>
+    
+            DFG folding of PutById to SimpleReplace should consider the specialized function case
+            https://bugs.webkit.org/show_bug.cgi?id=113093
+    
+            Reviewed by Geoffrey Garen and Mark Hahnenberg.
+    
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::computeFor):
+    
+2013-06-09  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG GetById patching shouldn't distinguish between self lists and proto lists
+        https://bugs.webkit.org/show_bug.cgi?id=117377
+
+        Reviewed by Geoffrey Garen.
+        
+        Previously if you did self accesses and then wanted to do a prototype access, you'd
+        have a bad time: the prototype accesses would be forced to take slow path because
+        the self list wouldn't allow prototype accesses. Likewise if you did prototype (or
+        chain) accesses and then wanted to do a self access, similar stupidity would ensue.
+        
+        This fixes the stupidity.
+
+        I believe that this was introduced way back in the days of the old interpreter,
+        where distinguishing between self lists, proto lists, and chain lists was meaningful
+        for interpreter performance: it meant fewer branches to evaluate those lists. Then
+        it got mostly carried over to the old JIT since the old JIT was just initially an
+        optimized version of the old interpreter, and then later it got carried over to the
+        DFG because I didn't know any better at the time. Now I do know better and I'm
+        fixing it.
+
+        * bytecode/PolymorphicAccessStructureList.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::getPolymorphicStructureList):
+        (DFG):
+        (JSC::DFG::patchJumpToGetByIdStub):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::dfgBuildGetByIDList):
+
+2013-06-09  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken no-DFG build.
+        https://bugs.webkit.org/show_bug.cgi?id=117381.
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGDriver.h:
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGJITCode.cpp:
+        * dfg/DFGRepatch.h:
+        (JSC::DFG::dfgResetGetByID):
+        (JSC::DFG::dfgResetPutByID):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::jettison):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        (JSC::ExecState::trueCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        * runtime/ExecutionHarness.h:
+        * runtime/VM.cpp:
+        (JSC::VM::~VM):
+
+2013-06-08  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Recursive deadlock in DFG::ByteCodeParser
+        https://bugs.webkit.org/show_bug.cgi?id=117376
+
+        Reviewed by Mark Hahnenberg.
+        
+        Leave the lock early to prevent a deadlock beneath get().
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2013-06-08  Mark Lam  <mark.lam@apple.com>
+
+        Removed bogus assertion in CallFrame::setLocationAsBytecodeOffset().
+        https://bugs.webkit.org/show_bug.cgi?id=117373.
+
+        Reviewed by Oliver Hunt.
+
+        The assertion wrongly assumes that the incoming offset argument is in
+        units of bytes. This is not true. It is in units of Instruction*. Hence,
+        the assertion which checks for the low 2 bits to be clear can fail.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::setLocationAsBytecodeOffset):
+
+2013-06-07  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: don't insert ForceOSRExits except for inadequate coverage
+        https://bugs.webkit.org/show_bug.cgi?id=117363
+
+        Reviewed by Mark Hahnenberg.
+        
+        Previously (in http://trac.webkit.org/changeset/151303) I made it so that we
+        inserted ForceOSRExits more eagerly.  I now think it's better to have
+        contradictions execute normally and exit with full OSR exit profiling.  It's
+        better at catching the few cases where the DFG will end up with different
+        types than the baseline engines.
+        
+        This simplifies a bunch of code. For example it gets rid of
+        ConstantFoldingPhase::paintUnreachableCode().
+        
+        You can think of this as a partial roll-out of r151303, except that it uses
+        the facilities introduced by that patch to give us run-time assertions that
+        check the CFA's correctness: if the CFA thought that something was a
+        contradiction but the code didn't exit, we'll now trap.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::startExecuting):
+        (JSC::DFG::AbstractState::executeEffects):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::filter):
+        (JSC::DFG::AbstractState::filterArrayModes):
+        (JSC::DFG::AbstractState::filterByValue):
+        (DFG):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        (JSC::DFG::AbstractState::filter):
+        (JSC::DFG::AbstractState::filterArrayModes):
+        (JSC::DFG::AbstractState::filterByValue):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (ConstantFoldingPhase):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+
+2013-06-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix release build.
+
+        * ftl/FTLLink.cpp:
+
+2013-06-06  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Reenable the DFG optimization fixpoint now that it's profitable to do so with concurrent compilation
+        https://bugs.webkit.org/show_bug.cgi?id=117331
+
+        Rubber stamped by Sam Weinig.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2013-06-05  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG CFA should know when it hits a contradiction
+        https://bugs.webkit.org/show_bug.cgi?id=117272
+
+        Reviewed by Oliver Hunt.
+        
+        This makes the DFG CFA immediately detect when it hit a contradiction. Previously
+        we might not know this: for example if we did an int32 type check on a known string;
+        the code would definitely always exit but the CFA would think that we wouldn't have
+        even though it would have computed a BOTTOM (i.e. contradictory) value for that
+        variable.
+        
+        This requires two other changes:
+        
+        - CFA must report contradictions as if they are frequent exit sites, since
+          contradictory speculations will subsequently get replaced with ForceOSRExit.
+          ForceOSRExit cannot itself report profiling data back to the DFG::ExitProfile. So,
+          we do this on behalf of the speculation, eagerly, within the CFA. This also has
+          the effect of speeding convergence somewhat. We may want to revisit this later;
+          for example we might want to instead have the notion of a ForceOSRExit that knows
+          the set of speculations that got folded into it.
+        
+        - This revealed a bug where the CFA was modeling CheckStructure on a node that had
+          a known singleton m_futurePossibleStructure set somewhat differently than the
+          constant folder. If the CheckStructure was checking a structure set with two or
+          more structures in it, it would not filter the abstract value. But the constant
+          folder would turn this into a watchpoint on the singleton structure, thereby
+          filtering the value. This discrepancy meant that we wouldn't realize the
+          contradiction until the backend, and the AbstractState::bail() method asserts that
+          we always realize contradictions in the constant folder.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::hasExitSite):
+        (CodeBlock):
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::ExitProfile::add):
+        (JSC::DFG::ExitProfile::hasExitSite):
+        (JSC::DFG::QueryableExitProfile::QueryableExitProfile):
+        (JSC::DFG::QueryableExitProfile::~QueryableExitProfile):
+        (DFG):
+        (JSC::DFG::QueryableExitProfile::initialize):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::FrequentExitSite::FrequentExitSite):
+        (ExitProfile):
+        (JSC::DFG::ExitProfile::hasExitSite):
+        (QueryableExitProfile):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::AbstractState):
+        (JSC::DFG::AbstractState::beginBasicBlock):
+        (JSC::DFG::AbstractState::reset):
+        (JSC::DFG::AbstractState::startExecuting):
+        (JSC::DFG::AbstractState::executeEffects):
+        (JSC::DFG::AbstractState::execute):
+        (JSC::DFG::AbstractState::filter):
+        (DFG):
+        (JSC::DFG::AbstractState::filterArrayModes):
+        (JSC::DFG::AbstractState::filterByValue):
+        (JSC::DFG::AbstractState::bail):
+        * dfg/DFGAbstractState.h:
+        (AbstractState):
+        (JSC::DFG::AbstractState::filter):
+        (JSC::DFG::AbstractState::filterArrayModes):
+        (JSC::DFG::AbstractState::filterByValue):
+        (JSC::DFG::AbstractState::filterByType):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::filterArrayModes):
+        (DFG):
+        (JSC::DFG::AbstractValue::filterByValue):
+        (JSC::DFG::AbstractValue::normalizeClarity):
+        * dfg/DFGAbstractValue.h:
+        (AbstractValue):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::debugFail):
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (ConstantFoldingPhase):
+        (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
+        * dfg/DFGFiltrationResult.h: Added.
+        (DFG):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOSRExitBase.cpp:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::backwardTypeCheck):
+        (JSC::DFG::SpeculativeJIT::bail):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateStringObject):
+        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::appendTypeCheck):
+
+2013-06-07  Mark Lam  <mark.lam@apple.com>
+
+        32-bit CallFrame::Location should use Instruction* for BytecodeLocation, not bytecodeOffset.
+        https://bugs.webkit.org/show_bug.cgi?id=117327.
+
+        Reviewed by Michael Saboff.
+
+        - Renamed CallFrame::Location's Type to TypeTag.
+        - Made the CallFrame::Location::TypeTag private, and provided type
+          specific encoder functions. This reduces verbosity in client code.
+        - Fixed the DFG's reifyInlinedCallFrames() on 32-bit ports to store a
+          bytecode Instruction* in the CallFrame location instead of a bytecode
+          offset.
+        - Fixed places in JIT and FTL code which populate the CallFrame location
+          (i.e. ArgumentCount tag) to use a Location encoder instead of storing
+          the bytecodeOffset directly. This doesn't make any semantic difference,
+          but it does assert that the stored value does not have bits where we
+          would expect Location TypeTags to be.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::beginCall):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::setLocationAsBytecodeOffset):
+        * interpreter/CallFrame.h:
+        (Location):
+        * interpreter/CallFrameInlines.h:
+        (JSC::CallFrame::Location::encodeAsBytecodeOffset):
+        (JSC::CallFrame::Location::encodeAsBytecodeInstruction):
+        (JSC::CallFrame::Location::encodeAsCodeOriginIndex):
+        (JSC::CallFrame::Location::encodeAsInlinedCode):
+        (JSC::CallFrame::Location::isBytecodeLocation):
+        (JSC::CallFrame::setIsInlinedFrame):
+        (JSC::CallFrame::hasLocationAsBytecodeOffset):
+        (JSC::CallFrame::setLocationAsBytecodeOffset):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlines.h:
+        (JSC::JIT::updateTopCallFrame):
+
+2013-06-06  Mark Lam  <mark.lam@apple.com>
+
+        Encode CallFrame::Location flags in the low bits when USE(JSVALUE32_64).
+        https://bugs.webkit.org/show_bug.cgi?id=117312.
+
+        Reviewed by Michael Saboff.
+
+        For USE(JSVALUE32_64), we store the location flags in the low 2 bits of
+        the word because we need the high bits for address bits.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::setLocationAsBytecodeOffset):
+        * interpreter/CallFrame.h:
+        * interpreter/CallFrameInlines.h:
+        (JSC::CallFrame::Location::encode):
+        (JSC::CallFrame::Location::decode):
+        (JSC::CallFrame::Location::isCodeOriginIndex):
+        (JSC::CallFrame::Location::isInlinedCode):
+
+2013-06-06  Mark Lam  <mark.lam@apple.com>
+
+        CallFrame::trueCallFrame() should populate the bytecodeOffset field
+        when reifying inlined frames..
+        https://bugs.webkit.org/show_bug.cgi?id=117209.
+
+        Reviewed by Geoffrey Garen.
+
+        When reifying an inlined frame, we fill in its CodeBlock, and
+        bytecodeOffset. We also set the InlinedFrame bit in the location field.
+        This is needed in order to iterate the stack correctly. Here's why:
+
+            Let's say we have the following stack trace:
+              X calls A inlines B inlines C calls D
+
+            Based on the above scenario,
+            1. D's callerFrame points to A (not C).
+            2. A has a codeOriginIndex that points to C.
+
+        When iterating the stack (from D back towards X), we will encounter A
+        twice:
+
+            t1. when trying to find C as D's caller.
+                This is the time when we reify B and C using the
+                codeOriginIndex in A, and return C as the caller frame of D.
+
+            t2. when getting's the reified B's caller.
+                This time, we don't run the reification process, and
+                just take A as the caller frame of B.
+
+        To discern which treatment of the DFG frame (i.e. A) we need to apply,
+        we check if the callee is an inlined frame:
+
+            If callee is NOT an inlined frame (e.g. frame D), apply treatment t1.
+            If callee is an inlined frame (e.g. frame B), apply treatment t2.
+
+        Why not just reify A by replacing its codeOriginIndex with A's
+        bytecodeOffset?
+
+        We can't do this because D's callerFrame pointer still points to A, and
+        needs to remain that way because we did not deopt A. It remains a DFG
+        frame which inlined B and C.
+
+        If we replace the codeOriginIndex in A with A's bytecodeOffset, we will
+        only get to iterate the stack correctly once. If we try to iterate the
+        stack a second time, we will not have the information from the
+        codeOriginIndex to tell us that D's caller is actually the inlined C,
+        and not A.
+
+        To recap, when reifying frames for stack iteration purposes, the DFG
+        frame needs to hold on to its codeOriginIndex. This in turn means the
+        DFG frame will need to be treated in 2 possible ways, and we need to
+        know if a callee frame is an inlined frame in order to choose the
+        correct treatment for the DFG frame.
+
+        Other changes:
+        - Simplified Interpreter::getCallerInfo().
+        - Removed CodeBlock::codeOriginForReturn() and supporting code
+          which is now unneeded.
+        - Moved CallFrame location bit encoding from the CodeOrigin to the
+          new CallFrame::Location class.
+        - Explicitly tagged inlined frames. This is necessary in order to
+          iterate the stack correctly as explained above.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::codeOrigins):
+        (CodeBlock):
+        (JSC::CodeBlock::codeOrigin):
+        (RareData):
+        * bytecode/CodeOrigin.h:
+        (CodeOrigin):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::beginCall):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallFrame):
+        (JSC::CallFrame::trueCallerFrame):
+        (JSC::CallFrame::bytecodeOffsetFromCodeOriginIndex):
+        * interpreter/CallFrame.h:
+        (Location):
+        (ExecState):
+        (JSC::ExecState::trueCallerFrame):
+        (JSC::ExecState::callerFrameNoFlags):
+        * interpreter/CallFrameInlines.h:
+        (JSC::CallFrame::Location::encode):
+        (JSC::CallFrame::Location::decode):
+        (JSC::CallFrame::Location::isBytecodeOffset):
+        (JSC::CallFrame::Location::isCodeOriginIndex):
+        (JSC::CallFrame::Location::isInlinedFrame):
+        (JSC::CallFrame::isInlinedFrame):
+        (JSC::CallFrame::setIsInlinedFrame):
+        (JSC::CallFrame::hasLocationAsBytecodeOffset):
+        (JSC::CallFrame::hasLocationAsCodeOriginIndex):
+        (JSC::CallFrame::locationAsBytecodeOffset):
+        (JSC::CallFrame::setLocationAsBytecodeOffset):
+        (JSC::CallFrame::locationAsCodeOriginIndex):
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::findFunctionCallFrameFromVMCode):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+
+2013-06-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA shouldn't filter ArrayModes with ALL_NON_ARRAY_ARRAY_MODES if the speculated type is not SpecArray
+        https://bugs.webkit.org/show_bug.cgi?id=117279
+
+        Reviewed by Mark Hahnenberg.
+        
+        The normalization of abstract value clarity introduced in r151229 revealed a
+        long-standing bug where we filtered ArrayModes incorrectly and sometimes ended
+        up with BOTTOM incorrectly.
+        
+        This patch fixes that bug, and cleans up a bunch of debugging infrastructure
+        that I needed to resurrect to track this down.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::noticeIncomingCall):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::filterArrayModesByType):
+        * dfg/DFGCFAPhase.cpp:
+        (CFAPhase):
+        (JSC::DFG::CFAPhase::run):
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        (JSC::DFG::CFAPhase::performForwardCFA):
+        * runtime/Options.h:
+        (JSC):
+
+2013-06-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix release build.
+
+        * interpreter/Interpreter.cpp:
+        * jit/JITStubs.cpp:
+
+2013-06-05  Mark Lam  <mark.lam@apple.com>
+
+        Disambiguate between CallFrame bytecodeOffset and codeOriginIndex.
+        https://bugs.webkit.org/show_bug.cgi?id=117262.
+
+        Reviewed by Geoffrey Garen.
+
+        When writing to the ArgumentCount tag in CallFrame, we will set the high
+        bit if the written value is a codeOriginIndex.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeOrigin.h:
+        (CodeOrigin):
+        (JSC::CodeOrigin::isHandle):
+        (JSC::CodeOrigin::encodeHandle):
+        (JSC::CodeOrigin::decodeHandle):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::beginCall):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::locationAsBytecodeOffset):
+        (JSC::CallFrame::setLocationAsBytecodeOffset):
+        (JSC::CallFrame::currentVPC):
+        (JSC::CallFrame::setCurrentVPC):
+        (JSC::CallFrame::trueCallFrame):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        (JSC::ExecState::inlineCallFrame):
+        * interpreter/CallFrameInlines.h: Added.
+        (JSC::CallFrame::hasLocationAsBytecodeOffset):
+        (JSC::CallFrame::hasLocationAsCodeOriginIndex):
+        (JSC::CallFrame::locationAsRawBits):
+        (JSC::CallFrame::setLocationAsRawBits):
+        (JSC::CallFrame::locationAsBytecodeOffset):
+        (JSC::CallFrame::setLocationAsBytecodeOffset):
+        (JSC::CallFrame::locationAsCodeOriginIndex):
+        * interpreter/Interpreter.cpp:
+        (JSC::getBytecodeOffsetForCallFrame):
+        (JSC::getCallerInfo):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2013-06-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix release build.
+
+        * interpreter/Interpreter.cpp:
+        * jit/JITStubs.cpp:
+
+2013-06-04  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Clean up AbstractValue
+        https://bugs.webkit.org/show_bug.cgi?id=117217
+
+        Reviewed by Oliver Hunt.
+        
+        This started as an attempt to make it so that when AbstractValue becomes empty,
+        its m_type always becomes SpecNone. I wanted this to happen naturally. That turns
+        out to be basically impossible, since AbstractValue is a set that is dynamically
+        computed from the intersection of several internal sets: so the value becomes
+        empty when any of the sets go empty. It's OK if we're imprecise here because it's
+        always safe for the AbstractValue to seem to overapproximate the set of values
+        that we see. So I mostly gave up on cleaning up that aspect of AbstractValue. But
+        while trying to make this happen, I encountered two bugs:
+        
+        - filterValueByType() ignores the case when m_type contravenes m_value. Namely,
+          we might filter the AbstractValue against a SpeculatedType leading to m_value
+          becoming inconsistent with the new m_type. This change fixes that case. This
+          wasn't a symptomatic bug but it was a silly oversight.
+        
+        - filterFuturePossibleStructure() was never right. The one call to this method,
+          in filter(Graph&, const StructureSet&), assumed that the previous notions of
+          what structures the value could have in the future were still relevant. This
+          could lead to a bug where we:
+          
+          1) CheckStructure(@foo, S1)
+          
+             Where S1 has a valid watchpoint. Now @foo's abstract value will have current
+             and future structure = S1.
+          
+          2) Clobber the world.
+          
+             Now @foo's abstract value will have current structure = TOP, and future
+             possible structure = S1.
+          
+          3) CheckStructure(@foo, S2)
+          
+             Now @foo's abstract value will have current structure = S2 and future
+             possible structure = S1 intersect S2 = BOTTOM.
+          
+          Now we will think that any subsequent watchpoint on @foo is valid because the
+          value is effectively BOTTOM. That would only be correct if we had actually set
+          a watchpoint on S1. If we had done so, then (3) would only pass (i.e. @foo
+          would only have structure S2) if S1's watchpoint fired, in which case (3)
+          wouldn't have been reachable. But we didn't actually set a watchpoint on S1:
+          we just observed that we *could* have set the watchpoint. Hence future possible
+          structure should only be set to either the known structure at compile-time, or
+          it should be the structure we just checked; in both cases it should only be set
+          if the structure is watchable.
+        
+        Then, in addition to all of this, I changed AbstractValue's filtering methods to
+        call clear() if the AbstractValue is effectively clear. This is just meant to
+        simplify the recognition of truly empty AbstractValues, but doesn't actually have
+        any other implications.
+
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::dump):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::filter):
+        (DFG):
+        (JSC::DFG::AbstractValue::filterArrayModes):
+        (JSC::DFG::AbstractValue::filterValueByType):
+        (JSC::DFG::AbstractValue::filterArrayModesByType):
+        (JSC::DFG::AbstractValue::shouldBeClear):
+        (JSC::DFG::AbstractValue::normalizeClarity):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::isClear):
+        (AbstractValue):
+
+2013-06-04  Mark Lam  <mark.lam@apple.com>
+
+        The DFG JIT should populate frame bytecodeOffsets on OSR exit.
+        https://bugs.webkit.org/show_bug.cgi?id=117103.
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+
+2013-06-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: all cached put_by_id transitions, even ones that weren't inlined by the DFG, should be propagated by the GC
+        https://bugs.webkit.org/show_bug.cgi?id=117170
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC):
+        (JSC::CodeBlock::determineLiveness):
+        (JSC::CodeBlock::visitWeakReferences):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC):
+        (PutByIdAccess):
+        (PolymorphicPutByIdList):
+        * bytecode/StructureStubInfo.h:
+        (StructureStubInfo):
+        * jit/JITCode.h:
+        (JSC::JITCode::couldBeInterpreted):
+        (JITCode):
+
+2013-06-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Get rid of StructureStubInfo::bytecodeIndex
+        https://bugs.webkit.org/show_bug.cgi?id=117127
+
+        Reviewed by Mark Hahnenberg.
+        
+        StructureStubInfo already has a CodeOrigin field, which also has a bytecodeIndex.
+        It makes sense to just always use the CodeOrigin.
+
+        * bytecode/StructureStubInfo.h:
+        (StructureStubInfo):
+        (JSC::getStructureStubInfoBytecodeIndex):
+        * jit/JIT.cpp:
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2013-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix some minor issues in the DFG's profiling of heap accesses
+        https://bugs.webkit.org/show_bug.cgi?id=113010
+
+        Reviewed by Goeffrey Garen.
+        
+        Carefully merge r146669 from trunk. This required some fiddling since it
+        wasn't a clean apply.
+        
+        Original changelog:
+
+            1) If a CodeBlock gets jettisoned by GC, we should count the exit sites.
+    
+            2) If a CodeBlock clears a structure stub during GC, it should record this, and
+            the DFG should prefer to not inline that access (i.e. treat it as if it had an
+            exit site).
+    
+            3) If a PutById was seen by the baseline JIT, and the JIT attempted to cache it,
+            but it chose not to, then assume that it will take slow path.
+    
+            4) If we frequently exited because of a structure check on a weak constant,
+            don't try to inline that access in the future.
+    
+            5) Treat all exits that were counted as being frequent.
+            
+            81% speed-up on Octane/gbemu. Small speed-ups elsewhere, and no regressions.
+    
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC):
+        (JSC::CodeBlock::resetStubDuringGCInternal):
+        (JSC::CodeBlock::reoptimize):
+        (JSC::CodeBlock::jettison):
+        (JSC::ProgramCodeBlock::jettisonImpl):
+        (JSC::EvalCodeBlock::jettisonImpl):
+        (JSC::FunctionCodeBlock::jettisonImpl):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (StructureStubInfo):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGOSRExitBase.cpp:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
+        (OSRExitBase):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Options.h:
+        (JSC):
+
+2013-05-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove CodeOrigin::valueProfileOffset since it was only needed for op_call_put_result.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/CodeOrigin.h:
+        (CodeOrigin):
+        (JSC::CodeOrigin::CodeOrigin):
+        (JSC::CodeOrigin::isSet):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::currentCodeOrigin):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueProfileFor):
+
+2013-05-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove finalDestinationOrIgnored since it isn't called anymore.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+
+2013-05-31  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: get rid of op_call_put_result
+        https://bugs.webkit.org/show_bug.cgi?id=117047
+
+        Reviewed by Gavin Barraclough.
+        
+        op_call_put_result is an oddball. Its semantics are that it takes the return
+        value of a call instruction, which is set aside in regT0/regT1, and places them
+        into some stack slot. This is weird since there is an implicit contract with the
+        preceding bytecode instruction, and it's even weirder since it means that it
+        doesn't make sense to jump to it; for example OSR exit from the preceding call
+        instruction must make sure to jump over the op_call_put_result.
+        
+        So this patch gets rid of op_call_put_result:
+        
+        - In bytecode, all calls return a value and we always allocate a temporary for
+          that value even if it isn't used.
+        
+        - The LLInt does the return value saving as part of dispatchAfterCall().
+        
+        - The JIT and DFG do the return value saving as part of normal code generation.
+          The DFG already did the right thing.
+        
+        - DFG->JIT OSR exit in the case of inlining will make the return PC's point at
+          the CallLinkInfo::callReturnLocation, rather than the machine PC associated
+          with the op_call_put_result instruction.
+        
+        - Tons of code gets removed. The DFG had to track whether or not a call had a
+          return value in a bunch of places. It had to track the fact that we would
+          exit to after the op_call_put_result. It was a mess. That mess is now gone.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::dumpArrayProfiling):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::currentCodeOrigin):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emitPutCallResult):
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::emit_op_call):
+        (JSC):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_construct):
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_construct):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitPutCallResult):
+        (JSC::JIT::compileLoadVarargs):
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOpcodes.cpp:
+        (JSC):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::genericCall):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-05-30  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: LLInt shouldn't store an offset call PC during op_call-like calls
+        https://bugs.webkit.org/show_bug.cgi?id=117048
+
+        Reviewed by Mark Hahnenberg.
+        
+        This just makes everything consistent in the LLInt: anytime any op calls out,
+        it stores its PC and never the next op's PC.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::interpreterThrowInCaller):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-05-28  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support ArithAbs
+        https://bugs.webkit.org/show_bug.cgi?id=116890
+
+        Reviewed by Oliver Hunt.
+        
+        Implements ArithAbs in the FTL, and cleans up the DFG implementation. The
+        DFG implementation was previously doing zero extensions manually when it
+        is probably better to just use StrictInt32Operand instead.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        (FTL):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAbs):
+        (LowerDFGToLLVM):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleAbs):
+
+2013-05-28  Mark Lam  <mark.lam@apple.com>
+
+        Misc JIT probe enhacements.
+        https://bugs.webkit.org/show_bug.cgi?id=116586.
+
+        Reviewed by Michael Saboff.
+
+        1. Added JIT probe support for ARMv7 and traditional ARM.
+           Built and tested on ARMv7. ARM version not tested nor built. 
+        2. Fix the following bugs in the X86 and X86_64 probes:
+           a. Cannot assume that the stack pointer is already aligned when
+              we push args for the probe. Instead, we ensure the stack
+              alignment at runtime when we set up the probe call.
+              This is now done in the ctiMasmProbeTrampoline.
+           b. On return, the user probe function may have altered the stack
+              pointer value to be restored. Previously, if the sp restore value
+              points to some of the other register restore values in the
+              ProbeContext record, we will fail to return from the probe having
+              those user specified value as we're expected to do.
+              This is now fixed.
+        3. Rearranged the X86/X86_64 registers order to organize them like gdb
+           expects on X86_64.
+        4. We also now preserve the condition code registers.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        (ARMRegisters):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+        (JSC::MacroAssemblerARM::ProbeContext::dumpCPURegisters):
+        (JSC::MacroAssemblerARM::ProbeContext::dump):
+        (JSC::MacroAssemblerARM::probe):
+        * assembler/MacroAssemblerARM.h:
+        (MacroAssemblerARM):
+        (CPUState):
+        (ProbeContext):
+        (JSC::MacroAssemblerARM::trustedImm32FromPtr):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (CPUState):
+        (ProbeContext):
+        (JSC::MacroAssemblerARMv7::trustedImm32FromPtr):
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::probe):
+        * assembler/MacroAssemblerX86Common.cpp:
+        (JSC::MacroAssemblerX86Common::ProbeContext::dumpCPURegisters):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::probe):
+        * assembler/X86Assembler.h:
+        * config.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86Common.h:
+        * jit/JITStubsX86_64.h:
+
+2013-05-28  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should call masqueradesAsUndefinedWatchpointIfIsStillValid() in all of the places where it currently calls masqueradesAsUndefinedWatchpointIsStillValid()
+        https://bugs.webkit.org/show_bug.cgi?id=116892
+
+        Reviewed by Oliver Hunt.
+        
+        All of those places mean to plant the watchpoint if it's still valid.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
+
+2013-05-28  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support ArithMin/ArithMax
+        https://bugs.webkit.org/show_bug.cgi?id=116885
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+
+2013-05-28  Filip Pizlo  <fpizlo@apple.com>
+
+        testRunner should have a way of disabling inlining of functions
+        https://bugs.webkit.org/show_bug.cgi?id=116875
+
+        Reviewed by Mark Hahnenberg.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::getExecutable):
+        (JSC):
+        (JSC::numberOfDFGCompiles):
+        (JSC::setNeverInline):
+        * API/JSCTestRunnerUtils.h:
+        (JSC):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForClosureCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (ScriptExecutable):
+        (JSC::ScriptExecutable::setNeverInline):
+        (JSC::ScriptExecutable::neverInline):
+        (JSC::ScriptExecutable::isInliningCandidate):
+
+2013-05-27  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support ArithMod
+        https://bugs.webkit.org/show_bug.cgi?id=116792
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildFRem):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+        (LowerDFGToLLVM):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleRem):
+
+2013-05-27  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to record heap operations (both FastMalloc and JSC GC)
+        https://bugs.webkit.org/show_bug.cgi?id=116848
+
+        Reviewed by Mark Hahnenberg.
+        
+        Record GC heap operations if ENABLE(ALLOCATION_LOGGING).
+
+        * API/JSManagedValue.mm:
+        * dfg/DFGOperations.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::allocateWithNormalDestructor):
+        (JSC::Heap::allocateWithImmortalStructureDestructor):
+        (JSC::Heap::allocateWithoutDestructor):
+        (JSC::Heap::tryAllocateStorage):
+        (JSC::Heap::tryReallocateStorage):
+        (JSC):
+        (JSC::Heap::ascribeOwner):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::internalAppend):
+        * heap/SlotVisitor.h:
+        (SlotVisitor):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::appendUnbarrieredPointer):
+        (JSC::SlotVisitor::appendUnbarrieredValue):
+        (JSC::SlotVisitor::appendUnbarrieredWeak):
+        (JSC::SlotVisitor::internalAppend):
+        (JSC):
+        (JSC::SlotVisitor::appendValues):
+        * jit/JITWriteBarrier.h:
+        (JSC::SlotVisitor::append):
+        * llint/LLIntCommon.h:
+        * runtime/Butterfly.h:
+        (Butterfly):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::createUninitialized):
+        (JSC::Butterfly::create):
+        (JSC::Butterfly::growPropertyStorage):
+        (JSC::Butterfly::createOrGrowArrayRight):
+        (JSC):
+        (JSC::Butterfly::growArrayRight):
+        (JSC::Butterfly::resizeArray):
+        * runtime/JSArray.cpp:
+        (JSC::createArrayButterflyInDictionaryIndexingMode):
+        (JSC::JSArray::unshiftCountSlowCase):
+        * runtime/JSArray.h:
+        (JSC::createContiguousArrayButterfly):
+        (JSC::createArrayButterfly):
+        (JSC):
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::growOutOfLineStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        * runtime/Operations.h:
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::create):
+        * runtime/StructureInlines.h:
+        (JSC):
+        * runtime/WriteBarrier.h:
+        (JSC):
+
+2013-05-27  Filip Pizlo  <fpizlo@apple.com>
+
+        testRunner should be able to tell you if a function is DFG compiled
+        https://bugs.webkit.org/show_bug.cgi?id=116847
+
+        Reviewed by Mark Hahnenberg.
+
+        * API/JSCTestRunnerUtils.cpp: Added.
+        (JSC):
+        (JSC::numberOfDFGCompiles):
+        * API/JSCTestRunnerUtils.h: Added.
+        (JSC):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::numberOfDFGCompiles):
+        (JSC):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::runThread):
+        * runtime/Executable.h:
+        (JSC):
+        * runtime/JSFunctionInlines.h: Added.
+        (JSC):
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::jsExecutable):
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::nativeConstructor):
+        * runtime/Operations.h:
+
+2013-05-27  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG ArithMod should have the !nodeUsedAsNumber optimizations that ArithDiv has
+        https://bugs.webkit.org/show_bug.cgi?id=116841
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+
+2013-05-26  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: clean up ArithDiv/ArithMod in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=116793
+
+        Reviewed by Mark Hahnenberg.
+        
+        This makes ArithDiv and ArithMod behave similarly, and moves both of their
+        implementations entirely into DFGSpeculativeJIT.cpp into methods named like
+        the ones for ArithSub/ArithMul.
+        
+        Specifically, ArithMod now uses the wrap-in-conversion-nodes idiom that
+        ArithDiv used for platforms that don't support integer division. Previously
+        ArithMod had its own int-to-double and double-to-int conversions for this
+        purpose.
+        
+        As well, this gets rid of confusing methods like compileSoftModulo() (which
+        did no such thing, there wasn't anything "soft" about it) and 
+        compileIntegerArithDivForX86() (which is accurately named but we don't use
+        the platform-specific method convention anywhere else).
+        
+        Finally, this takes the optimized power-of-two modulo operation that was
+        previously only for ARMv7s, and makes it available for all platforms. Well,
+        sort of: I actually rewrote it to do what latest LLVM appears to do, which
+        is a crazy straight-line power-of-2 modulo based on a combination of shifts,
+        ands, additions, and subtractions. I can kind of understand it well enough
+        to see that it complies with both C and JS power-of-2 modulo semantics. I've
+        also confirmed that it does by testing (hence the corresponding improvements
+        to one of the division tests). But, I don't claim to know exactly how this
+        code works other than to observe that it is super leet.
+        
+        Overall, this patch has the effect of killing some code (no more hackish
+        int-to-double conversions in ArithMod), making some optimization work on
+        more platforms, and making the compiler less confusing by doing more things
+        with the same idiom.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-05-25  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: cti_optimize shouldn't allow GCs to get in the way of it seeing the state of its CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=116748
+
+        Reviewed by Geoffrey Garen.
+        
+        This fixes the following race: an optimized version of our code block could be installed
+        by the GC just as we return from completeAllReadyPlansForVM(), leading us to believe
+        that the code block isn't ready yet even though it is. Currently this triggers a
+        RELEASE_ASSERT. We could remove that assertion, but then this case would lead to the
+        code in question entering into optimizeAfterWarmUp mode. That seems pretty wasteful.
+        
+        Fix the bug, and hopefully close the door on these bugs for a while, by wrapping
+        cti_optimize in a DeferGC. There is little downside to doing so since the only
+        "allocations" in cti_optimize are the ones where we inform the GC about extra memory
+        usage.
+        
+        I had a more comprehensive solution (see the bug, "work in progress" patch) but that
+        one involved adding *more* raciness to cti_optimize. I decided that was a less good
+        approach once I came to appreciate the simplicity of just using DeferGC.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2013-05-25  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support ArithDiv
+        https://bugs.webkit.org/show_bug.cgi?id=116771
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildDiv):
+        (JSC::FTL::buildRem):
+        (JSC::FTL::buildFDiv):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        (CommonValues):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+        (LowerDFGToLLVM):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::div):
+        (JSC::FTL::Output::rem):
+        (JSC::FTL::Output::doubleDiv):
+
+2013-05-25  Mark Lam  <mark.lam@apple.com>
+
+        Remove Interpreter::retrieveLastCaller().
+        https://bugs.webkit.org/show_bug.cgi?id=116753.
+
+        Reviewed by Geoffrey Garen.
+
+        This is part of the refactoring effort to get rid of functions walking
+        the JS stack in their own way.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * interpreter/CallFrame.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        * interpreter/Interpreter.h:
+        (StackFrame):
+        (JSC::StackFrame::StackFrame):
+        (Interpreter):
+        * jsc.cpp:
+        (functionJSCStack):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+
+2013-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL boolify should support ObjectOrOtherUse
+        https://bugs.webkit.org/show_bug.cgi?id=116741
+
+        Reviewed by Geoffrey Garen.
+        
+        Just reusing what was already there in equalNullOrUndefined(). Note that we will
+        sometimes generate some redundant IR - like having some spurious bitNot's in
+        places - but it's safe to assume that LLVM will simplify those, and that it won't
+        be the longest pole in the tent for compile times.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEqConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEqConstant):
+        (JSC::FTL::LowerDFGToLLVM::boolify):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+
+2013-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support LogicalNot and Branch on Int32 and Number
+        https://bugs.webkit.org/show_bug.cgi?id=116739
+
+        Reviewed by Gavin Barraclough.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileLogicalNot):
+        (JSC::FTL::LowerDFGToLLVM::compileBranch):
+        (JSC::FTL::LowerDFGToLLVM::boolify):
+        (LowerDFGToLLVM):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::isZero32):
+        (JSC::FTL::Output::notZero32):
+
+2013-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: add heuristics to reduce the likelihood of a trivially inlineable function being independently compiled by the concurrent JIT
+        https://bugs.webkit.org/show_bug.cgi?id=116557
+
+        Reviewed by Geoffrey Garen.
+        
+        This introduces a fairly comprehensive mechanism for preventing trivially inlineable
+        functions from being compiled independently of all of the things into which they end
+        up being inlined.
+        
+        The trick is CodeBlock::m_shouldAlwaysBeInlined, or SABI for short (that's what the
+        debug logging calls it). A SABI function is one that we currently believe should
+        never be DFG optimized because it should always be inlined into the functions that
+        call it. SABI follows "innocent until proven guilty": all functions start out SABI
+        and have SABI set to false if we see proof that that function may be called in some
+        possibly non-inlineable way. So long as a function is SABI, it will not tier up to
+        the DFG: cti_optimize will perpetually postpone its optimization. Because SABI has
+        such a severe effect, we make the burden of proof of guilt quite low. SABI gets
+        cleared if any of the following happen:
+        
+        - You get called from native code (either through CallData or CachedCall).
+        
+        - You get called from an eval, since eval code takes a long time to get DFG
+          optimized.
+        
+        - You get called from global code, since often global code doesn't tier-up since
+          it's run-once.
+        
+        - You get called recursively, where recursion is detected by a stack walk of depth
+          Options::maximumInliningDepth().
+        
+        - You get called through an unlinked virtual call.
+        
+        - You get called from DFG code, since if the caller was already DFG optimized and
+          didn't inline you then obviously, you might not get inlined.
+        
+        - You've tiered up to the baseline JIT and you get called from the interpreter.
+          The idea here is that this kind of ensures that you stay SABI only if you're
+          called no more frequently than any of your callers.
+        
+        - You get called from a code block that isn't a DFG candidate.
+        
+        - You aren't an inlining candidate.
+        
+        Most of the heuristics for SABI are in CodeBlock::noticeIncomingCall().
+        
+        This is neutral on SunSpider and V8Spider, and appears to be a slight speed-up on
+        V8v7, which was previously adversely affected by concurrent compilation. I also
+        confirmed that for example on V8/richards, it dramatically reduces the number of
+        code blocks that get DFG compiled. It is a speed-up on those V8v7 benchmarks that
+        saw regressions from concurrent compilation.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpAssumingJITType):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC):
+        (JSC::CodeBlock::noticeIncomingCall):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightInlineFunction):
+        (DFG):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgLinkFor):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkFor):
+        * jit/JIT.h:
+        (JIT):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::lazyLinkFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+
+2013-05-23  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: rationalize DFG::CapabilityLevel and DFGCapabilities.[h|cpp]
+        https://bugs.webkit.org/show_bug.cgi?id=116696
+
+        Reviewed by Sam Weinig.
+        
+        Make it so that all capability calculation is funneled through one function, which tells
+        you everything you wanted to know: can it be inlined, and can it be compiled.
+        
+        This work will help with https://bugs.webkit.org/show_bug.cgi?id=116557, since now the
+        JIT has a fairly authoritative answer to the "can it be inlined" question.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::ProgramCodeBlock::capabilityLevelInternal):
+        (JSC::EvalCodeBlock::capabilityLevelInternal):
+        (JSC::FunctionCodeBlock::capabilityLevelInternal):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::capabilityLevel):
+        (JSC::CodeBlock::capabilityLevelState):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::debugFail):
+        (DFG):
+        (JSC::DFG::canInlineResolveOperations):
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGCapabilities.h:
+        (DFG):
+        (JSC::DFG::capabilityLevel):
+        (JSC::DFG::evalCapabilityLevel):
+        (JSC::DFG::programCapabilityLevel):
+        (JSC::DFG::functionForCallCapabilityLevel):
+        (JSC::DFG::functionForConstructCapabilityLevel):
+        (JSC::DFG::canInlineFunctionForCall):
+        (JSC::DFG::canInlineFunctionForClosureCall):
+        (JSC::DFG::canInlineFunctionForConstruct):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::canCompile):
+        (DFG):
+        (JSC::DFG::canInline):
+        (JSC::DFG::leastUpperBound):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::sample):
+
+2013-05-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename getJITCode and getJITType to jitCode and jitType.
+        
+        Rubber stampted by Mark Hahnenberg.
+
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::RepatchBuffer):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::stronglyVisitWeakReferences):
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::codeOriginForReturn):
+        (JSC::ProgramCodeBlock::compileOptimized):
+        (JSC::EvalCodeBlock::compileOptimized):
+        (JSC::FunctionCodeBlock::compileOptimized):
+        (JSC::ProgramCodeBlock::jettison):
+        (JSC::EvalCodeBlock::jettison):
+        (JSC::FunctionCodeBlock::jettison):
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
+        (JSC::CodeBlock::adjustedExitCountThreshold):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::jitCodeWithArityCheck):
+        (JSC::CodeBlock::jitType):
+        (JSC::CodeBlock::hasBaselineJITProfiling):
+        (JSC::CodeBlock::jitCompile):
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
+        (JSC::ExecState::isInlineCallFrame):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::codeLocationForRepatch):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::~DFGCodeBlocks):
+        (JSC::DFGCodeBlocks::jettison):
+        (JSC::DFGCodeBlocks::clearMarks):
+        (JSC::DFGCodeBlocks::deleteUnmarkedJettisonedCodeBlocks):
+        (JSC::DFGCodeBlocks::traceMarkedCodeBlocks):
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriateImpl):
+        (JSC::jitCompileFunctionIfAppropriateImpl):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+        (JSC::EvalExecutable::compileOptimized):
+        (JSC::EvalExecutable::jettisonOptimizedCode):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::ProgramExecutable::jettisonOptimizedCode):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeForCall):
+        (JSC::FunctionExecutable::jettisonOptimizedCodeForConstruct):
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::sample):
+
+2013-05-22  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Race between LLInt->Baseline tier-up and DFG reading Baseline profiling data
+        https://bugs.webkit.org/show_bug.cgi?id=116633
+
+        Reviewed by Mark Hahnenberg.
+        
+        Previously we would check if we had Baseline JIT profiling data by seeing if the
+        appropriate vector was non-empty. This is horrible if we're doing LLInt->Baseline
+        tier-up at the same time. This will happen for code we are inlining, if we're
+        deciding to inline it before the LLInt->Baseline tier-up happened for that code.
+        
+        This changes things to take advantage of the fact that the very last thing that
+        LLInt->Baseline tier-up will do (in JITDriver.h) is setJITCode(). We now precede
+        the actual work in setJITCode() with a store-store fence to ensure that all
+        stores to modify the CodeBlock happen before setting the JITCode, and we modify
+        CodeBlock::getJITType() to use load-load fences to ensure that if you see
+        JITCode::BaselineJIT then you will also see all of those vectors. Then this
+        changes all of the code that scrapes Baseline JIT profiles to check if
+        getJITType() returns JITCode::BaselineJIT instead of checking vector sizes.
+        
+        The outcome is that for the non-racy cases we behave as we did before (we fall
+        back on LLInt profiling if the tier-up hasn't happened) and for racy cases we
+        use LLInt profiling conservatively.
+        
+        Note that for some (but not all!) of the cases where we scrape Baseline JIT
+        profiling, we would have anyway been holding the CodeBlock::m_lock so we can also
+        fix those cases by just having setJITCode graph that lock. This patch does that
+        also, mainly because although we only call setJITCode() from the main thread, in
+        general it's dangerous to have a pointer to a ref-counted object being modified
+        in a racy way. So, this patch just does the most conservative thing possible that
+        does we can afford to do.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::getJITType):
+        (JSC::CodeBlock::hasBaselineJITProfiling):
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::couldTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+
+2013-05-22  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: It should be possible to use more than one compiler thread
+        https://bugs.webkit.org/show_bug.cgi?id=116630
+
+        Reviewed by Mark Hahnenberg.
+        
+        This gives us the ability to use more compiler threads, but doesn't actually
+        enable the functionality because it isn't a speed-up on any benchmark. It can
+        even be a slow-down. This also adds the ability to disable concurrent
+        compilation if we're on a uniprocessor machine, and adds more logging to the
+        worklist code to allow us to investigate how many threads are active. It
+        appears that even on the most compiler-heavy benchmarks, we never have enough
+        work for more than 4 threads, and even then the 4 threads are all active for
+        a short time.
+        
+        Something that having more threads does accomplish is that it shakes out bugs.
+        This patch fixes a bug with Watchpoint not being thread-safe ref-counted,
+        which enabling 7 compilation threads did catch.
+        
+        As it stands, this patch is performance-neutral and just fixes bugs and adds
+        some options.
+
+        * bytecode/Watchpoint.h:
+        * dfg/DFGCommon.h:
+        (JSC::DFG::enableConcurrentJIT):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::Worklist):
+        (JSC::DFG::Worklist::~Worklist):
+        (JSC::DFG::Worklist::finishCreation):
+        (JSC::DFG::Worklist::create):
+        (JSC::DFG::Worklist::enqueue):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::dump):
+        (JSC::DFG::Worklist::runThread):
+        (JSC::DFG::initializeGlobalWorklistOnce):
+        * dfg/DFGWorklist.h:
+        * runtime/Options.cpp:
+        (JSC::computeNumberOfWorkerThreads):
+        (JSC):
+        (JSC::computeNumberOfGCMarkers):
+        * runtime/Options.h:
+        (JSC):
+
+2013-05-22  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL shouldn't use the LLVM global context, and should instead create its own context for each compilation
+        https://bugs.webkit.org/show_bug.cgi?id=116631
+
+        Reviewed by Mark Hahnenberg.
+        
+        In the future we might want to share contexts for multiple compilations, but for
+        now using one context per compilation is a progression over just constantly using
+        the global context.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (DFG):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+        * ftl/FTLAbbreviatedTypes.h:
+        (FTL):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::voidType):
+        (JSC::FTL::int1Type):
+        (JSC::FTL::int8Type):
+        (JSC::FTL::int32Type):
+        (JSC::FTL::int64Type):
+        (JSC::FTL::intPtrType):
+        (JSC::FTL::doubleType):
+        (JSC::FTL::structType):
+        (JSC::FTL::mdKindID):
+        (JSC::FTL::mdString):
+        (JSC::FTL::mdNode):
+        (JSC::FTL::appendBasicBlock):
+        (JSC::FTL::insertBasicBlock):
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::AbstractHeap::tbaaMetadataSlow):
+        (JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
+        (JSC::FTL::NumberedAbstractHeap::NumberedAbstractHeap):
+        (JSC::FTL::AbsoluteAbstractHeap::AbsoluteAbstractHeap):
+        * ftl/FTLAbstractHeap.h:
+        (IndexedAbstractHeap):
+        (NumberedAbstractHeap):
+        (AbsoluteAbstractHeap):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+        (AbstractHeapRepository):
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        (CommonValues):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateCodeSection):
+        * ftl/FTLIntrinsicRepository.cpp:
+        (JSC::FTL::IntrinsicRepository::IntrinsicRepository):
+        * ftl/FTLIntrinsicRepository.h:
+        (FTL):
+        (IntrinsicRepository):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::Output):
+        * ftl/FTLOutput.h:
+        (Output):
+        (JSC::FTL::Output::newBlock):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        (JSC::FTL::State::~State):
+        (FTL):
+        * ftl/FTLState.h:
+        (State):
+        * runtime/Options.h:
+        (JSC):
+
+2013-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should force LLVM to use our own JIT memory allocator, and we shouldn't have to keep around an LLVMExecutionEngineRef to keep code alive
+        https://bugs.webkit.org/show_bug.cgi?id=113619
+
+        Reviewed by Geoffrey Garen.
+        
+        This uses new API that I've exposed, which allows for memory manager callbacks
+        from within LLVM. LLVM may allocate multiple independent chunks of memory for
+        a module, and we track all of those in a Vector in FTL::JITCode.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateCodeSection):
+        (FTL):
+        (JSC::FTL::mmAllocateDataSection):
+        (JSC::FTL::mmApplyPermissions):
+        (JSC::FTL::mmDestroy):
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::JITCode):
+        (JSC::FTL::JITCode::~JITCode):
+        (JSC::FTL::JITCode::addHandle):
+        (FTL):
+        (JSC::FTL::JITCode::initializeCode):
+        * ftl/FTLJITCode.h:
+        (JITCode):
+        (JSC::FTL::JITCode::handles):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::~JITFinalizer):
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        (JSC::FTL::JITFinalizer::initializeEntrypointLinkBuffer):
+        (JITFinalizer):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * ftl/FTLState.h:
+        (State):
+
+2013-05-12  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL shouldn't use FastISel and Small code model should be turned off for now
+        https://bugs.webkit.org/show_bug.cgi?id=115998
+
+        Reviewed by Oliver Hunt.
+        
+        This switches off FastISel and makes it possible to turn off Small code model.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * runtime/Options.h:
+        (JSC):
+
+2013-05-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: should use ConcurrentJITLock[er] directly and not through typedef
+        https://bugs.webkit.org/show_bug.cgi?id=116561
+
+        Rubber stamped by Geoffrey Garen.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        (JSC::ArrayProfile::briefDescription):
+        * bytecode/ArrayProfile.h:
+        (ArrayProfile):
+        (JSC::ArrayProfile::expectedStructure):
+        (JSC::ArrayProfile::structureIsPolymorphic):
+        (JSC::ArrayProfile::hasDefiniteStructure):
+        (JSC::ArrayProfile::observedArrayModes):
+        (JSC::ArrayProfile::mayInterceptIndexedAccesses):
+        (JSC::ArrayProfile::mayStoreToHole):
+        (JSC::ArrayProfile::outOfBounds):
+        (JSC::ArrayProfile::usesOriginalArrayStructures):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpValueProfiling):
+        (JSC::CodeBlock::dumpArrayProfiling):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        (JSC::CodeBlock::updateAllArrayPredictions):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        (CodeBlock):
+        * bytecode/CodeBlockLock.h: Removed.
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
+        (JSC::CompressedLazyOperandValueProfileHolder::add):
+        (JSC::LazyOperandValueProfileParser::initialize):
+        (JSC::LazyOperandValueProfileParser::prediction):
+        * bytecode/LazyOperandValueProfile.h:
+        (CompressedLazyOperandValueProfileHolder):
+        (LazyOperandValueProfileParser):
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::briefDescription):
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        * dfg/DFGArrayMode.h:
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::withProfile):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * jit/JITInlines.h:
+        (JSC::JIT::chooseArrayMode):
+        * jit/JITStubs.cpp:
+        (JSC::tryCachePutByID):
+        (JSC::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::lazyLinkFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::addGlobalVar):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnNonIndexPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolveContainingScopeInternal):
+        (JSC::JSScope::resolvePut):
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::findRegisterIndex):
+        (JSC::JSSegmentedVariableObject::addRegisters):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSSegmentedVariableObject):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        (JSC::Structure::createPropertyMap):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/SymbolTable.h:
+        (SymbolTable):
+        (JSC::SymbolTable::find):
+        (JSC::SymbolTable::get):
+        (JSC::SymbolTable::inlineGet):
+        (JSC::SymbolTable::begin):
+        (JSC::SymbolTable::end):
+        (JSC::SymbolTable::size):
+        (JSC::SymbolTable::add):
+        (JSC::SymbolTable::set):
+        (JSC::SymbolTable::contains):
+
+2013-05-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should be able to run on a separate thread
+        https://bugs.webkit.org/show_bug.cgi?id=112839
+
+        Reviewed by Geoffrey Garen.
+        
+        This is the final bit of concurrent JITing. The idea is that there is a
+        single global worklist, and a single global thread, that does all
+        optimizing compilation. This is the DFG::Worklist. It contains a queue of
+        DFG::Plans, and a map from CodeBlock* (the baseline code block we're
+        trying to optimize) to DFG::Plan. If the DFGDriver tries to concurrently
+        compile something, it puts the Plan on the Worklist. The Worklist's
+        thread will compile that Plan eventually, and when it's done, it will
+        signal its completion by (1) notifying anyone waiting for the Worklist to
+        be done, and (2) forcing the CodeBlock::m_jitExecuteCounter to take slow
+        path. The next Baseline JIT cti_optimize call will then install all ready
+        (i.e. compiled) Plans for that VM. Note that (1) is only for the GC and
+        VM shutdown, which will want to ensure that there aren't any outstanding
+        async compilations before proceeding. They do so by simply waiting for
+        all of the plans for the current VM to complete. (2) is the actual way
+        that code typically gets installed.
+        
+        This is all very racy by design. For example, just as we try to force the
+        execute counter to take slow path, the main thread may be setting the
+        execute counter to some other value. The main thread must set it to
+        another value because (a) JIT code is constantly incrementing the counter
+        in a racy way, (b) the cti_optimize slow path will set it to some
+        large-ish negative value to ensure that cti_optimize isn't called
+        repeatedly, and (c) OSR exits from previously jettisoned code blocks may
+        still want to reset the counter values. This "race" is made benign, by
+        ensuring that while there is an asynchronous compilation, we at worse set
+        the counter to optimizeAfterWarmUp and never to deferIndefinitely. Hence
+        if the race happens then the worst case is that we wait another ~1000
+        counts before installing the optimized code. Another defense is that if
+        any CodeBlock calls into cti_optimize, then it will check for all ready
+        plans for the VM - so even if a code block has to wait another ~1000
+        executions before it calls cti_optimize to do the installation, it may
+        actually end up being installed sooner because a different code block had
+        called cti_optimize, potentially for an unrelated reason.
+        
+        Special care is taken to ensure that installing plans informs the GC
+        about the increased memory usage, but also ensures that we don't recurse
+        infinitely - since at start of GC we try to install outstanding plans.
+        This is done by introducing a new GC deferral mechanism (the DeferGC
+        block-scoped thingy), which will ensure that GCs don't happen in the
+        scope but are allowed to happen after. This still leaves the strange
+        corner case that cti_optimize may install outstanding plans, then GC, and
+        that GC may jettison the code block that was installed. This, and the
+        fact that the plan that we took slow path to install could have been a
+        failed or invalid compile, mean that we have to take special precautions
+        in cti_optimize.
+        
+        This patch also fixes a number of small concurrency bugs that I found
+        when things started running. There are probably more of those bugs still
+        left to fix. This patch just fixes the ones I know about.
+        
+        Concurrent compilation is right now only enabled on X86_64 Mac. We need
+        platforms that are sufficiently CAStastic so that we can do the various
+        memory fence and CAS tricks that make this safe. We also need a platform
+        that uses JSVALUE64. And we need pthread_once. So, that pretty much means
+        just X64_64 for now. Enabling Linux-64_64 should be a breeze, but I'll
+        leave that up to the Qt and GTK+ ports to do at their discretion.
+        
+        This is a solid speed-up on SunSpider (8-9%) and V8Spider (16%), our two
+        main compile-time benchmarks. Most peculiarly, this also appears to
+        reduce measurement noise, rather than increasing it as you would have
+        expected. I don't understand that result but I like it anyway. On the
+        other hand, this is a slight (1%) slow-down on V8v7. I will continue to
+        investigate this but I think that the results are already good enough
+        that we should land this as-is. So far, it appears that the slow-down is
+        due to this breaking the don't-compile-inlineables heuristics. See
+        investigation in https://bugs.webkit.org/show_bug.cgi?id=116556 and the
+        bug https://bugs.webkit.org/show_bug.cgi?id=116557.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::CodeBlock::optimizationThresholdScalingFactor):
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached):
+        (JSC::CodeBlock::optimizeNextInvocation):
+        (JSC::CodeBlock::dontOptimizeAnytimeSoon):
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::optimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon):
+        (JSC::CodeBlock::forceOptimizationSlowPathConcurrently):
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        (JSC::CodeBlock::updateAllArrayPredictions):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::jitCompile):
+        * bytecode/CodeBlockLock.h:
+        (JSC):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::forceSlowPathConcurrently):
+        (JSC):
+        (JSC::ExecutionCounter::setThreshold):
+        * bytecode/ExecutionCounter.h:
+        (ExecutionCounter):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::enableConcurrentJIT):
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::key):
+        (DFG):
+        * dfg/DFGPlan.h:
+        (DFG):
+        (Plan):
+        * dfg/DFGWorklist.cpp: Added.
+        (DFG):
+        (JSC::DFG::Worklist::Worklist):
+        (JSC::DFG::Worklist::~Worklist):
+        (JSC::DFG::Worklist::finishCreation):
+        (JSC::DFG::Worklist::create):
+        (JSC::DFG::Worklist::enqueue):
+        (JSC::DFG::Worklist::compilationState):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::completeAllPlansForVM):
+        (JSC::DFG::Worklist::queueLength):
+        (JSC::DFG::Worklist::dump):
+        (JSC::DFG::Worklist::runThread):
+        (JSC::DFG::Worklist::threadFunction):
+        (JSC::DFG::initializeGlobalWorklistOnce):
+        (JSC::DFG::globalWorklist):
+        * dfg/DFGWorklist.h: Added.
+        (DFG):
+        (Worklist):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::allocateBlock):
+        * heap/DeferGC.h: Added.
+        (JSC):
+        (DeferGC):
+        (JSC::DeferGC::DeferGC):
+        (JSC::DeferGC::~DeferGC):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportExtraMemoryCostSlowCase):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        (JSC):
+        (JSC::Heap::incrementDeferralDepth):
+        (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
+        * heap/Heap.h:
+        (Heap):
+        (JSC::Heap::isCollecting):
+        (JSC):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * profiler/ProfilerBytecodes.h:
+        * runtime/ConcurrentJITLock.h: Added.
+        (JSC):
+        * runtime/ExecutionHarness.h:
+        (JSC::replaceWithDeferredOptimizedCode):
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::findRegisterIndex):
+        (JSC::JSSegmentedVariableObject::addRegisters):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSSegmentedVariableObject):
+        * runtime/Options.h:
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::propertyTable):
+        * runtime/SymbolTable.h:
+        (SymbolTable):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        (JSC::VM::prepareToDiscardCode):
+        (JSC):
+        (JSC::VM::discardAllCode):
+        (JSC::VM::releaseExecutableMemory):
+        * runtime/VM.h:
+        (DFG):
+        (VM):
+
+2013-05-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CheckArrays should be hoisted
+        https://bugs.webkit.org/show_bug.cgi?id=116353
+
+        Performance neutral. This will be more important when we start depending on CheckArray for flat arrays.
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGAbstractState.cpp: Add ForwardCheckArray to wherever we had a CheckArray before.
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::isContravenedByStructure): Checks if the ArrayMode derived from a specific Structure 
+        would contradict the ArrayModes that would be filtered by the current ArrayMode. This is used to detect
+        if any specific CheckStructures would contradict our CheckArray so that we can defer to the CheckStructure's
+        judgment.
+        * dfg/DFGByteCodeParser.cpp: Fill in checkArrayHoistingFailed where we previously exited due to a BadIndexingType.
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArrayMode):
+        * dfg/DFGNodeType.h: New ForwardCheckArray node type.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp: Refactored most of TypeCheckHoistingPhase into separate functions, some 
+        of which are now generic to both CheckStructure and CheckArray hoisting while others are specific to one or the
+        other. Both of the non-zero CheckBallot values must be 1 because we use them as an index into an array of 
+        length 2 inside the VariableAccessData.
+        (CheckData): Moved structure outside of TypeCheckHoistingPhase so that ArrayTypeCheck and StructureTypeCheck
+        can access it. Also added new fields for tracking ArrayModes. We need the m_arrayModeIsValid because there 
+        isn't a good sentinel value for "this ArrayMode is invalid and meaningless" like there is for m_structure.
+        We need m_arrayModeHoistingOkay for when we want to permanently disable hoisting for that particular variable.
+        (JSC::DFG::CheckData::CheckData):
+        (JSC::DFG::CheckData::disableCheckArrayHoisting): Helper function for disabling CheckArray hoisting for a 
+        specific CheckData.
+        (JSC::DFG::TypeCheckHoistingPhase::run): We now do both CheckStructure and CheckArray hoisting, although we prefer
+        CheckStructure hoisting when given the possibility to do both.
+        (TypeCheckHoistingPhase):
+        (JSC::DFG::TypeCheckHoistingPhase::clearVariableVotes): Clears all of the VariableAccessData votes since they 
+        can only have two types of votes at any particular time.
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks): Very similar to identifyRedundantStructureChecks,
+        but with a few different nodes that are important, namely CheckArray (instead of CheckStructure) and the Arrayify-like
+        nodes always disable hoisting since they always change the IndexingType. 
+        (JSC::DFG::TypeCheckHoistingPhase::disableHoistingForVariablesWithInsufficientVotes):
+        (JSC::DFG::TypeCheckHoistingPhase::disableHoistingAcrossOSREntries):
+        (JSC::DFG::TypeCheckHoistingPhase::disableCheckArrayHoisting): Helper that looks up the CheckData for the 
+        specified variable and disables CheckArray hoisting on it.
+        (JSC::DFG::TypeCheckHoistingPhase::shouldConsiderForHoisting):
+        (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::TypeCheckHoistingPhase::noticeCheckArray):
+        (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheckAccountingForArrayMode): We want to take CheckStructure nodes
+        into account when hoisting CheckArrays, so we make sure that if we contradict what a CheckStructure says then we 
+        give up on hoisting the CheckArray.
+        (JSC::DFG::ArrayTypeCheck::isValidToHoist):
+        (ArrayTypeCheck): Structure that houses some of the specifics on how to hoist CheckArrays. This structure
+        is used a template argument to allow some of the very similar code to statically parameterized and reused
+        for both CheckStructure and CheckArray hoisting.
+        (JSC::DFG::ArrayTypeCheck::disableHoisting):
+        (JSC::DFG::ArrayTypeCheck::isContravenedByValue):
+        (JSC::DFG::ArrayTypeCheck::hasEnoughVotesToHoist):
+        (JSC::DFG::ArrayTypeCheck::hoistingPreviouslyFailed):
+        (JSC::DFG::StructureTypeCheck::isValidToHoist):
+        (StructureTypeCheck): Same as ArrayTypeCheck, but specific to CheckStructure hoisting.
+        (JSC::DFG::StructureTypeCheck::disableHoisting):
+        (JSC::DFG::StructureTypeCheck::isContravenedByValue):
+        (JSC::DFG::StructureTypeCheck::hasEnoughVotesToHoist):
+        (JSC::DFG::StructureTypeCheck::hoistingPreviouslyFailed):
+        * dfg/DFGUnificationPhase.cpp: Added merging of whether or not CheckArray hoisting failed.
+        (JSC::DFG::UnificationPhase::run):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeCheckArrayHoistingFailed):
+        (VariableAccessData):
+        (JSC::DFG::VariableAccessData::checkArrayHoistingFailed):
+        * runtime/Options.h:
+
+2013-05-17  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: getCTIStub should be thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=116126
+
+        Reviewed by Dan Bernstein.
+        
+        It's called from the compilation thread. Give it locks.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::ctiStub):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+        (JITThunks):
+
+2013-05-17  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Executable and CodeBlock should be aware of DFG::Plans that complete asynchronously
+        https://bugs.webkit.org/show_bug.cgi?id=116350
+
+        Reviewed by Oliver Hunt.
+        
+        This refactors compilation so that:
+        
+        - JITStubs knows exactly what the result of compilation was. For example, if
+          compilation was deferred, it will now know this.
+        
+        - The set of things that has to happen to install compiled code is now factored
+          out into JSC::installOptimizedCode().
+        
+        - A bunch of the code in Executable.cpp is now made more common to reduce code
+          duplication. For example, the heap heuristics stuff is now in one place.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::ProgramCodeBlock::compileOptimized):
+        (JSC::ProgramCodeBlock::replaceWithDeferredOptimizedCode):
+        (JSC):
+        (JSC::EvalCodeBlock::compileOptimized):
+        (JSC::EvalCodeBlock::replaceWithDeferredOptimizedCode):
+        (JSC::FunctionCodeBlock::compileOptimized):
+        (JSC::FunctionCodeBlock::replaceWithDeferredOptimizedCode):
+        (JSC::ProgramCodeBlock::jitCompileImpl):
+        (JSC::EvalCodeBlock::jitCompileImpl):
+        (JSC::FunctionCodeBlock::jitCompileImpl):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::jitCompile):
+        (ProgramCodeBlock):
+        (EvalCodeBlock):
+        (FunctionCodeBlock):
+        * dfg/DFGDesiredIdentifiers.cpp:
+        (JSC::DFG::DesiredIdentifiers::numberOfIdentifiers):
+        (DFG):
+        (JSC::DFG::DesiredIdentifiers::at):
+        * dfg/DFGDesiredIdentifiers.h:
+        (JSC):
+        (DesiredIdentifiers):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        (JSC::DFG::tryFinalizePlan):
+        (DFG):
+        * dfg/DFGDriver.h:
+        (DFG):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        (JSC::DFG::tryFinalizePlan):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::reallyAdd):
+        * dfg/DFGPlan.h:
+        (JSC):
+        (Plan):
+        (DFG):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriateImpl):
+        (JSC::jitCompileFunctionIfAppropriateImpl):
+        (JSC):
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * runtime/CompilationResult.cpp: Added.
+        (WTF):
+        (WTF::printInternal):
+        * runtime/CompilationResult.h: Added.
+        (JSC):
+        (WTF):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileOptimized):
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::EvalExecutable::replaceWithDeferredOptimizedCode):
+        (JSC):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::ProgramExecutable::replaceWithDeferredOptimizedCode):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeForCall):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeForConstruct):
+        * runtime/Executable.h:
+        (ScriptExecutable):
+        (EvalExecutable):
+        (ProgramExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::compileOptimizedFor):
+        (JSC::FunctionExecutable::replaceWithDeferredOptimizedCodeFor):
+        (JSC::FunctionExecutable::jitCompileFor):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecutionImpl):
+        (JSC::prepareFunctionForExecutionImpl):
+        (JSC):
+        (JSC::installOptimizedCode):
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+        (JSC::replaceWithDeferredOptimizedCode):
+
+2013-05-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        observeUseKindOnNode doesn't contain a case for KnownCellUse
+        https://bugs.webkit.org/show_bug.cgi?id=116130
+
+        This would just lead to us being overly conservative when deciding
+        whether we should unbox GetLocals with KnownCellUse UseKinds.
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+
+2013-05-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        fourthTier: infrequent segfault in DFGCodeBlocks::deleteUnmarkedJettisonedCodeBlocks()
+        https://bugs.webkit.org/show_bug.cgi?id=116134
+
+        CodeBlock and JITCode should be ThreadSafeRefCounted. We're going to
+        start using them on more threads very soon (with concurrent
+        compilation). This patch also fixes the specific place where we were
+        superfluously creating a RefPtr.
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getJITType):
+        * jit/JITCode.h:
+
+2013-05-16  Mark Lam  <mark.lam@apple.com>
+
+        Implement a probe mechanism for JIT generated code.
+        https://bugs.webkit.org/show_bug.cgi?id=115705.
+
+        Reviewed by Geoffrey Garen.
+
+        Edit: For C++ code, you can do debugging by adding printfs to your
+        code. For JIT generated code, you can now do the equivalent by
+        inserting a probe and have it emit a call to your probe function.
+
+        The probe is in the form of a MacroAssembler pseudo instruction.
+        It takes 3 arguments: a ProbeFunction, and 2 void* args.
+
+        When inserted into the JIT at some code generation site, the probe
+        pseudo "instruction" will emit a minimal amount of code to save the
+        stack pointer, 1 (or more) scratch register(s), and the probe
+        arguments into a ProbeContext record on the stack. The emitted code
+        will then call a probe trampoline to do the rest of the work, which
+        consists of:
+        1. saving the remaining registers into the ProbeContext.
+        2. calling the ProbeFunction, and passing it the ProbeContext pointer.
+        3. restoring the registers from the ProbeContext after the ProbeFunction
+           returns, and then returning to the JIT generated code.
+
+        The ProbeContext is stack allocated and is only valid for the duration
+        that the ProbeFunction is executing.
+
+        If the user supplied ProbeFunction alters the register values in the
+        ProbeContext, the new values will be installed into the registers upon
+        returning from the probe. This can be useful for some debugging or
+        testing purposes.
+
+        The probe mechanism is built conditional on USE(MASM_PROBE) which is
+        defined in config.h. USE(MASM_PROBE) will off by default.
+
+        This changeset only implements the probe mechanism for X86 and X86_64.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/MacroAssembler.h:
+        (MacroAssembler):
+        (JSC::MacroAssembler::shouldBlind):
+        (JSC::MacroAssembler::store32):
+        * assembler/MacroAssemblerX86.h:
+        (MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::trustedImm32FromPtr):
+        (JSC::MacroAssemblerX86::probe):
+        * assembler/MacroAssemblerX86Common.cpp: Added.
+        (JSC::MacroAssemblerX86Common::ProbeContext::dumpCPURegisters):
+        - CPU specific register dumper called by ProbeContext::dump().
+        (JSC::MacroAssemblerX86Common::ProbeContext::dump):
+        - Prints the ProbeContext to the DataLog.
+        * assembler/MacroAssemblerX86Common.h:
+        (MacroAssemblerX86Common):
+        (CPUState): Added.
+        (ProbeContext): Added.
+        * assembler/MacroAssemblerX86_64.h:
+        (MacroAssemblerX86_64):
+        (JSC::MacroAssemblerX86_64::trustedImm64FromPtr):
+        (JSC::MacroAssemblerX86_64::probe):
+        * assembler/X86Assembler.h:
+        * config.h: Added WTF_USE_MASM_PROBE flag.
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86Common.h: Added.
+        * jit/JITStubsX86_64.h:
+
+2013-05-15  Mark Lam  <mark.lam@apple.com>
+
+        Fix for broken 32-bit build in SpeculativeJIT::checkArray().
+        https://bugs.webkit.org/show_bug.cgi?id=116184.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+
+2013-05-15  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should separate link phase into things that must be done concurrently and things that must be done synchronously, and have a way of passing data from one to the other
+        https://bugs.webkit.org/show_bug.cgi?id=116060
+
+        Reviewed by Gavin Barraclough.
+        
+        This introduces the concept of a DFG::Plan, which corresponds to:
+        
+        - The data that the concurrent DFG or FTL need to start compiling a CodeBlock.
+          This mostly includes basic things like CodeBlock*, but also a list of
+          must-handle values for OSR entry.
+        
+        - The data that the synchronous linker need to link in code compiled by a
+          concurrent compilation thread. This is further encapsulated by DFG::Finalizer,
+          since the data, and the actions that need to be taken, are different in DFG
+          versus FTL. This patch also institutes the policy that the concurrent
+          compilation thread shall not use LinkBuffer::performFinalization(), since that
+          code assumes that it's running on the same thread that will actually run the
+          code.
+        
+        - The actions that need to be taken to compile code. In other words, most of the
+          code that previously lived in DFGDriver.cpp now lives in
+          DFG::Plan::compileInThread().
+        
+        - The actions that need to be taken when synchronously linking the code. This
+          includes "really" adding watchpoints and identifiers, checking watchpoint and
+          chain validity, and running the DFG::Finalizer.
+        
+        Currently, DFGDriver just creates a Plan and runs it synchronously. But in the
+        future, we will be able to malloc some Plans and enqueue them, and have the
+        concurrent thread dequeue them and call Plan::compileInThread().
+        
+        For now, this has no behavior or performance change.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::performFinalization):
+        * assembler/LinkBuffer.h:
+        (LinkBuffer):
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::~LinkBuffer):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::setFuturePossibleStructure):
+        (JSC::DFG::AbstractValue::filterFuturePossibleStructure):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        * dfg/DFGDriver.cpp:
+        (DFG):
+        (JSC::DFG::compile):
+        * dfg/DFGFailedFinalizer.cpp: Added.
+        (DFG):
+        (JSC::DFG::FailedFinalizer::FailedFinalizer):
+        (JSC::DFG::FailedFinalizer::~FailedFinalizer):
+        (JSC::DFG::FailedFinalizer::finalize):
+        (JSC::DFG::FailedFinalizer::finalizeFunction):
+        * dfg/DFGFailedFinalizer.h: Added.
+        (DFG):
+        (FailedFinalizer):
+        * dfg/DFGFinalizer.cpp: Added.
+        (DFG):
+        (JSC::DFG::Finalizer::Finalizer):
+        (JSC::DFG::Finalizer::~Finalizer):
+        * dfg/DFGFinalizer.h: Added.
+        (DFG):
+        (Finalizer):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dump):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (Graph):
+        (JSC::DFG::Graph::masqueradesAsUndefinedWatchpointIsStillValid):
+        (JSC::DFG::Graph::compilation):
+        (JSC::DFG::Graph::identifiers):
+        (JSC::DFG::Graph::watchpoints):
+        (JSC::DFG::Graph::chains):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::linkFunction):
+        (DFG):
+        (JSC::DFG::JITCompiler::disassemble):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::addLazily):
+        * dfg/DFGJITFinalizer.cpp: Added.
+        (DFG):
+        (JSC::DFG::JITFinalizer::JITFinalizer):
+        (JSC::DFG::JITFinalizer::~JITFinalizer):
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        * dfg/DFGJITFinalizer.h: Added.
+        (DFG):
+        (JITFinalizer):
+        * dfg/DFGPlan.cpp: Added.
+        (DFG):
+        (JSC::DFG::dumpAndVerifyGraph):
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::~Plan):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::isStillValid):
+        (JSC::DFG::Plan::reallyAdd):
+        (JSC::DFG::Plan::finalize):
+        * dfg/DFGPlan.h: Added.
+        (DFG):
+        (Plan):
+        (JSC::DFG::Plan::vm):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::identifierUID):
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        * ftl/FTLGeneratedFunction.h: Added.
+        (FTL):
+        * ftl/FTLJITFinalizer.cpp: Added.
+        (FTL):
+        (JSC::FTL::JITFinalizer::JITFinalizer):
+        (JSC::FTL::JITFinalizer::~JITFinalizer):
+        (JSC::FTL::JITFinalizer::finalize):
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h: Added.
+        (FTL):
+        (JITFinalizer):
+        (JSC::FTL::JITFinalizer::initializeExitThunksLinkBuffer):
+        (JSC::FTL::JITFinalizer::initializeEntrypointLinkBuffer):
+        (JSC::FTL::JITFinalizer::initializeCode):
+        (JSC::FTL::JITFinalizer::initializeFunction):
+        (JSC::FTL::JITFinalizer::initializeArityCheck):
+        (JSC::FTL::JITFinalizer::initializeJITCode):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLink.h:
+        (FTL):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::linkOSRExitsAndCompleteInitializationBlocks):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * ftl/FTLState.h:
+        (FTL):
+        (State):
+
+2013-05-14  Mark Lam  <mark.lam@apple.com>
+
+        Refactor JITStubs.cpp to move CPU specific parts out into their own files.
+        https://bugs.webkit.org/show_bug.cgi?id=116135.
+
+        Reviewed by Michael Saboff.
+
+        This mod only moves the CPU specific parts out. There is no code change.
+        Tested on debug builds of X86, X86_64, ARM and ARMv7. The SH4 and MIPS
+        ports are untested. Windows port also not tested.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITStubs.cpp:
+        (JSC::performPlatformSpecificJITAssertions):
+        * jit/JITStubsARM.h: Added.
+        (JSC::ctiTrampoline):
+        (JSC::ctiTrampolineEnd):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+        (JSC::performARMJITAssertions):
+        * jit/JITStubsARMv7.h: Added.
+        (JSC::ctiTrampoline):
+        (JSC::ctiVMThrowTrampoline):
+        (JSC::ctiOpThrowNotCaught):
+        (JSC::performARMv7JITAssertions):
+        * jit/JITStubsMIPS.h: Added.
+        (JSC::performMIPSJITAssertions):
+        * jit/JITStubsSH4.h: Added.
+        * jit/JITStubsX86.h: Added.
+        * jit/JITStubsX86_64.h: Added.
+
+2013-05-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        fourthTier: Segfault in jsc with simple test program when running with profile dumping enabled
+        https://bugs.webkit.org/show_bug.cgi?id=116082
+
+        It's crashing because CodeBlock::baselineVersion() doesn't know how to handle the case where 'this' is the 
+        baseline version but it hasn't been assigned to the m_blahCodeBlock field in BlahExecutable. The fix is to 
+        check if we're the baseline version in baselineVersion() and return this if so.
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::baselineVersion):
+
+2013-05-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename StructureCheckHoistingPhase to TypeCheckHoistingPhase
+        https://bugs.webkit.org/show_bug.cgi?id=115938
+
+        We're going to add some more types of check hoisting soon, so let's have
+        the right name here.
+
+        Rubber stamped by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp: Removed.
+        * dfg/DFGStructureCheckHoistingPhase.h: Removed.
+        * dfg/DFGTypeCheckHoistingPhase.cpp: Added.
+        (DFG):
+        (TypeCheckHoistingPhase):
+        (JSC::DFG::TypeCheckHoistingPhase::TypeCheckHoistingPhase):
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        (JSC::DFG::TypeCheckHoistingPhase::shouldConsiderForHoisting):
+        (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheck):
+        (CheckData):
+        (JSC::DFG::TypeCheckHoistingPhase::CheckData::CheckData):
+        (JSC::DFG::performTypeCheckHoisting):
+        * dfg/DFGTypeCheckHoistingPhase.h: Added.
+
+2013-05-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        SpeculativeJIT::checkArray should use the correct ExitKind
+        https://bugs.webkit.org/show_bug.cgi?id=115943
+
+        Currently it uses Uncountable, which gives us no information if we end up exiting due to a 
+        mismatched ClassInfo pointer. It should instead use BadType and should pass the correct 
+        JSValueSource and Node instead of passing empty values.
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+
+2013-05-11  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support Jump and ForceOSRExit
+        https://bugs.webkit.org/show_bug.cgi?id=115942
+
+        Reviewed by Oliver Hunt.
+        
+        Added two obvious nodes: Jump and ForceOSRExit. We already had everything we needed
+        to support them.
+        
+        Adding these increases our coverage a fair bit, and revealed a bug: LLVM's full
+        instruction selector currently appears to mishandle doubles in constant pools (or
+        just constant pools in general) with the small code model in the MCJIT. But switching
+        to FastISel "fixes" it. That's what this patch does, for now. This will probably
+        actually be permanent; the FastISel does pretty much everything we would ever want,
+        at least in the foreseeable future.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        (FTL):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileJSConstant):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileJump):
+        (JSC::FTL::LowerDFGToLLVM::compileReturn):
+        (JSC::FTL::LowerDFGToLLVM::compileForceOSRExit):
+        * runtime/Options.h:
+        (JSC):
+
+2013-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support CompareStrictEqConstant
+        https://bugs.webkit.org/show_bug.cgi?id=115941
+
+        Reviewed by Mark Hahnenberg.
+        
+        Pretty simple, but factors out the craziness of comparing against null or undefined
+        in a way that is reusable for both == and ===.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEqConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEqConstant):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+
+2013-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support CompareEqConstant
+        https://bugs.webkit.org/show_bug.cgi?id=115939
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        The most interesting part of this patch is the way I make it easier to deal with
+        the inputs to Phi functions. This adds the notion of ValueFromBlock, which you
+        can get by doing m_out.anchor(value). You can build up a vector of these, and then
+        pass them to m_out.phi(type, vector) in one go.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLAbbreviatedTypes.h: Added.
+        (FTL):
+        * ftl/FTLAbbreviations.h:
+        (FTL):
+        (JSC::FTL::addIncoming):
+        (JSC::FTL::buildPhi):
+        * ftl/FTLAbstractHeapRepository.h:
+        (FTL):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEqConstant):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (JSC::FTL::LowerDFGToLLVM::masqueradesAsUndefinedWatchpointIfIsStillValid):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::phi):
+        (Output):
+        (JSC::FTL::Output::anchor):
+        * ftl/FTLValueFromBlock.h: Added.
+        (FTL):
+        (ValueFromBlock):
+        (JSC::FTL::ValueFromBlock::ValueFromBlock):
+        (JSC::FTL::ValueFromBlock::value):
+        (JSC::FTL::ValueFromBlock::block):
+
+2013-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support CompareStrictEq
+        https://bugs.webkit.org/show_bug.cgi?id=115927
+
+        Reviewed by Mark Hahnenberg.
+        
+        Do the sensible thing, and make it so that for common cases, CompareEq is
+        implemented in terms of CompareStrictEq in the FTL backend. All of the cases
+        we currently support can be done this way.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+
+2013-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support Int32ToDouble
+        https://bugs.webkit.org/show_bug.cgi?id=115926
+
+        Reviewed by Mark Hahnenberg.
+        
+        This node exists mainly to help the DFG see that a node may have both an int
+        and a double representation. But in the FTL, nodes already have multiple
+        representations. So this is just a no-op for the FTL.
+        
+        I considered making it so that the node isn't even inserted if we're doing
+        FTL compilation, but that would have required a bunch of conditionalizing in
+        the DFG's optimization phases, which sort of expect this node to be present
+        and necessary.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble):
+        (LowerDFGToLLVM):
+
+2013-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support LogicalNot
+        https://bugs.webkit.org/show_bug.cgi?id=115924
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildNot):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileLogicalNot):
+        (LowerDFGToLLVM):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::bitNot):
+
+2013-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support CompareGreater, CompareLessEq, and CompareGreaterEq
+        https://bugs.webkit.org/show_bug.cgi?id=115923
+
+        Reviewed by Mark Hahnenberg.
+        
+        Also fixed a bug where double CompareLess would assert.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLess):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLessEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreater):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreaterEq):
+
+2013-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL CompareEq ObjectUse should handle masquerading
+        https://bugs.webkit.org/show_bug.cgi?id=115920
+
+        Reviewed by Mark Hahnenberg.
+        
+        We don't yet support watchpoints, but this does all the wiring right up to the
+        part where we would have emitted watchpoints. I've also written this in a way that
+        makes it easy to use the case where you would have anyway speculated non-masquerading
+        even if the watchpoint was invalidated.
+        
+        This is inherently racy, of course: but the only race here is that you might first
+        set the watchpoint, and then the watchpoint is invalidated, and then you compile rest
+        of the code in a way that doesn't need the watchpoint. That's fine, since the FTL
+        will remember that it had set the watchpoint and then cancel the compilation.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::int8Type):
+        * ftl/FTLAbstractHeapRepository.h:
+        (FTL):
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        (CommonValues):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::lowNonNullObject):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
+        (JSC::FTL::LowerDFGToLLVM::masqueradesAsUndefinedWatchpointIsStillValid):
+        (JSC::FTL::LowerDFGToLLVM::masqueradesAsUndefinedWatchpointIfIsStillValid):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::constInt8):
+        (JSC::FTL::Output::load8):
+        (JSC::FTL::Output::isZero8):
+        (JSC::FTL::Output::notZero8):
+        (JSC::FTL::Output::testIsZero8):
+        (JSC::FTL::Output::testNonZero8):
+
+2013-05-09  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG shouldn't allocate in the GC heap
+        https://bugs.webkit.org/show_bug.cgi?id=115598
+
+        Reviewed by Geoffrey Garen.
+        
+        I believe that we've now fixed this, and this patch just adds the relevant assertion.
+
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::JSCell):
+
+2013-05-09  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: CodeBlock should be RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=115594
+
+        Reviewed by Geoffrey Garen.
+        
+        This makes it possible to have the currently-being-compiled CodeBlock not be
+        installed in Executable, while also allowing it to point to its intended
+        alternative(). So long as we were using ownership and not reference counting, it
+        would have been difficult to have both CodeBlock::m_alternative and
+        Executable::m_codeBlockForBlah point to the previous CodeBlock.
+        
+        I also took the opportunity to clean up a bunch of code that appears to have
+        rotted.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::operator==):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::releaseAlternative):
+        (JSC::CodeBlock::setAlternative):
+        (CodeBlock):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::~DFGCodeBlocks):
+        (JSC::DFGCodeBlocks::jettison):
+        (JSC::DFGCodeBlocks::deleteUnmarkedJettisonedCodeBlocks):
+        * heap/DFGCodeBlocks.h:
+        (DFGCodeBlocks):
+        * heap/Heap.cpp:
+        (JSC::Heap::jettisonDFGCodeBlock):
+        * heap/Heap.h:
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * runtime/Executable.cpp:
+        (JSC::jettisonCodeBlock):
+        (JSC::EvalExecutable::jitCompile):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::jitCompile):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::jitCompileForCall):
+        (JSC::FunctionExecutable::jitCompileForConstruct):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (EvalExecutable):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::codeBlockFor):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+
+2013-05-09  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should have its own notion of StructureChain, and it should be possible to validate it after compilation finishes
+        https://bugs.webkit.org/show_bug.cgi?id=115841
+
+        Reviewed by Oliver Hunt.
+        
+        This adds IntendedStructureChain, which is like StructureChain, except that it holds a bit
+        more information and can be validated independantly of its owning Structure and lexical
+        GlobalObject, since it remembers both of those things. It's also malloc'd and RefCounted
+        rather than GC'd, so it can be allocated in a concurrent compilation thread.
+        
+        Gave this class a bunch of methods to allow the following idiom:
+        
+        - Snapshot a structure chain concurrently. This structure chain may end up being
+          wrong in case of races, but in that case we will find out when we try to validate
+          it.
+        
+        - Perform validation on the structure chain itself, without recomputing the chain.
+          Previously, many chain validation methods (prototypeChainMayInterceptStoreTo() for
+          example) recomputed the chain, and hence, were inherently racy: you could build one
+          chain and then validate against a different chain, and hence not realize that the
+          chain you did build was actually broken for your purposes, because the chain you
+          checked was a different one.
+        
+        - Validate that the chain is still the right one at any time, allowing the cancellation
+          of compilation if there was a race.
+        
+        Also added DFG::DesiredStructureChains, which tracks those intended structure chains that
+        the compiler had already chosen to use. If any of those are invalid at link time, throw
+        out the compilation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::chain):
+        (GetByIdStatus):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (JSC::PutByIdStatus::structureChain):
+        (PutByIdStatus):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDesiredStructureChains.cpp: Added.
+        (DFG):
+        (JSC::DFG::DesiredStructureChains::DesiredStructureChains):
+        (JSC::DFG::DesiredStructureChains::~DesiredStructureChains):
+        (JSC::DFG::DesiredStructureChains::areStillValid):
+        * dfg/DFGDesiredStructureChains.h: Added.
+        (DFG):
+        (DesiredStructureChains):
+        (JSC::DFG::DesiredStructureChains::addLazily):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isStillValid):
+        (DFG):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::linkFunction):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * runtime/IntendedStructureChain.cpp: Added.
+        (JSC):
+        (JSC::IntendedStructureChain::IntendedStructureChain):
+        (JSC::IntendedStructureChain::~IntendedStructureChain):
+        (JSC::IntendedStructureChain::isStillValid):
+        (JSC::IntendedStructureChain::matches):
+        (JSC::IntendedStructureChain::chain):
+        (JSC::IntendedStructureChain::mayInterceptStoreTo):
+        (JSC::IntendedStructureChain::isNormalized):
+        (JSC::IntendedStructureChain::terminalPrototype):
+        * runtime/IntendedStructureChain.h: Added.
+        (JSC):
+        (IntendedStructureChain):
+        (JSC::IntendedStructureChain::head):
+        (JSC::IntendedStructureChain::size):
+        (JSC::IntendedStructureChain::at):
+        (JSC::IntendedStructureChain::operator[]):
+        (JSC::IntendedStructureChain::last):
+        * runtime/Structure.cpp:
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::storedPrototypeObject):
+        (JSC):
+        (JSC::Structure::storedPrototypeStructure):
+
+2013-05-06  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken 32-bit build + some clean up in JITStubs.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=115684.
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITStubs.cpp:
+        - removed unneeded stubs for CPU(X86_64) && USE(JSVALUE32_64).
+        - added some line breaks to more clearly delineate between
+          ports/configurations of stub code.
+
+2013-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in r149527 with crash fixed.
+
+        Reviewed by Oliver Hunt.
+
+            Rationalized 'this' value conversion
+            https://bugs.webkit.org/show_bug.cgi?id=115542
+
+            This fixes a bunch of Sputnik tests, and some bad pointer access.
+
+            The new model is that the callee always performs 'this' value conversion.
+
+            My ultimate goal is to break up resolve_with_this into single-result 
+            opcodes. This step avoids having to add a special form of convert_this
+            that distinguishes callers vs callees.
+
+            Only the callee knows whether it uses 'this' and/or whether 'this'
+            conversion should use StrictMode, so it's most natural to perform
+            convert_this in the callee. 
+
+            * API/JSCallbackFunction.cpp:
+            (JSC::JSCallbackFunction::call): Perform 'this' value conversion for
+            our callee, since it may observe 'this'.
+
+            * API/JSCallbackObjectFunctions.h:
+            (JSC::::call): Ditto.
+
+            * API/JSContextRef.cpp:
+            (JSGlobalContextCreateInGroup): Use a proxy 'this' object in global scope
+            even when we're not in the browser. This eliminates some odd cases where
+            API clients used to be able to get a direct reference to an environment
+            record. Now, any reference to an environment record unambiguously means
+            that the VM resolved that record in the scope chain.
+
+            (JSContextGetGlobalObject): Removed an incorrect comment. Now that JSC
+            participates in the proxy 'this' object scheme, the behavior is not
+            WebCore-only.
+
+            * API/JSObjectRef.cpp:
+            (JSObjectSetPrototype):
+            (JSObjectCallAsFunction): Don't perform 'this' value conversion in the
+            caller; the callee will do it if needed.
+
+            * JavaScriptCore.order: Order!
+
+            * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+            * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+            What are the chances that this will work?
+
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::dumpBytecode):
+            (JSC::CodeBlock::CodeBlock): Renamed convert_this to to_this, to match our
+            other conversion opcodes.
+
+            * bytecode/CodeOrigin.h:
+            (CodeOrigin):
+            (InlineCallFrame):
+            (JSC::CodeOrigin::codeOriginOwner): Use the more precise type for our
+            executable, so compilation can discover where we're in strict mode.
+
+            * bytecode/Opcode.h:
+            (JSC::padOpcodeName): Updated for rename.
+
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::BytecodeGenerator): Always emit to_this when
+            'this' is in use -- strict mode still needs to convert environment
+            records to 'undefined'.
+
+            * dfg/DFGAbstractState.cpp:
+            (JSC::DFG::AbstractState::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGCapabilities.h:
+            (JSC::DFG::canCompileOpcode): Updated for renames.
+
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode): Tightened up this code to consider
+            strict mode (a new requirement) and to consider the global object (which
+            was always a requirement).
+
+            * dfg/DFGGraph.h:
+            (JSC::DFG::Graph::globalThisObjectFor):
+            (JSC::DFG::Graph::executableFor):
+            * dfg/DFGNodeType.h:
+            * dfg/DFGOperations.cpp:
+            * dfg/DFGOperations.h:
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            (JSC::DFG::PredictionPropagationPhase::propagate):
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile): Ditto.
+
+            * interpreter/Interpreter.cpp:
+            (JSC::eval):
+            (JSC::Interpreter::execute):
+            (JSC::Interpreter::executeCall):
+            * interpreter/Interpreter.h: Don't ASSERT about 'this' -- it's our job
+            to fix it up if needed.
+
+            * jit/JIT.cpp:
+            (JSC::JIT::privateCompileMainPass):
+            (JSC::JIT::privateCompileSlowCases):
+            * jit/JIT.h:
+            (JIT):
+            * jit/JITOpcodes.cpp:
+            (JSC::JIT::emit_op_to_this):
+            (JSC::JIT::emitSlow_op_to_this):
+            * jit/JITOpcodes32_64.cpp:
+            (JSC::JIT::emit_op_to_this):
+            (JSC::JIT::emitSlow_op_to_this):
+            * jit/JITStubs.cpp:
+            (JSC::DEFINE_STUB_FUNCTION):
+            * jit/JITStubs.h: Removed special-case code for various kinds of
+            conversions. The baseline fast path is now final objects only. It hurt
+            my brain to think through how to keep the other fast paths working, and
+            our benchmarks do not object.
+
+            * llint/LLIntData.cpp:
+            (JSC::LLInt::Data::performAssertions):
+            * llint/LLIntSlowPaths.cpp:
+            (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+            * llint/LLIntSlowPaths.h:
+            (LLInt):
+            * llint/LowLevelInterpreter.asm:
+            * llint/LowLevelInterpreter32_64.asm:
+            * llint/LowLevelInterpreter64.asm: Updated for renames. Removed some
+            special case code, as in the JIT above.
+
+            * profiler/ProfileGenerator.cpp:
+            (JSC::ProfileGenerator::addParentForConsoleStart):
+            * runtime/CallData.cpp:
+            (JSC::call):
+            * runtime/ClassInfo.h:
+            (MethodTable):
+            * runtime/Completion.cpp:
+            (JSC::evaluate):
+            * runtime/DatePrototype.cpp:
+            (JSC::dateProtoFuncToJSON): The callee performs 'this' conversion, not
+            the caller.
+
+            * runtime/GetterSetter.cpp:
+            (JSC::callGetter):
+            (JSC::callSetter):
+            * runtime/GetterSetter.h: Added helper functions for invoking getters
+            and setters from C++ code, since this was duplicated in a bunch of
+            places.
+
+            * runtime/JSActivation.cpp:
+            (JSC::JSActivation::toThis):
+            * runtime/JSActivation.h:
+            (JSActivation):
+            * runtime/JSCJSValue.cpp:
+            (JSC::JSValue::toThisSlowCase):
+            (JSC::JSValue::putToPrimitive):
+            * runtime/JSCJSValue.h:
+            (JSValue):
+            * runtime/JSCJSValueInlines.h:
+            (JSC::JSValue::toThis):
+            * runtime/JSCell.cpp:
+            (JSC::JSCell::toThis):
+            * runtime/JSCell.h:
+            (JSCell):
+            * runtime/JSGlobalObject.cpp:
+            (JSC::JSGlobalObject::toThis):
+            * runtime/JSGlobalObject.h:
+            (JSGlobalObject): Filled out runtime support for converting 'this'
+            values as needed, according to the appropriate strictness, using
+            helper functions where getter/setter code was duplicated.
+
+            * runtime/JSGlobalObjectFunctions.cpp:
+            (JSC::globalFuncProtoGetter):
+            (JSC::globalFuncProtoSetter): Perform 'this' value conversion, since we
+            observe 'this'.
+
+            * runtime/JSNameScope.cpp:
+            (JSC::JSNameScope::toThis):
+            * runtime/JSNameScope.h:
+            (JSNameScope): Same as JSActivation.
+
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::put):
+            (JSC::JSObject::setPrototypeWithCycleCheck): Bug fix. Don't peform
+            'this' value conversion in this helper function. The __proto__
+            setter does this for us, since it's the function that logically observes
+            'this' -- and we can ASSERT so. Also, the previous code used
+            "globalExec()->thisValue()", which is a read past the beginning of a
+            buffer! I don't think this ever worked on purpose.
+
+            (JSC::JSObject::toThis):
+            (JSC::JSObject::fillGetterPropertySlot):
+            * runtime/JSObject.h:
+            (JSC::JSObject::inlineGetOwnPropertySlot):
+            * runtime/JSScope.cpp:
+            (JSC::JSScope::resolveWithThis):
+            * runtime/JSString.cpp:
+            (JSC::JSString::toThis):
+            * runtime/JSString.h:
+            (JSString):
+            * runtime/PropertySlot.cpp:
+            (JSC::PropertySlot::functionGetter):
+            * runtime/PropertySlot.h:
+            (JSC):
+            (JSC::PropertySlot::setGetterSlot):
+            (JSC::PropertySlot::setCacheableGetterSlot):
+            * runtime/SparseArrayValueMap.cpp:
+            (JSC::SparseArrayEntry::get):
+            (JSC::SparseArrayEntry::put):
+            * runtime/StrictEvalActivation.cpp:
+            (JSC::StrictEvalActivation::toThis):
+            * runtime/StrictEvalActivation.h:
+            (StrictEvalActivation): Ditto.
+
+2013-05-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG::ByteCodeParser doesn't need ExecState*
+        https://bugs.webkit.org/show_bug.cgi?id=115582
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (ByteCodeParser):
+        (JSC::DFG::parse):
+        * dfg/DFGByteCodeParser.h:
+        (DFG):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+
+2013-05-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Profiler should be thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=115445
+
+        Reviewed by Geoffrey Garen.
+        
+        Change the Profiler::Database API for Compilation creation so that we don't add
+        it to the Database until it's completely constructed. This prevents the Database
+        from seeing Compilations that are being concurrently constructed.
+        
+        Change the Profiler::Database itself to do locking for creation of Bytecodes and
+        for modifying the map. This map may be consulted by both the main thread and the
+        concurrent thread.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::linkFunction):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * profiler/ProfilerBytecodes.h:
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        (JSC::Profiler::Database::notifyDestruction):
+        (JSC::Profiler::Database::addCompilation):
+        * profiler/ProfilerDatabase.h:
+        (Database):
+
+2013-05-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG tries to ref/deref StringImpls in a ton of places
+        https://bugs.webkit.org/show_bug.cgi?id=115300
+
+        Reviewed by Geoffrey Garen.
+        
+        Change any code transitively called from DFG compilation to use StringImpl*
+        directly instead of String, Identifier, or PropertyName. I use the convention
+        of passing "StringImpl* uid" instead of an Identifier or PropertyName.
+        
+        Switch over any code transitively called from DFG compilation to use CStrings
+        whenever possible for all of its debug dumping.
+        
+        This makes it possible to compile things without hitting the ref/deref
+        assertion in StringImpl.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::inferredName):
+        (JSC::CodeBlock::sourceCodeForTools):
+        (JSC::CodeBlock::sourceCodeOnOneLine):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        (JSC::pointerToSourceString):
+        (JSC::CodeBlock::printUnaryOp):
+        (JSC::CodeBlock::printBinaryOp):
+        (JSC::CodeBlock::printConditionalJump):
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::dumpStructure):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::printPutByIdOp):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/CodeBlockHash.cpp:
+        (JSC::CodeBlockHash::CodeBlockHash):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::inferredName):
+        * bytecode/CodeOrigin.h:
+        (InlineCallFrame):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC):
+        (GetByIdStatus):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (JSC):
+        (PutByIdStatus):
+        * bytecode/ReduceWhitespace.cpp:
+        (JSC::reduceWhitespace):
+        * bytecode/ReduceWhitespace.h:
+        (JSC):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForStructure):
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.h:
+        (JSC):
+        (ResolveGlobalStatus):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDesiredIdentifiers.cpp: Added.
+        (DFG):
+        (JSC::DFG::DesiredIdentifiers::DesiredIdentifiers):
+        (JSC::DFG::DesiredIdentifiers::~DesiredIdentifiers):
+        (JSC::DFG::DesiredIdentifiers::addLazily):
+        (JSC::DFG::DesiredIdentifiers::reallyAdd):
+        * dfg/DFGDesiredIdentifiers.h: Added.
+        (DFG):
+        (DesiredIdentifiers):
+        (JSC::DFG::DesiredIdentifiers::numberOfIdentifiers):
+        (JSC::DFG::DesiredIdentifiers::at):
+        (JSC::DFG::DesiredIdentifiers::operator[]):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryBuildGetByIDList):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::identifierUID):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * parser/SourceCode.cpp: Added.
+        (JSC):
+        (JSC::SourceCode::toUTF8):
+        * parser/SourceCode.h:
+        (SourceCode):
+        * profiler/ProfilerBytecodes.cpp:
+        (JSC::Profiler::Bytecodes::toJS):
+        * profiler/ProfilerBytecodes.h:
+        (JSC::Profiler::Bytecodes::inferredName):
+        (JSC::Profiler::Bytecodes::sourceCode):
+        (Bytecodes):
+        * runtime/Identifier.h:
+        (JSC::Identifier::utf8):
+        (JSC):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructureImpl):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
+        (JSC::Structure::getConcurrently):
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::getConcurrently):
+
+2013-05-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Structure transition table keys don't have to ref their StringImpl's
+        https://bugs.webkit.org/show_bug.cgi?id=115525
+
+        Reviewed by Geoffrey Garen.
+        
+        The structure transition table basically maps string to structure. The string is
+        always also stored, and ref'd, in the structure in Structure::m_nameInPrevious.
+        m_nameInPrevious is never mutated, and never cleared. The string cannot die unless
+        the structure dies. If the structure dies, then that entry in the transition map
+        becomes a zombie anyway and we will detect this separately.
+        
+        So, we don't need to use RefPtr<StringImpl>. We can just use StringImpl*.
+        
+        This also fixes a goof where we were getting the StringImpl's hash rather than
+        using a pointer hash. Not only is the latter faster, but it prevents my change
+        from leading to crashes: with my change we can have zombie keys, not just zombie
+        values. They will exist only until the next map mutation, which will clear them.
+        Lookups will work fine because the lookup routine will reject zombies. But it
+        does mean that the HashMap will have to deal with dangling StringImpl*'s; all it
+        takes to make this work is to ensure that the HashMap itself never dereferences
+        them. Using a pointer hash rather than StringImpl::existingHash() accomplishes
+        this.
+        
+        This also ensures that we don't accidentally call ref() or deref() from the
+        compilation thread, if the compilation thread inspects the transition table.
+        
+        And no, we wouldn't have been able to use the HashMap<RefPtr<...>, ...>
+        specialization, because the transition table is actually
+        HashMap<pair<RefPtr<StringImpl>, unsigned>, ...>: hence that specialization
+        doesn't kick in. We could have written a new specialization or something, but
+        that seemed like a lot of work given that we don't need the table to be ref'ing
+        the strings anyways.
+
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::add):
+        * runtime/StructureTransitionTable.h:
+        (StructureTransitionTable):
+        (Hash):
+        (JSC::StructureTransitionTable::Hash::hash):
+
+2013-05-01  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Structure::addPropertyTransitionToExistingStructure should be thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=115468
+
+        Reviewed by Geoffrey Garen.
+        
+        This makes the main thread modify the transition table while holding a lock. Note
+        that the GC might modify its weak pointers without locking, but the GC will lock out
+        the compilation thread anyway. The map will then only reshape in response to add()
+        and set(), which happen while holding a lock.
+        
+        This allows the compilation thread to now query transition tables safely, provided it
+        holds a lock when doing so.
+        
+        Also changed LLVM asm printer initialization to just initialize the X86 one. It makes
+        sense for us to just initialize the asm printer(s) that we actually use; you could
+        imagine us being linked to a system LLVM that has cross-compilation support; there is
+        no point in the WebKit or JSC process doing work to initialize all of those targets.
+        That part was rubber stamped by Mark Hahnenberg.
+        
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransitionToExistingStructureImpl):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC):
+        (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::nonPropertyTransition):
+        * runtime/Structure.h:
+        (Structure):
+
+2013-04-30  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Structure::getConcurrently() may be called from for uncacheable dictionaries, and this is safe
+        https://bugs.webkit.org/show_bug.cgi?id=115464
+
+        Reviewed by Oliver Hunt and Geoffrey Garen.
+        
+        This can happen for example transitively from JSObject::put(). getCurrently() does
+        work for uncacheable dictionaries; it just has the obvious race that right after it
+        returns, the result it returned may no longer be right. This isn't an issue if it was
+        called on the main thread, and may not be an issue in some other situations.
+        
+        So, we should just remove the assertion, since the only thing it buys us is crashes.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::getConcurrently):
+
+2013-04-30  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Don't link gtest into JavaScriptCore
+
+        Rubber stamped by Mark Rowe.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2013-04-29  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: String::utf8() should also be available as StringImpl::utf8() so that you don't have to ref() a StringImpl just to get its utf8()
+        https://bugs.webkit.org/show_bug.cgi?id=115393
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+
+2013-07-16  Oliver Hunt <oliver@apple.com>
+
+        Merge dfgFourthTier r149301
+
+    2013-04-28  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: ASSERT that commonly used not-thread-safe methods in the runtime are not being called during compilation
+        https://bugs.webkit.org/show_bug.cgi?id=115297
+
+        Reviewed by Geoffrey Garen.
+        
+        Put in assertions that we're not doing bad things in compilation threads. Also
+        factored compilation into compile+link so that even though we don't yet have
+        concurrent compilation, we can be explicit about which parts of DFG work are
+        meant to be concurrent, and which aren't.
+        
+        Also fix a handful of bugs found by these assertions.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForStructure):
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::add):
+        (JSC::InlineWatchpointSet::inflateSlow):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::~JITCompiler):
+        (DFG):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::linkFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLCompile.h:
+        (FTL):
+        * ftl/FTLLink.cpp: Added.
+        (FTL):
+        (JSC::FTL::compileEntry):
+        (JSC::FTL::link):
+        * ftl/FTLLink.h: Added.
+        (FTL):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * ftl/FTLState.h:
+        (FTL):
+        (State):
+        * runtime/Structure.cpp:
+        (JSC::Structure::get):
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+        * runtime/Structure.h:
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+
+2013-04-27  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support double variables
+        https://bugs.webkit.org/show_bug.cgi?id=113624
+
+        Reviewed by Geoffrey Garen.
+        
+        Made all of the operations that the FTL already supports, also support doubles.
+        OSR exit already basically had everything it needed, so no changes there. This
+        mostly just glues together bits of DFG IR to LLVM IR, in a straight-forward way.
+
+        * ftl/FTLAbbreviations.h:
+        (FTL):
+        (JSC::FTL::doubleType):
+        (JSC::FTL::constReal):
+        (JSC::FTL::buildPhi):
+        (JSC::FTL::addIncoming):
+        (JSC::FTL::buildFAdd):
+        (JSC::FTL::buildFSub):
+        (JSC::FTL::buildFMul):
+        (JSC::FTL::buildFNeg):
+        (JSC::FTL::buildSIToFP):
+        (JSC::FTL::buildUIToFP):
+        (JSC::FTL::buildBitCast):
+        (JSC::FTL::buildFCmp):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        (CommonValues):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileAdd):
+        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLess):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::isCellOrMisc):
+        (JSC::FTL::LowerDFGToLLVM::unboxDouble):
+        (JSC::FTL::LowerDFGToLLVM::boxDouble):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateNumber):
+        (JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::constDouble):
+        (Output):
+        (JSC::FTL::Output::phi):
+        (JSC::FTL::Output::doubleAdd):
+        (JSC::FTL::Output::doubleSub):
+        (JSC::FTL::Output::doubleMul):
+        (JSC::FTL::Output::doubleNeg):
+        (JSC::FTL::Output::intToFP):
+        (JSC::FTL::Output::intToDouble):
+        (JSC::FTL::Output::unsignedToFP):
+        (JSC::FTL::Output::unsignedToDouble):
+        (JSC::FTL::Output::bitCast):
+        (JSC::FTL::Output::loadDouble):
+        (JSC::FTL::Output::storeDouble):
+        (JSC::FTL::Output::doubleEqual):
+        (JSC::FTL::Output::doubleNotEqualOrUnordered):
+        (JSC::FTL::Output::doubleLessThan):
+        (JSC::FTL::Output::doubleLessThanOrEqual):
+        (JSC::FTL::Output::doubleGreaterThan):
+        (JSC::FTL::Output::doubleGreaterThanOrEqual):
+        (JSC::FTL::Output::doubleEqualOrUnordered):
+        (JSC::FTL::Output::doubleNotEqual):
+        (JSC::FTL::Output::doubleLessThanOrUnordered):
+        (JSC::FTL::Output::doubleLessThanOrEqualOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrEqualOrUnordered):
+        (JSC::FTL::Output::testIsZero64):
+
+2013-04-27  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: SymbolTable should be thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=115301
+
+        Reviewed by Geoffrey Garen.
+        
+        Makes SymbolTable thread-safe. Relies on SymbolTableEntry already being immutable,
+        other than the WatchpointSet; but the WatchpointSet already has a righteous
+        concurrency protocol. So, this patch just protects the SymbolTable's HashMap.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::nameForRegister):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::addGlobalVar):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnNonIndexPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::~SymbolTable):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::find):
+        (JSC::SymbolTable::get):
+        (JSC::SymbolTable::inlineGet):
+        (JSC::SymbolTable::begin):
+        (JSC::SymbolTable::end):
+        (JSC::SymbolTable::size):
+        (JSC::SymbolTable::add):
+        (JSC::SymbolTable::set):
+        (JSC::SymbolTable::contains):
+
+2013-04-26  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: WatchpointSet should make racy uses easier to reason about
+        https://bugs.webkit.org/show_bug.cgi?id=115299
+
+        Reviewed by Anders Carlsson.
+        
+        The compiler often does things like:
+
+        1c) Observe something that would imply that a WatchpointSet ought to be invalid
+
+        2c) Check that it is invalid
+
+        The main thread often does things like:
+
+        1m) Fire the watchpoint set
+
+        2m) Do some other thing that would cause the compiler to assume that the WatchpointSet
+        ought to be invalid
+
+        An example is structure transitions, where (1c) is the compiler noticing that a
+        put_by_id inline cache is in a transition state, with the source structure being S;
+        (2c) is the compiler asserting that S's watchpoint set is invalid; (1m) is the main
+        thread firing S's watchpoint set before it does the first transition away from S; and
+        (2m) is the main thread caching the put_by_id transition away from S.
+
+        This is totally fine, except that (1c) and (2c), and (1m) and (2m) could be reordered.
+        Probably, in most cases, this ought to do enough things that the main thread probably
+        already has some fencing. But the compiler thread definitely doesn't have fencing. In
+        any case, we should play it safe and just have additional fencing in all of the
+        relevant places.
+
+        We already have some idioms to put load-load and store-store fences in the right
+        places. But this change just makes WatchpointSet take care of this for us, thus
+        reducing the chances of us getting this wrong.
+
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::notifyWriteSlow):
+        * bytecode/Watchpoint.h:
+        (WatchpointSet):
+        (JSC::WatchpointSet::isStillValid):
+        (JSC::WatchpointSet::hasBeenInvalidated):
+        (JSC::InlineWatchpointSet::hasBeenInvalidated):
+        (JSC::InlineWatchpointSet::notifyWrite):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGDesiredWatchpoints.h:
+        (JSC::DFG::GenericDesiredWatchpoints::shouldAssumeMixedState):
+
+2013-07-16  Oliver Hunt <oliver@apple.com>
+
+        Merge dfgFourthTier r149233
+
+    2013-04-26  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: CFA should defend against results seeming inconsistent due to a watchpoint firing during compilation
+        https://bugs.webkit.org/show_bug.cgi?id=115083
+
+        Reviewed by Geoffrey Garen.
+        
+        This ruggedizes our racyness with respect to watchpoints. We want to be able to assert,
+        in some places, that a watchpoint-based optimization has only occurred if the
+        watchpoint set was still valid. But currently we *can* soundly do watchpoint-based
+        optimizations even for invalid watchpoints, so long as we recorded in the IR that we
+        had done so; this will then lead to the code being insta-jettisoned after compilation
+        completes. Obviously, we don't want this to happen often - but we do want to allow it
+        precisely in the case of watchpoint races.
+        
+        This adds the ability to assert that we hadn't over-watchpointed ourselves, with and
+        exemption for races.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::setFuturePossibleStructure):
+        (JSC::DFG::AbstractValue::filterFuturePossibleStructure):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        * dfg/DFGDesiredWatchpoints.h:
+        (GenericDesiredWatchpoints):
+        (JSC::DFG::GenericDesiredWatchpoints::isStillValid):
+        (JSC::DFG::GenericDesiredWatchpoints::shouldAssumeMixedState):
+        (JSC::DFG::GenericDesiredWatchpoints::isValidOrMixed):
+        (JSC::DFG::DesiredWatchpoints::isStillValid):
+        (JSC::DFG::DesiredWatchpoints::shouldAssumeMixedState):
+        (JSC::DFG::DesiredWatchpoints::isValidOrMixed):
+        (DesiredWatchpoints):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::masqueradesAsUndefinedWatchpointIsStillValid):
+        (Graph):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addLazily):
+        (JITCompiler):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::masqueradesAsUndefinedWatchpointIsStillValid):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpointForMasqueradesAsUndefined):
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLState.h:
+        (State):
+
+2013-04-23  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: AbstractValue methods that deal with watchpoints should have access to Graph, so that in debug mode, Graph can track the history of watchpoint states and detect races
+        https://bugs.webkit.org/show_bug.cgi?id=115084
+
+        Reviewed by Geoffrey Garen.
+        
+        The idea is that as part of https://bugs.webkit.org/show_bug.cgi?id=115083, I'll have
+        Graph record the initial state of a watchpoint at the time that we decide to take
+        advantage of it; then I will use this to disable any watchpoint-related assertions
+        in debug mode. Note that this "watchpoint cache" will only be maintained in debug
+        mode, so there will be no release performance implications. But to do this, I need to
+        ensure that all of the places that reason about watchpoints have access to Graph.
+        For example, I'll want AbstractValue::setFuturePossibleStructure to record the state
+        of the watchpoint in Graph so that subsequent assertions can check if the watchpoint's
+        state had changed since that decision was made.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        (JSC::DFG::AbstractState::executeEffects):
+        (JSC::DFG::AbstractState::mergeStateAtTail):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::trySetConstant):
+        * dfg/DFGAbstractValue.cpp: Added.
+        (DFG):
+        (JSC::DFG::AbstractValue::setMostSpecific):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::setFuturePossibleStructure):
+        (JSC::DFG::AbstractValue::filterFuturePossibleStructure):
+        (JSC::DFG::AbstractValue::dump):
+        * dfg/DFGAbstractValue.h:
+        (DFG):
+        (AbstractValue):
+        (JSC::DFG::AbstractValue::setType):
+        (JSC::DFG::AbstractValue::filterByValue):
+
+2013-07-16  Oliver Hunt <oliver@apple.com>
+
+        Merge dfgFourthTier r148936
+
+    2013-04-22  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Create an equivalent of Structure::get() that can work from a compilation thread
+        https://bugs.webkit.org/show_bug.cgi?id=114987
+
+        Reviewed by Geoffrey Garen.
+        
+        This completes the work started by r148570. That patch made it possible to do
+        Structure::get() without modifying Structure. This patch takes this further, and
+        makes this thread-safe (for non-uncacheable-dictionaries) via
+        Structure::getConcurrently(). This method not only doesn't modify Structure, but
+        also ensures that any concurrent attempts to add to, remove from, or steal the
+        table from that structure doesn't mess up the result of the call. The call may
+        return invalidOffset even if a property is *just* about to be added, but it will
+        never do the reverse: if it returns a property then you can be sure that the
+        structure really does have that property and always will have it.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+        * runtime/PropertyMapHashTable.h:
+        (PropertyTable):
+        (JSC::PropertyTable::findConcurrently):
+        (JSC):
+        (JSC::PropertyTable::add):
+        (JSC::PropertyTable::remove):
+        (JSC::PropertyTable::reinsert):
+        (JSC::PropertyTable::rehash):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/Structure.cpp:
+        (JSC::Structure::findStructuresAndMapForMaterialization):
+        (JSC::Structure::getConcurrently):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::getConcurrently):
+
+2013-07-16  Oliver Hunt <oliver@apple.com>
+
+        Merge dfgFourthTier r148850
+
+    2013-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: WebKit's build system should relink JavaScriptCore if LLVM's libraries changed but its headers didn't
+        https://bugs.webkit.org/show_bug.cgi?id=114926
+
+        Reviewed by Geoffrey Garen.
+        
+        Use a phony file that includes a phony header to force JavaScriptCore to be relinked
+        if necessary. The external LLVM-importing scripts will touch the header if the libraries
+        are known to have changed.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/WebKitLLVMLibraryAnchor.cpp: Added.
+
+2013-07-16  Oliver Hunt <oliver@apple.com>
+
+        Merge dfgFourthTier r148836
+
+    2013-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: It should be possible to query WatchpointSets, and add Watchpoints, even if the compiler is running in another thread
+        https://bugs.webkit.org/show_bug.cgi?id=114909
+
+        Reviewed by Oliver Hunt.
+        
+        The idea here is that a concurrent compiler will use watchpoint sets as follows:
+        
+        During concurrent compilation: It will create Watchpoints, and query WatchpointSets only
+        for the purpose of profiling. That is, it will use decide whether it is profitable to
+        compile the code "as if" the watchpoint sets are valid.
+        
+        During synchronous linking: By "linking" I don't necessarily mean the LinkBuffer stuff,
+        but just the very bitter end of compilation where we make the JIT code callable. This
+        can happen after LinkBuffer stuff. Anyway, this will have to happen synchronously, and
+        at that point we can (a) check that all WatchpointSets that we assumed were valid are
+        still valid and (b) if they are then we add the watchpoints to those sets. If any of the
+        sets are invalid, we give up on this compilation and try again later.
+        
+        The querying of WatchpointSets is engineered to say that the set is still valid if it
+        is so *right now*, but this is done in a racy way and so it may say so spuriously: we
+        may, with hopefully low probability, have a set that says it is valid even though it was
+        just invalidated. The goal is only to ensure that (i) a set never claims to be invalid
+        if it is actually valid, (ii) a set doesn't claim to be valid if it was invalidated
+        before compilation even began, and (iii) querying the validity of a set doesn't cause us
+        to crash.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Watchpoint.cpp:
+        (JSC::InlineWatchpointSet::inflateSlow):
+        * bytecode/Watchpoint.h:
+        (WatchpointSet):
+        (InlineWatchpointSet):
+        (JSC::InlineWatchpointSet::hasBeenInvalidated):
+        (JSC::InlineWatchpointSet::isThin):
+        (JSC::InlineWatchpointSet::isFat):
+        (JSC::InlineWatchpointSet::fat):
+        * dfg/DFGDesiredWatchpoints.cpp: Added.
+        (DFG):
+        (JSC::DFG::DesiredWatchpoints::DesiredWatchpoints):
+        (JSC::DFG::DesiredWatchpoints::~DesiredWatchpoints):
+        (JSC::DFG::DesiredWatchpoints::addLazily):
+        (JSC::DFG::DesiredWatchpoints::reallyAdd):
+        (JSC::DFG::DesiredWatchpoints::areStillValid):
+        * dfg/DFGDesiredWatchpoints.h: Added.
+        (DFG):
+        (JSC::DFG::WatchpointForGenericWatchpointSet::WatchpointForGenericWatchpointSet):
+        (WatchpointForGenericWatchpointSet):
+        (GenericDesiredWatchpoints):
+        (JSC::DFG::GenericDesiredWatchpoints::GenericDesiredWatchpoints):
+        (JSC::DFG::GenericDesiredWatchpoints::addLazily):
+        (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
+        (JSC::DFG::GenericDesiredWatchpoints::areStillValid):
+        (DesiredWatchpoints):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addLazily):
+        (JITCompiler):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLCompile.h:
+        (FTL):
+        * ftl/FTLState.h:
+        (State):
+        * runtime/JSFunction.h:
+        (JSFunction):
+        (JSC::JSFunction::allocationProfileWatchpointSet):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::transitionWatchpointSet):
+
+2013-07-16  Oliver Hunt <oliver@apple.com>
+
+        Merge dfgFourthTier r148804
+
+    2013-04-20  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: value profiles and array profiles should be thread-safe enough to be accessible in a concurrent compilation thread
+        https://bugs.webkit.org/show_bug.cgi?id=114906
+
+        Reviewed by Oliver Hunt.
+        
+        This introduces thread safety to value profiles, array profiles, and
+        array allocation profiles.
+        
+        We already have three separate operations that happen on profiles:
+        (1) writing, which the JIT, LLInt, and OSR exit do; (2) updating,
+        which happens during GC, from OSR entry slow-paths, and in the DFG;
+        and (3) reading, which happens in the DFG. For example, the JIT/LLInt
+        and OSR exit write to ValueProfile::m_buckets, which gets synthesized
+        into ValueProfile::m_prediction (and other fields) during update, and
+        the latter gets read by the DFG. Note that (2) must also happen in
+        the DFG since only the DFG knows which code blocks it will inline,
+        and those blocks' profiles may not have otherwise been updated via
+        any other mechanism.
+        
+        I refer to these three operations as writing, updating, and reading.
+        
+        Consequently, both profile updating and profile reading may happen
+        asynchronously, if the JIT is asynchronous.
+        
+        The locking protocol for profiles works as follows:
+        
+        - Writing does not require locking, but is only allowed on the main
+          thread. We require that these fields can be stored atomically by
+          the profiling code, even without locks. For value profiles, this
+          only works on 64-bit platforms, currently. For array profiles,
+          which consist of multiple separate fields, this means that an
+          asynchronous update of the profile may see slight inconsistencies
+          (like a structure that doesn't quite match the array modes bits),
+          but these should be harmless: at worst, the DFG will specialize
+          too much and we'll have OSR exits.
+        
+        - Updating a value profile requires holding a lock, but must assume
+          that the fields written by the profiling code in JIT/LLInt may
+          be written to without locking.
+        
+        - Reading a value profile requires holding a lock.
+        
+        The one major exception to these rules is the ArrayAllocationProfile,
+        which requires no locking. We do this because it's used so often and
+        in places where we don't necessarily have access to the owning
+        CodeBlock, so if we did want it to be locked it would have to have
+        its own lock. Also, I believe that it is sound to just make this
+        profile racy and not worry about locking at all. All that was needed
+        were some changes to ensure that we explicitly read some raced-over
+        fields only once.
+
+        Two additional interesting things in this change:
+        
+        - To make it easy to see which profile methods require locking, they
+          take a const CodeBlockLocker& as an argument. I saw this idiom for
+          identifying which methods require which locks to be held being used
+          in LLVM, and I quite like it.
+        
+        - Lazy operand value profiles, which are created lazily and at any
+          time, require the CodeBlockLock to be held when they are being
+          created. Writes to them are lockless and main-thread-only, but as
+          with other profiles, updates and reads require locking.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ArrayAllocationProfile.cpp:
+        (JSC::ArrayAllocationProfile::updateIndexingType):
+        * bytecode/ArrayAllocationProfile.h:
+        (JSC::ArrayAllocationProfile::selectIndexingType):
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        (JSC::ArrayProfile::briefDescription):
+        * bytecode/ArrayProfile.h:
+        (ArrayProfile):
+        (JSC::ArrayProfile::expectedStructure):
+        (JSC::ArrayProfile::structureIsPolymorphic):
+        (JSC::ArrayProfile::hasDefiniteStructure):
+        (JSC::ArrayProfile::observedArrayModes):
+        (JSC::ArrayProfile::mayInterceptIndexedAccesses):
+        (JSC::ArrayProfile::mayStoreToHole):
+        (JSC::ArrayProfile::outOfBounds):
+        (JSC::ArrayProfile::usesOriginalArrayStructures):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpValueProfiling):
+        (JSC::CodeBlock::dumpArrayProfiling):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        (JSC::CodeBlock::updateAllArrayPredictions):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
+        (JSC::CodeBlock::updateAllPredictionsAndCheckIfShouldOptimizeNow):
+        (CodeBlock):
+        * bytecode/CodeBlockLock.h: Added.
+        (JSC):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
+        (JSC::CompressedLazyOperandValueProfileHolder::add):
+        (JSC::LazyOperandValueProfileParser::LazyOperandValueProfileParser):
+        (JSC::LazyOperandValueProfileParser::~LazyOperandValueProfileParser):
+        (JSC):
+        (JSC::LazyOperandValueProfileParser::initialize):
+        (JSC::LazyOperandValueProfileParser::prediction):
+        * bytecode/LazyOperandValueProfile.h:
+        (CompressedLazyOperandValueProfileHolder):
+        (LazyOperandValueProfileParser):
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ValueProfile.h:
+        (JSC::ValueProfileBase::briefDescription):
+        (ValueProfileBase):
+        (JSC::ValueProfileBase::computeUpdatedPrediction):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        * dfg/DFGArrayMode.h:
+        (ArrayMode):
+        (JSC::DFG::ArrayMode::withProfile):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOSRExitPreparation.cpp:
+        (JSC::DFG::prepareCodeOriginForOSRExit):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * jit/JITInlines.h:
+        (JSC::JIT::chooseArrayMode):
+        * jit/JITStubs.cpp:
+        (JSC::tryCachePutByID):
+        (JSC::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::lazyLinkFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolveContainingScopeInternal):
+        (JSC::JSScope::resolvePut):
+
+2013-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: all inline caches should thread-safe enough to allow a concurrent compilation thread to read them safely
+        https://bugs.webkit.org/show_bug.cgi?id=114762
+
+        Reviewed by Mark Hahnenberg.
+        
+        For most inline caches this is easy: the inline cache has a clean temporal
+        separation between doing the requested action (which may take an unbounded
+        amount of time, may recurse, and may do arbitrary things) and recording the
+        relevant information in the cache. So, we just put locks around the
+        recording bit. That part is always O(1) and does not recurse. The lock we
+        use is per-CodeBlock to achieve a good balance between locking granularity
+        and low space overhead. So a concurrent compilation thread will only block
+        if an inline cache ping-pongs in the code block being compiled (or inlined)
+        and never when other inline caches do things.
+        
+        For resolve operations, it's a bit tricky. The global resolve bit works
+        like any other IC in that it has the clean temporal separation. But the
+        operations vector itself doesn't have this separation, since we will be
+        filling it in tandem with actions that may take a long time. This patch
+        gets around this by having a m_ready bit in the ResolveOperations and
+        PutToBaseOperation. This is set while holding the CodeBlock's lock. If the
+        DFG observes the m_ready bit not set (while holding the lock) then it
+        conservatively assumes that the resolve hasn't happened yet and just
+        plants a ForceOSRExit.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::ResolveGlobalStatus::computeFor):
+        * bytecode/ResolveOperation.h:
+        (JSC::ResolveOperations::ResolveOperations):
+        (ResolveOperations):
+        (JSC::PutToBaseOperation::PutToBaseOperation):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseResolveOperations):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JITStubs.cpp:
+        (JSC::tryCachePutByID):
+        (JSC::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::lazyLinkFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolveContainingScopeInternal):
+        (JSC::JSScope::resolveContainingScope):
+        (JSC::JSScope::resolvePut):
+
+2013-04-16  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should be able to query Structure without modifying it
+        https://bugs.webkit.org/show_bug.cgi?id=114708
+
+        Reviewed by Oliver Hunt.
+        
+        This is work towards allowing the DFG, and FTL, to run on a separate thread.
+        The idea is that the most evil thing that the DFG does that has thread-safety
+        issues is fiddling with Structures by calling Structure::get(). This can lead
+        to rematerialization of property tables, which is definitely not thread-safe
+        due to how StringImpl works. So, this patch completely side-steps the problem
+        by creating a new version of Structure::get, called
+        Structure::getWithoutMaterializing, which may choose to do an O(n) search if
+        necessary to avoid materialization. I believe this should be fine - the DFG
+        does't call into these code path often enough for this to matter, and most of
+        the time, the Structure that we call this on will already have a property
+        table because some inline cache would have already called ::get() on that
+        Structure.
+        
+        Also cleaned up the materialization logic: we can stop the search as soon as
+        we find any Structure with a property table rather than searching all the way
+        for a pinned one.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * runtime/Structure.cpp:
+        (JSC::Structure::findStructuresAndMapForMaterialization):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::getWithoutMaterializing):
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::getWithoutMaterializing):
+        (JSC):
+
+2013-04-13  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Fix release build.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        * ftl/FTLExitValue.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+
+2013-04-13  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should have OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=113623
+
+        Reviewed by Oliver Hunt.
+        
+        This implements OSR exit, and hilariously, it actually works. The idea is to have
+        LLVM call a no-return function on the off-ramp, passing it everything we know about
+        bytecode state that isn't already flushed to the call frame. Our own JIT takes care
+        of the rest.
+        
+        We can now run all of SunSpider, V8, and Kraken with the FTL enabled.
+        
+        The details are described in FTLOSRExit.h.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/AbstractMacroAssembler.h:
+        (Address):
+        (JSC::AbstractMacroAssembler::Address::withOffset):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::offsetOf):
+        (LinkBuffer):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::RepatchBuffer):
+        (JSC::RepatchBuffer::~RepatchBuffer):
+        (RepatchBuffer):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/Operands.h:
+        (Operands):
+        (JSC):
+        (JSC::::dump):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        * dfg/DFGGPRInfo.h:
+        (DFG):
+        (GPRInfo):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        * dfg/DFGNodeType.h:
+        (JSC::DFG::needsOSRBackwardRewiring):
+        (DFG):
+        (JSC::DFG::needsOSRForwardRewiring):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (DFG):
+        (JSC::DFG::OSRExit::convertToForward):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitBase.cpp: Added.
+        (DFG):
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
+        (JSC::DFG::OSRExitBase::doSearchForForwardConversion):
+        * dfg/DFGOSRExitBase.h: Added.
+        (DFG):
+        (JSC::DFG::OSRExitBase::OSRExitBase):
+        (OSRExitBase):
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::handleExitCounts):
+        (JSC::DFG::reifyInlinedCallFrames):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOSRExitCompilerCommon.h:
+        (DFG):
+        * dfg/DFGOSRExitPreparation.cpp: Added.
+        (DFG):
+        (JSC::DFG::prepareCodeOriginForOSRExit):
+        * dfg/DFGOSRExitPreparation.h: Added.
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::forSpeculation):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::functionType):
+        (FTL):
+        (JSC::FTL::typeOf):
+        (JSC::FTL::appendBasicBlock):
+        (JSC::FTL::insertBasicBlock):
+        (JSC::FTL::buildCall):
+        (JSC::FTL::setTailCall):
+        * ftl/FTLCArgumentGetter.cpp: Added.
+        (FTL):
+        (JSC::FTL::CArgumentGetter::loadNextAndBox):
+        * ftl/FTLCArgumentGetter.h: Added.
+        (FTL):
+        (JSC::FTL::isArgumentRegister):
+        (CArgumentGetter):
+        (JSC::FTL::CArgumentGetter::CArgumentGetter):
+        (JSC::FTL::CArgumentGetter::loadNext8):
+        (JSC::FTL::CArgumentGetter::loadNext32):
+        (JSC::FTL::CArgumentGetter::loadNext64):
+        (JSC::FTL::CArgumentGetter::loadNextPtr):
+        (JSC::FTL::CArgumentGetter::loadNextDouble):
+        (JSC::FTL::CArgumentGetter::nextAddress):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLExitArgument.cpp: Added.
+        (FTL):
+        (JSC::FTL::ExitArgument::dump):
+        * ftl/FTLExitArgument.h: Added.
+        (FTL):
+        (ExitArgumentRepresentation):
+        (ExitArgument):
+        (JSC::FTL::ExitArgument::ExitArgument):
+        (JSC::FTL::ExitArgument::operator!):
+        (JSC::FTL::ExitArgument::format):
+        (JSC::FTL::ExitArgument::argument):
+        (JSC::FTL::ExitArgument::withFormat):
+        (JSC::FTL::ExitArgument::representation):
+        * ftl/FTLExitArgumentForOperand.cpp: Added.
+        (FTL):
+        (JSC::FTL::ExitArgumentForOperand::dump):
+        * ftl/FTLExitArgumentForOperand.h: Added.
+        (FTL):
+        (ExitArgumentForOperand):
+        (JSC::FTL::ExitArgumentForOperand::ExitArgumentForOperand):
+        (JSC::FTL::ExitArgumentForOperand::operator!):
+        (JSC::FTL::ExitArgumentForOperand::exitArgument):
+        (JSC::FTL::ExitArgumentForOperand::operand):
+        (JSC::FTL::lesserArgumentIndex):
+        * ftl/FTLExitArgumentList.h: Added.
+        (FTL):
+        * ftl/FTLExitThunkGenerator.cpp: Added.
+        (FTL):
+        (JSC::FTL::ExitThunkGenerator::ExitThunkGenerator):
+        (JSC::FTL::ExitThunkGenerator::~ExitThunkGenerator):
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        * ftl/FTLExitThunkGenerator.h: Added.
+        (FTL):
+        (ExitThunkGenerator):
+        (JSC::FTL::ExitThunkGenerator::didThings):
+        * ftl/FTLExitValue.cpp: Added.
+        (FTL):
+        (JSC::FTL::ExitValue::dump):
+        * ftl/FTLExitValue.h: Added.
+        (FTL):
+        (ExitValue):
+        (JSC::FTL::ExitValue::ExitValue):
+        (JSC::FTL::ExitValue::operator!):
+        (JSC::FTL::ExitValue::dead):
+        (JSC::FTL::ExitValue::inJSStack):
+        (JSC::FTL::ExitValue::inJSStackAsInt32):
+        (JSC::FTL::ExitValue::inJSStackAsDouble):
+        (JSC::FTL::ExitValue::constant):
+        (JSC::FTL::ExitValue::exitArgument):
+        (JSC::FTL::ExitValue::kind):
+        (JSC::FTL::ExitValue::isDead):
+        (JSC::FTL::ExitValue::isInJSStackSomehow):
+        (JSC::FTL::ExitValue::isConstant):
+        (JSC::FTL::ExitValue::isArgument):
+        * ftl/FTLFormattedValue.h:
+        (FTL):
+        (JSC::FTL::noValue):
+        (JSC::FTL::int32Value):
+        (JSC::FTL::uInt32Value):
+        (JSC::FTL::booleanValue):
+        (JSC::FTL::jsValueValue):
+        (JSC::FTL::doubleValue):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::initializeExitThunks):
+        (FTL):
+        (JSC::FTL::JITCode::exitThunks):
+        * ftl/FTLJITCode.h:
+        (JITCode):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (FTL):
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::transferAndCheckArguments):
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileMovHint):
+        (JSC::FTL::LowerDFGToLLVM::compileZombieHint):
+        (JSC::FTL::LowerDFGToLLVM::compileMovHintAndCheck):
+        (JSC::FTL::LowerDFGToLLVM::compileAdd):
+        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::speculateBackward):
+        (JSC::FTL::LowerDFGToLLVM::speculateForward):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::terminate):
+        (JSC::FTL::LowerDFGToLLVM::backwardTypeCheck):
+        (JSC::FTL::LowerDFGToLLVM::forwardTypeCheck):
+        (JSC::FTL::LowerDFGToLLVM::typeCheck):
+        (JSC::FTL::LowerDFGToLLVM::appendTypeCheck):
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::speculateObject):
+        (JSC::FTL::LowerDFGToLLVM::isLive):
+        (JSC::FTL::LowerDFGToLLVM::use):
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        (JSC::FTL::LowerDFGToLLVM::tryToSetConstantExitArgument):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgument):
+        (JSC::FTL::LowerDFGToLLVM::linkOSRExitsAndCompleteInitializationBlocks):
+        (JSC::FTL::LowerDFGToLLVM::observeMovHint):
+        * ftl/FTLOSRExit.cpp: Added.
+        (FTL):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::convertToForward):
+        * ftl/FTLOSRExit.h: Added.
+        (FTL):
+        (OSRExit):
+        * ftl/FTLOSRExitCompilationInfo.h: Added.
+        (FTL):
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        (OSRExitCompilationInfo):
+        * ftl/FTLOSRExitCompiler.cpp: Added.
+        (FTL):
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLOSRExitCompiler.h: Added.
+        (FTL):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::newBlock):
+        (JSC::FTL::Output::intToPtr):
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::store):
+        (Output):
+        (JSC::FTL::Output::call):
+        (JSC::FTL::Output::convertToTailCall):
+        (FTL):
+        * ftl/FTLState.h:
+        (State):
+        * ftl/FTLThunks.cpp: Added.
+        (FTL):
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        * ftl/FTLThunks.h: Added.
+        (JSC):
+        (FTL):
+        * ftl/FTLValueFormat.cpp: Added.
+        (WTF):
+        (WTF::printInternal):
+        * ftl/FTLValueFormat.h: Added.
+        (FTL):
+        (WTF):
+        * ftl/FTLValueSource.cpp: Added.
+        (FTL):
+        (JSC::FTL::ValueSource::dump):
+        * ftl/FTLValueSource.h: Added.
+        (FTL):
+        (ValueSource):
+        (JSC::FTL::ValueSource::ValueSource):
+        (JSC::FTL::ValueSource::kind):
+        (JSC::FTL::ValueSource::operator!):
+        (JSC::FTL::ValueSource::node):
+
+2013-04-12  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: switch to using MCJIT and disable frame pointer elimination
+        https://bugs.webkit.org/show_bug.cgi?id=114542
+
+        Reviewed by Oliver Hunt and Michael Saboff.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+
+2013-04-09  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should provide utilities for common OSR exit tasks
+        https://bugs.webkit.org/show_bug.cgi?id=114306
+
+        Reviewed by Mark Hahnenberg.
+        
+        Just abstract out some things that the FTL will want to use as well.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler.h:
+        (OSRExitCompiler):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp: Added.
+        (DFG):
+        (JSC::DFG::handleExitCounts):
+        (JSC::DFG::reifyInlinedCallFrames):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOSRExitCompilerCommon.h: Added.
+        (DFG):
+
+2013-04-09  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should better abstract floating point arguments
+        https://bugs.webkit.org/show_bug.cgi?id=114300
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGFPRInfo.h:
+        (FPRInfo):
+        (JSC::DFG::FPRInfo::toArgumentRegister):
+
+2013-04-05  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should better abstract arguments
+        https://bugs.webkit.org/show_bug.cgi?id=114073
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGGPRInfo.h:
+        (GPRInfo):
+        (JSC::DFG::GPRInfo::toArgumentRegister):
+
+2013-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: put DFG data into a DFG::JITCode, and put common DFG and FTL data into something accessible from both DFG::JITCode and FTL::JITCode
+        https://bugs.webkit.org/show_bug.cgi?id=113905
+
+        Reviewed by Geoffrey Garen.
+        
+        This removes one pointer from CodeBlock.
+        
+        It also gives us a framework for having JITType-specific data in CodeBlock, by
+        putting it into the appropriate JITCode class (either DFG::JITCode or
+        FTL::JITCode). And it allows us to have DFG and FTL share some common data,
+        via DFG::CommonData, which is stored in both DFG::JITCode and FTL::JITCode and
+        always accessible via JITCode::dfgCommon().
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::performTracingFixpointIteration):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitWeakReferences):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
+        (JSC::DFGCodeBlocks::mark):
+        * dfg/DFGAssemblyHelpers.h:
+        * dfg/DFGCommonData.cpp: Added.
+        (DFG):
+        (JSC::DFG::CommonData::notifyCompilingStructureTransition):
+        (JSC::DFG::CommonData::shrinkToFit):
+        * dfg/DFGCommonData.h: Added.
+        (JSC):
+        (DFG):
+        (JSC::DFG::WeakReferenceTransition::WeakReferenceTransition):
+        (WeakReferenceTransition):
+        (CommonData):
+        (JSC::DFG::CommonData::CommonData):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h:
+        (DFG):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGJITCode.cpp: Added.
+        (DFG):
+        (JSC::DFG::JITCode::JITCode):
+        (JSC::DFG::JITCode::~JITCode):
+        (JSC::DFG::JITCode::dfgCommon):
+        (JSC::DFG::JITCode::dfg):
+        (JSC::DFG::JITCode::shrinkToFit):
+        * dfg/DFGJITCode.h: Added.
+        (DFG):
+        (JITCode):
+        (JSC::DFG::JITCode::appendOSREntryData):
+        (JSC::DFG::JITCode::osrEntryDataForBytecodeIndex):
+        (JSC::DFG::JITCode::appendOSRExit):
+        (JSC::DFG::JITCode::lastOSRExit):
+        (JSC::DFG::JITCode::appendSpeculationRecovery):
+        (JSC::DFG::JITCode::appendWatchpoint):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::addWeakReference):
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        (JSC::DFG::JITCompiler::jitCode):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::backwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableEventStream.cpp:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::JITCode):
+        (JSC::FTL::JITCode::~JITCode):
+        (FTL):
+        (JSC::FTL::JITCode::initializeCode):
+        (JSC::FTL::JITCode::addressForCall):
+        (JSC::FTL::JITCode::executableAddressAtOffset):
+        (JSC::FTL::JITCode::dataAddressAtOffset):
+        (JSC::FTL::JITCode::offsetOf):
+        (JSC::FTL::JITCode::size):
+        (JSC::FTL::JITCode::contains):
+        (JSC::FTL::JITCode::ftl):
+        (JSC::FTL::JITCode::dfgCommon):
+        * ftl/FTLJITCode.h:
+        (JITCode):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileStructureTransitionWatchpoint):
+        (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
+        (JSC::FTL::LowerDFGToLLVM::addWeakReference):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::weakPointer):
+        * ftl/FTLState.cpp:
+        (FTL):
+        (JSC::FTL::State::State):
+        (JSC::FTL::State::dumpState):
+        * ftl/FTLState.h:
+        (State):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::~DFGCodeBlocks):
+        (JSC::DFGCodeBlocks::jettison):
+        (JSC::DFGCodeBlocks::clearMarks):
+        (JSC::DFGCodeBlocks::deleteUnmarkedJettisonedCodeBlocks):
+        (JSC::DFGCodeBlocks::traceMarkedCodeBlocks):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::dfgCommon):
+        (JSC):
+        (JSC::JITCode::dfg):
+        (JSC::JITCode::ftl):
+        (JSC::DirectJITCode::DirectJITCode):
+        (JSC::DirectJITCode::initializeCodeRef):
+        (JSC::DirectJITCode::addressForCall):
+        (JSC::DirectJITCode::executableAddressAtOffset):
+        (JSC::DirectJITCode::dataAddressAtOffset):
+        (JSC::DirectJITCode::offsetOf):
+        (JSC::DirectJITCode::size):
+        (JSC::DirectJITCode::contains):
+        * jit/JITCode.h:
+        (DFG):
+        (FTL):
+        (JSC):
+        (JITCode):
+        (DirectJITCode):
+
+2013-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Include LLVM headers with surrounding #pragmas instead of using my #define
+        https://bugs.webkit.org/show_bug.cgi?id=113921
+
+        Reviewed by Oliver Hunt.
+        
+        The LLVM community wants us to continue including all of LLVM's C++ headers. Change
+        to using #pragma's to disable warnings that they cannot handle.
+
+        * ftl/FTLLLVMHeaders.h:
+
+2013-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Everyone should know about the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=113897
+
+        Reviewed by Mark Hahnenberg.
+        
+        In order to get OSR exit to work right, we need the distinction between DFG and
+        FTL to be clear even after compilation finishes, since they will have subtly
+        different OSR stories and likely use different data structures.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::ProgramCodeBlock::compileOptimized):
+        (JSC::EvalCodeBlock::compileOptimized):
+        (JSC::FunctionCodeBlock::compileOptimized):
+        (JSC::CodeBlock::adjustedExitCountThreshold):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::ExecState::isInlineCallFrame):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::JITCode):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::dumpState):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::jettison):
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        * jit/JITCode.cpp:
+        (WTF::printInternal):
+        * jit/JITCode.h:
+        (JSC::JITCode::topTierJIT):
+        (JSC::JITCode::nextTierJIT):
+        (JITCode):
+        (JSC::JITCode::isJIT):
+        (JSC::JITCode::isLowerTier):
+        (JSC::JITCode::isHigherTier):
+        (JSC::JITCode::isLowerOrSameTier):
+        (JSC::JITCode::isHigherOrSameTier):
+        (JSC::JITCode::isOptimizingJIT):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileOptimized):
+        (JSC::samplingDescription):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+
+2013-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should abstract out how it does forward exits, and that code should be simplified
+        https://bugs.webkit.org/show_bug.cgi?id=113894
+
+        Reviewed by Mark Hahnenberg.
+        
+        1) We previously had two different ways of convertingToForward, one path for
+           where we had a ValueRecovery for the current node and one where we didn't.
+           But the paths were doing exactly the same thing except that if you have a
+           ValueRecovery, you also find the last applicable mov hint and do some
+           extra things. This patch combines the two paths and bases both of them on
+           the previous no-ValueRecovery path, which was simpler to begin with.
+        
+        2) This moves the logic into DFG::OSRExit, which further simplifies the code
+           and makes the logic available to the FTL.
+
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::convertToForward):
+        (DFG):
+        * dfg/DFGOSRExit.h:
+        (DFG):
+        (OSRExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+
+2013-04-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should have the equivalent of a ValueRecovery
+        https://bugs.webkit.org/show_bug.cgi?id=113819
+
+        Reviewed by Mark Hahnenberg.
+        
+        This adds a way of saying that we have a value, we don't want to say what
+        node the value came from, but we know specifics of how the value is
+        formatted. This is the LLVM equivalent of DFG's ValueRecovery.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLFormattedValue.h: Added.
+        (FTL):
+        (FormattedValue):
+        (JSC::FTL::FormattedValue::FormattedValue):
+        (JSC::FTL::FormattedValue::operator!):
+        (JSC::FTL::FormattedValue::format):
+        (JSC::FTL::FormattedValue::value):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
+        (JSC::FTL::LowerDFGToLLVM::speculateForward):
+        (JSC::FTL::LowerDFGToLLVM::weakPointer):
+
+2013-04-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should use the right abstract heap for Int32 array accesses
+        https://bugs.webkit.org/show_bug.cgi?id=113759
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+
+2013-04-02  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support fast property stores
+        https://bugs.webkit.org/show_bug.cgi?id=113757
+
+        Reviewed by Oliver Hunt.
+        
+        Simplified the task of handling property transitions and reduced amount of code
+        duplication between the JITs.
+        
+        Added PutByOffset, PutStructure, PhantomPutStructure, WeakJSConstant, and a
+        stub form of StructureTransitionWatchpoint to the FTL.
+        
+        Also simplified the creation of pointer constants, and fixed a bug in
+        speculateObject().
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::notifyCompilingStructureTransition):
+        (Graph):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileWeakJSConstant):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileStructureTransitionWatchpoint):
+        (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByOffset):
+        (JSC::FTL::LowerDFGToLLVM::speculateObject):
+        (JSC::FTL::LowerDFGToLLVM::weakPointer):
+        * ftl/FTLOutput.h:
+        (Output):
+        (JSC::FTL::Output::constIntPtr):
+        (JSC::FTL::Output::absolute):
+
+2013-04-01  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support some more integer arithmetic ops (negate, xor, urshift)
+        https://bugs.webkit.org/show_bug.cgi?id=113740
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildNeg):
+        (JSC::FTL::buildLShr):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileBitXor):
+        (JSC::FTL::LowerDFGToLLVM::compileBitURShift):
+        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::neg):
+        (JSC::FTL::Output::lShr):
+
+2013-04-01  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support GetGlobalVar/PutGlobalVar
+        https://bugs.webkit.org/show_bug.cgi?id=113728
+
+        Reviewed by Gavin Barraclough.
+        
+        Removed the macro magic for the globals absolute abstract heap, since for anything
+        with absolute addresses we can just share a common absolute abstract heap. It
+        would only be a problem if we for example were emitting an access to a global but
+        not using an absolute address, and then wanted to say that this access was
+        constrained to global variables. I don't believe we do that, and I don't believe we
+        ever will.
+        
+        Then added Output::absolute(), a convenient way of building a typed pointer for an
+        absolute address.
+        
+        Then added GetGlobalVar/PutGlobalVar.
+
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+        (FTL):
+        (AbstractHeapRepository):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetGlobalVar):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compilePutGlobalVar):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::absolute):
+        (Output):
+
+2013-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL should support ArithSub
+        https://bugs.webkit.org/show_bug.cgi?id=113675
+
+        Reviewed by Oliver Hunt.
+        
+        This does the obvious bit of implementing ArithSub, but it also takes this
+        as an opportunity to clean up how intrinsics and common values (common types
+        and constants) are handled. Previously they were all lumped together in
+        FTL::Output. Now, in an effort to split up the files and make FTL::Output
+        less big, I created a thing called FTL::CommonValues which just tracks the
+        common values, and a thing called FTL::IntrinsicRepository which just tracks
+        intrinsics. These and FTL::Output are all related to each other in a linear
+        hierarchy. Moreover, IntrinsicRepository uses macro-fu to make it easy to
+        declare new intrinsics in the future.
+        
+        I also out-of-lined some things and made .cpp files for each of these classes.
+        Initialize I wasn't going to do this but then I realized that FTL::Output is
+        already included in multiple places. Probably it's better if some of its guts
+        are not inline, and it's also good to now have .cpp "landing pads" if we ever
+        want to add more things to that class.
+        
+        Note that a lot of how these things are designed has to do with the fact
+        that pretty soon here I'll have to switch us from using the LLVM global
+        context to using a context that we create. When that happens, anyone who
+        creates anything will have to know the context; that's why FTL::CommonValues
+        already knows the module but doesn't use it - in the future it will have to
+        do things with it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildSub):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCommonValues.cpp: Added.
+        (FTL):
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h: Added.
+        (FTL):
+        (CommonValues):
+        (JSC::FTL::CommonValues::initialize):
+        * ftl/FTLIntrinsicRepository.cpp: Added.
+        (FTL):
+        (JSC::FTL::IntrinsicRepository::IntrinsicRepository):
+        * ftl/FTLIntrinsicRepository.h: Added.
+        (FTL):
+        (IntrinsicRepository):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithSub):
+        (LowerDFGToLLVM):
+        * ftl/FTLOutput.cpp: Added.
+        (FTL):
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::~Output):
+        * ftl/FTLOutput.h:
+        (Output):
+        (JSC::FTL::Output::initialize):
+        (JSC::FTL::Output::sub):
+        (JSC::FTL::Output::addWithOverflow32):
+        (JSC::FTL::Output::subWithOverflow32):
+        (JSC::FTL::Output::mulWithOverflow32):
+
+2013-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL doesn't need virtual register allocation
+        https://bugs.webkit.org/show_bug.cgi?id=113679
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::dumpAndVerifyGraph):
+        (DFG):
+        (JSC::DFG::compile):
+
+2013-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=113656
+        Fix Sam's nits.
+
+        Unreviewed.
+
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::IndexedAbstractHeap::initialize):
+        * ftl/FTLAbstractHeap.h:
+        (IndexedAbstractHeap):
+        (AbsoluteAbstractHeap):
+        * ftl/FTLAbstractHeapRepository.h:
+        (AbstractHeapRepository):
+
+2013-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL JIT should support GetByVal on Int32 arrays
+        https://bugs.webkit.org/show_bug.cgi?id=113668
+
+        Reviewed by Sam Weinig.
+        
+        It actually already supported this, but needed to be told that it did.
+        
+        Also adds an option to enable LICM (loop-invariant code motion, i.e.
+        http://llvm.org/docs/Passes.html#licm-loop-invariant-code-motion). LICM
+        isn't doing me any good right now, but I guess I'll have to play with
+        it more. And this adds the ability to tweak the LLVM optimization level
+        from the command-line.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        * runtime/Options.h:
+        (JSC):
+
+2013-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL JIT should supply TBAA meta-data to LLVM
+        https://bugs.webkit.org/show_bug.cgi?id=113656
+
+        Reviewed by Oliver Hunt.
+        
+        This adds support for performing strong typing on the LLVM IR that the FTL
+        generates, by using TBAA meta-data. This will permit LLVM to do aggressive
+        GVN, load elimination, and LICM optimization even if it sees pointer store
+        side-effects. The goal is to precisely model all loads and stores we emit,
+        except for the super crazy ones (GetById that can go all-out polymorphic,
+        or for example a Call where we know nothing).
+        
+        This is accomplished by introducing the notion of an AbstractHeap
+        typesystem. An AbstractHeap is a subset of all possible memory locations
+        that we might store to. For example, JSCell::m_structure and
+        JSObject::m_butterfly are two disjoint AbstractHeaps because we know that
+        a store to one cannot clobber the other. AbstractHeaps follow a
+        single-inheritance hierarchy. There is the root heap, which corresponds to
+        any possible memory location accessible to the JS engine, and then there
+        are heaps for all internal object fields, a heap for each global object,
+        and so on.
+        
+        There are three other tidbits here that make this somewhat more interesting.
+        We have a notion of an AbstractHeap-with-offset, called AbstractField.
+        JSCell::m_structure is actually an AbstractField. This allows us to say
+        things like m_out.loadPtr(base, m_heaps.JSCell_structure); this both
+        gives you the offset of JSCell::m_structure and ascribes TBAA meta-data for
+        the JSCell::m_structure heap to the generated load instrction.
+        
+        Another fun tidbit is the notion of Indexed, Numbered, and Absolute abstract
+        heaps. An indexed abstract heap corresponds to a set of locations that you
+        might access by index from some base. Virtual registers are a great example.
+        Though I call them just "variables" in the FTL. When we access a virtual
+        register, we know that we aren't interfering with accesses to
+        Structure-managed named properties, or with JSCell::m_structure, or with
+        other such disjoint heaps. But we also know that if we access a variable at
+        offset X and then another variable at offset Y and we know that X and Y are
+        unequal, then these two accesses are on disjoint subheaps of the variables
+        heap. This works out naturally for interference between, say, scoped variable
+        access and local variable access: if you access scoped variable r5 and then
+        access a local variable r5, these might interfere - and they will get the
+        same abstract subheap of the variables heap. IndexedAbstractHeaps
+        conveniently remember the size of the elements and will give you an
+        AbstractField (i.e. heap-with-offset) if you give it an index. This is great
+        for conveniently writing code that accesses contiguous arrays of well-typed
+        things. This allows you to literally do things like
+        m_out.load64(callFrameRegister, m_heaps.variables[operand]) and the right
+        thing will happen. You can also get the heap variables.atAnyIndex(), if
+        you're doing an access with an unknown index.
+        
+        Numbered and Absolute abstract heaps are related except that they don't
+        assume that the value used to get the abstract subheap corresponds to any
+        meaningful offset from any base. Numbered heaps, like the properties heap
+        (for named properties tracked by Structure), are "numbered" (not indexed)
+        by the propertyNumber. So you can emit a GetByOffset by separately
+        computing the offset and the propertyNumber (both values are stored in the
+        StorageAccessData), and passing the offset directly to Output::address()
+        and passing m_heaps.properties[propertyNumber] as the field. Absolute heaps
+        are similar, but are keyed on absolute address. This is appropriate for
+        global variables, and possibly other things.
+        
+        Finally, FTL::Output understands the notion of a pointer-with-TBAA-data,
+        and calls it a TypedPointer. TypedPointer is a tuple of a LLVMValueRef
+        referencing an intptr value and a pointer to an AbstractHeap. All load()
+        and store() operations now take a TypedPointer, and will perform the access
+        by casting the intptr to a pointer of the right type and then ascribing the
+        TBAA meta-data from the AbstractHeap.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::mdKindID):
+        (JSC::FTL::mdString):
+        (JSC::FTL::mdNode):
+        (FTL):
+        (JSC::FTL::setMetadata):
+        * ftl/FTLAbstractHeap.cpp: Added.
+        (FTL):
+        (JSC::FTL::AbstractHeap::tbaaMetadataSlow):
+        (JSC::FTL::AbstractHeap::decorateInstruction):
+        (JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
+        (JSC::FTL::IndexedAbstractHeap::~IndexedAbstractHeap):
+        (JSC::FTL::IndexedAbstractHeap::baseIndex):
+        (JSC::FTL::IndexedAbstractHeap::atSlow):
+        (JSC::FTL::IndexedAbstractHeap::initialize):
+        (JSC::FTL::NumberedAbstractHeap::NumberedAbstractHeap):
+        (JSC::FTL::NumberedAbstractHeap::~NumberedAbstractHeap):
+        (JSC::FTL::AbsoluteAbstractHeap::AbsoluteAbstractHeap):
+        (JSC::FTL::AbsoluteAbstractHeap::~AbsoluteAbstractHeap):
+        * ftl/FTLAbstractHeap.h: Added.
+        (FTL):
+        (AbstractHeap):
+        (JSC::FTL::AbstractHeap::AbstractHeap):
+        (JSC::FTL::AbstractHeap::isInitialized):
+        (JSC::FTL::AbstractHeap::initialize):
+        (JSC::FTL::AbstractHeap::parent):
+        (JSC::FTL::AbstractHeap::heapName):
+        (JSC::FTL::AbstractHeap::tbaaMetadata):
+        (AbstractField):
+        (JSC::FTL::AbstractField::AbstractField):
+        (JSC::FTL::AbstractField::initialize):
+        (JSC::FTL::AbstractField::offset):
+        (IndexedAbstractHeap):
+        (JSC::FTL::IndexedAbstractHeap::atAnyIndex):
+        (JSC::FTL::IndexedAbstractHeap::at):
+        (JSC::FTL::IndexedAbstractHeap::operator[]):
+        (JSC::FTL::IndexedAbstractHeap::returnInitialized):
+        (JSC::FTL::IndexedAbstractHeap::MyHashTraits::constructDeletedValue):
+        (JSC::FTL::IndexedAbstractHeap::MyHashTraits::isDeletedValue):
+        (NumberedAbstractHeap):
+        (JSC::FTL::NumberedAbstractHeap::atAnyNumber):
+        (JSC::FTL::NumberedAbstractHeap::at):
+        (JSC::FTL::NumberedAbstractHeap::operator[]):
+        (AbsoluteAbstractHeap):
+        (JSC::FTL::AbsoluteAbstractHeap::atAnyAddress):
+        (JSC::FTL::AbsoluteAbstractHeap::at):
+        (JSC::FTL::AbsoluteAbstractHeap::operator[]):
+        * ftl/FTLAbstractHeapRepository.cpp: Added.
+        (FTL):
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        (JSC::FTL::AbstractHeapRepository::~AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h: Added.
+        (FTL):
+        (AbstractHeapRepository):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileGetButterfly):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::speculateObject):
+        (JSC::FTL::LowerDFGToLLVM::addressFor):
+        (JSC::FTL::LowerDFGToLLVM::payloadFor):
+        (JSC::FTL::LowerDFGToLLVM::tagFor):
+        (LowerDFGToLLVM):
+        * ftl/FTLOutput.h:
+        (FTL):
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::initialize):
+        (JSC::FTL::Output::set):
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::store):
+        (Output):
+        (JSC::FTL::Output::load32):
+        (JSC::FTL::Output::load64):
+        (JSC::FTL::Output::loadPtr):
+        (JSC::FTL::Output::store32):
+        (JSC::FTL::Output::store64):
+        (JSC::FTL::Output::storePtr):
+        (JSC::FTL::Output::addPtr):
+        (JSC::FTL::Output::address):
+        (JSC::FTL::Output::baseIndex):
+        * ftl/FTLTypedPointer.h: Added.
+        (FTL):
+        (TypedPointer):
+        (JSC::FTL::TypedPointer::TypedPointer):
+        (JSC::FTL::TypedPointer::operator!):
+        (JSC::FTL::TypedPointer::heap):
+        (JSC::FTL::TypedPointer::value):
+        * runtime/Options.h:
+        (JSC):
+
+2013-03-30  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL JIT should be able to compile the Array.prototype.findGraphNode function in Kraken/ai-astar
+        https://bugs.webkit.org/show_bug.cgi?id=113646
+
+        Reviewed by Oliver Hunt.
+        
+        This adds enough FTL support to compile Array.prototype.findGraphNode. This isn't
+        a speed-up, yet, because findGraphNode tends to be aggressively inlined by the DFG,
+        and the FTL can't yet compile the things into which it was inlined. In future
+        patches we will get to a point where we can compile the callers, and then we'll be
+        able to see what the performance effects are.
+        
+        But the interesting thing is that it isn't a slow-down, either. This implies that
+        even if we FTL compile a CodeBlock that we shouldn't have (the fact that we
+        compiling things that end up being inlined is dumb, and the fact that the current
+        FTL tiering strategy launches LLVM for those things is even dumber), we still run
+        at OK performance.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::transferAndCheckArguments):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileGetButterfly):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowObject):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::lowStorage):
+        (JSC::FTL::LowerDFGToLLVM::isNotInt32):
+        (JSC::FTL::LowerDFGToLLVM::isNotCell):
+        (JSC::FTL::LowerDFGToLLVM::isNotBoolean):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateCell):
+        (JSC::FTL::LowerDFGToLLVM::speculateObject):
+        (JSC::FTL::LowerDFGToLLVM::accountedPointer):
+        (JSC::FTL::LowerDFGToLLVM::weakPointer):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::insertNewBlocksBefore):
+        (JSC::FTL::Output::appendTo):
+        (Output):
+        (JSC::FTL::Output::baseIndex):
+
+2013-03-29  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL JIT should be able to compile the Marsaglia random number generator
+        https://bugs.webkit.org/show_bug.cgi?id=113635
+
+        Reviewed by Oliver Hunt.
+        
+        Just adding missing functionality.
+        
+        Also "fixed" OSR exit to use a call to abort() in addition to using Unreachable
+        since the latter doesn't actually mean trap - quite the opposite, it tells LLVM
+        that the code can never be reached.
+        
+        The Marsaglia function runs ~60% faster with FTL, than DFG. Not a terrible start.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLAbbreviations.h:
+        (FTL):
+        (JSC::FTL::voidType):
+        (JSC::FTL::structType):
+        (JSC::FTL::functionType):
+        (JSC::FTL::addFunction):
+        (JSC::FTL::setLinkage):
+        (JSC::FTL::setFunctionCallingConv):
+        (JSC::FTL::addExternFunction):
+        (JSC::FTL::constIntToPtr):
+        (JSC::FTL::constBitCast):
+        (JSC::FTL::buildMul):
+        (JSC::FTL::buildOr):
+        (JSC::FTL::buildShl):
+        (JSC::FTL::buildAShr):
+        (JSC::FTL::buildCall):
+        (JSC::FTL::buildExtractValue):
+        (JSC::FTL::dumpModule):
+        (JSC::FTL::verifyModule):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileAdd):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileBitAnd):
+        (JSC::FTL::LowerDFGToLLVM::compileBitOr):
+        (JSC::FTL::LowerDFGToLLVM::compileBitRShift):
+        (JSC::FTL::LowerDFGToLLVM::compileBitLShift):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLess):
+        (JSC::FTL::LowerDFGToLLVM::compileBranch):
+        (JSC::FTL::LowerDFGToLLVM::speculateBackward):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::initialize):
+        (JSC::FTL::Output::appendTo):
+        (Output):
+        (JSC::FTL::Output::mul):
+        (JSC::FTL::Output::bitOr):
+        (JSC::FTL::Output::shl):
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::addWithOverflow32):
+        (JSC::FTL::Output::mulWithOverflow32):
+        (JSC::FTL::Output::extractValue):
+        (JSC::FTL::Output::call):
+        (JSC::FTL::Output::addWithOverflow32Function):
+        (JSC::FTL::Output::mulWithOverflow32Function):
+        * ftl/FTLState.cpp: Added.
+        (FTL):
+        (JSC::FTL::State::dumpState):
+        * ftl/FTLState.h:
+        (State):
+
+2013-03-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, release mode build fix.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+
+2013-03-29  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Change DO_NOT_INCLUDE_LLVM_CPP_HEADERS to LLVM_DO_NOT_INCLUDE_CPP_HEADERS
+        https://bugs.webkit.org/show_bug.cgi?id=113634
+
+        Reviewed by Dan Bernstein.
+
+        * ftl/FTLLLVMHeaders.h:
+
+2013-03-29  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL JIT should be able run some simple function
+        https://bugs.webkit.org/show_bug.cgi?id=113481
+
+        Reviewed by Geoffrey Garen.
+        
+        I forgot to make a couple of the requested review changes, so I'm making
+        them now!
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.h:
+
+2013-03-29  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: FTL JIT should be able run some simple function
+        https://bugs.webkit.org/show_bug.cgi?id=113481
+
+        Reviewed by Geoffrey Garen.
+        
+        This is the initial version of the FTL JIT (Fourth Tier LLVM JIT).
+        It includes a lowering from the DFG IR to LLVM IR (FTL::lowerDFGToLLVM)
+        and a "backend" step that invokes the LLVM and wraps the resulting
+        function in a thunk (FTL::compile).
+        
+        All LLVM IR building functions are wrapped up into a nicer FTL API.
+        First they're wrapped in an abbreviated API (FTLAbbreviations.h) and
+        then again into an object-oriented IR builder (FTLOutput.h).
+        
+        This runs things. I don't know how fast it runs things. And I don't
+        make any claims of stability. The FTL is runtime-disabled by default;
+        you will enable it by doing --useExperimentalFTL=true. Probably if you
+        do this, you will run slower, because of the heavy thunking we do, the
+        fact that we don't have anything resembling a sensible tiering story,
+        and because we only compile ridiculously tiny functions.
+            
+        Finally, this still requires a custom set of LLVM headers to build.
+        I am working on getting that up-streamed to LLVM, and separately I'll
+        make sure that we have a build checked into this branch.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Operands.h:
+        (Operands):
+        (JSC::Operands::Operands):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::needsTypeCheck):
+        (AbstractState):
+        (JSC::DFG::AbstractState::filterEdgeByUse):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::needsTypeCheck):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        (DFG):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::shouldNotHaveTypeCheck):
+        (DFG):
+        (JSC::DFG::mayHaveTypeCheck):
+        (JSC::DFG::isDouble):
+        (JSC::DFG::isCell):
+        * ftl: Added.
+        * ftl/FTLAbbreviations.h: Added.
+        (FTL):
+        (JSC::FTL::int1Type):
+        (JSC::FTL::int32Type):
+        (JSC::FTL::int64Type):
+        (JSC::FTL::intPtrType):
+        (JSC::FTL::pointerType):
+        (JSC::FTL::getParam):
+        (JSC::FTL::constInt):
+        (JSC::FTL::appendBasicBlock):
+        (JSC::FTL::insertBasicBlock):
+        (JSC::FTL::buildAlloca):
+        (JSC::FTL::buildAdd):
+        (JSC::FTL::buildAnd):
+        (JSC::FTL::buildXor):
+        (JSC::FTL::buildLoad):
+        (JSC::FTL::buildStore):
+        (JSC::FTL::buildZExt):
+        (JSC::FTL::buildIntCast):
+        (JSC::FTL::buildIntToPtr):
+        (JSC::FTL::buildPtrToInt):
+        (JSC::FTL::buildICmp):
+        (JSC::FTL::buildSelect):
+        (JSC::FTL::buildBr):
+        (JSC::FTL::buildCondBr):
+        (JSC::FTL::buildRet):
+        (JSC::FTL::buildUnreachable):
+        * ftl/FTLCapabilities.cpp: Added.
+        (FTL):
+        (JSC::FTL::canCompile):
+        * ftl/FTLCapabilities.h: Added.
+        (FTL):
+        * ftl/FTLCompile.cpp: Added.
+        (FTL):
+        (JSC::FTL::compileEntry):
+        (JSC::FTL::compile):
+        * ftl/FTLCompile.h: Added.
+        (FTL):
+        * ftl/FTLJITCode.cpp: Added.
+        (FTL):
+        (JSC::FTL::JITCode::JITCode):
+        (JSC::FTL::JITCode::~JITCode):
+        (JSC::FTL::JITCode::addressForCall):
+        (JSC::FTL::JITCode::executableAddressAtOffset):
+        (JSC::FTL::JITCode::dataAddressAtOffset):
+        (JSC::FTL::JITCode::offsetOf):
+        (JSC::FTL::JITCode::size):
+        (JSC::FTL::JITCode::contains):
+        * ftl/FTLJITCode.h: Added.
+        (FTL):
+        (JITCode):
+        * ftl/FTLLLVMHeaders.h: Added.
+        * ftl/FTLLowerDFGToLLVM.cpp: Added.
+        (FTL):
+        (LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::addFlushedLocalOpRoots):
+        (JSC::FTL::LowerDFGToLLVM::closeOverFlushedLocalOps):
+        (JSC::FTL::LowerDFGToLLVM::addFlushedLocalOp):
+        (JSC::FTL::LowerDFGToLLVM::addFlushedLocalEdge):
+        (JSC::FTL::LowerDFGToLLVM::transferAndCheckArguments):
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileJSConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileMovHintAndCheck):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantom):
+        (JSC::FTL::LowerDFGToLLVM::compileReturn):
+        (JSC::FTL::LowerDFGToLLVM::speculateBackward):
+        (JSC::FTL::LowerDFGToLLVM::speculateForward):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::terminate):
+        (JSC::FTL::LowerDFGToLLVM::backwardTypeCheck):
+        (JSC::FTL::LowerDFGToLLVM::forwardTypeCheck):
+        (JSC::FTL::LowerDFGToLLVM::typeCheck):
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::checkNotInt32):
+        (JSC::FTL::LowerDFGToLLVM::unboxInt32):
+        (JSC::FTL::LowerDFGToLLVM::boxInt32):
+        (JSC::FTL::LowerDFGToLLVM::checkNotCell):
+        (JSC::FTL::LowerDFGToLLVM::checkNotBoolean):
+        (JSC::FTL::LowerDFGToLLVM::unboxBoolean):
+        (JSC::FTL::LowerDFGToLLVM::boxBoolean):
+        (JSC::FTL::LowerDFGToLLVM::speculateInt32):
+        (JSC::FTL::LowerDFGToLLVM::addressFor):
+        (JSC::FTL::LowerDFGToLLVM::payloadFor):
+        (JSC::FTL::LowerDFGToLLVM::tagFor):
+        (JSC::FTL::LowerDFGToLLVM::globalData):
+        (JSC::FTL::LowerDFGToLLVM::codeBlock):
+        (JSC::FTL::lowerDFGToLLVM):
+        * ftl/FTLLowerDFGToLLVM.h: Added.
+        (FTL):
+        * ftl/FTLOutput.h: Added.
+        (FTL):
+        (Output):
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::~Output):
+        (JSC::FTL::Output::initialize):
+        (JSC::FTL::Output::appendTo):
+        (JSC::FTL::Output::newBlock):
+        (JSC::FTL::Output::param):
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::constInt32):
+        (JSC::FTL::Output::constIntPtr):
+        (JSC::FTL::Output::constInt64):
+        (JSC::FTL::Output::add):
+        (JSC::FTL::Output::bitAnd):
+        (JSC::FTL::Output::bitXor):
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::intCast):
+        (JSC::FTL::Output::castToInt32):
+        (JSC::FTL::Output::get):
+        (JSC::FTL::Output::set):
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::load32):
+        (JSC::FTL::Output::load64):
+        (JSC::FTL::Output::loadPtr):
+        (JSC::FTL::Output::store32):
+        (JSC::FTL::Output::store64):
+        (JSC::FTL::Output::storePtr):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        (JSC::FTL::Output::above):
+        (JSC::FTL::Output::aboveOrEqual):
+        (JSC::FTL::Output::below):
+        (JSC::FTL::Output::belowOrEqual):
+        (JSC::FTL::Output::greaterThan):
+        (JSC::FTL::Output::greaterThanOrEqual):
+        (JSC::FTL::Output::lessThan):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::isZero64):
+        (JSC::FTL::Output::notZero64):
+        (JSC::FTL::Output::testNonZero64):
+        (JSC::FTL::Output::select):
+        (JSC::FTL::Output::jump):
+        (JSC::FTL::Output::branch):
+        (JSC::FTL::Output::ret):
+        (JSC::FTL::Output::unreachable):
+        * ftl/FTLState.h: Added.
+        (FTL):
+        (State):
+        (JSC::FTL::State::State):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/Options.h:
+        (JSC):
+
+2013-03-27  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: JITCode should abstract exactly how the JIT code is structured and where it was allocated
+        https://bugs.webkit.org/show_bug.cgi?id=113437
+
+        Reviewed by Mark Hahnenberg.
+        
+        JITCode is now a virtual base class, which will allow different JITs to have radically
+        different memory allocation and management conventions in the future. It will also
+        make it easier to store JIT-specific meta-data in CodeBlock just by putting it into
+        an appropriate JITCode subclass.
+        
+        For now there is one subclass, DirectJITCode, which just behaves like JITCode used to
+        behave.
+
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::RepatchBuffer):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::codeOriginForReturn):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::getJITCode):
+        (JSC::CodeBlock::getJITType):
+        (CodeBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h:
+        (DFG):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::codeLocationForRepatch):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        (JIT):
+        * jit/JITCode.cpp:
+        (JSC):
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::~JITCode):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::hostFunction):
+        (JSC::DirectJITCode::DirectJITCode):
+        (JSC::DirectJITCode::~DirectJITCode):
+        (JSC::DirectJITCode::addressForCall):
+        (JSC::DirectJITCode::executableAddressAtOffset):
+        (JSC::DirectJITCode::dataAddressAtOffset):
+        (JSC::DirectJITCode::offsetOf):
+        (JSC::DirectJITCode::size):
+        (JSC::DirectJITCode::contains):
+        * jit/JITCode.h:
+        (JSC):
+        (JITCode):
+        (JSC::JITCode::bottomTierJIT):
+        (JSC::JITCode::topTierJIT):
+        (JSC::JITCode::nextTierJIT):
+        (JSC::JITCode::isOptimizingJIT):
+        (JSC::JITCode::isBaselineCode):
+        (JSC::JITCode::jitType):
+        (JSC::JITCode::jitTypeFor):
+        (JSC::JITCode::executableAddress):
+        (JSC::JITCode::start):
+        (JSC::JITCode::end):
+        (DirectJITCode):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITStubs.cpp:
+        (JSC::lazyLinkFor):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualForGenerator):
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntEntrypoints.h:
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::getEntrypoint):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::generatedJITCodeForCall):
+        (JSC::ExecutableBase::generatedJITCodeForConstruct):
+        (JSC::ExecutableBase::generatedJITCodeFor):
+        (ExecutableBase):
+        (JSC::ExecutableBase::hostCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        (JSC::EvalExecutable::generatedJITCode):
+        (JSC::ProgramExecutable::generatedJITCode):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+
+2013-07-16  Oliver Hunt  <oliver@apple.com>
+
+        Merged dfgFourthTier r148570
+
+    2013-04-16  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should be able to query Structure without modifying it
+        https://bugs.webkit.org/show_bug.cgi?id=114708
+
+        Reviewed by Oliver Hunt.
+        
+        This is work towards allowing the DFG, and FTL, to run on a separate thread.
+        The idea is that the most evil thing that the DFG does that has thread-safety
+        issues is fiddling with Structures by calling Structure::get(). This can lead
+        to rematerialization of property tables, which is definitely not thread-safe
+        due to how StringImpl works. So, this patch completely side-steps the problem
+        by creating a new version of Structure::get, called
+        Structure::getWithoutMaterializing, which may choose to do an O(n) search if
+        necessary to avoid materialization. I believe this should be fine - the DFG
+        does't call into these code path often enough for this to matter, and most of
+        the time, the Structure that we call this on will already have a property
+        table because some inline cache would have already called ::get() on that
+        Structure.
+        
+        Also cleaned up the materialization logic: we can stop the search as soon as
+        we find any Structure with a property table rather than searching all the way
+        for a pinned one.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * runtime/Structure.cpp:
+        (JSC::Structure::findStructuresAndMapForMaterialization):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::getWithoutMaterializing):
+        (JSC):
+        * runtime/Structure.h:
+        (Structure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::getWithoutMaterializing):
+        (JSC):
+
+2013-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Merged dfgFourthTier r148047
+
+    2013-04-09  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should provide utilities for common OSR exit tasks
+        https://bugs.webkit.org/show_bug.cgi?id=114306
+
+        Reviewed by Mark Hahnenberg.
+        
+        Just abstract out some things that the FTL will want to use as well.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler.h:
+        (OSRExitCompiler):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp: Added.
+        (DFG):
+        (JSC::DFG::handleExitCounts):
+        (JSC::DFG::reifyInlinedCallFrames):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOSRExitCompilerCommon.h: Added.
+        (DFG):
+
+2013-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Merged dfgFourthTier r148037
+
+    2013-04-09  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should better abstract floating point arguments
+        https://bugs.webkit.org/show_bug.cgi?id=114300
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGFPRInfo.h:
+        (FPRInfo):
+        (JSC::DFG::FPRInfo::toArgumentRegister):
+
+2013-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Merged dfgFourthTier r147821
+
+    2013-04-05  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should better abstract arguments
+        https://bugs.webkit.org/show_bug.cgi?id=114073
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGGPRInfo.h:
+        (GPRInfo):
+        (JSC::DFG::GPRInfo::toArgumentRegister):
+
+2013-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Merged dfgFourthTier r147609
+
+    2013-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: put DFG data into a DFG::JITCode, and put common DFG and FTL data into something accessible from both DFG::JITCode and FTL::JITCode
+        https://bugs.webkit.org/show_bug.cgi?id=113905
+
+        Reviewed by Geoffrey Garen.
+        
+        This removes one pointer from CodeBlock.
+        
+        It also gives us a framework for having JITType-specific data in CodeBlock, by
+        putting it into the appropriate JITCode class (either DFG::JITCode or
+        FTL::JITCode). And it allows us to have DFG and FTL share some common data,
+        via DFG::CommonData, which is stored in both DFG::JITCode and FTL::JITCode and
+        always accessible via JITCode::dfgCommon().
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::performTracingFixpointIteration):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::stronglyVisitWeakReferences):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
+        (JSC::DFGCodeBlocks::mark):
+        * dfg/DFGAssemblyHelpers.h:
+        * dfg/DFGCommonData.cpp: Added.
+        (DFG):
+        (JSC::DFG::CommonData::notifyCompilingStructureTransition):
+        (JSC::DFG::CommonData::shrinkToFit):
+        * dfg/DFGCommonData.h: Added.
+        (JSC):
+        (DFG):
+        (JSC::DFG::WeakReferenceTransition::WeakReferenceTransition):
+        (WeakReferenceTransition):
+        (CommonData):
+        (JSC::DFG::CommonData::CommonData):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h:
+        (DFG):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGGraph.h:
+        (Graph):
+        * dfg/DFGJITCode.cpp: Added.
+        (DFG):
+        (JSC::DFG::JITCode::JITCode):
+        (JSC::DFG::JITCode::~JITCode):
+        (JSC::DFG::JITCode::dfgCommon):
+        (JSC::DFG::JITCode::dfg):
+        (JSC::DFG::JITCode::shrinkToFit):
+        * dfg/DFGJITCode.h: Added.
+        (DFG):
+        (JITCode):
+        (JSC::DFG::JITCode::appendOSREntryData):
+        (JSC::DFG::JITCode::osrEntryDataForBytecodeIndex):
+        (JSC::DFG::JITCode::appendOSRExit):
+        (JSC::DFG::JITCode::lastOSRExit):
+        (JSC::DFG::JITCode::appendSpeculationRecovery):
+        (JSC::DFG::JITCode::appendWatchpoint):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        (JSC::DFG::JITCompiler::addWeakReference):
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        (JSC::DFG::JITCompiler::jitCode):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::backwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableEventStream.cpp:
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::~DFGCodeBlocks):
+        (JSC::DFGCodeBlocks::jettison):
+        (JSC::DFGCodeBlocks::clearMarks):
+        (JSC::DFGCodeBlocks::deleteUnmarkedJettisonedCodeBlocks):
+        (JSC::DFGCodeBlocks::traceMarkedCodeBlocks):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::dfgCommon):
+        (JSC):
+        (JSC::JITCode::dfg):
+        (JSC::JITCode::ftl):
+        (JSC::DirectJITCode::DirectJITCode):
+        (JSC::DirectJITCode::initializeCodeRef):
+        (JSC::DirectJITCode::addressForCall):
+        (JSC::DirectJITCode::executableAddressAtOffset):
+        (JSC::DirectJITCode::dataAddressAtOffset):
+        (JSC::DirectJITCode::offsetOf):
+        (JSC::DirectJITCode::size):
+        (JSC::DirectJITCode::contains):
+        * jit/JITCode.h:
+        (DFG):
+        (FTL):
+        (JSC):
+        (JITCode):
+        (DirectJITCode):
+
+2013-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Merge dfgFourthTier r147587
+
+    2013-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: Everyone should know about the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=113897
+
+        Reviewed by Mark Hahnenberg.
+        
+        In order to get OSR exit to work right, we need the distinction between DFG and
+        FTL to be clear even after compilation finishes, since they will have subtly
+        different OSR stories and likely use different data structures.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::ProgramCodeBlock::compileOptimized):
+        (JSC::EvalCodeBlock::compileOptimized):
+        (JSC::FunctionCodeBlock::compileOptimized):
+        (JSC::CodeBlock::adjustedExitCountThreshold):
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::hasOptimizedReplacement):
+        (JSC::ExecState::isInlineCallFrame):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::JITCode):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::dumpState):
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::jettison):
+        * interpreter/Interpreter.cpp:
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        * jit/JITCode.cpp:
+        (WTF::printInternal):
+        * jit/JITCode.h:
+        (JSC::JITCode::topTierJIT):
+        (JSC::JITCode::nextTierJIT):
+        (JITCode):
+        (JSC::JITCode::isJIT):
+        (JSC::JITCode::isLowerTier):
+        (JSC::JITCode::isHigherTier):
+        (JSC::JITCode::isLowerOrSameTier):
+        (JSC::JITCode::isHigherOrSameTier):
+        (JSC::JITCode::isOptimizingJIT):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileOptimized):
+        (JSC::samplingDescription):
+        (JSC::ProgramExecutable::compileOptimized):
+        (JSC::FunctionExecutable::compileOptimizedForCall):
+        (JSC::FunctionExecutable::compileOptimizedForConstruct):
+
+2013-04-03  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: DFG should abstract out how it does forward exits, and that code should be simplified
+        https://bugs.webkit.org/show_bug.cgi?id=113894
+
+        Reviewed by Mark Hahnenberg.
+        
+        1) We previously had two different ways of convertingToForward, one path for
+           where we had a ValueRecovery for the current node and one where we didn't.
+           But the paths were doing exactly the same thing except that if you have a
+           ValueRecovery, you also find the last applicable mov hint and do some
+           extra things. This patch combines the two paths and bases both of them on
+           the previous no-ValueRecovery path, which was simpler to begin with.
+        
+        2) This moves the logic into DFG::OSRExit, which further simplifies the code
+           and makes the logic available to the FTL.
+
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::convertToForward):
+        (DFG):
+        * dfg/DFGOSRExit.h:
+        (DFG):
+        (OSRExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
+
+2013-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Merge dfgFourthTier r147582
+
+2013-07-15  Oliver Hunt  <oliver@apple.com>
+
+        Merge dfgFourthTier r147014
+
+    2013-03-27  Filip Pizlo  <fpizlo@apple.com>
+
+        fourthTier: JITCode should abstract exactly how the JIT code is structured and where it was allocated
+        https://bugs.webkit.org/show_bug.cgi?id=113437
+
+        Reviewed by Mark Hahnenberg.
+        
+        JITCode is now a virtual base class, which will allow different JITs to have radically
+        different memory allocation and management conventions in the future. It will also
+        make it easier to store JIT-specific meta-data in CodeBlock just by putting it into
+        an appropriate JITCode subclass.
+        
+        For now there is one subclass, DirectJITCode, which just behaves like JITCode used to
+        behave.
+
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::RepatchBuffer):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::bytecodeOffset):
+        (JSC::CodeBlock::codeOriginForReturn):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::getJITCode):
+        (JSC::CodeBlock::getJITType):
+        (CodeBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGDriver.h:
+        (DFG):
+        (JSC::DFG::tryCompile):
+        (JSC::DFG::tryCompileFunction):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JITCompiler):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::codeLocationForRepatch):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        (JIT):
+        * jit/JITCode.cpp:
+        (JSC):
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::~JITCode):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::hostFunction):
+        (JSC::DirectJITCode::DirectJITCode):
+        (JSC::DirectJITCode::~DirectJITCode):
+        (JSC::DirectJITCode::addressForCall):
+        (JSC::DirectJITCode::executableAddressAtOffset):
+        (JSC::DirectJITCode::dataAddressAtOffset):
+        (JSC::DirectJITCode::offsetOf):
+        (JSC::DirectJITCode::size):
+        (JSC::DirectJITCode::contains):
+        * jit/JITCode.h:
+        (JSC):
+        (JITCode):
+        (JSC::JITCode::bottomTierJIT):
+        (JSC::JITCode::topTierJIT):
+        (JSC::JITCode::nextTierJIT):
+        (JSC::JITCode::isOptimizingJIT):
+        (JSC::JITCode::isBaselineCode):
+        (JSC::JITCode::jitType):
+        (JSC::JITCode::jitTypeFor):
+        (JSC::JITCode::executableAddress):
+        (JSC::JITCode::start):
+        (JSC::JITCode::end):
+        (DirectJITCode):
+        * jit/JITDriver.h:
+        (JSC::jitCompileIfAppropriate):
+        (JSC::jitCompileFunctionIfAppropriate):
+        * jit/JITStubs.cpp:
+        (JSC::lazyLinkFor):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualForGenerator):
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntEntrypoints.h:
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::getEntrypoint):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::generatedJITCodeForCall):
+        (JSC::ExecutableBase::generatedJITCodeForConstruct):
+        (JSC::ExecutableBase::generatedJITCodeFor):
+        (ExecutableBase):
+        (JSC::ExecutableBase::hostCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        (JSC::EvalExecutable::generatedJITCode):
+        (JSC::ProgramExecutable::generatedJITCode):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareForExecution):
+        (JSC::prepareFunctionForExecution):
+
+2013-07-24  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to hijack IndexingHeader for things other than lengths
+        https://bugs.webkit.org/show_bug.cgi?id=119065
+
+        Reviewed by Mark Hahnenberg.
+        
+        Made the body of IndexingHeader be a union.
+        
+        Modified the offlineasm so that you can say IndexingHeader::u.lengths.publicLength.
+        Previously those dots would cause parse errors. Now an identifier in offlineasm can
+        have a dot anywhere except the first character.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/parser.rb:
+        * runtime/IndexingHeader.h:
+        (JSC::IndexingHeader::offsetOfPublicLength):
+        (JSC::IndexingHeader::offsetOfVectorLength):
+        (JSC::IndexingHeader::IndexingHeader):
+        (JSC::IndexingHeader::vectorLength):
+        (JSC::IndexingHeader::setVectorLength):
+        (JSC::IndexingHeader::publicLength):
+        (JSC::IndexingHeader::setPublicLength):
+
+2013-07-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JIT::updateTopCallFrame doesn't update the CallFrame's bytecodeOffset if bytecodeOffset == 0
+        https://bugs.webkit.org/show_bug.cgi?id=118923
+
+        Reviewed by Filip Pizlo.
+
+        This bug causes the CallFrame's bytecodeOffset to not be properly set when we 
+        enter, e.g., cti_optimize from an op_enter.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::updateTopCallFrame):
+
+2013-07-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG string concatenation optimizations might emit speculative nodes after emitting nodes that kill the original inputs
+        https://bugs.webkit.org/show_bug.cgi?id=119032
+
+        Reviewed by Oliver Hunt.
+
+        It just needs some Phantom action.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+
+2013-07-10  Mark Lam  <mark.lam@apple.com>
+
+        Need ExpressionRangeInfo before ResolveForPuts in strict mode.
+        https://bugs.webkit.org/show_bug.cgi?id=118997.
+
+        Reviewed by Oliver Hunt.
+
+        If we add an assertion in UnlinkedCodeBlock::expressionRangeForBytecodeOffset()
+        to ensure that we are able to find an ExpressionRangeInfo for any given bytecode
+        offset, the following tests will fails:
+            fast/js/basic-strict-mode.html
+            fast/js/mozilla/strict/8.7.2.html
+        With this fix, those tests will no longer fail.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        - Emit expression info before calls to emitResolveBaseForPut() when in strict mode.
+
+2013-07-23  Mark Lam  <mark.lam@apple.com>
+
+        Added ExpressionRangeInfo for BinaryOpNodes that can throw exceptions
+        due to type coersion.
+        https://bugs.webkit.org/show_bug.cgi?id=116853.
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BinaryOpNode::emitBytecode):
+        - Added expression info for the strcat and the general binary op cases.
+          I did not add expression info for the "compare with null" case because
+          that comparison cannot trigger type coersion, and hence it won't throw
+          any exceptions and doesn't need the expression info.
+
+2013-07-23  Mark Lam  <mark.lam@apple.com>
+
+        Removed unused sourceOffset from JSTokenLocation.
+        https://bugs.webkit.org/show_bug.cgi?id=118996.
+
+        Reviewed by Geoffrey Garen.
+
+        This also removes the assertion reported in the bug because it is now
+        moot, thereby resolving the assertion failure issue on Windows.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * parser/Lexer.cpp:
+        (JSC::::lex):
+        * parser/Lexer.h:
+        (JSC::::lexExpectIdentifier):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenLocation::JSTokenLocation):
+
+2013-07-22  Alex Christensen  <achristensen@apple.com>
+
+        Added assembly files to Windows 64-bit builds.
+        https://bugs.webkit.org/show_bug.cgi?id=118931
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added JITStubsMSVC64.asm for x64 and enabled MASM.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Added JITStubsMSVC64.asm.
+
+2013-07-20  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Remove unneeded custom stdint.h now that we build on VS2010.
+        https://bugs.webkit.org/show_bug.cgi?id=118868.
+
+        Reviewed by Anders Carlsson.
+
+        * os-win32/stdint.h: Removed.
+        * GNUmakefile.list.am: Removed reference to os-win32/stdint.h
+
+2013-07-19  Alex Christensen  <achristensen@apple.com>
+
+        Added x64 configuration to Visual Studio build.
+        https://bugs.webkit.org/show_bug.cgi?id=118888
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+
+2013-07-18  Andreas Kling  <akling@apple.com>
+
+        CodeBlock DFG entry list isn't getting shrunk-to-fit after linking.
+        <http://webkit.org/b/118875>
+        <rdar://problem/14488577>
+
+        Reviewed by Geoffrey Garen.
+
+        Move the CodeBlock::shrinkToFit() call out of JITCompiler::link() and to the call sites
+        so SpeculativeJIT::linkOSREntries() can fill in CodeBlock::m_dfgData->osrEntry first.
+
+        886 kB progression on <http://twitter.com/awesomekling>
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+
+2013-07-18  Chris Curtis  <chris_curtis@apple.com>
+
+        Fixed ASSERTION FAILED: callFrame == globalData->topCallFrame in JSC::Interpreter::addStackTraceIfNecessary
+        https://bugs.webkit.org/show_bug.cgi?id=118498
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITStubs.cpp:
+        (throwExceptionFromOpCall):
+        Created new throwExceptionFromOpCall that takes in a functor that contains
+        a function pointer (to create the errorObject) instead of a JSValue. Inside
+        of throwExceptionFromOpCall the topCallFrame is being rolled back in order
+        to handle the error throw. By passing the function pointer in, we can defer
+        the creation of the error object until after topCallFrame has been rolled 
+        back. This allows the error object to be created with the appropriate top 
+        frame.
+
+        DEFINE_STUB_FUNCTION(void*, stack_check):
+        DEFINE_STUB_FUNCTION(void*, op_call_arityCheck):
+        DEFINE_STUB_FUNCTION(void*, op_construct_arityCheck):
+        DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_NotJSFunction):
+        DEFINE_STUB_FUNCTION(EncodedJSValue, op_construct_NotJSConstruct):
+
+        (JSC::ErrorFunctor::~ErrorFunctor):
+        (JSC::ErrorWithExecFunctor::ErrorWithExecFunctor):
+        (JSC::ErrorWithExecFunctor::operator()):
+        (JSC::ErrorWithExecAndCalleeFunctor::ErrorWithExecAndCalleeFunctor):
+        (JSC::ErrorWithExecAndCalleeFunctor::operator()):
+        (JSC::ErrorWithExceptionFunctor::ErrorWithExceptionFunctor):
+        (JSC::ErrorWithExceptionFunctor::operator()):
+        (JSC::throwExceptionFromOpCall):
+
+        In order to eliminate the need to duplicate code, an error functor was 
+        created for the 3 different throwExceptionFromOpCall handles. 
+        1. The exception needs to be created, and the function pointer takes 1 
+            parameter(callFrame->callerFrame()).
+        2. The exception needs to be created, and the function pointer takes 2 
+            parameters (callFrame->callerFrame(), callFrame.calleeAsValue()).
+        3. The exception is already created. In this case, At the time when 
+            the error functor is called, globalData.exception is returned. 
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue):
+        (JSC::createError):
+        (JSC::createInvalidParameterError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        * runtime/ExceptionHelpers.h:
+
+        The function toString() was being used to stringify an object for an exception
+        message. If the user wrote a toString() for that object, then the system would 
+        continue to evaluate that code. A new helper function was created to prevent 
+        the system to continue execution and exception creation from that execution.
+
+2013-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt get_argument_by_val for JSVALUE64 stores into the array profile when it meant to store into the value profile
+        https://bugs.webkit.org/show_bug.cgi?id=118865
+
+        Reviewed by Mark Hahnenberg.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2013-07-18  Andreas Kling  <akling@apple.com>
+
+        CodeBlock::m_argumentValueProfiles wastes a lot of memory.
+        <http://webkit.org/b/118852>
+        <rdar://problem/14481659>
+
+        Reviewed by Anders Carlsson.
+
+        Use Vector::resizeToFit() for CodeBlock::m_argumentValueProfiles. We don't need any padding
+        for growth, since we won't be appending to it anyway.
+
+        921 KB progression on <http://twitter.com/awesomekling>
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::setNumParameters):
+
+2013-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix 32-bit after http://trac.webkit.org/changeset/152813
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        API tests should test for JSStringCreateWithCFString with empty string
+        https://bugs.webkit.org/show_bug.cgi?id=118819
+
+        Reviewed by Mark Hahnenberg.
+
+        * API/tests/testapi.c:
+        (main): Test!
+
+2013-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG assumes that NewFunction will never pass its input through
+        https://bugs.webkit.org/show_bug.cgi?id=118798
+
+        Reviewed by Sam Weinig.
+        
+        Previously the DFG was assuming that NewFunction always returns a function. That's not
+        the case. It may return whatever was passed to it, if it wasn't passed SpecEmpty.
+        
+        This fact needed to be wired through the compiler.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::makeTop):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-07-17  Geoffrey Garen  <ggaren@apple.com>
+
+        JSStringCreateWithCFString should not convert the empty string into the NULL string
+        https://bugs.webkit.org/show_bug.cgi?id=118816
+
+        Reviewed by Sam Weinig.
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithUTF8CString): Removed an extraneous comment, which
+        a previous version of the patch made incorrect.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString): Don't convert the empty string into the
+        null string.
+
+2013-07-17  Chris Curtis  <chris_curtis@apple.com>
+
+        Naming convention on createInvalidParamError is incorrect.
+        https://bugs.webkit.org/show_bug.cgi?id=118756
+
+        Reviewed by Geoffrey Garen.
+        
+        Changed the naming of createInvalidParamError to createInvalidParameterError.
+        This corrects the naming convention for the function listed in the WebKit code styling.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInvalidParameterError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+
+2013-07-16  David Farler  <dfarler@apple.com>
+
+        Typo in DFGInsertionSet.h header guard: "DFGInsectionSet_h" -> "DFGInsertionSet_h"
+        https://bugs.webkit.org/show_bug.cgi?id=118753
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGInsertionSet.h:
+        "DFGInsectionSet_h" -> "DFGInsertionSet_h"
+
+2013-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        MakeRope fixup shouldn't lead to an Identity without kids
+        https://bugs.webkit.org/show_bug.cgi?id=118745
+
+        Reviewed by Mark Hahnenberg.
+        
+        Make the empty string pruning part of fixupMakeRope() stop if it's on the last child.
+        
+        Make Node::convertToIdentity release-assert that it has exactly one kid.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupMakeRope):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToIdentity):
+
+2013-07-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove reference to JSValueStructSupport.h from JSExport.h
+        https://bugs.webkit.org/show_bug.cgi?id=118746
+
+        Reviewed by Filip Pizlo.
+
+        * API/JSExport.h: No such header exists, so it doesn't make sense to reference it.
+
+2013-07-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r151978.
+        http://trac.webkit.org/changeset/151978
+        https://bugs.webkit.org/show_bug.cgi?id=118651
+
+        Caused regressions at least 3 websites (Requested by rniwa on
+        #webkit).
+
+        * runtime/JSCJSValue.h:
+        * runtime/JSString.h:
+
+2013-07-12  Chris Curtis    <chris_curtis@apple.com>
+
+        Optimize addStrackTraceIfNecessary to be faster in the case when it's not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=118328
+
+        Reviewed by Geoffrey Garen.
+
+        Retrieving the stack is costly. We want to get it only once. By moving the check
+        for the .stack property above the code to retrieve the stack, we ensure this. 
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::addStackTraceIfNecessary):
+
+2013-07-12  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Build correction after r152573/r152577.
+        https://bugs.webkit.org/show_bug.cgi?id=118610
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub): Hand-feed MSVC++ the fact that we want the second
+        argument of the make_pair to be a function pointer.
+
+2013-07-11  Oliver Hunt  <oliver@apple.com>
+
+        Attempt to fix the windows build.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+
+2013-07-10  Oliver Hunt  <oliver@apple.com>
+
+        NativeExecutable cache needs to use both call and construct functions for key
+        https://bugs.webkit.org/show_bug.cgi?id=118545
+
+        Reviewed by Geoffrey Garen.
+
+        Make the native executable cache make use a key pair so we don't decide to
+        treat all subsequent functions as not being constructors.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getCallData):
+        (JSC::JSCell::getConstructData):
+
+2013-07-09  Mark Lam  <mark.lam@apple.com>
+
+        Gardening to unbreak builds on the Windows bot.
+
+        Not reviewed.
+
+        * parser/ParserTokens.h:
+
+2013-07-09  Mark Lam  <mark.lam@apple.com>
+
+        Fix 30% JSBench regression (caused by adding column numbers to stack traces).
+        https://bugs.webkit.org/show_bug.cgi?id=118481.
+
+        Reviewed by Mark Hahnenberg and Geoffrey Garen.
+
+        Previously, we already capture ExpressionRangeInfo that provides a divot for
+        each bytecode that can potentially throw an exception (and therefore generate
+        a stack trace). On first attempt to compute column numbers, we then do a walk
+        of the source string to record all line start positions in a table associated
+        with the SourceProvider. The column number can then be computed as
+            divot - lineStartFor(bytecodeOffset).
+
+        The computation of this lineStarts table is the source of the 30% JSBench
+        performance regression.
+
+        The new code now records lineStarts as the lexer and parser scans the source
+        code. These lineStarts are then used to compute the column number for the
+        given divot, and stored in the ExpressionRangeInfo. Similarly, we also capture
+        the line number at the divot point and store that in the ExpressionRangeInfo.
+        Hence, to look up line and column numbers, we now lookup the ExpressionRangeInfo
+        for the bytecodeOffset, and then compute the line and column from the values
+        stored in the expression info.
+
+        The strategy:
+        1. We want to minimize perturbations to the lexer and parser. Specifically,
+           the changes added should not change how it scans code, and generate bytecode.
+        2. We regard the divot as the source character position we are interested
+           in. As such, we'll capture line and lineStart (for column) at the point
+           when we capture the divot information. This ensures that the 3 values are
+           consistent.
+
+        How the change is done:
+        1. Change the lexer to track lineStarts.
+        2. Change the parser to capture line and lineStarts at the point of capturing
+           divots.
+        3. Change the parser and associated code to plumb these values all the way to
+           the point that the correspoinding ExpressionRangeInfo is emitted.
+        4. Propagate and record SourceCode firstLine and firstLineColumnOffset to the
+           the necessary places so that we can add them as needed when reifying
+           UnlinkedCodeBlocks into CodeBlocks.
+        5. Compress the line and column number values in the ExpressionRangeInfo. In
+           practice, we seldom have both large line and column numbers. Hence, we can
+           encode both in an uint32_t most of the time. For the times when we encounter
+           both large line and column numbers, we have a fallback to store the "fat"
+           position info.
+        6. Emit an ExpressionRangeInfo for UnaryOp nodes to get more line and column
+           number coverage.
+        7. Change the interpreter to use the new way of computing line and column.
+        8. Delete old line and column computation code that is now unused.
+
+        Misc details:
+        - the old lexer was tracking both a startOffset and charPosition where
+          charPosition equals startOffset - SourceCode.startOffset. We now use
+          startOffset exclusively throughout the system for consistency.
+          All offset values (including lineStart) are relative to the start of the
+          SourceProvider string. These values will only be converted to be relative
+          to the SourceCode.startOffset at the very last minute i.e. when the divot
+          is stored into the ExpressionRangeInfo.
+
+          This change to use the same offset system everywhere reduces confusion
+          from having to convert back and forth between the 2 systems. It also
+          enables a lot of assertions to be used.
+
+        - Also fixed some bugs in the choice of divot positions to use. For example,
+          both Eval and Function expressions previously used column numbers from
+          the start of the expression but used the line number at the end of the
+          expression. This is now fixed to use either the start or end positions
+          as appropriate, but not a mix of line and columns from both.
+
+        - Why use ints instead of unsigneds for offsets and lineStarts inside the
+          lexer and parser?
+          Some tests (e.g. fast/js/call-base-resolution.html and
+          fast/js/eval-cross-window.html) has shown that lineStart offsets can be
+          prior to the SourceCode.startOffset. Keeping the lexer offsets as ints
+          simplifies computations and makes it easier to maintain the assertions
+          that (startOffset >= lineStartOffset).
+
+          However, column and line numbers are always unsigned when we publish
+          them to the ExpressionRangeInfo. The ints are only used inside the
+          lexer and parser ... well, and bytecode generator.
+
+        - For all cases, lineStart is always captured where the divot is captured.
+          However, some sputnik conformance tests have shown that we cannot honor
+          line breaks for assignment statements like the following:
+
+              eval("x\u000A*=\u000A-1;");
+
+          In this case, the lineStart is expected to be captured at the start of
+          the assignment expression instead of at the divot point in the middle.
+          The assignment expression is the only special case for this.
+
+        This patch has been tested against the full layout tests both with release
+        and debug builds with no regression.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+          - Updated to use the new StackFrame::computeLineAndColumn().
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+          - Added m_firstLineColumnOffset initialization.
+          - Plumbed the firstLineColumnOffset into the SourceCode.
+          - Initialized column for op_debug using the new way.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+          - Changed to compute line number using the ExpressionRangeInfo.
+        (JSC::CodeBlock::columnNumberForBytecodeOffset): Added
+          - Changed to compute column number using the ExpressionRangeInfo.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::firstLineColumnOffset):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+          - Plumbed firstLineColumnOffset through to the super class.
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+          - Plumbed firstLineColumnOffset through to the super class.
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+          - Plumbed firstLineColumnOffset through to the super class.
+            But for EvalCodeBlocks, the firstLineColumnOffset is always 1
+            because we're starting with a new source string with no start
+            offset.
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+          - Plumbed firstLineColumnOffset through to the super class.
+
+        * bytecode/ExpressionRangeInfo.h:
+          - Added modes for encoding line and column into a single 30-bit
+            unsigned. The encoding is in 1 of 3 modes:
+            1. FatLineMode: 22-bit line, 8-bit column
+            2. FatColumnMode: 8-bit line, 22-bit column
+            3. FatLineAndColumnMode: 32-bit line, 32-bit column
+        (JSC::ExpressionRangeInfo::encodeFatLineMode): Added.
+          - Encodes line and column into the 30-bit position using FatLine mode.
+        (JSC::ExpressionRangeInfo::encodeFatColumnMode): Added.
+          - Encodes line and column into the 30-bit position using FatColumn mode.
+        (JSC::ExpressionRangeInfo::decodeFatLineMode): Added.
+          - Decodes the FatLine mode 30-bit position into line and column.
+        (JSC::ExpressionRangeInfo::decodeFatColumnMode): Added.
+          - Decodes the FatColumn mode 30-bit position into line and column.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+          - Plumbed startColumn through.
+        (JSC::UnlinkedFunctionExecutable::link):
+          - Plumbed startColumn through.
+        (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset):
+          - Computes a line number using the new way.
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset):
+          - Added decoding of line and column.
+          - Added handling of the case when we do not find a fitting expression
+            range info for a specified bytecodeOffset. This only happens if the
+            bytecodeOffset is below the first expression range info. In that
+            case, we'll use the first expression range info entry.
+        (JSC::UnlinkedCodeBlock::addExpressionInfo):
+          - Added encoding of line and column.
+
+        * bytecode/UnlinkedCodeBlock.h:
+          - Added m_expressionInfoFatPositions in RareData.
+        (JSC::UnlinkedFunctionExecutable::functionStartColumn):
+        (JSC::UnlinkedCodeBlock::shrinkToFit):
+          - Removed obsoleted m_lineInfo.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall): Plumbed line and lineStart through.
+        (JSC::BytecodeGenerator::emitCallEval): Plumbed line and lineStart through.
+        (JSC::BytecodeGenerator::emitCallVarargs): Plumbed line and lineStart through.
+        (JSC::BytecodeGenerator::emitConstruct): Plumbed line and lineStart through.
+        (JSC::BytecodeGenerator::emitDebugHook): Plumbed lineStart through.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+          - Removed obsoleted m_lineInfo.
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+          - Plumbed line and lineStart through.
+          - Compute the line and column to be added to the expression range info.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThrowableExpressionData::emitThrowReferenceError):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::DeleteBracketNode::emitBytecode):
+        (JSC::DeleteDotNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::PrefixNode::emitBracket):
+        (JSC::PrefixNode::emitDot):
+          - Plumbed line and lineStart through the above as needed.
+
+        (JSC::UnaryOpNode::emitBytecode):
+          - Added emission of an ExpressionRangeInfo for the UnaryOp node.
+
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::InstanceOfNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+          - Plumbed line and lineStart through the above as needed.
+
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+          - Plumbed line and lineStart through the above as needed.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::appendSourceToError):
+          - Added line and column arguments for expressionRangeForBytecodeOffset().
+        (JSC::StackFrame::computeLineAndColumn):
+          - Replaces StackFrame::line() and StackFrame::column().
+        (JSC::StackFrame::expressionInfo):
+          - Added line and column arguments.
+        (JSC::StackFrame::toString):
+          - Changed to use the new StackFrame::computeLineAndColumn().
+        (JSC::Interpreter::getStackTrace):
+          - Added the needed firstLineColumnOffset arg for the StackFrame.
+
+        * interpreter/Interpreter.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::BinaryOpInfo::BinaryOpInfo):
+        (JSC::ASTBuilder::AssignmentInfo::AssignmentInfo):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendBinaryExpressionInfo):
+        (JSC::ASTBuilder::appendUnaryToken):
+        (JSC::ASTBuilder::unaryTokenStackLastStart):
+        (JSC::ASTBuilder::unaryTokenStackLastLineStartPosition): Added.
+        (JSC::ASTBuilder::assignmentStackAppend):
+        (JSC::ASTBuilder::createAssignment):
+        (JSC::ASTBuilder::setExceptionLocation):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):.
+          - Plumbed line, lineStart, and startColumn through the above as needed.
+
+        * parser/Lexer.cpp:
+        (JSC::::currentSourcePtr):
+        (JSC::::setCode):
+          - Added tracking for sourceoffset and lineStart.
+        (JSC::::internalShift):
+        (JSC::::parseIdentifier):
+          - Added tracking for lineStart.
+        (JSC::::parseIdentifierSlowCase):
+        (JSC::::parseString):
+          - Added tracking for lineStart.
+        (JSC::::parseStringSlowCase):
+        (JSC::::lex):
+          - Added tracking for sourceoffset.
+        (JSC::::sourceCode):
+        * parser/Lexer.h:
+        (JSC::Lexer::currentOffset):
+        (JSC::Lexer::currentLineStartOffset):
+        (JSC::Lexer::setOffset):
+          - Added tracking for lineStart.
+        (JSC::Lexer::offsetFromSourcePtr): Added. conversion function.
+        (JSC::Lexer::sourcePtrFromOffset): Added. conversion function.
+        (JSC::Lexer::setOffsetFromSourcePtr):
+        (JSC::::lexExpectIdentifier):
+          - Added tracking for sourceoffset and lineStart.
+
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        (JSC::ResolveNode::ResolveNode):
+        (JSC::EvalFunctionCallNode::EvalFunctionCallNode):
+        (JSC::FunctionCallValueNode::FunctionCallValueNode):
+        (JSC::FunctionCallResolveNode::FunctionCallResolveNode):
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        (JSC::FunctionCallDotNode::FunctionCallDotNode):
+        (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode):
+        (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode):
+        (JSC::PostfixNode::PostfixNode):
+        (JSC::DeleteResolveNode::DeleteResolveNode):
+        (JSC::DeleteBracketNode::DeleteBracketNode):
+        (JSC::DeleteDotNode::DeleteDotNode):
+        (JSC::PrefixNode::PrefixNode):
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::ReadModifyBracketNode::ReadModifyBracketNode):
+        (JSC::AssignBracketNode::AssignBracketNode):
+        (JSC::AssignDotNode::AssignDotNode):
+        (JSC::ReadModifyDotNode::ReadModifyDotNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::WithNode::WithNode):
+        (JSC::ForInNode::ForInNode):
+          - Plumbed line and lineStart through the above as needed.
+        * parser/Nodes.cpp:
+        (JSC::StatementNode::setLoc): Plumbed lineStart.
+        (JSC::ScopeNode::ScopeNode): Plumbed lineStart.
+        (JSC::ProgramNode::ProgramNode): Plumbed startColumn.
+        (JSC::ProgramNode::create): Plumbed startColumn.
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode): Plumbed startColumn.
+        (JSC::FunctionBodyNode::create): Plumbed startColumn.
+        * parser/Nodes.h:
+        (JSC::Node::startOffset):
+        (JSC::Node::lineStartOffset): Added.
+        (JSC::StatementNode::firstLine):
+        (JSC::StatementNode::lastLine):
+        (JSC::ThrowableExpressionData::ThrowableExpressionData):
+        (JSC::ThrowableExpressionData::setExceptionSourceCode):
+        (JSC::ThrowableExpressionData::divotStartOffset):
+        (JSC::ThrowableExpressionData::divotEndOffset):
+        (JSC::ThrowableExpressionData::divotLine):
+        (JSC::ThrowableExpressionData::divotLineStart):
+        (JSC::ThrowableSubExpressionData::ThrowableSubExpressionData):
+        (JSC::ThrowableSubExpressionData::setSubexpressionInfo):
+        (JSC::ThrowableSubExpressionData::subexpressionDivot):
+        (JSC::ThrowableSubExpressionData::subexpressionStartOffset):
+        (JSC::ThrowableSubExpressionData::subexpressionEndOffset):
+        (JSC::ThrowableSubExpressionData::subexpressionLine):
+        (JSC::ThrowableSubExpressionData::subexpressionLineStart):
+        (JSC::ThrowablePrefixedSubExpressionData::ThrowablePrefixedSubExpressionData):
+        (JSC::ThrowablePrefixedSubExpressionData::setSubexpressionInfo):
+        (JSC::ThrowablePrefixedSubExpressionData::subexpressionDivot):
+        (JSC::ThrowablePrefixedSubExpressionData::subexpressionStartOffset):
+        (JSC::ThrowablePrefixedSubExpressionData::subexpressionEndOffset):
+        (JSC::ThrowablePrefixedSubExpressionData::subexpressionLine):
+        (JSC::ThrowablePrefixedSubExpressionData::subexpressionLineStart):
+        (JSC::ScopeNode::startStartOffset):
+        (JSC::ScopeNode::startLineStartOffset):
+        (JSC::ProgramNode::startColumn):
+        (JSC::EvalNode::startColumn):
+        (JSC::FunctionBodyNode::startColumn):
+          - Plumbed line and lineStart through the above as needed.
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+          - Plumbed line and lineStart through the above as needed.
+        (JSC::::parseFunctionBody):
+          - Plumbed startColumn.
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::LabelInfo::LabelInfo):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseMemberExpression):
+        (JSC::::parseUnaryExpression):
+          - Plumbed line, lineStart, startColumn through the above as needed.
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::tokenColumn):
+        (JSC::Parser::tokenEnd):
+        (JSC::Parser::tokenLineStart):
+        (JSC::Parser::lastTokenLine):
+        (JSC::Parser::lastTokenLineStart):
+        (JSC::::parse):
+        * parser/ParserTokens.h:
+        (JSC::JSTokenLocation::JSTokenLocation):
+          - Plumbed lineStart.
+        (JSC::JSTokenLocation::lineStartPosition):
+        (JSC::JSTokenLocation::startPosition):
+        (JSC::JSTokenLocation::endPosition):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::startColumn):
+        (JSC::makeSource):
+        (JSC::SourceCode::subExpression):
+        * parser/SourceProvider.cpp: delete old code.
+        * parser/SourceProvider.h: delete old code.
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::closeBraceToken):
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+          - Plumbed lineStart.
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegExp):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+          - Made SyntaxChecker prototype changes to match ASTBuilder due to new
+            args added for plumbing line, lineStart, and startColumn.
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::generateBytecode):
+        (JSC::CodeCache::getCodeBlock):
+          - Plumbed startColumn.
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::fromGlobalCode):
+          - Plumbed startColumn.
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::startColumn):
+        (JSC::ScriptExecutable::recordParse):
+        (JSC::FunctionExecutable::create):
+          - Plumbed startColumn.
+
+2013-07-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header files.
+
+2013-07-04  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add generation of JITStubs for x86_64 MSVC
+        https://bugs.webkit.org/show_bug.cgi?id=116666
+
+        Reviewed by Laszlo Gombos.
+
+        Also move the generation for ARM CPU into the CMakeLists.txt,
+        since it's compiler specific and not dedicated to Windows CE.
+
+        * CMakeLists.txt:
+        * PlatformWinCE.cmake: Removed.
+
+2013-07-04  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Add STATICALLY_LINKED_WITH_WTF to JavaScriptCore project
+        https://bugs.webkit.org/show_bug.cgi?id=118120
+
+        Reviewed by Gyuyoung Kim.
+
+        Since WTF is a static library linked to JavaScriptCore on all CMake ports
+        we need to define STATICALLY_LINKED_WITH_WTF for all of them.
+        This makes only a difference for Windows, since WTF_EXPORT and WTF_IMPORT
+        are the same on all other platforms.
+
+        * CMakeLists.txt:
+
+2013-07-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Replace RELEASE_ASSERT with ASSERT in CodeBlock:: bytecodeOffsetForCallAtIndex
+        https://bugs.webkit.org/show_bug.cgi?id=118316
+
+        Reviewed by Geoffrey Garen.
+
+        This is causing some crashiness in release builds. We should replace it with an ASSERT 
+        until we track down all the places that need fixing in bug 118315.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
+
+2013-07-02  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build correction for 'DebugSuffix' target.
+
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj: Must pass the
+        DEBUGSUFFIX definition to the nmake instance to be available during script processing.
+
+2013-07-01  Sergio Correia  <sergio.correia@openbossa.org>
+
+        [JSC]: Fix maybe-uninitialized gcc 4.8 warning in DFGSpeculativeJIT.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=118278
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        Initialize valueGPR with InvalidGPRReg.
+
+2013-07-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix cast-align warnings in JavaScriptCore/heap/HandleBlockInlines.h
+        https://bugs.webkit.org/show_bug.cgi?id=118242
+
+        Reviewed by Mark Hahnenberg.
+
+        * heap/HandleBlockInlines.h:
+        (JSC::HandleBlock::nodes):
+
+2013-06-29  Andreas Kling  <akling@apple.com>
+
+        Follow-up to r152206: also update HashFlags8BitBuffer in the LLInt.
+
+        * llint/LowLevelInterpreter.asm:
+
+2013-06-28  Andreas Kling  <akling@apple.com>
+
+        Un-crashify JSC tests on debug bots after Anders had his way with StringImpl.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+
+2013-06-28  Anders Carlsson  <andersca@apple.com>
+
+        Remove String::deprecatedCharactersWithNullTermination() and related code
+        https://bugs.webkit.org/show_bug.cgi?id=118211
+
+        Reviewed by Benjamin Poulain.
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharactersNoCopy):
+        Update call to StringImpl::createWithoutCopying.
+
+2013-06-27  Timothy Hatcher  <timothy@apple.com>
+
+        Notify the debugger about functions created from source code via new Function() or WebCore::JSLazyEventListener.
+
+        https://bugs.webkit.org/show_bug.cgi?id=118063
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode): Call Debugger::sourceParsed.
+
+2013-06-26  Anders Carlsson  <andersca@apple.com>
+
+        Add JSStringCreateWithCharactersNoCopy SPI
+        https://bugs.webkit.org/show_bug.cgi?id=118074
+        <rdar://problem/14279905>
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharactersNoCopy):
+        Create a new OpaqueJSString, using the newly added StringImpl::createWithoutCopying function.
+
+        * API/JSStringRefPrivate.h: Added.
+        Add a home for the JSStringCreateWithCharactersNoCopy function.
+
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::OpaqueJSString):
+        Just call isolatedCopy on the passed in string.
+
+        * API/tests/testapi.c:
+        Add an API test for JSStringCreateWithCharactersNoCopy.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add new files.
+
+2013-06-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        JSString should remember AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=117386
+
+        Reviewed by Geoffrey Garen.
+
+        Added JSValue::toAtomicString and JSString::atomicString. These two functions allow WebCore to update
+        JSString's m_value to set isAtomic flag and avoid the AtomicStringTable lookups in subsequent attempts
+        to obtain the AtomicString of the same value.
+
+        * runtime/JSCJSValue.h:
+        * runtime/JSString.h:
+        (JSC::JSString::atomicString):
+        (JSC::JSValue::toAtomicString):
+
+2013-06-24  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. Makefile build fix for AppleWindows.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+
+2013-06-17  Darin Adler  <darin@apple.com>
+
+        Sort all the Xcode project files
+        https://bugs.webkit.org/show_bug.cgi?id=117696
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ran the sort-Xcode-project-file script.
+
+2013-06-21  Mark Lam  <mark.lam@apple.com>
+
+        Introducing the VMStackBounds class.
+        https://bugs.webkit.org/show_bug.cgi?id=117862.
+
+        Reviewed by Geoffrey Garen.
+
+        - Removed Interpreter::StackPolicy.
+        - The new VMStackBounds will take over choosing the appropriate stack
+          size requirements, and invoking the underlying WTF::StackBounds to
+          to the real bounds check.
+        - VMStackBounds will now be used universally throughout JSC instead of
+          WTF::StackBounds.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isInErrorHandlingMode):
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        * parser/Parser.h:
+        * runtime/StringRecursionChecker.h:
+        (JSC::StringRecursionChecker::performCheck):
+        * runtime/VMStackBounds.h: Added.
+        (JSC::VMStackBounds::VMStackBounds):
+        (JSC::VMStackBounds::isSafeToRecurse):
+        (JSC::VMStackBounds::requiredCapacity):
+
+2013-06-20  Mark Lam  <mark.lam@apple.com>
+
+        Change stack capacity requirement to be more reasonable.
+        https://bugs.webkit.org/show_bug.cgi?id=117801.
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, the requiredStack in StackPolicy::StackPolicy() was set to
+        to a high value like 256K to reduce the chances of encountering an
+        undetected stack overflow in a scenario where we have a combination of
+        deeply nested divs and a large amount recursive re-entries into the JSGlobalData.
+
+        However, this high value of requiredStack still does not completely
+        ensure that we will never encounter an undetected stack overflow. It
+        only lessens the probability of encountering it.
+
+        Secondly, on some platforms, the total stack size can be less than 256K
+        to start with. Hence, this high value requiredStack renders the JSGlobalData
+        unuseable on those platforms.
+
+        This patch will fix the requiredStack to be more reasonable based on
+        real world stack usage by the JSGlobalData. We won't (and cannot) try to prevent
+        undetected stack overflows outside of JSC as well. External code that
+        do deep recursion (e.g. Documnet::updateLayout()) should do their own
+        stack checks.
+
+        From a previous experiment, we measured the following:
+
+        On a debug build on OSX:
+        1. Stack usage different between recursive calls to interpreter entry:
+           7744 bytes
+        On a release build on OSX:
+        2. Stack usage difference between recursive calls to interpreter entry:
+           6352 bytes
+
+        Using these as a guide, we'll pick the following values for the
+        StackPolicy:
+           requiredStack: 32K
+           errorModeRequiredStack: 16K
+
+        The requiredStack is chosen to be 4x the measured usage above. The
+        additional 3x is a conservative estimate to account for stack space
+        that may be needed by other native functions called while in the
+        interpreter.
+
+        The errorModeRequiredStack has to be less than the requiredStack or we
+        won't be able to reenter the interpreter to do error handling work when
+        an imminent stack overflow is detected. It is assumed that the error
+        handling code will only do minimal work to allocate an exception and its
+        stack trace, and not run any arbitrary JS code. As such, it is safe to
+        allow re-entry into the interpreter with only 2x the measured usage in
+        this case.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::StackPolicy::StackPolicy):
+
+2013-06-20  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        HashSet: reverse the order of the template arguments at alternate 'find', 'contains' and 'add' methods
+        https://bugs.webkit.org/show_bug.cgi?id=117830
+
+        Reviewed by Anders Carlsson.
+
+        The order of the template arguments at HashSet alternate 'find', 'contains' and
+        'add' methods is reversed so that callers can just pass the translator
+        and let the compiler deduce input argument type.
+
+        * runtime/Identifier.h:
+        (JSC::IdentifierTable::add):
+
+2013-06-20  Roger Fong  <roger_fong@apple.com>
+
+        Make Windows makefile copy build output to a different folder.
+        <rdar://problem/14219184>.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+
+2013-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Improper deallocation of JSManagedValue causes crashes during autorelease pool draining
+        https://bugs.webkit.org/show_bug.cgi?id=117840
+
+        Reviewed by Geoffrey Garen.
+
+        Improperly managing a JSManagedValue can cause a crash when the JSC::Weak inside the 
+        JSManagedValue is destroyed upon deallocation. We would rather have improperly maintained 
+        JSManagedValues cause memory leaks than take down the whole app. 
+
+        The fix is to use the callback to the JSC::Weak on the destruction of the JSGlobalData so that we 
+        can safely null it out. This will prevent ~Weak from crashing.
+
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue JSC::JSC::]):
+        (JSManagedValueHandleOwner::finalize):
+        * API/tests/testapi.mm: Added a test that crashed prior to this fix due to a leaked 
+        managed reference. Also fixed a small style nit I noticed in another test.
+
+2013-06-18  Oliver Hunt  <oliver@apple.com>
+
+        Going to google.com/trends causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=117602
+
+        Reviewed by Geoffrey Garen.
+
+        When handling op_throw, etc we need to flush the variables and arguments
+        for the entire inline stack, not just the top frame.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flushAllArgumentsAndCapturedVariablesInInlineStack):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2013-06-18  Roger Fong  <roger_fong@apple.com>
+
+        Replace tools32 folder with tools and update WebKit Windows solution accordingly.
+        <rdar://problem/14118143>.
+
+        Rubberstamped by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props:
+        * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreProduction.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jscDebug.props:
+        * JavaScriptCore.vcxproj/jsc/jscProduction.props:
+        * JavaScriptCore.vcxproj/jsc/jscRelease.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpProduction.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapiDebug.props:
+        * JavaScriptCore.vcxproj/testapi/testapiDebugCFLite.props:
+        * JavaScriptCore.vcxproj/testapi/testapiProduction.props:
+        * JavaScriptCore.vcxproj/testapi/testapiRelease.props:
+        * JavaScriptCore.vcxproj/testapi/testapiReleaseCFLite.props:
+
+2013-06-17  Roger Fong  <roger_fong@apple.com>
+
+        Modify Windows makefiles to copy some bin output into Program Files.
+        https://bugs.webkit.org/show_bug.cgi?id=117714.
+        <rdar://problem/14179054>
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+
+2013-06-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Function names on Object.prototype should be common identifiers
+        https://bugs.webkit.org/show_bug.cgi?id=117614
+
+        Reviewed by Darin Adler.
+
+        Patch written by Sam Weinig. Make Object's prototype function names common identififers since they're used frequently.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSObject.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::finishCreation):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2013-06-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove LiteralIdentifierTable
+        https://bugs.webkit.org/show_bug.cgi?id=117613
+
+        Reviewed by Geoffrey Garen.
+
+        Removed LiteralIdentifierTable since it doesn't seem to have any perf. impact now.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+
+2013-06-12  Conrad Shultz  <conrad_shultz@apple.com>
+
+        JSExport header documentation substitutes "semicolon" for "colon"
+        https://bugs.webkit.org/show_bug.cgi?id=117552
+
+        Reviewed by Mark Hahnenberg.
+
+        * API/JSExport.h:
+        Fix a couple typos.
+
+2013-06-10  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [JSC] Remove a vestige of wxWidgets support.
+        https://bugs.webkit.org/show_bug.cgi?id=117419
+
+        Reviewed by Benjamin Poulain.
+
+        * runtime/JSExportMacros.h: Remove a check for BUILDING_WX__ that
+        seems to have gone unnoticed when the wxWidgets port was removed.
+
+2013-06-06  Roger Fong  <roger_fong@apple.com>
+
+        Stop copying AAS binaries into build folder.
+        https://bugs.webkit.org/show_bug.cgi?id=117319.
+
+        Rubberstamped by Darin Adler.
+
+        * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd:
+
+2013-06-05  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CFA shouldn't filter ArrayModes with ALL_NON_ARRAY_ARRAY_MODES if the speculated type is not SpecArray
+        https://bugs.webkit.org/show_bug.cgi?id=117279
+        <rdar://problem/14078025>        
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::filterArrayModesByType):
+
+2013-06-05  Michael Saboff  <msaboff@apple.com>
+
+        JSC: Crash beneath cti_op_div @ http://gmailblog.blogspot.com
+        https://bugs.webkit.org/show_bug.cgi?id=117280
+
+        Reviewed by Filip Pizlo.
+
+        Updated the merging of VariableAccessData nodes in ArgumentPosition lists
+        to find the unified VariableAccessData node that is the root of the
+        current node instead of using the current node directly when merging
+        attributes.
+        Added new dump code to dump the ArgumentPosition list.
+
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::rgumentPosition::mergeArgumentPredictionAwareness):
+        (JSC::DFG::ArgumentPosition::mergeArgumentUnboxingAwareness):
+        (JSC::DFG::ArgumentPosition::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+
+2013-06-05  Bear Travis  <betravis@adobe.com>
+
+        [CSS Exclusions][CSS Shapes] Split CSS Exclusions & Shapes compile & runtime flags
+        https://bugs.webkit.org/show_bug.cgi?id=117172
+
+        Reviewed by Alexandru Chiculita.
+
+        Adding the CSS_SHAPES compile flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-06-05  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        JSC Assertion tests failures on MIPS.
+        https://bugs.webkit.org/show_bug.cgi?id=116552
+
+        Reviewed by Geoffrey Garen.
+
+        Fix condition handlig in branchAdd32 implemetations.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+
+2013-06-04  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Add floating point absolute function support in baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=117147
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::supportsFloatingPointAbs):
+        (JSC::MacroAssemblerSH4::absDouble):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::dabs):
+        (JSC::SH4Assembler::printInstr):
+
+2013-06-04  Zan Dobersek  <zdobersek@igalia.com>
+
+        [JSC] Test262 15.5.4.9_3 test is failing
+        https://bugs.webkit.org/show_bug.cgi?id=116789
+
+        Reviewed by Geoffrey Garen.
+
+        Bring the String.prototype.localeCompare behavior in line wit ES5 15.9.4.9.
+        If method is not given enough arguments, the minimal amount of arguments must be assumed, with their value being undefined.
+        The first argument to localeCompare, in its string form, is used as the 'that' string that's used in the comparison.
+        Therefor, when calling str.localeCompare() or str.localeCompare(undefined), the first argument is `undefined` and the
+        string "undefined" is used as the string to which value of str is compared.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLocaleCompare): Remove the early return in case of no given arguments to achieve the desired behavior.
+
+2013-06-03  Hojong Han  <hojong.han@samsung.com>
+
+        [EFL] Implement GCActivityCallback
+        https://bugs.webkit.org/show_bug.cgi?id=95923
+
+        Reviewed by Geoffrey Garen.
+
+        Implements the activity triggered garbage collector.
+        Additional GCs can be triggered by platfrom timer.
+        It has sort of compaction effect not to make JSC heap grow fast
+        so that memory usage becomes lower than usual.
+
+        * PlatformEfl.cmake: Added.
+        * heap/HeapTimer.cpp:
+        (JSC):
+        (JSC::HeapTimer::HeapTimer):
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::add):
+        (JSC::HeapTimer::stop):
+        (JSC::HeapTimer::timerEvent):
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * jsc.cpp:
+        (main):
+        * runtime/GCActivityCallback.cpp:
+        (JSC):
+        (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::scheduleTimer):
+        (JSC::DefaultGCActivityCallback::cancelTimer):
+        (JSC::DefaultGCActivityCallback::didAllocate):
+        * runtime/GCActivityCallback.h:
+        (GCActivityCallback):
+        (JSC::GCActivityCallback::GCActivityCallback):
+        (DefaultGCActivityCallback):
+
+2013-06-03  Roger Fong  <roger_fong@apple.com>
+
+        Nuke VS2005 files from the tree.
+        <rdar://problem/14042021>.
+
+        Rubberstamped by Brent Fulgham.
+
+        * JavaScriptCore.vcproj: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePGOOptimize.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePostBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePreLink.cmd: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: Removed.
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Removed.
+        * JavaScriptCore.vcproj/LLIntAssembly: Removed.
+        * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.make: Removed.
+        * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: Removed.
+        * JavaScriptCore.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Removed.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets: Removed.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Removed.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: Removed.
+        * JavaScriptCore.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.vsprops: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebugAll.vsprops: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebugCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.vsprops: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.vsprops: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorReleaseCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorReleasePGO.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc: Removed.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Removed.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jscDebug.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/jsc/jscPreBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/jsc/jscPreLink.cmd: Removed.
+        * JavaScriptCore.vcproj/jsc/jscProduction.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jscRelease.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops: Removed.
+        * JavaScriptCore.vcproj/testRegExp: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpPostBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpPreBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpPreLink.cmd: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi: Removed.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiDebug.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiPostBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiPreBuild.cmd: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiPreLink.cmd: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiProduction.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiRelease.vsprops: Removed.
+        * JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops: Removed.
+
+2013-05-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Incorrect assertion in DFG::Graph::uncheckedActivationRegisterFor()
+        <rdar://problem/13989324>
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        This has a bogus assertion that checks that the passed CodeOrigin doesn't have
+        an inline call frame. This was well intentioned in the sense that it is true
+        that inlined call frames wouldn't have an activation register. But that doesn't
+        mean that people won't ask. Removing the assertion fixes a debug-only crash and
+        has no impact on production code. This change adds a comment to that effect.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::uncheckedActivationRegisterFor):
+
+2013-05-31  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Fix Overflow case of branchMul32 in baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=117057
+
+        Reviewed by Oliver Hunt.
+
+        Current implementation of Overflow case in branchMul32 performs an
+        unsigned multiplication whereas a signed multiplication is expected.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchMul32):
+
+2013-05-31  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Fix floating point comparisons in baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=117066.
+
+        Reviewed by Oliver Hunt.
+
+        Current implementation of branchDouble function in baseline JIT is wrong
+        for some conditions and overkill for others. For instance:
+        - With DoubleGreaterThanOrEqual condition, branch will be taken if either
+          operand is NaN with current implementation whereras it should not.
+        - With DoubleNotEqualOrUnordered condition, performed NaN checks are
+          useless (because comparison result is false if either operand is NaN).
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchDouble):
+
+2013-05-31  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Fix double floating point transfer in baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=117054
+
+        Reviewed by Oliver Hunt.
+
+        In current implementation, dmovRegReg function transfers only one single
+        FPRegister as PR=1 and SZ=0 in floating point status/control register.
+        Double transfers must be performed with two fmov.s opcodes.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::moveDouble):
+        (JSC::MacroAssemblerSH4::addDouble): Handle (op2==dest) case properly.
+        (JSC::MacroAssemblerSH4::sqrtDouble):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::fmovsRegReg):
+
+2013-05-31  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Handle branchType properly in branchTruncateDoubleToInt32.
+        https://bugs.webkit.org/show_bug.cgi?id=117062
+
+        Reviewed by Oliver Hunt.
+
+        Current implementation of branchTruncateDoubleToInt32 is incorrect
+        when branchType == BranchIfTruncateSuccessful in sh4 baseline JIT.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchTruncateDoubleToInt32):
+
+2013-05-31  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix for VS2005 builders.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: Add
+        missing export for WTF::SHA1::computeHexDigest
+
+2013-05-30  David Farler  <dfarler@apple.com>
+
+        Fix jscore-test when not using --sdk option with jsDriver.pl
+        https://bugs.webkit.org/show_bug.cgi?id=116339
+
+        Reviewed by Joe Pecoraro.
+
+        * tests/mozilla/jsDriver.pl:
+        (execute_tests):
+        With each test, the shell_command needs to be started from scratch.
+
+        This fix will clear the shell_command and start over as before with
+        the opt_arch option when not using --sdk with jsDriver.pl.
+
+2013-05-30  Roger Fong  <roger_fong@apple.com>
+
+        Get rid of JavaScript exports file on AppleWin port.
+        https://bugs.webkit.org/show_bug.cgi?id=117050.
+
+        Reviewed by Darin Adler.
+
+        Delete the JavaScriptCoreExportGenerator folder and remove dependencies.
+        Start linking in WTF.lib now that it's a shared library.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorProduction.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/make-export-file-generator: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
+
+2013-05-22  David Farler  <dfarler@apple.com>
+
+        Add --sdk option to jsDriver.pl to run with iOS Simulator
+        https://bugs.webkit.org/show_bug.cgi?id=116339
+
+        Reviewed by David Kilzer.
+
+        * tests/mozilla/jsDriver.pl:
+        (execute_tests):
+        Prefix shell command with the path to the "sim" tool.
+        (parse_args):
+        Add -d / --sdk option.
+        (usage):
+        Help message for -d / --sdk option.
+
+2013-05-30  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Optimize NaN checks in LLINT for floating point comparisons.
+        https://bugs.webkit.org/show_bug.cgi?id=117049
+
+        Reviewed by Oliver Hunt.
+
+        Use the fcmp/eq opcode in sh4 LLINT to test if a double is NaN.
+        This is more efficient, doesn't require two tmp registers and requires
+        less code than current implementation (which converts double to float,
+        then checks 'E = Emax + 1' and 'f != 0').
+
+        * offlineasm/sh4.rb:
+
+2013-05-30  Oliver Hunt  <oliver@apple.com>
+
+        JSCallbackObject does not correctly initialise the PropertySlot for getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=117053
+
+        Reviewed by Mark Hahnenberg.
+
+        Set appropriate thisValue on the PropertySlot
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyDescriptor):
+        * API/tests/testapi.mm:
+
+2013-05-29  Jeffrey Pfau  <jpfau@apple.com>
+
+        [Mac] Enable cache partitioning and the public suffix list on 10.8
+        <rdar://problem/13679019>
+
+        Rubber-stamped by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-05-28  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Put correct byteCompile symbol in file. Previous version
+        had an extra 'i' appended to the end.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-05-28  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix.  Remove ?byteCompile symbol that
+        is no longer accessible during link.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-05-28  Gavin Barraclough  <barraclough@apple.com>
+
+        String(new Date(2010,10,1)) is wrong in KRAT, YAKT
+        https://bugs.webkit.org/show_bug.cgi?id=106750
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSDateMath.cpp:
+        (JSC::msToGregorianDateTime):
+            - Additional review comment fix.
+
+2013-05-28  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed build fix after r150833
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        A CR/LF combination was lost in the file, combining two symbols.
+
+2013-05-27  Gavin Barraclough  <barraclough@apple.com>
+
+        String(new Date(2010,10,1)) is wrong in KRAT, YAKT
+        https://bugs.webkit.org/show_bug.cgi?id=106750
+
+        Reviewed by Darin Adler.
+
+        First part of a fix, simplfy date handling code, instead of operating separately
+        on the UTC-standard and standard-DST offsets, just generate a combined UTC-local
+        offset (this is what we actually need, and what the OS gives us).
+
+        * runtime/JSDateMath.cpp:
+        (JSC::getLocalTimeOffset):
+            - removed getUTCOffset, converted getDSTOffset -> getLocalTimeOffset
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+            - call getLocalTimeOffset instead of getUTCOffset/getDSTOffset
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::resetDateCache):
+            - removed cachedUTCOffset, converted DSTOffsetCache -> LocalTimeOffsetCache
+        * runtime/JSGlobalData.h:
+        (JSC::LocalTimeOffsetCache::LocalTimeOffsetCache):
+        (JSC::LocalTimeOffsetCache::reset):
+        (LocalTimeOffsetCache):
+            - removed cachedUTCOffset, converted DSTOffsetCache -> LocalTimeOffsetCache
+
+2013-05-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        r150199 is very wrong
+        https://bugs.webkit.org/show_bug.cgi?id=116876
+
+        JSValue needs to protect its internal JSValueRef.
+
+        Reviewed by Darin Adler.
+
+        * API/JSValue.mm:
+        (-[JSValue initWithValue:inContext:]):
+        (-[JSValue dealloc]):
+        * API/tests/testapi.mm: Added a simple test to make sure that we protect the
+        underlying JavaScript value across garbage collections.
+
+2013-05-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Use ICU_INCLUDE_DIRS in BlackBerry CMake files
+        https://bugs.webkit.org/show_bug.cgi?id=116210
+
+        Reviewed by Rob Buis.
+
+        Set and use the ICU_INCLUDE_DIRS variable to avoid
+        duplicated adding of the ICU include directory.
+
+        * PlatformBlackBerry.cmake:
+
+2013-05-27  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        MacroAssemblerARM should use xor to swap registers instead of move
+        https://bugs.webkit.org/show_bug.cgi?id=116306
+
+        Reviewed by Zoltan Herczeg.
+
+        Change register swapping to xor from move and this way we don't need
+        temporary register anymore.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::swap):
+
+2013-05-25  Filip Pizlo  <fpizlo@apple.com>
+
+        We broke (-2^31/-1)|0 in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=116767
+
+        Reviewed by Andreas Kling.
+        
+        The bug is that we were assuming that in the -2^31 case, we already had -2^31
+        in the result register. This was a wrong assumption.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
+
+2013-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        We broke !(0/0)
+        https://bugs.webkit.org/show_bug.cgi?id=116736
+
+        Reviewed by Gavin Barraclough.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createLogicalNot):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::pureToBoolean):
+
+2013-05-24  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Optimize LLINT generated code and fix few bugs in baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=116716
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::mul32): Cosmetic changes.
+        (JSC::MacroAssemblerSH4::convertInt32ToDouble): Absolute address was not dereferenced.
+        (JSC::MacroAssemblerSH4::branch32): Absolute address was not dereferenced.
+        (JSC::MacroAssemblerSH4::revertJumpReplacementToBranchPtrWithPatch): Use all 32 bits of pointer for revertJump call.
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::revertJump): Use changePCrelativeAddress to patch the whole pointer.
+        (JSC::SH4Assembler::linkJump): Cosmetic change.
+        * offlineasm/sh4.rb: Optimize LLINT generated code.
+
+2013-05-23  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        CLoop llint backend should not use the d8 register as scratch register
+        https://bugs.webkit.org/show_bug.cgi?id=116019
+
+        Reviewed by Csaba Osztrogonác.
+
+        * offlineasm/cloop.rb:
+
+2013-05-22  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Use uninitialized register in "JIT::emit_op_neq_null" and "emit_op_eq_null"
+        https://bugs.webkit.org/show_bug.cgi?id=116593
+
+        Reviewed by Filip Pizlo.
+
+        Generated instructions using uninitialized register. It's caused by a mistake of r126494.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+
+2013-05-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of CodeBlock.h
+
+        Rubber stampted by Mark Hahnenberg.
+
+        * bytecode/CodeBlock.h:
+
+2013-05-22  Julien Brianceau  <jbrianceau@nds.com>
+
+        [sh4] Remove MacroAssemblerSH4.cpp file.
+        https://bugs.webkit.org/show_bug.cgi?id=116596.
+
+        Reviewed by Geoffrey Garen.
+
+        Move linkCall and repatchCall implementations from MacroAssemblerSH4.cpp
+        to MacroAssemblerSH4.h and remove MacroAssemblerSH4.cpp, as it is done
+        for other architectures.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * assembler/MacroAssemblerSH4.cpp: Removed.
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::linkCall):
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::repatchCall):
+
+2013-05-21  Brent Fulgham  <bfulgham@apple.com>
+
+        [Windows] Unreviewed speculative fix for test-bots.
+
+        Add export declaration for WTFInvokeCrashHook to avoid runtime
+        load error on test bots.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-05-21  Mark Lam  <mark.lam@apple.com>
+
+        Added missing assert condition for PositiveOrZero in ARM branch32().
+        https://bugs.webkit.org/show_bug.cgi?id=116538.
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchAdd32):
+
+2013-05-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Disable SuperRegion
+        https://bugs.webkit.org/show_bug.cgi?id=116362
+
+        Rubber stamped by Geoff Garen.
+
+        * heap/Region.h:
+
+2013-05-20  Oliver Hunt  <oliver@apple.com>
+
+        Make C API more robust against null contexts
+        https://bugs.webkit.org/show_bug.cgi?id=116462
+
+        Reviewed by Anders Carlsson.
+
+        Handle null contexts in a non-crashy way.  It's a bug to ever call the
+        API with a null context, and the absence of a context means we can't
+        produce a meaningful result, so we still assert in debug builds.
+
+        Now where possible we detect and early return, returning null for any
+        pointer type, NaN for doubles, and false for any boolean result.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSReportExtraMemoryCost):
+        * API/JSContextRef.cpp:
+        (JSContextGetGlobalObject):
+        (JSContextGetGroup):
+        (JSContextGetGlobalContext):
+        (JSContextCreateBacktrace):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCopyPropertyNames):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueMakeFromJSONString):
+        (JSValueCreateJSONString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+
+2013-05-20  David Kilzer  <ddkilzer@apple.com>
+
+        Synchronize FeatureDefines.xcconfig
+
+        * Configurations/FeatureDefines.xcconfig: Remove
+        ENABLE_LINK_PRERENDER.  This was missed in r150356.
+
+2013-05-19  Anders Carlsson  <andersca@apple.com>
+
+        Remove link prerendering code
+        https://bugs.webkit.org/show_bug.cgi?id=116415
+
+        Reviewed by Darin Adler.
+
+        This code was only used by Chromium and is dead now.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-05-18  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Replace *_LIBRARY_NAME with *_OUTPUT_NAME
+        https://bugs.webkit.org/show_bug.cgi?id=114554
+
+        Reviewed by Gyuyoung Kim.
+
+        Using variables as target names is very uncommon in CMake.
+        The usual way to specify the name of the resulting binary
+        is to set the OUTPUT_NAME target property.
+
+        * CMakeLists.txt:
+        * shell/CMakeLists.txt:
+
+2013-05-17  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Remove invalid include paths
+        https://bugs.webkit.org/show_bug.cgi?id=116213
+
+        Reviewed by Gyuyoung Kim.
+
+        Since "${JAVASCRIPTCORE_DIR}/wtf" does not exist, it is safe
+        to remove them from the list of include directories.
+
+        * PlatformEfl.cmake: Removed.
+        * PlatformGTK.cmake: Removed.
+
+2013-05-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Consolidate lists in JavaScriptCore CMake files
+        https://bugs.webkit.org/show_bug.cgi?id=115992
+
+        Reviewed by Gyuyoung Kim.
+
+        Move common files into the CMakeLists.txt to avoid duplicating the list of files.
+        Also rebase the recently added GTK files to match the other CMake ports, since
+        the submitted patch was based on an older version of the source tree.
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake:
+        * PlatformGTK.cmake:
+        * shell/CMakeLists.txt:
+        * shell/PlatformEfl.cmake:
+        * shell/PlatformGTK.cmake:
+
+2013-05-16  Geoffrey Garen  <ggaren@apple.com>
+
+        JSValue shouldn't protect/unprotect its context
+        https://bugs.webkit.org/show_bug.cgi?id=116234
+
+        Reviewed by Mark Hahnenberg.
+
+        Our retain on _context is sufficient.
+
+        * API/JSValue.mm:
+        (-[JSValue initWithValue:inContext:]):
+        (-[JSValue dealloc]):
+
+2013-05-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Another Windows build fix attempt after r150160.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-05-15  Oliver Hunt  <oliver@apple.com>
+
+        RefCountedArray needs to use vector initialisers for its backing store
+        https://bugs.webkit.org/show_bug.cgi?id=116194
+
+        Reviewed by Gavin Barraclough.
+
+        Use an out of line function to clear the exception stack to avoid
+        needing to include otherwise unnecessary headers all over the place.
+
+        Everything else is just being updated to use that.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearSupplementaryExceptionInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        (JSC::Interpreter::throwException):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+        (JSC::JSGlobalData::clearExceptionStack):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::exceptionStack):
+
+2013-05-15  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r150051.
+        http://trac.webkit.org/changeset/150051
+        https://bugs.webkit.org/show_bug.cgi?id=116186
+
+        Broke all JSC tests on Mac and the author is unresponsive
+        (Requested by rniwa on #webkit).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-05-15  Julien Brianceau  <jbrianceau@nds.com>
+
+        Remove savedTimeoutReg from JITStackFrame for sh4 base JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=116143
+
+        Reviewed by Geoffrey Garen.
+
+        Since r148119, timeoutCheckRegister is removed from baseline JIT.
+        So we don't need to save r8 register in JITStackFrame anymore for sh4.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        (JITStackFrame):
+
+2013-05-15  Nico Weber  <thakis@chromium.org>
+
+        WebKit doesn't support MSVS2003 any more, remove preprocessor checks for older versions.
+        https://bugs.webkit.org/show_bug.cgi?id=116157
+
+        Reviewed by Anders Carlsson.
+
+        Also remove a gcc3.2 workaround.
+
+        Merges parts of these two commits by the talented Nico Weber:
+        https://chromium.googlesource.com/chromium/blink/+/3677e2f47348daeff405a40b6f90fbdf0654c2f5
+        https://chromium.googlesource.com/chromium/blink/+/0fcd96c448dc30be1416dcc15713c53710c1a312
+
+        * os-win32/inttypes.h:
+
+2013-05-13  Alvaro Lopez Ortega  <alvaro@alobbs.com>
+
+        Nightly build's jsc doesn't work without DYLD_FRAMEWORK...
+        https://bugs.webkit.org/show_bug.cgi?id=79065
+
+        Reviewed by Darin Adler.
+
+        Fixes the build process so the depencencies of the jsc binary are
+        modified before its copied to its target directory. In this way
+        jsc should always use relative reference to the JavaScriptCore
+        libraries.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Fixes the commands in
+        the "Copy Into Framework" target.
+
+2013-05-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API: scanExternalObjectGraph should not create new JSVirtualMachine wrappers
+        https://bugs.webkit.org/show_bug.cgi?id=116074
+
+        If scanExternalObjectGraph creates a new JSVirtualMachine wrapper during collection, when the 
+        scanExternalObjectGraph call finishes and the autorelease pool is drained we will dealloc the 
+        JSVirtualMachine which will cause us to try to take the API lock for the corresponding JSGlobalData. 
+        If this happens on a GC thread other than the "main" thread, we will deadlock. The solution 
+        is to just check the JSGlobalData cache, and if there is no JSVirtualMachine wrapper, return early.
+
+        Reviewed by Darin Adler.
+
+        * API/JSVirtualMachine.mm:
+        (scanExternalObjectGraph):
+
+2013-05-13  Benjamin Poulain  <benjamin@webkit.org>
+
+        Improve stringProtoFuncLastIndexOf for the prefix case
+        https://bugs.webkit.org/show_bug.cgi?id=115952
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLastIndexOf):
+        Use the optimized string search when possible.
+
+        On Joseph Pecoraro's tests, this gives a ~30% speed improvement.
+
+2013-05-13  Zalan Bujtas  <zalan@apple.com>
+
+        WebProcess consuming very high CPU on linkedin.com
+        https://bugs.webkit.org/show_bug.cgi?id=115601
+
+        Reviewed by Andreas Kling.
+
+        Disable WEB_TIMING_MINIMAL.
+        Turn off window.performance and performance.now(). Some JS frameworks expect
+        additional Web Timing APIs, when performance.now() is available.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-05-12  Anders Carlsson  <andersca@apple.com>
+
+        Stop including UnusedParam.h
+        https://bugs.webkit.org/show_bug.cgi?id=116003
+
+        Reviewed by Sam Weinig.
+
+        UnusedParam.h is empty now so there's no need to include it anymore.
+
+        * API/APICast.h:
+        * API/tests/JSNode.c:
+        * API/tests/JSNodeList.c:
+        * API/tests/minidom.c:
+        * API/tests/testapi.c:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerCodeRef.h:
+        * bytecode/CodeBlock.cpp:
+        * heap/HandleStack.h:
+        * interpreter/JSStackInlines.h:
+        * jit/CompactJITCodeMap.h:
+        * jit/ExecutableAllocator.h:
+        * parser/SourceProvider.h:
+        * runtime/DatePrototype.cpp:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSSegmentedVariableObject.h:
+        * runtime/JSVariableObject.h:
+        * runtime/Options.cpp:
+        * runtime/PropertyOffset.h:
+
+2013-05-11  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Add a basic cmake build for WTF and JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=115967
+
+        Reviewed by Laszlo Gombos.
+
+        * PlatformGTK.cmake: Added.
+        * shell/PlatformGTK.cmake: Added.
+
+2013-05-10  Laszlo Gombos  <l.gombos@samsung.com>
+
+        Remove USE(OS_RANDOMNESS)
+        https://bugs.webkit.org/show_bug.cgi?id=108095
+
+        Reviewed by Darin Adler.
+
+        Remove the USE(OS_RANDOMNESS) guard as it is turned on for all
+        ports.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+
+2013-05-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Rename StructureCheckHoistingPhase to TypeCheckHoistingPhase
+        https://bugs.webkit.org/show_bug.cgi?id=115938
+
+        We're going to add some more types of check hoisting soon, so let's have the right name here.
+
+        Rubber stamped by Filip Pizlo.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp: Removed.
+        * dfg/DFGStructureCheckHoistingPhase.h: Removed.
+        * dfg/DFGTypeCheckHoistingPhase.cpp: Copied from Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp.
+        (JSC::DFG::TypeCheckHoistingPhase::TypeCheckHoistingPhase):
+        (JSC::DFG::performTypeCheckHoisting):
+        * dfg/DFGTypeCheckHoistingPhase.h: Copied from Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.h.
+
+2013-05-09  Christophe Dumez  <ch.dumez@sisa.samsung.com>
+
+        Unreviewed build fix after r149836.
+
+        It broke at least EFL and GTK builds. Move new static members initialization
+        outside the class. Those need to have a definition outside the class because
+        their address is used (e.g. CodeCacheMap::nonGlobalWorkingSetMaxEntries).
+
+        * runtime/CodeCache.cpp:
+        (JSC):
+        * runtime/CodeCache.h:
+        (CodeCacheMap):
+
+2013-05-08  Oliver Hunt  <oliver@apple.com>
+
+        Code cache stores bogus var references for functions in eval code
+        https://bugs.webkit.org/show_bug.cgi?id=115747
+
+        Reviewed by Mark Hahnenberg.
+
+        Non-global eval now uses a per-CodeBlock cache, and only use it
+        when we're at the top of a function's scope.  This means that we
+        will no longer cache the parsing of a single string across
+        multiple functions, and we won't cache when we're nested inside
+        constructs like |with| and |catch| where previously we would, which
+        is good because caching in those cases is unsound.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC):
+        (JSC::EvalCodeCache::getSlow):
+        (JSC::EvalCodeCache::get):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::codeCacheForEval):
+        (UnlinkedCodeBlock):
+        (RareData):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::CodeCache):
+        (JSC::CodeCache::generateBytecode):
+        (JSC):
+        (JSC::CodeCache::getCodeBlock):
+        * runtime/CodeCache.h:
+        (JSC::CodeCacheMap::CodeCacheMap):
+        (CodeCacheMap):
+        (JSC::CodeCacheMap::canPruneQuickly):
+        (JSC::CodeCacheMap::prune):
+        (JSC::CodeCache::create):
+        (CodeCache):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::EvalExecutable::compileInternal):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::create):
+        (EvalExecutable):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2013-05-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        DFGArrayMode::fromObserved is too liberal when it sees different Array and NonArray shapes
+        https://bugs.webkit.org/show_bug.cgi?id=115805
+
+        Reviewed by Geoffrey Garen.
+
+        It checks the observed ArrayModes to see if we have seen any ArrayWith* first. If so, it assumes it's 
+        an Array::Array, even if we've also observed any NonArrayWith* in the ArrayProfile. This leads to the 
+        code generated by jumpSlowForUnwantedArrayMode to check the indexing type against (shape | IsArray) 
+        instead of just shape, which can cause us to exit a lot in the case that we saw a NonArray.
+
+        To fix this we need to add a case that checks for both ArrayWith* and NonArrayWith* cases first, which 
+        should then use Array::PossiblyArray, then do the checks we were already doing.
+
+        * bytecode/ArrayProfile.h:
+        (JSC::hasSeenArray):
+        (JSC::hasSeenNonArray):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+
+2013-05-09  Joe Mason  <jmason@blackberry.com>
+
+        [BlackBerry] Set up logging buffer on start of jsc executable
+        https://bugs.webkit.org/show_bug.cgi?id=114688
+
+        Reviewed by Rob Buis.
+
+        Internal PR: 322715
+        Internally Reviewed By: Jeff Rogers
+
+        * jsc.cpp:
+        (main): call BB::Platform::setupApplicationLogging
+
+2013-05-08  Michael Saboff  <msaboff@apple.com>
+
+        JSC: There should be a disassembler for ARM Thumb 2
+        https://bugs.webkit.org/show_bug.cgi?id=115827
+
+        Reviewed by Filip Pizlo.
+
+        Added a new disassembler for ARMv7 Thumb2 instructions for use by the JSC debugging
+        and profiling code.  The opcode coverage is currently not complete.  It covers all
+        of the integer instructions JSC currently emits, but only a limited number of
+        floating point opcodes.  Currently that is just the 64 bit vmov and vmsr instructions.
+
+        The disassembler is structured as a base opcode class ARMv7DOpcode with sub-classes
+        for each instruction group.  There is a public format method that does the bulk of
+        the disassembly work.  There are two broad sub-classes, ARMv7D16BitOpcode and
+        ARMv7D32BitOpcode, for the 16 bit and 32 bit opcodes.  There are sub-classes under
+        those two classes for individual and related groups of opcodes.  Instructions are
+        "dispatched" to the right subclass via two arrays of linked lists in the inner classes
+        OpcodeGroup.  There is one such inner class for each ARMv7D16BitOpcode and ARMv7D32BitOpcode.
+        Each OpcodeGroup has a mask and a pattern that it applies to the instruction to determine
+        that it matches a particular group.  OpcodeGroup uses a static method to reinterpret_cast
+        the Opcode object to the right base class for the instruction group for formatting.
+        The cast eliminates the need of allocating an object for each decoded instruction.
+        Unknown instructions are formatted as ".word 1234" or ".long 12345678" depending whether
+        the instruction is 16 or 32 bit.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * disassembler/ARMv7: Added.
+        * disassembler/ARMv7/ARMv7DOpcode.cpp: Added.
+        (ARMv7Disassembler):
+        (OpcodeGroupInitializer):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::init):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::startITBlock):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::saveITConditionAt):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::fetchOpcode):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::disassemble):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::bufferPrintf):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendInstructionName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendRegisterName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendRegisterList):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendFPRegisterName):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::init):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::doDisassemble):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::defaultFormat):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddRegisterT2::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSPPlusImmediate::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate3::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate8::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchConditionalT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchExchangeT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchT2::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeCompareImmediateT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeCompareRegisterT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeCompareRegisterT2::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegisterT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeGeneratePCRelativeAddress::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadFromLiteralPool::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterOffsetT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterSPRelative::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLogicalImmediateT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscAddSubSP::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscBreakpointT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscByteHalfwordOps::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscCompareAndBranch::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscHint16::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscIfThenT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscPushPop::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMoveImmediateT1::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMoveRegisterT1::format):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::init):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::doDisassemble):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::defaultFormat):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeConditionalBranchT3::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchOrBranchLink::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingModifiedImmediate::appendModifiedImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingModifiedImmediate::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::appendImmShift):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::appendFPRegister):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegShift::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegExtend::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegParallel::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegMisc::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeHint32::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadRegister::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadSignedImmediate::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadUnsignedImmediate::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeUnmodifiedImmediate::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataPushPopSingle::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleImmediate12::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleImmediate8::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleRegister::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVDoublePrecision::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVSinglePrecision::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMSR::format):
+        * disassembler/ARMv7/ARMv7DOpcode.h: Added.
+        (ARMv7Disassembler):
+        (ARMv7DOpcode):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::ARMv7DOpcode):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::is32BitInstruction):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::isFPInstruction):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::conditionName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::shiftName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::inITBlock):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::startingITBlock):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::endITBlock):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendInstructionNameNoITBlock):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendSeparator):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendCharacter):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendString):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendShiftType):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendSignedImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendUnsignedImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendPCRelativeOffset):
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendShiftAmount):
+        (ARMv7D16BitOpcode):
+        (OpcodeGroup):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::OpcodeGroup::OpcodeGroup):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::OpcodeGroup::setNext):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::OpcodeGroup::next):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::OpcodeGroup::matches):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::OpcodeGroup::format):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::rm):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::rd):
+        (JSC::ARMv7Disassembler::ARMv7D16BitOpcode::opcodeGroupNumber):
+        (ARMv7DOpcodeAddRegisterT2):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddRegisterT2::rdn):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddRegisterT2::rm):
+        (ARMv7DOpcodeAddSPPlusImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSPPlusImmediate::rd):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSPPlusImmediate::immediate8):
+        (ARMv7DOpcodeAddSubtract):
+        (ARMv7DOpcodeAddSubtractT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractT1::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractT1::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractT1::rm):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractT1::rn):
+        (ARMv7DOpcodeAddSubtractImmediate3):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate3::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate3::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate3::immediate3):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate3::rn):
+        (ARMv7DOpcodeAddSubtractImmediate8):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate8::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate8::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate8::rdn):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate8::immediate8):
+        (ARMv7DOpcodeBranchConditionalT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchConditionalT1::condition):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchConditionalT1::offset):
+        (ARMv7DOpcodeBranchExchangeT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchExchangeT1::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchExchangeT1::rm):
+        (ARMv7DOpcodeBranchT2):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchT2::immediate11):
+        (ARMv7DOpcodeCompareImmediateT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeCompareImmediateT1::rn):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeCompareImmediateT1::immediate8):
+        (ARMv7DOpcodeCompareRegisterT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeCompareRegisterT1::rn):
+        (ARMv7DOpcodeCompareRegisterT2):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeCompareRegisterT2::rn):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeCompareRegisterT2::rm):
+        (ARMv7DOpcodeDataProcessingRegisterT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegisterT1::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegisterT1::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegisterT1::rm):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegisterT1::rdn):
+        (ARMv7DOpcodeGeneratePCRelativeAddress):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeGeneratePCRelativeAddress::rd):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeGeneratePCRelativeAddress::immediate8):
+        (ARMv7DOpcodeLoadFromLiteralPool):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadFromLiteralPool::rt):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadFromLiteralPool::immediate8):
+        (ARMv7DOpcodeLoadStoreRegisterImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::immediate5):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::rn):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::rt):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::scale):
+        (ARMv7DOpcodeLoadStoreRegisterImmediateWordAndByte):
+        (ARMv7DOpcodeLoadStoreRegisterImmediateHalfWord):
+        (ARMv7DOpcodeLoadStoreRegisterOffsetT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterOffsetT1::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterOffsetT1::opB):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterOffsetT1::rm):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterOffsetT1::rn):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterOffsetT1::rt):
+        (ARMv7DOpcodeLoadStoreRegisterSPRelative):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterSPRelative::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterSPRelative::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterSPRelative::rt):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterSPRelative::immediate8):
+        (ARMv7DOpcodeLogicalImmediateT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLogicalImmediateT1::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLogicalImmediateT1::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLogicalImmediateT1::immediate5):
+        (ARMv7DOpcodeMiscAddSubSP):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscAddSubSP::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscAddSubSP::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscAddSubSP::immediate7):
+        (ARMv7DOpcodeMiscByteHalfwordOps):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscByteHalfwordOps::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscByteHalfwordOps::op):
+        (ARMv7DOpcodeMiscBreakpointT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscBreakpointT1::immediate8):
+        (ARMv7DOpcodeMiscCompareAndBranch):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscCompareAndBranch::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscCompareAndBranch::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscCompareAndBranch::immediate6):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscCompareAndBranch::rn):
+        (ARMv7DOpcodeMiscHint16):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscHint16::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscHint16::opA):
+        (ARMv7DOpcodeMiscIfThenT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscIfThenT1::firstCondition):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscIfThenT1::mask):
+        (ARMv7DOpcodeMiscPushPop):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscPushPop::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscPushPop::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscPushPop::registerMask):
+        (ARMv7DOpcodeMoveImmediateT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMoveImmediateT1::rd):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMoveImmediateT1::immediate8):
+        (ARMv7DOpcodeMoveRegisterT1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMoveRegisterT1::rd):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMoveRegisterT1::rm):
+        (ARMv7D32BitOpcode):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::OpcodeGroup::OpcodeGroup):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::OpcodeGroup::setNext):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::OpcodeGroup::next):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::OpcodeGroup::matches):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::OpcodeGroup::format):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::rd):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::rm):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::rn):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::rt):
+        (JSC::ARMv7Disassembler::ARMv7D32BitOpcode::opcodeGroupNumber):
+        (ARMv7DOpcodeBranchRelative):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchRelative::sBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchRelative::j1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchRelative::j2):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchRelative::immediate11):
+        (ARMv7DOpcodeConditionalBranchT3):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeConditionalBranchT3::offset):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeConditionalBranchT3::condition):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeConditionalBranchT3::immediate6):
+        (ARMv7DOpcodeBranchOrBranchLink):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchOrBranchLink::offset):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchOrBranchLink::immediate10):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeBranchOrBranchLink::isBL):
+        (ARMv7DOpcodeDataProcessingLogicalAndRithmetic):
+        (ARMv7DOpcodeDataProcessingModifiedImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingModifiedImmediate::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingModifiedImmediate::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingModifiedImmediate::sBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingModifiedImmediate::immediate12):
+        (ARMv7DOpcodeDataProcessingShiftedReg):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::sBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::immediate5):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::type):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::tbBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingShiftedReg::tBit):
+        (ARMv7DOpcodeDataProcessingReg):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingReg::op1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingReg::op2):
+        (ARMv7DOpcodeDataProcessingRegShift):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegShift::opName):
+        (ARMv7DOpcodeDataProcessingRegExtend):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegExtend::opExtendName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegExtend::opExtendAndAddName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegExtend::rotate):
+        (ARMv7DOpcodeDataProcessingRegParallel):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegParallel::opName):
+        (ARMv7DOpcodeDataProcessingRegMisc):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataProcessingRegMisc::opName):
+        (ARMv7DOpcodeHint32):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeHint32::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeHint32::isDebugHint):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeHint32::debugOption):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeHint32::op):
+        (ARMv7DOpcodeFPTransfer):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::opH):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::opL):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::rt):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::opC):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::opB):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::vd):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeFPTransfer::vn):
+        (ARMv7DOpcodeDataLoad):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataLoad::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataLoad::op):
+        (ARMv7DOpcodeLoadRegister):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadRegister::immediate2):
+        (ARMv7DOpcodeLoadSignedImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadSignedImmediate::pBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadSignedImmediate::uBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadSignedImmediate::wBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadSignedImmediate::immediate8):
+        (ARMv7DOpcodeLoadUnsignedImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadUnsignedImmediate::immediate12):
+        (ARMv7DOpcodeLongMultipleDivide):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::smlalOpName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::smlaldOpName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::smlsldOpName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::rdLo):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::rdHi):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::op1):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::op2):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::nBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLongMultipleDivide::mBit):
+        (ARMv7DOpcodeDataPushPopSingle):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataPushPopSingle::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataPushPopSingle::op):
+        (ARMv7DOpcodeDataStoreSingle):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataStoreSingle::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataStoreSingle::op):
+        (ARMv7DOpcodeStoreSingleImmediate12):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleImmediate12::immediate12):
+        (ARMv7DOpcodeStoreSingleImmediate8):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleImmediate8::pBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleImmediate8::uBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleImmediate8::wBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleImmediate8::immediate8):
+        (ARMv7DOpcodeStoreSingleRegister):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeStoreSingleRegister::immediate2):
+        (ARMv7DOpcodeUnmodifiedImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeUnmodifiedImmediate::opName):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeUnmodifiedImmediate::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeUnmodifiedImmediate::shBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeUnmodifiedImmediate::bitNumOrSatImmediate):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeUnmodifiedImmediate::immediate5):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeUnmodifiedImmediate::immediate12):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeUnmodifiedImmediate::immediate16):
+        (ARMv7DOpcodeVMOVDoublePrecision):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVDoublePrecision::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVDoublePrecision::rt2):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVDoublePrecision::rt):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVDoublePrecision::globalData):
+        (ARMv7DOpcodeVMOVSinglePrecision):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVSinglePrecision::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVSinglePrecision::rt2):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVSinglePrecision::rt):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMOVSinglePrecision::globalData):
+        (ARMv7DOpcodeVMSR):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMSR::opL):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVMSR::rt):
+        * disassembler/ARMv7Disassembler.cpp: Added.
+        (JSC::tryToDisassemble):
+
+2013-05-07  Julien Brianceau  <jbrianceau@nds.com>
+
+        Take advantage of pre-decrement and post-increment opcodes for sh4 base JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=115722
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load8PostInc):
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::load16Unaligned):
+        (JSC::MacroAssemblerSH4::load16PostInc):
+        (JSC::MacroAssemblerSH4::storeDouble):
+        (JSC::MacroAssemblerSH4::load32WithUnalignedHalfWords):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::movwMemRegIn):
+        (SH4Assembler):
+        (JSC::SH4Assembler::movbMemRegIn):
+        (JSC::SH4Assembler::printInstr):
+
+2013-05-07  Anders Carlsson  <andersca@apple.com>
+
+        Remove AlwaysInline.h from WTF
+        https://bugs.webkit.org/show_bug.cgi?id=115727
+
+        Reviewed by Brent Fulgham.
+
+        The macro that used to be in AlwaysInline.h is now in Compiler.h so there's no reason
+        to keep AlwaysInline.h around anymore.
+
+        * jit/JSInterfaceJIT.h:
+        * parser/Lexer.h:
+        * runtime/JSCJSValue.h:
+        * runtime/SymbolTable.h:
+
+2013-05-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        HashTraits<RefPtr<P> >::PeekType should be raw pointer for better performance
+        https://bugs.webkit.org/show_bug.cgi?id=115646
+
+        Reviewed by Darin Adler.
+
+        * bytecompiler/StaticPropertyAnalyzer.h:
+        (JSC::StaticPropertyAnalyzer::putById):
+            Updated accordingly to new HashMap<.., RefPtr>::get() semantics.
+
+2013-05-06  Julien Brianceau  <jbrianceau@nds.com>
+
+        Misc bugfix and cleaning in sh4 base JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=115627
+
+        Reviewed by Oliver Hunt.
+
+        Get rid of loadX(RegisterID r0, RegisterID src, RegisterID dest) functions.
+        Remove misplaced extuw() implementation from MacroAssemblerSH4.
+        Add movbRegMemr0 and movwRegMemr0 functions in SH4Assembler.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::add32): Skip operation when first operand is a zero immediate.
+        (JSC::MacroAssemblerSH4::sub32): Skip operation when first operand is a zero immediate.
+        (JSC::MacroAssemblerSH4::load32): Fix wrong usage of r0 register.
+        (JSC::MacroAssemblerSH4::load8Signed): Handle "base == r0" case.
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::load16): Handle "base == r0" case.
+        (JSC::MacroAssemblerSH4::load16Unaligned): Use extuw() implementation from SH4Assembler.
+        (JSC::MacroAssemblerSH4::load16Signed): Cosmetic change.
+        (JSC::MacroAssemblerSH4::store8): Fix unhandled BaseIndex offset and handle (base == r0) case.
+        (JSC::MacroAssemblerSH4::store16): Fix unhandled BaseIndex offset and handle (base == r0) case.
+        (JSC::MacroAssemblerSH4::store32):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::movwRegMemr0):
+        (SH4Assembler):
+        (JSC::SH4Assembler::movbRegMemr0):
+        (JSC::SH4Assembler::placeConstantPoolBarrier): Cosmetic change.
+        (JSC::SH4Assembler::maxJumpReplacementSize):
+        (JSC::SH4Assembler::replaceWithJump): Correct branch range and save an opcode.
+        (JSC::SH4Assembler::printInstr):
+
+2013-05-06  Anders Carlsson  <andersca@apple.com>
+
+        Stop using WTF::deleteAllValues in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=115670
+
+        Reviewed by Oliver Hunt.
+
+        Change the Vectors used to Vectors of OwnPtrs instead.
+
+        * heap/DFGCodeBlocks.cpp:
+        (JSC::DFGCodeBlocks::~DFGCodeBlocks):
+        (JSC::DFGCodeBlocks::deleteUnmarkedJettisonedCodeBlocks):
+
+2013-05-06  Andras Becsi  <andras.becsi@digia.com>
+
+        Build with GCC 4.8 fails because of -Wmaybe-uninitialized
+        https://bugs.webkit.org/show_bug.cgi?id=115648
+
+        Reviewed by Michael Saboff.
+
+        Initialize values in Options::setOption since from
+        there we end up calling OptionRange::init with
+        uninitialized members.
+
+        * runtime/Options.cpp:
+
+2013-05-06  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        JSC ARM traditional failing on Octane NavierStokes test
+        https://bugs.webkit.org/show_bug.cgi?id=115626
+
+        Reviewed by Zoltan Herczeg.
+
+        Change the ARM traditional assembler to use double precision on value
+        conversions.
+
+        * assembler/ARMAssembler.h:
+
+2013-05-03  Michael Saboff  <msaboff@apple.com>
+
+        There should be a runtime option to constrain what functions get DFG compiled
+        https://bugs.webkit.org/show_bug.cgi?id=115576
+
+        Reviewed by Mark Hahnenberg.
+
+        Added OptionRange to Options to allow checking that something is within an option
+        or not.  The new OptionClass supports range strings in the form of [!]<low>[:<high>].
+        If only one value is given, then it will be used for both low and high.  A leading
+        '!' inverts the check.  If no range is given, then checking for a value within a range
+        will always return true.  Added the option "bytecodeRangeToDFGCompile" that takes an
+        OptionRange string to select the bytecode range of code blocks to DFG compile.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile): Added new check for bytecode count within bytecodeRangeToDFGCompile
+        range.
+        * runtime/Options.cpp:
+        (JSC::parse): Added overloaded parse() for OptionRange.
+        (JSC::OptionRange::init): Parse range string and then initialize the range.
+        (JSC::OptionRange::isInRange): Function used by consumer to check if a value is within
+        the specified range.
+        (JSC::Options::dumpOption): Added code to dump OptionRange options.
+        * runtime/Options.h:
+        (OptionRange): New class.
+        (JSC::OptionRange::operator= ): This is really used as a default ctor for use within
+        the Option static array initialization.
+        (JSC::OptionRange::rangeString): This is used for debug.  It assumes that the char*
+        passed into OptionRange::init is valid when this function is called.
+
+2013-05-02  Oliver Hunt  <oliver@apple.com>
+
+        Fix potential bug in lookup logic
+        https://bugs.webkit.org/show_bug.cgi?id=115522
+
+        Reviewed by Mark Hahnenberg.
+
+        Though not a problem in practise, it is technically possible
+        to inject an un-proxied global object into the scope chain
+        via the C API.  This change makes sure that the scope walk
+        in BytecodeGenerator actually limits itself to scopes that
+        are statically bindable.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC):
+        (JSC::JSObject::isStaticScopeObject):
+
+2013-05-01  Roger Fong  <roger_fong@apple.com>
+
+        Set Path in makefile for AppleWin.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+
+2013-05-01  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the remaining wscript
+        https://bugs.webkit.org/show_bug.cgi?id=115459
+
+        Reviewed by Andreas Kling.
+
+        * wscript: Removed.
+
+2013-04-30  Mark Lam  <mark.lam@apple.com>
+
+        JSContextGroupSetExecutionTimeLimit() should not pass a callback to the
+        JSGlobalData watchdog if its client did not pass one in.
+        https://bugs.webkit.org/show_bug.cgi?id=115461.
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSContextRef.cpp:
+        (internalScriptTimeoutCallback):
+        (JSContextGroupSetExecutionTimeLimit):
+        * API/tests/testapi.c:
+        (main):
+        - Added test case when the time limit callback is 0.
+        - Also updated a check to verify that a TerminatedExecutionException is
+          thrown when the time out is cancelled.
+        - Also fixed some cosmetic typos.
+
+2013-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed op_ensure_property_exists
+        https://bugs.webkit.org/show_bug.cgi?id=115460
+
+        Reviewed by Mark Hahnenberg.
+
+        It was unused, and whatever it was once used for was not optimized.
+
+        * JavaScriptCore.order:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+
+2013-04-30  Oliver Hunt  <oliver@apple.com>
+
+        JSC Stack walking logic craches in the face of inlined functions triggering JSGlobalData re-entry
+        https://bugs.webkit.org/show_bug.cgi?id=115449
+
+        Reviewed by Geoffrey Garen.
+
+        Rename callframeishost to something that makes sense, and fix
+        getCallerInfo to correctly handle inline functions calling into
+        the JSGlobalData.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::codeOriginForReturn):
+          Make this more robust in the face of incorrect stack walking
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::trueCallerFrame):
+          Everyone has to perform a codeblock() check before calling this
+          so we might as well just do it here.
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+
+2013-04-30  Julien Brianceau  <jbrianceau@nds.com>
+
+        Bug fixing in sh4 base JIT and LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=115420
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::lshift32):
+        (JSC::MacroAssemblerSH4::rshift32):
+        (JSC::MacroAssemblerSH4::branchMul32):
+        (JSC::MacroAssemblerSH4::urshift32):
+        (JSC::MacroAssemblerSH4::replaceWithJump):
+        (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::shldRegReg):
+        (JSC::SH4Assembler::shadRegReg):
+        (JSC::SH4Assembler::shalImm8r):
+        (SH4Assembler):
+        (JSC::SH4Assembler::sharImm8r):
+        (JSC::SH4Assembler::maxJumpReplacementSize):
+        (JSC::SH4Assembler::replaceWithJump):
+        * offlineasm/sh4.rb:
+
+2013-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Objective-C JavaScriptCore API should publicly support bridging to C
+        https://bugs.webkit.org/show_bug.cgi?id=115447
+
+        Reviewed by Mark Hahnenberg.
+
+        For consistency, I renamed
+
+            +[JSValue valueWithValue:] => +[JSValue valueWithJSValueRef]
+            +[JSContext contextWithGlobalContextRef] => +[JSContext contextWithJSGlobalContextRef]
+            -[JSContext globalContext] => -[JSContext JSGlobalContextRef]
+
+        I searched svn to verify that these functions don't have clients yet,
+        so we won't break anything.
+
+        I also exported as public API
+
+            +[JSValue valueWithJSValueRef:]
+            +[JSContext contextWithJSGlobalContextRef:]
+
+        It's hard to integrate with the C API without these.
+
+2013-04-30  Commit Queue  <rniwa@webkit.org>
+
+        Unreviewed, rolling out r149349 and r149354.
+        http://trac.webkit.org/changeset/149349
+        http://trac.webkit.org/changeset/149354
+        https://bugs.webkit.org/show_bug.cgi?id=115444
+
+         The Thumb version of compileSoftModulo make invalid use of
+        registers (Requested by benjaminp on #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isARMv7s):
+        (JSC):
+        * assembler/MacroAssemblerARMv7.cpp: Removed.
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-04-30  Zalan Bujtas  <zalan@apple.com>
+
+        Animations fail to start on http://www.google.com/insidesearch/howsearchworks/thestory/
+        https://bugs.webkit.org/show_bug.cgi?id=111244
+
+        Reviewed by David Kilzer.
+        
+        Enable performance.now() as a minimal subset of Web Timing API. 
+        It returns DOMHighResTimeStamp, a monotonically increasing value representing the 
+        number of milliseconds from the start of the navigation of the current document.
+        JS libraries use this API to check against the requestAnimationFrame() timestamp.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-04-30  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
+
+        Unreviewed. Speculative build fix on Qt Arm and Mips after r149349.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+
+2013-04-29  Cosmin Truta  <ctruta@blackberry.com>
+
+        [ARM] Expand the use of integer division
+        https://bugs.webkit.org/show_bug.cgi?id=115138
+
+        Reviewed by Benjamin Poulain.
+
+        If availability of hardware integer division isn't known at compile
+        time, check the CPU flags and decide at runtime whether to fall back
+        to software. Currently, this OS-specific check is implemented on QNX.
+
+        Moreover, use operator % instead of fmod() in the calculation of the
+        software modulo. Even when it's software-emulated, operator % is faster
+        than fmod(): on ARM v7 QNX, without hardware division, we noticed
+        >3% speedup on SunSpider.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::sdiv): Did not compile conditionally.
+        (JSC::ARMv7Assembler::udiv): Ditto.
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isARMv7s): Removed.
+        * assembler/MacroAssemblerARMv7.cpp: Added.
+        (JSC::isIntegerDivSupported): Added.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsIntegerDiv): Added.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Checked MacroAssembler::supportsIntegerDiv() in ArithDiv case.
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationModOnInts): Added.
+        * dfg/DFGOperations.h:
+        (JSC::DFG::Z_DFGOperation_ZZ): Added.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo): Separated the X86-specific and ARM-specific codegen
+        from the common implementation; used operationModOnInts on ARM.
+        (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARM): Renamed from compileIntegerArithDivForARMv7.
+        (JSC::DFG::SpeculativeJIT::compileArithMod): Allowed run-time detection of integer div on ARM.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Added overloads with Z_DFGOperation_ZZ arguments.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Used compileIntegerArithDivForARM.
+
+2013-04-29  Benjamin Poulain  <benjamin@webkit.org>
+
+        Unify the data access of StringImpl members from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=115320
+
+        Reviewed by Andreas Kling.
+
+        DFG accesses the member infos by directly calling the methods on StringImpl,
+        while the baseline JIT was using helper methods on ThunkHelpers.
+
+        Cut the middle man, and use StringImpl directly everywhere.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::emitLoadCharacterString):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JSInterfaceJIT.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::stringCharLoad):
+
+2013-04-29  Benjamin Poulain  <bpoulain@apple.com>
+
+        Use push and pop for iOS math function thunks
+        https://bugs.webkit.org/show_bug.cgi?id=115215
+
+        Reviewed by Filip Pizlo.
+
+        The iOS ABI is a little different than regular ARM ABI regarding stack alignment.
+        The requirement is 4 bytes:
+        "The ARM environment uses a stack that—at the point of function calls—is 4-byte aligned,
+         grows downward, and contains local variables and a function’s parameters."
+
+        Subsequently, we can just use push and pop to preserve the link register.
+
+        * jit/ThunkGenerators.cpp:
+
+2013-04-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        [Windows, WinCairo] Get rid of last few pthread include/link references.
+        https://bugs.webkit.org/show_bug.cgi?id=115375
+
+        Reviewed by Tim Horton.
+
+        * JavaScriptCore.vcproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
+
+2013-04-29  Roger Fong  <roger_fong@apple.com>
+
+        Unreviewed. AppleWin VS2010 build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
+
+2013-04-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        ~BlockAllocator should ASSERT that it has no more Regions left
+        https://bugs.webkit.org/show_bug.cgi?id=115287
+
+        Reviewed by Andreas Kling.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::~BlockAllocator):
+        (JSC::BlockAllocator::allRegionSetsAreEmpty):
+        * heap/BlockAllocator.h:
+        (RegionSet):
+        (JSC::BlockAllocator::RegionSet::isEmpty):
+        (BlockAllocator):
+
+2013-04-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        IndexingTypes should use hex
+        https://bugs.webkit.org/show_bug.cgi?id=115286
+
+        Decimal is kind of confusing/hard to read because they're used as bit masks. Hex seems more appropriate.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/IndexingType.h:
+
+2013-04-29  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing headers files to compilation
+        and offlineasm/sh4.rb script.
+
+2013-04-28  Dean Jackson  <dino@apple.com>
+
+        [Mac] Disable canvas backing store scaling (HIGH_DPI_CANVAS)
+        https://bugs.webkit.org/show_bug.cgi?id=115310
+
+        Reviewed by Simon Fraser.
+
+        Remove ENABLE_HIGH_DPI_CANVAS_macosx.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-04-27  Darin Adler  <darin@apple.com>
+
+        Move from constructor and member function adoptCF/NS to free function adoptCF/NS.
+        https://bugs.webkit.org/show_bug.cgi?id=115307
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::HeapTimer):
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler):
+        Use adoptCF free function.
+
+2013-04-27  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
+
+2013-04-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Cleaned up pre/post inc/dec in bytecode
+        https://bugs.webkit.org/show_bug.cgi?id=115222
+
+        Reviewed by Filip Pizlo.
+
+        A few related changes here:
+
+        (*) Removed post_inc and post_dec. The two-result form was awkward to
+        reason about. Being explicit about the intermediate mov and to_number
+        reduces DFG overhead, removes some fragile ASSERTs from the DFG, and
+        fixes a const bug. Plus, we get to blow away 262 lines of code.
+
+        (*) Renamed pre_inc and pre_dec to inc and dec, since there's only one
+        version now.
+
+        (*) Renamed to_jsnumber to to_number, to match the ECMA name.
+
+        (*) Tightened up the codegen and runtime support for to_number.
+
+
+        * JavaScriptCore.order: Order!
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitInc):
+        (JSC::BytecodeGenerator::emitDec):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitToNumber):
+        (BytecodeGenerator): Removed post_inc and post_dec.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::emitPreIncOrDec): Updated for rename.
+
+        (JSC::emitPostIncOrDec): Issue an explicit mov and to_number when needed.
+        These are rare, and they boil away in the DFG.
+
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve): For const, use an explicit mov instead
+        of any special forms. This fixes a bug where we would do string
+        add/subtract instead of number.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_inc):
+        (JSC::JIT::emitSlow_op_inc):
+        (JSC::JIT::emit_op_dec):
+        (JSC::JIT::emitSlow_op_dec):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_inc):
+        (JSC::JIT::emitSlow_op_inc):
+        (JSC::JIT::emit_op_dec):
+        (JSC::JIT::emitSlow_op_dec): Removed post_inc/dec, and updated for renames.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_number):
+        (JSC::JIT::emitSlow_op_to_number): Removed a test for number cells. There's
+        no such thing!
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_to_number): Use LowestTag to avoid making assumptions
+        about the lowest valued tag.
+
+        (JSC::JIT::emitSlow_op_to_number): Updated for renames.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/NodeConstructors.h:
+        (JSC::UnaryPlusNode::UnaryPlusNode): Removed post_inc/dec, and updated for renames.
+
+        * runtime/Operations.cpp:
+        (JSC::jsIsObjectType): Removed a test for number cells. There's
+        no such thing!
+
+2013-04-27  Julien Brianceau  <jbrianceau@nds.com>
+
+        REGRESSION(r149114): cache flush for SH4 arch may flush an extra page.
+        https://bugs.webkit.org/show_bug.cgi?id=115305
+
+        Reviewed by Andreas Kling.
+
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::cacheFlush):
+
+2013-04-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Re-landing <http://trac.webkit.org/changeset/148999>
+
+            Filled out more cases of branch folding in bytecode when emitting
+            expressions into a branching context
+            https://bugs.webkit.org/show_bug.cgi?id=115057
+
+            Reviewed by Phil Pizlo.
+
+        We can't fold the number == 1 case to boolean because all non-zero numbers
+        down-cast to true, but only 1 is == to true.
+
+2013-04-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Correct indentation of SymbolTable.h
+        
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/SymbolTable.h:
+
+2013-04-26  Roger Fong  <roger_fong@apple.com>
+
+        Make Apple Windows VS2010 build results into and get dependencies from __32 suffixed folders.
+        Make the DebugSuffix configuration use _debug dependencies.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCF.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorProduction.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props:
+        * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCoreProduction.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props:
+        * JavaScriptCore.vcxproj/build-generated-files.sh:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props:
+        * JavaScriptCore.vcxproj/jsc/jscDebug.props:
+        * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscProduction.props:
+        * JavaScriptCore.vcxproj/jsc/jscRelease.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpProduction.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
+        * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props:
+        * JavaScriptCore.vcxproj/testapi/testapiDebug.props:
+        * JavaScriptCore.vcxproj/testapi/testapiDebugCFLite.props:
+        * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiProduction.props:
+        * JavaScriptCore.vcxproj/testapi/testapiRelease.props:
+        * JavaScriptCore.vcxproj/testapi/testapiReleaseCFLite.props:
+
+2013-04-26  Roger Fong  <roger_fong@apple.com>
+
+        Disable sub-pixel layout on mac.
+        https://bugs.webkit.org/show_bug.cgi?id=114999.
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Make stack tracing more robust
+        https://bugs.webkit.org/show_bug.cgi?id=115272
+
+        Reviewed by Geoffrey Garen.
+
+        CallFrame already handles stack walking confusion robustly,
+        so we should make sure that the actual walk handles that as well.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getCallerInfo):
+
+2013-04-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION(r149165): It made many tests crash on 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=115227
+
+        Reviewed by Csaba Osztrogonác.
+
+        m_reservation is uninitialized when ENABLE(SUPER_REGION) is false.
+
+        * heap/SuperRegion.cpp:
+        (JSC::SuperRegion::~SuperRegion):
+
+2013-04-26  Julien Brianceau  <jbrianceau@nds.com>
+
+        Fix SH4 build broken since r149159.
+        https://bugs.webkit.org/show_bug.cgi?id=115229
+
+        Add BranchTruncateType enum in SH4 port and handle it in branchTruncateDoubleToInt32.
+
+        Reviewed by Allan Sandfeld Jensen.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchTruncateDoubleToInt32):
+
+2013-04-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        SuperRegion doesn't call deallocate() on its PageReservation
+        https://bugs.webkit.org/show_bug.cgi?id=115208
+
+        Reviewed by Geoffrey Garen.
+
+        It should. This doesn't cause us to leak physical memory, but it does cause us to leak virtual 
+        address space (and probably mach ports), which is also bad :-( FixedVMPoolExecutableAllocator 
+        also has this bug, but it doesn't matter much because there's only one instance of that class 
+        throughout the entire lifetime of the process, whereas each JSGlobalData has its own SuperRegion. 
+
+        * heap/SuperRegion.cpp:
+        (JSC::SuperRegion::~SuperRegion):
+        * heap/SuperRegion.h:
+        (SuperRegion):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (FixedVMPoolExecutableAllocator):
+        (JSC::FixedVMPoolExecutableAllocator::~FixedVMPoolExecutableAllocator):
+
+2013-04-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG doesn't support to_jsnumber
+        https://bugs.webkit.org/show_bug.cgi?id=115129
+
+        Reviewed by Geoffrey Garen.
+        
+        Based on Oliver's patch. Implements to_jsnumber as Identity(Number:@thingy), and then does
+        an optimization in Fixup to turn Identity(Number:) into Identity(Int32:) if the predictions
+        tell us to. Identity is later turned into Phantom.
+        
+        Also fixed BackPropMask, which appeared to have NodeDoesNotExit included in it. That's
+        wrong; NodeDoesNotExit is not a backward propagation property.
+        
+        Also fixed Identity to be marked as CanExit (i.e. not NodeDoesNotExit).
+        
+        This more than doubles the FPS on ammo.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::observeUseKindOnEdge):
+        * dfg/DFGNodeFlags.h:
+        (DFG):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2013-04-24  Oliver Hunt  <oliver@apple.com>
+
+        Add support for Math.imul
+        https://bugs.webkit.org/show_bug.cgi?id=115143
+
+        Reviewed by Filip Pizlo.
+
+        Add support for Math.imul, a thunk generator for Math.imul,
+        and an intrinsic.
+
+        Fairly self explanatory set of changes, DFG intrinsics simply
+        leverages the existing ValueToInt32 nodes.
+
+        * create_hash_table:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithIMul):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/ThunkGenerators.cpp:
+        (JSC::imulThunkGenerator):
+        (JSC):
+        * jit/ThunkGenerators.h:
+        (JSC):
+        * runtime/Intrinsic.h:
+        * runtime/MathObject.cpp:
+        (JSC):
+        (JSC::mathProtoFuncIMul):
+        * runtime/JSGlobalData.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+
+2013-04-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/148999
+        It broke http://kripken.github.io/ammo.js/examples/new/ammo.html
+
+        * JavaScriptCore.order:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::shouldEmitProfileHooks):
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC):
+        (JSC::NullNode::emitBytecode):
+        (JSC::BooleanNode::emitBytecode):
+        (JSC::NumberNode::emitBytecode):
+        (JSC::StringNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createIfStatement):
+        (ASTBuilder):
+        * parser/NodeConstructors.h:
+        (JSC):
+        (JSC::NullNode::NullNode):
+        (JSC::BooleanNode::BooleanNode):
+        (JSC::NumberNode::NumberNode):
+        (JSC::StringNode::StringNode):
+        (JSC::IfNode::IfNode):
+        (JSC::IfElseNode::IfElseNode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isPure):
+        (JSC::ExpressionNode::isSubtract):
+        (StatementNode):
+        (NullNode):
+        (JSC::NullNode::isNull):
+        (BooleanNode):
+        (JSC::BooleanNode::isPure):
+        (NumberNode):
+        (JSC::NumberNode::value):
+        (JSC::NumberNode::isPure):
+        (StringNode):
+        (JSC::StringNode::isPure):
+        (JSC::StringNode::isString):
+        (BinaryOpNode):
+        (IfNode):
+        (JSC):
+        (IfElseNode):
+        (ContinueNode):
+        (BreakNode):
+        * parser/Parser.cpp:
+        (JSC::::parseIfStatement):
+        * parser/ResultType.h:
+        (ResultType):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::pureToBoolean):
+        * runtime/JSCell.h:
+        (JSCell):
+        * runtime/JSCellInlines.h:
+        (JSC):
+
+2013-04-25  Filip Pizlo  <fpizlo@apple.com>
+
+        PreciseJumpTargets should treat loop_hint as a jump target
+        https://bugs.webkit.org/show_bug.cgi?id=115209
+
+        Reviewed by Mark Hahnenberg.
+        
+        I didn't add a test but I turned this into a release assertion. Running Octane is enough
+        to trigger it.
+
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::computePreciseJumpTargets):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2013-04-25  Roman Zhuykov  <zhroma@ispras.ru>
+
+        Fix problems with processing negative zero on DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=113862
+
+        Reviewed by Filip Pizlo.
+
+        Fix NodeNeedsNegZero flag propagation in BackwardPropagationPhase.
+        Function arithNodeFlags should not mask NodeNeedsNegZero flag for ArithNegate and DoubleAsInt32
+        nodes and this flag should be always used to decide where we need to generate nezative-zero checks.
+        Remove unnecessary negative-zero checks from integer ArithDiv on ARM.
+        Also remove such checks from integer ArithMod on ARM and X86, and make them always to
+        check not only "modulo_result == 0" but also "dividend < 0".
+        Generate faster code for case when ArithMod operation divisor is constant power of 2 on ARMv7
+        in the same way as on ARMv7s, and add negative-zero checks into this code when needed.
+        Change speculationCheck ExitKind from Overflow to NegativeZero where applicable.
+ 
+        This shows 30% speedup of math-spectral-norm, and 5% speedup
+        on SunSpider overall on ARMv7 Linux.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchConvertDoubleToInt32):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchConvertDoubleToInt32):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchConvertDoubleToInt32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
+        (JSC::DFG::BackwardsPropagationPhase::isNotPosZero):
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
+        (JSC::DFG::SpeculativeJIT::compileSoftModulo):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+
+2013-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Stack guards are too conservative
+        https://bugs.webkit.org/show_bug.cgi?id=115147
+
+        Reviewed by Mark Hahnenberg.
+
+        Increase stack guard to closer to old size.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::StackPolicy::StackPolicy):
+
+2013-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Stack guards are too conservative
+        https://bugs.webkit.org/show_bug.cgi?id=115147
+
+        Reviewed by Geoffrey Garen.
+
+        Reduce the limits and simplify the decision making.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::StackPolicy::StackPolicy):
+
+2013-04-25  Nick Diego Yamane  <nick.yamane@openbossa.org>
+
+        JSC: Fix interpreter misbehavior in builds with JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=115190
+
+        Reviewed by Oliver Hunt.
+
+        Commit http://trac.webkit.org/changeset/147858 modified
+        some details on how JS stack traces are built. The method
+        "getLineNumberForCallFrame", renamed in that changeset to
+        "getBytecodeOffsetForCallFrame" is always returning `0' when
+        JIT is disabled
+
+        How to reproduce:
+         - Build webkit with JIT disabled
+         - Open MiniBrowser, for example, with http://google.com
+         - In a debug build, WebProcess will hit the following ASSERT:
+           Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp:279 ASSERT(low);
+
+        * interpreter/Interpreter.cpp:
+        (JSC::getBytecodeOffsetForCallFrame):
+
+2013-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Make checkSyntax take a JSGlobalData instead of an ExecState
+
+        RS=Tim
+
+        * jsc.cpp:
+        (runInteractive):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        * runtime/Completion.h:
+        (JSC):
+
+2013-04-25  Michael Saboff  <msaboff@apple.com>
+
+        32 Bit: Crash due to RegExpTest nodes not setting result type to Boolean
+        https://bugs.webkit.org/show_bug.cgi?id=115188
+
+        Reviewed by Geoffrey Garen.
+
+        Changed the RegExpTest node to set the AbstractValue to boolean, since that
+        what it is.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+
+2013-04-25  Julien Brianceau  <jbrianceau@nds.com>
+
+        REGRESSION(r137994): Random crashes occur with SH4 JSC.
+        https://bugs.webkit.org/show_bug.cgi?id=115167.
+
+        Reviewed by Oliver Hunt.
+
+        Since r137994, uncommited pages could be inside the area of memory in
+        parameter of the cacheFlush function. That's why we have to flush each
+        page separately to avoid a fail of the whole flush, if an uncommited page
+        is in the area.
+
+        This patch is very similar to changeset 145194 made for ARMv7 architecture,
+        see https://bugs.webkit.org/show_bug.cgi?id=111441 for further information.
+
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::cacheFlush):
+
+2013-04-24  Mark Lam  <mark.lam@apple.com>
+
+        Add watchdog timer polling for the DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=115134.
+
+        Reviewed by Geoffrey Garen.
+
+        The strategy is to add a speculation check to the DFG generated code to
+        test if the watchdog timer has fired or not. If the watchdog timer has
+        fired, the generated code will do an OSR exit to the baseline JIT, and
+        let it handle servicing the watchdog timer.
+
+        If the watchdog is not enabled, this speculation check will not be
+        emitted.
+
+        * API/tests/testapi.c:
+        (currentCPUTime_callAsFunction):
+        (extendTerminateCallback):
+        (main):
+        - removed try/catch statements so that we can test the watchdog on the DFG.
+        - added JS bindings to a native currentCPUTime() function so that the timeout
+          tests can be more accurate.
+        - also shortened the time values so that the tests can complete sooner.
+
+        * bytecode/ExitKind.h:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::setTimeLimit):
+
+2013-04-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Special thunks for math functions should work on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=115144
+
+        Reviewed by Gavin Barraclough and Oliver Hunt.
+        
+        The only hard bit here was ensuring that we implemented the very special
+        "cheap C call" convention on ARMv7.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isARMv7s):
+        (JSC):
+        (JSC::isX86):
+        * dfg/DFGCommon.h:
+        * jit/SpecializedThunkJIT.h:
+        (SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
+        * jit/ThunkGenerators.cpp:
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+
+2013-04-24  Julien Brianceau  <jbrianceau@nds.com>
+
+        Misc bugfix and cleaning in sh4 base JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=115022.
+
+        Reviewed by Oliver Hunt.
+
+        Remove unused add32() and sub32() with scratchreg parameter to avoid
+        confusion as this function prototype means another behaviour.
+        Remove unused "void push(Address)" function which seems quite buggy.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::and32): Cosmetic change.
+        (JSC::MacroAssemblerSH4::lshift32): Cosmetic change.
+        (JSC::MacroAssemblerSH4::or32): Cosmetic change.
+        (JSC::MacroAssemblerSH4::xor32): Cosmetic change.
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::load32): Cosmetic change.
+        (JSC::MacroAssemblerSH4::load8Signed): Fix invalid offset upper limit
+        when using r0 register and cosmetic changes.
+        (JSC::MacroAssemblerSH4::load8): Reuse load8Signed to avoid duplication.
+        (JSC::MacroAssemblerSH4::load16): Fix invalid offset upper limit when
+        using r0 register, fix missing offset shift and cosmetic changes.
+        (JSC::MacroAssemblerSH4::store32): Cosmetic change.
+        (JSC::MacroAssemblerSH4::branchAdd32): Store result value before branch.
+
+2013-04-24  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Remove pthread from Visual Studio files in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=114864
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
+        * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props:
+
+2013-04-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should keep the operand to create_this alive if it's emitting code for create_this
+        https://bugs.webkit.org/show_bug.cgi?id=115133
+
+        Reviewed by Mark Hahnenberg.
+        
+        The DFG must model bytecode liveness, or else OSR exit is going to have a really bad time.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2013-04-24  Roger Fong  <roger_fong@apple.com>
+
+        Have VS2010 WebKit solution look in WebKit_Libraries/lib32 for dependencies.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd:
+
+2013-04-24  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit build fix.
+
+        Unreviewed.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch): Explicitly
+        truncate to 32-bit to avoid compiler warnings. It's safe to truncate
+        because the payload of a boolean is the low bits on both 64-bit and 32-bit.
+
+2013-04-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Filled out more cases of branch folding in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=115088
+
+        Reviewed by Oliver Hunt.
+
+        No change on the benchmarks we track, but a 3X speedup on a
+        microbenchmark that uses these techniques.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): (!/=)= and (!/=)== can constant
+        fold all types, not just numbers, because true constants have no
+        side effects when type-converted at runtime.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateBoolean): Added support for fixing up
+        boolean uses, like we do for other types like number.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileBooleanCompare): Peephole fuse
+        boolean compare and/or compare-branch, now that we have the types for
+        them.
+
+        * dfg/DFGSpeculativeJIT.h: Updated declarations.
+
+== Rolled over to ChangeLog-2013-04-24 ==
diff --git a/ChangeLog-2014-02-20 b/ChangeLog-2014-02-20
new file mode 100644
index 0000000..0ad98d4
--- /dev/null
+++ b/ChangeLog-2014-02-20
@@ -0,0 +1,22908 @@
+2014-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CopiedBlock::pin can call into fastFree while forbidden
+        https://bugs.webkit.org/show_bug.cgi?id=128654
+
+        Reviewed by Oliver Hunt.
+
+        A FullCollection that skips copying doesn't clear the CopyWorkList of the all the surviving 
+        CopiedBlocks because we currently only call didSurviveGC() at the beginning of FullCollections.
+
+        EdenCollections always do copying, therefore they always clear all CopyWorkLists.
+
+        The fix is to call didSurviveGC() for all surviving CopiedBlocks at the end of FullCollections 
+        as well at the beginning.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::didSurviveGC):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneCopying):
+
+2014-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add a JSC option to disable EdenCollections
+        https://bugs.webkit.org/show_bug.cgi?id=128849
+
+        Reviewed by Mark Lam.
+
+        This will help quickly identify whether or not GenGC is responsible for a 
+        particular crash by prematurely collecting a live object.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        (JSC::Heap::shouldDoFullCollection):
+        * heap/Heap.h:
+        * runtime/Options.h:
+
+2014-02-20  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r164417): ASSERTION FAILED: isBranch() in X86 32 bit build
+        https://bugs.webkit.org/show_bug.cgi?id=129118
+
+        Reviewed by Filip Pizlo.
+
+        Changed 32 bit version of SpeculativeJIT::compile handling of Jump nodes to match
+        what is in the 64 bit build.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-02-20  Zan Dobersek  <zdobersek@igalia.com>
+
+        [Automake] Collect the JavaScript files required for JSC builtins through a wildcard
+        https://bugs.webkit.org/show_bug.cgi?id=129115
+
+        Reviewed by Oliver Hunt.
+
+        * GNUmakefile.list.am: Simplify adding new JavaScriptCore builtins by using a wildcard
+        to gather all the JavaScript files instead of listing each file explicitly.
+
+2014-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Replace uses of deprecated POSIX index() with strchr() in ObjcRuntimeExtras.h
+        https://bugs.webkit.org/show_bug.cgi?id=128610
+
+        Reviewed by Anders Carlsson.
+
+        index() is deprecated in favor of strchr() so we should use the latter.
+
+        * API/JSWrapperMap.mm:
+        (selectorToPropertyName):
+        * API/ObjcRuntimeExtras.h:
+        (parseObjCType):
+
+2014-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should not emit stack overflow checks in leaf functions
+        https://bugs.webkit.org/show_bug.cgi?id=129085
+
+        Reviewed by Michael Saboff.
+        
+        Miniscule (0.5%) speed-up on V8v7.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::didOverflowStack):
+
+2014-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Dynamically generated JSExport protocols added to a class results in a crash
+        https://bugs.webkit.org/show_bug.cgi?id=129108
+
+        Reviewed by Oliver Hunt.
+
+        We're not getting any information from the runtime about the types of the methods on 
+        these protocols because they didn't exist at compile time. We should handle this gracefully.
+
+        * API/ObjCCallbackFunction.mm:
+        (objCCallbackFunctionForInvocation):
+        * API/tests/JSExportTests.mm:
+        (+[JSExportTests exportDynamicallyGeneratedProtocolTest]):
+        (runJSExportTests):
+
+2014-02-20  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        ASSERTION FAILED: isUInt16() on ARMv7 after r113253.
+        https://bugs.webkit.org/show_bug.cgi?id=129101
+
+        Reviewed by Michael Saboff.
+
+        If the immediate value type is encoded then we shouldn't reach this assert.
+        Check the immediate type to avoid assertion in alignemnt check.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::add):
+
+2014-02-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Get rid of redundant Platform.h includes
+        https://bugs.webkit.org/show_bug.cgi?id=128817
+
+        Reviewed by Brent Fulgham.
+
+        * API/tests/JSNode.c:
+        * API/tests/JSNodeList.c:
+        * API/tests/minidom.c:
+        * API/tests/testapi.c:
+        * assembler/MacroAssembler.h:
+        * bytecode/ByValInfo.h:
+        * bytecode/CallLinkInfo.h:
+        * bytecode/CallReturnOffsetToBytecodeOffset.h:
+        * bytecode/CodeType.h:
+        * bytecode/HandlerInfo.h:
+        * bytecode/MethodOfGettingAValueProfile.h:
+        * bytecode/PolymorphicAccessStructureList.h:
+        * bytecode/PolymorphicPutByIdList.h:
+        * bytecode/StructureStubClearingWatchpoint.h:
+        * bytecode/StructureStubInfo.h:
+        * bytecode/ValueRecovery.h:
+        * bytecode/VirtualRegister.h:
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreter.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGAdjacencyList.h:
+        * dfg/DFGAllocator.h:
+        * dfg/DFGAnalysis.h:
+        * dfg/DFGArgumentsSimplificationPhase.h:
+        * dfg/DFGArrayMode.h:
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGAtTailAbstractState.h:
+        * dfg/DFGBackwardsPropagationPhase.h:
+        * dfg/DFGBinarySwitch.h:
+        * dfg/DFGBlockInsertionSet.h:
+        * dfg/DFGBranchDirection.h:
+        * dfg/DFGCFAPhase.h:
+        * dfg/DFGCFGSimplificationPhase.h:
+        * dfg/DFGCPSRethreadingPhase.h:
+        * dfg/DFGCSEPhase.h:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGClobberSet.h:
+        * dfg/DFGClobberize.h:
+        * dfg/DFGCommon.h:
+        * dfg/DFGCommonData.h:
+        * dfg/DFGConstantFoldingPhase.h:
+        * dfg/DFGCriticalEdgeBreakingPhase.h:
+        * dfg/DFGDCEPhase.h:
+        * dfg/DFGDesiredIdentifiers.h:
+        * dfg/DFGDesiredStructureChains.h:
+        * dfg/DFGDesiredWatchpoints.h:
+        * dfg/DFGDisassembler.h:
+        * dfg/DFGDominators.h:
+        * dfg/DFGDriver.h:
+        * dfg/DFGEdge.h:
+        * dfg/DFGEdgeDominates.h:
+        * dfg/DFGEdgeUsesStructure.h:
+        * dfg/DFGFailedFinalizer.h:
+        * dfg/DFGFiltrationResult.h:
+        * dfg/DFGFinalizer.h:
+        * dfg/DFGFixupPhase.h:
+        * dfg/DFGFlushFormat.h:
+        * dfg/DFGFlushLivenessAnalysisPhase.h:
+        * dfg/DFGFlushedAt.h:
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.h:
+        * dfg/DFGInsertionSet.h:
+        * dfg/DFGInvalidationPointInjectionPhase.h:
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGLICMPhase.h:
+        * dfg/DFGLazyJSValue.h:
+        * dfg/DFGLivenessAnalysisPhase.h:
+        * dfg/DFGLongLivedState.h:
+        * dfg/DFGLoopPreHeaderCreationPhase.h:
+        * dfg/DFGMinifiedGraph.h:
+        * dfg/DFGMinifiedID.h:
+        * dfg/DFGMinifiedNode.h:
+        * dfg/DFGNaturalLoops.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNodeAllocator.h:
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.h:
+        * dfg/DFGOSREntrypointCreationPhase.h:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitBase.h:
+        * dfg/DFGOSRExitCompilationInfo.h:
+        * dfg/DFGOSRExitCompiler.h:
+        * dfg/DFGOSRExitCompilerCommon.h:
+        * dfg/DFGOSRExitJumpPlaceholder.h:
+        * dfg/DFGPhase.h:
+        * dfg/DFGPlan.h:
+        * dfg/DFGPredictionInjectionPhase.h:
+        * dfg/DFGPredictionPropagationPhase.h:
+        * dfg/DFGResurrectionForValidationPhase.h:
+        * dfg/DFGSSAConversionPhase.h:
+        * dfg/DFGSafeToExecute.h:
+        * dfg/DFGSaneStringGetByValSlowPathGenerator.h:
+        * dfg/DFGSilentRegisterSavePlan.h:
+        * dfg/DFGSlowPathGenerator.h:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGStackLayoutPhase.h:
+        * dfg/DFGStructureAbstractValue.h:
+        * dfg/DFGThunks.h:
+        * dfg/DFGTierUpCheckInjectionPhase.h:
+        * dfg/DFGToFTLDeferredCompilationCallback.h:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h:
+        * dfg/DFGTypeCheckHoistingPhase.h:
+        * dfg/DFGUnificationPhase.h:
+        * dfg/DFGUseKind.h:
+        * dfg/DFGValidate.h:
+        * dfg/DFGValueRecoveryOverride.h:
+        * dfg/DFGValueSource.h:
+        * dfg/DFGVariableAccessData.h:
+        * dfg/DFGVariableAccessDataDump.h:
+        * dfg/DFGVariableEvent.h:
+        * dfg/DFGVariableEventStream.h:
+        * dfg/DFGVirtualRegisterAllocationPhase.h:
+        * dfg/DFGWatchpointCollectionPhase.h:
+        * dfg/DFGWorklist.h:
+        * disassembler/Disassembler.h:
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLAbbreviations.h:
+        * ftl/FTLAbstractHeap.h:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.h:
+        * ftl/FTLCommonValues.h:
+        * ftl/FTLCompile.h:
+        * ftl/FTLExitArgument.h:
+        * ftl/FTLExitArgumentForOperand.h:
+        * ftl/FTLExitArgumentList.h:
+        * ftl/FTLExitThunkGenerator.h:
+        * ftl/FTLExitValue.h:
+        * ftl/FTLFail.h:
+        * ftl/FTLForOSREntryJITCode.h:
+        * ftl/FTLFormattedValue.h:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLJITCode.h:
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLink.h:
+        * ftl/FTLLocation.h:
+        * ftl/FTLLowerDFGToLLVM.h:
+        * ftl/FTLLoweredNodeValue.h:
+        * ftl/FTLOSREntry.h:
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompilationInfo.h:
+        * ftl/FTLOSRExitCompiler.h:
+        * ftl/FTLOutput.h:
+        * ftl/FTLSaveRestore.h:
+        * ftl/FTLStackMaps.h:
+        * ftl/FTLState.h:
+        * ftl/FTLSwitchCase.h:
+        * ftl/FTLThunks.h:
+        * ftl/FTLTypedPointer.h:
+        * ftl/FTLValueFormat.h:
+        * ftl/FTLValueFromBlock.h:
+        * heap/JITStubRoutineSet.h:
+        * interpreter/AbstractPC.h:
+        * jit/AssemblyHelpers.h:
+        * jit/CCallHelpers.h:
+        * jit/ClosureCallStubRoutine.h:
+        * jit/GCAwareJITStubRoutine.h:
+        * jit/HostCallReturnValue.h:
+        * jit/JITDisassembler.h:
+        * jit/JITStubRoutine.h:
+        * jit/JITThunks.h:
+        * jit/JITToDFGDeferredCompilationCallback.h:
+        * jit/RegisterSet.h:
+        * jit/Repatch.h:
+        * jit/ScratchRegisterAllocator.h:
+        * jit/TempRegisterSet.h:
+        * jit/ThunkGenerator.h:
+        * llint/LLIntData.h:
+        * llint/LLIntEntrypoint.h:
+        * llint/LLIntExceptions.h:
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntOpcode.h:
+        * llint/LLIntSlowPaths.h:
+        * llint/LLIntThunks.h:
+        * llint/LowLevelInterpreter.h:
+        * llvm/InitializeLLVM.h:
+        * llvm/InitializeLLVMPOSIX.h:
+        * llvm/LLVMAPI.h:
+        * os-win32/inttypes.h:
+        * runtime/ArrayStorage.h:
+        * runtime/Butterfly.h:
+        * runtime/CommonSlowPaths.h:
+        * runtime/CommonSlowPathsExceptions.h:
+        * runtime/IndexingHeader.h:
+        * runtime/JSExportMacros.h:
+        * runtime/PropertyOffset.h:
+        * runtime/SparseArrayValueMap.h:
+
+2014-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have a way of carrying and preserving conditional branch weights
+        https://bugs.webkit.org/show_bug.cgi?id=129083
+
+        Reviewed by Michael Saboff.
+        
+        Branch and Switch now have branch counts/weights for each target. This is encapsulated
+        behind DFG::BranchTarget. We carry this data all the way to the FTL, and the DFG
+        backend ignores it.
+        
+        We don't set this data yet; that's for https://bugs.webkit.org/show_bug.cgi?id=129055.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::branchData):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeToSuccessors):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::BranchTarget::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::BranchTarget::BranchTarget):
+        (JSC::DFG::BranchTarget::setBytecodeIndex):
+        (JSC::DFG::BranchTarget::bytecodeIndex):
+        (JSC::DFG::BranchData::withBytecodeIndices):
+        (JSC::DFG::BranchData::takenBytecodeIndex):
+        (JSC::DFG::BranchData::notTakenBytecodeIndex):
+        (JSC::DFG::BranchData::forCondition):
+        (JSC::DFG::SwitchCase::SwitchCase):
+        (JSC::DFG::SwitchCase::withBytecodeIndex):
+        (JSC::DFG::SwitchData::SwitchData):
+        (JSC::DFG::Node::targetBytecodeOffsetDuringParsing):
+        (JSC::DFG::Node::targetBlock):
+        (JSC::DFG::Node::branchData):
+        (JSC::DFG::Node::successor):
+        (JSC::DFG::Node::successorForCondition):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleInt32Branch):
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
+        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
+        (JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump):
+        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+        (JSC::DFG::SpeculativeJIT::emitBinarySwitchStringRecurse):
+        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
+        (JSC::DFG::SpeculativeJIT::emitSwitchString):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleInt52Branch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileJump):
+        (JSC::FTL::LowerDFGToLLVM::compileBranch):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::buildSwitch):
+
+2014-02-19  ChangSeok Oh  <changseok.oh@collabora.com>
+
+        Unreviewed build fix after r164396
+
+        * GNUmakefile.list.am: Added Promises.prototype.js properly
+
+2014-02-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Crash after -[JSContext evaluateScript:] when initializing JSContext with JSVirtualMachine
+        https://bugs.webkit.org/show_bug.cgi?id=129070
+
+        Reviewed by Mark Hahnenberg.
+
+        Clear our exception explicitly before throwing away the VM because our
+        exception references VM memory.
+
+        * API/JSContext.mm:
+        (-[JSContext dealloc]):
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI):
+
+2014-02-19  Brent Fulgham  <bfulgham@apple.com>
+
+        Unreviewed build fix after r164391
+
+        * runtime/Arguments.h: Make SlowArgumentData public so template libraries can
+        access its methods.
+
+2014-02-19  Mark Lam  <mark.lam@apple.com>
+
+        Need to align sp before calling operationLoadVarargs on 32-bit platforms.
+        <https://webkit.org/b/129056>
+
+        Reviewed by Michael Saboff.
+
+        In JIT::compileLoadVarargs(), we'll call operationSizeFrameForVarargs()
+        to compute the amount of stack space we need for the varargs, adjust the
+        stack pointer to make room for those varargs, and then call
+        operationLoadVarargs() to fill in the varargs. Currently, the stack
+        pointer adjustment takes care of allocating space for the varargs, but
+        does not align the stack pointer for the call to operationLoadVarargs().
+        The fix is to align the stack pointer there.
+
+        Note: The stack pointer adjustment is based on the new CallFrame pointer
+        value returned by operationSizeFrameForVarargs(). On 64-bit platforms,
+        both the stack pointer and call frame pointer are similarly aligned
+        (i.e. low nibbles are 0). Hence, no additional adjustment is needed.
+        Only the 32-bit code needs the fix.
+
+        Note: The LLINT also works this way i.e. aligns the stack pointer before
+        calling llint_slow_path_call_varargs().
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+
+2014-02-19  Sam Weinig  <sam@webkit.org>
+
+        [JS] Convert Promise.prototype.catch to be a built-in
+        https://bugs.webkit.org/show_bug.cgi?id=129052
+
+        Reviewed by Geoffrey Garen.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/Promise.prototype.js: Added.
+        (catch): Add JS based implementation of Promise.prototype.catch.
+
+        * runtime/JSPromisePrototype.cpp:
+        Remove the C++ implementation of Promise.prototype.catch.
+
+2014-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should allow LLVM to allocate data sections with alignment > 8
+        https://bugs.webkit.org/show_bug.cgi?id=129066
+
+        Reviewed by Geoffrey Garen.
+        
+        We were previously using the native allocator's alignment guarantees (which we presumed
+        to be 8 bytes), and further hinting our desires by using the LSectionWord type (which
+        was 8 bytes). This breaks now that LLVM will sometimes ask for 16 byte alignment on
+        some sections.
+        
+        This changes our data section allocation strategy to use the new FTL::DataSection,
+        which can handle arbitrary 2^k alignment.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        (JSC::FTL::dumpDataSection):
+        (JSC::FTL::compile):
+        * ftl/FTLDataSection.cpp: Added.
+        (JSC::FTL::DataSection::DataSection):
+        (JSC::FTL::DataSection::~DataSection):
+        * ftl/FTLDataSection.h: Added.
+        (JSC::FTL::DataSection::base):
+        (JSC::FTL::DataSection::size):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::addDataSection):
+        * ftl/FTLJITCode.h:
+        (JSC::FTL::JITCode::dataSections):
+        * ftl/FTLState.h:
+
+2014-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix comment.
+
+        * ftl/FTLWeight.h:
+        (JSC::FTL::Weight::scaleToTotal):
+
+2014-02-19  Anders Carlsson  <andersca@apple.com>
+
+        Add WTF_MAKE_FAST_ALLOCATED to more classes
+        https://bugs.webkit.org/show_bug.cgi?id=129064
+
+        Reviewed by Andreas Kling.
+
+        * dfg/DFGSpeculativeJIT.h:
+        * heap/CopyWorkList.h:
+        * heap/Region.h:
+        * runtime/Arguments.h:
+        * runtime/SymbolTable.h:
+        * runtime/WriteBarrier.h:
+
+2014-02-19  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix after r164374
+
+        * llint/LLIntOfflineAsmConfig.h: Added #define OFFLINE_ASM_X86_WIN 0 
+        for ENABLE(LLINT_C_LOOP).
+
+2014-02-19  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should be able to convey branch weights to LLVM
+        https://bugs.webkit.org/show_bug.cgi?id=129054
+
+        Reviewed by Michael Saboff.
+        
+        This introduces a really nice way to convey branch weights to LLVM. The basic class
+        is Weight, which just wraps a float; NaN is used when you are not sure. You can
+        pass this alongside a LBasicBlock to branching instructions like condbr and switch.
+        But for simplicity, you can just pass a WeightedTarget, which is a tuple of the
+        two. And for even greater simplicity, you can create WeightedTargets from
+        LBasicBlocks by doing:
+        
+            usually(b)   => WeightedTarget(b, Weight(1))
+            rarely(b)    => WeightedTarget(b, Weight(0))
+            unsure(b)    => WeightedTarget(b, Weight()) or WeightedTarget(b, Weight(NaN))
+        
+        This allows for constructs like:
+        
+            m_out.branch(isCell(value), usually(isCellCase), rarely(slowCase));
+        
+        This was intended to be perf-neutral for now, but it did end up creating a ~1%
+        speed-up on V8v7 and Octane2.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::mdNode):
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+        (JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck):
+        (JSC::FTL::LowerDFGToLLVM::compileToThis):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::compileGetTypedArrayByteOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
+        (JSC::FTL::LowerDFGToLLVM::compileToString):
+        (JSC::FTL::LowerDFGToLLVM::compileToPrimitive):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileNotifyWrite):
+        (JSC::FTL::LowerDFGToLLVM::compileBranch):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
+        (JSC::FTL::LowerDFGToLLVM::nonSpeculativeCompare):
+        (JSC::FTL::LowerDFGToLLVM::allocateCell):
+        (JSC::FTL::LowerDFGToLLVM::allocateBasicStorageAndGetEnd):
+        (JSC::FTL::LowerDFGToLLVM::boolify):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::contiguousPutByValOutOfBounds):
+        (JSC::FTL::LowerDFGToLLVM::buildSwitch):
+        (JSC::FTL::LowerDFGToLLVM::doubleToInt32):
+        (JSC::FTL::LowerDFGToLLVM::sensibleDoubleToInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToJSValue):
+        (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+        (JSC::FTL::LowerDFGToLLVM::speculateStringOrStringObject):
+        (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+        (JSC::FTL::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::initialize):
+        (JSC::FTL::Output::appendTo):
+        (JSC::FTL::Output::newBlock):
+        (JSC::FTL::Output::sensibleDoubleToInt):
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::baseIndex):
+        (JSC::FTL::Output::branch):
+        (JSC::FTL::Output::crashNonTerminal):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::branch):
+        (JSC::FTL::Output::switchInstruction):
+        * ftl/FTLSwitchCase.h:
+        (JSC::FTL::SwitchCase::SwitchCase):
+        (JSC::FTL::SwitchCase::weight):
+        * ftl/FTLWeight.h: Added.
+        (JSC::FTL::Weight::Weight):
+        (JSC::FTL::Weight::isSet):
+        (JSC::FTL::Weight::operator!):
+        (JSC::FTL::Weight::value):
+        (JSC::FTL::Weight::scaleToTotal):
+        * ftl/FTLWeightedTarget.h: Added.
+        (JSC::FTL::WeightedTarget::WeightedTarget):
+        (JSC::FTL::WeightedTarget::target):
+        (JSC::FTL::WeightedTarget::weight):
+        (JSC::FTL::usually):
+        (JSC::FTL::rarely):
+        (JSC::FTL::unsure):
+
+2014-02-19  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win][LLINT] Incorrect stack alignment.
+        https://bugs.webkit.org/show_bug.cgi?id=129045
+
+        Reviewed by Michael Saboff.
+
+        LLINT expects the stack to be 16 byte aligned, but with MSVC it is not.
+        To align the stack, a new backend, X86_WIN, is created.
+
+        * llint/LLIntOfflineAsmConfig.h: Use X86_WIN backend on Windows.
+        * llint/LowLevelInterpreter.asm: Align stack to 16 byte boundaries. Otherwise, use same implementation for X86_WIN as for X86.
+        * llint/LowLevelInterpreter32_64.asm: Adjust stack offset to retrieve function parameters now that the stack is aligned.
+        * offlineasm/backends.rb: Added X86_WIN backend.
+        * offlineasm/x86.rb: Fix crash caused by incorrect assembly code for double types.
+
+2014-02-19  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        ASSERTION FAILED: (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0) in WTF::dateToDaysFrom1970
+        https://bugs.webkit.org/show_bug.cgi?id=128740
+
+        Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970
+        DateConstructor will now check if the number fits into an Int32 before casting
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateUTC):
+
+2014-02-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Dedicated worker crash caused by global DFG worklists + GC
+        https://bugs.webkit.org/show_bug.cgi?id=128537
+
+        Reviewed by Filip Pizlo.
+
+        The process-global DFG worklists were causing objects to participate in the garbage collections of VMs 
+        other than the one they were allocated in. This started manifesting in the worker tests because they're 
+        one of the few WebKit tests that do multithreaded JS.
+
+        The fix is to filter out Plans from other VMs during collection.
+
+        * dfg/DFGSafepoint.cpp:
+        (JSC::DFG::Safepoint::vm):
+        * dfg/DFGSafepoint.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::isActiveForVM):
+        (JSC::DFG::Worklist::suspendAllThreads):
+        (JSC::DFG::Worklist::resumeAllThreads):
+        (JSC::DFG::Worklist::visitChildren):
+        * dfg/DFGWorklist.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater):
+
+2014-02-19  Brady Eidson  <beidson@apple.com>
+
+        Add FeatureDefines for image controls
+        https://bugs.webkit.org/show_bug.cgi?id=129022
+
+        Reviewed by Jer Noble.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-02-19  Dan Bernstein  <mitz@apple.com>
+
+        Simplify PLATFORM(MAC) && !PLATFORM(IOS) and similar expressions
+        https://bugs.webkit.org/show_bug.cgi?id=129029
+
+        Reviewed by Mark Rowe.
+
+        * API/JSValueRef.cpp:
+        (JSValueUnprotect):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2014-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Correctly install libllvmForJSC.dylib in production builds
+        https://bugs.webkit.org/show_bug.cgi?id=129023
+
+        Reviewed by Mark Rowe.
+        
+        In non-production builds, we copy it as before. In production builds, we use the install
+        path.
+        
+        Also roll http://trac.webkit.org/changeset/164348 back in.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/LLVMForJSC.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/164348 because it broke some
+        builds.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't call LLVMInitializeNativeTarget() because it can be all messed up if you cross-compile LLVM
+        https://bugs.webkit.org/show_bug.cgi?id=129020
+
+        Reviewed by Dan Bernstein.
+        
+        LLVMInitializeNativeTarget() is this super special inline function in llvm-c/Target.h that
+        depends on some #define's that come from some really weird magic in autoconf/configure.ac.
+        That magic fails miserably for cross-compiles. So, we need to manually initialize the things
+        that InitializeNativeTarget initializes.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        The shell scripts in the Xcode build system should tell you when they failed
+        https://bugs.webkit.org/show_bug.cgi?id=129018
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-02-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Add fast mapping from StringImpl to JSString
+        https://bugs.webkit.org/show_bug.cgi?id=128625
+
+        Reviewed by Geoff Garen & Andreas Kling.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::WeakOwner::finalize):
+            - once the JSString weakly owned by a StringImpl becomed unreachable remove the WeakImpl.
+        * runtime/JSString.h:
+        (JSC::jsStringWithWeakOwner):
+            - create a JSString wrapping a StringImpl, and weakly caches the JSString on the StringImpl.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+            - initialize jsStringWeakOwner.
+        (JSC::VM::createLeakedForMainThread):
+            - initialize jsStringWeakOwner - the main thread gets to use the weak pointer
+              on StringImpl to cache a JSString wrapper.
+        * runtime/VM.h:
+            - renamed createLeaked -> createLeakedForMainThread to make it clear this
+              should only be used to cretae the main thread VM.
+
+2014-02-18  Oliver Hunt  <oliver@apple.com>
+
+        Prevent builtin js named with C++ reserved words from breaking the build
+        https://bugs.webkit.org/show_bug.cgi?id=129017
+
+        Reviewed by Sam Weinig.
+
+        Simple change to a couple of macros to make sure we don't create functions
+        named using reserved words.
+
+        * builtins/BuiltinExecutables.cpp:
+        * builtins/BuiltinNames.h:
+
+2014-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should build on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=129010
+
+        Reviewed by Sam Weinig.
+        
+        * disassembler/X86Disassembler.cpp: Just because we have the LLVM disassembler doesn't mean we're on X86.
+        * ftl/FTLLocation.cpp: DWARF parsing for ARM64 is super easy.
+        (JSC::FTL::Location::isGPR):
+        (JSC::FTL::Location::gpr):
+        (JSC::FTL::Location::isFPR):
+        (JSC::FTL::Location::fpr):
+        (JSC::FTL::Location::restoreInto): This function wasn't even X86-specific to begin with so move it out of the #if stuff.
+        * ftl/FTLUnwindInfo.cpp: They're called q not d.
+        (JSC::FTL::UnwindInfo::parse):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toArgumentRegister): Add this method; we alraedy had it on X86.
+
+2014-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL unwind parsing should handle ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=128984
+
+        Reviewed by Oliver Hunt.
+        
+        This makes unwind parsing handle ARM64 and it makes all clients of unwind info capable of
+        dealing with that architecture.
+        
+        The big difference is that ARM64 has callee-save double registers. This is conceptually easy
+        to handle, but out code for dealing with callee-saves spoke of "GPRReg". We've been in this
+        situation before: code that needs to deal with either a GPRReg or a FPRReg. In the past we'd
+        hacked around the problem, but this time I decided to do a full frontal assault. This patch
+        adds a Reg class, which is a box for either GPRReg or FPRReg along with tools for iterating
+        over all possible registers. Then, I threaded this through SaveRestore, RegisterSet,
+        RegisterAtOffset, and UnwindInfo. With the help of Reg, it was easy to refactor the code to
+        handle FPRs in addition to GPRs.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLRegisterAtOffset.cpp:
+        (JSC::FTL::RegisterAtOffset::dump):
+        * ftl/FTLRegisterAtOffset.h:
+        (JSC::FTL::RegisterAtOffset::RegisterAtOffset):
+        (JSC::FTL::RegisterAtOffset::operator!):
+        (JSC::FTL::RegisterAtOffset::reg):
+        (JSC::FTL::RegisterAtOffset::operator==):
+        (JSC::FTL::RegisterAtOffset::operator<):
+        (JSC::FTL::RegisterAtOffset::getReg):
+        * ftl/FTLSaveRestore.cpp:
+        (JSC::FTL::offsetOfReg):
+        * ftl/FTLSaveRestore.h:
+        * ftl/FTLUnwindInfo.cpp:
+        (JSC::FTL::UnwindInfo::parse):
+        (JSC::FTL::UnwindInfo::find):
+        (JSC::FTL::UnwindInfo::indexOf):
+        * ftl/FTLUnwindInfo.h:
+        * jit/Reg.cpp: Added.
+        (JSC::Reg::dump):
+        * jit/Reg.h: Added.
+        (JSC::Reg::Reg):
+        (JSC::Reg::fromIndex):
+        (JSC::Reg::first):
+        (JSC::Reg::last):
+        (JSC::Reg::next):
+        (JSC::Reg::index):
+        (JSC::Reg::isSet):
+        (JSC::Reg::operator!):
+        (JSC::Reg::isGPR):
+        (JSC::Reg::isFPR):
+        (JSC::Reg::gpr):
+        (JSC::Reg::fpr):
+        (JSC::Reg::operator==):
+        (JSC::Reg::operator!=):
+        (JSC::Reg::operator<):
+        (JSC::Reg::operator>):
+        (JSC::Reg::operator<=):
+        (JSC::Reg::operator>=):
+        (JSC::Reg::hash):
+        (JSC::Reg::invalid):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::set):
+        (JSC::RegisterSet::clear):
+        (JSC::RegisterSet::get):
+
+2014-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        More ARM FTL glue
+        https://bugs.webkit.org/show_bug.cgi?id=128948
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/Base.xcconfig: Allow for an header search directory for LLVM's generated files.
+        * Configurations/LLVMForJSC.xcconfig: Link the right things for ARM.
+        * assembler/ARM64Assembler.h: Builds fix.
+        (JSC::ARM64Assembler::fillNops):
+        * disassembler/LLVMDisassembler.cpp: Use the right target triples.
+        (JSC::tryToDisassembleWithLLVM):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps): Build fix.
+        * jit/GPRInfo.h: Builds fix.
+        * llvm/library/LLVMExports.cpp: Link the right things.
+        (initializeAndGetJSCLLVMAPI):
+
+2014-02-17  Anders Carlsson  <andersca@apple.com>
+
+        Remove ENABLE_GLOBAL_FASTMALLOC_NEW
+        https://bugs.webkit.org/show_bug.cgi?id=127067
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Nodes.h:
+
+2014-02-17  Sergio Correia  <sergio.correia@openbossa.org>
+
+        Replace uses of PassOwnPtr/OwnPtr with std::unique_ptr in WebCore/inspector
+        https://bugs.webkit.org/show_bug.cgi?id=128681
+
+        Reviewed by Timothy Hatcher.
+
+        Another step towards getting rid of PassOwnPtr/OwnPtr, now targeting
+        WebCore/inspector/*. Besides files in there, a few other files in
+        JavaScriptCore/inspector, WebKit/, WebKit2/WebProcess/WebCoreSupport/
+        and WebCore/testing were touched.
+
+
+        * inspector/ContentSearchUtilities.cpp:
+        * inspector/ContentSearchUtilities.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        * inspector/agents/InspectorConsoleAgent.h:
+
+2014-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support ToPrimitive and the DFG should fold it correctly
+        https://bugs.webkit.org/show_bug.cgi?id=128892
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileToPrimitive):
+        * tests/stress/fold-to-primitive-in-cfa.js: Added.
+        (foo):
+        (.result.foo):
+        * tests/stress/fold-to-primitive-to-identity-in-cfa.js: Added.
+        (foo):
+        (.result.foo):
+
+2014-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Register preservation wrapper should know about the possibility of callee-saved FPRs
+        https://bugs.webkit.org/show_bug.cgi?id=128923
+
+        Reviewed by Mark Hahnenberg.
+
+        * jit/RegisterPreservationWrapperGenerator.cpp:
+        (JSC::generateRegisterPreservationWrapper):
+        (JSC::generateRegisterRestoration):
+        * jit/RegisterSet.cpp:
+
+2014-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        lr is a special register on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=128922
+
+        Reviewed by Mark Hahnenberg.
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::specialRegisters):
+
+2014-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix RegisterSet::calleeSaveRegisters() by making it correct on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=128921
+
+        Reviewed by Mark Hahnenberg.
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::calleeSaveRegisters):
+
+2014-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        RegisterSet::calleeSaveRegisters() should know about ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=128918
+
+        Reviewed by Mark Hahnenberg.
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::calleeSaveRegisters):
+
+2014-02-17  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Move back primary header includes next to config.h
+        https://bugs.webkit.org/show_bug.cgi?id=128912
+
+        Reviewed by Alexey Proskuryakov.
+
+        * dfg/DFGAbstractHeap.cpp:
+        * dfg/DFGAbstractValue.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGArithMode.cpp:
+        * dfg/DFGArrayMode.cpp:
+        * dfg/DFGAtTailAbstractState.cpp:
+        * dfg/DFGAvailability.cpp:
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        * dfg/DFGBasicBlock.cpp:
+        * dfg/DFGBinarySwitch.cpp:
+        * dfg/DFGBlockInsertionSet.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCFAPhase.cpp:
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGClobberSet.cpp:
+        * dfg/DFGClobberize.cpp:
+        * dfg/DFGCommon.cpp:
+        * dfg/DFGCommonData.cpp:
+        * dfg/DFGCompilationKey.cpp:
+        * dfg/DFGCompilationMode.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        * dfg/DFGDCEPhase.cpp:
+        * dfg/DFGDesiredIdentifiers.cpp:
+        * dfg/DFGDesiredStructureChains.cpp:
+        * dfg/DFGDesiredTransitions.cpp:
+        * dfg/DFGDesiredWatchpoints.cpp:
+        * dfg/DFGDesiredWeakReferences.cpp:
+        * dfg/DFGDesiredWriteBarriers.cpp:
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGDominators.cpp:
+        * dfg/DFGEdge.cpp:
+        * dfg/DFGFailedFinalizer.cpp:
+        * dfg/DFGFinalizer.cpp:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGFlushFormat.cpp:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        * dfg/DFGFlushedAt.cpp:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraphSafepoint.cpp:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        * dfg/DFGJITCode.cpp:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITFinalizer.cpp:
+        * dfg/DFGJumpReplacement.cpp:
+        * dfg/DFGLICMPhase.cpp:
+        * dfg/DFGLazyJSValue.cpp:
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        * dfg/DFGLongLivedState.cpp:
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        * dfg/DFGMinifiedNode.cpp:
+        * dfg/DFGNaturalLoops.cpp:
+        * dfg/DFGNode.cpp:
+        * dfg/DFGNodeFlags.cpp:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExitBase.cpp:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        * dfg/DFGOSRExitJumpPlaceholder.cpp:
+        * dfg/DFGOSRExitPreparation.cpp:
+        * dfg/DFGPhase.cpp:
+        * dfg/DFGPlan.cpp:
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGResurrectionForValidationPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        * dfg/DFGSSALoweringPhase.cpp:
+        * dfg/DFGSafepoint.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGStackLayoutPhase.cpp:
+        * dfg/DFGStoreBarrierElisionPhase.cpp:
+        * dfg/DFGStrengthReductionPhase.cpp:
+        * dfg/DFGThreadData.cpp:
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        * dfg/DFGUnificationPhase.cpp:
+        * dfg/DFGUseKind.cpp:
+        * dfg/DFGValidate.cpp:
+        * dfg/DFGValueSource.cpp:
+        * dfg/DFGVariableAccessDataDump.cpp:
+        * dfg/DFGVariableEvent.cpp:
+        * dfg/DFGVariableEventStream.cpp:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        * dfg/DFGWorklist.cpp:
+        * heap/JITStubRoutineSet.cpp:
+        * jit/GCAwareJITStubRoutine.cpp:
+        * jit/JIT.cpp:
+        * jit/JITDisassembler.cpp:
+        * jit/JITOperations.cpp:
+        * jit/JITStubRoutine.cpp:
+        * jit/JITStubs.cpp:
+        * jit/TempRegisterSet.cpp:
+
+2014-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL OSR exit shouldn't make X86-specific assumptions
+        https://bugs.webkit.org/show_bug.cgi?id=128890
+
+        Reviewed by Mark Hahnenberg.
+
+        Mostly this is about not using push/pop, but instead using the more abstract pushToSave() and popToRestore() while reflecting on the stack alignment.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::pushToSaveImmediateWithoutTouchingRegisters):
+        (JSC::MacroAssembler::pushToSaveByteOffset):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::pushToSaveImmediateWithoutTouchingRegisters):
+        (JSC::MacroAssemblerARM64::pushToSaveByteOffset):
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+
+2014-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, make this test pass without DFG. It was assuming that you always have DFG
+        and that it would always tier-up to the DFG - both wrong assumptions.
+
+        * tests/stress/tricky-array-bounds-checks.js:
+        (foo):
+
+2014-02-17  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        Fix the CLoop build after r163760
+        https://bugs.webkit.org/show_bug.cgi?id=128900
+
+        Reviewed by Csaba Osztrogonác.
+
+        * llint/LLIntThunks.cpp:
+
+2014-02-17  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        CLoop buildfix after r164207
+        https://bugs.webkit.org/show_bug.cgi?id=128899
+
+        Reviewed by Csaba Osztrogonác.
+
+        * dfg/DFGCommon.h:
+        (JSC::DFG::shouldShowDisassembly):
+
+2014-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, 32-bit build fix.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::lshiftPtr):
+
+2014-02-15  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should inline polymorphic heap accesses
+        https://bugs.webkit.org/show_bug.cgi?id=128795
+
+        Reviewed by Oliver Hunt.
+        
+        We now inline GetByIds that we know are pure but polymorphic. They manifest in DFG IR
+        as MultiGetByOffset, and in LLVM IR as a switch with a basic block for each kind of
+        read.
+        
+        2% speed-up on Octane mostly due to a 18% speed-up on deltablue.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/ExitingJITType.cpp: Added.
+        (WTF::printInternal):
+        * bytecode/ExitingJITType.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        (JSC::GetByIdStatus::computeFor):
+        (JSC::GetByIdStatus::dump):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::numVariants):
+        (JSC::GetByIdStatus::variants):
+        (JSC::GetByIdStatus::at):
+        (JSC::GetByIdStatus::operator[]):
+        * bytecode/GetByIdVariant.cpp: Added.
+        (JSC::GetByIdVariant::dump):
+        (JSC::GetByIdVariant::dumpInContext):
+        * bytecode/GetByIdVariant.h: Added.
+        (JSC::GetByIdVariant::GetByIdVariant):
+        (JSC::GetByIdVariant::isSet):
+        (JSC::GetByIdVariant::operator!):
+        (JSC::GetByIdVariant::structureSet):
+        (JSC::GetByIdVariant::chain):
+        (JSC::GetByIdVariant::specificValue):
+        (JSC::GetByIdVariant::offset):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::emitPrototypeChecks):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::verboseCompilationEnabled):
+        (JSC::DFG::logCompilationChanges):
+        (JSC::DFG::shouldShowDisassembly):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::convertToConstant):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToGetByOffset):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasMultiGetByOffsetData):
+        (JSC::DFG::Node::multiGetByOffsetData):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPhase.h:
+        (JSC::DFG::Phase::graph):
+        (JSC::DFG::runAndLog):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::dumpAndVerifyGraph):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        (JSC::FTL::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        * ftl/FTLState.h:
+        (JSC::FTL::verboseCompilationEnabled):
+        (JSC::FTL::showDisassembly):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionEffectful42):
+        * runtime/IntendedStructureChain.cpp:
+        (JSC::IntendedStructureChain::dump):
+        (JSC::IntendedStructureChain::dumpInContext):
+        * runtime/IntendedStructureChain.h:
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+        * tests/stress/fold-multi-get-by-offset-to-get-by-offset-with-watchpoint.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/fold-multi-get-by-offset-to-get-by-offset.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/multi-get-by-offset-proto-and-self.js: Added.
+        (foo):
+        (Foo):
+
+2014-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::prepareOSREntry should be nice to the stack
+        https://bugs.webkit.org/show_bug.cgi?id=128883
+
+        Reviewed by Oliver Hunt.
+        
+        Previously OSR entry had some FIXME's and some really badly commented-out code for
+        clearing stack entries to help GC. It also did some permutations on a stack frame
+        above us, in such a way that it wasn't obviously that we wouldn't clobber our own
+        stack frame. This function also crashed in ASan.
+        
+        It just seems like there was too much badness to the whole idea of prepareOSREntry
+        directly editing the stack. So, I changed it to create a stack frame in a scratch
+        buffer on the side and then have some assembly code just copy it into place. This
+        works fine, fixes a FIXME, possibly fixes some stack clobbering, and might help us
+        make more progress with ASan.
+
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrEntryThunkGenerator):
+        * dfg/DFGThunks.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOperations.cpp:
+
+2014-02-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Vector with inline capacity should work with non-PODs
+        https://bugs.webkit.org/show_bug.cgi?id=128864
+
+        Reviewed by Michael Saboff.
+        
+        Deques no longer have inline capacity because it was broken, and we didn't need it
+        here anyway.
+
+        * dfg/DFGWorklist.h:
+
+2014-02-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out r164166.
+
+        This broke three unique tests:
+
+        ** The following JSC stress test failures have been introduced:
+            regress/script-tests/variadic-closure-call.js.default-ftl
+            regress/script-tests/variadic-closure-call.js.ftl-no-cjit-validate
+            regress/script-tests/variadic-closure-call.js.ftl-no-cjit-osr-validation
+            regress/script-tests/variadic-closure-call.js.ftl-eager
+            regress/script-tests/variadic-closure-call.js.ftl-eager-no-cjit
+            regress/script-tests/variadic-closure-call.js.ftl-eager-no-cjit-osr-validation
+            jsc-layout-tests.yaml/js/script-tests/unmatching-argument-count.js.layout-ftl-eager-no-cjit
+            regress/script-tests/direct-arguments-getbyval.js.ftl-eager-no-cjit
+            regress/script-tests/direct-arguments-getbyval.js.ftl-eager-no-cjit-osr-validation
+
+        * bytecode/PolymorphicAccessStructureList.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * tests/stress/ftl-getbyval-arguments.js:
+
+2014-02-15  Matthew Mirman  <mmirman@apple.com>
+
+        Added GetMyArgumentByVal to FTL
+        https://bugs.webkit.org/show_bug.cgi?id=128850
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+        * tests/stress/ftl-getbyval-arguments.js: Added.
+        (foo):
+
+2014-02-15  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] LLINT is not working.
+        https://bugs.webkit.org/show_bug.cgi?id=128115
+
+        Reviewed by Mark Lam.
+
+        This patch will generate assembly code with Intel syntax, which can be processed by the Microsoft assembler (MASM).
+        By creating an asm file instead of a header file with inline assembly, we can support 64-bit.
+        Only 32-bit compilation has been tested, not 64-bit.
+        The aim of this patch is to get LLINT up and running on Windows.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added new files, and generated asm file.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+        * LLIntAssembly/build-LLIntAssembly.sh: Generate dummy asm file in case we're using C backend.
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor): Compile fix when DFG is disabled.
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor): Ditto.
+        * bytecode/GetByIdStatus.h: Ditto.
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor): Ditto.
+        * bytecode/PutByIdStatus.h: Ditto.
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::initialize): Compile fix.
+        * llint/LLIntSlowPaths.h: Added llint_crash function.
+        * llint/LLIntSlowPaths.cpp: Ditto.        
+        * llint/LowLevelInterpreter.cpp: Disable code for Windows.
+        * llint/LowLevelInterpreter.asm: Remove instruction which generates incorrect assembly code on Windows (MOV 0xbbadbeef, register), call llint_crash instead.
+        Make local labels visible to MASM on Windows.
+        * llint/LowLevelInterpreter32_64.asm: Make local labels visible to MASM on Windows.
+        * offlineasm/asm.rb: Generate asm file with Intel assembly syntax.
+        * offlineasm/settings.rb: Ditto.
+        * offlineasm/x86.rb: Ditto.
+
+2014-02-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: CRASH when debugger closes while paused and remote inspecting a JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=127757
+
+        Reviewed by Timothy Hatcher.
+
+        The problem was that the lifetime of the InspectorController and all agents
+        was tied to the remote inspector session. So, if a remote inspector was
+        disconnected while in the nested run loop, everything would get torn
+        down and when execution continued out of the nested runloop we would be
+        back in the original call stack of destroyed objects.
+
+        This patch changes the lifetime of the InspectorController and agents to
+        the JSGlobalObject. This way the agents are always alive, just the
+        frontend and backend channels are destroyed and recreated each remote
+        inspector session. This matches the agent lifetime for WebCore agents.
+        We can also later take advantage of the agents being alive before
+        and between inspector debug sessions to stash exception messages to
+        pass on to a debugger if a debugger is connected later.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        Cleaner initialization of agents. Easier to follow.
+
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        Move InjectedScript disconnection only once the global object is destroyed.
+        This way if a developer has attached once and included an injected script,
+        we will keep it around with any state it might want to remember until
+        the global object is destroyed.
+
+        (Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed):
+        Disconnect agents and injected scripts when the global object is destroyed.
+
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::disconnect):
+        Now that the injected script manager is reused between remote
+        inspector sessions, don't clear the pointer on disconnect calls.
+        We now only call this once when the global object is getting
+        destroyed anyways so it doesn't matter. But if we wanted to call
+        disconnect multiple times, e.g. once per session, we could.
+
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchFunctionToListeners):
+        If the only listener was removed during the nested runloop, then when
+        we dispatch an event after the nested runloop the listener list will
+        be empty. Instead of asserting, just pass by an empty list.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::inspectorController):
+        Tie the inspector controller lifetime to the JSGlobalObject.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        Create the inspector controller, and eagerly signal teardown
+        in destruction.
+
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        (JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend):
+        Simplify by using the inspector controller on JSGlobalObject.
+
+2014-02-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        -[JSManagedValue value] needs to be protected by the API lock
+        https://bugs.webkit.org/show_bug.cgi?id=128857
+
+        Reviewed by Mark Lam.
+
+        * API/APICast.h:
+        (toRef): Added an ASSERT so that we can detect these sorts of errors earlier. On 32-bit, toRef
+        can allocate objects so we need to be holding the lock.
+        * API/APIShims.h: Removed outdated comments.
+        * API/JSManagedValue.mm: Added RefPtr<JSLock> to JSManagedValue.
+        (-[JSManagedValue initWithValue:]): Initialize the m_lock field.
+        (-[JSManagedValue value]): Lock the JSLock, check the VM*, return nil if invalid, take the APIEntryShim otherwise.
+        * runtime/JSLock.cpp: Bug fix in JSLock. We were assuming that the VM was always non-null in JSLock::lock.
+        (JSC::JSLock::lock):
+
+2014-02-14  Oliver Hunt  <oliver@apple.com>
+
+        Implement a few more Array prototype functions in JS
+        https://bugs.webkit.org/show_bug.cgi?id=128788
+
+        Reviewed by Gavin Barraclough.
+
+        Remove a pile of awful C++, and rewrite in simple JS.
+
+        Needed to make a few other changes to get fully builtins
+        behavior to more accurately match a host function's.
+
+        * builtins/Array.prototype.js:
+        (every):
+        (forEach):
+        (filter):
+        (map):
+        (some):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::BuiltinExecutables):
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitExpressionInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::GetStackTraceFunctor::operator()):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::overrideName):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/ArrayPrototype.cpp:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::deleteProperty):
+        * runtime/JSFunction.h:
+
+2014-02-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        ASSERT(isValidAllocation(bytes)) when ObjC API creates custom errors
+        https://bugs.webkit.org/show_bug.cgi?id=128840
+
+        Reviewed by Joseph Pecoraro.
+
+        We need to add APIEntryShims around places where we allocate errors in JSC.
+        Also converted some of the createTypeError call sites to use ASCIILiteral.
+
+        * API/JSValue.mm:
+        (valueToArray):
+        (valueToDictionary):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::objCCallbackFunctionCallAsConstructor):
+        (JSC::ObjCCallbackFunctionImpl::call):
+        * API/tests/testapi.mm:
+
+2014-02-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Baseline JIT should have a fast path to bypass the write barrier on op_enter
+        https://bugs.webkit.org/show_bug.cgi?id=128832
+
+        Reviewed by Filip Pizlo.
+
+        * jit/JIT.h: Removed some random commented out functions.h
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enter):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+
+2014-02-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't optimize variadic closure calls
+        https://bugs.webkit.org/show_bug.cgi?id=128835
+
+        Reviewed by Gavin Barraclough.
+        
+        Read the check that had been in JITStubs.cpp, back in the day. This code came
+        from the DFG and the DFG didn't need these checks.
+
+        * jit/JITOperations.cpp:
+
+2014-02-14  David Kilzer  <ddkilzer@apple.com>
+
+        [ASan] Disable JSStack::sanitizeStack() to avoid false-positive stack-buffer-overflow errors
+        <http://webkit.org/b/128819>
+
+        Reviewed by Filip Pizlo.
+
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::sanitizeStack): When building with the clang
+        address sanitizer, don't sanitize the stack since it will
+        trigger false-positive stack-buffer-overflow errors.  Disabling
+        this only results in a performance penalty, not a correctness
+        penalty.
+
+2014-02-14  Andres Gomez  <agomez@igalia.com>
+
+        Cleaning the JSStaticScopeObject files left behind after renaming their objects to JSNameScope
+        https://bugs.webkit.org/show_bug.cgi?id=127595
+
+        Reviewed by Mario Sanchez Prada.
+
+        JSStaticScopeObject was renamed to JSNameScope and removed long
+        ago but the files were left behind empty and the CMake compilation
+        in need of its existance. Now, we are definitely getting rid of
+        them.
+
+        * CMakeLists.txt:
+        * runtime/JSStaticScopeObject.cpp: Removed.
+        * runtime/JSStaticScopeObject.h: Removed.
+
+2014-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Kill some of the last vestiges of the C++ interpreter's PICs
+        https://bugs.webkit.org/show_bug.cgi?id=128796
+
+        Reviewed by Michael Saboff.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/PolymorphicAccessStructureList.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::PolymorphicStubInfo):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::visitWeak):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::isGetByIdAccess):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/Repatch.cpp:
+        (JSC::getPolymorphicStructureList):
+        (JSC::tryBuildGetByIDList):
+        * llint/LowLevelInterpreter.asm:
+
+2014-02-13  Mark Lam  <mark.lam@apple.com>
+
+        The JSContainerConvertor and ObjcContainerConvertor need to protect JSValueRefs. Part 2.
+        <https://webkit.org/b/128764>
+
+        Reviewed by Mark Hahnenberg.
+
+        toJS() is the wrong cast function to use. We need to use toJSForGC() instead.
+        Also we need to acquire the JSLock to prevent concurrent accesses to the
+        Strong handle list.
+
+        * API/JSValue.mm:
+        (JSContainerConvertor::add):
+        (containerValueToObject):
+        (ObjcContainerConvertor::add):
+        (objectToValue):
+
+2014-02-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSManagedValue::dealloc modifies NSMapTable while iterating it
+        https://bugs.webkit.org/show_bug.cgi?id=128713
+
+        Reviewed by Geoffrey Garen.
+
+        Having to write a test for this revealed a bug in how addManagedReference:withOwner:
+        actually notifies JSManagedValues of new owners.
+
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue dealloc]):
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine addManagedReference:withOwner:]):
+        (-[JSVirtualMachine removeManagedReference:withOwner:]):
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI):
+
+2014-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
+
+2014-02-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Speculative Release build fix after r164077.
+
+        * API/JSValue.mm:
+
+2014-02-13  Mark Lam  <mark.lam@apple.com>
+
+        The JSContainerConvertor and ObjcContainerConvertor need to protect JSValueRefs.
+        <https://webkit.org/b/128764>
+
+        Reviewed by Mark Hahnenberg.
+
+        Added a vector of Strong<Unknown> references in the 2 containers, and append
+        the newly created JSValues to those vectors. This will keep all those JS objects
+        alive for the duration of the conversion.
+
+        * API/JSValue.mm:
+        (JSContainerConvertor::add):
+        (ObjcContainerConvertor::add):
+
+2014-02-13  Matthew Mirman  <mmirman@apple.com>
+
+        Added GetMyArgumentsLength to FTL
+        https://bugs.webkit.org/show_bug.cgi?id=128758
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
+        * tests/stress/ftl-getmyargumentslength.js: Added.
+        (foo):
+
+2014-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/164066.
+        
+        It broke tests and it was just plain wrong.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * runtime/Structure.h:
+        (JSC::Structure::takesSlowPathInDFGForImpureProperty):
+
+2014-02-13  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix.
+
+        Fixed typo.
+
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::run):
+
+2014-02-13  Michael Saboff  <msaboff@apple.com>
+
+        Change FTL stack check to use VM's stackLimit
+        https://bugs.webkit.org/show_bug.cgi?id=128561
+
+        Reviewed by Filip Pizlo.
+
+        Changes FTL function entry to check the call frame register against the FTL
+        specific stack limit (VM::m_ftlStackLimit) and throw an exception if the
+        stack limit has been exceeded.  Updated the exception handling code to have
+        a second entry that will unroll the current frame to the caller, since that
+        is where the exception should be processed.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        * ftl/FTLState.h:
+        * runtime/VM.h:
+        (JSC::VM::addressOfFTLStackLimit):
+
+2014-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        GetByIdStatus shouldn't call takesSlowPathInDFGForImpureProperty() for self accesses, and calling that method should never assert about anything
+        https://bugs.webkit.org/show_bug.cgi?id=128772
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * runtime/Structure.h:
+        (JSC::Structure::takesSlowPathInDFGForImpureProperty):
+
+2014-02-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add some RELEASE_ASSERTs to catch JSLock bugs earlier
+        https://bugs.webkit.org/show_bug.cgi?id=128762
+
+        Reviewed by Mark Lam.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+
+2014-02-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Hoist and combine array bounds checks
+        https://bugs.webkit.org/show_bug.cgi?id=125433
+
+        Reviewed by Mark Hahnenberg.
+        
+        This adds a phase for reasoning about overflow checks and array bounds checks. It's
+        block-local, and removes both overflow checks and bounds checks in one go.
+        
+        This also improves reasoning about commutative operations, and CSE between
+        CheckOverflow and Unchecked arithmetic.
+        
+        This strangely uncovered a DFG backend bug where we were trying to extract an int32
+        from a constant even when that constant was just simply a number. I fixed that bug.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArithMode.h:
+        (JSC::DFG::subsumes):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::int32ToDoubleCSE):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGEdge.cpp:
+        (JSC::DFG::Edge::dump):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::sanitized):
+        (JSC::DFG::Edge::hash):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueOfInt32Constant):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertConstant):
+        * dfg/DFGIntegerCheckCombiningPhase.cpp: Added.
+        (JSC::DFG::IntegerCheckCombiningPhase::IntegerCheckCombiningPhase):
+        (JSC::DFG::IntegerCheckCombiningPhase::run):
+        (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
+        (JSC::DFG::IntegerCheckCombiningPhase::rangeKeyAndAddend):
+        (JSC::DFG::IntegerCheckCombiningPhase::isValid):
+        (JSC::DFG::IntegerCheckCombiningPhase::insertAdd):
+        (JSC::DFG::IntegerCheckCombiningPhase::insertMustAdd):
+        (JSC::DFG::performIntegerCheckCombining):
+        * dfg/DFGIntegerCheckCombiningPhase.h: Added.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        (JSC::DFG::StrengthReductionPhase::handleCommutativity):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionFalse):
+        * runtime/Identifier.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSObject.h:
+        * tests/stress/get-by-id-untyped.js: Added.
+        (foo):
+        * tests/stress/inverted-additive-subsumption.js: Added.
+        (foo):
+        * tests/stress/redundant-add-overflow-checks.js: Added.
+        (foo):
+        * tests/stress/redundant-array-bounds-checks-addition-skip-first.js: Added.
+        (foo):
+        (arraycmp):
+        * tests/stress/redundant-array-bounds-checks-addition.js: Added.
+        (foo):
+        (arraycmp):
+        * tests/stress/redundant-array-bounds-checks-unchecked-addition.js: Added.
+        (foo):
+        (arraycmp):
+        * tests/stress/redundant-array-bounds-checks.js: Added.
+        (foo):
+        (arraycmp):
+        * tests/stress/tricky-array-bounds-checks.js: Added.
+        (foo):
+        (arraycmp):
+
+2014-02-13  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should be OK with __compact_unwind in a data section
+        https://bugs.webkit.org/show_bug.cgi?id=128756
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateCodeSection):
+        (JSC::FTL::mmAllocateDataSection):
+
+2014-02-13  Michael Saboff  <msaboff@apple.com>
+
+        CStack Branch: VM::currentReturnThunkPC appears to be unused and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=127205
+
+        Reviewed by Geoffrey Garen.
+
+        Removed ununsed references to VM::currentReturnThunkPC.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::arityFixup):
+        * runtime/VM.h:
+
+2014-02-13  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>
+
+        Code cleanup: remove gcc<4.7 guards.
+        https://bugs.webkit.org/show_bug.cgi?id=128729
+
+        Reviewed by Anders Carlsson.
+
+        Remove GCC_VERSION_AT_LEAST guards when it checks for pre-4.7 versions,
+        as WK does not compile with earlier gcc versions.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::cacheFlush):
+        * interpreter/StackVisitor.cpp:
+        (JSC::printif):
+
+2014-02-12  Mark Lam  <mark.lam@apple.com>
+
+        No need to save reservedZoneSize when dropping the JSLock.
+        <https://webkit.org/b/128719>
+
+        Reviewed by Geoffrey Garen.
+
+        The reservedZoneSize does not change due to the VM being run on a different
+        thread. Hence, there is no need to save and restore its value. Instead of
+        calling updateReservedZoneSize() to update the stack limit, we now call
+        setStackPointerAtVMEntry() to do the job. setStackPointerAtVMEntry()
+        will update the stackPointerAtVMEntry and delegate to updateStackLimit() to
+        update the stack limit based on the new stackPointerAtVMEntry.
+
+        * runtime/ErrorHandlingScope.cpp:
+        (JSC::ErrorHandlingScope::ErrorHandlingScope):
+        (JSC::ErrorHandlingScope::~ErrorHandlingScope):
+        - Previously, we initialize stackPointerAtVMEntry in VMEntryScope. This
+          means that the stackPointerAtVMEntry may not be initialize when we
+          instantiate the ErrorHandlingScope. And so, we needed to initialize the
+          stackPointerAtVMEntry in the ErrorHandlingScope constructor if it's not
+          already initialized.
+
+          Now that we initialize the stackPointerAtVMEntry when we lock the VM JSLock,
+          we are guaranteed that it will be initialized by the time we instantiate
+          the ErrorHandlingScope. Hence, we can change the ErrorHandlingScope code
+          to just assert that the stackPointerAtVMEntry is initialized instead.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        - We no longer need to save the reservedZoneSize. Remove the related code.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::lock):
+        - When we grab the JSLock mutex for the first time, there is no reason why
+          the stackPointerAtVMEntry should be initialized. By definition, grabbing
+          the lock for the first time equates to entering the VM for the first time.
+          Hence, we can just assert that stackPointerAtVMEntry is uninitialized,
+          and initialize it unconditionally.
+
+          The only exception to this is if we're locking to regrab the JSLock in
+          grabAllLocks(), but grabAllLocks() will take care of restoring the
+          stackPointerAtVMEntry in that case after lock() returns. stackPointerAtVMEntry
+          should still be 0 when we've just locked the JSLock. So, the above assertion
+          always holds true.
+
+          Note: VM::setStackPointerAtVMEntry() will take care of calling
+          VM::updateStackLimit() based on the new stackPointerAtVMEntry.
+
+        - There is no need to save the reservedZoneSize. The reservedZoneSize is
+          set to Options::reservedZoneSize() when the VM is initialized. Thereafter,
+          the ErrorHandlingScope will change it to Options::errorModeReservedZoneSize()
+          when we're handling an error, and it will restore it afterwards. There is
+          no other reason we should be changing the reservedZoneSize. Hence, we can
+          remove the unnecessary code to save it here.
+
+        (JSC::JSLock::unlock):
+        - Similarly, when the lockCount reaches 0 in unlock(), it is synonymous with
+          exiting the VM. Hence, we should just clear the stackPointerAtVMEntry and
+          update the stackLimit. Exiting the VM should have no effect on the VM
+          reservedZoneSize. Hence, we can remove the unnecessary code to "restore" it.
+
+        (JSC::JSLock::dropAllLocks):
+        - When dropping locks, we do not need to save the reservedZoneSize because
+          the reservedZoneSize should remain the same regardless of which thread
+          we are executing JS on. Hence, we can remove the unnecessary code to save
+          the reservedZoneSize here.
+
+        (JSC::JSLock::grabAllLocks):
+        - When re-grabbing locks, restoring the stackPointerAtVMEntry via
+          VM::setStackPointerAtVMEntry() will take care of updating the stack limit.
+          As explained above, there's no need to save the reservedZoneSize. Hence,
+          there's no need to "restore" it here.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::setStackPointerAtVMEntry):
+        - Sets the stackPointerAtVMEntry and delegates to updateStackLimit() to update
+          the stack limit based on the new stackPointerAtVMEntry.
+        (JSC::VM::updateStackLimit):
+        * runtime/VM.h:
+        (JSC::VM::stackPointerAtVMEntry):
+        - Renamed stackPointerAtVMEntry to m_stackPointerAtVMEntry and made it private.
+          Added a stackPointerAtVMEntry() function to read the value.
+
+2014-02-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        DelayedReleaseScope in MarkedAllocator::tryAllocateHelper is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=128641
+
+        Reviewed by Michael Saboff.
+
+        We were improperly handling the case where the DelayedReleaseScope 
+        in tryAllocateHelper would cause us to drop the API lock, allowing 
+        another thread to sneak in and allocate a new block after we had already 
+        concluded that there were no more blocks to allocate out of.
+
+        The fix is to call tryAllocateHelper in a loop until we know for sure 
+        that this did not happen.
+
+        There was also a race condition with the DelayedReleaseScope in addBlock.
+        We would add the block to the MarkedBlock's list, sweep it, and then return,
+        causing us to drop the API lock momentarily. Another thread could then 
+        grab the lock, and allocate out of the new block to the point where the 
+        free list was empty. Then we would return to the original thread, who thinks 
+        it's impossible to not allocate successfully at this point. 
+        Instead we should just let tryAllocate do all the hard work with correctly 
+        sweeping and getting a valid result.
+
+        There was another race condition in didFinishIterating. We would call resumeAllocating,
+        which would create a DelayedReleaseScope. The DelayedReleaseScope would then release 
+        API lock before we set m_isIterating back to false, which would potentially confuse 
+        other threads.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::tryPopFreeList):
+        (JSC::MarkedAllocator::tryAllocate):
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h:
+
+2014-02-12  Brian Burg  <bburg@apple.com>
+
+        Web Replay: capture and replay nondeterminism of Date.now() and Math.random()
+        https://bugs.webkit.org/show_bug.cgi?id=128633
+
+        Reviewed by Filip Pizlo.
+
+        Upstream the only two sources of script-visible nondeterminism in JavaScriptCore.
+
+        The random seed for WeakRandom is memoized when the owning JSGlobalObject is
+        constructed. It is deterministically initialized during replay before any
+        scripts execute with the global object.
+
+        The implementations of `Date.now()` and `new Date()` eventually obtain the
+        current time from jsCurrentTime(). When capturing, we save return values of
+        jsCurrentTime() into the recording. When replaying, we use memoized values from
+        the recording instead of obtaining values from the platform-specific currentTime()
+        implementation. No other code calls jsCurrentTime().
+
+        * DerivedSources.make: Add rules to make JSReplayInputs.h from JSInputs.json.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * replay/JSInputs.json: Added. Includes specifications for replay inputs
+        "GetCurrentTime" and "SetRandomSeed". Tests will be added for both input
+        cases once sufficient replay machinery has been added.
+
+        * replay/NondeterministicInput.h: NondeterministicInput should not have
+        been marked 'final'.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::deterministicCurrentTime): Added. Load or store the current time depending
+        on what kind of InputCursor is attached to the JSGlobalObject.
+
+        (JSC::constructDate): Use deterministicCurrentTime().
+        (JSC::dateNow): Use deterministicCurrentTime().
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setInputCursor): When setting a non-empty input cursor,
+        immediately store or load the "SetRandomSeed" input and initialize WeakRandom's
+        random seed with it. The input cursor (and thus random seed) must be set before
+        any scripts are evaluated with this JSGlobalObject.
+
+        * runtime/WeakRandom.h:
+        (JSC::WeakRandom::WeakRandom): Add JSGlobalObject as a friend class.
+        (JSC::WeakRandom::initializeSeed): Extract the seed initialization into a
+        separate method so it can be called outside of the JSGlobalObject constructor.
+
+2014-02-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Cleanup JavaScriptCore/inspector
+        https://bugs.webkit.org/show_bug.cgi?id=128662
+
+        Reviewed by Timothy Hatcher.
+
+        Now that the code has settled, do a cleanup pass.
+
+        * inspector/ContentSearchUtilities.cpp:
+        * inspector/InspectorValues.cpp:
+        (Inspector::InspectorValue::asObject):
+        (Inspector::InspectorValue::asArray):
+        (Inspector::InspectorValue::parseJSON):
+        (Inspector::InspectorObjectBase::getObject):
+        (Inspector::InspectorObjectBase::getArray):
+        (Inspector::InspectorObjectBase::get):
+        * inspector/ScriptCallStackFactory.cpp:
+        * inspector/ScriptDebugServer.cpp:
+        * inspector/agents/JSGlobalObjectConsoleAgent.h:
+
+2014-02-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Windows build fix attempt after r163960.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2014-02-12  Michael Saboff  <msaboff@apple.com>
+
+        Adjust VM::stackLimit based on the size of the largest FTL stack produced
+        https://bugs.webkit.org/show_bug.cgi?id=128562
+
+        Reviewed by Mark Lam.
+
+        Added VM::m_largestFTLStackSize to track the largest stack size of an FTL compiled
+        function. Added VM::m_ftlStackLimit for FTL functions stack limit.  Renamed
+        VM::updateStackLimitWithReservedZoneSize to VM::updateReservedZoneSize.  Renamed
+        VM::setStackLimit to VM::updateStackLimit and changed it to do the updating of the
+        stack limits, including taking into account m_largestFTLStackSize.
+
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * runtime/ErrorHandlingScope.cpp:
+        (JSC::ErrorHandlingScope::ErrorHandlingScope):
+        (JSC::ErrorHandlingScope::~ErrorHandlingScope):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::grabAllLocks):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::updateReservedZoneSize):
+        (JSC::VM::updateStackLimit):
+        (JSC::VM::updateFTLLargestStackSize):
+        * runtime/VM.h:
+
+2014-02-11  Oliver Hunt  <oliver@apple.com>
+
+        Make it possible to implement JS builtins in JS
+        https://bugs.webkit.org/show_bug.cgi?id=127887
+
+        Reviewed by Michael Saboff.
+
+        This patch makes it possible to write builtin functions in JS.
+        The bindings, generators, and definitions are all created automatically
+        based on js files in the builtins/ directory.  This patch includes one
+        such case: Array.prototype.js with an implementation of every().
+
+        There's a lot of refactoring to make it possible for CommonIdentifiers
+        to include the output of the generated files (DerivedSources/JSCBuiltins.{h,cpp})
+        without breaking the offset extractor. The result of this refactoring
+        is that CommonIdentifiers, and a few other miscellaneous headers now
+        need to be included directly as they were formerly captured through other
+        paths.
+
+        In addition this adds a flag to the Lookup table's hashentry to indicate
+        that a static function is actually backed by JS. There is then a lot of
+        logic to thread the special nature of the functon to where it matters.
+        This allows toString(), .caller, etc to mimic the behaviour of a host
+        function.
+
+        Notes on writing builtins:
+         - Each function is compiled independently of the others, and those
+           implementations cannot currently capture all global properties (as
+           that could be potentially unsafe). If a function does capture a
+           global we will deliberately crash.
+         - For those "global" properties that we do want access to, we use
+           the @ prefix, e.g. Object(this) becomes @Object(this). The @ identifiers
+           are private names, and behave just like regular properties, only
+           without the risk of adulteration. Again, in the @Object case, we
+           explicitly duplicate the ObjectConstructor reference on the GlobalObject
+           so that we have guaranteed access to the original version of the
+           constructor.
+         - call, apply, eval, and Function are all rejected identifiers, again
+           to prevent anything from accidentally using an adulterated object.
+           Instead @call and @apply are available, and happily they completely
+           drop the neq_ptr instruction as they're defined as always being the
+           original call/apply functions.
+
+        These restrictions are just intended to make it harder to accidentally
+        make changes that are incorrect (for instance calling whatever has been
+        assigned to global.Object, instead of the original constructor function).
+        However, making a mistake like this should result in a purely semantic
+        error as fundamentally these functions are treated as though they were
+        regular JS code in the host global, and have no more privileges than
+        any other JS.
+
+        The initial proof of concept is Array.prototype.every, this shows a 65%
+        performance improvement, and that improvement is significantly hurt by
+        our poor optimisation of op_in.
+
+        As this is such a limited function, we have not yet exported all symbols
+        that we could possibly need, but as we implement more, the likelihood
+        of encountering missing features will reduce.
+
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
+        (JSC::JSCallbackObject<Parent>::put):
+        (JSC::JSCallbackObject<Parent>::deleteProperty):
+        (JSC::JSCallbackObject<Parent>::getStaticValue):
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/Array.prototype.js:
+        (every):
+        * builtins/BuiltinExecutables.cpp: Added.
+        (JSC::BuiltinExecutables::BuiltinExecutables):
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * builtins/BuiltinExecutables.h:
+        (JSC::BuiltinExecutables::create):
+        * builtins/BuiltinNames.h: Added.
+        (JSC::BuiltinNames::BuiltinNames):
+        (JSC::BuiltinNames::getPrivateName):
+        (JSC::BuiltinNames::getPublicName):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::UnlinkedFunctionExecutable::create):
+        (JSC::UnlinkedFunctionExecutable::toStrictness):
+        (JSC::UnlinkedFunctionExecutable::isBuiltinFunction):
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isBuiltinFunction):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * create_hash_table:
+        * generate-js-builtins: Added.
+        (getCopyright):
+        (getFunctions):
+        (generateCode):
+        (mangleName):
+        (FunctionExecutable):
+        (Identifier):
+        (JSGlobalObject):
+        (SourceCode):
+        (UnlinkedFunctionExecutable):
+        (VM):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::isSafeBuiltinIdentifier):
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        (JSC::isSafeIdentifier):
+        (JSC::Lexer<T>::lexExpectIdentifier):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::setClosedVariables):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::capturedVariables):
+        (JSC::ScopeNode::setClosedVariables):
+        (JSC::ProgramNode::closedVariables):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::didFinishParsing):
+        (JSC::Parser<LexerType>::printUnexpectedTokenText):
+        * parser/Parser.h:
+        (JSC::Scope::getUsedVariables):
+        (JSC::Parser::closedVariables):
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * parser/ParserTokens.h:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        (JSC::CommonIdentifiers::~CommonIdentifiers):
+        (JSC::CommonIdentifiers::getPrivateName):
+        (JSC::CommonIdentifiers::getPublicName):
+        * runtime/CommonIdentifiers.h:
+        (JSC::CommonIdentifiers::builtinNames):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::executableInfo):
+        (JSC::ProgramExecutable::executableInfo):
+        (JSC::FunctionExecutable::isBuiltinFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::createBuiltinFunction):
+        (JSC::JSFunction::calculatedDisplayName):
+        (JSC::JSFunction::sourceCode):
+        (JSC::JSFunction::isHostOrBuiltinFunction):
+        (JSC::JSFunction::isBuiltinFunction):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::nativeConstructor):
+        (JSC::isHostFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::objectConstructor):
+        (JSC::JSGlobalObject::symbolTableHasProperty):
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        (JSC::JSObject::putDirectBuiltinFunction):
+        * runtime/JSObject.h:
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::builtinGenerator):
+        (JSC::HashEntry::propertyGetter):
+        (JSC::HashEntry::propertyPutter):
+        (JSC::HashTable::entry):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::putEntry):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/PropertySlot.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::builtinExecutables):
+
+2014-02-11  Brent Fulgham  <bfulgham@apple.com>
+
+        Remove some unintended copies in ranged for loops
+        https://bugs.webkit.org/show_bug.cgi?id=128644
+
+        Reviewed by Anders Carlsson.
+
+        * inspector/InjectedScriptHost.cpp:
+        (Inspector::InjectedScriptHost::clearAllWrappers): Avoid creating/destroying
+        a std::pair<> and pointer each loop iteration.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser): Avoid copying object containing a string
+        each loop iteration.
+
+2014-02-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Debug build fix after r163946.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+
+2014-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Inserting a node with a codeOrigin "like" another node should copy both the codeOrigin and codeOriginForExitTarget
+        https://bugs.webkit.org/show_bug.cgi?id=128635
+
+        Reviewed by Michael Saboff.
+        
+        Originally nodes just had a codeOrigin. But then we started doing code motion, and we
+        needed to separate the codeOrigin that designated where to exit from the codeOrigin
+        that designated everything else. The "everything else" is actually pretty important:
+        it includes profiling, exception handling, and the actual semantics of the node. For
+        example some nodes use the origin's global object in some way.
+        
+        This all sort of worked except for one quirk: the facilities for creating nodes all
+        assumed that there really was only one origin. LICM would work around this by setting
+        the codeOriginForExitTarget manually. But, that means that:
+        
+        - If we did hoist a node twice, then the second time around, we would forget the node's
+          original exit target.
+        
+        - If we did an insertNode() to insert a node before a hoisted node, the inserted node
+          would have the wrong exit target.
+        
+        Most of the time, if we copy the code origin, we actually want to copy both origins.
+        So, this patch introduces the notion of a NodeOrigin which has two CodeOrigins: a
+        forExit code origin that says where to exit, and a semantic code origin for everything
+        else.
+        
+        This also (annoyingly?) means that we are always more explicit about which code origin
+        we refer to. That means that a lot of "node->codeOrigin" expressions had to change to
+        "node->origin.semantic". This was partly a ploy on my part to ensure that this
+        refactoring was complete: to get the code to compile I really had to audit all uses of
+        CodeOrigin. If, in the future, we find that "node->origin.semantic" is too cumbersome
+        then we can reintroduce the Node::codeOrigin field. For now I kinda like it though.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::booleanResult):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::originalArrayStructure):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::convertToJump):
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        (JSC::DFG::CFGSimplificationPhase::jettisonBlock):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
+        (JSC::DFG::CPSRethreadingPhase::addPhi):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::propagatePhis):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::notifyCompilingStructureTransition):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::fixupBlock):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::createDumpList):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::createToString):
+        (JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
+        (JSC::DFG::FixupPhase::convertStringAddUse):
+        (JSC::DFG::FixupPhase::fixupToPrimitive):
+        (JSC::DFG::FixupPhase::fixupToString):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        (JSC::DFG::FixupPhase::fixEdge):
+        (JSC::DFG::FixupPhase::insertStoreBarrier):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        (JSC::DFG::FixupPhase::truncateConstantToInt32):
+        (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
+        (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
+        (JSC::DFG::FixupPhase::convertToGetArrayLength):
+        (JSC::DFG::FixupPhase::prependGetArrayLength):
+        (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):
+        (JSC::DFG::FixupPhase::addPhantomsIfNecessary):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::amountOfNodeWhiteSpace):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::hasExitSite):
+        (JSC::DFG::Graph::valueProfileFor):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        (JSC::DFG::InvalidationPointInjectionPhase::handle):
+        (JSC::DFG::InvalidationPointInjectionPhase::insertInvalidationCheck):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::isStronglyProvedConstantIn):
+        * dfg/DFGNodeOrigin.h: Added.
+        (JSC::DFG::NodeOrigin::NodeOrigin):
+        (JSC::DFG::NodeOrigin::isSet):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGResurrectionForValidationPhase.cpp:
+        (JSC::DFG::ResurrectionForValidationPhase::run):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSSALoweringPhase.cpp:
+        (JSC::DFG::SSALoweringPhase::handleNode):
+        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::masqueradesAsUndefinedWatchpointIsStillValid):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
+        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnException):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCall):
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild):
+        (JSC::DFG::StrengthReductionPhase::prepareToFoldTypedArray):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateSSA):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        (JSC::DFG::WatchpointCollectionPhase::handleEdge):
+        (JSC::DFG::WatchpointCollectionPhase::handleMasqueradesAsUndefined):
+        (JSC::DFG::WatchpointCollectionPhase::globalObject):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::link):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileToThis):
+        (JSC::FTL::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArray):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArrayBuffer):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyScope):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckArgumentsNotCreated):
+        (JSC::FTL::LowerDFGToLLVM::getById):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::speculateStringObjectForStructure):
+        (JSC::FTL::LowerDFGToLLVM::masqueradesAsUndefinedWatchpointIsStillValid):
+        (JSC::FTL::LowerDFGToLLVM::callPreflight):
+
+2014-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix assertions and incorrect codegen for CompareEq(ObjectOrOther:, Object:)
+        https://bugs.webkit.org/show_bug.cgi?id=128648
+
+        Reviewed by Mark Lam.
+        
+        I did CompareEq(Object:, ObjectOrOther:) correctly but the flipped version wrong.
+        That's what I get for running tests in release mode. It's hard to write a test for
+        the incorrect codegen; that's kind of why the assertions are there.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+
+2014-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, trivial change to silence FTL assertions
+
+        Normally, lowJSValue() should only be used for UntypedUse only. Here we are using it
+        on ObjectOrOtherUse because we execute the speculation ourselves. The way you're
+        supposed to do this is by passing ManualOperandSpeculation to tell lowJSValue() not
+        to assert.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
+
+2014-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Use LLVM's dead store elimination
+        https://bugs.webkit.org/show_bug.cgi?id=128638
+
+        Reviewed by Mark Hahnenberg.
+        
+        DFG's store elimination was being run too soon for comfort on the FTL path. It's
+        really only sound when run after all other optimizations. Remove it from the FTL
+        path.
+        
+        Enable LLVM store elimination. It's both easier to reason about and more
+        comprehensive.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+
+2014-02-11  Brian Burg  <bburg@apple.com>
+
+        Web Replay: upstream replay input code generator and EncodedValue class
+        https://bugs.webkit.org/show_bug.cgi?id=128215
+
+        Reviewed by Joseph Pecoraro.
+
+        Add the replay inputs code generator. Most features of the input generator are
+        exercised by included generator regression tests, which produce useful but
+        non-compilable test replay inputs.
+
+        Add EncodedValue, the main replay input serialization class that encodes and
+        decodes inputs and their data between C++ types and the JSON-based replay recording
+        format. EncodedValue uses EncodingTraits specializations for type-specific encoding.
+        Relative to other WebKit marshalling mechanisms, EncodedValue is key/value based.
+        EncodedValue uses InspectorValue subclasses as its backing data structure.
+
+        Add some missing numerical conversions to InspectorValue.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorValues.cpp:
+        (Inspector::InspectorValue::asNumber):
+        (Inspector::InspectorBasicValue::asNumber):
+        * inspector/InspectorValues.h:
+        * replay/EncodedValue.cpp: Added.
+        (JSC::EncodedValue::asObject):
+        (JSC::EncodedValue::asArray):
+        (JSC::ScalarEncodingTraits<bool>::encodeValue):
+        (JSC::ScalarEncodingTraits<double>::encodeValue):
+        (JSC::ScalarEncodingTraits<float>::encodeValue):
+        (JSC::ScalarEncodingTraits<int32_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<int64_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<uint32_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<uint64_t>::encodeValue):
+        (JSC::long>::encodeValue):
+        (JSC::EncodedValue::convertTo<bool>):
+        (JSC::EncodedValue::convertTo<double>):
+        (JSC::EncodedValue::convertTo<float>):
+        (JSC::EncodedValue::convertTo<int32_t>):
+        (JSC::EncodedValue::convertTo<int64_t>):
+        (JSC::EncodedValue::convertTo<uint32_t>):
+        (JSC::EncodedValue::convertTo<uint64_t>):
+        (JSC::long>):
+        (JSC::EncodedValue::convertTo<String>):
+        (JSC::EncodedValue::put<EncodedValue>):
+        (JSC::EncodedValue::append<EncodedValue>):
+        (JSC::EncodedValue::get<EncodedValue>):
+        * replay/EncodedValue.h: Added.
+        (JSC::EncodedValue::EncodedValue):
+        (JSC::EncodedValue::createObject):
+        (JSC::EncodedValue::createArray):
+        (JSC::EncodedValue::createString):
+        (JSC::EncodedValue::~EncodedValue):
+        (JSC::ScalarEncodingTraits::decodeValue):
+        (JSC::EncodingTraits<String>::encodeValue):
+        (JSC::EncodedValue::put):
+        (JSC::EncodedValue::append):
+        (JSC::EncodedValue::get):
+        * replay/scripts/CodeGeneratorReplayInputs.py: Added.
+        (ParseException):
+        (TypecheckException):
+        (Framework):
+        (Framework.__init__):
+        (Framework.setting):
+        (Framework.fromString):
+        (Frameworks):
+        (InputQueue):
+        (InputQueue.__init__):
+        (InputQueue.setting):
+        (InputQueue.fromString):
+        (InputQueues):
+        (Input):
+        (Input.__init__):
+        (Input.setting):
+        (InputMember):
+        (InputMember.__init__):
+        (InputMember.has_flag):
+        (TypeMode):
+        (TypeMode.__init__):
+        (TypeMode.fromString):
+        (TypeModes):
+        (Type):
+        (Type.__init__):
+        (Type.__eq__):
+        (Type.__hash__):
+        (Type.has_flag):
+        (Type.is_struct):
+        (Type.is_enum):
+        (Type.is_enum_class):
+        (Type.declaration_kind):
+        (Type.qualified_prefix):
+        (Type.qualified_prefix.is):
+        (Type.type_name):
+        (Type.storage_type):
+        (Type.borrow_type):
+        (Type.argument_type):
+        (check_properties):
+        (VectorType):
+        (VectorType.__init__):
+        (VectorType.has_flag):
+        (VectorType.is_struct):
+        (VectorType.is_enum):
+        (VectorType.is_enum_class):
+        (VectorType.qualified_prefix):
+        (VectorType.type_name):
+        (VectorType.argument_type):
+        (InputsModel):
+        (InputsModel.__init__):
+        (InputsModel.enum_types):
+        (InputsModel.get_type_for_member):
+        (InputsModel.parse_toplevel):
+        (InputsModel.parse_type_with_framework_name):
+        (InputsModel.parse_input):
+        (InputsModel.typecheck):
+        (InputsModel.typecheck_type):
+        (InputsModel.typecheck_input):
+        (InputsModel.typecheck_input_member):
+        (IncrementalFileWriter):
+        (IncrementalFileWriter.__init__):
+        (IncrementalFileWriter.write):
+        (IncrementalFileWriter.close):
+        (lcfirst):
+        (wrap_with_guard):
+        (Generator):
+        (Generator.__init__):
+        (Generator.setting):
+        (Generator.output_filename):
+        (Generator.write_output_files):
+        (Generator.generate_header):
+        (Generator.generate_implementation):
+        (Generator.generate_license):
+        (Generator.generate_includes):
+        (Generator.generate_includes.declaration):
+        (Generator.generate_includes.declaration.is):
+        (Generator.generate_type_forward_declarations):
+        (Generator.generate_type_forward_declarations.is):
+        (Generator.generate_class_declaration):
+        (Generator.generate_input_constructor_declaration):
+        (Generator.generate_input_destructor_declaration):
+        (Generator.generate_input_member_getter):
+        (Generator.generate_input_member_declaration):
+        (Generator.generate_input_member_tuples):
+        (Generator.qualified_input_name):
+        (Generator.generate_input_trait_declaration):
+        (Generator.generate_enum_trait_declaration):
+        (Generator.generate_for_each_macro):
+        (Generator.generate_class_implementation):
+        (Generator.generate_enum_trait_implementation):
+        (Generator.generate_enum_trait_implementation.is):
+        (Generator.generate_input_trait_implementation):
+        (Generator.generate_input_encode_implementation):
+        (Generator.generate_input_decode_implementation):
+        (Generator.generate_constructor_initializer_list):
+        (Generator.generate_constructor_formals_list):
+        (Generator.generate_member_borrow_expression):
+        (Generator.generate_member_move_expression):
+        (Generator.generate_constructor_arguments_list):
+        (generate_from_specification):
+        * replay/scripts/CodeGeneratorReplayInputsTemplates.py: Added.
+        (Templates):
+        * replay/scripts/tests/expected/JSInputs.json-TestReplayInputs.cpp: Added.
+        * replay/scripts/tests/expected/JSInputs.json-TestReplayInputs.h: Added.
+        * replay/scripts/tests/expected/fail-on-c-style-enum-no-storage.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-duplicate-input-names.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-duplicate-type-names.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-enum-type-missing-values.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-missing-input-member-name.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-missing-input-name.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-missing-input-queue.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-missing-type-mode.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-missing-type-name.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-no-inputs.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-no-types.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-unknown-input-queue.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-unknown-member-type.json-error: Added.
+        * replay/scripts/tests/expected/fail-on-unknown-type-mode.json-error: Added.
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.cpp: Added.
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h: Added.
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp: Added.
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h: Added.
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-error: Added.
+        * replay/scripts/tests/expected/generate-event-loop-shape-types.json-error: Added.
+        * replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.cpp: Added.
+        * replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.h: Added.
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.cpp: Added.
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h: Added.
+        * replay/scripts/tests/expected/generate-inputs-with-flags.json-error: Added.
+        * replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.cpp: Added.
+        * replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.h: Added.
+        * replay/scripts/tests/fail-on-c-style-enum-no-storage.json: Added.
+        * replay/scripts/tests/fail-on-duplicate-input-names.json: Added.
+        * replay/scripts/tests/fail-on-duplicate-type-names.json: Added.
+        * replay/scripts/tests/fail-on-enum-type-missing-values.json: Added.
+        * replay/scripts/tests/fail-on-missing-input-member-name.json: Added.
+        * replay/scripts/tests/fail-on-missing-input-name.json: Added.
+        * replay/scripts/tests/fail-on-missing-input-queue.json: Added.
+        * replay/scripts/tests/fail-on-missing-type-mode.json: Added.
+        * replay/scripts/tests/fail-on-missing-type-name.json: Added.
+        * replay/scripts/tests/fail-on-no-inputs.json: Added.
+        * replay/scripts/tests/fail-on-no-types.json: Added.
+        * replay/scripts/tests/fail-on-unknown-input-queue.json: Added.
+        * replay/scripts/tests/fail-on-unknown-member-type.json: Added.
+        * replay/scripts/tests/fail-on-unknown-type-mode.json: Added.
+        * replay/scripts/tests/generate-enum-encoding-helpers-with-guarded-values.json: Added.
+        * replay/scripts/tests/generate-enum-encoding-helpers.json: Added.
+        * replay/scripts/tests/generate-event-loop-shape-types.json: Added.
+        * replay/scripts/tests/generate-input-with-guard.json: Added.
+        * replay/scripts/tests/generate-input-with-vector-members.json: Added.
+        * replay/scripts/tests/generate-inputs-with-flags.json: Added.
+        * replay/scripts/tests/generate-memoized-type-modes.json: Added.
+
+2014-02-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Add Availability Macros to new JSC APIs
+        https://bugs.webkit.org/show_bug.cgi?id=128615
+
+        Reviewed by Mark Rowe.
+
+        * API/JSContext.h:
+        * API/JSContextRef.h:
+
+2014-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support CompareEq(ObjectOrOther:, Object:)
+        https://bugs.webkit.org/show_bug.cgi?id=127752
+
+        Reviewed by Oliver Hunt.
+        
+        Also introduce some helpers for reasoning about nullness and truthyness.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
+        (JSC::FTL::LowerDFGToLLVM::speculateTruthyObject):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::isNotNully):
+        (JSC::FTL::LowerDFGToLLVM::isNully):
+        (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+        * tests/stress/compare-eq-object-or-other-to-object.js: Added.
+        (foo):
+        (test):
+        * tests/stress/compare-eq-object-to-object-or-other.js: Added.
+        (foo):
+        (test):
+
+2014-02-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        32-bit LLInt writeBarrierOnGlobalObject is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=128556
+
+        Reviewed by Geoffrey Garen.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Also fixed the value check on 64-bit.
+
+2014-02-11  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        LLInt typo error after r139004.
+        https://bugs.webkit.org/show_bug.cgi?id=128592
+
+        Reviewed by Michael Saboff.
+
+        * offlineasm/arm.rb: change immediate to register in the condition
+
+2014-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        LICM should gracefully handle unprofiled code
+        https://bugs.webkit.org/show_bug.cgi?id=127848
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+
+2014-02-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Obj-C API: JSExport doesn't work for methods that contain protocols in their type signature
+        https://bugs.webkit.org/show_bug.cgi?id=128540
+
+        Reviewed by Oliver Hunt.
+
+        The bug is in parseObjCType in ObjcRuntimeExtras.h. When we see an '@' in the 
+        type signature of a method, we assume that what follows the '@' is a class name, 
+        so we call objc_getClass, and if that returns nil then we give up on the method 
+        and don't export it.
+
+        This assumption doesn't work in the case of id<Protocol> because it's the name 
+        of the protocol that follows the '@', not the name of a class. We should have 
+        another fallback case for protocol names.
+
+        There's another case that also doesn't work, and that's the case of a named class 
+        with a specified prototype in a method signature (e.g. NSObject<MyProtocol>). 
+        There the substring of the type signature that represents the class is "NSObject<MyProtocol>", 
+        which will also cause objc_getClass to return nil.
+
+        * API/ObjcRuntimeExtras.h:
+        (parseObjCType):
+        * API/tests/DateTests.mm: Also fixed an issue I noticed where we don't use an autorelease pool
+        for the DateTests.
+        * API/tests/JSExportTests.h: Added.
+        * API/tests/JSExportTests.mm: Added.
+        (-[TruthTeller returnTrue]):
+        (-[ExportMethodWithIdProtocol methodWithIdProtocol:]):
+        (-[ExportMethodWithClassProtocol methodWithClassProtocol:]):
+        (+[JSExportTests exportInstanceMethodWithIdProtocolTest]):
+        (+[JSExportTests exportInstanceMethodWithClassProtocolTest]):
+        (runJSExportTests):
+        * API/tests/testapi.mm:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Re-enable ARM Thumb2 disassembler
+        https://bugs.webkit.org/show_bug.cgi?id=128577
+
+        Reviewed by Filip Pizlo.
+
+        Changed signature of tryToDisassemble() to match updates.
+        Fixed typo in disassembler.
+
+        * disassembler/ARMv7/ARMv7DOpcode.cpp:
+        * disassembler/ARMv7Disassembler.cpp:
+        (JSC::tryToDisassemble):
+
+2014-02-10  Mark Lam  <mark.lam@apple.com>
+
+        Removing limitation on JSLock's lockDropDepth.
+        <https://webkit.org/b/128570>
+
+        Reviewed by Geoffrey Garen.
+
+        Now that we've switched to using the C stack, we no longer need to limit
+        the JSLock::lockDropDepth to 2.
+
+        For C loop builds which still use the separate JSStack, the JSLock will
+        enforce ordering for re-grabbing the lock after dropping it. Re-grabbing
+        must occur in the reverse order of the dropping of the locks.
+
+        Ordering is achieved by JSLock::dropAllLocks() stashing away the
+        JSLock:: m_lockDropDepth in its DropAllLocks instance's m_dropDepth
+        before unlocking the lock. Subsequently, JSLock::grabAllLocks() will
+        ensure that JSLocks::m_lockDropDepth equals its DropAllLocks instance's
+        m_dropDepth before allowing the lock to be re-grabbed. Otherwise, it
+        will yield execution and retry again later.
+
+        Note: because JSLocks::m_lockDropDepth is protected by the JSLock's
+        mutex, grabAllLocks() will optimistically lock the JSLock before doing
+        the check on m_lockDropDepth. If the check fails, it will unlock the
+        JSLock, yield, and then relock it again later before retrying the check.
+        This ensures that m_lockDropDepth remains under the protection of the
+        JSLock's mutex.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::grabAllLocks):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC::JSLock::DropAllLocks::setDropDepth):
+        (JSC::JSLock::DropAllLocks::dropDepth):
+
+2014-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support ToThis
+        https://bugs.webkit.org/show_bug.cgi?id=127751
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileToThis):
+        * tests/stress/to-this-polymorphic.js: Added.
+        (foo):
+
+2014-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename Operations.h to JSCInlines.h
+        https://bugs.webkit.org/show_bug.cgi?id=128543
+
+        Rubber stamped by Geoffrey Garen.
+        
+        Well, what this actually does is it splits Operations.h into a real Operations.h that
+        actually contains "operations", and JSCInlines.h, which serves the role of being an
+        inlines umbrella.
+        
+        * API/JSBase.cpp:
+        * API/JSCTestRunnerUtils.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObject.cpp:
+        * API/JSClassRef.cpp:
+        * API/JSContext.mm:
+        * API/JSContextRef.cpp:
+        * API/JSManagedValue.mm:
+        * API/JSObjectRef.cpp:
+        * API/JSScriptRef.cpp:
+        * API/JSValue.mm:
+        * API/JSValueRef.cpp:
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JSWrapperMap.mm:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/LinkBuffer.cpp:
+        * bindings/ScriptFunctionCall.cpp:
+        * bindings/ScriptObject.cpp:
+        * bytecode/ArrayAllocationProfile.cpp:
+        * bytecode/ArrayProfile.cpp:
+        * bytecode/BytecodeBasicBlock.cpp:
+        * bytecode/CallLinkInfo.cpp:
+        * bytecode/CallLinkStatus.cpp:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlockJettisoningWatchpoint.cpp:
+        * bytecode/CodeOrigin.cpp:
+        * bytecode/ExecutionCounter.cpp:
+        * bytecode/GetByIdStatus.cpp:
+        * bytecode/LazyOperandValueProfile.cpp:
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        * bytecode/PreciseJumpTargets.cpp:
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        * bytecode/PutByIdStatus.cpp:
+        * bytecode/SamplingTool.cpp:
+        * bytecode/SpecialPointer.cpp:
+        * bytecode/SpeculatedType.cpp:
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        * bytecode/ValueRecovery.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/NodesCodegen.cpp:
+        * debugger/Debugger.cpp:
+        * debugger/DebuggerActivation.cpp:
+        * debugger/DebuggerCallFrame.cpp:
+        * dfg/DFGAbstractHeap.cpp:
+        * dfg/DFGAbstractValue.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGArithMode.cpp:
+        * dfg/DFGArrayMode.cpp:
+        * dfg/DFGAtTailAbstractState.cpp:
+        * dfg/DFGAvailability.cpp:
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        * dfg/DFGBasicBlock.cpp:
+        * dfg/DFGBinarySwitch.cpp:
+        * dfg/DFGBlockInsertionSet.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCFAPhase.cpp:
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGClobberSet.cpp:
+        * dfg/DFGClobberize.cpp:
+        * dfg/DFGCommon.cpp:
+        * dfg/DFGCommonData.cpp:
+        * dfg/DFGCompilationKey.cpp:
+        * dfg/DFGCompilationMode.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        * dfg/DFGDCEPhase.cpp:
+        * dfg/DFGDesiredIdentifiers.cpp:
+        * dfg/DFGDesiredStructureChains.cpp:
+        * dfg/DFGDesiredTransitions.cpp:
+        * dfg/DFGDesiredWatchpoints.cpp:
+        * dfg/DFGDesiredWeakReferences.cpp:
+        * dfg/DFGDesiredWriteBarriers.cpp:
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGDominators.cpp:
+        * dfg/DFGDriver.cpp:
+        * dfg/DFGEdge.cpp:
+        * dfg/DFGFailedFinalizer.cpp:
+        * dfg/DFGFinalizer.cpp:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGFlushFormat.cpp:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        * dfg/DFGFlushedAt.cpp:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraphSafepoint.cpp:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        * dfg/DFGJITCode.cpp:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITFinalizer.cpp:
+        * dfg/DFGJumpReplacement.cpp:
+        * dfg/DFGLICMPhase.cpp:
+        * dfg/DFGLazyJSValue.cpp:
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        * dfg/DFGLongLivedState.cpp:
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        * dfg/DFGMinifiedNode.cpp:
+        * dfg/DFGNaturalLoops.cpp:
+        * dfg/DFGNode.cpp:
+        * dfg/DFGNodeFlags.cpp:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExitBase.cpp:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        * dfg/DFGOSRExitJumpPlaceholder.cpp:
+        * dfg/DFGOSRExitPreparation.cpp:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhase.cpp:
+        * dfg/DFGPlan.cpp:
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGResurrectionForValidationPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        * dfg/DFGSSALoweringPhase.cpp:
+        * dfg/DFGSafepoint.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGStackLayoutPhase.cpp:
+        * dfg/DFGStoreBarrierElisionPhase.cpp:
+        * dfg/DFGStrengthReductionPhase.cpp:
+        * dfg/DFGThreadData.cpp:
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        * dfg/DFGUnificationPhase.cpp:
+        * dfg/DFGUseKind.cpp:
+        * dfg/DFGValidate.cpp:
+        * dfg/DFGValueSource.cpp:
+        * dfg/DFGVariableAccessDataDump.cpp:
+        * dfg/DFGVariableEvent.cpp:
+        * dfg/DFGVariableEventStream.cpp:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        * dfg/DFGWorklist.cpp:
+        * ftl/FTLAbstractHeap.cpp:
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLExitValue.cpp:
+        * ftl/FTLLink.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        * ftl/FTLOSREntry.cpp:
+        * ftl/FTLOSRExit.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+        * ftl/FTLSlowPathCall.cpp:
+        * heap/BlockAllocator.cpp:
+        * heap/CodeBlockSet.cpp:
+        * heap/ConservativeRoots.cpp:
+        * heap/CopiedSpace.cpp:
+        * heap/CopyVisitor.cpp:
+        * heap/DeferGC.cpp:
+        * heap/GCThread.cpp:
+        * heap/GCThreadSharedData.cpp:
+        * heap/HandleSet.cpp:
+        * heap/HandleStack.cpp:
+        * heap/Heap.cpp:
+        * heap/HeapStatistics.cpp:
+        * heap/HeapTimer.cpp:
+        * heap/IncrementalSweeper.cpp:
+        * heap/JITStubRoutineSet.cpp:
+        * heap/MachineStackMarker.cpp:
+        * heap/MarkStack.cpp:
+        * heap/MarkedAllocator.cpp:
+        * heap/MarkedBlock.cpp:
+        * heap/MarkedSpace.cpp:
+        * heap/SlotVisitor.cpp:
+        * heap/SuperRegion.cpp:
+        * heap/Weak.cpp:
+        * heap/WeakBlock.cpp:
+        * heap/WeakHandleOwner.cpp:
+        * heap/WeakSet.cpp:
+        * heap/WriteBarrierBuffer.cpp:
+        * heap/WriteBarrierSupport.cpp:
+        * inspector/InjectedScript.cpp:
+        * inspector/InjectedScriptBase.cpp:
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        * inspector/JSInjectedScriptHost.cpp:
+        * inspector/ScriptArguments.cpp:
+        * inspector/ScriptCallStackFactory.cpp:
+        * interpreter/AbstractPC.cpp:
+        * interpreter/CallFrame.cpp:
+        * interpreter/Interpreter.cpp:
+        * interpreter/JSStack.cpp:
+        * interpreter/ProtoCallFrame.cpp:
+        * interpreter/StackVisitor.cpp:
+        * interpreter/VMInspector.cpp:
+        * jit/ArityCheckFailReturnThunks.cpp:
+        * jit/AssemblyHelpers.cpp:
+        * jit/ClosureCallStubRoutine.cpp:
+        * jit/ExecutableAllocator.cpp:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/GCAwareJITStubRoutine.cpp:
+        * jit/HostCallReturnValue.cpp:
+        * jit/JIT.cpp:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITCode.cpp:
+        * jit/JITDisassembler.cpp:
+        * jit/JITExceptions.cpp:
+        * jit/JITInlineCacheGenerator.cpp:
+        * jit/JITInlines.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperationsMSVC64.cpp:
+        * jit/JITStubRoutine.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITThunks.cpp:
+        * jit/JITToDFGDeferredCompilationCallback.cpp:
+        * jit/RegisterPreservationWrapperGenerator.cpp:
+        * jit/RegisterSet.cpp:
+        * jit/Repatch.cpp:
+        * jit/TempRegisterSet.cpp:
+        * jit/ThunkGenerators.cpp:
+        * jsc.cpp:
+        * llint/LLIntExceptions.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LowLevelInterpreter.cpp:
+        * parser/Lexer.cpp:
+        * parser/Nodes.cpp:
+        * parser/Parser.cpp:
+        * parser/ParserArena.cpp:
+        * parser/SourceCode.cpp:
+        * parser/SourceProvider.cpp:
+        * parser/SourceProviderCache.cpp:
+        * profiler/LegacyProfiler.cpp:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/ProfilerBytecode.cpp:
+        * profiler/ProfilerBytecodeSequence.cpp:
+        * profiler/ProfilerBytecodes.cpp:
+        * profiler/ProfilerCompilation.cpp:
+        * profiler/ProfilerCompiledBytecode.cpp:
+        * profiler/ProfilerDatabase.cpp:
+        * profiler/ProfilerOSRExit.cpp:
+        * profiler/ProfilerOSRExitSite.cpp:
+        * profiler/ProfilerOrigin.cpp:
+        * profiler/ProfilerOriginStack.cpp:
+        * profiler/ProfilerProfiledBytecodes.cpp:
+        * runtime/ArgList.cpp:
+        * runtime/Arguments.cpp:
+        * runtime/ArgumentsIteratorPrototype.cpp:
+        * runtime/ArrayBuffer.cpp:
+        * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanObject.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/CallData.cpp:
+        * runtime/CodeCache.cpp:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CommonSlowPathsExceptions.cpp:
+        * runtime/Completion.cpp:
+        * runtime/ConstructData.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/DateInstance.cpp:
+        * runtime/DatePrototype.cpp:
+        * runtime/Error.cpp:
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorPrototype.cpp:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/Executable.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/GetterSetter.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/IntendedStructureChain.cpp:
+        * runtime/InternalFunction.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSArgumentsIterator.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSArrayBuffer.cpp:
+        * runtime/JSArrayBufferConstructor.cpp:
+        * runtime/JSArrayBufferPrototype.cpp:
+        * runtime/JSArrayBufferView.cpp:
+        * runtime/JSBoundFunction.cpp:
+        * runtime/JSCInlines.h: Copied from Source/JavaScriptCore/runtime/Operations.h.
+        * runtime/JSCell.cpp:
+        * runtime/JSDataView.cpp:
+        * runtime/JSDataViewPrototype.cpp:
+        * runtime/JSDateMath.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSLock.cpp:
+        * runtime/JSNameScope.cpp:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSONObject.cpp:
+        * runtime/JSObject.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSProxy.cpp:
+        * runtime/JSScope.cpp:
+        * runtime/JSSegmentedVariableObject.cpp:
+        * runtime/JSString.cpp:
+        * runtime/JSStringJoiner.cpp:
+        * runtime/JSSymbolTableObject.cpp:
+        * runtime/JSTypedArrayConstructors.cpp:
+        * runtime/JSTypedArrayPrototypes.cpp:
+        * runtime/JSTypedArrays.cpp:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSWithScope.cpp:
+        * runtime/JSWrapperObject.cpp:
+        * runtime/LiteralParser.cpp:
+        * runtime/Lookup.cpp:
+        * runtime/MathObject.cpp:
+        * runtime/NameConstructor.cpp:
+        * runtime/NameInstance.cpp:
+        * runtime/NamePrototype.cpp:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorPrototype.cpp:
+        * runtime/NumberConstructor.cpp:
+        * runtime/NumberObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/Operations.cpp:
+        * runtime/Operations.h:
+        * runtime/PropertyDescriptor.cpp:
+        * runtime/PrototypeMap.cpp:
+        * runtime/RegExp.cpp:
+        * runtime/RegExpCache.cpp:
+        * runtime/RegExpCachedResult.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpMatchesArray.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/SimpleTypedArrayController.cpp:
+        * runtime/SmallStrings.cpp:
+        * runtime/SparseArrayValueMap.cpp:
+        * runtime/StrictEvalActivation.cpp:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/StringPrototype.cpp:
+        * runtime/StringRecursionChecker.cpp:
+        * runtime/Structure.cpp:
+        * runtime/StructureChain.cpp:
+        * runtime/StructureRareData.cpp:
+        * runtime/SymbolTable.cpp:
+        * runtime/TestRunnerUtils.cpp:
+        * runtime/VM.cpp:
+        * testRegExp.cpp:
+
+2014-02-10  Matthew Mirman  <mmirman@apple.com>
+
+        Removes the inline assert from SpeculativeJIT's ReallocatePropertyStorage
+        https://bugs.webkit.org/show_bug.cgi?id=128566
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+
+2014-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename getRecordMap to computeRecordMap.
+
+        Rubber stamped by Michael Saboff.
+        
+        "get" is such a weird prefix. It implies a getter. We don't prefix our getters with
+        anything in WebKit. Also, this isn't a getter. It actually does work to transform
+        the stackmaps into a hashmap. So, computeRecordMap is a much better name.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::computeRecordMap):
+        * ftl/FTLStackMaps.h:
+
+2014-02-10  Matthew Mirman  <mmirman@apple.com>
+
+        ReallocatePropertyStorage in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=128352
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileReallocatePropertyStorage):
+        * tests/stress/ftl-reallocatepropertystorage.js: Added.
+        (foo):
+
+2014-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Fail FTL compilation if the required stack is too big
+        https://bugs.webkit.org/show_bug.cgi?id=128560
+
+        Reviewed by Filip Pizlo.
+
+        Added StackSize struct to FTLStackMaps and populated it.  Added and updated
+        related dump functions.  Use the stack size found at the end of the compilation
+        to compare against the value of a new option, llvmMaxStackSize.  We fail the
+        compile if the function's stack size is greater than llvmMaxStackSize.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::StackSize::parse):
+        (JSC::FTL::StackMaps::StackSize::dump):
+        (JSC::FTL::StackMaps::parse):
+        (JSC::FTL::StackMaps::dump):
+        (JSC::FTL::StackMaps::dumpMultiline):
+        (JSC::FTL::StackMaps::getStackSize):
+        * ftl/FTLStackMaps.h:
+        * runtime/Options.h:
+
+2014-02-10  Mark Lam  <mark.lam@apple.com>
+
+        Change JSLock::dropAllLocks() and friends to use lock() and unlock().
+        <https://webkit.org/b/128451>
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, JSLock's dropAllLocks(), dropAllLocksUnconditionally(), and
+        grabAllLocks() implement locking / unlocking by duplicating the code from
+        lock() and unlock(). Instead, they should just call lock() and unlock().
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        - Modified lock() and unlock() into a version that takes an entry count
+          to lock / unlock. The previous lock() and unlock() now calls these
+          new versions with an entry count of 1.
+
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        (JSC::JSLock::grabAllLocks):
+        - Delegate to unlock() and lock() instead of duplicating the lock / unlock
+          code.
+        - There a some differences with calling lock() instead of duplicating its
+          code in grabAllLock() i.e. lock() does the following additional work:
+
+          1. lock() does a re-entry check that is not needed by grabAllLocks().
+             However, this is effectively a no-op since we never own the JSLock
+             before calling grabAllLocks().
+
+          2. set VM stackPointerAtVMEntry.
+          3. update VM stackLimit and reservedZoneSize.
+          4. set VM lastStackTop.
+             These 3 steps are just busy work which are also effective no-ops
+             because immediately after lock() returns, grabAllLocks() will write
+             over those values with their saved versions in the threadData.
+
+        * runtime/JSLock.h:
+
+2014-02-10  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * heap/UnconditionalFinalizer.h:
+        * runtime/SymbolTable.h:
+
+2014-02-10  Andreas Kling  <akling@apple.com>
+
+        Make the Identifier::add() family return PassRef<StringImpl>.
+        <https://webkit.org/b/128542>
+
+        This knocks one branch off of creating an Identifier from another
+        string source.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::add8):
+        (JSC::Identifier::addSlowCase):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+
+2014-02-09  Mark Lam  <mark.lam@apple.com>
+
+        Remove unnecessary spinLock in JSLock.
+        <https://webkit.org/b/128450>
+
+        Reviewed by Filip Pizlo.
+
+        The JSLock's mutex already provides protection for write access to
+        JSLock's internal state. The only JSLock state that needs to be read
+        from any thread including threads that don't own the JSLock is
+        m_ownerThread, which is used in currentThreadIsHoldingLock() to do an
+        ownership test on the lock.
+
+        It is safe for other threads to read from m_ownerThread because they
+        only need to know whether its value matches their own thread id
+        (provided by WTF::currentThread()).
+
+        Here are the scenarios for how the ownership test can go:
+
+        1. The JSLock has just been initialized and is not owned by any thread.
+
+           In this case, m_ownerThread will be 0 and will not match any thread's
+           thread id. The checking thread will know that it needs to lock the
+           JSLock before using the VM.
+
+        2. The JSLock was previously locked, but now is unlocked.
+
+           When we unlock it in JSLock::unlock(), the owner thread clears
+           m_ownerThread to 0. Hence, this case is the same as (1) above.
+
+        3. The JSLock is locked by Thread A. Thread B is checking ownership.
+
+           In this case, m_ownerThread will contains the Thread A's thread id.
+           Thread B will see that the thread id does not match its own and will
+           proceed to block on the JSLock's mutex to wait for its turn to use
+           the VM.
+
+           With Weak Memory Ordering architectures, Thread A's thread id may
+           not get written out to memory before Thread B inspects m_ownerThread.
+           However, though Thread B may not see Thread A's thread id in
+           m_ownerThread, it will see 0 which is the last value written to it
+           before the JSLock mutex was unlocked. The mutex unlock would have
+           executed a memory fence which would have flushed the 0 to
+           m_ownerThread in memory. Hence, Thread B will know that it does not
+           own the lock.
+
+        Apart from removing the unneeded spin lock code, I also changed the
+        JSLock code to use currentThreadIsHoldingLock() and setOwnerThread()
+        instead of accessing m_ownerThread directly.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::JSLock):
+
+        (JSC::JSLock::lock):
+        - Removed spinLock but left the indentation as is to keep the diff to a
+          minimum for better readability. Will unindent in a subsequent patch.
+
+        (JSC::JSLock::unlock):
+        - Before unlocking the mutex, clear m_ownerThread to indicate that the
+          lock is no longer owned.
+
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        - Removed the check of m_lockCount for determining ownership. Checking
+          m_ownerThread is sufficient.
+
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        - Renamed local locksToDrop to the better name droppedLockCount.
+        - Clear m_ownerThread since we're unlocking the JSLock.
+
+        (JSC::JSLock::grabAllLocks):
+        - Removed unneeded lock ownership test for lock re-entry case because
+          grabAllLocks() is never used to re-enter a locked JSLock.
+
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+
+        * runtime/JSLock.h:
+        (JSC::JSLock::setOwnerThread):
+
+2014-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/163796
+
+        The change was not justified in any way and it has a net negative effect on the code.
+
+        * dfg/DFGAbstractInterpreter.h:
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGAdjacencyList.h:
+        * dfg/DFGArgumentPosition.h:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGArrayMode.cpp:
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGAtTailAbstractState.h:
+        * dfg/DFGAvailability.h:
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGBasicBlockInlines.h:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCFAPhase.cpp:
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGClobberize.h:
+        * dfg/DFGCommonData.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        * dfg/DFGDCEPhase.cpp:
+        * dfg/DFGDominators.h:
+        * dfg/DFGDriver.cpp:
+        * dfg/DFGDriver.h:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        * dfg/DFGGenerationInfo.h:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        * dfg/DFGInPlaceAbstractState.h:
+        * dfg/DFGInlineCacheWrapperInlines.h:
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGJITFinalizer.cpp:
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGLICMPhase.cpp:
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        * dfg/DFGMinifiedNode.h:
+        * dfg/DFGNaturalLoops.h:
+        * dfg/DFGNode.cpp:
+        * dfg/DFGNode.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitBase.cpp:
+        * dfg/DFGOSRExitCompilationInfo.h:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGOSRExitJumpPlaceholder.cpp:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhase.h:
+        * dfg/DFGPlan.h:
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGResurrectionForValidationPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        * dfg/DFGSSALoweringPhase.cpp:
+        * dfg/DFGSaneStringGetByValSlowPathGenerator.h:
+        * dfg/DFGSlowPathGenerator.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGStackLayoutPhase.cpp:
+        * dfg/DFGStoreBarrierElisionPhase.cpp:
+        * dfg/DFGStrengthReductionPhase.cpp:
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        * dfg/DFGUnificationPhase.cpp:
+        * dfg/DFGValidate.h:
+        * dfg/DFGValueSource.h:
+        * dfg/DFGVariableAccessData.h:
+        * dfg/DFGVariableAccessDataDump.cpp:
+        * dfg/DFGVariableEvent.h:
+        * dfg/DFGVariableEventStream.h:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        * dfg/DFGWorklist.cpp:
+
+2014-02-10  Peter Molnar  <pmolnar.u-szeged@partner.samsung.com> 
+ 
+        Remove extra includes from DFG 
+        https://bugs.webkit.org/show_bug.cgi?id=126983 
+ 
+        Reviewed by Andreas Kling. 
+
+        * dfg/DFGAbstractInterpreter.h:
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGAdjacencyList.h:
+        * dfg/DFGArgumentPosition.h:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGArrayMode.cpp:
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGAtTailAbstractState.h:
+        * dfg/DFGAvailability.h:
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGBasicBlockInlines.h:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCFAPhase.cpp:
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGClobberize.h:
+        * dfg/DFGCommonData.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        * dfg/DFGDCEPhase.cpp:
+        * dfg/DFGDominators.h:
+        * dfg/DFGDriver.cpp:
+        * dfg/DFGDriver.h:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        * dfg/DFGGenerationInfo.h:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        * dfg/DFGInPlaceAbstractState.h:
+        * dfg/DFGInlineCacheWrapperInlines.h:
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGJITFinalizer.cpp:
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGLICMPhase.cpp:
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        * dfg/DFGMinifiedNode.h:
+        * dfg/DFGNaturalLoops.h:
+        * dfg/DFGNode.cpp:
+        * dfg/DFGNode.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitBase.cpp:
+        * dfg/DFGOSRExitCompilationInfo.h:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGOSRExitJumpPlaceholder.cpp:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhase.h:
+        * dfg/DFGPlan.h:
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGResurrectionForValidationPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        * dfg/DFGSSALoweringPhase.cpp:
+        * dfg/DFGSaneStringGetByValSlowPathGenerator.h:
+        * dfg/DFGSlowPathGenerator.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGStackLayoutPhase.cpp:
+        * dfg/DFGStoreBarrierElisionPhase.cpp:
+        * dfg/DFGStrengthReductionPhase.cpp:
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        * dfg/DFGUnificationPhase.cpp:
+        * dfg/DFGValidate.h:
+        * dfg/DFGValueSource.h:
+        * dfg/DFGVariableAccessData.h:
+        * dfg/DFGVariableAccessDataDump.cpp:
+        * dfg/DFGVariableEvent.h:
+        * dfg/DFGVariableEventStream.h:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        * dfg/DFGWorklist.cpp:
+
+2014-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC environment variables should override other mechanisms for setting options
+        https://bugs.webkit.org/show_bug.cgi?id=128511
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/Options.cpp:
+        (JSC::Options::setOption):
+        * runtime/Options.h:
+
+2014-02-10  Darin Adler  <darin@apple.com>
+
+        Stop using String::deprecatedCharacters to call WTF::Collator
+        https://bugs.webkit.org/show_bug.cgi?id=128517
+
+        Reviewed by Alexey Proskuryakov.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncLocaleCompare): Use the default constructor for Collator, which now
+        gives the default locale collation rules. Use the new arguments for Collator::collate, which
+        are now StringView. These two changes together eliminate the need for a separate helper function.
+
+2014-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        <1/100 probability FTL failure: v8-v6/v8-deltablue.js.ftl-eager: Exception: TypeError: undefined is not an object (evaluating 'c.isInput')
+        https://bugs.webkit.org/show_bug.cgi?id=128278
+
+        Reviewed by Mark Hahnenberg.
+        
+        Fix another FTL flake due to bytecode liveness corner cases. Hopefully it's the last
+        one.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Make sure that inside a constructor, the 'this' result is always set. This makes it easier to unify the treatment of 'this' for OSR exit: we just say that it's always live.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isLiveInBytecode): Assume that 'this' is live. We were already sort of doing this for calls because the callsite would claim it to be live. But we didn't do it for constructors. It's true that *at the callsite* 'this' won't be live, but inside the inlined constructor, it almost certainly will be.
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run): I just noticed this benign bug. We should only return 'true' if we actually injected checks.
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub): Make it easier to just dump disassembly for FTL OSR exits.
+        * runtime/Options.h: Ditto.
+        * tests/stress/inlined-constructor-this-liveness.js: Added.
+        (Foo):
+        (foo):
+        * tests/stress/inlined-function-this-liveness.js: Added.
+        (bar):
+        (foo):
+
+2014-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Actually register those DFG::Safepoints
+        https://bugs.webkit.org/show_bug.cgi?id=128521
+
+        Reviewed by Mark Hahnenberg.
+        
+        No test because GC + thread + JIT = ???.
+
+        * dfg/DFGSafepoint.cpp:
+        (JSC::DFG::Safepoint::~Safepoint):
+        (JSC::DFG::Safepoint::begin):
+
+2014-02-10  Peter Molnar  <pmolnar.u-szeged@partner.samsung.com>
+
+        Fix EFL build with INSPECTOR disabled
+        https://bugs.webkit.org/show_bug.cgi?id=125064
+
+        Reviewed by Csaba Osztrogonác.
+
+        * inspector/InjectedScriptManager.h:
+        * inspector/ScriptDebugServer.cpp:
+        * inspector/agents/InspectorAgent.h:
+        * inspector/scripts/CodeGeneratorInspectorStrings.py:
+        (Inspector):
+
+2014-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        GC blocks on FTL and then badness
+        https://bugs.webkit.org/show_bug.cgi?id=128291
+
+        Reviewed by Oliver Hunt.
+        
+        Introduce the notion of a DFG::Safepoint, which allows you to unlock the rightToRun
+        mutex for your JIT thread, while supplying the GC with all of the information it would
+        need to scan you at that moment in time. The default way of using this is
+        DFG::GraphSafepoint, where you just supply the Graph. There's a lot of machinery in
+        this patch just to make the Graph scannable.
+        
+        We then use DFG::GraphSafepoint in just two places for now: (1) while initializing LLVM
+        and (2) while invoking LLVM' optimizer and backend.
+        
+        This is a 30% speed-up on Octane/typescript and a 10% speed-up on Octane/gbemu. 2-3%
+        speed-up overall on Octane.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::visitChildren):
+        * dfg/DFGGraph.h:
+        * dfg/DFGGraphSafepoint.cpp: Added.
+        (JSC::DFG::GraphSafepoint::GraphSafepoint):
+        (JSC::DFG::GraphSafepoint::~GraphSafepoint):
+        * dfg/DFGGraphSafepoint.h: Added.
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSafepoint.cpp: Added.
+        (JSC::DFG::Safepoint::Safepoint):
+        (JSC::DFG::Safepoint::~Safepoint):
+        (JSC::DFG::Safepoint::add):
+        (JSC::DFG::Safepoint::begin):
+        (JSC::DFG::Safepoint::visitChildren):
+        * dfg/DFGSafepoint.h: Added.
+        * dfg/DFGScannable.h: Added.
+        (JSC::DFG::Scannable::Scannable):
+        (JSC::DFG::Scannable::~Scannable):
+        * dfg/DFGThreadData.cpp: Added.
+        (JSC::DFG::ThreadData::ThreadData):
+        (JSC::DFG::ThreadData::~ThreadData):
+        * dfg/DFGThreadData.h: Added.
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::finishCreation):
+        (JSC::DFG::Worklist::visitChildren):
+        (JSC::DFG::Worklist::runThread):
+        * dfg/DFGWorklist.h:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyPointer):
+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyValue):
+
+2014-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Never include *Inlines.h files in interface headers, and never include *Inlines.h when you could include Operations.h instead
+        https://bugs.webkit.org/show_bug.cgi?id=128505
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+
+        * API/JSContextRef.cpp:
+        * assembler/LinkBuffer.cpp:
+        * bytecode/ArrayProfile.cpp:
+        * bytecode/BytecodeBasicBlock.cpp:
+        * bytecode/BytecodeLivenessAnalysisInlines.h:
+        * bytecode/CallLinkInfo.cpp:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeBlockJettisoningWatchpoint.cpp:
+        * bytecode/ExecutionCounter.cpp:
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        * bytecode/PreciseJumpTargets.cpp:
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        * bytecode/SamplingTool.cpp:
+        * bytecode/SpecialPointer.cpp:
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        * debugger/DebuggerCallFrame.cpp:
+        * dfg/DFGAbstractHeap.cpp:
+        * dfg/DFGAbstractValue.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGArithMode.cpp:
+        * dfg/DFGArrayMode.cpp:
+        * dfg/DFGAtTailAbstractState.cpp:
+        * dfg/DFGAvailability.cpp:
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        * dfg/DFGBasicBlock.cpp:
+        * dfg/DFGBinarySwitch.cpp:
+        * dfg/DFGBlockInsertionSet.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGCFAPhase.cpp:
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGClobberSet.cpp:
+        * dfg/DFGClobberize.cpp:
+        * dfg/DFGCommon.cpp:
+        * dfg/DFGCommonData.cpp:
+        * dfg/DFGCompilationKey.cpp:
+        * dfg/DFGCompilationMode.cpp:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        * dfg/DFGDCEPhase.cpp:
+        * dfg/DFGDesiredIdentifiers.cpp:
+        * dfg/DFGDesiredStructureChains.cpp:
+        * dfg/DFGDesiredTransitions.cpp:
+        * dfg/DFGDesiredWatchpoints.cpp:
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGDisassembler.h:
+        * dfg/DFGDominators.cpp:
+        * dfg/DFGEdge.cpp:
+        * dfg/DFGFailedFinalizer.cpp:
+        * dfg/DFGFinalizer.cpp:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGFlushFormat.cpp:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        * dfg/DFGFlushedAt.cpp:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        * dfg/DFGJITCode.cpp:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGJITFinalizer.cpp:
+        * dfg/DFGJumpReplacement.cpp:
+        * dfg/DFGLICMPhase.cpp:
+        * dfg/DFGLazyJSValue.cpp:
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        * dfg/DFGLongLivedState.cpp:
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        * dfg/DFGMinifiedNode.cpp:
+        * dfg/DFGNaturalLoops.cpp:
+        * dfg/DFGNode.cpp:
+        * dfg/DFGNodeFlags.cpp:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        * dfg/DFGOSREntry.cpp:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExitBase.cpp:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        * dfg/DFGOSRExitCompiler64.cpp:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        * dfg/DFGOSRExitJumpPlaceholder.cpp:
+        * dfg/DFGOSRExitPreparation.cpp:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPhase.cpp:
+        * dfg/DFGPlan.cpp:
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGResurrectionForValidationPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        * dfg/DFGSSALoweringPhase.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGStackLayoutPhase.cpp:
+        * dfg/DFGStoreBarrierElisionPhase.cpp:
+        * dfg/DFGStrengthReductionPhase.cpp:
+        * dfg/DFGThunks.cpp:
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        * dfg/DFGUnificationPhase.cpp:
+        * dfg/DFGUseKind.cpp:
+        * dfg/DFGValidate.cpp:
+        * dfg/DFGValueSource.cpp:
+        * dfg/DFGVariableAccessDataDump.cpp:
+        * dfg/DFGVariableEvent.cpp:
+        * dfg/DFGVariableEventStream.cpp:
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        * dfg/DFGWorklist.cpp:
+        * disassembler/Disassembler.cpp:
+        * ftl/FTLLink.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+        * ftl/FTLSlowPathCall.cpp:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::slowPathCallThunkGenerator):
+        * heap/BlockAllocator.cpp:
+        * heap/CodeBlockSet.cpp:
+        * heap/ConservativeRoots.cpp:
+        * heap/DeferGC.cpp:
+        * heap/GCThread.cpp:
+        * heap/GCThreadSharedData.cpp:
+        * heap/HeapTimer.cpp:
+        * heap/IncrementalSweeper.cpp:
+        * heap/JITStubRoutineSet.cpp:
+        * heap/MachineStackMarker.cpp:
+        * heap/MarkStack.cpp:
+        * heap/MarkedAllocator.cpp:
+        * heap/MarkedSpace.cpp:
+        * heap/SuperRegion.cpp:
+        * heap/Weak.cpp:
+        * heap/WeakHandleOwner.cpp:
+        * heap/WeakSet.cpp:
+        * heap/WriteBarrierBuffer.cpp:
+        * heap/WriteBarrierSupport.cpp:
+        * inspector/ScriptCallStackFactory.cpp:
+        * interpreter/AbstractPC.cpp:
+        * interpreter/JSStack.cpp:
+        * interpreter/ProtoCallFrame.cpp:
+        * interpreter/VMInspector.cpp:
+        * jit/ArityCheckFailReturnThunks.cpp:
+        * jit/AssemblyHelpers.cpp:
+        * jit/ExecutableAllocator.cpp:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/GCAwareJITStubRoutine.cpp:
+        * jit/HostCallReturnValue.cpp:
+        * jit/JITDisassembler.cpp:
+        * jit/JITDisassembler.h:
+        * jit/JITExceptions.cpp:
+        * jit/JITInlines.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperationsMSVC64.cpp:
+        * jit/JITStubRoutine.cpp:
+        * jit/JITStubs.cpp:
+        * jit/JITToDFGDeferredCompilationCallback.cpp:
+        * jit/RegisterPreservationWrapperGenerator.cpp:
+        * jit/RegisterSet.cpp:
+        * jit/Repatch.cpp:
+        * jit/TempRegisterSet.cpp:
+        * jsc.cpp:
+        * parser/Lexer.cpp:
+        * parser/Parser.cpp:
+        * parser/ParserArena.cpp:
+        * parser/SourceCode.cpp:
+        * parser/SourceProvider.cpp:
+        * parser/SourceProviderCache.cpp:
+        * profiler/ProfileGenerator.cpp:
+        * runtime/Arguments.cpp:
+        * runtime/ArgumentsIteratorPrototype.cpp:
+        * runtime/CommonSlowPathsExceptions.cpp:
+        * runtime/JSArgumentsIterator.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/Operations.h:
+        * runtime/VM.cpp:
+
+2014-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, don't mark isHostFunction() inline in the header file because that really confuses EFL.
+
+        * runtime/JSFunction.h:
+
+2014-02-09  Anders Carlsson  <andersca@apple.com>
+
+        Add WTF_MAKE_FAST_ALLOCATED to more classes
+        https://bugs.webkit.org/show_bug.cgi?id=128506
+
+        Reviewed by Andreas Kling.
+
+        * bytecode/UnlinkedInstructionStream.h:
+        * runtime/SymbolTable.h:
+        * runtime/WriteBarrier.h:
+
+2014-02-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API NSDate conversion is off by 1000x (ms vs s)
+        https://bugs.webkit.org/show_bug.cgi?id=128386
+
+        Reviewed by Michael Saboff.
+
+        * API/JSValue.mm:
+        (valueToObjectWithoutCopy):
+        (valueToDate):
+        (objectToValueWithoutCopy):
+        * API/tests/DateTests.h: Added.
+        * API/tests/DateTests.mm: Added.
+        (+[DateTests NSDateToJSDateTest]):
+        (+[DateTests JSDateToNSDateTest]):
+        (+[DateTests roundTripThroughJSDateTest]):
+        (+[DateTests roundTripThroughObjCDateTest]):
+        * API/tests/testapi.mm:
+        (checkResult):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-02-09  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of ExecState to JSCell::fastGetOwnProperty().
+        <https://webkit.org/b/128497>
+
+        Knocks off a couple of instructions.
+
+        Reviewed by Anders Carlsson.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::fastGetOwnProperty):
+
+2014-02-09  Anders Carlsson  <andersca@apple.com>
+
+        Convert some JSC code over to std::mutex
+        https://bugs.webkit.org/show_bug.cgi?id=128500
+
+        Reviewed by Dan Bernstein.
+
+        * API/JSVirtualMachine.mm:
+        (wrapperCacheMutex):
+        (+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]):
+        (+[JSVMWrapperCache wrapperForJSContextGroupRef:]):
+        * heap/GCThreadSharedData.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::containsOpaqueRootTriState):
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::registerDebuggable):
+        (Inspector::RemoteInspector::unregisterDebuggable):
+        (Inspector::RemoteInspector::updateDebuggable):
+        (Inspector::RemoteInspector::sendMessageToRemoteFrontend):
+        (Inspector::RemoteInspector::start):
+        (Inspector::RemoteInspector::stop):
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        (Inspector::RemoteInspector::pushListingSoon):
+        (Inspector::RemoteInspector::receivedIndicateMessage):
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        (Inspector::RemoteInspectorDebuggableConnection::closeFromDebuggable):
+        (Inspector::RemoteInspectorDebuggableConnection::close):
+        (Inspector::RemoteInspectorDebuggableConnection::sendMessageToBackend):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::~DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators):
+        (JSC::DemandExecutableAllocator::bytesCommittedByAllocactors):
+        (JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators):
+        (JSC::DemandExecutableAllocator::allocatorsMutex):
+
+2014-02-09  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r163737.
+        http://trac.webkit.org/changeset/163737
+        https://bugs.webkit.org/show_bug.cgi?id=128491
+
+        Caused 8+ tests to fail on Mavericks and Mountain Lion bots
+        (Requested by rniwa on #webkit).
+
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsSubstring8):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        (JSC::SmallStrings::SmallStrings):
+
+2014-02-08  Anders Carlsson  <andersca@apple.com>
+
+        Simplify single character substrings in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=128483
+
+        Reviewed by Andreas Kling.
+
+        With the recent work to make StringImpl occupy less space, it is actually more
+        efficient to allocate a single character string that it is to use createSubstringSharingImpl!
+        
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsSubstring8):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        (JSC::SmallStrings::SmallStrings):
+
+2014-02-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Baseline JIT uses the wrong version of checkMarkWord in emitWriteBarrier
+        https://bugs.webkit.org/show_bug.cgi?id=128474
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+
+2014-02-08  Mark Lam  <mark.lam@apple.com>
+
+        Rename a field and some variables in JSLock to better describe what they contain.
+        <https://webkit.org/b/128475>
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        (JSC::JSLock::grabAllLocks):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+
+2014-02-08  Anders Carlsson  <andersca@apple.com>
+
+        Stop using getCharactersWithUpconvert in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=128457
+
+        Reviewed by Andreas Kling.
+
+        Change substituteBackreferencesSlow to take StringViews and use a StringBuilder instead of upconverting
+        if the source or replacement strings area 16-bit.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferences):
+
+2014-02-08  Mark Rowe  <mrowe@apple.com>
+
+        <https://webkit.org/b/128452> Don't duplicate the list of input files for postprocess-headers.sh
+
+        Reviewed by Dan Bernstein.
+
+        * postprocess-headers.sh: Pull the list of headers to process out of the environment.
+
+2014-02-08  Mark Rowe  <mrowe@apple.com>
+
+        Fix the iOS build.
+
+        * API/WebKitAvailability.h: Skip the workarounds specific to OS X when we're building for iOS.
+
+2014-02-07  Mark Rowe  <mrowe@apple.com>
+
+        <https://webkit.org/b/128448> Fix use of availability macros on recently-added APIs
+
+        Reviewed by Dan Bernstein.
+
+        * API/JSContext.h: Remove some #ifs.
+        * API/JSManagedValue.h: Ditto.
+        * API/WebKitAvailability.h: #define the macros that availability macros mentioning
+        newer OS X versions would expand to when building on older OS versions.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Call the new postprocess-headers.sh.
+        * postprocess-headers.sh: Extracted from the Xcode project. Updated to remove content
+        from headers based on the __MAC_OS_X_VERSION_MIN_REQUIRED macro, and to
+        process WebKitAvailability.h.
+
+2014-02-07  Mark Lam  <mark.lam@apple.com>
+
+        JSLock should not "restore" VM stack values if it did not re-grab locks.
+        <https://webkit.org/b/128447>
+
+        Reviewed by Geoffrey Garen.
+
+        In the existing code, if DropAllLocks is instantiate with DontAlwaysDropLocks
+        in a thread that does not own the JSLock, then a bug will manifest where:
+
+        1. The DropAllLocks constructor will save the VM's stackPointerAtEntry,
+           lastStackTop, and reservedZoneSize even though it will not drop the JSLock.
+        2. The DropAllLocks destructor will restore those 3 values to the VM even
+           though the JSLock will not grab its internal lock.
+
+        The former only causes busy work but does not impact correctness. The latter
+        however, will corrupt those 3 VM values which belong to the thread that
+        actually owns the JSLock.
+
+        The fix is to only save the values when the JSLock will actually drop its
+        internal lock, and only restore the values if it did re-grab the internal lock.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        (JSC::JSLock::grabAllLocks):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        - Moved the saving of VM stack values to dropAllLocks() and
+          dropAllLocksUnconditionally().
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        - Moved the restoring of VM stack values to grabAllLocks().
+
+2014-02-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't throw away code if there is code on the worklists
+        https://bugs.webkit.org/show_bug.cgi?id=128443
+
+        Reviewed by Joseph Pecoraro.
+        
+        If we throw away compiled code and there is code currently being JITed then the JIT
+        will get confused after it resumes: it will see a code block that had claimed to belong
+        to an executable except that it doesn't belong to any executables anymore.
+
+        * dfg/DFGWorklist.h:
+        (JSC::DFG::Worklist::isActive):
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode):
+
+2014-02-07  Filip Pizlo  <fpizlo@apple.com>
+
+        GC should safepoint the DFG worklist in a smarter way rather than just waiting for everything to complete
+        https://bugs.webkit.org/show_bug.cgi?id=128297
+
+        Reviewed by Oliver Hunt.
+        
+        This makes DFG worklist threads have a rightToRun lock that gives them the ability to
+        be safepointed by the GC in much the same way as you'd expect from a fully
+        multithreaded VM.
+        
+        The idea is that the worklist threads's roots are the DFG::Plan. They only touch those
+        roots when holding the rightToRun lock. They currently grab that lock to run the
+        compiler, but relinquish it when accessing - and waiting on - the worklist.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlockSet::mark):
+        * dfg/DFGCompilationKey.cpp:
+        (JSC::DFG::CompilationKey::visitChildren):
+        * dfg/DFGCompilationKey.h:
+        * dfg/DFGDesiredStructureChains.cpp:
+        (JSC::DFG::DesiredStructureChains::visitChildren):
+        * dfg/DFGDesiredStructureChains.h:
+        * dfg/DFGDesiredTransitions.cpp:
+        (JSC::DFG::DesiredTransition::visitChildren):
+        (JSC::DFG::DesiredTransitions::visitChildren):
+        * dfg/DFGDesiredTransitions.h:
+        * dfg/DFGDesiredWeakReferences.cpp:
+        (JSC::DFG::DesiredWeakReferences::visitChildren):
+        * dfg/DFGDesiredWeakReferences.h:
+        * dfg/DFGDesiredWriteBarriers.cpp:
+        (JSC::DFG::DesiredWriteBarrier::visitChildren):
+        (JSC::DFG::DesiredWriteBarriers::visitChildren):
+        * dfg/DFGDesiredWriteBarriers.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::visitChildren):
+        * dfg/DFGPlan.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::~Worklist):
+        (JSC::DFG::Worklist::finishCreation):
+        (JSC::DFG::Worklist::suspendAllThreads):
+        (JSC::DFG::Worklist::resumeAllThreads):
+        (JSC::DFG::Worklist::visitChildren):
+        (JSC::DFG::Worklist::runThread):
+        (JSC::DFG::Worklist::threadFunction):
+        * dfg/DFGWorklist.h:
+        (JSC::DFG::numberOfWorklists):
+        (JSC::DFG::worklistForIndexOrNull):
+        * heap/CodeBlockSet.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collect):
+        * runtime/IntendedStructureChain.cpp:
+        (JSC::IntendedStructureChain::visitChildren):
+        * runtime/IntendedStructureChain.h:
+        * runtime/VM.cpp:
+        (JSC::VM::~VM):
+        (JSC::VM::prepareToDiscardCode):
+
+2014-02-07  Mark Lam  <mark.lam@apple.com>
+
+        Unify JSLock implementation for iOS and non-iOS ports.
+        <https://webkit.org/b/128409>
+
+        Reviewed by Michael Saboff.
+
+        The iOS and non-iOS implementations of dropAllLocks(),
+        dropAllLocksUnconditionally(), and grabAllLocks() effectively do the
+        same work. The main difference is that the iOS implementation acquires
+        the JSLock spin lock in the DropAllLocks class while the other ports
+        acquire it when it calls JSLock::lock() and unlock().
+
+        The other difference is that the iOS implementation will only increment
+        m_locksDropDepth if it actually drops locks, whereas other ports will
+        increment it unconditionally. Analogously, iOS decrements the depth only
+        when needed while other ports will decrement it unconditionally when
+        re-grabbing locks.
+
+        We can unify the 2 implementations by having both use the iOS
+        implementation for a start.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        (JSC::JSLock::grabAllLocks):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+
+2014-02-06  Filip Pizlo  <fpizlo@apple.com>
+
+        More FTL build scaffolding
+        https://bugs.webkit.org/show_bug.cgi?id=128330
+
+        Reviewed by Geoffrey Garen.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * llvm/library/LLVMAnchor.cpp:
+
+2014-02-07  Mark Lam  <mark.lam@apple.com>
+
+        iOS port needs to clear VM::stackPointerAtVMEntry when it drops locks.
+        <https://webkit.org/b/128424>
+
+        Reviewed by Geoffrey Garen.
+
+        The iOS code path for dropping locks differ from the non-iOS code path
+        in that it (iOS) does not clear m_vm->stackPointerAtVMEntry nor reset the
+        VM stack limit. This is now fixed by copying that snippit from
+        JSLock::unlock().
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+
+2014-02-07  Mark Lam  <mark.lam@apple.com>
+
+        Removed superflous JSLock::entryStackPointer field.
+        <https://webkit.org/b/128413>
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::lock):
+        * runtime/JSLock.h:
+
+2014-02-07  Mark Lam  <mark.lam@apple.com>
+
+        Revert workaround committed in http://trac.webkit.org/r163595.
+        <https://webkit.org/b/128408>
+
+        Reviewed by Geoffrey Garen.
+
+        Now that we have fixed the bugs in JSLock's stack limit adjusments
+        in https://bugs.webkit.org/show_bug.cgi?id=128406, we can revert the
+        workaround in r163595.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        (JSGlobalContextCreateInGroup):
+        * API/tests/testapi.js:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::updateStackLimitWithReservedZoneSize):
+        * runtime/VM.h:
+
+2014-02-07  Mark Lam  <mark.lam@apple.com>
+
+        Fix bug in stack limit adjustments in JSLock.
+        <https://webkit.org/b/128406>
+
+        Reviewed by Geoffrey Garen.
+
+        1. JSLock::unlock() was only clearing the VM::stackPointerAtEntry when
+           m_vm->stackPointerAtVMEntry == entryStackPointer. FYI,
+           entryStackPointer is a field in JSLock.
+
+           When DropAllLocks::~DropAllLocks() will call JSLock::grabAllLocks()
+           to relock the JSLock, JSLock::grabAllLocks() will set a new
+           entryStackPointer value. Thereafter, DropAllLocks::~DropAllLocks() will
+           restore the saved VM::stackPointerAtEntry, which will now defer from
+           the JSLock's entryStackPointer value.
+
+           It turns out that when m_vm->stackPointerAtVMEntry was initialized,
+           it was set to whatever value entryStackPointer is set to. At no time
+           do we ever expect the 2 values to differ. The only time it differs is
+           when this bug manifests.
+
+           The fix is to remove the entryStackPointer field in JSLock and its uses
+           altogether.
+
+        2. DropAllLocks was unconditionally clearing VM::stackPointerAtEntry in
+           its constructor instead of letting JSLock::unlock() do the clearing.
+
+           However, DropAllLocks will not actually drop locks if it isn't required
+           to (e.g. when alwaysDropLocks is DontAlwaysDropLocks), and when we've
+           already drop locks once (i.e. JSLock::m_lockDropDepth is not 0).
+
+           We should not have cleared VM::stackPointerAtEntry here if we don't
+           actually drop the locks.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+
+2014-02-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [iOS] Eliminate race between XPC connection queue and Notification queue
+        https://bugs.webkit.org/show_bug.cgi?id=128384
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::RemoteInspector):
+        (Inspector::RemoteInspector::start):
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        Create the queue to use for RemoteInspector xpc connection
+        management and the connection itself.
+
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::RemoteInspectorXPCConnection):
+        Use the passed in queue instead of creating one for itself.
+
+2014-02-07  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION (r160628): LLint does not appear to handle impure get own property properly
+        https://bugs.webkit.org/show_bug.cgi?id=127943
+
+        Reviewed by Filip Pizlo.
+
+        Make sure the LLINT doesn't attempt to cache property
+        access on structures with impureGetOwnPropertySlot set.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2014-02-06  Michael Saboff  <msaboff@apple.com>
+
+        Workaround REGRESSION(r163195-r163227): Crash beneath NSErrorUserInfoFromJSException when installing AppleInternal.mpkg
+        https://bugs.webkit.org/show_bug.cgi?id=128347
+
+        Reviewed by Geoffrey Garen.
+
+        Added a flag to VM class called m_ignoreStackLimit that disables stack limit checks.
+        We set this flag in JSContextGroupCreate() and JSGlobalContextCreateInGroup().
+
+        Disabled stack overflow tests in testapi.js since it uses these paths.
+
+        THis patch will be reverted as part of a comprehensive solution to the problem.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        (JSGlobalContextCreateInGroup):
+        * API/tests/testapi.js:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::updateStackLimitWithReservedZoneSize):
+        * runtime/VM.h:
+        (JSC::VM::ignoreStackLimit):
+
+2014-02-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        +[JSContext currentCallee] should return the currently executing JS function
+        https://bugs.webkit.org/show_bug.cgi?id=122621
+
+        Reviewed by Geoffrey Garen.
+
+        It would be useful if there was a +[JSContext currentObject] API which was 
+        callable from ObjC API callbacks. Its purpose would be to allow convenient 
+        access to the JSValue wrapper for the currently-executing block callback.
+
+        * API/JSContext.h:
+        * API/JSContext.mm:
+        (+[JSContext currentCallee]):
+        (-[JSContext beginCallbackWithData:calleeValue:thisValue:argumentCount:arguments:]):
+        * API/JSContextInternal.h:
+        * API/ObjCCallbackFunction.mm:
+        (JSC::objCCallbackFunctionCallAsFunction):
+        (JSC::objCCallbackFunctionCallAsConstructor):
+        * API/tests/testapi.mm:
+
+2014-02-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix iOS builds after r163574
+
+        * API/JSManagedValue.h:
+
+2014-02-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Heap::writeBarrier shouldn't be static
+        https://bugs.webkit.org/show_bug.cgi?id=127807
+
+        Reviewed by Geoffrey Garen.
+
+        Currently it looks up the Heap in which to fire the write barrier by using 
+        the cell passed to it. Almost every call site already has a reference to the 
+        VM or the Heap itself. It seems wasteful to look it up all over again.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopyWriteBarrier.h:
+        (JSC::CopyWriteBarrier::set):
+        * heap/Heap.cpp:
+        (JSC::Heap::writeBarrier):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier):
+        * jit/JITOperations.cpp:
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrierBase::set):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_write_barrier_slow):
+        * runtime/Arguments.h:
+        * runtime/JSWeakMap.cpp:
+        * runtime/MapData.cpp:
+        (JSC::MapData::ensureSpaceForAppend):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/Structure.h:
+        * runtime/WriteBarrier.h:
+        * runtime/WriteBarrierInlines.h: Added.
+
+2014-02-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSManagedValue should automatically call removeManagedReference:withOwner: upon dealloc
+        https://bugs.webkit.org/show_bug.cgi?id=124053
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSManagedValue.h:
+        * API/JSManagedValue.mm:
+        (+[JSManagedValue managedValueWithValue:andOwner:]):
+        (-[JSManagedValue initWithValue:]):
+        (-[JSManagedValue dealloc]):
+        (-[JSManagedValue didAddOwner:]):
+        (-[JSManagedValue didRemoveOwner:]):
+        * API/JSManagedValueInternal.h: Added.
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine addManagedReference:withOwner:]):
+        (-[JSVirtualMachine removeManagedReference:withOwner:]):
+        * API/WebKitAvailability.h:
+        * API/tests/testapi.mm:
+        (-[TextXYZ click]):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-02-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add Console support to JSContext Inspection
+        https://bugs.webkit.org/show_bug.cgi?id=127941
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add new files.
+
+        * inspector/agents/InspectorConsoleAgent.cpp: Renamed from Source/WebCore/inspector/InspectorConsoleAgent.cpp.
+        * inspector/agents/InspectorConsoleAgent.h: Added.
+        New agent moved from WebCore. Rename a method to work in JS only context.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        Instantiate ConsoleAgent.
+
+        * inspector/agents/JSGlobalObjectConsoleAgent.h: Copied from Source/WebCore/inspector/PageInjectedScriptHost.h.
+        * inspector/agents/JSGlobalObjectConsoleAgent.cpp: Copied from Source/WebCore/inspector/PageInjectedScriptHost.h.
+        (Inspector::JSGlobalObjectConsoleAgent::JSGlobalObjectConsoleAgent):
+        (Inspector::JSGlobalObjectConsoleAgent::setMonitoringXHREnabled):
+        (Inspector::JSGlobalObjectConsoleAgent::addInspectedNode):
+        (Inspector::JSGlobalObjectConsoleAgent::addInspectedHeapObject):
+        JSGlobalObject implementation.
+
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::JSGlobalObjectDebuggerAgent):
+        (Inspector::JSGlobalObjectDebuggerAgent::breakpointActionLog):
+        Use ConsoleAgent to report logs.
+
+        * inspector/ConsoleMessage.cpp: Renamed from Source/WebCore/inspector/ConsoleMessage.cpp.
+        * inspector/ConsoleMessage.h: Renamed from Source/WebCore/inspector/ConsoleMessage.h.
+        * inspector/ConsoleTypes.h: Copied from Source/WebCore/inspector/ConsoleAPITypes.h.
+        * inspector/IdentifiersFactory.cpp: Renamed from Source/WebCore/inspector/IdentifiersFactory.cpp.
+        * inspector/IdentifiersFactory.h: Renamed from Source/WebCore/inspector/IdentifiersFactory.h.
+        * inspector/ScriptArguments.cpp: Renamed from Source/WebCore/inspector/ScriptArguments.cpp.
+        * inspector/ScriptArguments.h: Renamed from Source/WebCore/inspector/ScriptArguments.h.
+        * inspector/ScriptCallFrame.cpp: Renamed from Source/WebCore/inspector/ScriptCallFrame.cpp.
+        * inspector/ScriptCallFrame.h: Renamed from Source/WebCore/inspector/ScriptCallFrame.h.
+        * inspector/ScriptCallStack.cpp: Renamed from Source/WebCore/inspector/ScriptCallStack.cpp.
+        * inspector/ScriptCallStack.h: Renamed from Source/WebCore/inspector/ScriptCallStack.h.
+        * inspector/ScriptCallStackFactory.cpp: Renamed from Source/WebCore/bindings/js/ScriptCallStackFactory.cpp.
+        * inspector/ScriptCallStackFactory.h: Renamed from Source/WebCore/bindings/js/ScriptCallStackFactory.h.
+        * inspector/protocol/Console.json: Renamed from Source/WebCore/inspector/protocol/Console.json.
+        * inspector/scripts/generate-combined-inspector-json.py:
+
+2014-02-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r163542.
+        http://trac.webkit.org/changeset/163542
+        https://bugs.webkit.org/show_bug.cgi?id=128324
+
+        Caused many assertion failures (Requested by ap on #webkit).
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopyWriteBarrier.h:
+        (JSC::CopyWriteBarrier::set):
+        * heap/Heap.cpp:
+        (JSC::Heap::writeBarrier):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier):
+        * jit/JITOperations.cpp:
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrierBase::set):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_write_barrier_slow):
+        * runtime/Arguments.h:
+        * runtime/JSWeakMap.cpp:
+        * runtime/MapData.cpp:
+        (JSC::MapData::ensureSpaceForAppend):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/Structure.h:
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::setMayBeNull):
+        (JSC::WriteBarrierBase::setEarlyValue):
+        (JSC::WriteBarrierBase<Unknown>::set):
+        * runtime/WriteBarrierInlines.h: Removed.
+
+2014-02-06  Oliver Hunt  <oliver@apple.com>
+
+        Make 32bit pass the correct this value to custom getters
+        https://bugs.webkit.org/show_bug.cgi?id=128313
+
+        Reviewed by Mark Lam.
+
+        Now that the custom getter calling convetion uses a single register
+        for the slot base we can easily pass the correct |thisValue| instead
+        of simply relying on the thisValue not be relevant to existing
+        custom getters. This also means that 32bit can call custom getters
+        directly.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/Repatch.cpp:
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryBuildGetByIDList):
+
+2014-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Heap::writeBarrier shouldn't be static
+        https://bugs.webkit.org/show_bug.cgi?id=127807
+
+        Reviewed by Geoffrey Garen.
+
+        Currently it looks up the Heap in which to fire the write barrier by using 
+        the cell passed to it. Almost every call site already has a reference to the 
+        VM or the Heap itself. It seems wasteful to look it up all over again.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopyWriteBarrier.h:
+        (JSC::CopyWriteBarrier::set):
+        * heap/Heap.cpp:
+        (JSC::Heap::writeBarrier):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier):
+        * jit/JITOperations.cpp:
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrierBase::set):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_write_barrier_slow):
+        * runtime/Arguments.h:
+        * runtime/JSWeakMap.cpp:
+        * runtime/MapData.cpp:
+        (JSC::MapData::ensureSpaceForAppend):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/Structure.h:
+        * runtime/WriteBarrier.h:
+        * runtime/WriteBarrierInlines.h: Added.
+
+2014-02-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Make FTL OSR entry something we only try after we've already compiled the function with the FTL and it still got stuck in a loop after that without ever returning like a sensible function oughta have
+        https://bugs.webkit.org/show_bug.cgi?id=128234
+
+        Reviewed by Geoffrey Garen.
+        
+        Use DFG::JITCode::osrEntryRetry as a counter to decide when to invoke OSR entry. That
+        comes into play only after we've done a replacement compile.
+        
+        This appears to still give us a speed-up on the kinds of things that OSR entry is good
+        for, while also eliminating pointless OSR entry compilations on other things.
+
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::JITCode):
+        * dfg/DFGJITCode.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
+        * runtime/Options.h:
+
+2014-02-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't speculate on ToThis if we already know that arg0 has a questionable record with structure checks
+        https://bugs.webkit.org/show_bug.cgi?id=128229
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2014-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Handling of opaque roots is wrong in EdenCollections
+        https://bugs.webkit.org/show_bug.cgi?id=128210
+
+        Reviewed by Oliver Hunt.
+
+        The set of opaque roots is always cleared during each collection. We should instead persist 
+        the set of opaque roots across EdenCollections and only clear it at the beginning of FullCollections.
+
+        Also added a couple of custom objects to the jsc shell that allow us to test this.
+
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::reset):
+        (JSC::GCThreadSharedData::didStartMarking):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        (JSC::Heap::setShouldDoFullCollection):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset):
+        * heap/SlotVisitor.h:
+        * jsc.cpp:
+        (WTF::Element::Element):
+        (WTF::Element::root):
+        (WTF::Element::setRoot):
+        (WTF::Element::create):
+        (WTF::Element::createStructure):
+        (WTF::ElementHandleOwner::isReachableFromOpaqueRoots):
+        (WTF::Root::Root):
+        (WTF::Root::element):
+        (WTF::Root::setElement):
+        (WTF::Root::create):
+        (WTF::Root::createStructure):
+        (WTF::Root::visitChildren):
+        (WTF::Element::handleOwner):
+        (WTF::Element::finishCreation):
+        (GlobalObject::finishCreation):
+        (functionCreateRoot):
+        (functionCreateElement):
+        (functionGetElement):
+        (functionSetElementRoot):
+        (functionGCAndSweep):
+        (functionFullGC):
+        (functionEdenGC):
+
+2014-02-05  Anders Carlsson  <andersca@apple.com>
+
+        Remove unused functions.
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        * runtime/RegExpObject.cpp:
+
+2014-02-05  Oliver Hunt  <oliver@apple.com>
+
+        Change custom getter signature to make the base reference an object pointer
+        https://bugs.webkit.org/show_bug.cgi?id=128279
+
+        Reviewed by Geoffrey Garen.
+
+        Make custom getters take a JSObject* instead of EncodedJSValue as the base
+        reference.  This allows us to drop one pointer from the JSVALUE32_64 calling
+        convention.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryBuildGetByIDList):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::nameGetter):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/PropertySlot.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+
+2014-02-05  Andreas Kling  <akling@apple.com>
+
+        Remove ENABLE(DIRECTORY_UPLOAD).
+        <https://webkit.org/b/128275>
+
+        Rubber-stamped by Ryosuke Niwa.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-02-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename useExperimentalFTL to useFTLJIT.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * runtime/Options.h:
+
+2014-02-05  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: add probe manager and model objects to the frontend
+        https://bugs.webkit.org/show_bug.cgi?id=127117
+
+        Reviewed by Timothy Hatcher.
+
+        The inspector frontend now assigns breakpoint action identifiers,
+        rather than the backend. Remove return values containing breakpoint
+        identifiers, and remove tracking and assignment of action identifiers.
+
+        * inspector/ScriptDebugListener.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe):
+        Pass BreakpointAction by reference rather than just the action identifier.
+
+        * inspector/ScriptDebugServer.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::objectGroupForBreakpointAction):
+        (Inspector::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (Inspector::InspectorDebuggerAgent::breakpointActionsFromProtocol):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::removeBreakpoint):
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/protocol/Debugger.json: Revert change to setBreakpoint return values. Add optional identifier to breakpoint actions.
+
+2014-02-05  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC on Mac should pull LLVM from prefix=/usr/local/LLVMForJavaScriptCore and not /usr/local
+        https://bugs.webkit.org/show_bug.cgi?id=128269
+
+        Reviewed by Mark Hahnenberg.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/LLVMForJSC.xcconfig:
+
+2014-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix 32-bit builds after r163471
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+
+2014-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Can no longer run OctaneV2 in browser, crashes in speculationFromCell
+        https://bugs.webkit.org/show_bug.cgi?id=128266
+
+        Reviewed by Filip Pizlo.
+
+        Move the OSR exit write barriers into OSRExitCompilerCommon. Also reorganize some 
+        of the code to be in more appropriate places.
+
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::osrWriteBarrier):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::genericWriteBarrier):
+
+2014-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Malloc called beneath MachineThreads::gatherFromOtherThread(), while forbidden
+        https://bugs.webkit.org/show_bug.cgi?id=128202
+
+        Reviewed by Geoffrey Garen.
+
+        This patch uses the new GCSegmentedArray to replace the Vector that was used 
+        to record the set of currently executing CodeBlocks during the conservative 
+        stack scan. This is primarily to avoid the possibility of the Vector resizing 
+        while FastMalloc is forbidden.
+
+        * heap/BlockAllocator.h:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::CodeBlockSet):
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        * heap/CodeBlockSet.h:
+        * heap/GCSegmentedArray.h:
+        (JSC::GCSegmentedArray::begin):
+        (JSC::GCSegmentedArray::end):
+        (JSC::GCSegmentedArrayIterator::GCSegmentedArrayIterator):
+        (JSC::GCSegmentedArrayIterator::get):
+        (JSC::GCSegmentedArrayIterator::operator*):
+        (JSC::GCSegmentedArrayIterator::operator->):
+        (JSC::GCSegmentedArrayIterator::operator==):
+        (JSC::GCSegmentedArrayIterator::operator!=):
+        (JSC::GCSegmentedArrayIterator::operator++):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+
+2014-02-05  Wojciech Bielawski  <w.bielawski@samsung.com>
+
+        XMLHttpRequest performs too many copies for ArrayBuffer results
+        https://bugs.webkit.org/show_bug.cgi?id=117458
+
+        Reviewed by Alexey Proskuryakov.
+
+        Based on blink change: https://chromium.googlesource.com/chromium/blink/+/bed266aa5a43f7c080c87e527bd35e2b80ecc7b7
+
+        Add SharedBuffer::createArrayBuffer() and use it to create XMLHttpRequest's response in ArrayBuffer
+        This cuts
+            - two memsets (in ArrayBuffer::create and SharedBuffer::m_buffer::resize)
+            - one copy (SharedBuffer::m_buffer to ArrayBufferContents::m_data)
+            - one allocation (SharedBuffer::m_buffer)
+
+        * runtime/ArrayBuffer.h:
+
+2014-02-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove ENABLE(SVG) guards
+        https://bugs.webkit.org/show_bug.cgi?id=127991
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-02-05  Zan Dobersek  <zdobersek@igalia.com>
+
+        Remove CLASS_IF_GCC workarounds
+        https://bugs.webkit.org/show_bug.cgi?id=128207
+
+        Reviewed by Anders Carlsson.
+
+        Remove the CLASS_IF_GCC macro that was defined to 'class' when using the GCC compiler.
+        The macro was then used in class friendship declarations for templated classes to avoid
+        corner-case compiler failures on both GCC pre-4.7 and MSVC pre-2013. The problematic
+        versions of both compilers are no longer supported, so this macro is good to go.
+
+        * heap/HeapBlock.h:
+        * heap/Region.h:
+
+2014-02-04  Mark Lam  <mark.lam@apple.com>
+
+        The stack limit computation does not work for Windows.
+        <https://webkit.org/b/128226>
+
+        Reviewed by Geoffrey Garen.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoopRegister::CLoopRegister):
+        (JSC::CLoop::execute):
+        - Suppressed some compiler warnings for the C loop build.
+        * runtime/VM.cpp:
+        (JSC::VM::updateStackLimitWithReservedZoneSize):
+        - Use the new StackBounds::recursionLimit() to compute the stack limit
+          the right way.
+
+2014-02-04  Andreas Kling  <akling@apple.com>
+
+        Remove <iframe seamless> support.
+        <https://webkit.org/b/128213>
+
+        Rubber-stamped by Antti Koivisto.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-02-04  Mark Lam  <mark.lam@apple.com>
+
+        DFG::operationTypeOf() needs to set the VM::topCallFrame.
+        <https://webkit.org/b/128228>
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGOperations.cpp:
+        - operationTypeOf() can end up calling into WebCore which may in turn
+          call back to JSC, and need a valid VM::topCallFrame. So, we need to
+          set the value of VM::topCallFrame at the top of operationTypeOf().
+
+2014-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix !ENABLE(JIT) builds after r163418
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reoptimizationRetryCounter): Return 0 if there's no way for us to reoptimize.
+
+2014-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Reduce boilerplate in BlockAllocator.h
+        https://bugs.webkit.org/show_bug.cgi?id=128222
+
+        Reviewed by Filip Pizlo.
+
+        There are a lot of template specializations for the various types of HeapBlocks 
+        in BlockAllocator.h. We could reduce the spew by using a macro.
+
+        * heap/BlockAllocator.h:
+
+2014-02-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG PutByVal on typed arrays should detect OutOfBounds sooner
+        https://bugs.webkit.org/show_bug.cgi?id=128162
+
+        Reviewed by Mark Hahnenberg.
+        
+        Just wire the m_outOfBounds flag in ArrayProfile into the OutOfBounds speculation in
+        DFG::ArrayMode for typed arrays.
+        
+        Also make it possible to have tests for convergence.
+        
+        Also turn one of the LayoutTests/js/dfg- tests into a stress test because it
+        was relying on a specific number of recompiles. Stress tests instead take
+        the approach of just running for a while. That's more robust.
+
+        * bytecode/CodeBlock.h:
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::withSpeculationFromProfile):
+        (JSC::DFG::ArrayMode::withProfile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionReoptimizationRetryCount):
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::getExecutableForFunction):
+        (JSC::getSomeBaselineCodeBlockForFunction):
+        (JSC::numberOfDFGCompiles):
+        (JSC::setNeverInline):
+        * runtime/TestRunnerUtils.h:
+        * tests/stress/float32-repeat-out-of-bounds.js: Added.
+        (foo):
+        * tests/stress/int8-repeat-out-of-bounds.js: Added.
+        (foo):
+        * tests/stress/string-out-of-bounds-negative-proto-value.js: Added.
+        (foo):
+
+2014-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Refactor MarkStackArray to allow more than JSCells to be stored
+        https://bugs.webkit.org/show_bug.cgi?id=128203
+
+        Reviewed by Geoffrey Garen.
+
+        This patch refactors MarkStackArray into a separate template class named GCSegmentedArray.
+        This class allows subclassing to add functionality that only MarkStackArray wants.
+        Since it uses the JSC BlockAllocator instead of FastMalloc, this class can be used during 
+        conservative stack scanning, which disallows using FastMalloc.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/BlockAllocator.h:
+        * heap/GCSegmentedArray.h: Added.
+        (JSC::GCArraySegment::GCArraySegment):
+        (JSC::GCArraySegment::data):
+        * heap/GCSegmentedArrayInlines.h: Added.
+        (JSC::GCSegmentedArray<T>::GCSegmentedArray):
+        (JSC::GCSegmentedArray<T>::~GCSegmentedArray):
+        (JSC::GCSegmentedArray<T>::clear):
+        (JSC::GCSegmentedArray<T>::expand):
+        (JSC::GCSegmentedArray<T>::refill):
+        (JSC::GCSegmentedArray<T>::fillVector):
+        (JSC::GCArraySegment<T>::create):
+        (JSC::GCSegmentedArray<T>::postIncTop):
+        (JSC::GCSegmentedArray<T>::preDecTop):
+        (JSC::GCSegmentedArray<T>::setTopForFullSegment):
+        (JSC::GCSegmentedArray<T>::setTopForEmptySegment):
+        (JSC::GCSegmentedArray<T>::top):
+        (JSC::GCSegmentedArray<T>::validatePrevious):
+        (JSC::GCSegmentedArray<T>::append):
+        (JSC::GCSegmentedArray<T>::canRemoveLast):
+        (JSC::GCSegmentedArray<T>::removeLast):
+        (JSC::GCSegmentedArray<T>::isEmpty):
+        (JSC::GCSegmentedArray<T>::size):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::MarkStackArray):
+        (JSC::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStackArray::donateSomeCellsTo):
+        (JSC::MarkStackArray::stealSomeCellsFrom):
+        * heap/MarkStack.h:
+        * heap/MarkStackInlines.h:
+
+2014-02-04  Anders Carlsson  <andersca@apple.com>
+
+        Rename the substring sharing StringImpl::create variants to better indicate what they do
+        https://bugs.webkit.org/show_bug.cgi?id=128214
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsSubstring8):
+        (JSC::jsSubstring):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::replaceUsingStringSearch):
+
+2014-02-04  Anders Carlsson  <andersca@apple.com>
+
+        Rename StringImpl::getCharacters to StringImpl::characters
+        https://bugs.webkit.org/show_bug.cgi?id=128205
+
+        Reviewed by Antti Koivisto.
+
+        Update for WTF changes.
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::joinStrings):
+        * runtime/StringPrototype.cpp:
+        (JSC::splitStringByOneCharacterImpl):
+
+2014-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix a mismatch of uint64_t and size_t on 32-bit platforms.
+
+        * ftl/FTLDWARFDebugLineInfo.h:
+
+2014-01-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC needs to be able to parse DWARF debug_line info
+        https://bugs.webkit.org/show_bug.cgi?id=127394
+
+        Reviewed by Geoffrey Garen.
+
+        If we want to encode IR maps in the DWARF debug line info metadata generated by LLVM, 
+        we'll need to know how to decode the .debug_line DWARF section. This patch implements 
+        an interpreter for the .debug_line DWARF section in accordance with the version 3 spec 
+        published at http://www.dwarfstd.org.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLDWARFDebugLineInfo.cpp: Added.
+        (JSC::FTL::DebugLineInterpreter::DebugLineInterpreter):
+        (JSC::FTL::read):
+        (JSC::FTL::DebugLineInterpreter::parseULEB128):
+        (JSC::FTL::DebugLineInterpreter::parseSLEB128):
+        (JSC::FTL::DebugLineInterpreter::run):
+        (JSC::FTL::DebugLineInterpreter::parsePrologue):
+        (JSC::FTL::DebugLineInterpreter::parseIncludeDirectories):
+        (JSC::FTL::DebugLineInterpreter::parseFileEntries):
+        (JSC::FTL::DebugLineInterpreter::parseFileEntry):
+        (JSC::FTL::DebugLineInterpreter::interpretStatementProgram):
+        (JSC::FTL::DebugLineInterpreter::interpretOpcode):
+        (JSC::FTL::DebugLineInterpreter::printLineInfo):
+        (JSC::FTL::DebugLineInterpreter::resetInterpreterState):
+        * ftl/FTLDWARFDebugLineInfo.h: Added.
+        (JSC::FTL::DebugLineInterpreter::Prologue::Prologue):
+        * ftl/FTLValueRange.cpp: Random build fix for !ENABLE(FTL_JIT).
+
+2014-02-04  Anders Carlsson  <andersca@apple.com>
+
+        Rename String::getCharacters to String::characters
+        https://bugs.webkit.org/show_bug.cgi?id=128196
+
+        Reviewed by Andreas Kling.
+
+        Update for WTF::String changes.
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::Parser):
+
+2014-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC needs to be able to parse DWARF debug_line info
+        https://bugs.webkit.org/show_bug.cgi?id=127394
+
+        Reviewed by Geoffrey Garen.
+
+        If we want to encode IR maps in the DWARF debug line info metadata generated by LLVM, 
+        we'll need to know how to decode the .debug_line DWARF section. This patch implements 
+        an interpreter for the .debug_line DWARF section in accordance with the version 3 spec 
+        published at http://www.dwarfstd.org.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLDWARFDebugLineInfo.cpp: Added.
+        (JSC::FTL::DebugLineInterpreter::DebugLineInterpreter):
+        (JSC::FTL::read):
+        (JSC::FTL::DebugLineInterpreter::parseULEB128):
+        (JSC::FTL::DebugLineInterpreter::parseSLEB128):
+        (JSC::FTL::DebugLineInterpreter::run):
+        (JSC::FTL::DebugLineInterpreter::parsePrologue):
+        (JSC::FTL::DebugLineInterpreter::parseIncludeDirectories):
+        (JSC::FTL::DebugLineInterpreter::parseFileEntries):
+        (JSC::FTL::DebugLineInterpreter::parseFileEntry):
+        (JSC::FTL::DebugLineInterpreter::interpretStatementProgram):
+        (JSC::FTL::DebugLineInterpreter::interpretOpcode):
+        (JSC::FTL::DebugLineInterpreter::printLineInfo):
+        (JSC::FTL::DebugLineInterpreter::resetInterpreterState):
+        * ftl/FTLDWARFDebugLineInfo.h: Added.
+        (JSC::FTL::DebugLineInterpreter::Prologue::Prologue):
+
+2014-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        ASSERT in speculateMachineInt on 32-bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=128155
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2014-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GC timer should always do a FullCollection
+        https://bugs.webkit.org/show_bug.cgi?id=128186
+
+        Reviewed by Michael Saboff.
+
+        Right now the GC timer does whatever type of collection the next collection 
+        would have been, which is almost always an EdenCollection. It then thinks 
+        that it has done all of the work it was supposed to do and never schedules 
+        another GC. Ideally we'd like to have some heuristics for the timer that 
+        would schedule both EdenCollections and FullCollections, but the easiest 
+        fix for now is to always do FullCollections since that will at least be 
+        a non-regression.
+
+        * heap/Heap.h:
+        (JSC::Heap::gcTimerDidFire):
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::doWork):
+
+2014-02-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Lift the FTL tier-up threshold from 25000 to 100000
+        https://bugs.webkit.org/show_bug.cgi?id=128158
+
+        Rubber stamped by Michael Saboff.
+
+        * runtime/Options.h:
+
+2014-02-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        LLInt: Regex for pseudo-instructions is too big
+        https://bugs.webkit.org/show_bug.cgi?id=128148
+
+        Reviewed by Mark Lam.
+
+        * offlineasm/instructions.rb:
+        * offlineasm/parser.rb:
+
+2014-02-03  Brian Burg  <bburg@apple.com>
+
+        Web Replay: upstream base input classes and the input cursor interface
+        https://bugs.webkit.org/show_bug.cgi?id=128110
+
+        Reviewed by Joseph Pecoraro.
+
+        Add the base class for all replay inputs. Add InputTraits, a trait that
+        provides an input's queue, type, and encode/decode methods statically so
+        that they can be used within templated helper functions in InputCursor and
+        EncodedValue.
+
+        Add the InputCursor base class which mediates the saving and fetching of
+        replay inputs from a replay recording by instrumented nondeterministic code.
+
+        Add a dummy cursor implementation. This allows us to return a cursor reference
+        to clients even if no capturing or replaying is happening.
+
+        Add the ability to set an InputCursor instance on a JSGlobalObject. This
+        is the means for connecting a replay recording to a script context.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * replay/EmptyInputCursor.h: Added.
+        (JSC::EmptyInputCursor::~EmptyInputCursor):
+        (JSC::EmptyInputCursor::create):
+        (JSC::EmptyInputCursor::EmptyInputCursor):
+        * replay/InputCursor.h: Added.
+        (JSC::InputCursor::InputCursor):
+        (JSC::InputCursor::~InputCursor):
+        (JSC::InputCursor::appendInput):
+        (JSC::InputCursor::fetchInput):
+        * replay/NondeterministicInput.h: Added.
+        (JSC::NondeterministicInputBase::NondeterministicInputBase):
+        (JSC::NondeterministicInputBase::~NondeterministicInputBase):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::setInputCursor):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::inputCursor):
+
+2014-02-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the cloop due to GenGC
+        https://bugs.webkit.org/show_bug.cgi?id=128137
+
+        Reviewed by Geoffrey Garen.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_write_barrier_slow):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoopRegister::operator JSCell*):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+
+2014-02-03  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r163011-r163031): Web Inspector: Latest nightly crashes when showing the Web Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=127901
+
+        Reviewed by Geoffrey Garen.
+
+        Set VM::topCallFrame before making calls to possible C++ code in
+        generateProtoChainAccessStub() and tryBuildGetByIDList().
+
+        * jit/Repatch.cpp:
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryBuildGetByIDList):
+
+2014-02-03  Andreas Kling  <akling@apple.com>
+
+        Keep only captured symbols in CodeBlock symbol tables.
+        <https://webkit.org/b/128050>
+
+        Discard all uncaptured symbols at the end of codegen since only
+        the captured ones will be used after that point.
+
+        ~2MB progression on Membuster OSUS.
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::setSymbolTable):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+
+2014-02-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix the LLInt C loop
+
+        Rubber stamped by Mark Lam.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_write_barrier_slow):
+        * llint/LLIntSlowPaths.h:
+
+2014-02-03  Dean Jackson  <dino@apple.com>
+
+        Feature flag for shape-inside
+        https://bugs.webkit.org/show_bug.cgi?id=128001
+
+        Reviewed by Simon Fraser.
+
+        Add CSS_SHAPE_INSIDE flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-02-03  Oliver Hunt  <oliver@apple.com>
+
+        Deconstructed parameters aren't being placed in the correct scope
+        https://bugs.webkit.org/show_bug.cgi?id=128126
+
+        Reviewed by Antti Koivisto.
+
+        Make sure we declare the bound parameter names as variables when
+        we reparse.  In the BytecodeGenerator we now also directly ensure
+        that bound parameters are placed in the symbol table of the function
+        we're currently compiling.  We then delay binding until just before
+        we start codegen for the body of the function so that we can ensure
+        the function has completely initialised all scope details.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::createBindingPattern):
+
+2014-02-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Update JS whitespace definition for changes in Unicode 6.3
+        https://bugs.webkit.org/show_bug.cgi?id=127450
+
+        Reviewed by Oliver Hunt.
+
+        * parser/Lexer.h: (JSC::Lexer<UChar>::isWhiteSpace): Part 2 of the fix, update lexer too.
+
+2014-02-03  Matthew Mirman  <mmirman@apple.com>
+
+        Added GetTypedArrayByteOffset to FTL
+        https://bugs.webkit.org/show_bug.cgi?id=127589
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetTypedArrayByteOffset):
+        * tests/stress/ftl-gettypedarrayoffset-simple.js: Added.
+        (foo):
+        * tests/stress/ftl-gettypedarrayoffset-wasteful.js: Added.
+        (foo):
+
+2014-02-03  Mark Lam  <mark.lam@apple.com>
+
+        Debugger created JSActivations should account for CodeBlock::framePointerOffsetToGetActivationRegisters().
+        <https://webkit.org/b/128112>
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, when the DebuggerCallFrame creates the JSActivation object
+        for a frame, it does not account for the framePointerOffsetToGetActivationRegisters()
+        offset that needs to be added for DFG frames.
+
+        Instead of special casing the fix in DebuggerCallFrame::scope(), we fix
+        this by adding CodeBlock::framePointerOffsetToGetActivationRegisters() to
+        callFrame->registers() in the JSActivation::create() method that does not
+        explicitly take a Register*. This ensures that JSActivation::create() will
+        always do the right thing instead of only being a special case for the
+        LLINT and baselineJIT.
+
+        Apart from the DebuggerCallFrame, this create() function is only called by
+        slow paths in the LLINT and baselineJIT. Hence, it is not performance
+        critical.
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+
+2014-01-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Simplified name scope creation for function expressions
+        https://bugs.webkit.org/show_bug.cgi?id=128031
+
+        Reviewed by Mark Lam.
+
+        3X speedup on js/regress/script-tests/function-with-eval.js.
+
+        We used to emit bytecode to push a name into local scope every
+        time a function that needed such a name executed. Now, we push the name
+        into scope once on the function object, and leave it there.
+
+        This is faster, and it also reduces the number of variable resolution
+        modes you have to worry about when thinking about bytecode and the
+        debugger.
+
+        This patch is slightly complicated by the fact that we don't know if
+        a function needs a name scope until we parse its body. So, there's some
+        glue code in here to delay filling in a function's scope until we parse
+        its body for the first time.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::functionMode): Renamed
+        functionNameIsInScopeToggle to functionMode.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): No need to emit convert_this
+        when debugging. The debugger will perform the conversion as needed.
+
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::addCallee): Simplified this code by removing
+        the "my function needs a name scope, but didn't allocate one" mode.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall): Pass a scope slot through to
+        CodeBlock generation, so we can add a function name scope if the parsed
+        function body requires one.
+
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall): Ditto.
+
+        * parser/NodeConstructors.h:
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::finishParsing):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::functionMode): Updated for rename.
+
+        * parser/ParserModes.h:
+        (JSC::functionNameIsInScope):
+        (JSC::functionNameScopeIsDynamic): Helper functions for reasoning about
+        how crazy JavaScript language semantics are.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        (JSC::attemptFastSort): Updated for interface changes above.
+
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::prepareForExecution):
+        (JSC::FunctionExecutable::functionMode):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::addNameScopeIfNeeded):
+        * runtime/JSFunction.h:
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::JSNameScope): Added machinery for pushing a function
+        name scope onto a function when we first discover that it's needed.
+
+2014-01-25  Darin Adler  <darin@apple.com>
+
+        Stop using Unicode.h
+        https://bugs.webkit.org/show_bug.cgi?id=127633
+
+        Reviewed by Anders Carlsson.
+
+        * parser/Lexer.h:
+        * runtime/JSGlobalObjectFunctions.h:
+        * yarr/YarrCanonicalizeUCS2.h:
+        * yarr/YarrInterpreter.h:
+        * yarr/YarrParser.h:
+        * yarr/YarrPattern.h:
+        Removed includes of <wtf/unicode/Unicode.h>, adding includes of
+        ICU headers and <wtf/text/LChar.h> as needed to replace it.
+
+2014-02-03  Dan Bernstein  <mitz@apple.com>
+
+        Correctly address Darin’s review comment on the last change.
+
+        * runtime/Watchdog.h: Changed an OS(DARWIN) guard around formerly PLATFORM(MAC)-only member
+        variables to the equivalent OS(DARWIN) && !PLATFORM(EFL) && !PLATFORM(GTK).
+
+2014-02-03  Dan Bernstein  <mitz@apple.com>
+
+        Stop using PLATFORM(MAC) in JavaScriptCore except where it means “OS X but not iOS”
+        https://bugs.webkit.org/show_bug.cgi?id=128098
+
+        Reviewed by Darin Adler.
+
+        * API/JSValueRef.cpp:
+        (JSValueUnprotect): Added an explicit !PLATFORM(IOS) in guards for the Evernote workaround,
+        which is only needed on OS X.
+
+        * API/tests/testapi.c:
+        (main): Changed PLATFORM(MAC) || PLATFORM(IOS) guards to OS(DARWIN), because they were
+        surrounding tests for code that is itself guarded by OS(DARWIN).
+
+        * runtime/Watchdog.h: Changed PLATFORM(MAC) to OS(DARWIN).
+
+        * tools/CodeProfiling.cpp:
+        (JSC::CodeProfiling::begin): Changed PLATFORM(MAC) to
+        OS(DARWIN) && !PLATFORM(EFL) && !PLATFORM(GTK).
+        (JSC::CodeProfiling::end): Ditto.
+
+2014-02-02  Mark Lam  <mark.lam@apple.com>
+
+        Repatch code is passing the wrong args to lookupExceptionHandler.
+        <https://webkit.org/b/128085>
+
+        Reviewed by Oliver Hunt.
+
+        lookupExceptionHandler() is expecting 2 args: VM*, ExecState*.
+        The repatch code was only passing an ExecState*. A crash ensues.
+        This is now fixed.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/Repatch.cpp:
+        (JSC::generateProtoChainAccessStub):
+
+2014-02-01  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC profiler's stub info profiling support should work again
+        https://bugs.webkit.org/show_bug.cgi?id=128057
+
+        Reviewed by Mark Lam.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus): We want to know if the cache was ever reset by GC, since the DFG uses this information.
+        (JSC::CodeBlock::printLocationAndOp): This shouldn't have been inline.
+        (JSC::CodeBlock::printLocationOpAndRegisterOperand): Ditto.
+        (JSC::CodeBlock::dumpBytecode): Dump the profiling field, and make sure that the caller can pass a StubInfoMap, which is necessary for dumping StructureStubInfo profiling.
+        * bytecode/CodeBlock.h: Out-of-line some methods and add the StubInfoMap parameter.
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence): Create a StubInfoMap before dumping bytecodes.
+
+2014-02-01  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC profiler should show reasons for jettison
+        https://bugs.webkit.org/show_bug.cgi?id=128047
+
+        Reviewed by Geoffrey Garen.
+        
+        Henceforth if you want to jettison a CodeBlock, you gotta tell the Profiler why you did
+        it. This makes figuring out convergence issues - where some code seems to take a long
+        time to get into the top tier compiler - a lot easier.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::jettison):
+        (JSC::CodeBlock::addBreakpoint):
+        (JSC::CodeBlock::setSteppingMode):
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeBlockJettisoningWatchpoint.cpp:
+        (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        (JSC::ProfiledCodeBlockJettisoningWatchpoint::fireInternal):
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperations.cpp:
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::Compilation):
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerCompilation.h:
+        (JSC::Profiler::Compilation::setJettisonReason):
+        * profiler/ProfilerJettisonReason.cpp: Added.
+        (WTF::printInternal):
+        * profiler/ProfilerJettisonReason.h: Added.
+        * runtime/CommonIdentifiers.h:
+        * runtime/VM.cpp:
+        (JSC::SetEnabledProfilerFunctor::operator()):
+
+2014-02-01  Mark Lam  <mark.lam@apple.com>
+
+        Saying "jitType() == JITCode::DFGJIT" is almost never correct.
+        <http://webkit.org/b/128045>
+
+        Reviewed by Filip Pizlo.
+
+        JITCode::isOptimizingJIT(jitType()) is the right way to say it.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::addBreakpoint):
+        (JSC::CodeBlock::setSteppingMode):
+        * runtime/VM.cpp:
+        (JSC::SetEnabledProfilerFunctor::operator()):
+
+2014-02-01  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r163027?): CrashTracer: [USER] com.apple.WebKit.WebContent.Development at com.apple.JavaScriptCore: JSC::ArrayProfile::computeUpdatedPrediction + 4
+        https://bugs.webkit.org/show_bug.cgi?id=128037
+
+        Reviewed by Mark Lam.
+
+        op_call_varargs ops now needs an ArrayProfile since DFG inlines these since
+        change set r162739.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallVarargs):
+
+2014-01-31  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix build breakage.
+
+        Not reviewed.
+
+        * interpreter/CallFrame.h:
+
+2014-01-31  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: Fix a merge problem to unbreak bots.
+
+        Not reviewed.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+
+2014-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Rollout r163195 and related patches
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
+        (JSC::JSCallbackObject<Parent>::put):
+        (JSC::JSCallbackObject<Parent>::deleteProperty):
+        (JSC::JSCallbackObject<Parent>::getStaticValue):
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/Array.prototype.js: Removed.
+        * builtins/BuiltinExecutables.cpp: Removed.
+        * builtins/BuiltinExecutables.h: Removed.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::UnlinkedFunctionExecutable::create):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * create_hash_table:
+        * dfg/DFGDominators.cpp:
+        * dfg/DFGJITCode.cpp:
+        * dfg/DFGOperations.cpp:
+        * generate-js-builtins: Removed.
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        * interpreter/ProtoCallFrame.cpp:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITOperations.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jsc.cpp:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer<T>::lexExpectIdentifier):
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::didFinishParsing):
+        (JSC::Parser<LexerType>::printUnexpectedTokenText):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * parser/ParserTokens.h:
+        * runtime/Arguments.h:
+        * runtime/ArgumentsIteratorPrototype.cpp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncEvery):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CommonSlowPathsExceptions.cpp:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::executableInfo):
+        (JSC::ProgramExecutable::executableInfo):
+        (JSC::isHostFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArgumentsIterator.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSArrayIterator.cpp:
+        * runtime/JSCJSValue.cpp:
+        * runtime/JSCellInlines.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::calculatedDisplayName):
+        (JSC::JSFunction::sourceCode):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::nativeConstructor):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        * runtime/JSGenericTypedArrayViewPrototypeInlines.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::symbolTableHasProperty):
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        * runtime/JSObject.h:
+        * runtime/JSPromiseConstructor.cpp:
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/JSPromisePrototype.cpp:
+        * runtime/JSPromiseReaction.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::inlineJSValueNotStringtoString):
+        (JSC::JSValue::toWTFStringInline):
+        * runtime/JSStringInlines.h: Removed.
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::propertyGetter):
+        (JSC::HashEntry::propertyPutter):
+        (JSC::HashTable::entry):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::putEntry):
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeErrorConstructor.h:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/PropertySlot.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/SetConstructor.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/Structure.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2014-01-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG->FTL tier-up shouldn't assume that LoopHints stay at the tops of loops
+        https://bugs.webkit.org/show_bug.cgi?id=128030
+
+        Reviewed by Oliver Hunt.
+        
+        Remove a bogus assertion. The only thing that matters is that the LoopHint had at one
+        point in time been at the top of a loop header, and that it is now at the top of a
+        basic block. But the basic block that it's at the top of now doesn't have to be the
+        same as the loop header that it once was the top of.
+
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * tests/stress/tier-up-in-loop-with-cfg-simplification.js: Added.
+        (foo):
+
+2014-01-31  Mark Lam  <mark.lam@apple.com>
+
+        Avoid eagerly creating the JSActivation when the debugger is attached.
+        <https://webkit.org/b/127910>
+
+        Reviewed by Oliver Hunt.
+
+        Octane scores for this patch:
+            baseline w/o WebInspector: 11621
+            patched  w/o WebInspector: 11801
+            baseline w/ WebInspector:  3295
+            patched  w/ WebInspector:  7070   2.1x improvement
+
+        1. Because debugger can potentially create a closure from any call frame,
+           we need every function to allocate an activation register and check for
+           the need to tear off the activation (if needed) on return.
+
+           However, we do not need to eagerly create the activation object.
+           This patch implements the optimization to defer creation of the
+           activation object until we actually need it i.e. when:
+
+           1. We encounter a "eval", "with", or "catch" statement.
+           2. We've paused in the debugger, and called DebuggerCallFrame::scope().
+
+        2. The UnlinkedCodeBlock provides a needsFullScopeChain flag that is used
+           to indicate whether the linked CodeBlock will need an activation
+           object or not. Under normal circumstances, needsFullScopeChain and
+           needsActivation are synonymous. However, with a debugger attached, we
+           want the CodeBlock to always allocate an activationRegister even if
+           it does not need a "full scope chain".
+
+           Hence, we apply the following definitions to the "flags":
+
+           1. UnlinkedCodeBlock::needsFullScopeChain() - this flag indicates that
+              the parser discovered JS artifacts (e.g. use of "eval", "with", etc.)
+              that requires an activation.
+
+              BytecodeGenerator's destinationForAssignResult() and leftHandSideNeedsCopy()
+              checks needsFullScopeChain().
+
+           2. UnlinkedCodeBlock::hasActivationRegister() - this flag indicates that
+              an activation register was created for the UnlinkedCodeBlock either
+              because it needsFullScopeChain() or because the debugger is attached.
+
+           3. CodeBlock::needsActivation() reflects UnlinkedCodeBlock's
+              hasActivationRegister().
+
+        3. Introduced BytecodeGenerator::emitPushFunctionNameScope() and
+           BytecodeGenerator::emitPushCatchScope() because the JSNameScope
+           pushed for a function name cannot be popped unlike the JSNameScope
+           pushed for a "catch". Hence, we have 2 functions to handle the 2 cases
+           differently.
+
+        4. Removed DebuggerCallFrame::evaluateWithCallFrame() and require that all
+           debugger evaluations go through the DebuggerCallFrame::evaluate(). This
+           ensures that debugger evaluations require a DebuggerCallFrame.
+
+           DebuggerCallFrame::evaluateWithCallFrame() was used previously because
+           we didn't want to instantiate a DebuggerCallFrame on every debug hook
+           callback. However, we now only call the debug hooks when needed, and
+           this no longer poses a performance problem.
+
+           In addition, when the debug hook does an eval to test a breakpoint
+           condition, it is incorrect to evaluate it without a DebuggerCallFrame
+           anyway.
+
+        5. Added some utility functions to the CallFrame to make it easier to work
+           with the activation register in the frame (if present). These utility
+           functions should only be called if the CodeBlock::needsActivation() is
+           true (which indicates the presence of the activation register). The
+           utlity functions are:
+
+           1. CallFrame::hasActivation()
+              - checks if the frame's activation object has been created.
+
+           2. CallFrame::activation()
+              - returns the frame's activation object.
+
+           3. CallFrame::uncheckedActivation()
+              - returns the JSValue in the frame's activation register. May be null.
+
+           4. CallFrame::setActivation()
+              - sets the frame's activation object.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        - added symbollic dumping of ResolveMode and ResolveType values for some
+          bytecodes.
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::activationRegister):
+        (JSC::CodeBlock::uncheckedActivationRegister):
+        (JSC::CodeBlock::needsActivation):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::needsFullScopeChain):
+        (JSC::UnlinkedCodeBlock::hasActivationRegister):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::createActivationIfNecessary):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::hasBreakpoint):
+        (JSC::Debugger::pauseIfNeeded):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::scope):
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGGraph.h:
+        - Removed an unused function DFGGraph::needsActivation().
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::activation):
+        (JSC::CallFrame::setActivation):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hasActivation):
+        (JSC::ExecState::registers):
+        * interpreter/CallFrameInlines.h:
+        (JSC::CallFrame::uncheckedActivation):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::Interpreter::unwind):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+
+        * runtime/JSScope.cpp:
+        * runtime/JSScope.h:
+        (JSC::resolveModeName):
+        (JSC::resolveTypeName):
+        - utility functions for decoding names of the ResolveMode and ResolveType.
+          These are used in CodeBlock::dumpBytecode().
+
+2014-01-31  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION: Crash in sanitizeStackForVMImpl when scrolling @ lifehacker.com.au
+        https://bugs.webkit.org/show_bug.cgi?id=128017
+
+        Reviewed by Filip Pizlo.
+
+        Moved the setting and saving of VM::stackPointerAtVMEntry and the corresponding stack limit
+        to JSLock and JSLock::DropAllLocks.  The saved data is now stored in per-thread in
+        WTFThreadData.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::~VMEntryScope):
+        * runtime/VMEntryScope.h:
+
+2014-01-31  Mark Lam  <mark.lam@apple.com>
+
+        Don't need a JSNameScope for the callee name just for the debugger.
+        <https://webkit.org/b/128024>
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, in the bytecode for a function, we push a JSNamedScope for
+        the name of the function when a debugger is attached. The name scope for
+        the function name is only needed for evals which can redefine the name
+        to resolve to something else, and can later delete the redefined name
+        which should revert the resolution of the name to the original function.
+        The debugger does not need this feature because it declares all new vars
+        in a temporary nested scope. Hence, we can remove the presence of the
+        debugger as a criteria for pushing the JSNameScope.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::addCallee):
+
+2014-01-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, build fix.
+
+        * ftl/FTLOSREntry.cpp:
+
+2014-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Fix windows
+
+        * generate-js-builtins:
+
+2014-01-31  Oliver Hunt  <oliver@apple.com>
+
+        Fix 32bit.
+
+        * jit/JITPropertyAccess32_64.cpp:
+
+2014-01-31  Mark Lam  <mark.lam@apple.com>
+
+        Add options to force debugger / profiler bytecode generation.
+        <https://webkit.org/b/128014>
+
+        Reviewed by Oliver Hunt.
+
+        Add Options::forceDebuggerBytecodeGeneration() and
+        Options::forceProfilerBytecodeGeneration(). These options make it more
+        convenient to do correctness testing when debugger / profiler bytecodes
+        are generated.
+
+        These options are disabled by default.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * runtime/Options.h:
+
+2014-01-29  Oliver Hunt  <oliver@apple.com>
+
+        Make it possible to implement JS builtins in JS
+        https://bugs.webkit.org/show_bug.cgi?id=127887
+
+        Reviewed by Michael Saboff.
+
+        This patch makes it possible to write builtin functions in JS.
+        The bindings, generators, and definitions are all created automatically
+        based on js files in the builtins/ directory.  This patch includes one
+        such case: Array.prototype.js with an implementation of every().
+
+        There's a lot of refactoring to make it possible for CommonIdentifiers
+        to include the output of the generated files (DerivedSources/JSCBuiltins.{h,cpp})
+        without breaking the offset extractor. The result of this refactoring
+        is that CommonIdentifiers, and a few other miscellaneous headers now
+        need to be included directly as they were formerly captured through other
+        paths.
+
+        In addition this adds a flag to the Lookup table's hashentry to indicate
+        that a static function is actually backed by JS. There is then a lot of
+        logic to thread the special nature of the functon to where it matters.
+        This allows toString(), .caller, etc to mimic the behaviour of a host
+        function.
+
+        Notes on writing builtins:
+         - Each function is compiled independently of the others, and those
+           implementations cannot currently capture all global properties (as
+           that could be potentially unsafe). If a function does capture a
+           global we will deliberately crash.
+         - For those "global" properties that we do want access to, we use
+           the @ prefix, e.g. Object(this) becomes @Object(this). The @ identifiers
+           are private names, and behave just like regular properties, only
+           without the risk of adulteration. Again, in the @Object case, we
+           explicitly duplicate the ObjectConstructor reference on the GlobalObject
+           so that we have guaranteed access to the original version of the
+           constructor.
+         - call, apply, eval, and Function are all rejected identifiers, again
+           to prevent anything from accidentally using an adulterated object.
+           Instead @call and @apply are available, and happily they completely
+           drop the neq_ptr instruction as they're defined as always being the
+           original call/apply functions.
+
+        These restrictions are just intended to make it harder to accidentally
+        make changes that are incorrect (for instance calling whatever has been
+        assigned to global.Object, instead of the original constructor function).
+        However, making a mistake like this should result in a purely semantic
+        error as fundamentally these functions are treated as though they were
+        regular JS code in the host global, and have no more privileges than
+        any other JS.
+
+        The initial proof of concept is Array.prototype.every, this shows a 65%
+        performance improvement, and that improvement is significantly hurt by
+        our poor optimisation of op_in.
+
+        As this is such a limited function, we have not yet exported all symbols
+        that we could possibly need, but as we implement more, the likelihood
+        of encountering missing features will reduce.
+
+        This did require breaking out a JSStringInlines header, and required
+        fixing a few objects that were trying to using PropertyName::publicName
+        rather than PropertyName::uid.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
+        (JSC::JSCallbackObject<Parent>::put):
+        (JSC::JSCallbackObject<Parent>::deleteProperty):
+        (JSC::JSCallbackObject<Parent>::getStaticValue):
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/Array.prototype.js:
+        (every):
+        * builtins/BuiltinExecutables.cpp: Added.
+        (JSC::BuiltinExecutables::BuiltinExecutables):
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * builtins/BuiltinExecutables.h:
+        (JSC::BuiltinExecutables::create):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::UnlinkedFunctionExecutable::create):
+        (JSC::UnlinkedFunctionExecutable::toStrictness):
+        (JSC::UnlinkedFunctionExecutable::isBuiltinFunction):
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isBuiltinFunction):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * create_hash_table:
+        * dfg/DFGOperations.cpp:
+        * generate-js-builtins: Added.
+        (getCopyright):
+        (getFunctions):
+        (generateCode):
+        (mangleName):
+        (FunctionExecutable):
+        (Identifier):
+        (JSGlobalObject):
+        (SourceCode):
+        (UnlinkedFunctionExecutable):
+        (VM):
+        * interpreter/Interpreter.cpp:
+        * interpreter/ProtoCallFrame.cpp:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITOperations.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jsc.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::isSafeIdentifier):
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        (JSC::isSafeIdentifier):
+        (JSC::Lexer<T>::lexExpectIdentifier):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::setClosedVariables):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::capturedVariables):
+        (JSC::ScopeNode::setClosedVariables):
+        (JSC::ProgramNode::closedVariables):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::didFinishParsing):
+        (JSC::Parser<LexerType>::printUnexpectedTokenText):
+        * parser/Parser.h:
+        (JSC::Scope::getUsedVariables):
+        (JSC::Parser::closedVariables):
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * parser/ParserTokens.h:
+        * runtime/ArgList.cpp:
+        * runtime/Arguments.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArgumentsIteratorConstructor.cpp:
+        * runtime/ArgumentsIteratorPrototype.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        (JSC::CommonIdentifiers::getPrivateName):
+        (JSC::CommonIdentifiers::getPublicName):
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CommonSlowPathsExceptions.cpp:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::executableInfo):
+        (JSC::ProgramExecutable::executableInfo):
+        (JSC::FunctionExecutable::isBuiltinFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArgumentsIterator.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSArrayIterator.cpp:
+        * runtime/JSCJSValue.cpp:
+        * runtime/JSCellInlines.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::createBuiltinFunction):
+        (JSC::JSFunction::calculatedDisplayName):
+        (JSC::JSFunction::sourceCode):
+        (JSC::JSFunction::isHostOrBuiltinFunction):
+        (JSC::JSFunction::isBuiltinFunction):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSFunction.h:
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        * runtime/JSGenericTypedArrayViewPrototypeInlines.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::objectConstructor):
+        (JSC::JSGlobalObject::symbolTableHasProperty):
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        (JSC::JSObject::putDirectBuiltinFunction):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSString.h:
+        * runtime/JSStringInlines.h: Added.
+        (JSC::JSString::getStringPropertySlot):
+        (JSC::inlineJSValueNotStringtoString):
+        (JSC::JSValue::toWTFStringInline):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+           Don't report private names.
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::builtinGenerator):
+        (JSC::HashEntry::propertyGetter):
+        (JSC::HashEntry::propertyPutter):
+        (JSC::HashTable::entry):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::putEntry):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/PropertySlot.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/SetConstructor.cpp:
+        * runtime/StringObject.cpp:
+        * runtime/Structure.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::builtinExecutables):
+
+2014-01-31  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Fix the ARM Thumb2 build after jsCStack branch merge
+        https://bugs.webkit.org/show_bug.cgi?id=127903
+
+        Reviewed by Michael Saboff.
+
+        SP register cannot be used as a destination register of SUB or ADD on Thumb mode.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+
+2014-01-31  Julien Brianceau  <jbriance@cisco.com>
+
+        [arm] Add missing pushPair/popPair implementations in MacroAssemblerARM.h
+        https://bugs.webkit.org/show_bug.cgi?id=127904
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::popPair):
+        (JSC::MacroAssemblerARM::pushPair):
+
+2014-01-30  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [CMake] Add support for building against GTK+ 2
+        https://bugs.webkit.org/show_bug.cgi?id=127959
+
+        Reviewed by Anders Carlsson.
+
+        * PlatformGTK.cmake: Use the new API version variable and don't use GTK3 directly.
+
+2014-01-30  Andreas Kling  <akling@apple.com>
+
+        CodeBlock's cloned SymbolTables only need the captured names.
+        <https://webkit.org/b/127978>
+
+        Renamed SymbolTable::clone() to SymbolTable::cloneCapturedNames()
+        and make it skip over any symbols that aren't captured, since those
+        won't be needed after codegen.
+
+        This is a first step towards getting rid of redundant symbol tables.
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::cloneCapturedNames):
+        * runtime/SymbolTable.h:
+
+2014-01-28  Timothy Hatcher  <timothy@apple.com>
+
+        Add column number and call timing support to LegacyProfiler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=127764
+
+        Reviewed by Joseph Pecoraro.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::CallIdentifier):
+        (JSC::CallIdentifier::functionName):
+        (JSC::CallIdentifier::url):
+        (JSC::CallIdentifier::lineNumber):
+        (JSC::CallIdentifier::columnNumber):
+        (JSC::CallIdentifier::operator==):
+        (JSC::CallIdentifier::operator!=):
+        (JSC::CallIdentifier::Hash::hash):
+        (WTF::HashTraits<JSC::CallIdentifier>::constructDeletedValue):
+        (WTF::HashTraits<JSC::CallIdentifier>::isDeletedValue):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::willExecute):
+        (JSC::LegacyProfiler::didExecute):
+        (JSC::LegacyProfiler::exceptionUnwind):
+        (JSC::LegacyProfiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/LegacyProfiler.h:
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * profiler/Profile.h:
+        (JSC::Profile::uid):
+        (JSC::Profile::idleTime):
+        (JSC::Profile::setIdleTime):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::AddParentForConsoleStartFunctor::operator()):
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::ProfileGenerator::stopProfiling):
+        (JSC::ProfileGenerator::removeProfileStart):
+        (JSC::ProfileGenerator::removeProfileEnd):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::stopProfiling):
+        (JSC::ProfileNode::endAndRecordCall):
+        (JSC::ProfileNode::startTimer):
+        (JSC::ProfileNode::debugPrintData):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::Call::Call):
+        (JSC::ProfileNode::Call::startTime):
+        (JSC::ProfileNode::Call::setStartTime):
+        (JSC::ProfileNode::Call::totalTime):
+        (JSC::ProfileNode::Call::setTotalTime):
+        (JSC::ProfileNode::id):
+        (JSC::ProfileNode::functionName):
+        (JSC::ProfileNode::url):
+        (JSC::ProfileNode::lineNumber):
+        (JSC::ProfileNode::columnNumber):
+        (JSC::ProfileNode::calls):
+        (JSC::ProfileNode::lastCall):
+        (JSC::ProfileNode::numberOfCalls):
+
+2014-01-26  Timothy Hatcher  <timothy@apple.com>
+
+        Include profile with FunctionCall and EvaluateScript Timeline records.
+
+        https://bugs.webkit.org/show_bug.cgi?id=127663
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::callFunctionWithEvalEnabled):
+        * inspector/InspectorEnvironment.h:
+        * inspector/JSGlobalObjectInspectorController.h:
+
+2014-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support GetById(Untyped:)
+        https://bugs.webkit.org/show_bug.cgi?id=127750
+
+        Reviewed by Oliver Hunt.
+        
+        This was supposed to be easy. Indeed, the actual GetById UntypedUse case was easy. But
+        then it expanded coverage by a lot and I got to deal with three bugs. So, this has
+        some additional changes:
+        
+        Also make it safe for LLVM to duplicate calls to patchpoints and stackmaps. Previously
+        we incorrectly assumed that if we emitted a patchpoint, then there would only be one
+        copy of that patchpoint (with that ID) in the resulting machine code and in the
+        stackmaps section. That's obviously a bad assumption - LLVM is allowed to do anything
+        it wants so long as the outcome of executing the code has a semantically equivalent
+        meaning to the IR we gave it, and duplicating code is trivially OK under this rule. We
+        should be OK with it, too. The solution is to add Vectors in a bunch of places that
+        previously just thought they only had one value. For example, an InlineCacheDescriptor
+        now has a Vector of generators - one generator for each copy that LLVM stamped out.
+        Normally there will only be one copy, of course - since duplication is usually
+        unprofitable. But, if LLVM decides that copying would be groovy then we will no longer
+        barf.
+        
+        Also fix SSA conversion. It turns out that we mishandled the case where a block had
+        multiple Phi functions for the same local. If any of those CPS Phis fail to trivialize
+        in the Aycock-Horspool fixpoint, we need to insert an SSA Phi. Previously, it was
+        assuming that so long as the head CPS Phi was trivial, we could forego SSA Phi
+        insertion. That's wrong if the head CPS Phi trivialized but ended up pointing to a
+        non-trivial CPS Phi in the same block. This madness with trees of Phis occurs because
+        we try to save on compile times: no Phi ever has more than three children even if the
+        block has more than three predecessors; we just build out a tree of Phis to satisfy
+        all predecessors. So weird.
+        
+        And finally, fix DFG->FTL OSR entry's reconstruction of 'this' in a constructor. That
+        reconstruction code, JITCode::reconstruct(), had a work-around for the case where we
+        were entering into a constructor at the prologue. In that case, 'this' is definitely
+        unavailable. But the OSR code does reconstructions at LoopHints, which aren't at the
+        prologue, and so 'this' should totally be available.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::tryGetVariableAccessData):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::generateICFastPath):
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLInlineCacheDescriptor.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::codeSize):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::JSCall):
+        * ftl/FTLJSCall.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::getById):
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::getRecordMap):
+        * ftl/FTLStackMaps.h:
+        * tests/stress/get-by-id-untyped.js: Added.
+        (foo):
+
+2014-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Part 2: REGRESSION: JavascriptCore crash during OS Installation (due to
+        Heap::m_operationInProgress ASSERT vs DelayedReleaseScope)
+        https://bugs.webkit.org/show_bug.cgi?id=127950
+
+        Reviewed by Mark Hahnenberg.
+
+        Scope the APICallbackShim to make sure that we re-acquire the lock
+        before putting the heap back into the "unsafe to allocate" state.
+        Otherwise, the heap will seem to be in the "unsafe to allocate" state
+        during any GC that happens before we re-acquire the lock.
+
+        No regression test because threads.
+
+        * heap/DelayedReleaseScope.h:
+        (JSC::DelayedReleaseScope::~DelayedReleaseScope):
+
+2014-01-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Update FTL StackMaps parser to stackSize change
+        https://bugs.webkit.org/show_bug.cgi?id=127933
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::parse):
+
+2014-01-30  Zan Dobersek  <zdobersek@igalia.com>
+
+        [GTK] Only disable -ftree-dce optimization when compiling with GCC
+        https://bugs.webkit.org/show_bug.cgi?id=127911
+
+        Reviewed by Carlos Garcia Campos.
+
+        * GNUmakefile.am: Only disable the -ftree-dce optimization when using the GCC compiler.
+        Some Clang versions/configurations don't support the flag.
+
+2014-01-30  Zan Dobersek  <zdobersek@igalia.com>
+
+        [GTK] Disable optimizations for JSC that turned out malignant after jsCStack branch merge
+        https://bugs.webkit.org/show_bug.cgi?id=127909
+
+        Reviewed by Carlos Garcia Campos.
+
+        * GNUmakefile.am: Disable the -fomit-frame-pointer optimization to achieve proper register usage
+        in operationCallEval. Disable the -ftree-dce optimization since it is causing additional failures
+        when using GCC 4.8, possibly due to a bug in the compiler itself.
+
+2014-01-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove ENABLE(JAVASCRIPT_DEBUGGER) leftovers
+        https://bugs.webkit.org/show_bug.cgi?id=127845
+
+        Reviewed by Joseph Pecoraro.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-01-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Play Breakpoint Sound in Frontend
+        https://bugs.webkit.org/show_bug.cgi?id=127885
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/ScriptDebugListener.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionSound):
+        * inspector/ScriptDebugServer.h:
+        Pass the breakpoint action identifier through when the
+        sound breakpoint action is triggered.
+
+        * inspector/protocol/Debugger.json:
+        New "playBreakpointActionSound" event when a "sound" breakpoint action triggers.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::breakpointActionSound):
+        Send the new event so the frontend can handle it.
+
+2014-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge final changesets from the jsCStack branch (r162969, r162975, r162992, r163004, r163069).
+
+    2014-01-29  Filip Pizlo  <fpizlo@apple.com>
+    
+            DFG ArrayPop double array mishandles the NaN hole installation
+            https://bugs.webkit.org/show_bug.cgi?id=127813
+    
+            Reviewed by Mark Rowe.
+            
+            Our object model for arrays inferred double dictates that we use quiet NaN (QNaN) to
+            mark holes. Holes, in this context, are any entries in the allocated array buffer
+            (i.e. from index 0 up to the vectorLength) that don't currently hold a value. Popping
+            creates a hole, since it deletes the value at publicLength - 1.
+            
+            But, because of some sloppy copy-and-paste, we were storing (int64_t)0 when creating
+            the hole, instead of storing QNaN. That's likely because for other kinds of arrays,
+            64-bit zero is the hole marker, instead of QNaN.
+            
+            The attached test case illustrates the problem. In the LLInt and Baseline JIT, the
+            result returned from foo() is "1.5,2.5,,4.5", since array.pop() removes 3.5 and
+            replaces it with a hole and then the assignment "array[3] = 4.5" creates an element
+            just beyond that hole. But, once we tier-up to the DFG, the result previously became
+            "1.5,2.5,0,4.5", which is wrong. The 0 appeared because the IEEE double
+            interpretation of 64-bit zero is simply zero.
+            
+            This patch fixes that problem. Now the DFG agrees with the other engines.
+            
+            This patch also fixes style. For some reason that copy-pasted code wasn't even
+            indented correctly.
+    
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * tests/stress/array-pop-double-hole.js: Added.
+            (foo):
+    
+    2014-01-28  Filip Pizlo  <fpizlo@apple.com>
+    
+            FTL should support ArrayPush
+            https://bugs.webkit.org/show_bug.cgi?id=127748
+    
+            Not reviewed, remove some debug code.
+    
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+    
+    2014-01-27  Filip Pizlo  <fpizlo@apple.com>
+    
+            FTL should support ArrayPush
+            https://bugs.webkit.org/show_bug.cgi?id=127748
+    
+            Reviewed by Oliver Hunt.
+    
+            * ftl/FTLAbstractHeapRepository.h:
+            (JSC::FTL::AbstractHeapRepository::forArrayType):
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLIntrinsicRepository.h:
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+            (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+            * tests/stress/array-push-contiguous.js: Added.
+            (foo):
+            * tests/stress/array-push-double.js: Added.
+            (foo):
+    
+    2014-01-28  Filip Pizlo  <fpizlo@apple.com>
+    
+            FTL should support ArrayPop
+            https://bugs.webkit.org/show_bug.cgi?id=127749
+    
+            Reviewed by Geoffrey Garen.
+    
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLIntrinsicRepository.h:
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+            (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+            (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
+            * tests/stress/array-pop-contiguous.js: Added.
+            (foo):
+            * tests/stress/array-pop-double.js: Added.
+            (foo):
+            * tests/stress/array-pop-int32.js: Added.
+            (foo):
+    
+2014-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ByteCodeParser::m_dfgCodeBlock is sometimes uninitialized
+        <rdar://problem/15939032>
+
+        Reviewed by Dan Bernstein.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+
+2014-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        50% time on Dromaeo Selector * benchmark spent allocating oversized backing stores (but not in Chrome)
+        https://bugs.webkit.org/show_bug.cgi?id=127879
+
+        Reviewed by Gavin Barraclough.
+
+        Let's not dynamically resize an array whose size is statically known,
+        mmmkay?
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat): Use nullptr to disambiguate vs the numeric
+        argument.
+
+        (JSC::arrayProtoFuncSlice): The fix.
+
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap): Use nullptr.
+
+2014-01-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Run JSC Inspector EventLoop in a custom run loop mode to prevent default observers from running
+        https://bugs.webkit.org/show_bug.cgi?id=127865
+
+        Reviewed by Geoffrey Garen.
+
+        When hitting a breakpoint in a JSContext Inspector we want to entirely
+        pause the process and all access to the JSContext and only move forward
+        based on debugger commands. Having the nested run loop run in a default
+        mode allowed NSTimers scheduled on the thread to regularly run and
+        evaluate code in the JSContext. Using a custom run loop mode gets us
+        a bit closer to locking down the context. This doesn't handle scenarios
+        where background threads also access the JSContext, but it handles the
+        most common scenario.
+
+        * inspector/EventLoop.cpp:
+        (Inspector::EventLoop::cycle):
+
+2014-01-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Deadlock hitting breakpoint while inspecting JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=127864
+
+        Reviewed by Geoffrey Garen.
+
+        Temporarily drop the lock while we run the nested runloop.
+
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        (Inspector::JSGlobalObjectScriptDebugServer::runEventLoopWhilePaused):
+
+2014-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Make DOM attributes appear to be faux accessor properties
+        https://bugs.webkit.org/show_bug.cgi?id=127797
+
+        Reviewed by Michael Saboff.
+
+        Add flag so we can identify which properties should have the old
+        custom property semantics vs. the new faux accessors. Update the
+        inspector protocol accordingly.
+
+        These faux accessors produce descriptors with "get" and "set"
+        properties, but both values are undefined so can't be used
+        directly. A few custom properties actually require their
+        existing magical behaviour, so we now have a flag to 
+        distinguish the expected output.
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setCustomDescriptor):
+        * runtime/PropertyDescriptor.h:
+        * runtime/PropertySlot.h:
+
+2014-01-29  Beth Dakin  <bdakin@apple.com>
+
+        Build fix.
+
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        * llint/LowLevelInterpreter.cpp:
+
+2014-01-29  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp: Added a newline at the end of the
+        file.
+
+2014-01-28  Michael Saboff  <msaboff@apple.com>
+
+        Merge the jsCStack branch
+        https://bugs.webkit.org/show_bug.cgi?id=127763
+
+        Reviewed by Mark Hahnenberg.
+
+        Changes from http://svn.webkit.org/repository/webkit/branches/jsCStack
+        up to changeset 162958.
+
+2014-01-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove ENABLE(JAVASCRIPT_DEBUGGER) guards
+        https://bugs.webkit.org/show_bug.cgi?id=127840
+
+        Reviewed by Mark Lam.
+
+        * inspector/scripts/CodeGeneratorInspector.py:
+
+2014-01-28  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r162987.
+        http://trac.webkit.org/changeset/162987
+        https://bugs.webkit.org/show_bug.cgi?id=127825
+
+        Broke Mountain Lion build (Requested by andersca on #webkit).
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/PropertyDescriptor.cpp:
+        * runtime/PropertyDescriptor.h:
+        * runtime/PropertySlot.h:
+
+2014-01-28  Oliver Hunt  <oliver@apple.com>
+
+        Make DOM attributes appear to be faux accessor properties
+        https://bugs.webkit.org/show_bug.cgi?id=127797
+
+        Reviewed by Michael Saboff.
+
+        Add flag so we can identify which properties should have the old
+        custom property semantics vs. the new faux accessors. Update the
+        inspector protocol accordingly.
+
+        These faux accessors produce descriptors with "get" and "set"
+        properties, but both values are undefined so can't be used
+        directly. A few custom properties actually require their
+        existing magical behaviour, so we now have a flag to 
+        distinguish the expected output.
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setCustomDescriptor):
+        * runtime/PropertyDescriptor.h:
+        * runtime/PropertySlot.h:
+
+2014-01-28  Mark Lam  <mark.lam@apple.com>
+
+        Remove some unneeded debugger code.
+        https://bugs.webkit.org/show_bug.cgi?id=127805.
+
+        Reviewed by Oliver Hunt.
+
+        JSC will now always support the debugger. Hence, the #if ENABLE(JAVASCRIPT_DEBUGGER)
+        checks can be removed.
+
+        DebuggerCallFrame::callFrame() is also unused and will be removed.
+
+        * debugger/Breakpoint.h:
+        * debugger/Debugger.cpp:
+        * debugger/DebuggerCallFrame.h:
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::wrapCallFrames):
+        * inspector/InjectedScript.h:
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        * inspector/JSGlobalObjectScriptDebugServer.h:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        * inspector/JSJavaScriptCallFramePrototype.h:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/ScriptDebugListener.h:
+        * inspector/ScriptDebugServer.cpp:
+        * inspector/ScriptDebugServer.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (Inspector::setPauseOnExceptionsState):
+        (Inspector::InspectorRuntimeAgent::evaluate):
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        * inspector/agents/InspectorRuntimeAgent.h:
+
+2014-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: JavascriptCore crash during OS Installation (due to
+        Heap::m_operationInProgress ASSERT vs DelayedReleaseScope)
+        https://bugs.webkit.org/show_bug.cgi?id=127793
+
+        Reviewed by Mark Hahnenberg.
+
+        This was a mistaken ASSERT.
+
+        * API/tests/testapi.mm:
+        (-[EvilAllocationObject doEvilThingsWithContext:]): Added a test to verify
+        that GC from a DelayedReleaseScope doesn't crash.
+
+        * heap/DelayedReleaseScope.h:
+        (JSC::DelayedReleaseScope::~DelayedReleaseScope): Our contract is that
+        it is valid to do anything while running a DelayedReleaseScope -dealloc
+        method, so the Heap must be ready for new allocations and collections.
+
+        Change the Heap's operationInProgress value to NoOperation while running
+        -dealloc methods, so that it doesn't ASSERT in the face of new allocations
+        and collections.
+
+        * heap/Heap.h: Made DelayedReleaseScope a friend because exposing a setter
+        for m_operationInProgress seemed like the worse of the two options for
+        encapsulation: we don't really want arbitrary clients to set the Heap's
+        m_operationInProgress.
+
+2014-01-28  Mark Lam  <mark.lam@apple.com>
+
+        Jettison DFG code when neither breakpoints or the profiler are active.
+        <https://webkit.org/b/127766>
+
+        Reviewed by Geoffrey Garen.
+
+        We need to jettison the DFG CodeBlocks under the following circumstances:
+        1. When adding breakpoints to a CodeBlock, jettison it if it is a DFG CodeBlock.
+        2. When enabling stepping mode in a CodeBlock, jettison it if it a DFG CodeBlock.
+        3. When settign the enabled profiler in the VM, we need to jettison all DFG
+           CodeBlocks.
+
+        Instead of emitting speculation checks, the DFG code will now treat Breakpoint,
+        ProfileWillCall, and ProfileDidCall as no-ops similar to a Phantom node. We
+        still need to track these nodes so that they match the corresponding opcodes
+        in the baseline JIT when we jettison and OSR exit. Without them, we would OSR
+        exit to the wrong location in the baseline JIT code.
+
+        In DFGDriver's compileImpl() and DFGPlan's finalizeWithoutNotifyingCallback()
+        we fail the compilation effort with a CompilationInvalidated result. This allows
+        the DFG compiler to re-attampt the compilation of the function after some time
+        if it is hot. The CompilationInvalidated result is supposed to cause the DFG
+        to exercise an exponential back off before re-attempting compilation again
+        (see runtime/CompilationResult.h).
+
+        This patch improves the Octane score from ~2950 to ~3067.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::addBreakpoint):
+        (JSC::CodeBlock::setSteppingMode):
+        * bytecode/CodeBlock.h:
+        * debugger/Debugger.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::startProfiling):
+        (JSC::LegacyProfiler::stopProfiling):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::SetEnabledProfilerFunctor::operator()):
+        (JSC::VM::setEnabledProfiler):
+        * runtime/VM.h:
+        (JSC::VM::enabledProfiler):
+
+2014-01-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        -[JSContext evaluteScript:] calls JSEvaluteScript with startingLineNumber 0, later interpreted as a oneBasedInt
+        https://bugs.webkit.org/show_bug.cgi?id=127648
+
+        Reviewed by Geoffrey Garen.
+
+        The actual bug being fixed here is that the line number for
+        scripts evaluated via the JSC APIs is now sane. However,
+        there is no good infrastructure in place right now to test that.
+
+        * API/tests/testapi.c:
+        (main):
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI):
+        Add tests for exception line numbers and handling of bad
+        startingLineNumbers in public APIs. These tests were already
+        passing, I just add them to make sure they are not regressed
+        in the future.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSBase.h:
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        * API/JSObjectRef.h:
+        * API/JSScriptRef.cpp:
+        * API/JSScriptRefPrivate.h:
+        * API/JSStringRef.h:
+        - Clarify documentation that startingLineNumber is 1 based and clamped.
+        - Add clamping in the implementation to put sane values into JSC::SourceProvider.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        Remove the FIXME now that the SourceProvider is giving us expected values.
+
+2014-01-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: CRASH when debugger closes remote inspecting JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=127738
+
+        Reviewed by Timothy Hatcher.
+
+        RemoteInspectorXPCConnection could be accessed in a background dispatch
+        queue, while being deallocated on the main thread when a connection
+        was suddenly terminated.
+
+        Make RemoteInspectorXPCConnection a ThreadSafeRefCounted object. Always
+        keep the connection object ref'd until the main thread calls close()
+        and removes its reference. At that point we can close the connection,
+        queue, and deref safely on the background queue.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        For simplicity RemoteInspectorXPCConnections's don't have any threading
+        primatives to prevent client callbacks after they are closed. RemoteInspector
+        does, so it just ignores possible callbacks from connections it no longer
+        cares about.
+
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::RemoteInspectorXPCConnection):
+        (Inspector::RemoteInspectorXPCConnection::~RemoteInspectorXPCConnection):
+        (Inspector::RemoteInspectorXPCConnection::close):
+        Keep the connection alive as long as the queue it can be used on
+        is alive. Clean up everything on the queue when close() is called.
+
+        (Inspector::RemoteInspectorXPCConnection::handleEvent):
+        Checking if closed here is not thread safe so it is meaningless.
+        Remove the check.
+
+        (Inspector::RemoteInspectorXPCConnection::sendMessage):
+        Bail based on the m_closed state.
+
+2014-01-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JavaScriptCore: Enable -Wimplicit-fallthrough and add FALLTHROUGH annotation where needed
+        https://bugs.webkit.org/show_bug.cgi?id=127647
+
+        Reviewed by Anders Carlsson.
+
+        Explicitly annotate switch case fallthroughs in JavaScriptCore and
+        enable warnings for unannotated fallthroughs.
+
+        * dfg/DFGArithMode.h:
+        (doesOverflow):
+        Only insert FALLTHROUGH in release builds. In debug builds, the
+        FALLTHROUGH would be unreachable (due to the ASSERT_NOT_REACHED)
+        and would through a warning.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        Due to the templatized nature of this function, a fallthrough
+        in one of the template expansions would be unreachable. Disable
+        the warning for this function.
+
+        * Configurations/Base.xcconfig:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseProperty):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::push):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        * runtime/JSObject.h:
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parseTokens):
+
+2014-01-27  Andy Estes  <aestes@apple.com>
+
+        Scrub WebKit API headers of WTF macros
+        https://bugs.webkit.org/show_bug.cgi?id=127706
+
+        Reviewed by David Kilzer.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_INSPECTOR.
+
+2014-01-27  Mark Lam  <mark.lam@apple.com>
+
+        Remove unused CodeBlock::createActivation().
+        <https://webkit.org/b/127686>
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+
+2014-01-26  Andreas Kling  <akling@apple.com>
+
+        JSC: Pack unlinked instructions harder.
+        <https://webkit.org/b/127660>
+
+        Store UnlinkedCodeBlock's instructions in a variable-length stream
+        to reduce memory usage. Compression rate ends up around 60-61%.
+
+        The format is very simple. Every instruction starts with a 1 byte
+        opcode. It's followed by an opcode-dependent number of argument
+        values, each encoded separately for maximum packing. There are
+        7 packed value formats:
+
+            5-bit positive integer
+            5-bit negative integer
+            13-bit positive integer
+            13-bit positive integer
+            5-bit constant register index
+            13-bit constant register index
+            32-bit value (fallback)
+
+        27.5 MB progression on Membuster3. (~2% of total memory.)
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/UnlinkedInstructionStream.h: Added.
+        (JSC::UnlinkedInstructionStream::count):
+        (JSC::UnlinkedInstructionStream::Reader::atEnd):
+        * bytecode/UnlinkedInstructionStream.cpp: Added.
+        (JSC::UnlinkedInstructionStream::Reader::Reader):
+        (JSC::UnlinkedInstructionStream::Reader::read8):
+        (JSC::UnlinkedInstructionStream::Reader::read32):
+        (JSC::UnlinkedInstructionStream::Reader::next):
+        (JSC::append8):
+        (JSC::append32):
+        (JSC::UnlinkedInstructionStream::UnlinkedInstructionStream):
+        (JSC::UnlinkedInstructionStream::unpackForDebugging):
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset):
+        (JSC::dumpLineColumnEntry):
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::setInstructions):
+        (JSC::UnlinkedCodeBlock::instructions):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::BytecodeGenerator::generate):
+
+2014-01-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Move InspectorDebuggerAgent into JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=127629
+
+        Rubber-stamped by Sam Weinig.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        - Add new files to the build.
+        - Also, since non REMOTE_INSPECTOR ports cannot yet connect to a
+          JSGlobalObject for inspection remove those files as they don't
+          need to be built.
+
+        * inspector/EventLoop.cpp: Added.
+        (Inspector::EventLoop::cycle):
+        * inspector/EventLoop.h: Added.
+        (Inspector::EventLoop::EventLoop):
+        (Inspector::EventLoop::ended):
+        Add a JavaScriptCore version of EventLoop. This is currently only
+        used by the Mac port for JSGlobalObject remote inspection. Keep
+        the WebCore/platform version alive because for the Mac port it does
+        slightly different things involving AppKit.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        Create DebuggerAgent and hook up ScriptDebugServer where needed.
+
+        * inspector/JSGlobalObjectScriptDebugServer.cpp: Added.
+        (Inspector::JSGlobalObjectScriptDebugServer::JSGlobalObjectScriptDebugServer):
+        (Inspector::JSGlobalObjectScriptDebugServer::addListener):
+        (Inspector::JSGlobalObjectScriptDebugServer::removeListener):
+        (Inspector::JSGlobalObjectScriptDebugServer::recompileAllJSFunctions):
+        (Inspector::JSGlobalObjectScriptDebugServer::runEventLoopWhilePaused):
+        * inspector/JSGlobalObjectScriptDebugServer.h: Added.
+        Simple implementation of ScriptDebugServer with a JSGlobalObject.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp: Renamed from Source/WebCore/inspector/InspectorDebuggerAgent.cpp.
+        * inspector/agents/InspectorDebuggerAgent.h: Renamed from Source/WebCore/inspector/InspectorDebuggerAgent.h.
+        Copied from WebCore. A few methods need to be made virtual so that Web implementations
+        can override and extend the funcitonality. E.g. sourceMapURLForScript and enable/disable.
+        
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp: Added.
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h: Added.
+        (Inspector::JSGlobalObjectDebuggerAgent::JSGlobalObjectDebuggerAgent):
+        (Inspector::JSGlobalObjectDebuggerAgent::startListeningScriptDebugServer):
+        (Inspector::JSGlobalObjectDebuggerAgent::stopListeningScriptDebugServer):
+        (Inspector::JSGlobalObjectDebuggerAgent::injectedScriptForEval):
+        Simple implementation of DebuggerAGent with a JSGlobalObject.
+
+2014-01-25  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix build breakage from previous commit.
+
+        Not reviewed.
+
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintData):
+        - Removed obsolete references to "visible" timers.
+
+2014-01-25  Timothy Hatcher  <timothy@apple.com>
+
+        Remove dead code from the JSC profiler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=127643
+
+        Reviewed by Mark Lam.
+
+        * profiler/Profile.cpp:
+        * profiler/Profile.h:
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::stopProfiling):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::stopProfiling):
+        (JSC::ProfileNode::endAndRecordCall):
+        (JSC::ProfileNode::debugPrintData):
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::totalTime):
+        (JSC::ProfileNode::setTotalTime):
+        (JSC::ProfileNode::selfTime):
+        (JSC::ProfileNode::setSelfTime):
+        (JSC::ProfileNode::totalPercent):
+        (JSC::ProfileNode::selfPercent):
+        Remove support for things like focus and exclude. The Inspector does those in JS now.
+
+2014-01-25  Sam Weinig  <sam@webkit.org>
+
+        Remove unused support for DRAGGABLE_REGION
+        https://bugs.webkit.org/show_bug.cgi?id=127642
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-01-25  Darin Adler  <darin@apple.com>
+
+        Try to fix Mac build.
+
+        * runtime/DatePrototype.cpp: Put the include of <unicode/udat.h> inside
+        a conditional since we don't have that header in our Mac build configuration.
+
+2014-01-25  Darin Adler  <darin@apple.com>
+
+        Call deprecatedCharacters instead of characters at more call sites
+        https://bugs.webkit.org/show_bug.cgi?id=127631
+
+        Reviewed by Sam Weinig.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::~OpaqueJSString):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::createSearchRegexSource):
+        * inspector/InspectorValues.cpp:
+        * runtime/Identifier.h:
+        (JSC::Identifier::deprecatedCharacters):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::append):
+        Use the new name.
+
+2014-01-25  Darin Adler  <darin@apple.com>
+
+        Get rid of ICU_UNICODE and WCHAR_UNICODE remnants
+        https://bugs.webkit.org/show_bug.cgi?id=127623
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/DatePrototype.cpp: Removed USE(ICU_UNICODE) checks, since that's always true now.
+
+2014-01-25  Darin Adler  <darin@apple.com>
+
+        [Mac] Rewrite locale-specific date formatting code to remove strange string creation
+        https://bugs.webkit.org/show_bug.cgi?id=127624
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate): Use some smart pointers and conversion operators we already
+        have to do the formatting in a more straightforward way.
+
+2014-01-25  Anders Carlsson  <andersca@apple.com>
+
+        Remove atomicIncrement/atomicDecrement
+        https://bugs.webkit.org/show_bug.cgi?id=127625
+
+        Reviewed by Andreas Kling.
+
+        Replace atomicIncrement/atomicDecrement with std::atomic.
+
+        * bytecode/Watchpoint.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::Database):
+        (JSC::Profiler::Database::addDatabaseToAtExit):
+
+2014-01-24  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Move InspectorRuntimeAgent into JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=127605
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add new files to the build.
+
+        * inspector/agents/InspectorRuntimeAgent.h: Renamed from Source/WebCore/inspector/InspectorRuntimeAgent.h.
+        * inspector/agents/InspectorRuntimeAgent.cpp: Renamed from Source/WebCore/inspector/InspectorRuntimeAgent.cpp.
+        (Inspector::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (Inspector::InspectorRuntimeAgent::parse):
+        (Inspector::InspectorRuntimeAgent::evaluate):
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        - Move the agent into JavaScriptCore.
+        - Modernize and cleanup.
+        - Make globalVM a pure virtual function for subclasses to implement.
+
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h: Added.
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp: Added.
+        (Inspector::JSGlobalObjectRuntimeAgent::JSGlobalObjectRuntimeAgent):
+        (Inspector::JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend):
+        (Inspector::JSGlobalObjectRuntimeAgent::willDestroyFrontendAndBackend):
+        (Inspector::JSGlobalObjectRuntimeAgent::globalVM):
+        (Inspector::JSGlobalObjectRuntimeAgent::injectedScriptForEval):
+        Straightforward JSGlobalObject implementation.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        Add a runtime agent when inspecting a JSContext!
+
+2014-01-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Move JavaScriptCallFrame and ScriptDebugServer into JavaScriptCore for inspector
+        https://bugs.webkit.org/show_bug.cgi?id=127543
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add new files.
+
+        * inspector/ScriptDebugListener.h:
+        Extract WebCore knowledge from ScriptDebugServer. This will
+        eventually be made to work outside of WebCore.
+
+        * inspector/ScriptDebugServer.h: Renamed from Source/WebCore/bindings/js/ScriptDebugServer.h.
+        * inspector/ScriptDebugServer.cpp: Renamed from Source/WebCore/bindings/js/ScriptDebugServer.cpp.
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction):
+        (Inspector::ScriptDebugServer::dispatchDidPause):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionLog):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionSound):
+        (Inspector::ScriptDebugServer::sourceParsed):
+        (Inspector::ScriptDebugServer::dispatchFunctionToListeners):
+        (Inspector::ScriptDebugServer::handlePause):
+        Modernize code, and call the new ScriptDebugListener callbacks where appropriate.
+
+        * inspector/JSJavaScriptCallFrame.cpp: Renamed from Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp.
+        (Inspector::JSJavaScriptCallFrame::JSJavaScriptCallFrame):
+        (Inspector::JSJavaScriptCallFrame::finishCreation):
+        (Inspector::JSJavaScriptCallFrame::createPrototype):
+        (Inspector::JSJavaScriptCallFrame::destroy):
+        (Inspector::JSJavaScriptCallFrame::releaseImpl):
+        (Inspector::JSJavaScriptCallFrame::~JSJavaScriptCallFrame):
+        (Inspector::JSJavaScriptCallFrame::evaluate):
+        (Inspector::JSJavaScriptCallFrame::scopeType):
+        (Inspector::JSJavaScriptCallFrame::caller):
+        (Inspector::JSJavaScriptCallFrame::sourceID):
+        (Inspector::JSJavaScriptCallFrame::line):
+        (Inspector::JSJavaScriptCallFrame::column):
+        (Inspector::JSJavaScriptCallFrame::functionName):
+        (Inspector::JSJavaScriptCallFrame::scopeChain):
+        (Inspector::JSJavaScriptCallFrame::thisObject):
+        (Inspector::JSJavaScriptCallFrame::type):
+        (Inspector::toJS):
+        (Inspector::toJSJavaScriptCallFrame):
+        * inspector/JSJavaScriptCallFrame.h: Added.
+        (Inspector::JSJavaScriptCallFrame::createStructure):
+        (Inspector::JSJavaScriptCallFrame::create):
+        (Inspector::JSJavaScriptCallFrame::impl):
+        * inspector/JSJavaScriptCallFramePrototype.cpp: Added.
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluate):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeType):
+        (Inspector::jsJavaScriptCallFrameAttributeCaller):
+        (Inspector::jsJavaScriptCallFrameAttributeSourceID):
+        (Inspector::jsJavaScriptCallFrameAttributeLine):
+        (Inspector::jsJavaScriptCallFrameAttributeColumn):
+        (Inspector::jsJavaScriptCallFrameAttributeFunctionName):
+        (Inspector::jsJavaScriptCallFrameAttributeScopeChain):
+        (Inspector::jsJavaScriptCallFrameAttributeThisObject):
+        (Inspector::jsJavaScriptCallFrameAttributeType):
+        (Inspector::jsJavaScriptCallFrameConstantGLOBAL_SCOPE):
+        (Inspector::jsJavaScriptCallFrameConstantLOCAL_SCOPE):
+        (Inspector::jsJavaScriptCallFrameConstantWITH_SCOPE):
+        (Inspector::jsJavaScriptCallFrameConstantCLOSURE_SCOPE):
+        (Inspector::jsJavaScriptCallFrameConstantCATCH_SCOPE):
+        * inspector/JSJavaScriptCallFramePrototype.h: Added.
+        (Inspector::JSJavaScriptCallFramePrototype::create):
+        (Inspector::JSJavaScriptCallFramePrototype::createStructure):
+        (Inspector::JSJavaScriptCallFramePrototype::JSJavaScriptCallFramePrototype):
+        * inspector/JavaScriptCallFrame.cpp: Renamed from Source/WebCore/bindings/js/JavaScriptCallFrame.cpp.
+        (Inspector::JavaScriptCallFrame::caller):
+        * inspector/JavaScriptCallFrame.h: Renamed from Source/WebCore/bindings/js/JavaScriptCallFrame.h.
+        Port of JavaScriptCallFrame.idl to a set of native JS classes.
+
+2014-01-24  Mark Lam  <mark.lam@apple.com>
+
+        DebuggerCallFrame::evaluateWithCallFrame() should not execute a null executable.
+        <https://webkit.org/b/127600>
+
+        Reviewed by Oliver Hunt.
+
+        In DebuggerCallFrame::evaluateWithCallFrame(), if the script string that
+        is passed in is bad, it will fail to create an Executable i.e.
+        EvalExecutable::create() returns a null pointer. However,
+        DebuggerCallFrame::evaluateWithCallFrame() was just clearing the
+        exception and proceeded to execute the null pointer as an Executable.
+        A crash ensues.
+
+        Now, if an exception is detected while creating the Executable, we
+        abort instead.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluateWithCallFrame):
+
+2014-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Put functions need to take a base object and a this value, and perform type checks on |this|
+        https://bugs.webkit.org/show_bug.cgi?id=127594
+
+        Reviewed by Geoffrey Garen.
+
+        Change the signature for static setter functions, and update uses
+
+        * create_hash_table:
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/PutPropertySlot.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+
+2014-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Generic JSObject::put should handle static properties in the classinfo hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=127523
+
+        Reviewed by Geoffrey Garen.
+
+        This patch makes JSObject::put correctly call static setters
+        defined by the ClassInfo.
+
+        To make this not clobber performance, the ClassInfo HashTable
+        now includes a flag to indicate that it contains setters. This
+        required updating the lut generator so that it tracked (and emitted)
+        this.
+
+        The rest of the change was making a number of the methods take
+        a VM rather than an ExecState*, so that Structure could set the
+        getter/setter flags during construction (if necessary).
+
+        This also means most objects do not need to perform a lookupPut
+        manually anymore, so most custom ::put's are no longer needed.
+        DOMWindow is the only exception as it has interesting security
+        related semantics.
+
+        * create_hash_table:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::arrayConstructorTable):
+        (JSC::ExecState::arrayPrototypeTable):
+        (JSC::ExecState::booleanPrototypeTable):
+        (JSC::ExecState::dataViewTable):
+        (JSC::ExecState::dateTable):
+        (JSC::ExecState::dateConstructorTable):
+        (JSC::ExecState::errorPrototypeTable):
+        (JSC::ExecState::globalObjectTable):
+        (JSC::ExecState::jsonTable):
+        (JSC::ExecState::numberConstructorTable):
+        (JSC::ExecState::numberPrototypeTable):
+        (JSC::ExecState::objectConstructorTable):
+        (JSC::ExecState::privateNamePrototypeTable):
+        (JSC::ExecState::regExpTable):
+        (JSC::ExecState::regExpConstructorTable):
+        (JSC::ExecState::regExpPrototypeTable):
+        (JSC::ExecState::stringConstructorTable):
+        (JSC::ExecState::promisePrototypeTable):
+        (JSC::ExecState::promiseConstructorTable):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::propHashTable):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertySlot):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertySlot):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getOwnPropertySlot):
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::getOwnPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::HashTable::copy):
+        (JSC::putEntry):
+        (JSC::lookupPut):
+        * runtime/NamePrototype.cpp:
+        (JSC::NamePrototype::getOwnPropertySlot):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+        (JSC::RegExpObject::put):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getOwnPropertySlot):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::freezeTransition):
+        (JSC::ClassInfo::hasStaticSetterOrReadonlyProperties):
+
+2014-01-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r162713.
+        http://trac.webkit.org/changeset/162713
+        https://bugs.webkit.org/show_bug.cgi?id=127593
+
+        broke media/network-no-source-const-shadow (Requested by
+        thorton on #webkit).
+
+        * create_hash_table:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::arrayConstructorTable):
+        (JSC::ExecState::arrayPrototypeTable):
+        (JSC::ExecState::booleanPrototypeTable):
+        (JSC::ExecState::dataViewTable):
+        (JSC::ExecState::dateTable):
+        (JSC::ExecState::dateConstructorTable):
+        (JSC::ExecState::errorPrototypeTable):
+        (JSC::ExecState::globalObjectTable):
+        (JSC::ExecState::jsonTable):
+        (JSC::ExecState::numberConstructorTable):
+        (JSC::ExecState::numberPrototypeTable):
+        (JSC::ExecState::objectConstructorTable):
+        (JSC::ExecState::privateNamePrototypeTable):
+        (JSC::ExecState::regExpTable):
+        (JSC::ExecState::regExpConstructorTable):
+        (JSC::ExecState::regExpPrototypeTable):
+        (JSC::ExecState::stringConstructorTable):
+        (JSC::ExecState::promisePrototypeTable):
+        (JSC::ExecState::promiseConstructorTable):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::propHashTable):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertySlot):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertySlot):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getOwnPropertySlot):
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::getOwnPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::HashTable::copy):
+        (JSC::putEntry):
+        (JSC::lookupPut):
+        * runtime/NamePrototype.cpp:
+        (JSC::NamePrototype::getOwnPropertySlot):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        (JSC::NumberConstructor::put):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        (JSC::RegExpConstructor::put):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+        (JSC::RegExpObject::put):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getOwnPropertySlot):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::freezeTransition):
+
+2014-01-24  Mark Lam  <mark.lam@apple.com>
+
+        ASSERT(!m_markedSpace.m_currentDelayedReleaseScope) reloading page in inspector.
+        <https://webkit.org/b/127582>
+
+        Reviewed by Mark Hahnenberg.
+
+        1. We should not enter a HeapIterationScope when we iterate the CodeBlocks.
+           Apparently, iterating the CodeBlocks does not count as heap iteration.
+
+        2. If we're detaching the debugger due to the JSGlobalObject destructing,
+           then we don't need to clear the debugger requests in the associated
+           CodeBlocks. The JSGlobalObject destructing would mean that those
+           CodeBlocks would be destructing too, and it may not be safe to access
+           them anyway at this point.
+
+        The assertion failure is because we had entered a HeapIterationScope
+        while the JSGlobalObject is destructing, which in turn means that GC
+        sweeping is in progress. It's not legal to iterate the heap while the GC
+        is sweeping. Once we fixed the above 2 issues, we will no longer have
+        the conditions that manifests this assertion failure.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::detach):
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::toggleBreakpoint):
+        (JSC::Debugger::clearBreakpoints):
+        (JSC::Debugger::clearDebuggerRequests):
+        * debugger/Debugger.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+
+2014-01-24  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Convert some NMake files to MSBuild project files
+        https://bugs.webkit.org/show_bug.cgi?id=127579
+
+        Reviewed by Tim Horton.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.make: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj: Added.
+
+2014-01-24  Mark Lam  <mark.lam@apple.com>
+
+        Fixed a bad assertion in CodeBlock::removeBreakpoint().
+        <https://webkit.org/b/127581>
+
+        Reviewed by Joseph Pecoraro.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::removeBreakpoint):
+
+2014-01-24  Joseph Pecoraro  <pecoraro@apple.com>
+
+        fast/profiler tests ASSERTing after moving recompileAllJSFunctions off a timer
+        https://bugs.webkit.org/show_bug.cgi?id=127566
+
+        Reviewed by Oliver Hunt.
+
+        Make the VM handle recompilation as soon as possible after it is requested.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        When in a JavaScript stack, mark for recompilation when possible.
+
+        * runtime/VMEntryScope.h:
+        (JSC::VMEntryScope::setRecompilationNeeded):
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::~VMEntryScope):
+        Handle recompilation when the top VMEntryScope is popped.
+        Pass the needs recompilation flag up the stack if needed.
+
+2014-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Generic JSObject::put should handle static properties in the classinfo hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=127523
+
+        Reviewed by Geoffrey Garen.
+
+        This patch makes JSObject::put correctly call static setters
+        defined by the ClassInfo.
+
+        To make this not clobber performance, the ClassInfo HashTable
+        now includes a flag to indicate that it contains setters. This
+        required updating the lut generator so that it tracked (and emitted)
+        this.
+
+        The rest of the change was making a number of the methods take
+        a VM rather than an ExecState*, so that Structure could set the
+        getter/setter flags during construction (if necessary).
+
+        This also means most objects do not need to perform a lookupPut
+        manually anymore, so most custom ::put's are no longer needed.
+        DOMWindow is the only exception as it has interesting security
+        related semantics.
+
+        * create_hash_table:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::arrayConstructorTable):
+        (JSC::ExecState::arrayPrototypeTable):
+        (JSC::ExecState::booleanPrototypeTable):
+        (JSC::ExecState::dataViewTable):
+        (JSC::ExecState::dateTable):
+        (JSC::ExecState::dateConstructorTable):
+        (JSC::ExecState::errorPrototypeTable):
+        (JSC::ExecState::globalObjectTable):
+        (JSC::ExecState::jsonTable):
+        (JSC::ExecState::numberConstructorTable):
+        (JSC::ExecState::numberPrototypeTable):
+        (JSC::ExecState::objectConstructorTable):
+        (JSC::ExecState::privateNamePrototypeTable):
+        (JSC::ExecState::regExpTable):
+        (JSC::ExecState::regExpConstructorTable):
+        (JSC::ExecState::regExpPrototypeTable):
+        (JSC::ExecState::stringConstructorTable):
+        (JSC::ExecState::promisePrototypeTable):
+        (JSC::ExecState::promiseConstructorTable):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::propHashTable):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertySlot):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertySlot):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getOwnPropertySlot):
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::getOwnPropertySlot):
+        * runtime/Lookup.h:
+        (JSC::HashTable::copy):
+        (JSC::putEntry):
+        (JSC::lookupPut):
+        * runtime/NamePrototype.cpp:
+        (JSC::NamePrototype::getOwnPropertySlot):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+        (JSC::RegExpObject::put):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getOwnPropertySlot):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::freezeTransition):
+        (JSC::ClassInfo::hasStaticSetterOrReadonlyProperties):
+
+2014-01-24  Mark Lam  <mark.lam@apple.com>
+
+        Skip op_profiler callbacks if !VM::m_enabledProfiler.
+        https://bugs.webkit.org/show_bug.cgi?id=127567.
+
+        Reviewed by Geoffrey Garen.
+
+        The profiler may not be always active (recording). When it's not active
+        (as in VM::m_enabledProfiler is null), then we might as well skip the
+        op_profiler callbacks. The callbacks themselves were already previously
+        gated by a VM::enabledProfiler() check. So, this change does not change
+        any profiler behavior.
+
+        For the DFG, we'll turn the op_profiler handling into speculation checks
+        and OSR exit to the baseline JIT if the profiler becomes active.
+
+        This brings the Octane score up to ~3000 from ~2840.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/VM.h:
+        (JSC::VM::enabledProfilerAddress):
+
+2014-01-24  Mark Lam  <mark.lam@apple.com>
+
+        Removing the need for Debugger* and m_shouldPause op_debug check.
+        <https://webkit.org/b/127532>
+
+        Reviewed by Geoffrey Garen.
+
+        This patch replaces the checking of the Debugger::m_shouldPause flag
+        with a procedure to set a SteppingMode flag on all CodeBlocks under
+        the management of the debugger. This simplifies the op_debug checking
+        logic in all the execution engines.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasDebuggerRequests):
+        (JSC::CodeBlock::debuggerRequestsAddress):
+        (JSC::CodeBlock::setSteppingMode):
+        (JSC::CodeBlock::clearDebuggerRequests):
+        - CodeBlock::m_debuggerRequests is a union of m_numBreakpoints and the
+          new m_steppingMode. The debugger can add/remove breakpoints to the
+          CodeBlock as well as set the stepping mode. By having
+          m_debuggerRequests as a union of the 2 bit fields, the op_debug code
+          can now check if any of the 2 requests made on the CodeBlock is still
+          in effect just by testing a single int.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::detach):
+        - This was bug from before where I forgot to clear the CodeBlock
+          breakpoints before detaching. We now take care of it by clearing all
+          debugger requests made to the CodeBlock.
+
+        (JSC::Debugger::SetSteppingModeFunctor::SetSteppingModeFunctor):
+        (JSC::Debugger::SetSteppingModeFunctor::operator()):
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor::ClearCodeBlockDebuggerRequestsFunctor):
+        (JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor::operator()):
+        (JSC::Debugger::clearBreakpoints):
+
+        (JSC::Debugger::ClearDebuggerRequestsFunctor::ClearDebuggerRequestsFunctor):
+        (JSC::Debugger::ClearDebuggerRequestsFunctor::operator()):
+        (JSC::Debugger::clearDebuggerRequests):
+        - We need a distinct clearDebuggerRequests() from clearBreakpoints()
+          because:
+          1. When we detach a globalObject, we only want to clear the debugger
+             requests in CodeBlocks from that global.
+          2. Clearing the debugger requests in the CodeBlocks is not the same
+             as clearing the breakpoints. The breakpoints are still in effect
+             for the next time a globalObject is attached, or for other
+             globalObjects that are still attached.
+
+        (JSC::Debugger::setPauseOnNextStatement):
+        (JSC::Debugger::breakProgram):
+        (JSC::Debugger::stepIntoStatement):
+        (JSC::Debugger::updateCallFrameAndPauseIfNeeded):
+        (JSC::Debugger::pauseIfNeeded):
+        (JSC::Debugger::exception):
+        (JSC::Debugger::willExecuteProgram):
+        (JSC::Debugger::didReachBreakpoint):
+        * debugger/Debugger.h:
+        - We're always going to support the debugger. So, there's no longer
+          a need to check ENABLE(JAVASCRIPT_DEBUGGER). Removed the unneeded code.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::debug):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setDebugger):
+
+2014-01-24  Michael Saboff  <msaboff@apple.com>
+
+        ARM Offline assembler temporary register allocator has duplicate register when building fat binaries
+        https://bugs.webkit.org/show_bug.cgi?id=127545
+
+        Reviewed by Mark Lam.
+
+        Eliminate the conditional addition of r11/r7 from getModifiedListARMCommon as the
+        .concat will add the new register to ARM_EXTRA_GPRS.  If getModifiedListARMCommon is
+        invoked a second time, there will be a second r11 or r7, which messes things up.
+        Instead, r6 was added to ARM_EXTRA_GPRS.  r6 is currently an unused register.
+
+        * offlineasm/arm.rb:
+
+2014-01-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Move ContentSearchUtils, ScriptBreakpoint, and ScriptDebugListener into JavaScriptCore for inspector
+        https://bugs.webkit.org/show_bug.cgi?id=127537
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/ContentSearchUtilities.cpp: Renamed from Source/WebCore/inspector/ContentSearchUtils.cpp.
+        (Inspector::ContentSearchUtilities::createSearchRegexSource):
+        (Inspector::ContentSearchUtilities::sizetExtractor):
+        (Inspector::ContentSearchUtilities::textPositionFromOffset):
+        (Inspector::ContentSearchUtilities::getRegularExpressionMatchesByLines):
+        (Inspector::ContentSearchUtilities::lineEndings):
+        (Inspector::ContentSearchUtilities::buildObjectForSearchMatch):
+        (Inspector::ContentSearchUtilities::createSearchRegex):
+        (Inspector::ContentSearchUtilities::countRegularExpressionMatches):
+        (Inspector::ContentSearchUtilities::searchInTextByLines):
+        (Inspector::ContentSearchUtilities::scriptCommentPattern):
+        (Inspector::ContentSearchUtilities::stylesheetCommentPattern):
+        (Inspector::ContentSearchUtilities::findMagicComment):
+        (Inspector::ContentSearchUtilities::findScriptSourceURL):
+        (Inspector::ContentSearchUtilities::findScriptSourceMapURL):
+        (Inspector::ContentSearchUtilities::findStylesheetSourceMapURL):
+        * inspector/ContentSearchUtilities.h: Renamed from Source/WebCore/inspector/ContentSearchUtils.h.
+        * inspector/ScriptBreakpoint.h: Renamed from Source/WebCore/inspector/ScriptBreakpoint.h.
+        (Inspector::ScriptBreakpointAction::ScriptBreakpointAction):
+        (Inspector::ScriptBreakpoint::ScriptBreakpoint):
+        * inspector/ScriptDebugListener.h: Renamed from Source/WebCore/inspector/ScriptDebugListener.h.
+        (Inspector::ScriptDebugListener::Script::Script):
+        (Inspector::ScriptDebugListener::~ScriptDebugListener):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+
+2014-01-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Move RegularExpression into JavaScriptCore for inspector
+        https://bugs.webkit.org/show_bug.cgi?id=127526
+
+        Reviewed by Geoffrey Garen.
+
+        Move RegularExpression into JavaScriptCore/yarr so it can
+        be used later on by JavaScriptCore/inspector. Convert to
+        the JSC::Yarr namespace.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * yarr/RegularExpression.cpp: Renamed from Source/WebCore/platform/text/RegularExpression.cpp.
+        (JSC::Yarr::RegularExpression::Private::create):
+        (JSC::Yarr::RegularExpression::Private::Private):
+        (JSC::Yarr::RegularExpression::Private::compile):
+        (JSC::Yarr::RegularExpression::RegularExpression):
+        (JSC::Yarr::RegularExpression::~RegularExpression):
+        (JSC::Yarr::RegularExpression::operator=):
+        (JSC::Yarr::RegularExpression::match):
+        (JSC::Yarr::RegularExpression::searchRev):
+        (JSC::Yarr::RegularExpression::matchedLength):
+        (JSC::Yarr::replace):
+        (JSC::Yarr::RegularExpression::isValid):
+        * yarr/RegularExpression.h: Renamed from Source/WebCore/platform/text/RegularExpression.h.
+
+2014-01-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove recompileAllJSFunctions timer in ScriptDebugServer
+        https://bugs.webkit.org/show_bug.cgi?id=127409
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/InspectorAgentBase.h:
+        When disconnecting agents, provide a InspectorDisconnectReason for
+        the disconnection. It could be that an inspector frontend is just
+        disconnecting or that the inspected object is going away entirely
+        and we can avoid doing some work.
+
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::~JSGlobalObjectDebuggable):
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        (JSC::JSGlobalObjectDebuggable::disconnectInternal):
+        Pass different reasons for the different disconnects.
+
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::InspectorAgentRegistry::willDestroyFrontendAndBackend):
+        * inspector/InspectorAgentRegistry.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::willDestroyFrontendAndBackend):
+        * inspector/agents/InspectorAgent.h:
+        Pass InspectorDisconnectReason around where needed.
+
+2014-01-23  Mark Lam  <mark.lam@apple.com>
+
+        Enable DFG for the Debugger and Profiler.
+        <https://webkit.org/b/122847>
+
+        Reviewed by Geoffrey Garen.
+
+        In this patch, we implement DFG op_debug as a series of 3 checks:
+        1. Check if the debugger pointer is non-null. This is needed in case
+           the debugger has been detached but the DFG code is still running
+           on the stack.
+        2. Check if Debugger::m_shouldPause is true.
+        3. Check if CodeBlock::m_numBreakpoints is non-zero.
+
+        These are the same 3 checks done in the LLINT and baselineJIT. But unlike
+        the LLINT and baselineJIT, these DFG checks are implemented as
+        speculationChecks. If the check fails, we OSR exit to the baselineJIT and
+        let it do the work of servicing the op_debug callback.
+
+        Stepping through code in the debugger would work the same way. The top
+        function being debugged has to be a LLINT or baselineJIT function because
+        we would have OSR exited if there is a breakpoint in that function. When
+        we step out of that function to its caller, we expect that the caller will
+        call back to the debugger at the next op_debug. If the caller function is
+        a DFG function, the op_debug site will fail its speculation check on
+        Debugger::m_shouldPause and deopt into a baselineJIT function. Execution
+        continues from there as usual, and the debugger gets its callback.
+
+        For the profile, op_profile_will_call and op_profile_did_call are
+        implemented as simple runtime calls to service the profiler.
+
+        With this patch, Octane performance with the WebInspector open jump from
+        ~2000 to ~2500 (25% progression).
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numBreakpointsAddress):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::toggleBreakpoint):
+        - removed an obsolete assertion. The debugger can now handle DFG
+          CodeBlocks too.
+        * debugger/Debugger.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::debuggerAddress):
+
+2014-01-23  Max Vujovic  <mvujovic@adobe.com>
+
+        Remove CSS Custom Filters code and tests
+        https://bugs.webkit.org/show_bug.cgi?id=127382
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-01-22  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Update project and solution files for 64-bit builds.
+        https://bugs.webkit.org/show_bug.cgi?id=127457
+
+        Reviewed by Eric Carlson.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Add 64-bit target.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Update for VS2013
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Add missing
+        file from project view.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Update for VS2013
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Ditto
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Ditto
+
+2014-01-22  Mark Lam  <mark.lam@apple.com>
+
+        Poor man's fast breakpoints for a 2.3x debugger speedup.
+        <https://webkit.org/b/122836>
+
+        Reviewed by Geoffrey Garen.
+
+        Previously we gained back some performance (run at baseline JIT speeds)
+        when the WebInspector is opened provided no breakpoints are set. This
+        was achieved by simply skipping all op_debug callbacks to the debugger
+        if no breakpoints are set. If any breakpoints are set, the debugger will
+        set a m_needsOpDebugCallbacks flag which causes the callbacks to be
+        called, and we don't get the baseline JIT speeds anymore.
+
+        With this patch, we will now track the number of breakpoints set in the
+        CodeBlock that they are set in. The LLINT and baseline JIT code will
+        check CodeBlock::m_numBreakpoints to determine if the op_debug callbacks
+        need to be called. With this, we will only enable op_debug callbacks for
+        CodeBlocks that need it i.e. those with breakpoints set in them.
+
+        Debugger::m_needsOpDebugCallbacks is now obsoleted. The LLINT and baseline
+        JIT code still needs to check Debugger::m_shouldPause to determine if the
+        debugger is in stepping mode and hence, needs op_debug callbacks enabled
+        for everything until the debugger "continues" the run and exit stepping
+        mode.
+
+        Also in this patch, I fixed a regression in DOM breakpoints which relies
+        Debugger::breakProgram() to pause the debugger.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        - Missed accounting for op_debug's new hasBreakpointFlag operand here when
+          it was added.
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::hasOpDebugForLineAndColumn):
+        - This is needed in Debugger::toggleBreakpoint() to determine if a
+          breakpoint falls within a CodeBlock or not. Simply checking the bounds
+          of the CodeBlock is insufficient. For example, let's say we have the
+          following JS code:
+
+              // begin global scope
+              function f1() {
+                  function f2() {
+                     ... // set breakpoint here.
+                  }
+              }
+              // end global scope
+
+          Using the CodeBlock bounds alone, the breakpoint above will to appear
+          to be in the global program CodeBlock, and the CodeBlocks for function
+          f1() and f2(). With CodeBlock::hasOpDebugForLineAndColumn() we can
+          rule out the global program CodeBlock and f1(), and only apply the
+          breakpoint to f2(0 where it belongs.
+
+          CodeBlock::hasOpDebugForLineAndColumn() works by iterating over all
+          the opcodes in the CodeBlock to look for op_debug's. For each op_debug,
+          it calls CodeBlock::expressionRangeForBytecodeOffset() to do a binary
+          seach to get the line and column info for that op_debug. This is a
+          N * log(N) algorithm. However, a quick hands on test using the
+          WebInspector (with this patch applied) to exercise setting, breaking
+          on, and clearing breakpoints, as well as stepping through some code
+          shows no noticeable degradation of the user experience compared to the
+          baseline without this patch.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numBreakpoints):
+        (JSC::CodeBlock::numBreakpointsOffset):
+        (JSC::CodeBlock::addBreakpoint):
+        (JSC::CodeBlock::removeBreakpoint):
+        (JSC::CodeBlock::clearAllBreakpoints):
+        * debugger/Breakpoint.h:
+        - defined Breakpoint::unspecifiedColumn so that we can explicitly indicate
+          when the WebInspector was setting a line breakpoint and did not provide
+          a column value. CodeBlock::hasOpDebugForLineAndColumn() needs this
+          information in order to loosen its matching criteria for op_debug
+          bytecodes for the specified breakpoint line and column values provided
+          by the debugger.
+
+          Previously, we just hijack a 0 value column as an unspecified column.
+          However, the WebInspector operates on 0-based ints for column values.
+          Hence, 0 should be a valid column value and should not be hijacked to
+          mean an unspecified column.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        - added tracking of the VM that the debugger is used with. This is
+          needed by Debugger::breakProgram().
+
+          The VM pointer is attained from the first JSGlobalObject that the debugger
+          attaches to. When the debugger detaches from the last JSGlobalObject, it
+          will nullify its VM pointer to allow a new one to be set on the next
+          attach.
+
+          We were always only using each debugger instance with one VM. This change
+          makes it explicit with an assert to ensure that all globalObjects that
+          the debugger attaches to beongs to the same VM.
+
+        (JSC::Debugger::attach):
+        (JSC::Debugger::detach):
+        (JSC::Debugger::setShouldPause):
+
+        (JSC::Debugger::registerCodeBlock):
+        (JSC::Debugger::unregisterCodeBlock):
+        - registerCodeBlock() is responsible for applying pre-existing breakpoints
+          to new CodeBlocks being installed. Similarly, unregisterCodeBlock()
+          clears the breakpoints.
+
+        (JSC::Debugger::toggleBreakpoint):
+        - This is the workhorse function that checks if a breakpoint falls within
+          a CodeBlock or not. If it does, then it can either enable or disable
+          said breakpoint in the CodeBlock. In the current implementation,
+          enabling/disabling the breakpoint simply means incrementing/decrementing
+          the CodeBlock's m_numBreakpoints.
+
+        (JSC::Debugger::applyBreakpoints):
+
+        (JSC::Debugger::ToggleBreakpointFunctor::ToggleBreakpointFunctor):
+        (JSC::Debugger::ToggleBreakpointFunctor::operator()):
+        (JSC::Debugger::toggleBreakpoint):
+        - Iterates all relevant CodeBlocks and apply the specified breakpoint
+          if appropriate. This is called when a new breakpoint is being defined
+          by the WebInspector and needs to be applied to an already installed
+          CodeBlock.
+
+        (JSC::Debugger::setBreakpoint):
+        (JSC::Debugger::removeBreakpoint):
+        (JSC::Debugger::hasBreakpoint):
+        (JSC::Debugger::ClearBreakpointsFunctor::ClearBreakpointsFunctor):
+        (JSC::Debugger::ClearBreakpointsFunctor::operator()):
+        (JSC::Debugger::clearBreakpoints):
+
+        (JSC::Debugger::breakProgram):
+        - Fixed a regression that broke DOM breakpoints. The issue is that with
+          the skipping of op_debug callbacks, we don't always have an updated
+          m_currentCallFrame. Normally, m_currentCallFrame is provided as arg
+          in the op_debug callback. In this case, we can get the CallFrame* from
+          m_vm->topCallFrame.
+
+        (JSC::Debugger::updateCallFrameAndPauseIfNeeded):
+        (JSC::Debugger::pauseIfNeeded):
+        (JSC::Debugger::willExecuteProgram):
+        * debugger/Debugger.h:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::shouldPause):
+
+        * heap/CodeBlockSet.h:
+        (JSC::CodeBlockSet::iterate):
+        * heap/Heap.h:
+        (JSC::Heap::forEachCodeBlock):
+        - Added utility to iterate all CodeBlocks in the heap / VM.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::debug):
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * llint/LowLevelInterpreter.asm:
+        - These now checks CodeBlock::m_numBreakpoints and Debugger::m_shouldPause
+          instead of Debugger::m_needsOpDebugCallbacks.
+
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode):
+
+2014-01-22  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Remove CSS3_TEXT_DECORATION define
+        https://bugs.webkit.org/show_bug.cgi?id=127333
+
+        This is required for unprefixing the text-decoration-* CSS properties.
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-01-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Update JS whitespace definition for changes in Unicode 6.3
+        https://bugs.webkit.org/show_bug.cgi?id=127450
+        <rdar://15863457>
+
+        Reviewed by Oliver Hunt.
+
+        Covered by existing tests when running against a Unicode back-end that supports
+        Unicode 6.3 or higher.
+
+        * runtime/JSGlobalObjectFunctions.cpp: (JSC::isStrWhiteSpace): Explicitly allow
+        U+180E MONGOLIAN VOWEL SEPARATOR, because we need to keep recognizing all characters
+        that used to be whitespace.
+
+2014-01-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Registers used in writeBarrierOnOperand can cause clobbering on some platforms
+        https://bugs.webkit.org/show_bug.cgi?id=127357
+
+        Reviewed by Filip Pizlo.
+
+        Some platforms use t0 and t1 for their first two arguments, so using those to load the 
+        cell for the write barrier is a bad idea because it will get clobbered.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-01-21  Mark Rowe  <mrowe@apple.com>
+
+        Mac production build fix.
+
+        Move the shell script build phase to copy jsc into JavaScriptCore.framework
+        out of the jsc target and in to the All target so that it's not run during
+        production builds. Xcode appears to the parent directories of paths referenced
+        in the Output Files of the build phase, which leads to problems when the
+        SYMROOT for the JavaScriptCore framework and the jsc executables are later merged.
+
+        I've also fixed the path to the Resources folder in the script while I'm here.
+        On iOS the framework bundle is shallow so the correct destination is Resources/
+        rather than Versions/A/Resources. This is handled by tweaking the
+        JAVASCRIPTCORE_RESOURCES_DIR configuration setting to be relative rather than
+        a complete path so we can reuse it in the script. The references in JSC.xcconfig
+        and ToolExecutable.xcconfig are updated to prepend JAVASCRIPTCORE_FRAMEWORKS_DIR
+        to preserve their former values.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/JSC.xcconfig:
+        * Configurations/ToolExecutable.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-01-19  Andreas Kling  <akling@apple.com>
+
+        JSC Parser: Shrink BindingNode.
+        <https://webkit.org/b/127253>
+
+        The "divot" and "end" source locations are always identical for
+        BindingNodes, so store only "start" and "end" instead.
+
+        1.19 MB progression on Membuster3.
+
+        Reviewed by Geoff Garen.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BindingNode::bindValue):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createBindingLocation):
+        * parser/NodeConstructors.h:
+        (JSC::BindingNode::create):
+        (JSC::BindingNode::BindingNode):
+        * parser/Nodes.h:
+        (JSC::BindingNode::divotStart):
+        (JSC::BindingNode::divotEnd):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::createBindingPattern):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2014-01-20  Filip Pizlo  <fpizlo@apple.com>
+
+        op_captured_mov and op_new_captured_func in UnlinkedCodeBlocks should use the IdentifierMap instead of the strings directly
+        https://bugs.webkit.org/show_bug.cgi?id=127311
+        <rdar://problem/15853958>
+
+        Reviewed by Andreas Kling.
+        
+        This makes UnlinkedCodeBlocks use 32-bit instruction streams again.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedInstruction::UnlinkedInstruction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::emitInitLazyRegister):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::watchableVariable):
+        (JSC::BytecodeGenerator::hasWatchableVariable):
+
+2014-01-20  Mark Lam  <mark.lam@apple.com>
+
+        Removing CodeBlock::opDebugBytecodeOffsetForLineAndColumn() and friends.
+        <https://webkit.org/b/127321>
+
+        Reviewed by Geoffrey Garen.
+
+        We're changing plans and will be going with CodeBlock level breakpoints
+        instead of bytecode level breakpoints. As a result, we no longer need
+        the services of CodeBlock::opDebugBytecodeOffsetForLineAndColumn() (and
+        friends). This patch will remove that unused code.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/LineColumnInfo.h: Removed.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo):
+        * bytecode/UnlinkedCodeBlock.h:
+
+2014-01-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CodeBlockSet::traceMarked doesn't need to visit the ownerExecutable
+        https://bugs.webkit.org/show_bug.cgi?id=127301
+
+        Reviewed by Oliver Hunt.
+
+        We used to just call CodeBlock::visitAggregate, but now we call visitChildren 
+        on the ownerExecutable, which is unnecessary. 
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::traceMarked):
+
+2014-01-20  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * heap/BlockAllocator.h:
+
+2014-01-20  Anders Carlsson  <andersca@apple.com>
+
+        Stop using ThreadCondition in BlockAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=126313
+
+        Reviewed by Sam Weinig.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::~BlockAllocator):
+        (JSC::BlockAllocator::waitForDuration):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+        * heap/BlockAllocator.h:
+        (JSC::BlockAllocator::deallocate):
+
+2014-01-19  Anders Carlsson  <andersca@apple.com>
+
+        Convert GCThreadSharedData over to STL threading primitives
+        https://bugs.webkit.org/show_bug.cgi?id=127256
+
+        Reviewed by Andreas Kling.
+
+        * heap/GCThread.cpp:
+        (JSC::GCThread::waitForNextPhase):
+        (JSC::GCThread::gcThreadMain):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::~GCThreadSharedData):
+        (JSC::GCThreadSharedData::startNextPhase):
+        (JSC::GCThreadSharedData::endCurrentPhase):
+        (JSC::GCThreadSharedData::didStartMarking):
+        (JSC::GCThreadSharedData::didFinishMarking):
+        * heap/GCThreadSharedData.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drainFromShared):
+
+2014-01-18  Andreas Kling  <akling@apple.com>
+
+        CodeBlock: Size m_callLinkInfos and m_byValInfos to fit earlier.
+        <https://webkit.org/b/127239>
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setNumberOfByValInfos):
+        (JSC::CodeBlock::setNumberOfCallLinkInfos):
+
+            Use resizeToFit() instead of grow() for these vectors, since
+            we know the final size here.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+
+            No need to shrink here anymore. We were not even shrinking
+            m_byValInfo before!
+
+2014-01-18  Andreas Kling  <akling@apple.com>
+
+        CodeBlock: Size m_function{Exprs,Decls} to fit from creation.
+        <https://webkit.org/b/127238>
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+            Use resizeToFit() instead of grow() for m_functionExprs and
+            m_functionDecls since we know they will never change size.
+
+        (JSC::CodeBlock::shrinkToFit):
+
+            No need to shrink them here anymore.
+
+2014-01-18  Andreas Kling  <akling@apple.com>
+
+        Remove unused CodeBlock::m_additionalIdentifiers member.
+        <https://webkit.org/b/127237>
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+
+            Remove m_additionalIdentifiers, nothing uses it.
+
+2014-01-18  Andreas Kling  <akling@apple.com>
+
+        Remove two unused CodeBlock functions.
+        <https://webkit.org/b/127235>
+
+        Kill copyPostParseDataFrom() and copyPostParseDataFromAlternative()
+        since they are not used.
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+
+2014-01-18  Andreas Kling  <akling@apple.com>
+
+        CodeBlock: Size m_exceptionHandlers to fit from creation.
+        <https://webkit.org/b/127234>
+
+        Avoid allocation churn for CodeBlock::m_exceptionHandlers.
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/CodeBlock.h:
+
+            Removed unused CodeBlock::allocateHandlers() function.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+            Use resizeToFit() instead of grow() for m_exceptionHandlers
+            since we know it's never going to change size.
+
+        (JSC::CodeBlock::shrinkToFit):
+
+            No need to shrink m_exceptionHandlers here since it's already
+            the perfect size.
+
+2014-01-18  Mark Lam  <mark.lam@apple.com>
+
+        Add a hasBreakpointFlag arg to the op_debug bytecode.
+        https://bugs.webkit.org/show_bug.cgi?id=127230.
+
+        Reviewed by Geoffrey Garen.
+
+        This is in anticipation of upcoming changes to support bytecode level
+        breakpoints. This patch adds the flag to the op_debug bytecode and
+        initializes it, but does not use it yet.
+
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+        * llint/LowLevelInterpreter.asm:
+
+2014-01-18  Alberto Garcia  <berto@igalia.com>
+
+        JavaScriptCore uses PLATFORM(MAC) when it means OS(DARWIN)
+        https://bugs.webkit.org/show_bug.cgi?id=99683
+
+        Reviewed by Anders Carlsson.
+
+        * jit/ThunkGenerators.cpp:
+        * tools/CodeProfile.cpp:
+        (JSC::symbolName):
+        (JSC::CodeProfile::sample):
+
+2014-01-18  Anders Carlsson  <andersca@apple.com>
+
+        Remove ENABLE_THREADED_HTML_PARSER defines everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=127225
+
+        Reviewed by Andreas Kling.
+
+        This concludes the removal of over 8.8 million lines of threaded parser code.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-01-18  Mark Lam  <mark.lam@apple.com>
+
+        Adding UnlinkedCodeBlock::opDebugBytecodeOffsetForLineAndColumn()..
+        https://bugs.webkit.org/show_bug.cgi?id=127127.
+
+        Reviewed by Geoffrey Garen.
+
+        In order to implement bytecode level breakpoints, we need a mechanism
+        for computing the best fit op_debug bytecode offset for any valid given
+        line and column value in the source. The "best fit" op_debug bytecode
+        in this case is defined below in the comment for
+        UnlinkedCodeBlock::opDebugBytecodeOffsetForLineAndColumn().
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::opDebugBytecodeOffsetForLineAndColumn):
+        - Convert the line and column to unlinked line and column values and
+          pass them to UnlinkedCodeBlock::opDebugBytecodeOffsetForLineAndColumn()
+          to do the real work.
+
+        * bytecode/CodeBlock.h:
+        * bytecode/LineColumnInfo.h: Added.
+        (JSC::LineColumnInfo::operator <):
+        (JSC::LineColumnInfo::LineColumnPair::LineColumnPair):
+        (JSC::LineColumnInfo::operator ==):
+        (JSC::LineColumnInfo::operator !=):
+        (JSC::LineColumnInfo::operator <=):
+        (JSC::LineColumnInfo::operator >):
+        (JSC::LineColumnInfo::operator >=):
+        * bytecode/LineInfo.h: Removed.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::decodeExpressionRangeLineAndColumn):
+        - Factored this out of expressionRangeForBytecodeOffset() so that it can
+          be called from multiple places.
+        (JSC::dumpLineColumnEntry):
+        (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo):
+        (JSC::UnlinkedCodeBlock::dumpOpDebugLineColumnInfoList):
+        - Some dumpers for debugging use only.
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::opDebugBytecodeOffsetForLineAndColumn):
+        - Finds the earliest op_debug bytecode whose line and column matches the
+          specified line and column values. If an exact match is not found, then
+          finds the nearest op_debug bytecode that precedes the specified line
+          and column values. If there are more than one op_debug at that preceding
+          line and column value, then the earliest of those op_debug bytecodes will
+          be be selected. The offset of the selected bytecode will be returned.
+
+          We want the earliest one because when we have multiple op_debug bytecodes
+          that map to a given line and column, a debugger user would expect to break
+          on the first one and step through the rest thereafter if needed.
+
+        (JSC::compareLineColumnInfo):
+        (JSC::UnlinkedCodeBlock::opDebugLineColumnInfoList):
+        - Creates the sorted opDebugLineColumnInfoList on demand. This list is
+          stored in the UnlinkedCodeBlock's rareData.
+        * bytecode/UnlinkedCodeBlock.h:
+
+2014-01-18  Zan Dobersek  <zdobersek@igalia.com>
+
+        Inspector scripts are not compatible with Python v3
+        https://bugs.webkit.org/show_bug.cgi?id=127128
+
+        Reviewed by Benjamin Poulain.
+
+        * inspector/scripts/generate-combined-inspector-json.py: Turn print statements into print function calls.
+        * inspector/scripts/jsmin.py: Try importing the StringIO class from the StringIO module (which will work for
+        Python v2) or, on import error, import the class from the io module (which will work for Python v3).
+
+2014-01-17  Anders Carlsson  <andersca@apple.com>
+
+        String::is8Bit() crashes if m_impl is null, handle this.
+
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::OpaqueJSString):
+
+2014-01-17  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the Windows build.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::~OpaqueJSString):
+        (OpaqueJSString::characters):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::OpaqueJSString):
+
+2014-01-17  Anders Carlsson  <andersca@apple.com>
+
+        Get rid of OpaqueJSString::deprecatedCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=127161
+
+        Reviewed by Sam Weinig.
+
+        Handle OpaqueJSString::m_string being either 8-bit or 16-bit and add extra
+        code paths for the 8-bit cases.
+        
+        Unfortunately, JSStringGetCharactersPtr is still expected to return a 16-bit character pointer.
+        Handle this by storing a separate 16-bit string and initializing it on demand when JSStringGetCharactersPtr
+        is called and the backing string is 8-bit.
+        
+        This has the nice side effect of making JSStringGetCharactersPtr thread-safe when it wasn't before.
+        (In theory, someone could have a JSStringRef backed by an 8-bit string and call JSStringGetCharactersPtr on it
+        causing an unsafe upconversion to a 16-bit string).
+
+        * API/JSStringRef.cpp:
+        (JSStringGetCharactersPtr):
+        Call OpaqueJSString::characters.
+
+        (JSStringGetUTF8CString):
+        Add a code path that handles 8-bit strings.
+
+        (JSStringIsEqual):
+        Call OpaqueJSString::equal.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        Reformat the code to use an early return instead of putting most of the code inside the body of an if statement.
+
+        (JSStringCopyCFString):
+        Create an 8-bit CFStringRef if possible.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::create):
+        Use nullptr.
+
+        (OpaqueJSString::~OpaqueJSString):
+        Free m_characters.
+
+        (OpaqueJSString::characters):
+        Do the up-conversion and store the result in m_characters.
+
+        (OpaqueJSString::equal):
+        New helper function.
+
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::is8Bit):
+        New function that returns whether a string is 8-bit or not.
+
+        (OpaqueJSString::characters8):
+        (OpaqueJSString::characters16):
+        Add getters.
+
+2014-01-17  Peter Molnar  <pmolnar.u-szeged@partner.samsung.com>
+
+        Remove workaround for compilers not supporting deleted functions
+        https://bugs.webkit.org/show_bug.cgi?id=127166
+
+        Reviewed by Andreas Kling.
+
+        * inspector/InspectorAgentRegistry.h:
+
+2014-01-17  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r162185, r162186, and r162187.
+        http://trac.webkit.org/changeset/162185
+        http://trac.webkit.org/changeset/162186
+        http://trac.webkit.org/changeset/162187
+        https://bugs.webkit.org/show_bug.cgi?id=127164
+
+        Broke JSStringCreateWithCharactersNoCopy, as evidenced by a
+        JSC API test (Requested by ap on #webkit).
+
+        * API/JSStringRef.cpp:
+        (JSStringGetCharactersPtr):
+        (JSStringGetUTF8CString):
+        (JSStringIsEqual):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        (JSStringCopyCFString):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::create):
+        (OpaqueJSString::identifier):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::create):
+        (OpaqueJSString::characters):
+        (OpaqueJSString::deprecatedCharacters):
+        (OpaqueJSString::OpaqueJSString):
+
+2014-01-16  Anders Carlsson  <andersca@apple.com>
+
+        Export OpaqueJSString destructor.
+
+        * API/OpaqueJSString.h:
+
+2014-01-16  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * API/OpaqueJSString.h:
+
+2014-01-16  Anders Carlsson  <andersca@apple.com>
+
+        Get rid of OpaqueJSString::deprecatedCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=127161
+
+        Reviewed by Sam Weinig.
+
+        Handle OpaqueJSString::m_string being either 8-bit or 16-bit and add extra
+        code paths for the 8-bit cases.
+        
+        Unfortunately, JSStringGetCharactersPtr is still expected to return a 16-bit character pointer.
+        Handle this by storing a separate 16-bit string and initializing it on demand when JSStringGetCharactersPtr
+        is called. This has the nice side effect of making JSStringGetCharactersPtr thread-safe when it wasn't before.
+        (In theory, someone could have a JSStringRef backed by an 8-bit string and call JSStringGetCharactersPtr on it
+        causing an unsafe upconversion to a 16-bit string).
+
+        * API/JSStringRef.cpp:
+        (JSStringGetCharactersPtr):
+        Call OpaqueJSString::characters.
+
+        (JSStringGetUTF8CString):
+        Add a code path that handles 8-bit strings.
+
+        (JSStringIsEqual):
+        Call OpaqueJSString::equal.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        Reformat the code to use an early return instead of putting most of the code inside the body of an if statement.
+
+        (JSStringCopyCFString):
+        Create an 8-bit CFStringRef if possible.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::create):
+        Use nullptr.
+
+        (OpaqueJSString::~OpaqueJSString):
+        Free m_characters.
+
+        (OpaqueJSString::characters):
+        Do the up-conversion and store the result in m_characters.
+
+        (OpaqueJSString::equal):
+        New helper function.
+
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::is8Bit):
+        New function that returns whether a string is 8-bit or not.
+
+        (OpaqueJSString::characters8):
+        (OpaqueJSString::characters16):
+        Add getters.
+
+2014-01-16  Anders Carlsson  <andersca@apple.com>
+
+        Change all uses of FINAL to final now that all our compilers support it
+        https://bugs.webkit.org/show_bug.cgi?id=127142
+
+        Reviewed by Benjamin Poulain.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.h:
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/scripts/CodeGeneratorInspector.py:
+        (Generator.go):
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSPromiseReaction.cpp:
+
+2014-01-16  Oliver Hunt  <oliver@apple.com>
+
+        throwing an objc object (or general binding object) triggers an assertion
+        https://bugs.webkit.org/show_bug.cgi?id=127146
+
+        Reviewed by Alexey Proskuryakov.
+
+        This is simply a bogus assertion as we can't guarantee a bindings object
+        won't intercept assignment to .stack
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwind):
+
+2014-01-16  Peter Molnar  <pmolnar.u-szeged@partner.samsung.com>
+
+        Remove workaround for compilers not supporting explicit override control
+        https://bugs.webkit.org/show_bug.cgi?id=127111
+
+        Reviewed by Anders Carlsson.
+
+        Now all compilers support explicit override control, this workaround can be removed.
+
+        * API/JSAPIWrapperObject.mm:
+        * API/JSCallbackObject.h:
+        * API/JSManagedValue.mm:
+        * API/JSScriptRef.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeBlockJettisoningWatchpoint.h:
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.h:
+        * bytecode/StructureStubClearingWatchpoint.h:
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        * dfg/DFGFailedFinalizer.h:
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITFinalizer.h:
+        * dfg/DFGSaneStringGetByValSlowPathGenerator.h:
+        * dfg/DFGSlowPathGenerator.h:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * heap/Heap.h:
+        * heap/IncrementalSweeper.h:
+        * heap/SuperRegion.h:
+        * inspector/InspectorValues.h:
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.h:
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/scripts/CodeGeneratorInspector.py:
+        (Generator.go):
+        * jit/ClosureCallStubRoutine.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/GCAwareJITStubRoutine.h:
+        * jit/JITCode.h:
+        * jit/JITToDFGDeferredCompilationCallback.h:
+        * parser/Nodes.h:
+        * parser/SourceProvider.h:
+        * runtime/DataView.h:
+        * runtime/GCActivityCallback.h:
+        * runtime/GenericTypedArrayView.h:
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSPromiseReaction.cpp:
+        * runtime/RegExpCache.h:
+        * runtime/SimpleTypedArrayController.h:
+        * runtime/SymbolTable.h:
+        * runtime/WeakMapData.h:
+
+2014-01-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [iOS] Clean up REMOTE_INSPECTOR code in OpenSource after the iOS merge
+        https://bugs.webkit.org/show_bug.cgi?id=127069
+
+        Reviewed by Timothy Hatcher.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Export XPCConnection because it is needed by RemoteInspector.h.
+
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::startDisabled):
+        (Inspector::RemoteInspector::shared):
+        Allow RemoteInspector singleton to start disabled.
+
+2014-01-15  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: capture probe samples on the backend
+        https://bugs.webkit.org/show_bug.cgi?id=126668
+
+        Reviewed by Joseph Pecoraro.
+
+        Add the 'probe' breakpoint action to the protocol. Change the setBreakpoint
+        commands to return a list of assigned breakpoint action identifiers
+        Add a type for breakpoint action identifiers. Add an event for sending
+        captured probe samples to the inspector frontend.
+
+        * inspector/protocol/Debugger.json:
+
+2014-01-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Copying should be generational
+        https://bugs.webkit.org/show_bug.cgi?id=126555
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds support for copying to our generational collector. Eden collections 
+        always trigger copying. Full collections use our normal fragmentation-based heuristics.
+
+        The way this works is that the CopiedSpace now has the notion of an old generation set of CopiedBlocks
+        and a new generation of CopiedBlocks. During each mutator cycle new CopiedSpace allocations reside
+        in the new generation. When a collection occurs, those blocks are moved to the old generation.
+
+        One key thing to remember is that both new and old generation objects in the MarkedSpace can
+        refer to old or new generation allocations in CopiedSpace. This is why we must fire write barriers 
+        when assigning to an old (MarkedSpace) object's Butterfly.
+
+        * heap/CopiedAllocator.h:
+        (JSC::CopiedAllocator::tryAllocateDuringCopying):
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::didEvacuateBytes):
+        (JSC::CopiedBlock::isOld):
+        (JSC::CopiedBlock::didPromote):
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        (JSC::CopiedBlock::reportLiveBytesDuringCopying):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::CopiedSpace):
+        (JSC::CopiedSpace::~CopiedSpace):
+        (JSC::CopiedSpace::init):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::didStartFullCollection):
+        (JSC::CopiedSpace::doneCopying):
+        (JSC::CopiedSpace::size):
+        (JSC::CopiedSpace::capacity):
+        (JSC::CopiedSpace::isPagedOut):
+        * heap/CopiedSpace.h:
+        (JSC::CopiedSpace::CopiedGeneration::CopiedGeneration):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::contains):
+        (JSC::CopiedSpace::recycleEvacuatedBlock):
+        (JSC::CopiedSpace::allocateBlock):
+        (JSC::CopiedSpace::startedCopying):
+        * heap/CopyVisitor.cpp:
+        (JSC::CopyVisitor::copyFromShared):
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::allocateNewSpace):
+        (JSC::CopyVisitor::allocateNewSpaceSlow):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::didStartCopying):
+        * heap/Heap.cpp:
+        (JSC::Heap::copyBackingStores):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater):
+        * heap/TinyBloomFilter.h:
+        (JSC::TinyBloomFilter::add):
+
+2014-01-14  Mark Lam  <mark.lam@apple.com>
+
+        ASSERTION FAILED: !hasError() in JSC::Parser<LexerType>::createSavePoint().
+        https://bugs.webkit.org/show_bug.cgi?id=126990.
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseConstDeclarationList):
+        - We were missing an error check after attempting to parse an initializer
+          expression. This is now fixed.
+
+2014-01-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: For Remote Inspection link WebProcess's to their parent UIProcess
+        https://bugs.webkit.org/show_bug.cgi?id=126995
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::listingForDebuggable):
+        For each WebView, list the parent process. Listing the parent per WebView
+        is already supported back when we supported processes that could host WebViews
+        for multiple applications.
+
+        * inspector/remote/RemoteInspectorConstants.h:
+        Add a separate key for the bundle identifier, separate from application identifier.
+
+        * inspector/remote/RemoteInspectorDebuggable.cpp:
+        (Inspector::RemoteInspectorDebuggable::info):
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        (Inspector::RemoteInspectorDebuggableInfo::RemoteInspectorDebuggableInfo):
+        (Inspector::RemoteInspectorDebuggableInfo::hasParentProcess):
+        If a RemoteInspectorDebuggable has a non-zero parent process identifier
+        it is a proxy for the parent process.
+
+2014-01-14  Brian J. Burg  <burg@cs.washington.edu>
+
+        Add ENABLE(WEB_REPLAY) feature flag to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=126949
+
+        Reviewed by Joseph Pecoraro.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-01-14  Peter Molnar  <pmolnar.u-szeged@partner.samsung.com>
+
+        [EFL] FTL buildfix, add missing includes
+        https://bugs.webkit.org/show_bug.cgi?id=126641
+
+        Reviewed by Csaba Osztrogonác.
+
+        * ftl/FTLOSREntry.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+
+2014-01-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: RemoteInspector::updateDebuggable may miss a push
+        https://bugs.webkit.org/show_bug.cgi?id=126965
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::updateDebuggable):
+        Always push an update. If a debuggable went from allowed to
+        not allowed, we would have missed pushing an update.
+
+2014-01-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Performance regression on dromaeo due to generational marking
+        https://bugs.webkit.org/show_bug.cgi?id=126901
+
+        Reviewed by Oliver Hunt.
+
+        We were seeing some performance regression with ENABLE_GGC == 0, so this patch
+        ifdefs out more things to get rid of the additional overhead.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::writeBarrier):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::clearMarksWithCollectionType):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::resetAllocators):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::didAllocateInBlock):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::reportExtraMemoryUsage):
+
+2014-01-13  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: protocol generator should support integer-typed declarations
+        https://bugs.webkit.org/show_bug.cgi?id=126828
+
+        Reviewed by Joseph Pecoraro.
+
+        Add new binding classes for parameter/ad-hoc and normal integer type declarations.
+
+        * inspector/scripts/CodeGeneratorInspector.py:
+        (TypeBindings.create_type_declaration_):
+        (TypeBindings.create_type_declaration_.PlainInteger):
+        (TypeBindings.create_type_declaration_.PlainInteger.resolve_inner):
+        (TypeBindings.create_type_declaration_.PlainInteger.request_user_runtime_cast):
+        (TypeBindings.create_type_declaration_.PlainInteger.request_internal_runtime_cast):
+        (TypeBindings.create_type_declaration_.PlainInteger.get_code_generator):
+        (TypeBindings.create_type_declaration_.PlainInteger.get_validator_call_text):
+        (TypeBindings.create_type_declaration_.PlainInteger.reduce_to_raw_type):
+        (TypeBindings.create_type_declaration_.PlainInteger.get_type_model):
+        (TypeBindings.create_type_declaration_.PlainInteger.get_setter_value_expression_pattern):
+        (TypeBindings.create_type_declaration_.PlainInteger.get_array_item_c_type_text):
+        (TypeBindings.create_type_declaration_.TypedefInteger):
+        (TypeBindings.create_type_declaration_.TypedefInteger.resolve_inner):
+        (TypeBindings.create_type_declaration_.TypedefInteger.request_user_runtime_cast):
+        (TypeBindings.create_type_declaration_.TypedefInteger.request_internal_runtime_cast):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_code_generator):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_code_generator.CodeGenerator):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_code_generator.CodeGenerator.generate_type_builder):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_code_generator.CodeGenerator.generate_type_builder.int):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_code_generator.CodeGenerator.register_use):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_code_generator.CodeGenerator.get_generate_pass_id):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_validator_call_text):
+        (TypeBindings.create_type_declaration_.TypedefInteger.reduce_to_raw_type):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_type_model):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_setter_value_expression_pattern):
+        (TypeBindings.create_type_declaration_.TypedefInteger.get_array_item_c_type_text):
+
+2014-01-13  Zalan Bujtas  <zalan@apple.com>
+
+        Enable SUBPIXEL_LAYOUT on Mac
+        <https://webkit.org/b/126283>
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-01-13  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed. Changes in r161686 are exposing a bug in GCC where the global .cfi_startproc directive
+        is not inserted early enough into the generated assembler code when building in debug mode, causing
+        compilation failures on ports using the GCC compilers. To work around the problem, only utilize the
+        OFFLINE_ASM_* macros that use .cfi_ directives when compiling with Clang.
+
+        * llint/LowLevelInterpreter.cpp:
+
+2014-01-12  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r161840.
+        http://trac.webkit.org/changeset/161840
+        https://bugs.webkit.org/show_bug.cgi?id=126870
+
+        Caused jsscore and layout test failures (Requested by smfr on
+        #webkit).
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        * inspector/InspectorValues.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * runtime/Identifier.h:
+        (JSC::Identifier::characters):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::append):
+
+2014-01-12  Darin Adler  <darin@apple.com>
+
+        Add deprecatedCharacters as a synonym for characters and convert most call sites
+        https://bugs.webkit.org/show_bug.cgi?id=126858
+
+        Reviewed by Anders Carlsson.
+
+        * API/JSStringRef.cpp:
+        (JSStringGetCharactersPtr):
+        (JSStringGetUTF8CString):
+        (JSStringIsEqual):
+        * API/JSStringRefCF.cpp:
+        (JSStringCopyCFString):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::characters):
+        (OpaqueJSString::deprecatedCharacters):
+        (OpaqueJSString::length):
+        (OpaqueJSString::OpaqueJSString):
+        * inspector/InspectorValues.cpp:
+        (Inspector::InspectorValue::parseJSON):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        * runtime/StringPrototype.cpp:
+        (JSC::localeCompare):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        Use deprecatedCharacters instead of characters.
+
+2014-01-12  Darin Adler  <darin@apple.com>
+
+        Reduce use of String::characters
+        https://bugs.webkit.org/show_bug.cgi?id=126854
+
+        Reviewed by Sam Weinig.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString): Use characters16 instead of characters for 16-bit case.
+        Had to remove length check because an empty string could be either 8 bit or 16 bit.
+        Don't need a null string check before calling is8Bit because JSStringRef can't hold
+        a null string.
+
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue): Use the existing string here instead of creating
+        a new one by calling characters and length on the old string. I think this may be
+        left over from when string types were not the same in JavaScriptCore and WebCore.
+        Also rewrite the property names loop to use modern for syntax and fewer locals.
+
+        * inspector/InspectorValues.cpp:
+        (Inspector::escapeChar): Changed to use appendLiteral instead of hard-coding string
+        lengths. Moved handling of "<" and ">" in here instead of at the call site.
+        (Inspector::doubleQuoteString): Simplify the code so there is no use of characters
+        and length. This is still an inefficient way of doing this job and could use a rethink.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate): Use RetainPtr, createCFString, and the conversion from
+        CFStringRef to WTF::String to remove a lot of unneeded code.
+
+        * runtime/Identifier.h: Removed unneeded Identifier::characters function.
+
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::append): Use characters16 instead of characters function here,
+        since we have already checked is8Bit above.
+
+2014-01-12  Andy Estes  <aestes@apple.com>
+
+        [iOS] Enable the JSC Objective-C API
+
+        Rubber-stamped by Simon Fraser.
+
+        * API/JSBase.h:
+
+2014-01-12  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.am: Add inline-and-minify-stylesheets-and-scripts.py
+        to EXTRA_DIST and fix InjectedScriptSource.h generation rule.
+        * GNUmakefile.list.am: Move InjectedScriptSource.h to
+        built_nosources to make sure it's not disted.
+
+2014-01-11  Anders Carlsson  <andersca@apple.com>
+
+        Try again to fix the build.
+
+        * inspector/InspectorAgentRegistry.cpp:
+        * inspector/InspectorAgentRegistry.h:
+
+2014-01-11  Anders Carlsson  <andersca@apple.com>
+
+        Try to prevent the Vector copy constructor from being instantiated.
+
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::InspectorAgentRegistry::InspectorAgentRegistry):
+        * inspector/InspectorAgentRegistry.h:
+
+2014-01-11  Anders Carlsson  <andersca@apple.com>
+
+        Try something else.
+
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::InspectorAgentRegistry::~InspectorAgentRegistry):
+        * inspector/InspectorAgentRegistry.h:
+
+2014-01-11  Dean Jackson  <dino@apple.com>
+
+        [JSC] Revise typed array implementations to match ECMAScript and WebGL Specification
+        https://bugs.webkit.org/show_bug.cgi?id=126754
+
+        Reviewed by Filip Pizlo.
+
+        The ECMAScript specification forbids calling the typed array
+        constructors without using "new". Change the call data to return
+        none so we throw and exception in these cases.
+
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):
+
+2014-01-11  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the build by introducing a constructor.
+
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::InspectorAgentRegistry::InspectorAgentRegistry):
+        * inspector/InspectorAgentRegistry.h:
+
+2014-01-11  Anders Carlsson  <andersca@apple.com>
+
+        * inspector/InspectorAgentRegistry.h:
+
+        Remove an unused function.
+
+2014-01-11  Anders Carlsson  <andersca@apple.com>
+
+        InspectorAgentRegistry should use std::unique_ptr
+        https://bugs.webkit.org/show_bug.cgi?id=126826
+
+        Reviewed by Sam Weinig.
+
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::InspectorAgentRegistry::append):
+        * inspector/InspectorAgentRegistry.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        * inspector/agents/InspectorAgent.h:
+
+2014-01-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Push InspectorAgent down into JSC, give JSC an InspectorController
+        https://bugs.webkit.org/show_bug.cgi?id=126763
+
+        Reviewed by Timothy Hatcher.
+
+        Introduce JSGlobalObjectInspectorController. This is the InspectorController
+        for a JSContext. It is created by the JSGlobalObject Remote Inspector Debuggable
+        when a remote frontend connects, and is destroyed when the remote frontend
+        disconnects of the JSGlobalObject is destroyed.
+
+        * inspector/JSGlobalObjectInspectorController.h: Added.
+        * inspector/JSGlobalObjectInspectorController.cpp: Added.
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::~JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::dispatchMessageFromFrontend):
+        (Inspector::JSGlobalObjectInspectorController::functionCallHandler):
+        (Inspector::JSGlobalObjectInspectorController::evaluateHandler):
+        Create/destory agents, create/destroy dispatches, implement InspectorEnvironment.
+
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::~JSGlobalObjectDebuggable):
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        (JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend):
+        Forward actions to the InspectorController object.
+
+        * inspector/agents/InspectorAgent.h: Renamed from Source/WebCore/inspector/InspectorAgent.h.
+        * inspector/agents/InspectorAgent.cpp: Renamed from Source/WebCore/inspector/InspectorAgent.cpp.
+        (Inspector::InspectorAgent::InspectorAgent):
+        (Inspector::InspectorAgent::~InspectorAgent):
+        (Inspector::InspectorAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorAgent::inspect):
+        (Inspector::InspectorAgent::evaluateForTestInFrontend):
+        Implement InspectorAgent in JavaScriptCore in namespace Inspector.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * CMakeLists.txt:
+        * ChangeLog:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        Add files and new inspector/agents subdirectory.
+
+2014-01-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r161702.
+        http://trac.webkit.org/changeset/161702
+        https://bugs.webkit.org/show_bug.cgi?id=126803
+
+        Broke multiple tests (Requested by ap on #webkit).
+
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):
+
+2014-01-10  David Kilzer  <ddkilzer@apple.com>
+
+        Clean up architectures in xcconfig files
+        <http://webkit.org/b/126794>
+
+        Reviewed by Andy Estes.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig: Remove armv6, ppc.
+        * Configurations/ToolExecutable.xcconfig: Sort.
+        - Add new arch.
+
+2014-01-10  Dean Jackson  <dino@apple.com>
+
+        [JSC] Revise typed array implementations to match ECMAScript and WebGL Specification
+        https://bugs.webkit.org/show_bug.cgi?id=126754
+
+        Reviewed by Filip Pizlo.
+
+        The ECMAScript specification forbids calling the typed array
+        constructors without using "new". Change the call data to return
+        none so we throw and exception in these cases.
+
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):
+
+2014-01-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove the BlackBerry port from trunk
+        https://bugs.webkit.org/show_bug.cgi?id=126715
+
+        Reviewed by Anders Carlsson.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::cacheFlush):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::replaceWithJump):
+        (JSC::ARMv7Assembler::maxJumpReplacementSize):
+        (JSC::ARMv7Assembler::cacheFlush):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
+        * heap/MachineStackMarker.cpp:
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        (JSC::freePlatformThreadRegisters):
+        * jit/ExecutableAllocator.h:
+
+2014-01-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unimplemented or static ScriptDebugServer features
+        https://bugs.webkit.org/show_bug.cgi?id=126784
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Debugger.json:
+
+2014-01-10  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(C stack work): stack traces no longer work in CrashTracer, lldb, and other tools
+        https://bugs.webkit.org/show_bug.cgi?id=126764
+
+        Reviewed by Geoffrey Garen.
+
+        Updated callToJavaScript and cllToNativeFunction to properly replicate the caller's
+        return PC and frame pointer in the sentinel frame.  For X86-64, added .cfi_
+        directives to create eh_frame info for all LLInt symbols so that the various
+        unwinding code understands that we are using a separate JS stack referenced
+        by BP and at what offsets in that frame the prior PC (register 16) and prior
+        BP (register 6) can be found.  These two changes are sufficient for stack tracing
+        to work for Mac OSX.
+
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-01-10  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>
+
+        [EFL][JSC] Enable udis86 disassembler on efl.
+        https://bugs.webkit.org/show_bug.cgi?id=125502
+
+        Reviewed by Michael Saboff.
+
+        Enable udis86 disassembler on efl and fix build warnings.
+
+        * CMakeLists.txt:
+          Add udis86 disassembler source files.
+        * disassembler/udis86/udis86_decode.c:
+        (decode_modrm_rm):
+          Build warning fixes.
+        * disassembler/udis86/udis86_syn-att.c:
+        (gen_operand):
+          Build warning fixes.
+        * disassembler/udis86/udis86_syn-intel.c:
+        (gen_operand):
+          Build warning fixes.
+        * disassembler/udis86/udis86_types.h:
+          Correct FMT64 for uint64_t.
+
+2014-01-09  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove the BlackBerry files outside WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=126715
+
+        Reviewed by Anders Carlsson.
+
+        * PlatformBlackBerry.cmake: Removed.
+        * runtime/GCActivityCallbackBlackBerry.cpp: Removed.
+        * shell/PlatformBlackBerry.cmake: Removed.
+
+2014-01-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed Blackberry #ifdefs and platform code from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=126757
+
+        Reviewed by Sam Weinig.
+
+        * PlatformBlackBerry.cmake: Removed.
+        * heap/HeapTimer.cpp:
+        * heap/HeapTimer.h:
+        * heap/IncrementalSweeper.cpp:
+        * heap/IncrementalSweeper.h:
+        * jsc.cpp:
+        (main):
+        * runtime/GCActivityCallbackBlackBerry.cpp: Removed.
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+
+2014-01-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Marking should be generational
+        https://bugs.webkit.org/show_bug.cgi?id=126552
+
+        Reviewed by Geoffrey Garen.
+
+        Re-marking the same objects over and over is a waste of effort. This patch implements 
+        the sticky mark bit algorithm (along with our already-present write barriers) to reduce 
+        overhead during garbage collection caused by rescanning objects.
+
+        There are now two collection modes, EdenCollection and FullCollection. EdenCollections
+        only visit new objects or objects that were added to the remembered set by a write barrier.
+        FullCollections are normal collections that visit all objects regardless of their 
+        generation.
+
+        In this patch EdenCollections do not do anything in CopiedSpace. This will be fixed in 
+        https://bugs.webkit.org/show_bug.cgi?id=126555.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlockSet::mark):
+        * dfg/DFGOperations.cpp:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::traceMarked):
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        * heap/CodeBlockSet.h:
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::didStartFullCollection):
+        * heap/CopiedSpace.h:
+        (JSC::CopiedSpace::heap):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::didAbandon):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::didAllocate):
+        (JSC::Heap::writeBarrier):
+        * heap/Heap.h:
+        (JSC::Heap::isInRememberedSet):
+        (JSC::Heap::operationInProgress):
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isCollecting):
+        (JSC::Heap::isWriteBarrierEnabled):
+        (JSC::Heap::writeBarrier):
+        * heap/HeapOperation.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStackArray::clear):
+        (JSC::MarkStackArray::fillVector):
+        * heap/MarkStack.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::isListPagedOut):
+        (JSC::MarkedAllocator::isPagedOut):
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::reset):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::MarkedAllocator):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::clearRememberedSet):
+        (JSC::MarkedBlock::clearMarksWithCollectionType):
+        (JSC::MarkedBlock::lastChanceToFinalize):
+        * heap/MarkedBlock.h: Changed atomSize to 16 bytes because we have no objects smaller
+        than 16 bytes. This is also to pay for the additional Bitmap for the remembered set.
+        (JSC::MarkedBlock::didConsumeEmptyFreeList):
+        (JSC::MarkedBlock::setRemembered):
+        (JSC::MarkedBlock::clearRemembered):
+        (JSC::MarkedBlock::atomicClearRemembered):
+        (JSC::MarkedBlock::isRemembered):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::~MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        (JSC::VerifyMarked::operator()):
+        (JSC::MarkedSpace::clearMarks):
+        * heap/MarkedSpace.h:
+        (JSC::ClearMarks::operator()):
+        (JSC::ClearRememberedSet::operator()):
+        (JSC::MarkedSpace::didAllocateInBlock):
+        (JSC::MarkedSpace::clearRememberedSet):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::~SlotVisitor):
+        (JSC::SlotVisitor::clearMarkStack):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::markStack):
+        (JSC::SlotVisitor::sharedData):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::unconditionallyAppend):
+        (JSC::SlotVisitor::copyLater):
+        (JSC::SlotVisitor::reportExtraMemoryUsage):
+        (JSC::SlotVisitor::heap):
+        * jit/Repatch.cpp:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::StructureRareData::setEnumerationCache):
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren):
+        * runtime/StructureRareDataInlines.h:
+        (JSC::StructureRareData::setPreviousID):
+        (JSC::StructureRareData::setObjectToStringValue):
+        * runtime/WeakMapData.cpp:
+        (JSC::WeakMapData::visitChildren):
+
+2014-01-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed Windows build fix for r161563.
+
+        Copy all scripts, some may not be .py.
+
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+
+2014-01-09  Filip Pizlo  <fpizlo@apple.com>
+
+        AI for CreateArguments should pass through non-SpecEmpty input values
+        https://bugs.webkit.org/show_bug.cgi?id=126709
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * tests/stress/use-arguments-as-object-pointer.js: Added.
+        (foo):
+
+2014-01-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Constructors for Objective-C classes do not work properly with instanceof
+        https://bugs.webkit.org/show_bug.cgi?id=126670
+
+        Reviewed by Oliver Hunt.
+
+        This bug is due to the fact that the JS constructors created for Objective-C classes via the JSC 
+        API inherit from JSCallbackObject, which overrides hasInstance with its own customHasInstance. 
+        JSCallbackObject::customHasInstance only checks the JSClassRefs for hasInstance callbacks. 
+        If it doesn't find any callbacks, it returns false.
+
+        This patch adds a hasInstance callback to constructors created for Objective-C wrapper classes.
+
+        * API/JSWrapperMap.mm:
+        (constructorHasInstance):
+        (constructorWithCustomBrand):
+        (allocateConstructorForCustomClass):
+        * API/tests/testapi.mm:
+
+2014-01-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Move InjectedScript classes into JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=126598
+
+        Reviewed by Timothy Hatcher.
+
+        Part 5: Move InjectedScript classes into JavaScriptCore
+
+        There are pieces of logic that WebCore wants to hook into in the InjectedScript
+        execution (e.g. for CommandLineAPIModule and InspectorInstrumentation). Create
+        hooks for those in a base class called InspectorEnvironment. For now, the
+        InspectorControllers (Page, JSGlobalObject, Worker) will be the InspectorEnvironments
+        and provide answers to its hooks.
+
+        * inspector/InspectorEnvironment.h: Added.
+        New hooks needed by WebCore in various places. Mostly stubbed in JavaScriptCore.
+
+        * inspector/InjectedScript.cpp: Renamed from Source/WebCore/inspector/InjectedScript.cpp.
+        * inspector/InjectedScript.h: Added.
+        * inspector/InjectedScriptBase.cpp: Renamed from Source/WebCore/inspector/InjectedScriptBase.cpp.
+        * inspector/InjectedScriptBase.h: Renamed from Source/WebCore/inspector/InjectedScriptBase.h.
+        * inspector/InjectedScriptModule.cpp: Renamed from Source/WebCore/inspector/InjectedScriptModule.cpp.
+        * inspector/InjectedScriptModule.h: Renamed from Source/WebCore/inspector/InjectedScriptModule.h.
+        Cleanup the style of these files (nullptr, formatting, whitespace, etc).
+        Use the InspectorEnvironments call/evaluate function for ScriptFunctionCalls and checking access
+
+        * inspector/InjectedScriptManager.cpp: Renamed from Source/WebCore/inspector/InjectedScriptManager.cpp.
+        * inspector/InjectedScriptManager.h: Renamed from Source/WebCore/inspector/InjectedScriptManager.h.
+        Take an InspectorEnvironment with multiple hooks, instead of a single hook function.
+
+        * inspector/InjectedScriptHost.cpp: Added.
+        * inspector/InjectedScriptHost.h: Added.
+        * inspector/JSInjectedScriptHost.cpp: Renamed from Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp.
+        * inspector/JSInjectedScriptHost.h: Added.
+        * inspector/JSInjectedScriptHostPrototype.cpp: Added.
+        * inspector/JSInjectedScriptHostPrototype.h: Added.
+        Implementation of InjectedScriptHost which is passed into the script (InjectedScriptSource.js)
+        that we inject into the page. This is mostly copied from the original autogenerated code,
+        then simplified and cleaned up. InjectedScriptHost can be subclasses to provide specialized
+        implementations of isHTMLAllCollection and type for Web/DOM types unknown to a pure JS context.
+
+
+        Part 4: Move all inspector scripts into JavaScriptCore and update generators.
+
+        For OS X be sure to export the scripts as if they are private headers.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/scripts/cssmin.py: Renamed from Source/WebCore/inspector/Scripts/cssmin.py.
+        * inspector/scripts/inline-and-minify-stylesheets-and-scripts.py: Renamed from Source/WebCore/inspector/Scripts/inline-and-minify-stylesheets-and-scripts.py.
+        * inspector/scripts/jsmin.py: Renamed from Source/WebCore/inspector/Scripts/jsmin.py.
+        * inspector/scripts/xxd.pl: Renamed from Source/WebCore/inspector/xxd.pl.
+
+
+        Part 3: Update CodeGeneratorInspector to avoid inlining virtual destructors.
+
+        This avoids build errors about duplicate exported virtual inlined methods
+        are included from multiple places. Just put empty destructors in the
+        implementation file instead of inlined.
+
+        * inspector/scripts/CodeGeneratorInspector.py:
+        (Generator):
+        (Generator.go):
+        * inspector/scripts/CodeGeneratorInspectorStrings.py:
+
+
+        Part 2: Move InjectedScriptSource and generation into JavaScriptCore.
+
+        Move InjectedScriptSource.js and derived sources generation.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptSource.js: Renamed from Source/WebCore/inspector/InjectedScriptSource.js.
+
+2014-01-09  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        Regression: failing RegExp tests on 32 bit architectures.
+        https://bugs.webkit.org/show_bug.cgi?id=126699
+
+        Reviewed by Michael Saboff.
+
+        Fix setRegExpConstructor functions for 32 bit architectures.
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+
+2014-01-09  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r161540.
+        http://trac.webkit.org/changeset/161540
+        https://bugs.webkit.org/show_bug.cgi?id=126704
+
+        Caused assertion failures on multiple tests (Requested by ap
+        on #webkit).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlockSet::mark):
+        * dfg/DFGOperations.cpp:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::traceMarked):
+        * heap/CodeBlockSet.h:
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        * heap/CopiedSpace.cpp:
+        * heap/CopiedSpace.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::didAbandon):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::didAllocate):
+        * heap/Heap.h:
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isCollecting):
+        (JSC::Heap::isWriteBarrierEnabled):
+        (JSC::Heap::writeBarrier):
+        * heap/HeapOperation.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::~MarkStackArray):
+        * heap/MarkStack.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::isPagedOut):
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::reset):
+        * heap/MarkedBlock.cpp:
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::lastChanceToFinalize):
+        (JSC::MarkedBlock::didConsumeEmptyFreeList):
+        (JSC::MarkedBlock::clearMarks):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::~MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        * heap/MarkedSpace.h:
+        (JSC::ClearMarks::operator()):
+        (JSC::MarkedSpace::clearMarks):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::~SlotVisitor):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::sharedData):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::copyLater):
+        (JSC::SlotVisitor::reportExtraMemoryUsage):
+        * jit/Repatch.cpp:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::StructureRareData::setEnumerationCache):
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren):
+        * runtime/StructureRareDataInlines.h:
+        (JSC::StructureRareData::setPreviousID):
+        (JSC::StructureRareData::setObjectToStringValue):
+        * runtime/WeakMapData.cpp:
+        (JSC::WeakMapData::visitChildren):
+
+2014-01-09  Andreas Kling  <akling@apple.com>
+
+        Shrink WatchpointSet.
+        <https://webkit.org/b/126694>
+
+        Reorder the members of WatchpointSet, shrinking it by 8 bytes.
+        767 kB progression on Membuster3.
+
+        Reviewed by Antti Koivisto.
+
+        * bytecode/Watchpoint.h:
+
+2014-01-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Reverting accidental GC logging
+
+        * heap/Heap.cpp:
+
+2014-01-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Marking should be generational
+        https://bugs.webkit.org/show_bug.cgi?id=126552
+
+        Reviewed by Geoffrey Garen.
+
+        Re-marking the same objects over and over is a waste of effort. This patch implements 
+        the sticky mark bit algorithm (along with our already-present write barriers) to reduce 
+        overhead during garbage collection caused by rescanning objects.
+
+        There are now two collection modes, EdenCollection and FullCollection. EdenCollections
+        only visit new objects or objects that were added to the remembered set by a write barrier.
+        FullCollections are normal collections that visit all objects regardless of their 
+        generation.
+
+        In this patch EdenCollections do not do anything in CopiedSpace. This will be fixed in 
+        https://bugs.webkit.org/show_bug.cgi?id=126555.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlockSet::mark):
+        * dfg/DFGOperations.cpp:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::traceMarked):
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        * heap/CodeBlockSet.h:
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::didStartFullCollection):
+        * heap/CopiedSpace.h:
+        (JSC::CopiedSpace::heap):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::didAbandon):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::didAllocate):
+        (JSC::Heap::writeBarrier):
+        * heap/Heap.h:
+        (JSC::Heap::isInRememberedSet):
+        (JSC::Heap::operationInProgress):
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isCollecting):
+        (JSC::Heap::isWriteBarrierEnabled):
+        (JSC::Heap::writeBarrier):
+        * heap/HeapOperation.h:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::~MarkStackArray):
+        (JSC::MarkStackArray::clear):
+        (JSC::MarkStackArray::fillVector):
+        * heap/MarkStack.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::isListPagedOut):
+        (JSC::MarkedAllocator::isPagedOut):
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::reset):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::MarkedAllocator):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::clearRememberedSet):
+        (JSC::MarkedBlock::clearMarksWithCollectionType):
+        (JSC::MarkedBlock::lastChanceToFinalize):
+        * heap/MarkedBlock.h: Changed atomSize to 16 bytes because we have no objects smaller
+        than 16 bytes. This is also to pay for the additional Bitmap for the remembered set.
+        (JSC::MarkedBlock::didConsumeEmptyFreeList):
+        (JSC::MarkedBlock::setRemembered):
+        (JSC::MarkedBlock::clearRemembered):
+        (JSC::MarkedBlock::atomicClearRemembered):
+        (JSC::MarkedBlock::isRemembered):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::~MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        (JSC::VerifyMarked::operator()):
+        (JSC::MarkedSpace::clearMarks):
+        * heap/MarkedSpace.h:
+        (JSC::ClearMarks::operator()):
+        (JSC::ClearRememberedSet::operator()):
+        (JSC::MarkedSpace::didAllocateInBlock):
+        (JSC::MarkedSpace::clearRememberedSet):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::~SlotVisitor):
+        (JSC::SlotVisitor::clearMarkStack):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::markStack):
+        (JSC::SlotVisitor::sharedData):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::unconditionallyAppend):
+        (JSC::SlotVisitor::copyLater):
+        (JSC::SlotVisitor::reportExtraMemoryUsage):
+        (JSC::SlotVisitor::heap):
+        * jit/Repatch.cpp:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::StructureRareData::setEnumerationCache):
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren):
+        * runtime/StructureRareDataInlines.h:
+        (JSC::StructureRareData::setPreviousID):
+        (JSC::StructureRareData::setObjectToStringValue):
+        * runtime/WeakMapData.cpp:
+        (JSC::WeakMapData::visitChildren):
+
+2014-01-08  Sam Weinig  <sam@webkit.org>
+
+        [JS] Should be able to create a promise by calling the Promise constructor as a function
+        https://bugs.webkit.org/show_bug.cgi?id=126561
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getCallData):
+        Add support for calling the Promise constructor as a function (e.g. var p = Promise(...), note
+        the missing "new").
+
+2014-01-08  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        [EFL] Make FTL buildable
+        https://bugs.webkit.org/show_bug.cgi?id=125777
+
+        Reviewed by Csaba Osztrogonác.
+
+        * CMakeLists.txt:
+        * ftl/FTLOSREntry.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+        * llvm/library/config_llvm.h:
+
+2014-01-08  Zan Dobersek  <zdobersek@igalia.com>
+
+        [Automake] Scripts for generated build targets do not necessarily produce their output
+        https://bugs.webkit.org/show_bug.cgi?id=126378
+
+        Reviewed by Carlos Garcia Campos.
+
+        * GNUmakefile.am: Touch the build targets that are generated through helper scripts that don't
+        assure the output is generated every time the script is invoked, most commonly due to unchanged
+        input. This assures the build targets are up-to-date and can't be older that their dependencies,
+        which would result in constant regeneration at every build.
+
+2014-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG fixup phase should be responsible for inserting ValueToInt32's as needed and it should use Phantom to keep the original values alive in case of OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=126600
+
+        Reviewed by Michael Saboff.
+        
+        This fixes an embarrassing OSR exit liveness bug. It also simplifies the code. We were
+        already using FixupPhase as the place where conversion nodes get inserted. ValueToInt32
+        was the only exception to that rule, and that was one of the reasons why we had this bug.
+        
+        Henceforth ValueToInt32 is only inserted by FixupPhase, and only when it is necessary:
+        we have a BitOp that will want a ToInt32 conversion and the operand is not predicted to
+        already be an int32. If FixupPhase inserts any ValueToInt32's then the BitOp will no
+        longer appear to use the original operand, which will make OSR exit think that the
+        original operand is dead. We work around this they way we always do: insert a Phantom on
+        the original operands right after the BitOp. This ensures that any OSR exit in any of the
+        ValueToInt32's or in the BitOp itself will have values for the original inputs.
+
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::fixBinaryIntEdges):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * tests/stress/bit-op-value-to-int32-input-liveness.js: Added.
+        (foo):
+
+2014-01-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Repatch write barrier slow path call doesn't align the stack in the presence of saved registers
+        https://bugs.webkit.org/show_bug.cgi?id=126093
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/Repatch.cpp: Reworked the stack alignment code for calling out to C code on the write barrier slow path.
+        We need to properly account for the number of reused registers that were saved to the stack, so we have to 
+        pass the ScratchRegisterAllocator around.
+        (JSC::storeToWriteBarrierBuffer):
+        (JSC::writeBarrier):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        * jit/ScratchRegisterAllocator.h: Previously the ScratchRegisterAllocator only knew whether or not it had
+        reused registers, but not how many. In order to correctly align the stack for calls to C slow paths for 
+        the write barriers in inline caches we need to know how the stack is aligned. So now ScratchRegisterAllocator
+        tracks how many registers it has reused.
+        (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        (JSC::ScratchRegisterAllocator::allocateScratch):
+        (JSC::ScratchRegisterAllocator::didReuseRegisters):
+        (JSC::ScratchRegisterAllocator::numberOfReusedRegisters):
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        * llint/LowLevelInterpreter64.asm: Random typo fix.
+
+2014-01-07  Mark Lam  <mark.lam@apple.com>
+
+        r161364 caused JSC tests regression on non-DFG builds (e.g. C Loop and Windows).
+        https://bugs.webkit.org/show_bug.cgi?id=126589.
+
+        Reviewed by Filip Pizlo.
+
+        After the removal of ENABLE(VALUE_PROFILER), the LLINT is now expecting the
+        relevant opcode operands to point to ValueProfiler data structures and will
+        write profiling data into them. Hence, we need to allocate these data
+        structures even though the profiling data won't be used in non-DFG builds.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+
+2014-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERT in compileArithNegate on pdfjs
+        https://bugs.webkit.org/show_bug.cgi?id=126584
+
+        Reviewed by Mark Hahnenberg.
+        
+        Check negative zero when we should check it, not when we shouldn't check it. :-/
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+
+2014-01-07  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        pushFinallyContext saves wrong m_labelScopes size
+        https://bugs.webkit.org/show_bug.cgi?id=124529
+
+        Remove free label scopes before saving finally context.
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::pushFinallyContext):
+
+2014-01-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Heap::collect shouldn't be responsible for sweeping
+        https://bugs.webkit.org/show_bug.cgi?id=126556
+
+        Reviewed by Geoffrey Garen.
+
+        Sweeping happens at an awkward time during collection due to the fact that destructors can 
+        cause arbitrary reentry into the VM. This patch separates collecting and sweeping, and delays 
+        sweeping until after collection has completely finished.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        * heap/Heap.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::sweep):
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::doWork):
+
+2014-01-07  Mark Rowe  <mrowe@apple.com>
+
+        <https://webkit.org/b/126567> Remove the legacy WebKit availability macros
+
+        They're no longer used.
+
+        Reviewed by Ryosuke Niwa.
+
+        * API/WebKitAvailability.h:
+
+2014-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        SetLocal for a FlushedArguments should not claim that the dataFormat is DataFormatJS
+        https://bugs.webkit.org/show_bug.cgi?id=126563
+
+        Reviewed by Gavin Barraclough.
+        
+        This was a rookie arguments simplification mistake: the SetLocal needs to record the fact
+        that although it set JSValue(), OSR should think it set Arguments. DataFormatArguments
+        conveys this, and dataFormatFor(FlushFormat) will do the right thing.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * tests/stress/phantom-arguments-set-local-then-exit-in-same-block.js: Added.
+        (foo):
+
+2014-01-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Make the different flavors of integer arithmetic more explicit, and don't rely on (possibly stale) results of the backwards propagator to decide integer arithmetic semantics
+        https://bugs.webkit.org/show_bug.cgi?id=125519
+
+        Reviewed by Geoffrey Garen.
+        
+        Adds the Arith::Mode enum to arithmetic nodes, which makes it explicit what sorts of
+        checks and overflows the node should do. Previously this would be deduced from
+        backwards analysis results.
+        
+        This also makes "unchecked" variants really mean that you want the int32 wrapped
+        result, so ArithIMul is now done in terms of ArithMul(Unchecked). That means that the
+        constant folder needs to compute exactly the result implied by ArithMode, instead of
+        just folding the double result.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArithMode.cpp: Added.
+        (WTF::printInternal):
+        * dfg/DFGArithMode.h: Added.
+        (JSC::DFG::doesOverflow):
+        (JSC::DFG::shouldCheckOverflow):
+        (JSC::DFG::shouldCheckNegativeZero):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::pureCSE):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::hasArithMode):
+        (JSC::DFG::Node::arithMode):
+        (JSC::DFG::Node::setArithMode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileAddSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDivMod):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
+
+2014-01-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add write barriers to the LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=126527
+
+        Reviewed by Filip Pizlo.
+
+        This patch takes a similar approach to how write barriers work in the baseline JIT.
+        We execute the write barrier at the beginning of the opcode so we don't have to 
+        worry about saving and restoring live registers across write barrier slow path calls 
+        to C code.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_write_barrier_slow):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/arm64.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2014-01-05  Sam Weinig  <sam@webkit.org>
+
+        [JS] Implement Promise.all()
+        https://bugs.webkit.org/show_bug.cgi?id=126510
+
+        Reviewed by Gavin Barraclough.
+
+        Add Promise.all() implementation and factor out performing resolves and rejects
+        on deferreds to share a bit of code. Also moves the abruptRejection helper to
+        JSPromiseDeferred so it can be used in JSPromiseFunctions.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructorFuncCast):
+        (JSC::JSPromiseConstructorFuncResolve):
+        (JSC::JSPromiseConstructorFuncReject):
+        (JSC::JSPromiseConstructorFuncAll):
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::updateDeferredFromPotentialThenable):
+        (JSC::performDeferredResolve):
+        (JSC::performDeferredReject):
+        (JSC::abruptRejection):
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPromiseFunctions.cpp:
+        (JSC::promiseAllCountdownFunction):
+        (JSC::createPromiseAllCountdownFunction):
+        * runtime/JSPromiseFunctions.h:
+        * runtime/JSPromiseReaction.cpp:
+        (JSC::ExecutePromiseReactionMicrotask::run):
+
+2014-01-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of ENABLE(VALUE_PROFILER). It's on all the time now.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpValueProfiling):
+        (JSC::CodeBlock::dumpArrayProfiling):
+        (JSC::CodeBlock::dumpRareCaseProfile):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::setNumParameters):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/LazyOperandValueProfile.cpp:
+        * bytecode/LazyOperandValueProfile.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/ValueProfile.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::newArrayProfile):
+        (JSC::BytecodeGenerator::newArrayAllocationProfile):
+        (JSC::BytecodeGenerator::emitProfiledOpcode):
+        * jit/GPRInfo.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_div):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emitPutCallResult):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitPutCallResult):
+        * jit/JITInlines.h:
+        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
+        (JSC::JIT::emitValueProfilingSite):
+        (JSC::JIT::emitArrayProfilingSiteForBytecodeIndex):
+        (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase):
+        (JSC::JIT::emitArrayProfileOutOfBoundsSpecialCase):
+        (JSC::arrayProfileSaw):
+        (JSC::JIT::chooseArrayMode):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_get_from_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_get_from_scope):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
+        * runtime/CommonSlowPaths.cpp:
+
+2014-01-06  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt shouldn't check for ENABLE(JIT).
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * llint/LLIntCommon.h:
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+
+2014-01-06  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt shouldnt check for ENABLE(JAVASCRIPT_DEBUGGER).
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * debugger/Debugger.h:
+        (JSC::Debugger::Debugger):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+
+2014-01-05  Sam Weinig  <sam@webkit.org>
+
+        [JS] Implement Promise.race()
+        https://bugs.webkit.org/show_bug.cgi?id=126506
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/CommonIdentifiers.h:
+        Add identifier for "cast".
+    
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::abruptRejection):
+        Helper for the RejectIfAbrupt abstract operation.
+  
+        (JSC::JSPromiseConstructorFuncRace):
+        Add implementation of Promise.race()
+
+2014-01-05  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [CMake] Ensure that the autotools build and the CMake install the same files
+        https://bugs.webkit.org/show_bug.cgi?id=116379
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * PlatformGTK.cmake: Install API headers, gir files, and the pkg-config file.
+
+2014-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Use Compiler macros instead of raw "final" and "override"
+        https://bugs.webkit.org/show_bug.cgi?id=126490
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSPromiseReaction.cpp:
+
+2014-01-04  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [CMake] Improve the way we locate gobject-introspection
+        https://bugs.webkit.org/show_bug.cgi?id=126452
+
+        Reviewed by Philippe Normand.
+
+        * PlatformGTK.cmake: Use the new introspection variables.
+
+2014-01-04  Zan Dobersek  <zdobersek@igalia.com>
+
+        Explicitly use the std:: nested name specifier when using std::pair, std::make_pair
+        https://bugs.webkit.org/show_bug.cgi?id=126439
+
+        Reviewed by Andreas Kling.
+
+        Instead of relying on std::pair and std::make_pair symbols being present in the current scope
+        through the pair and make_pair symbols, the std:: specifier should be used explicitly.
+
+        * bytecode/Opcode.cpp:
+        (JSC::compareOpcodePairIndices):
+        (JSC::OpcodeStats::~OpcodeStats):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeBinaryNode):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseIfStatement):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::add):
+
+2014-01-03  David Farler  <dfarler@apple.com>
+
+        [super dealloc] missing in Source/JavaScriptCore/API/tests/testapi.mm, fails to build with -Werror,-Wobjc-missing-super-calls
+        https://bugs.webkit.org/show_bug.cgi?id=126454
+
+        Reviewed by Geoffrey Garen.
+
+        * API/tests/testapi.mm:
+        (-[TextXYZ dealloc]):
+        add [super dealloc]
+        (-[EvilAllocationObject dealloc]):
+        add [super dealloc]
+
+2014-01-02  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(r160304): [GTK] Disable libtool fast install
+        https://bugs.webkit.org/show_bug.cgi?id=126381
+
+        Reviewed by Martin Robinson.
+
+        Remove -no-fast-install ld flag since fast install is now disabled
+        globally.
+
+        * GNUmakefile.am:
+
+2014-01-02  Sam Weinig  <sam@webkit.org>
+
+        Update Promises to the https://github.com/domenic/promises-unwrapping spec
+        https://bugs.webkit.org/show_bug.cgi?id=120954
+
+        Reviewed by Filip Pizlo.
+
+        Update Promises to the revised spec. Notable changes:
+        - JSPromiseResolver is gone.
+        - TaskContext has been renamed Microtask and now has a virtual run() function.
+        - Instead of using custom InternalFunction subclasses, JSFunctions are used
+          with PrivateName properties for internal slots.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::promiseConstructorTable):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::queueMicrotask):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::promiseConstructor):
+        (JSC::JSGlobalObject::promisePrototype):
+        (JSC::JSGlobalObject::promiseStructure):
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::create):
+        (JSC::JSPromise::JSPromise):
+        (JSC::JSPromise::finishCreation):
+        (JSC::JSPromise::visitChildren):
+        (JSC::JSPromise::reject):
+        (JSC::JSPromise::resolve):
+        (JSC::JSPromise::appendResolveReaction):
+        (JSC::JSPromise::appendRejectReaction):
+        (JSC::triggerPromiseReactions):
+        * runtime/JSPromise.h:
+        (JSC::JSPromise::status):
+        (JSC::JSPromise::result):
+        (JSC::JSPromise::constructor):
+        * runtime/JSPromiseCallback.cpp: Removed.
+        * runtime/JSPromiseCallback.h: Removed.
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        (JSC::JSPromiseConstructor::getCallData):
+        (JSC::JSPromiseConstructorFuncCast):
+        (JSC::JSPromiseConstructorFuncResolve):
+        (JSC::JSPromiseConstructorFuncReject):
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromiseDeferred.cpp: Added.
+        (JSC::JSPromiseDeferred::create):
+        (JSC::JSPromiseDeferred::JSPromiseDeferred):
+        (JSC::JSPromiseDeferred::finishCreation):
+        (JSC::JSPromiseDeferred::visitChildren):
+        (JSC::createJSPromiseDeferredFromConstructor):
+        (JSC::updateDeferredFromPotentialThenable):
+        * runtime/JSPromiseDeferred.h: Added.
+        (JSC::JSPromiseDeferred::createStructure):
+        (JSC::JSPromiseDeferred::promise):
+        (JSC::JSPromiseDeferred::resolve):
+        (JSC::JSPromiseDeferred::reject):
+        * runtime/JSPromiseFunctions.cpp: Added.
+        (JSC::deferredConstructionFunction):
+        (JSC::createDeferredConstructionFunction):
+        (JSC::identifyFunction):
+        (JSC::createIdentifyFunction):
+        (JSC::promiseAllCountdownFunction):
+        (JSC::createPromiseAllCountdownFunction):
+        (JSC::promiseResolutionHandlerFunction):
+        (JSC::createPromiseResolutionHandlerFunction):
+        (JSC::rejectPromiseFunction):
+        (JSC::createRejectPromiseFunction):
+        (JSC::resolvePromiseFunction):
+        (JSC::createResolvePromiseFunction):
+        (JSC::throwerFunction):
+        (JSC::createThrowerFunction):
+        * runtime/JSPromiseFunctions.h: Added.
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototypeFuncThen):
+        (JSC::JSPromisePrototypeFuncCatch):
+        * runtime/JSPromiseReaction.cpp: Added.
+        (JSC::createExecutePromiseReactionMicroTask):
+        (JSC::ExecutePromiseReactionMicroTask::run):
+        (JSC::JSPromiseReaction::create):
+        (JSC::JSPromiseReaction::JSPromiseReaction):
+        (JSC::JSPromiseReaction::finishCreation):
+        (JSC::JSPromiseReaction::visitChildren):
+        * runtime/JSPromiseReaction.h: Added.
+        (JSC::JSPromiseReaction::createStructure):
+        (JSC::JSPromiseReaction::deferred):
+        (JSC::JSPromiseReaction::handler):
+        * runtime/JSPromiseResolver.cpp: Removed.
+        * runtime/JSPromiseResolver.h: Removed.
+        * runtime/JSPromiseResolverConstructor.cpp: Removed.
+        * runtime/JSPromiseResolverConstructor.h: Removed.
+        * runtime/JSPromiseResolverPrototype.cpp: Removed.
+        * runtime/JSPromiseResolverPrototype.h: Removed.
+        * runtime/Microtask.h: Added.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h:
+
+2014-01-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add support for StoreBarrier and friends to the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=126040
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileStoreBarrier):
+        (JSC::FTL::LowerDFGToLLVM::compileConditionalStoreBarrier):
+        (JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck):
+        (JSC::FTL::LowerDFGToLLVM::loadMarkByte):
+        (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrierBuffer):
+
+2014-01-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Storing new CopiedSpace memory into a JSObject should fire a write barrier
+        https://bugs.webkit.org/show_bug.cgi?id=126025
+
+        Reviewed by Filip Pizlo.
+
+        Technically this is creating a pointer between a (potentially) old generation object and a young 
+        generation chunk of memory, thus there needs to be a barrier.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOperations.cpp:
+        * heap/CopyWriteBarrier.h: Added. This class functions similarly to the WriteBarrier class. It 
+        acts as a proxy for pointers to CopiedSpace. Assignments to the field cause a write barrier to 
+        fire for the object that is the owner of the CopiedSpace memory. This is to ensure during nursery 
+        collections that objects with new backing stores are visited, even if they are old generation objects. 
+        (JSC::CopyWriteBarrier::CopyWriteBarrier):
+        (JSC::CopyWriteBarrier::operator!):
+        (JSC::CopyWriteBarrier::operator UnspecifiedBoolType*):
+        (JSC::CopyWriteBarrier::get):
+        (JSC::CopyWriteBarrier::operator*):
+        (JSC::CopyWriteBarrier::operator->):
+        (JSC::CopyWriteBarrier::set):
+        (JSC::CopyWriteBarrier::setWithoutWriteBarrier):
+        (JSC::CopyWriteBarrier::clear):
+        * heap/Heap.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        * runtime/JSCell.h:
+        (JSC::JSCell::unvalidatedStructure):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::countElements):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        * runtime/JSObject.h:
+        (JSC::JSObject::butterfly):
+        (JSC::JSObject::setStructureAndButterfly):
+        (JSC::JSObject::setButterflyWithoutChangingStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/MapData.cpp:
+        (JSC::MapData::ensureSpaceForAppend):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+
+2013-12-23  Oliver Hunt  <oliver@apple.com>
+
+        Refactor PutPropertySlot to be aware of custom properties
+        https://bugs.webkit.org/show_bug.cgi?id=126187
+
+        Reviewed by Antti Koivisto.
+
+        Refactor PutPropertySlot, making the constructor take the thisValue
+        used as a target.  This results in a wide range of boilerplate changes
+        to pass the new parameter.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putByIndex):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncPush):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putByIndex):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::deleteProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        (JSC::lookupPut):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setCustomProperty):
+        (JSC::PutPropertySlot::thisValue):
+        (JSC::PutPropertySlot::isCacheable):
+
+2014-01-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize DFG DCE
+        https://bugs.webkit.org/show_bug.cgi?id=125523
+
+        Reviewed by Mark Hahnenberg.
+        
+        Adds the ability to DCE more things. It's now the case that if a node is completely
+        pure, we clear NodeMustGenerate and the node becomes a DCE candidate.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::cleanVariables):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileValueAdd):
+
+2014-01-02  Benjamin Poulain  <benjamin@webkit.org>
+
+        Attempt to fix the build of WebCore's code generator on CMake based system
+        https://bugs.webkit.org/show_bug.cgi?id=126271
+
+        Reviewed by Sam Weinig.
+
+        * CMakeLists.txt:
+
+2013-12-30  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r161157, r161158, r161160, r161161,
+        r161163, and r161165.
+        http://trac.webkit.org/changeset/161157
+        http://trac.webkit.org/changeset/161158
+        http://trac.webkit.org/changeset/161160
+        http://trac.webkit.org/changeset/161161
+        http://trac.webkit.org/changeset/161163
+        http://trac.webkit.org/changeset/161165
+        https://bugs.webkit.org/show_bug.cgi?id=126332
+
+        Broke WebKit2 on Mountain Lion (Requested by ap on #webkit).
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::~BlockAllocator):
+        (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
+        (JSC::BlockAllocator::waitForRelativeTime):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+        * heap/BlockAllocator.h:
+        (JSC::BlockAllocator::deallocate):
+
+2013-12-30  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * heap/BlockAllocator.h:
+
+2013-12-30  Anders Carlsson  <andersca@apple.com>
+
+        Stop using ThreadCondition in BlockAllocator
+        https://bugs.webkit.org/show_bug.cgi?id=126313
+
+        Reviewed by Sam Weinig.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::~BlockAllocator):
+        (JSC::BlockAllocator::waitForDuration):
+        (JSC::BlockAllocator::blockFreeingThreadMain):
+        * heap/BlockAllocator.h:
+        (JSC::BlockAllocator::deallocate):
+
+2013-12-30  Anders Carlsson  <andersca@apple.com>
+
+        Stop using ThreadCondition in jsc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=126311
+
+        Reviewed by Sam Weinig.
+
+        * jsc.cpp:
+        (timeoutThreadMain):
+        (main):
+
+2013-12-30  Anders Carlsson  <andersca@apple.com>
+
+        Replace WTF::ThreadingOnce with std::call_once
+        https://bugs.webkit.org/show_bug.cgi?id=126215
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::globalWorklist):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+
+2013-12-30  Martin Robinson  <mrobinson@igalia.com>
+
+        [CMake] [GTK] Add support for GObject introspection
+        https://bugs.webkit.org/show_bug.cgi?id=126162
+
+        Reviewed by Daniel Bates.
+
+        * PlatformGTK.cmake: Add the GIR targets.
+
+2013-12-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of DFG forward exiting
+        https://bugs.webkit.org/show_bug.cgi?id=125531
+
+        Reviewed by Oliver Hunt.
+        
+        This finally gets rid of forward exiting. Forward exiting was always a fragile concept
+        since it involved the compiler trying to figure out how to "roll forward" the
+        execution from some DFG node to the next bytecode index. It was always easy to find
+        counterexamples where it broke, and it has always served as an obstacle to adding
+        compiler improvements - the latest being http://webkit.org/b/125523, which tried to
+        make DCE work for more things.
+        
+        This change finishes the work of removing forward exiting. A lot of forward exiting
+        was already removed in some other bugs, but SetLocal still did forward exits. SetLocal
+        is in many ways the hardest to remove, since the forward exiting of SetLocal also
+        implied that any conversion nodes inserted before the SetLocal would then also be
+        marked as forward-exiting. Hence SetLocal's forward-exiting made a bunch of other
+        things also forward-exiting, and this was always a source of weirdo bugs.
+        
+        SetLocal must be able to exit in case it performs a hoisted type speculation. Nodes
+        inserted just before SetLocal must also be able to exit - for example type check
+        hoisting may insert a CheckStructure, or fixup phase may insert something like
+        Int32ToDouble. But if any of those nodes tried to backward exit, then this could lead
+        to the reexecution of a side-effecting operation, for example:
+        
+            a: Call(...)
+            b: SetLocal(@a, r1)
+        
+        For a long time it seemed like SetLocal *had* to exit forward because of this. But
+        this change side-steps the problem by changing the ByteCodeParser to always emit a
+        kind of "two-phase commit" for stores to local variables. Now when the ByteCodeParser
+        wishes to store to a local, it first emits a MovHint and then enqueues a SetLocal.
+        The SetLocal isn't actually emitted until the beginning of the next bytecode
+        instruction (which the exception of op_enter and op_ret, which emit theirs immediately
+        since it's always safe to reexecute those bytecode instructions and since deferring
+        SetLocals would be weird there - op_enter has many SetLocals and op_ret is a set
+        followed by a jump in case of inlining, so we'd have to emit the SetLocal "after" the
+        jump and that would be awkward). This means that the above IR snippet would look
+        something like:
+        
+            a: Call(..., bc#42)
+            b: MovHint(@a, r1, bc#42)
+            c: SetLocal(@a, r1, bc#47)
+        
+        Where the SetLocal exits "backwards" but appears at the beginning of the next bytecode
+        instruction. This means that by the time we get to that SetLocal, the OSR exit
+        analysis already knows that r1 is associated with @a, and it means that the SetLocal
+        or anything hoisted above it can exit backwards as normal.
+        
+        This change also means that the "forward rewiring" can be killed. Previously, we might
+        have inserted a conversion node on SetLocal and then the SetLocal died (i.e. turned
+        into a MovHint) and the conversion node either died completely or had its lifetime
+        truncated to be less than the actual value's bytecode lifetime. This no longer happens
+        since conversion nodes are only inserted at SetLocals.
+        
+        More precisely, this change introduces two laws that we were basically already
+        following anyway:
+        
+        1) A MovHint's child should never be changed except if all other uses of that child
+           are also replaced. Specifically, this prohibits insertion of conversion nodes at
+           MovHints.
+        
+        2) Anytime any child is replaced with something else, and all other uses aren't also
+           replaced, we must insert a Phantom use of the original child.
+
+        This is a slight compile-time regression but has no effect on code-gen. It unlocks a
+        bunch of optimization opportunities so I think it's worth it.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::instructionCount):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setDirect):
+        (JSC::DFG::ByteCodeParser::DelayedSetLocal::DelayedSetLocal):
+        (JSC::DFG::ByteCodeParser::DelayedSetLocal::execute):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::eliminate):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        (JSC::DFG::DCEPhase::fixupBlock):
+        (JSC::DFG::DCEPhase::cleanVariables):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixEdge):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGMinifiedNode.cpp:
+        (JSC::DFG::MinifiedNode::fromNode):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        (JSC::DFG::MinifiedNode::constantNumber):
+        (JSC::DFG::MinifiedNode::weakConstant):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::hasVariableAccessData):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantom):
+        (JSC::DFG::Node::convertToPhantomUnchecked):
+        (JSC::DFG::Node::convertToIdentity):
+        (JSC::DFG::Node::containsMovHint):
+        (JSC::DFG::Node::hasUnlinkedLocal):
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGOSRExit.cpp:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitBase.cpp:
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
+        (JSC::DFG::SpeculativeJIT::typeCheck):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::needsTypeCheck):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArgument):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileMovHint):
+        (JSC::FTL::LowerDFGToLLVM::compileZombieHint):
+        (JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::typeCheck):
+        (JSC::FTL::LowerDFGToLLVM::appendTypeCheck):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        * ftl/FTLOSRExit.cpp:
+        * ftl/FTLOSRExit.h:
+        * tests/stress/dead-int32-to-double.js: Added.
+        (foo):
+        * tests/stress/dead-uint32-to-number.js: Added.
+        (foo):
+
+2013-12-25  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r161033 and r161074.
+        http://trac.webkit.org/changeset/161033
+        http://trac.webkit.org/changeset/161074
+        https://bugs.webkit.org/show_bug.cgi?id=126240
+
+        Oliver says that a rollout would be better (Requested by ap on
+        #webkit).
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putByIndex):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncPush):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putByIndex):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::deleteProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        (JSC::lookupPut):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::isCacheable):
+
+2013-12-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG PhantomArguments shouldn't rely on a dead Phi graph
+        https://bugs.webkit.org/show_bug.cgi?id=126218
+
+        Reviewed by Oliver Hunt.
+        
+        This change dramatically rationalizes our handling of PhantomArguments (i.e.
+        speculative elision of arguments object allocation).
+        
+        It's now the case that if we decide that we can elide arguments allocation, we just
+        turn the arguments-creating node into a PhantomArguments and mark all locals that
+        it's stored to as being arguments aliases. Being an arguments alias and being a
+        PhantomArguments means basically the same thing: in DFG execution you have the empty
+        value, on OSR exit an arguments object is allocated in your place, and all operations
+        that use the value now just refer directly to the actual arguments in the call frame
+        header (or the arguments we know that we passed to the call, in case of inlining).
+        
+        This means that we no longer have arguments simplification creating a dead Phi graph
+        that then has to be interpreted by the OSR exit logic. That sort of never made any
+        sense.
+        
+        This means that PhantomArguments now has a clear story in SSA: basically SSA just
+        gets rid of the "locals" but everything else is the same.
+        
+        Finally, this means that we can more easily get rid of forward exiting. As I was
+        working on the code to get rid of forward exiting, I realized that I'd have to
+        carefully preserve the special meanings of MovHint and SetLocal in the case of
+        PhantomArguments. It was really bizarre: even the semantics of MovHint were tied to
+        our specific treatment of PhantomArguments. After this change this is no longer the
+        case.
+        
+        One of the really cool things about this change is that arguments reification now
+        just becomes a special kind of FlushFormat. This further unifies things: it means
+        that a MovHint(PhantomArguments) and a SetLocal(PhantomArguments) both have the same
+        meaning, since both of them dictate that the way we recover the local on exit is by
+        reifying arguments. Previously, the SetLocal(PhantomArguments) case needed some
+        special handling to accomplish this.
+        
+        A downside of this approach is that we will now emit code to store the empty value
+        into aliased arguments variables, and we will even emit code to load that empty value
+        as well. As far as I can tell this doesn't cost anything, since PhantomArguments are
+        most profitable in cases where it allows us to simplify control flow and kill the
+        arguments locals entirely. Of course, this isn't an issue in SSA form since SSA form
+        also eliminates the locals.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::detypeArgumentsReferencingPhantomChild):
+        * dfg/DFGFlushFormat.cpp:
+        (WTF::printInternal):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::resultFor):
+        (JSC::DFG::useKindFor):
+        (JSC::DFG::dataFormatFor):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::ValueSource):
+        (JSC::DFG::ValueSource::forFlushFormat):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::flushFormat):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+
+2013-12-23  Oliver Hunt  <oliver@apple.com>
+
+        Refactor PutPropertySlot to be aware of custom properties
+        https://bugs.webkit.org/show_bug.cgi?id=126187
+
+        Reviewed by msaboff.
+
+        Refactor PutPropertySlot, making the constructor take the thisValue
+        used as a target.  This results in a wide range of boilerplate changes
+        to pass the new parameter.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putByIndex):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncPush):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putByIndex):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::deleteProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        (JSC::lookupPut):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setCustomProperty):
+        (JSC::PutPropertySlot::thisValue):
+        (JSC::PutPropertySlot::isCacheable):
+
+2013-12-23  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add class matching to the Selector Code Generator
+        https://bugs.webkit.org/show_bug.cgi?id=126176
+
+        Reviewed by Antti Koivisto and Oliver Hunt.
+
+        Add test and branch based on BaseIndex addressing for x86_64.
+        Fast loops are needed to compete with clang on tight loops.
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branch64):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpq_rm):
+
+2013-12-23  Oliver Hunt  <oliver@apple.com>
+
+        Update custom setter implementations to perform type checks
+        https://bugs.webkit.org/show_bug.cgi?id=126171
+
+        Reviewed by Daniel Bates.
+
+        Modify the setter function signature to take encoded values
+        as we're changing the setter usage everywhere anyway.
+
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+
+2013-12-23  Lucas Forschler  <lforschler@apple.com>
+
+        <rdar://problem/15682948> Update copyright strings
+        
+        Reviewed by Dan Bernstein.
+
+        * Info.plist:
+        * JavaScriptCore.vcxproj/JavaScriptCore.resources/Info.plist:
+
+2013-12-23  Zan Dobersek  <zdobersek@igalia.com>
+
+        [GTK] Clean up compiler optimizations flags for libWTF, libJSC
+        https://bugs.webkit.org/show_bug.cgi?id=126157
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * GNUmakefile.am: Remove the -fstrict-aliasing and -O3 compiler flags for libWTF.la. -O3 gets
+        overridden by -O2 that's listed in CXXFLAGS (or -O0 in case of debug builds) and -fstrict-aliasing
+        is enabled when -O2 is used (and shouldn't be enabled in debug builds anyway).
+
+2013-12-22  Martin Robinson  <mrobinson@igalia.com>
+
+        [CMake] Fix typo from r160812
+        https://bugs.webkit.org/show_bug.cgi?id=126145
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * CMakeLists.txt: Fix typo when detecting the type of library.
+
+2013-12-22  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK][CMake] libtool-compatible soversion calculation
+        https://bugs.webkit.org/show_bug.cgi?id=125511
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * CMakeLists.txt: Use the POPULATE_LIBRARY_VERSION macro and the
+        library-specific version information.
+
+2013-12-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] [CMake] Generate pkg-config files
+        https://bugs.webkit.org/show_bug.cgi?id=125685
+
+        Reviewed by Martin Robinson.
+
+        * PlatformGTK.cmake: Added. Generate javascriptcoregtk-3.0.pc.
+
+2013-12-22  Benjamin Poulain  <benjamin@webkit.org>
+
+        Create a skeleton for CSS Selector code generation
+        https://bugs.webkit.org/show_bug.cgi?id=126044
+
+        Reviewed by Antti Koivisto and Gavin Barraclough.
+
+        * assembler/LinkBuffer.h:
+        Add a new owner UID for code compiled for CSS.
+        Export the symbols needed to link code from WebCore.
+
+2013-12-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Clean up DFG write barriers
+        https://bugs.webkit.org/show_bug.cgi?id=126047
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer): Use the register allocator to 
+        determine which registers need saving instead of saving every single one of them.
+        (JSC::DFG::SpeculativeJIT::osrWriteBarrier): We don't need to save live register state 
+        because the write barriers during OSR execute when there are no live registers. Also we  
+        don't need to use pushes to pad the stack pointer for pokes on x86; we can just use an add.
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT.h:
+        * jit/Repatch.cpp:
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        * runtime/VM.h: Get rid of writeBarrierRegisterBuffer since it's no longer used.
+
+2013-12-20  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        [MIPS] Missing MacroAssemblerMIPS::branchTest8(ResultCondition, BaseIndex, TrustedImm32)
+        https://bugs.webkit.org/show_bug.cgi?id=126062
+
+        Reviewed by Mark Hahnenberg.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchTest8):
+
+2013-12-20  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Add missing implementation in MacroAssembler to fix build.
+        https://bugs.webkit.org/show_bug.cgi?id=126063
+
+        Reviewed by Mark Hahnenberg.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchTest8):
+
+2013-12-20  Julien Brianceau  <jbriance@cisco.com>
+
+        [arm] Add missing implementation in MacroAssembler to fix CPU(ARM_TRADITIONAL) build.
+        https://bugs.webkit.org/show_bug.cgi?id=126064
+
+        Reviewed by Mark Hahnenberg.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchTest8):
+
+2013-12-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add InspectorFrontendHost.debuggableType to let the frontend know it's backend is JavaScript or Web
+        https://bugs.webkit.org/show_bug.cgi?id=126016
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::listingForDebuggable):
+        * inspector/remote/RemoteInspectorConstants.h:
+        Include a debuggable type identifier in the debuggable listing,
+        so the remote frontend can know if it is debugging a Web Page
+        or JS Context.
+
+2013-12-19  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add an utility class to simplify generating function calls
+        https://bugs.webkit.org/show_bug.cgi?id=125972
+
+        Reviewed by Geoffrey Garen.
+
+        Split branchTest32 in two functions: test32AndSetFlags and branchOnFlags.
+        This is done to allow code where the flags are set, multiple operation that
+        do not modify the flags occur, then the flags are used.
+
+        This is used for function calls to test the return value while discarding the
+        return register.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::test32AndSetFlags):
+        (JSC::MacroAssemblerX86Common::branchOnFlags):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+
+2013-12-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Put write barriers in the right places in the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=125975
+
+        Reviewed by Filip Pizlo.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        (JSC::JIT::emitArrayProfilingSite):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emitSlow_op_enter):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emitSlow_op_enter):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitPutGlobalProperty):
+        (JSC::JIT::emitPutGlobalVar):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::checkMarkWord):
+        (JSC::JIT::emitWriteBarrier):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::emitPutGlobalProperty):
+        (JSC::JIT::emitPutGlobalVar):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_init_global_const):
+        * jit/Repatch.cpp:
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        (JSC::repatchPutByID):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+
+2013-12-19  Brent Fulgham  <bfulgham@apple.com>
+
+        Implement ArrayBuffer.isView
+        https://bugs.webkit.org/show_bug.cgi?id=126004
+
+        Reviewed by Filip Pizlo.
+
+        Test coverage in webgl/1.0.2/resources/webgl_test_files/conformance/typedarrays/array-unit-tests.html
+
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::finishCreation): Add 'isView' to object constructor.
+        (JSC::arrayBufferFuncIsView): New method.
+
+2013-12-19  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken C loop LLINT build.
+        https://bugs.webkit.org/show_bug.cgi?id=126024.
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/VM.h:
+
+2013-12-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        DelayedReleaseScope is in the wrong place
+        https://bugs.webkit.org/show_bug.cgi?id=125876
+
+        Reviewed by Geoffrey Garen.
+
+        The DelayedReleaseScope needs to be around the free list sweeping in MarkedAllocator::tryAllocateHelper. 
+        This location gives us a good safe point between getting ready to allocate  (i.e. identifying a non-empty 
+        free list) and doing the actual allocation (popping the free list).
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::allocateSlowCase):
+        (JSC::MarkedAllocator::addBlock):
+        * runtime/JSCellInlines.h:
+        (JSC::allocateCell):
+
+2013-12-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK][CMake] make libjavascriptcoregtk a public shared library again
+        https://bugs.webkit.org/show_bug.cgi?id=125512
+
+        Reviewed by Martin Robinson.
+
+        * CMakeLists.txt: use target type instead of SHARED_CORE to decide whether
+        JavaScriptCore is a shared library, since it's always shared for GTK+ regardless
+        of SHARED_CORE.
+
+2013-12-18  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add a simple stack abstraction for x86_64
+        https://bugs.webkit.org/show_bug.cgi?id=125908
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::addPtrNoFlags):
+        Add an explicit abstraction for the "lea" instruction. This is needed
+        by the experimental JIT to have add and substract without changing the flags.
+
+        This is useful for function calls to test the return value, restore the registers,
+        then branch on the flags from the return value.
+
+2013-12-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        DFG should have a separate StoreBarrier node
+        https://bugs.webkit.org/show_bug.cgi?id=125530
+
+        Reviewed by Filip Pizlo.
+
+        This is in preparation for GenGC. We use a separate StoreBarrier node instead of making them implicitly 
+        part of other nodes so that it's easier to run analyses on them, e.g. for the StoreBarrierElisionPhase. 
+        They are inserted during the fixup phase. Initially they do not generate any code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::isKnownNotCell):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberizeForAllocation):
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants): Whenever we insert new nodes that require StoreBarriers,
+        we have to add those new StoreBarriers too. It's important to note that AllocatePropertyStorage and 
+        ReallocatePropertyStorage nodes require their StoreBarriers to come after them since they allocate first,
+        which could cause a GC, and then store the resulting buffer into their JSCell, which requires the barrier.
+        If we ever require that write barriers occur before stores, we'll have to split these nodes into 
+        AllocatePropertyStorage + StoreBarrier + PutPropertyStorage.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::insertStoreBarrier):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isStoreBarrier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
+        (JSC::DFG::SpeculativeJIT::genericWriteBarrier): The fast path write barrier check. It loads the 
+        byte that contains the mark bit of the object. 
+        (JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer): If the fast path check fails we try to store the 
+        cell in the WriteBarrierBuffer so as to avoid frequently flushing all registers in order to make a C call.
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::osrWriteBarrier): More barebones version of the write barrier to be executed 
+        during an OSR exit into baseline code. We must do this so that the baseline JIT object and array profiles 
+        are properly cleared during GC.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compileBaseValueStoreBarrier):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compileBaseValueStoreBarrier):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGStoreBarrierElisionPhase.cpp: Added. New DFG phase that does block-local elision of redundant
+        StoreBarriers. Every time a StoreBarrier on a particular object is executed, a bit is set indicating that 
+        that object doesn't need any more StoreBarriers. 
+        (JSC::DFG::StoreBarrierElisionPhase::StoreBarrierElisionPhase):
+        (JSC::DFG::StoreBarrierElisionPhase::couldCauseGC): Nodes that could cause a GC reset the bits for all of the 
+        objects known in the current block. 
+        (JSC::DFG::StoreBarrierElisionPhase::allocatesFreshObject): A node that creates a new object automatically 
+        sets the bit for that object since if a GC occurred as the result of that object's allocation then that 
+        object would not need a barrier since it would be guaranteed to be a young generation object until the 
+        next GC point.
+        (JSC::DFG::StoreBarrierElisionPhase::noticeFreshObject):
+        (JSC::DFG::StoreBarrierElisionPhase::getBaseOfStore):
+        (JSC::DFG::StoreBarrierElisionPhase::shouldBeElided):
+        (JSC::DFG::StoreBarrierElisionPhase::elideBarrier):
+        (JSC::DFG::StoreBarrierElisionPhase::handleNode):
+        (JSC::DFG::StoreBarrierElisionPhase::handleBlock):
+        (JSC::DFG::StoreBarrierElisionPhase::run):
+        (JSC::DFG::performStoreBarrierElision):
+        * dfg/DFGStoreBarrierElisionPhase.h: Added.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::offsetOfMarks):
+        * heap/WriteBarrierBuffer.cpp: Added. The WriteBarrierBuffer buffers a set of JSCells that are awaiting 
+        a pending WriteBarrier. This buffer is used by the DFG to avoid the overhead of calling out to C repeatedly
+        to invoke a write barrier on a single JSCell. Instead the DFG has inline code to fill the WriteBarrier buffer
+        until its full, and then to call out to C to flush it. The WriteBarrierBuffer will also be flushed prior to 
+        each EdenCollection.
+        (JSC::WriteBarrierBuffer::WriteBarrierBuffer):
+        (JSC::WriteBarrierBuffer::~WriteBarrierBuffer):
+        (JSC::WriteBarrierBuffer::flush):
+        (JSC::WriteBarrierBuffer::reset):
+        (JSC::WriteBarrierBuffer::add):
+        * heap/WriteBarrierBuffer.h: Added.
+        (JSC::WriteBarrierBuffer::currentIndexOffset):
+        (JSC::WriteBarrierBuffer::capacityOffset):
+        (JSC::WriteBarrierBuffer::bufferOffset):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * runtime/VM.h:
+
+2013-12-18  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.am:
+
+2013-12-17  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix armv7 and sh4 builds.
+        https://bugs.webkit.org/show_bug.cgi?id=125848
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/ARMv7Assembler.h: Include limits.h for INT_MIN.
+        * assembler/SH4Assembler.h: Include limits.h for INT_MIN.
+
+2013-12-16  Oliver Hunt  <oliver@apple.com>
+
+        Avoid indirect function calls for custom getters
+        https://bugs.webkit.org/show_bug.cgi?id=125821
+
+        Reviewed by Mark Hahnenberg.
+
+        Rather than invoking a helper function to perform an indirect call
+        through a function pointer, just have the JIT call the function directly.
+
+        Unfortunately this only works in JSVALUE64 at the moment as there
+        is not an obvious way to pass two EncodedJSValues uniformly over
+        the various effected JITs.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArguments):
+        * jit/Repatch.cpp:
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryBuildGetByIDList):
+
+2013-12-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix some whitespace issues in inspector code
+        https://bugs.webkit.org/show_bug.cgi?id=125814
+
+        Reviewed by Darin Adler.
+
+        * inspector/protocol/Debugger.json:
+        * inspector/protocol/Runtime.json:
+        * inspector/scripts/CodeGeneratorInspector.py:
+        (Generator.process_command):
+
+2013-12-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add some missing functions to MacroAssembler
+        https://bugs.webkit.org/show_bug.cgi?id=125809
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/AssemblerBuffer.h:
+        * assembler/LinkBuffer.cpp:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::andPtr):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::and64):
+        (JSC::MacroAssemblerARM64::branchTest8):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        * assembler/X86Assembler.h:
+
+2013-12-16  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Remove dead code after conversion to VS2013
+        https://bugs.webkit.org/show_bug.cgi?id=125795
+
+        Reviewed by Darin Adler.
+
+        * API/tests/testapi.c: Remove local nan implementation
+
+2013-12-16  Oliver Hunt  <oliver@apple.com>
+
+        Cache getters and custom accessors on the prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=125602
+
+        Reviewed by Michael Saboff.
+
+        Support caching of custom getters and accessors on the prototype chain.
+        This is relatively trivial and just requires a little work compared to
+        the direct access mode as we're under more register pressure.
+
+        * bytecode/StructureStubInfo.h:
+          Removed the unsued initGetByIdProto as it was confusing to still have it present.
+        * jit/Repatch.cpp:
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+
+2013-12-16  Mark Lam  <mark.lam@apple.com>
+
+        Change slow path result to take a void* instead of a ExecState*.
+        https://bugs.webkit.org/show_bug.cgi?id=125802.
+
+        Reviewed by Filip Pizlo.
+
+        This is in preparation for C Stack OSR entry work that is coming soon.
+        In the OSR entry case, we'll be returning a topOfFrame pointer value
+        instead of the ExecState*.
+
+        * offlineasm/cloop.rb:
+        * runtime/CommonSlowPaths.h:
+        (JSC::encodeResult):
+        (JSC::decodeResult):
+
+2013-12-16  Alex Christensen  <achristensen@webkit.org>
+
+        Fixed Win64 build on VS2013.
+        https://bugs.webkit.org/show_bug.cgi?id=125753
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        Added correct PlatformToolset for 64-bit builds.
+
+2013-12-16  Peter Szanka  <h868064@stud.u-szeged.hu>
+
+        Delete RVCT related code parts.
+        https://bugs.webkit.org/show_bug.cgi?id=125626
+
+        Reviewed by Darin Adler.
+
+        * assembler/ARMAssembler.cpp:
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::cacheFlush):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+
+2013-12-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION: 2x regression on Dromaeo DOM query tests
+        https://bugs.webkit.org/show_bug.cgi?id=125377
+
+        Reviewed by Filip Pizlo.
+
+        The bug was caused by JSC not JIT'ing property access on "document" due to its type info having
+        HasImpureGetOwnPropertySlot flag.
+
+        Fixed the bug by new type info flag NewImpurePropertyFiresWatchpoints, which allows the baseline
+        JIT to generate byte code for access properties on an object with named properties (a.k.a.
+        custom name getter) in DOM. When a new named property appears on the object, VM is notified via
+        VM::addImpureProperty and fires StructureStubClearingWatchpoint added during the repatch.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt): Take the slow path if we have any object with impure
+        properties in the prototype chain.
+        (JSC::GetByIdStatus::computeForChain): Ditto.
+
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess): Throw away the byte code when a new impure property is added on any
+        object in the prototype chain via StructureStubClearingWatchpoint.
+        (JSC::generateProtoChainAccessStub): Ditto.
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::tryRepatchIn): Ditto.
+
+        * runtime/JSTypeInfo.h: Added NewImpurePropertyFiresWatchpoints.
+        (JSC::TypeInfo::newImpurePropertyFiresWatchpoints): Added.
+
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChainForChainAccess): Don't exit early if VM will be notified of new
+        impure property even if the object had impure properties.
+
+        * runtime/Structure.h:
+        (JSC::Structure::takesSlowPathInDFGForImpureProperty): Added. Wraps hasImpureGetOwnPropertySlot and
+        asserts that newImpurePropertyFiresWatchpoints is true whenever hasImpureGetOwnPropertySlot is true.
+
+        * runtime/VM.cpp:
+        (JSC::VM::registerWatchpointForImpureProperty): Added.
+        (JSC::VM::addImpureProperty): Added. HTMLDocument calls it to notify JSC of a new impure property.
+
+        * runtime/VM.h:
+
+2013-12-15  Andy Estes  <aestes@apple.com>
+
+        [iOS] Upstream changes to FeatureDefines.xcconfig
+        https://bugs.webkit.org/show_bug.cgi?id=125742
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should *really* know when things are flushed
+        https://bugs.webkit.org/show_bug.cgi?id=125747
+
+        Reviewed by Sam Weinig.
+        
+        Fix more codegen badness. This makes V8v7's crypto am3() function run faster in the FTL
+        than in DFG. This means that even if we just compile those functions in V8v7 that don't
+        make calls, the FTL gives us a 2% speed-up over the DFG. That's pretty good considering
+        that we have still more optimizations to fix and we can make calls work.
+
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+
+2013-12-14  Andy Estes  <aestes@apple.com>
+
+        Unify FeatureDefines.xcconfig
+        https://bugs.webkit.org/show_bug.cgi?id=125741
+
+        Rubber-stamped by Dan Bernstein.
+
+        * Configurations/FeatureDefines.xcconfig: Enable ENABLE_MEDIA_SOURCE.
+
+2013-12-14  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r160557.
+
+        r160557 added the first generated header to JavaScriptCore that needs to be installed in to
+        the framework wrapper. Sadly JavaScriptCore's Derived Sources target was not set to generate
+        headers when invoked as part of the installhdrs action. This resulted in the build failing
+        due to Xcode being unable to find the header file to install. The fix for this is to configure
+        the Derived Sources target to use JavaScriptCore.xcconfig, which sets INSTALLHDRS_SCRIPT_PHASE
+        to YES and allows Xcode to generate derived sources during the installhdrs action.
+
+        Enabling INSTALLHDRS_SCRIPT_PHASE required tweaking the Generate Derived Sources script build
+        phase to skip running code related to offlineasm that depends on JSCLLIntOffsetExtractor
+        having been compiled, which isn't the case at installhdrs time.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-12-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Some Set and Map prototype functions have incorrect function lengths
+        https://bugs.webkit.org/show_bug.cgi?id=125732
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+
+2013-12-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Move Inspector and Debugger protocol domains into JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=125707
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * inspector/protocol/Debugger.json: Renamed from Source/WebCore/inspector/protocol/Debugger.json.
+        * inspector/protocol/GenericTypes.json: Added.
+        * inspector/protocol/InspectorDomain.json: Renamed from Source/WebCore/inspector/protocol/InspectorDomain.json.
+        Add new files to inspector generation.
+
+        * inspector/scripts/CodeGeneratorInspector.py:
+        (Generator.go):
+        Only build TypeBuilder output if the domain only has types. Avoid
+        backend/frontend dispatchers and backend commands.
+
+        (TypeBindings.create_type_declaration_.EnumBinding.get_setter_value_expression_pattern):
+        (format_setter_value_expression):
+        (Generator.process_command):
+        (Generator.generate_send_method):
+        * inspector/scripts/CodeGeneratorInspectorStrings.py:
+        Export and name the get{JS,Web}EnumConstant function.
+
+2013-12-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of forward exit on UInt32ToNumber by adding an op_unsigned bytecode instruction
+        https://bugs.webkit.org/show_bug.cgi?id=125553
+
+        Reviewed by Oliver Hunt.
+        
+        UInt32ToNumber was a super complicated node because it had to do a speculation, but it
+        would do it after we already had computed the urshift. It couldn't just back to the
+        beginning of the urshift because the inputs to the urshift weren't necessarily live
+        anymore. We couldn't jump forward to the beginning of the next instruction because the
+        result of the urshift was not yet unsigned-converted.
+        
+        For a while we solved this by forward-exiting in UInt32ToNumber. But that's really
+        gross and I want to get rid of all forward exits. They cause a lot of bugs.
+        
+        We could also have turned UInt32ToNumber to a backwards exit by forcing the inputs to
+        the urshift to be live. I figure that this might be a bit too extreme.
+        
+        So, I just created a new place that we can exit to: I split op_urshift into op_urshift
+        followed by op_unsigned. op_unsigned is an "unsigned cast" along the lines of what
+        UInt32ToNumber does. This allows me to get rid of all of the nastyness in the DFG for
+        forward exiting in UInt32ToNumber.
+        
+        This patch enables massive code carnage in the DFG and FTL, and brings us closer to
+        eliminating one of the DFG's most confusing concepts. On the flipside, it does make the
+        bytecode slightly more complex (one new instruction). This is a profitable trade. We
+        want the DFG and FTL to trend towards simplicity, since they are both currently too
+        complicated.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/ValueRecovery.cpp:
+        (JSC::ValueRecovery::dumpInContext):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::gpr):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::toInt32):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        (JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild):
+        (JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild1):
+        (JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild2):
+        * ftl/FTLFormattedValue.h:
+        (JSC::FTL::int32Value):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileUInt32ToNumber):
+        * ftl/FTLValueFormat.cpp:
+        (JSC::FTL::reboxAccordingToFormat):
+        (WTF::printInternal):
+        * ftl/FTLValueFormat.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_op_unsigned):
+        (JSC::JIT::emitSlow_op_unsigned):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emit_op_unsigned):
+        (JSC::JIT::emitSlow_op_unsigned):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+
+2013-12-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        LLInt should not conditionally branch to to labels outside of its function
+        https://bugs.webkit.org/show_bug.cgi?id=125713
+
+        Reviewed by Geoffrey Garen.
+
+        Conditional branches are insufficient for jumping to out-of-function labels.
+        The fix is to use an unconditional jmp to the label combined with a conditional branch around the jmp.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-12-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [GTK] Remove Warnings in building about duplicate INSPECTOR variables
+        https://bugs.webkit.org/show_bug.cgi?id=125710
+
+        Reviewed by Tim Horton.
+
+        * GNUmakefile.am:
+
+2013-12-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Cleanup CodeGeneratorInspectorStrings a bit
+        https://bugs.webkit.org/show_bug.cgi?id=125705
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/scripts/CodeGeneratorInspectorStrings.py:
+        Use ${foo} variable syntax and add an ASCIILiteral.
+
+2013-12-13  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed build fix after r160563
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Missed the Debug
+        target in my last patch.
+
+2013-12-13  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed build fix after r160548
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Specify
+        that we are using the vs12_xp target for Makefile-based projects.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj: Ditto
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Ditto.
+
+2013-12-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Make inspector folder groups smarter in JavaScriptCore.xcodeproj
+        https://bugs.webkit.org/show_bug.cgi?id=125663
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-12-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add Inspector Code Generation to JavaScriptCore for Runtime Domain
+        https://bugs.webkit.org/show_bug.cgi?id=125595
+
+        Reviewed by Timothy Hatcher.
+
+          - Move CodeGeneration scripts from WebCore into JavaScriptCore/inspector/scripts
+          - For ports that build WebKit frameworks separately, export the scripts as PrivateHeaders
+          - Update CodeGeneratorInspector.py in a few ways:
+            - output dynamic filenames, so JavaScriptCore generates InspectorJSFoo.* and WebCore generates InspectorWebFoo.*
+            - take in more then one protocol JSON file. The first contains domains to generate, the others are dependencies
+              that are generated elsewhere that we can depend on for Types.
+          - Add DerivedSources build step to generate the Inspector Interfaces
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add scripts and code generation.
+
+        * inspector/protocol/Runtime.json: Renamed from Source/WebCore/inspector/protocol/Runtime.json.
+        Move protocol file into JavaScriptCore so its types will be generated in JavaScriptCore.
+
+        * inspector/scripts/CodeGeneratorInspector.py: Renamed from Source/WebCore/inspector/CodeGeneratorInspector.py.
+        Updates to the script as listed above.
+
+        * inspector/scripts/CodeGeneratorInspectorStrings.py: Renamed from Source/WebCore/inspector/CodeGeneratorInspectorStrings.py.
+        * inspector/scripts/generate-combined-inspector-json.py: Renamed from Source/WebCore/inspector/Scripts/generate-combined-inspector-json.py.
+        Moved from WebCore into JavaScriptCore for code generation.
+
+2013-12-13  Peter Szanka  <h868064@stud.u-szeged.hu>
+
+        Delete INTEL C compiler related code parts.
+        https://bugs.webkit.org/show_bug.cgi?id=125625
+
+        Reviewed by Darin Adler.
+
+        * jsc.cpp:
+        * testRegExp.cpp:
+
+2013-12-13  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Switch WebKit solution to Visual Studio 2013
+        https://bugs.webkit.org/show_bug.cgi?id=125192
+
+        Reviewed by Anders Carlsson.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Update for VS2013
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        Ditto
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Ditto
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Ditto
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Ditto
+
+2013-12-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Add a few more ASCIILiterals
+        https://bugs.webkit.org/show_bug.cgi?id=125662
+
+        Reviewed by Darin Adler.
+
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::InspectorBackendDispatcher::dispatch):
+
+2013-12-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Test new JSContext name APIs
+        https://bugs.webkit.org/show_bug.cgi?id=125607
+
+        Reviewed by Darin Adler.
+
+        * API/JSContext.h:
+        * API/JSContextRef.h:
+        Fix whitespace issues.
+
+        * API/tests/testapi.c:
+        (globalContextNameTest):
+        (main):
+        * API/tests/testapi.mm:
+        Add tests for JSContext set/get name APIs.
+
+2013-12-11  Filip Pizlo  <fpizlo@apple.com>
+
+        ARM64: Hang running pdfjs test, suspect DFG generated code for "in"
+        https://bugs.webkit.org/show_bug.cgi?id=124727
+        <rdar://problem/15566923>
+
+        Reviewed by Michael Saboff.
+        
+        Get rid of In's hackish use of StructureStubInfo. Previously it was using hotPathBegin,
+        and it was the only IC that used that field, which was wasteful. Moreover, it used it
+        to store two separate locations: the label for patching the jump and the label right
+        after the jump. The code was relying on those two being the same label, which is true
+        on X86 and some other platforms, but it isn't true on ARM64.
+        
+        This gets rid of hotPathBegin and makes In express those two locations as offsets from
+        the callReturnLocation, which is analogous to what the other IC's do.
+        
+        This fixes a bug where any successful In patching would result in a trivially infinite
+        loop - and hence a hang - on ARM64.
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::InRecord::InRecord):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::finalize):
+        * jit/Repatch.cpp:
+        (JSC::replaceWithJump):
+        (JSC::patchJumpToGetByIdStub):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::resetIn):
+
+2013-12-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Push More Inspector Required Classes Down into JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=125324
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/ScriptFunctionCall.cpp: Renamed from Source/WebCore/bindings/js/ScriptFunctionCall.cpp.
+        * bindings/ScriptFunctionCall.h: Renamed from Source/WebCore/bindings/js/ScriptFunctionCall.h.
+        * bindings/ScriptObject.cpp: Copied from Source/WebCore/inspector/WorkerConsoleAgent.cpp.
+        * bindings/ScriptObject.h: Renamed from Source/WebCore/inspector/InspectorBaseAgent.h.
+        * bindings/ScriptValue.cpp: Renamed from Source/WebCore/bindings/js/ScriptValue.cpp.
+        * bindings/ScriptValue.h: Renamed from Source/WebCore/bindings/js/ScriptValue.h.
+        * inspector/InspectorAgentBase.h: Copied from Source/WebCore/inspector/InspectorAgentRegistry.h.
+        * inspector/InspectorAgentRegistry.cpp: Renamed from Source/WebCore/inspector/InspectorAgentRegistry.cpp.
+        * inspector/InspectorBackendDispatcher.h: Renamed from Source/WebCore/inspector/InspectorBackendDispatcher.h.
+        (Inspector::InspectorSupplementalBackendDispatcher::InspectorSupplementalBackendDispatcher):
+        (Inspector::InspectorSupplementalBackendDispatcher::~InspectorSupplementalBackendDispatcher):
+        * inspector/InspectorValues.cpp: Renamed from Source/WebCore/inspector/InspectorValues.cpp.
+        * inspector/InspectorValues.h: Renamed from Source/WebCore/inspector/InspectorValues.h.
+
+2013-12-11  Laszlo Vidacs  <lac@inf.u-szeged.hu>
+
+        Store SHA1 hash in std::array
+        https://bugs.webkit.org/show_bug.cgi?id=125446
+
+        Reviewed by Darin Adler.
+
+        Change Vector to std::array and use typedef.
+
+        * bytecode/CodeBlockHash.cpp:
+        (JSC::CodeBlockHash::CodeBlockHash):
+
+2013-12-11  Mark Rowe  <mrowe@apple.com>
+
+        <https://webkit.org/b/125141> Modernize the JavaScriptCore API headers
+        <rdar://problem/15540121>
+
+        This consists of three main changes:
+        1) Converting the return type of initializer methods to instancetype.
+        2) Declaring properties rather than getters and setters.
+        3) Tagging C API methods with information about their memory management semantics.
+
+        Changing the declarations from getters and setters to properties also required
+        updating the headerdoc in a number of places.
+
+        Reviewed by Anders Carlsson.
+
+        * API/JSContext.h:
+        * API/JSContext.mm:
+        * API/JSManagedValue.h:
+        * API/JSManagedValue.mm:
+        * API/JSStringRefCF.h:
+        * API/JSValue.h:
+        * API/JSVirtualMachine.h:
+        * API/JSVirtualMachine.mm:
+
+2013-12-11  Mark Rowe  <mrowe@apple.com>
+
+        <https://webkit.org/b/125559> Move JavaScriptCore off the legacy WebKit availability macros
+
+        The legacy WebKit availability macros are verbose, confusing, and provide no benefit over
+        using the system availability macros directly. The original vision was that they'd serve
+        a cross-platform purpose but that never came to be.
+
+        Map from WebKit version to OS X version based on the mapping in WebKitAvailability.h.
+        All iOS versions are specified as 7.0 as that is when the JavaScriptCore C API was made
+        public.
+
+        Part of <rdar://problem/15512304>.
+
+        Reviewed by Anders Carlsson.
+
+        * API/JSBasePrivate.h:
+        * API/JSContextRef.h:
+        * API/JSContextRefPrivate.h:
+        * API/JSObjectRef.h:
+        * API/JSValueRef.h:
+
+2013-12-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of forward exit on DoubleAsInt32
+        https://bugs.webkit.org/show_bug.cgi?id=125552
+
+        Reviewed by Oliver Hunt.
+        
+        The forward exit was just there so that we wouldn't have to keep the inputs alive up to
+        the DoubleAsInt32. That's dumb. Forward exits are a complicated piece of machinery and
+        we shouldn't have it just for a bit of liveness micro-optimization.
+        
+        Also add a bunch of machinery to test this case on X86.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::optimizeForARMv7s):
+        (JSC::optimizeForARM64):
+        (JSC::optimizeForX86):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
+        * runtime/Options.h:
+        * tests/stress/double-as-int32.js: Added.
+        (foo):
+        (test):
+
+2013-12-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Simplify CSE's treatment of NodeRelevantToOSR
+        https://bugs.webkit.org/show_bug.cgi?id=125538
+
+        Reviewed by Oliver Hunt.
+        
+        Make the NodeRelevantToOSR thing obvious: if there is any MovHint on a node then the
+        node is relevant to OSR.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::run):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::performBlockCSE):
+
+2013-12-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of forward exit in GetByVal on Uint32Array
+        https://bugs.webkit.org/show_bug.cgi?id=125543
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+
+2013-12-10  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        [MIPS] Redundant instructions in code generated from offlineasm.
+        https://bugs.webkit.org/show_bug.cgi?id=125528
+
+        Reviewed by Michael Saboff.
+
+        Optimize lowering of offlineasm BaseIndex Addresses.
+
+        * offlineasm/mips.rb:
+
+2013-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reduce the mass templatizing of the JS parser
+        https://bugs.webkit.org/show_bug.cgi?id=125535
+
+        Reviewed by Michael Saboff.
+
+        The various caches we have now have removed the need for many of
+        the template vs. regular parameters.  This patch converts those
+        template parameters to regular parameters and updates the call
+        sites.  This reduces the code size of the parser by around 15%.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createProperty):
+        * parser/Parser.cpp:
+        (JSC::::parseInner):
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::createBindingPattern):
+        (JSC::::tryParseDeconstructionPatternExpression):
+        (JSC::::parseDeconstructionPattern):
+        (JSC::::parseSwitchClauses):
+        (JSC::::parseSwitchDefaultClause):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseFormalParameters):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseMemberExpression):
+        * parser/Parser.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+
+2013-12-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        ASSERT !heap.vm()->isInitializingObject() when finishing DFG compilation at beginning of GC
+        https://bugs.webkit.org/show_bug.cgi?id=125472
+
+        Reviewed by Geoff Garen.
+
+        This patch makes it look like it's okay to allocate so that the DFG plan finalization stuff 
+        can do what it needs to do. We already expected that we might do allocation during plan 
+        finalization and we increased the deferral depth to handle this, but we need to fix this other 
+        ASSERT stuff too.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/RecursiveAllocationScope.h: Added.
+        (JSC::RecursiveAllocationScope::RecursiveAllocationScope):
+        (JSC::RecursiveAllocationScope::~RecursiveAllocationScope):
+        * runtime/VM.h:
+
+2013-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Impose and enforce some basic rules of sanity for where Phi functions are allowed to occur and where their (optional) corresponding MovHints can be
+        https://bugs.webkit.org/show_bug.cgi?id=125480
+
+        Reviewed by Geoffrey Garen.
+        
+        Previously, if you wanted to insert some speculation right after where a value was
+        produced, you'd get super confused if that value was produced by a Phi node.  You can't
+        necessarily insert speculations after a Phi node because Phi nodes appear in this
+        special sequence of Phis and MovHints that establish the OSR exit state for a block.
+        So, you'd probably want to search for the next place where it's safe to insert things.
+        We already do this "search for beginning of next bytecode instruction" search by
+        looking at the next node that has a different CodeOrigin.  But this would be hard for a
+        Phi because those Phis and MovHints have basically random CodeOrigins and they can all
+        have different CodeOrigins.
+
+        This change imposes some sanity for this situation:
+
+        - Phis must have unset CodeOrigins.
+
+        - In each basic block, all nodes that have unset CodeOrigins must come before all nodes
+          that have set CodeOrigins.
+
+        This all ends up working out just great because prior to this change we didn't have a 
+        use for unset CodeOrigins.  I think it's appropriate to make "unset CodeOrigin" mean
+        that we're in the prologue of a basic block.
+
+        It's interesting what this means for block merging, which we don't yet do in SSA.
+        Consider merging the edge A->B.  One possibility is that the block merger is now
+        required to clean up Phi/Upsilons, and reascribe the MovHints to have the CodeOrigin of
+        the A's block terminal.  But an answer that might be better is that the originless
+        nodes at the top of the B are just given the origin of the terminal and we keep the
+        Phis.  That would require changing the above rules.  We'll see how it goes, and what we
+        end up picking...
+
+        Overall, this special-things-at-the-top rule is analogous to what other SSA-based
+        compilers do.  For example, LLVM has rules mandating that Phis appear at the top of a
+        block.
+
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::dump):
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::OSRExitBase):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::validateSSA):
+
+2013-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Reveal array bounds checks in DFG IR
+        https://bugs.webkit.org/show_bug.cgi?id=125253
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        In SSA mode, this reveals array bounds checks and the load of array length in DFG IR,
+        making this a candidate for LICM.
+
+        This also fixes a long-standing performance bug where the JSObject slow paths would
+        always create contiguous storage, rather than type-specialized storage, when doing a
+        "storage creating" storage, like:
+        
+            var o = {};
+            o[0] = 42;
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        (JSC::exitKindIsCountable):
+        * bytecode/ExitKind.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::permitsBoundsCheckLowering):
+        (JSC::DFG::ArrayMode::permitsBoundsCheckLowering):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::lengthNeedsStorage):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSSALoweringPhase.cpp: Added.
+        (JSC::DFG::SSALoweringPhase::SSALoweringPhase):
+        (JSC::DFG::SSALoweringPhase::run):
+        (JSC::DFG::SSALoweringPhase::handleNode):
+        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
+        (JSC::DFG::performSSALowering):
+        * dfg/DFGSSALoweringPhase.h: Added.
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckInBounds):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::contiguousPutByValOutOfBounds):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::convertUndecidedForValue):
+        (JSC::JSObject::createInitialForValueAndSet):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        * runtime/JSObject.h:
+        * tests/stress/float32array-out-of-bounds.js: Added.
+        (make):
+        (foo):
+        (test):
+        * tests/stress/int32-object-out-of-bounds.js: Added.
+        (make):
+        (foo):
+        (test):
+        * tests/stress/int32-out-of-bounds.js: Added.
+        (foo):
+        (test):
+
+2013-12-09  Sam Weinig  <sam@webkit.org>
+
+        Replace use of WTF::FixedArray with std::array
+        https://bugs.webkit.org/show_bug.cgi?id=125475
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/CodeBlockHash.cpp:
+        (JSC::CodeBlockHash::dump):
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * dfg/DFGCSEPhase.cpp:
+        * ftl/FTLAbstractHeap.h:
+        * heap/MarkedSpace.h:
+        * parser/ParserArena.h:
+        * runtime/CodeCache.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSString.h:
+        * runtime/LiteralParser.h:
+        * runtime/NumericStrings.h:
+        * runtime/RegExpCache.h:
+        * runtime/SmallStrings.h:
+
+2013-12-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove miscellaneous unnecessary build statements
+        https://bugs.webkit.org/show_bug.cgi?id=125466
+
+        Reviewed by Darin Adler.
+
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/build-generated-files.sh:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * make-generated-sources.sh:
+
+2013-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        CSE should work in SSA
+        https://bugs.webkit.org/show_bug.cgi?id=125430
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::run):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2013-12-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove docs/make-bytecode-docs.pl
+        https://bugs.webkit.org/show_bug.cgi?id=125462
+
+        This sript is very old and no longer outputs useful data since the
+        op code definitions have moved from Interpreter.cpp.
+
+        Reviewed by Darin Adler.
+
+        * DerivedSources.make:
+        * docs/make-bytecode-docs.pl: Removed.
+
+2013-12-09  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix sh4 LLINT build.
+        https://bugs.webkit.org/show_bug.cgi?id=125454
+
+        Reviewed by Michael Saboff.
+
+        In LLINT, sh4 backend implementation didn't handle properly conditional jumps using
+        a LabelReference instance. This patch fixes it through sh4LowerMisplacedLabels phase.
+        Also, to avoid the need of a 4th temporary gpr, this phase is triggered later in
+        getModifiedListSH4.
+
+        * offlineasm/sh4.rb:
+
+2013-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Add the notion of ConstantStoragePointer to DFG IR
+        https://bugs.webkit.org/show_bug.cgi?id=125395
+
+        Reviewed by Oliver Hunt.
+        
+        This pushes more typed array folding into StrengthReductionPhase, and enables CSE on
+        storage pointers. Previously, you might have separate nodes for the same storage
+        pointer and this would cause some bad register pressure in the DFG. Note that this
+        was really a theoretical problem and not, to my knowledge a practical one - so this
+        patch is basically just a clean-up.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::constantStoragePointerCSE):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToConstantStoragePointer):
+        (JSC::DFG::Node::hasStoragePointer):
+        (JSC::DFG::Node::storagePointer):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileConstantStoragePointer):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        (JSC::DFG::StrengthReductionPhase::foldTypedArrayPropertyToConstant):
+        (JSC::DFG::StrengthReductionPhase::prepareToFoldTypedArray):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileConstantStoragePointer):
+        (JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+
+2013-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support UntypedUse versions of Compare nodes
+        https://bugs.webkit.org/show_bug.cgi?id=125426
+
+        Reviewed by Oliver Hunt.
+        
+        This adds UntypedUse versions of all comparisons except CompareStrictEq, which is
+        sufficiently different that I thought I'd do it in another patch.
+        
+        This also extends our ability to abstract over comparison kind and removes a bunch of
+        copy-paste code.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLess):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareLessEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreater):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareGreaterEq):
+        (JSC::FTL::LowerDFGToLLVM::compare):
+        (JSC::FTL::LowerDFGToLLVM::nonSpeculativeCompare):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::icmp):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        (JSC::FTL::Output::above):
+        (JSC::FTL::Output::aboveOrEqual):
+        (JSC::FTL::Output::below):
+        (JSC::FTL::Output::belowOrEqual):
+        (JSC::FTL::Output::greaterThan):
+        (JSC::FTL::Output::greaterThanOrEqual):
+        (JSC::FTL::Output::lessThan):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::fcmp):
+        (JSC::FTL::Output::doubleEqual):
+        (JSC::FTL::Output::doubleNotEqualOrUnordered):
+        (JSC::FTL::Output::doubleLessThan):
+        (JSC::FTL::Output::doubleLessThanOrEqual):
+        (JSC::FTL::Output::doubleGreaterThan):
+        (JSC::FTL::Output::doubleGreaterThanOrEqual):
+        (JSC::FTL::Output::doubleEqualOrUnordered):
+        (JSC::FTL::Output::doubleNotEqual):
+        (JSC::FTL::Output::doubleLessThanOrUnordered):
+        (JSC::FTL::Output::doubleLessThanOrEqualOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrEqualOrUnordered):
+        * tests/stress/untyped-equality.js: Added.
+        (foo):
+        * tests/stress/untyped-less-than.js: Added.
+        (foo):
+
+2013-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Fold typedArray.length if typedArray is constant
+        https://bugs.webkit.org/show_bug.cgi?id=125252
+
+        Reviewed by Sam Weinig.
+        
+        This was meant to be easy. The problem is that there was no good place for putting
+        the folding of typedArray.length to a constant. You can't quite do it in the
+        bytecode parser because at that point you don't yet know if typedArray is really
+        a typed array. You can't do it as part of constant folding because the folder
+        assumes that it can opportunistically forward-flow a constant value without changing
+        the IR; this doesn't work since we need to first change the IR to register a
+        desired watchpoint and only after that can we introduce that constant. We could have
+        done it in Fixup but that would have been awkward since Fixup's code for turning a
+        GetById of "length" into GetArrayLength is already somewhat complex. We could have
+        done it in CSE but CSE is already fairly gnarly and will probably get rewritten.
+        
+        So I introduced a new phase, called StrengthReduction. This phase should have any
+        transformations that don't requite CFA or CSE and that it would be weird to put into
+        those other phases.
+        
+        I also took the opportunity to refactor some of the other folding code.
+        
+        This also adds a test, but the test couldn't quite be a LayoutTests/js/regress so I
+        introduced the notion of JavaScriptCore/tests/stress.
+        
+        The goal of this patch isn't really to improve performance or anything like that.
+        It adds an optimization for completeness, and in doing so it unlocks a bunch of new
+        possibilities. The one that I'm most excited about is revealing array length checks
+        in DFG IR, which will allow for array bounds check hoisting and elimination.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetFoldableView):
+        (JSC::DFG::Graph::tryGetFoldableViewForChild1):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasTypedArray):
+        (JSC::DFG::Node::typedArray):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
+        (JSC::DFG::SpeculativeJIT::compileConstantIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp: Added.
+        (JSC::DFG::StrengthReductionPhase::StrengthReductionPhase):
+        (JSC::DFG::StrengthReductionPhase::run):
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        (JSC::DFG::StrengthReductionPhase::foldTypedArrayPropertyToConstant):
+        (JSC::DFG::performStrengthReduction):
+        * dfg/DFGStrengthReductionPhase.h: Added.
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::typedArrayLength):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionTransferArrayBuffer):
+        * runtime/ArrayBufferView.h:
+        * tests/stress: Added.
+        * tests/stress/fold-typed-array-properties.js: Added.
+        (foo):
+
+2013-12-07  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win][64-bit] Hitting breakpoint assembler instruction in callToJavaScript.
+        https://bugs.webkit.org/show_bug.cgi?id=125382
+
+        Reviewed by Michael Saboff.
+
+        The WinCairo results from run-javascriptcore-tests are the same as the WinCairo 32-bits results, when removing these breakpoints.
+
+        * jit/JITStubsMSVC64.asm: Remove breakpoint instructions.
+
+2013-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support all of Branch/LogicalNot
+        https://bugs.webkit.org/show_bug.cgi?id=125370
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::boolify):
+
+2013-12-06  Roger Fong <roger_fong@apple.com> and Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Support compiling with VS2013
+        https://bugs.webkit.org/show_bug.cgi?id=125353
+
+        Reviewed by Anders Carlsson.
+
+        * API/tests/testapi.c: Use C99 defines if available.
+        * jit/JITOperations.cpp: Don't attempt to define C linkage when
+        returning a C++ object.
+
+2013-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support generic ByVal accesses
+        https://bugs.webkit.org/show_bug.cgi?id=125368
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isStrictModeFor):
+        (JSC::DFG::Graph::ecmaModeFor):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+
+2013-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support hole/OOB array accesses
+        https://bugs.webkit.org/show_bug.cgi?id=118077
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::baseIndex):
+
+2013-12-06  Michael Saboff  <msaboff@apple.com>
+
+        Split sizing of VarArgs frames from loading arguments for the frame
+        https://bugs.webkit.org/show_bug.cgi?id=125331
+
+        Reviewed by Filip Pizlo.
+
+        Split loadVarargs into sizeAndAllocFrameForVarargs() and loadVarargs() in
+        preparation for moving onto the C stack.  sizeAndAllocFrameForVarargs() will
+        compute the size of the callee frame and allocate it, while loadVarargs()
+        actually loads the argument values.
+
+        As part of moving onto the C stack, sizeAndAllocFrameForVarargs() will be
+        changed to a function that just computes the size.  The caller will use that
+        size to allocate the new frame on the stack before calling loadVargs() and
+        actually making the call.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeAndAllocFrameForVarargs):
+        (JSC::loadVarargs):
+        * interpreter/Interpreter.h:
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/VM.h:
+
+2013-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support all of ValueToInt32
+        https://bugs.webkit.org/show_bug.cgi?id=125283
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::isCell):
+
+2013-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL shouldn't have a doubleToUInt32 path
+        https://bugs.webkit.org/show_bug.cgi?id=125360
+
+        Reviewed by Mark Hahnenberg.
+        
+        This code existed because I incorrectly thought it was necessary. It's now basically
+        dead.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+
+2013-12-06  Laszlo Vidacs  <lac@inf.u-szeged.hu>
+
+        Define SHA1 hash size in SHA1.h and use it at various places.
+        https://bugs.webkit.org/show_bug.cgi?id=125345
+
+        Reviewed by Darin Adler.
+
+        Use SHA1::hashSize instead of local variables.
+
+        * bytecode/CodeBlockHash.cpp:
+        (JSC::CodeBlockHash::CodeBlockHash): use SHA1::hashSize
+
+2013-12-05  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r160213): Crash in js/dom/JSON-parse.html
+        https://bugs.webkit.org/show_bug.cgi?id=125335
+
+        Reviewed by Mark Lam.
+
+        Changed _llint_op_catch to materialize the VM via the scope chain instead of 
+        the CodeBlock.  CallFrames always have a scope chain, but may have a null CodeBlock.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        (_llint_op_catch):
+        * llint/LowLevelInterpreter64.asm:
+        (_llint_op_catch):
+
+2013-12-05  Michael Saboff  <msaboff@apple.com>
+
+        JSC: Simplify interface between throw and catch handler
+        https://bugs.webkit.org/show_bug.cgi?id=125328
+
+        Reviewed by Geoffrey Garen.
+
+        Simplified the throw - catch interface.  The throw side is only responsible for
+        jumping to the appropriate op_catch handler or returnFromJavaScript for uncaught
+        exceptions.  The handler uses the exception values like VM.callFrameForThrow
+        as appropriate and no longer relies on the throw side putting anything in
+        registers.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * llint/LowLevelInterpreter32_64.asm:
+        (_llint_op_catch):
+        (_llint_throw_from_slow_path_trampoline):
+        * llint/LowLevelInterpreter64.asm:
+        (_llint_op_catch):
+        (_llint_throw_from_slow_path_trampoline):
+
+2013-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Refactor static getter function prototype to include thisValue in addition to the base object
+        https://bugs.webkit.org/show_bug.cgi?id=124461
+
+        Reviewed by Geoffrey Garen.
+
+        Add thisValue parameter to static getter prototype, and switch
+        from JSValue to EncodedJSValue for parameters and return value.
+
+        Currently none of the static getters use the thisValue, but
+        separating out the refactoring will prevent future changes
+        from getting lost in the noise of refactoring.  This means
+        that this patch does not result in any change in behaviour.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * jit/JITOperations.cpp:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::nameGetter):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/PropertySlot.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::asRegExpConstructor):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::asRegExpObject):
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+
+2013-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should use cvttsd2si directly for double-to-int32 conversions
+        https://bugs.webkit.org/show_bug.cgi?id=125275
+
+        Reviewed by Michael Saboff.
+        
+        Wow. This was an ordeal. Using cvttsd2si was actually easy, but I learned, and
+        sometimes even fixed, some interesting things:
+        
+        - The llvm.x86.sse2.cvttsd2si intrinsic can actually result in LLVM emitting a
+          vcvttsd2si. I guess the intrinsic doesn't actually imply the instruction.
+        
+        - That whole thing about branchTruncateDoubleToUint32? Yeah we don't need that. It's
+          better to use branchTruncateDoubleToInt32 instead. It has the right semantics for
+          all of its callers (err, its one-and-only caller), and it's more likely to take
+          fast path. This patch kills branchTruncateDoubleToUint32.
+        
+        - "a[i] = v; v = a[i]". Does this change v? OK, assume that 'a[i]' is a pure-ish
+          operation - like an array access with 'i' being an integer index and we're not
+          having a bad time. Now does this change v? CSE assumes that it doesn't. That's
+          wrong. If 'a' is a typed array - the most sensible and pure kind of array - then
+          this can be a truncating cast. For example 'v' could be a double and 'a' could be
+          an integer array.
+        
+        - "v1 = a[i]; v2 = a[i]". Is v1 === v2 assuming that 'a[i]' is pure-ish? The answer
+          is no. You could have a different arrayMode in each access. I know this sounds
+          weird, but with concurrent JIT that might happen.
+        
+        This patch adds tests for all of this stuff, except for the first issue (it's weird
+        but probably doesn't matter) and the last issue (it's too much of a freakshow).
+
+        * assembler/MacroAssemblerARM64.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.h:
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::vectorType):
+        (JSC::FTL::getUndef):
+        (JSC::FTL::buildInsertElement):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::doubleToInt32):
+        (JSC::FTL::LowerDFGToLLVM::doubleToUInt32):
+        (JSC::FTL::LowerDFGToLLVM::sensibleDoubleToInt32):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::insertElement):
+        (JSC::FTL::Output::hasSensibleDoubleToInt):
+        (JSC::FTL::Output::sensibleDoubleToInt):
+
+2013-12-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r160133.
+        http://trac.webkit.org/changeset/160133
+        https://bugs.webkit.org/show_bug.cgi?id=125325
+
+        broke bindings tests on all the bots (Requested by thorton on
+        #webkit).
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * jit/JITOperations.cpp:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::nameGetter):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/PropertySlot.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+
+2013-12-05  Mark Lam  <mark.lam@apple.com>
+
+        Make the C Loop LLINT work with callToJavaScript.
+        https://bugs.webkit.org/show_bug.cgi?id=125294.
+
+        Reviewed by Michael Saboff.
+
+        1. Changed the C Loop LLINT to dispatch to an Executable via its JITCode
+           instance which is consistent with how the ASM LLINT works.
+        2. Changed CLoop::execute() to take an Opcode instead of an OpcodeID.
+           This makes it play nice with the use of JITCode for dispatching.
+        3. Introduce a callToJavaScript and callToNativeFunction for the C Loop
+           LLINT. These will call JSStack::pushFrame() and popFrame() to setup
+           and teardown the CallFrame.
+        4. Also introduced a C Loop returnFromJavaScript which is just a
+           replacement for ctiOpThrowNotCaught which had the same function.
+        5. Remove a lot of #if ENABLE(LLINT_C_LOOP) code now that the dispatch
+           mechanism is consistent.
+
+        This patch has been tested with both configurations of COMPUTED_GOTOs
+        on and off.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setArgument):
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setThis):
+        (JSC::CallFrameClosure::setArgument):
+        (JSC::CallFrameClosure::resetCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        * interpreter/JSStack.h:
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::pushFrame):
+        * interpreter/ProtoCallFrame.h:
+        (JSC::ProtoCallFrame::scope):
+        (JSC::ProtoCallFrame::callee):
+        (JSC::ProtoCallFrame::thisValue):
+        (JSC::ProtoCallFrame::argument):
+        (JSC::ProtoCallFrame::setArgument):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        * jit/JITCode.h:
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * llint/LLIntCLoop.cpp:
+        (JSC::LLInt::CLoop::initialize):
+        * llint/LLIntCLoop.h:
+        * llint/LLIntEntrypoint.cpp:
+        (JSC::LLInt::setFunctionEntrypoint):
+        (JSC::LLInt::setEvalEntrypoint):
+        (JSC::LLInt::setProgramEntrypoint):
+        - Inverted the check for vm.canUseJIT(). This allows the JIT case to be
+          #if'd out nicely when building the C Loop LLINT.
+        * llint/LLIntOpcode.h:
+        * llint/LLIntThunks.cpp:
+        (JSC::doCallToJavaScript):
+        (JSC::executeJS):
+        (JSC::callToJavaScript):
+        (JSC::executeNative):
+        (JSC::callToNativeFunction):
+        * llint/LLIntThunks.h:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::offsetOfNumParametersFor):
+        (JSC::ExecutableBase::hostCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::finishCreation):
+        (JSC::ProgramExecutable::generatedJITCode):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        * runtime/VM.cpp:
+        (JSC::VM::getHostFunction):
+
+2013-12-05  Laszlo Vidacs  <lac@inf.u-szeged.hu>
+
+        Fix JavaScriptCore build if cloop is enabled after r160094
+        https://bugs.webkit.org/show_bug.cgi?id=125292
+
+        Reviewed by Michael Saboff.
+
+        Move ProtoCallFrame outside the JIT guard.
+
+        * jit/JITCode.h:
+
+2013-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Fold constant typed arrays
+        https://bugs.webkit.org/show_bug.cgi?id=125205
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        If by some other mechanism we have a typed array access on a compile-time constant
+        typed array pointer, then fold:
+        
+        - Array bounds checks. Specifically, fold the load of length.
+        
+        - Loading the vector.
+        
+        This needs to install a watchpoint on the array itself because of the possibility of
+        neutering. Neutering is ridiculous. We do this without bloating the size of
+        ArrayBuffer or JSArrayBufferView in the common case (i.e. the case where you
+        allocated an array that didn't end up becoming a compile-time constant). To install
+        the watchpoint, we slowDownAndWasteMemory and then create an incoming reference to
+        the ArrayBuffer, where that incoming reference is from a watchpoint object. The
+        ArrayBuffer already knows about such incoming references and can fire the
+        watchpoints that way.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGDesiredWatchpoints.cpp:
+        (JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):
+        (JSC::DFG::DesiredWatchpoints::addLazily):
+        * dfg/DFGDesiredWatchpoints.h:
+        (JSC::DFG::GenericSetAdaptor::add):
+        (JSC::DFG::GenericSetAdaptor::hasBeenInvalidated):
+        (JSC::DFG::ArrayBufferViewWatchpointAdaptor::hasBeenInvalidated):
+        (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
+        (JSC::DFG::GenericDesiredWatchpoints::areStillValid):
+        (JSC::DFG::GenericDesiredWatchpoints::isStillValid):
+        (JSC::DFG::GenericDesiredWatchpoints::shouldAssumeMixedState):
+        (JSC::DFG::DesiredWatchpoints::isStillValid):
+        (JSC::DFG::DesiredWatchpoints::shouldAssumeMixedState):
+        (JSC::DFG::DesiredWatchpoints::isValidOrMixed):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetFoldableView):
+        * dfg/DFGGraph.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
+        (JSC::DFG::SpeculativeJIT::emitTypedArrayBoundsCheck):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileConstantIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        (JSC::DFG::WatchpointCollectionPhase::addLazily):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::typedArrayLength):
+        * runtime/ArrayBuffer.cpp:
+        (JSC::ArrayBuffer::transfer):
+        * runtime/ArrayBufferNeuteringWatchpoint.cpp: Added.
+        (JSC::ArrayBufferNeuteringWatchpoint::ArrayBufferNeuteringWatchpoint):
+        (JSC::ArrayBufferNeuteringWatchpoint::~ArrayBufferNeuteringWatchpoint):
+        (JSC::ArrayBufferNeuteringWatchpoint::finishCreation):
+        (JSC::ArrayBufferNeuteringWatchpoint::destroy):
+        (JSC::ArrayBufferNeuteringWatchpoint::create):
+        (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
+        * runtime/ArrayBufferNeuteringWatchpoint.h: Added.
+        (JSC::ArrayBufferNeuteringWatchpoint::set):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2013-12-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r160116.
+        http://trac.webkit.org/changeset/160116
+        https://bugs.webkit.org/show_bug.cgi?id=125264
+
+        Change doesn't work as intended. See bug comments for details.
+        (Requested by bfulgham on #webkit).
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+
+2013-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Refactor static getter function prototype to include thisValue in addition to the base object
+        https://bugs.webkit.org/show_bug.cgi?id=124461
+
+        Reviewed by Geoffrey Garen.
+
+        Add thisValue parameter to static getter prototype, and switch
+        from JSValue to EncodedJSValue for parameters and return value.
+
+        Currently none of the static getters use the thisValue, but
+        separating out the refactoring will prevent future changes
+        from getting lost in the noise of refactoring.  This means
+        that this patch does not result in any change in behaviour.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * jit/JITOperations.cpp:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::nameGetter):
+        * runtime/JSFunction.h:
+        * runtime/JSObject.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/PropertySlot.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::asRegExpConstructor):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * runtime/RegExpObject.cpp:
+        (JSC::asRegExpObject):
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+
+2013-12-04  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Enable Objective-C ARC when building JSC tools for iOS simulator
+        https://bugs.webkit.org/show_bug.cgi?id=125170
+
+        Reviewed by Geoffrey Garen.
+
+        * API/tests/testapi.mm:
+        * Configurations/ToolExecutable.xcconfig:
+
+2013-12-04  peavo@outlook.com  <peavo@outlook.com>
+
+        Use ThreadingOnce class to encapsulate pthread_once functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=125228
+
+        Reviewed by Brent Fulgham.
+
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+
+2013-12-04  Mark Lam  <mark.lam@apple.com>
+
+        Remove unneeded semicolons.
+        https://bugs.webkit.org/show_bug.cgi?id=125083.
+
+        Rubber-stamped by Filip Pizlo.
+
+        * debugger/Debugger.h:
+        (JSC::Debugger::detach):
+        (JSC::Debugger::sourceParsed):
+        (JSC::Debugger::exception):
+        (JSC::Debugger::atStatement):
+        (JSC::Debugger::callEvent):
+        (JSC::Debugger::returnEvent):
+        (JSC::Debugger::willExecuteProgram):
+        (JSC::Debugger::didExecuteProgram):
+        (JSC::Debugger::didReachBreakpoint):
+
+2013-12-04  Andy Estes  <aestes@apple.com>
+
+        [iOS] Build projects with $(ARCHS_STANDARD_32_64_BIT)
+        https://bugs.webkit.org/show_bug.cgi?id=125236
+
+        Reviewed by Sam Weinig.
+
+        $(ARCHS_STANDARD_32_64_BIT) is what we want for both device and simulator builds.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2013-12-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Infer constant closure variables
+        https://bugs.webkit.org/show_bug.cgi?id=124630
+
+        Reviewed by Geoffrey Garen.
+        
+        Captured variables that are assigned once (not counting op_enter's Undefined
+        initialization) and that are contained within a function that has thus far only been
+        entered once are now constant folded. It's pretty awesome.
+        
+        This involves a watchpoint on the assignment to variables and a watchpoint on entry
+        into the function. The former is reused from global variable constant inference and the
+        latter is reused from one-time closure inference.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedInstruction::UnlinkedInstruction):
+        * bytecode/VariableWatchpointSet.h:
+        (JSC::VariableWatchpointSet::invalidate):
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::invalidate):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitInitLazyRegister):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::watchableVariable):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::inferredConstant):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetActivation):
+        (JSC::DFG::Graph::tryGetRegisters):
+        * dfg/DFGGraph.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_captured_mov):
+        (JSC::JIT::emit_op_new_captured_func):
+        (JSC::JIT::emitSlow_op_captured_mov):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_captured_mov):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/ConstantMode.h: Added.
+        * runtime/JSGlobalObject.h:
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::prepareToWatch):
+
+2013-12-04  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed project file gardening.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Remove deleted files from project.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Put files in proper directory
+        folders to match the directory structure of the source code.
+
+2013-12-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed Windows Build Fix attempt after r160099.
+
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+
+2013-12-04  Julien Brianceau  <jbriance@cisco.com>
+
+        REGRESSION (r160094): Fix lots of crashes for sh4 architecture.
+        https://bugs.webkit.org/show_bug.cgi?id=125227
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter32_64.asm: Do not use t4 and t5 as they match a0 and a1.
+        * offlineasm/registers.rb: Add t7, t8 and t9 in register list for sh4 port.
+        * offlineasm/sh4.rb: Rearrange RegisterID list and add the missing ones.
+
+2013-12-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Push Remote Inspector debugging connection management into JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=124613
+
+        Reviewed by Timothy Hatcher.
+
+        Move the ENABLE(REMOTE_INSPECTOR) remote debugger connection management
+        into JavaScriptCore (originally from WebKit/mac). Include enhancements:
+
+          * allow for different types of remote debuggable targets,
+            eventually at least a JSContext, WebView, WKView.
+          * allow debuggables to be registered and debugged on any thread. Unlike
+            WebViews, JSContexts may be run entirely off of the main thread.
+          * move the remote connection (XPC connection) itself off of the main thread,
+            it doesn't need to be on the main thread.
+
+        Make JSContext @class and JavaScriptCore::JSContextRef
+        "JavaScript" Remote Debuggables.
+
+        * inspector/remote/RemoteInspectorDebuggable.h: Added.
+        * inspector/remote/RemoteInspectorDebuggable.cpp: Added.
+        (Inspector::RemoteInspectorDebuggable::RemoteInspectorDebuggable):
+        (Inspector::RemoteInspectorDebuggable::~RemoteInspectorDebuggable):
+        (Inspector::RemoteInspectorDebuggable::init):
+        (Inspector::RemoteInspectorDebuggable::update):
+        (Inspector::RemoteInspectorDebuggable::setRemoteDebuggingAllowed):
+        (Inspector::RemoteInspectorDebuggable::info):
+        RemoteInspectorDebuggable defines a debuggable target. As long as
+        something creates a debuggable and is set to allow remote inspection
+        it will be listed in remote debuggers. For the different types of
+        debuggables (JavaScript and Web) there is different basic information
+        that may be listed.
+
+        * inspector/InspectorFrontendChannel.h: Added.
+        (Inspector::InspectorFrontendChannel::~InspectorFrontendChannel):
+        The only thing a debuggable needs for remote debugging is an
+        InspectorFrontendChannel a way to send messages to a remote frontend.
+        This class provides that method, and is vended to the
+        RemoteInspectorDebuggable when a remote connection is setup.
+
+        * inspector/remote/RemoteInspector.h: Added.
+        * inspector/remote/RemoteInspector.mm: Added.
+        Singleton, created at least when the first Debuggable is created.
+        This class manages the list of debuggables, any connection to a
+        remote debugger proxy (XPC service "com.apple.webinspector").
+
+        (Inspector::dispatchAsyncOnQueueSafeForAnyDebuggable):
+        (Inspector::RemoteInspector::shared):
+        (Inspector::RemoteInspector::RemoteInspector):
+        (Inspector::RemoteInspector::nextAvailableIdentifier):
+        (Inspector::RemoteInspector::registerDebuggable):
+        (Inspector::RemoteInspector::unregisterDebuggable):
+        (Inspector::RemoteInspector::updateDebuggable):
+        Debuggable management. When debuggables are added, removed, or updated
+        we stash a copy of the debuggable information and push an update to
+        debuggers. Stashing a copy of the information in the RemoteInspector
+        is a thread safe way to avoid walking over all debuggables to gather
+        the information when it is needed.
+
+        (Inspector::RemoteInspector::start):
+        (Inspector::RemoteInspector::stop):
+        Runtime API to enable / disable the feature.
+
+        (Inspector::RemoteInspector::listingForDebuggable):
+        (Inspector::RemoteInspector::pushListingNow):
+        (Inspector::RemoteInspector::pushListingSoon):
+        Pushing a listing to remote debuggers.
+
+        (Inspector::RemoteInspector::sendMessageToRemoteFrontend):
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        (Inspector::RemoteInspector::xpcConnectionUnhandledMessage):
+        XPC setup, send, and receive handling.
+
+        (Inspector::RemoteInspector::updateHasActiveDebugSession):
+        Applications being debugged may want to know when a debug
+        session is active. This provides that notification.
+
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        (Inspector::RemoteInspector::receivedDataMessage):
+        (Inspector::RemoteInspector::receivedDidCloseMessage):
+        (Inspector::RemoteInspector::receivedGetListingMessage):
+        (Inspector::RemoteInspector::receivedIndicateMessage):
+        (Inspector::RemoteInspector::receivedConnectionDiedMessage):
+        Dispatching incoming remote debugging protocol messages.
+        These are wrapping above the inspector protocol messages.
+
+        * inspector/remote/RemoteInspectorConstants.h: Added.
+        Protocol messages and dictionary keys inside the messages.
+
+        (Inspector::RemoteInspectorDebuggableInfo::RemoteInspectorDebuggableInfo):
+        * inspector/remote/RemoteInspectorDebuggableConnection.h: Added.
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm: Added.
+        This is a connection between the RemoteInspector singleton and a RemoteInspectorDebuggable.
+
+        (Inspector::RemoteInspectorDebuggableConnection::RemoteInspectorDebuggableConnection):
+        (Inspector::RemoteInspectorDebuggableConnection::~RemoteInspectorDebuggableConnection):
+        Allow for dispatching messages on JavaScript debuggables on a dispatch_queue
+        instead of the main queue.
+
+        (Inspector::RemoteInspectorDebuggableConnection::destination):
+        (Inspector::RemoteInspectorDebuggableConnection::connectionIdentifier):
+        Needed in the remote debugging protocol to identify the remote debugger.
+
+        (Inspector::RemoteInspectorDebuggableConnection::dispatchSyncOnDebuggable):
+        (Inspector::RemoteInspectorDebuggableConnection::dispatchAsyncOnDebuggable):
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        (Inspector::RemoteInspectorDebuggableConnection::closeFromDebuggable):
+        (Inspector::RemoteInspectorDebuggableConnection::close):
+        (Inspector::RemoteInspectorDebuggableConnection::sendMessageToBackend):
+        (Inspector::RemoteInspectorDebuggableConnection::sendMessageToFrontend):
+        The connection is a thin channel between the two sides that can be closed
+        from either side, so there is some logic around multi-threaded access.
+
+        * inspector/remote/RemoteInspectorXPCConnection.h: Added.
+        (Inspector::RemoteInspectorXPCConnection::Client::~Client):
+        * inspector/remote/RemoteInspectorXPCConnection.mm: Added.
+        (Inspector::RemoteInspectorXPCConnection::RemoteInspectorXPCConnection):
+        (Inspector::RemoteInspectorXPCConnection::~RemoteInspectorXPCConnection):
+        (Inspector::RemoteInspectorXPCConnection::close):
+        (Inspector::RemoteInspectorXPCConnection::deserializeMessage):
+        (Inspector::RemoteInspectorXPCConnection::handleEvent):
+        (Inspector::RemoteInspectorXPCConnection::sendMessage):
+        This is a connection between the RemoteInspector singleton and an XPC service
+        named "com.apple.webinspector". This handles serialization of the dictionary
+        messages to and from the service. The receiving is done on a non-main queue.
+
+        * API/JSContext.h:
+        * API/JSContext.mm:
+        (-[JSContext name]):
+        (-[JSContext setName:]):
+        ObjC API to enable/disable JSContext remote inspection and give a name.
+
+        * API/JSContextRef.h:
+        * API/JSContextRef.cpp:
+        (JSGlobalContextGetName):
+        (JSGlobalContextSetName):
+        C API to give a JSContext a name.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setName):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::name):
+        Shared handling of the APIs above.
+
+        * runtime/JSGlobalObjectDebuggable.cpp: Added.
+        (JSC::JSGlobalObjectDebuggable::JSGlobalObjectDebuggable):
+        (JSC::JSGlobalObjectDebuggable::name):
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        (JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend):
+        * runtime/JSGlobalObjectDebuggable.h: Added.
+        Stub for the actual remote debugging implementation. We will push
+        down the appropriate WebCore/inspector peices suitable for debugging
+        just a JavaScript context.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        Update build files.
+
+2013-12-04  Michael Saboff  <msaboff@apple.com>
+
+        Move the setting up of callee's callFrame from pushFrame to callToJavaScript thunk
+        https://bugs.webkit.org/show_bug.cgi?id=123999
+
+        Reviewed by Filip Pizlo.
+
+        Changed LLInt and/or JIT enabled ports to allocate the stack frame in the
+        callToJavaScript stub.  Added an additional stub, callToNativeFunction that
+        allocates a stack frame in a similar way for calling native entry points
+        that take a single ExecState* argument.  These stubs are implemented
+        using common macros in LowLevelInterpreter{32_64,64}.asm.  There are also
+        Windows X86 and X86-64 versions in the corresponding JitStubsXX.h.
+        The stubs allocate and create a sentinel frame, then create the callee's
+        frame, populating  the header and arguments from the passed in ProtoCallFrame*.
+        It is assumed that the caller of either stub does a check for enough stack space
+        via JSStack::entryCheck().
+
+        For ports using the C-Loop interpreter, the prior method for allocating stack
+        frame and invoking functions is used, namely with JSStack::pushFrame() and
+        ::popFrame().
+
+        Made spelling changes "sentinal" -> "sentinel".
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::resetCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        * interpreter/JSStack.h:
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::entryCheck):
+        (JSC::JSStack::pushFrame):
+        (JSC::JSStack::popFrame):
+        * interpreter/ProtoCallFrame.cpp: Added.
+        (JSC::ProtoCallFrame::init):
+        * interpreter/ProtoCallFrame.h: Added.
+        (JSC::ProtoCallFrame::codeBlock):
+        (JSC::ProtoCallFrame::setCodeBlock):
+        (JSC::ProtoCallFrame::setScope):
+        (JSC::ProtoCallFrame::setCallee):
+        (JSC::ProtoCallFrame::argumentCountIncludingThis):
+        (JSC::ProtoCallFrame::argumentCount):
+        (JSC::ProtoCallFrame::setArgumentCountIncludingThis):
+        (JSC::ProtoCallFrame::setPaddedArgsCount):
+        (JSC::ProtoCallFrame::clearCurrentVPC):
+        (JSC::ProtoCallFrame::setThisValue):
+        (JSC::ProtoCallFrame::setArgument):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        * jit/JITCode.h:
+        * jit/JITOperations.cpp:
+        * jit/JITStubs.h:
+        * jit/JITStubsMSVC64.asm:
+        * jit/JITStubsX86.h:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntThunks.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArgList.h:
+        (JSC::ArgList::data):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+
+2013-12-04  László Langó  <lango@inf.u-szeged.hu>
+
+        Remove stdio.h from JSC files.
+        https://bugs.webkit.org/show_bug.cgi?id=125220
+
+        Reviewed by Michael Saboff.
+
+        * interpreter/VMInspector.cpp:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * runtime/Completion.cpp:
+        * runtime/IndexingType.cpp:
+        * runtime/Lookup.h:
+        * runtime/Operations.cpp:
+        * runtime/Options.cpp:
+        * runtime/RegExp.cpp:
+
+2013-12-04  László Langó  <lango@inf.u-szeged.hu>
+
+        Avoid to add zero offset in BaseIndex.
+        https://bugs.webkit.org/show_bug.cgi?id=125215
+
+        Reviewed by Michael Saboff.
+
+        When using cloop do not generate offsets additions for BaseIndex if the offset is zero.
+
+        * offlineasm/cloop.rb:
+
+2013-12-04  Peter Molnar  <pmolnar.u-szeged@partner.samsung.com>
+
+        Fix !ENABLE(JAVASCRIPT_DEBUGGER) build.
+        https://bugs.webkit.org/show_bug.cgi?id=125083
+
+        Reviewed by Mark Lam.
+
+        * debugger/Debugger.cpp:
+        * debugger/Debugger.h:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::needsOpDebugCallbacks):
+        (JSC::Debugger::needsExceptionCallbacks):
+        (JSC::Debugger::detach):
+        (JSC::Debugger::sourceParsed):
+        (JSC::Debugger::exception):
+        (JSC::Debugger::atStatement):
+        (JSC::Debugger::callEvent):
+        (JSC::Debugger::returnEvent):
+        (JSC::Debugger::willExecuteProgram):
+        (JSC::Debugger::didExecuteProgram):
+        (JSC::Debugger::didReachBreakpoint):
+        * debugger/DebuggerPrimitives.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+
+2013-12-03  Mark Lam  <mark.lam@apple.com>
+
+        testapi test crashes on Windows in WTF::Vector<wchar_t,64,WTF::UnsafeVectorOverflow>::size().
+        https://bugs.webkit.org/show_bug.cgi?id=121972.
+
+        Reviewed by Brent Fulgham.
+
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::~JSStack):
+        - Reverting the change from r160004 since it's better to fix OSAllocatorWin
+          to be consistent with OSAllocatorPosix.
+
+2013-12-03  Mark Lam  <mark.lam@apple.com>
+
+        Fix LLINT_C_LOOP build for Win64.
+        https://bugs.webkit.org/show_bug.cgi?id=125186.
+
+        Reviewed by Michael Saboff.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * jit/JITOperationsMSVC64.cpp: Added.
+        (JSC::getHostCallReturnValueWithExecState):
+        - Win64 will build JITStubMSVC64.asm even when !ENABLE(JIT). This results
+          in a linkage error due to a missing getHostCallReturnValueWithExecState().
+          So, we add a stub getHostCallReturnValueWithExecState() here to satisfy
+          that linkage. This function will never be called.
+          The alternative to providing such a stub is to make the MSVC project
+          recognize if the JIT is enabled or not, and exclude JITStubMSVC64.asm
+          if it's not enabled. We don't currently set ENABLE(JIT) via the MSVC
+          project and the work to do that is too much trouble for what we're trying
+          to achieve here. So, we're opting for this simpler workaround instead.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        - Don't build callToJavaScript if we're building the C loop. Otherwise,
+          the C loop won't build if !ENABLE(COMPUTE_GOTO_OPCODES). 
+
+2013-12-03  Michael Saboff  <msaboff@apple.com>
+
+        ARM64: Crash in JIT code due to improper reuse of cached memory temp register
+        https://bugs.webkit.org/show_bug.cgi?id=125181
+
+        Reviewed by Geoffrey Garen.
+
+        Changed load8() and load() to invalidate the memory temp CachedTempRegister when the
+        destination of an absolute load is the memory temp register since the source address
+        is also the memory temp register.  Change branch{8,32,64} of an AbsoluteAddress with
+        a register to use the dataTempRegister as the destinate of the absolute load to
+        reduce the chance that we need to invalidate the memory temp register cache.
+        In the process, found and fixed an outright bug in branch8() where we'd load into
+        the data temp register and then compare and branch on the memory temp register.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::load8):
+        (JSC::MacroAssemblerARM64::branch32):
+        (JSC::MacroAssemblerARM64::branch64):
+        (JSC::MacroAssemblerARM64::branch8):
+        (JSC::MacroAssemblerARM64::load):
+
+2013-12-03  Michael Saboff  <msaboff@apple.com>
+
+        jit/JITArithmetic.cpp doesn't build for non-X86 ports
+        https://bugs.webkit.org/show_bug.cgi?id=125185
+
+        Rubber stamped by Mark Hahnenberg.
+
+        Removed unused declarations and related UNUSED_PARAM().
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+
+2013-12-03  Filip Pizlo  <fpizlo@apple.com>
+
+        ObjectAllocationProfile is racy and the DFG should be cool with that
+        https://bugs.webkit.org/show_bug.cgi?id=125172
+        <rdar://problem/15233487>
+
+        Reviewed by Mark Hahnenberg.
+        
+        We would previously sometimes get a null Structure because checking if the profile is non-null and loading
+        the structure from it were two separate operations.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::setFuturePossibleStructure):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::allocationProfile):
+        (JSC::JSFunction::allocationStructure):
+
+2013-12-03  peavo@outlook.com  <peavo@outlook.com>
+
+        testapi test crashes on Windows in WTF::Vector<wchar_t,64,WTF::UnsafeVectorOverflow>::size()
+        https://bugs.webkit.org/show_bug.cgi?id=121972
+
+        Reviewed by Michael Saboff.
+
+        The reason for the crash is that the wrong memory block is decommitted.
+        This can happen if no memory has been committed in the reserved block before the JSStack object is destroyed.
+        In the JSStack destructor, the pointer to decommit then points to the end of the block (or the start of the next), and the decommit size is zero.
+        If there is a block just after the block we are trying to decommit, this block will be decommitted, since Windows will decommit the whole block,
+        if the decommit size is zero (see VirtualFree). When somebody tries to read/write to this block later, we crash.
+
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::~JSStack): Don't decommit memory if nothing has been committed.
+
+2013-12-03  László Langó  <lango@inf.u-szeged.hu>
+
+        Guard JIT include.
+        https://bugs.webkit.org/show_bug.cgi?id=125063
+
+        Reviewed by Filip Pizlo.
+
+        * llint/LLIntThunks.cpp:
+
+2013-12-03  Julien Brianceau  <jbriance@cisco.com>
+
+        Merge mips and arm/sh4 paths in nativeForGenerator and privateCompileCTINativeCall functions.
+        https://bugs.webkit.org/show_bug.cgi?id=125067
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+
+2013-12-02  Mark Lam  <mark.lam@apple.com>
+
+        Build failure when disabling JIT, YARR_JIT, and ASSEMBLER.
+        https://bugs.webkit.org/show_bug.cgi?id=123809.
+
+        Reviewed by Geoffrey Garen.
+
+        Also fixed build when disabling the DISASSEMBLER.
+        Added some needed #if's and some comments.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGDisassembler.h:
+        (JSC::DFG::Disassembler::Disassembler):
+        (JSC::DFG::Disassembler::setStartOfCode):
+        (JSC::DFG::Disassembler::setForBlockIndex):
+        (JSC::DFG::Disassembler::setForNode):
+        (JSC::DFG::Disassembler::setEndOfMainPath):
+        (JSC::DFG::Disassembler::setEndOfCode):
+        (JSC::DFG::Disassembler::dump):
+        (JSC::DFG::Disassembler::reportToProfiler):
+        * disassembler/Disassembler.cpp:
+        * disassembler/X86Disassembler.cpp:
+        * jit/FPRInfo.h:
+        * jit/GPRInfo.h:
+        * jit/JITDisassembler.cpp:
+        * jit/JITDisassembler.h:
+        (JSC::JITDisassembler::JITDisassembler):
+        (JSC::JITDisassembler::setStartOfCode):
+        (JSC::JITDisassembler::setForBytecodeMainPath):
+        (JSC::JITDisassembler::setForBytecodeSlowPath):
+        (JSC::JITDisassembler::setEndOfSlowPath):
+        (JSC::JITDisassembler::setEndOfCode):
+        (JSC::JITDisassembler::dump):
+        (JSC::JITDisassembler::reportToProfiler):
+
+2013-12-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT calls to CommonSlowPaths shouldn't restore the last result
+        https://bugs.webkit.org/show_bug.cgi?id=125107
+
+        Reviewed by Mark Hahnenberg.
+
+        Just killing dead code.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_inc):
+        (JSC::JIT::emitSlow_op_dec):
+        (JSC::JIT::emitSlow_op_mod):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emitSlow_op_div):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_inc):
+        (JSC::JIT::emitSlow_op_dec):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emitSlow_op_div):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_strcat):
+        (JSC::JIT::emitSlow_op_get_callee):
+        (JSC::JIT::emitSlow_op_create_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emitSlow_op_to_number):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emitSlow_op_not):
+        (JSC::JIT::emitSlow_op_stricteq):
+        (JSC::JIT::emitSlow_op_nstricteq):
+        (JSC::JIT::emitSlow_op_to_number):
+        (JSC::JIT::emitSlow_op_get_callee):
+        (JSC::JIT::emitSlow_op_create_this):
+        (JSC::JIT::emitSlow_op_to_this):
+
+2013-12-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Stores to local captured variables should be intercepted
+        https://bugs.webkit.org/show_bug.cgi?id=124883
+
+        Reviewed by Mark Hahnenberg.
+        
+        Previously, in bytecode, you could assign to a captured variable just as you would
+        assign to any other kind of variable. This complicates closure variable constant
+        inference because we don't have any place where we can intercept stores to captured
+        variables in the LLInt.
+        
+        This patch institutes a policy that only certain instructions can store to captured
+        variables. If you interpret those instructions and you are required to notifyWrite()
+        then you need to check if the relevant variable is captured. Those instructions are
+        tracked in CodeBlock.cpp's VerifyCapturedDef. The main one is simply op_captured_mov.
+        In the future, we'll probably modify those instructions to have a pointer directly to
+        the VariableWatchpointSet; but for now we just introduce the captured instructions as
+        placeholders.
+        
+        In order to validate that the placeholders are inserted correctly, this patch improves
+        the CodeBlock validation to be able to inspect every def in the bytecode. To do that,
+        this patch refactors the liveness analysis' use/def calculator to be reusable; it now
+        takes a functor for each use or def.
+        
+        In the process of refactoring the liveness analysis, I noticed that op_enter was
+        claiming to def all callee registers. That's wrong; it only defs the non-temporary
+        variables. Making that change revealed preexisting bugs in the liveness analysis, since
+        now the validator would pick up cases where the bytecode claimed to use a temporary and
+        the def calculator never noticed the definition (or the converse - where the bytecode
+        was actually not using a temporary but the liveness analysis thought that it was a
+        use). This patch fixes a few of those bugs.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::stepOverInstruction):
+        * bytecode/BytecodeUseDef.h: Added.
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::isCaptured):
+        (JSC::CodeBlock::validate):
+        * bytecode/CodeBlock.h:
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::isCaptured):
+        (JSC::BytecodeGenerator::local):
+        (JSC::BytecodeGenerator::constLocal):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::Local::Local):
+        (JSC::Local::isCaptured):
+        (JSC::Local::captureMode):
+        (JSC::BytecodeGenerator::captureMode):
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::pushOptimisedForIn):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::isCaptured):
+
+2013-12-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Instead of watchpointing activation allocation, we should watchpoint entry into functions that have captured variables
+        https://bugs.webkit.org/show_bug.cgi?id=125052
+
+        Reviewed by Mark Hahnenberg.
+        
+        This makes us watch function entry rather than activation creation. We only incur the
+        costs of doing so for functions that have captured variables, and only on the first two
+        entries into the function. This means that closure variable constant inference will
+        naturally work even for local uses of the captured variable, like:
+        
+            (function(){
+                var blah = 42;
+                ... // stuff
+                function () { ... blah /* we can fold this to 42 */ }
+                ... blah // we can also fold this to 42.
+            })();
+        
+        Previously, only the nested use would have been foldable.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::touch):
+        (JSC::InlineWatchpointSet::touch):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasSymbolTable):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_touch_entry):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        * runtime/SymbolTable.h:
+
+2013-12-02  Nick Diego Yamane  <nick.yamane@openbossa.org>
+
+        [JSC] Get rid of some unused parameters in LLIntSlowPaths.cpp macros
+        https://bugs.webkit.org/show_bug.cgi?id=125075
+
+        Reviewed by Michael Saboff.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::handleHostCall): added UNUSED_PARAM(pc).
+        (JSC::LLInt::setUpCall): Doesn't pass 'pc' to LLINT_CALL macros.
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Ditto.
+
+2013-12-02  László Langó  <lango@inf.u-szeged.hu>
+
+        Remove stdio.h from JSC files.
+        https://bugs.webkit.org/show_bug.cgi?id=125066
+
+        Reviewed by Michael Saboff.
+
+        Remove stdio.h, when it is not necessary to be included.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecode/StructureSet.h:
+        * profiler/LegacyProfiler.cpp:
+        * profiler/Profile.cpp:
+        * profiler/ProfileNode.cpp:
+        * yarr/YarrInterpreter.cpp:
+
+2013-12-02  László Langó  <lango@inf.u-szeged.hu>
+
+        Unused include files when building without JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=125062
+
+        Reviewed by Michael Saboff.
+
+        We should organize the includes, and guard JIT methods
+        in ValueRecovery.
+
+        * bytecode/ValueRecovery.cpp: Guard include files.
+        * bytecode/ValueRecovery.h: Guard JIT methods.
+
+2013-12-02  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        [MIPS] Small stack frame causes regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=124945
+
+        Reviewed by Michael Saboff.
+
+        Fix stack space for LLInt on MIPS.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2013-12-02  Brian J. Burg  <burg@cs.washington.edu>
+
+        jsc: implement a native readFile function
+        https://bugs.webkit.org/show_bug.cgi?id=125059
+
+        Reviewed by Filip Pizlo.
+
+        This adds a native readFile() function to jsc, used to slurp
+        an entire file into a JavaScript string.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation): Add readFile() to globals.
+        (functionReadFile): Added.
+
+2013-12-02  László Langó  <lango@inf.u-szeged.hu>
+
+        JSC does not build if OPCODE_STATS is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=125011
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/Opcode.cpp:
+
+2013-11-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Finally remove those DFG_ENABLE things
+        https://bugs.webkit.org/show_bug.cgi?id=125025
+
+        Rubber stamped by Sam Weinig.
+        
+        This removes a bunch of unused and untested insanity.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
+        (JSC::DFG::ByteCodeParser::getArrayModeConsideringSlowPath):
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        (JSC::DFG::parse):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::convertToJump):
+        (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::endIndexForPureCSE):
+        (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
+        (JSC::DFG::CSEPhase::setReplacement):
+        (JSC::DFG::CSEPhase::eliminate):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::verboseCompilationEnabled):
+        (JSC::DFG::logCompilationChanges):
+        (JSC::DFG::shouldDumpGraphAtEachPhase):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        (JSC::DFG::InPlaceAbstractState::mergeToSuccessors):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::run):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::propagateForward):
+        (JSC::DFG::PredictionPropagationPhase::propagateBackward):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::use):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::generate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        (JSC::DFG::SpeculativeJIT::dump):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * dfg/DFGVariableEventStream.h:
+        (JSC::DFG::VariableEventStream::appendAndLog):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2013-11-29  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL IC should nop-fill to make up the difference between the actual IC size and the requested patchpoint size
+        https://bugs.webkit.org/show_bug.cgi?id=124960
+
+        Reviewed by Sam Weinig.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::size):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::fillNops):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dumpHeader):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::generateICFastPath):
+        * jit/JITDisassembler.cpp:
+        (JSC::JITDisassembler::dumpHeader):
+
+2013-11-29  Julien Brianceau  <jbriance@cisco.com>
+
+        Use moveDoubleToInts in SpecializedThunkJIT::returnDouble for non-X86 JSVALUE32_64 ports.
+        https://bugs.webkit.org/show_bug.cgi?id=124936
+
+        Reviewed by Zoltan Herczeg.
+
+        The moveDoubleToInts implementations in ARM, MIPS and SH4 macro assemblers do not clobber
+        src FPRegister and are likely to be more efficient than the current generic implementation
+        using the stack.
+
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnDouble):
+
+2013-11-29  Julien Brianceau  <jbriance@cisco.com>
+
+        Merge arm and sh4 paths in nativeForGenerator and privateCompileCTINativeCall functions.
+        https://bugs.webkit.org/show_bug.cgi?id=124892
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::call): Pick a scratch register instead of getting it as a
+        parameter. The sh4 port was the only one to have this call(Address, RegisterID) prototype.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): Use argumentGPRx and merge arm and sh4 paths.
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator): Use argumentGPRx and merge arm and sh4 paths.
+
+2013-11-28  Nadav Rotem  <nrotem@apple.com>
+
+        Revert the X86 assembler peephole changes
+        https://bugs.webkit.org/show_bug.cgi?id=124988
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add32):
+        (JSC::MacroAssemblerX86::add64):
+        (JSC::MacroAssemblerX86::or32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::add64):
+        (JSC::MacroAssemblerX86_64::or64):
+        (JSC::MacroAssemblerX86_64::xor64):
+
+2013-11-28  Antti Koivisto  <antti@apple.com>
+
+        Remove feature: CSS variables
+        https://bugs.webkit.org/show_bug.cgi?id=114119
+
+        Reviewed by Andreas Kling.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-11-28  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Typo fix after r159834 to fix 32 bit builds.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-11-27  Nadav Rotem  <nrotem@apple.com>
+
+        Add a bunch of early exits and local optimizations to the x86 assembler.
+        https://bugs.webkit.org/show_bug.cgi?id=124904
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add32):
+        (JSC::MacroAssemblerX86::add64):
+        (JSC::MacroAssemblerX86::or32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::or32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::add64):
+        (JSC::MacroAssemblerX86_64::or64):
+        (JSC::MacroAssemblerX86_64::xor64):
+
+2013-11-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Infer one-time scopes
+        https://bugs.webkit.org/show_bug.cgi?id=124812
+
+        Reviewed by Oliver Hunt.
+        
+        This detects JSActivations that are created only once. The JSActivation pointer is then
+        baked into the machine code.
+        
+        This takes advantage of the one-time scope inference to reduce the number of
+        indirections needed to get to a closure variable in case where the scope is only
+        allocated once. This isn't really a speed-up since in the common case the total number
+        of instruction bytes needed to load the scope from the stack is about equal to the
+        number of instruction bytes needed to materialize the absolute address of a scoped
+        variable. But, this is a necessary prerequisite to
+        https://bugs.webkit.org/show_bug.cgi?id=124630, so it's probably a good idea anyway.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/Instruction.h:
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::notifyWrite):
+        (JSC::InlineWatchpointSet::notifyWrite):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveScope):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::scopedVarLoadElimination):
+        (JSC::DFG::CSEPhase::scopedVarStoreElimination):
+        (JSC::DFG::CSEPhase::getLocalLoadElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetRegisters):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::varNumber):
+        (JSC::DFG::Node::hasSymbolTable):
+        (JSC::DFG::Node::symbolTable):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetClosureRegisters):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        (JSC::JSScope::abstractResolve):
+        * runtime/JSScope.h:
+        (JSC::ResolveOp::ResolveOp):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::registers):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        * runtime/SymbolTable.h:
+
+2013-11-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Finally fix some obvious Bartlett bugs
+        https://bugs.webkit.org/show_bug.cgi?id=124951
+
+        Reviewed by Mark Hahnenberg.
+        
+        Sanitize the stack (i.e. zero parts of it known to be dead) at three key points:
+        
+        - GC.
+        
+        - At beginning of OSR entry.
+        
+        - Just as we finish preparing OSR entry. This clears those slots on the stack that
+          could have been live in baseline but that are known to be dead in DFG.
+        
+        This is as much as a 2x speed-up on splay if you run it in certain modes, and run it
+        for a long enough interval. It appears to fix all instances of the dreaded exponential
+        heap growth that splay gets into when some stale pointer stays around.
+        
+        This doesn't have much of an effect on real-world programs. This bug has only ever
+        manifested in splay and for that reason we thus far opted against fixing it. But splay
+        is, for what it's worth, the premiere GC stress test in JavaScript - so making sure we
+        can run it without pathologies - even when you tweak its configuration - is probably
+        fairly important.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::sanitizeStack):
+        * interpreter/JSStack.h:
+
+2013-11-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Do bytecode validation as part of testing
+        https://bugs.webkit.org/show_bug.cgi?id=124913
+
+        Reviewed by Oliver Hunt.
+        
+        Also fix some small bugs in the bytecode liveness analysis that I found by doing
+        this validation thingy.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::isValidRegisterForLiveness):
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::validate):
+        (JSC::CodeBlock::beginValidationDidFail):
+        (JSC::CodeBlock::endValidationDidFail):
+        * bytecode/CodeBlock.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/Options.h:
+
+2013-11-27  Andreas Kling  <akling@apple.com>
+
+        Structure::m_staticFunctionReified should be a single bit.
+        <https://webkit.org/b/124912>
+
+        Shave 8 bytes off of JSC::Structure by jamming m_staticFunctionReified
+        into the bitfield just above.
+
+        Reviewed by Antti Koivisto.
+
+2013-11-27  Andreas Kling  <akling@apple.com>
+
+        JSActivation constructor should use NotNull placement new.
+        <https://webkit.org/b/124909>
+
+        Knock a null check outta the storage initialization loop.
+
+        Reviewed by Antti Koivisto.
+
+2013-11-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Restructure global variable constant inference so that it could work for any kind of symbol table variable
+        https://bugs.webkit.org/show_bug.cgi?id=124760
+
+        Reviewed by Oliver Hunt.
+        
+        This changes the way global variable constant inference works so that it can be reused
+        for closure variable constant inference. Some of the premises that originally motivated
+        this patch are somewhat wrong, but it led to some simplifications anyway and I suspect
+        that we'll be able to fix those premises in the future. The main point of this patch is
+        to make it easy to reuse global variable constant inference for closure variable
+        constant inference, and this will be possible provided we can also either (a) infer
+        one-shot closures (easy) or (b) infer closure variables that are always assigned prior
+        to first use.
+        
+        One of the things that this patch is meant to enable is constant inference for closure
+        variables that may be part of a multi-shot closure. Closure variables may be
+        instantiated multiple times, like:
+        
+            function foo() {
+                var WIDTH = 45;
+                function bar() {
+                    ... use WIDTH ...
+                }
+                ...
+            }
+        
+        Even if foo() is called many times and WIDTH is assigned to multiple times, that
+        doesn't change the fact that it's a constant. The goal of closure variable constant
+        inference is to catch any case where a closure variable has been assigned at least once
+        and its value has never changed. This patch doesn't implement that, but it does change
+        global variable constant inference to have most of the powers needed to do that. Note
+        that most likely we will use this functionality only to implement constant inference
+        for one-shot closures, but the resulting machinery is still simpler than what we had
+        before.
+        
+        This involves three changes:
+        
+            - The watchpoint object now contains the inferred value. This involves creating a
+              new kind of watchpoint set, the VariableWatchpointSet. We will reuse this object
+              for closure variables.
+        
+            - Writing to a variable that is watchpointed still involves these three states that
+              we proceed through monotonically (Uninitialized->Initialized->Invalidated) but
+              now, the Initialized->Invalidated state transition only happens if we change the
+              variable's value, rather than store to the variable. Repeatedly storing the same
+              value won't change the variable's state.
+        
+            - On 64-bit systems (the only systems on which we do concurrent JIT), you no longer
+              need fancy fencing to get a consistent view of the watchpoint in the JIT. The
+              state of the VariableWatchpointSet for the purposes of constant folding is
+              entirely encapsulated in the VariableWatchpointSet::m_inferredValue. If that is
+              JSValue() then you cannot fold (either because the set is uninitialized or
+              because it's invalidated - doesn't matter which); on the other hand if the value
+              is anything other than JSValue() then you can fold, and that's the value you fold
+              to. Simple!
+        
+        This also changes the way that DFG IR deals with variable watchpoints. It's now
+        oblivious to global variables. You install a watchpoint using VariableWatchpoint and
+        you notify write using NotifyWrite. Easy!
+        
+        Note that this will requires some more tweaks because of the fact that op_enter will
+        store Undefined into every captured variable. Hence it won't even work for one-shot
+        closures. One-shot closures are easily fixed by introducing another state (so we'll
+        have Uninitialized->Undefined->Initialized->Invalidated). Multi-shot closures will
+        require static analysis. One-shot closures are clearly a higher priority.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Instruction.h:
+        * bytecode/VariableWatchpointSet.h: Added.
+        (JSC::VariableWatchpointSet::VariableWatchpointSet):
+        (JSC::VariableWatchpointSet::~VariableWatchpointSet):
+        (JSC::VariableWatchpointSet::inferredValue):
+        (JSC::VariableWatchpointSet::notifyWrite):
+        (JSC::VariableWatchpointSet::invalidate):
+        (JSC::VariableWatchpointSet::finalizeUnconditionally):
+        (JSC::VariableWatchpointSet::addressOfInferredValue):
+        * bytecode/Watchpoint.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasRegisterPointer):
+        (JSC::DFG::Node::hasVariableWatchpointSet):
+        (JSC::DFG::Node::variableWatchpointSet):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileNotifyWrite):
+        * jit/JIT.h:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitNotifyWrite):
+        (JSC::JIT::emitPutGlobalVar):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitNotifyWrite):
+        (JSC::JIT::emitPutGlobalVar):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSScope.h:
+        (JSC::ResolveOp::ResolveOp):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::inferredValue):
+        (JSC::SymbolTableEntry::prepareToWatch):
+        (JSC::SymbolTableEntry::addWatchpoint):
+        (JSC::SymbolTableEntry::notifyWriteSlow):
+        (JSC::SymbolTable::visitChildren):
+        (JSC::SymbolTable::WatchpointCleanup::WatchpointCleanup):
+        (JSC::SymbolTable::WatchpointCleanup::~WatchpointCleanup):
+        (JSC::SymbolTable::WatchpointCleanup::finalizeUnconditionally):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTableEntry::watchpointSet):
+        (JSC::SymbolTableEntry::notifyWrite):
+
+2013-11-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Create a new SymbolTable every time code is loaded so that the watchpoints don't get reused
+        https://bugs.webkit.org/show_bug.cgi?id=124824
+
+        Reviewed by Oliver Hunt.
+        
+        This helps with one shot closure inference as well as closure variable constant
+        inference, since without this, if code was reloaded from the cache then we would
+        think that the first run was actually an Nth run. This would cause us to think that
+        the watchpoint(s) should all be invalidated.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::symbolTable):
+        * runtime/Executable.h:
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::clone):
+        * runtime/SymbolTable.h:
+
+2013-11-26  Oliver Hunt  <oliver@apple.com>
+
+        Crash in JSC::ASTBuilder::Expression JSC::Parser<JSC::Lexer<unsigned char> >::parseUnaryExpression<JSC::ASTBuilder>(JSC::ASTBuilder&)
+        https://bugs.webkit.org/show_bug.cgi?id=124886
+
+        Reviewed by Sam Weinig.
+
+        Make sure the error macros propagate an existing error before
+        trying to create a new error message.  We need to do this as
+        the parser state may not be safe for any specific error message
+        if we are already unwinding due to an error.
+
+        * parser/Parser.cpp:
+
+2013-11-26  Nadav Rotem  <nrotem@apple.com>
+
+        Optimize away OR with zero - a common ASM.js pattern.
+        https://bugs.webkit.org/show_bug.cgi?id=124869
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2013-11-25  Julien Brianceau  <jbriance@cisco.com>
+
+        [arm][mips] Fix crash in dfg-arrayify-elimination layout jsc test.
+        https://bugs.webkit.org/show_bug.cgi?id=124839
+
+        Reviewed by Michael Saboff.
+
+        In ARM EABI and MIPS, 64-bit values have to be aligned on stack too.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation): Add missing EABI_32BIT_DUMMY_ARG.
+
+2013-11-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix more fallout from failed attempts at div/mod DFG strength reductions
+        https://bugs.webkit.org/show_bug.cgi?id=124813
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+
+2013-11-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC Obj-C API should have real documentation
+        https://bugs.webkit.org/show_bug.cgi?id=124805
+
+        Reviewed by Geoffrey Garen.
+
+        Massaging the header comments into proper headerdocs.
+
+        * API/JSContext.h:
+        * API/JSExport.h:
+        * API/JSManagedValue.h:
+        * API/JSValue.h:
+        * API/JSVirtualMachine.h:
+
+2013-11-22  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock::m_numCalleeRegisters shouldn't also mean frame size, frame size needed for exit, or any other unrelated things
+        https://bugs.webkit.org/show_bug.cgi?id=124793
+
+        Reviewed by Mark Hahnenberg.
+        
+        Now m_numCalleeRegisters always refers to the number of locals that the attached
+        bytecode uses. It never means anything else.
+        
+        For frame size, we now have it lazily computed from m_numCalleeRegisters for the
+        baseline engines and we have it stored in DFG::CommonData for the optimizing JITs.
+        
+        For frame-size-needed-at-exit, we store that in DFG::CommonData, too.
+        
+        The code no longer implies that there is any arithmetic relationship between
+        m_numCalleeRegisters and frameSize. Previously it implied that the latter is greater
+        than the former.
+        
+        The code no longer implies that there is any arithmetic relationship between the
+        frame Size and the frame-size-needed-at-exit. Previously it implied that the latter
+        is greater that the former.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::frameRegisterCount):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGCommonData.h:
+        (JSC::DFG::CommonData::CommonData):
+        (JSC::DFG::CommonData::requiredRegisterCountForExecutionAndExit):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::frameRegisterCount):
+        (JSC::DFG::Graph::requiredRegisterCountForExit):
+        (JSC::DFG::Graph::requiredRegisterCountForExecutionAndExit):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::frameExtentInternal):
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::pushFrame):
+        * jit/JIT.h:
+        (JSC::JIT::frameRegisterCountFor):
+        * jit/JITOperations.cpp:
+        * llint/LLIntEntrypoint.cpp:
+        (JSC::LLInt::frameRegisterCountFor):
+        * llint/LLIntEntrypoint.h:
+
+2013-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Combine SymbolTable and SharedSymbolTable
+        https://bugs.webkit.org/show_bug.cgi?id=124761
+
+        Reviewed by Geoffrey Garen.
+        
+        SymbolTable was never used directly; we now always used SharedSymbolTable. So, this
+        gets rid of SymbolTable and renames SharedSymbolTable to SymbolTable.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::symbolTable):
+        (JSC::UnlinkedCodeBlock::symbolTable):
+        (JSC::UnlinkedCodeBlock::finishCreation):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::symbolTable):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::symbolTableFor):
+        * runtime/Arguments.h:
+        (JSC::Arguments::finishCreation):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::symbolTable):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::registersOffset):
+        (JSC::JSActivation::allocationSize):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::symbolTable):
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::finishCreation):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::destroy):
+        (JSC::SymbolTable::SymbolTable):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::create):
+        (JSC::SymbolTable::createStructure):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2013-11-22  Mark Lam  <mark.lam@apple.com>
+
+        Remove residual references to "dynamicGlobalObject".
+        https://bugs.webkit.org/show_bug.cgi?id=124787.
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.order:
+        * interpreter/CallFrame.h:
+
+2013-11-22  Mark Lam  <mark.lam@apple.com>
+
+        Ensure that arity fixups honor stack alignment requirements.
+        https://bugs.webkit.org/show_bug.cgi?id=124756.
+
+        Reviewed by Geoffrey Garen.
+
+        The LLINT and all the JITs rely on CommonSlowPaths::arityCheckFor() to
+        compute the arg count adjustment for the arity fixup. We take advantage
+        of this choke point and introduce the stack alignment padding there in
+        the guise of additional args.
+
+        The only cost of this approach is that the padding will also be
+        initialized to undefined values as if they were args. Since arity fixups
+        are considered a slow path that is rarely taken, this cost is not a
+        concern.
+
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        * runtime/VM.h:
+        (JSC::VM::isSafeToRecurse):
+
+2013-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        BytecodeGenerator should align the stack according to native conventions
+        https://bugs.webkit.org/show_bug.cgi?id=124735
+
+        Reviewed by Mark Lam.
+        
+        Rolling this back in because it actually fixed fast/dom/gc-attribute-node.html, but
+        our infrastructure misleads peole into thinking that fixing a test constitutes
+        breaking it.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::registerOffset):
+        (JSC::CallArguments::argumentCountIncludingThis):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+
+2013-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of CodeBlock::dumpStatistics()
+        https://bugs.webkit.org/show_bug.cgi?id=124762
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+
+2013-11-22  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r159652.
+        http://trac.webkit.org/changeset/159652
+        https://bugs.webkit.org/show_bug.cgi?id=124778
+
+        broke fast/dom/gc-attribute-node.html (Requested by ap on
+        #webkit).
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::registerOffset):
+        (JSC::CallArguments::argumentCountIncludingThis):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        (JSC::CallArguments::newArgument):
+
+2013-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix a typo (requriements->requirements).
+
+        * runtime/StackAlignment.h:
+
+2013-11-21  Mark Lam  <mark.lam@apple.com>
+
+        CodeBlock::m_numCalleeRegisters need to honor native stack alignment.
+        https://bugs.webkit.org/show_bug.cgi?id=124754.
+
+        Reviewed by Filip Pizlo.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::newRegister):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2013-11-21  Mark Rowe  <mrowe@apple.com>
+
+        <https://webkit.org/b/124702> Stop overriding VALID_ARCHS.
+
+        All modern versions of Xcode set it appropriately for our needs.
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/Base.xcconfig:
+
+2013-11-21  Mark Rowe  <mrowe@apple.com>
+
+        <https://webkit.org/b/124701> Fix an error in a few Xcode configuration setting files.
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/Base.xcconfig:
+
+2013-11-21  Michael Saboff  <msaboff@apple.com>
+
+        ARM64: Implement push/pop equivalents in LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=124721
+
+        Reviewed by Filip Pizlo.
+
+        Added pushLRAndFP and popLRAndFP that push and pop the link register and frame pointer register.
+        These ops emit code just like what the compiler emits in the prologue and epilogue.  Also changed
+        pushCalleeSaves and popCalleeSaves to use the same store pair and load pair instructions to do
+        the actually pushing and popping.  Finally changed the implementation of push and pop to raise
+        an exception since we don't have (or need) a single register push or pop.
+
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/arm64.rb:
+        * offlineasm/instructions.rb:
+
+2013-11-21  Michael Saboff  <msaboff@apple.com>
+
+        JSC: Removed unused opcodes from offline assembler
+        https://bugs.webkit.org/show_bug.cgi?id=124749
+
+        Reviewed by Mark Hahnenberg.
+
+        Removed the unused, X86 only peekq and pokeq.
+
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+
+2013-11-21  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(159395) Fix branch8(…, AbsoluteAddress, …) in ARM64 MacroAssembler
+        https://bugs.webkit.org/show_bug.cgi?id=124688
+
+        Reviewed by Geoffrey Garen.
+
+        Changed handling of the address for the load8() in the branch8(AbsoluteAddress) to be like
+        the rest of the branchXX(AbsoluteAddress) fucntions.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branch8):
+
+2013-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        BytecodeGenerator should align the stack according to native conventions
+        https://bugs.webkit.org/show_bug.cgi?id=124735
+
+        Reviewed by Mark Lam.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::registerOffset):
+        (JSC::CallArguments::argumentCountIncludingThis):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+
+2013-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, preemptive build fix.
+
+        * runtime/StackAlignment.h:
+        (JSC::stackAlignmentBytes):
+        (JSC::stackAlignmentRegisters):
+
+2013-11-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should know what the stack alignment conventions are
+        https://bugs.webkit.org/show_bug.cgi?id=124736
+
+        Reviewed by Mark Lam.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/StackAlignment.h: Added.
+        (JSC::stackAlignmentBytes):
+        (JSC::stackAlignmentRegisters):
+
+2013-11-21  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        [MIPS] Build fails since r159545.
+        https://bugs.webkit.org/show_bug.cgi?id=124716
+
+        Reviewed by Michael Saboff.
+
+        Add missing implementations in MacroAssembler and LLInt for MIPS.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::sync):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::store8):
+        (JSC::MacroAssemblerMIPS::memoryFence):
+        * offlineasm/mips.rb:
+
+2013-11-21  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix sh4 build after r159545.
+        https://bugs.webkit.org/show_bug.cgi?id=124713
+
+        Reviewed by Michael Saboff.
+
+        Add missing implementations in macro assembler and LLINT for sh4.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load8):
+        (JSC::MacroAssemblerSH4::store8):
+        (JSC::MacroAssemblerSH4::memoryFence):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::synco):
+        * offlineasm/sh4.rb: Handle "memfence" opcode.
+
+2013-11-20  Mark Lam  <mark.lam@apple.com>
+
+        Introducing VMEntryScope to update the VM stack limit.
+        https://bugs.webkit.org/show_bug.cgi?id=124634.
+
+        Reviewed by Geoffrey Garen.
+
+        1. Introduced USE(SEPARATE_C_AND_JS_STACK) (defined in Platform.h).
+           Currently, it is hardcoded to use separate C and JS stacks. Once we
+           switch to using the C stack for JS frames, we'll need to fix this to
+           only be enabled when ENABLE(LLINT_C_LOOP).
+
+        2. Stack limits are now tracked in the VM.
+
+           Logically, there are 2 stack limits:
+           a. m_stackLimit for the native C stack, and
+           b. m_jsStackLimit for the JS stack.
+
+           If USE(SEPARATE_C_AND_JS_STACK), then the 2 limits are the same
+           value, and are implemented as 2 fields in a union.
+
+        3. The VM native stackLimit is set as follows:
+           a. Initially, the VM sets it to the limit of the stack of the thread that
+              instantiated the VM. This allows the parser and bytecode generator to
+              run before we enter the VM to execute JS code.
+
+           b. Upon entry into the VM to execute JS code (via one of the
+              Interpreter::execute...() functions), we instantiate a VMEntryScope
+              that sets the VM's stackLimit to the limit of the current thread's
+              stack. The VMEntryScope will automatically restore the previous
+              entryScope and stack limit upon destruction.
+
+           If USE(SEPARATE_C_AND_JS_STACK), the JSStack's methods will set the VM's
+           jsStackLimit whenever it grows or shrinks.
+
+        4. The VM now provides a isSafeToRecurse() function that compares the
+           current stack pointer against its native stackLimit. This subsumes and
+           obsoletes the VMStackBounds class.
+
+        5. The VMEntryScope class also subsumes DynamicGlobalObjectScope for
+           tracking the JSGlobalObject that we last entered the VM with.
+
+        6. Renamed dynamicGlobalObject() to vmEntryGlobalObject() since that is
+           the value that the function retrieves.
+
+        7. Changed JIT and LLINT code to do stack checks against the jsStackLimit
+           in the VM class instead of the JSStack.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextRetain):
+        (JSGlobalContextRelease):
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::detach):
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::Debugger::pauseIfNeeded):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::vmEntryGlobalObject):
+        * debugger/DebuggerCallFrame.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGOSREntry.cpp:
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLOSREntry.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::deleteAllCompiledCode):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::vmEntryGlobalObject):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::Interpreter::unwind):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::debug):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::growSlowCase):
+        * interpreter/JSStack.h:
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::shrink):
+        (JSC::JSStack::grow):
+        - Moved these inlined functions here from JSStack.h. It reduces some
+          #include dependencies of JSSTack.h which had previously resulted
+          in some EWS bots' unhappiness with this patch.
+        (JSC::JSStack::updateStackLimit):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        * parser/Parser.h:
+        (JSC::Parser::canRecurse):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/StringRecursionChecker.h:
+        (JSC::StringRecursionChecker::performCheck):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::releaseExecutableMemory):
+        (JSC::VM::throwException):
+        * runtime/VM.h:
+        (JSC::VM::addressOfJSStackLimit):
+        (JSC::VM::jsStackLimit):
+        (JSC::VM::setJSStackLimit):
+        (JSC::VM::stackLimit):
+        (JSC::VM::setStackLimit):
+        (JSC::VM::isSafeToRecurse):
+        * runtime/VMEntryScope.cpp: Added.
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::~VMEntryScope):
+        (JSC::VMEntryScope::requiredCapacity):
+        * runtime/VMEntryScope.h: Added.
+        (JSC::VMEntryScope::globalObject):
+        * runtime/VMStackBounds.h: Removed.
+
+2013-11-20  Michael Saboff  <msaboff@apple.com>
+
+        [Win] JavaScript JIT crash (with DFG enabled).
+        https://bugs.webkit.org/show_bug.cgi?id=124675
+
+        Reviewed by Geoffrey Garen.
+
+        Similar to the change in r159427, changed linkClosureCall to use regT0/regT1 (payload/tag) for the callee.
+        linkForThunkGenerator already expected the callee in regT0/regT1, but changed the comment to reflect that.
+
+        * jit/Repatch.cpp:
+        (JSC::linkClosureCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::linkForThunkGenerator):
+
+2013-11-20  Michael Saboff  <msaboff@apple.com>
+
+        ARMv7: Crash due to use after free of AssemblerBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=124611
+
+        Reviewed by Geoffrey Garen.
+
+        Changed JITFinalizer constructor to take a MacroAssemblerCodePtr instead of a Label.
+        In finalizeFunction(), we use that value instead of calculating it from the label.
+
+        * assembler/MacroAssembler.cpp:
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::JITFinalizer):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        * dfg/DFGJITFinalizer.h:
+
+2013-11-20  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix CPU(ARM_TRADITIONAL) build after r159545.
+        https://bugs.webkit.org/show_bug.cgi?id=124649
+
+        Reviewed by Michael Saboff.
+
+        Add missing memoryFence, load8 and store8 implementations in macro assembler.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::dmbSY):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load8):
+        (JSC::MacroAssemblerARM::store8):
+        (JSC::MacroAssemblerARM::memoryFence):
+
+2013-11-20  Julien Brianceau  <jbriance@cisco.com>
+
+        [armv7][arm64] Speculative build fix after r159545.
+        https://bugs.webkit.org/show_bug.cgi?id=124646
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::memoryFence):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::memoryFence):
+
+2013-11-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Enable HTMLTemplateElement on Mac port
+        https://bugs.webkit.org/show_bug.cgi?id=124637
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, remove completely bogus assertion.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addFunction):
+
+2013-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, debug build fix.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addFunction):
+
+2013-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Infer constant global variables
+        https://bugs.webkit.org/show_bug.cgi?id=124464
+
+        Reviewed by Sam Weinig.
+        
+        All global variables that are candidates for watchpoint-based constant inference (i.e.
+        not 'const' variables) will now have WatchpointSet's associated with them and those
+        are used to drive the inference by tracking three states of each variable:
+        
+        Uninitialized: the variable's value is Undefined and the WatchpointSet state is
+            ClearWatchpoint.
+        
+        Initialized: the variable's value was set to something (could even be explicitly set
+            to Undefined) and the WatchpointSet state is IsWatching.
+        
+        Invalidated: the variable's value was set to something else (could even be the same
+            thing as before but the point is that a put operation did execute again) and the
+            WatchpointSet is IsInvalidated.
+        
+        If the compiler tries to compile a GetGlobalVar and the WatchpointSet state is
+        IsWatching, then the current value of the variable can be folded in place of the get,
+        and a watchpoint on the variable can be registered.
+        
+        We handle race conditions between the mutator and compiler by mandating that:
+        
+        - The mutator changes the WatchpointSet state after executing the put.
+        
+        - There is no opportunity to install code or call functions between when the mutator
+          executes a put and changes the WatchpointSet state.
+        
+        - The compiler checks the WatchpointSet state prior to reading the value.
+        
+        The concrete algorithm used by the mutator is:
+        
+            1. Store the new value into the variable.
+            --- Execute a store-store fence.
+            2. Bump the state (ClearWatchpoing becomes IsWatching, IsWatching becomes
+               IsInvalidated); the IsWatching->IsInvalidated transition may end up firing
+               watchpoints.
+        
+        The concrete algorithm that the compiler uses is:
+        
+            1. Load the state. If it's *not* IsWatching, then give up on constant inference.
+            --- Execute a load-load fence.
+            2. Load the value of the variable and use that for folding, while also registering
+               a DesiredWatchpoint. The various parts of this step can be done in any order.
+        
+        The desired watchpoint registration will fail if the watchpoint set is already
+        invalidated. Now consider the following interesting interleavings:
+        
+        Uninitialized->M1->M2->C1->C2: Compiler sees IsWatching because of the mutator's store
+            operation, and the variable is folded. The fencing ensures that C2 sees the value
+            stored in M1 - i.e. we fold on the value that will actually be watchpointed. If
+            before the compilation is installed the mutator executes another store then we
+            will be sure that it will be a complete sequence of M1+M2 since compilations get
+            installed at safepoints and never "in the middle" of a put_to_scope. Hence that
+            compilation installation will be invalidated. If the M1+M2 sequence happens after
+            the code is installed, then the code will be invalidated by triggering a jettison.
+        
+        Uninitialized->M1->C1->C2->M2: Compiler sees Uninitialized and will not fold. This is
+            a sensible outcome since if the compiler read the variable's value, it would have
+            seen Undefined.
+        
+        Uninitialized->C1->C2->M1->M2: Compiler sees Uninitialized and will not fold.
+        Uninitialized->C1->M1->C2->M2: Compiler sees Uninitialized and will not fold.
+        Uninitialized->C1->M1->M2->C2: Compiler sees Uninitialized and will not fold.
+        Uninitialized->M1->C1->M2->C2: Compiler sees Uninitialized and will not fold.
+        
+        IsWatched->M1->M2->C1->C2: Compiler sees IsInvalidated and will not fold.
+        
+        IsWatched->M1->C1->C2->M2: Compiler will fold, but will also register a desired
+            watchpoint, and that watchpoint will get invalidated before the code is installed.
+        
+        IsWatched->M1->C1->M2->C2: As above, will fold but the code will get invalidated.
+        IsWatched->C1->C2->M1->M2: As above, will fold but the code will get invalidated.
+        IsWatched->C1->M1->C2->M2: As above, will fold but the code will get invalidated.
+        IsWatched->C1->M1->M2->C2: As above, will fold but the code will get invalidated.
+        
+        Note that this kind of reasoning shows why having the mutator first bump the state and
+        then store the new value would be wrong. If we had done that (M1 = bump state, M2 =
+        execute put) then we could have the following deadly interleavings:
+        
+        Uninitialized->M1->C1->C2->M2:
+        Uninitialized->M1->C1->M2->C2: Mutator bumps the state to IsWatched and then the
+            compiler folds Undefined, since M2 hasn't executed yet. Although C2 will set the
+            watchpoint, M1 didn't notify it - it mearly initiated watching. M2 then stores a
+            value other than Undefined, and you're toast.
+        
+        You could fix this sort of thing by making the Desired Watchpoints machinery more
+        sophisticated, for example having it track the value that was folded; if the global
+        variable's value was later found to be different then we could invalidate the
+        compilation. You could also fix it by having the compiler also check that the value of
+        the variable is not Undefined before folding. While those all sound great, I decided
+        to instead just use the right interleaving since that results in less code and feels
+        more intuitive.
+        
+        This is a 0.5% speed-up on SunSpider, mostly due to a 20% speed-up on math-cordic.
+        It's a 0.6% slow-down on LongSpider, mostly due to a 25% slow-down on 3d-cube. This is
+        because 3d-cube takes global variable assignment slow paths very often. Note that this
+        3d-cube slow-down doesn't manifest as much in SunSpider (only 6% there). This patch is
+        also a 1.5% speed-up on V8v7 and a 2.8% speed-up on Octane v1, mostly due to deltablue
+        (3.7%), richards (4%), and mandreel (26%). This is a 2% speed-up on Kraken, mostly due
+        to a 17.5% speed-up on imaging-gaussian-blur. Something that really illustrates the
+        slam-dunk-itude of this patch is the wide range of speed-ups on JSRegress. Casual JS
+        programming often leads to global-var-based idioms and those variables tend to be
+        assigned once, leading to excellent constant folding opportunities in an optimizing
+        JIT. This is very evident in the speed-ups on JSRegress.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::dmbSY):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::dmbSY):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::memfence):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load8):
+        (JSC::MacroAssemblerARMv7::memfence):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::load8):
+        (JSC::MacroAssemblerX86::store8):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::getUnusedRegister):
+        (JSC::MacroAssemblerX86Common::store8):
+        (JSC::MacroAssemblerX86Common::memoryFence):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::load8):
+        (JSC::MacroAssemblerX86_64::store8):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movb_rm):
+        (JSC::X86Assembler::movzbl_mr):
+        (JSC::X86Assembler::mfence):
+        (JSC::X86Assembler::X86InstructionFormatter::threeByteOp):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp8):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::WatchpointSet):
+        (JSC::WatchpointSet::add):
+        (JSC::WatchpointSet::notifyWriteSlow):
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::state):
+        (JSC::WatchpointSet::isStillValid):
+        (JSC::WatchpointSet::addressOfSetIsNotEmpty):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getJSConstantForValue):
+        (JSC::DFG::ByteCodeParser::getJSConstant):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isStronglyProvedConstantIn):
+        (JSC::DFG::Node::hasIdentifierNumberForCheck):
+        (JSC::DFG::Node::hasRegisterPointer):
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNotifyPutGlobalVar):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildFence):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileNotifyPutGlobalVar):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::fence):
+        * jit/JIT.h:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitPutGlobalVar):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitPutGlobalVar):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * llvm/LLVMAPIFunctions.h:
+        * offlineasm/arm.rb:
+        * offlineasm/arm64.rb:
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/x86.rb:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addVar):
+        (JSC::JSGlobalObject::addConst):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::couldBeWatched):
+        (JSC::SymbolTableEntry::prepareToWatch):
+        (JSC::SymbolTableEntry::notifyWriteSlow):
+        * runtime/SymbolTable.h:
+
+2013-11-19  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(158384) ARMv7 point checks too restrictive for native calls to traditional ARM code
+        https://bugs.webkit.org/show_bug.cgi?id=124612
+
+        Reviewed by Geoffrey Garen.
+
+        Removed ASSERT checks (i.e. lower bit set) for ARM Thumb2 destination addresses related to
+        calls since we are calling native ARM traditional functions like sin() and cos().
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::linkCall):
+        (JSC::ARMv7Assembler::relinkCall):
+        * assembler/MacroAssemblerCodeRef.h:
+
+2013-11-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r159459.
+        http://trac.webkit.org/changeset/159459
+        https://bugs.webkit.org/show_bug.cgi?id=124616
+
+        tons of assertions on launch (Requested by thorton on
+        #webkit).
+
+        * API/JSContext.mm:
+        (-[JSContext setException:]):
+        (-[JSContext wrapperForObjCObject:]):
+        (-[JSContext wrapperForJSObject:]):
+        * API/JSContextRef.cpp:
+        (JSContextGroupRelease):
+        (JSGlobalContextRelease):
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue initWithValue:]):
+        (-[JSManagedValue value]):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCopyPropertyNames):
+        * API/JSValue.mm:
+        (containerValueToObject):
+        * API/JSWrapperMap.mm:
+        (tryUnwrapObjcObject):
+
+2013-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename WatchpointSet::notifyWrite() should be renamed to WatchpointSet::fireAll()
+        https://bugs.webkit.org/show_bug.cgi?id=124609
+
+        Rubber stamped by Mark Lam.
+        
+        notifyWrite() is a thing that SymbolTable does. WatchpointSet uses that terminology
+        because it was original designed to match exactly SymbolTable's semantics. But now
+        it's a confusing term.
+
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::fireAllSlow):
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::fireAll):
+        (JSC::InlineWatchpointSet::fireAll):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::haveABadTime):
+        * runtime/Structure.h:
+        (JSC::Structure::notifyTransitionFromThisStructure):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::notifyWriteSlow):
+
+2013-11-18  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r159395): Error compiling for ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=124552
+
+        Reviewed by Geoffrey Garen.
+
+        Fixed the implementation of branch8(RelationalCondition cond, AbsoluteAddress address, TrustedImm32 right)
+        to materialize and use address similar to other ARMv7 branchXX() functions.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branch8):
+
+2013-11-19  Mark Lam  <mark.lam@apple.com>
+
+        Add tracking of endColumn for Executables.
+        https://bugs.webkit.org/show_bug.cgi?id=124245.
+
+        Reviewed by Geoffrey Garen.
+
+        1. Fixed computation of columns to take into account the startColumn from
+           <script> tags. Previously, we were only computing the column relative
+           to the char after the <script> tag. Now, the column number that JSC
+           computes is always the column number you'll see when viewing the source
+           in a text editor (assuming the first column position is 1, not 0).
+
+        2. Previously, unlinkedExecutables kept the a base-1 startColumn for
+           ProgramExecutables and EvalExecutables, but uses base-0 columns for
+           FunctionExecutables. This has been fixed so that they all use base-0
+           columns. When the executable gets linked, the column is adjusted into
+           a base-1 value.
+
+        3. In the UnlinkedFunctionExecutable, renamed m_functionStartOffset to
+           m_unlinkedFunctionNameStart because it actually points to the start
+           column in the name part of the function declaration.
+
+           Similarly, renamed m_functionStartColumn to m_unlinkedBodyStartColumn
+           because it points to the first character in the function body. This is
+           usually '{' except for functions created from "global code" which
+           excludes its braces. See FunctionExecutable::fromGlobalCode().
+
+               The exclusion of braces for the global code case is needed so that
+           computed start and end columns will more readily map to what a JS
+           developer would expect them to be. Otherwise, the first column of the
+           function source will not be 1 (includes prepended characters added in
+           constructFunctionSkippingEvalEnabledCheck()).
+
+           Also, similarly, a m_unlinkedBodyEndColumn has been added to track the
+           end column of the UnlinkedFunctionExecutable.
+
+        4. For unlinked executables, end column values are either:
+           a. Relative to the start of the last line if (last line != first line).
+           b. Relative to the start column position if (last line == first line).
+
+           The second case is needed so that we can add an appropriate adjustment
+           to the end column value (just like we do for the start column) when we
+           link the executable.
+
+        5. This is not new to this patch, but it worth noting that the lineCount
+           values used through this patch has the following meaning:
+           - a lineCount of 0 means the source for this code block is on 1 line.
+           - a lineCount of N means there are N + l lines of source.
+
+           This interpretation is janky, but was present before this patch. We can
+           clean that up later in another patch.
+
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        - In order to implement WebCore::Internals::parserMetaData(), we need to
+          move some seemingly unrelated header files from the Project section to
+          the Private section so that they can be #include'd by the forwarding
+          CodeBlock.h from WebCore.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::sourceCodeForTools):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        - m_isFromGlobalCode is needed to support the exclusion of the open brace /
+          prepended code for functions created from "global code".
+        (JSC::UnlinkedFunctionExecutable::link):
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::create):
+        (JSC::UnlinkedFunctionExecutable::unlinkedFunctionNameStart):
+        (JSC::UnlinkedFunctionExecutable::unlinkedBodyStartColumn):
+        (JSC::UnlinkedFunctionExecutable::unlinkedBodyEndColumn):
+        (JSC::UnlinkedFunctionExecutable::recordParse):
+        (JSC::UnlinkedCodeBlock::recordParse):
+        (JSC::UnlinkedCodeBlock::endColumn):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionBodyNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::setFunctionNameStart):
+        * parser/Lexer.cpp:
+        (JSC::::shiftLineTerminator):
+        - Removed an unused SourceCode Lexer<T>::sourceCode() function.
+        * parser/Lexer.h:
+        (JSC::Lexer::positionBeforeLastNewline):
+        (JSC::Lexer::prevTerminator):
+        - Added tracking of m_positionBeforeLastNewline in the Lexer to enable us
+          to exclude the close brace / appended code for functions created from "global
+          code".
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        (JSC::FunctionBodyNode::setEndPosition):
+        - setEndPosition() is needed to fixed up the end position so that we can
+          exclude the close brace / appended code for functions created from "global
+          code".
+        * parser/Nodes.h:
+        (JSC::ProgramNode::startColumn):
+        (JSC::ProgramNode::endColumn):
+        (JSC::EvalNode::startColumn):
+        (JSC::EvalNode::endColumn):
+        (JSC::FunctionBodyNode::setFunctionNameStart):
+        (JSC::FunctionBodyNode::functionNameStart):
+        (JSC::FunctionBodyNode::endColumn):
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionBody):
+        (JSC::::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Parser::positionBeforeLastNewline):
+        (JSC::::parse):
+        - Subtracted 1 from startColumn here to keep the node column values consistently
+          base-0. See note 2 above.
+        (JSC::parse):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::setFunctionNameStart):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::isEvalExecutable):
+        (JSC::ExecutableBase::isProgramExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::endColumn):
+        (JSC::ScriptExecutable::recordParse):
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::bodyIncludesBraces):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+
+2013-11-19  Dean Jackson  <dino@apple.com>
+
+        MarkedSpace::resumeAllocating needs to delay release
+        https://bugs.webkit.org/show_bug.cgi?id=124596
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::resumeAllocating): Add DelayedReleaseScope protection.
+
+2013-11-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        IncrementalSweeper needs to use DelayedReleaseScope too
+        https://bugs.webkit.org/show_bug.cgi?id=124558
+
+        Reviewed by Filip Pizlo.
+
+        It does sweeping too, so it needs to use it. Also refactored an
+        ASSERT that should have caught this sooner.
+
+        * heap/DelayedReleaseScope.h:
+        (JSC::DelayedReleaseScope::isInEffectFor):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doSweep):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::sweep):
+
+2013-11-18  Michael Saboff  <msaboff@apple.com>
+
+        ARM64 CRASH: Debug builds crash in emitPointerValidation()
+        https://bugs.webkit.org/show_bug.cgi?id=124545
+
+        Reviewed by Filip Pizlo.
+
+        Changed emitPointerValidation() to use pushToSave() and popToRestore() as
+        all macro assemblers have an implementation of these functions.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::emitPointerValidation):
+
+2013-11-18  Michael Saboff  <msaboff@apple.com>
+
+        ARM64: Update getHostCallReturnValue() to use architected frame pointer register
+        https://bugs.webkit.org/show_bug.cgi?id=124520
+
+        Reviewed by Filip Pizlo.
+
+        Changed from using the prior JSC specific x25 callframe register to the ARM64
+        architected x29 (fp) register.  This change should have been done as part of
+        https://bugs.webkit.org/show_bug.cgi?id=123956.
+
+        * jit/JITOperations.cpp:
+
+2013-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        put_to_scope[5] should not point to the structure if it's a variable access, but it should point to the WatchpointSet
+        https://bugs.webkit.org/show_bug.cgi?id=124539
+
+        Reviewed by Mark Hahnenberg.
+        
+        This is in preparation for getting put_to_scope to directly invalidate the watchpoint set
+        on stores, which will allow us to run constant inference on all globals.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/Instruction.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        (JSC::JSScope::abstractResolve):
+        * runtime/JSScope.h:
+        (JSC::ResolveOp::ResolveOp):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTableEntry::watchpointSet):
+
+2013-11-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        APIEntryShims need some love
+        https://bugs.webkit.org/show_bug.cgi?id=124540
+
+        Reviewed by Filip Pizlo.
+
+        We were missing them in key places which some other hacking revealed. These could have manifested as
+        race conditions for VMs being used in multithreaded environments.
+
+        * API/JSContext.mm:
+        (-[JSContext setException:]):
+        (-[JSContext wrapperForObjCObject:]):
+        (-[JSContext wrapperForJSObject:]):
+        * API/JSContextRef.cpp:
+        (JSContextGroupRelease):
+        (JSGlobalContextRelease):
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue initWithValue:]):
+        (-[JSManagedValue value]):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCopyPropertyNames):
+        * API/JSValue.mm:
+        (containerValueToObject):
+        * API/JSWrapperMap.mm:
+        (tryUnwrapObjcObject):
+
+2013-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Allow the FTL debug dumps to include the new size field
+        https://bugs.webkit.org/show_bug.cgi?id=124479
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Location::parse):
+        (JSC::FTL::StackMaps::Location::dump):
+        * ftl/FTLStackMaps.h:
+
+2013-11-18  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Link fails when DFG JIT is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=123614
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added new files.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+
+2013-11-18  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Add missing implementation in MacroAssembler to fix build (broken since r159395).
+        https://bugs.webkit.org/show_bug.cgi?id=124484
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load8):
+        (JSC::MacroAssemblerSH4::branch8):
+
+2013-11-18  Michael Saboff  <msaboff@apple.com>
+
+        ARM64 CRASH: Improper offset in getHostCallReturnValue() to access callerFrame in CallFrame
+        https://bugs.webkit.org/show_bug.cgi?id=124481
+
+        Reviewed by Mark Lam.
+
+        Fixed the offset to access CallerFrame in the ARM64 version of getHostCallReturnValue() to be 0
+        to correspond with the change in CallFrame layout done in r158315.
+
+        * jit/JITOperations.cpp:
+
+2013-11-18  Michael Saboff  <msaboff@apple.com>
+
+        Crash in virtualForThunkGenerator generated code on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=124447
+
+        Reviewed by Geoffrey Garen.
+
+        The baseline JIT generates slow path call code with the caller in regT0.  The DFG
+        generates call code with the caller in nonArgGPR0.  The virtualForThunkGenerator
+        generates code with the caller in nonArgGPR0.  For X86 and X86_64, regT0 and nonArgGPR0
+        are the same CPU register, eax.  For other platforms this isn't the case.  The same
+        issue exists for JSVALUE32_64 ports as well, where there also is an issue with the callee
+        tag registers being regT1 and nonArgGPR1 in the various locations.
+
+        Changed nonArgGPR0, nonArgGPR1 and nonArgGPR2 for X86 and X86_64 to not match up with
+        regT0-2.  Changing these registers will cause a crash on all ports should we have a
+        similar problem in the future.  Changed the DFG call generating code to use regT0 and
+        regT1.  Now all slow path call code is generated using regT0 and for JSVALUE32_64 regT1.
+        Added r12 to X86_64 as a new temp register (regT9) and moved r13 down to regT10.
+        The new temp register decreases the likelihood of inadvertant register overlap.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toRegister):
+        (JSC::GPRInfo::toIndex):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualForThunkGenerator):
+
+2013-11-18  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        Add missing load8/branch8 with AbsoluteAddress parameter to MIPS port.
+
+        [MIPS] Build fails since r159395.
+        https://bugs.webkit.org/show_bug.cgi?id=124491
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load8):
+        (JSC::MacroAssemblerMIPS::branch8):
+
+2013-11-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r159351): It made zillion tests assert on !CF platforms
+        https://bugs.webkit.org/show_bug.cgi?id=124490
+
+        Reviewed by Mark Hahnenberg.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::sweep):
+
+2013-11-18  Julien Brianceau  <jbriance@cisco.com>
+
+        Remove architecture specific code in LowLevelInterpreter.
+        https://bugs.webkit.org/show_bug.cgi?id=124501
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter.asm: Use generic path instead of sh4 specific code.
+        * llint/LowLevelInterpreter32_64.asm: Merge sh4/mips path with arm path. The
+        "move t0, a0" is not needed for arm because t0 == a0 with this architecture.
+        * offlineasm/sh4.rb: Handle move opcode with pr register.
+
+2013-11-18  Julien Brianceau  <jbriance@cisco.com>
+
+        [arm] Add missing implementation in MacroAssembler to fix build (broken since r159395).
+        https://bugs.webkit.org/show_bug.cgi?id=124488
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch8):
+
+2013-11-17  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Fix revertJumpReplacementToBranchPtrWithPatch in MacroAssembler.
+        https://bugs.webkit.org/show_bug.cgi?id=124468
+
+        Reviewed by Michael Saboff.
+
+        Current implementation of revertJumpReplacementToBranchPtrWithPatch is wrong in
+        the sh4 MacroAssembler part, leading to random instabilities. This patch fixes it
+        and also renames the bad-named revertJumpToMove to revertJumpReplacementToBranchPtrWithPatch
+        in the SH4Assembler.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::revertJumpReplacementToBranchPtrWithPatch):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::replaceWithJump):
+        (JSC::SH4Assembler::revertJumpReplacementToBranchPtrWithPatch):
+
+2013-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Simplify WatchpointSet state tracking
+        https://bugs.webkit.org/show_bug.cgi?id=124465
+
+        Reviewed by Sam Weinig.
+        
+        We previously represented the state of watchpoint sets using two booleans. But that
+        makes it awkward to case over the state.
+        
+        We also previously supported a watchpoint set being both watched and invalidated. We
+        never used that capability, and its presence was just purely confusing.
+        
+        This turns the whole thing into an enum.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branch8):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branch8):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::branch8):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branch8):
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::WatchpointSet):
+        (JSC::WatchpointSet::add):
+        (JSC::WatchpointSet::notifyWriteSlow):
+        (JSC::InlineWatchpointSet::inflateSlow):
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::state):
+        (JSC::WatchpointSet::isStillValid):
+        (JSC::WatchpointSet::startWatching):
+        (JSC::WatchpointSet::notifyWrite):
+        (JSC::WatchpointSet::addressOfState):
+        (JSC::InlineWatchpointSet::InlineWatchpointSet):
+        (JSC::InlineWatchpointSet::hasBeenInvalidated):
+        (JSC::InlineWatchpointSet::startWatching):
+        (JSC::InlineWatchpointSet::notifyWrite):
+        (JSC::InlineWatchpointSet::decodeState):
+        (JSC::InlineWatchpointSet::encodeState):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitVarInjectionCheck):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitVarInjectionCheck):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::attemptToWatch):
+        * runtime/SymbolTable.h:
+
+2013-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should have an explicit notion of bytecode liveness
+        https://bugs.webkit.org/show_bug.cgi?id=124181
+
+        Reviewed by Sam Weinig.
+        
+        This makes FTL OSR exit use bytecode liveness analysis to determine which variables
+        to include values for. The decision of how to get the values of variables is based on
+        forward propagation of MovHints and SetLocals.
+        
+        This fixes a bunch of bugs (like https://bugs.webkit.org/show_bug.cgi?id=124138 but
+        also others that I noticed when I started writing more targetted tests) and allows us
+        to remove some sketchy code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeBasicBlock.h:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::isValidRegisterForLiveness):
+        (JSC::setForOperand):
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        (JSC::stepOverInstruction):
+        (JSC::computeLocalLivenessForBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
+        (JSC::BytecodeLivenessAnalysis::operandIsLiveAtBytecodeOffset):
+        (JSC::getLivenessInfo):
+        (JSC::BytecodeLivenessAnalysis::getLivenessInfoAtBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
+        * bytecode/BytecodeLivenessAnalysis.h:
+        * bytecode/BytecodeLivenessAnalysisInlines.h: Added.
+        (JSC::operandIsAlwaysLive):
+        (JSC::operandThatIsNotAlwaysLiveIsLive):
+        (JSC::operandIsLive):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::captureCount):
+        (JSC::CodeBlock::captureStart):
+        (JSC::CodeBlock::captureEnd):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::dumpInContext):
+        * bytecode/FullBytecodeLiveness.h: Added.
+        (JSC::FullBytecodeLiveness::FullBytecodeLiveness):
+        (JSC::FullBytecodeLiveness::getOut):
+        (JSC::FullBytecodeLiveness::operandIsLive):
+        (JSC::FullBytecodeLiveness::getLiveness):
+        * dfg/DFGAvailability.cpp: Added.
+        (JSC::DFG::Availability::dump):
+        (JSC::DFG::Availability::dumpInContext):
+        * dfg/DFGAvailability.h: Added.
+        (JSC::DFG::Availability::Availability):
+        (JSC::DFG::Availability::unavailable):
+        (JSC::DFG::Availability::withFlush):
+        (JSC::DFG::Availability::withNode):
+        (JSC::DFG::Availability::withUnavailableNode):
+        (JSC::DFG::Availability::nodeIsUndecided):
+        (JSC::DFG::Availability::nodeIsUnavailable):
+        (JSC::DFG::Availability::hasNode):
+        (JSC::DFG::Availability::node):
+        (JSC::DFG::Availability::flushedAt):
+        (JSC::DFG::Availability::operator!):
+        (JSC::DFG::Availability::operator==):
+        (JSC::DFG::Availability::merge):
+        (JSC::DFG::Availability::mergeNodes):
+        (JSC::DFG::Availability::unavailableMarker):
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::Disassembler):
+        * dfg/DFGFlushFormat.cpp:
+        (WTF::printInternal):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::resultFor):
+        (JSC::DFG::useKindFor):
+        (JSC::DFG::dataFormatFor):
+        * dfg/DFGFlushedAt.cpp:
+        (JSC::DFG::FlushedAt::dump):
+        * dfg/DFGFlushedAt.h:
+        (JSC::DFG::FlushedAt::FlushedAt):
+        (JSC::DFG::FlushedAt::merge):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::livenessFor):
+        (JSC::DFG::Graph::isLiveInBytecode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::baselineCodeBlockFor):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGResurrectionForValidationPhase.cpp: Added.
+        (JSC::DFG::ResurrectionForValidationPhase::ResurrectionForValidationPhase):
+        (JSC::DFG::ResurrectionForValidationPhase::run):
+        (JSC::DFG::performResurrectionForValidation):
+        * dfg/DFGResurrectionForValidationPhase.h: Added.
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::forFlushFormat):
+        * dfg/DFGVariableAccessData.h:
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfGetById):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::gpr):
+        (JSC::FTL::Location::fpr):
+        (JSC::FTL::Location::directGPR):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileZombieHint):
+        (JSC::FTL::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        (JSC::FTL::LowerDFGToLLVM::observeMovHint):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::alloca):
+        * ftl/FTLValueSource.cpp: Removed.
+        * ftl/FTLValueSource.h: Removed.
+        * llvm/LLVMAPIFunctions.h:
+        * runtime/DumpContext.cpp:
+        (JSC::DumpContext::DumpContext):
+        * runtime/DumpContext.h:
+        * runtime/Options.h:
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::captureStart):
+        (JSC::SharedSymbolTable::captureEnd):
+        (JSC::SharedSymbolTable::captureCount):
+
+2013-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of JSActivation.h.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/JSActivation.h:
+
+2013-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation of JSVariableObject.h.
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        I'm about to do some damage to this file. I wanted to give it some sanity first.
+
+        * runtime/JSVariableObject.h:
+
+2013-11-16  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Fix build (broken since r159346).
+        https://bugs.webkit.org/show_bug.cgi?id=124455
+
+        Reviewed by Oliver Hunt.
+
+        Fix LLINT implementation for sh4 architecture to handle properly load and store operations with pr register.
+
+        * offlineasm/sh4.rb:
+
+2013-11-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Support exporting symmetric keys as JWK
+        https://bugs.webkit.org/show_bug.cgi?id=124442
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSONObject.h: Export JSONStringify.
+
+2013-11-15  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] JavaScript crashes on 64-bit with JIT enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=124409
+
+        Reviewed by Michael Saboff.
+
+        These are issues found with JIT on 64-bit:
+        - The registers rsi and rdi in callToJavaScript needs to be saved and restored. This is required by the Windows 64-bit ABI.
+        - The getHostCallReturnValue function needs to be updated according to it's GCC counterpart.
+        - The poke argument offset needs to be 20h, because Windows 64-bit ABI requires stack space allocated for the 4 argument registers.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Re-added JITStubsMSVC64.asm to project.
+        * jit/CCallHelpers.h: Set poke argument offset.
+        (JSC::CCallHelpers::setupArguments): Compile fix, added needed method.
+        * jit/JITStubsMSVC64.asm: Save and restore registers rsi and rdi.
+                                  Update getHostCallReturnValue according to the GCC version.
+
+2013-11-14  David Farler  <dfarler@apple.com>
+
+        Copy ASAN flag settings to WebCore and JavaScriptCore intermediate build tools
+        https://bugs.webkit.org/show_bug.cgi?id=124362
+
+        Reviewed by David Kilzer.
+
+        * Configurations/ToolExecutable.xcconfig:
+        Use ASAN_C*FLAGS.
+
+2013-11-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove JSChunk
+        https://bugs.webkit.org/show_bug.cgi?id=124435
+
+        Reviewed by Geoffrey Garen.
+
+        It's empty and has been since it was added 3 years ago.
+
+        * CMakeLists.txt:
+        * runtime/JSChunk.cpp: Removed.
+        * runtime/JSChunk.h: Removed.
+
+2013-11-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove VTableSpectrum
+        https://bugs.webkit.org/show_bug.cgi?id=124427
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+        * heap/Heap.h:
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor):
+        * heap/SlotVisitor.cpp:
+        (JSC::visitChildren):
+        * heap/SlotVisitor.h:
+        * heap/VTableSpectrum.cpp: Removed.
+        * heap/VTableSpectrum.h: Removed.
+
+2013-11-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        -dealloc callbacks from wrapped Objective-C objects can happen at bad times
+        https://bugs.webkit.org/show_bug.cgi?id=123821
+
+        Reviewed by Darin Adler.
+
+        Currently with the JSC Obj-C API, JS wrappers for client Obj-C objects retain their associated Obj-C 
+        object. When they are swept, they release their Obj-C objects which can trigger a call to that 
+        object's -dealloc method. These -dealloc methods can then call back into the same VM, which is not 
+        allowed during sweeping or VM shutdown.
+
+        We can handle this case by creating our own pool of Obj-C objects to be released when it is safe to do so.
+        This is accomplished by using DelayedReleaseScope, an RAII-style object that will retain all objects
+        that are unsafe to release until the end of the DelayedReleaseScope.
+
+        * API/APIShims.h:
+        (JSC::APICallbackShim::APICallbackShim):
+        (JSC::APICallbackShim::vmForDropAllLocks):
+        (JSC::APICallbackShim::execForDropAllLocks):
+        * API/JSAPIWrapperObject.mm:
+        (JSAPIWrapperObjectHandleOwner::finalize):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunctionImpl::destroy):
+        (JSC::ObjCCallbackFunction::destroy):
+        * API/tests/testapi.mm:
+        (-[TinyDOMNode initWithVirtualMachine:]):
+        (-[TinyDOMNode dealloc]):
+        (-[TinyDOMNode appendChild:]):
+        (-[TinyDOMNode removeChildAtIndex:]):
+        (-[EvilAllocationObject initWithContext:]):
+        (-[EvilAllocationObject dealloc]):
+        (-[EvilAllocationObject doEvilThingsWithContext:]):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/DelayedReleaseScope.h: Added.
+        (JSC::DelayedReleaseScope::DelayedReleaseScope):
+        (JSC::DelayedReleaseScope::~DelayedReleaseScope):
+        (JSC::DelayedReleaseScope::releaseSoon):
+        (JSC::MarkedSpace::releaseSoon):
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        * heap/Heap.h:
+        (JSC::Heap::releaseSoon):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+        (JSC::MarkedSpace::sweep):
+        * heap/MarkedSpace.h:
+
+2013-11-15  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r158586): callToJavaScript needs to save return PC to Sentinel frame
+        https://bugs.webkit.org/show_bug.cgi?id=124420
+
+        Reviewed by Filip Pizlo.
+
+        Save the return PC into the sentinel frame.
+
+        * jit/JITStubsMSVC64.asm:
+        * jit/JITStubsX86.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-11-14  Oliver Hunt  <oliver@apple.com>
+
+        Make CLoop easier to build, and make it work
+        https://bugs.webkit.org/show_bug.cgi?id=124359
+
+        Reviewed by Geoffrey Garen.
+
+        Add --cloop to build-jsc, build-webkit and friends.
+
+        Also make CLoop build and work again - This meant adding a
+        couple of missing ENABLE(DFG_JIT) blocks, and fixing a few 
+        other references.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/DFGExitProfile.cpp:
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGCompilationKey.cpp:
+        * dfg/DFGCompilationMode.cpp:
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+
+2013-11-14  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r159276): Fix lots of crashes for arm_traditional architecture.
+        https://bugs.webkit.org/show_bug.cgi?id=124365
+
+        Reviewed by Oliver Hunt.
+
+        Crashes were caused by a mixup between regular registers and temporary registers in ARM_EXTRA_GPRS.
+
+        * llint/LowLevelInterpreter32_64.asm: Warning, t3 != a3. It's safer to use an implementation using aX
+        registers like the MIPS one for cCallX macros.
+        * offlineasm/arm.rb: Rearrange ARM_EXTRA_GPRS according to the new register distribution in LLINT.
+
+2013-11-14  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r159276): rbp register overwritten in Win 64 version of callToJavascript stub
+        https://bugs.webkit.org/show_bug.cgi?id=124361
+
+        Reviewed by Oliver Hunt.
+
+        Swapped operand ordering to: mov rax, rbp
+
+        * jit/JITStubsMSVC64.asm:
+
+2013-11-14  Julien Brianceau  <jbriance@cisco.com>
+
+        REGRESSION (r159276): Fix lots of crashes for sh4 architecture.
+        https://bugs.webkit.org/show_bug.cgi?id=124347
+
+        Reviewed by Michael Saboff.
+
+        Since r159276, we have (t4 == a0 == r4) and (t5 == a1 == r5) in LLINT for sh4.
+        This leads to argument register trampling in cCallX macros, especially with cCall2
+        macro when arg1 == t4.
+
+        * llint/LowLevelInterpreter32_64.asm: Use a new "setargs" pseudo-op to setup arguments for sh4.
+        * offlineasm/instructions.rb:
+        * offlineasm/sh4.rb: Lower "setargs" pseudo-op to setup argument registers and prevent register trampling issues.
+
+2013-11-14  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix build for sh4 architectures (broken since r159276).
+        https://bugs.webkit.org/show_bug.cgi?id=124344
+
+        Reviewed by Csaba Osztrogonác.
+
+        * offlineasm/sh4.rb: There is no fp alias for r14 register for sh4.
+
+2013-11-13  Michael Saboff  <msaboff@apple.com>
+
+        Change callToJavaScript thunk into an offline assembled stub
+        https://bugs.webkit.org/show_bug.cgi?id=124251
+
+        Reviewed by Geoffrey Garen.
+
+        Changed callToJavaScript and throwNotCaught into stubs generated by the offline assembler.
+        Added popCalleeSaves and pushCalleeSaves pseudo ops to the offline assembler to handle
+        the saving and restoring of callee save registers.  Fixed callFrameRegister differences
+        between arm traditional (r11) and arm Thumb2 (r7) in GPRInfo.h.  Also fixed implementation
+        of pop & push in arm.rb.
+
+        Since the offline assembler and therefore the LLInt don't work on Windows, the Windows stubs
+        are handled as inline assembly in JITStubsX86.h and JITStubsMSVC64.asm.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toIndex):
+        (JSC::GPRInfo::debugName):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITStubs.h:
+        * jit/JITStubsMSVC64.asm:
+        * jit/JITStubsX86.h:
+        * jit/ThunkGenerators.cpp:
+        * jit/ThunkGenerators.h:
+        * llint/LLIntThunks.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/arm.rb:
+        * offlineasm/arm64.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/mips.rb:
+        * offlineasm/registers.rb:
+        * offlineasm/sh4.rb:
+        * offlineasm/x86.rb:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2013-11-13  Andy Estes  <aestes@apple.com>
+
+        Fix the ARM64 build after recent JavaScriptCore changes
+        https://bugs.webkit.org/show_bug.cgi?id=124315
+
+        Reviewed by Michael Saboff.
+
+        Based on patches by myself, Filip Pizlo, Benjamin Poulain, and Michael Saboff.
+
+        * Configurations/JavaScriptCore.xcconfig: Hid the symbol for
+        std::bad_function_call.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Marked
+        MacroAssemblerARM64.h and ARM64Assembler.h as Private headers.
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::executableOffsetFor):
+        * assembler/MacroAssemblerARM64.h: Removed ARM64's executableCopy(),
+        which was removed from other assembler backends in r157690.
+        (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch): Added.
+        (JSC::MacroAssemblerARM64::lshift64): Added.
+        (JSC::MacroAssemblerARM64::mul64): Added.
+        (JSC::MacroAssemblerARM64::rshift64): Added.
+        (JSC::MacroAssemblerARM64::convertInt64ToDouble): Added.
+        (JSC::MacroAssemblerARM64::branchMul64): Added.
+        (JSC::MacroAssemblerARM64::branchNeg64): Added.
+        (JSC::MacroAssemblerARM64::scratchRegisterForBlinding): Added.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDiv): Changed
+        SpeculateIntegerOperand to SpeculateInt32Operand,
+        nodeCanIgnoreNegativeZero() to bytecodeCanIgnoreNegativeZero(), and
+        nodeUsedAsNumber() to bytecodeUsesAsNumber().
+        (JSC::DFG::SpeculativeJIT::compileArithMod): Changed
+        nodeCanIgnoreNegativeZero() to bytecodeCanIgnoreNegativeZero().
+
+2013-11-13  Oliver Hunt  <oliver@apple.com>
+
+        Fix debug build.
+
+        * parser/Parser.cpp:
+
+2013-11-13  Tim Horton  <timothy_horton@apple.com>
+
+        r159210 added a period where there previously wasn't one, breaking >100 tests
+
+        Rubber-stamped by Oliver Hunt.
+
+        * parser/Parser.cpp:
+        (JSC::::logError):
+        Remove the extra period.
+
+2013-11-13  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION (r158014): Many webpages throw stack overflow exceptions on iOS (because Parser::parseMemberExpression uses ~130K more stack)
+        https://bugs.webkit.org/show_bug.cgi?id=124177
+
+        Reviewed by Michael Saboff.
+
+        This patch pushes error handling into NEVER_INLINE functions to perform
+        the actual error message construction.  This dramatically reduces the
+        stack usage of the Parser.  For the large functions (such as parseMemberExpression)
+        the improvement is on the order of 2.5x reduction in stack usage.  For
+        smaller functions the reduction is in the order of 5-6x.
+
+        * parser/Parser.cpp:
+        (JSC::::logError):
+        * parser/Parser.h:
+
+2013-11-13  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Protect repatchCompact from flushConstantPool.
+        https://bugs.webkit.org/show_bug.cgi?id=124278
+
+        Reviewed by Michael Saboff.
+
+        Random crashes may occur with sh4 architecture, when a flushConstantPool occurs in
+        movlMemRegCompact. As in this case a branch opcode and the constant pool are put
+        before the movlMemRegCompact, the branch itself is patched when calling repatchCompact
+        instead of the mov instruction, which is really bad.
+
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::repatchCompact): Handle this specific case and add an ASSERT.
+
+2013-11-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Disable WebCrypto on Mountain Lion
+        https://bugs.webkit.org/show_bug.cgi?id=124261
+
+        Rubber-stamped by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-11-12  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Fix load32WithUnalignedHalfWords function in baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=124233
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load32WithUnalignedHalfWords): Do not claim scratch register too early.
+        Test already covered by fast/regex/pcre-test-1.
+
+2013-11-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Liveness analysis should take less memory in CodeBlock when it is unused
+        https://bugs.webkit.org/show_bug.cgi?id=124225
+
+        Reviewed by Mark Hahnenberg.
+        
+        Basically, I turned CodeBlock::m_livenessAnalysis into a pointer that is null by
+        default.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::BytecodeLivenessAnalysis::BytecodeLivenessAnalysis):
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
+        (JSC::BytecodeLivenessAnalysis::operandIsLiveAtBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::dumpResults):
+        (JSC::BytecodeLivenessAnalysis::compute):
+        * bytecode/BytecodeLivenessAnalysis.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::livenessAnalysis):
+
+2013-11-11  Oliver Hunt  <oliver@apple.com>
+
+        Support unprefixed deconstructing assignment
+        https://bugs.webkit.org/show_bug.cgi?id=124172
+
+        Reviewed by Mark Lam.
+
+        Add support for unprefixed descontructive assignment.
+
+        Happily non-reference types on the left hand side of an assignment
+        are a runtime error, so we're able to defer validation of the binding
+        pattern to codegen time when we're already doing a lot more work.
+
+        We're also able to predicate our attempt to parse on the existence of
+        '[' or '{' as they are not as common as other constructs. 
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        * parser/ASTBuilder.h:
+        * parser/Parser.cpp:
+        (JSC::::createBindingPattern):
+        (JSC::::tryParseDeconstructionPatternExpression):
+        (JSC::::parseDeconstructionPattern):
+        (JSC::::parseForStatement):
+        (JSC::::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::Parser::createSavePoint):
+        (JSC::Parser::restoreSavePoint):
+        * parser/SyntaxChecker.h:
+
+2013-11-12  Andy Estes  <aestes@apple.com>
+
+        Run JavaScriptCore Objective-C API tests on all supported platforms
+        https://bugs.webkit.org/show_bug.cgi?id=124214
+
+        Reviewed by Mark Hahnenberg.
+
+        Now that we support the API on iOS and on OS X 10.8, there's no reason
+        to limit the tests to OS X 10.9 (or greater).
+
+        * API/tests/CurrentThisInsideBlockGetterTest.h:
+        * API/tests/CurrentThisInsideBlockGetterTest.mm:
+        * API/tests/testapi.mm:
+
+2013-08-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CodeBlocks should be able to determine bytecode liveness
+        https://bugs.webkit.org/show_bug.cgi?id=118546
+
+        Reviewed by Filip Pizlo.
+
+        This will simplify some things in the DFG related to OSR exits and determining 
+        which bytecode variables are live at which points during execution. It will
+        also be useful for making our conservative GC scan more precise. Currently it 
+        doesn't properly account for liveness while the DFG is running, so it will be 
+        off by default behing a runtime Options flag.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeBasicBlock.cpp: Added.
+        (JSC::isBranch): Used to determine the end of basic blocks.
+        (JSC::isUnconditionalBranch): Used to determine when a branch at the end of a 
+        basic block can't possibly fall through to the next basic block in program order.
+        (JSC::isTerminal): Also used to detect the end of a block.
+        (JSC::isThrow):
+        (JSC::isJumpTarget): Used to correctly separate basic blocks. Any jump destination 
+        must be the head of its own basic block.
+        (JSC::linkBlocks): Links two blocks together in a bi-direcitonal fashion.
+        (JSC::computeBytecodeBasicBlocks): Creates a set of basic blocks given a particular 
+        CodeBlock and links them together.
+        * bytecode/BytecodeBasicBlock.h: Added.
+        (JSC::BytecodeBasicBlock::isEntryBlock): Entry blocks are a special basic blocks 
+        that indicate the beginning of the function.
+        (JSC::BytecodeBasicBlock::isExitBlock): Exit blocks are a special basic block that 
+        all blocks that exit the function have as a successor. Entry and exit blocks allows 
+        the various code paths to be more regular.
+        (JSC::BytecodeBasicBlock::leaderBytecodeOffset): The leader bytecode offset is the 
+        bytecode offset of the first instruction in the block.
+        (JSC::BytecodeBasicBlock::totalBytecodeLength): The total length of all the bytecodes 
+        in this block.
+        (JSC::BytecodeBasicBlock::bytecodeOffsets): The bytecode offsets in this particular 
+        basic block. This Vector allows us to iterate over the bytecodes in reverse order 
+        which wouldn't be possible normally since they are of variable size.
+        (JSC::BytecodeBasicBlock::addPredecessor): Links a block to a specified predecessor. 
+        Only creates one direction of the link.
+        (JSC::BytecodeBasicBlock::addSuccessor): Same as addPredecessor, but for successors.
+        (JSC::BytecodeBasicBlock::predecessors): Getter for predecessors.
+        (JSC::BytecodeBasicBlock::successors): Getter for successors.
+        (JSC::BytecodeBasicBlock::in): Getter for the liveness info at the head of the block.
+        (JSC::BytecodeBasicBlock::out): Getter for the liveness info at  the tail of the block.
+        (JSC::BytecodeBasicBlock::BytecodeBasicBlock):
+        (JSC::BytecodeBasicBlock::addBytecodeLength): When creating basic blocks we call 
+        this function when we want to add the next bytecode in program order to this block.
+        * bytecode/BytecodeLivenessAnalysis.cpp: Added.
+        (JSC::BytecodeLivenessAnalysis::BytecodeLivenessAnalysis):
+        (JSC::numberOfCapturedVariables): Convenience wrapper. Returns the
+        number of captured variables for a particular CodeBlock, or 0 if 
+        the CodeBlock has no SymbolTable.
+        (JSC::captureStart): Ditto, but for captureStart().
+        (JSC::captureEnd): Ditto, but for captureEnd().
+        (JSC::isValidRegisterForLiveness): Returns true if the liveness analysis should 
+        track the liveness of a particular operand. We ignore constants, arguments, and 
+        captured variables. We ignore arguments because they're live for the duration of 
+        a function call. We ignore captured variables because we also treat them as live 
+        for the duration of the function. This could probably be improved to be more precise, 
+        but it didn't seem worth it for now.
+        (JSC::setForOperand): Convenience wrapper that sets the bit in the provided bit 
+        vector for the provided operand. It handles skipping over captured variables.
+        (JSC::computeUsesForBytecodeOffset): Computes which operands are used by a particular bytecode.
+        (JSC::computeDefsForBytecodeOffset): Computes which operands are defined by a particular 
+        bytecode. Typically this is just the left-most operand.
+        (JSC::findBasicBlockWithLeaderOffset): 
+        (JSC::findBasicBlockForBytecodeOffset): Scans over basic blocks to find the block 
+        which contains a particular bytecode offset.
+        (JSC::computeLocalLivenessForBytecodeOffset): Computes block-local liveness from the 
+        bottom of the block until a specified bytecode offset is reached. 
+        (JSC::computeLocalLivenessForBlock): Computes liveness for the entire block and 
+        stores the resulting liveness at the head.
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint): Runs backward flow liveness 
+        analysis to fixpoint.
+        (JSC::BytecodeLivenessAnalysis::getLivenessInfoForNonCapturedVarsAtBytecodeOffset): 
+        Slow path to get liveness info for non-captured, non-argument variable.
+        (JSC::BytecodeLivenessAnalysis::operandIsLiveAtBytecodeOffset): 
+        (JSC::BytecodeLivenessAnalysis::getLivenessInfoAtBytecodeOffset): Returns the liveness 
+        info for both captured and non-captured vars at a particular bytecode offset.
+        (JSC::BytecodeLivenessAnalysis::dumpResults): Dumps the output of the liveness analysis. 
+        Controlled by new flag in Options.h/.cpp.
+        (JSC::BytecodeLivenessAnalysis::compute): Creates bytecode basic blocks and runs 
+        full liveness analysis.
+        * bytecode/BytecodeLivenessAnalysis.h: Added.
+        (JSC::BytecodeLivenessAnalysis::hasBeenComputed):
+        (JSC::BytecodeLivenessAnalysis::computeIfNecessary):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::livenessAnalysis):
+        * bytecode/PreciseJumpTargets.cpp: Refactored to be able to get the jump targets for 
+        a particular bytecode offset for use during bytecode basic block construction.
+        (JSC::getJumpTargetsForBytecodeOffset):
+        (JSC::computePreciseJumpTargets):
+        (JSC::findJumpTargetsForBytecodeOffset):
+        * bytecode/PreciseJumpTargets.h:
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+
+2013-11-11  Andy Estes  <aestes@apple.com>
+
+        [iOS] Define JSC_OBJC_API_ENABLED
+        https://bugs.webkit.org/show_bug.cgi?id=124192
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSBase.h: JSC_OBJC_API_ENABLED should evaluate to true if
+        TARGET_OS_IPHONE is true.
+        * API/JSValue.h: Ensure CG types referenced later in the file are defined.
+
+2013-11-12  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        Fix undefined reference issues in JavaScriptCore build.
+        https://bugs.webkit.org/show_bug.cgi?id=124152
+
+        Reviewed by Michael Saboff.
+
+        Missing includes added.
+
+        * runtime/SymbolTable.cpp:
+
+2013-11-12  Alexandru Chiculita  <achicu@adobe.com>
+
+        Web Inspector: Crash when closing the Inspector while debugging an exception inside a breakpoint condition.
+        https://bugs.webkit.org/show_bug.cgi?id=124078
+
+        Reviewed by Joseph Pecoraro.
+
+        The crash would happen because the Debugger is not designed to support nested
+        breaks. For example, when the debugger handles a breakpoint and the Inspector
+        executes a console command that would hit the breakpoint again, the Debugger
+        will just ignore the breakpoint.
+
+        There were no checks for conditions and actions. Because of that conditions and actions
+        could trigger exceptions and breakpoints. This patch disables that functionality as it
+        cannot be supported without a bigger rewrite of the code.
+
+        * debugger/Debugger.cpp:
+        (JSC::TemporaryPausedState::TemporaryPausedState):
+        (JSC::TemporaryPausedState::~TemporaryPausedState):
+        (JSC::Debugger::hasBreakpoint):
+        (JSC::Debugger::pauseIfNeeded):
+        * debugger/Debugger.h:
+
+2013-11-12  Julien Brianceau  <jbriance@cisco.com>
+
+        InvalidIndex shouldn't be private in GPRInfo and FPRInfo for sh4, mips and arm64 architectures.
+        https://bugs.webkit.org/show_bug.cgi?id=124156
+
+        Reviewed by Michael Saboff.
+
+        * jit/FPRInfo.h:
+        (JSC::FPRInfo::debugName):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::debugName):
+
+2013-11-11  Andreas Kling  <akling@apple.com>
+
+        CodeBlock: Un-segment some Vectors.
+        <https://webkit.org/b/124188>
+
+        Turn some SegmentedVectors into Vectors where the final item count
+        is known at CodeBlock construction time. This removes unnecessary
+        allocation and indirection.
+
+        I've got ~4.5 MB below SegmentedVector<ValueProfile>::ensureSegment
+        on Membuster3 (peak, before pressure signal) so this should help
+        take a bit of the edge off there.
+
+        Reviewed by Geoffrey Garen.
+
+2013-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of the lastResultRegister optimization in the baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=124171
+
+        Rubber stamped by Mark Hahnenberg.
+        
+        The baseline JIT no longer needs amazing throughput. And this optimization has caused
+        way too many OSR exit bugs. And it constrains how much we can do in the DFG/FTL. So,
+        I'm getting rid of it.
+
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::convertToForward):
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileZombieHint):
+        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::observeMovHint):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::convertToForward):
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::appendCall):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_inc):
+        (JSC::JIT::emit_op_dec):
+        * jit/JITCall.cpp:
+        (JSC::JIT::emitPutCallResult):
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        (JSC::JIT::emitGetFromCallFrameHeader64):
+        (JSC::JIT::emitLoadTag):
+        (JSC::JIT::emitLoadPayload):
+        (JSC::JIT::emitLoad2):
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitGetVirtualRegisters):
+        (JSC::JIT::emitPutVirtualRegister):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_new_func):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_mov):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_to_number):
+        (JSC::JIT::emit_op_catch):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emit_op_put_to_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitResolveClosure):
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emit_op_init_global_const):
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+
+2013-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove ConstantFoldingPhase's weirdo compile-time optimization
+        https://bugs.webkit.org/show_bug.cgi?id=124169
+
+        Reviewed by Mark Hahnenberg.
+        
+        It turns out that this compile-time optimization doesn't optimize compile times
+        anymore. Kill it with fire.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2013-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Make bytecode dumping use the right opcode names for inc/dec.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+
+2013-11-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Int52 boxing code may clobber the source without telling anyone
+        https://bugs.webkit.org/show_bug.cgi?id=124137
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::boxInt52): This is called in places where source is expected to be unchanged. We never call this expecting super-amazing codegen. So, preserve the source's value the dumb way (by recovering it mathematically).
+        * jit/AssemblyHelpers.h: Document the invariant for boxInt52.
+        * jsc.cpp:
+        (GlobalObject::finishCreation): It's been super annoying that sometimes we say noInline() and sometimes we say neverInlineFunction(). The LayoutTests harnesses ensure that we have something called noInline(), but it's great to also ensure that the shell has it.
+
+2013-11-11  Oliver Hunt  <oliver@apple.com>
+
+        ExtJS breaks with modern Array.prototype.values API due to use of with()
+        https://bugs.webkit.org/show_bug.cgi?id=123440
+
+        Reviewed by Beth Dakin.
+
+        As with our attempt to make Arguments use the Array prototype, ExtJS has
+        a weird dependency on not adding new APIs to core types.  In this case
+        Array.prototype.values.  The fix is to remove it, and push for ES6 to drop
+        the API.
+
+        * runtime/ArrayPrototype.cpp:
+
+2013-11-11  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Fix CPU(ARM_TRADITIONAL) build after r159039.
+        https://bugs.webkit.org/show_bug.cgi?id=124149
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::firstRegister):
+        (JSC::ARMAssembler::lastRegister):
+        (JSC::ARMAssembler::firstFPRegister):
+        (JSC::ARMAssembler::lastFPRegister):
+        * assembler/MacroAssemblerARM.h:
+        * jit/FPRInfo.h:
+
+2013-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Switch FTL GetById/PutById IC's over to using AnyRegCC
+        https://bugs.webkit.org/show_bug.cgi?id=124094
+
+        Reviewed by Sam Weinig.
+        
+        This closes the loop on inline caches (IC's) in the FTL. The goal is to have IC's
+        in LLVM-generated code that are just as efficient (if not more so) than what a
+        custom JIT could do. As in zero sources of overhead. Not a single extra instruction
+        or even register allocation pathology. We accomplish this by having two thingies in
+        LLVM. First is the llvm.experimental.patchpoint intrinsic, which is sort of an
+        inline machine code snippet that we can fill in with whatever we want and then
+        modify subsequently. But you have only two choices of how to pass values to a
+        patchpoint: (1) via the calling convention or (2) via the stackmap. Neither are good
+        for operands to an IC (like the base pointer for a GetById, for example). (1) is bad
+        because it results in things being pinned to certain registers a priori; a custom
+        JIT (like the DFG) will not pin IC operands to any registers a priori but will allow
+        the register allocator to do whatever it wants. (2) is bad because the operands may
+        be spilled or may be represented in other crazy ways. You generally want an IC to
+        have its operands in registers. Also, patchpoints only return values using the
+        calling convention, which is unfortunate since it pins the return value to a
+        register a priori. This is where the second thingy comes in: the AnyRegCC. This is
+        a special calling convention only for use with patchpoints. It means that arguments
+        passed "by CC" in the patchpoint can be placed in any register, and the register
+        that gets used is reported as part of the stackmap. It also means that the return
+        value (if there is one) can be placed in any register, and the stackmap will tell
+        you which one it was. Thus, patchpoints combined with AnyRegCC mean that you not
+        only get the kind of self-modifying code that you want for IC's, but you also get
+        all of the register allocation goodness that a custom JIT would have given you.
+        Except that you're getting it from LLVM and not a custom JIT. Awesome.
+        
+        Even though all of the fun stuff is on the LLVM side, this patch was harder than
+        you'd expect.
+        
+        First the obvious bits:
+        
+        - IC patchpoints now use AnyRegCC instead of the C CC. (CC = calling convention.)
+        
+        - FTL::fixFunctionBasedOnStackMaps() now correctly figures out which registers the
+          IC is supposed to use instead of assuming C CC argument registers.
+        
+        And then all of the stuff that broke and that this patch fixes:
+        
+        - IC sizing based on generating a dummy IC (what FTLInlineCacheSize did) is totally
+          bad on x86-64, where various register permutations lead to bizarre header bytes
+          and eclectic SIB encodings. I changed that to have magic constants, for now.
+        
+        - Slow path calls didn't preserve the CC return register.
+        
+        - Repatch's scratch register allocation would get totally confused if the operand
+          registers weren't one of the DFG-style "temp" registers. And by "totally confused"
+          I mean that it would crash.
+        
+        - We assumed that r10 is callee-saved. It's not. That one dude's PPT about x86-64
+          cdecl that I found on the intertubes was not a trustworthy source of information,
+          apparently.
+        
+        - Call repatching didn't know that the FTL does its IC slow calls via specially
+          generated thunks. This was particularly fun to fix: basically, now when we relink
+          an IC call in the FTL, we use the old call target to find the SlowPathCallKey,
+          which tells us everything we need to know to generate (or look up) a new thunk for
+          the new function we want to call.
+        
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::isEmptyValue):
+        (JSC::MacroAssemblerCodePtr::isDeletedValue):
+        (JSC::MacroAssemblerCodePtr::hash):
+        (JSC::MacroAssemblerCodePtr::emptyValue):
+        (JSC::MacroAssemblerCodePtr::deletedValue):
+        (JSC::MacroAssemblerCodePtrHash::hash):
+        (JSC::MacroAssemblerCodePtrHash::equal):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::RepatchBuffer):
+        (JSC::RepatchBuffer::codeBlock):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::setInstructionCallingConvention):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfGetById):
+        (JSC::FTL::sizeOfPutById):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::forStackmaps):
+        * ftl/FTLLocation.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::compilePutById):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLSlowPathCall.cpp:
+        * ftl/FTLSlowPathCallKey.h:
+        (JSC::FTL::SlowPathCallKey::withCallTarget):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Location::directGPR):
+        (JSC::FTL::StackMaps::Location::restoreInto):
+        * ftl/FTLStackMaps.h:
+        * ftl/FTLThunks.h:
+        (JSC::FTL::generateIfNecessary):
+        (JSC::FTL::keyForThunk):
+        (JSC::FTL::Thunks::keyForSlowPathCallThunk):
+        * jit/FPRInfo.h:
+        (JSC::FPRInfo::toIndex):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toIndex):
+        (JSC::GPRInfo::debugName):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::calleeSaveRegisters):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::filter):
+        * jit/Repatch.cpp:
+        (JSC::readCallTarget):
+        (JSC::repatchCall):
+        (JSC::repatchByIdSelfAccess):
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::lock):
+
+2013-11-10  Oliver Hunt  <oliver@apple.com>
+
+        Implement Set iterators
+        https://bugs.webkit.org/show_bug.cgi?id=124129
+
+        Reviewed by Antti Koivisto.
+
+        Add Set iterator classes and implementations
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSSetIterator.cpp: Added.
+        (JSC::JSSetIterator::finishCreation):
+        (JSC::JSSetIterator::visitChildren):
+        (JSC::JSSetIterator::createPair):
+        * runtime/JSSetIterator.h: Added.
+        (JSC::JSSetIterator::createStructure):
+        (JSC::JSSetIterator::create):
+        (JSC::JSSetIterator::next):
+        (JSC::JSSetIterator::JSSetIterator):
+        * runtime/SetIteratorConstructor.cpp: Added.
+        (JSC::SetIteratorConstructor::finishCreation):
+        * runtime/SetIteratorConstructor.h: Added.
+        (JSC::SetIteratorConstructor::create):
+        (JSC::SetIteratorConstructor::createStructure):
+        (JSC::SetIteratorConstructor::SetIteratorConstructor):
+        * runtime/SetIteratorPrototype.cpp: Added.
+        (JSC::SetIteratorPrototype::finishCreation):
+        (JSC::SetIteratorPrototypeFuncIterator):
+        (JSC::SetIteratorPrototypeFuncNext):
+        * runtime/SetIteratorPrototype.h: Added.
+        (JSC::SetIteratorPrototype::create):
+        (JSC::SetIteratorPrototype::createStructure):
+        (JSC::SetIteratorPrototype::SetIteratorPrototype):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        (JSC::setProtoFuncValues):
+        (JSC::setProtoFuncEntries):
+        (JSC::setProtoFuncKeys):
+
+2013-11-09  Oliver Hunt  <oliver@apple.com>
+
+        Add Map Iterators
+        https://bugs.webkit.org/show_bug.cgi?id=124109
+
+        Reviewed by Andreas Kling.
+
+        Added new Map iterator implementation.  This is a mostly boilerplate patch
+        however there's a a little bit of additional logic added to the MapData iterator
+        to deal with the possibility of map mutation between creation of the iterator
+        and use of it.  We'll be able to improve the performance of this substantially
+        by using intrinsics, however I'm pondering coming up with a better way to define
+        these thunks without requiring so much duplicated logic.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSMapIterator.cpp: Added.
+        (JSC::JSMapIterator::finishCreation):
+        (JSC::JSMapIterator::visitChildren):
+        (JSC::JSMapIterator::createPair):
+        * runtime/JSMapIterator.h: Added.
+        (JSC::JSMapIterator::createStructure):
+        (JSC::JSMapIterator::create):
+        (JSC::JSMapIterator::next):
+        (JSC::JSMapIterator::JSMapIterator):
+        * runtime/MapData.h:
+        (JSC::MapData::const_iterator::ensureSlot):
+        * runtime/MapIteratorConstructor.cpp: Added.
+        (JSC::MapIteratorConstructor::finishCreation):
+        * runtime/MapIteratorConstructor.h: Added.
+        (JSC::MapIteratorConstructor::create):
+        (JSC::MapIteratorConstructor::createStructure):
+        (JSC::MapIteratorConstructor::MapIteratorConstructor):
+        * runtime/MapIteratorPrototype.cpp: Added.
+        (JSC::MapIteratorPrototype::finishCreation):
+        (JSC::MapIteratorPrototypeFuncIterator):
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/MapIteratorPrototype.h: Added.
+        (JSC::MapIteratorPrototype::create):
+        (JSC::MapIteratorPrototype::createStructure):
+        (JSC::MapIteratorPrototype::MapIteratorPrototype):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        (JSC::mapProtoFuncValues):
+        (JSC::mapProtoFuncEntries):
+        (JSC::mapProtoFuncKeys):
+
+2013-11-08  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed GTK build fix.
+
+        * GNUmakefile.list.am: Remove redundant build targets.
+
+2013-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove dead FTL C ABI support
+        https://bugs.webkit.org/show_bug.cgi?id=124100
+
+        Reviewed by Jer Noble.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLCArgumentGetter.cpp: Removed.
+        * ftl/FTLCArgumentGetter.h: Removed.
+        * ftl/FTLOSRExitCompiler.cpp:
+        * jit/FPRInfo.h:
+
+2013-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support Phantom(FinalObject:)
+        https://bugs.webkit.org/show_bug.cgi?id=124092
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::isType):
+        (JSC::FTL::LowerDFGToLLVM::isNotType):
+        (JSC::FTL::LowerDFGToLLVM::speculateFinalObject):
+
+2013-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of the FTL tail call APIs since they are unused
+        https://bugs.webkit.org/show_bug.cgi?id=124093
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildCall):
+        * ftl/FTLOutput.h:
+
+2013-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support AllocatePropertyStorage
+        https://bugs.webkit.org/show_bug.cgi?id=124086
+
+        Reviewed by Oliver Hunt.
+        
+        Also rationalized some offsets in the DFG.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileAllocatePropertyStorage):
+
+2013-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of the bizarre Darwin/x86-only MacroAssembler::shouldBlindForSpecificArch(uintptr_t) overload
+        https://bugs.webkit.org/show_bug.cgi?id=124087
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlindPointerForSpecificArch):
+        (JSC::MacroAssembler::shouldBlind):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
+
+2013-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support NewArrayBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=124067
+
+        Reviewed by Michael Saboff.
+        
+        This expanded coverage and revealed some bugs.
+        
+        This revealed a bug in FTL::OSRExitCompiler where it was assuming that it could save
+        the framePointer in regT3 even though DFG::reifyInlinedCallFrames() would clobber it.
+        It turns out that this can be fixed by just completely restoring the stack prior to
+        doing reifyInlineCallFrames().
+        
+        I used this as an opportunity to simplify NewArray. That revealed a bug; whenever we say
+        lowJSValue() in there we need to use ManualOperandSpeculation since we're using it to
+        rebox values even when we also have to do some speculations. The speculations are done
+        at the top of compileNewArray().
+        
+        This also revealed a bug in StringCharAt() for the OOB case.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        (JSC::FTL::AbstractHeapRepository::forIndexingType):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArray):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArrayBuffer):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+
+2013-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be easy to disable blinding on a per-architecture basis
+        https://bugs.webkit.org/show_bug.cgi?id=124083
+
+        Reviewed by Michael Saboff.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::haveScratchRegisterForBlinding):
+        (JSC::AbstractMacroAssembler::scratchRegisterForBlinding):
+        (JSC::AbstractMacroAssembler::canBlind):
+        (JSC::AbstractMacroAssembler::shouldBlindForSpecificArch):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlind):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::canBlind):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::haveScratchRegisterForBlinding):
+
+2013-11-08  Oliver Hunt  <oliver@apple.com>
+
+        Remove more accidentally added files.
+
+        * runtime/SetIteratorConstructor.cpp: Removed.
+        * runtime/SetIteratorConstructor.h: Removed.
+        * runtime/SetIteratorPrototype.cpp: Removed.
+        * runtime/SetIteratorPrototype.h: Removed.
+
+2013-11-08  Oliver Hunt  <oliver@apple.com>
+
+        Remove accidentally added files.
+
+        * runtime/JSSetIterator.cpp: Removed.
+        * runtime/JSSetIterator.h: Removed.
+
+2013-11-08  Oliver Hunt  <oliver@apple.com>
+
+        Fix minor (unobservable) bug in ArrayIterator::next()
+        https://bugs.webkit.org/show_bug.cgi?id=124061
+
+        Reviewed by Beth Dakin.
+
+        I noticed this while reading the array iterator code.  Due to how
+        ArrayIterator::next() and our enumeration behaviour is implemented
+        this is not actually a code path that can be hit.  But in order to
+        future proof this it should be correct.
+        
+        * runtime/JSArrayIterator.cpp:
+        (JSC::arrayIteratorNext):
+
+2013-11-08  Mark Lam  <mark.lam@apple.com>
+
+        Move breakpoint (and exception break) functionality into JSC::Debugger.
+        https://bugs.webkit.org/show_bug.cgi?id=121796.
+
+        Reviewed by Geoffrey Garen.
+
+        - In ScriptDebugServer and JSC::Debugger, SourceID and BreakpointID are
+          now numeric tokens.
+
+        - JSC::Debugger now tracks user defined breakpoints in a JSC::Breakpoint
+          record. Previously, this info is tracked in the ScriptBreakpoint record
+          in ScriptDebugServer. The only element of ScriptBreakpoint that is not
+          being tracked by JSC::Breakpoint is the ScriptBreakpointAction.
+             The ScriptBreakpointAction is still tracked by the ScriptDebugServer
+          in a list keyed on the corresponding BreakpointID.
+             The ScriptBreakpoint record is now only used as a means of passing
+          breakpoint paramaters to the ScriptDebugServer.
+
+        - ScriptDebugServer now no longer accesses the JSC::CallFrame* directly.
+          It always goes through the DebuggerCallFrame.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Breakpoint.h: Added.
+        (JSC::Breakpoint::Breakpoint):
+        - Breakpoint class to track info for each breakpoint in JSC::Debugger.
+        * debugger/Debugger.cpp:
+        (JSC::DebuggerCallFrameScope::DebuggerCallFrameScope):
+        (JSC::DebuggerCallFrameScope::~DebuggerCallFrameScope):
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::detach):
+        (JSC::Debugger::updateNeedForOpDebugCallbacks):
+        (JSC::Debugger::setBreakpoint):
+        (JSC::Debugger::removeBreakpoint):
+        (JSC::Debugger::hasBreakpoint):
+        (JSC::Debugger::clearBreakpoints):
+        (JSC::Debugger::setBreakpointsActivated):
+        (JSC::Debugger::setPauseOnExceptionsState):
+        (JSC::Debugger::setPauseOnNextStatement):
+        (JSC::Debugger::breakProgram):
+        (JSC::Debugger::continueProgram):
+        (JSC::Debugger::stepIntoStatement):
+        (JSC::Debugger::stepOverStatement):
+        (JSC::Debugger::stepOutOfFunction):
+        (JSC::Debugger::updateCallFrame):
+        (JSC::Debugger::updateCallFrameAndPauseIfNeeded):
+        (JSC::Debugger::pauseIfNeeded):
+        (JSC::Debugger::exception):
+        (JSC::Debugger::atStatement):
+        (JSC::Debugger::callEvent):
+        (JSC::Debugger::returnEvent):
+        (JSC::Debugger::willExecuteProgram):
+        (JSC::Debugger::didExecuteProgram):
+        (JSC::Debugger::didReachBreakpoint):
+        (JSC::Debugger::currentDebuggerCallFrame):
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::sourceID):
+        (JSC::DebuggerCallFrame::sourceIDForCallFrame):
+        * debugger/DebuggerCallFrame.h:
+        * debugger/DebuggerPrimitives.h: Added.
+        - define SourceID, noSourceID, BreakpointID, and noBreakpointID.
+
+2013-11-08  Oliver Hunt  <oliver@apple.com>
+
+        Map.forEach crashes on deleted values
+        https://bugs.webkit.org/show_bug.cgi?id=124017
+
+        Reviewed by Ryosuke Niwa.
+
+        MapData iterator did not consider the case of the first entries
+        being holes.  To fix this I've refactored iteration so that we
+        can perform an initialisation increment on construction, whle
+        retaining the useful assertion in MapData::const_iterator::operator++
+
+        * runtime/MapData.h:
+        (JSC::MapData::const_iterator::operator++):
+        (JSC::MapData::const_iterator::internalIncrement):
+        (JSC::MapData::const_iterator::const_iterator):
+
+2013-11-08  Julien Brianceau  <jbriance@cisco.com>
+
+        REGRESSION(r158883): Fix crashes for ARM architecture.
+        https://bugs.webkit.org/show_bug.cgi?id=124038
+
+        Reviewed by Michael Saboff.
+
+        * jit/GPRInfo.h: Remove r11 from the temporary register set, use a free register for
+        nonPreservedNonReturnGPR and remove obsolete declaration of bucketCounterRegister.
+        (JSC::GPRInfo::toRegister):
+        (JSC::GPRInfo::toIndex):
+        * jit/JITOperations.cpp: Frame pointer register is r11 for ARM_TRADITIONAL and
+        r7 for ARM_THUMB2 instead of r5 since r158883.
+
+2013-11-08  Julien Brianceau  <jbriance@cisco.com>
+
+        REGRESSION(r158883): Fix crashes for MIPS architecture.
+        https://bugs.webkit.org/show_bug.cgi?id=124044
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITOperations.cpp: Frame pointer register is fp instead of s0 since r158883 for MIPS.
+        * jit/ThunkGenerators.cpp: Save and restore the new frame pointer register.
+        (JSC::returnFromJavaScript):
+        (JSC::callToJavaScript):
+
+2013-11-08  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] JavaScript crash in getHostCallReturnValue.
+        https://bugs.webkit.org/show_bug.cgi?id=124040
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITOperations.cpp: Update MSVC assembler code in getHostCallReturnValue according to gcc x86 version.
+
+2013-11-08  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Fix typo (introduced in r158751).
+        https://bugs.webkit.org/show_bug.cgi?id=124033.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::callToJavaScript):
+
+2013-11-08  Julien Brianceau  <jbriance@cisco.com>
+
+        [arm] Use specific PatchableJump implementation for CPU(ARM_TRADITIONAL).
+        https://bugs.webkit.org/show_bug.cgi?id=123891
+
+        Reviewed by Michael Saboff.
+
+        Although patchableBranch32 is implemented in MacroAssemblerARM.h, the used implementation
+        is the generic one in MacroAssembler.h. This patch fixes it and also implements the
+        patchableJump() function for CPU(ARM_TRADITIONAL). These specific implementations are
+        needed for this architecture backend to ensure that these jumps can be relinked.
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::patchableJump):
+        * jit/GPRInfo.h: Remove static_cast that are generating warnings in debug builds.
+        (JSC::GPRInfo::toIndex):
+        (JSC::GPRInfo::debugName):
+
+2013-11-07  Mark Lam  <mark.lam@apple.com>
+
+        Get rid of the regT* definitions in JSInterfaceJIT.h.
+        https://bugs.webkit.org/show_bug.cgi?id=123806.
+
+        Reviewed by Geoffrey Garen.
+
+        JSInterfaceJIT now inherits from GPRInfo and FPRInfo, and relies on them
+        to provide all the register definitions.
+
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toArgumentRegister):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitEnterOptimizationCheck):
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_compareAndJumpSlow):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_compareAndJumpSlow):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlines.h:
+        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):
+        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::JSInterfaceJIT):
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+        * jit/ThunkGenerators.cpp:
+
+2013-11-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support NewArray
+        https://bugs.webkit.org/show_bug.cgi?id=124010
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileNewObject):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArray):
+        (JSC::FTL::LowerDFGToLLVM::allocateCell):
+        (JSC::FTL::LowerDFGToLLVM::allocateObject):
+        (JSC::FTL::LowerDFGToLLVM::allocateBasicStorageAndGetEnd):
+        (JSC::FTL::LowerDFGToLLVM::ArrayValues::ArrayValues):
+        (JSC::FTL::LowerDFGToLLVM::allocateJSArray):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::loadDouble):
+        (JSC::FTL::Output::storeDouble):
+
+2013-11-07  Michael Saboff  <msaboff@apple.com>
+
+        Change CallFrameRegister to architected frame pointer register
+        https://bugs.webkit.org/show_bug.cgi?id=123956
+
+        Reviewed by Geoffrey Garen.
+
+        Changed X86 and ARM variants as well as MIPS to use their respective architected
+        frame pointer registers.  The freed up callFrameRegisteris are made available to 
+        the DFG register allocator.  Modified the FTL OSR exit compiler to use a temporary
+        register as a stand in for the destination callFrameRegister since the FTL frame
+        pointer register is needed to extract values from the FTL stack.
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::addressFor):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toRegister):
+        (JSC::GPRInfo::toIndex):
+        * jit/JITOperations.cpp:
+        * jit/JSInterfaceJIT.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::callToJavaScript):
+        * offlineasm/arm.rb:
+        * offlineasm/arm64.rb:
+        * offlineasm/mips.rb:
+        * offlineasm/x86.rb:
+
+2013-11-07  Oliver Hunt  <oliver@apple.com>
+
+        Reproducible crash when using Map (affects Web Inspector)
+        https://bugs.webkit.org/show_bug.cgi?id=123940
+
+        Reviewed by Geoffrey Garen.
+
+        Trivial fix.  Once again we get bitten by attempting to be clever when
+        growing while adding entries to indexing maps.
+
+        Now we simply do a find(), and then add() _after_ we've ensured there is
+        sufficient space in the MapData list.
+
+        * runtime/MapData.cpp:
+        (JSC::MapData::add):
+
+2013-11-07  Mark Lam  <mark.lam@apple.com>
+
+        Cosmetic: rename xxxId to xxxID for ScriptId, SourceId, and BreakpointId.
+        https://bugs.webkit.org/show_bug.cgi?id=123945.
+
+        Reviewed by Geoffrey Garen.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::sourceID):
+        (JSC::DebuggerCallFrame::sourceIDForCallFrame):
+        * debugger/DebuggerCallFrame.h:
+
+2013-11-07  Michael Saboff  <msaboff@apple.com>
+
+        returnFromJavaScript() for ARM_THUMB2 uses push()s which should be pop()s
+        https://bugs.webkit.org/show_bug.cgi?id=124006
+
+        Rubber stamped by Mark Hahnenberg.
+
+        Changed the push() calls to pop().
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::returnFromJavaScript):
+
+2013-11-07  Michael Saboff  <msaboff@apple.com>
+
+        Remove unneeded moving of ESP to ECX in callToJavaScript for COMPILER(MSVC)
+        https://bugs.webkit.org/show_bug.cgi?id=123998
+
+        Reviewed by Mark Lam.
+
+        Dead code removal.  Passing esp as the first "C" argument to a JavaScript
+        function is no longer needed.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::callToJavaScript):
+
+2013-11-07  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix build for architectures with 4 argument registers (broken since r158820).
+        https://bugs.webkit.org/show_bug.cgi?id=123969
+
+        Reviewed by Andreas Kling.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArguments):
+
+2013-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support CheckFunction
+        https://bugs.webkit.org/show_bug.cgi?id=123862
+
+        Reviewed by Sam Weinig.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckFunction):
+
+2013-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        IC code should handle the call frame register not being the callFrameRegister
+        https://bugs.webkit.org/show_bug.cgi?id=123865
+
+        Reviewed by Geoffrey Garen.
+        
+        For now, in the FTL, the call frame may be something other than our frame pointer,
+        since it's an argument passed in according to whatever convention LLVM picks.
+        
+        This is temporary in two ways - pretty soon the callFrameRegister will be the actual
+        frame pointer and not some other register, and LLVM will not pass the frame pointer
+        as an argument to IC's.
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfGetById):
+        (JSC::FTL::sizeOfPutById):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArguments):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/Repatch.cpp:
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitPutTransitionStub):
+
+2013-11-06  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream Letterpress effect
+        https://bugs.webkit.org/show_bug.cgi?id=123932
+
+        Reviewed by Sam Weinig.
+
+        Add feature define ENABLE_LETTERPRESS disabled by default. We only enable
+        letterpress on iOS.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-11-05  Oliver Hunt  <oliver@apple.com>
+
+        Support iteration of the Arguments object
+        https://bugs.webkit.org/show_bug.cgi?id=123835
+
+        Reviewed by Mark Lam.
+
+        Add an ArgumentsIterator object, and associated classes so that we can support
+        iteration of the arguments object.
+
+        This is a largely mechanical patch.  The only gnarliness is in the
+        logic to avoid reifying the Arguments object in for(... of arguments)
+        scenarios.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEnumeration):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::argumentsFuncIterator):
+        * runtime/Arguments.h:
+        * runtime/ArgumentsIteratorConstructor.cpp: Added.
+        (JSC::ArgumentsIteratorConstructor::finishCreation):
+        * runtime/ArgumentsIteratorConstructor.h: Added.
+        (JSC::ArgumentsIteratorConstructor::create):
+        (JSC::ArgumentsIteratorConstructor::createStructure):
+        (JSC::ArgumentsIteratorConstructor::ArgumentsIteratorConstructor):
+        * runtime/ArgumentsIteratorPrototype.cpp: Added.
+        (JSC::ArgumentsIteratorPrototype::finishCreation):
+        (JSC::argumentsIteratorPrototypeFuncIterator):
+        (JSC::argumentsIteratorPrototypeFuncNext):
+        * runtime/ArgumentsIteratorPrototype.h: Added.
+        (JSC::ArgumentsIteratorPrototype::create):
+        (JSC::ArgumentsIteratorPrototype::createStructure):
+        (JSC::ArgumentsIteratorPrototype::ArgumentsIteratorPrototype):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArgumentsIterator.cpp: Added.
+        (JSC::JSArgumentsIterator::finishCreation):
+        * runtime/JSArgumentsIterator.h: Added.
+        (JSC::JSArgumentsIterator::createStructure):
+        (JSC::JSArgumentsIterator::create):
+        (JSC::JSArgumentsIterator::next):
+        (JSC::JSArgumentsIterator::JSArgumentsIterator):
+        * runtime/JSArrayIterator.cpp:
+        (JSC::createIteratorResult):
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+
+2013-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CheckArray(NonArray) should prove that the child isn't an array
+        https://bugs.webkit.org/show_bug.cgi?id=123911
+        <rdar://problem/15202803>
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::isArrayType):
+
+2013-11-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSExport doesn't support constructors
+        https://bugs.webkit.org/show_bug.cgi?id=123380
+
+        Reviewed by Geoffrey Garen.
+
+        Needed another linked-on-or-after check for when we're deciding whether
+        we should copy over init family methods.
+
+        Factored out the link time checks into a separate function so that they can be cached.
+
+        Factored out the check for init-family method selectors into helper function and changed it to
+        match the description in the clang docs, namely that there can be underscores at the beginning
+        and the first letter after 'init' part of the selector (if there is one) must be a capital letter.
+
+        Updated tests to make sure we don't treat "initialize" as an init-family method and that we do
+        treat "_init" as an init-family method.
+
+        * API/JSWrapperMap.h:
+        * API/JSWrapperMap.mm:
+        (isInitFamilyMethod):
+        (shouldSkipMethodWithName):
+        (copyMethodsToObject):
+        (allocateConstructorForCustomClass):
+        (supportsInitMethodConstructors):
+        * API/tests/testapi.mm:
+        (-[ClassA initialize]):
+        (-[ClassD initialize]):
+
+2013-11-06  Michael Saboff  <msaboff@apple.com>
+
+        Change ctiTrampoline into a thunk
+        https://bugs.webkit.org/show_bug.cgi?id=123844
+
+        Reviewed by Filip Pizlo.
+
+        Converted ctiTrampoline and ctiOpThrowNotCaught into thunks named callToJavaScript
+        and returnFromJavaScript.  Cleaned up and in some cases removed JITStubsXXX.h files
+        after removing ctiTrampoline and ctiOpThrowNotCaught.  Added callJavaScriptJITFunction
+        to VM that is a function pointer to the callToJavaScript thunk.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARM64.h: Removed.
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsMIPS.h: Removed.
+        * jit/JITStubsMSVC64.asm:
+        * jit/JITStubsSH4.h: Removed.
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+        * jit/JSInterfaceJIT.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::returnFromJavaScript):
+        (JSC::callToJavaScript):
+        * jit/ThunkGenerators.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2013-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support StringCharCodeAt
+        https://bugs.webkit.org/show_bug.cgi?id=123854
+
+        Reviewed by Sam Weinig.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):
+
+2013-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support NewObject
+        https://bugs.webkit.org/show_bug.cgi?id=123849
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileNewObject):
+        (JSC::FTL::LowerDFGToLLVM::allocate):
+
+2013-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support StringCharAt
+        https://bugs.webkit.org/show_bug.cgi?id=123855
+
+        Reviewed by Oliver Hunt.
+        
+        This is just like GetByVal for String, so we reuse that code.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
+
+2013-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove old unused code for hypothetical LLVM intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=123824
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLIntrinsicRepository.h:
+
+2013-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support String character access operations
+        https://bugs.webkit.org/show_bug.cgi?id=123783
+
+        Reviewed by Oliver Hunt.
+        
+        Implements:
+        
+        - string.length
+        
+        - string[index]
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+
+2013-11-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        ObjCCallbackFunctionImpl's NSInvocation shouldn't retain its target or arguments
+        https://bugs.webkit.org/show_bug.cgi?id=123822
+
+        Reviewed by Geoffrey Garen.
+
+        Using -retainArguments on ObjCCallbackFunctionImpl's NSInvocation leads to memory leaks.
+        We should handle retaining/releasing the target ourselves, and we should never retain the arguments.
+
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunctionImpl::~ObjCCallbackFunctionImpl):
+        (JSC::ObjCCallbackFunctionImpl::name):
+        (objCCallbackFunctionForInvocation):
+        (objCCallbackFunctionForMethod):
+        (objCCallbackFunctionForBlock):
+
+2013-11-05  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix build for architectures with 4 argument registers (broken since r158681).
+        https://bugs.webkit.org/show_bug.cgi?id=123826
+
+        Reviewed by Michael Saboff.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        (JSC::CCallHelpers::setupArguments):
+
+2013-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix register allocation inside control flow in GetByVal String
+        https://bugs.webkit.org/show_bug.cgi?id=123816
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+
+2013-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove FTL::LowerDFGToLLVM::compileJSConstant()
+        https://bugs.webkit.org/show_bug.cgi?id=123817
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+
+2013-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support PutById
+        https://bugs.webkit.org/show_bug.cgi?id=123784
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::buildCall):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::generateICFastPath):
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::InlineCacheDescriptor::InlineCacheDescriptor):
+        (JSC::FTL::GetByIdDescriptor::GetByIdDescriptor):
+        (JSC::FTL::PutByIdDescriptor::PutByIdDescriptor):
+        (JSC::FTL::PutByIdDescriptor::ecmaMode):
+        (JSC::FTL::PutByIdDescriptor::putKind):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compilePutById):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::call):
+        * ftl/FTLSlowPathCall.cpp:
+        (JSC::FTL::callOperation):
+        * ftl/FTLSlowPathCall.h:
+        * ftl/FTLState.h:
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArguments):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ecmaMode):
+
+2013-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        GetById->GetByOffset and PutById->PutByOffset folding should mark haveStructures since it may result in structure transition watchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=123788
+
+        Reviewed by Geoffrey Garen.
+        
+        haveStructures is true if there are any currentlyKnownStructures that have
+        interesting values, since that's the only time when clobbering needs to do things.
+        It's a really important compile-time optimization. But that also means that anytime
+        we might cause currentlyKnownStructures to get set - like when we might insert some
+        structure transition watchpoints - we need to set haveStructures. We were forgetting
+        to do that for GetById->GetByOffset and PutById->PutByOffset because, I guess, we
+        forgot that those might insert structure transition watchpoints.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+
+2013-11-05  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Make regTx registers match between JSInterfaceJIT and GPRInfo.
+        https://bugs.webkit.org/show_bug.cgi?id=123807
+
+        Reviewed by Mark Lam.
+
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toIndex):
+        * jit/JSInterfaceJIT.h:
+
+2013-11-05  Julien Brianceau  <jbriance@cisco.com>
+
+        REGRESSION(r158315): Fix register mixup in JIT::compileOpCall.
+        https://bugs.webkit.org/show_bug.cgi?id=123799
+
+        Reviewed by Mark Lam.
+
+        Changeset r158315 is crashing architectures where JSInterfaceJIT::regT3 is
+        different from GPRInfo::regT3. This is the case for MIPS architecture.
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2013-11-05  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Fix build for MIPS platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=123796
+
+        Reviewed by Michael Saboff.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::linkCode): Add specific MIPS call to relocateJumps.
+        * assembler/MIPSAssembler.h: Remove executableCopy (because of r157690) and set relocateJumps function public.
+        (JSC::MIPSAssembler::firstRegister):
+        (JSC::MIPSAssembler::lastRegister):
+        (JSC::MIPSAssembler::firstFPRegister):
+        (JSC::MIPSAssembler::lastFPRegister):
+        (JSC::MIPSAssembler::buffer): Needed since r157690.
+        * assembler/MacroAssemblerMIPS.h: Add framePointerRegister.
+        (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch): Remove unused parameter warning.
+
+2013-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249
+        https://bugs.webkit.org/show_bug.cgi?id=123778
+
+        Unreviewed, remove the other such assertion.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2013-11-04  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r158586): plugins/refcount-leaks.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=123765
+
+        We were leaving a hole of one slot above a new frame when pushing the new frame on
+        the stack with pushFrame().  This unused slot can contain residual values that will
+        be marked during GC.
+
+        Reviewed by Filip Pizlo.
+
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::pushFrame):
+
+2013-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        internal-js-tests.yaml/Octane/stress-tests/pdfjs.js.default: ASSERTION FAILED: m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)) at DFGConstantFoldingPhase.cpp:249
+        https://bugs.webkit.org/show_bug.cgi?id=123778
+
+        Reviewed by Geoffrey Garen.
+        
+        This assertion was just wrong: ee do an execute() above the assertion. The assertion
+        is asserting that if we need a watchpoint (i.e. the best proven structure was not the
+        current structure) then it must be the future possible structure.  But while that may
+        have been true before execute(), it won't be true after if the PutById was a
+        transition. Of course, this can only happen in the concurrent JIT in which case the
+        code would be invalidated anyway since we would only transform the code in a way that
+        leveraged the lack of a transition if we inserted a watchpoint, in which case we
+        would realize that the watchpoint had been fired during compilation.
+        
+        Since this requires concurrent JIT awesomeness, I don't know how to test it.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2013-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CheckArray(String) should just be a Phantom(String:)
+        https://bugs.webkit.org/show_bug.cgi?id=123779
+
+        Reviewed by Geoffrey Garen.
+        
+        This should be a speed-up since Phantom(String:) is smart enough to use the string
+        structure. It should also be a simplification since CheckArray(String) was totally
+        redundant.
+        
+        Also FixupPhase was assuming that it may see CheckArray's. That's wrong. It can
+        create CheckArray's but it won't see them as input since no previous phase can
+        create them.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+
+2013-11-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG NewArray/NewArrayBuffer shouldn't be constructing with negative indexing
+        https://bugs.webkit.org/show_bug.cgi?id=123760
+        <rdar://problem/15356705>
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+
+        * dfg/DFGOperations.cpp:
+
+2013-11-04  Michael Saboff  <msaboff@apple.com>
+
+        Eliminate HostCall bit from JSC Stack CallerFrame
+        https://bugs.webkit.org/show_bug.cgi?id=123642
+
+        Reviewed by Geoffrey Garen.
+
+        Replace the HostCallFrame bit or'ed to the CallerFrame value in a CallFrame with
+        a VM entry sentinel CallFrame.  Logically, the VM entry sentinel call frame is
+        pushed on the stack before the callee frame when calling from native to JavaScript
+        code.  The callee frame's CallerFrame points at the VM entry sentinel call frame
+        and the VM entry sentinel call frame's CallerFrame points to the real caller.
+        The VM entry sentinel call frame has a sentinel (1) in the CodeBlock to indicate
+        its a VM entry sentinel call frame.  It's ScopeChain has vm.topCallFrame at the
+        time of the call.  This allows for a complete stack walk as well as walking just
+        the contiguous JS frames.
+
+        The VM entry sentinel call frame and callee frame are currently allocated and
+        initialized in ExecState::init(), but this initialization will be moved to
+        ctiTrampoline when we actually move onto the native stack.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::noticeIncomingCall):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::callerFrame):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::frameExtent):
+        (JSC::ExecState::currentVPC):
+        (JSC::ExecState::setCurrentVPC):
+        (JSC::ExecState::init):
+        (JSC::ExecState::noCaller):
+        (JSC::ExecState::isVMEntrySentinel):
+        (JSC::ExecState::vmEntrySentinelCallerFrame):
+        (JSC::ExecState::initializeVMEntrySentinelFrame):
+        (JSC::ExecState::callerFrameSkippingVMEntrySentinel):
+        (JSC::ExecState::vmEntrySentinelCodeBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::Interpreter::getStackTrace):
+        * interpreter/Interpreter.h:
+        (JSC::TopCallFrameSetter::TopCallFrameSetter):
+        (JSC::TopCallFrameSetter::~TopCallFrameSetter):
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::~JSStack):
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::getStartOfFrame):
+        (JSC::JSStack::pushFrame):
+        (JSC::JSStack::popFrame):
+        * interpreter/Register.h:
+        (JSC::Register::operator=):
+        (JSC::Register::callFrame):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::readFrame):
+        (JSC::StackVisitor::readNonInlinedFrame):
+        (JSC::StackVisitor::readInlinedFrame):
+        (JSC::StackVisitor::Frame::print):
+        * interpreter/VMInspector.cpp:
+        (JSC::VMInspector::countFrames):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JITOperations.cpp:
+        * jit/JITStubsARM.h:
+        (JSC::ctiTrampoline):
+        * jit/JITStubsARM64.h:
+        * jit/JITStubsARMv7.h:
+        (JSC::ctiTrampoline):
+        * jit/JITStubsMIPS.h:
+        * jit/JITStubsMSVC64.asm:
+        * jit/JITStubsSH4.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+        * jsc.cpp:
+        (functionDumpCallFrame):
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::throwException):
+
+2013-11-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSArrayBufferViews of length 0 allocate 0 CopiedSpace bytes, which is invalid
+        https://bugs.webkit.org/show_bug.cgi?id=123746
+
+        Reviewed by Geoffrey Garen.
+
+        This patch disallows clients from allocating 0 bytes in CopiedSpace. We enforce this invariant 
+        with an ASSERT in C++ code and a breakpoint in JIT code. Clients who care about 0-byte 
+        allocations (like JSArrayBufferViews) must handle that case themselves, but we don't punish 
+        anybody else for the rare case that somebody decides to allocate a 0-length typed array. 
+        It also makes the allocation and copying cases consistent for CopiedSpace: no 0-byte allocations, 
+        no 0-byte copying.
+ 
+        Also added a check so that JSArrayBufferViews don't try to copy their m_vector backing store when 
+        their length is 0. Also sprinkled several ASSERTs throughout the JSArrayBufferView code to make sure that 
+        when length is 0 m_vector is null.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::tryAllocate):
+        * runtime/ArrayBuffer.h:
+        (JSC::ArrayBuffer::create):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::::visitChildren):
+        (JSC::::copyBackingStore):
+        (JSC::::slowDownAndWasteMemory):
+
+2013-11-04  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Refactor jumps in baseline JIT to return label after the jump.
+        https://bugs.webkit.org/show_bug.cgi?id=123734
+
+        Reviewed by Michael Saboff.
+
+        Current implementation of jumps in sh4 baseline JIT returns a label on the jump itself
+        and not after it. This is not correct and leads to issues like infinite loop the DFG
+        (https://bugs.webkit.org/show_bug.cgi?id=122597 for instance). This refactor fixes this
+        and also simplifies the link and relink procedures for sh4 jumps.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchDouble):
+        (JSC::MacroAssemblerSH4::branchTrue):
+        (JSC::MacroAssemblerSH4::branchFalse):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::jmp):
+        (JSC::SH4Assembler::extraInstrForBranch):
+        (JSC::SH4Assembler::jne):
+        (JSC::SH4Assembler::je):
+        (JSC::SH4Assembler::bra):
+        (JSC::SH4Assembler::linkJump):
+        (JSC::SH4Assembler::relinkJump):
+
+2013-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Generated color wheel displays incorrectly (regressed in r155567)
+        https://bugs.webkit.org/show_bug.cgi?id=123664
+
+        Reviewed by Andreas Kling.
+
+        Interestingly, r155567 just "un-broke" the attempt to constant-fold ArithMod, but
+        that constant folding was just wrong to begin with. There is no evidence that this
+        constant folding rule is profitable. I'm removing it instead of trying to think
+        about what it means for it to be correct.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+
+2013-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, it is no longer necessary to call DisablePrettyStackTrace.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2013-11-02  Mark Lam  <mark.lam@apple.com>
+
+        Assertion failure in non-JIT'ed LLInt on ARM Thumb.
+        https://bugs.webkit.org/show_bug.cgi?id=97569.
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        - Thumb2 alignment assertions do not apply to the C Loop LLINT because
+          the arguments passed to those assertions are actually OpcodeIDs
+          masquerading as addresses.
+        * llint/LLIntOfflineAsmConfig.h:
+        - Some of the #defines belong in the !ENABLE(LLINT_C_LOOP) section.
+          Moving them there.
+        * llint/LowLevelInterpreter.cpp:
+        - Keep the compiler happy from some unreferenced C Loop labels.
+
+2013-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should use LLVM intrinsics for OSR exit, watchpoints, inline caches, and stack layout
+        https://bugs.webkit.org/show_bug.cgi?id=122318
+
+        Reviewed by Geoffrey Garen.
+        
+        This all now works. This patch just updates our implementation to work with LLVM trunk,
+        and removes all of the old code that tried to do OSR exits and heap accesses without
+        the benefit of those intrinsics.
+        
+        In particular:
+        
+        - StackMaps parsing now uses the new, less compact, but more future-proof, format.
+        
+        - Remove the ftlUsesStackmaps() option and hard-code ftlUsesStackmaps = true. Remove
+          all code for ftlUsesStackmaps = false, since that was only there for back when we
+          didn't have the intrinsics.
+        
+        - Remove the other experimental OSR options (useLLVMOSRExitIntrinsic,
+          ftlTrapsOnOSRExit, and FTLOSRExitOmitsMarshalling).
+        
+        - Remove LowerDFGToLLVM's use of the ExitThunkGenerator since we don't need to generate
+          the exit thunks until after we parse the stackmaps.
+        
+        - Remove all of the exit thunk and compiler code for the no-stackmaps case.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::forStackmaps):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::callStackmap):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        * ftl/FTLOSRExitCompilationInfo.h:
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Location::parse):
+        (JSC::FTL::StackMaps::parse):
+        (WTF::printInternal):
+        * ftl/FTLStackMaps.h:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        * ftl/FTLThunks.h:
+        (JSC::FTL::Thunks::getOSRExitGenerationThunk):
+        * runtime/Options.h:
+
+2013-11-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Add missing getHostCallReturnValue() for MSVC ARM
+        https://bugs.webkit.org/show_bug.cgi?id=123685
+
+        Reviewed by Darin Adler.
+
+        * jit/JITStubsARM.h:
+
+2013-11-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix MSVC warning about unary minus operator
+        https://bugs.webkit.org/show_bug.cgi?id=123674
+
+        Reviewed by Darin Adler.
+
+        Change some static_cast<> to silence the following warning of Microsoft compiler:
+        warning C4146: unary minus operator applied to unsigned type, result still unsigned
+
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStub):
+
+2013-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Disable LLVM's pretty stack traces, which involve intercepting fatal signals
+        https://bugs.webkit.org/show_bug.cgi?id=123681
+
+        Reviewed by Geoffrey Garen.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2013-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        LLVM assertion failures should funnel into WTF's crash handling
+        https://bugs.webkit.org/show_bug.cgi?id=123682
+
+        Reviewed by Geoffrey Garen.
+        
+        Inside llvmForJSC, we override assertion-related functions and funnel them
+        into g_llvmTrapCallback(). We also now register a fatal error handler inside
+        the library and funnel that into g_llvmTrapCallback, and have
+        initializeAndGetJSCLLVMAPI() take such a callback as an argument.
+        
+        Inside JSC, we no longer call LLVMInstallFatalErrorHandler() but instead we
+        pass WTFLogAlwaysAndCrash() as the trap callback for llvmForJSC.
+
+        * llvm/InitializeLLVM.cpp:
+        (JSC::initializeLLVM):
+        * llvm/InitializeLLVMPOSIX.cpp:
+        (JSC::initializeLLVMPOSIX):
+        * llvm/library/LLVMExports.cpp:
+        (llvmCrash):
+        (initializeAndGetJSCLLVMAPI):
+        * llvm/library/LLVMOverrides.cpp:
+        (raise):
+        (__assert_rtn):
+        (abort):
+        * llvm/library/LLVMTrapCallback.h: Added.
+
+2013-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock::jettison() shouldn't call baselineVersion()
+        https://bugs.webkit.org/show_bug.cgi?id=123675
+
+        Reviewed by Geoffrey Garen.
+        
+        Fix more uses of baselineVersion().
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        (JSC::ProfiledCodeBlockJettisoningWatchpoint::fireInternal):
+
+2013-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        LLVM asserts in internal-js-tests.yaml/Octane/stress-tests/mandreel.js
+        https://bugs.webkit.org/show_bug.cgi?id=123535
+
+        Reviewed by Geoffrey Garen.
+        
+        Use double comparisons for doubles.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::doubleToInt32):
+
+2013-11-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Various small WinCE build fixes
+
+        * jsc.cpp:
+        (main):
+
+2013-11-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Fix MSVC ARM build after r157581.
+
+        * jit/JITStubsARM.h:
+
+2013-11-01  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should use a simple optimization pipeline by default
+        https://bugs.webkit.org/show_bug.cgi?id=123638
+
+        Reviewed by Geoffrey Garen.
+        
+        20% speed-up on imagine-gaussian-blur, when combined with --ftlUsesStackmaps=true.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * runtime/Options.h:
+
+2013-11-01  Andreas Kling  <akling@apple.com>
+
+        Neuter WTF_MAKE_FAST_ALLOCATED in GLOBAL_FASTMALLOC_NEW builds.
+        <https://webkit.org/b/123639>
+
+        JSC::ParserArenaRefCounted really needed to have the new/delete
+        operators overridden, in order for JSC::ScopeNode to be able to
+        choose that "operator new" out of the two it inherits.
+
+        Reviewed by Anders Carlsson.
+
+2013-11-01  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR exit profiling should be robust against all code being cleared
+        https://bugs.webkit.org/show_bug.cgi?id=123629
+        <rdar://problem/15365476>
+
+        Reviewed by Michael Saboff.
+        
+        The problem here is two-fold:
+
+        1) A watchpoint (i.e. ProfiledCodeBlockJettisoningWatchpoint) may be fired after we
+        have cleared the CodeBlock for all or some Executables.  This means that doing
+        codeBlock->baselineVersion() would either crash or return a bogus CodeBlock, since
+        there wasn't a baseline code block reachable from the Executable anymore.  The
+        solution is that we shouldn't be asking for the baseline code block reachable from
+        the owning executable (what baselineVersion did), but instead we should be asking
+        for the baseline version reachable from the code block being watchpointed (basically
+        what CodeBlock::alternative() did).
+
+        2) If dealing with inlined code, baselienCodeBlockForOriginAndBaselineCodeBlock()
+        may return null, for the same reason as above - we might have cleared the baseline
+        codeblock for the executable that was inlined.  The solution is to just not do
+        profiling if there isn't a baseline code block anymore.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::baselineAlternative):
+        (JSC::CodeBlock::baselineVersion):
+        (JSC::CodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeBlockJettisoningWatchpoint.cpp:
+        (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        (JSC::ProfiledCodeBlockJettisoningWatchpoint::fireInternal):
+        * dfg/DFGOSRExitBase.cpp:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::AssemblyHelpers):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+
+2013-10-31  Oliver Hunt  <oliver@apple.com>
+
+        JavaScript parser bug
+        https://bugs.webkit.org/show_bug.cgi?id=123506
+
+        Reviewed by Mark Lam.
+
+        Add ParserState as an abstraction and use that to save and restore
+        the parser state around nested functions (We'll need to use this in
+        more places in future).  Also fix a minor error typo this testcases
+        hit.
+
+        * parser/Parser.cpp:
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::Parser::saveState):
+        (JSC::Parser::restoreState):
+
+2013-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL Int32ToDouble should handle the forward type check case where you need a recovery
+        https://bugs.webkit.org/show_bug.cgi?id=123605
+
+        Reviewed by Mark Hahnenberg.
+        
+        If you have a Int32ToDouble that needs to do a type check and it's required to do a
+        forward exit, then it needs to manually pass in a value recovery for itself in the
+        OSR exit - since this is one of those forward-exiting nodes that doesn't have a
+        preceding MovHint.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble):
+        (JSC::FTL::LowerDFGToLLVM::forwardTypeCheck):
+
+2013-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should implement InvalidationPoint in terms of llvm.stackmap
+        https://bugs.webkit.org/show_bug.cgi?id=113647
+
+        Reviewed by Mark Hahnenberg.
+        
+        This is pretty straightforward now that InvalidationPoint has exactly the semantics
+        that agree with llvm.stackmap.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::LowerDFGToLLVM::callStackmap):
+        * ftl/FTLOSRExitCompilationInfo.h:
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+
+2013-10-30  Oliver Hunt  <oliver@apple.com>
+
+        Implement basic ES6 Math functions
+        https://bugs.webkit.org/show_bug.cgi?id=123536
+
+        Reviewed by Michael Saboff.
+
+        Fairly trivial patch to implement the core ES6 Math functions.
+
+        This doesn't implement Math.hypot as it is not a trivial function.
+        I've also skipped Math.sign as I am yet to be convinced the spec
+        behaviour is good.  Everything else is trivial.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        (JSC::mathProtoFuncACosh):
+        (JSC::mathProtoFuncASinh):
+        (JSC::mathProtoFuncATanh):
+        (JSC::mathProtoFuncCbrt):
+        (JSC::mathProtoFuncCosh):
+        (JSC::mathProtoFuncExpm1):
+        (JSC::mathProtoFuncFround):
+        (JSC::mathProtoFuncLog1p):
+        (JSC::mathProtoFuncLog10):
+        (JSC::mathProtoFuncLog2):
+        (JSC::mathProtoFuncSinh):
+        (JSC::mathProtoFuncTanh):
+        (JSC::mathProtoFuncTrunc):
+
+2013-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL::Location::restoreInto() doesn't handle stack-related registers correctly if you're using it after pushing a new stack frame
+        https://bugs.webkit.org/show_bug.cgi?id=123591
+
+        Reviewed by Mark Hahnenberg.
+        
+        This gets us to pass more tests with ftlUsesStackmaps.
+
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::restoreInto):
+        * ftl/FTLLocation.h:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationWithStackMapThunkGenerator):
+
+2013-10-31  Alexey Proskuryakov  <ap@apple.com>
+
+        Enable WebCrypto on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=123587
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig: Do it.
+
+2013-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, really remove CachedTranscendentalFunction.h.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+
+2013-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove CachedTranscendentalFunction because caching math functions is an ugly idea
+        https://bugs.webkit.org/show_bug.cgi?id=123574
+
+        Reviewed by Mark Hahnenberg.
+        
+        This is performance-neutral because I also make Math.cos/sin intrinsic. This means that
+        we gain the "overhead" of actually computing sin and cos but we lose the overhead of
+        going through the native call thunks.
+        
+        Caching transcendental functions is a really ugly idea. It works for SunSpider because
+        that benchmark makes very predictable calls into Math.sin. But I don't believe that this
+        is representative of any kind of reality, and so for sensible uses of Math.sin/cos all
+        that this was doing was adding more call overhead and some hashing overhead.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOperations.h:
+        * runtime/CachedTranscendentalFunction.h: Removed.
+        * runtime/DateInstanceCache.h:
+        * runtime/Intrinsic.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncSin):
+        * runtime/VM.h:
+
+2013-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Assertion failure in js/dom/global-constructors-attributes-dedicated-worker.html
+        https://bugs.webkit.org/show_bug.cgi?id=123551
+        <rdar://problem/15356238>
+
+        Reviewed by Mark Hahnenberg.
+        
+        WatchpointSets have always had this "fire everything on deletion" policy because it
+        seemed like a good fail-safe at the time I first implemented WatchpointSets. But
+        it's actually causing bugs rather than providing safety:
+        
+        - Everyone who registers Watchpoints with WatchpointSets have separate mechanisms
+          for either keeping the WatchpointSets alive or noticing when they are collected.
+          So this wasn't actually providing any safety.
+          
+          One example of this is Structures, where:
+          
+          - CodeBlocks that register Watchpoints on Structure's WatchpointSet will also
+            register weak references to the Structure, and the GC will jettison a CodeBlock
+            if the Structure(s) it cares about dies.
+          
+          - StructureStubInfos that register Watchpoints on Structure's WatchpointSet will
+            also be cleared by GC if the Structures die.
+        
+        - The WatchpointSet destructor would get invoked from finalization/destruction.
+          This would then cause CodeBlock::jettison() to be called on a CodeBlock, but that
+          method requires doing things that access heap objects. This would usually cause
+          problems on VM destruction, since then the CodeBlocks would still be alive but the
+          whole heap would be destroyed.
+        
+        This also ensures that CodeBlock::jettison() cannot cause a GC. This is safe since
+        that method doesn't really allocate objects, and it is likely necessary because
+        jettison() may be called from deep in the stack.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::~WatchpointSet):
+        * bytecode/Watchpoint.h:
+
+2013-10-30  Mark Lam  <mark.lam@apple.com>
+
+        Unreviewed, fix C Loop LLINT build.
+
+        * bytecode/CodeBlockJettisoningWatchpoint.cpp:
+        (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp:
+        (JSC::ProfiledCodeBlockJettisoningWatchpoint::fireInternal):
+
+2013-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix FTL build.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+
+2013-10-30  Alexey Proskuryakov  <ap@apple.com>
+
+        Add a way to fulfill promises from DOM code
+        https://bugs.webkit.org/show_bug.cgi?id=123466
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make JSPromise.h and JSPromiseResolver.h
+        private headers for WebCore to use.
+
+        * runtime/JSPromise.h:
+        * runtime/JSPromiseResolver.h:
+        Export functions that JSDOMPromise will use.
+
+2013-10-30  Mark Lam  <mark.lam@apple.com>
+
+        Adjust CallFrameHeader's ReturnPC and CallFrame locations to match the native ABI .
+        https://bugs.webkit.org/show_bug.cgi?id=123444.
+
+        Reviewed by Geoffrey Garen.
+
+        - Introduced an explicit CallerFrameAndPC struct.
+        - A CallFrame is expected to start with a CallerFrameAndPC struct. 
+        - The Register class no longer supports CallFrame* and Instruction*.
+
+          These hides the differences between JSVALUE32_64 and JSVALUE64 in
+          terms of managing the callerFrame() and returnPC() values.
+
+        - Convert all uses of JSStack::CallerFrame and JSStack::ReturnPC to
+          go through CallFrame to access the appropriate values and offsets.
+          CallFrame, in turn, will access the callerFrame and returnPC via
+          the CallerFrameAndPC struct.
+
+        - InlineCallFrame will provide offsets for its callerFrame and
+          returnPC. It will make use of CallFrame::callerFrameOffset() and
+          CallerFrame::returnPCOffset() to compute these.
+
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::callerFrameOffset):
+        (JSC::InlineCallFrame::returnPCOffset):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::calleeFrameSlot):
+        (JSC::DFG::SpeculativeJIT::calleeArgumentSlot):
+        (JSC::DFG::SpeculativeJIT::calleeFrameTagSlot):
+        (JSC::DFG::SpeculativeJIT::calleeFramePayloadSlot):
+        (JSC::DFG::SpeculativeJIT::calleeArgumentTagSlot):
+        (JSC::DFG::SpeculativeJIT::calleeArgumentPayloadSlot):
+        - Prefixed all the above with callee since they apply to the callee frame.
+        (JSC::DFG::SpeculativeJIT::calleeFrameCallerFrame):
+        - Added to set the callerFrame pointer in the callee frame.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::compileEntry):
+        (JSC::FTL::link):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callerFrame):
+        (JSC::ExecState::callerFrameOffset):
+        (JSC::ExecState::returnPC):
+        (JSC::ExecState::hasReturnPC):
+        (JSC::ExecState::clearReturnPC):
+        (JSC::ExecState::returnPCOffset):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setReturnPC):
+        (JSC::ExecState::callerFrameAndPC):
+        * interpreter/JSStack.h:
+        * interpreter/Register.h:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitPutToCallFrameHeader):
+        - Convert to using storePtr() here and simplify the code.
+        (JSC::AssemblyHelpers::emitGetCallerFrameFromCallFrameHeaderPtr):
+        (JSC::AssemblyHelpers::emitPutCallerFrameToCallFrameHeader):
+        (JSC::AssemblyHelpers::emitGetReturnPCFromCallFrameHeaderPtr):
+        (JSC::AssemblyHelpers::emitPutReturnPCToCallFrameHeader):
+        - Helpers to emit gets/puts of the callerFrame and returnPC.
+        (JSC::AssemblyHelpers::addressForByteOffset):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::compileCallEval):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlines.h:
+        (JSC::JIT::unmap):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_end):
+        * jit/JITOperations.cpp:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::slowPathFor):
+        (JSC::nativeForGenerator):
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        - Updated offsets and asserts to match the new CallFrame layout.
+
+2013-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Mac.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::RegisterAllocationOffset::checkOffsets):
+        (JSC::AbstractMacroAssembler::checkRegisterAllocationAgainstBranchRange):
+
+2013-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Windows.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+
+2013-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Windows.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFrequentExitSite):
+
+2013-10-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Add InvalidationPoints to the DFG and use them for all watchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=123472
+
+        Reviewed by Mark Hahnenberg.
+        
+        This makes a fundamental change to how watchpoints work in the DFG.
+        
+        Previously, a watchpoint was an instruction whose execution semantics were something
+        like:
+        
+            if (watchpoint->invalidated)
+                exit
+        
+        We would implement this without any branch by using jump replacement.
+        
+        This is a very good optimization. But it's a bit awkward once you get a lot of
+        watchpoints: semantically we will have lots of these branches in the code, which the
+        compiler needs to reason about even though they don't actually result in any emitted
+        code.
+        
+        Separately, we also had a mechanism for jettisoning a CodeBlock. This mechanism would
+        be invoked if a CodeBlock exited a lot. It would ensure that a CodeBlock wouldn't be
+        called into again, but it would do nothing for CodeBlocks that were already on the
+        stack.
+        
+        This change flips jettisoning and watchpoint invalidation on their heads. Now, the jump
+        replacement has nothing to do with watchpoints; instead it's something that happens if
+        you ever jettison a CodeBlock. Jump replacement is now an all-or-nothing operation over
+        all of the potential call-return safe-exit-points in a CodeBlock. We call these
+        "InvalidationPoint"s. A watchpoint instruction is now "lowered" by having the DFG
+        collect all of the watchpoint sets that the CodeBlock cares about, and then registering
+        a CodeBlockJettisoningWatchpoint with all of them. That is, if the watchpoint fires, it
+        jettisons the CodeBlock, which in turn ensures that the CodeBlock can't be called into
+        (because the entrypoint now points to baseline code) and can't be returned into
+        (because returning exits to baseline before the next bytecode instruction).
+        
+        This will allow for a sensible lowering of watchpoints to LLVM IR. It will also allow
+        for jettison() to be used effectively for things like breakpointing and single-stepping
+        in the debugger.
+        
+        Well, basically, this mechanism just takes us into the HotSpot-style world where anyone
+        can, at any time and for any reason, request that an optimized CodeBlock is rendered
+        immediately invalid. You can use this for many cool things, I'm sure.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeBlockJettisoningWatchpoint.cpp: Added.
+        (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
+        * bytecode/CodeBlockJettisoningWatchpoint.h: Added.
+        (JSC::CodeBlockJettisoningWatchpoint::CodeBlockJettisoningWatchpoint):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp: Added.
+        (JSC::ProfiledCodeBlockJettisoningWatchpoint::fireInternal):
+        * bytecode/ProfiledCodeBlockJettisoningWatchpoint.h: Added.
+        (JSC::ProfiledCodeBlockJettisoningWatchpoint::ProfiledCodeBlockJettisoningWatchpoint):
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGClobberize.cpp:
+        (JSC::DFG::writesOverlap):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        (JSC::DFG::AbstractHeapOverlaps::AbstractHeapOverlaps):
+        (JSC::DFG::AbstractHeapOverlaps::operator()):
+        (JSC::DFG::AbstractHeapOverlaps::result):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::invalidate):
+        * dfg/DFGCommonData.h:
+        (JSC::DFG::CommonData::CommonData):
+        * dfg/DFGDesiredWatchpoints.cpp:
+        (JSC::DFG::DesiredWatchpoints::addLazily):
+        (JSC::DFG::DesiredWatchpoints::reallyAdd):
+        * dfg/DFGDesiredWatchpoints.h:
+        (JSC::DFG::WatchpointForGenericWatchpointSet::WatchpointForGenericWatchpointSet):
+        (JSC::DFG::GenericDesiredWatchpoints::addLazily):
+        (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
+        (JSC::DFG::GenericDesiredWatchpoints::areStillValid):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGInvalidationPointInjectionPhase.cpp: Added.
+        (JSC::DFG::InvalidationPointInjectionPhase::InvalidationPointInjectionPhase):
+        (JSC::DFG::InvalidationPointInjectionPhase::run):
+        (JSC::DFG::InvalidationPointInjectionPhase::handle):
+        (JSC::DFG::InvalidationPointInjectionPhase::insertInvalidationCheck):
+        (JSC::DFG::performInvalidationPointInjection):
+        * dfg/DFGInvalidationPointInjectionPhase.h: Added.
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGJumpReplacement.cpp: Added.
+        (JSC::DFG::JumpReplacement::fire):
+        * dfg/DFGJumpReplacement.h: Added.
+        (JSC::DFG::JumpReplacement::JumpReplacement):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRExitCompilationInfo.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::reallyAdd):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::masqueradesAsUndefinedWatchpointIsStillValid):
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWatchpointCollectionPhase.cpp: Added.
+        (JSC::DFG::WatchpointCollectionPhase::WatchpointCollectionPhase):
+        (JSC::DFG::WatchpointCollectionPhase::run):
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        (JSC::DFG::WatchpointCollectionPhase::handleEdge):
+        (JSC::DFG::WatchpointCollectionPhase::handleMasqueradesAsUndefined):
+        (JSC::DFG::WatchpointCollectionPhase::handleStringGetByVal):
+        (JSC::DFG::WatchpointCollectionPhase::addLazily):
+        (JSC::DFG::WatchpointCollectionPhase::globalObject):
+        (JSC::DFG::performWatchpointCollection):
+        * dfg/DFGWatchpointCollectionPhase.h: Added.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileStructureTransitionWatchpoint):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileGlobalVarWatchpoint):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEqConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEqConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
+        * jit/JITOperations.cpp:
+        * jit/JumpReplacementWatchpoint.cpp: Removed.
+        * jit/JumpReplacementWatchpoint.h: Removed.
+
+2013-10-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSExport doesn't support constructors
+        https://bugs.webkit.org/show_bug.cgi?id=123380
+
+        Reviewed by Geoffrey Garen.
+
+        Support for constructor-style callbacks for the Objective-C API to JSC is currently limited to 
+        Objective-C blocks. Any clients who try to call the constructor of a JSExport-ed Objective-C class 
+        are met with a type error stating that it cannot be called as a constructor.
+
+        It would be nice to expand JSExport's functionality to support this idiom. It is a natural 
+        extension to JSExport and would increase the expressiveness and simplicity in both Objective-C and 
+        JavaScript client code.
+
+        The way we'll do this is to expand the capabilities of ObjCCallbackFunction and associated classes. 
+        Instead of constructing a normal C API object for the constructor, we'll instead allocate a full-blown 
+        ObjCCallbackFunction object which can already properly handle being invoked as a constructor.
+
+        * API/JSWrapperMap.mm:
+        (copyMethodsToObject):
+        (allocateConstructorForCustomClass):
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
+        (tryUnwrapObjcObject):
+        * API/ObjCCallbackFunction.h:
+        (JSC::ObjCCallbackFunction::impl):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunctionImpl::ObjCCallbackFunctionImpl):
+        (JSC::ObjCCallbackFunctionImpl::wrappedConstructor):
+        (JSC::ObjCCallbackFunctionImpl::isConstructible):
+        (JSC::ObjCCallbackFunction::getConstructData):
+        (JSC::ObjCCallbackFunctionImpl::name):
+        (JSC::ObjCCallbackFunctionImpl::call):
+        (objCCallbackFunctionForInvocation):
+        (objCCallbackFunctionForInit):
+        (tryUnwrapConstructor):
+        * API/tests/testapi.mm:
+        (-[TextXYZ initWithString:]):
+        (-[ClassA initWithA:]):
+        (-[ClassB initWithA:b:]):
+        (-[ClassC initWithA:]):
+        (-[ClassC initWithA:b:]):
+
+2013-10-30  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Compile errors when enabling DFG JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=120998
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added files.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+        * dfg/DFGAllocator.h: Removed scope.
+        * dfg/DFGWorklist.cpp: Use new ThreadingOnce class instead of pthread_once.
+        (JSC::DFG::globalWorklist):
+        * heap/DeferGC.h: Link fix, member needs to be public.
+        * jit/JITOperationWrappers.h: Added required assembler macros.
+
+2013-10-30  Iago Toral Quiroga  <itoral@igalia.com>
+
+        Add result caching for Math.cos
+        https://bugs.webkit.org/show_bug.cgi?id=123255
+
+        Reviewed by Brent Fulgham.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncCos):
+        * runtime/VM.h:
+
+2013-10-30  Alex Christensen  <achristensen@webkit.org>
+
+        Disabled JIT on Win64.
+        https://bugs.webkit.org/show_bug.cgi?id=122472
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        Disabled building JITStubsMSVC64.
+
+2013-10-29  Michael Saboff  <msaboff@apple.com>
+
+        Change local variable register allocation to start at offset -1
+        https://bugs.webkit.org/show_bug.cgi?id=123182
+
+        Reviewed by Geoffrey Garen.
+
+        Adjusted the virtual register mapping down by one slot.  Reduced
+        the CallFrame header slots offsets by one.  They now start at 0.
+        Changed arity fixup to no longer skip passed register slot 0 as this
+        is now part of the CallFrame header.
+
+        * bytecode/VirtualRegister.h:
+        (JSC::operandIsLocal):
+        (JSC::operandIsArgument):
+        (JSC::VirtualRegister::localToOperand):
+        (JSC::VirtualRegister::operandToLocal):
+          Adjusted functions for shift in mapping from local to register offset.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::frameExtent):
+        (JSC::ExecState::offsetFor):
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::executeCall):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+          Adjusted math to accomodate for shift in call frame slots.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::calleeFrameOffset):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::frameExtentInternal):
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::pushFrame):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_slow_path_stack_check):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+          Fixed offset calculation to use VirtualRegister and related calculation instead of
+          doing seperate calculations.
+
+        * interpreter/JSStack.h:
+          Adjusted CallFrame slots down by one.  Did some miscellaneous fixing of dumpRegisters()
+          in the process of testing the fixes.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::arityFixup):
+          Changed arity fixup to no longer skip passed register slot 0 as this
+          is now part of the CallFrame header.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+          Changed arity fixup to no longer skip passed register slot 0 as this
+          is now part of the CallFrame header.  Updated op_enter processing for
+          the change in local registers.
+
+        * runtime/JSGlobalObject.h:
+          Removed the now unneeded extra slot in the global callframe
+
+2013-10-29  Julien Brianceau  <jbriance@cisco.com>
+
+        [arm] Fix lots of crashes because of 4th argument register trampling.
+        https://bugs.webkit.org/show_bug.cgi?id=123421
+
+        Reviewed by Michael Saboff.
+
+        r3 register is the 4th argument register for ARM and also a scratch
+        register in the baseline JIT for this architecture. We can use r6
+        instead, as this used to be the timeoutCheckRegister and it is no
+        longer used since r148119.
+
+        * assembler/ARMAssembler.h: Temp register is now r6 instead of r3 for ARM.
+        * assembler/MacroAssemblerARMv7.h: Temp register is now r6 instead of r3 for ARMv7.
+        * jit/GPRInfo.h: Add r3 properly in GPRInfo for ARM.
+        (JSC::GPRInfo::toRegister):
+        (JSC::GPRInfo::toIndex):
+        * jit/JITStubsARM.h:
+        (JSC::ctiTrampoline): Remove obsolete timeoutCheckRegister init.
+        * jit/JITStubsARMv7.h:
+        (JSC::ctiTrampoline): Remove obsolete timeoutCheckRegister init.
+        * jit/JSInterfaceJIT.h: Remove useless stuff.
+        * yarr/YarrJIT.cpp: Use r3 and not the new scratch register r6.
+        (JSC::Yarr::YarrGenerator::generateEnter): r8 register doesn't need to be saved.
+        (JSC::Yarr::YarrGenerator::generateReturn):
+
+2013-10-29  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix CPU(ARM_TRADITIONAL) build after r157690.
+        https://bugs.webkit.org/show_bug.cgi?id=123247
+
+        Reviewed by Michael Saboff.
+
+        Since r157690, the executableCopy function has been removed from AssemblerBuffer.h
+        and the copy of executable code occurs in the linkCode function (in LinkBuffer.cpp).
+        As the constant pool for jumps is updated in the executableCopy function of ARM_TRADITIONAL,
+        this part of code still needs to be called and absolute jumps must be corrected to anticipate
+        the copy of the executable code through memcpy.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::prepareExecutableCopy): Rename executableCopy to prepareExecutableCopy
+        and correct absolute jump values using the delta between the source and destination buffers.
+        * assembler/ARMAssembler.h:
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::linkCode): Call prepareExecutableCopy just before the memcpy.
+
+2013-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        OSRExit::m_watchpointIndex should be in OSRExitCompilationInfo
+        https://bugs.webkit.org/show_bug.cgi?id=123423
+
+        Reviewed by Mark Hahnenberg.
+        
+        Also enable ExitKind to tell you if it's a watchpoint.
+
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        (JSC::isWatchpoint):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::appendExitInfo):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompilationInfo.h:
+        (JSC::DFG::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2013-10-28  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Parsing support for -webkit-text-decoration-skip: ink
+        https://bugs.webkit.org/show_bug.cgi?id=123358
+
+        Reviewed by Dean Jackson.
+
+        Adding ENABLE(CSS3_TEXT_DECORATION)
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-10-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of InlineStart so that I don't have to implement it in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=123302
+
+        Reviewed by Geoffrey Garen.
+        
+        InlineStart was a special instruction that we would insert at the top of inlined code,
+        so that the backend could capture the OSR state of arguments to an inlined call. It used
+        to be that only the backend had this information, so this instruction was sort of an ugly
+        callback from the backend for filling in some data structures.
+        
+        But in the time since when that code was written (two years ago?), we rationalized how
+        variables work. It's now the case that variables that the runtime must know about are
+        treated specially in IR (they are "flushed") and we know how we will represent them even
+        before we get to the backend. The last place that makes changes to their representation
+        is the StackLayoutPhase.
+        
+        So, this patch gets rid of InlineStart, but keeps around the special meta-data that the
+        instruction had. Instead of handling the bookkeeping in the backend, we handle it in
+        StackLayoutPhase. This means that the DFG and FTL can share code for handling this
+        bookkeeping. This also means that now the FTL can compile code blocks that had inlining.
+        
+        Of course, giving the FTL the ability to handle code blocks that had inlining means that
+        we're going to have new bugs. Sure enough, the FTL's linker didn't handle inline call
+        frames. This patch also fixes that.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+
+2013-10-24  Filip Pizlo  <fpizlo@apple.com>
+
+        The GetById->GetByOffset AI-based optimization should actually do things
+        https://bugs.webkit.org/show_bug.cgi?id=123299
+
+        Reviewed by Oliver Hunt.
+        
+        20% speed-up on Octane/gbemu.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor): Actually finish filling in the Status by setting the state. Previously it would remain set to NoInformation, meaning that this whole method was a no-op.
+
+2013-10-28  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files to compilation.
+
+2013-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Refactor parser rollback logic
+        https://bugs.webkit.org/show_bug.cgi?id=123372
+
+        Reviewed by Brady Eidson.
+
+        Add a sane abstraction for rollbacks in the parser.
+
+        * parser/Parser.cpp:
+        (JSC::::parseSourceElements):
+        (JSC::::parseObjectLiteral):
+        * parser/Parser.h:
+        (JSC::Parser::createSavePoint):
+        (JSC::Parser::restoreSavePoint):
+
+2013-10-25  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Javascript crash with DFG JIT enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=121001
+
+        Reviewed by Geoffrey Garen.
+
+        On windows, using register GPRInfo::regT0 as parameter to e.g. JIT::storeDouble(..., GPRInfo::regT0)),
+        results in a call to JIT::storeDouble(FPRegisterID src, const void* address),
+        where the address parameter gets the value of GPRInfo::regT0, which is 0 (eax on Windows).
+        This causes the register to be written to address 0, hence the crash.
+  
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::storeDouble): Assert if we try to generate code which writes to a null pointer.
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit): Use address in regT0 as parameter.
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator): Ditto.
+
+2013-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Fix a number of problems with destructuring of arguments
+        https://bugs.webkit.org/show_bug.cgi?id=123357
+
+        Reviewed by Filip Pizlo.
+
+        This renames the destructuring node's emitBytecode to bindValue
+        in order to remove the existing confusion over what was happening.
+
+        We then fix an incorrect fall through in the destructuring arguments
+        logic, and fix the then exposed bug where we placed the index rather
+        than value into the bound property.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::DeconstructingAssignmentNode::emitBytecode):
+        (JSC::ArrayPatternNode::bindValue):
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        (JSC::ObjectPatternNode::bindValue):
+        (JSC::BindingNode::bindValue):
+        * parser/Nodes.h:
+
+2013-10-25  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Upstream ENABLE(REMOTE_INSPECTOR) and enable on iOS and Mac
+        https://bugs.webkit.org/show_bug.cgi?id=123111
+
+        Reviewed by Timothy Hatcher.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Fix MSVC again
+
+        * parser/Parser.cpp:
+
+2013-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Fix MSVC
+
+        * parser/Parser.cpp:
+
+2013-10-25  Oliver Hunt  <oliver@apple.com>
+
+        Improve JSC Parser error messages
+        https://bugs.webkit.org/show_bug.cgi?id=123341
+
+        Reviewed by Andreas Kling.
+
+        This patch moves away from the current cludgy mechanisms used to produce
+        error messages and moves to something closer to case by case errors.
+
+        This results in a large change size as previously we may just have
+        'failIfFalse(foo)', but now the logic becomes either
+        'failIfFalseWithMessage(foo, "Cannot do blah with ", foo->thing())'
+        Or alternatively
+
+        if (!foo)
+            check for 'interesting' errors, before falling back to generic error
+
+        This means that this patch is large, but produces no semantic changes, and
+        only hits slow (e.g. error) paths.
+
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        (JSC::::parseSourceElements):
+        (JSC::::parseVarDeclaration):
+        (JSC::::parseConstDeclaration):
+        (JSC::::parseDoWhileStatement):
+        (JSC::::parseWhileStatement):
+        (JSC::::parseVarDeclarationList):
+        (JSC::::createBindingPattern):
+        (JSC::::parseDeconstructionPattern):
+        (JSC::::parseConstDeclarationList):
+        (JSC::::parseForStatement):
+        (JSC::::parseBreakStatement):
+        (JSC::::parseContinueStatement):
+        (JSC::::parseReturnStatement):
+        (JSC::::parseThrowStatement):
+        (JSC::::parseWithStatement):
+        (JSC::::parseSwitchStatement):
+        (JSC::::parseSwitchClauses):
+        (JSC::::parseSwitchDefaultClause):
+        (JSC::::parseTryStatement):
+        (JSC::::parseDebuggerStatement):
+        (JSC::::parseBlockStatement):
+        (JSC::::parseStatement):
+        (JSC::::parseFormalParameters):
+        (JSC::::parseFunctionBody):
+        (JSC::stringForFunctionMode):
+        (JSC::::parseFunctionInfo):
+        (JSC::::parseFunctionDeclaration):
+        (JSC::::parseExpressionOrLabelStatement):
+        (JSC::::parseExpressionStatement):
+        (JSC::::parseIfStatement):
+        (JSC::::parseExpression):
+        (JSC::::parseAssignmentExpression):
+        (JSC::::parseConditionalExpression):
+        (JSC::::parseBinaryExpression):
+        (JSC::::parseProperty):
+        (JSC::::parseObjectLiteral):
+        (JSC::::parseStrictObjectLiteral):
+        (JSC::::parseArrayLiteral):
+        (JSC::::parsePrimaryExpression):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        (JSC::operatorString):
+        (JSC::::parseUnaryExpression):
+        (JSC::::printUnexpectedTokenText):
+        * parser/Parser.h:
+        (JSC::Scope::hasDeclaredVariable):
+        (JSC::Scope::hasDeclaredParameter):
+        (JSC::Parser::hasDeclaredVariable):
+        (JSC::Parser::hasDeclaredParameter):
+        (JSC::Parser::setErrorMessage):
+
+2013-10-24  Mark Rowe  <mrowe@apple.com>
+
+        Remove references to OS X 10.7 from Xcode configuration settings.
+
+        Now that we're not building for OS X 10.7 they're no longer needed.
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2013-10-24  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/15312643> Prepare for the mysterious future.
+
+        Reviewed by David Kilzer.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2013-10-24  Mark Lam  <mark.lam@apple.com>
+
+        Better way to fix part of broken C Loop LLINT build.
+        https://bugs.webkit.org/show_bug.cgi?id=123271.
+
+        Reviewed by Geoffrey Garen.
+
+        Undoing offline asm hackery.
+
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+
+2013-10-24  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken C Loop LLINT build.
+        https://bugs.webkit.org/show_bug.cgi?id=123271.
+
+        Reviewed by Michael Saboff.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus): Added an UNUSED_PARAM().
+        (JSC::CodeBlock::dumpBytecode): Added #if ENABLE(JIT) to JIT only code.
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor): Added an UNUSED_PARAM().
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor): Added an UNUSED_PARAM().
+        * bytecode/StructureStubInfo.h:
+        - Added a stub StubInfoMap for non-JIT builds. StubInfoMap is still used
+          in function prototypes even when !ENABLE(JIT). Rather that adding #if's
+          in many places, we just provide a stub/placeholder implementation that
+          is unused but keeps the compiler happy.
+        * jit/JITOperations.h: Added #if ENABLE(JIT).
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        - The putByVal() macro reifies a slow path which is never taken in one case.
+          This translates into a label that is never used in the C Loop LLINT. The
+          C++ compiler doesn't like unused labels. So, we fix this by adding a
+          cloopUnusedLabel offline asm instruction that synthesizes the following:
+
+              if (false) goto unusedLabel;
+
+          This keeps the C++ compiler happy without changing code behavior.
+        * offlineasm/cloop.rb: Implementing cloopUnusedLabel.
+        * offlineasm/instructions.rb: Declaring cloopUnusedLabel.
+        * runtime/Executable.cpp:
+        (JSC::setupJIT): Added UNUSED_PARAM()s.
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        - run-javascriptcore-tests have phases that forces the LLINT to be off
+          which in turn asserts that the JIT is enabled. With the C Loop LLINT,
+          this combination is illegal. So, we override the setup code here to
+          always use the LLINT if !ENABLE(JIT) regardless of what options are
+          passed in.
+
+2013-10-24  peavo@outlook.com  <peavo@outlook.com>
+
+        Uninitialized member causes crash when DFG JIT is not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=123270
+
+        Reviewed by Brent Fulgham.
+
+        The data member sizeOfLastScratchBuffer in the VM class is only initialized if DFG JIT is enabled, even though it's defined regardless.
+        This causes an early crash on Windows, which doesn't have DFG JIT enabled.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Initialize sizeOfLastScratchBuffer member regardless of whether DFG JIT is enabled.
+
+2013-10-24  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Build break with latest EFL 1.8 libraries.
+        https://bugs.webkit.org/show_bug.cgi?id=123245
+
+        Reviewed by Gyuyoung Kim.
+
+        After fixed build break on EFL 1.8 at r138326, EFL libraries are changed
+        Eo typedef and splitted header files which contain version macro.
+
+        * PlatformEfl.cmake: Added EO path to include directories.
+        * heap/HeapTimer.h: Changed Ecore_Timer typedef when EO exist.
+
+2013-10-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Put all uses of LLVM intrinsics behind a single Option
+        https://bugs.webkit.org/show_bug.cgi?id=123219
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::generateExitThunks):
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * runtime/Options.h:
+
+2013-10-23  Daniel Bates  <dabates@apple.com>
+
+        Fix JavaScriptCore build targets following <http://trac.webkit.org/changeset/157864>
+        (https://bugs.webkit.org/show_bug.cgi?id=123169)
+
+        Tell Xcode that the supported platforms for all JavaScriptCore targets are iOS and OS X.
+
+        * Configurations/Base.xcconfig:
+
+2013-10-23  Michael Saboff  <msaboff@apple.com>
+
+        LLInt arity check exception processing should start unwinding from caller
+        https://bugs.webkit.org/show_bug.cgi?id=123209
+
+        Reviewed by Oliver Hunt.
+
+        Use the caller frame returned from slow_path_call_arityCheck to process exceptions.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-10-22  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should be able to do some simple inline caches using LLVM patchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=123164
+
+        Reviewed by Mark Hahnenberg.
+        
+        This implements GetById inline caches in the FTL using llvm.webkit.patchpoint.
+        
+        The idea is that we ask LLVM for a nop slide the size of a GetById inline
+        cache and then fill in the code after LLVM compilation is complete. For now, we
+        just use the system calling convention for the arguments and return. We also
+        still make some assumptions about registers that aren't correct. But, most of
+        the scaffolding is there and this will successfully patch an inline cache.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::allocate):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::link):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::constNull):
+        (JSC::FTL::buildCall):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLInlineCacheDescriptor.h: Added.
+        (JSC::FTL::InlineCacheDescriptor::InlineCacheDescriptor):
+        (JSC::FTL::GetByIdDescriptor::GetByIdDescriptor):
+        (JSC::FTL::GetByIdDescriptor::stackmapID):
+        (JSC::FTL::GetByIdDescriptor::codeOrigin):
+        (JSC::FTL::GetByIdDescriptor::uid):
+        * ftl/FTLInlineCacheSize.cpp: Added.
+        (JSC::FTL::sizeOfGetById):
+        (JSC::FTL::sizeOfPutById):
+        * ftl/FTLInlineCacheSize.h: Added.
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::directGPR):
+        * ftl/FTLLocation.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::call):
+        * ftl/FTLSlowPathCall.cpp: Added.
+        (JSC::FTL::callOperation):
+        * ftl/FTLSlowPathCall.h: Added.
+        (JSC::FTL::SlowPathCall::SlowPathCall):
+        (JSC::FTL::SlowPathCall::call):
+        (JSC::FTL::SlowPathCall::key):
+        * ftl/FTLSlowPathCallKey.cpp: Added.
+        (JSC::FTL::SlowPathCallKey::dump):
+        * ftl/FTLSlowPathCallKey.h: Added.
+        (JSC::FTL::SlowPathCallKey::SlowPathCallKey):
+        (JSC::FTL::SlowPathCallKey::usedRegisters):
+        (JSC::FTL::SlowPathCallKey::callTarget):
+        (JSC::FTL::SlowPathCallKey::offset):
+        (JSC::FTL::SlowPathCallKey::isEmptyValue):
+        (JSC::FTL::SlowPathCallKey::isDeletedValue):
+        (JSC::FTL::SlowPathCallKey::operator==):
+        (JSC::FTL::SlowPathCallKey::hash):
+        (JSC::FTL::SlowPathCallKeyHash::hash):
+        (JSC::FTL::SlowPathCallKeyHash::equal):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Location::directGPR):
+        * ftl/FTLStackMaps.h:
+        * ftl/FTLState.h:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::slowPathCallThunkGenerator):
+        * ftl/FTLThunks.h:
+        (JSC::FTL::Thunks::getSlowPathCallThunk):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArguments):
+        * jit/GPRInfo.h:
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::garbageStubInfo):
+        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
+        (JSC::JITByIdGenerator::finalize):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITByIdGenerator::slowPathBegin):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::stackRegisters):
+        (JSC::RegisterSet::specialRegisters):
+        (JSC::RegisterSet::calleeSaveRegisters):
+        (JSC::RegisterSet::allGPRs):
+        (JSC::RegisterSet::allFPRs):
+        (JSC::RegisterSet::allRegisters):
+        (JSC::RegisterSet::dump):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::exclude):
+        (JSC::RegisterSet::numberOfSetRegisters):
+        (JSC::RegisterSet::RegisterSet):
+        (JSC::RegisterSet::isEmptyValue):
+        (JSC::RegisterSet::isDeletedValue):
+        (JSC::RegisterSet::operator==):
+        (JSC::RegisterSet::hash):
+        (JSC::RegisterSetHash::hash):
+        (JSC::RegisterSetHash::equal):
+        * runtime/Options.h:
+
+2013-10-22  Filip Pizlo  <fpizlo@apple.com>
+
+        jitCompileAndSetHeuristics should DeferGCForAWhile
+        https://bugs.webkit.org/show_bug.cgi?id=123196
+
+        Reviewed by Mark Hahnenberg.
+        
+        This fixes random crashes in V8v7/raytrace. I only see those crashes on exactly one of
+        my machines. I don't think this is testable; we just need to steadily converge towards
+        getting our uses of DeferGC to be right and then be careful not to regress. We're not
+        there yet, obviously.
+        
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+
+2013-10-23  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream more JavaScriptCore build configuration changes
+        https://bugs.webkit.org/show_bug.cgi?id=123169
+
+        Reviewed by David Kilzer.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/iOS.xcconfig: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2013-10-23  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Export DefaultGCActivityCallback member functions
+        https://bugs.webkit.org/show_bug.cgi?id=123175
+
+        Reviewed by David Kilzer.
+
+        * runtime/GCActivityCallback.h:
+
+2013-10-23  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream more ARMv7s bits
+        https://bugs.webkit.org/show_bug.cgi?id=123052
+
+        Reviewed by Joseph Pecoraro.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2013-10-22  Andreas Kling  <akling@apple.com>
+
+        Minor VM* -> VM& cleanups in HashTable and Keywords.
+        <https://webkit.org/b/123183>
+
+        Turn some VM* variables that will never be null into VM&.
+
+        Reviewed by Geoffrey Garen.
+
+2013-10-22  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: `if (false === (true && undefined)) console.log("wrong!");` logs "wrong!", shouldn't!
+        https://bugs.webkit.org/show_bug.cgi?id=123179
+
+        Reviewed by Mark Hahnenberg.
+
+        * parser/NodeConstructors.h:
+        (JSC::LogicalOpNode::LogicalOpNode):
+        * parser/ResultType.h:
+        (JSC::ResultType::forLogicalOp): Don't assume that && produces a boolean.
+        This is JavaScript (aka Sparta).
+
+2013-10-22  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r157819.
+        http://trac.webkit.org/changeset/157819
+        https://bugs.webkit.org/show_bug.cgi?id=123180
+
+        Broke 32-bit builds (Requested by smfr on #webkit).
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/ToolExecutable.xcconfig:
+
+2013-10-22  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream more ARMv7s bits
+        https://bugs.webkit.org/show_bug.cgi?id=123052
+
+        Reviewed by Joseph Pecoraro.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/ToolExecutable.xcconfig: Enable CLANG_ENABLE_OBJC_ARC for i386 as I'm
+        modifying a file in JavaScriptCore/Configurations.
+
+2013-10-22  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream JSLock changes
+        https://bugs.webkit.org/show_bug.cgi?id=123107
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::dropAllLocks): Modified to take a SpinLock, used only on iOS.
+        (JSC::JSLock::dropAllLocksUnconditionally): Modified to take a SpinLock, used only on iOS. Also
+        use pre-increment instead of post-increment when we're not using the return value of the instruction.
+        (JSC::JSLock::grabAllLocks): Modified to take a SpinLock, used only on iOS. Also change
+        places where we were using post-increment/post-decrement to use pre-increment/pre-decrement,
+        since we don't use the return value of such instructions.
+        (JSC::JSLock::DropAllLocks::DropAllLocks): Modified to support releasing all locks unconditionally.
+        Take a spin lock before releasing all locks on iOS. Also, use nullptr instead of 0.
+        (JSC::JSLock::DropAllLocks::~DropAllLocks): Take a spin lock before acquiring all locks on iOS.
+        * runtime/JSLock.h: Remove extraneous argument name "exec" from DropAllLocks as the data type of
+        the argument is sufficiently descriptive of its purpose.
+
+2013-10-22  Julien Brianceau  <jbriance@cisco.com>
+
+        [arm] Add missing setupArgumentsWithExecState() prototypes to fix build.
+        https://bugs.webkit.org/show_bug.cgi?id=123166
+
+        Reviewed by Michael Saboff.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2013-10-22  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4][mips][arm] Fix crashes in JSC (32-bit only).
+        https://bugs.webkit.org/show_bug.cgi?id=123165
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperationNoExceptionCheck): Add missing EABI_32BIT_DUMMY_ARG.
+        (JSC::JIT::callOperation): The last TrustedImm32(arg3) is a bit overkill for SH4 :)
+        (JSC::JIT::callOperation): Add missing EABI_32BIT_DUMMY_ARG.
+        (JSC::JIT::callOperation): Fix tag and payload order for V_JITOperation_EJJJ prototype.
+
+2013-10-22  Julien Brianceau  <jbriance@cisco.com>
+
+        REGRESSION(r157690, r157699) Fix architectures using AssemblerBufferWithConstantPool.
+        https://bugs.webkit.org/show_bug.cgi?id=123092
+
+        Reviewed by Michael Saboff.
+
+        Impacted architectures are SH4 and ARM_TRADITIONAL.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::buffer):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::flushConstantPool):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::linkCode):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::buffer):
+
+2013-10-22  Julien Brianceau  <jbriance@cisco.com>
+
+        Remove unused stuff in JIT stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=123155
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        (JSC::ctiTrampoline):
+        * jit/JITStubsARM64.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsMIPS.h:
+        * jit/JITStubsSH4.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+
+2013-10-22  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream OS-version-specific install paths for JavaScriptCore.framework
+        https://bugs.webkit.org/show_bug.cgi?id=123115
+        <rdar://problem/13696872>
+
+        Reviewed by Andy Estes.
+
+        Based on a patch by Mark Hahnenberg.
+
+        Add support for running JavaScriptCore-based apps, built against the iOS 7 SDK, on older versions of iOS.
+
+        * API/JSBase.cpp:
+
+2013-10-22  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Add missing lastRegister(), firstFPRegister() and lastFPRegister(). 
+        https://bugs.webkit.org/show_bug.cgi?id=123157
+
+        Reviewed by Andreas Kling.
+
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::lastRegister):
+        (JSC::SH4Assembler::firstFPRegister):
+        (JSC::SH4Assembler::lastFPRegister):
+
+2013-10-22  Brian Holt  <brian.holt@samsung.com>
+
+        Build break on ARMv7 after r157209
+        https://bugs.webkit.org/show_bug.cgi?id=122890
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add framePointerRegister and first/last register helpers for ARM_TRADITIONAL.
+
+        * assembler/ARMAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::firstRegister):
+        (JSC::MacroAssemblerARM::lastRegister):
+        (JSC::MacroAssemblerARM::firstFPRegister):
+        (JSC::MacroAssemblerARM::lastFPRegister):
+
+2013-10-21  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream JSGlobalObject::shouldInterruptScriptBeforeTimeout()
+        https://bugs.webkit.org/show_bug.cgi?id=123045
+
+        Reviewed by Joseph Pecoraro.
+
+        * jsc.cpp: Add function pointer for shouldInterruptScriptBeforeTimeout
+        to global method table.
+        * runtime/JSGlobalObject.cpp: Ditto.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::shouldInterruptScriptBeforeTimeout): Added.
+
+2013-10-21  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream JSC Objective-C API compiler warning fixes
+        https://bugs.webkit.org/show_bug.cgi?id=123125
+
+        Reviewed by Mark Hahnenberg.
+
+        Based on a patch by Mark Hahnenberg.
+
+        * API/JSValue.mm:
+        (-[JSValue toPoint]): Cast to CGFloat to fix some compiler warnings about double narrowing to float.
+        (-[JSValue toSize]): Ditto.
+        * API/tests/testapi.mm: Changed a test that was failing due to overflow of 32-bit NSUInteger on armv7.
+
+2013-10-21  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Mark classes JS{Context, ManagedValue, Value, VirtualMachine} as
+        available since iOS 7.0
+        https://bugs.webkit.org/show_bug.cgi?id=123122
+
+        Reviewed by Dan Bernstein.
+
+        * API/JSContext.h:
+        * API/JSManagedValue.h:
+        * API/JSValue.h:
+        * API/JSVirtualMachine.h:
+
+2013-10-20  Mark Lam  <mark.lam@apple.com>
+
+        Avoid JSC debugger overhead unless needed.
+        https://bugs.webkit.org/show_bug.cgi?id=123084.
+
+        Reviewed by Geoffrey Garen.
+
+        - If no breakpoints are set, we now avoid calling the debug hook callbacks.
+        - If no break on exception is set, we also avoid exception event debug callbacks.
+        - When we return from the ScriptDebugServer to the JSC::Debugger, we may no
+          longer call the debug hook callbacks if not needed. Hence, the m_currentCallFrame
+          pointer in the ScriptDebugServer may become stale. To avoid this issue, before
+          returning, the ScriptDebugServer will clear its m_currentCallFrame if
+          needsOpDebugCallbacks() is false.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::setNeedsExceptionCallbacks):
+        (JSC::Debugger::setShouldPause):
+        (JSC::Debugger::updateNumberOfBreakpoints):
+        (JSC::Debugger::updateNeedForOpDebugCallbacks):
+        * debugger/Debugger.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwind):
+        (JSC::Interpreter::debug):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_debug):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_debug):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LowLevelInterpreter.asm:
+
+2013-10-21  Brent Fulgham  <bfulgham@apple.com>
+
+        [WIN] Unreviewed build correction.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Handle new JIT files as C++ implementation
+          sources, not header files.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+
+2013-10-21  Oliver Hunt  <oliver@apple.com>
+
+        Support computed property names in object literals
+        https://bugs.webkit.org/show_bug.cgi?id=123112
+
+        Reviewed by Michael Saboff.
+
+        Add support for computed property names to the parser.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::getName):
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode):
+        * parser/Nodes.h:
+        (JSC::PropertyNode::expressionName):
+        (JSC::PropertyNode::name):
+        * parser/Parser.cpp:
+        (JSC::::parseProperty):
+        (JSC::::parseStrictObjectLiteral):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::Property::Property):
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2013-10-21  Michael Saboff  <msaboff@apple.com>
+
+        Add option so that JSC will crash if it can't allocate executable memory for the JITs
+        https://bugs.webkit.org/show_bug.cgi?id=123048
+        <rdar://problem/12856193>
+
+        Reviewed by Geoffrey Garen.
+
+        Added new option, called crashIfCantAllocateJITMemory. If this option is true then we crash
+        when checking the validity of the executable allocator. The default value for this option is
+        false, but jsc sets it to true when built for iOS to make it straightforward to identify whether
+        the app can obtain executable memory.
+
+        * jsc.cpp: Explicitly enable crashIfCantAllocateJITMemory on iOS.
+        (main):
+        * runtime/Options.h: Added option crashIfCantAllocateJITMemory.
+        * runtime/VM.cpp:
+        (JSC::enableAssembler): Modified to crash if option crashIfCantAllocateJITMemory
+        is enabled.
+
+2013-10-21  Nadav Rotem  <nrotem@apple.com>
+
+        Remove AllInOneFile.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=123055
+
+        Reviewed by Csaba Osztrogonác.
+
+        * AllInOneFile.cpp: Removed.
+
+2013-10-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, cleanup a FIXME comment.
+
+        * jit/Repatch.cpp:
+
+2013-10-20  Filip Pizlo  <fpizlo@apple.com>
+
+        StructureStubInfo's usedRegisters set should be able to track all registers, not just the ones that our JIT's view as temporaries
+        https://bugs.webkit.org/show_bug.cgi?id=123076
+
+        Reviewed by Sam Weinig.
+        
+        Start preparing for a world in which we are patching code generated by LLVM, which may have
+        very different register usage conventions than our JITs. This requires us being more explicit
+        about the registers we are using. For example, the repatching code shouldn't take for granted
+        that tagMaskRegister holds the TagMask or that the register is even in use.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::numberOfRegisters):
+        (JSC::MacroAssembler::registerIndex):
+        (JSC::MacroAssembler::numberOfFPRegisters):
+        (JSC::MacroAssembler::fpRegisterIndex):
+        (JSC::MacroAssembler::totalNumberOfRegisters):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::usedRegisters):
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLSaveRestore.cpp:
+        (JSC::FTL::bytesForGPRs):
+        (JSC::FTL::bytesForFPRs):
+        (JSC::FTL::offsetOfGPR):
+        (JSC::FTL::offsetOfFPR):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/RegisterSet.cpp: Added.
+        (JSC::RegisterSet::specialRegisters):
+        * jit/RegisterSet.h: Added.
+        (JSC::RegisterSet::RegisterSet):
+        (JSC::RegisterSet::set):
+        (JSC::RegisterSet::clear):
+        (JSC::RegisterSet::get):
+        (JSC::RegisterSet::merge):
+        * jit/Repatch.cpp:
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitPutReplaceStub):
+        (JSC::tryRepatchIn):
+        (JSC::linkClosureCall):
+        * jit/TempRegisterSet.cpp: Added.
+        (JSC::TempRegisterSet::TempRegisterSet):
+        * jit/TempRegisterSet.h:
+
+2013-10-20  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Fix build (broken since r157690).
+        https://bugs.webkit.org/show_bug.cgi?id=123081
+
+        Reviewed by Andreas Kling.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::buffer):
+        (JSC::SH4Assembler::readCallTarget):
+
+2013-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Simplify TempRegisterSet - it no longer needs to be convertible to a POD since it's no longer going to be a member of a union
+        https://bugs.webkit.org/show_bug.cgi?id=123079
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/TempRegisterSet.h:
+
+2013-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename RegisterSet to TempRegisterSet
+        https://bugs.webkit.org/show_bug.cgi?id=123077
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::usedRegisters):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/RegisterSet.h: Removed.
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        * jit/TempRegisterSet.h: Copied from Source/JavaScriptCore/jit/RegisterSet.h.
+        (JSC::TempRegisterSet::TempRegisterSet):
+        (JSC::TempRegisterSet::asPOD):
+        (JSC::TempRegisterSet::copyInfo):
+
+2013-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Restructure LinkBuffer to allow for alternate allocation strategies
+        https://bugs.webkit.org/show_bug.cgi?id=123071
+
+        Reviewed by Oliver Hunt.
+        
+        The idea is to eventually allow a LinkBuffer to place the code into an already
+        allocated region of memory.  That region of memory could be the nop-slide left behind
+        by a llvm.webkit.patchpoint.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::buffer):
+        * assembler/AssemblerBuffer.h:
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::allocate):
+        (JSC::LinkBuffer::shrink):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::didFailToAllocate):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::buffer):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+
+2013-10-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Some includes in JSC seem to use an incorrect style
+        https://bugs.webkit.org/show_bug.cgi?id=123057
+
+        Reviewed by Geoffrey Garen.
+
+        Changed pseudo-system includes to user ones.
+
+        * API/JSContextRef.cpp:
+        * API/JSStringRefCF.cpp:
+        * API/JSValueRef.cpp:
+        * API/OpaqueJSString.cpp:
+        * jit/JIT.h:
+        * parser/SyntaxChecker.h:
+        * runtime/WeakGCMap.h:
+
+2013-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT and DFG IC code generation should be unified and rationalized
+        https://bugs.webkit.org/show_bug.cgi?id=122939
+
+        Reviewed by Geoffrey Garen.
+        
+        Introduce the JITInlineCacheGenerator, which takes a CodeBlock and a CodeOrigin plus
+        some register info and creates JIT inline caches for you. Used this to even furhter
+        unify the baseline and DFG ICs. In the future we can use this for FTL ICs. And my hope
+        is that we'll be able to use it for cascading ICs: an IC for some instruction may realize
+        that it needs to do the equivalent of get_by_id, so with this generator it will be able
+        to create an IC even though it wasn't associated with a get_by_id bytecode instruction.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::DataLabelCompact::label):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ecmaMode):
+        * dfg/DFGInlineCacheWrapper.h: Added.
+        (JSC::DFG::InlineCacheWrapper::InlineCacheWrapper):
+        * dfg/DFGInlineCacheWrapperInlines.h: Added.
+        (JSC::DFG::::finalize):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addGetById):
+        (JSC::DFG::JITCompiler::addPutById):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::isStrictModeFor):
+        (JSC::AssemblyHelpers::strictModeFor):
+        * jit/GPRInfo.h:
+        (JSC::JSValueRegs::tagGPR):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITInlineCacheGenerator.cpp: Added.
+        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITByIdGenerator::finalize):
+        (JSC::JITByIdGenerator::generateFastPathChecks):
+        (JSC::JITGetByIdGenerator::generateFastPath):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        (JSC::JITPutByIdGenerator::generateFastPath):
+        (JSC::JITPutByIdGenerator::slowPathFunction):
+        * jit/JITInlineCacheGenerator.h: Added.
+        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
+        (JSC::JITInlineCacheGenerator::stubInfo):
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITByIdGenerator::reportSlowPathCall):
+        (JSC::JITByIdGenerator::slowPathJump):
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::set):
+
+2013-10-19  Alexey Proskuryakov  <ap@apple.com>
+
+        APICast.h uses functions from JSCJSValueInlines.h, but doesn't include it
+        https://bugs.webkit.org/show_bug.cgi?id=123067
+
+        Reviewed by Geoffrey Garen.
+
+        * API/APICast.h: Include it.
+
+2013-10-19  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL::Location should treat the offset as an addend in the case of a Register location
+        https://bugs.webkit.org/show_bug.cgi?id=123062
+
+        Reviewed by Sam Weinig.
+
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::forStackmaps):
+        (JSC::FTL::Location::dump):
+        (JSC::FTL::Location::restoreInto):
+        * ftl/FTLLocation.h:
+        (JSC::FTL::Location::forRegister):
+        (JSC::FTL::Location::hasAddend):
+        (JSC::FTL::Location::addend):
+
+2013-10-19  Nadav Rotem  <nrotem@apple.com>
+
+        DFG dominators: document and rename stuff.
+        https://bugs.webkit.org/show_bug.cgi?id=123056
+
+        Reviewed by Filip Pizlo.
+
+        Documented the code and renamed some variables.
+
+        * dfg/DFGDominators.cpp:
+        (JSC::DFG::Dominators::compute):
+        (JSC::DFG::Dominators::pruneDominators):
+        * dfg/DFGDominators.h:
+
+2013-10-19  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix build failure for architectures with 4 argument registers.
+        https://bugs.webkit.org/show_bug.cgi?id=123060
+
+        Reviewed by Michael Saboff.
+
+        Add missing setupArgumentsWithExecState() prototypes for architecture with 4 argument registers.
+        Remove SH4 specific code no longer needed since callOperation prototype change in r157660.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+
+2013-10-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix FTL build.
+
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+
+2013-10-18  Filip Pizlo  <fpizlo@apple.com>
+
+        A CodeBlock's StructureStubInfos shouldn't be in a Vector that we search using code origins and machine code PCs
+        https://bugs.webkit.org/show_bug.cgi?id=122940
+
+        Reviewed by Oliver Hunt.
+        
+        This accomplishes a number of simplifications. StructureStubInfo is now non-moving,
+        whereas previously it was in a Vector, so it moved. This allows you to use pointers to
+        StructureStubInfo. This also eliminates the use of return PC as a way of finding the
+        StructureStubInfo's. It removes some of the need for the compile-time property access
+        records; for example the DFG no longer has to save information about registers in a
+        property access record only to later save it to the stub info.
+        
+        The main thing is accomplishes is that it makes it easier to add StructureStubInfo's
+        at any stage of compilation.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::addStubInfo):
+        (JSC::CodeBlock::getStubInfoMap):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::begin):
+        (JSC::CodeBlock::end):
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::CodeOrigin):
+        (JSC::CodeOrigin::isHashTableDeletedValue):
+        (JSC::CodeOrigin::hash):
+        (JSC::CodeOriginHash::hash):
+        (JSC::CodeOriginHash::equal):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        * bytecode/StructureStubInfo.h:
+        (JSC::getStructureStubInfoCodeOrigin):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+        (JSC::DFG::InRecord::InRecord):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.cpp:
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::PropertyStubCompilationInfo::slowCaseInfo):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/Repatch.cpp:
+        (JSC::appropriateGenericPutByIdFunction):
+        (JSC::appropriateListBuildingPutByIdFunction):
+        (JSC::resetPutByID):
+
+2013-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Spread operator should be performing direct "puts" and not triggering setters
+        https://bugs.webkit.org/show_bug.cgi?id=123047
+
+        Reviewed by Geoffrey Garen.
+
+        Add a new opcode -- op_put_by_val_directue -- and make use of it in the spread
+        to array construct.  This required a new PutByValDirect node to be introduced to
+        the DFG.  The current implementation simply changes the slow path function that
+        is called, but in future this could be made faster as it does not need to check
+        the prototype chain.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDirectPutByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getArrayLengthElimination):
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArrayMode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        (JSC::DFG::operationPutByValInternal):
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::compileDirectPutByVal):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2013-10-18  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Export symbol for VM::sharedInstanceExists()
+        https://bugs.webkit.org/show_bug.cgi?id=123046
+
+        Reviewed by Mark Hahnenberg.
+
+        * runtime/VM.h:
+
+2013-10-18  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream WebSafe{GCActivityCallback, IncrementalSweeper}IOS
+        https://bugs.webkit.org/show_bug.cgi?id=123049
+
+        Reviewed by Mark Hahnenberg.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::setIncrementalSweeper):
+        * heap/Heap.h:
+        * heap/HeapTimer.h:
+        * heap/IncrementalSweeper.h: Make protected and export CF-variant of constructor.
+        Removed unused include of header RetainPtr.h. Also forward declare class MarkedBlock
+        (we include its header in the .cpp file) and remove include for header wtf/HashSet.h
+        (duplicates the include in the .cpp).
+        * heap/MachineStackMarker.h: Export function makeUsableFromMultipleThreads(). We aren't
+        making use of this now, but we'll make use of it in a subsequent patch.
+
+2013-10-18  Anders Carlsson  <andersca@apple.com>
+
+        Remove spaces between template angle brackets
+        https://bugs.webkit.org/show_bug.cgi?id=123040
+
+        Reviewed by Andreas Kling.
+
+        * API/JSCallbackObject.cpp:
+        (JSC::::create):
+        * API/JSObjectRef.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::constants):
+        (JSC::CodeBlock::setConstantRegisters):
+        * bytecode/DFGExitProfile.h:
+        * bytecode/EvalCodeCache.h:
+        * bytecode/Operands.h:
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::constantRegisters):
+        * bytecode/Watchpoint.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/StaticPropertyAnalysis.h:
+        * bytecompiler/StaticPropertyAnalyzer.h:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        * dfg/DFGBlockInsertionSet.h:
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::performCSE):
+        (JSC::DFG::performStoreElimination):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGDesiredStructureChains.h:
+        * dfg/DFGDesiredWatchpoints.h:
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGWorklist.h:
+        * heap/BlockAllocator.h:
+        (JSC::CopiedBlock):
+        (JSC::MarkedBlock):
+        (JSC::WeakBlock):
+        (JSC::MarkStackSegment):
+        (JSC::CopyWorkListSegment):
+        (JSC::HandleBlock):
+        * heap/Heap.h:
+        * heap/Local.h:
+        * heap/MarkedBlock.h:
+        * heap/Strong.h:
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::decodedCodeMapFor):
+        * jit/AssemblyHelpers.h:
+        * jit/SpecializedThunkJIT.h:
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::::parseIfStatement):
+        * parser/Parser.h:
+        (JSC::Scope::copyCapturedVariablesToVector):
+        (JSC::parse):
+        * parser/ParserArena.h:
+        * parser/SourceProviderCacheItem.h:
+        * profiler/LegacyProfiler.cpp:
+        (JSC::dispatchFunctionToProfiles):
+        * profiler/LegacyProfiler.h:
+        (JSC::LegacyProfiler::currentProfiles):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::children):
+        * profiler/ProfilerDatabase.h:
+        * runtime/Butterfly.h:
+        (JSC::Butterfly::contiguousInt32):
+        (JSC::Butterfly::contiguous):
+        * runtime/GenericTypedArrayViewInlines.h:
+        (JSC::::create):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/JSPromise.h:
+        * runtime/PropertyMapHashTable.h:
+        * runtime/PropertyNameArray.h:
+        * runtime/RegExpCache.h:
+        * runtime/SparseArrayValueMap.h:
+        * runtime/SymbolTable.h:
+        * runtime/VM.h:
+        * tools/CodeProfile.cpp:
+        (JSC::truncateTrace):
+        * tools/CodeProfile.h:
+        * yarr/YarrInterpreter.cpp:
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
+        (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
+        (JSC::Yarr::YarrGenerator::opCompileBody):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
+        (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
+        * yarr/YarrPattern.h:
+
+2013-10-18  Mark Lam  <mark.lam@apple.com>
+
+        Remove excess reserved space in ctiTrampoline frames for X86 and X86_64.
+        https://bugs.webkit.org/show_bug.cgi?id=123037.
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITStubsMSVC64.asm:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+
+2013-10-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Frequent RELEASE_ASSERT crashes in Structure::checkOffsetConsistency on WebGL swizzler tests
+        https://bugs.webkit.org/show_bug.cgi?id=121661
+
+        Reviewed by Mark Hahnenberg.
+        
+        This method shouldn't have been called from the concurrent JIT thread. That's hard to prevent
+        so I added a return-early check using isCompilationThread().
+        
+        Here's why this makes sense. Structure has two ways to tell you about the layout of the objects
+        it is describing: m_offset and the property table. Most structures only have m_offset and report
+        null for the property table. If the property table is there, it will tell you additional
+        information and that information subsumes m_offset - but the m_offset is still there. So, when
+        we have a property table, we have to keep it in sync with the m_offset. There is a bunch of
+        machinery to do this.
+        
+        Changing the property table only happens on the main thread.
+        
+        Because the machinery to change the property table is so complex, especially with respect to
+        keeping it in sync with m_offset, we have the checkOffsetConsistency method. It's meant to be
+        called at key points before and after changes to the property table or the offset.
+
+        Most clients of Structure who care about object layout, including the concurrent thread, will
+        want to know m_offset and not the property table. If they want the property table, they will
+        already be super careful. The concurrent thread has special methods for this, like
+        Structure::getConcurrently(), which uses fine-grained locking to ensure that it sees a coherent
+        view of the property table.
+        
+        Adding locking to checkOffsetConsistency() is probably a bad idea since that method may be
+        called when the relevant lock is already held. So, we'd have awkward recursive locking issues.
+        
+        But right now, the concurrent JIT thread may call a method, like Structure::outOfLineCapacity(),
+        which has a call to checkOffsetConsistency(). The call to checkOffsetConsistency() is there
+        because we have found that it helps quickly identify situations where the property table and
+        m_offset get out of sync - mainly because code that changes either of those things will usually
+        also want to know the outOfLineCapacity(). But Structure::outOfLineCapacity() doesn't *actually*
+        need the property table; it uses the m_offset. The concurrent JIT is correct to call
+        outOfLineCapacity(), and is right to do so without holding any locks (since in all cases where
+        it calls outOfLineCapacity() it has already proven that m_offset is immutable). But because
+        outOfLineCapacity() calls checkOffsetConsistency(), and checkOffsetConsistency() doesn't grab
+        locks, and that same structure is having its property table modified by the main thread, we end
+        up with these spurious assertion failures. FWIW, the structure isn't *actually* having *its*
+        property table modified - instead what happens is that some downstream structure steals the
+        property table and then starts adding things to it. The concurrent thread loads the property
+        table before it's stolen, and hence the badness.
+        
+        I suspect there are other code paths that lead to the concurrent JIT calling some Structure
+        method that it is fine and safe to call, but then that method calls checkOffsetConsistency(),
+        and then you have a possible crash.
+        
+        The most sensible solution to this appears to be to make sure that checkOffsetConsistency() is
+        aware of its uselessness to the concurrent JIT thread. This change makes it return early if
+        it's in the concurrent JIT.
+        
+        * runtime/StructureInlines.h:
+        (JSC::Structure::checkOffsetConsistency):
+
+2013-10-18  Daniel Bates  <dabates@apple.com>
+
+        Add SPI to disable the garbage collector timer
+        https://bugs.webkit.org/show_bug.cgi?id=122921
+
+        Add null check to Heap::setGarbageCollectionTimerEnabled() that I inadvertently
+        omitted.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::setGarbageCollectionTimerEnabled):
+
+2013-10-18  Julien Brianceau  <jbriance@cisco.com>
+
+        Group 64-bit specific and 32-bit specific callOperation implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=123024
+
+        Reviewed by Michael Saboff.
+
+        This is not a big deal, but could be less confusing when reading the code.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        (JSC::JIT::callOperationWithCallFrameRollbackOnException):
+        (JSC::JIT::callOperationNoExceptionCheck):
+
+2013-10-18  Nadav Rotem  <nrotem@apple.com>
+
+        Fix a FlushLiveness problem.
+        https://bugs.webkit.org/show_bug.cgi?id=122984
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp:
+        (JSC::DFG::FlushLivenessAnalysisPhase::process):
+
+2013-10-18  Michael Saboff  <msaboff@apple.com>
+
+        Change native function call stubs to use JIT operations instead of ctiVMHandleException
+        https://bugs.webkit.org/show_bug.cgi?id=122982
+
+        Reviewed by Geoffrey Garen.
+
+        Change ctiVMHandleException to operationVMHandleException.  Change all exception operations to
+        return the catch callFrame and entryPC via vm.callFrameForThrow and vm.targetMachinePCForThrow.
+        This removed calling convention headaches, fixing https://bugs.webkit.org/show_bug.cgi?id=122980
+        in the process.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JIT.h:
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITExceptions.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperationNoExceptionCheck):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_throw):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARM64.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsMIPS.h:
+        * jit/JITStubsMSVC64.asm:
+        * jit/JITStubsSH4.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+        * jit/Repatch.cpp:
+        (JSC::tryBuildGetByIDList):
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::nativeForGenerator):
+        * runtime/VM.h:
+        (JSC::VM::callFrameForThrowOffset):
+        (JSC::VM::targetMachinePCForThrowOffset):
+
+2013-10-18  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix J_JITOperation_EAapJ call for MIPS and ARM EABI.
+        https://bugs.webkit.org/show_bug.cgi?id=123023
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation): EncodedJSValue parameter do not need alignment
+        using EABI_32BIT_DUMMY_ARG here.
+
+2013-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, another ARM64 build fix.
+        
+        Get rid of andPtr(TrustedImmPtr, blah), since it would take Effort to get it to work
+        on ARM64 and none of its uses are legit - they should all be using
+        andPtr(TrustedImm32, blah) anyway.
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM64.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileExceptionHandlers):
+
+2013-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, speculative ARM64 build fix.
+        
+        move(ImmPtr, blah) is only available in MacroAssembler since that's where blinding is
+        implemented. So, you have to use TrustedImmPtr in the superclasses.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::store8):
+        (JSC::MacroAssemblerARM64::branchTest8):
+
+2013-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, speculative ARM build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=122890
+        <rdar://problem/15258624>
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::firstRegister):
+        (JSC::ARM64Assembler::lastRegister):
+        (JSC::ARM64Assembler::firstFPRegister):
+        (JSC::ARM64Assembler::lastFPRegister):
+        * assembler/MacroAssemblerARM64.h:
+        * assembler/MacroAssemblerARMv7.h:
+
+2013-10-17  Andreas Kling  <akling@apple.com>
+
+        Pass VM instead of JSGlobalObject to JSONObject constructor.
+        <https://webkit.org/b/122999>
+
+        JSONObject was only use the JSGlobalObject to grab at the VM.
+        Dodge a few loads by passing the VM directly instead.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::JSONObject):
+        (JSC::JSONObject::finishCreation):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+
+2013-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed the JITStackFrame struct
+        https://bugs.webkit.org/show_bug.cgi?id=123001
+
+        Reviewed by Anders Carlsson.
+
+        * jit/JITStubs.h: JITStackFrame and JITStubArg are unused now, since all
+        our helper functions obey the C function call ABI.
+
+2013-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed an unused #define
+        https://bugs.webkit.org/show_bug.cgi?id=123000
+
+        Reviewed by Anders Carlsson.
+
+        * jit/JITStubs.h: Removed the concept of JITSTACKFRAME_ARGS_INDEX,
+        since it is unused now. This is a step toward using the C stack.
+
+2013-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Eliminate uses of JITSTACKFRAME_ARGS_INDEX as scratch area for thunks
+        https://bugs.webkit.org/show_bug.cgi?id=122973
+
+        Reviewed by Michael Saboff.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromCallSlowPathGenerator): This was all dead code,
+        so I removed it.
+
+        The code acted as if it needed to pass an argument to
+        lookupExceptionHandler, and as if it passed that argument to itself
+        through JITStackFrame. However, lookupExceptionHandler does not take
+        an argument (other than the default ExecState argument), and the code
+        did not initialize the thing that it thought it passed to itself!
+
+2013-10-17  Alex Christensen  <achristensen@webkit.org>
+
+        Run JavaScriptCore tests again on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=122787
+
+        Reviewed by Tim Horton.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.sln: Added.
+        * jit/JITStubsMSVC64.asm: Removed reference to cti_vm_throw unused since r157581.
+
+2013-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed restoreArgumentReference (another use of JITStackFrame)
+        https://bugs.webkit.org/show_bug.cgi?id=122997
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JSInterfaceJIT.h: Removed an unused function. This is a step
+        toward using the C stack.
+
+2013-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Remove JITStubCall.h
+        https://bugs.webkit.org/show_bug.cgi?id=122991
+
+        Reviewed by Geoff Garen.
+
+        Happily this is no longer used
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubCall.h: Removed.
+
+2013-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed a use of JITSTACKFRAME_ARGS_INDEX
+        https://bugs.webkit.org/show_bug.cgi?id=122989
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JITStubCall.h: Removed an unused function. This is one step closer
+        to using the C stack.
+
+2013-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Change emit_op_catch to use another method to materialize VM
+        https://bugs.webkit.org/show_bug.cgi?id=122977
+
+        Reviewed by Oliver Hunt.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch): Use a constant. It removes our dependency
+        on JITStackFrame. It is also faster and simpler.
+
+2013-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Eliminate emitGetJITStubArg() - dead code
+        https://bugs.webkit.org/show_bug.cgi?id=122975
+
+        Reviewed by Anders Carlsson.
+
+        * jit/JIT.h:
+        * jit/JITInlines.h: Removed unused, deprecated function.
+
+2013-10-17  Mark Lam  <mark.lam@apple.com>
+
+        Eliminate all ASSERT references to OBJECT_OFFSETOF(struct JITStackFrame,...) in JITStubsXXX.h.
+        https://bugs.webkit.org/show_bug.cgi?id=122979.
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARM64.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsMIPS.h:
+        * jit/JITStubsSH4.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+
+2013-10-17  Michael Saboff  <msaboff@apple.com>
+
+        Remove saving callFrameRegister to JITStackFrame in JITCompiler::compileFunction()
+        https://bugs.webkit.org/show_bug.cgi?id=122974
+
+        Reviewed by Geoffrey Garen.
+
+        Eliminated unneeded storing to JITStackFrame.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+
+2013-10-17  Michael Saboff  <msaboff@apple.com>
+
+        Transition cti_op_throw and cti_vm_throw to a JIT operation
+        https://bugs.webkit.org/show_bug.cgi?id=122931
+
+        Reviewed by Filip Pizlo.
+
+        Moved cti_op_throw to operationThrow.  Made the caller responsible for jumping to the
+        catch handler.  Eliminated cti_op_throw_static_error, cti_vm_throw, ctiVMThrowTrampoline()
+        and their callers as it is now dead code.  There is some work needed on the Microsoft X86
+        callOperation to handle the need to provide space for structure return value.
+
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARM64.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsMIPS.h:
+        * jit/JITStubsMSVC64.asm:
+        * jit/JITStubsSH4.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+        * jit/JSInterfaceJIT.h:
+
+2013-10-17  Mark Lam  <mark.lam@apple.com>
+
+        Remove JITStackFrame references in the C Loop LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=122950.
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITStubs.h:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * offlineasm/cloop.rb:
+
+2013-10-17  Mark Lam  <mark.lam@apple.com>
+
+        Remove JITStackFrame references in JIT probes.
+        https://bugs.webkit.org/show_bug.cgi?id=122947.
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::ProbeContext::dump):
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.cpp:
+        (JSC::MacroAssemblerARMv7::ProbeContext::dump):
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.cpp:
+        (JSC::MacroAssemblerX86Common::ProbeContext::dump):
+        * assembler/MacroAssemblerX86Common.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86Common.h:
+        * jit/JITStubsX86_64.h:
+
+2013-10-17  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix build when NUMBER_OF_ARGUMENT_REGISTERS == 4.
+        https://bugs.webkit.org/show_bug.cgi?id=122949
+
+        Reviewed by Andreas Kling.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2013-10-16  Mark Lam  <mark.lam@apple.com>
+
+        Transition remaining op_get* JITStubs to JIT operations.
+        https://bugs.webkit.org/show_bug.cgi?id=122925.
+
+        Reviewed by Geoffrey Garen.
+
+        Transitioning:
+            cti_op_get_by_id_generic
+            cti_op_get_by_val
+            cti_op_get_by_val_generic
+            cti_op_get_by_val_string
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_arguments_length):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+        (JSC::JIT::privateCompileGetByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * runtime/Executable.cpp:
+        (JSC::setupLLInt): Added some UNUSED_PARAMs to fix the no LLINT build.
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+
+2013-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Introduce WTF::Bag and start using it for InlineCallFrameSet
+        https://bugs.webkit.org/show_bug.cgi?id=122941
+
+        Reviewed by Geoffrey Garen.
+        
+        Use Bag for InlineCallFrameSet. If this works out then I'll make other
+        SegmentedVectors into Bags as well.
+
+        * bytecode/InlineCallFrameSet.cpp:
+        (JSC::InlineCallFrameSet::add):
+        * bytecode/InlineCallFrameSet.h:
+        (JSC::InlineCallFrameSet::begin):
+        (JSC::InlineCallFrameSet::end):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+
+2013-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        libllvmForJSC shouldn't call exit(1) on report_fatal_error()
+        https://bugs.webkit.org/show_bug.cgi?id=122905
+        <rdar://problem/15237856>
+
+        Reviewed by Michael Saboff.
+        
+        Expose the new LLVMInstallFatalErrorHandler() API through the soft linking magic and
+        then always call it to install something that calls CRASH().
+
+        * llvm/InitializeLLVM.cpp:
+        (JSC::llvmCrash):
+        (JSC::initializeLLVMOnce):
+        (JSC::initializeLLVM):
+        * llvm/LLVMAPIFunctions.h:
+
+2013-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Prototype chain repatching in the polymorphic case fails to check if the receiver is a dictionary
+        https://bugs.webkit.org/show_bug.cgi?id=122938
+
+        Reviewed by Sam Weinig.
+        
+        This fixes jsc-layout-tests.yaml/js/script-tests/dictionary-prototype-caching.js.layout-no-llint.
+
+        * jit/Repatch.cpp:
+        (JSC::tryBuildGetByIDList):
+
+2013-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT::appendCall() needs to killLastResultRegister() or equivalent since there's some really bad code that expects it
+        https://bugs.webkit.org/show_bug.cgi?id=122937
+
+        Reviewed by Geoffrey Garen.
+        
+        JITStubCall used to do it.
+        
+        This makes mozilla-tests.yaml/ecma/Statements/12.10-1.js.mozilla-baseline pass.
+
+        * jit/JIT.h:
+        (JSC::JIT::appendCall):
+
+2013-10-16  Michael Saboff  <msaboff@apple.com>
+
+        transition void cti_op_put_by_val* stubs to JIT operations
+        https://bugs.webkit.org/show_bug.cgi?id=122903
+
+        Reviewed by Geoffrey Garen.
+
+        Transitioned cti_op_put_by_val and cti_op_put_by_val_generic to operationPutByVal and
+        operationPutByValGeneric.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+
+2013-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Implement ES6 spread operator
+        https://bugs.webkit.org/show_bug.cgi?id=122911
+
+        Reviewed by Michael Saboff.
+
+        Implement the ES6 spread operator
+
+        This has a little bit of refactoring to move the enumeration logic out ForOfNode
+        and into BytecodeGenerator, and then adds the logic to make it nicely callback
+        driven.
+
+        The rest of the logic is just the addition of the SpreadExpressionNode, the parsing,
+        and actually handling the spread.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::SpreadExpressionNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createSpreadExpression):
+        * parser/Lexer.cpp:
+        (JSC::::lex):
+        * parser/NodeConstructors.h:
+        (JSC::SpreadExpressionNode::SpreadExpressionNode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isSpreadExpression):
+        (JSC::SpreadExpressionNode::expression):
+        * parser/Parser.cpp:
+        (JSC::::parseArrayLiteral):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Parser::getTokenName):
+        (JSC::Parser::updateErrorMessageSpecialCase):
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createSpreadExpression):
+
+2013-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a useLLInt option to jsc
+        https://bugs.webkit.org/show_bug.cgi?id=122930
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/Executable.cpp:
+        (JSC::setupLLInt):
+        (JSC::setupJIT):
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/Options.h:
+
+2013-10-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Build fix.
+
+        Forgot to svn add DeferGC.cpp
+
+        * heap/DeferGC.cpp: Added.
+
+2013-10-16  Filip Pizlo  <fpizlo@apple.com>
+
+        r157411 fails run-javascriptcore-tests when run with Baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=122902
+
+        Reviewed by Mark Hahnenberg.
+        
+        It turns out that this was a long-standing bug in the DFG PutById repatching logic. It's
+        not legal to patch if the typeInfo tells you that you can't patch. The old JIT's patching
+        logic did this right, and the DFG's GetById patching logic did it right; but DFG PutById
+        didn't. Turns out that there's even a helpful method,
+        Structure::propertyAccessesAreCacheable(), that will even do all of the checks for you!
+
+        * jit/Repatch.cpp:
+        (JSC::tryCachePutByID):
+
+2013-10-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        llint_slow_path_put_by_id can deadlock on a ConcurrentJITLock
+        https://bugs.webkit.org/show_bug.cgi?id=122667
+
+        Reviewed by Geoffrey Garen.
+
+        The issue this patch is attempting to fix is that there are places in our codebase
+        where we acquire the ConcurrentJITLock for a particular CodeBlock, then we do some
+        operations that can initiate a garbage collection. Garbage collection then calls 
+        some methods of CodeBlock that also take the ConcurrentJITLock (because they don't
+        always necessarily run during garbage collection). This causes a deadlock.
+ 
+        To fix this issue, this patch adds a new RAII-style object (DisallowGC) that stores 
+        into a thread-local field that indicates that it is unsafe to perform any operation 
+        that could trigger garbage collection on the current thread. In debug builds, 
+        ConcurrentJITLocker contains one of these DisallowGC objects so that we can eagerly 
+        detect deadlocks.
+ 
+        This patch also adds a new type of ConcurrentJITLocker, GCSafeConcurrentJITLocker,
+        which uses the DeferGC mechanism to prevent collections from occurring while the 
+        lock is held.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/DeferGC.h:
+        (JSC::DisallowGC::DisallowGC):
+        (JSC::DisallowGC::~DisallowGC):
+        (JSC::DisallowGC::isGCDisallowedOnCurrentThread):
+        (JSC::DisallowGC::initialize):
+        * jit/Repatch.cpp:
+        (JSC::repatchPutByID):
+        (JSC::buildPutByIdList):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ConcurrentJITLock.h:
+        (JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase):
+        (JSC::ConcurrentJITLockerBase::~ConcurrentJITLockerBase):
+        (JSC::ConcurrentJITLockerBase::unlockEarly):
+        (JSC::GCSafeConcurrentJITLocker::GCSafeConcurrentJITLocker):
+        (JSC::GCSafeConcurrentJITLocker::~GCSafeConcurrentJITLocker):
+        (JSC::GCSafeConcurrentJITLocker::NoDefer::NoDefer):
+        (JSC::ConcurrentJITLocker::ConcurrentJITLocker):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSCellInlines.h:
+        (JSC::allocateCell):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        * runtime/Structure.cpp: materializePropertyMapIfNecessary* now has a problem in that it
+        can start a garbage collection when the GCSafeConcurrentJITLocker goes out of scope, but 
+        before the caller has a chance to use the newly created PropertyTable. The garbage collection
+        clears the PropertyTable, and then the caller uses it assuming it's valid. To avoid this,
+        we must DeferGC until the caller is done getting the newly materialized PropertyTable from 
+        the Structure.
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::despecifyAllFunctions):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::find):
+        (JSC::SymbolTable::end):
+
+2013-10-16  Daniel Bates  <dabates@apple.com>
+
+        Add SPI to disable the garbage collector timer
+        https://bugs.webkit.org/show_bug.cgi?id=122921
+
+        Reviewed by Geoffrey Garen.
+
+        Based on a patch by Mark Hahnenberg.
+
+        * API/JSBase.cpp:
+        (JSDisableGCTimer): Added; SPI function.
+        * API/JSBasePrivate.h:
+        * heap/BlockAllocator.cpp:
+        (JSC::createBlockFreeingThread): Added.
+        (JSC::BlockAllocator::BlockAllocator): Modified to use JSC::createBlockFreeingThread()
+        to conditionally create the "block freeing" thread depending on the value of
+        GCActivityCallback::s_shouldCreateGCTimer.
+        (JSC::BlockAllocator::~BlockAllocator):
+        * heap/BlockAllocator.h:
+        (JSC::BlockAllocator::deallocate):
+        * heap/Heap.cpp:
+        (JSC::Heap::didAbandon):
+        (JSC::Heap::collect):
+        (JSC::Heap::didAllocate):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::timerDidFire):
+        * runtime/GCActivityCallback.cpp:
+        * runtime/GCActivityCallback.h:
+        (JSC::DefaultGCActivityCallback::create): Only instantiate a DefaultGCActivityCallback object
+        when GCActivityCallback::s_shouldCreateGCTimer is true so as to prevent allocating a HeapTimer
+        object (since DefaultGCActivityCallback ultimately extends HeapTimer).
+
+2013-10-16  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r157529.
+        http://trac.webkit.org/changeset/157529
+        https://bugs.webkit.org/show_bug.cgi?id=122919
+
+        Caused score test failures and some build failures. (Requested
+        by rfong on #webkit).
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::CallArguments::CallArguments):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::BindingNode::collectBoundIdentifiers):
+        * parser/ASTBuilder.h:
+        * parser/Lexer.cpp:
+        (JSC::::lex):
+        * parser/NodeConstructors.h:
+        (JSC::DotAccessorNode::DotAccessorNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::::parseArrayLiteral):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Parser::getTokenName):
+        (JSC::Parser::updateErrorMessageSpecialCase):
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+
+2013-10-16  Julien Brianceau  <jbriance@cisco.com>
+
+        Remove useless architecture specific implementation in DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=122917.
+
+        Reviewed by Michael Saboff.
+
+        With CPU(ARM) && CPU(ARM_HARDFP) architecture, the fallback implementation is fine
+        as FPRInfo::argumentFPR0 == FPRInfo::returnValueFPR in this case.
+
+        * dfg/DFGSpeculativeJIT.h:
+
+2013-10-16  Julien Brianceau  <jbriance@cisco.com>
+
+        Remove unused JIT::restoreArgumentReferenceForTrampoline function.
+        https://bugs.webkit.org/show_bug.cgi?id=122916.
+
+        Reviewed by Michael Saboff.
+
+        This architecture specific function is not used anymore, so get rid of it.
+
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+
+2013-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Implement ES6 spread operator
+        https://bugs.webkit.org/show_bug.cgi?id=122911
+
+        Reviewed by Michael Saboff.
+
+        Implement the ES6 spread operator
+
+        This has a little bit of refactoring to move the enumeration logic out ForOfNode
+        and into BytecodeGenerator, and then adds the logic to make it nicely callback
+        driven.
+
+        The rest of the logic is just the addition of the SpreadExpressionNode, the parsing,
+        and actually handling the spread.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::SpreadExpressionNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createSpreadExpression):
+        * parser/Lexer.cpp:
+        (JSC::::lex):
+        * parser/NodeConstructors.h:
+        (JSC::SpreadExpressionNode::SpreadExpressionNode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isSpreadExpression):
+        (JSC::SpreadExpressionNode::expression):
+        * parser/Parser.cpp:
+        (JSC::::parseArrayLiteral):
+        (JSC::::parseArguments):
+        (JSC::::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Parser::getTokenName):
+        (JSC::Parser::updateErrorMessageSpecialCase):
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createSpreadExpression):
+
+2013-10-16  Mark Lam  <mark.lam@apple.com>
+
+        Transition void cti_op_tear_off* methods to JIT operations for 32 bit.
+        https://bugs.webkit.org/show_bug.cgi?id=122899.
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2013-10-16  Julien Brianceau  <jbriance@cisco.com>
+
+        Remove more of the UNINTERRUPTED_SEQUENCE thing
+        https://bugs.webkit.org/show_bug.cgi?id=122885
+
+        Reviewed by Andreas Kling.
+
+        It was not completely removed by r157481, leading to build failure for sh4 architecture.
+
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+
+2013-10-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of the StructureStubInfo::patch union
+        https://bugs.webkit.org/show_bug.cgi?id=122877
+
+        Reviewed by Sam Weinig.
+        
+        Just simplifying code by getting rid of data structures that ain't used no more.
+        
+        Note that I replace the patch union with a patch struct. This means we say things like
+        stubInfo.patch.valueGPR instead of stubInfo.valueGPR. I think that this extra
+        encapsulation makes the code more readable: the patch struct contains just those things
+        that you need to know to perform patching.
+
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * jit/JIT.cpp:
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess):
+        (JSC::replaceWithJump):
+        (JSC::linkRestoreScratch):
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryCacheGetByID):
+        (JSC::getPolymorphicStructureList):
+        (JSC::patchJumpToGetByIdStub):
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::resetIn):
+
+2013-10-15  Nadav Rotem  <nrotem@apple.com>
+
+        FTL: add support for Int52ToValue and fix putByVal of int52s.
+        https://bugs.webkit.org/show_bug.cgi?id=122873
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileInt52ToValue):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+
+2013-10-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of the UNINTERRUPTED_SEQUENCE thing
+        https://bugs.webkit.org/show_bug.cgi?id=122876
+
+        Reviewed by Mark Hahnenberg.
+        
+        It doesn't make sense anymore. We now use the DFG's IC logic, which never needed that.
+        
+        Moreover, we should resist the temptation to bring anything like this back. We don't
+        want to have inline caches that only work if the assembler lays out code in a specific
+        predetermined way.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2013-10-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should use the DFG GetById IC
+        https://bugs.webkit.org/show_bug.cgi?id=122861
+
+        Reviewed by Oliver Hunt.
+        
+        This mostly just kills a ton of code.
+        
+        Note that this doesn't yet do all of the simplifications that can be done, but it does
+        kill dead code. I'll have another change to simplify StructureStubInfo's unions and such.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        * jit/JIT.cpp:
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        * jit/JIT.h:
+        (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
+        * jit/JITInlines.h:
+        (JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):
+        (JSC::JIT::callOperation):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/Repatch.cpp:
+        (JSC::repatchGetByID):
+        (JSC::buildGetByIDList):
+        * jit/ThunkGenerators.cpp:
+        * jit/ThunkGenerators.h:
+
+2013-10-15  Dean Jackson  <dino@apple.com>
+
+        Add ENABLE_WEB_ANIMATIONS flag
+        https://bugs.webkit.org/show_bug.cgi?id=122871
+
+        Reviewed by Tim Horton.
+
+        Eventually might be http://dev.w3.org/fxtf/web-animations/
+        but this is just engine-internal work at the moment.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2013-10-15  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Some calls don't match sh4 ABI.
+        https://bugs.webkit.org/show_bug.cgi?id=122863
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+
+2013-10-15  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Upstream JavaScriptCore support for ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=122762
+
+        Reviewed by Oliver Hunt and Filip Pizlo.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/ToolExecutable.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARM64Assembler.h: Added.
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isARM64):
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::CachedTempRegister::CachedTempRegister):
+        (JSC::AbstractMacroAssembler::CachedTempRegister::registerIDInvalidate):
+        (JSC::AbstractMacroAssembler::CachedTempRegister::registerIDNoInvalidate):
+        (JSC::AbstractMacroAssembler::CachedTempRegister::value):
+        (JSC::AbstractMacroAssembler::CachedTempRegister::setValue):
+        (JSC::AbstractMacroAssembler::CachedTempRegister::invalidate):
+        (JSC::AbstractMacroAssembler::invalidateAllTempRegisters):
+        (JSC::AbstractMacroAssembler::isTempRegisterValid):
+        (JSC::AbstractMacroAssembler::clearTempRegisterValid):
+        (JSC::AbstractMacroAssembler::setTempRegisterValid):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        (JSC::LinkBuffer::linkCode):
+        * assembler/LinkBuffer.h:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::isPtrAlignedAddressOffset):
+        (JSC::MacroAssembler::pushToSave):
+        (JSC::MacroAssembler::popToRestore):
+        (JSC::MacroAssembler::patchableBranchTest32):
+        * assembler/MacroAssemblerARM64.h: Added.
+        * assembler/MacroAssemblerARMv7.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * disassembler/ARM64/A64DOpcode.cpp: Added.
+        * disassembler/ARM64/A64DOpcode.h: Added.
+        * disassembler/ARM64Disassembler.cpp: Added.
+        * heap/MachineStackMarker.cpp:
+        (JSC::getPlatformThreadRegisters):
+        (JSC::otherThreadStackPointer):
+        * heap/Region.h:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::debugCall):
+        * jit/CCallHelpers.h:
+        * jit/ExecutableAllocator.h:
+        * jit/FPRInfo.h:
+        (JSC::FPRInfo::toRegister):
+        (JSC::FPRInfo::toIndex):
+        (JSC::FPRInfo::debugName):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toRegister):
+        (JSC::GPRInfo::toIndex):
+        (JSC::GPRInfo::debugName):
+        * jit/JITInlines.h:
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITOperationWrappers.h:
+        * jit/JITOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::performPlatformSpecificJITAssertions):
+        (JSC::tryCachePutByID):
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+        * jit/JITStubsARM64.h: Added.
+        * jit/JSInterfaceJIT.h:
+        * jit/Repatch.cpp:
+        (JSC::emitRestoreScratch):
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryCacheGetByID):
+        (JSC::emitPutReplaceStub):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        * jsc.cpp:
+        (main):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::handleHostCall):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/arm.rb:
+        * offlineasm/arm64.rb: Added.
+        * offlineasm/backends.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/risc.rb:
+        * offlineasm/transform.rb:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::alignCallFrameSizeInBytes):
+        (JSC::Yarr::YarrGenerator::initCallFrame):
+        (JSC::Yarr::YarrGenerator::removeCallFrame):
+        (JSC::Yarr::YarrGenerator::generateEnter):
+        * yarr/YarrJIT.h:
+
+2013-10-15  Mark Lam  <mark.lam@apple.com>
+
+        Fix 3 operand sub operation in C loop LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=122866.
+
+        Reviewed by Geoffrey Garen.
+
+        * offlineasm/cloop.rb:
+
+2013-10-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        ObjCCallbackFunctionImpl shouldn't store a JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=122531
+
+        Reviewed by Geoffrey Garen.
+
+        The m_context field in ObjCCallbackFunctionImpl is vestigial and is only incidentally correct 
+        in the common case. It's also no longer necessary in that we can look up the current JSContext 
+        by looking using the globalObject of the callee when the function callback is invoked.
+ 
+        Also added a new test that would cause us to crash previously. The test required making 
+        JSContextGetGlobalContext public API so that clients can obtain a JSContext from the JSContextRef
+        in C API callbacks.
+
+        * API/JSContextRef.h:
+        * API/JSContextRefPrivate.h:
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunctionImpl::ObjCCallbackFunctionImpl):
+        (JSC::objCCallbackFunctionCallAsFunction):
+        (objCCallbackFunctionForInvocation):
+        * API/WebKitAvailability.h:
+        * API/tests/CurrentThisInsideBlockGetterTest.h: Added.
+        * API/tests/CurrentThisInsideBlockGetterTest.mm: Added.
+        (CallAsConstructor):
+        (ConstructorFinalize):
+        (ConstructorClass):
+        (+[JSValue valueWithConstructorDescriptor:inContext:]):
+        (-[JSContext valueWithConstructorDescriptor:]):
+        (currentThisInsideBlockGetterTest):
+        * API/tests/testapi.mm:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp: Had to add some fully qualified names to avoid conflicts with Mac OS X headers.
+
+2013-10-15  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix build after r157457 for architecture with 4 argument registers.
+        https://bugs.webkit.org/show_bug.cgi?id=122860
+
+        Reviewed by Michael Saboff.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupStubArguments134):
+
+2013-10-14  Michael Saboff  <msaboff@apple.com>
+
+        transition void cti_op_* methods to JIT operations.
+        https://bugs.webkit.org/show_bug.cgi?id=122617
+
+        Reviewed by Geoffrey Garen.
+
+        Converted the follow stubs to JIT operations:
+            cti_handle_watchdog_timer
+            cti_op_debug
+            cti_op_pop_scope
+            cti_op_profile_did_call
+            cti_op_profile_will_call
+            cti_op_put_by_index
+            cti_op_put_getter_setter
+            cti_op_tear_off_activation
+            cti_op_tear_off_arguments
+            cti_op_throw_static_error
+            cti_optimize
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        (JSC::CCallHelpers::setupThreeStubArgsGPR):
+        (JSC::CCallHelpers::setupStubArguments):
+        (JSC::CCallHelpers::setupStubArguments134):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitEnterOptimizationCheck):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_pop_scope):
+        (JSC::JIT::emit_op_push_name_scope):
+        (JSC::JIT::emit_op_throw_static_error):
+        (JSC::JIT::emit_op_debug):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_pop_scope):
+        (JSC::JIT::emit_op_push_name_scope):
+        (JSC::JIT::emit_op_throw_static_error):
+        (JSC::JIT::emit_op_debug):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter_setter):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_index):
+        (JSC::JIT::emit_op_put_getter_setter):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2013-10-15  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Introduce const pools in LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=122746
+
+        Reviewed by Michael Saboff.
+
+        In current implementation of LLINT for sh4, immediate values outside range -128..127 are
+        loaded this way:
+
+            mov.l .label, rx
+            bra out
+            nop
+            .balign 4
+            .label: .long immvalue
+            out:
+
+        This change introduces const pools for sh4 implementation to avoid lots of useless branches
+        and reduce code size. It also removes lines of dirty code, like jmpf and callf.
+
+        * offlineasm/instructions.rb: Remove jmpf and callf sh4 specific instructions.
+        * offlineasm/sh4.rb:
+
+2013-10-15  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken C Loop LLINT build.
+        https://bugs.webkit.org/show_bug.cgi?id=122839.
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGFlushedAt.cpp:
+        * jit/JITOperations.h:
+
+2013-10-14  Mark Lam  <mark.lam@apple.com>
+
+        Transition *switch* and *scope* JITStubs to JIT operations.
+        https://bugs.webkit.org/show_bug.cgi?id=122757.
+
+        Reviewed by Geoffrey Garen.
+
+        Transitioning:
+            cti_op_switch_char
+            cti_op_switch_imm
+            cti_op_switch_string
+            cti_op_resolve_scope
+            cti_op_get_from_scope
+            cti_op_put_to_scope
+
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        (JSC::JIT::emit_op_switch_string):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2013-10-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG PutById IC should use the ConcurrentJITLocker since it's now dealing with IC's that get read by the compiler thread
+        https://bugs.webkit.org/show_bug.cgi?id=122786
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStub): Resetting a stub should acquire the lock since this is observable from the thread; but we should only acquire the lock if we're resetting outside of GC.
+        * jit/Repatch.cpp:
+        (JSC::repatchPutByID): Doing the PutById patching should hold the lock.
+        (JSC::buildPutByIdList): Ditto.
+
+2013-10-14  Nadav Rotem  <nrotem@apple.com>
+
+        Add FTL support for LogicalNot(string)
+        https://bugs.webkit.org/show_bug.cgi?id=122765
+
+        Reviewed by Filip Pizlo.
+
+        This patch is tested by:
+        regress/script-tests/emscripten-cube2hash.js.ftl-eager
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileLogicalNot):
+
+2013-10-14  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Fixes after r157404 and r157411.
+        https://bugs.webkit.org/show_bug.cgi?id=122782
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Add missing SH4_32BIT_DUMMY_ARG.
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation): Add missing SH4_32BIT_DUMMY_ARG.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_id): Remove unwanted BEGIN_UNINTERRUPTED_SEQUENCE.
+
+2013-10-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r157413.
+        http://trac.webkit.org/changeset/157413
+        https://bugs.webkit.org/show_bug.cgi?id=122779
+
+        Appears to have caused frequent crashes (Requested by ap on
+        #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/DeferGC.cpp: Removed.
+        * heap/DeferGC.h:
+        * jit/JITStubs.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ConcurrentJITLock.h:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSCellInlines.h:
+        (JSC::allocateCell):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        * runtime/Structure.h:
+
+2013-10-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        COLLECT_ON_EVERY_ALLOCATION causes assertion failures
+        https://bugs.webkit.org/show_bug.cgi?id=122652
+
+        Reviewed by Filip Pizlo.
+
+        COLLECT_ON_EVERY_ALLOCATION wasn't accounting for the new GC deferral mechanism,
+        so we would end up ASSERTing during garbage collection.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+
+2013-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Separate out array iteration intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=122656
+
+        Reviewed by Michael Saboff.
+
+        Separate out the intrinsics for key and values iteration
+        of arrays.
+
+        This requires moving moving array iteration into the iterator
+        instance, rather than the prototype, but this is essentially
+        unobservable so we'll live with it for now.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::arrayIteratorNextThunkGenerator):
+        (JSC::arrayIteratorNextKeyThunkGenerator):
+        (JSC::arrayIteratorNextValueThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        * runtime/Intrinsic.h:
+        * runtime/JSArrayIterator.cpp:
+        (JSC::JSArrayIterator::finishCreation):
+        (JSC::createIteratorResult):
+        (JSC::arrayIteratorNext):
+        (JSC::arrayIteratorNextKey):
+        (JSC::arrayIteratorNextValue):
+        (JSC::arrayIteratorNextGeneric):
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+
+2013-10-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        llint_slow_path_put_by_id can deadlock on a ConcurrentJITLock
+        https://bugs.webkit.org/show_bug.cgi?id=122667
+
+        Reviewed by Filip Pizlo.
+
+        The issue this patch is attempting to fix is that there are places in our codebase
+        where we acquire the ConcurrentJITLock for a particular CodeBlock, then we do some
+        operations that can initiate a garbage collection. Garbage collection then calls 
+        some methods of CodeBlock that also take the ConcurrentJITLock (because they don't
+        always necessarily run during garbage collection). This causes a deadlock.
+
+        To fix this issue, this patch adds a new RAII-style object (DisallowGC) that stores 
+        into a thread-local field that indicates that it is unsafe to perform any operation 
+        that could trigger garbage collection on the current thread. In debug builds, 
+        ConcurrentJITLocker contains one of these DisallowGC objects so that we can eagerly 
+        detect deadlocks.
+
+        This patch also adds a new type of ConcurrentJITLocker, GCSafeConcurrentJITLocker,
+        which uses the DeferGC mechanism to prevent collections from occurring while the 
+        lock is held.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/DeferGC.cpp: Added.
+        * heap/DeferGC.h:
+        (JSC::DisallowGC::DisallowGC):
+        (JSC::DisallowGC::~DisallowGC):
+        (JSC::DisallowGC::isGCDisallowedOnCurrentThread):
+        (JSC::DisallowGC::initialize):
+        * jit/JITStubs.cpp:
+        (JSC::tryCachePutByID):
+        (JSC::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ConcurrentJITLock.h:
+        (JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase):
+        (JSC::ConcurrentJITLockerBase::~ConcurrentJITLockerBase):
+        (JSC::ConcurrentJITLockerBase::unlockEarly):
+        (JSC::GCSafeConcurrentJITLocker::GCSafeConcurrentJITLocker):
+        (JSC::ConcurrentJITLocker::ConcurrentJITLocker):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSCellInlines.h:
+        (JSC::allocateCell):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::createPropertyMap):
+        * runtime/Structure.h:
+
+2013-10-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should use the DFG's PutById IC
+        https://bugs.webkit.org/show_bug.cgi?id=122704
+
+        Reviewed by Mark Hahnenberg.
+        
+        Mostly no big deal, just removing the old Baseline JIT's put_by_id IC support and forcing
+        that JIT to use the DFG's (i.e. JITOperations) PutById IC.
+        
+        The only complicated part was that the PutById operations assumed that we first did a
+        cell speculation, which the baseline JIT obviously won't do. So I changed all of those
+        slow paths to deal with EncodedJSValue's.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resetStubInternal):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.cpp:
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        * jit/JIT.h:
+        (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
+        (JSC::PropertyStubCompilationInfo::slowCaseInfo):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperationWrappers.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/Repatch.cpp:
+        (JSC::appropriateGenericPutByIdFunction):
+        (JSC::appropriateListBuildingPutByIdFunction):
+        (JSC::resetPutByID):
+
+2013-10-13  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should have an inefficient but correct implementation of GetById
+        https://bugs.webkit.org/show_bug.cgi?id=122740
+
+        Reviewed by Mark Hahnenberg.
+        
+        It took some effort to realize that the node->prediction() check in the DFG backends
+        are completely unnecessary since the ByteCodeParser will always insert a ForceOSRExit
+        if !prediction.
+        
+        But other than that this was an easy patch.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+
+2013-10-13  Mark Lam  <mark.lam@apple.com>
+
+        Transition misc cti_op_* JITStubs to JIT operations.
+        https://bugs.webkit.org/show_bug.cgi?id=122645.
+
+        Reviewed by Michael Saboff.
+
+        Stubs converted:
+            cti_op_check_has_instance
+            cti_op_create_arguments
+            cti_op_del_by_id
+            cti_op_instanceof
+            cti_to_object
+            cti_op_push_activation
+            cti_op_get_pnames
+            cti_op_load_varargs
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        (JSC::JIT::emitStoreCell):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_del_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_del_by_id):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+
+2013-10-13  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL OSR exit should perform zero extension on values smaller than 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=122688
+
+        Reviewed by Gavin Barraclough.
+        
+        In the DFG we usually make the simplistic assumption that a 32-bit value in a 64-bit
+        register will have zeros on the high bits.  In the few cases where the high bits are
+        non-zero, the DFG sort of tells us this explicitly.
+
+        But when working with llvm.webkit.stackmap, it doesn't work that way.  Consider we might
+        emit LLVM IR like:
+
+            %2 = trunc i64 %1 to i32
+            stuff %2
+            call @llvm.webkit.stackmap(...., %2)
+
+        LLVM may never actually emit a truncation instruction of any kind.  And that's great - in
+        many cases it won't be needed, like if 'stuff %2' is a 32-bit op that ignores the high
+        bits anyway.  Hence LLVM may tell us that %2 is in the register that still had the value
+        from before truncation, and that register may have garbage in the high bits.
+
+        This means that on our end, if we want a 32-bit value and we want that value to be
+        zero-extended, we should zero-extend it ourselves.  This is pretty easy and should be
+        cheap, so we should just do it and not make it a requirement that LLVM does it on its
+        end.
+        
+        This makes all tests pass with JSC_ftlOSRExitUsesStackmap=true.
+
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStubWithOSRExitStackmap):
+        * ftl/FTLValueFormat.cpp:
+        (JSC::FTL::reboxAccordingToFormat):
+
+== Rolled over to ChangeLog-2013-10-13 ==
diff --git a/ChangeLog-2014-10-07 b/ChangeLog-2014-10-07
new file mode 100644
index 0000000..55c897c
--- /dev/null
+++ b/ChangeLog-2014-10-07
@@ -0,0 +1,30352 @@
+2014-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Remove op_new_captured_func
+        https://bugs.webkit.org/show_bug.cgi?id=137491
+
+        Reviewed by Mark Lam.
+
+        Removes the op_captured_new_func opcode as part of the work
+        towards having any magical opcodes that write directly to
+        named "registers" and then have a follow on op to ensure that
+        the environment record correctly represents the stack state.
+
+        For this we add a non-captured scratch register so we don't
+        have to have any kind of magic opcode, and instead simply
+        have sensible creation and move semantics for capturing new
+        functions.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_captured_func): Deleted.
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL): Deleted.
+        * runtime/CommonSlowPaths.h:
+
+2014-10-06  Andy Estes  <aestes@apple.com>
+
+        Objective-C objects must be fully defined when used in a WTF::Vector
+        https://bugs.webkit.org/show_bug.cgi?id=137479
+
+        Reviewed by Mark Rowe.
+
+        When compiling an Objective-C++ file under ARC, @class types are considered non-trivially destructable, so
+        Vector needs to see their definition in order to call their destructor.
+
+        See <http://clang.llvm.org/docs/AutomaticReferenceCounting.html#ownership-qualified-fields-of-structs-and-unions> for details.
+
+        * API/ObjcRuntimeExtras.h: Imported <objc/Protocol.h>.
+
+2014-10-06  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Use of 1-bit Enum type behaves improperly
+        https://bugs.webkit.org/show_bug.cgi?id=137471
+        <rdar://problem/18559172>
+
+        Reviewed by Mark Lam.
+
+        Represent 1-bit enum element as 'unsigned', as we have done elsewhere
+        in WebKit to avoid problems when building with MSVC.
+
+        * debugger/Debugger.h:
+
+2014-10-06  Mark Lam  <mark.lam@apple.com>
+
+        Fixed compiler warnings on Windows build.
+        <https://webkit.org/b/135205>
+
+        Reviewed by Geoffrey Garen.
+
+        Benchmarking with jsc shows that perf is neutral with this change.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::call):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::ArgumentPosition::mergeShouldNeverUnbox):
+        (JSC::DFG::ArgumentPosition::mergeArgumentUnboxingAwareness):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::makeWord):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::nodeMayOverflow):
+        (JSC::DFG::nodeMayNegZero):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGVariableAccessData.cpp:
+        (JSC::DFG::VariableAccessData::mergeIsCaptured):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::mergeIsProfitableToUnbox):
+        (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
+        (JSC::DFG::VariableAccessData::mergeCheckArrayHoistingFailed):
+        (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
+        (JSC::DFG::VariableAccessData::mergeIsLoadedFrom):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+
+2014-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Remove incorrect assertion.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+
+2014-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Fix cloop build
+
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+
+2014-10-06  Mark Lam  <mark.lam@apple.com>
+
+        Unreviewed build fix.
+        <https://webkit.org/b/137279>
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2014-10-06  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION(r174226): [JSC] Crash when running the perf test Speedometer/Full.html
+        https://bugs.webkit.org/show_bug.cgi?id=137404
+
+        Reviewed by Michael Saboff.
+
+        Update the Arguments object to recognise that it must always have an
+        environment record if the referenced callee has one, and if such is not
+        present it should not try to extract one from the callframe, as that
+        path leads to madness.
+
+        Happily this makes some of the other code more sensible, and removes a
+        bunch of unnecessary and icky logic.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        (JSC::Arguments::didTearOffActivation): Deleted.
+        * runtime/Arguments.h:
+        (JSC::Arguments::argument):
+        (JSC::Arguments::finishCreation):
+
+2014-10-04  Brian J. Burg  <burg@cs.washington.edu>
+
+        Unreviewed, rolling out r174319.
+
+        Causes assertions in fast/profiler tests. Needs nontrivial
+        investigation, will take offline.
+
+        Reverted changeset:
+
+        "Web Inspector: timelines should not count time elapsed while
+        paused in the debugger"
+        https://bugs.webkit.org/show_bug.cgi?id=136351
+        http://trac.webkit.org/changeset/174319
+
+2014-10-04  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: timelines should not count time elapsed while paused in the debugger
+        https://bugs.webkit.org/show_bug.cgi?id=136351
+
+        Reviewed by Timothy Hatcher.
+
+        Now that we have a stopwatch to provide pause-aware timing data, we can remove the
+        profiler's handling of debugger pause/continue callbacks. The timeline agent accounts
+        for debugger pauses by pausing and resuming the stopwatch.
+
+        * API/JSProfilerPrivate.cpp:
+        (JSStartProfiling): Use a fresh stopwatch when profiling from the JSC API.
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::handlePause):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::profiler): Use nullptr.
+        (JSC::LegacyProfiler::startProfiling): Hand off a stopwatch to the profile generator.
+        (JSC::LegacyProfiler::stopProfiling): Use nullptr.
+        (JSC::LegacyProfiler::didPause): Deleted.
+        (JSC::LegacyProfiler::didContinue): Deleted.
+        * profiler/LegacyProfiler.h:
+        * profiler/ProfileGenerator.cpp: Remove debugger pause/continue callbacks and the
+        timestamp member that was used to track time elapsed by the debugger. Just use the
+        stopwatch's elapsed times to generate start/elapsed times for function calls.
+        (JSC::ProfileGenerator::create):
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::ProfileGenerator::beginCallEntry):
+        (JSC::ProfileGenerator::endCallEntry):
+        (JSC::ProfileGenerator::didPause): Deleted.
+        (JSC::ProfileGenerator::didContinue): Deleted.
+        * profiler/ProfileGenerator.h:
+
+2014-10-04  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should sink PutLocals
+        https://bugs.webkit.org/show_bug.cgi?id=137168
+
+        Reviewed by Oliver Hunt.
+        
+        We've known for a while that our PutLocal situation was sub-optimal. We emit them anytime we
+        "pass" arguments to an inlined function call, because we need to enable the runtime to grab
+        those arguments when doing foo.arguments where foo is inlined: our engine doesn't deoptimize
+        in that case but rather just relies on the arguments being flushed (i.e. a copy of their
+        values is spilled) at a well-known place in a well-known format.
+        
+        The PutLocals incur two costs: (1) they are store instructions and stores ain't free, and (2)
+        they look like escaping sites and so they inhibit object allocation sinking.
+        
+        But in most cases, the PutLocals are unnecessary because the inlined code never performs any
+        side effect that could transitively lead to function.arguments. Even if the inlined code
+        could do such a side effect, it may be on a rare path so there is no need to penalize the
+        entire function.
+        
+        This patch implements one solution to the PutLocal problem: it aggressively sinks PutLocals
+        to the latest possible point. This is even more aggressive than the object allocation
+        sinking. That sinking algorithm avoids creating situations where an object could be
+        materialized more than one along any path. PutLocal sinking, on the other hand, doesn't avoid
+        this at all - both to make the phase cheaper and simpler and to make it more aggressive.
+        Every PutLocal is sunk no matter what.
+        
+        The upside of this patch is that it eliminates many PutLocals: many of them are sunk "past
+        their death", thus eliminating them completely. Others are sunk to rare paths. This enables a
+        lot of object allocation sinking and it removes a lot of pointless store instructions.
+        
+        It also has downsites. Sinking PutLocals increases register pressure because it increases the
+        live ranges of things like inlined arguments.
+        
+        This patch is a net performance win in its current form: 1% SunSpider regression, 2% OctaneV2
+        progression, 0.6% Kraken regression, 1% AsmBench progression, and 0.5% CompressionBench
+        regression. The biggest win is on Octane/raytrace, which improves by 27%.
+        
+        Relanding after fixing internal builds. We have to be careful about implicit casts from int64
+        to int32.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * bytecode/Operands.h:
+        (JSC::Operands::dump): Deleted.
+        * bytecode/OperandsInlines.h:
+        (JSC::Traits>::dump):
+        * bytecode/VirtualRegister.h:
+        (JSC::VirtualRegister::isHeader):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGClobberSet.h:
+        (JSC::DFG::ClobberSetAdd::operator()):
+        (JSC::DFG::ClobberSetOverlaps::operator()):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        (JSC::DFG::NoOpClobberize::operator()):
+        (JSC::DFG::CheckClobberize::operator()):
+        (JSC::DFG::AbstractHeapOverlaps::operator()):
+        (JSC::DFG::ReadMethodClobberize::operator()):
+        (JSC::DFG::WriteMethodClobberize::operator()):
+        (JSC::DFG::DefMethodClobberize::operator()):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::merge):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::capturedVarsFor):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPreciseLocalClobberize.h: Added.
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::PreciseLocalClobberizeAdaptor):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::read):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::write):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::def):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::callIfAppropriate):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::writeTop):
+        (JSC::DFG::forEachLocalReadByUnwind):
+        (JSC::DFG::preciseLocalClobberize):
+        * dfg/DFGPutLocalSinkingPhase.cpp: Added.
+        (JSC::DFG::performPutLocalSinking):
+        * dfg/DFGPutLocalSinkingPhase.h: Added.
+        * dfg/DFGSSACalculator.h:
+        (JSC::DFG::SSACalculator::computePhis):
+        * dfg/DFGValidate.cpp:
+
+2014-10-03  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r174216): CodeBlock::dumpByteCodes crashes on op_push_name_scope
+        https://bugs.webkit.org/show_bug.cgi?id=137412
+
+        Reviewed by Mark Lam.
+
+        Added support for the JSNameScope::type opcode parameter in dumpBytecode().
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+
+2014-10-03  Saam Barati  <saambarati1@gmail.com>
+
+        Implement op_profile_type in the 32-bit baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=137181
+
+        Reviewed by Michael Saboff.
+
+        Generate inline code to write to the TypeProfilerLog inside the 32-bit 
+        baseline JIT instead of unconditionally bailing out to the slow path 
+        for op_profile_type.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_type):
+
+2014-10-03  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r174275.
+        https://bugs.webkit.org/show_bug.cgi?id=137408
+
+        Build failures on the internal bots. (Requested by dethbakin
+        on #webkit).
+
+        Reverted changeset:
+
+        "FTL should sink PutLocals"
+        https://bugs.webkit.org/show_bug.cgi?id=137168
+        http://trac.webkit.org/changeset/174275
+
+2014-10-03  Oliver Hunt  <oliver@apple.com>
+
+        tearoff_arguments should always refer to the unmodified arguments register
+        https://bugs.webkit.org/show_bug.cgi?id=137406
+
+        Reviewed by Michael Saboff.
+
+        To simplify subsequent work, and remove unnecessary work from
+        actual execution this patch simply ensures that tear_off_arguments
+        refers to the actual unmodified arguments register.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_tear_off_arguments):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_tear_off_arguments):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-10-03  Saam Barati  <saambarati1@gmail.com>
+
+        Web Inspector: Move the computation that results in UI strings from JSC to the Web Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=137295
+
+        Reviewed by Timothy Hatcher.
+
+        Remove unnecessary functions and properties from JSC that are
+        now being computed inside the Web Inspector. 
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * inspector/protocol/Runtime.json:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::allPrimitiveTypeNames): Deleted.
+        * runtime/TypeSet.h:
+
+2014-10-02  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should sink PutLocals
+        https://bugs.webkit.org/show_bug.cgi?id=137168
+
+        Reviewed by Oliver Hunt.
+        
+        We've known for a while that our PutLocal situation was sub-optimal. We emit them anytime we
+        "pass" arguments to an inlined function call, because we need to enable the runtime to grab
+        those arguments when doing foo.arguments where foo is inlined: our engine doesn't deoptimize
+        in that case but rather just relies on the arguments being flushed (i.e. a copy of their
+        values is spilled) at a well-known place in a well-known format.
+        
+        The PutLocals incur two costs: (1) they are store instructions and stores ain't free, and (2)
+        they look like escaping sites and so they inhibit object allocation sinking.
+        
+        But in most cases, the PutLocals are unnecessary because the inlined code never performs any
+        side effect that could transitively lead to function.arguments. Even if the inlined code
+        could do such a side effect, it may be on a rare path so there is no need to penalize the
+        entire function.
+        
+        This patch implements one solution to the PutLocal problem: it aggressively sinks PutLocals
+        to the latest possible point. This is even more aggressive than the object allocation
+        sinking. That sinking algorithm avoids creating situations where an object could be
+        materialized more than one along any path. PutLocal sinking, on the other hand, doesn't avoid
+        this at all - both to make the phase cheaper and simpler and to make it more aggressive.
+        Every PutLocal is sunk no matter what.
+        
+        The upside of this patch is that it eliminates many PutLocals: many of them are sunk "past
+        their death", thus eliminating them completely. Others are sunk to rare paths. This enables a
+        lot of object allocation sinking and it removes a lot of pointless store instructions.
+        
+        It also has downsites. Sinking PutLocals increases register pressure because it increases the
+        live ranges of things like inlined arguments.
+        
+        This patch is a net performance win in its current form: 1% SunSpider regression, 2% OctaneV2
+        progression, 0.6% Kraken regression, 1% AsmBench progression, and 0.5% CompressionBench
+        regression. The biggest win is on Octane/raytrace, which improves by 27%.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        * bytecode/Operands.h:
+        (JSC::Operands::dump): Deleted.
+        * bytecode/OperandsInlines.h:
+        (JSC::Traits>::dump):
+        * bytecode/VirtualRegister.h:
+        (JSC::VirtualRegister::isHeader):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGClobberSet.h:
+        (JSC::DFG::ClobberSetAdd::operator()):
+        (JSC::DFG::ClobberSetOverlaps::operator()):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        (JSC::DFG::NoOpClobberize::operator()):
+        (JSC::DFG::CheckClobberize::operator()):
+        (JSC::DFG::AbstractHeapOverlaps::operator()):
+        (JSC::DFG::ReadMethodClobberize::operator()):
+        (JSC::DFG::WriteMethodClobberize::operator()):
+        (JSC::DFG::DefMethodClobberize::operator()):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::merge):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::capturedVarsFor):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPreciseLocalClobberize.h: Added.
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::PreciseLocalClobberizeAdaptor):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::read):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::write):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::def):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::callIfAppropriate):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::writeTop):
+        (JSC::DFG::forEachLocalReadByUnwind):
+        (JSC::DFG::preciseLocalClobberize):
+        * dfg/DFGPutLocalSinkingPhase.cpp: Added.
+        (JSC::DFG::performPutLocalSinking):
+        * dfg/DFGPutLocalSinkingPhase.h: Added.
+        * dfg/DFGSSACalculator.h:
+        (JSC::DFG::SSACalculator::computePhis):
+        * dfg/DFGValidate.cpp:
+
+2014-10-03  Saam Barati  <saambarati1@gmail.com>
+
+        Change how 32-bit JSValues check if they are a Boolean
+
+        Rubber stamped by Filip Pizlo.
+
+        32-bit JSValue::isBoolean can simply check if its tag corresponds 
+        to the boolean tag instead of checking if it's either true or false.
+
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isBoolean):
+
+2014-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Do all closed variable access through the local lexical object
+        https://bugs.webkit.org/show_bug.cgi?id=136869
+
+        Reviewed by Filip Pizlo.
+
+        This patch makes all reads and writes from captured registers
+        go through the lexical record, and by doing so removes the
+        need for record tearoff.
+
+        To keep the patch simple we still number variables as though
+        they are local stack allocated registers, but ::local() will
+        fail. When local fails we perform a generic resolve, and in
+        that resolve we now use a ResolveScopeInfo struct to pass
+        around information about whether a lookup is a statically
+        known captured variable, and its location in the activation.
+        To ensure correct behaviour during codeblock linking we also
+        add a LocalClosureVariable resolution type.
+
+        To ensure correct semantics for the Arguments object, we now
+        have to eagerly create the Arguments object for any function
+        that uses both the Arguments object and requires a lexical
+        record.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeCapturedVariable):
+          During the entry to a function we are not yet in a position
+          to allocate temporaries so we directly use the lexical
+          environment register.
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::local):
+        (JSC::BytecodeGenerator::constLocal):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitResolveConstantLocal):
+          The two resolve scope operations could technically skip
+          the op_resolve_scope, and simply perform 
+              op_mov dst, recordRegister
+          but for now it seemed best to maintain the same basic
+          behaviour.
+        (JSC::BytecodeGenerator::emitGetFromScope):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+          If we have an environment we've already created Arguments
+          so no need to check again.
+        (JSC::BytecodeGenerator::emitReturn):
+          Don't need to emit tearoff_environment
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::Local::Local):
+        (JSC::Local::operator bool):
+        (JSC::Local::get):
+        (JSC::Local::isReadOnly):
+        (JSC::Local::isSpecial):
+        (JSC::ResolveScopeInfo::ResolveScopeInfo):
+        (JSC::ResolveScopeInfo::isLocal):
+        (JSC::ResolveScopeInfo::localIndex):
+        (JSC::BytecodeGenerator::shouldCreateArgumentsEagerly):
+        (JSC::Local::isCaptured): Deleted.
+        (JSC::Local::captureMode): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::EmptyVarExpression::emitBytecode):
+        (JSC::ForInNode::tryGetBoundLocal):
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::BindingNode::bindValue):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetRegisters):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_captured_mov): Deleted.
+        (JSC::JIT::emit_op_tear_off_lexical_environment): Deleted.
+        (JSC::JIT::emitSlow_op_captured_mov): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_captured_mov): Deleted.
+        (JSC::JIT::emit_op_tear_off_lexical_environment): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOff):
+        * runtime/Arguments.h:
+        (JSC::Arguments::argument):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL): Deleted.
+        * runtime/CommonSlowPaths.h:
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::visitChildren):
+        (JSC::JSLexicalEnvironment::symbolTableGet):
+        (JSC::JSLexicalEnvironment::symbolTablePut):
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        (JSC::JSLexicalEnvironment::getOwnPropertySlot):
+        (JSC::JSLexicalEnvironment::argumentsGetter):
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::JSLexicalEnvironment::create):
+        (JSC::JSLexicalEnvironment::JSLexicalEnvironment):
+        (JSC::JSLexicalEnvironment::tearOff): Deleted.
+        (JSC::JSLexicalEnvironment::isTornOff): Deleted.
+        * runtime/JSScope.cpp:
+        (JSC::resolveTypeName):
+        * runtime/JSScope.h:
+        (JSC::makeType):
+        (JSC::needsVarInjectionChecks):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrier<Unknown>::WriteBarrier):
+
+2014-10-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Object allocation sinking should have a sound story for picking materialization points
+        https://bugs.webkit.org/show_bug.cgi?id=137315
+
+        Reviewed by Oliver Hunt.
+        
+        The only missing piece was having the object allocation sinking phase locate materialization
+        points that were at CFG edges.
+        
+        The logic for how and why this "just works" relies on some properties of critical edge
+        breaking, so I was fairly careful in how I did this. Also, this requires inserting things at
+        the "first origin node" of a block - that is the first node in a block that has a NodeOrigin
+        and therefore is allowed to exit. We basically had support for such a notion before, but
+        didn't close the loop on it; this patch does that.
+        
+        Also I added the ability to provide a BasicBlock* as context for a DFG_ASSERT().
+
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::firstOriginNode):
+        (JSC::DFG::BasicBlock::firstOrigin):
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::crash):
+        (JSC::DFG::Graph::handleAssertionFailure):
+        * dfg/DFGGraph.h:
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+        * dfg/DFGNodeOrigin.h:
+        (JSC::DFG::NodeOrigin::isSet):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+        (JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * runtime/Options.h:
+
+2014-10-02  Daniel Bates  <dabates@apple.com>
+
+        Clean up: Move XPC forward declarations in JavaScriptCore to WTF SPI wrapper header
+        https://bugs.webkit.org/show_bug.cgi?id=137277
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use wtf/spi/darwin/XPCSPI.h instead of including the corresponding XPC headers/
+        forward declaring XPC functions.
+
+        * inspector/remote/RemoteInspector.mm:
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+
+2014-10-01  Anders Carlsson  <andersca@apple.com>
+
+        Use variadic templates for jsMakeNontrivialString
+        https://bugs.webkit.org/show_bug.cgi?id=137325
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSString.h:
+        (JSC::jsNontrivialString):
+        Add an overload that takes an rvalue reference to a String so we can transfer ownership easily.
+
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        Make this a variadic function template, with a single-parameter version that can steal the string if it's OK to do so.
+
+2014-10-02  Mark Lam  <mark.lam@apple.com>
+
+        Fixed the Inspector to be able to properly distinguish between scope types.
+        <https://webkit.org/b/137279>
+
+        Reviewed by Geoffrey Garen.
+
+        The pre-existing code incorrectly labels Catch Scopes and Function Name Scopes
+        as With Scopes.  This patch will fix this.
+
+        * bytecode/BytecodeList.json:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        - These now passes stores the desired JSNameScope::Type in a bytecode operand.
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::isCatchScope):
+        (JSC::DebuggerScope::isFunctionNameScope):
+        - Added queries to be able to explicitly test if the scope is a CatchScope
+          or FunctionNameScope.  The FunctionNameScope is the case where the
+          NameScope is used to capture the function name of a function expression.
+        * debugger/DebuggerScope.h:
+        * inspector/InjectedScriptSource.js:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::scopeType):
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):
+        (Inspector::jsJavaScriptCallFrameConstantFUNCTION_NAME_SCOPE):
+        * inspector/protocol/Debugger.json:
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::addNameScopeIfNeeded):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::isFunctionNameScope):
+        (JSC::JSNameScope::isCatchScope):
+        (JSC::JSNameScope::JSNameScope):
+        - Now stores the JSNameScope::Type in a field.
+
+2014-10-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r174180, r174183, and r174186.
+        https://bugs.webkit.org/show_bug.cgi?id=137320
+
+        Broke the Mac MountainLion build. Will investigate offline.
+        (Requested by dydz on #webkit).
+
+        Reverted changesets:
+
+        "Clean up: Move XPC forward declarations in JavaScriptCore to
+        WTF SPI wrapper header"
+        https://bugs.webkit.org/show_bug.cgi?id=137277
+        http://trac.webkit.org/changeset/174180
+
+        "Attempt to fix the build after
+        <https://trac.webkit.org/changeset/174180>"
+        https://bugs.webkit.org/show_bug.cgi?id=137277
+        http://trac.webkit.org/changeset/174183
+
+        "Another attempt to fix the Mac build after
+        <https://trac.webkit.org/changeset/174180>"
+        https://bugs.webkit.org/show_bug.cgi?id=137277
+        http://trac.webkit.org/changeset/174186
+
+2014-10-01  Daniel Bates  <dabates@apple.com>
+
+        Clean up: Move XPC forward declarations in JavaScriptCore to WTF SPI wrapper header
+        https://bugs.webkit.org/show_bug.cgi?id=137277
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use wtf/spi/darwin/XPCSPI.h instead of including the corresponding XPC headers/
+        forward declaring XPC functions.
+
+        * inspector/remote/RemoteInspector.mm:
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+
+2014-10-01  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed build gardening.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Show files in the appropriate
+        folders in Visual Studio.
+
+2014-10-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Object allocation sinking is broken for escaping sites in loops
+        https://bugs.webkit.org/show_bug.cgi?id=137310
+
+        Reviewed by Michael Saboff.
+        
+        I tried to do this clever forward-flow based materialization point placement, and I messed up loops. Disabling
+        the phase for now and landing a test to demonstrate what it going on.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * runtime/Options.h:
+        * tests/stress/object-escapes-in-loop.js: Added.
+        (foo):
+        (bar):
+
+2014-10-01  Saam Barati  <saambarati1@gmail.com>
+
+        Support the type profiler in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=136712
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements op_profile_type inside the DFG as the node: ProfileType.
+        The DFG will convert the ProfileType node into a Check node in the cases where
+        passing a type check is equivalent to writing to the TypeProfilerLog. This
+        gives the DFG the potential to optimize out multiple ProfileType nodes into
+        a single Check node.
+
+        When the DFG doesn't convert ProfileType into a Check node, it will generate
+        the same inline code as the baseline JIT does for writing an entry to the
+        TypeProfilerLog.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::typeLocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::logTypesForTypeLocation):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::dumpTypes):
+        (JSC::TypeSet::doesTypeConformTo):
+        Make this method public so others can reason about the types a TypeSet has seen.
+        (JSC::TypeSet::seenTypes): Deleted.
+        (JSC::TypeSet::dumpSeenTypes): Deleted.
+        Renamed to dumpTypes so the method seenTypes can be used as a public getter.
+        * runtime/TypeSet.h:
+        (JSC::TypeSet::seenTypes):
+        * tests/typeProfiler/dfg-jit-optimizations.js: Added.
+        (tierUpToDFG):
+        (funcs):
+        (.return):
+
+2014-10-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix 32-bit.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SSA should use PutLocal/KillLocal instead of SetLocal to communicate what is flushed to the stack and when
+        https://bugs.webkit.org/show_bug.cgi?id=137242
+
+        Reviewed by Geoffrey Garen.
+        
+        OSR availability has to do with telling you the various ways that you could go about getting
+        the value of a bytecode variable. It can give you two options: node availability means that
+        there is a node in the DFG IR that has the right value, and flush availability tells you
+        that the value was already stored to the stack. The clients of OSR availability would
+        typically prefer flush over node availability.
+        
+        Previously OSR availability was affected thusly by the various local-related nodes: SetLocal
+        set both the node and flush availability, MovHint set node availability and cleared flush
+        availability, GetArgument set both, and ZombieHint cleared both.
+        
+        A MovHint could be turned into a ZombieHint if its source value was DCEd.
+        
+        The fact that each node affected both node and flush availability caused weirdness. For
+        example it meant that we could not insert MovHints in areas of the CFG where a SetLocal's
+        variable was still live, because then those parts of the code would forget that they had an
+        availability flush. This meant that if a flush was available, we wouldn't insert MovHints,
+        and so we would forget that a node was in fact available. This kind of "either-or" picking
+        was not only hackish but it led to interesting problems for IR transformation: for example
+        if you tried to do any kind of code motion on SetLocals, you had to be super careful because
+        you might violate the rule that "MovHints must exist for a live local if a flush is
+        unavailable".
+        
+        The right thing to do is to have independent nodes for flushing and making nodes available.
+        They shouldn't interact with each other. This patch accomplishes this:
+        
+        - PutLocal means that that a value is to be stored to the stack. It makes a flush available.
+        - KillLocal means that the value stored to the stack is no longer available for the purposes
+          of OSR (i.e. it no longer accurately corresponds to what that actual bytecode variable
+          would have been, so you have to fall back on node availability).
+        - MovHint means that a node is available. It has no effect on flush availability.
+        - ZombieHint means that a node is not available. It has no effect on flush availability.
+        
+        This means that we will see a lot of KillLocals and MovHints right next to each other. It's
+        a bit verbose, but at least it's precise.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAvailability.h:
+        (JSC::DFG::Availability::setFlush):
+        (JSC::DFG::Availability::setNode):
+        (JSC::DFG::Availability::setNodeUnavailable):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::hasVariableAccessData):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasUnlinkedLocal):
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compilePutLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal): Deleted.
+
+2014-10-01  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] 32-bit JavaScriptCore should limit itself to the C loop
+        https://bugs.webkit.org/show_bug.cgi?id=137304
+        <rdar://problem/18375370>
+
+        Reviewed by Michael Saboff.
+
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.pl:
+        Use the C loop for 32-bit builds.
+
+2014-09-30  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: ErrorString should be passed by reference
+        https://bugs.webkit.org/show_bug.cgi?id=137257
+
+        Reviewed by Joseph Pecoraro.
+
+        Pass the leading ErrorString argument by reference, since it is always an out parameter.
+        Clean up callsites where the error message is written.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::evaluate):
+        (Inspector::InjectedScript::callFunctionOn):
+        (Inspector::InjectedScript::evaluateOnCallFrame):
+        (Inspector::InjectedScript::getFunctionDetails):
+        (Inspector::InjectedScript::getProperties):
+        (Inspector::InjectedScript::getInternalProperties):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::makeEvalCall):
+        * inspector/InjectedScriptBase.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorAgent::enable):
+        (Inspector::InspectorAgent::disable):
+        (Inspector::InspectorAgent::initialized):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorConsoleAgent::enable):
+        (Inspector::InspectorConsoleAgent::disable):
+        (Inspector::InspectorConsoleAgent::clearMessages):
+        (Inspector::InspectorConsoleAgent::reset):
+        (Inspector::InspectorConsoleAgent::addMessageToConsole):
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::enable):
+        (Inspector::InspectorDebuggerAgent::disable):
+        (Inspector::InspectorDebuggerAgent::setBreakpointsActive):
+        (Inspector::InspectorDebuggerAgent::breakpointActionsFromProtocol):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::parseLocation):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::removeBreakpoint):
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        (Inspector::InspectorDebuggerAgent::searchInContent):
+        (Inspector::InspectorDebuggerAgent::getScriptSource):
+        (Inspector::InspectorDebuggerAgent::getFunctionDetails):
+        (Inspector::InspectorDebuggerAgent::pause):
+        (Inspector::InspectorDebuggerAgent::resume):
+        (Inspector::InspectorDebuggerAgent::stepOver):
+        (Inspector::InspectorDebuggerAgent::stepInto):
+        (Inspector::InspectorDebuggerAgent::stepOut):
+        (Inspector::InspectorDebuggerAgent::setPauseOnExceptions):
+        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (Inspector::InspectorDebuggerAgent::setOverlayMessage):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        (Inspector::InspectorDebuggerAgent::clearInspectorBreakpointState):
+        (Inspector::InspectorDebuggerAgent::assertPaused):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::parse):
+        (Inspector::InspectorRuntimeAgent::evaluate):
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        (Inspector::InspectorRuntimeAgent::releaseObject):
+        (Inspector::InspectorRuntimeAgent::releaseObjectGroup):
+        (Inspector::InspectorRuntimeAgent::run):
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::InspectorRuntimeAgent::enableTypeProfiler):
+        (Inspector::InspectorRuntimeAgent::disableTypeProfiler):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectConsoleAgent.cpp:
+        (Inspector::JSGlobalObjectConsoleAgent::setMonitoringXHREnabled):
+        (Inspector::JSGlobalObjectConsoleAgent::addInspectedNode):
+        * inspector/agents/JSGlobalObjectConsoleAgent.h:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::injectedScriptForEval):
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        (Inspector::JSGlobalObjectRuntimeAgent::injectedScriptForEval):
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        * inspector/scripts/codegen/generate_backend_dispatcher_header.py:
+        (BackendDispatcherHeaderGenerator._generate_handler_declaration_for_command):
+        (BackendDispatcherHeaderGenerator._generate_async_handler_declaration_for_command):
+        * inspector/scripts/codegen/generate_backend_dispatcher_implementation.py:
+        (BackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+
+2014-09-30  Mark Lam  <mark.lam@apple.com>
+
+        Label some asserts as having security implications.
+        <https://webkit.org/b/137260>
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::handleAssertionFailure):
+        * runtime/JSCell.h:
+        (JSC::jsCast):
+        * runtime/StructureIDTable.h:
+        (JSC::StructureIDTable::get):
+
+2014-09-30  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r174025): Invalid cast in JSC::asString
+        https://bugs.webkit.org/show_bug.cgi?id=137224
+
+        Reviewed by Geoffrey Garen.
+        
+        Store barrier elision in fixup depends on checking the type of the value being stored. It's very important that
+        when we speak of "the value being stored" we are really referring to the right value.
+        
+        The bug here was that the PutClosureVar case was assuming that child2 is the value being stored. It's actually
+        child3. So we were incorrectly removing all barriers from PutClosureVar.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2014-09-30  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: use static Strings instead of AtomicStrings for replay input type tags
+        https://bugs.webkit.org/show_bug.cgi?id=137086
+
+        Reviewed by Joseph Pecoraro.
+
+        This pattern doesn't work when we want to define some inputs in WebKit2.
+        The ReplayInputTypes class was generated from WebCore inputs only. This
+        patch moves all input traits to use static local Strings as type tags.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py: Remove configuration of how
+        type tags are generated, since all framework targets now generate the same code.
+
+        * replay/NondeterministicInput.h:
+        * replay/scripts/CodeGeneratorReplayInputs.py: Simplify and rebase test results.
+        (Generator.generate_input_trait_implementation):
+        * replay/scripts/CodeGeneratorReplayInputsTemplates.py: Simplify templates.
+
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.cpp:
+        (JSC::InputTraits<Test::SavedMouseButton>::type):
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp:
+        (JSC::InputTraits<Test::SavedMouseButton>::type):
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.cpp:
+        (JSC::InputTraits<Test::HandleWheelEvent>::type):
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp:
+        (JSC::InputTraits<Test::FormCombo>::type):
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.cpp:
+        (JSC::InputTraits<Test::GetCurrentTime>::type):
+        (JSC::InputTraits<Test::SetRandomSeed>::type):
+        * replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.cpp:
+        (JSC::InputTraits<Test::ArrayOfThings>::type):
+        (JSC::InputTraits<Test::SavedHistory>::type):
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.cpp:
+        (JSC::InputTraits<Test::ScalarInput1>::type):
+        (JSC::InputTraits<Test::ScalarInput2>::type):
+        * replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.cpp:
+        (JSC::InputTraits<Test::ScalarInput>::type):
+        (JSC::InputTraits<Test::MapInput>::type):
+        * replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.h:
+
+2014-09-30  Daniel Bates  <dabates@apple.com>
+
+        REGRESSION (r172532): JSBase.h declares NSMapTable functions that are SPI
+        https://bugs.webkit.org/show_bug.cgi?id=137170
+        <rdar://problem/18477384>
+
+        Reviewed by Geoffrey Garen.
+
+        Move conditional include of header Foundation/NSMapTablePriv.h and forward declarations
+        of NSMapTable SPI from file JavaScriptCore/API/JSBase.h to WTF/wtf/spi/cocoa/NSMapTableSPI.h.
+
+        * API/JSBase.h:
+        * API/JSManagedValue.mm: Include header WTF/wtf/spi/cocoa/NSMapTableSPI.h.
+        * API/JSVirtualMachine.mm: Ditto.
+        * API/JSVirtualMachineInternal.h: Forward declare class NSMapTable.
+        * API/JSWrapperMap.mm: Include header WTF/wtf/spi/cocoa/NSMapTableSPI.h. Also, order
+        #include directives such that they are sorted in alphabetical order.
+
+2014-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Fix C API header
+        https://bugs.webkit.org/show_bug.cgi?id=137254
+        <rdar://problem/18487528>
+
+        Build fix
+
+        Guard extern "C" behind __cplusplus ifdef
+
+        * API/JSBase.h:
+
+2014-09-29  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: InjectedScripts should not be profiled or displayed in Timeline
+        https://bugs.webkit.org/show_bug.cgi?id=136806
+
+        Reviewed by Timothy Hatcher.
+
+        It doesn't make sense to show profile nodes for injected scripts when profiling user content.
+        For now, omit nodes by suspending profiling before and after executing injected scripts.
+
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::suspendProfiling): Added.
+        (JSC::LegacyProfiler::unsuspendProfiling): Added.
+        * profiler/LegacyProfiler.h:
+        * profiler/ProfileGenerator.cpp: Add isSuspended() flag, remove unused typedef.
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * profiler/ProfileGenerator.h:
+        (JSC::ProfileGenerator::setIsSuspended): Added.
+
+2014-09-29  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: InspectorValues should use references for out parameters
+        https://bugs.webkit.org/show_bug.cgi?id=137190
+
+        Reviewed by Joseph Pecoraro.
+
+        Use references for out parameters in asType() and getType() methods.
+        Also convert to references in some miscellaneous code where we don't
+        expect or handle null values.
+
+        Remove variants of asObject() and asArray() that return a nullable RefPtr.
+        Now, client code is forced to use out parameters and check for cast failure.
+
+        Iron out control flow in some functions and fix some style issues.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getFunctionDetails):
+        (Inspector::InjectedScript::wrapObject):
+        (Inspector::InjectedScript::wrapTable):
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::makeEvalCall):
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::injectedScriptForObjectId): Simplify control flow.
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::InspectorBackendDispatcher::dispatch):
+        (Inspector::getPropertyValue):
+        (Inspector::AsMethodBridges::asInteger):
+        (Inspector::AsMethodBridges::asDouble):
+        (Inspector::AsMethodBridges::asString):
+        (Inspector::AsMethodBridges::asBoolean):
+        (Inspector::AsMethodBridges::asObject):
+        (Inspector::AsMethodBridges::asArray):
+        * inspector/InspectorProtocolTypes.h:
+        (Inspector::Protocol::BindingTraits<Protocol::Array<T>>::runtimeCast):
+        (Inspector::Protocol::BindingTraits<Protocol::Array<T>>::assertValueHasExpectedType):
+        * inspector/InspectorValues.cpp: Use more by-reference out parameters. Add more spacing.
+        (Inspector::InspectorValue::asBoolean):
+        (Inspector::InspectorValue::asDouble):
+        (Inspector::InspectorValue::asInteger):
+        (Inspector::InspectorValue::asString):
+        (Inspector::InspectorValue::asValue):
+        (Inspector::InspectorValue::asObject):
+        (Inspector::InspectorValue::asArray):
+        (Inspector::InspectorValue::parseJSON):
+        (Inspector::InspectorValue::toJSONString):
+        (Inspector::InspectorValue::writeJSON):
+        (Inspector::InspectorBasicValue::asBoolean):
+        (Inspector::InspectorBasicValue::asDouble):
+        (Inspector::InspectorBasicValue::asInteger):
+        (Inspector::InspectorBasicValue::writeJSON):
+        (Inspector::InspectorString::asString):
+        (Inspector::InspectorString::writeJSON):
+        (Inspector::InspectorObjectBase::asObject):
+        (Inspector::InspectorObjectBase::openAccessors):
+        (Inspector::InspectorObjectBase::getBoolean):
+        (Inspector::InspectorObjectBase::getString):
+        (Inspector::InspectorObjectBase::getObject):
+        (Inspector::InspectorObjectBase::getArray):
+        (Inspector::InspectorObjectBase::writeJSON):
+        (Inspector::InspectorArrayBase::asArray):
+        (Inspector::InspectorArrayBase::writeJSON):
+        * inspector/InspectorValues.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::breakpointActionsFromProtocol):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::parseLocation):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * inspector/scripts/codegen/generate_protocol_types_implementation.py:
+        (ProtocolTypesImplementationGenerator):
+        (ProtocolTypesImplementationGenerator._generate_assertion_for_enum):
+        * inspector/scripts/codegen/generator_templates.py:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * replay/EncodedValue.cpp:
+        (JSC::EncodedValue::asObject):
+        (JSC::EncodedValue::asArray):
+        (JSC::EncodedValue::convertTo<bool>):
+        (JSC::EncodedValue::convertTo<double>):
+        (JSC::EncodedValue::convertTo<float>):
+        (JSC::EncodedValue::convertTo<int32_t>):
+        (JSC::EncodedValue::convertTo<int64_t>):
+        (JSC::EncodedValue::convertTo<uint32_t>):
+        (JSC::EncodedValue::convertTo<uint64_t>):
+        (JSC::EncodedValue::convertTo<String>):
+
+2014-09-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG HasStructureProperty codegen should use one fewer registers
+        https://bugs.webkit.org/show_bug.cgi?id=137235
+
+        Reviewed by Andreas Kling.
+        
+        This was an obvious source of inefficiency and it was causing us to run out of registers on
+        x86-32.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-09-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't use GPRResult unless you're flushing registers and making a runtime function call
+        https://bugs.webkit.org/show_bug.cgi?id=137234
+
+        Rubber stamped by Andreas Kling.
+
+        Rename GPRResult to GPRFlushedCallResult, in an attempt to dissuade people from using it for results in the
+        general case.
+        
+        Replace GPRResult with GPRTemporary in those places where it was causing bugs: particularly in GetDirectPname it
+        would cause us to spill the register that has the base, and the code was assuming (rightly) that the base and the
+        result were in different registers. That's a valid assumption when using GPRTemporary but not with GPRResult.
+        Also this code wasn't getting any benefit from using GPRResult because it wasn't doing flushRegisters().
+        
+        I don't know how to test this. A test would require setting up a particularly awkward register allocation state.
+        
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::GPRFlushedCallResult::GPRFlushedCallResult):
+        (JSC::DFG::GPRFlushedCallResult2::GPRFlushedCallResult2):
+        (JSC::DFG::GPRResult::GPRResult): Deleted.
+        (JSC::DFG::GPRResult2::GPRResult2): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt):
+
+2014-09-29  Diego Pino Garcia  <dpino@igalia.com>
+
+        Missing changes from r174049
+        https://bugs.webkit.org/show_bug.cgi?id=137206
+
+        Reviewed by Darin Adler.
+
+        * runtime/CommonIdentifiers.h:
+
+2014-09-28  Diego Pino Garcia  <dpino@igalia.com>
+
+        Simple ES6 feature: Number constructor extras
+        https://bugs.webkit.org/show_bug.cgi?id=131707
+
+        Reviewed by Darin Adler.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation): Setup constants and
+        functions.
+        (JSC::numberConstructorFuncIsFinite): Added.
+        (JSC::numberConstructorFuncIsInteger): Added.
+        (JSC::numberConstructorFuncIsNaN): Added.
+        (JSC::numberConstructorFuncIsSafeInteger): Added.
+        (JSC::NumberConstructor::getOwnPropertySlot): Deleted.
+        (JSC::numberConstructorNaNValue): Deleted.
+        (JSC::numberConstructorNegInfinity): Deleted.
+        (JSC::numberConstructorPosInfinity): Deleted.
+        (JSC::numberConstructorMaxValue): Deleted.
+        (JSC::numberConstructorMinValue): Deleted.
+        * runtime/NumberConstructor.h:
+
+2014-09-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Disable function.arguments
+        https://bugs.webkit.org/show_bug.cgi?id=137167
+
+        Rubber stamped by Geoffrey Garen.
+        
+        Add an option to disable function.arguments. Add a test for disabling it.
+        
+        Disabling function.arguments means that it returns an Arguments object that claims that
+        there were zero arguments. All other Arguments functionality still works, so any code
+        that tries to inspect this object will still think that it is looking at a perfectly
+        valid Arguments object.
+        
+        This also makes function.arguments disabled by default. Note that the RJST harness will
+        enable them by default, to continue to get test coverage for the code that implements
+        the feature.
+        
+        We will rip out that code once we're confident that it's really safe to remove this
+        feature. Only once we rip out that support will we be able to do optimizations to
+        leverage the lack of this feature. It's important to keep the support code, and the test
+        infrastructure, in place before we are confident. The logic to keep this working touches
+        the entire compiler and a large chunk of the runtime, so reimplementing it - or even
+        merging it back in - would be a nightmare. That's also basically the reason why we want
+        to rip it out if at all possible. It's a lot of terrible code.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::createArguments):
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::finishCreation):
+        * runtime/Options.h:
+        * tests/stress/disable-function-dot-arguments.js: Added.
+        (foo):
+        (bar):
+
+2014-09-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Automatic Inspection should continue once all breakpoints are loaded
+        https://bugs.webkit.org/show_bug.cgi?id=137038
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new protocol command "Inspector.initialized" that signifies to the backend
+        when the frontend has sent all its initialization messages to the backend. This
+        can include information like breakpoints, which we would want to have loaded
+        before any JavaScript evaluates in the context.
+
+        * inspector/protocol/InspectorDomain.json:
+        New protocol command, Inspector.initialized.
+
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::InspectorAgent):
+        (Inspector::InspectorAgent::initialized):
+        Tell the InspectorEnvironment (the Controller) the frontend has initialized.
+
+        * inspector/InspectorEnvironment.h:
+        Abstract virtual method to handle frontend initialization. To be
+        implemented by all of the InspectorControllers.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::frontendInitialized):
+        When a frontend is initialized, if it was automatic inspection unpause the debuggable.
+
+        * inspector/remote/RemoteInspectorDebuggable.cpp:
+        (Inspector::RemoteInspectorDebuggable::unpauseForInitializedInspector):
+        Complete setup for this debuggable.
+
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        Move the setup complete to later, when the frontend sends an "initialized" message.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::updateDebuggableAutomaticInspectCandidate):
+        Provide a longer timeout now that the frontend must send messages after the connection
+        has established. The longest I have seen in  600ms, but the average tends to be 200ms.
+        So bump the timeout to 800ms for a buffer.
+
+        (Inspector::RemoteInspector::setupSucceeded): Deleted.
+        (Inspector::RemoteInspector::setupCompleted):
+        Rename, as this happens at a slightly different time.
+
+2014-09-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG shouldn't insert store barriers when it has it on good authority that we're not storing a cell
+        https://bugs.webkit.org/show_bug.cgi?id=137161
+
+        Reviewed by Mark Hahnenberg.
+        
+        This looks like a 1% Octane speed-up.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isNotCellSpeculation):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::insertStoreBarrier):
+        (JSC::DFG::FixupPhase::insertCheck):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateNotCell):
+
+2014-09-26  Peter Varga  <pvarga@webkit.org>
+
+        Fix typo in YARR at BOL check
+        https://bugs.webkit.org/show_bug.cgi?id=137144
+
+        Reviewed by Darin Adler.
+
+        * yarr/YarrPattern.cpp: replace bitwise and operator by logical and
+        (JSC::Yarr::YarrPatternConstructor::assertionBOL):
+
+2014-09-25  Saam Barati  <saambarati1@gmail.com>
+
+        Web Inspector: console.assert(bitString) TypeSet:50 
+        https://bugs.webkit.org/show_bug.cgi?id=137051
+
+        Reviewed by Joseph Pecoraro.
+
+        This patch creates stricter requirements on a TypeDescription
+        being valid. To be valid, a TypeDescription now ensures that 
+        the TypeSet it describes has non null type information.
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * runtime/TypeSet.h:
+        (JSC::TypeSet::isEmpty):
+
+2014-09-25  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should sink object allocations
+        https://bugs.webkit.org/show_bug.cgi?id=136330
+
+        Reviewed by Oliver Hunt.
+        
+        This adds a comprehensive infrastructure for sinking object allocations in DFG SSA form. The
+        ultimate goal of sinking is to sink an allocation "past the points of its death" - i.e. to
+        eliminate it completely. The way sinking reasons about the CFG means that it resembles a
+        partial escape analysis: we create paths through a function where some allocation(s) don't
+        have to be done at all even if there are other paths along which those allocations still have
+        to happen. But it also produces other side benefits. Even if an allocation isn't eliminated
+        along any path, the act of sinking reduces the number of barriers that have to execute.
+        
+        Because this was a fairly ambituous SSA analysis and transformation, I added a bunch of C++11
+        sugar to the DFG's internal APIs to allow for easier iteration over blocks, nodes, and
+        successors; and to add more functor goodness to allow for more lambdas.
+        
+        This is just the beginning. The bug has a bunch of other bugs that depend on it. So far this
+        is a spectacular speed-up on microbenchmarks but it's still too limited to affect big
+        benchmarks. For example, doing o == p makes the sinking phase think that o and p escape.
+        That's just an omission and there are likely others; we can easily fix them. I think it's
+        best to land it in its current form and then to worry about the big benchmarks in subsequent
+        work (see bug 137126).
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::iterator::iterator):
+        (JSC::StructureSet::iterator::operator*):
+        (JSC::StructureSet::iterator::operator++):
+        (JSC::StructureSet::iterator::operator==):
+        (JSC::StructureSet::iterator::operator!=):
+        (JSC::StructureSet::begin):
+        (JSC::StructureSet::end):
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::phiChildren):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::AbstractInterpreter):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::startExecuting):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::execute):
+        * dfg/DFGAvailability.h:
+        (JSC::DFG::Availability::shouldUseNode):
+        (JSC::DFG::Availability::isFlushUseful):
+        (JSC::DFG::Availability::isDead):
+        (JSC::DFG::Availability::operator!=):
+        * dfg/DFGAvailabilityMap.cpp: Added.
+        (JSC::DFG::AvailabilityMap::prune):
+        (JSC::DFG::AvailabilityMap::clear):
+        (JSC::DFG::AvailabilityMap::dump):
+        (JSC::DFG::AvailabilityMap::operator==):
+        (JSC::DFG::AvailabilityMap::merge):
+        * dfg/DFGAvailabilityMap.h: Added.
+        (JSC::DFG::AvailabilityMap::forEachAvailability):
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::SSAData::SSAData):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::begin):
+        (JSC::DFG::BasicBlock::end):
+        (JSC::DFG::BasicBlock::SuccessorsIterable::SuccessorsIterable):
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::iterator):
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator*):
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator++):
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator==):
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator!=):
+        (JSC::DFG::BasicBlock::SuccessorsIterable::begin):
+        (JSC::DFG::BasicBlock::SuccessorsIterable::end):
+        (JSC::DFG::BasicBlock::successors):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGFlushedAt.cpp:
+        (JSC::DFG::FlushedAt::dump):
+        * dfg/DFGFlushedAt.h:
+        (JSC::DFG::FlushedAt::FlushedAt):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::mergeRelevantToOSR):
+        (JSC::DFG::Graph::invalidateCFG):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::NaturalBlockIterable::NaturalBlockIterable):
+        (JSC::DFG::Graph::NaturalBlockIterable::iterator::iterator):
+        (JSC::DFG::Graph::NaturalBlockIterable::iterator::operator*):
+        (JSC::DFG::Graph::NaturalBlockIterable::iterator::operator++):
+        (JSC::DFG::Graph::NaturalBlockIterable::iterator::operator==):
+        (JSC::DFG::Graph::NaturalBlockIterable::iterator::operator!=):
+        (JSC::DFG::Graph::NaturalBlockIterable::iterator::findNext):
+        (JSC::DFG::Graph::NaturalBlockIterable::begin):
+        (JSC::DFG::Graph::NaturalBlockIterable::end):
+        (JSC::DFG::Graph::blocksInNaturalOrder):
+        (JSC::DFG::Graph::doToChildrenWithNode):
+        (JSC::DFG::Graph::doToChildren):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGInsertOSRHintsForUpdate.cpp: Added.
+        (JSC::DFG::insertOSRHintsForUpdate):
+        * dfg/DFGInsertOSRHintsForUpdate.h: Added.
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::graph):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPutByOffsetHint):
+        (JSC::DFG::Node::convertToPutStructureHint):
+        (JSC::DFG::Node::convertToPhantomNewObject):
+        (JSC::DFG::Node::isCellConstant):
+        (JSC::DFG::Node::castConstant):
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::hasStorageAccessData):
+        (JSC::DFG::Node::hasObjectMaterializationData):
+        (JSC::DFG::Node::objectMaterializationData):
+        (JSC::DFG::Node::isPhantomObjectAllocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::endBlock):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp: Added.
+        (JSC::DFG::ObjectAllocationSinkingPhase::ObjectAllocationSinkingPhase):
+        (JSC::DFG::ObjectAllocationSinkingPhase::run):
+        (JSC::DFG::ObjectAllocationSinkingPhase::performSinking):
+        (JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+        (JSC::DFG::ObjectAllocationSinkingPhase::resolve):
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        (JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize):
+        (JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize):
+        (JSC::DFG::performObjectAllocationSinking):
+        * dfg/DFGObjectAllocationSinkingPhase.h: Added.
+        * dfg/DFGObjectMaterializationData.cpp: Added.
+        (JSC::DFG::PhantomPropertyValue::dump):
+        (JSC::DFG::ObjectMaterializationData::dump):
+        (JSC::DFG::ObjectMaterializationData::oneWaySimilarityScore):
+        (JSC::DFG::ObjectMaterializationData::similarityScore):
+        * dfg/DFGObjectMaterializationData.h: Added.
+        (JSC::DFG::PhantomPropertyValue::PhantomPropertyValue):
+        (JSC::DFG::PhantomPropertyValue::operator==):
+        * dfg/DFGPhantomCanonicalizationPhase.cpp:
+        (JSC::DFG::PhantomCanonicalizationPhase::run):
+        * dfg/DFGPhantomRemovalPhase.cpp:
+        (JSC::DFG::PhantomRemovalPhase::run):
+        * dfg/DFGPhiChildren.cpp: Added.
+        (JSC::DFG::PhiChildren::PhiChildren):
+        (JSC::DFG::PhiChildren::~PhiChildren):
+        (JSC::DFG::PhiChildren::upsilonsOf):
+        * dfg/DFGPhiChildren.h: Added.
+        (JSC::DFG::PhiChildren::forAllIncomingValues):
+        (JSC::DFG::PhiChildren::forAllTransitiveIncomingValues):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPrePostNumbering.cpp: Added.
+        (JSC::DFG::PrePostNumbering::PrePostNumbering):
+        (JSC::DFG::PrePostNumbering::~PrePostNumbering):
+        (JSC::DFG::PrePostNumbering::compute):
+        (WTF::printInternal):
+        * dfg/DFGPrePostNumbering.h: Added.
+        (JSC::DFG::PrePostNumbering::preNumber):
+        (JSC::DFG::PrePostNumbering::postNumber):
+        (JSC::DFG::PrePostNumbering::isStrictAncestorOf):
+        (JSC::DFG::PrePostNumbering::isAncestorOf):
+        (JSC::DFG::PrePostNumbering::isStrictDescendantOf):
+        (JSC::DFG::PrePostNumbering::isDescendantOf):
+        (JSC::DFG::PrePostNumbering::edgeKind):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPromoteHeapAccess.h: Added.
+        (JSC::DFG::promoteHeapAccess):
+        * dfg/DFGPromotedHeapLocation.cpp: Added.
+        (JSC::DFG::PromotedLocationDescriptor::dump):
+        (JSC::DFG::PromotedHeapLocation::createHint):
+        (JSC::DFG::PromotedHeapLocation::dump):
+        (WTF::printInternal):
+        * dfg/DFGPromotedHeapLocation.h: Added.
+        (JSC::DFG::PromotedLocationDescriptor::PromotedLocationDescriptor):
+        (JSC::DFG::PromotedLocationDescriptor::operator!):
+        (JSC::DFG::PromotedLocationDescriptor::kind):
+        (JSC::DFG::PromotedLocationDescriptor::info):
+        (JSC::DFG::PromotedLocationDescriptor::hash):
+        (JSC::DFG::PromotedLocationDescriptor::operator==):
+        (JSC::DFG::PromotedLocationDescriptor::operator!=):
+        (JSC::DFG::PromotedLocationDescriptor::isHashTableDeletedValue):
+        (JSC::DFG::PromotedHeapLocation::PromotedHeapLocation):
+        (JSC::DFG::PromotedHeapLocation::operator!):
+        (JSC::DFG::PromotedHeapLocation::kind):
+        (JSC::DFG::PromotedHeapLocation::base):
+        (JSC::DFG::PromotedHeapLocation::info):
+        (JSC::DFG::PromotedHeapLocation::descriptor):
+        (JSC::DFG::PromotedHeapLocation::hash):
+        (JSC::DFG::PromotedHeapLocation::operator==):
+        (JSC::DFG::PromotedHeapLocation::isHashTableDeletedValue):
+        (JSC::DFG::PromotedHeapLocationHash::hash):
+        (JSC::DFG::PromotedHeapLocationHash::equal):
+        * dfg/DFGSSACalculator.cpp:
+        (JSC::DFG::SSACalculator::reset):
+        * dfg/DFGSSACalculator.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLExitPropertyValue.cpp: Added.
+        (JSC::FTL::ExitPropertyValue::dump):
+        * ftl/FTLExitPropertyValue.h: Added.
+        (JSC::FTL::ExitPropertyValue::ExitPropertyValue):
+        (JSC::FTL::ExitPropertyValue::operator!):
+        (JSC::FTL::ExitPropertyValue::location):
+        (JSC::FTL::ExitPropertyValue::value):
+        * ftl/FTLExitTimeObjectMaterialization.cpp: Added.
+        (JSC::FTL::ExitTimeObjectMaterialization::ExitTimeObjectMaterialization):
+        (JSC::FTL::ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization):
+        (JSC::FTL::ExitTimeObjectMaterialization::add):
+        (JSC::FTL::ExitTimeObjectMaterialization::get):
+        (JSC::FTL::ExitTimeObjectMaterialization::dump):
+        * ftl/FTLExitTimeObjectMaterialization.h: Added.
+        (JSC::FTL::ExitTimeObjectMaterialization::type):
+        (JSC::FTL::ExitTimeObjectMaterialization::properties):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::materializeNewObject):
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::isObjectMaterialization):
+        (JSC::FTL::ExitValue::objectMaterialization):
+        (JSC::FTL::ExitValue::withVirtualRegister):
+        (JSC::FTL::ExitValue::valueFormat):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+        (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileNewObject):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructureImmediate):
+        (JSC::FTL::LowerDFGToLLVM::compileMaterializeNewObject):
+        (JSC::FTL::LowerDFGToLLVM::checkStructure):
+        (JSC::FTL::LowerDFGToLLVM::allocateCell):
+        (JSC::FTL::LowerDFGToLLVM::storeStructure):
+        (JSC::FTL::LowerDFGToLLVM::allocateObject):
+        (JSC::FTL::LowerDFGToLLVM::speculateStringObjectForStructureID):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
+        (JSC::FTL::LowerDFGToLLVM::weakStructureID):
+        (JSC::FTL::LowerDFGToLLVM::weakStructure):
+        (JSC::FTL::LowerDFGToLLVM::availabilityMap):
+        (JSC::FTL::LowerDFGToLLVM::availability): Deleted.
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileRecovery):
+        (JSC::FTL::compileStub):
+        * ftl/FTLOperations.cpp: Added.
+        (JSC::FTL::operationNewObjectWithButterfly):
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * ftl/FTLOperations.h: Added.
+        * ftl/FTLSwitchCase.h:
+        (JSC::FTL::SwitchCase::SwitchCase):
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSFinalObject::create):
+        * runtime/Structure.cpp:
+        (JSC::Structure::canUseForAllocationsOf):
+        * runtime/Structure.h:
+        * tests/stress/elidable-new-object-roflcopter-then-exit.js: Added.
+        (sumOfArithSeries):
+        (foo):
+        * tests/stress/elide-new-object-dag-then-exit.js: Added.
+        (sumOfArithSeries):
+        (bar):
+        (verify):
+        (foo):
+        * tests/stress/obviously-elidable-new-object-then-exit.js: Added.
+        (sumOfArithSeries):
+        (foo):
+
+2014-09-25  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: Check event loop input extents during replaying too
+        https://bugs.webkit.org/show_bug.cgi?id=136316
+
+        Reviewed by Timothy Hatcher.
+
+        Sometimes we see different nondeterminism during capture and replay
+        executions, so we should add determinism checks during replay too.
+
+        Move the withinEventLoopInputExtent flag to the base class, and tighten
+        the assertion to address <http://webkit.org/b/133019>.
+
+        * replay/InputCursor.h:
+        (JSC::InputCursor::InputCursor):
+        (JSC::InputCursor::setWithinEventLoopInputExtent): Added.
+        This assertion is slightly wrong because it does not account for nested run loops.
+        We can be within two input extents when a nested run loop processes additional
+        user inputs while the debugger is paused.
+
+        This should only be the case when execution is being neither captured or
+        replayed. The debugger should not pause when capturing, and we should not replay
+        event loop inputs while in a nested run loop.
+
+        (JSC::InputCursor::withinEventLoopInputExtent): Added.
+
+2014-09-25  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove WinCE port from trunk
+        https://bugs.webkit.org/show_bug.cgi?id=136951
+
+        Reviewed by Alex Christensen.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::cacheFlush):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::cacheFlush):
+        * config.h:
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherFromOtherThread):
+        (JSC::swapIfBackwards): Deleted.
+        * jit/ExecutableAllocator.h:
+        * jsc.cpp:
+        (main):
+        * runtime/DateConstructor.cpp:
+        * runtime/Options.cpp:
+        (JSC::overrideOptionWithHeuristic):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * testRegExp.cpp:
+        (main):
+        * tools/CodeProfiling.cpp:
+        (JSC::CodeProfiling::notifyAllocator):
+
+2014-09-24  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: subtract elapsed time while debugger is paused from profile nodes
+        https://bugs.webkit.org/show_bug.cgi?id=136796
+
+        Reviewed by Timothy Hatcher.
+
+        Rather than accruing no time to any profile node created while the debugger is paused,
+        we can instead count a node's elapsed time and exclude time elapsed while paused.
+
+        Time for a node may elapse in a non-contiguous fashion depending on the interleaving of
+        didPause, didContinue, willExecute, and didExecute. A node's start time is set to the
+        start of the last such interval that accrues elapsed time.
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::ProfileGenerator::beginCallEntry):
+        (JSC::ProfileGenerator::endCallEntry):
+        (JSC::ProfileGenerator::didPause): Added.
+        (JSC::ProfileGenerator::didContinue): Added.
+        * profiler/ProfileGenerator.h:
+        (JSC::ProfileGenerator::didPause): Deleted.
+        (JSC::ProfileGenerator::didContinue): Deleted.
+        * profiler/ProfileNode.h: Rename totalTime to elapsedTime.
+        (JSC::ProfileNode::Call::Call):
+        (JSC::ProfileNode::Call::elapsedTime): Added.
+        (JSC::ProfileNode::Call::setElapsedTime): Added.
+        (JSC::CalculateProfileSubtreeDataFunctor::operator()):
+        (JSC::ProfileNode::Call::totalTime): Deleted.
+        (JSC::ProfileNode::Call::setTotalTime): Deleted.
+
+2014-09-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r173839.
+        https://bugs.webkit.org/show_bug.cgi?id=137062
+
+        NumberConstruct should no longer use static tables (Requested
+        by dpino on #webkit).
+
+        Reverted changeset:
+
+        "Simple ES6 feature: Number constructor extras"
+        https://bugs.webkit.org/show_bug.cgi?id=131707
+        http://trac.webkit.org/changeset/173839
+
+2014-09-23  Mark Lam  <mark.lam@apple.com>
+
+        DebuggerCallFrame::invalidate() should invalidate all DebuggerScope chains.
+        <https://webkit.org/b/137045>
+
+        Reviewed by Geoffrey Garen.
+
+        DebuggerCallFrame::invalidate() currently invalidates all DebuggerCallFrames
+        in the debugger stack, but only invalidates the DebuggerScope chain of the
+        top most frame.  We should also invalidate all the DebuggerScope chains of
+        the other frames in the debugger stack.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::invalidate):
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::invalidateChain):
+
+2014-09-23  Mark Lam  <mark.lam@apple.com>
+
+        Renamed DebuggerCallFrameScope to DebuggerPausedScope.
+        <https://webkit.org/b/137042>
+
+        Reviewed by Michael Saboff.
+
+        DebuggerPausedScope is a better name for this data structure because it
+        is meant for tracking the period within which the debugger is paused,
+        and doing clean ups after the pause ends.
+
+        * debugger/Debugger.cpp:
+        (JSC::DebuggerPausedScope::DebuggerPausedScope):
+        (JSC::DebuggerPausedScope::~DebuggerPausedScope):
+        (JSC::Debugger::pauseIfNeeded):
+        (JSC::DebuggerCallFrameScope::DebuggerCallFrameScope): Deleted.
+        (JSC::DebuggerCallFrameScope::~DebuggerCallFrameScope): Deleted.
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.h:
+
+2014-09-23  Tomas Popela  <tpopela@redhat.com>
+
+        [CLoop] - Fix CLoop on the 32-bit Big-Endians
+        https://bugs.webkit.org/show_bug.cgi?id=137020
+
+        Reviewed by Mark Lam.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+
+2014-09-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Should be able to attach a debugger to a JSContext before anything is executed
+        https://bugs.webkit.org/show_bug.cgi?id=136893
+
+        Reviewed by Timothy Hatcher.
+
+        Adds new remote inspector protocol handling for automatic inspection.
+        Debuggers can signal they have enabled automatic inspection, and
+        when debuggables are created the current application will pause to
+        see if the debugger will inspect or decline to inspect the debuggable.
+
+        * inspector/remote/RemoteInspectorConstants.h:
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::globalAutomaticInspectionState):
+        (Inspector::RemoteInspector::RemoteInspector):
+        (Inspector::RemoteInspector::start):
+        When first starting, check the global "is there an auto-inspect" debugger state.
+        This is necessary so that the current application knows if it should pause or
+        not when a debuggable is created, even without having connected to webinspectord yet.
+
+        (Inspector::RemoteInspector::updateDebuggableAutomaticInspectCandidate):
+        When a debuggable has enabled remote inspection, take this path to propose
+        it as an automatic inspection candidate if there is an auto-inspect debugger.
+
+        (Inspector::RemoteInspector::sendAutomaticInspectionCandidateMessage):
+        Send the automatic inspection candidate message.
+
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        (Inspector::RemoteInspector::setupFailed):
+        (Inspector::RemoteInspector::setupSucceeded):
+        After attempting to open an inspector, unpause if it was for the
+        automatic inspection candidate.
+
+        (Inspector::RemoteInspector::waitingForAutomaticInspection):
+        When running a nested runloop, check if we should remain paused.
+
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        If by the time we connect to webinspectord we have a candidate, then
+        immediately send the candidate message.
+
+        (Inspector::RemoteInspector::stopInternal):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        In error cases, clear our state.
+
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        (Inspector::RemoteInspector::receivedAutomaticInspectionConfigurationMessage):
+        (Inspector::RemoteInspector::receivedAutomaticInspectionRejectMessage):
+        Update state when receiving new messages.
+
+
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggable.cpp:
+        (Inspector::RemoteInspectorDebuggable::setRemoteDebuggingAllowed):
+        Special case when a debuggable is newly allowed to be debuggable.
+
+        (Inspector::RemoteInspectorDebuggable::pauseWaitingForAutomaticInspection):
+        Run a nested run loop while this is an automatic inspection candidate.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        When the inspector starts via automatic inspection automatically pause.
+        We plan on removing this condition by having the frontend signal to the
+        backend when it is completely initialized.
+        
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        Pass on the flag of whether or not this was automatic inspection.
+
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::pauseWaitingForAutomaticInspection):
+        When pausing in a JSGlobalObject we need to release the API lock.
+
+2014-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL allocatePropertyStorage code should involve less copy-paste
+        https://bugs.webkit.org/show_bug.cgi?id=137006
+
+        Reviewed by Michael Saboff.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::allocatePropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::reallocatePropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::allocatePropertyStorageWithSizeImpl):
+
+2014-09-22  Diego Pino Garcia  <dpino@igalia.com>
+
+        Simple ES6 feature: Number constructor extras
+        https://bugs.webkit.org/show_bug.cgi?id=131707
+
+        Reviewed by Darin Adler.
+
+        * runtime/CommonIdentifiers.h: Added new identifiers.
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        (JSC::NumberConstructor::isFunction): Added.
+        (JSC::numberConstructorEpsilonValue): Added.
+        (JSC::numberConstructorNegInfinity): Added.
+        (JSC::numberConstructorPosInfinity): Added.
+        (JSC::numberConstructorMaxValue): Added.
+        (JSC::numberConstructorMinValue): Added.
+        (JSC::numberConstructorMaxSafeInteger): Added.
+        (JSC::numberConstructorMinSafeInteger): Added.
+        (JSC::numberConstructorFuncIsFinite): Added.
+        (JSC::numberConstructorFuncIsInteger): Added.
+        (JSC::numberConstructorFuncIsNaN): Added.
+        (JSC::numberConstructorFuncIsSafeInteger): Added.
+        * runtime/NumberConstructor.h:
+
+2014-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should store the four bytes of the cell header using a 32-bit store rather than four 8-bit stores
+        https://bugs.webkit.org/show_bug.cgi?id=136992
+
+        Reviewed by Sam Weinig.
+        
+        LLVM ought to be able to do this optimization for us given how the code was written, but
+        any such lower-level attempts to optimize this would get into trouble with the weird
+        object materialization logic I'll be introducing in bug 136330. So, this brings the
+        merging of the byte stores into the FTL lowering so that we can control it explicitly.
+
+        * ftl/FTLAbstractHeap.h:
+        (JSC::FTL::AbstractHeap::changeParent):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::allocateCell):
+
+2014-09-21  Saam Barati  <saambarati1@gmail.com>
+
+        Web Inspector: fix TypeSet hierarchy in TypeTokenView
+        https://bugs.webkit.org/show_bug.cgi?id=136982
+
+        Reviewed by Joseph Pecoraro.
+
+        TypeSet was computing the set of type booleans in the Inspector::Protocol::Runtime::TypeSet 
+        object incorrectly because it was calling TypeSet::doesTypeConformTo(T) which checks if the 
+        type set has only been of type T. It now checks '(m_seenTypes & T) != TypeNothing' to see 
+        if type T is in the set of seen types, but not the entire set itself.
+
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::inspectorTypeSet):
+
+2014-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure should have a method for concurrently getting all of the property map entries, and this method shouldn't involve copy-paste
+        https://bugs.webkit.org/show_bug.cgi?id=136983
+
+        Reviewed by Mark Hahnenberg.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry): Moved PropertyMapEntry struct to Structure.h so that Structure can refer to it.
+        * runtime/Structure.cpp:
+        (JSC::Structure::getConcurrently): Switch to using the new forEachPropertyConcurrently() method.
+        (JSC::Structure::getPropertiesConcurrently): The subject of this patch. It will be useful for object allocation sinking (bug 136330).
+        (JSC::Structure::dump): Switch to using the new forEachPropertyConcurrently() method.
+        * runtime/Structure.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry): Moved from PropertyMapHashTable.h.
+        * runtime/StructureInlines.h:
+        (JSC::Structure::forEachPropertyConcurrently): Capture this very common concurrent structure iteration pattern into a template method.
+
+2014-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure::getConcurrently() doesn't need to take a VM& argument.
+
+        Rubber stamped by Dan Bernstein.
+        
+        Removed the extra argument, and then removed similar arguments from other methods until
+        I could build successfully again. It turned out that many methods took a VM& argument
+        just for calling getConcurrently().
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::dumpStructure):
+        (JSC::dumpChain):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printPutByIdCacheStatus):
+        * bytecode/ComplexGetStatus.cpp:
+        (JSC::ComplexGetStatus::computeFor):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+        * runtime/IntendedStructureChain.cpp:
+        (JSC::IntendedStructureChain::mayInterceptStoreTo):
+        * runtime/IntendedStructureChain.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::getConcurrently):
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::getConcurrently):
+
+2014-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL OSRExit construction should be based on methods that return ExitValues rather than methods that add ExitValues to OSRExit
+        https://bugs.webkit.org/show_bug.cgi?id=136978
+
+        Reviewed by Dean Jackson.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
+        (JSC::FTL::LowerDFGToLLVM::exitArgument):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::tryToSetConstantExitArgument): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::addExitArgument): Deleted.
+
+2014-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL OSR exit should do reboxing and value recovery in the same pass
+        https://bugs.webkit.org/show_bug.cgi?id=136977
+
+        Reviewed by Oliver Hunt.
+        
+        It's conceptually simpler to have all of the logic in one place. After the
+        recover-and-rebox loop is done, all of the exit values are in the form that the baseline
+        JIT would want them to be in; the only remaining task is to move them into the right
+        place on the stack after we do all of the necessary stack adjustments.
+
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+
+2014-09-19  Filip Pizlo  <fpizlo@apple.com>
+
+        StorageAccessData should be referenced in a sensible way
+        https://bugs.webkit.org/show_bug.cgi?id=136963
+
+        Reviewed and rubber stamped by Michael Saboff.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::handlePutByOffset):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToGetByOffset):
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::storageAccessData):
+        (JSC::DFG::Node::storageAccessDataIndex): Deleted.
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByOffset):
+
+2014-09-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Leak of mallocs under StructureSet::OutOfLineList::create
+        https://bugs.webkit.org/show_bug.cgi?id=136970
+
+        Reviewed by Filip Pizlo.
+
+        addOutOfLine should free the old list when expanding the capacity.
+
+        * bytecode/StructureSet.cpp:
+        (JSC::StructureSet::addOutOfLine):
+
+2014-09-19  Daniel Bates  <dabates@apple.com>
+
+        Always assume internal SDK when building configuration Production
+        https://bugs.webkit.org/show_bug.cgi?id=136925
+        <rdar://problem/18362399>
+
+        Reviewed by Dan Bernstein.
+
+        As a side effect of this change we will always enable ENABLE_TOUCH_EVENTS, ENABLE_IOS_{GESTURE, TOUCH}_EVENTS,
+        and ENABLE_XSLT when either building configuration Production or building with the Internal SDK.
+
+        * Configurations/Base.xcconfig:
+
+2014-09-19  Diego Pino Garcia  <dpino@igalia.com>
+
+        Simple ES6 feature:String prototype additions
+        https://bugs.webkit.org/show_bug.cgi?id=131704
+
+        Reviewed by Darin Adler.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncStartsWith): Added.
+        (JSC::stringProtoFuncEndsWith): Added.
+        (JSC::stringProtoFuncContains): Added.
+
+2014-09-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout r173731. Broke multiple builds.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::RemoteInspector):
+        (Inspector::RemoteInspector::setupFailed):
+        (Inspector::RemoteInspector::start):
+        (Inspector::RemoteInspector::stopInternal):
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        (Inspector::globalAutomaticInspectionState): Deleted.
+        (Inspector::RemoteInspector::updateDebuggableAutomaticInspectCandidate): Deleted.
+        (Inspector::RemoteInspector::sendAutomaticInspectionCandidateMessage): Deleted.
+        (Inspector::RemoteInspector::setupSucceeded): Deleted.
+        (Inspector::RemoteInspector::waitingForAutomaticInspection): Deleted.
+        (Inspector::RemoteInspector::receivedAutomaticInspectionConfigurationMessage): Deleted.
+        (Inspector::RemoteInspector::receivedAutomaticInspectionRejectMessage): Deleted.
+        * inspector/remote/RemoteInspectorConstants.h:
+        * inspector/remote/RemoteInspectorDebuggable.cpp:
+        (Inspector::RemoteInspectorDebuggable::setRemoteDebuggingAllowed):
+        (Inspector::RemoteInspectorDebuggable::pauseWaitingForAutomaticInspection): Deleted.
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::pauseWaitingForAutomaticInspection): Deleted.
+        * runtime/JSGlobalObjectDebuggable.h:
+
+2014-09-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Should be able to attach a debugger to a JSContext before anything is executed
+        https://bugs.webkit.org/show_bug.cgi?id=136893
+
+        Reviewed by Timothy Hatcher.
+
+        Adds new remote inspector protocol handling for automatic inspection.
+        Debuggers can signal they have enabled automatic inspection, and
+        when debuggables are created the current application will pause to
+        see if the debugger will inspect or decline to inspect the debuggable.
+
+        * inspector/remote/RemoteInspectorConstants.h:
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::globalAutomaticInspectionState):
+        (Inspector::RemoteInspector::RemoteInspector):
+        (Inspector::RemoteInspector::start):
+        When first starting, check the global "is there an auto-inspect" debugger state.
+        This is necessary so that the current application knows if it should pause or
+        not when a debuggable is created, even without having connected to webinspectord yet.
+
+        (Inspector::RemoteInspector::updateDebuggableAutomaticInspectCandidate):
+        When a debuggable has enabled remote inspection, take this path to propose
+        it as an automatic inspection candidate if there is an auto-inspect debugger.
+
+        (Inspector::RemoteInspector::sendAutomaticInspectionCandidateMessage):
+        Send the automatic inspection candidate message.
+
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        (Inspector::RemoteInspector::setupFailed):
+        (Inspector::RemoteInspector::setupSucceeded):
+        After attempting to open an inspector, unpause if it was for the
+        automatic inspection candidate.
+
+        (Inspector::RemoteInspector::waitingForAutomaticInspection):
+        When running a nested runloop, check if we should remain paused.
+
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        If by the time we connect to webinspectord we have a candidate, then
+        immediately send the candidate message.
+
+        (Inspector::RemoteInspector::stopInternal):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        In error cases, clear our state.
+
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        (Inspector::RemoteInspector::receivedAutomaticInspectionConfigurationMessage):
+        (Inspector::RemoteInspector::receivedAutomaticInspectionRejectMessage):
+        Update state when receiving new messages.
+
+
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggable.cpp:
+        (Inspector::RemoteInspectorDebuggable::setRemoteDebuggingAllowed):
+        Special case when a debuggable is newly allowed to be debuggable.
+
+        (Inspector::RemoteInspectorDebuggable::pauseWaitingForAutomaticInspection):
+        Run a nested run loop while this is an automatic inspection candidate.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        When the inspector starts via automatic inspection automatically pause.
+        We plan on removing this condition by having the frontend signal to the
+        backend when it is completely initialized.
+        
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        Pass on the flag of whether or not this was automatic inspection.
+
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::pauseWaitingForAutomaticInspection):
+        When pausing in a JSGlobalObject we need to release the API lock.
+
+2014-09-18  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        Fix "Tools/Scripts/build-webkit --efl --no-inspector" build
+        https://bugs.webkit.org/show_bug.cgi?id=136912
+
+        Reviewed by Darin Adler.
+
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::leastCommonAncestor):
+
+2014-09-17  Michael Saboff  <msaboff@apple.com>
+
+        Change CallFrame to use Callee instead of JSScope to implement vm()
+        https://bugs.webkit.org/show_bug.cgi?id=136894
+
+        Reviewed by Geoffrey Garen.
+
+        Added JSCell::vm() method that can be used on any JSObject.  Changed CallFrame::vm() to
+        use JSCell::vm with the Callee.  Made similar changes in the LLInt.
+        In support of this, changed JSGlobalObject::init() to take a VM& parameter, as there is
+        a chicken/egg problem with trying to use the Callee in the global exec before the Callee
+        has been create.  Besides, the vm is readily available in finishCreation(), the caller of
+        init().
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Changed the calculation of CallFrame::VM to use the Callee instead of JSScope.
+
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::vm): New method for getting VM from the pointer.
+        (JSC::ExecState::vm): Moved this method from JSScope.h to here since this file
+        contains the implementation of JSCell::vm(), this file is included by all users
+        of CallFrame::vm, and lastly putting it in CallFrameInlines.h required changing
+        many other .h files and possible the WebCore generator generate-bindings.pl.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        Changed init() to take a VM parameter.
+
+        * runtime/JSScope.h:
+        (JSC::ExecState::vm): Deleted.
+
+2014-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, disable native inlining because it causes build failures.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-09-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Reduce a bit of churn setting initial remote inspection state
+        https://bugs.webkit.org/show_bug.cgi?id=136875
+
+        Reviewed by Timothy Hatcher.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        Set the defaultl remote debuggable state at the API boundary.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        Do not set remote debuggable state here. Let clients set it.
+
+2014-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Promise: Drop Promise.cast
+        https://bugs.webkit.org/show_bug.cgi?id=136222
+
+        Reviewed by Sam Weinig.
+
+        Promise.cast is dropped and Promise.resolve is replaced with old Promise.cast.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructorFuncResolve):
+        (JSC::JSPromiseConstructorFuncRace):
+        (JSC::JSPromiseConstructorFuncAll):
+        (JSC::JSPromiseConstructorFuncCast): Deleted.
+
+2014-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Local OSR availability calculation should be reusable
+        https://bugs.webkit.org/show_bug.cgi?id=136860
+
+        Reviewed by Oliver Hunt.
+        
+        Previously, the FTL lowering repeated some of the logic of the OSR availability analysis
+        phase. Humorously, it actually did this logic a bit differently; for example the phase
+        would claim that a SetLocal makes both the flush and the node available while the FTL
+        only claimed that the flush was available. This different was benign, but still: yuck!
+        
+        Also, previously if you wanted to use availability information then you'd have to repeat
+        some of the logic that both the phase itself and the FTL lowering already had.
+        Presumably, you could get epic style points for finding other benign ways in which to
+        make your copy of the logic different from the other two!
+        
+        This reduces the amount of style points one could conceivably get in the future when
+        hacking JSC, by creating a single reusable thingy for computing local OSR availability.
+
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::LocalOSRAvailabilityCalculator):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::~LocalOSRAvailabilityCalculator):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::beginBlock):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::LowerDFGToLLVM::availability):
+        (JSC::FTL::LowerDFGToLLVM::compileMovHint): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileZombieHint): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::initializeOSRExitStateForBlock): Deleted.
+
+2014-09-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        JSC test gardening
+        https://bugs.webkit.org/show_bug.cgi?id=136823
+
+        Reviewed by Geoffrey Garen.
+
+        * tests/mozilla/mozilla-tests.yaml: Unskip passing tests.
+
+2014-09-15  Michael Saboff  <msaboff@apple.com>
+
+        Create a JSCallee for GlobalExec object
+        https://bugs.webkit.org/show_bug.cgi?id=136840
+
+        Reviewed by Geoffrey Garen.
+
+        Added m_globalCallee, initialized it and then used it to set the globalExec's callee.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+
+2014-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ref count calculation should be reusable
+        https://bugs.webkit.org/show_bug.cgi?id=136811
+
+        Reviewed by Oliver Hunt.
+        
+        Henceforth if you call Graph::computeRefCounts(), a nifty O(n) operation, every Node
+        will be able to tell you how many places it is used from. Currently only DCE uses this,
+        but it will be useful for https://bugs.webkit.org/show_bug.cgi?id=136330.
+
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        (JSC::DFG::DCEPhase::findTypeCheckRoot): Deleted.
+        (JSC::DFG::DCEPhase::countNode): Deleted.
+        (JSC::DFG::DCEPhase::countEdge): Deleted.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::computeRefCounts):
+        * dfg/DFGGraph.h:
+
+2014-09-12  Michael Saboff  <msaboff@apple.com>
+
+        Merge JSGlobalObject::reset() into ::init()
+        https://bugs.webkit.org/show_bug.cgi?id=136800
+
+        Reviewed by Oliver Hunt.
+
+        Moved the contents of reset() into init().
+        Note that the diff shows more changes.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Moved body of reset() into init.
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::defineOwnProperty):
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        (JSC::lastInPrototypeChain):
+        (JSC::JSGlobalObject::reset): Deleted.
+        * runtime/JSGlobalObject.h:
+
+2014-09-12  Michael Saboff  <msaboff@apple.com>
+
+        Add JSCallee to program and eval CallFrames
+        https://bugs.webkit.org/show_bug.cgi?id=136785
+
+        Reviewed by Mark Lam.
+
+        Populated Callee slot for program and call eval CallFrames with a JSCallee objects.
+        Made supporting changes including adding a JSCallee structure to global object and adding
+        JSCallee::create() method.  Added code so that the newly added callee object won't be
+        returned by Function.caller.  Changed null pointer checks of callee to check the if
+        the type is JSFunction* or JSCallee*.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::type):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::createCallIdentifier):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        Changed checks of callee is a JSFunction* or JSCallee* instead of just checking
+        if it is null or not.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute): Create and use JSCallee objects for execute(EvalExecutable, ...)
+        and execute(ProgramExecutable, ...)
+
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute): Use jsDynamicCast to cast only JSFunctions.
+
+        * runtime/JSCallee.cpp:
+        (JSC::JSCallee::create): Not used, therefore deleted.
+
+        * runtime/JSCallee.h:
+        (JSC::JSCallee::create): Added.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::callerGetter): Added test to return null for JSCallee's that aren't
+        JSFunction's.  This can only be the case when the JSCallee comes from a program or
+        call eval CallFrame.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::calleeStructure):
+        Added new JSCallee structure.
+
+2014-09-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Re-add the request autocomplete feature
+
+        <https://bugs.webkit.org/show_bug.cgi?id=136730>
+
+        This feature was rolled out in r148731 because it was only used by
+        Chromium. As we consider supporting this feature, roll it back in, but
+        leave it disabled.
+
+        This rolls out r148731 (which removed the feature) with small changes
+        needed to make the code build in ToT, to match modern style, to make
+        the tests run, and to remove unused code.
+
+        Reviewed by Andy Estes.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-09-12  Julien Brianceau  <jbriance@cisco.com>
+
+        [x86] moveDoubleToInts() does not clobber its source register anymore
+        https://bugs.webkit.org/show_bug.cgi?id=131690
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::moveDoubleToInts):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueRep):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnDouble):
+
+2014-09-12  Mark Lam  <mark.lam@apple.com>
+
+        Unreviewed build fix for CLOOP build.
+
+        * runtime/JSCallee.h:
+
+2014-09-12  Michael Saboff  <msaboff@apple.com>
+
+        Remove unneeded declarations from JSCallee.h
+        https://bugs.webkit.org/show_bug.cgi?id=136783
+
+        Reviewed by Mark Lam.
+
+        * runtime/JSCallee.h:
+        (JSCallee::name): Deleted.
+        (JSCallee::displayName): Deleted.
+        (JSCallee::calculatedDisplayName): Deleted.
+
+2014-09-11  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: disambiguate double and integer primitive types in the protocol
+        https://bugs.webkit.org/show_bug.cgi?id=136606
+
+        Reviewed by Timothy Hatcher.
+
+        Right now it's really easy to mix up doubles and integers when serializing or deserializing
+        values for the inspector protocol. This patch disambiguates setting/getting doubles and integers
+        so that it is clearer as to which type is intended.
+
+        A new InspectorValue::Type is added for Integer types, and the Number type is renamed to Double.
+        The existing callsites for asNumber/getNumber/setNumber have been fixed.
+
+        Address various integration points to make sure the right type tag is assigned to InspectorValues.
+
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue): Make an Integer if the JSValue is Int52 or smaller.
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::injectedScriptForObjectId):
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::InspectorBackendDispatcher::dispatch):
+        (Inspector::InspectorBackendDispatcher::sendResponse):
+        (Inspector::InspectorBackendDispatcher::reportProtocolError):
+        (Inspector::AsMethodBridges::asInteger):
+        (Inspector::AsMethodBridges::asDouble):
+        (Inspector::InspectorBackendDispatcher::getInteger):
+        (Inspector::InspectorBackendDispatcher::getDouble):
+        (Inspector::AsMethodBridges::asInt): Deleted.
+        (Inspector::InspectorBackendDispatcher::getInt): Deleted.
+        * inspector/InspectorBackendDispatcher.h:
+        * inspector/InspectorProtocolTypes.h: Remove the special case for checking int type tags.
+        (Inspector::Protocol::ArrayItemHelper<int>::Traits::pushRaw):
+        (Inspector::Protocol::ArrayItemHelper<double>::Traits::pushRaw):
+        (Inspector::Protocol::BindingTraits<int>::assertValueHasExpectedType): Deleted.
+        * inspector/InspectorValues.cpp: Allow integers and doubles to be convertible using asInteger/asDouble.
+        (Inspector::InspectorValue::asDouble):
+        (Inspector::InspectorValue::asInteger):
+        (Inspector::InspectorBasicValue::asDouble):
+        (Inspector::InspectorBasicValue::asInteger):
+        (Inspector::InspectorBasicValue::writeJSON):
+        (Inspector::InspectorValue::asNumber): Deleted.
+        (Inspector::InspectorBasicValue::asNumber): Deleted.
+        * inspector/InspectorValues.h:
+        (Inspector::InspectorObjectBase::setInteger):
+        (Inspector::InspectorObjectBase::setDouble):
+        (Inspector::InspectorArrayBase::pushInteger):
+        (Inspector::InspectorArrayBase::pushDouble):
+        (Inspector::InspectorObjectBase::setNumber): Deleted.
+        (Inspector::InspectorArrayBase::pushInt): Deleted.
+        (Inspector::InspectorArrayBase::pushNumber): Deleted.
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::buildObjectForBreakpointCookie):
+        (Inspector::InspectorDebuggerAgent::breakpointActionsFromProtocol):
+        (Inspector::parseLocation):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * inspector/scripts/codegen/generator.py: Update emitted code and rebaseline test results.
+        (Generator.keyed_get_method_for_type):
+        (Generator.keyed_set_method_for_type):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * replay/EncodedValue.cpp:
+        (JSC::EncodedValue::convertTo<double>):
+        (JSC::EncodedValue::convertTo<float>):
+        (JSC::EncodedValue::convertTo<int32_t>):
+        (JSC::EncodedValue::convertTo<int64_t>):
+        (JSC::EncodedValue::convertTo<uint32_t>):
+        (JSC::EncodedValue::convertTo<uint64_t>):
+
+2014-09-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Occasional ASSERT closing web inspector
+        https://bugs.webkit.org/show_bug.cgi?id=136762
+
+        Reviewed by Timothy Hatcher.
+
+        It is harmless, and indeed possible to have an empty set of listeners
+        now that each Page gets its own PageDebugServer instead of a shared
+        global. So we should replace the null checks with isEmpty checks.
+        Since nobody was ever returning null, convert to references as well.
+
+        * inspector/JSGlobalObjectScriptDebugServer.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionLog):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionSound):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe):
+        (Inspector::ScriptDebugServer::sourceParsed):
+        (Inspector::ScriptDebugServer::dispatchFunctionToListeners):
+        (Inspector::ScriptDebugServer::notifyDoneProcessingDebuggerEvents):
+        (Inspector::ScriptDebugServer::handlePause):
+        (Inspector::ScriptDebugServer::needPauseHandling): Deleted.
+        * inspector/ScriptDebugServer.h:
+
+2014-09-10  Michael Saboff  <msaboff@apple.com>
+
+        Move JSScope out of JSFunction into separate JSCallee class
+        https://bugs.webkit.org/show_bug.cgi?id=136725
+
+        Reviewed by Oliver Hunt.
+
+        Created new JSCallee class that contains a JSScope*.  Changed JSFunction to inherit from
+        JSCallee.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Build changes.  Added JSCallee.cpp and JSCallee.h.
+
+        * runtime/JSCallee.cpp: Added.
+        (JSC::JSCallee::create):
+        (JSC::JSCallee::destroy):
+        (JSC::JSCallee::JSCallee):
+        (JSC::JSCallee::finishCreation):
+        (JSC::JSCallee::visitChildren):
+        (JSC::JSCallee::getOwnPropertySlot): Pass through wrapper function.
+        (JSC::JSCallee::getOwnNonIndexPropertyNames): Pass through wrapper function.
+        (JSC::JSCallee::put): Pass through wrapper function.
+        (JSC::JSCallee::deleteProperty): Pass through wrapper function.
+        (JSC::JSCallee::defineOwnProperty): Pass through wrapper function.
+
+        * runtime/JSCallee.h: Added.
+        (JSC::JSCallee::scope):
+        (JSC::JSCallee::scopeUnchecked):
+        (JSC::JSCallee::setScope):
+        (JSC::JSCallee::createStructure):
+        (JSC::JSCallee::offsetOfScopeChain):
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::addNameScopeIfNeeded):
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::scope): Deleted.
+        (JSC::JSFunction::scopeUnchecked): Deleted.
+        (JSC::JSFunction::setScope): Deleted.
+        (JSC::JSFunction::offsetOfScopeChain): Deleted.
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::JSFunction):
+        Changed to reference JSCallee and its methods.
+
+        * runtime/JSType.h: Added JSCallee as a TypeEnum.
+
+2014-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r172129): Vine pages load as blank
+        https://bugs.webkit.org/show_bug.cgi?id=136655
+        rdar://problem/18281215
+
+        Reviewed by Michael Saboff.
+        
+        If lastNode is something that is subject to DCE, then removing the Phantom's reference to something
+        that lastNode references means that the thing being referenced may no longer be kept alive for OSR.
+        Teach PhantomRemovalPhase that it's only safe to do this if lastNode is a Phantom. That's probably too
+        conservative, but that's fine since this is mainly just an optimization to make the IR sane to read and
+        reasonably compact; it's OK if we miss cases here.
+
+        * dfg/DFGPhantomRemovalPhase.cpp:
+        (JSC::DFG::PhantomRemovalPhase::run):
+        * tests/stress/remove-phantom-after-setlocal.js: Added.
+
+2014-09-11  Bear Travis  <betravis@adobe.com>
+
+        [CSS Font Loading] Enable CSS Font Loading on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=135473
+
+        Reviewed by Antti Koivisto.
+
+        Enable CSS Font Loading in FeatureDefines.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-09-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rebaseline of inspector generator test results after r173120.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+
+2014-09-11  Oliver Hunt  <oliver@apple.com>
+
+        Rename activation to be more in line with spec language
+        https://bugs.webkit.org/show_bug.cgi?id=136721
+
+        Reviewed by Michael Saboff.
+
+        Somewhat bigger than the last one, but still just a rename.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CallVariant.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::isCaptured):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setActivationRegister):
+        (JSC::CodeBlock::activationRegister):
+        (JSC::CodeBlock::uncheckedActivationRegister):
+        (JSC::CodeBlock::needsActivation):
+        * bytecode/Instruction.h:
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::setActivationRegister):
+        (JSC::UnlinkedCodeBlock::activationRegister):
+        (JSC::UnlinkedCodeBlock::hasActivationRegister):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitReturn):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::scope):
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::isFunctionOrEvalScope):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetActivation):
+        (JSC::DFG::Graph::tryGetRegisters):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::lexicalEnvironment):
+        (JSC::CallFrame::setActivation):
+        (JSC::CallFrame::activation): Deleted.
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        * interpreter/Register.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_tear_off_lexical_environment):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_create_lexical_environment):
+        (JSC::JIT::emit_op_tear_off_activation): Deleted.
+        (JSC::JIT::emit_op_create_activation): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_tear_off_lexical_environment):
+        (JSC::JIT::emit_op_tear_off_arguments):
+        (JSC::JIT::emit_op_create_lexical_environment):
+        (JSC::JIT::emit_op_tear_off_activation): Deleted.
+        (JSC::JIT::emit_op_create_activation): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        (JSC::Arguments::tearOff):
+        (JSC::Arguments::didTearOffActivation):
+        * runtime/Arguments.h:
+        (JSC::Arguments::offsetOfActivation):
+        (JSC::Arguments::argument):
+        (JSC::Arguments::finishCreation):
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::activationStructure):
+        * runtime/JSLexicalEnvironment.cpp: Renamed from Source/JavaScriptCore/runtime/JSActivation.cpp.
+        (JSC::JSLexicalEnvironment::visitChildren):
+        (JSC::JSLexicalEnvironment::symbolTableGet):
+        (JSC::JSLexicalEnvironment::symbolTablePut):
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        (JSC::JSLexicalEnvironment::symbolTablePutWithAttributes):
+        (JSC::JSLexicalEnvironment::getOwnPropertySlot):
+        (JSC::JSLexicalEnvironment::put):
+        (JSC::JSLexicalEnvironment::deleteProperty):
+        (JSC::JSLexicalEnvironment::toThis):
+        (JSC::JSLexicalEnvironment::argumentsGetter):
+        * runtime/JSLexicalEnvironment.h: Renamed from Source/JavaScriptCore/runtime/JSActivation.h.
+        (JSC::JSLexicalEnvironment::create):
+        (JSC::JSLexicalEnvironment::createStructure):
+        (JSC::JSLexicalEnvironment::JSLexicalEnvironment):
+        (JSC::asActivation):
+        (JSC::Register::lexicalEnvironment):
+        (JSC::JSLexicalEnvironment::registersOffset):
+        (JSC::JSLexicalEnvironment::tearOff):
+        (JSC::JSLexicalEnvironment::isTornOff):
+        (JSC::JSLexicalEnvironment::storageOffset):
+        (JSC::JSLexicalEnvironment::storage):
+        (JSC::JSLexicalEnvironment::allocationSize):
+        (JSC::JSLexicalEnvironment::isValidIndex):
+        (JSC::JSLexicalEnvironment::isValid):
+        (JSC::JSLexicalEnvironment::registerAt):
+        * runtime/JSObject.h:
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        * runtime/JSScope.h:
+        (JSC::ResolveOp::ResolveOp):
+        * runtime/JSSymbolTableObject.cpp:
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::create):
+        * runtime/VM.cpp:
+
+2014-09-11  László Langó  <llango.u-szeged@partner.samsung.com>
+
+        [JavaScriptCore] Fix FTL on platform EFL.
+        https://bugs.webkit.org/show_bug.cgi?id=133571
+
+        Reviewed by Filip Pizlo.
+
+        There are no compact_unwind sections on Linux systems so FTL crashes.
+        We have to parse eh_frame in FTLUnwindInfo instead of compact_unwind
+        and get the information for stack unwinding from there.
+
+        * CMakeLists.txt: Revert r169181.
+        * ftl/FTLCompile.cpp:
+        Change section name literals to use SECTION_NAME macro, because of architecture differencies.
+        (JSC::FTL::mmAllocateCodeSection):
+        (JSC::FTL::mmAllocateDataSection):
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.h:
+        We need the SECTION_NAME macro in FTLCompile and FTLLink, so we define it here.
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLState.h:
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * ftl/FTLUnwindInfo.h:
+        * ftl/FTLUnwindInfo.cpp:
+        Lift the eh_frame parsing method from LLVM/libcxxabi project and modify it for our purposes.
+        Parse eh_frame on Linux instead of compact_unwind.
+        (JSC::FTL::UnwindInfo::parse):
+
+2014-09-10  Saam Barati  <saambarati1@gmail.com>
+
+        Web Inspector: Modify the type profiler runtime protocol to transfer some computation into the WebInspector
+        https://bugs.webkit.org/show_bug.cgi?id=136500
+
+        Reviewed by Joseph Pecoraro.
+
+        This patch changes the type profiler protocol to the Web Inspector
+        by moving the work of calculating computed properties that effect the UI 
+        into the Web Inspector. This makes the Web Inspector have control over the 
+        strings it displays as UI elements representing type information to the user 
+        instead of JavaScriptCore deciding on a convention for these strings.
+        JavaScriptCore now sends enough information to the Web Inspector so that 
+        it can compute the properties JavaScriptCore used to compute.
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * inspector/protocol/Runtime.json:
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::getTypesForVariableAtOffsetForInspector): Deleted.
+        * runtime/TypeProfiler.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::inspectorTypeSet):
+        (JSC::StructureShape::leastCommonAncestor):
+        (JSC::StructureShape::inspectorRepresentation):
+        * runtime/TypeSet.h:
+
+2014-09-10  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Apply ARM64-specific lowering to load/store instructions in offlineasm
+        https://bugs.webkit.org/show_bug.cgi?id=136569
+
+        Reviewed by Michael Saboff.
+
+        The standard risc lowering of load/store instructions with base +
+        immediate offset addresses is to move the offset to a temporary, add the
+        base to the temporary, and then change the load/store to use the
+        temporary + 0 immediate offset address. However, on ARM64, base +
+        register offset addressing mode is available, so it is unnecessary to
+        perform explicit register additions but it is enough to change load/store
+        to use base + temporary as the address.
+
+        * offlineasm/arm64.rb: Added arm64LowerMalformedLoadStoreAddresses
+
+2014-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Rename JSVariableObject to JSEnvironmentRecord to align naming with ES spec
+        https://bugs.webkit.org/show_bug.cgi?id=136710
+
+        Reviewed by Anders Carlsson.
+
+        This is a trivial rename.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetClosureRegisters):
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emitPutClosureVar):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emitPutClosureVar):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnNonIndexPropertyNames):
+        * runtime/JSActivation.h:
+        * runtime/JSEnvironmentRecord.cpp: Renamed from Source/JavaScriptCore/runtime/JSVariableObject.cpp.
+        * runtime/JSEnvironmentRecord.h: Renamed from Source/JavaScriptCore/runtime/JSVariableObject.h.
+        (JSC::JSEnvironmentRecord::registers):
+        (JSC::JSEnvironmentRecord::registerAt):
+        (JSC::JSEnvironmentRecord::addressOfRegisters):
+        (JSC::JSEnvironmentRecord::offsetOfRegisters):
+        (JSC::JSEnvironmentRecord::JSEnvironmentRecord):
+        * runtime/JSNameScope.h:
+        * runtime/JSSegmentedVariableObject.h:
+
+2014-09-10  Julien Brianceau   <jbriance@cisco.com>
+
+        [mips] Add missing parts and fix LLINT mips backend
+        https://bugs.webkit.org/show_bug.cgi?id=136706
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter.asm: Fix invalid CalleeSave register number.
+        Implement initPCRelative and setEntryAddress macros.
+        * llint/LowLevelInterpreter32_64.asm: Fix register distribution in
+        doVMEntry macro.
+
+2014-09-10  Saam Barati  <saambarati1@gmail.com>
+
+        TypeSet needs a mode where it no longer profiles structure shapes
+        https://bugs.webkit.org/show_bug.cgi?id=136263
+
+        Reviewed by Filip Pizlo.
+
+        The TypeSet data structure used to gather as many StructureShape
+        objects as it encountered during type profiling. But, this meant 
+        that there was no upper limit on how many objects it could allocate. 
+        This patch places a fixed upper bound on the number of StructureShapes
+        allocated per TypeSet to prevent using too much memory for little gain
+        in type profiling usefulness.
+
+        StructureShape objects are now also aware of when they are created
+        from Structures which are dictionaries.
+
+        In total, this patch lays the final groundwork needed in refactoring 
+        the inspector protocol for the type profiler.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::toStructureShape):
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::typeInformationForExpressionAtOffset):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::TypeSet):
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::StructureShape::StructureShape):
+        (JSC::StructureShape::toJSONString):
+        (JSC::StructureShape::enterDictionaryMode):
+        * runtime/TypeSet.h:
+        (JSC::TypeSet::isOverflown):
+        * tests/typeProfiler/dictionary-mode.js: Added.
+        (wrapper):
+        * tests/typeProfiler/driver/driver.js:
+        * tests/typeProfiler/overflow.js: Added.
+        (wrapper.Proto):
+        (wrapper):
+
+2014-09-10  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        [MIPS] branch32WithPatch missing
+        https://bugs.webkit.org/show_bug.cgi?id=136696
+
+        Reviewed by Michael Saboff.
+
+        Added the missing branch32WithPatch. The implementation
+        is currently the same as the branchPtrithPatch because
+        the macro assembler supports only 32 bit MIPS.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branch32WithPatch):
+
+2014-09-10  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        Fix !ENABLE(DFG_JIT) build
+        https://bugs.webkit.org/show_bug.cgi?id=136702
+
+        Reviewed by Michael Saboff.
+
+        * bytecode/CallEdgeProfile.h:
+
+2014-09-09  Benjamin Poulain  <bpoulain@apple.com>
+
+        Disable the "unreachable-code" warning
+        https://bugs.webkit.org/show_bug.cgi?id=136677
+
+        Reviewed by Darin Adler.
+
+        * Configurations/Base.xcconfig:
+
+2014-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have a reusable SSA builder
+        https://bugs.webkit.org/show_bug.cgi?id=136331
+
+        Reviewed by Oliver Hunt.
+        
+        We want to implement sophisticated SSA transformations like object allocation sinking
+        (https://bugs.webkit.org/show_bug.cgi?id=136330), but to do that, we need to be able to do
+        updates to SSA that require inserting new Phi's. This requires calculating where Phis go.
+        Previously, our Phi calculation was based on Aycock and Horspool's algorithm, and our
+        implementation of this algorithm only worked when doing CPS->SSA conversion. The code
+        could not be reused for cases where some phase happens to know that it introduced a few
+        defs in some blocks and it wants to figure out where the Phis should go. Moreover, even
+        the general algorithm of Aycock and Horspool is not well suited to such targetted SSA
+        updates, since it requires first inserting maximal Phis. That scales well when the Phis
+        were already there (like in our CPS form) but otherwise it's quite unnatural and may be
+        difficult to make efficient.
+        
+        The usual way of handling both SSA conversion and SSA update is to use Cytron et al's
+        algorithm based on dominance frontiers. For a while now, I've been working on creating a
+        Cytron-based SSA calculator that can be used both as a replacement for our current SSA
+        converter and as a reusable tool for any phase that needs to do SSA update. I previously
+        optimized our dominator calculation and representation to use dominator trees computed
+        using Lengauer and Tarjan's algorithm - mainly to make it more scalable to enumerate over
+        the set of blocks that dominate you or vice-versa, and then I implemented a dominance
+        frontier calculator. This patch implements the final step towards making SSA update
+        available to all SSA phases: it implements an SSACalculator that can tell you where Phis
+        go when given an arbitrary set of Defs. To keep things simple, and to ensure that we have
+        good test coverage for this SSACalculator, this patch replaces the old Aycock-Horspool
+        SSA converter with one based on the SSACalculator.
+        
+        This has no observable impact. It does reduce the amount of code in SSAConversionPhase.
+        But even better, it makes SSAConversionPhase have significantly less tricky logic. It
+        mostly just relies on SSACalculator to do the tricky stuff, and SSAConversionPhase mostly
+        just reasons about the weirdnesses unique to the ThreadedCPS form that it sees as input.
+        In fact, using the Cytron et al approach means that there isn't really any "smoke and
+        mirrors" trickyness related to SSA. SSACalculator's only "tricks" are using the pruned
+        iterated dominance frontier to place Phi's and using the dom tree to find reaching defs.
+        The complexity is mostly confined to Dominators, which computes various dominator-related
+        properties over the control flow graph. That class can be difficult to understand, but at
+        least it follows well-known graph theory wisdom.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAnalysis.h:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        * dfg/DFGDominators.h:
+        (JSC::DFG::Dominators::immediateDominatorOf):
+        (JSC::DFG::Dominators::forAllBlocksInIteratedDominanceFrontierOf):
+        (JSC::DFG::Dominators::forAllBlocksInPrunedIteratedDominanceFrontierOf):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::blocksInPreOrder):
+        (JSC::DFG::Graph::blocksInPostOrder):
+        (JSC::DFG::Graph::getBlocksInPreOrder): Deleted.
+        (JSC::DFG::Graph::getBlocksInPostOrder): Deleted.
+        * dfg/DFGGraph.h:
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        * dfg/DFGPhase.h:
+        * dfg/DFGSSACalculator.cpp: Added.
+        (JSC::DFG::SSACalculator::Variable::dump):
+        (JSC::DFG::SSACalculator::Variable::dumpVerbose):
+        (JSC::DFG::SSACalculator::Def::dump):
+        (JSC::DFG::SSACalculator::SSACalculator):
+        (JSC::DFG::SSACalculator::~SSACalculator):
+        (JSC::DFG::SSACalculator::newVariable):
+        (JSC::DFG::SSACalculator::newDef):
+        (JSC::DFG::SSACalculator::nonLocalReachingDef):
+        (JSC::DFG::SSACalculator::reachingDefAtTail):
+        (JSC::DFG::SSACalculator::dump):
+        * dfg/DFGSSACalculator.h: Added.
+        (JSC::DFG::SSACalculator::Variable::index):
+        (JSC::DFG::SSACalculator::Variable::Variable):
+        (JSC::DFG::SSACalculator::Def::variable):
+        (JSC::DFG::SSACalculator::Def::block):
+        (JSC::DFG::SSACalculator::Def::value):
+        (JSC::DFG::SSACalculator::Def::Def):
+        (JSC::DFG::SSACalculator::variable):
+        (JSC::DFG::SSACalculator::computePhis):
+        (JSC::DFG::SSACalculator::phisForBlock):
+        (JSC::DFG::SSACalculator::reachingDefAtHead):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::SSAConversionPhase):
+        (JSC::DFG::SSAConversionPhase::run):
+        (JSC::DFG::SSAConversionPhase::forwardPhiChildren): Deleted.
+        (JSC::DFG::SSAConversionPhase::forwardPhi): Deleted.
+        (JSC::DFG::SSAConversionPhase::forwardPhiEdge): Deleted.
+        (JSC::DFG::SSAConversionPhase::deduplicateChildren): Deleted.
+        * dfg/DFGSSAConversionPhase.h:
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::Validate):
+        (JSC::DFG::Validate::dumpGraphIfAppropriate):
+        (JSC::DFG::validate):
+        * dfg/DFGValidate.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        * runtime/Options.h:
+
+2014-09-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r173402.
+        https://bugs.webkit.org/show_bug.cgi?id=136649
+
+        Breaking buildw with error "unable to restore file position to
+        0x00000c60 for section __DWARF.__debug_info (errno = 9)"
+        (Requested by mlam_ on #webkit).
+
+        Reverted changeset:
+
+        "Move CallFrame and Register inlines functions out of
+        JSScope.h."
+        https://bugs.webkit.org/show_bug.cgi?id=136579
+        http://trac.webkit.org/changeset/173402
+
+2014-09-08  Mark Lam  <mark.lam@apple.com>
+
+        Move CallFrame and Register inlines functions out of JSScope.h.
+        <https://webkit.org/b/136579>
+
+        Reviewed by Geoffrey Garen.
+
+        This include fixing up some files to #include JSCInlines.h to pick up
+        these inline functions.  I also added JSCellInlines.h to JSCInlines.h
+        since it is included from many of the affected .cpp files.
+
+        * API/ObjCCallbackFunction.mm:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/ScriptValue.cpp:
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/InjectedScriptManager.cpp:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        * inspector/ScriptDebugServer.cpp:
+        * interpreter/CallFrameInlines.h:
+        (JSC::CallFrame::vm):
+        (JSC::CallFrame::lexicalGlobalObject):
+        (JSC::CallFrame::globalThisValue):
+        * interpreter/RegisterInlines.h: Added.
+        (JSC::Register::operator=):
+        (JSC::Register::scope):
+        * runtime/ArgumentsIteratorConstructor.cpp:
+        * runtime/JSArrayIterator.cpp:
+        * runtime/JSCInlines.h:
+        * runtime/JSCJSValue.cpp:
+        * runtime/JSMapIterator.cpp:
+        * runtime/JSPromiseConstructor.cpp:
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/JSPromiseFunctions.cpp:
+        * runtime/JSPromisePrototype.cpp:
+        * runtime/JSPromiseReaction.cpp:
+        * runtime/JSScope.h:
+        (JSC::Register::operator=): Deleted.
+        (JSC::Register::scope): Deleted.
+        (JSC::ExecState::vm): Deleted.
+        (JSC::ExecState::lexicalGlobalObject): Deleted.
+        (JSC::ExecState::globalThisValue): Deleted.
+        * runtime/JSSetIterator.cpp:
+        * runtime/MapConstructor.cpp:
+        * runtime/MapData.cpp:
+        * runtime/MapIteratorPrototype.cpp:
+        * runtime/MapPrototype.cpp:
+        * runtime/SetConstructor.cpp:
+        * runtime/SetIteratorPrototype.cpp:
+        * runtime/SetPrototype.cpp:
+        * runtime/WeakMapConstructor.cpp:
+        * runtime/WeakMapPrototype.cpp:
+
+2014-09-08  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        Remove FILTERS flag
+        https://bugs.webkit.org/show_bug.cgi?id=136571
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-09-08  Saam Barati  <saambarati1@gmail.com>
+
+        Merge StructureShapes that share the same prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=136549
+
+        Reviewed by Filip Pizlo.
+
+        Instead of keeping track of many discrete StructureShapes that share
+        the same prototype chain, TypeSet should merge StructureShapes that 
+        have the same prototype chain and provide a new member variable for 
+        optional structure fields. This provides a cleaner and more concise
+        interface for dealing with StructureShapes within TypeSet. Instead
+        of having many discrete shapes that are almost identical, almost 
+        identical shapes will be merged together with an interface for 
+        understanding what fields the shapes being merged together differ in.
+
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::StructureShape::addProperty):
+        (JSC::StructureShape::toJSONString):
+        (JSC::StructureShape::inspectorRepresentation):
+        (JSC::StructureShape::hasSamePrototypeChain):
+        (JSC::StructureShape::merge):
+        * runtime/TypeSet.h:
+        * tests/typeProfiler/optional-fields.js: Added.
+        (wrapper.func):
+        (wrapper):
+
+2014-09-08  Jessie Berlin  <jberlin@apple.com>
+
+        More 32-bit Release build fixes after r173364.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-09-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Fix typos in last patch to fix build.
+
+        Unreviewed build fix.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+
+2014-09-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Introduce COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE) and use it
+        https://bugs.webkit.org/show_bug.cgi?id=136616
+
+        Reviewed by Darin Adler.
+        
+        Many compilers will analyze unrechable code paths (e.g. after an
+        unreachable code path), so sometimes they need dead code initializations.
+        But clang with suitable warnings will complain about unreachable code. So
+        use the quirk to include it conditionally.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::handleExitCounts):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        * jsc.cpp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+
+2014-09-06  Darin Adler  <darin@apple.com>
+
+        Make updates suggested by new version of Xcode
+        https://bugs.webkit.org/show_bug.cgi?id=136603
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Added CLANG_WARN_UNREACHABLE_CODE, COMBINE_HIDPI_IMAGES,
+        and ENABLE_STRICT_OBJC_MSGSEND as suggested by Xcode upgrade check.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Update LastUpgradeCheck.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode): Compile out unreachable code
+        for clang, since it understands the code is unreachable.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::fillArgList): Ditto.
+        (JSC::JSArray::copyToArguments): Ditto.
+
+2014-09-05  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: breakpoint actions should work regardless of Content Security Policy
+        https://bugs.webkit.org/show_bug.cgi?id=136542
+
+        Reviewed by Mark Lam.
+
+        Added JSC::DebuggerEvalEnabler, an RAII object which enables eval on a 
+        JSGlobalObject for the duration of a scope, returning the eval enabled state to its
+        original value when the scope exits. Used by JSC::DebuggerCallFrame::evaluate 
+        to allow breakpoint actions to execute JS in pages with a Content Security Policy
+        that would normally prohibit this (such as Inspector's Main.html).
+
+        Refactored Inspector::InjectedScriptBase to use the RAII object instead of manually
+        setting eval enabled and then resetting the original eval enabled state.
+
+        NOTE: The JS::DebuggerEvalEnabler constructor checks the passed in ExecState pointer
+        for null to be equivalent with the original code in Inspector::InjectedScriptBase.
+        InjectedScriptBase is getting the ExecState from ScriptObject::scriptState(), which
+        can currently be null.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerEvalEnabler.h: Added.
+        (JSC::DebuggerEvalEnabler::DebuggerEvalEnabler):
+        (JSC::DebuggerEvalEnabler::~DebuggerEvalEnabler):
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::callFunctionWithEvalEnabled):
+
+2014-09-05  peavo@outlook.com  <peavo@outlook.com>
+
+        [WinCairo] jsc.exe won't run.
+        https://bugs.webkit.org/show_bug.cgi?id=136481
+
+        Reviewed by Alex Christensen.
+        
+        We need to define WIN_CAIRO to avoid looking for the AAS folder.
+
+        * JavaScriptCore.vcxproj/jsc/DLLLauncherWinCairo.props: Added.
+        * JavaScriptCore.vcxproj/jsc/jscLauncher.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncher.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props:
+        * JavaScriptCore.vcxproj/testapi/testapiLauncher.vcxproj:
+
+2014-09-05  David Kilzer  <ddkilzer@apple.com>
+
+        JavaScriptCore should build with newer clang
+        <http://webkit.org/b/136002>
+        <rdar://problem/18020616>
+
+        Reviewed by Geoffrey Garen.
+
+        Other than the JSC::SourceProvider::asID() change (which simply
+        removes code that the optimizing compiler would have discarded
+        in Release builds), we move the |this| checks in OpaqueJSString
+        to NULL checks in to JSBase, JSObjectRef, JSScriptRef,
+        JSStringRef{CF} and JSValueRef.
+
+        Note that the following function arguments are _not_ NULL-checked
+        since doing so would just cover up bugs (and were not needed to
+        prevent any tests from failing):
+        - |script| in JSEvaluateScript(), JSCheckScriptSyntax();
+        - |body| in JSObjectMakeFunction();
+        - |source| in JSScriptCreateReferencingImmortalASCIIText()
+          (which is a const char* anyway);
+        - |source| in JSScriptCreateFromString().
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Add NULL check for |sourceURL|.
+        (JSCheckScriptSyntax): Ditto.
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction): Ditto.
+        * API/JSScriptRef.cpp:
+        (JSScriptCreateReferencingImmortalASCIIText): Ditto.
+        (JSScriptCreateFromString): Add NULL check for |url|.
+        * API/JSStringRef.cpp:
+        (JSStringGetLength): Return early if NULL pointer is passed in.
+        (JSStringGetCharactersPtr): Ditto.
+        (JSStringGetUTF8CString): Ditto.  Also check |buffer| parameter.
+        * API/JSStringRefCF.cpp:
+        (JSStringCopyCFString): Ditto.
+        * API/JSValueRef.cpp:
+        (JSValueMakeString): Add NULL check for |string|.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::string): Remove code that checks |this|.
+        (OpaqueJSString::identifier): Ditto.
+        (OpaqueJSString::characters): Ditto.
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::is8Bit): Remove code that checks |this|.
+        (OpaqueJSString::characters8): Ditto.
+        (OpaqueJSString::characters16): Ditto.
+        (OpaqueJSString::length): Ditto.
+
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::asID): Remove code that checks |this|.
+
+2014-06-06  Jer Noble  <jer.noble@apple.com>
+
+        Refactoring: make MediaTime the primary time type for audiovisual times.
+        https://bugs.webkit.org/show_bug.cgi?id=133579
+
+        Reviewed by Eric Carlson.
+
+        Add a utility function which converts a MediaTime to a JSNumber.
+
+        * runtime/JSCJSValue.h:
+        (JSC::jsNumber):
+
+2014-09-04  Michael Saboff  <msaboff@apple.com>
+
+        ARM: Add more coverage to ARMv7 disassembler
+        https://bugs.webkit.org/show_bug.cgi?id=136565
+
+        Reviewed by Mark Lam.
+
+        Added ARMV7 disassembler support for Push/Pop multiple and floating point instructions
+        VCMP, VCVT[R] between floating point and integer, and VLDR.
+
+        * disassembler/ARMv7/ARMv7DOpcode.cpp:
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataPushPopMultiple::appendRegisterList):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataPopMultiple::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataPushMultiple::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCMP::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::format):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::format):
+        * disassembler/ARMv7/ARMv7DOpcode.h:
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataPushPopMultiple::registerList):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeDataPushPopMultiple::condition):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCMP::condition):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCMP::dBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCMP::vd):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCMP::szBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCMP::eBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCMP::mBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCMP::vm):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::condition):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::dBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::op2):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::vd):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::szBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::op):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::mBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVCVTBetweenFPAndInt::vm):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::condition):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::uBit):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::rn):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::vd):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::doubleReg):
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeVLDR::immediate8):
+
+2014-09-04  Mark Lam  <mark.lam@apple.com>
+
+        Move PropertySlot's inline functions back to PropertySlot.h.
+        <https://webkit.org/b/136547>
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSObject.h:
+        (JSC::PropertySlot::getValue): Deleted.
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+
+2014-09-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Make sure that deleting all code first processes the call edge log, and reenable call edge profiling.
+
+        Rubber stamped by Sam Weinig.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::forEachCodeBlock):
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::recompileAllJSFunctions):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::recompileAllJSFunctionsForTypeProfiling):
+        * runtime/Options.h: Reenable call edge profiling.
+        * runtime/VM.cpp:
+        (JSC::VM::prepareToDiscardCode): Make sure this also processes the call edge log, in case any call edge profiles are about to be destroyed.
+        (JSC::VM::discardAllCode):
+        (JSC::VM::releaseExecutableMemory):
+        (JSC::VM::setEnabledProfiler):
+        (JSC::VM::waitForCompilationsToComplete): Deleted.
+        * runtime/VM.h: Rename waitForCompilationsToComplete() back to prepareToDiscardCode() because the purpose of the method - now as ever - is to do all of the things that need to be done to ensure that code may be safely deleted.
+
+2014-09-04  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Ensure that the call frame set up by vmEntryToNative does not overlap with the stack of the callee
+        https://bugs.webkit.org/show_bug.cgi?id=136485
+
+        Reviewed by Michael Saboff.
+
+        Changed makeHostFunctionCall to keep the stack pointer above the call
+        frame set up by doVMEntry. Thus the callee will/can not override the top
+        of the call frame.
+
+        Refactored the two (32_64 and 64) versions of makeHostFunctionCall to be
+        more alike to help future maintenance.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-09-04  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r173031): crashes during run-layout-jsc on x86/Linux
+        https://bugs.webkit.org/show_bug.cgi?id=136436
+
+        Reviewed by Geoffrey Garen.
+
+        Instead of trying to calculate a stack pointer that allows for possible
+        stacked argument space, just use the "home" stack pointer location.
+        That stack pointer provides space for the worst case number of stacked
+        arguments on architectures that use stacked arguments.  It also provides
+        stack space so that the return PC and caller frame pointer that are stored
+        as part of making the call to operationCallEval will not override any part
+        of the callee frame created on the stack.
+
+        Changed compileCallEval() to use the stackPointer value of the calling
+        function.  That stack pointer is calculated to have enough space for
+        outgoing stacked arguments.  By moving the stack pointer to its "home"
+        position, the caller frame and return PC are not set as part of making
+        the call to operationCallEval().  Moved the explicit setting of the
+        callerFrame field of the callee CallFrame from operationCallEval() to
+        compileCallEval() since it has been the artifact of making a call for
+        most architectures.  Simplified the exception logic in compileCallEval()
+        as a result of the change.  To be compliant with the stack state
+        expected by virtualCallThunkGenerator(), moved the stack pointer to
+        point above the CallerFrameAndPC of the callee CallFrame.
+
+        * jit/JIT.h: Changed callOperationNoExceptionCheck(J_JITOperation_EE, ...)
+        to callOperation(J_JITOperation_EE, ...) as it now can do a typical exception
+        check.
+        * jit/JITCall.cpp & jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEval): Use the home stack pointer when making the call
+        to operationCallEval.  Since the stack pointer adjustment no longer needs
+        to be done after making the call to operationCallEval(), the exception check
+        logic can be simplified.
+        (JSC::JIT::compileCallEvalSlowCase): Restored the stack pointer to point
+        to above the calleeFrame as this is what the generated thunk expects.
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation): Refactor of callOperationNoExceptionCheck
+        with the addition of a standard exception check.
+        (JSC::JIT::callOperationNoExceptionCheck): Deleted.
+        * jit/JITOperations.cpp:
+        (JSC::operationCallEval): Eliminated the explicit setting of caller frame
+        as that is now done in the code generated by compileCallEval().
+
+2014-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Beef up the DFG's CFG analyses to include iterated dominance frontiers and more user-friendly BlockSets
+        https://bugs.webkit.org/show_bug.cgi?id=136520
+
+        Reviewed by Geoffrey Garen.
+        
+        Add code to compute iterated dominance frontiers. This involves using BlockSet a lot, so
+        this patch also makes BlockSet a lot more user-friendly.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGBlockSet.cpp: Added.
+        (JSC::DFG::BlockSet::dump):
+        * dfg/DFGBlockSet.h:
+        (JSC::DFG::BlockSet::iterator::iterator):
+        (JSC::DFG::BlockSet::iterator::operator++):
+        (JSC::DFG::BlockSet::iterator::operator==):
+        (JSC::DFG::BlockSet::iterator::operator!=):
+        (JSC::DFG::BlockSet::Iterable::Iterable):
+        (JSC::DFG::BlockSet::Iterable::begin):
+        (JSC::DFG::BlockSet::Iterable::end):
+        (JSC::DFG::BlockSet::iterable):
+        (JSC::DFG::BlockAdder::BlockAdder):
+        (JSC::DFG::BlockAdder::operator()):
+        * dfg/DFGBlockSetInlines.h: Added.
+        (JSC::DFG::BlockSet::iterator::operator*):
+        * dfg/DFGDominators.cpp:
+        (JSC::DFG::Dominators::strictDominatorsOf):
+        (JSC::DFG::Dominators::dominatorsOf):
+        (JSC::DFG::Dominators::blocksStrictlyDominatedBy):
+        (JSC::DFG::Dominators::blocksDominatedBy):
+        (JSC::DFG::Dominators::dominanceFrontierOf):
+        (JSC::DFG::Dominators::iteratedDominanceFrontierOf):
+        * dfg/DFGDominators.h:
+        (JSC::DFG::Dominators::forAllStrictDominatorsOf):
+        (JSC::DFG::Dominators::forAllDominatorsOf):
+        (JSC::DFG::Dominators::forAllBlocksStrictlyDominatedBy):
+        (JSC::DFG::Dominators::forAllBlocksDominatedBy):
+        (JSC::DFG::Dominators::forAllBlocksInDominanceFrontierOf):
+        (JSC::DFG::Dominators::forAllBlocksInIteratedDominanceFrontierOf):
+        (JSC::DFG::Dominators::forAllBlocksInDominanceFrontierOfImpl):
+        (JSC::DFG::Dominators::forAllBlocksInIteratedDominanceFrontierOfImpl):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        (JSC::DFG::InvalidationPointInjectionPhase::run):
+
+2014-09-04  Mark Lam  <mark.lam@apple.com>
+
+        Fixed indentations and some style warnings in JavaScriptCore/runtime.
+        <https://webkit.org/b/136518>
+
+        Reviewed by Michael Saboff.
+
+        Also removed some superflous spaces.  There are no semantic changes.
+
+        * runtime/Completion.h:
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/DatePrototype.h:
+        * runtime/Error.h:
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.h:
+        * runtime/GetterSetter.h:
+        * runtime/Identifier.h:
+        * runtime/InitializeThreading.h:
+        * runtime/InternalFunction.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSFunction.h:
+        * runtime/JSLock.h:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.h:
+        * runtime/JSString.h:
+        * runtime/JSTypeInfo.h:
+        * runtime/JSWrapperObject.h:
+        * runtime/Lookup.h:
+        * runtime/MathObject.h:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.h:
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.h:
+        * runtime/NumericStrings.h:
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.h:
+        * runtime/PropertyDescriptor.h:
+        * runtime/Protect.h:
+        * runtime/PutPropertySlot.h:
+        * runtime/RegExp.h:
+        * runtime/RegExpCachedResult.h:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.h:
+        * runtime/SmallStrings.h:
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.h:
+        * runtime/StructureChain.h:
+        * runtime/VM.h:
+
+2014-09-04  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        Remove CSS_FILTERS flag
+        https://bugs.webkit.org/show_bug.cgi?id=136529
+
+        Reviewed by Dirk Schulze.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-09-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r173248.
+        https://bugs.webkit.org/show_bug.cgi?id=136536
+
+        call edge profiling and polymorphic call inlining are still
+        causing crashes (Requested by eric_carlson on #webkit).
+
+        Reverted changeset:
+
+        "Reenable call edge profiling and polymorphic call inlining,
+        now that a bunch of the bugs"
+        http://trac.webkit.org/changeset/173248
+
+2014-09-04  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: the profiler should not accrue time to nodes while the debugger is paused
+        https://bugs.webkit.org/show_bug.cgi?id=136352
+
+        Reviewed by Timothy Hatcher.
+
+        Hook up pause/continue events to the LegacyProfiler and any active
+        ProfilerGenerators. If the debugger is paused, all intervening call
+        entries will be created with totalTime as 0.0.
+
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::handlePause):
+        * profiler/LegacyProfiler.cpp: Move from typedef'd callbacks to using
+        std::function. This allows callbacks to take different argument types.
+
+        (JSC::callFunctionForProfilesWithGroup):
+        (JSC::LegacyProfiler::willExecute):
+        (JSC::LegacyProfiler::didExecute):
+        (JSC::LegacyProfiler::exceptionUnwind):
+        (JSC::LegacyProfiler::didPause):
+        (JSC::LegacyProfiler::didContinue):
+        (JSC::dispatchFunctionToProfiles): Deleted.
+        * profiler/LegacyProfiler.h:
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::ProfileGenerator::endCallEntry):
+        (JSC::ProfileGenerator::didExecute): Deleted.
+        * profiler/ProfileGenerator.h:
+        (JSC::ProfileGenerator::didPause):
+        (JSC::ProfileGenerator::didContinue):
+
+2014-09-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r173245.
+        https://bugs.webkit.org/show_bug.cgi?id=136533
+
+        Broke JSC tests. (Requested by ddkilzer on #webkit).
+
+        Reverted changeset:
+
+        "JavaScriptCore should build with newer clang"
+        https://bugs.webkit.org/show_bug.cgi?id=136002
+        http://trac.webkit.org/changeset/173245
+
+2014-09-04  Brian J. Burg  <burg@cs.washington.edu>
+
+        LegacyProfiler: ProfileNodes should be used more like structs
+        https://bugs.webkit.org/show_bug.cgi?id=136381
+
+        Reviewed by Timothy Hatcher.
+
+        Previously, both the profile generator and individual profile nodes
+        were collectively responsible for creating new Call entries and
+        maintaining data structure invariants. This complexity is unnecessary.
+
+        This patch centralizes profile data creation inside the profile generator.
+        The profile nodes manage nextSibling and parent pointers, but do not
+        collect the current time or create new Call entries themselves.
+
+        Since ProfileNode::nextSibling and its callers are only used within
+        debug printing code, it should be compiled out for release builds.
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::AddParentForConsoleStartFunctor::operator()):
+        (JSC::ProfileGenerator::beginCallEntry): create a new Call entry.
+        (JSC::ProfileGenerator::endCallEntry): finish the last Call entry.
+        (JSC::ProfileGenerator::willExecute): inline ProfileNode::willExecute()
+        (JSC::ProfileGenerator::didExecute): inline ProfileNode::didExecute()
+        (JSC::ProfileGenerator::stopProfiling): Only walk up the spine.
+        (JSC::ProfileGenerator::removeProfileStart):
+        (JSC::ProfileGenerator::removeProfileEnd):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::addChild):
+        (JSC::ProfileNode::removeChild):
+        (JSC::ProfileNode::spliceNode): Renamed from insertNode.
+        (JSC::ProfileNode::debugPrintRecursively):
+        (JSC::ProfileNode::willExecute): Deleted.
+        (JSC::ProfileNode::insertNode): Deleted.
+        (JSC::ProfileNode::stopProfiling): Deleted.
+        (JSC::ProfileNode::traverseNextNodePostOrder):
+        (JSC::ProfileNode::endAndRecordCall): Deleted.
+        (JSC::ProfileNode::debugPrintDataSampleStyle):
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::Call::setStartTime):
+        (JSC::ProfileNode::Call::setTotalTime):
+        (JSC::ProfileNode::appendCall):
+        (JSC::ProfileNode::firstChild):
+        (JSC::ProfileNode::lastChild):
+        (JSC::ProfileNode::nextSibling):
+        (JSC::ProfileNode::setNextSibling):
+
+2014-09-02  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: fix prefixes for subclasses of JSC::ConsoleClient
+        https://bugs.webkit.org/show_bug.cgi?id=136476
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/JSGlobalObjectConsoleClient.cpp: Renamed from Source/JavaScriptCore/inspector/JSConsoleClient.cpp.
+        * inspector/JSGlobalObjectConsoleClient.h: Renamed from Source/JavaScriptCore/inspector/JSConsoleClient.h.
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        * inspector/JSGlobalObjectInspectorController.h:
+
+2014-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Reenable call edge profiling and polymorphic call inlining, now that a bunch of the bugs
+        are fixed.
+
+        * runtime/Options.h:
+
+2014-09-03  David Kilzer  <ddkilzer@apple.com>
+
+        JavaScriptCore should build with newer clang
+        <http://webkit.org/b/136002>
+        <rdar://problem/18020616>
+
+        Reviewed by Geoffrey Garen.
+
+        Other than the JSC::SourceProvider::asID() change (which simply
+        removes code that the optimizing compiler would have discarded
+        in Release builds), we move the |this| checks in OpaqueJSString
+        to NULL checks in to JSBase, JSScriptRef, JSStringRef{CF} and
+        JSValueRef.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Use String() in case |script| or |sourceURL|
+        are NULL.
+        * API/JSScriptRef.cpp:
+        (JSScriptCreateReferencingImmortalASCIIText): Use String() in
+        case |url| is NULL.
+        * API/JSStringRef.cpp:
+        (JSStringGetLength): Return early if NULL pointer is passed in.
+        (JSStringGetCharactersPtr): Ditto.
+        (JSStringGetUTF8CString): Ditto.  Also check |buffer| parameter.
+        * API/JSStringRefCF.cpp:
+        (JSStringCopyCFString): Ditto.
+        * API/JSValueRef.cpp:
+        (JSValueMakeString): Use String() in case |string| is NULL.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::string): Remove code that checks |this|.
+        (OpaqueJSString::identifier): Ditto.
+        (OpaqueJSString::characters): Ditto.
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::is8Bit): Remove code that checks |this|.
+        (OpaqueJSString::characters8): Ditto.
+        (OpaqueJSString::characters16): Ditto.
+        (OpaqueJSString::length): Ditto.
+
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::asID): Remove code that checks |this|.
+
+2014-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        CallEdgeProfile::visitWeak() shouldn't attempt to despecify empty profiles
+        https://bugs.webkit.org/show_bug.cgi?id=136511
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CallEdgeProfile.cpp:
+        (JSC::CallEdgeProfile::worthDespecifying):
+        (JSC::CallEdgeProfile::visitWeak):
+        (JSC::CallEdgeProfile::mergeBack):
+
+2014-09-03  David Kilzer  <ddkilzer@apple.com>
+
+        REGRESSION (r167325): (null) entry added to Xcode project file when JSBoundFunction.h was removed
+        <http://webkit.org/b/136509>
+
+        Reviewed by Daniel Bates.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Remove the (null)
+        entry left behind when JSBoundFunction.h was removed.
+
+2014-09-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Avoid warning if a process does not have access to com.apple.webinspector
+        https://bugs.webkit.org/show_bug.cgi?id=136473
+
+        Reviewed by Alexey Proskuryakov.
+
+        Pre-check for access to the mach port to avoid emitting warnings
+        in syslog for processes that do not have access.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::canAccessWebInspectorMachPort):
+        (Inspector::RemoteInspector::shared):
+
+2014-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Temporarily disable call edge profiling. It is causing crashes and I'm still investigating
+        them.
+
+        * runtime/Options.h:
+
+2014-09-03  Balazs Kilvady  <kilvadyb@homejinni.com>
+
+        [MIPS] Wrong register usage in LLInt op_catch.
+        https://bugs.webkit.org/show_bug.cgi?id=125168
+
+        Reviewed by Geoffrey Garen.
+
+        Fix register usage and add PIC header to all the ops in LLInt.
+
+        * offlineasm/instructions.rb:
+        * offlineasm/mips.rb:
+
+2014-09-03  Saam Barati  <saambarati1@gmail.com>
+
+        Create tests for type profiling
+        https://bugs.webkit.org/show_bug.cgi?id=136161
+
+        Reviewed by Geoffrey Garen.
+
+        The type profiler is now being tested. These are basic tests that don't 
+        check every edge case, but will catch any major failures in the type profiler. 
+        These tests cover:
+        - The basic, inheritance-based type system in TypeSet.
+        - Function return types.
+        - Correct merging of types for multiple assignments to one variable.
+
+        This patch also provides an API for writing new tests for
+        the type profiler. The API works by passing in a function and a 
+        unique substring of an expression contained in that function, and 
+        returns an object representing type information for that expression.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionFindTypeForExpression):
+        (functionReturnTypeFor):
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::typeInformationForExpressionAtOffset):
+        * runtime/TypeProfiler.h:
+        * runtime/TypeProfilerLog.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::toJSONString):
+        (JSC::StructureShape::toJSONString):
+        * runtime/TypeSet.h:
+        * tests/typeProfiler: Added.
+        * tests/typeProfiler.yaml: Added.
+        * tests/typeProfiler/basic.js: Added.
+        (wrapper.foo):
+        (wrapper):
+        * tests/typeProfiler/captured.js: Added.
+        (wrapper.changeFoo):
+        (wrapper):
+        * tests/typeProfiler/driver: Added.
+        * tests/typeProfiler/driver/driver.js: Added.
+        (assert):
+        * tests/typeProfiler/inheritance.js: Added.
+        (wrapper.A):
+        (wrapper.B):
+        (wrapper.C):
+        (wrapper):
+        * tests/typeProfiler/return.js: Added.
+        (foo):
+        (Ctor):
+
+2014-09-03  Julien Brianceau   <jbriance@cisco.com>
+
+        Add missing implementations to fix build for sh4 architecture
+        https://bugs.webkit.org/show_bug.cgi?id=136455
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::store8):
+        (JSC::MacroAssemblerSH4::moveWithPatch):
+        (JSC::MacroAssemblerSH4::branchAdd32):
+        (JSC::MacroAssemblerSH4::branch32WithPatch):
+        (JSC::MacroAssemblerSH4::abortWithReason):
+        (JSC::MacroAssemblerSH4::canJumpReplacePatchableBranch32WithPatch):
+        (JSC::MacroAssemblerSH4::startOfPatchableBranch32WithPatchOnAddress):
+        (JSC::MacroAssemblerSH4::revertJumpReplacementToPatchableBranch32WithPatch):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitFunctionPrologue):
+        (JSC::AssemblyHelpers::emitFunctionEpilogue):
+
+2014-09-03  Dan Bernstein  <mitz@apple.com>
+
+        Get rid of HIGH_DPI_CANVAS leftovers
+        https://bugs.webkit.org/show_bug.cgi?id=136491
+
+        Reviewed by Benjamin Poulain.
+
+        * Configurations/FeatureDefines.xcconfig: Removed definition of ENABLE_HIGH_DPI_CANVAS
+        and removed it from FEATURE_DEFINES.
+
+2014-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        CallEdgeProfile::visitWeak() should gracefully handle the case where primaryCallee duplicates an entry in otherCallees
+        https://bugs.webkit.org/show_bug.cgi?id=136490
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CallEdgeProfile.cpp:
+        (JSC::CallEdgeProfile::visitWeak):
+
+2014-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL In implementation sets callReturnLocation incorrectly leading to crashes beneath repatchCall()
+        https://bugs.webkit.org/show_bug.cgi?id=136488
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::generateCheckInICFastPath): The call is in the slow path.
+        * tests/stress/ftl-in-overflow.js: Added. This used to crash with 100% with FTL enabled.
+        (foo):
+
+2014-09-03  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Don't generate superfluous mov instructions for move immediate on ARM64.
+        https://bugs.webkit.org/show_bug.cgi?id=136435
+
+        Reviewed by Michael Saboff.
+
+        On ARM64, the size of an immediate operand for a mov instruction is 16
+        bits. Thus, a move immediate offlineasm instruction may potentially be
+        split up to several machine level instructions. The current
+        implementation always emits a mov for the least significant 16 bits of
+        the value. However, if any of the bits 63:16 are significant then the
+        first emitted mov already filled bits 15:0 with zeroes (or ones, for
+        negative values). So, if bits 15:0 of the value are all zeroes (or ones)
+        then the last mov does not need to be emitted.
+
+        * offlineasm/arm64.rb:
+
+2014-09-02  Brian J. Burg  <burg@cs.washington.edu>
+
+        LegacyProfiler: remove redundant ProfileNode members and other cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=136380
+
+        Reviewed by Timothy Hatcher.
+
+        ProfileNode's selfTime and totalTime members are redundant and only used
+        for dumping profile data from debug-only code. Remove the members and compute
+        the same data on-demand when necessary using a postorder traversal functor.
+
+        Remove ProfileNode.head since it is only used to calculate percentages for
+        dumped profile data. This can be explicitly passed around when needed.
+
+        Rename Profile.head to Profile.rootNode, and other various renamings.
+
+        Rearrange some header includes so that touching LegacyProfiler-related headers
+        will no longer cause a full rebuild.
+
+        * inspector/JSConsoleClient.cpp: Add header include.
+        * inspector/agents/InspectorProfilerAgent.cpp:
+        (Inspector::InspectorProfilerAgent::buildProfileInspectorObject):
+        * inspector/protocol/Profiler.json: Remove unused Profile.idleTime member.
+        * jit/JIT.h: Remove header include.
+        * jit/JITCode.h: Remove header include.
+        * jit/JITOperations.cpp: Sort and add header include.
+        * llint/LLIntSlowPaths.cpp: Sort and add header include.
+        * profiler/Profile.cpp: Rename the debug dumping functions. Move the node
+        postorder traversal code to ProfileNode so we can traverse any subtree.
+        (JSC::Profile::Profile):
+        (JSC::Profile::debugPrint):
+        (JSC::Profile::debugPrintSampleStyle):
+        (JSC::Profile::forEach): Deleted.
+        (JSC::Profile::debugPrintData): Deleted.
+        (JSC::Profile::debugPrintDataSampleStyle): Deleted.
+        * profiler/Profile.h:
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::AddParentForConsoleStartFunctor::AddParentForConsoleStartFunctor):
+        (JSC::AddParentForConsoleStartFunctor::operator()):
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::StopProfilingFunctor::operator()):
+        (JSC::ProfileGenerator::stopProfiling):
+        (JSC::ProfileGenerator::removeProfileStart):
+        (JSC::ProfileGenerator::removeProfileEnd):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::willExecute):
+        (JSC::ProfileNode::removeChild):
+        (JSC::ProfileNode::stopProfiling):
+        (JSC::ProfileNode::endAndRecordCall):
+        (JSC::ProfileNode::debugPrint):
+        (JSC::ProfileNode::debugPrintSampleStyle):
+        (JSC::ProfileNode::debugPrintRecursively):
+        (JSC::ProfileNode::debugPrintSampleStyleRecursively):
+        (JSC::ProfileNode::debugPrintData): Deleted.
+        (JSC::ProfileNode::debugPrintDataSampleStyle): Deleted.
+        * profiler/ProfileNode.h: Calculate per-node self and total times using a postorder traversal.
+        The forEachNodePostorder functor traverses the subtree rooted at |this|.
+        (JSC::ProfileNode::create):
+        (JSC::ProfileNode::calls):
+        (JSC::ProfileNode::forEachNodePostorder):
+        (JSC::CalculateProfileSubtreeDataFunctor::returnValue):
+        (JSC::CalculateProfileSubtreeDataFunctor::operator()):
+        (JSC::ProfileNode::head): Deleted.
+        (JSC::ProfileNode::setHead): Deleted.
+        (JSC::ProfileNode::totalTime): Deleted.
+        (JSC::ProfileNode::setTotalTime): Deleted.
+        (JSC::ProfileNode::selfTime): Deleted.
+        (JSC::ProfileNode::setSelfTime): Deleted.
+        (JSC::ProfileNode::totalPercent): Deleted.
+        (JSC::ProfileNode::selfPercent): Deleted.
+        * runtime/ConsoleClient.h: Remove header include.
+
+2014-09-02  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: remove ProfilerAgent and legacy profiler files in the frontend
+        https://bugs.webkit.org/show_bug.cgi?id=136462
+
+        Reviewed by Timothy Hatcher.
+
+        It's not used by the frontend anymore.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * inspector/JSConsoleClient.cpp:
+        (Inspector::JSConsoleClient::JSConsoleClient): Stub out console.profile/profileEnd
+        methods since they didn't work for JSContexts anyway.
+        (Inspector::JSConsoleClient::profile):
+        (Inspector::JSConsoleClient::profileEnd):
+        * inspector/JSConsoleClient.h:
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        * inspector/agents/InspectorProfilerAgent.cpp: Removed.
+        * inspector/agents/InspectorProfilerAgent.h: Removed.
+        * inspector/agents/JSGlobalObjectProfilerAgent.cpp: Removed.
+        * inspector/agents/JSGlobalObjectProfilerAgent.h: Removed.
+        * inspector/protocol/Profiler.json: Removed.
+
+2014-09-02  Andreas Kling  <akling@apple.com>
+
+        Optimize own property GetByVals with rope string subscripts.
+        <https://webkit.org/b/136458>
+
+        For simple JSObjects that don't override getOwnPropertySlot to implement
+        custom properties, we have a fast path that grabs directly at the object
+        property storage.
+
+        Make this fast path even faster when the property name is an unresolved
+        rope string by using JSString::toExistingAtomicString(). This is faster
+        because it avoids allocating a new StringImpl if the string is already
+        a known Identifier, which is guaranteed to be the case if it's present
+        as an own property on the object.)
+
+        ~10% speed-up on Dromaeo/dom-attr.html
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+
+            When using the fastGetOwnProperty() optimization, get the String
+            out of JSString by using toExistingAtomicString(). This avoids
+            StringImpl allocation and lets us bypass the PropertyTable lookup
+            entirely if no AtomicString is found.
+
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::fastGetOwnProperty):
+
+            Make fastGetOwnProperty() take a PropertyName instead of a String.
+            This avoids churning the ref count, since we don't need to create
+            a temporary wrapper around the AtomicStringImpl* found in GetByVal.
+
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+
+            Add constructor: PropertyName(AtomicStringImpl*)
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::get):
+        (JSC::PropertyTable::findWithString): Deleted.
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+
+            Remove code for querying a PropertyTable with an unhashed string key
+            since the only client is now gone.
+
+2014-09-02  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        [ARM] MacroAssembler generating incorrect code on ARM32 Traditional
+        https://bugs.webkit.org/show_bug.cgi?id=136429
+
+        Reviewed by Csaba Osztrogonác.
+
+        Changed test32 to use tst to check if reg is zero, instead of cmp.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::test32):
+
+2014-09-02  Michael Saboff  <msaboff@apple.com>
+
+        Out of bounds write in vmEntryToJavaScript / JSC::JITCode::execute
+        https://bugs.webkit.org/show_bug.cgi?id=136305
+
+        Reviewed by Filip Pizlo.
+
+        While preparing the callee's CallFrame, ProtoCallFrame fixes any arity mismatch
+        and then JITCode::execute() calls the normal entrypoint.  This is incompatible
+        with the expectation of FTL generated functions.  Changed ProtoCallFrame to not 
+        perform the arity fix, but just flag an arity mismatch.  now JITCode::execute()
+        uses that arity mismatch condition to select the normal or arity check
+        entrypoint.  The entrypoint selection is only done for functions, programs
+        and eval always have one parameter.
+
+        * interpreter/ProtoCallFrame.cpp:
+        (JSC::ProtoCallFrame::init): Changed to flag arity mismatch instead of fixing it.
+        * interpreter/ProtoCallFrame.h:
+        (JSC::ProtoCallFrame::needArityCheck): New boolean to signify what entrypoint
+        should be called.
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute): Select normal or arity check entrypoint as appropriate.
+
+2014-09-02  peavo@outlook.com  <peavo@outlook.com>
+
+        [WinCairo] testapi.exe is not built.
+        https://bugs.webkit.org/show_bug.cgi?id=136369
+
+        Reviewed by Alex Christensen.
+
+        The testapi project should be of type Application.
+
+        * JavaScriptCore.vcxproj/jsc/jscLauncher.vcxproj: Change project type to Application.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncher.vcxproj: Ditto.
+        * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props: Compile and link fix.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncher.vcxproj: Change project type to Application.
+
+2014-09-01  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        [CMAKE] Add missing offlineasm dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=136437
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add the ARM64, MIPS and SH4 backends to the dependencies.
+
+        * CMakeLists.txt:
+
+2014-09-01  Brian J. Burg  <burg@cs.washington.edu>
+
+        Provide column numbers to DTrace willExecute/didExecute probes
+        https://bugs.webkit.org/show_bug.cgi?id=136434
+
+        Reviewed by Antti Koivisto.
+
+        Provide the columnNumber and update stubs for !HAVE(DTRACE).
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        * runtime/Tracing.d:
+        * runtime/Tracing.h:
+
+2014-09-01  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE] Build warning by INTERFACE_LINK_LIBRARIES
+        https://bugs.webkit.org/show_bug.cgi?id=136194
+
+        Reviewed by Csaba Osztrogonác.
+
+        Set the LINK_INTERFACE_LIBRARIES target property on the top level CMakeLists.txt.
+
+        * CMakeLists.txt:
+
+2014-08-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Use RetainPtr::autorelease in some places where it seems appropriate
+        https://bugs.webkit.org/show_bug.cgi?id=136280
+
+        Reviewed by Darin Adler.
+
+        * API/JSContext.mm:
+        (-[JSContext name]): Use RetainPtr::autorelease() in place of ObjC autorelease.
+        * API/JSValue.mm:
+        (valueToString): Make appropriate use of RetainPtr
+
+2014-08-29  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Ensure that the call frame passed from doVMEntry to the called function always contains the valid scope chain.
+        https://bugs.webkit.org/show_bug.cgi?id=136391
+
+        Reviewed by Michael Saboff.
+
+        Do not rely on calling conventions to fill in the CallerFrame component
+        of the ExecState* parameter of the called function.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-08-29  Saam Barati  <sbarati@apple.com>
+
+        emit op_profile_type for deconstruction assignments
+        https://bugs.webkit.org/show_bug.cgi?id=136274
+
+        Reviewed by Filip Pizlo.
+
+        Enable type profiling for ES6 deconstruction expressions.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BindingNode::bindValue):
+
+2014-08-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JavaScriptCore: Use ASCIILiteral where possible
+        https://bugs.webkit.org/show_bug.cgi?id=136179
+
+        Reviewed by Michael Saboff.
+
+        General string / character related changes. Use ASCIILiteral where
+        possible, jsNontrivialString where possible, and replace string
+        literals with character literals in some places.
+
+        No new tests, no changes to functionality.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::nameForRegister):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitBytecode):
+        (JSC::PrefixNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::ObjectPatternNode::toString):
+        * dfg/DFGFunctionWhitelist.cpp:
+        (JSC::DFG::FunctionWhitelist::contains):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::newTypedArrayWithSize):
+        (JSC::DFG::newTypedArrayWithOneArgument):
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::addToFrontend):
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::InspectorBackendDispatcher::dispatch):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::extractSourceInformationFromException):
+        * inspector/scripts/codegen/generator_templates.py:
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::functionName):
+        (JSC::StackVisitor::Frame::sourceURL):
+        * jit/JITOperations.cpp:
+        * jsc.cpp:
+        (functionDescribeArray):
+        (functionRun):
+        (functionLoad):
+        (functionReadFile):
+        (functionCheckSyntax):
+        (functionTransferArrayBuffer):
+        (runWithScripts):
+        (runInteractive):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::invalidCharacterMessage):
+        (JSC::Lexer<T>::parseString):
+        (JSC::Lexer<T>::parseStringSlowCase):
+        (JSC::Lexer<T>::lex):
+        * profiler/Profile.cpp:
+        (JSC::Profile::Profile):
+        * runtime/Arguments.cpp:
+        (JSC::argumentsFuncIterator):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::performSlowSort):
+        (JSC::arrayProtoFuncSort):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        (JSC::createInvalidParameterError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        (JSC::createErrorForInvalidGlobalAssignment):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::finishCreation):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::create):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::finishCreation):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::Lexer::lex):
+        (JSC::LiteralParser<CharType>::Lexer::lexString):
+        (JSC::LiteralParser<CharType>::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::getErrorMessage):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::seenTypes):
+        (JSC::TypeSet::displayName):
+        (JSC::TypeSet::allPrimitiveTypeNames):
+        (JSC::StructureShape::propertyHash):
+        (JSC::StructureShape::stringRepresentation):
+
+2014-08-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviwed, remove empty directories.
+
+        * qt: Removed.
+
+2014-08-28  Mark Lam  <mark.lam@apple.com>
+
+        DebuggerCallFrame::scope() should return a DebuggerScope.
+        <https://webkit.org/b/134420>
+
+        Reviewed by Geoffrey Garen.
+
+        Rolling back in r170680 with the fix for <https://webkit.org/b/135656>.
+
+        Previously, DebuggerCallFrame::scope() returns a JSActivation (and relevant
+        peers) which the WebInspector will use to introspect CallFrame variables.
+        Instead, we should be returning a DebuggerScope as an abstraction layer that
+        provides the introspection functionality that the WebInspector needs.  This
+        is the first step towards not forcing every frame to have a JSActivation
+        object just because the debugger is enabled.
+
+        1. Instantiate the debuggerScopeStructure as a member of the JSGlobalObject
+           instead of the VM.  This allows JSObject::globalObject() to be able to
+           return the global object for the DebuggerScope.
+
+        2. On the DebuggerScope's life-cycle management:
+
+           The DebuggerCallFrame is designed to be "valid" only during a debugging session
+           (while the debugger is broken) through the use of a DebuggerCallFrameScope in
+           Debugger::pauseIfNeeded().  Once the debugger resumes from the break, the
+           DebuggerCallFrameScope destructs, and the DebuggerCallFrame will be invalidated.
+           We can't guarantee (from this code alone) that the Inspector code isn't still
+           holding a ref to the DebuggerCallFrame (though they shouldn't), but by contract,
+           the frame will be invalidated, and any attempt to query it will return null values.
+           This is pre-existing behavior.
+
+           Now, we're adding the DebuggerScope into the picture.  While a single debugger
+           pause session is in progress, the Inspector may request the scope from the
+           DebuggerCallFrame.  While the DebuggerCallFrame is still valid, we want
+           DebuggerCallFrame::scope() to always return the same DebuggerScope object.
+           This is why we hold on to the DebuggerScope with a strong ref.
+
+           If we use a weak ref instead, the following cooky behavior can manifest:
+           1. The Inspector calls Debugger::scope() to get the top scope.
+           2. The Inspector iterates down the scope chain and is now only holding a
+              reference to a parent scope.  It is no longer referencing the top scope.
+           3. A GC occurs, and the DebuggerCallFrame's weak m_scope ref to the top scope
+              gets cleared.
+           4. The Inspector calls DebuggerCallFrame::scope() to get the top scope again but gets
+              a different DebuggerScope instance.
+           5. The Inspector iterates down the scope chain but never sees the parent scope
+              instance that retained a ref to in step 2 above.  This is because when iterating
+              this new DebuggerScope instance (which has no knowledge of the previous parent
+              DebuggerScope instance), a new DebuggerScope instance will get created for the
+              same parent scope. 
+
+           Since the DebuggerScope is a JSObject, its liveness is determined by its reachability.
+           However, its "validity" is determined by the life-cycle of its owner DebuggerCallFrame.
+           When the owner DebuggerCallFrame gets invalidated, its debugger scope chain (if
+           instantiated) will also get invalidated.  This is why we need the
+           DebuggerScope::invalidateChain() method.  The Inspector should not be using the
+           DebuggerScope instance after its owner DebuggerCallFrame is invalidated.  If it does,
+           those methods will do nothing or returned a failed status.
+
+        Fix for <https://webkit.org/b/135656>:
+        3. DebuggerScope::getOwnPropertySlot() and DebuggerScope::put() need to set
+           m_thisValue in the returned slot to the wrapped scope object.  Previously,
+           it was pointing to the DebuggerScope though the rest of the fields in the
+           returned slot will be set to data pertaining the wrapped scope object.
+
+        4. DebuggerScope::getOwnPropertySlot() will invoke getPropertySlot() on its
+           wrapped scope.  This is because JSObject::getPropertySlot() cannot be
+           overridden, and when called on a DebuggerScope, will not know to look in
+           the ptototype chain of the DebuggerScope's wrapped scope.  Hence, we'll
+           treat all properties in the wrapped scope as own properties in the
+           DebuggerScope.  This is fine because the WebInspector does not presently
+           care about where in the prototype chain the scope property comes from.
+
+           Note that the DebuggerScope and the JSActivation objects that it wraps do
+           not have prototypes.  They are always jsNull().  This works perfectly with
+           the above change to use getPropertySlot() instead of getOwnPropertySlot().
+           To make this an explicit invariant, I also changed DebuggerScope::createStructure()
+           and JSActivation::createStructure() to not take a prototype argument, and
+           to always use jsNull() for their prototype value.
+
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::scope):
+        (JSC::DebuggerCallFrame::evaluate):
+        (JSC::DebuggerCallFrame::invalidate):
+        * debugger/DebuggerCallFrame.h:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::DebuggerScope):
+        (JSC::DebuggerScope::finishCreation):
+        (JSC::DebuggerScope::visitChildren):
+        (JSC::DebuggerScope::className):
+        (JSC::DebuggerScope::getOwnPropertySlot):
+        (JSC::DebuggerScope::put):
+        (JSC::DebuggerScope::deleteProperty):
+        (JSC::DebuggerScope::getOwnPropertyNames):
+        (JSC::DebuggerScope::defineOwnProperty):
+        (JSC::DebuggerScope::next):
+        (JSC::DebuggerScope::invalidateChain):
+        (JSC::DebuggerScope::isWithScope):
+        (JSC::DebuggerScope::isGlobalScope):
+        (JSC::DebuggerScope::isFunctionOrEvalScope):
+        * debugger/DebuggerScope.h:
+        (JSC::DebuggerScope::create):
+        (JSC::DebuggerScope::createStructure):
+        (JSC::DebuggerScope::iterator::iterator):
+        (JSC::DebuggerScope::iterator::get):
+        (JSC::DebuggerScope::iterator::operator++):
+        (JSC::DebuggerScope::iterator::operator==):
+        (JSC::DebuggerScope::iterator::operator!=):
+        (JSC::DebuggerScope::isValid):
+        (JSC::DebuggerScope::jsScope):
+        (JSC::DebuggerScope::begin):
+        (JSC::DebuggerScope::end):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::scopeType):
+        (Inspector::JSJavaScriptCallFrame::scopeChain):
+        * inspector/JavaScriptCallFrame.h:
+        (Inspector::JavaScriptCallFrame::scopeChain):
+        * inspector/ScriptDebugServer.cpp:
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::debuggerScopeStructure):
+        * runtime/JSObject.cpp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::isWithScope):
+        * runtime/JSScope.h:
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::setThisValue):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setThisValue):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2014-08-28  Andreas Kling  <akling@apple.com>
+
+        Use JSString::toIdentifier() in more places.
+        <https://webkit.org/b/136348>
+
+        Call sites that grab the WTF::String from a JSString using value() can
+        use the more efficient toIdentifier() if the string is going to be used
+        to construct an Identifier.
+
+        If the JSString is a rope that resolves to something that is already
+        present in the VM's Identifier table, using toIdentifier() can avoid
+        allocating a new StringImpl.
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+
+2014-08-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should compute immediate dominators using the O(n log n) form of Lengauer and Tarjan's "A Fast Algorithm for Finding Dominators in a Flowgraph"
+        https://bugs.webkit.org/show_bug.cgi?id=93361
+
+        Reviewed by Mark Hahnenberg.
+        
+        This patch also adds some new utilities for reasoning about block-keyed maps, block sets,
+        and block worklists. It changes preexisting code to use these abstractions.
+        
+        The main effect of this code is that all current clients of dominators end up using the
+        results of the new idom calculation. We convert the dom tree to a dominance test using
+        Dietz's pre/post number range check trick.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAnalysis.h:
+        (JSC::DFG::Analysis::computeIfNecessary):
+        (JSC::DFG::Analysis::computeDependencies):
+        * dfg/DFGBlockMap.h: Added.
+        (JSC::DFG::BlockMap::BlockMap):
+        (JSC::DFG::BlockMap::size):
+        (JSC::DFG::BlockMap::atIndex):
+        (JSC::DFG::BlockMap::operator[]):
+        * dfg/DFGBlockMapInlines.h: Added.
+        (JSC::DFG::BlockMap<T>::BlockMap):
+        * dfg/DFGBlockSet.h: Added.
+        (JSC::DFG::BlockSet::BlockSet):
+        (JSC::DFG::BlockSet::add):
+        (JSC::DFG::BlockSet::contains):
+        * dfg/DFGBlockWorklist.cpp: Added.
+        (JSC::DFG::BlockWorklist::BlockWorklist):
+        (JSC::DFG::BlockWorklist::~BlockWorklist):
+        (JSC::DFG::BlockWorklist::push):
+        (JSC::DFG::BlockWorklist::pop):
+        (JSC::DFG::PostOrderBlockWorklist::PostOrderBlockWorklist):
+        (JSC::DFG::PostOrderBlockWorklist::~PostOrderBlockWorklist):
+        (JSC::DFG::PostOrderBlockWorklist::pushPre):
+        (JSC::DFG::PostOrderBlockWorklist::pushPost):
+        (JSC::DFG::PostOrderBlockWorklist::pop):
+        * dfg/DFGBlockWorklist.h: Added.
+        (JSC::DFG::BlockWorklist::notEmpty):
+        (JSC::DFG::BlockWith::BlockWith):
+        (JSC::DFG::BlockWith::operator UnspecifiedBoolType*):
+        (JSC::DFG::ExtendedBlockWorklist::ExtendedBlockWorklist):
+        (JSC::DFG::ExtendedBlockWorklist::forcePush):
+        (JSC::DFG::ExtendedBlockWorklist::push):
+        (JSC::DFG::ExtendedBlockWorklist::notEmpty):
+        (JSC::DFG::ExtendedBlockWorklist::pop):
+        (JSC::DFG::BlockWithOrder::BlockWithOrder):
+        (JSC::DFG::BlockWithOrder::operator UnspecifiedBoolType*):
+        (JSC::DFG::PostOrderBlockWorklist::push):
+        (JSC::DFG::PostOrderBlockWorklist::notEmpty):
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGDominators.cpp:
+        (JSC::DFG::Dominators::compute):
+        (JSC::DFG::Dominators::naiveDominates):
+        (JSC::DFG::Dominators::dump):
+        (JSC::DFG::Dominators::pruneDominators): Deleted.
+        * dfg/DFGDominators.h:
+        (JSC::DFG::Dominators::strictlyDominates):
+        (JSC::DFG::Dominators::dominates):
+        (JSC::DFG::Dominators::BlockData::BlockData):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::getBlocksInPreOrder):
+        (JSC::DFG::Graph::getBlocksInPostOrder):
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        (JSC::DFG::InvalidationPointInjectionPhase::run):
+        * dfg/DFGNaiveDominators.cpp: Added.
+        (JSC::DFG::NaiveDominators::NaiveDominators):
+        (JSC::DFG::NaiveDominators::~NaiveDominators):
+        (JSC::DFG::NaiveDominators::compute):
+        (JSC::DFG::NaiveDominators::pruneDominators):
+        (JSC::DFG::NaiveDominators::dump):
+        * dfg/DFGNaiveDominators.h: Added.
+        (JSC::DFG::NaiveDominators::dominates):
+        * dfg/DFGNaturalLoops.cpp:
+        (JSC::DFG::NaturalLoops::computeDependencies):
+        (JSC::DFG::NaturalLoops::compute):
+        * dfg/DFGNaturalLoops.h:
+
+2014-08-27  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should be able to do polymorphic call inlining
+        https://bugs.webkit.org/show_bug.cgi?id=135145
+
+        Reviewed by Geoffrey Garen.
+        
+        Added a log-based high-fidelity call edge profiler that runs in DFG JIT (and optionally
+        baseline JIT) code. Used it to do precise polymorphic inlining in the FTL. Potential
+        inlining sites use the call edge profile if it is available, but they will still fall back
+        on the call inline cache and rare case counts if it's not. Polymorphic inlining means that
+        multiple possible callees can be inlined with a switch to guard them. The slow path may
+        either be an OSR exit or a virtual call.
+        
+        The call edge profiling added in this patch is very precise - it will tell you about every
+        call that has ever happened. It took some effort to reduce the overhead of this profiling.
+        This mostly involved ensuring that we don't do it unnecessarily. For example, we avoid it
+        in the baseline JIT (you can conditionally enable it but it's off by default) and we only do
+        it in the DFG JIT if we know that the regular inline cache profiling wasn't precise enough.
+        I also experimented with reducing the precision of the profiling. This led to a significant
+        reduction in the speed-up, so I avoided this approach. I also explored making log processing
+        concurrent, but that didn't help. Also, I tested the overhead of the log processing and
+        found that most of the overhead of this profiling is actually in putting things into the log
+        rather than in processing the log - that part appears to be surprisingly cheap.
+        
+        Polymorphic inlining could be enabled in the DFG if we enabled baseline call edge profiling,
+        and if we guarded such inlining sites with some profiling mechanism to detect
+        polyvariant monomorphisation opportunities (where the callsite being inlined reveals that
+        it's actually monomorphic).
+        
+        This is a ~28% speed-up on deltablue and a ~7% speed-up on richards, with small speed-ups on
+        other programs as well. It's about a 2% speed-up on Octane version 2, and never a regression
+        on anything we care about. Some aggregates, like V8Spider, see a regression. This is
+        highlighting the increase in profiling overhead. But since this doesn't show up on any major
+        score (code-load or SunSpider), it's probably not relevant.
+        
+        Relanding after fixing debug assertions in fast/storage/serialized-script-value.html.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallEdge.cpp: Added.
+        (JSC::CallEdge::dump):
+        * bytecode/CallEdge.h: Added.
+        (JSC::CallEdge::operator!):
+        (JSC::CallEdge::callee):
+        (JSC::CallEdge::count):
+        (JSC::CallEdge::despecifiedClosure):
+        (JSC::CallEdge::CallEdge):
+        * bytecode/CallEdgeProfile.cpp: Added.
+        (JSC::CallEdgeProfile::callEdges):
+        (JSC::CallEdgeProfile::numCallsToKnownCells):
+        (JSC::worthDespecifying):
+        (JSC::CallEdgeProfile::worthDespecifying):
+        (JSC::CallEdgeProfile::visitWeak):
+        (JSC::CallEdgeProfile::addSlow):
+        (JSC::CallEdgeProfile::mergeBack):
+        (JSC::CallEdgeProfile::fadeByHalf):
+        (JSC::CallEdgeLog::CallEdgeLog):
+        (JSC::CallEdgeLog::~CallEdgeLog):
+        (JSC::CallEdgeLog::isEnabled):
+        (JSC::operationProcessCallEdgeLog):
+        (JSC::CallEdgeLog::emitLogCode):
+        (JSC::CallEdgeLog::processLog):
+        * bytecode/CallEdgeProfile.h: Added.
+        (JSC::CallEdgeProfile::numCallsToNotCell):
+        (JSC::CallEdgeProfile::numCallsToUnknownCell):
+        (JSC::CallEdgeProfile::totalCalls):
+        * bytecode/CallEdgeProfileInlines.h: Added.
+        (JSC::CallEdgeProfile::CallEdgeProfile):
+        (JSC::CallEdgeProfile::add):
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkInfo.h:
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeExitSiteData):
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+        (JSC::CallLinkStatus::computeFromCallEdgeProfile):
+        (JSC::CallLinkStatus::computeDFGStatuses):
+        (JSC::CallLinkStatus::isClosureCall):
+        (JSC::CallLinkStatus::makeClosureCall):
+        (JSC::CallLinkStatus::dump):
+        (JSC::CallLinkStatus::function): Deleted.
+        (JSC::CallLinkStatus::internalFunction): Deleted.
+        (JSC::CallLinkStatus::intrinsicFor): Deleted.
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::couldTakeSlowPath):
+        (JSC::CallLinkStatus::edges):
+        (JSC::CallLinkStatus::size):
+        (JSC::CallLinkStatus::at):
+        (JSC::CallLinkStatus::operator[]):
+        (JSC::CallLinkStatus::canOptimize):
+        (JSC::CallLinkStatus::canTrustCounts):
+        (JSC::CallLinkStatus::isClosureCall): Deleted.
+        (JSC::CallLinkStatus::callTarget): Deleted.
+        (JSC::CallLinkStatus::executable): Deleted.
+        (JSC::CallLinkStatus::makeClosureCall): Deleted.
+        * bytecode/CallVariant.cpp: Added.
+        (JSC::CallVariant::dump):
+        * bytecode/CallVariant.h: Added.
+        (JSC::CallVariant::CallVariant):
+        (JSC::CallVariant::operator!):
+        (JSC::CallVariant::despecifiedClosure):
+        (JSC::CallVariant::rawCalleeCell):
+        (JSC::CallVariant::internalFunction):
+        (JSC::CallVariant::function):
+        (JSC::CallVariant::isClosureCall):
+        (JSC::CallVariant::executable):
+        (JSC::CallVariant::nonExecutableCallee):
+        (JSC::CallVariant::intrinsicFor):
+        (JSC::CallVariant::functionExecutable):
+        (JSC::CallVariant::isHashTableDeletedValue):
+        (JSC::CallVariant::operator==):
+        (JSC::CallVariant::operator!=):
+        (JSC::CallVariant::operator<):
+        (JSC::CallVariant::operator>):
+        (JSC::CallVariant::operator<=):
+        (JSC::CallVariant::operator>=):
+        (JSC::CallVariant::hash):
+        (JSC::CallVariant::deletedToken):
+        (JSC::CallVariantHash::hash):
+        (JSC::CallVariantHash::equal):
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::isNormalCall):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::~BasicBlock):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::takeLast):
+        (JSC::DFG::BasicBlock::didLink):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::processSetLocalQueue):
+        (JSC::DFG::ByteCodeParser::removeLastNodeFromGraph):
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+        (JSC::DFG::ByteCodeParser::undoFunctionChecks):
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::cancelLinkingForBlock):
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::prepareToParseBlock):
+        (JSC::DFG::ByteCodeParser::clearCaches):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::linkBlocks):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::getBlocksInPreOrder):
+        (JSC::DFG::Graph::visitChildren):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::switchLookupValue):
+        * dfg/DFGLazyJSValue.h:
+        (JSC::DFG::LazyJSValue::switchLookupValue): Deleted.
+        * dfg/DFGNode.cpp:
+        (WTF::printInternal):
+        * dfg/DFGNode.h:
+        (JSC::DFG::OpInfo::OpInfo):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::cellOperand):
+        (JSC::DFG::Node::setCellOperand):
+        (JSC::DFG::Node::canBeKnownFunction): Deleted.
+        (JSC::DFG::Node::hasKnownFunction): Deleted.
+        (JSC::DFG::Node::knownFunction): Deleted.
+        (JSC::DFG::Node::giveKnownFunction): Deleted.
+        (JSC::DFG::Node::hasFunction): Deleted.
+        (JSC::DFG::Node::function): Deleted.
+        (JSC::DFG::Node::hasExecutable): Deleted.
+        (JSC::DFG::Node::executable): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPhantomCanonicalizationPhase.cpp:
+        (JSC::DFG::PhantomCanonicalizationPhase::run):
+        * dfg/DFGPhantomRemovalPhase.cpp:
+        (JSC::DFG::PhantomRemovalPhase::run):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitch):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        (JSC::DFG::TierUpCheckInjectionPhase::removeFTLProfiling):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::ftlUnreachable):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckCell):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckBadCell):
+        (JSC::FTL::LowerDFGToLLVM::compileGetExecutable):
+        (JSC::FTL::LowerDFGToLLVM::compileNativeCallOrConstruct):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::buildSwitch):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckFunction): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileCheckExecutable): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::storeValue):
+        (JSC::AssemblyHelpers::loadValue):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArguments):
+        * jit/GPRInfo.h:
+        (JSC::JSValueRegs::uses):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::ensureCallEdgeLog):
+        * runtime/VM.h:
+        * tests/stress/fold-profiled-call-to-call.js: Added. This test pinpoints the problem we saw in fast/storage/serialized-script-value.html.
+        * tests/stress/new-array-then-exit.js: Added.
+        * tests/stress/poly-call-exit-this.js: Added.
+        * tests/stress/poly-call-exit.js: Added.
+
+2014-08-28  Julien Brianceau   <jbriance@cisco.com>
+
+        Correct GC length unit and prevent division by 0 in showObjectStatistics.
+        https://bugs.webkit.org/show_bug.cgi?id=136340
+
+        Reviewed by Mark Hahnenberg.
+
+        * heap/HeapStatistics.cpp:
+        (JSC::HeapStatistics::showObjectStatistics):
+
+2014-08-27  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Ensure that the call frame passed from JIT code via JSC::operationCallEval to JSC::eval always contains the valid scope chain.
+        https://bugs.webkit.org/show_bug.cgi?id=136313
+
+        Reviewed by Michael Saboff.
+
+        Do not rely on calling conventions to fill in the CallerFrame component
+        of the execCallee parameter of JSC::operationCallEval.
+
+        * jit/JITOperations.cpp:
+
+2014-08-27  Saam Barati  <sbarati@apple.com>
+
+        Deconstruction object pattern node emits the wrong start/end text positions
+        https://bugs.webkit.org/show_bug.cgi?id=136304
+
+        Reviewed by Geoffrey Garen.
+
+        Object pattern nodes that used the syntactic sugar binding: 
+        'var {foo} = {foo:20}' instead of 'var {foo:foo} = {foo:20}' 
+        would get the wrong text position for variable 'foo'. The position 
+        would be placed on the comma(s)/closing brace instead of the identifier. 
+        This patch fixes this bug by caching the identifier's JSToken before 
+        trying to parse an optional colon.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVarDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseDeconstructionPattern):
+        * parser/Parser.h:
+
+2014-08-27  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Build fix after last commit.
+
+        Check in new DLLLauncherMain.cpp file.
+
+        * JavaScriptCore.vcxproj/jsc/DLLLauncherMain.cpp: Added.
+        (enableTerminationOnHeapCorruption):
+        (getStringValue):
+        (applePathFromRegistry):
+        (appleApplicationSupportDirectory):
+        (copyEnvironmentVariable):
+        (prependPath):
+        (fatalError):
+        (directoryExists):
+        (modifyPath):
+        (getLastErrorString):
+        (wWinMain):
+
+2014-08-27  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] testapi and testRegExp need to find support libraries.
+        https://bugs.webkit.org/show_bug.cgi?id=136008.
+
+        Reviewed by Dean Jackson.
+
+        Revise the Windows build of jsc, testapi, and testRegExp so that they
+        find and use the proper runtime support libraries.
+
+        These locations vary between the Apple Windows build and WinCairo, and
+        are generally not in the system PATH environment setting. Consequently,
+        these applications fail on launch unless the user modifies their
+        PATH.
+
+        This patch revises these tools to work like WinLauncher and DumpRenderTree
+        so that they run reliably.
+
+        * API/tests/testapi.c:
+        (dllLauncherEntryPoint): Added.
+        * JavaScriptCore.vcxproj/JavaScriptCore.sln: Add new build projects and
+          provide proper dependencies with existing projects.
+        * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Ditto.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Switch to build
+          a DLL, rather than an executable.
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props: Add shlwapi.lib
+          to the list of libraries needed at link-time, and to use
+          the DLL/Console combination entry point.
+        * JavaScriptCore.vcxproj/jsc/jscLauncher.vcxproj: Added.
+        * JavaScriptCore.vcxproj/jsc/jscLauncherPostBuild.cmd: Copied from JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd.
+        * JavaScriptCore.vcxproj/jsc/jscLauncherPreBuild.cmd: Copied from JavaScriptCore.vcxproj/jsc/jscPreBuild.cmd.
+        * JavaScriptCore.vcxproj/jsc/jscLauncherPreLink.cmd: Copied from JavaScriptCore.vcxproj/jsc/jscPreLink.cmd.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Switch to build
+          a DLL, rather than an executable.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props: Add shlwapi.lib
+          to the list of libraries needed at link-time, and to use
+          the DLL/Console combination entry point.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncher.vcxproj: Added.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncherPostBuild.cmd: Copied from JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncherPreBuild.cmd: Copied from JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncherPreLink.cmd: Copied from JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd.
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Switch to build
+          a DLL, rather than an executable.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncher.vcxproj: Added.
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props: Add shlwapi.lib
+          to the list of libraries needed at link-time, and to use
+          the DLL/Console combination entry point.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncherPostBuild.cmd: Copied from JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncherPreBuild.cmd: Copied from JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncherPreLink.cmd: Copied from JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd.
+        * jsc.cpp:
+        (dllLauncherEntryPoint): Added.
+        * testRegExp.cpp:
+        (dllLauncherEntryPoint): Added.
+
+2014-08-27  Julien Brianceau   <jbriance@cisco.com>
+
+        Take advantage of 3 parameters or32() calls
+        https://bugs.webkit.org/show_bug.cgi?id=136287
+
+        Reviewed by Michael Saboff.
+
+        For specific architectures (arm and mips for instance), or32() calls
+        with 3 parameters are likely to produce a single instruction.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::branchIsOther):
+        (JSC::DFG::SpeculativeJIT::branchNotOther):
+
+2014-08-26  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: put feature flags for Inspector domains in the protocol specification
+        https://bugs.webkit.org/show_bug.cgi?id=136027
+
+        Reviewed by Timothy Hatcher.
+
+        Remove the hardcoded map of domains to feature guards, and instead parse it from the specification.
+
+        Test: inspector/scripts/tests/generate-domains-with-feature-guards.json
+
+        * inspector/scripts/codegen/generator.py:
+        (Generator.wrap_with_guard_for_domain):
+        * inspector/scripts/codegen/models.py:
+        (Protocol.parse_domain):
+        (Domain.__init__):
+        (Domains):
+        * inspector/scripts/tests/generate-domains-with-feature-guards.json: Added.
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+
+2014-08-26  Andy Estes  <aestes@apple.com>
+
+        [Cocoa] Some projects are incorrectly installed to $BUILT_PRODUCTS_DIR
+        https://bugs.webkit.org/show_bug.cgi?id=136267
+
+        Reviewed by Dan Bernstein.
+
+        INSTALL_PATH was set to $BUILT_PRODUCTS_DIR for engineering configurations in r20225 as part of a build fix.
+        Not only is this no longer necessary to build, but it causes built products to be incorrectly installed in
+        engineering configurations.
+
+        Remove the setting of INSTALL_PATH from the pbxproj file so that the value specified in the xcconfig files is
+        used instead.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-08-26  Michael Saboff  <msaboff@apple.com>
+
+        [Win] 64-bit JavaScriptCore crashes on launch
+        https://bugs.webkit.org/show_bug.cgi?id=136241
+
+        Reviewed by Mark Lam.
+
+        * llint/LowLevelInterpreter.asm:
+        (vmEntryRecord): X86_64_WIN doesn't use "a0" (rax) for the first argument, it uses
+        "t2" (rcx).  Changed to get the input parameter using the correct register.
+
+2014-08-26  Saam Barati  <sbarati@apple.com>
+
+        TypeSet caches structureIDs even after the corresponding Structure could be GCed
+        https://bugs.webkit.org/show_bug.cgi?id=136178
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, TypeSet will never remove StructureIDs from its cache,
+        even after the corresponding Structures could be garbage collected.
+        Now, when the Garbage Collector collects, and type profiling is 
+        enabled, the Garbage Collector will invalidate all TypeSet caches.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::TypeSet::invalidateCache):
+        * runtime/TypeSet.h:
+        * runtime/VM.cpp:
+        (JSC::VM::invalidateTypeSetCache):
+        * runtime/VM.h:
+
+2014-08-26  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r172794) + 32Bit build: for-in-base-reassigned-later-and-change-structure.js fail with NaN result
+        https://bugs.webkit.org/show_bug.cgi?id=136187
+
+        Reviewed by Mark Hahnenberg.
+
+        Added two arg version for 32 bit builds of callOperation(J_JITOperation_ECJ, ...) that
+        doesn't require a tag for the second argument, instead it fills in a CellTag.  This is
+        used for the slow case of the GetDirectPname case in SpeculativeJIT::compile since we
+        haven't set up a register with a tag and we know that argument 2 is a cell.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): New version with implicit CellTag.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Eliminated extraneous filling of the scratchGPR
+        with CellTag as it wasn't in the control flow for the slow path that needed the tag.
+        Instead changed to calling new version of callOperation with an implicit CellTag.
+
+2014-08-26  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r172940.
+        https://bugs.webkit.org/show_bug.cgi?id=136256
+
+        Caused assertions on fast/storage/serialized-script-
+        value.html, and possibly flakiness on more tests (Requested by
+        ap on #webkit).
+
+        Reverted changeset:
+
+        "FTL should be able to do polymorphic call inlining"
+        https://bugs.webkit.org/show_bug.cgi?id=135145
+        http://trac.webkit.org/changeset/172940
+
+2014-08-26  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r172794) + 32Bit build: ASSERT failures in for-in-tests.js tests.
+        https://bugs.webkit.org/show_bug.cgi?id=136165
+
+        Reviewed by Mark Hahnenberg.
+
+        Changed switch case GetDirectPname: to always use the slow path for X86 since it only has
+        6 registers available, but the code requires 7.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-08-25  Saam Barati  <sbarati@apple.com>
+
+        TypeProfiler search breaks on return statements
+        https://bugs.webkit.org/show_bug.cgi?id=136201
+
+        Reviewed by Filip Pizlo.
+
+        Searching for return statements in the TypeProfiler currently 
+        breaks down because it expected to see the search descriptor 
+        TypeProfilerSearchDescriptorFunctionReturn when looking for 
+        return statements in the actual source code of the program. 
+        But, TypeProfilerSearchDescriptorFunctionReturn search descriptor 
+        is reserved for looking for return statements that aren't in the 
+        actual source code of the program, but when asking for the 
+        aggregate return type of a function. Now, searching for 
+        return statements in the actual source code of the program will 
+        work when passing in the search descriptor TypeProfilerSearchDescriptorNormal.  
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::findLocation):
+        (JSC::descriptorMatchesTypeLocation): Deleted.
+
+2014-08-25  Saam Barati  <sbarati@apple.com>
+
+        Return statement TypeSet's might be duplicated
+        https://bugs.webkit.org/show_bug.cgi?id=136200
+
+        Reviewed by Filip Pizlo.
+
+        Currently, the globalTypeSet that converges the types of all 
+        return statements in a function lives off of CodeBlock. It lives 
+        off CodeBlock because of a faulty assumption that CodeBlock 
+        will have a one to one mapping with a function in the source 
+        text of the program. (Currently, there isn't an actual bug 
+        with this design because TypeLocationCache will hash cons to 
+        the same TypeLocation, but this is still an incorrect design). 
+        In this patch, the globalTypeSet for function return statements  
+        is moved to the FunctionExecutable object which does have a one 
+        to one mapping with functions in the source text of a program.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::returnStatementTypeSet): Deleted.
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::returnStatementTypeSet):
+
+2014-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should be able to do polymorphic call inlining
+        https://bugs.webkit.org/show_bug.cgi?id=135145
+
+        Reviewed by Geoffrey Garen.
+        
+        Added a log-based high-fidelity call edge profiler that runs in DFG JIT (and optionally
+        baseline JIT) code. Used it to do precise polymorphic inlining in the FTL. Potential
+        inlining sites use the call edge profile if it is available, but they will still fall back
+        on the call inline cache and rare case counts if it's not. Polymorphic inlining means that
+        multiple possible callees can be inlined with a switch to guard them. The slow path may
+        either be an OSR exit or a virtual call.
+        
+        The call edge profiling added in this patch is very precise - it will tell you about every
+        call that has ever happened. It took some effort to reduce the overhead of this profiling.
+        This mostly involved ensuring that we don't do it unnecessarily. For example, we avoid it
+        in the baseline JIT (you can conditionally enable it but it's off by default) and we only do
+        it in the DFG JIT if we know that the regular inline cache profiling wasn't precise enough.
+        I also experimented with reducing the precision of the profiling. This led to a significant
+        reduction in the speed-up, so I avoided this approach. I also explored making log processing
+        concurrent, but that didn't help. Also, I tested the overhead of the log processing and
+        found that most of the overhead of this profiling is actually in putting things into the log
+        rather than in processing the log - that part appears to be surprisingly cheap.
+        
+        Polymorphic inlining could be enabled in the DFG if we enabled baseline call edge profiling,
+        and if we guarded such inlining sites with some profiling mechanism to detect
+        polyvariant monomorphisation opportunities (where the callsite being inlined reveals that
+        it's actually monomorphic).
+        
+        This is a ~28% speed-up on deltablue and a ~7% speed-up on richards, with small speed-ups on
+        other programs as well. It's about a 2% speed-up on Octane version 2, and never a regression
+        on anything we care about. Some aggregates, like V8Spider, see a regression. This is
+        highlighting the increase in profiling overhead. But since this doesn't show up on any major
+        score (code-load or SunSpider), it's probably not relevant.
+        
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallEdge.cpp: Added.
+        (JSC::CallEdge::dump):
+        * bytecode/CallEdge.h: Added.
+        (JSC::CallEdge::operator!):
+        (JSC::CallEdge::callee):
+        (JSC::CallEdge::count):
+        (JSC::CallEdge::despecifiedClosure):
+        (JSC::CallEdge::CallEdge):
+        * bytecode/CallEdgeProfile.cpp: Added.
+        (JSC::CallEdgeProfile::callEdges):
+        (JSC::CallEdgeProfile::numCallsToKnownCells):
+        (JSC::worthDespecifying):
+        (JSC::CallEdgeProfile::worthDespecifying):
+        (JSC::CallEdgeProfile::visitWeak):
+        (JSC::CallEdgeProfile::addSlow):
+        (JSC::CallEdgeProfile::mergeBack):
+        (JSC::CallEdgeProfile::fadeByHalf):
+        (JSC::CallEdgeLog::CallEdgeLog):
+        (JSC::CallEdgeLog::~CallEdgeLog):
+        (JSC::CallEdgeLog::isEnabled):
+        (JSC::operationProcessCallEdgeLog):
+        (JSC::CallEdgeLog::emitLogCode):
+        (JSC::CallEdgeLog::processLog):
+        * bytecode/CallEdgeProfile.h: Added.
+        (JSC::CallEdgeProfile::numCallsToNotCell):
+        (JSC::CallEdgeProfile::numCallsToUnknownCell):
+        (JSC::CallEdgeProfile::totalCalls):
+        * bytecode/CallEdgeProfileInlines.h: Added.
+        (JSC::CallEdgeProfile::CallEdgeProfile):
+        (JSC::CallEdgeProfile::add):
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkInfo.h:
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::computeFromLLInt):
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeExitSiteData):
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+        (JSC::CallLinkStatus::computeFromCallEdgeProfile):
+        (JSC::CallLinkStatus::computeDFGStatuses):
+        (JSC::CallLinkStatus::isClosureCall):
+        (JSC::CallLinkStatus::makeClosureCall):
+        (JSC::CallLinkStatus::dump):
+        (JSC::CallLinkStatus::function): Deleted.
+        (JSC::CallLinkStatus::internalFunction): Deleted.
+        (JSC::CallLinkStatus::intrinsicFor): Deleted.
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::couldTakeSlowPath):
+        (JSC::CallLinkStatus::edges):
+        (JSC::CallLinkStatus::size):
+        (JSC::CallLinkStatus::at):
+        (JSC::CallLinkStatus::operator[]):
+        (JSC::CallLinkStatus::canOptimize):
+        (JSC::CallLinkStatus::canTrustCounts):
+        (JSC::CallLinkStatus::isClosureCall): Deleted.
+        (JSC::CallLinkStatus::callTarget): Deleted.
+        (JSC::CallLinkStatus::executable): Deleted.
+        (JSC::CallLinkStatus::makeClosureCall): Deleted.
+        * bytecode/CallVariant.cpp: Added.
+        (JSC::CallVariant::dump):
+        * bytecode/CallVariant.h: Added.
+        (JSC::CallVariant::CallVariant):
+        (JSC::CallVariant::operator!):
+        (JSC::CallVariant::despecifiedClosure):
+        (JSC::CallVariant::rawCalleeCell):
+        (JSC::CallVariant::internalFunction):
+        (JSC::CallVariant::function):
+        (JSC::CallVariant::isClosureCall):
+        (JSC::CallVariant::executable):
+        (JSC::CallVariant::nonExecutableCallee):
+        (JSC::CallVariant::intrinsicFor):
+        (JSC::CallVariant::functionExecutable):
+        (JSC::CallVariant::isHashTableDeletedValue):
+        (JSC::CallVariant::operator==):
+        (JSC::CallVariant::operator!=):
+        (JSC::CallVariant::operator<):
+        (JSC::CallVariant::operator>):
+        (JSC::CallVariant::operator<=):
+        (JSC::CallVariant::operator>=):
+        (JSC::CallVariant::hash):
+        (JSC::CallVariant::deletedToken):
+        (JSC::CallVariantHash::hash):
+        (JSC::CallVariantHash::equal):
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::isNormalCall):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::~BasicBlock):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::takeLast):
+        (JSC::DFG::BasicBlock::didLink):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::processSetLocalQueue):
+        (JSC::DFG::ByteCodeParser::removeLastNodeFromGraph):
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+        (JSC::DFG::ByteCodeParser::undoFunctionChecks):
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::cancelLinkingForBlock):
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::prepareToParseBlock):
+        (JSC::DFG::ByteCodeParser::clearCaches):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::linkBlocks):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::visitChildren):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::switchLookupValue):
+        * dfg/DFGLazyJSValue.h:
+        (JSC::DFG::LazyJSValue::switchLookupValue): Deleted.
+        * dfg/DFGNode.cpp:
+        (WTF::printInternal):
+        * dfg/DFGNode.h:
+        (JSC::DFG::OpInfo::OpInfo):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::cellOperand):
+        (JSC::DFG::Node::setCellOperand):
+        (JSC::DFG::Node::canBeKnownFunction): Deleted.
+        (JSC::DFG::Node::hasKnownFunction): Deleted.
+        (JSC::DFG::Node::knownFunction): Deleted.
+        (JSC::DFG::Node::giveKnownFunction): Deleted.
+        (JSC::DFG::Node::hasFunction): Deleted.
+        (JSC::DFG::Node::function): Deleted.
+        (JSC::DFG::Node::hasExecutable): Deleted.
+        (JSC::DFG::Node::executable): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPhantomCanonicalizationPhase.cpp:
+        (JSC::DFG::PhantomCanonicalizationPhase::run):
+        * dfg/DFGPhantomRemovalPhase.cpp:
+        (JSC::DFG::PhantomRemovalPhase::run):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitch):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        (JSC::DFG::TierUpCheckInjectionPhase::removeFTLProfiling):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::ftlUnreachable):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckCell):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckBadCell):
+        (JSC::FTL::LowerDFGToLLVM::compileGetExecutable):
+        (JSC::FTL::LowerDFGToLLVM::compileNativeCallOrConstruct):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::buildSwitch):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckFunction): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileCheckExecutable): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::storeValue):
+        (JSC::AssemblyHelpers::loadValue):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArguments):
+        * jit/GPRInfo.h:
+        (JSC::JSValueRegs::uses):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::ensureCallEdgeLog):
+        * runtime/VM.h:
+        * tests/stress/new-array-then-exit.js: Added.
+        (foo):
+        * tests/stress/poly-call-exit-this.js: Added.
+        * tests/stress/poly-call-exit.js: Added.
+
+2014-08-22  Michael Saboff  <msaboff@apple.com>
+
+        After r172867 another crash in in js/dom/line-column-numbers.html
+        https://bugs.webkit.org/show_bug.cgi?id=136192
+
+        Reviewed by Geoffrey Garen.
+
+        In lookupExceptionHandlerFromCallerFrame(), We need to use the caller's CallFrame
+        and VMEntryFrame when calling genericUnwind().  NativeCallFrameTracerWithRestore()
+        does that for us.
+
+        In general, NativeCallFrameTracerWithRestore(), restores the values because we may
+        do more processing that requires the current callFrame and vmEntryFrame before we
+        get to the catch handler where we change these to the catch values.  In this
+        particular case, that restoration isn't currently needed, but we add complexity
+        and possible future confusion if we create another NativeCallFrameTracerXXX()
+        version that doesn't restore the values.
+
+        * jit/JITOperations.cpp:
+        (JSC::lookupExceptionHandlerFromCallerFrame): Changed NativeCallFrameTracer() to
+        NativeCallFrameTracerWithRestore() so that VM::topVMEntryFrame will be updated
+        before calling genericUnwind().
+
+2014-08-24  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: rename Inspector::TypeBuilder to Inspector::Protocol
+        https://bugs.webkit.org/show_bug.cgi?id=136031
+
+        Reviewed by Timothy Hatcher.
+
+        Rename TypeBuilder namespace to Protocol. Disambiguate where
+        necessary. Also rename InspectorTypeBuilder to ProtocolTypes.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::messageSourceValue):
+        (Inspector::messageTypeValue):
+        (Inspector::messageLevelValue):
+        (Inspector::ConsoleMessage::addToFrontend):
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::buildObjectForSearchMatch):
+        (Inspector::ContentSearchUtilities::searchInTextByLines):
+        * inspector/ContentSearchUtilities.h:
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::evaluate):
+        (Inspector::InjectedScript::callFunctionOn):
+        (Inspector::InjectedScript::evaluateOnCallFrame):
+        (Inspector::InjectedScript::getFunctionDetails):
+        (Inspector::InjectedScript::getProperties):
+        (Inspector::InjectedScript::getInternalProperties):
+        (Inspector::InjectedScript::wrapCallFrames):
+        (Inspector::InjectedScript::wrapObject):
+        (Inspector::InjectedScript::wrapTable):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::makeEvalCall):
+        * inspector/InjectedScriptBase.h:
+        * inspector/InspectorTypeBuilder.h: Removed.
+        * inspector/ScriptCallFrame.cpp:
+        (Inspector::ScriptCallFrame::buildInspectorObject):
+        * inspector/ScriptCallFrame.h:
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::buildInspectorArray):
+        * inspector/ScriptCallStack.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::inspect):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::breakpointActionTypeForString):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::resolveBreakpoint):
+        (Inspector::InspectorDebuggerAgent::searchInContent):
+        (Inspector::InspectorDebuggerAgent::getFunctionDetails):
+        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (Inspector::InspectorDebuggerAgent::currentCallFrames):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorProfilerAgent.cpp:
+        (Inspector::InspectorProfilerAgent::createProfileHeader):
+        (Inspector::InspectorProfilerAgent::getProfileHeaders):
+        (Inspector::buildInspectorObject):
+        (Inspector::InspectorProfilerAgent::buildProfileInspectorObject):
+        (Inspector::InspectorProfilerAgent::getCPUProfile):
+        * inspector/agents/InspectorProfilerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::buildErrorRangeObject):
+        (Inspector::InspectorRuntimeAgent::parse):
+        (Inspector::InspectorRuntimeAgent::evaluate):
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/scripts/codegen/__init__.py:
+        * inspector/scripts/codegen/generate_backend_dispatcher_header.py:
+        (BackendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_backend_dispatcher_implementation.py:
+        (BackendDispatcherImplementationGenerator._generate_async_dispatcher_class_for_domain):
+        (BackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_header.py:
+        (FrontendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_implementation.py:
+        (FrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/generate_type_builder_header.py: Removed.
+        * inspector/scripts/codegen/generate_type_builder_implementation.py: Removed.
+        * inspector/scripts/codegen/generator.py:
+        (Generator.protocol_type_string_for_type):
+        (Generator.protocol_type_string_for_type_member):
+        (Generator.type_string_for_type_with_name):
+        (Generator.type_string_for_formal_out_parameter):
+        (Generator.type_string_for_formal_async_parameter):
+        (Generator.type_string_for_stack_in_parameter):
+        (Generator.type_string_for_stack_out_parameter):
+        (Generator.assertion_method_for_type_member.assertion_method_for_type):
+        (Generator.assertion_method_for_type_member):
+        (Generator.type_builder_string_for_type): Deleted.
+        (Generator.type_builder_string_for_type_member): Deleted.
+        * inspector/scripts/codegen/generator_templates.py:
+        (Inspector):
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        (generate_from_specification):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * runtime/HighFidelityTypeProfiler.cpp:
+        (JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
+        * runtime/HighFidelityTypeProfiler.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::allPrimitiveTypeNames):
+        (JSC::TypeSet::allStructureRepresentations):
+        (JSC::StructureShape::inspectorRepresentation):
+        * runtime/TypeSet.h:
+
+2014-08-24  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: Rename DOM.RGBA and remove workarounds in the bindings generator
+        https://bugs.webkit.org/show_bug.cgi?id=136025
+
+        Reviewed by Joseph Pecoraro.
+
+        This workaround can be removed since it is no longer necessary.
+
+        * inspector/scripts/codegen/models.py:
+        (TypeReference.__init__):
+        (Type.raw_name):
+        (TypeDeclaration.__init__):
+        * inspector/scripts/tests/type-declaration-object-type.json: Remove related test input.
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result: Rebaseline.
+
+2014-08-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Do not copy large module source strings
+        https://bugs.webkit.org/show_bug.cgi?id=136191
+
+        Reviewed by Benjamin Poulain.
+
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::injectedScriptSource):
+
+2014-08-21  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r163179): Sporadic crash in js/dom/line-column-numbers.html test
+        https://bugs.webkit.org/show_bug.cgi?id=136111
+
+        Reviewed by Filip Pizlo.
+
+        The problem was that we weren't properly handling VM::topVMEntryFrame in two ways.
+
+        First in the case where we get an exception of a stack overflow during setup of the direct
+        callee frame of a VM entry frame, we need to throw the exception in the caller's frame.
+        This requires unrolling topVMEntryFrame while creating the exception object.  This is
+        accomplished with the renamed NativeCallFrameTracerWithRestore object.  As part of this,
+        split the JIT rollback exception handling to call a new helper,
+        callLookupExceptionHandlerFromCallerFrame, which will unroll the callFrame and VMEntryFrame.
+
+        Second, when we unwind to find a handler, we also need to unwind topVMCallFrame for the
+        case where we end up (re)throwing another exception after entering the catch block, but
+        before another vmEntry call.  Added VM::vmEntryFrameForThrow as a way similar to
+        VM::callFrameForThrow to pass the appropriate VMENtryFrame to the catch block.
+
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileExceptionHandlers):
+        Split out the unroll cases to use the new helper callLookupExceptionHandlerFromCallerFrame()
+        to unwind both the callFrame and topVMEntryFrame.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::UnwindFunctor):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::unwind):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        Added VMEntryFrame as another component to unwind.
+
+        * interpreter/Interpreter.h:
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        (JSC::NativeCallFrameTracerWithRestore::NativeCallFrameTracerWithRestore):
+        (JSC::NativeCallFrameTracerWithRestore::~NativeCallFrameTracerWithRestore):
+        Renamed and changed to save and restore topCallFrame and topVMEntryFrame around the setting of
+        both values.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::gotoNextFrame):
+        (JSC::StackVisitor::readNonInlinedFrame):
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::Frame::vmEntryFrame):
+        Added code to unwind the VMEntryFrame.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler): Updated comment to indicate that the value
+        the handler should use for VM::topEntryFrame is in VM::vmEntryFrameForThrow.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Added code to update VM::topVMEntryFrame from VM::vmEntryFrameForThrowOffset.
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        (JSC::operationThrowStackOverflowError):
+        (JSC::operationCallArityCheck):
+        (JSC::operationConstructArityCheck):
+
+        * runtime/VM.h:
+        (JSC::VM::vmEntryFrameForThrowOffset):
+        (JSC::VM::topVMEntryFrameOffset):
+        Added as the side channel to return the topVMEntryFrame that the handler should use.
+
+2014-08-22  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Disable ENABLE_IOS_{GESTURE, TOUCH}_EVENTS, and temporarily disable ENABLE_TOUCH_EVENTS
+        and ENABLE_XSLT when building with the iOS public SDK
+        https://bugs.webkit.org/show_bug.cgi?id=135945
+
+        Reviewed by Andy Estes.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-22  Jon Lee  <jonlee@apple.com>
+
+        Fix iOS build due to r172832 and move RUBBER_BANDING out of FeatureDefines.h
+        https://bugs.webkit.org/show_bug.cgi?id=136157
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE(RUBBER_BANDING).
+
+2014-08-21  Mark Lam  <mark.lam@apple.com>
+
+        r171362 accidentally increased the size of InlineCallFrame.
+        <https://webkit.org/b/136141>
+
+        Reviewed by Filip Pizlo.
+
+        r171362 increased the size of InlineCallFrame::kind to 2 bits.  This increased
+        the size of InlineCallFrame from 72 to 80 though not intentionally.  The fix
+        is to reduce the size of InlineCallFrame::stackOffset to 29 bits.
+
+        Also added an assert to ensure that we never set a value that exceeds the size
+        of InlineCallFrame::stackOffset.
+
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::setStackOffset):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+
+2014-08-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: RetainPtr misuse, CFRunLoopSource leak
+        https://bugs.webkit.org/show_bug.cgi?id=136143
+
+        Reviewed by Timothy Hatcher.
+
+        Adopt a Create into the RetainPtr to avoid leaking.
+
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setupRunLoop):
+
+2014-08-21  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION(r172808): It made 6 different tests fail on 32 bit platforms.
+        <https://webkit.org/b/136123>
+
+        Reviewed by Filip Pizlo.
+
+        The original patch in r172808 removed the code to skip the top scope in
+        the 64-bit port of JIT::emitResolveClosure() but not in the 32-bit port.
+        This patch fixes that and achieves parity.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitResolveClosure):
+
+2014-08-21  Zalan Bujtas  <zalan@apple.com>
+
+        Enable SATURATED_LAYOUT_ARITHMETIC.
+        https://bugs.webkit.org/show_bug.cgi?id=136106
+
+        Reviewed by Simon Fraser.
+
+        SATURATED_LAYOUT_ARITHMETIC protects LayoutUnit against arithmetic overflow.
+        (No measurable performance regression on Mac.)
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-20  Saam Barati  <sbarati@apple.com>
+
+        Fix how CodeBlock dumps the opcode op_profile_type
+        https://bugs.webkit.org/show_bug.cgi?id=136088
+
+        Reviewed by Filip Pizlo.
+
+        op_profile_type was modified to receive two extra arguments,
+        but its dump in CodeBlock::dumpBytecode wasn't changed to 
+        account for this, so it broke CodeBlock::dumpBytecode when
+        op_profile_type was in the stream of bytecode instructions.
+        CodeBlock::dumpBytecode now accounts for the change in 
+        op_profile_type's arity.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+
+2014-08-20  Saam Barati  <sbarati@apple.com>
+
+        Rename HighFidelityTypeProfiling variables for more clarity
+        https://bugs.webkit.org/show_bug.cgi?id=135899
+
+        Reviewed by Geoffrey Garen.
+
+        Many names that are used in the type profiling infrastructure
+        prefix themselves with "HighFidelity" or include the words "high"
+        and/or "fidelity" in some way. But the words "high" and "fidelity" don't 
+        add anything descriptive to the names surrounding type profiling. 
+        So this patch removes all uses of "HighFidelity" and its variants.
+
+        Most renamings change "HighFidelity*" to "TypeProfiler*" or simply 
+        drop the prefix "HighFidelity" all together. Now, almost all names 
+        in relation to type profiling contain in them "TypeProfiler" or 
+        "TypeProfiling" or some combination of the words "type" and "profile".
+
+        This patch also changes how we check if type profiling is enabled:
+        We no longer call vm::isProfilingTypesWithHighFidelity. We now just 
+        check that vm::typeProfiler is not null.
+
+        This patch also changes all calls to TypeProfilerLog::processLogEntries
+        to use ASCIILiteral to form WTFStrings instead of vanilla C string literals.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/TypeLocation.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo):
+        (JSC::UnlinkedCodeBlock::highFidelityTypeProfileExpressionInfoForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addHighFidelityTypeProfileExpressionInfo): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::typeProfilingStartOffset):
+        (JSC::UnlinkedFunctionExecutable::typeProfilingEndOffset):
+        (JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingStartOffset): Deleted.
+        (JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingEndOffset): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitTypeProfilerExpressionInfo):
+        (JSC::BytecodeGenerator::emitProfileType):
+        (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo): Deleted.
+        (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::PrefixNode::emitBracket):
+        (JSC::PrefixNode::emitDot):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::EmptyVarExpression::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::recompileAllJSFunctionsForTypeProfiling):
+        (Inspector::InspectorRuntimeAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorRuntimeAgent::enableTypeProfiler):
+        (Inspector::InspectorRuntimeAgent::disableTypeProfiler):
+        (Inspector::InspectorRuntimeAgent::setTypeProfilerEnabledState):
+        (Inspector::InspectorRuntimeAgent::enableHighFidelityTypeProfiling): Deleted.
+        (Inspector::InspectorRuntimeAgent::disableHighFidelityTypeProfiling): Deleted.
+        (Inspector::InspectorRuntimeAgent::setHighFidelityTypeProfilingEnabledState): Deleted.
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Runtime.json:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_type):
+        (JSC::JIT::emit_op_profile_types_with_high_fidelity): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_type):
+        (JSC::JIT::emit_op_profile_types_with_high_fidelity): Deleted.
+        * jit/JITOperations.cpp:
+        * jsc.cpp:
+        (functionDumpTypesForAllVariables):
+        * llint/LLIntSlowPaths.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::typeProfilingStartOffset):
+        (JSC::ScriptExecutable::typeProfilingEndOffset):
+        (JSC::ScriptExecutable::highFidelityTypeProfilingStartOffset): Deleted.
+        (JSC::ScriptExecutable::highFidelityTypeProfilingEndOffset): Deleted.
+        * runtime/HighFidelityLog.cpp: Removed.
+        * runtime/HighFidelityLog.h: Removed.
+        * runtime/HighFidelityTypeProfiler.cpp: Removed.
+        * runtime/HighFidelityTypeProfiler.h: Removed.
+        * runtime/Options.h:
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::prepareForTypeProfiling):
+        (JSC::SymbolTable::uniqueIDForVariable):
+        (JSC::SymbolTable::uniqueIDForRegister):
+        (JSC::SymbolTable::prepareForHighFidelityTypeProfiling): Deleted.
+        * runtime/SymbolTable.h:
+        * runtime/TypeProfiler.cpp: Added.
+        (JSC::TypeProfiler::logTypesForTypeLocation):
+        (JSC::TypeProfiler::insertNewLocation):
+        (JSC::TypeProfiler::getTypesForVariableAtOffsetForInspector):
+        (JSC::descriptorMatchesTypeLocation):
+        (JSC::TypeProfiler::findLocation):
+        * runtime/TypeProfiler.h: Added.
+        (JSC::QueryKey::QueryKey):
+        (JSC::QueryKey::isHashTableDeletedValue):
+        (JSC::QueryKey::operator==):
+        (JSC::QueryKey::hash):
+        (JSC::QueryKeyHash::hash):
+        (JSC::QueryKeyHash::equal):
+        (JSC::TypeProfiler::functionHasExecutedCache):
+        (JSC::TypeProfiler::typeLocationCache):
+        * runtime/TypeProfilerLog.cpp: Added.
+        (JSC::TypeProfilerLog::initializeLog):
+        (JSC::TypeProfilerLog::~TypeProfilerLog):
+        (JSC::TypeProfilerLog::processLogEntries):
+        * runtime/TypeProfilerLog.h: Added.
+        (JSC::TypeProfilerLog::LogEntry::structureIDOffset):
+        (JSC::TypeProfilerLog::LogEntry::valueOffset):
+        (JSC::TypeProfilerLog::LogEntry::locationOffset):
+        (JSC::TypeProfilerLog::TypeProfilerLog):
+        (JSC::TypeProfilerLog::recordTypeInformationForLocation):
+        (JSC::TypeProfilerLog::logEndPtr):
+        (JSC::TypeProfilerLog::logStartOffset):
+        (JSC::TypeProfilerLog::currentLogEntryOffset):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::enableTypeProfiler):
+        (JSC::VM::disableTypeProfiler):
+        (JSC::VM::dumpTypeProfilerData):
+        (JSC::VM::enableHighFidelityTypeProfiling): Deleted.
+        (JSC::VM::disableHighFidelityTypeProfiling): Deleted.
+        (JSC::VM::dumpHighFidelityProfilingTypes): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::typeProfilerLog):
+        (JSC::VM::typeProfiler):
+        (JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
+        (JSC::VM::highFidelityLog): Deleted.
+        (JSC::VM::highFidelityTypeProfiler): Deleted.
+
+2014-08-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        URTBF after r172799.
+
+        * disassembler/ARM64/A64DOpcode.cpp:
+        * disassembler/ARM64Disassembler.cpp:
+
+2014-08-20  Oliver Hunt  <oliver@apple.com>
+
+        Stop implicitly skipping a function's own activation when walking the scope chain
+        https://bugs.webkit.org/show_bug.cgi?id=136118
+
+        Reviewed by Geoffrey Garen.
+
+        Remove the current logic that implicitly skips a function's
+        own activation when walking the scope chain. This is ground
+        work for ensuring that all closed variable access is made
+        through the function's activation. This leads to a further
+        10% regression on earley, but we're already tracking the
+        overall performance regression.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getScope):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitResolveClosure):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::abstractResolve):
+        * runtime/JSScope.h:
+
+2014-08-20  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION: Web Inspector crashes when reloading apple.com with Timeline recording active
+        https://bugs.webkit.org/show_bug.cgi?id=136034
+
+        Reviewed by Mark Lam.
+
+        DebuggerCallFrame::positionForCallFrame is trying to unwind starting somewhere in the middle
+        of the stack.  Hardened StackVisitor to skip over the frames between the current top frame
+        and the requested start frame.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::StackVisitor):
+
+2014-08-20  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] JavaScriptCore.dll is missing version information.
+        https://bugs.webkit.org/show_bug.cgi?id=136105
+        <rdar://problem/18075852>
+
+        Reviewed by Dean Jackson.
+
+        * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd: Add missing step to generate
+        version information for intermediary build path.
+
+2014-08-20  Saam Barati  <sbarati@apple.com>
+
+        Fix a memory leak in TypeSet
+        https://bugs.webkit.org/show_bug.cgi?id=135913
+
+        Reviewed by Filip Pizlo.
+
+        Currently, TypeSet unconditionally allocates memory for its member
+        variable m_structureHistory, but never deallocates it. Change this 
+        from being a pointer that is unconditionally allocated to a member 
+        variable that will be deallocated when TypeSet itself is deallocated.
+
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::TypeSet):
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::TypeSet::seenTypes):
+        (JSC::TypeSet::displayName):
+        (JSC::TypeSet::allStructureRepresentations):
+        (JSC::StructureShape::leastCommonAncestor):
+        * runtime/TypeSet.h:
+
+2014-08-20  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Assertion fails when running JSC stress tests.
+        https://bugs.webkit.org/show_bug.cgi?id=136103
+
+        Reviewed by Darin Adler.
+
+        Use unsigned bitfield member instead of enum bitfield member to avoid negative values.
+
+        * bytecode/CodeOrigin.h: Use unsigned bitfield member.
+        (JSC::InlineCallFrame::specializationKind): Compile fix.
+
+2014-08-20  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Enable ARM64 disassembler on EFL
+        https://bugs.webkit.org/show_bug.cgi?id=136089
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+        Added disassembler/ARM64Disassembler.cpp and
+        disassembler/ARM64/A64DOpcode.cpp to JavaScriptCore_SOURCES.
+
+        * disassembler/ARM64/A64DOpcode.cpp:
+        Added USE(ARM64_DISASSEMBLER) guard around implementation.
+
+        * disassembler/ARM64/A64DOpcode.h:
+        (JSC::ARM64Disassembler::A64DOpcode::appendUnsignedImmediate64):
+        (JSC::ARM64Disassembler::A64DOpcode::appendPCRelativeOffset):
+        Made format strings portable by changing "%llx" to "%" PRIx64 for
+        uint64_t arguments.
+
+2014-08-19  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r172401): for-in optimization no longer works at all
+        https://bugs.webkit.org/show_bug.cgi?id=136056
+
+        Reviewed by Geoffrey Garen.
+        
+        Roll this back in, along with a fix to make proxies work. Previously, for-in over proxies
+        would instacrash every time.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::pushIndexedForInScope):
+        (JSC::BytecodeGenerator::pushStructureForInScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ForInContext::ForInContext):
+        (JSC::StructureForInContext::StructureForInContext):
+        (JSC::IndexedForInContext::IndexedForInContext):
+        (JSC::ForInContext::base): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::getStructurePropertyNames):
+        (JSC::JSProxy::getGenericPropertyNames):
+        * tests/stress/for-in-base-reassigned-later-and-change-structure.js: Added.
+        (foo):
+        * tests/stress/for-in-base-reassigned-later.js: Added.
+        (foo):
+        * tests/stress/for-in-base-reassigned.js: Added.
+        (foo):
+        * tests/stress/for-in-proxy-target-changed-structure.js: Added.
+        (deleteAll):
+        (foo):
+        * tests/stress/for-in-proxy.js: Added.
+        (foo):
+
+2014-08-19  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Unreviewed, fix EFL build after r17275
+
+        Fix error: ignoring #pragma clang diagnostic [-Werror=unknown-pragmas]
+
+        * runtime/JSDataViewPrototype.cpp:
+        Add #if COMPILER(CLANG) and #endif.
+
+2014-08-19  Michael Saboff  <msaboff@apple.com>
+
+        Crash in jsc-layout-tests.yaml/js/script-tests/reentrant-caching.js
+        https://bugs.webkit.org/show_bug.cgi?id=136080
+
+        Reviewed by Mark Lam.
+
+        Update VM::topVMEntryFrame via NativeCallFrameTracer() when we pass the caller's frame
+        to NativeCallFrameTracer() as the callee's frame may be the first callee from an entry
+        frame.  In that case, the caller will have the prior VM entry frame.
+
+        The new NativeCallFrameTracer with a VMEntryFrame parameter should be used when throwing
+        an exception from a caller frame.  The value to use for the VMEntryFrame should be a
+        value possibly modified by CallFrame::callerFrame(&*VMEntryFrame) used to find the caller.
+
+        * interpreter/Interpreter.h:
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer): Added a new constructor that takes a
+        VMEntryFrame.  Added an ASSERT to both constructors to check that the updated topCallFrame
+        is below the current vmEntryFrame.
+
+        * jit/JITOperations.cpp:
+        (JSC::operationThrowStackOverflowError):
+        (JSC::operationCallArityCheck):
+        (JSC::operationConstructArityCheck):
+        Set VM::topVMEntryFrame to the possibly updated VMEntryFrame after getting the caller's frame.
+
+2014-08-19  Andy Estes  <aestes@apple.com>
+
+        [Cocoa] Offline Assembler build phase fails when $BUILT_PRODUCTS_DIR contains spaces
+        https://bugs.webkit.org/show_bug.cgi?id=136086
+
+        Reviewed by Filip Pizlo.
+
+        Enclosed arguments to asm.rb containing $BUILT_PRODUCTS_DIR in double quotes so that they don't get split on
+        whitespace. Also let Xcode have its way with an unrelated part of the project file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-08-19  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt build should be way faster
+        https://bugs.webkit.org/show_bug.cgi?id=136085
+
+        Reviewed by Geoffrey Garen.
+        
+        This does three things to improve the LLInt build performance. One of them is only for
+        Xcode for now while the others should benefit all platforms:
+        
+        - Don't exponentially build settings combinations that correspond to being on two backends
+          simultaneously. This is by far the biggest win.
+        
+        - Don't generate offset extraction code for backends that aren't supported by the current
+          port. This currently only works on Xcode-based ports. This is a relatively small win.
+        
+        - Remove the ALWAYS_ALLOCATE_SLOW option. Each option increases build time, and we haven't
+          used this one in a long time. Anyway, setting this option could be emulated by just
+          directly hacking the code.
+        
+        This is an enormous speed-up in the LLInt build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Prune the set of backends that we should consider on Xcode-based platforms.
+        * llint/LLIntOfflineAsmConfig.h: Remove ALWAYS_ALLOCATE_SLOW
+        * llint/LowLevelInterpreter.asm: Remove ALWAYS_ALLOCATE_SLOW
+        * offlineasm/backends.rb: Add infrastructure for reasoning about valid backends.
+        * offlineasm/generate_offset_extractor.rb: Allow the client to specify a filtered set of valid backends.
+        * offlineasm/settings.rb: Improve the construction of settings combinations so that it doesn't traverse the enourmous set of obviously invalid multi-backend combinations. Also glue into support for valid backends.
+
+2014-08-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix indentation and style in LowLevelInterpreter.asm
+        https://bugs.webkit.org/show_bug.cgi?id=136083
+
+        Reviewed by Mark Lam.
+
+        * llint/LowLevelInterpreter.asm:
+
+2014-08-19  Magnus Granberg  <zorry@gentoo.org>
+
+        TEXTREL in libjavascriptcoregtk-1.0.so.0.11.0 on x86 (or i586)
+        https://bugs.webkit.org/show_bug.cgi?id=70610
+
+        Reviewed by Darin Adler.
+
+        Setup %ebx so we can use the plt.
+
+        * jit/ThunkGenerators.cpp:
+
+2014-08-19  Zalan Bujtas  <zalan@apple.com>
+
+        Remove ENABLE(SUBPIXEL_LAYOUT).
+        https://bugs.webkit.org/show_bug.cgi?id=136077
+
+        Reviewed by Simon Fraser.
+
+        Remove compile time flag SUBPIXEL_LAYOUT. All ports have it enabled for a while now.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-19  Alex Christensen  <achristensen@webkit.org>
+
+        [CMake] Generate LLInt assembly correctly on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=135888
+
+        Reviewed by Oliver Hunt.
+
+        * CMakeLists.txt:
+        Generate LowLevelInterpreterWin.asm instead of LLIntAssembly.h on Windows like the existing build system.
+        * PlatformWin.cmake:
+        Don't build JSGlobalObjectInspectorController.cpp on Windows.
+        * offlineasm/x86.rb:
+        Detect non-cygwin ruby installations correctly.
+
+2014-08-19  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r163179): It broke the build on ARM Thumb2 with GCC
+        https://bugs.webkit.org/show_bug.cgi?id=136028
+
+        Reviewed by Oliver Hunt.
+
+        Added back ARMv7 conditionals around three op addp and subp since ARM Thumb2 spec says that
+        the behavior for those ops are undefined.  This was originally done in changeset 163179.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2014-08-18  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r172741.
+        https://bugs.webkit.org/show_bug.cgi?id=136058
+
+        This change is breaking PLT. (Requested by mlam on #webkit).
+
+        Reverted changeset:
+
+        "REGRESSION(r172401): for-in optimization no longer works at
+        all"
+        https://bugs.webkit.org/show_bug.cgi?id=136056
+        http://trac.webkit.org/changeset/172741
+
+2014-08-18  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r172401): for-in optimization no longer works at all
+        https://bugs.webkit.org/show_bug.cgi?id=136056
+
+        Reviewed by Mark Hahnenberg.
+        
+        This is a partial roll-out of r172401. It turns out that the fix wasn't actually fixing a
+        real bug (since it's fine to use op_get_direct_pname on the wrong base because it has a
+        structure check) and it was actually breaking the entire for-in optimization (since there is
+        no way that we can statically prove that the base matches, because the base we see is a
+        newly created temporary, and anyway doing it right would be really hard in our bytecode
+        because it's 3AC form).
+        
+        But, I added a new test for the problem, and kept the original test. Both the old test and
+        the new test prove that r172401 wasn't fixing what it thought it was fixing. To the extent
+        that it resolved crashes it was because it just disabled the for-in optimization entirely.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::pushIndexedForInScope):
+        (JSC::BytecodeGenerator::pushStructureForInScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ForInContext::ForInContext):
+        (JSC::StructureForInContext::StructureForInContext):
+        (JSC::IndexedForInContext::IndexedForInContext):
+        (JSC::ForInContext::base): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        * tests/stress/for-in-base-reassigned.js: Added.
+        * tests/stress/for-in-base-reassigned-later.js: Added.
+        * tests/stress/for-in-base-reassigned-later-and-change-structure.js: Added.
+
+2014-08-18  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: build fix for non-Mac builds after r172737.
+        https://bugs.webkit.org/show_bug.cgi?id=135750
+
+        Not reviewed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2014-08-18  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r172129): ftlopt branch merge made performance tests flakey crash
+        https://bugs.webkit.org/show_bug.cgi?id=135750
+
+        Reviewed by Mark Lam.
+        
+        This was caused by a rather embarrassing oversight in how the DFG tracks structures: we
+        could sometimes perform an optimization that requires a structure to be alive but forget to
+        ensure that the structure is actually kept alive. In particular, any watchpoint-based
+        optimizations involve setting watchpoints even if the code that got optimized is eventually
+        deleted because it is unreachable. All such optimizations would leave behind something in
+        the IR to tell us that we are interested in the structure and that therefore it should be
+        kept alive. But, IR can be deleted if it is unreachable.
+        
+        The solution is to ensure that as soon as the DFG is made aware of a structure, it adds it
+        to the set of weak references.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::setOSREntryValue):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::normalizeClarity):
+        (JSC::DFG::AbstractValue::assertIsRegistered):
+        (JSC::DFG::AbstractValue::assertIsWatched): Deleted.
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::assertIsRegistered):
+        (JSC::DFG::AbstractValue::assertIsWatched): Deleted.
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        * dfg/DFGDesiredWeakReferences.cpp:
+        (JSC::DFG::DesiredWeakReferences::addLazily):
+        (JSC::DFG::DesiredWeakReferences::contains):
+        (JSC::DFG::DesiredWeakReferences::reallyAdd):
+        (JSC::DFG::DesiredWeakReferences::visitChildren):
+        * dfg/DFGDesiredWeakReferences.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::registerFrozenValues):
+        (JSC::DFG::Graph::convertToConstant):
+        (JSC::DFG::Graph::registerStructure):
+        (JSC::DFG::Graph::assertIsRegistered):
+        (JSC::DFG::Graph::assertIsWatched): Deleted.
+        * dfg/DFGGraph.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGStructureAbstractValue.cpp:
+        (JSC::DFG::StructureAbstractValue::assertIsRegistered):
+        (JSC::DFG::StructureAbstractValue::assertIsWatched): Deleted.
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::assertIsRegistered):
+        (JSC::DFG::StructureAbstractValue::assertIsWatched): Deleted.
+        * dfg/DFGStructureRegistrationPhase.cpp: Copied from Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp.
+        (JSC::DFG::StructureRegistrationPhase::StructureRegistrationPhase):
+        (JSC::DFG::StructureRegistrationPhase::run):
+        (JSC::DFG::StructureRegistrationPhase::registerStructures):
+        (JSC::DFG::StructureRegistrationPhase::registerStructure):
+        (JSC::DFG::performStructureRegistration):
+        (JSC::DFG::WatchableStructureWatchingPhase::WatchableStructureWatchingPhase): Deleted.
+        (JSC::DFG::WatchableStructureWatchingPhase::run): Deleted.
+        (JSC::DFG::WatchableStructureWatchingPhase::tryWatch): Deleted.
+        (JSC::DFG::performWatchableStructureWatching): Deleted.
+        * dfg/DFGStructureRegistrationPhase.h: Copied from Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.h.
+        * dfg/DFGWatchableStructureWatchingPhase.cpp: Removed.
+        * dfg/DFGWatchableStructureWatchingPhase.h: Removed.
+
+2014-08-18  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Fix ASSERT in ARM64's JSC::GPRInfo::debugName
+        https://bugs.webkit.org/show_bug.cgi?id=136050
+
+        Reviewed by Darin Adler.
+
+        Remove cast of GPRReg to unsigned to prevent signed/unsigned comparison
+        error.
+
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::debugName):
+
+2014-08-18  Andreas Kling  <akling@apple.com>
+
+        REGRESSION(r168256): JSString can get 8-bit flag wrong when re-using AtomicStrings.
+        <https://webkit.org/b/133574>
+        <rdar://problem/18051847>
+
+        The optimization that resolves JSRopeStrings into an existing
+        AtomicString (to save time and memory by avoiding StringImpl allocation)
+        had a bug that it wasn't copying the 8-bit flag from the AtomicString.
+
+        This could lead to a situation where a 16-bit StringImpl containing
+        only 8-bit characters is sitting in the AtomicString table, is found
+        by the rope resolution optimization, and gives you a rope that thinks
+        it's all 8-bit, but has a fiber with 16-bit characters.
+
+        Resolving that rope will then yield incorrect results.
+
+        This was all caught by an assertion, but very hard to reproduce.
+
+        Test: js/dopey-rope-with-16-bit-propertyname.html
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeToAtomicString):
+        (JSC::JSRopeString::resolveRopeToExistingAtomicString):
+        * runtime/JSString.h:
+        (JSC::JSString::setIs8Bit):
+        (JSC::JSString::toExistingAtomicString):
+
+2014-08-18  Matthew Mirman  <mmirman@apple.com>
+
+        Merges the two native inlining passes from the build.
+        Also adds the AvailableExternallyLinkage assertion to linked 
+        functions to allow unused and duplicate ones to be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=135526
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: 
+        Removed second generation of llvm binary files.
+        Fixed the flags on the first pass. 
+        * build-symbol-table-index.py: Modified some paths.
+        * build-symbol-table-index.sh: Removed.
+        * copy-llvm-ir-to-derived-sources.sh: Now calls build-symbol-table-index directly.
+        * ftl/FTLLowerDFGToLLVM.cpp: Added LLVMAvailableExternallyLinkage assertion.
+        (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): 
+        * runtime/ArrayPrototype.cpp: Removed static declarations. 
+        * runtime/DateConstructor.cpp: ditto.
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp: ditto.
+        * runtime/JSDataViewPrototype.cpp: ditto on both.
+        (JSC::dataViewProtoFuncGetInt8):
+        (JSC::dataViewProtoFuncGetInt16):
+        (JSC::dataViewProtoFuncGetInt32):
+        (JSC::dataViewProtoFuncGetUint8):
+        (JSC::dataViewProtoFuncGetUint16):
+        (JSC::dataViewProtoFuncGetUint32):
+        (JSC::dataViewProtoFuncGetFloat32):
+        (JSC::dataViewProtoFuncGetFloat64):
+        (JSC::dataViewProtoFuncSetInt8):
+        (JSC::dataViewProtoFuncSetInt16):
+        (JSC::dataViewProtoFuncSetInt32):
+        (JSC::dataViewProtoFuncSetUint8):
+        (JSC::dataViewProtoFuncSetUint16):
+        (JSC::dataViewProtoFuncSetUint32):
+        (JSC::dataViewProtoFuncSetFloat32):
+        (JSC::dataViewProtoFuncSetFloat64):
+        * runtime/JSONObject.cpp: ditto.
+        * runtime/ObjectConstructor.cpp: ditto.
+        * runtime/StringPrototype.cpp: ditto.
+
+2014-08-18  Saam Barati  <sbarati@apple.com>
+
+        The parser should generate AST nodes the var declarations with no initializers
+        https://bugs.webkit.org/show_bug.cgi?id=135545
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, JSC's parser ignores variable declarations
+        that have no assignment initializer value because all 
+        variables are implicitly assigned to undefined. But, 
+        type profiling needs an AST node to be generated for these 
+        empty variable declarations because it needs to be able to 
+        profile their text locations and to see that their type 
+        is undefined.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::EmptyVarExpression::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createEmptyVarExpression):
+        * parser/NodeConstructors.h:
+        (JSC::EmptyVarExpression::EmptyVarExpression):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVarDeclarationList):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createEmptyVarExpression):
+
+2014-08-18  Diego Pino Garcia  <dpino@igalia.com>
+
+        Completed iterator can be revived by adding more than one new entry to the target object
+        https://bugs.webkit.org/show_bug.cgi?id=129993
+
+        Reviewed by Oliver Hunt.
+
+        When iterator reaches end, finish iterator.
+
+        * runtime/JSMapIterator.h:
+        (JSC::JSMapIterator::finish):
+        * runtime/JSSetIterator.h:
+        (JSC::JSSetIterator::finish):
+        * runtime/MapData.h:
+        (JSC::MapData::const_iterator::finish): set index of iterator to max
+        Int32.
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototypeFuncNext):
+
+2014-08-15  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: rewrite CodeGeneratorInspector to be modular and testable
+        https://bugs.webkit.org/show_bug.cgi?id=131596
+
+        Unreviewed gardening to rebaseline inspector generator tests after addressing review comments.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2014-08-15  Brian J. Burg  <burg@cs.washington.edu>
+
+        Unreviewed build fix for some GTK bots after r172655.
+
+        Some bots use Python 2.6, which lacks the 'flags' named parameter for re.sub.
+
+        * inspector/scripts/codegen/generator.py:
+        (Generator.stylized_name_for_enum_value): Do things the old-school way.
+
+2014-08-15  Michael Saboff  <msaboff@apple.com>
+
+        Change callToJavaScript and callToNativeFunction so their callFrames match the native calling conventions
+        https://bugs.webkit.org/show_bug.cgi?id=131578
+
+        Reviewed by Geoffrey Garen.
+
+        Renamed callToJavaScript and callToNativeFunction to vmEntryToJavaScript and vmEntryToNative,
+        respectively.  Eliminated the sentinel frame and replaced it with the structure VMEntryRecord
+        that appears in the "locals" area of a VM entry stack frame.  Changed the order that
+        vmEntryToJavaScript and vmEntryToNative creates their stack frames to be native calling
+        convention compliant.  That is to save prior frame pointer, save callee save registers, then
+        allocate and populate the VMEntryRecord, and finally allocate a CallFrame for the JS function
+        that vmEntryToJavaScript will invoke.  The top most vm entry frame pointer is saved in
+        VM::topVMEntryFrame.  The vmEntry functions save prior contents of VM::topVMEntryFrame
+        along with the VM and VM::topCallFrame in the VMEntryRecord it places on the stack.  Starting
+        at VM::topCallFrame, the stack can be walked using these VMEntryRecords.
+
+        Arbitrary stack unwinding is now handled either iteratively by loading VM::topVMEntryFrame
+        into a local variable and using CallFrame::callerFrame(VMEntryFrame*&) or by using StackVisitor.
+        Given that the stack is effectively a singly linked list, general stack unwinding needs to use
+        one of these two methods.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Addition of VMEntryRecord.h
+
+        * bytecode/BytecodeList.json:
+        Renaming of llint helper opcodes due to renaming callToJavaScript and callToNativeFunction.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::stepOutOfFunction):
+        (JSC::Debugger::returnEvent):
+        (JSC::Debugger::didExecuteProgram):
+        * jsc.cpp:
+        (functionDumpCallFrame):
+        * jit/JITOperations.cpp:
+        Changed unwinding to use CallFrame::callerFrame(VMEntryFrame*&).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::RecursionCheckFunctor::RecursionCheckFunctor):
+        (JSC::RecursionCheckFunctor::operator()):
+        (JSC::RecursionCheckFunctor::didRecurse):
+        (JSC::CodeBlock::noticeIncomingCall):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::FindCallerMidStackFunctor::FindCallerMidStackFunctor):
+        (JSC::FindCallerMidStackFunctor::operator()):
+        (JSC::FindCallerMidStackFunctor::getCallerFrame):
+        (JSC::DebuggerCallFrame::callerFrame):
+        * interpreter/VMInspector.cpp:
+        (JSC::CountFramesFunctor::CountFramesFunctor):
+        (JSC::CountFramesFunctor::operator()):
+        (JSC::CountFramesFunctor::count):
+        (JSC::VMInspector::countFrames):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::FindFirstCallerFrameWithCodeblockFunctor):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::operator()):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::foundCallFrame):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::index):
+        (JSC::VM::throwException):
+        Changed unwinding to use StackVisitor including added functor classes.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::callerFrame):
+        Added new flavor of callerFrame() that can iteratively unwind the stack.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callerFrame): Changed callerFrame() to use private common helper.
+        (JSC::ExecState::callerFrameOrVMEntryFrame): Deleted.
+        (JSC::ExecState::isVMEntrySentinel): Deleted.
+        (JSC::ExecState::vmEntrySentinelCallerFrame): Deleted.
+        (JSC::ExecState::initializeVMEntrySentinelFrame): Deleted.
+        (JSC::ExecState::callerFrameSkippingVMEntrySentinel): Deleted.
+        (JSC::ExecState::vmEntrySentinelCodeBlock): Deleted.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        (JSC::ExecState::topOfFrame):
+        (JSC::ExecState::currentVPC):
+        (JSC::ExecState::setCurrentVPC):
+        Eliminated unneded checking of sentinel frame.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::Interpreter::getStackTrace): Updated for unwidning changes.
+        (JSC::Interpreter::unwind): Eliminated unneeded sentinel frame check.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JITStubs.h:
+        * llint/LLIntThunks.cpp:
+        (JSC::callToJavaScript): Deleted.
+        (JSC::callToNativetion): Deleted.
+        (JSC::vmEntryToJavaScript):
+        (JSC::vmEntryToNative):
+        * llint/LLIntThunks.h:
+        Updated for vmEntryToJavaScript and vmEntryToNative name changes.
+
+        * interpreter/Interpreter.h:
+        (JSC::TopCallFrameSetter::TopCallFrameSetter):
+        (JSC::TopCallFrameSetter::~TopCallFrameSetter):
+        Eliminated unneeded sentinel frame check.
+
+        * interpreter/Interpreter.h:
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        Removed sentinel specific constructor.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::StackVisitor):
+        (JSC::StackVisitor::readFrame):
+        (JSC::StackVisitor::readNonInlinedFrame):
+        (JSC::StackVisitor::readInlinedFrame):
+        (JSC::StackVisitor::Frame::print):
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::Frame::callerIsVMEntry):
+        Changes for unwinding using CallFrame::callerFrame(VMEntryFrame*&).  Also added field that
+        indicates when about to step over a VM entry frame.
+
+        * interpreter/VMEntryRecord.h: Added.
+        (JSC::VMEntryRecord::prevTopCallFrame):
+        (JSC::VMEntryRecord::prevTopVMEntryFrame):
+        New struct to record prior state of VM's notion of VM entry and top call frames.
+
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        Use new vmEntryToJavaScript and vmEntryToNative name.
+
+        * llint/LLIntOffsetsExtractor.cpp: Added include for VMEntryRecord.h.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Offline assembly implementation of creating stack frame with VMEntryRecord and well as restoring 
+        relevent VM fields when exiting the VM.  Added a helper that returns a VMEntryRecord given
+        a pointer to the VM entry frame.
+
+        * llint/LLIntThunks.cpp:
+        (JSC::vmEntryRecord):
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        C Loop changes to mirror the assembly changes.
+
+        * runtime/VM.h:
+        Added topVMEntryFrame field.
+
+2014-08-15  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: rewrite CodeGeneratorInspector to be modular and testable
+        https://bugs.webkit.org/show_bug.cgi?id=131596
+
+        Reviewed by Joseph Pecoraro.
+
+        Replace CodeGeneratorInspector.py with generate-inspector-protocol-bindings.py.
+        The new generator decouples parsing and typechecking a model of the protocol from
+        code generation. Each generated file is created by a different subclass of Generator.
+        Helper methods to compute various type signatures are shared among generators.
+
+        This patch introduces a test harness and a test suite that covers all functionality.
+
+        Aside from hooking up the new inspector bindings generator to the build system,
+        there are a few comingled changes that would be painful to split from the main
+        patch:
+
+        Convert protocol enumeration types from struct-namespaced enums to C++ scoped enums.
+
+        Move all runtimeCast(), assertValueHasExpectedType(), and RuntimeCastHelper methods to static
+        methods of BindingTraits specializations.
+
+        Together, these changes reduce duplication and make it possible to forward-declare
+        all protocol enum and object types, reducing weird ordering dependencies between domains.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Add inspector scripts to solution filters.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/ConsoleMessage.cpp: Convert to scoped enums.
+        (Inspector::messageSourceValue):
+        (Inspector::messageTypeValue):
+        (Inspector::messageLevelValue):
+        * inspector/InjectedScript.cpp: Convert to scoped enums and BindingTraits.
+        (Inspector::InjectedScript::getFunctionDetails):
+        (Inspector::InjectedScript::getProperties):
+        (Inspector::InjectedScript::getInternalProperties):
+        (Inspector::InjectedScript::wrapCallFrames):
+        (Inspector::InjectedScript::wrapObject):
+        (Inspector::InjectedScript::wrapTable):
+        * inspector/InjectedScriptBase.cpp: Convert InspectorValue::Type to a scoped enum.
+        (Inspector::InjectedScriptBase::makeEvalCall):
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::injectedScriptForObjectId):
+        * inspector/InspectorTypeBuilder.h:
+        (Inspector::TypeBuilder::Array::create):
+        (Inspector::TypeBuilder::StructItemTraits::pushRefPtr):
+        (Inspector::TypeBuilder::ArrayItemHelper<String>::Traits::pushRaw):
+        (Inspector::TypeBuilder::ArrayItemHelper<int>::Traits::pushRaw):
+        (Inspector::TypeBuilder::ArrayItemHelper<double>::Traits::pushRaw):
+        (Inspector::TypeBuilder::ArrayItemHelper<bool>::Traits::pushRaw):
+        (Inspector::TypeBuilder::ArrayItemHelper<InspectorValue>::Traits::pushRefPtr):
+        (Inspector::TypeBuilder::ArrayItemHelper<InspectorObject>::Traits::pushRefPtr):
+        (Inspector::TypeBuilder::ArrayItemHelper<InspectorArray>::Traits::pushRefPtr):
+        (Inspector::TypeBuilder::PrimitiveBindingTraits::assertValueHasExpectedType):
+        (Inspector::TypeBuilder::BindingTraits<TypeBuilder::Array<T>>::runtimeCast):
+        (Inspector::TypeBuilder::BindingTraits<TypeBuilder::Array<T>>::assertValueHasExpectedType):
+        (Inspector::TypeBuilder::BindingTraits<InspectorValue>::assertValueHasExpectedType):
+        (Inspector::TypeBuilder::BindingTraits<int>::assertValueHasExpectedType):
+        (Inspector::TypeBuilder::ExactlyInt::ExactlyInt): Deleted. It was not used.
+        (Inspector::TypeBuilder::ExactlyInt::operator int): Deleted.
+        (Inspector::TypeBuilder::ExactlyInt::cast_to_int): Deleted.
+        (Inspector::TypeBuilder::ExactlyInt::cast_to_int<int>): Deleted.
+        (Inspector::TypeBuilder::int>): Deleted.
+        (Inspector::TypeBuilder::RuntimeCastHelper::assertType): Deleted.
+        (Inspector::TypeBuilder::RuntimeCastHelper::assertAny): Deleted.
+        (Inspector::TypeBuilder::RuntimeCastHelper::assertInt): Deleted.
+        (Inspector::TypeBuilder::Array::runtimeCast): Deleted.
+        (Inspector::TypeBuilder::Array::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::StructItemTraits::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::ArrayItemHelper<String>::Traits::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::ArrayItemHelper<int>::Traits::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::ArrayItemHelper<double>::Traits::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::ArrayItemHelper<bool>::Traits::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::ArrayItemHelper<InspectorValue>::Traits::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::ArrayItemHelper<InspectorObject>::Traits::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::ArrayItemHelper<InspectorArray>::Traits::assertCorrectValue): Deleted.
+        (Inspector::TypeBuilder::ArrayItemHelper<TypeBuilder::Array<T>>::Traits::assertCorrectValue): Deleted.
+
+        * inspector/InspectorValues.cpp: Convert InspectorValue::Type to a scoped enum.
+        (Inspector::InspectorValue::writeJSON):
+        (Inspector::InspectorBasicValue::asBoolean):
+        (Inspector::InspectorBasicValue::asNumber):
+        (Inspector::InspectorBasicValue::writeJSON):
+        (Inspector::InspectorString::writeJSON):
+        (Inspector::InspectorObjectBase::InspectorObjectBase):
+        (Inspector::InspectorObjectBase::setArray): Take InspectorArrayBase.
+        (Inspector::InspectorObjectBase::setObject): Take InspectorObjectBase.
+        (Inspector::InspectorArrayBase::InspectorArrayBase):
+        * inspector/InspectorValues.h:
+
+        * inspector/agents/InspectorDebuggerAgent.cpp: Convert to scoped enums.
+        (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (Inspector::InspectorDebuggerAgent::breakProgram):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::parse):
+        * inspector/agents/InspectorRuntimeAgent.h:
+
+        * inspector/scripts/CodeGeneratorInspector.py: Removed.
+        * inspector/scripts/codegen/__init__.py: Added.
+        * inspector/scripts/codegen/generate_backend_commands.py: Added.
+        (BackendCommandsGenerator):
+        (BackendCommandsGenerator.__init__):
+        (BackendCommandsGenerator.model):
+        (BackendCommandsGenerator.output_filename):
+        (BackendCommandsGenerator.generate_license):
+        (BackendCommandsGenerator.generate_output):
+        (BackendCommandsGenerator.generate_domain):
+        (BackendCommandsGenerator.generate_domain.is_anonymous_enum_member):
+        (BackendCommandsGenerator.generate_domain.generate_parameter_object):
+        * inspector/scripts/codegen/generate_backend_dispatcher_header.py: Added.
+        (BackendDispatcherHeaderGenerator):
+        (BackendDispatcherHeaderGenerator.__init__):
+        (BackendDispatcherHeaderGenerator.model):
+        (BackendDispatcherHeaderGenerator.output_filename):
+        (BackendDispatcherHeaderGenerator.generate_license):
+        (BackendDispatcherHeaderGenerator.generate_output):
+        (BackendDispatcherHeaderGenerator.generate_output.for):
+        (BackendDispatcherHeaderGenerator._generate_handler_declarations_for_domain):
+        (BackendDispatcherHeaderGenerator._generate_anonymous_enum_for_parameter):
+        (BackendDispatcherHeaderGenerator._generate_handler_declaration_for_command):
+        (BackendDispatcherHeaderGenerator._generate_async_handler_declaration_for_command):
+        (BackendDispatcherHeaderGenerator._generate_dispatcher_declarations_for_domain):
+        (BackendDispatcherHeaderGenerator._generate_dispatcher_declaration_for_command):
+        * inspector/scripts/codegen/generate_backend_dispatcher_implementation.py: Added.
+        (BackendDispatcherImplementationGenerator):
+        (BackendDispatcherImplementationGenerator.__init__):
+        (BackendDispatcherImplementationGenerator.model):
+        (BackendDispatcherImplementationGenerator.output_filename):
+        (BackendDispatcherImplementationGenerator.generate_license):
+        (BackendDispatcherImplementationGenerator.generate_output):
+        (BackendDispatcherImplementationGenerator._generate_handler_class_destructor_for_domain):
+        (BackendDispatcherImplementationGenerator._generate_dispatcher_implementations_for_domain):
+        (BackendDispatcherImplementationGenerator._generate_small_dispatcher_switch_implementation_for_domain):
+        (BackendDispatcherImplementationGenerator._generate_large_dispatcher_switch_implementation_for_domain):
+        (BackendDispatcherImplementationGenerator._generate_async_dispatcher_class_for_domain):
+        (BackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_header.py: Added.
+        (FrontendDispatcherHeaderGenerator):
+        (FrontendDispatcherHeaderGenerator.__init__):
+        (FrontendDispatcherHeaderGenerator.model):
+        (FrontendDispatcherHeaderGenerator.output_filename):
+        (FrontendDispatcherHeaderGenerator.generate_license):
+        (FrontendDispatcherHeaderGenerator.generate_output):
+        (FrontendDispatcherHeaderGenerator._generate_anonymous_enum_for_parameter):
+        (FrontendDispatcherHeaderGenerator._generate_dispatcher_declarations_for_domain):
+        (FrontendDispatcherHeaderGenerator._generate_dispatcher_declaration_for_event):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_implementation.py: Added.
+        (FrontendDispatcherImplementationGenerator):
+        (FrontendDispatcherImplementationGenerator.__init__):
+        (FrontendDispatcherImplementationGenerator.model):
+        (FrontendDispatcherImplementationGenerator.output_filename):
+        (FrontendDispatcherImplementationGenerator.generate_license):
+        (FrontendDispatcherImplementationGenerator.generate_output):
+        (FrontendDispatcherImplementationGenerator._generate_dispatcher_implementations_for_domain):
+        (FrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/generate_type_builder_header.py: Added.
+        (TypeBuilderHeaderGenerator):
+        (TypeBuilderHeaderGenerator.__init__):
+        (TypeBuilderHeaderGenerator.model):
+        (TypeBuilderHeaderGenerator.output_filename):
+        (TypeBuilderHeaderGenerator.generate_license):
+        (TypeBuilderHeaderGenerator.generate_output):
+        (TypeBuilderHeaderGenerator._generate_forward_declarations):
+        (_generate_typedefs):
+        (_generate_typedefs_for_domain):
+        (_generate_builders_for_domain):
+        (_generate_class_for_object_declaration):
+        (_generate_struct_for_enum_declaration):
+        (_generate_struct_for_anonymous_enum_member):
+        (_generate_struct_for_anonymous_enum_member.apply_indentation):
+        (_generate_struct_for_enum_type):
+        (_generate_builder_state_enum):
+        (_generate_builder_setter_for_member):
+        (_generate_unchecked_setter_for_member):
+        (_generate_forward_declarations_for_binding_traits):
+        * inspector/scripts/codegen/generate_type_builder_implementation.py: Added.
+        (TypeBuilderImplementationGenerator):
+        (TypeBuilderImplementationGenerator.__init__):
+        (TypeBuilderImplementationGenerator.model):
+        (TypeBuilderImplementationGenerator.output_filename):
+        (TypeBuilderImplementationGenerator.generate_license):
+        (TypeBuilderImplementationGenerator.generate_output):
+        (TypeBuilderImplementationGenerator._generate_enum_mapping):
+        (TypeBuilderImplementationGenerator._generate_open_field_names):
+        (TypeBuilderImplementationGenerator._generate_builders_for_domain):
+        (TypeBuilderImplementationGenerator._generate_runtime_cast_for_object_declaration):
+        (TypeBuilderImplementationGenerator._generate_assertion_for_object_declaration):
+        (TypeBuilderImplementationGenerator._generate_assertion_for_enum):
+        * inspector/scripts/codegen/generator.py: Added.
+        (ucfirst):
+        (Generator):
+        (Generator.__init__):
+        (Generator.model):
+        (Generator.generate_license):
+        (Generator.domains_to_generate):
+        (Generator.generate_output):
+        (Generator.output_filename):
+        (Generator.encoding_for_enum_value):
+        (Generator.assigned_enum_values):
+        (Generator.type_needs_runtime_casts):
+        (Generator.type_has_open_fields):
+        (Generator.type_needs_shape_assertions):
+        (Generator.calculate_types_requiring_shape_assertions):
+        (Generator.calculate_types_requiring_shape_assertions.gather_transitively_referenced_types):
+        (Generator._traverse_and_assign_enum_values):
+        (Generator._assign_encoding_for_enum_value):
+        (Generator.wrap_with_guard_for_domain):
+        (Generator.stylized_name_for_enum_value):
+        (Generator.stylized_name_for_enum_value.replaceCallback):
+        (Generator.keyed_get_method_for_type):
+        (Generator.keyed_set_method_for_type):
+        (Generator.type_builder_string_for_type):
+        (Generator.type_builder_string_for_type_member):
+        (Generator.type_string_for_unchecked_formal_in_parameter):
+        (Generator.type_string_for_checked_formal_event_parameter):
+        (Generator.type_string_for_type_member):
+        (Generator.type_string_for_type_with_name):
+        (Generator.type_string_for_formal_out_parameter):
+        (Generator.type_string_for_formal_async_parameter):
+        (Generator.type_string_for_stack_in_parameter):
+        (Generator.type_string_for_stack_out_parameter):
+        (Generator.assertion_method_for_type_member):
+        (Generator.assertion_method_for_type_member.assertion_method_for_type):
+        (Generator.cpp_name_for_primitive_type):
+        (Generator.js_name_for_parameter_type):
+        (Generator.should_use_wrapper_for_return_type):
+        (Generator.should_pass_by_copy_for_return_type):
+        * inspector/scripts/codegen/generator_templates.py: Added.
+        (GeneratorTemplates):
+        (void):
+        (HashMap):
+        (Builder):
+        (Inspector):
+        * inspector/scripts/codegen/models.py: Added.
+        (ucfirst):
+        (ParseException):
+        (TypecheckException):
+        (Framework):
+        (Framework.__init__):
+        (Framework.setting):
+        (Framework.fromString):
+        (Frameworks):
+        (TypeReference):
+        (TypeReference.__init__):
+        (TypeReference.referenced_name):
+        (Type):
+        (Type.__init__):
+        (Type.__eq__):
+        (Type.__hash__):
+        (Type.raw_name):
+        (Type.is_enum):
+        (Type.type_domain):
+        (Type.qualified_name):
+        (Type.resolve_type_references):
+        (PrimitiveType):
+        (PrimitiveType.__init__):
+        (PrimitiveType.__repr__):
+        (PrimitiveType.type_domain):
+        (PrimitiveType.qualified_name):
+        (AliasedType):
+        (AliasedType.__init__):
+        (AliasedType.__repr__):
+        (AliasedType.is_enum):
+        (AliasedType.type_domain):
+        (AliasedType.qualified_name):
+        (AliasedType.resolve_type_references):
+        (EnumType):
+        (EnumType.__init__):
+        (EnumType.__repr__):
+        (EnumType.is_enum):
+        (EnumType.type_domain):
+        (EnumType.enum_values):
+        (EnumType.qualified_name):
+        (EnumType.resolve_type_references):
+        (ArrayType):
+        (ArrayType.__init__):
+        (ArrayType.__repr__):
+        (ArrayType.type_domain):
+        (ArrayType.qualified_name):
+        (ArrayType.resolve_type_references):
+        (ObjectType):
+        (ObjectType.__init__):
+        (ObjectType.__repr__):
+        (ObjectType.type_domain):
+        (ObjectType.qualified_name):
+        (check_for_required_properties):
+        (Protocol):
+        (Protocol.__init__):
+        (Protocol.parse_specification):
+        (Protocol.parse_domain):
+        (Protocol.parse_type_declaration):
+        (Protocol.parse_type_member):
+        (Protocol.parse_command):
+        (Protocol.parse_event):
+        (Protocol.parse_call_or_return_parameter):
+        (Protocol.resolve_types):
+        (Protocol.lookup_type_for_declaration):
+        (Protocol.lookup_type_reference):
+        (Domain):
+        (Domain.__init__):
+        (Domain.resolve_type_references):
+        (Domains):
+        (TypeDeclaration):
+        (TypeDeclaration.__init__):
+        (TypeDeclaration.resolve_type_references):
+        (TypeMember):
+        (TypeMember.__init__):
+        (TypeMember.resolve_type_references):
+        (Parameter):
+        (Parameter.__init__):
+        (Parameter.resolve_type_references):
+        (Command):
+        (Command.__init__):
+        (Command.resolve_type_references):
+        (Event):
+        (Event.__init__):
+        (Event.resolve_type_references):
+        * inspector/scripts/generate-inspector-protocol-bindings.py: Added.
+        (IncrementalFileWriter):
+        (IncrementalFileWriter.__init__):
+        (IncrementalFileWriter.write):
+        (IncrementalFileWriter.close):
+        (generate_from_specification):
+        (generate_from_specification.load_specification):
+        * inspector/scripts/tests/commands-with-async-attribute.json: Added.
+        * inspector/scripts/tests/commands-with-optional-call-return-parameters.json: Added.
+        * inspector/scripts/tests/domains-with-varying-command-sizes.json: Added.
+        * inspector/scripts/tests/events-with-optional-parameters.json: Added.
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result: Added.
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result: Added.
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result: Added.
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result: Added.
+        * inspector/scripts/tests/fail-on-duplicate-type-declarations.json-error: Added.
+        * inspector/scripts/tests/fail-on-enum-with-no-values.json-error: Added.
+        * inspector/scripts/tests/fail-on-type-declaration-using-type-reference.json-error: Added.
+        * inspector/scripts/tests/fail-on-type-with-lowercase-name.json-error: Added.
+        * inspector/scripts/tests/fail-on-unknown-type-reference-in-type-declaration.json-error: Added.
+        * inspector/scripts/tests/fail-on-unknown-type-reference-in-type-member.json-error: Added.
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result: Added.
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result: Added.
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result: Added.
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result: Added.
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result: Added.
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result: Added.
+        * inspector/scripts/tests/fail-on-duplicate-type-declarations.json: Added.
+        * inspector/scripts/tests/fail-on-enum-with-no-values.json: Added.
+        * inspector/scripts/tests/fail-on-type-declaration-using-type-reference.json: Added.
+        * inspector/scripts/tests/fail-on-type-with-lowercase-name.json: Added.
+        * inspector/scripts/tests/fail-on-unknown-type-reference-in-type-declaration.json: Added.
+        * inspector/scripts/tests/fail-on-unknown-type-reference-in-type-member.json: Added.
+        * inspector/scripts/tests/same-type-id-different-domain.json: Added.
+        * inspector/scripts/tests/type-declaration-aliased-primitive-type.json: Added.
+        * inspector/scripts/tests/type-declaration-array-type.json: Added.
+        * inspector/scripts/tests/type-declaration-enum-type.json: Added.
+        * inspector/scripts/tests/type-declaration-object-type.json: Added.
+        * inspector/scripts/tests/type-requiring-runtime-casts.json: Added.
+
+2014-08-15  Matthew Mirman  <mmirman@apple.com>
+
+        Made native inlining errors not segfault. 
+        https://bugs.webkit.org/show_bug.cgi?id=135988
+        
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::disposeMessage): Added.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compilePutById): 
+        abstracted out Options::verboseCompilation as was the case in the rest of the file.
+        (JSC::FTL::LowerDFGToLLVM::compileNativeCallOrConstruct):
+        (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): 
+        added output error messages for llvm module loading.
+
+2014-08-14  Andreas Kling  <akling@apple.com>
+
+        Allocate the whole RegExpMatchesArray backing store up front.
+        <https://webkit.org/b/135217>
+
+        We were using the generic array backing store allocation path for
+        RegExpMatchesArray which meant starting with 4 slots and then growing
+        it dynamically as we append. Since we always know the final number of
+        entries up front, allocate a perfectly-sized backing store right away.
+
+        ~2% progression on Octane/regexp.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSArray.h:
+        (JSC::createArrayButterflyWithExactLength):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::create):
+
+2014-08-14  Saam Barati  <sbarati@apple.com>
+
+        Allow high fidelity type profiling to be enabled and disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=135423
+
+        Reviewed by Geoffrey Garen.
+
+        - Merged op_put_to_scope_with_profile and op_get_from_scope_with_profile into
+          op_profile_types_with_high_fidelity by adding extra arguments to the opcode.
+        - Altered SymbolTable to use less memory by adding a rare data structure for 
+          type profiling.
+        - Created an interface to turn on and off type profiling from the Web
+          Inspector.
+        - Refactored how entries are written to HighFidelityLog to make it
+          easier to inline when generating machine code.
+        - Implemented op_profile_types_with_high_fidelity in the baseline JIT
+          by inlining the process of writing to the log and doing a small amount
+          of type inference optimizations.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::scopeDependentProfile): Deleted.
+        * bytecode/CodeBlock.h:
+        * bytecode/TypeLocation.h:
+        (JSC::TypeLocation::TypeLocation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
+        (JSC::BytecodeGenerator::emitGetFromScopeWithProfile): Deleted.
+        (JSC::BytecodeGenerator::emitPutToScopeWithProfile): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::PrefixNode::emitBracket):
+        (JSC::PrefixNode::emitDot):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::TypeRecompiler::operator()):
+        (Inspector::recompileAllJSFunctionsForTypeProfiling):
+        (Inspector::InspectorRuntimeAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorRuntimeAgent::enableHighFidelityTypeProfiling):
+        (Inspector::InspectorRuntimeAgent::disableHighFidelityTypeProfiling):
+        (Inspector::InspectorRuntimeAgent::setHighFidelityTypeProfilingEnabledState):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        (Inspector::JSGlobalObjectRuntimeAgent::willDestroyFrontendAndBackend):
+        * inspector/protocol/Runtime.json:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_types_with_high_fidelity):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_types_with_high_fidelity):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::getFromScopeCommon): Deleted.
+        (JSC::LLInt::putToScopeCommon): Deleted.
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/HighFidelityLog.cpp:
+        (JSC::HighFidelityLog::initializeHighFidelityLog):
+        (JSC::HighFidelityLog::~HighFidelityLog):
+        (JSC::HighFidelityLog::processHighFidelityLog):
+        * runtime/HighFidelityLog.h:
+        (JSC::HighFidelityLog::LogEntry::structureIDOffset):
+        (JSC::HighFidelityLog::LogEntry::valueOffset):
+        (JSC::HighFidelityLog::LogEntry::locationOffset):
+        (JSC::HighFidelityLog::recordTypeInformationForLocation):
+        (JSC::HighFidelityLog::logEndPtr):
+        (JSC::HighFidelityLog::logStartOffset):
+        (JSC::HighFidelityLog::currentLogEntryOffset):
+        * runtime/HighFidelityTypeProfiler.cpp:
+        (JSC::HighFidelityTypeProfiler::logTypesForTypeLocation):
+        (JSC::descriptorMatchesTypeLocation):
+        * runtime/HighFidelityTypeProfiler.h:
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::cloneCapturedNames):
+        (JSC::SymbolTable::prepareForHighFidelityTypeProfiling):
+        (JSC::SymbolTable::uniqueIDForVariable):
+        (JSC::SymbolTable::uniqueIDForRegister):
+        (JSC::SymbolTable::globalTypeSetForRegister):
+        (JSC::SymbolTable::globalTypeSetForVariable):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::add):
+        (JSC::SymbolTable::set):
+        * runtime/TypeLocationCache.cpp:
+        (JSC::TypeLocationCache::getTypeLocation):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::getRuntimeTypeForValue):
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::TypeSet::allPrimitiveTypeNames):
+        (JSC::TypeSet::addTypeForValue): Deleted.
+        * runtime/TypeSet.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::nextTypeLocation):
+        (JSC::VM::enableHighFidelityTypeProfiling):
+        (JSC::VM::disableHighFidelityTypeProfiling):
+        (JSC::VM::dumpHighFidelityProfilingTypes):
+        * runtime/VM.h:
+        (JSC::VM::nextLocation): Deleted.
+
+2014-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Update scope resolution to assume that the parent activation is always there
+        https://bugs.webkit.org/show_bug.cgi?id=135947
+
+        Reviewed by Andreas Kling.
+
+        Another incremental step in removing the idea of lazily created
+        activations.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitResolveClosure):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitResolveClosure):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Create activations eagerly
+        https://bugs.webkit.org/show_bug.cgi?id=135942
+
+        Reviewed by Geoffrey Garen.
+
+        Prepare to rewrite activation objects into a more
+        sane implementation. Step 1 is reverting to eager
+        creation of the activation object. This results in
+        a 1.35x regression in earley, but otherwise has a
+        minimal performance impact.
+
+        The earley regression is being tracked by bug #135943
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        (JSC::BytecodeGenerator::createActivationIfNecessary): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_activation):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_activation):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-08-14  Oliver Hunt  <oliver@apple.com>
+
+        Create activations eagerly
+        https://bugs.webkit.org/show_bug.cgi?id=135942
+
+        Reviewed by Geoffrey Garen.
+
+        Prepare to rewrite activation objects into a more
+        sane implementation. Step 1 is reverting to eager
+        creation of the activation object. This results in
+        a 1.35x regression in earley, but otherwise has a
+        minimal performance impact.
+
+        The earley regression is being tracked by 
+        http://webkit.org/b/135943
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        (JSC::BytecodeGenerator::createActivationIfNecessary): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_activation):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_activation):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-08-14  Tomas Popela  <tpopela@redhat.com>
+
+        Add support for ppc, ppc64, ppc64le, s390, s390x into the CMake build
+        https://bugs.webkit.org/show_bug.cgi?id=135937
+
+        Reviewed by Carlos Garcia Campos.
+
+        * CMakeLists.txt:
+
+2014-08-14  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Fix JSC::ARM64Assembler::LinkRecord::RealTypes
+        https://bugs.webkit.org/show_bug.cgi?id=135906
+
+        Reviewed by Michael Saboff.
+
+        JSC::ARM64Assembler::LinkRecord::RealTypes::m_compareRegister is defined
+        to occupy 5 bits but JSC::ARM64Assembler::RegisterID needs 6 bits. So,
+        increase the size of the bit field and also reorganize the struct to 
+        better align with word boundaries.
+
+        * assembler/ARM64Assembler.h:
+
+2014-08-13  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Add ARM64 support to CMake-based builds
+        https://bugs.webkit.org/show_bug.cgi?id=135912
+
+        Reviewed by Gyuyoung Kim.
+
+        This patch ensures that CMake does not fail with Unknown CPU error when
+        building for ARM64.
+
+        * CMakeLists.txt:
+
+2014-08-13  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Enable CSS_SCROLL_SNAP for iOS
+        https://bugs.webkit.org/show_bug.cgi?id=135915
+
+        Turn on CSS_SCROLL_SNAP for iOS and the iOS simulator.
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-13  Alex Christensen  <achristensen@webkit.org>
+
+        Progress towards CMake on Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=135819
+
+        Reviewed by Laszlo Gombos.
+
+        * CMakeLists.txt:
+        Add the remote inspector headers to the forwarding headers list.
+
+2014-08-13  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Make JavaScriptCore and bmalloc build with the public SDK
+        https://bugs.webkit.org/show_bug.cgi?id=135848
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSBase.h: Declare NSMap functions with external linkage when building for iOS without the
+        header <Foundation/NSMapTablePriv.h>.
+        * inspector/remote/RemoteInspector.mm: Define XPC functions with external linkage when building
+        without the system header <xpc/xpc.h>.
+        * inspector/remote/RemoteInspectorXPCConnection.h: Define xpc_connection_t and xpc_object_t when building
+        without the system header <xpc/xpc.h>.
+        * inspector/remote/RemoteInspectorXPCConnection.mm: Declare XPC functions with external linkage when
+        building without without the system header <xpc/xpc.h>.
+        (Inspector::RemoteInspectorXPCConnection::closeOnQueue): Fix code style; use nullptr instead of NULL.
+        (Inspector::RemoteInspectorXPCConnection::sendMessage): Ditto.
+
+2014-08-12  Peyton Randolph  <prandolph@apple.com>
+
+        Runtime switch for long mouse press gesture. Part of 135257 - Add long mouse press gesture.
+        https://bugs.webkit.org/show_bug.cgi?id=135682
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Remove ENABLE_LONG_MOUSE_PRESS feature flag.
+
+2014-08-12  Alex Christensen  <achristensen@webkit.org>
+
+        Generate header detection headers for CMake on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=135807
+
+        Reviewed by Brent Fulgham.
+
+        * CMakeLists.txt:
+        Include the derived sources directory to find WTF/WTFHeaderDetection.h.
+
+2014-08-11  Andy Estes  <aestes@apple.com>
+
+        [iOS] Get rid of iOS.xcconfig
+        https://bugs.webkit.org/show_bug.cgi?id=135809
+
+        Reviewed by Joseph Pecoraro.
+
+        All iOS.xcconfig did was include AspenFamily.xcconfig, so there's no need for the indirection.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/iOS.xcconfig: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-08-11  Michael Saboff  <msaboff@apple.com>
+
+        Eliminate {push,pop}CalleeSaves in favor of individual pushes & pops
+        https://bugs.webkit.org/show_bug.cgi?id=127155
+
+        Reviewed by Geoffrey Garen.
+
+        Eliminated the offline assembler instructions {push,pop}CalleeSaves as well as the
+        ARM64 specific {push,pop}LRAndFP and replaced them with individual push and pop
+        instructions. Where the registers referenced by the added push and pop instructions
+        are not part of the offline assembler register aliases, used a newly added "emit"
+        offline assembler instruction which takes a string literal and outputs that
+        string as a native instruction.
+
+        * llint/LowLevelInterpreter.asm:
+        * offlineasm/arm.rb:
+        * offlineasm/arm64.rb:
+        * offlineasm/ast.rb:
+        * offlineasm/cloop.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/mips.rb:
+        * offlineasm/parser.rb:
+        * offlineasm/sh4.rb:
+        * offlineasm/transform.rb:
+        * offlineasm/x86.rb:
+
+2014-08-11  Mark Lam  <mark.lam@apple.com>
+
+        Re-landing r172401 with fixed test.
+        <https://webkit.org/b/135782>
+
+        Not reviewed.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::pushIndexedForInScope):
+        (JSC::BytecodeGenerator::pushStructureForInScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ForInContext::ForInContext):
+        (JSC::ForInContext::base):
+        (JSC::StructureForInContext::StructureForInContext):
+        (JSC::IndexedForInContext::IndexedForInContext):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        * tests/stress/for-in-tests.js:
+
+2014-08-11  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r172401.
+        https://bugs.webkit.org/show_bug.cgi?id=135812
+
+        Failing stress/for-in-tests.js
+        http://build.webkit.org/builders/Apple%20Mavericks%20Release%20WK1%20%28Tests%29/builds/7945/steps
+        /jscore-test/logs/stdio (Requested by mlam on #webkit).
+
+        Reverted changeset:
+
+        "for-in optimization should also make sure the base matches
+        the object being iterated"
+        https://bugs.webkit.org/show_bug.cgi?id=135782
+        http://trac.webkit.org/changeset/172401
+
+2014-08-11  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: use type builders to construct high fidelity type information payloads
+        https://bugs.webkit.org/show_bug.cgi?id=135803
+
+        Reviewed by Timothy Hatcher.
+
+        Due to some typos in the protocol file, the code had worked with raw objects
+        rather than with type builders. Convert to using builders.
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Runtime.json: Fix 'item' for 'items'; true for 'true'.
+        * runtime/HighFidelityTypeProfiler.cpp:
+        (JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
+        * runtime/HighFidelityTypeProfiler.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::allStructureRepresentations):
+        (JSC::StructureShape::stringRepresentation):
+        (JSC::StructureShape::inspectorRepresentation):
+        * runtime/TypeSet.h:
+
+2014-08-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        for-in optimization should also make sure the base matches the object being iterated
+        https://bugs.webkit.org/show_bug.cgi?id=135782
+
+        Reviewed by Geoffrey Garen.
+
+        If we access a different base object with the same index, we shouldn't try to randomly 
+        load from that object's backing store.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::pushIndexedForInScope):
+        (JSC::BytecodeGenerator::pushStructureForInScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::ForInContext::ForInContext):
+        (JSC::ForInContext::base):
+        (JSC::StructureForInContext::StructureForInContext):
+        (JSC::IndexedForInContext::IndexedForInContext):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        * tests/stress/for-in-tests.js:
+
+2014-08-11  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed gardening.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Display files in
+        proper folder categories..
+
+2014-08-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JIT should use full 64-bit stores for jsBoolean and jsNull
+        https://bugs.webkit.org/show_bug.cgi?id=135784
+
+        Reviewed by Michael Saboff.
+
+        This guarantees that we set the high bits of the register with the correct tag.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_has_structure_property):
+        (JSC::JIT::emit_op_next_enumerator_pname):
+
+2014-08-11  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Adjust build script for Windows production build.
+        https://bugs.webkit.org/show_bug.cgi?id=135806
+        <rdar://problem/17978299>
+
+        Reviewed by Timothy Hatcher.
+
+        * JavaScriptCore.vcxproj/copy-files.cmd: Copy file for later use
+        in WebInspectorUI build.
+
+2014-08-10  Oliver Hunt  <oliver@apple.com>
+
+        Destructuring assignment in a var declaration list incorrectly consumes subsequent variable initialisers
+        https://bugs.webkit.org/show_bug.cgi?id=135773
+
+        Reviewed by Michael Saboff.
+
+        We should be using parseAssignment expression in order to get the correct
+        precedence.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVarDeclarationList):
+
+2014-08-10  Diego Pino Garcia  <dpino@igalia.com>
+
+        JSC Lexer is allowing octals 08 and 09 in strict mode functions
+        https://bugs.webkit.org/show_bug.cgi?id=135704
+
+        Reviewed by Oliver Hunt.
+
+        Return syntax error ("Decimal integer literals with a leading zero are
+        forbidden in strict mode") if a number starts with 0 and is followed 
+        by a digit.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+
+2014-08-08  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION: Inspector crashes when debugger is paused and injected scripts access window.screen().
+        <https://webkit.org/b/135656>
+
+        Not reviewed.
+
+        Rolling out r170680 which was merged to ToT in r172129.
+
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::scope):
+        (JSC::DebuggerCallFrame::evaluate):
+        (JSC::DebuggerCallFrame::invalidate):
+        * debugger/DebuggerCallFrame.h:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::DebuggerScope):
+        (JSC::DebuggerScope::finishCreation):
+        (JSC::DebuggerScope::visitChildren):
+        (JSC::DebuggerScope::className):
+        (JSC::DebuggerScope::getOwnPropertySlot):
+        (JSC::DebuggerScope::put):
+        (JSC::DebuggerScope::deleteProperty):
+        (JSC::DebuggerScope::getOwnPropertyNames):
+        (JSC::DebuggerScope::defineOwnProperty):
+        (JSC::DebuggerScope::next): Deleted.
+        (JSC::DebuggerScope::invalidateChain): Deleted.
+        (JSC::DebuggerScope::isWithScope): Deleted.
+        (JSC::DebuggerScope::isGlobalScope): Deleted.
+        (JSC::DebuggerScope::isFunctionScope): Deleted.
+        * debugger/DebuggerScope.h:
+        (JSC::DebuggerScope::create):
+        (JSC::DebuggerScope::Iterator::Iterator): Deleted.
+        (JSC::DebuggerScope::Iterator::get): Deleted.
+        (JSC::DebuggerScope::Iterator::operator++): Deleted.
+        (JSC::DebuggerScope::Iterator::operator==): Deleted.
+        (JSC::DebuggerScope::Iterator::operator!=): Deleted.
+        (JSC::DebuggerScope::isValid): Deleted.
+        (JSC::DebuggerScope::jsScope): Deleted.
+        (JSC::DebuggerScope::begin): Deleted.
+        (JSC::DebuggerScope::end): Deleted.
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::scopeType):
+        (Inspector::JSJavaScriptCallFrame::scopeChain):
+        * inspector/JavaScriptCallFrame.h:
+        (Inspector::JavaScriptCallFrame::scopeChain):
+        * inspector/ScriptDebugServer.cpp:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::debuggerScopeStructure): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::isWithScope): Deleted.
+        * runtime/JSScope.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2014-08-07  Saam Barati  <sbarati@apple.com>
+
+        Create a more generic way for VMEntryScope to notify those interested that it will be destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=135358
+
+        Reviewed by Geoffrey Garen.
+
+        When VMEntryScope is destroyed, and it has a flag set indicating that the
+        Debugger needs to recompile all functions, it calls Debugger::recompileAllJSFunctions. 
+        This flag is only used by Debugger to have VMEntryScope notify it when the
+        Debugger is safe to recompile all functions. This patch will substitute this
+        Debugger-specific recompilation flag with a list of callbacks that are notified 
+        when the outermost VMEntryScope dies. This creates a general purpose interface 
+        for being notified when the VM stops executing code via the event of the outermost 
+        VMEntryScope dying.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::setEntryScopeDidPopListener):
+        (JSC::VMEntryScope::~VMEntryScope):
+        * runtime/VMEntryScope.h:
+        (JSC::VMEntryScope::setRecompilationNeeded): Deleted.
+
+2014-08-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        Get rid of SCRIPTED_SPEECH
+        https://bugs.webkit.org/show_bug.cgi?id=135729
+
+        Reviewed by Brent Fulgham.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        SpeculateInt32Operand is sometimes used in a 64-bit context, which has undefined behavior
+        https://bugs.webkit.org/show_bug.cgi?id=135722
+
+        Reviewed by Filip Pizlo.
+
+        We should be using SpeculateStrictInt32Operand instead.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-08-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        Get rid of INPUT_SPEECH
+        https://bugs.webkit.org/show_bug.cgi?id=135672
+
+        Reviewed by Andreas Kling.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        for-in is failing fast/dom/dataset-xhtml.xhtml and dataset.html tests
+        https://bugs.webkit.org/show_bug.cgi?id=135681
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::canCacheGenericPropertyNameEnumerator): We were checking the entire 
+        prototype chain for overridesGetPropertyNames, but we were neglecting to check the 
+        base object's Structure. D'oh!
+
+2014-08-06  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix for build failure on EFL bots.
+
+        Not reviewed.
+
+        * runtime/EnumerationMode.h:
+        (JSC::shouldIncludeJSObjectPropertyNames):
+        (JSC::modeThatSkipsJSObject):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getEnumerableLength):
+        * runtime/JSCell.h:
+
+2014-08-06  Dean Jackson  <dino@apple.com>
+
+        ENABLE_CSS_TRANSFORMS_ANIMATIONS_UNPREFIXED is not used anywhere. Remove it.
+        https://bugs.webkit.org/show_bug.cgi?id=135675
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-06  Wenson Hsieh  <wenson_hsieh@apple.com>
+
+        Implement parsing for CSS scroll snap points
+        https://bugs.webkit.org/show_bug.cgi?id=134301
+
+        Reviewed by Dean Jackson.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_CSS_SCROLL_SNAP
+
+2014-08-06  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix for build failure on GTK bots.
+
+        Not reviewed.
+
+        * runtime/FunctionHasExecutedCache.cpp:
+        - #include <limits.h> for UINT_MAX's definition.
+
+2014-08-06  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix for build failure on EFL bots.
+
+        Not reviewed.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::emitLoadForArrayMode):
+
+2014-08-06  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: adding missing build file changes from the FTLOPT merge at r172176.
+
+        Not reviewed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2014-08-06  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix attempt since r172184
+
+        * CMakeLists.txt: Removed TypeLocation.cpp
+
+2014-08-06  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: adding missing build file changes from r171510.
+        <https://webkit.org/b/134860>
+
+        Not reviewed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2014-08-06  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: adding missing build file changes from r170490.
+        <https://webkit.org/b/133395>
+
+        Not reviewed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2014-08-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Silence a debug assertion.
+
+        Reviewed by Mark Hahnenberg.
+
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::JSPropertyNameEnumerator::cachedStructure):
+
+2014-08-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix 32-bit build.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileHasIndexedProperty):
+
+2014-08-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge r171389, r171495, r171508, r171510, r171605, r171606, r171611, r171614, r171763 from ftlopt.
+
+    2014-07-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            Support for-in in the FTL
+            https://bugs.webkit.org/show_bug.cgi?id=134140
+    
+            Reviewed by Filip Pizlo.
+    
+            * dfg/DFGSSALoweringPhase.cpp:
+            (JSC::DFG::SSALoweringPhase::handleNode):
+            * ftl/FTLAbstractHeapRepository.cpp:
+            * ftl/FTLAbstractHeapRepository.h:
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLIntrinsicRepository.h:
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+            (JSC::FTL::LowerDFGToLLVM::compileHasIndexedProperty):
+            (JSC::FTL::LowerDFGToLLVM::compileHasGenericProperty):
+            (JSC::FTL::LowerDFGToLLVM::compileHasStructureProperty):
+            (JSC::FTL::LowerDFGToLLVM::compileGetDirectPname):
+            (JSC::FTL::LowerDFGToLLVM::compileGetEnumerableLength):
+            (JSC::FTL::LowerDFGToLLVM::compileGetStructurePropertyEnumerator):
+            (JSC::FTL::LowerDFGToLLVM::compileGetGenericPropertyEnumerator):
+            (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname):
+            (JSC::FTL::LowerDFGToLLVM::compileToIndexString):
+    
+    2014-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            Remove JSPropertyNameIterator
+            https://bugs.webkit.org/show_bug.cgi?id=135066
+    
+            Reviewed by Geoffrey Garen.
+    
+            It has been replaced by JSPropertyNameEnumerator.
+    
+            * JavaScriptCore.order:
+            * bytecode/BytecodeBasicBlock.cpp:
+            (JSC::isBranch):
+            * bytecode/BytecodeList.json:
+            * bytecode/BytecodeUseDef.h:
+            (JSC::computeUsesForBytecodeOffset):
+            (JSC::computeDefsForBytecodeOffset):
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::dumpBytecode):
+            * bytecode/PreciseJumpTargets.cpp:
+            (JSC::getJumpTargetsForBytecodeOffset):
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::emitGetPropertyNames): Deleted.
+            (JSC::BytecodeGenerator::emitNextPropertyName): Deleted.
+            * bytecompiler/BytecodeGenerator.h:
+            * interpreter/Interpreter.cpp:
+            * interpreter/Register.h:
+            * jit/JIT.cpp:
+            (JSC::JIT::privateCompileMainPass):
+            (JSC::JIT::privateCompileSlowCases):
+            * jit/JIT.h:
+            * jit/JITOpcodes.cpp:
+            (JSC::JIT::emit_op_get_pnames): Deleted.
+            (JSC::JIT::emit_op_next_pname): Deleted.
+            * jit/JITOpcodes32_64.cpp:
+            (JSC::JIT::emit_op_get_pnames): Deleted.
+            (JSC::JIT::emit_op_next_pname): Deleted.
+            * jit/JITOperations.cpp:
+            * jit/JITPropertyAccess.cpp:
+            (JSC::JIT::emit_op_get_by_pname): Deleted.
+            (JSC::JIT::emitSlow_op_get_by_pname): Deleted.
+            * jit/JITPropertyAccess32_64.cpp:
+            (JSC::JIT::emit_op_get_by_pname): Deleted.
+            (JSC::JIT::emitSlow_op_get_by_pname): Deleted.
+            * llint/LLIntOffsetsExtractor.cpp:
+            * llint/LLIntSlowPaths.cpp:
+            (JSC::LLInt::LLINT_SLOW_PATH_DECL): Deleted.
+            * llint/LLIntSlowPaths.h:
+            * llint/LowLevelInterpreter.asm:
+            * llint/LowLevelInterpreter32_64.asm:
+            * llint/LowLevelInterpreter64.asm:
+            * runtime/CommonSlowPaths.cpp:
+            * runtime/JSPropertyNameIterator.cpp:
+            (JSC::JSPropertyNameIterator::JSPropertyNameIterator): Deleted.
+            (JSC::JSPropertyNameIterator::create): Deleted.
+            (JSC::JSPropertyNameIterator::destroy): Deleted.
+            (JSC::JSPropertyNameIterator::get): Deleted.
+            (JSC::JSPropertyNameIterator::visitChildren): Deleted.
+            * runtime/JSPropertyNameIterator.h:
+            (JSC::JSPropertyNameIterator::createStructure): Deleted.
+            (JSC::JSPropertyNameIterator::size): Deleted.
+            (JSC::JSPropertyNameIterator::setCachedStructure): Deleted.
+            (JSC::JSPropertyNameIterator::cachedStructure): Deleted.
+            (JSC::JSPropertyNameIterator::setCachedPrototypeChain): Deleted.
+            (JSC::JSPropertyNameIterator::cachedPrototypeChain): Deleted.
+            (JSC::JSPropertyNameIterator::finishCreation): Deleted.
+            (JSC::Register::propertyNameIterator): Deleted.
+            (JSC::StructureRareData::enumerationCache): Deleted.
+            (JSC::StructureRareData::setEnumerationCache): Deleted.
+            * runtime/Structure.cpp:
+            (JSC::Structure::addPropertyWithoutTransition):
+            (JSC::Structure::removePropertyWithoutTransition):
+            * runtime/Structure.h:
+            * runtime/StructureInlines.h:
+            (JSC::Structure::setEnumerationCache): Deleted.
+            (JSC::Structure::enumerationCache): Deleted.
+            * runtime/StructureRareData.cpp:
+            (JSC::StructureRareData::visitChildren):
+            * runtime/StructureRareData.h:
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+    
+    2014-07-25  Saam Barati  <sbarati@apple.com>
+    
+            Fix 32-bit build breakage for type profiling
+            https://bugs.webkit.org/process_bug.cgi
+    
+            Reviewed by Mark Hahnenberg.
+    
+            32-bit builds currently break because global variable IDs for high
+            fidelity type profiling are int64_t. Change this to intptr_t so that
+            it's 32 bits on 32-bit platforms and 64 bits on 64-bit platforms.
+    
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::CodeBlock):
+            (JSC::CodeBlock::scopeDependentProfile):
+            * bytecode/TypeLocation.h:
+            * runtime/SymbolTable.cpp:
+            (JSC::SymbolTable::uniqueIDForVariable):
+            (JSC::SymbolTable::uniqueIDForRegister):
+            * runtime/SymbolTable.h:
+            * runtime/TypeLocationCache.cpp:
+            (JSC::TypeLocationCache::getTypeLocation):
+            * runtime/TypeLocationCache.h:
+            * runtime/VM.h:
+            (JSC::VM::getNextUniqueVariableID):
+    
+    2014-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            Reindent PropertyNameArray.h
+            https://bugs.webkit.org/show_bug.cgi?id=135067
+    
+            Reviewed by Geoffrey Garen.
+    
+            * runtime/PropertyNameArray.h:
+            (JSC::RefCountedIdentifierSet::contains):
+            (JSC::RefCountedIdentifierSet::size):
+            (JSC::RefCountedIdentifierSet::add):
+            (JSC::PropertyNameArrayData::create):
+            (JSC::PropertyNameArrayData::propertyNameVector):
+            (JSC::PropertyNameArrayData::PropertyNameArrayData):
+            (JSC::PropertyNameArray::PropertyNameArray):
+            (JSC::PropertyNameArray::vm):
+            (JSC::PropertyNameArray::add):
+            (JSC::PropertyNameArray::addKnownUnique):
+            (JSC::PropertyNameArray::operator[]):
+            (JSC::PropertyNameArray::setData):
+            (JSC::PropertyNameArray::data):
+            (JSC::PropertyNameArray::releaseData):
+            (JSC::PropertyNameArray::identifierSet):
+            (JSC::PropertyNameArray::canAddKnownUniqueForStructure):
+            (JSC::PropertyNameArray::size):
+            (JSC::PropertyNameArray::begin):
+            (JSC::PropertyNameArray::end):
+            (JSC::PropertyNameArray::numCacheableSlots):
+            (JSC::PropertyNameArray::setNumCacheableSlotsForObject):
+            (JSC::PropertyNameArray::setBaseObject):
+            (JSC::PropertyNameArray::setPreviouslyEnumeratedLength):
+    
+    2014-07-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            Refactor our current implementation of for-in
+            https://bugs.webkit.org/show_bug.cgi?id=134142
+    
+            Reviewed by Filip Pizlo.
+    
+            This patch splits for-in loops into three distinct parts:
+    
+            - Iterating over the indexed properties in the base object.
+            - Iterating over the Structure properties in the base object.
+            - Iterating over any other enumerable properties for that object and any objects in the prototype chain.
+     
+            It does this by emitting these explicit loops in bytecode, using a new set of bytecodes to 
+            support the various operations required for each loop.
+    
+            * API/JSCallbackObjectFunctions.h:
+            (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/BytecodeList.json:
+            * bytecode/BytecodeUseDef.h:
+            (JSC::computeUsesForBytecodeOffset):
+            (JSC::computeDefsForBytecodeOffset):
+            * bytecode/CallLinkStatus.h:
+            (JSC::CallLinkStatus::CallLinkStatus):
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::dumpBytecode):
+            (JSC::CodeBlock::CodeBlock):
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::emitGetByVal):
+            (JSC::BytecodeGenerator::emitComplexPopScopes):
+            (JSC::BytecodeGenerator::emitGetEnumerableLength):
+            (JSC::BytecodeGenerator::emitHasGenericProperty):
+            (JSC::BytecodeGenerator::emitHasIndexedProperty):
+            (JSC::BytecodeGenerator::emitHasStructureProperty):
+            (JSC::BytecodeGenerator::emitGetStructurePropertyEnumerator):
+            (JSC::BytecodeGenerator::emitGetGenericPropertyEnumerator):
+            (JSC::BytecodeGenerator::emitNextEnumeratorPropertyName):
+            (JSC::BytecodeGenerator::emitToIndexString):
+            (JSC::BytecodeGenerator::pushIndexedForInScope):
+            (JSC::BytecodeGenerator::popIndexedForInScope):
+            (JSC::BytecodeGenerator::pushStructureForInScope):
+            (JSC::BytecodeGenerator::popStructureForInScope):
+            (JSC::BytecodeGenerator::invalidateForInContextForLocal):
+            * bytecompiler/BytecodeGenerator.h:
+            (JSC::ForInContext::ForInContext):
+            (JSC::ForInContext::~ForInContext):
+            (JSC::ForInContext::isValid):
+            (JSC::ForInContext::invalidate):
+            (JSC::ForInContext::local):
+            (JSC::StructureForInContext::StructureForInContext):
+            (JSC::StructureForInContext::type):
+            (JSC::StructureForInContext::index):
+            (JSC::StructureForInContext::property):
+            (JSC::StructureForInContext::enumerator):
+            (JSC::IndexedForInContext::IndexedForInContext):
+            (JSC::IndexedForInContext::type):
+            (JSC::IndexedForInContext::index):
+            (JSC::BytecodeGenerator::pushOptimisedForIn): Deleted.
+            (JSC::BytecodeGenerator::popOptimisedForIn): Deleted.
+            * bytecompiler/NodesCodegen.cpp:
+            (JSC::ReadModifyResolveNode::emitBytecode):
+            (JSC::AssignResolveNode::emitBytecode):
+            (JSC::ForInNode::tryGetBoundLocal):
+            (JSC::ForInNode::emitLoopHeader):
+            (JSC::ForInNode::emitMultiLoopBytecode):
+            (JSC::ForInNode::emitBytecode):
+            * debugger/DebuggerScope.h:
+            * dfg/DFGAbstractHeap.h:
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGCapabilities.cpp:
+            (JSC::DFG::capabilityLevel):
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            * dfg/DFGDoesGC.cpp:
+            (JSC::DFG::doesGC):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            * dfg/DFGHeapLocation.cpp:
+            (WTF::printInternal):
+            * dfg/DFGHeapLocation.h:
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::hasHeapPrediction):
+            (JSC::DFG::Node::hasArrayMode):
+            * dfg/DFGNodeType.h:
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            (JSC::DFG::PredictionPropagationPhase::propagate):
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+            * dfg/DFGSpeculativeJIT.h:
+            (JSC::DFG::SpeculativeJIT::callOperation):
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * jit/JIT.cpp:
+            (JSC::JIT::privateCompileMainPass):
+            (JSC::JIT::privateCompileSlowCases):
+            * jit/JIT.h:
+            (JSC::JIT::compileHasIndexedProperty):
+            (JSC::JIT::emitInt32Load):
+            * jit/JITInlines.h:
+            (JSC::JIT::emitDoubleGetByVal):
+            (JSC::JIT::emitLoadForArrayMode):
+            (JSC::JIT::emitContiguousGetByVal):
+            (JSC::JIT::emitArrayStorageGetByVal):
+            * jit/JITOpcodes.cpp:
+            (JSC::JIT::emit_op_get_enumerable_length):
+            (JSC::JIT::emit_op_has_structure_property):
+            (JSC::JIT::emitSlow_op_has_structure_property):
+            (JSC::JIT::emit_op_has_generic_property):
+            (JSC::JIT::privateCompileHasIndexedProperty):
+            (JSC::JIT::emit_op_has_indexed_property):
+            (JSC::JIT::emitSlow_op_has_indexed_property):
+            (JSC::JIT::emit_op_get_direct_pname):
+            (JSC::JIT::emitSlow_op_get_direct_pname):
+            (JSC::JIT::emit_op_get_structure_property_enumerator):
+            (JSC::JIT::emit_op_get_generic_property_enumerator):
+            (JSC::JIT::emit_op_next_enumerator_pname):
+            (JSC::JIT::emit_op_to_index_string):
+            * jit/JITOpcodes32_64.cpp:
+            (JSC::JIT::emit_op_get_enumerable_length):
+            (JSC::JIT::emit_op_has_structure_property):
+            (JSC::JIT::emitSlow_op_has_structure_property):
+            (JSC::JIT::emit_op_has_generic_property):
+            (JSC::JIT::privateCompileHasIndexedProperty):
+            (JSC::JIT::emit_op_has_indexed_property):
+            (JSC::JIT::emitSlow_op_has_indexed_property):
+            (JSC::JIT::emit_op_get_direct_pname):
+            (JSC::JIT::emitSlow_op_get_direct_pname):
+            (JSC::JIT::emit_op_get_structure_property_enumerator):
+            (JSC::JIT::emit_op_get_generic_property_enumerator):
+            (JSC::JIT::emit_op_next_enumerator_pname):
+            (JSC::JIT::emit_op_to_index_string):
+            * jit/JITOperations.cpp:
+            * jit/JITOperations.h:
+            * jit/JITPropertyAccess.cpp:
+            (JSC::JIT::emitDoubleLoad):
+            (JSC::JIT::emitContiguousLoad):
+            (JSC::JIT::emitArrayStorageLoad):
+            (JSC::JIT::emitDoubleGetByVal): Deleted.
+            (JSC::JIT::emitContiguousGetByVal): Deleted.
+            (JSC::JIT::emitArrayStorageGetByVal): Deleted.
+            * jit/JITPropertyAccess32_64.cpp:
+            (JSC::JIT::emitContiguousLoad):
+            (JSC::JIT::emitDoubleLoad):
+            (JSC::JIT::emitArrayStorageLoad):
+            (JSC::JIT::emitContiguousGetByVal): Deleted.
+            (JSC::JIT::emitDoubleGetByVal): Deleted.
+            (JSC::JIT::emitArrayStorageGetByVal): Deleted.
+            * llint/LowLevelInterpreter.asm:
+            * parser/Nodes.h:
+            * runtime/Arguments.cpp:
+            (JSC::Arguments::getOwnPropertyNames):
+            * runtime/ClassInfo.h:
+            * runtime/CommonSlowPaths.cpp:
+            (JSC::SLOW_PATH_DECL):
+            * runtime/CommonSlowPaths.h:
+            * runtime/EnumerationMode.h: Added.
+            (JSC::shouldIncludeDontEnumProperties):
+            (JSC::shouldExcludeDontEnumProperties):
+            (JSC::shouldIncludeJSObjectPropertyNames):
+            (JSC::modeThatSkipsJSObject):
+            * runtime/JSActivation.cpp:
+            (JSC::JSActivation::getOwnNonIndexPropertyNames):
+            * runtime/JSArray.cpp:
+            (JSC::JSArray::getOwnNonIndexPropertyNames):
+            * runtime/JSArrayBuffer.cpp:
+            (JSC::JSArrayBuffer::getOwnNonIndexPropertyNames):
+            * runtime/JSArrayBufferView.cpp:
+            (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
+            * runtime/JSCell.cpp:
+            (JSC::JSCell::getEnumerableLength):
+            (JSC::JSCell::getStructurePropertyNames):
+            (JSC::JSCell::getGenericPropertyNames):
+            * runtime/JSCell.h:
+            * runtime/JSFunction.cpp:
+            (JSC::JSFunction::getOwnNonIndexPropertyNames):
+            * runtime/JSGenericTypedArrayViewInlines.h:
+            (JSC::JSGenericTypedArrayView<Adaptor>::getOwnNonIndexPropertyNames):
+            * runtime/JSObject.cpp:
+            (JSC::getClassPropertyNames):
+            (JSC::JSObject::hasOwnProperty):
+            (JSC::JSObject::getOwnPropertyNames):
+            (JSC::JSObject::getOwnNonIndexPropertyNames):
+            (JSC::JSObject::getEnumerableLength):
+            (JSC::JSObject::getStructurePropertyNames):
+            (JSC::JSObject::getGenericPropertyNames):
+            * runtime/JSObject.h:
+            * runtime/JSPropertyNameEnumerator.cpp: Added.
+            (JSC::JSPropertyNameEnumerator::create):
+            (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
+            (JSC::JSPropertyNameEnumerator::finishCreation):
+            (JSC::JSPropertyNameEnumerator::destroy):
+            (JSC::JSPropertyNameEnumerator::visitChildren):
+            * runtime/JSPropertyNameEnumerator.h: Added.
+            (JSC::JSPropertyNameEnumerator::createStructure):
+            (JSC::JSPropertyNameEnumerator::propertyNameAtIndex):
+            (JSC::JSPropertyNameEnumerator::identifierSet):
+            (JSC::JSPropertyNameEnumerator::cachedPrototypeChain):
+            (JSC::JSPropertyNameEnumerator::setCachedPrototypeChain):
+            (JSC::JSPropertyNameEnumerator::cachedStructure):
+            (JSC::JSPropertyNameEnumerator::cachedStructureID):
+            (JSC::JSPropertyNameEnumerator::cachedInlineCapacity):
+            (JSC::JSPropertyNameEnumerator::cachedStructureIDOffset):
+            (JSC::JSPropertyNameEnumerator::cachedInlineCapacityOffset):
+            (JSC::JSPropertyNameEnumerator::cachedPropertyNamesLengthOffset):
+            (JSC::JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset):
+            (JSC::structurePropertyNameEnumerator):
+            (JSC::genericPropertyNameEnumerator):
+            * runtime/JSProxy.cpp:
+            (JSC::JSProxy::getEnumerableLength):
+            (JSC::JSProxy::getStructurePropertyNames):
+            (JSC::JSProxy::getGenericPropertyNames):
+            * runtime/JSProxy.h:
+            * runtime/JSSymbolTableObject.cpp:
+            (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+            * runtime/PropertyNameArray.cpp:
+            (JSC::PropertyNameArray::add):
+            (JSC::PropertyNameArray::setPreviouslyEnumeratedProperties):
+            * runtime/PropertyNameArray.h:
+            (JSC::RefCountedIdentifierSet::contains):
+            (JSC::RefCountedIdentifierSet::size):
+            (JSC::RefCountedIdentifierSet::add):
+            (JSC::PropertyNameArray::PropertyNameArray):
+            (JSC::PropertyNameArray::add):
+            (JSC::PropertyNameArray::addKnownUnique):
+            (JSC::PropertyNameArray::identifierSet):
+            (JSC::PropertyNameArray::canAddKnownUniqueForStructure):
+            (JSC::PropertyNameArray::setPreviouslyEnumeratedLength):
+            * runtime/RegExpObject.cpp:
+            (JSC::RegExpObject::getOwnNonIndexPropertyNames):
+            (JSC::RegExpObject::getPropertyNames):
+            (JSC::RegExpObject::getGenericPropertyNames):
+            * runtime/RegExpObject.h:
+            * runtime/StringObject.cpp:
+            (JSC::StringObject::getOwnPropertyNames):
+            * runtime/Structure.cpp:
+            (JSC::Structure::getPropertyNamesFromStructure):
+            (JSC::Structure::setCachedStructurePropertyNameEnumerator):
+            (JSC::Structure::cachedStructurePropertyNameEnumerator):
+            (JSC::Structure::setCachedGenericPropertyNameEnumerator):
+            (JSC::Structure::cachedGenericPropertyNameEnumerator):
+            (JSC::Structure::canCacheStructurePropertyNameEnumerator):
+            (JSC::Structure::canCacheGenericPropertyNameEnumerator):
+            (JSC::Structure::canAccessPropertiesQuickly):
+            * runtime/Structure.h:
+            * runtime/StructureRareData.cpp:
+            (JSC::StructureRareData::visitChildren):
+            (JSC::StructureRareData::cachedStructurePropertyNameEnumerator):
+            (JSC::StructureRareData::setCachedStructurePropertyNameEnumerator):
+            (JSC::StructureRareData::cachedGenericPropertyNameEnumerator):
+            (JSC::StructureRareData::setCachedGenericPropertyNameEnumerator):
+            * runtime/StructureRareData.h:
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+    
+    2014-07-23  Saam Barati  <sbarati@apple.com>
+    
+            Make improvements to Type Profiling
+            https://bugs.webkit.org/show_bug.cgi?id=134860
+    
+            Reviewed by Filip Pizlo.
+    
+            I improved the API between the inspector and JSC. We no longer send one huge
+            string to the inspector. We now send structured data that represents the type
+            information that JSC has collected. I've also created a beginning implementation 
+            of a type lattice that allows us to resolve a display name for a type that
+            consists of a single word.
+    
+            I created a data structure that knows which functions have executed. This
+            solves the bug where types inside an un-executed function will resolve
+            to the type of the enclosing expression of that function. This data
+            structure may also be useful later if the inspector chooses to create a UI
+            around showing which functions have executed.
+    
+            Better type information is gathered for objects. StructureShape now
+            represents an object's prototype chain.  StructureShape also collects
+            the constructor name for an object.
+    
+            Expression ranges are now zero indexed.
+    
+            Removed some extraneous methods.
+    
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::CodeBlock):
+            (JSC::CodeBlock::scopeDependentProfile):
+            * bytecode/CodeBlock.h:
+            * bytecode/TypeLocation.h:
+            (JSC::TypeLocation::TypeLocation):
+            * bytecode/UnlinkedCodeBlock.cpp:
+            (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+            * bytecode/UnlinkedCodeBlock.h:
+            (JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingStartOffset):
+            (JSC::UnlinkedFunctionExecutable::highFidelityTypeProfilingEndOffset):
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::BytecodeGenerator):
+            (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo):
+            * bytecompiler/BytecodeGenerator.h:
+            (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo): Deleted.
+            * heap/Heap.cpp:
+            (JSC::Heap::collect):
+            * inspector/agents/InspectorRuntimeAgent.cpp:
+            (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+            (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableAtOffset): Deleted.
+            * inspector/agents/InspectorRuntimeAgent.h:
+            * inspector/protocol/Runtime.json:
+            * runtime/Executable.cpp:
+            (JSC::ScriptExecutable::ScriptExecutable):
+            (JSC::ProgramExecutable::ProgramExecutable):
+            (JSC::FunctionExecutable::FunctionExecutable):
+            (JSC::ProgramExecutable::initializeGlobalProperties):
+            * runtime/Executable.h:
+            (JSC::ScriptExecutable::highFidelityTypeProfilingStartOffset):
+            (JSC::ScriptExecutable::highFidelityTypeProfilingEndOffset):
+            * runtime/FunctionHasExecutedCache.cpp: Added.
+            (JSC::FunctionHasExecutedCache::hasExecutedAtOffset):
+            (JSC::FunctionHasExecutedCache::insertUnexecutedRange):
+            (JSC::FunctionHasExecutedCache::removeUnexecutedRange):
+            * runtime/FunctionHasExecutedCache.h: Added.
+            (JSC::FunctionHasExecutedCache::FunctionRange::FunctionRange):
+            (JSC::FunctionHasExecutedCache::FunctionRange::operator==):
+            (JSC::FunctionHasExecutedCache::FunctionRange::hash):
+            * runtime/HighFidelityLog.cpp:
+            (JSC::HighFidelityLog::processHighFidelityLog):
+            (JSC::HighFidelityLog::actuallyProcessLogThreadFunction): Deleted.
+            * runtime/HighFidelityLog.h:
+            (JSC::HighFidelityLog::recordTypeInformationForLocation):
+            * runtime/HighFidelityTypeProfiler.cpp:
+            (JSC::HighFidelityTypeProfiler::logTypesForTypeLocation):
+            (JSC::HighFidelityTypeProfiler::insertNewLocation):
+            (JSC::HighFidelityTypeProfiler::getTypesForVariableAtOffsetForInspector):
+            (JSC::descriptorMatchesTypeLocation):
+            (JSC::HighFidelityTypeProfiler::findLocation):
+            (JSC::HighFidelityTypeProfiler::getTypesForVariableInAtOffset): Deleted.
+            (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableAtOffset): Deleted.
+            (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableAtOffset): Deleted.
+            * runtime/HighFidelityTypeProfiler.h:
+            (JSC::QueryKey::QueryKey):
+            (JSC::QueryKey::isHashTableDeletedValue):
+            (JSC::QueryKey::operator==):
+            (JSC::QueryKey::hash):
+            (JSC::QueryKeyHash::hash):
+            (JSC::QueryKeyHash::equal):
+            (JSC::HighFidelityTypeProfiler::functionHasExecutedCache):
+            (JSC::HighFidelityTypeProfiler::typeLocationCache):
+            * runtime/Structure.cpp:
+            (JSC::Structure::toStructureShape):
+            * runtime/Structure.h:
+            * runtime/TypeLocationCache.cpp: Added.
+            (JSC::TypeLocationCache::getTypeLocation):
+            * runtime/TypeLocationCache.h: Added.
+            (JSC::TypeLocationCache::LocationKey::LocationKey):
+            (JSC::TypeLocationCache::LocationKey::operator==):
+            (JSC::TypeLocationCache::LocationKey::hash):
+            * runtime/TypeSet.cpp:
+            (JSC::TypeSet::getRuntimeTypeForValue):
+            (JSC::TypeSet::addTypeForValue):
+            (JSC::TypeSet::seenTypes):
+            (JSC::TypeSet::doesTypeConformTo):
+            (JSC::TypeSet::displayName):
+            (JSC::TypeSet::allPrimitiveTypeNames):
+            (JSC::TypeSet::allStructureRepresentations):
+            (JSC::TypeSet::leastCommonAncestor):
+            (JSC::StructureShape::StructureShape):
+            (JSC::StructureShape::addProperty):
+            (JSC::StructureShape::propertyHash):
+            (JSC::StructureShape::leastCommonAncestor):
+            (JSC::StructureShape::stringRepresentation):
+            (JSC::StructureShape::inspectorRepresentation):
+            (JSC::StructureShape::leastUpperBound): Deleted.
+            * runtime/TypeSet.h:
+            (JSC::StructureShape::setConstructorName):
+            (JSC::StructureShape::constructorName):
+            (JSC::StructureShape::setProto):
+            * runtime/VM.cpp:
+            (JSC::VM::dumpHighFidelityProfilingTypes):
+            (JSC::VM::getTypesForVariableAtOffset): Deleted.
+            (JSC::VM::updateHighFidelityTypeProfileState): Deleted.
+            * runtime/VM.h:
+            (JSC::VM::isProfilingTypesWithHighFidelity):
+            (JSC::VM::highFidelityTypeProfiler):
+    
+    2014-07-23  Filip Pizlo  <fpizlo@apple.com>
+    
+            Fix debug build.
+    
+            * bytecode/CallLinkStatus.h:
+            (JSC::CallLinkStatus::CallLinkStatus):
+    
+    2014-07-20  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Phantoms in SSA form should be aggressively hoisted
+            https://bugs.webkit.org/show_bug.cgi?id=135111
+    
+            Reviewed by Oliver Hunt.
+            
+            In CPS form, Phantom means three things: (1) that the children should be kept alive so long
+            as they are relevant to OSR (due to a MovHint), (2) that the children are live-in-bytecode
+            at the point of the Phantom, and (3) that some checks should be performed. In SSA, the
+            second meaning is not used but the other two stay.
+            
+            The fact that a Phantom that is used to keep a node alive could be anywhere in the graph,
+            even in a totally different basic block, complicates some SSA transformations. It's not
+            possible to just jettison some successor, since tha successor could have a Phantom that we
+            care about.
+            
+            This change rationalizes how Phantoms work so that:
+            
+            1) Phantoms keep children alive so long as those children are relevant to OSR. This is true
+               in both CPS and SSA. This was true before and it's true now.
+            
+            2) Phantoms are used for live-in-bytecode only in CPS. This was true before and it's true
+               now, except that now we also don't bother preserving the live-in-bytecode information
+               that Phantoms convey, when we are in SSA.
+            
+            3) Phantoms may incidentally have checks, but in cases where we only want checks, we now
+               use Check instead of Phantom. Notably, DCE phase has dead nodes decay to Check, not
+               Phantom.
+            
+            The biggest part of this change is that in SSA, we canonicalize Phantoms:
+            
+            - All Phantoms are replaced with Check nodes that include only those edges that have
+              checks.
+            
+            - Nodes that were the children of any Phantoms have a Phantom right after them.
+            
+            For example, the following code:
+            
+                5: ArithAdd(@1, @2)
+                6: ArithSub(@5, @3)
+                7: Phantom(Int32:@5)
+            
+            would be turned into the following:
+            
+                5: ArithAdd(@1, @2)
+                8: Phantom(@5) // @5 was the child of a Phantom, so we create a new Phantom right after
+                               // @5. This is the only Phantom we will have for @5.
+                6: ArithSub(@5, @3)
+                7: Check(Int32:@5) // We replace the Phantom with a Check; in this case since Int32: is
+                                   // a checking edge, we leave it.
+            
+            This is a slight speed-up across the board, presumably because we now do a better job of
+            reducing the size of the graph during compilation. It could also be a fluke, though. The
+            main purpose of this is to unlock some other work (like CFG simplification in SSA). It will
+            become a requirement to run phantom canonicalization prior to some SSA phases. None of the
+            current phases need it, but future phases probably will.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            * dfg/DFGDCEPhase.cpp:
+            (JSC::DFG::DCEPhase::run):
+            (JSC::DFG::DCEPhase::findTypeCheckRoot):
+            (JSC::DFG::DCEPhase::countEdge):
+            (JSC::DFG::DCEPhase::fixupBlock):
+            (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
+            * dfg/DFGEdge.cpp:
+            (JSC::DFG::Edge::dump):
+            * dfg/DFGEdge.h:
+            (JSC::DFG::Edge::isProved):
+            (JSC::DFG::Edge::needsCheck): Deleted.
+            * dfg/DFGNodeFlags.h:
+            * dfg/DFGPhantomCanonicalizationPhase.cpp: Added.
+            (JSC::DFG::PhantomCanonicalizationPhase::PhantomCanonicalizationPhase):
+            (JSC::DFG::PhantomCanonicalizationPhase::run):
+            (JSC::DFG::performPhantomCanonicalization):
+            * dfg/DFGPhantomCanonicalizationPhase.h: Added.
+            * dfg/DFGPhantomRemovalPhase.cpp:
+            (JSC::DFG::PhantomRemovalPhase::run):
+            * dfg/DFGPhantomRemovalPhase.h:
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+            (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+    
+    2014-07-22  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Get rid of structure checks as a way of checking if a function is in fact a function
+            https://bugs.webkit.org/show_bug.cgi?id=135146
+    
+            Reviewed by Oliver Hunt.
+            
+            This greatly simplifies our closure call optimizations by taking advantage of the type
+            bits available in the cell header.
+    
+            * bytecode/CallLinkInfo.cpp:
+            (JSC::CallLinkInfo::visitWeak):
+            * bytecode/CallLinkStatus.cpp:
+            (JSC::CallLinkStatus::CallLinkStatus):
+            (JSC::CallLinkStatus::computeFor):
+            (JSC::CallLinkStatus::dump):
+            * bytecode/CallLinkStatus.h:
+            (JSC::CallLinkStatus::CallLinkStatus):
+            (JSC::CallLinkStatus::executable):
+            (JSC::CallLinkStatus::structure): Deleted.
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            (JSC::DFG::FixupPhase::observeUseKindOnNode):
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::SafeToExecuteEdge::operator()):
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::checkArray):
+            (JSC::DFG::SpeculativeJIT::speculateCellTypeWithoutTypeFiltering):
+            (JSC::DFG::SpeculativeJIT::speculateCellType):
+            (JSC::DFG::SpeculativeJIT::speculateFunction):
+            (JSC::DFG::SpeculativeJIT::speculateFinalObject):
+            (JSC::DFG::SpeculativeJIT::speculate):
+            * dfg/DFGSpeculativeJIT.h:
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGUseKind.cpp:
+            (WTF::printInternal):
+            * dfg/DFGUseKind.h:
+            (JSC::DFG::typeFilterFor):
+            (JSC::DFG::isCell):
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileCheckExecutable):
+            (JSC::FTL::LowerDFGToLLVM::speculate):
+            (JSC::FTL::LowerDFGToLLVM::isFunction):
+            (JSC::FTL::LowerDFGToLLVM::isNotFunction):
+            (JSC::FTL::LowerDFGToLLVM::speculateFunction):
+            * jit/ClosureCallStubRoutine.cpp:
+            (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
+            (JSC::ClosureCallStubRoutine::markRequiredObjectsInternal):
+            * jit/ClosureCallStubRoutine.h:
+            (JSC::ClosureCallStubRoutine::structure): Deleted.
+            * jit/JIT.h:
+            (JSC::JIT::compileClosureCall): Deleted.
+            * jit/JITCall.cpp:
+            (JSC::JIT::privateCompileClosureCall): Deleted.
+            * jit/JITCall32_64.cpp:
+            (JSC::JIT::privateCompileClosureCall): Deleted.
+            * jit/JITOperations.cpp:
+            * jit/Repatch.cpp:
+            (JSC::linkClosureCall):
+            * jit/Repatch.h:
+    
+2014-08-06  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        [ARM] Incorrect handling of Unicode characters
+        https://bugs.webkit.org/show_bug.cgi?id=135380
+
+        Reviewed by Darin Adler.
+
+        Removed erroneous fast case from stringFromUTF(), since it assumed that 
+        char is always implemented as signed.
+
+        * jsc.cpp:
+        (stringFromUTF):
+
+2014-08-06  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        [JSC] Build fix for FTL on EFL after ftlopt merge
+        https://bugs.webkit.org/show_bug.cgi?id=135565
+
+        Reviewed by Mark Lam.
+
+        Adding an enable guard for native inlining, since it now requires the bitcode
+        emitted from Clang, and we don't have a good way of creating it from other compilers.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * ftl/FTLState.h:
+
+2014-08-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        URTBF after r172129. (ftlopt branch merge)
+
+        Remove the duplicated friend declaration to fix this build failure:
+        "error: ‘JSC::Structure’ is already a friend of ‘JSC::StructureRareData’ [-Werror]"
+
+        * runtime/StructureRareData.h:
+
+2014-08-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix CMake-based builds, part 3.
+
+        * CMakeLists.txt:
+
+2014-08-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix CMake-based builds, part 2.
+
+        * CMakeLists.txt:
+
+2014-08-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix Windows build, part 2.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+
+2014-08-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix CMake-based builds.
+
+        * CMakeLists.txt:
+
+2014-08-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix Windows build.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+
+2014-08-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix cloop build.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+
+2014-07-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge r170564, r170571, r170604, r170628, r170672, r170680, r170724, r170728, r170729, r170819, r170821, r170836, r170855, r170860, r170890, r170907, r170929, r171052, r171106, r171152, r171153, r171214 from ftlopt.
+
+        This part of the merge delivers roughly a 2% across-the-board performance
+        improvement, mostly due to immutable property inference and DFG-side GCSE. It also
+        almost completely resolves accessor performance issues; in the common case the DFG
+        will compile a getter/setter access into code that is just as efficient as a normal
+        property access.
+        
+        Another major highlight of this part of the merge is the work to add a type profiler
+        to the inspector. This work is still on-going but this greatly increases coverage.
+
+        Note that this merge fixes a minor bug in the GetterSetter refactoring from
+        http://trac.webkit.org/changeset/170729 (https://bugs.webkit.org/show_bug.cgi?id=134518).
+        It also adds a new tests to tests/stress to cover that bug. That bug was previously only
+        covered by layout tests.
+
+    2014-07-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG Flush(SetLocal) store elimination is overzealous for captured variables in the presence of nodes that have no effects but may throw (merge trunk r171190)
+            https://bugs.webkit.org/show_bug.cgi?id=135019
+    
+            Reviewed by Oliver Hunt.
+            
+            Behaviorally, this is just a merge of trunk r171190, except that the relevant functionality
+            has moved to StrengthReductionPhase and is written in a different style. Same algorithm,
+            different code.
+    
+            * dfg/DFGNodeType.h:
+            * dfg/DFGStrengthReductionPhase.cpp:
+            (JSC::DFG::StrengthReductionPhase::handleNode):
+            * tests/stress/capture-escape-and-throw.js: Added.
+            (foo.f):
+            (foo):
+            * tests/stress/new-array-with-size-throw-exception-and-tear-off-arguments.js: Added.
+            (foo):
+            (bar):
+    
+    2014-07-15  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Constant fold GetGetter and GetSetter if the GetterSetter is a constant
+            https://bugs.webkit.org/show_bug.cgi?id=134962
+    
+            Reviewed by Oliver Hunt.
+            
+            This removes yet another steady-state-throughput implication of using getters and setters:
+            if your accessor call is monomorphic then you'll just get a structure check, nothing more.
+            No more loads to get to the GetterSetter object or the accessor function object.
+    
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * runtime/GetterSetter.h:
+            (JSC::GetterSetter::getterConcurrently):
+            (JSC::GetterSetter::setGetter):
+            (JSC::GetterSetter::setterConcurrently):
+            (JSC::GetterSetter::setSetter):
+    
+    2014-07-15  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Identity replacement in CSE shouldn't create a Phantom over the Identity's children
+            https://bugs.webkit.org/show_bug.cgi?id=134893
+    
+            Reviewed by Oliver Hunt.
+            
+            Replace Identity with Check instead of Phantom. Phantom means that the child of the
+            Identity should be unconditionally live. The liveness semantics of Identity are such that
+            if the parents of Identity are live then the child is live. Removing the Identity entirely
+            preserves such liveness semantics. So, the only thing that should be left behind is the
+            type check on the child, which is what Check means: do the check but don't keep the child
+            alive if the check isn't needed.
+    
+            * dfg/DFGCSEPhase.cpp:
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::convertToCheck):
+    
+    2014-07-13  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG should be able to do GCSE in SSA and this should be unified with the CSE in CPS, and both of these things should use abstract heaps for reasoning about effects
+            https://bugs.webkit.org/show_bug.cgi?id=134677
+    
+            Reviewed by Sam Weinig.
+            
+            This removes the old local CSE phase, which was based on manually written backward-search 
+            rules for all of the different kinds of things we cared about, and adds a new local/global
+            CSE (local for CPS and global for SSA) that leaves the node semantics almost entirely up to
+            clobberize(). Thus, the CSE phase itself just worries about the algorithms and data
+            structures used for storing sets of available values. This results in a large reduction in
+            code size in CSEPhase.cpp while greatly increasing the phase's power (since it now does
+            global CSE) and reducing compile time (since local CSE is now rewritten to use smarter data
+            structures). Even though LLVM was already running GVN, the extra GCSE at DFG IR level means
+            that this is a significant (~0.7%) throughput improvement.
+            
+            This work is based on the concept of "def" to clobberize(). If clobberize() calls def(), it
+            means that the node being analyzed makes available some value in some DFG node, and that
+            future attempts to compute that value can simply use that node. In other words, it
+            establishes an available value mapping of the form value=>node. There are two kinds of
+            values that can be passed to def():
+            
+            PureValue. This captures everything needed to determine whether two pure nodes - nodes that
+                neither read nor write, and produce a value that is a CSE candidate - are identical. It
+                carries the NodeType, an AdjacencyList, and one word of meta-data. The meta-data is
+                usually used for things like the arithmetic mode or constant pointer. Passing a
+                PureValue to def() means that the node produces a value that is valid anywhere that the
+                node dominates.
+            
+            HeapLocation. This describes a location in the heap that could be written to or read from.
+                Both stores and loads can def() a HeapLocation. HeapLocation carries around an abstract
+                heap that both serves as part of the "name" of the heap location (together with the
+                other fields of HeapLocation) and also tells us what write()'s to watch for. If someone
+                write()'s to an abstract heap that overlaps the heap associated with the HeapLocation,
+                then it means that the values for that location are no longer available.
+            
+            This approach is sufficiently clever that the CSEPhase itself can focus on the mechanism of
+            tracking the PureValue=>node and HeapLocation=>node maps, without having to worry about
+            interpreting the semantics of different DFG node types - that is now almost entirely in
+            clobberize(). The only things we special-case inside CSEPhase are the Identity node, which
+            CSE is traditionally responsible for eliminating even though it has nothing to do with CSE,
+            and the LocalCSE rule for turning PutByVal into PutByValAlias.
+            
+            This is a slight Octane, SunSpider, and Kraken speed-up - all somewhere arond 0.7% . It's
+            not a bigger win because LLVM was already giving us most of what we needed in its GVN.
+            Also, the SunSpider speed-up isn't from GCSE as much as it's a clean-up of local CSE - that
+            is no longer O(n^2). Basically this is purely good: it reduces the amount of LLVM IR we
+            generate, it removes the old CSE's heap modeling (which was a constant source of bugs), and
+            it improves both the quality of the code we generate and the speed with which we generate
+            it. Also, any future optimizations that depend on GCSE will now be easier to implement.
+            
+            During the development of this patch I also rationalized some other stuff, like Graph's
+            ordered traversals - we now have preorder and postorder rather than just "depth first".
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * dfg/DFGAbstractHeap.h:
+            * dfg/DFGAdjacencyList.h:
+            (JSC::DFG::AdjacencyList::hash):
+            (JSC::DFG::AdjacencyList::operator==):
+            * dfg/DFGBasicBlock.h:
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::performLocalCSE):
+            (JSC::DFG::performGlobalCSE):
+            (JSC::DFG::CSEPhase::CSEPhase): Deleted.
+            (JSC::DFG::CSEPhase::run): Deleted.
+            (JSC::DFG::CSEPhase::endIndexForPureCSE): Deleted.
+            (JSC::DFG::CSEPhase::pureCSE): Deleted.
+            (JSC::DFG::CSEPhase::constantCSE): Deleted.
+            (JSC::DFG::CSEPhase::constantStoragePointerCSE): Deleted.
+            (JSC::DFG::CSEPhase::getCalleeLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::getArrayLengthElimination): Deleted.
+            (JSC::DFG::CSEPhase::globalVarLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::scopedVarLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::varInjectionWatchpointElimination): Deleted.
+            (JSC::DFG::CSEPhase::getByValLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::checkFunctionElimination): Deleted.
+            (JSC::DFG::CSEPhase::checkExecutableElimination): Deleted.
+            (JSC::DFG::CSEPhase::checkStructureElimination): Deleted.
+            (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): Deleted.
+            (JSC::DFG::CSEPhase::getByOffsetLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::getGetterSetterByOffsetLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::checkArrayElimination): Deleted.
+            (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::getInternalFieldLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::getMyScopeLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::getLocalLoadElimination): Deleted.
+            (JSC::DFG::CSEPhase::invalidationPointElimination): Deleted.
+            (JSC::DFG::CSEPhase::setReplacement): Deleted.
+            (JSC::DFG::CSEPhase::eliminate): Deleted.
+            (JSC::DFG::CSEPhase::performNodeCSE): Deleted.
+            (JSC::DFG::CSEPhase::performBlockCSE): Deleted.
+            (JSC::DFG::performCSE): Deleted.
+            * dfg/DFGCSEPhase.h:
+            * dfg/DFGClobberSet.cpp:
+            (JSC::DFG::addReads):
+            (JSC::DFG::addWrites):
+            (JSC::DFG::addReadsAndWrites):
+            (JSC::DFG::readsOverlap):
+            (JSC::DFG::writesOverlap):
+            * dfg/DFGClobberize.cpp:
+            (JSC::DFG::doesWrites):
+            (JSC::DFG::accessesOverlap):
+            (JSC::DFG::writesOverlap):
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            (JSC::DFG::NoOpClobberize::operator()):
+            (JSC::DFG::CheckClobberize::operator()):
+            (JSC::DFG::ReadMethodClobberize::ReadMethodClobberize):
+            (JSC::DFG::ReadMethodClobberize::operator()):
+            (JSC::DFG::WriteMethodClobberize::WriteMethodClobberize):
+            (JSC::DFG::WriteMethodClobberize::operator()):
+            (JSC::DFG::DefMethodClobberize::DefMethodClobberize):
+            (JSC::DFG::DefMethodClobberize::operator()):
+            * dfg/DFGDCEPhase.cpp:
+            (JSC::DFG::DCEPhase::run):
+            (JSC::DFG::DCEPhase::fixupBlock):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::getBlocksInPreOrder):
+            (JSC::DFG::Graph::getBlocksInPostOrder):
+            (JSC::DFG::Graph::addForDepthFirstSort): Deleted.
+            (JSC::DFG::Graph::getBlocksInDepthFirstOrder): Deleted.
+            * dfg/DFGGraph.h:
+            * dfg/DFGHeapLocation.cpp: Added.
+            (JSC::DFG::HeapLocation::dump):
+            (WTF::printInternal):
+            * dfg/DFGHeapLocation.h: Added.
+            (JSC::DFG::HeapLocation::HeapLocation):
+            (JSC::DFG::HeapLocation::operator!):
+            (JSC::DFG::HeapLocation::kind):
+            (JSC::DFG::HeapLocation::heap):
+            (JSC::DFG::HeapLocation::base):
+            (JSC::DFG::HeapLocation::index):
+            (JSC::DFG::HeapLocation::hash):
+            (JSC::DFG::HeapLocation::operator==):
+            (JSC::DFG::HeapLocation::isHashTableDeletedValue):
+            (JSC::DFG::HeapLocationHash::hash):
+            (JSC::DFG::HeapLocationHash::equal):
+            * dfg/DFGLICMPhase.cpp:
+            (JSC::DFG::LICMPhase::run):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::replaceWith):
+            (JSC::DFG::Node::convertToPhantomUnchecked): Deleted.
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl):
+            * dfg/DFGPureValue.cpp: Added.
+            (JSC::DFG::PureValue::dump):
+            * dfg/DFGPureValue.h: Added.
+            (JSC::DFG::PureValue::PureValue):
+            (JSC::DFG::PureValue::operator!):
+            (JSC::DFG::PureValue::op):
+            (JSC::DFG::PureValue::children):
+            (JSC::DFG::PureValue::info):
+            (JSC::DFG::PureValue::hash):
+            (JSC::DFG::PureValue::operator==):
+            (JSC::DFG::PureValue::isHashTableDeletedValue):
+            (JSC::DFG::PureValueHash::hash):
+            (JSC::DFG::PureValueHash::equal):
+            * dfg/DFGSSAConversionPhase.cpp:
+            (JSC::DFG::SSAConversionPhase::run):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::lower):
+    
+    2014-07-13  Filip Pizlo  <fpizlo@apple.com>
+    
+            Unreviewed, revert unintended change in r171051.
+    
+            * dfg/DFGCSEPhase.cpp:
+    
+    2014-07-08  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Move Flush(SetLocal) store elimination to StrengthReductionPhase
+            https://bugs.webkit.org/show_bug.cgi?id=134739
+    
+            Reviewed by Mark Hahnenberg.
+            
+            I'm going to streamline CSE around clobberize() as part of
+            https://bugs.webkit.org/show_bug.cgi?id=134677, and so Flush(SetLocal) store
+            elimination wouldn't belong in CSE anymore. It doesn't quite belong anywhere, which
+            means that it belongs in StrengthReductionPhase, since that's intended to be our
+            dumping ground.
+            
+            To do this I had to add some missing smarts to clobberize(). Previously clobberize()
+            could play a bit loose with reads of Variables because it wasn't used for store
+            elimination. The main client of read() was LICM, but it would only use it to
+            determine hoistability and anything that did a write() was not hoistable - so, we had
+            benign (but still wrong) missing read() calls in places that did write()s. This fixes
+            a bunch of those cases.
+    
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::CSEPhase::performNodeCSE):
+            (JSC::DFG::CSEPhase::setLocalStoreElimination): Deleted.
+            * dfg/DFGClobberize.cpp:
+            (JSC::DFG::accessesOverlap):
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize): Make clobberize() smart enough for detecting when this store elimination would be sound.
+            * dfg/DFGStrengthReductionPhase.cpp:
+            (JSC::DFG::StrengthReductionPhase::handleNode): Implement the store elimination in terms of clobberize().
+    
+    2014-07-08  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Phantom simplification should be in its own phase
+            https://bugs.webkit.org/show_bug.cgi?id=134742
+    
+            Reviewed by Geoffrey Garen.
+            
+            This moves Phantom simplification out of CSE, which greatly simplifies CSE and gives it
+            more focus. Also this finally adds a phase that removes empty Phantoms. We sort of had
+            this in CPSRethreading, but that phase runs too infrequently and doesn't run at all for
+            SSA.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * dfg/DFGAdjacencyList.h:
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::CSEPhase::run):
+            (JSC::DFG::CSEPhase::setReplacement):
+            (JSC::DFG::CSEPhase::eliminate):
+            (JSC::DFG::CSEPhase::performNodeCSE):
+            (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren): Deleted.
+            * dfg/DFGPhantomRemovalPhase.cpp: Added.
+            (JSC::DFG::PhantomRemovalPhase::PhantomRemovalPhase):
+            (JSC::DFG::PhantomRemovalPhase::run):
+            (JSC::DFG::performCleanUp):
+            * dfg/DFGPhantomRemovalPhase.h: Added.
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl):
+    
+    2014-07-08  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Get rid of Node::misc by moving the fields out of the union so that you can use replacement and owner simultaneously
+            https://bugs.webkit.org/show_bug.cgi?id=134730
+    
+            Reviewed by Mark Lam.
+            
+            This will allow for a better GCSE implementation.
+    
+            * dfg/DFGCPSRethreadingPhase.cpp:
+            (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::CSEPhase::setReplacement):
+            * dfg/DFGEdgeDominates.h:
+            (JSC::DFG::EdgeDominates::operator()):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::clearReplacements):
+            (JSC::DFG::Graph::initializeNodeOwners):
+            * dfg/DFGGraph.h:
+            (JSC::DFG::Graph::performSubstitutionForEdge):
+            * dfg/DFGLICMPhase.cpp:
+            (JSC::DFG::LICMPhase::attemptHoist):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::Node):
+            * dfg/DFGSSAConversionPhase.cpp:
+            (JSC::DFG::SSAConversionPhase::run):
+    
+    2014-07-04  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Infer immutable object properties
+            https://bugs.webkit.org/show_bug.cgi?id=134567
+    
+            Reviewed by Mark Hahnenberg.
+            
+            This introduces a new way of inferring immutable object properties. A property is said to
+            be immutable if after its creation (i.e. the transition that creates it), we never
+            overwrite it (i.e. replace it) or delete it. Immutability is a property of an "own
+            property" - so if we say that "f" is immutable at "o" then we are implying that "o" has "f"
+            directly and not on a prototype. More specifically, the immutability inference will prove
+            that a property on some structure is immutable. This means that, for example, we may have a
+            structure S1 with property "f" where we claim that "f" at S1 is immutable, but S1 has a
+            transition to S2 that adds a new property "g" and we may claim that "f" at S2 is actually
+            mutable. This is mainly for convenience; it allows us to decouple immutability logic from
+            transition logic. Immutability can be used to constant-fold accesses to objects at
+            DFG-time. The DFG needs to prove the following to constant-fold the access:
+            
+            - The base of the access must be a constant object pointer. We prove that a property at a
+              structure is immutable, but that says nothing of its value; each actual instance of that
+              property may have a different value. So, a constant object pointer is needed to get an
+              actual constant instance of the immutable value.
+            
+            - A check (or watchpoint) must have been emitted proving that the object has a structure
+              that allows loading the property in question.
+            
+            - The replacement watchpoint set of the property in the structure that we've proven the
+              object to have is still valid and we add a watchpoint to it lazily. The replacement
+              watchpoint set is the key new mechanism that this change adds. It's possible that we have
+              proven that the object has one of many structures, in which case each of those structures
+              needs a valid replacement watchpoint set.
+            
+            The replacement watchpoint set is created the first time that any access to the property is
+            cached. A put replace cache will create, and immediately invalidate, the watchpoint set. A
+            get cache will create the watchpoint set and make it start watching. Any non-cached put
+            access will invalidate the watchpoint set if one had been created; the underlying algorithm
+            ensures that checking for the existence of a replacement watchpoint set is very fast in the
+            common case. This algorithm ensures that no cached access needs to ever do any work to
+            invalidate, or check the validity of, any replacement watchpoint sets. It also has some
+            other nice properties:
+            
+            - It's very robust in its definition of immutability. The strictest that it will ever be is
+              that for any instance of the object, the property must be written to only once,
+              specifically at the time that the property is created. But it's looser than this in
+              practice. For example, the property may be written to any number of times before we add
+              the final property that the object will have before anyone reads the property; this works
+              since for optimization purposes we only care if we detect immutability on the structure
+              that the object will have when it is most frequently read from, not any previous
+              structure that the object had. Also, we may write to the property any number of times
+              before anyone caches accesses to it.
+            
+            - It is mostly orthogonal to structure transitions. No new structures need to be created to
+              track the immutability of a property. Hence, there is no risk from this feature causing
+              more polymorphism. This is different from the previous "specificValue" constant
+              inference, which did cause additional structures to be created and sometimes those
+              structures led to fake polymorphism. This feature does leverage existing transitions to
+              do some of the watchpointing: property deletions don't fire the replacement watchpoint
+              set because that would cause a new structure and so the mandatory structure check would
+              fail. Also, this feature is guaranteed to never kick in for uncacheable dictionaries
+              because those wouldn't allow for cacheable accesses - and it takes a cacheable access for
+              this feature to be enabled.
+            
+            - No memory overhead is incurred except when accesses to the property are cached.
+              Dictionary properties will typically have no meta-data for immutability. The number of
+              replacement watchpoint sets we allocate is proportional to the number of inline caches in
+              the program, which is typically must smaller than the number of structures or even the
+              number of objects.
+            
+            This inference is far more powerful than the previous "specificValue" inference, so this
+            change also removes all of that code. It's interesting that the amount of code that is
+            changed to remove that feature is almost as big as the amount of code added to support the
+            new inference - and that's if you include the new tests in the tally. Without new tests,
+            it appears that the new feature actually touches less code!
+            
+            There is one corner case where the previous "specificValue" inference was more powerful.
+            You can imagine someone creating objects with functions as self properties on those
+            objects, such that each object instance had the same function pointers - essentially,
+            someone might be trying to create a vtable but failing at the whole "one vtable for many
+            instances" concept. The "specificValue" inference would do very well for such programs,
+            because a structure check would be sufficient to prove a constant value for all of the
+            function properties. This new inference will fail because it doesn't track the constant
+            values of constant properties; instead it detects the immutability of otherwise variable
+            properties (in the sense that each instance of the property may have a different value).
+            So, the new inference requires having a particular object instance to actually get the
+            constant value. I think it's OK to lose this antifeature. It took a lot of code to support
+            and was a constant source of grief in our transition logic, and there doesn't appear to be
+            any real evidence that programs benefited from that particular kind of inference since
+            usually it's the singleton prototype instance that has all of the functions.
+            
+            This change is a speed-up on everything. date-format-xparb and both SunSpider/raytrace and
+            V8/raytrace seem to be the biggest winners among the macrobenchmarks; they see >5%
+            speed-ups. Many of our microbenchmarks see very large performance improvements, even 80% in
+            one case.
+    
+            * bytecode/ComplexGetStatus.cpp:
+            (JSC::ComplexGetStatus::computeFor):
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::computeFromLLInt):
+            (JSC::GetByIdStatus::computeForStubInfo):
+            (JSC::GetByIdStatus::computeFor):
+            * bytecode/GetByIdVariant.cpp:
+            (JSC::GetByIdVariant::GetByIdVariant):
+            (JSC::GetByIdVariant::operator=):
+            (JSC::GetByIdVariant::attemptToMerge):
+            (JSC::GetByIdVariant::dumpInContext):
+            * bytecode/GetByIdVariant.h:
+            (JSC::GetByIdVariant::alternateBase):
+            (JSC::GetByIdVariant::specificValue): Deleted.
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::computeForStubInfo):
+            (JSC::PutByIdStatus::computeFor):
+            * bytecode/PutByIdVariant.cpp:
+            (JSC::PutByIdVariant::operator=):
+            (JSC::PutByIdVariant::setter):
+            (JSC::PutByIdVariant::dumpInContext):
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::specificValue): Deleted.
+            * bytecode/Watchpoint.cpp:
+            (JSC::WatchpointSet::fireAllSlow):
+            (JSC::WatchpointSet::fireAll): Deleted.
+            * bytecode/Watchpoint.h:
+            (JSC::WatchpointSet::fireAll):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handleGetByOffset):
+            (JSC::DFG::ByteCodeParser::handleGetById):
+            (JSC::DFG::ByteCodeParser::handlePutById):
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+            (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::tryGetConstantProperty):
+            (JSC::DFG::Graph::visitChildren):
+            * dfg/DFGGraph.h:
+            * dfg/DFGWatchableStructureWatchingPhase.cpp:
+            (JSC::DFG::WatchableStructureWatchingPhase::run):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+            * jit/JITOperations.cpp:
+            * jit/Repatch.cpp:
+            (JSC::repatchByIdSelfAccess):
+            (JSC::generateByIdStub):
+            (JSC::tryCacheGetByID):
+            (JSC::tryCachePutByID):
+            (JSC::tryBuildPutByIdList):
+            * llint/LLIntSlowPaths.cpp:
+            (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+            (JSC::LLInt::putToScopeCommon):
+            * runtime/CommonSlowPaths.h:
+            (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+            * runtime/IntendedStructureChain.cpp:
+            (JSC::IntendedStructureChain::mayInterceptStoreTo):
+            * runtime/JSCJSValue.cpp:
+            (JSC::JSValue::putToPrimitive):
+            * runtime/JSGlobalObject.cpp:
+            (JSC::JSGlobalObject::reset):
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::put):
+            (JSC::JSObject::putDirectNonIndexAccessor):
+            (JSC::JSObject::deleteProperty):
+            (JSC::JSObject::defaultValue):
+            (JSC::getCallableObjectSlow): Deleted.
+            (JSC::JSObject::getPropertySpecificValue): Deleted.
+            * runtime/JSObject.h:
+            (JSC::JSObject::getDirect):
+            (JSC::JSObject::getDirectOffset):
+            (JSC::JSObject::inlineGetOwnPropertySlot):
+            (JSC::JSObject::putDirectInternal):
+            (JSC::JSObject::putOwnDataProperty):
+            (JSC::JSObject::putDirect):
+            (JSC::JSObject::putDirectWithoutTransition):
+            (JSC::getCallableObject): Deleted.
+            * runtime/JSScope.cpp:
+            (JSC::abstractAccess):
+            * runtime/PropertyMapHashTable.h:
+            (JSC::PropertyMapEntry::PropertyMapEntry):
+            (JSC::PropertyTable::copy):
+            * runtime/PropertyTable.cpp:
+            (JSC::PropertyTable::clone):
+            (JSC::PropertyTable::PropertyTable):
+            (JSC::PropertyTable::visitChildren): Deleted.
+            * runtime/Structure.cpp:
+            (JSC::Structure::Structure):
+            (JSC::Structure::materializePropertyMap):
+            (JSC::Structure::addPropertyTransitionToExistingStructureImpl):
+            (JSC::Structure::addPropertyTransitionToExistingStructure):
+            (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
+            (JSC::Structure::addPropertyTransition):
+            (JSC::Structure::changePrototypeTransition):
+            (JSC::Structure::attributeChangeTransition):
+            (JSC::Structure::toDictionaryTransition):
+            (JSC::Structure::preventExtensionsTransition):
+            (JSC::Structure::takePropertyTableOrCloneIfPinned):
+            (JSC::Structure::nonPropertyTransition):
+            (JSC::Structure::addPropertyWithoutTransition):
+            (JSC::Structure::allocateRareData):
+            (JSC::Structure::ensurePropertyReplacementWatchpointSet):
+            (JSC::Structure::startWatchingPropertyForReplacements):
+            (JSC::Structure::didCachePropertyReplacement):
+            (JSC::Structure::startWatchingInternalProperties):
+            (JSC::Structure::copyPropertyTable):
+            (JSC::Structure::copyPropertyTableForPinning):
+            (JSC::Structure::getConcurrently):
+            (JSC::Structure::get):
+            (JSC::Structure::add):
+            (JSC::Structure::visitChildren):
+            (JSC::Structure::prototypeChainMayInterceptStoreTo):
+            (JSC::Structure::dump):
+            (JSC::Structure::despecifyDictionaryFunction): Deleted.
+            (JSC::Structure::despecifyFunctionTransition): Deleted.
+            (JSC::Structure::despecifyFunction): Deleted.
+            (JSC::Structure::despecifyAllFunctions): Deleted.
+            (JSC::Structure::putSpecificValue): Deleted.
+            * runtime/Structure.h:
+            (JSC::Structure::startWatchingPropertyForReplacements):
+            (JSC::Structure::startWatchingInternalPropertiesIfNecessary):
+            (JSC::Structure::startWatchingInternalPropertiesIfNecessaryForEntireChain):
+            (JSC::Structure::transitionDidInvolveSpecificValue): Deleted.
+            (JSC::Structure::disableSpecificFunctionTracking): Deleted.
+            * runtime/StructureInlines.h:
+            (JSC::Structure::getConcurrently):
+            (JSC::Structure::didReplaceProperty):
+            (JSC::Structure::propertyReplacementWatchpointSet):
+            * runtime/StructureRareData.cpp:
+            (JSC::StructureRareData::destroy):
+            * runtime/StructureRareData.h:
+            * tests/stress/infer-constant-global-property.js: Added.
+            (foo.Math.sin):
+            (foo):
+            * tests/stress/infer-constant-property.js: Added.
+            (foo):
+            * tests/stress/jit-cache-poly-replace-then-cache-get-and-fold-then-invalidate.js: Added.
+            (foo):
+            (bar):
+            * tests/stress/jit-cache-replace-then-cache-get-and-fold-then-invalidate.js: Added.
+            (foo):
+            (bar):
+            * tests/stress/jit-put-to-scope-global-cache-watchpoint-invalidate.js: Added.
+            (foo):
+            (bar):
+            * tests/stress/llint-cache-replace-then-cache-get-and-fold-then-invalidate.js: Added.
+            (foo):
+            (bar):
+            * tests/stress/llint-put-to-scope-global-cache-watchpoint-invalidate.js: Added.
+            (foo):
+            (bar):
+            * tests/stress/repeat-put-to-scope-global-with-same-value-watchpoint-invalidate.js: Added.
+            (foo):
+            (bar):
+    
+    2014-07-03  Saam Barati  <sbarati@apple.com>
+    
+            Add more coverage for the profile_types_with_high_fidelity op code.
+            https://bugs.webkit.org/show_bug.cgi?id=134616
+    
+            Reviewed by Filip Pizlo.
+    
+            More operations are now being recorded by the profile_types_with_high_fidelity 
+            opcode. Specifically: function parameters, function return values,
+            function 'this' value, get_by_id, get_by_value, resolve nodes, function return 
+            values at the call site. Added more flags to the profile_types_with_high_fidelity
+            opcode so more focused tasks can take place when the instruction is
+            being linked in CodeBlock. Re-worked the type profiler to search 
+            through character offset ranges when asked for the type of an expression
+            at a given offset. Removed redundant calls to Structure::toStructureShape
+            in HighFidelityLog and TypeSet by caching calls based on StructureID.
+    
+            * bytecode/BytecodeList.json:
+            * bytecode/BytecodeUseDef.h:
+            (JSC::computeUsesForBytecodeOffset):
+            (JSC::computeDefsForBytecodeOffset):
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::CodeBlock):
+            (JSC::CodeBlock::finalizeUnconditionally):
+            (JSC::CodeBlock::scopeDependentProfile):
+            * bytecode/CodeBlock.h:
+            (JSC::CodeBlock::returnStatementTypeSet):
+            * bytecode/TypeLocation.h:
+            * bytecode/UnlinkedCodeBlock.cpp:
+            (JSC::UnlinkedCodeBlock::highFidelityTypeProfileExpressionInfoForBytecodeOffset):
+            (JSC::UnlinkedCodeBlock::addHighFidelityTypeProfileExpressionInfo):
+            * bytecode/UnlinkedCodeBlock.h:
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::emitMove):
+            (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
+            (JSC::BytecodeGenerator::emitGetFromScopeWithProfile):
+            (JSC::BytecodeGenerator::emitPutToScope):
+            (JSC::BytecodeGenerator::emitPutToScopeWithProfile):
+            (JSC::BytecodeGenerator::emitPutById):
+            (JSC::BytecodeGenerator::emitPutByVal):
+            * bytecompiler/BytecodeGenerator.h:
+            (JSC::BytecodeGenerator::emitHighFidelityTypeProfilingExpressionInfo):
+            * bytecompiler/NodesCodegen.cpp:
+            (JSC::ResolveNode::emitBytecode):
+            (JSC::BracketAccessorNode::emitBytecode):
+            (JSC::DotAccessorNode::emitBytecode):
+            (JSC::FunctionCallValueNode::emitBytecode):
+            (JSC::FunctionCallResolveNode::emitBytecode):
+            (JSC::FunctionCallBracketNode::emitBytecode):
+            (JSC::FunctionCallDotNode::emitBytecode):
+            (JSC::CallFunctionCallDotNode::emitBytecode):
+            (JSC::ApplyFunctionCallDotNode::emitBytecode):
+            (JSC::PostfixNode::emitResolve):
+            (JSC::PostfixNode::emitBracket):
+            (JSC::PostfixNode::emitDot):
+            (JSC::PrefixNode::emitResolve):
+            (JSC::PrefixNode::emitBracket):
+            (JSC::PrefixNode::emitDot):
+            (JSC::ReadModifyResolveNode::emitBytecode):
+            (JSC::AssignResolveNode::emitBytecode):
+            (JSC::AssignDotNode::emitBytecode):
+            (JSC::ReadModifyDotNode::emitBytecode):
+            (JSC::AssignBracketNode::emitBytecode):
+            (JSC::ReadModifyBracketNode::emitBytecode):
+            (JSC::ReturnNode::emitBytecode):
+            (JSC::FunctionBodyNode::emitBytecode):
+            * inspector/agents/InspectorRuntimeAgent.cpp:
+            (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableAtOffset):
+            (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
+            * inspector/agents/InspectorRuntimeAgent.h:
+            * inspector/protocol/Runtime.json:
+            * llint/LLIntSlowPaths.cpp:
+            (JSC::LLInt::getFromScopeCommon):
+            (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+            * llint/LLIntSlowPaths.h:
+            * llint/LowLevelInterpreter.asm:
+            * runtime/HighFidelityLog.cpp:
+            (JSC::HighFidelityLog::processHighFidelityLog):
+            (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
+            (JSC::HighFidelityLog::recordTypeInformationForLocation): Deleted.
+            * runtime/HighFidelityLog.h:
+            (JSC::HighFidelityLog::recordTypeInformationForLocation):
+            * runtime/HighFidelityTypeProfiler.cpp:
+            (JSC::HighFidelityTypeProfiler::getTypesForVariableInAtOffset):
+            (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableAtOffset):
+            (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableAtOffset):
+            (JSC::HighFidelityTypeProfiler::insertNewLocation):
+            (JSC::HighFidelityTypeProfiler::findLocation):
+            (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange): Deleted.
+            (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange): Deleted.
+            (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange): Deleted.
+            (JSC::HighFidelityTypeProfiler::getLocationBasedHash): Deleted.
+            * runtime/HighFidelityTypeProfiler.h:
+            (JSC::LocationKey::LocationKey): Deleted.
+            (JSC::LocationKey::hash): Deleted.
+            (JSC::LocationKey::operator==): Deleted.
+            * runtime/Structure.cpp:
+            (JSC::Structure::toStructureShape):
+            * runtime/Structure.h:
+            * runtime/TypeSet.cpp:
+            (JSC::TypeSet::TypeSet):
+            (JSC::TypeSet::addTypeForValue):
+            (JSC::TypeSet::seenTypes):
+            (JSC::TypeSet::removeDuplicatesInStructureHistory): Deleted.
+            * runtime/TypeSet.h:
+            (JSC::StructureShape::setConstructorName):
+            * runtime/VM.cpp:
+            (JSC::VM::getTypesForVariableAtOffset):
+            (JSC::VM::dumpHighFidelityProfilingTypes):
+            (JSC::VM::getTypesForVariableInRange): Deleted.
+            * runtime/VM.h:
+    
+    2014-07-04  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt][REGRESSION] debug tests fail because PutByIdDirect is now implemented in terms of In
+            https://bugs.webkit.org/show_bug.cgi?id=134642
+    
+            Rubber stamped by Andreas Kling.
+    
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+    
+    2014-07-01  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Allocate a new GetterSetter if we change the value of any of its entries other than when they were previously null, so that if we constant-infer an accessor slot then we immediately get the function constant for free
+            https://bugs.webkit.org/show_bug.cgi?id=134518
+    
+            Reviewed by Mark Hahnenberg.
+            
+            This has no real effect right now, particularly since almost all uses of
+            setSetter/setGetter were already allocating a branch new GetterSetter. But once we start
+            doing more aggressive constant property inference, this change will allow us to remove
+            all runtime checks from getter/setter calls.
+    
+            * runtime/GetterSetter.cpp:
+            (JSC::GetterSetter::withGetter):
+            (JSC::GetterSetter::withSetter):
+            * runtime/GetterSetter.h:
+            (JSC::GetterSetter::setGetter):
+            (JSC::GetterSetter::setSetter):
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::defineOwnNonIndexProperty):
+    
+    2014-07-02  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Rename notifyTransitionFromThisStructure to didTransitionFromThisStructure
+    
+            Rubber stamped by Mark Hahnenberg.
+    
+            * runtime/Structure.cpp:
+            (JSC::Structure::Structure):
+            (JSC::Structure::nonPropertyTransition):
+            (JSC::Structure::didTransitionFromThisStructure):
+            (JSC::Structure::notifyTransitionFromThisStructure): Deleted.
+            * runtime/Structure.h:
+    
+    2014-07-02  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Remove the functionality for cloning StructureRareData since we never do that anymore.
+    
+            Rubber stamped by Mark Hahnenberg.
+    
+            * runtime/Structure.cpp:
+            (JSC::Structure::Structure):
+            (JSC::Structure::cloneRareDataFrom): Deleted.
+            * runtime/Structure.h:
+            * runtime/StructureRareData.cpp:
+            (JSC::StructureRareData::clone): Deleted.
+            (JSC::StructureRareData::StructureRareData): Deleted.
+            * runtime/StructureRareData.h:
+            (JSC::StructureRareData::needsCloning): Deleted.
+    
+    2014-07-01  Mark Lam  <mark.lam@apple.com>
+    
+            [ftlopt] DebuggerCallFrame::scope() should return a DebuggerScope.
+            <https://webkit.org/b/134420>
+    
+            Reviewed by Geoffrey Garen.
+    
+            Previously, DebuggerCallFrame::scope() returns a JSActivation (and relevant
+            peers) which the WebInspector will use to introspect CallFrame variables.
+            Instead, we should be returning a DebuggerScope as an abstraction layer that
+            provides the introspection functionality that the WebInspector needs.  This
+            is the first step towards not forcing every frame to have a JSActivation
+            object just because the debugger is enabled.
+    
+            1. Instantiate the debuggerScopeStructure as a member of the JSGlobalObject
+               instead of the VM.  This allows JSObject::globalObject() to be able to
+               return the global object for the DebuggerScope.
+    
+            2. On the DebuggerScope's life-cycle management:
+    
+               The DebuggerCallFrame is designed to be "valid" only during a debugging session
+               (while the debugger is broken) through the use of a DebuggerCallFrameScope in
+               Debugger::pauseIfNeeded().  Once the debugger resumes from the break, the
+               DebuggerCallFrameScope destructs, and the DebuggerCallFrame will be invalidated.
+               We can't guarantee (from this code alone) that the Inspector code isn't still
+               holding a ref to the DebuggerCallFrame (though they shouldn't), but by contract,
+               the frame will be invalidated, and any attempt to query it will return null values.
+               This is pre-existing behavior.
+    
+               Now, we're adding the DebuggerScope into the picture.  While a single debugger
+               pause session is in progress, the Inspector may request the scope from the
+               DebuggerCallFrame.  While the DebuggerCallFrame is still valid, we want
+               DebuggerCallFrame::scope() to always return the same DebuggerScope object.
+               This is why we hold on to the DebuggerScope with a strong ref.
+    
+               If we use a weak ref instead, the following cooky behavior can manifest:
+               1. The Inspector calls Debugger::scope() to get the top scope.
+               2. The Inspector iterates down the scope chain and is now only holding a
+                  reference to a parent scope.  It is no longer referencing the top scope.
+               3. A GC occurs, and the DebuggerCallFrame's weak m_scope ref to the top scope
+                  gets cleared.
+               4. The Inspector calls DebuggerCallFrame::scope() to get the top scope again but gets
+                  a different DebuggerScope instance.
+               5. The Inspector iterates down the scope chain but never sees the parent scope
+                  instance that retained a ref to in step 2 above.  This is because when iterating
+                  this new DebuggerScope instance (which has no knowledge of the previous parent
+                  DebuggerScope instance), a new DebuggerScope instance will get created for the
+                  same parent scope. 
+    
+               Since the DebuggerScope is a JSObject, it's liveness is determined by its reachability.
+               However, it's "validity" is determined by the life-cycle of its owner DebuggerCallFrame.
+               When the owner DebuggerCallFrame gets invalidated, its debugger scope chain (if
+               instantiated) will also get invalidated.  This is why we need the
+               DebuggerScope::invalidateChain() method.  The Inspector should not be using the
+               DebuggerScope instance after its owner DebuggerCallFrame is invalidated.  If it does,
+               those methods will do nothing or returned a failed status.
+    
+            * debugger/Debugger.h:
+            * debugger/DebuggerCallFrame.cpp:
+            (JSC::DebuggerCallFrame::scope):
+            (JSC::DebuggerCallFrame::evaluate):
+            (JSC::DebuggerCallFrame::invalidate):
+            (JSC::DebuggerCallFrame::vm):
+            (JSC::DebuggerCallFrame::lexicalGlobalObject):
+            * debugger/DebuggerCallFrame.h:
+            * debugger/DebuggerScope.cpp:
+            (JSC::DebuggerScope::DebuggerScope):
+            (JSC::DebuggerScope::finishCreation):
+            (JSC::DebuggerScope::visitChildren):
+            (JSC::DebuggerScope::className):
+            (JSC::DebuggerScope::getOwnPropertySlot):
+            (JSC::DebuggerScope::put):
+            (JSC::DebuggerScope::deleteProperty):
+            (JSC::DebuggerScope::getOwnPropertyNames):
+            (JSC::DebuggerScope::defineOwnProperty):
+            (JSC::DebuggerScope::next):
+            (JSC::DebuggerScope::invalidateChain):
+            (JSC::DebuggerScope::isWithScope):
+            (JSC::DebuggerScope::isGlobalScope):
+            (JSC::DebuggerScope::isFunctionScope):
+            * debugger/DebuggerScope.h:
+            (JSC::DebuggerScope::create):
+            (JSC::DebuggerScope::Iterator::Iterator):
+            (JSC::DebuggerScope::Iterator::get):
+            (JSC::DebuggerScope::Iterator::operator++):
+            (JSC::DebuggerScope::Iterator::operator==):
+            (JSC::DebuggerScope::Iterator::operator!=):
+            (JSC::DebuggerScope::isValid):
+            (JSC::DebuggerScope::jsScope):
+            (JSC::DebuggerScope::begin):
+            (JSC::DebuggerScope::end):
+            * inspector/JSJavaScriptCallFrame.cpp:
+            (Inspector::JSJavaScriptCallFrame::scopeType):
+            (Inspector::JSJavaScriptCallFrame::scopeChain):
+            * inspector/JavaScriptCallFrame.h:
+            (Inspector::JavaScriptCallFrame::scopeChain):
+            * inspector/ScriptDebugServer.cpp:
+            * runtime/JSGlobalObject.cpp:
+            (JSC::JSGlobalObject::reset):
+            (JSC::JSGlobalObject::visitChildren):
+            * runtime/JSGlobalObject.h:
+            (JSC::JSGlobalObject::debuggerScopeStructure):
+            * runtime/JSObject.h:
+            (JSC::JSObject::isWithScope):
+            * runtime/JSScope.h:
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+    
+    2014-07-01  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG bytecode parser should turn PutById with nothing but a Setter stub as stuff+handleCall, and handleCall should be allowed to inline if it wants to
+            https://bugs.webkit.org/show_bug.cgi?id=130756
+    
+            Reviewed by Oliver Hunt.
+            
+            The enables exposing the call to setters in the DFG, and then inlining it. Previously we
+            already supproted inlined-cached calls to setters from within put_by_id inline caches,
+            and the DFG could certainly emit such IC's. Now, if an IC had a setter call, then the DFG
+            will either emit the GetGetterSetterByOffset/GetSetter/Call combo, or it will do one
+            better and inline the call.
+            
+            A lot of the core functionality was already available from the previous work to inline
+            getters. So, there are some refactorings in this patch that move preexisting
+            functionality around. For example, the work to figure out how the DFG should go about
+            getting to what we call the "loaded value" - i.e. the GetterSetter object reference in
+            the case of accessors - is now shared in ComplexGetStatus, and both GetByIdStatus and
+            PutByIdStatus use it. This means that we can keep the safety checks common.  This patch
+            also does additional refactorings in DFG::ByteCodeParser so that we can continue to reuse
+            handleCall() for all of the various kinds of calls we can now emit.
+            
+            83% speed-up on getter-richards, 2% speed-up on box2d.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/ComplexGetStatus.cpp: Added.
+            (JSC::ComplexGetStatus::computeFor):
+            * bytecode/ComplexGetStatus.h: Added.
+            (JSC::ComplexGetStatus::ComplexGetStatus):
+            (JSC::ComplexGetStatus::skip):
+            (JSC::ComplexGetStatus::takesSlowPath):
+            (JSC::ComplexGetStatus::kind):
+            (JSC::ComplexGetStatus::attributes):
+            (JSC::ComplexGetStatus::specificValue):
+            (JSC::ComplexGetStatus::offset):
+            (JSC::ComplexGetStatus::chain):
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::computeForStubInfo):
+            * bytecode/GetByIdVariant.cpp:
+            (JSC::GetByIdVariant::GetByIdVariant):
+            * bytecode/PolymorphicPutByIdList.h:
+            (JSC::PutByIdAccess::PutByIdAccess):
+            (JSC::PutByIdAccess::setter):
+            (JSC::PutByIdAccess::structure):
+            (JSC::PutByIdAccess::chainCount):
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::computeFromLLInt):
+            (JSC::PutByIdStatus::computeFor):
+            (JSC::PutByIdStatus::computeForStubInfo):
+            (JSC::PutByIdStatus::makesCalls):
+            * bytecode/PutByIdStatus.h:
+            (JSC::PutByIdStatus::makesCalls): Deleted.
+            * bytecode/PutByIdVariant.cpp:
+            (JSC::PutByIdVariant::PutByIdVariant):
+            (JSC::PutByIdVariant::operator=):
+            (JSC::PutByIdVariant::replace):
+            (JSC::PutByIdVariant::transition):
+            (JSC::PutByIdVariant::setter):
+            (JSC::PutByIdVariant::writesStructures):
+            (JSC::PutByIdVariant::reallocatesStorage):
+            (JSC::PutByIdVariant::makesCalls):
+            (JSC::PutByIdVariant::dumpInContext):
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::PutByIdVariant):
+            (JSC::PutByIdVariant::structure):
+            (JSC::PutByIdVariant::oldStructure):
+            (JSC::PutByIdVariant::alternateBase):
+            (JSC::PutByIdVariant::specificValue):
+            (JSC::PutByIdVariant::callLinkStatus):
+            (JSC::PutByIdVariant::replace): Deleted.
+            (JSC::PutByIdVariant::transition): Deleted.
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+            (JSC::DFG::ByteCodeParser::addCall):
+            (JSC::DFG::ByteCodeParser::handleCall):
+            (JSC::DFG::ByteCodeParser::handleInlining):
+            (JSC::DFG::ByteCodeParser::handleGetById):
+            (JSC::DFG::ByteCodeParser::handlePutById):
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * jit/Repatch.cpp:
+            (JSC::tryCachePutByID):
+            (JSC::tryBuildPutByIdList):
+            * runtime/IntendedStructureChain.cpp:
+            (JSC::IntendedStructureChain::takesSlowPathInDFGForImpureProperty):
+            * runtime/IntendedStructureChain.h:
+            * tests/stress/exit-from-setter.js: Added.
+            * tests/stress/poly-chain-setter.js: Added.
+            (Cons):
+            (foo):
+            (test):
+            * tests/stress/poly-chain-then-setter.js: Added.
+            (Cons1):
+            (Cons2):
+            (foo):
+            (test):
+            * tests/stress/poly-setter-combo.js: Added.
+            (Cons1):
+            (Cons2):
+            (foo):
+            (test):
+            (.test):
+            * tests/stress/poly-setter-then-self.js: Added.
+            (foo):
+            (test):
+            (.test):
+            * tests/stress/weird-setter-counter.js: Added.
+            (foo):
+            (test):
+            * tests/stress/weird-setter-counter-syntactic.js: Added.
+            (foo):
+            (test):
+    
+    2014-07-01  Matthew Mirman  <mmirman@apple.com>
+    
+            Added an implementation of the "in" check to FTL.
+            https://bugs.webkit.org/show_bug.cgi?id=134508
+    
+            Reviewed by Filip Pizlo.
+    
+            * ftl/FTLCapabilities.cpp: enabled compilation for "in"
+            (JSC::FTL::canCompile): ditto
+            * ftl/FTLCompile.cpp:
+            (JSC::FTL::generateCheckInICFastPath): added.
+            (JSC::FTL::fixFunctionBasedOnStackMaps): added case for CheckIn descriptors.
+            * ftl/FTLInlineCacheDescriptor.h:
+            (JSC::FTL::CheckInGenerator::CheckInGenerator): added.
+            (JSC::FTL::CheckInDescriptor::CheckInDescriptor): added.
+            * ftl/FTLInlineCacheSize.cpp: 
+            (JSC::FTL::sizeOfCheckIn): added. Currently larger than necessary.
+            * ftl/FTLInlineCacheSize.h: ditto
+            * ftl/FTLIntrinsicRepository.h: Added function type for operationInGeneric
+            * ftl/FTLLowerDFGToLLVM.cpp: 
+            (JSC::FTL::LowerDFGToLLVM::compileNode): added case for In.
+            (JSC::FTL::LowerDFGToLLVM::compileIn): added.
+            * ftl/FTLSlowPathCall.cpp: Added a callOperation for operationIn
+            (JSC::FTL::callOperation): ditto
+            * ftl/FTLSlowPathCall.h: ditto
+            * ftl/FTLState.h: Added a vector to hold CheckIn descriptors.
+            * jit/JITOperations.h: made operationIns internal.
+            * tests/stress/ftl-checkin.js: Added.
+            * tests/stress/ftl-checkin-variable.js: Added.
+    
+    2014-06-30  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            CodeBlock::stronglyVisitWeakReferences should mark DFG::CommonData::weakStructureReferences
+            https://bugs.webkit.org/show_bug.cgi?id=134455
+    
+            Reviewed by Geoffrey Garen.
+    
+            Otherwise we get hanging pointers which can cause us to die later.
+    
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::stronglyVisitWeakReferences):
+    
+    2014-06-27  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Reduce the GC's influence on optimization decisions
+            https://bugs.webkit.org/show_bug.cgi?id=134427
+    
+            Reviewed by Oliver Hunt.
+            
+            This is a slight speed-up on some platforms, that arises from a bunch of fixes that I made
+            while trying to make the GC keep more structures alive
+            (https://bugs.webkit.org/show_bug.cgi?id=128072).
+            
+            The fixes are, roughly:
+            
+            - If the GC clears an inline cache, then this no longer causes the IC to be forever
+              polymorphic.
+            
+            - If we exit in inlined code into a function that tries to OSR enter, then we jettison
+              sooner.
+            
+            - Some variables being uninitialized led to rage-recompilations.
+            
+            This is a pretty strong step in the direction of keeping more Structures alive and not
+            blowing away code just because a Structure died. But, it seems like there is still a slight
+            speed-up to be had from blowing away code that references dead Structures.
+    
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::dumpAssumingJITType):
+            (JSC::shouldMarkTransition):
+            (JSC::CodeBlock::propagateTransitions):
+            (JSC::CodeBlock::determineLiveness):
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::computeForStubInfo):
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::computeForStubInfo):
+            * dfg/DFGCapabilities.cpp:
+            (JSC::DFG::isSupportedForInlining):
+            (JSC::DFG::mightInlineFunctionForCall):
+            (JSC::DFG::mightInlineFunctionForClosureCall):
+            (JSC::DFG::mightInlineFunctionForConstruct):
+            * dfg/DFGCapabilities.h:
+            * dfg/DFGCommonData.h:
+            * dfg/DFGDesiredWeakReferences.cpp:
+            (JSC::DFG::DesiredWeakReferences::reallyAdd):
+            * dfg/DFGOSREntry.cpp:
+            (JSC::DFG::prepareOSREntry):
+            * dfg/DFGOSRExitCompilerCommon.cpp:
+            (JSC::DFG::handleExitCounts):
+            * dfg/DFGOperations.cpp:
+            * dfg/DFGOperations.h:
+            * ftl/FTLForOSREntryJITCode.cpp:
+            (JSC::FTL::ForOSREntryJITCode::ForOSREntryJITCode): These variables being uninitialized is benign in terms of correctness but can sometimes cause rage-recompilations. For some reason it took this patch to reveal this.
+            * ftl/FTLOSREntry.cpp:
+            (JSC::FTL::prepareOSREntry):
+            * runtime/Executable.cpp:
+            (JSC::ExecutableBase::destroy):
+            (JSC::NativeExecutable::destroy):
+            (JSC::ScriptExecutable::ScriptExecutable):
+            (JSC::ScriptExecutable::destroy):
+            (JSC::ScriptExecutable::installCode):
+            (JSC::EvalExecutable::EvalExecutable):
+            (JSC::ProgramExecutable::ProgramExecutable):
+            * runtime/Executable.h:
+            (JSC::ScriptExecutable::setDidTryToEnterInLoop):
+            (JSC::ScriptExecutable::didTryToEnterInLoop):
+            (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop):
+            (JSC::ScriptExecutable::ScriptExecutable): Deleted.
+            * runtime/StructureInlines.h:
+            (JSC::Structure::storedPrototypeObject):
+            (JSC::Structure::storedPrototypeStructure):
+    
+    2014-06-25  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] If a CodeBlock is jettisoned due to a watchpoint then it should be possible to figure out something about that watchpoint
+            https://bugs.webkit.org/show_bug.cgi?id=134333
+    
+            Reviewed by Geoffrey Garen.
+            
+            This is engineered to provide loads of information to the profiler without incurring any
+            costs when the profiler is disabled. It's the oldest trick in the book: the thing that
+            fires the watchpoint doesn't actually create anything to describe the reason why it was
+            fired; instead it creates a stack-allocated FireDetail subclass instance. Only if the
+            FireDetail::dump() virtual method is called does anything happen.
+            
+            Currently we use this to produce very fine-grained data for Structure watchpoints and
+            some cases of variable watchpoints. For all other situations, the given reason is just a
+            string constant, by using StringFireDetail. If we find a situation where that string
+            constant is insufficient to diagnose an issue then we can change it to provide more
+            fine-grained information.
+    
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::CodeBlock):
+            (JSC::CodeBlock::jettison):
+            * bytecode/CodeBlock.h:
+            * bytecode/CodeBlockJettisoningWatchpoint.cpp:
+            (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
+            * bytecode/CodeBlockJettisoningWatchpoint.h:
+            * bytecode/ProfiledCodeBlockJettisoningWatchpoint.cpp: Removed.
+            * bytecode/ProfiledCodeBlockJettisoningWatchpoint.h: Removed.
+            * bytecode/StructureStubClearingWatchpoint.cpp:
+            (JSC::StructureStubClearingWatchpoint::fireInternal):
+            * bytecode/StructureStubClearingWatchpoint.h:
+            * bytecode/VariableWatchpointSet.h:
+            (JSC::VariableWatchpointSet::invalidate):
+            (JSC::VariableWatchpointSet::finalizeUnconditionally):
+            * bytecode/VariableWatchpointSetInlines.h:
+            (JSC::VariableWatchpointSet::notifyWrite):
+            * bytecode/Watchpoint.cpp:
+            (JSC::StringFireDetail::dump):
+            (JSC::WatchpointSet::fireAll):
+            (JSC::WatchpointSet::fireAllSlow):
+            (JSC::WatchpointSet::fireAllWatchpoints):
+            (JSC::InlineWatchpointSet::fireAll):
+            * bytecode/Watchpoint.h:
+            (JSC::FireDetail::FireDetail):
+            (JSC::FireDetail::~FireDetail):
+            (JSC::StringFireDetail::StringFireDetail):
+            (JSC::Watchpoint::fire):
+            (JSC::WatchpointSet::fireAll):
+            (JSC::WatchpointSet::touch):
+            (JSC::WatchpointSet::invalidate):
+            (JSC::InlineWatchpointSet::fireAll):
+            (JSC::InlineWatchpointSet::touch):
+            * dfg/DFGCommonData.h:
+            * dfg/DFGOperations.cpp:
+            * interpreter/Interpreter.cpp:
+            (JSC::Interpreter::execute):
+            * jsc.cpp:
+            (WTF::Masquerader::create):
+            * profiler/ProfilerCompilation.cpp:
+            (JSC::Profiler::Compilation::setJettisonReason):
+            (JSC::Profiler::Compilation::toJS):
+            * profiler/ProfilerCompilation.h:
+            (JSC::Profiler::Compilation::setJettisonReason): Deleted.
+            * runtime/ArrayBuffer.cpp:
+            (JSC::ArrayBuffer::transfer):
+            * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+            (JSC::ArrayBufferNeuteringWatchpoint::fireAll):
+            * runtime/ArrayBufferNeuteringWatchpoint.h:
+            * runtime/CommonIdentifiers.h:
+            * runtime/CommonSlowPaths.cpp:
+            (JSC::SLOW_PATH_DECL):
+            * runtime/Identifier.cpp:
+            (JSC::Identifier::dump):
+            * runtime/Identifier.h:
+            * runtime/JSFunction.cpp:
+            (JSC::JSFunction::put):
+            (JSC::JSFunction::defineOwnProperty):
+            * runtime/JSGlobalObject.cpp:
+            (JSC::JSGlobalObject::addFunction):
+            (JSC::JSGlobalObject::haveABadTime):
+            * runtime/JSSymbolTableObject.cpp:
+            (JSC::VariableWriteFireDetail::dump):
+            * runtime/JSSymbolTableObject.h:
+            (JSC::VariableWriteFireDetail::VariableWriteFireDetail):
+            (JSC::symbolTablePut):
+            (JSC::symbolTablePutWithAttributes):
+            * runtime/PropertyName.h:
+            (JSC::PropertyName::dump):
+            * runtime/Structure.cpp:
+            (JSC::Structure::notifyTransitionFromThisStructure):
+            * runtime/Structure.h:
+            (JSC::Structure::notifyTransitionFromThisStructure): Deleted.
+            * runtime/SymbolTable.cpp:
+            (JSC::SymbolTableEntry::notifyWriteSlow):
+            (JSC::SymbolTable::WatchpointCleanup::finalizeUnconditionally):
+            * runtime/SymbolTable.h:
+            (JSC::SymbolTableEntry::notifyWrite):
+            * runtime/VM.cpp:
+            (JSC::VM::addImpureProperty):
+    
+2014-08-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r172099.
+        https://bugs.webkit.org/show_bug.cgi?id=135635
+
+        Needs a do-over. (Requested by kling on #webkit).
+
+        Reverted changeset:
+
+        "The JIT should cache property lookup misses."
+        https://bugs.webkit.org/show_bug.cgi?id=135578
+        http://trac.webkit.org/changeset/172099
+
+2014-08-05  Przemyslaw Kuczynski  <p.kuczynski@samsung.com>
+
+        Fix resource leak of unclosed file descriptor.
+        https://bugs.webkit.org/show_bug.cgi?id=135417
+
+        Reviewed by Darin Adler.
+
+        When open returns zero, fd handle leaks. Checking (fd > 0) needs to be replaced
+        with (fd != -1).
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+
+2014-08-05  Andreas Kling  <akling@apple.com>
+
+        The JIT should cache property lookup misses.
+        <https://webkit.org/b/135578>
+
+        Add support for inline caching of object properties that don't exist.
+        Previously we'd fall back to the C++ slow-path whenever a property was missing.
+
+        It's implemented as a simple GetById-style stub that returns jsUndefined() as
+        long as the Structure chain check passes.
+
+        10x speedup on the included microbenchmark.
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/Repatch.cpp:
+        (JSC::toString):
+        (JSC::kindFor):
+        (JSC::generateByIdStub):
+        (JSC::tryCacheGetByID):
+        (JSC::patchJumpToGetByIdStub):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isUnset):
+
+2014-08-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r172009.
+        https://bugs.webkit.org/show_bug.cgi?id=135627
+
+        "Commit landed on trunk instead of ftlopt branch." (Requested
+        by saamyjoon on #webkit).
+
+        Reverted changeset:
+
+        "Create a more generic way for VMEntryScope to notify those
+        interested that it will be destroyed"
+        https://bugs.webkit.org/show_bug.cgi?id=135358
+        http://trac.webkit.org/changeset/172009
+
+2014-08-05  Alex Christensen  <achristensen@webkit.org>
+
+        More work on CMake.
+        https://bugs.webkit.org/show_bug.cgi?id=135620
+
+        Reviewed by Laszlo Gombos.
+
+        * CMakeLists.txt:
+        Added missing source files.
+        * PlatformEfl.cmake:
+        * PlatformGTK.cmake:
+        Include glib directories and libraries to find glib.h in EventLoop.cpp.
+        * PlatformMac.cmake:
+        Moved STATICALLY_LINKED_WITH_WTF definition away from the common CMakeLists
+        because it should not be defined on Windows.
+        Added remote inspector source files.
+
+2014-08-05  Peyton Randolph  <prandolph@apple.com>
+
+        Rename MAC_LONG_PRESS feature flag to LONG_MOUSE_PRESS.
+        https://bugs.webkit.org/show_bug.cgi?id=135276
+
+        Reviewed by Beth Dakin.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-04  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add a flag for the CSS Selectors level 4 implementation
+        https://bugs.webkit.org/show_bug.cgi?id=135535
+
+        Reviewed by Andreas Kling.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-08-04  Alex Christensen  <achristensen@webkit.org>
+
+        Progress towards CMake on Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=135528
+
+        Reviewed by Gyuyoung Kim.
+
+        * CMakeLists.txt:
+        Include necessary directories and copy all necessary forwarding headers.
+        Only compile UDis86Disassembler.cpp if we're using UDIS86.
+        * PlatformMac.cmake: Added.
+        * tools/CodeProfiling.cpp:
+        Compile fix.  Include sys/time.h on darwin, too.
+
+2014-08-04  Saam Barati  <sbarati@apple.com>
+
+        Create a more generic way for VMEntryScope to notify those interested that it will be destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=135358
+
+        Reviewed by Geoffrey Garen.
+
+        When VMEntryScope is destroyed, and it has a flag set indicating that the
+        Debugger needs to recompile all functions, it calls Debugger::recompileAllJSFunctions. 
+        This flag is only used by Debugger to have VMEntryScope notify it when the
+        Debugger is safe to recompile all functions. This patch will substitute this
+        Debugger-specific recompilation flag with a list of callbacks that are notified 
+        when the outermost VMEntryScope dies. This creates a general purpose interface 
+        for being notified when the VM stops executing code via the event of the outermost 
+        VMEntryScope dying.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions):
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::addEntryScopeDidPopListener):
+        (JSC::VMEntryScope::~VMEntryScope):
+        * runtime/VMEntryScope.h:
+        (JSC::VMEntryScope::setRecompilationNeeded): Deleted.
+
+2014-08-01  Carlos Alberto Lopez Perez  <clopez@igalia.com>
+
+        REGRESSION(r171942): [CMAKE] [GTK] build broken (clean build).
+        https://bugs.webkit.org/show_bug.cgi?id=135522
+
+        Reviewed by Martin Robinson.
+
+        * CMakeLists.txt: Output the inspector headers inside inspector
+        subdirectory.
+
+2014-08-01  Mark Lam  <mark.lam@apple.com>
+
+        Add some structure related assertions.
+        <https://webkit.org/b/135523>
+
+        Reviewed by Geoffrey Garen.
+
+        Adding 2 assertions:
+        1. assert that we don't index pass the end of the StructureIDTable.
+           This should never happen, but this assertion will help catch bugs
+           where a bad structureID gets passed in.
+        2. assert that cells in MarkedBlock::callDestructor() that are not
+           zapped should have a non-null StructureID.  This will help us catch
+           bugs where the other cell header flag bits get set after the cell is
+           zapped, thereby making the cell look like an unzapped cell but has a
+           null structureID.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor):
+        * runtime/StructureIDTable.h:
+        (JSC::StructureIDTable::get):
+
+2014-08-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        URTBF after r171946 to fix non-Apple builds.
+
+        * bytecode/InlineCallFrameSet.cpp:
+
+2014-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CodeBlock fails to visit the Executables of its InlineCallFrames
+        https://bugs.webkit.org/show_bug.cgi?id=135471
+
+        Reviewed by Geoffrey Garen.
+
+        CodeBlock needs to visit its InlineCallFrames' owner Executables. If it doesn't, they 
+        can be prematurely collected and cause crashes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::visitAggregate):
+        * bytecode/InlineCallFrameSet.cpp:
+        (JSC::InlineCallFrameSet::visitAggregate):
+        * bytecode/InlineCallFrameSet.h:
+
+2014-08-01  Alex Christensen  <achristensen@webkit.org>
+
+        Progress towards cmake on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=135484
+
+        Reviewed by Martin Robinson.
+
+        * CMakeLists.txt:
+        Generate code directly to inspector directory to avoid using the cp command
+        which is not available on Windows.
+        * PlatformWin.cmake: Added.
+
+2014-07-31  Andreas Kling  <akling@apple.com>
+
+        Remove the JSC::OverridesVisitChildren flag.
+        <https://webkit.org/b/135489>
+
+        Except for 3 special classes, the visitChildren() call is always
+        dispatched through the method table (see SlotVisitor.cpp.)
+
+        The OverridesVisitChildren flag doesn't actually do anything.
+        It could be used to implement a non-virtual direct call to
+        JSCell::visitChildren, bypassing the method table for some objects,
+        but such a micro-optimization seems like a weak trade for all this
+        code complexity. Instead, just remove the flag.
+
+        This change frees up an inline flag bit in JSCell.
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSAPIWrapperObject.h:
+        * API/JSAPIWrapperObject.mm:
+        (JSC::JSAPIWrapperObject::visitChildren):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::visitChildren):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        (JSC::UnlinkedCodeBlock::visitChildren):
+        (JSC::UnlinkedProgramCodeBlock::visitChildren):
+        * bytecode/UnlinkedCodeBlock.h:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::visitChildren):
+        * debugger/DebuggerScope.h:
+        * jsc.cpp:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        * runtime/Arguments.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::visitChildren):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSActivation.h:
+        * runtime/JSArrayIterator.cpp:
+        (JSC::JSArrayIterator::visitChildren):
+        * runtime/JSArrayIterator.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::setStructure):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::visitChildren):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSMap.h:
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::visitChildren):
+        * runtime/JSMapIterator.h:
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::visitChildren):
+        * runtime/JSNameScope.h:
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::visitChildren):
+        * runtime/JSPromise.h:
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::visitChildren):
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPromiseReaction.cpp:
+        (JSC::JSPromiseReaction::visitChildren):
+        * runtime/JSPromiseReaction.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::visitChildren):
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::visitChildren):
+        * runtime/JSProxy.h:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::visitChildren):
+        * runtime/JSScope.h:
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::visitChildren):
+        * runtime/JSSegmentedVariableObject.h:
+        * runtime/JSSet.h:
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::visitChildren):
+        * runtime/JSSetIterator.h:
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::visitChildren):
+        * runtime/JSSymbolTableObject.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesVisitChildren): Deleted.
+        * runtime/JSWeakMap.h:
+        * runtime/JSWithScope.cpp:
+        (JSC::JSWithScope::visitChildren):
+        * runtime/JSWithScope.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::visitChildren):
+        * runtime/JSWrapperObject.h:
+        * runtime/MapData.h:
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::visitChildren):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/PropertyMapHashTable.h:
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::visitChildren):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::visitChildren):
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::visitChildren):
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::visitChildren):
+        * runtime/RegExpObject.h:
+        * runtime/SparseArrayValueMap.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::visitChildren):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::visitChildren):
+        * runtime/StructureChain.h:
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::visitChildren):
+        * runtime/StructureRareData.h:
+        * runtime/WeakMapData.h:
+
+2014-07-31  Mark Lam  <mark.lam@apple.com>
+
+        JSCell::classInfo() belongs in JSCellInlines.h.
+        <https://webkit.org/b/135475>
+
+        Reviewed by Mark Hahnenberg.
+
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::classInfo):
+        * runtime/JSDestructibleObject.h:
+        (JSC::JSCell::classInfo): Deleted.
+
+2014-07-31  Tanay C  <tanay.c@samsung.com>
+
+        Build warning in webkit/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=135414
+
+        Reviewed by Csaba Osztrogonác.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::putToScopeCommon):removed unused parameter from function definition
+
+2014-07-30  Filip Pizlo  <fpizlo@apple.com>
+
+        NewFunctionExpression and NewFunctionNoCheck should setHaveStructures(true)
+        https://bugs.webkit.org/show_bug.cgi?id=135430
+
+        Reviewed by Mark Hahnenberg.
+
+        We already handled this correctly after the ftlopt merge, but it's useful to have the test.
+
+        * tests/stress/new-function-expression-has-structures.js: Added.
+        (foo.f):
+        (foo.f.prototype.f):
+        (foo):
+
+2014-07-30  Andreas Kling  <akling@apple.com>
+
+        Speculative Windows build fix.
+
+        Try to dllimport the dllexported global object HashTable.
+
+        * jsc.cpp:
+        * testRegExp.cpp:
+
+2014-07-30  Andreas Kling  <akling@apple.com>
+
+        PropertyName's internal string is always atomic.
+        <https://webkit.org/b/135451>
+
+        Now that we've merged the JSC::Identifier and WTF::AtomicString tables,
+        we know that any string that's an Identifier is guaranteed to be atomic.
+
+        A PropertyName can be either an Identifier or a PrivateName, and the
+        private names are also guaranteed to be atomic internally.
+
+        Make PropertyName vend AtomicStringImpl* instead of StringImpl*.
+
+        Reviewed by Benjamin Poulain.
+
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+        (JSC::PropertyName::uid):
+        (JSC::PropertyName::publicName):
+
+2014-07-30  Andy Estes  <aestes@apple.com>
+
+        USE(CONTENT_FILTERING) should be ENABLE(CONTENT_FILTERING)
+        https://bugs.webkit.org/show_bug.cgi?id=135439
+
+        Reviewed by Tim Horton.
+
+        We now support two different platform content filters, and will soon support a mock content filter (as part of
+        webkit.org/b/128858). This makes content filtering a feature of WebKit, not just an adoption of a third-party
+        library. ENABLE() is the correct macro to use for such a feature.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-07-30  Andreas Kling  <akling@apple.com>
+
+        Static hash tables no longer need to be coupled with a VM.
+        <https://webkit.org/b/135421>
+
+        Now that the static hash tables are using char** instead of StringImpl**,
+        it's no longer necessary to make them per-VM.
+
+        This patch removes the hook in ClassInfo for providing your own static
+        hash table getter. Everyone now uses ClassInfo::staticPropHashTable.
+        Most of this patch is tweaking ClassInfo construction sites to pass one
+        less null pointer.
+
+        Also simplified Lookup.h to stop requiring ExecState/VM to access the
+        static hash tables.
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSAPIWrapperObject.mm:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObject.cpp:
+        * API/ObjCCallbackFunction.mm:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        * create_hash_table:
+        * debugger/DebuggerScope.cpp:
+        * inspector/JSInjectedScriptHost.cpp:
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::arrayConstructorTable): Deleted.
+        (JSC::ExecState::arrayPrototypeTable): Deleted.
+        (JSC::ExecState::booleanPrototypeTable): Deleted.
+        (JSC::ExecState::dataViewTable): Deleted.
+        (JSC::ExecState::dateTable): Deleted.
+        (JSC::ExecState::dateConstructorTable): Deleted.
+        (JSC::ExecState::errorPrototypeTable): Deleted.
+        (JSC::ExecState::globalObjectTable): Deleted.
+        (JSC::ExecState::jsonTable): Deleted.
+        (JSC::ExecState::numberConstructorTable): Deleted.
+        (JSC::ExecState::numberPrototypeTable): Deleted.
+        (JSC::ExecState::objectConstructorTable): Deleted.
+        (JSC::ExecState::privateNamePrototypeTable): Deleted.
+        (JSC::ExecState::regExpTable): Deleted.
+        (JSC::ExecState::regExpConstructorTable): Deleted.
+        (JSC::ExecState::regExpPrototypeTable): Deleted.
+        (JSC::ExecState::stringConstructorTable): Deleted.
+        (JSC::ExecState::promisePrototypeTable): Deleted.
+        (JSC::ExecState::promiseConstructorTable): Deleted.
+        * jsc.cpp:
+        * parser/Lexer.h:
+        (JSC::Keywords::isKeyword):
+        (JSC::Keywords::getKeyword):
+        * runtime/Arguments.cpp:
+        * runtime/ArgumentsIteratorConstructor.cpp:
+        * runtime/ArgumentsIteratorPrototype.cpp:
+        * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getOwnPropertySlot):
+        * runtime/ArrayIteratorConstructor.cpp:
+        * runtime/ArrayIteratorPrototype.cpp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::getOwnPropertySlot):
+        * runtime/BooleanConstructor.cpp:
+        * runtime/BooleanObject.cpp:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::getOwnPropertySlot):
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::hasStaticProperties):
+        (JSC::ClassInfo::propHashTable): Deleted.
+        * runtime/ConsolePrototype.cpp:
+        * runtime/CustomGetterSetter.cpp:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertySlot):
+        * runtime/DateInstance.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::getOwnPropertySlot):
+        * runtime/Error.cpp:
+        * runtime/ErrorConstructor.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/Executable.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/GetterSetter.cpp:
+        * runtime/InternalFunction.cpp:
+        * runtime/JSAPIValueWrapper.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSArgumentsIterator.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSArrayBuffer.cpp:
+        * runtime/JSArrayBufferConstructor.cpp:
+        * runtime/JSArrayBufferPrototype.cpp:
+        * runtime/JSArrayBufferView.cpp:
+        * runtime/JSArrayIterator.cpp:
+        * runtime/JSBoundFunction.cpp:
+        * runtime/JSConsole.cpp:
+        * runtime/JSDataView.cpp:
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::getOwnPropertySlot):
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        * runtime/JSMap.cpp:
+        * runtime/JSMapIterator.cpp:
+        * runtime/JSNameScope.cpp:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::getOwnPropertySlot):
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::findPropertyHashEntry):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        * runtime/JSObject.h:
+        * runtime/JSPromise.cpp:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getOwnPropertySlot):
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::getOwnPropertySlot):
+        * runtime/JSPromiseReaction.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSProxy.cpp:
+        * runtime/JSSet.cpp:
+        * runtime/JSSetIterator.cpp:
+        * runtime/JSString.cpp:
+        * runtime/JSTypedArrayConstructors.cpp:
+        * runtime/JSTypedArrayPrototypes.cpp:
+        * runtime/JSTypedArrays.cpp:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSWeakMap.cpp:
+        * runtime/JSWithScope.cpp:
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        * runtime/Lookup.h:
+        (JSC::HashTable::initializeIfNeeded):
+        (JSC::HashTable::entry):
+        (JSC::HashTable::begin):
+        (JSC::HashTable::end):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+        (JSC::getStaticValueSlot):
+        (JSC::lookupPut):
+        * runtime/MapConstructor.cpp:
+        * runtime/MapData.cpp:
+        * runtime/MapIteratorConstructor.cpp:
+        * runtime/MapIteratorPrototype.cpp:
+        * runtime/MapPrototype.cpp:
+        * runtime/MathObject.cpp:
+        * runtime/NameConstructor.cpp:
+        * runtime/NameInstance.cpp:
+        * runtime/NamePrototype.cpp:
+        (JSC::NamePrototype::getOwnPropertySlot):
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getOwnPropertySlot):
+        * runtime/NumberObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::getOwnPropertySlot):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getOwnPropertySlot):
+        * runtime/ObjectPrototype.cpp:
+        * runtime/PropertyTable.cpp:
+        * runtime/RegExp.cpp:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        * runtime/RegExpMatchesArray.cpp:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        * runtime/SetConstructor.cpp:
+        * runtime/SetIteratorConstructor.cpp:
+        * runtime/SetIteratorPrototype.cpp:
+        * runtime/SetPrototype.cpp:
+        * runtime/SparseArrayValueMap.cpp:
+        * runtime/StrictEvalActivation.cpp:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getOwnPropertySlot):
+        * runtime/StringObject.cpp:
+        * runtime/StringPrototype.cpp:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::freezeTransition):
+        (JSC::ClassInfo::hasStaticSetterOrReadonlyProperties):
+        * runtime/StructureChain.cpp:
+        * runtime/StructureRareData.cpp:
+        * runtime/SymbolTable.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h:
+        * runtime/WeakMapConstructor.cpp:
+        * runtime/WeakMapData.cpp:
+        * runtime/WeakMapPrototype.cpp:
+        * testRegExp.cpp:
+
+2014-07-29  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Modify version numbering scheme to support 5-tuple versions
+        https://bugs.webkit.org/show_bug.cgi?id=135400
+        <rdar://problem/17849033>
+
+        Reviewed by David Kilzer.
+
+        * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Use the
+        new version-stamp.pl script to version JavaScriptCore.dll.
+
+2014-07-29  Daniel Bates  <dabates@apple.com>
+
+        Use WTF::move() instead of std::move() to help ensure move semantics
+        https://bugs.webkit.org/show_bug.cgi?id=135351
+
+        Reviewed by Alexey Proskuryakov.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::GetByIdVariant):
+
+2014-07-28  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>
+
+        BuildFix: JavaScriptCore/bytecode/StructureSet.h:262:77: warning.
+        https://bugs.webkit.org/show_bug.cgi?id=135287
+
+        Reviewed by Darin Adler.
+
+        The set() method tries to use a part of the old value (the reservedFlag bit) which
+        was not defined when the constructor is called. Initialize m_pointer to 0 explicitely.
+
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::StructureSet):
+
+2014-07-28  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] JIT::assertStackPointerOffset() crashes on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=135316
+
+        Reviewed by Geoffrey Garen.
+
+        JIT::assertStackPointerOffset() does a compare between an arbitrary register
+        and the stack pointer. This was not supported by the ARM64 assembler.
+
+        There are no variation that can take a stack pointer for Xd. There is one version of subs
+        that can take a stack pointer, but only for the Xn: the shift+extend one.
+        To solve the problem, I changed cmp to swap the registers if necessary, and I fixed
+        the implementation of sub.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::sub):
+        In the generic sub(reg, reg), I added assertions to catch the condition that cannot be generated
+        with either version of sub.
+
+        In sub(with shift), I remove the weird special case for SP. First, it was quite misleading because
+        the Rd case only works if "setflag == false". The other confusing part is going to addSubtractShiftedRegister()
+        gives you a reduce shift range, which could create subtle bug that only appear when SP is used.
+
+        Since I removed the weird case, I need to differentiate between the sub() that support SP, and the one that does
+        not elsewhere. That is why that branch has moved to the generic sub(reg, reg). Since at that point we know
+        the shift value must be zero, it is safe to call either variant.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branch64):
+        With the changes described above, we can now use SP for the left register. What do we do if the rightmost
+        register is SP?
+
+        For the case of JIT::assertStackPointerOffset(), the comparison is Equal so the order really does not matter,
+        we just switch the registers before generating the instruction.
+
+        For the generic case, just move the value of SP to a GPR before doing the CMP.
+
+2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
+
+        Unreviewed build fix after r171682.
+
+        * replay/EncodedValue.h: Don't mark the inlined Vector<char> specialization
+        as an exported symbol.
+
+2014-07-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION: JSObjectSetPrototype() does not work on result of JSGetGlobalObject()
+        https://bugs.webkit.org/show_bug.cgi?id=135322
+
+        Reviewed by Oliver Hunt.
+
+        The prototype chain of the JSProxy object should match that of the JSGlobalObject. 
+
+        This is a separate but related issue with JSObjectSetPrototype which doesn't correctly 
+        account for JSProxies. I also audited the rest of the C API to check that we correctly 
+        handle JSProxies in all other situations where we expect a JSCallbackObject of some sort
+        and found some SPI calls (JSObject*PrivateProperty) that didn't behave correctly when 
+        passed a JSProxy.
+
+        I also added some new tests for these cases.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrototype):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/tests/CustomGlobalObjectClassTest.c:
+        (globalObjectSetPrototypeTest):
+        (globalObjectPrivatePropertyTest):
+        * API/tests/CustomGlobalObjectClassTest.h:
+        * API/tests/testapi.c:
+        (main):
+
+2014-07-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Make sure that we don't use non-speculative BooleanToNumber for a speculative Branch
+        https://bugs.webkit.org/show_bug.cgi?id=135350
+        <rdar://problem/17509889>
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+        
+        If we have an exiting node that uses a conversion node, then that exiting node
+        needs to have a Phantom after it for the the original node. But we can't do that
+        for Branch because https://bugs.webkit.org/show_bug.cgi?id=126778.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::clearPhantomsAtEnd):
+        * tests/stress/branch-check-int32-on-boolean-to-number-untyped.js: Added.
+        (foo):
+        (test):
+        * tests/stress/branch-check-number-on-boolean-to-number-untyped.js: Added.
+        (foo):
+        (test):
+
+2014-07-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSContext Inspector: crash when using step-into
+        https://bugs.webkit.org/show_bug.cgi?id=135345
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::stepInto):
+        Null check m_listener since it may not be set.
+
+2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: auto-decoding of parameterized vector's elements is incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=135343
+
+        Reviewed by Timothy Hatcher.
+
+        Fix an incorrect type argument in EncodingTraits<Vector<T>>::encodeValue
+        that was using the element's decoded type as the type parameter to
+        EncodedValue::append<T>. It should instead be the raw type T. This
+        causes problems when encoding Vector<RefPtr<T>>, as it later tries to
+        use encoding traits for RefPtr<T> rather than for T.
+
+        Fix incorrect generated encoding traits argument for vectors of
+        RefCounted objects. Updated test to cover this scenario.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Type.encoding_type_argument):
+        (VectorType.type_name):
+        (VectorType):
+        (VectorType.encoding_type_argument):
+        (Generator.generate_input_encode_implementation):
+        (Generator.generate_input_decode_implementation):
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.cpp:
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h:
+        * replay/scripts/tests/generate-input-with-vector-members.json: Updated.
+
+2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: incorrect serialization code generated for enum classes inside class scope
+        https://bugs.webkit.org/show_bug.cgi?id=135342
+
+        Reviewed by Timothy Hatcher.
+
+        If an enum class is defined inside of a class scope, then the enum class
+        cannot be forward-declared and the relevant header should be included.
+        Some generated code used incorrectly-scoped enum values in this situation.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Generator.generate_includes.declaration.is):
+        (Generator.generate_enum_trait_implementation.is):
+        (Generator.generate_enum_trait_implementation):
+
+        Tests:
+
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp: Rebaselined.
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h: Rebaselined.
+        * replay/scripts/tests/generate-enums-with-same-base-name.json: Add enum
+        class types to this test case.
+
+2014-07-28  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: vectors of characters should be base64-encoded
+        https://bugs.webkit.org/show_bug.cgi?id=135341
+
+        Reviewed by Timothy Hatcher.
+
+        Without this specialization, encode/decode methods try to create an
+        array of single characters in JSON, rather than treating the
+        vector as a binary blob.
+
+        * replay/EncodedValue.cpp:
+        (JSC::EncodingTraits<Vector<char>>::encodeValue): Added.
+        (JSC::EncodingTraits<Vector<char>>::decodeValue): Added.
+        * replay/EncodedValue.h:
+
+2014-07-28  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj: Switch from the 'Rebuild' target for MSBuild
+        builds to the 'Build' target to avoid a spurious 'clean' in between build steps.
+
+2014-07-27  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix on the EFL port
+
+        Build break because of -Werror=return-type
+
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::oldStructureForTransition):
+        * dfg/DFGValueStrength.h:
+        (JSC::DFG::merge):
+
+2014-07-27  Filip Pizlo  <fpizlo@apple.com>
+
+        [REGRESSION][ftlopt merge][32-bit] stress/prune-multi-put-by-offset-replace-or-transition-variant.js.dfg-eager hits an assertion in SpeculativeJIT::silentSavePlanForGPR
+        https://bugs.webkit.org/show_bug.cgi?id=135323
+
+        Reviewed by Oliver Hunt.
+        
+        SpeculativeJIT::silentSavePlanForGPR likes to believe that if a node is a constant,
+        then it's a constant that can be represented using that node's current DataFormat.
+        This doesn't work if the constant had been filled as a JSValue, and then one of the
+        fillSpeculateBlah() methods had speculated that it's of some type that the constant
+        isn't. Unless fillSpeculateBlah() specifically defends against this case, we'll have
+        a constant that claims to have a contradictory data format.
+        
+        This patch fixes such a bug in the 32-bit fillSpeculateCell(). The 64-bit
+        fillSpeculateCell() appears to not have this bug, but I added a similar defense
+        mechanism anyway just in case, since this is one of those mistakes that keeps
+        reappearing.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+
+2014-07-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
+        
+        This fixes the previous mismerge and adds test coverage for the thing that went wrong.
+        
+        Additional changes listed here:
+
+        * jsc.cpp:
+        (functionHasCustomProperties): Expose a way of checking hasCustomProperties(), which the DOM relies on. The regression I previously introduced was because this didn't work right. Now we can test it!
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): This was supposed to be setDidTransition(true); the last merge had it set to false.
+        * tests/stress/has-custom-properties.js: Added. This test failed with the mismerge.
+
+    2014-06-27  Michael Saboff  <msaboff@apple.com>
+    
+            Unreviewed build fix after r169795.
+    
+            Fixed ASSERT for 32 bit build.
+    
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+    
+    2014-06-24  Saam Barati  <sbarati@apple.com>
+    
+            Web Inspector: debugger should be able to show variable types
+            https://bugs.webkit.org/show_bug.cgi?id=133395
+    
+            Reviewed by Filip Pizlo.
+    
+            Increase the amount of type information the VM gathers when directed
+            to do so. This initial commit is working towards the goal of
+            capturing, and then showing (via the Web Inspector) type information for all
+            assignment and load operations. This patch doesn't have the feature fully 
+            implemented, but it ensures the VM has no performance regressions
+            unless the feature is specifically turned on.
+    
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/BytecodeList.json:
+            * bytecode/BytecodeUseDef.h:
+            (JSC::computeUsesForBytecodeOffset):
+            (JSC::computeDefsForBytecodeOffset):
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::dumpBytecode):
+            (JSC::CodeBlock::CodeBlock):
+            (JSC::CodeBlock::finalizeUnconditionally):
+            * bytecode/CodeBlock.h:
+            * bytecode/Instruction.h:
+            * bytecode/TypeLocation.h: Added.
+            (JSC::TypeLocation::TypeLocation):
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::emitMove):
+            (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
+            (JSC::BytecodeGenerator::emitPutToScope):
+            (JSC::BytecodeGenerator::emitPutById):
+            (JSC::BytecodeGenerator::emitPutByVal):
+            * bytecompiler/BytecodeGenerator.h:
+            (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity):
+            * bytecompiler/NodesCodegen.cpp:
+            (JSC::PostfixNode::emitResolve):
+            (JSC::PrefixNode::emitResolve):
+            (JSC::ReadModifyResolveNode::emitBytecode):
+            (JSC::AssignResolveNode::emitBytecode):
+            (JSC::ConstDeclNode::emitCodeSingle):
+            (JSC::ForInNode::emitBytecode):
+            * heap/Heap.cpp:
+            (JSC::Heap::collect):
+            * inspector/agents/InspectorRuntimeAgent.cpp:
+            (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange):
+            * inspector/agents/InspectorRuntimeAgent.h:
+            * inspector/protocol/Runtime.json:
+            * jsc.cpp:
+            (GlobalObject::finishCreation):
+            (functionDumpTypesForAllVariables):
+            * llint/LLIntSlowPaths.cpp:
+            (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+            (JSC::LLInt::putToScopeCommon):
+            * llint/LLIntSlowPaths.h:
+            * llint/LowLevelInterpreter.asm:
+            * runtime/HighFidelityLog.cpp: Added.
+            (JSC::HighFidelityLog::initializeHighFidelityLog):
+            (JSC::HighFidelityLog::~HighFidelityLog):
+            (JSC::HighFidelityLog::recordTypeInformationForLocation):
+            (JSC::HighFidelityLog::processHighFidelityLog):
+            (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
+            * runtime/HighFidelityLog.h: Added.
+            (JSC::HighFidelityLog::HighFidelityLog):
+            * runtime/HighFidelityTypeProfiler.cpp: Added.
+            (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange):
+            (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange):
+            (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange):
+            (JSC::HighFidelityTypeProfiler::insertNewLocation):
+            (JSC::HighFidelityTypeProfiler::getLocationBasedHash):
+            * runtime/HighFidelityTypeProfiler.h: Added.
+            * runtime/Options.h:
+            * runtime/Structure.cpp:
+            (JSC::Structure::toStructureShape):
+            * runtime/Structure.h:
+            * runtime/SymbolTable.cpp:
+            (JSC::SymbolTable::SymbolTable):
+            (JSC::SymbolTable::cloneCapturedNames):
+            (JSC::SymbolTable::uniqueIDForVariable):
+            (JSC::SymbolTable::uniqueIDForRegister):
+            (JSC::SymbolTable::globalTypeSetForRegister):
+            (JSC::SymbolTable::globalTypeSetForVariable):
+            * runtime/SymbolTable.h:
+            (JSC::SymbolTable::add):
+            (JSC::SymbolTable::set):
+            * runtime/TypeSet.cpp: Added.
+            (JSC::TypeSet::TypeSet):
+            (JSC::TypeSet::getRuntimeTypeForValue):
+            (JSC::TypeSet::addTypeForValue):
+            (JSC::TypeSet::removeDuplicatesInStructureHistory):
+            (JSC::TypeSet::seenTypes):
+            (JSC::TypeSet::dumpSeenTypes):
+            (JSC::StructureShape::StructureShape):
+            (JSC::StructureShape::markAsFinal):
+            (JSC::StructureShape::addProperty):
+            (JSC::StructureShape::propertyHash):
+            (JSC::StructureShape::leastUpperBound):
+            (JSC::StructureShape::stringRepresentation):
+            * runtime/TypeSet.h: Added.
+            (JSC::StructureShape::create):
+            (JSC::TypeSet::create):
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            (JSC::VM::getTypesForVariableInRange):
+            (JSC::VM::updateHighFidelityTypeProfileState):
+            (JSC::VM::dumpHighFidelityProfilingTypes):
+            * runtime/VM.h:
+            (JSC::VM::isProfilingTypesWithHighFidelity):
+            (JSC::VM::highFidelityLog):
+            (JSC::VM::highFidelityTypeProfiler):
+            (JSC::VM::nextLocation):
+            (JSC::VM::getNextUniqueVariableID):
+    
+    2014-06-26  Mark Lam  <mark.lam@apple.com>
+    
+            Remove unused instantiation of the WithScope structure.
+            <https://webkit.org/b/134331>
+    
+            Reviewed by Oliver Hunt.
+    
+            The WithScope structure instance is the VM is unused, and is now removed.
+    
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+    
+    2014-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            Structure bit fields should have a consistent format
+            https://bugs.webkit.org/show_bug.cgi?id=134307
+    
+            Reviewed by Filip Pizlo.
+    
+            Currently we use C-style bit fields for a number of member variables in Structure to save space. 
+            This makes it difficult to load these fields in the JIT. We should instead use our own bitfield 
+            format to make it easy to load and test these variables in JIT code.
+    
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::putDirectNonIndexAccessor):
+            (JSC::JSObject::reifyStaticFunctionsForDelete):
+            * runtime/Structure.cpp:
+            (JSC::StructureTransitionTable::contains):
+            (JSC::StructureTransitionTable::get):
+            (JSC::StructureTransitionTable::add):
+            (JSC::Structure::Structure):
+            (JSC::Structure::materializePropertyMap):
+            (JSC::Structure::addPropertyTransition):
+            (JSC::Structure::despecifyFunctionTransition):
+            (JSC::Structure::toDictionaryTransition):
+            (JSC::Structure::freezeTransition):
+            (JSC::Structure::preventExtensionsTransition):
+            (JSC::Structure::takePropertyTableOrCloneIfPinned):
+            (JSC::Structure::nonPropertyTransition):
+            (JSC::Structure::flattenDictionaryStructure):
+            (JSC::Structure::addPropertyWithoutTransition):
+            (JSC::Structure::pin):
+            (JSC::Structure::allocateRareData):
+            (JSC::Structure::cloneRareDataFrom):
+            (JSC::Structure::getConcurrently):
+            (JSC::Structure::putSpecificValue):
+            (JSC::Structure::getPropertyNamesFromStructure):
+            (JSC::Structure::visitChildren):
+            (JSC::Structure::checkConsistency):
+            * runtime/Structure.h:
+            (JSC::Structure::isExtensible):
+            (JSC::Structure::isDictionary):
+            (JSC::Structure::isUncacheableDictionary):
+            (JSC::Structure::propertyAccessesAreCacheable):
+            (JSC::Structure::previousID):
+            (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck):
+            (JSC::Structure::setContainsReadOnlyProperties):
+            (JSC::Structure::disableSpecificFunctionTracking):
+            (JSC::Structure::objectToStringValue):
+            (JSC::Structure::setObjectToStringValue):
+            (JSC::Structure::setPreviousID):
+            (JSC::Structure::clearPreviousID):
+            (JSC::Structure::previous):
+            (JSC::Structure::rareData):
+            (JSC::Structure::didTransition): Deleted.
+            (JSC::Structure::hasGetterSetterProperties): Deleted.
+            (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto): Deleted.
+            (JSC::Structure::setHasGetterSetterProperties): Deleted.
+            (JSC::Structure::hasNonEnumerableProperties): Deleted.
+            (JSC::Structure::staticFunctionsReified): Deleted.
+            (JSC::Structure::setStaticFunctionsReified): Deleted.
+            * runtime/StructureInlines.h:
+            (JSC::Structure::setEnumerationCache):
+            (JSC::Structure::enumerationCache):
+            (JSC::Structure::checkOffsetConsistency):
+    
+    2014-06-24  Mark Lam  <mark.lam@apple.com>
+    
+            [ftlopt] Renamed DebuggerActivation to DebuggerScope.
+            <https://webkit.org/b/134273>
+    
+            Reviewed by Michael Saboff.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * debugger/DebuggerActivation.cpp: Removed.
+            * debugger/DebuggerActivation.h: Removed.
+            * debugger/DebuggerScope.cpp: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp.
+            (JSC::DebuggerScope::DebuggerScope):
+            (JSC::DebuggerScope::finishCreation):
+            (JSC::DebuggerScope::visitChildren):
+            (JSC::DebuggerScope::className):
+            (JSC::DebuggerScope::getOwnPropertySlot):
+            (JSC::DebuggerScope::put):
+            (JSC::DebuggerScope::deleteProperty):
+            (JSC::DebuggerScope::getOwnPropertyNames):
+            (JSC::DebuggerScope::defineOwnProperty):
+            (JSC::DebuggerActivation::DebuggerActivation): Deleted.
+            (JSC::DebuggerActivation::finishCreation): Deleted.
+            (JSC::DebuggerActivation::visitChildren): Deleted.
+            (JSC::DebuggerActivation::className): Deleted.
+            (JSC::DebuggerActivation::getOwnPropertySlot): Deleted.
+            (JSC::DebuggerActivation::put): Deleted.
+            (JSC::DebuggerActivation::deleteProperty): Deleted.
+            (JSC::DebuggerActivation::getOwnPropertyNames): Deleted.
+            (JSC::DebuggerActivation::defineOwnProperty): Deleted.
+            * debugger/DebuggerScope.h: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h.
+            (JSC::DebuggerScope::create):
+            (JSC::DebuggerActivation::create): Deleted.
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+    
+    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] PutByIdFlush can also be converted to a PutByOffset so don't assert otherwise
+            https://bugs.webkit.org/show_bug.cgi?id=134265
+    
+            Reviewed by Geoffrey Garen.
+            
+            More assertion fallout from the PutById folding work.
+    
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::convertToPutByOffset):
+    
+    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] GC should notify us if it resets to_this
+            https://bugs.webkit.org/show_bug.cgi?id=128231
+    
+            Reviewed by Geoffrey Garen.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/BytecodeList.json:
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::dumpBytecode):
+            (JSC::CodeBlock::finalizeUnconditionally):
+            * bytecode/Instruction.h:
+            * bytecode/ToThisStatus.cpp: Added.
+            (JSC::merge):
+            (WTF::printInternal):
+            * bytecode/ToThisStatus.h: Added.
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::BytecodeGenerator):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * llint/LowLevelInterpreter32_64.asm:
+            * llint/LowLevelInterpreter64.asm:
+            * runtime/CommonSlowPaths.cpp:
+            (JSC::SLOW_PATH_DECL):
+    
+    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
+            https://bugs.webkit.org/show_bug.cgi?id=134256
+    
+            Reviewed by Michael Saboff.
+            
+            This isn't testable right now (i.e. it's benign) but we should get it right anyway. The
+            point is to be able to precisely model what goes on in the snippets of code between a
+            side-effect and an InvalidationPoint.
+            
+            This patch also cleans up onlyStructure() by delegating more work to
+            StructureSet::onlyStructure().
+    
+            * dfg/DFGStructureAbstractValue.h:
+            (JSC::DFG::StructureAbstractValue::onlyStructure):
+    
+    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt][REGRESSION] PutById AI is introducing watchable structures without watching them
+            https://bugs.webkit.org/show_bug.cgi?id=134260
+    
+            Reviewed by Geoffrey Garen.
+            
+            This was causing loads of assertion failures in debug builds.
+    
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+    
+    2014-06-21  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
+            https://bugs.webkit.org/show_bug.cgi?id=134090
+    
+            Reviewed by Oliver Hunt.
+            
+            This pretty much finishes off the work to eliminate the special-casing of singleton
+            structure sets by making it possible to fold GetById and PutById to various polymorphic
+            forms of the ByOffset nodes.
+            
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::computeForStubInfo):
+            (JSC::GetByIdStatus::computeFor):
+            * bytecode/GetByIdStatus.h:
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::computeFor):
+            * bytecode/PutByIdStatus.h:
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::constantChecks):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            (JSC::DFG::ConstantFoldingPhase::addChecks):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::convertToMultiGetByOffset):
+            (JSC::DFG::Node::convertToMultiPutByOffset):
+            * dfg/DFGSpeculativeJIT64.cpp: Also convert all release assertions to DFG assertions in this file, because I was hitting some of them while debugging.
+            (JSC::DFG::SpeculativeJIT::fillJSValue):
+            (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+            (JSC::DFG::SpeculativeJIT::emitCall):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+            (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+            (JSC::DFG::SpeculativeJIT::emitBranch):
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGStructureAbstractValue.h:
+            (JSC::DFG::StructureAbstractValue::set):
+    
+    2014-06-19  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] StructureSet::onlyStructure() should return nullptr if it's not a singleton (instead of asserting)
+            https://bugs.webkit.org/show_bug.cgi?id=134077
+    
+            Reviewed by Sam Weinig.
+            
+            This makes StructureSet and StructureAbstractValue more consistent and fixes a debug assert
+            in the abstract interpreter.
+    
+            * bytecode/StructureSet.h:
+            (JSC::StructureSet::onlyStructure):
+    
+    2014-06-18  Filip Pizlo  <fpizlo@apple.com>
+    
+            DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
+            https://bugs.webkit.org/show_bug.cgi?id=133918
+    
+            Reviewed by Mark Hahnenberg.
+            
+            This also adds pruning of PutStructure, since I basically had no choice but
+            to implement such logic within MultiPutByOffset.
+            
+            Also adds a bunch of PutById cache status dumping to bytecode dumping.
+    
+            * bytecode/GetByIdVariant.cpp:
+            (JSC::GetByIdVariant::dumpInContext):
+            * bytecode/GetByIdVariant.h:
+            (JSC::GetByIdVariant::structureSet):
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::oldStructure):
+            * bytecode/StructureSet.cpp:
+            (JSC::StructureSet::filter):
+            (JSC::StructureSet::filterArrayModes):
+            * bytecode/StructureSet.h:
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGAbstractValue.cpp:
+            (JSC::DFG::AbstractValue::changeStructure):
+            (JSC::DFG::AbstractValue::contains):
+            * dfg/DFGAbstractValue.h:
+            (JSC::DFG::AbstractValue::couldBeType):
+            (JSC::DFG::AbstractValue::isType):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::freezeStrong):
+            * dfg/DFGGraph.h:
+            * dfg/DFGStructureAbstractValue.h:
+            (JSC::DFG::StructureAbstractValue::operator=):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+            * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Added.
+            (foo):
+            (fu):
+            (bar):
+            (baz):
+            (.bar):
+            (.baz):
+            * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Added.
+            (foo):
+            (fu):
+            (bar):
+            (baz):
+            (.bar):
+            (.baz):
+            * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Added.
+            (foo):
+            (fu):
+            (bar):
+            (baz):
+            (.bar):
+            (.baz):
+    
+    2014-06-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            Remove CompoundType and LeafType
+            https://bugs.webkit.org/show_bug.cgi?id=134037
+    
+            Reviewed by Filip Pizlo.
+    
+            We don't use them for anything. We'll replace them with a generic CellType type for all 
+            the objects that are JSCells, aren't JSObjects, and for which we generally don't care about 
+            their JSType at runtime.
+    
+            * llint/LLIntData.cpp:
+            (JSC::LLInt::Data::performAssertions):
+            * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+            (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
+            * runtime/Executable.h:
+            (JSC::ExecutableBase::createStructure):
+            (JSC::NativeExecutable::createStructure):
+            * runtime/JSPromiseDeferred.h:
+            (JSC::JSPromiseDeferred::createStructure):
+            * runtime/JSPromiseReaction.h:
+            (JSC::JSPromiseReaction::createStructure):
+            * runtime/JSPropertyNameIterator.h:
+            (JSC::JSPropertyNameIterator::createStructure):
+            * runtime/JSType.h:
+            * runtime/JSTypeInfo.h:
+            (JSC::TypeInfo::TypeInfo):
+            * runtime/MapData.h:
+            (JSC::MapData::createStructure):
+            * runtime/PropertyMapHashTable.h:
+            (JSC::PropertyTable::createStructure):
+            * runtime/RegExp.h:
+            (JSC::RegExp::createStructure):
+            * runtime/SparseArrayValueMap.cpp:
+            (JSC::SparseArrayValueMap::createStructure):
+            * runtime/Structure.cpp:
+            (JSC::Structure::Structure):
+            * runtime/StructureChain.h:
+            (JSC::StructureChain::createStructure):
+            * runtime/StructureRareData.cpp:
+            (JSC::StructureRareData::createStructure):
+            * runtime/SymbolTable.h:
+            (JSC::SymbolTable::createStructure):
+            * runtime/WeakMapData.h:
+            (JSC::WeakMapData::createStructure):
+    
+    2014-06-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] PutStructure and PhantomPutStructure shouldn't leave the world in a clobbered state
+            https://bugs.webkit.org/show_bug.cgi?id=134002
+    
+            Reviewed by Mark Hahnenberg.
+            
+            The effect of this bug was that if we had a PutStructure or PhantomPutStructure then any
+            JSConstants would be in a Clobbered state, so we wouldn't take advantage of our knowledge
+            of the structure if that structure was watchable.
+            
+            Also kill PhantomPutStructure.
+    
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            * dfg/DFGDoesGC.cpp:
+            (JSC::DFG::doesGC):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::visitChildren):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::hasTransition):
+            * dfg/DFGNodeType.h:
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            (JSC::DFG::PredictionPropagationPhase::propagate):
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGStructureAbstractValue.cpp:
+            (JSC::DFG::StructureAbstractValue::observeTransition):
+            (JSC::DFG::StructureAbstractValue::observeTransitions):
+            * dfg/DFGValidate.cpp:
+            (JSC::DFG::Validate::validate):
+            * dfg/DFGWatchableStructureWatchingPhase.cpp:
+            (JSC::DFG::WatchableStructureWatchingPhase::run):
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+            (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure): Deleted.
+    
+    2014-06-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
+            https://bugs.webkit.org/show_bug.cgi?id=133964
+    
+            Reviewed by Mark Hahnenberg.
+    
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::appendVariant):
+            (JSC::PutByIdStatus::computeForStubInfo):
+            * bytecode/PutByIdVariant.cpp:
+            (JSC::PutByIdVariant::oldStructureForTransition):
+            (JSC::PutByIdVariant::writesStructures):
+            (JSC::PutByIdVariant::reallocatesStorage):
+            (JSC::PutByIdVariant::attemptToMerge):
+            (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
+            (JSC::PutByIdVariant::dumpInContext):
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::PutByIdVariant):
+            (JSC::PutByIdVariant::replace):
+            (JSC::PutByIdVariant::transition):
+            (JSC::PutByIdVariant::structure):
+            (JSC::PutByIdVariant::oldStructure):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handlePutById):
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::visitChildren):
+            * dfg/DFGNode.cpp:
+            (JSC::DFG::MultiPutByOffsetData::writesStructures):
+            (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
+            * ftl/FTLAbbreviations.h:
+            (JSC::FTL::getLinkage):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+            (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
+    
+2014-07-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+        reland later.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::dumpInContext):
+        * bytecode/GetByIdVariant.h:
+        (JSC::GetByIdVariant::structureSet):
+        * bytecode/Instruction.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::appendVariant):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::dumpInContext):
+        (JSC::PutByIdVariant::oldStructureForTransition): Deleted.
+        (JSC::PutByIdVariant::writesStructures): Deleted.
+        (JSC::PutByIdVariant::reallocatesStorage): Deleted.
+        (JSC::PutByIdVariant::attemptToMerge): Deleted.
+        (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): Deleted.
+        * bytecode/PutByIdVariant.h:
+        (JSC::PutByIdVariant::PutByIdVariant):
+        (JSC::PutByIdVariant::replace):
+        (JSC::PutByIdVariant::transition):
+        (JSC::PutByIdVariant::structure):
+        (JSC::PutByIdVariant::oldStructure):
+        (JSC::PutByIdVariant::newStructure):
+        (JSC::PutByIdVariant::constantChecks):
+        * bytecode/StructureSet.cpp:
+        (JSC::StructureSet::filter): Deleted.
+        (JSC::StructureSet::filterArrayModes): Deleted.
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::onlyStructure):
+        * bytecode/ToThisStatus.cpp: Removed.
+        * bytecode/ToThisStatus.h: Removed.
+        * bytecode/TypeLocation.h: Removed.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode):
+        * debugger/DebuggerActivation.cpp: Added.
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::finishCreation):
+        (JSC::DebuggerActivation::visitChildren):
+        (JSC::DebuggerActivation::className):
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::deleteProperty):
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        (JSC::DebuggerActivation::defineOwnProperty):
+        * debugger/DebuggerActivation.h: Added.
+        (JSC::DebuggerActivation::create):
+        (JSC::DebuggerActivation::createStructure):
+        * debugger/DebuggerScope.cpp: Removed.
+        * debugger/DebuggerScope.h: Removed.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::changeStructure): Deleted.
+        (JSC::DFG::AbstractValue::contains): Deleted.
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::couldBeType):
+        (JSC::DFG::AbstractValue::isType):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        (JSC::DFG::ConstantFoldingPhase::addBaseCheck): Deleted.
+        (JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::visitChildren):
+        (JSC::DFG::Graph::freezeStrong):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::MultiPutByOffsetData::writesStructures):
+        (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::hasTransition):
+        (JSC::DFG::Node::convertToMultiGetByOffset): Deleted.
+        (JSC::DFG::Node::convertToMultiPutByOffset): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureAbstractValue.cpp:
+        (JSC::DFG::StructureAbstractValue::observeTransition):
+        (JSC::DFG::StructureAbstractValue::observeTransitions):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::onlyStructure):
+        (JSC::DFG::StructureAbstractValue::operator=): Deleted.
+        (JSC::DFG::StructureAbstractValue::set): Deleted.
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * dfg/DFGWatchableStructureWatchingPhase.cpp:
+        (JSC::DFG::WatchableStructureWatchingPhase::run):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::getLinkage): Deleted.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+        (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Runtime.json:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDumpTypesForAllVariables): Deleted.
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::putToScopeCommon): Deleted.
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+        (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        * runtime/HighFidelityLog.cpp: Removed.
+        * runtime/HighFidelityLog.h: Removed.
+        * runtime/HighFidelityTypeProfiler.cpp: Removed.
+        * runtime/HighFidelityTypeProfiler.h: Removed.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectCustomAccessor):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        * runtime/JSPromiseDeferred.h:
+        (JSC::JSPromiseDeferred::createStructure):
+        * runtime/JSPromiseReaction.h:
+        (JSC::JSPromiseReaction::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        * runtime/MapData.h:
+        (JSC::MapData::createStructure):
+        * runtime/Options.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::createStructure):
+        * runtime/RegExp.h:
+        (JSC::RegExp::createStructure):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::add):
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::pin):
+        (JSC::Structure::allocateRareData):
+        (JSC::Structure::cloneRareDataFrom):
+        (JSC::Structure::getConcurrently):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        (JSC::Structure::visitChildren):
+        (JSC::Structure::checkConsistency):
+        (JSC::Structure::toStructureShape): Deleted.
+        * runtime/Structure.h:
+        (JSC::Structure::isExtensible):
+        (JSC::Structure::didTransition):
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::hasBeenFlattenedBefore):
+        (JSC::Structure::propertyAccessesAreCacheable):
+        (JSC::Structure::previousID):
+        (JSC::Structure::hasGetterSetterProperties):
+        (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+        (JSC::Structure::hasCustomGetterSetterProperties):
+        (JSC::Structure::setHasCustomGetterSetterProperties):
+        (JSC::Structure::setContainsReadOnlyProperties):
+        (JSC::Structure::hasNonEnumerableProperties):
+        (JSC::Structure::disableSpecificFunctionTracking):
+        (JSC::Structure::objectToStringValue):
+        (JSC::Structure::setObjectToStringValue):
+        (JSC::Structure::staticFunctionsReified):
+        (JSC::Structure::setStaticFunctionsReified):
+        (JSC::Structure::transitionWatchpointSet):
+        (JSC::Structure::setPreviousID):
+        (JSC::Structure::clearPreviousID):
+        (JSC::Structure::previous):
+        (JSC::Structure::rareData):
+        (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): Deleted.
+        (JSC::Structure::setHasCustomGetterSetterPropertiesWithProtoCheck): Deleted.
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache):
+        (JSC::Structure::checkOffsetConsistency):
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::createStructure):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::cloneCapturedNames):
+        (JSC::SymbolTable::uniqueIDForVariable): Deleted.
+        (JSC::SymbolTable::uniqueIDForRegister): Deleted.
+        (JSC::SymbolTable::globalTypeSetForRegister): Deleted.
+        (JSC::SymbolTable::globalTypeSetForVariable): Deleted.
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::createStructure):
+        (JSC::SymbolTable::add):
+        (JSC::SymbolTable::set):
+        * runtime/TypeSet.cpp: Removed.
+        * runtime/TypeSet.h: Removed.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::getTypesForVariableInRange): Deleted.
+        (JSC::VM::updateHighFidelityTypeProfileState): Deleted.
+        (JSC::VM::dumpHighFidelityProfilingTypes): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
+        (JSC::VM::highFidelityLog): Deleted.
+        (JSC::VM::highFidelityTypeProfiler): Deleted.
+        (JSC::VM::nextLocation): Deleted.
+        (JSC::VM::getNextUniqueVariableID): Deleted.
+        * runtime/WeakMapData.h:
+        (JSC::WeakMapData::createStructure):
+        * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Removed.
+        * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Removed.
+        * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Removed.
+
+2014-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Attempt to fix non-Xcode platforms.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+
+2014-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix cloop.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::dumpChain):
+        (JSC::CodeBlock::printPutByIdCacheStatus):
+        * bytecode/StructureSet.cpp:
+        * bytecode/StructureSet.h:
+
+2014-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
+
+    2014-06-27  Michael Saboff  <msaboff@apple.com>
+    
+            Unreviewed build fix after r169795.
+    
+            Fixed ASSERT for 32 bit build.
+    
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+    
+    2014-06-24  Saam Barati  <sbarati@apple.com>
+    
+            Web Inspector: debugger should be able to show variable types
+            https://bugs.webkit.org/show_bug.cgi?id=133395
+    
+            Reviewed by Filip Pizlo.
+    
+            Increase the amount of type information the VM gathers when directed
+            to do so. This initial commit is working towards the goal of
+            capturing, and then showing (via the Web Inspector) type information for all
+            assignment and load operations. This patch doesn't have the feature fully 
+            implemented, but it ensures the VM has no performance regressions
+            unless the feature is specifically turned on.
+    
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/BytecodeList.json:
+            * bytecode/BytecodeUseDef.h:
+            (JSC::computeUsesForBytecodeOffset):
+            (JSC::computeDefsForBytecodeOffset):
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::dumpBytecode):
+            (JSC::CodeBlock::CodeBlock):
+            (JSC::CodeBlock::finalizeUnconditionally):
+            * bytecode/CodeBlock.h:
+            * bytecode/Instruction.h:
+            * bytecode/TypeLocation.h: Added.
+            (JSC::TypeLocation::TypeLocation):
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::emitMove):
+            (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
+            (JSC::BytecodeGenerator::emitPutToScope):
+            (JSC::BytecodeGenerator::emitPutById):
+            (JSC::BytecodeGenerator::emitPutByVal):
+            * bytecompiler/BytecodeGenerator.h:
+            (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity):
+            * bytecompiler/NodesCodegen.cpp:
+            (JSC::PostfixNode::emitResolve):
+            (JSC::PrefixNode::emitResolve):
+            (JSC::ReadModifyResolveNode::emitBytecode):
+            (JSC::AssignResolveNode::emitBytecode):
+            (JSC::ConstDeclNode::emitCodeSingle):
+            (JSC::ForInNode::emitBytecode):
+            * heap/Heap.cpp:
+            (JSC::Heap::collect):
+            * inspector/agents/InspectorRuntimeAgent.cpp:
+            (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange):
+            * inspector/agents/InspectorRuntimeAgent.h:
+            * inspector/protocol/Runtime.json:
+            * jsc.cpp:
+            (GlobalObject::finishCreation):
+            (functionDumpTypesForAllVariables):
+            * llint/LLIntSlowPaths.cpp:
+            (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+            (JSC::LLInt::putToScopeCommon):
+            * llint/LLIntSlowPaths.h:
+            * llint/LowLevelInterpreter.asm:
+            * runtime/HighFidelityLog.cpp: Added.
+            (JSC::HighFidelityLog::initializeHighFidelityLog):
+            (JSC::HighFidelityLog::~HighFidelityLog):
+            (JSC::HighFidelityLog::recordTypeInformationForLocation):
+            (JSC::HighFidelityLog::processHighFidelityLog):
+            (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
+            * runtime/HighFidelityLog.h: Added.
+            (JSC::HighFidelityLog::HighFidelityLog):
+            * runtime/HighFidelityTypeProfiler.cpp: Added.
+            (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange):
+            (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange):
+            (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange):
+            (JSC::HighFidelityTypeProfiler::insertNewLocation):
+            (JSC::HighFidelityTypeProfiler::getLocationBasedHash):
+            * runtime/HighFidelityTypeProfiler.h: Added.
+            * runtime/Options.h:
+            * runtime/Structure.cpp:
+            (JSC::Structure::toStructureShape):
+            * runtime/Structure.h:
+            * runtime/SymbolTable.cpp:
+            (JSC::SymbolTable::SymbolTable):
+            (JSC::SymbolTable::cloneCapturedNames):
+            (JSC::SymbolTable::uniqueIDForVariable):
+            (JSC::SymbolTable::uniqueIDForRegister):
+            (JSC::SymbolTable::globalTypeSetForRegister):
+            (JSC::SymbolTable::globalTypeSetForVariable):
+            * runtime/SymbolTable.h:
+            (JSC::SymbolTable::add):
+            (JSC::SymbolTable::set):
+            * runtime/TypeSet.cpp: Added.
+            (JSC::TypeSet::TypeSet):
+            (JSC::TypeSet::getRuntimeTypeForValue):
+            (JSC::TypeSet::addTypeForValue):
+            (JSC::TypeSet::removeDuplicatesInStructureHistory):
+            (JSC::TypeSet::seenTypes):
+            (JSC::TypeSet::dumpSeenTypes):
+            (JSC::StructureShape::StructureShape):
+            (JSC::StructureShape::markAsFinal):
+            (JSC::StructureShape::addProperty):
+            (JSC::StructureShape::propertyHash):
+            (JSC::StructureShape::leastUpperBound):
+            (JSC::StructureShape::stringRepresentation):
+            * runtime/TypeSet.h: Added.
+            (JSC::StructureShape::create):
+            (JSC::TypeSet::create):
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            (JSC::VM::getTypesForVariableInRange):
+            (JSC::VM::updateHighFidelityTypeProfileState):
+            (JSC::VM::dumpHighFidelityProfilingTypes):
+            * runtime/VM.h:
+            (JSC::VM::isProfilingTypesWithHighFidelity):
+            (JSC::VM::highFidelityLog):
+            (JSC::VM::highFidelityTypeProfiler):
+            (JSC::VM::nextLocation):
+            (JSC::VM::getNextUniqueVariableID):
+    
+    2014-06-26  Mark Lam  <mark.lam@apple.com>
+    
+            Remove unused instantiation of the WithScope structure.
+            <https://webkit.org/b/134331>
+    
+            Reviewed by Oliver Hunt.
+    
+            The WithScope structure instance is the VM is unused, and is now removed.
+    
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+    
+    2014-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            Structure bit fields should have a consistent format
+            https://bugs.webkit.org/show_bug.cgi?id=134307
+    
+            Reviewed by Filip Pizlo.
+    
+            Currently we use C-style bit fields for a number of member variables in Structure to save space. 
+            This makes it difficult to load these fields in the JIT. We should instead use our own bitfield 
+            format to make it easy to load and test these variables in JIT code.
+    
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::putDirectNonIndexAccessor):
+            (JSC::JSObject::reifyStaticFunctionsForDelete):
+            * runtime/Structure.cpp:
+            (JSC::StructureTransitionTable::contains):
+            (JSC::StructureTransitionTable::get):
+            (JSC::StructureTransitionTable::add):
+            (JSC::Structure::Structure):
+            (JSC::Structure::materializePropertyMap):
+            (JSC::Structure::addPropertyTransition):
+            (JSC::Structure::despecifyFunctionTransition):
+            (JSC::Structure::toDictionaryTransition):
+            (JSC::Structure::freezeTransition):
+            (JSC::Structure::preventExtensionsTransition):
+            (JSC::Structure::takePropertyTableOrCloneIfPinned):
+            (JSC::Structure::nonPropertyTransition):
+            (JSC::Structure::flattenDictionaryStructure):
+            (JSC::Structure::addPropertyWithoutTransition):
+            (JSC::Structure::pin):
+            (JSC::Structure::allocateRareData):
+            (JSC::Structure::cloneRareDataFrom):
+            (JSC::Structure::getConcurrently):
+            (JSC::Structure::putSpecificValue):
+            (JSC::Structure::getPropertyNamesFromStructure):
+            (JSC::Structure::visitChildren):
+            (JSC::Structure::checkConsistency):
+            * runtime/Structure.h:
+            (JSC::Structure::isExtensible):
+            (JSC::Structure::isDictionary):
+            (JSC::Structure::isUncacheableDictionary):
+            (JSC::Structure::propertyAccessesAreCacheable):
+            (JSC::Structure::previousID):
+            (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck):
+            (JSC::Structure::setContainsReadOnlyProperties):
+            (JSC::Structure::disableSpecificFunctionTracking):
+            (JSC::Structure::objectToStringValue):
+            (JSC::Structure::setObjectToStringValue):
+            (JSC::Structure::setPreviousID):
+            (JSC::Structure::clearPreviousID):
+            (JSC::Structure::previous):
+            (JSC::Structure::rareData):
+            (JSC::Structure::didTransition): Deleted.
+            (JSC::Structure::hasGetterSetterProperties): Deleted.
+            (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto): Deleted.
+            (JSC::Structure::setHasGetterSetterProperties): Deleted.
+            (JSC::Structure::hasNonEnumerableProperties): Deleted.
+            (JSC::Structure::staticFunctionsReified): Deleted.
+            (JSC::Structure::setStaticFunctionsReified): Deleted.
+            * runtime/StructureInlines.h:
+            (JSC::Structure::setEnumerationCache):
+            (JSC::Structure::enumerationCache):
+            (JSC::Structure::checkOffsetConsistency):
+    
+    2014-06-24  Mark Lam  <mark.lam@apple.com>
+    
+            [ftlopt] Renamed DebuggerActivation to DebuggerScope.
+            <https://webkit.org/b/134273>
+    
+            Reviewed by Michael Saboff.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * debugger/DebuggerActivation.cpp: Removed.
+            * debugger/DebuggerActivation.h: Removed.
+            * debugger/DebuggerScope.cpp: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp.
+            (JSC::DebuggerScope::DebuggerScope):
+            (JSC::DebuggerScope::finishCreation):
+            (JSC::DebuggerScope::visitChildren):
+            (JSC::DebuggerScope::className):
+            (JSC::DebuggerScope::getOwnPropertySlot):
+            (JSC::DebuggerScope::put):
+            (JSC::DebuggerScope::deleteProperty):
+            (JSC::DebuggerScope::getOwnPropertyNames):
+            (JSC::DebuggerScope::defineOwnProperty):
+            (JSC::DebuggerActivation::DebuggerActivation): Deleted.
+            (JSC::DebuggerActivation::finishCreation): Deleted.
+            (JSC::DebuggerActivation::visitChildren): Deleted.
+            (JSC::DebuggerActivation::className): Deleted.
+            (JSC::DebuggerActivation::getOwnPropertySlot): Deleted.
+            (JSC::DebuggerActivation::put): Deleted.
+            (JSC::DebuggerActivation::deleteProperty): Deleted.
+            (JSC::DebuggerActivation::getOwnPropertyNames): Deleted.
+            (JSC::DebuggerActivation::defineOwnProperty): Deleted.
+            * debugger/DebuggerScope.h: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h.
+            (JSC::DebuggerScope::create):
+            (JSC::DebuggerActivation::create): Deleted.
+            * runtime/VM.cpp:
+            (JSC::VM::VM):
+            * runtime/VM.h:
+    
+    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] PutByIdFlush can also be converted to a PutByOffset so don't assert otherwise
+            https://bugs.webkit.org/show_bug.cgi?id=134265
+    
+            Reviewed by Geoffrey Garen.
+            
+            More assertion fallout from the PutById folding work.
+    
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::convertToPutByOffset):
+    
+    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] GC should notify us if it resets to_this
+            https://bugs.webkit.org/show_bug.cgi?id=128231
+    
+            Reviewed by Geoffrey Garen.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/BytecodeList.json:
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::dumpBytecode):
+            (JSC::CodeBlock::finalizeUnconditionally):
+            * bytecode/Instruction.h:
+            * bytecode/ToThisStatus.cpp: Added.
+            (JSC::merge):
+            (WTF::printInternal):
+            * bytecode/ToThisStatus.h: Added.
+            * bytecompiler/BytecodeGenerator.cpp:
+            (JSC::BytecodeGenerator::BytecodeGenerator):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * llint/LowLevelInterpreter32_64.asm:
+            * llint/LowLevelInterpreter64.asm:
+            * runtime/CommonSlowPaths.cpp:
+            (JSC::SLOW_PATH_DECL):
+    
+    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
+            https://bugs.webkit.org/show_bug.cgi?id=134256
+    
+            Reviewed by Michael Saboff.
+            
+            This isn't testable right now (i.e. it's benign) but we should get it right anyway. The
+            point is to be able to precisely model what goes on in the snippets of code between a
+            side-effect and an InvalidationPoint.
+            
+            This patch also cleans up onlyStructure() by delegating more work to
+            StructureSet::onlyStructure().
+    
+            * dfg/DFGStructureAbstractValue.h:
+            (JSC::DFG::StructureAbstractValue::onlyStructure):
+    
+    2014-06-24  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt][REGRESSION] PutById AI is introducing watchable structures without watching them
+            https://bugs.webkit.org/show_bug.cgi?id=134260
+    
+            Reviewed by Geoffrey Garen.
+            
+            This was causing loads of assertion failures in debug builds.
+    
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+    
+    2014-06-21  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
+            https://bugs.webkit.org/show_bug.cgi?id=134090
+    
+            Reviewed by Oliver Hunt.
+            
+            This pretty much finishes off the work to eliminate the special-casing of singleton
+            structure sets by making it possible to fold GetById and PutById to various polymorphic
+            forms of the ByOffset nodes.
+            
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::computeForStubInfo):
+            (JSC::GetByIdStatus::computeFor):
+            * bytecode/GetByIdStatus.h:
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::computeFor):
+            * bytecode/PutByIdStatus.h:
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::constantChecks):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            (JSC::DFG::ConstantFoldingPhase::addChecks):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::convertToMultiGetByOffset):
+            (JSC::DFG::Node::convertToMultiPutByOffset):
+            * dfg/DFGSpeculativeJIT64.cpp: Also convert all release assertions to DFG assertions in this file, because I was hitting some of them while debugging.
+            (JSC::DFG::SpeculativeJIT::fillJSValue):
+            (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+            (JSC::DFG::SpeculativeJIT::emitCall):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+            (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+            (JSC::DFG::SpeculativeJIT::emitBranch):
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGStructureAbstractValue.h:
+            (JSC::DFG::StructureAbstractValue::set):
+    
+    2014-06-19  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] StructureSet::onlyStructure() should return nullptr if it's not a singleton (instead of asserting)
+            https://bugs.webkit.org/show_bug.cgi?id=134077
+    
+            Reviewed by Sam Weinig.
+            
+            This makes StructureSet and StructureAbstractValue more consistent and fixes a debug assert
+            in the abstract interpreter.
+    
+            * bytecode/StructureSet.h:
+            (JSC::StructureSet::onlyStructure):
+    
+    2014-06-18  Filip Pizlo  <fpizlo@apple.com>
+    
+            DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
+            https://bugs.webkit.org/show_bug.cgi?id=133918
+    
+            Reviewed by Mark Hahnenberg.
+            
+            This also adds pruning of PutStructure, since I basically had no choice but
+            to implement such logic within MultiPutByOffset.
+            
+            Also adds a bunch of PutById cache status dumping to bytecode dumping.
+    
+            * bytecode/GetByIdVariant.cpp:
+            (JSC::GetByIdVariant::dumpInContext):
+            * bytecode/GetByIdVariant.h:
+            (JSC::GetByIdVariant::structureSet):
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::oldStructure):
+            * bytecode/StructureSet.cpp:
+            (JSC::StructureSet::filter):
+            (JSC::StructureSet::filterArrayModes):
+            * bytecode/StructureSet.h:
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGAbstractValue.cpp:
+            (JSC::DFG::AbstractValue::changeStructure):
+            (JSC::DFG::AbstractValue::contains):
+            * dfg/DFGAbstractValue.h:
+            (JSC::DFG::AbstractValue::couldBeType):
+            (JSC::DFG::AbstractValue::isType):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::freezeStrong):
+            * dfg/DFGGraph.h:
+            * dfg/DFGStructureAbstractValue.h:
+            (JSC::DFG::StructureAbstractValue::operator=):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+            * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Added.
+            (foo):
+            (fu):
+            (bar):
+            (baz):
+            (.bar):
+            (.baz):
+            * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Added.
+            (foo):
+            (fu):
+            (bar):
+            (baz):
+            (.bar):
+            (.baz):
+            * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Added.
+            (foo):
+            (fu):
+            (bar):
+            (baz):
+            (.bar):
+            (.baz):
+    
+    2014-06-18  Mark Hahnenberg  <mhahnenberg@apple.com>
+    
+            Remove CompoundType and LeafType
+            https://bugs.webkit.org/show_bug.cgi?id=134037
+    
+            Reviewed by Filip Pizlo.
+    
+            We don't use them for anything. We'll replace them with a generic CellType type for all 
+            the objects that are JSCells, aren't JSObjects, and for which we generally don't care about 
+            their JSType at runtime.
+    
+            * llint/LLIntData.cpp:
+            (JSC::LLInt::Data::performAssertions):
+            * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+            (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
+            * runtime/Executable.h:
+            (JSC::ExecutableBase::createStructure):
+            (JSC::NativeExecutable::createStructure):
+            * runtime/JSPromiseDeferred.h:
+            (JSC::JSPromiseDeferred::createStructure):
+            * runtime/JSPromiseReaction.h:
+            (JSC::JSPromiseReaction::createStructure):
+            * runtime/JSPropertyNameIterator.h:
+            (JSC::JSPropertyNameIterator::createStructure):
+            * runtime/JSType.h:
+            * runtime/JSTypeInfo.h:
+            (JSC::TypeInfo::TypeInfo):
+            * runtime/MapData.h:
+            (JSC::MapData::createStructure):
+            * runtime/PropertyMapHashTable.h:
+            (JSC::PropertyTable::createStructure):
+            * runtime/RegExp.h:
+            (JSC::RegExp::createStructure):
+            * runtime/SparseArrayValueMap.cpp:
+            (JSC::SparseArrayValueMap::createStructure):
+            * runtime/Structure.cpp:
+            (JSC::Structure::Structure):
+            * runtime/StructureChain.h:
+            (JSC::StructureChain::createStructure):
+            * runtime/StructureRareData.cpp:
+            (JSC::StructureRareData::createStructure):
+            * runtime/SymbolTable.h:
+            (JSC::SymbolTable::createStructure):
+            * runtime/WeakMapData.h:
+            (JSC::WeakMapData::createStructure):
+    
+    2014-06-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] PutStructure and PhantomPutStructure shouldn't leave the world in a clobbered state
+            https://bugs.webkit.org/show_bug.cgi?id=134002
+    
+            Reviewed by Mark Hahnenberg.
+            
+            The effect of this bug was that if we had a PutStructure or PhantomPutStructure then any
+            JSConstants would be in a Clobbered state, so we wouldn't take advantage of our knowledge
+            of the structure if that structure was watchable.
+            
+            Also kill PhantomPutStructure.
+    
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            * dfg/DFGDoesGC.cpp:
+            (JSC::DFG::doesGC):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::visitChildren):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::hasTransition):
+            * dfg/DFGNodeType.h:
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            (JSC::DFG::PredictionPropagationPhase::propagate):
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGStructureAbstractValue.cpp:
+            (JSC::DFG::StructureAbstractValue::observeTransition):
+            (JSC::DFG::StructureAbstractValue::observeTransitions):
+            * dfg/DFGValidate.cpp:
+            (JSC::DFG::Validate::validate):
+            * dfg/DFGWatchableStructureWatchingPhase.cpp:
+            (JSC::DFG::WatchableStructureWatchingPhase::run):
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+            (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure): Deleted.
+    
+    2014-06-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
+            https://bugs.webkit.org/show_bug.cgi?id=133964
+    
+            Reviewed by Mark Hahnenberg.
+    
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::appendVariant):
+            (JSC::PutByIdStatus::computeForStubInfo):
+            * bytecode/PutByIdVariant.cpp:
+            (JSC::PutByIdVariant::oldStructureForTransition):
+            (JSC::PutByIdVariant::writesStructures):
+            (JSC::PutByIdVariant::reallocatesStorage):
+            (JSC::PutByIdVariant::attemptToMerge):
+            (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
+            (JSC::PutByIdVariant::dumpInContext):
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::PutByIdVariant):
+            (JSC::PutByIdVariant::replace):
+            (JSC::PutByIdVariant::transition):
+            (JSC::PutByIdVariant::structure):
+            (JSC::PutByIdVariant::oldStructure):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handlePutById):
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::visitChildren):
+            * dfg/DFGNode.cpp:
+            (JSC::DFG::MultiPutByOffsetData::writesStructures):
+            (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
+            * ftl/FTLAbbreviations.h:
+            (JSC::FTL::getLinkage):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+            (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
+    
+2014-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Add an option to disable native call inlining. Disable it for now to see how it
+        affects the bots.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        * runtime/Options.h:
+
+2014-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix cloop.
+
+        * dfg/DFGMayExit.cpp:
+
+2014-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge r169795, r169819, r169864, r169902, r169949, r169950, r170016, r170017, r170060, r170064 from ftlopt.
+
+    2014-06-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Fold constant Phis
+            https://bugs.webkit.org/show_bug.cgi?id=133967
+    
+            Reviewed by Mark Hahnenberg.
+            
+            It's surprising but we didn't really do this before. Or, rather, we only did it
+            incidentally when we would likely crash if it ever happened.
+            
+            Making this work required cleaning up the validater a bit, so I did that too. I also added
+            mayExit() validation for nodes that didn't have origin.forExit (i.e. nodes that end up in
+            the Phi header of basic blocks). But this required beefing up mayExit() a bit.
+    
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGAdjacencyList.h:
+            (JSC::DFG::AdjacencyList::isEmpty):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::run):
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::fixUpsilons):
+            * dfg/DFGInPlaceAbstractState.h:
+            * dfg/DFGLICMPhase.cpp:
+            (JSC::DFG::LICMPhase::run):
+            (JSC::DFG::LICMPhase::attemptHoist):
+            * dfg/DFGMayExit.cpp:
+            (JSC::DFG::mayExit):
+            * dfg/DFGValidate.cpp:
+            (JSC::DFG::Validate::validate):
+            (JSC::DFG::Validate::validateSSA):
+    
+    2014-06-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Get rid of NodeDoesNotExit and also get rid of StoreEliminationPhase
+            https://bugs.webkit.org/show_bug.cgi?id=133985
+    
+            Reviewed by Michael Saboff and Mark Hahnenberg.
+            
+            Store elimination phase has never been very profitable, and now that LLVM can do dead
+            store elimination for us, this phase is just completely pointless.
+            
+            This phase is also the primary user of NodeDoesNotExit, which is a flag that the CFA
+            computes. It computes it poorly and we often get bugs in it. It's also a lot of code to
+            maintain.
+            
+            This patch does introduce a new mayExit() calculator that is independent of the CFA and
+            should be enough for most of the previous NodeDoesNotExit users. Currently it's only used
+            for assertions in the DFG backend, but we could use it if we ever brought back any of the
+            other optimizations that previously relied upon NodeDoesNotExit.
+            
+            This is performance-neutral, except for SunSpider, where it's a speed-up.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * dfg/DFGAbstractInterpreter.h:
+            (JSC::DFG::AbstractInterpreter::filterEdgeByUse):
+            (JSC::DFG::AbstractInterpreter::filterByType):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::startExecuting):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::CSEPhase::CSEPhase):
+            (JSC::DFG::CSEPhase::invalidationPointElimination):
+            (JSC::DFG::CSEPhase::setLocalStoreElimination):
+            (JSC::DFG::CSEPhase::performNodeCSE):
+            (JSC::DFG::CSEPhase::performBlockCSE):
+            (JSC::DFG::performCSE):
+            (JSC::DFG::CSEPhase::globalVarStoreElimination): Deleted.
+            (JSC::DFG::CSEPhase::scopedVarStoreElimination): Deleted.
+            (JSC::DFG::CSEPhase::putStructureStoreElimination): Deleted.
+            (JSC::DFG::CSEPhase::putByOffsetStoreElimination): Deleted.
+            (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult): Deleted.
+            (JSC::DFG::performStoreElimination): Deleted.
+            * dfg/DFGCSEPhase.h:
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::resetExitStates): Deleted.
+            * dfg/DFGGraph.h:
+            * dfg/DFGMayExit.cpp: Added.
+            (JSC::DFG::mayExit):
+            * dfg/DFGMayExit.h: Added.
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::mergeFlags):
+            (JSC::DFG::Node::filterFlags):
+            (JSC::DFG::Node::setCanExit): Deleted.
+            (JSC::DFG::Node::canExit): Deleted.
+            * dfg/DFGNodeFlags.cpp:
+            (JSC::DFG::dumpNodeFlags):
+            * dfg/DFGNodeFlags.h:
+            * dfg/DFGNodeType.h:
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl):
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+            (JSC::DFG::SpeculativeJIT::bail):
+            (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+    
+    2014-06-15  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Remove the DFG optimization fixpoint and remove some obvious reasons why we previously benefited from it
+            https://bugs.webkit.org/show_bug.cgi?id=133931
+    
+            Reviewed by Oliver Hunt.
+    
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Trigger constant-folding for GetMyArgumentByVal (which means turning it into GetLocalUnlinked) and correct the handling of Upsilon so we don't fold them away.
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants): Implement constant-folding for GetMyArgumentByVal.
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl): Remove the fixpoint.
+    
+    2014-06-15  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG OSR entry should have a crystal-clear story for when it's safe to enter at a block with a set of values
+            https://bugs.webkit.org/show_bug.cgi?id=133935
+    
+            Reviewed by Oliver Hunt.
+    
+            * bytecode/Operands.h:
+            (JSC::Operands::Operands):
+            (JSC::Operands::ensureLocals):
+            * dfg/DFGAbstractValue.cpp:
+            (JSC::DFG::AbstractValue::filter): Now we can compute intersections of abstract values!
+            * dfg/DFGAbstractValue.h:
+            (JSC::DFG::AbstractValue::makeFullTop): Completeness.
+            (JSC::DFG::AbstractValue::bytecodeTop): Completeness.
+            (JSC::DFG::AbstractValue::fullTop): Completeness. We end up using this one.
+            * dfg/DFGBasicBlock.cpp:
+            (JSC::DFG::BasicBlock::BasicBlock):
+            (JSC::DFG::BasicBlock::ensureLocals):
+            * dfg/DFGBasicBlock.h: Remember the intersection of all things ever proven.
+            * dfg/DFGCFAPhase.cpp:
+            (JSC::DFG::CFAPhase::run): Compute the intersection.
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants): No need for the weirdo merge check since this fixes the root of the problem.
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::dumpBlockHeader): Better dumping.
+            (JSC::DFG::Graph::dump): Better dumping.
+            * dfg/DFGJITCompiler.h:
+            (JSC::DFG::JITCompiler::noticeOSREntry): Use the intersected abstract value.
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::compileCurrentBlock): Assert if the intersected state indicates the block shouldn't execute.
+    
+    2014-06-12  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
+            https://bugs.webkit.org/show_bug.cgi?id=133821
+    
+            Reviewed by Mark Hahnenberg.
+            
+            This allows us to efficiently cache accesses that differ only in the prototypes on the path
+            from the base to the prototype that has the field.
+            
+            It also simplifies a bunch of code - IntendedStructureChain is now just an intermediate
+            data structure.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/ConstantStructureCheck.cpp: Added.
+            (JSC::ConstantStructureCheck::dumpInContext):
+            (JSC::ConstantStructureCheck::dump):
+            (JSC::structureFor):
+            (JSC::areCompatible):
+            (JSC::mergeInto):
+            * bytecode/ConstantStructureCheck.h: Added.
+            (JSC::ConstantStructureCheck::ConstantStructureCheck):
+            (JSC::ConstantStructureCheck::operator!):
+            (JSC::ConstantStructureCheck::constant):
+            (JSC::ConstantStructureCheck::structure):
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::computeForStubInfo):
+            * bytecode/GetByIdVariant.cpp:
+            (JSC::GetByIdVariant::GetByIdVariant):
+            (JSC::GetByIdVariant::operator=):
+            (JSC::GetByIdVariant::attemptToMerge):
+            (JSC::GetByIdVariant::dumpInContext):
+            * bytecode/GetByIdVariant.h:
+            (JSC::GetByIdVariant::constantChecks):
+            (JSC::GetByIdVariant::alternateBase):
+            (JSC::GetByIdVariant::GetByIdVariant): Deleted.
+            (JSC::GetByIdVariant::chain): Deleted.
+            * bytecode/PutByIdVariant.cpp:
+            (JSC::PutByIdVariant::dumpInContext):
+            * bytecode/PutByIdVariant.h:
+            (JSC::PutByIdVariant::transition):
+            (JSC::PutByIdVariant::constantChecks):
+            (JSC::PutByIdVariant::structureChain): Deleted.
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::emitChecks):
+            (JSC::DFG::ByteCodeParser::handleGetById):
+            (JSC::DFG::ByteCodeParser::handlePutById):
+            (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck): Deleted.
+            (JSC::DFG::ByteCodeParser::structureChainIsStillValid): Deleted.
+            (JSC::DFG::ByteCodeParser::emitPrototypeChecks): Deleted.
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+            * dfg/DFGDesiredStructureChains.cpp: Removed.
+            * dfg/DFGDesiredStructureChains.h: Removed.
+            * dfg/DFGGraph.h:
+            (JSC::DFG::Graph::watchpoints):
+            (JSC::DFG::Graph::chains): Deleted.
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::isStillValid):
+            (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+            (JSC::DFG::Plan::cancel):
+            * dfg/DFGPlan.h:
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+            * runtime/IntendedStructureChain.cpp:
+            (JSC::IntendedStructureChain::gatherChecks):
+            * runtime/IntendedStructureChain.h:
+            (JSC::IntendedStructureChain::at):
+            (JSC::IntendedStructureChain::operator[]):
+    
+    2014-06-12  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Constant folding and strength reduction should work in SSA
+            https://bugs.webkit.org/show_bug.cgi?id=133839
+    
+            Reviewed by Oliver Hunt.
+    
+            * dfg/DFGAtTailAbstractState.cpp:
+            (JSC::DFG::AtTailAbstractState::AtTailAbstractState):
+            (JSC::DFG::AtTailAbstractState::forNode):
+            * dfg/DFGAtTailAbstractState.h:
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::convertToConstant):
+            * dfg/DFGIntegerCheckCombiningPhase.cpp:
+            (JSC::DFG::IntegerCheckCombiningPhase::rangeKeyAndAddend): Fix an unrelated regression that this uncovered.
+            * dfg/DFGLICMPhase.cpp:
+            (JSC::DFG::LICMPhase::LICMPhase):
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl):
+    
+    2014-06-11  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base
+            https://bugs.webkit.org/show_bug.cgi?id=133751
+    
+            Reviewed by Mark Hahnenberg.
+    
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::appendVariant):
+            (JSC::GetByIdStatus::computeForStubInfo):
+            * bytecode/GetByIdVariant.cpp:
+            (JSC::GetByIdVariant::attemptToMerge):
+            * bytecode/GetByIdVariant.h:
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::computeFor):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::emitPrototypeChecks):
+            (JSC::DFG::ByteCodeParser::handleGetById):
+            (JSC::DFG::ByteCodeParser::handlePutById):
+            * runtime/IntendedStructureChain.cpp:
+            (JSC::IntendedStructureChain::IntendedStructureChain):
+            (JSC::IntendedStructureChain::isStillValid):
+            (JSC::IntendedStructureChain::isNormalized):
+            (JSC::IntendedStructureChain::terminalPrototype):
+            (JSC::IntendedStructureChain::operator==):
+            (JSC::IntendedStructureChain::visitChildren):
+            (JSC::IntendedStructureChain::dumpInContext):
+            (JSC::IntendedStructureChain::chain): Deleted.
+            * runtime/IntendedStructureChain.h:
+            (JSC::IntendedStructureChain::prototype):
+            (JSC::IntendedStructureChain::operator!=):
+            (JSC::IntendedStructureChain::head): Deleted.
+    
+    2014-06-11  Matthew Mirman  <mmirman@apple.com>
+    
+           Readded native calling to the FTL and Split the DFG nodes 
+           Call and Construct into NativeCall and NativeConstruct 
+           to better represent their semantics.
+           https://bugs.webkit.org/show_bug.cgi?id=133660
+    
+           Reviewed by Filip Pizlo.
+    
+           * dfg/DFGAbstractInterpreterInlines.h:
+           (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): 
+           Added NativeCall and NativeConstruct case
+           * dfg/DFGByteCodeParser.cpp:
+           (JSC::DFG::ByteCodeParser::addCall): added NativeCall case. 
+           (JSC::DFG::ByteCodeParser::handleCall): 
+           set to return NativeCall or NativeConstruct instead of Call or Construct
+           in the presence of a native function.
+           * dfg/DFGClobberize.h:
+           (JSC::DFG::clobberize): added NativeCall and NativeConstruct case.
+           * dfg/DFGDoesGC.cpp:
+           (JSC::DFG::doesGC): added NativeCall and NativeConstruct case.
+           * dfg/DFGFixupPhase.cpp:
+           (JSC::DFG::FixupPhase::fixupNode): added NativeCall and NativeConstruct case.
+           * dfg/DFGNode.h:
+           (JSC::DFG::Node::hasHeapPrediction): added NativeCall and NativeConstruct case.
+           (JSC::DFG::Node::canBeKnownFunction): changed to NativeCall and NativeConstruct.
+           (JSC::DFG::Node::hasKnownFunction): changed to NativeCall and NativeConstruct.
+           * dfg/DFGNodeType.h: added NativeCall and NativeConstruct.
+           * dfg/DFGPredictionPropagationPhase.cpp:
+           (JSC::DFG::PredictionPropagationPhase::propagate): added NativeCall and NativeConstruct case.
+           * dfg/DFGSafeToExecute.h:
+           (JSC::DFG::safeToExecute): added NativeCall and NativeConstruct case.
+           * dfg/DFGSpeculativeJIT32_64.cpp:
+           (JSC::DFG::SpeculativeJIT::emitCall): ditto
+           (JSC::DFG::SpeculativeJIT::compile): ditto
+           * dfg/DFGSpeculativeJIT64.cpp:
+           (JSC::DFG::SpeculativeJIT::emitCall): ditto
+           (JSC::DFG::SpeculativeJIT::compile): ditto
+           * ftl/FTLCapabilities.cpp:
+           (JSC::FTL::canCompile): ditto
+           * ftl/FTLLowerDFGToLLVM.cpp:  
+           (JSC::FTL::LowerDFGToLLVM::lower): ditto
+           (JSC::FTL::LowerDFGToLLVM::compileNode): ditto.
+           (JSC::FTL::LowerDFGToLLVM::compileNativeCallOrConstruct): Added.
+           (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct): removed NativeCall and NativeConstruct functionality.
+           (JSC::FTL::LowerDFGToLLVM::didOverflowStack): added NativeCall and NativeConstruct case.
+           * runtime/JSCJSValue.h: added JS_EXPORT_PRIVATE to toInteger as it is apparently needed.
+           
+    2014-06-11  Matthew Mirman  <mmirman@apple.com>
+    
+            Ensured Native Calls and Construct and associated checks 
+            are only emitted during ftl mode.
+            https://bugs.webkit.org/show_bug.cgi?id=133718
+            
+            Reviewed by Filip Pizlo.
+            
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handleCall): Added check for ftl mode 
+            before attaching the native function to Call or Construct.
+            
+    2014-06-10  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG should use its own notion of JSValue, which we should call FrozenValue, that will carry around a copy of its structure
+            https://bugs.webkit.org/show_bug.cgi?id=133426
+    
+            Reviewed by Geoffrey Garen.
+            
+            The impetus for this was to provide some sense and reason to race conditions arising from
+            cell constants having their structure changed on the main thread - this is harmess because
+            we defend against it, but when it goes wrong, it can be difficult to reproduce because it
+            requires a race. Giving the DFG the ability to "freeze" a cell's structure fixes this.
+            
+            But this patch goes quite a bit further, and completely rationalizes how the DFG reasons
+            about constants. It no longer relies on the CodeBlock constant pool at all, which allows
+            for a more object-oriented approach: for example a Node that has a constant can tell you
+            what constant it has without needing a CodeBlock.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/CallLinkStatus.cpp:
+            (JSC::CallLinkStatus::computeExitSiteData):
+            * bytecode/ExitKind.cpp:
+            (JSC::exitKindToString):
+            (JSC::exitKindIsCountable):
+            * bytecode/ExitKind.h:
+            (JSC::isWatchpoint): Deleted.
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::hasExitSite):
+            * bytecode/PutByIdStatus.cpp:
+            (JSC::PutByIdStatus::hasExitSite):
+            * dfg/DFGAbstractInterpreter.h:
+            (JSC::DFG::AbstractInterpreter::filterByValue):
+            (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
+            (JSC::DFG::AbstractInterpreter::setConstant):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::filterByValue):
+            * dfg/DFGAbstractValue.cpp:
+            (JSC::DFG::AbstractValue::setOSREntryValue):
+            (JSC::DFG::AbstractValue::set):
+            (JSC::DFG::AbstractValue::filterByValue):
+            (JSC::DFG::AbstractValue::setMostSpecific): Deleted.
+            * dfg/DFGAbstractValue.h:
+            * dfg/DFGArgumentsSimplificationPhase.cpp:
+            (JSC::DFG::ArgumentsSimplificationPhase::run):
+            * dfg/DFGBackwardsPropagationPhase.cpp:
+            (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
+            (JSC::DFG::BackwardsPropagationPhase::isNotPosZero):
+            (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoForConstant):
+            (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::ByteCodeParser):
+            (JSC::DFG::ByteCodeParser::getDirect):
+            (JSC::DFG::ByteCodeParser::get):
+            (JSC::DFG::ByteCodeParser::getLocal):
+            (JSC::DFG::ByteCodeParser::setLocal):
+            (JSC::DFG::ByteCodeParser::setArgument):
+            (JSC::DFG::ByteCodeParser::jsConstant):
+            (JSC::DFG::ByteCodeParser::weakJSConstant):
+            (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck):
+            (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
+            (JSC::DFG::ByteCodeParser::handleCall):
+            (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+            (JSC::DFG::ByteCodeParser::handleInlining):
+            (JSC::DFG::ByteCodeParser::handleMinMax):
+            (JSC::DFG::ByteCodeParser::handleIntrinsic):
+            (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+            (JSC::DFG::ByteCodeParser::handleGetById):
+            (JSC::DFG::ByteCodeParser::prepareToParseBlock):
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            (JSC::DFG::ByteCodeParser::buildOperandMapsIfNecessary):
+            (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+            (JSC::DFG::ByteCodeParser::parseCodeBlock):
+            (JSC::DFG::ByteCodeParser::addConstant): Deleted.
+            (JSC::DFG::ByteCodeParser::getJSConstantForValue): Deleted.
+            (JSC::DFG::ByteCodeParser::getJSConstant): Deleted.
+            (JSC::DFG::ByteCodeParser::isJSConstant): Deleted.
+            (JSC::DFG::ByteCodeParser::isInt32Constant): Deleted.
+            (JSC::DFG::ByteCodeParser::valueOfJSConstant): Deleted.
+            (JSC::DFG::ByteCodeParser::valueOfInt32Constant): Deleted.
+            (JSC::DFG::ByteCodeParser::constantUndefined): Deleted.
+            (JSC::DFG::ByteCodeParser::constantNull): Deleted.
+            (JSC::DFG::ByteCodeParser::one): Deleted.
+            (JSC::DFG::ByteCodeParser::constantNaN): Deleted.
+            (JSC::DFG::ByteCodeParser::cellConstant): Deleted.
+            (JSC::DFG::ByteCodeParser::inferredConstant): Deleted.
+            (JSC::DFG::ByteCodeParser::ConstantRecord::ConstantRecord): Deleted.
+            * dfg/DFGCFGSimplificationPhase.cpp:
+            (JSC::DFG::CFGSimplificationPhase::run):
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::CSEPhase::constantCSE):
+            (JSC::DFG::CSEPhase::checkFunctionElimination):
+            (JSC::DFG::CSEPhase::performNodeCSE):
+            (JSC::DFG::CSEPhase::weakConstantCSE): Deleted.
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            * dfg/DFGCommon.h:
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+            (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+            * dfg/DFGDoesGC.cpp:
+            (JSC::DFG::doesGC):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            (JSC::DFG::FixupPhase::fixupMakeRope):
+            (JSC::DFG::FixupPhase::truncateConstantToInt32):
+            (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
+            (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+            * dfg/DFGFrozenValue.cpp: Added.
+            (JSC::DFG::FrozenValue::emptySingleton):
+            (JSC::DFG::FrozenValue::dumpInContext):
+            (JSC::DFG::FrozenValue::dump):
+            * dfg/DFGFrozenValue.h: Added.
+            (JSC::DFG::FrozenValue::FrozenValue):
+            (JSC::DFG::FrozenValue::operator!):
+            (JSC::DFG::FrozenValue::value):
+            (JSC::DFG::FrozenValue::structure):
+            (JSC::DFG::FrozenValue::strengthenTo):
+            (JSC::DFG::FrozenValue::strength):
+            (JSC::DFG::FrozenValue::freeze):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::Graph):
+            (JSC::DFG::Graph::dump):
+            (JSC::DFG::Graph::tryGetActivation):
+            (JSC::DFG::Graph::tryGetFoldableView):
+            (JSC::DFG::Graph::registerFrozenValues):
+            (JSC::DFG::Graph::visitChildren):
+            (JSC::DFG::Graph::freezeFragile):
+            (JSC::DFG::Graph::freeze):
+            (JSC::DFG::Graph::freezeStrong):
+            (JSC::DFG::Graph::convertToConstant):
+            (JSC::DFG::Graph::convertToStrongConstant):
+            (JSC::DFG::Graph::assertIsWatched):
+            * dfg/DFGGraph.h:
+            (JSC::DFG::Graph::addImmediateShouldSpeculateInt32):
+            (JSC::DFG::Graph::convertToConstant): Deleted.
+            (JSC::DFG::Graph::constantRegisterForConstant): Deleted.
+            (JSC::DFG::Graph::getJSConstantSpeculation): Deleted.
+            (JSC::DFG::Graph::isConstant): Deleted.
+            (JSC::DFG::Graph::isJSConstant): Deleted.
+            (JSC::DFG::Graph::isInt32Constant): Deleted.
+            (JSC::DFG::Graph::isDoubleConstant): Deleted.
+            (JSC::DFG::Graph::isNumberConstant): Deleted.
+            (JSC::DFG::Graph::isBooleanConstant): Deleted.
+            (JSC::DFG::Graph::isCellConstant): Deleted.
+            (JSC::DFG::Graph::isFunctionConstant): Deleted.
+            (JSC::DFG::Graph::isInternalFunctionConstant): Deleted.
+            (JSC::DFG::Graph::valueOfJSConstant): Deleted.
+            (JSC::DFG::Graph::valueOfInt32Constant): Deleted.
+            (JSC::DFG::Graph::valueOfNumberConstant): Deleted.
+            (JSC::DFG::Graph::valueOfBooleanConstant): Deleted.
+            (JSC::DFG::Graph::valueOfFunctionConstant): Deleted.
+            (JSC::DFG::Graph::mulImmediateShouldSpeculateInt32): Deleted.
+            * dfg/DFGInPlaceAbstractState.cpp:
+            (JSC::DFG::InPlaceAbstractState::initialize):
+            * dfg/DFGInsertionSet.h:
+            (JSC::DFG::InsertionSet::insertConstant):
+            (JSC::DFG::InsertionSet::insertConstantForUse):
+            * dfg/DFGIntegerCheckCombiningPhase.cpp:
+            (JSC::DFG::IntegerCheckCombiningPhase::rangeKeyAndAddend):
+            * dfg/DFGJITCompiler.cpp:
+            (JSC::DFG::JITCompiler::link):
+            * dfg/DFGLazyJSValue.cpp:
+            (JSC::DFG::LazyJSValue::getValue):
+            (JSC::DFG::LazyJSValue::strictEqual):
+            (JSC::DFG::LazyJSValue::dumpInContext):
+            * dfg/DFGLazyJSValue.h:
+            (JSC::DFG::LazyJSValue::LazyJSValue):
+            (JSC::DFG::LazyJSValue::tryGetValue):
+            (JSC::DFG::LazyJSValue::value):
+            (JSC::DFG::LazyJSValue::switchLookupValue):
+            * dfg/DFGMinifiedNode.cpp:
+            (JSC::DFG::MinifiedNode::fromNode):
+            * dfg/DFGMinifiedNode.h:
+            (JSC::DFG::belongsInMinifiedGraph):
+            (JSC::DFG::MinifiedNode::hasConstant):
+            (JSC::DFG::MinifiedNode::constant):
+            (JSC::DFG::MinifiedNode::hasConstantNumber): Deleted.
+            (JSC::DFG::MinifiedNode::constantNumber): Deleted.
+            (JSC::DFG::MinifiedNode::hasWeakConstant): Deleted.
+            (JSC::DFG::MinifiedNode::weakConstant): Deleted.
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::hasConstant):
+            (JSC::DFG::Node::constant):
+            (JSC::DFG::Node::convertToConstant):
+            (JSC::DFG::Node::asJSValue):
+            (JSC::DFG::Node::isInt32Constant):
+            (JSC::DFG::Node::asInt32):
+            (JSC::DFG::Node::asUInt32):
+            (JSC::DFG::Node::isDoubleConstant):
+            (JSC::DFG::Node::isNumberConstant):
+            (JSC::DFG::Node::asNumber):
+            (JSC::DFG::Node::isMachineIntConstant):
+            (JSC::DFG::Node::asMachineInt):
+            (JSC::DFG::Node::isBooleanConstant):
+            (JSC::DFG::Node::asBoolean):
+            (JSC::DFG::Node::isCellConstant):
+            (JSC::DFG::Node::asCell):
+            (JSC::DFG::Node::dynamicCastConstant):
+            (JSC::DFG::Node::function):
+            (JSC::DFG::Node::isWeakConstant): Deleted.
+            (JSC::DFG::Node::constantNumber): Deleted.
+            (JSC::DFG::Node::convertToWeakConstant): Deleted.
+            (JSC::DFG::Node::weakConstant): Deleted.
+            (JSC::DFG::Node::valueOfJSConstant): Deleted.
+            * dfg/DFGNodeType.h:
+            * dfg/DFGOSRExitCompiler.cpp:
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            (JSC::DFG::PredictionPropagationPhase::propagate):
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+            (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
+            (JSC::DFG::SpeculativeJIT::silentFill):
+            (JSC::DFG::SpeculativeJIT::compileIn):
+            (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
+            (JSC::DFG::SpeculativeJIT::compilePeepHoleInt32Branch):
+            (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+            (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+            (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
+            (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+            (JSC::DFG::SpeculativeJIT::compileAdd):
+            (JSC::DFG::SpeculativeJIT::compileArithSub):
+            (JSC::DFG::SpeculativeJIT::compileArithMod):
+            * dfg/DFGSpeculativeJIT.h:
+            (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
+            (JSC::DFG::SpeculativeJIT::initConstantInfo):
+            (JSC::DFG::SpeculativeJIT::isConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::isJSConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::isInt32Constant): Deleted.
+            (JSC::DFG::SpeculativeJIT::isDoubleConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::isNumberConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::isBooleanConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::isFunctionConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::valueOfInt32Constant): Deleted.
+            (JSC::DFG::SpeculativeJIT::valueOfNumberConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::addressOfDoubleConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::valueOfJSConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::isNullConstant): Deleted.
+            (JSC::DFG::SpeculativeJIT::isInteger): Deleted.
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::fillJSValue):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::fillJSValue):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+            (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGStrengthReductionPhase.cpp:
+            (JSC::DFG::StrengthReductionPhase::handleNode):
+            * dfg/DFGValidate.cpp:
+            (JSC::DFG::Validate::validate):
+            * dfg/DFGValueStrength.cpp: Added.
+            (WTF::printInternal):
+            * dfg/DFGValueStrength.h: Added.
+            (JSC::DFG::merge):
+            * dfg/DFGVariableEventStream.cpp:
+            (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
+            (JSC::DFG::VariableEventStream::reconstruct):
+            * dfg/DFGVariableEventStream.h:
+            * dfg/DFGWatchableStructureWatchingPhase.cpp:
+            (JSC::DFG::WatchableStructureWatchingPhase::run):
+            (JSC::DFG::WatchableStructureWatchingPhase::tryWatch):
+            * dfg/DFGWatchpointCollectionPhase.cpp:
+            (JSC::DFG::WatchpointCollectionPhase::handle):
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLLink.cpp:
+            (JSC::FTL::link):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+            (JSC::FTL::LowerDFGToLLVM::compileDoubleConstant):
+            (JSC::FTL::LowerDFGToLLVM::compileInt52Constant):
+            (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
+            (JSC::FTL::LowerDFGToLLVM::compileCheckFunction):
+            (JSC::FTL::LowerDFGToLLVM::compileCompareEqConstant):
+            (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEqConstant):
+            (JSC::FTL::LowerDFGToLLVM::lowInt32):
+            (JSC::FTL::LowerDFGToLLVM::lowCell):
+            (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+            (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+            (JSC::FTL::LowerDFGToLLVM::tryToSetConstantExitArgument):
+            (JSC::FTL::LowerDFGToLLVM::compileWeakJSConstant): Deleted.
+            * ftl/FTLOSRExitCompiler.cpp:
+            (JSC::FTL::compileStub):
+            * runtime/JSCJSValue.cpp:
+            (JSC::JSValue::dumpInContext):
+            (JSC::JSValue::dumpInContextAssumingStructure):
+            * runtime/JSCJSValue.h:
+    
+2014-07-24  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Correct build order in JavaScriptCore.submit.sln
+        https://bugs.webkit.org/show_bug.cgi?id=135282
+        <rdar://problem/17805592>
+
+        Unreviewed build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Correct build order
+        such that LLIntDesiredOffset is built prior to the rest of JSC.
+
+2014-07-24  Mark Lam  <mark.lam@apple.com>
+
+        JSWrapperMap's jsWrapperForObject() needs to keep weak prototype and constructors from being GCed.
+        <https://webkit.org/b/135258>
+
+        Reviewed by Mark Hahnenberg.
+
+        Where needed, we cache the prototype object pointer in a stack local var.
+        This allows it to be scanned by the GC, and hence be kept alive until
+        we use it.  The constructor object will in turn be kept alive by the
+        prototype object.
+
+        Also added some comments to warn against future code additions that could
+        regress this issue.
+
+        * API/JSWrapperMap.mm:
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
+        (-[JSObjCClassInfo reallocateConstructorAndOrPrototype]):
+        (-[JSObjCClassInfo wrapperForObject:]):
+        (-[JSObjCClassInfo constructor]):
+
+2014-07-24  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSLock release should only modify the AtomicStringTable if it modified in acquire
+        https://bugs.webkit.org/show_bug.cgi?id=135143
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::JSLock):
+        Initialize the member variable to nullptr.
+
+        (JSC::JSLock::willDestroyVM):
+        Update style to use nullptr instead of 0.
+
+        (JSC::JSLock::willReleaseLock):
+        We should only reset the thread data's atomic string table if
+        didAcquireLock changed it. m_entryAtomicStringTable will have
+        been set by didAcquireLock if it changed, or nullptr if it didn't.
+        This way we are sure we are balanced, regardless of m_vm changes.
+
+2014-07-24  Peyton Randolph  <prandolph@apple.com>
+
+        Rename feature flag for long-press gesture on Mac.                                                                   
+        https://bugs.webkit.org/show_bug.cgi?id=135259                                                                 
+
+        Reviewed by Beth Dakin.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Rename LINK_LONG_PRESS to MAC_LONG_PRESS.
+
+2014-07-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r171527.
+        https://bugs.webkit.org/show_bug.cgi?id=135265
+
+        Breaks JSC API tests (Requested by mlam on #webkit).
+
+        Reverted changeset:
+
+        "JSWrapperMap's jsWrapperForObject() needs to defer GC."
+        https://bugs.webkit.org/show_bug.cgi?id=135258
+        http://trac.webkit.org/changeset/171527
+
+2014-07-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Creating a JSGlobalObject with a custom JSClassRef results in a JSProxy with the wrong prototype
+        https://bugs.webkit.org/show_bug.cgi?id=135250
+
+        Reviewed by Geoffrey Garen.
+
+        JSGlobalObject::resetPrototype (which is called from JSGlobalContextCreateInGroup) doesn't change its 
+        JSProxy's prototype as well. This results in a JSProxy where no properties in the original prototype 
+        chain (as created from the JSClassRef hierarchy) are accessible. Changing resetPrototype to also change
+        the JSProxy's prototype fixes the issue.
+
+        * API/JSValueRef.cpp:
+        (JSValueIsObjectOfClass): Also fixed a bug where a JSProxy for a JSGlobalObject with a custom JSClassRef
+        would claim it wasn't of the specified class, even if the target was of the specified class.
+        * API/tests/CustomGlobalObjectClassTest.c: Added.
+        (jsDoSomething):
+        (customGlobalObjectClassTest):
+        * API/tests/CustomGlobalObjectClassTest.h: Added.
+        * API/tests/testapi.c:
+        (assertTrue):
+        (main):
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resetPrototype):
+
+2014-07-24  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: don't encode/decode primitive types that lack explicit sizes
+        https://bugs.webkit.org/show_bug.cgi?id=133430
+
+        Reviewed by Anders Carlsson.
+
+        Don't support encode/decode of unsigned long, since its size is compiler-dependent.
+
+        * replay/EncodedValue.cpp:
+        (JSC::EncodedValue::convertTo<unsigned long>):
+        (JSC::unsigned long>::encodeValue): Deleted.
+        * replay/EncodedValue.h:
+
+2014-07-24  Mark Lam  <mark.lam@apple.com>
+
+        JSWrapperMap's jsWrapperForObject() needs to defer GC.
+        <https://webkit.org/b/135258>
+
+        Reviewed by Oliver Hunt.
+
+        In the process of creating a JS wrapper, jsWrapperForObject() will create
+        the prototype and constructor of the corresponding ObjC class, as well as
+        for classes in its inheritance chain.  These prototypes and constructors
+        are stored in Weak references in the JSObjCClassInfo objects.  During all
+        the allocation that is being done to create all the prototypes and
+        constructors as well as the wrapper objects, a GC may occur thereby
+        collecting one or more of these newly created prototype and constructor
+        objects.
+
+        One example of where this problem can manifest is in wrapperForObject()
+        which is called from jsWrapperForObject().  In wrapperFoObject(), we do
+        the following steps:
+
+        1. reallocateConstructorAndOrPrototype() which creates the prototype
+           object and store it in JSObjCClassInfo's m_prototype which is a Weak
+           ref.
+        2. makeWrapper() to create the wrapper object, which may trigger a GC.
+           GC will collect the prototype object and nullify the corresponding
+           JSObjCClassInfo's m_prototype Weak ref.
+        3. call JSObjectSetPrototype() to set the JSObjCClassInfo's m_prototype
+           in the newly created wrapper.  This results in the wrapper getting a
+           jsNull as a prototype instead of the expected prototype object.
+
+        To ensure that the prototype and constructor objects are retained until
+        they can be referenced properly from the wrapper object,
+        jsWrapperForObject() should defer GC until it's done with its work.
+
+        * API/JSWrapperMap.mm:
+        (-[JSWrapperMap jsWrapperForObject:]):
+
+2014-07-23  Brent Fulgham  <bfulgham@apple.com>
+
+        Build fix after r171482.
+
+        Rubberstamped by Joe Pecoraro.
+
+        * runtime/Identifier.h: Make header declarations match
+        implementation file.
+
+2014-07-23  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Use NO_RETURN_DUE_TO_CRASH on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=135199
+
+        Reviewed by Mark Lam.
+
+        * jsc.cpp:
+        (WTF::RuntimeArray::deleteProperty): Stop using ugly
+        compiler work-around on Windows; use NO_RETURN_DUE_TO_CRASH
+        codepath instead.
+        * runtime/Identifier.h: Add NO_RETURN_DUE_TO_CRASH
+        to header so function declaration matches implementation.
+
+2014-07-23  Bem Jones-Bey  <bjonesbe@adobe.com>
+
+        Remove CSS_EXCLUSIONS compile flag and leftover code
+        https://bugs.webkit.org/show_bug.cgi?id=135175
+
+        Reviewed by Zoltan Horvath.
+
+        At this point, the CSS_EXCLUSIONS flag guards nothing but some useless
+        stubs. This removes the flag and the useless code.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-07-23  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r171367.
+        https://bugs.webkit.org/show_bug.cgi?id=135192
+
+        broke three API tests (Requested by thorton on #webkit).
+
+        Reverted changeset:
+
+        "JSLock release should only modify the AtomicStringTable if it
+        modified in acquire"
+        https://bugs.webkit.org/show_bug.cgi?id=135143
+        http://trac.webkit.org/changeset/171367
+
+2014-07-22  László Langó  <llango.u-szeged@partner.samsung.com>
+
+        [EFL] Build fix after the [ftlopt] branch merge.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * dfg/DFGBranchDirection.h:
+        (JSC::DFG::branchDirectionToString):
+        * dfg/DFGStructureClobberState.h:
+        (JSC::DFG::merge):
+
+2014-07-22  Brent Fulgham  <bfulgham@apple.com>
+
+        Build fix for non-clang compile.
+
+        * jsc.cpp:
+        (WTF::RuntimeArray::put): Remove incorrect return statement
+        I added.
+
+2014-07-22  Brent Fulgham  <bfulgham@apple.com>
+
+        Build fix for non-clang compile.
+
+        * jsc.cpp:
+        (WTF::RuntimeArray::deleteProperty): Need (fake) return
+        value when NO_RETURN_DUE_TO_CRASH is not defined.
+
+2014-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge r169628 from ftlopt.
+
+    2014-06-04  Matthew Mirman  <mmirman@apple.com>
+    
+            Added system for inlining native functions via the FTL.
+            https://bugs.webkit.org/show_bug.cgi?id=131515
+    
+            Reviewed by Filip Pizlo.
+    
+            Also fixed the build to not compress the bitcode and to 
+            include all of the relevant runtime. With GCC_GENERATE_DEBUGGING_SYMBOLS = NO, 
+            the produced bitcode files are a 100th the size they were before.  
+            Now we can include all of the relevant runtime files with only a 3mb overhead. 
+            This is the same overhead as for two compressed files before, 
+            but done more efficiently (on both ends) and with less code.
+            
+            Deciding whether to inline native functions is left up to LLVM. 
+            The entire module containing the function is linked into the current 
+            compiled JS so that inlining the native functions shouldn't make them smaller.
+            
+            Rather than loading Runtime.symtbl at runtime FTLState.cpp now generates a file 
+            InlineRuntimeSymbolTable.h which statically builds the symbol table hash table.  
+            
+            * JavaScriptCore.xcodeproj/project.pbxproj: Added back runtime files to compile.
+            * build-symbol-table-index.py: Changed bitcode suffix. 
+            Added inclusion of only tested symbols.  
+            Added output to InlineRuntimeSymbolTable.h. 
+            * build-symbol-table-index.sh: Changed bitcode suffix.
+            * copy-llvm-ir-to-derived-sources.sh: Removed gzip compression.
+            * tested-symbols.symlst: Added.
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handleCall):  
+            Now sets the knownFunction of the call node if such a function exists 
+            and emits a check that during runtime the callee is in fact known.
+            * dfg/DFGNode.h:
+            Added functions to set the known function of a call node.
+            (JSC::DFG::Node::canBeKnownFunction): Added.
+            (JSC::DFG::Node::hasKnownFunction): Added.
+            (JSC::DFG::Node::knownFunction): Added.
+            (JSC::DFG::Node::giveKnownFunction): Added.
+            * ftl/FTLAbbreviatedTypes.h: Added a typedef for LLVMMemoryBufferRef
+            * ftl/FTLAbbreviations.h: Added some abbreviations.
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Added. Hardcoded threshold to 275.
+            (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Added.
+            (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Added.
+            (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Added.
+            (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):  
+            Added call to possiblyCompileInlineableNativeCall
+            * ftl/FTLOutput.h:
+            (JSC::FTL::Output::allocaName):  Added. Useful for debugging.
+            * ftl/FTLState.cpp:
+            (JSC::FTL::State::State): Added an include for InlineRuntimeSymbolTable.h
+            * ftl/FTLState.h: Added symbol table hash table.
+            * ftl/FTLCompile.cpp:
+            (JSC::FTL::compile): Added inlining and dead function elimination passes.
+            * heap/HandleStack.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
+            * llvm/InitializeLLVMMac.mm: Deleted.
+            * llvm/InitializeLLVMMac.cpp: Added.
+            * llvm/LLVMAPIFunctions.h: Added macros to include Bitcode parsing and linking functions.
+            * llvm/LLVMHeaders.h: Added includes for Bitcode parsing and linking.
+            * runtime/BundlePath.h: Added.
+            * runtime/BundlePath.mm: Added.
+            * runtime/DateInstance.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
+            * runtime/DateInstance.h: ditto.
+            * runtime/DateConversion.h: ditto.
+            * runtime/ExceptionHelpers.h: ditto.
+            * runtime/JSCJSValue.h: ditto.
+            * runtime/JSArray.h: ditto.
+            * runtime/JSDateMath.h: ditto.
+            * runtime/JSObject.h: ditto.
+            * runtime/JSObject.h: ditto.
+            * runtime/RegExp.h: ditto.
+            * runtime/Structure.h: ditto.
+            * runtime/Options.h:  Added maximumLLVMInstructionCountForNativeInlining.
+    
+2014-07-22  Mark Lam  <mark.lam@apple.com>
+
+        Array.concat() should work on runtime arrays too.
+        <https://webkit.org/b/135179>
+
+        Reviewed by Geoffrey Garen.
+
+        * jsc.cpp:
+        (WTF::RuntimeArray::create):
+        (WTF::RuntimeArray::~RuntimeArray):
+        (WTF::RuntimeArray::destroy):
+        (WTF::RuntimeArray::getOwnPropertySlot):
+        (WTF::RuntimeArray::getOwnPropertySlotByIndex):
+        (WTF::RuntimeArray::put):
+        (WTF::RuntimeArray::deleteProperty):
+        (WTF::RuntimeArray::getLength):
+        (WTF::RuntimeArray::createPrototype):
+        (WTF::RuntimeArray::createStructure):
+        (WTF::RuntimeArray::finishCreation):
+        (WTF::RuntimeArray::RuntimeArray):
+        (WTF::RuntimeArray::lengthGetter):
+        (GlobalObject::finishCreation):
+        (functionCreateRuntimeArray):
+        - Added support to create a runtime array for testing purpose.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getLength):
+        - Added fast case for when the array object is a JSArray.
+        (JSC::arrayProtoFuncJoin):
+        - Added a needed but missing exception check.
+        (JSC::arrayProtoFuncConcat):
+        - Use getLength() to compute the array length instead of assuming that
+          the array is a JSArray instance.
+        * tests/stress/regexp-matches-array.js: Added.
+        (testArrayConcat):
+        * tests/stress/runtime-array.js: Added.
+        (testArrayConcat):
+
+2014-07-22  Brent Fulgham  <bfulgham@apple.com>
+
+        Fix Windows (return a value!)
+
+        * jsc.cpp:
+        (functionQuit): Satisfy compiler's need for
+        a return value.
+
+2014-07-22  Brent Fulgham  <bfulgham@apple.com>
+
+        Fix Windows (sleep -> Sleep)
+
+        * jsc.cpp:
+        (WTF::jscExit):
+
+2014-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix Windows.
+
+        * jsc.cpp:
+        (WTF::jscExit):
+
+2014-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix 32-bit.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge r169148, r169185, r169188, r169578, r169582, r169584, r169588, r169753 from ftlopt.
+        
+        Note that r169753 is merged out of order because it fixes a bug in r169588.
+
+    2014-06-10  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Structure::dfgShouldWatchIfPossible() is unsound
+            https://bugs.webkit.org/show_bug.cgi?id=133624
+    
+            Reviewed by Mark Hahnenberg.
+    
+            * runtime/Structure.h:
+            (JSC::Structure::dfgShouldWatchIfPossible): Make it sound and add some verbiage.
+    
+    2014-06-04  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] AI should be able track structure sets larger than 1
+            https://bugs.webkit.org/show_bug.cgi?id=128073
+    
+            Reviewed by Oliver Hunt.
+            
+            This makes two major changes to how AI (abstract interpreter) proves that a value has
+            some structure:
+            
+            - StructureAbstractValue can now track an arbitrary number of structures. A set whose
+              size is greater than one means that the value may have any of the structures, and we
+              don't know which - but we do know that it cannot be any structure not in the set. The
+              structure abstract value can still be TOP, which means the set of all structures. We
+              artificially limit the set size to StructureAbstractValue::polymorphismLimit to guard
+              memory explosion on pathological programs. This limit is big enough that it wouldn't
+              kick in for normal code, since we have other heuristics that limit the number of
+              structures that we would allow an inline cache to know about.
+            
+            - We eagerly set watchpoints on all watchable structures and then we assume that
+              watchable structures are being watched, and that the watchpoint will jettison the code.
+              This allows tracking of watchable structures to be far simpler than before. Previously,
+              a structure being tracked as "future possible" was predicated on it being watchable but
+              we might not actually watch it. This makes algebra over sets of future possible
+              structures quite weird. But watching all watchable structures means that we simple say
+              that a structure set can be in the following states: unclobbered, which means it's just
+              a set of structures and it doesn't matter what is watchable or what isn't because we've
+              proven that the value must have one of these structures right now; and clobbered, which
+              means that we have a set of structures, plus all possible structures temporarily, with
+              invalidation removing the "plus all possible structures". Clobbering a set means that
+              if any of its structures are unwatchable, the set just becomes TOP; but if all
+              structures in the set are watchable then we just set the clobbered bit to add the "plus
+              all possible structures temporarily" thing. This precisely tracks the exact meaning of
+              watchability and invalidation points.
+            
+            Slight SunSpider slow-down, neutral on Octane, slight AsmBench speed-up. I believe that
+            we will ultimately undo the SunSpider slow-down by making further improvements to the set
+            representation. I believe that Octane perfromance will ultimately improve once we remove
+            remaining singleton special-cases. The ultimate goal of this is to remove the need to
+            try quite so desperately hard to make everything monomorphic as we do currently.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/StructureSet.cpp:
+            (JSC::StructureSet::clear):
+            (JSC::StructureSet::remove):
+            (JSC::StructureSet::filter):
+            (JSC::StructureSet::copyFromOutOfLine):
+            (JSC::StructureSet::StructureSet): Deleted.
+            (JSC::StructureSet::operator=): Deleted.
+            (JSC::StructureSet::copyFrom): Deleted.
+            * bytecode/StructureSet.h:
+            (JSC::StructureSet::StructureSet):
+            (JSC::StructureSet::operator=):
+            (JSC::StructureSet::isEmpty):
+            (JSC::StructureSet::genericFilter):
+            (JSC::StructureSet::ContainsOutOfLine::ContainsOutOfLine):
+            (JSC::StructureSet::ContainsOutOfLine::operator()):
+            (JSC::StructureSet::copyFrom):
+            (JSC::StructureSet::deleteStructureListIfNecessary):
+            (JSC::StructureSet::setEmpty):
+            (JSC::StructureSet::getReservedFlag):
+            (JSC::StructureSet::setReservedFlag):
+            * dfg/DFGAbstractInterpreter.h:
+            (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::booleanResult):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberCapturedVars):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber):
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
+            * dfg/DFGAbstractValue.cpp:
+            (JSC::DFG::AbstractValue::observeTransitions):
+            (JSC::DFG::AbstractValue::setMostSpecific):
+            (JSC::DFG::AbstractValue::set):
+            (JSC::DFG::AbstractValue::filter):
+            (JSC::DFG::AbstractValue::shouldBeClear):
+            (JSC::DFG::AbstractValue::normalizeClarity):
+            (JSC::DFG::AbstractValue::checkConsistency):
+            (JSC::DFG::AbstractValue::assertIsWatched):
+            (JSC::DFG::AbstractValue::dumpInContext):
+            (JSC::DFG::AbstractValue::setFuturePossibleStructure): Deleted.
+            * dfg/DFGAbstractValue.h:
+            (JSC::DFG::AbstractValue::clear):
+            (JSC::DFG::AbstractValue::clobberStructures):
+            (JSC::DFG::AbstractValue::clobberStructuresFor):
+            (JSC::DFG::AbstractValue::observeInvalidationPoint):
+            (JSC::DFG::AbstractValue::observeInvalidationPointFor):
+            (JSC::DFG::AbstractValue::observeTransition):
+            (JSC::DFG::AbstractValue::TransitionObserver::TransitionObserver):
+            (JSC::DFG::AbstractValue::TransitionObserver::operator()):
+            (JSC::DFG::AbstractValue::TransitionsObserver::TransitionsObserver):
+            (JSC::DFG::AbstractValue::TransitionsObserver::operator()):
+            (JSC::DFG::AbstractValue::isHeapTop):
+            (JSC::DFG::AbstractValue::setType):
+            (JSC::DFG::AbstractValue::operator==):
+            (JSC::DFG::AbstractValue::merge):
+            (JSC::DFG::AbstractValue::validate):
+            (JSC::DFG::AbstractValue::hasClobberableState):
+            (JSC::DFG::AbstractValue::assertIsWatched):
+            (JSC::DFG::AbstractValue::observeIndexingTypeTransition):
+            (JSC::DFG::AbstractValue::makeTop):
+            (JSC::DFG::AbstractValue::bestProvenStructure): Deleted.
+            * dfg/DFGAllocator.h:
+            * dfg/DFGArgumentsSimplificationPhase.cpp:
+            (JSC::DFG::ArgumentsSimplificationPhase::run):
+            * dfg/DFGArrayMode.cpp:
+            (JSC::DFG::ArrayMode::alreadyChecked):
+            * dfg/DFGAtTailAbstractState.h:
+            (JSC::DFG::AtTailAbstractState::structureClobberState):
+            (JSC::DFG::AtTailAbstractState::setStructureClobberState):
+            (JSC::DFG::AtTailAbstractState::setFoundConstants):
+            (JSC::DFG::AtTailAbstractState::haveStructures): Deleted.
+            (JSC::DFG::AtTailAbstractState::setHaveStructures): Deleted.
+            * dfg/DFGBasicBlock.cpp:
+            (JSC::DFG::BasicBlock::BasicBlock):
+            * dfg/DFGBasicBlock.h:
+            * dfg/DFGBranchDirection.h:
+            (JSC::DFG::branchDirectionToString):
+            (WTF::printInternal):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handlePutById):
+            * dfg/DFGCFAPhase.cpp:
+            (JSC::DFG::CFAPhase::performBlockCFA):
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::CSEPhase::checkStructureElimination):
+            (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+            (JSC::DFG::CSEPhase::performNodeCSE):
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            * dfg/DFGCommon.cpp:
+            (JSC::DFG::startCrashing):
+            (JSC::DFG::isCrashing):
+            * dfg/DFGCommon.h:
+            * dfg/DFGCommonData.cpp:
+            (JSC::DFG::CommonData::notifyCompilingStructureTransition):
+            * dfg/DFGConstantFoldingPhase.cpp:
+            (JSC::DFG::ConstantFoldingPhase::foldConstants):
+            (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+            (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+            (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+            * dfg/DFGDesiredWatchpoints.cpp:
+            (JSC::DFG::DesiredWatchpoints::consider):
+            (JSC::DFG::DesiredWatchpoints::addLazily): Deleted.
+            * dfg/DFGDesiredWatchpoints.h:
+            (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
+            (JSC::DFG::GenericDesiredWatchpoints::areStillValid):
+            (JSC::DFG::GenericDesiredWatchpoints::isWatched):
+            (JSC::DFG::DesiredWatchpoints::isWatched):
+            (JSC::DFG::WatchpointForGenericWatchpointSet::WatchpointForGenericWatchpointSet): Deleted.
+            (JSC::DFG::GenericDesiredWatchpoints::addLazily): Deleted.
+            (JSC::DFG::GenericDesiredWatchpoints::isStillValid): Deleted.
+            (JSC::DFG::GenericDesiredWatchpoints::shouldAssumeMixedState): Deleted.
+            (JSC::DFG::GenericDesiredWatchpoints::isValidOrMixed): Deleted.
+            (JSC::DFG::DesiredWatchpoints::isStillValid): Deleted.
+            (JSC::DFG::DesiredWatchpoints::shouldAssumeMixedState): Deleted.
+            (JSC::DFG::DesiredWatchpoints::isValidOrMixed): Deleted.
+            * dfg/DFGDoesGC.cpp:
+            (JSC::DFG::doesGC):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+            (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+            * dfg/DFGGraph.cpp:
+            (JSC::DFG::Graph::~Graph):
+            (JSC::DFG::Graph::dump):
+            (JSC::DFG::Graph::dumpBlockHeader):
+            (JSC::DFG::Graph::tryGetFoldableView):
+            (JSC::DFG::Graph::visitChildren):
+            (JSC::DFG::Graph::assertIsWatched):
+            (JSC::DFG::Graph::handleAssertionFailure):
+            * dfg/DFGGraph.h:
+            (JSC::DFG::Graph::convertToConstant):
+            (JSC::DFG::Graph::masqueradesAsUndefinedWatchpointIsStillValid):
+            (JSC::DFG::Graph::addStructureTransitionData): Deleted.
+            * dfg/DFGInPlaceAbstractState.cpp:
+            (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
+            (JSC::DFG::InPlaceAbstractState::initialize):
+            (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+            (JSC::DFG::InPlaceAbstractState::reset):
+            (JSC::DFG::InPlaceAbstractState::merge):
+            * dfg/DFGInPlaceAbstractState.h:
+            (JSC::DFG::InPlaceAbstractState::structureClobberState):
+            (JSC::DFG::InPlaceAbstractState::setStructureClobberState):
+            (JSC::DFG::InPlaceAbstractState::setFoundConstants):
+            (JSC::DFG::InPlaceAbstractState::haveStructures): Deleted.
+            (JSC::DFG::InPlaceAbstractState::setHaveStructures): Deleted.
+            * dfg/DFGLivenessAnalysisPhase.cpp:
+            (JSC::DFG::LivenessAnalysisPhase::run):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::hasTransition):
+            (JSC::DFG::Node::transition):
+            (JSC::DFG::Node::hasStructure):
+            (JSC::DFG::StructureTransitionData::StructureTransitionData): Deleted.
+            (JSC::DFG::Node::convertToStructureTransitionWatchpoint): Deleted.
+            (JSC::DFG::Node::hasStructureTransitionData): Deleted.
+            (JSC::DFG::Node::structureTransitionData): Deleted.
+            * dfg/DFGNodeType.h:
+            * dfg/DFGPlan.cpp:
+            (JSC::DFG::Plan::compileInThreadImpl):
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            (JSC::DFG::PredictionPropagationPhase::propagate):
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+            * dfg/DFGSpeculativeJIT.cpp:
+            (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+            (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+            * dfg/DFGSpeculativeJIT.h:
+            (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGStructureAbstractValue.cpp: Added.
+            (JSC::DFG::StructureAbstractValue::assertIsWatched):
+            (JSC::DFG::StructureAbstractValue::clobber):
+            (JSC::DFG::StructureAbstractValue::observeTransition):
+            (JSC::DFG::StructureAbstractValue::observeTransitions):
+            (JSC::DFG::StructureAbstractValue::add):
+            (JSC::DFG::StructureAbstractValue::merge):
+            (JSC::DFG::StructureAbstractValue::mergeSlow):
+            (JSC::DFG::StructureAbstractValue::mergeNotTop):
+            (JSC::DFG::StructureAbstractValue::filter):
+            (JSC::DFG::StructureAbstractValue::filterSlow):
+            (JSC::DFG::StructureAbstractValue::contains):
+            (JSC::DFG::StructureAbstractValue::isSubsetOf):
+            (JSC::DFG::StructureAbstractValue::isSupersetOf):
+            (JSC::DFG::StructureAbstractValue::overlaps):
+            (JSC::DFG::StructureAbstractValue::equalsSlow):
+            (JSC::DFG::StructureAbstractValue::dumpInContext):
+            (JSC::DFG::StructureAbstractValue::dump):
+            * dfg/DFGStructureAbstractValue.h:
+            (JSC::DFG::StructureAbstractValue::StructureAbstractValue):
+            (JSC::DFG::StructureAbstractValue::operator=):
+            (JSC::DFG::StructureAbstractValue::clear):
+            (JSC::DFG::StructureAbstractValue::makeTop):
+            (JSC::DFG::StructureAbstractValue::assertIsWatched):
+            (JSC::DFG::StructureAbstractValue::observeInvalidationPoint):
+            (JSC::DFG::StructureAbstractValue::top):
+            (JSC::DFG::StructureAbstractValue::isClear):
+            (JSC::DFG::StructureAbstractValue::isTop):
+            (JSC::DFG::StructureAbstractValue::isNeitherClearNorTop):
+            (JSC::DFG::StructureAbstractValue::isClobbered):
+            (JSC::DFG::StructureAbstractValue::merge):
+            (JSC::DFG::StructureAbstractValue::filter):
+            (JSC::DFG::StructureAbstractValue::operator==):
+            (JSC::DFG::StructureAbstractValue::size):
+            (JSC::DFG::StructureAbstractValue::at):
+            (JSC::DFG::StructureAbstractValue::operator[]):
+            (JSC::DFG::StructureAbstractValue::onlyStructure):
+            (JSC::DFG::StructureAbstractValue::isSupersetOf):
+            (JSC::DFG::StructureAbstractValue::makeTopWhenThin):
+            (JSC::DFG::StructureAbstractValue::setClobbered):
+            (JSC::DFG::StructureAbstractValue::add): Deleted.
+            (JSC::DFG::StructureAbstractValue::addAll): Deleted.
+            (JSC::DFG::StructureAbstractValue::contains): Deleted.
+            (JSC::DFG::StructureAbstractValue::isSubsetOf): Deleted.
+            (JSC::DFG::StructureAbstractValue::doesNotContainAnyOtherThan): Deleted.
+            (JSC::DFG::StructureAbstractValue::isClearOrTop): Deleted.
+            (JSC::DFG::StructureAbstractValue::last): Deleted.
+            (JSC::DFG::StructureAbstractValue::speculationFromStructures): Deleted.
+            (JSC::DFG::StructureAbstractValue::isValidOffset): Deleted.
+            (JSC::DFG::StructureAbstractValue::hasSingleton): Deleted.
+            (JSC::DFG::StructureAbstractValue::singleton): Deleted.
+            (JSC::DFG::StructureAbstractValue::dumpInContext): Deleted.
+            (JSC::DFG::StructureAbstractValue::dump): Deleted.
+            (JSC::DFG::StructureAbstractValue::topValue): Deleted.
+            * dfg/DFGStructureClobberState.h: Added.
+            (JSC::DFG::merge):
+            (WTF::printInternal):
+            * dfg/DFGTransition.cpp: Added.
+            (JSC::DFG::Transition::dumpInContext):
+            (JSC::DFG::Transition::dump):
+            * dfg/DFGTransition.h: Added.
+            (JSC::DFG::Transition::Transition):
+            * dfg/DFGTypeCheckHoistingPhase.cpp:
+            (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+            (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+            * dfg/DFGWatchableStructureWatchingPhase.cpp: Added.
+            (JSC::DFG::WatchableStructureWatchingPhase::WatchableStructureWatchingPhase):
+            (JSC::DFG::WatchableStructureWatchingPhase::run):
+            (JSC::DFG::WatchableStructureWatchingPhase::tryWatch):
+            (JSC::DFG::performWatchableStructureWatching):
+            * dfg/DFGWatchableStructureWatchingPhase.h: Added.
+            * dfg/DFGWatchpointCollectionPhase.cpp:
+            (JSC::DFG::WatchpointCollectionPhase::handle):
+            (JSC::DFG::WatchpointCollectionPhase::handleEdge): Deleted.
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLIntrinsicRepository.h:
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::ftlUnreachable):
+            (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+            (JSC::FTL::LowerDFGToLLVM::compileBlock):
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+            (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+            (JSC::FTL::LowerDFGToLLVM::compilePhi):
+            (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+            (JSC::FTL::LowerDFGToLLVM::compileValueRep):
+            (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+            (JSC::FTL::LowerDFGToLLVM::compileGetArgument):
+            (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+            (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+            (JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
+            (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+            (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+            (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+            (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+            (JSC::FTL::LowerDFGToLLVM::compileArithAbs):
+            (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+            (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+            (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+            (JSC::FTL::LowerDFGToLLVM::compileGetById):
+            (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
+            (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+            (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+            (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+            (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+            (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+            (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
+            (JSC::FTL::LowerDFGToLLVM::compileNewArray):
+            (JSC::FTL::LowerDFGToLLVM::compileNewArrayBuffer):
+            (JSC::FTL::LowerDFGToLLVM::compileAllocatePropertyStorage):
+            (JSC::FTL::LowerDFGToLLVM::compileReallocatePropertyStorage):
+            (JSC::FTL::LowerDFGToLLVM::compileToString):
+            (JSC::FTL::LowerDFGToLLVM::compileMakeRope):
+            (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+            (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+            (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+            (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+            (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+            (JSC::FTL::LowerDFGToLLVM::compare):
+            (JSC::FTL::LowerDFGToLLVM::boolify):
+            (JSC::FTL::LowerDFGToLLVM::terminate):
+            (JSC::FTL::LowerDFGToLLVM::lowInt32):
+            (JSC::FTL::LowerDFGToLLVM::lowInt52):
+            (JSC::FTL::LowerDFGToLLVM::opposite):
+            (JSC::FTL::LowerDFGToLLVM::lowCell):
+            (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+            (JSC::FTL::LowerDFGToLLVM::lowDouble):
+            (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+            (JSC::FTL::LowerDFGToLLVM::speculate):
+            (JSC::FTL::LowerDFGToLLVM::isArrayType):
+            (JSC::FTL::LowerDFGToLLVM::speculateStringObjectForStructureID):
+            (JSC::FTL::LowerDFGToLLVM::callCheck):
+            (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+            (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+            (JSC::FTL::LowerDFGToLLVM::setInt52):
+            (JSC::FTL::LowerDFGToLLVM::crash):
+            (JSC::FTL::LowerDFGToLLVM::compileStructureTransitionWatchpoint): Deleted.
+            * ftl/FTLOutput.cpp:
+            (JSC::FTL::Output::crashNonTerminal): Deleted.
+            * ftl/FTLOutput.h:
+            (JSC::FTL::Output::crash): Deleted.
+            * jit/JITOperations.h:
+            * jsc.cpp:
+            (WTF::jscExit):
+            (functionQuit):
+            (main):
+            (printUsageStatement):
+            (CommandLine::parseArguments):
+            * runtime/Structure.h:
+            (JSC::Structure::dfgShouldWatchIfPossible):
+            (JSC::Structure::dfgShouldWatch):
+            * tests/stress/arrayify-to-structure-contradiction.js: Added.
+            (foo):
+            * tests/stress/ftl-getmyargumentslength-inline.js: Added.
+            (foo):
+            * tests/stress/multi-put-by-offset-multiple-transitions.js: Added.
+            (foo):
+            (Foo):
+            * tests/stress/throw-from-ftl-in-loop.js: Added.
+            * tests/stress/throw-from-ftl.js: Added.
+            (foo):
+    
+    2014-06-03  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Unreviewed, roll out r169578. The build system needs some more love.
+    
+            * InlineRuntimeSymbolTable.h: Removed.
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * build-symbol-table-index.py:
+            * build-symbol-table-index.sh:
+            * copy-llvm-ir-to-derived-sources.sh:
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handleCall):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::canBeKnownFunction): Deleted.
+            (JSC::DFG::Node::hasKnownFunction): Deleted.
+            (JSC::DFG::Node::knownFunction): Deleted.
+            (JSC::DFG::Node::giveKnownFunction): Deleted.
+            * ftl/FTLAbbreviatedTypes.h:
+            * ftl/FTLCompile.cpp:
+            (JSC::FTL::compile):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+            (JSC::FTL::LowerDFGToLLVM::lower):
+            (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+            (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Deleted.
+            (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Deleted.
+            (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Deleted.
+            (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Deleted.
+            * ftl/FTLState.cpp:
+            (JSC::FTL::State::State):
+            * ftl/FTLState.h:
+            * heap/HandleStack.h:
+            * llvm/InitializeLLVM.h:
+            * llvm/InitializeLLVMMac.cpp: Removed.
+            * llvm/InitializeLLVMMac.mm: Added.
+            (JSC::initializeLLVMImpl):
+            * llvm/LLVMAPIFunctions.h:
+            * llvm/LLVMHeaders.h:
+            * runtime/BundlePath.h: Removed.
+            * runtime/BundlePath.mm: Removed.
+            * runtime/DateConversion.h:
+            * runtime/DateInstance.h:
+            * runtime/ExceptionHelpers.h:
+            * runtime/JSArray.h:
+            * runtime/JSCJSValue.h:
+            (JSC::JSValue::toFloat):
+            * runtime/JSDateMath.h:
+            * runtime/JSObject.h:
+            * runtime/JSWrapperObject.h:
+            * runtime/Options.h:
+            * runtime/RegExp.h:
+            * runtime/StringObject.h:
+            * runtime/Structure.h:
+            * tested-symbols.symlst: Removed.
+    
+    2014-06-03  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] FTL native inlining tests take far too long
+            https://bugs.webkit.org/show_bug.cgi?id=133498
+    
+            Unreviewed test gardening.
+            
+            Added a new exceptions test since the other one appears to not work.
+    
+            * tests/stress/ftl-library-exception.js:
+            * tests/stress/ftl-library-inline-gettimezoneoffset.js: Added.
+            (foo):
+            * tests/stress/ftl-library-inlining-exceptions-dataview.js: Added.
+            (foo):
+            * tests/stress/ftl-library-inlining-exceptions.js: Copied from LayoutTests/js/regress/script-tests/ftl-library-inlining-exceptions.js.
+            * tests/stress/ftl-library-inlining-loops.js: Copied from LayoutTests/js/regress/script-tests/ftl-library-inlining-loops.js.
+            * tests/stress/ftl-library-inlining-random.js:
+            * tests/stress/ftl-library-substring.js:
+    
+    2014-06-03  Matthew Mirman  <mmirman@apple.com>
+    
+            [ftlopt] Added system for inlining native functions via the FTL.
+            https://bugs.webkit.org/show_bug.cgi?id=131515
+    
+            Reviewed by Filip Pizlo.
+    
+            Also fixed the build to not compress the bitcode and to 
+            include all of the relevant runtime. With GCC_GENERATE_DEBUGGING_SYMBOLS = NO, 
+            the produced bitcode files are a 100th the size they were before.  
+            Now we can include all of the relevant runtime files with only a 3mb overhead. 
+            This is the same overhead as for two compressed files before, 
+            but done more efficiently (on both ends) and with less code.
+            
+            Deciding whether to inline native functions is left up to LLVM. 
+            The entire module containing the function is linked into the current 
+            compiled JS so that inlining the native functions shouldn't make them smaller.
+            
+            Rather than loading Runtime.symtbl at runtime FTLState.cpp now includes a file 
+            InlineRuntimeSymbolTable.h which statically builds the symbol table hash table.  
+            Currently build-symbol-table-index.py updates this file from the 
+            contents of tested-symbols.symlst when done building as a matter of convenience.  
+            However, in order to include the new contents of the file in the build
+            you'd need to build twice.  This will be fixed in future versions.
+    
+            * JavaScriptCore.xcodeproj/project.pbxproj: Added back runtime files to compile.
+            * build-symbol-table-index.py: Changed bitcode suffix. 
+            Added inclusion of only tested symbols.  
+            Added output to InlineRuntimeSymbolTable.h. 
+            * build-symbol-table-index.sh: Changed bitcode suffix.
+            * copy-llvm-ir-to-derived-sources.sh: Removed gzip compression.
+            * tested-symbols.symlst: Added.
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::handleCall):  
+            Now sets the knownFunction of the call node if such a function exists 
+            and emits a check that during runtime the callee is in fact known.
+            * dfg/DFGNode.h:
+            Added functions to set the known function of a call node.
+            (JSC::DFG::Node::canBeKnownFunction): Added.
+            (JSC::DFG::Node::hasKnownFunction): Added.
+            (JSC::DFG::Node::knownFunction): Added.
+            (JSC::DFG::Node::giveKnownFunction): Added.
+            * ftl/FTLAbbreviatedTypes.h: Added a typedef for LLVMMemoryBufferRef
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Added. Hardcoded threshold to 275.
+            (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Added.
+            (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Added.
+            (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Added.
+            (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):  
+            Added call to possiblyCompileInlineableNativeCall
+            * ftl/FTLOutput.h:
+            (JSC::FTL::Output::allocaName):  Added. Useful for debugging.
+            * ftl/FTLState.cpp:
+            (JSC::FTL::State::State): Added an include for InlineRuntimeSymbolTable.h
+            * ftl/FTLState.h: Added symbol table hash table.
+            * ftl/FTLCompile.cpp:
+            (JSC::FTL::compile): Added inlining and dead function elimination passes.
+            * heap/HandleStack.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
+            * InlineRuntimeSymbolTable.h: Added.  
+            * llvm/InitializeLLVMMac.mm: Deleted.
+            * llvm/InitializeLLVMMac.cpp: Added.
+            * llvm/LLVMAPIFunctions.h: Added macros to include Bitcode parsing and linking functions.
+            * llvm/LLVMHeaders.h: Added includes for Bitcode parsing and linking.
+            * runtime/BundlePath.h: Added.
+            * runtime/BundlePath.mm: Added.
+            * runtime/DateInstance.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
+            * runtime/DateInstance.h: ditto.
+            * runtime/DateConversion.h: ditto.
+            * runtime/ExceptionHelpers.h: ditto.
+            * runtime/JSCJSValue.h: ditto.
+            * runtime/JSArray.h: ditto.
+            * runtime/JSDateMath.h: ditto.
+            * runtime/JSObject.h: ditto.
+            * runtime/JSObject.h: ditto.
+            * runtime/RegExp.h: ditto.
+            * runtime/Structure.h: ditto.
+            * runtime/Options.h:  Added maximumLLVMInstructionCountForNativeInlining.
+            * tests/stress/ftl-library-inlining-random.js: Added.
+            * tests/stress/ftl-library-substring.js: Added.
+    
+    2014-05-21  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG::clobberize should be blind to the effects of GC
+            https://bugs.webkit.org/show_bug.cgi?id=133166
+    
+            Reviewed by Goeffrey Garen.
+            
+            Move the computation of where GCs happen to DFG::doesGC().
+            
+            Large (>5x) speed-up on programs that do loop-invariant string concatenations.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * dfg/DFGAbstractHeap.h:
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            (JSC::DFG::clobberizeForAllocation): Deleted.
+            * dfg/DFGDoesGC.cpp: Added.
+            (JSC::DFG::doesGC):
+            * dfg/DFGDoesGC.h: Added.
+            * dfg/DFGStoreBarrierElisionPhase.cpp:
+            (JSC::DFG::StoreBarrierElisionPhase::handleNode):
+            (JSC::DFG::StoreBarrierElisionPhase::couldCauseGC): Deleted.
+    
+    2014-05-16  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] A StructureSet with one element should only require one word and no allocation
+            https://bugs.webkit.org/show_bug.cgi?id=133014
+    
+            Reviewed by Oliver Hunt.
+            
+            This makes it more efficient to use StructureSet in situations where the common case is
+            just one structure.
+            
+            I also took the opportunity to use the same set terminology we use in BitVector: merge,
+            filter, exclude, contains, etc.
+            
+            Eventually, this will be used to implement StructureAbstractValue as well.
+    
+            * CMakeLists.txt:
+            * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+            * JavaScriptCore.xcodeproj/project.pbxproj:
+            * bytecode/StructureSet.cpp: Added.
+            (JSC::StructureSet::StructureSet):
+            (JSC::StructureSet::operator=):
+            (JSC::StructureSet::clear):
+            (JSC::StructureSet::add):
+            (JSC::StructureSet::remove):
+            (JSC::StructureSet::contains):
+            (JSC::StructureSet::merge):
+            (JSC::StructureSet::filter):
+            (JSC::StructureSet::exclude):
+            (JSC::StructureSet::isSubsetOf):
+            (JSC::StructureSet::overlaps):
+            (JSC::StructureSet::operator==):
+            (JSC::StructureSet::speculationFromStructures):
+            (JSC::StructureSet::arrayModesFromStructures):
+            (JSC::StructureSet::dumpInContext):
+            (JSC::StructureSet::dump):
+            (JSC::StructureSet::addOutOfLine):
+            (JSC::StructureSet::containsOutOfLine):
+            (JSC::StructureSet::copyFrom):
+            (JSC::StructureSet::OutOfLineList::create):
+            (JSC::StructureSet::OutOfLineList::destroy):
+            * bytecode/StructureSet.h:
+            (JSC::StructureSet::StructureSet):
+            (JSC::StructureSet::~StructureSet):
+            (JSC::StructureSet::onlyStructure):
+            (JSC::StructureSet::isEmpty):
+            (JSC::StructureSet::size):
+            (JSC::StructureSet::at):
+            (JSC::StructureSet::operator[]):
+            (JSC::StructureSet::last):
+            (JSC::StructureSet::OutOfLineList::list):
+            (JSC::StructureSet::OutOfLineList::OutOfLineList):
+            (JSC::StructureSet::deleteStructureListIfNecessary):
+            (JSC::StructureSet::isThin):
+            (JSC::StructureSet::pointer):
+            (JSC::StructureSet::singleStructure):
+            (JSC::StructureSet::structureList):
+            (JSC::StructureSet::set):
+            (JSC::StructureSet::clear): Deleted.
+            (JSC::StructureSet::add): Deleted.
+            (JSC::StructureSet::addAll): Deleted.
+            (JSC::StructureSet::remove): Deleted.
+            (JSC::StructureSet::contains): Deleted.
+            (JSC::StructureSet::containsOnly): Deleted.
+            (JSC::StructureSet::isSubsetOf): Deleted.
+            (JSC::StructureSet::overlaps): Deleted.
+            (JSC::StructureSet::singletonStructure): Deleted.
+            (JSC::StructureSet::speculationFromStructures): Deleted.
+            (JSC::StructureSet::arrayModesFromStructures): Deleted.
+            (JSC::StructureSet::operator==): Deleted.
+            (JSC::StructureSet::dumpInContext): Deleted.
+            (JSC::StructureSet::dump): Deleted.
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::emitPrototypeChecks):
+            (JSC::DFG::ByteCodeParser::handleGetById):
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+            * dfg/DFGTypeCheckHoistingPhase.cpp:
+            (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheck):
+    
+2014-07-22  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix attempt on the EFL port after r171362.
+
+        Build break because of -Werror=return-type
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::makesCalls):
+
+2014-07-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSLock release should only modify the AtomicStringTable if it modified in acquire
+        https://bugs.webkit.org/show_bug.cgi?id=135143
+
+        Reviewed by Pratik Solanki.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::willDestroyVM):
+        (JSC::JSLock::willReleaseLock):
+        Only set the AtomicStringTable when there was a VM, to balance JSLock::didAcquireLock.
+
+2014-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix cloop build.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeExitSiteData):
+
+2014-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Merge r168635, r168780, r169005, r169014, and r169143 from ftlopt.
+
+    2014-05-20  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG bytecode parser should turn GetById with nothing but a Getter stub as stuff+handleCall, and handleCall should be allowed to inline if it wants to
+            https://bugs.webkit.org/show_bug.cgi?id=133105
+    
+            Reviewed by Michael Saboff.
+            
+            - GetByIdStatus now knows about getters and can report intelligent things about them.
+              As is usually the case with how we do these things, GetByIdStatus knows more about
+              getters than the DFG can actually handle: it'll report details about polymorphic
+              getter calls even though the DFG won't be able to handle those. This is fine; the DFG
+              will see those statuses and bail to a generic slow path.
+            
+            - The DFG::ByteCodeParser now knows how to set up and do handleCall() for a getter call.
+              This can, and usually does, result in inlining of getters!
+            
+            - CodeOrigin and OSR exit know about inlined getter calls. When you OSR out of an
+              inlined getter, we set the return PC to a getter return thunk that fixes up the stack.
+              We use the usual offset-true-return-PC trick, where OSR exit places the true return PC
+              of the getter's caller as a phony argument that only the thunk knows how to find.
+            
+            - Removed a bunch of dead monomorphic chain support from StructureStubInfo.
+            
+            - A large chunk of this change is dragging GetGetterSetterByOffset, GetGetter, and
+              GetSetter through the DFG and FTL. GetGetterSetterByOffset is like GetByOffset except
+              that we know that we're returning a GetterSetter cell. GetGetter and GetSetter extract
+              the getter, or setter, from the GetterSetter.
+            
+            This is a ~2.5x speed-up on the getter microbenchmarks that we already had. So far none
+            of the "real" benchmarks exercise getters enough for this to matter. But I noticed that
+            some of the variants of the Richards benchmark in other languages - for example
+            Wolczko's Java translation of a C++ translation of Deutsch's Smalltalk version - use
+            getters and setters extensively. So, I created a getter/setter JavaScript version of
+            Richards and put it in regress/script-tests/getter-richards.js. That sees about a 2.4x
+            speed-up from this patch, which is very reassuring.
+    
+            * bytecode/CodeBlock.cpp:
+            (JSC::CodeBlock::printGetByIdCacheStatus):
+            (JSC::CodeBlock::findStubInfo):
+            * bytecode/CodeBlock.h:
+            * bytecode/CodeOrigin.cpp:
+            (WTF::printInternal):
+            * bytecode/CodeOrigin.h:
+            (JSC::InlineCallFrame::specializationKindFor):
+            * bytecode/GetByIdStatus.cpp:
+            (JSC::GetByIdStatus::computeFor):
+            (JSC::GetByIdStatus::computeForStubInfo):
+            (JSC::GetByIdStatus::makesCalls):
+            (JSC::GetByIdStatus::computeForChain): Deleted.
+            * bytecode/GetByIdStatus.h:
+            (JSC::GetByIdStatus::makesCalls): Deleted.
+            * bytecode/GetByIdVariant.cpp:
+            (JSC::GetByIdVariant::~GetByIdVariant):
+            (JSC::GetByIdVariant::GetByIdVariant):
+            (JSC::GetByIdVariant::operator=):
+            (JSC::GetByIdVariant::dumpInContext):
+            * bytecode/GetByIdVariant.h:
+            (JSC::GetByIdVariant::GetByIdVariant):
+            (JSC::GetByIdVariant::callLinkStatus):
+            * bytecode/PolymorphicGetByIdList.cpp:
+            (JSC::GetByIdAccess::fromStructureStubInfo):
+            (JSC::PolymorphicGetByIdList::from):
+            * bytecode/SpeculatedType.h:
+            * bytecode/StructureStubInfo.cpp:
+            (JSC::StructureStubInfo::deref):
+            (JSC::StructureStubInfo::visitWeakReferences):
+            * bytecode/StructureStubInfo.h:
+            (JSC::isGetByIdAccess):
+            (JSC::StructureStubInfo::initGetByIdChain): Deleted.
+            * dfg/DFGAbstractHeap.h:
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::addCall):
+            (JSC::DFG::ByteCodeParser::handleCall):
+            (JSC::DFG::ByteCodeParser::handleInlining):
+            (JSC::DFG::ByteCodeParser::handleGetByOffset):
+            (JSC::DFG::ByteCodeParser::handleGetById):
+            (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+            (JSC::DFG::ByteCodeParser::parse):
+            * dfg/DFGCSEPhase.cpp:
+            (JSC::DFG::CSEPhase::getGetterSetterByOffsetLoadElimination):
+            (JSC::DFG::CSEPhase::getInternalFieldLoadElimination):
+            (JSC::DFG::CSEPhase::performNodeCSE):
+            (JSC::DFG::CSEPhase::getTypedArrayByteOffsetLoadElimination): Deleted.
+            * dfg/DFGClobberize.h:
+            (JSC::DFG::clobberize):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            * dfg/DFGJITCompiler.cpp:
+            (JSC::DFG::JITCompiler::linkFunction):
+            * dfg/DFGNode.h:
+            (JSC::DFG::Node::hasStorageAccessData):
+            * dfg/DFGNodeType.h:
+            * dfg/DFGOSRExitCompilerCommon.cpp:
+            (JSC::DFG::reifyInlinedCallFrames):
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            (JSC::DFG::PredictionPropagationPhase::propagate):
+            * dfg/DFGSafeToExecute.h:
+            (JSC::DFG::safeToExecute):
+            * dfg/DFGSpeculativeJIT32_64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * dfg/DFGSpeculativeJIT64.cpp:
+            (JSC::DFG::SpeculativeJIT::compile):
+            * ftl/FTLAbstractHeapRepository.cpp:
+            * ftl/FTLAbstractHeapRepository.h:
+            * ftl/FTLCapabilities.cpp:
+            (JSC::FTL::canCompile):
+            * ftl/FTLLink.cpp:
+            (JSC::FTL::link):
+            * ftl/FTLLowerDFGToLLVM.cpp:
+            (JSC::FTL::LowerDFGToLLVM::compileNode):
+            (JSC::FTL::LowerDFGToLLVM::compileGetGetter):
+            (JSC::FTL::LowerDFGToLLVM::compileGetSetter):
+            * jit/AccessorCallJITStubRoutine.h:
+            * jit/JIT.cpp:
+            (JSC::JIT::assertStackPointerOffset):
+            (JSC::JIT::privateCompile):
+            * jit/JIT.h:
+            * jit/JITPropertyAccess.cpp:
+            (JSC::JIT::emit_op_get_by_id):
+            * jit/ThunkGenerators.cpp:
+            (JSC::arityFixupGenerator):
+            (JSC::baselineGetterReturnThunkGenerator):
+            (JSC::baselineSetterReturnThunkGenerator):
+            (JSC::arityFixup): Deleted.
+            * jit/ThunkGenerators.h:
+            * runtime/CommonSlowPaths.cpp:
+            (JSC::setupArityCheckData):
+            * tests/stress/exit-from-getter.js: Added.
+            * tests/stress/poly-chain-getter.js: Added.
+            (Cons):
+            (foo):
+            (test):
+            * tests/stress/poly-chain-then-getter.js: Added.
+            (Cons1):
+            (Cons2):
+            (foo):
+            (test):
+            * tests/stress/poly-getter-combo.js: Added.
+            (Cons1):
+            (Cons2):
+            (foo):
+            (test):
+            (.test):
+            * tests/stress/poly-getter-then-chain.js: Added.
+            (Cons1):
+            (Cons2):
+            (foo):
+            (test):
+            * tests/stress/poly-getter-then-self.js: Added.
+            (foo):
+            (test):
+            (.test):
+            * tests/stress/poly-self-getter.js: Added.
+            (foo):
+            (test):
+            (getter):
+            * tests/stress/poly-self-then-getter.js: Added.
+            (foo):
+            (test):
+            * tests/stress/weird-getter-counter.js: Added.
+            (foo):
+            (test):
+    
+    2014-05-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] Factor out how CallLinkStatus uses exit site data
+            https://bugs.webkit.org/show_bug.cgi?id=133042
+    
+            Reviewed by Anders Carlsson.
+            
+            This makes it easier to use CallLinkStatus from clients that are calling into after
+            already holding some of the relevant locks. This is necessary because we use a "one lock
+            at a time" policy for CodeBlock locks: if you hold one then you're not allowed to acquire
+            any of the others. So, any code that needs to lock multiple CodeBlock locks needs to sort
+            of lock one, do some stuff, release it, then lock another, and then do more stuff. The
+            exit site data corresponds to the stuff you do while holding the baseline lock, while the
+            CallLinkInfo method corresponds to the stuff you do while holding the CallLinkInfo owner's
+            lock.
+    
+            * bytecode/CallLinkStatus.cpp:
+            (JSC::CallLinkStatus::computeFor):
+            (JSC::CallLinkStatus::computeExitSiteData):
+            (JSC::CallLinkStatus::computeDFGStatuses):
+            * bytecode/CallLinkStatus.h:
+            (JSC::CallLinkStatus::ExitSiteData::ExitSiteData):
+    
+    2014-05-17  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] InlineCallFrame::isCall should be an enumeration
+            https://bugs.webkit.org/show_bug.cgi?id=133034
+    
+            Reviewed by Sam Weinig.
+            
+            Once we start inlining getters and setters, we'll want InlineCallFrame to be able to tell
+            us that the inlined call was a getter call or a setter call. Initially I thought I would
+            have a new field called "kind" that would have components NormalCall, GetterCall, and
+            SetterCall. But that doesn't make sense, because for GetterCall and SetterCall, isCall
+            would have to be true. Hence, It makes more sense to have one enumeration that is Call,
+            Construct, GetterCall, or SetterCall. This patch is a first step towards this.
+            
+            It's interesting that isClosureCall should probably still be separate, since getter and
+            setter inlining could inline closure calls.
+    
+            * bytecode/CodeBlock.h:
+            (JSC::baselineCodeBlockForInlineCallFrame):
+            * bytecode/CodeOrigin.cpp:
+            (JSC::InlineCallFrame::dumpInContext):
+            (WTF::printInternal):
+            * bytecode/CodeOrigin.h:
+            (JSC::InlineCallFrame::kindFor):
+            (JSC::InlineCallFrame::specializationKindFor):
+            (JSC::InlineCallFrame::InlineCallFrame):
+            (JSC::InlineCallFrame::specializationKind):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+            * dfg/DFGOSRExitPreparation.cpp:
+            (JSC::DFG::prepareCodeOriginForOSRExit):
+            * runtime/Arguments.h:
+            (JSC::Arguments::finishCreation):
+    
+    2014-05-13  Filip Pizlo  <fpizlo@apple.com>
+    
+            [ftlopt] DFG should not exit due to inadequate profiling coverage when it can trivially fill in the profiling coverage due to variable constant inference and the better prediction modeling of typed array GetByVals
+            https://bugs.webkit.org/show_bug.cgi?id=132896
+    
+            Reviewed by Geoffrey Garen.
+            
+            This is a slight win on SunSpider, but it's meant to ultimately help us on
+            embenchen/lua. We already do well on that benchmark but our convergence is slower than
+            I'd like.
+    
+            * dfg/DFGArrayMode.cpp:
+            (JSC::DFG::ArrayMode::refine):
+            * dfg/DFGByteCodeParser.cpp:
+            (JSC::DFG::ByteCodeParser::parseBlock):
+            * dfg/DFGFixupPhase.cpp:
+            (JSC::DFG::FixupPhase::fixupNode):
+            * dfg/DFGPredictionPropagationPhase.cpp:
+            (JSC::DFG::PredictionPropagationPhase::propagate):
+    
+    2014-05-08  Filip Pizlo  <fpizlo@apple.com>
+    
+            jsSubstring() should be lazy
+            https://bugs.webkit.org/show_bug.cgi?id=132556
+    
+            Reviewed by Andreas Kling.
+            
+            jsSubstring() is now lazy by using a special rope that is a substring instead of a
+            concatenation. To make this patch super simple, we require that a substring's base is
+            never a rope. Hence, when resolving a rope, we either go down a non-recursive substring
+            path, or we go down a concatenation path which may see exactly one level of substrings in
+            its fibers.
+            
+            This is up to a 50% speed-up on microbenchmarks and a 10% speed-up on Octane/regexp.
+            
+            Relanding this with assertion fixes.
+    
+            * heap/MarkedBlock.cpp:
+            (JSC::MarkedBlock::specializedSweep):
+            * runtime/JSString.cpp:
+            (JSC::JSRopeString::visitFibers):
+            (JSC::JSRopeString::resolveRopeInternal8):
+            (JSC::JSRopeString::resolveRopeInternal16):
+            (JSC::JSRopeString::clearFibers):
+            (JSC::JSRopeString::resolveRope):
+            (JSC::JSRopeString::resolveRopeSlowCase8):
+            (JSC::JSRopeString::resolveRopeSlowCase):
+            * runtime/JSString.h:
+            (JSC::JSRopeString::finishCreation):
+            (JSC::JSRopeString::append):
+            (JSC::JSRopeString::create):
+            (JSC::JSRopeString::offsetOfFibers):
+            (JSC::JSRopeString::fiber):
+            (JSC::JSRopeString::substringBase):
+            (JSC::JSRopeString::substringOffset):
+            (JSC::JSRopeString::notSubstringSentinel):
+            (JSC::JSRopeString::substringSentinel):
+            (JSC::JSRopeString::isSubstring):
+            (JSC::JSRopeString::setIsSubstring):
+            (JSC::jsSubstring):
+            * runtime/RegExpMatchesArray.cpp:
+            (JSC::RegExpMatchesArray::reifyAllProperties):
+            * runtime/StringPrototype.cpp:
+            (JSC::stringProtoFuncSubstring):
+    
+2014-07-21  Sam Weinig  <sam@webkit.org>
+
+        [Cocoa] WKScriptMessageHandlers don't seem to function properly after navigating
+        https://bugs.webkit.org/show_bug.cgi?id=135148
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/CommonIdentifiers.h:
+        Add a common identifier for the string "webkit".
+
+2014-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILED: info.spillFormat() & DataFormatJS in JSC::DFG::SpeculativeJIT::fillSpeculateCell
+        https://bugs.webkit.org/show_bug.cgi?id=135155
+        <rdar://problem/17763909>
+
+        Reviewed by Oliver Hunt.
+        
+        The DFG fillSpeculate code paths all need to be mindful of the fact that they may be stumbling upon a
+        contradiction, and that this is OK. In this case, we were speculating cell on an int.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        * tests/stress/regress-135155.js: Added.
+        (run.t.length):
+        (run):
+
+2014-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Extend exception fuzzing to the LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=135076
+
+        Reviewed by Oliver Hunt.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITOperations.cpp:
+        (JSC::numberOfExceptionFuzzChecks): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/ExceptionFuzz.cpp: Added.
+        (JSC::numberOfExceptionFuzzChecks):
+        (JSC::doExceptionFuzzing):
+        * runtime/ExceptionFuzz.h: Added.
+        (JSC::doExceptionFuzzingIfEnabled):
+
+2014-07-21  Mark Lam  <mark.lam@apple.com>
+
+        Refactor ArrayPrototype to use getLength() and putLength() utility functions.
+        https://bugs.webkit.org/show_bug.cgi?id=135139.
+
+        Reviewed by Oliver Hunt.
+
+        - Specialize putProperty() to putLength() because it is only used for setting
+          the length property.
+        - Added a getLength() utility function to get the value of the length property.
+        - Use these getLength() and putLength() functions instead of the existing code
+          to get and put the length property.  Less code to read, easier to understand.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getLength):
+        (JSC::putLength):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        (JSC::putProperty): Deleted.
+
+2014-07-21  Diego Pino Garcia  <dpino@igalia.com>
+
+        new Int32Array(new ArrayBuffer(100), 1, 1) shouldn't throw an error that says "RangeError: Byte offset and length out of range of buffer"
+        https://bugs.webkit.org/show_bug.cgi?id=125391
+
+        Reviewed by Darin Adler.
+
+        Create own method for verifying byte offset alignment.
+
+        * runtime/ArrayBufferView.h:
+        (JSC::ArrayBufferView::verifyByteOffsetAlignment):
+        (JSC::ArrayBufferView::verifySubRangeLength):
+        (JSC::ArrayBufferView::verifySubRange): Deleted.
+        * runtime/GenericTypedArrayViewInlines.h:
+        (JSC::GenericTypedArrayView<Adaptor>::create):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::create):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::create):
+
+2014-07-20  Diego Pino Garcia  <dpino@igalia.com>
+
+        ES6: Implement Math.sign()
+        https://bugs.webkit.org/show_bug.cgi?id=134980
+
+        Reviewed by Darin Adler.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        (JSC::mathProtoFuncSign):
+
+2014-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Exception fuzzing should work on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=135070
+
+        Reviewed by Mark Hahnenberg.
+
+        * tests/exceptionFuzz.yaml:
+
+2014-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix cloop build.
+
+        * jsc.cpp:
+        (jscmain):
+
+2014-07-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Need ability to fuzz exception throwing
+        https://bugs.webkit.org/show_bug.cgi?id=134945
+        <rdar://problem/17722027>
+
+        Reviewed by Sam Weinig.
+        
+        Adds the ability to instrument exception checks, and to force some random
+        exception check to artificially throw an exception. Also adds new tests that
+        are suitable for testing this. Note that this is closely tied to the Tools
+        directory changes that are also part of this changeset.
+        
+        This also fixes an activation tear-off bug that arises if we ever throw an
+        exception from operationOptimize, or if due to some other bug it's only due
+        to the operationOptimize exception check that we realize that there is an
+        exception to be thrown.
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::fastExceptionCheck):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::callCheck):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::callExceptionFuzz):
+        (JSC::AssemblyHelpers::emitExceptionCheck):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitExceptionCheck): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enter):
+        * jit/JITOperations.cpp:
+        (JSC::numberOfExceptionFuzzChecks):
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (jscmain):
+        * runtime/Options.h:
+        * runtime/TestRunnerUtils.h:
+        * tests/exceptionFuzz.yaml: Added.
+        * tests/exceptionFuzz: Added.
+        * tests/exceptionFuzz/3d-cube.js: Added.
+        * tests/exceptionFuzz/date-format-xparb.js: Added.
+        * tests/exceptionFuzz/earley-boyer.js: Added.
+
+2014-07-17  David Kilzer  <ddkilzer@apple.com>
+
+        SECTORDER_FLAGS should be defined in target's xcconfig file, not Base.xcconfig
+        <http://webkit.org/b/135006>
+
+        Reviewed by Darin Adler.
+
+        * Configurations/Base.xcconfig: Move SECTORDER_FLAGS to
+        JavaScriptCore.xcconfig.
+        * Configurations/CompileRuntimeToLLVMIR.xcconfig: Remove empty
+        SECTORDER_FLAGS definition.
+        * Configurations/DebugRelease.xcconfig: Ditto.
+        * Configurations/JavaScriptCore.xcconfig: Use $(CONFIGURATION)
+        so SECTORDER_FLAGS is only set on Production builds.
+
+2014-07-17  Juergen Ributzka  <juergen@apple.com>
+
+        Disable live-out calculation for stackmap intrinsics.
+        https://bugs.webkit.org/show_bug.cgi?id=134366
+
+        The live-out variables are not required for the stackmaps, because we
+        don't care about preserving the state when we perform destructive
+        patching.
+
+        Reviewed by Filip Pizlo.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-07-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Follow-up fix to r171195 to prevent ASSERT in fast/profiler/profile-with-no-title.html
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Null / empty titles should be fine. Tests pass in release builds
+        which allowed empty titles, and it looks like the LegacyProfiler
+        stopProfiling handles empty titles as expected already.
+
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::startProfiling):
+
+2014-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Flush(SetLocal) store elimination is overzealous for captured variables in the presence of nodes that have no effects but may throw
+        https://bugs.webkit.org/show_bug.cgi?id=134988
+        <rdar://problem/17706349>
+
+        Reviewed by Oliver Hunt.
+        
+        Luckily, we also don't need this optimization to be super powerful: the only place
+        where it really matters is for getting rid of the redundancy between op_enter and
+        op_init_lazy_reg, and in that case, there is a small set of possible nodes between the
+        two things. This change updates the store eliminator to know about only that small,
+        obviously safe, set of nodes over which we can store-eliminate.
+        
+        This shouldn't have any performance impact in the DFG because this optimization kicks
+        in relatively rarely already. And once we tier up into the FTL, we get a much better
+        store elimination over LLVM IR, so this really shouldn't matter at all.
+        
+        The tricky part of this patch is that there is a close relative of this optimization,
+        for uncaptured variables that got flushed. This happens for arguments to inlined calls.
+        I make this work by splitting it into two different store eliminators.
+        
+        Note that in the process of crafting the tests, I realized that we were incorrectly
+        DCEing NewArrayWithSize. That's not cool, since that can throw an exception for
+        negative array sizes. If we ever did want to DCE this node, we'd need to lower the node
+        to a check node followed by the actual allocation.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::uncapturedSetLocalStoreElimination):
+        (JSC::DFG::CSEPhase::capturedSetLocalStoreElimination):
+        (JSC::DFG::CSEPhase::setLocalStoreElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult): Deleted.
+        * dfg/DFGNodeType.h:
+        * tests/stress/capture-escape-and-throw.js: Added.
+        (foo.f):
+        (foo):
+        * tests/stress/new-array-with-size-throw-exception-and-tear-off-arguments.js: Added.
+        (foo):
+        (bar):
+
+2014-07-15  Benjamin Poulain  <benjamin@webkit.org>
+
+        Reduce the overhead of updating the AssemblerBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=134659
+
+        Reviewed by Gavin Barraclough.
+
+        In r164548, the linker was changed to allow the LinkBuffer to survive its MacroAssembler.
+        That feature is useful for JSC to get offsets inside a linked buffer in order to jump directly
+        there.
+
+        On ARM, we use branch compaction and we need to keep the "compaction offset" somewher to be able
+        to get the real address of a lable. That is done by reusing the memory of AssemblerData.
+
+        To share the memory between LinkBuffer and the Assembler, r164548 moved the AssemblerData into
+        a ref-counted object. Unfortunately, the extra complexity related to the new AssemblerData was enough
+        to make clang give up a bunch of optimizations.
+
+        This patch solve (some of) the problems by making AssemblerBuffer and AssemblerData super low overhead structures.
+        In particular, the grow() function becomes 8 Thumb instructions, which is easily inlined everywhere it is used.
+
+        Instead of sharing ownership between the Assembler and LinkBuffer, LinkBuffer now takes full ownership of
+        the AssemblerData. I feel this is also safer since LinkBuffer is reusing the AssemblerData is a very
+        specific way that would make it unusable for the Assembler.
+
+        -- Technical details --
+
+        From LinkBuffer, we don't want to ever access the Assembler after releasing its buffer (or writting anything
+        into it really). This was obviously already the case, but that was hard to prove from LinkBuffer::copyCompactAndLinkCode().
+        To make this easier to work with, I changed all the assembler specific function to be static. This way we know
+        exactly what code access the Assembler instance. The code that does access the instance is then moved
+        at the beginning, before we modify anything.
+
+        The function recordLinkOffsets() that was on the MacroAssembler and copied in Assembler was moved directly
+        to LinkBuffer. This make the modification of AssemblerData completely explicit, and that code is specific
+        to LinkBuffer anyway (see LinkBuffer::executableOffsetFor()).
+
+        -- Perf impact --
+
+        This does not put us exactly at before r164548 due to the missing inline buffer. Still, it is very close.
+        On ARMv7, this reduces the time spent in Assembler by half. On the CSS JIT, this reduces the compilation
+        time by ~20%.
+
+        I could not measure any difference on x86_64.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::jumpSizeDelta):
+        (JSC::ARM64Assembler::canCompact):
+        (JSC::ARM64Assembler::computeJumpType):
+        (JSC::ARM64Assembler::link):
+        (JSC::ARM64Assembler::recordLinkOffsets): Deleted.
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ifThenElseConditionBit):
+        (JSC::ARMv7Assembler::ifThenElse):
+        (JSC::ARMv7Assembler::jumpSizeDelta):
+        (JSC::ARMv7Assembler::canCompact):
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::linkJumpT1):
+        (JSC::ARMv7Assembler::linkJumpT3):
+        (JSC::ARMv7Assembler::linkConditionalJumpT4):
+        (JSC::ARMv7Assembler::linkConditionalBX):
+        (JSC::ARMv7Assembler::recordLinkOffsets): Deleted.
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerData::AssemblerData):
+        (JSC::AssemblerData::operator=):
+        (JSC::AssemblerData::~AssemblerData):
+        (JSC::AssemblerData::buffer):
+        (JSC::AssemblerData::capacity):
+        (JSC::AssemblerData::grow):
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::isAvailable):
+        (JSC::AssemblerBuffer::data):
+        (JSC::AssemblerBuffer::releaseAssemblerData):
+        (JSC::AssemblerBuffer::putIntegral):
+        (JSC::AssemblerBuffer::putIntegralUnchecked):
+        (JSC::AssemblerBuffer::append):
+        (JSC::AssemblerBuffer::grow):
+        (JSC::AssemblerBuffer::~AssemblerBuffer): Deleted.
+        (JSC::AssemblerBuffer::storage): Deleted.
+        * assembler/LinkBuffer.cpp:
+        (JSC::recordLinkOffsets):
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::executableOffsetFor):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::canCompact):
+        (JSC::MacroAssemblerARM64::computeJumpType):
+        (JSC::MacroAssemblerARM64::jumpSizeDelta):
+        (JSC::MacroAssemblerARM64::link):
+        (JSC::MacroAssemblerARM64::recordLinkOffsets): Deleted.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::canCompact):
+        (JSC::MacroAssemblerARMv7::computeJumpType):
+        (JSC::MacroAssemblerARMv7::jumpSizeDelta):
+        (JSC::MacroAssemblerARMv7::link):
+        (JSC::MacroAssemblerARMv7::recordLinkOffsets): Deleted.
+
+2014-07-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Stores to PropertyTable use the Structure as the owner
+        https://bugs.webkit.org/show_bug.cgi?id=134595
+
+        Reviewed by Darin Adler.
+
+        Since PropertyTable is the object that does the marking of these references, it should be the owner.
+
+        Also removed some unused parameters to other methods that historically used the Structure as the owner.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::StructureRareData::setEnumerationCache):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::copy):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::clone):
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::putSpecificValue):
+        * runtime/Structure.h:
+        (JSC::Structure::setObjectToStringValue):
+        (JSC::Structure::setPreviousID):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::setEnumerationCache):
+        * runtime/StructureRareData.h:
+        * runtime/StructureRareDataInlines.h:
+        (JSC::StructureRareData::setPreviousID):
+        (JSC::StructureRareData::setObjectToStringValue):
+
+2014-07-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        ScriptExecutable::forEachCodeBlock can dereference null CodeBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=134928
+
+        Reviewed by Andreas Kling.
+
+        * bytecode/CodeBlock.h:
+        (JSC::ScriptExecutable::forEachCodeBlock): Check for null CodeBlocks before calling forEachRelatedCodeBlock.
+
+2014-07-15  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        Buildfix if LLINT_SLOW_PATH_TRACING is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=133790
+
+        Reviewed by Mark Lam.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2014-07-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Allow for Int52Rep to see things other than Int32, and make this testable
+        https://bugs.webkit.org/show_bug.cgi?id=134873
+        <rdar://problem/17641915>
+
+        Reviewed by Geoffrey Garen and Mark Hahnenberg.
+        
+        A major premise of our type inference is that prediction propagation can say whatever it
+        wants and we'll still have valid IR after Fixup. This previously didn't work with Int52s.
+        We required some kind of agreement between prediction propagation and fixup over which
+        data flow paths were Int52 and which weren't.
+        
+        It turns out that we basically had such an agreement, with the exception of code that was
+        unreachable due to ForceOSRExit. Then, fixup and prediction propagation would disagree. It
+        might be nice to fix that bug - but it's only in the case of Int52 that such a thing would
+        be a bug! Normally, we allow sloppiness in prediction propagation.
+        
+        This patch allows us to be sloppy with Int52 prediction propagation by giving Int52Rep the
+        ability to see inputs other than Int32. This fixes the particular ForceOSRExit bug (see
+        int52-force-osr-exit-path.js for the reduced test case). To make sure that the newly
+        empowered Int52Rep is actually correct - in case we end up using it on paths other than
+        ForceOSRExit - this patch introduces an internal intrinsic called fiatInt52() that forces
+        us to attempt Int52 conversion on the input. This patch adds a bunch of tests that stress
+        this intrinsic. This means that we're now stressing Int52Rep more so than ever before!
+        
+        Note that it would still be a bug for prediction propagation to ever cause us to create an
+        Int52Rep node for a non-Int32 input. But, this will now be a performance bug, rather than
+        a crash bug.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::fixTypeForRepresentation):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isMachineIntConstant):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isMachineIntConstant):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::convertMachineInt):
+        (JSC::DFG::SpeculativeJIT::speculateMachineInt):
+        (JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isNumerical):
+        (JSC::DFG::isDouble):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileInt52Rep):
+        (JSC::FTL::LowerDFGToLLVM::doubleToInt32):
+        (JSC::FTL::LowerDFGToLLVM::jsValueToDouble):
+        (JSC::FTL::LowerDFGToLLVM::jsValueToStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::doubleToStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateMachineInt):
+        (JSC::FTL::LowerDFGToLLVM::speculateDoubleRepMachineInt):
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionIdentity):
+        * runtime/Intrinsic.h:
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::tryConvertToInt52):
+        (JSC::isInt52):
+        (JSC::JSValue::isMachineInt):
+        * tests/stress/dead-fiat-double-to-int52-then-exit-not-int52.js: Added.
+        (foo):
+        * tests/stress/dead-fiat-double-to-int52.js: Added.
+        (foo):
+        * tests/stress/dead-fiat-int32-to-int52.js: Added.
+        (foo):
+        * tests/stress/dead-fiat-value-to-int52-double-path.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/dead-fiat-value-to-int52-then-exit-not-double.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/dead-fiat-value-to-int52-then-exit-not-int52.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/dead-fiat-value-to-int52.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/fiat-double-to-int52-then-exit-not-int52.js: Added.
+        (foo):
+        * tests/stress/fiat-double-to-int52-then-fail-to-fold.js: Added.
+        (foo):
+        * tests/stress/fiat-double-to-int52-then-fold.js: Added.
+        (foo):
+        * tests/stress/fiat-double-to-int52.js: Added.
+        (foo):
+        * tests/stress/fiat-int32-to-int52.js: Added.
+        (foo):
+        * tests/stress/fiat-value-to-int52-double-path.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/fiat-value-to-int52-then-exit-not-double.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/fiat-value-to-int52-then-exit-not-int52.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/fiat-value-to-int52-then-fail-to-fold.js: Added.
+        (foo):
+        * tests/stress/fiat-value-to-int52-then-fold.js: Added.
+        (foo):
+        * tests/stress/fiat-value-to-int52.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/int52-force-osr-exit-path.js: Added.
+        (foo):
+
+2014-07-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Flattening dictionaries with oversize backing stores can cause crashes
+        https://bugs.webkit.org/show_bug.cgi?id=134906
+
+        Reviewed by Filip Pizlo.
+
+        The collector expects any pointers into CopiedSpace passed to copyLater are within 32 KB 
+        of the CopiedBlock header. This was always the case except for when flattening a dictionary 
+        caused the size of the Butterfly to decrease. This was equivalent to moving the base of the 
+        Butterfly to higher addresses. If the object was reduced sufficiently in size, the base 
+        would no longer be within the first 32 KB of the CopiedBlock and the next collection would 
+        choke on the Butterfly pointer.
+
+        This patch fixes this issue by detect this situation during flattening and memmove-ing 
+        the Butterfly down to where the old base was.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::shiftButterflyAfterFlattening):
+        * runtime/JSObject.h:
+        (JSC::JSObject::butterflyPreCapacity):
+        (JSC::JSObject::butterflyTotalSize):
+        * runtime/Structure.cpp:
+        (JSC::Structure::flattenDictionaryStructure):
+        * tests/stress/flatten-oversize-dictionary-object.js: Added.
+        (foo):
+
+2014-07-14  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove some dead code from FTLJITFinalizer
+        https://bugs.webkit.org/show_bug.cgi?id=134874
+
+        Reviewed by Geoffrey Garen.
+
+        Not sure what that code was for...but it does not do anything :)
+
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        The pointer of the label is computed but never used.
+
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        The label is never set to anything.
+
+2014-07-14  Bear Travis  <betravis@adobe.com>
+
+        [Feature Queries] Enable Feature Queries on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=134404
+
+        Reviewed by Antti Koivisto.
+
+        Enable Feature Queries on Mac and resume running the
+        feature tests.
+
+        * Configurations/FeatureDefines.xcconfig: Turn on
+        ENABLE_CSS3_CONDITIONAL_RULES.
+
+2014-07-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Debugger Pause button does not work
+        https://bugs.webkit.org/show_bug.cgi?id=134785
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        Minification strips the sourceURL command. Add it back with minification.
+
+2014-07-11  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Enable DFG JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=123615
+
+        Reviewed by Mark Lam.
+
+        When the return type of a JIT generated function call is larger than 64-bit (e.g. SlowPathReturnType),
+        the normal call() implementation cannot be used on 64-bit Windows, because the 64-bit Windows ABI is different in this case.
+        Also, when generating calls with double arguments, we need to make sure the arguments are put in the correct registers,
+        since the register allocation differs on 64-bit Windows.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::callWithSlowPathReturnType): Added method to handle function calls where the return value type size is larger than 64-bit.
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState): Move arguments to correct registers when there are floating point arguments.
+        (JSC::CCallHelpers::setupArgumentsWithExecStateForCallWithSlowPathReturnType): Added method.
+        * jit/JIT.h:
+        (JSC::JIT::appendCallWithSlowPathReturnType): Added method.
+        * jit/JITInlines.h:
+        (JSC::JIT::appendCallWithExceptionCheckAndSlowPathReturnType): Added method.
+        (JSC::JIT::callOperation): Call new method.
+
+2014-07-09  Benjamin Poulain  <benjamin@webkit.org>
+
+        Use 16bits instructions for push/pop on ARMv7 when possible
+        https://bugs.webkit.org/show_bug.cgi?id=134753
+
+        Reviewed by Geoffrey Garen.
+
+        The patch r170839 mixed the code for push/pop pair and single push/pop.
+        That part was reverted in r170909.
+
+        This patch puts the code back but specialized for single push/pop.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::pop):
+        (JSC::ARMv7Assembler::push):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::pop):
+        (JSC::MacroAssemblerARMv7::push):
+
+2014-07-09  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Remove uses of 'bash' in build system
+        https://bugs.webkit.org/show_bug.cgi?id=134782
+        <rdar://problem/17615533>
+
+        Reviewed by Dean Jackson.
+
+        Remove uses of 'bash' by replacing Windows-specific bash scripts
+        with Perl equivalents.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.pl: Copied from Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.pl: Copied from Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh.
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Removed.
+        * JavaScriptCore.vcxproj/build-generated-files.pl: Copied from Source/JavaScriptCore/JavaScriptCore.vcxproj/build-generated-files.sh.
+        * JavaScriptCore.vcxproj/build-generated-files.sh: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscPreBuild.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd:
+
+2014-07-09  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Remove use of 'grep' in build steps
+        https://bugs.webkit.org/show_bug.cgi?id=134770
+        <rdar://problem/17608783>
+
+        Reviewed by Tim Horton.
+
+        Replace uses of the grep command in Windows builds with the equivalent
+        Perl program.
+
+        * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscPreBuild.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd:
+
+2014-07-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Restore the assertion changed with 170839
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::pop):
+        (JSC::ARMv7Assembler::push):
+        Revert the Assembler part of 170839. The assertions do not match both encoding.
+
+        I'll add specific version of push and pop instead.
+
+2014-07-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        RemoteInspector::shared() should not call WTF::initializeMainThread()
+        <https://bugs.webkit.org/show_bug.cgi?id=134747>
+        <rdar://problem/17161482>
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::shared):
+        Don't call WTF::initializeMainThread(). WTF threading is initialized by
+        JSC::initializeThreading().
+
+2014-07-08  Andreas Kling  <akling@apple.com>
+
+        VM::lastCachedString should be a Strong, not a Weak.
+        <https://webkit.org/b/134746>
+
+        Using Weak<JSString> for this regressed some of our bindings perf tests
+        due to Weak having to allocate a new WeakImpl every time the last cached
+        string changed. Make it a Strong instead should make that problem go away.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSString.cpp:
+        (JSC::jsStringWithCacheSlowCase):
+        * runtime/VM.h:
+
+2014-07-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        Fix the build after r170876
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::linkCode):
+
+2014-07-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        LinkBuffer should not keep a reference to the MacroAssembler
+        https://bugs.webkit.org/show_bug.cgi?id=134668
+
+        Reviewed by Geoffrey Garen.
+
+        In FTL, the LinkBuffer can outlive the MacroAssembler that was used for code generation.
+        When that happens, the pointer m_assembler points to released memory. That was not causing
+        issues because the attribute is not used after linking, but that was not particularily
+        future proof.
+
+        This patch refactors LinkBuffer to avoid any lifetime risk. The MacroAssembler is now passed
+        as a reference, it is used for linking but no reference is ever stored with the LinkBuffer.
+
+        While fixing the call sites to use a reference, I also discovered LinkBuffer.h was included
+        everywhere. I refactored some #include to avoid that.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        (JSC::LinkBuffer::linkCode):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        * bytecode/Watchpoint.cpp:
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGDisassembler.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::linkFunction):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGPlan.cpp:
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+        (JSC::DFG::osrEntryThunkGenerator):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::generateICFastPath):
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLJSCall.cpp:
+        * ftl/FTLJSCall.h:
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        (JSC::FTL::slowPathCallThunkGenerator):
+        * jit/ArityCheckFailReturnThunks.cpp:
+        (JSC::ArityCheckFailReturnThunks::returnPCsFor):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCall.cpp:
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITDisassembler.cpp:
+        * jit/JITDisassembler.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompilePutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/RegisterPreservationWrapperGenerator.cpp:
+        (JSC::generateRegisterPreservationWrapper):
+        (JSC::registerRestorationThunkGenerator):
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::tryCacheGetByID):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        (JSC::tryRepatchIn):
+        (JSC::linkClosureCall):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::linkForThunkGenerator):
+        (JSC::linkClosureCallForThunkGenerator):
+        (JSC::virtualForThunkGenerator):
+        (JSC::nativeForGenerator):
+        (JSC::arityFixup):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::generateThunkWithJumpTo):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+
+2014-07-07  Andreas Kling  <akling@apple.com>
+
+        Fast path for jsStringWithCache() when asked for the same string repeatedly.
+        <https://webkit.org/b/134635>
+
+        Reviewed by Darin Adler.
+
+        Follow-up to r170818 addressing a review comment by Geoff Garen.
+
+        * runtime/JSString.cpp:
+        (JSC::jsStringWithCacheSlowCase):
+
+2014-07-07  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
+
+        Add missing ENABLE(FTL_JIT) guards
+        https://bugs.webkit.org/show_bug.cgi?id=134680
+
+        Reviewed by Darin Adler.
+
+        * ftl/FTLDWARFDebugLineInfo.cpp:
+        * ftl/FTLDWARFDebugLineInfo.h:
+        * ftl/FTLGeneratedFunction.h:
+
+2014-07-07  Zan Dobersek  <zdobersek@igalia.com>
+
+        Enable ARMv7 disassembler for the GTK port
+        https://bugs.webkit.org/show_bug.cgi?id=134676
+
+        Reviewed by Benjamin Poulain.
+
+        * CMakeLists.txt: Add ARMv7DOpcode.cpp file to the build.
+        * disassembler/ARMv7/ARMv7DOpcode.cpp: Include the string.h header for strlen().
+
+2014-07-06  Benjamin Poulain  <benjamin@webkit.org>
+
+        [ARMv7] Use 16 bits instructions for push/pop when possible
+        https://bugs.webkit.org/show_bug.cgi?id=134656
+
+        Reviewed by Andreas Kling.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::pop):
+        (JSC::ARMv7Assembler::push):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::oneWordOp7Imm9):
+        Add the 16 bits version of push and pop.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::pop):
+        (JSC::MacroAssemblerARMv7::push):
+        Use the new push/pop instead of a regular load/store.
+
+        * disassembler/ARMv7/ARMv7DOpcode.cpp:
+        (JSC::ARMv7Disassembler::ARMv7DOpcode::appendRegisterList):
+        * disassembler/ARMv7/ARMv7DOpcode.h:
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeMiscPushPop::registerMask):
+        Fix the disassembler for push/pop:
+        -The register mask was on 7 bits for some reason.
+        -The code printing the registers was comparing a register ID with a register
+         mask.
+
+2014-07-06  Yoav Weiss  <yoav@yoav.ws>
+
+        Turn on img@sizes compile flag
+        https://bugs.webkit.org/show_bug.cgi?id=134634
+
+        Reviewed by Benjamin Poulain.
+
+        * Configurations/FeatureDefines.xcconfig: Moved compile flag to alphabetical order.
+
+2014-07-06  Daewoong Jang  <daewoong.jang@navercorp.com>
+
+        Flags value of SourceCodeKey should be unique for each case.
+        https://bugs.webkit.org/show_bug.cgi?id=134435
+
+        Reviewed by Darin Adler.
+
+        Different combinations of CodeType and JSParserStrictness could generate same m_flags value because
+        the value of CodeType and the value of JSParserStrictness shares a bit inside m_flags member variable.
+        Shift the value of CodeType one bit farther to the left so those values don't overlap.
+
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::SourceCodeKey):
+
+2014-07-04  Andreas Kling  <akling@apple.com>
+
+        Fast path for jsStringWithCache() when asked for the same string repeatedly.
+        <https://webkit.org/b/134635>
+
+        Also moved the whole thing from WebCore to JavaScriptCore since it
+        makes more sense here, and inline the lightweight checks, leaving only
+        the hashmap stuff out of line.
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSString.cpp:
+        (JSC::jsStringWithCacheSlowCase):
+        * runtime/JSString.h:
+        (JSC::jsStringWithCache):
+        * runtime/VM.h:
+
+2014-07-03  Daniel Bates  <dabates@apple.com>
+
+        Add WTF::move()
+        https://bugs.webkit.org/show_bug.cgi?id=134500
+
+        Rubber-stamped by Anders Carlsson.
+
+        Substitute WTF::move() for std::move().
+
+        * bytecode/CodeBlock.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * dfg/DFGGraph.cpp:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGStackLayoutPhase.cpp:
+        * dfg/DFGWorklist.cpp:
+        * heap/DelayedReleaseScope.h:
+        * heap/HeapInlines.h:
+        [...]
+
+2014-07-03  Filip Pizlo  <fpizlo@apple.com>
+
+        SSA DCE should process blocks in forward order
+        https://bugs.webkit.org/show_bug.cgi?id=134611
+
+        Reviewed by Andreas Kling.
+
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+        * tests/stress/dead-value-with-mov-hint-in-another-block.js: Added.
+        (foo):
+
+2014-07-03  Filip Pizlo  <fpizlo@apple.com>
+
+        JSActivation::symbolTablePut() should invalidate variable watchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=134602
+
+        Reviewed by Oliver Hunt.
+        
+        Usually stores to captured variables cause us to invalidate the variable watchpoint because CodeBlock does so
+        during linking - we essentially assume that if it's at all possible for an inner function to store to a
+        variable we declare then this variable cannot be a constant. But this misses the dynamic store case, i.e.
+        JSActivation::symbolTablePut(). Part of the problem here is that JSActivation duplicates
+        JSSymbolTableObject's symbolTablePut() logic, which did have the invalidation. This patch keeps that code
+        duplicated, but fixes JSActivation::symbolTablePut() to do the right thing.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTablePut):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        * tests/stress/constant-closure-var-with-dynamic-invalidation.js: Added.
+        (.):
+
+2014-07-01  Mark Lam  <mark.lam@apple.com>
+
+        Debugger's breakpoint list should not be a Vector.
+        <https://webkit.org/b/134514>
+
+        Reviewed by Geoffrey Garen.
+
+        The debugger currently stores breakpoint data as entries in a Vector (see
+        BreakpointsInLine).  It also keeps a fast map look up of breakpoint IDs to
+        the breakpoint data (see m_breakpointIDToBreakpoint).  Because a Vector can
+        compact or reallocate its backing store, this can causes all sorts of havoc.
+        The m_breakpointIDToBreakpoint map assumes that the breakpoint data doesn't
+        move in memory.
+
+        The fix is to replace the BreakpointsInLine Vector with a BreakpointsList
+        doubly linked list.
+
+        * debugger/Breakpoint.h:
+        (JSC::Breakpoint::Breakpoint):
+        (JSC::BreakpointsList::~BreakpointsList):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::setBreakpoint):
+        (JSC::Debugger::removeBreakpoint):
+        (JSC::Debugger::hasBreakpoint):
+        * debugger/Debugger.h:
+
+2014-06-30  Michael Saboff  <msaboff@apple.com>
+
+        Add option to run-jsc-stress-testes to filter out tests that use large heaps
+        https://bugs.webkit.org/show_bug.cgi?id=134458
+
+        Reviewed by Filip Pizlo.
+
+        Added test to skip js1_5/Regress/regress-159334.js when testing on a memory limited device.
+
+        * tests/mozilla/mozilla-tests.yaml:
+
+2014-06-30  Daniel Bates  <dabates@apple.com>
+
+        Avoid copying closed variables vector; actually use move semantics
+
+        Rubber-stamped by Oliver Hunt.
+
+        Currently we always copy the closed variables vector passed by Parser::closedVariables()
+        to ProgramNode::setClosedVariables() because these member functions return and take a const
+        rvalue reference, respectively. Instead, these member functions should take an return a non-
+        constant rvalue reference so that we actually move the closed variables vector from the Parser
+        object to the Node object.
+
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::setClosedVariables): Remove const qualifier for argument.
+        * parser/Nodes.h:
+        (JSC::ScopeNode::setClosedVariables): Ditto.
+        * parser/Parser.h:
+        (JSC::Parser::closedVariables): Remove const qualifier on return type.
+        (JSC::parse): Remove extraneous call to std::move(). Calling std::move() is unnecessary here
+        because Parser::closedVariables() returns an rvalue reference.
+
+2014-06-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSContext Inspection: Provide a way to use a non-Main RunLoop for Inspector JavaScript Evaluations
+        https://bugs.webkit.org/show_bug.cgi?id=134371
+
+        Reviewed by Timothy Hatcher.
+
+        * API/JSContextPrivate.h:
+        * API/JSContext.mm:
+        (-[JSContext _debuggerRunLoop]):
+        (-[JSContext _setDebuggerRunLoop:]):
+        Private API for setting the CFRunLoop for a debugger to evaluate in.
+        
+        * API/JSContextRefInternal.h: Added.
+        * API/JSContextRef.cpp:
+        (JSGlobalContextGetDebuggerRunLoop):
+        (JSGlobalContextSetDebuggerRunLoop):
+        Internal API for setting a CFRunLoop on a JSContextRef.
+        Set this on the debuggable.
+        
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        (Inspector::RemoteInspectorBlock::RemoteInspectorBlock):
+        (Inspector::RemoteInspectorBlock::~RemoteInspectorBlock):
+        (Inspector::RemoteInspectorBlock::operator=):
+        (Inspector::RemoteInspectorBlock::operator()):
+        Moved into the header.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::inspectorDebuggable):
+        Lets store the RunLoop on the debuggable instead of this core
+        platform agnostic class, so expose the debuggable.
+
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorHandleRunSourceGlobal):
+        (Inspector::RemoteInspectorQueueTaskOnGlobalQueue):
+        (Inspector::RemoteInspectorInitializeGlobalQueue):
+        Rename the global functions for clarity.
+
+        (Inspector::RemoteInspectorHandleRunSourceWithInfo):
+        Handler for private run loops.
+
+        (Inspector::RemoteInspectorDebuggableConnection::RemoteInspectorDebuggableConnection):
+        (Inspector::RemoteInspectorDebuggableConnection::~RemoteInspectorDebuggableConnection):
+        (Inspector::RemoteInspectorDebuggableConnection::dispatchAsyncOnDebuggable):
+        (Inspector::RemoteInspectorDebuggableConnection::setupRunLoop):
+        (Inspector::RemoteInspectorDebuggableConnection::teardownRunLoop):
+        (Inspector::RemoteInspectorDebuggableConnection::queueTaskOnPrivateRunLoop):
+        Setup and teardown and use private run loop sources if the debuggable needs it.
+
+2014-06-30  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
+
+        Add missing ENABLE(DFG_JIT) guards
+        https://bugs.webkit.org/show_bug.cgi?id=134444
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGFunctionWhitelist.cpp:
+        * dfg/DFGFunctionWhitelist.h:
+
+2014-06-29  Yoav Weiss  <yoav@yoav.ws>
+
+        Add support for HTMLImageElement's sizes attribute
+        https://bugs.webkit.org/show_bug.cgi?id=133620
+
+        Reviewed by Dean Jackson.
+
+        Added an ENABLE_PICTURE_SIZES compile flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't fold a UInt32ToNumber with DoOverflow to Identity since that would result in an Identity that takes an Int32 and returns a DoubleRep
+        https://bugs.webkit.org/show_bug.cgi?id=134412
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::setReplacement):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * tests/stress/uint32-to-number-fold-constant-with-do-overflow.js: Added.
+        (foo):
+        (bar):
+        (baz):
+
+2014-06-27  Peyton Randolph  <prandolph@apple.com>
+
+         Add feature flag for link long-press gesture.                                                                   
+         https://bugs.webkit.org/show_bug.cgi?id=134262                                                                  
+                                                                                                                         
+         Reviewed by Enrica Casucci.                                                                                     
+                                                                                                                         
+         * Configurations/FeatureDefines.xcconfig:                                                                       
+         Add ENABLE_LINK_LONG_PRESS. 
+
+2014-06-27  László Langó  <llango.u-szeged@partner.samsung.com>
+
+        [JavaScriptCore] FTL buildfix for EFL platform.
+        https://bugs.webkit.org/show_bug.cgi?id=133546
+
+        Reviewed by Darin Adler.
+
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::forStackmaps):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::opposite):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Constant::dump):
+        * llvm/InitializeLLVMPOSIX.cpp:
+        (JSC::initializeLLVMPOSIX):
+
+2014-06-26  Benjamin Poulain  <benjamin@webkit.org>
+
+        iOS 8 beta 2 ES6 'Set' clear() broken
+        https://bugs.webkit.org/show_bug.cgi?id=134346
+
+        Reviewed by Oliver Hunt.
+
+        The object map was not cleared :(.
+
+        Kudos to Ashley Gullen for tracking this and making a regression test.
+        Credit to Oliver for finding the missing code.
+
+        * runtime/MapData.h:
+        (JSC::MapData::clear):
+
+2014-06-25  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Expose Cache Information to WinLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=134318
+
+        Reviewed by Dean Jackson.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing
+        MemoryStatistics files to the WIndows build.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2014-06-26  David Kilzer  <ddkilzer@apple.com>
+
+        DFG::FunctionWhitelist::parseFunctionNamesInFile does not close file
+        <http://webkit.org/b/134343>
+        <rdar://problem/17459487>
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGFunctionWhitelist.cpp:
+        (JSC::DFG::FunctionWhitelist::parseFunctionNamesInFile):
+        Close the file handle, and log an error on failure.
+
+2014-06-25  Dana Burkart  <dburkart@apple.com>
+
+        Add support for 5-tuple versioning.
+
+        Reviewed by David Farler.
+
+        * Configurations/Version.xcconfig:
+
+2014-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        Unreviewed.
+
+        * runtime/JSDateMath.cpp:
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * runtime/VM.cpp:
+        (JSC::VM::resetDateCache): Use std::numeric_limits instead of QNaN
+        constant since that constant doesn't exist anymore.
+
+2014-06-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling out r166876.
+
+        Caused some ECMA test262 failures
+
+        Reverted changeset:
+
+        "Date object needs to check for ES5 15.9.1.14 TimeClip limit."
+        https://bugs.webkit.org/show_bug.cgi?id=131248
+        http://trac.webkit.org/changeset/166876
+
+2014-06-25  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed gardening.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Update to
+        put various files in proper IDE categories.
+
+2014-06-25  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win64] ASM LLINT is not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=130638
+
+        This patch adds a new LLINT assembler backend for Win64, and implements it.
+        It makes adjustments to follow the Win64 ABI spec. where it's found to be needed.
+        Also, LLINT and JIT is enabled for Win64.
+
+        Reviewed by Mark Lam.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added JITStubsMSVC64.asm.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+        * JavaScriptCore/JavaScriptCore.vcxproj/jsc/jscCommon.props: Increased stack size to avoid stack overflow in tests.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Generate assembler source file for Win64.
+        * assembler/MacroAssemblerX86_64.h: 
+        (JSC::MacroAssemblerX86_64::call): Follow Win64 ABI spec.
+        * jit/JITStubsMSVC64.asm: Added.
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStub): Compile fix.
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator): Follow Win64 ABI spec.
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions): Ditto.
+        * llint/LLIntOfflineAsmConfig.h: Enable new llint backend for Win64.
+        * llint/LowLevelInterpreter.asm: Implement new Win64 backend, and follow Win64 ABI spec.
+        * llint/LowLevelInterpreter64.asm: Ditto.
+        * offlineasm/asm.rb: Compile fix.
+        * offlineasm/backends.rb: Add new llint backend for Win64.
+        * offlineasm/settings.rb: Compile fix.
+        * offlineasm/x86.rb: Implement new llint Win64 backend.
+
+2014-06-25  Laszlo Gombos  <l.gombos@samsung.com>
+
+        Remove build guard for progress element
+        https://bugs.webkit.org/show_bug.cgi?id=134292
+
+        Reviewed by Benjamin Poulain.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-06-24  Michael Saboff  <msaboff@apple.com>
+
+        Add support routines to provide descriptive JavaScript backtraces
+        https://bugs.webkit.org/show_bug.cgi?id=134278
+
+        Reviewed by Mark Lam.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dump):
+        (JSC::CallFrame::describeFrame):
+        * interpreter/CallFrame.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpForBacktrace):
+        * runtime/JSCJSValue.h:
+
+2014-06-24  Brady Eidson  <beidson@apple.com>
+
+        Enable GAMEPAD in the Mac build, but disabled at runtime.
+        https://bugs.webkit.org/show_bug.cgi?id=134255
+
+        Reviewed by Dean Jackson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+        * runtime/JSObject.h: Export JSObject::removeDirect() to allow disabling
+          functions at runtime.
+
+2014-06-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION (r169703): Invalid cast in JSC::asGetterSetter / JSC::JSObject::defineOwnNonIndexProperty
+        https://bugs.webkit.org/show_bug.cgi?id=134046
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnNonIndexProperty): We need to check for a CustomGetterSetter here as well as
+        a normal GetterSetter. If we encounter a CustomGetterSetter, we delete it, create a new normal GetterSetter,
+        and insert it like normal. We also need to check for CustomAccessors when checking for unconfigurable properties.
+
+2014-06-24  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] MSVC mishandles enums in bitfields
+        https://bugs.webkit.org/show_bug.cgi?id=134237
+
+        Reviewed by Michael Saboff.
+
+        Replace uses of enum types in bit fields with unsigned to
+        avoid losing a bit to hold the sign value. This can result
+        in Windows interpreting the value of the field improperly.
+
+        * bytecode/StructureStubInfo.h:
+        * parser/Nodes.h:
+
+2014-06-23  Andreas Kling  <akling@apple.com>
+
+        Inline the UnlinkedInstructionStream::Reader logic.
+        <https://webkit.org/b/134203>
+
+        This class is only used by CodeBlock to unpack the unlinked instructions,
+        and we were spending 0.5% of total time on PLT calling Reader::next().
+        Move the logic to the header file and mark it ALWAYS_INLINE.
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/UnlinkedInstructionStream.cpp:
+        * bytecode/UnlinkedInstructionStream.h:
+        (JSC::UnlinkedInstructionStream::Reader::Reader):
+        (JSC::UnlinkedInstructionStream::Reader::read8):
+        (JSC::UnlinkedInstructionStream::Reader::read32):
+        (JSC::UnlinkedInstructionStream::Reader::next):
+
+2014-06-20  Sam Weinig  <sam@webkit.org>
+
+        Remove static tables for bindings that use eager reification
+        https://bugs.webkit.org/show_bug.cgi?id=134126
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectCustomAccessor):
+        * runtime/Structure.h:
+        (JSC::Structure::setHasCustomGetterSetterProperties):
+        Change setHasCustomGetterSetterProperties to behave like setHasGetterSetterProperties, and set
+        the m_hasReadOnlyOrGetterSetterPropertiesExcludingProto bit if the property is not __proto__.
+        Without this, JSObject::put() won't think there are any setters on the prototype chain of an
+        object that has no static lookup table and uses eagerly reified custom getter/setter properties.
+
+2014-06-21  Brady Eidson  <beidson@apple.com>
+
+        Gamepad API - Deprecate the existing implementation
+        https://bugs.webkit.org/show_bug.cgi?id=134108
+
+        Reviewed by Timothy Hatcher.
+
+        -Add new "GAMEPAD_DEPRECATED" build flag, moving the existing implementation to use it
+        -Move some implementation files into a "deprecated" subdirectory.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-06-21  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r170244.
+        https://bugs.webkit.org/show_bug.cgi?id=134157
+
+        GTK/EFL bindings generator works differently, making this
+        patch not work there.  Will fix entire patch after a rollout.
+        (Requested by bradee-oh on #webkit).
+
+        Reverted changeset:
+
+        "Gamepad API - Deprecate the existing implementation"
+        https://bugs.webkit.org/show_bug.cgi?id=134108
+        http://trac.webkit.org/changeset/170244
+
+2014-06-21  Brady Eidson  <beidson@apple.com>
+
+        Gamepad API - Deprecate the existing implementation
+        https://bugs.webkit.org/show_bug.cgi?id=134108
+
+        Reviewed by Timothy Hatcher.
+
+        -Add new "GAMEPAD_DEPRECATED" build flag, moving the existing implementation to use it
+        -Add the "Deprecated" suffix to some implementation files
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-06-21  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        Removing PAGE_VISIBILITY_API compile guard.
+        https://bugs.webkit.org/show_bug.cgi?id=133844
+
+        Reviewed by Gavin Barraclough.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-06-21  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        ARM traditional buildfix after r169942.
+        https://bugs.webkit.org/show_bug.cgi?id=134100
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::abortWithReason): Added.
+
+2014-06-20  Andreas Kling  <akling@apple.com>
+
+        [Cocoa] Release freed up blocks from the JS heap after simulated memory pressure.
+        <https://webkit.org/b/134112>
+
+        Reviewed by Mark Hahnenberg.
+
+        * heap/BlockAllocator.h:
+
+2014-06-19  Alex Christensen  <achristensen@webkit.org>
+
+        Unreviewed fix after r170130.
+
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj:
+        Corrected directory so it can find common.props when opening Visual Studio.
+
+2014-06-19  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        Remove ENABLE(LLINT) and ENABLE(LLINT_C_LOOP) guards
+        https://bugs.webkit.org/show_bug.cgi?id=130389
+
+        Reviewed by Mark Lam.
+
+        Removed ENABLE(LLINT) since we always build with it, and changed ENABLE(LLINT_C_LOOP)
+        into !ENABLE(JIT) since they are mutually exclusive.
+
+        * CMakeLists.txt:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
+        * assembler/MaxFrameExtentForSlowPathCall.h:
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        * bytecode/CodeBlock.cpp:
+        (JSC::dumpStructure):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::frameRegisterCount):
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * heap/Heap.cpp:
+        (JSC::Heap::gatherJSStackRoots):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcodeID):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::committedByteCount):
+        * interpreter/JSStack.h:
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::ensureCapacityFor):
+        (JSC::JSStack::topOfFrameFor):
+        (JSC::JSStack::setStackLimit):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITExceptions.h:
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::ctiNativeCall):
+        (JSC::JITThunks::ctiNativeConstruct):
+        * llint/LLIntCLoop.cpp:
+        * llint/LLIntCLoop.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::initialize):
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntData.h:
+        (JSC::LLInt::Data::performAssertions): Deleted.
+        * llint/LLIntEntrypoint.cpp:
+        * llint/LLIntEntrypoint.h:
+        * llint/LLIntExceptions.cpp:
+        * llint/LLIntExceptions.h:
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntOffsetsExtractor.cpp:
+        (JSC::LLIntOffsetsExtractor::dummy):
+        * llint/LLIntOpcode.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LLIntThunks.cpp:
+        * llint/LLIntThunks.h:
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter.h:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CommonSlowPaths.h:
+        * runtime/ErrorHandlingScope.cpp:
+        (JSC::ErrorHandlingScope::ErrorHandlingScope):
+        (JSC::ErrorHandlingScope::~ErrorHandlingScope):
+        * runtime/Executable.cpp:
+        (JSC::setupLLInt):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::sanitizeStackForVM):
+        * runtime/VM.h:
+        (JSC::VM::canUseJIT): Deleted.
+
+2014-06-18  Alex Christensen  <achristensen@webkit.org>
+
+        Add FTL to Windows build.
+        https://bugs.webkit.org/show_bug.cgi?id=134015
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        Added ftl source files.
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        Added ftl and llvm directories to include path.
+        * JavaScriptCore.vcxproj/libllvmForJSC: Added.
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.props: Added.
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj: Added.
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj.filters: Added.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+        MSVC doesn't like to divide by zero while compiling.  Use std::nan instead.
+        * llvm/InitializeLLVMWin.cpp: Added.
+        (JSC::initializeLLVMImpl):
+        Implemented dynamic loading and linking for Windows.
+
+2014-06-18  Alex Christensen  <achristensen@webkit.org>
+
+        Unreviewed build fix after r170107.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        Use non-template sub for armv7s.
+
+2014-06-18  David Kilzer  <ddkilzer@apple.com>
+
+        -[JSContext setName:] leaks NSString
+        <http://webkit.org/b/134038>
+
+        Reviewed by Joseph Pecoraro.
+
+        Fixes the following static analyzer warning:
+
+            JavaScriptCore/API/JSContext.mm:200:73: warning: Potential leak of an object
+                JSStringRef nameJS = name ? JSStringCreateWithCFString((CFStringRef)[name copy]) : nullptr;
+                                                                                    ^
+
+        * API/JSContext.mm:
+        (-[JSContext setName:]): Autorelease the copy of |name|.
+
+2014-06-18  Mark Lam  <mark.lam@apple.com>
+
+        DFGGraph::m_doubleConstantMap will not map 0 values correctly.
+        <https://webkit.org/b/133994>
+
+        Reviewed by Geoffrey Garen.
+
+        DFGGraph::m_doubleConstantsMap should not use a double as a key to its HashMap,
+        because it means two unfortunate things:
+        - It will probably break for zero.
+        - It will think that -0 is the same as +0 under some circumstances, size
+          -0==+0 even though they are distinct values (for example 1/-0 != 1/+0).
+
+        The fix is to use std::unordered_map which does not require special empty
+        and deleted values, and to use the raw bits instead of the double value as
+        the key.
+
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant):
+
+2014-06-18  Alex Christensen  <achristensen@webkit.org>
+
+        Remove duplicate code using sdiv.
+        https://bugs.webkit.org/show_bug.cgi?id=133764
+
+        Reviewed by Daniel Bates.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::sdiv):
+        Make sdiv a template to match arm64.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        Remove duplicate code that was identical except for sdiv not being a template.
+
+2014-06-17  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r170082.
+        https://bugs.webkit.org/show_bug.cgi?id=134006
+
+        Breaks build. (Requested by mlam on #webkit).
+
+        Reverted changeset:
+
+        "DFGGraph::m_doubleConstantMap will not map 0 values
+        correctly."
+        https://bugs.webkit.org/show_bug.cgi?id=133994
+        http://trac.webkit.org/changeset/170082
+
+2014-06-17  Mark Lam  <mark.lam@apple.com>
+
+        DFGGraph::m_doubleConstantMap will not map 0 values correctly.
+        <https://webkit.org/b/133994>
+
+        Reviewed by Geoffrey Garen.
+
+        DFGGraph::m_doubleConstantsMap should not use a double as a key to its HashMap,
+        because it means two unfortunate things:
+        - It will probably break for zero.
+        - It will think that -0 is the same as +0 under some circumstances, size
+          -0==+0 even though they are distinct values (for example 1/-0 != 1/+0).
+
+        The fix is to use std::unordered_map which does not require special empty
+        and deleted values, and to use the raw bits instead of the double value as
+        the key.
+
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant):
+
+2014-06-17  Oliver Hunt  <oliver@apple.com>
+
+        Fix error messages for incorrect hex literals
+        https://bugs.webkit.org/show_bug.cgi?id=133998
+
+        Reviewed by Mark Lam.
+
+        Ensure that the error messages for bogus hex literals actually
+        make sense.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+        * parser/ParserTokens.h:
+
+2014-06-17  Matthew Mirman  <mmirman@apple.com>
+
+        Fixes bug where building JSC sometimes crashes at build-symbol-table-index.py. Also adds licenses. 
+        https://bugs.webkit.org/show_bug.cgi?id=133814
+
+        Reviewed by Filip Pizlo.
+        
+        Adds the "shopt -s nullglob" line necessary to prevent the loop in the shell 
+        script from using "*.o" as a file when no other files in the directory exist. 
+        
+        * build-symbol-table-index.sh: Added license.
+        * copy-llvm-ir-to-derived-sources.sh: Added license and "shopt -s nullglob" line.
+
+2014-06-16  Sam Weinig  <sam@webkit.org>
+
+        Move forward declaration of bindings static functions into their implementation files
+        https://bugs.webkit.org/show_bug.cgi?id=133943
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/CommonIdentifiers.h:
+        Add a few identifiers that are needed by the DOM.
+
+2014-06-16  Mark Lam  <mark.lam@apple.com>
+
+        Parser statementDepth accounting needs to account for when a function body excludes its braces.
+        <https://webkit.org/b/133832>
+
+        Reviewed by Oliver Hunt.
+
+        In some cases (e.g. when a Function object is instantiated from a string), the
+        function body source may not include its braces.  The parser needs to account
+        for this when calculating its statementDepth.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        * bytecode/UnlinkedCodeBlock.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatement):
+        - Also fixed the error message for declaring nested functions in strict mode
+          to be more accurate.
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        (JSC::parse):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+
+2014-06-16  Juergen Ributzka  <juergen@apple.com>
+
+        Change the order of the alias analysis passes to align with the opt pipeline of LLVM
+        https://bugs.webkit.org/show_bug.cgi?id=133753
+
+        Reviewed by Geoffrey Garen.
+
+        The order in which the alias analysis passes are added affects also the
+        order in which they are utilized. Change the order to align with the
+        one use by LLVM itself. The last alias analysis pass added will be
+        evaluated first. With this change we first perform a basic alias
+        analysis and then use the type-based alias analysis (if required).
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+
+2014-06-16  Juergen Ributzka  <juergen@apple.com>
+
+        Fix the arguments passed to the LLVM dylib
+        https://bugs.webkit.org/show_bug.cgi?id=133757
+
+        Reviewed by Geoffrey Garen.
+
+        The LLVM command line argument parser assumes that the first argument
+        is the program name. We need to add a fake program name, otherwise the
+        first argument will be parsed as program name and ignored.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-06-16  Michael Saboff  <msaboff@apple.com>
+
+        Convert ASSERT in inlineFunctionForCapabilityLevel to early return
+        https://bugs.webkit.org/show_bug.cgi?id=133903
+
+        Reviewed by Mark Hahnenberg.
+
+        Hardened code by Converting ASSERT to return CannotCompile.
+
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::inlineFunctionForCapabilityLevel):
+
+2014-06-13  Sam Weinig  <sam@webkit.org>
+
+        Store DOM constants directly in the JS object rather than jumping through a custom accessor
+        https://bugs.webkit.org/show_bug.cgi?id=133898
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::attributes):
+        Switch attributes to be stored as an unsigned rather than an unsigned char, since there is no difference in memory use
+        and will make adding more flags possibles.
+
+        (JSC::HashTableValue::propertyGetter):
+        (JSC::HashTableValue::propertyPutter):
+        Change assertion to use BuiltinOrFunctionOrConstant.
+
+        (JSC::HashTableValue::constantInteger):
+        Added.
+
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        Use PropertySlot::setValue() for constants during static lookup.
+
+        (JSC::reifyStaticProperties):
+        Put the constant directly on the object when eagerly reifying.
+
+        * runtime/PropertySlot.h:
+        Add ConstantInteger flag and BuiltinOrFunctionOrConstant helper.
+
+2014-06-14  Michael Saboff  <msaboff@apple.com>
+
+        operationCreateArguments could cause a GC during OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=133905
+
+        Reviewed by Filip Pizlo.
+
+        Defer GC via new wrapper functions for operationCreateArguments and operationCreateInlinedArguments
+        for use by OSR exit stubs.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::ArgumentsRecoveryGenerator::generateFor):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+
+2014-06-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        OSR exit should barrier the Executables for all InlineCallFrames, not just those on the stack at the time of exit
+        https://bugs.webkit.org/show_bug.cgi?id=133880
+
+        Reviewed by Filip Pizlo.
+
+        We could have exited due to a value received from an inlined block that's no longer on 
+        the stack, so we should just barrier all InlineCallFrames.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::adjustAndJumpToTarget):
+
+2014-06-13  Alex Christensen  <achristensen@webkit.org>
+
+        Make css jit compile for armv7.
+        https://bugs.webkit.org/show_bug.cgi?id=133596
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/MacroAssembler.h:
+        Use branchPtr on ARM_THUMB2.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::addPtrNoFlags):
+        (JSC::MacroAssemblerARMv7::or32):
+        (JSC::MacroAssemblerARMv7::test32):
+        (JSC::MacroAssemblerARMv7::branch):
+        (JSC::MacroAssemblerARMv7::branchPtr):
+        Added macros necessary for css jit.
+
+2014-06-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix ARMv7.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::abortWithReason):
+
+2014-06-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Even better diagnostics from DFG traps
+        https://bugs.webkit.org/show_bug.cgi?id=133836
+
+        Reviewed by Oliver Hunt.
+        
+        We now stuff the DFG::NodeType into a register before bailing. Also made the
+        DFGBailed abort reason a bit more specific. As planned, the new abort reasons use
+        different numbers than any previous abort reasons.
+
+        * assembler/AbortReason.h:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::abortWithReason):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::abortWithReason):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::abortWithReason):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::abortWithReason):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::bail):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT.h:
+
+2014-06-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix assertions under JSC::setNeverInline() when running js tests in WebKitTestRunner
+        https://bugs.webkit.org/show_bug.cgi?id=133840
+
+        Reviewed by Filip Pizlo.
+        
+        Fix ASSERT(exec->vm().currentThreadIsHoldingAPILock()); under JSC::setNeverInline()
+        when running DFG tests.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::numberOfDFGCompiles):
+        (JSC::setNeverInline):
+
+2014-06-12  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Avoid fork bomb during build
+        https://bugs.webkit.org/show_bug.cgi?id=133837
+        <rdar://problem/17296034>
+
+        Reviewed by Tim Horton.
+
+        * JavaScriptCore.vcxproj/build-generated-files.sh: Use a
+        reasonable default value when the 'num-cpus' script is not available.
+
+2014-06-12  Mark Lam  <mark.lam@apple.com>
+
+        Remove some dead / unused code.
+        <https://webkit.org/b/133828>
+
+        Reviewed by Filip Pizlo.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::create):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * parser/Parser.h:
+        (JSC::DepthManager::DepthManager): Deleted.
+        (JSC::DepthManager::~DepthManager): Deleted.
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+
+2014-06-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Move structureHasRareData out of TypeInfo
+        https://bugs.webkit.org/show_bug.cgi?id=133800
+
+        Reviewed by Andreas Kling.
+
+        StructureHasRareData was originally put in TypeInfo to avoid making Structure bigger, 
+        but we have a few spare bits in Structure so it would be nice to remove this hack.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::newImpurePropertyFiresWatchpoints):
+        (JSC::TypeInfo::structureHasRareData): Deleted.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::allocateRareData):
+        (JSC::Structure::cloneRareDataFrom):
+        * runtime/Structure.h:
+        (JSC::Structure::previousID):
+        (JSC::Structure::objectToStringValue):
+        (JSC::Structure::setObjectToStringValue):
+        (JSC::Structure::setPreviousID):
+        (JSC::Structure::clearPreviousID):
+        (JSC::Structure::previous):
+        (JSC::Structure::rareData):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache):
+
+2014-06-12  Zsolt Borbely  <zsborbely.u-szeged@partner.samsung.com>
+
+        Allow enum guards to be generated from the replay json files
+        https://bugs.webkit.org/show_bug.cgi?id=133399
+
+        Reviewed by Csaba Osztrogonác.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Type.__init__):
+        (InputsModel.parse_type_with_framework_name):
+        (Generator.generate_header):
+        (Generator.generate_implementation):
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.cpp: Added.
+        (Test::HandleWheelEvent::HandleWheelEvent):
+        (Test::HandleWheelEvent::~HandleWheelEvent):
+        (JSC::InputTraits<Test::HandleWheelEvent>::type):
+        (JSC::InputTraits<Test::HandleWheelEvent>::encode):
+        (JSC::InputTraits<Test::HandleWheelEvent>::decode):
+        (JSC::EncodingTraits<WebCore::PlatformWheelEventPhase>::encodeValue):
+        (JSC::EncodingTraits<WebCore::PlatformWheelEventPhase>::decodeValue):
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h: Added.
+        (JSC::InputTraits<Test::HandleWheelEvent>::queue):
+        (Test::HandleWheelEvent::platformEvent):
+        * replay/scripts/tests/generate-enum-with-guard.json: Added.
+
+2014-06-12  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build after r169823.
+
+        Include StructureInlines.h in a few more files to fix linking
+        issues due to JSC::Structure::get undefined symbol.
+
+        * runtime/ArrayIteratorConstructor.cpp:
+        * runtime/ArrayIteratorPrototype.cpp:
+        * runtime/JSConsole.cpp:
+        * runtime/JSMapIterator.cpp:
+        * runtime/JSSet.cpp:
+        * runtime/JSSetIterator.cpp:
+        * runtime/JSWeakMap.cpp:
+        * runtime/MapIteratorPrototype.cpp:
+        * runtime/MapPrototype.cpp:
+        * runtime/SetIteratorPrototype.cpp:
+        * runtime/SetPrototype.cpp:
+        * runtime/WeakMapPrototype.cpp:
+
+2014-06-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [EFL] One more URTBF after r169823 to make ARM64 build happy too.
+
+        * runtime/JSMap.cpp:
+
+2014-06-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Inline caching should try to flatten uncacheable dictionaries
+        https://bugs.webkit.org/show_bug.cgi?id=133683
+
+        Reviewed by Geoffrey Garen.
+
+        There exists a body of JS code that deletes properties off of objects (especially function/constructor objects), 
+        which puts them into an uncacheable dictionary state. This prevents all future inline caching for these objects. 
+        If properties are deleted out of the object during its initialization, we can enable caching for that object by 
+        attempting to flatten it when we see we're trying to do inline caching with that object. We then record that we 
+        performed this flattening optimization in the object's Structure. If it ever re-enters the uncacheable dictionary 
+        state then we can just give up on caching that object.
+
+        In refactoring some of the code in tryCacheGetById and tryBuildGetByIdList to reduce some duplication, I added
+        the InlineCacheAction enum, a new way to indicate the success or failure of an inline caching attempt. I changed
+        the other inline caching functions to return this enum rather than the opaque booleans that we were previously 
+        returning.
+
+        * jit/Repatch.cpp:
+        (JSC::actionForCell):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::buildGetByIDList):
+        (JSC::tryCachePutByID):
+        (JSC::repatchPutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::buildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::repatchIn):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::flattenDictionaryStructure):
+        * runtime/Structure.h:
+        (JSC::Structure::hasBeenFlattenedBefore):
+
+2014-06-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [EFL] URTBF after r169823.
+
+        * bindings/ScriptValue.cpp: Missing include added.
+
+2014-06-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove an unnecessary asObject(this) call inside JSObject::fastGetOwnPropertySlot.
+
+        Rubber-stamped by Andreas Kling.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::fastGetOwnPropertySlot):
+
+2014-06-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Turning on DUMP_PROPERTYMAP_STATS causes a build failure
+        https://bugs.webkit.org/show_bug.cgi?id=133673
+
+        Reviewed by Andreas Kling.
+
+        Rewrote the property map statistics code because the old code wasn't building,
+        and it was also mixing numbers for lookups and insertions/removals.
+
+        New logging code records the number of calls to PropertyTable::find (finds) and
+        PropertyTable::get/PropertyTable::findWithString separately so that we can quantify
+        the number of probing during updates and lookups.
+
+        * jsc.cpp:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::get):
+        (JSC::PropertyTable::findWithString):
+        (JSC::PropertyTable::add):
+        (JSC::PropertyTable::remove):
+        (JSC::PropertyTable::reinsert):
+        (JSC::PropertyTable::rehash):
+        * runtime/Structure.cpp:
+        (JSC::PropertyMapStatisticsExitLogger::PropertyMapStatisticsExitLogger):
+        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
+
+2014-06-11  Andreas Kling  <akling@apple.com>
+
+        Always inline JSValue::get() and Structure::get().
+        <https://webkit.org/b/133755>
+
+        Reviewed by Ryosuke Niwa.
+
+        These functions get really hot, so ask the compiler to be more
+        aggressive about inlining them.
+
+        ~28% speed-up on Ryosuke's microbenchmark for accessing nextSibling
+        through GetByVal.
+
+        * runtime/JSArrayIterator.cpp:
+        * runtime/JSCJSValue.cpp:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::get):
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+
+2014-06-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Structure::get should instantiate DeferGC only when materializing property map
+        https://bugs.webkit.org/show_bug.cgi?id=133727
+
+        Rubber-stamped by Andreas Kling.
+
+        Make materializePropertyMapIfNecessary always inline.
+
+        This is ~12% improvement on the microbenchmark attached in the bug.
+
+        * runtime/Structure.h:
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
+
+2014-06-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Structure::get should instantiate DeferGC only when materializing property map
+        https://bugs.webkit.org/show_bug.cgi?id=133727
+
+        Reviewed by Geoffrey Garen.
+
+        DeferGC instances in Structure::get was added in http://trac.webkit.org/r157539 in order to avoid
+        collecting the property table newly created by materializePropertyMapIfNecessary since GC can happen
+        when GCSafeConcurrentJITLocker goes out of scope.
+
+        However, always instantiating DeferGC inside Structure::get introduced a new performance bottleneck
+        in JSObject::getPropertySlot because frequently incrementing and decrementing a counter in vm.m_heap
+        and running a release assertion inside Heap::incrementDeferralDepth() is expensive.
+
+        Work around this by instantiating DeferGC only when we're actually calling materializePropertyMap,
+        and immediately storing a pointer to the newly created property table in the stack before DeferGC
+        goes out of scope so that the property table will be marked.
+
+        This shows 13-16% improvement on the microbenchmark attached in the bug.
+
+        * runtime/JSCJSValue.cpp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::fastGetOwnPropertySlot):
+        * runtime/Structure.h:
+        (JSC::Structure::materializePropertyMapIfNecessary):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+
+2014-06-11  Andreas Kling  <akling@apple.com>
+
+        Some JSValue::get() micro-optimzations.
+        <https://webkit.org/b/133739>
+
+        Tighten some of the property lookup code to improve performance of the
+        eagerly reified prototype attributes:
+
+        - Instead of converting the property name to an integer at every step
+          in the prototype chain, move that to a separate pass at the end
+          since it should be a rare case.
+
+        - Cache the StructureIDTable in a local instead of fetching it from
+          the Heap on every step.
+
+        - Make fillCustomGetterPropertySlot inline. It was out-of-lined based
+          on the assumption that clients would mostly be cacheable GetByIds,
+          and it gets pretty hot (~1%) in GetByVal.
+
+        - Pass the Structure directly to fillCustomGetterPropertySlot instead
+          of refetching it from the StructureIDTable.
+
+        Reviewed by Geoff Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillCustomGetterPropertySlot): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::fillCustomGetterPropertySlot):
+        (JSC::JSObject::getOwnPropertySlot):
+        (JSC::JSObject::fastGetOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotSlow): Deleted.
+
+2014-06-10  Sam Weinig  <sam@webkit.org>
+
+        Don't create a HashTable for JSObjects that use eager reification
+        https://bugs.webkit.org/show_bug.cgi?id=133705
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/Lookup.h:
+        (JSC::reifyStaticProperties):
+        Add a version of reifyStaticProperties that takes an array of HashTableValues
+        rather than a HashTable.
+
+2014-06-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Prediction propagator should make sure everyone knows that a variable that is in an argument position where other versions of that variable are not MachineInts cannot possibly be flushed as Int52
+        https://bugs.webkit.org/show_bug.cgi?id=133698
+
+        Reviewed by Geoffrey Garen and Mark Hahnenberg.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate): Use the new utility to figure out if a variable could ever represent an Int52.
+        * dfg/DFGVariableAccessData.cpp:
+        (JSC::DFG::VariableAccessData::couldRepresentInt52): Add a new utility to detect early on if a variable could possibly be Int52.
+        (JSC::DFG::VariableAccessData::couldRepresentInt52Impl):
+        (JSC::DFG::VariableAccessData::flushFormat):
+        * dfg/DFGVariableAccessData.h:
+        * tests/stress/int52-inlined-call-argument.js: Added.
+        (foo):
+        (bar):
+
+2014-06-10  Mark Lam  <mark.lam@apple.com>
+
+        Assertion failure at JSC::Structure::checkOffsetConsistency() const + 234.
+        <https://webkit.org/b/133356>
+
+        Reviewed by Mark Hahnenberg.
+
+        The root cause of this issue is that a nonPropertyTransition can transition
+        a pinned dictionary structure to an unpinned dictionary structure.  The new
+        structure will get a copy of the property table from the original structure.
+        However, when a GC occurs, the property table in the new structure will be
+        cleared because it is unpinned.  This leads to complications in subsequent
+        derivative structures when flattening occurs, which eventually leads to the
+        assertion failure in this bug.
+
+        The fix is to ensure that the new dictionary structure generated by the
+        nonPropertyTransition will have a copy of its predecessor's property table
+        and is pinned.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::nonPropertyTransition):
+
+2014-06-10  Michael Saboff  <msaboff@apple.com>
+
+        In a certain app state, Array.prototype.filter() returns incorrect results
+        https://bugs.webkit.org/show_bug.cgi?id=133577
+
+        Reviewed by Oliver Hunt.
+
+        Fixed the LLInt processing of op_put_by_val_direct to have the same hole check as op_put_by_val.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-06-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Global HashTables contain references to atomic StringImpls
+        https://bugs.webkit.org/show_bug.cgi?id=133661
+
+        Reviewed by Geoffrey Garen.
+
+        This was a long-standing bug revealed by bug 133558. The issue is that the global static HashTables 
+        cache their set of keys as StringImpls that are associated with a particular VM.  This is obviously 
+        incompatible with using multiple VMs on multiple threads (e.g. when using workers). The fix is to 
+        change the "keys" field of the static HashTables to be char** instead of StringImpl**.
+
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        * runtime/Lookup.h:
+        (JSC::HashTable::ConstIterator::key):
+        (JSC::HashTable::entry):
+
+2014-06-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Build fix after r169703
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-06-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Eagerly reify DOM prototype attributes
+        https://bugs.webkit.org/show_bug.cgi?id=133558
+
+        Reviewed by Oliver Hunt.
+
+        This allows us to get rid of a lot of the additional overhead of pushing DOM attributes up into the prototype. 
+        By eagerly reifying the custom getters and setters into the actual JSObject we avoid having to override 
+        getOwnPropertySlot for all of the DOM prototypes, which is a lot of the overhead of doing property lookups on 
+        DOM wrappers.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        * runtime/CustomGetterSetter.cpp: Added.
+        (JSC::callCustomSetter):
+        * runtime/CustomGetterSetter.h: Added.
+        (JSC::CustomGetterSetter::create):
+        (JSC::CustomGetterSetter::getter):
+        (JSC::CustomGetterSetter::setter):
+        (JSC::CustomGetterSetter::createStructure):
+        (JSC::CustomGetterSetter::CustomGetterSetter):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isCustomGetterSetter):
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::isCustomGetterSetter):
+        (JSC::JSCell::canUseFastGetOwnProperty):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::isHostOrBuiltinFunction): Deleted.
+        (JSC::JSFunction::isBuiltinFunction): Deleted.
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h: Inlined some random functions that appeared hot during profiling.
+        (JSC::JSFunction::isBuiltinFunction):
+        (JSC::JSFunction::isHostOrBuiltinFunction):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putDirectCustomAccessor):
+        (JSC::JSObject::fillGetterPropertySlot):
+        (JSC::JSObject::fillCustomGetterPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotSlow): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::hasCustomGetterSetterProperties):
+        (JSC::JSObject::convertToDictionary):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotSlow): Inlined because it looked hot during profiling.
+        (JSC::JSObject::putOwnDataProperty):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/JSType.h:
+        * runtime/Lookup.h:
+        (JSC::reifyStaticProperties):
+        * runtime/PropertyDescriptor.h:
+        (JSC::PropertyDescriptor::PropertyDescriptor):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::nextOutOfLineStorageCapacity): Deleted.
+        (JSC::Structure::suggestedNewOutOfLineStorageCapacity): Deleted.
+        (JSC::Structure::get): Deleted.
+        * runtime/Structure.h:
+        (JSC::Structure::hasCustomGetterSetterProperties):
+        (JSC::Structure::setHasCustomGetterSetterProperties):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get): Inlined due to hotness.
+        (JSC::nextOutOfLineStorageCapacity): Inlined due to hotness.
+        (JSC::Structure::suggestedNewOutOfLineStorageCapacity): Inlined due to hotness.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase<Unknown>::isCustomGetterSetter):
+
+2014-06-07  Mark Lam  <mark.lam@apple.com>
+
+        Structure should initialize its previousID in its constructor.
+        <https://webkit.org/b/133606>
+
+        Reviewed by Mark Hahnenberg.
+
+        Currently, the Structure constructor that takes a previous structure will
+        initialize its previousID to point to the previous structure's previousID.
+        This is incorrect.  However, the caller of the Structure::create() factory
+        method (which instantiated the Structure) will later call setPreviousID()
+        to set the previousID to the correct previous structure.  This makes the
+        code confusing to read and more error prone in that the structure relies
+        on client code to fix its invalid previousID.
+
+        This patch fixes this by making the Structure constructor initialize
+        previousID correctly.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::nonPropertyTransition):
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::create):
+
+2014-06-06  Andreas Kling  <akling@apple.com>
+
+        Indexed getters should return values directly on the PropertySlot.
+        <https://webkit.org/b/133586>
+
+        Remove PropertySlot's custom index mode.
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSObject.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::setCustomIndex): Deleted.
+
+2014-06-04  Timothy Horton  <timothy_horton@apple.com>
+
+        iOS Debug build fix
+
+        Rubber-stamped by Filip Pizlo.
+
+        * Configurations/LLVMForJSC.xcconfig:
+        Dead-code strip the llvmForJSC library unconditionally, to work around <rdar://problem/16920916>.
+
+2014-06-04  Oliver Hunt  <oliver@apple.com>
+
+        ArrayIterator should not be exposed in Safari 8
+        https://bugs.webkit.org/show_bug.cgi?id=133494
+
+        Reviewed by Michael Saboff.
+
+        Separate out types that require constructor objects, and don't
+        include the iterator types in that list.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+
+2014-06-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Safepoint::begin() should set m_didCallBegin before releasing the rightToRun lock, because otherwise, Safepoint::checkLivenessAndVisitChildren() may assert due to a race
+        https://bugs.webkit.org/show_bug.cgi?id=133525
+        <rdar://problem/16790296>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGSafepoint.cpp:
+        (JSC::DFG::Safepoint::begin):
+
+2014-06-03  Filip Pizlo  <fpizlo@apple.com>
+
+        LLVM soft-linking should be truly fail-silent
+        https://bugs.webkit.org/show_bug.cgi?id=133482
+
+        Reviewed by Mark Lam.
+
+        * llvm/InitializeLLVMPOSIX.cpp:
+        (JSC::initializeLLVMPOSIX): Missing return statement in the dlsym() returning null case.
+
+2014-06-03  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        REGRESSION(r169092 and r169102): Skip failing JSC tests poperly on non-x86 Darwin platforms
+        https://bugs.webkit.org/show_bug.cgi?id=133149
+
+        Reviewed by Csaba Osztrogonác.
+
+        * tests/mozilla/mozilla-tests.yaml: Skip js1_5/Regress/regress-159334.js only if the architecture isn't x86 and the host is Darwin.
+
+2014-05-31  Anders Carlsson  <andersca@apple.com>
+
+        Add a LazyNeverDestroyed class template and use it
+        https://bugs.webkit.org/show_bug.cgi?id=133425
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGFunctionWhitelist.cpp:
+        (JSC::DFG::FunctionWhitelist::ensureGlobalWhitelist):
+        * dfg/DFGFunctionWhitelist.h:
+
+2014-05-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::DCEPhase inserts into an insertion set in reverse, causing hilarious basic block corruption if you kill a lot of NewArrays
+        https://bugs.webkit.org/show_bug.cgi?id=133368
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::fixupBlock): Loop in the right order so that we insert in the right order.
+        * tests/stress/new-array-dead.js: Added.
+        (foo):
+
+2014-05-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix not-x86 32-bit.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2014-05-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Arrayify neglects to inform the clobberizer that it might fire watchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=133340
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): Be honest.
+        * llint/LowLevelInterpreter32_64.asm: Profile the object, not its structure.
+        * tests/stress/arrayify-fires-watchpoint.js: Added.
+        (foo):
+        (test):
+        (makeObjectArray):
+        * tests/stress/arrayify-structure-bad-test.js: Added.
+        (foo):
+        (test):
+
+2014-05-27  Jon Lee  <jonlee@apple.com>
+
+        Update ENABLE(MEDIA_SOURCE) on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=133141
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-05-27  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
+
+        Remove BLOB guards
+        https://bugs.webkit.org/show_bug.cgi?id=132863
+
+        Reviewed by Csaba Osztrogonác.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-05-27  Zsolt Borbely  <zsborbely.u-szeged@partner.samsung.com>
+
+        Allow building CMake based ports with WEB_REPLAY
+        https://bugs.webkit.org/show_bug.cgi?id=133154
+
+        Reviewed by Csaba Osztrogonác.
+
+        * CMakeLists.txt:
+
+2014-05-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Latest emscripten life benchmark is 4x slower because the DFG doesn't realize that arithmetic on booleans is a thing
+        https://bugs.webkit.org/show_bug.cgi?id=133136
+
+        Reviewed by Oliver Hunt.
+        
+        Some key concepts:
+
+        - Except for the prediction propagation and type fixup phases, which are super early in
+          the pipeline, nobody has to know about the fact that booleans may flow into numerical
+          operations because there will just be a BooleanToNumber node that will take a value
+          and, if that value is a boolean, will convert it to the equivalent numerical value. It
+          will have a BooleanUse mode where it will also speculate that the input is a boolean
+          but it can also do UntypedUse in which case it will pass through any non-booleans.
+          This operation is very easy to model in all of the compiler tiers.
+
+        - No changes to the baseline JIT. The Baseline JIT will still believe that boolean
+          inputs require taking the slow path and it will still report that it took slow path
+          for any such operations.  The DFG will now be smart enough to ignore baseline JIT slow
+          path profiling on operations that were known to have had boolean inputs.  That's a
+          little quirky, but it's probably easier than modifying the baseline JIT to track
+          booleans correctly.
+        
+        4.1x speed-up on the emscripten "life" benchmark. Up to 10x speed-up on microbenchmarks.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt32OrBooleanSpeculation):
+        (JSC::isInt32SpeculationForArithmetic):
+        (JSC::isInt32OrBooleanSpeculationForArithmetic):
+        (JSC::isInt32OrBooleanSpeculationExpectingDefined):
+        (JSC::isInt52Speculation):
+        (JSC::isMachineIntSpeculation):
+        (JSC::isFullNumberOrBooleanSpeculation):
+        (JSC::isFullNumberOrBooleanSpeculationExpectingDefined):
+        (JSC::isInt32SpeculationExpectingDefined): Deleted.
+        (JSC::isMachineIntSpeculationExpectingDefined): Deleted.
+        (JSC::isMachineIntSpeculationForArithmetic): Deleted.
+        (JSC::isBytecodeNumberSpeculationExpectingDefined): Deleted.
+        (JSC::isFullNumberSpeculationExpectingDefined): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAllocator.h:
+        (JSC::DFG::Allocator<T>::indexOf):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixIntConvertingEdge):
+        (JSC::DFG::FixupPhase::fixIntOrBooleanEdge):
+        (JSC::DFG::FixupPhase::fixDoubleOrBooleanEdge):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        (JSC::DFG::FixupPhase::fixIntEdge): Deleted.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addSpeculationMode):
+        (JSC::DFG::Graph::valueAddSpeculationMode):
+        (JSC::DFG::Graph::arithAddSpeculationMode):
+        (JSC::DFG::Graph::addShouldSpeculateInt32):
+        (JSC::DFG::Graph::mulShouldSpeculateInt32):
+        (JSC::DFG::Graph::mulShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::negateShouldSpeculateInt32):
+        (JSC::DFG::Graph::negateShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInt32):
+        (JSC::DFG::Graph::mulImmediateShouldSpeculateInt32): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::sawBooleans):
+        (JSC::DFG::Node::shouldSpeculateInt32OrBoolean):
+        (JSC::DFG::Node::shouldSpeculateInt32ForArithmetic):
+        (JSC::DFG::Node::shouldSpeculateInt32OrBooleanForArithmetic):
+        (JSC::DFG::Node::shouldSpeculateInt32OrBooleanExpectingDefined):
+        (JSC::DFG::Node::shouldSpeculateMachineInt):
+        (JSC::DFG::Node::shouldSpeculateDouble):
+        (JSC::DFG::Node::shouldSpeculateNumberOrBoolean):
+        (JSC::DFG::Node::shouldSpeculateNumberOrBooleanExpectingDefined):
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        (JSC::DFG::Node::canSpeculateInt32):
+        (JSC::DFG::Node::canSpeculateInt52):
+        (JSC::DFG::Node::sourceFor):
+        (JSC::DFG::Node::shouldSpeculateInt32ExpectingDefined): Deleted.
+        (JSC::DFG::Node::shouldSpeculateMachineIntForArithmetic): Deleted.
+        (JSC::DFG::Node::shouldSpeculateMachineIntExpectingDefined): Deleted.
+        (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic): Deleted.
+        (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined): Deleted.
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::nodeMayOverflow):
+        (JSC::DFG::nodeMayNegZero):
+        (JSC::DFG::nodeCanSpeculateInt32):
+        (JSC::DFG::nodeCanSpeculateInt52):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::run):
+        (JSC::DFG::PredictionPropagationPhase::propagateToFixpoint):
+        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+        (JSC::FTL::LowerDFGToLLVM::compileBooleanToNumber):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::asInt32ForArithmetic):
+        * tests/stress/max-boolean-exit.js: Added.
+        (foo):
+        (test):
+        * tests/stress/mul-boolean-exit.js: Added.
+        (foo):
+        (test):
+        * tests/stress/plus-boolean-exit.js: Added.
+        (foo):
+        (test):
+        * tests/stress/plus-boolean-or-double.js: Added.
+        (foo):
+        (test):
+        * tests/stress/plus-boolean-or-int.js: Added.
+        (foo):
+        (test):
+
+2014-05-26  Zsolt Borbely  <zsborbely.u-szeged@partner.samsung.com>
+
+        Remove dead code from VM.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=133284
+
+        Reviewed by Darin Adler.
+
+        This workaround was added in r127505. Since the clang is the
+        only used compiler in this case, this workaround is obsolete.
+
+        * runtime/VM.cpp:
+        (JSC::enableAssembler):
+
+2014-05-26  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        JSC CLoop warning fix
+        https://bugs.webkit.org/show_bug.cgi?id=133259
+
+        Reviewed by Darin Adler.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2014-05-24  Andreas Kling  <akling@apple.com>
+
+        Object.prototype.toString() should use cached strings for null/undefined.
+        <https://webkit.org/b/133261>
+
+        Normally, when calling Object.prototype.toString() on a regular object,
+        we'd cache the result of the stringification on the object's structure,
+        making repeated calls fast.
+
+        For null and undefined, we were not as smart. We'd instead construct a
+        new string with either "[object Null]" or "[object Undefined]" each time.
+
+        This was exposed by Dromaeo's JS library tests, where some prototype.js
+        subtests generate millions of strings this way.
+
+        This patch adds two VM-permanent cached strings to the SmallStrings.
+        Looks like ~10% speed-up on Dromaeo/jslib-traverse-prototype.html
+
+        Reviewed by Darin Adler.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::initializeCommonStrings):
+        (JSC::SmallStrings::visitStrongReferences):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::nullObjectString):
+        (JSC::SmallStrings::undefinedObjectString):
+
+2014-05-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove operationCallGetter
+
+        Rubber stamped by Filip Pizlo.
+
+        Nobody calls this function.
+
+        * JavaScriptCore.order:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+
+2014-05-23  Andreas Kling  <akling@apple.com>
+
+        Templatize GC's destructor invocation for dtor type.
+        <https://webkit.org/b/133231>
+
+        Get rid of a branch in callDestructor() by templatizing it for
+        the DestructorType. Removed JSCell::methodTableForDestruction()
+        since this was the only call site and it was jumping through
+        a bunch of unnecessary hoops.
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::callDestructor):
+        (JSC::MarkedBlock::specializedSweep):
+        * heap/MarkedBlock.h:
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::methodTableForDestruction): Deleted.
+
+2014-05-23  Andreas Kling  <akling@apple.com>
+
+        Support inline caching of RegExpMatchesArray.length
+        <https://webkit.org/b/133234>
+
+        Give RegExpMatchesArray.length the same treatment as JSArray in
+        repatch so we don't have to go out of line on every access.
+
+        ~13% speed-up on Octane/regexp.
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::isRegExpMatchesArray):
+
+2014-05-22  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION(r154797): Debugger crashes when stepping over an uncaught exception.
+        <https://webkit.org/b/133182>
+
+        Reviewed by Oliver Hunt.
+
+        Before r154797, we used to clear the VM exception before calling into the
+        debugger.  After r154797, we don't.  This patch will restore this clearing
+        of the exception before calling into the debugger.
+
+        Also added assertions after returning from calls into the debugger to
+        ensure that the debugger did not introduce any exceptions.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::Interpreter::unwind):
+        (JSC::Interpreter::debug):
+        - Fixed the assertion here.  Interpreter::debug() should never be called
+          with a pending exception.  Debugger callbacks for exceptions should be
+          handled by Interpreter::unwind() and Interpreter::unwindCallFrame().
+
+2014-05-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Store barrier elision should run after DCE in both the DFG path and the FTL path
+        https://bugs.webkit.org/show_bug.cgi?id=129718
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2014-05-21  Zsolt Borbely  <zsborbely.u-szeged@partner.samsung.com>
+
+        [EFL] Add include path of compact_unwind_encoding.h if FTL JIT is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=132907
+
+        Reviewed by Gyuyoung Kim.
+
+        * CMakeLists.txt:
+
+2014-05-16  Martin Robinson  <mrobinson@igalia.com>
+
+        [CMake] Improve handling of LIB_INSTALL_DIR, EXEC_INSTALL_DIR, and LIBEXEC_INSTALL_DIR
+        https://bugs.webkit.org/show_bug.cgi?id=132819
+
+        Reviewed by Carlos Garcia Campos.
+
+        * javascriptcoregtk.pc.in: Instead of using the special pkg-config variables,
+        use the common CMake ones directly.
+
+2014-05-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/169159.
+        
+        This was a unilateral change and wasn't properly reviewed.
+
+        * tests/mozilla/mozilla-tests.yaml:
+
+2014-05-21  Antoine Quint  <graouts@webkit.org>
+
+        Array.prototype.find and findIndex should skip holes
+        https://bugs.webkit.org/show_bug.cgi?id=132658
+
+        Reviewed by Geoffrey Garen.
+
+        Skip holes in the array when iterating such that callback isn't called.
+
+        * builtins/Array.prototype.js:
+        (find):
+        (findIndex):
+
+2014-05-21  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
+
+        REGRESSION(r169092 and r169102): Skip failing JSC tests on ARM64 properly
+        https://bugs.webkit.org/show_bug.cgi?id=133149
+
+        Reviewed by Csaba Osztrogonác.
+
+        * tests/mozilla/mozilla-tests.yaml:
+
+2014-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out <http://trac.webkit.org/changeset/166184>
+        https://bugs.webkit.org/show_bug.cgi?id=133144
+
+        Reviewed by Gavin Barraclough.
+
+        It caused a performance regression.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::blockFreeingThreadStartFunc):
+
+2014-05-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG prediction propagation should agree with fixup phase over the return type of GetByVal
+        https://bugs.webkit.org/show_bug.cgi?id=133134
+
+        Reviewed by Mark Hahnenberg.
+        
+        Make prediction propagator use ArrayMode refinement to decide the return type.
+        
+        Also introduce a heap prediction intrinsic that allows us to test weird corner cases
+        like this. The only way we'll see a mismatch like this in the real world is probably
+        through a gnarly race condition.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::setHeapPrediction):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionFalse1):
+        (functionFalse2):
+        (functionUndefined1):
+        (functionUndefined2):
+        (functionFalse): Deleted.
+        (functionOtherFalse): Deleted.
+        (functionUndefined): Deleted.
+        * runtime/Intrinsic.h:
+        * tests/stress/get-by-val-double-predicted-int.js: Added.
+        (foo):
+
+2014-05-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Watchdog timer should be lazily allocated
+        https://bugs.webkit.org/show_bug.cgi?id=133135
+
+        Reviewed by Geoffrey Garen.
+
+        We incur a noticeable amount of overhead on some benchmarks due to checking if the Watchdog ever fired. 
+        There is no reason to do this checking if we never activated the Watchdog, which can only be done through 
+        JSContextGroupSetExecutionTimeLimit or JSContextGroupClearExecutionTimeLimit. 
+
+        By allocating the Watchdog lazily on the VM we can avoid all of the associated overhead when we don't use 
+        these two API functions (which is true of most clients).
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupSetExecutionTimeLimit):
+        (JSContextGroupClearExecutionTimeLimit):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_hint):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/VM.h:
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::Scope::Scope): Deleted.
+        (JSC::Watchdog::Scope::~Scope): Deleted.
+        * runtime/Watchdog.h:
+        (JSC::Watchdog::Scope::Scope):
+        (JSC::Watchdog::Scope::~Scope):
+
+2014-05-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSArray::shiftCountWith* could be more efficient
+        https://bugs.webkit.org/show_bug.cgi?id=133011
+
+        Reviewed by Geoffrey Garen.
+
+        Our current implementations of shiftCountWithAnyIndexingType and shiftCountWithArrayStorage 
+        are scared of the presence of any holes in the array. We can mitigate this somewhat by enabling 
+        them to correctly handle holes, thus avoiding the slowest of slow paths in most cases.
+
+        * runtime/ArrayStorage.h:
+        (JSC::ArrayStorage::indexingHeader):
+        (JSC::ArrayStorage::length):
+        (JSC::ArrayStorage::hasHoles):
+        * runtime/IndexingHeader.h:
+        (JSC::IndexingHeader::publicLength):
+        (JSC::IndexingHeader::from):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        * runtime/JSArray.h:
+        (JSC::JSArray::shiftCountForShift):
+        (JSC::JSArray::shiftCountForSplice):
+        (JSC::JSArray::shiftCount):
+        * runtime/Structure.cpp:
+        (JSC::Structure::holesRequireSpecialBehavior):
+        * runtime/Structure.h:
+
+2014-05-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Test gardening: skip some failing tests on not-X86.
+
+        * tests/mozilla/mozilla-tests.yaml:
+
+2014-05-19  Mark Lam  <mark.lam@apple.com>
+
+        operationOptimize() should defer the GC for a while.
+        <https://webkit.org/b/133103>
+
+        Reviewed by Filip Pizlo.
+
+        Currently, operationOptimize() only defers the GC until its end.  As a result,
+        a GC may be triggered just before we return from operationOptimize(), and it may
+        jettison the optimize codeBlock that we're planning to OSR enter into when we
+        return from this function.  This is because the OSR entry on-ramp code hasn't
+        been executed yet, and hence, there is not yet a reference to this new codeBlock
+        from the stack, and there won't be until we've had a chance to return out of
+        operationOptimize() to run the OSR entry on-ramp code.
+
+        This issue is now fixed by using DeferGCForAWhile instead of DeferGC.  This
+        ensures that the GC will be deferred until after the OSR entry on-ramp can be
+        executed.
+
+        * jit/JITOperations.cpp:
+
+2014-05-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Take care of some ARM64 test failures
+        https://bugs.webkit.org/show_bug.cgi?id=133090
+
+        Reviewed by Geoffrey Garen.
+        
+        Constant blinding on ARM64 cannot use the scratch register.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::convertInt32ToDouble):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::store64):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::scratchRegisterForBlinding):
+
+2014-05-19  Tanay C  <tanay.c@samsung.com>
+
+        Removing some check-webkit-style warnings from ./dfg
+        https://bugs.webkit.org/show_bug.cgi?id=132854
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGAbstractInterpreter.h:
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGBlockInsertionSet.h:
+        * dfg/DFGCommonData.h:
+        * dfg/DFGDominators.h:
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.h:
+        * dfg/DFGPredictionPropagationPhase.h:
+
+2014-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, remove bogus comment. We already made the FTL use our calling convention.
+        That was a long time ago.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileReturn):
+
+2014-05-18  Rik Cabanier  <cabanier@adobe.com>
+
+        support for navigator.hardwareConcurrency
+        https://bugs.webkit.org/show_bug.cgi?id=132588
+
+        Reviewed by Filip Pizlo.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-05-16  Michael Saboff  <msaboff@apple.com>
+
+        Crash in JSC::Yarr::YarrGenerator<(JSC::Yarr::YarrJITCompileMode)0>::generatePatternCharacterFixed() due to WTF::CrashOnOverflow::overflowed + 9
+        https://bugs.webkit.org/show_bug.cgi?id=133009
+
+        Reviewed by Oliver Hunt.
+
+        If we determine that any alternative requires a minumum match size greater than
+        INT_MAX, we handle the match in the interpreter.
+
+        Check to see if the pattern has unsigned lengths before invoking YARR JIT.
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+
+        * tests/stress/large-regexp.js: New test added.
+
+        Set m_containsUnsignedLengthPattern flag if any alternative's minimum length
+        doesn't fit in an int.
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
+
+        Clear new m_containsUnsignedLengthPattern flag.
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::YarrPattern::reset):
+        (JSC::Yarr::YarrPattern::containsUnsignedLengthPattern):
+
+2014-05-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSDOMWindow should not claim HasImpureGetOwnPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=132918
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/Repatch.cpp:
+        (JSC::tryRepatchIn): We forgot to check for watchpoints when repatching "in".
+
+2014-05-15  Alex Christensen  <achristensen@webkit.org>
+
+        Add pointer lock to features without enabling it.
+        https://bugs.webkit.org/show_bug.cgi?id=132961
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Added ENABLE_POINTER_LOCK to list of features.
+
+2014-05-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Inline caching for proxies clobbers baseGPR too early
+        https://bugs.webkit.org/show_bug.cgi?id=132916
+
+        Reviewed by Filip Pizlo.
+
+        We clobber baseGPR prior to the Structure checks, so if any of the checks fail then the slow path 
+        gets the target of the proxy rather than the proxy itself. We need to delay the clobbering of baseGPR 
+        until we know the inline cache is going to succeed.
+
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+
+2014-05-14  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed build fix.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: This solution
+        was missing commands to build LLInt portions of JSC.
+        * llint/LLIntData.cpp: 64-bit build fix.
+
+2014-05-14  Martin Hodovan <mhodovan.u-szeged@partner.samsung.com>
+
+        ARM Traditional buildfix after r168776.
+        https://bugs.webkit.org/show_bug.cgi?id=132903
+
+        Reviewed by Darin Adler.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::abortWithReason): Added.
+
+2014-05-14  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
+
+        Remove CSS_STICKY_POSITION guards
+        https://bugs.webkit.org/show_bug.cgi?id=132676
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-05-13  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT breakpoints should be more informative
+        https://bugs.webkit.org/show_bug.cgi?id=132882
+
+        Reviewed by Oliver Hunt.
+        
+        Introduce the notion of an AbortReason, which is a nice enumeration of coded assertion
+        failure names. This means that all you need to figure out why the JIT SIGTRAP'd is to look
+        at that platform's abort reason register (r11 on X86-64 for example).
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbortReason.h: Added.
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::abortWithReason):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::abortWithReason):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::abortWithReason):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::abortWithReason):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::generate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::bail):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrEntryThunkGenerator):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::jitAssertIsInt32):
+        (JSC::AssemblyHelpers::jitAssertIsJSInt32):
+        (JSC::AssemblyHelpers::jitAssertIsJSNumber):
+        (JSC::AssemblyHelpers::jitAssertIsJSDouble):
+        (JSC::AssemblyHelpers::jitAssertIsCell):
+        (JSC::AssemblyHelpers::jitAssertTagsInPlace):
+        (JSC::AssemblyHelpers::jitAssertHasValidCallFrame):
+        (JSC::AssemblyHelpers::jitAssertIsNull):
+        (JSC::AssemblyHelpers::jitAssertArgumentCountSane):
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::checkStackPointerAlignment):
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo): Deleted.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitSlow_op_div):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::addStructureTransitionCheck): Deleted.
+        (JSC::JIT::testPrototype): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::compileGetDirectOffset):
+        * jit/RegisterPreservationWrapperGenerator.cpp:
+        (JSC::generateRegisterRestoration):
+        * jit/Repatch.cpp:
+        (JSC::addStructureTransitionCheck):
+        (JSC::linkClosureCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::emitPointerValidation):
+        (JSC::nativeForGenerator):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generate):
+
+2014-05-13  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Enum type with value zero is compatible with void*, potential cause of crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=132772
+
+        Reviewed by Geoffrey Garen.
+
+        Using the MSVC compiler, an instance of an enum type with value zero, is compatible with void* (see bug 132683 for a code example).
+        This has caused crashes on Windows on two occasions (bug 132683, and bug 121001).
+        This patch tries to prevent these type of crashes by using a type with explicit constructors instead of void*.
+        The void* parameter in the loadDouble and storeDouble methods are replaced with TrustedImmPtr.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeDouble):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::loadDouble):
+        (JSC::MacroAssemblerARM64::storeDouble):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::loadDouble):
+        (JSC::MacroAssemblerSH4::storeDouble):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::storeDouble):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::absDouble):
+        (JSC::MacroAssemblerX86Common::negateDouble):
+        (JSC::MacroAssemblerX86Common::loadDouble):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::compileClampDoubleToByte):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::purifyNaN):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitLoadDouble):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        * jit/ThunkGenerators.cpp:
+        (JSC::floorThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::powThunkGenerator):
+
+2014-05-12  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r168642.
+        https://bugs.webkit.org/show_bug.cgi?id=132839
+
+        Broke ARM build (Requested by jpfau on #webkit).
+
+        Reverted changeset:
+
+        "[Win] Enum type with value zero is compatible with void*,
+        potential cause of crashes."
+        https://bugs.webkit.org/show_bug.cgi?id=132772
+        http://trac.webkit.org/changeset/168642
+
+2014-05-12  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Enum type with value zero is compatible with void*, potential cause of crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=132772
+
+        Reviewed by Geoffrey Garen.
+
+        Using the MSVC compiler, an instance of an enum type with value zero, is compatible with void* (see bug 132683 for a code example).
+        This has caused crashes on Windows on two occasions (bug 132683, and bug 121001).
+        This patch tries to prevent these type of crashes by using a type with explicit constructors instead of void*.
+        The void* parameter in the loadDouble and storeDouble methods are replaced with TrustedImmPtr.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeDouble):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::loadDouble):
+        (JSC::MacroAssemblerARM64::storeDouble):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::loadDouble):
+        (JSC::MacroAssemblerMIPS::storeDouble):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::loadDouble):
+        (JSC::MacroAssemblerSH4::storeDouble):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::storeDouble):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::absDouble):
+        (JSC::MacroAssemblerX86Common::negateDouble):
+        (JSC::MacroAssemblerX86Common::loadDouble):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::compileClampDoubleToByte):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::purifyNaN):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitLoadDouble):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        * jit/ThunkGenerators.cpp:
+        (JSC::floorThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::powThunkGenerator):
+
+2014-05-12  Andreas Kling  <akling@apple.com>
+
+        0.4% of PLT3 in JSCell::structure() below JSObject::visitChildren().
+        <https://webkit.org/b/132828>
+        <rdar://problem/16886285>
+
+        Reviewed by Michael Saboff.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::visitChildren):
+
+            Use JSCell::structure(VM&) to reduce the number of hoops we jump
+            through to find Structures during marking.
+
+2014-05-12  László Langó  <llango.u-szeged@partner.samsung.com>
+
+        [cmake] Add missing FTL source files to the build system.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * CMakeLists.txt:
+
+2014-05-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Allow Remote Inspector to entitlement check UIProcess through WebProcess
+        https://bugs.webkit.org/show_bug.cgi?id=132409
+
+        Reviewed by Timothy Hatcher.
+
+        Proxy applications are applications which hold WebViews for other
+        applications. The WebProcess (Web Content Service) is a proxy application.
+        For legacy reasons we were supporting a scenario where proxy applications
+        could potentially host WebViews for more then one other application. That
+        was never the case for WebProcess and it is now a scenario we don't need
+        to worry about supporting.
+
+        With this change, a proxy application more naturally only holds WebViews
+        for a single parent / host application. The proxy process can set the
+        parent pid / audit_token data on the RemoteInspector singleton, and
+        that data will be sent on to webinspectord later on to be validated.
+        In the WebProcess<->UIProcess relationship that information is known
+        and set immediately. In the Legacy iOS case that information is set
+        soon after, but not immediately known at the point the WebView is created.
+
+        This allows us to simplify the RemoteInspectorDebuggable interface.
+        We no longer need a pid per-Debuggable.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::RemoteInspector):
+        (Inspector::RemoteInspector::setParentProcessInformation):
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        (Inspector::RemoteInspector::listingForDebuggable):
+        (Inspector::RemoteInspector::receivedProxyApplicationSetupMessage):
+        Handle new proxy application setup message, and provide an API
+        for a proxy application to set the parent process information.
+
+        * inspector/remote/RemoteInspectorConstants.h:
+        New setup and response message for proxy applications to pass
+        their parent / host application information to webinspectord.
+
+        * inspector/remote/RemoteInspectorDebuggable.cpp:
+        (Inspector::RemoteInspectorDebuggable::info):
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        (Inspector::RemoteInspectorDebuggableInfo::RemoteInspectorDebuggableInfo):
+        (Inspector::RemoteInspectorDebuggableInfo::hasParentProcess): Deleted.
+        pid per debuggable is no longer needed.
+
+2014-05-09  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSDOMWindow should disable property caching after a certain point
+        https://bugs.webkit.org/show_bug.cgi?id=132751
+
+        Reviewed by Filip Pizlo.
+
+        This is part of removing HasImpureGetOwnPropertySlot from JSDOMWindow. After the lookup in the static 
+        hash table for JSDOMWindow fails we want to disable property caching even if the code that follows thinks 
+        that it has provided a cacheable value.
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::isCacheable):
+        (JSC::PropertySlot::disableCaching):
+
+2014-05-09  Andreas Kling  <akling@apple.com>
+
+        8.8% spent in Object.prototype.hasOwnProperty() on sbperftest.
+        <https://webkit.org/b/132749>
+
+        Leverage the fast-resolve-to-AtomicString optimization for JSRopeString
+        in Object.prototype.* by using JSString::toIdentifier() in the cases where
+        we are converting JSString -> String -> Identifier.
+
+        This brings time spent in hasOwnProperty() from 8.8% to 1.3% on
+        "The Great HTML5 Gaming Performance Test: 2014 edition"
+        <http://www.scirra.com/demos/c2/sbperftest/>
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+
+2014-05-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSDOMWindow should have a WatchpointSet to fire on window close
+        https://bugs.webkit.org/show_bug.cgi?id=132721
+
+        Reviewed by Filip Pizlo.
+
+        This patch allows us to reset the inline caches that assumed they could skip 
+        the first part of JSDOMWindow::getOwnPropertySlot that checks if the window has 
+        been closed. This is part of getting rid of HasImpureGetOwnPropertySlot on JSDOMWindow.
+
+        PropertySlot now accepts a WatchpointSet which the inline cache code can look for
+        to see if it should create a new Watchpoint for that particular inline cache site.
+
+        * bytecode/Watchpoint.h:
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::tryBuildGetByIDList):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::watchpointSet):
+        (JSC::PropertySlot::setWatchpointSet):
+
+2014-05-09  Tanay C  <tanay.c@samsung.com>
+
+        Fix build warning (uninitialized variable) in DFGFixupPhase.cpp 
+        https://bugs.webkit.org/show_bug.cgi?id=132331
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+
+2014-05-09  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win] Crash when enabling DFG JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=132683
+
+        Reviewed by Geoffrey Garen.
+
+        On windows, using register GPRInfo::regT0 as parameter to e.g. JIT::storeDouble(..., GPRInfo::regT0)),
+        results in a call to JIT::storeDouble(FPRegisterID src, const void* address),
+        where the address parameter gets the value of GPRInfo::regT0, which is 0 (eax on Windows).
+        This causes the register to be written to address 0, hence the crash.
+
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit): Use address in regT0 as parameter.
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit): Ditto.
+
+2014-05-09  Martin Hodovan <mhodovan.u-szeged@partner.samsung.com>
+
+        REGRESSION(r167094): JSC crashes on ARM Traditional
+        https://bugs.webkit.org/show_bug.cgi?id=132738
+
+        Reviewed by Zoltan Herczeg.
+
+        PC is two instructions ahead of the current instruction
+        on ARM Traditional, so the distance is 8 bytes not 2.
+
+        * llint/LowLevelInterpreter.asm:
+
+2014-05-09  Alberto Garcia  <berto@igalia.com>
+
+        jsmin.py license header confusing, mentions non-free license
+        https://bugs.webkit.org/show_bug.cgi?id=123665
+
+        Reviewed by Darin Adler.
+
+        Pull the most recent version from upstream, which has a clear
+        license.
+
+        * inspector/scripts/jsmin.py:
+
+2014-05-08  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Base case for get-by-id inline cache doesn't check for HasImpureGetOwnPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=132695
+
+        Reviewed by Filip Pizlo.
+
+        We check in the case where we're accessing something other than the base object (e.g. the prototype), 
+        but we fail to do so for the base object.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        * jsc.cpp: Added some infrastructure to support this test. We don't currently trigger this bug anywhere in WebKit
+        because all of the values that are returned that could be impure are set to uncacheable anyways.
+        (WTF::ImpureGetter::ImpureGetter):
+        (WTF::ImpureGetter::createStructure):
+        (WTF::ImpureGetter::create):
+        (WTF::ImpureGetter::finishCreation):
+        (WTF::ImpureGetter::getOwnPropertySlot):
+        (WTF::ImpureGetter::visitChildren):
+        (WTF::ImpureGetter::setDelegate):
+        (GlobalObject::finishCreation):
+        (functionCreateImpureGetter):
+        (functionSetImpureGetterDelegate):
+        * tests/stress/impure-get-own-property-slot-inline-cache.js: Added.
+        (foo):
+
+2014-05-08  Filip Pizlo  <fpizlo@apple.com>
+
+        deleteAllCompiledCode() shouldn't use the suspension worklist
+        https://bugs.webkit.org/show_bug.cgi?id=132708
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::isStillValid):
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode):
+
+2014-05-08  Filip Pizlo  <fpizlo@apple.com>
+
+        SSA conversion should delete PhantomLocals for captured variables
+        https://bugs.webkit.org/show_bug.cgi?id=132693
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGCommon.cpp:
+        (JSC::DFG::startCrashing): Parallel JIT and a JIT bug means that we man dump IR in parallel. This is the workaround. This patch uses it in all of the places where we dump IR and crash.
+        * dfg/DFGCommon.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge): Use the workaround.
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::LivenessAnalysisPhase::run): Use the workaround.
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run): Fix the bug - it's true that PhantomLocal for captured variables doesn't need anything done to it, but it's wrong that we didn't delete it outright.
+        * dfg/DFGValidate.cpp: Use the workaround.
+        * tests/stress/phantom-local-captured-but-not-flushed-to-ssa.js: Added.
+        (foo):
+        (bar):
+
+2014-05-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r168451.
+        https://bugs.webkit.org/show_bug.cgi?id=132670
+
+        Not a speed-up, just do what other compilers do. (Requested by
+        kling on #webkit).
+
+        Reverted changeset:
+
+        "[X86] Emit BT instruction for single-bit tests."
+        https://bugs.webkit.org/show_bug.cgi?id=132650
+        http://trac.webkit.org/changeset/168451
+
+2014-05-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Make Executable::clearCode() actually clear all of the entrypoints, and
+        clean up some other FTL-related calling convention stuff.
+        <rdar://problem/16720172>
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::Worklist):
+        (JSC::DFG::Worklist::finishCreation):
+        (JSC::DFG::Worklist::create):
+        (JSC::DFG::ensureGlobalDFGWorklist):
+        (JSC::DFG::ensureGlobalFTLWorklist):
+        * dfg/DFGWorklist.h:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::dump):
+        * heap/CodeBlockSet.h:
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode):
+
+2014-05-07  Andreas Kling  <akling@apple.com>
+
+        [X86] Emit BT instruction for single-bit tests.
+        <https://webkit.org/b/132650>
+
+        Implement test-bit-and-branch slightly more efficiently by using
+        BT + JC/JNC instead of TEST + JZ/JNZ when we're only testing for
+        a single bit.
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::singleBitIndex):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::bt_i8r):
+        (JSC::X86Assembler::bt_i8m):
+
+2014-05-07  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION(r166678): Dromaeo/cssquery-dojo.html crashes regularly.
+        <https://webkit.org/b/131356>
+
+        Reviewed by Geoffrey Garen.
+
+        The issue is that GC needs to be made aware of writes to m_inferredValue
+        in the VariableWatchpointSet, but was not.  As a result, if a JSCell*
+        is written to a VariableWatchpointSet m_inferredValue, and that JSCell
+        does not survive an eden GC shortly after, we will end up with a stale
+        JSCell pointer left in the m_inferredValue.
+
+        This issue can be detected more easily by running Dromaeo/cssquery-dojo.html
+        using DumpRenderTree with the VM heap in zombie mode.
+
+        The fix is to change VariableWatchpointSet m_inferredValue to type
+        WriteBarrier<Unknown> and ensure that VariableWatchpointSet::notifyWrite()
+        is executed by all the execution engines so that the WriteBarrier semantics
+        are honored.
+
+        We still check if the value to be written is the same as the one in the
+        inferredValue.  We'll by-pass calling the slow path notifyWrite() if the
+        values are the same.        
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        - need to pass the symbolTable to prepareToWatch() because it will be needed
+          for instantiating the VariableWatchpointSet in prepareToWatch().
+
+        * bytecode/VariableWatchpointSet.h:
+        (JSC::VariableWatchpointSet::VariableWatchpointSet):
+        - VariableWatchpointSet now tracks its owner symbol table for its m_inferredValue
+          write barrier, and yes, m_inferredValue is now of type WriteBarrier<Unknown>.
+        (JSC::VariableWatchpointSet::inferredValue):
+        (JSC::VariableWatchpointSet::invalidate):
+        (JSC::VariableWatchpointSet::finalizeUnconditionally):
+        (JSC::VariableWatchpointSet::addressOfInferredValue):
+        (JSC::VariableWatchpointSet::notifyWrite): Deleted.
+        * bytecode/VariableWatchpointSetInlines.h: Added.
+        (JSC::VariableWatchpointSet::notifyWrite):
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        - Added an assert in case we try to make constants of zombified JSCells again.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        - We now let the slow path handle the cases when the VariableWatchpointSet is
+          in state ClearWatchpoint and IsWatched, and the slow path will ensure that
+          we handle the needed write barrier semantics correctly.
+          We will by-pass the slow path if the value being written is the same as the
+          inferred value.
+
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNotifyWrite):
+        - Let the slow path handle the cases when the VariableWatchpointSet is
+          in state ClearWatchpoint and IsWatched.
+          We will by-pass the slow path if the value being written is the same as the
+          inferred value.
+
+        * heap/Heap.cpp:
+        (JSC::Zombify::operator()):
+        - Use a different value for the zombified bits (to distinguish it from 0xbbadbeef
+          which is used everywhere else).
+        * heap/Heap.h:
+        (JSC::Heap::isZombified):
+        - Provide a convenience test function to check if JSCells are zombified.  This is
+          currently only used in an assertion in the DFG bytecode parser, but the intent
+          it that we'll apply this test in other strategic places later to help with early
+          detection of usage of GC'ed objects when we run in zombie mode.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_captured_mov):
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitNotifyWrite):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitNotifyWrite):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        - Let the slow path for notifyWrite handle the cases when the VariableWatchpointSet
+          is in state ClearWatchpoint and IsWatched.
+          We will by-pass the slow path if the value being written is the same as the
+          inferred value.
+        
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        - Let the slow path for notifyWrite handle the cases when the VariableWatchpointSet
+          is in state ClearWatchpoint and IsWatched.
+          We will by-pass the slow path if the value being written is the same as the
+          inferred value.
+        
+        * runtime/CommonSlowPaths.cpp:
+
+        * runtime/JSCJSValue.h: Fixed some typos in the comments.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::prepareToWatch):
+        (JSC::SymbolTableEntry::notifyWriteSlow):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTableEntry::notifyWrite):
+
+2014-05-06  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewd build fix for C-LOOP after r168396.
+
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::optimizeNextInvocation): Wrapped actual call inside #if ENABLE(JIT)
+
+2014-05-06  Michael Saboff  <msaboff@apple.com>
+
+        Add test for deleteAllCompiledCode
+        https://bugs.webkit.org/show_bug.cgi?id=132632
+
+        Reviewed by Phil Pizlo.
+
+        Added two new hooks to jsc, one to call Heap::deleteAllCompiledCode() and
+        the other to call CodeBlock::optimizeNextInvocation().  Used these two hooks
+        to write a test that will queue up loads of DFG compiles and then call
+        Heap::deleteAllCompiledCode() to make sure that it can handle compiled
+        code as well as code being compiled.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDeleteAllCompiledCode):
+        (functionOptimizeNextInvocation):
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::optimizeNextInvocation):
+        * runtime/TestRunnerUtils.h:
+        * tests/stress/deleteAllCompiledCode.js: Added.
+        (functionList):
+        (runTest):
+
+2014-05-06  Andreas Kling  <akling@apple.com>
+
+        JSString::toAtomicString() should return AtomicString.
+        <https://webkit.org/b/132627>
+
+        Remove premature optimization where I was trying to avoid refcount
+        churn when returning an already atomicized String.
+
+        Instead of using reinterpret_cast to mangle the String member into
+        a const AtomicString& return value, just return AtomicString.
+
+        Reviewed by Geoff Garen.
+
+        * runtime/JSString.h:
+        (JSC::JSString::toAtomicString):
+
+2014-05-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Roll out r167889
+
+        Rubber stamped by Geoff Garen.
+
+        It broke some websites.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::hasDeletedOffset):
+        (JSC::PropertyTable::hadDeletedOffset): Deleted.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::pin):
+        (JSC::Structure::pinAndPreventTransitions): Deleted.
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::propertyTable):
+        (JSC::Structure::checkOffsetConsistency):
+        (JSC::Structure::hadDeletedOffsets): Deleted.
+        * tests/stress/for-in-after-delete.js:
+        (foo): Deleted.
+
+2014-05-05  Andreas Kling  <akling@apple.com>
+
+        Fix debug build.
+
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::fastGetOwnProperty):
+
+2014-05-05  Andreas Kling  <akling@apple.com>
+
+        Optimize GetByVal when subscript is a rope string.
+        <https://webkit.org/b/132590>
+
+        Use JSString::toIdentifier() in the various GetByVal implementations
+        to try and avoid allocating extra strings.
+
+        Added canUseFastGetOwnProperty() and wrap calls to fastGetOwnProperty()
+        in that, to avoid calling JSString::value() which always resolves ropes
+        into new strings and de-optimizes subsequent toIdentifier() calls.
+
+        My iMac says ~9% progression on Dromaeo/dom-attr.html
+
+        Reviewed by Phil Pizlo.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::fastGetOwnProperty):
+        (JSC::JSCell::canUseFastGetOwnProperty):
+
+2014-05-05  Andreas Kling  <akling@apple.com>
+
+        REGRESSION (r168256): ASSERTION FAILED: (buffer + m_length) == position loading vanityfair.com article.
+        <https://webkit.org/b/168256>
+        <rdar://problem/16816316>
+
+        Make resolveRopeSlowCase8() behave like its 16-bit counterpart and not
+        clear the fibers. The caller takes care of this.
+
+        Test: fast/dom/getElementById-with-rope-string-arg.html
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeSlowCase8):
+
+2014-05-05  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION: RELEASE_ASSERT in CodeBlock::baselineVersion @ cnn.com
+        https://bugs.webkit.org/show_bug.cgi?id=132581
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::isStillValid): Check that the alternative codeBlock we
+        started compiling for is still the same at the end of compilation.
+        Also did some minor restructuring.
+
+2014-05-05  Andreas Kling  <akling@apple.com>
+
+        Optimize PutByVal when subscript is a rope string.
+        <https://webkit.org/b/132572>
+
+        Add a JSString::toIdentifier() that is smarter when the JSString is
+        really a rope string. Use this in baseline & DFG's PutByVal to avoid
+        allocating new StringImpls that we immediately deduplicate anyway.
+
+        Reviewed by Antti Koivisto.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * jit/JITOperations.cpp:
+        * runtime/JSString.h:
+        (JSC::JSString::toIdentifier):
+
+2014-05-05  Andreas Kling  <akling@apple.com>
+
+        Remove two now-incorrect assertions after r168256.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeSlowCase8):
+        (JSC::JSRopeString::resolveRopeSlowCase):
+
+2014-05-04  Andreas Kling  <akling@apple.com>
+
+        Optimize JSRopeString for resolving directly to AtomicString.
+        <https://webkit.org/b/132548>
+
+        If we know that the JSRopeString we are resolving is going to be used
+        as an AtomicString, we can try to avoid creating a new string.
+
+        We do this by first resolving the rope into a stack buffer, and using
+        that buffer as a key into the AtomicString table. If there is already
+        an AtomicString with the same characters, we reuse that instead of
+        constructing a new StringImpl.
+
+        JSString gains these two public functions:
+
+        - AtomicString toAtomicString()
+
+            Returns an AtomicString, tries to avoid allocating a new string
+            if possible.
+
+        - AtomicStringImpl* toExistingAtomicString()
+
+            Returns a non-null AtomicStringImpl* if one already exists in the
+            AtomicString table. If none is found, the rope is left unresolved.
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeInternal8):
+        (JSC::JSRopeString::resolveRopeInternal16):
+        (JSC::JSRopeString::resolveRopeToAtomicString):
+        (JSC::JSRopeString::clearFibers):
+        (JSC::JSRopeString::resolveRopeToExistingAtomicString):
+        (JSC::JSRopeString::resolveRope):
+        (JSC::JSRopeString::outOfMemory):
+        * runtime/JSString.h:
+        (JSC::JSString::toAtomicString):
+        (JSC::JSString::toExistingAtomicString):
+
+2014-05-04  Andreas Kling  <akling@apple.com>
+
+        Unreviewed, rolling out r168254.
+
+        Very crashy on debug JSC tests.
+
+        Reverted changeset:
+
+        "jsSubstring() should be lazy"
+        https://bugs.webkit.org/show_bug.cgi?id=132556
+        http://trac.webkit.org/changeset/168254
+
+2014-05-04  Filip Pizlo  <fpizlo@apple.com>
+
+        jsSubstring() should be lazy
+        https://bugs.webkit.org/show_bug.cgi?id=132556
+
+        Reviewed by Andreas Kling.
+        
+        jsSubstring() is now lazy by using a special rope that is a substring instead of a
+        concatenation. To make this patch super simple, we require that a substring's base is
+        never a rope. Hence, when resolving a rope, we either go down a non-recursive substring
+        path, or we go down a concatenation path which may see exactly one level of substrings in
+        its fibers.
+        
+        This is up to a 50% speed-up on microbenchmarks and a 10% speed-up on Octane/regexp.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::specializedSweep):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::visitFibers):
+        (JSC::JSRopeString::resolveRope):
+        (JSC::JSRopeString::resolveRopeSlowCase8):
+        (JSC::JSRopeString::resolveRopeSlowCase):
+        (JSC::JSRopeString::outOfMemory):
+        * runtime/JSString.h:
+        (JSC::JSRopeString::finishCreation):
+        (JSC::JSRopeString::append):
+        (JSC::JSRopeString::create):
+        (JSC::JSRopeString::offsetOfFibers):
+        (JSC::JSRopeString::fiber):
+        (JSC::JSRopeString::substringBase):
+        (JSC::JSRopeString::substringOffset):
+        (JSC::JSRopeString::substringSentinel):
+        (JSC::JSRopeString::isSubstring):
+        (JSC::jsSubstring):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::reifyAllProperties):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSubstring):
+
+2014-05-02  Michael Saboff  <msaboff@apple.com>
+
+        "arm64 function not 4-byte aligned" warnings when building JSC
+        https://bugs.webkit.org/show_bug.cgi?id=132495
+
+        Reviewed by Geoffrey Garen.
+
+        Added ".align 4" for both ARM Thumb2 and ARM 64 to silence the linker.
+
+        * llint/LowLevelInterpreter.cpp:
+
+2014-05-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix cloop build after r168178
+
+        * bytecode/CodeBlock.cpp:
+
+2014-05-01  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add a DFG function whitelist
+        https://bugs.webkit.org/show_bug.cgi?id=132437
+
+        Reviewed by Geoffrey Garen.
+
+        Often times when debugging, using bytecode ranges isn't enough to narrow down to the 
+        particular DFG block that's causing issues. This patch adds the ability to whitelist 
+        specific functions specified in a file to enable further filtering without having to recompile.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::isSupported):
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForClosureCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * dfg/DFGFunctionWhitelist.cpp: Added.
+        (JSC::DFG::FunctionWhitelist::ensureGlobalWhitelist):
+        (JSC::DFG::FunctionWhitelist::FunctionWhitelist):
+        (JSC::DFG::FunctionWhitelist::parseFunctionNamesInFile):
+        (JSC::DFG::FunctionWhitelist::contains):
+        * dfg/DFGFunctionWhitelist.h: Added.
+        * runtime/Options.cpp:
+        (JSC::parse):
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+
+2014-05-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGAbstractInterpreter should not claim Int52 arithmetic creates Int52s
+        https://bugs.webkit.org/show_bug.cgi?id=132446
+
+        Reviewed by Mark Hahnenberg.
+        
+        Basically any arithmetic operation can turn an Int52 into an Int32 or vice-versa, and
+        our modeling of Int52Rep nodes is such that they can have either Int32 or Int52 type
+        to indicate a bound on the value. This is useful for knowing, for example, that
+        Int52Rep(Int32:) returns a value that cannot be outside the Int32 range. Also,
+        ValueRep(Int52Rep:) uses this to determine whether it may return a double or an int.
+        But this means that all arithmetic operations must be careful to note that they may
+        turn Int32 inputs into an Int52 output or vice-versa, as these new tests show.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * tests/stress/int52-ai-add-then-filter-int32.js: Added.
+        (foo):
+        * tests/stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js: Added.
+        (foo):
+        * tests/stress/int52-ai-mul-then-filter-int32-directly.js: Added.
+        (foo):
+        * tests/stress/int52-ai-mul-then-filter-int32.js: Added.
+        (foo):
+        * tests/stress/int52-ai-neg-then-filter-int32.js: Added.
+        (foo):
+        * tests/stress/int52-ai-sub-then-filter-int32.js: Added.
+        (foo):
+
+2014-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptCore fails to build with some versions of clang
+        https://bugs.webkit.org/show_bug.cgi?id=132436
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/ArgumentsIteratorConstructor.cpp: Since we call
+        putDirectWithoutTransition, and it calls putWillGrowOutOfLineStorage,
+        and both are marked inline, it's valid for the compiler to decide
+        to inline both and emit neither in the binary. Therefore, we need
+        both inline definitions to be available in the translation unit at
+        compile time, or we'll try to link against a function that doesn't exist.
+
+2014-05-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r167964.
+        https://bugs.webkit.org/show_bug.cgi?id=132431
+
+        Memory improvements should not regress memory usage (Requested
+        by olliej on #webkit).
+
+        Reverted changeset:
+
+        "Don't hold on to parameter BindingNodes forever"
+        https://bugs.webkit.org/show_bug.cgi?id=132360
+        http://trac.webkit.org/changeset/167964
+
+2014-05-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix trivial debug-only race-that-crashes in CallLinkStatus and explain why the remaining races are totally awesome
+        https://bugs.webkit.org/show_bug.cgi?id=132427
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+
+2014-04-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Remove ENABLE_PLUGIN_PROXY_FOR_VIDEO
+        https://bugs.webkit.org/show_bug.cgi?id=132396
+
+        Reviewed by Eric Carlson.
+
+        Remove ENABLE_PLUGIN_PROXY_FOR_VIDEO and related code.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-04-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Argument flush formats should not be presumed to be JSValue since 'this' is weird
+        https://bugs.webkit.org/show_bug.cgi?id=132404
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock): Don't assume that arguments are flushed as JSValue. Use the logic for locals instead.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): SetArgument "changes" the format because before this we wouldn't know we had arguments.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Ditto.
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dumpInContext): Make this easier to dump.
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::ValueSource::operator!): Make this easier to dump because Operands<T> uses T::operator!().
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry): This had a useful assertion for everything except 'this'.
+        * tests/stress/strict-to-this-int.js: Added.
+        (foo):
+        (Number.prototype.valueOf):
+        (test):
+
+2014-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Don't hold on to parameterBindingNodes forever
+        https://bugs.webkit.org/show_bug.cgi?id=132360
+
+        Reviewed by Geoffrey Garen.
+
+        Don't keep the parameter nodes anymore. Instead we store the
+        original parameter string and reparse whenever we actually
+        need them. Because we only actually need them for compilation
+        this only results in a single extra parse.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        (JSC::UnlinkedFunctionExecutable::finishCreation):
+        (JSC::UnlinkedFunctionExecutable::paramString):
+        (JSC::UnlinkedFunctionExecutable::parameters):
+        (JSC::UnlinkedFunctionExecutable::parameterCount): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::create):
+        (JSC::UnlinkedFunctionExecutable::parameterCount):
+        (JSC::UnlinkedFunctionExecutable::parameters): Deleted.
+        (JSC::UnlinkedFunctionExecutable::finishCreation): Deleted.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::setFunctionBodyParameters):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::parametersStartOffset):
+        (JSC::FunctionBodyNode::parametersEndOffset):
+        (JSC::FunctionBodyNode::setParameterLocation):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::parseParameters):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::subExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::setFunctionBodyParameters):
+
+2014-04-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSProxies should be cacheable
+        https://bugs.webkit.org/show_bug.cgi?id=132351
+
+        Reviewed by Geoffrey Garen.
+
+        Whenever we encounter a proxy in an inline cache we should try to cache on the 
+        proxy's target instead of giving up.
+
+        This patch adds support for a simple "recursive" inline cache if the base object
+        we're accessing is a pure forwarding proxy. JSGlobalObject and its subclasses 
+        are the only ones to benefit from this right now.
+
+        This is performance neutral on the benchmarks we track. Currently we won't
+        cache on JSDOMWindow due to HasImpureGetOwnPropertySlot, but this issue will be fixed soon.
+
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::tryBuildGetByIDList):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionCreateProxy):
+        * runtime/IntendedStructureChain.cpp:
+        (JSC::IntendedStructureChain::isNormalized):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::isProxy):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::createStructure):
+        (JSC::JSProxy::targetOffset):
+        * runtime/JSType.h:
+        * runtime/Operations.h:
+        (JSC::isPrototypeChainNormalized):
+        * runtime/Structure.h:
+        (JSC::Structure::isProxy):
+        * tests/stress/proxy-inline-cache.js: Added.
+        (cacheOnTarget.getX):
+        (cacheOnTarget):
+        (cacheOnPrototypeOfTarget.getX):
+        (cacheOnPrototypeOfTarget):
+        (dontCacheOnProxyInPrototypeChain.getX):
+        (dontCacheOnProxyInPrototypeChain):
+        (dontCacheOnTargetOfProxyInPrototypeChainOfTarget.getX):
+        (dontCacheOnTargetOfProxyInPrototypeChainOfTarget):
+
+2014-04-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Use LLVM as a backend for the fourth-tier DFG JIT (a.k.a. the FTL JIT)
+        https://bugs.webkit.org/show_bug.cgi?id=112840
+
+        Rubber stamped by Geoffrey Garen.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-04-29  Geoffrey Garen  <ggaren@apple.com>
+
+        String.prototype.trim removes U+200B from strings.
+        https://bugs.webkit.org/show_bug.cgi?id=130184
+
+        Reviewed by Michael Saboff.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::trimString):
+        (JSC::isTrimWhitespace): Deleted.
+
+2014-04-29  Mark Lam  <mark.lam@apple.com>
+
+        Zombifying sweep should ignore retired blocks.
+        <https://webkit.org/b/132344>
+
+        Reviewed by Mark Hahnenberg.
+
+        By definition, retired blocks do not have "dead" objects, or at least
+        none that we know of yet until the next marking phase has been run
+        over it.  So, we should not be sweeping them (even for zombie mode).
+
+        * heap/Heap.cpp:
+        (JSC::Heap::zombifyDeadObjects):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::zombifySweep):
+        * heap/MarkedSpace.h:
+        (JSC::ZombifySweep::operator()):
+
+2014-04-29  Mark Lam  <mark.lam@apple.com>
+
+        Fix bit rot in zombie mode heap code.
+        <https://webkit.org/b/132342>
+
+        Reviewed by Mark Hahnenberg.
+
+        Need to enter a DelayedReleaseScope before doing a sweep.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::zombifyDeadObjects):
+
+2014-04-29  Tomas Popela  <tpopela@redhat.com>
+
+        LLINT loadisFromInstruction doesn't need special case for big endians
+        https://bugs.webkit.org/show_bug.cgi?id=132330
+
+        Reviewed by Mark Lam.
+
+        The change introduced in r167076 was wrong. We should not apply the offset
+        adjustment on loadisFromInstruction usage as the instruction
+        (UnlinkedInstruction) is declared as an union (i.e. with the int32_t
+        operand variable). The offset of the other union members will be the
+        same as the offset of the first one, that is 0. The behavior here is the
+        same on little and big endian architectures. Thus we don't need
+        special case for big endians.
+
+        * llint/LowLevelInterpreter.asm:
+
+2014-04-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Simplify tryCacheGetById
+        https://bugs.webkit.org/show_bug.cgi?id=132314
+
+        Reviewed by Oliver Hunt and Filip Pizlo.
+
+        This is neutral across all benchmarks we track, although it looks like a wee 0.5% progression on sunspider.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID): If we fail to cache on self, we just repatch to call tryBuildGetByIDList next time.
+
+2014-04-28  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r153142) ASSERT from CodeBlock::dumpBytecode dumping String Switch Jump Tables
+        https://bugs.webkit.org/show_bug.cgi?id=132315
+
+        Reviewed by Mark Hahnenberg.
+
+        Used the StringImpl version of utf8() instead of creating a String first.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+
+2014-04-28  Filip Pizlo  <fpizlo@apple.com>
+
+        The LLInt is awesome and it should get more of the action.
+
+        Rubber stamped by Geoffrey Garen.
+        
+        5% speed-up on JSBench and no meaningful regressions.  Should be a PLT/DYE speed-up also.
+
+        * runtime/Options.h:
+
+2014-04-27  Filip Pizlo  <fpizlo@apple.com>
+
+        GC should be able to remove things from the DFG worklist and cancel on-going compilations if it knows that the compilation would already be invalidated
+        https://bugs.webkit.org/show_bug.cgi?id=132166
+
+        Reviewed by Oliver Hunt and Mark Hahnenberg.
+        
+        The GC can aid type inference by removing structures that are dead and jettisoning
+        code that relies on those structures. This can dramatically accelerate type inference
+        for some tricky programs.
+        
+        Unfortunately, we previously pinned any structures that enqueued compilations depended
+        on. This means that if you're on a machine that only runs a single compilation thread
+        and where compilations are relatively slow, you have a high chance of large numbers of
+        structures being pinned during any GC since the compilation queue is likely to be full
+        of random stuff.
+        
+        This comprehensively fixes this issue by allowing the GC to remove compilation plans
+        if the things they depend on are dead, and to even cancel safepointed compilations.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
+        (JSC::CodeBlock::isKnownToBeLiveDuringGC):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan): Deleted.
+        * dfg/DFGDesiredIdentifiers.cpp:
+        (JSC::DFG::DesiredIdentifiers::DesiredIdentifiers):
+        * dfg/DFGDesiredIdentifiers.h:
+        * dfg/DFGDesiredWatchpoints.h:
+        * dfg/DFGDesiredWeakReferences.cpp:
+        (JSC::DFG::DesiredWeakReferences::DesiredWeakReferences):
+        * dfg/DFGDesiredWeakReferences.h:
+        * dfg/DFGGraphSafepoint.cpp:
+        (JSC::DFG::GraphSafepoint::GraphSafepoint):
+        * dfg/DFGGraphSafepoint.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::notifyCompiling):
+        (JSC::DFG::Plan::notifyCompiled):
+        (JSC::DFG::Plan::notifyReady):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        (JSC::DFG::Plan::isKnownToBeLiveDuringGC):
+        (JSC::DFG::Plan::cancel):
+        (JSC::DFG::Plan::visitChildren): Deleted.
+        * dfg/DFGPlan.h:
+        * dfg/DFGSafepoint.cpp:
+        (JSC::DFG::Safepoint::Result::~Result):
+        (JSC::DFG::Safepoint::Result::didGetCancelled):
+        (JSC::DFG::Safepoint::Safepoint):
+        (JSC::DFG::Safepoint::~Safepoint):
+        (JSC::DFG::Safepoint::checkLivenessAndVisitChildren):
+        (JSC::DFG::Safepoint::isKnownToBeLiveDuringGC):
+        (JSC::DFG::Safepoint::cancel):
+        (JSC::DFG::Safepoint::visitChildren): Deleted.
+        * dfg/DFGSafepoint.h:
+        (JSC::DFG::Safepoint::Result::Result):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::compilationState):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::Worklist::removeDeadPlans):
+        (JSC::DFG::Worklist::runThread):
+        (JSC::DFG::Worklist::visitChildren): Deleted.
+        * dfg/DFGWorklist.h:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLCompile.h:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::visitCompilerWorklistWeakReferences):
+        (JSC::Heap::removeDeadCompilerWorklistEntries):
+        (JSC::Heap::visitWeakHandles):
+        (JSC::Heap::collect):
+        (JSC::Heap::visitCompilerWorklists): Deleted.
+        * heap/Heap.h:
+
+2014-04-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Deleting properties poisons objects
+        https://bugs.webkit.org/show_bug.cgi?id=131551
+
+        Reviewed by Oliver Hunt.
+
+        This is ~3% progression on Dromaeo with a ~6% progression on the jslib portion of Dromaeo in particular.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::hasDeletedOffset):
+        (JSC::PropertyTable::hadDeletedOffset): If we ever had deleted properties we can no longer cache offsets when 
+        iterating properties because we're required to iterate properties in insertion order.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap): We now re-use deleted properties when materializing the property map.
+        (JSC::Structure::removePropertyTransition): We allow up to 5 deletes for a particular path through the tree of 
+        Structure transitions. After that, we convert to an uncacheable dictionary like we used to. We don't cache 
+        delete transitions, but we allow transitioning from them.
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::pin): Now does only what it says it does--marks the property table as pinned.
+        (JSC::Structure::pinAndPreventTransitions): More descriptive version of what the old pin() was doing.
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::hadDeletedOffsets):
+        (JSC::Structure::propertyTable):
+        (JSC::Structure::checkOffsetConsistency): Rearranged variables to be more sensible.
+        * tests/stress/for-in-after-delete.js: Added.
+        (foo):
+
+2014-04-25  Andreas Kling  <akling@apple.com>
+
+        Inline (C++) GetByVal with numeric indices more aggressively.
+        <https://webkit.org/b/132218>
+
+        We were already inlining the string indexed GetByVal path pretty well,
+        while the path for numeric indices got neglected. No more!
+
+        ~9.5% improvement on Dromaeo/dom-traverse.html on my MBP:
+
+            Before: 199.50 runs/s
+             After: 218.58 runs/s
+
+        Reviewed by Phil Pizlo.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::get):
+
+            ALWAYS_INLINE all the things.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getPropertySlot):
+
+            Avoid fetching the Structure more than once. We have the same
+            optimization in the string-indexed code path.
+
+2014-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Need earlier cell test
+        https://bugs.webkit.org/show_bug.cgi?id=132211
+
+        Reviewed by Mark Lam.
+
+        Move cell test to before the function call repatch
+        location, as the repatch logic for 32bit assumes that the
+        caller will already have performed a cell check.
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2014-04-25  Andreas Kling  <akling@apple.com>
+
+        Un-fast-allocate JSGlobalObjectRareData because Windows doesn't build and I'm not in the mood.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectRareData::JSGlobalObjectRareData):
+        (JSC::JSGlobalObject::JSGlobalObjectRareData::~JSGlobalObjectRareData): Deleted.
+
+2014-04-25  Andreas Kling  <akling@apple.com>
+
+        Windows build fix attempt.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectRareData::~JSGlobalObjectRareData):
+
+2014-04-25  Mark Lam  <mark.lam@apple.com>
+
+        Refactor debugging code to use BreakpointActions instead of Vector<ScriptBreakpointAction>.
+        <https://webkit.org/b/132201>
+
+        Reviewed by Joseph Pecoraro.
+
+        BreakpointActions is Vector<ScriptBreakpointAction>.  Let's just consistently use
+        BreakpointActions everywhere.
+
+        * inspector/ScriptBreakpoint.h:
+        (Inspector::ScriptBreakpoint::ScriptBreakpoint):
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::setBreakpoint):
+        (Inspector::ScriptDebugServer::getActionsForBreakpoint):
+        * inspector/ScriptDebugServer.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::breakpointActionsFromProtocol):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::removeBreakpoint):
+        * inspector/agents/InspectorDebuggerAgent.h:
+
+2014-04-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG worklist scanning should not treat the key as a separate entity
+        https://bugs.webkit.org/show_bug.cgi?id=132167
+
+        Reviewed by Mark Hahnenberg.
+        
+        This simplifies the interface to the GC and will enable more optimizations.
+
+        * dfg/DFGCompilationKey.cpp:
+        (JSC::DFG::CompilationKey::visitChildren): Deleted.
+        * dfg/DFGCompilationKey.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::visitChildren):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::visitChildren):
+
+2014-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Remove unused parameter from codeblock linking function
+        https://bugs.webkit.org/show_bug.cgi?id=132199
+
+        Reviewed by Anders Carlsson.
+
+        No change in behaviour. This is just a small change to make it
+        slightly easier to reason about what the offsets in UnlinkedFunctionExecutable
+        actually mean.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::link):
+        * bytecode/UnlinkedCodeBlock.h:
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+
+2014-04-25  Andreas Kling  <akling@apple.com>
+
+        Mark some things with WTF_MAKE_FAST_ALLOCATED.
+        <https://webkit.org/b/132198>
+
+        Use FastMalloc for more things.
+
+        Reviewed by Anders Carlsson.
+
+        * builtins/BuiltinExecutables.h:
+        * heap/GCThreadSharedData.h:
+        * inspector/JSConsoleClient.h:
+        * inspector/agents/InspectorAgent.h:
+        * runtime/CodeCache.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        * runtime/WeakGCMap.h:
+
+2014-04-25  Antoine Quint  <graouts@webkit.org>
+
+        Implement Array.prototype.find()
+        https://bugs.webkit.org/show_bug.cgi?id=130966
+
+        Reviewed by Oliver Hunt.
+
+        Implement Array.prototype.find() and Array.prototype.findIndex() as proposed in the Harmony spec.
+
+        * builtins/Array.prototype.js:
+        (find):
+        (findIndex):
+        * runtime/ArrayPrototype.cpp:
+
+2014-04-24  Brady Eidson  <beidson@apple.com>
+
+        Rename "IMAGE_CONTROLS" feature to "SERVICE_CONTROLS"
+        https://bugs.webkit.org/show_bug.cgi?id=132155
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-04-24  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION: Apparent hang of PCE.js Mac OS System 7.0.1 on ARM64 devices
+        https://bugs.webkit.org/show_bug.cgi?id=132147
+
+        Reviewed by Mark Lam.
+
+        Fixed or64(), eor32( ) and eor64() to use "src" register when we have a valid logicalImm.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::or64):
+        (JSC::MacroAssemblerARM64::xor32):
+        (JSC::MacroAssemblerARM64::xor64):
+        * tests/stress/regress-132147.js: Added test.
+
+2014-04-24  Mark Lam  <mark.lam@apple.com>
+
+        Make slowPathAllocsBetweenGCs a runtime option.
+        <https://webkit.org/b/132137>
+
+        Reviewed by Mark Hahnenberg.
+
+        This will make it easier to more casually run tests with this configuration
+        as well as to reproduce issues (instead of requiring a code mod and rebuild).
+        We will now take --slowPathAllocsBetweenGCs=N where N is the number of
+        slow path allocations before we trigger a collection.
+
+        The option defaults to 0, which is reserved to mean that we will not trigger
+        any collections there.
+
+        * heap/Heap.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::doTestCollectionsIfNeeded):
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/MarkedAllocator.h:
+        * runtime/Options.h:
+
+2014-04-23  Mark Lam  <mark.lam@apple.com>
+
+        The GC should only resume compiler threads that it suspended in the same GC pass.
+        <https://webkit.org/b/132088>
+
+        Reviewed by Mark Hahnenberg.
+
+        Previously, this scenario can occur:
+        1. Thread 1 starts a GC and tries to suspend DFG worklist threads.  However,
+           no worklists were created yet at the that time.
+        2. Thread 2 starts to compile some functions and creates a DFG worklist, and
+           acquires the worklist thread's lock.
+        3. Thread 1's GC completes and tries to resume suspended DFG worklist thread.
+           This time, it sees the worklist created by Thread 2 and ends up unlocking
+           the worklist thread's lock that is supposedly held by Thread 2.
+        Thereafter, chaos ensues.
+
+        The fix is to cache the worklists that were actually suspended by each GC pass,
+        and only resume those when the GC is done.
+
+        This issue was discovered by enabling COLLECT_ON_EVERY_ALLOCATION and running
+        the fast/workers layout tests.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::visitCompilerWorklists):
+        (JSC::Heap::deleteAllCompiledCode):
+        (JSC::Heap::suspendCompilerThreads):
+        (JSC::Heap::resumeCompilerThreads):
+        * heap/Heap.h:
+
+2014-04-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Arguments::copyBackingStore needs to update m_registers in tandem with m_registerArray
+        https://bugs.webkit.org/show_bug.cgi?id=132079
+
+        Reviewed by Michael Saboff.
+
+        Since we're moving the register backing store, we don't want to leave a dangling pointer into a random CopiedBlock.
+
+        Also added a test that previously triggered this bug.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyBackingStore): D'oh!
+        * tests/stress/arguments-copy-register-array-backing-store.js: Added.
+        (foo):
+        (bar):
+
+2014-04-23  Mark Rowe  <mrowe@apple.com>
+
+        [Mac] REGRESSION (r164823): Building JavaScriptCore creates files under /tmp/JavaScriptCore.dst
+        <https://webkit.org/b/132053>
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Don't try to create a symlink at /usr/local/bin/jsc inside
+        the DSTROOT unless we're building to the deployment location. Also remove the unnecessary -x argument
+        from /bin/sh since that generates unnecessary output.
+
+2014-04-22  Mark Lam  <mark.lam@apple.com>
+
+        DFG::Worklist should acquire the m_lock before iterating DFG plans.
+        <https://webkit.org/b/132032>
+
+        Reviewed by Filip Pizlo.
+
+        Currently, there's a rightToRun mechanism that ensures that no compilation
+        threads are running when the GC is iterating through the DFG worklists.
+        However, this does not prevent a Worker thread from doing a DFG compilation
+        and modifying the plans in the worklists thereby invalidating the plan
+        iterator that the GC is using.  This patch fixes the issue by acquiring
+        the worklist m_lock before iterating the worklist plans.
+
+        This issue was uncovered by running the fast/workers layout tests with
+        COLLECT_ON_EVERY_ALLOCATION enabled.
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::isActiveForVM):
+        (JSC::DFG::Worklist::visitChildren):
+
+2014-04-22  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Support Python 2.7 in Cygwin
+        https://bugs.webkit.org/show_bug.cgi?id=132023
+
+        Reviewed by Michael Saboff.
+
+        * DerivedSources.make: Use a conditional variable to define
+        the path to Python/Perl.
+
+2014-04-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Switch the LLVMForJSC target to using the LLVM in /usr/local rather than /usr/local/LLVMForJavaScriptCore on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=130867
+        <rdar://problem/16432456> 
+
+        Reviewed by Mark Hahnenberg.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/LLVMForJSC.xcconfig:
+
+2014-04-22  Alex Christensen  <achristensen@webkit.org>
+
+        [Win] Unreviewed build fix after my r167666.
+
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
+        Added ../../../ again to include headers in Source/JavaScriptCore.
+
+2014-04-22  Alex Christensen  <achristensen@webkit.org>
+
+        Removed old stdbool and inttypes headers.
+        https://bugs.webkit.org/show_bug.cgi?id=131966
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
+        Removed references to os-win32 directory.
+        * os-win32: Removed.
+        * os-win32/inttypes.h: Removed.
+        * os-win32/stdbool.h: Removed.
+
+2014-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::clobberize() should honestly admit that profiler and debugger nodes are effectful
+        https://bugs.webkit.org/show_bug.cgi?id=131971
+        <rdar://problem/16676511>
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2014-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Switch statements that skip the baseline JIT should work
+        https://bugs.webkit.org/show_bug.cgi?id=131965
+
+        Reviewed by Mark Hahnenberg.
+
+        * bytecode/JumpTable.h:
+        (JSC::SimpleJumpTable::ensureCTITable):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_switch_char):
+        * tests/stress/inline-llint-with-switch.js: Added.
+        (foo):
+        (bar):
+        (test):
+
+2014-04-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Arguments objects shouldn't need a destructor
+        https://bugs.webkit.org/show_bug.cgi?id=131899
+
+        Reviewed by Oliver Hunt.
+
+        This patch rids Arguments objects of their destructors. It does this by 
+        switching their backing stores to use CopiedSpace rather than malloc memory.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateArguments): Fix the code emitted for inline
+        Arguments allocation so that it only emits an extra write for strict mode code rather
+        than unconditionally.
+        * heap/CopyToken.h: New CopyTokens for the two different types of Arguments backing stores.
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren): We need to tell the collector to copy the back stores now.
+        (JSC::Arguments::copyBackingStore): Do the actual copying of the backing stores.
+        (JSC::Arguments::deletePropertyByIndex): Update all the accesses to SlowArgumentData and m_registerArray.
+        (JSC::Arguments::deleteProperty):
+        (JSC::Arguments::defineOwnProperty):
+        (JSC::Arguments::allocateRegisterArray):
+        (JSC::Arguments::tearOff):
+        (JSC::Arguments::destroy): Deleted. We don't need the destructor any more.
+        * runtime/Arguments.h:
+        (JSC::Arguments::registerArraySizeInBytes):
+        (JSC::Arguments::SlowArgumentData::SlowArgumentData): Switch SlowArgumentData to being allocated
+        in CopiedSpace. Now the SlowArgumentData and its backing store are a single contiguous CopiedSpace
+        allocation.
+        (JSC::Arguments::SlowArgumentData::slowArguments):
+        (JSC::Arguments::SlowArgumentData::bytecodeToMachineCaptureOffset):
+        (JSC::Arguments::SlowArgumentData::setBytecodeToMachineCaptureOffset):
+        (JSC::Arguments::SlowArgumentData::sizeForNumArguments):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::allocateSlowArguments):
+        (JSC::Arguments::tryDeleteArgument):
+        (JSC::Arguments::isDeletedArgument):
+        (JSC::Arguments::isArgument):
+        (JSC::Arguments::argument):
+        (JSC::Arguments::finishCreation):
+        * runtime/SymbolTable.h:
+
+2014-04-21  Eric Carlson  <eric.carlson@apple.com>
+
+        [Mac] implement WebKitDataCue
+        https://bugs.webkit.org/show_bug.cgi?id=131799
+
+        Reviewed by Dean Jackson.
+
+        * Configurations/FeatureDefines.xcconfig: Define ENABLE_DATACUE_VALUE.
+
+2014-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed test gardening, run the repeat-out-of-bounds tests again.
+
+        * tests/stress/float32-repeat-out-of-bounds.js:
+        * tests/stress/int8-repeat-out-of-bounds.js:
+
+2014-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR exit should know about Int52 and Double constants
+        https://bugs.webkit.org/show_bug.cgi?id=131945
+
+        Reviewed by Oliver Hunt.
+        
+        The DFG OSR exit machinery's ignorance would lead to some constants becoming
+        jsUndefined() after OSR exit.
+        
+        The FTL OSR exit machinery's ignorance just meant that we would sometimes use a
+        stackmap constant rather than baking the constant into the OSRExit data structure.
+        So, not a big deal, but worth fixing.
+        
+        Also added some helpful hacks to jsc.cpp for testing such OSR exit pathologies.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        (JSC::DFG::MinifiedNode::hasConstantNumber):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::tryToSetConstantExitArgument):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionOtherFalse):
+        (functionUndefined):
+        * runtime/Intrinsic.h:
+        * tests/stress/fold-to-double-constant-then-exit.js: Added.
+        (foo):
+        * tests/stress/fold-to-int52-constant-then-exit.js: Added.
+        (foo):
+
+2014-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Provide feedback when we encounter an unrecognied node in the FTL backend.
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+
+2014-04-21  Andreas Kling  <akling@apple.com>
+
+        Move the JSString cache from DOMWrapperWorld to VM.
+        <https://webkit.org/b/131940>
+
+        Reviewed by Geoff Garen.
+
+        * runtime/VM.h:
+
+2014-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Take block execution count estimates into account when voting double
+        https://bugs.webkit.org/show_bug.cgi?id=131906
+
+        Reviewed by Geoffrey Garen.
+        
+        This was a drama in three acts.
+        
+        Act I: Slurp in BasicBlock::executionCount and use it as a weight when counting the
+            number of uses of a variable that want double or non-double. Easy as pie. This
+            gave me a huge speed-up on FloatMM and a huge slow-down on basically everything
+            else.
+        
+        Act II: Realize that there were some programs where our previous double voting was
+            just on the edge of disaster and making it more precise tipped it over. In
+            particular, if you had an integer variable that would infrequently be used in a
+            computation that resulted in a variable that was frequently used as an array index,
+            the outer infrequentness would be the thing we'd use in the vote. So, an array
+            index would become double. We fix this by reviving global backwards propagation
+            and introducing the concept of ReallyWantsInt, which is used just for array
+            indices. Any variable transitively flagged as ReallyWantsInt will never be forced
+            double. We need that flag to be separate from UsedAsInt, since UsedAsInt needs to
+            be set in bitops for RageConversion but using it for double forcing is too much.
+            Basically, it's cheaper to have to convert a double to an int for a bitop than it
+            is to convert a double to an int for an array index; also a variable being used as
+            an array index is a much stronger hint that it ought to be an int. This recovered
+            performance on everything except programs that used FTL OSR entry.
+        
+        Act III: Realize that OSR entrypoint creation creates blocks that have NaN execution
+            count, which then completely pollutes the weighting - essentially all votes go
+            NaN. Fix this with some surgical defenses. Basically, any client of execution
+            counts should allow for them to be NaN and shouldn't completely fall off a cliff
+            when it happens.
+        
+        This is awesome. 75% speed-up on FloatMM. 11% speed-up on audio-dft. This leads to
+        7% speed-up on AsmBench and 2% speed-up on Kraken.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::run):
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::voteNode):
+        (JSC::DFG::Graph::voteChildren):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        * dfg/DFGVariableAccessData.cpp: Added.
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::mergeIsCaptured):
+        (JSC::DFG::VariableAccessData::mergeShouldNeverUnbox):
+        (JSC::DFG::VariableAccessData::predict):
+        (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
+        (JSC::DFG::VariableAccessData::mergeDoubleFormatState):
+        (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
+        (JSC::DFG::VariableAccessData::flushFormat):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::vote):
+        (JSC::DFG::VariableAccessData::VariableAccessData): Deleted.
+        (JSC::DFG::VariableAccessData::mergeIsCaptured): Deleted.
+        (JSC::DFG::VariableAccessData::mergeShouldNeverUnbox): Deleted.
+        (JSC::DFG::VariableAccessData::predict): Deleted.
+        (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction): Deleted.
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): Deleted.
+        (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat): Deleted.
+        (JSC::DFG::VariableAccessData::mergeDoubleFormatState): Deleted.
+        (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat): Deleted.
+        (JSC::DFG::VariableAccessData::flushFormat): Deleted.
+
+2014-04-21  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r167591): ARM64 and ARM traditional builds broken
+        https://bugs.webkit.org/show_bug.cgi?id=131935
+
+        Reviewed by Mark Hahnenberg.
+
+        Added store8(TrustedImm32, MacroAssembler::Address) to the ARM traditional and ARM64
+        macro assemblers.  Added a new test for the original patch.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::store8):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::store8):
+        * tests/stress/dfg-create-arguments-inline-alloc.js: New test.
+
+2014-04-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Inline allocate Arguments objects in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=131897
+
+        Reviewed by Geoffrey Garen.
+
+        Many libraries/frameworks depend on the arguments object for overloaded API entry points. 
+        This is the first step to making Arguments fast(er). We'll duplicate the logic in Arguments::create 
+        for now and take the slow path for complicated cases like slow arguments, tearing off for strict mode, etc.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateArguments):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Arguments.h:
+        (JSC::Arguments::offsetOfActivation):
+        (JSC::Arguments::offsetOfOverrodeLength):
+        (JSC::Arguments::offsetOfIsStrictMode):
+        (JSC::Arguments::offsetOfRegisterArray):
+        (JSC::Arguments::offsetOfCallee):
+        (JSC::Arguments::allocationSize):
+
+2014-04-20  Andreas Kling  <akling@apple.com>
+
+        Speed up jsStringWithCache() through WeakGCMap inlining.
+        <https://webkit.org/b/131923>
+
+        Always inline WeakGCMap::add() but move the slow garbage collecting
+        path out-of-line.
+
+        Reviewed by Darin Adler.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::gcMap):
+
+2014-04-20  László Langó  <llango.u-szeged@partner.samsung.com>
+
+        JavaScriptCore: ARM build fix after r167094.
+        https://bugs.webkit.org/show_bug.cgi?id=131612
+
+        Reviewed by Michael Saboff.
+
+        After r167094 there are many build errors on ARM like these:
+
+            /tmp/ccgtHRno.s:370: Error: invalid constant (425a) after fixup
+            /tmp/ccgtHRno.s:374: Error: invalid constant (426e) after fixup
+            /tmp/ccgtHRno.s:378: Error: invalid constant (4282) after fixup
+            /tmp/ccgtHRno.s:382: Error: invalid constant (4296) after fixup
+
+        Problem is caused by the wrong generated assembly like:
+            "\tmov r2, (" LOCAL_LABEL_STRING(llint_op_strcat) " - " LOCAL_LABEL_STRING(relativePCBase) ")\n" // /home/webkit/WebKit/Source/JavaScriptCore/llint/LowLevelInterpreter.asm:741
+
+        `mov` can only move 8 bit immediate, but not every constant fit into 8 bit. Clang converts
+        the mov to a single movw or a movw and a movt, depending on the immediate, but binutils doesn't.
+        Add a new ARM specific offline assembler instruction (`mvlbl`) for the following llint_entry
+        use case: move rn, (label1-label2) which is translated to movw and movt.
+
+        * llint/LowLevelInterpreter.asm:
+        * offlineasm/arm.rb:
+        * offlineasm/instructions.rb:
+
+2014-04-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Unreviewed build fix after r167336.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchAdd32):
+
+2014-04-20  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r167501.
+        https://bugs.webkit.org/show_bug.cgi?id=131913
+
+        It broke DYEBench (Requested by mhahnenberg on #webkit).
+
+        Reverted changeset:
+
+        "Deleting properties poisons objects"
+        https://bugs.webkit.org/show_bug.cgi?id=131551
+        http://trac.webkit.org/changeset/167501
+
+2014-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be OK to store new fields into objects that have no prototypes
+        https://bugs.webkit.org/show_bug.cgi?id=131905
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::emitPrototypeChecks):
+        * tests/stress/put-by-id-transition-null-prototype.js: Added.
+        (foo):
+
+2014-04-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        Make the CSS JIT compile for ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=131834
+
+        Reviewed by Gavin Barraclough.
+
+        Extend the ARM64 MacroAssembler to support the code generation required by
+        the CSS JIT.
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::addPtrNoFlags):
+        (JSC::MacroAssemblerARM64::or32):
+        (JSC::MacroAssemblerARM64::branchPtr):
+        (JSC::MacroAssemblerARM64::test32):
+        (JSC::MacroAssemblerARM64::branch):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::test32):
+
+2014-04-19  Andreas Kling  <akling@apple.com>
+
+        Two little shortcuts to the JSType.
+        <https://webkit.org/b/131896>
+
+        Tweak two sites that take the long road through JSCell::structure()->typeInfo()
+        to look at data that's already in JSCell::type().
+
+        Reviewed by Darin Adler.
+
+        * runtime/NameInstance.h:
+        (JSC::isName):
+        * runtime/NumberPrototype.cpp:
+        (JSC::toThisNumber):
+
+2014-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it easier to check if an integer sum would overflow
+        https://bugs.webkit.org/show_bug.cgi?id=131900
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2014-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Address some feedback on https://bugs.webkit.org/show_bug.cgi?id=130684.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/JSString.h:
+        (JSC::JSRopeString::RopeBuilder::append):
+
+2014-04-18  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION(r164205): WebKit crash @StructureIDTable::get.
+        <https://webkit.org/b/130539>
+
+        Reviewed by Geoffrey Garen.
+
+        prepareOSREntry() prepares for OSR entry by first copying the local var
+        values from the baseline frame to a scartch buffer, which is then used
+        to fill in the locals in their new position in the DFG frame.  Unfortunately,
+        prepareOSREntry() was using the DFG frame's frameRegisterCount as the frame
+        size of the baseline frame.  As a result, some values of locals in the
+        baseline frame were not saved off, and the DFG frame may get initialized
+        with random content that happened to be in the uninitialized (and possibly
+        unallocated) portions of the scratch buffer.
+
+        The fix is to use OSREntryData::m_expectedValues.numberOfLocals() as the
+        number of locals in the baseline frame that we want to copy to the scratch
+        buffer.
+
+        Note: osrEntryThunkGenerator() is expecting the DFG frameRegisterCount
+        at offset 0 in the scratch buffer.  So, we continue to write that value
+        there, not the baseline frame size.
+
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+
+2014-04-18  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: Move InspectorProfilerAgent to JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=131673
+
+        Passes existing profiler and inspector tests.
+
+        Reviewed by Joseph Pecoraro.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/JSConsoleClient.cpp:
+        (Inspector::JSConsoleClient::JSConsoleClient):
+        (Inspector::JSConsoleClient::profile):
+        (Inspector::JSConsoleClient::profileEnd):
+        (Inspector::JSConsoleClient::count): Deleted.
+        * inspector/JSConsoleClient.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        * inspector/agents/InspectorProfilerAgent.cpp: Added.
+        (Inspector::InspectorProfilerAgent::InspectorProfilerAgent):
+        (Inspector::InspectorProfilerAgent::~InspectorProfilerAgent):
+        (Inspector::InspectorProfilerAgent::addProfile):
+        (Inspector::InspectorProfilerAgent::createProfileHeader):
+        (Inspector::InspectorProfilerAgent::enable):
+        (Inspector::InspectorProfilerAgent::disable):
+        (Inspector::InspectorProfilerAgent::getUserInitiatedProfileName):
+        (Inspector::InspectorProfilerAgent::getProfileHeaders):
+        (Inspector::buildInspectorObject):
+        (Inspector::InspectorProfilerAgent::buildProfileInspectorObject):
+        (Inspector::InspectorProfilerAgent::getCPUProfile):
+        (Inspector::InspectorProfilerAgent::removeProfile):
+        (Inspector::InspectorProfilerAgent::reset):
+        (Inspector::InspectorProfilerAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorProfilerAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorProfilerAgent::start):
+        (Inspector::InspectorProfilerAgent::stop):
+        (Inspector::InspectorProfilerAgent::setRecordingProfile):
+        (Inspector::InspectorProfilerAgent::startProfiling):
+        (Inspector::InspectorProfilerAgent::stopProfiling):
+        * inspector/agents/InspectorProfilerAgent.h: Added.
+        * inspector/agents/JSGlobalObjectProfilerAgent.cpp: Copied from Source/WebCore/inspector/ScriptProfile.idl.
+        (Inspector::JSGlobalObjectProfilerAgent::JSGlobalObjectProfilerAgent):
+        (Inspector::JSGlobalObjectProfilerAgent::profilingGlobalExecState):
+        * inspector/agents/JSGlobalObjectProfilerAgent.h: Copied from Source/WebCore/inspector/ScriptProfile.idl.
+        * inspector/protocol/Profiler.json: Renamed from Source/WebCore/inspector/protocol/Profiler.json.
+        * profiler/Profile.h:
+        * runtime/ConsoleClient.h:
+
+2014-04-18  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r167527.
+        https://bugs.webkit.org/show_bug.cgi?id=131883
+
+        Broke 32-bit build (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "[Mac] implement WebKitDataCue"
+        https://bugs.webkit.org/show_bug.cgi?id=131799
+        http://trac.webkit.org/changeset/167527
+
+2014-04-18  Eric Carlson  <eric.carlson@apple.com>
+
+        [Mac] implement WebKitDataCue
+        https://bugs.webkit.org/show_bug.cgi?id=131799
+
+        Reviewed by Dean Jackson.
+
+        * Configurations/FeatureDefines.xcconfig: Define ENABLE_DATACUE_VALUE.
+
+2014-04-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Actually address Mark's review feedback.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::handleExitCounts):
+
+2014-04-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Options::maximumExecutionCountsBetweenCheckpoints() should be higher for DFG->FTL tier-up but the same for other tier-ups
+        https://bugs.webkit.org/show_bug.cgi?id=131850
+
+        Reviewed by Mark Hahnenberg.
+        
+        Templatize ExecutionCounter to allow for two different styles of calculating the
+        checkpoint threshold.
+        
+        Appears to be a slight speed-up on DYEBench.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::llintExecuteCounter):
+        (JSC::CodeBlock::offsetOfJITExecuteCounter):
+        (JSC::CodeBlock::offsetOfJITExecutionActiveThreshold):
+        (JSC::CodeBlock::offsetOfJITExecutionTotalCount):
+        (JSC::CodeBlock::jitExecuteCounter):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter<countingVariant>::ExecutionCounter):
+        (JSC::ExecutionCounter<countingVariant>::forceSlowPathConcurrently):
+        (JSC::ExecutionCounter<countingVariant>::checkIfThresholdCrossedAndSet):
+        (JSC::ExecutionCounter<countingVariant>::setNewThreshold):
+        (JSC::ExecutionCounter<countingVariant>::deferIndefinitely):
+        (JSC::applyMemoryUsageHeuristics):
+        (JSC::applyMemoryUsageHeuristicsAndConvertToInt):
+        (JSC::ExecutionCounter<countingVariant>::hasCrossedThreshold):
+        (JSC::ExecutionCounter<countingVariant>::setThreshold):
+        (JSC::ExecutionCounter<countingVariant>::reset):
+        (JSC::ExecutionCounter<countingVariant>::dump):
+        (JSC::ExecutionCounter::ExecutionCounter): Deleted.
+        (JSC::ExecutionCounter::forceSlowPathConcurrently): Deleted.
+        (JSC::ExecutionCounter::checkIfThresholdCrossedAndSet): Deleted.
+        (JSC::ExecutionCounter::setNewThreshold): Deleted.
+        (JSC::ExecutionCounter::deferIndefinitely): Deleted.
+        (JSC::ExecutionCounter::applyMemoryUsageHeuristics): Deleted.
+        (JSC::ExecutionCounter::applyMemoryUsageHeuristicsAndConvertToInt): Deleted.
+        (JSC::ExecutionCounter::hasCrossedThreshold): Deleted.
+        (JSC::ExecutionCounter::setThreshold): Deleted.
+        (JSC::ExecutionCounter::reset): Deleted.
+        (JSC::ExecutionCounter::dump): Deleted.
+        * bytecode/ExecutionCounter.h:
+        (JSC::formattedTotalExecutionCount):
+        (JSC::ExecutionCounter::maximumExecutionCountsBetweenCheckpoints):
+        (JSC::ExecutionCounter::clippedThreshold):
+        (JSC::ExecutionCounter::formattedTotalCount): Deleted.
+        * dfg/DFGJITCode.h:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::handleExitCounts):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/Options.h:
+
+2014-04-17  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Deleting properties poisons objects
+        https://bugs.webkit.org/show_bug.cgi?id=131551
+
+        Reviewed by Geoffrey Garen.
+
+        This is ~3% progression on Dromaeo with a ~6% progression on the jslib portion of Dromaeo in particular.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap): We now re-use deleted properties when materializing the property map.
+        (JSC::Structure::removePropertyTransition): We allow up to 5 deletes for a particular path through the tree of 
+        Structure transitions. After that, we convert to an uncacheable dictionary like we used to. We don't cache 
+        delete transitions, but we allow transitioning from them.
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::pin): Now does only what it says it does--marks the property table as pinned.
+        (JSC::Structure::pinAndPreventTransitions): More descriptive version of what the old pin() was doing.
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::checkOffsetConsistency): Rearranged variables to be more sensible.
+
+2014-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        InlineCallFrameSet should be refcounted
+        https://bugs.webkit.org/show_bug.cgi?id=131829
+
+        Reviewed by Geoffrey Garen.
+        
+        And DFG::Plan should hold a ref to it. Previously it was owned by Graph until it
+        became owned by JITCode. Except that if we're "failing" to compile, JITCode may die.
+        Even as it dies, the GC may still want to scan the DFG::Plan, which leads to scanning
+        the DesiredWriteBarriers, which leads to scanning the InlineCallFrameSet.
+        
+        So, just make the darn thing refcounted.
+
+        * bytecode/InlineCallFrameSet.h:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::requiredRegisterCountForExit):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        * dfg/DFGPlan.h:
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * ftl/FTLFail.cpp:
+        (JSC::FTL::fail):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+
+2014-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL::fail() should manage memory "correctly"
+        https://bugs.webkit.org/show_bug.cgi?id=131823
+        <rdar://problem/16384297>
+
+        Reviewed by Oliver Hunt.
+
+        * ftl/FTLFail.cpp:
+        (JSC::FTL::fail):
+
+2014-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Prediction propagator should correctly model Int52s flowing through arguments
+        https://bugs.webkit.org/show_bug.cgi?id=131822
+        <rdar://problem/16641408>
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * tests/stress/int52-argument.js: Added.
+        (foo):
+        * tests/stress/int52-variable.js: Added.
+        (foo):
+
+2014-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints()) on jquery tests
+        https://bugs.webkit.org/show_bug.cgi?id=131798
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Some day, we will fix https://bugs.webkit.org/show_bug.cgi?id=131810 and some version
+        of this assertion can return. For now, it's not clear that the assertion is guarding
+        any truly undesirable behavior - so it should just go away and be replaced with a
+        FIXME.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * runtime/Structure.h:
+        (JSC::Structure::takesSlowPathInDFGForImpureProperty):
+
+2014-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Blind attempt to fix Windows build after r166837
+        <http://webkit.org/b/131246>
+
+        Hoping to fix this build error:
+
+            warning MSB8027: Two or more files with the name of GCLogging.cpp will produce outputs to the same location. This can lead to an incorrect build result.  The files involved are ..\heap\GCLogging.cpp, ..\heap\GCLogging.cpp.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Fix copy-paste
+        boo-boo by changing the GCLogging.cpp ClCompile entry to a
+        GCLogging.h ClInclude entry.
+
+2014-04-16  Filip Pizlo  <fpizlo@apple.com>
+
+        AI for GetLocal should match the DFG backend, and in this case, the best way to do that is to get rid of the "exit if empty prediction" thing since it's a vestige of a time long gone
+        https://bugs.webkit.org/show_bug.cgi?id=131764
+
+        Reviewed by Geoffrey Garen.
+        
+        The attached test case can be made to not crash by deleting old code. It used to be
+        the case that the DFG needed empty prediction guards, for shady reasons. We fixed that
+        long ago. At this point, these guards just make life difficult. So get rid of them.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * tests/stress/bug-131764.js: Added.
+        (test1):
+        (test2):
+
+2014-04-17  Darin Adler  <darin@apple.com>
+
+        Add separate flag for IndexedDatabase in workers since the current implementation is not threadsafe
+        https://bugs.webkit.org/show_bug.cgi?id=131785
+        rdar://problem/16003108
+
+        Reviewed by Brady Eidson.
+
+        * Configurations/FeatureDefines.xcconfig: Added INDEXED_DATABASE_IN_WORKERS.
+
+2014-04-16  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix after http://trac.webkit.org/changeset/167416 (Sink NaN sanitization)
+
+        * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculate):
+
+2014-04-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Extra error reporting for invalid value conversions
+        https://bugs.webkit.org/show_bug.cgi?id=131786
+
+        Rubber stamped by Ryosuke Niwa.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+
+2014-04-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Sink NaN sanitization to uses and remove it when it's unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=131419
+
+        Reviewed by Oliver Hunt.
+        
+        This moves NaN purification to stores that could see an impure NaN.
+        
+        5% speed-up on AsmBench, 50% speed-up on AsmBench/n-body. It is a regression on FloatMM
+        though, because of the other bug that causes that benchmark to box doubles in a loop.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt32SpeculationForArithmetic):
+        (JSC::isMachineIntSpeculationForArithmetic):
+        (JSC::isDoubleSpeculation):
+        (JSC::isDoubleSpeculationForArithmetic):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::fixTypeForRepresentation):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueRep):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileValueRep):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        * runtime/PureNaN.h:
+        * tests/stress/float32-array-nan-inlined.js: Added.
+        (foo):
+        (test):
+        * tests/stress/float32-array-nan.js: Added.
+        (foo):
+        (test):
+        * tests/stress/float64-array-nan-inlined.js: Added.
+        (foo):
+        (isBigEndian):
+        (test):
+        * tests/stress/float64-array-nan.js: Added.
+        (foo):
+        (isBigEndian):
+        (test):
+
+2014-04-16  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed Windows gardening. Restrict our new 'isinf' check
+        to 32-bit builds, and revise the comment to explain what we are
+        doing.
+
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isMachineInt): Provide motivation for the new
+        'isinf' check for our 32-bit code path.
+
+2014-04-16  Juergen Ributzka  <juergen@apple.com>
+
+        Allocate the data section on the heap again for FTL on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=130156
+
+        Reviewed by Geoffrey Garen and Filip Pizlo.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLDataSection.cpp:
+        (JSC::FTL::DataSection::DataSection):
+        (JSC::FTL::DataSection::~DataSection):
+        * ftl/FTLDataSection.h:
+
+2014-04-16  Mark Lam  <mark.lam@apple.com>
+
+        Crash in CodeBlock::setOptimizationThresholdBasedOnCompilationResult() when the debugger activates.
+        <https://webkit.org/b/131747>
+
+        Reviewed by Filip Pizlo.
+
+        When the debugger is about to activate (e.g. enter stepping mode), it first
+        waits for all DFG compilations to complete.  However, when the DFG completes,
+        if compilation is successful, it will install a new DFG codeBlock.  The
+        CodeBlock installation process is required to register codeBlocks with the
+        debugger.  Debugger::registerCodeBlock() will eventually call
+        CodeBlock::setSteppingMode() which may jettison the DFG codeBlock that we're
+        trying to install.  Thereafter, chaos ensues.
+
+        This jettison'ing only happens because the debugger currently set its
+        m_steppingMode flag before waiting for compilation to complete.  The fix is
+        simply to set that flag only after compilation is complete.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::registerCodeBlock):
+
+2014-04-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Discern between NaNs that would be safe to tag and NaNs that need some purification before tagging
+        https://bugs.webkit.org/show_bug.cgi?id=131420
+
+        Reviewed by Oliver Hunt.
+        
+        Rationalizes our handling of NaNs. We now have the notion of pureNaN(), or PNaN, which
+        replaces QNaN and represents a "safe" NaN for our tagging purposes. NaN purification now
+        goes through the purifyNaN() API.
+        
+        SpeculatedType and its clients can now distinguish between a PureNaN and an ImpureNaN.
+        
+        Prediction propagator is made slightly more cautious when dealing with NaNs. It doesn't
+        have to be too cautious since most prediction-based logic only cares about whether or not
+        a value could be an integer.
+        
+        AI is made much more cautious when dealing with NaNs. We don't yet introduce ImpureNaN
+        anywhere in the compiler, but when we do, we ought to be able to trust AI to propagate it
+        soundly and precisely.
+        
+        No performance change because this just unblocks
+        https://bugs.webkit.org/show_bug.cgi?id=131419.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeNumber):
+        (JSValueToNumber):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationFromValue):
+        (JSC::typeOfDoubleSum):
+        (JSC::typeOfDoubleDifference):
+        (JSC::typeOfDoubleProduct):
+        (JSC::polluteDouble):
+        (JSC::typeOfDoubleQuotient):
+        (JSC::typeOfDoubleMinMax):
+        (JSC::typeOfDoubleNegation):
+        (JSC::typeOfDoubleAbs):
+        (JSC::typeOfDoubleFRound):
+        (JSC::typeOfDoubleBinaryOp):
+        (JSC::typeOfDoubleUnaryOp):
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+        * dfg/DFGNode.h:
+        (JSC::DFG::BranchTarget::BranchTarget):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
+        (JSC::FTL::LowerDFGToLLVM::numberOrNotCellToInt32):
+        (JSC::FTL::LowerDFGToLLVM::allocateJSArray):
+        * ftl/FTLValueFormat.cpp:
+        (JSC::FTL::reboxAccordingToFormat):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::purifyNaN):
+        (JSC::AssemblyHelpers::sanitizeDouble): Deleted.
+        * jit/AssemblyHelpers.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceData::DateInstanceData):
+        (JSC::DateInstanceCache::reset):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::TerminatedExecutionError::defaultValue):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::sortVector):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toNumberSlowCase):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::jsNaN):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::getPrimitiveNumber):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        (JSC::jsStrDecimalLiteral):
+        (JSC::toDouble):
+        (JSC::jsToNumber):
+        (JSC::parseFloat):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::ensureLengthSlow):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        * runtime/PureNaN.h: Added.
+        (JSC::pureNaN):
+        (JSC::isImpureNaN):
+        (JSC::purifyNaN):
+        * runtime/TypedArrayAdaptors.h:
+        (JSC::FloatTypedArrayAdaptor::toJSValue):
+
+2014-04-16  Juergen Ributzka  <juergen@apple.com>
+
+        Enable system library calls in FTL for ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=130154
+
+        Reviewed by Geoffrey Garen and Filip Pizlo.
+
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleRem):
+        (JSC::FTL::Output::doubleSin):
+        (JSC::FTL::Output::doubleCos):
+
+2014-04-16  peavo@outlook.com  <peavo@outlook.com>
+
+        Fix JSC Debug Regressions on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=131182
+
+        Reviewed by Brent Fulgham.
+
+        The cast static_cast<int64_t>(number) in JSValue::isMachineInt() can generate a floating point error,
+        and set the st floating point register tags, if the value of the number parameter is infinite.
+        If the st floating point register tags are not cleared, this can cause strange floating point behavior later on.
+        This can be avoided by checking for infinity first.
+
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isMachineInt): Avoid floating point error by checking for infinity first.
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions): Re-enable jit for Windows.
+
+2014-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Simple ES6 feature:Array.prototype.fill
+        https://bugs.webkit.org/show_bug.cgi?id=131703
+
+        Reviewed by David Hyatt.
+
+        Add support for Array.prototype.fill
+
+        * builtins/Array.prototype.js:
+        (fill):
+        * runtime/ArrayPrototype.cpp:
+
+2014-04-16  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        [WebKit] Cleanup the build from uninitialized variable in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=131728
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::genericConvertDoubleToContiguous): Add a RELEASE_ASSERT on the 
+        path we expect to never take. Also shut up confused compilers about uninitialized things.
+
+2014-04-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, ARMv7 build fix after r167336.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchAdd32):
+
+2014-04-16  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Unreviewed, ARM64 buildfix after r167336.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branchAdd32): Add missing function.
+
+2014-04-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add the obvious thing that marks MakeRope as exiting since it can exit.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2014-04-15  Filip Pizlo  <fpizlo@apple.com>
+
+        compileMakeRope does not emit necessary bounds checks
+        https://bugs.webkit.org/show_bug.cgi?id=130684
+        <rdar://problem/16398388>
+
+        Reviewed by Oliver Hunt.
+        
+        Add string length bounds checks in a bunch of places. We should never allow a string
+        to have a length greater than 2^31-1 because it's not clear that the language has
+        semantics for it and because there is code that assumes that this cannot happen.
+        
+        Also add a bunch of tests to that effect to cover the various ways in which this was
+        previously allowed to happen.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileMakeRope):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::RopeBuilder::expand):
+        * runtime/JSString.h:
+        (JSC::JSString::create):
+        (JSC::JSRopeString::RopeBuilder::append):
+        (JSC::JSRopeString::RopeBuilder::release):
+        (JSC::JSRopeString::append):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsStringFromRegisterArray):
+        (JSC::jsStringFromArguments):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        * tests/stress/make-large-string-jit-strcat.js: Added.
+        (foo):
+        * tests/stress/make-large-string-jit.js: Added.
+        (foo):
+        * tests/stress/make-large-string-strcat.js: Added.
+        * tests/stress/make-large-string.js: Added.
+
+2014-04-15  Julien Brianceau  <jbriance@cisco.com>
+
+        Remove invalid sh4 specific code in JITInlines header.
+        https://bugs.webkit.org/show_bug.cgi?id=131692
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation): Prototype is not F_JITOperation_EJJZ
+        anymore since r160244, so the sh4 specific code is invalid now
+        and has to be removed.
+
+2014-04-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix precedence issue in JSCell:setRemembered
+
+        Rubber stamped by Filip Pizlo.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::setRemembered):
+
+2014-04-15  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Objective-C API external object graphs don't handle generational collection properly
+        https://bugs.webkit.org/show_bug.cgi?id=131634
+
+        Reviewed by Geoffrey Garen.
+
+        If the set of Objective-C objects transitively reachable through an object changes, we 
+        need to update the set of opaque roots accordingly. If we don't, the next EdenCollection 
+        won't rescan the external object graph, which would lead us to consider a newly allocated 
+        JSManagedValue to be dead.
+
+        * API/JSBase.cpp:
+        (JSSynchronousEdenCollectForDebugging):
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine initWithContextGroupRef:]):
+        (-[JSVirtualMachine dealloc]):
+        (-[JSVirtualMachine isOldExternalObject:]):
+        (-[JSVirtualMachine addExternalRememberedObject:]):
+        (-[JSVirtualMachine addManagedReference:withOwner:]):
+        (-[JSVirtualMachine removeManagedReference:withOwner:]):
+        (-[JSVirtualMachine externalRememberedSet]):
+        (scanExternalObjectGraph):
+        (scanExternalRememberedSet):
+        * API/JSVirtualMachineInternal.h:
+        * API/tests/testapi.mm:
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/Heap.h:
+        (JSC::Heap::slotVisitor):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::containsOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRootTriState):
+
+2014-04-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG IR should keep the data flow of doubles and int52's separate from the data flow of JSValue's
+        https://bugs.webkit.org/show_bug.cgi?id=131423
+
+        Reviewed by Geoffrey Garen.
+        
+        This introduces more static typing into DFG IR. Previously we just had the notion of
+        JSValues and Storage. This was weird because doubles weren't always convertible to
+        JSValues, and Int52s weren't always convertible to either doubles or JSValues. We would
+        sort of insert explicit conversion nodes just for the places where we knew that an
+        implicit conversion wouldn't have been possible -- but there was no hard and fast rule so
+        we'd get bugs from forgetting to do the right conversion.
+        
+        This patch introduces a hard and fast rule: doubles can never be implicitly converted to
+        anything but doubles, and likewise Int52's can never be implicitly converted. Conversion
+        nodes are used for all of the conversions. Int52Rep, DoubleRep, and ValueRep are the
+        conversions. They are like Identity but return the same value using a different
+        representation. Likewise, constants may now be represented using either JSConstant,
+        Int52Constant, or DoubleConstant. UseKinds have been adjusted accordingly, as well.
+        Int52RepUse and DoubleRepUse are node uses that mean "the node must be of Int52 (or
+        Double) type". They don't imply checks. There is also DoubleRepRealUse, which means that
+        we speculate DoubleReal and expect Double representation.
+        
+        In addition to simplifying a bunch of rules in the IR and making the IR more verifiable,
+        this also makes it easier to introduce optimizations in the future. It's now possible for
+        AI to model when/how conversion take place. For example if doing a conversion results in
+        NaN sanitization, then AI can model this and can allow us to sink sanitizations. That's
+        what https://bugs.webkit.org/show_bug.cgi?id=131419 will be all about.
+        
+        This was a big change, so I had to do some interesting things, like finally get rid of
+        the DFG's weird variadic template macro hacks and use real C++11 variadic templates. Also
+        the ByteCodeParser no longer emits Identity nodes since that was always pointless.
+        
+        No performance change because this mostly just rationalizes preexisting behavior.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86.h:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
+        (JSC::DFG::AbstractInterpreter::setConstant):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::fixTypeForRepresentation):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGBasicBlockInlines.h:
+        (JSC::DFG::BasicBlock::appendNode):
+        (JSC::DFG::BasicBlock::appendNonTerminal):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::constantCSE):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::CSEPhase::int32ToDoubleCSE): Deleted.
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::fixupBlock):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::willNotHaveCheck):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupGetAndSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        (JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
+        (JSC::DFG::FixupPhase::tryToRelaxRepresentation):
+        (JSC::DFG::FixupPhase::fixEdgeRepresentation):
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+        (JSC::DFG::FixupPhase::addRequiredPhantom):
+        (JSC::DFG::FixupPhase::addPhantomsIfNecessary):
+        (JSC::DFG::FixupPhase::clearPhantomsAtEnd):
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock): Deleted.
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::resultFor):
+        (JSC::DFG::useKindFor):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addNode):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertNode):
+        (JSC::DFG::InsertionSet::insertConstant):
+        (JSC::DFG::InsertionSet::insertConstantForUse):
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::insertAdd):
+        (JSC::DFG::IntegerCheckCombiningPhase::insertMustAdd):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToIdentity):
+        (WTF::printInternal):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::setResult):
+        (JSC::DFG::Node::result):
+        (JSC::DFG::Node::isConstant):
+        (JSC::DFG::Node::hasConstant):
+        (JSC::DFG::Node::convertToConstant):
+        (JSC::DFG::Node::valueOfJSConstant):
+        (JSC::DFG::Node::hasResult):
+        (JSC::DFG::Node::hasInt32Result):
+        (JSC::DFG::Node::hasInt52Result):
+        (JSC::DFG::Node::hasNumberResult):
+        (JSC::DFG::Node::hasDoubleResult):
+        (JSC::DFG::Node::hasJSResult):
+        (JSC::DFG::Node::hasBooleanResult):
+        (JSC::DFG::Node::hasStorageResult):
+        (JSC::DFG::Node::defaultUseKind):
+        (JSC::DFG::Node::defaultEdge):
+        (JSC::DFG::Node::convertToIdentity): Deleted.
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::canonicalResultRepresentation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGResurrectionForValidationPhase.cpp:
+        (JSC::DFG::ResurrectionForValidationPhase::run):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary):
+        (JSC::DFG::JSValueRegsTemporary::~JSValueRegsTemporary):
+        (JSC::DFG::JSValueRegsTemporary::regs):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+        (JSC::DFG::SpeculativeJIT::compileValueRep):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+        (JSC::DFG::SpeculativeJIT::speculateDoubleReal):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble): Deleted.
+        (JSC::DFG::SpeculativeJIT::speculateMachineInt): Deleted.
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::allocate):
+        (JSC::DFG::SpeculativeJIT::use):
+        (JSC::DFG::SpeculativeJIT::boxDouble):
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::jsValueResult):
+        (JSC::DFG::SpeculateInt52Operand::SpeculateInt52Operand):
+        (JSC::DFG::SpeculateStrictInt52Operand::SpeculateStrictInt52Operand):
+        (JSC::DFG::SpeculateWhicheverInt52Operand::SpeculateWhicheverInt52Operand):
+        (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::convertToDouble): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::convertToDouble): Deleted.
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::shouldNotHaveTypeCheck):
+        (JSC::DFG::mayHaveTypeCheck):
+        (JSC::DFG::isNumerical):
+        (JSC::DFG::isDouble):
+        (JSC::DFG::isCell):
+        (JSC::DFG::usesStructure):
+        (JSC::DFG::useKindForResult):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * dfg/DFGVariadicFunction.h: Removed.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::LowerDFGToLLVM::compileDoubleConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileInt52Constant):
+        (JSC::FTL::LowerDFGToLLVM::compileWeakJSConstant):
+        (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+        (JSC::FTL::LowerDFGToLLVM::compileValueRep):
+        (JSC::FTL::LowerDFGToLLVM::compileInt52Rep):
+        (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAbs):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compare):
+        (JSC::FTL::LowerDFGToLLVM::boolify):
+        (JSC::FTL::LowerDFGToLLVM::lowInt52):
+        (JSC::FTL::LowerDFGToLLVM::lowStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::lowWhicheverInt52):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::strictInt52ToDouble):
+        (JSC::FTL::LowerDFGToLLVM::jsValueToDouble):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateNumber):
+        (JSC::FTL::LowerDFGToLLVM::speculateDoubleReal):
+        (JSC::FTL::LowerDFGToLLVM::compileInt52ToValue): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::setInt52WithStrictValue): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::speculateRealNumber): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::speculateMachineInt): Deleted.
+        * ftl/FTLValueFormat.cpp:
+        (JSC::FTL::reboxAccordingToFormat):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::sanitizeDouble):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::boxDouble):
+
+2014-04-15  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r167199 and r167251.
+        https://bugs.webkit.org/show_bug.cgi?id=131678
+
+        Caused a DYEBench regression and does not seem to improve perf
+        on relevant websites (Requested by rniwa on #webkit).
+
+        Reverted changesets:
+
+        "Rewrite Function.bind as a builtin"
+        https://bugs.webkit.org/show_bug.cgi?id=131083
+        http://trac.webkit.org/changeset/167199
+
+        "Update test result"
+        http://trac.webkit.org/changeset/167251
+
+2014-04-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r167272.
+        https://bugs.webkit.org/show_bug.cgi?id=131666
+
+        Broke multiple tests (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Function.bind itself is too slow"
+        https://bugs.webkit.org/show_bug.cgi?id=131636
+        http://trac.webkit.org/changeset/167272
+
+2014-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        ASSERT when firing low memory warning
+        https://bugs.webkit.org/show_bug.cgi?id=131659
+
+        Reviewed by Mark Hahnenberg.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode): Allow deleteAllCompiledCode to be
+        called when no GC is happening because that is what we do when a low
+        memory warning fires, and it is harmless.
+
+2014-04-14  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        emit_op_put_by_id should not emit a write barrier that filters on value
+        https://bugs.webkit.org/show_bug.cgi?id=131654
+
+        Reviewed by Filip Pizlo.
+
+        The 32-bit implementation does this, and it can cause crashes if we later repatch the 
+        code to allocate and store new Butterflies.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier): We also weren't verifying that the base was a cell on 
+        32-bit if we were passed ShouldFilterBase. I also took the liberty of sinking the tag 
+        load down into the if statement so that we don't do it if we're not filtering on the value.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+
+2014-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Function.bind itself is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=131636
+
+        Reviewed by Geoffrey Garen.
+
+        Rather than forcing creation of an activation, we now store
+        bound function properties directly on the returned closure.
+        This is necessary to deal with code that creates many function
+        bindings, but does not call them very often.
+
+        This is a 60% speed up in the included js/regress test.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * builtins/Function.prototype.js:
+        (bind.bindingFunction):
+        (bind.else.switch.case.1.bindingFunction.bindingFunction.bindingFunction.boundOversizedCallThunk):
+        (bind.else.switch.case.1.bindingFunction):
+        (bind.else.switch.case.2.bindingFunction.bindingFunction.bindingFunction.boundOversizedCallThunk):
+        (bind.else.switch.case.2.bindingFunction):
+        (bind.else.switch.case.3.bindingFunction.bindingFunction.bindingFunction.boundOversizedCallThunk):
+        (bind.else.switch.case.3.bindingFunction):
+        (bind.else.switch.bindingFunction):
+        (bind):
+        (bind.else.switch.case.1.bindingFunction.oversizedCall): Deleted.
+        (bind.else.switch.case.2.bindingFunction.oversizedCall): Deleted.
+        (bind.else.switch.case.3.bindingFunction.oversizedCall): Deleted.
+        * runtime/CommonIdentifiers.h:
+
+2014-04-14  Julien Brianceau  <jbriance@cisco.com>
+
+        [sh4] Allow use of SubImmediates in LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=131608
+
+        Reviewed by Mark Lam.
+
+        Allow use of SubImmediates with const pool so the sh4 architecture can
+        share the arm path for setEntryAddress macro. It reduces architecture
+        specific code and lead to a more optimal generated code for sh4.
+
+        * llint/LowLevelInterpreter.asm:
+        * offlineasm/sh4.rb:
+
+2014-04-14  Andreas Kling  <akling@apple.com>
+
+        Array.prototype.concat should allocate output storage only once.
+        <https://webkit.org/b/131609>
+
+        Do a first pass across 'this' and any arguments to compute the
+        final size of the resulting array from Array.prototype.concat.
+        This avoids having to grow the output incrementally as we go.
+
+        This also includes two other micro-optimizations:
+
+        - Mark getProperty() with ALWAYS_INLINE.
+
+        - Use JSArray::length() instead of taking the generic property
+          lookup path when we know an argument is an Array.
+
+        My MBP says ~3% progression on Dromaeo/jslib-traverse-jquery.
+
+        Reviewed by Oliver & Darin.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::arrayProtoFuncConcat):
+
+2014-04-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r167249.
+        https://bugs.webkit.org/show_bug.cgi?id=131621
+
+        broke 3 tests on cloop (Requested by kling on #webkit).
+
+        Reverted changeset:
+
+        "Array.prototype.concat should allocate output storage only
+        once."
+        https://bugs.webkit.org/show_bug.cgi?id=131609
+        http://trac.webkit.org/changeset/167249
+
+2014-04-14  Alex Christensen  <achristensen@webkit.org>
+
+        Fixed potential integer truncation.
+        https://bugs.webkit.org/show_bug.cgi?id=131615
+
+        Reviewed by Darin Adler.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::fillNops):
+        Truncate the size_t to an unsigned after it is limited to 15 instead of before.
+
+2014-04-14  Andreas Kling  <akling@apple.com>
+
+        Array.prototype.concat should allocate output storage only once.
+        <https://webkit.org/b/131609>
+
+        Do a first pass across 'this' and any arguments to compute the
+        final size of the resulting array from Array.prototype.concat.
+        This avoids having to grow the output incrementally as we go.
+
+        This also includes two other micro-optimizations:
+
+        - Mark getProperty() with ALWAYS_INLINE.
+
+        - Use JSArray::length() instead of taking the generic property
+          lookup path when we know an argument is an Array.
+
+        My MBP says ~3% progression on Dromaeo/jslib-traverse-jquery.
+
+        Reviewed by Darin Adler.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::arrayProtoFuncConcat):
+
+2014-04-14  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Improve the call site of string comparison in some hot path
+        https://bugs.webkit.org/show_bug.cgi?id=131605
+
+        Reviewed by Darin Adler.
+
+        When resolved, the String of a JSString is never null. It can be empty but not null.
+        The null value is reserved for ropes but those would be resolved when getting the value.
+
+        Consequently, we should use the equal() operation that do not handle null values.
+        Using the StringImpl directly is already common in StringPrototype but it was not used here for some reason.
+
+        * jit/JITOperations.cpp:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::pureStrictEqual):
+
+2014-04-08  Oliver Hunt  <oliver@apple.com>
+
+        Rewrite Function.bind as a builtin
+        https://bugs.webkit.org/show_bug.cgi?id=131083
+
+        Reviewed by Geoffrey Garen.
+
+        This change removes the existing function.bind implementation
+        entirely so JSBoundFunction is no more.
+
+        Instead we just return a regular JS closure with a few
+        private properties hanging off it that allow us to perform
+        the necessary bound function fakery.  While most of this is
+        simple, a couple of key changes:
+
+        - The parser and lexer now directly track whether they're
+          parsing code for call or construct and convert the private
+          name @IsConstructor into TRUETOK or FALSETOK as appropriate.
+          This automatically gives us the ability to vary behaviour
+          from within the builtin. It also leaves a lot of headroom
+          for trivial future improvements.
+        - The instanceof operator now uses the prototypeForHasInstance
+          private name, and we have a helper function to ensure that
+          all objects that need to can update their magical 'prototype'
+          property pair correctly.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * builtins/Function.prototype.js:
+        (bind.bindingFunction):
+        (bind.else.bindingFunction):
+        (bind):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        * parser/Lexer.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncBind): Deleted.
+        * runtime/JSBoundFunction.cpp: Removed.
+        * runtime/JSBoundFunction.h: Removed.
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        (JSC::retrieveCallerFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncSetTypeErrorAccessor):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+
+2014-04-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Math.fround() should be an intrinsic
+        https://bugs.webkit.org/show_bug.cgi?id=131583
+
+        Reviewed by Geoffrey Garen.
+        
+        Makes programs that use Math.fround() run up to 6x faster.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithFRound):
+        * runtime/Intrinsic.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+
+2014-04-12  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should use stackmap register liveness
+        https://bugs.webkit.org/show_bug.cgi?id=130791
+
+        Reviewed by Goeffrey Garen.
+        
+        Enable the stackmap register liveness support by fixing the two last bugs:
+        
+        - If everything is dead after the patchpoint - a good possibility for a put_by_id -
+          then we shouldn't crash due to a null scratch buffer.
+        
+        - Always consider callee-saves as if they were live. More precisely, we should
+          consider those callee-saves that are not saved by the enclosing function to be live.
+          For now we do the much simpler thing and consider callee-saves to be always live
+          since it has minimal impact on the scratch register allocator. It will know not to
+          preserve those for calls, anyway.
+        
+        I tried writing a test for the null scratch buffer thing, but failed. I will land the
+        test anyway since it seems useful.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::usedRegistersFor):
+        * jit/ScratchRegisterAllocator.cpp:
+        (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall):
+        (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall):
+        * runtime/Options.h:
+        * tests/stress/repeated-put-by-id-reallocating-transition.js: Added.
+        (foo):
+
+2014-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::FixupPhase should insert conversion nodes after the rest of fixup so that we know how the types settled
+        https://bugs.webkit.org/show_bug.cgi?id=131424
+
+        Reviewed by Geoffrey Garen.
+        
+        This defers type conversion injection until we've decided on types. This makes the
+        process of deciding types a bit more flexible - for example we can naturally fixpoint
+        and change our minds. Only when things are settled do we actually insert conversions.
+        
+        This is a necessary prerequisite for keeping double, int52, and JSValue data flow
+        separate. A SetLocal/GetLocal will appear to be JSValue until we fixpoint and realize
+        that there are typed uses. If we were eagerly inserting type conversions then we would
+        first insert a to/from-JSValue conversion in some cases only to then replace it by
+        the other conversions. It's probably trivial to remove those redundant conversions later
+        but I think it's better if we don't insert them to begin with.
+
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::operator!):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::fixupBlock):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::fixEdge):
+        (JSC::DFG::FixupPhase::fixIntEdge):
+        (JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+        (JSC::DFG::FixupPhase::addRequiredPhantom):
+        (JSC::DFG::FixupPhase::addPhantomsIfNecessary):
+        (JSC::DFG::FixupPhase::clearPhantomsAtEnd):
+        (JSC::DFG::FixupPhase::observeUntypedEdge): Deleted.
+        (JSC::DFG::FixupPhase::fixupUntypedSetLocalsInBlock): Deleted.
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode): Deleted.
+
+2014-04-11  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: code generator should consider enclosing class when computing duplicate type names
+        https://bugs.webkit.org/show_bug.cgi?id=131554
+
+        Reviewed by Timothy Hatcher.
+
+        We need to prepend an enum's enclosing class, if any, so that multiple enums with the same name
+        can coexist without triggering a "duplicate types" error. Now, such enums must be referenced
+        by the enclosing class and enum name.
+
+        Added tests for the new syntax, and rebaselined one test to reflect a previous patch's change.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Type.type_name): Prepend the enclosing class name.
+        (Type.type_name.is):
+        * replay/scripts/tests/expected/fail-on-duplicate-enum-type.json-error: Added.
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp: Added.
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h: Added.
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h: Rebaseline.
+        * replay/scripts/tests/fail-on-duplicate-enum-type.json: Added.
+        * replay/scripts/tests/generate-enums-with-same-base-name.json: Added.
+
+2014-04-11  Gavin Barraclough  <baraclough@apple.com>
+
+        Rollout - Rewrite Function.bind as a builtin
+        https://bugs.webkit.org/show_bug.cgi?id=131083
+
+        Unreviewed.
+
+        Rolling out r167020 while investigating a performance regression.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * builtins/Function.prototype.js:
+        (apply):
+        (bind.bindingFunction): Deleted.
+        (bind.else.bindingFunction): Deleted.
+        (bind): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        * parser/Lexer.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * runtime/ArgumentsIteratorConstructor.cpp:
+        (JSC::ArgumentsIteratorConstructor::finishCreation):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::finishCreation):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::finishCreation):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::finishCreation):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncBind):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::finishCreation):
+        * runtime/JSBoundFunction.cpp: Added.
+        (JSC::boundFunctionCall):
+        (JSC::boundFunctionConstruct):
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::destroy):
+        (JSC::JSBoundFunction::customHasInstance):
+        (JSC::JSBoundFunction::JSBoundFunction):
+        (JSC::JSBoundFunction::finishCreation):
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSBoundFunction.h: Added.
+        (JSC::JSBoundFunction::targetFunction):
+        (JSC::JSBoundFunction::boundThis):
+        (JSC::JSBoundFunction::boundArgs):
+        (JSC::JSBoundFunction::createStructure):
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        (JSC::retrieveCallerFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncSetTypeErrorAccessor): Deleted.
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectPrototypeProperty): Deleted.
+        (JSC::JSObject::putDirectPrototypePropertyWithoutTransitions): Deleted.
+        * runtime/JSObject.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::finishCreation):
+        * runtime/MapConstructor.cpp:
+        (JSC::MapConstructor::finishCreation):
+        * runtime/MapIteratorConstructor.cpp:
+        (JSC::MapIteratorConstructor::finishCreation):
+        * runtime/NameConstructor.cpp:
+        (JSC::NameConstructor::finishCreation):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::finishCreation):
+        * runtime/SetConstructor.cpp:
+        (JSC::SetConstructor::finishCreation):
+        * runtime/SetIteratorConstructor.cpp:
+        (JSC::SetIteratorConstructor::finishCreation):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::finishCreation):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::WeakMapConstructor::finishCreation):
+
+2014-04-11  David Kilzer  <ddkilzer@apple.com>
+
+        [ASan] Build broke because libCompileRuntimeToLLVMIR.a links to libclang_rt.asan_osx_dynamic.dylib
+        <http://webkit.org/b/131556>
+        <rdar://problem/16591856>
+
+        Reviewed by Brent Fulgham.
+
+        * Configurations/CompileRuntimeToLLVMIR.xcconfig: Clear
+        OTHER_LDFLAGS so the ASan build does not try to link to
+        libclang_rt.asan_osx_dynamic.dylib.
+
+2014-04-11  Mark Lam  <mark.lam@apple.com>
+
+        JSMainThreadExecState::call() should clear exceptions before returning.
+        <https://webkit.org/b/131530>
+
+        Reviewed by Geoffrey Garen.
+
+        Added a version of JSC::call() that return any uncaught exception instead
+        of leaving it pending in the VM.
+
+        As part of this change, I updated various parts of the code base to use the
+        new API as needed.
+
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptFunctionCall::call):
+        - ScriptFunctionCall::call() is only used by the inspector to inject scripts.
+          The injected scripts that will include Inspector scripts that should catch
+          and handle any exceptions that were thrown.  We should not be seeing any
+          exceptions returned from this call.  However, we do have checks for
+          exceptions in case there are bugs in the Inspector scripts which allowed
+          the exception to leak through.  Hence, it is proper to clear the exception
+          here, and only record the fact that an exception was seen (if present).
+
+        * bindings/ScriptFunctionCall.h:
+        * inspector/InspectorEnvironment.h:
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+
+2014-04-11  Oliver Hunt  <oliver@apple.com>
+
+        Add BuiltinLog function to make debugging builtins easier
+        https://bugs.webkit.org/show_bug.cgi?id=131550
+
+        Reviewed by Andreas Kling.
+
+        Add a logging function that builtins can use for debugging.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncBuiltinLog):
+        * runtime/JSGlobalObjectFunctions.h:
+
+2014-04-11  Julien Brianceau  <jbriance@cisco.com>
+
+        Fix LLInt for sh4 architecture (broken since C stack merge).
+        https://bugs.webkit.org/show_bug.cgi?id=131532
+
+        Reviewed by Mark Lam.
+
+        This patch fixes build and also implements sh4 parts for initPCRelative and
+        setEntryAddress macros introduced in http://trac.webkit.org/changeset/167094.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * offlineasm/instructions.rb:
+        * offlineasm/sh4.rb:
+
+2014-04-10  Michael Saboff  <msaboff@apple.com>
+
+        Crash beneath DFG JIT code @ video.disney.com
+        https://bugs.webkit.org/show_bug.cgi?id=131447
+
+        Reviewed by Geoffrey Garen.
+
+        The 32-bit path of speculateMisc() uses an 'is not int32' check followed by
+        'tag not less than Undefined' check.  The first check was incorrectly elided if we
+        knew that the value *was* an int32, when it should have been elided if we already
+        knew that the value *was not* an int32.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateMisc):
+        * tests/stress/test-spec-misc.js: Added test.
+        (getX):
+        (foo):
+        (bar):
+
+2014-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Make room for additional types in SpeculatedType.h
+        https://bugs.webkit.org/show_bug.cgi?id=131422
+
+        Reviewed by Sam Weinig.
+        
+        This'll make it easier to add DoubleHeavyNaN and DoubleEmptyNaN.
+
+        * bytecode/SpeculatedType.h:
+
+2014-04-10  Alex Christensen  <achristensen@webkit.org>
+
+        Compile fix for Win64.
+        https://bugs.webkit.org/show_bug.cgi?id=131508
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::fillNops):
+        Added unsigned template parameter to distinguish between size_t and unsigned long.
+
+2014-04-10  Michael Saboff  <msaboff@apple.com>
+
+        LLInt interpreter code should be generated as part of one function
+        https://bugs.webkit.org/show_bug.cgi?id=131205
+
+        Reviewed by Mark Lam.
+
+        Changed the generation of llint opcodes so that they are all part of the same
+        global function, llint_entry.  That function is used to fill in an entry point
+        table that includes each of the opcodes and helpers.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added appropriate use of new -I option to offline assembler and offset
+        generator scripts.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter.h:
+        * offlineasm/arm.rb:
+        * offlineasm/arm64.rb:
+        * offlineasm/asm.rb:
+        * offlineasm/ast.rb:
+        * offlineasm/backends.rb:
+        * offlineasm/cloop.rb:
+        * offlineasm/generate_offset_extractor.rb:
+        * offlineasm/instructions.rb:
+        * offlineasm/parser.rb:
+        * offlineasm/registers.rb:
+        * offlineasm/self_hash.rb:
+        * offlineasm/settings.rb:
+        * offlineasm/transform.rb:
+        * offlineasm/x86.rb:
+        Added a new "global" keyword to the offline assembler that denotes a label that
+        should be exported.  Added opcode and operand support to get the absolute
+        address of a local label using position independent calculations.  Updated the
+        offline assembler to handle included files, both when generating the checksum
+        as well as including files from other than the local directory via a newly
+        added -I option.  The offline assembler now automatically determines external
+        functions by keeping track of referenced functions that are defined within the
+        assembly source.  This is used both for choosing the correct macro for external
+        references as well as generating the needed EXTERN directives for masm.
+        Updated the generation of the masm only .sym file to be written once at the end
+        of the offline assembler.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITStubs.h:
+        * llint/LLIntCLoop.cpp:
+        (JSC::LLInt::initialize):
+        * llint/LLIntData.h:
+        (JSC::LLInt::getCodeFunctionPtr):
+        (JSC::LLInt::getOpcode): Deleted.
+        (JSC::LLInt::getCodePtr): Deleted.
+        * llint/LLIntOpcode.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::functionForCallEntryThunkGenerator):
+        (JSC::LLInt::functionForConstructEntryThunkGenerator):
+        (JSC::LLInt::functionForCallArityCheckThunkGenerator):
+        (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
+        (JSC::LLInt::evalEntryThunkGenerator):
+        (JSC::LLInt::programEntryThunkGenerator):
+        * llint/LLIntThunks.h:
+        Changed references to llint helpers to go through the entry point table populated
+        by llint_entry.  Added helpers to OpcodeID enum for all builds.
+
+        * bytecode/BytecodeList.json:
+        * generate-bytecode-files:
+        * llint/LLIntCLoop.cpp:
+        (JSC::LLInt::CLoop::initialize):
+        Reordered sections to match the order that the functions are added to the entry point
+        table.  Added new "asmPrefix" property for symbols that have one name but are generated
+        with a prefix, e.g. op_enter -> llint_op_enter.  Eliminated the "emitDefineID" property
+        as we are using enums for all bytecode references.  Changed the C Loop only
+        llint_c_loop_init to llint_entry.
+
+2014-04-10  Matthew Mirman  <mmirman@apple.com>
+
+        WIP for inlining C++.  Added a build target to produce LLVM IR.
+        https://bugs.webkit.org/show_bug.cgi?id=130523
+
+        Reviewed by Mark Rowe.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * build-symbol-table-index.py: Added.
+        * build-symbol-table-index.sh: Added.
+        * Configurations/CompileRuntimeToLLVMIR.xcconfig: Added.
+        * copy-llvm-ir-to-derived-sources.sh: Added.
+
+2014-04-10  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: memoize plugin data for navigator.mimeTypes and navigator.plugins
+        https://bugs.webkit.org/show_bug.cgi?id=131341
+
+        Reviewed by Timothy Hatcher.
+
+        Add support for encoding/decoding unsigned long with EncodedValue.
+        It is a distinct type from uint32_t and uint64_t.
+
+        * replay/EncodedValue.cpp:
+        (JSC::EncodedValue::convertTo<unsigned long>):
+        * replay/EncodedValue.h:
+
+2014-04-10  Mark Lam  <mark.lam@apple.com>
+
+        LLINT loadisFromInstruction should handle the big endian case.
+        <https://webkit.org/b/131495>
+
+        Reviewed by Mark Hahnenberg.
+
+        The LLINT loadisFromInstruction macro aims to load the least significant
+        32-bit word from the 64-bit bytecode instruction stream and sign extend
+        it.  For big endian machines, the current implementation would load the
+        wrong 32-bit word.
+
+        Without this fix, the JSC tests will crash on big endian machines.
+        Thanks to Tomas Popela for diagnosing this issue.
+
+        * llint/LowLevelInterpreter.asm:
+
+2014-04-09  Mark Lam  <mark.lam@apple.com>
+
+        Temporarily disable the JIT for the Windows port.
+        <https://webkit.org/b/131470>
+
+        Reviewed by Brent Fulgham.
+
+        This is a temporary stop gap measure to green the Windows bots until
+        we have a fix for https://webkit.org/b/131182.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2014-04-09  Juergen Ributzka  <juergen@apple.com>
+
+        [FTL] Emit multibyte NOPs on X86-64
+        https://bugs.webkit.org/show_bug.cgi?id=131394
+
+        Reviewed by Michael Saboff.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::fillNops):
+
+2014-04-09  Julien Brianceau  <jbriance@cisco.com>
+
+        Get rid of JITOperationWrappers.h header file.
+        https://bugs.webkit.org/show_bug.cgi?id=131450
+
+        Reviewed by Michael Saboff.
+
+        JITOperationWrappers header file contains architecture specific code that is
+        not needed anymore, so get rid of it.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperationWrappers.h: Removed.
+        * jit/JITOperations.cpp:
+
+2014-04-09  Mark Lam  <mark.lam@apple.com>
+
+        Ensure that LLINT accessing of the ProtoCallFrame is big endian friendly.
+        <https://webkit.org/b/131449>
+
+        Reviewed by Mark Hahnenberg.
+
+        Change ProtoCallFrame::paddedArgCount to be of type uint32_t.  The argCount
+        that it pads is of type int anyway.  It doesn't need to be 64 bit.  This
+        also makes it work with the LLINT which is loading it with a loadi
+        instruction.
+
+        We should add the PayLoadOffset to ProtoCallFrame::argCountAndCodeOriginValue
+        when loading the argCount.
+
+        The paddedArgCount issue was causing failures when running the JSC tests on a
+        64-bit big endian machine.  In this case, the paddedArgCount in the
+        ProtoCallFrame has the value 2.  However, because the paddedArgCount was stored
+        as a 64-bit size_t and the LLINT was loading only the low address 32-bits of
+        that field, the LLINT got a value of 0 instead of the expected 2.  With this
+        patch, we now have a matching store and load of a 32-bit value, and endianness
+        no longer comes into play.
+
+        As for ProtoCallFrame::argCountAndCodeOriginValue, the argCount is stored in
+        the payload field of the Register.  In the definition of EncodedValueDescriptor,
+        We already ensure that that the payload is in the least significant 32-bits for
+        little endian machines, and in the most significant 32-bits for big endian
+        machines.  This means that there is no endianness bug when loading this value
+        using loadi.  However, adding the PayLoadOffset clarifies the intent of the
+        code to load the payload part of the Register value.
+
+        * interpreter/ProtoCallFrame.h:
+        (JSC::ProtoCallFrame::setPaddedArgCount):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-04-08  Oliver Hunt  <oliver@apple.com>
+
+        Rewrite Function.bind as a builtin
+        https://bugs.webkit.org/show_bug.cgi?id=131083
+
+        Reviewed by Geoffrey Garen.
+
+        This change removes the existing function.bind implementation
+        entirely so JSBoundFunction is no more.
+
+        Instead we just return a regular JS closure with a few
+        private properties hanging off it that allow us to perform
+        the necessary bound function fakery.  While most of this is
+        simple, a couple of key changes:
+
+        - The parser and lexer now directly track whether they're
+          parsing code for call or construct and convert the private
+          name @IsConstructor into TRUETOK or FALSETOK as appropriate.
+          This automatically gives us the ability to vary behaviour
+          from within the builtin. It also leaves a lot of headroom
+          for trivial future improvements.
+        - The instanceof operator now uses the prototypeForHasInstance
+          private name, and we have a helper function to ensure that
+          all objects that need to can update their magical 'prototype'
+          property pair correctly.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * builtins/Function.prototype.js:
+        (bind.bindingFunction):
+        (bind.else.bindingFunction):
+        (bind):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        * parser/Lexer.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncBind): Deleted.
+        * runtime/JSBoundFunction.cpp: Removed.
+        * runtime/JSBoundFunction.h: Removed.
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        (JSC::retrieveCallerFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncSetTypeErrorAccessor):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+
+2014-04-08  Jon Lee  <jonlee@apple.com>
+
+        Turn MSE on by default
+        https://bugs.webkit.org/show_bug.cgi?id=131313
+        <rdar://problem/16525223>
+
+        Reviewed by Jer Noble.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-04-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Prevent deadlocks receiving WIRPermissionDenied message
+        https://bugs.webkit.org/show_bug.cgi?id=131406
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::stop):
+        (Inspector::RemoteInspector::stopInternal):
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        Provide a way to stop externally and a path to stop when in
+        the middle of handling a message already with the locked mutex.
+
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::close):
+        (Inspector::RemoteInspectorXPCConnection::closeFromMessage):
+        Provide a way to close externally and a path to close when in
+        the middle of handling a message already with a mutex.
+
+2014-04-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Address stale FIXMEs concerning console in JSContext inspection
+        https://bugs.webkit.org/show_bug.cgi?id=131398
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        The console object can be deleted from a page or JSContext,
+        so keep code that expects that it could have been deleted
+        to be resilient in those cases.
+
+        * inspector/JSGlobalObjectScriptDebugServer.h:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        Change the FIXMEs to NOTEs that explain why these functions
+        have empty implementations for JSContext inspection.
+
+2014-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix a goofy assertion to fix debug.
+
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::isSetter):
+        (JSC::PutByIdAccess::oldStructure):
+        (JSC::PutByIdAccess::chain):
+        (JSC::PutByIdAccess::stubRoutine):
+        (JSC::PutByIdAccess::customSetter):
+
+2014-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Fail silently if the LLVM dylib isn't found
+        https://bugs.webkit.org/show_bug.cgi?id=131385
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * llvm/InitializeLLVM.cpp:
+        (JSC::initializeLLVM):
+        * llvm/InitializeLLVM.h:
+        * llvm/InitializeLLVMPOSIX.cpp:
+        (JSC::initializeLLVMPOSIX):
+
+2014-04-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Repatch should support setters and plant calls to them directly
+        https://bugs.webkit.org/show_bug.cgi?id=130750
+
+        Reviewed by Geoffrey Garen.
+        
+        All of the infrastructure was in place so this just enables setter optimization.
+        
+        This is a 12x speed-up on setter microbenchmarks. This is a 1% speed-up on Octane.
+
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::visitWeak):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::setter):
+        (JSC::PutByIdAccess::customSetter): Deleted.
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * jit/Repatch.cpp:
+        (JSC::toString):
+        (JSC::kindFor):
+        (JSC::customFor):
+        (JSC::generateByIdStub):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setCacheableSetter):
+        (JSC::PutPropertySlot::isCacheableSetter):
+        (JSC::PutPropertySlot::isCacheableCustom):
+        (JSC::PutPropertySlot::setCacheableCustomProperty): Deleted.
+        (JSC::PutPropertySlot::isCacheableCustomProperty): Deleted.
+        * tests/stress/setter.js: Added.
+        (foo):
+
+2014-04-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Setters are just getters that take an extra argument and don't return a value
+        https://bugs.webkit.org/show_bug.cgi?id=131336
+
+        Reviewed by Geoffrey Garen.
+        
+        Other than that, they're totally the same thing.
+        
+        This isn't as dumb as it sounds.        
+
+        Most of the work in calling an accessor has to do with emitting the necessary checks for
+        figuring out whether we're calling the accessor we expected, followed by the boilerplate
+        needed for setting up a call inside of a stub. It makes sense for the code to be totally
+        common.
+
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::storeValue):
+        (JSC::AssemblyHelpers::moveTrustedValue):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupResults):
+        * jit/Repatch.cpp:
+        (JSC::kindFor):
+        (JSC::customFor):
+        (JSC::generateByIdStub):
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::generateGetByIdStub): Deleted.
+        (JSC::emitCustomSetterStub): Deleted.
+        * runtime/JSCJSValue.h:
+        (JSC::JSValue::asValue):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::cachedOffset):
+
+2014-04-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Hang in debuggable application after receiving WIRPermissionDenied
+        https://bugs.webkit.org/show_bug.cgi?id=131321
+
+        Reviewed by Mark Rowe.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        Avoid attempting to take the same lock twice. Move the received message
+        lock grab after the WIRPermissionDenied branch, which takes the lock
+        inside RemoteInspector::stop.
+
+2014-04-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it possible to disable some of the FTL's more interesting features
+        https://bugs.webkit.org/show_bug.cgi?id=131312
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::parse):
+        * runtime/Options.h:
+
+2014-04-04  Mark Lam  <mark.lam@apple.com>
+
+        Date object needs to check for ES5 15.9.1.14 TimeClip limit.
+        <https://webkit.org/b/131248>
+
+        Reviewed by Mark Hahnenberg.
+
+        The current Date object code does not adequately check for the ES5
+        15.9.1.14 TimeClip limit.  As a result, some calculations can underflow
+        / overflow and produce unexpected results.
+
+        For example, we were getting an assertion failure in
+        WTF::equivalentYearForDST() due int underflows in this function, which
+        in turn were due to an int overflow in WTF::msToYear().
+
+        This patch adds the needed checks, and adds some assertions to ensure
+        that the used values are sane.
+
+        The changes have no noticeable impact on benchmark results.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        * runtime/JSDateMath.cpp:
+        (JSC::localTimeOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        (JSC::parseDate):
+        * runtime/JSDateMath.h:
+        - parseDateFromNullTerminatedCharacters() does not need to be public.
+          Made it a static function.
+        * runtime/VM.cpp:
+        (JSC::VM::resetDateCache):
+        - Changed cachedDateStringValue to use std::numeric_limits<double>::quiet_NaN()
+          to be consistent with other Date code.
+
+2014-04-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed speculative 32-bit buildfix after r166837.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::updateObjectCounts):
+
+2014-04-06  Dan Bernstein  <mitz@apple.com>
+
+        32-bit build fix.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setInputCursor):
+
+2014-04-04  Brian J. Burg  <burg@cs.washington.edu>
+
+        Enable WEB_REPLAY for PLATFORM(MAC)
+        https://bugs.webkit.org/show_bug.cgi?id=130700
+
+        Reviewed by Timothy Hatcher.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-04-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add missing files from r166837
+
+        * heap/GCLogging.cpp: Added.
+        (JSC::GCLogging::levelAsString):
+        (JSC::LoggingFunctor::LoggingFunctor):
+        (JSC::LoggingFunctor::~LoggingFunctor):
+        (JSC::LoggingFunctor::operator()):
+        (JSC::LoggingFunctor::log):
+        (JSC::LoggingFunctor::reviveCells):
+        (JSC::LoggingFunctor::returnValue):
+        (JSC::GCLogging::dumpObjectGraph):
+        * heap/GCLogging.h: Added.
+
+2014-04-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Enhanced GC logging
+        https://bugs.webkit.org/show_bug.cgi?id=131246
+
+        Reviewed by Geoff Garen.
+
+        Getting data on the state of the JSC Heap at runtime is currently in a sad state. 
+        The OBJECT_MARK_LOGGING macro enables some basic GC logging, but it requires a full 
+        recompile to turn it on. It would be nice if we could runtime enable our GC logging 
+        infrastructure while incurring minimal cost when it is disabled. 
+
+        It would also be nice to get a complete view of the Heap. Currently OBJECT_MARK_LOGGING 
+        provides us with the discovered roots along with parent-child relationships as objects 
+        are scanned. However, once an object is scanned it will never be declared as the child 
+        of another object during that collection. This gives us a tree-like view of the 
+        Heap (i.e. each scanned node only reports having a single parent), where the actual 
+        Heap can be an arbitrary graph.
+
+        This patch replaces OBJECT_MARK_LOGGING and gives us these nice to haves. First it enhances 
+        our logGC() runtime Option by changing it to be a tri-state value of None, Basic, or Verbose 
+        logging levels. None means no logging is done, Basic is what logGC() = true would have done 
+        prior to this patch, and Verbose logs all object relationships.
+
+        JSCell has new dump/dumpToStream methods, the latter of which is "virtual" to allow 
+        subclasses to override the default string representation that will be dumped. These 
+        methods allow JSCells to be dumped using the standard dataLog() calls similar to much of
+        the logging infrastructure in our compilers.
+
+        This patch also adds a GCLogging class that handles dumping the relationships between objects.
+        It does this by using the pre-existing visitChildren virtual methods to obtain the immediate
+        children of each live cell at the end of garbage collection.
+
+        This change meets our goal of being neutral on the benchmarks we track.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/GCLogging.cpp: Added.
+        (JSC::GCLogging::levelAsString):
+        (JSC::LoggingFunctor::LoggingFunctor):
+        (JSC::LoggingFunctor::operator()):
+        (JSC::LoggingFunctor::log):
+        (JSC::LoggingFunctor::reviveCells):
+        (JSC::LoggingFunctor::returnValue):
+        (JSC::GCLogging::dumpObjectGraph):
+        * heap/GCLogging.h: Added.
+        * heap/GCSegmentedArray.h:
+        (JSC::GCSegmentedArray::begin):
+        (JSC::GCSegmentedArray::end):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::visitSmallStrings):
+        (JSC::Heap::visitConservativeRoots):
+        (JSC::Heap::visitCompilerWorklists):
+        (JSC::Heap::visitProtectedObjects):
+        (JSC::Heap::visitTempSortVectors):
+        (JSC::Heap::visitArgumentBuffers):
+        (JSC::Heap::visitException):
+        (JSC::Heap::visitStrongHandles):
+        (JSC::Heap::visitHandleStack):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        (JSC::Heap::visitWeakHandles):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::collect):
+        (JSC::Heap::didFinishCollection):
+        * heap/Heap.h:
+        * heap/MarkStack.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::dump):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::markStack):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::internalAppend):
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::dump):
+        (JSC::JSCell::dumpToStream):
+        (JSC::JSCell::className):
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::visitChildren):
+        * runtime/JSString.cpp:
+        (JSC::JSString::dumpToStream):
+        (JSC::JSString::visitChildren):
+        * runtime/JSString.h:
+        (JSC::JSString::length):
+        (JSC::JSRopeString::RopeBuilder::length):
+        * runtime/Options.cpp:
+        (JSC::parse):
+        (JSC::Options::setOption):
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+
+2014-04-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove bogus ASSERT in -JSVirtualMachine scanObjectGraph
+        https://bugs.webkit.org/show_bug.cgi?id=131251
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSVirtualMachine.mm:
+        (scanExternalObjectGraph):
+        * API/tests/testapi.mm:
+
+2014-04-03  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: hook up probe samples to TimelineAgent's records
+        https://bugs.webkit.org/show_bug.cgi?id=131127
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/ScriptDebugListener.h: Add a proper forward declaration for ScriptBreakpointAction.
+
+2014-04-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r166820.
+        https://bugs.webkit.org/show_bug.cgi?id=131256
+
+        Broke builds. (Requested by bdash on #webkit).
+
+        Reverted changeset:
+
+        "WIP for inlining C++.  Added a build target to produce llvm
+        ir."
+        https://bugs.webkit.org/show_bug.cgi?id=130523
+        http://trac.webkit.org/changeset/166820
+
+2014-04-04  Matthew Mirman  <mmirman@apple.com>
+
+        WIP for inlining C++.  Added a build target to produce llvm ir.
+        https://bugs.webkit.org/show_bug.cgi?id=130523
+
+        Reviewed by Filip Pizlo.
+
+        The llvm ir gets placed JavaScriptCoreRuntimeToLLVMir.build with the extension .o
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * build_index.py: Added.
+        * Configurations/CompileRuntimeToLLVMir.xcconfig: Added.
+
+2014-04-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Log JS Exceptions to System Console if JavaScriptCoreOutputConsoleMessagesToSystemConsole enabled
+        https://bugs.webkit.org/show_bug.cgi?id=131241
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        Log the exception to the system console if system console output is enabled.
+
+2014-04-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Provide a way for JSContext console to log to system console
+        https://bugs.webkit.org/show_bug.cgi?id=131050
+
+        Reviewed by Timothy Hatcher.
+
+        Applications often re-expose some log -> NSLog functionality.
+        We already have the capability ourselves, which includes extra
+        information such as sourceURL:line:column, all arguments instead
+        of just one argument, and backtrace information on console.trace.
+        Therefore it would be convenient if developers could just use
+        the built-in console.log and get rich output in both the inspector
+        and the console, without writing their own logger.
+
+        The logging will be enabled in debug builds by default, and can be enabled
+        otherwise by setting a user default before creating the first context.
+        
+        For example, in the application itself:
+
+            [[NSUserDefaults standardUserDefaults] setBool:YES forKey:@"JavaScriptCoreOutputConsoleMessagesToSystemConsole"];
+
+        Or from outside the application:
+        
+            shell> defaults write <app-bundle-identifier> JavaScriptCoreOutputConsoleMessagesToSystemConsole -bool YES
+
+        * inspector/JSConsoleClient.h:
+        * inspector/JSConsoleClient.cpp:
+        (Inspector::JSConsoleClient::logToSystemConsole):
+        (Inspector::JSConsoleClient::setLogToSystemConsole):
+        (Inspector::JSConsoleClient::initializeLogToSystemConsole):
+        (Inspector::JSConsoleClient::JSConsoleClient):
+        Global setting for logging to system console. Enabled on
+        debug builds, and by a user default on supported platforms.
+
+        (Inspector::JSConsoleClient::messageWithTypeAndLevel):
+        Log to system console when the static setting is enabled.
+
+        * runtime/ConsoleClient.h:
+        * runtime/ConsoleClient.cpp:
+        (JSC::appendURLAndPosition):
+        (JSC::appendMessagePrefix):
+        (JSC::ConsoleClient::printConsoleMessage):
+        (JSC::ConsoleClient::printConsoleMessageWithArguments):
+        Clean up printing. Build strings and use WTFLogAlways instead of printf
+        for consistant logging.
+
+        * runtime/ConsoleClient.cpp:
+        (JSC::ConsoleClient::printConsoleMessageWithArguments):
+        Clean up printing. If there is no source URL, don't print a leading colon.
+
+2014-04-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Use JSCell::indexingType instead of Structure::indexingType wherever possible
+        https://bugs.webkit.org/show_bug.cgi?id=131230
+
+        Reviewed by Mark Lam.
+
+        Avoid the indirection through the Structure.
+
+        * bytecode/ArrayAllocationProfile.cpp:
+        (JSC::ArrayAllocationProfile::updateIndexingType):
+        * bytecode/ArrayAllocationProfile.h:
+        (JSC::ArrayAllocationProfile::selectIndexingType):
+        * heap/HeapStatistics.cpp:
+        (JSC::StorageStatistics::operator()):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::attemptFastSort):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::objectPrototypeIsSane):
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+
+2014-04-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Use JSCell::type instead of TypeInfo::type wherever possible
+        https://bugs.webkit.org/show_bug.cgi?id=131229
+
+        Reviewed by Michael Saboff.
+
+        Avoid going through the Structure and reifying the TypeInfo.
+
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::isEvalExecutable):
+        (JSC::ExecutableBase::isProgramExecutable):
+
+2014-04-03  Andreas Kling  <akling@apple.com>
+
+        Fast-path for casting JS wrappers to JSNode.
+        <https://webkit.org/b/131196>
+
+        Allow code outside of JSC (well, WebCore) to extend the JSType spectrum
+        a little bit. We do this by exposing a LastJSCObjectType constant so
+        WebCore can encode its own wrapper types after that.
+
+        Reviewed by Mark Hahnenberg and Geoff Garen.
+
+        * runtime/JSType.h:
+
+            Added LastJSCObjectType for use by WebCore.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::isVariableObject):
+
+            Updated since this can no longer assume that types >= VariableObjectType
+            are all variable objects.
+
+2014-04-03  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        All Heap::writeBarriers should be inline
+        https://bugs.webkit.org/show_bug.cgi?id=131197
+
+        Reviewed by Mark Lam.
+
+        One is in a JSCellInlines.h, another is in Heap.cpp. These are all critical 
+        enough and small enough to belong in HeapInlines.h. Also added the proper 
+        ENABLE(GGC) ifdefs to minimize the cost of C++ barriers for !ENABLE(GGC) builds.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::writeBarrier): Deleted.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::writeBarrier):
+        * runtime/JSCellInlines.h:
+        (JSC::Heap::writeBarrier): Deleted.
+
+2014-04-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JSContext inspection provide a way to opt-out of including Native Call Stacks in Exception traces reported to Web Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=131186
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSContextPrivate.h:
+        * API/JSContext.mm:
+        (-[JSContext _includesNativeCallStackWhenReportingExceptions]):
+        (-[JSContext _setIncludesNativeCallStackWhenReportingExceptions:]):
+        JSContext ObjC SPI to opt-out of including native call stacks in exceptions.
+
+        * API/JSContextRefPrivate.h:
+        * API/JSContextRef.cpp:
+        (JSGlobalContextGetIncludesNativeCallStackWhenReportingExceptions):
+        (JSGlobalContextSetIncludesNativeCallStackWhenReportingExceptions):
+        JSContext C SPI to opt-out of including native call stacks in exceptions.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        Only include the native call stack if the setting is enabled. It is enabled by default.
+
+2014-04-03  Mark Lam  <mark.lam@apple.com>
+
+        Fix bit rot in ARMv7 JIT probe mechanism.
+        <https://webkit.org/b/131167>
+
+        Reviewed by Geoffrey Garen.
+
+        1. The macro assembler does not support pushing the SP register.  Worked
+           around this by pushing the LR register as a placeholder, and then
+           writing the original SP value to that slot.
+        2. The CPUState field in the ProbeContext needs to be aligned on a 4
+           byte boundary, not an 8 byte boundary.
+
+        * assembler/MacroAssemblerARMv7.cpp:
+        (JSC::MacroAssemblerARMv7::probe):
+        * jit/JITStubsARMv7.h:
+
+2014-04-02  Mark Lam  <mark.lam@apple.com>
+
+        ARMv7 compare32() should not use TST to do CMP's job.
+        <https://webkit.org/b/131146>
+
+        Reviewed by Geoffrey Garen.
+
+        The ARMv7 implementation of "compare32(RegisterID left, TrustedImm32 right)"
+        was using "tst reg, reg" to implement "cmp reg, #0".  Unfortunately, the tst
+        instruction doesn't set the Overflow (V) flag and this results in random
+        results depending on whether there was a preceeding instruction that did set
+        the Overflow (V) flag.  This issue was causing emscripten-cube2hash to run
+        with a lot of OSR exits where not expected as well as producing wrong results.
+
+        The fix is to use "cmp reg, #0" to do the job properly.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::compare32):
+
+2014-04-02  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CodeBlockSet should be generational
+        https://bugs.webkit.org/show_bug.cgi?id=127152
+
+        Reviewed by Geoffrey Garen.
+
+        During EdenCollections we now only visit those CodeBlocks that:
+        a) Are new since the last collection if they were somehow otherwise reachable.
+        b) Are reachable from an Executable that is part of the remembered set.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Initialize uninitialized variables.
+        (JSC::CodeBlock::visitAggregate): Move the addition of the weak reference harvester after the
+        shouldImmediatelyAssumeLivenessDuringScan check since it's redundant if we assume liveness.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::forEachRelatedCodeBlock): Executes a functor for each CodeBlock reachable from the current CodeBlock (including this).
+        We use this to clear marks for the CodeBlocks of remembered Executables (see: CodeBlockSet::clearMarksForEdenCollection).
+        (JSC::CodeBlockSet::mark): Also check the set of new CodeBlocks for memebership when doing conservative scanning.
+        (JSC::ScriptExecutable::forEachCodeBlock): Executes a functor for each of this Executable's CodeBlocks.
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::~CodeBlockSet):
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::promoteYoungCodeBlocks): Moves all CodeBlocks currently in the set of new CodeBlocks into 
+        the set of old CodeBlocks.
+        (JSC::CodeBlockSet::clearMarksForFullCollection): Clears the marks for all CodeBlocks.
+        (JSC::CodeBlockSet::clearMarksForEdenCollection): Clears the marks for CodeBlocks owned by Executables in the 
+        remembered set. When an Executable is added to the remembered set it's typically because we need to do something 
+        with its CodeBlock.
+        (JSC::CodeBlockSet::clearMarks):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced): Fixpoints over either just the new CodeBlocks or all CodeBlocks
+        to determine which CodeBlocks are dead and eagerly finalizes/deletes them.
+        (JSC::CodeBlockSet::remove):
+        (JSC::CodeBlockSet::traceMarked): Iterate only the currently executing CodeBlocks instead of all CodeBlocks.
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks): Clear m_mayBeExecuting for all currently executing 
+        CodeBlocks because we no longer always do this at the beginning of EdenCollections.
+        * heap/CodeBlockSet.h:
+        (JSC::CodeBlockSet::iterate):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::deleteAllCompiledCode):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode): Write barrier code on installation. We do this due to the following situation:
+        a) A CodeBlock is created and is compiled on a DFG worker thread.
+        b) No GC happens.
+        c) The CodeBlock has finished being compiled and is installed in the Executable.
+        d) The function never executes before the next GC.
+        e) The next GC needs needs to visit the new CodeBlock but the Executable won't be revisited unless 
+            it's added to the remembered set.
+
+2014-04-02  Mark Lam  <mark.lam@apple.com>
+
+        Added some more dataLog info for OSR exits.
+        <https://webkit.org/b/131120>
+
+        Reviewed by Michael Saboff.
+
+        Adding info about the OSR exit index, the bytecode index of the bytecode
+        that is OSR exiting, and the reason for the OSR exit.  This change is
+        for debugging code which only comes into play when we use the
+        --printEachOSRExit option.
+
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+
+2014-04-02  Martin Robinson  <mrobinson@igalia.com>
+
+        REGRESSION(r165704): [GTK] Inspector resources not correctly generated
+        https://bugs.webkit.org/show_bug.cgi?id=130343
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * CMakeLists.txt: We generate the inspector JavaScript file into a directory like the one
+        in which it should be distributed. This allows us to more easily package it for GTK+.
+
+2014-04-01  Timothy Hatcher  <timothy@apple.com>
+
+        Remove HeapProfiler from the Web Inspector protocol.
+
+        https://bugs.webkit.org/show_bug.cgi?id=131070
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/JSGlobalObjectConsoleAgent.cpp:
+        (Inspector::JSGlobalObjectConsoleAgent::addInspectedHeapObject): Deleted.
+        * inspector/agents/JSGlobalObjectConsoleAgent.h:
+        * inspector/protocol/Console.json:
+
+2014-03-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable WEB_TIMING on Mac and iOS
+        https://bugs.webkit.org/show_bug.cgi?id=128064
+
+        Reviewed by Sam Weinig, Brent Fulgham.
+
+        Enable WEB_TIMING.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-03-31  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r166415): JSObject{Get,Set}Private() don't work with proxies objects
+        https://bugs.webkit.org/show_bug.cgi?id=130992
+
+        Reviewed by Mark Hahnenberg.
+
+        Forward JSObjectGetPrivate() and JSObjectSetPrivate() to the wrapped object.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrivate):
+        (JSObjectSetPrivate):
+        * API/tests/testapi.c:
+        (main): Added new test case to validate we are properly foarwarding.
+
+2014-03-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Improve GC_LOGGING
+        https://bugs.webkit.org/show_bug.cgi?id=130988
+
+        Reviewed by Geoffrey Garen.
+
+        GC_LOGGING can be useful for diagnosing where we're spending our time during collection, 
+        but it doesn't distinguish between Eden and Full collections in the data it gathers. This
+        patch updates it so that it can. It also adds the process ID to the beginning of each line 
+        of input to be able to distinguish between the output of multiple processes exiting at the 
+        same time.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+
+2014-03-31  Dean Jackson  <dino@apple.com>
+
+        Remove WEB_ANIMATIONS
+        https://bugs.webkit.org/show_bug.cgi?id=130989
+
+        Reviewed by Simon Fraser.
+
+        Remove this feature flag until we plan to implement.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        More validation for FTL inline caches
+        https://bugs.webkit.org/show_bug.cgi?id=130948
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * runtime/Options.h:
+
+2014-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        LLVM IR for store barriers should be nicely arranged and they don't need exception checks
+        https://bugs.webkit.org/show_bug.cgi?id=130950
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+
+2014-03-31  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
+
+        [CMake] Stop checking for WTF_USE_ICU_UNICODE.
+        https://bugs.webkit.org/show_bug.cgi?id=130965
+
+        Reviewed by Martin Robinson.
+
+        This is somewhat of a follow-up to r162782, which got rid of
+        WTF_USE_ICU_UNICODE in CMake but did not remove the check in JSC's
+        CMakeLists.txt. This meant the includes and libraries were not
+        being properly included since then.
+
+        * CMakeLists.txt:
+
+2014-03-31  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        Remove hostThisRegister() and hostThisValue()
+        https://bugs.webkit.org/show_bug.cgi?id=130895
+
+        Reviewed by Geoffrey Garen.
+
+        Removed hostThisRegister() and hostThisValue() and instead use thisArgumentOffset() and thisValue() respectively.
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::call):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionInternalConstructorName):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionType):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionFunctionDetails):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionGetInternalProperties):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluate):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeType):
+        (Inspector::jsJavaScriptCallFrameAttributeCaller):
+        (Inspector::jsJavaScriptCallFrameAttributeSourceID):
+        (Inspector::jsJavaScriptCallFrameAttributeLine):
+        (Inspector::jsJavaScriptCallFrameAttributeColumn):
+        (Inspector::jsJavaScriptCallFrameAttributeFunctionName):
+        (Inspector::jsJavaScriptCallFrameAttributeScopeChain):
+        (Inspector::jsJavaScriptCallFrameAttributeThisObject):
+        (Inspector::jsJavaScriptCallFrameAttributeType):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hostThisRegister): Deleted.
+        (JSC::ExecState::hostThisValue): Deleted.
+        * runtime/Arguments.cpp:
+        (JSC::argumentsFuncIterator):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        (JSC::arrayProtoFuncValues):
+        (JSC::arrayProtoFuncEntries):
+        (JSC::arrayProtoFuncKeys):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/ConsolePrototype.cpp:
+        (JSC::consoleLogWithLevel):
+        (JSC::consoleProtoFuncClear):
+        (JSC::consoleProtoFuncDir):
+        (JSC::consoleProtoFuncDirXML):
+        (JSC::consoleProtoFuncTable):
+        (JSC::consoleProtoFuncTrace):
+        (JSC::consoleProtoFuncAssert):
+        (JSC::consoleProtoFuncCount):
+        (JSC::consoleProtoFuncProfile):
+        (JSC::consoleProtoFuncProfileEnd):
+        (JSC::consoleProtoFuncTime):
+        (JSC::consoleProtoFuncTimeEnd):
+        (JSC::consoleProtoFuncTimeStamp):
+        (JSC::consoleProtoFuncGroup):
+        (JSC::consoleProtoFuncGroupCollapsed):
+        (JSC::consoleProtoFuncGroupEnd):
+        * runtime/DatePrototype.cpp:
+        (JSC::formateDateInstance):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncBind):
+        * runtime/NamePrototype.cpp:
+        (JSC::privateNameProtoFuncToString):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncClz):
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::stringProtoFuncTrim):
+        (JSC::stringProtoFuncTrimLeft):
+        (JSC::stringProtoFuncTrimRight):
+
+2014-03-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Land the stackmap register liveness glue with the uses of the liveness disabled
+        https://bugs.webkit.org/show_bug.cgi?id=130924
+
+        Reviewed by Oliver Hunt.
+        
+        Add the liveness and fix other bugs I found.
+
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::usedRegistersFor):
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLSlowPathCall.cpp:
+        * ftl/FTLSlowPathCallKey.cpp:
+        (JSC::FTL::SlowPathCallKey::dump):
+        * ftl/FTLSlowPathCallKey.h:
+        (JSC::FTL::SlowPathCallKey::SlowPathCallKey):
+        (JSC::FTL::SlowPathCallKey::argumentRegisters):
+        (JSC::FTL::SlowPathCallKey::withCallTarget):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Record::locationSet):
+        (JSC::FTL::StackMaps::Record::liveOutsSet):
+        (JSC::FTL::StackMaps::Record::usedRegisterSet):
+        * ftl/FTLStackMaps.h:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::registerClobberCheck):
+        (JSC::FTL::slowPathCallThunkGenerator):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::stackRegisters):
+        (JSC::RegisterSet::reservedHardwareRegisters):
+        (JSC::RegisterSet::runtimeRegisters):
+        (JSC::RegisterSet::specialRegisters):
+        (JSC::RegisterSet::dump):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::RegisterSet):
+        (JSC::RegisterSet::setAny):
+        (JSC::RegisterSet::setMany):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2014-03-28  Mark Lam  <mark.lam@apple.com>
+
+        mandreel throws a checksum error on 32-bit x86.
+        <https://webkit.org/b/125706>
+
+        Reviewed by Filip Pizlo.
+
+        The 32-bit DFG can emit code that loads double constants from its
+        CodeBlock's m_constantRegisters vector.  The emitted instruction will
+        embed the address of the constant from the vector's backing store.
+        Subsequently, while inserting new constants, the DFG may resize the
+        vector, thereby reallocating the backing store.  This renders the
+        previously embedded constant addresses stale.
+
+        The fix is to use a dedicated doubles constant pool stored in the DFG
+        CommonData instead.  This constant pool won't be reallocated, and
+        hence will not manifest this issue.
+
+        * dfg/DFGCommonData.h:
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant): Deleted.
+
+2014-03-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: console.warn is showing as error instead of warning
+        https://bugs.webkit.org/show_bug.cgi?id=130921
+
+        Reviewed by Timothy Hatcher.
+
+        * runtime/ConsolePrototype.cpp:
+        (JSC::consoleProtoFuncWarn):
+        console.warn should be MessageLevel Warning, not Error.
+
+2014-03-28  Oliver Hunt  <oliver@apple.com>
+
+        Fix cloop build.
+
+        * bytecode/BytecodeList.json:
+
+2014-03-28  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed, rolling r166248 back in.
+
+        Turns out r166070 didn't cause a 2% performance loss in page load times
+
+        Reverted changeset:
+
+        Unreviewed, rolling out r166126.
+        Rollout r166126 in prepartion to roll out prerequisite r166070
+
+2014-03-27  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r166376.
+        https://bugs.webkit.org/show_bug.cgi?id=130887
+
+        This was a misguided optimization. (Requested by kling on
+        #webkit).
+
+        Reverted changeset:
+
+        "Avoid fetching JSObject::structure() repeatedly in
+        putDirectInternal."
+        https://bugs.webkit.org/show_bug.cgi?id=130857
+        http://trac.webkit.org/changeset/166376
+
+2014-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Support spread operand in |new| expressions
+        https://bugs.webkit.org/show_bug.cgi?id=130877
+
+        Reviewed by Michael Saboff.
+
+        Add support for the spread operator being applied in
+        |new| expressions.  This required adding support for
+        a new opcode, op_construct_varargs.  This is a relatively
+        simple refactoring of the call_varargs implementation.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::callTypeFor):
+        (JSC::CallLinkInfo::specializationKind):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::emit_op_construct_varargs):
+        (JSC::JIT::emitSlow_op_construct_varargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitSlow_op_construct_varargs):
+        (JSC::JIT::emit_op_construct_varargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseMemberExpression):
+
+2014-03-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Revert http://trac.webkit.org/changeset/166386 because it broke builds.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/LLVMForJSC.xcconfig:
+
+2014-03-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, skip this test for now.
+
+        * tests/stress/recurse-infinitely-on-getter.js:
+
+2014-03-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Switch the LLVMForJSC target to using the LLVM in /usr/local rather than /usr/local/LLVMForJavaScriptCore on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=130867
+        <rdar://problem/16432456> 
+
+        Reviewed by Mark Hahnenberg.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/LLVMForJSC.xcconfig:
+
+2014-03-27  Andreas Kling  <akling@apple.com>
+
+        Avoid fetching JSObject::structure() repeatedly in putDirectInternal.
+        <https://webkit.org/b/130857>
+
+        Use the cached Structure* instead of re-fetching it over and over since
+        that's a non-trivial operation these days.
+
+        Reviewed by Mark Hahnenberg.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2014-03-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Check the remembered set bit faster
+        https://bugs.webkit.org/show_bug.cgi?id=130860
+
+        Reviewed by Oliver Hunt.
+
+        Currently we look up the remembered set bit in the MarkedBlock in C++ code, but 
+        that bit is also stored in the object. We should look it up there whenever possible.
+
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::shouldReportLiveBytes):
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        * heap/Heap.h:
+        * heap/HeapInlines.h: Removed.
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExtraMemoryUsage):
+
+2014-03-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Provide SPI to disallow remote inspection of a JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=130853
+
+        Reviewed by Timothy Hatcher.
+
+        * API/JSContextPrivate.h: Added.
+        * API/JSContext.mm:
+        (-[JSContext _remoteInspectionEnabled]):
+        (-[JSContext _setRemoteInspectionEnabled:]):
+        ObjC SPI to enable/disable remote inspection.
+
+        * API/JSContextRefPrivate.h:
+        * API/JSContextRef.cpp:
+        (JSGlobalContextGetRemoteInspectionEnabled):
+        (JSGlobalContextSetRemoteInspectionEnabled):
+        C SPI to enable/disable remote inspection.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add new private header, and export as a private header.
+
+2014-03-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Clean up questionable style in ScriptExecutable::prepareForExecutionImpl
+        https://bugs.webkit.org/show_bug.cgi?id=130845
+
+        Reviewed by Filip Pizlo.
+
+        There was a hack added to make sure C Loop LLInt worked which included overriding the 
+        global Options::useLLInt setting, which makes no sense to do here. We should put the 
+        update of the global setting in Options::recomputeDependentOptions along with the other 
+        execution engine flags.
+
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2014-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Enable LLVM stackmap liveOuts computation
+        https://bugs.webkit.org/show_bug.cgi?id=130821
+
+        Reviewed by Andy Estes and Sam Weinig.
+
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Record::dump):
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Parse stackmaps liveOuts
+        https://bugs.webkit.org/show_bug.cgi?id=130801
+
+        Reviewed by Geoffrey Garen.
+        
+        This just adds the code to parse them but doesn't do anything with them, yet.
+
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::forStackmaps):
+        * ftl/FTLLocation.h:
+        (JSC::FTL::Location::forRegister):
+        (JSC::FTL::Location::forIndirect):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::Location::parse):
+        (JSC::FTL::StackMaps::Location::dump):
+        (JSC::FTL::StackMaps::LiveOut::parse):
+        (JSC::FTL::StackMaps::LiveOut::dump):
+        (JSC::FTL::StackMaps::Record::parse):
+        (JSC::FTL::StackMaps::Record::dump):
+        * ftl/FTLStackMaps.h:
+
+2014-03-26  Mark Lam  <mark.lam@apple.com>
+
+        Build fix after r166307.
+
+        Not reviewed.
+
+        * runtime/JSCell.h:
+        - The inline function isAPIValueWrapper() should not be exported.  This
+          was causing a linkage error when building for 32-bit x86 on Mac.
+
+2014-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Reasoning about DWARF register numbers should be moved out of FTL::Location
+        https://bugs.webkit.org/show_bug.cgi?id=130792
+
+        Reviewed by Oliver Hunt.
+        
+        Moving this code makes it possible for things other than FTL::Location to reason about
+        DWARF register encoding. This refactoring also appears to reduce some code duplication
+        and makes FTLLocation.cpp cleaner.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLDWARFRegister.cpp: Added.
+        (JSC::FTL::DWARFRegister::reg):
+        (JSC::FTL::DWARFRegister::dump):
+        * ftl/FTLDWARFRegister.h: Added.
+        (JSC::FTL::DWARFRegister::DWARFRegister):
+        (JSC::FTL::DWARFRegister::dwarfRegNum):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::dump):
+        (JSC::FTL::Location::isGPR):
+        (JSC::FTL::Location::gpr):
+        (JSC::FTL::Location::isFPR):
+        (JSC::FTL::Location::fpr):
+        * ftl/FTLLocation.h:
+        (JSC::FTL::Location::hasDwarfReg):
+        (JSC::FTL::Location::dwarfReg):
+
+2014-03-26  Brent Fulgham  <bfulgham@apple.com>
+
+        Unreviewed build fix.
+
+        * runtime/JSCell.h: VS2013 confused about argument type.
+
+2014-03-26  Zoltan Horvath  <zoltan@webkit.org>
+
+        [CSS Shapes] Remove shape-inside support
+        https://bugs.webkit.org/show_bug.cgi?id=130698
+
+        Reviewed by David Hyatt.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-03-26  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        Rename hasFastArrayStorage to be more appropriate
+        https://bugs.webkit.org/show_bug.cgi?id=130773
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNewArray):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArrayBuffer):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::unshift):
+        (JSC::Butterfly::shift):
+        * runtime/IndexingHeaderInlines.h:
+        (JSC::IndexingHeader::preCapacity):
+        * runtime/IndexingType.h:
+        (JSC::hasArrayStorage):
+        (JSC::hasAnyArrayStorage):
+        (JSC::hasFastArrayStorage): Deleted.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortVector):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::ensureArrayStorage):
+        (JSC::JSObject::arrayStorage):
+        * runtime/StructureTransitionTable.h:
+        (JSC::newIndexingType):
+
+2014-03-26  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed. Removing the remaining Automake cruft.
+
+        * GNUmakefile.list.am: Removed.
+
+2014-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Arguments simplification phase should be fine with marking the arguments local itself as an arguments alias
+        https://bugs.webkit.org/show_bug.cgi?id=130764
+        <rdar://problem/16304788>
+
+        Reviewed by Sam Weinig.
+        
+        Being an arguments alias just means that your OSR exit recovery should attempt arguments
+        creation. This is true of arguments locals. We had special cases that tried to make it not
+        true of arguments locals. The only consequence of those special cases was to cause crashes
+        in case of arguments that are also captured variables (i.e. we have SlowArguments). This
+        change just removes those special cases.
+        
+        This change means that the FTL will now see SetLocals with a FlushedArguments format.
+        Previously you wouldn't see them because previously only non-captured variable would be
+        arguments aliases, and non-captured variables get completely SSAified - i.e. no SetLocals
+        left. Adding handling for FlushedArguments is a benign and simple change since its
+        behavior is identical to FlushedJSValue for that code's purposes.
+
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+        * tests/stress/captured-arguments-variable.js: Added.
+        (foo):
+        (noInline):
+
+2014-03-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add HeapInlines
+        https://bugs.webkit.org/show_bug.cgi?id=130759
+
+        Reviewed by Filip Pizlo.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::MarkedBlockSnapshotFunctor::MarkedBlockSnapshotFunctor):
+        (JSC::MarkedBlockSnapshotFunctor::operator()):
+        * heap/Heap.h: Also reindented while we're here.
+        (JSC::Heap::writeBarrierBuffer):
+        (JSC::Heap::vm):
+        (JSC::Heap::objectSpace):
+        (JSC::Heap::machineThreads):
+        (JSC::Heap::operationInProgress):
+        (JSC::Heap::allocatorForObjectWithoutDestructor):
+        (JSC::Heap::allocatorForObjectWithNormalDestructor):
+        (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor):
+        (JSC::Heap::storageAllocator):
+        (JSC::Heap::notifyIsSafeToCollect):
+        (JSC::Heap::isSafeToCollect):
+        (JSC::Heap::handleSet):
+        (JSC::Heap::handleStack):
+        (JSC::Heap::lastFullGCLength):
+        (JSC::Heap::lastEdenGCLength):
+        (JSC::Heap::increaseLastFullGCLength):
+        (JSC::Heap::sizeBeforeLastEdenCollection):
+        (JSC::Heap::sizeAfterLastEdenCollection):
+        (JSC::Heap::sizeBeforeLastFullCollection):
+        (JSC::Heap::sizeAfterLastFullCollection):
+        (JSC::Heap::jitStubRoutines):
+        (JSC::Heap::isDeferred):
+        (JSC::Heap::structureIDTable):
+        (JSC::Heap::removeCodeBlock):
+        * heap/HeapInlines.h: Added.
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::isCollecting):
+        (JSC::Heap::heap):
+        (JSC::Heap::isLive):
+        (JSC::Heap::isInRememberedSet):
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::setMarked):
+        (JSC::Heap::isWriteBarrierEnabled):
+        (JSC::Heap::writeBarrier):
+        (JSC::Heap::reportExtraMemoryCost):
+        (JSC::Heap::forEachProtectedCell):
+        (JSC::Heap::forEachCodeBlock):
+        (JSC::Heap::allocateWithNormalDestructor):
+        (JSC::Heap::allocateWithImmortalStructureDestructor):
+        (JSC::Heap::allocateWithoutDestructor):
+        (JSC::Heap::tryAllocateStorage):
+        (JSC::Heap::tryReallocateStorage):
+        (JSC::Heap::ascribeOwner):
+        (JSC::Heap::blockAllocator):
+        (JSC::Heap::releaseSoon):
+        (JSC::Heap::incrementDeferralDepth):
+        (JSC::Heap::decrementDeferralDepth):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
+        (JSC::Heap::markListSet):
+        * runtime/JSCInlines.h:
+
+2014-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ByteCodeParser::SetMode should distinguish between setting immediately without a flush and setting immediately with a flush
+        https://bugs.webkit.org/show_bug.cgi?id=130760
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * tests/stress/assign-argument-in-inlined-call.js: Added.
+        (f1):
+        (getF2Arguments):
+        (f2):
+        (f3):
+        * tests/stress/assign-captured-argument-in-inlined-call.js: Added.
+        (f1):
+        (f2):
+        (f3):
+
+2014-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix 32-bit getter call alignment.
+
+        Reviewed by Mark Hahnenberg.
+
+        * jit/Repatch.cpp:
+        (JSC::generateGetByIdStub):
+
+2014-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Repatch should plant calls to getters directly rather than through a C helper
+        https://bugs.webkit.org/show_bug.cgi?id=129589
+
+        Reviewed by Mark Hahnenberg.
+        
+        As the title says. All of the superstructure for this was already in place, so now it
+        was just a matter of actually emitting the call.
+        
+        8x speed-up for getter microbenchmarks. 
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PolymorphicGetByIdList.h:
+        (JSC::GetByIdAccess::doesCalls):
+        * jit/AccessorCallJITStubRoutine.cpp: Added.
+        (JSC::AccessorCallJITStubRoutine::AccessorCallJITStubRoutine):
+        (JSC::AccessorCallJITStubRoutine::~AccessorCallJITStubRoutine):
+        (JSC::AccessorCallJITStubRoutine::visitWeak):
+        * jit/AccessorCallJITStubRoutine.h: Added.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::storeCell):
+        * jit/GCAwareJITStubRoutine.h:
+        * jit/Repatch.cpp:
+        (JSC::generateGetByIdStub):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::offsetOfGetter):
+        (JSC::GetterSetter::offsetOfSetter):
+
+2014-03-25  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed, rolling out r166126.
+
+        Rollout r166126 in prepartion to roll out prerequisite r166070
+
+        Reverted changeset:
+
+        "toThis() on a JSWorkerGlobalScope should return a JSProxy and
+        not undefined"
+        https://bugs.webkit.org/show_bug.cgi?id=130554
+        http://trac.webkit.org/changeset/166126
+
+2014-03-25  Oliver Hunt  <oliver@apple.com>
+
+        AST incorrectly conflates readable and writable locations
+        https://bugs.webkit.org/show_bug.cgi?id=130734
+
+        Reviewed by Filip Pizlo.
+
+        We need to distinguish between "locations" that are valid for reading
+        and writing, vs those that may only be written.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isAssignmentLocation):
+
+2014-03-24  Oliver Hunt  <oliver@apple.com>
+
+        ASSERTION FAILED in Parser: dst != localReg
+        https://bugs.webkit.org/show_bug.cgi?id=130710
+
+        Reviewed by Filip Pizlo.
+
+        Just make sure we don't try to write to a captured constant,
+        following the change to track captured variables separately.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+
+2014-03-25  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Remove the autotools build
+        https://bugs.webkit.org/show_bug.cgi?id=130717
+
+        Reviewed by Anders Carlsson.
+
+        * GNUmakefile.am: Removed.
+        * config.h: Remove references to the autotools configure file.
+
+2014-03-24  Filip Pizlo  <fpizlo@apple.com>
+
+        More scaffolding for a stub routine to have a stub recursively embedded inside it
+        https://bugs.webkit.org/show_bug.cgi?id=130770
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink): VM& argument is superfluous.
+        (JSC::CallLinkInfo::visitWeak): Factor this out, it used to be in CodeBlock::finalizeUnconditionally().
+        * bytecode/CallLinkInfo.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally): Factor out some functionality into CallLinkInfo::visitWeak(), and make sure we pass RepatchBuffer& in more places.
+        (JSC::CodeBlock::unlinkCalls):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        * bytecode/PolymorphicGetByIdList.cpp: Pass RepatchBuffer& through and call JITStubRoutine::visitWeak().
+        (JSC::GetByIdAccess::visitWeak):
+        (JSC::PolymorphicGetByIdList::visitWeak):
+        * bytecode/PolymorphicGetByIdList.h:
+        * bytecode/PolymorphicPutByIdList.cpp: Pass RepatchBuffer& through and call JITStubRoutine::visitWeak().
+        (JSC::PutByIdAccess::visitWeak):
+        (JSC::PolymorphicPutByIdList::visitWeak):
+        * bytecode/PolymorphicPutByIdList.h:
+        * bytecode/StructureStubInfo.cpp: Pass RepatchBuffer& through.
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        * jit/ClosureCallStubRoutine.cpp: isClosureCall is unused.
+        (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
+        (JSC::createJITStubRoutine):
+        * jit/GCAwareJITStubRoutine.h: Make it easier to construct one of these.
+        (JSC::GCAwareJITStubRoutine::isClosureCall): Deleted.
+        * jit/JITStubRoutine.cpp:
+        (JSC::JITStubRoutine::visitWeak): This will allow future JITStubRoutine subclasses to have stubs recursively embedded inside them.
+        * jit/JITStubRoutine.h:
+        * jit/Repatch.cpp:
+        (JSC::generateGetByIdStub): Fix a possible GC bug where we weren't making the stub routine GC aware.
+        (JSC::emitCustomSetterStub): Clean up some code.
+
+2014-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Safari crashes in JavaScriptCore: JSC::JSObject::growOutOfLineStorage
+        when WebKit is compiled with fcatch-undefined-behavior
+        https://bugs.webkit.org/show_bug.cgi?id=130652
+
+        Reviewed by Mark Hahnenberg.
+
+        Use a static member function because the butterfly we pass in might be
+        NULL, and passing NULL to a member function is undefined behavior.
+
+        Stylistically, I think this new way reads a little more clearly, since it
+        matches createOrGrowArrayRight, and it helps to convey that m_butterfly
+        might not exist yet.
+
+        * runtime/Butterfly.h:
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::createOrGrowPropertyStorage): Renamed from growPropertyStorage
+        because we might create. Split out the create path to avoid using NULL
+        in a member function expression.
+
+        Removed some unused versions of this function.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::growOutOfLineStorage): Updated for interface change.
+
+2014-03-24  Oliver Hunt  <oliver@apple.com>
+
+        Strict mode destructuring assignment crashes the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=130538
+
+        Reviewed by Michael Saboff.
+
+        The SyntaxChecker mode always return 1 for success, except
+        for a small subset of functions where we needed exact information.
+        This ends up just being a poor design decision as it means
+        the parser can get confused between a function return 1, and
+        the Resolve constant which was also 1. So we now use a unique
+        type for every creation method.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createSourceElements):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArguments):
+        (JSC::SyntaxChecker::createSpreadExpression):
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createElementList):
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::createClause):
+        (JSC::SyntaxChecker::createClauseList):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createForOfLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createLabelStatement):
+        (JSC::SyntaxChecker::createThrowStatement):
+        (JSC::SyntaxChecker::createDebugger):
+        (JSC::SyntaxChecker::createConstStatement):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2014-03-24  Brent Fulgham  <bfulgham@apple.com>
+
+        Activate WebVTT Tests Once Merging is Complete
+        https://bugs.webkit.org/show_bug.cgi?id=130420
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig: Turn on ENABLE(WEBVTT_REGIONS)
+
+2014-03-24  Andreas Kling  <akling@apple.com>
+
+        Stop pulling in all the macro assemblers from VM.h
+        <https://webkit.org/b/130691>
+
+        Remove #include of "GPRInfo.h". This breaks WebCore's dependency
+        on macro assemblers headers and removes 8 includes from every
+        .cpp file in the JS bindings.
+
+        Reviewed by Geoff Garen.
+
+        * runtime/VM.h:
+
+2014-03-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Add support for thread QoS
+        https://bugs.webkit.org/show_bug.cgi?id=130688
+
+        Reviewed by Andreas Kling.
+
+        * heap/BlockAllocator.cpp:
+        (JSC::BlockAllocator::blockFreeingThreadStartFunc):
+            - block freeing is a utility activity.
+
+2014-03-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix CLOOP build.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
+        (JSC::CodeBlock::resetStubDuringGCInternal): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::callLinkInfosEnd): Deleted.
+
+2014-03-24  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        [ARM64] GNU assembler doesn't work with LLInt arm64 backend.
+        https://bugs.webkit.org/show_bug.cgi?id=130453
+        
+        Reviewed by Filip Pizlo.
+
+        Change fp and lr to x29 and x30. Add both operand kinds to emitARM64()
+        at sxtw and uxtw instructions.
+
+        * offlineasm/arm64.rb:
+
+2014-03-23  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        Move all EFL typedefs into EflTypedefs.h.
+        https://bugs.webkit.org/show_bug.cgi?id=130511
+
+        Reviewed by Gyuyoung Kim
+
+        * heap/HeapTimer.h: Remove EFL typedefs.
+
+2014-03-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Gotta grow the locals vectors if we are about to do SetLocals beyond the bytecode's numCalleeRegisters
+        https://bugs.webkit.org/show_bug.cgi?id=130650
+        <rdar://problem/16122966>
+
+        Reviewed by Michael Saboff.
+        
+        Previously, it was only in the case of inlining that we would do SetLocal's beyond the
+        previously established numLocals limit. But then we added generalized op_call_varargs
+        handling, which results in us emitting SetLocals that didn't previously exist in the
+        bytecode.
+        
+        This factors out the inliner's ensureLocals loop and calls it from op_call_varargs.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ensureLocals):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub): Make this do alignment correctly.
+        * runtime/Options.h:
+        * tests/stress/call-varargs-from-inlined-code.js: Added.
+        * tests/stress/call-varargs-from-inlined-code-with-odd-number-of-arguments.js: Added.
+
+2014-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, adjust sizes for ARM64.
+
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfCall):
+
+2014-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Protect the silent spiller/filler's desire to fill Int32Constants by making sure that we don't mark something as having a Int32 register format if it's a non-Int32 constant
+        https://bugs.webkit.org/show_bug.cgi?id=130649
+        <rdar://problem/16399949>
+
+        Reviewed by Andreas Kling.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        * tests/stress/fuzz-bug-16399949.js: Added.
+        (tryItOut.f):
+        (tryItOut):
+
+2014-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Call linking slow paths should be passed a CallLinkInfo* directly so that you can create a call IC without adding it to any CodeBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=130644
+
+        Reviewed by Andreas Kling.
+        
+        This is conceptually a really simple change but it involves the following:
+        
+        - The inline part of the call IC stuffs a pointer to the CallLinkInfo into regT2.
+        
+        - CodeBlock uses a Bag of CallLinkInfos instead of a Vector.
+        
+        - Remove the significance of a CallLinkInfo's index. This means that DFG::JITCode no
+          longer has a vector of slow path counts that shadows the CallLinkInfo vector.
+        
+        - Make CallLinkInfo have its own slowPathCount, which counts actual slow path executions
+          and not all relinking.
+        
+        This makes planting JS->JS calls inside other inline caches or stubs a lot easier, since
+        the CallLinkInfo and the call IC slow paths no longer rely on the call being associated
+        with a op_call/op_construct instruction and a machine code return PC within such an
+        instruction.
+
+        * bytecode/CallLinkInfo.h:
+        (JSC::getCallLinkInfoCodeOrigin):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeDFGStatuses):
+        * bytecode/CallLinkStatus.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::getCallLinkInfoMap):
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::unlinkCalls):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::stubInfoBegin):
+        (JSC::CodeBlock::stubInfoEnd):
+        (JSC::CodeBlock::callLinkInfosBegin):
+        (JSC::CodeBlock::callLinkInfosEnd):
+        (JSC::CodeBlock::byValInfo):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addJSCall):
+        (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfCall):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::JSCall):
+        (JSC::FTL::JSCall::emit):
+        (JSC::FTL::JSCall::link):
+        * ftl/FTLJSCall.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        (JSC::operationLinkFor):
+        (JSC::operationVirtualFor):
+        (JSC::operationLinkClosureCallFor):
+        * jit/Repatch.cpp:
+        (JSC::linkClosureCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::slowPathFor):
+        (JSC::virtualForThunkGenerator):
+        * tests/stress/eval-that-is-not-eval.js: Added.
+
+2014-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix mispelled test name.
+
+        * tests/stress/constand-folding-osr-exit.js: Removed.
+        * tests/stress/constant-folding-osr-exit.js: Copied from Source/JavaScriptCore/tests/stress/constand-folding-osr-exit.js.
+
+2014-03-22  Andreas Kling  <akling@apple.com>
+
+        CREATE_DOM_WRAPPER doesn't need the ExecState.
+        <https://webkit.org/b/130648>
+
+        Add a fast path from JSGlobalObject to the VM so we don't have
+        to dance via the Heap.
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::vm):
+
+2014-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix FTL build.
+
+        * ftl/FTLJITFinalizer.cpp:
+
+2014-03-22  Michael Saboff  <msaboff@apple.com>
+
+        toThis() on a JSWorkerGlobalScope should return a JSProxy and not undefined
+        https://bugs.webkit.org/show_bug.cgi?id=130554
+
+        Reviewed by Geoffrey Garen.
+
+        Fixed toThis() on WorkerGlobalScope to return a JSProxy instead of the JSGlobalObject.
+        Did some cleanup as well.  Moved the setting of the thisObject in a JSGlobalObject to
+        happen in finishCreation() so that it will also happen for other derived classes including
+        JSWorkerGlobalScopeBase.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        * jsc.cpp:
+        (GlobalObject::create):
+        * API/tests/testapi.c:
+        (globalObject_initialize): Eliminated ASSERT that the global object we are creating matches
+        the result from JSContextGetGlobalObject() as that will return the proxy.       
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Removed thisValue parameter and the call to setGlobalThis() since
+        we now call setGlobalThis in finishCreation().
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        (JSC::JSGlobalObject::setGlobalThis): Made this a private method.
+
+2014-03-22  Andreas Kling  <akling@apple.com>
+
+        Fix debug build.
+
+        * bytecode/CodeBlock.cpp:
+        * runtime/Executable.cpp:
+
+2014-03-22  Andreas Kling  <akling@apple.com>
+
+        Cut down on JSC profiler includes in WebCore & co.
+        <https://webkit.org/b/130637>
+
+        Most of WebKit was pulling in JSC's profiler headers via VM.h.
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGDisassembler.cpp:
+        * dfg/DFGDisassembler.h:
+        * dfg/DFGJITFinalizer.cpp:
+        * jsc.cpp:
+        * runtime/VM.cpp:
+        * runtime/VM.h:
+
+2014-03-22  Landry Breuil <landry@openbsd.org>
+
+        Use pthread_stackseg_np() to find the stack bounds on OpenBSD.
+        https://bugs.webkit.org/show_bug.cgi?id=129965
+
+        Reviewed By Anders Carlsson.
+
+2014-03-21  Mark Lam  <mark.lam@apple.com>
+
+        Crash when BytecodeGenerator::emitJump calls Label::bind on null pointer.
+        <https://webkit.org/b/124508>
+
+        Reviewed by Oliver Hunt.
+
+        The issue is that BreakNode::emitBytecode() is holding onto a LabelScope
+        pointer from the BytecodeGenerator's m_localScopes vector, and then it
+        calls emitPopScopes().  emitPopScopes() may do finally clause handling
+        which will require the m_localScopes to be cloned so that it can change
+        the local scopes for the finally block, and then restore it after
+        handling the finally clause.  These modifications of the m_localScopes
+        vector will result in the LabelScope pointer in BreakNode::emitBytecode()
+        becoming stale, thereby causing the crash.
+
+        The same issue applies to the ContinueNode as well.
+
+        The fix is to use the existing LabelScopePtr abstraction instead of raw
+        LabelScope pointers.  The LabelScopePtr is resilient to the underlying
+        vector re-allocating its backing store.
+
+        I also changed the LabelScopePtr constructor that takes a LabelScopeStore
+        to expect a reference to the owner store instead of a pointer because the
+        owner store should never be a null pointer.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::newLabelScope):
+        (JSC::BytecodeGenerator::breakTarget):
+        (JSC::BytecodeGenerator::continueTarget):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/LabelScope.h:
+        (JSC::LabelScopePtr::LabelScopePtr):
+        (JSC::LabelScopePtr::operator bool):
+        (JSC::LabelScopePtr::null):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ContinueNode::trivialTarget):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::trivialTarget):
+        (JSC::BreakNode::emitBytecode):
+
+2014-03-21  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        6% SunSpider commandline regression due to r165940
+        https://bugs.webkit.org/show_bug.cgi?id=130617
+
+        Reviewed by Michael Saboff.
+
+        In GCActivityCallback::didAllocate, lastGCLength() returns 0 if we've never collected 
+        before. Some of the benchmarks are never running a single EdenCollection, which causes 
+        them to repeatedly call scheduleTimer with a newDelay of 0. This defeats our timer 
+        slop heuristic, causing us to invoke CFRunLoopTimerSetNextFireDate a couple orders of 
+        magnitude more than we normally would.
+
+        The fix is to seed the last GC lengths in Heap with a non-zero length so that our heuristic works.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+
+2014-03-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Constants folded by DFG::ByteCodeParser should not be dead.
+        https://bugs.webkit.org/show_bug.cgi?id=130576
+
+        Reviewed by Mark Hahnenberg.
+        
+        This fixes bugs in the ByteCodeParser's constant folder by removing that constant folder. This
+        reduces the number of folders in JSC from fourish to just threeish (parser, DFG AI, and one
+        or more folders in LLVM). Doing so has no performance impact since the other constant folders
+        already subsume this one.
+        
+        Also added a test case for the specific bug that instigated this.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getJSConstantForValue):
+        (JSC::DFG::ByteCodeParser::getJSConstant):
+        (JSC::DFG::ByteCodeParser::inferredConstant):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        * dfg/DFGNodeFlags.h:
+        * tests/stress/constand-folding-osr-exit.js: Added.
+        (foo):
+        (test):
+        (.var):
+
+2014-03-21  Mark Lam  <mark.lam@apple.com>
+
+        StackLayoutPhase should find the union'ed calleeVariable before accessing its machineLocal.
+        <https://webkit.org/b/130566>
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+
+2014-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should correctly compile GetByVal on Uint32Array that claims to return non-int32 values
+        https://bugs.webkit.org/show_bug.cgi?id=130562
+        <rdar://problem/16382842>
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        * tests/stress/uint32array-unsigned-load.js: Added.
+        (foo):
+
+2014-03-20  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: add frontend controller and models for replay sessions
+        https://bugs.webkit.org/show_bug.cgi?id=130145
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/scripts/CodeGeneratorInspector.py: Add the conditional Replay domain.
+
+2014-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL ValueToInt32 mishandles the constant case, and by the way, there is a constant case that the FTL sees
+        https://bugs.webkit.org/show_bug.cgi?id=130546
+        <rdar://problem/16383308>
+
+        Reviewed by Mark Hahnenberg.
+        
+        Make AI do a better job of folding this.
+        
+        Also made the FTL backend be more tolerant of data representations. In this case it
+        didn't know that "constant" was a valid representation. There is a finite set of
+        possible representations, but broadly, we don't write code that presumes anything
+        about the representation of an input; that's what methods like lowJSValue() are for.
+        ValueToInt32 was previously not relying on those methods at all because it had some
+        hacks. Now, those hacks are just a fast-path optimization but ultimately we fall down
+        to lowJSValue().
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+        (JSC::FTL::LowerDFGToLLVM::numberOrNotCellToInt32):
+        * tests/stress/value-to-int32-undefined-constant.js: Added.
+        (foo):
+        * tests/stress/value-to-int32-undefined.js: Added.
+        (foo):
+
+2014-03-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Add some assertions back
+        https://bugs.webkit.org/show_bug.cgi?id=130531
+
+        Reviewed by Geoffrey Garen.
+
+        We removed a useful set of assertions for verifying that MarkedBlocks were 
+        in the state that we expected them to be in after clearing marks in the Heap. 
+        We should add these back to catch bugs earlier.
+
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::VerifyMarkedOrRetired::operator()):
+        (JSC::MarkedSpace::clearMarks):
+
+2014-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Implement stackmap header version check and support new stackmap formats
+        https://bugs.webkit.org/show_bug.cgi?id=130535
+        <rdar://problem/16164284>
+
+        Reviewed by Geoffrey Garen.
+        
+        Add the notion of versioning so that LLVMers can happily implement new stackmap formats
+        without worrying about WebKit getting version-locked to LLVM. In the future, we will have
+        to implement parsing for a new LLVM stackmap format before it lands in LLVM, or we'll have
+        to have a "max usable LLVM revision" limit. But, thanks to versioning, we'll always be
+        happy to move backward in time to older versions of LLVM.
+
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::readObject):
+        (JSC::FTL::StackMaps::Constant::parse):
+        (JSC::FTL::StackMaps::StackSize::parse):
+        (JSC::FTL::StackMaps::Location::parse):
+        (JSC::FTL::StackMaps::Record::parse):
+        (JSC::FTL::StackMaps::parse):
+        (JSC::FTL::StackMaps::dump):
+        (JSC::FTL::StackMaps::dumpMultiline):
+        * ftl/FTLStackMaps.h:
+
+2014-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Crash beneath operationTearOffActivation running this JS compression demo
+        https://bugs.webkit.org/show_bug.cgi?id=130295
+        <rdar://problem/16332337>
+
+        Reviewed by Oliver Hunt.
+        
+        Make sure that we flush things as if we were at a terminal, if we are at a block with
+        no forward edges. This fixes infinitely loopy code with captured variables.
+
+        Make sure that the CFG simplifier adds explicit flushes whenever it jettisons a block.
+        
+        Make it so that NodeIsFlushed is a thing. Previously only SSA used it and it computed
+        it by itself. Now it's an artifact of CPS rethreading.
+        
+        Add a bunch of tests. All of them previously either crashed or returned bad output due
+        to memory corruption.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::isCaptured):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flushForTerminal):
+        (JSC::DFG::ByteCodeParser::flushForReturn):
+        (JSC::DFG::ByteCodeParser::flushIfTerminal):
+        (JSC::DFG::ByteCodeParser::branchData):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::run):
+        (JSC::DFG::CPSRethreadingPhase::computeIsFlushed):
+        (JSC::DFG::CPSRethreadingPhase::addFlushedLocalOp):
+        (JSC::DFG::CPSRethreadingPhase::addFlushedLocalEdge):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::clearFlagsOnAllNodes):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * tests/stress/activation-test-loop.js: Added.
+        (Inner.this.doStuff):
+        (Inner):
+        (foo.inner.isDone):
+        (foo):
+        * tests/stress/inferred-infinite-loop-that-uses-captured-variables.js: Added.
+        (bar):
+        (foo):
+        (noInline):
+        * tests/stress/infinite-loop-that-uses-captured-variables-before-throwing.js: Added.
+        (bar):
+        (foo):
+        (noInline):
+        * tests/stress/infinite-loop-that-uses-captured-variables-but-they-do-not-escape.js: Added.
+        (bar):
+        (foo):
+        (noInline):
+        * tests/stress/infinite-loop-that-uses-captured-variables-with-osr-entry.js: Added.
+        (bar):
+        (foo):
+        (noInline):
+        * tests/stress/infinite-loop-that-uses-captured-variables.js: Added.
+        (bar):
+        (foo):
+        (noInline):
+        * tests/stress/tricky-indirectly-inferred-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
+        (bar):
+        (fuzz):
+        (foo.f):
+        (foo):
+        * tests/stress/tricky-inferred-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
+        (bar):
+        (foo.f):
+        (foo):
+        * tests/stress/tricky-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
+        (bar):
+        (foo.f):
+        (foo):
+        * tests/stress/tricky-infinite-loop-that-uses-captured-variables.js: Added.
+        (bar):
+        (foo):
+        (noInline):
+
+2014-03-20  Oliver Hunt  <oliver@apple.com>
+
+        Incorrect behavior when mutating a typed array during set.
+        https://bugs.webkit.org/show_bug.cgi?id=130428
+
+        Reviewed by Geoffrey Garen.
+
+        This fixes a null derefence that occurs if a typed array
+        is mutated during the set() operation. The patch gets rid
+        of the "Quickly" version of setIndex that is assigning
+        JSValues of unknown type, as the numeric conversion can trigger
+        side effects that lead to neutering, and so we deref null.
+
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndex):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::set):
+        (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
+
+2014-03-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove IdentifierTable typedef, isIdentifier()
+        https://bugs.webkit.org/show_bug.cgi?id=130533
+
+        Rubber stamped by Geoff Garen.
+
+        Code should use AtomicStringTable, isAtomic() directly.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::className):
+        * API/JSClassRef.h:
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromCell):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::speculateStringIdent):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::atomicStringTable):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::addVar):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::createBindingPattern):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::checkCurrentAtomicStringTable):
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::add):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContext):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::didAcquireLock):
+        (JSC::JSLock::willReleaseLock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::get):
+        (JSC::PropertyTable::findWithString):
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h:
+        (JSC::VM::atomicStringTable):
+
+2014-03-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Merge AtomicString, Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=128624
+
+        Reviewed by Geoff Garen.
+
+        WTF::StringImpl currently supports two uniquing mechanism - AtomicString and
+        Identifer - that is one too many.
+
+        Remove Identifier in favour of AtomicString. Identifier had two interesting
+        mechanisms that we preserve.
+
+        (1) JSC API VMs each get their own string table, switch the string table on
+            API entry/exit.
+        (2) JSC caches a pointer to the string table on the VM to avoid a thread
+            specific access. Adds a new AtomicString::add method to support this.
+
+        * API/JSAPIWrapperObject.mm:
+            - updated includes.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            - added IdentifierInlines.h.
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+            - updated includes.
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::atomicStringTable):
+            - added, used via AtomicString::add to avoid thread-specific access.
+        * runtime/ConsolePrototype.cpp:
+            - updated includes.
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::add8):
+            - vm->smallStrings.singleCharacterStringRep now returns Atomic strings, use AtomicString::add.
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+            - added ASSERTS.
+        (JSC::Identifier::add):
+            - vm->smallStrings.singleCharacterStringRep now returns Atomic strings, use AtomicString::add.
+        * runtime/IdentifierInlines.h: Added.
+        (JSC::Identifier::add):
+            - moved from Identifier.h, use AtomicString::add.
+        * runtime/JSCInlines.h:
+            - added IdentifierInlines.h.
+        * runtime/JSLock.h:
+            - removed IdentifierTable.
+        * runtime/PropertyNameArray.cpp:
+            - updated includes.
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+            - ensure all single character strings are Atomic.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+            - instantiate CommonIdentifiers with the correct AtomicStringTable set on thread data.
+        * runtime/VM.h:
+        (JSC::VM::atomicStringTable):
+            - added, used via AtomicString::add to avoid thread-specific access.
+
+2014-03-20  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        [ARM64] Fix assembler build issues and add cacheFlush support for Linux
+        https://bugs.webkit.org/show_bug.cgi?id=130502
+
+        Reviewed by Michael Saboff.
+
+        Add limits.h for INT_MIN in ARM64Assembler(). Delete shouldBlindForSpecificArch(uintptr_t)
+        because on ARM64 uint64_t and uintptr_t is the same with GCC and Clang as well.
+        Add cacheFlush support for Linux.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::linuxPageFlush):
+        (JSC::ARM64Assembler::cacheFlush):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch):
+
+2014-03-19  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=130494
+        EmptyUnique strings are Identifiers/Atomic
+
+        Reviewed by Geoff Garen.
+
+        EmptyUnique strings should set the Identifier/Atomic flag.
+
+        This fixes an unreproducible bug we believe exists in Identifier handling.
+        Expected behaviour is that while Identifiers may reference EmptyUniques
+        (StringImpls allocated as UIDs for PrivateNames), these are not created
+        through the main Identifier constructor, the Identifier flag is not set
+        on PrivateNames, and we should never lookup EmptyUnique strings in the
+        IdentifierTable.
+
+        Unfortunately that was happening. Some tables used to implement property
+        access in the JIT hold StringImpl*s, and turn these back into Identifiers
+        using the identfiier constructor. Since the code generator will now plant
+        by-id (cachable) accesses to PrivateNames we can end up passing an
+        EmptyUnique to Identifier::add, potentially leading to PrivateNames being
+        uniqued together (though hard to prove, since the hash codes are random).
+
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+        (JSC::PropertyName::uid):
+        (JSC::PropertyName::publicName):
+        (JSC::PropertyName::asIndex):
+            - PropertyName assumed that PrivateNames are not Identifiers - instead check isEmptyUnique().
+        * runtime/Structure.cpp:
+        (JSC::Structure::getPropertyNamesFromStructure):
+            - Structure assumed that PrivateNames are not Identifiers - instead check isEmptyUnique().
+
+2014-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, revert the DFGCommon.h change in r165938. It was not intentional.
+
+        * dfg/DFGCommon.h:
+
+2014-03-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GC timer should intelligently choose between EdenCollections and FullCollections
+        https://bugs.webkit.org/show_bug.cgi?id=128261
+
+        Reviewed by Geoffrey Garen.
+
+        Most of the GCs while browsing the web are due to the GC timer. Currently the GC timer 
+        always does FullCollections. To reduce the impact of the GC timer on the system this patch
+        changes Heap so that it has two timers, one for each type of collection. The FullCollection
+        timer is notified at the end of EdenCollections how much the Heap has grown since the last 
+        FullCollection and when somebody notifies the Heap of abandoned memory (which usually wouldn't 
+        be detected by an EdenCollection).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/EdenGCActivityCallback.cpp: Added.
+        (JSC::EdenGCActivityCallback::EdenGCActivityCallback):
+        (JSC::EdenGCActivityCallback::doCollection):
+        (JSC::EdenGCActivityCallback::lastGCLength):
+        (JSC::EdenGCActivityCallback::deathRate):
+        (JSC::EdenGCActivityCallback::gcTimeSlice):
+        * heap/EdenGCActivityCallback.h: Added.
+        (JSC::GCActivityCallback::createEdenTimer):
+        * heap/FullGCActivityCallback.cpp: Added.
+        (JSC::FullGCActivityCallback::FullGCActivityCallback):
+        (JSC::FullGCActivityCallback::doCollection):
+        (JSC::FullGCActivityCallback::lastGCLength):
+        (JSC::FullGCActivityCallback::deathRate):
+        (JSC::FullGCActivityCallback::gcTimeSlice):
+        * heap/FullGCActivityCallback.h: Added.
+        (JSC::GCActivityCallback::createFullTimer):
+        * heap/GCActivityCallback.cpp:
+        (JSC::GCActivityCallback::GCActivityCallback):
+        (JSC::GCActivityCallback::doWork):
+        (JSC::GCActivityCallback::scheduleTimer):
+        (JSC::GCActivityCallback::cancelTimer):
+        (JSC::GCActivityCallback::didAllocate):
+        (JSC::GCActivityCallback::willCollect):
+        (JSC::GCActivityCallback::cancel):
+        * heap/GCActivityCallback.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportAbandonedObjectGraph):
+        (JSC::Heap::didAbandon):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::setFullActivityCallback):
+        (JSC::Heap::setEdenActivityCallback):
+        (JSC::Heap::fullActivityCallback):
+        (JSC::Heap::edenActivityCallback):
+        (JSC::Heap::setGarbageCollectionTimerEnabled):
+        (JSC::Heap::didAllocate):
+        (JSC::Heap::shouldDoFullCollection):
+        * heap/Heap.h:
+        (JSC::Heap::lastFullGCLength):
+        (JSC::Heap::lastEdenGCLength):
+        (JSC::Heap::increaseLastFullGCLength):
+        (JSC::Heap::sizeBeforeLastEdenCollection):
+        (JSC::Heap::sizeAfterLastEdenCollection):
+        (JSC::Heap::sizeBeforeLastFullCollection):
+        (JSC::Heap::sizeAfterLastFullCollection):
+        * heap/HeapOperation.h:
+        * heap/HeapStatistics.cpp:
+        (JSC::HeapStatistics::showObjectStatistics):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::timerDidFire):
+        * jsc.cpp:
+        (functionFullGC):
+        (functionEdenGC):
+        * runtime/Options.h:
+
+2014-03-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r165926.
+        https://bugs.webkit.org/show_bug.cgi?id=130488
+
+        broke the iOS build (Requested by estes on #webkit).
+
+        Reverted changeset:
+
+        "GC timer should intelligently choose between EdenCollections
+        and FullCollections"
+        https://bugs.webkit.org/show_bug.cgi?id=128261
+        http://trac.webkit.org/changeset/165926
+
+2014-03-13  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        GC timer should intelligently choose between EdenCollections and FullCollections
+        https://bugs.webkit.org/show_bug.cgi?id=128261
+
+        Reviewed by Geoffrey Garen.
+
+        Most of the GCs while browsing the web are due to the GC timer. Currently the GC timer 
+        always does FullCollections. To reduce the impact of the GC timer on the system this patch
+        changes Heap so that it has two timers, one for each type of collection. The FullCollection
+        timer is notified at the end of EdenCollections how much the Heap has grown since the last 
+        FullCollection and when somebody notifies the Heap of abandoned memory (which wouldn't be 
+        detected by an EdenCollection).
+
+        * heap/GCActivityCallback.cpp:
+        (JSC::GCActivityCallback::GCActivityCallback):
+        (JSC::GCActivityCallback::doWork):
+        (JSC::FullGCActivityCallback::FullGCActivityCallback):
+        (JSC::FullGCActivityCallback::doCollection):
+        (JSC::EdenGCActivityCallback::EdenGCActivityCallback):
+        (JSC::EdenGCActivityCallback::doCollection):
+        (JSC::GCActivityCallback::scheduleTimer):
+        (JSC::GCActivityCallback::cancelTimer):
+        (JSC::GCActivityCallback::didAllocate):
+        (JSC::GCActivityCallback::willCollect):
+        (JSC::GCActivityCallback::cancel):
+        * heap/GCActivityCallback.h:
+        (JSC::GCActivityCallback::GCActivityCallback):
+        (JSC::GCActivityCallback::createFullTimer):
+        (JSC::GCActivityCallback::createEdenTimer):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::didAbandon):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::setFullActivityCallback):
+        (JSC::Heap::setEdenActivityCallback):
+        (JSC::Heap::fullActivityCallback):
+        (JSC::Heap::edenActivityCallback):
+        (JSC::Heap::setGarbageCollectionTimerEnabled):
+        (JSC::Heap::didAllocate):
+        * heap/Heap.h:
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::timerDidFire):
+
+2014-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r165459): It broke 109 jsc stress test on ARM Thumb2 and Mac 32 bit
+        https://bugs.webkit.org/show_bug.cgi?id=130134
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Can't do some optimizations if you don't have a lot of registers.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById): Move stuff around before going into the IC code to ensure that we give the IC code the invariants it needs. This only happens in case of GetByIdFlush, where we are forced into using weird combinations of registers because the results have to be in t0/t1.
+        (JSC::DFG::SpeculativeJIT::compile): For a normal GetById, the register allocator should just do the right thing so nobody has to move anything around.
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator): Assert the things we want.
+        * jit/JITInlineCacheGenerator.h:
+        * jit/Repatch.cpp:
+        (JSC::generateGetByIdStub): Remove a previous incomplete hack to try to work around the DFG's problem.
+
+2014-03-19  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Normalize some of the older JSC options
+        https://bugs.webkit.org/show_bug.cgi?id=128753
+
+        Reviewed by Michael Saboff.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+
+2014-03-12  Mark Lam  <mark.lam@apple.com>
+
+        Update type of local vars to match the type of String length.
+        <https://webkit.org/b/130077>
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::join):
+
+2014-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of Flush in SSA
+        https://bugs.webkit.org/show_bug.cgi?id=130440
+
+        Reviewed by Sam Weinig.
+        
+        This is basically a red patch. We used to use backwards flow for determining what was
+        flushed, until it became clear that this doesn't make sense. Now the Flush nodes don't
+        accomplish anything. Keeping them around in SSA can only make things hard.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::SSAData::SSAData):
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGFlushLivenessAnalysisPhase.cpp: Removed.
+        * dfg/DFGFlushLivenessAnalysisPhase.h: Removed.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+
+2014-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix iOS production build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-03-18  Michael Saboff  <msaboff@apple.com>
+
+        Update RegExp Tracing code
+        https://bugs.webkit.org/show_bug.cgi?id=130381
+
+        Reviewed by Andreas Kling.
+
+        Updated the regular expression tracing code for 8/16 bit JIT as
+        well as match only entry points.  Also added average string length
+        metric.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::match):
+        (JSC::RegExp::printTraceData):
+        * runtime/RegExp.h:
+        * runtime/VM.cpp:
+        (JSC::VM::addRegExpToTrace):
+        (JSC::VM::dumpRegExpTrace):
+        * runtime/VM.h:
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::YarrCodeBlock::get8BitMatchOnlyAddr):
+        (JSC::Yarr::YarrCodeBlock::get16BitMatchOnlyAddr):
+        (JSC::Yarr::YarrCodeBlock::get8BitMatchAddr):
+        (JSC::Yarr::YarrCodeBlock::get16BitMatchAddr):
+
+2014-03-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Add CompareStrictEq(StringIdent:, NotStringVar:) and CompareStrictEq(String:, Untyped:)
+        https://bugs.webkit.org/show_bug.cgi?id=130300
+
+        Reviewed by Mark Hahnenberg.
+        
+        We can quickly strictly compare StringIdent's to NotStringVar's and String's to Untyped's.
+        This makes the DFG aware of this.
+        
+        Also adds StringIdent-to-StringIdent and StringIdent-to-NotStringVar strict comparisons to
+        the FTL. Also adds StringIdent-to-StringIdent non-strict comparisons to the FTL.
+        
+        This also gives the DFG some abstractions for checking something is a cell or is other.
+        This made this patch easier to write and also simplified a bunch of other stuff.
+        
+        1% speed-up on Octane.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::JumpList):
+        * bytecode/SpeculatedType.h:
+        (JSC::isNotStringVarSpeculation):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::childFor):
+        (JSC::DFG::Node::shouldSpeculateNotStringVar):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::compileBooleanCompare):
+        (JSC::DFG::SpeculativeJIT::compileStringEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringIdentEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringZeroLength):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
+        (JSC::DFG::SpeculativeJIT::speculateNotStringVar):
+        (JSC::DFG::SpeculativeJIT::speculateNotCell):
+        (JSC::DFG::SpeculativeJIT::speculateOther):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+        (JSC::DFG::SpeculativeJIT::emitSwitchString):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::blessedBooleanResult):
+        (JSC::DFG::SpeculativeJIT::unblessedBooleanResult):
+        (JSC::DFG::SpeculativeJIT::booleanResult):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::branchIsCell):
+        (JSC::DFG::branchNotCell):
+        (JSC::DFG::SpeculativeJIT::branchIsOther):
+        (JSC::DFG::SpeculativeJIT::branchNotOther):
+        (JSC::DFG::SpeculativeJIT::moveTrueTo):
+        (JSC::DFG::SpeculativeJIT::moveFalseTo):
+        (JSC::DFG::SpeculativeJIT::blessBoolean):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::branchIsCell):
+        (JSC::DFG::SpeculativeJIT::branchNotCell):
+        (JSC::DFG::SpeculativeJIT::branchIsOther):
+        (JSC::DFG::SpeculativeJIT::branchNotOther):
+        (JSC::DFG::SpeculativeJIT::moveTrueTo):
+        (JSC::DFG::SpeculativeJIT::moveFalseTo):
+        (JSC::DFG::SpeculativeJIT::blessBoolean):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::lowString):
+        (JSC::FTL::LowerDFGToLLVM::lowStringIdent):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateString):
+        (JSC::FTL::LowerDFGToLLVM::speculateStringIdent):
+        (JSC::FTL::LowerDFGToLLVM::speculateNotStringVar):
+        * runtime/JSCJSValue.h:
+        * tests/stress/string-ident-to-not-string-var-equality.js: Added.
+        (foo):
+        (bar):
+        (test):
+
+2014-03-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Add Copyright to framework.sb
+        https://bugs.webkit.org/show_bug.cgi?id=130413
+
+        Reviewed by Timothy Hatcher.
+
+        Other sb files got the copyright. Follow suit.
+
+        * framework.sb:
+
+2014-03-18  Matthew Mirman  <mmirman@apple.com>
+
+        Removed extra parens from if statement in a preprocessor define.
+        https://bugs.webkit.org/show_bug.cgi?id=130408
+
+        Reviewed by Filip Pizlo.
+
+        * parser/Parser.cpp:
+
+2014-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        More FTL enabling.
+
+        Rubber stamped by Dan Bernstein and Mark Hahnenberg.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+
+2014-03-17  Michael Saboff  <msaboff@apple.com>
+
+        V8 regexp spends most of its time in operationGetById
+        https://bugs.webkit.org/show_bug.cgi?id=130380
+
+        Reviewed by Filip Pizlo.
+
+        Added String.length case to tryCacheGetByID that will only help the BaseLine JIT.
+        When V8 regexp is run from the command line, this nets a 2% performance improvement.
+        When the test is run for a longer amount of time, there is much less benefit as the
+        DFG will emit the appropriate code for String.length.  This does remove
+        operationGetById as the hottest function whne run from the command line.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+
+2014-03-17  Andreas Kling  <akling@apple.com>
+
+        Add one-deep cache to opaque roots hashset.
+        <https://webkit.org/b/130357>
+
+        The vast majority of WebCore JS wrappers will have their Document*
+        as the root(). This change adds a simple optimization where we cache
+        the last lookup and avoid going to the hashset for repeated queries.
+
+        Looks like 0.4% progression on DYEB on my MBP.
+
+        Reviewed by Mark Hahnenberg.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/OpaqueRootSet.h: Added.
+        (JSC::OpaqueRootSet::OpaqueRootSet):
+        (JSC::OpaqueRootSet::contains):
+        (JSC::OpaqueRootSet::isEmpty):
+        (JSC::OpaqueRootSet::clear):
+        (JSC::OpaqueRootSet::add):
+        (JSC::OpaqueRootSet::size):
+        (JSC::OpaqueRootSet::begin):
+        (JSC::OpaqueRootSet::end):
+        * heap/SlotVisitor.h:
+
+2014-03-17  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
+
+        Implement Math.hypot
+        https://bugs.webkit.org/show_bug.cgi?id=129486
+
+        Reviewed by Darin Adler.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        (JSC::mathProtoFuncHypot):
+
+2014-03-17  Zsolt Borbely  <borbezs@inf.u-szeged.hu>
+
+        Fix the !ENABLE(PROMISES) build
+        https://bugs.webkit.org/show_bug.cgi?id=130328
+
+        Reviewed by Darin Adler.
+
+        Add missing ENABLE(PROMISES) guards.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPromiseReaction.cpp:
+        * runtime/JSPromiseReaction.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2014-03-16  Andreas Kling  <akling@apple.com>
+
+        REGRESSION(r165703): JSC tests crashing in StringImpl::destroy().
+        <https://webkit.org/b/130304>
+
+        Reviewed by Anders Carlsson.
+
+        Unreviewed, restoring the old behavior of OpaqueJSString::identifier()
+        that doesn't put a potentially unwanted string into the Identifier table.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::identifier):
+
+2014-03-16  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: generated backend commands should reflect build system ENABLE settings
+        https://bugs.webkit.org/show_bug.cgi?id=130111
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+
+        Combine only the Inspector domains listed in INSPECTOR_DOMAINS,
+        instead of globbing any .json file.
+
+        * DerivedSources.make:
+
+        Force the combined inspector protocol file to be regenerated if
+        the content or list of domains itself changes.
+
+2014-03-16  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: vended backend commands file should be generated as part of the build
+        https://bugs.webkit.org/show_bug.cgi?id=130110
+
+        Reviewed by Timothy Hatcher.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Copy InspectorJSBackendCommands.js to the
+        private headers directory.
+
+2014-03-16  Darin Adler  <darin@apple.com>
+
+        Remove all uses of deprecatedCharacters from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=130304
+
+        Reviewed by Anders Carlsson.
+
+        * API/JSValueRef.cpp:
+        (JSValueMakeFromJSONString): Use characters16 in the 16-bit code path.
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::~OpaqueJSString): Use characters 16 in the 16-bit code path.
+        (OpaqueJSString::identifier): Get rid of custom Identifier constructor, and
+        juse use the standard one that takes a String.
+        (OpaqueJSString::characters): Use getCharactersWithUpconvert instead of a
+        hand-written alternative.
+
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue): Create InspectorString from String directly
+        instead of involving a character pointer. Use the String from Identifier
+        directly instead of making a new String.
+
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::createSearchRegexSource): Use StringBuilder
+        instead of building a String a character at a time. This is still a very slow
+        way to do this. Also use strchr to search for a character instead of building
+        a String every time just to use find on it.
+
+        * inspector/InspectorValues.cpp:
+        (Inspector::doubleQuoteString): Remove unnecessary trip through a
+        character pointer. This is still a really slow way to do this.
+        (Inspector::InspectorValue::parseJSON): Use StringView::upconvertedCharacters
+        instead of String::deprecatedCharacters. Still slow to always upconvert.
+
+        * runtime/DateConstructor.cpp: Removed unneeded include.
+        * runtime/DatePrototype.cpp: Ditto.
+
+        * runtime/Identifier.h: Removed deprecatedCharacters function.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode): Added a type cast to avoid ambiguity with the two character-
+        appending functions from JSStringBuilder. Removed unneeded code duplicating
+        what JSStringBuilder already does in its character append function.
+        (JSC::decode): Deleted code that creates a JSStringBuilder that is never used.
+        (JSC::parseIntOverflow): Changed lengths to unsigned. Made only the overload that
+        is used outside this file have external linkage. Added a new overload that takes
+        a StringView.
+        (JSC::parseInt): Use StringView::substring to call parseIntOverflow.
+        (JSC::globalFuncEscape): Use JSBuilder::append in a more efficient way for a
+        single character.
+
+        * runtime/JSGlobalObjectFunctions.h: Removed unused overloads of parseIntOverflow.
+
+        * runtime/JSStringBuilder.h: Marked this "lightly deprecated".
+        (JSC::JSStringBuilder::append): Overloaded for better speed with 8-bit characters.
+        Made one overload private. Fixed a performance bug where we would reserve capacity
+        in the 8-bit buffer but then append to the 16-bit buffer.
+
+        * runtime/ObjectPrototype.cpp: Removed unneeded include.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize): Use StringView::getCharactersWithUpconvert.
+        (JSC::stringProtoFuncLink): Ditto.
+
+2014-03-15  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL ArrayifyToStructure shouldn't fail every time that it actually arrayifies
+        https://bugs.webkit.org/show_bug.cgi?id=130296
+
+        Reviewed by Andreas Kling.
+        
+        During the 32-bit structure ID work, the second load of the structure was removed.
+        That's wrong. The whole point of loading the structure ID again is that the structure
+        ID would have been changed by the arrayification call, and we're verifying that the
+        arrayification succeeded in changing the structure. If we check the old structure - as
+        the code was doing after the 32-bit structure ID work - then this check is guaranteed
+        to fail, causing a significant performance regression.
+        
+        It's actually amazing that the regression wasn't bigger. The reason is that if FTL
+        code pathologically exits but the equivalent DFG code doesn't, then the exponential
+        backoff almost perfectly guarantees that we just end up in the DFG. For this code, at
+        the time at least, the DFG wasn't much slower so this didn't cause too much pain.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+
+2014-03-15  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support CheckHasInstance/InstanceOf
+        https://bugs.webkit.org/show_bug.cgi?id=130285
+
+        Reviewed by Sam Weinig.
+        
+        Fairly straightforward; I also discovered an inaccurate FIXME in the process.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckHasInstance):
+        (JSC::FTL::LowerDFGToLLVM::compileInstanceOf):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::phi):
+        * tests/stress/instanceof.js: Added.
+        * tests/stress/instanceof-not-cell.js: Added.
+
+2014-03-15  Michael Saboff  <msaboff@apple.com>
+
+        It should be possible to adjust DFG and FTL compiler thread priorities
+        https://bugs.webkit.org/show_bug.cgi?id=130288
+
+        Reviewed by Filip Pizlo.
+
+        Added ability to change thread priorities relative to its current priority.
+        Created options to adjust the priority of the DFG and FTL compilation work thread
+        pools.  For two core systems, there might be three runnable threads, the main thread,
+        the DFG compilation thread and the FTL compilation thread.  With the same priority,
+        the scheduler is free to schedule whatever thread it wants.  By lowering the
+        compilation threads, the main thread can run.  Further tests may suggest better values
+        for the new options, priorityDeltaOfDFGCompilerThreads and priorityDeltaOfFTLCompilerThreads.
+
+        For a two-core device, this change has a net positive improvement of 1-3% across
+        SunSpider, Octane, Kraken and AsmBench.
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::finishCreation):
+        (JSC::DFG::Worklist::create):
+        (JSC::DFG::ensureGlobalDFGWorklist):
+        (JSC::DFG::ensureGlobalFTLWorklist):
+        * dfg/DFGWorklist.h:
+        * runtime/Options.cpp:
+        (JSC::computePriorityDeltaOfWorkerThreads):
+        * runtime/Options.h:
+
+2014-03-15  David Kilzer  <ddkilzer@apple.com>
+
+        [iOS] Define SYSTEM_VERSION_PREFIX consistently
+        <http://webkit.org/b/130293>
+        <rdar://problem/15926359>
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Version.xcconfig:
+        (SYSTEM_VERSION_PREFIX_iphoneos): Sync with
+        Source/WebKit/mac/Version.xcconfig.
+
+2014-03-15  David Kilzer  <ddkilzer@apple.com>
+
+        Fix build: using integer absolute value function 'abs' when argument is of floating point type
+        <http://webkit.org/b/130286>
+
+        Reviewed by Filip Pizlo.
+
+        Fixes the following build failure using trunk clang:
+
+            JavaScriptCore/assembler/MacroAssembler.h:992:17: error: using integer absolute value function 'abs' when argument is of floating point type [-Werror,-Wabsolute-value]
+                    value = abs(value);
+                            ^
+            JavaScriptCore/assembler/MacroAssembler.h:992:17: note: use function 'fabs' instead
+                    value = abs(value);
+                            ^~~
+                            fabs
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::shouldBlindDouble): Switch from abs() to
+        fabs().
+
+2014-03-14  Oliver Hunt  <oliver@apple.com>
+
+        Reinstate intialiser syntax in for-in loops
+        https://bugs.webkit.org/show_bug.cgi?id=130269
+
+        Reviewed by Michael Saboff.
+
+        Disallowing the initialiser broke some sites so this patch re-allows
+        the syntax.  We still disallow the syntax in 'of' and pattern based
+        enumeration.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::isBindingNode):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVarDeclarationList):
+        (JSC::Parser<LexerType>::parseForStatement):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2014-03-14  Mark Lam  <mark.lam@apple.com>
+
+        Accessing __lookupGetter__ and __lookupSetter__ should not crash the VM when undefined.
+        <https://webkit.org/b/130279>
+
+        Reviewed by Filip Pizlo.
+
+        If neither the getter nor setter are defined, accessing __lookupGetter__
+        and __lookupSetter__ will return undefined as expected.  However, if the
+        getter is defined but the setter is not, accessing __lookupSetter__ will
+        crash the VM.  Similarly, accessing __lookupGetter__ when only the setter
+        is defined will crash the VM.
+
+        The reason is because objectProtoFuncLookupGetter() and
+        objectProtoFuncLookupSetter() did not check if the getter and setter
+        value is non-null before returning it as an EncodedJSValue.  The fix is
+        to add the appropriate null checks.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+
+2014-03-14  Mark Rowe  <mrowe@apple.com>
+
+        Fix the production build.
+
+        Don't rely on USE_INTERNAL_SDK being set for the Production configuration since UseInternalSDK.xcconfig won't
+        be at the expected relative path when working from installed source.
+
+        * Configurations/Base.xcconfig:
+
+2014-03-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Replace "Apple Computer, Inc." with "Apple Inc." in copyright headers
+        https://bugs.webkit.org/show_bug.cgi?id=130276
+        <rdar://problem/16266927>
+
+        Reviewed by Simon Fraser.
+
+        * API/APICast.h:
+        * API/JSBase.cpp:
+        * API/JSBase.h:
+        * API/JSBasePrivate.h:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSClassRef.cpp:
+        * API/JSClassRef.h:
+        * API/JSContextRef.cpp:
+        * API/JSContextRef.h:
+        * API/JSContextRefPrivate.h:
+        * API/JSObjectRef.cpp:
+        * API/JSObjectRef.h:
+        * API/JSProfilerPrivate.cpp:
+        * API/JSProfilerPrivate.h:
+        * API/JSRetainPtr.h:
+        * API/JSStringRef.cpp:
+        * API/JSStringRef.h:
+        * API/JSStringRefBSTR.cpp:
+        * API/JSStringRefBSTR.h:
+        * API/JSStringRefCF.cpp:
+        * API/JSStringRefCF.h:
+        * API/JSValueRef.cpp:
+        * API/JSValueRef.h:
+        * API/JavaScript.h:
+        * API/JavaScriptCore.h:
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * API/tests/JSNode.c:
+        * API/tests/JSNode.h:
+        * API/tests/JSNodeList.c:
+        * API/tests/JSNodeList.h:
+        * API/tests/Node.c:
+        * API/tests/Node.h:
+        * API/tests/NodeList.c:
+        * API/tests/NodeList.h:
+        * API/tests/minidom.c:
+        * API/tests/minidom.js:
+        * API/tests/testapi.c:
+        * API/tests/testapi.js:
+        * DerivedSources.make:
+        * bindings/ScriptValue.cpp:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/EvalCodeCache.h:
+        * bytecode/Instruction.h:
+        * bytecode/JumpTable.cpp:
+        * bytecode/JumpTable.h:
+        * bytecode/Opcode.cpp:
+        * bytecode/Opcode.h:
+        * bytecode/SamplingTool.cpp:
+        * bytecode/SamplingTool.h:
+        * bytecode/SpeculatedType.cpp:
+        * bytecode/SpeculatedType.h:
+        * bytecode/ValueProfile.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/Label.h:
+        * bytecompiler/LabelScope.h:
+        * bytecompiler/RegisterID.h:
+        * debugger/DebuggerCallFrame.cpp:
+        * debugger/DebuggerCallFrame.h:
+        * dfg/DFGDesiredStructureChains.cpp:
+        * dfg/DFGDesiredStructureChains.h:
+        * heap/GCActivityCallback.cpp:
+        * heap/GCActivityCallback.h:
+        * inspector/ConsoleMessage.cpp:
+        * inspector/ConsoleMessage.h:
+        * inspector/IdentifiersFactory.cpp:
+        * inspector/IdentifiersFactory.h:
+        * inspector/InjectedScriptManager.cpp:
+        * inspector/InjectedScriptManager.h:
+        * inspector/InjectedScriptSource.js:
+        * inspector/ScriptBreakpoint.h:
+        * inspector/ScriptDebugListener.h:
+        * inspector/ScriptDebugServer.cpp:
+        * inspector/ScriptDebugServer.h:
+        * inspector/agents/InspectorAgent.cpp:
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+        * interpreter/JSStack.cpp:
+        * interpreter/JSStack.h:
+        * interpreter/Register.h:
+        * jit/CompactJITCodeMap.h:
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86_64.h:
+        * os-win32/stdbool.h:
+        * parser/SourceCode.h:
+        * parser/SourceProvider.h:
+        * profiler/LegacyProfiler.cpp:
+        * profiler/LegacyProfiler.h:
+        * profiler/ProfileNode.cpp:
+        * profiler/ProfileNode.h:
+        * runtime/ArrayBufferView.cpp:
+        * runtime/ArrayBufferView.h:
+        * runtime/BatchedTransitionOptimizer.h:
+        * runtime/CallData.h:
+        * runtime/ConstructData.h:
+        * runtime/DumpContext.cpp:
+        * runtime/DumpContext.h:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/ExceptionHelpers.h:
+        * runtime/InitializeThreading.cpp:
+        * runtime/InitializeThreading.h:
+        * runtime/IntegralTypedArrayBase.h:
+        * runtime/IntendedStructureChain.cpp:
+        * runtime/IntendedStructureChain.h:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSExportMacros.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSNotAnObject.cpp:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSPropertyNameIterator.h:
+        * runtime/JSSegmentedVariableObject.cpp:
+        * runtime/JSSegmentedVariableObject.h:
+        * runtime/JSSymbolTableObject.cpp:
+        * runtime/JSSymbolTableObject.h:
+        * runtime/JSTypeInfo.h:
+        * runtime/JSVariableObject.cpp:
+        * runtime/JSVariableObject.h:
+        * runtime/PropertyTable.cpp:
+        * runtime/PutPropertySlot.h:
+        * runtime/SamplingCounter.cpp:
+        * runtime/SamplingCounter.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        * runtime/StructureInlines.h:
+        * runtime/StructureTransitionTable.h:
+        * runtime/SymbolTable.cpp:
+        * runtime/SymbolTable.h:
+        * runtime/TypedArrayBase.h:
+        * runtime/TypedArrayType.cpp:
+        * runtime/TypedArrayType.h:
+        * runtime/VM.cpp:
+        * runtime/VM.h:
+        * yarr/RegularExpression.cpp:
+        * yarr/RegularExpression.h:
+
+2014-03-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Final FTL iOS build magic
+        https://bugs.webkit.org/show_bug.cgi?id=130281
+
+        Reviewed by Michael Saboff.
+
+        * Configurations/Base.xcconfig: For now our LLVM headers are in /usr/local/LLVMForJavaScriptCore/include, which is the same as OS X.
+        * Configurations/LLVMForJSC.xcconfig: We need to be more careful about how we specify library paths if we want to get the prioritzation right. Also we need protobuf because things. :-/
+
+2014-03-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Gracefully handle nil name -[JSContext setName:]
+        https://bugs.webkit.org/show_bug.cgi?id=130262
+
+        Reviewed by Mark Hahnenberg.
+
+        * API/JSContext.mm:
+        (-[JSContext setName:]):
+        Gracefully handle nil input.
+
+        * API/tests/testapi.c:
+        (globalContextNameTest):
+        * API/tests/testapi.mm:
+        Test for nil / NULL names in the ObjC and C APIs.
+
+2014-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Improve dom error messages
+        https://bugs.webkit.org/show_bug.cgi?id=130103
+
+        Reviewed by Andreas Kling.
+
+        Add new helper function.
+
+        * runtime/Error.h:
+        (JSC::throwVMTypeError):
+
+2014-03-14  László Langó  <llango.u-szeged@partner.samsung.com>
+
+        Remove unused method declaration.
+        https://bugs.webkit.org/show_bug.cgi?id=130238
+
+        Reviewed by Filip Pizlo.
+
+        The implementation of CallFrame::dumpCaller was removed in
+        http://trac.webkit.org/changeset/153183, but the declaration of it was not.
+
+        * interpreter/CallFrame.h:
+        Remove CallFrame::dumpCaller() method declaration.
+
+2014-03-12  Sergio Villar Senin  <svillar@igalia.com>
+
+        Rename DEFINE_STATIC_LOCAL to DEPRECATED_DEFINE_STATIC_LOCAL
+        https://bugs.webkit.org/show_bug.cgi?id=129612
+
+        Reviewed by Darin Adler.
+
+        For new code use static NeverDestroyed<T> instead.
+
+        * API/JSAPIWrapperObject.mm:
+        (jsAPIWrapperObjectHandleOwner):
+        * API/JSManagedValue.mm:
+        (managedValueHandleOwner):
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::objectGroupForBreakpointAction):
+        * inspector/scripts/CodeGeneratorInspectorStrings.py:
+        * interpreter/JSStack.cpp:
+        (JSC::stackStatisticsMutex):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::allocators):
+
+2014-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reduce memory use for static property maps
+        https://bugs.webkit.org/show_bug.cgi?id=129986
+
+        Reviewed by Andreas Kling.
+
+        Static property tables are currently duplicated on first use from read-only memory into dirty memory
+        in every process, and since the entries are large (48 bytes) and the tables can be unusually sparse
+        (we use a custom hash table without a rehash) a lot of memory may be wasted.
+
+        First, reduce the size of the hashtable. Instead of storing values in the table the hashtable maps
+        from string hashes to indicies into a densely packed array of values. Compute the index table at
+        compile time as a part of the derived sources step, such that this may be read-only data.
+
+        Second, don't copy all data from the HashTableValue array into a HashEntry objects. Instead refer
+        directly to the HashTableValue entries. The only data that needs to be allocated at runtime are the
+        keys, which are Identifiers.
+
+        * create_hash_table:
+            - emit the hash table index into the derived source (we were calculating this already to ensure chaining does not get too deep).
+        * parser/Lexer.cpp:
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        (JSC::Lexer<T>::parseIdentifierSlowCase):
+            - HashEntry -> HashTableValue.
+        * parser/Lexer.h:
+        (JSC::Keywords::getKeyword):
+            - HashEntry -> HashTableValue.
+        * runtime/ClassInfo.h:
+            - removed HashEntry.
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+            - use HashTable::ConstIterator.
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::findPropertyHashEntry):
+            - HashEntry -> HashTableValue.
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+            - changed HashTable::ConstIterator interface.
+        * runtime/JSObject.h:
+            - HashEntry -> HashTableValue.
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+            - table -> keys, keys array is now densely packed.
+        (JSC::HashTable::deleteTable):
+            - table -> keys.
+        (JSC::setUpStaticFunctionSlot):
+            - HashEntry -> HashTableValue.
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::builtinGenerator):
+        (JSC::HashTableValue::function):
+        (JSC::HashTableValue::functionLength):
+        (JSC::HashTableValue::propertyGetter):
+        (JSC::HashTableValue::propertyPutter):
+        (JSC::HashTableValue::lexerValue):
+            - added accessor methods from HashEntry.
+        (JSC::HashTable::copy):
+            - fields changed.
+        (JSC::HashTable::initializeIfNeeded):
+            - table -> keys.
+        (JSC::HashTable::entry):
+            - HashEntry -> HashTableValue.
+        (JSC::HashTable::ConstIterator::ConstIterator):
+            - iterate packed value array, so no need to skipInvalidKeys().
+        (JSC::HashTable::ConstIterator::value):
+        (JSC::HashTable::ConstIterator::key):
+        (JSC::HashTable::ConstIterator::operator->):
+            - accessors now get HashTableValue/StringImpl* separately.
+        (JSC::HashTable::ConstIterator::operator++):
+            - iterate packed value array, so no need to skipInvalidKeys().
+        (JSC::HashTable::end):
+            - end is now size of dense not sparse array.
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+        (JSC::getStaticValueSlot):
+        (JSC::putEntry):
+        (JSC::lookupPut):
+            - HashEntry -> HashTableValue.
+
+2014-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Mac no-FTL build.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-03-13  Juergen Ributzka  <juergen@apple.com>
+
+        Only export initializeAndGetJSCLLVMAPI from libllvmForJSC.dylib
+        https://bugs.webkit.org/show_bug.cgi?id=130224
+
+        Reviewed by Filip Pizlo.
+
+        This limits the exported symbols to only initializeAndGetJSCLLVMAPI from
+        the LLVM dylib. This allows the dylib to be safely used with other LLVM
+        dylibs on the same system. It also reduces the dynamic linking overhead
+        and also reduces the size by 6MB, because the linker can now dead strip
+        many unused functions.
+
+        * Configurations/LLVMForJSC.xcconfig:
+
+2014-03-13  Andreas Kling  <akling@apple.com>
+
+        VM::discardAllCode() should clear the RegExp cache.
+        <https://webkit.org/b/130144>
+
+        Reviewed by Michael Saboff.
+
+        * runtime/VM.cpp:
+        (JSC::VM::discardAllCode):
+
+2014-03-13  Andreas Kling  <akling@apple.com>
+
+        Revert "Short-circuit JSGlobalObjectInspectorController when not inspecting."
+        <https://webkit.org/b/129995>
+
+        This code path is not taken anymore on DYEB, and I can't explain why
+        it was showing up in my profiles. Backing it out per JoePeck's suggestion.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+
+2014-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support IsBlah
+        https://bugs.webkit.org/show_bug.cgi?id=130202
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileIsUndefined):
+        (JSC::FTL::LowerDFGToLLVM::compileIsBoolean):
+        (JSC::FTL::LowerDFGToLLVM::compileIsNumber):
+        (JSC::FTL::LowerDFGToLLVM::compileIsString):
+        (JSC::FTL::LowerDFGToLLVM::compileIsObject):
+        (JSC::FTL::LowerDFGToLLVM::compileIsFunction):
+        (JSC::FTL::LowerDFGToLLVM::compileStoreBarrier):
+        (JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck):
+        (JSC::FTL::LowerDFGToLLVM::isNotCellOrMisc):
+        (JSC::FTL::LowerDFGToLLVM::isNumber):
+        (JSC::FTL::LowerDFGToLLVM::isNotNumber):
+        (JSC::FTL::LowerDFGToLLVM::isBoolean):
+        * ftl/FTLOSRExitCompiler.cpp:
+        * tests/stress/is-undefined-exit-on-masquerader.js: Added.
+        (bar):
+        (foo):
+        (test):
+        * tests/stress/is-undefined-jettison-on-masquerader.js: Added.
+        (foo):
+        (test):
+        * tests/stress/is-undefined-masquerader.js: Added.
+        (foo):
+        (test):
+
+2014-03-13  Mark Lam  <mark.lam@apple.com>
+
+        JS benchmarks crash with a bus error on 32-bit x86.
+        <https://webkit.org/b/130203>
+
+        Reviewed by Geoffrey Garen.
+
+        The issue is that generateGetByIdStub() can potentially use the same register
+        for the JSValue base register and the target tag register.  After loading the
+        tag value into the target tag register, the JSValue base address is lost.
+        The code then proceeds to load the payload value using the base register, and
+        this results in a crash.
+
+        The fix is to check if the base register is the same as the target tag register.
+        If so, we should make a copy the base register first before loading the tag
+        value, and use the copy to load the payload value instead.
+
+        * jit/Repatch.cpp:
+        (JSC::generateGetByIdStub):
+
+2014-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        WebKit shouldn't crash on uniprocessor machines
+        https://bugs.webkit.org/show_bug.cgi?id=130176
+
+        Reviewed by Michael Saboff.
+        
+        Previously the math for computing the number of JIT compiler threads would come up with
+        zero threads on uniprocessor machines, and then the Worklist code would assert.
+
+        * runtime/Options.cpp:
+        (JSC::computeNumberOfWorkerThreads):
+        * runtime/Options.h:
+
+2014-03-13  Radu Stavila  <stavila@adobe.com>
+
+        Webkit not building on XCode 5.1 due to garbage collection no longer being supported
+        https://bugs.webkit.org/show_bug.cgi?id=130087
+
+        Reviewed by Mark Rowe.
+
+        Disable garbage collection on macosx when not using internal SDK.
+
+        * Configurations/Base.xcconfig:
+
+2014-03-10  Darin Adler  <darin@apple.com>
+
+        Avoid copy-prone idiom "for (auto item : collection)"
+        https://bugs.webkit.org/show_bug.cgi?id=129990
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/CodeBlockSet.h:
+        (JSC::CodeBlockSet::iterate): Use auto& to be sure we don't copy by accident.
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionLog): Use auto* to
+        make explicit that we are iterating through pointers.
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionSound): Ditto.
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe): Ditto.
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::removeBreakpoint): Use auto&, and also
+        get rid of an unneeded local variable.
+
+2014-03-13  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: Remove unused callId parameter from evaluateInWebInspector
+        https://bugs.webkit.org/show_bug.cgi?id=129744
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::enable):
+        (Inspector::InspectorAgent::evaluateForTestInFrontend):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/protocol/InspectorDomain.json:
+
+2014-03-11  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument
+        https://bugs.webkit.org/show_bug.cgi?id=130069
+
+        Reviewed by Geoffrey Garen.
+        
+        This was a great assertion, and it represents our strictest interpretation of the rules of
+        our intermediate representation. However, fixing DCE to actually preserve the relevant
+        property would be hard, and it wouldn't have an observable effect right now because nobody
+        actually uses the propery of CPS that this assertion is checking for.
+        
+        In particular, we do always require, and rely on, the fact that non-captured variables
+        have variablesAtTail refer to the last interesting use of the variable: a SetLocal if the
+        block assigns to the variable, a GetLocal if it only reads from it, and a Flush,
+        PhantomLocal, or Phi otherwise. We do preserve this property successfully and DCE was not
+        broken in this regard. But, in the strictest sense, CPS also means that for captured
+        variables, variablesAtTail also continues to point to the last relevant use of the
+        variable. In particular, if there are multiple GetLocals, then it should point to the last
+        one. This is hard for DCE to preserve. Also, nobody relies on variablesAtTail for captured
+        variables, except to check the VariableAccessData; but in that case, we don't really need
+        the *last* relevant use of the variable - any node that mentions the same variable will do
+        just fine.
+        
+        So, this change loosens the assertion and adds a detailed FIXME describing what we would
+        have to do if we wanted to preserve the more strict property.
+        
+        This also makes changes to various debug printing paths so that validation doesn't crash
+        during graph dump. This also adds tests for the interesting cases of DCE failing to
+        preserve CPS in the strictest sense. This also attempts to win the record for longest test
+        name.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hashAsStringIfPossible):
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * bytecode/CodeBlock.h:
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::hashAsStringIfPossible):
+        (JSC::InlineCallFrame::dumpBriefFunctionInformation):
+        * bytecode/CodeOrigin.h:
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::run):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::cleanVariables):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        * runtime/FunctionExecutableDump.cpp:
+        (JSC::FunctionExecutableDump::dump):
+        * tests/stress/dead-access-to-captured-variable-preceded-by-a-live-store-in-function-with-multiple-basic-blocks.js: Added.
+        (foo):
+        * tests/stress/dead-access-to-captured-variable-preceded-by-a-live-store.js: Added.
+        (foo):
+
+2014-03-12  Brian Burg  <bburg@apple.com>
+
+        Web Replay: add infrastructure for memoizing nondeterministic DOM APIs
+        https://bugs.webkit.org/show_bug.cgi?id=129445
+
+        Reviewed by Timothy Hatcher.
+
+        There was a bug in the replay inputs code generator that would include
+        headers for definitions of enum classes, even though they can be safely
+        forward-declared.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Generator.generate_includes): Only include for copy constructor if the
+        type is a heavy scalar (i.e., String, URL), not a normal scalar
+        (i.e., int, double, enum classes).
+
+        (Generator.generate_type_forward_declarations): Forward-declare scalars
+        that are enums or enum classes.
+
+2014-03-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Disable REMOTE_INSPECTOR in earlier OS X releases
+        https://bugs.webkit.org/show_bug.cgi?id=130118
+
+        Reviewed by Timothy Hatcher.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-03-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Hang in Remote Inspection triggering breakpoint from console
+        https://bugs.webkit.org/show_bug.cgi?id=130032
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/EventLoop.h:
+        * inspector/EventLoop.cpp:
+        (Inspector::EventLoop::remoteInspectorRunLoopMode):
+        (Inspector::EventLoop::cycle):
+        Expose the run loop mode name so it can be used if needed by others.
+
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorBlock::RemoteInspectorBlock):
+        (Inspector::RemoteInspectorBlock::~RemoteInspectorBlock):
+        (Inspector::RemoteInspectorBlock::operator=):
+        (Inspector::RemoteInspectorBlock::operator()):
+        (Inspector::RemoteInspectorQueueTask):
+        Instead of a dispatch_queue, have our own static Vector of debugger tasks.
+
+        (Inspector::RemoteInspectorHandleRunSource):
+        (Inspector::RemoteInspectorInitializeQueue):
+        Initialize the static queue and run loop source. When the run loop source
+        fires, it will exhaust the queue of debugger messages.
+
+        (Inspector::RemoteInspectorDebuggableConnection::RemoteInspectorDebuggableConnection):
+        (Inspector::RemoteInspectorDebuggableConnection::~RemoteInspectorDebuggableConnection):
+        When we get a debuggable connection add a run loop source for inspector commands.
+
+        (Inspector::RemoteInspectorDebuggableConnection::dispatchAsyncOnDebuggable):
+        (Inspector::RemoteInspectorDebuggableConnection::sendMessageToBackend):
+        Enqueue blocks on our Vector instead of our dispatch_queue.
+
+2014-03-12  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r165482.
+        https://bugs.webkit.org/show_bug.cgi?id=130157
+
+        Broke the windows build; "error C2466: cannot allocate an
+        array of constant size 0" (Requested by jernoble on #webkit).
+
+        Reverted changeset:
+
+        "Reduce memory use for static property maps"
+        https://bugs.webkit.org/show_bug.cgi?id=129986
+        http://trac.webkit.org/changeset/165482
+
+2014-03-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove HandleSet::m_nextToFinalize
+        https://bugs.webkit.org/show_bug.cgi?id=130109
+
+        Reviewed by Mark Lam.
+
+        This is a remnant of when HandleSet contained things that needed to be finalized. 
+
+        * heap/HandleSet.cpp:
+        (JSC::HandleSet::HandleSet):
+        (JSC::HandleSet::writeBarrier):
+        * heap/HandleSet.h:
+        (JSC::HandleSet::allocate):
+        (JSC::HandleSet::deallocate):
+
+2014-03-12  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Layout Test fast/workers/worker-gc.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=130135
+
+        Reviewed by Geoffrey Garen.
+
+        When removing MarkedBlocks, we always expect them to be in the MarkedAllocator's 
+        main list of blocks, i.e. not in the retired list. When shutting down the VM this
+        wasn't always the case which was causing ASSERTs to fire. We should rearrange things 
+        so that allocators are notified with lastChanceToFinalize. This will give them 
+        the chance to move their retired blocks back into the main list before removing them all.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::LastChanceToFinalize::operator()):
+        (JSC::MarkedAllocator::lastChanceToFinalize):
+        * heap/MarkedAllocator.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::LastChanceToFinalize::operator()):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+
+2014-03-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reduce memory use for static property maps
+        https://bugs.webkit.org/show_bug.cgi?id=129986
+
+        Reviewed by Andreas Kling.
+
+        Static property tables are currently duplicated on first use from read-only memory into dirty memory
+        in every process, and since the entries are large (48 bytes) and the tables can be unusually sparse
+        (we use a custom hash table without a rehash) a lot of memory may be wasted.
+
+        First, reduce the size of the hashtable. Instead of storing values in the table the hashtable maps
+        from string hashes to indicies into a densely packed array of values. Compute the index table at
+        compile time as a part of the derived sources step, such that this may be read-only data.
+
+        Second, don't copy all data from the HashTableValue array into a HashEntry objects. Instead refer
+        directly to the HashTableValue entries. The only data that needs to be allocated at runtime are the
+        keys, which are Identifiers.
+
+        * create_hash_table:
+            - emit the hash table index into the derived source (we were calculating this already to ensure chaining does not get too deep).
+        * parser/Lexer.cpp:
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        (JSC::Lexer<T>::parseIdentifierSlowCase):
+            - HashEntry -> HashTableValue.
+        * parser/Lexer.h:
+        (JSC::Keywords::getKeyword):
+            - HashEntry -> HashTableValue.
+        * runtime/ClassInfo.h:
+            - removed HashEntry.
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+            - use HashTable::ConstIterator.
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::findPropertyHashEntry):
+            - HashEntry -> HashTableValue.
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+            - changed HashTable::ConstIterator interface.
+        * runtime/JSObject.h:
+            - HashEntry -> HashTableValue.
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+            - table -> keys, keys array is now densely packed.
+        (JSC::HashTable::deleteTable):
+            - table -> keys.
+        (JSC::setUpStaticFunctionSlot):
+            - HashEntry -> HashTableValue.
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::builtinGenerator):
+        (JSC::HashTableValue::function):
+        (JSC::HashTableValue::functionLength):
+        (JSC::HashTableValue::propertyGetter):
+        (JSC::HashTableValue::propertyPutter):
+        (JSC::HashTableValue::lexerValue):
+            - added accessor methods from HashEntry.
+        (JSC::HashTable::copy):
+            - fields changed.
+        (JSC::HashTable::initializeIfNeeded):
+            - table -> keys.
+        (JSC::HashTable::entry):
+            - HashEntry -> HashTableValue.
+        (JSC::HashTable::ConstIterator::ConstIterator):
+            - iterate packed value array, so no need to skipInvalidKeys().
+        (JSC::HashTable::ConstIterator::value):
+        (JSC::HashTable::ConstIterator::key):
+        (JSC::HashTable::ConstIterator::operator->):
+            - accessors now get HashTableValue/StringImpl* separately.
+        (JSC::HashTable::ConstIterator::operator++):
+            - iterate packed value array, so no need to skipInvalidKeys().
+        (JSC::HashTable::end):
+            - end is now size of dense not sparse array.
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+        (JSC::getStaticValueSlot):
+        (JSC::putEntry):
+        (JSC::lookupPut):
+            - HashEntry -> HashTableValue.
+
+2014-03-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to build WebKit with FTL on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=130116
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+
+2014-03-10  Filip Pizlo  <fpizlo@apple.com>
+
+        GetById list caching should use something object-oriented rather than PolymorphicAccessStructureList
+        https://bugs.webkit.org/show_bug.cgi?id=129778
+
+        Reviewed by Geoffrey Garen.
+        
+        Also deduplicate the GetById getter call caching. Also add some small tests for
+        get stubs.
+        
+        This change reduces the amount of code involved in GetById access caching and it
+        creates data structures that can serve as an elegant scaffold for introducing other
+        kinds of caches or improving current caching styles. It will definitely make getter
+        performance improvements easier to implement.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/PolymorphicGetByIdList.cpp: Added.
+        (JSC::GetByIdAccess::GetByIdAccess):
+        (JSC::GetByIdAccess::~GetByIdAccess):
+        (JSC::GetByIdAccess::fromStructureStubInfo):
+        (JSC::GetByIdAccess::visitWeak):
+        (JSC::PolymorphicGetByIdList::PolymorphicGetByIdList):
+        (JSC::PolymorphicGetByIdList::from):
+        (JSC::PolymorphicGetByIdList::~PolymorphicGetByIdList):
+        (JSC::PolymorphicGetByIdList::currentSlowPathTarget):
+        (JSC::PolymorphicGetByIdList::addAccess):
+        (JSC::PolymorphicGetByIdList::isFull):
+        (JSC::PolymorphicGetByIdList::isAlmostFull):
+        (JSC::PolymorphicGetByIdList::didSelfPatching):
+        (JSC::PolymorphicGetByIdList::visitWeak):
+        * bytecode/PolymorphicGetByIdList.h: Added.
+        (JSC::GetByIdAccess::GetByIdAccess):
+        (JSC::GetByIdAccess::isSet):
+        (JSC::GetByIdAccess::operator!):
+        (JSC::GetByIdAccess::type):
+        (JSC::GetByIdAccess::structure):
+        (JSC::GetByIdAccess::chain):
+        (JSC::GetByIdAccess::chainCount):
+        (JSC::GetByIdAccess::stubRoutine):
+        (JSC::GetByIdAccess::doesCalls):
+        (JSC::PolymorphicGetByIdList::isEmpty):
+        (JSC::PolymorphicGetByIdList::size):
+        (JSC::PolymorphicGetByIdList::at):
+        (JSC::PolymorphicGetByIdList::operator[]):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::isGetByIdAccess):
+        (JSC::StructureStubInfo::initGetByIdList):
+        * jit/Repatch.cpp:
+        (JSC::generateGetByIdStub):
+        (JSC::tryCacheGetByID):
+        (JSC::patchJumpToGetByIdStub):
+        (JSC::tryBuildGetByIDList):
+        (JSC::tryBuildPutByIdList):
+        * tests/stress/getter.js: Added.
+        (foo):
+        (.o):
+        * tests/stress/polymorphic-prototype-accesses.js: Added.
+        (Foo):
+        (Bar):
+        (foo):
+        * tests/stress/prototype-getter.js: Added.
+        (Foo):
+        (foo):
+        * tests/stress/simple-prototype-accesses.js: Added.
+        (Foo):
+        (foo):
+
+2014-03-11  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        MarkedBlocks that are "full enough" shouldn't be swept after EdenCollections
+        https://bugs.webkit.org/show_bug.cgi?id=129920
+
+        Reviewed by Geoffrey Garen.
+
+        This patch introduces the notion of "retiring" MarkedBlocks. We retire a MarkedBlock
+        when the amount of free space in a MarkedBlock drops below a certain threshold.
+        Retired blocks are not considered for sweeping.
+
+        This is profitable because it reduces churn during sweeping. To build a free list, 
+        we have to scan through each cell in a block. After a collection, all objects that 
+        are live in the block will remain live until the next FullCollection, at which time
+        we un-retire all previously retired blocks. Thus, a small number of objects in a block
+        that die during each EdenCollection could cause us to do a disproportiante amount of 
+        sweeping for how much free memory we get back.
+
+        This patch looks like a consistent ~2% progression on boyer and is neutral everywhere else.
+
+        * heap/Heap.h:
+        (JSC::Heap::didRetireBlockWithFreeListSize):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::reset):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::forEachBlock):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper):
+        (JSC::MarkedBlock::clearMarksWithCollectionType):
+        (JSC::MarkedBlock::didRetireBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::willRemoveBlock):
+        (JSC::MarkedBlock::isLive):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        (JSC::MarkedSpace::clearMarks):
+        * runtime/Options.h:
+
+2014-03-11  Andreas Kling  <akling@apple.com>
+
+        Streamline PropertyTable for lookup-only access.
+        <https://webkit.org/b/130060>
+
+        The PropertyTable lookup algorithm was written to support both read
+        and write access. This wasn't actually needed in most places.
+
+        This change adds a PropertyTable::get() that just returns the value
+        type (instead of an insertion iterator.) It also adds an early return
+        for empty tables.
+
+        Finally, up the minimum table capacity from 8 to 16. It was lowered
+        to 8 in order to save memory, but that was before PropertyTables were
+        GC allocated. Nowadays we don't have nearly as many tables, since all
+        the unpinned transitions die off.
+
+        Reviewed by Darin Adler.
+
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::get):
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+
+2014-03-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        REGRESSION(r165407): DoYouEvenBench crashes in DRT
+        https://bugs.webkit.org/show_bug.cgi?id=130066
+
+        Reviewed by Geoffrey Garen.
+
+        The baseline JIT does a conditional store barrier for the put_by_id, but we need 
+        an unconditional store barrier so that we cover the butterfly case as well in emitPutTransitionStub.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitWriteBarrier):
+
+2014-03-10  Mark Lam  <mark.lam@apple.com>
+
+        Resurrect bit-rotted JIT::probe() mechanism.
+        <https://webkit.org/b/130067>
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITStubs.cpp:
+        - Added the needed #include <wtf/InlineASM.h>.
+
+2014-03-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix typo in EXCLUDED_SOURCE_FILE_NAMES_iphoneos.
+
+        Rubber-stamped by Dan Bernstein.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2014-03-10  Mark Lam  <mark.lam@apple.com>
+
+        r165414 broke the 32-bit x86 tests: ASSERTION FAILED: result != InvalidIndex @ GPRInfo.h:330.
+        <https://webkit.org/b/130065>
+
+        Reviewed by Michael Saboff.
+
+        There is code in ScratchRegisterAllocator.cpp that is relying on GPRInfo::toIndex()
+        being able to return InvalidIndex.  Hence, the assertion is invalid.  Ditto for
+        FPRInfo::toIndex().
+
+        The fix is to remove the "result != InvalidIndex" assertions.
+
+        * jit/FPRInfo.h:
+        (JSC::FPRInfo::toIndex):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toIndex):
+
+2014-03-10  Mark Lam  <mark.lam@apple.com>
+
+        Crash on a stack overflow on 32-bit x86 in http/tests/websocket/tests/hybi/workers/no-onmessage-in-sync-op.html.
+        <https://webkit.org/b/129955>
+
+        Reviewed by Geoffrey Garen.
+
+        The 32-bit x86 version of getHostCallReturnValue() was leaking 16 bytes
+        stack memory every time it was called.  This is now fixed.
+
+        * jit/JITOperations.cpp:
+
+2014-03-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Better JSContext API for named evaluations (other than //# sourceURL)
+        https://bugs.webkit.org/show_bug.cgi?id=129911
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSBase.h:
+        * API/JSContext.h:
+        * API/JSContext.mm:
+        (-[JSContext evaluateScript:]):
+        (-[JSContext evaluateScript:withSourceURL:]):
+        Add new evaluateScript:withSourceURL:.
+
+        * API/tests/testapi.c:
+        (main):
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI):
+        Add tests for sourceURL in evaluate APIs. It should
+        affect the exception objects.
+
+2014-03-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Repatch should save and restore all used registers - not just temp ones - when making a call
+        https://bugs.webkit.org/show_bug.cgi?id=130041
+
+        Reviewed by Geoffrey Garen and Mark Hahnenberg.
+        
+        The save/restore code was written back when the only client was the DFG, which only uses a
+        subset of hardware registers: the "temp" registers in our lingo. But the FTL may use many
+        other registers, especially on ARM64. The fact that Repatch doesn't know to save those can
+        lead to data corruption on ARM64. 
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::calleeSaveRegisters):
+        (JSC::RegisterSet::numberOfSetGPRs):
+        (JSC::RegisterSet::numberOfSetFPRs):
+        * jit/RegisterSet.h:
+        * jit/Repatch.cpp:
+        (JSC::storeToWriteBarrierBuffer):
+        (JSC::emitPutTransitionStub):
+        * jit/ScratchRegisterAllocator.cpp:
+        (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        (JSC::ScratchRegisterAllocator::usedRegistersForCall):
+        (JSC::ScratchRegisterAllocator::desiredScratchBufferSizeForCall):
+        (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall):
+        (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall):
+        * jit/ScratchRegisterAllocator.h:
+
+2014-03-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove ConditionalStore barrier
+        https://bugs.webkit.org/show_bug.cgi?id=130040
+
+        Reviewed by Geoffrey Garen.
+
+        ConditionalStoreBarrier was created when barriers were much more expensive. Now that 
+        they're cheap(er), we can get rid of them. This also allows us to get rid of the write 
+        barrier logic in emitPutTransitionStub because we always will have executed a write barrier 
+        on the base object in the case where we are allocating and storing a new Butterfly into it. 
+        Previously, a ConditionalStoreBarrier might or might not have barrier-ed the base object, 
+        so we'd have to emit a write barrier in the transition case.
+
+        This is performance neutral on the benchmarks we track.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::insertStoreBarrier):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isStoreBarrier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStub):
+
+2014-03-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG and FTL should know that comparing anything to Misc is cheap and easy
+        https://bugs.webkit.org/show_bug.cgi?id=130001
+
+        Reviewed by Geoffrey Garen.
+        
+        - Expand CompareStrictEq(Misc:, Misc:) to work for cases where either side of the
+          comparison is just Untyped:.
+        
+        - This obviates the need for CompareStrictEqConstant, so remove it.
+        
+        - FTL had a thing called "Nully" which is really "Other". Rename it and add
+          OtherUse.
+        
+        9% speed-up on box2d.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isBinaryUseKind):
+        (JSC::DFG::Node::shouldSpeculateOther):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::isNotOther):
+        (JSC::FTL::LowerDFGToLLVM::isOther):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+        (JSC::FTL::LowerDFGToLLVM::speculateNotCell):
+        (JSC::FTL::LowerDFGToLLVM::speculateOther):
+        (JSC::FTL::LowerDFGToLLVM::speculateMisc):
+        * tests/stress/compare-strict-eq-integer-to-misc.js: Added.
+
+2014-03-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, remove unintended change.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+
+2014-03-10  Filip Pizlo  <fpizlo@apple.com>
+
+        jsc commandline shouldn't have a "console" because that confuses some tests into thinking
+        that they're running in the browser.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+
+2014-03-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Out-line ScratchRegisterAllocator
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * jit/ScratchRegisterAllocator.cpp: Added.
+        (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        (JSC::ScratchRegisterAllocator::~ScratchRegisterAllocator):
+        (JSC::ScratchRegisterAllocator::lock):
+        (JSC::ScratchRegisterAllocator::allocateScratch):
+        (JSC::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        (JSC::ScratchRegisterAllocator::desiredScratchBufferSize):
+        (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
+        (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
+        * jit/ScratchRegisterAllocator.h:
+
+2014-03-10  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Pass environment to Pre-Build, Pre-link, and Post-Build Stages.
+        https://bugs.webkit.org/show_bug.cgi?id=130023
+
+        Reviewed by Dean Jackson.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj: Avoid trailing backslashes in
+        path names to avoid accidental escaping of later string substitutions.
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for testb_i8r when register is accumulator.
+        <https://webkit.org/b/130026>
+
+        Generate the shorthand version of "test al, imm" when possible.
+
+        Reviewed by Michael Saboff.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testb_i8r):
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for sub_ir when register is accumulator.
+        <https://webkit.org/b/130025>
+
+        Generate the shorthand version of "sub eax, imm" when possible.
+
+        Reviewed by Michael Saboff.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::subl_ir):
+        (JSC::X86Assembler::subq_ir):
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for add_ir when register is accumulator.
+        <https://webkit.org/b/130024>
+
+        Generate the shorthand version of "add eax, imm" when possible.
+
+        Reviewed by Michael Saboff.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addl_ir):
+        (JSC::X86Assembler::addq_ir):
+
+2014-03-10  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        writeBarrier in emitPutReplaceStub is unnecessary
+        https://bugs.webkit.org/show_bug.cgi?id=130030
+
+        Reviewed by Filip Pizlo.
+
+        We already emit write barriers for each put-by-id when they're first compiled, so it's 
+        redundant to emit a write barrier as part of the repatched code.
+
+        * jit/Repatch.cpp:
+        (JSC::emitPutReplaceStub):
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for xor_ir when register is accumulator.
+        <https://webkit.org/b/130008>
+
+        Generate the shorthand version of "xor eax, imm" when possible.
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::xorl_ir):
+        (JSC::X86Assembler::xorq_ir):
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for or_ir when register is accumulator.
+        <https://webkit.org/b/130007>
+
+        Generate the shorthand version of "or eax, imm" when possible.
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::orl_ir):
+        (JSC::X86Assembler::orq_ir):
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for test_ir when register is accumulator.
+        <https://webkit.org/b/130006>
+
+        Generate the shorthand version of "test eax, imm" when possible.
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::testq_i32r):
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for cmp_ir when register is accumulator.
+        <https://webkit.org/b/130005>
+
+        Generate the shorthand version of "cmp eax, imm" when possible.
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpl_ir):
+        (JSC::X86Assembler::cmpq_ir):
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for store64(imm, address) when imm fits in 32 bits.
+        <https://webkit.org/b/130002>
+
+        Generate this:
+
+            mov [address], imm32
+
+        Instead of this:
+
+            mov scratchRegister, imm32
+            mov [address], scratchRegister
+
+        For store64(imm, address) where the 64-bit immediate can be passed as
+        a sign-extended 32-bit value.
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (CAN_SIGN_EXTEND_32_64):
+        (JSC::MacroAssemblerX86_64::store64):
+
+2014-03-10  Andreas Kling  <akling@apple.com>
+
+        [X86_64] Smaller code for xchg_rr when one register is accumulator.
+        <https://webkit.org/b/130004>
+
+        Generate the 1-byte version of "xchg eax, reg" when possible.
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::xchgl_rr):
+        (JSC::X86Assembler::xchgq_rr):
+
+2014-03-09  Filip Pizlo  <fpizlo@apple.com>
+
+        GPRInfo::toIndex should return InvalidIndex for non-temp registers on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=129998
+
+        Reviewed by Geoffrey Garen.
+        
+        Not only is that the established contract, but this is used to signal to
+        ScratchRegisterAllocator that the register doesn't need locking since it isn't a register
+        that this allocator would use. In the FTL, we may have an inline cache where LLVM had used
+        some non-temp register (i.e. a register that JSC itself wouldn't have used). This is totally
+        fine but previously it would have led to either an assertion failure, or data corruption, in
+        the ScratchRegisterAllocator.
+
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toIndex):
+
+2014-03-09  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL fails the new equals-masquerader strictEqualConstant test
+        https://bugs.webkit.org/show_bug.cgi?id=129996
+
+        Reviewed by Mark Lam.
+        
+        It turns out that the FTL was trying to do the masquerading stuff for ===null. But
+        that's wrong since none of the other engines do it. The DFG even had an ancient
+        FIXME about doing it - but that doesn't make sense since the LLInt and baseline JIT
+        don't do it and JSValue::strictEqual() doesn't do it.
+        
+        Remove the FIXME and remove the extra checks in the FTL.
+        
+        This is a glorious patch: nothing but red and it fixes a test failure.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEqConstant):
+
+2014-03-09  Andreas Kling  <akling@apple.com>
+
+        Short-circuit JSGlobalObjectInspectorController when not inspecting.
+        <https://webkit.org/b/129995>
+
+        Add an early return in reportAPIException() when the console agent
+        is disabled. This avoids expensive symbolication during exceptions
+        if there's nobody expecting the fancy backtrace anyway.
+
+        ~2% progression on DYEB on my MBP.
+
+        Reviewed by Geoff Garen.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+
+2014-03-09  Andreas Kling  <akling@apple.com>
+
+        Inline the trivial parts of GC deferral.
+        <https://webkit.org/b/129984>
+
+        Made most of the functions called by the DeferGC RAII object inline
+        to avoid function call overhead.
+
+        Looks like ~1% progression on DYEB.
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp:
+        * heap/Heap.h:
+        (JSC::Heap::incrementDeferralDepth):
+        (JSC::Heap::decrementDeferralDepth):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
+
+2014-03-08  Mark Lam  <mark.lam@apple.com>
+
+        32-bit x86 handleUncaughtException returns to wrong location after a stack overflow.
+        <https://webkit.org/b/129969>
+
+        Reviewed by Geoffrey Garen.
+
+        The 32-bit version of handleUncaughtException was missing the handling of an
+        edge case for stack overflows where the current frame may already be the
+        sentinel frame.  This edge case was handled in the 64-bit version.  The fix
+        is to bring the 32-bit version up to parity.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * llint/LowLevelInterpreter32_64.asm:
+
+2014-03-07  Mark Lam  <mark.lam@apple.com>
+
+        Fix bugs in 32-bit Structure implementation.
+        <https://webkit.org/b/129947>
+
+        Reviewed by Mark Hahnenberg.
+
+        Added the loading of the Structure (from the JSCell) before use that was
+        missing in a few places.  Also added more test cases to equals-masquerader.js.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * llint/LowLevelInterpreter32_64.asm:
+        * tests/stress/equals-masquerader.js:
+        (equalsNull):
+        (notEqualsNull):
+        (strictEqualsNull):
+        (strictNotEqualsNull):
+        (equalsUndefined):
+        (notEqualsUndefined):
+        (strictEqualsUndefined):
+        (strictNotEqualsUndefined):
+        (isFalsey):
+        (test):
+
+2014-03-07  Andrew Trick  <atrick@apple.com>
+
+        Temporarily disable repeat-out-of-bounds stress tests pending fix for 129953.
+        https://bugs.webkit.org/show_bug.cgi?id=129954
+
+        Reviewed by Filip Pizlo.
+
+        * tests/stress/float32-repeat-out-of-bounds.js:
+        * tests/stress/int8-repeat-out-of-bounds.js:
+
+2014-03-07  Michael Saboff  <msaboff@apple.com>
+
+        .cfi directives in LowLevelInterpreter.cpp are providing no benefit
+        https://bugs.webkit.org/show_bug.cgi?id=129945
+
+        Reviewed by Mark Lam.
+
+        Removed .cfi directive.  Verified that stack traces didn't regress in crash reporter
+        or in lldb.
+
+        * llint/LowLevelInterpreter.cpp:
+
+2014-03-07  Oliver Hunt  <oliver@apple.com>
+
+        Continue hangs when performing for-of over arguments
+        https://bugs.webkit.org/show_bug.cgi?id=129915
+
+        Reviewed by Geoffrey Garen.
+
+        Put the continue label in the right place
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEnumeration):
+
+2014-03-07  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win64] Compile error after r165128.
+        https://bugs.webkit.org/show_bug.cgi?id=129807
+
+        Reviewed by Mark Lam.
+
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: 
+        Check platform environment variable to determine if an assembler file should be generated.
+
+2014-03-07  Michael Saboff  <msaboff@apple.com>
+
+        Clarify how we deal with "special" registers
+        https://bugs.webkit.org/show_bug.cgi?id=129806
+
+        Already reviewed change being relanded.
+
+        Relanding change set r165196 as it wasn't responsible for the breakage reported in
+        https://bugs.webkit.org/show_bug.cgi?id=129822.  That appears to be a build or
+
+        Reviewed by Michael Saboff.
+        configuration issue.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::lastRegister):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::nextRegister):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::restoreInto):
+        * ftl/FTLSaveRestore.cpp:
+        (JSC::FTL::saveAllRegisters):
+        (JSC::FTL::restoreAllRegisters):
+        * ftl/FTLSlowPathCall.cpp:
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::reservedHardwareRegisters):
+        (JSC::RegisterSet::runtimeRegisters):
+        (JSC::RegisterSet::specialRegisters):
+        (JSC::RegisterSet::calleeSaveRegisters):
+        * jit/RegisterSet.h:
+
+2014-03-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Move GCActivityCallback to heap
+        https://bugs.webkit.org/show_bug.cgi?id=129457
+
+        Reviewed by Geoffrey Garen.
+
+        All the other GC timer related stuff is there already.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/GCActivityCallback.cpp: Copied from Source/JavaScriptCore/runtime/GCActivityCallback.cpp.
+        * heap/GCActivityCallback.h: Copied from Source/JavaScriptCore/runtime/GCActivityCallback.h.
+        * runtime/GCActivityCallback.cpp: Removed.
+        * runtime/GCActivityCallback.h: Removed.
+
+2014-03-07  Andrew Trick  <atrick@apple.com>
+
+        Correct a comment typo from:
+        FLT should call fmod directly on platforms where LLVM cannot relocate the libcall
+        https://bugs.webkit.org/show_bug.cgi?id=129865
+
+        Reviewed by Mark Lam.
+
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleRem):
+
+2014-03-07  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Use OwnPtr in StructureIDTable
+        https://bugs.webkit.org/show_bug.cgi?id=129828
+
+        Reviewed by Geoffrey Garen.
+
+        This reduces the amount of boilerplate and fixes a memory leak.
+
+        * runtime/StructureIDTable.cpp:
+        (JSC::StructureIDTable::StructureIDTable):
+        (JSC::StructureIDTable::resize):
+        (JSC::StructureIDTable::flushOldTables):
+        (JSC::StructureIDTable::allocateID):
+        (JSC::StructureIDTable::deallocateID):
+        * runtime/StructureIDTable.h:
+        (JSC::StructureIDTable::table):
+        (JSC::StructureIDTable::get):
+
+2014-03-07  Andrew Trick  <atrick@apple.com>
+
+        FLT should call fmod directly on platforms where LLVM cannot relocate the libcall
+        https://bugs.webkit.org/show_bug.cgi?id=129865
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleRem):
+
+2014-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        If the FTL is build-time enabled then it should be run-time enabled.
+
+        Rubber stamped by Geoffrey Garen.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2014-03-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [OS X] Web Inspector: Allow Apps using JavaScriptCore to access "com.apple.webinspector" mach port
+        https://bugs.webkit.org/show_bug.cgi?id=129852
+
+        Reviewed by Geoffrey Garen.
+
+        * framework.sb: Added.
+        Sandbox extension to allow access to "com.apple.webinspector".
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add a Copy Resources build phase and include framework.sb.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        Do not copy framework.sb on iOS.
+
+2014-03-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSGlobalContextRelease incorrectly handles saving/restoring IdentifierTable
+        https://bugs.webkit.org/show_bug.cgi?id=129858
+
+        Reviewed by Mark Lam.
+
+        It was correct (but really ugly) prior to the combining of APIEntryShim and JSLock, 
+        but now it ends up overwriting the IdentifierTable that JSLock just restored.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextRelease):
+
+2014-03-06  Oliver Hunt  <oliver@apple.com>
+
+        Fix FTL build.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2014-03-06  Brent Fulgham  <bfulgham@apple.com>
+
+        Unreviewed build fix after r165128.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: The SEH flag was not getting set when
+        performing 'Production' and 'DebugSuffix' type builds.
+
+2014-03-06  Julien Brianceau  <jbriance@cisco.com>
+
+        Unreviewed, fix style in my previous commit.
+        https://bugs.webkit.org/show_bug.cgi?id=129833
+
+        * runtime/JSConsole.cpp:
+
+2014-03-06  Julien Brianceau  <jbriance@cisco.com>
+
+        Build fix: add missing include in JSConole.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=129833
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/JSConsole.cpp:
+
+2014-03-06  Oliver Hunt  <oliver@apple.com>
+
+        Fix ARMv7
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2014-03-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r165196.
+        http://trac.webkit.org/changeset/165196
+        https://bugs.webkit.org/show_bug.cgi?id=129822
+
+        broke arm64 on hardware (Requested by bfulgham on #webkit).
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::lastRegister):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::isStackRelated):
+        (JSC::MacroAssembler::firstRealRegister):
+        (JSC::MacroAssembler::nextRegister):
+        (JSC::MacroAssembler::secondRealRegister):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::restoreInto):
+        * ftl/FTLSaveRestore.cpp:
+        (JSC::FTL::saveAllRegisters):
+        (JSC::FTL::restoreAllRegisters):
+        * ftl/FTLSlowPathCall.cpp:
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::specialRegisters):
+        (JSC::RegisterSet::calleeSaveRegisters):
+        * jit/RegisterSet.h:
+
+2014-03-06  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION(r165205): broke the CLOOP build (Requested by smfr on #webkit).
+        <https://webkit.org/b/129813>
+
+        Reviewed by Michael Saboff.
+
+        Fixed broken C loop LLINT build.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * offlineasm/cloop.rb:
+
+2014-03-03  Oliver Hunt  <oliver@apple.com>
+
+        Support caching of custom setters
+        https://bugs.webkit.org/show_bug.cgi?id=129519
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds caching of assignment to properties that
+        are backed by C functions. This provides most of the leg
+        work required to start supporting setters, and resolves
+        the remaining regressions from moving DOM properties up
+        the prototype chain.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::visitWeak):
+        (JSC::PolymorphicPutByIdList::PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::from):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::replace):
+        (JSC::PutByIdAccess::customSetter):
+        (JSC::PutByIdAccess::isCustom):
+        (JSC::PutByIdAccess::oldStructure):
+        (JSC::PutByIdAccess::chain):
+        (JSC::PutByIdAccess::stubRoutine):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::dump):
+        * bytecode/PutByIdStatus.h:
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (JSC::PutByIdStatus::takesSlowPath):
+        (JSC::PutByIdStatus::makesCalls):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::emitPutById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitCustomSetterStub):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        * jit/SpillRegistersMode.h: Added.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setCacheableCustomProperty):
+        (JSC::PutPropertySlot::customSetter):
+        (JSC::PutPropertySlot::isCacheablePut):
+        (JSC::PutPropertySlot::isCacheableCustomProperty):
+        (JSC::PutPropertySlot::cachedOffset):
+
+2014-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL arity fixup should work on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=129810
+
+        Reviewed by Michael Saboff.
+        
+        - Using regT5 to pass the thunk return address to arityFixup is shady since that's a
+          callee-save.
+        
+        - The FTL path was assuming X86 conventions for where SP points at the top of the prologue.
+        
+        This makes some more tests pass.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::prologueStackPointerDelta):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/ThunkGenerators.cpp:
+        (JSC::arityFixup):
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/arm64.rb:
+        * offlineasm/x86.rb: In addition to the t7 change, make t6 agree with GPRInfo.h.
+
+2014-03-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix write barriers in Repatch.cpp for !ENABLE(DFG_JIT) platforms after r165128
+        https://bugs.webkit.org/show_bug.cgi?id=129760
+
+        Reviewed by Geoffrey Garen.
+
+        r165128 disabled the write barrier fast path for inline caches on !ENABLE(DFG_JIT) platforms. 
+        The fix is to refactor the write barrier code into AssemblyHelpers and use that everywhere.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::checkMarkByte):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        * jit/Repatch.cpp:
+        (JSC::writeBarrier):
+
+2014-03-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Expose the console object in JSContexts to interact with Web Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=127944
+
+        Reviewed by Geoffrey Garen.
+
+        Always expose the Console object in JSContexts, just like we
+        do for web pages. The default behavior will route to an
+        attached JSContext inspector. This can be overriden by
+        setting the ConsoleClient on the JSGlobalObject, which WebCore
+        does to get slightly different behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Update build systems.
+
+        * API/tests/testapi.js:
+        * API/tests/testapi.mm:
+        Test that "console" exists in C and ObjC contexts.
+
+        * runtime/ConsoleClient.cpp: Added.
+        (JSC::ConsoleClient::printURLAndPosition):
+        (JSC::ConsoleClient::printMessagePrefix):
+        (JSC::ConsoleClient::printConsoleMessage):
+        (JSC::ConsoleClient::printConsoleMessageWithArguments):
+        (JSC::ConsoleClient::internalMessageWithTypeAndLevel):
+        (JSC::ConsoleClient::logWithLevel):
+        (JSC::ConsoleClient::clear):
+        (JSC::ConsoleClient::dir):
+        (JSC::ConsoleClient::dirXML):
+        (JSC::ConsoleClient::table):
+        (JSC::ConsoleClient::trace):
+        (JSC::ConsoleClient::assertCondition):
+        (JSC::ConsoleClient::group):
+        (JSC::ConsoleClient::groupCollapsed):
+        (JSC::ConsoleClient::groupEnd):
+        * runtime/ConsoleClient.h: Added.
+        (JSC::ConsoleClient::~ConsoleClient):
+        New private interface for handling the console object's methods.
+        A lot of the methods funnel through messageWithTypeAndLevel.
+
+        * runtime/ConsoleTypes.h: Renamed from Source/JavaScriptCore/inspector/ConsoleTypes.h.
+        Moved to JSC namespace.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        Create the "console" object when initializing the environment.
+        Also set the default console client to be the JS context inspector.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setConsoleClient):
+        (JSC::JSGlobalObject::consoleClient):
+        Ability to change the console client, so WebCore can set a custom client.
+
+        * runtime/ConsolePrototype.cpp: Added.
+        (JSC::ConsolePrototype::finishCreation):
+        (JSC::valueToStringWithUndefinedOrNullCheck):
+        (JSC::consoleLogWithLevel):
+        (JSC::consoleProtoFuncDebug):
+        (JSC::consoleProtoFuncError):
+        (JSC::consoleProtoFuncLog):
+        (JSC::consoleProtoFuncWarn):
+        (JSC::consoleProtoFuncClear):
+        (JSC::consoleProtoFuncDir):
+        (JSC::consoleProtoFuncDirXML):
+        (JSC::consoleProtoFuncTable):
+        (JSC::consoleProtoFuncTrace):
+        (JSC::consoleProtoFuncAssert):
+        (JSC::consoleProtoFuncCount):
+        (JSC::consoleProtoFuncProfile):
+        (JSC::consoleProtoFuncProfileEnd):
+        (JSC::consoleProtoFuncTime):
+        (JSC::consoleProtoFuncTimeEnd):
+        (JSC::consoleProtoFuncTimeStamp):
+        (JSC::consoleProtoFuncGroup):
+        (JSC::consoleProtoFuncGroupCollapsed):
+        (JSC::consoleProtoFuncGroupEnd):
+        * runtime/ConsolePrototype.h: Added.
+        (JSC::ConsolePrototype::create):
+        (JSC::ConsolePrototype::createStructure):
+        (JSC::ConsolePrototype::ConsolePrototype):
+        Define the console object interface. Parse out required / expected
+        arguments and throw expcetions when methods are misused.
+
+        * runtime/JSConsole.cpp: Added.
+        * runtime/JSConsole.h: Added.
+        (JSC::JSConsole::createStructure):
+        (JSC::JSConsole::create):
+        (JSC::JSConsole::JSConsole):
+        Empty "console" object. Everything is in the prototype.
+
+        * inspector/JSConsoleClient.cpp: Added.
+        (Inspector::JSConsoleClient::JSGlobalObjectConsole):
+        (Inspector::JSConsoleClient::count):
+        (Inspector::JSConsoleClient::profile):
+        (Inspector::JSConsoleClient::profileEnd):
+        (Inspector::JSConsoleClient::time):
+        (Inspector::JSConsoleClient::timeEnd):
+        (Inspector::JSConsoleClient::timeStamp):
+        (Inspector::JSConsoleClient::warnUnimplemented):
+        (Inspector::JSConsoleClient::internalAddMessage):
+        * inspector/JSConsoleClient.h: Added.
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::consoleClient):
+        * inspector/JSGlobalObjectInspectorController.h:
+        Default JSContext ConsoleClient implementation. Handle nearly
+        everything exception profile/profileEnd and timeStamp.
+
+2014-03-06  Andreas Kling  <akling@apple.com>
+
+        Drop unlinked function code on memory pressure.
+        <https://webkit.org/b/129789>
+
+        Make VM::discardAllCode() also drop UnlinkedFunctionCodeBlocks that
+        are not currently being compiled.
+
+        4.5 MB progression on Membuster.
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllUnlinkedFunctionCode):
+        * heap/Heap.h:
+        * runtime/VM.cpp:
+        (JSC::VM::discardAllCode):
+
+2014-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Clarify how we deal with "special" registers
+        https://bugs.webkit.org/show_bug.cgi?id=129806
+
+        Reviewed by Michael Saboff.
+        
+        Previously we had two different places that defined what "stack" registers are, a thing
+        called "specialRegisters" that had unclear meaning, and a really weird "firstRealRegister"/
+        "secondRealRegister"/"nextRegister" idiom in MacroAssembler that appeared to only be used by
+        one place and had a baked-in notion of what it meant for a register to be "real" or not.
+        
+        It's not cool to use words like "real" and "special" to describe registers, especially if you
+        fail to qualify what that means. This originally made sense on X86 - "real" registers were
+        the ones that weren't "stack related" (so "real" was the opposite of "stack"). But on ARM64,
+        you also have to worry about the LR register, which we'd want to say is "not real" but it's
+        also not a "stack" register. This got super confusing.
+        
+        So, this patch removes any mention of "real" registers, consolidates the knowledge of what is
+        a "stack" register, and uses the word special only in places where it's clearly defined and
+        where no better word comes to mind.
+        
+        This cleans up the code and fixes what seems like it was probably a harmless ARM64 bug: the
+        Reg and RegisterSet data structures would sometimes think that FP was Q0. Somehow this
+        magically didn't break anything because you never need to save/restore either FP or Q0, but
+        it was still super weird.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::lastRegister):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::nextRegister):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::restoreInto):
+        * ftl/FTLSaveRestore.cpp:
+        (JSC::FTL::saveAllRegisters):
+        (JSC::FTL::restoreAllRegisters):
+        * ftl/FTLSlowPathCall.cpp:
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::reservedHardwareRegisters):
+        (JSC::RegisterSet::runtimeRegisters):
+        (JSC::RegisterSet::specialRegisters):
+        (JSC::RegisterSet::calleeSaveRegisters):
+        * jit/RegisterSet.h:
+
+2014-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build.
+
+        * disassembler/ARM64Disassembler.cpp:
+
+2014-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Use the LLVM disassembler on ARM64 if we are enabling the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=129785
+
+        Reviewed by Geoffrey Garen.
+        
+        Our disassembler can't handle some of the code sequences that LLVM emits. LLVM's disassembler
+        is strictly more capable at this point. Use it if it's available.
+
+        * disassembler/ARM64Disassembler.cpp:
+        (JSC::tryToDisassemble):
+
+2014-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Reduce RWI message frequency
+        https://bugs.webkit.org/show_bug.cgi?id=129767
+
+        Reviewed by Timothy Hatcher.
+
+        This used to be 0.2s and changed by accident to 0.02s.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::pushListingSoon):
+
+2014-03-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r165141, r165157, and r165158.
+        http://trac.webkit.org/changeset/165141
+        http://trac.webkit.org/changeset/165157
+        http://trac.webkit.org/changeset/165158
+        https://bugs.webkit.org/show_bug.cgi?id=129772
+
+        "broke ftl" (Requested by olliej_ on #webkit).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::visitWeak):
+        (JSC::PolymorphicPutByIdList::PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::from):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::replace):
+        (JSC::PutByIdAccess::oldStructure):
+        (JSC::PutByIdAccess::chain):
+        (JSC::PutByIdAccess::stubRoutine):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::dump):
+        * bytecode/PutByIdStatus.h:
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (JSC::PutByIdStatus::takesSlowPath):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::emitPutById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        * jit/SpillRegistersMode.h: Removed.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::isCacheable):
+        (JSC::PutPropertySlot::cachedOffset):
+
+2014-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Prevent possible deadlock in view indication
+        https://bugs.webkit.org/show_bug.cgi?id=129766
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::receivedIndicateMessage):
+
+2014-03-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSObject::fastGetOwnPropertySlot does a slow check for OverridesGetOwnPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=129754
+
+        Reviewed by Geoffrey Garen.
+
+        InlineTypeFlags are stored in JSCell, so we can just load those instead of going through the TypeInfo.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::inlineTypeFlags):
+        * runtime/JSObject.h:
+        (JSC::JSObject::fastGetOwnPropertySlot):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::overridesGetOwnPropertySlot):
+
+2014-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ASSERTION FAILED: m_javaScriptBreakpoints.isEmpty()
+        https://bugs.webkit.org/show_bug.cgi?id=129763
+
+        Reviewed by Geoffrey Garen.
+
+        Clear the list of all breakpoints, including unresolved breakpoints.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::clearInspectorBreakpointState):
+
+2014-03-05  Mark Lam  <mark.lam@apple.com>
+
+        llint_slow_path_check_has_instance() should not adjust PC before accessing operands.
+        <https://webkit.org/b/129768>
+
+        Reviewed by Mark Hahnenberg.
+
+        When evaluating "a instanceof b" where b is an object that ImplementsHasInstance
+        and OverridesHasInstance (e.g. a bound function), the LLINT will take the slow
+        path llint_slow_path_check_has_instance(), and execute a code path that does the
+        following:
+        1. Adjusts the byte code PC to the jump target PC.
+        2. For the purpose of storing the result, get the result registerIndex from the
+           1st operand using the PC as if the PC is still pointing to op_check_has_instance
+           bytecode.
+
+        The result is that whatever value resides after where the jump target PC is will
+        be used as a result register value.  Depending on what that value is, the result
+        can be:
+        1. the code coincidently works correctly
+        2. memory corruption
+        3. crashes
+
+        The fix is to only adjust the byte code PC after we have stored the result.
+        
+        * llint/LLIntSlowPaths.cpp:
+        (llint_slow_path_check_has_instance):
+
+2014-03-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Another build fix attempt after r165141.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+
+2014-03-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        FTL build fix attempt after r165141.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+
+2014-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=128625
+        Add fast mapping from StringImpl to JSString
+
+        Unreviewed roll-out.
+
+        Reverting r164347, r165054, r165066 - not clear the performance tradeoff was right.
+
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        * runtime/VM.cpp:
+        (JSC::VM::createLeaked):
+        * runtime/VM.h:
+
+2014-03-03  Oliver Hunt  <oliver@apple.com>
+
+        Support caching of custom setters
+        https://bugs.webkit.org/show_bug.cgi?id=129519
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds caching of assignment to properties that
+        are backed by C functions. This provides most of the leg
+        work required to start supporting setters, and resolves
+        the remaining regressions from moving DOM properties up
+        the prototype chain.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::visitWeak):
+        (JSC::PolymorphicPutByIdList::PolymorphicPutByIdList):
+        (JSC::PolymorphicPutByIdList::from):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::replace):
+        (JSC::PutByIdAccess::customSetter):
+        (JSC::PutByIdAccess::isCustom):
+        (JSC::PutByIdAccess::oldStructure):
+        (JSC::PutByIdAccess::chain):
+        (JSC::PutByIdAccess::stubRoutine):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::dump):
+        * bytecode/PutByIdStatus.h:
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (JSC::PutByIdStatus::takesSlowPath):
+        (JSC::PutByIdStatus::makesCalls):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::emitPutById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitCustomSetterStub):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        * jit/SpillRegistersMode.h: Added.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setCacheableCustomProperty):
+        (JSC::PutPropertySlot::customSetter):
+        (JSC::PutPropertySlot::isCacheablePut):
+        (JSC::PutPropertySlot::isCacheableCustomProperty):
+        (JSC::PutPropertySlot::cachedOffset):
+
+2014-03-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSCell::m_gcData should encode its information differently
+        https://bugs.webkit.org/show_bug.cgi?id=129741
+
+        Reviewed by Geoffrey Garen.
+
+        We want to keep track of three GC states for an object:
+
+        1. Not marked (which implies not in the remembered set)
+        2. Marked but not in the remembered set
+        3. Marked and in the remembered set
+        
+        Currently we only indicate marked vs. not marked in JSCell::m_gcData. During a write 
+        barrier, we only want to take the slow path if the object being stored to is in state #2. 
+        We'd like to make the test for state #2 as fast as possible, which means making it a 
+        compare against 0.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::osrWriteBarrier):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkMarkByte):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::allocateCell):
+        (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+        * heap/Heap.cpp:
+        (JSC::Heap::clearRememberedSet):
+        (JSC::Heap::addToRememberedSet):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::checkMarkByte):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::checkMarkByte):
+        (JSC::JIT::emitWriteBarrier):
+        * jit/Repatch.cpp:
+        (JSC::writeBarrier):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSCell.h:
+        (JSC::JSCell::mark):
+        (JSC::JSCell::remember):
+        (JSC::JSCell::forget):
+        (JSC::JSCell::isMarked):
+        (JSC::JSCell::isRemembered):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::JSCell):
+        * runtime/StructureIDBlob.h:
+        (JSC::StructureIDBlob::StructureIDBlob):
+
+2014-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        More FTL ARM fixes
+        https://bugs.webkit.org/show_bug.cgi?id=129755
+
+        Reviewed by Geoffrey Garen.
+        
+        - Be more defensive about inline caches that have degenerate chains.
+        
+        - Temporarily switch to allocating all MCJIT memory in the executable pool on non-x86
+          platforms. The bug tracking the real fix is: https://bugs.webkit.org/show_bug.cgi?id=129756
+        
+        - Don't even emit intrinsic declarations on non-x86 platforms.
+        
+        - More debug printing support.
+        
+        - Don't use vmCall() in the prologue. This should have crashed on all platforms all the time
+          but somehow it gets lucky on x86.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::appendVariant):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::appendVariant):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.h:
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::overlaps):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLDataSection.cpp:
+        (JSC::FTL::DataSection::DataSection):
+        (JSC::FTL::DataSection::~DataSection):
+        * ftl/FTLDataSection.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleSin):
+        (JSC::FTL::Output::doubleCos):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContext):
+        * runtime/JSCell.h:
+        (JSC::JSCell::structureID):
+
+2014-03-05  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win32][LLINT] Crash when running JSC stress tests.
+        https://bugs.webkit.org/show_bug.cgi?id=129429
+
+        On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
+        where the guard page is a barrier between committed and uncommitted memory.
+        When data from the guard page is read or written, the guard page is moved, and memory is committed.
+        This is how the system grows the stack.
+        When using the C stack on Windows we need to precommit the needed stack space.
+        Otherwise we might crash later if we access uncommitted stack memory.
+        This can happen if we allocate stack space larger than the page guard size (4K).
+        The system does not get the chance to move the guard page, and commit more memory,
+        and we crash if uncommitted memory is accessed.
+        The MSVC compiler fixes this by inserting a call to the _chkstk() function,
+        when needed, see http://support.microsoft.com/kb/100775.
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
+        * jit/Repatch.cpp:
+        (JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
+        * offlineasm/x86.rb: Compile fix, and small simplification.
+        * runtime/VM.cpp:
+        (JSC::preCommitStackMemory): Added function to precommit stack memory.
+        (JSC::VM::updateStackLimit): Call function to precommit stack memory when stack limit is updated.
+
+2014-03-05  Michael Saboff  <msaboff@apple.com>
+
+        JSDataViewPrototype::getData() and setData() crash on platforms that don't allow unaligned accesses
+        https://bugs.webkit.org/show_bug.cgi?id=129746
+
+        Reviewed by Filip Pizlo.
+
+        Changed to use a union to manually assemble or disassemble the various types
+        from / to the corresponding bytes.  All memory access is now done using
+        byte accesses.
+
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+
+2014-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL loadStructure always generates invalid IR
+        https://bugs.webkit.org/show_bug.cgi?id=129747
+
+        Reviewed by Mark Hahnenberg.
+
+        As the comment at the top of FTL::Output states, the FTL doesn't use LLVM's notion
+        of pointers. LLVM's notion of pointers tries to model C, in the sense that you have
+        to have a pointer to a type, and you can only load things of that type from that
+        pointer. Pointer arithmetic is basically not possible except through the bizarre
+        getelementptr operator. This doesn't fit with how the JS object model works since
+        the JS object model doesn't consist of nice and tidy C types placed in C arrays.
+        Also, it would be impossible to use getelementptr and LLVM pointers for accessing
+        any of JSC's C or C++ objects unless we went through the exercise of redeclaring
+        all of our fundamental data structures in LLVM IR as LLVM types. Clang could do
+        this for us, but that would require that to use the FTL, JSC itself would have to
+        be compiled with clang. Worse, it would have to be compiled with a clang that uses
+        a version of LLVM that is compatible with the one against which the FTL is linked.
+        Yuck!
+
+        The solution is to NEVER use LLVM pointers. This has always been the case in the
+        FTL. But it causes some confusion.
+        
+        Not using LLVM pointers means that if the FTL has a "pointer", it's actually a
+        pointer-wide integer (m_out.intPtr in FTL-speak). The act of "loading" and
+        "storing" from or to a pointer involves first bitcasting the intPtr to a real LLVM
+        pointer that has the type that we want. The load and store operations over pointers
+        are called Output::load* and Output::store*, where * is one of "8", "16", "32",
+        "64", "Ptr", "Float", or "Double.
+        
+        There is unavoidable confusion here. It would be bizarre for the FTL to call its
+        "pointer-wide integers" anything other than "pointers", since they are, in all
+        respects that we care about, simply pointers. But they are *not* LLVM pointers and
+        they never will be that.
+        
+        There is one exception to this "no pointers" rule. The FTL does use actual LLVM
+        pointers for refering to LLVM alloca's - i.e. local variables. To try to reduce
+        confusion, we call these "references". So an "FTL reference" is actually an "LLVM
+        pointer", while an "FTL pointer" is actually an "LLVM integer". FTL references have
+        methods for access called Output::get and Output::set. These lower to LLVM load
+        and store, since FTL references are just LLVM pointers.
+        
+        This confusion appears to have led to incorrect code in loadStructure().
+        loadStructure() was using get() and set() to access FTL pointers. But those methods
+        don't work on FTL pointers and never will, since they are for FTL references.
+        
+        The worst part of this is that it was previously impossible to have test coverage
+        for the relevant path (MasqueradesAsUndefined) without writing a DRT test. This
+        patch fixes this by introducing a Masquerader object to jsc.cpp.
+        
+        * ftl/FTLAbstractHeapRepository.h: Add an abstract heap for the structure table.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::loadStructure): This was wrong.
+        * ftl/FTLOutput.h: Add a comment to disuade people from using get() and set().
+        * jsc.cpp: Give us the power to test for MasqueradesAsUndefined.
+        (WTF::Masquerader::Masquerader):
+        (WTF::Masquerader::create):
+        (WTF::Masquerader::createStructure):
+        (GlobalObject::finishCreation):
+        (functionMakeMasquerader):
+        * tests/stress/equals-masquerader.js: Added.
+        (foo):
+        (test):
+
+2014-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Tweak after r165109 to avoid extra copies
+        https://bugs.webkit.org/show_bug.cgi?id=129745
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::visitProtectedObjects):
+        (JSC::Heap::visitTempSortVectors):
+        (JSC::Heap::clearRememberedSet):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+
+2014-03-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        DFGStoreBarrierElisionPhase should should GCState directly instead of m_gcClobberSet when calling writesOverlap()
+        https://bugs.webkit.org/show_bug.cgi?id=129717
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGStoreBarrierElisionPhase.cpp:
+        (JSC::DFG::StoreBarrierElisionPhase::StoreBarrierElisionPhase):
+        (JSC::DFG::StoreBarrierElisionPhase::couldCauseGC):
+
+2014-03-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Use range-based loops where possible in Heap methods
+        https://bugs.webkit.org/show_bug.cgi?id=129513
+
+        Reviewed by Mark Lam.
+
+        Replace old school iterator based loops with the new range-based loop hotness
+        for a better tomorrow.
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::~CodeBlockSet):
+        (JSC::CodeBlockSet::clearMarks):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        (JSC::CodeBlockSet::traceMarked):
+        * heap/Heap.cpp:
+        (JSC::Heap::visitProtectedObjects):
+        (JSC::Heap::visitTempSortVectors):
+        (JSC::Heap::clearRememberedSet):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+
+2014-03-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG and FTL should specialize for and support CompareStrictEq over Misc (i.e. boolean, undefined, or null)
+        https://bugs.webkit.org/show_bug.cgi?id=129563
+
+        Reviewed by Geoffrey Garen.
+        
+        Rolling this back in after fixing an assertion failure. speculateMisc() should have
+        said DFG_TYPE_CHECK instead of typeCheck.
+        
+        This adds a specialization of CompareStrictEq over Misc. I noticed the need for this
+        when I saw that we didn't support CompareStrictEq(Untyped) in FTL but that the main
+        user of this was EarleyBoyer, and in that benchmark what it was really doing was
+        comparing undefined, null, and booleans to each other.
+        
+        This also adds support for miscellaneous things that I needed to make my various test
+        cases work. This includes comparison over booleans and the various Throw-related node
+        types.
+        
+        This also improves constant folding of CompareStrictEq and CompareEq.
+        
+        Also found a bug where we were claiming that GetByVals on typed arrays are OutOfBounds
+        based on profiling, which caused some downstream badness. We don't actually support
+        compiling OutOfBounds GetByVals on typed arrays. The DFG would ignore the flag and just
+        emit a bounds check, but in the FTL path, the SSA lowering phase would assume that it
+        shouldn't factor out the bounds check since the access is not InBounds but then the
+        backend would ignore the flag and assume that the bounds check was already emitted.
+        This showed up on an existing test but I added a test for this explicitly to have more
+        certain coverage. The fix is to not mark something as OutOfBounds if the semantics are
+        that we'll have a bounds check anyway.
+        
+        This is a 1% speed-up on Octane mostly because of raytrace, but also because of just
+        general progressions across the board. No speed-up yet on EarleyBoyer, since there is
+        still a lot more coverage work to be done there.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationToAbbreviatedString):
+        (JSC::leastUpperBoundOfStrictlyEquivalentSpeculations):
+        (JSC::valuesCouldBeEqual):
+        * bytecode/SpeculatedType.h:
+        (JSC::isMiscSpeculation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGArrayMode.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateMisc):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::speculateMisc):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileThrow):
+        (JSC::FTL::LowerDFGToLLVM::isNotMisc):
+        (JSC::FTL::LowerDFGToLLVM::isMisc):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateMisc):
+        * tests/stress/float32-array-out-of-bounds.js: Added.
+        * tests/stress/weird-equality-folding-cases.js: Added.
+
+2014-03-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r165085.
+        http://trac.webkit.org/changeset/165085
+        https://bugs.webkit.org/show_bug.cgi?id=129729
+
+        Broke imported/w3c/html-templates/template-element/template-
+        content.html (Requested by ap on #webkit).
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationToAbbreviatedString):
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGArrayMode.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateBoolean):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        * tests/stress/float32-array-out-of-bounds.js: Removed.
+        * tests/stress/weird-equality-folding-cases.js: Removed.
+
+2014-03-04  Brian Burg  <bburg@apple.com>
+
+        Inspector does not restore breakpoints after a page reload
+        https://bugs.webkit.org/show_bug.cgi?id=129655
+
+        Reviewed by Joseph Pecoraro.
+
+        Fix a regression introduced by r162096 that erroneously removed
+        the inspector backend's mapping of files to breakpoints whenever the
+        global object was cleared.
+
+        The inspector's breakpoint mappings should only be cleared when the
+        debugger agent is disabled or destroyed. We should only clear the
+        debugger's breakpoint state when the global object is cleared.
+
+        To make it clearer what state is being cleared, the two cases have
+        been split into separate methods.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::disable):
+        (Inspector::InspectorDebuggerAgent::clearInspectorBreakpointState):
+        (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
+        (Inspector::InspectorDebuggerAgent::didClearGlobalObject):
+        * inspector/agents/InspectorDebuggerAgent.h:
+
+2014-03-04  Andreas Kling  <akling@apple.com>
+
+        Streamline JSValue::get().
+        <https://webkit.org/b/129720>
+
+        Fetch each Structure and VM only once when walking the prototype chain
+        in JSObject::getPropertySlot(), then pass it along to the functions
+        we call from there, so they don't have to re-fetch it.
+
+        Reviewed by Geoff Garen.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::fastGetOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+
+2014-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG and FTL should specialize for and support CompareStrictEq over Misc (i.e. boolean, undefined, or null)
+        https://bugs.webkit.org/show_bug.cgi?id=129563
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds a specialization of CompareStrictEq over Misc. I noticed the need for this
+        when I saw that we didn't support CompareStrictEq(Untyped) in FTL but that the main
+        user of this was EarleyBoyer, and in that benchmark what it was really doing was
+        comparing undefined, null, and booleans to each other.
+        
+        This also adds support for miscellaneous things that I needed to make my various test
+        cases work. This includes comparison over booleans and the various Throw-related node
+        types.
+        
+        This also improves constant folding of CompareStrictEq and CompareEq.
+        
+        Also found a bug where we were claiming that GetByVals on typed arrays are OutOfBounds
+        based on profiling, which caused some downstream badness. We don't actually support
+        compiling OutOfBounds GetByVals on typed arrays. The DFG would ignore the flag and just
+        emit a bounds check, but in the FTL path, the SSA lowering phase would assume that it
+        shouldn't factor out the bounds check since the access is not InBounds but then the
+        backend would ignore the flag and assume that the bounds check was already emitted.
+        This showed up on an existing test but I added a test for this explicitly to have more
+        certain coverage. The fix is to not mark something as OutOfBounds if the semantics are
+        that we'll have a bounds check anyway.
+        
+        This is a 1% speed-up on Octane mostly because of raytrace, but also because of just
+        general progressions across the board. No speed-up yet on EarleyBoyer, since there is
+        still a lot more coverage work to be done there.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationToAbbreviatedString):
+        (JSC::leastUpperBoundOfStrictlyEquivalentSpeculations):
+        (JSC::valuesCouldBeEqual):
+        * bytecode/SpeculatedType.h:
+        (JSC::isMiscSpeculation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateMisc):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::speculateMisc):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileThrow):
+        (JSC::FTL::LowerDFGToLLVM::isNotMisc):
+        (JSC::FTL::LowerDFGToLLVM::isMisc):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateMisc):
+        * tests/stress/float32-array-out-of-bounds.js: Added.
+        * tests/stress/weird-equality-folding-cases.js: Added.
+
+2014-03-04  Andreas Kling  <akling@apple.com>
+
+        Spam static branch prediction hints on JS bindings.
+        <https://webkit.org/b/129703>
+
+        Add LIKELY hint to jsDynamicCast since it's always used in a context
+        where we expect it to succeed and takes an error path when it doesn't.
+
+        Reviewed by Geoff Garen.
+
+        * runtime/JSCell.h:
+        (JSC::jsDynamicCast):
+
+2014-03-04  Andreas Kling  <akling@apple.com>
+
+        Get to Structures more efficiently in JSCell::methodTable().
+        <https://webkit.org/b/129702>
+
+        In JSCell::methodTable(), get the VM once and pass that along to
+        structure(VM&) instead of using the heavier structure().
+
+        In JSCell::methodTable(VM&), replace calls to structure() with
+        calls to structure(VM&).
+
+        Reviewed by Mark Hahnenberg.
+
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::methodTable):
+
+2014-03-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Listen for the XPC_ERROR_CONNECTION_INVALID event to deref
+        https://bugs.webkit.org/show_bug.cgi?id=129697
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::RemoteInspectorXPCConnection):
+        (Inspector::RemoteInspectorXPCConnection::handleEvent):
+
+2014-03-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Merge API shims and JSLock
+        https://bugs.webkit.org/show_bug.cgi?id=129650
+
+        Reviewed by Mark Lam.
+
+        JSLock is now taking on all of APIEntryShim's responsibilities since there is never a reason 
+        to take just the JSLock. Ditto for DropAllLocks and APICallbackShim.
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call):
+        (JSC::APICallbackFunction::construct):
+        * API/APIShims.h: Removed.
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        (JSReportExtraMemoryCost):
+        (JSSynchronousGarbageCollectForDebugging):
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::init):
+        (JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
+        (JSC::JSCallbackObject<Parent>::put):
+        (JSC::JSCallbackObject<Parent>::putByIndex):
+        (JSC::JSCallbackObject<Parent>::deleteProperty):
+        (JSC::JSCallbackObject<Parent>::construct):
+        (JSC::JSCallbackObject<Parent>::customHasInstance):
+        (JSC::JSCallbackObject<Parent>::call):
+        (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
+        (JSC::JSCallbackObject<Parent>::getStaticValue):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+        * API/JSContext.mm:
+        (-[JSContext setException:]):
+        (-[JSContext wrapperForObjCObject:]):
+        (-[JSContext wrapperForJSObject:]):
+        * API/JSContextRef.cpp:
+        (JSContextGroupRelease):
+        (JSContextGroupSetExecutionTimeLimit):
+        (JSContextGroupClearExecutionTimeLimit):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRetain):
+        (JSGlobalContextRelease):
+        (JSContextGetGlobalObject):
+        (JSContextGetGlobalContext):
+        (JSGlobalContextCopyName):
+        (JSGlobalContextSetName):
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue value]):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSScriptRef.cpp:
+        * API/JSValue.mm:
+        (isDate):
+        (isArray):
+        (containerValueToObject):
+        (valueToArray):
+        (valueToDictionary):
+        (objectToValue):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueMakeFromJSONString):
+        (JSValueCreateJSONString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine addManagedReference:withOwner:]):
+        (-[JSVirtualMachine removeManagedReference:withOwner:]):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JSWrapperMap.mm:
+        (constructorHasInstance):
+        (makeWrapper):
+        (tryUnwrapObjcObject):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::objCCallbackFunctionCallAsFunction):
+        (JSC::objCCallbackFunctionCallAsConstructor):
+        (objCCallbackFunctionForInvocation):
+        * CMakeLists.txt:
+        * ForwardingHeaders/JavaScriptCore/APIShims.h: Removed.
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGWorklist.cpp:
+        * heap/DelayedReleaseScope.h:
+        (JSC::DelayedReleaseScope::~DelayedReleaseScope):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::timerDidFire):
+        (JSC::HeapTimer::timerEvent):
+        * heap/IncrementalSweeper.cpp:
+        * inspector/InjectedScriptModule.cpp:
+        (Inspector::InjectedScriptModule::ensureInjected):
+        * jsc.cpp:
+        (jscmain):
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::doWork):
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        (JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::lock):
+        (JSC::JSLock::didAcquireLock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::willReleaseLock):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        * testRegExp.cpp:
+        (realMain):
+
+2014-03-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r164812.
+        http://trac.webkit.org/changeset/164812
+        https://bugs.webkit.org/show_bug.cgi?id=129699
+
+        it made things run slower (Requested by pizlo on #webkit).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+
+2014-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        GetMyArgumentByVal in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=128850
+
+        Reviewed by Oliver Hunt.
+        
+        This would have been easy if the OSR exit compiler's arity checks hadn't been wrong.
+        They checked arity by doing "exec->argumentCount == codeBlock->numParameters", which
+        caused it to think that the arity check had failed if the caller had passed more
+        arguments than needed. This would cause the call frame copying to sort of go into
+        reverse (because the amount-by-which-we-failed-arity would have opposite sign,
+        throwing off a bunch of math) and the stack would end up being corrupted.
+        
+        The bug was revealed by two existing tests although as far as I could tell, neither
+        test was intending to cover this case directly. So, I added a new test.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckArgumentsNotCreated):
+        (JSC::FTL::LowerDFGToLLVM::checkArgumentsNotCreated):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLState.h:
+        * tests/stress/exit-from-ftl-when-caller-passed-extra-args-then-use-function-dot-arguments.js: Added.
+        * tests/stress/ftl-get-my-argument-by-val-inlined-and-not-inlined.js: Added.
+        * tests/stress/ftl-get-my-argument-by-val-inlined.js: Added.
+        * tests/stress/ftl-get-my-argument-by-val.js: Added.
+
+2014-03-04  Zan Dobersek  <zdobersek@igalia.com>
+
+        [GTK] Build the Udis86 disassembler
+        https://bugs.webkit.org/show_bug.cgi?id=129679
+
+        Reviewed by Michael Saboff.
+
+        * GNUmakefile.am: Generate the Udis86-related derived sources. Distribute the required files.
+        * GNUmakefile.list.am: Add the Udis86 disassembler files to the build.
+
+2014-03-04  Andreas Kling  <akling@apple.com>
+
+        Fix too-narrow assertion I added in r165054.
+
+        It's okay for a 1-character string to come in here. This will happen
+        if the VM small string optimization doesn't apply (ch > 0xFF)
+
+        * runtime/JSString.h:
+        (JSC::jsStringWithWeakOwner):
+
+2014-03-04  Andreas Kling  <akling@apple.com>
+
+        Micro-optimize Strings in JS bindings.
+        <https://webkit.org/b/129673>
+
+        Make jsStringWithWeakOwner() take a StringImpl& instead of a String.
+        This avoids branches in length() and operator[].
+
+        Also call JSString::create() directly instead of jsString() and just
+        assert that the string length is >1. This way we don't duplicate the
+        optimizations for empty and single-character strings.
+
+        Reviewed by Ryosuke Niwa.
+
+        * runtime/JSString.h:
+        (JSC::jsStringWithWeakOwner):
+
+2014-03-04  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        Implement Number.prototype.clz()
+        https://bugs.webkit.org/show_bug.cgi?id=129479
+
+        Reviewed by Oliver Hunt.
+
+        Implemented Number.prototype.clz() as specified in the ES6 standard.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncClz):
+
+2014-03-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Avoid too early deref caused by RemoteInspectorXPCConnection::close
+        https://bugs.webkit.org/show_bug.cgi?id=129631
+
+        Reviewed by Timothy Hatcher.
+
+        Avoid deref() too early if a client calls close(). The xpc_connection_close
+        will cause another XPC_ERROR event to come in from the queue, deref then.
+        Likewise, protect multithreaded access to m_client. If a client calls
+        close() we want to immediately clear the pointer to prevent calls to it.
+
+        Overall the multi-threading aspects of RemoteInspectorXPCConnection are
+        growing too complicated for probably little benefit. We may want to
+        clean this up later.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::RemoteInspectorXPCConnection):
+        (Inspector::RemoteInspectorXPCConnection::close):
+        (Inspector::RemoteInspectorXPCConnection::closeOnQueue):
+        (Inspector::RemoteInspectorXPCConnection::deserializeMessage):
+        (Inspector::RemoteInspectorXPCConnection::handleEvent):
+        (Inspector::RemoteInspectorXPCConnection::sendMessage):
+
+2014-03-03  Michael Saboff  <msaboff@apple.com>
+
+        AbstractMacroAssembler::CachedTempRegister should start out invalid
+        https://bugs.webkit.org/show_bug.cgi?id=129657
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
+        - Invalidate all cached registers in constructor as we don't know the
+          contents of any register at the entry to the code we are going to
+          generate.
+
+2014-03-03  Andreas Kling  <akling@apple.com>
+
+        StructureOrOffset should be fastmalloced.
+        <https://webkit.org/b/129640>
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/StructureIDTable.h:
+
+2014-03-03  Michael Saboff  <msaboff@apple.com>
+
+        Crash in JIT code while watching a video @ storyboard.tumblr.com
+        https://bugs.webkit.org/show_bug.cgi?id=129635
+
+        Reviewed by Filip Pizlo.
+
+        Clear m_set before we set bits in the TempRegisterSet(const RegisterSet& other)
+        construtor.
+
+        * jit/TempRegisterSet.cpp:
+        (JSC::TempRegisterSet::TempRegisterSet): Clear map before setting it.
+        * jit/TempRegisterSet.h:
+        (JSC::TempRegisterSet::TempRegisterSet): Use new clearAll() helper.
+        (JSC::TempRegisterSet::clearAll): New private helper.
+
+2014-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        [x86] Improve code generation of byte test
+        https://bugs.webkit.org/show_bug.cgi?id=129597
+
+        Reviewed by Geoffrey Garen.
+
+        When possible, test the 8 bit register to itself instead of comparing it
+        to a literal.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::test32):
+
+2014-03-03  Mark Lam  <mark.lam@apple.com>
+
+        Web Inspector: debugger statements do not break.
+        <https://webkit.org/b/129524>
+
+        Reviewed by Geoff Garen.
+
+        Since we no longer call op_debug hooks unless there is a debugger request
+        made on the CodeBlock, the op_debug for the debugger statement never gets
+        serviced.
+
+        With this fix, we check in the CodeBlock constructor if any debugger
+        statements are present.  If so, we set a m_hasDebuggerStatement flag that
+        causes the CodeBlock to show as having debugger requests.  Hence,
+        breaking at debugger statements is now restored.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasDebuggerRequests):
+        (JSC::CodeBlock::clearDebuggerRequests):
+
+2014-03-03  Mark Lam  <mark.lam@apple.com>
+
+        ASSERTION FAILED: m_numBreakpoints >= numBreakpoints when deleting breakpoints.
+        <https://webkit.org/b/129393>
+
+        Reviewed by Geoffrey Garen.
+
+        The issue manifests because the debugger will iterate all CodeBlocks in
+        the heap when setting / clearing breakpoints, but it is possible for a
+        CodeBlock to have been instantiate but is not yet registered with the
+        debugger.  This can happen because of the following:
+
+        1. DFG worklist compilation is still in progress, and the target
+           codeBlock is not ready for installation in its executable yet.
+
+        2. DFG compilation failed and we have a codeBlock that will never be
+           installed in its executable, and the codeBlock has not been cleaned
+           up by the GC yet.
+
+        The code for installing the codeBlock in its executable is the same code
+        that registers it with the debugger.  Hence, these codeBlocks are not
+        registered with the debugger, and any pending breakpoints that would map
+        to that CodeBlock is as yet unset or will never be set.  As such, an
+        attempt to remove a breakpoint in that CodeBlock will fail that assertion.
+
+        To fix this, we do the following:
+
+        1. We'll eagerly clean up any zombie CodeBlocks due to failed DFG / FTL
+           compilation.  This is achieved by providing a
+           DeferredCompilationCallback::compilationDidComplete() that does this
+           clean up, and have all sub classes call it at the end of their
+           compilationDidComplete() methods.
+
+        2. Before the debugger or profiler iterates CodeBlocks in the heap, they
+           will wait for all compilations to complete before proceeding.  This
+           ensures that:
+           1. any zombie CodeBlocks would have been cleaned up, and won't be
+              seen by the debugger or profiler.
+           2. all CodeBlocks that the debugger and profiler needs to operate on
+              will be "ready" for whatever needs to be done to them e.g.
+              jettison'ing of DFG codeBlocks.
+
+        * bytecode/DeferredCompilationCallback.cpp:
+        (JSC::DeferredCompilationCallback::compilationDidComplete):
+        * bytecode/DeferredCompilationCallback.h:
+        - Provide default implementation method to clean up zombie CodeBlocks.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::forEachCodeBlock):
+        - Utility function to iterate CodeBlocks.  It ensures that all compilations
+          are complete before proceeding.
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::toggleBreakpoint):
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::Debugger::clearBreakpoints):
+        (JSC::Debugger::clearDebuggerRequests):
+        - Use the utility iterator function.
+
+        * debugger/Debugger.h:
+        * dfg/DFGOperations.cpp:
+        - Added an assert to ensure that zombie CodeBlocks will be imminently cleaned up.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        - Remove unneeded code (that was not the best solution anyway) for ensuring
+          that we don't generate new DFG codeBlocks after enabling the debugger or
+          profiler.  Now that we wait for compilations to complete before proceeding
+          with debugger and profiler work, this scenario will never happen.
+
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
+        - Call the super class method to clean up zombie codeBlocks.
+
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
+        - Call the super class method to clean up zombie codeBlocks.
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::remove):
+        * heap/CodeBlockSet.h:
+        * heap/Heap.h:
+        (JSC::Heap::removeCodeBlock):
+        - New method to remove a codeBlock from the codeBlock set.
+
+        * jit/JITOperations.cpp:
+        - Added an assert to ensure that zombie CodeBlocks will be imminently cleaned up.
+
+        * jit/JITToDFGDeferredCompilationCallback.cpp:
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
+        - Call the super class method to clean up zombie codeBlocks.
+
+        * runtime/VM.cpp:
+        (JSC::VM::waitForCompilationsToComplete):
+        - Renamed from prepareToDiscardCode() to be clearer about what it does.
+
+        (JSC::VM::discardAllCode):
+        (JSC::VM::releaseExecutableMemory):
+        (JSC::VM::setEnabledProfiler):
+        - Wait for compilation to complete before enabling the profiler.
+
+        * runtime/VM.h:
+
+2014-03-03  Brian Burg  <bburg@apple.com>
+
+        Another unreviewed build fix attempt for Windows after r164986.
+
+        We never told Visual Studio to copy over the web replay code generator scripts
+        and the generated headers for JavaScriptCore replay inputs as if they were
+        private headers.
+
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+
+2014-03-03  Brian Burg  <bburg@apple.com>
+
+        Web Replay: upstream input storage, capture/replay machinery, and inspector domain
+        https://bugs.webkit.org/show_bug.cgi?id=128782
+
+        Reviewed by Timothy Hatcher.
+
+        Alter the replay inputs code generator so that it knows when it is necessary to
+        to include headers for HEAVY_SCALAR types such as WTF::String and WebCore::URL.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Framework.fromString):
+        (Frameworks): Add WTF as an allowed framework for code generation.
+        (Generator.generate_includes): Include headers for HEAVY_SCALAR types in the header file.
+        (Generator.generate_includes.declaration):
+        (Generator.generate_includes.or):
+        (Generator.generate_type_forward_declarations): Skip HEAVY_SCALAR types.
+
+2014-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        PolymorphicPutByIdList should have a simpler construction API with basically a single entrypoint
+        https://bugs.webkit.org/show_bug.cgi?id=129591
+
+        Reviewed by Michael Saboff.
+
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::fromStructureStubInfo): This function can figure out the slow path target for itself.
+        (JSC::PolymorphicPutByIdList::PolymorphicPutByIdList): This constuctor should be private, only from() should call it.
+        (JSC::PolymorphicPutByIdList::from):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::stubRoutine):
+        * jit/Repatch.cpp:
+        (JSC::tryBuildPutByIdList): Don't pass the slow path target since it can be derived from the stubInfo.
+
+2014-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Debugging improvements from my gbemu investigation session
+        https://bugs.webkit.org/show_bug.cgi?id=129599
+
+        Reviewed by Mark Lam.
+        
+        Various improvements from when I was investigating bug 129411.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::optimizationThresholdScalingFactor): Make the dataLog() statement print the actual multiplier.
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDescribe): Make describe() return a string rather than printing the string.
+        (functionDescribeArray): Like describe(), but prints details about arrays.
+
+2014-02-25  Andreas Kling  <akling@apple.com>
+
+        JSDOMWindow::commonVM() should return a reference.
+        <https://webkit.org/b/129293>
+
+        Added a DropAllLocks constructor that takes VM& without null checks.
+
+        Reviewed by Geoff Garen.
+
+2014-03-02  Mark Lam  <mark.lam@apple.com>
+
+        CodeBlock::hasDebuggerRequests() should returning a bool instead of an int.
+        <https://webkit.org/b/129584>
+
+        Reviewed by Darin Adler.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasDebuggerRequests):
+
+2014-03-02  Mark Lam  <mark.lam@apple.com>
+
+        Clean up use of Options::enableConcurrentJIT().
+        <https://webkit.org/b/129582>
+
+        Reviewed by Filip Pizlo.
+
+        DFG Driver was conditionally checking Options::enableConcurrentJIT()
+        only if ENABLE(CONCURRENT_JIT).  Otherwise, it bypasses it with a local
+        enableConcurrentJIT set to false.
+
+        Instead we should configure Options::enableConcurrentJIT() to be false
+        in Options.cpp if !ENABLE(CONCURRENT_JIT), and DFG Driver should always
+        check Options::enableConcurrentJIT().  This makes the code read a little
+        cleaner.
+
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2014-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        This shouldn't have been a layout test since it runs only under jsc. Moving it to JSC
+        stress tests.
+
+        * tests/stress/generational-opaque-roots.js: Copied from LayoutTests/js/script-tests/generational-opaque-roots.js.
+
+2014-03-01  Andreas Kling  <akling@apple.com>
+
+        JSCell::fastGetOwnProperty() should get the Structure more efficiently.
+        <https://webkit.org/b/129560>
+
+        Now that structure() is nontrivial and we have a faster structure(VM&),
+        make use of that in fastGetOwnProperty() since we already have VM.
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::fastGetOwnProperty):
+
+2014-03-01  Andreas Kling  <akling@apple.com>
+
+        Avoid going through ExecState for VM when we already have it (in some places.)
+        <https://webkit.org/b/129554>
+
+        Tweak some places that jump through unnecessary hoops to get the VM.
+        There are many more like this.
+
+        Reviewed by Sam Weinig.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+
+2014-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support PhantomArguments
+        https://bugs.webkit.org/show_bug.cgi?id=113986
+
+        Reviewed by Oliver Hunt.
+        
+        Adding PhantomArguments to the FTL mostly means wiring the recovery of the Arguments
+        object into the FTL's OSR exit compiler.
+        
+        This isn't a speed-up yet, since there is still more to be done to fully support
+        all of the arguments craziness that our varargs benchmarks do.
+
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit): move the recovery code to DFGOSRExitCompilerCommon.cpp
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit): move the recovery code to DFGOSRExitCompilerCommon.cpp
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::ArgumentsRecoveryGenerator::ArgumentsRecoveryGenerator):
+        (JSC::DFG::ArgumentsRecoveryGenerator::~ArgumentsRecoveryGenerator):
+        (JSC::DFG::ArgumentsRecoveryGenerator::generateFor): this is the common place for the recovery code
+        * dfg/DFGOSRExitCompilerCommon.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::argumentsObjectThatWasNotCreated):
+        (JSC::FTL::ExitValue::isArgumentsObjectThatWasNotCreated):
+        (JSC::FTL::ExitValue::valueFormat):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantomArguments):
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::LowerDFGToLLVM::tryToSetConstantExitArgument):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub): Call into the ArgumentsRecoveryGenerator
+        * tests/stress/slightly-more-difficult-to-fold-reflective-arguments-access.js: Added.
+        * tests/stress/trivially-foldable-reflective-arguments-access.js: Added.
+
+2014-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, uncomment some code. It wasn't meant to be commented in the first place.
+
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+
+2014-02-28  Andreas Kling  <akling@apple.com>
+
+        JSObject::findPropertyHashEntry() should take VM instead of ExecState.
+        <https://webkit.org/b/129529>
+
+        Callers already have VM in a local, and findPropertyHashEntry() only
+        uses the VM, no need to go all the way through ExecState.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::findPropertyHashEntry):
+        * runtime/JSObject.h:
+
+2014-02-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Deadlock remotely inspecting iOS Simulator
+        https://bugs.webkit.org/show_bug.cgi?id=129511
+
+        Reviewed by Timothy Hatcher.
+
+        Avoid synchronous setup. Do it asynchronously, and let
+        the RemoteInspector singleton know later if it failed.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::setupFailed):
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+
+2014-02-28  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION(r164835): It broke 10 JSC stress test on 32 bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=129488
+
+        Reviewed by Mark Lam.
+
+        Whoops, modify the right register.
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+
+2014-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should be able to call sin/cos directly on platforms where the intrinsic is busted
+        https://bugs.webkit.org/show_bug.cgi?id=129503
+
+        Reviewed by Mark Lam.
+
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleSin):
+        (JSC::FTL::Output::doubleCos):
+        (JSC::FTL::Output::intrinsicOrOperation):
+
+2014-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Fix !ENABLE(GGC) builds
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::gatherJSStackRoots): Also fix one of the names of the GC phases.
+
+2014-02-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Clean up Heap::collect and Heap::markRoots
+        https://bugs.webkit.org/show_bug.cgi?id=129464
+
+        Reviewed by Geoffrey Garen.
+
+        These functions have built up a lot of cruft recently. 
+        We should do a bit of cleanup to make them easier to grok.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::finalizeUnconditionalFinalizers):
+        (JSC::Heap::gatherStackRoots):
+        (JSC::Heap::gatherJSStackRoots):
+        (JSC::Heap::gatherScratchBufferRoots):
+        (JSC::Heap::clearLivenessData):
+        (JSC::Heap::visitSmallStrings):
+        (JSC::Heap::visitConservativeRoots):
+        (JSC::Heap::visitCompilerWorklists):
+        (JSC::Heap::markProtectedObjects):
+        (JSC::Heap::markTempSortVectors):
+        (JSC::Heap::markArgumentBuffers):
+        (JSC::Heap::visitException):
+        (JSC::Heap::visitStrongHandles):
+        (JSC::Heap::visitHandleStack):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        (JSC::Heap::converge):
+        (JSC::Heap::visitWeakHandles):
+        (JSC::Heap::clearRememberedSet):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::resetVisitors):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        (JSC::Heap::collect):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        (JSC::Heap::suspendCompilerThreads):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::deleteOldCode):
+        (JSC::Heap::flushOldStructureIDTables):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        (JSC::Heap::stopAllocation):
+        (JSC::Heap::reapWeakHandles):
+        (JSC::Heap::sweepArrayBuffers):
+        (JSC::Heap::snapshotMarkedSpace):
+        (JSC::Heap::deleteSourceProviderCaches):
+        (JSC::Heap::notifyIncrementalSweeper):
+        (JSC::Heap::rememberCurrentlyExecutingCodeBlocks):
+        (JSC::Heap::resetAllocators):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::resumeCompilerThreads):
+        * heap/Heap.h:
+
+2014-02-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        indexOf and lastIndexOf shouldn't resolve ropes when needle is longer than haystack
+        https://bugs.webkit.org/show_bug.cgi?id=129466
+
+        Reviewed by Michael Saboff.
+
+        Refactored the code to avoid calling JSString::value when needle is longer than haystack.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+
+2014-02-27  Timothy Hatcher  <timothy@apple.com>
+
+        Improve how ContentSearchUtilities::lineEndings works by supporting the three common line endings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=129458
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::textPositionFromOffset): Remove assumption about line ending length.
+        (Inspector::ContentSearchUtilities::getRegularExpressionMatchesByLines): Remove assumption about
+        line ending type and don't try to strip the line ending. Use size_t
+        (Inspector::ContentSearchUtilities::lineEndings): Use findNextLineStart to find the lines.
+        This will include the line ending in the lines, but that is okay.
+        (Inspector::ContentSearchUtilities::buildObjectForSearchMatch): Use size_t.
+        (Inspector::ContentSearchUtilities::searchInTextByLines): Modernize.
+
+2014-02-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Mac] Warning: Multiple build commands for output file GCSegmentedArray and InspectorAgent
+        https://bugs.webkit.org/show_bug.cgi?id=129446
+
+        Reviewed by Timothy Hatcher.
+
+        Remove duplicate header entries in Copy Header build phase.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-02-27  Oliver Hunt  <oliver@apple.com>
+
+        Whoops, include all of last patch.
+
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+
+2014-02-27  Oliver Hunt  <oliver@apple.com>
+
+        Slow cases for function.apply and function.call should not require vm re-entry
+        https://bugs.webkit.org/show_bug.cgi?id=129454
+
+        Reviewed by Geoffrey Garen.
+
+        Implement call and apply using builtins. Happily the use
+        of @call and @apply don't perform function equality checks
+        and just plant direct var_args calls. This did expose a few
+        codegen issues, but they're all covered by existing tests
+        once call and apply are implemented in JS.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/Function.prototype.js: Added.
+        (call):
+        (apply):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeFrameForVarargs):
+        (JSC::loadVarargs):
+        * interpreter/Interpreter.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        * parser/Lexer.cpp:
+        (JSC::isSafeBuiltinIdentifier):
+        * runtime/CommonIdentifiers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectBuiltinFunction):
+        (JSC::JSObject::putDirectBuiltinFunctionWithoutTransition):
+        * runtime/JSObject.h:
+
+2014-02-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Better name for RemoteInspectorDebuggableConnection dispatch queue
+        https://bugs.webkit.org/show_bug.cgi?id=129443
+
+        Reviewed by Timothy Hatcher.
+
+        This queue is specific to the JSContext debuggable connections,
+        there is no XPC involved. Give it a better name.
+
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::RemoteInspectorDebuggableConnection):
+
+2014-02-27  David Kilzer  <ddkilzer@apple.com>
+
+        Remove jsc symlink if it already exists
+
+        This is a follow-up fix for:
+
+        Create symlink to /usr/local/bin/jsc during installation
+        <http://webkit.org/b/129399>
+        <rdar://problem/16168734>
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        (Create /usr/local/bin/jsc symlink): If a jsc symlink already
+        exists where we're about to create the symlink, remove the old
+        one first.
+
+2014-02-27  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix for Mac tools after r164814
+
+        * Configurations/ToolExecutable.xcconfig:
+        - Added JavaScriptCore.framework/PrivateHeaders to ToolExecutable include path.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        - Changed productName to testRegExp for testRegExp target.
+
+2014-02-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JSContext inspection should report exceptions in the console
+        https://bugs.webkit.org/show_bug.cgi?id=128776
+
+        Reviewed by Timothy Hatcher.
+
+        When JavaScript API functions have an exception, let the inspector
+        know so it can log the JavaScript and Native backtrace that caused
+        the exception.
+
+        Include some clean up of ConsoleMessage and ScriptCallStack construction.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValue.mm:
+        (reportExceptionToInspector):
+        (valueToArray):
+        (valueToDictionary):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueCreateJSONString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        When seeing an exception, let the inspector know there was an exception.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::appendAPIBacktrace):
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        Log API exceptions by also grabbing the native backtrace.
+
+        * inspector/ScriptCallStack.h:
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::firstNonNativeCallFrame):
+        (Inspector::ScriptCallStack::append):
+        Minor extensions to ScriptCallStack to make it easier to work with.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::ConsoleMessage):
+        (Inspector::ConsoleMessage::autogenerateMetadata):
+        Provide better default information if the first call frame was native.
+
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::extractSourceInformationFromException):
+        (Inspector::createScriptCallStackFromException):
+        Perform the handling here of inserting a fake call frame for exceptions
+        if there was no call stack (e.g. a SyntaxError) or if the first call
+        frame had no information.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::ConsoleMessage):
+        (Inspector::ConsoleMessage::autogenerateMetadata):
+        * inspector/ConsoleMessage.h:
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::createScriptCallStackForConsole):
+        * inspector/ScriptCallStackFactory.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::enable):
+        (Inspector::InspectorConsoleAgent::addMessageToConsole):
+        (Inspector::InspectorConsoleAgent::count):
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::breakpointActionLog):
+        ConsoleMessage cleanup.
+
+2014-02-27  David Kilzer  <ddkilzer@apple.com>
+
+        Create symlink to /usr/local/bin/jsc during installation
+        <http://webkit.org/b/129399>
+        <rdar://problem/16168734>
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        - Add "Create /usr/local/bin/jsc symlink" build phase script to
+          create the symlink during installation.
+
+2014-02-27  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
+
+        Math.{max, min}() must not return after first NaN value
+        https://bugs.webkit.org/show_bug.cgi?id=104147
+
+        Reviewed by Oliver Hunt.
+
+        According to the spec, ToNumber going to be called on each argument
+        even if a `NaN` value was already found
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+
+2014-02-27  Gergo Balogh  <gbalogh.u-szeged@partner.samsung.com>
+
+        JSType upper limit (0xff) assertion can be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=129424
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2014-02-26  Michael Saboff  <msaboff@apple.com>
+
+        Auto generate bytecode information for bytecode parser and LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=129181
+
+        Reviewed by Mark Lam.
+
+        Added new bytecode/BytecodeList.json that contains a list of bytecodes and related
+        helpers.  It also includes bytecode length and other information used to generate files.
+        Added a new generator, generate-bytecode-files that generates Bytecodes.h and InitBytecodes.asm
+        in DerivedSources/JavaScriptCore/.
+
+        Added the generation of these files to the "DerivedSource" build step.
+        Slighty changed the build order, since the Bytecodes.h file is needed by
+        JSCLLIntOffsetsExtractor.  Moved the offline assembly to a separate step since it needs
+        to be run after JSCLLIntOffsetsExtractor.
+
+        Made related changes to OPCODE macros and their use.
+
+        Added JavaScriptCore.framework/PrivateHeaders to header file search path for building
+        jsc to resolve Mac build issue.
+
+        * CMakeLists.txt:
+        * Configurations/JSC.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * llint/LLIntCLoop.cpp:
+        (JSC::LLInt::CLoop::initialize):
+        * llint/LLIntCLoop.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::initialize):
+        * llint/LLIntOpcode.h:
+        * llint/LowLevelInterpreter.asm:
+
+2014-02-27  Julien Brianceau   <jbriance@cisco.com>
+
+        Fix 32-bit V_JITOperation_EJ callOperation introduced in r162652.
+        https://bugs.webkit.org/show_bug.cgi?id=129420
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Payload and tag are swapped.
+        Also, EABI_32BIT_DUMMY_ARG is missing for arm EABI and mips.
+
+2014-02-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Octane/closure thrashes between flattening dictionaries during global object initialization in a global eval
+        https://bugs.webkit.org/show_bug.cgi?id=129435
+
+        Reviewed by Oliver Hunt.
+        
+        This is a 5-10% speed-up on Octane/closure.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionClearCodeCache):
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+
+2014-02-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Added svn:ignore to two directories, so that .pyc files don't show up as unversioned.
+
+        * inspector/scripts: Added property svn:ignore.
+        * replay/scripts: Added property svn:ignore.
+
+2014-02-27  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        r164764 broke the ARM build
+        https://bugs.webkit.org/show_bug.cgi?id=129415
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::moveWithPatch): Change reinterpret_cast to static_cast.
+        (JSC::MacroAssemblerARM::canJumpReplacePatchableBranch32WithPatch): Add missing function.
+        (JSC::MacroAssemblerARM::startOfPatchableBranch32WithPatchOnAddress): Add missing function.
+        (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranch32WithPatch): Add missing function.
+
+2014-02-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        r164764 broke the ARM build
+        https://bugs.webkit.org/show_bug.cgi?id=129415
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::moveWithPatch):
+
+2014-02-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        r164764 broke the ARM build
+        https://bugs.webkit.org/show_bug.cgi?id=129415
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32WithPatch): Missing this function.
+
+2014-02-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        EFL build fix
+
+        * dfg/DFGSpeculativeJIT32_64.cpp: Remove unused variables.
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2014-02-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Make JSCells have 32-bit Structure pointers
+        https://bugs.webkit.org/show_bug.cgi?id=123195
+
+        Reviewed by Filip Pizlo.
+
+        This patch changes JSCells such that they no longer have a full 64-bit Structure
+        pointer in their header. Instead they now have a 32-bit index into
+        a per-VM table of Structure pointers. 32-bit platforms still use normal Structure
+        pointers.
+
+        This change frees up an additional 32 bits of information in our object headers.
+        We then use this extra space to store the indexing type of the object, the JSType
+        of the object, some various type flags, and garbage collection data (e.g. mark bit).
+        Because this inline type information is now faster to read, it pays for the slowdown 
+        incurred by having to perform an extra indirection through the StructureIDTable.
+
+        This patch also threads a reference to the current VM through more of the C++ runtime
+        to offset the cost of having to look up the VM to get the actual Structure pointer.
+
+        * API/JSContext.mm:
+        (-[JSContext setException:]):
+        (-[JSContext wrapperForObjCObject:]):
+        (-[JSContext wrapperForJSObject:]):
+        * API/JSContextRef.cpp:
+        (JSContextGroupRelease):
+        (JSGlobalContextRelease):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCopyPropertyNames):
+        * API/JSValue.mm:
+        (containerValueToObject):
+        * API/JSWrapperMap.mm:
+        (tryUnwrapObjcObject):
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::patchableBranch32WithPatch):
+        (JSC::MacroAssembler::patchableBranch32):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branchPtrWithPatch):
+        (JSC::MacroAssemblerARM64::patchableBranch32WithPatch):
+        (JSC::MacroAssemblerARM64::canJumpReplacePatchableBranch32WithPatch):
+        (JSC::MacroAssemblerARM64::startOfPatchableBranch32WithPatchOnAddress):
+        (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranch32WithPatch):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::store8):
+        (JSC::MacroAssemblerARMv7::branch32WithPatch):
+        (JSC::MacroAssemblerARMv7::patchableBranch32WithPatch):
+        (JSC::MacroAssemblerARMv7::canJumpReplacePatchableBranch32WithPatch):
+        (JSC::MacroAssemblerARMv7::startOfPatchableBranch32WithPatchOnAddress):
+        (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranch32WithPatch):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::branch32WithPatch):
+        (JSC::MacroAssemblerX86::canJumpReplacePatchableBranch32WithPatch):
+        (JSC::MacroAssemblerX86::startOfPatchableBranch32WithPatchOnAddress):
+        (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranch32WithPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::moveWithPatch):
+        (JSC::MacroAssemblerX86_64::branch32WithPatch):
+        (JSC::MacroAssemblerX86_64::canJumpReplacePatchableBranch32WithPatch):
+        (JSC::MacroAssemblerX86_64::startOfBranch32WithPatchOnRegister):
+        (JSC::MacroAssemblerX86_64::startOfPatchableBranch32WithPatchOnAddress):
+        (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranch32WithPatch):
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::startOfPatchableBranch32WithPatchOnAddress):
+        (JSC::RepatchBuffer::revertJumpReplacementToPatchableBranch32WithPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::revertJumpTo_movq_i64r):
+        (JSC::X86Assembler::revertJumpTo_movl_i32r):
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::ArrayProfile):
+        (JSC::ArrayProfile::addressOfLastSeenStructureID):
+        (JSC::ArrayProfile::observeStructure):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::heap):
+        * bytecode/UnlinkedCodeBlock.h:
+        * debugger/Debugger.h:
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::branchWeakStructure):
+        (JSC::DFG::JITCompiler::branchStructurePtr):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::osrWriteBarrier):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateObject):
+        (JSC::DFG::SpeculativeJIT::speculateFinalObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateStringObject):
+        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
+        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+        (JSC::DFG::SpeculativeJIT::emitSwitchString):
+        (JSC::DFG::SpeculativeJIT::genericWriteBarrier):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGWorklist.cpp:
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+        (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileToString):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+        (JSC::FTL::LowerDFGToLLVM::speculateTruthyObject):
+        (JSC::FTL::LowerDFGToLLVM::allocateCell):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::isObject):
+        (JSC::FTL::LowerDFGToLLVM::isString):
+        (JSC::FTL::LowerDFGToLLVM::isArrayType):
+        (JSC::FTL::LowerDFGToLLVM::hasClassInfo):
+        (JSC::FTL::LowerDFGToLLVM::isType):
+        (JSC::FTL::LowerDFGToLLVM::speculateStringOrStringObject):
+        (JSC::FTL::LowerDFGToLLVM::speculateStringObjectForCell):
+        (JSC::FTL::LowerDFGToLLVM::speculateStringObjectForStructureID):
+        (JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
+        (JSC::FTL::LowerDFGToLLVM::loadMarkByte):
+        (JSC::FTL::LowerDFGToLLVM::loadStructure):
+        (JSC::FTL::LowerDFGToLLVM::weakStructure):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::store8):
+        * heap/GCAssertions.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::getConservativeRegisterRoots):
+        (JSC::Heap::collect):
+        (JSC::Heap::writeBarrier):
+        * heap/Heap.h:
+        (JSC::Heap::structureIDTable):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::forEachBlock):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::internalAppend):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfCellNotObject):
+        (JSC::AssemblyHelpers::genericWriteBarrier):
+        (JSC::AssemblyHelpers::emitLoadStructure):
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::privateCompileClosureCall):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::generateFastPathChecks):
+        * jit/JITInlineCacheGenerator.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::emitLoadCharacterString):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitJumpIfCellNotObject):
+        (JSC::JIT::emitAllocateJSObject):
+        (JSC::JIT::emitArrayProfilingSiteWithCell):
+        (JSC::JIT::emitArrayProfilingSiteForBytecodeIndexWithCell):
+        (JSC::JIT::branchStructure):
+        (JSC::branchStructure):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_is_string):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_to_this):
+        (JSC::JIT::emitSlow_op_to_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_is_string):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_to_this):
+        * jit/JITOperations.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitLoadWithStructureCheck):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        (JSC::JIT::checkMarkWord):
+        (JSC::JIT::emitWriteBarrier):
+        (JSC::JIT::addStructureTransitionCheck):
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitLoadWithStructureCheck):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfNotType):
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess):
+        (JSC::addStructureTransitionCheck):
+        (JSC::replaceWithJump):
+        (JSC::generateProtoChainAccessStub):
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::writeBarrier):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        (JSC::tryBuildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::linkClosureCall):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+        (JSC::SpecializedThunkJIT::loadArgumentWithSpecificClass):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualForThunkGenerator):
+        (JSC::arrayIteratorNextThunkGenerator):
+        * jit/UnusedPointer.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::createStrictModeCallerIfNecessary):
+        (JSC::Arguments::createStrictModeCalleeIfNecessary):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::performSlowSort):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::isFunctionExecutable):
+        (JSC::ExecutableBase::clearCodeVirtual):
+        (JSC::ScriptExecutable::unlinkCalls):
+        * runtime/GetterSetter.cpp:
+        (JSC::callGetter):
+        (JSC::callSetter):
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        (JSC::JSArray::sortNumericVector):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sortCompactedVector):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::sortVector):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::toThis):
+        (JSC::JSValue::put):
+        (JSC::JSValue::putByIndex):
+        (JSC::JSValue::equalSlowCaseInline):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::putByIndex):
+        (JSC::JSCell::deleteProperty):
+        (JSC::JSCell::deletePropertyByIndex):
+        * runtime/JSCell.h:
+        (JSC::JSCell::clearStructure):
+        (JSC::JSCell::mark):
+        (JSC::JSCell::isMarked):
+        (JSC::JSCell::structureIDOffset):
+        (JSC::JSCell::typeInfoFlagsOffset):
+        (JSC::JSCell::typeInfoTypeOffset):
+        (JSC::JSCell::indexingTypeOffset):
+        (JSC::JSCell::gcDataOffset):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::JSCell):
+        (JSC::JSCell::finishCreation):
+        (JSC::JSCell::type):
+        (JSC::JSCell::indexingType):
+        (JSC::JSCell::structure):
+        (JSC::JSCell::visitChildren):
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        (JSC::JSCell::isGetterSetter):
+        (JSC::JSCell::isProxy):
+        (JSC::JSCell::isAPIValueWrapper):
+        (JSC::JSCell::setStructure):
+        (JSC::JSCell::methodTable):
+        (JSC::Heap::writeBarrier):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::createStructure):
+        * runtime/JSDestructibleObject.h:
+        (JSC::JSCell::classInfo):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::getCallableObjectSlow):
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSFinalObject::visitChildren):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::genericConvertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::ensureInt32Slow):
+        (JSC::JSObject::ensureDoubleSlow):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::hasOwnProperty):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::countElements):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        * runtime/JSObject.h:
+        (JSC::getJSFunction):
+        (JSC::JSObject::getArrayLength):
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::putByIndexInline):
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::tryGetIndexQuickly):
+        (JSC::JSObject::getDirectIndex):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuicklyForPutDirect):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::hasSparseMap):
+        (JSC::JSObject::inSparseIndexingMode):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::ensureInt32):
+        (JSC::JSObject::ensureDouble):
+        (JSC::JSObject::ensureContiguous):
+        (JSC::JSObject::rageEnsureContiguous):
+        (JSC::JSObject::ensureArrayStorage):
+        (JSC::JSObject::arrayStorage):
+        (JSC::JSObject::arrayStorageOrNull):
+        (JSC::JSObject::ensureLength):
+        (JSC::JSObject::currentIndexingData):
+        (JSC::JSObject::getHolyIndexQuickly):
+        (JSC::JSObject::currentRelevantLength):
+        (JSC::JSObject::isGlobalObject):
+        (JSC::JSObject::isVariableObject):
+        (JSC::JSObject::isStaticScopeObject):
+        (JSC::JSObject::isNameScopeObject):
+        (JSC::JSObject::isActivationObject):
+        (JSC::JSObject::isErrorInstance):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::fastGetOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::getOwnPropertySlot):
+        (JSC::JSProxy::getOwnPropertySlotByIndex):
+        (JSC::JSProxy::put):
+        (JSC::JSProxy::putByIndex):
+        (JSC::JSProxy::defineOwnProperty):
+        (JSC::JSProxy::deleteProperty):
+        (JSC::JSProxy::deletePropertyByIndex):
+        (JSC::JSProxy::getPropertyNames):
+        (JSC::JSProxy::getOwnPropertyNames):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::objectAtScope):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        (JSC::isJSString):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::isObject):
+        (JSC::TypeInfo::structureIsImmortal):
+        (JSC::TypeInfo::zeroedGCDataOffset):
+        (JSC::TypeInfo::inlineTypeFlags):
+        * runtime/MapData.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::defineProperties):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChainForChainAccess):
+        (JSC::normalizePrototypeChain):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::createStructure):
+        * runtime/RegExp.h:
+        (JSC::RegExp::createStructure):
+        * runtime/SparseArrayValueMap.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+        * runtime/Structure.h:
+        (JSC::Structure::id):
+        (JSC::Structure::idBlob):
+        (JSC::Structure::objectInitializationFields):
+        (JSC::Structure::structureIDOffset):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+        * runtime/StructureIDTable.cpp: Added.
+        (JSC::StructureIDTable::StructureIDTable):
+        (JSC::StructureIDTable::~StructureIDTable):
+        (JSC::StructureIDTable::resize):
+        (JSC::StructureIDTable::flushOldTables):
+        (JSC::StructureIDTable::allocateID):
+        (JSC::StructureIDTable::deallocateID):
+        * runtime/StructureIDTable.h: Added.
+        (JSC::StructureIDTable::base):
+        (JSC::StructureIDTable::get):
+        * runtime/SymbolTable.h:
+        * runtime/TypedArrayType.cpp:
+        (JSC::typeForTypedArrayType):
+        * runtime/TypedArrayType.h:
+        * runtime/WeakMapData.h:
+
+2014-02-26  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Unconditional logging in compileFTLOSRExit
+        https://bugs.webkit.org/show_bug.cgi?id=129407
+
+        Reviewed by Michael Saboff.
+
+        This was causing tests to fail with the FTL enabled.
+
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+
+2014-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Remove unused access types
+        https://bugs.webkit.org/show_bug.cgi?id=129385
+
+        Reviewed by Filip Pizlo.
+
+        Remove unused cruft.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        * bytecode/StructureStubInfo.h:
+        (JSC::isGetByIdAccess):
+        (JSC::isPutByIdAccess):
+
+2014-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Function.prototype.apply has a bad time with the spread operator
+        https://bugs.webkit.org/show_bug.cgi?id=129381
+
+        Reviewed by Mark Hahnenberg.
+
+        Make sure our apply logic handle the spread operator correctly.
+        To do this we simply emit the enumeration logic that we'd normally
+        use for other enumerations, but only store the first two results
+        to registers.  Then perform a varargs call.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2014-02-26  Mark Lam  <mark.lam@apple.com>
+
+        Compilation policy management belongs in operationOptimize(), not the DFG Driver.
+        <https://webkit.org/b/129355>
+
+        Reviewed by Filip Pizlo.
+
+        By compilation policy, I mean the rules for determining whether to
+        compile, when to compile, when to attempt compilation again, etc.  The
+        few of these policy decisions that were previously being made in the
+        DFG driver are now moved to operationOptimize() where we keep the rest
+        of the policy logic.  Decisions that are based on the capabilities
+        supported by the DFG are moved to DFG capabiliityLevel().
+
+        I've run the following benchmarks:
+        1. the collection of jsc benchmarks on the jsc executable vs. its
+           baseline.
+        2. Octane 2.0 in browser without the WebInspector.
+        3. Octane 2.0 in browser with the WebInspector open and a breakpoint
+           set somewhere where it won't break.
+
+        In all of these, the results came out to be a wash as expected.
+
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::isSupported):
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForClosureCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * jit/JITOperations.cpp:
+
+2014-02-26  Mark Lam  <mark.lam@apple.com>
+
+        ASSERTION FAILED: m_heap->vm()->currentThreadIsHoldingAPILock() in inspector-protocol/*.
+        <https://webkit.org/b/129364>
+
+        Reviewed by Alexey Proskuryakov.
+
+        InjectedScriptModule::ensureInjected() needs an APIEntryShim.
+
+        * inspector/InjectedScriptModule.cpp:
+        (Inspector::InjectedScriptModule::ensureInjected):
+        - Added the needed but missing APIEntryShim. 
+
+2014-02-25  Mark Lam  <mark.lam@apple.com>
+
+        Web Inspector: CRASH when evaluating in console of JSContext RWI with disabled breakpoints.
+        <https://webkit.org/b/128766>
+
+        Reviewed by Geoffrey Garen.
+
+        Make the JSLock::grabAllLocks() work the same way as for the C loop LLINT.
+        The reasoning is that we don't know of any clients that need unordered
+        re-entry into the VM from different threads. So, we're enforcing ordered
+        re-entry i.e. we must re-grab locks in the reverse order of dropping locks.
+
+        The crash in this bug happened because we were allowing unordered re-entry,
+        and the following type of scenario occurred:
+
+        1. Thread T1 locks the VM, and enters the VM to execute some JS code.
+        2. On entry, T1 detects that VM::m_entryScope is null i.e. this is the
+           first time it entered the VM.
+           T1 sets VM::m_entryScope to T1's entryScope.
+        3. T1 drops all locks.
+
+        4. Thread T2 locks the VM, and enters the VM to execute some JS code.
+           On entry, T2 sees that VM::m_entryScope is NOT null, and therefore
+           does not set the entryScope.
+        5. T2 drops all locks.
+
+        6. T1 re-grabs locks.
+        7. T1 returns all the way out of JS code. On exit from the outer most
+           JS function, T1 clears VM::m_entryScope (because T1 was the one who
+           set it).
+        8. T1 unlocks the VM.
+
+        9. T2 re-grabs locks.
+        10. T2 proceeds to execute some code and expects VM::m_entryScope to be
+            NOT null, but it turns out to be null. Assertion failures and
+            crashes ensue.
+
+        With ordered re-entry, at step 6, T1 will loop and yield until T2 exits
+        the VM. Hence, the issue will no longer manifest.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::grabAllLocks):
+        * runtime/JSLock.h:
+        (JSC::JSLock::DropAllLocks::dropDepth):
+
+2014-02-25  Mark Lam  <mark.lam@apple.com>
+
+        Need to initialize VM stack data even when the VM is on an exclusive thread.
+        <https://webkit.org/b/129265>
+
+        Not reviewed.
+
+        Relanding r164627 now that <https://webkit.org/b/129341> is fixed.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::shouldDropAllLocks):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::addCurrentThread):
+        * runtime/JSLock.cpp:
+        (JSC::JSLockHolder::JSLockHolder):
+        (JSC::JSLockHolder::init):
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::setExclusiveThread):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::grabAllLocks):
+        * runtime/JSLock.h:
+        (JSC::JSLock::hasExclusiveThread):
+        (JSC::JSLock::exclusiveThread):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::hasExclusiveThread):
+        (JSC::VM::exclusiveThread):
+        (JSC::VM::setExclusiveThread):
+        (JSC::VM::currentThreadIsHoldingAPILock):
+
+2014-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Inline caching in the FTL on ARM64 should "work"
+        https://bugs.webkit.org/show_bug.cgi?id=129334
+
+        Reviewed by Mark Hahnenberg.
+        
+        Gets us to the point where simple tests that use inline caching are passing.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        (JSC::LinkBuffer::shrink):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfGetById):
+        (JSC::FTL::sizeOfPutById):
+        (JSC::FTL::sizeOfCall):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        * jit/GPRInfo.h:
+        * offlineasm/arm64.rb:
+
+2014-02-25  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r164627.
+        http://trac.webkit.org/changeset/164627
+        https://bugs.webkit.org/show_bug.cgi?id=129325
+
+        Broke SubtleCrypto tests (Requested by ap on #webkit).
+
+        * API/APIShims.h:
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::shouldDropAllLocks):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::addCurrentThread):
+        * runtime/JSLock.cpp:
+        (JSC::JSLockHolder::JSLockHolder):
+        (JSC::JSLockHolder::init):
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::grabAllLocks):
+        * runtime/JSLock.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::currentThreadIsHoldingAPILock):
+
+2014-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        ARM64 rshift64 should be an arithmetic shift
+        https://bugs.webkit.org/show_bug.cgi?id=129323
+
+        Reviewed by Mark Hahnenberg.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::rshift64):
+
+2014-02-25  Sergio Villar Senin  <svillar@igalia.com>
+
+        [CSS Grid Layout] Add ENABLE flag
+        https://bugs.webkit.org/show_bug.cgi?id=129153
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig: added ENABLE_CSS_GRID_LAYOUT feature flag.
+
+2014-02-25  Michael Saboff  <msaboff@apple.com>
+
+        JIT Engines use the wrong stack limit for stack checks
+        https://bugs.webkit.org/show_bug.cgi?id=129314
+
+        Reviewed by Filip Pizlo.
+
+        Change the Baseline and DFG code to use VM::m_stackLimit for stack limit checks.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * runtime/VM.h:
+        (JSC::VM::addressOfStackLimit):
+
+2014-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/164493.
+        
+        It causes crashes, apparently because it's removing too many barriers. I will investigate
+        later.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationToAbbreviatedString):
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::insertStoreBarrier):
+        * dfg/DFGNode.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::isNotNully):
+        (JSC::FTL::LowerDFGToLLVM::isNully):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+        (JSC::FTL::LowerDFGToLLVM::speculateNotCell):
+
+2014-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Fix build.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2014-02-24  Oliver Hunt  <oliver@apple.com>
+
+        Spread operator has a bad time when applied to call function
+        https://bugs.webkit.org/show_bug.cgi?id=128853
+
+        Reviewed by Geoffrey Garen.
+
+        Follow on from the previous patch the added an extra slot to
+        op_call_varargs (and _call, _call_eval, _construct).  We now
+        use the slot as an offset to in effect act as a 'slice' on
+        the spread subject.  This allows us to automatically retain
+        all our existing argument and array optimisatons.  Most of
+        this patch is simply threading the offset around.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::getArgumentByVal):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeFrameForVarargs):
+        (JSC::loadVarargs):
+        * interpreter/Interpreter.h:
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileLoadVarargs):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToArguments):
+        * runtime/Arguments.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArray.h:
+
+2014-02-24  Mark Lam  <mark.lam@apple.com>
+
+        Need to initialize VM stack data even when the VM is on an exclusive thread.
+        <https://webkit.org/b/129265>
+
+        Reviewed by Geoffrey Garen.
+
+        We check VM::exclusiveThread as an optimization to forego the need to do
+        JSLock locking. However, we recently started piggy backing on JSLock's
+        lock() and unlock() to initialize VM stack data (stackPointerAtVMEntry
+        and lastStackTop) to appropriate values for the current thread. This is
+        needed because we may be acquiring the lock to enter the VM on a different
+        thread.
+
+        As a result, we ended up not initializing the VM stack data when
+        VM::exclusiveThread causes us to bypass the locking activity. Even though
+        the VM::exclusiveThread will not have to deal with the VM being entered
+        on a different thread, it still needs to initialize the VM stack data.
+        The VM relies on that data being initialized properly once it has been
+        entered.
+
+        With this fix, we push the check for exclusiveThread down into the JSLock,
+        and handle the bypassing of unneeded locking activity there while still
+        executing the necessary the VM stack data initialization.
+
+        * API/APIShims.h:
+        (JSC::APIEntryShim::APIEntryShim):
+        (JSC::APICallbackShim::shouldDropAllLocks):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::addCurrentThread):
+        * runtime/JSLock.cpp:
+        (JSC::JSLockHolder::JSLockHolder):
+        (JSC::JSLockHolder::init):
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::setExclusiveThread):
+        (JSC::JSLock::lock):
+        (JSLock::unlock):
+        (JSLock::currentThreadIsHoldingLock):
+        (JSLock::dropAllLocks):
+        (JSLock::grabAllLocks):
+        * runtime/JSLock.h:
+        (JSC::JSLock::exclusiveThread):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::exclusiveThread):
+        (JSC::VM::setExclusiveThread):
+        (JSC::VM::currentThreadIsHoldingAPILock):
+
+2014-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should do polymorphic PutById inlining
+        https://bugs.webkit.org/show_bug.cgi?id=129210
+
+        Reviewed by Mark Hahnenberg and Oliver Hunt.
+        
+        This makes PutByIdStatus inform us about polymorphic cases by returning an array of
+        PutByIdVariants. The DFG now has a node called MultiPutByOffset that indicates a
+        selection of multiple inlined PutByIdVariants.
+        
+        MultiPutByOffset is almost identical to MultiGetByOffset, which we added in
+        http://trac.webkit.org/changeset/164207.
+        
+        This also does some FTL refactoring to make MultiPutByOffset share code with some nodes
+        that generate similar code.
+        
+        1% speed-up on V8v7 due to splay improving by 6.8%. Splay does the thing where it
+        sometimes swaps field insertion order, creating fake polymorphism.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        (JSC::PutByIdStatus::dump):
+        * bytecode/PutByIdStatus.h:
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (JSC::PutByIdStatus::isSimple):
+        (JSC::PutByIdStatus::numVariants):
+        (JSC::PutByIdStatus::variants):
+        (JSC::PutByIdStatus::at):
+        (JSC::PutByIdStatus::operator[]):
+        * bytecode/PutByIdVariant.cpp: Added.
+        (JSC::PutByIdVariant::dump):
+        (JSC::PutByIdVariant::dumpInContext):
+        * bytecode/PutByIdVariant.h: Added.
+        (JSC::PutByIdVariant::PutByIdVariant):
+        (JSC::PutByIdVariant::replace):
+        (JSC::PutByIdVariant::transition):
+        (JSC::PutByIdVariant::kind):
+        (JSC::PutByIdVariant::isSet):
+        (JSC::PutByIdVariant::operator!):
+        (JSC::PutByIdVariant::structure):
+        (JSC::PutByIdVariant::oldStructure):
+        (JSC::PutByIdVariant::newStructure):
+        (JSC::PutByIdVariant::structureChain):
+        (JSC::PutByIdVariant::offset):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::emitPrototypeChecks):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::emitPutById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::MultiPutByOffsetData::writesStructures):
+        (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::hasMultiPutByOffsetData):
+        (JSC::DFG::Node::multiPutByOffsetData):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileAllocatePropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::compileReallocatePropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+        (JSC::FTL::LowerDFGToLLVM::loadProperty):
+        (JSC::FTL::LowerDFGToLLVM::storeProperty):
+        (JSC::FTL::LowerDFGToLLVM::addressOfProperty):
+        (JSC::FTL::LowerDFGToLLVM::storageForTransition):
+        (JSC::FTL::LowerDFGToLLVM::allocatePropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::reallocatePropertyStorage):
+        (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+        * tests/stress/fold-multi-put-by-offset-to-put-by-offset.js: Added.
+        * tests/stress/multi-put-by-offset-reallocation-butterfly-cse.js: Added.
+        * tests/stress/multi-put-by-offset-reallocation-cases.js: Added.
+
+2014-02-24  peavo@outlook.com  <peavo@outlook.com>
+
+        JSC regressions after r164494
+        https://bugs.webkit.org/show_bug.cgi?id=129272
+
+        Reviewed by Mark Lam.
+
+        * offlineasm/x86.rb: Only avoid reverse opcode (fdivr) for Windows.
+
+2014-02-24  Tamas Gergely  <tgergely.u-szeged@partner.samsung.com>
+
+        Code cleanup: remove leftover ENABLE(WORKERS) macros and support.
+        https://bugs.webkit.org/show_bug.cgi?id=129255
+
+        Reviewed by Csaba Osztrogonác.
+
+        ENABLE_WORKERS macro was removed in r159679.
+        Support is now also removed from xcconfig files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-02-24  David Kilzer  <ddkilzer@apple.com>
+
+        Remove redundant setting in FeatureDefines.xcconfig
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-02-23  Sam Weinig  <sam@webkit.org>
+
+        Update FeatureDefines.xcconfig
+
+        Rubber-stamped by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-02-23  Dean Jackson  <dino@apple.com>
+
+        Sort the project file with sort-Xcode-project-file.
+
+        Rubber-stamped by Sam Weinig.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-02-23  Sam Weinig  <sam@webkit.org>
+
+        Move telephone number detection behind its own ENABLE macro
+        https://bugs.webkit.org/show_bug.cgi?id=129236
+
+        Reviewed by Dean Jackson.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Add ENABLE_TELEPHONE_NUMBER_DETECTION.
+
+2014-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Refine DFG+FTL inlining and compilation limits
+        https://bugs.webkit.org/show_bug.cgi?id=129212
+
+        Reviewed by Mark Hahnenberg.
+        
+        Allow larger functions to be DFG-compiled. Institute a limit on FTL compilation,
+        and set that limit quite high. Institute a limit on inlining-into. The idea here is
+        that large functions tend to be autogenerated, and code generators like emscripten
+        appear to leave few inlining opportunities anyway. Also, we don't want the code
+        size explosion that we would risk if we allowed compilation of a large function and
+        then inlined a ton of stuff into it.
+        
+        This is a 0.5% speed-up on Octane v2 and almost eliminates the typescript
+        regression. This is a 9% speed-up on AsmBench.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::noticeIncomingCall):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::isSmallEnoughToInlineCodeInto):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLState.h:
+        (JSC::FTL::shouldShowDisassembly):
+        * runtime/Options.h:
+
+2014-02-22  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r164507): Crash beneath JSGlobalObjectInspectorController::reportAPIException at facebook.com, twitter.com, youtube.com
+        https://bugs.webkit.org/show_bug.cgi?id=129227
+
+        Reviewed by Eric Carlson.
+
+        Reverted r164507.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValue.mm:
+        (valueToArray):
+        (valueToDictionary):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueCreateJSONString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::ConsoleMessage):
+        (Inspector::ConsoleMessage::autogenerateMetadata):
+        * inspector/ConsoleMessage.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/ScriptCallStack.cpp:
+        * inspector/ScriptCallStack.h:
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::createScriptCallStackForConsole):
+        (Inspector::createScriptCallStackFromException):
+        * inspector/ScriptCallStackFactory.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::enable):
+        (Inspector::InspectorConsoleAgent::addMessageToConsole):
+        (Inspector::InspectorConsoleAgent::count):
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::breakpointActionLog):
+
+2014-02-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove some unreachable code (-Wunreachable-code)
+        https://bugs.webkit.org/show_bug.cgi?id=129220
+
+        Reviewed by Eric Carlson.
+
+        * API/tests/testapi.c:
+        (EvilExceptionObject_convertToType):
+        * disassembler/udis86/udis86_decode.c:
+        (decode_operand):
+
+2014-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, ARMv7 build fix.
+
+        * assembler/ARMv7Assembler.h:
+
+2014-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible for a LinkBuffer to outlive the MacroAssembler and still be useful
+        https://bugs.webkit.org/show_bug.cgi?id=124733
+
+        Reviewed by Oliver Hunt.
+        
+        This also takes the opportunity to de-duplicate some branch compaction code.
+
+        * assembler/ARM64Assembler.h:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::buffer):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerData::AssemblerData):
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::storage):
+        (JSC::AssemblerBuffer::grow):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::executableOffsetFor):
+        (JSC::LinkBuffer::applyOffset):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::link):
+        * assembler/MacroAssemblerARMv7.h:
+
+2014-02-21  Brent Fulgham  <bfulgham@apple.com>
+
+        Extend media support for WebVTT sources
+        https://bugs.webkit.org/show_bug.cgi?id=129156
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig: Add new feature define for AVF_CAPTIONS
+
+2014-02-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JSContext inspection should report exceptions in the console
+        https://bugs.webkit.org/show_bug.cgi?id=128776
+
+        Reviewed by Timothy Hatcher.
+
+        When JavaScript API functions have an exception, let the inspector
+        know so it can log the JavaScript and Native backtrace that caused
+        the exception.
+
+        Include some clean up of ConsoleMessage and ScriptCallStack construction.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValue.mm:
+        (reportExceptionToInspector):
+        (valueToArray):
+        (valueToDictionary):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueCreateJSONString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        When seeing an exception, let the inspector know there was an exception.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::appendAPIBacktrace):
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        Log API exceptions by also grabbing the native backtrace.
+
+        * inspector/ScriptCallStack.h:
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::firstNonNativeCallFrame):
+        (Inspector::ScriptCallStack::append):
+        Minor extensions to ScriptCallStack to make it easier to work with.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::ConsoleMessage):
+        (Inspector::ConsoleMessage::autogenerateMetadata):
+        Provide better default information if the first call frame was native.
+
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::extractSourceInformationFromException):
+        (Inspector::createScriptCallStackFromException):
+        Perform the handling here of inserting a fake call frame for exceptions
+        if there was no call stack (e.g. a SyntaxError) or if the first call
+        frame had no information.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::ConsoleMessage):
+        (Inspector::ConsoleMessage::autogenerateMetadata):
+        * inspector/ConsoleMessage.h:
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::createScriptCallStackForConsole):
+        * inspector/ScriptCallStackFactory.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::enable):
+        (Inspector::InspectorConsoleAgent::addMessageToConsole):
+        (Inspector::InspectorConsoleAgent::count):
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::breakpointActionLog):
+        ConsoleMessage cleanup.
+
+2014-02-21  Oliver Hunt  <oliver@apple.com>
+
+        Add extra space to op_call and related opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=129170
+
+        Reviewed by Mark Lam.
+
+        No change in behaviour, just some refactoring to add an extra
+        slot to the op_call instructions, and refactoring to make similar
+        changes easier in future.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-02-21  Mark Lam  <mark.lam@apple.com>
+
+        gatherFromOtherThread() needs to align the sp before gathering roots.
+        <https://webkit.org/b/129169>
+
+        Reviewed by Geoffrey Garen.
+
+        The GC scans the stacks of other threads using MachineThreads::gatherFromOtherThread().
+        gatherFromOtherThread() defines the range of the other thread's stack as
+        being bounded by the other thread's stack pointer and stack base. While
+        the stack base will always be aligned to sizeof(void*), the stack pointer
+        may not be. This is because the other thread may have just pushed a 32-bit
+        value on its stack before we suspended it for scanning.
+
+        The fix is to round the stack pointer up to the next aligned address of
+        sizeof(void*) and start scanning from there. On 64-bit systems, we will
+        effectively ignore the 32-bit word at the bottom of the stack (top of the
+        stack for stacks growing up) because it cannot be a 64-bit pointer anyway.
+        64-bit pointers should always be stored on 64-bit aligned boundaries (our
+        conservative scan algorithm already depends on this assumption).
+
+        On 32-bit systems, the rounding is effectively a no-op.
+
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddSpan):
+        - Hardened somne assertions so that we can catch misalignment issues on
+          release builds as well.
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromOtherThread):
+
+2014-02-21  Matthew Mirman  <mmirman@apple.com>
+
+        Added a GetMyArgumentsLengthSafe and added a speculation check.
+        https://bugs.webkit.org/show_bug.cgi?id=129051
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
+
+2014-02-21  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win][LLINT] Many JSC stress test failures.
+        https://bugs.webkit.org/show_bug.cgi?id=129155
+
+        Reviewed by Michael Saboff.
+
+        Intel syntax has reversed operand order compared to AT&T syntax, so we need to swap the operand order, in this case on floating point operations.
+        Also avoid using the reverse opcode (e.g. fdivr), as this puts the result at the wrong position in the floating point stack.
+        E.g. "divd ft0, ft1" would translate to fdivr st, st(1) (Intel syntax) on Windows, but this puts the result in st, when it should be in st(1).
+
+        * offlineasm/x86.rb: Swap operand order on Windows.
+
+2014-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG write barriers should do more speculations
+        https://bugs.webkit.org/show_bug.cgi?id=129160
+
+        Reviewed by Mark Hahnenberg.
+        
+        Replace ConditionalStoreBarrier with the cheapest speculation that you could do
+        instead.
+        
+        Miniscule speed-up on some things. It's a decent difference in code size, though.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationToAbbreviatedString):
+        * bytecode/SpeculatedType.h:
+        (JSC::isNotCellSpeculation):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::insertStoreBarrier):
+        (JSC::DFG::FixupPhase::insertPhantomCheck):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateOther):
+        (JSC::DFG::Node::shouldSpeculateNotCell):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::isNotOther):
+        (JSC::FTL::LowerDFGToLLVM::isOther):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+        (JSC::FTL::LowerDFGToLLVM::speculateOther):
+        (JSC::FTL::LowerDFGToLLVM::speculateNotCell):
+
+2014-02-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Revert r164486, causing a number of test failures.
+
+        Unreviewed rollout.
+
+2014-02-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Revive SABI (aka shouldAlwaysBeInlined)
+        https://bugs.webkit.org/show_bug.cgi?id=129159
+
+        Reviewed by Mark Hahnenberg.
+        
+        This is a small Octane speed-up.
+
+        * jit/Repatch.cpp:
+        (JSC::linkFor): This code was assuming that if it's invoked then the caller is a DFG code block. That's wrong, since it's now used by all of the JITs.
+
+2014-02-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JSContext inspection should report exceptions in the console
+        https://bugs.webkit.org/show_bug.cgi?id=128776
+
+        Reviewed by Timothy Hatcher.
+
+        When JavaScript API functions have an exception, let the inspector
+        know so it can log the JavaScript and Native backtrace that caused
+        the exception.
+
+        Include some clean up of ConsoleMessage and ScriptCallStack construction.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValue.mm:
+        (reportExceptionToInspector):
+        (valueToArray):
+        (valueToDictionary):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueCreateJSONString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        When seeing an exception, let the inspector know there was an exception.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::appendAPIBacktrace):
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        Log API exceptions by also grabbing the native backtrace.
+
+        * inspector/ScriptCallStack.h:
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::firstNonNativeCallFrame):
+        (Inspector::ScriptCallStack::append):
+        Minor extensions to ScriptCallStack to make it easier to work with.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::ConsoleMessage):
+        (Inspector::ConsoleMessage::autogenerateMetadata):
+        Provide better default information if the first call frame was native.
+
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::extractSourceInformationFromException):
+        (Inspector::createScriptCallStackFromException):
+        Perform the handling here of inserting a fake call frame for exceptions
+        if there was no call stack (e.g. a SyntaxError) or if the first call
+        frame had no information.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::ConsoleMessage):
+        (Inspector::ConsoleMessage::autogenerateMetadata):
+        * inspector/ConsoleMessage.h:
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::createScriptCallStackForConsole):
+        * inspector/ScriptCallStackFactory.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::enable):
+        (Inspector::InspectorConsoleAgent::addMessageToConsole):
+        (Inspector::InspectorConsoleAgent::count):
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::breakpointActionLog):
+        ConsoleMessage cleanup.
+
+2014-02-20  Anders Carlsson  <andersca@apple.com>
+
+        Modernize JSGlobalLock and JSLockHolder
+        https://bugs.webkit.org/show_bug.cgi?id=129105
+
+        Reviewed by Michael Saboff.
+
+        Use std::mutex and std::thread::id where possible.
+
+        * runtime/JSLock.cpp:
+        (JSC::GlobalJSLock::GlobalJSLock):
+        (JSC::GlobalJSLock::~GlobalJSLock):
+        (JSC::GlobalJSLock::initialize):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        * runtime/JSLock.h:
+
+2014-02-20  Mark Lam  <mark.lam@apple.com>
+
+        virtualForWithFunction() should not throw an exception with a partially initialized frame.
+        <https://webkit.org/b/129134>
+
+        Reviewed by Michael Saboff.
+
+        Currently, when JITOperations.cpp's virtualForWithFunction() fails to
+        prepare the callee function for execution, it proceeds to throw the
+        exception using the callee frame which is only partially initialized
+        thus far. Instead, it should be throwing the exception using the caller
+        frame because:
+        1. the error happened "in" the caller while preparing the callee for
+           execution i.e. the caller frame is the top fully initialized frame
+           on the stack.
+        2. the callee frame is not fully initialized yet, and the unwind
+           mechanism cannot depend on the data in it.
+
+        * jit/JITOperations.cpp:
+
+2014-02-20  Mark Lam  <mark.lam@apple.com>
+
+        DefaultGCActivityCallback::doWork() should reschedule if GC is deferred.
+        <https://webkit.org/b/129131>
+
+        Reviewed by Mark Hahnenberg.
+
+        Currently, DefaultGCActivityCallback::doWork() does not check if the GC
+        needs to be deferred before commencing. As a result, the GC may crash
+        and/or corrupt data because the VM is not in the consistent state needed
+        for the GC to run. With this fix, doWork() now checks if the GC is
+        supposed to be deferred and re-schedules if needed. It only commences
+        with GC'ing when it's safe to do so.
+
+        * runtime/GCActivityCallback.cpp:
+        (JSC::DefaultGCActivityCallback::doWork):
+
+2014-02-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Math.imul gives wrong results
+        https://bugs.webkit.org/show_bug.cgi?id=126345
+
+        Reviewed by Mark Hahnenberg.
+
+        Don't truncate non-int doubles to 0 -- that's just not how ToInt32 works.
+        Instead, take a slow path that will do the right thing.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::imulThunkGenerator):
+
+2014-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should do its own static estimates of execution frequency before it starts creating OSR entrypoints
+        https://bugs.webkit.org/show_bug.cgi?id=129129
+
+        Reviewed by Geoffrey Garen.
+        
+        We estimate execution counts based on loop depth, and then use those to estimate branch
+        weights. These weights then get carried all the way down to LLVM prof branch_weights
+        meta-data.
+        
+        This is better than letting LLVM do its own static estimates, since by the time we
+        generate LLVM IR, we may have messed up the CFG due to OSR entrypoint creation. Of
+        course, it would be even better if we just slurped in some kind of execution counts
+        from profiling, but we don't do that, yet.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::BasicBlock):
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGBlockInsertionSet.cpp:
+        (JSC::DFG::BlockInsertionSet::insert):
+        (JSC::DFG::BlockInsertionSet::insertBefore):
+        * dfg/DFGBlockInsertionSet.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+        * dfg/DFGNaturalLoops.h:
+        (JSC::DFG::NaturalLoops::loopDepth):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGStaticExecutionCountEstimationPhase.cpp: Added.
+        (JSC::DFG::StaticExecutionCountEstimationPhase::StaticExecutionCountEstimationPhase):
+        (JSC::DFG::StaticExecutionCountEstimationPhase::run):
+        (JSC::DFG::StaticExecutionCountEstimationPhase::applyCounts):
+        (JSC::DFG::performStaticExecutionCountEstimation):
+        * dfg/DFGStaticExecutionCountEstimationPhase.h: Added.
+
+2014-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL may not see a compact_unwind section if there weren't any stackmaps
+        https://bugs.webkit.org/show_bug.cgi?id=129125
+
+        Reviewed by Geoffrey Garen.
+        
+        It's OK to not have an unwind section, so long as the function also doesn't have any
+        OSR exits.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        (JSC::FTL::compile):
+        * ftl/FTLUnwindInfo.cpp:
+        (JSC::FTL::UnwindInfo::parse):
+        * ftl/FTLUnwindInfo.h:
+
+== Rolled over to ChangeLog-2014-02-20 ==
diff --git a/ChangeLog-2015-11-21 b/ChangeLog-2015-11-21
new file mode 100644
index 0000000..4b165dd
--- /dev/null
+++ b/ChangeLog-2015-11-21
@@ -0,0 +1,70730 @@
+2015-11-20  Andreas Kling  <akling@apple.com>
+
+        REGRESSION(r192536): Null pointer dereference in JSPropertyNameEnumerator::visitChildren().
+        <https://webkit.org/b/151495>
+
+        Reviewed by Mark Lam.
+
+        The copied space allocation in JSPropertyNameEnumerator::finishCreation()
+        may end up triggering a GC, and so JSPropertyNameEnumerator::visitChildren()
+        would get called while m_propertyNames was still null.
+
+        This patch fixes that by having visitChildren() check for pointer nullity
+        instead of the number of names, since that is non-zero even before the
+        allocation is made.
+
+        Added a test that induces GC during JSPropertyNameEnumerator construction
+        to cover this bug.
+
+        Test: property-name-enumerator-gc-151495.js
+
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::visitChildren):
+
+2015-11-20  Andreas Kling  <akling@apple.com>
+
+        GC timers should carry on gracefully when Heap claims it grew from GC.
+        <https://webkit.org/b/151521>
+
+        Reviewed by Mark Lam.
+
+        TL;DR the Heap "extra memory" reporting APIs are hard to use 100% correctly
+        and GC scheduling shouldn't break if someone makes a mistake with it.
+
+        The JSC::Heap allows you to report an extra memory cost for any GC object.
+        This is reported first when allocating the memory, and then each time the
+        object is visited during the marking phase.
+
+        When reporting an allocation, it's added to the Heap's "bytes allocated in
+        this cycle" counter. This contributes to the computed heap size at the start
+        of a collection.
+
+        When visiting a GC object that reports extra memory, it's added to the Heap's
+        "extra memory visited in this collection" counter. This contributes to the
+        computed heap size at the end of a collection.
+
+        As you can see, this means that visiting more memory than we said we allocated
+        can lead to the Heap thinking it's bigger after a collection than it was before.
+
+        Clients of this API do some sketchy things to compute costs, for instance
+        StringImpl cost is determined by dividing the number of bytes used for the
+        characters, and dividing it by the StringImpl's ref count. Since a JSString
+        could be backed by any StringImpl, any code that modifies a StringImpl's
+        ref count during collection will change the extra memory reported by all
+        JSString objects that wrap that StringImpl.
+
+        So anyways...
+
+        The object death rate, which is the basis for when to schedule the next
+        collection is computed like so:
+
+            deathRate = (sizeBeforeGC - sizeAfterGC) / sizeBeforeGC
+
+        This patch adds a safety mechanism that returns a zero death rate when the Heap
+        claims it grew from collection.
+
+        * heap/EdenGCActivityCallback.cpp:
+        (JSC::EdenGCActivityCallback::deathRate):
+        * heap/FullGCActivityCallback.cpp:
+        (JSC::FullGCActivityCallback::deathRate):
+
+2015-11-20  Mark Lam  <mark.lam@apple.com>
+
+        New JSC tests introduced in r192664 fail on ARM.
+        https://bugs.webkit.org/show_bug.cgi?id=151485
+
+        Reviewed by Geoffrey Garen.
+
+        The newly added tests are exposing some pre-existing bugs.  The bugs are tracked here:
+            https://bugs.webkit.org/show_bug.cgi?id=151514
+            https://bugs.webkit.org/show_bug.cgi?id=151515
+
+        Skipping the tests for now.
+
+        * tests/stress/op_div.js:
+        * tests/stress/op_rshift.js:
+        * tests/stress/op_urshift.js:
+
+2015-11-20  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should have a Select opcode
+        https://bugs.webkit.org/show_bug.cgi?id=150762
+
+        Reviewed by Benjamin Poulain.
+
+        This cleans up our conditional move implementation - specifically so that it distinguishes between
+        comparing the low 32 bits of a GPR and all bits of a GPR - and fixes bugs with operand ordering. It
+        then adds a Select opcode to B3 and adds all of the strength reduction and lowering magic that it
+        needs. Finally this change implements FTL::Output::select() in terms of B3::Select.
+
+        This patch lets us run Kraken/imaging-gaussian-blur. Running that benchmark using FTL+B3 is a 17%
+        speed-up. The compile times go down dramatically (by about 7x) and code quality stays about the same.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::moveDoubleConditionally32):
+        (JSC::MacroAssembler::moveDoubleConditionally64):
+        (JSC::MacroAssembler::moveDoubleConditionallyTest32):
+        (JSC::MacroAssembler::moveDoubleConditionallyTest64):
+        (JSC::MacroAssembler::moveDoubleConditionallyDouble):
+        (JSC::MacroAssembler::lea):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::moveConditionallyDouble):
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::moveConditionally32):
+        (JSC::MacroAssemblerX86Common::moveConditionallyTest32):
+        (JSC::MacroAssemblerX86Common::set32):
+        (JSC::MacroAssemblerX86Common::cmov):
+        (JSC::MacroAssemblerX86Common::moveConditionally): Deleted.
+        (JSC::MacroAssemblerX86Common::moveConditionallyTest): Deleted.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchNeg64):
+        (JSC::MacroAssemblerX86_64::moveConditionally64):
+        (JSC::MacroAssemblerX86_64::moveConditionallyTest64):
+        (JSC::MacroAssemblerX86_64::abortWithReason):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmovl_rr):
+        (JSC::X86Assembler::cmovl_mr):
+        (JSC::X86Assembler::cmovel_rr):
+        (JSC::X86Assembler::cmovnel_rr):
+        (JSC::X86Assembler::cmovpl_rr):
+        (JSC::X86Assembler::cmovnpl_rr):
+        (JSC::X86Assembler::cmovq_rr):
+        (JSC::X86Assembler::cmovq_mr):
+        (JSC::X86Assembler::cmoveq_rr):
+        (JSC::X86Assembler::cmovneq_rr):
+        (JSC::X86Assembler::cmovpq_rr):
+        (JSC::X86Assembler::cmovnpq_rr):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createCompare):
+        (JSC::B3::Air::LowerToAir::createSelect):
+        (JSC::B3::Air::LowerToAir::marshallCCallArgument):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3MoveConstants.cpp:
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::checkOpcode):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::dump):
+        (JSC::B3::ValueKey::materialize):
+        * b3/B3ValueKey.h:
+        (JSC::B3::ValueKey::ValueKey):
+        (JSC::B3::ValueKey::hash):
+        (JSC::B3::ValueKey::operator bool):
+        * b3/B3ValueKeyInlines.h:
+        (JSC::B3::ValueKey::ValueKey):
+        (JSC::B3::ValueKey::child):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testTruncSExt32):
+        (JSC::B3::testBasicSelect):
+        (JSC::B3::testSelectTest):
+        (JSC::B3::testSelectCompareDouble):
+        (JSC::B3::testSelectDouble):
+        (JSC::B3::testSelectDoubleTest):
+        (JSC::B3::testSelectDoubleCompareDouble):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::testIsZeroPtr):
+        (JSC::FTL::Output::testNonZeroPtr):
+        (JSC::FTL::Output::select):
+        (JSC::FTL::Output::extractValue):
+        (JSC::FTL::Output::fence):
+
+2015-11-20  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add Air lowering to BitNot() for Xor(value, -1)
+        https://bugs.webkit.org/show_bug.cgi?id=151474
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::not32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::not64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::notq_r):
+        (JSC::X86Assembler::notq_m):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3ReduceStrength.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testNegValueSubOne):
+        (JSC::B3::testNegValueSubOne32):
+        (JSC::B3::testBitNotArg):
+        (JSC::B3::testBitNotImm):
+        (JSC::B3::testBitNotMem):
+        (JSC::B3::testBitNotArg32):
+        (JSC::B3::testBitNotImm32):
+        (JSC::B3::testBitNotMem32):
+        (JSC::B3::testBitNotOnBooleanAndBranch32):
+        (JSC::B3::int64Operands):
+        (JSC::B3::int32Operands):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::bitNot):
+
+2015-11-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Super use should be recorded in per-function scope
+        https://bugs.webkit.org/show_bug.cgi?id=151500
+
+        Reviewed by Geoffrey Garen.
+
+        "super" use is prohibited under the non-constructor / non-class-method-related functions.
+        This "super" use should be recorded in per-function scope to check its incorrect use after
+        parsing a function.
+        Currently, we accidentally record it to a lexical current scope. So when using "super" inside
+        a block scope, our "super" use guard miss it.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Parser::currentVariableScope):
+        (JSC::Parser::currentFunctionScope):
+        (JSC::Parser::declareVariable):
+        * tests/stress/super-in-lexical-scope.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntaxError.test):
+
+2015-11-20  Chris Dumez  <cdumez@apple.com>
+
+        Caching of properties on objects that have named property getters is sometimes incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=151453
+        <rdar://problem/23049343>
+
+        Reviewed by Gavin Barraclough.
+
+        Add new GetOwnPropertySlotIsImpureForPropertyAbsence TypeInfo flag to be
+        used by objects that have a non-'OverrideBuiltins' named property getter.
+        This flag prevents caching of properties that are missing as a named
+        property with this name may later become available.
+
+        Objects with an 'OverrideBuiltins' named property getter will keep using
+        the GetOwnPropertySlotIsImpure TypeInfo flag, which prevents all property
+        caching since named properties can override own properties or properties
+        on the prototype.
+
+        * bytecode/ComplexGetStatus.cpp:
+        (JSC::ComplexGetStatus::computeFor):
+        * bytecode/PropertyCondition.cpp:
+        (JSC::PropertyCondition::isStillValid):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryRepatchIn):
+        * jsc.cpp:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::getOwnPropertySlotIsImpure):
+        (JSC::TypeInfo::getOwnPropertySlotIsImpureForPropertyAbsence):
+        (JSC::TypeInfo::prohibitsPropertyCaching): Deleted.
+        * runtime/Structure.h:
+
+2015-11-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(r189433) Web Inspector: JSContext inspection exceptions should include native call frames by default
+        https://bugs.webkit.org/show_bug.cgi?id=151479
+
+        Reviewed by Brian Burg.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        Value accidentally got flipped when moving to initializer syntax.
+
+2015-11-19  Saam barati  <sbarati@apple.com>
+
+        [ES6] Add support for rest parameters
+        https://bugs.webkit.org/show_bug.cgi?id=38408
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements rest parameters from the ES6 spec.
+        http://www.ecma-international.org/ecma-262/6.0/index.html#sec-function-definitions
+
+        We implement the rest parameter as a new AST node. This AST node
+        lowers to "op_new_array X, op_copy_rest X". Note
+        that the op_copy_rest opcode does not have a result.
+        The bulk of this patch is implementing op_copy_rest.
+        This patch implements this in all four tiers in a straight forward way.
+        The opcode is implemented as a C call that will read the pertinent
+        arguments from the call frame and fill them into the array.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::invalidateForInContextForLocal):
+        (JSC::BytecodeGenerator::emitRestParameter):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignmentElementNode::toString):
+        (JSC::RestParameterNode::collectBoundIdentifiers):
+        (JSC::RestParameterNode::toString):
+        (JSC::RestParameterNode::bindValue):
+        (JSC::RestParameterNode::emit):
+        (JSC::SpreadExpressionNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::setEpoch):
+        (JSC::DFG::Node::numberOfArgumentsToSkip):
+        (JSC::DFG::Node::dumpChildren):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):
+        (JSC::DFG::SpeculativeJIT::compileCopyRest):
+        (JSC::DFG::SpeculativeJIT::compileNotifyWrite):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateClonedArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCopyRest):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewObject):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_out_of_band_arguments):
+        (JSC::JIT::emit_op_copy_rest):
+        * jit/JITOperations.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createBindingLocation):
+        (JSC::ASTBuilder::createRestParameter):
+        (JSC::ASTBuilder::createAssignmentElement):
+        * parser/NodeConstructors.h:
+        (JSC::AssignmentElementNode::AssignmentElementNode):
+        (JSC::RestParameterNode::RestParameterNode):
+        (JSC::DestructuringAssignmentNode::DestructuringAssignmentNode):
+        * parser/Nodes.h:
+        (JSC::DestructuringPatternNode::isBindingNode):
+        (JSC::DestructuringPatternNode::isRestParameter):
+        (JSC::DestructuringPatternNode::emitDirectBinding):
+        (JSC::RestParameterNode::name):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::declareRestOrNormalParameter):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        * parser/Parser.h:
+        (JSC::Parser::strictMode):
+        (JSC::Parser::isValidStrictMode):
+        (JSC::Parser::declareParameter):
+        (JSC::Parser::breakIsValid):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * tests/es6.yaml:
+        * tests/stress/rest-parameter-and-default-arguments.js: Added.
+        (assert):
+        (shouldThrowTDZ):
+        (foo):
+        (baz):
+        (i.shouldThrowTDZ):
+        * tests/stress/rest-parameter-basics.js: Added.
+        (assert):
+        (foo):
+        (bar):
+        (capture):
+        (baz):
+        (jaz):
+        (kaz):
+        (raz):
+        (restLength):
+        (testArgumentsObject):
+        (strictModeLikeArgumentsObject):
+        * tests/stress/rest-parameter-inlined.js: Added.
+        (assert):
+        (bar):
+        (foo):
+        (baz):
+        (jaz):
+
+2015-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should have a story for Ext/Trunc strength reduction
+        https://bugs.webkit.org/show_bug.cgi?id=151464
+
+        Reviewed by Geoffrey Garen.
+
+        The LLVM shift operations require the shift amount to have the same type as the shift base. The B3
+        shift operations require the shift amount to be an Int32. DFG concurs with this. But the initial
+        lowering should involve pretending the FTLOutput's shift operations still take an LLVM-style shift
+        amount so that we don't regress FTL->LLVM performance. That means emitting an extra Trunc. That means
+        that we want to be able to constant fold Trunc and be able to fold Trunc(ZExt).
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3ReduceStrength.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testSwitchChillDiv):
+        (JSC::B3::testTruncFold):
+        (JSC::B3::testZExt32):
+        (JSC::B3::testZExt32Fold):
+        (JSC::B3::testSExt32):
+        (JSC::B3::testSExt32Fold):
+        (JSC::B3::testTruncZExt32):
+        (JSC::B3::testTruncSExt32):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::baseIndex):
+        (JSC::FTL::Output::branch):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::bitAnd):
+        (JSC::FTL::Output::bitOr):
+        (JSC::FTL::Output::bitXor):
+        (JSC::FTL::Output::shl):
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::bitNot):
+        (JSC::FTL::Output::insertElement):
+        (JSC::FTL::Output::address):
+        (JSC::FTL::Output::baseIndex):
+
+2015-11-19  Mark Lam  <mark.lam@apple.com>
+
+        Create correctness tests for binary snippet operators.
+        https://bugs.webkit.org/show_bug.cgi?id=151465
+
+        Reviewed by Geoffrey Garen.
+
+        Implement a common infrastructure for generating and running tests on binary
+        operators.  Also re-implemented the op_add, op_sub, and op_mul tests to be based
+        on this new infrastructure.
+
+        * tests/stress/op_add.js:
+        * tests/stress/op_mul.js:
+        * tests/stress/op_sub.js:
+        - These were reimplemented using binary-op-test.js.
+
+        * tests/stress/op_div.js: Added.
+        * tests/stress/op_mod.js: Added.
+
+        * tests/stress/op_bitand.js: Added.
+        * tests/stress/op_bitor.js: Added.
+        * tests/stress/op_bitxor.js: Added.
+
+        * tests/stress/op_lshift.js: Added.
+        * tests/stress/op_rshift.js: Added.
+        * tests/stress/op_urshift.js: Added.
+
+        * tests/stress/resources/binary-op-test.js: Added.
+        - Common code for generating and running tests.
+
+2015-11-19  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] Fix AssignmentElement parsing
+        https://bugs.webkit.org/show_bug.cgi?id=151026
+
+        Reviewed by Geoffrey Garen.
+
+        When parsing an AssignmentPattern, any LeftHandSideExpression which
+        is a valid assignment target is acceptable.
+
+        Additionally, this change minimizes the amount of time spent
+        re-parsing ObjectLiteral and ArrayLiterals, by parsing as an
+        Expression first (the common case), and re-parsing only if the
+        result is a valid ObjectLiteral or ArrayLiteral followed by an `=`,
+        or if an error specifically indicates that the expression could
+        have been parsed as an AssignmentPattern.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignmentElementNode::collectBoundIdentifiers):
+        (JSC::AssignmentElementNode::bindValue):
+        (JSC::AssignmentElementNode::toString):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::isAssignmentLocation):
+        (JSC::ASTBuilder::isObjectLiteral):
+        (JSC::ASTBuilder::isArrayLiteral):
+        (JSC::ASTBuilder::isObjectOrArrayLiteral):
+        (JSC::ASTBuilder::createAssignmentElement):
+        * parser/NodeConstructors.h:
+        (JSC::AssignmentElementNode::AssignmentElementNode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isObjectLiteral):
+        (JSC::ExpressionNode::isArrayLiteral):
+        (JSC::AssignmentElementNode::assignmentTarget):
+        (JSC::AssignmentElementNode::divotStart):
+        (JSC::AssignmentElementNode::divotEnd):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::createAssignmentElement):
+        (JSC::Parser<LexerType>::parseBindingOrAssignmentElement):
+        (JSC::Parser<LexerType>::parseAssignmentElement):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        * parser/Parser.h:
+        (JSC::Parser::ExpressionErrorClassifier::ExpressionErrorClassifier):
+        (JSC::Parser::ExpressionErrorClassifier::~ExpressionErrorClassifier):
+        (JSC::Parser::ExpressionErrorClassifier::classifyExpressionError):
+        (JSC::Parser::ExpressionErrorClassifier::indicatesPossiblePattern):
+        (JSC::Parser::classifyExpressionError):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+        * tests/es6.yaml:
+        * tests/es6/destructuring_assignment_non_simple_target.js: Added.
+        (test.):
+        (test):
+        * tests/es6/destructuring_initializer_scoping.js: Added.
+        (test.tester):
+        * tests/stress/destructuring-assignment-syntax.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        * tests/stress/rest-elements.js:
+        (shouldThrow): Deleted.
+
+2015-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL->B3 lowering should support integer comparisons with the opcode abstracted and a few other things
+        https://bugs.webkit.org/show_bug.cgi?id=151463
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::signExt):
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::zeroExtPtr):
+        (JSC::FTL::Output::fpToInt):
+        (JSC::FTL::Output::fpToUInt):
+        (JSC::FTL::Output::fpToInt32):
+        (JSC::FTL::Output::baseIndex):
+        (JSC::FTL::Output::absolute):
+        (JSC::FTL::Output::load32NonNegative):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        (JSC::FTL::Output::above):
+        (JSC::FTL::Output::lessThan):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::doubleEqual):
+        (JSC::FTL::Output::doubleNotEqualOrUnordered):
+        (JSC::FTL::Output::doubleLessThan):
+        (JSC::FTL::Output::icmp): Deleted.
+        (JSC::FTL::Output::fcmp): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareLess):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareLessEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareGreater):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareGreaterEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileLogicalNot):
+        (JSC::FTL::DFG::LowerDFGToLLVM::baseIndex):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compare):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateTruthyObject):
+        (JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
+
+2015-11-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] When the iterated allocator is forced to spill, nuke the Moves that were already proven to be useless
+        https://bugs.webkit.org/show_bug.cgi?id=151461
+
+        Reviewed by Filip Pizlo.
+
+        Previously, when we had to spill, we were just inserting new Spill() and Fill()
+        in code while everything else remained identical.
+
+        Coalescing moves is a big part of the algorithm and takes a non-trivial time.
+        Since we were never removing Moves until reaching a successful coloring, we were
+        paying that cost with every single iteration.
+
+        With this patch, I keep a copy of the coalescing aliases when we make the first
+        potential spill decision. Before doing that, we have only simplified and coalesced
+        vertices that are provably colorable regardless of the other vertices' colors
+        (because their degree is <K, potentially after other edges were removed by simplification).
+
+        If we end up actually spilling, I use the old aliases to simplify the blocks if possible.
+
+        This is a 5% progression on "testComplex(64, 384)".
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::getAliasWhenSpilling):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::coalesce):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::selectSpill):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::assignColors):
+        (JSC::B3::Air::addSpillAndFillToProgram):
+        (JSC::B3::Air::iteratedRegisterCoalescingOnType):
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+
+2015-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix FTL->B3 lowering of Phi
+        https://bugs.webkit.org/show_bug.cgi?id=151460
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePhi):
+
+2015-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL->B3 lowering should support lazy slow paths, patchpoints, all integer comparisons, and more load/stores
+        https://bugs.webkit.org/show_bug.cgi?id=151459
+
+        Reviewed by Benjamin Poulain.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::absolute):
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::load8ZeroExt32):
+        (JSC::FTL::Output::load16SignExt32):
+        (JSC::FTL::Output::load16ZeroExt32):
+        (JSC::FTL::Output::load32):
+        (JSC::FTL::Output::load64):
+        (JSC::FTL::Output::loadPtr):
+        (JSC::FTL::Output::loadDouble):
+        (JSC::FTL::Output::store32):
+        (JSC::FTL::Output::store64):
+        (JSC::FTL::Output::storePtr):
+        (JSC::FTL::Output::storeDouble):
+        (JSC::FTL::Output::ascribeRange):
+        (JSC::FTL::Output::nonNegative32):
+        (JSC::FTL::Output::load32NonNegative):
+        (JSC::FTL::Output::icmp):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        (JSC::FTL::Output::above):
+        (JSC::FTL::Output::aboveOrEqual):
+        (JSC::FTL::Output::below):
+        (JSC::FTL::Output::belowOrEqual):
+        (JSC::FTL::Output::greaterThan):
+        (JSC::FTL::Output::greaterThanOrEqual):
+        (JSC::FTL::Output::lessThan):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::fcmp):
+        (JSC::FTL::Output::doubleEqual):
+        (JSC::FTL::Output::speculateMul):
+        (JSC::FTL::Output::patchpoint):
+        (JSC::FTL::Output::trap):
+        (JSC::FTL::Output::anchor):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+
+2015-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL->B3 lowering should support absolute(), double comparisons, and intToDouble()
+        https://bugs.webkit.org/show_bug.cgi?id=151457
+
+        Reviewed by Benjamin Poulain.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::fpToInt32):
+        (JSC::FTL::Output::fpToUInt32):
+        (JSC::FTL::Output::intToFP):
+        (JSC::FTL::Output::intToDouble):
+        (JSC::FTL::Output::unsignedToFP):
+        (JSC::FTL::Output::unsignedToDouble):
+        (JSC::FTL::Output::intCast):
+        (JSC::FTL::Output::baseIndex):
+        (JSC::FTL::Output::absolute):
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::load8ZeroExt32):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::fcmp):
+        (JSC::FTL::Output::doubleEqual):
+        (JSC::FTL::Output::doubleNotEqualOrUnordered):
+        (JSC::FTL::Output::doubleLessThan):
+        (JSC::FTL::Output::doubleLessThanOrEqual):
+        (JSC::FTL::Output::doubleGreaterThan):
+        (JSC::FTL::Output::doubleGreaterThanOrEqual):
+        (JSC::FTL::Output::doubleEqualOrUnordered):
+        (JSC::FTL::Output::doubleNotEqual):
+        (JSC::FTL::Output::doubleLessThanOrUnordered):
+        (JSC::FTL::Output::doubleLessThanOrEqualOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrEqualOrUnordered):
+        (JSC::FTL::Output::isZero32):
+        (JSC::FTL::Output::notZero32):
+
+2015-11-19  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL->B3 lowering should support checked int math
+        https://bugs.webkit.org/show_bug.cgi?id=151451
+
+        Reviewed by Saam Barati.
+
+        Adds lowering of ArithAdd/Sub/Mul to CheckAdd/Sub/Mul. Includes a nice refactoring of the OSR exit
+        code that made this a lot easier. Also needed to implement a few other ops in FTL::Output.
+
+        I ended up renaming "check" to "speculate" in FTL::Output, because it already had a thing called
+        "check". The FTL terminology for side-exit is "speculate", so I think that this is appropriate.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::sensibleDoubleToInt):
+        (JSC::FTL::Output::signExt):
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::zeroExtPtr):
+        (JSC::FTL::Output::fpToInt):
+        (JSC::FTL::Output::fpToUInt):
+        (JSC::FTL::Output::unsignedToFP):
+        (JSC::FTL::Output::unsignedToDouble):
+        (JSC::FTL::Output::intCast):
+        (JSC::FTL::Output::castToInt32):
+        (JSC::FTL::Output::fpCast):
+        (JSC::FTL::Output::intToPtr):
+        (JSC::FTL::Output::ptrToInt):
+        (JSC::FTL::Output::unreachable):
+        (JSC::FTL::Output::speculate):
+        (JSC::FTL::Output::speculateAdd):
+        (JSC::FTL::Output::speculateSub):
+        (JSC::FTL::Output::speculateMul):
+        (JSC::FTL::Output::trap):
+        (JSC::FTL::Output::check): Deleted.
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+
+2015-11-19  Mark Lam  <mark.lam@apple.com>
+
+        JIT snippet generator JumpLists should be returned as references.
+        https://bugs.webkit.org/show_bug.cgi?id=151445
+
+        Reviewed by Gavin Barraclough.
+
+        The JumpLists were being returned by value.  As a result, new jumps added to
+        them in the client are actually added to a temporary copy and promptly discarded.
+        Those jumps never get linked, resulting in infinite loops in DFG generated code
+        that used the snippets.
+
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::endJumpList):
+        (JSC::JITAddGenerator::slowPathJumpList):
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::endJumpList):
+        (JSC::JITMulGenerator::slowPathJumpList):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::endJumpList):
+        (JSC::JITSubGenerator::slowPathJumpList):
+
+2015-11-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed CLOOP buildfix after r192624.
+
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+        * runtime/MemoryStatistics.h:
+
+2015-11-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove unused LLVM API functions
+        https://bugs.webkit.org/show_bug.cgi?id=151184
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::typeOf): Deleted.
+        (JSC::FTL::getElementType): Deleted.
+        (JSC::FTL::getNamedFunction): Deleted.
+        (JSC::FTL::removeFunctionAttr): Deleted.
+        (JSC::FTL::getLinkage): Deleted.
+        (JSC::FTL::setVisibility): Deleted.
+        (JSC::FTL::isDeclaration): Deleted.
+        (JSC::FTL::linkModules): Deleted.
+        (JSC::FTL::getValueName): Deleted.
+        (JSC::FTL::getNamedGlobal): Deleted.
+        (JSC::FTL::getFirstGlobal): Deleted.
+        (JSC::FTL::getNextGlobal): Deleted.
+        (JSC::FTL::createMemoryBufferWithContentsOfFile): Deleted.
+        (JSC::FTL::parseBitcodeInContext): Deleted.
+        (JSC::FTL::disposeMemoryBuffer): Deleted.
+        (JSC::FTL::getParamTypes): Deleted.
+        (JSC::FTL::constIntToPtr): Deleted.
+        (JSC::FTL::constBitCast): Deleted.
+        * llvm/LLVMAPIFunctions.h:
+
+2015-11-19  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
+
+        Remove unnecessary PLATFORM(EFL) macro in globalMemoryStatistics()
+        https://bugs.webkit.org/show_bug.cgi?id=151301
+
+        Reviewed by Csaba Osztrogonác.
+
+        EXECUTABLE_ALLOCATOR_FIXED is enabled on EFL port. So we don't need to keep
+        PLATFORM(EFL) macro anymore. Besides ENABLE(EXECUTABLE_ALLOCATOR_FIXED) guard
+        isn't related with ExecutableAllocator::committedByteCount() closely. So this patch
+        removes it as well.
+
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+
+2015-11-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add bitwise Double-Int conversion to B3
+        https://bugs.webkit.org/show_bug.cgi?id=151432
+
+        Reviewed by Filip Pizlo.
+
+        This is needed for boxing/unboxing doubles.
+
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::bitwiseCastConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::bitwiseCastConstant):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::bitwiseCastConstant):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testDoubleArgToInt64BitwiseCast):
+        (JSC::B3::testDoubleImmToInt64BitwiseCast):
+        (JSC::B3::testTwoBitwiseCastOnDouble):
+        (JSC::B3::testBitwiseCastOnDoubleInMemory):
+        (JSC::B3::testInt64BArgToDoubleBitwiseCast):
+        (JSC::B3::testInt64BImmToDoubleBitwiseCast):
+        (JSC::B3::testTwoBitwiseCastOnInt64):
+        (JSC::B3::testBitwiseCastOnInt64InMemory):
+        (JSC::B3::int64Operands):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::bitCast):
+
+2015-11-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add some missing load/store to FTLB3Output
+        https://bugs.webkit.org/show_bug.cgi?id=151427
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::load8ZeroExt32):
+        (JSC::FTL::Output::load16SignExt32):
+        (JSC::FTL::Output::load16ZeroExt32):
+        (JSC::FTL::Output::loadFloatToDouble):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::load32):
+        (JSC::FTL::Output::loadPtr):
+        (JSC::FTL::Output::loadDouble):
+        (JSC::FTL::Output::load8SignExt32): Deleted.
+        (JSC::FTL::Output::load8ZeroExt32): Deleted.
+        (JSC::FTL::Output::load16SignExt32): Deleted.
+        (JSC::FTL::Output::load16ZeroExt32): Deleted.
+        (JSC::FTL::Output::loadFloatToDouble): Deleted.
+
+2015-11-18  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix typos in r192605
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileUpsilon):
+
+2015-11-18  Filip Pizlo  <fpizlo@apple.com> and Benjamin Poulain  <bpoulain@apple.com>
+
+        FTL should be able to compile a small function with B3
+        https://bugs.webkit.org/show_bug.cgi?id=151423
+
+        Reviewed by Filip Pizlo.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::~Output):
+        (JSC::FTL::Output::initialize):
+        (JSC::FTL::Output::appendTo):
+        (JSC::FTL::Output::lockedStackSlot):
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::branch):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::newBlock):
+        (JSC::FTL::Output::setOrigin):
+        (JSC::FTL::Output::origin):
+        (JSC::FTL::Output::framePointer):
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::constInt32):
+        (JSC::FTL::Output::constIntPtr):
+        (JSC::FTL::Output::constInt64):
+        (JSC::FTL::Output::constDouble):
+        (JSC::FTL::Output::upsilon):
+        (JSC::FTL::Output::phi):
+        (JSC::FTL::Output::add):
+        (JSC::FTL::Output::sub):
+        (JSC::FTL::Output::mul):
+        (JSC::FTL::Output::neg):
+        (JSC::FTL::Output::doubleAdd):
+        (JSC::FTL::Output::doubleSub):
+        (JSC::FTL::Output::doubleMul):
+        (JSC::FTL::Output::doubleDiv):
+        (JSC::FTL::Output::doubleNeg):
+        (JSC::FTL::Output::bitAnd):
+        (JSC::FTL::Output::bitOr):
+        (JSC::FTL::Output::bitXor):
+        (JSC::FTL::Output::shl):
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::load64):
+        (JSC::FTL::Output::store32):
+        (JSC::FTL::Output::store64):
+        (JSC::FTL::Output::storePtr):
+        (JSC::FTL::Output::storeDouble):
+        (JSC::FTL::Output::addPtr):
+        (JSC::FTL::Output::address):
+        (JSC::FTL::Output::below):
+        (JSC::FTL::Output::isZero32):
+        (JSC::FTL::Output::notZero32):
+        (JSC::FTL::Output::isZero64):
+        (JSC::FTL::Output::notZero64):
+        (JSC::FTL::Output::isNull):
+        (JSC::FTL::Output::notNull):
+        (JSC::FTL::Output::testIsZero32):
+        (JSC::FTL::Output::testNonZero32):
+        (JSC::FTL::Output::testIsZero64):
+        (JSC::FTL::Output::testNonZero64):
+        (JSC::FTL::Output::testIsZeroPtr):
+        (JSC::FTL::Output::testNonZeroPtr):
+        (JSC::FTL::Output::call):
+        (JSC::FTL::Output::operation):
+        (JSC::FTL::Output::jump):
+        (JSC::FTL::Output::branch):
+        (JSC::FTL::Output::ret):
+        (JSC::FTL::Output::unreachable):
+        (JSC::FTL::Output::check):
+        (JSC::FTL::Output::anchor):
+        (JSC::FTL::Output::addIncomingToPhi):
+        (JSC::FTL::Output::~Output): Deleted.
+        (JSC::FTL::Output::appendTo): Deleted.
+        (JSC::FTL::Output::param): Deleted.
+        (JSC::FTL::Output::load): Deleted.
+        (JSC::FTL::Output::store): Deleted.
+        (JSC::FTL::Output::store16): Deleted.
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        (JSC::FTL::CommonValues::initializeConstants):
+        * ftl/FTLCommonValues.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::safelyInvalidateAfterTermination):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileToThis):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStrCat):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArrayifyToStructure):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutAccessorById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutGetterSetterById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutAccessorByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArrayPush):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArrayPop):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateScopedArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateClonedArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArrayBuffer):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileToStringOrCallStringConstructor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileToPrimitive):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStringCharAt):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileLoadVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileHasIndexedProperty):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileHasGenericProperty):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileHasStructureProperty):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetDirectPname):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetPropertyEnumerator):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileToIndexString):
+        (JSC::FTL::DFG::LowerDFGToLLVM::didOverflowStack):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
+        (JSC::FTL::DFG::LowerDFGToLLVM::contiguousPutByValOutOfBounds):
+        (JSC::FTL::DFG::LowerDFGToLLVM::switchStringSlow):
+        (JSC::FTL::DFG::LowerDFGToLLVM::doubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToLLVM::sensibleDoubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToLLVM::jsValueToStrictInt52):
+        (JSC::FTL::DFG::LowerDFGToLLVM::doubleToStrictInt52):
+        (JSC::FTL::DFG::LowerDFGToLLVM::vmCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callStackmap):
+        (JSC::FTL::DFG::LowerDFGToLLVM::probe):
+        (JSC::FTL::DFG::LowerDFGToLLVM::crash):
+        (JSC::FTL::lowerDFGToLLVM):
+        (JSC::FTL::DFG::LowerDFGToLLVM::vmCallNoExceptions): Deleted.
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::sensibleDoubleToInt):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::ceil64):
+        (JSC::FTL::Output::ctlz32):
+        (JSC::FTL::Output::addWithOverflow32):
+        (JSC::FTL::Output::subWithOverflow32):
+        (JSC::FTL::Output::mulWithOverflow32):
+        (JSC::FTL::Output::addWithOverflow64):
+        (JSC::FTL::Output::subWithOverflow64):
+        (JSC::FTL::Output::mulWithOverflow64):
+        (JSC::FTL::Output::doubleAbs):
+        (JSC::FTL::Output::doubleSin):
+        (JSC::FTL::Output::doubleCos):
+        (JSC::FTL::Output::doublePow):
+        (JSC::FTL::Output::doublePowi):
+        (JSC::FTL::Output::doubleSqrt):
+        (JSC::FTL::Output::doubleLog):
+        (JSC::FTL::Output::call):
+        (JSC::FTL::Output::trap):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State): Deleted.
+        * ftl/FTLState.h:
+        * ftl/FTLWeight.h:
+        (JSC::FTL::Weight::frequencyClass):
+
+2015-11-18  Saam barati  <sbarati@apple.com>
+
+        There is a bug when default parameter values are mixed with destructuring parameter values
+        https://bugs.webkit.org/show_bug.cgi?id=151369
+
+        Reviewed by Geoffrey Garen and Mark Lam.
+
+        Relanding this after a rollout.
+
+        This patch changes our parser to no longer declare destructuring
+        parameters as "var"s. This is a weird bug that just happened
+        to work in a world without default parameter values. In a world with
+        default parameter values this is just completely wrong. It would
+        incorrectly transform this program:
+        ```function foo(a = function() { b = 40; }, {b}) { a(); return b; }; foo(undefined, {b: 42}); // Should return 40```
+        into
+        ```function foo(a = function() { b = 40; }, {b}) { var b; a(); return b; }; foo(undefined, {b:42}); // Returns 42, not 40.```
+        Which is wrong because we end up with two distinct bindings of "b" when
+        there should only be one.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::getUsedVariables):
+        (JSC::Parser::strictMode):
+        (JSC::Parser::isValidStrictMode):
+        (JSC::Parser::declareParameter):
+        (JSC::Parser::breakIsValid):
+        (JSC::Scope::declareBoundParameter): Deleted.
+        (JSC::Parser::declareBoundParameter): Deleted.
+        * tests/stress/es6-default-parameters.js:
+
+2015-11-18  Mark Lam  <mark.lam@apple.com>
+
+        Snippefy op_mul for the baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=151393
+
+        Reviewed by Geoffrey Garen.
+
+        Benchmarks shows that perf is neutral on x86 and x86_64 with the DFG enabled.
+
+        With the DFG disabled (relying on the baseline JIT for perf), LongSpider
+        3d-morph shows a 7.6% regression.  However, there are other benchmarks that shows
+        a progression e.g. on Kraken, audio-beat-detection and audio-fft.
+
+        Upon inspection of the generated code for 3d-morph, the only differences is the
+        added use of a scratch register for the result as well as a jump around the
+        code that handles double types.  It does not look like we're generating bad code.
+        I'll consider the perf acceptable in aggregate.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::boxInt32):
+        * jit/IntrinsicEmitter.cpp:
+        (JSC::AccessCase::emitIntrinsicGetter):
+        - Changed AssemblyHelpers::boxInt32() to take a TagRegistersMode.
+          The pre-existing boxInt32() always assume that the tag registers are not
+          available.  Since we should assume we have tag registers by default, I also
+          changed all the other clients to explicitly specify a more of
+          DoNotHaveTagRegisters.  That is except for the snippet generators that do have
+          the tag registers.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::compileBinaryArithOp): Deleted.
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mul): Deleted.
+        (JSC::JIT::emitSlow_op_mul): Deleted.
+        * jit/JITMulGenerator.cpp: Added.
+        (JSC::JITMulGenerator::generateFastPath):
+        * jit/JITMulGenerator.h: Added.
+        (JSC::JITMulGenerator::JITMulGenerator):
+        (JSC::JITMulGenerator::didEmitFastPath):
+        (JSC::JITMulGenerator::endJumpList):
+        (JSC::JITMulGenerator::slowPathJumpList):
+
+        * tests/stress/op_mul.js: Added.
+        (o1.valueOf):
+        (generateScenarios):
+        (printScenarios):
+        (testCases.func):
+        (func):
+        (initializeTestCases):
+        (stringifyIfNeeded):
+        (isIdentical):
+        (runTest):
+        - Tests that JIT op_mul results are equivalent to the expected values as
+          defined by the LLINT.
+
+2015-11-18  Mark Lam  <mark.lam@apple.com>
+
+        Remove some unnecessary jumps in snippet code.
+        https://bugs.webkit.org/show_bug.cgi?id=151415
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, the snippet generators always emit a jump at the end of the fast
+        path.  In the baseline JIT and FTL, this results in a jump to the very next
+        instruction.  I've change it to assume that the fast path will just fall thru,
+        and let the client decide instead if it wants/needs a jump or not after the fast
+        path.
+
+        I also changed the generators to provide a didEmitFastPath() query explicitly
+        declare if they actually generated the fast path, instead of having the client
+        infer it from an empty endJumpList.
+
+        Benchmarks show that perf is neutral with this change (tested on x86_64).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::didEmitFastPath):
+        (JSC::JITAddGenerator::endJumpList):
+        (JSC::JITAddGenerator::slowPathJumpList):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_sub):
+        * jit/JITSubGenerator.cpp:
+        (JSC::JITSubGenerator::generateFastPath):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::didEmitFastPath):
+        (JSC::JITSubGenerator::endJumpList):
+        (JSC::JITSubGenerator::slowPathJumpList):
+
+2015-11-18  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r192436 and r192586.
+        https://bugs.webkit.org/show_bug.cgi?id=151417
+
+        Caused a hang in the inspector and a crash @ google.com.
+        (Requested by saamyjoon on #webkit).
+
+        Reverted changesets:
+
+        "Allow any LeftHandSideExpression as a valid
+        AssignmentElement"
+        https://bugs.webkit.org/show_bug.cgi?id=151026
+        http://trac.webkit.org/changeset/192436
+
+        "There is a bug when default parameter values are mixed with
+        destructuring parameter values"
+        https://bugs.webkit.org/show_bug.cgi?id=151369
+        http://trac.webkit.org/changeset/192586
+
+2015-11-17  Keith Miller  <keith_miller@apple.com>
+
+        [JSC] TailCalls should not trigger assertion failures when running with the jsc profiler on.
+        https://bugs.webkit.org/show_bug.cgi?id=151359
+
+        Reviewed by Geoffrey Garen.
+
+        If we have the profiler on when parsing tail calls in the dfg we would emit a CountExecutions node
+        following a TailCall node as our bytecode for tail calls always emits a op_ret following an op_tail_call.
+        This trips assertions that no nodes follow a terminal in a basic block. This patch fixes this issue by
+        not emiting a CountExecutions when we have a tail call that is terminal i.e. the tail caller is not
+        inlined into another function or the tail caller is inlined but is in tail position itself.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleVarargsCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * tests/stress/tail-call-profiler.js: Added.
+        (tail):
+        (inlineTail):
+        (inlineTailVarArgs):
+        (inlineTailTernary):
+        (body):
+
+2015-11-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make LBasicBlock into an alias for B3::BasicBlock. #ifdef anything that does not compile
+        https://bugs.webkit.org/show_bug.cgi?id=151381
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLAbbreviations.h:
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::AbstractHeap::decorateInstruction):
+        (JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
+        * ftl/FTLAbstractHeap.h:
+        (JSC::FTL::AbstractHeap::AbstractHeap):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::newBlock):
+        (JSC::FTL::Output::insertNewBlocksBefore):
+        (JSC::FTL::Output::addIncomingToPhi):
+        (JSC::FTL::Output::Output): Deleted.
+        (JSC::FTL::Output::initialize): Deleted.
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        * ftl/FTLIntrinsicRepository.cpp:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileForwardVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInstanceOf):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildSwitch):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToLLVM::crash):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::Output):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::addIncomingToPhi):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::dumpState):
+        * ftl/FTLValueRange.cpp:
+        (JSC::FTL::ValueRange::decorateInstruction):
+        * ftl/FTLValueRange.h:
+        (JSC::FTL::ValueRange::ValueRange):
+
+2015-11-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Implement the B3 equivalent of FTLCompile
+        https://bugs.webkit.org/show_bug.cgi?id=151370
+
+        Reviewed by Benjamin Poulain.
+
+        This adds a B3 version of FTLCompile and gets the data structures related to installing an FTL
+        compilation (i.e. the finalizer and JITCode) to be aware of B3. That requires stubbing a lot of stuff
+        out and also simplifying a lot of code around having everything inside a single contiguous chunk of
+        JIT code rather than some opaque JIT code handles plus miscellaneous side-codes. This compiles but
+        crashes because lowering isn't done yet.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addDataSection):
+        (JSC::B3::Procedure::calleeSaveRegisters):
+        (JSC::B3::Procedure::addValueIndex):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::code):
+        * ftl/FTLB3Compile.cpp: Added.
+        (JSC::FTL::compile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExceptionHandlerManager.cpp:
+        (JSC::FTL::ExceptionHandlerManager::callOperationExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::lazySlowPathExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::getByIdOSRExit):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::~JITCode):
+        (JSC::FTL::JITCode::initializeB3Code):
+        (JSC::FTL::JITCode::initializeExitThunks):
+        (JSC::FTL::JITCode::addDataSection):
+        (JSC::FTL::JITCode::initializeAddressForCall):
+        (JSC::FTL::JITCode::initializeArityCheckEntrypoint):
+        (JSC::FTL::JITCode::addressForCall):
+        (JSC::FTL::JITCode::contains):
+        (JSC::FTL::JITCode::exitThunks):
+        (JSC::FTL::JITCode::ftl):
+        * ftl/FTLJITCode.h:
+        (JSC::FTL::JITCode::b3Code):
+        (JSC::FTL::JITCode::handles):
+        (JSC::FTL::JITCode::dataSections):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::codeSize):
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::gatherRegistersToSpillForCallIfException):
+
+2015-11-18  Saam barati  <sbarati@apple.com>
+
+        There is a bug when default parameter values are mixed with destructuring parameter values
+        https://bugs.webkit.org/show_bug.cgi?id=151369
+
+        Reviewed by Geoffrey Garen and Mark Lam.
+
+        This patch changes our parser to no longer declare destructuring
+        parameters as "var"s. This is a weird bug that just happened
+        to work in a world without default parameter values. In a world with
+        default parameter values this is just completely wrong. It would
+        incorrectly transform this program:
+        ```function foo(a = function() { b = 40; }, {b}) { a(); return b; }; foo(undefined, {b: 42}); // Should return 40```
+        into
+        ```function foo(a = function() { b = 40; }, {b}) { var b; a(); return b; }; foo(undefined, {b:42}); // Returns 42, not 40.```
+        Which is wrong because we end up with two distinct bindings of "b" when
+        there should only be one.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::getUsedVariables):
+        (JSC::Parser::strictMode):
+        (JSC::Parser::isValidStrictMode):
+        (JSC::Parser::declareParameter):
+        (JSC::Parser::breakIsValid):
+        (JSC::Scope::declareBoundParameter): Deleted.
+        (JSC::Parser::declareBoundParameter): Deleted.
+        * tests/stress/es6-default-parameters.js:
+
+2015-11-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Untangle the dependencies on FTLAbbreviations a bit
+        https://bugs.webkit.org/show_bug.cgi?id=151375
+
+        Reviewed by Geoffrey Garen.
+
+        FTLAbbreviations was included in many places but in most cases
+        we just need the Abbreviated types. Update the #include accordingly.
+
+        Also remove the IntrinsicRepository dependency from the B3Output.
+
+        * ftl/FTLAbstractHeap.cpp:
+        * ftl/FTLAbstractHeap.h:
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::stackmapIntrinsic):
+        (JSC::FTL::Output::frameAddressIntrinsic):
+        (JSC::FTL::Output::patchpointInt64Intrinsic):
+        (JSC::FTL::Output::patchpointVoidIntrinsic):
+        * ftl/FTLCommonValues.cpp:
+        * ftl/FTLCommonValues.h:
+        * ftl/FTLFormattedValue.h:
+        * ftl/FTLIntrinsicRepository.cpp:
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompilationInfo.h:
+        * ftl/FTLStackmapArgumentList.h:
+        * ftl/FTLState.cpp:
+        * ftl/FTLState.h:
+        * ftl/FTLTypedPointer.h:
+
+2015-11-17  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::generate should separate out the final Air codegen, so that it can be done outside the Graph safepoint
+        https://bugs.webkit.org/show_bug.cgi?id=151371
+
+        Reviewed by Benjamin Poulain.
+
+        One of the FTL optimizations is that while the expensive backend is running, we are at a "graph
+        safepoint" that allows the VM to do GCs and other dangerous and time-sensitive things without
+        waiting for the compilation thread. While in the safepoint, we cannot do anything that touches
+        anything other than the backend's state. That means, for example, that we wouldn't be able to run
+        any of the stackmap generation callbacks, since those need to mess with DFG state.
+
+        That means that we need to separate the B3 pipeline into "preparation" and "generation".
+        Preparation is all of the expensive stuff: all B3 phases, lowering to Air, all Air phases.
+        Generation is just the part where we turn fully lowered Air into machine code. Generation also
+        happens to be the part where we call stackmap generation callbacks. In other words, preparation
+        is exactly the stuff that should go into the graph safepoint, while generation is the stuff that
+        we want to do after we emerge from the safepoint.
+
+        Because the tests were using the higher-level Compilation API, I didn't have to change any test
+        code. The FTL will not use that high-level API.
+
+        * b3/B3Compilation.cpp:
+        (JSC::B3::Compilation::Compilation):
+        * b3/B3Generate.cpp:
+        (JSC::B3::prepareForGeneration):
+        (JSC::B3::generate):
+        (JSC::B3::generateToAir):
+        * b3/B3Generate.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::LowerToAir):
+        (JSC::B3::lowerToAir):
+        * b3/B3LowerToAir.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::Procedure):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::takeByproducts):
+        (JSC::B3::Procedure::code):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::proc):
+        (JSC::B3::Air::Code::lastPhaseName):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        (JSC::B3::Air::generate):
+        * b3/air/AirGenerate.h:
+
+2015-11-17  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL::State should be able to refer to B3::Procedure
+
+        Rubber stamped by Benjamin Poulain.
+
+        * ftl/FTLState.h:
+
+2015-11-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add an empty FTLOutput for B3 that crashes on any operation
+        https://bugs.webkit.org/show_bug.cgi?id=151366
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLB3Output.h: Added.
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLAbstractHeap.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::createPhiVariables):
+        * ftl/FTLOutput.cpp:
+        * ftl/FTLOutput.h:
+
+2015-11-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Do not copy the adjacency list when we just need to manipulate them
+        https://bugs.webkit.org/show_bug.cgi?id=151343
+
+        Reviewed by Geoffrey Garen.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::precoloredCoalescingHeuristic):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::conservativeHeuristic):
+
+2015-11-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove FTLOutput operations that act directly on floats
+        https://bugs.webkit.org/show_bug.cgi?id=151342
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithFRound):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutByVal):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::store):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::loadFloatToDouble):
+        (JSC::FTL::Output::fround):
+        (JSC::FTL::Output::loadFloat): Deleted.
+
+2015-11-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a FTL_USES_B3 compile-time setting and set it to 0.
+
+        Rubber stamped by Benjamin Poulain.
+
+        * dfg/DFGCommon.h:
+
+2015-11-17  Filip Pizlo  <fpizlo@apple.com>
+
+        CheckAdd/Mul should have commutativity optimizations in B3->Air lowering
+        https://bugs.webkit.org/show_bug.cgi?id=151214
+
+        Reviewed by Geoffrey Garen.
+
+        This is an overhaul of CheckAdd/CheckSub/CheckMul that fixes bugs, improves codegen, and
+        simplifies the contract between B3 and its client.
+
+        Previously, the idea was that the operands to the Air BranchAdd/Sub/Mul matched the children of
+        the B3 CheckAdd/Sub/Mul, or at least, that's what the B3::CheckSpecial would make you believe.
+        This meant that B3/Air had to avoid optimizations that would break this protocol. This prevented
+        commutativity optimizations on CheckAdd/Mul and it also prevented strength reduction from
+        CheckMul(x, 2) to CheckAdd(x, x), for example. Those optimizations would break things because the
+        client's Stackmap generation callback was allowed to assume that the first entry in params.reps
+        was the first child. Also, there was a contract between B3 and its client that for CheckAdd/Sub,
+        the client would undo the operation by doing the opposite operation with the params.reps[0] as the
+        source and params.reps[1] as the destination.
+
+        This not only prevented commutativity optimizations, it also led to bugs. Here are two bugs that
+        we had:
+
+        - Add(x, x) would not work. The client would be told to undo the add using %x as both the source
+          and destination. The client would use a sub() instruction. The result would not be x - it would
+          be zero.
+
+        - Mul where the result got coalesced with one of the sources. You can't undo a multiplication, so
+          you need to keep the inputs alive until after the result is computed - i.e. the inputs are late
+          uses. I initially thought I worked around this by using a three-operand form of Mul, but of
+          course that doesn't actually fix the issue.
+
+        This patch fixes these issues comprehensively by introducing the following changes:
+
+        The params.reps corresponding to the first two children of CheckAdd/Sub/Mul and the first child of
+        Check are always garbage: if you want to know the values of those children in the slow path, pass
+        them as additional stackmap children. This makes it clear to the compiler whose values you
+        actually care about, and frees the compiler to reorder and commute the non-stackmap children.
+
+        The "undo" of an Add or Sub is handled internally by B3: the client doesn't have to know anything
+        about undoing. B3 does it. The contract is simply that if a B3::Value* is a stackmap child of a
+        CheckXYZ, then the corresponding entry in params.reps inside the stackmap generator callback will
+        contain the value of that Value*. For Add and Sub, B3 undoes the operation. For Add(x, x), the
+        undo uses the carry flag and some shift magic. For Mul, B3 uses LateUse:
+
+        A new kind of Arg::Role called Arg::LateUse is introduced: This kind of use means that the use
+        happens at the start of the execution of the next instruction. None of the built-in Air opcodes
+        use LateUse, but it is used by B3::CheckSpecial. We use it to implement CheckMul.
+
+        Finally, this change fixes testComplex to actually create many live variables. This revealed a
+        really dumb pathology in allocateStack(), and this patch fixes it. Basically, it's a bad idea to
+        build interference graphs by repeatedly recreating the same cliques.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::test32):
+        (JSC::MacroAssemblerX86Common::setCarry):
+        (JSC::MacroAssemblerX86Common::invert):
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::Air::numB3Args):
+        (JSC::B3::CheckSpecial::Key::Key):
+        (JSC::B3::CheckSpecial::Key::dump):
+        (JSC::B3::CheckSpecial::CheckSpecial):
+        (JSC::B3::CheckSpecial::forEachArg):
+        (JSC::B3::CheckSpecial::isValid):
+        (JSC::B3::CheckSpecial::generate):
+        (JSC::B3::CheckSpecial::dumpImpl):
+        (JSC::B3::CheckSpecial::deepDumpImpl):
+        * b3/B3CheckSpecial.h:
+        (JSC::B3::CheckSpecial::Key::Key):
+        (JSC::B3::CheckSpecial::Key::operator==):
+        (JSC::B3::CheckSpecial::Key::operator!=):
+        (JSC::B3::CheckSpecial::Key::opcode):
+        (JSC::B3::CheckSpecial::Key::numArgs):
+        (JSC::B3::CheckSpecial::Key::stackmapRole):
+        (JSC::B3::CheckSpecial::Key::hash):
+        * b3/B3CheckValue.cpp:
+        (JSC::B3::CheckValue::~CheckValue):
+        (JSC::B3::CheckValue::convertToAdd):
+        (JSC::B3::CheckValue::CheckValue):
+        * b3/B3CheckValue.h:
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::checkMulConstant):
+        (JSC::B3::Const32Value::checkNegConstant):
+        (JSC::B3::Const32Value::divConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::checkMulConstant):
+        (JSC::B3::Const64Value::checkNegConstant):
+        (JSC::B3::Const64Value::divConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.h:
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::~PatchpointSpecial):
+        (JSC::B3::PatchpointSpecial::forEachArg):
+        (JSC::B3::PatchpointSpecial::isValid):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        * b3/B3StackmapSpecial.h:
+        * b3/B3StackmapValue.cpp:
+        (JSC::B3::StackmapValue::append):
+        (JSC::B3::StackmapValue::appendSomeRegister):
+        (JSC::B3::StackmapValue::setConstrainedChild):
+        * b3/B3StackmapValue.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::checkMulConstant):
+        (JSC::B3::Value::checkNegConstant):
+        (JSC::B3::Value::divConstant):
+        * b3/B3Value.h:
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirArg.cpp:
+        (WTF::printInternal):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isAnyUse):
+        (JSC::B3::Air::Arg::isEarlyUse):
+        (JSC::B3::Air::Arg::isLateUse):
+        (JSC::B3::Air::Arg::isDef):
+        (JSC::B3::Air::Arg::forEachTmp):
+        (JSC::B3::Air::Arg::isUse): Deleted.
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::build):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::allocate):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdge::hash):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdge::dump):
+        (JSC::B3::Air::addSpillAndFillToProgram):
+        (JSC::B3::Air::iteratedRegisterCoalescingOnType):
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::Liveness::Liveness):
+        (JSC::B3::Air::Liveness::LocalCalc::LocalCalc):
+        (JSC::B3::Air::Liveness::LocalCalc::live):
+        (JSC::B3::Air::Liveness::LocalCalc::takeLive):
+        (JSC::B3::Air::Liveness::LocalCalc::execute):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirReportUsedRegisters.cpp:
+        (JSC::B3::Air::reportUsedRegisters):
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/testb3.cpp:
+        (JSC::B3::testMulArg):
+        (JSC::B3::testMulArgStore):
+        (JSC::B3::testMulAddArg):
+        (JSC::B3::testMulArgs):
+        (JSC::B3::testComplex):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::testCheckLessThan):
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::testCheckAddImm):
+        (JSC::B3::testCheckAddImmCommute):
+        (JSC::B3::testCheckAddImmSomeRegister):
+        (JSC::B3::testCheckAdd):
+        (JSC::B3::testCheckAdd64):
+        (JSC::B3::testCheckSubImm):
+        (JSC::B3::testCheckSubBadImm):
+        (JSC::B3::testCheckSub):
+        (JSC::B3::testCheckSub64):
+        (JSC::B3::testCheckNeg):
+        (JSC::B3::testCheckNeg64):
+        (JSC::B3::testCheckMul):
+        (JSC::B3::testCheckMulMemory):
+        (JSC::B3::testCheckMul2):
+        (JSC::B3::testCheckMul64):
+        (JSC::B3::run):
+
+2015-11-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Air should lay out code optimally
+        https://bugs.webkit.org/show_bug.cgi?id=150478
+
+        Reviewed by Geoffrey Garen.
+
+        This adds a phase that optimizes code layout using something that's worked well for me in the past.
+        Basically, it just forces pre-ordering on the CFG, except that:
+
+        - Blocks that are only reachable by Rare control flow are scheduled separately, all the way at the
+          end.
+
+        - Successors of the same frequency class are pushed in ascending order of frequency, so that the most
+          frequent successor is scheduled immediately after.
+
+        This also adds the requisite branch flipping, so that a branch's taken successor is not the
+        fall-through block. We want the fall-through to be the not-taken successor if at all possible.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3BlockWorklist.h:
+        * b3/B3GenericFrequentedBlock.h:
+        (JSC::B3::GenericFrequentedBlock::frequency):
+        (JSC::B3::GenericFrequentedBlock::isRare):
+        (JSC::B3::GenericFrequentedBlock::dump):
+        * b3/B3Procedure.h:
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isDoubleCond):
+        (JSC::B3::Air::Arg::isCondition):
+        (JSC::B3::Air::Arg::isSpecial):
+        (JSC::B3::Air::Arg::asDoubleCondition):
+        (JSC::B3::Air::Arg::isInvertible):
+        (JSC::B3::Air::Arg::inverted):
+        * b3/air/AirBasicBlock.h:
+        (JSC::B3::Air::BasicBlock::index):
+        (JSC::B3::Air::BasicBlock::setIndex):
+        (JSC::B3::Air::BasicBlock::size):
+        (JSC::B3::Air::BasicBlock::begin):
+        (JSC::B3::Air::BasicBlock::containsPredecessor):
+        (JSC::B3::Air::BasicBlock::frequency):
+        * b3/air/AirBlockWorklist.h: Added.
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::findNextBlock):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::proc):
+        (JSC::B3::Air::Code::at):
+        (JSC::B3::Air::Code::operator[]):
+        (JSC::B3::Air::Code::blockList):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirOptimizeBlockOrder.cpp: Added.
+        (JSC::B3::Air::optimizeBlockOrder):
+        * b3/air/AirOptimizeBlockOrder.h: Added.
+
+2015-11-17  Andreas Kling  <akling@apple.com>
+
+        [JSC] JSPropertyNameEnumerator could be destructorless.
+        <https://webkit.org/b/151242>
+
+        Reviewed by Mark Lam.
+
+        Make JSPropertyNameEnumerator destructorless and have it store the property names
+        cache in CopiedSpace. This was the most popular occupant of 64-byte destructor cells
+        in MarkedSpace, so making it destructorless gets rid of some ill-filled MarkedBlocks.
+
+        This patch had two issues on 32-bit platforms when first landed:
+
+        - Copied space allocations are required to be 8-byte divisible in size.
+
+        - WriteBarrier<Unknown> and WriteBarrier<JSString> are not the same size on 32-bit;
+          the former is a 64-bit EncodedJSValue internally, and the latter is a 32-bit JSCell*.
+          My patch was reinterpret_cast'ing a WriteBarrier<JSString> to a WriteBarrier<Unknown>
+          when passing to SlotVisitor::appendValues(), which led to invalid addresses getting
+          marked and strings getting GC'd prematurely.
+
+        * heap/CopyToken.h:
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::finishCreation):
+        (JSC::JSPropertyNameEnumerator::visitChildren):
+        (JSC::JSPropertyNameEnumerator::copyBackingStore):
+        (JSC::JSPropertyNameEnumerator::destroy): Deleted.
+        * runtime/JSPropertyNameEnumerator.h:
+
+2015-11-17  Mark Lam  <mark.lam@apple.com>
+
+        Refactoring: move branchMul32's imm arg to the 3rd argument to be consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=151358
+
+        Reviewed by Saam Barati.
+
+        branch32, branchAdd32, and branchSub32 all have it as the 3rd argument.
+        branchMul32 is the odd man out.  This patch makes branchMul32 consistent with
+        the others.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchMul32):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branchMul32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchMul32):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchMul32):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::branchNeg32):
+        (JSC::MacroAssemblerSH4::branchMul32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+
+2015-11-17  Mark Lam  <mark.lam@apple.com>
+
+        Use the JITAddGenerator snippet in the DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=151266
+
+        Reviewed by Geoffrey Garen.
+
+        No tests added because the op_add.js stress test already tests for correctness
+        (using the LLINT as a reference).
+
+        Performance-wise, the difference from the pre-existing DFG implementation is
+        insignificant (at least as measured on x86 and x86_64).  We're moving forward
+        with adopting this implementation because it unifies the 32-bit and 64-bit
+        implementations, as well as lays ground work for a repatching inline cache
+        implementation of op_add later.
+
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::resultType):
+        - Made an assertion less restrictive.  For ValueAdd operands, the DFG thinks that
+          the operand can also be empty (though we should never see this in practice).
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        - Add fallback to unused type operands.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        - Introduce a common function to compile the ValueAdd node.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        - Add the forwarding constructor so that we can use Optional<JSValueOperand>.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        - Changed to use the common compileValueAdd().
+
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::moveValue):
+        - Similar to moveTrustedValue() but used for untrusted constants.
+
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::JITAddGenerator):
+        - Updated to take the left or right operand as a constant.  This is necessary
+          because the client should not be making assumptions about whether the snippet
+          will determine the operation to be commutative or not.  Instead, the client
+          should just pass in the operands and let the snippet do any operand order
+          swapping if necessary.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        - Updated to use the new JITAddGenerator interface.
+
+        * tests/stress/op_add.js:
+        (stringifyIfNeeded):
+        (runTest):
+        - Made test output more clear about when string results are expected.
+
+2015-11-17  Filip Pizlo  <fpizlo@apple.com>
+
+        It's best for the DFG to always have some guess of basic block frequency
+        https://bugs.webkit.org/show_bug.cgi?id=151350
+
+        Reviewed by Geoffrey Garen.
+
+        It'll simplify things for B3 if we always have some estimate of block frequency, even if it's not
+        a great estimate. Using NaN as an estimate is probably worse than using any non-NaN number.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+
+2015-11-17  Michael Saboff  <msaboff@apple.com>
+
+        Reserved VM pool established in r187125 is likely too conservative
+        https://bugs.webkit.org/show_bug.cgi?id=151351
+
+        Reviewed by Filip Pizlo.
+
+        Reduce the VM allocation reserved pool from 25% to 15% for ARM32.
+
+        * jit/ExecutableAllocator.h:
+
+2015-11-17  Saam barati  <sbarati@apple.com>
+
+        FTLLazySlowPaths should be able to handle being passed the zero register as a location
+        https://bugs.webkit.org/show_bug.cgi?id=151193
+
+        Reviewed by Geoffrey Garen.
+
+        On arm64, SP and ZR are the same register number. The meaning
+        of the register number being SP or ZR is dependent on context of
+        the instruction and the register within the instruction. LLVM may
+        prove that a value is zero, or sometimes, we will lower a
+        value as a constant zero (for example, we might compile
+        CreateDirectArguments of an inlined call frame and we might know
+        that the arguments have a length of zero). LazySlowPaths should
+        be able to gracefully handle being passed a stackmap location
+        with a gpr value of SP by moving zero into another register
+        and replacing the location's register with the new register.
+        This way, no lazy slow path will ever have access to a location with a GPR
+        value of SP.  This patch makes this work by using a scratch register 
+        allocator when we need to do this maneuver of moving zero into a scratch
+        register.  Inside FTLCompile, we track if we need to move zero into a register,
+        and if so, into which register. We actually emit the necessary
+        instructions to move zero into this register, and to spill reused
+        registers if necessary, while generating the code for the lazy slow
+        path itself.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLDWARFRegister.cpp:
+        (JSC::FTL::DWARFRegister::reg):
+        * ftl/FTLLazySlowPath.cpp:
+        (JSC::FTL::LazySlowPath::LazySlowPath):
+        (JSC::FTL::LazySlowPath::generate):
+        * ftl/FTLLazySlowPath.h:
+        (JSC::FTL::LazySlowPath::createGenerator):
+
+2015-11-17  Mark Lam  <mark.lam@apple.com>
+
+        [JSC] Support Doubles with B3's Mul.
+        https://bugs.webkit.org/show_bug.cgi?id=151355
+
+        Reviewed by Filip Pizlo.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testMulLoadTwice):
+        (JSC::B3::testMulArgDouble):
+        (JSC::B3::testMulArgsDouble):
+        (JSC::B3::testMulArgImmDouble):
+        (JSC::B3::testMulImmArgDouble):
+        (JSC::B3::testMulImmsDouble):
+        (JSC::B3::testDivArgDouble):
+        (JSC::B3::run):
+
+2015-11-17  Matthew Daiter  <mdaiter8121@gmail.com>
+
+        Removed useless variable scriptResult from testExecutionTimeLimit
+        https://bugs.webkit.org/show_bug.cgi?id=151331
+
+        Reviewed by Alex Christensen.
+
+        * API/tests/ExecutionTimeLimitTest.cpp: Removed scriptResult
+        (testExecutionTimeLimit):
+
+2015-11-16  Mark Lam  <mark.lam@apple.com>
+
+        [JSC] Support Doubles with B3's Sub.
+        https://bugs.webkit.org/show_bug.cgi?id=151322
+
+        Reviewed by Filip Pizlo.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+
+        * b3/testb3.cpp:
+        (JSC::B3::testSubImmArg32):
+        (JSC::B3::testSubArgDouble):
+        (JSC::B3::testSubArgsDouble):
+        (JSC::B3::testSubArgImmDouble):
+        (JSC::B3::testSubImmArgDouble):
+        (JSC::B3::testSubImmsDouble):
+        (JSC::B3::testBitAndArgs):
+        (JSC::B3::negativeZero):
+        (JSC::B3::posInfinity):
+        (JSC::B3::negInfinity):
+        (JSC::B3::doubleOperands):
+        (JSC::B3::run):
+        - Added RUN_UNARY and RUN_BINARY macros to auto generate permutations
+          of operands for the tests.
+        - Added SubDouble tests using the new macros.
+
+2015-11-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] IteratedRegisterCoalescingAllocator's freeze can add zombie Tmps to our coloring algorithm
+        https://bugs.webkit.org/show_bug.cgi?id=151345
+
+        Reviewed by Filip Pizlo.
+
+        The extended test of https://bugs.webkit.org/show_bug.cgi?id=151214 revealed a problem with
+        the Move freezing step of the iterated register allocator.
+
+        When freezing a move related Tmp, we go over all the move instructions and update the other
+        Tmp of the move as needed. If that Tmp is no longer Move related and is of low degree it can
+        be simplified too.
+
+        The problem arise when one of those Tmp was already coalesced. For example, say we have
+
+          1: move %tmp42, %tmp43
+          2: move %tmp42, %tmp44
+
+        The first move cannot be coalesced for some reason and is moved to the Active worklist.
+        The second move is coalesced and %tmp42 is now %tmp44.
+
+        When nothing can be simplified or coalesced, we look at freezing a Move-related Tmp.
+        Let's say we pick %tmp43. The code of freeze() was going to all the Move instructions
+        to update them. Here you would find @1 above, get %tmp42 as the other Tmp. Since %tmp42
+        is no longer move related, it is added to the simplify work list.
+        -> We just added a coalesced Tmp to our worklist!
+
+        To fix that, I get the alias of every other Tmp before updating its status.
+
+        There is still a problem: multiple Moves instructions may have been coalesced to the same
+        Tmp. We must not add a Tmp twice to a worklist.
+        To avoid duplicates, I rely on the fact that the freeze worklist should not contains
+        aliased Tmps. Before adding something to the simplify worklist, I check that it was
+        in the freeze worklist.
+
+        I cannot find how this problem would have been avoided in the original paper. I suspect
+        that may have been a bug in the pseudo-code.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::freeze):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::freezeMoves):
+
+2015-11-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make FTLOutput's load8() and load16() compatible with B3
+        https://bugs.webkit.org/show_bug.cgi?id=151336
+
+        Reviewed by Filip Pizlo.
+
+        B3 does not have 8bit and 16bit types. Make FTLOutput abstract enough
+        to handle LLVM IR and B3.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStringCharAt):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStringCharCodeAt):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNotifyWrite):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckHasInstance):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckWatchdogTimer):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateTruthyObject):
+        (JSC::FTL::DFG::LowerDFGToLLVM::boolify):
+        (JSC::FTL::DFG::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::DFG::LowerDFGToLLVM::switchStringRecurse):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isObject):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isNotObject):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isArrayType):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isExoticForTypeof):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isType):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateNonNullObject):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadCellState):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::load8ZeroExt32):
+        (JSC::FTL::Output::load16SignExt32):
+        (JSC::FTL::Output::load16ZeroExt32):
+        (JSC::FTL::Output::constInt8): Deleted.
+        (JSC::FTL::Output::load8): Deleted.
+        (JSC::FTL::Output::load16): Deleted.
+        (JSC::FTL::Output::store8): Deleted.
+        (JSC::FTL::Output::storeFloat): Deleted.
+        (JSC::FTL::Output::isZero8): Deleted.
+        (JSC::FTL::Output::notZero8): Deleted.
+        (JSC::FTL::Output::testIsZero8): Deleted.
+        (JSC::FTL::Output::testNonZero8): Deleted.
+
+2015-11-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        Fix a typo in AirIteratedRegisterCoalescing
+
+        I forgot to fix that review comment from Geoff.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::build):
+
+2015-11-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add support for the extra registers that can be clobbered by Specials
+        https://bugs.webkit.org/show_bug.cgi?id=151246
+
+        Reviewed by Geoffrey Garen.
+
+        Specials can clobber arbitrary registers. This was not handled correctly by Air
+        and nothing was preventing us from re-allocating those registers.
+
+        This patch adds support for the extra clobbered registers in the two register allocators.
+
+        I also fixed the re-spilling FIXME of the iterated allocator because the test might
+        not always converge without it. Since we are at maximum register pressure at the patch point,
+        we could be always spilling the return value, which would loop forever.
+
+        To fix the re-spilling, I just kept a Set of every value spilled or filled so far. When selecting
+        a spill candidate, we never pick a Tmp from that set.
+
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirHandleCalleeSaves.cpp:
+        (JSC::B3::Air::handleCalleeSaves):
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::forEachDefAndExtraClobberedTmp):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::IteratedRegisterCoalescingAllocator):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::build):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addEdges):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::selectSpill):
+        (JSC::B3::Air::addSpillAndFillToProgram):
+        (JSC::B3::Air::iteratedRegisterCoalescingOnType):
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/testb3.cpp:
+        (JSC::B3::testSimplePatchpointWithoutOuputClobbersGPArgs):
+        (JSC::B3::testSimplePatchpointWithOuputClobbersGPArgs):
+        (JSC::B3::testSimplePatchpointWithoutOuputClobbersFPArgs):
+        (JSC::B3::testSimplePatchpointWithOuputClobbersFPArgs):
+        (JSC::B3::run):
+        * jit/RegisterSet.h:
+
+2015-11-16  Benjamin Poulain  <benjamin@webkit.org>
+
+        Build fix after r192492
+
+        Last second change broke the build.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::contains):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::takeMove):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::takeLastMove):
+
+2015-11-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add trivial lowering for B3's Div with doubles
+        https://bugs.webkit.org/show_bug.cgi?id=151292
+
+        Reviewed by Geoffrey Garen.
+
+        Filip had already made the constant propagation for it.
+        The Air Opcode was all we had left.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testDivArgDouble):
+        (JSC::B3::testDivArgsDouble):
+        (JSC::B3::testDivArgImmDouble):
+        (JSC::B3::testDivImmArgDouble):
+        (JSC::B3::testDivImmsDouble):
+        (JSC::B3::run):
+
+2015-11-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Speed up the coalescing-related operation of the iterated register allocator
+        https://bugs.webkit.org/show_bug.cgi?id=151290
+
+        Reviewed by Geoffrey Garen.
+
+        One step closer to removing the Hash structures:
+
+        For the coalescing operation, we need to keep track of Move instructions. We do not strictly
+        need those to be the Air Move, just any abstract operation that copy a Tmp into another Tmp.
+
+        In this patch, I exploit that to remove the Hash structure related to the Inst. Instead of
+        using the Move Inst, we just keep track of the Use() and Def() of the instructions.
+        Those are added in the global list m_coalescingCandidates and the index in that list represent
+        the move for the remaining of the algorithm.
+
+        With Moves transformed into dense indices, we can start using arrays to make fast sets.
+
+        The m_activeMoves Set is easy since we only need simple add/remove/contains. It is transformed
+        into a BitVector.
+        The bit vector is always fully allocated to allow for quick uniform access. The assumtion is that
+        activeMoves will contains a few values for non trivial cases.
+
+        The worklist m_worklistMoves is more complicated. I want it to be ordered to coalesce moves starting
+        at the top of blocks. Having a fast remove() operation is also useful for mass coalescing.
+        It also needs Set operations, especially a fast contains().
+
+        For m_worklistMoves, I created a new structure: OrderedMoveSet.
+        It contains a list of ordered values, and a map of each value to its position in the list.
+
+        This resembles Briggs' Sparse Set but it is not exactly the same. When removing a value,
+        I set a special marker in the map (UINT_MAX). The reason is that I want contains() to be fast
+        instead of remove(). The marker in the map allows contains() with a single memory operation instead of two.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::build):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::allocate):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::forEachNodeMoves):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::isMoveRelated):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::enableMovesOnValue):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::coalesce):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::combine):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::freezeMoves):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::dumpWorkLists):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::addMove):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::isEmpty):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::contains):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::takeMove):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::takeLastMove):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::returnMove):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::OrderedMoveSet::clear):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::assignColors): Deleted.
+
+2015-11-16  Saam barati  <sbarati@apple.com>
+
+        DFGEdge's dump method should print "Untyped:" for untyped uses.
+        https://bugs.webkit.org/show_bug.cgi?id=151314
+
+        Rubber stamped by Filip Pizlo.
+
+        * dfg/DFGEdge.cpp:
+        (JSC::DFG::Edge::dump):
+
+2015-11-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Make sure that the address matcher correctly handles Shl(x, 1)
+        https://bugs.webkit.org/show_bug.cgi?id=151316
+
+        Reviewed by Geoffrey Garen.
+
+        This optimization isn't really that awesome, but the nicest part of the change is just the
+        testing. If we ever do more cleverness with shifts, these tests will come in handy.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        * b3/testb3.cpp:
+        (JSC::B3::testLoadOffsetUsingAddNotConstant):
+        (JSC::B3::testLoadAddrShift):
+        (JSC::B3::testFramePointer):
+        (JSC::B3::run):
+
+2015-11-16  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Use FTL by default when LLVM 3.7 is available
+        https://bugs.webkit.org/show_bug.cgi?id=142128
+
+        Reviewed by Csaba Osztrogonác.
+
+        * PlatformGTK.cmake: Install libllvmForJSC.so.
+        * llvm/InitializeLLVMLinux.cpp:
+        (JSC::getLLVMInitializerFunction): For developer build try to load first
+        libllvmForJSC.so from standard paths since not installed binaries
+        have the RPATH set. If it fails try the installed one. For
+        production buils load always the installed one.
+
+2015-11-15  Saam barati  <sbarati@apple.com>
+
+        64-bit in the DFG: non tail Calls unnecessarily store the argument count twice on the callee frame and tails calls unnecessarily store it once
+        https://bugs.webkit.org/show_bug.cgi?id=151297
+
+        Reviewed by Geoffrey Garen.
+
+        Non tail calls only need to store the count once. Tail calls
+        never need to store the count on the callee frame because they
+        will be reusing the caller's frame.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
+2015-11-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        WebRTC: Update RTCPeerConnection API and introduce PeerConnectionBackend
+        https://bugs.webkit.org/show_bug.cgi?id=150166
+
+        Reviewed by Eric Carlson and Youenn Fablet
+
+        Added generic isDictionary() function to GlobalObject.js that tests if a
+        value can be interpreted as a dictionary.
+
+        * builtins/GlobalObject.js:
+        (isDictionary):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
+2015-11-14  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r190370): CrashTracer: [USER] com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::JITCode::execute + 158
+        https://bugs.webkit.org/show_bug.cgi?id=151279
+
+        Reviewed by Geoffrey Garen.
+
+        We need to restore callee saves even when we take the slow path in a polymorphic call stub.
+        Move the restoration to the top of the stub so that it is done for all paths.
+
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+
+2015-11-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r192416 and r192443.
+        https://bugs.webkit.org/show_bug.cgi?id=151285
+
+        Broke 32-bit in some mysterious way I need to understand
+        (Requested by kling on #webkit).
+
+        Reverted changesets:
+
+        "[JSC] JSPropertyNameEnumerator could be destructorless."
+        https://bugs.webkit.org/show_bug.cgi?id=151242
+        http://trac.webkit.org/changeset/192416
+
+        "Follow-up for 32-bit test failures after..."
+        https://bugs.webkit.org/show_bug.cgi?id=151242
+        http://trac.webkit.org/changeset/192443
+
+2015-11-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r192401.
+        https://bugs.webkit.org/show_bug.cgi?id=151282
+
+        "caused crashes on animometer" (Requested by thorton on
+        #webkit).
+
+        Reverted changeset:
+
+        "Restore CodeBlock jettison code I accidentally removed"
+        https://bugs.webkit.org/show_bug.cgi?id=151241
+        http://trac.webkit.org/changeset/192401
+
+2015-11-13  Andreas Kling  <akling@apple.com>
+
+        Follow-up for 32-bit test failures after...
+        [JSC] JSPropertyNameEnumerator could be destructorless.
+        <https://webkit.org/b/151242>
+
+        Reviewed by Mark Lam
+
+        Apparently copied space allocations need to be in multiples of 8 bytes.
+        Have JSPropertyNameEnumerator do what other copied space clients already do
+        and round the allocation size up to a multiple of 8.
+
+        Added a little helper function to compute the allocation size so this doesn't
+        have to be repeated everywhere.
+
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::finishCreation):
+        (JSC::JSPropertyNameEnumerator::visitChildren):
+        (JSC::JSPropertyNameEnumerator::copyBackingStore):
+        * runtime/JSPropertyNameEnumerator.h:
+
+2015-11-13  Saam barati  <sbarati@apple.com>
+
+        sub IC does not properly handle exception handling now that try/catch is compiled in the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=151080
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements proper exception handling for ArithSubs with binaryUseKind as
+        UntypedUse inside try/catch.  We implement this in a very similar way as we implement 
+        exception handling from GetById/PutById/LazySlowPaths callOperation calls. We do the needed 
+        spilling if the result is the same register as the left/right register because in the event
+        of an exception, we don't want to do value recovery on the garbage result, we
+        want to do it on the original lhs/rhs of the operation.
+
+        This patch also does some refactoring. No longer does OSRExitDescriptor
+        have a long list of booleans that correspond to different OSR exit types.
+        It now just has an enum property called ExceptionType that tells us
+        what type of exception handler the OSR exit is. Then, we can just ask
+        interesting questions about the OSR exit and get answers based on its
+        ExceptionType property.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExceptionHandlerManager.cpp:
+        (JSC::FTL::ExceptionHandlerManager::addNewExit):
+        (JSC::FTL::ExceptionHandlerManager::callOperationExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::lazySlowPathExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::getByIdOSRExit):
+        (JSC::FTL::ExceptionHandlerManager::subOSRExit):
+        (JSC::FTL::ExceptionHandlerManager::getCallOSRExitCommon):
+        (JSC::FTL::ExceptionHandlerManager::getOrPutByIdCallOperationExceptionTarget): Deleted.
+        * ftl/FTLExceptionHandlerManager.h:
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBranchToOSRExitIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
+        (JSC::FTL::OSRExitDescriptor::willArriveAtExitFromIndirectExceptionCheck):
+        (JSC::FTL::OSRExitDescriptor::mightArriveAtOSRExitFromGenericUnwind):
+        (JSC::FTL::OSRExitDescriptor::mightArriveAtOSRExitFromCallOperation):
+        (JSC::FTL::OSRExitDescriptor::needsRegisterRecoveryOnGenericUnwindOSRExitPath):
+        (JSC::FTL::OSRExitDescriptor::isExceptionHandler):
+        (JSC::FTL::OSRExitDescriptor::validateReferences):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::gatherRegistersToSpillForCallIfException):
+        (JSC::FTL::OSRExit::spillRegistersToSpillSlot):
+        (JSC::FTL::OSRExit::recoverRegistersFromSpillSlot):
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompilationInfo.h:
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * tests/stress/ftl-try-catch-arith-sub-exception.js: Added.
+        (assert):
+        (let.o.valueOf):
+        (baz):
+        (foo):
+        (bar):
+
+2015-11-13  Caitlin Potter  <caitpotter88@gmail.com>
+
+        Allow any LeftHandSideExpression as a valid AssignmentElement
+        https://bugs.webkit.org/show_bug.cgi?id=151026
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignmentElementNode::collectBoundIdentifiers):
+        (JSC::AssignmentElementNode::bindValue):
+        (JSC::AssignmentElementNode::toString):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::isAssignmentLocation):
+        (JSC::ASTBuilder::createAssignmentElement):
+        * parser/NodeConstructors.h:
+        (JSC::AssignmentElementNode::AssignmentElementNode):
+        * parser/Nodes.h:
+        (JSC::AssignmentElementNode::assignmentTarget):
+        (JSC::AssignmentElementNode::divotStart):
+        (JSC::AssignmentElementNode::divotEnd):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::createAssignmentElement):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        * parser/Parser.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2015-11-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        op_assert should declare that it uses the first register argument
+        https://bugs.webkit.org/show_bug.cgi?id=151183
+
+        Reviewed by Geoffrey Garen.
+
+        op_assert(conditionRegister, lineNumber) should declare that it
+        *uses* (in terms of use-def) the first `conditionRegister` and
+        it does not define any variables.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+
+2015-11-13  Andreas Kling  <akling@apple.com>
+
+        [JSC] JSPropertyNameEnumerator could be destructorless.
+        <https://webkit.org/b/151242>
+
+        Reviewed by Mark Lam.
+
+        Make JSPropertyNameEnumerator destructorless and have it store the property names
+        cache in CopiedSpace. This was the most popular occupant of 64-byte destructor cells
+        in MarkedSpace, so making it destructorless gets rid of some ill-filled MarkedBlocks.
+
+        * heap/CopyToken.h:
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::finishCreation):
+        (JSC::JSPropertyNameEnumerator::visitChildren):
+        (JSC::JSPropertyNameEnumerator::copyBackingStore):
+        (JSC::JSPropertyNameEnumerator::destroy): Deleted.
+        * runtime/JSPropertyNameEnumerator.h:
+
+2015-11-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Do not generate an Add when adding a zero immediate to something
+        https://bugs.webkit.org/show_bug.cgi?id=151171
+
+        Reviewed by Geoffrey Garen.
+
+        Avoid generating an add if one of arguments is a zero immediate.
+
+        On x86, the add32/64() were also used internally for branchAdd32/64.
+        I split the code that sets flag to add32AndSetFlags() to make sure
+        we always force the flags before testing.
+
+        I could have used CMp to set the flags but I would gain nothing from
+        that, cmp is just a SUB.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::add32):
+        (JSC::MacroAssemblerARM64::add64):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::add32):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::add32AndSetFlags):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::add64):
+        (JSC::MacroAssemblerX86_64::branchAdd64):
+        (JSC::MacroAssemblerX86_64::add64AndSetFlags):
+
+2015-11-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Restore CodeBlock jettison code I accidentally removed
+        https://bugs.webkit.org/show_bug.cgi?id=151241
+
+        Reviewed by Andreas Kling.
+
+        I meant to add this back in <http://trac.webkit.org/changeset/190827>
+        but I missed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::timeToLive):
+        (JSC::CodeBlock::shouldJettisonDueToOldAge):
+
+2015-11-12  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile programs with CheckAdd, CheckSub, and CheckMul
+        https://bugs.webkit.org/show_bug.cgi?id=151213
+
+        Reviewed by Benjamin Poulain.
+
+        This adds lowering code for CheckAdd, CheckSub, and CheckMul along with support for CheckNeg
+        (i.e. CheckSub with the left child being zero).
+
+        This adds tests for these things, by simulating what JS would do: if there is overflow, revert
+        to double math. To write the test, I needed support for IToD so I added that support.
+
+        This also fixes a memory corruption bug in the register allocator.
+
+        Also fixes a bug in opcode_generator.rb where we were emitting stray "return" statements inside
+        switch statements. I think this was benign, but I'm not sure, so I fixed it.
+
+        Note that I had to convert CheckMul handling to always use a three-operand form. That's because
+        there is no other way to tell Air that we need the original value alive. This means that on X86
+        we'll emit an extra Move just before the checked mul. That's probably fine since that's
+        necessary anyway.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchMul64):
+        (JSC::MacroAssemblerX86_64::branchSub64):
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::generate):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::mulConstant):
+        (JSC::B3::Const32Value::checkAddConstant):
+        (JSC::B3::Const32Value::checkSubConstant):
+        (JSC::B3::Const32Value::checkMulConstant):
+        (JSC::B3::Const32Value::divConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::mulConstant):
+        (JSC::B3::Const64Value::checkAddConstant):
+        (JSC::B3::Const64Value::checkSubConstant):
+        (JSC::B3::Const64Value::checkMulConstant):
+        (JSC::B3::Const64Value::divConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendUnOp):
+        (JSC::B3::Air::LowerToAir::ensureSpecial):
+        (JSC::B3::Air::LowerToAir::ensureCheckSpecial):
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::mulConstant):
+        (JSC::B3::Value::checkAddConstant):
+        (JSC::B3::Value::checkSubConstant):
+        (JSC::B3::Value::checkMulConstant):
+        (JSC::B3::Value::divConstant):
+        * b3/B3Value.h:
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::testCheckAddImm):
+        (JSC::B3::testCheckAdd):
+        (JSC::B3::testCheckAdd64):
+        (JSC::B3::testCheckAddFold):
+        (JSC::B3::testCheckAddFoldFail):
+        (JSC::B3::testCheckSubImm):
+        (JSC::B3::testCheckSub):
+        (JSC::B3::doubleSub):
+        (JSC::B3::testCheckSub64):
+        (JSC::B3::testCheckSubFold):
+        (JSC::B3::testCheckSubFoldFail):
+        (JSC::B3::testCheckNeg):
+        (JSC::B3::testCheckNeg64):
+        (JSC::B3::testCheckMul):
+        (JSC::B3::testCheckMul64):
+        (JSC::B3::testCheckMulFold):
+        (JSC::B3::testCheckMulFoldFail):
+        (JSC::B3::genericTestCompare):
+        (JSC::B3::run):
+
+2015-11-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Reduce list of saved console messages
+        https://bugs.webkit.org/show_bug.cgi?id=151225
+
+        Reviewed by Geoffrey Garen.
+
+        Inspector saves messages so that when an inspector frontend opens it can report
+        these messages to the frontend. However we were saving a rather large list of
+        1000 messages. Most pages do not produce a large number of console messages.
+        However pages that live for a long time can generate many errors over time,
+        especially periodic engine issues such as cross-origin access errors. This could
+        result in a lot of wasted memory for console messages that may never be used.
+
+        Likewise when an inspector first open sending all 1000 messages to the frontend
+        results in a poor experience.
+
+        Lets reduce the list of saved messages. Developer will still be able to see
+        all messages as long as they have Web Inspector open at the time the messages
+        are generated.
+
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        Reduce the list from 1000 to 100. Also, when expiring
+        messages from this list, chunk in 10s instead of 100s.
+
+2015-11-12  Mark Lam  <mark.lam@apple.com>
+
+        Adjust timeout values in ExecutionTimeLimitTest.
+        https://bugs.webkit.org/show_bug.cgi?id=151223
+
+        Reviewed by Geoffrey Garen.
+
+        Some bots were not happy with the existing time out values.  I adjusted them to give
+        the system a little more time to fire the timer events, and this made the bots happy.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (testExecutionTimeLimit):
+
+2015-11-12  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile Patchpoints with Register and Any constraints
+        https://bugs.webkit.org/show_bug.cgi?id=151209
+
+        Reviewed by Geoffrey Garen.
+
+        Most of this patch is about adding tests, since Register constraints already worked but
+        were untested, and almost all forms of the Any constraint worked.
+
+        One change that I'm making is that Patchpoints now default to forCall effects rather
+        than no effects. I think this is better because if a client of Patchpoint never supplies
+        any effects, it's best to assume the worst.
+
+        My testing uncovered only one real bug: moveConstants() would turn all non-zero double
+        constants into Loads, so the optimization to fold constants into a Stackmap would stop
+        working. Instead of telling the Stackmap that the double value it wanted is actually a
+        constant, we would tell it that it's a register and it would emit code to materialize
+        the double into that register. I worked around this by having moveConstants() create
+        ConstDoubleValue's just for the Stackmaps, which lowerToAir() recognizes and does the
+        right thing with (i.e. folds into the stackmap instead of materializing).
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3MoveConstants.cpp:
+        * b3/B3PatchpointValue.cpp:
+        (JSC::B3::PatchpointValue::PatchpointValue):
+        * b3/testb3.cpp:
+        (JSC::B3::testPatchpointCallArg):
+        (JSC::B3::testPatchpointFixedRegister):
+        (JSC::B3::testPatchpointAny):
+        (JSC::B3::testPatchpointAnyImm):
+        (JSC::B3::testPatchpointManyImms):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::run):
+
+2015-11-12  Mark Lam  <mark.lam@apple.com>
+
+        Move some prototypes to header files.
+        https://bugs.webkit.org/show_bug.cgi?id=151194
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerPrinter.cpp:
+        (JSC::printIndent):
+        * assembler/MacroAssemblerPrinter.h:
+        (JSC::MacroAssembler::print):
+
+2015-11-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove ENABLE(SATURATED_LAYOUT_ARITHMETIC) guards
+        https://bugs.webkit.org/show_bug.cgi?id=150972
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-11-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Air: we have more register than what the allocator believed
+        https://bugs.webkit.org/show_bug.cgi?id=151182
+
+        Reviewed by Michael Saboff.
+
+        I was using GPRInfo/FPRInfo to get the number of register while coloring the interference graph.
+        The problem is, those classes are lying about register availability.
+
+        They don't report stuff reserved by the MacroAssembler and reserve some registers.
+        FPRInfo is the worst, reporting only 6 of the 15 registers we have.
+
+        The ground truth in our case is that we can color with all the registers returned
+        by regsInPriorityOrder(). I changed IteratedRegisterCoalescingAllocator to use that value.
+
+        The new test testSpillFP() covers simple spilling of doubles.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::IteratedRegisterCoalescingAllocator):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::makeWorkList):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::decrementDegree):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::precoloredCoalescingHeuristic):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::conservativeHeuristic):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addWorkList):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::combine):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::freezeMoves):
+        * b3/testb3.cpp:
+        (JSC::B3::testSpillFP):
+        (JSC::B3::run):
+
+2015-11-11  Mark Lam  <mark.lam@apple.com>
+
+        The BinarySnippetRegisterContext needs to copy the result back from the scratch register.
+        https://bugs.webkit.org/show_bug.cgi?id=150712
+
+        Reviewed by Geoffrey Garen.
+
+        If the BinarySnippetRegisterContext had re-assigned the result register to a scratch
+        before emitting the snippet, it needs to copy the result back from the scratch after
+        the snippet is done.
+
+        This fixes the cdjs-tests.yaml/main.js.ftl failure reported in
+        https://bugs.webkit.org/show_bug.cgi?id=150687.
+
+        Also added an optimization to check for the case where any of the left, right,
+        or result registers are aliased together, and to map them to the corresponding
+        allocated scratch register for their alias instead of allocating separate ones.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        - Added JITSubGenerator.h to these project files for completeness.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        - Re-enable ArithSub handling of UntypedUse operands.
+
+        * ftl/FTLCompile.cpp:
+
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfArithSub):
+        - Adjusted IC sizes to account for the snippet changes.
+
+2015-11-11  Mark Lam  <mark.lam@apple.com>
+
+        Crash in sorting-benchmark.js on ARM64 with full op_sub FTL coverage.
+        https://bugs.webkit.org/show_bug.cgi?id=150936
+
+        Reviewed by Michael Saboff.
+
+        The OSR entry thunk does not currently restore the callee saved registers that the baseline
+        JIT saves but the DFG does not.  As a result, sorting-benchmark.js was crashing with the
+        following scenario:
+
+            1. There exists 2 functions: benchmark() and bottom_up_merge_sort().
+               Let's call them A() and B() respectively for brevity.
+            2. A() is FTL compiled.
+            3. B() is FTL compiled.
+            4. FTL A() calls FTL B().  FTL B() trashes register x26.
+            5. FTL B() goes through an OSR exit, and deopts to baseline.  The OSR exit off-ramp
+               puts x26's original value in the baseline B()'s stash location for x26 in its stack
+               frame.  It expects baseline B() to restore x26 when it returns.
+            6. Baseline B() gets DFG optimized, and we OSR enter into DFG B().
+               The OSR entry thunk does nothing to restore x26's original value.  Hence, x26 contains
+               whatever value FTL B() left in it.
+            7. DFG B() returns to FTL A().
+               x26 is not one of the callee saved registers used by DFG B().  Hence, it does nothing
+               to restore it.
+            8. FTL A() tries to use x26 and crashes, because x26 contains FTL B()'s value for it, and
+               not FTL A()'s.
+
+        This patch fixes this issue by having the OSR entry thunk restore all the callee saved
+        registers before running the DFG code.
+
+        No new test needed because this issue will be covered by sorting-benchmark.js as soon as
+        https://bugs.webkit.org/show_bug.cgi?id=150712 lands.
+
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrEntryThunkGenerator):
+
+2015-11-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add a comment explaining the opcode suffixes on x86
+        https://bugs.webkit.org/show_bug.cgi?id=151176
+
+        Reviewed by Alex Christensen.
+
+        * assembler/X86Assembler.h:
+        I was always confused with the prefixes. Gavin pointed out the Intel documentation
+        explains everything.
+        I added a comment to help the next person confused about those suffixes.
+
+2015-11-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Support Doubles with B3's Add
+        https://bugs.webkit.org/show_bug.cgi?id=151164
+
+        Reviewed by Filip Pizlo.
+
+        I tweaked ReduceStrength a bit to maintain correctness.
+        Nothing fancy otherwise.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::isInteger):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::bitWiseEqual):
+        (JSC::B3::testAddArgDouble):
+        (JSC::B3::testAddArgsDouble):
+        (JSC::B3::testAddArgImmDouble):
+        (JSC::B3::testAddImmArgDouble):
+        (JSC::B3::testAddImmsDouble):
+        (JSC::B3::run):
+
+2015-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile a program with Switch
+        https://bugs.webkit.org/show_bug.cgi?id=151115
+
+        Reviewed by Benjamin Poulain.
+
+        Adds lowering of Switch to a binary switch. This doesn't require any Air support.
+
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::append):
+        (JSC::B3::BasicBlock::removeLast):
+        (JSC::B3::BasicBlock::replaceLast):
+        * b3/B3BasicBlock.h:
+        * b3/B3BlockInsertionSet.cpp:
+        (JSC::B3::BlockInsertionSet::insertBefore):
+        (JSC::B3::BlockInsertionSet::insertAfter):
+        (JSC::B3::BlockInsertionSet::splitForward):
+        * b3/B3BlockInsertionSet.h:
+        * b3/B3ControlValue.h:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3LowerMacros.cpp:
+        * b3/B3SwitchValue.cpp:
+        (JSC::B3::SwitchValue::dumpMeta):
+        (JSC::B3::SwitchValue::SwitchValue):
+        * b3/B3SwitchValue.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testChillDiv64):
+        (JSC::B3::testSwitch):
+        (JSC::B3::run):
+
+2015-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Patchpoints with stackArgument constraints should work
+        https://bugs.webkit.org/show_bug.cgi?id=151177
+
+        Reviewed by Saam Barati.
+
+        The only thing broken was that StackmapSpecial's isValidForm would reject Arg::addr, so
+        validation would fail after allocateStack.
+
+        In order for StackmapSpecial to validate Arg::addr, it needs to know the frame size. To know
+        the frame size, it needs access to Code&. So, this changes Air::Special to always have a
+        pointer back to Code.
+
+        Other than this already worked.
+
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::isValidImpl):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::addSpecial):
+        * b3/air/AirSpecial.cpp:
+        (JSC::B3::Air::Special::Special):
+        * b3/air/AirSpecial.h:
+        (JSC::B3::Air::Special::code):
+        * b3/testb3.cpp:
+        (JSC::B3::testSimplePatchpoint):
+        (JSC::B3::testPatchpointCallArg):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::run):
+
+2015-11-11  Mark Lam  <mark.lam@apple.com>
+
+        Add ability to insert probes in LLVM IR that we generate.
+        https://bugs.webkit.org/show_bug.cgi?id=151159
+
+        Reviewed by Geoffrey Garen.
+
+        This is done by inserting a stackmap intrinsic and emitting the probe there.
+
+        We can now insert probes that take a lambda like so:
+
+            probe([] (CCallHelpers::ProbeContext*) {
+                dataLog("Hello FTL\n");
+            });
+
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::ProbeDescriptor::ProbeDescriptor):
+        (JSC::FTL::ProbeDescriptor::probeFunction):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfProbe):
+        * ftl/FTLInlineCacheSize.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::probe):
+        * ftl/FTLState.h:
+
+2015-11-11  Mark Lam  <mark.lam@apple.com>
+
+        Change probe CPUState gpr() and fpr() to return references.
+        https://bugs.webkit.org/show_bug.cgi?id=151154
+
+        Reviewed by Saam Barati.
+
+        This will allow us to set their values as well as reading them.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CPUState::gpr):
+        (JSC::AbstractMacroAssembler::CPUState::fpr):
+        (JSC::AbstractMacroAssembler::ProbeContext::gpr):
+        (JSC::AbstractMacroAssembler::ProbeContext::fpr):
+
+2015-11-11  Mark Lam  <mark.lam@apple.com>
+
+        Add convenience utility to support dataLogging opcodeIDs.
+        https://bugs.webkit.org/show_bug.cgi?id=151117
+
+        Reviewed by Saam Barati.
+
+        * bytecode/Opcode.cpp:
+        (WTF::printInternal):
+        * bytecode/Opcode.h:
+
+2015-11-10  Keith Miller  <keith_miller@apple.com>
+
+        Regression(r191815): 5.3% regression on Dromaeo JS Library Benchmark
+        https://bugs.webkit.org/show_bug.cgi?id=150945
+
+        Reviewed by Filip Pizlo.
+
+        This patch fixes a performance regression introduced by r191815. Before adding Symbol.toStringTag
+        we would cache the value of Object.prototype.toString() in the rareData of the structure.
+        In order to cache the result of Object.prototype.toString() we now need to ensure that the
+        value stored in Symbol.toStringTag is a known constant. Thus, in order to ensure the stored Symbol.toStringTag
+        value remains constant adaptive inferred value watchpoints have been re-factored to be generalizable and
+        a new version that clears the toString value cache when fired has been added.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp: Copied from Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp.
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::AdaptiveInferredPropertyValueWatchpointBase):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::install):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::fire):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::fireInternal):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::fireInternal):
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.h: Copied from Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h.
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::key):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::StructureWatchpoint):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::PropertyWatchpoint):
+        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::AdaptiveInferredPropertyValueWatchpoint):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::handleFire):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::install): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::fire): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::fireInternal): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::fireInternal): Deleted.
+        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h:
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::key): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::StructureWatchpoint): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::PropertyWatchpoint): Deleted.
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::setObjectToStringValue):
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::StructureRareData):
+        (JSC::StructureRareData::setObjectToStringValue):
+        (JSC::StructureRareData::clearObjectToStringValue):
+        (JSC::ObjectToStringAdaptiveStructureWatchpoint::ObjectToStringAdaptiveStructureWatchpoint):
+        (JSC::ObjectToStringAdaptiveStructureWatchpoint::install):
+        (JSC::ObjectToStringAdaptiveStructureWatchpoint::fireInternal):
+        (JSC::ObjectToStringAdaptiveInferredPropertyValueWatchpoint::ObjectToStringAdaptiveInferredPropertyValueWatchpoint):
+        (JSC::ObjectToStringAdaptiveInferredPropertyValueWatchpoint::handleFire):
+        * runtime/StructureRareData.h:
+        * runtime/StructureRareDataInlines.h:
+        (JSC::StructureRareData::setObjectToStringValue): Deleted.
+        * tests/stress/symbol-tostringtag-watchpoints.js: Added.
+        (Base):
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp: Copied from Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp.
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::AdaptiveInferredPropertyValueWatchpointBase):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::install):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::fire):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::fireInternal):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::fireInternal):
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.h: Copied from Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h.
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::key):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::StructureWatchpoint):
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::PropertyWatchpoint):
+        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::AdaptiveInferredPropertyValueWatchpoint):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::handleFire):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::install): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::fire): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::fireInternal): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::fireInternal): Deleted.
+        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h:
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::key): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::StructureWatchpoint): Deleted.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::PropertyWatchpoint): Deleted.
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::setObjectToStringValue):
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::StructureRareData):
+        (JSC::StructureRareData::setObjectToStringValue):
+        (JSC::StructureRareData::clearObjectToStringValue):
+        (JSC::ObjectToStringAdaptiveStructureWatchpoint::ObjectToStringAdaptiveStructureWatchpoint):
+        (JSC::ObjectToStringAdaptiveStructureWatchpoint::install):
+        (JSC::ObjectToStringAdaptiveStructureWatchpoint::fireInternal):
+        (JSC::ObjectToStringAdaptiveInferredPropertyValueWatchpoint::ObjectToStringAdaptiveInferredPropertyValueWatchpoint):
+        (JSC::ObjectToStringAdaptiveInferredPropertyValueWatchpoint::handleFire):
+        * runtime/StructureRareData.h:
+        * runtime/StructureRareDataInlines.h:
+        (JSC::StructureRareData::setObjectToStringValue): Deleted.
+        * tests/stress/symbol-tostringtag-watchpoints.js: Added.
+        (Base):
+
+2015-11-11  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile and canonicalize Mul
+        https://bugs.webkit.org/show_bug.cgi?id=151124
+
+        Reviewed by Geoffrey Garen.
+
+        This was a strange trip. I wanted to do a quick patch to implement Mul. But then I realized
+        that our tradition when adding new lowerings was to also add the corresponding strength
+        reductions. So then I wrote the Mul->Shl strength reduction. But that reminded me that I needed
+        to canonicalize between Add(x, x) and Shl(x, 1). I decided that it would probably be better to
+        use Shl(x, 1), since that only has one use of x. But that means that we should compile
+        Shl(x, 1) to Add x, x in the backend, since that's what X86 wants. While doing that, I almost
+        introduced a bug where Shl(Load(x), 1) would cause the compiler to either crash or generate bad
+        code. That's because I was using Add(x, x) to handle Shl(x, 1), so we'd end up with
+        Add(Load(x), Load(x)) - i.e. we would try to duplicate the Load.
+
+        The instruction selector already defends against this, and the only reason why I would have
+        created the bug was by using the Add helper when compiling a Shl. Still, this was so close to
+        a bad bug that I added a ton of new tests that cover the Op(x, x) where x = Load case.
+
+        * b3/B3Compilation.cpp:
+        (JSC::B3::Compilation::Compilation):
+        * b3/B3Compilation.h:
+        (JSC::B3::Compilation::code):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::subConstant):
+        (JSC::B3::Const32Value::mulConstant):
+        (JSC::B3::Const32Value::bitAndConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::subConstant):
+        (JSC::B3::Const64Value::mulConstant):
+        (JSC::B3::Const64Value::bitAndConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::subConstant):
+        (JSC::B3::ConstDoubleValue::mulConstant):
+        (JSC::B3::ConstDoubleValue::equalConstant):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generate):
+        (JSC::B3::generateToAir):
+        * b3/B3Generate.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::subConstant):
+        (JSC::B3::Value::mulConstant):
+        (JSC::B3::Value::bitAndConstant):
+        * b3/B3Value.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::compile):
+        (JSC::B3::testReturnConst64):
+        (JSC::B3::testAddArg):
+        (JSC::B3::testAddArgs):
+        (JSC::B3::testAddArgs32):
+        (JSC::B3::testAddLoadTwice):
+        (JSC::B3::testMulArg):
+        (JSC::B3::testMulArgs):
+        (JSC::B3::testMulArgImm):
+        (JSC::B3::testMulImmArg):
+        (JSC::B3::testMulArgs32):
+        (JSC::B3::testMulLoadTwice):
+        (JSC::B3::testSubArg):
+        (JSC::B3::testSubArgs):
+        (JSC::B3::testShlArgImm):
+        (JSC::B3::testShlArg32):
+        (JSC::B3::testShlArgs32):
+        (JSC::B3::testSShrArgImm):
+        (JSC::B3::testSShrArg32):
+        (JSC::B3::testSShrArgs32):
+        (JSC::B3::testZShrArgImm):
+        (JSC::B3::testZShrArg32):
+        (JSC::B3::testZShrArgs32):
+        (JSC::B3::genericTestCompare):
+        (JSC::B3::testCompareLoad):
+        (JSC::B3::testCompareImpl):
+        (JSC::B3::run):
+
+2015-11-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Update ES6 Generators' status to "In Development"
+        https://bugs.webkit.org/show_bug.cgi?id=151142
+
+        Reviewed by Saam Barati.
+
+        Currently, features.json raises some linting errors.
+        This should be cleaned up in another patch.
+
+        * features.json:
+
+2015-11-10  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile a program with ChillDiv
+        https://bugs.webkit.org/show_bug.cgi?id=151114
+
+        Reviewed by Benjamin Poulain.
+
+        This change is about a lot more than ChillDiv. I picked that as the next thing to lower
+        because I knew that it would force me to come up with a sensible idiom for doing
+        stepwise lowerings that require breaking basic blocks. The idea is that you want to
+        write a loop that iterates forward over the program, which turns some operations that
+        currently are just single Values into an entire little sub-CFGs. That requires splitting
+        the block that contained the original Value. That's tricky if you then want to keep
+        iterating: the index of the Value you were last looking at has now changed and your
+        InsertionSets are now invalid.
+
+        This introduces an idiom that handles this. It's BlockInsertionSet::splitBefore(). The
+        idea is that it uses the current block before the split as the continuation after the
+        split. When you call splitBefore(), you pass it your loop index and your InsertionSet
+        (if applicable). It makes sure that it changes those auxiliary things in such a way that
+        you can keep looping.
+
+        This uncovered some bugs, since this is the first time that we're compiling cross edges.
+
+        Because ChillDiv is really a division, I also had to write a bunch of code to support
+        the ordinary B3 Div. While doing that, I realized that there was asymmetry to that
+        constness of the Value constant folding methods, so I fixed that as well.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::x86ConvertToDoubleWord32):
+        (JSC::MacroAssemblerX86Common::x86Div32):
+        (JSC::MacroAssemblerX86Common::neg32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::mul64):
+        (JSC::MacroAssemblerX86_64::x86ConvertToQuadWord64):
+        (JSC::MacroAssemblerX86_64::x86Div64):
+        (JSC::MacroAssemblerX86_64::neg64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::idivl_r):
+        (JSC::X86Assembler::idivq_r):
+        (JSC::X86Assembler::cmpl_rr):
+        (JSC::X86Assembler::cdq):
+        (JSC::X86Assembler::cdqq):
+        (JSC::X86Assembler::fstps):
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::append):
+        (JSC::B3::BasicBlock::replaceLast):
+        (JSC::B3::BasicBlock::appendIntConstant):
+        (JSC::B3::BasicBlock::replaceSuccessor):
+        (JSC::B3::BasicBlock::addPredecessor):
+        (JSC::B3::BasicBlock::replacePredecessor):
+        (JSC::B3::BasicBlock::updatePredecessors):
+        (JSC::B3::BasicBlock::dump):
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::values):
+        (JSC::B3::BasicBlock::numPredecessors):
+        (JSC::B3::BasicBlock::predecessor):
+        (JSC::B3::BasicBlock::frequency):
+        * b3/B3BasicBlockInlines.h:
+        (JSC::B3::BasicBlock::appendNew):
+        (JSC::B3::BasicBlock::replaceLastWithNew):
+        (JSC::B3::BasicBlock::numSuccessors):
+        * b3/B3BasicBlockUtils.h:
+        (JSC::B3::replacePredecessor):
+        (JSC::B3::updatePredecessors):
+        (JSC::B3::resetReachability):
+        * b3/B3BlockInsertionSet.cpp: Added.
+        (JSC::B3::BlockInsertionSet::BlockInsertionSet):
+        (JSC::B3::BlockInsertionSet::~BlockInsertionSet):
+        (JSC::B3::BlockInsertionSet::insert):
+        (JSC::B3::BlockInsertionSet::insertBefore):
+        (JSC::B3::BlockInsertionSet::splitForward):
+        (JSC::B3::BlockInsertionSet::execute):
+        * b3/B3BlockInsertionSet.h: Added.
+        * b3/B3Common.h:
+        (JSC::B3::isRepresentableAs):
+        (JSC::B3::chillDiv):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::addConstant):
+        (JSC::B3::Const32Value::subConstant):
+        (JSC::B3::Const32Value::divConstant):
+        (JSC::B3::Const32Value::bitAndConstant):
+        (JSC::B3::Const32Value::bitOrConstant):
+        (JSC::B3::Const32Value::bitXorConstant):
+        (JSC::B3::Const32Value::shlConstant):
+        (JSC::B3::Const32Value::sShrConstant):
+        (JSC::B3::Const32Value::zShrConstant):
+        (JSC::B3::Const32Value::equalConstant):
+        (JSC::B3::Const32Value::notEqualConstant):
+        (JSC::B3::Const32Value::lessThanConstant):
+        (JSC::B3::Const32Value::greaterThanConstant):
+        (JSC::B3::Const32Value::lessEqualConstant):
+        (JSC::B3::Const32Value::greaterEqualConstant):
+        (JSC::B3::Const32Value::aboveConstant):
+        (JSC::B3::Const32Value::belowConstant):
+        (JSC::B3::Const32Value::aboveEqualConstant):
+        (JSC::B3::Const32Value::belowEqualConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::addConstant):
+        (JSC::B3::Const64Value::subConstant):
+        (JSC::B3::Const64Value::divConstant):
+        (JSC::B3::Const64Value::bitAndConstant):
+        (JSC::B3::Const64Value::bitOrConstant):
+        (JSC::B3::Const64Value::bitXorConstant):
+        (JSC::B3::Const64Value::shlConstant):
+        (JSC::B3::Const64Value::sShrConstant):
+        (JSC::B3::Const64Value::zShrConstant):
+        (JSC::B3::Const64Value::equalConstant):
+        (JSC::B3::Const64Value::notEqualConstant):
+        (JSC::B3::Const64Value::lessThanConstant):
+        (JSC::B3::Const64Value::greaterThanConstant):
+        (JSC::B3::Const64Value::lessEqualConstant):
+        (JSC::B3::Const64Value::greaterEqualConstant):
+        (JSC::B3::Const64Value::aboveConstant):
+        (JSC::B3::Const64Value::belowConstant):
+        (JSC::B3::Const64Value::aboveEqualConstant):
+        (JSC::B3::Const64Value::belowEqualConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::addConstant):
+        (JSC::B3::ConstDoubleValue::subConstant):
+        (JSC::B3::ConstDoubleValue::divConstant):
+        (JSC::B3::ConstDoubleValue::equalConstant):
+        (JSC::B3::ConstDoubleValue::notEqualConstant):
+        (JSC::B3::ConstDoubleValue::lessThanConstant):
+        (JSC::B3::ConstDoubleValue::greaterThanConstant):
+        (JSC::B3::ConstDoubleValue::lessEqualConstant):
+        (JSC::B3::ConstDoubleValue::greaterEqualConstant):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ControlValue.cpp:
+        (JSC::B3::ControlValue::~ControlValue):
+        (JSC::B3::ControlValue::replaceSuccessor):
+        (JSC::B3::ControlValue::convertToJump):
+        * b3/B3ControlValue.h:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3GenericFrequentedBlock.h:
+        (JSC::B3::GenericFrequentedBlock::block):
+        (JSC::B3::GenericFrequentedBlock::frequency):
+        (JSC::B3::GenericFrequentedBlock::dump):
+        * b3/B3InsertionSet.cpp:
+        (JSC::B3::InsertionSet::insertIntConstant):
+        (JSC::B3::InsertionSet::execute):
+        * b3/B3InsertionSet.h:
+        * b3/B3LowerMacros.cpp: Added.
+        (JSC::B3::lowerMacros):
+        * b3/B3LowerMacros.h: Added.
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::addIntConstant):
+        (JSC::B3::Procedure::addBoolConstant):
+        (JSC::B3::Procedure::resetValueOwners):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::takeByproducts):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::addConstant):
+        (JSC::B3::Value::subConstant):
+        (JSC::B3::Value::divConstant):
+        (JSC::B3::Value::bitAndConstant):
+        (JSC::B3::Value::bitOrConstant):
+        (JSC::B3::Value::bitXorConstant):
+        (JSC::B3::Value::shlConstant):
+        (JSC::B3::Value::sShrConstant):
+        (JSC::B3::Value::zShrConstant):
+        (JSC::B3::Value::equalConstant):
+        (JSC::B3::Value::notEqualConstant):
+        (JSC::B3::Value::lessThanConstant):
+        (JSC::B3::Value::greaterThanConstant):
+        (JSC::B3::Value::lessEqualConstant):
+        (JSC::B3::Value::greaterEqualConstant):
+        (JSC::B3::Value::aboveConstant):
+        (JSC::B3::Value::belowConstant):
+        (JSC::B3::Value::aboveEqualConstant):
+        (JSC::B3::Value::belowEqualConstant):
+        * b3/B3Value.h:
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::isUrshift64Valid):
+        (JSC::B3::Air::isX86DivHelperValid):
+        (JSC::B3::Air::isX86ConvertToDoubleWord32Valid):
+        (JSC::B3::Air::isX86ConvertToDoubleWord64Valid):
+        (JSC::B3::Air::isX86Div32Valid):
+        (JSC::B3::Air::isX86Div64Valid):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirSimplifyCFG.cpp:
+        (JSC::B3::Air::simplifyCFG):
+        * b3/testb3.cpp:
+        (JSC::B3::testCallFunctionWithHellaDoubleArguments):
+        (JSC::B3::testChillDiv):
+        (JSC::B3::testChillDivTwice):
+        (JSC::B3::testChillDiv64):
+        (JSC::B3::run):
+        * dfg/DFGBlockInsertionSet.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildBinaryI32):
+
+2015-11-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        Air should allocate registers
+        https://bugs.webkit.org/show_bug.cgi?id=150457
+
+        Reviewed by Filip Pizlo.
+
+        This is a direct implementation of the Iterated Register Coalescing allocator.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirInstInlines.h:
+        * b3/air/AirIteratedRegisterCoalescing.cpp: Added.
+        (JSC::B3::Air::MoveInstHelper<Arg::GP>::mayBeCoalescable):
+        (JSC::B3::Air::MoveInstHelper<Arg::FP>::mayBeCoalescable):
+        (JSC::B3::Air::AbsoluteTmpHelper<Arg::GP>::absoluteIndex):
+        (JSC::B3::Air::AbsoluteTmpHelper<Arg::GP>::tmpFromAbsoluteIndex):
+        (JSC::B3::Air::AbsoluteTmpHelper<Arg::FP>::absoluteIndex):
+        (JSC::B3::Air::AbsoluteTmpHelper<Arg::FP>::tmpFromAbsoluteIndex):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::IteratedRegisterCoalescingAllocator):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::build):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::allocate):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::getAlias):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::spilledTmp):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::allocatedReg):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::tmpArraySize):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::initializeDegrees):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addEdges):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addEdge):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::makeWorkList):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::simplify):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::forEachAdjacent):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::hasBeenSimplified):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::decrementDegree):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::forEachNodeMoves):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::isMoveRelated):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::enableMovesOnValue):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::enableMovesOnValueAndAdjacents):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::coalesce):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::canBeSafelyCoalesced):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::precoloredCoalescingHeuristic):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::conservativeHeuristic):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addWorkList):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::combine):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::freeze):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::freezeMoves):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::selectSpill):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::assignColors):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::dumpInterferenceGraphInDot):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::dumpWorkLists):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdge::InterferenceEdge):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdge::first):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdge::second):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdge::operator==):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdge::isHashTableDeletedValue):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdge::hash):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdgeHash::hash):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::InterferenceEdgeHash::equal):
+        (JSC::B3::Air::isUselessMoveInst):
+        (JSC::B3::Air::assignRegisterToTmpInProgram):
+        (JSC::B3::Air::addSpillAndFillToProgram):
+        (JSC::B3::Air::iteratedRegisterCoalescingOnType):
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+        * b3/air/AirIteratedRegisterCoalescing.h: Added.
+        * b3/air/AirTmp.h:
+        (JSC::B3::Air::Tmp::internalValue):
+        (JSC::B3::Air::Tmp::tmpForInternalValue):
+        * b3/testb3.cpp:
+        (JSC::B3::testSpillGP):
+        (JSC::B3::run):
+
+2015-11-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add a FIXME referencing https://bugs.webkit.org/show_bug.cgi?id=151128.
+
+        * b3/air/AirInstInlines.h:
+
+2015-11-10  Saam barati  <sbarati@apple.com>
+
+        Create an FTLExceptionHandlerManager abstraction
+        https://bugs.webkit.org/show_bug.cgi?id=151079
+
+        Reviewed by Mark Lam.
+
+        Before, we used to manage the {stackmapRecordIndex => OSRExit} relationship
+        for exception handlers with a locally allocated HashMap and a few different
+        lambdas and random checks. It's cleaner and more manageable to just create 
+        a class that handles this abstraction for us. This class provides nice helper 
+        functions for everything we need. This abstraction makes reading the code easier.
+        And it will also makes hacking on the code in the future easier.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::OSRExitBase):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExceptionHandlerManager.cpp: Added.
+        (JSC::FTL::ExceptionHandlerManager::ExceptionHandlerManager):
+        (JSC::FTL::ExceptionHandlerManager::addNewExit):
+        (JSC::FTL::ExceptionHandlerManager::getOrPutByIdCallOperationExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::lazySlowPathExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::getByIdOSRExit):
+        (JSC::FTL::ExceptionHandlerManager::getCallOSRExitCommon):
+        (JSC::FTL::ExceptionHandlerManager::getCallOSRExit):
+        (JSC::FTL::ExceptionHandlerManager::procureCallSiteIndex):
+        * ftl/FTLExceptionHandlerManager.h: Added.
+
+2015-11-10  Michael Saboff  <msaboff@apple.com>
+
+        X86_64 support for compareDouble(DoubleCondition, FPRegisterID left, FPRegisterID right, RegisterID dest)
+        https://bugs.webkit.org/show_bug.cgi?id=151009
+
+        Reviewed by Filip Pizlo.
+
+        Added compareDouble() macro assembler function and the supporting setnp_r() and setp_r() X86 assembler functions.
+        Hand tested.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::compare64):
+        (JSC::MacroAssemblerX86_64::compareDouble):
+        (JSC::MacroAssemblerX86_64::branch64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::setnz_r):
+        (JSC::X86Assembler::setnp_r):
+        (JSC::X86Assembler::setp_r):
+        (JSC::X86Assembler::cdq):
+
+2015-11-10  Saam barati  <sbarati@apple.com>
+
+        Rename FTL's ExitArgumentList to something more indicative of what it is
+        https://bugs.webkit.org/show_bug.cgi?id=151078
+
+        Reviewed by Geoffrey Garen.
+
+        New name is: StackmapArgumentList
+        We use this to build patchpoint and stackmap intrinsics in FTLLowerDFGToLLVM.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLExitArgumentList.h: Removed.
+        * ftl/FTLJSTailCall.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callStackmap):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForAvailability):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitArgument):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForTailCall):
+        * ftl/FTLOSRExit.cpp:
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLStackmapArgumentList.h: Copied from Source/JavaScriptCore/ftl/FTLExitArgumentList.h.
+
+2015-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        [B3] Add more tests for Check and fix bugs this found
+        https://bugs.webkit.org/show_bug.cgi?id=151073
+
+        Reviewed by Saam Barati.
+
+        Adds tests for compare/Check fusion. The "MegaCombo" test found a bug in our implementation
+        of forEachArg: Air::spillEverything() was expecting that the Arg& to point to the actual Arg
+        so that it can mutate it. But this wasn't the case in B3::CheckSpecial. This fixes that bug.
+
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::Air::numB3Args):
+        (JSC::B3::CheckSpecial::hiddenBranch):
+        (JSC::B3::CheckSpecial::commitHiddenBranch):
+        (JSC::B3::CheckSpecial::forEachArg):
+        * b3/B3CheckSpecial.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::testCheckLessThan):
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::genericTestCompare):
+        (JSC::B3::run):
+
+2015-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        [B3] Add a test for CCall with double arguments and results
+        https://bugs.webkit.org/show_bug.cgi?id=151064
+
+        Reviewed by Saam Barati.
+
+        The test already passed on trunk. But when looking at the disassembly, I realized that I had
+        made a rookie mistake in the call argument marshalling: the stores to the stack went after the
+        moves to argument registers! This means that arguments that go to stack would be made to
+        interfere with all argument registers. That's some severe register pressure right there. So,
+        this change fixes that as well, and adds a FIXME to do it in a more principled manner in Air.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::createStore):
+        (JSC::B3::Air::LowerToAir::appendStore):
+        (JSC::B3::Air::LowerToAir::moveForType):
+        (JSC::B3::Air::LowerToAir::marshallCCallArgument):
+        * b3/testb3.cpp:
+        (JSC::B3::testReturnDouble):
+        (JSC::B3::simpleFunctionDouble):
+        (JSC::B3::testCallSimpleDouble):
+        (JSC::B3::functionWithHellaDoubleArguments):
+        (JSC::B3::testCallFunctionWithHellaDoubleArguments):
+        (JSC::B3::run):
+
+2015-11-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Remove create_hash_table options and simplify build system
+        https://bugs.webkit.org/show_bug.cgi?id=151081
+
+        Reviewed by Darin Adler.
+
+        * CMakeLists.txt: Merged native and builtin object sources and removed create_hash_table options.
+        * DerivedSources.make: Ditto.
+        * create_hash_table: Removed -b and -i options.
+
+2015-11-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        create_hash_table should know whether a function is JSBuiltin or not.
+        https://bugs.webkit.org/show_bug.cgi?id=151016
+
+        Reviewed by Darin Adler.
+
+        lut description information can explicitly state that a function is to be implemented as a JS built-in.
+        To do so, the field used to give the C++ function must be set to "JSBuiltin".
+        Updated create_hash_table script to handle that.
+        create_hash_table only includes JSCBuiltins.h if at least one function is set to "JSBuiltin".
+
+        Updated builtin generator to remove XX_BUILTIN_EXIST macro.
+        A further patch should simplify the build system by removing create_hash_table -b option.
+
+        Changes to the builtin generator are covered by rebased expectations.
+
+        Moved all lut information to using JSBuiltin whenever needed.
+
+        * Scripts/builtins/builtins_generate_combined_header.py:
+        (generate_section_for_object): Deleted.
+        (generate_section_for_code_table_macro): Deleted.
+        * Scripts/builtins/builtins_templates.py:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+        * create_hash_table:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayIteratorPrototype.cpp:
+        * runtime/InspectorInstrumentationObject.cpp:
+        * runtime/JSInternalPromiseConstructor.cpp:
+        * runtime/JSPromiseConstructor.cpp:
+        * runtime/JSPromisePrototype.cpp:
+        * runtime/ModuleLoaderObject.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ReflectObject.cpp:
+        * runtime/StringConstructor.cpp:
+        * runtime/StringIteratorPrototype.cpp:
+
+2015-11-09  Saam barati  <sbarati@apple.com>
+
+        Implement try/catch in the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=149409
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements try/catch in the FTL in a similar
+        way to how it's implemented in the DFG. The main idea is
+        this: anytime an exception is thrown in a try block, 
+        we OSR exit into the baseline JIT's corresponding catch
+        block. We compile OSR exits in a few forms:
+        1) Explicit exception checks that check VM's exception
+        pointer. This is modeled explicitly in LLVM IR.
+        2) OSR exits that are arrived at from genericUnwind 
+        caused by an exception being thrown in a JS call (including
+        getters and setters).
+        3) Exception from lazy slow paths.
+        4) Exception from when an IC misses and makes a slow path C Call.
+
+        All stackmaps associated with the above types of exits all 
+        take arguments that correspond to variables that are 
+        bytecode-live in the catch block.
+
+        1) Item 1 is the simplest implementation. When inside
+        a try block, exception checks will emit a branch to
+        an OSR exit stackmap intrinsic. This stackmap intrinsic
+        takes as arguments the live catch variables.
+
+        2) All forms of calls and GetByIds and PutByIds are implemented
+        as patchpoints in LLVM. As a patchpoint, they have a stackmap ID.
+        We use the same stackmap ID for the OSR exit. The OSR exit arguments
+        are appended to the end of the normal arguments for the patchpoint. These
+        types of OSR exits are only reached indirectly via genericUnwind.
+        Therefore, the LLVM IR we generate never has a direct branch to them.
+        These are the OSR exits we store in the CodeBlock's exception handling
+        table. The exception handlers' code locations point to the beginning
+        of the corresponding OSR exit. There is an interesting story here
+        about how we preserve registers. LLVM patchpoints assume late clobber,
+        i.e, they assume we use the patchpoint arguments before we clobber them.
+        Therefore, it's sound for LLVM to pass us arguments in volatile registers.
+        We must take care to store the arguments in volatile registers to the
+        stack before making a call. We ensure we have stack space for these
+        by using LLVM's alloca instruction. Then, when making a call inside
+        a try block, we spill the needed registers, and if that call throws,
+        we make sure the OSR exit fills the corresponding registers.
+
+        3) Exceptions from lazy slow paths are similar to (2) except they
+        don't go through generic unwind. These OSR Exits are arrived at from explicit
+        exception checks in the generated lazy slow path. Therefore, the callframe
+        is intact when arriving at the OSR exit. We make sure such lazy slow
+        paths exception check are linked to the OSR exit's code location.
+
+        4) This has a really interesting register preservation story.
+        We may have a GetById that has an IC miss and therefore goes
+        through the FTL's callOperation machinery. LLVM may also
+        ask for the result to be placed in the same register as the
+        base. Therefore, after the call, when storing to the result,
+        we overwrite the base. This can't fly with exceptions because
+        operationGetByIdOptimize may throw an exception and return "undefined". What
+        we really want is the original base value for OSR exit value
+        recovery. In this case, we take special care to flush the base 
+        value to the stack before the callOperation GetById slow path. 
+        Like call OSR exits, these types of exits will recover the base 
+        value from the stack when necessary.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::canOptimizeStringObjectAccess):
+        (JSC::DFG::Graph::willCatchExceptionInMachineFrame):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
+        (JSC::DFG::JITCompiler::exceptionCheck):
+        (JSC::DFG::JITCompiler::recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded):
+        (JSC::DFG::JITCompiler::willCatchExceptionInMachineFrame): Deleted.
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGNodeOrigin.h:
+        (JSC::DFG::NodeOrigin::withSemantic):
+        (JSC::DFG::NodeOrigin::withForExitAndExitOK):
+        (JSC::DFG::NodeOrigin::withExitOK):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::OSRExitBase):
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExitArgument.h:
+        (JSC::FTL::ExitArgument::withFormat):
+        (JSC::FTL::ExitArgument::representation):
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::~ExitThunkGenerator):
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        (JSC::FTL::ExitThunkGenerator::emitThunks):
+        * ftl/FTLExitThunkGenerator.h:
+        (JSC::FTL::ExitThunkGenerator::didThings):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::isArgument):
+        (JSC::FTL::ExitValue::isRecovery):
+        (JSC::FTL::ExitValue::isObjectMaterialization):
+        (JSC::FTL::ExitValue::hasIndexInStackmapLocations):
+        (JSC::FTL::ExitValue::exitArgument):
+        (JSC::FTL::ExitValue::rightRecoveryArgument):
+        (JSC::FTL::ExitValue::adjustStackmapLocationsIndexByOffset):
+        (JSC::FTL::ExitValue::recoveryFormat):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::validateReferences):
+        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::JSCall):
+        (JSC::FTL::JSCall::emit):
+        * ftl/FTLJSCall.h:
+        (JSC::FTL::JSCall::stackmapID):
+        * ftl/FTLJSCallBase.cpp:
+        (JSC::FTL::JSCallBase::JSCallBase):
+        (JSC::FTL::JSCallBase::emit):
+        * ftl/FTLJSCallBase.h:
+        (JSC::FTL::JSCallBase::setCallSiteIndex):
+        (JSC::FTL::JSCallBase::callSiteDescriptionOrigin):
+        (JSC::FTL::JSCallBase::setCorrespondingGenericUnwindOSRExit):
+        * ftl/FTLJSCallVarargs.cpp:
+        (JSC::FTL::JSCallVarargs::numSpillSlotsNeeded):
+        (JSC::FTL::JSCallVarargs::emit):
+        * ftl/FTLJSCallVarargs.h:
+        (JSC::FTL::JSCallVarargs::stackmapID):
+        (JSC::FTL::JSCallVarargs::operator<):
+        (JSC::FTL::JSCallVarargs::setCallSiteIndex):
+        (JSC::FTL::JSCallVarargs::callSiteDescriptionOrigin):
+        (JSC::FTL::JSCallVarargs::setCorrespondingGenericUnwindOSRExit):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
+        (JSC::FTL::DFG::LowerDFGToLLVM::terminate):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendTypeCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callPreflight):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBranchToOSRExitIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForNode):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::gatherRegistersToSpillForCallIfException):
+        (JSC::FTL::OSRExit::spillRegistersToSpillSlot):
+        (JSC::FTL::OSRExit::recoverRegistersFromSpillSlot):
+        * ftl/FTLOSRExit.h:
+        (JSC::FTL::OSRExit::considerAddingAsFrequentExitSite):
+        * ftl/FTLOSRExitCompilationInfo.h:
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * ftl/FTLState.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::findExceptionHandler):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::specialRegisters):
+        (JSC::RegisterSet::volatileRegistersForJSCall):
+        (JSC::RegisterSet::stubUnavailableRegisters):
+        * jit/RegisterSet.h:
+        * tests/stress/ftl-try-catch-getter-ic-fail-to-call-operation-throw-error.js: Added.
+        (assert):
+        (let.oThrow.get f):
+        (let.o2.get f):
+        (foo):
+        (f):
+        * tests/stress/ftl-try-catch-getter-throw.js: Added.
+        (assert):
+        (random):
+        (foo):
+        (f):
+        (let.o2.get f):
+        * tests/stress/ftl-try-catch-oom-error-lazy-slow-path.js: Added.
+        (assert):
+        (a):
+        (b):
+        (c):
+        (d):
+        (e):
+        (f):
+        (g):
+        (foo):
+        (blah):
+        * tests/stress/ftl-try-catch-patchpoint-with-volatile-registers.js: Added.
+        (assert):
+        (o1.get f):
+        (a):
+        (b):
+        (c):
+        (d):
+        (e):
+        (f):
+        (g):
+        (o2.get f):
+        (foo):
+        * tests/stress/ftl-try-catch-setter-throw.js: Added.
+        (foo):
+        (assert):
+        (f):
+        (let.o2.set f):
+        * tests/stress/ftl-try-catch-tail-call-inilned-caller.js: Added.
+        (value):
+        (assert):
+        (validate):
+        (bar):
+        (baz):
+        (jaz):
+        * tests/stress/ftl-try-catch-varargs-call-throws.js: Added.
+        (foo):
+        (f):
+        * tests/stress/try-catch-stub-routine-replaced.js:
+        (hello):
+        (foo):
+
+2015-11-09  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Built-in generator should check that there are no duplicate in JS built-in internal functions
+        https://bugs.webkit.org/show_bug.cgi?id=151018
+
+        Reviewed by Brian Burg.
+
+        Added @internal to corresponding JS built-in files.
+        Added check in built-in generator so that clashing names result in an error.
+
+        * Scripts/builtins/builtins_generate_combined_header.py:
+        (generate_section_for_code_name_macro):
+        * Scripts/builtins/builtins_model.py:
+        (BuiltinsCollection.all_internal_functions):
+        * builtins/GlobalObject.js:
+        * builtins/Operations.Promise.js:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-error: Added.
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result: Added.
+
+2015-11-09  Saam barati  <sbarati@apple.com>
+
+        DFG::PutStackSinkingPhase should not treat the stack variables written by LoadVarargs/ForwardVarargs as being live
+        https://bugs.webkit.org/show_bug.cgi?id=145295
+
+        Reviewed by Filip Pizlo.
+
+        This patch fixes PutStackSinkingPhase to no longer escape the stack
+        locations that LoadVarargs and ForwardVarargs write to. We used
+        to consider sinking PutStacks right before a LoadVarargs/ForwardVarargs
+        because we considered them uses of such stack locations. They aren't
+        uses of those stack locations, they unconditionally write to those
+        stack locations. Sinking PutStacks to these nodes was not needed before,
+        but seemed mostly innocent. But I ran into a problem with this while implementing 
+        FTL try/catch where we would end up having to generate a value for a sunken PutStack 
+        right before a LoadVarargs. This would cause us to issue a GetStack that loaded garbage that 
+        was then forwarded into a Phi that was used as the source as the PutStack. This caused the
+        abstract interpreter to confuse itself on type information for the garbage GetStack
+        that was fed into the Phi, which would cause the abstract interpreter to then claim 
+        that the basic block with the PutStack in it would never be reached. This isn't true, the 
+        block would indeed be reached. The solution here is to be more precise about the 
+        liveness of locals w.r.t LoadVarargs and ForwardVarargs.
+
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::PreciseLocalClobberizeAdaptor):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::write):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGSSACalculator.h:
+
+2015-11-09  Filip Pizlo  <fpizlo@apple.com>
+
+        B3->Air lowering should support CCall
+        https://bugs.webkit.org/show_bug.cgi?id=151043
+
+        Reviewed by Geoffrey Garen.
+
+        Adds support for lowering CCall to Air, and adds a test that makes calls. I cannot test doubles
+        until https://bugs.webkit.org/show_bug.cgi?id=151002 lands, but this does test integer
+        arguments pretty thoroughly including a test for lots of arguments. That test ensures that the
+        arguments go to registers and the stack in the right order and such.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createCompare):
+        (JSC::B3::Air::LowerToAir::marshallCCallArgument):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.h:
+        * b3/air/AirCCallSpecial.cpp:
+        (JSC::B3::Air::CCallSpecial::forEachArg):
+        (JSC::B3::Air::CCallSpecial::isValid):
+        (JSC::B3::Air::CCallSpecial::admitsStack):
+        (JSC::B3::Air::CCallSpecial::generate):
+        * b3/air/AirCCallSpecial.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testCompare):
+        (JSC::B3::simpleFunction):
+        (JSC::B3::testCallSimple):
+        (JSC::B3::functionWithHellaArguments):
+        (JSC::B3::testCallFunctionWithHellaArguments):
+        (JSC::B3::run):
+        * jit/FPRInfo.h:
+
+2015-11-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: $0 stops working after navigating to a different domain
+        https://bugs.webkit.org/show_bug.cgi?id=147962
+
+        Reviewed by Brian Burg.
+
+        Extract the per-GlobalObject cache of JSValue wrappers for
+        InjectedScriptHost objects to be reused by WebCore for its
+        CommandLineAPIHost objects injected into multiple contexts.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add new files.
+
+        * inspector/PerGlobalObjectWrapperWorld.h:
+        * inspector/PerGlobalObjectWrapperWorld.cpp:
+        (Inspector::PerGlobalObjectWrapperWorld::getWrapper):
+        (Inspector::PerGlobalObjectWrapperWorld::addWrapper):
+        (Inspector::PerGlobalObjectWrapperWorld::clearAllWrappers):
+        Hold a bunch of per-global-object wrappers for an object
+        that will outlive the global object. This inspector does this
+        for host objects that it exposes into scripts it injects into
+        each execution context created by the page.
+
+        * inspector/InjectedScriptHost.cpp:
+        (Inspector::InjectedScriptHost::wrapper):
+        (Inspector::InjectedScriptHost::clearAllWrappers):
+        (Inspector::InjectedScriptHost::jsWrapper): Deleted.
+        (Inspector::clearWrapperFromValue): Deleted.
+        (Inspector::InjectedScriptHost::clearWrapper): Deleted.
+        Extract and simplify the Per-GlobalObject wrapping into a class.
+        Simplify object construction as well.
+
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::createInjectedScript):
+        (Inspector::InjectedScriptManager::discardInjectedScripts):
+        Make discarding virtual so subclasses may also discard injected scripts.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::JSInjectedScriptHost):
+        (Inspector::JSInjectedScriptHost::releaseImpl): Deleted.
+        (Inspector::JSInjectedScriptHost::~JSInjectedScriptHost): Deleted.
+        (Inspector::toJS): Deleted.
+        (Inspector::toJSInjectedScriptHost): Deleted.
+        * inspector/JSInjectedScriptHost.h:
+        (Inspector::JSInjectedScriptHost::create):
+        (Inspector::JSInjectedScriptHost::impl):
+        Update this code originally copied from older generated bindings to
+        be more like new generated bindings and remove some now unused code.
+
+2015-11-08  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile a program with a double constant
+        https://bugs.webkit.org/show_bug.cgi?id=151002
+
+        Reviewed by Benjamin Poulain.
+
+        This implements a bunch of annoying stuff that is necessary to support constants that need a
+        data section, such as double constants on X86_64:
+
+        - B3::Procedure can now tell you what to keep alive in addition to the MacroAssemblerCodeRef.
+          We call this the B3::OpaqueByproducts. It's the client's responsibility to keep this alive
+          after calling B3::generate().
+
+        - Added a new helper for compiling B3 code, called B3::Compilation. Constructing a
+          Compilation runs the compiler. Then you can pass around a Compilation the way you would
+          have passed around a MacroAssemblerCodeRef.
+
+        - Added a constant motion phase, called moveConstants(). This does very simple constant
+          hoisting/sinking: it makes sure that each constant is only materialized in one place in
+          each basic block. It uses a DataSection, which is a kind of OpaqueByproduct, to store
+          double constants.
+
+        - The way I wanted to do constant motion is to basically track what constants are of interest
+          and then recreate them as needed, so the original Values become irrelevant in the process.
+          To do that, I needed an abstraction that is almost identical to the DFG PureValue
+          abstraction that we use for CSE. So, I created such a thing, and called it ValueKey. It
+          can be used to compare and hash pure Values, and to recreate them as needed.
+
+        - Fixed the lowering's handling of constants so that we don't perturb the placement of the
+          constant materializations.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::moveZeroToDouble):
+        (JSC::MacroAssemblerX86Common::branchDoubleNonZero):
+        * b3/B3Common.h:
+        (JSC::B3::isIdentical):
+        (JSC::B3::isRepresentableAsImpl):
+        * b3/B3Compilation.cpp: Added.
+        (JSC::B3::Compilation::Compilation):
+        (JSC::B3::Compilation::~Compilation):
+        * b3/B3Compilation.h: Added.
+        (JSC::B3::Compilation::code):
+        * b3/B3ConstDoubleValue.h:
+        (JSC::B3::ConstDoubleValue::accepts): Deleted.
+        * b3/B3DataSection.cpp: Added.
+        (JSC::B3::DataSection::DataSection):
+        (JSC::B3::DataSection::~DataSection):
+        (JSC::B3::DataSection::dump):
+        * b3/B3DataSection.h: Added.
+        (JSC::B3::DataSection::data):
+        (JSC::B3::DataSection::size):
+        * b3/B3Generate.cpp:
+        (JSC::B3::generate):
+        (JSC::B3::generateToAir):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::immOrTmp):
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::immForMove): Deleted.
+        (JSC::B3::Air::LowerToAir::immOrTmpForMove): Deleted.
+        * b3/B3MoveConstants.cpp: Added.
+        (JSC::B3::moveConstants):
+        * b3/B3MoveConstants.h: Added.
+        * b3/B3OpaqueByproduct.h: Added.
+        (JSC::B3::OpaqueByproduct::OpaqueByproduct):
+        (JSC::B3::OpaqueByproduct::~OpaqueByproduct):
+        * b3/B3OpaqueByproducts.cpp: Added.
+        (JSC::B3::OpaqueByproducts::OpaqueByproducts):
+        (JSC::B3::OpaqueByproducts::~OpaqueByproducts):
+        (JSC::B3::OpaqueByproducts::add):
+        (JSC::B3::OpaqueByproducts::dump):
+        * b3/B3OpaqueByproducts.h: Added.
+        (JSC::B3::OpaqueByproducts::count):
+        * b3/B3Opcode.h:
+        (JSC::B3::constPtrOpcode):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::Procedure):
+        (JSC::B3::Procedure::dump):
+        (JSC::B3::Procedure::blocksInPreOrder):
+        (JSC::B3::Procedure::deleteValue):
+        (JSC::B3::Procedure::addDataSection):
+        (JSC::B3::Procedure::addValueIndex):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::lastPhaseName):
+        (JSC::B3::Procedure::byproducts):
+        (JSC::B3::Procedure::takeByproducts):
+        * b3/B3Type.h:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::performSubstitution):
+        * b3/B3Value.h:
+        * b3/B3ValueKey.cpp: Added.
+        (JSC::B3::ValueKey::dump):
+        (JSC::B3::ValueKey::materialize):
+        * b3/B3ValueKey.h: Added.
+        (JSC::B3::ValueKey::ValueKey):
+        (JSC::B3::ValueKey::opcode):
+        (JSC::B3::ValueKey::type):
+        (JSC::B3::ValueKey::childIndex):
+        (JSC::B3::ValueKey::value):
+        (JSC::B3::ValueKey::doubleValue):
+        (JSC::B3::ValueKey::operator==):
+        (JSC::B3::ValueKey::operator!=):
+        (JSC::B3::ValueKey::hash):
+        (JSC::B3::ValueKey::operator bool):
+        (JSC::B3::ValueKey::canMaterialize):
+        (JSC::B3::ValueKey::isHashTableDeletedValue):
+        (JSC::B3::ValueKeyHash::hash):
+        (JSC::B3::ValueKeyHash::equal):
+        * b3/B3ValueKeyInlines.h: Added.
+        (JSC::B3::ValueKey::ValueKey):
+        (JSC::B3::ValueKey::child):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::Code):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::proc):
+        (JSC::B3::Air::Code::lastPhaseName):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::compile):
+        (JSC::B3::invoke):
+        (JSC::B3::compileAndRun):
+        (JSC::B3::test42):
+        (JSC::B3::testBranch):
+        (JSC::B3::testBranchPtr):
+        (JSC::B3::testDiamond):
+        (JSC::B3::testBranchNotEqual):
+        (JSC::B3::testBranchNotEqualCommute):
+        (JSC::B3::testBranchNotEqualNotEqual):
+        (JSC::B3::testBranchEqual):
+        (JSC::B3::testBranchEqualEqual):
+        (JSC::B3::testBranchEqualCommute):
+        (JSC::B3::testBranchEqualEqual1):
+        (JSC::B3::testBranchFold):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::testCompare):
+        (JSC::B3::testReturnDouble):
+        (JSC::B3::run):
+
+2015-11-09  Michael Saboff  <msaboff@apple.com>
+
+        Need a function that will provide Nth argument register
+        https://bugs.webkit.org/show_bug.cgi?id=151041
+
+        Reviewed by Filip Pizlo.
+
+        For 64 bit platforms, return the Nth architected argument register, otherwise InvalidGPRReg.
+
+        * jit/GPRInfo.h:
+        (JSC::argumentRegisterFor): Added to return the Nth architected argument register if defined
+        for a platform or InvalidGPRReg if not.
+
+2015-11-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [FTL] Fix the build with LLVM 3.7
+        https://bugs.webkit.org/show_bug.cgi?id=150595
+
+        Reviewed by Darin Adler.
+
+        * llvm/LLVMAPIFunctions.h: Removed the unused BuildLandingPad function.
+
+2015-11-09  Xabier Rodriguez Calvar  <calvaris@igalia.com>
+
+        [Streams API] Shield implementation from mangling then and catch promise methods
+        https://bugs.webkit.org/show_bug.cgi?id=150934
+
+        Reviewed by Youenn Fablet.
+
+        Since the prototype is not deletable and readonly we only have to care about ensuring that it has the right
+        @then and @catch internal methods.
+
+        * runtime/JSPromisePrototype.h:
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::addOwnInternalSlots): Added to create the proper @then and @catch internal slots.
+        (JSC::JSPromisePrototype::create): Call addOwnInternalSlots.
+
+2015-11-09  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        JS Built-ins functions should be able to assert
+        https://bugs.webkit.org/show_bug.cgi?id=150333
+
+        Reviewed by Yusuke Suzuki.
+
+        Introduced @assert to enable asserting in JS built-ins.
+        Adding a new bytecode 'assert' to implement it.
+        In debug builds, @assert generates 'assert' bytecodes.
+        In release builds, no byte code is produced for @assert.
+
+        In case assert is false, the JS built-in and the line number are dumped.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitAssert):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp: Generating op_assert bytecode for @assert for Debug builds.
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_assert):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_assert):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_assert):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonIdentifiers.h: Adding @assert identifier as intrinsic.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+
+2015-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Minimize ES6_CLASS_SYNTAX ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=151006
+
+        Reviewed by Darin Adler.
+
+        This patch minimizes ENABLE_ES6_CLASS_SYNTAX ifdefs.
+        It keeps several ENABLE_ES6_CLASS_SYNTAX ifdefs in Parser.cpp.
+
+        - super meta property
+        - class declaration parsing
+        - class expression parsing
+        - class with import declaration
+
+        This change makes difference minimal between the enabled and disabled configurations;
+        reducing accidental build breaks of the disabled configuration.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::constructorKind): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        * parser/ASTBuilder.h:
+        * parser/NodeConstructors.h:
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        (JSC::Scope::hasDirectSuper): Deleted.
+        (JSC::Scope::needsSuperBinding): Deleted.
+        * parser/ParserFunctionInfo.h:
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+
+2015-11-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Use StringView::upconvertedCharacters() to make a 16-bit copy in String.prototype.normalize
+        https://bugs.webkit.org/show_bug.cgi?id=151005
+
+        Reviewed by Michael Saboff.
+
+        The ICU's unorm_normalize function used by String.prototype.normalize
+        requires a 16-bit string. This patch uses StringView::upconvertedCharacters()
+        to make a 16-bit copy of a string.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncNormalize):
+
+2015-11-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        generate-js-builtins.js should support @internal annotation
+        https://bugs.webkit.org/show_bug.cgi?id=150929
+
+        Reviewed by Darin Adler.
+
+        * Scripts/builtins/builtins_generate_separate_header.py:
+        (BuiltinsSeparateHeaderGenerator.generate_output): Generate internal boilerplate code only if @internal annotation is available.
+        * Scripts/builtins/builtins_templates.py: Split boilerplate in two templates (one that is used for all built-ins and one dedicated to internals).
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Removed internal boilerplate.
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
+
+2015-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Minimize ENABLE_ES6_TEMPLATE_LITERAL_SYNTAX ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=150998
+
+        Reviewed by Geoffrey Garen.
+
+        This patch minimizes ENABLE_ES6_TEMPLATE_LITERAL_SYNTAX ifdefs.
+        It only keeps 2 ENABLE_ES6_TEMPLATE_LITERAL_SYNTAX in Parser.cpp, one for
+        template literals and one for tagged templates.
+        This change makes difference minimal between the enabled and disabled configurations;
+        reducing accidental build breaks of the disabled configuration.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        * parser/ASTBuilder.h:
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer): Deleted.
+        (JSC::Lexer<T>::lex): Deleted.
+        * parser/Lexer.h:
+        * parser/NodeConstructors.h:
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        * parser/SyntaxChecker.h:
+
+2015-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        B3->Air lowering should do pattern matching the old fashioned way
+        https://bugs.webkit.org/show_bug.cgi?id=150994
+
+        Reviewed by Geoffrey Garen.
+
+        When I first wrote the B3->Air lowering prototype, I was convinced that the patterns would get
+        so gnarly that we'd want a pattern language to write them in. So I made one, and that's what
+        the lowering has used. But as we've worked with the IR, we've found that it's very easy to
+        pattern match in C++ using the B3 API, and we've also found that most of the patterns we wrote
+        using the pattern language were mostly trivial. So this change removes the pattern match code
+        generator and the patterns files, and redoes the lowering using good old fashioned switch
+        statements. This actually reduces the total code of the lowering.
+
+        I also took the opportunity to refactoring UnOp and BinOp lowering. We had a lot of repetetive
+        code for 32-vs-64-bit opcode selection, so I factored that out into a helper. This also saves a
+        lot of code.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * b3/B3AddressMatcher.patterns: Removed.
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::LowerToAir):
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::highBitsAreZero):
+        (JSC::B3::Air::LowerToAir::tmp):
+        (JSC::B3::Air::LowerToAir::canBeInternal):
+        (JSC::B3::Air::LowerToAir::commitInternal):
+        (JSC::B3::Air::LowerToAir::crossesInterference):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::addr):
+        (JSC::B3::Air::LowerToAir::loadPromise):
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::immForMove):
+        (JSC::B3::Air::LowerToAir::immOrTmpForMove):
+        (JSC::B3::Air::LowerToAir::tryOpcodeForType):
+        (JSC::B3::Air::LowerToAir::opcodeForType):
+        (JSC::B3::Air::LowerToAir::appendUnOp):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::appendShift):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreUnOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::append):
+        (JSC::B3::Air::LowerToAir::ensureSpecial):
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        (JSC::B3::Air::LowerToAir::createBranch):
+        (JSC::B3::Air::LowerToAir::createCompare):
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::immOrTmp): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::AddressSelector): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptRoot): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptRootLate): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptInternals): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptInternalsLate): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptOperands): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptOperandsLate): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryAddShift1): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryAddShift2): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryAdd): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryFramePointer): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryStackSlot): Deleted.
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryDirect): Deleted.
+        (JSC::B3::Air::LowerToAir::acceptRoot): Deleted.
+        (JSC::B3::Air::LowerToAir::acceptRootLate): Deleted.
+        (JSC::B3::Air::LowerToAir::acceptInternals): Deleted.
+        (JSC::B3::Air::LowerToAir::acceptInternalsLate): Deleted.
+        (JSC::B3::Air::LowerToAir::acceptOperands): Deleted.
+        (JSC::B3::Air::LowerToAir::acceptOperandsLate): Deleted.
+        (JSC::B3::Air::LowerToAir::tryLoad): Deleted.
+        (JSC::B3::Air::LowerToAir::tryLoad8S): Deleted.
+        (JSC::B3::Air::LowerToAir::tryLoad8Z): Deleted.
+        (JSC::B3::Air::LowerToAir::tryLoad16S): Deleted.
+        (JSC::B3::Air::LowerToAir::tryLoad16Z): Deleted.
+        (JSC::B3::Air::LowerToAir::tryAdd): Deleted.
+        (JSC::B3::Air::LowerToAir::trySub): Deleted.
+        (JSC::B3::Air::LowerToAir::tryAnd): Deleted.
+        (JSC::B3::Air::LowerToAir::tryOr): Deleted.
+        (JSC::B3::Air::LowerToAir::tryXor): Deleted.
+        (JSC::B3::Air::LowerToAir::tryShl): Deleted.
+        (JSC::B3::Air::LowerToAir::trySShr): Deleted.
+        (JSC::B3::Air::LowerToAir::tryZShr): Deleted.
+        (JSC::B3::Air::LowerToAir::tryStoreAddLoad): Deleted.
+        (JSC::B3::Air::LowerToAir::tryStoreSubLoad): Deleted.
+        (JSC::B3::Air::LowerToAir::tryStoreAndLoad): Deleted.
+        (JSC::B3::Air::LowerToAir::tryStore): Deleted.
+        (JSC::B3::Air::LowerToAir::tryTrunc): Deleted.
+        (JSC::B3::Air::LowerToAir::tryZExt32): Deleted.
+        (JSC::B3::Air::LowerToAir::tryArgumentReg): Deleted.
+        (JSC::B3::Air::LowerToAir::tryConst32): Deleted.
+        (JSC::B3::Air::LowerToAir::tryConst64): Deleted.
+        (JSC::B3::Air::LowerToAir::tryFramePointer): Deleted.
+        (JSC::B3::Air::LowerToAir::tryStackSlot): Deleted.
+        (JSC::B3::Air::LowerToAir::tryEqual): Deleted.
+        (JSC::B3::Air::LowerToAir::tryNotEqual): Deleted.
+        (JSC::B3::Air::LowerToAir::tryLessThan): Deleted.
+        (JSC::B3::Air::LowerToAir::tryGreaterThan): Deleted.
+        (JSC::B3::Air::LowerToAir::tryLessEqual): Deleted.
+        (JSC::B3::Air::LowerToAir::tryGreaterEqual): Deleted.
+        (JSC::B3::Air::LowerToAir::tryAbove): Deleted.
+        (JSC::B3::Air::LowerToAir::tryBelow): Deleted.
+        (JSC::B3::Air::LowerToAir::tryAboveEqual): Deleted.
+        (JSC::B3::Air::LowerToAir::tryBelowEqual): Deleted.
+        (JSC::B3::Air::LowerToAir::tryPatchpoint): Deleted.
+        (JSC::B3::Air::LowerToAir::tryCheck): Deleted.
+        (JSC::B3::Air::LowerToAir::tryUpsilon): Deleted.
+        (JSC::B3::Air::LowerToAir::tryPhi): Deleted.
+        (JSC::B3::Air::LowerToAir::tryBranch): Deleted.
+        (JSC::B3::Air::LowerToAir::tryJump): Deleted.
+        (JSC::B3::Air::LowerToAir::tryIdentity): Deleted.
+        (JSC::B3::Air::LowerToAir::tryReturn): Deleted.
+        * b3/B3LoweringMatcher.patterns: Removed.
+        * b3/generate_pattern_matcher.rb: Removed.
+
+2015-11-07  Michael Saboff  <msaboff@apple.com>
+
+        Add conditional moves to the MacroAssembler
+        https://bugs.webkit.org/show_bug.cgi?id=150761
+
+        Reviewed by Filip Pizlo.
+
+        Added moveConditionally, moveConditionallyTest & moveConditionallyDouble to X86 macro assemblers.
+        Bench tested correct opcodes and operations on X86-64 and X86 for a select number of comparisons.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::moveConditionally):
+        (JSC::MacroAssemblerX86Common::moveConditionallyTest):
+        (JSC::MacroAssemblerX86Common::moveConditionallyDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmovcc):
+        (JSC::X86Assembler::cmovl_rr):
+        (JSC::X86Assembler::cmovl_mr):
+        (JSC::X86Assembler::cmovel_rr):
+        (JSC::X86Assembler::cmovnel_rr):
+        (JSC::X86Assembler::cmovpl_rr):
+        (JSC::X86Assembler::cmovnpl_rr):
+        (JSC::X86Assembler::cmovq_rr):
+        (JSC::X86Assembler::cmovq_mr):
+        (JSC::X86Assembler::cmoveq_rr):
+        (JSC::X86Assembler::cmovneq_rr):
+        (JSC::X86Assembler::cmovpq_rr):
+        (JSC::X86Assembler::cmovnpq_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::twoByteOp64):
+
+2015-11-06  Saam barati  <sbarati@apple.com>
+
+        Control Flow Profiler should keep execution counts of basic blocks
+        https://bugs.webkit.org/show_bug.cgi?id=146099
+
+        Reviewed by Mark Lam.
+
+        This patch changes the control flow profiler to now
+        keep track of execution counts for each basic block
+        instead of a boolean indicating if the basic block has 
+        executed at all.  This has the consequence of us having to 
+        always compile all op_profile_control_flows in the baseline and DFG.
+
+        This patch adds a new "executionCount" field to the inspector protocol
+        corresponding to the execution of a basic block. This patch, for now,
+        still maintains the previous field of "hasExecuted" even though this is
+        redundant with "executionCount".
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getBasicBlocks):
+        * inspector/protocol/Runtime.json:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_control_flow):
+        (JSC::JIT::emit_op_create_direct_arguments):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionHasBasicBlockExecuted):
+        (functionBasicBlockExecutionCount):
+        (functionEnableExceptionFuzz):
+        (functionDrainMicrotasks):
+        (functionIs32BitPlatform):
+        (functionLoadWebAssembly):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/BasicBlockLocation.cpp:
+        (JSC::BasicBlockLocation::BasicBlockLocation):
+        (JSC::BasicBlockLocation::dumpData):
+        (JSC::BasicBlockLocation::emitExecuteCode):
+        * runtime/BasicBlockLocation.h:
+        (JSC::BasicBlockLocation::endOffset):
+        (JSC::BasicBlockLocation::setStartOffset):
+        (JSC::BasicBlockLocation::setEndOffset):
+        (JSC::BasicBlockLocation::hasExecuted):
+        (JSC::BasicBlockLocation::executionCount):
+        * runtime/ControlFlowProfiler.cpp:
+        (JSC::ControlFlowProfiler::getBasicBlocksForSourceID):
+        (JSC::findBasicBlockAtTextOffset):
+        (JSC::ControlFlowProfiler::hasBasicBlockAtTextOffsetBeenExecuted):
+        (JSC::ControlFlowProfiler::basicBlockExecutionCountAtTextOffset):
+        * runtime/ControlFlowProfiler.h:
+        (JSC::ControlFlowProfiler::dummyBasicBlock):
+        * tests/controlFlowProfiler/execution-count.js: Added.
+        (noop):
+        (foo):
+        (a):
+        (b):
+        (baz):
+        (jaz):
+        (testWhile):
+        (is32BitPlatform.testMax):
+        (is32BitPlatform):
+
+2015-11-06  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 and Air should simplify CFGs
+        https://bugs.webkit.org/show_bug.cgi?id=150960
+
+        Reviewed by Geoffrey Garen.
+
+        This adds CFG simplification to both B3 and Air.
+
+        In B3, the simplification is done inside the B3::reduceStrength() fixpoint because we expect
+        that it will help to reveal more optimization opportunities. This is going to be particularly
+        true when we add Phi elimination.
+
+        In Air, the simplification is its own phase. We expect it to produce most of its benefits once
+        we have coalescing. Then, CFG simplification in Air will unbreak critial edges.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbortReason.h:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::oops): Reveal this as a method so that we can have an Oops instruction.
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::predecessor):
+        (JSC::B3::BasicBlock::predecessors):
+        (JSC::B3::BasicBlock::containsPredecessor):
+        * b3/B3BasicBlockUtils.h: Bunch of fixes for blocks being killed.
+        (JSC::B3::replacePredecessor):
+        (JSC::B3::resetReachability):
+        * b3/B3ReduceStrength.cpp: Implement B3 CFG simplification.
+        * b3/B3ReduceStrength.h:
+        * b3/air/AirBasicBlock.h:
+        (JSC::B3::Air::BasicBlock::resize):
+        (JSC::B3::Air::BasicBlock::insts):
+        (JSC::B3::Air::BasicBlock::appendInst):
+        (JSC::B3::Air::BasicBlock::containsPredecessor):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirInst.cpp:
+        (JSC::B3::Air::Inst::hasArgEffects):
+        (JSC::B3::Air::Inst::dump):
+        * b3/air/AirInst.h:
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::Liveness::Liveness): Fix for when blocks were killed.
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirSimplifyCFG.cpp: Added.
+        (JSC::B3::Air::simplifyCFG):
+        * b3/air/AirSimplifyCFG.h: Added.
+
+2015-11-05  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>
+
+        Add runtime and compile time flags for enabling Web Animations API and model.
+        https://bugs.webkit.org/show_bug.cgi?id=150914
+
+        Reviewed by Benjamin Poulain.
+
+        Add ENABLE_WEB_ANIMATIONS compile time flag, runtime flag webAnimationsEnabled and Expose WK2 preference for runtime flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-11-05  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Layout Test js/intl-collator.html is crashing on win 7 debug
+        https://bugs.webkit.org/show_bug.cgi?id=150943
+
+        Reviewed by Geoffrey Garen.
+
+        The string length returned by ICU's uenum_next seems to be unreliable
+        on an old version of ICU. Since uenum_next returns a null-terminated
+        string anyway, this patch removes the use of the length.
+
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::sortLocaleData):
+
+2015-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add FIXMEs referencing https://bugs.webkit.org/show_bug.cgi?id=150958 and
+        https://bugs.webkit.org/show_bug.cgi?id=150954.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        * b3/B3ReduceStrength.cpp:
+
+2015-11-05  Aleksandr Skachkov  <gskachkov@gmail.com>
+
+        Using emitResolveScope & emitGetFromScope with 'this' that is TDZ lead to segfault in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=150902
+
+        Reviewed by Geoffrey Garen.
+
+        Tiny fix provided by Saam Barati. This fix prevent segfault error in arrow function, 
+        when it uses in constructor of derived class, before 'super' is called.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2015-11-05  Filip Pizlo  <fpizlo@apple.com>
+
+        B3->Air lowering should have a story for compare-branch fusion
+        https://bugs.webkit.org/show_bug.cgi?id=150721
+
+        Reviewed by Geoffrey Garen.
+
+        This adds comprehensive support for compares and compare/branch fusion to B3. The fusion is
+        super aggressive. It can even handle things like Branch(LessThan(Load8S(...), constant)). It
+        can even handle flipping the operands to the branch, and flipping the comparison condition,
+        if it enables a more efficient instruction. This happens when there is asymmetry in the
+        admitted argument kinds. For example, Branch32 will only accept an Imm as a second operand.
+        If we do a LessThan(constant, load) then we will generate it as:
+
+            Branch32 GreaterThan, (addr), $imm
+
+        This also supports compiling and fusing tests, and to some extent, compiling and fusing
+        double compares. Though we cannot test doubles yet because we don't have enough support for
+        that.
+
+        This also supports fusing compare/branches in Checks. We basically get that for free.
+
+        Because I wanted to fuse comparisons with sub-32-bit loads, I added support for those loads
+        directly, too.
+
+        The tests are now getting super big, so I made testb3 run tests in parallel.
+
+        Finally, this slightly changes the semantics of Branch and Check. Previously they would have
+        accepted a double to branch on. I found that this is awkward. It's especially awkward since
+        we want to be explicit about when a double zero constant is materialized. So, from now on, we
+        require that to branch on a double being non-zero, you have to do Branch(NotEqual(value, 0)).
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::invert):
+        (JSC::MacroAssembler::isInvertible):
+        (JSC::MacroAssembler::flip):
+        (JSC::MacroAssembler::isSigned):
+        (JSC::MacroAssembler::isUnsigned):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::test32):
+        (JSC::MacroAssemblerX86Common::invert):
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::Key::Key):
+        (JSC::B3::CheckSpecial::Key::dump):
+        (JSC::B3::CheckSpecial::CheckSpecial):
+        (JSC::B3::CheckSpecial::~CheckSpecial):
+        * b3/B3CheckSpecial.h:
+        (JSC::B3::CheckSpecial::Key::Key):
+        (JSC::B3::CheckSpecial::Key::operator==):
+        (JSC::B3::CheckSpecial::Key::operator!=):
+        (JSC::B3::CheckSpecial::Key::operator bool):
+        (JSC::B3::CheckSpecial::Key::opcode):
+        (JSC::B3::CheckSpecial::Key::numArgs):
+        (JSC::B3::CheckSpecial::Key::isHashTableDeletedValue):
+        (JSC::B3::CheckSpecial::Key::hash):
+        (JSC::B3::CheckSpecialKeyHash::hash):
+        (JSC::B3::CheckSpecialKeyHash::equal):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::zShrConstant):
+        (JSC::B3::Const32Value::equalConstant):
+        (JSC::B3::Const32Value::notEqualConstant):
+        (JSC::B3::Const32Value::lessThanConstant):
+        (JSC::B3::Const32Value::greaterThanConstant):
+        (JSC::B3::Const32Value::lessEqualConstant):
+        (JSC::B3::Const32Value::greaterEqualConstant):
+        (JSC::B3::Const32Value::aboveConstant):
+        (JSC::B3::Const32Value::belowConstant):
+        (JSC::B3::Const32Value::aboveEqualConstant):
+        (JSC::B3::Const32Value::belowEqualConstant):
+        (JSC::B3::Const32Value::dumpMeta):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::zShrConstant):
+        (JSC::B3::Const64Value::equalConstant):
+        (JSC::B3::Const64Value::notEqualConstant):
+        (JSC::B3::Const64Value::lessThanConstant):
+        (JSC::B3::Const64Value::greaterThanConstant):
+        (JSC::B3::Const64Value::lessEqualConstant):
+        (JSC::B3::Const64Value::greaterEqualConstant):
+        (JSC::B3::Const64Value::aboveConstant):
+        (JSC::B3::Const64Value::belowConstant):
+        (JSC::B3::Const64Value::aboveEqualConstant):
+        (JSC::B3::Const64Value::belowEqualConstant):
+        (JSC::B3::Const64Value::dumpMeta):
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::subConstant):
+        (JSC::B3::ConstDoubleValue::equalConstant):
+        (JSC::B3::ConstDoubleValue::notEqualConstant):
+        (JSC::B3::ConstDoubleValue::lessThanConstant):
+        (JSC::B3::ConstDoubleValue::greaterThanConstant):
+        (JSC::B3::ConstDoubleValue::lessEqualConstant):
+        (JSC::B3::ConstDoubleValue::greaterEqualConstant):
+        (JSC::B3::ConstDoubleValue::dumpMeta):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::LowerToAir):
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::shouldCopyPropagate):
+        (JSC::B3::Air::LowerToAir::ArgPromise::ArgPromise):
+        (JSC::B3::Air::LowerToAir::ArgPromise::tmp):
+        (JSC::B3::Air::LowerToAir::ArgPromise::operator bool):
+        (JSC::B3::Air::LowerToAir::ArgPromise::kind):
+        (JSC::B3::Air::LowerToAir::ArgPromise::peek):
+        (JSC::B3::Air::LowerToAir::ArgPromise::consume):
+        (JSC::B3::Air::LowerToAir::tmp):
+        (JSC::B3::Air::LowerToAir::tmpPromise):
+        (JSC::B3::Air::LowerToAir::canBeInternal):
+        (JSC::B3::Air::LowerToAir::addr):
+        (JSC::B3::Air::LowerToAir::loadPromise):
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreUnOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        (JSC::B3::Air::LowerToAir::createBranch):
+        (JSC::B3::Air::LowerToAir::createCompare):
+        (JSC::B3::Air::LowerToAir::tryLoad):
+        (JSC::B3::Air::LowerToAir::tryLoad8S):
+        (JSC::B3::Air::LowerToAir::tryLoad8Z):
+        (JSC::B3::Air::LowerToAir::tryLoad16S):
+        (JSC::B3::Air::LowerToAir::tryLoad16Z):
+        (JSC::B3::Air::LowerToAir::tryAdd):
+        (JSC::B3::Air::LowerToAir::tryStackSlot):
+        (JSC::B3::Air::LowerToAir::tryEqual):
+        (JSC::B3::Air::LowerToAir::tryNotEqual):
+        (JSC::B3::Air::LowerToAir::tryLessThan):
+        (JSC::B3::Air::LowerToAir::tryGreaterThan):
+        (JSC::B3::Air::LowerToAir::tryLessEqual):
+        (JSC::B3::Air::LowerToAir::tryGreaterEqual):
+        (JSC::B3::Air::LowerToAir::tryAbove):
+        (JSC::B3::Air::LowerToAir::tryBelow):
+        (JSC::B3::Air::LowerToAir::tryAboveEqual):
+        (JSC::B3::Air::LowerToAir::tryBelowEqual):
+        (JSC::B3::Air::LowerToAir::tryPatchpoint):
+        (JSC::B3::Air::LowerToAir::tryCheck):
+        (JSC::B3::Air::LowerToAir::tryBranch):
+        (JSC::B3::Air::LowerToAir::loadAddr): Deleted.
+        * b3/B3LoweringMatcher.patterns:
+        * b3/B3Opcode.cpp:
+        (JSC::B3::invertedCompare):
+        * b3/B3Opcode.h:
+        (JSC::B3::isCheckMath):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::addIntConstant):
+        (JSC::B3::Procedure::addBoolConstant):
+        (JSC::B3::Procedure::resetValueOwners):
+        * b3/B3Procedure.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::zShrConstant):
+        (JSC::B3::Value::equalConstant):
+        (JSC::B3::Value::notEqualConstant):
+        (JSC::B3::Value::lessThanConstant):
+        (JSC::B3::Value::greaterThanConstant):
+        (JSC::B3::Value::lessEqualConstant):
+        (JSC::B3::Value::greaterEqualConstant):
+        (JSC::B3::Value::aboveConstant):
+        (JSC::B3::Value::belowConstant):
+        (JSC::B3::Value::aboveEqualConstant):
+        (JSC::B3::Value::belowEqualConstant):
+        (JSC::B3::Value::invertedCompare):
+        * b3/B3Value.h:
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::dump):
+        (WTF::printInternal):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isUse):
+        (JSC::B3::Air::Arg::typeForB3Type):
+        (JSC::B3::Air::Arg::widthForB3Type):
+        (JSC::B3::Air::Arg::Arg):
+        (JSC::B3::Air::Arg::value):
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::asNumber):
+        (JSC::B3::Air::Arg::pointerValue):
+        (JSC::B3::Air::Arg::asDoubleCondition):
+        (JSC::B3::Air::Arg::inverted):
+        (JSC::B3::Air::Arg::flipped):
+        (JSC::B3::Air::Arg::isSignedCond):
+        (JSC::B3::Air::Arg::isUnsignedCond):
+        * b3/air/AirInst.h:
+        (JSC::B3::Air::Inst::Inst):
+        (JSC::B3::Air::Inst::operator bool):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (hiddenTruthBecauseNoReturnIsStupid):
+        (JSC::B3::testStoreLoadStackSlot):
+        (JSC::B3::modelLoad):
+        (JSC::B3::testLoad):
+        (JSC::B3::testBranch):
+        (JSC::B3::testComplex):
+        (JSC::B3::testSimplePatchpoint):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::genericTestCompare):
+        (JSC::B3::modelCompare):
+        (JSC::B3::testCompareLoad):
+        (JSC::B3::testCompareImpl):
+        (JSC::B3::testCompare):
+        (JSC::B3::run):
+        (main):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+
+2015-11-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Clean up InjectedScript uses
+        https://bugs.webkit.org/show_bug.cgi?id=150921
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::wrapCallFrames):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::initialize): Deleted.
+        * inspector/InjectedScriptBase.h:
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::didCreateInjectedScript):
+        * inspector/InjectedScriptManager.h:
+        * inspector/InjectedScriptModule.cpp:
+        (Inspector::InjectedScriptModule::ensureInjected):
+        * inspector/InjectedScriptModule.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/agents/InspectorDebuggerAgent.h:
+
+2015-11-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Put ScriptDebugServer into InspectorEnvironment and cleanup duplicate references
+        https://bugs.webkit.org/show_bug.cgi?id=150869
+
+        Reviewed by Brian Burg.
+
+        ScriptDebugServer (JSC::Debugger) is being used by more and more agents
+        for instrumentation into JavaScriptCore. Currently the ScriptDebugServer
+        is owned by DebuggerAgent subclasses that make their own ScriptDebugServer
+        subclass. As more agents want to use it there was added boilerplate.
+        Instead, put the ScriptDebugServer in the InspectorEnvironment (Controllers).
+        Then each agent can access it during construction through the environment.
+
+        Do the same clean up for RuntimeAgent::globalVM, which is now just a
+        duplication of InspectorEnvironment::vm.
+
+        * inspector/InspectorEnvironment.h:
+        Add scriptDebugServer().
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::scriptDebugServer):
+        Own the JSGlobalObjectScriptDebugServer.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (Inspector::InspectorDebuggerAgent::enable):
+        (Inspector::InspectorDebuggerAgent::disable):
+        (Inspector::InspectorDebuggerAgent::setBreakpointsActive):
+        (Inspector::InspectorDebuggerAgent::isPaused):
+        (Inspector::InspectorDebuggerAgent::setSuppressAllPauses):
+        (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
+        (Inspector::InspectorDebuggerAgent::removeBreakpoint):
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        (Inspector::InspectorDebuggerAgent::resolveBreakpoint):
+        (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (Inspector::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        (Inspector::InspectorDebuggerAgent::resume):
+        (Inspector::InspectorDebuggerAgent::stepOver):
+        (Inspector::InspectorDebuggerAgent::stepInto):
+        (Inspector::InspectorDebuggerAgent::stepOut):
+        (Inspector::InspectorDebuggerAgent::setPauseOnExceptions):
+        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (Inspector::InspectorDebuggerAgent::scriptExecutionBlockedByCSP):
+        (Inspector::InspectorDebuggerAgent::didPause):
+        (Inspector::InspectorDebuggerAgent::breakProgram):
+        (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (Inspector::setPauseOnExceptionsState):
+        (Inspector::InspectorRuntimeAgent::parse):
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::InspectorRuntimeAgent::setTypeProfilerEnabledState):
+        (Inspector::InspectorRuntimeAgent::getBasicBlocks):
+        Use VM and ScriptDebugServer passed during construction.
+
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::injectedScriptForEval):
+        (Inspector::JSGlobalObjectDebuggerAgent::JSGlobalObjectDebuggerAgent): Deleted.
+        One special case needed by this subclass as a convenience to access the global object.
+
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        (Inspector::JSGlobalObjectRuntimeAgent::globalVM): Deleted.
+        This virtual method is no longer needed, the base class has everything now.
+
+2015-11-05  Xabier Rodriguez Calvar  <calvaris@igalia.com>
+
+        [Streams API] Shield implementation from user mangling Promise.reject and resolve methods
+        https://bugs.webkit.org/show_bug.cgi?id=150895
+
+        Reviewed by Youenn Fablet.
+
+        Keep Promise.resolve and reject also as internal slots for the Promise constructor given that there is no way to
+        retrieve the former implementation if the user decides to replace it. This allows to safely create vended
+        promises even if the user changes the constructor methods.
+
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::addOwnInternalSlots): Added to include @reject and @resolve.
+        (JSC::JSPromiseConstructor::create): Call addOwnInternalSlots.
+
+2015-11-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add B3-to-Air lowering for the shift opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=150919
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::rshift64):
+        (JSC::MacroAssemblerX86_64::urshift64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::shrq_CLr):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::shlConstant):
+        (JSC::B3::Const32Value::sShrConstant):
+        (JSC::B3::Const32Value::zShrConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::shlConstant):
+        (JSC::B3::Const64Value::sShrConstant):
+        (JSC::B3::Const64Value::zShrConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendShift):
+        (JSC::B3::Air::LowerToAir::tryShl):
+        (JSC::B3::Air::LowerToAir::trySShr):
+        (JSC::B3::Air::LowerToAir::tryZShr):
+        * b3/B3LoweringMatcher.patterns:
+        * b3/B3Opcode.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::shlConstant):
+        (JSC::B3::Value::sShrConstant):
+        (JSC::B3::Value::zShrConstant):
+        * b3/B3Value.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::isShiftValid):
+        (JSC::B3::Air::isRshift32Valid):
+        (JSC::B3::Air::isRshift64Valid):
+        (JSC::B3::Air::isUrshift32Valid):
+        (JSC::B3::Air::isUrshift64Valid):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testShlArgs):
+        (JSC::B3::testShlImms):
+        (JSC::B3::testShlArgImm):
+        (JSC::B3::testShlArgs32):
+        (JSC::B3::testShlImms32):
+        (JSC::B3::testShlArgImm32):
+        (JSC::B3::testSShrArgs):
+        (JSC::B3::testSShrImms):
+        (JSC::B3::testSShrArgImm):
+        (JSC::B3::testSShrArgs32):
+        (JSC::B3::testSShrImms32):
+        (JSC::B3::testSShrArgImm32):
+        (JSC::B3::testZShrArgs):
+        (JSC::B3::testZShrImms):
+        (JSC::B3::testZShrArgImm):
+        (JSC::B3::testZShrArgs32):
+        (JSC::B3::testZShrImms32):
+        (JSC::B3::testZShrArgImm32):
+        (JSC::B3::run):
+
+2015-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile a Check
+        https://bugs.webkit.org/show_bug.cgi?id=150878
+
+        Reviewed by Saam Barati.
+
+        The Check opcode in B3 is going to be our main OSR exit mechanism. It is a stackmap
+        value, so you can pass it any number of additional arguments, and you will get to find
+        out how those arguments are represented at the point that the value lands in the machine
+        code. Unlike a Patchpoint, a Check branches on a value, with the goal of supporting full
+        compare/branch fusion. The stackmap's generator runs in an out-of-line path to which
+        that branch is linked.
+
+        This change fills in the glue necessary to compile a Check and it includes a simple
+        test of this functionality. That test also happens to check that such simple code will
+        never use callee-saves, which I think is sensible.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::append):
+        (JSC::B3::Air::LowerToAir::ensureSpecial):
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        (JSC::B3::Air::LowerToAir::tryStackSlot):
+        (JSC::B3::Air::LowerToAir::tryPatchpoint):
+        (JSC::B3::Air::LowerToAir::tryCheck):
+        (JSC::B3::Air::LowerToAir::tryUpsilon):
+        * b3/B3LoweringMatcher.patterns:
+        * b3/testb3.cpp:
+        (JSC::B3::testSimplePatchpoint):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::run):
+
+2015-10-30  Keith Miller  <keith_miller@apple.com>
+
+        Fix endless OSR exits when creating a rope that contains an object that ToPrimitive's to a number.
+        https://bugs.webkit.org/show_bug.cgi?id=150583
+
+        Reviewed by Benjamin Poulain.
+
+        Before we assumed that the result of ToPrimitive on any object was a string.
+        This had a couple of negative effects. First, the result ToPrimitive on an
+        object can be overridden to be any primitive type. In fact, as of ES6, ToPrimitive,
+        when part of a addition expression, will type hint a number value. Second, even after
+        repeatedly exiting with a bad type we would continue to think that the result
+        of ToPrimitive would be a string so we continue to convert StrCats into MakeRope.
+
+        The fix is to make Prediction Propagation match the behavior of Fixup and move
+        canOptimizeStringObjectAccess to DFGGraph.
+
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
+        (JSC::DFG::FixupPhase::fixupToPrimitive):
+        (JSC::DFG::FixupPhase::fixupToStringOrCallStringConstructor):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane): Deleted.
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess): Deleted.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isStringPrototypeMethodSane):
+        (JSC::DFG::Graph::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::resultOfToPrimitive):
+        (JSC::DFG::resultOfToPrimitive): Deleted.
+
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
+        (JSC::DFG::FixupPhase::fixupToPrimitive):
+        (JSC::DFG::FixupPhase::fixupToStringOrCallStringConstructor):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane): Deleted.
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess): Deleted.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isStringPrototypeMethodSane):
+        (JSC::DFG::Graph::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::resultOfToPrimitive):
+        (JSC::DFG::resultOfToPrimitive): Deleted.
+        * tests/stress/string-rope-with-custom-valueof.js: Added.
+        (catNumber):
+        (number.valueOf):
+        (catBool):
+        (bool.valueOf):
+        (catUndefined):
+        (undef.valueOf):
+        (catRandom):
+        (random.valueOf):
+
+2015-11-04  Xabier Rodriguez Calvar  <calvaris@igalia.com>
+
+        Remove bogus global internal functions for properties and prototype retrieval
+        https://bugs.webkit.org/show_bug.cgi?id=150892
+
+        Reviewed by Darin Adler.
+
+        Global @getOwnPropertyNames and @getPrototypeOf point to the floor function, so it is bogus dead code.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Removed global @getOwnPropertyNames and @getPrototypeOf.
+
+2015-11-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add B3-to-Air lowering for BitXor
+        https://bugs.webkit.org/show_bug.cgi?id=150872
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::xor32):
+        Fix the indentation.
+
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::bitXorConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::bitXorConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tryXor):
+        * b3/B3LoweringMatcher.patterns:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::bitXorConstant):
+        * b3/B3Value.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testBitXorArgs):
+        (JSC::B3::testBitXorSameArg):
+        (JSC::B3::testBitXorImms):
+        (JSC::B3::testBitXorArgImm):
+        (JSC::B3::testBitXorImmArg):
+        (JSC::B3::testBitXorBitXorArgImmImm):
+        (JSC::B3::testBitXorImmBitXorArgImm):
+        (JSC::B3::testBitXorArgs32):
+        (JSC::B3::testBitXorSameArg32):
+        (JSC::B3::testBitXorImms32):
+        (JSC::B3::testBitXorArgImm32):
+        (JSC::B3::testBitXorImmArg32):
+        (JSC::B3::testBitXorBitXorArgImmImm32):
+        (JSC::B3::testBitXorImmBitXorArgImm32):
+        (JSC::B3::run):
+
+2015-11-03  Mark Lam  <mark.lam@apple.com>
+
+        Add op_add tests to compare behavior of JIT generated code to the LLINT's.
+        https://bugs.webkit.org/show_bug.cgi?id=150864
+
+        Reviewed by Saam Barati.
+
+        * tests/stress/op_add.js: Added.
+        (o1.valueOf):
+        (generateScenarios):
+        (printScenarios):
+        (testCases.func):
+        (func):
+        (initializeTestCases):
+        (runTest):
+
+2015-11-03  Mark Lam  <mark.lam@apple.com>
+
+        Rename DFG's compileAdd to compileArithAdd.
+        https://bugs.webkit.org/show_bug.cgi?id=150866
+
+        Reviewed by Benjamin Poulain.
+
+        The function is only supposed to generate code to do arithmetic addition on
+        numeric types.  Naming it compileArithAdd() is more accurate, and is consistent
+        with the name of the node it emits code for (i.e. ArithAdd) as well as other
+        compiler functions for analogous operations e.g. compileArithSub.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::SpeculativeJIT::compileArithAdd):
+        (JSC::DFG::SpeculativeJIT::compileAdd): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2015-11-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove duplication among ScriptDebugServer subclasses
+        https://bugs.webkit.org/show_bug.cgi?id=150860
+
+        Reviewed by Timothy Hatcher.
+
+        ScriptDebugServer expects a list of listeners to dispatch events to.
+        However each of its subclasses had their own implementation of the
+        list because of different handling when the first was added or when
+        the last was removed. Extract common code into ScriptDebugServer
+        which simplifies things.
+
+        Subclasses now only implement a virtual methods "attachDebugger"
+        and "detachDebugger" which is the unique work done when the first
+        listener is added or last is removed.
+
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        (Inspector::JSGlobalObjectScriptDebugServer::attachDebugger):
+        (Inspector::JSGlobalObjectScriptDebugServer::detachDebugger):
+        (Inspector::JSGlobalObjectScriptDebugServer::addListener): Deleted.
+        (Inspector::JSGlobalObjectScriptDebugServer::removeListener): Deleted.
+        * inspector/JSGlobalObjectScriptDebugServer.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionLog):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionSound):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe):
+        (Inspector::ScriptDebugServer::sourceParsed):
+        (Inspector::ScriptDebugServer::dispatchFunctionToListeners):
+        (Inspector::ScriptDebugServer::addListener):
+        (Inspector::ScriptDebugServer::removeListener):
+        * inspector/ScriptDebugServer.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::enable):
+        (Inspector::InspectorDebuggerAgent::disable):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::startListeningScriptDebugServer): Deleted.
+        (Inspector::JSGlobalObjectDebuggerAgent::stopListeningScriptDebugServer): Deleted.
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h:
+
+        * inspector/ScriptDebugListener.h:
+        (Inspector::ScriptDebugListener::Script::Script):
+        Drive-by convert Script to a struct, it has public fields and is used as such.
+
+2015-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::LowerToAir should recognize Neg (i.e. Sub($0, value))
+        https://bugs.webkit.org/show_bug.cgi?id=150759
+
+        Reviewed by Benjamin Poulain.
+
+        Adds various forms of Sub(0, value) and compiles them as Neg. Also fixes a bug in
+        StoreSubLoad. This bug was correctness-benign, so I couldn't add a test for it.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::immOrTmp):
+        (JSC::B3::Air::LowerToAir::appendUnOp):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreUnOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::trySub):
+        (JSC::B3::Air::LowerToAir::tryStoreSubLoad):
+        * b3/B3LoweringMatcher.patterns:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testAdd1Ptr):
+        (JSC::B3::testNeg32):
+        (JSC::B3::testNegPtr):
+        (JSC::B3::testStoreAddLoad):
+        (JSC::B3::testStoreAddAndLoad):
+        (JSC::B3::testStoreNegLoad32):
+        (JSC::B3::testStoreNegLoadPtr):
+        (JSC::B3::testAdd1Uncommuted):
+        (JSC::B3::run):
+
+2015-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::Values that have effects should allow specification of custom HeapRanges
+        https://bugs.webkit.org/show_bug.cgi?id=150535
+
+        Reviewed by Benjamin Poulain.
+
+        Add a Effects field to calls and patchpoints. Add a HeapRange to MemoryValues.
+
+        In the process, I created a class for the CCall opcode, so that it has somewhere to put
+        the Effects field.
+
+        While doing this, I realized that we didn't have a good way of ensuring that an opcode
+        that requires a specific subclass was actually created with that subclass. So, I added
+        assertions for this.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3ArgumentRegValue.h:
+        * b3/B3CCallValue.cpp: Added.
+        * b3/B3CCallValue.h: Added.
+        * b3/B3CheckValue.h:
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.h:
+        (JSC::B3::ConstDoubleValue::ConstDoubleValue):
+        * b3/B3ControlValue.h:
+        * b3/B3Effects.h:
+        (JSC::B3::Effects::forCall):
+        (JSC::B3::Effects::mustExecute):
+        * b3/B3MemoryValue.h:
+        * b3/B3PatchpointValue.h:
+        * b3/B3StackSlotValue.h:
+        * b3/B3UpsilonValue.h:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::dumpMeta):
+        (JSC::B3::Value::checkOpcode):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+
+2015-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::Stackmap should be a superclass of B3::PatchpointValue and B3::CheckValue rather than being one of their members
+        https://bugs.webkit.org/show_bug.cgi?id=150831
+
+        Rubber stamped by Benjamin Poulain.
+
+        Previously, Stackmap was a value that PatchpointValue and CheckValue would hold as a field.
+        We'd have convenient ways of getting this field, like via Value::stackmap(). But this was a
+        bit ridiculous, since Stackmap is logically just a common supertype for Patchpointvalue and
+        CheckValue. This patch makes this reality by replacing Stackmap with StackmapValue. This makes
+        the code a lot more reasonable.
+
+        I also needed to make dumping a bit more customizable, so I changed dumpMeta() to take a
+        CommaPrinter&. This gives subclasses better control over whether or not to emit a comma. Also
+        it's now possible for subclasses of Value to customize how children are printed. StackmapValue
+        uses this to print the children and their reps together like:
+
+            Int32 @2 = Patchpoint(@0:SomeRegister, @1:SomeRegister, generator = 0x1107ec010, clobbered = [], usedRegisters = [], ExitsSideways|ControlDependent|Writes:Top|Reads:Top)
+
+        This has no behavior change, it's just a big refactoring. You can see how much simpler this
+        makes things by looking at the testSimplePatchpoint() test.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3ArgumentRegValue.cpp:
+        (JSC::B3::ArgumentRegValue::~ArgumentRegValue):
+        (JSC::B3::ArgumentRegValue::dumpMeta):
+        * b3/B3ArgumentRegValue.h:
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::generate):
+        * b3/B3CheckValue.cpp:
+        (JSC::B3::CheckValue::~CheckValue):
+        (JSC::B3::CheckValue::CheckValue):
+        (JSC::B3::CheckValue::dumpMeta): Deleted.
+        * b3/B3CheckValue.h:
+        (JSC::B3::CheckValue::accepts):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::notEqualConstant):
+        (JSC::B3::Const32Value::dumpMeta):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::notEqualConstant):
+        (JSC::B3::Const64Value::dumpMeta):
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::notEqualConstant):
+        (JSC::B3::ConstDoubleValue::dumpMeta):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ConstrainedValue.cpp: Added.
+        (JSC::B3::ConstrainedValue::dump):
+        * b3/B3ConstrainedValue.h: Added.
+        (JSC::B3::ConstrainedValue::ConstrainedValue):
+        (JSC::B3::ConstrainedValue::operator bool):
+        (JSC::B3::ConstrainedValue::value):
+        (JSC::B3::ConstrainedValue::rep):
+        * b3/B3ControlValue.cpp:
+        (JSC::B3::ControlValue::convertToJump):
+        (JSC::B3::ControlValue::dumpMeta):
+        * b3/B3ControlValue.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tryPatchpoint):
+        * b3/B3MemoryValue.cpp:
+        (JSC::B3::MemoryValue::accessByteSize):
+        (JSC::B3::MemoryValue::dumpMeta):
+        * b3/B3MemoryValue.h:
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::generate):
+        * b3/B3PatchpointValue.cpp:
+        (JSC::B3::PatchpointValue::~PatchpointValue):
+        (JSC::B3::PatchpointValue::PatchpointValue):
+        (JSC::B3::PatchpointValue::dumpMeta): Deleted.
+        * b3/B3PatchpointValue.h:
+        (JSC::B3::PatchpointValue::accepts):
+        * b3/B3StackSlotValue.cpp:
+        (JSC::B3::StackSlotValue::~StackSlotValue):
+        (JSC::B3::StackSlotValue::dumpMeta):
+        * b3/B3StackSlotValue.h:
+        * b3/B3Stackmap.cpp: Removed.
+        * b3/B3Stackmap.h: Removed.
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::reportUsedRegisters):
+        (JSC::B3::StackmapSpecial::extraClobberedRegs):
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        (JSC::B3::StackmapSpecial::isValidImpl):
+        (JSC::B3::StackmapSpecial::admitsStackImpl):
+        * b3/B3StackmapSpecial.h:
+        * b3/B3StackmapValue.cpp: Added.
+        (JSC::B3::StackmapValue::~StackmapValue):
+        (JSC::B3::StackmapValue::append):
+        (JSC::B3::StackmapValue::setConstrainedChild):
+        (JSC::B3::StackmapValue::setConstraint):
+        (JSC::B3::StackmapValue::dumpChildren):
+        (JSC::B3::StackmapValue::dumpMeta):
+        (JSC::B3::StackmapValue::StackmapValue):
+        * b3/B3StackmapValue.h: Added.
+        * b3/B3SwitchValue.cpp:
+        (JSC::B3::SwitchValue::appendCase):
+        (JSC::B3::SwitchValue::dumpMeta):
+        (JSC::B3::SwitchValue::SwitchValue):
+        * b3/B3SwitchValue.h:
+        * b3/B3UpsilonValue.cpp:
+        (JSC::B3::UpsilonValue::~UpsilonValue):
+        (JSC::B3::UpsilonValue::dumpMeta):
+        * b3/B3UpsilonValue.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::dump):
+        (JSC::B3::Value::dumpChildren):
+        (JSC::B3::Value::deepDump):
+        (JSC::B3::Value::performSubstitution):
+        (JSC::B3::Value::dumpMeta):
+        * b3/B3Value.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::asNumber):
+        (JSC::B3::Value::stackmap): Deleted.
+        * b3/B3ValueRep.h:
+        (JSC::B3::ValueRep::kind):
+        (JSC::B3::ValueRep::operator==):
+        (JSC::B3::ValueRep::operator!=):
+        (JSC::B3::ValueRep::operator bool):
+        (JSC::B3::ValueRep::isAny):
+        * b3/air/AirInstInlines.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testSimplePatchpoint):
+
+2015-11-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add Air lowering for BitOr and impove BitAnd
+        https://bugs.webkit.org/show_bug.cgi?id=150827
+
+        Reviewed by Filip Pizlo.
+
+        In this patch:
+        -B3 to Air lowering for BirOr.
+        -Codegen for BitOr.
+        -Strength reduction for BitOr and BitAnd.
+        -Tests for BitAnd and BitOr.
+        -Bug fix: Move64 with a negative value was destroying the top bits.
+
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::bitAndConstant):
+        (JSC::B3::Const32Value::bitOrConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::bitAndConstant):
+        (JSC::B3::Const64Value::bitOrConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::immForMove):
+        (JSC::B3::Air::LowerToAir::immOrTmpForMove):
+        (JSC::B3::Air::LowerToAir::tryOr):
+        (JSC::B3::Air::LowerToAir::tryConst64):
+        (JSC::B3::Air::LowerToAir::tryUpsilon):
+        (JSC::B3::Air::LowerToAir::tryIdentity):
+        (JSC::B3::Air::LowerToAir::tryReturn):
+        (JSC::B3::Air::LowerToAir::immOrTmp): Deleted.
+        * b3/B3LoweringMatcher.patterns:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::bitAndConstant):
+        (JSC::B3::Value::bitOrConstant):
+        * b3/B3Value.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testReturnConst64):
+        (JSC::B3::testBitAndArgs):
+        (JSC::B3::testBitAndSameArg):
+        (JSC::B3::testBitAndImms):
+        (JSC::B3::testBitAndArgImm):
+        (JSC::B3::testBitAndImmArg):
+        (JSC::B3::testBitAndBitAndArgImmImm):
+        (JSC::B3::testBitAndImmBitAndArgImm):
+        (JSC::B3::testBitAndArgs32):
+        (JSC::B3::testBitAndSameArg32):
+        (JSC::B3::testBitAndImms32):
+        (JSC::B3::testBitAndArgImm32):
+        (JSC::B3::testBitAndImmArg32):
+        (JSC::B3::testBitAndBitAndArgImmImm32):
+        (JSC::B3::testBitAndImmBitAndArgImm32):
+        (JSC::B3::testBitOrArgs):
+        (JSC::B3::testBitOrSameArg):
+        (JSC::B3::testBitOrImms):
+        (JSC::B3::testBitOrArgImm):
+        (JSC::B3::testBitOrImmArg):
+        (JSC::B3::testBitOrBitOrArgImmImm):
+        (JSC::B3::testBitOrImmBitOrArgImm):
+        (JSC::B3::testBitOrArgs32):
+        (JSC::B3::testBitOrSameArg32):
+        (JSC::B3::testBitOrImms32):
+        (JSC::B3::testBitOrArgImm32):
+        (JSC::B3::testBitOrImmArg32):
+        (JSC::B3::testBitOrBitOrArgImmImm32):
+        (JSC::B3::testBitOrImmBitOrArgImm32):
+        (JSC::B3::run):
+
+2015-11-03  Saam barati  <sbarati@apple.com>
+
+        Rewrite "const" as "var" for iTunes/iBooks on the Mac
+        https://bugs.webkit.org/show_bug.cgi?id=150852
+
+        Reviewed by Geoffrey Garen.
+
+        VM now has a setting indicating if we should treat
+        "const" variables as "var" to more closely match
+        JSC's previous implementation of "const" before ES6.
+
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        * runtime/VM.h:
+        (JSC::VM::setShouldRewriteConstAsVar):
+        (JSC::VM::shouldRewriteConstAsVar):
+
+2015-11-03  Mark Lam  <mark.lam@apple.com>
+
+        Fix some inefficiencies in the baseline usage of JITAddGenerator.
+        https://bugs.webkit.org/show_bug.cgi?id=150850
+
+        Reviewed by Michael Saboff.
+
+        1. emit_op_add() was loading the operands twice.  Removed the redundant load.
+        2. The snippet may decide that it wants to go the slow path route all the time.
+           In that case, emit_op_add will end up emitting a branch to an out of line
+           slow path followed by some dead code to store the result of the fast path
+           on to the stack.
+           We now check if the snippet determined that there's no fast path, and just
+           emit the slow path inline, and skip the dead store of the fast path result.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+
+2015-11-03  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::LowerToAir should do copy propagation
+        https://bugs.webkit.org/show_bug.cgi?id=150775
+
+        Reviewed by Geoffrey Garen.
+
+        What we are trying to do is remove the unnecessary Move's and Move32's from Trunc and ZExt32.
+        You could think of this as an Air optimization, and indeed, Air is powerful enough that we
+        could write a phase that does copy propagation through Move's and Move32's. For Move32's it
+        would only copy-propagate if it proved that the value was already zero-extended. We could
+        know this by just adding a Def32 role to Air.
+
+        But this patch takes a different approach: we ensure that we don't generate such redundant
+        Move's and Move32's to begin with. The reason is that it's much cheaper to do analysis over
+        B3 than over Air. So, whenever possible, and optimization should be implemented in B3. In
+        this case the optimization can't quite be implemented in B3 because you cannot remove a Trunc
+        or ZExt32 without violating the B3 type system. So, the best place to do this optimization is
+        during lowering: we can use B3 for our analysis and we can use Air to express the
+        transformation.
+
+        Copy propagating during B3->Air lowering is natural because we are creating "SSA-like" Tmps
+        from the B3 Values. They are SSA-like in the sense that except the tmp for a Phi, we know
+        that the Tmp will be assigned once and that the assignment will dominate all uses. So, if we
+        see an operation like Trunc that is semantically just a Move, we can skip the Move and just
+        claim that the Trunc has the same Tmp as its child. We do something similar for ZExt32,
+        except with that one we have to analyze IR to ensure that the value will actually be zero
+        extended. Note that this kind of reasoning about how Tmps work in Air is only possible in the
+        B3->Air lowering, since at that point we know for sure which Tmps behave this way. If we
+        wanted to do anything like this as a later Air phase, we'd have to do more analysis to first
+        prove that Tmps behave in this way.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::highBitsAreZero):
+        (JSC::B3::Air::LowerToAir::shouldCopyPropagate):
+        (JSC::B3::Air::LowerToAir::tmp):
+        (JSC::B3::Air::LowerToAir::tryStore):
+        (JSC::B3::Air::LowerToAir::tryTrunc):
+        (JSC::B3::Air::LowerToAir::tryZExt32):
+        (JSC::B3::Air::LowerToAir::tryIdentity):
+        (JSC::B3::Air::LowerToAir::tryTruncArgumentReg): Deleted.
+        * b3/B3LoweringMatcher.patterns:
+
+2015-11-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Move ScriptDebugServer::Task to WorkerScriptDebugServer where it is actually used
+        https://bugs.webkit.org/show_bug.cgi?id=150847
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/ScriptDebugServer.h:
+        Remove Task from here, it isn't needed in the general case.
+
+        * parser/SourceProvider.h:
+        Remove unimplemented method.
+
+2015-11-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Handle or Remove ParseHTML Timeline Event Records
+        https://bugs.webkit.org/show_bug.cgi?id=150689
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+
+2015-11-03  Michael Saboff  <msaboff@apple.com>
+
+        Rename InlineCallFrame:: getCallerSkippingDeadFrames to something more descriptive
+        https://bugs.webkit.org/show_bug.cgi?id=150832
+
+        Reviewed by Geoffrey Garen.
+
+        Renamed InlineCallFrame::getCallerSkippingDeadFrames() to getCallerSkippingTailCalls().
+        Did similar renaming to helper InlineCallFrame::computeCallerSkippingTailCalls() and
+        InlineCallFrame::getCallerInlineFrameSkippingTailCalls().
+
+        * bytecode/InlineCallFrame.h:
+        (JSC::InlineCallFrame::computeCallerSkippingTailCalls):
+        (JSC::InlineCallFrame::getCallerSkippingTailCalls):
+        (JSC::InlineCallFrame::getCallerInlineFrameSkippingTailCalls):
+        (JSC::InlineCallFrame::computeCallerSkippingDeadFrames): Deleted.
+        (JSC::InlineCallFrame::getCallerSkippingDeadFrames): Deleted.
+        (JSC::InlineCallFrame::getCallerInlineFrameSkippingDeadFrames): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::allInlineFramesAreTailCalls):
+        (JSC::DFG::ByteCodeParser::currentCodeOrigin):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isLiveInBytecode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::codeOriginDescriptionOfCallSite):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::gotoNextFrame):
+
+2015-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        B3/Air should use bubble sort for their insertion sets, because it's faster than std::stable_sort
+        https://bugs.webkit.org/show_bug.cgi?id=150828
+
+        Reviewed by Geoffrey Garen.
+
+        Undo the 2% compile time regression caused by http://trac.webkit.org/changeset/191913.
+
+        * b3/B3InsertionSet.cpp:
+        (JSC::B3::InsertionSet::execute): Switch to bubble sort.
+        * b3/air/AirInsertionSet.cpp:
+        (JSC::B3::Air::InsertionSet::execute): Switch to bubble sort.
+        * dfg/DFGBlockInsertionSet.cpp:
+        (JSC::DFG::BlockInsertionSet::execute): Switch back to quicksort.
+
+2015-11-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, partially revert r191952.
+
+        Removed GCC compiler workarounds (unreachable returns).
+
+        * b3/B3Type.h:
+        (JSC::B3::sizeofType):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isUse):
+        (JSC::B3::Air::Arg::isDef):
+        (JSC::B3::Air::Arg::isGP):
+        (JSC::B3::Air::Arg::isFP):
+        (JSC::B3::Air::Arg::isType):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::newTmp):
+        (JSC::B3::Air::Code::numTmps):
+
+2015-11-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the ENABLE(B3_JIT) build on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=150794
+
+        Reviewed by Darin Adler.
+
+        * CMakeLists.txt:
+        * b3/B3HeapRange.h:
+        * b3/B3IndexSet.h:
+        (JSC::B3::IndexSet::Iterable::iterator::operator++):
+        * b3/B3Type.h:
+        (JSC::B3::sizeofType):
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::dump):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isUse):
+        (JSC::B3::Air::Arg::isDef):
+        (JSC::B3::Air::Arg::isGP):
+        (JSC::B3::Air::Arg::isFP):
+        (JSC::B3::Air::Arg::isType):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::newTmp):
+        (JSC::B3::Air::Code::numTmps):
+        * b3/air/AirSpecial.cpp:
+
+2015-11-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Clean up ENABLE(ES6_ARROWFUNCTION_SYNTAX) ifdefs and keep minimal set of them
+        https://bugs.webkit.org/show_bug.cgi?id=150793
+
+        Reviewed by Darin Adler.
+
+        Fix the !ENABLE(ES6_ARROWFUNCTION_SYNTAX) build after r191875.
+        This patch drops many ENABLE(ES6_ARROWFUNCTION_SYNTAX) ifdefs and keep only one of them;
+        the ifdef in parseAssignmentExpression.
+        This prevents functionality of parsing arrow function syntax.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner): Deleted.
+        * parser/Parser.h:
+        (JSC::Parser::isArrowFunctionParamters): Deleted.
+        * parser/ParserTokens.h:
+
+2015-11-02  Michael Saboff  <msaboff@apple.com>
+
+        WebInspector crashed while viewing Timeline when refreshing cnn.com while it was already loading
+        https://bugs.webkit.org/show_bug.cgi?id=150745
+
+        Reviewed by Geoffrey Garen.
+
+        During OSR exit, reifyInlinedCallFrames() was using the call kind from a tail call to
+        find the CallLinkInfo / StubInfo to find the return PC.  Instead we need to get the call
+        type of the true caller, that is the function we'll be returning to.
+
+        This can be found by remembering the last call type we find while walking up the inlined
+        frames in InlineCallFrame::getCallerSkippingDeadFrames().
+
+        We can also return directly back to a getter or setter callsite without using a thunk.
+
+        * bytecode/InlineCallFrame.h:
+        (JSC::InlineCallFrame::computeCallerSkippingDeadFrames):
+        (JSC::InlineCallFrame::getCallerSkippingDeadFrames):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_id): Need to eliminate the stack pointer check, as it is wrong
+        for reified inlined frames created during OSR exit. 
+        * jit/ThunkGenerators.cpp:
+        (JSC::baselineGetterReturnThunkGenerator): Deleted.
+        (JSC::baselineSetterReturnThunkGenerator): Deleted.
+        * jit/ThunkGenerators.h:
+
+2015-11-02  Saam barati  <sbarati@apple.com>
+
+        Wrong value recovery for DFG try/catch with a getter that throws during an IC miss
+        https://bugs.webkit.org/show_bug.cgi?id=150760
+
+        Reviewed by Geoffrey Garen.
+
+        This is related to using PhantomLocal instead of Flush as 
+        the liveness preservation mechanism for live catch variables. 
+        I'm temporarily switching things back to Flush. This will be a
+        performance hit for try/catch in the DFG. Landing this patch,
+        though, will allow me to land try/catch in the FTL. It also
+        makes try/catch in the DFG sound. I have opened another
+        bug to further investigate using PhantomLocal as the
+        liveness preservation mechanism: https://bugs.webkit.org/show_bug.cgi?id=150824
+
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp:
+        (JSC::DFG::LiveCatchVariablePreservationPhase::handleBlock):
+        * tests/stress/dfg-try-catch-wrong-value-recovery-on-ic-miss.js: Added.
+        (assert):
+        (let.oThrow.get f):
+        (let.o2.get f):
+        (foo):
+        (f):
+
+2015-11-02  Andy Estes  <aestes@apple.com>
+
+        [Cocoa] Add tvOS and watchOS to SUPPORTED_PLATFORMS
+        https://bugs.webkit.org/show_bug.cgi?id=150819
+
+        Reviewed by Dan Bernstein.
+
+        This tells Xcode to include these platforms in its Devices dropdown, making it possible to build in the IDE.
+
+        * Configurations/Base.xcconfig:
+
+2015-11-02  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] MiniBrowser unable to use WebInspector
+        https://bugs.webkit.org/show_bug.cgi?id=150810
+        <rdar://problem/23358514>
+
+        Reviewed by Timothy Hatcher.
+
+        The CMakeList rule for creating the InjectedScriptSource.min.js was improperly including
+        the quote characters in the text prepended to InjectedScriptSource.min.js. This caused a
+        parsing error in the JS file.
+        
+        The solution was to switch from using "COMMAND echo" to use the more cross-platform
+        compatible command "COMMAND ${CMAKE_COMMAND} -E echo ...", which handles the string
+        escaping properly on all platforms.
+
+        * CMakeLists.txt: Switch the 'echo' command syntax to be more cross-platform.
+
+2015-11-02  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile a Patchpoint
+        https://bugs.webkit.org/show_bug.cgi?id=150750
+
+        Reviewed by Geoffrey Garen.
+
+        This adds the glue in B3::LowerToAir that turns a B3::PatchpointValue into an Air::Patch
+        with a B3::PatchpointSpecial.
+
+        Along the way, I found some bugs. For starters, it became clear that I wanted to be able
+        to append constraints to a Stackmap, and I wanted to have more flexibility in how I
+        created a PatchpointValue. I also wanted more helper methods in ValueRep, since
+        otherwise I would have had to write a lot of boilerplate.
+
+        I discovered, and fixed, a minor goof in Air::Code dumping when there are specials.
+
+        There were a ton of indexing bugs in B3StackmapSpecial.
+
+        The spiller was broken in case the Def was not the last Arg, since it was adding things
+        to the insertion set both at instIndex and instIndex + 1, and the two types of additions
+        could occur in the wrong (i.e. the +1 case first) order with an early Def. We often have
+        bugs like this. In the DFG, we were paranoid about performance so we only admit out-of-
+        order insertions as a rare case. I think that we don't really need to be so paranoid.
+        So, I made the new insertion sets use a stable_sort to ensure that everything happens in
+        the right order. I changed DFG::BlockInsertionSet to also use stable_sort; it previously
+        used sort, which is slightly wrong.
+
+        This adds a new test that uses Patchpoint to implement a 32-bit add. It works!
+
+        * b3/B3InsertionSet.cpp:
+        (JSC::B3::InsertionSet::execute):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::appendStore):
+        (JSC::B3::Air::LowerToAir::moveForType):
+        (JSC::B3::Air::LowerToAir::append):
+        (JSC::B3::Air::LowerToAir::ensureSpecial):
+        (JSC::B3::Air::LowerToAir::tryStore):
+        (JSC::B3::Air::LowerToAir::tryStackSlot):
+        (JSC::B3::Air::LowerToAir::tryPatchpoint):
+        (JSC::B3::Air::LowerToAir::tryUpsilon):
+        * b3/B3LoweringMatcher.patterns:
+        * b3/B3PatchpointValue.h:
+        (JSC::B3::PatchpointValue::accepts): Deleted.
+        (JSC::B3::PatchpointValue::PatchpointValue): Deleted.
+        * b3/B3Stackmap.h:
+        (JSC::B3::Stackmap::constrain):
+        (JSC::B3::Stackmap::appendConstraint):
+        (JSC::B3::Stackmap::reps):
+        (JSC::B3::Stackmap::clobber):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        (JSC::B3::StackmapSpecial::isValidImpl):
+        * b3/B3Value.h:
+        * b3/B3ValueRep.h:
+        (JSC::B3::ValueRep::ValueRep):
+        (JSC::B3::ValueRep::reg):
+        (JSC::B3::ValueRep::operator bool):
+        (JSC::B3::ValueRep::isAny):
+        (JSC::B3::ValueRep::isSomeRegister):
+        (JSC::B3::ValueRep::isReg):
+        (JSC::B3::ValueRep::isGPR):
+        (JSC::B3::ValueRep::isFPR):
+        (JSC::B3::ValueRep::gpr):
+        (JSC::B3::ValueRep::fpr):
+        (JSC::B3::ValueRep::isStack):
+        (JSC::B3::ValueRep::offsetFromFP):
+        (JSC::B3::ValueRep::isStackArgument):
+        (JSC::B3::ValueRep::offsetFromSP):
+        (JSC::B3::ValueRep::isConstant):
+        (JSC::B3::ValueRep::value):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::dump):
+        * b3/air/AirInsertionSet.cpp:
+        (JSC::B3::Air::InsertionSet::execute):
+        * b3/testb3.cpp:
+        (JSC::B3::testComplex):
+        (JSC::B3::testSimplePatchpoint):
+        (JSC::B3::run):
+        * dfg/DFGBlockInsertionSet.cpp:
+        (JSC::DFG::BlockInsertionSet::execute):
+
+2015-11-02  Mark Lam  <mark.lam@apple.com>
+
+        Snippefy op_add for the baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=150129
+
+        Reviewed by Geoffrey Garen and Saam Barati.
+
+        Performance is neutral for both 32-bit and 64-bit on X86_64.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.h:
+        (JSC::JIT::getOperandConstantInt):
+        - Move getOperandConstantInt() from the JSVALUE64 section to the common section
+          because the snippet needs it.
+
+        * jit/JITAddGenerator.cpp: Added.
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITAddGenerator.h: Added.
+        (JSC::JITAddGenerator::JITAddGenerator):
+        (JSC::JITAddGenerator::endJumpList):
+        (JSC::JITAddGenerator::slowPathJumpList):
+        - JITAddGenerator implements an optimization for the case where 1 of the 2 operands
+          is a constant int32_t.  It does not implement an optimization for the case where
+          both operands are constant int32_t.  This is because:
+          1. For the baseline JIT, the ASTBuilder will fold the 2 constants together.
+          2. For the DFG, the AbstractInterpreter will also fold the 2 constants.
+
+          Hence, such an optimization path (for 2 constant int32_t operands) would never
+          be taken, and is why we won't implement it.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        - Removed op_add cases.  These are no longer used by the op_add emitters.
+
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        - Moved out from the JSVALUE64 section to the common section, and reimplemented
+          using the snippet.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_add): Deleted.
+        (JSC::JIT::emitAdd32Constant): Deleted.
+        (JSC::JIT::emitSlow_op_add): Deleted.
+        - Remove 32-bit specific version of op_add.  The snippet serves both 32-bit
+          and 64-bit implementations.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::getOperandConstantInt):
+        - Move getOperandConstantInt() from the JSVALUE64 section to the common section
+          because the snippet needs it.
+
+2015-11-02  Brian Burg  <bburg@apple.com>
+
+        Run sort-Xcode-project-file for the JavaScriptCore project.
+
+        Unreviewed. Many things were out of order following recent B3 commits.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-11-02  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Rename op_put_getter_setter to op_put_getter_setter_by_id
+        https://bugs.webkit.org/show_bug.cgi?id=150773
+
+        Reviewed by Mark Lam.
+
+        Renaming op_put_getter_setter to op_put_getter_setter_by_id makes this op name consistent with
+        the other ops' names like op_put_getter_by_id etc.
+
+        And to fix build dependencies in Xcode, we added LLIntAssembly.h into Xcode project file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutGetterSetter):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_getter_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+
+2015-11-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the FTL JIT build with system LLVM on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=150795
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+
+2015-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Support Generator Syntax
+        https://bugs.webkit.org/show_bug.cgi?id=150769
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements syntax part of ES6 Generators.
+
+        1. Add ENABLE_ES6_GENERATORS compile time flag. It is disabled by default, and will be enabled once ES6 generator functionality is implemented.
+        2. Add lexer support for YIELD. It changes "yield" from reserved-if-strict word to keyword. And it is correct under the ES6 spec.
+        3. Implement parsing functionality and YieldExprNode stub. YieldExprNode does not emit meaningful bytecodes yet. This should be implemented in the future patch.
+        4. Accept "yield" Identifier as an label etc. under sloppy mode && non-generator code. http://ecma-international.org/ecma-262/6.0/#sec-generator-function-definitions-static-semantics-early-errors
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::YieldExprNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createYield):
+        * parser/Keywords.table:
+        * parser/NodeConstructors.h:
+        (JSC::YieldExprNode::YieldExprNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseBreakStatement):
+        (JSC::Parser<LexerType>::parseContinueStatement):
+        (JSC::Parser<LexerType>::parseTryStatement):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseYieldExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parseFunctionExpression):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseArrowFunctionExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::setSourceParseMode):
+        (JSC::Scope::isGenerator):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::setIsGenerator):
+        (JSC::Scope::setIsModule):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::isYIELDMaskedAsIDENT):
+        (JSC::Parser::matchSpecIdentifier):
+        (JSC::Parser::saveState):
+        (JSC::Parser::restoreState):
+        * parser/ParserModes.h:
+        (JSC::isFunctionParseMode):
+        (JSC::isModuleParseMode):
+        (JSC::isProgramParseMode):
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createYield):
+        * tests/stress/generator-methods.js: Added.
+        (Hello.prototype.gen):
+        (Hello.gen):
+        (Hello):
+        (Hello.prototype.set get string_appeared_here):
+        (Hello.string_appeared_here):
+        (Hello.prototype.20):
+        (Hello.20):
+        (Hello.prototype.42):
+        (Hello.42):
+        (let.object.gen):
+        (let.object.set get string_appeared_here):
+        (let.object.20):
+        (let.object.42):
+        * tests/stress/generator-syntax.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntaxError.Hello.prototype.get gen):
+        (testSyntaxError.Hello):
+        (SyntaxError.Unexpected.token.string_appeared_here.Expected.an.opening.string_appeared_here.before.a.method.testSyntaxError.Hello.prototype.set gen):
+        (SyntaxError.Unexpected.token.string_appeared_here.Expected.an.opening.string_appeared_here.before.a.method.testSyntaxError.Hello):
+        (SyntaxError.Unexpected.token.string_appeared_here.Expected.an.opening.string_appeared_here.before.a.method.testSyntaxError.gen):
+        (testSyntaxError.value):
+        (testSyntaxError.gen.ng):
+        (testSyntaxError.gen):
+        (testSyntax.gen):
+        * tests/stress/yield-and-line-terminator.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntax.gen):
+        (testSyntaxError.gen):
+        * tests/stress/yield-label-generator.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntaxError.test):
+        (SyntaxError.Unexpected.keyword.string_appeared_here.Expected.an.identifier.as.the.target.a.continue.statement.testSyntax.test):
+        * tests/stress/yield-label.js: Added.
+        (yield):
+        (testSyntaxError):
+        (testSyntaxError.test):
+        * tests/stress/yield-named-accessors-generator.js: Added.
+        (t1.let.object.get yield):
+        (t1.let.object.set yield):
+        (t1):
+        (t2.let.object.get yield):
+        (t2.let.object.set yield):
+        (t2):
+        * tests/stress/yield-named-accessors.js: Added.
+        (t1.let.object.get yield):
+        (t1.let.object.set yield):
+        (t1):
+        (t2.let.object.get yield):
+        (t2.let.object.set yield):
+        (t2):
+        * tests/stress/yield-named-variable-generator.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntaxError.t1):
+        (testSyntaxError.t1.yield):
+        (testSyntax.t1.yield):
+        (testSyntax.t1):
+        * tests/stress/yield-named-variable.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntax.t1):
+        (testSyntaxError.t1):
+        (testSyntax.t1.yield):
+        (testSyntaxError.t1.yield):
+        * tests/stress/yield-out-of-generator.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntaxError.hello):
+        (testSyntaxError.gen.hello):
+        (testSyntaxError.gen):
+        (testSyntax.gen):
+        (testSyntax.gen.ok):
+        (testSyntaxError.gen.ok):
+
+2015-11-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Dominators should be factored out of the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=150764
+
+        Reviewed by Geoffrey Garen.
+
+        Factored DFGDominators.h/DFGDominators.cpp into WTF. To do this, I made two changes to the
+        DFG:
+
+        1) DFG now has a CFG abstraction called DFG::CFG. The cool thing about this is that in the
+           future if we wanted to support inverted dominators, we could do it by just creating a
+           DFG::BackwardCFG.
+
+        2) Got rid of DFG::Analysis. From now on, an Analysis being invalidated is expressed by the
+           DFG::Graph having a null pointer for that analysis. When we "run" the analysis, we
+           just instantiate it. This makes it much more natural to integrate WTF::Dominators into
+           the DFG.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAnalysis.h: Removed.
+        * dfg/DFGCFG.h: Added.
+        (JSC::DFG::CFG::CFG):
+        (JSC::DFG::CFG::root):
+        (JSC::DFG::CFG::newMap<T>):
+        (JSC::DFG::CFG::successors):
+        (JSC::DFG::CFG::predecessors):
+        (JSC::DFG::CFG::index):
+        (JSC::DFG::CFG::node):
+        (JSC::DFG::CFG::numNodes):
+        (JSC::DFG::CFG::dump):
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::createDumpList):
+        * dfg/DFGDominators.cpp: Removed.
+        * dfg/DFGDominators.h:
+        (JSC::DFG::Dominators::Dominators):
+        (JSC::DFG::Dominators::strictlyDominates): Deleted.
+        (JSC::DFG::Dominators::dominates): Deleted.
+        (JSC::DFG::Dominators::immediateDominatorOf): Deleted.
+        (JSC::DFG::Dominators::forAllStrictDominatorsOf): Deleted.
+        (JSC::DFG::Dominators::forAllDominatorsOf): Deleted.
+        (JSC::DFG::Dominators::forAllBlocksStrictlyDominatedBy): Deleted.
+        (JSC::DFG::Dominators::forAllBlocksDominatedBy): Deleted.
+        (JSC::DFG::Dominators::forAllBlocksInDominanceFrontierOf): Deleted.
+        (JSC::DFG::Dominators::forAllBlocksInIteratedDominanceFrontierOf): Deleted.
+        (JSC::DFG::Dominators::forAllBlocksInPrunedIteratedDominanceFrontierOf): Deleted.
+        (JSC::DFG::Dominators::forAllBlocksInDominanceFrontierOfImpl): Deleted.
+        (JSC::DFG::Dominators::forAllBlocksInIteratedDominanceFrontierOfImpl): Deleted.
+        (JSC::DFG::Dominators::BlockData::BlockData): Deleted.
+        * dfg/DFGEdgeDominates.h:
+        (JSC::DFG::EdgeDominates::operator()):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::invalidateCFG):
+        (JSC::DFG::Graph::substituteGetLocal):
+        (JSC::DFG::Graph::handleAssertionFailure):
+        (JSC::DFG::Graph::ensureDominators):
+        (JSC::DFG::Graph::ensurePrePostNumbering):
+        (JSC::DFG::Graph::ensureNaturalLoops):
+        (JSC::DFG::Graph::valueProfileFor):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::hasDebuggerEnabled):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+        (JSC::DFG::LoopPreHeaderCreationPhase::run):
+        * dfg/DFGNaturalLoops.cpp:
+        (JSC::DFG::NaturalLoop::dump):
+        (JSC::DFG::NaturalLoops::NaturalLoops):
+        (JSC::DFG::NaturalLoops::~NaturalLoops):
+        (JSC::DFG::NaturalLoops::loopsOf):
+        (JSC::DFG::NaturalLoops::computeDependencies): Deleted.
+        (JSC::DFG::NaturalLoops::compute): Deleted.
+        * dfg/DFGNaturalLoops.h:
+        (JSC::DFG::NaturalLoops::numLoops):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::SuccessorsIterable::end):
+        (JSC::DFG::Node::SuccessorsIterable::size):
+        (JSC::DFG::Node::SuccessorsIterable::at):
+        (JSC::DFG::Node::SuccessorsIterable::operator[]):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPrePostNumbering.cpp:
+        (JSC::DFG::PrePostNumbering::PrePostNumbering):
+        (JSC::DFG::PrePostNumbering::~PrePostNumbering):
+        (JSC::DFG::PrePostNumbering::compute): Deleted.
+        * dfg/DFGPrePostNumbering.h:
+        (JSC::DFG::PrePostNumbering::preNumber):
+        (JSC::DFG::PrePostNumbering::postNumber):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGSSACalculator.cpp:
+        (JSC::DFG::SSACalculator::nonLocalReachingDef):
+        (JSC::DFG::SSACalculator::reachingDefAtTail):
+        * dfg/DFGSSACalculator.h:
+        (JSC::DFG::SSACalculator::computePhis):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::safelyInvalidateAfterTermination):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isValid):
+
+2015-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::reduceStrength's DCE should be more agro and less wrong
+        https://bugs.webkit.org/show_bug.cgi?id=150748
+
+        Reviewed by Geoffrey Garen.
+
+        First of all, our DCE had a bug where it would keep Upsilons after it deleted the Phis that
+        they referenced. But our B3 DCE was also not aggressive enough. It would not eliminate
+        cycles. It was also probably slower than it needed to be, since it would eliminate all
+        never-referenced things on each fixpoint.
+
+        This adds a presume-everyone-is-dead-and-find-live-things style DCE. This is very natural to
+        write, except for Upsilons. For everything but Upsilons, it's just a worklist algorithm. For
+        Upsilons, it's a fixpoint. It works fine in the end.
+
+        I kept finding bugs in this algorithm when I tested it against my "Complex" test that I was
+        writing as a compile time benchmark. So, I include that test in this change. I also include
+        the small lowering extensions that it needed - shifting and zero extending.
+
+        This change also adds an LLVM version of the Complex test. Though the LLVM version feels
+        more natural to write because LLVM has traditional Phi's rather than our quirky Phi's, in
+        the end LLVM ends up performing very badly - 10x to 20x worse than B3. Some of that gap will
+        close once we give B3 a register allocator, but still, that's pretty good news for our B3
+        strategy.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::lshift64):
+        (JSC::MacroAssemblerX86_64::rshift64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::shlq_i8r):
+        (JSC::X86Assembler::shlq_CLr):
+        (JSC::X86Assembler::imull_rr):
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::replacePredecessor):
+        (JSC::B3::BasicBlock::dump):
+        (JSC::B3::BasicBlock::removeNops): Deleted.
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::frequency):
+        * b3/B3Common.cpp:
+        (JSC::B3::shouldSaveIRBeforePhase):
+        (JSC::B3::shouldMeasurePhaseTiming):
+        * b3/B3Common.h:
+        (JSC::B3::isRepresentableAsImpl):
+        * b3/B3Generate.cpp:
+        (JSC::B3::generate):
+        (JSC::B3::generateToAir):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tryAnd):
+        (JSC::B3::Air::LowerToAir::tryShl):
+        (JSC::B3::Air::LowerToAir::tryStoreAddLoad):
+        (JSC::B3::Air::LowerToAir::tryTrunc):
+        (JSC::B3::Air::LowerToAir::tryZExt32):
+        (JSC::B3::Air::LowerToAir::tryArgumentReg):
+        * b3/B3LoweringMatcher.patterns:
+        * b3/B3PhaseScope.cpp:
+        (JSC::B3::PhaseScope::PhaseScope):
+        * b3/B3PhaseScope.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3TimingScope.cpp: Added.
+        (JSC::B3::TimingScope::TimingScope):
+        (JSC::B3::TimingScope::~TimingScope):
+        * b3/B3TimingScope.h: Added.
+        * b3/B3Validate.cpp:
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::ForEach<Arg>::forEach):
+        (JSC::B3::Air::Inst::forEach):
+        (JSC::B3::Air::isLshift32Valid):
+        (JSC::B3::Air::isLshift64Valid):
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::Liveness::isAlive):
+        (JSC::B3::Air::Liveness::Liveness):
+        (JSC::B3::Air::Liveness::LocalCalc::execute):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirPhaseScope.cpp:
+        (JSC::B3::Air::PhaseScope::PhaseScope):
+        * b3/air/AirPhaseScope.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testBranchEqualFoldPtr):
+        (JSC::B3::testComplex):
+        (JSC::B3::run):
+        * runtime/Options.h:
+
+2015-11-01  Alexey Proskuryakov  <ap@apple.com>
+
+        [ES6] Add support for toStringTag
+        https://bugs.webkit.org/show_bug.cgi?id=150696
+
+        Re-landing, as this wasn't the culprit.
+
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::JSArrayBufferPrototype::finishCreation):
+        (JSC::JSArrayBufferPrototype::create):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::create):
+        (JSC::JSDataViewPrototype::finishCreation):
+        (JSC::JSDataViewPrototype::createStructure):
+        * runtime/JSDataViewPrototype.h:
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::finishCreation):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::finishCreation):
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::finishCreation):
+        (JSC::JSPromisePrototype::getOwnPropertySlot):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewProtoFuncValues):
+        (JSC::typedArrayViewProtoGetterFuncToStringTag):
+        (JSC::JSTypedArrayViewPrototype::JSTypedArrayViewPrototype):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototype::finishCreation):
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototype::finishCreation):
+        (JSC::SetIteratorPrototypeFuncNext):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::initializeCommonStrings):
+        (JSC::SmallStrings::visitStrongReferences):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::typeString):
+        (JSC::SmallStrings::objectStringStart):
+        (JSC::SmallStrings::nullObjectString):
+        (JSC::SmallStrings::undefinedObjectString):
+        * runtime/StringIteratorPrototype.cpp:
+        (JSC::StringIteratorPrototype::finishCreation):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::SymbolPrototype::finishCreation):
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::WeakMapPrototype::finishCreation):
+        (JSC::getWeakMapData):
+        * runtime/WeakSetPrototype.cpp:
+        (JSC::WeakSetPrototype::finishCreation):
+        (JSC::getWeakMapData):
+        * tests/es6.yaml:
+        * tests/modules/namespace.js:
+        * tests/stress/symbol-tostringtag.js: Copied from Source/JavaScriptCore/tests/stress/symbol-tostringtag.js.
+
+2015-11-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r191815 and r191821.
+        https://bugs.webkit.org/show_bug.cgi?id=150781
+
+        Seems to have broken JSC API tests on some platforms
+        (Requested by ap on #webkit).
+
+        Reverted changesets:
+
+        "[ES6] Add support for toStringTag"
+        https://bugs.webkit.org/show_bug.cgi?id=150696
+        http://trac.webkit.org/changeset/191815
+
+        "Unreviewed, forgot to mark tests as passing for new feature."
+        http://trac.webkit.org/changeset/191821
+
+2015-11-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r191858.
+        https://bugs.webkit.org/show_bug.cgi?id=150780
+
+        Broke the build (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Rename op_put_getter_setter to op_put_getter_setter_by_id"
+        https://bugs.webkit.org/show_bug.cgi?id=150773
+        http://trac.webkit.org/changeset/191858
+
+2015-11-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add a FIXME referencing https://bugs.webkit.org/show_bug.cgi?id=150777.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptRoot):
+
+2015-11-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add a FIXME referencing https://bugs.webkit.org/show_bug.cgi?id=150775.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tryTrunc):
+
+2015-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Rename op_put_getter_setter to op_put_getter_setter_by_id
+        https://bugs.webkit.org/show_bug.cgi?id=150773
+
+        Reviewed by Mark Lam.
+
+        Renaming op_put_getter_setter to op_put_getter_setter_by_id makes this op name consistent with
+        the other ops' names like op_put_getter_by_id etc.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutGetterSetter):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_getter_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+
+2015-10-31  Andreas Kling  <akling@apple.com>
+
+        Add a debug overlay with information about web process resource usage.
+        <https://webkit.org/b/150599>
+
+        Reviewed by Darin Adler.
+
+        Have Heap track the exact number of bytes allocated in CopiedBlock, MarkedBlock and
+        WeakBlock objects, keeping them in a single location that can be sampled by the
+        resource usage overlay thread.
+
+        The bulk of these changes is threading a Heap& through from sites where blocks are
+        allocated or freed.
+
+        * heap/CopiedBlock.cpp:
+        (JSC::CopiedBlock::createNoZeroFill):
+        (JSC::CopiedBlock::destroy):
+        (JSC::CopiedBlock::create):
+        * heap/CopiedBlock.h:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::~CopiedSpace):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::recycleEvacuatedBlock):
+        (JSC::CopiedSpace::recycleBorrowedBlock):
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        (JSC::CopiedSpace::allocateBlock):
+        (JSC::CopiedSpace::startedCopying):
+        * heap/Heap.cpp:
+        (JSC::Heap::~Heap):
+        (JSC::Heap::sweepNextLogicallyEmptyWeakBlock):
+        * heap/Heap.h:
+        (JSC::Heap::blockBytesAllocated):
+        * heap/HeapInlines.h:
+        (JSC::Heap::didAllocateBlock):
+        (JSC::Heap::didFreeBlock):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::destroy):
+        * heap/WeakBlock.h:
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::~WeakSet):
+        (JSC::WeakSet::addAllocator):
+        (JSC::WeakSet::removeAllocator):
+
+2015-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Air should eliminate dead code
+        https://bugs.webkit.org/show_bug.cgi?id=150746
+
+        Reviewed by Geoffrey Garen.
+
+        This adds a very simple dead code elimination to Air. It simply looks at whether a Tmp or
+        StackSlot has ever been used by a live instruction. An instruction is live if it has non-arg
+        effects (branching, returning, calling, etc) or if it stores to a live Arg. An Arg is live if
+        it references a live Tmp or StackSlot, or if it is neither a Tmp nor a StackSlot. The phase
+        runs these rules to fixpoint, and then removes the dead instructions.
+
+        This also changes the AirOpcodes parser to handle multiple attributes per opcode, so that we
+        could conceivably say things like "FooBar /branch /effects". It also adds the /effects
+        attribute, which we currently use for Breakpoint and nothing else. C calls, patchpoints, and
+        checks are all Specials, and the Special base class by default always claims that the
+        instruction has effects. In the future, we could have B3 use a Patch in Air to implement
+        exotic math constructs; then the Special associated with that thing would claim that there
+        are no effects.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/air/AirBasicBlock.h:
+        (JSC::B3::Air::BasicBlock::begin):
+        (JSC::B3::Air::BasicBlock::end):
+        (JSC::B3::Air::BasicBlock::at):
+        (JSC::B3::Air::BasicBlock::last):
+        (JSC::B3::Air::BasicBlock::resize):
+        (JSC::B3::Air::BasicBlock::appendInst):
+        * b3/air/AirEliminateDeadCode.cpp: Added.
+        (JSC::B3::Air::eliminateDeadCode):
+        * b3/air/AirEliminateDeadCode.h: Added.
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirInst.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirSpecial.cpp:
+        (JSC::B3::Air::Special::name):
+        (JSC::B3::Air::Special::hasNonArgNonControlEffects):
+        (JSC::B3::Air::Special::dump):
+        * b3/air/AirSpecial.h:
+        * b3/air/opcode_generator.rb:
+
+2015-10-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Air needs a late register liveness phase that calls Special::reportUsedRegisters()
+        https://bugs.webkit.org/show_bug.cgi?id=150511
+
+        Reviewed by Saam Barati.
+
+        This change adds such a phase. In the process of writing it, I was reminded about the
+        glaring efficiency bugs in Air::Liveness and so I filed a bug and added FIXMEs.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirReportUsedRegisters.cpp: Added.
+        (JSC::B3::Air::reportUsedRegisters):
+        * b3/air/AirReportUsedRegisters.h: Added.
+
+2015-10-31  Brian Burg  <bburg@apple.com>
+
+        Builtins generator should put WebCore-only wrappers in the per-builtin header
+        https://bugs.webkit.org/show_bug.cgi?id=150539
+
+        Reviewed by Youenn Fablet.
+
+        If generating for WebCore, put the XXXWrapper and related boilerplate
+        in the per-builtin header instead of making a separate XXXWrapper.h.
+
+        Rebaseline the tests.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * Scripts/builtins/builtins.py:
+        * Scripts/builtins/builtins_generate_separate_header.py:
+        (BuiltinsSeparateHeaderGenerator.generate_output):
+        (generate_header_includes):
+        * Scripts/builtins/builtins_generate_separate_wrapper.py: Deleted.
+        * Scripts/builtins/builtins_templates.py: Be consistent with variables.
+        * Scripts/generate-js-builtins.py:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+
+2015-10-31  Saam barati  <sbarati@apple.com>
+
+        JSC should have a forceGCSlowPaths option
+        https://bugs.webkit.org/show_bug.cgi?id=150744
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements the forceGCSlowPaths option.
+        It defaults to false, but when it is set to true,
+        the JITs will always allocate objects along the slow
+        path. This will be helpful for writing a certain class
+        of tests. This may also come in handy for debugging
+        later.
+
+        This patch also adds the "forceGCSlowPaths" function
+        in jsc.cpp which sets the option to true. If you
+        use this function in a jsc stress test, it's best
+        to call it as the first thing in the program before
+        we JIT anything.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitAllocateJSObject):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionEdenGC):
+        (functionForceGCSlowPaths):
+        (functionHeapSize):
+        * runtime/Options.h:
+
+2015-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Test Debugger.scriptParsed events received after opening inspector frontend
+        https://bugs.webkit.org/show_bug.cgi?id=150753
+
+        Reviewed by Timothy Hatcher.
+
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        Only set the directives on the SourceProvider if we were parsing the
+        entire file (Program or Module), not if we are in function parsing mode.
+        This was inadvertently clearing the directives stored on the
+        SourceProvider when the function parse didn't see directives and reset
+        the values on the source provider.
+
+2015-10-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add lowering for B3's Sub operation with integers
+        https://bugs.webkit.org/show_bug.cgi?id=150749
+
+        Reviewed by Filip Pizlo.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::trySub):
+        (JSC::B3::Air::LowerToAir::tryStoreSubLoad):
+        * b3/B3LoweringMatcher.patterns:
+        Identical to Add but obviously NotCommutative.
+
+        * b3/B3ReduceStrength.cpp:
+        Turn Add/Sub with zero into an identity. I only added for
+        Add since Sub with a constant is always turned into an Add.
+
+        Also switched the Sub optimizations to put the strongest first.
+
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testAddArgImm):
+        (JSC::B3::testAddImmArg):
+        (JSC::B3::testSubArgs):
+        (JSC::B3::testSubArgImm):
+        (JSC::B3::testSubImmArg):
+        (JSC::B3::testSubArgs32):
+        (JSC::B3::testSubArgImm32):
+        (JSC::B3::testSubImmArg32):
+        (JSC::B3::testStoreSubLoad):
+        (JSC::B3::run):
+
+2015-10-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add the Air Opcode definitions to the Xcode project file
+        https://bugs.webkit.org/show_bug.cgi?id=150701
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Easier for those who use Xcode :)
+
+2015-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, removing FIXME referencing https://bugs.webkit.org/show_bug.cgi?id=150540.
+
+        * b3/B3ValueRep.h:
+
+2015-10-30  Michael Saboff  <msaboff@apple.com>
+
+        Windows X86-64 change for Crash making a tail call from a getter to a host function
+        https://bugs.webkit.org/show_bug.cgi?id=150737
+
+        Reviewed by Geoffrey Garen.
+
+        Need to make the same change for Windows X86-64 as was made in change set
+        http://trac.webkit.org/changeset/191765.
+
+        * jit/JITStubsMSVC64.asm:
+
+2015-10-30  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, forgot to mark tests as passing for new feature.
+
+        * tests/es6.yaml:
+
+2015-10-30  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile a control flow diamond
+        https://bugs.webkit.org/show_bug.cgi?id=150720
+
+        Reviewed by Benjamin Poulain.
+
+        Adds support for Branch, Jump, Upsilon, and Phi. Adds some basic strength reduction for
+        comparisons and boolean-like operations.
+
+        * assembler/MacroAssembler.cpp:
+        (WTF::printInternal):
+        * assembler/MacroAssembler.h:
+        * b3/B3BasicBlockUtils.h:
+        (JSC::B3::replacePredecessor):
+        (JSC::B3::resetReachability):
+        * b3/B3CheckValue.h:
+        * b3/B3Common.h:
+        (JSC::B3::isRepresentableAsImpl):
+        (JSC::B3::isRepresentableAs):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::subConstant):
+        (JSC::B3::Const32Value::equalConstant):
+        (JSC::B3::Const32Value::notEqualConstant):
+        (JSC::B3::Const32Value::dumpMeta):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::subConstant):
+        (JSC::B3::Const64Value::equalConstant):
+        (JSC::B3::Const64Value::notEqualConstant):
+        (JSC::B3::Const64Value::dumpMeta):
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::subConstant):
+        (JSC::B3::ConstDoubleValue::equalConstant):
+        (JSC::B3::ConstDoubleValue::notEqualConstant):
+        (JSC::B3::ConstDoubleValue::dumpMeta):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ControlValue.cpp:
+        (JSC::B3::ControlValue::~ControlValue):
+        (JSC::B3::ControlValue::convertToJump):
+        (JSC::B3::ControlValue::dumpMeta):
+        * b3/B3ControlValue.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::tryStackSlot):
+        (JSC::B3::Air::LowerToAir::tryUpsilon):
+        (JSC::B3::Air::LowerToAir::tryPhi):
+        (JSC::B3::Air::LowerToAir::tryBranch):
+        (JSC::B3::Air::LowerToAir::tryJump):
+        (JSC::B3::Air::LowerToAir::tryIdentity):
+        * b3/B3LoweringMatcher.patterns:
+        * b3/B3Opcode.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::resetReachability):
+        (JSC::B3::Procedure::dump):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3UpsilonValue.cpp:
+        (JSC::B3::UpsilonValue::dumpMeta):
+        * b3/B3UpsilonValue.h:
+        (JSC::B3::UpsilonValue::accepts): Deleted.
+        (JSC::B3::UpsilonValue::phi): Deleted.
+        (JSC::B3::UpsilonValue::UpsilonValue): Deleted.
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::subConstant):
+        (JSC::B3::Value::equalConstant):
+        (JSC::B3::Value::notEqualConstant):
+        (JSC::B3::Value::returnsBool):
+        (JSC::B3::Value::asTriState):
+        (JSC::B3::Value::effects):
+        * b3/B3Value.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::asInt32):
+        (JSC::B3::Value::isInt32):
+        (JSC::B3::Value::hasInt64):
+        (JSC::B3::Value::asInt64):
+        (JSC::B3::Value::isInt64):
+        (JSC::B3::Value::hasInt):
+        (JSC::B3::Value::asIntPtr):
+        (JSC::B3::Value::isIntPtr):
+        (JSC::B3::Value::hasDouble):
+        (JSC::B3::Value::asDouble):
+        (JSC::B3::Value::isEqualToDouble):
+        (JSC::B3::Value::hasNumber):
+        (JSC::B3::Value::representableAs):
+        (JSC::B3::Value::asNumber):
+        (JSC::B3::Value::stackmap):
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::dump):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::resCond):
+        (JSC::B3::Air::Arg::doubleCond):
+        (JSC::B3::Air::Arg::special):
+        (JSC::B3::Air::Arg::isResCond):
+        (JSC::B3::Air::Arg::isDoubleCond):
+        (JSC::B3::Air::Arg::isSpecial):
+        (JSC::B3::Air::Arg::isGP):
+        (JSC::B3::Air::Arg::isFP):
+        (JSC::B3::Air::Arg::asResultCondition):
+        (JSC::B3::Air::Arg::asDoubleCondition):
+        (JSC::B3::Air::Arg::Arg):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::resetReachability):
+        (JSC::B3::Air::Code::dump):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (hiddenTruthBecauseNoReturnIsStupid):
+        (usage):
+        (JSC::B3::compile):
+        (JSC::B3::invoke):
+        (JSC::B3::compileAndRun):
+        (JSC::B3::test42):
+        (JSC::B3::testStoreLoadStackSlot):
+        (JSC::B3::testBranch):
+        (JSC::B3::testDiamond):
+        (JSC::B3::testBranchNotEqual):
+        (JSC::B3::testBranchFold):
+        (JSC::B3::testDiamondFold):
+        (JSC::B3::run):
+        (run):
+        (main):
+
+2015-10-30  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add support for toStringTag
+        https://bugs.webkit.org/show_bug.cgi?id=150696
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds support for Symbol.toStringTag. This is a simple
+        feature, if an object passed to Object.prototype.toString() has a
+        toStringTag we use the tag in the string rather than the class info.
+        Added a test that checks this works for all the default supported classes
+        along with the corresponding prototype and custom cases.
+
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::JSArrayBufferPrototype::finishCreation):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::finishCreation):
+        * runtime/JSDataViewPrototype.h:
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::finishCreation):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONObject::finishCreation):
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::finishCreation):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewProtoGetterFuncToStringTag):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototype::finishCreation):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototype::finishCreation):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::initializeCommonStrings):
+        (JSC::SmallStrings::visitStrongReferences):
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::objectStringStart):
+        * runtime/StringIteratorPrototype.cpp:
+        (JSC::StringIteratorPrototype::finishCreation):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::SymbolPrototype::finishCreation):
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::WeakMapPrototype::finishCreation):
+        * runtime/WeakSetPrototype.cpp:
+        (JSC::WeakSetPrototype::finishCreation):
+        * tests/modules/namespace.js:
+        * tests/stress/symbol-tostringtag.js: Added.
+        (toStr):
+        (strName):
+        (classes.string_appeared_here):
+
+2015-10-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Do not show JavaScriptCore builtins in inspector
+        https://bugs.webkit.org/show_bug.cgi?id=146049
+
+        Reviewed by Geoffrey Garen.
+
+        * debugger/Debugger.cpp:
+        When gathering scripts to notify the inspector / debuggers about
+        skip over sources containing host / built-in functions as those
+        for those won't contain source code developers expect to see.
+
+2015-10-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix typo in "use strict" in TypedArray builtins
+        https://bugs.webkit.org/show_bug.cgi?id=150709
+
+        Reviewed by Geoffrey Garen.
+
+        * builtins/TypedArray.prototype.js:
+        (toLocaleString):
+
+2015-10-29  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK][Mac] disable OBJC JSC API
+        https://bugs.webkit.org/show_bug.cgi?id=150500
+
+        Reviewed by Alex Christensen.
+
+        * API/JSBase.h: Disable the Objective-C API on Mac for the GTK port.
+
+2015-10-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Air::handleCalleeSaves shouldn't save/restore the frame pointer
+        https://bugs.webkit.org/show_bug.cgi?id=150688
+
+        Reviewed by Michael Saboff.
+
+        We save/restore the FP inside Air::generate().
+
+        * b3/air/AirHandleCalleeSaves.cpp:
+        (JSC::B3::Air::handleCalleeSaves):
+
+2015-10-29  Michael Saboff  <msaboff@apple.com>
+
+        Crash making a tail call from a getter to a host function
+        https://bugs.webkit.org/show_bug.cgi?id=150663
+
+        Reviewed by Geoffrey Garen.
+
+        Change the inline assembly versions of getHostCallReturnValue() to pass the location of the callee
+        call frame to getHostCallReturnValueWithExecState().  We were passing the caller's frame address.
+
+        * jit/JITOperations.cpp:
+
+2015-10-29  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::LowerToAir::imm() should work for both 32-bit and 64-bit immediates
+        https://bugs.webkit.org/show_bug.cgi?id=150685
+
+        Reviewed by Geoffrey Garen.
+
+        In B3, a constant must match the type of its use. In Air, immediates don't have type, they
+        only have representation. A 32-bit immediate (i.e. Arg::imm) can be used either for 32-bit
+        operations or for 64-bit operations. The only difference from a Arg::imm64 is that it
+        requires fewer bits.
+
+        In the B3->Air lowering, we have a lot of code that is effectively polymorphic over integer
+        type. That code should still be able to use Arg::imm, and it should work even for 64-bit
+        immediates - so long as they are representable as 32-bit immediates. Therefore, the imm()
+        helper should happily accept either Const32Value or Const64Value.
+
+        We already sort of had this with immAnyType(), but it just turns out that anyone using
+        immAnyType() should really be using imm().
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::tryStore):
+        (JSC::B3::Air::LowerToAir::tryConst64):
+        (JSC::B3::Air::LowerToAir::immAnyInt): Deleted.
+        * b3/testb3.cpp:
+        (JSC::B3::testAdd1):
+        (JSC::B3::testAdd1Ptr):
+        (JSC::B3::testStoreAddLoad):
+        (JSC::B3::run):
+
+2015-10-29  Filip Pizlo  <fpizlo@apple.com>
+
+        StoreOpLoad pattern matching should check effects between the Store and Load
+        https://bugs.webkit.org/show_bug.cgi?id=150534
+
+        Reviewed by Geoffrey Garen.
+
+        If we turn:
+
+            a = Load(addr)
+            b = Add(a, 42)
+            Store(b, addr)
+
+        Into:
+
+            Add $42, (addr)
+
+        Then we must make sure that we didn't really have this to begin with:
+
+            a = Load(addr)
+            Store(666, addr)
+            b = Add(a, 42)
+            Store(b, addr)
+
+        That's because pattern matching doesn't care about control flow, and it finds the Load
+        just using data flow. This patch fleshes out B3's aliasing analysis, and makes it powerful
+        enough to broadly ask questions about whether such a code motion of the Load is legal.
+
+        * b3/B3Effects.cpp:
+        (JSC::B3::Effects::interferes):
+        (JSC::B3::Effects::dump):
+        * b3/B3Effects.h:
+        (JSC::B3::Effects::mustExecute):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::commitInternal):
+        (JSC::B3::Air::LowerToAir::crossesInterference):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::loadAddr):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::resetValueOwners):
+        (JSC::B3::Procedure::resetReachability):
+        * b3/B3Procedure.h:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        * b3/B3Value.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testStoreAddLoad):
+        (JSC::B3::testStoreAddLoadInterference):
+        (JSC::B3::testStoreAddAndLoad):
+        (JSC::B3::testLoadOffsetUsingAdd):
+        (JSC::B3::testLoadOffsetUsingAddInterference):
+        (JSC::B3::testLoadOffsetUsingAddNotConstant):
+        (JSC::B3::run):
+
+2015-10-29  Brady Eidson  <beidson@apple.com>
+
+        Modern IDB: deleteObjectStore support.
+        https://bugs.webkit.org/show_bug.cgi?id=150673
+
+        Reviewed by Alex Christensen.
+
+        * runtime/VM.h:
+
+2015-10-29  Mark Lam  <mark.lam@apple.com>
+
+        cdjs-tests.yaml/main.js.ftl fails due to FTL ArithSub code for supporting UntypedUse operands.
+        https://bugs.webkit.org/show_bug.cgi?id=150687
+
+        Unreviewed.
+
+        Disabling the feature while it is being debugged.  I'm doing this by effectively
+        rolling out only the changes in FTLCapabilities.cpp.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+
+2015-10-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix iOS build.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::store64):
+
+2015-10-29  Alex Christensen  <achristensen@webkit.org>
+
+        Fix Mac CMake build
+        https://bugs.webkit.org/show_bug.cgi?id=150686
+
+        Reviewed by Filip Pizlo.
+
+        * API/ObjCCallbackFunction.mm:
+        * CMakeLists.txt:
+        * PlatformMac.cmake:
+
+2015-10-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Air needs syntax for escaping StackSlots
+        https://bugs.webkit.org/show_bug.cgi?id=150430
+
+        Reviewed by Geoffrey Garen.
+
+        This adds lowering for FramePointer and StackSlot, and to enable this, it adds the Lea
+        instruction for getting the value of an address. This is necessary to support arbitrary
+        lowerings of StackSlot, since the only way to get the "value" of a StackSlot in Air is with
+        this new instruction.
+
+        Lea uses a new Role, called UseAddr. This describes exactly what the Intel-style LEA opcode
+        would do: it evaluates an address, but does not load from it or store to it.
+
+        Lea is also the only way to escape a StackSlot. Well, more accurately, UseAddr is the only
+        way to escape and UseAddr is only used by Lea. The stack allocation phase now understands
+        that StackSlots may escape, and factors this into its analysis.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::lea):
+        * b3/B3AddressMatcher.patterns:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::addr):
+        (JSC::B3::Air::LowerToAir::loadAddr):
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryAdd):
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryFramePointer):
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryStackSlot):
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryDirect):
+        (JSC::B3::Air::LowerToAir::tryConst64):
+        (JSC::B3::Air::LowerToAir::tryFramePointer):
+        (JSC::B3::Air::LowerToAir::tryStackSlot):
+        (JSC::B3::Air::LowerToAir::tryIdentity):
+        * b3/B3LoweringMatcher.patterns:
+        * b3/B3MemoryValue.cpp:
+        (JSC::B3::MemoryValue::~MemoryValue):
+        (JSC::B3::MemoryValue::accessByteSize):
+        (JSC::B3::MemoryValue::dumpMeta):
+        * b3/B3MemoryValue.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3StackSlotValue.h:
+        (JSC::B3::StackSlotValue::accepts): Deleted.
+        * b3/B3Type.h:
+        (JSC::B3::pointerType):
+        (JSC::B3::sizeofType):
+        * b3/B3Validate.cpp:
+        * b3/B3Value.h:
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isUse):
+        (JSC::B3::Air::Arg::isDef):
+        (JSC::B3::Air::Arg::forEachTmp):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::addStackSlot):
+        (JSC::B3::Air::Code::addSpecial):
+        * b3/air/AirCode.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/air/AirStackSlot.h:
+        (JSC::B3::Air::StackSlot::byteSize):
+        (JSC::B3::Air::StackSlot::kind):
+        (JSC::B3::Air::StackSlot::isLocked):
+        (JSC::B3::Air::StackSlot::index):
+        (JSC::B3::Air::StackSlot::alignment):
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (JSC::B3::testLoadOffsetUsingAddNotConstant):
+        (JSC::B3::testFramePointer):
+        (JSC::B3::testStackSlot):
+        (JSC::B3::testLoadFromFramePointer):
+        (JSC::B3::testStoreLoadStackSlot):
+        (JSC::B3::run):
+
+2015-10-29  Saam barati  <sbarati@apple.com>
+
+        we're incorrectly adjusting a stack location with respect to the localsOffset in FTLCompile
+        https://bugs.webkit.org/show_bug.cgi?id=150655
+
+        Reviewed by Filip Pizlo.
+
+        We're recomputing this value for an *OSRExitDescriptor* for every one
+        of its corresponding *OSRExits*. This is having a multiplicative
+        effect on offsets because each computation is relative to the previous
+        value. We must do this computation just once per OSRExitDescriptor.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+
+2015-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Air::spillEverything() should try to replace tmps with spill slots without using registers whenever possible
+        https://bugs.webkit.org/show_bug.cgi?id=150657
+
+        Reviewed by Geoffrey Garen.
+
+        Also added the ability to store an immediate to memory.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::store64):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::store64):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::immAnyInt):
+        (JSC::B3::Air::LowerToAir::immOrTmp):
+        (JSC::B3::Air::LowerToAir::tryStore):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/testb3.cpp:
+        (JSC::B3::testStore):
+        (JSC::B3::testStoreConstant):
+        (JSC::B3::testStoreConstantPtr):
+        (JSC::B3::testTrunc):
+        (JSC::B3::run):
+
+2015-10-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Rename InspectorResourceAgent to InspectorNetworkAgent
+        https://bugs.webkit.org/show_bug.cgi?id=150654
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/scripts/codegen/generator.py:
+
+2015-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::reduceStrength() should do DCE
+        https://bugs.webkit.org/show_bug.cgi?id=150656
+
+        Reviewed by Saam Barati.
+
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::removeNops): This now deletes the values from the procedure, to preserve the invariant that valuesInProc == valuesInBlocks.
+        * b3/B3BasicBlock.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::deleteValue): Add a utility used by removeNops().
+        (JSC::B3::Procedure::addValueIndex): Make sure that we reuse Value indices so that m_values doesn't get too sparse.
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::ValuesCollection::iterator::iterator): Teach this that m_values can be slightly sparse.
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator++):
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator!=):
+        (JSC::B3::Procedure::ValuesCollection::iterator::findNext):
+        (JSC::B3::Procedure::values):
+        * b3/B3ProcedureInlines.h:
+        (JSC::B3::Procedure::add): Use addValueIndex() instead of always creating a new index.
+        * b3/B3ReduceStrength.cpp: Implement the optimization using UseCounts and Effects.
+
+2015-10-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused / duplicate WebSocket timeline records
+        https://bugs.webkit.org/show_bug.cgi?id=150647
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+
+2015-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::LowerToAir should not duplicate Loads
+        https://bugs.webkit.org/show_bug.cgi?id=150651
+
+        Reviewed by Benjamin Poulain.
+
+        The instruction selector may decide to fuse two Values into one. This ordinarily only happens
+        if we haven't already emitted code that uses the Value and the Value has only one direct
+        user. Once we have emitted such code, we ensure that everyone knows that we have "locked" the
+        Value: we won't emit any more code for it in the future.
+
+        The optimization to fuse Loads was forgetting to do all of these things, and so generated
+        code would have a lot of duplicated Loads. That's bad and this change fixes that.
+
+        Ordinarily, this is far less tricky because the pattern matcher does this for us via
+        acceptInternals() and acceptInternalsLate(). I added a comment to this effect. I hope that we
+        won't need to do this manually very often.
+
+        Also found an uninitialized value bug in UseCounts. That was making all of this super hard to
+        debug.
+
+        * b3/B3IndexMap.h:
+        (JSC::B3::IndexMap::IndexMap):
+        (JSC::B3::IndexMap::resize):
+        (JSC::B3::IndexMap::operator[]):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tmp):
+        (JSC::B3::Air::LowerToAir::canBeInternal):
+        (JSC::B3::Air::LowerToAir::commitInternal):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::loadAddr):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::acceptInternals):
+        * b3/B3UseCounts.cpp:
+        (JSC::B3::UseCounts::UseCounts):
+
+2015-10-28  Mark Lam  <mark.lam@apple.com>
+
+        JITSubGenerator::generateFastPath() does not need to be inlined.
+        https://bugs.webkit.org/show_bug.cgi?id=150645
+
+        Reviewed by Geoffrey Garen.
+
+        Moving it to a .cpp file to reduce code size.  Benchmarks shows this to be
+        perf neutral.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLCompile.cpp:
+        * jit/JITSubGenerator.cpp: Added.
+        (JSC::JITSubGenerator::generateFastPath):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::JITSubGenerator):
+        (JSC::JITSubGenerator::endJumpList):
+        (JSC::JITSubGenerator::slowPathJumpList):
+        (JSC::JITSubGenerator::generateFastPath): Deleted.
+
+2015-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        [B3] handleCommutativity should canonicalize commutative operations over non-constants
+        https://bugs.webkit.org/show_bug.cgi?id=150649
+
+        Reviewed by Saam Barati.
+
+        Turn this: Add(value1, value2)
+        Into this: Add(value2, value1)
+
+        But ony if value2 should come before value1 according to our total ordering. This will allow
+        CSE to observe the equality between commuted versions of the same operation, since we will
+        first canonicalize them into the same order.
+
+        * b3/B3ReduceStrength.cpp:
+
+2015-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix the build for case sensitive file systems.
+
+        * b3/air/AirBasicBlock.h:
+        * b3/air/AirStackSlot.h:
+
+2015-10-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Create a super rough prototype of B3
+        https://bugs.webkit.org/show_bug.cgi?id=150280
+
+        Reviewed by Benjamin Poulain.
+
+        This changeset adds the basic scaffolding of the B3 compiler. B3 stands for Bare Bones
+        Backend. It's a low-level SSA-based language-agnostic compiler. The basic structure allows
+        for aggressive C-level optimizations and an awesome portable backend. The backend, called
+        Air (Assembly IR), is a reflective abstraction over our MacroAssembler. The abstraction is
+        defined using a spec file (AirOpcode.opcodes) which describes the various kinds of
+        instructions that we wish to support. Then, the B3::LowerToAir phase, which does our
+        instruction selection, reflectively selects Air opcodes by querying which instruction forms
+        are possible. Air allows for optimal register allocation and stack layout. Currently the
+        register allocator isn't written, but the stack layout is.
+
+        Of course this isn't done yet. It can only compile simple programs, seen in the "test suite"
+        called "testb3.cpp". There's a lot of optimizations that have to be written and a lot of
+        stuff added to the instruction selector. But it's a neat start.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.cpp:
+        (WTF::printInternal):
+        * assembler/MacroAssembler.h:
+        * b3: Added.
+        * b3/B3AddressMatcher.patterns: Added.
+        * b3/B3ArgumentRegValue.cpp: Added.
+        (JSC::B3::ArgumentRegValue::~ArgumentRegValue):
+        (JSC::B3::ArgumentRegValue::dumpMeta):
+        * b3/B3ArgumentRegValue.h: Added.
+        * b3/B3BasicBlock.cpp: Added.
+        (JSC::B3::BasicBlock::BasicBlock):
+        (JSC::B3::BasicBlock::~BasicBlock):
+        (JSC::B3::BasicBlock::append):
+        (JSC::B3::BasicBlock::addPredecessor):
+        (JSC::B3::BasicBlock::removePredecessor):
+        (JSC::B3::BasicBlock::replacePredecessor):
+        (JSC::B3::BasicBlock::removeNops):
+        (JSC::B3::BasicBlock::dump):
+        (JSC::B3::BasicBlock::deepDump):
+        * b3/B3BasicBlock.h: Added.
+        (JSC::B3::BasicBlock::index):
+        (JSC::B3::BasicBlock::begin):
+        (JSC::B3::BasicBlock::end):
+        (JSC::B3::BasicBlock::size):
+        (JSC::B3::BasicBlock::at):
+        (JSC::B3::BasicBlock::last):
+        (JSC::B3::BasicBlock::values):
+        (JSC::B3::BasicBlock::numPredecessors):
+        (JSC::B3::BasicBlock::predecessor):
+        (JSC::B3::BasicBlock::predecessors):
+        (JSC::B3::BasicBlock::frequency):
+        (JSC::B3::DeepBasicBlockDump::DeepBasicBlockDump):
+        (JSC::B3::DeepBasicBlockDump::dump):
+        (JSC::B3::deepDump):
+        * b3/B3BasicBlockInlines.h: Added.
+        (JSC::B3::BasicBlock::appendNew):
+        (JSC::B3::BasicBlock::numSuccessors):
+        (JSC::B3::BasicBlock::successor):
+        (JSC::B3::BasicBlock::successors):
+        (JSC::B3::BasicBlock::successorBlock):
+        (JSC::B3::BasicBlock::successorBlocks):
+        * b3/B3BasicBlockUtils.h: Added.
+        (JSC::B3::addPredecessor):
+        (JSC::B3::removePredecessor):
+        (JSC::B3::replacePredecessor):
+        (JSC::B3::resetReachability):
+        (JSC::B3::blocksInPreOrder):
+        (JSC::B3::blocksInPostOrder):
+        * b3/B3BlockWorklist.h: Added.
+        * b3/B3CheckSpecial.cpp: Added.
+        (JSC::B3::Air::numB3Args):
+        (JSC::B3::CheckSpecial::CheckSpecial):
+        (JSC::B3::CheckSpecial::~CheckSpecial):
+        (JSC::B3::CheckSpecial::hiddenBranch):
+        (JSC::B3::CheckSpecial::forEachArg):
+        (JSC::B3::CheckSpecial::isValid):
+        (JSC::B3::CheckSpecial::admitsStack):
+        (JSC::B3::CheckSpecial::generate):
+        (JSC::B3::CheckSpecial::dumpImpl):
+        (JSC::B3::CheckSpecial::deepDumpImpl):
+        * b3/B3CheckSpecial.h: Added.
+        * b3/B3CheckValue.cpp: Added.
+        (JSC::B3::CheckValue::~CheckValue):
+        (JSC::B3::CheckValue::dumpMeta):
+        * b3/B3CheckValue.h: Added.
+        * b3/B3Common.cpp: Added.
+        (JSC::B3::shouldDumpIR):
+        (JSC::B3::shouldDumpIRAtEachPhase):
+        (JSC::B3::shouldValidateIR):
+        (JSC::B3::shouldValidateIRAtEachPhase):
+        (JSC::B3::shouldSaveIRBeforePhase):
+        * b3/B3Common.h: Added.
+        (JSC::B3::is64Bit):
+        (JSC::B3::is32Bit):
+        * b3/B3Commutativity.cpp: Added.
+        (WTF::printInternal):
+        * b3/B3Commutativity.h: Added.
+        * b3/B3Const32Value.cpp: Added.
+        (JSC::B3::Const32Value::~Const32Value):
+        (JSC::B3::Const32Value::negConstant):
+        (JSC::B3::Const32Value::addConstant):
+        (JSC::B3::Const32Value::subConstant):
+        (JSC::B3::Const32Value::dumpMeta):
+        * b3/B3Const32Value.h: Added.
+        * b3/B3Const64Value.cpp: Added.
+        (JSC::B3::Const64Value::~Const64Value):
+        (JSC::B3::Const64Value::negConstant):
+        (JSC::B3::Const64Value::addConstant):
+        (JSC::B3::Const64Value::subConstant):
+        (JSC::B3::Const64Value::dumpMeta):
+        * b3/B3Const64Value.h: Added.
+        * b3/B3ConstDoubleValue.cpp: Added.
+        (JSC::B3::ConstDoubleValue::~ConstDoubleValue):
+        (JSC::B3::ConstDoubleValue::negConstant):
+        (JSC::B3::ConstDoubleValue::addConstant):
+        (JSC::B3::ConstDoubleValue::subConstant):
+        (JSC::B3::ConstDoubleValue::dumpMeta):
+        * b3/B3ConstDoubleValue.h: Added.
+        (JSC::B3::ConstDoubleValue::accepts):
+        (JSC::B3::ConstDoubleValue::value):
+        (JSC::B3::ConstDoubleValue::ConstDoubleValue):
+        * b3/B3ConstPtrValue.h: Added.
+        (JSC::B3::ConstPtrValue::value):
+        (JSC::B3::ConstPtrValue::ConstPtrValue):
+        * b3/B3ControlValue.cpp: Added.
+        (JSC::B3::ControlValue::~ControlValue):
+        (JSC::B3::ControlValue::dumpMeta):
+        * b3/B3ControlValue.h: Added.
+        * b3/B3Effects.cpp: Added.
+        (JSC::B3::Effects::dump):
+        * b3/B3Effects.h: Added.
+        (JSC::B3::Effects::mustExecute):
+        * b3/B3FrequencyClass.cpp: Added.
+        (WTF::printInternal):
+        * b3/B3FrequencyClass.h: Added.
+        * b3/B3FrequentedBlock.h: Added.
+        * b3/B3Generate.cpp: Added.
+        (JSC::B3::generate):
+        (JSC::B3::generateToAir):
+        * b3/B3Generate.h: Added.
+        * b3/B3GenericFrequentedBlock.h: Added.
+        (JSC::B3::GenericFrequentedBlock::GenericFrequentedBlock):
+        (JSC::B3::GenericFrequentedBlock::operator==):
+        (JSC::B3::GenericFrequentedBlock::operator!=):
+        (JSC::B3::GenericFrequentedBlock::operator bool):
+        (JSC::B3::GenericFrequentedBlock::block):
+        (JSC::B3::GenericFrequentedBlock::frequency):
+        (JSC::B3::GenericFrequentedBlock::dump):
+        * b3/B3HeapRange.cpp: Added.
+        (JSC::B3::HeapRange::dump):
+        * b3/B3HeapRange.h: Added.
+        (JSC::B3::HeapRange::HeapRange):
+        (JSC::B3::HeapRange::top):
+        (JSC::B3::HeapRange::operator==):
+        (JSC::B3::HeapRange::operator!=):
+        (JSC::B3::HeapRange::operator bool):
+        (JSC::B3::HeapRange::begin):
+        (JSC::B3::HeapRange::end):
+        (JSC::B3::HeapRange::overlaps):
+        * b3/B3IndexMap.h: Added.
+        (JSC::B3::IndexMap::IndexMap):
+        (JSC::B3::IndexMap::resize):
+        (JSC::B3::IndexMap::operator[]):
+        * b3/B3IndexSet.h: Added.
+        (JSC::B3::IndexSet::IndexSet):
+        (JSC::B3::IndexSet::add):
+        (JSC::B3::IndexSet::contains):
+        (JSC::B3::IndexSet::Iterable::Iterable):
+        (JSC::B3::IndexSet::Iterable::iterator::iterator):
+        (JSC::B3::IndexSet::Iterable::iterator::operator*):
+        (JSC::B3::IndexSet::Iterable::iterator::operator++):
+        (JSC::B3::IndexSet::Iterable::iterator::operator==):
+        (JSC::B3::IndexSet::Iterable::iterator::operator!=):
+        (JSC::B3::IndexSet::Iterable::begin):
+        (JSC::B3::IndexSet::Iterable::end):
+        (JSC::B3::IndexSet::values):
+        (JSC::B3::IndexSet::indices):
+        (JSC::B3::IndexSet::dump):
+        * b3/B3InsertionSet.cpp: Added.
+        (JSC::B3::InsertionSet::execute):
+        * b3/B3InsertionSet.h: Added.
+        (JSC::B3::InsertionSet::InsertionSet):
+        (JSC::B3::InsertionSet::code):
+        (JSC::B3::InsertionSet::appendInsertion):
+        (JSC::B3::InsertionSet::insertValue):
+        * b3/B3InsertionSetInlines.h: Added.
+        (JSC::B3::InsertionSet::insert):
+        * b3/B3LowerToAir.cpp: Added.
+        (JSC::B3::Air::LowerToAir::LowerToAir):
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::tmp):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::addr):
+        (JSC::B3::Air::LowerToAir::loadAddr):
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::immOrTmp):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::moveForType):
+        (JSC::B3::Air::LowerToAir::relaxedMoveForType):
+        (JSC::B3::Air::LowerToAir::append):
+        (JSC::B3::Air::LowerToAir::AddressSelector::AddressSelector):
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptRoot):
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptRootLate):
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptInternals):
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptInternalsLate):
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptOperands):
+        (JSC::B3::Air::LowerToAir::AddressSelector::acceptOperandsLate):
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryAddShift1):
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryAddShift2):
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryAdd):
+        (JSC::B3::Air::LowerToAir::AddressSelector::tryDirect):
+        (JSC::B3::Air::LowerToAir::acceptRoot):
+        (JSC::B3::Air::LowerToAir::acceptRootLate):
+        (JSC::B3::Air::LowerToAir::acceptInternals):
+        (JSC::B3::Air::LowerToAir::acceptInternalsLate):
+        (JSC::B3::Air::LowerToAir::acceptOperands):
+        (JSC::B3::Air::LowerToAir::acceptOperandsLate):
+        (JSC::B3::Air::LowerToAir::tryLoad):
+        (JSC::B3::Air::LowerToAir::tryAdd):
+        (JSC::B3::Air::LowerToAir::tryAnd):
+        (JSC::B3::Air::LowerToAir::tryStoreAddLoad):
+        (JSC::B3::Air::LowerToAir::tryStoreAndLoad):
+        (JSC::B3::Air::LowerToAir::tryStore):
+        (JSC::B3::Air::LowerToAir::tryTruncArgumentReg):
+        (JSC::B3::Air::LowerToAir::tryTrunc):
+        (JSC::B3::Air::LowerToAir::tryArgumentReg):
+        (JSC::B3::Air::LowerToAir::tryConst32):
+        (JSC::B3::Air::LowerToAir::tryConst64):
+        (JSC::B3::Air::LowerToAir::tryIdentity):
+        (JSC::B3::Air::LowerToAir::tryReturn):
+        (JSC::B3::lowerToAir):
+        * b3/B3LowerToAir.h: Added.
+        * b3/B3LoweringMatcher.patterns: Added.
+        * b3/B3MemoryValue.cpp: Added.
+        (JSC::B3::MemoryValue::~MemoryValue):
+        (JSC::B3::MemoryValue::dumpMeta):
+        * b3/B3MemoryValue.h: Added.
+        * b3/B3Opcode.cpp: Added.
+        (WTF::printInternal):
+        * b3/B3Opcode.h: Added.
+        (JSC::B3::isCheckMath):
+        * b3/B3Origin.cpp: Added.
+        (JSC::B3::Origin::dump):
+        * b3/B3Origin.h: Added.
+        (JSC::B3::Origin::Origin):
+        (JSC::B3::Origin::operator bool):
+        (JSC::B3::Origin::data):
+        * b3/B3PatchpointSpecial.cpp: Added.
+        (JSC::B3::PatchpointSpecial::PatchpointSpecial):
+        (JSC::B3::PatchpointSpecial::~PatchpointSpecial):
+        (JSC::B3::PatchpointSpecial::forEachArg):
+        (JSC::B3::PatchpointSpecial::isValid):
+        (JSC::B3::PatchpointSpecial::admitsStack):
+        (JSC::B3::PatchpointSpecial::generate):
+        (JSC::B3::PatchpointSpecial::dumpImpl):
+        (JSC::B3::PatchpointSpecial::deepDumpImpl):
+        * b3/B3PatchpointSpecial.h: Added.
+        * b3/B3PatchpointValue.cpp: Added.
+        (JSC::B3::PatchpointValue::~PatchpointValue):
+        (JSC::B3::PatchpointValue::dumpMeta):
+        * b3/B3PatchpointValue.h: Added.
+        (JSC::B3::PatchpointValue::accepts):
+        (JSC::B3::PatchpointValue::PatchpointValue):
+        * b3/B3PhaseScope.cpp: Added.
+        (JSC::B3::PhaseScope::PhaseScope):
+        (JSC::B3::PhaseScope::~PhaseScope):
+        * b3/B3PhaseScope.h: Added.
+        * b3/B3Procedure.cpp: Added.
+        (JSC::B3::Procedure::Procedure):
+        (JSC::B3::Procedure::~Procedure):
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::resetReachability):
+        (JSC::B3::Procedure::dump):
+        (JSC::B3::Procedure::blocksInPreOrder):
+        (JSC::B3::Procedure::blocksInPostOrder):
+        * b3/B3Procedure.h: Added.
+        (JSC::B3::Procedure::size):
+        (JSC::B3::Procedure::at):
+        (JSC::B3::Procedure::operator[]):
+        (JSC::B3::Procedure::iterator::iterator):
+        (JSC::B3::Procedure::iterator::operator*):
+        (JSC::B3::Procedure::iterator::operator++):
+        (JSC::B3::Procedure::iterator::operator==):
+        (JSC::B3::Procedure::iterator::operator!=):
+        (JSC::B3::Procedure::iterator::findNext):
+        (JSC::B3::Procedure::begin):
+        (JSC::B3::Procedure::end):
+        (JSC::B3::Procedure::ValuesCollection::ValuesCollection):
+        (JSC::B3::Procedure::ValuesCollection::iterator::iterator):
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator*):
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator++):
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator==):
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator!=):
+        (JSC::B3::Procedure::ValuesCollection::begin):
+        (JSC::B3::Procedure::ValuesCollection::end):
+        (JSC::B3::Procedure::ValuesCollection::size):
+        (JSC::B3::Procedure::ValuesCollection::at):
+        (JSC::B3::Procedure::ValuesCollection::operator[]):
+        (JSC::B3::Procedure::values):
+        (JSC::B3::Procedure::setLastPhaseName):
+        (JSC::B3::Procedure::lastPhaseName):
+        * b3/B3ProcedureInlines.h: Added.
+        (JSC::B3::Procedure::add):
+        * b3/B3ReduceStrength.cpp: Added.
+        (JSC::B3::reduceStrength):
+        * b3/B3ReduceStrength.h: Added.
+        * b3/B3StackSlotKind.cpp: Added.
+        (WTF::printInternal):
+        * b3/B3StackSlotKind.h: Added.
+        * b3/B3StackSlotValue.cpp: Added.
+        (JSC::B3::StackSlotValue::~StackSlotValue):
+        (JSC::B3::StackSlotValue::dumpMeta):
+        * b3/B3StackSlotValue.h: Added.
+        (JSC::B3::StackSlotValue::accepts):
+        (JSC::B3::StackSlotValue::byteSize):
+        (JSC::B3::StackSlotValue::kind):
+        (JSC::B3::StackSlotValue::offsetFromFP):
+        (JSC::B3::StackSlotValue::setOffsetFromFP):
+        (JSC::B3::StackSlotValue::StackSlotValue):
+        * b3/B3Stackmap.cpp: Added.
+        (JSC::B3::Stackmap::Stackmap):
+        (JSC::B3::Stackmap::~Stackmap):
+        (JSC::B3::Stackmap::dump):
+        * b3/B3Stackmap.h: Added.
+        (JSC::B3::Stackmap::constrain):
+        (JSC::B3::Stackmap::reps):
+        (JSC::B3::Stackmap::clobber):
+        (JSC::B3::Stackmap::clobbered):
+        (JSC::B3::Stackmap::setGenerator):
+        * b3/B3StackmapSpecial.cpp: Added.
+        (JSC::B3::StackmapSpecial::StackmapSpecial):
+        (JSC::B3::StackmapSpecial::~StackmapSpecial):
+        (JSC::B3::StackmapSpecial::reportUsedRegisters):
+        (JSC::B3::StackmapSpecial::extraClobberedRegs):
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        (JSC::B3::StackmapSpecial::isValidImpl):
+        (JSC::B3::StackmapSpecial::admitsStackImpl):
+        (JSC::B3::StackmapSpecial::appendRepsImpl):
+        (JSC::B3::StackmapSpecial::repForArg):
+        * b3/B3StackmapSpecial.h: Added.
+        * b3/B3SuccessorCollection.h: Added.
+        (JSC::B3::SuccessorCollection::SuccessorCollection):
+        (JSC::B3::SuccessorCollection::size):
+        (JSC::B3::SuccessorCollection::at):
+        (JSC::B3::SuccessorCollection::operator[]):
+        (JSC::B3::SuccessorCollection::iterator::iterator):
+        (JSC::B3::SuccessorCollection::iterator::operator*):
+        (JSC::B3::SuccessorCollection::iterator::operator++):
+        (JSC::B3::SuccessorCollection::iterator::operator==):
+        (JSC::B3::SuccessorCollection::iterator::operator!=):
+        (JSC::B3::SuccessorCollection::begin):
+        (JSC::B3::SuccessorCollection::end):
+        * b3/B3SwitchCase.cpp: Added.
+        (JSC::B3::SwitchCase::dump):
+        * b3/B3SwitchCase.h: Added.
+        (JSC::B3::SwitchCase::SwitchCase):
+        (JSC::B3::SwitchCase::operator bool):
+        (JSC::B3::SwitchCase::caseValue):
+        (JSC::B3::SwitchCase::target):
+        (JSC::B3::SwitchCase::targetBlock):
+        * b3/B3SwitchValue.cpp: Added.
+        (JSC::B3::SwitchValue::~SwitchValue):
+        (JSC::B3::SwitchValue::removeCase):
+        (JSC::B3::SwitchValue::appendCase):
+        (JSC::B3::SwitchValue::dumpMeta):
+        (JSC::B3::SwitchValue::SwitchValue):
+        * b3/B3SwitchValue.h: Added.
+        (JSC::B3::SwitchValue::accepts):
+        (JSC::B3::SwitchValue::numCaseValues):
+        (JSC::B3::SwitchValue::caseValue):
+        (JSC::B3::SwitchValue::caseValues):
+        (JSC::B3::SwitchValue::fallThrough):
+        (JSC::B3::SwitchValue::size):
+        (JSC::B3::SwitchValue::at):
+        (JSC::B3::SwitchValue::operator[]):
+        (JSC::B3::SwitchValue::iterator::iterator):
+        (JSC::B3::SwitchValue::iterator::operator*):
+        (JSC::B3::SwitchValue::iterator::operator++):
+        (JSC::B3::SwitchValue::iterator::operator==):
+        (JSC::B3::SwitchValue::iterator::operator!=):
+        (JSC::B3::SwitchValue::begin):
+        (JSC::B3::SwitchValue::end):
+        * b3/B3Type.cpp: Added.
+        (WTF::printInternal):
+        * b3/B3Type.h: Added.
+        (JSC::B3::isInt):
+        (JSC::B3::isFloat):
+        (JSC::B3::pointerType):
+        * b3/B3UpsilonValue.cpp: Added.
+        (JSC::B3::UpsilonValue::~UpsilonValue):
+        (JSC::B3::UpsilonValue::dumpMeta):
+        * b3/B3UpsilonValue.h: Added.
+        (JSC::B3::UpsilonValue::accepts):
+        (JSC::B3::UpsilonValue::phi):
+        (JSC::B3::UpsilonValue::UpsilonValue):
+        * b3/B3UseCounts.cpp: Added.
+        (JSC::B3::UseCounts::UseCounts):
+        (JSC::B3::UseCounts::~UseCounts):
+        * b3/B3UseCounts.h: Added.
+        (JSC::B3::UseCounts::operator[]):
+        * b3/B3Validate.cpp: Added.
+        (JSC::B3::validate):
+        * b3/B3Validate.h: Added.
+        * b3/B3Value.cpp: Added.
+        (JSC::B3::Value::~Value):
+        (JSC::B3::Value::replaceWithIdentity):
+        (JSC::B3::Value::replaceWithNop):
+        (JSC::B3::Value::dump):
+        (JSC::B3::Value::deepDump):
+        (JSC::B3::Value::negConstant):
+        (JSC::B3::Value::addConstant):
+        (JSC::B3::Value::subConstant):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::performSubstitution):
+        (JSC::B3::Value::dumpMeta):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h: Added.
+        (JSC::B3::DeepValueDump::DeepValueDump):
+        (JSC::B3::DeepValueDump::dump):
+        (JSC::B3::deepDump):
+        * b3/B3ValueInlines.h: Added.
+        (JSC::B3::Value::as):
+        (JSC::B3::Value::isConstant):
+        (JSC::B3::Value::hasInt32):
+        (JSC::B3::Value::asInt32):
+        (JSC::B3::Value::hasInt64):
+        (JSC::B3::Value::asInt64):
+        (JSC::B3::Value::hasInt):
+        (JSC::B3::Value::asInt):
+        (JSC::B3::Value::isInt):
+        (JSC::B3::Value::hasIntPtr):
+        (JSC::B3::Value::asIntPtr):
+        (JSC::B3::Value::hasDouble):
+        (JSC::B3::Value::asDouble):
+        (JSC::B3::Value::stackmap):
+        * b3/B3ValueRep.cpp: Added.
+        (JSC::B3::ValueRep::dump):
+        (WTF::printInternal):
+        * b3/B3ValueRep.h: Added.
+        (JSC::B3::ValueRep::ValueRep):
+        (JSC::B3::ValueRep::reg):
+        (JSC::B3::ValueRep::stack):
+        (JSC::B3::ValueRep::stackArgument):
+        (JSC::B3::ValueRep::constant):
+        (JSC::B3::ValueRep::constantDouble):
+        (JSC::B3::ValueRep::kind):
+        (JSC::B3::ValueRep::operator bool):
+        (JSC::B3::ValueRep::offsetFromFP):
+        (JSC::B3::ValueRep::offsetFromSP):
+        (JSC::B3::ValueRep::value):
+        (JSC::B3::ValueRep::doubleValue):
+        * b3/air: Added.
+        * b3/air/AirAllocateStack.cpp: Added.
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirAllocateStack.h: Added.
+        * b3/air/AirArg.cpp: Added.
+        (JSC::B3::Air::Arg::dump):
+        * b3/air/AirArg.h: Added.
+        (JSC::B3::Air::Arg::isUse):
+        (JSC::B3::Air::Arg::isDef):
+        (JSC::B3::Air::Arg::typeForB3Type):
+        (JSC::B3::Air::Arg::Arg):
+        (JSC::B3::Air::Arg::imm):
+        (JSC::B3::Air::Arg::imm64):
+        (JSC::B3::Air::Arg::addr):
+        (JSC::B3::Air::Arg::stack):
+        (JSC::B3::Air::Arg::callArg):
+        (JSC::B3::Air::Arg::isValidScale):
+        (JSC::B3::Air::Arg::logScale):
+        (JSC::B3::Air::Arg::index):
+        (JSC::B3::Air::Arg::relCond):
+        (JSC::B3::Air::Arg::resCond):
+        (JSC::B3::Air::Arg::special):
+        (JSC::B3::Air::Arg::operator==):
+        (JSC::B3::Air::Arg::operator!=):
+        (JSC::B3::Air::Arg::operator bool):
+        (JSC::B3::Air::Arg::kind):
+        (JSC::B3::Air::Arg::isTmp):
+        (JSC::B3::Air::Arg::isImm):
+        (JSC::B3::Air::Arg::isImm64):
+        (JSC::B3::Air::Arg::isAddr):
+        (JSC::B3::Air::Arg::isStack):
+        (JSC::B3::Air::Arg::isCallArg):
+        (JSC::B3::Air::Arg::isIndex):
+        (JSC::B3::Air::Arg::isRelCond):
+        (JSC::B3::Air::Arg::isResCond):
+        (JSC::B3::Air::Arg::isSpecial):
+        (JSC::B3::Air::Arg::isAlive):
+        (JSC::B3::Air::Arg::tmp):
+        (JSC::B3::Air::Arg::value):
+        (JSC::B3::Air::Arg::pointerValue):
+        (JSC::B3::Air::Arg::base):
+        (JSC::B3::Air::Arg::hasOffset):
+        (JSC::B3::Air::Arg::offset):
+        (JSC::B3::Air::Arg::stackSlot):
+        (JSC::B3::Air::Arg::scale):
+        (JSC::B3::Air::Arg::isGPTmp):
+        (JSC::B3::Air::Arg::isFPTmp):
+        (JSC::B3::Air::Arg::isGP):
+        (JSC::B3::Air::Arg::isFP):
+        (JSC::B3::Air::Arg::hasType):
+        (JSC::B3::Air::Arg::type):
+        (JSC::B3::Air::Arg::isType):
+        (JSC::B3::Air::Arg::isGPR):
+        (JSC::B3::Air::Arg::gpr):
+        (JSC::B3::Air::Arg::isFPR):
+        (JSC::B3::Air::Arg::fpr):
+        (JSC::B3::Air::Arg::isReg):
+        (JSC::B3::Air::Arg::reg):
+        (JSC::B3::Air::Arg::gpTmpIndex):
+        (JSC::B3::Air::Arg::fpTmpIndex):
+        (JSC::B3::Air::Arg::tmpIndex):
+        (JSC::B3::Air::Arg::withOffset):
+        (JSC::B3::Air::Arg::forEachTmpFast):
+        (JSC::B3::Air::Arg::forEachTmp):
+        (JSC::B3::Air::Arg::asTrustedImm32):
+        (JSC::B3::Air::Arg::asTrustedImm64):
+        (JSC::B3::Air::Arg::asTrustedImmPtr):
+        (JSC::B3::Air::Arg::asAddress):
+        (JSC::B3::Air::Arg::asBaseIndex):
+        (JSC::B3::Air::Arg::asRelationalCondition):
+        (JSC::B3::Air::Arg::asResultCondition):
+        (JSC::B3::Air::Arg::isHashTableDeletedValue):
+        (JSC::B3::Air::Arg::hash):
+        (JSC::B3::Air::ArgHash::hash):
+        (JSC::B3::Air::ArgHash::equal):
+        * b3/air/AirBasicBlock.cpp: Added.
+        (JSC::B3::Air::BasicBlock::addPredecessor):
+        (JSC::B3::Air::BasicBlock::removePredecessor):
+        (JSC::B3::Air::BasicBlock::replacePredecessor):
+        (JSC::B3::Air::BasicBlock::dump):
+        (JSC::B3::Air::BasicBlock::deepDump):
+        (JSC::B3::Air::BasicBlock::BasicBlock):
+        * b3/air/AirBasicBlock.h: Added.
+        (JSC::B3::Air::BasicBlock::index):
+        (JSC::B3::Air::BasicBlock::size):
+        (JSC::B3::Air::BasicBlock::begin):
+        (JSC::B3::Air::BasicBlock::end):
+        (JSC::B3::Air::BasicBlock::at):
+        (JSC::B3::Air::BasicBlock::last):
+        (JSC::B3::Air::BasicBlock::appendInst):
+        (JSC::B3::Air::BasicBlock::append):
+        (JSC::B3::Air::BasicBlock::numSuccessors):
+        (JSC::B3::Air::BasicBlock::successor):
+        (JSC::B3::Air::BasicBlock::successors):
+        (JSC::B3::Air::BasicBlock::successorBlock):
+        (JSC::B3::Air::BasicBlock::successorBlocks):
+        (JSC::B3::Air::BasicBlock::numPredecessors):
+        (JSC::B3::Air::BasicBlock::predecessor):
+        (JSC::B3::Air::BasicBlock::predecessors):
+        (JSC::B3::Air::DeepBasicBlockDump::DeepBasicBlockDump):
+        (JSC::B3::Air::DeepBasicBlockDump::dump):
+        (JSC::B3::Air::deepDump):
+        * b3/air/AirCCallSpecial.cpp: Added.
+        (JSC::B3::Air::CCallSpecial::CCallSpecial):
+        (JSC::B3::Air::CCallSpecial::~CCallSpecial):
+        (JSC::B3::Air::CCallSpecial::forEachArg):
+        (JSC::B3::Air::CCallSpecial::isValid):
+        (JSC::B3::Air::CCallSpecial::admitsStack):
+        (JSC::B3::Air::CCallSpecial::reportUsedRegisters):
+        (JSC::B3::Air::CCallSpecial::generate):
+        (JSC::B3::Air::CCallSpecial::extraClobberedRegs):
+        (JSC::B3::Air::CCallSpecial::dumpImpl):
+        (JSC::B3::Air::CCallSpecial::deepDumpImpl):
+        * b3/air/AirCCallSpecial.h: Added.
+        * b3/air/AirCode.cpp: Added.
+        (JSC::B3::Air::Code::Code):
+        (JSC::B3::Air::Code::~Code):
+        (JSC::B3::Air::Code::addBlock):
+        (JSC::B3::Air::Code::addStackSlot):
+        (JSC::B3::Air::Code::addSpecial):
+        (JSC::B3::Air::Code::cCallSpecial):
+        (JSC::B3::Air::Code::resetReachability):
+        (JSC::B3::Air::Code::dump):
+        (JSC::B3::Air::Code::findFirstBlockIndex):
+        (JSC::B3::Air::Code::findNextBlockIndex):
+        (JSC::B3::Air::Code::findNextBlock):
+        * b3/air/AirCode.h: Added.
+        (JSC::B3::Air::Code::newTmp):
+        (JSC::B3::Air::Code::numTmps):
+        (JSC::B3::Air::Code::callArgAreaSize):
+        (JSC::B3::Air::Code::requestCallArgAreaSize):
+        (JSC::B3::Air::Code::frameSize):
+        (JSC::B3::Air::Code::setFrameSize):
+        (JSC::B3::Air::Code::calleeSaveRegisters):
+        (JSC::B3::Air::Code::size):
+        (JSC::B3::Air::Code::at):
+        (JSC::B3::Air::Code::operator[]):
+        (JSC::B3::Air::Code::iterator::iterator):
+        (JSC::B3::Air::Code::iterator::operator*):
+        (JSC::B3::Air::Code::iterator::operator++):
+        (JSC::B3::Air::Code::iterator::operator==):
+        (JSC::B3::Air::Code::iterator::operator!=):
+        (JSC::B3::Air::Code::begin):
+        (JSC::B3::Air::Code::end):
+        (JSC::B3::Air::Code::StackSlotsCollection::StackSlotsCollection):
+        (JSC::B3::Air::Code::StackSlotsCollection::size):
+        (JSC::B3::Air::Code::StackSlotsCollection::at):
+        (JSC::B3::Air::Code::StackSlotsCollection::operator[]):
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::iterator):
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::operator*):
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::operator++):
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::operator==):
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::operator!=):
+        (JSC::B3::Air::Code::StackSlotsCollection::begin):
+        (JSC::B3::Air::Code::StackSlotsCollection::end):
+        (JSC::B3::Air::Code::stackSlots):
+        (JSC::B3::Air::Code::SpecialsCollection::SpecialsCollection):
+        (JSC::B3::Air::Code::SpecialsCollection::size):
+        (JSC::B3::Air::Code::SpecialsCollection::at):
+        (JSC::B3::Air::Code::SpecialsCollection::operator[]):
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::iterator):
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::operator*):
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::operator++):
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::operator==):
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::operator!=):
+        (JSC::B3::Air::Code::SpecialsCollection::begin):
+        (JSC::B3::Air::Code::SpecialsCollection::end):
+        (JSC::B3::Air::Code::specials):
+        (JSC::B3::Air::Code::setLastPhaseName):
+        (JSC::B3::Air::Code::lastPhaseName):
+        * b3/air/AirFrequentedBlock.h: Added.
+        * b3/air/AirGenerate.cpp: Added.
+        (JSC::B3::Air::generate):
+        * b3/air/AirGenerate.h: Added.
+        * b3/air/AirGenerated.cpp: Added.
+        * b3/air/AirGenerationContext.h: Added.
+        * b3/air/AirHandleCalleeSaves.cpp: Added.
+        (JSC::B3::Air::handleCalleeSaves):
+        * b3/air/AirHandleCalleeSaves.h: Added.
+        * b3/air/AirInsertionSet.cpp: Added.
+        (JSC::B3::Air::InsertionSet::execute):
+        * b3/air/AirInsertionSet.h: Added.
+        (JSC::B3::Air::InsertionSet::InsertionSet):
+        (JSC::B3::Air::InsertionSet::code):
+        (JSC::B3::Air::InsertionSet::appendInsertion):
+        (JSC::B3::Air::InsertionSet::insertInst):
+        (JSC::B3::Air::InsertionSet::insert):
+        * b3/air/AirInst.cpp: Added.
+        (JSC::B3::Air::Inst::dump):
+        * b3/air/AirInst.h: Added.
+        (JSC::B3::Air::Inst::Inst):
+        (JSC::B3::Air::Inst::opcode):
+        (JSC::B3::Air::Inst::forEachTmpFast):
+        (JSC::B3::Air::Inst::forEachTmp):
+        * b3/air/AirInstInlines.h: Added.
+        (JSC::B3::Air::ForEach<Tmp>::forEach):
+        (JSC::B3::Air::ForEach<Arg>::forEach):
+        (JSC::B3::Air::Inst::forEach):
+        (JSC::B3::Air::Inst::hasSpecial):
+        (JSC::B3::Air::Inst::extraClobberedRegs):
+        (JSC::B3::Air::Inst::reportUsedRegisters):
+        (JSC::B3::Air::isShiftValid):
+        (JSC::B3::Air::isLshift32Valid):
+        * b3/air/AirLiveness.h: Added.
+        (JSC::B3::Air::Liveness::Liveness):
+        (JSC::B3::Air::Liveness::liveAtHead):
+        (JSC::B3::Air::Liveness::liveAtTail):
+        (JSC::B3::Air::Liveness::LocalCalc::LocalCalc):
+        (JSC::B3::Air::Liveness::LocalCalc::live):
+        (JSC::B3::Air::Liveness::LocalCalc::takeLive):
+        (JSC::B3::Air::Liveness::LocalCalc::execute):
+        * b3/air/AirOpcode.opcodes: Added.
+        * b3/air/AirPhaseScope.cpp: Added.
+        (JSC::B3::Air::PhaseScope::PhaseScope):
+        (JSC::B3::Air::PhaseScope::~PhaseScope):
+        * b3/air/AirPhaseScope.h: Added.
+        * b3/air/AirRegisterPriority.cpp: Added.
+        (JSC::B3::Air::gprsInPriorityOrder):
+        (JSC::B3::Air::fprsInPriorityOrder):
+        (JSC::B3::Air::regsInPriorityOrder):
+        * b3/air/AirRegisterPriority.h: Added.
+        (JSC::B3::Air::RegistersInPriorityOrder<GPRInfo>::inPriorityOrder):
+        (JSC::B3::Air::RegistersInPriorityOrder<FPRInfo>::inPriorityOrder):
+        (JSC::B3::Air::regsInPriorityOrder):
+        * b3/air/AirSpecial.cpp: Added.
+        (JSC::B3::Air::Special::Special):
+        (JSC::B3::Air::Special::~Special):
+        (JSC::B3::Air::Special::name):
+        (JSC::B3::Air::Special::dump):
+        (JSC::B3::Air::Special::deepDump):
+        * b3/air/AirSpecial.h: Added.
+        (JSC::B3::Air::DeepSpecialDump::DeepSpecialDump):
+        (JSC::B3::Air::DeepSpecialDump::dump):
+        (JSC::B3::Air::deepDump):
+        * b3/air/AirSpillEverything.cpp: Added.
+        (JSC::B3::Air::spillEverything):
+        * b3/air/AirSpillEverything.h: Added.
+        * b3/air/AirStackSlot.cpp: Added.
+        (JSC::B3::Air::StackSlot::setOffsetFromFP):
+        (JSC::B3::Air::StackSlot::dump):
+        (JSC::B3::Air::StackSlot::deepDump):
+        (JSC::B3::Air::StackSlot::StackSlot):
+        * b3/air/AirStackSlot.h: Added.
+        (JSC::B3::Air::StackSlot::byteSize):
+        (JSC::B3::Air::StackSlot::kind):
+        (JSC::B3::Air::StackSlot::index):
+        (JSC::B3::Air::StackSlot::alignment):
+        (JSC::B3::Air::StackSlot::value):
+        (JSC::B3::Air::StackSlot::offsetFromFP):
+        (JSC::B3::Air::DeepStackSlotDump::DeepStackSlotDump):
+        (JSC::B3::Air::DeepStackSlotDump::dump):
+        (JSC::B3::Air::deepDump):
+        * b3/air/AirTmp.cpp: Added.
+        (JSC::B3::Air::Tmp::dump):
+        * b3/air/AirTmp.h: Added.
+        (JSC::B3::Air::Tmp::Tmp):
+        (JSC::B3::Air::Tmp::gpTmpForIndex):
+        (JSC::B3::Air::Tmp::fpTmpForIndex):
+        (JSC::B3::Air::Tmp::operator bool):
+        (JSC::B3::Air::Tmp::isGP):
+        (JSC::B3::Air::Tmp::isFP):
+        (JSC::B3::Air::Tmp::isGPR):
+        (JSC::B3::Air::Tmp::isFPR):
+        (JSC::B3::Air::Tmp::isReg):
+        (JSC::B3::Air::Tmp::gpr):
+        (JSC::B3::Air::Tmp::fpr):
+        (JSC::B3::Air::Tmp::reg):
+        (JSC::B3::Air::Tmp::hasTmpIndex):
+        (JSC::B3::Air::Tmp::gpTmpIndex):
+        (JSC::B3::Air::Tmp::fpTmpIndex):
+        (JSC::B3::Air::Tmp::tmpIndex):
+        (JSC::B3::Air::Tmp::isAlive):
+        (JSC::B3::Air::Tmp::operator==):
+        (JSC::B3::Air::Tmp::operator!=):
+        (JSC::B3::Air::Tmp::isHashTableDeletedValue):
+        (JSC::B3::Air::Tmp::hash):
+        (JSC::B3::Air::Tmp::encodeGP):
+        (JSC::B3::Air::Tmp::encodeFP):
+        (JSC::B3::Air::Tmp::encodeGPR):
+        (JSC::B3::Air::Tmp::encodeFPR):
+        (JSC::B3::Air::Tmp::encodeGPTmp):
+        (JSC::B3::Air::Tmp::encodeFPTmp):
+        (JSC::B3::Air::Tmp::isEncodedGP):
+        (JSC::B3::Air::Tmp::isEncodedFP):
+        (JSC::B3::Air::Tmp::isEncodedGPR):
+        (JSC::B3::Air::Tmp::isEncodedFPR):
+        (JSC::B3::Air::Tmp::isEncodedGPTmp):
+        (JSC::B3::Air::Tmp::isEncodedFPTmp):
+        (JSC::B3::Air::Tmp::decodeGPR):
+        (JSC::B3::Air::Tmp::decodeFPR):
+        (JSC::B3::Air::Tmp::decodeGPTmp):
+        (JSC::B3::Air::Tmp::decodeFPTmp):
+        (JSC::B3::Air::TmpHash::hash):
+        (JSC::B3::Air::TmpHash::equal):
+        * b3/air/AirTmpInlines.h: Added.
+        (JSC::B3::Air::Tmp::Tmp):
+        * b3/air/AirValidate.cpp: Added.
+        (JSC::B3::Air::validate):
+        * b3/air/AirValidate.h: Added.
+        * b3/air/opcode_generator.rb: Added.
+        * b3/generate_pattern_matcher.rb: Added.
+        * b3/testb3.cpp: Added.
+        (JSC::B3::compileAndRun):
+        (JSC::B3::test42):
+        (JSC::B3::testLoad42):
+        (JSC::B3::testArg):
+        (JSC::B3::testAddArgs):
+        (JSC::B3::testAddArgs32):
+        (JSC::B3::testStore):
+        (JSC::B3::testTrunc):
+        (JSC::B3::testAdd1):
+        (JSC::B3::testStoreAddLoad):
+        (JSC::B3::testStoreAddAndLoad):
+        (JSC::B3::testAdd1Uncommuted):
+        (JSC::B3::testLoadOffset):
+        (JSC::B3::testLoadOffsetNotConstant):
+        (JSC::B3::testLoadOffsetUsingAdd):
+        (JSC::B3::testLoadOffsetUsingAddNotConstant):
+        (JSC::B3::run):
+        (run):
+        (main):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::specializationKind):
+        * jit/Reg.h:
+        (JSC::Reg::index):
+        (JSC::Reg::isSet):
+        (JSC::Reg::operator bool):
+        (JSC::Reg::isHashTableDeletedValue):
+        (JSC::Reg::AllRegsIterable::iterator::iterator):
+        (JSC::Reg::AllRegsIterable::iterator::operator*):
+        (JSC::Reg::AllRegsIterable::iterator::operator++):
+        (JSC::Reg::AllRegsIterable::iterator::operator==):
+        (JSC::Reg::AllRegsIterable::iterator::operator!=):
+        (JSC::Reg::AllRegsIterable::begin):
+        (JSC::Reg::AllRegsIterable::end):
+        (JSC::Reg::all):
+        (JSC::Reg::invalid):
+        (JSC::Reg::operator!): Deleted.
+        * jit/RegisterAtOffsetList.cpp:
+        (JSC::RegisterAtOffsetList::RegisterAtOffsetList):
+        * jit/RegisterAtOffsetList.h:
+        (JSC::RegisterAtOffsetList::clear):
+        (JSC::RegisterAtOffsetList::size):
+        (JSC::RegisterAtOffsetList::begin):
+        (JSC::RegisterAtOffsetList::end):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::operator==):
+        (JSC::RegisterSet::hash):
+        (JSC::RegisterSet::forEach):
+        (JSC::RegisterSet::setAny):
+
+2015-10-28  Mark Lam  <mark.lam@apple.com>
+
+        Rename MacroAssembler::callProbe() to probe().
+        https://bugs.webkit.org/show_bug.cgi?id=150641
+
+        Reviewed by Saam Barati.
+
+        To do this, I needed to disambiguate between the low-level probe() from the
+        high-level version that takes a std::function.  I did this by changing the low-
+        level version to not take default args anymore.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssembler.cpp:
+        (JSC::stdFunctionCallback):
+        (JSC::MacroAssembler::probe):
+        (JSC::MacroAssembler::callProbe): Deleted.
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::urshift32):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::repatchCall):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::repatchCall):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::repatchCall):
+        * assembler/MacroAssemblerPrinter.h:
+        (JSC::MacroAssemblerPrinter::print):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
+
+2015-10-28  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: jsmin.py mistakenly removes whitespace from template literal strings
+        https://bugs.webkit.org/show_bug.cgi?id=148728
+
+        Reviewed by Joseph Pecoraro.
+
+        * Scripts/jsmin.py:
+        (JavascriptMinify.minify): Make backtick a quoting character.
+
+2015-10-28  Brian Burg  <bburg@apple.com>
+
+        Builtins generator should emit ENABLE(FEATURE) guards based on @conditional annotation
+        https://bugs.webkit.org/show_bug.cgi?id=150536
+
+        Reviewed by Yusuke Suzuki.
+
+        Scan JS builtin files for @key=value and @flag annotations in single-line comments.
+        For @conditional=CONDITIONAL, emit CONDITIONAL guards around the relevant object's code.
+
+        Generate primary header includes separately from secondary header includes so we can
+        put the guard between the two header groups, as is customary in WebKit C++ code.
+
+        New tests:
+
+        Scripts/tests/builtins/WebCore-ArbitraryConditionalGuard-Separate.js
+        Scripts/tests/builtins/WebCore-DuplicateFlagAnnotation-Separate.js
+        Scripts/tests/builtins/WebCore-DuplicateKeyValueAnnotation-Separate.js
+
+        * Scripts/builtins/builtins_generate_combined_implementation.py:
+        (BuiltinsCombinedImplementationGenerator.generate_output):
+        (BuiltinsCombinedImplementationGenerator.generate_secondary_header_includes):
+        (BuiltinsCombinedImplementationGenerator.generate_header_includes): Deleted.
+        * Scripts/builtins/builtins_generate_separate_header.py:
+        (BuiltinsSeparateHeaderGenerator.generate_output):
+        (generate_secondary_header_includes):
+        (generate_header_includes): Deleted.
+        * Scripts/builtins/builtins_generate_separate_implementation.py:
+        (BuiltinsSeparateImplementationGenerator.generate_output):
+        (BuiltinsSeparateImplementationGenerator.generate_secondary_header_includes):
+        (BuiltinsSeparateImplementationGenerator.generate_header_includes): Deleted.
+        * Scripts/builtins/builtins_generate_separate_wrapper.py:
+        (BuiltinsSeparateWrapperGenerator.generate_output):
+        (BuiltinsSeparateWrapperGenerator.generate_secondary_header_includes):
+        (BuiltinsSeparateWrapperGenerator.generate_header_includes): Deleted.
+        * Scripts/builtins/builtins_generator.py:
+        (BuiltinsGenerator.generate_includes_from_entries):
+        (BuiltinsGenerator):
+        (BuiltinsGenerator.generate_primary_header_includes):
+        * Scripts/builtins/builtins_model.py:
+        (BuiltinObject.__init__):
+        (BuiltinsCollection.parse_builtins_file):
+        (BuiltinsCollection._parse_annotations):
+        * Scripts/tests/builtins/WebCore-ArbitraryConditionalGuard-Separate.js: Added.
+        * Scripts/tests/builtins/WebCore-DuplicateFlagAnnotation-Separate.js: Added.
+        * Scripts/tests/builtins/WebCore-DuplicateKeyValueAnnotation-Separate.js: Added.
+        * Scripts/tests/builtins/WebCore-GuardedBuiltin-Separate.js: Simplify.
+        * Scripts/tests/builtins/WebCore-GuardedInternalBuiltin-Separate.js: Simplify.
+        * Scripts/tests/builtins/WebCore-UnguardedBuiltin-Separate.js: Simplify.
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Added.
+        * Scripts/tests/builtins/expected/WebCore-DuplicateFlagAnnotation-Separate.js-error: Added.
+        * Scripts/tests/builtins/expected/WebCore-DuplicateKeyValueAnnotation-Separate.js-error: Added.
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+
+2015-10-28  Mark Lam  <mark.lam@apple.com>
+
+        Update FTL to support UntypedUse operands for op_sub.
+        https://bugs.webkit.org/show_bug.cgi?id=150562
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerARM64.h:
+        - make the dataTempRegister and memoryTempRegister public so that we can
+          move input registers out of them if needed.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        - We can now compile ArithSub.
+
+        * ftl/FTLCompile.cpp:
+        - Added BinaryArithGenerationContext to shuffle registers into a state that is
+          expected by the baseline snippet generator.  This includes:
+          1. Making sure that the input and output registers are not in the tag or
+             scratch registers.
+          2. Loading the tag registers with expected values.
+          3. Restoring the registers to their original value on return.
+        - Added code to implement the ArithSub inline cache.
+
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::ArithSubDescriptor::ArithSubDescriptor):
+        (JSC::FTL::ArithSubDescriptor::leftType):
+        (JSC::FTL::ArithSubDescriptor::rightType):
+
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfArithSub):
+        * ftl/FTLInlineCacheSize.h:
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        - Added handling for UnusedType for the ArithSub case.
+
+        * ftl/FTLState.h:
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::reservedRegisters):
+
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::generateFastPath):
+        - When the result is in the same as one of the input registers, we'll end up
+          corrupting the input in fast path even if we determine that we need to go to
+          the slow path.  We now move the input into the scratch register and operate
+          on that instead and only move the result into the result register only after
+          the fast path has succeeded.
+
+        * tests/stress/op_sub.js:
+        (o1.valueOf):
+        (runTest):
+        - Added some debugging tools: flags for verbose logging, and eager abort on fail.
+
+2015-10-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix a typo in ProbeContext::fpr().
+        https://bugs.webkit.org/show_bug.cgi?id=150629
+
+        Reviewed by Yusuke Suzuki.
+
+        ProbeContext::fpr() should be calling CPUState::fpr(), not CPUState::gpr().
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ProbeContext::fpr):
+
+2015-10-28  Mark Lam  <mark.lam@apple.com>
+
+        Add ability to print the PC register from JIT'ed code.
+        https://bugs.webkit.org/show_bug.cgi?id=150561
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerPrinter.cpp:
+        (JSC::printPC):
+        (JSC::MacroAssemblerPrinter::printCallback):
+        * assembler/MacroAssemblerPrinter.h:
+        (JSC::MacroAssemblerPrinter::PrintArg::PrintArg):
+
+2015-10-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove Timeline MarkDOMContent and MarkLoad, data is already available
+        https://bugs.webkit.org/show_bug.cgi?id=150615
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+
+2015-10-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused / duplicated XHR timeline instrumentation
+        https://bugs.webkit.org/show_bug.cgi?id=150605
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+
+2015-10-27  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r191360): Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::FTL:: + 386
+        https://bugs.webkit.org/show_bug.cgi?id=150580
+
+        Reviewed by Mark Lam.
+
+        Changed code to box 32 bit integers and booleans arguments when generating the call instead of boxing
+        them in the shuffler.
+
+        The ASSERT in CallFrameShuffler::extendFrameIfNeeded is wrong when called from CallFrameShuffler::spill(),
+        as we could be making space to spill a register so that we have a spare that we can use for the new
+        frame's base pointer.
+
+        * ftl/FTLJSTailCall.cpp:
+        (JSC::FTL::DFG::recoveryFor): Added RELEASE_ASSERT to check that we never see unboxed 32 bit
+        arguments stored in the stack.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForTailCall):
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::extendFrameIfNeeded): Removed unneeded ASSERT.
+
+2015-10-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Add DFG/FTL support for accessor put operations
+        https://bugs.webkit.org/show_bug.cgi?id=148860
+
+        Reviewed by Geoffrey Garen.
+
+        This patch introduces accessor defining ops into DFG and FTL.
+        The following DFG nodes are introduced.
+
+            op_put_getter_by_id  => PutGetterById
+            op_put_setter_by_id  => PutSetterById
+            op_put_getter_setter => PutGetterSetterById
+            op_put_getter_by_val => PutGetterByVal
+            op_put_setter_by_val => PutSetterByVal
+
+        These DFG nodes just call operations. But it does not prevent compiling in DFG/FTL.
+
+        To use operations defined for baseline JIT, we clean up existing operations.
+        And reuse these operations in DFG and FTL.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::hasAccessorAttributes):
+        (JSC::DFG::Node::accessorAttributes):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutAccessorById):
+        (JSC::DFG::SpeculativeJIT::compilePutGetterSetterById):
+        (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):
+        We should fill all GPRs before calling flushRegisters().
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutAccessorById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutGetterSetterById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutAccessorByVal):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_getter_by_id):
+        (JSC::JIT::emit_op_put_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter_by_id):
+        (JSC::JIT::emit_op_put_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter):
+        * tests/stress/dfg-put-accessors-by-id-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.Cocoa.prototype.get hello):
+        (getter.Cocoa):
+        (getter):
+        (setter.Cocoa):
+        (setter.Cocoa.prototype.set hello):
+        (setter):
+        (accessors.Cocoa):
+        (accessors.Cocoa.prototype.get hello):
+        (accessors.Cocoa.prototype.set hello):
+        (accessors):
+        * tests/stress/dfg-put-accessors-by-id.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.object.get hello):
+        (getter):
+        (setter.object.set hello):
+        (setter):
+        (accessors.object.get hello):
+        (accessors.object.set hello):
+        (accessors):
+        * tests/stress/dfg-put-getter-by-id-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.Cocoa):
+        (getter.Cocoa.prototype.get hello):
+        (getter.Cocoa.prototype.get name):
+        (getter):
+        * tests/stress/dfg-put-getter-by-id.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.object.get hello):
+        (getter):
+        * tests/stress/dfg-put-getter-by-val-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.Cocoa):
+        (getter.Cocoa.prototype.get name):
+        (getter):
+        * tests/stress/dfg-put-getter-by-val.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.object.get name):
+        (getter):
+        * tests/stress/dfg-put-setter-by-id-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.Cocoa):
+        (getter.Cocoa.prototype.set hello):
+        (getter.Cocoa.prototype.get name):
+        (getter):
+        * tests/stress/dfg-put-setter-by-id.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (setter.object.set hello):
+        (setter):
+        * tests/stress/dfg-put-setter-by-val-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (setter.Cocoa):
+        (setter.Cocoa.prototype.set name):
+        (setter):
+        * tests/stress/dfg-put-setter-by-val.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (setter.object.set name):
+        (setter):
+
+2015-10-26  Mark Lam  <mark.lam@apple.com>
+
+        Add logging to warn about under-estimated FTL inline cache sizes.
+        https://bugs.webkit.org/show_bug.cgi?id=150570
+
+        Reviewed by Geoffrey Garen.
+
+        Added 2 options:
+        1. JSC_dumpFailedICSizing - dumps an error message if the FTL encounters IC size
+           estimates that are less than the actual needed code size.
+
+           This option is useful for when we add a new IC and want to compute an
+           estimated size for the IC.  To do this:
+           1. Build jsc for the target port with a very small IC size (enough to
+              store the jump instruction needed for the out of line fallback
+              implementation).
+           2. Implement a test suite with scenarios that exercise all the code paths in
+              the IC generator.
+           3. Run jsc with JSC_dumpFailedICSizing=true on the test suite.
+           4. The max value reported by the dumps will be the worst case size needed to
+              store the IC.  We should use this value for our estimate.
+           5. Update the IC's estimated size and rebuild jsc.
+           6. Re-run (3) and confirm that there are no more error messages about the
+              IC sizing.
+
+        2. JSC_assertICSizing - same as JSC_dumpFailedICSizing except that it also
+           crashes the VM each time it encounters an inadequate IC size estimate.
+
+           This option is useful for regression testing to ensure that our estimates
+           do not regress.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::generateInlineIfPossibleOutOfLineIfNot):
+        * runtime/Options.h:
+
+2015-10-26  Saam barati  <sbarati@apple.com>
+
+        r190735 Caused us to maybe trample the base's tag-GPR on 32-bit inline cache when the cache allocates a scratch register and then jumps to the slow path
+        https://bugs.webkit.org/show_bug.cgi?id=150532
+
+        Reviewed by Geoffrey Garen.
+
+        The base's tag register used to show up in the used register set
+        before r190735 because of how the DFG kept track of used register. I changed this 
+        in my work on inline caching because we don't want to spill these registers
+        when we have a GetByIdFlush/PutByIdFlush and we use the used register set
+        as the metric of what to spill. That said, these registers should be locked
+        and not used as scratch registers by the scratch register allocator. The
+        reason is that our inline cache may fail and jump to the slow path. The slow
+        path then uses the base's tag register. If the inline cache used the base's tag
+        register as a scratch and the inline cache fails and jumps to the slow path, we
+        have a problem because the tag may now be trampled.
+
+        Note that this doesn't mean that we can't trample the base's tag register when making
+        a call. We can totally trample the register as long as the inline cache succeeds in a GetByIdFlush/PutByIdFlush.
+        The problem is only when we trample it and then jump to the slow path.
+
+        This patch fixes this bug by making StructureStubInfo keep track of the base's
+        tag GPR. PolymorphicAccess then locks this register when using the ScratchRegisterAllocator.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        * tests/stress/regress-150532.js: Added.
+        (assert):
+        (randomFunction):
+        (foo):
+        (i.switch):
+
+2015-10-24  Brian Burg  <bburg@apple.com>
+
+        Teach create_hash_table to omit builtins macros when generating tables for native-only objects
+        https://bugs.webkit.org/show_bug.cgi?id=150491
+
+        Reviewed by Yusuke Suzuki.
+
+        In order to support separate compilation for generated builtins files, we need to be able to
+        include specific builtins headers from generated .lut.h files. However, the create_hash_table
+        script isn't smart enough to figure out when a generated file might actually contain a builtin.
+        Without further help, we'd have to include an all-in-one header, mostly defeating the point of
+        generating separate .h and .cpp files for every builtin.
+
+        This patch segregates the pure native and partially builtin sources in the build system, and
+        gives hints to create_hash_table so that it doesn't even generate checks for builtins if the
+        input file has no builtin method implementations. Also do some modernization and code cleanup.
+
+        * CMakeLists.txt:
+
+        Generate each group with different flags to create_hash_table. Change the macro to take
+        flags through the variable LUT_GENERATOR_FLAGS. Set this as necessary before calling macro.
+        Add an additional hint to CMake that the .cpp source file depends on the generated file.
+
+        * DerivedSources.make:
+
+        Generate each group with different flags to create_hash_table. Clean up the 'all' target
+        so that static dependencies are listed first. Use static patterns to decide which .lut.h
+        files require which flags. Reduce fragile usages of implicit variables.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        Add some missing .lut.h files to the Derived Sources group. Sort the project.
+
+        * create_hash_table:
+
+        Parse options in a sane way using GetOpt::Long. Remove ability to specify a custom namespace
+        since this isn't actually used anywhere. Normalize placement of newlines in quoted strings.
+        Only generate builtins macros and includes if the source file is known to have some builtins.
+
+2015-10-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused ScrollLayer Timeline EventType
+        https://bugs.webkit.org/show_bug.cgi?id=150518
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+
+2015-10-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Clean up InspectorInstrumentation includes
+        https://bugs.webkit.org/show_bug.cgi?id=150523
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::consoleMessageArgumentCounts): Deleted.
+        * inspector/agents/InspectorConsoleAgent.h:
+
+2015-10-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584
+        https://bugs.webkit.org/show_bug.cgi?id=150513
+
+        Reviewed by Saam Barati.
+
+        Add check in linkPolymorphicCall() to make sure we have a CodeBlock for the newly added variant.
+        If not, we turn the call into a virtual call.
+
+        The bug was caused by a stack overflow when preparing the function for execution.  This properly
+        threw an exception, however linkPolymorphicCall() didn't check for this error case.
+
+        Added a new test function "failNextNewCodeBlock()" to test tools to simplify the testing.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::failNextNewCodeBlock):
+        (JSC::numberOfDFGCompiles):
+        * API/JSCTestRunnerUtils.h:
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionTransferArrayBuffer):
+        (functionFailNextNewCodeBlock):
+        (functionQuit):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::optimizeNextInvocation):
+        (JSC::failNextNewCodeBlock):
+        (JSC::numberOfDFGCompiles):
+        * runtime/TestRunnerUtils.h:
+        * runtime/VM.h:
+        (JSC::VM::setFailNextNewCodeBlock):
+        (JSC::VM::getAndClearFailNextNewCodeBlock):
+        (JSC::VM::stackPointerAtVMEntry):
+
+2015-10-23  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r191500.
+        https://bugs.webkit.org/show_bug.cgi?id=150526
+
+        Broke two JSC regression tests (Requested by msaboff on
+        #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Add DFG/FTL support for accessor put operations"
+        https://bugs.webkit.org/show_bug.cgi?id=148860
+        http://trac.webkit.org/changeset/191500
+
+2015-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Add DFG/FTL support for accessor put operations
+        https://bugs.webkit.org/show_bug.cgi?id=148860
+
+        Reviewed by Geoffrey Garen.
+
+        This patch introduces accessor defining ops into DFG and FTL.
+        The following DFG nodes are introduced.
+
+            op_put_getter_by_id  => PutGetterById
+            op_put_setter_by_id  => PutSetterById
+            op_put_getter_setter => PutGetterSetterById
+            op_put_getter_by_val => PutGetterByVal
+            op_put_setter_by_val => PutSetterByVal
+
+        These DFG nodes just call operations. But it does not prevent compiling in DFG/FTL.
+
+        To use operations defined for baseline JIT, we clean up existing operations.
+        And reuse these operations in DFG and FTL.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::hasAccessorAttributes):
+        (JSC::DFG::Node::accessorAttributes):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutAccessorById):
+        (JSC::DFG::SpeculativeJIT::compilePutGetterSetterById):
+        (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutAccessorById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutGetterSetterById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutAccessorByVal):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_getter_by_id):
+        (JSC::JIT::emit_op_put_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter_by_id):
+        (JSC::JIT::emit_op_put_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter):
+        * tests/stress/dfg-put-accessors-by-id-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.Cocoa.prototype.get hello):
+        (getter.Cocoa):
+        (getter):
+        (setter.Cocoa):
+        (setter.Cocoa.prototype.set hello):
+        (setter):
+        (accessors.Cocoa):
+        (accessors.Cocoa.prototype.get hello):
+        (accessors.Cocoa.prototype.set hello):
+        (accessors):
+        * tests/stress/dfg-put-accessors-by-id.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.object.get hello):
+        (getter):
+        (setter.object.set hello):
+        (setter):
+        (accessors.object.get hello):
+        (accessors.object.set hello):
+        (accessors):
+        * tests/stress/dfg-put-getter-by-id-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.Cocoa):
+        (getter.Cocoa.prototype.get hello):
+        (getter.Cocoa.prototype.get name):
+        (getter):
+        * tests/stress/dfg-put-getter-by-id.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.object.get hello):
+        (getter):
+        * tests/stress/dfg-put-getter-by-val-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.Cocoa):
+        (getter.Cocoa.prototype.get name):
+        (getter):
+        * tests/stress/dfg-put-getter-by-val.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.object.get name):
+        (getter):
+        * tests/stress/dfg-put-setter-by-id-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (getter.Cocoa):
+        (getter.Cocoa.prototype.set hello):
+        (getter.Cocoa.prototype.get name):
+        (getter):
+        * tests/stress/dfg-put-setter-by-id.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (setter.object.set hello):
+        (setter):
+        * tests/stress/dfg-put-setter-by-val-class.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (setter.Cocoa):
+        (setter.Cocoa.prototype.set name):
+        (setter):
+        * tests/stress/dfg-put-setter-by-val.js: Added.
+        (shouldBe):
+        (testAttribute):
+        (setter.object.set name):
+        (setter):
+
+2015-10-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused Timeline GCEvent Record type
+        https://bugs.webkit.org/show_bug.cgi?id=150477
+
+        Reviewed by Timothy Hatcher.
+
+        Garbage Collection events go through the Heap domain, not the
+        Timeline domain (long time ago for Chromium).
+
+        * inspector/protocol/Timeline.json:
+
+2015-10-22  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r191360): Repro Crash: com.apple.WebKit.WebContent at JavaScriptCore:JSC::ExecState::bytecodeOffset + 174
+        https://bugs.webkit.org/show_bug.cgi?id=150434
+
+        Reviewed by Mark Lam.
+
+        Pass the current frame instead of the caller frame to operationVMHandleException when processing an
+        exception in one of the native thunks.
+
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind): Made debug printing of CodeBlock safe for call frames without one.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+
+2015-10-21  Brian Burg  <bburg@apple.com>
+
+        Restructure generate-js-bindings script to be modular and testable
+        https://bugs.webkit.org/show_bug.cgi?id=149929
+
+        Reviewed by Alex Christensen.
+
+        This is a new code generator, based on the replay inputs code generator and
+        the inspector protocol code generator, which produces various files for JS
+        builtins.
+
+        Relative to the generator it replaces, this one consolidates two scripts in
+        JavaScriptCore and WebCore into a single script with multiple files. Parsed
+        information about the builtins file is stored in backend-independent model
+        objects. Each output file has its own code generator that uses the model to
+        produce resulting code. Generators are additionally parameterized by the target
+        framework (to choose correct macros and includes) and output mode (one
+        header/implementation file per builtin or per framework).
+
+        It includes a few simple tests of the generator's functionality. These result-
+        based tests will become increasingly more important as we start to add support
+        for builtins annotation such as @optional, @internal, etc. to the code generator.
+
+        Some of these complexities, such as having two output modes, will be removed in
+        subsequent patches. This patch is intended to exactly replace the existing
+        functionality with a unified script that makes additional cleanups straightforward.
+
+        Additional cleanup and consolidation between inspector code generator scripts
+        and this script will be pursued in followup patches.
+
+        New tests:
+
+        Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Combined.js
+        Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Separate.js
+        Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Combined.js
+        Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Separate.js
+        Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Combined.js
+        Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Separate.js
+        Scripts/tests/builtins/WebCore-GuardedBuiltin-Separate.js
+        Scripts/tests/builtins/WebCore-GuardedInternalBuiltin-Separate.js
+        Scripts/tests/builtins/WebCore-UnguardedBuiltin-Separate.js
+        Scripts/tests/builtins/WebCore-xmlCasingTest-Separate.js
+
+
+        * CMakeLists.txt:
+
+            Copy the scripts that are used by other targets to a staging directory inside
+            ${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore/Scripts.
+            Define JavaScriptCore_SCRIPTS_DIR to point here so that the add_custom_command
+            and shared file lists are identical between JavaScriptCore and WebCore. The staged
+            scripts are a dependency of the main JavaScriptCore target so that they are
+            always staged, even if JavaScriptCore itself does not use a particular script.
+
+            The output files additionally depend on all builtin generator script files
+            and input files that are combined into the single header/implementation file.
+
+        * DerivedSources.make:
+
+            Define JavaScriptCore_SCRIPTS_DIR explicitly so the rule for code generation and
+            shared file lists are identical between JavaScriptCore and WebCore.
+
+            The output files additionally depend on all builtin generator script files
+            and input files that are combined into the single header/implementation file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+            Mark the new builtins generator files as private headers so we can use them from
+            WebCore.
+
+        * Scripts/UpdateContents.py: Renamed from Source/JavaScriptCore/UpdateContents.py.
+        * Scripts/builtins/__init__.py: Added.
+        * Scripts/builtins/builtins.py: Added.
+        * Scripts/builtins/builtins_generator.py: Added. This file contains the base generator.
+        (WK_lcfirst):
+        (WK_ucfirst):
+        (BuiltinsGenerator):
+        (BuiltinsGenerator.__init__):
+        (BuiltinsGenerator.model):
+        (BuiltinsGenerator.generate_license):
+        (BuiltinsGenerator.generate_includes_from_entries):
+        (BuiltinsGenerator.generate_output):
+        (BuiltinsGenerator.output_filename):
+        (BuiltinsGenerator.mangledNameForFunction):
+        (BuiltinsGenerator.mangledNameForFunction.toCamel):
+        (BuiltinsGenerator.generate_embedded_code_string_section_for_function):
+        * Scripts/builtins/builtins_model.py: Added. This file contains builtins model objects.
+        (ParseException):
+        (Framework):
+        (Framework.__init__):
+        (Framework.setting):
+        (Framework.fromString):
+        (Frameworks):
+        (BuiltinObject):
+        (BuiltinObject.__init__):
+        (BuiltinFunction):
+        (BuiltinFunction.__init__):
+        (BuiltinFunction.fromString):
+        (BuiltinFunction.__str__):
+        (BuiltinsCollection):
+        (BuiltinsCollection.__init__):
+        (BuiltinsCollection.parse_builtins_file):
+        (BuiltinsCollection.copyrights):
+        (BuiltinsCollection.all_functions):
+        (BuiltinsCollection._parse_copyright_lines):
+        (BuiltinsCollection._parse_functions):
+        * Scripts/builtins/builtins_templates.py: Added.
+        (BuiltinsGeneratorTemplates):
+        * Scripts/builtins/builtins_generate_combined_header.py: Added.
+        (BuiltinsCombinedHeaderGenerator):
+        (BuiltinsCombinedHeaderGenerator.__init__):
+        (BuiltinsCombinedHeaderGenerator.output_filename):
+        (BuiltinsCombinedHeaderGenerator.generate_output):
+        (BuiltinsCombinedHeaderGenerator.generate_forward_declarations):
+        (FunctionExecutable):
+        (VM):
+        (ConstructAbility):
+        (generate_section_for_object):
+        (generate_externs_for_object):
+        (generate_macros_for_object):
+        (generate_defines_for_object):
+        (generate_section_for_code_table_macro):
+        (generate_section_for_code_name_macro):
+        * Scripts/builtins/builtins_generate_combined_implementation.py: Added.
+        (BuiltinsCombinedImplementationGenerator):
+        (BuiltinsCombinedImplementationGenerator.__init__):
+        (BuiltinsCombinedImplementationGenerator.output_filename):
+        (BuiltinsCombinedImplementationGenerator.generate_output):
+        (BuiltinsCombinedImplementationGenerator.generate_header_includes):
+        * Scripts/builtins/builtins_generate_separate_header.py: Added.
+        (BuiltinsSeparateHeaderGenerator):
+        (BuiltinsSeparateHeaderGenerator.__init__):
+        (BuiltinsSeparateHeaderGenerator.output_filename):
+        (BuiltinsSeparateHeaderGenerator.macro_prefix):
+        (BuiltinsSeparateHeaderGenerator.generate_output):
+        (BuiltinsSeparateHeaderGenerator.generate_forward_declarations):
+        (FunctionExecutable):
+        (generate_header_includes):
+        (generate_section_for_object):
+        (generate_externs_for_object):
+        (generate_macros_for_object):
+        (generate_defines_for_object):
+        (generate_section_for_code_table_macro):
+        (generate_section_for_code_name_macro):
+        * Scripts/builtins/builtins_generate_separate_implementation.py: Added.
+        (BuiltinsSeparateImplementationGenerator):
+        (BuiltinsSeparateImplementationGenerator.__init__):
+        (BuiltinsSeparateImplementationGenerator.output_filename):
+        (BuiltinsSeparateImplementationGenerator.macro_prefix):
+        (BuiltinsSeparateImplementationGenerator.generate_output):
+        (BuiltinsSeparateImplementationGenerator.generate_header_includes):
+        * Scripts/builtins/builtins_generate_separate_wrapper.py: Added.
+        (BuiltinsSeparateWrapperGenerator):
+        (BuiltinsSeparateWrapperGenerator.__init__):
+        (BuiltinsSeparateWrapperGenerator.output_filename):
+        (BuiltinsSeparateWrapperGenerator.macro_prefix):
+        (BuiltinsSeparateWrapperGenerator.generate_output):
+        (BuiltinsSeparateWrapperGenerator.generate_header_includes):
+        * Scripts/generate-js-builtins.py: Added.
+
+            Parse command line options, decide which generators and output modes to use.
+
+        (generate_bindings_for_builtins_files):
+        * Scripts/lazywriter.py: Copied from the inspector protocol generator.
+        (LazyFileWriter):
+        (LazyFileWriter.__init__):
+        (LazyFileWriter.write):
+        (LazyFileWriter.close):
+        * Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Combined.js: Added.
+        * Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Separate.js: Added.
+        * Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Combined.js: Added.
+        * Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Separate.js: Added.
+        * Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Combined.js: Added.
+        * Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Separate.js: Added.
+        * Scripts/tests/builtins/WebCore-GuardedBuiltin-Separate.js: Added.
+        * Scripts/tests/builtins/WebCore-GuardedInternalBuiltin-Separate.js: Added.
+        * Scripts/tests/builtins/WebCore-UnguardedBuiltin-Separate.js: Added.
+        * Scripts/tests/builtins/WebCore-xmlCasingTest-Separate.js: Added.
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result: Added.
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result: Added.
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result: Added.
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result: Added.
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result: Added.
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result: Added.
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Added.
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Added.
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Added.
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Added.
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::BuiltinExecutables):
+        * builtins/BuiltinExecutables.h:
+        * create_hash_table:
+
+            Update the generated builtin macro names.
+
+        * generate-js-builtins: Removed.
+
+2015-10-21  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove FTL Native Inlining, it is dead code
+        https://bugs.webkit.org/show_bug.cgi?id=150429
+
+        Reviewed by Filip Pizlo.
+
+        The code is not used and it is in the way of other changes.
+
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::getFirstInstruction): Deleted.
+        (JSC::FTL::getNextInstruction): Deleted.
+        (JSC::FTL::getFirstBasicBlock): Deleted.
+        (JSC::FTL::getNextBasicBlock): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::isInlinableSize): Deleted.
+        * runtime/Options.h:
+
+2015-10-21  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove two useless temporaries from the PutByOffset codegen
+        https://bugs.webkit.org/show_bug.cgi?id=150421
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        Looks like they were added by accident in r160796.
+
+2015-10-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Factor out the graph node worklists from DFG into WTF
+        https://bugs.webkit.org/show_bug.cgi?id=150411
+
+        Reviewed by Geoffrey Garen.
+
+        Rewrite the DFGBlockWorklist.h file as a bunch of typedefs and aliases for things in
+        wtf/GraphNodeWorklist.h. Most users won't notice, except that some small things got
+        renamed. For example PreOrder becomes VisitOrder::Pre and item.block becomes item.node.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBlockWorklist.cpp: Removed.
+        * dfg/DFGBlockWorklist.h:
+        (JSC::DFG::BlockWorklist::notEmpty): Deleted.
+        (JSC::DFG::BlockWith::BlockWith): Deleted.
+        (JSC::DFG::BlockWith::operator bool): Deleted.
+        (JSC::DFG::ExtendedBlockWorklist::ExtendedBlockWorklist): Deleted.
+        (JSC::DFG::ExtendedBlockWorklist::forcePush): Deleted.
+        (JSC::DFG::ExtendedBlockWorklist::push): Deleted.
+        (JSC::DFG::ExtendedBlockWorklist::notEmpty): Deleted.
+        (JSC::DFG::ExtendedBlockWorklist::pop): Deleted.
+        (JSC::DFG::BlockWithOrder::BlockWithOrder): Deleted.
+        (JSC::DFG::BlockWithOrder::operator bool): Deleted.
+        (JSC::DFG::PostOrderBlockWorklist::push): Deleted.
+        (JSC::DFG::PostOrderBlockWorklist::notEmpty): Deleted.
+        * dfg/DFGDominators.cpp:
+        (JSC::DFG::Dominators::compute):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::blocksInPostOrder):
+        * dfg/DFGPrePostNumbering.cpp:
+        (JSC::DFG::PrePostNumbering::compute):
+
+2015-10-21  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        [INTL] Implement Intl.Collator.prototype.resolvedOptions ()
+        https://bugs.webkit.org/show_bug.cgi?id=147601
+
+        Reviewed by Benjamin Poulain.
+
+        This patch implements Intl.Collator.prototype.resolvedOptions() according
+        to the ECMAScript 2015 Internationalization API spec (ECMA-402 2nd edition.)
+        It also implements the abstract operations InitializeCollator, ResolveLocale,
+        LookupMatcher, and BestFitMatcher.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/IntlCollator.h:
+        (JSC::IntlCollator::usage):
+        (JSC::IntlCollator::setUsage):
+        (JSC::IntlCollator::locale):
+        (JSC::IntlCollator::setLocale):
+        (JSC::IntlCollator::collation):
+        (JSC::IntlCollator::setCollation):
+        (JSC::IntlCollator::numeric):
+        (JSC::IntlCollator::setNumeric):
+        (JSC::IntlCollator::sensitivity):
+        (JSC::IntlCollator::setSensitivity):
+        (JSC::IntlCollator::ignorePunctuation):
+        (JSC::IntlCollator::setIgnorePunctuation):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::sortLocaleData):
+        (JSC::searchLocaleData):
+        (JSC::initializeCollator):
+        (JSC::constructIntlCollator):
+        (JSC::callIntlCollator):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototypeFuncResolvedOptions):
+        * runtime/IntlObject.cpp:
+        (JSC::defaultLocale):
+        (JSC::getIntlBooleanOption):
+        (JSC::getIntlStringOption):
+        (JSC::removeUnicodeLocaleExtension):
+        (JSC::lookupMatcher):
+        (JSC::bestFitMatcher):
+        (JSC::resolveLocale):
+        (JSC::lookupSupportedLocales):
+        * runtime/IntlObject.h:
+
+2015-10-21  Saam barati  <sbarati@apple.com>
+
+        C calls in PolymorphicAccess shouldn't assume that the top of the stack looks like a JSC JIT frame and enable *ByIdFlush in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=125711
+
+        Reviewed by Filip Pizlo.
+
+        This patch ensures that anytime we need to make a C call inside
+        PolymorphicAccess, we ensure there is enough space on the stack to do so.
+
+        This patch also enables GetByIdFlush/PutByIdFlush inside the FTL.
+        Because PolymorphicAccess now spills the necessary registers
+        before making a JS/C call, any registers that LLVM report as
+        being in use for the patchpoint will be spilled before making
+        a call by PolymorphicAccess.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::restoreScratch):
+        (JSC::AccessGenerationState::succeed):
+        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerate):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitTypeOf):
+        (JSC::AssemblyHelpers::makeSpaceOnStackForCCall):
+        (JSC::AssemblyHelpers::reclaimSpaceOnStackForCCall):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::webAssemblyCalleeSaveRegisters):
+        (JSC::RegisterSet::registersToNotSaveForJSCall):
+        (JSC::RegisterSet::registersToNotSaveForCCall):
+        (JSC::RegisterSet::allGPRs):
+        (JSC::RegisterSet::registersToNotSaveForCall): Deleted.
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::set):
+        * jit/ScratchRegisterAllocator.cpp:
+        (JSC::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        These methods now take an extra parameter indicating if they
+        should create space for a C call at the top of the stack if
+        there are any reused registers to spill.
+
+        (JSC::ScratchRegisterAllocator::usedRegistersForCall):
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::usedRegisters):
+
+2015-10-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Array previews with Symbol objects have too few preview values
+        https://bugs.webkit.org/show_bug.cgi?id=150404
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.RemoteObject.prototype._appendPropertyPreviews):
+        We should be continuing inside this loop not returning.
+
+2015-10-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Failures in PutStackSinkingPhase should be less severe
+        https://bugs.webkit.org/show_bug.cgi?id=150400
+
+        Reviewed by Geoffrey Garen.
+
+        Make the PutStackSinkingPhase abort instead of asserting. To test that it's OK to not have
+        PutStackSinkingPhase run, this adds a test mode where we run without PutStackSinkingPhase.
+
+        * dfg/DFGPlan.cpp: Make it possible to not run PutStackSinkingPhase for tests.
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPutStackSinkingPhase.cpp: PutStackSinkingPhase should abort instead of asserting, except when validation is enabled.
+        * runtime/Options.h: Add an option for disabling PutStackSinkingPhase.
+
+2015-10-21  Saam barati  <sbarati@apple.com>
+
+        The FTL should place the CallSiteIndex on the call frame for JS calls when it fills in the patchpoint
+        https://bugs.webkit.org/show_bug.cgi?id=150104
+
+        Reviewed by Filip Pizlo.
+
+        We lower JS Calls to patchpoints in LLVM. LLVM may decide to duplicate
+        these patchpoints (or remove them). We eagerly store the CallSiteIndex on the 
+        call frame when lowering DFG to LLVM. But, because the patchpoint we lower to may
+        be duplicated, we really don't know the unique CallSiteIndex until we've
+        actually seen the resulting patchpoints after LLVM has completed its transformations.
+        To solve this, we now store the unique CallSiteIndex on the call frame header 
+        when generating code to fill into the patchpoint.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::JSCall):
+        (JSC::FTL::JSCall::emit):
+        * ftl/FTLJSCall.h:
+        (JSC::FTL::JSCall::stackmapID):
+        * ftl/FTLJSCallBase.cpp:
+        (JSC::FTL::JSCallBase::JSCallBase):
+        (JSC::FTL::JSCallBase::emit):
+        (JSC::FTL::JSCallBase::link):
+        * ftl/FTLJSCallBase.h:
+        * ftl/FTLJSCallVarargs.cpp:
+        (JSC::FTL::JSCallVarargs::JSCallVarargs):
+        (JSC::FTL::JSCallVarargs::numSpillSlotsNeeded):
+        (JSC::FTL::JSCallVarargs::emit):
+        * ftl/FTLJSCallVarargs.h:
+        (JSC::FTL::JSCallVarargs::node):
+        (JSC::FTL::JSCallVarargs::stackmapID):
+        * ftl/FTLJSTailCall.cpp:
+        (JSC::FTL::JSTailCall::JSTailCall):
+        (JSC::FTL::m_instructionOffset):
+        (JSC::FTL::JSTailCall::emit):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callPreflight):
+        (JSC::FTL::DFG::LowerDFGToLLVM::codeOriginDescriptionOfCallSite):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+
+2015-10-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Date creation should share a little code
+        https://bugs.webkit.org/show_bug.cgi?id=150399
+
+        Reviewed by Filip Pizlo.
+
+        I want to fix a bug in this code, but I don't want to fix it in two
+        different places. (See https://bugs.webkit.org/show_bug.cgi?id=150386.)
+
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getOwnPropertySlot):
+        (JSC::milliseconds): Factored out a shared helper function. If you look
+        closely, you'll see that one copy of this code previously checked isfinite
+        while the other checked isnan. isnan returning nan was obviously a no-op,
+        so I removed it. isfinite, it turns out, is also a no-op -- but less
+        obviously so, so I kept it for now.
+
+        (JSC::constructDate):
+        (JSC::dateUTC): Use the helper function.
+
+2015-10-21  Guillaume Emont  <guijemont@igalia.com>
+
+        llint: align stack pointer on mips too
+
+        [MIPS] LLInt: align stack pointer on MIPS too
+        https://bugs.webkit.org/show_bug.cgi?id=150380
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2015-10-20  Mark Lam  <mark.lam@apple.com>
+
+        YarrPatternConstructor::containsCapturingTerms() should not assume that its terms.size() is greater than 0.
+        https://bugs.webkit.org/show_bug.cgi?id=150372
+
+        Reviewed by Geoffrey Garen.
+
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::Yarr::YarrPatternConstructor::optimizeBOL):
+        (JSC::Yarr::YarrPatternConstructor::containsCapturingTerms):
+        (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
+
+2015-10-20  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r191175): OSR Exit from an inlined tail callee trashes callee save registers
+        https://bugs.webkit.org/show_bug.cgi?id=150336
+
+        Reviewed by Mark Lam.
+
+        During OSR exit, we need to restore and transform the active stack into what the baseline
+        JIT expects.  Inlined call frames become true call frames.  When we reify an inlined call
+        frame and it is a tail call which we will be continuing from, we need to restore the tag
+        constant callee save registers with what was saved by the outermost caller.
+
+        Re-enabled tail calls and restored tests for tail calls.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames): Select whether or not we use the callee save tag register
+        contents or what was saved by the inlining caller when populating an inlined callee's
+        callee save registers.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitSaveCalleeSavesFor): This function no longer needs a stack offset.
+        (JSC::AssemblyHelpers::emitSaveOrCopyCalleeSavesFor): New helper.
+        * runtime/Options.h: Turned tail calls back on.
+        * tests/es6.yaml:
+        * tests/stress/dfg-tail-calls.js:
+        (nonInlinedTailCall.callee):
+        * tests/stress/mutual-tail-call-no-stack-overflow.js:
+        (shouldThrow):
+        * tests/stress/tail-call-in-inline-cache.js:
+        (tail):
+        * tests/stress/tail-call-no-stack-overflow.js:
+        (shouldThrow):
+        * tests/stress/tail-call-recognize.js:
+        (callerMustBeRun):
+        * tests/stress/tail-call-varargs-no-stack-overflow.js:
+        (shouldThrow):
+
+2015-10-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JavaScriptCore should parse sourceURL and sourceMappingURL directives
+        https://bugs.webkit.org/show_bug.cgi?id=150096
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::scriptCommentPattern): Deleted.
+        (Inspector::ContentSearchUtilities::findScriptSourceURL): Deleted.
+        (Inspector::ContentSearchUtilities::findScriptSourceMapURL): Deleted.
+        * inspector/ContentSearchUtilities.h:
+        No longer need to search script content.
+
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchDidParseSource):
+        Carry over the sourceURL and sourceMappingURL from the SourceProvider.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::sourceMapURLForScript):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        No longer do content searching.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::setCode):
+        (JSC::Lexer<T>::skipWhitespace):
+        (JSC::Lexer<T>::parseCommentDirective):
+        (JSC::Lexer<T>::parseCommentDirectiveValue):
+        (JSC::Lexer<T>::consume):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::sourceURL):
+        (JSC::Lexer::sourceMappingURL):
+        (JSC::Lexer::sourceProvider): Deleted.
+        Give lexer the ability to detect script comment directives.
+        This just consumes characters in single line comments and
+        ultimately sets the sourceURL or sourceMappingURL found.
+
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::url):
+        (JSC::SourceProvider::sourceURL):
+        (JSC::SourceProvider::sourceMappingURL):
+        (JSC::SourceProvider::setSourceURL):
+        (JSC::SourceProvider::setSourceMappingURL):
+        After parsing a script, update the Source Provider with the
+        value of directives that may have been found in the script.
+
+2015-10-20  Saam barati  <sbarati@apple.com>
+
+        GCAwareJITStubRoutineWithExceptionHandler has a stale CodeBlock pointer in its destructor
+        https://bugs.webkit.org/show_bug.cgi?id=150351
+
+        Reviewed by Mark Lam.
+
+        We may regenerate many GCAwareJITStubRoutineWithExceptionHandler stubs per one PolymorphicAccess.
+        Only the last GCAwareJITStubRoutineWithExceptionHandler stub that was generated will get the CodeBlock's aboutToDie()
+        notification. All other GCAwareJITStubRoutineWithExceptionHandler stubs will still be holding a stale CodeBlock pointer
+        that they will use in their destructor. The solution is to have GCAwareJITStubRoutineWithExceptionHandler remove its
+        exception handler in observeZeroRefCount() instead of its destructor. observeZeroRefCount() will run when a PolymorphicAccess
+        replaces its m_stubRoutine.
+
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutineWithExceptionHandler::aboutToDie):
+        (JSC::GCAwareJITStubRoutineWithExceptionHandler::observeZeroRefCount):
+        (JSC::createJITStubRoutine):
+        (JSC::GCAwareJITStubRoutineWithExceptionHandler::~GCAwareJITStubRoutineWithExceptionHandler): Deleted.
+        * jit/GCAwareJITStubRoutine.h:
+
+2015-10-20  Tim Horton  <timothy_horton@apple.com>
+
+        Try to fix the build by disabling MAC_GESTURE_EVENTS on 10.9 and 10.10
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-10-20  Xabier Rodriguez Calvar  <calvaris@igalia.com>
+
+        [Streams API] Rework some readable stream internals that can be common to writable streams
+        https://bugs.webkit.org/show_bug.cgi?id=150133
+
+        Reviewed by Darin Adler.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Added RangeError also as native functions.
+
+2015-10-20  Yoav Weiss  <yoav@yoav.ws>
+
+        Rename the PICTURE_SIZES flag to CURRENTSRC
+        https://bugs.webkit.org/show_bug.cgi?id=150275
+
+        Reviewed by Dean Jackson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-10-19  Saam barati  <sbarati@apple.com>
+
+        FTL should generate a unique OSR exit for each duplicated OSR exit stackmap intrinsic.
+        https://bugs.webkit.org/show_bug.cgi?id=149970
+
+        Reviewed by Filip Pizlo.
+
+        When we lower DFG to LLVM, we generate a stackmap intrnsic for OSR 
+        exits. We also recorded the OSR exit inside FTL::JITCode during lowering.
+        This stackmap intrinsic may be duplicated or even removed by LLVM.
+        When the stackmap intrinsic is duplicated, we used to generate just
+        a single OSR exit data structure. Then, when we compiled an OSR exit, we 
+        would look for the first record in the record list that had the same stackmap ID
+        as what the OSR exit data structure had. We did this even when the OSR exit
+        stackmap intrinsic was duplicated. This would lead us to grab the wrong FTL::StackMaps::Record.
+
+        Now, each OSR exit knows exactly which FTL::StackMaps::Record it corresponds to.
+        We accomplish this by having an OSRExitDescriptor that is recorded during
+        lowering. Each descriptor may be referenced my zero, one, or more OSRExits.
+        Now, no more than one stackmap intrinsic corresponds to the same index inside 
+        JITCode's OSRExit Vector. Also, each OSRExit jump now jumps to a code location.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::validateReferences):
+        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * ftl/FTLJITCode.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIsUndefined):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callStackmap):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
+        (JSC::FTL::OSRExitDescriptor::validateReferences):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::validateReferences): Deleted.
+        * ftl/FTLOSRExit.h:
+        (JSC::FTL::OSRExit::considerAddingAsFrequentExitSite):
+        * ftl/FTLOSRExitCompilationInfo.h:
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLStackMaps.cpp:
+        (JSC::FTL::StackMaps::computeRecordMap):
+        * ftl/FTLStackMaps.h:
+
+2015-10-16  Brian Burg  <bburg@apple.com>
+
+        Unify handling of JavaScriptCore scripts that are used in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=150245
+
+        Reviewed by Alex Christensen.
+
+        Move all standalone JavaScriptCore scripts that are used by WebCore into the
+        JavaScriptCore/Scripts directory. Use JavaScriptCore_SCRIPTS_DIR to refer
+        to the path for these scripts.
+
+        * DerivedSources.make:
+
+            Define and use JavaScriptCore_SCRIPTS_DIR.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+            Make a new group in the Xcode project and clean up references.
+
+        * PlatformWin.cmake:
+
+            For Windows, copy these scripts over to ForwardingHeaders/Scripts since they
+            cannot be used directly from JAVASCRIPTCORE_DIR in AppleWin builds. Do the same
+            thing for both Windows variants to be consistent about it.
+
+        * Scripts/cssmin.py: Renamed from Source/JavaScriptCore/inspector/scripts/cssmin.py.
+        * Scripts/generate-combined-inspector-json.py: Renamed from Source/JavaScriptCore/inspector/scripts/generate-combined-inspector-json.py.
+        * Scripts/generate-js-builtins: Renamed from Source/JavaScriptCore/generate-js-builtins.
+        * Scripts/inline-and-minify-stylesheets-and-scripts.py: Renamed from Source/JavaScriptCore/inspector/scripts/inline-and-minify-stylesheets-and-scripts.py.
+        * Scripts/jsmin.py: Renamed from Source/JavaScriptCore/inspector/scripts/jsmin.py.
+        * Scripts/xxd.pl: Renamed from Source/JavaScriptCore/inspector/scripts/xxd.pl.
+
+2015-10-19  Tim Horton  <timothy_horton@apple.com>
+
+        Try to fix the iOS build
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-10-17  Keith Miller  <keith_miller@apple.com>
+
+        Add regression tests for TypedArray.prototype functions' error messages.
+        https://bugs.webkit.org/show_bug.cgi?id=150288
+
+        Reviewed by Darin Adler.
+
+        Fix a typo in the text passed by TypedArrray.prototype.filter type error message.
+        Add tests that check the actual error message text for all the TypeArray.prototype
+        functions that throw.
+
+        * builtins/TypedArray.prototype.js:
+        (filter):
+        * tests/stress/typedarray-every.js:
+        * tests/stress/typedarray-filter.js:
+        * tests/stress/typedarray-find.js:
+        * tests/stress/typedarray-findIndex.js:
+        * tests/stress/typedarray-forEach.js:
+        * tests/stress/typedarray-map.js:
+        * tests/stress/typedarray-reduce.js:
+        * tests/stress/typedarray-reduceRight.js:
+        * tests/stress/typedarray-some.js:
+
+2015-10-19  Tim Horton  <timothy_horton@apple.com>
+
+        Add magnify and rotate gesture event support for Mac
+        https://bugs.webkit.org/show_bug.cgi?id=150179
+        <rdar://problem/8036240>
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+        New feature flag.
+
+2015-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the ENABLE(WEBASSEMBLY) build after r190827
+        https://bugs.webkit.org/show_bug.cgi?id=150330
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Removed the duplicated VM argument.
+        * bytecode/CodeBlock.h:
+        (JSC::WebAssemblyCodeBlock::create): Added new parameters to finishCreation() calls.
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock): Change VM parameter to pointer to match *CodeBlock classes.
+        * runtime/Executable.cpp:
+        (JSC::WebAssemblyExecutable::prepareForExecution): Removed extra ")" and pass pointer as it is expected.
+
+2015-10-19  Mark Lam  <mark.lam@apple.com>
+
+        DoubleRep fails to convert SpecBoolean values.
+        https://bugs.webkit.org/show_bug.cgi?id=150313
+
+        Reviewed by Geoffrey Garen.
+
+        This was uncovered by the op_sub stress test on 32-bit builds.  On 32-bit builds,
+        DoubleRep will erroneously convert 'true' to a 'NaN' instead of a double 1.
+        On 64-bit, the same issue exists but is masked by another bug in DoubleRep where
+        boolean values will always erroneously trigger a BadType OSR exit.
+
+        The erroneous conversion of 'true' to 'NaN' is because the 'true' case in
+        compileDoubleRep() is missing a jump to the "done" destination.  Instead, it
+        fall through to the "isUndefined" case where it produces a NaN.
+
+        The 64-bit erroneous BadType OSR exit is due to the boolean type check being
+        implemented incorrectly.  It was checking if any bits other than bit 0 were set.
+        However, boolean JS values always have TagBitBool (the 3rd bit) set.  Hence, the
+        check will always fail if we have a boolean value.
+
+        This patch fixes both of these issues.
+
+        No new test is needed because these issues are already covered by scenarios in
+        the op_sub.js stress test.  This patch also fixes the op_sub.js test to throw an
+        exception if any failures are encountered (as expected by the stress test
+        harness).  This patch also re-worked the test code to provide more accurate
+        descriptions of each test scenario for error reporting.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+
+        * tests/stress/op_sub.js:
+        (generateScenarios):
+        (func):
+        (initializeTestCases):
+        (runTest):
+        (stringify): Deleted.
+
+2015-10-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Drop !newTarget check since it always becomes true
+        https://bugs.webkit.org/show_bug.cgi?id=150308
+
+        Reviewed by Geoffrey Garen.
+
+        In a context of calling a constructor, `newTarget` should not become JSEmpty.
+        So `!newTarget` always becomes true. This patch drops this unneccessary check.
+        And to ensure the implementation of the constructor is only called under
+        the context of calling it as a constructor, we change these functions to
+        static and only use them for constructor implementations of InternalFunction.
+
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        (JSC::callIntlCollator):
+        * runtime/IntlCollatorConstructor.h:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        (JSC::callIntlDateTimeFormat):
+        * runtime/IntlDateTimeFormatConstructor.h:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        (JSC::callIntlNumberFormat):
+        * runtime/IntlNumberFormatConstructor.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+
+2015-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Promise constructor should throw when not called with "new"
+        https://bugs.webkit.org/show_bug.cgi?id=149380
+
+        Reviewed by Darin Adler.
+
+        Implement handling new.target in Promise constructor. And
+        prohibiting Promise constructor call without "new".
+
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        (JSC::callPromise):
+        (JSC::JSPromiseConstructor::getCallData):
+        * tests/es6.yaml:
+        * tests/stress/promise-cannot-be-called.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (Deferred):
+        (super):
+
+2015-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Handle asynchronous tests in tests/es6
+        https://bugs.webkit.org/show_bug.cgi?id=150293
+
+        Reviewed by Darin Adler.
+
+        Since JSC can handle microtasks, some of ES6 Promise tests can be executed under the JSC shell.
+        Some of them still fail because it uses setTimeout that invokes macrotasks with explicit delay.
+
+        * tests/es6.yaml:
+        * tests/es6/Promise_Promise.all.js:
+        (test.asyncTestPassed):
+        (test):
+        * tests/es6/Promise_Promise.all_generic_iterables.js:
+        (test.asyncTestPassed):
+        (test):
+        * tests/es6/Promise_Promise.race.js:
+        (test.asyncTestPassed):
+        (test):
+        * tests/es6/Promise_Promise.race_generic_iterables.js:
+        (test.asyncTestPassed):
+        (test):
+        * tests/es6/Promise_basic_functionality.js:
+        (test.asyncTestPassed):
+        (test):
+        * tests/es6/Promise_is_subclassable_Promise.all.js:
+        (test.asyncTestPassed):
+        (test):
+        * tests/es6/Promise_is_subclassable_Promise.race.js:
+        (test.asyncTestPassed):
+        (test):
+        * tests/es6/Promise_is_subclassable_basic_functionality.js:
+        (test.asyncTestPassed):
+        (test):
+
+2015-10-18  Sungmann Cho  <sungmann.cho@navercorp.com>
+
+        [Win] Fix the Windows builds.
+        https://bugs.webkit.org/show_bug.cgi?id=150300
+
+        Reviewed by Darin Adler.
+
+        Add missing files to JavaScriptCore.vcxproj.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix some generational heap growth pathologies
+        https://bugs.webkit.org/show_bug.cgi?id=150270
+
+        Reviewed by Andreas Kling.
+
+        When doing generational copying, we would pretend that the size of old space was increased
+        just by the amount of bytes we copied. In reality, it would be increased by the number of
+        bytes used by the copied blocks we created. This is a larger number, and in some simple
+        pathological programs, the difference can be huge.
+
+        Fixing this bug was relatively easy, and the only really meaningful change here is in
+        Heap::updateAllocationLimits(). But to convince myself that the change was valid, I had to
+        add some debugging code and I had to refactor some stuff so that it made more sense.
+
+        This change does obviate the need for m_totalBytesCopied, because we no longer use it in
+        release builds to decide how much heap we are using at the end of collection. But I added a
+        FIXME about how we could restore our use of m_totalBytesCopied. So, I kept the logic, for
+        now. The FIXME references https://bugs.webkit.org/show_bug.cgi?id=150268.
+
+        Relanding with build fix.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopiedBlock.cpp: Added.
+        (JSC::CopiedBlock::createNoZeroFill):
+        (JSC::CopiedBlock::destroy):
+        (JSC::CopiedBlock::create):
+        (JSC::CopiedBlock::zeroFillWilderness):
+        (JSC::CopiedBlock::CopiedBlock):
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::didSurviveGC):
+        (JSC::CopiedBlock::createNoZeroFill): Deleted.
+        (JSC::CopiedBlock::destroy): Deleted.
+        (JSC::CopiedBlock::create): Deleted.
+        (JSC::CopiedBlock::zeroFillWilderness): Deleted.
+        (JSC::CopiedBlock::CopiedBlock): Deleted.
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::startedCopying):
+        * heap/Heap.cpp:
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::resetVisitors):
+        (JSC::Heap::capacity):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::sizeAfterCollect): Deleted.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+
+2015-10-17  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r191240.
+        https://bugs.webkit.org/show_bug.cgi?id=150281
+
+        Broke 32-bit builds (Requested by smfr on #webkit).
+
+        Reverted changeset:
+
+        "Fix some generational heap growth pathologies"
+        https://bugs.webkit.org/show_bug.cgi?id=150270
+        http://trac.webkit.org/changeset/191240
+
+2015-10-17  Sungmann Cho  <sungmann.cho@navercorp.com>
+
+        [Win] Fix the Windows build.
+        https://bugs.webkit.org/show_bug.cgi?id=150278
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-10-17  Mark Lam  <mark.lam@apple.com>
+
+        Fixed typos from r191224.
+
+        Not reviewed.
+
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::generateFastPath):
+
+2015-10-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix some generational heap growth pathologies
+        https://bugs.webkit.org/show_bug.cgi?id=150270
+
+        Reviewed by Andreas Kling.
+
+        When doing generational copying, we would pretend that the size of old space was increased
+        just by the amount of bytes we copied. In reality, it would be increased by the number of
+        bytes used by the copied blocks we created. This is a larger number, and in some simple
+        pathological programs, the difference can be huge.
+
+        Fixing this bug was relatively easy, and the only really meaningful change here is in
+        Heap::updateAllocationLimits(). But to convince myself that the change was valid, I had to
+        add some debugging code and I had to refactor some stuff so that it made more sense.
+
+        This change does obviate the need for m_totalBytesCopied, because we no longer use it in
+        release builds to decide how much heap we are using at the end of collection. But I added a
+        FIXME about how we could restore our use of m_totalBytesCopied. So, I kept the logic, for
+        now. The FIXME references https://bugs.webkit.org/show_bug.cgi?id=150268.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopiedBlock.cpp: Added.
+        (JSC::CopiedBlock::createNoZeroFill):
+        (JSC::CopiedBlock::destroy):
+        (JSC::CopiedBlock::create):
+        (JSC::CopiedBlock::zeroFillWilderness):
+        (JSC::CopiedBlock::CopiedBlock):
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::didSurviveGC):
+        (JSC::CopiedBlock::createNoZeroFill): Deleted.
+        (JSC::CopiedBlock::destroy): Deleted.
+        (JSC::CopiedBlock::create): Deleted.
+        (JSC::CopiedBlock::zeroFillWilderness): Deleted.
+        (JSC::CopiedBlock::CopiedBlock): Deleted.
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::startedCopying):
+        * heap/Heap.cpp:
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::resetVisitors):
+        (JSC::Heap::capacity):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::sizeAfterCollect): Deleted.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::shouldCollect):
+        (JSC::Heap::isBusy):
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+
+2015-10-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement String.prototype.normalize
+        https://bugs.webkit.org/show_bug.cgi?id=150094
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements String.prototype.normalize leveraging ICU.
+        It can provide the feature applying {NFC, NFD, NFKC, NFKD} normalization to a given string.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::normalize):
+        (JSC::stringProtoFuncNormalize):
+        * tests/es6.yaml:
+        * tests/stress/string-normalize.js: Added.
+        (unicode):
+        (shouldBe):
+        (shouldThrow):
+        (normalizeTest):
+
+2015-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Update JavaScriptCore API docs
+        https://bugs.webkit.org/show_bug.cgi?id=150262
+
+        Reviewed by Mark Lam.
+
+        Apply some edits for clarity. These came out of a docs review.
+
+        * API/JSContext.h:
+        * API/JSExport.h:
+        * API/JSManagedValue.h:
+        * API/JSValue.h:
+
+2015-10-16  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed. Fix typo in TypeError messages in TypedArray.prototype.forEach/filter.
+
+        * builtins/TypedArray.prototype.js:
+        (forEach):
+        (filter):
+
+2015-10-16  Mark Lam  <mark.lam@apple.com>
+
+        Use JITSubGenerator to support UntypedUse operands for op_sub in the DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=150038
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isUntypedSpeculationForArithmetic): Added
+        - Also fixed some comments.
+        
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::resultType):
+        * dfg/DFGAbstractValue.h:
+        - Added function to compute the ResultType of an operand from its SpeculatedType.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        - Fix up ArithSub to speculate its operands to be numbers.  But if an OSR exit
+          due to a BadType was seen at this node, we'll fix it up to expect UntypedUse
+          operands.  This gives the generated code a change to run fast if it only
+          receives numeric operands.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateUntypedForArithmetic):
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        - Add the C++ runtime function to implement op_sub when we really encounter the
+          hard types in the operands.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        - Added support for UntypedUse operands using the JITSubGenerator.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::SpeculativeJIT::pickCanTrample):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        - Just refuse to FTL compile functions with UntypedUse op_sub operands for now.
+
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::boxDouble):
+        (JSC::AssemblyHelpers::unboxDoubleNonDestructive):
+        (JSC::AssemblyHelpers::unboxDouble):
+        (JSC::AssemblyHelpers::boxBooleanPayload):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_sub):
+
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::generateFastPath):
+        (JSC::JITSubGenerator::endJumpList):
+        - Added some asserts to document the contract that this generator expects in
+          terms of its incoming registers.
+
+          Also fixed the generated code to not be destructive with regards to incoming
+          registers.  The DFG expects this.
+
+          Also added an endJumpList so that we don't have to jump twice for the fast
+          path where both operands are ints.
+
+        * parser/ResultType.h:
+        (JSC::ResultType::ResultType):
+        - Make the internal Type bits and the constructor private.  Clients should only
+          create ResultType values using one of the provided factory methods.
+
+        * tests/stress/op_sub.js: Added.
+        (o1.valueOf):
+        (stringify):
+        (generateScenarios):
+        (printScenarios):
+        (testCases.func):
+        (func):
+        (initializeTestCases):
+        (runTest):
+        - test op_sub results by comparing one LLINT result against the output of
+          multiple LLINT, and JIT runs.  This test assume that we'll at least get the
+          right result some of the time (if not all the time), and confirms that the
+          various engines produce consistent results for all the various value pairs
+          being tested.
+
+2015-10-15  Filip Pizlo  <fpizlo@apple.com>
+
+        CopyBarrier must be avoided for slow TypedArrays
+        https://bugs.webkit.org/show_bug.cgi?id=150217
+        rdar://problem/23128791
+
+        Reviewed by Michael Saboff.
+
+        Change how we access array buffer views so that we don't fire the barrier slow path, and
+        don't mask off the spaceBits, if the view is not FastTypedArray. That's because in that case
+        m_vector could be misaligned and so have meaningful non-space data in the spaceBits. Also in
+        that case, m_vector does not point into copied space.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadVectorWithBarrier):
+        (JSC::FTL::DFG::LowerDFGToLLVM::copyBarrier):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isInToSpace):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadButterflyReadOnly):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadVectorReadOnly):
+        (JSC::FTL::DFG::LowerDFGToLLVM::removeSpaceBits):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isFastTypedArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::baseIndex):
+        * heap/CopyBarrier.h:
+        (JSC::CopyBarrierBase::getWithoutBarrier):
+        (JSC::CopyBarrierBase::getPredicated):
+        (JSC::CopyBarrierBase::get):
+        (JSC::CopyBarrierBase::copyState):
+        (JSC::CopyBarrier::get):
+        (JSC::CopyBarrier::getPredicated):
+        (JSC::CopyBarrier::set):
+        * heap/Heap.cpp:
+        (JSC::Heap::copyBarrier):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::branchIfNotType):
+        (JSC::AssemblyHelpers::branchIfFastTypedArray):
+        (JSC::AssemblyHelpers::branchIfNotFastTypedArray):
+        (JSC::AssemblyHelpers::loadTypedArrayVector):
+        (JSC::AssemblyHelpers::purifyNaN):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchStructure):
+        (JSC::AssemblyHelpers::branchIfToSpace):
+        (JSC::AssemblyHelpers::branchIfNotToSpace):
+        (JSC::AssemblyHelpers::removeSpaceBits):
+        (JSC::AssemblyHelpers::addressForByteOffset):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::vector):
+        (JSC::JSArrayBufferView::length):
+        * runtime/JSArrayBufferViewInlines.h:
+        (JSC::JSArrayBufferView::byteOffset):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::typedVector):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore):
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        * tests/stress/misaligned-int8-view-byte-offset.js: Added.
+        * tests/stress/misaligned-int8-view-read.js: Added.
+        * tests/stress/misaligned-int8-view-write.js: Added.
+
+2015-10-16  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed. Build fix for 191215.
+
+        * jit/IntrinsicEmitter.cpp:
+
+2015-10-16  Keith Miller  <keith@Keiths-MacBook-Pro-5.local>
+
+        Add Intrinsic Getters and use them to fix performance on the getters of TypedArray properties.
+        https://bugs.webkit.org/show_bug.cgi?id=149687
+
+        Reviewed by Geoffrey Garen.
+
+        Add the ability to create intrinsic getters in both the inline cache and the DFG/FTL. When the
+        getter fetched by a GetById has an intrinsic we know about we add a new intrinsic access case.
+        Once we get to the DFG, we observe that the access case was an intrinsic and add an appropriate
+        GetByIdVariant. We then parse the intrinsic into an appropriate DFG node.
+
+        The first intrinsics are the new TypedArray prototype getters length, byteLength, and byteOffset.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::GetByIdVariant):
+        (JSC::GetByIdVariant::operator=):
+        (JSC::GetByIdVariant::canMergeIntrinsicStructures):
+        (JSC::GetByIdVariant::attemptToMerge):
+        (JSC::GetByIdVariant::dumpInContext):
+        * bytecode/GetByIdVariant.h:
+        (JSC::GetByIdVariant::intrinsicFunction):
+        (JSC::GetByIdVariant::intrinsic):
+        (JSC::GetByIdVariant::callLinkStatus): Deleted.
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::addWatchpoint):
+        (JSC::AccessGenerationState::restoreScratch):
+        (JSC::AccessGenerationState::succeed):
+        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
+        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCall):
+        (JSC::AccessGenerationState::restoreLiveRegistersFromStackForCall):
+        (JSC::AccessGenerationState::restoreLiveRegistersFromStackForCallWithThrownException):
+        (JSC::AccessGenerationState::callSiteIndexForExceptionHandlingOrOriginal):
+        (JSC::AccessGenerationState::originalExceptionHandler):
+        (JSC::AccessGenerationState::originalCallSiteIndex):
+        (JSC::AccessCase::getIntrinsic):
+        (JSC::AccessCase::clone):
+        (JSC::AccessCase::visitWeak):
+        (JSC::AccessCase::generate):
+        (WTF::printInternal):
+        (JSC::AccessCase::AccessCase): Deleted.
+        (JSC::AccessCase::get): Deleted.
+        (JSC::AccessCase::replace): Deleted.
+        (JSC::AccessCase::transition): Deleted.
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::isGet):
+        (JSC::AccessCase::isPut):
+        (JSC::AccessCase::isIn):
+        (JSC::AccessCase::intrinsicFunction):
+        (JSC::AccessCase::intrinsic):
+        (JSC::AccessGenerationState::AccessGenerationState):
+        (JSC::AccessGenerationState::liveRegistersForCall):
+        (JSC::AccessGenerationState::callSiteIndexForExceptionHandling):
+        (JSC::AccessGenerationState::numberOfStackBytesUsedForRegisterPreservation):
+        (JSC::AccessGenerationState::needsToRestoreRegistersIfException):
+        (JSC::AccessGenerationState::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * bytecode/PutByIdVariant.h:
+        (JSC::PutByIdVariant::intrinsic):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        (JSC::DFG::arrayTypeToString):
+        (JSC::DFG::toTypedArrayType):
+        (JSC::DFG::refineTypedArrayType):
+        (JSC::DFG::permitsBoundsCheckLowering):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::supportsLength):
+        (JSC::DFG::ArrayMode::isSomeTypedArrayView):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        (JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
+        (JSC::DFG::ByteCodeParser::load):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::presenceLike): Deleted.
+        (JSC::DFG::ByteCodeParser::store): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::convertToGetArrayLength): Deleted.
+        (JSC::DFG::FixupPhase::prependGetArrayLength): Deleted.
+        (JSC::DFG::FixupPhase::fixupChecksInBlock): Deleted.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetFoldableView):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetArrayLength):
+        * jit/IntrinsicEmitter.cpp: Added.
+        (JSC::AccessCase::canEmitIntrinsicGetter):
+        (JSC::AccessCase::emitIntrinsicGetter):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        * runtime/Intrinsic.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::put):
+        (JSC::JSArrayBufferView::defineOwnProperty):
+        (JSC::JSArrayBufferView::deleteProperty):
+        (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
+        (JSC::JSArrayBufferView::getOwnPropertySlot): Deleted.
+        (JSC::JSArrayBufferView::finalize): Deleted.
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::getOwnPropertySlot):
+        (JSC::JSDataView::put):
+        (JSC::JSDataView::defineOwnProperty):
+        (JSC::JSDataView::deleteProperty):
+        (JSC::JSDataView::getOwnNonIndexPropertyNames):
+        * runtime/JSDataView.h:
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::intrinsic):
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex): Deleted.
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren): Deleted.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectNativeIntrinsicGetter):
+        * runtime/JSObject.h:
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        * tests/stress/typedarray-add-property-to-base-object.js: Added.
+        (body.foo):
+        (body):
+        * tests/stress/typedarray-bad-getter.js: Added.
+        (body.foo):
+        (body.get Bar):
+        (body):
+        * tests/stress/typedarray-getter-on-self.js: Added.
+        (body.foo):
+        (body.bar):
+        (body.baz):
+        (body.get for):
+        (body):
+        * tests/stress/typedarray-intrinsic-getters-change-prototype.js: Added.
+        (body.foo):
+        (body.bar):
+        (body.baz):
+        (body):
+
+2015-10-16  Keith Miller  <keith_miller@apple.com>
+
+        Fix some issues with TypedArrays
+        https://bugs.webkit.org/show_bug.cgi?id=150216
+
+        Reviewed by Geoffrey Garen.
+
+        This fixes a couple of issues:
+        1) The DFG had a separate case for creating new typedarrays in the dfg when the first argument is an object.
+           Since the code for creating a Typedarray in the dfg is almost the same as the code in Baseline/LLInt
+           the two cases have been merged.
+        2) If the length property on an object was unset then the construction could crash.
+        3) The TypedArray.prototype.set function and the TypedArray constructor should not call [[Get]] for the
+           length of the source object when the source object is a TypedArray.
+        4) The conditions that were used to decide if the iterator could be skipped were incorrect.
+           Instead of checking for have a bad time we should have checked the Indexing type did not allow for
+           indexed accessors.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        (JSC::constructGenericTypedArrayViewWithFirstArgument): Deleted.
+
+2015-10-16  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-10-16  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r191175): Still crashing when clicking back button on netflix.com
+        https://bugs.webkit.org/show_bug.cgi?id=150251
+
+        Rubber stamped by Filip Pizlo.
+
+        Turning off Tail Calls and disabling tests until the crash is fixed.
+
+        * runtime/Options.h:
+        * tests/es6.yaml:
+        * tests/stress/dfg-tail-calls.js:
+        (nonInlinedTailCall.callee):
+        * tests/stress/mutual-tail-call-no-stack-overflow.js:
+        (shouldThrow):
+        * tests/stress/tail-call-in-inline-cache.js:
+        (tail):
+        * tests/stress/tail-call-no-stack-overflow.js:
+        (shouldThrow):
+        * tests/stress/tail-call-recognize.js:
+        (callerMustBeRun):
+        * tests/stress/tail-call-varargs-no-stack-overflow.js:
+        (shouldThrow):
+
+2015-10-16  Mark Lam  <mark.lam@apple.com>
+
+        Add MacroAssembler::callProbe() for supporting lambda JIT probes.
+        https://bugs.webkit.org/show_bug.cgi?id=150186
+
+        Reviewed by Geoffrey Garen.
+
+        With callProbe(), we can now make probes that are lambdas.  For example, we can
+        now conveniently add probes like so: 
+
+            // When you know exactly which register you want to inspect:
+            jit.callProbe([] (MacroAssembler::ProbeContext* context) {
+                intptr_t value = reinterpret_cast<intptr_t>(context->cpu.eax);
+                dataLogF("eax %p\n", context->cpu.eax); // Inspect the register.
+                ASSERT(value > 10); // Add test code for debugging.
+            });
+
+            // When you want to inspect whichever register the JIT allocated:
+            auto reg = op1.gpr();
+            jit.callProbe([reg] (MacroAssembler::ProbeContext* context) {
+                intptr_t value = reinterpret_cast<intptr_t>(context->gpr(reg));
+                dataLogF("reg %s: %ld\n", context->gprName(reg), value);
+                ASSERT(value > 10);
+            });
+
+        callProbe() is only meant to be used for debugging sessions.  It is not
+        appropriate to use it in permanent code (even for debug builds).
+        This is because:
+        1. The probe mechanism saves and restores all (and I really mean "all")
+           registers, and is inherently slow.
+        2. callProbe() currently works by allocating (via new) a std::function to
+           guarantee that it is persisted for the duration that the JIT generated code is
+           live.  We don't currently delete it ever i.e. it leaks a bit of memory each
+           time the JIT generates code that contains such a lambda probe.
+
+        These limitations are acceptable for a debugging session (assuming you're not
+        debugging a memory leak), but not for deployment code.  If there's a need, we can
+        plug that leak in another patch.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CPUState::fpr):
+        - Removed an unnecessary empty line.
+        (JSC::AbstractMacroAssembler::ProbeContext::gpr):
+        (JSC::AbstractMacroAssembler::ProbeContext::fpr):
+        (JSC::AbstractMacroAssembler::ProbeContext::gprName):
+        (JSC::AbstractMacroAssembler::ProbeContext::fprName):
+        - Added some convenience functions that will make using the probe mechanism
+          easier.
+
+        * assembler/MacroAssembler.cpp:
+        (JSC::StdFunctionData::StdFunctionData):
+        (JSC::stdFunctionCallback):
+        (JSC::MacroAssembler::callProbe):
+        * assembler/MacroAssembler.h:
+
+2015-10-16  Andreas Kling  <akling@apple.com>
+
+        Remove unused StructureRareData::m_cachedGenericPropertyNameEnumerator.
+        <https://webkit.org/b/150244>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove an unused field from StructureRareData.
+
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::visitChildren): Deleted.
+        * runtime/StructureRareData.h:
+
+2015-10-16  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, rolling out r191190.
+
+        Patch needs some design changes.
+
+        Reverted changeset:
+
+        "Fix some issues with TypedArrays"
+        https://bugs.webkit.org/show_bug.cgi?id=150216
+        http://trac.webkit.org/changeset/191190
+
+2015-10-16  Mark Lam  <mark.lam@apple.com>
+
+        Move all the probe trampolines into their respective MacroAssembler files.
+        https://bugs.webkit.org/show_bug.cgi?id=150239
+
+        Reviewed by Saam Barati.
+
+        This patch does not introduce any behavior changes.  It only moves the
+        ctiMasmProbeTrampoline implementations from the respective JITStubs<CPU>.h
+        files to the corresponding MacroAssembler<CPU>.cpp files. 
+
+        I also had to make some minor changes to get the code to build after this move:
+        1. Added #include <wtf/InlineASM.h> in the MacroAssembler<CPU>.cpp files
+           because the ctiMasmProbeTrampoline is an inline assembly blob.
+        2. In the moved code, convert MacroAssembler:: qualifiers to the CPU specific
+           MacroAssembler equivalent.  The referenced entities were always defined in
+           the CPU specific MacroAssembler anyway, and indirectly referenced through
+           the generic MacroAssembler.
+
+        With this, we can get rid of all the JITStubs<CPU>.cpp files.  There is one
+        exception: JITStubsMSVC64.asm.  However, that one is unrelated to the probe
+        mechanism.  So, I'll leave it as is.
+
+        We can also remove JITStubs.cpp and JITStubs.h which are now empty except for
+        some stale unused code.
+
+        This patch has been build tested for x86, x86_64, armv7, and arm64.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::probe):
+        * assembler/MacroAssemblerARM64.cpp:
+        (JSC::arm64ProbeTrampoline):
+        (JSC::MacroAssemblerARM64::probe):
+        * assembler/MacroAssemblerARMv7.cpp:
+        (JSC::MacroAssemblerARMv7::probe):
+        * assembler/MacroAssemblerX86Common.cpp:
+        * bytecode/CodeBlock.cpp:
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLLink.cpp:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITCode.h:
+        * jit/JITExceptions.cpp:
+        * jit/JITStubs.cpp: Removed.
+        * jit/JITStubs.h: Removed.
+        * jit/JITStubsARM.h: Removed.
+        * jit/JITStubsARM64.h: Removed.
+        * jit/JITStubsARMv7.h: Removed.
+        * jit/JITStubsX86.h: Removed.
+        * jit/JITStubsX86Common.h: Removed.
+        * jit/JITStubsX86_64.h: Removed.
+        * jit/JSInterfaceJIT.h:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * runtime/CommonSlowPaths.cpp:
+
+2015-10-16  Keith Miller  <keith_miller@apple.com>
+
+        Fix some issues with TypedArrays
+        https://bugs.webkit.org/show_bug.cgi?id=150216
+
+        Reviewed by Michael Saboff.
+
+        This fixes a couple of issues:
+        1) The DFG had a separate case for creating new typedarrays in the dfg when the first argument is an object.
+           Since the code for creating a Typedarray in the dfg is almost the same as the code in Baseline/LLInt
+           the two cases have been merged.
+        2) If the length property on an object was unset then the construction could crash.
+        3) The TypedArray.prototype.set function and the TypedArray constructor should not call [[Get]] for the
+           length of the source object when the source object is a TypedArray.
+        4) The conditions that were used to decide if the iterator could be skipped were incorrect.
+           Instead of checking for have a bad time we should have checked the Indexing type did not allow for
+           indexed accessors.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::newTypedArrayWithOneArgument): Deleted.
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayViewWithFirstArgument):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        * tests/stress/typedarray-construct-iterator.js: Added.
+        (iterator.return.next):
+        (iterator):
+        (body):
+
+2015-10-15  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r190289): Repro crash clicking back button on netflix.com
+        https://bugs.webkit.org/show_bug.cgi?id=150220
+
+        Reviewed by Geoffrey Garen.
+
+        Since constructors check for a valid new "this" object and return it, we can't make
+        a tail call to another function from within a constructor.
+
+        Re-enabled the tail calls and the related tail call tests.
+
+        Did some other miscellaneous clean up in the tail call code as part of the debugging.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::callPreflight):
+        * interpreter/Interpreter.h:
+        (JSC::calleeFrameForVarargs):
+        * runtime/Options.h:
+        * tests/es6.yaml:
+        * tests/stress/dfg-tail-calls.js:
+        (nonInlinedTailCall.callee):
+        * tests/stress/mutual-tail-call-no-stack-overflow.js:
+        (shouldThrow):
+        * tests/stress/tail-call-in-inline-cache.js:
+        (tail):
+        * tests/stress/tail-call-no-stack-overflow.js:
+        (shouldThrow):
+        * tests/stress/tail-call-recognize.js:
+        (callerMustBeRun):
+        * tests/stress/tail-call-varargs-no-stack-overflow.js:
+        (shouldThrow):
+
+2015-10-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed. Attempted EFL build fix 2 after r191159.
+
+        * PlatformEfl.cmake:
+
+2015-10-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed. Attempted EFL build fix after r191159.
+
+        * PlatformEfl.cmake:
+
+2015-10-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed. Build fix after r191160.
+
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::didGarbageCollect):
+
+2015-10-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed. Revert part of r191159 which caused ASSERTs.
+
+        A review comment suggested using WeakPtr. It is not suitable
+        here and causes ASSERTs across threads. Will address separately.
+
+        * inspector/agents/InspectorHeapAgent.h:
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::didGarbageCollect):
+        (Inspector::InspectorHeapAgent::InspectorHeapAgent): Deleted.
+
+2015-10-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Include Garbage Collection Event in Timeline
+        https://bugs.webkit.org/show_bug.cgi?id=142510
+
+        Reviewed by Geoffrey Garen and Brian Burg.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Include new files in the build.
+
+        * heap/HeapObserver.h:
+        (JSC::HeapObserver::~HeapObserver):
+        * heap/Heap.cpp:
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::didFinishCollection):
+        * heap/Heap.h:
+        (JSC::Heap::addObserver):
+        (JSC::Heap::removeObserver):
+        Allow observers on heap to add hooks for starting / ending garbage collection.
+
+        * inspector/InspectorEnvironment.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::vm):
+        * inspector/JSGlobalObjectInspectorController.h:
+        Access the VM through the InspectorEnvironment as it won't change.
+
+        * inspector/agents/InspectorHeapAgent.cpp: Added.
+        (Inspector::InspectorHeapAgent::InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::~InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorHeapAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorHeapAgent::enable):
+        (Inspector::InspectorHeapAgent::disable):
+        (Inspector::InspectorHeapAgent::gc):
+        (Inspector::protocolTypeForHeapOperation):
+        (Inspector::InspectorHeapAgent::willGarbageCollect):
+        (Inspector::InspectorHeapAgent::didGarbageCollect):
+        * inspector/agents/InspectorHeapAgent.h: Added.
+        * inspector/protocol/Heap.json: Added.
+        New domain and agent to handle tasks related to the JavaScriptCore heap.
+
+2015-10-15  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r191135.
+        https://bugs.webkit.org/show_bug.cgi?id=150197
+
+        This patch causes 50+ LayoutTest crashes related to the
+        inspector (Requested by ryanhaddad on #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: JavaScriptCore should parse sourceURL and
+        sourceMappingURL directives"
+        https://bugs.webkit.org/show_bug.cgi?id=150096
+        http://trac.webkit.org/changeset/191135
+
+2015-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling out r191003.
+        https://bugs.webkit.org/show_bug.cgi?id=150042
+
+        We're seeing some crashes in GC beneath speculationFromCell. Maybe this
+        patch caused them?
+
+        Reverted changeset:
+
+        CodeBlock write barriers should be precise
+        https://bugs.webkit.org/show_bug.cgi?id=150042
+        http://trac.webkit.org/changeset/191003
+
+2015-10-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JavaScriptCore should parse sourceURL and sourceMappingURL directives
+        https://bugs.webkit.org/show_bug.cgi?id=150096
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::scriptCommentPattern): Deleted.
+        (Inspector::ContentSearchUtilities::findScriptSourceURL): Deleted.
+        (Inspector::ContentSearchUtilities::findScriptSourceMapURL): Deleted.
+        * inspector/ContentSearchUtilities.h:
+        No longer need to search script content.
+
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchDidParseSource):
+        Carry over the sourceURL and sourceMappingURL from the SourceProvider.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::sourceMapURLForScript):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        No longer do content searching.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::setCode):
+        (JSC::Lexer<T>::skipWhitespace):
+        (JSC::Lexer<T>::parseCommentDirective):
+        (JSC::Lexer<T>::parseCommentDirectiveValue):
+        (JSC::Lexer<T>::consume):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::sourceURL):
+        (JSC::Lexer::sourceMappingURL):
+        (JSC::Lexer::sourceProvider): Deleted.
+        Give lexer the ability to detect script comment directives.
+        This just consumes characters in single line comments and
+        ultimately sets the sourceURL or sourceMappingURL found.
+
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::url):
+        (JSC::SourceProvider::sourceURL):
+        (JSC::SourceProvider::sourceMappingURL):
+        (JSC::SourceProvider::setSourceURL):
+        (JSC::SourceProvider::setSourceMappingURL):
+        After parsing a script, update the Source Provider with the
+        value of directives that may have been found in the script.
+
+2015-10-15  Filip Pizlo  <fpizlo@apple.com>
+
+        InferredTypeTable should ref its keys
+        https://bugs.webkit.org/show_bug.cgi?id=150138
+        rdar://problem/23080555
+
+        Reviewed by Michael Saboff.
+
+        InferredTypeTable was incorrectly using a key hash traits that caused the underlying HashTable to
+        store keys as UniquedStringImpl* rather than RefPtr<UniquedStringImpl>, even though the HashMap's
+        nominal key type was RefPtr<UniquedStringImpl>. This arose because I copy-pasted the HashMap type
+        instantiation from other places and then made random changes to adapt it to my needs, rather than
+        actually thinking about what I was doing. The solution is to remove the key hash traits argument,
+        since all it accomplishes is to produce this bug.
+
+        The way this bug manifested is probably best described in http://webkit.org/b/150008. After a while
+        the InferredTypeTable would have dangling references to its strings, if some recompilation or other
+        thing caused us to drop all other references to those strings. InferredTypeTable is particularly
+        susceptible to this because it is designed to know about a superset of the property names that its
+        client Structures know about. The debug assert would then happen when we rehashed the
+        InferredTypeTable's HashMap, because we'd try to get the hashes of strings that were already
+        deleted. AFAICT, we didn't have release crashes arising from those strings' memory being returned
+        to the OS - but it's totally possible that this could have happened. So, we definitely should treat
+        this bug as more than just a debug issue.
+
+        Interestingly, we could have also solved this problem by changing the hash function to use PtrHash.
+        In all other ways, it's OK for InferredTypeTable to hold dangling references, since it uses the
+        address of the UniquedStringImpl as a way to name an abstract heap. It's fine if the name of an
+        abstract heap is a bogus memory address, and it's also fine if that name referred to an entirely
+        different UniquedStringImpl at some point in the past. That's a nice benefit of any data structure
+        that keys by abstract heap - if two of them get unified then it's no big deal. I've filed another
+        bug, http://webkit.org/b/150137 about changing all of our UniquedStringImpl* hashing to use
+        PtrHash.
+
+        * runtime/Identifier.h: Add a comment about http://webkit.org/b/150137.
+        * runtime/InferredTypeTable.h: Fix the bug.
+        * tests/stress/inferred-type-table-stale-identifiers.js: Added. I couldn't get this to cause a crash before my change, but it's an interesting test nonetheless.
+
+2015-10-15  Mark Lam  <mark.lam@apple.com>
+
+        Add MASM_PROBE support for ARM64.
+        https://bugs.webkit.org/show_bug.cgi?id=150128
+
+        Reviewed by Michael Saboff.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARM64Assembler.h:
+        - Convert the ARM64 registers enum list into a macro list so that we can use
+          it elsewhere e.g. to declare fields in the probe CPUState.
+          Also de-tabbed the contents of the ARM64Registers namespace since the enum
+          list change touches almost all of it anyway. This reduces the amount of
+          complaints from the style checker.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CPUState::registerName):
+        (JSC::AbstractMacroAssembler::CPUState::registerValue):
+        - Change CPUState methods to allow for registers ID that do not map to one of
+          its fields. This is needed because ARM64's registers include aliases for some
+          register names. The CPUState will not allocate separate storage for the
+          aliases. 
+
+        * assembler/MacroAssemblerARM64.cpp: Added.
+        (JSC::arm64ProbeTrampoline):
+        - Unlike the probe mechanism for other CPUs, the ARM64 implementation does not
+          allow the probe function to modify the sp and pc registers.  We insert this
+          wrapper function between ctiMasmProbeTrampoline() and the user's probe function
+          so that we can check if the user tried to modify sp and pc.  If so, we will
+          print an error message so that we can alert the user that we don't support
+          that on ARM64.
+
+          See the comment in ctiMasmProbeTrampoline() in JITStubsARM64.h for details
+          on why we cannot support sp and pc modifications by the probe function.
+
+        (JSC::MacroAssemblerARM64::probe):
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::repatchCall):
+        (JSC::MacroAssemblerARM64::makeBranch):
+        * jit/JITStubs.cpp:
+        * jit/JITStubsARM64.h: Added.
+
+2015-10-15  Mark Lam  <mark.lam@apple.com>
+
+        Fix some typos in comments.
+        https://bugs.webkit.org/show_bug.cgi?id=150181
+
+        Rubber stamped by Michael Saboff.
+
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+
+2015-10-15  Mark Lam  <mark.lam@apple.com>
+
+        Refactoring: give the MASM probe CPUState methods shorter names.
+        https://bugs.webkit.org/show_bug.cgi?id=150177
+
+        Reviewed by Michael Saboff.
+
+        The existing names are longer than they need to be.  Renaming them as follows:
+            For GPR, registerName ==> gprName
+            For GPR, registerValue ==> gpr
+            For FPR, registerName ==> fprName
+            For FPR, registerValue ==> fpr
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CPUState::gprName):
+        (JSC::AbstractMacroAssembler::CPUState::fprName):
+        (JSC::AbstractMacroAssembler::CPUState::gpr):
+        (JSC::AbstractMacroAssembler::CPUState::fpr):
+        (JSC::AbstractMacroAssembler::CPUState::registerName): Deleted.
+        (JSC::AbstractMacroAssembler::CPUState::registerValue): Deleted.
+
+        * assembler/MacroAssemblerPrinter.cpp:
+        (JSC::printRegister):
+        (JSC::printMemory):
+        - Updated to use the new names.
+
+2015-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Class expression should have lexical environment that has itself as an imutable binding
+        https://bugs.webkit.org/show_bug.cgi?id=150089
+
+        Reviewed by Geoffrey Garen.
+
+        According to ES6 spec, class expression has its own lexical environment that holds itself
+        as an immutable binding[1] (section 14.5.14 step 2, 3, 4, 23)
+
+        As a result, even if the binding declared in the outer scope is overridden, methods inside
+        class expression can refer its class by the class name.
+
+        [1]: http://ecma-international.org/ecma-262/6.0/#sec-runtime-semantics-classdefinitionevaluation
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ClassExprNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createClassExpr):
+        * parser/NodeConstructors.h:
+        (JSC::ClassExprNode::ClassExprNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createClassExpr):
+        * tests/es6.yaml:
+        * tests/stress/class-expression-generates-environment.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (prototype.method):
+        (staticMethod):
+        (A.prototype.method):
+        (A.staticMethod):
+        (A):
+        * tests/stress/class-expression-should-be-tdz-in-heritage.js: Added.
+        (shouldThrow):
+        (shouldThrow.A):
+
+2015-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Class method should not declare any variables to upper scope.
+        https://bugs.webkit.org/show_bug.cgi?id=150115
+
+        Reviewed by Geoffrey Garen.
+
+        In the current implementation, class methods attempt to declare variables to an upper scope with their method names.
+        But this is not specified behavior in the ES6 spec.
+
+        And as a result, previously, we attempted to declare variables with invalid identifiers.
+        For example, `class A { 1() { } }` attempt to declare a variable with name `1`.
+        This (declaring variables with incorrect names) is not allowed in the lexical environment.
+        And it fires assertions in https://bugs.webkit.org/show_bug.cgi?id=150089.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass): Deleted.
+        * tests/stress/class-method-does-not-declare-variable-to-upper-scope.js: Added.
+        (shouldBe):
+        (A.prototype.method):
+        (A.staticMethod):
+        (A):
+
+2015-10-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION: Web Inspector hangs for many seconds when trying to reload page
+        https://bugs.webkit.org/show_bug.cgi?id=150065
+
+        Reviewed by Mark Lam.
+
+        When debugging Web Pages, the same Debugger (PageScriptDebugServer) is
+        attached to each of the different JSGlobalObjects on the page. This could
+        mean multiple frames or isolated scripting contexts. Therefore we should
+        only need to send sourceParsed events to the frontend for scripts within
+        this new JSGlobalObject, not any JSGlobalObject that has this debugger.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::attach):
+        Only send sourceParsed events for Scripts in this JSGlobalObject.
+
+2015-10-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unimplemented methods in CopiedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=150143
+
+        Reviewed by Andreas Kling.
+
+        * heap/CopiedSpace.h:
+
+2015-10-14  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Enforce launcher/library naming scheme
+        https://bugs.webkit.org/show_bug.cgi?id=150124
+
+        Reviewed by Alex Christensen.
+
+        * JavaScriptCore.vcxproj/jsc/DLLLauncherMain.cpp: Look for
+        {name}Lib.dll instead of {name}.dll.
+        (wWinMain):
+        * shell/PlatformWin.cmake: Add 'Lib' suffix to DLLs.
+
+2015-10-14  Keith Miller  <keith_miller@apple.com>
+
+        ES6 Fix TypedArray constructors.
+        https://bugs.webkit.org/show_bug.cgi?id=149975
+
+        Reviewed by Geoffrey Garen.
+
+        The ES6 spec requires that any object argument passed to a TypedArray constructor that is not a TypedArray
+        and has an iterator should use the iterator to construct the TypedArray. To avoid performance regressions related
+        to iterating we check if the iterator attached to the object points to the generic array iterator and length is a value.
+        If so, we do not use the iterator since there should be no observable difference. Another other interesting note is
+        that the ES6 spec has the of and from functions on a shared constructor between all the TypedArray constructors.
+        When the TypedArray is constructed the expectation is to crawl the prototype chain of the this value
+        passed to the function. If the function finds a known TypedArray constructor (Int32Array, Float64Array,...) then
+        it creates a TypedArray of that type. This is implemented by adding a private function (@allocateTypedArray) to each
+        of the constructors that can be called in order to construct the array. By using the private functions the JIT should
+        hopefully be able to optimize this to a direct call.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/TypedArrayConstructor.js: Added.
+        (of):
+        (from):
+        (allocateInt8Array):
+        (allocateInt16Array):
+        (allocateInt32Array):
+        (allocateUint32Array):
+        (allocateUint16Array):
+        (allocateUint8Array):
+        (allocateUint8ClampedArray):
+        (allocateFloat32Array):
+        (allocateFloat64Array):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::setIndex):
+        * runtime/JSDataView.h:
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue):
+        * runtime/JSGenericTypedArrayViewConstructor.h:
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::create):
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSTypedArrayViewConstructor.cpp: Added.
+        (JSC::JSTypedArrayViewConstructor::JSTypedArrayViewConstructor):
+        (JSC::JSTypedArrayViewConstructor::finishCreation):
+        (JSC::JSTypedArrayViewConstructor::create):
+        (JSC::JSTypedArrayViewConstructor::createStructure):
+        (JSC::constructTypedArrayView):
+        (JSC::JSTypedArrayViewConstructor::getConstructData):
+        (JSC::JSTypedArrayViewConstructor::getCallData):
+        * runtime/JSTypedArrayViewConstructor.h: Copied from Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.h.
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::create):
+        * tests/es6.yaml:
+        * tests/stress/resources/typedarray-constructor-helper-functions.js: Added.
+        (forEachTypedArray):
+        (hasSameValues):
+        (foo):
+        (testConstructorFunction):
+        (testConstructor):
+        * tests/stress/typedarray-constructor.js: Added.
+        (A):
+        (iterator.return.next):
+        (iterator):
+        (obj.valueOf):
+        (iterator2.return.next):
+        (iterator2):
+        * tests/stress/typedarray-from.js: Added.
+        (even):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-of.js: Added.
+
+2015-10-14  Mark Lam  <mark.lam@apple.com>
+
+        Rename some JSC option names to be more uniform.
+        https://bugs.webkit.org/show_bug.cgi?id=150127
+
+        Reviewed by Geoffrey Garen.
+
+        Renaming JSC_enableXXX options to JSC_useXXX, and JSC_showXXX options to JSC_dumpXXX.
+        Also will renaming a few other miscellaneous to options, to abide by this scheme.
+
+        Also renaming some functions to match the option names where relevant.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (testExecutionTimeLimit):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::optimizeForARMv7IDIVSupported):
+        (JSC::optimizeForARM64):
+        (JSC::optimizeForX86):
+        * assembler/LinkBuffer.cpp:
+        (JSC::shouldDumpDisassemblyFor):
+        (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
+        (JSC::shouldShowDisassemblyFor): Deleted.
+        * assembler/LinkBuffer.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+        * bytecode/CodeBlockJettisoningWatchpoint.cpp:
+        (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::fire):
+        * dfg/DFGAdaptiveStructureWatchpoint.cpp:
+        (JSC::DFG::AdaptiveStructureWatchpoint::fireInternal):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::leastUpperBound):
+        (JSC::DFG::shouldDumpDisassembly):
+        (JSC::DFG::shouldShowDisassembly): Deleted.
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::disassemble):
+        * dfg/DFGJumpReplacement.cpp:
+        (JSC::DFG::JumpReplacement::fire):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitFuzz.h:
+        (JSC::DFG::doOSRExitFuzzing):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSqrt):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::~JITCode):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLState.h:
+        (JSC::FTL::verboseCompilationEnabled):
+        (JSC::FTL::shouldDumpDisassembly):
+        (JSC::FTL::shouldShowDisassembly): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::shouldDoFullCollection):
+        * heap/Heap.h:
+        (JSC::Heap::isDeferred):
+        (JSC::Heap::structureIDTable):
+        * heap/HeapStatistics.cpp:
+        (JSC::StorageStatistics::storageCapacity):
+        (JSC::HeapStatistics::dumpObjectStatistics):
+        (JSC::HeapStatistics::showObjectStatistics): Deleted.
+        * heap/HeapStatistics.h:
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::createArguments):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::callExceptionFuzz):
+        * jit/ExecutableAllocationFuzz.cpp:
+        (JSC::doExecutableAllocationFuzzing):
+        * jit/ExecutableAllocationFuzz.h:
+        (JSC::doExecutableAllocationFuzzingIfEnabled):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCode.cpp:
+        (JSC::JITCodeWithCodeRef::~JITCodeWithCodeRef):
+        * jit/PolymorphicCallStubRoutine.cpp:
+        (JSC::PolymorphicCallNode::unlink):
+        (JSC::PolymorphicCallNode::clearCallLinkInfo):
+        (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
+        * jit/Repatch.cpp:
+        (JSC::linkFor):
+        (JSC::unlinkFor):
+        (JSC::linkVirtualFor):
+        * jsc.cpp:
+        (functionEnableExceptionFuzz):
+        (jscmain):
+        * llvm/InitializeLLVM.cpp:
+        (JSC::initializeLLVMImpl):
+        * runtime/ExceptionFuzz.cpp:
+        (JSC::doExceptionFuzzing):
+        * runtime/ExceptionFuzz.h:
+        (JSC::doExceptionFuzzingIfEnabled):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        (JSC::Options::initialize):
+        (JSC::Options::dumpOptionsIfNeeded):
+        (JSC::Options::setOption):
+        (JSC::Options::dumpAllOptions):
+        (JSC::Options::dumpAllOptionsInALine):
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::exceptionFuzzingBuffer):
+        * runtime/WriteBarrierInlines.h:
+        (JSC::WriteBarrierBase<T>::set):
+        (JSC::WriteBarrierBase<Unknown>::set):
+        * tests/executableAllocationFuzz.yaml:
+        * tests/stress/arrowfunction-typeof.js:
+        * tests/stress/disable-function-dot-arguments.js:
+        (foo):
+        * tests/stress/math-sqrt-basics-disable-architecture-specific-optimizations.js:
+        (sqrtOnInteger):
+        * tests/stress/regress-148564.js:
+
+2015-10-14  Mark Lam  <mark.lam@apple.com>
+
+        Speculative build fix: the CallSiteIndex constructor is explicit and requires an uint32_t.
+
+        Not Reviewed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex):
+
+2015-10-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r191030.
+        https://bugs.webkit.org/show_bug.cgi?id=150116
+
+        caused js/class-syntax-method-names.html to crash on debug
+        builds (Requested by alexchristensen_ on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Class expression should have lexical environment that
+        has itself as an imutable binding"
+        https://bugs.webkit.org/show_bug.cgi?id=150089
+        http://trac.webkit.org/changeset/191030
+
+2015-10-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Class expression should have lexical environment that has itself as an imutable binding
+        https://bugs.webkit.org/show_bug.cgi?id=150089
+
+        Reviewed by Geoffrey Garen.
+
+        According to ES6 spec, class expression has its own lexical environment that holds itself
+        as an immutable binding[1] (section 14.5.14 step 2, 3, 4, 23)
+
+        As a result, even if the binding declared in the outer scope is overridden, methods inside
+        class expression can refer its class by the class name.
+
+        [1]: http://ecma-international.org/ecma-262/6.0/#sec-runtime-semantics-classdefinitionevaluation
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ClassExprNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createClassExpr):
+        * parser/NodeConstructors.h:
+        (JSC::ClassExprNode::ClassExprNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createClassExpr):
+        * tests/es6.yaml:
+        * tests/stress/class-expression-generates-environment.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (prototype.method):
+        (staticMethod):
+        (A.prototype.method):
+        (A.staticMethod):
+        (A):
+        * tests/stress/class-expression-should-be-tdz-in-heritage.js: Added.
+        (shouldThrow):
+        (shouldThrow.A):
+
+2015-10-13  Saam barati  <sbarati@apple.com>
+
+        We were creating a GCAwareJITStubRoutineWithExceptionHandler when we didn't actually have an exception handler in the CodeBlock's exception handler table
+        https://bugs.webkit.org/show_bug.cgi?id=150016
+
+        Reviewed by Geoffrey Garen.
+
+        There was a bug where we created a GCAwareJITStubRoutineWithExceptionHandler
+        for inline caches that were custom setters/getters (but not JS getters/setters).
+        This is wrong; we only create GCAwareJITStubRoutineWithExceptionHandler when we have
+        an inline cache with a JS getter/setter call which causes the inline cache to add itself
+        to the CodeBlock's exception handling table. The problem was that we created
+        a GCAwareJITStubRoutineWithExceptionHandler that tried to remove itself from
+        the exception handler table only to find out that it didn't have an entry in the table.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::PolymorphicAccess::regenerate):
+
+2015-10-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Simplify WeakBlock visit and reap phases
+        https://bugs.webkit.org/show_bug.cgi?id=150045
+
+        Reviewed by Geoffrey Garen.
+
+        WeakBlock visiting and reaping both happen after MarkedBlock marking.
+        All the MarkedBlocks we encounter should be either Marked or Retired.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isMarkedOrRetired):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::visit):
+        (JSC::WeakBlock::reap):
+        * heap/WeakBlock.h:
+
+2015-10-12  Geoffrey Garen  <ggaren@apple.com>
+
+        CodeBlock write barriers should be precise
+        https://bugs.webkit.org/show_bug.cgi?id=150042
+
+        Reviewed by Saam Barati.
+
+        CodeBlock performs lots of unnecessary write barriers. This wastes
+        performance and makes the code a bit harder to follow, and it might mask
+        important bugs. Now is a good time to unmask important bugs.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlockSet::mark): Don't write barrier all CodeBlocks on the
+        stack. Only CodeBlocks that do value profiling need write barriers, and
+        they do those themselves.
+
+        In steady state, when most of our CodeBlocks are old and FTL-compiled,
+        and we're doing eden GC's, we should almost never visit a CodeBlock.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::osrWriteBarrier):
+        (JSC::DFG::adjustAndJumpToTarget): Don't write barrier all inlined
+        CodeBlocks on exit. That's not necessary. Instead, write barrier the 
+        CodeBlock(s) we will exit to, along with the one we will write a value
+        profile to.
+
+2015-10-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION: ASSERT (impl->isAtomic()) @ facebook.com
+        https://bugs.webkit.org/show_bug.cgi?id=149965
+
+        Reviewed by Geoffrey Garen.
+
+        Edge filtering for CheckIdent ensures that a given value is either Symbol or StringIdent.
+        However, this filtering is not applied to CheckIdent when propagating a constant value in
+        the constant folding phase. As a result, it is not guaranteeed that a constant value
+        propagated in constant folding is Symbol or StringIdent.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2015-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, register symbol structure to fix Debug build
+        https://bugs.webkit.org/show_bug.cgi?id=149622
+
+        Since InferredTypes for String or Symbol claim that they don't have any structure,
+        `registerInferredType` does not register the structure for Symbol.
+        We take the similar way to String to fix this issue; Registering Symbol structure
+        explicitly in DFGStructureRegisterationPhase. Because,
+
+        1. InferredType::structure is only allowed for ObjectWithStructure / ObjectWithStructureOrOther.
+           It looks clear to me that only ObjectWithStructure has structure.
+        2. Symbol is similar primitive value to String. So handling its structure in similar way to String is nice.
+
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+
+2015-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Iterator loops over key twice after delete
+        https://bugs.webkit.org/show_bug.cgi?id=149811
+
+        Reviewed by Geoffrey Garen.
+
+        When an object is the dictionary mode, JSPropertyNameEnumerator collects property names through generic property name enumeration `getPropertyNames`.
+        The result vector contains indexed property names. But in this case, `publicLength()` may not be 0.
+        So without disabling indexed names enumeration phase explicitly, JSPropertyNameEnumerator produces indexed property names twice.
+        One in indexed name enumeration phase, and another in generic property name enumeration phase.
+        This patch disables indexed names enumeration by setting `indexedLength` to 0 when collecting names through generic property name enumeration.
+
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::propertyNameEnumerator):
+        * tests/stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js: Added.
+        (shouldBe):
+        (col2.of.Reflect.enumerate):
+
+2015-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce Symbol type for property type inference
+        https://bugs.webkit.org/show_bug.cgi?id=149622
+
+        Reviewed by Geoffrey Garen.
+
+        This patch introduces Symbol type into property type inference.
+        One of the use cases of ES6 Symbol is enum value. In this case,
+        we may hold different symbols as the same property of the same structure.
+        Current property type inference does not support Symbol type, so in the
+        above case, the property will be inferred as Top type.
+
+        * bytecode/PutByIdFlags.h:
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        * dfg/DFGInferredTypeCheck.cpp:
+        (JSC::DFG::insertInferredTypeCheck):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::checkInferredType):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::branchIfNotType):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/InferredType.cpp:
+        (JSC::InferredType::kindForFlags):
+        (JSC::InferredType::Descriptor::forValue):
+        (JSC::InferredType::Descriptor::putByIdFlags):
+        (JSC::InferredType::Descriptor::merge):
+        (WTF::printInternal):
+        * runtime/InferredType.h:
+        * tests/stress/prop-type-symbol-then-object.js: Added.
+        (foo):
+        (bar):
+        (toString):
+        * tests/stress/prop-type-symbol-then-string.js: Added.
+        (foo):
+        (bar):
+
+2015-10-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Rebaseline Inspector generator tests and make better use of RWIProtocol constant
+        https://bugs.webkit.org/show_bug.cgi?id=150044
+
+        Reviewed by Brian Burg.
+
+        * inspector/scripts/codegen/generate_objc_configuration_header.py:
+        (ObjCConfigurationHeaderGenerator.generate_output):
+        (ObjCConfigurationHeaderGenerator._generate_configuration_interface_for_domains):
+        * inspector/scripts/codegen/generate_objc_configuration_implementation.py:
+        (ObjCBackendDispatcherImplementationGenerator._generate_configuration_implementation_for_domains):
+        * inspector/scripts/codegen/generate_objc_header.py:
+        (ObjCHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_internal_header.py:
+        (ObjCInternalHeaderGenerator.generate_output):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2015-10-12  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Unreviewed build fix
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::reallocateAndShrinkButterfly):
+
+2015-10-08  Filip Pizlo  <fpizlo@apple.com>
+
+        GC should have a Baker barrier for concurrent copying
+        https://bugs.webkit.org/show_bug.cgi?id=149852
+
+        Reviewed by Geoffrey Garen.
+
+        This adds a Baker-style read barrier [1] to copied space accesses. This barrier incurs some
+        overhead (0%-2% depending on benchmark suite), but what it buys is the ability to make the GC copy
+        phase concurrent.
+
+        The barrier relies on copied space pointers having two "space bits" in the low pointer bits. The
+        space bits indicate whether the backing store is being copied right now or not, and if it is being
+        copied, what stage of copying it's in. Two barrier variants are supported:
+
+        Read only barrier: if you load a backing store and immediately load from it without doing anything
+        else, you can just mask off the bits. In the worst case, you'll get the old backing store while
+        some copying thread is already allocating and populating the new version of the backing store. But
+        in that case, forwarding to the new backing store will not enable you to load a more up-to-date
+        value from the backing store. So, just masking the bits is enough. The read-only barrier is only
+        used in ICs where we know that we are only reading, and opportunistically within the DFG and FTL
+        thanks to the CopyBarrierOptimizationPhase. We never explicitly emit a read-only barrier in those
+        compilers; instead the phase will turn a GetButterfly into GetButterflyReadOnly if it proves that a
+        bunch of requirements are met.
+
+        Normal barrier: if the space bits are non-zero, call a slow path. The slow path will either do
+        nothing (if the copy phase hasn't started yet), or it will copy the backing store and update the
+        pointer (if the copy phase hasn't gotten around to copying this particular backing store), or it
+        will wait for the copying thread to finish (if some thread is copying this backing store right
+        now), or it will do nothing (if by the time we called into the slow path the backing store was
+        already copied). This is just like Baker's CAR/CDR barrier, but with a lock thrown in to handle
+        concurrent execution.
+
+        This is a 1% slow-down on SunSpider, a 1.5% slow-down on Octane, a 1.5% slow-down on Kraken, and a
+        0% slow-down on AsmBench. Note that the Octane slow-down is excluding the SplayLatency benchmark.
+        That benchmark will eventually speed up a lot once we finish doing all of this stuff. Probably, the
+        JetStream splay-latency will see an even larger speed-up, since our version of the latency tests do
+        a better job of punishing bad worst-case behavior.
+
+        [1] http://dspace.mit.edu/bitstream/handle/1721.1/41976/AI_WP_139.pdf, look for the CAR and CDR
+        procedures on page 9.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCopyBarrierOptimizationPhase.cpp: Added.
+        (JSC::DFG::performCopyBarrierOptimization):
+        * dfg/DFGCopyBarrierOptimizationPhase.h: Added.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetButterfly):
+        (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetButterfly):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetButterflyReadOnly):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileConstantStoragePointer):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetTypedArrayByteOffset):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMultiGetByOffset):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMultiPutByOffset):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetDirectPname):
+        (JSC::FTL::DFG::LowerDFGToLLVM::storageForTransition):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadButterflyWithBarrier):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadVectorWithBarrier):
+        (JSC::FTL::DFG::LowerDFGToLLVM::copyBarrier):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadButterflyReadOnly):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadVectorReadOnly):
+        (JSC::FTL::DFG::LowerDFGToLLVM::removeSpaceBits):
+        (JSC::FTL::DFG::LowerDFGToLLVM::baseIndex):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationNewObjectWithButterfly):
+        (JSC::FTL::operationPopulateObjectInOSR):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::testNonZero32):
+        (JSC::FTL::Output::testIsZero64):
+        (JSC::FTL::Output::testNonZero64):
+        (JSC::FTL::Output::testIsZeroPtr):
+        (JSC::FTL::Output::testNonZeroPtr):
+        (JSC::FTL::Output::select):
+        (JSC::FTL::Output::extractValue):
+        * heap/CopyBarrier.h: Copied from Source/JavaScriptCore/heap/CopyWriteBarrier.h.
+        (JSC::CopyBarrierBase::CopyBarrierBase):
+        (JSC::CopyBarrierBase::operator!):
+        (JSC::CopyBarrierBase::operator bool):
+        (JSC::CopyBarrierBase::getWithoutBarrier):
+        (JSC::CopyBarrierBase::get):
+        (JSC::CopyBarrierBase::copyState):
+        (JSC::CopyBarrierBase::setCopyState):
+        (JSC::CopyBarrierBase::clear):
+        (JSC::CopyBarrierBase::set):
+        (JSC::CopyBarrierBase::setWithoutBarrier):
+        (JSC::CopyBarrierBase::weakCASWithoutBarrier):
+        (JSC::CopyBarrier::CopyBarrier):
+        (JSC::CopyBarrier::getWithoutBarrier):
+        (JSC::CopyBarrier::get):
+        (JSC::CopyBarrier::set):
+        (JSC::CopyBarrier::setWithoutBarrier):
+        (JSC::CopyBarrier::weakCASWithoutBarrier):
+        (JSC::CopyWriteBarrier::CopyWriteBarrier): Deleted.
+        (JSC::CopyWriteBarrier::operator!): Deleted.
+        (JSC::CopyWriteBarrier::operator bool): Deleted.
+        (JSC::CopyWriteBarrier::get): Deleted.
+        (JSC::CopyWriteBarrier::operator*): Deleted.
+        (JSC::CopyWriteBarrier::operator->): Deleted.
+        (JSC::CopyWriteBarrier::set): Deleted.
+        (JSC::CopyWriteBarrier::setWithoutWriteBarrier): Deleted.
+        (JSC::CopyWriteBarrier::clear): Deleted.
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::checkIfShouldCopy):
+        * heap/CopyWriteBarrier.h: Removed.
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::copyBarrier):
+        (JSC::Heap::collectAndSweep):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrierBuffer):
+        * heap/HeapInlines.h:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchStructure):
+        (JSC::AssemblyHelpers::branchIfNotToSpace):
+        (JSC::AssemblyHelpers::removeSpaceBits):
+        (JSC::AssemblyHelpers::addressForByteOffset):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        (JSC::JIT::emit_op_get_direct_pname):
+        (JSC::JIT::emitSlow_op_get_direct_pname):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_direct_pname):
+        (JSC::JIT::emitSlow_op_get_direct_pname):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitDoubleLoad):
+        (JSC::JIT::emitContiguousLoad):
+        (JSC::JIT::emitArrayStorageLoad):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/DirectArguments.cpp:
+        (JSC::DirectArguments::visitChildren):
+        (JSC::DirectArguments::copyBackingStore):
+        (JSC::DirectArguments::overrideThings):
+        (JSC::DirectArguments::overrideThingsIfNecessary):
+        (JSC::DirectArguments::overrideArgument):
+        (JSC::DirectArguments::copyToArguments):
+        * runtime/DirectArguments.h:
+        (JSC::DirectArguments::canAccessIndexQuickly):
+        (JSC::DirectArguments::canAccessArgumentIndexQuicklyInDFG):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::fastSlice):
+        (JSC::JSArray::fastConcatWith):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        (JSC::JSArrayBufferView::JSArrayBufferView):
+        (JSC::JSArrayBufferView::finishCreation):
+        (JSC::JSArrayBufferView::finalize):
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::vector):
+        (JSC::JSArrayBufferView::length):
+        * runtime/JSArrayBufferViewInlines.h:
+        (JSC::JSArrayBufferView::neuter):
+        (JSC::JSArrayBufferView::byteOffset):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::typedVector):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        (JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore):
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        * runtime/JSMap.h:
+        (JSC::JSMap::JSMap):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::copyBackingStore):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::setIndexQuicklyToUndecided):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::reallocateAndShrinkButterfly):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::getEnumerableLength):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getArrayLength):
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::tryGetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuicklyForPutDirect):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::hasSparseMap):
+        (JSC::JSObject::inSparseIndexingMode):
+        (JSC::JSObject::inlineStorage):
+        (JSC::JSObject::butterfly):
+        (JSC::JSObject::outOfLineStorage):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::ensureInt32):
+        (JSC::JSObject::ensureDouble):
+        (JSC::JSObject::ensureContiguous):
+        (JSC::JSObject::ensureArrayStorage):
+        (JSC::JSObject::arrayStorage):
+        (JSC::JSObject::arrayStorageOrNull):
+        (JSC::JSObject::ensureLength):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/JSSet.h:
+        (JSC::JSSet::JSSet):
+        * runtime/MapData.h:
+        (JSC::JSIterator>::MapDataImpl):
+        (JSC::JSIterator>::IteratorData::next):
+        (JSC::JSIterator>::IteratorData::refreshCursor):
+        * runtime/MapDataInlines.h:
+        (JSC::JSIterator>::clear):
+        (JSC::JSIterator>::find):
+        (JSC::JSIterator>::add):
+        (JSC::JSIterator>::remove):
+        (JSC::JSIterator>::replaceAndPackBackingStore):
+        (JSC::JSIterator>::replaceBackingStore):
+        (JSC::JSIterator>::ensureSpaceForAppend):
+        (JSC::JSIterator>::visitChildren):
+        (JSC::JSIterator>::copyBackingStore):
+        * runtime/Options.h:
+
+2015-10-12  Saam barati  <sbarati@apple.com>
+
+        Update JSC features.json
+        https://bugs.webkit.org/show_bug.cgi?id=150043
+
+        Reviewed by Mark Lam.
+
+        There were a lot of things implemented that weren't in
+        the list. We should be better about updating the list
+        as we land patches for new ES6 features.
+
+        * features.json:
+
+2015-10-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Cleanup Heap.h and some related headers
+        https://bugs.webkit.org/show_bug.cgi?id=149981
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.h:
+        - Some functions did not need export.
+        - threadDupStrings never had an implementation.
+
+        * heap/ConservativeRoots.cpp:
+        * heap/ConservativeRoots.h:
+        * heap/Heap.cpp:
+        * heap/ListableHandler.h:
+        * heap/WeakReferenceHarvester.h:
+        * jit/Repatch.cpp:
+        * runtime/JSONObject.h:
+        * runtime/VM.h:
+        - Stale forward declarations / includes.
+
+2015-10-12  Saam barati  <sbarati@apple.com>
+
+        Each *ById inline cache in the FTL must have its own CallSiteIndex
+        https://bugs.webkit.org/show_bug.cgi?id=150039
+
+        Reviewed by Geoffrey Garen and Filip Pizlo.
+
+        When lowering to LLVM, we create a patchpoint intrinsic for each
+        *ById in DFG IR. LLVM may choose to duplicate these patchpoints.
+        Therefore, we want each resulting inline cache to have a unique
+        CallSiteIndex because each inline cache will have its own set of 
+        used registers. This change is necessary when we implement try/catch 
+        in the FTL because an inline cache will ask for the set of used 
+        registers it will need to restore in the event of an exception 
+        being thrown. It asks for this set of registers by giving JITCode
+        a CallSiteIndex. Because each corresponding inline cache that results
+        from a duplicated patchpoint may all ask this for this set of registers, 
+        we must assign each inline cache a unique CallSiteIndex.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::addCodeOrigin):
+        (JSC::DFG::CommonData::addUniqueCallSiteIndex):
+        (JSC::DFG::CommonData::addCodeOriginUnconditionally): Deleted.
+        * dfg/DFGCommonData.h:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::InlineCacheDescriptor::InlineCacheDescriptor):
+        (JSC::FTL::InlineCacheDescriptor::stackmapID):
+        (JSC::FTL::InlineCacheDescriptor::codeOrigin):
+        (JSC::FTL::InlineCacheDescriptor::uid):
+        (JSC::FTL::GetByIdDescriptor::GetByIdDescriptor):
+        (JSC::FTL::PutByIdDescriptor::PutByIdDescriptor):
+        (JSC::FTL::CheckInDescriptor::CheckInDescriptor):
+        (JSC::FTL::LazySlowPathDescriptor::LazySlowPathDescriptor):
+        (JSC::FTL::InlineCacheDescriptor::callSiteIndex): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+
+2015-10-12  Andreas Kling  <akling@apple.com>
+
+        "A + B" with strings shouldn't copy if A or B is empty.
+        <https://webkit.org/b/150034>
+
+        Reviewed by Anders Carlsson.
+
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/Lookup.cpp:
+        (JSC::reifyStaticAccessor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+
+2015-10-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        VisitedValueCount GC Counter misses parallel SlotVisitors
+        https://bugs.webkit.org/show_bug.cgi?id=149980
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::updateObjectCounts):
+        Include threaded slot visitor's object counts in the debugging value.
+
+2015-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix non-FTL build for real.
+
+        * ftl/FTLLazySlowPath.h:
+
+2015-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, clarify a comment. The example code had a bug.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+
+2015-10-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix no-FTL build.
+
+        * ftl/FTLLazySlowPath.cpp:
+
+2015-10-12  Philip Chimento  <philip.chimento@gmail.com>
+
+        webkit-gtk 2.3.3 fails to build on OS X - Conflicting type "Fixed"
+        https://bugs.webkit.org/show_bug.cgi?id=126433
+
+        Reviewed by Philippe Normand
+
+        Don't include CoreFoundation.h when building the GTK port.
+
+        * Source/JavaScriptCore/API/WebKitAvailability.h: Add !defined(BUILDING_GTK__) to defined(__APPLE__).
+
+2015-10-10  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should generate code to call slow paths lazily
+        https://bugs.webkit.org/show_bug.cgi?id=149936
+
+        Reviewed by Saam Barati.
+
+        We often have complex slow paths in FTL-generated code. Those slow paths may never run. Even
+        if they do run, they don't need stellar performance. So, it doesn't make sense to have LLVM
+        worry about compiling such slow path code.
+
+        This patch enables us to use our own MacroAssembler for compiling the slow path inside FTL
+        code. It does this by using a crazy lambda thingy (see FTLLowerDFGToLLVM.cpp's lazySlowPath()
+        and its documentation). The result is quite natural to use.
+
+        Even for straight slow path calls via something like vmCall(), the lazySlowPath offers the
+        benefit that the call marshalling and the exception checking are not expressed using LLVM IR
+        and do not require LLVM to think about it. It also has the benefit that we never generate the
+        code if it never runs. That's great, since function calls usually involve ~10 instructions
+        total (move arguments to argument registers, make the call, check exception, etc.).
+
+        This patch adds the lazy slow path abstraction and uses it for some slow paths in the FTL.
+        The code we generate with lazy slow paths is worse than the code that LLVM would have
+        generated. Therefore, a lazy slow path only makes sense when we have strong evidence that
+        the slow path will execute infrequently relative to the fast path. This completely precludes
+        the use of lazy slow paths for out-of-line Nodes that unconditionally call a C++ function.
+        It also precludes their use for the GetByVal out-of-bounds handler, since when we generate
+        a GetByVal with an out-of-bounds handler it means that we only know that the out-of-bounds
+        case executed at least once. So, for all we know, it may actually be the common case. So,
+        this patch just deployed the lazy slow path for GC slow paths and masquerades-as-undefined
+        slow paths. It makes sense for GC slow paths because those have a statistical guarantee of
+        slow path frequency - probably bounded at less than 1/10. It makes sense for masquerades-as-
+        undefined because we can say quite confidently that this is an uncommon scenario on the
+        modern Web.
+
+        Something that's always been challenging about abstractions involving the MacroAssembler is
+        that linking is a separate phase, and there is no way for someone who is just given access to
+        the MacroAssembler& to emit code that requires linking, since linking happens once we have
+        emitted all code and we are creating the LinkBuffer. Moreover, the FTL requires that the
+        final parts of linking happen on the main thread. This patch ran into this issue, and solved
+        it comprehensively, by introducing MacroAssembler::addLinkTask(). This takes a lambda and
+        runs it at the bitter end of linking - when performFinalization() is called. This ensure that
+        the task added by addLinkTask() runs on the main thread. This patch doesn't replace all of
+        the previously existing idioms for dealing with this issue; we can do that later.
+
+        This shows small speed-ups on a bunch of things. No big win on any benchmark aggregate. But
+        mainly this is done for https://bugs.webkit.org/show_bug.cgi?id=149852, where we found that
+        outlining the slow path in this way was a significant speed boost.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
+        (JSC::AbstractMacroAssembler::addLinkTask):
+        (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::allocate):
+        (JSC::LinkBuffer::performFinalization):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::wasAlreadyDisassembled):
+        (JSC::LinkBuffer::didAlreadyDisassemble):
+        (JSC::LinkBuffer::vm):
+        (JSC::LinkBuffer::executableOffsetFor):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::CodeOrigin):
+        (JSC::CodeOrigin::isSet):
+        (JSC::CodeOrigin::operator bool):
+        (JSC::CodeOrigin::isHashTableDeletedValue):
+        (JSC::CodeOrigin::operator!): Deleted.
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::InlineCacheDescriptor::InlineCacheDescriptor):
+        (JSC::FTL::CheckInDescriptor::CheckInDescriptor):
+        (JSC::FTL::LazySlowPathDescriptor::LazySlowPathDescriptor):
+        * ftl/FTLJITCode.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLazySlowPath.cpp: Added.
+        (JSC::FTL::LazySlowPath::LazySlowPath):
+        (JSC::FTL::LazySlowPath::~LazySlowPath):
+        (JSC::FTL::LazySlowPath::generate):
+        * ftl/FTLLazySlowPath.h: Added.
+        (JSC::FTL::LazySlowPath::createGenerator):
+        (JSC::FTL::LazySlowPath::patchpoint):
+        (JSC::FTL::LazySlowPath::usedRegisters):
+        (JSC::FTL::LazySlowPath::callSiteIndex):
+        (JSC::FTL::LazySlowPath::stub):
+        * ftl/FTLLazySlowPathCall.h: Added.
+        (JSC::FTL::createLazyCallGenerator):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNotifyWrite):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIsObjectOrNull):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIsFunction):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckWatchdogTimer):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocatePropertyStorageWithSizeImpl):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateJSArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildTypeOf):
+        (JSC::FTL::DFG::LowerDFGToLLVM::sensibleDoubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        (JSC::FTL::compileFTLLazySlowPath):
+        * ftl/FTLOperations.h:
+        * ftl/FTLSlowPathCall.cpp:
+        (JSC::FTL::SlowPathCallContext::SlowPathCallContext):
+        (JSC::FTL::SlowPathCallContext::~SlowPathCallContext):
+        (JSC::FTL::SlowPathCallContext::keyWithTarget):
+        (JSC::FTL::SlowPathCallContext::makeCall):
+        (JSC::FTL::callSiteIndexForCodeOrigin):
+        (JSC::FTL::storeCodeOrigin): Deleted.
+        (JSC::FTL::callOperation): Deleted.
+        * ftl/FTLSlowPathCall.h:
+        (JSC::FTL::callOperation):
+        * ftl/FTLState.h:
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::genericGenerationThunkGenerator):
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        (JSC::FTL::lazySlowPathGenerationThunkGenerator):
+        (JSC::FTL::registerClobberCheck):
+        * ftl/FTLThunks.h:
+        * interpreter/CallFrame.h:
+        (JSC::CallSiteIndex::CallSiteIndex):
+        (JSC::CallSiteIndex::operator bool):
+        (JSC::CallSiteIndex::bits):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgument):
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITOperations.cpp:
+
+2015-10-12  Philip Chimento  <philip.chimento@gmail.com>
+
+        webkit-gtk-2.3.4 fails to link JavaScriptCore, missing symbols add_history and readline
+        https://bugs.webkit.org/show_bug.cgi?id=127059
+
+        Reviewed by Philippe Normand.
+
+        * shell/CMakeLists.txt: Link JSC with -ledit on Mac OSX.
+
+2015-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        ES6 classes: When a class extends B, super() invokes B.prototype.constructor() instead of B()
+        https://bugs.webkit.org/show_bug.cgi?id=149001
+
+        Reviewed by Saam Barati.
+
+        This patch matches the `super()` call in the constructor to the latest spec.
+        Before this patch, when calling `super()`, it loads `callee.[[HomeObject]].__proto__.constructor`
+        as a super constructor. But after this patch, it loads `callee.__proto__` as a super constructor.
+        This behavior corresponds to the section 12.3.5.2[1].
+
+        [1]: http://www.ecma-international.org/ecma-262/6.0/#sec-getsuperconstructor
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::SuperNode::emitBytecode):
+        * tests/stress/super-call-does-not-look-up-constructor.js: Added.
+        (shouldBe):
+        (B):
+        (C):
+        (B.prototype):
+
+2015-10-10  Andreas Kling  <akling@apple.com>
+
+        Reduce pointless malloc traffic in CodeBlock construction.
+        <https://webkit.org/b/149999>
+
+        Reviewed by Antti Koivisto.
+
+        Create the RefCountedArray<Instruction> for CodeBlock's m_instructions directly
+        instead of first creating a Vector<Instruction> and then creating a RefCountedArray
+        from that. None of the Vector functionality is needed here anyway.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
+        * bytecode/CodeBlock.h:
+
+2015-10-10  Dan Bernstein  <mitz@apple.com>
+
+        [iOS] Remove unnecessary iOS version checks
+        https://bugs.webkit.org/show_bug.cgi?id=150002
+
+        Reviewed by Alexey Proskuryakov.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2015-10-10  Dan Bernstein  <mitz@apple.com>
+
+        [iOS] Remove project support for iOS 8
+        https://bugs.webkit.org/show_bug.cgi?id=149993
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/JSC.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/LLVMForJSC.xcconfig:
+        * Configurations/ToolExecutable.xcconfig:
+
+2015-10-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Modernize and cleanup an NSNumber constant
+        https://bugs.webkit.org/show_bug.cgi?id=149962
+
+        Reviewed by Andreas Kling.
+
+        * API/JSVirtualMachine.mm:
+        (-[JSVirtualMachine addExternalRememberedObject:]):
+
+2015-10-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        No need to keep setting needsVisit flag in SmallStrings
+        https://bugs.webkit.org/show_bug.cgi?id=149961
+
+        Reviewed by Andreas Kling.
+
+        SmallStrings are all initialized at once privately before the VM
+        enables Garbage Collection. There is no need to keep updating
+        this flag, as it couldn't have changed.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createEmptyString):
+        (JSC::SmallStrings::createSingleCharacterString):
+        (JSC::SmallStrings::initialize):
+        * runtime/SmallStrings.h:
+
+2015-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in r190694
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+
+        This time for double sure?
+
+        The cause of the crash was an incorrect write barrier.
+
+        OSR exit was barriering the baseline codeblock for the top of the stack
+        twice, missing the baseline codeblock for the bottom of the stack.
+
+        Restored changesets:
+
+        "CodeBlock should be a GC object"
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/r190694
+
+2015-10-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unused RecursiveAllocationScope
+        https://bugs.webkit.org/show_bug.cgi?id=149967
+
+        Reviewed by Csaba Osztrogonác.
+
+        RecursiveAllocationScope has been unused since r163691.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        * heap/Heap.h:
+        * heap/RecursiveAllocationScope.h: Removed.
+        * runtime/VM.h:
+
+2015-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling out r190694
+        https://bugs.webkit.org/show_bug.cgi?id=148560
+
+        Crashes seen on PLT bots and facebook.com.
+
+        Reverted changesets:
+
+        "CodeBlock should be a GC object"
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/190694
+
+2015-10-09  Xabier Rodriguez Calvar  <calvaris@igalia.com> and Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Automate WebCore JS builtins generation and build system
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+
+        Reviewed by Darin Adler.
+
+        * generate-js-builtins: updating the part related to WebCore JS binding.
+
+2015-10-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SSA should remove unreachable code
+        https://bugs.webkit.org/show_bug.cgi?id=149931
+
+        Reviewed by Geoffrey Garen.
+
+        Rolled back in with a call to m_state.reset(), which fixes the debug asserts.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run): Remove unreachable code.
+        * dfg/DFGObjectAllocationSinkingPhase.cpp: Deal with the CFG changing.
+        * dfg/DFGPutStackSinkingPhase.cpp: Deal with the CFG changing.
+
+2015-10-08  Daniel Bates  <dabates@apple.com>
+
+        Add LLVM binaries for iOS 9 device
+        https://bugs.webkit.org/show_bug.cgi?id=149913
+
+        Reviewed by Filip Pizlo.
+
+        Look for locally built/binary dropped LLVM headers and libraries when building for iOS device
+        in WebKitBuild/usr/local.
+
+        Currently Mac and iOS look for the locally built/binary dropped LLVM in different directories:
+        WebKitBuild/usr/local and /usr/local/LLVMForJavaScriptCore, respectively. This difference is
+        due to dependencies with the Apple internal build system. We should look to resolve the
+        Apple internal dependencies and standardize on one location for both platforms.
+
+        * Configurations/Base.xcconfig:
+
+2015-10-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190749.
+        https://bugs.webkit.org/show_bug.cgi?id=149938
+
+        Caused 50+ layout test failures
+        https://build.webkit.org/results/Apple%20El%20Capitan%20Debug%20WK1%20(Tests)/r190749%20(213)/results.html
+        (Requested by litherum1 on #webkit).
+
+        Reverted changeset:
+
+        "DFG SSA should remove unreachable code"
+        https://bugs.webkit.org/show_bug.cgi?id=149931
+        http://trac.webkit.org/changeset/190749
+
+2015-10-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SSA should remove unreachable code
+        https://bugs.webkit.org/show_bug.cgi?id=149931
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run): Remove unreachable code.
+        * dfg/DFGObjectAllocationSinkingPhase.cpp: Deal with the CFG changing.
+        * dfg/DFGPutStackSinkingPhase.cpp: Deal with the CFG changing.
+
+2015-10-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed build fix. Missing forward declaration.
+
+        * heap/Heap.h:
+
+2015-10-08  Saam barati  <sbarati@apple.com>
+
+        Unreviewed Cloop build fix after bug: https://bugs.webkit.org/show_bug.cgi?id=149601
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex):
+        * jit/JITCode.cpp:
+        (JSC::NativeJITCode::addressForCall):
+        (JSC::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * jit/JITCode.h:
+
+2015-10-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Clean up Marked classes
+        https://bugs.webkit.org/show_bug.cgi?id=149853
+
+        Reviewed by Darin Adler.
+
+        * heap/Heap.h:
+        Move include here where it is really needed.
+
+        * heap/HeapStatistics.cpp:
+        * heap/HeapStatistics.h:
+        Simplify includes.
+
+        * heap/MarkedAllocator.h:
+        Add missing copyright header.
+
+        * heap/MarkedBlock.cpp:
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::needsSweeping):
+        Remove unused constants. Add some static asserts. Add some `const` ness.
+
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::isIterating):
+        Update comments to better reflect actual values.
+        Remove unimplemented method (moved to Heap).
+
+        * heap/MarkedSpace.cpp:
+        (JSC::Free::Free):
+        (JSC::Free::operator()):
+        (JSC::Free::returnValue): Deleted.
+        (JSC::FreeOrShrink::FreeOrShrink):
+        (JSC::FreeOrShrink::operator()):
+        (JSC::MarkedSpace::~MarkedSpace):
+        (JSC::MarkedSpace::shrink):
+        Replace conditional Functor that was not using return value
+        with simplified targeted VoidFunctors.
+
+        (JSC::Shrink::operator()): Deleted.
+        Remove unused functor.
+
+        * heap/WeakBlock.cpp:
+        * heap/WeakBlock.h:
+        * runtime/Options.cpp:
+        Remove dead code.
+
+2015-10-08  Saam barati  <sbarati@apple.com>
+
+        We should be able to inline getter/setter calls inside an inline cache even when the SpillRegistersMode is NeedsToSpill
+        https://bugs.webkit.org/show_bug.cgi?id=149601
+
+        Reviewed by Filip Pizlo.
+
+        Before, if we had a PolymorphicAccess with and a StructureStubInfo
+        with a NeedToSpill spillMode, we wouldn't generate getter/setter
+        calls. This patch changes it such that we will generate the
+        getter/setter call and do the necessary register spilling/filling
+        around the getter/setter call to preserve any "usedRegisters".
+
+        This has an interesting story with how it relates to exception handling 
+        inside the DFG. Because the GetById variants are considered a throwing call 
+        site, we must make sure that we properly restore the registers spilled to the stack 
+        in case of an exception being thrown inside the getter/setter call. We do 
+        this by having the inline cache register itself as a new exception handling 
+        call site. When the inline cache "catches" the exception (i.e, genericUnwind 
+        will jump to this code), it will restore the registers it spilled that are 
+        live inside the original catch handler, and then jump to the original catch 
+        handler. We make sure to only generate this makeshift catch handler when we 
+        actually need to do any cleanup. If we determine that we don't need to restore 
+        any registers, we don't bother generating this makeshift catch handler.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::handlerForIndex):
+        (JSC::CodeBlock::newExceptionHandlingCallSiteIndex):
+        (JSC::CodeBlock::removeExceptionHandlerForCallSite):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::appendExceptionHandler):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::AccessGenerationState):
+        (JSC::AccessGenerationState::restoreScratch):
+        (JSC::AccessGenerationState::succeed):
+        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
+        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCall):
+        (JSC::AccessGenerationState::restoreLiveRegistersFromStackForCall):
+        (JSC::AccessGenerationState::restoreLiveRegistersFromStackForCallWithThrownException):
+        (JSC::AccessGenerationState::liveRegistersForCall):
+        (JSC::AccessGenerationState::callSiteIndexForExceptionHandlingOrOriginal):
+        (JSC::AccessGenerationState::callSiteIndexForExceptionHandling):
+        (JSC::AccessGenerationState::originalExceptionHandler):
+        (JSC::AccessGenerationState::numberOfStackBytesUsedForRegisterPreservation):
+        (JSC::AccessGenerationState::needsToRestoreRegistersIfException):
+        (JSC::AccessGenerationState::originalCallSiteIndex):
+        (JSC::AccessGenerationState::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        (JSC::AccessCase::AccessCase):
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerateWithCases):
+        (JSC::PolymorphicAccess::regenerate):
+        (JSC::PolymorphicAccess::aboutToDie):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::doesCalls):
+        (JSC::AccessCase::isGetter):
+        (JSC::AccessCase::callLinkInfo):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::aboutToDie):
+        (JSC::StructureStubInfo::addAccessCase):
+        * bytecode/StructureStubInfo.h:
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::isInJSValueRegs):
+        (JSC::ValueRecovery::fpr):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::addCodeOrigin):
+        (JSC::DFG::CommonData::addCodeOriginUnconditionally):
+        (JSC::DFG::CommonData::lastCallSite):
+        (JSC::DFG::CommonData::removeCallSiteIndex):
+        (JSC::DFG::CommonData::shrinkToFit):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        (JSC::DFG::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        (JSC::DFG::JITCode::checkIfOptimizationThresholdReached):
+        * dfg/DFGJITCode.h:
+        (JSC::DFG::JITCode::osrEntryBlock):
+        (JSC::DFG::JITCode::setOSREntryBlock):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::validateReferences):
+        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * ftl/FTLJITCode.h:
+        (JSC::FTL::JITCode::handles):
+        (JSC::FTL::JITCode::dataSections):
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal):
+        (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
+        (JSC::GCAwareJITStubRoutineWithExceptionHandler::aboutToDie):
+        (JSC::GCAwareJITStubRoutineWithExceptionHandler::~GCAwareJITStubRoutineWithExceptionHandler):
+        (JSC::createJITStubRoutine):
+        * jit/GCAwareJITStubRoutine.h:
+        * jit/JITCode.cpp:
+        (JSC::NativeJITCode::addressForCall):
+        (JSC::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * jit/JITCode.h:
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITByIdGenerator::reportSlowPathCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITStubRoutine.h:
+        (JSC::JITStubRoutine::createSelfManagedRoutine):
+        (JSC::JITStubRoutine::aboutToDie):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::webAssemblyCalleeSaveRegisters):
+        (JSC::RegisterSet::registersToNotSaveForCall):
+        (JSC::RegisterSet::allGPRs):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::set):
+        (JSC::RegisterSet::clear):
+        * jit/ScratchRegisterAllocator.cpp:
+        (JSC::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        (JSC::ScratchRegisterAllocator::usedRegistersForCall):
+        (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall):
+        (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall):
+        (JSC::ScratchRegisterAllocator::preserveRegistersToStackForCall):
+        (JSC::ScratchRegisterAllocator::restoreRegistersFromStackForCall):
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::numberOfReusedRegisters):
+        (JSC::ScratchRegisterAllocator::usedRegisters):
+        * jsc.cpp:
+        (WTF::CustomGetter::CustomGetter):
+        (WTF::CustomGetter::createStructure):
+        (WTF::CustomGetter::create):
+        (WTF::CustomGetter::getOwnPropertySlot):
+        (WTF::CustomGetter::customGetter):
+        (WTF::Element::handleOwner):
+        (GlobalObject::finishCreation):
+        (functionCreateImpureGetter):
+        (functionCreateCustomGetterObject):
+        (functionSetImpureGetterDelegate):
+        * tests/stress/try-catch-custom-getter-as-get-by-id.js: Added.
+        (assert):
+        (bar):
+        (foo):
+        * tests/stress/try-catch-getter-as-get-by-id-register-restoration.js: Added.
+        (assert):
+        (o1.get f):
+        (bar):
+        (foo):
+        * tests/stress/try-catch-getter-as-get-by-id.js: Added.
+        (assert):
+        (o1.get f):
+        (bar):
+        (foo):
+        * tests/stress/try-catch-setter-as-put-by-id.js: Added.
+        (assert):
+        (o1.set f):
+        (bar):
+        (foo):
+        * tests/stress/try-catch-stub-routine-replaced.js: Added.
+        (assert):
+        (arr):
+        (hello):
+        (foo):
+        (objChain.get f):
+        (fakeOut.get f):
+        (o.get f):
+
+2015-10-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190716.
+        https://bugs.webkit.org/show_bug.cgi?id=149924
+
+        broke mac build from time to time (Requested by youenn on
+        #webkit).
+
+        Reverted changeset:
+
+        "Automate WebCore JS builtins generation and build system"
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+        http://trac.webkit.org/changeset/190716
+
+2015-10-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the WASM build on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=149919
+
+        Reviewed by Mark Lam.
+
+        * inspector/ScriptCallStackFactory.cpp:
+        * wasm/JSWASMModule.cpp:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::sizeOfMemoryType):
+        * wasm/WASMFunctionLLVMIRGenerator.h:
+
+2015-10-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed CLOOP buildfix after r190718.
+
+        * jit/Repatch.h:
+        (JSC::resetGetByID): Deleted.
+        (JSC::resetPutByID): Deleted.
+        (JSC::resetIn): Deleted.
+
+2015-10-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove references to removed class RepatchBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=149909
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARM64.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerSH4.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * jit/JITStubRoutine.h:
+        * jit/Repatch.h:
+
+2015-10-08  Xabier Rodriguez Calvar  <calvaris@igalia.com> and Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Automate WebCore JS builtins generation and build system
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+
+        Reviewed by Darin Adler.
+
+        * generate-js-builtins: updating the part related to WebCore JS binding.
+
+2015-10-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Clean up Copied classes
+        https://bugs.webkit.org/show_bug.cgi?id=149863
+
+        Reviewed by Saam Barati.
+
+        * heap/CopiedAllocator.h:
+        (JSC::CopiedAllocator::isValid):
+        * heap/CopiedBlock.h:
+        * heap/CopiedBlockInlines.h:
+        * heap/CopiedSpace.cpp:
+        * heap/CopiedSpace.h:
+        (JSC::CopiedSpace::isInCopyPhase):
+        (JSC::CopiedSpace::shouldDoCopyPhase):
+        * heap/CopiedSpaceInlines.h:
+        * heap/CopyToken.h:
+        * heap/CopyVisitor.cpp:
+        * heap/CopyVisitor.h:
+        * heap/CopyVisitorInlines.h:
+        * heap/CopyWorkList.h:
+        * heap/HandleBlock.h:
+        * heap/HandleSet.h:
+        * heap/HeapHelperPool.cpp:
+        * heap/HeapHelperPool.h:
+
+2015-10-07  Mark Lam  <mark.lam@apple.com>
+
+        [Follow up 2] Disable tail calls because it is breaking some sites.
+        https://bugs.webkit.org/show_bug.cgi?id=149900
+
+        Rubber stamped by Saam Barati.
+
+        Also need to surpress JSC tail call tests.
+
+        * tests/es6.yaml:
+        * tests/stress/dfg-tail-calls.js:
+        (nonInlinedTailCall.callee):
+        * tests/stress/mutual-tail-call-no-stack-overflow.js:
+        (shouldThrow):
+        * tests/stress/tail-call-in-inline-cache.js:
+        (tail):
+        * tests/stress/tail-call-no-stack-overflow.js:
+        (shouldThrow):
+        * tests/stress/tail-call-recognize.js:
+        (callerMustBeRun):
+        * tests/stress/tail-call-varargs-no-stack-overflow.js:
+        (shouldThrow):
+
+2015-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in r190450
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+
+        This time for sure?
+
+        The cause of the leak was an invalidated compilation.
+
+        There was vestigial manual memory management code that eagerly removed
+        a CodeBlock from the set of CodeBlocks if compilation was invalidated.
+        That's not cool since we rely on the set of CodeBlocks when we run
+        destructors.
+
+        The fix is to remove the vestigial code.
+
+        I ran the leaks, correctness, and performance tests locally and did not
+        see any problems.
+
+        Restored changesets:
+
+        "CodeBlock should be a GC object"
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/190450
+
+2015-10-07  Mark Lam  <mark.lam@apple.com>
+
+        Disable tail calls because it is breaking some sites.
+        https://bugs.webkit.org/show_bug.cgi?id=149900
+
+        Reviewed by Saam Barati.
+
+        This is until we fix whatever the breakage is.
+
+        * runtime/Options.h:
+
+2015-10-07  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Add an LLVM IR generator for WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149486
+
+        Reviewed by Mark Lam.
+
+        This patch adds initial support for an LLVM IR generator in WebAssembly
+        (polyfill-prototype-1 format). All the methods will be implemented in
+        subsequent patches.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wasm/WASMFunctionLLVMIRGenerator.h: Added.
+        (JSC::WASMFunctionLLVMIRGenerator::MemoryAddress::MemoryAddress):
+        (JSC::WASMFunctionLLVMIRGenerator::startFunction):
+        (JSC::WASMFunctionLLVMIRGenerator::endFunction):
+        (JSC::WASMFunctionLLVMIRGenerator::buildSetLocal):
+        (JSC::WASMFunctionLLVMIRGenerator::buildSetGlobal):
+        (JSC::WASMFunctionLLVMIRGenerator::buildReturn):
+        (JSC::WASMFunctionLLVMIRGenerator::buildImmediateI32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildImmediateF32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildImmediateF64):
+        (JSC::WASMFunctionLLVMIRGenerator::buildGetLocal):
+        (JSC::WASMFunctionLLVMIRGenerator::buildGetGlobal):
+        (JSC::WASMFunctionLLVMIRGenerator::buildConvertType):
+        (JSC::WASMFunctionLLVMIRGenerator::buildLoad):
+        (JSC::WASMFunctionLLVMIRGenerator::buildStore):
+        (JSC::WASMFunctionLLVMIRGenerator::buildUnaryI32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildUnaryF32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildUnaryF64):
+        (JSC::WASMFunctionLLVMIRGenerator::buildBinaryI32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildBinaryF32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildBinaryF64):
+        (JSC::WASMFunctionLLVMIRGenerator::buildRelationalI32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildRelationalF32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildRelationalF64):
+        (JSC::WASMFunctionLLVMIRGenerator::buildMinOrMaxI32):
+        (JSC::WASMFunctionLLVMIRGenerator::buildMinOrMaxF64):
+        (JSC::WASMFunctionLLVMIRGenerator::buildCallInternal):
+        (JSC::WASMFunctionLLVMIRGenerator::buildCallIndirect):
+        (JSC::WASMFunctionLLVMIRGenerator::buildCallImport):
+        (JSC::WASMFunctionLLVMIRGenerator::appendExpressionList):
+        (JSC::WASMFunctionLLVMIRGenerator::discard):
+        (JSC::WASMFunctionLLVMIRGenerator::linkTarget):
+        (JSC::WASMFunctionLLVMIRGenerator::jumpToTarget):
+        (JSC::WASMFunctionLLVMIRGenerator::jumpToTargetIf):
+        (JSC::WASMFunctionLLVMIRGenerator::startLoop):
+        (JSC::WASMFunctionLLVMIRGenerator::endLoop):
+        (JSC::WASMFunctionLLVMIRGenerator::startSwitch):
+        (JSC::WASMFunctionLLVMIRGenerator::endSwitch):
+        (JSC::WASMFunctionLLVMIRGenerator::startLabel):
+        (JSC::WASMFunctionLLVMIRGenerator::endLabel):
+        (JSC::WASMFunctionLLVMIRGenerator::breakTarget):
+        (JSC::WASMFunctionLLVMIRGenerator::continueTarget):
+        (JSC::WASMFunctionLLVMIRGenerator::breakLabelTarget):
+        (JSC::WASMFunctionLLVMIRGenerator::continueLabelTarget):
+        (JSC::WASMFunctionLLVMIRGenerator::buildSwitch):
+        * wasm/WASMFunctionParser.cpp:
+
+2015-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of LLInt inline/out-of-line storage helpers, they are unused
+        https://bugs.webkit.org/show_bug.cgi?id=149892
+
+        Reviewed by Mark Lam.
+
+        Just killing dead code.
+
+        * llint/LowLevelInterpreter.asm:
+
+2015-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't setOutOfBounds in JIT code for PutByVal, since the C++ slow path already does it
+        https://bugs.webkit.org/show_bug.cgi?id=149885
+
+        Reviewed by Geoffrey Garen.
+
+        This simplifies the slow path code, which will make it easier to put read barriers on all of
+        the butterflies.
+
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_val):
+
+2015-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of JIT::compilePutDirectOffset
+        https://bugs.webkit.org/show_bug.cgi?id=149884
+
+        Reviewed by Andreas Kling.
+
+        I'm finding more dead code.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::emitVarInjectionCheck):
+        (JSC::JIT::compilePutDirectOffset): Deleted.
+
+2015-10-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Heap::isWriteBarrierEnabled is unused
+        https://bugs.webkit.org/show_bug.cgi?id=149881
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::isWriteBarrierEnabled): Deleted.
+
+2015-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT::emitGetGlobalProperty/emitPutGlobalProperty are only called from one place
+        https://bugs.webkit.org/show_bug.cgi?id=149879
+
+        Reviewed by Saam Barati.
+
+        To simplify my work to insert barriers on loads of the butterfly, I want to reduce the amount
+        of abstraction we have around code that loads the butterfly.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitLoadWithStructureCheck):
+        (JSC::JIT::emitGetVarFromPointer):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitPutGlobalVariable):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitGetGlobalProperty): Deleted.
+        (JSC::JIT::emitPutGlobalProperty): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitLoadWithStructureCheck):
+        (JSC::JIT::emitGetVarFromPointer):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitPutGlobalVariable):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitGetGlobalProperty): Deleted.
+        (JSC::JIT::emitPutGlobalProperty): Deleted.
+
+2015-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT::compileGetDirectOffset is useless
+        https://bugs.webkit.org/show_bug.cgi?id=149878
+
+        Reviewed by Mark Lam.
+
+        Two of the overloads of this method were never called. The other was called only from one
+        place, in a manner that rendered most of its code dead. This change removes the dead code and
+        folds the method into its one caller.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::emitVarInjectionCheck):
+        (JSC::JIT::emitGetGlobalProperty):
+        (JSC::JIT::emitGetVarFromPointer):
+        (JSC::JIT::compileGetDirectOffset): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::emitVarInjectionCheck):
+        (JSC::JIT::emitGetGlobalProperty):
+        (JSC::JIT::emitGetVarFromPointer):
+        (JSC::JIT::compileGetDirectOffset): Deleted.
+
+2015-10-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Inline caches should handle out-of-line offsets out-of-line
+        https://bugs.webkit.org/show_bug.cgi?id=149869
+
+        Reviewed by Saam Barati.
+
+        If we want to have a concurrent copying GC, then we need a read barrier on copied space
+        pointers. That makes the convertible load portion of the get_by_id/put_by_id inline caches
+        rather challenging. Currently we have a load instruction that we can turn into an add
+        instruction - the add case is when we have an inline offset, and the load case is when we
+        have an out-of-line offset and we need to load a copied space pointer. But if the load from
+        copied space requires a barrier, then there is no easy way to convert that back to the inline
+        case.
+
+        This patch removes the convertible load. The inline path of get_by_id/put_by_id only handles
+        the inline offsets. Out-of-line offsets are now handled using out-of-line stubs.
+
+        * bytecode/StructureStubInfo.h:
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfGetById):
+        (JSC::FTL::sizeOfPutById):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::finalize):
+        (JSC::JITByIdGenerator::generateFastPathChecks):
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        (JSC::JITGetByIdGenerator::generateFastPath):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        (JSC::JITPutByIdGenerator::generateFastPath):
+        * jit/JITInlineCacheGenerator.h:
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess):
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::butterflyTotalSize):
+        (JSC::indexRelativeToBase):
+        (JSC::offsetRelativeToBase):
+        (JSC::maxOffsetRelativeToBase):
+        (JSC::makeIdentifier):
+        (JSC::offsetRelativeToPatchedStorage): Deleted.
+        (JSC::maxOffsetRelativeToPatchedStorage): Deleted.
+
+2015-10-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190664.
+        https://bugs.webkit.org/show_bug.cgi?id=149877
+
+        mac build is sometimes borken due to missing generated header
+        file (Requested by youenn on #webkit).
+
+        Reverted changeset:
+
+        "Automate WebCore JS builtins generation and build system"
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+        http://trac.webkit.org/changeset/190664
+
+2015-10-07  Xabier Rodriguez Calvar  <calvaris@igalia.com> and Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Automate WebCore JS builtins generation and build system
+        https://bugs.webkit.org/show_bug.cgi?id=149751
+
+        Reviewed by Darin Adler.
+
+        * generate-js-builtins: updating the part related to WebCore JS binding.
+
+2015-10-06  Mark Lam  <mark.lam@apple.com>
+
+        Factoring out op_sub baseline code generation into JITSubGenerator.
+        https://bugs.webkit.org/show_bug.cgi?id=149600
+
+        Reviewed by Geoffrey Garen.
+
+        We're going to factor out baseline code generation into snippet generators so
+        that we can later use them in the DFG and FTL to emit code for to perform the
+        JS operations where the operand types are predicted to be polymorphic.
+        We are starting in this patch with the implementation of op_sub.
+
+        What was done in this patch:
+        1. Created JITSubGenerator based on the baseline implementation of op_sub as
+           expressed in compileBinaryArithOp() and compileBinaryArithOpSlowCase().
+           I did not attempt to do write a more optimal version of op_sub.  I'll
+           leave that to a later patch.
+
+        2. Convert the 32-bit op_sub baseline implementation to use the same
+           JITSubGenerator which was based on the 64-bit implementation.  The
+           pre-existing 32-bit baseline op_sub had handling for more optimization cases.
+           However, a benchmark run shows that simply going with the 64-bit version
+           (foregoing those extra optimizations) did not change the performance.
+
+           Also, previously, the 32-bit version was able to move double results directly
+           into the result location on the stack directly.  By using JITSubGenerator,
+           we now always move that result into a pair of GPRs before storing it into
+           the stack location.
+
+        3. Add some needed emitters to AssemblyHelpers that play nice with JSValueRegs.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::boxDouble):
+        (JSC::AssemblyHelpers::unboxDouble):
+        (JSC::AssemblyHelpers::boxBooleanPayload):
+        * jit/JIT.h:
+        (JSC::JIT::linkDummySlowCase):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emitSlow_op_div):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_sub): Deleted.
+        (JSC::JIT::emitSub32Constant): Deleted.
+        (JSC::JIT::emitSlow_op_sub): Deleted.
+        * jit/JITInlines.h:
+        (JSC::JIT::linkSlowCaseIfNotJSCell):
+        (JSC::JIT::linkAllSlowCasesForBytecodeOffset):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::emitLoad):
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutVirtualRegister):
+        * jit/JITSubGenerator.h: Added.
+        (JSC::JITSubGenerator::JITSubGenerator):
+        (JSC::JITSubGenerator::generateFastPath):
+        (JSC::JITSubGenerator::slowPathJumpList):
+
+2015-10-06  Daniel Bates  <dbates@webkit.org>
+
+        Enable XSLT when building WebKit for iOS using the public iOS SDK
+        https://bugs.webkit.org/show_bug.cgi?id=149827
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-10-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190599.
+        https://bugs.webkit.org/show_bug.cgi?id=149836
+
+        Made perf tests randomly crash (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "GC shouldn't cancel every FTL compilation"
+        https://bugs.webkit.org/show_bug.cgi?id=149821
+        http://trac.webkit.org/changeset/190599
+
+2015-10-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190589.
+        https://bugs.webkit.org/show_bug.cgi?id=149833
+
+        Caused lots of leaks, and possibly crashes (Requested by ap on
+        #webkit).
+
+        Reverted changeset:
+
+        "Unreviewed, rolling back in r190450"
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/190589
+
+2015-10-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Remove a few includes from JSGlobalObject.h
+        https://bugs.webkit.org/show_bug.cgi?id=148004
+
+        Reviewed by Saam Barati.
+
+        * parser/VariableEnvironment.cpp:
+        * parser/VariableEnvironment.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::createStructure):
+        (JSC::JSRopeString::RopeBuilder::expand):
+        * runtime/JSString.h:
+        (JSC::JSString::canGetIndex):
+        (JSC::JSString::offsetOfLength):
+        (JSC::JSString::offsetOfFlags):
+        (JSC::JSString::createStructure): Deleted.
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        * runtime/StructureRareDataInlines.h:
+
+2015-10-05  Filip Pizlo  <fpizlo@apple.com>
+
+        GC shouldn't cancel every FTL compilation
+        https://bugs.webkit.org/show_bug.cgi?id=149821
+
+        Reviewed by Saam Barati.
+
+        During one of the CodeBlock GC refactorings, we messed up the GC's compilation cancellation
+        code. The GC should be able to cancel compilation plans if it determines that the plan will
+        be DOA. But, prior to this fix, that code was killing every FTL compilation. This happened
+        because the meaning of CodeBlock::isKnownToBeLiveDuringGC() changed.
+
+        It's funny that this didn't show up as a bigger slow-down. Basically, those benchmarks that
+        GC a lot usually don't rely on good compilation, while those benchmarks that do rely on good
+        compilation usually don't GC a lot. That's probably why this wasn't super obvious when we
+        broke it.
+
+        This change just changes the cancellation logic so that it only cancels plans if the owning
+        executable is dead. This is safe; in fact the relevant method would be correct even if it
+        always returned true. It would also be correct if it always returned false. So, compared to
+        what we had before we changed isKnownToBeLiveDuringGC(), this new code will cancel fewer
+        compilations. But, that's better than cancelling every compilation. I've filed a bug and
+        written a FIXME for investigating ways to resurrect the old behavior:
+        https://bugs.webkit.org/show_bug.cgi?id=149823
+
+        Nonetheless, this change looks like it might be a 1% speed-up on Octane. It improves earley
+        and gbemu.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::isKnownToBeLiveDuringGC):
+
+2015-10-05  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        [Intl] Change the return type of canonicalizeLocaleList() from JSArray* to Vector<String>
+        https://bugs.webkit.org/show_bug.cgi?id=149807
+
+        Reviewed by Benjamin Poulain.
+
+        From ECMA-402, 9.2.1, the abstract operation CanonicalizeLocaleList
+        returns a List of Strings. From the spec, we never modify the result
+        from CanonicalizeLocaleList(). We never expose it to the user either.
+        This patch changes the return type of canonicalizeLocaleList() from
+        JSArray* to Vector<String>. This should ease the workload of the GC and
+        make the code a bit easier to read.
+
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlObject.cpp:
+        (JSC::canonicalizeLocaleList):
+        (JSC::lookupSupportedLocales):
+        (JSC::bestFitSupportedLocales):
+        (JSC::supportedLocales):
+        * runtime/IntlObject.h:
+
+2015-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in r190450
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+
+        The cause of the leak was VM shutdown, which happens in workers.
+
+        The fix is for CodeBlockSet to participate in lastChanceToFinalize,
+        since it's responsible for running CodeBlock destructors.
+
+        I ran the leaks tests locally and did not see any CodeBlock-related leaks.
+
+        Restored changesets:
+
+        "CodeBlock should be a GC object"
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/190450
+
+2015-10-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Allow an object's marking state to track The Three Colors
+        https://bugs.webkit.org/show_bug.cgi?id=149654
+
+        Reviewed by Geoffrey Garen.
+
+        I want to make GC marking concurrent (see https://bugs.webkit.org/show_bug.cgi?id=149432).
+        Concurrent GC require barriers to be executed during certain heap operations. We already have a
+        generational GC. Generational GCs also need barriers, and we already have those. The generational
+        GC barrier that we use is the "sticky mark bit" barrier. Ordinarily, mark bits get reset after a
+        collection. In our collector, there is a secondary mark bit that "sticks" - i.e. it does not get
+        reset. If the sticky mark bit is set in between two collections, then we know that the object is in
+        old space. This is sufficient to determine when to put things into remembered sets. Additionally,
+        the sticky mark bit is actually a tri-state that can also tell us if the object has been placed on
+        a remembered set.
+
+        This is awfully similar to what you want in a concurrent GC. Concurrent GCs typically want writes
+        to the heap that change the object graph to do different things depending on an object's marking
+        state, which is usually referred to as its color. White means that the object has never been seen
+        by the collector. All white objects are presumed dead at the flip. Grey objects are those that are
+        known to the collector but have not been scanned. Black objects are those that have been scanned,
+        and will not be scanned again. White is exactly just "not being marked", and both grey and black
+        mean "marked" - with "black" meaning "marked but not on any worklist". That's quite a bit like the
+        current "Marked" and "MarkedAndRemembered" states that we have for generational GC.
+        "MarkedAndRemembered" is a lot like "grey", and "Marked" is a lot like "black".
+
+        I want to make a concurrent GC that unifies the generational and concurrent barriers into a single
+        fast path check. Even better if the two barriers are entirely identical. You can do this using
+        Pirinen's technique #2 [1], originally due to Guy Steele [2]: when doing o.f=v where o is black and
+        v is white, turn o grey again. This is like remembering an object, in the sense that our gen GC
+        "rememberes" o when o is old and v is new. It remembers objects by putting them on the mark stack,
+        setting the generational state to MarkedAndRemembered, and doing nothing to the primary mark bit.
+
+        This makes our concurrent GC approach pretty obvious. We want to use one barrier for concurrent and
+        generational, and we want to basically keep our current barriers unchanged. The only things missing
+        are just some small changes to allow the concurrent GC to know precisely when an object is black,
+        and to know during object visiting if we are visiting the object for the first time during a
+        collection or a subsequent time due to barrier re-greying (concurrent GC) or barrier remembering
+        (generational GC). So, this patch does the following:
+
+        - Changes the terminology used for the gcData header byte in JSCell. This changes the name of this
+          to cellState, and introduces a new enumeration called CellState. This new enumeration behaves a
+          lot like the old GCData did. It has the following members, with the following correspondence to
+          the old GCData:
+
+          OldBlack: this is like Marked, with the exception that we ensure that an object becomes OldBlack
+              as soon as the object starts to be scanned. Previously, an object might be
+              MarkedAndRemembered during scanning and we'd turn all MarkedAndRemembered objects into Marked
+              objects during a post-processing step at the end of GC. This patch gets rid of that
+              post-processing. The act of visiting an object unconditionally makes it OldBlack. Note that
+              our definition of "black" is not that the object is done being scanned, but that it is either
+              being scanned right now or it has already been scanned. This is like a combination of
+              Siebert's anthracite and black states [3].
+
+          NewWhite: this is exactly NotMarked. It's the state that objects get when they are allocated.
+              It's impossible for an object to return to this state.
+
+          OldGrey: the object is on the mark stack and will be scanned at some point in the future. This
+              also means that this isn't the first time in this cycle that the object has been grey. In an
+              eden collection, an old object that has been remembered is thought of as being OldGrey, even
+              if this is the first time during this eden collection that it is grey. That's because an eden
+              collection must behave "as if" the grey->black transition for old objects magically happened
+              at the start of GC. Remembered objects are like old objects that underwent a concurrent
+              barrier re-greying just after the magical old object grey->black transition at the start of
+              GC. This state is almost exactly like MarkedAndRemembered, except that an object now
+              transitions from OldGrey to OldBlack at the beginning of visiting, rather than how previously
+              we transitioned from MarkedAndRemembered to Marked at the bitter end of GC.
+
+          NewGray: the object is on the mark stack and will be scanned at some point in the future. This
+              state has no clear relative in the old state system. It means that the object became grey due
+              to ordinary marking. Previously, ordinary marking would make the object Marked.
+
+        - Removal of the post-processing phase that "clears" the remembered set by moving all remembered
+          objects to the Marked state. This now happens magically during visiting, as described above.
+
+        - SlotVisitor now remembers the state that the object did have just before visiting. While visiting
+          that object, it's possible to query what the state was. This is used for copy space decisions and
+          for extra memory usage accounting. We don't want to put the backing store on the copy worklist,
+          and we don't want to count extra memory usage, if the object was OldGrey at the start of
+          visiting. Previously, we would be able to just ask if the object was MarkedAndRemembered since
+          that state wouldn't get cleared until after all marking finished. This change also simplifies
+          some APIs, because there is no need to pass the JSCell* pointer, since these SlotVisitor methods
+          no longer ask the cell for its state - instead they use the saved pre-visiting state.
+
+        - Removal of a bunch of helpers and abstractions. Previously we had various methods for asking if
+          an object was "marked" and if an object was "remembered". We had helpers for adjusting these
+          states, and those helpers would assert that they were being used the right way. This is not very
+          useful for concurrent GC, since now the set of possible state transitions is much larger. Also,
+          the previous use of the word "marked" was pretty bad - for example in Heap, "marked" refers to
+          the primary mark bit (that gets cleared at the flip), while in JSCell, "marked" refers to the
+          sticky mark bit (that does not get cleared, ever). This change gets rid of a lot of those helpers
+          and inlines their logic. This actually makes the code easier and more fun to read, since you can
+          now look at the marking and barrier code and see how that code uses the four CellStates. For
+          example, it's fun to see that the barrier gets fired for o.f=v exactly when o is OldBlack and v
+          is NewWhite.
+
+        This change shouldn't have any effect on performance or GC behavior. It does put our code in a
+        weird state where we now have states and comments referencing a concurrent GC that doesn't exist
+        yet.
+
+        Finally, some thoughts about the concurrent GC barrier and its implications for performance. This
+        barrier exhibits very poor guarantees about collector progress, but maximizes throughput by just
+        reusing the existing barrier code we already emit and optimize. I believe that even our epoch-based
+        barrier insertion DFG phase is correct for the concurrent interpretation of our existing barrier.
+        But, the barrier can regress the progress that the collector has made for two reasons:
+
+        Incremental update: you don't want to use this barrier with a black stack, since that would mean
+        that heap loads of white objects will have to explicitly re-grey the stack. The way you implement
+        this kind of collector is that collector termination will rescan the stack. Termination is reached
+        only if the at-termination re-scan greys no objects. This means that the collector is a fixpoint.
+        Luckily, our collector is already a fixpoint because of opaque roots and structure transitions.
+
+        Marking ain't monotonic: normally, once an object is black, it stays that way. In this collector,
+        black objects may become grey again. I don't have personal experience with such concurrent GCs, but
+        I suspect that this will basically be fine. Concurrent collections finish pretty quickly, and the
+        mutator usually touches only a subset of the heap. Only that subset of the heap that the mutator is
+        touching could be re-greyed. Probably, the GC will have to be hybrid incremental and concurrent,
+        and towards the end of GC when we do the termination stack re-scan, we can ensure that the
+        collector does some minimal amount of marking. If the minimal amount of marking done by the
+        collector is large enough, we can ensure that we reach termination before the mutator can regress
+        progress. The barrier cannot un-terminate the collector; if the collector reaches termination and
+        the barrier re-greys an object then it's actually doing a generational remembering rather than a
+        concurrent re-greying.
+
+        That's sort of the cute thing about the barrier - it is exactly a re-greying barrier during GC and
+        it is exactly a remembering barrier in between GCs.
+
+        [1] http://www.cs.utexas.edu/ftp/garbage/submit/readable/ppirinen11.ps
+        [2] http://dl.acm.org/citation.cfm?id=361005
+        [3] http://www.aicas.com/papers/ISMM132-siebert.pdf
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitChildren):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::masqueradesAsUndefinedWatchpointIsStillValid):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadCellState):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadMarkByte): Deleted.
+        * heap/CellState.h: Added.
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        * heap/CopiedBlock.h:
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        (JSC::CopiedBlock::shouldReportLiveBytes): Deleted.
+        * heap/GCLogging.cpp:
+        (JSC::LoggingFunctor::reviveCells):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::visitWeakHandles):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::clearRememberedSet): Deleted.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::isLive):
+        (JSC::Heap::isMarked):
+        (JSC::Heap::writeBarrier):
+        (JSC::Heap::reportExtraMemoryAllocated):
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::isRemembered): Deleted.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::visitChildren):
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::visitChildren): Deleted.
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::childCount):
+        (JSC::SlotVisitor::incrementChildCount):
+        (JSC::SlotVisitor::dataBeforeVisitingCurrentObject):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::internalAppend):
+        (JSC::SlotVisitor::copyLater):
+        (JSC::SlotVisitor::reportExtraMemoryVisited):
+        (JSC::SlotVisitor::heap):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::jumpIfIsRememberedOrInEden):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSCell.h:
+        (JSC::JSCell::cellState):
+        (JSC::JSCell::setCellState):
+        (JSC::JSCell::structureIDOffset):
+        (JSC::JSCell::indexingTypeOffset):
+        (JSC::JSCell::cellStateOffset):
+        (JSC::JSCell::setMarked): Deleted.
+        (JSC::JSCell::setRemembered): Deleted.
+        (JSC::JSCell::isMarked): Deleted.
+        (JSC::JSCell::isRemembered): Deleted.
+        (JSC::JSCell::gcDataOffset): Deleted.
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::JSCell):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyBackingStore):
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren):
+        * runtime/StructureIDBlob.h:
+        (JSC::StructureIDBlob::StructureIDBlob):
+        (JSC::StructureIDBlob::operator=):
+        * runtime/WeakMapData.cpp:
+        (JSC::WeakMapData::visitChildren):
+        (JSC::WeakMapData::set):
+        * tests/stress/basic-eden-gc-test.js: Added.
+            Hilariously, an earlier version of this patch that didn't have the NewGrey/OldGrey distinction
+            would only crash super-big tests that GCd twice but it didn't crash any small focused test. All
+            it took to show the need for the NewGrey/OldGrey distinction was this super simple test.
+
+2015-10-05  Geoffrey Garen  <ggaren@apple.com>
+
+        JSC::SlotVisitor should not be a hot mess
+        https://bugs.webkit.org/show_bug.cgi?id=149798
+
+        Reviewed by Andreas Kling.
+
+        I had to debug JSC::SlotVisitor the other day. It was hard to follow.
+        Let's make it easy to follow.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::resetVisitors):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::collectAndSweep):
+        * heap/Heap.h: Deleted the string hash-consing code. It
+        was dead code.
+
+        Since no benchmark noticed the commit that broke this feature, perhaps
+        it's not worth having.
+
+        Either way, the best thing to do with dead code is to delete it.
+        It's still there in svn if we ever want to pick it up again.
+
+        * heap/HeapRootVisitor.h:
+        (JSC::HeapRootVisitor::visit):
+        (JSC::HeapRootVisitor::visitor): Removed the private append functions
+        for unsafe pointers and switched HeapRootVisitor over to the public
+        specially named functions for unsafe pointers.
+
+        In future, we should either remove the public specially named functions
+        or remove HeapRootVisitor, since they serve the same purpose. At least
+        for now we don't have pairs of functions on SlotVisitor that do the
+        exact same thing.
+
+        * heap/SlotVisitor.cpp:
+        (JSC::validate): Moved this static function to the top of the file.
+
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset): More hash cons removal.
+
+        (JSC::SlotVisitor::append):
+
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        (JSC::SlotVisitor::appendToMarkStack): Renamed these functions to 
+        distinguish them from the up-front helper functions that just do type
+        conversions. These are the functions that actually do stuff.
+
+        Moved these functions out of line to make it easier to set breakpoints,
+        and to enable code changes for debugging, like printf and synchronous
+        marking, without recompiling the world.
+
+        setMarkedAndAppendToMarkStack is roughly 258 bytes long (not including
+        function prologue and epilogue), so inlining it was probably not a
+        great idea in the first place.
+
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared): Removed some stack probing code.
+        It was also dead.
+
+        (JSC::SlotVisitor::addOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRootTriState):
+        (JSC::SlotVisitor::opaqueRootCount):
+        (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary):
+        (JSC::SlotVisitor::mergeOpaqueRootsIfProfitable):
+        (JSC::SlotVisitor::donate):
+        (JSC::SlotVisitor::donateAndDrain):
+        (JSC::SlotVisitor::copyLater):
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        (JSC::SlotVisitor::harvestWeakReferences):
+        (JSC::SlotVisitor::finalizeUnconditionalFinalizers):
+        (JSC::SlotVisitor::dump): Moved more code out-of-line. These code paths
+        are not hot and/or not small, so we need more evidence before we inline
+        them. The SlotVisitor headers are included everywhere, so we should
+        make them include less.
+
+        Removed "internal" from all function names because it wasn't applied in
+        any consistent way that would mean anything.
+
+        (JSC::JSString::tryHashConsLock): Deleted.
+        (JSC::JSString::releaseHashConsLock): Deleted.
+        (JSC::JSString::shouldTryHashCons): Deleted.
+        (JSC::SlotVisitor::internalAppend): Deleted.
+        (JSC::SlotVisitor::validate): Deleted.
+
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::resetChildCount): Deleted.
+        (JSC::SlotVisitor::childCount): Deleted.
+        (JSC::SlotVisitor::incrementChildCount): Deleted. Removed this child
+        count thing. It was dead code.
+
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::appendUnbarrieredPointer):
+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyPointer):
+        (JSC::SlotVisitor::appendUnbarrieredValue):
+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyValue): Some renaming and un-inlining.
+
+        (JSC::SlotVisitor::appendUnbarrieredWeak): Don't null check our input.
+        The one true place where null checking happens is our out-of-line
+        code. All inline functions do only type conversions.
+
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::appendValues):
+        (JSC::SlotVisitor::addWeakReferenceHarvester):
+        (JSC::SlotVisitor::addUnconditionalFinalizer):
+        (JSC::SlotVisitor::reportExtraMemoryVisited): Some renaming and un-inlining.
+
+        (JSC::SlotVisitor::internalAppend): Deleted.
+        (JSC::SlotVisitor::unconditionallyAppend): Deleted.
+        (JSC::SlotVisitor::addOpaqueRoot): Deleted.
+        (JSC::SlotVisitor::containsOpaqueRoot): Deleted.
+        (JSC::SlotVisitor::containsOpaqueRootTriState): Deleted.
+        (JSC::SlotVisitor::opaqueRootCount): Deleted.
+        (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary): Deleted.
+        (JSC::SlotVisitor::mergeOpaqueRootsIfProfitable): Deleted.
+        (JSC::SlotVisitor::donate): Deleted.
+        (JSC::SlotVisitor::donateAndDrain): Deleted.
+        (JSC::SlotVisitor::copyLater): Deleted.
+
+        * runtime/JSString.h:
+        (JSC::JSString::finishCreation):
+        (JSC::JSString::setIs8Bit):
+        (JSC::JSString::isHashConsSingleton): Deleted.
+        (JSC::JSString::clearHashConsSingleton): Deleted.
+        (JSC::JSString::setHashConsSingleton): Deleted. More hash cons removal.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::currentThreadIsHoldingAPILock):
+        (JSC::VM::apiLock):
+        (JSC::VM::haveEnoughNewStringsToHashCons): Deleted.
+        (JSC::VM::resetNewStringsSinceLastHashCons): Deleted. More hash cons removal.
+
+2015-10-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Inline cache repatching should be throttled if it happens a lot
+        https://bugs.webkit.org/show_bug.cgi?id=149796
+        rdar://problem/22674436
+
+        Reviewed by Saam Barati.
+
+        We noticed a slight PLT regression from http://trac.webkit.org/changeset/189586. It's because
+        some pages do things that our inline caches mishandle, in the sense that some ICs end up
+        repatching themselves very frequently. The cost of repatching outweighs the speed-up on those
+        pages. There are probably super smart things we could do to tune the IC heuristics to make the
+        ICs do the right thing on those pages. But more fundamentally, we should ensure that our ICs
+        back off from continuous repatching if they repatch a lot. That's what this change does.
+
+        With this change, StructureStubInfo counts the number of repatchings. If that exceeds a
+        threshold, we put the IC into a cool-down mode, where some number of future repatch events do
+        nothing but decrement the cool-down counter. The duration of cool-down increases exponentially
+        every time we have to do it.
+
+        This change also outlines a lot of code. The fact that StructureStubInfo had a lot of inline
+        methods was starting to get on my nerves. Now it only has inline methods for things that need
+        to be inlined. Also, I changed StructureStubInfo to be a class rather than a struct. Maybe
+        with enough such incremental changes, eventually StructureStubInfo will actually behave like a
+        proper class.
+
+        This has no effect on JSC benchmarks. It progresses one of the pages that was hit by the
+        regression by 15%. It's hard to see if this totally fixes the entire PLT regression since the
+        geomean regression was very close to noise.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printPutByIdCacheStatus):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::checkIfOptimizationThresholdReached):
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/PolymorphicAccess.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/StructureStubClearingWatchpoint.h:
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::~StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::initStub):
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::addAccessCase):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::considerCaching):
+        (JSC::StructureStubInfo::willRepatch):
+        (JSC::StructureStubInfo::willCoolDown):
+        (JSC::getStructureStubInfoCodeOrigin):
+        (JSC::StructureStubInfo::StructureStubInfo): Deleted.
+        (JSC::StructureStubInfo::initGetByIdSelf): Deleted.
+        (JSC::StructureStubInfo::initPutByIdReplace): Deleted.
+        (JSC::StructureStubInfo::initStub): Deleted.
+        (JSC::StructureStubInfo::seenOnce): Deleted.
+        (JSC::StructureStubInfo::setSeen): Deleted.
+        * jit/JIT.h:
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        * runtime/Options.h:
+
+2015-10-04  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeBlock.h shouldn't be included from everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=149785
+
+        Reviewed by Andreas Kling.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:
+        * dfg/DFGAdaptiveStructureWatchpoint.cpp:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::callSiteBitsAreBytecodeOffset):
+        (JSC::CallFrame::callSiteBitsAreCodeOriginIndex):
+        (JSC::CallFrame::callSiteAsRawBits):
+        (JSC::CallFrame::callSiteIndex):
+        (JSC::CallFrame::hasActivation):
+        (JSC::CallFrame::uncheckedActivation):
+        (JSC::CallFrame::stack):
+        * interpreter/CallFrameInlines.h: Removed.
+        * interpreter/Interpreter.cpp:
+        * interpreter/StackVisitor.cpp:
+        * runtime/DirectArguments.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSCInlines.h:
+        * runtime/LiteralParser.cpp:
+        * runtime/NullSetterFunction.cpp:
+        * tools/JSDollarVMPrototype.cpp:
+
+2015-10-03  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190522.
+        https://bugs.webkit.org/show_bug.cgi?id=149787
+
+        Caused a lot of leaks (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Unreviewed, rolling back in r190450"
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/190522
+
+2015-10-02  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: Add breakpoint option to ignore n times before stopping
+        https://bugs.webkit.org/show_bug.cgi?id=147664
+
+        Reviewed by Timothy Hatcher.
+
+        * debugger/Breakpoint.h:
+        (JSC::Breakpoint::Breakpoint):
+        Added ignoreCount and hitCount fields. Cleaned up initializers.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::hasBreakpoint):
+        If a breakpoint matches the current text position, increment breakpoint hit count and
+        compare with ignore count before testing the breakpoint condition.
+
+        * inspector/ScriptBreakpoint.h:
+        (Inspector::ScriptBreakpoint::ScriptBreakpoint):
+        Added ignoreCount field. Cleaned up initializers.
+
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::setBreakpoint):
+        Added ignoreCount field.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::buildObjectForBreakpointCookie):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        Plumbing for ignoreCount property.
+
+        * inspector/protocol/Debugger.json:
+        Added optional ignoreCount property to BreakpointOptions object.
+
+2015-10-02  Filip Pizlo <fpizlo@apple.com> and Mark Lam <mark.lam@apple.com>
+
+        We should not add InferredTypeTables to old Structures
+        https://bugs.webkit.org/show_bug.cgi?id=149767
+        rdar://problem/22825526
+
+        Reviewed by Saam Barati.
+
+        Our property type inference has an optimization where the absence of an InferredTypeTable is
+        taken to mean that all properties are TOP. This is great because most Structures come into
+        existence through reflective stores, and we don't want to waste time inferring types for
+        those.
+
+        But our code was not obeying this rule properly. If we were doing a transition, we would
+        assume that this meant that we were creating a new structure, and so we would give it an
+        InferredTypeTable if we were doing a non-reflective store (i.e. context = PutById). But that
+        same structure could already have been in use prior to us giving it an InferredTypeTable. At
+        that point bad things will start to happen because the objects created before we created the
+        table, and the inline caches compiled before then, will have types that disagree with the new
+        objects and inline caches despite them sharing the same structure and property names.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/Structure.h:
+        * tests/stress/add-inferred-type-table-to-existing-structure.js: Added.
+        (foo):
+        (bar):
+        (baz):
+
+2015-10-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed, rolling out r190520, some tests assert / crash.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::willStartCollection): Deleted.
+        (JSC::Heap::didFinishCollection): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::addObserver): Deleted.
+        (JSC::Heap::removeObserver): Deleted.
+        * heap/HeapObserver.h: Removed.
+        * heap/MarkedSpace.h:
+        * inspector/InspectorEnvironment.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::vm): Deleted.
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorHeapAgent.cpp: Removed.
+        * inspector/agents/InspectorHeapAgent.h: Removed.
+        * inspector/protocol/Heap.json: Removed.
+
+2015-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in r190450
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+
+        The cause of the crash was a CodeBlock, after surviving a call to
+        deleteAllCode by virtue of being in the remembered set, trying to mark
+        its inlined CodeBlocks via pointers from its inlined executables.
+        Since deleteAllCode clears those pointers, the CodeBlock would ASSERT.
+        (Any other choice to retain a CodeBlock after deleteAllCode -- for
+        example, conservative marking -- could trigger the same bug.)
+
+        The fix is for InlineCallFrame to point directly to its inlined CodeBlock
+        instead of pointing indirectly via an executable. This guarantees that
+        CodeBlocks are GC safe regardless of whether we've called deleteAllCode.
+
+        Restored changesets:
+
+        "CodeBlock should be a GC object"
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/190450
+
+2015-10-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Include Garbage Collection Event in Timeline
+        https://bugs.webkit.org/show_bug.cgi?id=142510
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * heap/HeapObserver.h:        
+        * heap/Heap.cpp:
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::didFinishCollection):
+        * heap/Heap.h:
+        (JSC::Heap::addObserver):
+        (JSC::Heap::removeObserver):
+        Allow observers on heap to add hooks for starting / ending garbage collection.
+
+        * inspector/InspectorEnvironment.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::vm):
+        * inspector/JSGlobalObjectInspectorController.h:
+        Access the VM through the InspectorEnvironment as it won't change.
+
+        * inspector/agents/InspectorHeapAgent.cpp: Added.
+        (Inspector::InspectorHeapAgent::InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::~InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorHeapAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorHeapAgent::enable):
+        (Inspector::InspectorHeapAgent::disable):
+        (Inspector::InspectorHeapAgent::gc):
+        (Inspector::protocolTypeForHeapOperation):
+        (Inspector::InspectorHeapAgent::willGarbageCollect):
+        (Inspector::InspectorHeapAgent::didGarbageCollect):
+        * inspector/agents/InspectorHeapAgent.h: Added.
+        * inspector/protocol/Heap.json: Added.
+        New domain and agent to handle tasks related to the JavaScriptCore heap.
+
+2015-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling out r190450
+        https://bugs.webkit.org/show_bug.cgi?id=148560
+
+        Crashes seen on el cap wk1 bots.
+
+        Reverted changesets:
+
+        "CodeBlock should be a GC object"
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/190450
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::inferredName):
+        (JSC::CodeBlock::dumpAssumingJITType):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::setNumParameters):
+        (JSC::CodeBlock::specialOSREntryBlockOrNull):
+        (JSC::CodeBlock::visitStrongly):
+        (JSC::CodeBlock::visitAggregate):
+        (JSC::CodeBlock::shouldVisitStrongly):
+        (JSC::CodeBlock::isKnownToBeLiveDuringGC):
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference):
+        (JSC::CodeBlock::shouldJettisonDueToOldAge):
+        (JSC::CodeBlock::determineLiveness):
+        (JSC::CodeBlock::visitWeakReferences):
+        (JSC::CodeBlock::finalizeLLIntInlineCaches):
+        (JSC::CodeBlock::finalizeBaselineJITInlineCaches):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::visitOSRExitTargets):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::newReplacement):
+        (JSC::ProgramCodeBlock::replacement):
+        (JSC::ModuleProgramCodeBlock::replacement):
+        (JSC::EvalCodeBlock::replacement):
+        (JSC::FunctionCodeBlock::replacement):
+        (JSC::ProgramCodeBlock::capabilityLevelInternal):
+        (JSC::ModuleProgramCodeBlock::capabilityLevelInternal):
+        (JSC::EvalCodeBlock::capabilityLevelInternal):
+        (JSC::FunctionCodeBlock::capabilityLevelInternal):
+        (JSC::WebAssemblyCodeBlock::replacement):
+        (JSC::WebAssemblyCodeBlock::capabilityLevelInternal):
+        (JSC::CodeBlock::jettison):
+        (JSC::CodeBlock::capabilityLevel):
+        (JSC::FunctionCodeBlock::destroy): Deleted.
+        (JSC::WebAssemblyCodeBlock::destroy): Deleted.
+        (JSC::ProgramCodeBlock::destroy): Deleted.
+        (JSC::ModuleProgramCodeBlock::destroy): Deleted.
+        (JSC::EvalCodeBlock::destroy): Deleted.
+        (JSC::CodeBlock::finishCreation): Deleted.
+        (JSC::CodeBlock::setAlternative): Deleted.
+        (JSC::CodeBlock::visitWeakly): Deleted.
+        (JSC::CodeBlock::visitChildren): Deleted.
+        (JSC::timeToLive): Deleted.
+        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences): Deleted.
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Deleted.
+        (JSC::CodeBlock::replacement): Deleted.
+        (JSC::CodeBlock::computeCapabilityLevel): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::unlinkedCodeBlock):
+        (JSC::CodeBlock::addressOfNumParameters):
+        (JSC::CodeBlock::offsetOfNumParameters):
+        (JSC::CodeBlock::alternative):
+        (JSC::CodeBlock::setAlternative):
+        (JSC::CodeBlock::forEachRelatedCodeBlock):
+        (JSC::CodeBlock::specializationKind):
+        (JSC::CodeBlock::instructionCount):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::hasBaselineJITProfiling):
+        (JSC::CodeBlock::capabilityLevelState):
+        (JSC::CodeBlock::addConstant):
+        (JSC::CodeBlock::appendExceptionHandler):
+        (JSC::CodeBlock::setConstantRegisters):
+        (JSC::CodeBlock::replaceConstant):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::EvalCodeBlock::variable):
+        (JSC::EvalCodeBlock::numVariables):
+        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock):
+        (JSC::ExecState::uncheckedR):
+        (JSC::CodeBlock::clearMarks):
+        (JSC::CodeBlockSet::mark):
+        (JSC::ScriptExecutable::forEachCodeBlock):
+        (JSC::ProgramCodeBlock::create): Deleted.
+        (JSC::ProgramCodeBlock::createStructure): Deleted.
+        (JSC::ModuleProgramCodeBlock::create): Deleted.
+        (JSC::ModuleProgramCodeBlock::createStructure): Deleted.
+        (JSC::EvalCodeBlock::create): Deleted.
+        (JSC::EvalCodeBlock::createStructure): Deleted.
+        (JSC::FunctionCodeBlock::create): Deleted.
+        (JSC::FunctionCodeBlock::createStructure): Deleted.
+        (JSC::WebAssemblyCodeBlock::create): Deleted.
+        (JSC::WebAssemblyCodeBlock::createStructure): Deleted.
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled): Deleted.
+        * bytecode/DeferredCompilationCallback.cpp:
+        (JSC::DeferredCompilationCallback::DeferredCompilationCallback):
+        (JSC::DeferredCompilationCallback::~DeferredCompilationCallback):
+        (JSC::DeferredCompilationCallback::compilationDidComplete):
+        * bytecode/DeferredCompilationCallback.h:
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::addAccessCase):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGDesiredTransitions.cpp:
+        (JSC::DFG::DesiredTransition::reallyAdd):
+        * dfg/DFGDesiredWeakReferences.cpp:
+        (JSC::DFG::DesiredWeakReferences::reallyAdd):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGJITCode.h:
+        (JSC::DFG::JITCode::osrEntryBlock): Deleted.
+        (JSC::DFG::JITCode::setOSREntryBlock): Deleted.
+        (JSC::DFG::JITCode::clearOSREntryBlock): Deleted.
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::reallyAdd):
+        (JSC::DFG::Plan::notifyReady):
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        (JSC::DFG::Plan::finalizeAndNotifyCallback):
+        (JSC::DFG::Plan::key):
+        (JSC::DFG::Plan::clearCodeBlockMarks):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        (JSC::DFG::Plan::rememberCodeBlocks): Deleted.
+        * dfg/DFGPlan.h:
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLDeferredCompilationCallback::ToFTLDeferredCompilationCallback):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::~ToFTLDeferredCompilationCallback):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::create):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
+        * dfg/DFGToFTLDeferredCompilationCallback.h:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::~ToFTLForOSREntryDeferredCompilationCallback):
+        (JSC::DFG::Ref<ToFTLForOSREntryDeferredCompilationCallback>ToFTLForOSREntryDeferredCompilationCallback::create):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::completeAllPlansForVM):
+        (JSC::DFG::Worklist::clearCodeBlockMarks):
+        (JSC::DFG::completeAllPlansForVM):
+        (JSC::DFG::clearCodeBlockMarks):
+        (JSC::DFG::Worklist::rememberCodeBlocks): Deleted.
+        (JSC::DFG::rememberCodeBlocks): Deleted.
+        * dfg/DFGWorklist.h:
+        (JSC::DFG::worklistForIndexOrNull):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::~CodeBlockSet):
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::clearMarksForFullCollection):
+        (JSC::CodeBlockSet::clearMarksForEdenCollection):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        (JSC::CodeBlockSet::remove):
+        (JSC::CodeBlockSet::traceMarked):
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        (JSC::CodeBlockSet::dump):
+        * heap/CodeBlockSet.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::clearLivenessData):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        (JSC::Heap::deleteAllCodeBlocks):
+        (JSC::Heap::deleteAllUnlinkedCodeBlocks):
+        (JSC::Heap::clearUnmarkedExecutables):
+        (JSC::Heap::willStartCollection):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * jit/GCAwareJITStubRoutine.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::isJIT):
+        (JSC::JITCode::timeToLive):
+        (JSC::JITCode::isLowerTier):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enter):
+        * jit/JITOperations.cpp:
+        * jit/JITToDFGDeferredCompilationCallback.cpp:
+        (JSC::JITToDFGDeferredCompilationCallback::create):
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
+        * jit/JITToDFGDeferredCompilationCallback.h:
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        (JSC::linkFor):
+        (JSC::linkPolymorphicCall):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode):
+        (JSC::ScriptExecutable::installCode):
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor):
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::EvalExecutable::clearCode):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::ProgramExecutable::clearCode):
+        (JSC::ModuleProgramExecutable::visitChildren):
+        (JSC::ModuleProgramExecutable::clearCode):
+        (JSC::FunctionExecutable::baselineCodeBlockFor):
+        (JSC::FunctionExecutable::visitChildren):
+        (JSC::FunctionExecutable::clearCode):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::WebAssemblyExecutable::visitChildren):
+        (JSC::WebAssemblyExecutable::clearCode):
+        (JSC::WebAssemblyExecutable::prepareForExecution):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::generatedJITCodeForCall):
+        (JSC::ScriptExecutable::prepareForExecution):
+        (JSC::ExecutableBase::clearCodeVirtual):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2015-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        CodeBlock should be a GC object
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+
+        Reviewed by Filip Pizlo.
+
+        We want CodeBlock to be a GC object:
+
+        (1) Sane write barriers. Because CodeBlock wasn't a GC object, we couldn't
+        execute a write barrier on it. This caused us to do weird things that
+        were hard to reason about, like executing a barrier on a related executable
+        (even though the executable might stop pointing to the CodeBlock before
+        the next GC), or pretending that an object had written to itself. Now,
+        when we write to a CodeBlock, we barrier the CodeBlock, and that's that.
+
+        (2) Simpler marking and destruction logic. There's no need to have a
+        custom remembered set or a destruction fixpoint if we just obey normal
+        GC rules.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::FunctionCodeBlock::destroy):
+        (JSC::WebAssemblyCodeBlock::destroy):
+        (JSC::ProgramCodeBlock::destroy):
+        (JSC::ModuleProgramCodeBlock::destroy):
+        (JSC::EvalCodeBlock::destroy): Add ClassInfo and destroy functions
+        because our GC object model requires them.
+
+        Note that we do not set the needsDestruction flag. Since CodeBlock needs
+        eager destruction, it runs its destructors through CodeBlockSet,
+        and not through normal object sweeping.
+
+        (JSC::CodeBlock::finishCreation): Factor out finishCreation from the
+        constructor because our GC object model requires it. Change write
+        barriers to note the CodeBlock as the owner.
+
+        (JSC::CodeBlock::~CodeBlock): Refactor to use the shared
+        unlinkIncomingCalls() function instead of rolling a copy by hand.
+
+        (JSC::CodeBlock::visitWeakly): New helper function for owner executables
+        to do weak marking that might jettison a CodeBlock. Our new GC logic
+        says that a CodeBlock pointer is a strong reference by default, and
+        clients need to opt in if they want to allow a CodeBlock to jettison.
+        This is easier to get right because it means that only those
+        specific owners that want jettison behavior need to worry about it,
+        while all other pointers are valid by default.
+
+        (JSC::CodeBlock::visitChildren): The default visit function keeps
+        everything alive.
+
+        (JSC::CodeBlock::shouldVisitStrongly):
+        (JSC::CodeBlock::isKnownToBeLiveDuringGC): No need to keep special state
+        anymore. If we're marked, we're live -- just like any other object.
+
+        (JSC::timeToLive): Move this code into CodeBlock.cpp so you can mess
+        with it without recompiling, and also because it's really a CodeBlock
+        policy.
+
+        (JSC::CodeBlock::WeakReferenceHarvester::visitWeakReferences):
+        (JSC::CodeBlock::UnconditionalFinalizer::finalizeUnconditionally): Use
+        internal objects for virtual callbacks because GC objects can't have
+        vtables.
+
+        (JSC::CodeBlock::unlinkIncomingCalls): Remove a fast path check that does
+        not exist in the copy of this code in ~CodeBlock because it is not
+        actually an optimization.
+
+        (JSC::CodeBlock::replacement):
+        (JSC::CodeBlock::computeCapabilityLevel): Make these functions generic
+        instead of virtual because GC objects can't have vtables.
+
+        (JSC::CodeBlock::visitStrongly): Deleted.
+        (JSC::CodeBlock::visitAggregate): Deleted.
+        (JSC::CodeBlock::visitWeakReferences): Deleted.
+        (JSC::CodeBlock::finalizeUnconditionally): Deleted.
+        (JSC::ProgramCodeBlock::replacement): Deleted.
+        (JSC::ModuleProgramCodeBlock::replacement): Deleted.
+        (JSC::EvalCodeBlock::replacement): Deleted.
+        (JSC::FunctionCodeBlock::replacement): Deleted.
+        (JSC::ProgramCodeBlock::capabilityLevelInternal): Deleted.
+        (JSC::ModuleProgramCodeBlock::capabilityLevelInternal): Deleted.
+        (JSC::EvalCodeBlock::capabilityLevelInternal): Deleted.
+        (JSC::FunctionCodeBlock::capabilityLevelInternal): Deleted.
+        (JSC::WebAssemblyCodeBlock::replacement): Deleted.
+        (JSC::WebAssemblyCodeBlock::capabilityLevelInternal): Deleted.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::unlinkedCodeBlock):
+        (JSC::CodeBlock::addressOfNumParameters):
+        (JSC::CodeBlock::offsetOfNumParameters):
+        (JSC::CodeBlock::alternative):
+        (JSC::CodeBlock::forEachRelatedCodeBlock):
+        (JSC::CodeBlock::specializationKind):
+        (JSC::CodeBlock::instructionCount):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::hasBaselineJITProfiling):
+        (JSC::CodeBlock::capabilityLevelState):
+        (JSC::CodeBlock::addConstant):
+        (JSC::CodeBlock::appendExceptionHandler):
+        (JSC::CodeBlock::setConstantRegisters):
+        (JSC::CodeBlock::replaceConstant):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::ProgramCodeBlock::create):
+        (JSC::ProgramCodeBlock::createStructure):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::ModuleProgramCodeBlock::create):
+        (JSC::ModuleProgramCodeBlock::createStructure):
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock):
+        (JSC::EvalCodeBlock::create):
+        (JSC::EvalCodeBlock::createStructure):
+        (JSC::EvalCodeBlock::variable):
+        (JSC::EvalCodeBlock::numVariables):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::EvalCodeBlock::unlinkedEvalCodeBlock):
+        (JSC::FunctionCodeBlock::create):
+        (JSC::FunctionCodeBlock::createStructure):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (JSC::WebAssemblyCodeBlock::create):
+        (JSC::WebAssemblyCodeBlock::createStructure):
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock):
+        (JSC::ExecState::uncheckedR):
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
+        (JSC::CodeBlockSet::mark):
+        (JSC::ScriptExecutable::forEachCodeBlock):
+        (JSC::CodeBlock::setAlternative): Deleted.
+        (JSC::CodeBlock::clearMarks): Deleted. Lots of mechanical changes to
+        match the logic changes above.
+
+        * bytecode/DeferredCompilationCallback.cpp:
+        (JSC::DeferredCompilationCallback::DeferredCompilationCallback):
+        (JSC::DeferredCompilationCallback::~DeferredCompilationCallback):
+        (JSC::DeferredCompilationCallback::compilationDidComplete):
+        * bytecode/DeferredCompilationCallback.h: Provide a profiledDFGCodeBlock
+        to all compilation callbacks instead of requiring the callback to
+        store the profiledDFGCodeBlock. This is how the rest of compilation
+        around the callback works anyway, and it is easier to do things this
+        way than to think about how a non-GC malloc'd object should keep its
+        CodeBlock alive.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::addAccessCase): Change the owner for write
+        barrier purposes to CodeBlock.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGDesiredTransitions.cpp:
+        (JSC::DFG::DesiredTransition::reallyAdd):
+        * dfg/DFGDesiredWeakReferences.cpp:
+        (JSC::DFG::DesiredWeakReferences::reallyAdd):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph): Ditto.
+
+        * dfg/DFGJITCode.h:
+        (JSC::DFG::JITCode::osrEntryBlock):
+        (JSC::DFG::JITCode::setOSREntryBlock):
+        (JSC::DFG::JITCode::clearOSREntryBlock): Use helper functions for 
+        accessing osrEntryBlock to help with write barrier stuff.
+
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::adjustAndJumpToTarget): Use CodeBlock as owner instead of
+        executable.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::reallyAdd):
+        (JSC::DFG::Plan::notifyReady):
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        (JSC::DFG::Plan::finalizeAndNotifyCallback):
+        (JSC::DFG::Plan::key):
+        (JSC::DFG::Plan::rememberCodeBlocks):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        (JSC::DFG::Plan::clearCodeBlockMarks): Deleted.
+        * dfg/DFGPlan.h: Use normal GC write barrier concepts to model the fact
+        that the compiler writes to CodeBlocks.
+
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLDeferredCompilationCallback::ToFTLDeferredCompilationCallback):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::~ToFTLDeferredCompilationCallback):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::create):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
+        * dfg/DFGToFTLDeferredCompilationCallback.h:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::~ToFTLForOSREntryDeferredCompilationCallback):
+        (JSC::DFG::Ref<ToFTLForOSREntryDeferredCompilationCallback>ToFTLForOSREntryDeferredCompilationCallback::create):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h: We always have
+        a profiledDFGCodeBlock passed to use -- see above.
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::completeAllPlansForVM):
+        (JSC::DFG::Worklist::rememberCodeBlocks):
+        (JSC::DFG::completeAllPlansForVM):
+        (JSC::DFG::rememberCodeBlocks):
+        (JSC::DFG::Worklist::clearCodeBlockMarks): Deleted.
+        (JSC::DFG::clearCodeBlockMarks): Deleted.
+        * dfg/DFGWorklist.h:
+        (JSC::DFG::worklistForIndexOrNull): Renamed to use remembered set terminology.
+
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::~CodeBlockSet):
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::clearMarksForFullCollection):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced): No need for a fixpoint
+        anymore since the GC can tell us if we are live.
+
+        (JSC::CodeBlockSet::remove):
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        (JSC::CodeBlockSet::dump):
+        (JSC::CodeBlockSet::clearMarksForEdenCollection): Deleted. No need for
+        this logic anymore since the GC will clear our mark bit.
+
+        (JSC::CodeBlockSet::traceMarked): Deleted. No need for this marking
+        fixpoint anymore either.
+
+        * heap/CodeBlockSet.h:
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots): Moved some of this logic around to make the
+        algorithm clearer. 
+
+        (JSC::Heap::deleteAllCodeBlocks): Deleting CodeBlocks can only clear
+        pointers immediately; they won't fully delete until the next GC and sweep.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * jit/GCAwareJITStubRoutine.h: CodeBlock is owner now.
+
+        * jit/JITCode.h:
+        (JSC::JITCode::isJIT):
+        (JSC::JITCode::isLowerTier):
+        (JSC::JITCode::timeToLive): Deleted.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enter): CodeBlock is owner now.
+
+        * jit/JITOperations.cpp:
+        * jit/JITToDFGDeferredCompilationCallback.cpp:
+        (JSC::JITToDFGDeferredCompilationCallback::create):
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
+        * jit/JITToDFGDeferredCompilationCallback.h:
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        (JSC::linkFor):
+        (JSC::linkPolymorphicCall):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL): 
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal): CodeBlock is owner now.
+
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode): Provide a generic clearCode() so that
+        it can be used on any Executable. This fixes a very subtle bug where
+        deleteAllCode() does not remove CodeBlocks from non-function executables
+        that have been saved in stack traces.
+
+        (JSC::ScriptExecutable::installCode): WriteBarrier requires special
+        handling for pointers that may be null.
+
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor):
+        (JSC::ScriptExecutable::prepareForExecutionImpl): Update for interface
+        changes.
+
+        (JSC::EvalExecutable::visitChildren):
+        (JSC::ProgramExecutable::visitChildren):
+        (JSC::ModuleProgramExecutable::visitChildren):
+        (JSC::FunctionExecutable::visitChildren):
+        (JSC::WebAssemblyExecutable::visitChildren): Visit weakly because we want
+        to participate in jettisoning.
+
+        (JSC::WebAssemblyExecutable::prepareForExecution):
+        (JSC::EvalExecutable::clearCode): Deleted.
+        (JSC::ProgramExecutable::clearCode): Deleted.
+        (JSC::ModuleProgramExecutable::clearCode): Deleted.
+        (JSC::FunctionExecutable::clearCode): Deleted.
+        (JSC::WebAssemblyExecutable::clearCode): Deleted.
+
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::generatedJITCodeForCall):
+        (JSC::ScriptExecutable::prepareForExecution):
+        (JSC::ExecutableBase::clearCodeVirtual): Deleted.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h: Provide structures because our GC requires it.
+
+2015-10-01  Mark Lam  <mark.lam@apple.com>
+
+        Remove unnecessary SpecialFastCaseProfiles.
+        https://bugs.webkit.org/show_bug.cgi?id=149729
+
+        Reviewed by Saam Barati.
+
+        The current baseline code creates special fast case profiles records for
+        bytecodes that don't need them.  This was done to keep the DFG from crashing when
+        it searches for such a profile and don't find one.  Instead, we will fix the code
+        to check for the existence of the profile before dereferencing it to get a count.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::specialFastCaseProfileCountForBytecodeOffset):
+        (JSC::CodeBlock::couldTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::numberOfArrayProfiles):
+        (JSC::CodeBlock::arrayProfiles):
+        (JSC::CodeBlock::addArrayProfile):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase): Deleted.  Not used.
+        (JSC::CodeBlock::likelyToTakeAnySlowCase): Deleted.   Not used.
+        * jit/JITArithmetic.cpp:
+
+        (JSC::JIT::compileBinaryArithOp):
+        - Only op_mul needs the profile.  So, only allocate it in the op_mul case.
+
+        (JSC::JIT::emit_op_mul):
+        - These op_mul cases create the profile but never increments its counter.
+          Hence, we can get rid of these.
+
+2015-10-01  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add TypedArray.prototype functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=148035
+
+        Reviewed by Geoffrey Garen.
+
+        This patch should add most of the functionality for
+        the prototype properties of TypedArray objects in ES6.
+        There are a few exceptions to this, which will be added
+        in upcoming patches:
+
+        1) First we do not use the species constructor for some
+        of the TypedArray prototype functions (namely: map, filter,
+        slice, and subarray). That will need to be added when
+        species constructors are finished.
+
+        2) TypedArrays still have a length, byteOffset, byteLength,
+        and buffer are still attached to the TypedArray instance (in
+        the spec they are on the TypedArray.prototype instance object)
+        since the JIT currently assumes those properties are fixed.
+
+        3) The TypedArray.constructor property is not added yet
+        as it should point to the TypedArray instance object,
+        which will be added in a future patch.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/TypedArray.prototype.js: Added.
+        (every):
+        (find):
+        (findIndex):
+        (forEach):
+        (some):
+        (sort.min):
+        (sort.merge):
+        (sort.mergeSort):
+        (sort):
+        (reduce):
+        (reduceRight):
+        (map):
+        (filter):
+        (toLocaleString):
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue):
+        (JSC::JSGenericTypedArrayView::setRangeToValue):
+        (JSC::JSGenericTypedArrayView::sort):
+        (JSC::JSGenericTypedArrayView::purifyArray):
+        (JSC::JSGenericTypedArrayView::sortComparison):
+        (JSC::JSGenericTypedArrayView::sortFloat):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h: Added.
+        (JSC::argumentClampedIndexFromStartOrEnd):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncEntries):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncFill):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncKeys):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoGetterFuncLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteOffset):
+        (JSC::genericTypedArrayViewProtoFuncReverse):
+        (JSC::genericTypedArrayViewPrivateFuncSort):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewProtoFuncSubarray):
+        (JSC::typedArrayViewProtoFuncValues):
+        * runtime/JSGenericTypedArrayViewPrototypeInlines.h:
+        (JSC::JSGenericTypedArrayViewPrototype<ViewClass>::finishCreation):
+        (JSC::genericTypedArrayViewProtoFuncSet): Deleted.
+        (JSC::genericTypedArrayViewProtoFuncSubarray): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSObject.h:
+        * runtime/JSTypedArrayPrototypes.cpp:
+        * runtime/JSTypedArrayPrototypes.h:
+        * runtime/JSTypedArrayViewPrototype.cpp: Added.
+        (JSC::typedArrayViewPrivateFuncLength):
+        (JSC::typedArrayViewPrivateFuncSort):
+        (JSC::typedArrayViewProtoFuncSet):
+        (JSC::typedArrayViewProtoFuncEntries):
+        (JSC::typedArrayViewProtoFuncCopyWithin):
+        (JSC::typedArrayViewProtoFuncFill):
+        (JSC::typedArrayViewProtoFuncLastIndexOf):
+        (JSC::typedArrayViewProtoFuncIndexOf):
+        (JSC::typedArrayViewProtoFuncJoin):
+        (JSC::typedArrayViewProtoFuncKeys):
+        (JSC::typedArrayViewProtoGetterFuncLength):
+        (JSC::typedArrayViewProtoGetterFuncByteLength):
+        (JSC::typedArrayViewProtoGetterFuncByteOffset):
+        (JSC::typedArrayViewProtoFuncReverse):
+        (JSC::typedArrayViewProtoFuncSubarray):
+        (JSC::typedArrayViewProtoFuncSlice):
+        (JSC::typedArrayViewProtoFuncValues):
+        (JSC::JSTypedArrayViewPrototype::JSTypedArrayViewPrototype):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        (JSC::JSTypedArrayViewPrototype::create):
+        (JSC::JSTypedArrayViewPrototype::createStructure):
+        * runtime/JSTypedArrayViewPrototype.h: Copied from Source/JavaScriptCore/runtime/JSTypedArrayPrototypes.cpp.
+        * tests/es6.yaml:
+        * tests/stress/resources/standalone-pre.js: Added.
+        (description):
+        (debug):
+        (escapeString):
+        (testPassed):
+        (testFailed):
+        (areNumbersEqual):
+        (areArraysEqual):
+        (isMinusZero):
+        (isTypedArray):
+        (isResultCorrect):
+        (stringify):
+        (shouldBe):
+        (dfgShouldBe):
+        (shouldBeType):
+        (shouldBeTrue):
+        (shouldBeFalse):
+        (shouldBeNaN):
+        (shouldBeNull):
+        (shouldBeEqualToString):
+        (shouldBeUndefined):
+        (shouldNotThrow):
+        (shouldThrow):
+        (dfgCompiled):
+        (dfgIncrement):
+        (noInline):
+        (finishJSTest):
+        * tests/stress/resources/typedarray-test-helper-functions.js: Added.
+        (forEachTypedArray):
+        (isSameFunctionForEachTypedArrayPrototype.eq):
+        (isSameFunctionForEachTypedArrayPrototype):
+        (hasSameValues):
+        (foo):
+        (testPrototypeFunctionHelper):
+        (testPrototypeFunctionOnSigned):
+        (testPrototypeFunctionOnFloat):
+        (testPrototypeFunction):
+        (tester):
+        (testPrototypeReceivesArray):
+        * tests/stress/typedarray-copyWithin.js: Added.
+        * tests/stress/typedarray-every.js: Added.
+        (isBigEnough):
+        (isBigEnoughAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-fill.js: Added.
+        * tests/stress/typedarray-filter.js: Added.
+        (keepEven):
+        (keepEvenAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-find.js: Added.
+        (keepEven):
+        (keepEvenAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-findIndex.js: Added.
+        (keepEven):
+        (keepEvenAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-forEach.js: Added.
+        (checkCorrect.let.list):
+        (checkCorrect):
+        (createChecker):
+        (foo):
+        (changeArray):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-indexOf.js: Added.
+        (keepEven):
+        * tests/stress/typedarray-lastIndexOf.js: Added.
+        * tests/stress/typedarray-map.js: Added.
+        (even):
+        (evenAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-reduce.js: Added.
+        (createArray):
+        (sum):
+        (createArrayAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-reduceRight.js: Added.
+        (createArray):
+        (sum):
+        (createArrayAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-slice.js: Added.
+        * tests/stress/typedarray-some.js: Added.
+        (isBigEnough):
+        (isBigEnoughAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-sort.js: Added.
+        (sortBackwards):
+        (compareException):
+
+2015-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce SymbolUse optimization into CompareEq and CompareStrictEq
+        https://bugs.webkit.org/show_bug.cgi?id=149616
+
+        Reviewed by Saam Barati.
+
+        Since ES6 Symbols are used as an enum value[1] (And WebKit inspector do so for Esprima's type of nodes),
+        optimizing equality comparison for symbols makes much sense.
+
+        This patch leverages SymbolUse for CompareEq and CompareStrictEq.
+        Optimizations for both DFG and FTL are implemented.
+
+        [1]: http://www.2ality.com/2014/12/es6-symbols.html
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateSymbol):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        (JSC::DFG::SpeculativeJIT::extractStringImplFromBinarySymbols):
+        (JSC::DFG::SpeculativeJIT::compileSymbolEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleSymbolEquality):
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareStrictEq):
+        * tests/stress/symbol-equality.js: Added.
+        (shouldBe):
+        (equal):
+        (strictEqual):
+        (list.forEach.result.set 1):
+
+2015-10-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Streams API] Add support for private WebCore JS builtins functions
+        https://bugs.webkit.org/show_bug.cgi?id=149518
+
+        Reviewed by Darin Adler.
+
+        Adding API to add private identifiers on the fly.
+        This is used to support private JS Builtin functions/private JS Builtin names in WebCore.
+
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::appendExternalName):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::appendExternalName):
+        * runtime/CommonIdentifiers.h:
+
+2015-09-30  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Unreviewed, cleanup after r190385
+
+        TypedArray.prototype.js is removed at r190385.
+        Remove it from CMakeLists.txt as well.
+
+        * CMakeLists.txt:
+
+2015-09-30  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190367 and r190373.
+        https://bugs.webkit.org/show_bug.cgi?id=149694
+
+        Windows build broken (Requested by smfr on #webkit).
+
+        Reverted changesets:
+
+        "[ES6] Add TypedArray.prototype functionality."
+        https://bugs.webkit.org/show_bug.cgi?id=148035
+        http://trac.webkit.org/changeset/190367
+
+        "Unreviewed Windows buildfix."
+        http://trac.webkit.org/changeset/190373
+
+2015-09-30  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed Windows buildfix.
+
+        * CMakeLists.txt:
+
+2015-09-30  Michael Saboff  <msaboff@apple.com>
+
+        Relanding r190289 with the following two fixes:
+
+         1. REGRESSION(r190289): It made Speedometer/Full.html performance test fail
+            https://bugs.webkit.org/show_bug.cgi?id=149621
+
+            Reviewed by Saam Barati.
+
+            We need to restore callee saves for both the fast and slow paths before making a
+            tail call in the FTL.
+
+            * ftl/FTLJSCallBase.cpp:
+            (JSC::FTL::JSCallBase::emit):
+
+         2. [ARM] REGRESSION(r190289): It made 374 tests crash on 32 bit ARM Linux
+            https://bugs.webkit.org/show_bug.cgi?id=149619
+
+            Reviewed by Filip Pizlo.
+
+            Need to check for ARMv7_TRADITIONAL and ARMv7 in addition to ARM in "if"
+            statement to handle platforms with a link register.
+            
+            * llint/LowLevelInterpreter.asm:
+            (prepareForTailCall):
+
+2015-09-30  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add TypedArray.prototype functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=148035
+
+        Reviewed by Geoffrey Garen.
+
+        This patch should add most of the functionality for
+        the prototype properties of TypedArray objects in ES6.
+        There are a few exceptions to this, which will be added
+        in upcoming patches:
+
+        1) First we do not use the species constructor for some
+        of the TypedArray prototype functions (namely: map, filter,
+        slice, and subarray). That will need to be added when
+        species constructors are finished.
+
+        2) TypedArrays still have a length, byteOffset, byteLength,
+        and buffer are still attached to the TypedArray instance (in
+        the spec they are on the TypedArray.prototype instance object)
+        since the JIT currently assumes those properties are fixed.
+
+        3) The TypedArray.constructor property is not added yet
+        as it should point to the TypedArray instance object,
+        which will be added in a future patch.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/TypedArray.prototype.js: Added.
+        (every):
+        (find):
+        (findIndex):
+        (forEach):
+        (some):
+        (sort.min):
+        (sort.merge):
+        (sort.mergeSort):
+        (sort):
+        (reduce):
+        (reduceRight):
+        (map):
+        (filter):
+        (toLocaleString):
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue):
+        (JSC::JSGenericTypedArrayView::setRangeToValue):
+        (JSC::JSGenericTypedArrayView::sort):
+        (JSC::JSGenericTypedArrayView::purifyArray):
+        (JSC::JSGenericTypedArrayView::sortComparison):
+        (JSC::JSGenericTypedArrayView::sortFloat):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h: Added.
+        (JSC::argumentClampedIndexFromStartOrEnd):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncEntries):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncFill):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncKeys):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoGetterFuncLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteOffset):
+        (JSC::genericTypedArrayViewProtoFuncReverse):
+        (JSC::genericTypedArrayViewPrivateFuncSort):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewProtoFuncSubarray):
+        (JSC::typedArrayViewProtoFuncValues):
+        * runtime/JSGenericTypedArrayViewPrototypeInlines.h:
+        (JSC::JSGenericTypedArrayViewPrototype<ViewClass>::finishCreation):
+        (JSC::genericTypedArrayViewProtoFuncSet): Deleted.
+        (JSC::genericTypedArrayViewProtoFuncSubarray): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSObject.h:
+        * runtime/JSTypedArrayPrototypes.cpp:
+        * runtime/JSTypedArrayPrototypes.h:
+        * runtime/JSTypedArrayViewPrototype.cpp: Added.
+        (JSC::typedArrayViewPrivateFuncLength):
+        (JSC::typedArrayViewPrivateFuncSort):
+        (JSC::typedArrayViewProtoFuncSet):
+        (JSC::typedArrayViewProtoFuncEntries):
+        (JSC::typedArrayViewProtoFuncCopyWithin):
+        (JSC::typedArrayViewProtoFuncFill):
+        (JSC::typedArrayViewProtoFuncLastIndexOf):
+        (JSC::typedArrayViewProtoFuncIndexOf):
+        (JSC::typedArrayViewProtoFuncJoin):
+        (JSC::typedArrayViewProtoFuncKeys):
+        (JSC::typedArrayViewProtoGetterFuncLength):
+        (JSC::typedArrayViewProtoGetterFuncByteLength):
+        (JSC::typedArrayViewProtoGetterFuncByteOffset):
+        (JSC::typedArrayViewProtoFuncReverse):
+        (JSC::typedArrayViewProtoFuncSubarray):
+        (JSC::typedArrayViewProtoFuncSlice):
+        (JSC::typedArrayViewProtoFuncValues):
+        (JSC::JSTypedArrayViewPrototype::JSTypedArrayViewPrototype):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        (JSC::JSTypedArrayViewPrototype::create):
+        (JSC::JSTypedArrayViewPrototype::createStructure):
+        * runtime/JSTypedArrayViewPrototype.h: Copied from Source/JavaScriptCore/runtime/JSTypedArrayPrototypes.cpp.
+        * tests/stress/resources/standalone-pre.js: Added.
+        (description):
+        (debug):
+        (escapeString):
+        (testPassed):
+        (testFailed):
+        (areNumbersEqual):
+        (areArraysEqual):
+        (isMinusZero):
+        (isTypedArray):
+        (isResultCorrect):
+        (stringify):
+        (shouldBe):
+        (dfgShouldBe):
+        (shouldBeType):
+        (shouldBeTrue):
+        (shouldBeFalse):
+        (shouldBeNaN):
+        (shouldBeNull):
+        (shouldBeEqualToString):
+        (shouldBeUndefined):
+        (shouldNotThrow):
+        (shouldThrow):
+        (dfgCompiled):
+        (dfgIncrement):
+        (noInline):
+        (finishJSTest):
+        * tests/stress/resources/typedarray-test-helper-functions.js: Added.
+        (forEachTypedArray):
+        (isSameFunctionForEachTypedArrayPrototype.eq):
+        (isSameFunctionForEachTypedArrayPrototype):
+        (hasSameValues):
+        (.foo):
+        (testPrototypeFunctionHelper):
+        (testPrototypeFunctionOnSigned):
+        (testPrototypeFunctionOnFloat):
+        (testPrototypeFunction):
+        (.tester):
+        (testPrototypeReceivesArray):
+        * tests/stress/typedarray-copyWithin.js: Added.
+        * tests/stress/typedarray-every.js: Added.
+        (isBigEnough):
+        (isBigEnoughAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-fill.js: Added.
+        * tests/stress/typedarray-filter.js: Added.
+        (keepEven):
+        (keepEvenAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-find.js: Added.
+        (keepEven):
+        (keepEvenAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-findIndex.js: Added.
+        (keepEven):
+        (keepEvenAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-forEach.js: Added.
+        (.checkCorrect.let.list):
+        (.checkCorrect):
+        (createChecker):
+        (foo):
+        (changeArray):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-indexOf.js: Added.
+        (keepEven):
+        * tests/stress/typedarray-lastIndexOf.js: Added.
+        * tests/stress/typedarray-map.js: Added.
+        (even):
+        (evenAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-reduce.js: Added.
+        (createArray):
+        (sum):
+        (createArrayAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-reduceRight.js: Added.
+        (createArray):
+        (sum):
+        (createArrayAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-slice.js: Added.
+        * tests/stress/typedarray-some.js: Added.
+        (isBigEnough):
+        (isBigEnoughAndChange):
+        (isBigEnoughAndException):
+        * tests/stress/typedarray-sort.js: Added.
+        (sortBackwards):
+        (compareException):
+
+2015-09-30  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190324.
+        https://bugs.webkit.org/show_bug.cgi?id=149671
+
+        Caused flaky crashes, rdar://problem/22916304 (Requested by ap
+        on #webkit).
+
+        Reverted changeset:
+
+        "ParallelHelperPool::runFunctionInParallel() shouldn't
+        allocate, and ParallelHelperPool.h shouldn't be included
+        everywhere"
+        https://bugs.webkit.org/show_bug.cgi?id=149635
+        http://trac.webkit.org/changeset/190324
+
+2015-09-29  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190289.
+        https://bugs.webkit.org/show_bug.cgi?id=149647
+
+        Crashing speedometer and some ARM32 tests (Requested by
+        msaboff on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Implement tail calls in the FTL"
+        https://bugs.webkit.org/show_bug.cgi?id=148664
+        http://trac.webkit.org/changeset/190289
+
+2015-09-29  Filip Pizlo  <fpizlo@apple.com>
+
+        ParallelHelperPool::runFunctionInParallel() shouldn't allocate, and ParallelHelperPool.h shouldn't be included everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=149635
+
+        Reviewed by Saam Barati.
+
+        It bugged me that this change caused a whole-world recompile. So, I changed the code so
+        that ParallelHelperPool.h is only included by Heap.cpp and not by Heap.h.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        * heap/Heap.h:
+
+2015-09-29  Filip Pizlo  <fpizlo@apple.com>
+
+        GC copy phase spans too many files
+        https://bugs.webkit.org/show_bug.cgi?id=149586
+
+        Reviewed by Andreas Kling.
+
+        This puts the core logic of the copy phase into Heap::copyBackingStores(). Now, instead of
+        using many helpers in many places, the actual algorithm is all in one place.
+
+        This lets me do a lot of simplification.
+
+        - CopyVisitor no longer requires that you call startCopying() before, and doneCopying() and
+          WTF::releaseFastMallocFreeMemoryForThisThread() after. The constructor and destructor now
+          do this for you.
+
+        - CopyVisitor no longer contains the algorithm that drives copying. That's all in
+          Heap::copyBackingStores() now. Basically, copyBackingStores() glues together the new
+          WTF::ParallelVectorIterator with the copying algorithm that we used to have in
+          CopyVisitor::copyFromShared().
+
+        - Lots of stuff that was in headers is now in .cpp files. That includes all non-hot-path
+          code in CopyVisitor. Also, the code for copying in HeapInlines.h is now in
+          ParallelVectorVisotor, and it's only included by Heap.cpp.
+
+        Overall, I like this direction for the GC. I don't think it's useful for Heap.cpp to have
+        calls to algorithms in some other file, unless those algorithms are either reusable or just
+        very dense. That's not actually true for the copy phase, and it's probably not true for
+        some other stuff like marking. I'll probably do the same refactoring for marking in another
+        bug.
+
+        This should have no effect on performance.
+
+        * heap/CopyVisitor.cpp:
+        (JSC::CopyVisitor::CopyVisitor):
+        (JSC::CopyVisitor::~CopyVisitor):
+        (JSC::CopyVisitor::copyFromShared): Deleted.
+        * heap/CopyVisitor.h:
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::checkIfShouldCopy):
+        (JSC::CopyVisitor::allocateNewSpaceSlow):
+        (JSC::CopyVisitor::didCopy):
+        (JSC::CopyVisitor::visitItem): Deleted.
+        (JSC::CopyVisitor::startCopying): Deleted.
+        (JSC::CopyVisitor::doneCopying): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::copyBackingStores):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::unregisterWeakGCMap):
+        (JSC::Heap::getNextBlocksToCopy): Deleted.
+
+2015-09-29  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Add support for WebIDL JSBuiltin attributes
+        https://bugs.webkit.org/show_bug.cgi?id=149554
+
+        Reviewed by Darin Adler.
+
+        * runtime/Lookup.cpp:
+        (JSC::reifyStaticAccessor): Adding support for creating attribute getter from JS builtin functions.
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::builtinAccessorGetterGenerator):
+        (JSC::HashTableValue::builtinAccessorSetterGenerator):
+        (JSC::reifyStaticProperties): Ensuring that builtin attributes are not treated as Builtin functions.
+
+2015-09-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unused parseMemoryAmount
+        https://bugs.webkit.org/show_bug.cgi?id=149611
+
+        Reviewed by Mark Lam.
+
+        * heap/HeapStatistics.cpp:
+        (JSC::HeapStatistics::parseMemoryAmount): Deleted.
+        * heap/HeapStatistics.h:
+
+2015-09-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JSGlobalRuntimeAgent unintentionally overrides InspectorRuntimeAgent destruction handling
+        https://bugs.webkit.org/show_bug.cgi?id=149537
+
+        Reviewed by Darin Adler.
+
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        (Inspector::JSGlobalObjectRuntimeAgent::willDestroyFrontendAndBackend): Deleted.
+        Do not override method, super class implementation is sufficient.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Fix file ordering.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        Remove unused member variable.
+
+2015-09-28  basile_clement@apple.com  <basile_clement@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
+
+        [ES6] Implement tail calls in the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=148664
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements the tail call opcodes in the FTL, making tail
+        calls available through all tiers. The changes are relatively
+        straightforward, although the frame shuffler had to be extended to
+        handle the possibility of running out of stack when spilling or
+        building a slow path frame. The other tiers always ensure that we have
+        enough stack space to build the new frame at the bottom of the old one,
+        but that is not true for the FTL.
+
+        Moreover, for efficiency, this adds to the shuffler the ability to
+        record the state of the TagTypeNumber, and to re-use the same register
+        when doing several consecutive integer boxings with no spilling in
+        between.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::inRegister):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isFunctionTerminal):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfTailCallVarargs):
+        (JSC::FTL::sizeOfTailCallForwardVarargs):
+        (JSC::FTL::sizeOfICFor):
+        * ftl/FTLInlineCacheSize.h:
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::JSCall):
+        * ftl/FTLJSCallBase.cpp:
+        (JSC::FTL::JSCallBase::emit):
+        (JSC::FTL::JSCallBase::link):
+        * ftl/FTLJSCallBase.h:
+        * ftl/FTLJSCallVarargs.cpp:
+        (JSC::FTL::JSCallVarargs::JSCallVarargs):
+        (JSC::FTL::JSCallVarargs::emit):
+        * ftl/FTLJSTailCall.cpp: Added.
+        (JSC::FTL::getRegisterWithAddend):
+        (JSC::FTL::recoveryFor):
+        (JSC::FTL::sizeFor):
+        (JSC::FTL::JSTailCall::JSTailCall):
+        (JSC::FTL::m_instructionOffset):
+        (JSC::FTL::JSTailCall::emit):
+        * ftl/FTLJSTailCall.h: Copied from Source/JavaScriptCore/ftl/FTLJSCallBase.h.
+        (JSC::FTL::JSTailCall::stackmapID):
+        (JSC::FTL::JSTailCall::estimatedSize):
+        (JSC::FTL::JSTailCall::numArguments):
+        (JSC::FTL::JSTailCall::operator<):
+        * ftl/FTLLocation.h:
+        (JSC::FTL::Location::operator bool):
+        (JSC::FTL::Location::operator!):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callPreflight):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForTailCall):
+        * ftl/FTLState.h:
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitExceptionCheck):
+        * jit/CallFrameShuffleData.h:
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::CallFrameShuffler):
+        (JSC::CallFrameShuffler::dump):
+        (JSC::CallFrameShuffler::spill):
+        (JSC::CallFrameShuffler::extendFrameIfNeeded):
+        (JSC::CallFrameShuffler::prepareForSlowPath):
+        (JSC::CallFrameShuffler::prepareAny):
+        * jit/CallFrameShuffler.h:
+        (JSC::CallFrameShuffler::restoreGPR):
+        (JSC::CallFrameShuffler::getFreeRegister):
+        (JSC::CallFrameShuffler::getFreeTempGPR):
+        (JSC::CallFrameShuffler::ensureTempGPR):
+        (JSC::CallFrameShuffler::addNew):
+        * jit/CallFrameShuffler64.cpp:
+        (JSC::CallFrameShuffler::emitBox):
+        (JSC::CallFrameShuffler::tryAcquireTagTypeNumber):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/Reg.h:
+        (JSC::Reg::Reg):
+        (JSC::Reg::isHashTableDeletedValue):
+        (JSC::Reg::deleted):
+        (JSC::RegHash::hash):
+        (JSC::RegHash::equal):
+        * test/es6.yaml:
+
+2015-09-28  Keith Miller  <keith_miller@apple.com>
+
+        ObjectPropertyConditionSet::mergedWith does not produce a minimal intersection.
+        https://bugs.webkit.org/show_bug.cgi?id=149598
+
+        Reviewed by Michael Saboff.
+
+        mergedWith sometimes creates duplicates of an ObjectPropertyCondition, which causes GetByIdVariant
+        in believe that the condition has more than one slotBaseCondition when only one was necessary.
+
+        * bytecode/ObjectPropertyConditionSet.cpp:
+        (JSC::ObjectPropertyConditionSet::mergedWith):
+
+2015-09-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix debug tests. Before marking, we need to call registerGCThreads().
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+
+2015-09-24  Filip Pizlo  <fpizlo@apple.com>
+
+        VMs should share GC threads
+        https://bugs.webkit.org/show_bug.cgi?id=149433
+        rdar://problem/12859344
+
+        Reviewed by Geoffrey Garen.
+
+        This changes the GC to use a new WTF abstraction for parallelism called ParallelHelperPool.
+        This allows us to remove GCThread and all of the GCPhase machinery. This kills a lot of
+        code and also gives our GC magical thread sharing powers. If two GCs in two different VMs
+        fire at the same time, then they will both get a random subset of the available shared GC
+        threads. If one GC happens before the other, then it will probably get all of the available
+        threads. If a GC happens while another VM already started GCing, then it will probably not
+        get any helper threads. This is probably fine, since in multi-VM scenarios we have no
+        reason to optimize for anything other than total throughput.
+
+        The GC has one static helper pool. This pool is available via JSC::heapHelperPool(). It
+        would be OK for other parts of JSC to use it in the future for parallel tasks. Each Heap
+        instance has a helper client attached to the pool.
+
+        The marking phase tells the ParallelHelperClient to asynchronously run a function that
+        joins parallel marking and finishes once marking reaches termination. It uses the
+        client.setFunction() idiom where the threads share work with each other using a specialized
+        worklist. The ParallelHelperPool is not involved in deciding when threads should terminate.
+
+        The copying phase tells the ParallelHelperClient to run a copying function in parallel. It
+        uses the client.runFunctionInParallel() idiom. The copying function gets work from the
+        m_blocksToCopy worklist inside Heap.
+
+        To test that multiple VMs work properly, this adds a multi-VM test to testapi.mm. This test
+        creates five concurrent VMs and has each of them allocate about 30MB of memory before doing
+        a full GC. I've confirmed that this tests uses only 6 total GC threads on my 8-core
+        computer (this is correct since we are currently configured for 7-way parallelism).
+
+        This shouldn't affect performance on benchmarks, but it will sure help apps with a lot of
+        VM instances.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        * heap/GCThread.cpp: Removed.
+        * heap/GCThread.h: Removed.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::isPagedOut):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::resetVisitors):
+        (JSC::Heap::threadVisitCount):
+        (JSC::Heap::threadBytesVisited):
+        (JSC::Heap::threadBytesCopied):
+        (JSC::Heap::startNextPhase): Deleted.
+        (JSC::Heap::endCurrentPhase): Deleted.
+        * heap/Heap.h:
+        * heap/HeapHelperPool.cpp: Added.
+        (JSC::heapHelperPool):
+        * heap/HeapHelperPool.h: Added.
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::stealSomeCellsFrom):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset):
+        (JSC::SlotVisitor::drainFromShared):
+        * jit/BinarySwitch.h:
+        * runtime/CodeCache.h:
+        * runtime/VM.h:
+        * runtime/WeakRandom.h: Removed.
+        * API/tests/testapi.mm:
+
+2015-09-25  Saam barati  <sbarati@apple.com>
+
+        DFG should use PhantomLocal instead of Flush as liveness preservation mechanism in LiveCatchVariablesPreservationPhase
+        https://bugs.webkit.org/show_bug.cgi?id=149575
+
+        Reviewed by Geoffrey Garen.
+
+        LiveCatchVariablesPreservationPhase is no longer forcing all live-at-catch 
+        variables to be flushed to the stack. They are now kept alive to OSR exit 
+        through PhantomLocal. This gives us a speed improvement for try-catch 
+        programs (especially those that don't throw errors very often) because
+        we can keep locals in registers instead of forcing them onto the stack.
+
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp:
+        (JSC::DFG::LiveCatchVariablePreservationPhase::LiveCatchVariablePreservationPhase):
+        (JSC::DFG::LiveCatchVariablePreservationPhase::handleBlock):
+        (JSC::DFG::performLiveCatchVariablePreservationPhase):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::FlushLiveCatchVariablesInsertionPhase): Deleted.
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::handleBlock): Deleted.
+
+2015-09-25  Michael Saboff  <msaboff@apple.com>
+
+        FTLOSRExitCompiler incorrectly excludes FPR registers in callee saves loop
+        https://bugs.webkit.org/show_bug.cgi?id=149540
+
+        Reviewed by Saam Barati.
+
+        Eliminated the incorrect check that callee saves registers are only GPRs.
+
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+
+2015-09-25  Alex Christensen  <achristensen@webkit.org>
+
+        [Win] Switch to CMake
+        https://bugs.webkit.org/show_bug.cgi?id=148111
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj:
+
+2015-09-24  Mark Lam  <mark.lam@apple.com>
+
+        Remove the use of "Immediate" in JIT function names.
+        https://bugs.webkit.org/show_bug.cgi?id=149542
+
+        Reviewed by Geoffrey Garen.
+
+        We will rename the following:
+            isOperandConstantImmediateDouble => isOperandConstantDouble
+            isOperandConstantImmediateInt => isOperandConstantInt
+            isOperandConstantImmediateChar => isOperandConstantChar
+
+            getOperandConstantImmediateInt => getOperandConstantInt
+            getConstantOperandImmediateInt => getOperandConstantInt
+
+            emitJumpIfImmediateInteger => emitJumpIfInt
+            emitJumpIfNotImmediateInteger => emitJumpIfNotInt
+            emitJumpIfNotImmediateIntegers => emitJumpIfNotInt
+            emitPatchableJumpIfNotImmediateInteger => emitPatchableJumpIfNotInt
+            emitJumpSlowCaseIfNotImmediateInteger => emitJumpSlowCaseIfNotInt
+            emitJumpSlowCaseIfNotImmediateNumber => emitJumpSlowCaseIfNotNumber
+            emitJumpSlowCaseIfNotImmediateIntegers => emitJumpSlowCaseIfNotInt
+            emitFastArithReTagImmediate => emitTagInt
+            emitTagAsBoolImmediate => emitTagBool
+            emitJumpIfImmediateNumber => emitJumpIfNumber
+            emitJumpIfNotImmediateNumber => emitJumpIfNotNumber
+            emitFastArithImmToInt - Deleted because this is an empty function.
+            emitFastArithIntToImmNoCheck => emitTagInt
+            emitPutImmediateToCallFrameHeader => emitPutToCallFrameHeader
+
+        This is purely a refactoring patch to do the renaming.  There is no behavior
+        change.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileSetupRegistersForEntry):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitPutToCallFrameHeader):
+        (JSC::AssemblyHelpers::emitPutImmediateToCallFrameHeader): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::emitStoreCell):
+        (JSC::JIT::getSlowCase):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_op_unsigned):
+        (JSC::JIT::emit_compareAndJump):
+        (JSC::JIT::emit_compareAndJumpSlow):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_inc):
+        (JSC::JIT::emit_op_dec):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_compareAndJump):
+        (JSC::JIT::emit_compareAndJumpSlow):
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitRightShift):
+        (JSC::JIT::emitRightShiftSlowCase):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitArrayStorageGetByVal):
+        (JSC::JIT::isOperandConstantDouble):
+        (JSC::JIT::isOperandConstantChar):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::isOperandConstantInt):
+        (JSC::JIT::getOperandConstantInt):
+        (JSC::JIT::emitGetVirtualRegisters):
+        (JSC::JIT::emitLoadInt32ToDouble):
+        (JSC::JIT::emitJumpIfInt):
+        (JSC::JIT::emitJumpIfNotInt):
+        (JSC::JIT::emitPatchableJumpIfNotInt):
+        (JSC::JIT::emitJumpSlowCaseIfNotInt):
+        (JSC::JIT::emitJumpSlowCaseIfNotNumber):
+        (JSC::JIT::emitTagBool):
+        (JSC::JIT::isOperandConstantImmediateDouble): Deleted.
+        (JSC::JIT::isOperandConstantImmediateChar): Deleted.
+        (JSC::JIT::isOperandConstantImmediateInt): Deleted.
+        (JSC::JIT::getOperandConstantImmediateInt): Deleted.
+        (JSC::JIT::getConstantOperandImmediateInt): Deleted.
+        (JSC::JIT::emitJumpIfImmediateInteger): Deleted.
+        (JSC::JIT::emitJumpIfNotImmediateInteger): Deleted.
+        (JSC::JIT::emitPatchableJumpIfNotImmediateInteger): Deleted.
+        (JSC::JIT::emitJumpIfNotImmediateIntegers): Deleted.
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateInteger): Deleted.
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateIntegers): Deleted.
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateNumber): Deleted.
+        (JSC::JIT::emitFastArithReTagImmediate): Deleted.
+        (JSC::JIT::emitTagAsBoolImmediate): Deleted.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_undefined):
+        (JSC::JIT::emit_op_is_boolean):
+        (JSC::JIT::emit_op_is_number):
+        (JSC::JIT::emit_op_is_string):
+        (JSC::JIT::emit_op_is_object):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_eq):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emit_op_neq):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_to_number):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emitSlow_op_eq):
+        (JSC::JIT::emitSlow_op_neq):
+        (JSC::JIT::emit_op_profile_type):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
+        (JSC::JSInterfaceJIT::emitJumpIfNumber):
+        (JSC::JSInterfaceJIT::emitJumpIfNotNumber):
+        (JSC::JSInterfaceJIT::emitLoadDouble):
+        (JSC::JSInterfaceJIT::emitTagInt):
+        (JSC::JSInterfaceJIT::emitPutToCallFrameHeader):
+        (JSC::JSInterfaceJIT::emitJumpIfImmediateNumber): Deleted.
+        (JSC::JSInterfaceJIT::emitJumpIfNotImmediateNumber): Deleted.
+        (JSC::JSInterfaceJIT::emitFastArithImmToInt): Deleted.
+        (JSC::JSInterfaceJIT::emitFastArithIntToImmNoCheck): Deleted.
+        (JSC::JSInterfaceJIT::emitPutImmediateToCallFrameHeader): Deleted.
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+        (JSC::WASMFunctionCompiler::endFunction):
+
+2015-09-24  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Implement tail calls in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=148663
+
+        Reviewed by Filip Pizlo.
+
+        jsc-tailcall: Implement the tail call opcodes in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=146850
+
+        This patch adds support for tail calls in the DFG. This requires a slightly high number of nodes:
+
+         - TailCall and TailCallVarargs are straightforward. They are terminal
+           nodes and have the semantics of an actual tail call.
+
+         - TailCallInlinedCaller and TailCallVarargsInlinedCaller are here to perform a
+           tail call inside an inlined function. They are non terminal nodes,
+           and are performing the call as a regular call after popping an
+           appropriate number of inlined tail call frames.
+
+         - TailCallForwardVarargs and TailCallForwardVarargsInlinedCaller are the
+           extension of TailCallVarargs and TailCallVarargsInlinedCaller to enable
+           the varargs forwarding optimization so that we don't lose
+           performance with a tail call instead of a regular call.
+
+        This also required two broad kind of changes:
+
+         - Changes in the JIT itself (DFGSpeculativeJIT) are pretty
+           straightforward since they are just an extension of the baseline JIT
+           changes introduced previously.
+
+         - Changes in the runtime are mostly related with handling inline call
+           frames. The idea here is that we have a special TailCall type for
+           call frames that indicates to the various pieces of code walking the
+           inline call frame that they should (recursively) skip the caller in
+           their analysis.
+
+        * bytecode/CallMode.h:
+        (JSC::specializationKindFor):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::inlineDepthForCallFrame):
+        (JSC::CodeOrigin::isApproximatelyEqualTo):
+        (JSC::CodeOrigin::approximateHash):
+        (JSC::CodeOrigin::inlineStack):
+        * bytecode/CodeOrigin.h:
+        * bytecode/InlineCallFrame.cpp:
+        (JSC::InlineCallFrame::dumpInContext):
+        (WTF::printInternal):
+        * bytecode/InlineCallFrame.h:
+        (JSC::InlineCallFrame::callModeFor):
+        (JSC::InlineCallFrame::kindFor):
+        (JSC::InlineCallFrame::varargsKindFor):
+        (JSC::InlineCallFrame::specializationKindFor):
+        (JSC::InlineCallFrame::isVarargs):
+        (JSC::InlineCallFrame::isTail):
+        (JSC::InlineCallFrame::computeCallerSkippingDeadFrames):
+        (JSC::InlineCallFrame::getCallerSkippingDeadFrames):
+        (JSC::InlineCallFrame::getCallerInlineFrameSkippingDeadFrames):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::findTerminal):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::inlineCallFrame):
+        (JSC::DFG::ByteCodeParser::allInlineFramesAreTailCalls):
+        (JSC::DFG::ByteCodeParser::currentCodeOrigin):
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getPrediction):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleVarargsCall):
+        (JSC::DFG::ByteCodeParser::emitArgumentPhantoms):
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isLiveInBytecode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeToSuccessors):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::willCatchExceptionInMachineFrame):
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp:
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::willCatchException):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCallVarargsData):
+        (JSC::DFG::Node::isTerminal):
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::handleExitCounts):
+        (JSC::DFG::reifyInlinedCallFrames):
+        (JSC::DFG::osrWriteBarrier):
+        * dfg/DFGOSRExitPreparation.cpp:
+        (JSC::DFG::prepareCodeOriginForOSRExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateSSA):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::bytecodeOffset):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::gotoNextFrame):
+
+2015-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove special case code for the no-parallel-GC case
+        https://bugs.webkit.org/show_bug.cgi?id=149512
+
+        Reviewed by Mark Lam.
+
+        Make serial GC just a parallel GC where the helper threads don't do anything. Also make the
+        idle thread calculation a bit more explicit.
+
+        The main outcome is that we no longer use Options::numberOfGCMarkers() as much, so the code is
+        resilient against the number of GC markers changing.
+
+        * heap/Heap.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+
+2015-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        PolymorphicAccess should remember that it checked an ObjectPropertyCondition with a check on some structure
+        https://bugs.webkit.org/show_bug.cgi?id=149514
+
+        Reviewed by Oliver Hunt.
+
+        When we checked an ObjectPropertyCondition using an explicit structure check, we would forget to
+        note the structure in any weak reference table and we would attempt to regenerate the condition
+        check even if the condition became invalid.
+
+        We need to account for this better and we need to prune AccessCases that have an invalid condition
+        set. This change does both.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::addWatchpoint):
+        (JSC::AccessCase::alternateBase):
+        (JSC::AccessCase::couldStillSucceed):
+        (JSC::AccessCase::canReplace):
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerateWithCases):
+        (JSC::PolymorphicAccess::visitWeak):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::callLinkInfo):
+        * tests/stress/make-dictionary-repatch.js: Added. This used to crash on a release assert. If we removed the release assert, this would return bad results.
+
+2015-09-24  Mark Lam  <mark.lam@apple.com>
+
+        We should only expect a RareCaseProfile to exist if the rare case actually exists.
+        https://bugs.webkit.org/show_bug.cgi?id=149531
+
+        Reviewed by Saam Barati.
+
+        The current code that calls rareCaseProfileForBytecodeOffset() assumes that it
+        will always return a non-null RareCaseProfile.  As a result, op_add in the
+        baseline JIT is forced to add a dummy slow case that will never be taken, only to
+        ensure that the RareCaseProfile for that bytecode is created.  This profile will
+        always produce a counter value of 0 (since that path will never be taken).
+
+        Instead, we'll make the callers of rareCaseProfileForBytecodeOffset() check if
+        the profile actually exist before dereferencing it.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset):
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset):
+        (JSC::CodeBlock::capabilityLevel):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addRareCaseProfile):
+        (JSC::CodeBlock::numberOfRareCaseProfiles):
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::rareCaseProfile): Deleted.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+
+2015-09-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Ran sort-Xcode-project-file.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-09-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Streams API] Add support for JS builtins constructor
+        https://bugs.webkit.org/show_bug.cgi?id=149497
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSFunction.h: exporting createBuiltinFunction.
+
+2015-09-23  Saam barati  <sbarati@apple.com>
+
+        JSC allows invalid var declarations when the declared name is the same as a let/const variable
+        https://bugs.webkit.org/show_bug.cgi?id=147600
+
+        Reviewed by Yusuke Suzuki.
+
+        We had an ordering bug where if you first declared a "let"
+        variable then a "var" variable with the same name, you wouldn't
+        get a syntax error. But, if you did it in the reverse order,
+        you would. This patch fixes this syntax error to be order independent.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        * parser/Parser.h:
+        (JSC::Scope::declareVariable):
+
+2015-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Parallel copy phase synchronization should be simplified
+        https://bugs.webkit.org/show_bug.cgi?id=149509
+
+        Reviewed by Mark Lam.
+
+        Before this change, we didn't wait for the copy phase to finish before starting to do things to
+        copied space that presumed that copying was done. Copied space would "detect" that nobody was
+        copying anymore by waiting for all loaned blocks to be returned. But that would succeed if some
+        thread had not yet started copying. So, we had weird hacks to ensure that a block was loaned
+        before any threads started. It also meant that we had two separate mechanisms for waiting for
+        copying threads to finish - one mechanism in the Heap phase logic and another in the
+        CopiedSpace::doneCopying() method.
+
+        We can get rid of a lot of the weirdness by just having a sound shutdown sequence:
+
+        1) Threads concur on when there is no more work. We already have this; once
+           Heap::getNextBlocksToCopy() returns no work in any thread, it will also return no work in
+           any other thread that asks for work.
+        2) Main thread waits for the threads to not be copying anymore.
+        3) Do whatever we need to do after copying finishes.
+
+        Currently, we do (3) before (2) and so we have weird problems. This just changes the code to do
+        (3) after (2), and so we can get rid of the synchronization in doneCopying() and we can safely
+        call startCopying() inside GCThread. This also means that we don't need to make CopyVisitor a
+        property of GCThread. Instead, GCThread just instantiates its own CopyVisitor when it needs to.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneCopying):
+        * heap/GCThread.cpp:
+        (JSC::GCThread::GCThread):
+        (JSC::GCThread::slotVisitor):
+        (JSC::GCThread::waitForNextPhase):
+        (JSC::GCThread::gcThreadMain):
+        (JSC::GCThread::copyVisitor): Deleted.
+        * heap/GCThread.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::gatherStackRoots):
+
+2015-09-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unimplemented method Heap::showStatistics
+        https://bugs.webkit.org/show_bug.cgi?id=149507
+
+        Reviewed by Darin Adler.
+
+        * heap/Heap.h:
+
+2015-09-23  Tim Horton  <timothy_horton@apple.com>
+
+        Hopefully fix the production build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * PlatformWin.cmake:
+
+2015-09-23  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Streams API] Implement ReadableStream pipeThrough
+        https://bugs.webkit.org/show_bug.cgi?id=147556
+
+        Reviewed by Darin Adler.
+
+        Updating BuiltIns infrastructure to make it reusable from WebCore.
+        Extracting macros from BuiltinNames and createBuiltinExecutable from BuiltinExecutables.
+        Updated generate-js-builtins to allow generating builtin CPP/H files in WebCore namespace.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor):
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        (JSC::createBuiltinExecutable):
+        (JSC::createExecutableInternal):
+        * builtins/BuiltinExecutables.h:
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::BuiltinNames): Deleted.
+        * builtins/BuiltinUtils.h: Extracting code from BuiltinNames and BuiltinExecutables.h.
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * generate-js-builtins:
+        (getFunctions):
+        (writeIncludeDirectives):
+
+2015-09-22  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: speculative non-JIT build fix after r189999.
+
+        Not reviewed.
+
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::jsValueRegs):
+
+2015-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        GCThreadSharedData is just a bad way of saying Heap
+        https://bugs.webkit.org/show_bug.cgi?id=149435
+
+        Reviewed by Mark Lam.
+
+        This removes the GCThreadSharedData class and moves its members into Heap. This is a net
+        simplification since GCThreadSharedData had a 1-to-1 mapping to Heap and the two classes had a
+        vast contract with a lot of interdependencies. Heap would call a lot of GCThreadSharedData
+        methods; now a lot of those are inlined since they were only called from the one place in Heap.
+        This makes it a lot easier to see what is going on. For example, you no longer have to look at
+        code in two places (Heap and GCThreadSharedData) to figure out the timing and synchronization
+        of GC phases - all of that code is in Heap now.
+
+        This also removes weird indirections in other places. It used to be that a lot of GC helper
+        classes woud have a pointer to GCThreadSharedData, and then would use that to get to Heap, VM,
+        and the visitors. Now these helpers just point to Heap.
+
+        I think that GCThreadSharedData was only useful for defining the set of things that we need to
+        know to collect garbage. That's how we decided if something would go into GCThreadSharedData
+        instead of Heap. But I think that separating things into multiple classes usually makes the
+        code less hackable, so there should be a very high bar for doing this in a way that produces a
+        1-to-1 mapping between two classes - where one instance of one of the classes is always paired
+        with exactly one instance of the other class and vice-versa.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopiedSpace.h:
+        * heap/CopyVisitor.cpp:
+        (JSC::CopyVisitor::CopyVisitor):
+        (JSC::CopyVisitor::copyFromShared):
+        * heap/CopyVisitor.h:
+        * heap/CopyVisitorInlines.h:
+        (JSC::CopyVisitor::allocateNewSpaceSlow):
+        (JSC::CopyVisitor::startCopying):
+        (JSC::CopyVisitor::doneCopying):
+        (JSC::CopyVisitor::didCopy):
+        * heap/GCThread.cpp:
+        (JSC::GCThread::GCThread):
+        (JSC::GCThread::waitForNextPhase):
+        (JSC::GCThread::gcThreadMain):
+        * heap/GCThread.h:
+        * heap/GCThreadSharedData.cpp: Removed.
+        * heap/GCThreadSharedData.h: Removed.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::isPagedOut):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::resetVisitors):
+        (JSC::Heap::objectCount):
+        (JSC::Heap::sweepNextLogicallyEmptyWeakBlock):
+        (JSC::Heap::threadVisitCount):
+        (JSC::Heap::threadBytesVisited):
+        (JSC::Heap::threadBytesCopied):
+        (JSC::Heap::startNextPhase):
+        (JSC::Heap::endCurrentPhase):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::unregisterWeakGCMap):
+        (JSC::Heap::getNextBlocksToCopy):
+        * heap/ListableHandler.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset):
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        (JSC::SlotVisitor::harvestWeakReferences):
+        (JSC::SlotVisitor::finalizeUnconditionalFinalizers):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::markStack):
+        (JSC::SlotVisitor::isEmpty):
+        (JSC::SlotVisitor::sharedData): Deleted.
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::addWeakReferenceHarvester):
+        (JSC::SlotVisitor::addUnconditionalFinalizer):
+        (JSC::SlotVisitor::addOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRootTriState):
+        (JSC::SlotVisitor::opaqueRootCount):
+        (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary):
+        (JSC::SlotVisitor::copyLater):
+        (JSC::SlotVisitor::heap):
+        (JSC::SlotVisitor::vm):
+
+2015-09-22  Saam barati  <sbarati@apple.com>
+
+        Web Inspector: [ES6] Improve Type Profiler Support for Arrow Functions
+        https://bugs.webkit.org/show_bug.cgi?id=143171
+
+        Reviewed by Joseph Pecoraro.
+
+        We now need to take into account TypeProfilerSearchDescriptor when
+        hashing results for type profiler queries. Before, we've gotten
+        away with not doing this because before we would never have a text 
+        collision between a return type text offset and a normal expression text
+        offset. But, with arrow functions, we will have collisions when
+        the arrow function doesn't have parens around its single parameter.
+        I.e: "param => { ... };"
+
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::findLocation):
+        * runtime/TypeProfiler.h:
+        (JSC::QueryKey::QueryKey):
+        (JSC::QueryKey::isHashTableDeletedValue):
+        (JSC::QueryKey::operator==):
+        (JSC::QueryKey::hash):
+        * tests/typeProfiler/arrow-functions.js: Added.
+
+2015-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of ENABLE(PARALLEL_GC)
+        https://bugs.webkit.org/show_bug.cgi?id=149436
+
+        Reviewed by Mark Lam.
+
+        We always enable parallel GC everywhere but Windows, and it doesn't look like it was disabled
+        there for any good reason. So, get rid of the flag.
+
+        The only effect of this change is that parallel GC will now be enabled on Windows, provided
+        that the CPU detection finds more than one.
+
+        * heap/GCThread.cpp:
+        (JSC::GCThread::gcThreadMain):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::resetChildren):
+        (JSC::GCThreadSharedData::childBytesCopied):
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::~GCThreadSharedData):
+        (JSC::GCThreadSharedData::reset):
+        (JSC::GCThreadSharedData::didStartMarking):
+        * heap/Heap.cpp:
+        (JSC::Heap::converge):
+        (JSC::Heap::visitWeakHandles):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::resetVisitors):
+        * heap/MarkedBlock.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        (JSC::JSString::tryHashConsLock):
+        (JSC::JSString::releaseHashConsLock):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::addOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRoot):
+        (JSC::SlotVisitor::containsOpaqueRootTriState):
+        (JSC::SlotVisitor::opaqueRootCount):
+        (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary):
+        * runtime/Options.cpp:
+        (JSC::computeNumberOfGCMarkers):
+
+2015-09-22  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement min and max instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149454
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements min and max instructions in WebAssembly.
+
+        * tests/stress/wasm-arithmetic-float64.js:
+        * tests/stress/wasm-arithmetic-int32.js:
+        * tests/stress/wasm/arithmetic-float64.wasm:
+        * tests/stress/wasm/arithmetic-int32.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildMinOrMaxI32):
+        (JSC::WASMFunctionCompiler::buildMinOrMaxF64):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseMinOrMaxExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseMinOrMaxExpressionF64):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildMinOrMaxI32):
+        (JSC::WASMFunctionSyntaxChecker::buildMinOrMaxF64):
+
+2015-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of ENABLE(GGC)
+        https://bugs.webkit.org/show_bug.cgi?id=149472
+
+        Reviewed by Mark Hahnenberg and Mark Lam.
+
+        Getting rid of this feature flag allows us to remove a lot of yuck.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlockSet::mark):
+        (JSC::ScriptExecutable::forEachCodeBlock):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        (JSC::DFG::osrWriteBarrier):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::linkBranches):
+        (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::masqueradesAsUndefinedWatchpointIsStillValid):
+        (JSC::DFG::SpeculativeJIT::selectScratchGPR):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileBaseValueStoreBarrier):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::moveTrueTo):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileBaseValueStoreBarrier):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::moveTrueTo):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier):
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        (JSC::CodeBlockSet::dump):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::clearRememberedSet):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        (JSC::Heap::shouldDoFullCollection):
+        (JSC::Heap::addLogicallyEmptyWeakBlock):
+        * heap/HeapInlines.h:
+        (JSC::Heap::isWriteBarrierEnabled):
+        (JSC::Heap::writeBarrier):
+        (JSC::Heap::reportExtraMemoryAllocated):
+        (JSC::Heap::reportExtraMemoryVisited):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::clearMarks):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::didAllocateInBlock):
+        (JSC::MarkedSpace::objectCount):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+        (JSC::JIT::emitIdentifierCheck):
+        (JSC::JIT::privateCompilePutByVal):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2015-09-22  Saam barati  <sbarati@apple.com>
+
+        the toInt32 operation inside DFGSpeculativeJIT.cpp can't throw so we shouldn't emit an exceptionCheck after it.
+        https://bugs.webkit.org/show_bug.cgi?id=149467
+
+        Reviewed by Mark Lam.
+
+        The callOperation for toInt32 won't store a call site index in the call frame.
+        Therefore, if this is the first callOperation in the current compilation, 
+        and we emit an exception check inside a try block, we will hit an assertion 
+        saying that we must have DFGCommonData::codeOrigins.size() be > 0 inside
+        DFGCommonData::lastCallSite(). Therefore, it is imperative that we don't 
+        emit exception checks for callOperations that don't throw exceptions and 
+        don't store a call site index in the call frame.
+
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::lastCallSite):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+
+2015-09-22  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the conditional instruction in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149451
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements the conditional (ternary) instruction in WebAssembly.
+        This is basically "condition ? exp1 : exp2" in JavaScript.
+        
+        The use of context.discard() in WASMFunctionParser::parseConditional()
+        is not ideal. We don't discard anything. We just use it to decrement the
+        stack top in the WebAssembly baseline JIT. When we optimize the JIT by
+        storing results directly into the destination like the JavaScript
+        baseline JIT, the code will look like this:
+
+            ContextExpression temp = context.newTemporary();
+            ContextExpression condition = parseExpressionI32(context);
+            context.jumpToTargetIf(Context::JumpCondition::Zero, condition, elseTarget);
+
+            parseExpression(context, temp, expressionType);
+            context.jumpToTarget(end);
+
+            context.linkTarget(elseTarget);
+            parseExpression(context, temp, expressionType);
+            context.linkTarget(end);
+
+            return temp;
+
+        which looks cleaner than using discard().
+
+        * tests/stress/wasm-control-flow.js:
+        * tests/stress/wasm/control-flow.wasm:
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseConditional):
+        * wasm/WASMFunctionParser.h:
+
+2015-09-22  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189616.
+        https://bugs.webkit.org/show_bug.cgi?id=149456
+
+        suspected cause of multiple regressions (Requested by kling on
+        #webkit).
+
+        Reverted changeset:
+
+        "[JSC] Weak should only accept cell pointees."
+        https://bugs.webkit.org/show_bug.cgi?id=148955
+        http://trac.webkit.org/changeset/189616
+
+2015-09-22  Saam barati  <sbarati@apple.com>
+
+        Web Inspector: Basic Block Annotations and Type Profiler annotations wrong for script with "class" with default constructor
+        https://bugs.webkit.org/show_bug.cgi?id=149248
+
+        Reviewed by Mark Lam.
+
+        We keep track of which functions have and have not
+        executed so we can show visually, inside the inspector,
+        which functions have and have not executed. With a default
+        constructor, our parser parses code that isn't in the actual
+        JavaScript source code of the user. Our parser would then
+        give us a range of starting at "1" to "1 + default constructor length"
+        as being the text range of a function. But, this would then pollute
+        actual source code that was at these ranges.
+
+        Therefore, we should treat these default constructor source 
+        codes as having "invalid" ranges. We use [UINT_MAX, UINT_MAX] 
+        as the invalid range. This range has the effect of not polluting 
+        valid ranges inside the source code.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        (JSC::UnlinkedFunctionExecutable::setInvalidTypeProfilingOffsets):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewDefaultConstructor):
+
+2015-09-21  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the comma instruction in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149425
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements the comma instruction in WebAssembly. The comma
+        instruction evaluates the left operand and then the right operand and
+        returns the value of the right operand.
+
+        * tests/stress/wasm-comma.js: Added.
+        (shouldBe):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::discard):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseComma):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::discard):
+
+2015-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Always use the compiler's CAS implementation and get rid of ENABLE(COMPARE_AND_SWAP)
+        https://bugs.webkit.org/show_bug.cgi?id=149438
+
+        Reviewed by Mark Lam.
+
+        * heap/HeapInlines.h:
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::deprecatedReportExtraMemory):
+
+2015-09-21  Saam barati  <sbarati@apple.com>
+
+        functionProtoFuncToString should not rely on typeProfilingEndOffset()
+        https://bugs.webkit.org/show_bug.cgi?id=149429
+
+        Reviewed by Geoffrey Garen.
+
+        We should be able to freely change typeProfilingEndOffset()
+        without worrying we will break Function.prototype.toString.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+
+2015-09-21  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r190086.
+        https://bugs.webkit.org/show_bug.cgi?id=149427
+
+        Broke LayoutTests/inspector/model/remote-object.htm (Requested
+        by saamyjoon on #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: Basic Block Annotations and Type Profiler
+        annotations wrong for script with "class" with default
+        constructor"
+        https://bugs.webkit.org/show_bug.cgi?id=149248
+        http://trac.webkit.org/changeset/190086
+
+2015-09-21  Saam barati  <sbarati@apple.com>
+
+        Web Inspector: Basic Block Annotations and Type Profiler annotations wrong for script with "class" with default constructor
+        https://bugs.webkit.org/show_bug.cgi?id=149248
+
+        Reviewed by Mark Lam.
+
+        We keep track of which functions have and have not
+        executed so we can show visually, inside the inspector,
+        which functions have and have not executed. With a default
+        constructor, our parser parses code that isn't in the actual
+        JavaScript source code of the user. Our parser would then
+        give us a range of starting at "1" to "1 + default constructor length"
+        as being the text range of a function. But, this would then pollute
+        actual source code that was at these ranges.
+
+        Therefore, we should treat these default constructor source 
+        codes as having "invalid" ranges. We use [UINT_MAX, UINT_MAX] 
+        as the invalid range. This range has the effect of not polluting 
+        valid ranges inside the source code.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        (JSC::UnlinkedFunctionExecutable::setInvalidTypeProfilingOffsets):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewDefaultConstructor):
+
+2015-09-21  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement call statements and call expressions of type void in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149411
+
+        Reviewed by Mark Lam.
+
+        Call instructions in WebAssembly can be both statements and expressions.
+        This patch implements call statements. It also implements call
+        expressions of type void. The only place where call expressions of type
+        void can occur is the left-hand side of the comma (,) operator, which
+        will be implemented in a subsequent patch. The comma operator requires
+        both of its operands to be expressions.
+
+        * tests/stress/wasm-calls.js:
+        * tests/stress/wasm/calls.wasm:
+        * wasm/WASMConstants.h:
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseStatement):
+        (JSC::WASMFunctionParser::parseExpression):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseExpressionVoid):
+        (JSC::WASMFunctionParser::parseCallInternal):
+        (JSC::WASMFunctionParser::parseCallIndirect):
+        (JSC::WASMFunctionParser::parseCallImport):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMReader.cpp:
+        (JSC::WASMReader::readOpExpressionVoid):
+        * wasm/WASMReader.h:
+
+2015-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should infer property types
+        https://bugs.webkit.org/show_bug.cgi?id=148610
+
+        Reviewed by Geoffrey Garen.
+
+        This change brings recursive type inference to JavaScript object properties in JSC. We check that a
+        value being stored into a property obeys a property's type before we do the store. If it doesn't,
+        we broaden the property's type to include the new value. If optimized code was relying on the old
+        type, we deoptimize that code.
+
+        The type system that this supports includes important primitive types like Int32 and Boolean. But
+        it goes further and also includes a type kind called ObjectWithStructure, which means that we
+        expect the property to always point to objects with a particular structure. This only works for
+        leaf structures (i.e. structures that have a valid transition watchpoint set). Invalidation of the
+        transition set causes the property type to become Object (meaning an object with any structure).
+        This capability gives us recursive type inference. It's possible for an expression like "o.f.g.h"
+        to execute without any type checks if .f and .g are both ObjectWithStructure.
+
+        The type inference of a property is tracked by an InferredType instance, which is a JSCell. This
+        means that it manages its own memory. That's convenient. For example, when the DFG is interested in
+        one of these, it can just list the InferredType as a weak reference in addition to setting a
+        watchpoint. This ensures that even if the InferredType is dropped by the owning structure, the DFG
+        won't read a dangling pointer. A mapping from property name to InferredType is implemented by
+        InferredTypeTable, which is also a JSCell. Each Structure may point to some InferredTypeTable.
+
+        This feature causes programs to be happier (run faster without otherwise doing bad things like
+        using lots of memory) when four conditions hold:
+
+        1) A property converges to one of the types that we support.
+        2) The property is loaded from more frequently than it is stored to.
+        3) The stores are all cached, so that we statically emit a type check.
+        4) We don't allocate a lot of meta-data for the property's type.
+
+        We maximize the likelihood of (1) by having a rich type system. But having a rich type system means
+        that a reflective put to a property has to have a large switch over the inferred type to decide how
+        to do the type check. That's why we need (3). We ensure (3) by having every reflective property
+        store (i.e. putDirectInternal in any context that isn't PutById) force the inferred type to become
+        Top. We don't really worry about ensuring (2); this is statistically true for most programs
+        already.
+
+        Probably the most subtle trickery goes into (4). Logically we'd like to say that each
+        (Structure, Property) maps to its own InferredType. If structure S1 has a transition edge to S2,
+        then we could ensure that the InferredType I1 where (S1, Property)->I1 has a data flow constraint
+        to I2 where (S2, Property)->I2. That would work, but it would involve a lot of memory. And when I1
+        gets invalidated in some way, it would have to tell I2 about it, and then I2 might tell other
+        InferredType objects downstream. That's madness. So, the first major compromise that we make here
+        is to say that if some property has some InferredType at some Structure, then anytime we
+        transition from that Structure, the new Structure shares the same InferredType for that property.
+        This unifies the type of the property over the entire transition tree starting at the Structure at
+        which the property was added. But this would still mean that each Structure would have its own
+        InferredTypeTable. We don't want that because experience with PropertyTable shows that this can be
+        a major memory hog. So, we don't create an InferredTypeTable until someone adds a property that is
+        subject to type inference (i.e. it was added non-reflectively), and we share that InferredTypeTable
+        with the entire structure transition tree rooted at the Structure that had the first inferred
+        property. We also drop the InferredTypeTable anytime that we do a dictionary transition, and we
+        don't allow further property type inference if a structure had ever been a dictionary.
+
+        This is a 3% speed-up on Octane and a 12% speed-up on Kraken on my setup. It's not a significant
+        slow-down on any benchmark I ran.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branchTest64):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchTest64):
+        (JSC::MacroAssemblerX86_64::test64):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        * bytecode/PutByIdFlags.cpp:
+        (WTF::printInternal):
+        * bytecode/PutByIdFlags.h:
+        (JSC::encodeStructureID):
+        (JSC::decodeStructureID):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::operator=):
+        (JSC::PutByIdVariant::replace):
+        (JSC::PutByIdVariant::transition):
+        (JSC::PutByIdVariant::setter):
+        (JSC::PutByIdVariant::attemptToMerge):
+        (JSC::PutByIdVariant::dumpInContext):
+        * bytecode/PutByIdVariant.h:
+        (JSC::PutByIdVariant::newStructure):
+        (JSC::PutByIdVariant::requiredType):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedInstruction::UnlinkedInstruction):
+        * bytecode/Watchpoint.h:
+        (JSC::InlineWatchpointSet::touch):
+        (JSC::InlineWatchpointSet::isBeingWatched):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::filter):
+        (JSC::DFG::AbstractInterpreter::filterByValue):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::filter):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::setType):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::fixTypeForRepresentation):
+        (JSC::DFG::AbstractValue::mergeOSREntryValue):
+        (JSC::DFG::AbstractValue::isType):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::filterValueByType):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::setType):
+        (JSC::DFG::AbstractValue::isType):
+        (JSC::DFG::AbstractValue::validate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::handlePutByOffset):
+        (JSC::DFG::ByteCodeParser::load):
+        (JSC::DFG::ByteCodeParser::store):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGClobbersExitState.cpp:
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
+        * dfg/DFGDesiredInferredType.h: Added.
+        (JSC::DFG::DesiredInferredType::DesiredInferredType):
+        (JSC::DFG::DesiredInferredType::operator bool):
+        (JSC::DFG::DesiredInferredType::object):
+        (JSC::DFG::DesiredInferredType::expected):
+        (JSC::DFG::DesiredInferredType::isStillValid):
+        (JSC::DFG::DesiredInferredType::add):
+        (JSC::DFG::DesiredInferredType::operator==):
+        (JSC::DFG::DesiredInferredType::operator!=):
+        (JSC::DFG::DesiredInferredType::isHashTableDeletedValue):
+        (JSC::DFG::DesiredInferredType::hash):
+        (JSC::DFG::DesiredInferredType::dumpInContext):
+        (JSC::DFG::DesiredInferredType::dump):
+        (JSC::DFG::DesiredInferredTypeHash::hash):
+        (JSC::DFG::DesiredInferredTypeHash::equal):
+        * dfg/DFGDesiredWatchpoints.cpp:
+        (JSC::DFG::AdaptiveStructureWatchpointAdaptor::add):
+        (JSC::DFG::InferredTypeAdaptor::add):
+        (JSC::DFG::DesiredWatchpoints::DesiredWatchpoints):
+        (JSC::DFG::DesiredWatchpoints::~DesiredWatchpoints):
+        (JSC::DFG::DesiredWatchpoints::addLazily):
+        (JSC::DFG::DesiredWatchpoints::consider):
+        (JSC::DFG::DesiredWatchpoints::reallyAdd):
+        (JSC::DFG::DesiredWatchpoints::areStillValid):
+        (JSC::DFG::DesiredWatchpoints::dumpInContext):
+        * dfg/DFGDesiredWatchpoints.h:
+        (JSC::DFG::AdaptiveStructureWatchpointAdaptor::dumpInContext):
+        (JSC::DFG::InferredTypeAdaptor::hasBeenInvalidated):
+        (JSC::DFG::InferredTypeAdaptor::dumpInContext):
+        (JSC::DFG::DesiredWatchpoints::isWatched):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::isSafeToLoad):
+        (JSC::DFG::Graph::inferredTypeFor):
+        (JSC::DFG::Graph::livenessFor):
+        (JSC::DFG::Graph::tryGetConstantProperty):
+        (JSC::DFG::Graph::inferredValueForProperty):
+        (JSC::DFG::Graph::tryGetConstantClosureVar):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::registerInferredType):
+        (JSC::DFG::Graph::inferredTypeForProperty):
+        * dfg/DFGInferredTypeCheck.cpp: Added.
+        (JSC::DFG::insertInferredTypeCheck):
+        * dfg/DFGInferredTypeCheck.h: Added.
+        * dfg/DFGNode.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPropertyTypeKey.h: Added.
+        (JSC::DFG::PropertyTypeKey::PropertyTypeKey):
+        (JSC::DFG::PropertyTypeKey::operator bool):
+        (JSC::DFG::PropertyTypeKey::structure):
+        (JSC::DFG::PropertyTypeKey::uid):
+        (JSC::DFG::PropertyTypeKey::operator==):
+        (JSC::DFG::PropertyTypeKey::operator!=):
+        (JSC::DFG::PropertyTypeKey::hash):
+        (JSC::DFG::PropertyTypeKey::isHashTableDeletedValue):
+        (JSC::DFG::PropertyTypeKey::dumpInContext):
+        (JSC::DFG::PropertyTypeKey::dump):
+        (JSC::DFG::PropertyTypeKey::deletedUID):
+        (JSC::DFG::PropertyTypeKeyHash::hash):
+        (JSC::DFG::PropertyTypeKeyHash::equal):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileTypeOf):
+        (JSC::DFG::SpeculativeJIT::compileCheckStructure):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::speculateCell):
+        (JSC::DFG::SpeculativeJIT::speculateCellOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateObject):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::at):
+        (JSC::DFG::StructureAbstractValue::operator[]):
+        (JSC::DFG::StructureAbstractValue::onlyStructure):
+        (JSC::DFG::StructureAbstractValue::forEach):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckStructure):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckCell):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMultiPutByOffset):
+        (JSC::FTL::DFG::LowerDFGToLLVM::numberOrNotCellToInt32):
+        (JSC::FTL::DFG::LowerDFGToLLVM::checkInferredType):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadProperty):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateCell):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateCellOrOther):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateMachineInt):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::decodedCodeMapFor):
+        (JSC::AssemblyHelpers::branchIfNotType):
+        (JSC::AssemblyHelpers::purifyNaN):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfEqual):
+        (JSC::AssemblyHelpers::branchIfNotCell):
+        (JSC::AssemblyHelpers::branchIfCell):
+        (JSC::AssemblyHelpers::branchIfNotOther):
+        (JSC::AssemblyHelpers::branchIfInt32):
+        (JSC::AssemblyHelpers::branchIfNotInt32):
+        (JSC::AssemblyHelpers::branchIfNumber):
+        (JSC::AssemblyHelpers::branchIfNotNumber):
+        (JSC::AssemblyHelpers::branchIfEmpty):
+        (JSC::AssemblyHelpers::branchStructure):
+        * jit/Repatch.cpp:
+        (JSC::tryCachePutByID):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/InferredType.cpp: Added.
+        (JSC::InferredType::create):
+        (JSC::InferredType::destroy):
+        (JSC::InferredType::createStructure):
+        (JSC::InferredType::visitChildren):
+        (JSC::InferredType::kindForFlags):
+        (JSC::InferredType::Descriptor::forValue):
+        (JSC::InferredType::Descriptor::forFlags):
+        (JSC::InferredType::Descriptor::putByIdFlags):
+        (JSC::InferredType::Descriptor::merge):
+        (JSC::InferredType::Descriptor::removeStructure):
+        (JSC::InferredType::Descriptor::subsumes):
+        (JSC::InferredType::Descriptor::dumpInContext):
+        (JSC::InferredType::Descriptor::dump):
+        (JSC::InferredType::InferredType):
+        (JSC::InferredType::~InferredType):
+        (JSC::InferredType::canWatch):
+        (JSC::InferredType::addWatchpoint):
+        (JSC::InferredType::dump):
+        (JSC::InferredType::willStoreValueSlow):
+        (JSC::InferredType::makeTopSlow):
+        (JSC::InferredType::set):
+        (JSC::InferredType::removeStructure):
+        (JSC::InferredType::InferredStructureWatchpoint::fireInternal):
+        (JSC::InferredType::InferredStructureFinalizer::finalizeUnconditionally):
+        (JSC::InferredType::InferredStructure::InferredStructure):
+        (WTF::printInternal):
+        * runtime/InferredType.h: Added.
+        * runtime/InferredTypeTable.cpp: Added.
+        (JSC::InferredTypeTable::create):
+        (JSC::InferredTypeTable::destroy):
+        (JSC::InferredTypeTable::createStructure):
+        (JSC::InferredTypeTable::visitChildren):
+        (JSC::InferredTypeTable::get):
+        (JSC::InferredTypeTable::willStoreValue):
+        (JSC::InferredTypeTable::makeTop):
+        (JSC::InferredTypeTable::InferredTypeTable):
+        (JSC::InferredTypeTable::~InferredTypeTable):
+        * runtime/InferredTypeTable.h: Added.
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/Structure.cpp:
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::startWatchingInternalProperties):
+        (JSC::Structure::willStoreValueSlow):
+        (JSC::Structure::visitChildren):
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+        * runtime/Structure.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::get):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * tests/stress/prop-type-boolean-then-string.js: Added.
+        * tests/stress/prop-type-int32-then-string.js: Added.
+        * tests/stress/prop-type-number-then-string.js: Added.
+        * tests/stress/prop-type-object-or-other-then-string.js: Added.
+        * tests/stress/prop-type-object-then-string.js: Added.
+        * tests/stress/prop-type-other-then-string.js: Added.
+        * tests/stress/prop-type-string-then-object.js: Added.
+        * tests/stress/prop-type-struct-or-other-then-string.js: Added.
+        * tests/stress/prop-type-struct-then-object.js: Added.
+        * tests/stress/prop-type-struct-then-object-opt.js: Added.
+        * tests/stress/prop-type-struct-then-object-opt-fold.js: Added.
+        * tests/stress/prop-type-struct-then-object-opt-multi.js: Added.
+
+2015-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        WebCore shouldn't have to include DFG headers
+        https://bugs.webkit.org/show_bug.cgi?id=149337
+
+        Reviewed by Michael Saboff.
+
+        This does some simple rewiring and outlining of CodeBlock/Heap functionality so that
+        those headers don't have to include DFG headers. As a result, WebCore no longer includes
+        DFG headers, except for two fairly innocent ones (DFGCommon.h and DFGCompilationMode.h).
+        This also changes the Xcode project file so that all but those two headers are Project
+        rather than Private. So, if WebCore accidentally includes any of them, we'll get a build
+        error.
+
+        The main group of headers that this prevents WebCore from including are the DFGDesired*.h
+        files and whatever those include. Those headers used to be fairly simple, but now they
+        are growing in complexity (especially with things like http://webkit.org/b/148610). So,
+        it makes sense to make sure they don't leak out of JSC.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::~CallLinkInfo):
+        (JSC::CallLinkInfo::clearStub):
+        (JSC::CallLinkInfo::visitWeak):
+        (JSC::CallLinkInfo::setFrameShuffleData):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::isVarargsCallType):
+        (JSC::CallLinkInfo::specializationKindFor):
+        (JSC::CallLinkInfo::frameShuffleData):
+        (JSC::CallLinkInfo::CallLinkInfo): Deleted.
+        (JSC::CallLinkInfo::~CallLinkInfo): Deleted.
+        (JSC::CallLinkInfo::setFrameShuffleData): Deleted.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::getOrAddArrayProfile):
+        (JSC::CodeBlock::codeOrigins):
+        (JSC::CodeBlock::numberOfDFGIdentifiers):
+        (JSC::CodeBlock::identifier):
+        (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasExpressionInfo):
+        (JSC::CodeBlock::hasCodeOrigins):
+        (JSC::CodeBlock::numberOfIdentifiers):
+        (JSC::CodeBlock::identifier):
+        (JSC::CodeBlock::codeOrigins): Deleted.
+        (JSC::CodeBlock::numberOfDFGIdentifiers): Deleted.
+        * bytecode/CodeOrigin.h:
+        * dfg/DFGDesiredIdentifiers.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::didFinishIterating):
+        (JSC::Heap::completeAllDFGPlans):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::deleteAllCodeBlocks):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::deprecatedReportExtraMemory):
+        (JSC::Heap::forEachCodeBlock):
+        (JSC::Heap::forEachProtectedCell):
+        * runtime/Executable.h:
+        * runtime/JSCInlines.h:
+        (JSC::Heap::forEachCodeBlock): Deleted.
+
+2015-09-21 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        Web Inspector: arrow function names are never inferred, call frames are labeled (anonymous function)
+        https://bugs.webkit.org/show_bug.cgi?id=148318
+
+        Reviewed by Saam Barati.
+
+        Tiny change to support of the inferred name in arrow function
+ 
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAssignResolve):
+
+2015-09-19 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        New tests introduced in r188545 fail on 32 bit ARM
+        https://bugs.webkit.org/show_bug.cgi?id=148376
+
+        Reviewed by Saam Barati.
+
+        Added correct support of the ARM CPU in JIT functions that are related to arrow function.
+
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncExprCommon):
+
+2015-09-21  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement Store expressions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149395
+
+        Reviewed by Geoffrey Garen.
+
+        The Store instruction in WebAssembly stores a value in the linear memory
+        at the given index. It can be both a statement and an expression. When
+        it is an expression, it returns the assigned value. This patch
+        implements Store as an expression.
+
+        Since Store uses two operands, which are the index and the value, we
+        need to pop the two operands from the stack and push the value back to
+        the stack. We can simply implement this by copying the value to where
+        the index is in the stack.
+
+        * tests/stress/wasm-linear-memory.js:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildStore):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseStatement):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseStore):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildStore):
+
+2015-09-20  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement SetLocal and SetGlobal expressions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149383
+
+        Reviewed by Saam Barati.
+
+        SetLocal and SetGlobal in WebAssembly can be both statements and
+        expressions. We have implemented the statement version. This patch
+        implements the expression version.
+
+        SetLocal and SetGlobal expressions return the assigned value.
+        Since SetLocal and SetGlobal use only one operand, which is the assigned
+        value, we can simply implement them by not removing the value from the
+        top of the stack.
+
+        * tests/stress/wasm-globals.js:
+        * tests/stress/wasm-locals.js:
+        * tests/stress/wasm/globals.wasm:
+        * tests/stress/wasm/locals.wasm:
+        * wasm/WASMConstants.h:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildSetLocal):
+        (JSC::WASMFunctionCompiler::buildSetGlobal):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseStatement):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseSetLocal):
+        (JSC::WASMFunctionParser::parseSetGlobal):
+        (JSC::WASMFunctionParser::parseSetLocalStatement): Deleted.
+        (JSC::WASMFunctionParser::parseSetGlobalStatement): Deleted.
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildSetLocal):
+        (JSC::WASMFunctionSyntaxChecker::buildSetGlobal):
+
+2015-09-19 Aleksandr Skachkov    <gskachkov@gmail.com>
+
+        [ES6] Added controlFlowProfiler test for arrow function
+        https://bugs.webkit.org/show_bug.cgi?id=145638
+
+        Reviewed by Saam Barati.
+
+        * Source/JavaScriptCore/tests/controlFlowProfiler/arrowfunction-expression.js: added
+
+2015-09-20  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Remove XHR_TIMEOUT compilation guard
+        https://bugs.webkit.org/show_bug.cgi?id=149260
+
+        Reviewed by Benjamin Poulain.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-09-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [GTK] Unreviewed, should check the result of fread
+        https://bugs.webkit.org/show_bug.cgi?id=148917
+
+        Suppress the build warning on GTK with GCC.
+
+        * jsc.cpp:
+        (fillBufferWithContentsOfFile):
+        (fetchModuleFromLocalFileSystem):
+
+2015-09-19  Saam barati  <sbarati@apple.com>
+
+        VariableEnvironmentNode should inherit from ParserArenaDeletable because VariableEnvironment's must have their destructors run
+        https://bugs.webkit.org/show_bug.cgi?id=149359
+
+        Reviewed by Andreas Kling.
+
+        VariableEnvironment must have its destructor run.
+        Therefore, VariableEnvironmentNode should inherit from ParserArenaDeletable.
+        Also, anything that inherits from VariableEnvironmentNode must use
+        ParserArenaDeletable's operator new. Also, any other nodes that own
+        a VariableEnvironment must also have their destructors run.
+
+        * parser/Nodes.h:
+        (JSC::VariableEnvironmentNode::VariableEnvironmentNode):
+
+2015-09-18  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Remove duplicate code in the WebAssembly parser
+        https://bugs.webkit.org/show_bug.cgi?id=149361
+
+        Reviewed by Saam Barati.
+
+        Refactor the methods for parsing GetLocal and GetGlobal in WebAssembly
+        to remove duplicate code.
+
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::nameOfType):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseUnaryExpressionF64):
+        (JSC::WASMFunctionParser::parseBinaryExpressionF64):
+        (JSC::WASMFunctionParser::parseGetLocalExpression):
+        (JSC::WASMFunctionParser::parseGetGlobalExpression):
+        (JSC::WASMFunctionParser::parseGetLocalExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseGetGlobalExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseGetLocalExpressionF32): Deleted.
+        (JSC::WASMFunctionParser::parseGetGlobalExpressionF32): Deleted.
+        (JSC::WASMFunctionParser::parseGetLocalExpressionF64): Deleted.
+        (JSC::WASMFunctionParser::parseGetGlobalExpressionF64): Deleted.
+        * wasm/WASMFunctionParser.h:
+
+2015-09-18  Saam barati  <sbarati@apple.com>
+
+        Refactor common code between GetCatchHandlerFunctor and UnwindFunctor
+        https://bugs.webkit.org/show_bug.cgi?id=149276
+
+        Reviewed by Mark Lam.
+
+        There is currently code copy-pasted between these
+        two functors. Lets not do that. It's better to write
+        a function, even if the function is small.
+
+        I also did a bit of renaming to make the intent of the
+        unwindCallFrame function clear. The name of the function
+        didn't really indicate what it did. It decided if it was
+        okay to unwind further, and it also notified the debugger.
+        I've renamed the function to notifyDebuggerOfUnwinding.
+        And I've inlined the logic of deciding if it's okay
+        to unwind further into UnwindFunctor itself.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::isOpcode):
+        (JSC::getStackFrameCodeType):
+        (JSC::Interpreter::stackTraceAsString):
+        (JSC::findExceptionHandler):
+        (JSC::GetCatchHandlerFunctor::GetCatchHandlerFunctor):
+        (JSC::GetCatchHandlerFunctor::operator()):
+        (JSC::notifyDebuggerOfUnwinding):
+        (JSC::UnwindFunctor::UnwindFunctor):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
+        (JSC::unwindCallFrame): Deleted.
+
+2015-09-18  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the arithmetic instructions for doubles in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148945
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements the arithmetic instructions for doubles (float64)
+        in WebAssembly.
+
+        * tests/stress/wasm-arithmetic-float64.js:
+        * tests/stress/wasm/arithmetic-float64.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildUnaryF64):
+        (JSC::WASMFunctionCompiler::buildBinaryF64):
+        (JSC::WASMFunctionCompiler::callOperation):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseUnaryExpressionF64):
+        (JSC::WASMFunctionParser::parseBinaryExpressionF64):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildUnaryF64):
+        (JSC::WASMFunctionSyntaxChecker::buildBinaryF32):
+        (JSC::WASMFunctionSyntaxChecker::buildBinaryF64):
+
+2015-09-18  Basile Clement  <basile_clement@apple.com>
+
+        [ES6] Tail call fast path should efficiently reuse the frame's stack space
+        https://bugs.webkit.org/show_bug.cgi?id=148662
+
+        Reviewed by Geoffrey Garen.
+
+        This introduces a new class (CallFrameShuffler) that is responsible for
+        efficiently building the new frames when performing a tail call. In
+        order for Repatch to know about the position of arguments on the
+        stack/registers (e.g. for polymorphic call inline caches), we store a
+        CallFrameShuffleData in the CallLinkInfo. Otherwise, the JIT and DFG
+        compiler are now using CallFrameShuffler instead of
+        CCallHelpers::prepareForTailCallSlow() to build the frame for a tail
+        call.
+
+        When taking a slow path, we still build the frame as if doing a regular
+        call, because we could throw an exception and need the caller's frame
+        at that point. This means that for virtual calls, we don't benefit from
+        the efficient frame move for now.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::firstRegister):
+        (JSC::ARMv7Assembler::lastRegister):
+        (JSC::ARMv7Assembler::firstFPRegister):
+        (JSC::ARMv7Assembler::lastFPRegister):
+        * assembler/AbortReason.h:
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::setFrameShuffleData):
+        (JSC::CallLinkInfo::frameShuffleData):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::inRegister):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::recovery):
+        * jit/CachedRecovery.cpp: Added.
+        (JSC::CachedRecovery::loadsIntoFPR):
+        (JSC::CachedRecovery::loadsIntoGPR):
+        * jit/CachedRecovery.h: Added.
+        (JSC::CachedRecovery::CachedRecovery):
+        (JSC::CachedRecovery::targets):
+        (JSC::CachedRecovery::addTarget):
+        (JSC::CachedRecovery::removeTarget):
+        (JSC::CachedRecovery::clearTargets):
+        (JSC::CachedRecovery::setWantedJSValueRegs):
+        (JSC::CachedRecovery::setWantedFPR):
+        (JSC::CachedRecovery::boxingRequiresGPR):
+        (JSC::CachedRecovery::boxingRequiresFPR):
+        (JSC::CachedRecovery::recovery):
+        (JSC::CachedRecovery::setRecovery):
+        (JSC::CachedRecovery::wantedJSValueRegs):
+        (JSC::CachedRecovery::wantedFPR):
+        * jit/CallFrameShuffleData.cpp: Added.
+        (JSC::CallFrameShuffleData::setupCalleeSaveRegisters):
+        * jit/CallFrameShuffleData.h: Added.
+        * jit/CallFrameShuffler.cpp: Added.
+        (JSC::CallFrameShuffler::CallFrameShuffler):
+        (JSC::CallFrameShuffler::dump):
+        (JSC::CallFrameShuffler::getCachedRecovery):
+        (JSC::CallFrameShuffler::setCachedRecovery):
+        (JSC::CallFrameShuffler::spill):
+        (JSC::CallFrameShuffler::emitDeltaCheck):
+        (JSC::CallFrameShuffler::prepareForSlowPath):
+        (JSC::CallFrameShuffler::prepareForTailCall):
+        (JSC::CallFrameShuffler::tryWrites):
+        (JSC::CallFrameShuffler::performSafeWrites):
+        (JSC::CallFrameShuffler::prepareAny):
+        * jit/CallFrameShuffler.h: Added.
+        (JSC::CallFrameShuffler::lockGPR):
+        (JSC::CallFrameShuffler::acquireGPR):
+        (JSC::CallFrameShuffler::releaseGPR):
+        (JSC::CallFrameShuffler::snapshot):
+        (JSC::CallFrameShuffler::setCalleeJSValueRegs):
+        (JSC::CallFrameShuffler::assumeCalleeIsCell):
+        (JSC::CallFrameShuffler::canBox):
+        (JSC::CallFrameShuffler::ensureBox):
+        (JSC::CallFrameShuffler::ensureLoad):
+        (JSC::CallFrameShuffler::canLoadAndBox):
+        (JSC::CallFrameShuffler::updateRecovery):
+        (JSC::CallFrameShuffler::clearCachedRecovery):
+        (JSC::CallFrameShuffler::addCachedRecovery):
+        (JSC::CallFrameShuffler::numLocals):
+        (JSC::CallFrameShuffler::getOld):
+        (JSC::CallFrameShuffler::setOld):
+        (JSC::CallFrameShuffler::firstOld):
+        (JSC::CallFrameShuffler::lastOld):
+        (JSC::CallFrameShuffler::isValidOld):
+        (JSC::CallFrameShuffler::argCount):
+        (JSC::CallFrameShuffler::getNew):
+        (JSC::CallFrameShuffler::setNew):
+        (JSC::CallFrameShuffler::addNew):
+        (JSC::CallFrameShuffler::firstNew):
+        (JSC::CallFrameShuffler::lastNew):
+        (JSC::CallFrameShuffler::isValidNew):
+        (JSC::CallFrameShuffler::newAsOld):
+        (JSC::CallFrameShuffler::getFreeRegister):
+        (JSC::CallFrameShuffler::getFreeGPR):
+        (JSC::CallFrameShuffler::getFreeFPR):
+        (JSC::CallFrameShuffler::hasFreeRegister):
+        (JSC::CallFrameShuffler::ensureRegister):
+        (JSC::CallFrameShuffler::ensureGPR):
+        (JSC::CallFrameShuffler::ensureFPR):
+        (JSC::CallFrameShuffler::addressForOld):
+        (JSC::CallFrameShuffler::isUndecided):
+        (JSC::CallFrameShuffler::isSlowPath):
+        (JSC::CallFrameShuffler::addressForNew):
+        (JSC::CallFrameShuffler::dangerFrontier):
+        (JSC::CallFrameShuffler::isDangerNew):
+        (JSC::CallFrameShuffler::updateDangerFrontier):
+        (JSC::CallFrameShuffler::hasOnlySafeWrites):
+        * jit/CallFrameShuffler32_64.cpp: Added.
+        (JSC::CallFrameShuffler::emitStore):
+        (JSC::CallFrameShuffler::emitBox):
+        (JSC::CallFrameShuffler::emitLoad):
+        (JSC::CallFrameShuffler::canLoad):
+        (JSC::CallFrameShuffler::emitDisplace):
+        * jit/CallFrameShuffler64.cpp: Added.
+        (JSC::CallFrameShuffler::emitStore):
+        (JSC::CallFrameShuffler::emitBox):
+        (JSC::CallFrameShuffler::emitLoad):
+        (JSC::CallFrameShuffler::canLoad):
+        (JSC::CallFrameShuffler::emitDisplace):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/RegisterMap.cpp:
+        (JSC::RegisterMap::RegisterMap):
+        (JSC::GPRMap::GPRMap):
+        (JSC::FPRMap::FPRMap):
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+
+2015-09-18  Saam barati  <sbarati@apple.com>
+
+        Implement try/catch in the DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=147374
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements try/catch inside the DFG JIT.
+        It also prevents tier up to the FTL for any functions
+        that have an op_catch in them that are DFG compiled.
+
+        This patch accomplishes implementing try/catch inside
+        the DFG by OSR exiting to op_catch when an exception is thrown.
+        We can OSR exit from an exception inside the DFG in two ways:
+        1) We have a JS call (can also be via implicit getter/setter in GetById/PutById)
+        2) We have an exception when returing from a callOperation
+
+        In the case of (1), we get to the OSR exit from genericUnwind because
+        the exception was thrown in a child call frame. This means these
+        OSR exits must act as defacto op_catches (even though we will still OSR
+        exit to a baseline op_catch). That means they must restore the stack pointer
+        and call frame.
+
+        In the case of (2), we can skip genericUnwind because we know the exception 
+        check will take us to a particular OSR exit. Instead, we link these
+        exception checks as jumps to a particular OSR exit.
+
+        Both types of OSR exits will exit into op_catch inside the baseline JIT.
+        Because they exit to op_catch, these OSR exits must set callFrameForCatch
+        to the proper call frame pointer.
+
+        We "handle" all exceptions inside the machine frame of the DFG code
+        block. This means the machine code block is responsible for "catching"
+        exceptions of any inlined frames' try/catch. OSR exit will then exit to 
+        the proper baseline CodeBlock after reifying the inlined frames
+        (DFG::OSRExit::m_codeOrigin corresponds to the op_catch we will exit to). 
+        Also, genericUnwind will never consult an inlined call frame's CodeBlock to 
+        see if they can catch the exception because they can't. We always unwind to the 
+        next machine code block frame. The DFG CodeBlock changes how the exception 
+        handler table is keyed: it is now keyed by CallSiteIndex for DFG code blocks. 
+
+        So, when consulting call sites that throw, we keep track of the CallSiteIndex,
+        and the HandlerInfo for the corresponding baseline exception handler for
+        that particular CallSiteIndex (if an exception at that call site will be caught). 
+        Then, when we're inside DFG::JITCompiler::link(), we install new HandlerInfo's
+        inside the DFG CodeBlock and key it by the corresponding CallSiteIndex.
+        (The CodeBlock only has HandlerInfos for the OSR exits that are to be arrived
+        at from genericUnwind).
+
+        Also, each OSR exit will know if it acting as an exception handler, and
+        whether or not it will be arrived at from genericUnwind. When we know we 
+        will arrive at an OSR exit from genericUnwind, we set the corresponding 
+        HandlerInfo's nativeCode CodeLocationLabel field to be the OSR exit.
+
+        This patch also introduces a new Phase inside the DFG that ensures
+        that DFG CodeBlocks that handle exceptions take the necessary
+        steps to keep live variables at "op_catch" live according the
+        OSR exit value recovery machinery. We accomplish this by flushing
+        all live op_catch variables to the stack when inside a "try" block.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::handlerForIndex):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearExceptionHandlers):
+        (JSC::CodeBlock::appendExceptionHandler):
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::computePreciseJumpTargets):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::addCodeOrigin):
+        (JSC::DFG::CommonData::lastCallSite):
+        (JSC::DFG::CommonData::shrinkToFit):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
+        (JSC::DFG::JITCompiler::willCatchExceptionInMachineFrame):
+        (JSC::DFG::JITCompiler::exceptionCheck):
+        (JSC::DFG::JITCompiler::recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::emitStoreCodeOrigin):
+        (JSC::DFG::JITCompiler::emitStoreCallSiteIndex):
+        (JSC::DFG::JITCompiler::appendCall):
+        (JSC::DFG::JITCompiler::exceptionCheckWithCallFrameRollback):
+        (JSC::DFG::JITCompiler::blockHeads):
+        (JSC::DFG::JITCompiler::exceptionCheck): Deleted.
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp: Added.
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::FlushLiveCatchVariablesInsertionPhase):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::run):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::willCatchException):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::handleBlock):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::newVariableAccessData):
+        (JSC::DFG::performLiveCatchVariablePreservationPhase):
+        * dfg/DFGLiveCatchVariablePreservationPhase.h: Added.
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::setPatchableCodeOffset):
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::osrWriteBarrier):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOSRExitCompilerCommon.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::SlowPathGenerator):
+        (JSC::DFG::SlowPathGenerator::~SlowPathGenerator):
+        (JSC::DFG::SlowPathGenerator::generate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * interpreter/Interpreter.cpp:
+        (JSC::GetCatchHandlerFunctor::operator()):
+        (JSC::UnwindFunctor::operator()):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::gotoNextFrame):
+        (JSC::StackVisitor::unwindToMachineCodeBlockFrame):
+        (JSC::StackVisitor::readFrame):
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::operator*):
+        (JSC::StackVisitor::operator->):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitExceptionCheck):
+        (JSC::AssemblyHelpers::emitNonPatchableExceptionCheck):
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitCount):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::clearException):
+        (JSC::VM::clearLastException):
+        (JSC::VM::addressOfCallFrameForCatch):
+        (JSC::VM::exception):
+        (JSC::VM::addressOfException):
+        * tests/stress/dfg-exception-try-catch-in-constructor-with-inlined-throw.js: Added.
+        (f):
+        (bar):
+        (Foo):
+        * tests/stress/es6-for-of-loop-exception.js: Added.
+        (assert):
+        (shouldThrowInvalidConstAssignment):
+        (baz):
+        (foo):
+        * tests/stress/exception-dfg-inlined-frame-not-strict-equal.js: Added.
+        (assert):
+        (o.valueOf):
+        (o.toString):
+        (read):
+        (bar):
+        (foo):
+        * tests/stress/exception-dfg-not-strict-equal.js: Added.
+        (foo):
+        (o.valueOf):
+        (o.toString):
+        (assert):
+        (shouldDoSomethingInFinally):
+        (catch):
+        * tests/stress/exception-dfg-operation-read-value.js: Added.
+        (assert):
+        (o.valueOf):
+        (o.toString):
+        (read):
+        (foo):
+        * tests/stress/exception-dfg-throw-from-catch-block.js: Added.
+        (assert):
+        (baz):
+        (bar):
+        (foo):
+
+2015-09-18  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement linear memory instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149326
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements linear memory instructions in WebAssembly.[1] To
+        use the linear memory, an ArrayBuffer must be passed to loadWebAssembly().
+
+        Notes:
+        - We limit the ArrayBuffer's byte length to 2^31 - 1. This enables us to
+          use only one comparison (unsigned greater than) to check for
+          out-of-bounds access.
+        - There is no consensus yet on what should happen when an out-of-bounds
+          access occurs.[2] For now, we throw an error when that happens.
+        - In asm.js, a heap access looks like this: int32Array[i >> 2]. Note
+          that ">> 2" is part of the syntax and is required. pack-asmjs will
+          produce bytecodes that look something like "LoadI32, i" (not
+          "LoadI32, ShiftRightI32, i, 2"). The requirement of the shift operator
+          prevents unaligned accesses in asm.js. (There is a proposal to support
+          unaligned accesses in the future version of asm.js using DataView.[3])
+          The WebAssembly spec allows unaligned accesses.[4] But since we use
+          asm.js for testing, we follow asm.js's behaviors for now.
+
+        [1]: https://github.com/WebAssembly/design/blob/master/AstSemantics.md#linear-memory
+        [2]: https://github.com/WebAssembly/design/blob/master/AstSemantics.md#out-of-bounds
+        [3]: https://wiki.mozilla.org/Javascript:SpiderMonkey:OdinMonkey#Possible_asm.js_extensions_that_don.27t_require_new_JS_features
+        [4]: https://github.com/WebAssembly/design/blob/master/AstSemantics.md#alignment
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionLoadWebAssembly):
+        * tests/stress/wasm-linear-memory.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        * tests/stress/wasm/linear-memory.wasm: Added.
+        * wasm/JSWASMModule.cpp:
+        (JSC::JSWASMModule::JSWASMModule):
+        (JSC::JSWASMModule::visitChildren):
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::create):
+        (JSC::JSWASMModule::arrayBuffer):
+        (JSC::JSWASMModule::JSWASMModule): Deleted.
+        * wasm/WASMConstants.h:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::sizeOfMemoryType):
+        (JSC::WASMFunctionCompiler::MemoryAddress::MemoryAddress):
+        (JSC::WASMFunctionCompiler::endFunction):
+        (JSC::WASMFunctionCompiler::buildLoad):
+        (JSC::WASMFunctionCompiler::buildStore):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseStatement):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseMemoryAddress):
+        (JSC::WASMFunctionParser::parseLoad):
+        (JSC::WASMFunctionParser::parseStore):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::MemoryAddress::MemoryAddress):
+        (JSC::WASMFunctionSyntaxChecker::buildLoad):
+        (JSC::WASMFunctionSyntaxChecker::buildStore):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::WASMModuleParser):
+        (JSC::WASMModuleParser::parseModule):
+        (JSC::parseWebAssembly):
+        (JSC::WASMModuleParser::parse): Deleted.
+        * wasm/WASMModuleParser.h:
+
+2015-09-18  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement type conversion instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149340
+
+        Reviewed by Mark Lam.
+
+        This patch implements some type conversion instructions in WebAssembly.
+        The WebAssembly spec has a lot more type conversion instructions than
+        what are available in asm.js.[1] We only implement the ones that are in
+        asm.js for now because we can only test those.
+
+        [1]: https://github.com/WebAssembly/design/blob/master/AstSemantics.md
+
+        * tests/stress/wasm-type-conversion.js:
+        * tests/stress/wasm/type-conversion.wasm:
+        * wasm/WASMConstants.h:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::operationConvertUnsignedInt32ToDouble):
+        (JSC::WASMFunctionCompiler::buildConvertType):
+        (JSC::WASMFunctionCompiler::callOperation):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseConvertType):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildConvertType):
+
+2015-09-18  Alex Christensen  <achristensen@webkit.org>
+
+        Fix tests on Windows after switching to CMake.
+        https://bugs.webkit.org/show_bug.cgi?id=149339
+
+        Reviewed by Brent Fulgham.
+
+        * shell/PlatformWin.cmake:
+        Build testapi and testRegExp (which doesn't seem to be used any more).
+
+2015-09-17  Brian Burg  <bburg@apple.com>
+
+        ASSERT(!m_frontendRouter->hasLocalFrontend()) when running Web Inspector tests
+        https://bugs.webkit.org/show_bug.cgi?id=149006
+
+        Reviewed by Joseph Pecoraro.
+
+        Prior to disconnecting, we need to know how many frontends remain connected.
+
+        * inspector/InspectorFrontendRouter.h: Add frontendCount().
+
+2015-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Explicitly specify builtin JS files dependency
+        https://bugs.webkit.org/show_bug.cgi?id=149323
+
+        Reviewed by Alex Christensen.
+
+        JSCBuiltins.{h,cpp} in CMakeLists.txt and DerivedSources.make just depend on the builtins directory.
+        As a result, even if we modify builtins/*.js code, regenerating JSCBuiltins.{h,cpp} does not occur.
+        As the same to the cpp sources, let's list up the JS files explicitly.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+
+2015-09-18  Michael Saboff  <msaboff@apple.com>
+
+        Remove register preservation and restoration stub code
+        https://bugs.webkit.org/show_bug.cgi?id=149335
+
+        Reviewed by Mark Lam.
+
+        Delete the register preservation and restoration thunks and related plumbing.
+
+        Much of this change is removing the unneeded RegisterPreservationMode parameter
+        from various functions.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::isVarargsCallType):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::isVarargs):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::CallLinkInfo::setUpCallFromFTL):
+        (JSC::CallLinkInfo::registerPreservationMode): Deleted.
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::initializeAddressForCall):
+        (JSC::FTL::JITCode::addressForCall):
+        * ftl/FTLJITCode.h:
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        (JSC::DirectJITCode::initializeCodeRef):
+        (JSC::DirectJITCode::addressForCall):
+        (JSC::NativeJITCode::initializeCodeRef):
+        (JSC::NativeJITCode::addressForCall):
+        (JSC::DirectJITCode::ensureWrappers): Deleted.
+        * jit/JITCode.h:
+        (JSC::JITCode::jitTypeFor):
+        (JSC::JITCode::executableAddress):
+        * jit/JITOperations.cpp:
+        * jit/RegisterPreservationWrapperGenerator.cpp: Removed.
+        * jit/RegisterPreservationWrapperGenerator.h: Removed.
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualThunkFor):
+        * jit/ThunkGenerators.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::setUpCall):
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode):
+        (JSC::ScriptExecutable::installCode):
+        (JSC::WebAssemblyExecutable::prepareForExecution):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::generatedJITCodeFor):
+        (JSC::ExecutableBase::entrypointFor):
+        (JSC::ExecutableBase::offsetOfJITCodeWithArityCheckFor):
+        * runtime/RegisterPreservationMode.h: Removed.
+
+2015-09-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused canClearBrowserCookies / canClearBrowserCache protocol methods
+        https://bugs.webkit.org/show_bug.cgi?id=149307
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/Network.json:
+        Remove unused protocol methods.
+
+2015-09-17  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189938, r189952, and r189956.
+        https://bugs.webkit.org/show_bug.cgi?id=149329
+
+        Broke Web Workers (Requested by ap on #webkit).
+
+        Reverted changesets:
+
+        "Implement try/catch in the DFG."
+        https://bugs.webkit.org/show_bug.cgi?id=147374
+        http://trac.webkit.org/changeset/189938
+
+        "CLoop build fix after r189938."
+        http://trac.webkit.org/changeset/189952
+
+        "add a regress test for richards with try/catch."
+        https://bugs.webkit.org/show_bug.cgi?id=149301
+        http://trac.webkit.org/changeset/189956
+
+2015-09-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        CLoop build fix after r189938.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::unwindToMachineCodeBlockFrame):
+
+2015-09-17  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Convert return values from JavaScript functions to the expected types in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149200
+
+        Reviewed by Mark Lam.
+
+        When a WebAssembly function calls a JavaScript function, there is no
+        guarantee that the JavaScript function will always return values of the
+        type we expect. This patch converts the return values to the expected
+        types.
+
+        (The reverse is also true: When a WebAssembly function is called from a
+        JavaScript function, there is no guarantee that the arguments to the
+        WebAssembly function will always be of the types we expect. We have
+        fixed this in Bug 149033.)
+
+        We don't need to type check the return values if the callee is a
+        WebAssembly function. We don't need to type check the arguments if the
+        caller is a WebAssembly function. This optimization will be
+        implemented in the future. See https://bugs.webkit.org/show_bug.cgi?id=149310
+
+        * tests/stress/wasm-type-conversion.js:
+        * tests/stress/wasm/type-conversion.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+        (JSC::WASMFunctionCompiler::buildReturn):
+        (JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
+        (JSC::WASMFunctionCompiler::callAndUnboxResult):
+        (JSC::WASMFunctionCompiler::convertValueToInt32):
+        (JSC::WASMFunctionCompiler::convertValueToDouble):
+        (JSC::WASMFunctionCompiler::convertDoubleToValue):
+        (JSC::WASMFunctionCompiler::loadValueAndConvertToInt32): Deleted.
+        (JSC::WASMFunctionCompiler::loadValueAndConvertToDouble): Deleted.
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseCallInternalExpressionI32): Deleted.
+        * wasm/WASMFunctionParser.h:
+
+2015-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Add more fine-grained APIs and additional hooks to control module loader from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=149129
+
+        Reviewed by Saam Barati.
+
+        No behavior change.
+
+        Module tag `<script type="module>` will be executed asynchronously.
+        But we would like to fetch the resources before when the postTask-ed task is performed.
+        So instead of 1 API that fetch, instantiate and execute the module,
+        we need 2 fine-grained APIs.
+
+        1. Fetch and initialize a module, but not execute it yet.
+        2. Link and execute a module specified by the key (this will be invoked asynchronously).
+
+        And to instrument the script execution (like reporting the execution time of the module to
+        the inspector), we need a hook to inject code around an execution of a module body.
+
+        * builtins/ModuleLoaderObject.js:
+        (moduleEvaluation):
+        (loadAndEvaluateModule):
+        (loadModule):
+        (linkAndEvaluateModule):
+        * jsc.cpp:
+        (functionLoadModule):
+        (runWithScripts):
+        * runtime/Completion.cpp:
+        (JSC::identifierToJSValue):
+        (JSC::createSymbolForEntryPointModule):
+        (JSC::rejectPromise):
+        (JSC::loadAndEvaluateModule):
+        (JSC::loadModule):
+        (JSC::linkAndEvaluateModule):
+        (JSC::evaluateModule): Deleted.
+        * runtime/Completion.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::evaluate):
+        (JSC::JSModuleRecord::execute): Deleted.
+        * runtime/JSModuleRecord.h:
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::ModuleLoaderObject::loadAndEvaluateModule):
+        (JSC::ModuleLoaderObject::linkAndEvaluateModule):
+        (JSC::ModuleLoaderObject::evaluate):
+        (JSC::moduleLoaderObjectEvaluate):
+        * runtime/ModuleLoaderObject.h:
+
+2015-09-17  Saam barati  <sbarati@apple.com>
+
+        Implement try/catch in the DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=147374
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements try/catch inside the DFG JIT.
+        It also prevents tier up to the FTL for any functions
+        that have an op_catch in them that are DFG compiled.
+
+        This patch accomplishes implementing try/catch inside
+        the DFG by OSR exiting to op_catch when an exception is thrown.
+        We can OSR exit from an exception inside the DFG in two ways:
+        1) We have a JS call (can also be via implicit getter/setter in GetById/PutById)
+        2) We have an exception when returing from a callOperation
+
+        In the case of (1), we get to the OSR exit from genericUnwind because
+        the exception was thrown in a child call frame. This means these
+        OSR exits must act as defacto op_catches (even though we will still OSR
+        exit to a baseline op_catch). That means they must restore the stack pointer
+        and call frame.
+
+        In the case of (2), we can skip genericUnwind because we know the exception 
+        check will take us to a particular OSR exit. Instead, we link these
+        exception checks as jumps to a particular OSR exit.
+
+        Both types of OSR exits will exit into op_catch inside the baseline JIT.
+        Because they exit to op_catch, these OSR exits must set callFrameForCatch
+        to the proper call frame pointer.
+
+        We "handle" all exceptions inside the machine frame of the DFG code
+        block. This means the machine code block is responsible for "catching"
+        exceptions of any inlined frames' try/catch. OSR exit will then exit to 
+        the proper baseline CodeBlock after reifying the inlined frames
+        (DFG::OSRExit::m_codeOrigin corresponds to the op_catch we will exit to). 
+        Also, genericUnwind will never consult an inlined call frame's CodeBlock to 
+        see if they can catch the exception because they can't. We always unwind to the 
+        next machine code block frame. The DFG CodeBlock changes how the exception 
+        handler table is keyed: it is now keyed by CallSiteIndex for DFG code blocks. 
+
+        So, when consulting call sites that throw, we keep track of the CallSiteIndex,
+        and the HandlerInfo for the corresponding baseline exception handler for
+        that particular CallSiteIndex (if an exception at that call site will be caught). 
+        Then, when we're inside DFG::JITCompiler::link(), we install new HandlerInfo's
+        inside the DFG CodeBlock and key it by the corresponding CallSiteIndex.
+        (The CodeBlock only has HandlerInfos for the OSR exits that are to be arrived
+        at from genericUnwind).
+
+        Also, each OSR exit will know if it acting as an exception handler, and
+        whether or not it will be arrived at from genericUnwind. When we know we 
+        will arrive at an OSR exit from genericUnwind, we set the corresponding 
+        HandlerInfo's nativeCode CodeLocationLabel field to be the OSR exit.
+
+        This patch also introduces a new Phase inside the DFG that ensures
+        that DFG CodeBlocks that handle exceptions take the necessary
+        steps to keep live variables at "op_catch" live according the
+        OSR exit value recovery machinery. We accomplish this by flushing
+        all live op_catch variables to the stack when inside a "try" block.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::handlerForIndex):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearExceptionHandlers):
+        (JSC::CodeBlock::appendExceptionHandler):
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::computePreciseJumpTargets):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::addCodeOrigin):
+        (JSC::DFG::CommonData::lastCallSite):
+        (JSC::DFG::CommonData::shrinkToFit):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
+        (JSC::DFG::JITCompiler::willCatchExceptionInMachineFrame):
+        (JSC::DFG::JITCompiler::exceptionCheck):
+        (JSC::DFG::JITCompiler::recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::emitStoreCodeOrigin):
+        (JSC::DFG::JITCompiler::emitStoreCallSiteIndex):
+        (JSC::DFG::JITCompiler::appendCall):
+        (JSC::DFG::JITCompiler::exceptionCheckWithCallFrameRollback):
+        (JSC::DFG::JITCompiler::blockHeads):
+        (JSC::DFG::JITCompiler::exceptionCheck): Deleted.
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp: Added.
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::FlushLiveCatchVariablesInsertionPhase):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::run):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::willCatchException):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::handleBlock):
+        (JSC::DFG::FlushLiveCatchVariablesInsertionPhase::newVariableAccessData):
+        (JSC::DFG::performLiveCatchVariablePreservationPhase):
+        * dfg/DFGLiveCatchVariablePreservationPhase.h: Added.
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::setPatchableCodeOffset):
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::osrWriteBarrier):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOSRExitCompilerCommon.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::SlowPathGenerator):
+        (JSC::DFG::SlowPathGenerator::~SlowPathGenerator):
+        (JSC::DFG::SlowPathGenerator::generate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * interpreter/Interpreter.cpp:
+        (JSC::GetCatchHandlerFunctor::operator()):
+        (JSC::UnwindFunctor::operator()):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::gotoNextFrame):
+        (JSC::StackVisitor::unwindToMachineCodeBlockFrame):
+        (JSC::StackVisitor::readFrame):
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::operator*):
+        (JSC::StackVisitor::operator->):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitExceptionCheck):
+        (JSC::AssemblyHelpers::emitNonPatchableExceptionCheck):
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitCount):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/VM.h:
+        (JSC::VM::clearException):
+        (JSC::VM::clearLastException):
+        (JSC::VM::addressOfCallFrameForCatch):
+        (JSC::VM::exception):
+        (JSC::VM::addressOfException):
+        * tests/stress/dfg-exception-try-catch-in-constructor-with-inlined-throw.js: Added.
+        (f):
+        (bar):
+        (Foo):
+        * tests/stress/es6-for-of-loop-exception.js: Added.
+        (assert):
+        (shouldThrowInvalidConstAssignment):
+        (baz):
+        (foo):
+        * tests/stress/exception-dfg-inlined-frame-not-strict-equal.js: Added.
+        (assert):
+        (o.valueOf):
+        (o.toString):
+        (read):
+        (bar):
+        (foo):
+        * tests/stress/exception-dfg-not-strict-equal.js: Added.
+        (foo):
+        (o.valueOf):
+        (o.toString):
+        (assert):
+        (shouldDoSomethingInFinally):
+        (catch):
+        * tests/stress/exception-dfg-operation-read-value.js: Added.
+        (assert):
+        (o.valueOf):
+        (o.toString):
+        (read):
+        (foo):
+        * tests/stress/exception-dfg-throw-from-catch-block.js: Added.
+        (assert):
+        (baz):
+        (bar):
+        (foo):
+
+2015-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        0.0 should really be 0.0
+        https://bugs.webkit.org/show_bug.cgi?id=149283
+
+        Reviewed by Mark Lam.
+
+        A while ago (http://trac.webkit.org/changeset/180813) we introduced the idea that if the
+        user wrote a number with a decimal point (like "0.0") then we should treat that number as
+        a double. That's probably a pretty good idea. But, we ended up doing it inconsistently.
+        The DFG would indeed treat such a number as a double by consulting the
+        SourceCodeRepresentation, but the other execution engines would still see Int32:0.
+
+        This patch makes it consistent.
+
+        This is necessary for property type inference to perform well. Otherwise, a store of a
+        constant would change type from the baseline engine to the DFG, which would then cause
+        a storm of property type invalidations and recompilations.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstantValue):
+
+2015-09-17  Filip Pizlo  <fpizlo@apple.com>
+
+        stress/exit-from-getter.js.ftl-eager occasionally traps in debug
+        https://bugs.webkit.org/show_bug.cgi?id=149096
+
+        Reviewed by Geoffrey Garen.
+
+        JS calls to getters/setters in get/put inline caches need to reset SP after the call, as our
+        calling convention requires.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate): Fix the bug.
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link): Adds some verbiage about why the FTL stack offset logic is correct.
+        * tests/stress/getter-arity.js: Added. Other tests would flaky crash before the patch. This test instacrashes before the patch.
+
+2015-09-17  Saam barati  <sbarati@apple.com>
+
+        Interpreter::unwind() shouldn't be responsible for filtering out uncatchable exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=149228
+
+        Reviewed by Mark Lam.
+
+        op_catch is now responsible for filtering exceptions that
+        aren't catchable. When op_catch encounters an uncatchable
+        exception, it will call back into genericUnwind and throw
+        the exception further down the call stack. This is necessary
+        in a later patch that will implement exception handling
+        in the DFG, and part of that patch includes exception
+        handling that doesn't go through genericUnwind. The DFG try/catch
+        patch will not go through genericUnwind when it knows that
+        an exception check after a callOperation will be caught inside the 
+        machine frame or any inlined frames. This patch enables that 
+        patch by destroying the notion that all exception handling must 
+        filter through genericUnwind.
+
+        This patch maintains compatibility with the debugger and
+        profiler by ensuring we notify the debugger when an
+        exception is thrown inside VM::throwException and not
+        in genericUnwind. It also notifies the profiler that we've
+        potentially changed call frames inside op_catch.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::pauseIfNeeded):
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::unwind):
+        (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
+        (JSC::checkedReturn):
+        * interpreter/Interpreter.h:
+        (JSC::SuspendExceptionScope::SuspendExceptionScope):
+        (JSC::SuspendExceptionScope::~SuspendExceptionScope):
+        (JSC::Interpreter::sampler):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        (JSC::JIT::callOperationNoExceptionCheck):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::llint_throw_stack_overflow_error):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::isTerminatedExecutionException):
+        * runtime/VM.cpp:
+        (JSC::VM::throwException):
+        * runtime/VM.h:
+        (JSC::VM::targetMachinePCForThrowOffset):
+        (JSC::VM::restorePreviousException):
+        (JSC::VM::clearException):
+        (JSC::VM::clearLastException):
+        (JSC::VM::exception):
+        (JSC::VM::addressOfException):
+        (JSC::VM::setException):
+
+2015-09-17  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Calling a float function on x86 in WebAssembly incorrectly returns a double
+        https://bugs.webkit.org/show_bug.cgi?id=149254
+
+        Reviewed by Michael Saboff.
+
+        In WebAssembly on x86 (32-bit), when we call a function that returns a
+        float or a double, we use the FSTP instruction to read the return value
+        from the FPU register stack. The FSTP instruction converts the value to
+        single-precision or double-precision floating-point format, depending on
+        the destination operand. Currently, we always use double as the
+        destination, which is wrong. This patch uses the correct return type.
+        This should fix the test errors in tests/stress/wasm-arithmetic-float32.js
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::fstps):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::appendCallSetResult):
+        (JSC::WASMFunctionCompiler::callOperation):
+
+2015-09-17  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Save and restore callee save registers in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149247
+
+        Reviewed by Michael Saboff.
+
+        Save callee save registers when entering WebAssembly functions
+        and restore them when returning.
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::webAssemblyCalleeSaveRegisters):
+        * jit/RegisterSet.h:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+        (JSC::WASMFunctionCompiler::endFunction):
+        (JSC::WASMFunctionCompiler::buildReturn):
+        (JSC::WASMFunctionCompiler::localAddress):
+        (JSC::WASMFunctionCompiler::temporaryAddress):
+        (JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
+        (JSC::WASMFunctionCompiler::callAndUnboxResult):
+
+2015-09-16  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement indirect calls in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149100
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implement indirect calls for WebAssembly files generated by
+        pack-asmjs <https://github.com/WebAssembly/polyfill-prototype-1>.
+        pack-asmjs uses the same indirect call model as asm.js. In asm.js, an
+        indirect call looks like this:
+            t[i & n](...)
+        where t is a variable referring to an array of functions with the same
+        signature, i is an integer expression, n is an integer that is equal to
+        (t.length - 1), and t.length is a power of two. pack-asmjs does not
+        use the '&' operator nor n in the WebAssembly output, but the semantics
+        is still the same as asm.js.
+
+        * tests/stress/wasm-calls.js:
+        * tests/stress/wasm/calls.wasm:
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildCallIndirect):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseCallIndirect):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildCallIndirect):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::parseFunctionPointerTableSection):
+        (JSC::WASMModuleParser::parseFunctionDefinitionSection):
+
+2015-09-16  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Fix 32-bit build issues in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149240
+
+        Reviewed by Geoffrey Garen.
+
+        Fix the syntax error and replace the instructions that are not available on
+        64-bit platforms.
+
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+        (JSC::WASMFunctionCompiler::endFunction):
+        (JSC::WASMFunctionCompiler::buildReturn):
+        (JSC::WASMFunctionCompiler::callAndUnboxResult):
+        (JSC::WASMFunctionCompiler::loadValueAndConvertToDouble):
+
+2015-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptCore should discard baseline code after some time
+        https://bugs.webkit.org/show_bug.cgi?id=149220
+
+        Reviewed by Saam Barati.
+
+        This is a bit more complicated than discarding optimized code because
+        the engine previously assumed that we would never discard baseline code.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Record creation time (and compute time since
+        creation) instead of install time because CodeBlocks can be installed
+        more than once, and we don't want to have to worry about edge cases
+        created by CodeBlocks seeming to get younger.
+
+        (JSC::CodeBlock::visitAggregate): Be explicit about only doing the 
+        weak reference fixpoint for optimized CodeBlocks. We used to avoid the
+        fixpoint for baseline CodeBlocks implicitly, since they would always
+        visit themselves strongly right away. But now baseline CodeBlocks might
+        not visit themselves strongly, since they might choose to jettison due
+        to old age.
+
+        (JSC::CodeBlock::shouldVisitStrongly): Add old age as a reason not to
+        visit ourselves strongly, so that baseline CodeBlocks can jettison due
+        to old age.
+
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference): Be explicit about
+        only jettisoning optimized CodeBlocks due to weak references so that we
+        don't confuse ourselves into thinking that we will jettison a baseline
+        CodeBlock due to weak references.
+
+        (JSC::CodeBlock::shouldJettisonDueToOldAge): Updated to use creation time.
+
+        (JSC::CodeBlock::visitOSRExitTargets): Clarify a comment and add an
+        ASSERT to help record some things I discovered while debugging.
+
+        (JSC::CodeBlock::jettison): Allow a baseline CodeBlock to jettison. Don't
+        assume that we have an alternative or a profiler.
+
+        (JSC::CodeBlock::install): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::releaseAlternative): Deleted.
+        (JSC::CodeBlock::setInstallTime): Deleted.
+        (JSC::CodeBlock::timeSinceInstall): Deleted.
+
+        * dfg/DFGOSRExitPreparation.cpp:
+        (JSC::DFG::prepareCodeOriginForOSRExit): Simplified the computation of
+        baseline CodeBlock.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren): Be sure to strongly
+        visit our inline callframes because we assume that an optimized CodeBlock
+        will keep its OSR exit targets alive, but the CodeBlock object won't be
+        able to mark them for itself until compilation has completed (since it
+        won't have a JITCode object yet).
+
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLDeferredCompilationCallback::compilationDidComplete):
+        Updated for interface change.
+
+        * jit/JITCode.h:
+        (JSC::JITCode::timeToLive): Provide a time to live for interpreter and
+        baseline code, so they will jettison when old. Use seconds in our
+        code so that we don't need comments. Make DFG 2X interpreter+baseline,
+        and FTL 2X DFG+interpreter+baseline, also matching the time we allot
+        before throwing away all code.
+
+        * jit/JITToDFGDeferredCompilationCallback.cpp:
+        (JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics): Updated for interface change.
+
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode): Allow our caller to install nullptr,
+        since we need to do this when jettisoning a baseline CodeBlock. Require
+        our caller to specify the details of the installation because we can't
+        rely on a non-null CodeBlock in order to compute them.
+
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::recordParse): Updated for interface change.
+
+        * runtime/Options.h: Renamed the CodeBlock liveness option since it now
+        controls baseline and optimized code.
+
+2015-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Remove obsolete code for deleting CodeBlocks
+        https://bugs.webkit.org/show_bug.cgi?id=149231
+
+        Reviewed by Mark Lam.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCodeBlocks): ASSERT that we're called in a valid
+        state, and do the compiler waiting ourselves instead of having our
+        caller do it. This is more appropriate to our new limited use.
+
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::deleteOldCode): Deleted. Don't call deleteAllCodeBlocks
+        periodically because it's not such a good idea to delete everything
+        at once, and CodeBlocks now have a more precise individual policy for
+        when to delete. Also, this function used to fail all or nearly all of
+        the time because its invariants that we were not executing or compiling
+        could not be met.
+
+        * heap/Heap.h:
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDeleteAllCompiledCode): Deleted.
+        * tests/stress/deleteAllCompiledCode.js: Removed. Removed this testing
+        code because it did not do what it thought it did. All of this code
+        was guaranteed to no-op since it would run JavaScript to call a function
+        that would return early because JavaScript was running.
+
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllCode): This code is simpler now becaue 
+        heap.deleteAllCodeBlocks does some work for us.
+
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope): Don't delete code on VM entry. This
+        policy was old, and it dated back to a time when we 
+
+            (a) couldn't run in the interpreter if compilation failed;
+
+            (b) didn't reduce the rate of compilation in response to executable
+            memory pressure;
+
+            (c) didn't throw away individual CodeBlocks automatically.
+
+2015-09-16  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Implement tail calls in the LLInt and Baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=148661
+
+        Fix for the breakage of Speedometer/Full.html (https://bugs.webkit.org/show_bug.cgi?id=149162).
+
+        Reviewed by Filip Pizlo.
+        Changed SetupVarargsFrame.cpp::emitSetVarargsFrame to align the callframe size to be a
+        multiple of stackAlignmentRegisters() in addition to the location of the new frame.
+
+        Fixed Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbortReason.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::repatchNearCall):
+        (JSC::AbstractMacroAssembler::repatchCompact):
+        * assembler/CodeLocation.h:
+        (JSC::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::CodeLocationNearCall::callMode):
+        (JSC::CodeLocationCommon::callAtOffset):
+        (JSC::CodeLocationCommon::nearCallAtOffset):
+        (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::locationOfNearCall):
+        (JSC::LinkBuffer::locationOf):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::nearTailCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::linkCall):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::nearCall):
+        (JSC::MacroAssemblerARM64::nearTailCall):
+        (JSC::MacroAssemblerARM64::ret):
+        (JSC::MacroAssemblerARM64::linkCall):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::nearTailCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::linkCall):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::nearTailCall):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::linkCall):
+        (JSC::MacroAssemblerMIPS::repatchCall):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::call):
+        (JSC::MacroAssemblerSH4::nearTailCall):
+        (JSC::MacroAssemblerSH4::nearCall):
+        (JSC::MacroAssemblerSH4::linkCall):
+        (JSC::MacroAssemblerSH4::repatchCall):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::linkCall):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::breakpoint):
+        (JSC::MacroAssemblerX86Common::nearTailCall):
+        (JSC::MacroAssemblerX86Common::nearCall):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::linkCall):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::callTypeFor):
+        (JSC::CallLinkInfo::isVarargsCallType):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::specializationKind):
+        (JSC::CallLinkInfo::callModeFor):
+        (JSC::CallLinkInfo::callMode):
+        (JSC::CallLinkInfo::isTailCall):
+        (JSC::CallLinkInfo::isVarargs):
+        (JSC::CallLinkInfo::registerPreservationMode):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCallInTailPosition):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        (JSC::LabelNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isCallBytecode):
+        (JSC::calleeFrameForVarargs):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        (JSC::CCallHelpers::prepareForTailCallSlow):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_tail_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_tail_call_varargs):
+        (JSC::JIT::emit_op_construct_varargs):
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_tail_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_tail_call_varargs):
+        (JSC::JIT::emitSlow_op_construct_varargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_tail_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_tail_call_varargs):
+        (JSC::JIT::emitSlow_op_construct_varargs):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_tail_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_tail_call_varargs):
+        (JSC::JIT::emit_op_construct_varargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitNakedTailCall):
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/Repatch.cpp:
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetVarargsFrame):
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::slowPathFor):
+        (JSC::linkCallThunkGenerator):
+        (JSC::virtualThunkFor):
+        (JSC::arityFixupGenerator):
+        (JSC::unreachableGenerator):
+        (JSC::baselineGetterReturnThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        (JSC::CommonSlowPaths::opIn):
+
+2015-09-15  Michael Saboff  <msaboff@apple.com>
+
+        Rollout r189774 and 189818.
+
+        Broke Speedometer/Full.html
+
+        Not reviewed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbortReason.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::repatchNearCall):
+        (JSC::AbstractMacroAssembler::repatchCompact):
+        * assembler/CodeLocation.h:
+        (JSC::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::CodeLocationCommon::callAtOffset):
+        (JSC::CodeLocationCommon::nearCallAtOffset):
+        (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::CodeLocationNearCall::callMode): Deleted.
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::locationOfNearCall):
+        (JSC::LinkBuffer::locationOf):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::linkCall):
+        (JSC::MacroAssemblerARM::nearTailCall): Deleted.
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::nearCall):
+        (JSC::MacroAssemblerARM64::ret):
+        (JSC::MacroAssemblerARM64::linkCall):
+        (JSC::MacroAssemblerARM64::nearTailCall): Deleted.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::linkCall):
+        (JSC::MacroAssemblerARMv7::nearTailCall): Deleted.
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::linkCall):
+        (JSC::MacroAssemblerMIPS::repatchCall):
+        (JSC::MacroAssemblerMIPS::nearTailCall): Deleted.
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::call):
+        (JSC::MacroAssemblerSH4::nearCall):
+        (JSC::MacroAssemblerSH4::linkCall):
+        (JSC::MacroAssemblerSH4::repatchCall):
+        (JSC::MacroAssemblerSH4::nearTailCall): Deleted.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::linkCall):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::breakpoint):
+        (JSC::MacroAssemblerX86Common::nearCall):
+        (JSC::MacroAssemblerX86Common::nearTailCall): Deleted.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::linkCall):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::callTypeFor):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::specializationKind):
+        (JSC::CallLinkInfo::registerPreservationMode):
+        (JSC::CallLinkInfo::isVarargsCallType): Deleted.
+        (JSC::CallLinkInfo::callModeFor): Deleted.
+        (JSC::CallLinkInfo::callMode): Deleted.
+        (JSC::CallLinkInfo::isTailCall): Deleted.
+        (JSC::CallLinkInfo::isVarargs): Deleted.
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCallInTailPosition):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        (JSC::LabelNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isCallBytecode):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        (JSC::CCallHelpers::prepareForTailCallSlow): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_construct_varargs):
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_construct_varargs):
+        (JSC::JIT::emit_op_tail_call): Deleted.
+        (JSC::JIT::emit_op_tail_call_varargs): Deleted.
+        (JSC::JIT::emitSlow_op_tail_call): Deleted.
+        (JSC::JIT::emitSlow_op_tail_call_varargs): Deleted.
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_construct_varargs):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_construct_varargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::emitSlow_op_tail_call): Deleted.
+        (JSC::JIT::emitSlow_op_tail_call_varargs): Deleted.
+        (JSC::JIT::emit_op_tail_call): Deleted.
+        (JSC::JIT::emit_op_tail_call_varargs): Deleted.
+        * jit/JITInlines.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::updateTopCallFrame):
+        (JSC::JIT::emitNakedTailCall): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/Repatch.cpp:
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::slowPathFor):
+        (JSC::linkCallThunkGenerator):
+        (JSC::virtualThunkFor):
+        (JSC::arityFixupGenerator):
+        (JSC::baselineGetterReturnThunkGenerator):
+        (JSC::unreachableGenerator): Deleted.
+        * jit/ThunkGenerators.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        (JSC::CommonSlowPaths::opIn):
+        * tests/stress/mutual-tail-call-no-stack-overflow.js: Removed.
+        * tests/stress/tail-call-no-stack-overflow.js: Removed.
+        * tests/stress/tail-call-recognize.js: Removed.
+        * tests/stress/tail-call-varargs-no-stack-overflow.js: Removed.
+        * tests/stress/tail-calls-dont-overwrite-live-stack.js: Removed.
+
+2015-09-15  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement imported global variables in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149206
+
+        Reviewed by Filip Pizlo.
+
+        Values can now be imported to a WebAssembly module through properties of
+        the imports object that is passed to loadWebAssembly(). In order to
+        avoid any side effect when accessing the imports object, we check that
+        the properties are data properties. We also check that each value is a
+        primitive and is not a Symbol. According to the ECMA262 6.0 spec,
+        calling ToNumber() on a primitive that is not a Symbol should not cause
+        any side effect.[1]
+
+        [1]: http://www.ecma-international.org/ecma-262/6.0/#sec-tonumber
+
+        * tests/stress/wasm-globals.js:
+        * tests/stress/wasm/globals.wasm:
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::parseModule):
+        (JSC::WASMModuleParser::parseGlobalSection):
+        * wasm/WASMModuleParser.h:
+
+2015-09-15  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Fix asm.js errors in WebAssembly tests
+        https://bugs.webkit.org/show_bug.cgi?id=149203
+
+        Reviewed by Geoffrey Garen.
+
+        Our WebAssembly implementation uses asm.js for testing. Using Firefox to
+        parse asm.js reveals many errors that are not caught by pack-asmjs. For
+        example,
+        - asm.js does not allow the use of the multiplication operator (*) to
+          multiply two integers, because the result can be so large that some
+          lower bits of precision are lost. Math.imul is used instead.
+        - an int variable must be coerced to either signed (via x|0) or unsigned
+          (via x>>>0) before it's returned.
+
+        * tests/stress/wasm-arithmetic-int32.js:
+        * tests/stress/wasm-calls.js:
+        * tests/stress/wasm-control-flow.js:
+        * tests/stress/wasm-globals.js:
+        * tests/stress/wasm-locals.js:
+        * tests/stress/wasm-relational.js:
+        * tests/stress/wasm/control-flow.wasm:
+
+2015-09-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Add ShadowRoot interface and Element.prototype.attachShadow
+        https://bugs.webkit.org/show_bug.cgi?id=149187
+
+        Reviewed by Antti Koivisto.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-09-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Paused Debugger prevents page reload
+        https://bugs.webkit.org/show_bug.cgi?id=148174
+
+        Reviewed by Brian Burg.
+
+        * debugger/Debugger.h:
+        (JSC::Debugger::suppressAllPauses):
+        (JSC::Debugger::setSuppressAllPauses):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::pauseIfNeeded):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::setSuppressAllPauses):
+        Provide a way to suppress pauses.
+
+2015-09-15  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement calls to JavaScript functions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149093
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements calls to JavaScript functions in WebAssembly.
+        WebAssembly functions can only call JavaScript functions that are
+        imported to their module via an object that is passed into
+        loadWebAssembly(). References to JavaScript functions are resolved at
+        the module's load time, just like asm.js.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionLoadWebAssembly):
+        * tests/stress/wasm-calls.js:
+        * tests/stress/wasm/calls.wasm:
+        * wasm/JSWASMModule.cpp:
+        (JSC::JSWASMModule::visitChildren):
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::importedFunctions):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildCallImport):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseCallImport):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildCallInternal):
+        (JSC::WASMFunctionSyntaxChecker::buildCallImport):
+        (JSC::WASMFunctionSyntaxChecker::updateTempStackHeightForCall):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::WASMModuleParser):
+        (JSC::WASMModuleParser::parse):
+        (JSC::WASMModuleParser::parseModule):
+        (JSC::WASMModuleParser::parseFunctionImportSection):
+        (JSC::WASMModuleParser::getImportedValue):
+        (JSC::parseWebAssembly):
+        * wasm/WASMModuleParser.h:
+
+2015-09-15  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(DFG_JIT) build after r188696
+        https://bugs.webkit.org/show_bug.cgi?id=149158
+
+        Reviewed by Yusuke Suzuki.
+
+        * bytecode/GetByIdStatus.cpp:
+        * bytecode/GetByIdStatus.h:
+
+2015-09-15  Saam barati  <sbarati@apple.com>
+
+        functions that use try/catch will allocate a top level JSLexicalEnvironment even when it is not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=148169
+
+        Reviewed by Geoffrey Garen.
+
+        We used to do this before we had proper lexical scoping
+        in the bytecode generator. There is absolutely no reason
+        why need to allocate a top-level "var" activation when a
+        function/program uses a "catch" block.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::incConstants):
+        (JSC::ASTBuilder::usesThis):
+        (JSC::ASTBuilder::usesArguments):
+        (JSC::ASTBuilder::usesWith):
+        (JSC::ASTBuilder::usesEval):
+        (JSC::ASTBuilder::usesCatch): Deleted.
+        * parser/Nodes.h:
+        (JSC::ScopeNode::isStrictMode):
+        (JSC::ScopeNode::setUsesArguments):
+        (JSC::ScopeNode::usesThis):
+        (JSC::ScopeNode::needsActivation):
+        (JSC::ScopeNode::hasCapturedVariables):
+        (JSC::ScopeNode::captures):
+        (JSC::ScopeNode::needsActivationForMoreThanVariables): Deleted.
+        * parser/ParserModes.h:
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::isStrictMode):
+        (JSC::ScriptExecutable::ecmaMode):
+
+2015-09-15  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r189774): CLoop doesn't build after r189774
+        https://bugs.webkit.org/show_bug.cgi?id=149171
+
+        Unreviewed build fix for the C Loop.
+
+        Added needed C Loop label opcodes.
+
+        * bytecode/BytecodeList.json:
+
+2015-09-15  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement supportedLocalesOf on Intl Constructors
+        https://bugs.webkit.org/show_bug.cgi?id=147599
+
+        Reviewed by Benjamin Poulain.
+
+        Implements all of the abstract operations used by supportedLocalesOf,
+        except during canonicalization it does not replace redundant tags,
+        or subtags with their preferred values.
+
+        * icu/unicode/ucal.h: Added.
+        * icu/unicode/udat.h: Added.
+        * icu/unicode/umisc.h: Added.
+        * icu/unicode/unum.h: Added.
+        * icu/unicode/utypes.h: Clear the U_SHOW_CPLUSPLUS_API flag to prevent C++ headers from being included.
+        * runtime/CommonIdentifiers.h: Adde localeMatcher.
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf): Implemented.
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf): Implemented.
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf): Implemented.
+        * runtime/IntlObject.cpp:
+        (JSC::canonicalizeLanguageTag):
+        (JSC::getCanonicalLangTag):
+        (JSC::getPrivateUseLangTag):
+        (JSC::getGrandfatheredLangTag):
+        (JSC::canonicalizeLocaleList):
+        (JSC::bestAvailableLocale):
+        (JSC::lookupSupportedLocales):
+        (JSC::bestFitSupportedLocales):
+        (JSC::supportedLocales):
+        (JSC::getIntlStringOption):
+        (JSC::getIntlBooleanOption):
+        * runtime/IntlObject.h:
+        * runtime/JSCJSValue.h: Added toLength.
+        * runtime/JSCJSValue.cpp: Added toLength.
+        (JSC::JSValue::toLength): Implement ToLength from ECMA 262 6.0 7.1.15
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::intlCollatorAvailableLocales): Added lazy locale list.
+        (JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales): Added lazy locale list.
+        (JSC::JSGlobalObject::intlNumberFormatAvailableLocales): Added lazy locale list.
+        * runtime/JSGlobalObject.h:
+
+2015-09-14  Saam barati  <sbarati@apple.com>
+
+        rename callFrameForThrow to callFrameForCatch
+        https://bugs.webkit.org/show_bug.cgi?id=149136
+
+        Reviewed by Michael Saboff.
+
+        We use "callFrameForThrow" to mean the call frame in
+        which we're catching the exception. The field name
+        should accurately represent its purpose by being
+        named "callFrameForCatch".
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOperations.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/VM.h:
+        (JSC::VM::exceptionOffset):
+        (JSC::VM::callFrameForCatchOffset):
+        (JSC::VM::targetMachinePCForThrowOffset):
+        (JSC::VM::callFrameForThrowOffset): Deleted.
+
+2015-09-14  Basile Clement  <basile_clement@apple.com>
+
+        [ES6] Implement tail calls in the LLInt and Baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=148661
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces two new opcodes, op_tail_call and
+        op_tail_call_varargs, to perform tail calls, and implements them in the
+        LLInt and baseline JIT. Their use prevents DFG and FTL compilation for
+        now. They are currently implemented by sliding the call frame and
+        masquerading as our own caller right before performing an actual call.
+
+        This required to change the operationLink family of operation to return
+        a SlowPathReturnType instead of a char* in order to distinguish between
+        exception cases and actual call cases. We introduce a new FrameAction
+        enum that indicates whether to reuse (non-exceptional tail call) or
+        keep the current call frame (non-tail call, and exceptional cases).
+
+        This is also a semantics change, since the Function.caller property is
+        now leaking tail calls. Since tail calls are only used in strict mode,
+        which poisons this property, the only way of seeing this semantics
+        change is when a sloppy function calls a strict function that then
+        tail-calls a sloppy function. Previously, the second sloppy function's
+        caller would have been the strict function (i.e. raises a TypeError
+        when the .caller attribute is accessed), while it is now the first
+        sloppy function. Tests have been updated to reflect that.
+
+        This also changes the assumptions we make about call frames. In order
+        to be relatively efficient, we want to be able to compute the frame
+        size based only on the argument count, which was not possible
+        previously. To enable this, we now enforce at the bytecode generator,
+        DFG and FTL level that any space reserved for a call frame is
+        stack-aligned, which allows to easily compute its size when performing
+        a tail call. In all the "special call cases" (calls from native code,
+        inlined cache calls, etc.), we are starting the frame at the current
+        stack pointer and thus will always have a stack-aligned frame size.
+
+        Finally, this patch adds a couple of tests to check that tail calls run
+        in constant stack space, as well as tests checking that tail calls are
+        recognized correctly. Those tests use the handy aforementioned leaking
+        of tail calls through Function.caller to detect tail calls. 
+
+        Given that this patch only implements tail calls for the LLInt and
+        Baseline JIT, tail calls are disabled by default.  Until changes are
+        landed for all tiers, tail call testing and use requires the
+        --enableTailCalls=true or equivalent.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbortReason.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::repatchNearCall):
+        (JSC::AbstractMacroAssembler::repatchCompact):
+        * assembler/CodeLocation.h:
+        (JSC::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::CodeLocationNearCall::callMode):
+        (JSC::CodeLocationCommon::callAtOffset):
+        (JSC::CodeLocationCommon::nearCallAtOffset):
+        (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::locationOfNearCall):
+        (JSC::LinkBuffer::locationOf):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::nearTailCall):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::linkCall):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::nearCall):
+        (JSC::MacroAssemblerARM64::nearTailCall):
+        (JSC::MacroAssemblerARM64::ret):
+        (JSC::MacroAssemblerARM64::linkCall):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::nearTailCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::linkCall):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::nearCall):
+        (JSC::MacroAssemblerMIPS::nearTailCall):
+        (JSC::MacroAssemblerMIPS::call):
+        (JSC::MacroAssemblerMIPS::linkCall):
+        (JSC::MacroAssemblerMIPS::repatchCall):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::call):
+        (JSC::MacroAssemblerSH4::nearTailCall):
+        (JSC::MacroAssemblerSH4::nearCall):
+        (JSC::MacroAssemblerSH4::linkCall):
+        (JSC::MacroAssemblerSH4::repatchCall):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::linkCall):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::breakpoint):
+        (JSC::MacroAssemblerX86Common::nearTailCall):
+        (JSC::MacroAssemblerX86Common::nearCall):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::linkCall):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::callTypeFor):
+        (JSC::CallLinkInfo::isVarargsCallType):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::specializationKind):
+        (JSC::CallLinkInfo::callModeFor):
+        (JSC::CallLinkInfo::callMode):
+        (JSC::CallLinkInfo::isTailCall):
+        (JSC::CallLinkInfo::isVarargs):
+        (JSC::CallLinkInfo::registerPreservationMode):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromLLInt):
+        * bytecode/CallMode.cpp: Added.
+        (WTF::printInternal):
+        * bytecode/CallMode.h: Added.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCallInTailPosition):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        (JSC::LabelNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isCallBytecode):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        (JSC::CCallHelpers::prepareForTailCallSlow):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_tail_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_tail_call_varargs):
+        (JSC::JIT::emit_op_construct_varargs):
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_tail_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_tail_call_varargs):
+        (JSC::JIT::emitSlow_op_construct_varargs):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitSlow_op_call):
+        (JSC::JIT::emitSlow_op_tail_call):
+        (JSC::JIT::emitSlow_op_call_eval):
+        (JSC::JIT::emitSlow_op_call_varargs):
+        (JSC::JIT::emitSlow_op_tail_call_varargs):
+        (JSC::JIT::emitSlow_op_construct_varargs):
+        (JSC::JIT::emit_op_call):
+        (JSC::JIT::emit_op_tail_call):
+        (JSC::JIT::emit_op_call_eval):
+        (JSC::JIT::emit_op_call_varargs):
+        (JSC::JIT::emit_op_tail_call_varargs):
+        (JSC::JIT::emit_op_construct_varargs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitNakedTailCall):
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/Repatch.cpp:
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::slowPathFor):
+        (JSC::linkCallThunkGenerator):
+        (JSC::virtualThunkFor):
+        (JSC::arityFixupGenerator):
+        (JSC::unreachableGenerator):
+        (JSC::baselineGetterReturnThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/Options.h:
+        * tests/stress/mutual-tail-call-no-stack-overflow.js: Added.
+        (shouldThrow):
+        (sloppyCountdown.even):
+        (sloppyCountdown.odd):
+        (strictCountdown.even):
+        (strictCountdown.odd):
+        (strictCountdown):
+        (odd):
+        (even):
+        * tests/stress/tail-call-no-stack-overflow.js: Added.
+        (shouldThrow):
+        (strictLoop):
+        (strictLoopArityFixup1):
+        (strictLoopArityFixup2):
+        * tests/stress/tail-call-recognize.js: Added.
+        (callerMustBeRun):
+        (callerMustBeStrict):
+        (runTests):
+        * tests/stress/tail-call-varargs-no-stack-overflow.js: Added.
+        (shouldThrow):
+        (strictLoop):
+        * tests/stress/tail-calls-dont-overwrite-live-stack.js: Added.
+        (tail):
+        (obj.method):
+        (obj.get fromNative):
+        (getThis):
+
+2015-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt get/put inline caches shouldn't use tons of opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=149106
+
+        Reviewed by Geoffrey Garen.
+
+        Our LLInt get/put inline caches currently use separate opcodes to reduce branching. For
+        example, instead of having get_by_id branch on the kind of offset (inline or
+        out-of-line), we have two get_by_id instructions: get_by_id and get_by_id_out_of_line.
+        But the problem with this approach is that it doesn't scale. In the property type
+        inference work (https://bugs.webkit.org/show_bug.cgi?id=148610), we need each kind of put
+        inline cache to support 11 different kinds of type checks. It seemed ridiculous to add 60
+        new put_by_id opcodes (there are currently 6 variants of put_by_id, so after adding type
+        checks, we'd have 6 * 11 = 66 variants of put_by_id).
+
+        So, this patch completely changes the strategy to mostly using branching inside the
+        opcode implementation. It's unlikely to have a performance effect. For example, the long
+        road to generational GC caused a seemingly prohibitive regression in LLInt inline caches,
+        and yet nobody noticed. The regression was because the inline cache was in terms of the
+        structure, not the structure ID, so the code was doing a structure ID table lookup. If we
+        didn't notice that, then we probably won't notice a couple new branches. (Also, this
+        patch fixes that regression - the code no longer does such lookups except in the one
+        unavoidable case in put_by_id transition chain checking.)
+
+        This patch also turns the isDirect operand of put_by_id into a flags field. I will use
+        this flags field to encode the desired type check in bug 148610.
+
+        This patch has no effect on performance according to run-jsc-benchmarks.
+
+        Relanding this patch with LLInt fixes for non-x86. Previous attempts to fix non-x86 LLInt
+        build also caused every 64-bit test to crash on every platform. So the patch got rolled
+        out. This fixes the non-x86 LLInt build while also ensuring that 64-bit platforms don't
+        crash.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printPutByIdCacheStatus):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::finalizeLLIntInlineCaches):
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/PutByIdFlags.cpp: Added.
+        (WTF::printInternal):
+        * bytecode/PutByIdFlags.h: Added.
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedInstruction::UnlinkedInstruction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2015-09-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189751, r189752, and r189754.
+        https://bugs.webkit.org/show_bug.cgi?id=149143
+
+        caused crashes everywhere (Requested by alexchristensen on
+        #webkit).
+
+        Reverted changesets:
+
+        "LLInt get/put inline caches shouldn't use tons of opcodes"
+        https://bugs.webkit.org/show_bug.cgi?id=149106
+        http://trac.webkit.org/changeset/189751
+
+        "Unreviewed, fix non-x86 LLInt build."
+        http://trac.webkit.org/changeset/189752
+
+        "Unreviewed, really fix non-x86 LLInt build without also
+        breaking everything else."
+        http://trac.webkit.org/changeset/189754
+
+2015-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, really fix non-x86 LLInt build without also breaking everything else.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2015-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix non-x86 LLInt build.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2015-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt get/put inline caches shouldn't use tons of opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=149106
+
+        Reviewed by Geoffrey Garen.
+
+        Our LLInt get/put inline caches currently use separate opcodes to reduce branching. For
+        example, instead of having get_by_id branch on the kind of offset (inline or
+        out-of-line), we have two get_by_id instructions: get_by_id and get_by_id_out_of_line.
+        But the problem with this approach is that it doesn't scale. In the property type
+        inference work (https://bugs.webkit.org/show_bug.cgi?id=148610), we need each kind of put
+        inline cache to support 11 different kinds of type checks. It seemed ridiculous to add 60
+        new put_by_id opcodes (there are currently 6 variants of put_by_id, so after adding type
+        checks, we'd have 6 * 11 = 66 variants of put_by_id).
+
+        So, this patch completely changes the strategy to mostly using branching inside the
+        opcode implementation. It's unlikely to have a performance effect. For example, the long
+        road to generational GC caused a seemingly prohibitive regression in LLInt inline caches,
+        and yet nobody noticed. The regression was because the inline cache was in terms of the
+        structure, not the structure ID, so the code was doing a structure ID table lookup. If we
+        didn't notice that, then we probably won't notice a couple new branches. (Also, this
+        patch fixes that regression - the code no longer does such lookups except in the one
+        unavoidable case in put_by_id transition chain checking.)
+
+        This patch also turns the isDirect operand of put_by_id into a flags field. I will use
+        this flags field to encode the desired type check in bug 148610.
+
+        This patch has no effect on performance according to run-jsc-benchmarks.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printPutByIdCacheStatus):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::finalizeLLIntInlineCaches):
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/PutByIdFlags.cpp: Added.
+        (WTF::printInternal):
+        * bytecode/PutByIdFlags.h: Added.
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedInstruction::UnlinkedInstruction):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_by_id):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2015-09-14  Alex Christensen  <achristensen@webkit.org>
+
+        Progress towards CMake on Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=149123
+
+        Reviewed by Chris Dumez.
+
+        * CMakeLists.txt:
+        Make forwarding headers for the replay subdirectory.
+        * PlatformMac.cmake:
+        Make forwarding headers for the generated inspector headers. 
+        They should eventually either be packaged correctly with JavaScriptCore headers and included correctly.
+
+2015-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Cache the resolution result in JSModuleRecord
+        https://bugs.webkit.org/show_bug.cgi?id=148896
+
+        Reviewed by Saam Barati.
+
+        The resolveExport operation is frequently called. For example,
+        1. When instantiating the module environment, we call it for each exported name and imported
+           name.
+        2. When linking the imported module environment to the code block, we call it to resolve the
+           resolution.
+        3. When looking up the property from the namespace object, we call it to look up the original
+           module for the imported binding.
+        4. When creating the namespace object, we need to collect all the exported names from the module
+           and need to resolve them by calling resolveExport.
+
+        However, resolveExport takes some cost. It traces the imported modules and resolves the reference
+        queried by the original module.
+
+        The resolveExport operation is pure function; given a module record and an export name,
+        it always returns the same result. So we cache resolution results in the module record to avoid
+        repeated resolveExport calls with the same arguments.
+        Here, we only cache the correctly resolved references, since,
+        1. We rarely looked up the non-correctly-resolved ones. In the linking phase, attempting to
+           resolve non-correctly-resolved ones throws a syntax error. So only namespace object creation
+           phase does it in a syntax valid script.
+        2. This strategy limits the size of the cache map. The number of the correctly exported bindings
+           is defined by the modules' code. So the size does not become infinitely large.
+
+        Currently, the all modules cannot be linked twice. For example,
+
+          graph 1
+
+          -> (A) -> (B)
+
+          graph 2
+
+          -> (C) -> (A) -> (B)
+
+        We cannot test the behavior now because when executing the graph 2, (A) and (B) are already linked,
+        it raises an error in the current loader spec. But it should be allowed[1] since it will occur when
+        there is multiple module tag in WebCore.
+
+        [1]: https://github.com/whatwg/loader/issues/41
+
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::ResolveQuery::Hash::hash):
+        (JSC::JSModuleRecord::ResolveQuery::Hash::equal):
+        (JSC::JSModuleRecord::cacheResolution):
+        (JSC::ResolveQueryHash::hash): Deleted.
+        (JSC::ResolveQueryHash::equal): Deleted.
+        (JSC::resolveExportLoop): Deleted.
+        * runtime/JSModuleRecord.h:
+        * tests/modules/caching-should-not-make-ambiguous.js: Added.
+        * tests/modules/caching-should-not-make-ambiguous/A.js: Added.
+        * tests/modules/caching-should-not-make-ambiguous/B.js: Added.
+        * tests/modules/caching-should-not-make-ambiguous/C.js: Added.
+        * tests/modules/caching-should-not-make-ambiguous/D.js: Added.
+        * tests/modules/caching-should-not-make-ambiguous/main.js: Added.
+        * tests/modules/different-view.js: Added.
+        (from.string_appeared_here.shouldThrow):
+        * tests/modules/different-view/A.js: Added.
+        * tests/modules/different-view/B.js: Added.
+        * tests/modules/different-view/C.js: Added.
+        * tests/modules/different-view/D.js: Added.
+        * tests/modules/different-view/E.js: Added.
+        * tests/modules/different-view/main.js: Added.
+        * tests/modules/fallback-ambiguous.js: Added.
+        (from.string_appeared_here.shouldThrow):
+        * tests/modules/fallback-ambiguous/A.js: Added.
+        * tests/modules/fallback-ambiguous/B.js: Added.
+        * tests/modules/fallback-ambiguous/C.js: Added.
+        * tests/modules/fallback-ambiguous/D.js: Added.
+        * tests/modules/fallback-ambiguous/E.js: Added.
+        * tests/modules/fallback-ambiguous/main.js: Added.
+        * tests/modules/self-star-link.js: Added.
+        * tests/modules/self-star-link/A.js: Added.
+        * tests/modules/self-star-link/B.js: Added.
+        * tests/modules/self-star-link/C.js: Added.
+        * tests/modules/self-star-link/D.js: Added.
+        * tests/modules/self-star-link/E.js: Added.
+        * tests/modules/uncacheable-when-see-star.js: Added.
+        * tests/modules/uncacheable-when-see-star/A-pre.js: Added.
+        * tests/modules/uncacheable-when-see-star/A.js: Added.
+        * tests/modules/uncacheable-when-see-star/B.js: Added.
+        * tests/modules/uncacheable-when-see-star/C.js: Added.
+        * tests/modules/uncacheable-when-see-star/D.js: Added.
+        * tests/modules/uncacheable-when-see-star/E-pre.js: Added.
+        * tests/modules/uncacheable-when-see-star/E.js: Added.
+        * tests/modules/uncacheable-when-see-star/main1.js: Added.
+        * tests/modules/uncacheable-when-see-star/main2.js: Added.
+
+2015-09-14  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the arithmetic instructions for floats in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149102
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements the arithmetic instructions for floats (float32)
+        in WebAssembly by converting the float operands to doubles, performing
+        the equivalent double instructions, and converting the result back to
+        float. The asm.js spec says that "As proved in 'When is double rounding
+        innocuous?' (Figueroa 1995), both the 32- and 64-bit versions of
+        standard arithmetic operations produce equivalent results when given
+        32-bit inputs and coerced to 32-bit outputs."
+        (http://asmjs.org/spec/latest/#floatish)
+
+        This patch also pads WebAssembly call frames by maxFrameExtentForSlowPathCall,
+        so that there is no need to adjust the stack pointer every time we make
+        a slow path call.
+
+        * tests/stress/wasm-arithmetic-float32.js:
+        * tests/stress/wasm/arithmetic-float32.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+        (JSC::WASMFunctionCompiler::buildUnaryF32):
+        (JSC::WASMFunctionCompiler::buildBinaryF32):
+        (JSC::WASMFunctionCompiler::callOperation):
+        (JSC::WASMFunctionCompiler::callAndUnboxResult):
+        (JSC::WASMFunctionCompiler::endFunction): Deleted.
+        (JSC::WASMFunctionCompiler::buildBinaryI32): Deleted.
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseUnaryExpressionF32):
+        (JSC::WASMFunctionParser::parseBinaryExpressionF32):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildUnaryF32):
+        (JSC::WASMFunctionSyntaxChecker::buildBinaryF32):
+
+2015-09-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Eden GC should not try to jettison old CodeBlocks in the remembered set
+        https://bugs.webkit.org/show_bug.cgi?id=149108
+
+        Reviewed by Saam Barati.
+
+        All we know about objects in the remembered set is that they must be
+        visited. We don't know whether they're referenced or not because we
+        won't mark the objects that point to them.
+
+        Therefore, it's incorrect for a CodeBlock to consider jettisoning
+        itself when it's marked as a part of the remembered set: Some
+        old object might have visited the CodeBlock strongly if given the chance.
+
+        I believe this doesn't cause any problems currently because we happen
+        to visit all strong references to all CodeBlocks elligible for jettison
+        during every GC.
+
+        However, this behavior is a logical oddity that tripped me up, and I
+        believe it will start causing real problems once we start to jettison
+        baseline CodeBlocks, since we do not visit all strong references to all
+        baseline CodeBlocks during every GC.
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::clearMarksForEdenCollection):
+        (JSC::CodeBlockSet::traceMarked): Be sure to visit the remembered set
+        strongly, in order to prohibit jettisoning.
+
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        * heap/CodeBlockSet.h: Track the remembered set during eden GCs.
+
+2015-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r189585): run-perf-tests Speedometer fails with a console error
+        https://bugs.webkit.org/show_bug.cgi?id=149066
+
+        Reviewed by Michael Saboff.
+
+        The bug here was that the new IC code was calling actionForCell() more than once. That's
+        illegal, since when actionForCell() returns RetryCacheLater, it means that it changed some
+        object's Structure. The Repatch code was doing things like "if (actionForCell(blah) ==
+        AttemptToCache)" in more than one place, so that if the first such expression was false, then
+        we'd fall through to the next one. It's possible for the first call to return RetryCacheLater,
+        in which case our view of the world just got clobbered and we need to return, and then the
+        second call will probably return AttemptToCache because it *thinks* that we had bailed the last
+        time and we're now in a future IC invocation.
+
+        The solution is to cache the actionForCell() result. This is a bit tricky, because we need to
+        do this after we check if we're in a proxy.
+
+        Debugging bugs like these requires adding ad hoc bisection code in various places. We already
+        had the basic hooks for this. This patch makes those hooks a bit more useful. In the case of
+        the LLInt->JIT tier-up hooks, it adds a CodeBlock* argument so that we can bisect based on the
+        CodeBlock. In the case of Repatch, it puts the Options::forceICFailure() check in a helper
+        function that also takes ExecState*, which allows us to bisect on either CodeBlock or
+        CodeOrigin.
+
+        * jit/Repatch.cpp:
+        (JSC::actionForCell):
+        (JSC::forceICFailure):
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::shouldJIT):
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * tests/stress/retry-cache-later.js:
+
+2015-09-11  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the relational instructions for floats in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149080
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements the relational instructions for floats (float32)
+        in WebAssembly by converting float operands to doubles and then
+        comparing them using the existing double comparison instructions in the
+        macro assembler.
+
+        * tests/stress/wasm-relational.js:
+        * tests/stress/wasm/relational.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildRelationalF32):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseRelationalF32ExpressionI32):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildRelationalF32):
+
+2015-09-11  Nan Wang  <n_wang@apple.com>
+
+        AX: ARIA 1.1 @aria-current
+        https://bugs.webkit.org/show_bug.cgi?id=146012
+
+        Reviewed by Chris Fleizach.
+
+        Updated inspector to support aria-current.
+
+        * inspector/protocol/DOM.json:
+
+2015-09-11  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Add initial support for floats in WebAsssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149062
+
+        Reviewed by Geoffrey Garen.
+
+        Implement the ConstantPoolIndex, Immediate, GetLocal, and GetGlobal
+        instructions for floats (float32) in WebAssembly.
+
+        * tests/stress/wasm-arithmetic-float32.js: Added.
+        (shouldBe):
+        * tests/stress/wasm-globals.js:
+        * tests/stress/wasm-type-conversion.js:
+        * tests/stress/wasm/arithmetic-float32.wasm: Added.
+        * tests/stress/wasm/globals.wasm:
+        * tests/stress/wasm/type-conversion.wasm:
+        * wasm/WASMConstants.h:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildSetLocal):
+        (JSC::WASMFunctionCompiler::buildReturn):
+        (JSC::WASMFunctionCompiler::buildImmediateF32):
+        (JSC::WASMFunctionCompiler::buildGetLocal):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpression):
+        (JSC::WASMFunctionParser::parseExpressionF32):
+        (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionF32):
+        (JSC::WASMFunctionParser::parseImmediateExpressionF32):
+        (JSC::WASMFunctionParser::parseGetLocalExpressionF32):
+        (JSC::WASMFunctionParser::parseGetGlobalExpressionF32):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildImmediateF32):
+        * wasm/WASMReader.cpp:
+        (JSC::WASMReader::readOpExpressionF32):
+        * wasm/WASMReader.h:
+
+2015-09-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the CLOOP build.
+
+        Unreviewed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeBaselineJITInlineCaches):
+        (JSC::CodeBlock::finalizeUnconditionally):
+
+2015-09-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [EFL] Fix WASM build
+        https://bugs.webkit.org/show_bug.cgi?id=149065
+
+        Reviewed by Darin Adler.
+
+        * wasm/WASMFunctionParser.cpp:
+
+2015-09-11  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptCore should discard optimized code after some time
+        https://bugs.webkit.org/show_bug.cgi?id=149048
+
+        Reviewed by Michael Saboff.
+
+        This patch adds a new jettison type -- JettisonDueToOldAge -- and starts
+        using it for DFG and FTL code. Baseline and LLInt code will come in a
+        follow-up patch.
+
+        The primary goal is to save memory. Some popular websites leave about 10MB
+        of dead code sitting around immediately after they finish loading.
+
+        Throwing away code periodically might also save us from profiling
+        pathologies that lead to performance dead ends.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate): Updated for rename, and removed a
+        stale comment.
+
+        (JSC::CodeBlock::shouldVisitStrongly): Renamed to shouldVisitStrongly
+        because the practical effect of this function is to trigger a call to
+        visitStrongly.
+
+        (JSC::CodeBlock::isKnownToBeLiveDuringGC): Check the
+        m_visitStronglyHasBeenCalled flag instead of
+        shouldImmediatelyAssumeLivenessDuringScan / shouldVisitStrongly because
+        m_visitStronglyHasBeenCalled can be set by anybody even if the CodeBlock
+        would not otherwise visit itself strongly.
+
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference): New helper function
+        for readability.
+
+        (JSC::CodeBlock::shouldJettisonDueToOldAge): New helper function that
+        tells if a CodeBlock is old enough for deletion.
+
+        (JSC::CodeBlock::determineLiveness): There's no need to check
+        shouldImmediatelyAssumeLivenessDuringScan here because we will not call
+        this function if shouldImmediatelyAssumeLivenessDuringScan is true.
+        Also, it's just not clear -- if someone chooses to call this function --
+        that it would be safe to ignore them simply because
+        shouldImmediatelyAssumeLivenessDuringScan was true.
+
+        (JSC::CodeBlock::finalizeLLIntInlineCaches): Moved code out into a helper
+        function to make the main function more readable.
+
+        (JSC::CodeBlock::finalizeBaselineJITInlineCaches): Ditto.
+
+        (JSC::CodeBlock::finalizeUnconditionally): Added code for jettisoning a
+        CodeBlock if it is too old. Moved large sections of code into helper
+        functions to aid readability in this function.
+
+        (JSC::CodeBlock::jettison): Account for the fact that we might jettison
+        a CodeBlock without OSR exit and without requiring a stack shoot-down.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setInstallTime):
+        (JSC::CodeBlock::timeSinceInstall): Track CodeBlock age to help us
+        decide when to delete.
+
+        * jit/JITCode.h:
+        (JSC::JITCode::timeToLive): Static limits on CodeBlock lifetime. I got
+        these numbers from the place where numbers come from. 
+
+        * profiler/ProfilerJettisonReason.cpp:
+        (WTF::printInternal):
+        * profiler/ProfilerJettisonReason.h: Updated for new jettison type.
+
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode): Record install time so that we
+        can measure how old a CodeBlock is.
+
+2015-09-11  Andreas Kling  <akling@apple.com>
+
+        [JSC] Weak should only accept cell pointees.
+        <https://webkit.org/b/148955>
+
+        Reviewed by Geoffrey Garen.
+
+        Since WeakImpls only support pointing to JSCell derived objects,
+        enforce that at compile time by having the API use JSCell* instead of JSValue.
+
+        WeakHandleOwner callbacks now get JSCell& and JSCell*& respectively instead
+        of wrapping the cell pointer in a Handle<Unknown>.
+
+        Also added a static_assert so Weak<T> can't be instantiated with a T that's
+        not convertible to JSCell.
+
+        * API/JSAPIWrapperObject.mm:
+        (JSAPIWrapperObjectHandleOwner::finalize):
+        (JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
+        (JSC::JSAPIWrapperObject::finishCreation):
+        * API/JSManagedValue.mm:
+        (JSManagedValueHandleOwner::isReachableFromOpaqueRoots):
+        (JSManagedValueHandleOwner::finalize):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::finalize):
+        * builtins/BuiltinExecutables.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::addFinalizer):
+        (JSC::Heap::FinalizerOwner::finalize):
+        * heap/Heap.h:
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::visit):
+        (JSC::WeakBlock::reap):
+        * heap/WeakHandleOwner.cpp:
+        (JSC::WeakHandleOwner::isReachableFromOpaqueRoots):
+        (JSC::WeakHandleOwner::finalize):
+        * heap/WeakHandleOwner.h:
+        * heap/WeakImpl.h:
+        (JSC::WeakImpl::WeakImpl):
+        (JSC::WeakImpl::state):
+        (JSC::WeakImpl::cell):
+        (JSC::WeakImpl::asWeakImpl):
+        (JSC::WeakImpl::jsValue): Deleted.
+        * heap/WeakInlines.h:
+        (JSC::Weak<T>::Weak):
+        (JSC::>):
+        (JSC::Weak<T>::operator):
+        (JSC::Weak<T>::get):
+        (JSC::Weak<T>::was):
+        * heap/WeakSet.h:
+        * heap/WeakSetInlines.h:
+        (JSC::WeakSet::allocate):
+        (JSC::WeakBlock::finalize):
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::finalize):
+        * jit/JITThunks.h:
+        * jsc.cpp:
+        (WTF::ElementHandleOwner::isReachableFromOpaqueRoots): Deleted.
+        * runtime/JSCell.h:
+        (JSC::jsCast):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::finalize):
+        * runtime/RegExpCache.h:
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+
+2015-09-10  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement switch statements in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149051
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements switch statements in WebAssembly using the
+        JSC::BinarySwitch class.
+
+        * tests/stress/wasm-control-flow.js:
+        * tests/stress/wasm/control-flow.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildSwitch):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseSwitchStatement):
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildSwitch):
+
+2015-09-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure should be able to tell you if it had ever been a dictionary
+        https://bugs.webkit.org/show_bug.cgi?id=149047
+
+        Reviewed by Mark Lam.
+
+        Introduces the hasBeenDictionary flag to Structure, which tells you if this structure or
+        any of its ancestors is a dictionary. We already implicitly tracked this for DFG
+        watchpoint optimizations, so this is mainly just decoupling that existing logic from
+        watchpoints. Having Structure::hasBeenDictionary() enables some of the heuristics in the
+        property type inference work (https://bugs.webkit.org/show_bug.cgi?id=148610).
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::dump):
+        * runtime/Structure.h:
+
+2015-09-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, fix Windows file loading in JSC shell after r189583
+        https://bugs.webkit.org/show_bug.cgi?id=148917
+
+        Should load the script files with the binary mode.
+        Since these loading functions are only used for the simple test scripts,
+        we just use ftell / fseek now.
+
+        * jsc.cpp:
+        (fillBufferWithContentsOfFile):
+
+2015-09-10  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r189575): Appears to break ARM64 linux builds
+        https://bugs.webkit.org/show_bug.cgi?id=149044
+
+        Reviewed by Filip Pizlo.
+
+        Changed the use of the ARM64 "fp", a register alias, to be "x29", the real register name.
+
+        * llint/LowLevelInterpreter.asm:
+
+2015-09-09  Filip Pizlo  <fpizlo@apple.com>
+
+        There should be one stub hanging off an inline cache that contains code for all of the cases, rather than forming a linked list consisting of one stub per case
+        https://bugs.webkit.org/show_bug.cgi?id=148717
+
+        Reviewed by Michael Saboff.
+
+        This is a major rewrite of the JSC get/put/in inline caches (ICs), motivated by the need to add
+        fancy new kinds of inline caches for property type inference (https://webkit.org/b/148610).
+
+        Previously, our inline caches had some problems that made them difficult to work with. It was
+        impossible to change any code that was previously generated by the IC except by blowing the
+        whole IC away, the ICs scaled poorly if there were many cases, and there was a lot of duplicate
+        and ad hoc code.
+
+        Impossible to regenerate a previously generated stub: Say that some access (o.f = v) causes our
+        IC code to emit some stub; let's call it stub1. Then later we find that we need to emit a
+        different stub, stub2, where we think that stub2 might subsume stub1. We say that stub2
+        subsumes stub1 if failing to execute stub2 to completion means that we are guaranteed to fail
+        to execute stub1 to completion. This could happen in trunk if stub2 has the same base structure
+        as stub1 but different prototype conditions. It could happen with property type inference if
+        stub2 has a looser type check on v than stub1 did. Currently, if this happened, we would emit
+        stub2 and have its slow path jump to stub1. Hence, we would still end up executing the checks
+        of stub1 before falling through to the slow path. This gets bad when there are many stubs.
+        Stub1 might be in front of a bunch of other stubs, so when we add stub2, we will end up
+        executing both stub2's and stub1's checks before falling through to the other stubs. It would
+        be better if we could remove stub1 from the list at this point. But since stub1 could be linked
+        to from a different stub that we had already generated, we'd have to have a way of patching
+        stubs or regenerating them from scratch. This is currenty impossible because we just don't keep
+        around enough meta-data to mess with a stub after it's generated. After this change, we never
+        link new stubs onto a linked list of pre-existing stubs; instead each IC will have one stub
+        hanging off of it and we always regenerate that one stub from scratch. That one stub contains
+        either a BinarySwitch or a branch cascade to select one of the AccessCases. Each AccessCase is
+        an object that describes everything we need to regenerate it in the future. This means that
+        when we add a new case to an IC stub, we can figure out which previous cases this one subsumes.
+
+        Poor scalability when there are many cases: Previously, the cases of a polymorphic inline cache
+        formed a linked list of branches. This meant that the complexity of an inline cache grew
+        linearly with the number of cases. This change turns this into a BinarySwitch in most cases,
+        leading to logarithmic scaling.
+
+        Duplicate code between get, put, and in: The code for op_get_by_id, op_put_by_id, and op_in
+        inline caches grew independently and ended up having a lot of duplicate code. We had the worst
+        kinds of duplicate code. In some cases, the code was copy-pasted. In other cases, we wrote code
+        that felt like it was new despite the fact that it was logically identical to code that was
+        already written elsewhere. The main sources of duplication were in selecting a scratch
+        register, checking all of the ObjectPropertyConditions and the base structure, the pro forma
+        involved in generating a stub, and the data structures needed to describe all of the access
+        cases. This change deduplicates all of that code. Now, all of those ICs use the same classes:
+        the PolymorphicAccess and AccessCase. There is code in those classes that handles all of the
+        common things, and for the most part the only code that actually specializes for the kind of
+        access is in some switch statement in AccessCase::generate().
+
+        Special-casing of array length and string length: Previously, array.length and string.length
+        were handled in an ad hoc manner in the get_by_id repatching code. The handling was separate
+        from the polymorphic get_by_id handling, which meant that we could not handle polymorphic
+        length accesses if one of the length cases was either array or string length. For example, if
+        you had "o.length" where the length was either array length or a vanilla length property, then
+        the get_by_id inline cache would either emit a monomorphic stub for array length, or a
+        monomorphic stub for the vanilla length property, but never a polymorphic stub (or list) that
+        could do both. This change addresses this problem by folding array length and string length
+        into the polymorphic get_by_id code.
+
+        This was meant to be a perf-neutral change to enable property type inference, but it ended up
+        being a 1% Octane speed-up, mainly because of a 14% speed-up in raytrace. This isn't too
+        surprising, since that test does use inline caches a lot and this change makes inline caches
+        more scalable.
+
+        This also fixes and adds a test for a BinarySwitch bug. BinarySwitch had an optimization for
+        consecutive integer cases. Using it on typed array structures triggers this bug. It's a hard
+        bug to trigger any other way because our other switch optimizations will usually use a jump
+        table in case of consecutive integers.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::dumpWithName):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printPutByIdCacheStatus):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::getByValInfoMap):
+        (JSC::CodeBlock::addStubInfo):
+        (JSC::CodeBlock::findStubInfo):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::stubInfoBegin):
+        (JSC::CodeBlock::stubInfoEnd):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/PolymorphicAccess.cpp: Copied from Source/JavaScriptCore/bytecode/PolymorphicGetByIdList.cpp.
+        (JSC::AccessGenerationState::addWatchpoint):
+        (JSC::AccessGenerationState::restoreScratch):
+        (JSC::AccessGenerationState::succeed):
+        (JSC::AccessCase::AccessCase):
+        (JSC::AccessCase::get):
+        (JSC::AccessCase::replace):
+        (JSC::AccessCase::transition):
+        (JSC::AccessCase::setter):
+        (JSC::AccessCase::in):
+        (JSC::AccessCase::getLength):
+        (JSC::AccessCase::~AccessCase):
+        (JSC::AccessCase::fromStructureStubInfo):
+        (JSC::AccessCase::clone):
+        (JSC::AccessCase::guardedByStructureCheck):
+        (JSC::AccessCase::alternateBase):
+        (JSC::AccessCase::canReplace):
+        (JSC::AccessCase::dump):
+        (JSC::AccessCase::visitWeak):
+        (JSC::AccessCase::generateWithGuard):
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::PolymorphicAccess):
+        (JSC::PolymorphicAccess::~PolymorphicAccess):
+        (JSC::PolymorphicAccess::regenerateWithCases):
+        (JSC::PolymorphicAccess::regenerateWithCase):
+        (JSC::PolymorphicAccess::visitWeak):
+        (JSC::PolymorphicAccess::dump):
+        (JSC::PolymorphicAccess::regenerate):
+        (WTF::printInternal):
+        (JSC::GetByIdAccess::GetByIdAccess): Deleted.
+        (JSC::GetByIdAccess::~GetByIdAccess): Deleted.
+        (JSC::GetByIdAccess::fromStructureStubInfo): Deleted.
+        (JSC::GetByIdAccess::visitWeak): Deleted.
+        (JSC::PolymorphicGetByIdList::PolymorphicGetByIdList): Deleted.
+        (JSC::PolymorphicGetByIdList::from): Deleted.
+        (JSC::PolymorphicGetByIdList::~PolymorphicGetByIdList): Deleted.
+        (JSC::PolymorphicGetByIdList::currentSlowPathTarget): Deleted.
+        (JSC::PolymorphicGetByIdList::addAccess): Deleted.
+        (JSC::PolymorphicGetByIdList::isFull): Deleted.
+        (JSC::PolymorphicGetByIdList::isAlmostFull): Deleted.
+        (JSC::PolymorphicGetByIdList::didSelfPatching): Deleted.
+        (JSC::PolymorphicGetByIdList::visitWeak): Deleted.
+        * bytecode/PolymorphicAccess.h: Copied from Source/JavaScriptCore/bytecode/PolymorphicGetByIdList.h.
+        (JSC::AccessCase::isGet):
+        (JSC::AccessCase::isPut):
+        (JSC::AccessCase::isIn):
+        (JSC::AccessCase::type):
+        (JSC::AccessCase::offset):
+        (JSC::AccessCase::viaProxy):
+        (JSC::AccessCase::structure):
+        (JSC::AccessCase::newStructure):
+        (JSC::AccessCase::conditionSet):
+        (JSC::AccessCase::additionalSet):
+        (JSC::AccessCase::customSlotBase):
+        (JSC::AccessCase::doesCalls):
+        (JSC::AccessCase::callLinkInfo):
+        (JSC::AccessCase::RareData::RareData):
+        (JSC::PolymorphicAccess::isEmpty):
+        (JSC::PolymorphicAccess::size):
+        (JSC::PolymorphicAccess::at):
+        (JSC::PolymorphicAccess::operator[]):
+        (JSC::GetByIdAccess::GetByIdAccess): Deleted.
+        (JSC::GetByIdAccess::isSet): Deleted.
+        (JSC::GetByIdAccess::operator!): Deleted.
+        (JSC::GetByIdAccess::type): Deleted.
+        (JSC::GetByIdAccess::structure): Deleted.
+        (JSC::GetByIdAccess::conditionSet): Deleted.
+        (JSC::GetByIdAccess::stubRoutine): Deleted.
+        (JSC::GetByIdAccess::doesCalls): Deleted.
+        (JSC::PolymorphicGetByIdList::isEmpty): Deleted.
+        (JSC::PolymorphicGetByIdList::size): Deleted.
+        (JSC::PolymorphicGetByIdList::at): Deleted.
+        (JSC::PolymorphicGetByIdList::operator[]): Deleted.
+        * bytecode/PolymorphicAccessStructureList.h: Removed.
+        * bytecode/PolymorphicGetByIdList.cpp: Removed.
+        * bytecode/PolymorphicGetByIdList.h: Removed.
+        * bytecode/PolymorphicPutByIdList.cpp: Removed.
+        * bytecode/PolymorphicPutByIdList.h: Removed.
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::addAccessCase):
+        (JSC::StructureStubInfo::reset):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::initStub):
+        (JSC::StructureStubInfo::setSeen):
+        (JSC::getStructureStubInfoCodeOrigin):
+        (JSC::isGetByIdAccess): Deleted.
+        (JSC::isPutByIdAccess): Deleted.
+        (JSC::isInAccess): Deleted.
+        (JSC::StructureStubInfo::initGetByIdList): Deleted.
+        (JSC::StructureStubInfo::initPutByIdTransition): Deleted.
+        (JSC::StructureStubInfo::initPutByIdList): Deleted.
+        (JSC::StructureStubInfo::initInList): Deleted.
+        (JSC::StructureStubInfo::addWatchpoint): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * jit/AccessorCallJITStubRoutine.cpp: Removed.
+        * jit/AccessorCallJITStubRoutine.h: Removed.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfEmpty):
+        (JSC::AssemblyHelpers::branchStructure):
+        (JSC::AssemblyHelpers::boxBooleanPayload):
+        (JSC::AssemblyHelpers::boxBoolean):
+        (JSC::AssemblyHelpers::boxInt32):
+        * jit/BinarySwitch.cpp:
+        (JSC::BinarySwitch::BinarySwitch):
+        (JSC::BinarySwitch::build):
+        (JSC::BinarySwitch::Case::dump):
+        (JSC::BinarySwitch::BranchCode::dump):
+        * jit/BinarySwitch.h:
+        (JSC::BinarySwitch::Case::operator<):
+        (JSC::BinarySwitch::BranchCode::BranchCode):
+        * jit/JIT.h:
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::garbageStubInfo):
+        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
+        (JSC::JITInlineCacheGenerator::stubInfo):
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITByIdGenerator::reportSlowPathCall):
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::repatchCall):
+        (JSC::repatchByIdSelfAccess):
+        (JSC::resetGetByIDCheckAndLoad):
+        (JSC::resetPutByIDCheckAndLoad):
+        (JSC::replaceWithJump):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::appropriateGenericPutByIdFunction):
+        (JSC::appropriateOptimizingPutByIdFunction):
+        (JSC::tryCachePutByID):
+        (JSC::repatchPutByID):
+        (JSC::tryRepatchIn):
+        (JSC::repatchIn):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::checkObjectPropertyCondition): Deleted.
+        (JSC::checkObjectPropertyConditions): Deleted.
+        (JSC::emitRestoreScratch): Deleted.
+        (JSC::linkRestoreScratch): Deleted.
+        (JSC::toString): Deleted.
+        (JSC::kindFor): Deleted.
+        (JSC::customFor): Deleted.
+        (JSC::generateByIdStub): Deleted.
+        (JSC::patchJumpToGetByIdStub): Deleted.
+        (JSC::tryBuildGetByIDList): Deleted.
+        (JSC::buildGetByIDList): Deleted.
+        (JSC::appropriateListBuildingPutByIdFunction): Deleted.
+        (JSC::emitPutReplaceStub): Deleted.
+        (JSC::emitPutTransitionStub): Deleted.
+        (JSC::tryBuildPutByIdList): Deleted.
+        (JSC::buildPutByIdList): Deleted.
+        * jit/ScratchRegisterAllocator.cpp:
+        (JSC::ScratchRegisterAllocator::lock):
+        (JSC::ScratchRegisterAllocator::allocateScratch):
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionQuit):
+        (functionAbort):
+        (functionFalse1):
+        (functionFalse2):
+        * runtime/Options.h:
+        * tests/stress/array-message-passing.js: Added.
+        (window.addEventListener):
+        (window.postMessage):
+        (window._handleEvents):
+        (testPassed):
+        (testFailed):
+        (classCompare):
+        (bufferCompare):
+        (viewCompare):
+        (typedArrayCompare):
+        (dataViewCompare):
+        (dataViewCompare2):
+        (dataViewCompare3):
+        (createBuffer):
+        (createTypedArray):
+        (createTypedArrayOverBuffer):
+        (new.DataView):
+        (testList.testList.concat.basicBufferTypes.map):
+        (doneTest):
+
+2015-09-10  Geoffrey Garen  <ggaren@apple.com>
+
+        CodeBlock::codeType() doesn't need to compute anything
+        https://bugs.webkit.org/show_bug.cgi?id=149039
+
+        Reviewed by Michael Saboff.
+
+        CodeBlock already has an m_codeType data member.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::codeType):
+        (JSC::CodeBlock::putByIdContext):
+
+2015-09-10  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement global variables in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=149031
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements global variables in WebAssembly. There are two
+        types of global variables in the current format that we use (the format
+        used by <https://github.com/WebAssembly/polyfill-prototype-1>): internal
+        global variables and imported global variables. This patch does not yet
+        import values for imported global variables. It will be done in a
+        subsequent patch.
+
+        * tests/stress/wasm-globals.js: Added.
+        (shouldBe):
+        * tests/stress/wasm/globals.wasm: Added.
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::globalVariables):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildSetGlobal):
+        (JSC::WASMFunctionCompiler::buildGetGlobal):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseStatement):
+        (JSC::WASMFunctionParser::parseSetGlobalStatement):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseGetGlobalExpressionI32):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseGetGlobalExpressionF64):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildSetGlobal):
+        (JSC::WASMFunctionSyntaxChecker::buildGetGlobal):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::parseGlobalSection):
+
+2015-09-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Consider long module path name case in Windows
+        https://bugs.webkit.org/show_bug.cgi?id=148917
+
+        Reviewed by Alex Christensen.
+
+        The local file system module loader in the JSC shell manages the module files by the absolute path.
+        However, in Windows, _MAX_PATH is defined as 260. So if the path like the current working directory or the path to the module is long,
+        it will be truncated by the API and it fail to open the file.
+        In JSC tests in Apple Windows buildbot, since the current working directory is long enough, the tests failed.
+
+        This patch introduces the following 3 tweaks.
+
+        1. When retrieving the current working path, we use GetCurrentDirectoryW instead of _getcwd.
+           GetCurrentDirectoryW allows the long path while _getcwd automatically truncate the result by the _MAX_PATH.
+
+        2. Before opening the module file, we prepend "\\?\" to the path. It converts the local file path to the long UNC path
+           which allows longer path names.
+
+        3. Since Windows ASCII API accepts the characters in the current code page, we use the Unicode APIs like _wfopen instead.
+
+        And enable the once disabled module tests in Windows.
+
+        Since this functionality is the part of the JSC shell to run the module tests, it is now implemented in jsc.cpp.
+
+        * jsc.cpp:
+        (stringFromUTF):
+        (jscSource):
+        (extractDirectoryName):
+        (currentWorkingDirectory):
+        (convertShebangToJSComment):
+        (fillBufferWithContentsOfFile):
+        (fetchScriptFromLocalFileSystem):
+        (fetchModuleFromLocalFileSystem):
+        (GlobalObject::moduleLoaderFetch):
+        (functionRun):
+        (functionLoad):
+        (functionReadFile):
+        (functionCheckSyntax):
+        (functionLoadModule):
+        (runWithScripts):
+        (runInteractive):
+        * tests/modules.yaml:
+
+2015-09-10  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Convert arguments to WebAssembly functions to the declared types
+        https://bugs.webkit.org/show_bug.cgi?id=149033
+
+        Reviewed by Geoffrey Garen.
+
+        This patch checks the types of arguments to WebAssembly functions and
+        converts them to the declared types. This is necessary because:
+        - For example, if a function expects an argument of type double and we
+          pass 1.0 to it, it will get a JSValue of an integer, not a double.
+        - We should follow asm.js's behavior for now, because we want to be able
+          to test WebAssembly apps against asm.js apps. asm.js does type
+          coercion on arguments by using int|0, Math.fround(float), and +double.
+
+        * jit/JITOperations.h:
+        * tests/stress/wasm-type-conversion.js: Added.
+        (shouldBe):
+        (two.valueOf):
+        * tests/stress/wasm/type-conversion.wasm: Added.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::operationConvertJSValueToInt32):
+        (JSC::operationConvertJSValueToDouble):
+        (JSC::WASMFunctionCompiler::startFunction):
+        (JSC::WASMFunctionCompiler::appendCallSetResult):
+        (JSC::WASMFunctionCompiler::callOperation):
+        (JSC::WASMFunctionCompiler::loadValueAndConvertToInt32):
+        (JSC::WASMFunctionCompiler::loadValueAndConvertToDouble):
+
+2015-09-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        JSInternalPromiseDeferred should inherit JSPromiseDeferred
+        https://bugs.webkit.org/show_bug.cgi?id=149027
+
+        Reviewed by Darin Adler.
+
+        JSInternalPromiseDeferred is constructed by using JSPromiseDeferred implementation.
+        So the class info of JSInternalPromiseDeferred should inherit JSPromiseDeferred.
+
+        * runtime/JSInternalPromiseDeferred.cpp:
+
+2015-09-10  Michael Saboff  <msaboff@apple.com>
+
+        Add support for Callee-Saves registers
+        https://bugs.webkit.org/show_bug.cgi?id=148666
+
+        Reviewed by Filip Pizlo.
+
+        We save platform callee save registers right below the call frame header,
+        in the location(s) starting with VirtualRegister 0.  This local space is
+        allocated in the bytecode compiler.  This space is the maximum space
+        needed for the callee registers that the LLInt and baseline JIT use,
+        rounded up to a stack aligned number of VirtualRegisters.
+        The LLInt explicitly saves and restores the registers in the macros
+        preserveCalleeSavesUsedByLLInt and restoreCalleeSavesUsedByLLInt.
+        The JITs saves and restores callee saves registers by what registers
+        are included in m_calleeSaveRegisters in the code block.
+
+        Added handling of callee save register restoration to exception handling.
+        The basic flow is when an exception is thrown or one is recognized to
+        have been generated in C++ code, we save the current state of all
+        callee save registers to VM::calleeSaveRegistersBuffer.  As we unwind
+        looking for the corresponding catch, we copy the callee saves from call 
+        frames to the same VM::calleeSaveRegistersBuffer.  This is done for all
+        call frames on the stack up to but not including the call frame that has
+        the corresponding catch block.  When we process the catch, we restore
+        the callee save registers with the contents of VM::calleeSaveRegistersBuffer.
+        If there isn't a catch, then handleUncaughtException will restore callee
+        saves before it returns back to the calling C++.
+
+        Eliminated callee saves registers as free registers for various thunk
+        generators as the callee saves may not have been saved by the function
+        calling the thunk.
+
+        Added code to transition callee saves from one VM's format to the another
+        as part of OSR entry and OSR exit.
+
+        Cleaned up the static RegisterSet's including adding one for LLInt and 
+        baseline JIT callee saves and one to be used to allocate local registers
+        not including the callee saves or other special registers.
+
+        Moved ftl/FTLRegisterAtOffset.{cpp,h} to jit/RegisterAtOffset.{cpp,h}.
+        Factored out the vector of RegisterAtOffsets in ftl/FTLUnwindInfo.{cpp,h}
+        into a new class in jit/RegisterAtOffsetList.{cpp,h}.
+        Eliminted UnwindInfo and changed UnwindInfo::parse() into a standalone
+        function named parseUnwindInfo.  That standalone function now returns
+        the callee saves RegisterAtOffsetList.  This is stored in the CodeBlock
+        and used instead of UnwindInfo.
+
+        Turned off register preservation thunks for outgoing calls from FTL
+        generated code.  THey'll be removed in a subsequent patch.
+
+        Changed specialized thinks to save and restore the contents of
+        tagTypeNumberRegister and tagMaskRegister as they can be called by FTL
+        compiled functions.  We materialize those tag registers for the thunk's
+        use and then restore the prior contents on function exit.
+
+        Also removed the arity check fail return thunk since it is now the
+        caller's responsibility to restore the stack pointer.
+
+        Removed saving of callee save registers and materialization of special
+        tag registers for 64 bit platforms from vmEntryToJavaScript and
+        vmEntryToNative.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLJITCode.h:
+        * ftl/FTLRegisterAtOffset.cpp: Removed.
+        * ftl/FTLRegisterAtOffset.h: Removed.
+        * ftl/FTLUnwindInfo.cpp:
+        (JSC::FTL::parseUnwindInfo):
+        (JSC::FTL::UnwindInfo::UnwindInfo): Deleted.
+        (JSC::FTL::UnwindInfo::~UnwindInfo): Deleted.
+        (JSC::FTL::UnwindInfo::parse): Deleted.
+        (JSC::FTL::UnwindInfo::dump): Deleted.
+        (JSC::FTL::UnwindInfo::find): Deleted.
+        (JSC::FTL::UnwindInfo::indexOf): Deleted.
+        * ftl/FTLUnwindInfo.h:
+        (JSC::RegisterAtOffset::dump):
+        * jit/RegisterAtOffset.cpp: Added.
+        * jit/RegisterAtOffset.h: Added.
+        (JSC::RegisterAtOffset::RegisterAtOffset):
+        (JSC::RegisterAtOffset::operator!):
+        (JSC::RegisterAtOffset::reg):
+        (JSC::RegisterAtOffset::offset):
+        (JSC::RegisterAtOffset::offsetAsIndex):
+        (JSC::RegisterAtOffset::operator==):
+        (JSC::RegisterAtOffset::operator<):
+        (JSC::RegisterAtOffset::getReg):
+        * jit/RegisterAtOffsetList.cpp: Added.
+        (JSC::RegisterAtOffsetList::RegisterAtOffsetList):
+        (JSC::RegisterAtOffsetList::sort):
+        (JSC::RegisterAtOffsetList::dump):
+        (JSC::RegisterAtOffsetList::find):
+        (JSC::RegisterAtOffsetList::indexOf):
+        * jit/RegisterAtOffsetList.h: Added.
+        (JSC::RegisterAtOffsetList::clear):
+        (JSC::RegisterAtOffsetList::size):
+        (JSC::RegisterAtOffsetList::at):
+        (JSC::RegisterAtOffsetList::append):
+        Move and refactored use of FTLRegisterAtOffset to RegisterAtOffset.
+        Added RegisterAtOffset and RegisterAtOffsetList to build configurations.
+        Remove FTLRegisterAtOffset files.
+
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::setUpCallFromFTL):
+        Turned off FTL register preservation thunks.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::setCalleeSaveRegisters):
+        (JSC::roundCalleeSaveSpaceAsVirtualRegisters):
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters):
+        (JSC::CodeBlock::calleeSaveSpaceAsVirtualRegisters):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfLLIntBaselineCalleeSaveRegisters):
+        (JSC::CodeBlock::calleeSaveRegisters):
+        (JSC::CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters):
+        (JSC::CodeBlock::optimizeAfterWarmUp):
+        (JSC::CodeBlock::numberOfDFGCompiles):
+        Methods to manage a set of callee save registers.  Also to allocate the appropriate
+        number of VirtualRegisters for callee saves.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::allocateCalleeSaveSpace):
+        * bytecompiler/BytecodeGenerator.h:
+        Allocate the appropriate number of VirtualRegisters for callee saves needed by LLInt or baseline JIT.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileSetupRegistersForEntry):
+        (JSC::DFG::JITCompiler::compileBody):
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::operator()):
+        (JSC::UnwindFunctor::copyCalleeSavesToVMCalleeSavesBuffer):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::usedRegisters):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::fixFunctionBasedOnStackMaps):
+        (JSC::FTL::compile):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        * jit/ArityCheckFailReturnThunks.cpp: Removed.
+        * jit/ArityCheckFailReturnThunks.h: Removed.
+        * jit/JIT.cpp:
+        (JSC::JIT::emitEnterOptimizationCheck):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITExceptions.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        * jit/ThunkGenerators.cpp:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::arityFixupGenerator):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::setupArityCheckData):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        Emit code to save and restore callee save registers and materialize tagTypeNumberRegister
+        and tagMaskRegister.
+        Handle callee saves when tiering up.
+        Copy callee saves register contents to VM::calleeSaveRegistersBuffer at beginning of
+        exception processing.
+        Process callee save registers in frames when unwinding from an exception.
+        Restore callee saves register contents from VM::calleeSaveRegistersBuffer on catch.
+        Use appropriate register set to make sure we don't allocate a callee save register when
+        compiling a thunk.
+        Helper to populate tagTypeNumberRegister and tagMaskRegister with the appropriate
+        constants.
+        Removed arity fixup return thunks.
+
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        (JSC::DFG::adjustAndJumpToTarget):
+        Restore callee saves from the DFG and save the appropriate ones for the baseline JIT.
+        Materialize the tag registers on 64 bit platforms.
+
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitSaveCalleeSavesFor):
+        (JSC::AssemblyHelpers::emitRestoreCalleeSavesFor):
+        (JSC::AssemblyHelpers::emitSaveCalleeSaves):
+        (JSC::AssemblyHelpers::emitRestoreCalleeSaves):
+        (JSC::AssemblyHelpers::copyCalleeSavesToVMCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::emitMaterializeTagCheckRegisters):
+        New helpers to save and restore callee saves as well as materialize the tag registers
+        contents.
+
+        * jit/FPRInfo.h:
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toRegister):
+        Updated to include FP callee save registers.  Added number of callee saves registers and
+        cleanup register aliases that collide with callee save registers.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        Uses new stubUnavailableRegisters register set to limit what registers are available for 
+        temporaries.
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::stubUnavailableRegisters):
+        (JSC::RegisterSet::calleeSaveRegisters):
+        (JSC::RegisterSet::llintBaselineCalleeSaveRegisters):
+        (JSC::RegisterSet::dfgCalleeSaveRegisters):
+        (JSC::RegisterSet::ftlCalleeSaveRegisters):
+        * jit/RegisterSet.h:
+        New register sets with the callee saves used by various tiers as well as one listing registers
+        not availble to stub code.
+
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::loadDoubleArgument):
+        (JSC::SpecializedThunkJIT::returnJSValue):
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::returnInt32):
+        (JSC::SpecializedThunkJIT::returnJSCell):
+        (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
+        (JSC::SpecializedThunkJIT::emitSaveThenMaterializeTagRegisters):
+        (JSC::SpecializedThunkJIT::emitRestoreSavedTagRegisters):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        Changed to save and restore existing tag register contents as the may contain other values.
+        After saving the existing values, we materialize the tag constants.
+
+        * jit/TempRegisterSet.h:
+        (JSC::TempRegisterSet::getFPRByIndex):
+        (JSC::TempRegisterSet::getFreeFPR):
+        (JSC::TempRegisterSet::setByIndex):
+        * offlineasm/arm64.rb:
+        * offlineasm/registers.rb:
+        Added methods for floating point registers to support callee save FP registers.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_mod):
+        Removed unnecessary #if CPU(X86_64) check to this 32 bit only file.
+
+        * offlineasm/x86.rb:
+        Fixed Windows callee saves naming.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::calleeSaveRegistersBufferOffset):
+        (JSC::VM::getAllCalleeSaveRegistersMap):
+        Provide a RegisterSaveMap that has all registers that might be saved.  Added a callee save buffer to be
+        used for OSR exit and for exception processing in a future patch.
+
+2015-09-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        ModuleProgramExecutable should provide CodeBlock to ScriptExecutable::forEachCodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=149028
+
+        Reviewed by Michael Saboff.
+
+        ModuleProgramExecutable should provide CodeBlock since ModuleProgramExecutable inherits
+        ScriptExecutable.
+
+        * bytecode/CodeBlock.h:
+        (JSC::ScriptExecutable::forEachCodeBlock):
+
+2015-09-09  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement internal calls in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148998
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements internal calls to functions that return a 32-bit
+        integer in WebAssembly.
+
+        * tests/stress/wasm-calls.js: Added.
+        (shouldBe):
+        * tests/stress/wasm/calls.wasm: Added.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::WASMFunctionCompiler):
+        (JSC::WASMFunctionCompiler::endFunction):
+        (JSC::WASMFunctionCompiler::buildCallInternal):
+        (JSC::WASMFunctionCompiler::appendExpressionList):
+        (JSC::WASMFunctionCompiler::emitNakedCall):
+        (JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
+        (JSC::WASMFunctionCompiler::callAndUnboxResult):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::compile):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseCallInternalExpressionI32):
+        (JSC::WASMFunctionParser::parseCallArguments):
+        (JSC::WASMFunctionParser::parseCallInternal):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildCallInternal):
+        (JSC::WASMFunctionSyntaxChecker::appendExpressionList):
+
+2015-09-09  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189522.
+        https://bugs.webkit.org/show_bug.cgi?id=149020
+
+        "Caused a ~4% Speedometer regression" (Requested by cdumez on
+        #webkit).
+
+        Reverted changeset:
+
+        "Function.prototype.bind: Bound functions must use the
+        [[Prototype]] of their target function instead of
+        Function.prototype"
+        https://bugs.webkit.org/show_bug.cgi?id=145605
+        http://trac.webkit.org/changeset/189522
+
+2015-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix the no-DFG build.
+
+        Unreviewed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitOSRExitTargets):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+
+2015-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        CodeBlocks should strongly visit their OSR exit targets
+        https://bugs.webkit.org/show_bug.cgi?id=148988
+
+        Reviewed by Saam Barati.
+
+        CodeBlocks jump to their OSR exit targets, so we need to keep them alive
+        explicitly.
+
+        This is a step toward throwing away CodeBlocks, which is only safe
+        if we keep alive logically in-use CodeBlocks.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitStrongly): Added a flag to indicate if visit
+        strongly had been performed yet, since we are likely to revisit
+        the same CodeBlock many times now.
+
+        (JSC::CodeBlock::visitOSRExitTargets):
+        (JSC::CodeBlock::stronglyVisitStrongReferences): Do the visiting.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearMarks):
+        (JSC::CodeBlockSet::mark): Added a helper function for clearing out
+        two flags.
+
+2015-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in r189516.
+        https://bugs.webkit.org/show_bug.cgi?id=148989
+
+        Restored changeset:
+
+        "GC should be able to discover new strong CodeBlock references
+        during marking"
+        https://bugs.webkit.org/show_bug.cgi?id=148981
+        http://trac.webkit.org/changeset/189516
+
+        This patch caused infinite recursion on Windows because of a pre-existing
+        logical error in the non-parallel GC configuration. Even in non-parallel
+        GC, we must set the mark bit on a CodeBlock to avoid marking it twice
+        (or, in the case of our crash, infinitely recursively).
+
+2015-09-09  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the relational instructions for doubles in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148999
+
+        Reviewed by Filip Pizlo.
+
+        Implements the relational instructions for doubles (float64) in
+        WebAssembly. Also pass the values into the test functions as Mark Lam
+        suggested in https://bugs.webkit.org/show_bug.cgi?id=148882#c3
+
+        * tests/stress/wasm-relational.js:
+        * tests/stress/wasm/relational.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildRelationalF64):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseRelationalF64ExpressionI32):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildRelationalI32):
+        (JSC::WASMFunctionSyntaxChecker::buildRelationalF64):
+
+2015-09-09  Saam barati  <sbarati@apple.com>
+
+        DFG should have a debugging option that runs a phase that flushes all locals
+        https://bugs.webkit.org/show_bug.cgi?id=148916
+
+        Reviewed by Filip Pizlo.
+
+        There is now an option to enable the DFG's new MaximalFlushInsertionPhase
+        phase to run. This phase ensures that we keep all locals and arguments flushed
+        to the stack at all places in the CFG. This phase is helpful for finding
+        a class of bugs where enabling this phase to run removes the bug.
+        This may also be useful in the development of a faster debugger
+        that doesn't capture all variables.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGMaximalFlushInsertionPhase.cpp: Added.
+        (JSC::DFG::MaximalFlushInsertionPhase::MaximalFlushInsertionPhase):
+        (JSC::DFG::MaximalFlushInsertionPhase::run):
+        (JSC::DFG::MaximalFlushInsertionPhase::treatRegularBlock):
+        (JSC::DFG::MaximalFlushInsertionPhase::treatRootBlock):
+        (JSC::DFG::MaximalFlushInsertionPhase::newVariableAccessData):
+        (JSC::DFG::performMaximalFlushInsertion):
+        * dfg/DFGMaximalFlushInsertionPhase.h: Added.
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Refactor the test for the arithmetic instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148983
+
+        Reviewed by Mark Lam.
+
+        Pass the values into the test functions as Mark Lam suggested in
+        https://bugs.webkit.org/show_bug.cgi?id=148882#c3
+
+        * tests/stress/wasm-arithmetic-int32.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        * tests/stress/wasm-arithmetic.js: Removed.
+        (shouldBe): Deleted.
+        (shouldThrow): Deleted.
+        * tests/stress/wasm/arithmetic-int32.wasm: Added.
+        * tests/stress/wasm/arithmetic.wasm: Removed.
+
+2015-09-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] reduce the amount of memory access needed for LivenessAnalysisPhase
+        https://bugs.webkit.org/show_bug.cgi?id=148414
+
+        Reviewed by Mark Lam.
+
+        LivenessAnalysisPhase still causes a huge number of cache miss.
+        This patch reduces the amount of accesses needed by the HashTables.
+
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::LivenessAnalysisPhase::run):
+        (JSC::DFG::LivenessAnalysisPhase::process):
+
+2015-09-08  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Prospective build fix after r189517
+
+        Unreviewed.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::Thread::captureStack):
+
+2015-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unify symbolTableGet and Put in JSLexicalEnvironment and JSSymbolTableObject
+        https://bugs.webkit.org/show_bug.cgi?id=148783
+
+        Reviewed by Geoffrey Garen.
+
+        Unify the symbolTableGet and symbolTablePut into JSSymbolTableObject's one.
+        Since symbolTablePutWithAttributes in JSLexicalEnvironment is not used, we drop that function.
+
+        * runtime/JSEnvironmentRecord.h:
+        (JSC::JSEnvironmentRecord::isValidScopeOffset):
+        (JSC::JSEnvironmentRecord::variableAt):
+        (JSC::JSEnvironmentRecord::isValid): Deleted.
+        * runtime/JSGlobalLexicalEnvironment.cpp:
+        (JSC::JSGlobalLexicalEnvironment::put):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        (JSC::JSLexicalEnvironment::getOwnPropertySlot):
+        (JSC::JSLexicalEnvironment::put):
+        (JSC::JSLexicalEnvironment::symbolTableGet): Deleted.
+        (JSC::JSLexicalEnvironment::symbolTablePut): Deleted.
+        (JSC::JSLexicalEnvironment::symbolTablePutWithAttributes): Deleted.
+        * runtime/JSLexicalEnvironment.h:
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::isValidScopeOffset):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutTouchWatchpointSet):
+        (JSC::symbolTablePutInvalidateWatchpointSet):
+        (JSC::symbolTablePutWithAttributesTouchWatchpointSet):
+        (JSC::symbolTablePutWithAttributes): Deleted.
+
+2015-09-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189516.
+        https://bugs.webkit.org/show_bug.cgi?id=148989
+
+        broke tests on windows (Requested by alexchristensen on
+        #webkit).
+
+        Reverted changeset:
+
+        "GC should be able to discover new strong CodeBlock references
+        during marking"
+        https://bugs.webkit.org/show_bug.cgi?id=148981
+        http://trac.webkit.org/changeset/189516
+
+2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Remove unused DFG::dfgConvertJSValueToInt32()
+        https://bugs.webkit.org/show_bug.cgi?id=148986
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unused DFG::dfgConvertJSValueToInt32() and also remove
+        DFG::JITCompiler::callOperation(D_JITOperation_EJ operation, ...) which
+        was introduced in Bug 69806 for dfgConvertJSValueToNumber() and is no
+        longer used.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Deleted.
+
+2015-09-08  Matthew Hill  <matthew.jh@outlook.com>
+
+        Function.prototype.bind: Bound functions must use the [[Prototype]] of their target function instead of Function.prototype
+        https://bugs.webkit.org/show_bug.cgi?id=145605
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        * tests/es6.yaml:
+
+2015-09-08  Mark Lam  <mark.lam@apple.com>
+
+        Fixed a bad comment r189517.
+
+        Not reviewed.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::osRedZoneAdjustment):
+
+2015-09-08  Geoffrey Garen  <ggaren@apple.com>
+
+        InlineCallFrames shouldn't be strongly marked by CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=146613
+
+        Reviewed by Saam Barati.
+
+        This code was vestigial an unnecessary, so I removed it.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/InlineCallFrame.cpp:
+        (JSC::InlineCallFrame::calleeConstant):
+        (JSC::InlineCallFrame::calleeForCallFrame):
+        (JSC::InlineCallFrame::visitAggregate): Deleted.
+        * bytecode/InlineCallFrame.h:
+        (JSC::InlineCallFrame::specializationKind):
+        * bytecode/InlineCallFrameSet.cpp:
+        (JSC::InlineCallFrameSet::add):
+        (JSC::InlineCallFrameSet::visitAggregate): Deleted.
+        * bytecode/InlineCallFrameSet.h:
+        (JSC::InlineCallFrameSet::begin):
+        (JSC::InlineCallFrameSet::end):
+
+2015-09-08  Mark Lam  <mark.lam@apple.com>
+
+        GC stack scan should include ABI red zone.
+        https://bugs.webkit.org/show_bug.cgi?id=148976
+
+        Reviewed by Geoffrey Garen and Benjamin Poulain.
+
+        The x86_64 ABI section 3.2.2[1] and ARM64 ABI[2] both state that there is a
+        128 byte red zone below the stack pointer (reserved by the OS), and that
+        "functions may use this area for temporary data that is not needed across
+        function calls".
+
+        Hence, it is possible for a thread to store JSCell pointers in the red zone
+        area, and the conservative GC thread scanner needs to scan that area as well.
+
+        Note: the red zone should not be scanned for the GC thread itself (in
+        gatherFromCurrentThread()).  This because we're guaranteed that there will
+        be GC frames below the lowest (top of stack) frame that we need to scan.
+        Hence, we are guaranteed that there are no red zone areas there containing
+        JSObject pointers of relevance.
+
+        No test added for this issue because the issue relies on:
+        1. the compiler tool chain generating code that stores local variables
+           containing the sole reference to a JS object (that needs to be kept
+           alive) in the stack red zone, and
+        2. GC has to run on another thread while that red zone containing the
+           JS object reference is in use. 
+
+        These conditions require a race that cannot be reliably reproduced.
+
+        [1]: http://people.freebsd.org/~obrien/amd64-elf-abi.pdf
+        [2]: https://developer.apple.com/library/ios/documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARM64FunctionCallingConventions.html#//apple_ref/doc/uid/TP40013702-SW7
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::MachineThreads::Thread::createForCurrentThread):
+        (JSC::MachineThreads::Thread::freeRegisters):
+        (JSC::osRedZoneAdjustment):
+        (JSC::MachineThreads::Thread::captureStack):
+
+2015-09-08  Geoffrey Garen  <ggaren@apple.com>
+
+        GC should be able to discover new strong CodeBlock references during marking
+        https://bugs.webkit.org/show_bug.cgi?id=148981
+
+        Reviewed by Mark Lam.
+
+        Previously, we required a strong reference to register itself before the
+        first visit to a CodeBlock. Now, we can discover a strong reference at
+        any time during the marking phase.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Remove the two strong reference state
+        variables from CodeBlock. Now, a strong reference immediately marks
+        the CodeBlock and its references at the moment of its discovery, and no
+        separate state is required.
+
+        (JSC::CodeBlock::visitStrongly): New helper function for establishing
+        a strong reference to a CodeBlock.
+
+        (JSC::CodeBlock::visitAggregate): Adopt helper function above.
+
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan): Updated
+        for state removal.
+
+        (JSC::CodeBlock::isKnownToBeLiveDuringGC): Ditto.
+
+        (JSC::CodeBlock::stronglyVisitWeakReferences): Be sure to record that
+        we have proven liveness (by virtue of marking all the references the
+        proof would check). This is required so that the CodeBlock knows itself
+        to be live, and it is also an optimization to avoid testing weak references
+        after we have already visited them.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearMarks):
+        (JSC::CodeBlockSet::mark):
+        (JSC::CodeBlockSet::clearMarks): Deleted. Updated for state removal.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::clearCodeBlockMarks):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        * dfg/DFGPlan.h: No need to use a CodeBlockSet in order to mark anymore.
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::completeAllPlansForVM):
+        (JSC::DFG::Worklist::clearCodeBlockMarks):
+        (JSC::DFG::Worklist::resumeAllThreads):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::completeAllPlansForVM):
+        (JSC::DFG::clearCodeBlockMarks):
+        * dfg/DFGWorklist.h:
+        (JSC::DFG::worklistForIndexOrNull): No need to use a CodeBlockSet in order
+        to mark anymore.
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::clearMarksForFullCollection):
+        (JSC::CodeBlockSet::clearMarksForEdenCollection):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        (JSC::CodeBlockSet::traceMarked):
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        (JSC::CodeBlockSet::dump):
+        * heap/CodeBlockSet.h: Keep the currently executing CodeBlocks in RefPtrs
+        since we can no longer rely on the m_currentlyExecuting bit to keep them
+        alive. (A currently executing CodeBlock may not be referenced by its
+        Executable because it may since have been replaced by another CodeBlock.
+        This is common in the cases of OSR entry and exit.)
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::visitCompilerWorklistWeakReferences):
+        (JSC::Heap::visitWeakHandles): No need to trace the list of CodeBlocks
+        on the stack in the weak reference fixpoint because we no longer overload
+        "on the stack" to include CodeBlocks referenced by the compiler.
+
+2015-09-08  Andreas Kling  <akling@apple.com>
+
+        [JSC] Remove unused Heap::getConservativeRegisterRoots().
+        <https://webkit.org/b/148974>
+
+        Reviewed by Geoffrey Garen.
+
+        Spotted this unused stack root gathering helper in Heap. Let's lose it.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::getConservativeRegisterRoots): Deleted.
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::gatherConservativeRoots): Deleted.
+        * interpreter/JSStack.h:
+        (JSC::JSStack::gatherConservativeRoots): Deleted.
+
+2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement control flow statements in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148934
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements if, while, do, label, break, and continue
+        statements in WebAssembly. Switches will be implemented in a subsequent
+        patch.
+
+        * tests/stress/wasm-control-flow.js: Added.
+        (shouldBe):
+        * tests/stress/wasm/control-flow.wasm: Added.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::linkTarget):
+        (JSC::WASMFunctionCompiler::jumpToTarget):
+        (JSC::WASMFunctionCompiler::jumpToTargetIf):
+        (JSC::WASMFunctionCompiler::startLoop):
+        (JSC::WASMFunctionCompiler::endLoop):
+        (JSC::WASMFunctionCompiler::startSwitch):
+        (JSC::WASMFunctionCompiler::endSwitch):
+        (JSC::WASMFunctionCompiler::startLabel):
+        (JSC::WASMFunctionCompiler::endLabel):
+        (JSC::WASMFunctionCompiler::breakTarget):
+        (JSC::WASMFunctionCompiler::continueTarget):
+        (JSC::WASMFunctionCompiler::breakLabelTarget):
+        (JSC::WASMFunctionCompiler::continueLabelTarget):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseIfStatement):
+        (JSC::WASMFunctionParser::parseIfElseStatement):
+        (JSC::WASMFunctionParser::parseWhileStatement):
+        (JSC::WASMFunctionParser::parseDoStatement):
+        (JSC::WASMFunctionParser::parseLabelStatement):
+        (JSC::WASMFunctionParser::parseBreakStatement):
+        (JSC::WASMFunctionParser::parseBreakLabelStatement):
+        (JSC::WASMFunctionParser::parseContinueStatement):
+        (JSC::WASMFunctionParser::parseContinueLabelStatement):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::linkTarget):
+        (JSC::WASMFunctionSyntaxChecker::jumpToTarget):
+        (JSC::WASMFunctionSyntaxChecker::jumpToTargetIf):
+        (JSC::WASMFunctionSyntaxChecker::startLoop):
+        (JSC::WASMFunctionSyntaxChecker::endLoop):
+        (JSC::WASMFunctionSyntaxChecker::startSwitch):
+        (JSC::WASMFunctionSyntaxChecker::endSwitch):
+        (JSC::WASMFunctionSyntaxChecker::startLabel):
+        (JSC::WASMFunctionSyntaxChecker::endLabel):
+        (JSC::WASMFunctionSyntaxChecker::breakTarget):
+        (JSC::WASMFunctionSyntaxChecker::continueTarget):
+        (JSC::WASMFunctionSyntaxChecker::breakLabelTarget):
+        (JSC::WASMFunctionSyntaxChecker::continueLabelTarget):
+
+2015-09-08  Per Arne Vollan  <peavo@outlook.com>
+
+        [Win] Compile errors in inspector code.
+        https://bugs.webkit.org/show_bug.cgi?id=148977
+
+        Reviewed by Alex Christensen.
+
+        Include definition of class FrontendRouter before use.
+
+        * inspector/InspectorBackendDispatcher.h:
+        * inspector/JSGlobalObjectInspectorController.h:
+
+2015-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement computed accessors
+        https://bugs.webkit.org/show_bug.cgi?id=147883
+
+        Reviewed by Geoffrey Garen.
+
+        Patch by Yusuke Suzuki <utatane.tea@gmail.com> and Matthew Mirman <mmirman@apple.com>.
+
+        Implement the computed accessors functionality for class syntax and object literal syntax.
+        Added new opcodes, op_put_getter_by_val and op_put_setter_by_val. LLInt and baseline JIT support them.
+        As the same to the other accessor opcodes (like op_put_getter_by_id etc.), DFG / FTL does not support
+        them. This is handled here[1].
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=148860
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutGetterByVal):
+        (JSC::BytecodeGenerator::emitPutSetterByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_getter_by_val):
+        (JSC::JIT::emit_op_put_setter_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter_by_val):
+        (JSC::JIT::emit_op_put_setter_by_val):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        * tests/es6.yaml:
+        * tests/stress/computed-accessor-parsing.js: Added.
+        (testShouldNotThrow):
+        (testShouldThrow):
+        (Val.prototype.get string_appeared_here):
+        (Val):
+        * tests/stress/computed-accessor.js: Added.
+        (shouldBe):
+        (.):
+        * tests/stress/duplicate-computed-accessors.js: Added.
+        (shouldBe):
+
+2015-09-08  Saam barati  <sbarati@apple.com>
+
+        baseline JIT should emit better code for UnresolvedProperty in resolve_scope/get_from_scope/put_to_scope
+        https://bugs.webkit.org/show_bug.cgi?id=148895
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, if a resolve_scope/get_from_scope/put_to_scope with
+        UnresolvedProperty made it to the baseline JIT, we would hard compile
+        a jump to the slow path. This is bad and slow. Because UnresolvedProperty
+        tries to update itself to something more useful, and succeeds at doing so
+        with high probability, we should be emitting code that checks to see if the 
+        slow path has performed an update, and if it has, execute more efficient code 
+        and not go to the slow path (unless it needs to for var injection check failure, 
+        or other check failures). This increases the speed of this code greatly because 
+        we may decide to compile a program/function before certain resolve_scope/get_from_scope/put_to_scope 
+        operations ever execute. And now, the baseline JIT code better adapts to such
+        compilation scenarios.
+
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::isBeingWatched):
+        (JSC::WatchpointSet::addressOfState):
+        (JSC::WatchpointSet::offsetOfState):
+        (JSC::WatchpointSet::addressOfSetIsNotEmpty):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitNotifyWrite):
+        (JSC::JIT::assertStackPointerOffset):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emitGetGlobalProperty):
+        (JSC::JIT::emitGetVarFromPointer):
+        (JSC::JIT::emitGetVarFromIndirectPointer):
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitPutGlobalProperty):
+        (JSC::JIT::emitPutGlobalVariable):
+        (JSC::JIT::emitPutGlobalVariableIndirect):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emitGetGlobalProperty):
+        (JSC::JIT::emitGetVarFromPointer):
+        (JSC::JIT::emitGetVarFromIndirectPointer):
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitPutGlobalProperty):
+        (JSC::JIT::emitPutGlobalVariable):
+        (JSC::JIT::emitPutGlobalVariableIndirect):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        * tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js:
+        (foo):
+
+2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement all the arithmetic and logical instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148882
+
+        Reviewed by Mark Lam.
+
+        This patch implements all the arithmetic and logical instructions for
+        32-bit integers in WebAssembly.
+
+        * tests/stress/wasm-arithmetic.js:
+        * tests/stress/wasm/arithmetic.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildUnaryI32):
+        (JSC::WASMFunctionCompiler::buildBinaryI32):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseUnaryExpressionI32):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildUnaryI32):
+
+2015-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix debug by removing an assertion that is not correct anymore.
+
+        * jit/Repatch.cpp:
+        (JSC::linkFor):
+
+2015-09-08  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Add initial support for doubles in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148913
+
+        Reviewed by Filip Pizlo.
+
+        Implement the ConstantPoolIndex, Immediate, and GetLocal instructions
+        for doubles (float64) in WebAssembly.
+
+        * tests/stress/wasm-arithmetic-float64.js: Added.
+        (shouldBe):
+        * tests/stress/wasm/arithmetic-float64.wasm: Added.
+        * wasm/WASMConstants.h:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildSetLocal):
+        (JSC::WASMFunctionCompiler::buildReturn):
+        (JSC::WASMFunctionCompiler::buildImmediateI32):
+        (JSC::WASMFunctionCompiler::buildImmediateF64):
+        (JSC::WASMFunctionCompiler::buildGetLocal):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpression):
+        (JSC::WASMFunctionParser::parseExpressionF64):
+        (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionF64):
+        (JSC::WASMFunctionParser::parseImmediateExpressionF64):
+        (JSC::WASMFunctionParser::parseGetLocalExpressionF64):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildImmediateF64):
+        * wasm/WASMReader.cpp:
+        (JSC::WASMReader::readOpExpressionF64):
+        * wasm/WASMReader.h:
+
+2015-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        CallLinkInfo inside StructureStubInfo should not use polymorphic stubs
+        https://bugs.webkit.org/show_bug.cgi?id=148915
+
+        Reviewed by Mark Lam.
+
+        There is a subtle bug where if we reset a get_by_id IC that had a getter stub that in
+        turn had a polymorphic call stub, then the GC won't know to keep the getter stub alive.
+        This patch documents the bug in a FIXME and disables polymorphic call optimizations for
+        getters. It also just so happens that the polymorphic call optimizations usually don't
+        benefit getters, since it's hard to create polymorphism at the point of call without also
+        introducing polymorphism in the base object's structure.
+
+        The added test doesn't reproduce the problem, because it's hard to get the GC to delete
+        all of the stubs.
+
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::setCallLocations):
+        (JSC::CallLinkInfo::allowStubs):
+        (JSC::CallLinkInfo::disallowStubs):
+        (JSC::CallLinkInfo::setUpCallFromFTL):
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::linkFor):
+        (JSC::linkPolymorphicCall):
+        * tests/stress/poly-call-stub-in-getter-stub.js: Added.
+        (foo):
+        (makeGetter):
+
+2015-09-07  Filip Pizlo  <fpizlo@apple.com>
+
+        The put_by_id IC store barrier contract should benefit transition over replace
+        https://bugs.webkit.org/show_bug.cgi?id=148943
+
+        Reviewed by Mark Lam.
+
+        Previously, we would only emit a barrier if the value being stored was possibly a cell, so
+        the transition stub code generator would have to emit a barrier for the store of the
+        structure, just in case the structure was newer than the base object.
+
+        This changes the contract so that the put_by_id callsite would always have a barrier on the
+        base (except if it proved that the base was brand new). That way, the transition doesn't have
+        to have a barrier unless it allocates.
+
+        This is meant to be a perf-neutral change that I need for the IC refactoring in
+        https://bugs.webkit.org/show_bug.cgi?id=148717.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStub):
+
+2015-09-07  Alex Christensen  <achristensen@webkit.org>
+
+        Windows non-cygwin build fix after r189333.
+
+        SVN on Windows (non-cygwin) doesn't like having the * character in file names.
+        I replaced "*" with "star" in some of Geoff's new tests.
+
+        * tests/es6.yaml:
+        Changed all _*_ to _star_
+        * tests/es6/generators_yield_*_arrays.js: Removed.
+        * tests/es6/generators_yield_*_astral_plane_strings.js: Removed.
+        * tests/es6/generators_yield_*_generator_instances.js: Removed.
+        * tests/es6/generators_yield_*_generic_iterables.js: Removed.
+        * tests/es6/generators_yield_*_instances_of_iterables.js: Removed.
+        * tests/es6/generators_yield_*_iterator_closing.js: Removed.
+        * tests/es6/generators_yield_*_iterator_closing_via_throw.js: Removed.
+        * tests/es6/generators_yield_*_on_non-iterables_is_a_runtime_error.js: Removed.
+        * tests/es6/generators_yield_*_sparse_arrays.js: Removed.
+        * tests/es6/generators_yield_*_strings.js: Removed.
+        * tests/es6/generators_yield_star_arrays.js: Copied from tests/es6/generators_yield_*_arrays.js.
+        * tests/es6/generators_yield_star_astral_plane_strings.js: Copied from tests/es6/generators_yield_*_astral_plane_strings.js.
+        * tests/es6/generators_yield_star_generator_instances.js: Copied from tests/es6/generators_yield_*_generator_instances.js.
+        * tests/es6/generators_yield_star_generic_iterables.js: Copied from tests/es6/generators_yield_*_generic_iterables.js.
+        * tests/es6/generators_yield_star_instances_of_iterables.js: Copied from tests/es6/generators_yield_*_instances_of_iterables.js.
+        * tests/es6/generators_yield_star_iterator_closing.js: Copied from tests/es6/generators_yield_*_iterator_closing.js.
+        * tests/es6/generators_yield_star_iterator_closing_via_throw.js: Copied from tests/es6/generators_yield_*_iterator_closing_via_throw.js.
+        * tests/es6/generators_yield_star_on_non-iterables_is_a_runtime_error.js: Copied from tests/es6/generators_yield_*_on_non-iterables_is_a_runtime_error.js.
+        * tests/es6/generators_yield_star_sparse_arrays.js: Copied from tests/es6/generators_yield_*_sparse_arrays.js.
+        * tests/es6/generators_yield_star_strings.js: Copied from tests/es6/generators_yield_*_strings.js.
+
+2015-09-06  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix broken Windows build after r189454.
+
+        Not reviewed.
+
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
+
+2015-09-06  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the relational instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148838
+
+        Reviewed by Saam Barati.
+
+        This patch implements the relational instructions for 32-bit integers in
+        WebAssembly.
+
+        * tests/stress/wasm-arithmetic.js:
+        * tests/stress/wasm-locals.js:
+        * tests/stress/wasm-relational.js: Added.
+        (shouldBe):
+        * tests/stress/wasm/arithmetic.wasm: Renamed from Source/JavaScriptCore/tests/stress/wasm-arithmetic.wasm.
+        * tests/stress/wasm/locals.wasm: Renamed from Source/JavaScriptCore/tests/stress/wasm-locals.wasm.
+        * tests/stress/wasm/relational.wasm: Added.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildRelationalI32):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseRelationalI32ExpressionI32):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildRelationalI32):
+
+2015-09-06  Mark Lam  <mark.lam@apple.com>
+
+        StackOverflow stack unwinding should stop at native frames.
+        https://bugs.webkit.org/show_bug.cgi?id=148749
+
+        Reviewed by Michael Saboff.
+
+        In the present code, after ping-pong'ing back and forth between native and JS
+        code a few times, if we have a stack overflow on re-entry into the VM to run
+        JS code's whose stack frame would overflow the JS stack, the code will end up
+        unwinding past the native function that is making the call to re-enter the VM.
+        As a result, any clean up code (e.g. destructors for stack variables) in the
+        skipped native function frame (and its chain of native function callers) will
+        not be called.
+
+        This patch is based on the Michael Saboff's fix of this issue landed on the
+        jsc-tailcall branch: http://trac.webkit.org/changeset/188555
+
+        We now check for the case where there are no JS frames to unwind since the
+        last native frame, and treat the exception as an unhandled exception.  The
+        native function is responsible for further propagating the exception if needed.
+
+        Other supporting work:
+        1. Remove vm->vmEntryFrameForThrow.  It should always be the same as
+           vm->topVMEntryFrame.
+        2. Change operationThrowStackOverflowError() to use the throwStackOverflowError()
+           helper function instead of rolling its own.
+        3. Added a test that exercises this edge case.  The test should not hang or crash.
+
+        * API/tests/PingPongStackOverflowTest.cpp: Added.
+        (PingPongStackOverflowObject_hasInstance):
+        (testPingPongStackOverflow):
+        * API/tests/PingPongStackOverflowTest.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::operator=):
+        (JSC::ExecState::callerFrame):
+        (JSC::ExecState::callerFrameOrVMEntryFrame):
+        (JSC::ExecState::argIndexForRegister):
+        (JSC::ExecState::callerFrameAndPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::UnwindFunctor):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::unwind):
+        * interpreter/Interpreter.h:
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        (JSC::Interpreter::sampler):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITExceptions.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOperations.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/VM.h:
+        (JSC::VM::exceptionOffset):
+        (JSC::VM::callFrameForThrowOffset):
+        (JSC::VM::vmEntryFrameForThrowOffset): Deleted.
+        (JSC::VM::topVMEntryFrameOffset): Deleted.
+
+2015-09-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, disable module tests in Windows until name resolution is fixed
+        https://bugs.webkit.org/show_bug.cgi?id=148689
+
+        Until bug[1] is fixed, we disable the module tests.
+        Since the local file system name resolution is just implemented in jsc.cpp and
+        is intended to be used for the module tests, it does not affect JSC framework
+        and WebKit itself.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=148917
+
+        * tests/modules.yaml:
+
+2015-09-06  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Simplify JIT::emit_op_mod()
+        https://bugs.webkit.org/show_bug.cgi?id=148908
+
+        Reviewed by Michael Saboff.
+
+        The IDIV instruction on x86 divides the value in the EDX:EAX registers
+        by the source operand and stores the quotient in EAX and the remainder
+        in EDX. Therefore, we store the values that we don't want to be
+        overwritten by IDIV in registers that are not EAX or EDX. This patch
+        makes the intention clearer and makes the code easier to read.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+
+2015-09-05  Mark Lam  <mark.lam@apple.com>
+
+        Fix JSDollarVMPrototype after r189160.
+        https://bugs.webkit.org/show_bug.cgi?id=148900
+
+        Reviewed by Michael Saboff.
+
+        JSDollarVMPrototype needs to be updated to match http://trac.webkit.org/changeset/189160 i.e.
+        remove the use of JSC::Function bit in its property attributes.
+
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::finishCreation):
+
+2015-09-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, fix the module name resolution in Windows
+        https://bugs.webkit.org/show_bug.cgi?id=148689
+
+        Attempt to fix the module name resolution in Windows.
+        A module name is represented as the UNIX path under the current module tests.
+        This fix split the module name with '/' instead of pathSeparator().
+
+        This is only utilized by the jsc.cpp for the local module tests.
+        So, WebKit production and JavaScriptCore framework are not affected by this change.
+
+        * jsc.cpp:
+        (ModuleName::startsWithRoot):
+        (ModuleName::ModuleName):
+        (resolvePath):
+        (GlobalObject::moduleLoaderResolve):
+
+2015-09-05  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: tighten up lifetimes for Agent-owned objects, and initialize agents using contexts
+        https://bugs.webkit.org/show_bug.cgi?id=148625
+
+        Reviewed by Joseph Pecoraro.
+
+        All agents own their domain-specific frontend and backend dispatchers. Change so that
+        they are initialized in constructors rather than when a frontend connects or disconnects.
+        This may cause additional memory use, but this can be counteracted by lazily creating
+        some agents that are not required for other agents to function (i.e., runtime and page agents).
+
+        To avoid adding frontend/backend dispatcher arguments to every single agent constructor,
+        change agent construction to take a AgentContext or a subclass of it. This provides agents with
+        references to objects in the owning InspectorEnvironment subclass that are guaranteed to
+        outlive all agents. AgentContext and its subclasses follow the existing Agent class hierarchy.
+
+        * inspector/InspectorAgentBase.h:
+        (Inspector::JSAgentContext::JSAgentContext):
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectAllFrontends):
+        (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::InspectorAgent):
+        (Inspector::InspectorAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorAgent::willDestroyFrontendAndBackend):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::InspectorConsoleAgent):
+        (Inspector::InspectorConsoleAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorConsoleAgent::willDestroyFrontendAndBackend):
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (Inspector::InspectorDebuggerAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorDebuggerAgent::willDestroyFrontendAndBackend):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectConsoleAgent.cpp:
+        (Inspector::JSGlobalObjectConsoleAgent::JSGlobalObjectConsoleAgent):
+        * inspector/agents/JSGlobalObjectConsoleAgent.h:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::JSGlobalObjectDebuggerAgent):
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        (Inspector::JSGlobalObjectRuntimeAgent::JSGlobalObjectRuntimeAgent):
+        (Inspector::JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend):
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        * inspector/augmentable/AlternateDispatchableAgent.h:
+        * inspector/augmentable/AugmentableInspectorController.h: Alternate agents should
+        have access to frontend router and backend dispatcher at construction time.
+        
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/objc_generator_templates.py:
+
+2015-09-04  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: agents should send messages through FrontendRouter instead of FrontendChannel
+        https://bugs.webkit.org/show_bug.cgi?id=148492
+
+        Reviewed by Joseph Pecoraro.
+
+        Replace uses of FrontendChannel with FrontendRouter. Minor cleanups along the way.  
+
+        Make AgentRegistry automatically signal discardAgent() in its destructor, since it always
+        gets executed in the owning controller's destructor anyway.
+
+        * inspector/InspectorAgentBase.h:
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::AgentRegistry::~AgentRegistry):
+        (Inspector::AgentRegistry::didCreateFrontendAndBackend):
+        (Inspector::AgentRegistry::willDestroyFrontendAndBackend):
+        (Inspector::AgentRegistry::discardAgents): Deleted.
+        * inspector/InspectorAgentRegistry.h:
+        * inspector/InspectorBackendDispatcher.cpp:
+        * inspector/InspectorFrontendRouter.cpp:
+        (Inspector::FrontendRouter::leakChannel): Deleted, no longer necessary.
+        * inspector/InspectorFrontendRouter.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
+        (Inspector::JSGlobalObjectInspectorController::~JSGlobalObjectInspectorController):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::didCreateFrontendAndBackend):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::didCreateFrontendAndBackend):
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::didCreateFrontendAndBackend):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        (Inspector::JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend):
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        * inspector/augmentable/AlternateDispatchableAgent.h:
+        * inspector/remote/RemoteInspectorDebuggable.cpp:
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
+        (CppFrontendDispatcherHeaderGenerator.generate_output.FrontendRouter):
+        (CppFrontendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator.generate_output):
+        (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator.generate_output):
+
+2015-09-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Enable ES6 Module in JSC shell by default
+        https://bugs.webkit.org/show_bug.cgi?id=148689
+
+        Reviewed by Geoffrey Garen.
+
+        Enable ES6 Modules in JSC shell by default. Compile time flag is left for WebCore.
+        Since the entry point to evaluate the modules are completely separated from the usual
+        entry point to evaluate the script, we can safely enable ES6 modules in JSC shell.
+
+        And add bunch of tests for ES6 Modules.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionLoadModule):
+        (runWithScripts):
+        (printUsageStatement): Deleted.
+        (CommandLine::parseArguments): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner): Deleted.
+        * tests/modules.yaml: Added.
+        * tests/modules/aliasing.js: Added.
+        * tests/modules/aliasing/drink-2.js: Added.
+        (export.let.Cappuccino.string_appeared_here.export.changeCappuccino):
+        * tests/modules/aliasing/drink.js: Added.
+        (export.changeCocoa):
+        * tests/modules/cyclic-may-produce-tdz.js: Added.
+        * tests/modules/cyclic-may-produce-tdz/1.js: Added.
+        * tests/modules/cyclic-may-produce-tdz/2.js: Added.
+        * tests/modules/default-error/main.js: Added.
+        * tests/modules/default-value-case-should-be-copied.js: Added.
+        * tests/modules/default-value-case-should-be-copied/module.js: Added.
+        (export.changeValue):
+        * tests/modules/defaults.js: Added.
+        * tests/modules/defaults/Cappuccino.js: Added.
+        * tests/modules/defaults/Cocoa.js: Added.
+        (export.default.Cocoa):
+        * tests/modules/defaults/Matcha.js: Added.
+        * tests/modules/destructuring-export.js: Added.
+        * tests/modules/destructuring-export/array.js: Added.
+        * tests/modules/destructuring-export/main.js: Added.
+        * tests/modules/execution-order-cyclic.js: Added.
+        * tests/modules/execution-order-cyclic/1.js: Added.
+        * tests/modules/execution-order-cyclic/10.js: Added.
+        * tests/modules/execution-order-cyclic/11.js: Added.
+        * tests/modules/execution-order-cyclic/2.js: Added.
+        * tests/modules/execution-order-cyclic/3.js: Added.
+        * tests/modules/execution-order-cyclic/4.js: Added.
+        * tests/modules/execution-order-cyclic/5.js: Added.
+        * tests/modules/execution-order-cyclic/6.js: Added.
+        * tests/modules/execution-order-cyclic/7.js: Added.
+        * tests/modules/execution-order-cyclic/8.js: Added.
+        * tests/modules/execution-order-cyclic/9.js: Added.
+        * tests/modules/execution-order-dag.js: Added.
+        * tests/modules/execution-order-dag/1.js: Added.
+        * tests/modules/execution-order-dag/10.js: Added.
+        * tests/modules/execution-order-dag/2.js: Added.
+        * tests/modules/execution-order-dag/3.js: Added.
+        * tests/modules/execution-order-dag/4.js: Added.
+        * tests/modules/execution-order-dag/5.js: Added.
+        * tests/modules/execution-order-dag/6.js: Added.
+        * tests/modules/execution-order-dag/7.js: Added.
+        * tests/modules/execution-order-dag/8.js: Added.
+        * tests/modules/execution-order-dag/9.js: Added.
+        * tests/modules/execution-order-depth.js: Added.
+        * tests/modules/execution-order-depth/1.js: Added.
+        * tests/modules/execution-order-depth/2.js: Added.
+        * tests/modules/execution-order-depth/3.js: Added.
+        * tests/modules/execution-order-self.js: Added.
+        * tests/modules/execution-order-sibling.js: Added.
+        * tests/modules/execution-order-sibling/1.js: Added.
+        * tests/modules/execution-order-sibling/2.js: Added.
+        * tests/modules/execution-order-sibling/3.js: Added.
+        * tests/modules/execution-order-tree.js: Added.
+        * tests/modules/execution-order-tree/1.js: Added.
+        * tests/modules/execution-order-tree/10.js: Added.
+        * tests/modules/execution-order-tree/11.js: Added.
+        * tests/modules/execution-order-tree/2.js: Added.
+        * tests/modules/execution-order-tree/3.js: Added.
+        * tests/modules/execution-order-tree/4.js: Added.
+        * tests/modules/execution-order-tree/5.js: Added.
+        * tests/modules/execution-order-tree/6.js: Added.
+        * tests/modules/execution-order-tree/7.js: Added.
+        * tests/modules/execution-order-tree/8.js: Added.
+        * tests/modules/execution-order-tree/9.js: Added.
+        * tests/modules/export-conflict-ok.js: Added.
+        * tests/modules/export-conflict-ok/A.js: Added.
+        * tests/modules/export-conflict-ok/B.js: Added.
+        * tests/modules/export-conflict-ok/main.js: Added.
+        * tests/modules/export-from.js: Added.
+        * tests/modules/export-from/main.js: Added.
+        * tests/modules/export-from/second.js: Added.
+        * tests/modules/export-with-declarations-list.js: Added.
+        * tests/modules/export-with-declarations-list/main.js: Added.
+        * tests/modules/exported-function-may-be-called-before-module-is-executed.js: Added.
+        * tests/modules/exported-function-may-be-called-before-module-is-executed/1.js: Added.
+        * tests/modules/exported-function-may-be-called-before-module-is-executed/2.js: Added.
+        (export.add):
+        (export.raise):
+        * tests/modules/import-error.js: Added.
+        * tests/modules/import-error/export-ambiguous-1.js: Added.
+        * tests/modules/import-error/export-ambiguous-2.js: Added.
+        * tests/modules/import-error/export-ambiguous.js: Added.
+        * tests/modules/import-error/export-default-from-star-2.js: Added.
+        (export.default.Cocoa):
+        * tests/modules/import-error/export-default-from-star.js: Added.
+        * tests/modules/import-error/export-not-found.js: Added.
+        * tests/modules/import-error/import-ambiguous.js: Added.
+        * tests/modules/import-error/import-default-from-star.js: Added.
+        * tests/modules/import-error/import-not-found.js: Added.
+        * tests/modules/imported-bindings-are-immutable.js: Added.
+        * tests/modules/imported-bindings-are-immutable/bindings.js: Added.
+        (export.functionDeclaration):
+        (export.classDeclaration):
+        * tests/modules/imported-bindings-can-be-changed-in-original-module.js: Added.
+        * tests/modules/imported-bindings-can-be-changed-in-original-module/bindings.js: Added.
+        * tests/modules/indirect-export-error.js: Added.
+        * tests/modules/indirect-export-error/indirect-export-ambiguous-2.js: Added.
+        * tests/modules/indirect-export-error/indirect-export-ambiguous-3.js: Added.
+        * tests/modules/indirect-export-error/indirect-export-ambiguous-4.js: Added.
+        * tests/modules/indirect-export-error/indirect-export-ambiguous.js: Added.
+        * tests/modules/indirect-export-error/indirect-export-default-2.js: Added.
+        * tests/modules/indirect-export-error/indirect-export-default-3.js: Added.
+        (export.default.Cocoa):
+        * tests/modules/indirect-export-error/indirect-export-default.js: Added.
+        * tests/modules/indirect-export-error/indirect-export-not-found-2.js: Added.
+        * tests/modules/indirect-export-error/indirect-export-not-found.js: Added.
+        * tests/modules/module-eval.js: Added.
+        * tests/modules/module-eval/A.js: Added.
+        * tests/modules/module-eval/B.js: Added.
+        * tests/modules/module-eval/drink.js: Added.
+        * tests/modules/module-is-strict-code.js: Added.
+        * tests/modules/namespace-ambiguous.js: Added.
+        * tests/modules/namespace-ambiguous/ambiguous-2.js: Added.
+        * tests/modules/namespace-ambiguous/ambiguous-3.js: Added.
+        * tests/modules/namespace-ambiguous/ambiguous-4.js: Added.
+        * tests/modules/namespace-ambiguous/ambiguous.js: Added.
+        * tests/modules/namespace-error.js: Added.
+        * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-2.js: Added.
+        * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-3.js: Added.
+        * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-4.js: Added.
+        * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-5.js: Added.
+        * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-6.js: Added.
+        * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity-7.js: Added.
+        * tests/modules/namespace-error/namespace-local-error-should-hide-global-ambiguity.js: Added.
+        * tests/modules/namespace-tdz.js: Added.
+        * tests/modules/namespace-tdz/A.js: Added.
+        * tests/modules/namespace-tdz/B.js: Added.
+        (export.later):
+        * tests/modules/namespace-tdz/main.js: Added.
+        * tests/modules/namespace.js: Added.
+        * tests/modules/namespace/additional-drink.js: Added.
+        * tests/modules/namespace/drink.js: Added.
+        (export.default.changeCappuccino):
+        * tests/modules/namespace/more-additional-drink.js: Added.
+        * tests/modules/resources/assert.js: Added.
+        (export.shouldBe):
+        (export.shouldThrow):
+        * tests/modules/scopes.js: Added.
+        * tests/modules/scopes/additional-drink.js: Added.
+        * tests/modules/scopes/drink.js: Added.
+        (export.default.changeCappuccino):
+        * tests/modules/scopes/more-additional-drink.js: Added.
+        * tests/modules/this-should-be-undefined.js: Added.
+        * tests/stress/modules-syntax-error-with-names.js:
+        * tests/stress/modules-syntax-error.js:
+        * tests/stress/modules-syntax.js:
+
+2015-09-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement ModuleNamespaceObject
+        https://bugs.webkit.org/show_bug.cgi?id=148705
+
+        Reviewed by Geoffrey Garen.
+
+        Implement Module namespace object.
+        That is used when importing the module with the form `import * as namespace from "mod"`.
+        The module namespace object is non-extensible object that has the bindings to the original module
+        as the property.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::moduleNamespaceObjectStructure):
+        * runtime/JSModuleNamespaceObject.cpp: Added.
+        (JSC::JSModuleNamespaceObject::JSModuleNamespaceObject):
+        (JSC::JSModuleNamespaceObject::finishCreation):
+        (JSC::JSModuleNamespaceObject::destroy):
+        (JSC::JSModuleNamespaceObject::visitChildren):
+        (JSC::callbackGetter):
+        (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
+        (JSC::JSModuleNamespaceObject::put):
+        (JSC::JSModuleNamespaceObject::putByIndex):
+        (JSC::JSModuleNamespaceObject::deleteProperty):
+        (JSC::JSModuleNamespaceObject::getOwnPropertyNames):
+        (JSC::JSModuleNamespaceObject::defineOwnProperty):
+        (JSC::moduleNamespaceObjectSymbolIterator):
+        * runtime/JSModuleNamespaceObject.h: Added.
+        (JSC::JSModuleNamespaceObject::create):
+        (JSC::JSModuleNamespaceObject::createStructure):
+        (JSC::JSModuleNamespaceObject::moduleRecord):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::visitChildren):
+        (JSC::getExportedNames):
+        (JSC::JSModuleRecord::getModuleNamespace):
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        * runtime/JSModuleRecord.h:
+
+2015-09-04  Mark Lam  <mark.lam@apple.com>
+
+        Rollout r189411, r189413: Broke JSC tests.
+
+        Not reviewed.
+
+        * API/tests/PingPongStackOverflowTest.cpp: Removed.
+        * API/tests/PingPongStackOverflowTest.h: Removed.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::operator=):
+        (JSC::ExecState::callerFrame):
+        (JSC::ExecState::argIndexForRegister):
+        (JSC::ExecState::callerFrameOrVMEntryFrame):
+        (JSC::ExecState::callerFrameAndPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::UnwindFunctor):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::unwind):
+        * interpreter/Interpreter.h:
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        (JSC::Interpreter::sampler):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITExceptions.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOperations.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/VM.h:
+        (JSC::VM::exceptionOffset):
+        (JSC::VM::vmEntryFrameForThrowOffset):
+        (JSC::VM::topVMEntryFrameOffset):
+        (JSC::VM::callFrameForThrowOffset):
+
+2015-09-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Test Runtime.saveResult and $n values
+        https://bugs.webkit.org/show_bug.cgi?id=148837
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._evaluateOn):
+        We don't need to be in the console object group to put the value
+        in the saved results list. That strong reference will ensure $n
+        values are always alive even if other object groups were used
+        when creating and subsequently released.
+
+2015-09-04  Mark Lam  <mark.lam@apple.com>
+
+        [Follow up] StackOverflow stack unwinding should stop at native frames.
+        https://bugs.webkit.org/show_bug.cgi?id=148749
+
+        Rubber stamped by Michael Saboff.
+
+        Speculative fix for jsc test failure.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwind):
+
+2015-09-04  Mark Lam  <mark.lam@apple.com>
+
+        StackOverflow stack unwinding should stop at native frames.
+        https://bugs.webkit.org/show_bug.cgi?id=148749
+
+        Reviewed by Michael Saboff.
+
+        In the present code, after ping-pong'ing back and forth between native and JS
+        code a few times, if we have a stack overflow on re-entry into the VM to run
+        JS code's whose stack frame would overflow the JS stack, the code will end up
+        unwinding past the native function that is making the call to re-enter the VM.
+        As a result, any clean up code (e.g. destructors for stack variables) in the
+        skipped native function frame (and its chain of native function callers) will
+        not be called.
+
+        This patch is based on the Michael Saboff's fix of this issue landed on the
+        jsc-tailcall branch: http://trac.webkit.org/changeset/188555
+
+        We now check for the case where there are no JS frames to unwind since the
+        last native frame, and treat the exception as an unhandled exception.  The
+        native function is responsible for further propagating the exception if needed.
+
+        Other supporting work:
+        1. Remove vm->vmEntryFrameForThrow.  It should always be the same as
+           vm->topVMEntryFrame.
+        2. Change operationThrowStackOverflowError() to use the throwStackOverflowError()
+           helper function instead of rolling its own.
+        3. In the LLINT vm entry, set vm->topVMEntryFrame as soon as the entry frame is
+           fully initialized (instead of waiting).  With this, we can always reliably
+           tell which VMEntryFrame is on top.
+        4. Added a test that exercises this edge case.  The test should not hang or crash.
+
+        * API/tests/PingPongStackOverflowTest.cpp: Added.
+        (PingPongStackOverflowObject_hasInstance):
+        (testPingPongStackOverflow):
+        * API/tests/PingPongStackOverflowTest.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::getStackFrameCodeType):
+        (JSC::UnwindFunctor::UnwindFunctor):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::unwind):
+        * interpreter/Interpreter.h:
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        (JSC::NativeCallFrameTracerWithRestore::NativeCallFrameTracerWithRestore):
+        (JSC::NativeCallFrameTracerWithRestore::~NativeCallFrameTracerWithRestore):
+        (JSC::Interpreter::sampler):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::jumpToExceptionHandler):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITExceptions.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOperations.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/VM.h:
+        (JSC::VM::exceptionOffset):
+        (JSC::VM::callFrameForThrowOffset):
+        (JSC::VM::vmEntryFrameForThrowOffset): Deleted.
+        (JSC::VM::topVMEntryFrameOffset): Deleted.
+
+2015-09-04  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the division and modulo instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148791
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements the unsigned division, signed modulo, and unsigned
+        modulo instructions for 32-bit integers in WebAssembly. It also
+        implements the context pool index instructions, which are needed for
+        testing. (pack-asmjs puts numbers that are used more than once in the
+        constant pool.)
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::divl_r):
+        * tests/stress/wasm-arithmetic.js:
+        * tests/stress/wasm-arithmetic.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::operationMod):
+        (JSC::operationUnsignedDiv):
+        (JSC::operationUnsignedMod):
+        (JSC::WASMFunctionCompiler::buildBinaryI32):
+        (JSC::WASMFunctionCompiler::callOperation):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionI32):
+        * wasm/WASMFunctionParser.h:
+
+2015-09-04  Basile Clement  <basile_clement@apple.com>
+
+        Fix debug output for an eval call
+        https://bugs.webkit.org/show_bug.cgi?id=148839
+
+        Reviewed by Filip Pizlo.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualThunkFor):
+
+2015-09-04  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the signed division instruction in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148772
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements the signed division instruction in WebAssembly
+        for 32-bit integers. We use the IDIV instruction on x86 and x86-64 and
+        use a C function on all other platforms. We throw an exception if
+        - the denominator is zero, or
+        - the numerator is -2^31 and the denominator is -1.
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * tests/stress/wasm-arithmetic.js:
+        (shouldBe):
+        (shouldThrow):
+        * tests/stress/wasm-arithmetic.wasm:
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::operationDiv):
+        (JSC::WASMFunctionCompiler::endFunction):
+        (JSC::WASMFunctionCompiler::buildBinaryI32):
+        (JSC::WASMFunctionCompiler::appendCall):
+        (JSC::WASMFunctionCompiler::appendCallWithExceptionCheck):
+        (JSC::WASMFunctionCompiler::callOperation):
+        (JSC::WASMFunctionCompiler::throwStackOverflowError): Deleted.
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseExpressionI32):
+
+2015-09-04  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement the GetLocal and SetLocal instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148793
+
+        Reviewed by Saam Barati.
+
+        This patch implements the GetLocal and SetLocal instructions for locals
+        of type int32 in WebAssembly. A "local" in this context is either an
+        argument or a local variable.
+
+        * tests/stress/wasm-locals.js: Added.
+        (shouldBe):
+        * tests/stress/wasm-locals.wasm: Added.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::buildSetLocal):
+        (JSC::WASMFunctionCompiler::buildGetLocal):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseSetLocalStatement):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseGetLocalExpressionI32):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::buildSetLocal):
+        (JSC::WASMFunctionSyntaxChecker::buildGetLocal):
+
+2015-09-04  Basile Clement  <basile_clement@apple.com>
+
+        Unreviewed, add missing copyright to file from r189336
+
+        * bytecompiler/SetForScope.h:
+
+2015-09-04  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: InspectorController should support multiple frontend channels
+        https://bugs.webkit.org/show_bug.cgi?id=148538
+
+        Reviewed by Joseph Pecoraro.
+
+        Instead of a singleton, it should be possible to have multiple channels open
+        at the same time and to individually close channels as frontends come and go.
+
+        The FrontendRouter class keeps a list of open FrontendChannels and sends messages
+        to the appropriate frontends based on whether the message is a response or event.
+        Each InspectorController owns a single FrontendRouter and BackendDispatcher instance.
+        Inspector backend code that sends messages to the frontend should switch over to
+        using the router rather than directly using a FrontendChannel.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorBackendDispatcher.cpp: Move constructors/destructors out of the header
+        to avoid including InspectorFrontendRouter everywhere. Use the router instead of a
+        specific frontend channel. Remove guards that are no longer necessary since the router
+        is guaranteed to outlive the backend dispatcher.
+
+        (Inspector::SupplementalBackendDispatcher::SupplementalBackendDispatcher):
+        (Inspector::SupplementalBackendDispatcher::~SupplementalBackendDispatcher):
+        (Inspector::BackendDispatcher::BackendDispatcher):
+        (Inspector::BackendDispatcher::create):
+        (Inspector::BackendDispatcher::isActive):
+        (Inspector::BackendDispatcher::registerDispatcherForDomain):
+        (Inspector::BackendDispatcher::sendResponse):
+        (Inspector::BackendDispatcher::sendPendingErrors):
+        * inspector/InspectorBackendDispatcher.h:
+        (Inspector::SupplementalBackendDispatcher::SupplementalBackendDispatcher): Deleted.
+        (Inspector::SupplementalBackendDispatcher::~SupplementalBackendDispatcher): Deleted.
+        (Inspector::BackendDispatcher::clearFrontend): Deleted, no longer necessary.
+        (Inspector::BackendDispatcher::isActive): Moved to implementation file.
+        (Inspector::BackendDispatcher::BackendDispatcher): Moved to implementation file.
+        * inspector/InspectorFrontendRouter.cpp: Added.
+        (Inspector::FrontendRouter::create):
+        (Inspector::FrontendRouter::connectFrontend):
+        (Inspector::FrontendRouter::disconnectFrontend):
+        (Inspector::FrontendRouter::disconnectAllFrontends):
+        (Inspector::FrontendRouter::leakChannel):
+        (Inspector::FrontendRouter::hasLocalFrontend):
+        (Inspector::FrontendRouter::hasRemoteFrontend):
+        (Inspector::FrontendRouter::sendEvent):
+        (Inspector::FrontendRouter::sendResponse):
+        * inspector/InspectorFrontendRouter.h: Added.
+        * inspector/JSGlobalObjectInspectorController.cpp: Remove guards that are no longer necessary.
+        The frontend router and backend dispatcher now have the same lifetime as the controller.
+        Explicitly connect/disconnect the frontend channel.
+
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectAllFrontends):
+        (Inspector::JSGlobalObjectInspectorController::dispatchMessageFromFrontend):
+        (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
+        (Inspector::JSGlobalObjectInspectorController::pause): Deleted.
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.cpp:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        * inspector/augmentable/AugmentableInspectorController.h:
+        (Inspector::AugmentableInspectorController::connected):
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::close):
+        * inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py:
+        (CppAlternateBackendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event): Use the router.
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        * runtime/JSGlobalObjectDebuggable.h:
+
+2015-09-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Expand Console domain test coverage
+        https://bugs.webkit.org/show_bug.cgi?id=148740
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/Console.json:
+        Update the description of this command now that it only
+        manipulates $0, and not $1, $2, .. $n.
+
+2015-09-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Test RuntimeAgent.parse, detecting if a script parse error is recoverable
+        https://bugs.webkit.org/show_bug.cgi?id=148790
+
+        Reviewed by Timothy Hatcher.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::printUnexpectedTokenText):
+        * parser/ParserTokens.h:
+        More consistently name and treat unterminated numeric literals.
+
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        Treat multiline capable unterminated literals as recoverable.
+
+2015-08-25  Basile Clement  <basile_clement@apple.com>
+
+        Get rid of FTLValueFormat
+        https://bugs.webkit.org/show_bug.cgi?id=148448
+
+        Reviewed by Michael Saboff.
+
+        FTL::ValueFormat is nothing more than DataFormat (and is actually
+        slightly less). Let's get rid of it.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/DataFormat.cpp: Renamed from Source/JavaScriptCore/ftl/FTLValueFormat.h.
+        (WTF::printInternal):
+        * bytecode/DataFormat.h:
+        * ftl/FTLAvailableRecovery.h:
+        (JSC::FTL::AvailableRecovery::AvailableRecovery):
+        (JSC::FTL::AvailableRecovery::format):
+        * ftl/FTLExitArgument.h:
+        (JSC::FTL::ExitArgument::ExitArgument):
+        (JSC::FTL::ExitArgument::operator!):
+        (JSC::FTL::ExitArgument::format):
+        (JSC::FTL::ExitArgument::withFormat):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dataFormat):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::recovery):
+        (JSC::FTL::ExitValue::recoveryFormat):
+        * ftl/FTLFormattedValue.h:
+        (JSC::FTL::FormattedValue::FormattedValue):
+        (JSC::FTL::FormattedValue::operator!):
+        (JSC::FTL::FormattedValue::format):
+        (JSC::FTL::int32Value):
+        (JSC::FTL::booleanValue):
+        (JSC::FTL::jsValueValue):
+        (JSC::FTL::doubleValue):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::convertDoubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitArgument):
+        (JSC::FTL::DFG::LowerDFGToLLVM::addAvailableRecovery):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::OSRExit):
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::reboxAccordingToFormat):
+        (JSC::FTL::compileRecovery):
+        (JSC::FTL::compileStub):
+        * ftl/FTLValueFormat.cpp: Removed.
+
+2015-09-04  Basile Clement  <basile_clement@apple.com>
+
+        Introduce RegisterMap<T>
+        https://bugs.webkit.org/show_bug.cgi?id=148335
+
+        Reviewed by Michael Saboff.
+
+        Introduce RegisterMap<T>, GPRMap<T> and FPRMap<T> dense mappings for
+        Reg, GPRReg and FPRReg.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/RegisterMap.h: Added.
+        (JSC::RegisterMap::operator[]):
+        (JSC::GPRMap::operator[]):
+        (JSC::FPRMap::operator[]):
+
+2015-09-04  Andreas Kling  <akling@apple.com>
+
+        Remove some unused functions from MarkedBlock and MarkedSpace.
+        <https://webkit.org/b/148748>
+
+        Reviewed by Darin Adler.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::offsetOfMarks): Deleted.
+        (JSC::MarkedBlock::didConsumeEmptyFreeList): Deleted.
+        * heap/MarkedSpace.h:
+
+2015-09-04  Basile Clement  <basile_clement@apple.com>
+
+        Make a bunch of MacroAssembler operations constexpr
+        https://bugs.webkit.org/show_bug.cgi?id=148334
+
+        Reviewed by Saam Barati.
+
+        This is in preparation of https://bugs.webkit.org/show_bug.cgi?id=148335 .
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Registers::isSp):
+        (JSC::ARM64Registers::isZr):
+        (JSC::ARM64Assembler::firstRegister):
+        (JSC::ARM64Assembler::lastRegister):
+        (JSC::ARM64Assembler::firstFPRegister):
+        (JSC::ARM64Assembler::lastFPRegister):
+        (JSC::ARM64Assembler::isSp):
+        (JSC::ARM64Assembler::isZr):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::firstRegister):
+        (JSC::ARMAssembler::lastRegister):
+        (JSC::ARMAssembler::firstFPRegister):
+        (JSC::ARMAssembler::lastFPRegister):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::firstRegister):
+        (JSC::AbstractMacroAssembler::lastRegister):
+        (JSC::AbstractMacroAssembler::firstFPRegister):
+        (JSC::AbstractMacroAssembler::lastFPRegister):
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::firstRegister):
+        (JSC::MIPSAssembler::lastRegister):
+        (JSC::MIPSAssembler::firstFPRegister):
+        (JSC::MIPSAssembler::lastFPRegister):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::nextRegister):
+        (JSC::MacroAssembler::nextFPRegister):
+        (JSC::MacroAssembler::numberOfRegisters):
+        (JSC::MacroAssembler::registerIndex):
+        (JSC::MacroAssembler::numberOfFPRegisters):
+        (JSC::MacroAssembler::fpRegisterIndex):
+        (JSC::MacroAssembler::totalNumberOfRegisters):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::firstRegister):
+        (JSC::SH4Assembler::lastRegister):
+        (JSC::SH4Assembler::firstFPRegister):
+        (JSC::SH4Assembler::lastFPRegister):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::firstRegister):
+        (JSC::X86Assembler::lastRegister):
+        (JSC::X86Assembler::firstFPRegister):
+        (JSC::X86Assembler::lastFPRegister):
+
+2015-08-24  Basile Clement  <basile_clement@apple.com>
+
+        Add a bunch of operators
+        https://bugs.webkit.org/show_bug.cgi?id=148337
+
+        Reviewed by Saam Barati.
+
+        * jit/GPRInfo.h:
+        (JSC::JSValueRegs::operator bool):
+        (JSC::JSValueRegs::operator==):
+        (JSC::JSValueRegs::operator!=):
+        (JSC::JSValueSource::operator bool):
+        (JSC::JSValueRegs::operator!):
+        (JSC::JSValueSource::operator!):
+        * jit/Reg.h:
+        (JSC::Reg::operator bool):
+
+2015-09-04  Basile Clement  <basile_clement@apple.com>
+
+        Since r189341, es6.yaml/es6/arrow_functions_no_prototype_property.js is expected to succeed
+
+        Rubber stamped by Michael Saboff.
+
+        * tests/es6.yaml:
+
+2015-09-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Fix the ARM Traditional build after r189288
+        https://bugs.webkit.org/show_bug.cgi?id=148792
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARM.h: Make repatchCall public similar to changes in r189288.
+        (JSC::MacroAssemblerARM::repatchCall):
+
+2015-09-03 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        [ES6] Implement ES6 arrow function syntax. Prototype of arrow function should be undefined
+        https://bugs.webkit.org/show_bug.cgi?id=147742
+
+        Reviewed by Saam Barati.
+
+        Added correct support of prototype property for arrow function. Arrow function 
+        doesn’t have own prototype property, so (() => {}).hasOwnProperty('prototype') === false.
+        Changes prevent from creation of 'prototype' property automatically during initialization 
+        of arrow function and allow to assign & delete it later in js code. 
+
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::deleteProperty):
+        * tests/stress/arrowfunction-prototype.js: Added.
+
+2015-09-03  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189338.
+        https://bugs.webkit.org/show_bug.cgi?id=148785
+
+        Caused tons of crashes (Requested by cdumez on #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: InspectorController should support multiple
+        frontend channels"
+        https://bugs.webkit.org/show_bug.cgi?id=148538
+        http://trac.webkit.org/changeset/189338
+
+2015-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Instantiate Module Environment bindings and execute module
+        https://bugs.webkit.org/show_bug.cgi?id=148053
+
+        Reviewed by Saam Barati.
+
+        This patch implements Module Environment binding instantiation.
+        And since the layout of the module environment is tightly coupled with the variable
+        look up in LLInt / Baseline / DFG, we implement the execution part at the same time.
+
+        For the instantiation, we implement the several operations (like resolveExport)
+        specified in the spec. The original algorithm contains the recursive call, but it is not
+        good for C++ code. We flatten the algorithm by using the manual frames to avoid recursions.
+        By leveraging the information retrieved by the above operations, we instantiate and
+        initialize the slots of the module environment.
+
+        The module namespace object is not implemented yet in this patch. It will be implemented
+        and instantiated in the module environment in the subsequent patch[1].
+
+        To look up the imported module bindings in the JS code, we introduce the "ModuleVar" resolve
+        type for resolve_scope, get_from_scope and put_to_scope. This "ModuleVar" will be filled
+        when linking the CodeBlock. This type is used when treating the imported bindings.
+
+        1. For resolve_scope, when linking, we resolve the actual module environment where
+            looked up variable resides and store it directly to the instruction. And resolve_scope
+            simply retrieve the stored pointer from the instruction.
+
+        2. For get_from_scope, since "ModuleVar" behavior for get_from_scope is completely same
+            to the "ClosureVar", we just store "ClosureVar" for get_from_scope to eliminate
+            unnecessary branch in LLInt layer.
+
+        3. For put_to_scope, we always emit the function call that immediately raises the error.
+            Because all the imported bindings are immutable and module code is always strict code.
+            In DFG, we just emit the ForceOSRExit. We don't make put_to_scope with "ModuleVar"
+            "CannotCompile" because it disables DFG compiling for the function even if this
+            problematic instruction is never executed.
+
+        Exported module variables inside the original module environment are just treated as the
+        usual heap variables. So the types for closure variables are just used. ("ClosureVar" etc.)
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=148705
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedModuleProgramCodeBlock::visitChildren): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * interpreter/Interpreter.h:
+        * jit/JITOperations.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::exportVariable):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Error.cpp:
+        (JSC::throwSyntaxError):
+        * runtime/Error.h:
+        * runtime/Executable.cpp:
+        (JSC::ModuleProgramExecutable::create):
+        (JSC::ModuleProgramExecutable::visitChildren):
+        (JSC::ModuleProgramExecutable::clearCode):
+        * runtime/Executable.h:
+        * runtime/GetPutInfo.h:
+        (JSC::resolveTypeName):
+        (JSC::makeType):
+        (JSC::needsVarInjectionChecks):
+        (JSC::ResolveOp::ResolveOp):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::moduleEnvironmentStructure):
+        * runtime/JSLexicalEnvironment.h:
+        * runtime/JSModuleEnvironment.cpp: Added.
+        (JSC::JSModuleEnvironment::create):
+        (JSC::JSModuleEnvironment::finishCreation):
+        (JSC::JSModuleEnvironment::visitChildren):
+        (JSC::JSModuleEnvironment::getOwnPropertySlot):
+        (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
+        (JSC::JSModuleEnvironment::put):
+        (JSC::JSModuleEnvironment::deleteProperty):
+        * runtime/JSModuleEnvironment.h: Copied from Source/JavaScriptCore/runtime/JSLexicalEnvironment.h.
+        (JSC::JSModuleEnvironment::create):
+        (JSC::JSModuleEnvironment::createStructure):
+        (JSC::JSModuleEnvironment::offsetOfModuleRecord):
+        (JSC::JSModuleEnvironment::allocationSize):
+        (JSC::JSModuleEnvironment::moduleRecord):
+        (JSC::JSModuleEnvironment::moduleRecordSlot):
+        (JSC::JSModuleEnvironment::JSModuleEnvironment):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::visitChildren):
+        (JSC::JSModuleRecord::appendRequestedModule):
+        (JSC::JSModuleRecord::addStarExportEntry):
+        (JSC::JSModuleRecord::addImportEntry):
+        (JSC::JSModuleRecord::addExportEntry):
+        (JSC::ResolveQuery::ResolveQuery):
+        (JSC::ResolveQuery::isEmptyValue):
+        (JSC::ResolveQuery::isDeletedValue):
+        (JSC::ResolveQueryHash::hash):
+        (JSC::ResolveQueryHash::equal):
+        (JSC::resolveExportLoop):
+        (JSC::JSModuleRecord::link):
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        (JSC::JSModuleRecord::execute):
+        (JSC::JSModuleRecord::dump):
+        * runtime/JSModuleRecord.h:
+        (JSC::JSModuleRecord::exportEntries):
+        (JSC::JSModuleRecord::importEntries):
+        (JSC::JSModuleRecord::starExportEntries):
+        (JSC::JSModuleRecord::moduleEnvironment):
+        (JSC::JSModuleRecord::appendRequestedModule): Deleted.
+        (JSC::JSModuleRecord::addImportEntry): Deleted.
+        (JSC::JSModuleRecord::addExportEntry): Deleted.
+        (JSC::JSModuleRecord::addStarExportEntry): Deleted.
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        (JSC::JSScope::collectVariablesUnderTDZ):
+        (JSC::JSScope::isModuleScope):
+        * runtime/JSScope.h:
+        * runtime/ModuleLoaderObject.cpp:
+
+2015-09-03  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: InspectorController should support multiple frontend channels
+        https://bugs.webkit.org/show_bug.cgi?id=148538
+
+        Reviewed by Joseph Pecoraro.
+
+        Instead of a singleton, it should be possible to have multiple channels open
+        at the same time and to individually close channels as frontends come and go.
+
+        The FrontendRouter class keeps a list of open FrontendChannels and sends messages
+        to the appropriate frontends based on whether the message is a response or event.
+        Each InspectorController owns a single FrontendRouter and BackendDispatcher instance.
+        Inspector backend code that sends messages to the frontend should switch over to
+        using the router rather than directly using a FrontendChannel.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorBackendDispatcher.cpp: Move constructors/destructors out of the header
+        to avoid including InspectorFrontendRouter everywhere. Use the router instead of a
+        specific frontend channel. Remove guards that are no longer necessary since the router
+        is guaranteed to outlive the backend dispatcher.
+
+        (Inspector::SupplementalBackendDispatcher::SupplementalBackendDispatcher):
+        (Inspector::SupplementalBackendDispatcher::~SupplementalBackendDispatcher):
+        (Inspector::BackendDispatcher::BackendDispatcher):
+        (Inspector::BackendDispatcher::create):
+        (Inspector::BackendDispatcher::isActive):
+        (Inspector::BackendDispatcher::registerDispatcherForDomain):
+        (Inspector::BackendDispatcher::sendResponse):
+        (Inspector::BackendDispatcher::sendPendingErrors):
+        * inspector/InspectorBackendDispatcher.h:
+        (Inspector::SupplementalBackendDispatcher::SupplementalBackendDispatcher): Deleted.
+        (Inspector::SupplementalBackendDispatcher::~SupplementalBackendDispatcher): Deleted.
+        (Inspector::BackendDispatcher::clearFrontend): Deleted, no longer necessary.
+        (Inspector::BackendDispatcher::isActive): Moved to implementation file.
+        (Inspector::BackendDispatcher::BackendDispatcher): Moved to implementation file.
+        * inspector/InspectorFrontendRouter.cpp: Added.
+        (Inspector::FrontendRouter::create):
+        (Inspector::FrontendRouter::connectFrontend):
+        (Inspector::FrontendRouter::disconnectFrontend):
+        (Inspector::FrontendRouter::disconnectAllFrontends):
+        (Inspector::FrontendRouter::leakChannel):
+        (Inspector::FrontendRouter::hasLocalFrontend):
+        (Inspector::FrontendRouter::hasRemoteFrontend):
+        (Inspector::FrontendRouter::sendEvent):
+        (Inspector::FrontendRouter::sendResponse):
+        * inspector/InspectorFrontendRouter.h: Added.
+        * inspector/JSGlobalObjectInspectorController.cpp: Remove guards that are no longer necessary.
+        The frontend router and backend dispatcher now have the same lifetime as the controller.
+        Explicitly connect/disconnect the frontend channel.
+
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectAllFrontends):
+        (Inspector::JSGlobalObjectInspectorController::dispatchMessageFromFrontend):
+        (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
+        (Inspector::JSGlobalObjectInspectorController::pause): Deleted.
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.cpp:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        * inspector/augmentable/AugmentableInspectorController.h:
+        (Inspector::AugmentableInspectorController::connected):
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::close):
+        * inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py:
+        (CppAlternateBackendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event): Use the router.
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        * runtime/JSGlobalObjectDebuggable.h:
+
+2015-09-03  Basile Clement  <basile_clement@apple.com>
+
+        [ES6] Recognize calls in tail position
+        https://bugs.webkit.org/show_bug.cgi?id=148665
+
+        Reviewed by Saam Barati.
+
+        This patch adds the capability for the bytecode generator to recognize
+        and dispatch tail calls, as per ES6 spec:
+        http://www.ecma-international.org/ecma-262/6.0/#sec-isintailposition
+
+        This does not change the generated bytecode, but merely provides the
+        hook for generating tail calls in subsequent patches toward
+        https://bugs.webkit.org/show_bug.cgi?id=146477
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCallInTailPosition):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::emitNodeInTailPosition):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::LogicalOpNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::SourceElements::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * bytecompiler/SetForScope.h: Added.
+        (JSC::SetForScope::SetForScope):
+        (JSC::SetForScope::~SetForScope):
+        * runtime/Options.h:
+
+2015-08-11  Basile Clement  <basile_clement@apple.com>
+
+        Add more strict mode tests
+        https://bugs.webkit.org/show_bug.cgi?id=147850
+
+        Reviewed by Michael Saboff.
+
+        We should have more tests in strict mode to have better test coverage.
+        This adds a copy of the v8-v6 tests from SunSpider as JSC stress tests,
+        with "use strict"; added at the top of the files.
+
+        A few modifications were necessary to make the files valid in strict
+        mode, namely adding a couple of "var" statements and removing some
+        generated code in earley-boyer that was using strings with octal
+        escapes.
+
+        * tests/stress/v8-crypto-strict.js: Added.
+        * tests/stress/v8-deltablue-strict.js: Added.
+        * tests/stress/v8-earley-boyer-strict.js: Added.
+        * tests/stress/v8-raytrace-strict.js: Added.
+        * tests/stress/v8-regexp-strict.js: Added.
+        * tests/stress/v8-richards-strict.js: Added.
+        * tests/stress/v8-splay-strict.js: Added.
+
+2015-09-03  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptCore should have some ES6 conformance tests
+        https://bugs.webkit.org/show_bug.cgi?id=148771
+
+        Reviewed by Chris Dumez.
+
+        I created 590 independent, reduced test cases that collectively tell us
+        whether we pass or fail the conformance matrix @ http://kangax.github.io/compat-table/es6/.
+
+        * tests/es6: Added.
+        * tests/es6.yaml: Added.
+        * tests/es6/Array.prototype_methods_Array.prototype.copyWithin.js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array.prototype.entries.js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array.prototype.fill.js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array.prototype.find.js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array.prototype.findIndex.js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array.prototype.keys.js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array.prototype.values.js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array.prototype[Symbol.iterator].js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array.prototype[Symbol.unscopables].js: Added.
+        (test):
+        * tests/es6/Array.prototype_methods_Array_iterator_prototype_chain.js: Added.
+        (test):
+        * tests/es6/Array_is_subclassable_Array.from.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_Array.isArray_support.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_Array.of.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_Array.prototype.concat.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_Array.prototype.filter.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_Array.prototype.map.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_Array.prototype.slice.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_Array.prototype.splice.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_correct_prototype_chain.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_length_property_accessing.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_is_subclassable_length_property_setting.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Array_static_methods_Array.from_array-like_objects.js: Added.
+        (test):
+        * tests/es6/Array_static_methods_Array.from_generator_instances.js: Added.
+        (test.iterable):
+        (test):
+        * tests/es6/Array_static_methods_Array.from_generic_iterables.js: Added.
+        (test):
+        * tests/es6/Array_static_methods_Array.from_instances_of_generic_iterables.js: Added.
+        (test):
+        * tests/es6/Array_static_methods_Array.from_iterator_closing.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Array_static_methods_Array.from_map_function_array-like_objects.js: Added.
+        (test):
+        * tests/es6/Array_static_methods_Array.from_map_function_generator_instances.js: Added.
+        (test.iterable):
+        (test):
+        * tests/es6/Array_static_methods_Array.from_map_function_generic_iterables.js: Added.
+        (test):
+        * tests/es6/Array_static_methods_Array.from_map_function_instances_of_iterables.js: Added.
+        (test):
+        * tests/es6/Array_static_methods_Array.of.js: Added.
+        (test):
+        * tests/es6/Array_static_methods_Array[Symbol.species].js: Added.
+        (test):
+        * tests/es6/Function_is_subclassable_Function.prototype.apply.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Function_is_subclassable_Function.prototype.bind.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Function_is_subclassable_Function.prototype.call.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Function_is_subclassable_can_be_called.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Function_is_subclassable_can_be_used_with_new.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Function_is_subclassable_correct_prototype_chain.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/HTML-style_comments.js: Added.
+        (test):
+        * tests/es6/Map_-0_key_converts_to_+0.js: Added.
+        (test.set var):
+        * tests/es6/Map_Map.prototype.clear.js: Added.
+        (test):
+        * tests/es6/Map_Map.prototype.delete.js: Added.
+        (test):
+        * tests/es6/Map_Map.prototype.entries.js: Added.
+        (test):
+        * tests/es6/Map_Map.prototype.forEach.js: Added.
+        (test):
+        * tests/es6/Map_Map.prototype.keys.js: Added.
+        (test):
+        * tests/es6/Map_Map.prototype.set_returns_this.js: Added.
+        * tests/es6/Map_Map.prototype.size.js: Added.
+        * tests/es6/Map_Map.prototype.values.js: Added.
+        (test):
+        * tests/es6/Map_Map.prototype[Symbol.iterator].js: Added.
+        (test):
+        * tests/es6/Map_Map[Symbol.species].js: Added.
+        (test):
+        * tests/es6/Map_Map_iterator_prototype_chain.js: Added.
+        (test):
+        * tests/es6/Map_basic_functionality.js: Added.
+        * tests/es6/Map_constructor_accepts_null.js: Added.
+        (test):
+        * tests/es6/Map_constructor_arguments.js: Added.
+        * tests/es6/Map_constructor_invokes_set.js: Added.
+        * tests/es6/Map_constructor_requires_new.js: Added.
+        (test):
+        * tests/es6/Map_iterator_closing.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Math_methods_Math.acosh.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.asinh.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.atanh.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.cbrt.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.clz32.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.cosh.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.expm1.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.fround.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.hypot.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.imul.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.log10.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.log1p.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.log2.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.sign.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.sinh.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.tanh.js: Added.
+        (test):
+        * tests/es6/Math_methods_Math.trunc.js: Added.
+        (test):
+        * tests/es6/Number_properties_Number.EPSILON.js: Added.
+        (test):
+        * tests/es6/Number_properties_Number.MAX_SAFE_INTEGER.js: Added.
+        (test):
+        * tests/es6/Number_properties_Number.MIN_SAFE_INTEGER.js: Added.
+        (test):
+        * tests/es6/Number_properties_Number.isFinite.js: Added.
+        (test):
+        * tests/es6/Number_properties_Number.isInteger.js: Added.
+        (test):
+        * tests/es6/Number_properties_Number.isNaN.js: Added.
+        (test):
+        * tests/es6/Number_properties_Number.isSafeInteger.js: Added.
+        (test):
+        * tests/es6/Object.prototype.__proto___absent_from_Object.createnull.js: Added.
+        (test):
+        * tests/es6/Object.prototype.__proto___correct_property_descriptor.js: Added.
+        (test.A):
+        (test):
+        * tests/es6/Object.prototype.__proto___get_prototype.js: Added.
+        (test.A):
+        (test):
+        * tests/es6/Object.prototype.__proto___present_in_Object.getOwnPropertyNames.js: Added.
+        (test):
+        * tests/es6/Object.prototype.__proto___present_in_hasOwnProperty.js: Added.
+        (test):
+        * tests/es6/Object.prototype.__proto___set_prototype.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_Object.assign.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_Object.getOwnPropertySymbols.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_Object.is.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_Object.setPrototypeOf.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.freeze.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.getOwnPropertyDescriptor.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.getOwnPropertyNames.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.getPrototypeOf.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.isExtensible.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.isFrozen.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.isSealed.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.keys.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.preventExtensions.js: Added.
+        (test):
+        * tests/es6/Object_static_methods_accept_primitives_Object.seal.js: Added.
+        (test):
+        * tests/es6/Promise_Promise.all.js: Added.
+        (test):
+        * tests/es6/Promise_Promise.all_generic_iterables.js: Added.
+        (test):
+        * tests/es6/Promise_Promise.race.js: Added.
+        (test):
+        * tests/es6/Promise_Promise.race_generic_iterables.js: Added.
+        (test):
+        * tests/es6/Promise_Promise[Symbol.species].js: Added.
+        (test):
+        * tests/es6/Promise_basic_functionality.js: Added.
+        (test.thenFn):
+        (test.catchFn):
+        (test.shouldNotRun):
+        (test):
+        * tests/es6/Promise_constructor_requires_new.js: Added.
+        (test):
+        * tests/es6/Promise_is_subclassable_Promise.all.js: Added.
+        (test.P):
+        (test):
+        * tests/es6/Promise_is_subclassable_Promise.race.js: Added.
+        (test.P):
+        (test):
+        * tests/es6/Promise_is_subclassable_basic_functionality.js: Added.
+        (test.P):
+        (test):
+        (test.catchFn):
+        (test.shouldNotRun):
+        * tests/es6/Promise_is_subclassable_correct_prototype_chain.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/Proxy_Array.isArray_support.js: Added.
+        (test):
+        * tests/es6/Proxy_JSON.stringify_support.js: Added.
+        (test):
+        * tests/es6/Proxy_Proxy.revocable.js: Added.
+        (test.):
+        (test.get var):
+        (test):
+        * tests/es6/Proxy_apply_handler.js: Added.
+        (test.proxied):
+        (test.host.):
+        (test):
+        * tests/es6/Proxy_construct_handler.js: Added.
+        (test.proxied):
+        (test.):
+        (test):
+        * tests/es6/Proxy_constructor_requires_new.js: Added.
+        (test):
+        * tests/es6/Proxy_defineProperty_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_deleteProperty_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_enumerate_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_getOwnPropertyDescriptor_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_getPrototypeOf_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_get_handler.js: Added.
+        (test.):
+        * tests/es6/Proxy_get_handler_instances_of_proxies.js: Added.
+        (test.):
+        * tests/es6/Proxy_has_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_has_handler_instances_of_proxies.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_defineProperty_calls_SetIntegrityLevel.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_defineProperty_calls_[[Set]].js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_deleteProperty_calls_Array.prototype.copyWithin.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_deleteProperty_calls_Array.prototype.pop.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_deleteProperty_calls_Array.prototype.reverse.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_deleteProperty_calls_Array.prototype.shift.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_deleteProperty_calls_Array.prototype.splice.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_deleteProperty_calls_Array.prototype.unshift.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_getOwnPropertyDescriptor_calls_Function.prototype.bind.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_getOwnPropertyDescriptor_calls_Object.assign.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_getOwnPropertyDescriptor_calls_Object.prototype.hasOwnProperty.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_getOwnPropertyDescriptor_calls_[[Set]].js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_get_calls_Array.from.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_Array.prototype.concat.js: Added.
+        (test.):
+        (test.get var):
+        * tests/es6/Proxy_internal_get_calls_Array.prototype.pop.js: Added.
+        (test.):
+        (test.get var):
+        * tests/es6/Proxy_internal_get_calls_Array.prototype.reverse.js: Added.
+        (test.):
+        (test.get var):
+        * tests/es6/Proxy_internal_get_calls_Array.prototype.shift.js: Added.
+        (test.):
+        (test.get var):
+        * tests/es6/Proxy_internal_get_calls_Array.prototype.splice.js: Added.
+        (test.):
+        (test.get var):
+        * tests/es6/Proxy_internal_get_calls_Array.prototype.toString.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_Array.prototype_iteration_methods.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_ClassDefinitionEvaluation.js: Added.
+        (test.):
+        (test.get var):
+        (test):
+        * tests/es6/Proxy_internal_get_calls_CreateDynamicFunction.js: Added.
+        (test.):
+        (test.get var):
+        * tests/es6/Proxy_internal_get_calls_CreateListFromArrayLike.js: Added.
+        (test.get var):
+        (test.):
+        (test.get Function):
+        * tests/es6/Proxy_internal_get_calls_Date.prototype.toJSON.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_Error.prototype.toString.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_Function.prototype.bind.js: Added.
+        (test.):
+        (test.get var):
+        * tests/es6/Proxy_internal_get_calls_HasBinding.js: Added.
+        (test.get var):
+        (test.):
+        (test.get p):
+        * tests/es6/Proxy_internal_get_calls_IteratorComplete_IteratorValue.js: Added.
+        (test.get var):
+        (test.iterable.Symbol.iterator.return.next.):
+        (test.iterable.Symbol.iterator.return.next):
+        (test.iterable.Symbol.iterator):
+        * tests/es6/Proxy_internal_get_calls_JSON.stringify.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_Object.assign.js: Added.
+        (test.get var):
+        (test.):
+        (test.get Object):
+        * tests/es6/Proxy_internal_get_calls_Object.defineProperties.js: Added.
+        (test.get var):
+        (test.):
+        (test.get Object):
+        * tests/es6/Proxy_internal_get_calls_Promise_resolve_functions.js: Added.
+        (test.get var):
+        (test.):
+        (test.get new):
+        * tests/es6/Proxy_internal_get_calls_RegExp.prototype.flags.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_RegExp.prototype.test.js: Added.
+        (test.get var.p.new.Proxy):
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.match].js: Added.
+        (test.get var.p.new.Proxy):
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.replace].js: Added.
+        (test.get var.p.new.Proxy):
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js: Added.
+        (test.get var.p.new.Proxy):
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.split].js: Added.
+        (test.p.new.Proxy):
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_RegExp_constructor.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_String.prototype.match.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_String.prototype.replace.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_String.prototype.search.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_String.prototype.split.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_String.raw.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_ToPrimitive.js: Added.
+        (test.get var):
+        (test.):
+        * tests/es6/Proxy_internal_get_calls_ToPropertyDescriptor.js: Added.
+        (test.get var):
+        (test.):
+        (test.set get try):
+        * tests/es6/Proxy_internal_get_calls_instanceof_operator.js: Added.
+        (test.):
+        (test.get var):
+        * tests/es6/Proxy_internal_ownKeys_calls_SerializeJSONObject.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_ownKeys_calls_SetIntegrityLevel.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_ownKeys_calls_TestIntegrityLevel.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_internal_set_calls_Array.from.js: Added.
+        (test.set var):
+        (test.):
+        (test.set Array):
+        * tests/es6/Proxy_internal_set_calls_Array.of.js: Added.
+        (test.set var):
+        (test.):
+        (test.set Array):
+        * tests/es6/Proxy_internal_set_calls_Array.prototype.copyWithin.js: Added.
+        (test.):
+        (test.set var):
+        * tests/es6/Proxy_internal_set_calls_Array.prototype.fill.js: Added.
+        (test.):
+        (test.set var):
+        * tests/es6/Proxy_internal_set_calls_Array.prototype.pop.js: Added.
+        (test.):
+        (test.set var):
+        * tests/es6/Proxy_internal_set_calls_Array.prototype.push.js: Added.
+        (test.):
+        (test.set var):
+        * tests/es6/Proxy_internal_set_calls_Array.prototype.reverse.js: Added.
+        (test.):
+        (test.set var):
+        * tests/es6/Proxy_internal_set_calls_Array.prototype.shift.js: Added.
+        (test.):
+        (test.set var):
+        * tests/es6/Proxy_internal_set_calls_Array.prototype.splice.js: Added.
+        (test.):
+        (test.set var):
+        * tests/es6/Proxy_internal_set_calls_Array.prototype.unshift.js: Added.
+        (test.):
+        (test.set var):
+        * tests/es6/Proxy_internal_set_calls_Object.assign.js: Added.
+        (test.set var):
+        (test.):
+        (test.set Object):
+        * tests/es6/Proxy_isExtensible_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_ownKeys_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_preventExtensions_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_setPrototypeOf_handler.js: Added.
+        (test.):
+        (test):
+        * tests/es6/Proxy_set_handler.js: Added.
+        (test.):
+        * tests/es6/Proxy_set_handler_instances_of_proxies.js: Added.
+        (test.):
+        * tests/es6/Reflect_Reflect.apply.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.construct.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.construct_creates_instance_from_newTarget_argument.js: Added.
+        (test.F):
+        (test):
+        * tests/es6/Reflect_Reflect.construct_sets_new.target_meta_property.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.defineProperty.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.deleteProperty.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.enumerate.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.get.js: Added.
+        * tests/es6/Reflect_Reflect.getOwnPropertyDescriptor.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.getPrototypeOf.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.has.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.isExtensible.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.ownKeys_string_keys.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.ownKeys_symbol_keys.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.preventExtensions.js: Added.
+        (test):
+        * tests/es6/Reflect_Reflect.set.js: Added.
+        * tests/es6/Reflect_Reflect.setPrototypeOf.js: Added.
+        (test):
+        * tests/es6/RegExp.prototype.compile.js: Added.
+        (test):
+        * tests/es6/RegExp.prototype_properties_RegExp.prototype.flags.js: Added.
+        (test):
+        * tests/es6/RegExp.prototype_properties_RegExp.prototype[Symbol.match].js: Added.
+        (test):
+        * tests/es6/RegExp.prototype_properties_RegExp.prototype[Symbol.replace].js: Added.
+        (test):
+        * tests/es6/RegExp.prototype_properties_RegExp.prototype[Symbol.search].js: Added.
+        (test):
+        * tests/es6/RegExp.prototype_properties_RegExp.prototype[Symbol.split].js: Added.
+        (test):
+        * tests/es6/RegExp.prototype_properties_RegExp[Symbol.species].js: Added.
+        (test):
+        * tests/es6/RegExp_is_subclassable_RegExp.prototype.exec.js: Added.
+        (test.R):
+        (test):
+        * tests/es6/RegExp_is_subclassable_RegExp.prototype.test.js: Added.
+        (test.R):
+        (test):
+        * tests/es6/RegExp_is_subclassable_basic_functionality.js: Added.
+        (test.R):
+        (test):
+        * tests/es6/RegExp_is_subclassable_correct_prototype_chain.js: Added.
+        (test.R):
+        (test):
+        * tests/es6/RegExp_syntax_extensions_hyphens_in_character_sets.js: Added.
+        (test):
+        * tests/es6/RegExp_syntax_extensions_incomplete_patterns_and_quantifiers.js: Added.
+        * tests/es6/RegExp_syntax_extensions_invalid_Unicode_escapes.js: Added.
+        (test):
+        * tests/es6/RegExp_syntax_extensions_invalid_backreferences_become_octal_escapes.js: Added.
+        (test):
+        * tests/es6/RegExp_syntax_extensions_invalid_character_escapes.js: Added.
+        (test):
+        * tests/es6/RegExp_syntax_extensions_invalid_control-character_escapes.js: Added.
+        (test):
+        * tests/es6/RegExp_syntax_extensions_invalid_hexadecimal_escapes.js: Added.
+        (test):
+        * tests/es6/RegExp_syntax_extensions_octal_escape_sequences.js: Added.
+        (test):
+        * tests/es6/RegExp_y_and_u_flags_u_flag.js: Added.
+        (test):
+        * tests/es6/RegExp_y_and_u_flags_u_flag_Unicode_code_point_escapes.js: Added.
+        (test):
+        * tests/es6/RegExp_y_and_u_flags_y_flag.js: Added.
+        (test):
+        * tests/es6/RegExp_y_and_u_flags_y_flag_lastIndex.js: Added.
+        (test):
+        * tests/es6/Set_-0_key_converts_to_+0.js: Added.
+        (test.set forEach):
+        * tests/es6/Set_Set.prototype.add_returns_this.js: Added.
+        * tests/es6/Set_Set.prototype.clear.js: Added.
+        (test):
+        * tests/es6/Set_Set.prototype.delete.js: Added.
+        (test):
+        * tests/es6/Set_Set.prototype.entries.js: Added.
+        (test):
+        * tests/es6/Set_Set.prototype.forEach.js: Added.
+        (test):
+        * tests/es6/Set_Set.prototype.keys.js: Added.
+        (test):
+        * tests/es6/Set_Set.prototype.size.js: Added.
+        * tests/es6/Set_Set.prototype.values.js: Added.
+        (test):
+        * tests/es6/Set_Set.prototype[Symbol.iterator].js: Added.
+        (test):
+        * tests/es6/Set_Set[Symbol.species].js: Added.
+        (test):
+        * tests/es6/Set_Set_iterator_prototype_chain.js: Added.
+        (test):
+        * tests/es6/Set_basic_functionality.js: Added.
+        * tests/es6/Set_constructor_accepts_null.js: Added.
+        (test):
+        * tests/es6/Set_constructor_arguments.js: Added.
+        * tests/es6/Set_constructor_invokes_add.js: Added.
+        (test.Set.prototype.add):
+        (test):
+        * tests/es6/Set_constructor_requires_new.js: Added.
+        (test):
+        * tests/es6/Set_iterator_closing.js: Added.
+        (test.):
+        (test.Set.prototype.add):
+        (test):
+        * tests/es6/String.prototype_HTML_methods_existence.js: Added.
+        (test):
+        * tests/es6/String.prototype_HTML_methods_quotes_in_arguments_are_escaped.js: Added.
+        (test):
+        * tests/es6/String.prototype_HTML_methods_tags_names_are_lowercase.js: Added.
+        (test):
+        * tests/es6/String.prototype_methods_String.prototype.codePointAt.js: Added.
+        (test):
+        * tests/es6/String.prototype_methods_String.prototype.endsWith.js: Added.
+        (test):
+        * tests/es6/String.prototype_methods_String.prototype.includes.js: Added.
+        (test):
+        * tests/es6/String.prototype_methods_String.prototype.normalize.js: Added.
+        (test):
+        * tests/es6/String.prototype_methods_String.prototype.repeat.js: Added.
+        (test):
+        * tests/es6/String.prototype_methods_String.prototype.startsWith.js: Added.
+        (test):
+        * tests/es6/String.prototype_methods_String.prototype[Symbol.iterator].js: Added.
+        (test):
+        * tests/es6/String.prototype_methods_String_iterator_prototype_chain.js: Added.
+        (test):
+        * tests/es6/String_static_methods_String.fromCodePoint.js: Added.
+        (test):
+        * tests/es6/String_static_methods_String.raw.js: Added.
+        (test):
+        * tests/es6/Symbol_JSON.stringify_ignores_symbols.js: Added.
+        (test):
+        * tests/es6/Symbol_Object.defineProperty_support.js: Added.
+        (test):
+        * tests/es6/Symbol_Objectsymbol.js: Added.
+        (test):
+        * tests/es6/Symbol_basic_functionality.js: Added.
+        (test):
+        * tests/es6/Symbol_can_convert_with_String.js: Added.
+        (test):
+        * tests/es6/Symbol_cannot_coerce_to_string_or_number.js: Added.
+        (test):
+        * tests/es6/Symbol_global_symbol_registry.js: Added.
+        (test):
+        * tests/es6/Symbol_new_Symbol_throws.js: Added.
+        (test):
+        * tests/es6/Symbol_symbol_keys_are_hidden_to_pre-ES6_code.js: Added.
+        (test):
+        * tests/es6/Symbol_typeof_support.js: Added.
+        (test):
+        * tests/es6/Unicode_code_point_escapes_in_identifiers.js: Added.
+        (test):
+        * tests/es6/Unicode_code_point_escapes_in_strings.js: Added.
+        (test):
+        * tests/es6/WeakMap_WeakMap.prototype.delete.js: Added.
+        (test):
+        * tests/es6/WeakMap_WeakMap.prototype.set_returns_this.js: Added.
+        * tests/es6/WeakMap_basic_functionality.js: Added.
+        * tests/es6/WeakMap_constructor_accepts_null.js: Added.
+        (test):
+        * tests/es6/WeakMap_constructor_arguments.js: Added.
+        * tests/es6/WeakMap_constructor_invokes_set.js: Added.
+        * tests/es6/WeakMap_constructor_requires_new.js: Added.
+        (test):
+        * tests/es6/WeakMap_frozen_objects_as_keys.js: Added.
+        * tests/es6/WeakMap_iterator_closing.js: Added.
+        (test.):
+        (test):
+        * tests/es6/WeakMap_no_WeakMap.prototype.clear_method.js: Added.
+        * tests/es6/WeakSet_WeakSet.prototype.add_returns_this.js: Added.
+        (test):
+        * tests/es6/WeakSet_WeakSet.prototype.delete.js: Added.
+        (test):
+        * tests/es6/WeakSet_basic_functionality.js: Added.
+        (test):
+        * tests/es6/WeakSet_constructor_accepts_null.js: Added.
+        (test):
+        * tests/es6/WeakSet_constructor_arguments.js: Added.
+        (test):
+        * tests/es6/WeakSet_constructor_invokes_add.js: Added.
+        (test.WeakSet.prototype.add):
+        (test):
+        * tests/es6/WeakSet_constructor_requires_new.js: Added.
+        (test):
+        * tests/es6/WeakSet_iterator_closing.js: Added.
+        (test.):
+        (test):
+        * tests/es6/WeakSet_no_WeakSet.prototype.clear_method.js: Added.
+        (test):
+        * tests/es6/__proto___in_object_literals_basic_support.js: Added.
+        (test):
+        * tests/es6/__proto___in_object_literals_multiple___proto___is_an_error.js: Added.
+        (test):
+        * tests/es6/__proto___in_object_literals_not_a_computed_property.js: Added.
+        (test):
+        * tests/es6/__proto___in_object_literals_not_a_shorthand_method.js: Added.
+        (test):
+        * tests/es6/__proto___in_object_literals_not_a_shorthand_property.js: Added.
+        (test):
+        * tests/es6/arrow_functions_0_parameters.js: Added.
+        (test):
+        * tests/es6/arrow_functions_1_parameter_no_brackets.js: Added.
+        (test):
+        * tests/es6/arrow_functions_cant_be_bound_can_be_curried.js: Added.
+        (test.d.y):
+        (test):
+        * tests/es6/arrow_functions_correct_precedence.js: Added.
+        (test):
+        * tests/es6/arrow_functions_lexical_arguments_binding.js: Added.
+        (test.f):
+        (test):
+        * tests/es6/arrow_functions_lexical_new.target_binding.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/arrow_functions_lexical_super_binding.js: Added.
+        (test.B.prototype.qux):
+        (test.B):
+        (test.C.prototype.baz):
+        (test.C):
+        (test):
+        * tests/es6/arrow_functions_lexical_this_binding.js: Added.
+        (test.d.y):
+        (test):
+        * tests/es6/arrow_functions_multiple_parameters.js: Added.
+        (test):
+        * tests/es6/arrow_functions_no_line_break_between_params_and_code_=_code.js: Added.
+        (test):
+        * tests/es6/arrow_functions_no_prototype_property.js: Added.
+        (test):
+        * tests/es6/arrow_functions_this_unchanged_by_call_or_apply.js: Added.
+        (test.d.y):
+        (test):
+        * tests/es6/block-level_function_declaration.js: Added.
+        (test.f):
+        (test):
+        * tests/es6/class_accessor_properties.js: Added.
+        (test.C.prototype.get foo):
+        (test.C.prototype.set bar):
+        (test.C):
+        (test):
+        * tests/es6/class_anonymous_class.js: Added.
+        * tests/es6/class_class_expression.js: Added.
+        (test.return.typeof.C):
+        (test):
+        * tests/es6/class_class_name_is_lexically_scoped.js: Added.
+        (test.C.prototype.method):
+        (test.C):
+        (test):
+        * tests/es6/class_class_statement.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/class_computed_accessor_properties.js: Added.
+        (test.C.prototype.get garply):
+        (test.C.prototype.set grault):
+        (test.C):
+        (test):
+        * tests/es6/class_computed_names_temporal_dead_zone.js: Added.
+        (test.try.B.prototype.C):
+        (test.try.B):
+        (test):
+        * tests/es6/class_computed_prototype_methods.js: Added.
+        (test.C.prototype.foo):
+        (test.C):
+        (test):
+        * tests/es6/class_computed_static_accessor_properties.js: Added.
+        (test.C.prototype.get garply):
+        (test.C.prototype.set grault):
+        (test.C):
+        (test):
+        * tests/es6/class_computed_static_methods.js: Added.
+        (test.C.foo):
+        (test.C):
+        (test):
+        * tests/es6/class_constructor.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/class_constructor_requires_new.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/class_extends.js: Added.
+        (test.B):
+        (test.C):
+        (test):
+        * tests/es6/class_extends_expressions.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/class_extends_null.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/class_implicit_strict_mode.js: Added.
+        (test.C.method):
+        (test.C):
+        (test):
+        * tests/es6/class_is_block-scoped.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/class_methods_arent_enumerable.js: Added.
+        (test.C.prototype.foo):
+        (test.C.bar):
+        (test.C):
+        (test):
+        * tests/es6/class_new.target.js: Added.
+        (test.new.f):
+        (test.A):
+        (test.B):
+        (test):
+        * tests/es6/class_prototype_methods.js: Added.
+        (test.C.prototype.method):
+        (test.C):
+        (test):
+        * tests/es6/class_static_accessor_properties.js: Added.
+        (test.C.prototype.get foo):
+        (test.C.prototype.set bar):
+        (test.C):
+        (test):
+        * tests/es6/class_static_methods.js: Added.
+        (test.C.method):
+        (test.C):
+        (test):
+        * tests/es6/class_string-keyed_methods.js: Added.
+        (test.C.prototype.string_appeared_here):
+        (test.C):
+        (test):
+        * tests/es6/const_basic_support.js: Added.
+        (test):
+        * tests/es6/const_basic_support_strict_mode.js: Added.
+        (test):
+        * tests/es6/const_is_block-scoped.js: Added.
+        (test):
+        * tests/es6/const_is_block-scoped_strict_mode.js: Added.
+        (test):
+        * tests/es6/const_redefining_a_const_is_an_error.js: Added.
+        (test):
+        * tests/es6/const_redefining_a_const_strict_mode.js: Added.
+        (test):
+        * tests/es6/const_temporal_dead_zone.js: Added.
+        (test.passed):
+        (test):
+        * tests/es6/const_temporal_dead_zone_strict_mode.js: Added.
+        (test.passed):
+        (test):
+        * tests/es6/default_function_parameters_arguments_object_interaction.js: Added.
+        (test):
+        * tests/es6/default_function_parameters_basic_functionality.js: Added.
+        (test):
+        * tests/es6/default_function_parameters_defaults_can_refer_to_previous_params.js: Added.
+        (test):
+        * tests/es6/default_function_parameters_explicit_undefined_defers_to_the_default.js: Added.
+        (test):
+        * tests/es6/default_function_parameters_new_Function_support.js: Added.
+        (test):
+        * tests/es6/default_function_parameters_separate_scope.js: Added.
+        (test.return):
+        (test):
+        * tests/es6/default_function_parameters_temporal_dead_zone.js: Added.
+        (test):
+        * tests/es6/destructuring_chained_iterable_destructuring.js: Added.
+        (test):
+        * tests/es6/destructuring_chained_object_destructuring.js: Added.
+        (test):
+        * tests/es6/destructuring_computed_properties.js: Added.
+        (test):
+        * tests/es6/destructuring_defaults.js: Added.
+        (test):
+        * tests/es6/destructuring_defaults_in_parameters.js: Added.
+        (test):
+        * tests/es6/destructuring_defaults_in_parameters_new_Function_support.js: Added.
+        (test):
+        * tests/es6/destructuring_defaults_in_parameters_separate_scope.js: Added.
+        (test.return):
+        (test):
+        * tests/es6/destructuring_defaults_let_temporal_dead_zone.js: Added.
+        (test):
+        * tests/es6/destructuring_empty_patterns.js: Added.
+        (test):
+        * tests/es6/destructuring_empty_patterns_in_parameters.js: Added.
+        (test):
+        * tests/es6/destructuring_in_for-in_loop_heads.js: Added.
+        (test):
+        * tests/es6/destructuring_in_for-of_loop_heads.js: Added.
+        (test):
+        * tests/es6/destructuring_in_parameters.js: Added.
+        (test):
+        * tests/es6/destructuring_in_parameters_arguments_interaction.js: Added.
+        (test):
+        * tests/es6/destructuring_in_parameters_function_length_property.js: Added.
+        (test):
+        * tests/es6/destructuring_in_parameters_new_Function_support.js: Added.
+        (test):
+        * tests/es6/destructuring_iterable_destructuring_expression.js: Added.
+        (test):
+        * tests/es6/destructuring_iterator_closing.js: Added.
+        (test.):
+        (test):
+        * tests/es6/destructuring_multiples_in_a_single_var_statement.js: Added.
+        (test):
+        * tests/es6/destructuring_nested.js: Added.
+        (test):
+        * tests/es6/destructuring_nested_rest.js: Added.
+        (test):
+        * tests/es6/destructuring_object_destructuring_expression.js: Added.
+        (test):
+        * tests/es6/destructuring_object_destructuring_with_primitives.js: Added.
+        (test):
+        * tests/es6/destructuring_parenthesised_left-hand-side_is_a_syntax_error.js: Added.
+        (test):
+        * tests/es6/destructuring_rest.js: Added.
+        (test):
+        * tests/es6/destructuring_throws_on_null_and_undefined.js: Added.
+        (test):
+        * tests/es6/destructuring_trailing_commas_in_iterable_patterns.js: Added.
+        (test):
+        * tests/es6/destructuring_trailing_commas_in_object_patterns.js: Added.
+        (test):
+        * tests/es6/destructuring_with_arrays.js: Added.
+        (test):
+        * tests/es6/destructuring_with_astral_plane_strings.js: Added.
+        (test):
+        * tests/es6/destructuring_with_generator_instances.js: Added.
+        (test.c):
+        (test.e):
+        (test):
+        * tests/es6/destructuring_with_generic_iterables.js: Added.
+        (test):
+        * tests/es6/destructuring_with_instances_of_generic_iterables.js: Added.
+        (test):
+        * tests/es6/destructuring_with_objects.js: Added.
+        (test):
+        * tests/es6/destructuring_with_sparse_arrays.js: Added.
+        (test):
+        * tests/es6/destructuring_with_strings.js: Added.
+        (test):
+        * tests/es6/for..of_loops_iterator_closing_break.js: Added.
+        (test.):
+        (test):
+        * tests/es6/for..of_loops_iterator_closing_throw.js: Added.
+        (test.):
+        (test):
+        * tests/es6/for..of_loops_with_arrays.js: Added.
+        (test):
+        * tests/es6/for..of_loops_with_astral_plane_strings.js: Added.
+        (test):
+        * tests/es6/for..of_loops_with_generator_instances.js: Added.
+        (test.iterable):
+        (test):
+        * tests/es6/for..of_loops_with_generic_iterables.js: Added.
+        (test):
+        * tests/es6/for..of_loops_with_instances_of_generic_iterables.js: Added.
+        (test):
+        * tests/es6/for..of_loops_with_sparse_arrays.js: Added.
+        (test):
+        * tests/es6/for..of_loops_with_strings.js: Added.
+        (test):
+        * tests/es6/function_name_property_accessor_properties.js: Added.
+        (test.o.get foo):
+        (test.o.set foo):
+        * tests/es6/function_name_property_bound_functions.js: Added.
+        (test.foo):
+        (test):
+        * tests/es6/function_name_property_class_expressions.js: Added.
+        (test.return.foo):
+        (test.name.string_appeared_here.typeof.bar.name):
+        (test.name.string_appeared_here.typeof.bar):
+        (test):
+        * tests/es6/function_name_property_class_prototype_methods.js: Added.
+        (test.C.prototype.foo):
+        (test.C):
+        (test):
+        * tests/es6/function_name_property_class_statements.js: Added.
+        (test.foo):
+        (test.bar.name):
+        (test.bar):
+        (test):
+        * tests/es6/function_name_property_class_static_methods.js: Added.
+        (test.C.foo):
+        (test.C):
+        (test):
+        * tests/es6/function_name_property_function_expressions.js: Added.
+        (test):
+        * tests/es6/function_name_property_function_statements.js: Added.
+        (test.foo):
+        (test):
+        * tests/es6/function_name_property_isnt_writable_is_configurable.js: Added.
+        (test):
+        * tests/es6/function_name_property_new_Function.js: Added.
+        (test):
+        * tests/es6/function_name_property_object_methods_class.js: Added.
+        (test.o):
+        * tests/es6/function_name_property_object_methods_function.js: Added.
+        (test.o.foo):
+        (test.o.bar):
+        (test.o.qux):
+        (test):
+        * tests/es6/function_name_property_shorthand_methods.js: Added.
+        (test):
+        * tests/es6/function_name_property_shorthand_methods_no_lexical_binding.js: Added.
+        (test):
+        * tests/es6/function_name_property_symbol-keyed_methods.js: Added.
+        (test.o.sym1):
+        (test.o.sym2):
+        (test):
+        * tests/es6/function_name_property_variables_class.js: Added.
+        (test.bar):
+        (test.qux):
+        * tests/es6/function_name_property_variables_function.js: Added.
+        (test.foo):
+        (test.bar):
+        (test):
+        * tests/es6/generators_%GeneratorPrototype%.constructor.js: Added.
+        (test.g):
+        (test):
+        * tests/es6/generators_%GeneratorPrototype%.js: Added.
+        (test.generatorFn):
+        (test):
+        * tests/es6/generators_%GeneratorPrototype%.return.js: Added.
+        (test.generator):
+        (test):
+        * tests/es6/generators_%GeneratorPrototype%.throw.js: Added.
+        (test.generator):
+        (test):
+        * tests/es6/generators_basic_functionality.js: Added.
+        (test.generator):
+        (test):
+        * tests/es6/generators_cant_use_this_with_new.js: Added.
+        (test.generator):
+        (test):
+        * tests/es6/generators_computed_shorthand_generators.js: Added.
+        (test):
+        * tests/es6/generators_computed_shorthand_generators_classes.js: Added.
+        (test.C.prototype.garply):
+        (test.C):
+        (test):
+        * tests/es6/generators_correct_this_binding.js: Added.
+        (test.generator):
+        (test):
+        * tests/es6/generators_generator_function_expressions.js: Added.
+        (test.generator):
+        (test):
+        * tests/es6/generators_sending.js: Added.
+        (test.generator):
+        (test):
+        * tests/es6/generators_shorthand_generator_methods.js: Added.
+        (test):
+        * tests/es6/generators_shorthand_generator_methods_classes.js: Added.
+        (test.C.prototype.generator):
+        (test.C):
+        (test):
+        * tests/es6/generators_string-keyed_shorthand_generator_methods.js: Added.
+        (test):
+        * tests/es6/generators_yield_*_arrays.js: Added.
+        (test.iterator):
+        (test):
+        * tests/es6/generators_yield_*_astral_plane_strings.js: Added.
+        (test.iterator):
+        (test):
+        * tests/es6/generators_yield_*_generator_instances.js: Added.
+        (test.iterator):
+        (test):
+        * tests/es6/generators_yield_*_generic_iterables.js: Added.
+        (test.iterator):
+        (test):
+        * tests/es6/generators_yield_*_instances_of_iterables.js: Added.
+        (test.iterator):
+        (test):
+        * tests/es6/generators_yield_*_iterator_closing.js: Added.
+        (test.):
+        (test.gen):
+        (test):
+        * tests/es6/generators_yield_*_iterator_closing_via_throw.js: Added.
+        (test.):
+        (test.gen):
+        (test):
+        * tests/es6/generators_yield_*_on_non-iterables_is_a_runtime_error.js: Added.
+        (test.iterator):
+        (test):
+        * tests/es6/generators_yield_*_sparse_arrays.js: Added.
+        (test.iterator):
+        (test):
+        * tests/es6/generators_yield_*_strings.js: Added.
+        (test.iterator):
+        (test):
+        * tests/es6/generators_yield_operator_precedence.js: Added.
+        (test.generator):
+        (test):
+        * tests/es6/let_basic_support.js: Added.
+        (test):
+        * tests/es6/let_basic_support_strict_mode.js: Added.
+        (test):
+        * tests/es6/let_for-loop_iteration_scope.js: Added.
+        (test):
+        * tests/es6/let_for-loop_iteration_scope_strict_mode.js: Added.
+        (test):
+        * tests/es6/let_for-loop_statement_scope.js: Added.
+        (test):
+        * tests/es6/let_for-loop_statement_scope_strict_mode.js: Added.
+        (test):
+        * tests/es6/let_is_block-scoped.js: Added.
+        (test):
+        * tests/es6/let_is_block-scoped_strict_mode.js: Added.
+        (test):
+        * tests/es6/let_temporal_dead_zone.js: Added.
+        (test.passed):
+        (test):
+        * tests/es6/let_temporal_dead_zone_strict_mode.js: Added.
+        (test.passed):
+        (test):
+        * tests/es6/miscellaneous_Invalid_Date.js: Added.
+        (test):
+        * tests/es6/miscellaneous_RegExp_constructor_can_alter_flags.js: Added.
+        (test):
+        * tests/es6/miscellaneous_String.prototype_case_methods_Unicode_support.js: Added.
+        (test):
+        * tests/es6/miscellaneous_accessors_arent_constructors.js: Added.
+        (test.get catch):
+        (test):
+        * tests/es6/miscellaneous_built-in_prototypes_are_not_instances.js: Added.
+        (test):
+        * tests/es6/miscellaneous_duplicate_property_names_in_strict_mode.js: Added.
+        (test):
+        * tests/es6/miscellaneous_function_length_is_configurable.js: Added.
+        (test.fn):
+        (test):
+        * tests/es6/miscellaneous_no_assignments_allowed_in_for-in_head.js: Added.
+        (test):
+        * tests/es6/miscellaneous_no_escaped_reserved_words_as_identifiers.js: Added.
+        (test):
+        * tests/es6/miscellaneous_no_semicolon_needed_after_do-while.js: Added.
+        (test):
+        * tests/es6/miscellaneous_subclassables_Boolean_is_subclassable.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/miscellaneous_subclassables_Map_is_subclassable.js: Added.
+        (test):
+        * tests/es6/miscellaneous_subclassables_Number_is_subclassable.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/miscellaneous_subclassables_Set_is_subclassable.js: Added.
+        (test):
+        * tests/es6/miscellaneous_subclassables_String_is_subclassable.js: Added.
+        (test.C):
+        (test):
+        * tests/es6/new.target_assignment_is_an_early_error.js: Added.
+        (test.new.f):
+        (test):
+        * tests/es6/new.target_in_constructors.js: Added.
+        (test.new.f):
+        (test):
+        * tests/es6/non-strict_function_semantics_function_statements_in_if-statement_clauses.js: Added.
+        (test.foo):
+        (test.else.bar):
+        (test.baz):
+        (test.qux):
+        (test.else.qux):
+        (test):
+        * tests/es6/non-strict_function_semantics_hoisted_block-level_function_declaration.js: Added.
+        (test.f):
+        (test.g):
+        (test.h):
+        (test):
+        * tests/es6/non-strict_function_semantics_labeled_function_statements.js: Added.
+        (test.label):
+        (test):
+        * tests/es6/object_literal_extensions_computed_accessors.js: Added.
+        (test.obj.get x):
+        (test.obj.set x):
+        (test):
+        * tests/es6/object_literal_extensions_computed_properties.js: Added.
+        (test):
+        * tests/es6/object_literal_extensions_computed_shorthand_methods.js: Added.
+        (test):
+        * tests/es6/object_literal_extensions_shorthand_methods.js: Added.
+        (test):
+        * tests/es6/object_literal_extensions_shorthand_properties.js: Added.
+        (test):
+        * tests/es6/object_literal_extensions_string-keyed_shorthand_methods.js: Added.
+        (test):
+        * tests/es6/octal_and_binary_literals_binary_literals.js: Added.
+        (test):
+        * tests/es6/octal_and_binary_literals_binary_supported_by_Number.js: Added.
+        (test):
+        * tests/es6/octal_and_binary_literals_octal_literals.js: Added.
+        (test):
+        * tests/es6/octal_and_binary_literals_octal_supported_by_Number.js: Added.
+        (test):
+        * tests/es6/own_property_order_JSON.parse.js: Added.
+        (test):
+        * tests/es6/own_property_order_JSON.stringify.js: Added.
+        (test):
+        * tests/es6/own_property_order_Object.assign.js: Added.
+        * tests/es6/own_property_order_Object.getOwnPropertyNames.js: Added.
+        (test):
+        * tests/es6/own_property_order_Object.keys.js: Added.
+        (test):
+        * tests/es6/own_property_order_Reflect.ownKeys_string_key_order.js: Added.
+        (test):
+        * tests/es6/own_property_order_Reflect.ownKeys_symbol_key_order.js: Added.
+        (test):
+        * tests/es6/own_property_order_for..in.js: Added.
+        (test):
+        * tests/es6/proper_tail_calls_tail_call_optimisation_direct_recursion.js: Added.
+        (test):
+        * tests/es6/proper_tail_calls_tail_call_optimisation_mutual_recursion.js: Added.
+        (test.f):
+        (test.g):
+        (test):
+        * tests/es6/prototype_of_bound_functions_arrow_functions.js: Added.
+        (test.correctProtoBound):
+        (test):
+        * tests/es6/prototype_of_bound_functions_basic_functions.js: Added.
+        (test.correctProtoBound.f):
+        (test.correctProtoBound):
+        (test):
+        * tests/es6/prototype_of_bound_functions_classes.js: Added.
+        (test.correctProtoBound.C):
+        (test.correctProtoBound):
+        (test):
+        * tests/es6/prototype_of_bound_functions_generator_functions.js: Added.
+        (test.correctProtoBound.f):
+        (test.correctProtoBound):
+        (test):
+        * tests/es6/prototype_of_bound_functions_subclasses.js: Added.
+        (test.correctProtoBound.C):
+        (test.correctProtoBound):
+        (test):
+        * tests/es6/rest_parameters_arguments_object_interaction.js: Added.
+        (test):
+        * tests/es6/rest_parameters_basic_functionality.js: Added.
+        (test):
+        * tests/es6/rest_parameters_cant_be_used_in_setters.js: Added.
+        (test):
+        * tests/es6/rest_parameters_function_length_property.js: Added.
+        (test):
+        * tests/es6/rest_parameters_new_Function_support.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_spreading_non-iterables_is_a_runtime_error.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_arrays_in_array_literals.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_arrays_in_function_calls.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_astral_plane_strings_in_array_literals.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_astral_plane_strings_in_function_calls.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_generator_instances_in_arrays.js: Added.
+        (test.iterable):
+        (test):
+        * tests/es6/spread_..._operator_with_generator_instances_in_calls.js: Added.
+        (test.iterable):
+        (test):
+        * tests/es6/spread_..._operator_with_generic_iterables_in_arrays.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_generic_iterables_in_calls.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_instances_of_iterables_in_arrays.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_instances_of_iterables_in_calls.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_sparse_arrays_in_array_literals.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_sparse_arrays_in_function_calls.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_strings_in_array_literals.js: Added.
+        (test):
+        * tests/es6/spread_..._operator_with_strings_in_function_calls.js: Added.
+        (test):
+        * tests/es6/super_constructor_calls_use_correct_new.target_binding.js: Added.
+        (test.B):
+        (test):
+        * tests/es6/super_expression_in_constructors.js: Added.
+        (test.B):
+        (test.C):
+        (test):
+        * tests/es6/super_in_methods_method_calls.js: Added.
+        (test.B.prototype.qux):
+        (test.B):
+        (test.C.prototype.qux):
+        (test.C):
+        (test):
+        * tests/es6/super_in_methods_property_access.js: Added.
+        (test.B):
+        (test.C.prototype.quux):
+        (test.C):
+        (test):
+        * tests/es6/super_is_statically_bound.js: Added.
+        (test.B.prototype.qux):
+        (test.B):
+        (test.C.prototype.qux):
+        (test.C):
+        (test):
+        * tests/es6/super_method_calls_use_correct_this_binding.js: Added.
+        (test.B.prototype.qux):
+        (test.B):
+        (test.C.prototype.qux):
+        (test.C):
+        (test):
+        * tests/es6/super_statement_in_constructors.js: Added.
+        (test.B):
+        (test):
+        * tests/es6/template_strings_basic_functionality.js: Added.
+        (test):
+        * tests/es6/template_strings_line_break_normalisation.js: Added.
+        (test):
+        * tests/es6/template_strings_passed_array_is_frozen.js: Added.
+        (test):
+        * tests/es6/template_strings_tagged_template_strings.js: Added.
+        (test.fn):
+        (test):
+        * tests/es6/template_strings_toString_conversion.js: Added.
+        (test.a.toString):
+        (test.a.valueOf):
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.from.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.of.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.copyWithin.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.entries.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.every.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.fill.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.filter.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.find.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.findIndex.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.forEach.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.indexOf.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.join.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.keys.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.lastIndexOf.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.map.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.reduce.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.reduceRight.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.reverse.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.slice.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.some.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.sort.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.subarray.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype.values.js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%.prototype[Symbol.iterator].js: Added.
+        (test):
+        * tests/es6/typed_arrays_%TypedArray%[Symbol.species].js: Added.
+        (test):
+        * tests/es6/typed_arrays_ArrayBuffer[Symbol.species].js: Added.
+        (test):
+        * tests/es6/typed_arrays_DataView_Float32.js: Added.
+        (test):
+        * tests/es6/typed_arrays_DataView_Float64.js: Added.
+        (test):
+        * tests/es6/typed_arrays_DataView_Int16.js: Added.
+        (test):
+        * tests/es6/typed_arrays_DataView_Int32.js: Added.
+        (test):
+        * tests/es6/typed_arrays_DataView_Int8.js: Added.
+        (test):
+        * tests/es6/typed_arrays_DataView_Uint16.js: Added.
+        (test):
+        * tests/es6/typed_arrays_DataView_Uint32.js: Added.
+        (test):
+        * tests/es6/typed_arrays_DataView_Uint8.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Float32Array.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Float64Array.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Int16Array.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Int32Array.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Int8Array.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Uint16Array.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Uint32Array.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Uint8Array.js: Added.
+        (test):
+        * tests/es6/typed_arrays_Uint8ClampedArray.js: Added.
+        (test):
+        * tests/es6/typed_arrays_constructors_require_new.js: Added.
+        (test):
+        * tests/es6/typed_arrays_correct_prototype_chains.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.hasInstance.js: Added.
+        (test.C):
+        (test.):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.isConcatSpreadable.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.iterator_arguments_object.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.iterator_existence.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.match.js: Added.
+        (test.O.Symbol.match):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.replace.js: Added.
+        (test.O.Symbol.replace):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.search.js: Added.
+        (test.O.Symbol.search):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.species_Array.prototype.concat.js: Added.
+        (test.obj.Symbol.species):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.species_Array.prototype.filter.js: Added.
+        (test.obj.Symbol.species):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.species_Array.prototype.map.js: Added.
+        (test.obj.Symbol.species):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.species_Array.prototype.slice.js: Added.
+        (test.obj.Symbol.species):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.species_Array.prototype.splice.js: Added.
+        (test.obj.Symbol.species):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.species_RegExp.prototype[Symbol.split].js: Added.
+        (test.obj.Symbol.species):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.species_existence.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.split.js: Added.
+        (test.O.Symbol.split):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.toPrimitive.js: Added.
+        (test.a.Symbol.toPrimitive):
+        (test.b.Symbol.toPrimitive):
+        (test.c.Symbol.toPrimitive):
+        (test):
+        * tests/es6/well-known_symbols_Symbol.toStringTag.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.toStringTag_misc._built-ins.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.unscopables.js: Added.
+        (test):
+
+2015-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        WatchpointsOnStructureStubInfo doesn't need to be reference counted
+        https://bugs.webkit.org/show_bug.cgi?id=148766
+
+        Reviewed by Saam Barati.
+
+        It doesn't need to be reference counted because the only RefPtr to it is in
+        StructureStubInfo. Therefore, it can be a unique_ptr.
+
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
+        (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
+        * bytecode/StructureStubClearingWatchpoint.h:
+        (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo):
+        (JSC::WatchpointsOnStructureStubInfo::codeBlock):
+        * bytecode/StructureStubInfo.h:
+        (JSC::getStructureStubInfoCodeOrigin):
+
+2015-09-03  Basile Clement  <basile_clement@apple.com>
+
+        JavaScript functions should restore the stack pointer after a call
+        https://bugs.webkit.org/show_bug.cgi?id=148659
+
+        Reviewed by Michael Saboff.
+
+        This patch makes it so that the various places where we are making a
+        JS-to-JS call restore the stack pointer afterwards. This allows us to
+        no longer rely on the stack pointer still being valid after a call, and
+        is a prerequisite for getting rid of the arity fixup return thunk.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfCall):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::emit):
+        * ftl/FTLJSCall.h:
+        * ftl/FTLStackMaps.h:
+        (JSC::FTL::StackMaps::stackSizeForLocals):
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        * tests/stress/tail-call-in-inline-cache.js: Added.
+        (tail):
+        (obj.get x):
+
+2015-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        StructureStubInfo should be able to reset itself without going through CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=148743
+
+        Reviewed by Geoffrey Garen.
+
+        We had some resetStub...() methods in CodeBlock that didn't really do anything that
+        StructureStubInfo couldn't do by itself. It makes sense for the functionality to reset a
+        stub to be in the stub class, not in CodeBlock.
+
+        It's still true that:
+
+        - In order to mess with a StructureStubInfo, you either have to be in GC or you have to
+          be holding the owning CodeBlock's lock.
+
+        - StructureStubInfo doesn't remember which CodeBlock owns it (to save space), and all
+          of the callers of StructureStubInfo methods know which CodeBlock own it. So, many stub
+          methods take CodeBlock* as an argument.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
+        (JSC::CodeBlock::resetStub): Deleted.
+        (JSC::CodeBlock::resetStubInternal): Deleted.
+        (JSC::CodeBlock::resetStubDuringGCInternal): Deleted.
+        * bytecode/CodeBlock.h:
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        (JSC::StructureStubClearingWatchpoint::fireInternal):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::reset):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initInList):
+        (JSC::StructureStubInfo::seenOnce):
+        (JSC::StructureStubInfo::reset): Deleted.
+
+2015-09-03  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement some arithmetic instructions in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148737
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements the addition and subtraction instructions in
+        WebAssembly using a stack-based approach: each instruction reads its
+        operands from the top of the 'temporary' stack, pops them, and
+        optionally pushes a return value to the stack. Since operands are passed
+        on the stack, we don't use the arguments that are passed to the methods
+        of WASMFunctionCompiler, and we don't use the return values from these
+        methods. (We will use them when we implement LLVM IR generation for
+        WebAssembly, where each expression is an LLVMValueRef.)
+
+        * tests/stress/wasm-arithmetic.js: Added.
+        * tests/stress/wasm-arithmetic.wasm: Added.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::endFunction):
+        (JSC::WASMFunctionCompiler::buildReturn):
+        (JSC::WASMFunctionCompiler::buildImmediateI32):
+        (JSC::WASMFunctionCompiler::buildBinaryI32):
+        (JSC::WASMFunctionCompiler::temporaryAddress):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseReturnStatement):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseImmediateExpressionI32):
+        (JSC::WASMFunctionParser::parseBinaryExpressionI32):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::startFunction):
+        (JSC::WASMFunctionSyntaxChecker::endFunction):
+        (JSC::WASMFunctionSyntaxChecker::buildReturn):
+        (JSC::WASMFunctionSyntaxChecker::buildImmediateI32):
+        (JSC::WASMFunctionSyntaxChecker::buildBinaryI32):
+        (JSC::WASMFunctionSyntaxChecker::stackHeight):
+        (JSC::WASMFunctionSyntaxChecker::updateTempStackHeight):
+
+2015-09-03  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: should crash on purpose if InjectedScriptSource.js is unparseable
+        https://bugs.webkit.org/show_bug.cgi?id=148750
+
+        Reviewed by Timothy Hatcher.
+
+        If an injected script cannot be parsed or executed without exception, we should abort as
+        soon as possible. This patch adds a release assertion after creating the injected
+        script and dumps the bad injected script's source as it was embedded into the binary.
+
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::injectedScriptFor):
+
+2015-09-03  Basile Clement  <basile_clement@apple.com> and Michael Saboff  <msaboff@apple.com>
+
+        Clean up register naming
+        https://bugs.webkit.org/show_bug.cgi?id=148658
+
+        Reviewed by Geoffrey Garen.
+
+        This changes register naming conventions in the llint and baseline JIT
+        in order to use as few (native) callee-save registers as possible on
+        64-bits platforms. It also introduces significant changes in the way
+        registers names are defined in the LLint and baseline JIT in order to
+        enable a simpler convention about which registers can be aliased. That
+        convention is valid across all architecture, and described in
+        llint/LowLevelInterpreter.asm.
+
+        Callee save registers are now called out regCS<n> (in the JIT) or
+        csr<n> (in the LLInt) with a common numbering across all tiers. Some
+        registers are unused in some tiers.
+
+        As a part of this change, rdi was removed from the list of temporary
+        registers for X86-64 Windows as it is a callee saves register. This
+        reduced the number of temporary registers for X86-64 Windows.
+
+        This is in preparation for properly handling callee save register
+        preservation and restoration.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileFunction):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * jit/FPRInfo.h:
+        (JSC::FPRInfo::toRegister):
+        (JSC::FPRInfo::toIndex):
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toIndex):
+        (JSC::GPRInfo::toRegister):
+        (JSC::GPRInfo::debugName): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_new_object):
+        * jit/RegisterPreservationWrapperGenerator.cpp:
+        (JSC::generateRegisterPreservationWrapper):
+        (JSC::generateRegisterRestoration):
+        * jit/ThunkGenerators.cpp:
+        (JSC::arityFixupGenerator):
+        (JSC::nativeForGenerator): Deleted.
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/arm.rb:
+        * offlineasm/arm64.rb:
+        * offlineasm/cloop.rb:
+        * offlineasm/mips.rb:
+        * offlineasm/registers.rb:
+        * offlineasm/sh4.rb:
+        * offlineasm/x86.rb:
+
+2015-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of RepatchBuffer and replace it with static functions
+        https://bugs.webkit.org/show_bug.cgi?id=148742
+
+        Reviewed by Geoffrey Garen and Mark Lam.
+
+        RepatchBuffer is an object that doesn't have any state. All of its instance methods are
+        just wrappers for methods on MacroAssembler. So, we should make those MacroAssembler
+        methods public and call them directly.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::linkJump):
+        (JSC::AbstractMacroAssembler::linkPointer):
+        (JSC::AbstractMacroAssembler::getLinkerAddress):
+        (JSC::AbstractMacroAssembler::getLinkerCallReturnOffset):
+        (JSC::AbstractMacroAssembler::repatchJump):
+        (JSC::AbstractMacroAssembler::repatchNearCall):
+        (JSC::AbstractMacroAssembler::repatchCompact):
+        (JSC::AbstractMacroAssembler::repatchInt32):
+        (JSC::AbstractMacroAssembler::repatchPointer):
+        (JSC::AbstractMacroAssembler::readPointer):
+        (JSC::AbstractMacroAssembler::replaceWithLoad):
+        (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
+        (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::revertJumpReplacementToPatchableBranch32WithPatch):
+        (JSC::MacroAssemblerARM64::repatchCall):
+        (JSC::MacroAssemblerARM64::makeBranch):
+        (JSC::MacroAssemblerARM64::linkCall):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranch32WithPatch):
+        (JSC::MacroAssemblerARMv7::repatchCall):
+        (JSC::MacroAssemblerARMv7::linkCall):
+        (JSC::MacroAssemblerARMv7::trustedImm32FromPtr):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranch32WithPatch):
+        (JSC::MacroAssemblerX86::repatchCall):
+        (JSC::MacroAssemblerX86::linkCall):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::repatchCall):
+        (JSC::MacroAssemblerX86_64::linkCall):
+        * assembler/RepatchBuffer.h: Removed.
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::clearStub):
+        (JSC::CallLinkInfo::unlink):
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::registerPreservationMode):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::CallLinkInfo::setUpCall):
+        (JSC::CallLinkInfo::codeOrigin):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::resetStub):
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::resetStubDuringGCInternal):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        * bytecode/CodeBlock.h:
+        * bytecode/PolymorphicGetByIdList.cpp:
+        (JSC::GetByIdAccess::fromStructureStubInfo):
+        (JSC::GetByIdAccess::visitWeak):
+        (JSC::PolymorphicGetByIdList::didSelfPatching):
+        (JSC::PolymorphicGetByIdList::visitWeak):
+        * bytecode/PolymorphicGetByIdList.h:
+        (JSC::GetByIdAccess::doesCalls):
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::fromStructureStubInfo):
+        (JSC::PutByIdAccess::visitWeak):
+        (JSC::PolymorphicPutByIdList::addAccess):
+        (JSC::PolymorphicPutByIdList::visitWeak):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::customSetter):
+        (JSC::PolymorphicPutByIdList::kind):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::seenOnce):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * jit/AccessorCallJITStubRoutine.cpp:
+        (JSC::AccessorCallJITStubRoutine::~AccessorCallJITStubRoutine):
+        (JSC::AccessorCallJITStubRoutine::visitWeak):
+        * jit/AccessorCallJITStubRoutine.h:
+        * jit/JIT.cpp:
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::JIT):
+        (JSC::ctiPatchNearCallByReturnAddress): Deleted.
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileHasIndexedProperty):
+        (JSC::JIT::emit_op_has_indexed_property):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompileGetByValWithCachedId):
+        (JSC::JIT::privateCompilePutByVal):
+        (JSC::JIT::privateCompilePutByValWithCachedId):
+        * jit/JITPropertyAccess32_64.cpp:
+        * jit/JITStubRoutine.cpp:
+        (JSC::JITStubRoutine::~JITStubRoutine):
+        (JSC::JITStubRoutine::visitWeak):
+        * jit/JITStubRoutine.h:
+        * jit/PolymorphicCallStubRoutine.cpp:
+        (JSC::PolymorphicCallNode::~PolymorphicCallNode):
+        (JSC::PolymorphicCallNode::unlink):
+        (JSC::PolymorphicCallStubRoutine::clearCallNodesFor):
+        (JSC::PolymorphicCallStubRoutine::visitWeak):
+        * jit/PolymorphicCallStubRoutine.h:
+        (JSC::PolymorphicCallNode::hasCallLinkInfo):
+        * jit/Repatch.cpp:
+        (JSC::readCallTarget):
+        (JSC::repatchCall):
+        (JSC::repatchByIdSelfAccess):
+        (JSC::checkObjectPropertyConditions):
+        (JSC::replaceWithJump):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::patchJumpToGetByIdStub):
+        (JSC::tryBuildGetByIDList):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::repatchIn):
+        (JSC::linkSlowFor):
+        (JSC::linkFor):
+        (JSC::revertCall):
+        (JSC::unlinkFor):
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::resetIn):
+        * jit/Repatch.h:
+
+2015-09-03  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Initial implementation of WebAssembly function compiler
+        https://bugs.webkit.org/show_bug.cgi?id=148734
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces WASMFunctionCompiler, a class for generating
+        baseline JIT code for WebAssembly functions. The source for each
+        WebAssembly function is parsed in two passes.
+        - The first pass is done by WASMFunctionSyntaxChecker when the
+          WebAssembly module is initialized. It validates the syntax,
+          determines the start and the end offsets in the source, and
+          calculates the stack height of the function.
+        - The second pass is done by WASMFunctionCompiler when the function
+          is about to be executed.
+        This patch doesn't calculate the correct stack height nor generate
+        the correct code. That will be done in a subsequent patch.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::functionStartOffsetsInSource):
+        (JSC::JSWASMModule::functionStackHeights):
+        * wasm/WASMFunctionCompiler.h: Added.
+        (JSC::WASMFunctionCompiler::WASMFunctionCompiler):
+        (JSC::WASMFunctionCompiler::startFunction):
+        (JSC::WASMFunctionCompiler::endFunction):
+        (JSC::WASMFunctionCompiler::throwStackOverflowError):
+        (JSC::WASMFunctionCompiler::localAddress):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::checkSyntax):
+        (JSC::WASMFunctionParser::compile):
+        (JSC::WASMFunctionParser::parseFunction):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::startFunction):
+        (JSC::WASMFunctionSyntaxChecker::endFunction):
+        (JSC::WASMFunctionSyntaxChecker::stackHeight):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::parseFunctionDeclarationSection):
+        (JSC::WASMModuleParser::parseFunctionDefinition):
+
+2015-09-03  Saam barati  <sbarati@apple.com>
+
+        Block scoped variables should be visible across scripts
+        https://bugs.webkit.org/show_bug.cgi?id=147813
+
+        Reviewed by Filip Pizlo.
+
+        This patch properly implements the global lexical tier described in
+        http://www.ecma-international.org/ecma-262/6.0/index.html#sec-globaldeclarationinstantiation.
+        The sepcification mandates that there is a global lexical environment
+        that wrtaps all program execution. This global lexical environment
+        holds let/const/class variables defined at the top-level scope
+        inside a program. These variables can never shadow other program-level
+        "var"s, global object properties, or other global lexical environment
+        declarations. Doing so is a SyntaxError.
+
+        This patch adds new ResolveTypes that describe the global lexical environment:
+        GlobalLexicalVar and GlobalLexiclaVarWithInjectionChecks. Resolving to
+        these means we're doing a load/store from the JSGlobalLexicalEnvironment.
+        This patch also addes new ResolveTypes: UnresolvedProperty and
+        UnresolvedPropertyWithVarInjectionChecks. Before, we used GlobalProperty
+        to encompass this category because if JSScope::abstractAccess didn't
+        resolve to anything, we could safely assume that this property is
+        on the global object. Such an assumption is no longer true in ES6.
+        When we have a resolve_scope/put_to_scope/get_from_scope with this
+        ResolveType, we try to transition it to either a GlobalProperty
+        ResolveType or a GlobalLexicalVar resolve type.
+
+        JSGlobalLexicalEnvironment is a subclass of JSSegmentedVariableObject.
+        This means get_from_scopes are direct pointer reads and
+        put_to_scopes are direct pointer stores.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::clear):
+        (JSC::EvalCodeCache::isCacheableScope):
+        (JSC::EvalCodeCache::isCacheable):
+        * bytecode/SpeculatedType.h:
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::emitGetFromScope):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::initializeVariable):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::pushScopedControlFlowContext):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        (JSC::BytecodeGenerator::emitPopCatchScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::EmptyLetExpression::emitBytecode):
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::BindingNode::bindValue):
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::isGlobalScope):
+        (JSC::DebuggerScope::isGlobalLexicalEnvironment):
+        (JSC::DebuggerScope::isClosureScope):
+        (JSC::DebuggerScope::caughtValue):
+        (JSC::DebuggerScope::isFunctionOrEvalScope): Deleted.
+        * debugger/DebuggerScope.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasRegisterPointer):
+        (JSC::DFG::Node::variablePointer):
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMultiPutByOffset):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetGlobalVariable):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutGlobalVariable):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetGlobalVar): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutGlobalVar): Deleted.
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::scopeType):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JIT.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emitLoadWithStructureCheck):
+        (JSC::JIT::emitGetGlobalProperty):
+        (JSC::JIT::emitGetVarFromPointer):
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitPutGlobalProperty):
+        (JSC::JIT::emitPutGlobalVariable):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        (JSC::JIT::emitGetGlobalVar): Deleted.
+        (JSC::JIT::emitPutGlobalVar): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emitLoadWithStructureCheck):
+        (JSC::JIT::emitGetGlobalProperty):
+        (JSC::JIT::emitGetVarFromPointer):
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emitPutGlobalProperty):
+        (JSC::JIT::emitPutGlobalVariable):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        (JSC::JIT::emitGetGlobalVar): Deleted.
+        (JSC::JIT::emitPutGlobalVar): Deleted.
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/GetPutInfo.h: Added.
+        (JSC::resolveModeName):
+        (JSC::resolveTypeName):
+        (JSC::initializationModeName):
+        (JSC::makeType):
+        (JSC::needsVarInjectionChecks):
+        (JSC::ResolveOp::ResolveOp):
+        (JSC::GetPutInfo::GetPutInfo):
+        (JSC::GetPutInfo::resolveType):
+        (JSC::GetPutInfo::initializationMode):
+        (JSC::GetPutInfo::resolveMode):
+        (JSC::GetPutInfo::operand):
+        * runtime/JSGlobalLexicalEnvironment.cpp: Added.
+        (JSC::JSGlobalLexicalEnvironment::getOwnPropertySlot):
+        (JSC::JSGlobalLexicalEnvironment::put):
+        * runtime/JSGlobalLexicalEnvironment.h: Added.
+        (JSC::JSGlobalLexicalEnvironment::create):
+        (JSC::JSGlobalLexicalEnvironment::isEmpty):
+        (JSC::JSGlobalLexicalEnvironment::createStructure):
+        (JSC::JSGlobalLexicalEnvironment::JSGlobalLexicalEnvironment):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addVar):
+        (JSC::JSGlobalObject::globalScope):
+        (JSC::JSGlobalObject::globalLexicalEnvironment):
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
+        (JSC::constructEmptyArray):
+        (JSC::JSGlobalObject::symbolTableHasProperty): Deleted.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::JSLexicalEnvironment::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isGlobalObject):
+        (JSC::JSObject::isErrorInstance):
+        (JSC::JSObject::isVariableObject): Deleted.
+        (JSC::JSObject::isStaticScopeObject): Deleted.
+        (JSC::JSObject::isNameScopeObject): Deleted.
+        (JSC::JSObject::isActivationObject): Deleted.
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::visitChildren):
+        (JSC::abstractAccess):
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::abstractResolve):
+        (JSC::JSScope::collectVariablesUnderTDZ):
+        (JSC::isScopeType):
+        (JSC::JSScope::isVarScope):
+        (JSC::JSScope::isLexicalScope):
+        (JSC::JSScope::isCatchScope):
+        (JSC::JSScope::isFunctionNameScopeObject):
+        (JSC::JSScope::isGlobalLexicalEnvironment):
+        (JSC::JSScope::constantScopeForCodeBlock):
+        (JSC::resolveModeName): Deleted.
+        (JSC::resolveTypeName): Deleted.
+        * runtime/JSScope.h:
+        (JSC::makeType): Deleted.
+        (JSC::needsVarInjectionChecks): Deleted.
+        (JSC::ResolveOp::ResolveOp): Deleted.
+        (JSC::ResolveModeAndType::ResolveModeAndType): Deleted.
+        (JSC::ResolveModeAndType::mode): Deleted.
+        (JSC::ResolveModeAndType::type): Deleted.
+        (JSC::ResolveModeAndType::operand): Deleted.
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::findVariableIndex):
+        (JSC::JSSegmentedVariableObject::addVariables):
+        * runtime/JSSegmentedVariableObject.h:
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        * runtime/JSType.h:
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::isCacheablePut):
+        (JSC::PutPropertySlot::isCacheableSetter):
+        (JSC::PutPropertySlot::isCacheableCustom):
+        (JSC::PutPropertySlot::isInitialization):
+        (JSC::PutPropertySlot::cachedOffset):
+        * runtime/SymbolTable.h:
+        * tests/stress/global-lexical-let-no-rhs.js: Added.
+        (assert):
+        (foo):
+        * tests/stress/global-lexical-redeclare-variable.js: Added.
+        (globalFunction):
+        (globalClass):
+        (assert):
+        (assertExpectations):
+        (assertProperError):
+        * tests/stress/global-lexical-redefine-const.js: Added.
+        * tests/stress/global-lexical-var-injection.js: Added.
+        (assert):
+        (baz):
+        * tests/stress/global-lexical-variable-tdz.js: Added.
+        * tests/stress/global-lexical-variable-unresolved-property.js: Added.
+        * tests/stress/global-lexical-variable-with-statement.js: Added.
+        (assert):
+        (shouldThrowInvalidConstAssignment):
+        (makeObj):
+        * tests/stress/multiple-files-tests: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/fifth.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/first.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/fourth.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/second.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/sixth.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/third.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redefine-const: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redefine-const/first.js: Added.
+        (assert):
+        (shouldThrowInvalidConstAssignment):
+        * tests/stress/multiple-files-tests/global-lexical-redefine-const/second.js: Added.
+        (foo):
+        (bar):
+        (baz):
+        * tests/stress/multiple-files-tests/global-lexical-variable-tdz: Added.
+        * tests/stress/multiple-files-tests/global-lexical-variable-tdz/first.js: Added.
+        (assert):
+        (shouldThrowTDZ):
+        (foo):
+        (bar):
+        * tests/stress/multiple-files-tests/global-lexical-variable-tdz/second.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property: Added.
+        * tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/first.js: Added.
+        (assert):
+        (shouldThrowTDZ):
+        (foo):
+        * tests/stress/multiple-files-tests/global-lexical-variable-unresolved-property/second.js: Added.
+
+2015-09-03  Filip Pizlo  <fpizlo@apple.com>
+
+        RepatchBuffer should be stateless
+        https://bugs.webkit.org/show_bug.cgi?id=148741
+
+        Reviewed by Geoffrey Garen.
+
+        This removes our reliance on RepatchBuffer having a pointer to CodeBlock. This is in
+        preparation for removing RepatchBuffer entirely (see
+        https://bugs.webkit.org/show_bug.cgi?id=148742). In the longer term, this is necessary
+        for making inline cache code, particularly in StructureStubInfo, more self-contained.
+        Currently StructureStubInfo relies on very pointless-looking methods in CodeBlock to
+        clear itself, and the only thing that those methods do is create a RepatchBuffer. It's
+        quite silly.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::allocate):
+        (JSC::LinkBuffer::performFinalization):
+        * assembler/RepatchBuffer.h:
+        (JSC::RepatchBuffer::RepatchBuffer):
+        (JSC::RepatchBuffer::~RepatchBuffer):
+        (JSC::RepatchBuffer::relink):
+        (JSC::RepatchBuffer::revertJumpReplacementToPatchableBranch32WithPatch):
+        (JSC::RepatchBuffer::codeBlock): Deleted.
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::clearStub):
+        (JSC::CallLinkInfo::unlink):
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::registerPreservationMode):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::CallLinkInfo::setUpCall):
+        (JSC::CallLinkInfo::codeOrigin):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::resetStubInternal):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        * bytecode/PolymorphicGetByIdList.cpp:
+        (JSC::GetByIdAccess::fromStructureStubInfo):
+        (JSC::GetByIdAccess::visitWeak):
+        (JSC::PolymorphicGetByIdList::didSelfPatching):
+        (JSC::PolymorphicGetByIdList::visitWeak):
+        * bytecode/PolymorphicGetByIdList.h:
+        (JSC::GetByIdAccess::doesCalls):
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::fromStructureStubInfo):
+        (JSC::PutByIdAccess::visitWeak):
+        (JSC::PolymorphicPutByIdList::addAccess):
+        (JSC::PolymorphicPutByIdList::visitWeak):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::customSetter):
+        (JSC::PolymorphicPutByIdList::kind):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::seenOnce):
+        * jit/AccessorCallJITStubRoutine.cpp:
+        (JSC::AccessorCallJITStubRoutine::~AccessorCallJITStubRoutine):
+        (JSC::AccessorCallJITStubRoutine::visitWeak):
+        * jit/AccessorCallJITStubRoutine.h:
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeWritable): Deleted.
+        (JSC::ExecutableAllocator::makeExecutable): Deleted.
+        (JSC::ExecutableAllocator::allocator): Deleted.
+        * jit/JITStubRoutine.cpp:
+        (JSC::JITStubRoutine::~JITStubRoutine):
+        (JSC::JITStubRoutine::visitWeak):
+        * jit/JITStubRoutine.h:
+        * jit/PolymorphicCallStubRoutine.cpp:
+        (JSC::PolymorphicCallNode::~PolymorphicCallNode):
+        (JSC::PolymorphicCallNode::unlink):
+        (JSC::PolymorphicCallStubRoutine::clearCallNodesFor):
+        (JSC::PolymorphicCallStubRoutine::visitWeak):
+        * jit/PolymorphicCallStubRoutine.h:
+        (JSC::PolymorphicCallNode::hasCallLinkInfo):
+        * jit/Repatch.cpp:
+        (JSC::readCallTarget):
+        (JSC::repatchCall):
+        (JSC::repatchByIdSelfAccess):
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::revertCall):
+        (JSC::unlinkFor):
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::resetIn):
+        * jit/Repatch.h:
+
+2015-09-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Replace all the various forms of branchStructure() with a single method in AssemblyHelpers
+        https://bugs.webkit.org/show_bug.cgi?id=148725
+
+        Reviewed by Saam Barati.
+
+        Previously there were the following branchStructure() implementations:
+
+        JSC::JIT::branchStructure()
+        JSC::branchStructure()
+        JSC::DFG::JITCompiler::branchStructurePtr()
+
+        They all did the same thing.  Now there is only one, AssemblyHelpers::branchStructure().
+
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::branchWeakStructure):
+        (JSC::DFG::JITCompiler::jitCode):
+        (JSC::DFG::JITCompiler::branchStructurePtr): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfEmpty):
+        (JSC::AssemblyHelpers::branchStructure):
+        (JSC::AssemblyHelpers::addressForByteOffset):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::branchStructure): Deleted.
+        (JSC::branchStructure): Deleted.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        * jit/Repatch.cpp:
+        (JSC::checkObjectPropertyCondition):
+        (JSC::checkObjectPropertyConditions):
+        (JSC::generateByIdStub):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        (JSC::tryRepatchIn):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::loadJSStringArgument):
+
+2015-09-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove some unused methods from GetByIdAccess.
+
+        Rubber stamped by Michael Saboff.
+
+        * bytecode/PolymorphicGetByIdList.h:
+        (JSC::GetByIdAccess::stubRoutine):
+        (JSC::GetByIdAccess::doesCalls):
+        (JSC::GetByIdAccess::isWatched): Deleted.
+        (JSC::GetByIdAccess::isSimple): Deleted.
+
+2015-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix the no JIT build.
+
+        Unreviewed.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+
+2015-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        CodeBlock should have a more explicit "strongly referenced" state
+        https://bugs.webkit.org/show_bug.cgi?id=148714
+
+        Reviewed by Filip Pizlo.
+
+        Previously, CodeBlock had a "may be executing" bit, which was used by
+        both the stack visitor and the compiler to indicate "this CodeBlock must
+        not jettison itself".
+
+        Now, CodeBlock has an explicit "is strongly referenced" bit to do the
+        same.
+
+        For now, there is no behavior change. In future, I will use the "is
+        strongly referenced" bit to indicate the set of all references that
+        cause a CodeBlock not to jettison itself. Strong references and stack
+        references will be different because:
+
+            (1) A stack reference requires a write barrier at the end of GC
+            (since CodeBlocks only barrier themselves on function entry,
+            and GC will clear that barrier); but a strong reference does not
+            need or want a write barrier at the end of GC.
+
+            (2) Visiting more heap objects might reveal more strong references
+            but, by definition, it cannot reveal more stack references.
+
+        Also, this patch adds an explicit mark clearing phase for compiler
+        CodeBlocks, which does the work that would normally be done by a write
+        barrier. A compiler CodeBlock can't rely on a normal write barrier 
+        because the compiler writes to CodeBlocks without invoking a write
+        barrier, and because the CodeBlock write barrier operates on an
+        executable, but an in-flight compilation is not pointed to by any
+        executable. This bug does not appear to be noticeable in the current
+        system, but I will probably make it noticeable.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
+        (JSC::CodeBlock::isKnownToBeLiveDuringGC):
+        * bytecode/CodeBlock.h:
+        (JSC::ExecState::uncheckedR):
+        (JSC::CodeBlockSet::clearMarks):
+        (JSC::CodeBlockSet::mark):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::key):
+        (JSC::DFG::Plan::clearCodeBlockMarks):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        * dfg/DFGPlan.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::completeAllPlansForVM):
+        (JSC::DFG::Worklist::clearCodeBlockMarks):
+        (JSC::DFG::Worklist::suspendAllThreads):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::completeAllPlansForVM):
+        (JSC::DFG::clearCodeBlockMarks):
+        * dfg/DFGWorklist.h:
+        (JSC::DFG::worklistForIndexOrNull):
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::clearMarksForFullCollection):
+        (JSC::CodeBlockSet::clearMarksForEdenCollection):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        (JSC::CodeBlockSet::traceMarked):
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        * heap/CodeBlockSet.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+
+2015-09-01  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: protocol generator should not allow non-boolean values for "optional" key
+        https://bugs.webkit.org/show_bug.cgi?id=148679
+
+        Reviewed by Joseph Pecoraro.
+
+        In Python, the 'bool' type inherits from 'int'. In the runtime, True and False are
+        just numbers to Python. So, the existing check for boolean literals was not quite right.
+
+        * inspector/scripts/codegen/models.py: Use isinstance instead.
+        (TypeMember.__init__):
+        (Parameter.__init__):
+        * inspector/scripts/tests/expected/fail-on-number-typed-optional-parameter-flag.json-error: Added.
+        * inspector/scripts/tests/expected/fail-on-number-typed-optional-type-member.json-error: Added.
+        * inspector/scripts/tests/fail-on-number-typed-optional-parameter-flag.json: Added.
+        * inspector/scripts/tests/fail-on-number-typed-optional-type-member.json: Added.
+
+2015-09-01  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG AI assertions about not having to do type checks at the point of a Known use kind are unsound
+        https://bugs.webkit.org/show_bug.cgi?id=148649
+
+        Reviewed by Saam Barati.
+
+        We often generate IR like:
+
+        Check(Int32:@x)
+        ...
+        Foo(KnownInt32:@x)
+
+        It would be valid for any optimization that somehow proves the type of @x to remove the
+        Check node entirely. But then, AI might fail on an assertion at Foo() because of the
+        KnownInt32 use kind, if AI isn't smart enough to construct the same proof that the former
+        optimization used for removing the Check.
+
+        The correct solution is to remove the compile-time assertions about Known use kinds
+        having already been checked.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge):
+
+2015-09-01  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: tighten up lifetimes for InspectorController-owned objects; add brace initializers to agents
+        https://bugs.webkit.org/show_bug.cgi?id=148612
+
+        Reviewed by Joseph Pecoraro.
+
+        Both InjectedScriptManager and AgentRegistry (thus all agents) are
+        owned by JSGlobalObjectInspectorController. So, use references.
+
+        Add brace initalizers for scalar and pointer members in agent classes.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::addToFrontend):
+        (Inspector::ConsoleMessage::updateRepeatCountInConsole):
+        (Inspector::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::InspectorAgent):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::InspectorConsoleAgent):
+        (Inspector::InspectorConsoleAgent::enable):
+        (Inspector::InspectorConsoleAgent::clearMessages):
+        (Inspector::InspectorConsoleAgent::addMessageToConsole):
+        (Inspector::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (Inspector::InspectorDebuggerAgent::removeBreakpoint):
+        (Inspector::InspectorDebuggerAgent::getFunctionDetails):
+        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (Inspector::InspectorDebuggerAgent::didPause):
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        (Inspector::InspectorDebuggerAgent::didContinue):
+        (Inspector::InspectorDebuggerAgent::clearExceptionValue):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        (Inspector::InspectorRuntimeAgent::getDisplayableProperties):
+        (Inspector::InspectorRuntimeAgent::getCollectionEntries):
+        (Inspector::InspectorRuntimeAgent::saveResult):
+        (Inspector::InspectorRuntimeAgent::releaseObject):
+        (Inspector::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectConsoleAgent.cpp:
+        (Inspector::JSGlobalObjectConsoleAgent::JSGlobalObjectConsoleAgent):
+        * inspector/agents/JSGlobalObjectConsoleAgent.h:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::JSGlobalObjectDebuggerAgent):
+        (Inspector::JSGlobalObjectDebuggerAgent::injectedScriptForEval):
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        (Inspector::JSGlobalObjectRuntimeAgent::JSGlobalObjectRuntimeAgent):
+        (Inspector::JSGlobalObjectRuntimeAgent::injectedScriptForEval):
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+
+2015-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Introduce ModuleProgramExecutable families and compile Module code to bytecode
+        https://bugs.webkit.org/show_bug.cgi?id=148581
+
+        Reviewed by Saam Barati.
+
+        This patch introduces ModuleProgramExecutable, that is new executable type for the ES6 modules.
+        And related code block types, UninkedModuleProgramCodeBlock and ModuleProgramCodeBlock are also
+        introduced. BytecodeGenerator now recognizes these types and emits the bytecode and constructs
+        the symbol table for the module environment. While this patch introduces the bytecode generation
+        for the ES6 modules, the module environment instantiation initialization and imported binding
+        resolution are not included in this patch. They will be implemented in the subsequent patch.
+
+        The interesting part is the symbol table construction for the module environment.
+        Since the module code will be only executed once, the module environment need not to be allocated
+        and instantiated inside the module code; In the case of the function code, the function code need
+        to allocate the environment inside the prologue of it because the function code can be executed
+        more than once and the function environments are different in each time of the executions.
+        The module environment will be instantiated outside the module code before executing the module code.
+        This is required because we need to link the module environments to import the bindings before
+        executing the any module code in the dependency graph. And this is because the function inside the
+        module may be executed before the module top-level body is executed. (See the code comment for more
+        detailed situations)
+
+        The module environment will hold the top-most heap allocated variables in the module code.
+        This has the following benefits.
+        1) This enables JSC to perform the usual LocalClosureVar operations onto it.
+        2) It also makes the exported lexical variables just the heap allocated lexical variables.
+        3) Make it possible to initialize the heap allocated function declarations before executing the module
+           code. It is required under the circular dependency (see the code comment for more details).
+
+        To do so, the module environment will be constructed with the symbol table that is generated by the
+        bytecode generator. And the symbol table is held by the unlinked code block. That means, once the module
+        environment is instantiated, we cannot clear the unlinked code block before executing the module since
+        the layout of the instantiated module environment is coupled with the unlinked code block. This is OK
+        because the module code can be cleared once we executed the module code. If we failed to execute the
+        module (some errors occur), we can throw away the both, the module environment and the unlinked code block.
+
+        The unlinked module program code block holds the symbol table, but it does not hold the module environment.
+        So the unlinked module program code block can be cached. While unlinked code block can be cached, the linked
+        code block cannot be cached because it is already linked to the specific set of the module environment to
+        resolve the imported bindings.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::inferredName):
+        (JSC::ModuleProgramCodeBlock::replacement):
+        (JSC::ProgramCodeBlock::capabilityLevelInternal):
+        (JSC::ModuleProgramCodeBlock::capabilityLevelInternal):
+        * bytecode/CodeBlock.h:
+        (JSC::ModuleProgramCodeBlock::ModuleProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        * bytecode/CodeType.cpp:
+        (WTF::printInternal):
+        * bytecode/CodeType.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedModuleProgramCodeBlock::visitChildren):
+        (JSC::UnlinkedModuleProgramCodeBlock::destroy):
+        (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::instantiateLexicalVariables):
+        (JSC::BytecodeGenerator::emitPrefillStackTDZVariables):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::emitProgramNodeBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::ModuleProgramNode::emitBytecode):
+        (JSC::ImportDeclarationNode::emitBytecode):
+        (JSC::ExportAllDeclarationNode::emitBytecode):
+        (JSC::ExportDefaultDeclarationNode::emitBytecode):
+        (JSC::ExportLocalDeclarationNode::emitBytecode):
+        (JSC::ExportNamedDeclarationNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::StackFrame::friendlySourceURL):
+        (JSC::StackFrame::friendlyFunctionName):
+        (JSC::getStackFrameCodeType):
+        * interpreter/Interpreter.h:
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::codeType):
+        (JSC::StackVisitor::Frame::functionName):
+        (JSC::StackVisitor::Frame::sourceURL):
+        * interpreter/StackVisitor.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntEntrypoint.cpp:
+        (JSC::LLInt::setModuleProgramEntrypoint):
+        (JSC::LLInt::setEntrypoint):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::moduleProgramEntryThunkGenerator):
+        * llint/LLIntThunks.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::exportVariable):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseImportClauseItem):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        * parser/Parser.h:
+        (JSC::Scope::declareLexicalVariable):
+        * parser/VariableEnvironment.h:
+        (JSC::VariableEnvironmentEntry::isImportedNamespace):
+        (JSC::VariableEnvironmentEntry::setIsImportedNamespace):
+        (JSC::VariableEnvironment::find):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        * runtime/CodeCache.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode):
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ScriptExecutable::newReplacementCodeBlockFor):
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable):
+        (JSC::ModuleProgramExecutable::create):
+        (JSC::ModuleProgramExecutable::destroy):
+        (JSC::ModuleProgramExecutable::visitChildren):
+        (JSC::ModuleProgramExecutable::clearCode):
+        (JSC::ExecutableBase::dump):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::isModuleProgramExecutable):
+        (JSC::ExecutableBase::clearCodeVirtual):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::visitChildren):
+        (JSC::JSModuleRecord::link):
+        * runtime/JSModuleRecord.h:
+        (JSC::JSModuleRecord::moduleProgramExecutable):
+        * runtime/JSType.h:
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::moduleLoaderObjectModuleDeclarationInstantiation):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2015-08-31  Basile Clement  <basile_clement@apple.com>
+
+        Unreviewed, build fix after r189292
+
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::jsValueRegs): Deleted.
+
+2015-08-24  Basile Clement  <basile_clement@apple.com>
+
+        ValueRecovery should distinguish between doubles in an FPR and JSValues in an FPR
+        https://bugs.webkit.org/show_bug.cgi?id=148336
+
+        Reviewed by Michael Saboff.
+
+        Currently, ValueRecovery::InFPR means "this is a *double* value in an
+        FPR". Let's change the semantics to be "this is a *JSValue* in an FPR"
+        (to match ValueRecovery::InGPR), and introduce
+        ValueRecovery::UnboxedDoubleInFPR to mean "this is a double value in an
+        FPR".
+
+        * bytecode/ValueRecovery.cpp:
+        (JSC::ValueRecovery::dumpInContext):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::operator bool):
+        (JSC::ValueRecovery::inFPR):
+        (JSC::ValueRecovery::isInGPR):
+        (JSC::ValueRecovery::isInFPR):
+        (JSC::ValueRecovery::isInRegisters):
+        (JSC::ValueRecovery::isInJSStack):
+        (JSC::ValueRecovery::dataFormat):
+        (JSC::ValueRecovery::gpr):
+        (JSC::ValueRecovery::isInJSValueRegs):
+        (JSC::ValueRecovery::jsValueRegs):
+        (JSC::ValueRecovery::fpr):
+        (JSC::ValueRecovery::virtualRegister):
+        (JSC::ValueRecovery::constant):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+
+2015-08-31  Chris Dumez  <cdumez@apple.com>
+
+        NodeFilter.SHOW_ALL has wrong value on 32-bit
+        https://bugs.webkit.org/show_bug.cgi?id=148602
+
+        Reviewed by Geoffrey Garen.
+
+        NodeFilter.SHOW_ALL has wrong value on 32-bit. This is because
+        NodeFilter.SHOW_ALL is an unsigned long whose value is 0xFFFFFFFF but
+        our bindings code is casting it to an intptr_t type which is not wide
+        enough on 32-bit.
+
+        * create_hash_table:
+        Add extra curly brackets to initialize the union.
+
+        * runtime/Lookup.h:
+        Use a union type to store either a struct containing 2 intptr_t members
+        (value1 / value2) or a large constant of type unsigned long long. When
+        storing a constant, we only need one of the values so this allows us to
+        support larger constants without increasing the actual HashTableValue
+        size.
+
+2015-08-31  Mark Lam  <mark.lam@apple.com>
+
+        Watchdog timer callback should release the lock before deref'ing the watchdog.
+        https://bugs.webkit.org/show_bug.cgi?id=148635
+
+        Reviewed by Filip Pizlo.
+
+        The deref'ing of the watchdog may free it.  The lock may not be available to be unlocked
+        after the deref.
+
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::Watchdog):
+
+2015-08-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] JSON.stringify should ignore object properties that have symbol values and convert the symbol values in array to null
+        https://bugs.webkit.org/show_bug.cgi?id=148628
+
+        Reviewed by Saam Barati.
+
+        As per ECMA262 6.0,
+
+        1. JSON.stringify should ignore object properties that have symbol values.
+
+            SerializeJSONProperty[1] will return undefined if the value of the property is a symbol.
+            In this case, SerializeJSONObject[2] does not append any string for this property.
+
+        2. JSON.stringify should convert the symbol values in array to null
+
+            As the same to the object case, SerializeJSONProperty will return undefined if the value of the property is a symbol.
+            But in the case of arrays, if the result of SerializeJSONProperty is undefined, it will emit "null"[3].
+            This behavior is already implemented in the existing JSON.stringify. Added tests to ensure that.
+
+        [1]: http://www.ecma-international.org/ecma-262/6.0/#sec-serializejsonproperty
+        [2]: http://www.ecma-international.org/ecma-262/6.0/#sec-serializejsonobject
+        [3]: http://www.ecma-international.org/ecma-262/6.0/#sec-serializejsonarray
+
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        * tests/stress/symbol-with-json.js:
+        (shouldBe):
+
+2015-08-30  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC property attributes should fit in a byte
+        https://bugs.webkit.org/show_bug.cgi?id=148611
+
+        Reviewed by Sam Weinig.
+
+        I want to make room in PropertyMapEntry for more things to support property type inference (see
+        https://bugs.webkit.org/show_bug.cgi?id=148610). The most obvious candidate for a size reduction is
+        attributes, since we only have a small number of attribute bits. Even without complex changes, it
+        would have been possible to reduce the attribute field from 32 bits to 16 bits. Specifically, prior
+        to this change, the attributes field needed 9 bits. This made it very tempting to trim it so that
+        it could fit in a byte.
+
+        Luckily, many of the attributes bits are for the static lookup hashtables that we use for lazily
+        building objects in the standard library. Those bits don't need to stay around after the property
+        has been created, since they are just for telling the code in Lookup how to create the property.
+        So, this change separates the attributes bits into those that are interesting for Structure and
+        those that aren't. The ones used by Structure sit in the low 8 bits, allowing for the attributes
+        field in PropertyMapEntry to be a uint8_t. The attributes bits used only by Lookup use the higher
+        bits. In production, the conversion from the Lookup attributes to the Structure attributes is just
+        a cast to uint8_t. In debug, we assert that those bits are not dropped by accident. Code that
+        intentionally drops those bits calls attributesForStructure().
+
+        It turned out that there was a lot of code that was using the Function bit even in code that didn't
+        involve Lookup. This change removes those uses of Function. Structure does not need to know if we
+        think that a property points to a function.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::reifyStaticProperties):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+        * runtime/PropertySlot.h:
+        (JSC::attributesForStructure):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCacheableCustom):
+        (JSC::PropertySlot::setGetterSlot):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        * runtime/Structure.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+
+2015-08-29  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, fix PropertyName::isNull() that was introduced in r188994.
+
+        The condition was reversed.
+
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::isNull):
+
+2015-08-28  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189136.
+        https://bugs.webkit.org/show_bug.cgi?id=148608
+
+        Made JSC tests flaky (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "[JSC][x86] Improve the compare functions when comparing with
+        zero"
+        https://bugs.webkit.org/show_bug.cgi?id=148536
+        http://trac.webkit.org/changeset/189136
+
+2015-08-28  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Get rid of DFG's MergeMode
+        https://bugs.webkit.org/show_bug.cgi?id=148245
+
+        Reviewed by Mark Lam.
+
+        That code has become useless, the merge mode is always MergeToSuccessors.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+        * dfg/DFGInPlaceAbstractState.h:
+        * dfg/DFGMergeMode.h: Removed.
+
+2015-08-28  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC][x86] Improve the compare functions when comparing with zero
+        https://bugs.webkit.org/show_bug.cgi?id=148536
+
+        Reviewed by Geoffrey Garen.
+
+        This patch has two parts:
+        1) The macro assembler gets an additional cmp->test optimization
+           for LessThan and GreaterThanOrEqual.
+           Instead of comparing the value with an immediate, test the value
+           with itself and use the flag.
+        2) Extend the DFG JIT optimization of compare.
+           In particular, use the same optimization in compileInt32Compare()
+           as we have in compilePeepHoleBooleanBranch().
+           The generator compileInt32Compare() is unfortunately very
+           common due to MoveHints placed between the Compare node and the Branch
+           node.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::compare32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::compare32):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32Compare):
+
+2015-08-28  Mark Lam  <mark.lam@apple.com>
+
+        Add MacroAssemblerPrinter support for printing memory.
+        https://bugs.webkit.org/show_bug.cgi?id=148600
+
+        Reviewed by Saam Barati.
+
+        Previously, we can dump registers at runtime.  Now we can dump memory too.
+        See comment in MacroAssemblerPrinter.h for examples of how to do this.
+
+        * assembler/MacroAssemblerPrinter.cpp:
+        (JSC::printMemory):
+        (JSC::MacroAssemblerPrinter::printCallback):
+        * assembler/MacroAssemblerPrinter.h:
+        (JSC::Memory::Memory):
+        (JSC::MemWord::MemWord):
+        (JSC::MacroAssemblerPrinter::PrintArg::PrintArg):
+
+2015-08-28  Khem Raj  <raj.khem@gmail.com>
+
+        JavaScriptCore fails to build using GCC 5
+        https://bugs.webkit.org/show_bug.cgi?id=147815
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSObject.cpp: Explicitly instantiate all variants of
+        putByIndexBeyondVectorLengthWithAttributes used by JSArray.cpp.
+
+2015-08-28  Mark Lam  <mark.lam@apple.com>
+
+        Refactor the JIT printer out of the AbstractMacroAssembler into MacroAssemblerPrinter.
+        https://bugs.webkit.org/show_bug.cgi?id=148595
+
+        Reviewed by Geoffrey Garen.
+
+        Why do this?
+        1. MacroAssembler::print() code (except for the prototype) need no longer be parsed
+           when compiling C++ files that don't need it.
+        2. Adding support for more printable types to MacroAssemblerPrinter::PrintArg
+           triggers recompilation of less files.
+        3. The printing code is for most the part common between all target platforms and
+           was previously duplicated by cut-and-paste to all the varieties of MacroAssemblers
+           that support the MASM_PROBE mechanism.  Now, there is only one copy in
+           MacroAssemblerPrinter.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ProbeContext::print): Deleted.
+        - Removed this function because it is no longer useful since we have this more
+          flexible print() functionality.
+
+        (JSC::AbstractMacroAssembler::printIndent): Deleted.
+        (JSC::AbstractMacroAssembler::printCPU): Deleted.
+        (JSC::AbstractMacroAssembler::print): Deleted.
+        (JSC::AbstractMacroAssembler::PrintArg::PrintArg): Deleted.
+        (JSC::AbstractMacroAssembler::appendPrintArg): Deleted.
+        (JSC::AbstractMacroAssembler::printInternal): Deleted.
+        (JSC::AbstractMacroAssembler::printCallback): Deleted.
+        - These got moved into MacroAssemblerPrinter.cpp.
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::printCPURegisters): Deleted.
+        (JSC::MacroAssemblerARM::printRegister): Deleted.
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.cpp:
+        (JSC::MacroAssemblerARMv7::printCPURegisters): Deleted.
+        (JSC::MacroAssemblerARMv7::printRegister): Deleted.
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.cpp:
+        (JSC::MacroAssemblerX86Common::printCPURegisters): Deleted.
+        (JSC::MacroAssemblerX86Common::printRegister): Deleted.
+        * assembler/MacroAssemblerX86Common.h:
+        - Deleted a whole bunch of mostly duplicated code.
+
+        * assembler/MacroAssemblerPrinter.cpp: Added.
+        (JSC::printIndent):
+        (JSC::printCPU):
+        (JSC::printCPURegisters):
+        (JSC::printRegister):
+        (JSC::MacroAssemblerPrinter::printCallback):
+        * assembler/MacroAssemblerPrinter.h: Added.
+        (JSC::MacroAssemblerPrinter::print):
+        (JSC::MacroAssemblerPrinter::PrintArg::PrintArg):
+        (JSC::MacroAssemblerPrinter::appendPrintArg):
+        (JSC::MacroAssembler::print):
+
+2015-08-28  Filip Pizlo  <fpizlo@apple.com>
+
+        LICM should be sound even if the CFG has changed
+        https://bugs.webkit.org/show_bug.cgi?id=148259
+
+        Reviewed by Benjamin Poulain.
+
+        Prior to this change, LICM expected a certain CFG shape around a loop: broken critical edges,
+        a pre-header, and the pre-header's terminal has exitOK. LICM would either crash on an
+        assertion, or generate code that fails validation, if these conditions weren't met.
+
+        The broken critical edge assumption is fine; so far we are assuming that SSA means broken
+        critical edges. We may revisit this, but we don't have to right now.
+
+        The other assumptions are not fine, because it's hard to guarantee that every phase will
+        preserve the presence of pre-headers. Even if we required that pre-headers are regenerated
+        before LICM, that regeneration wouldn't be guaranteed to create pre-headers that have exitOK at
+        the terminal. That's because once in SSA, the loop header probably has exitOK=false at the
+        head because of Phi's. Pre-header creation has no choice but to use the Node::origin from the
+        loop header, which means creating a pre-header that has exitOK=false. Regardless of whether
+        that's a fixable problem, it seems that our best short-term approach is just to be defensive
+        and turn undesirable pathologies into performance bugs and not crashes.
+
+        For the foreseeable future, once pre-headers are created they will probably not be removed. Our
+        current CFG simplification phase doesn't have a rule for removing pre-headers (since it doesn't
+        have any jump threading). So, it wouldn't be profitable to put effort towards reneration of
+        pre-headers for LICM's benefit.
+
+        Also, we cannot guarantee that some sequence of CFG transformations will not create a loop that
+        doesn't have a pre-header. This would be super rare. But you could imagine that some program
+        has control flow encoded using relooping (like
+        https://github.com/kripken/Relooper/blob/master/paper.pdf). If that happens, our compiler will
+        probably incrementally discover the "original" CFG. That may happen only after SSA conversion,
+        and so after pre-header generation. This is super unlikely for a bunch of reasons, but it
+        *could* happen.
+
+        So, this patch just makes sure that if pre-headers are missing or cannot be exited from, LICM
+        will simply avoid hoisting out of that block. At some point later, we can worry about a more
+        comprehensive solution to the pre-header problem. That's covered by this bug:
+        https://bugs.webkit.org/show_bug.cgi?id=148586
+
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * runtime/Options.h:
+        * tests/stress/licm-no-pre-header.js: Added.
+        (foo):
+        * tests/stress/licm-pre-header-cannot-exit.js: Added.
+        (foo):
+
+2015-08-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Move std::function from JSFunction into NativeStdFunctionCell to correctly destroy the heap allocated std::function
+        https://bugs.webkit.org/show_bug.cgi?id=148262
+
+        Reviewed by Filip Pizlo.
+
+        std::function is heap allocated value. So if this is held in the JSCell, the cell should be destructible.
+        Before this patch, it is held in the JSStdFunction. JSStdFunction is the derived class from the JSFunction,
+        and they are not destructible. So it leaked the memory.
+
+        This patch extracts std::function field from the JSStdFunction to the NativeStdFunctionCell. NativeStdFunctionCell
+        is responsible for destructing the held std::function.
+        Instead of moving std::function to the ExecutableBase, we move it to the newly created NativeStdFunctionCell cell.
+        The reason is the following.
+
+        - Each NativeExecutable (in 64_32 JIT environment) has the trampolines to call given host functions.
+          And the address of the host function is directly embedded on the JIT-compiled trampoline code.
+        - To suppress the overuse of the executable memory (which is used to generate the trampoline), NativeExecutable
+          is cached. The host function address is used as the key to look up the cached executable from the table.
+        - In all the JSStdFunction, we use the same host function that immediately calls the each std::function.
+        - As a result, without any change, all the JSStdFunction hit the same cached NativeExecutable even if the held
+          std::function is different.
+        - To solve it, if we put the std::function in the NativeExecutable, we need to add this std::function
+          identity (like address) to the cache key, because the address of the stub host function (that calls the
+          std::function) is the same in the all JSStdFunction.
+        - But since the std::function will be allocated in the heap, this address is always different. So caching has
+          no effect.
+        - If we do not cache the NativeExecutable that holds the std::function, each time when creating the JSStdFunction,
+          we need to regenerate the completely same trampolines (since it just calls the same host function stub that
+          calls the std::function).
+
+        And this patch drops JSArrowFunction::destroy because (1) JSArrowFunction is not destructible and (2) it no longer
+        holds any fields that require destructions.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/JSArrowFunction.cpp:
+        (JSC::JSArrowFunction::destroy): Deleted.
+        * runtime/JSArrowFunction.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::lookUpOrCreateNativeExecutable):
+        (JSC::JSFunction::create):
+        (JSC::getNativeExecutable): Deleted.
+        (JSC::JSStdFunction::JSStdFunction): Deleted.
+        (JSC::runStdFunction): Deleted.
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::nativeStdFunctionStructure):
+        * runtime/JSNativeStdFunction.cpp: Added.
+        (JSC::JSNativeStdFunction::JSNativeStdFunction):
+        (JSC::JSNativeStdFunction::visitChildren):
+        (JSC::JSNativeStdFunction::finishCreation):
+        (JSC::runStdFunction):
+        (JSC::JSNativeStdFunction::create):
+        * runtime/JSNativeStdFunction.h: Copied from Source/JavaScriptCore/runtime/JSArrowFunction.h.
+        (JSC::JSNativeStdFunction::createStructure):
+        (JSC::JSNativeStdFunction::nativeStdFunctionCell):
+        * runtime/NativeStdFunctionCell.cpp: Added.
+        (JSC::NativeStdFunctionCell::create):
+        (JSC::NativeStdFunctionCell::NativeStdFunctionCell):
+        (JSC::NativeStdFunctionCell::destroy):
+        * runtime/NativeStdFunctionCell.h: Added.
+        (JSC::NativeStdFunctionCell::createStructure):
+        (JSC::NativeStdFunctionCell::function):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2015-08-28  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Create WebAssembly functions
+        https://bugs.webkit.org/show_bug.cgi?id=148373
+
+        Reviewed by Filip Pizlo.
+
+        Create functions from WebAssembly files generated by pack-asmjs
+        <https://github.com/WebAssembly/polyfill-prototype-1>.
+        WebAssembly functions created by this patch can only return 0.
+        Actual code generation will be implemented in subsequent patches.
+
+        This patch introduces WebAssemblyExecutable, a new subclass of
+        ExecutableBase for WebAssembly functions. CodeBlocks can now have
+        an owner that is not a ScriptExecutable. This patch changes the
+        return type of CodeBlock::ownerExecutable() from ScriptExecutable*
+        to ExecutableBase*. It also changes code that calls ScriptExecutable's
+        methods on CodeBlock::ownerExecutable() to use
+        CodeBlock::ownerScriptExecutable(), which does jsCast<ScriptExecutable*>.
+
+        Since ownerScriptExecutable() is called from WebCore and it uses
+        jsCast<ScriptExecutable*>, this patch needs to export
+        ScriptExecutable::info(). This should fix the build error in
+        https://bugs.webkit.org/show_bug.cgi?id=148555
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hash):
+        (JSC::CodeBlock::sourceCodeForTools):
+        (JSC::CodeBlock::dumpAssumingJITType):
+        (JSC::CodeBlock::dumpSource):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::install):
+        (JSC::CodeBlock::newReplacement):
+        (JSC::WebAssemblyCodeBlock::replacement):
+        (JSC::WebAssemblyCodeBlock::capabilityLevelInternal):
+        (JSC::CodeBlock::updateAllPredictions):
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::ownerScriptExecutable):
+        (JSC::CodeBlock::codeType):
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::toggleBreakpoint):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::sourceIDForCallFrame):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::executable):
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::isSupportedForInlining):
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::executableFor):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::CreateScriptCallStackFunctor::operator()):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::isWebAssemblyExecutable):
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::UnwindFunctor::operator()):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::sourceURL):
+        (JSC::StackVisitor::Frame::computeLineAndColumn):
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable):
+        (JSC::WebAssemblyExecutable::destroy):
+        (JSC::WebAssemblyExecutable::visitChildren):
+        (JSC::WebAssemblyExecutable::clearCode):
+        (JSC::WebAssemblyExecutable::prepareForExecution):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::isEvalExecutable):
+        (JSC::ExecutableBase::isFunctionExecutable):
+        (JSC::ExecutableBase::isProgramExecutable):
+        (JSC::ExecutableBase::isWebAssemblyExecutable):
+        (JSC::ExecutableBase::clearCodeVirtual):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::isBuiltinFunction):
+        * runtime/JSType.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::functions):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::compile):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::WASMModuleParser):
+        (JSC::WASMModuleParser::parse):
+        (JSC::WASMModuleParser::parseFunctionDeclarationSection):
+        (JSC::WASMModuleParser::parseFunctionDefinition):
+        (JSC::WASMModuleParser::parseExportSection):
+        (JSC::parseWebAssembly):
+        * wasm/WASMModuleParser.h:
+
+2015-08-28  Mark Lam  <mark.lam@apple.com>
+
+        [Follow up] ScratchRegisterAllocator::preserveReusedRegistersByPushing() should allow room for C helper calls and keep sp properly aligned.
+        https://bugs.webkit.org/show_bug.cgi?id=148564
+
+        Not reviewed.
+
+        Updated the test to run with //@ runNoCJITNoAccessInlining instead of specifying
+        the JSC option directly via //@ run().  This is the right thing to do in order
+        to guarantee that the test will be compiled by the DFG.
+
+        * tests/stress/regress-148564.js:
+
+2015-08-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Separate creating a style sheet from adding a new rule in the protocol
+        https://bugs.webkit.org/show_bug.cgi?id=148502
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/CSS.json:
+        Add CSS.createStyleSheet. Modify CSS.addRule.
+
+2015-08-28  Mark Lam  <mark.lam@apple.com>
+
+        ScratchRegisterAllocator::preserveReusedRegistersByPushing() should allow room for C helper calls and keep sp properly aligned.
+        https://bugs.webkit.org/show_bug.cgi?id=148564
+
+        Reviewed by Saam Barati.
+
+        ScratchRegisterAllocator::preserveReusedRegistersByPushing() pushes registers on
+        the stack in order to preserve them.  But emitPutTransitionStub() (which uses
+        preserveReusedRegistersByPushing()) may also emit a call to a C helper function
+        to flush the heap write barrier buffer.  The code for emitting a C helper call
+        expects the stack pointer (sp) to already be pointing to a location on the stack
+        where there's adequate space reserved for storing the arguments to the C helper,
+        and that space is expected to be at the top of the stack.  Hence, there is a
+        conflict of expectations.  As a result, the arguments for the C helper will
+        overwrite and corrupt the values that are pushed on the stack by
+        preserveReusedRegistersByPushing().
+
+        In addition, JIT compiled functions always position the sp such that it will be
+        aligned (according to platform ABI dictates) after a C call is made (i.e. after
+        the frame pointer and return address is pushed on to the stack).
+        preserveReusedRegistersByPushing()'s arbitrary pushing of a number of saved
+        register values may mess up this alignment.
+
+        The fix is to have preserveReusedRegistersByPushing(), after it has pushed the
+        saved register values, adjust the sp to reserve an additional amount of stack
+        space needed for C call helpers plus any padding needed to restore proper sp
+        alignment.  The stack's ReservedZone will ensure that we have enough stack space
+        for this.  ScratchRegisterAllocator::restoreReusedRegistersByPopping() also
+        needs to be updated to perform the complement of this behavior.
+
+        * jit/Repatch.cpp:
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        * jit/ScratchRegisterAllocator.cpp:
+        (JSC::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::numberOfReusedRegisters):
+        * tests/stress/regress-148564.js: Added.
+        (test):
+        (runTest):
+
+2015-08-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed Windows buildfix.
+
+        Revert part of r189072 since the original change was rolled out by r189085.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-08-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed Windows buildfix.
+
+        Revert r189077 since the original change was rolled out by r189085.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-08-27  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Module execution and Loader's ready / link phase
+        https://bugs.webkit.org/show_bug.cgi?id=148172
+
+        Reviewed by Saam Barati.
+
+        This patch adds the link / ready phases to the existing module loader.
+        They are just the stubs and the actual implementations will be
+        forthcoming in the subsequnt patch.
+
+        And this patch paves the way to instantiate the module environment and
+        compile the executable code in the link phase. Move declaredVariables /
+        lexicalVariables from ModuleAnalyzer to JSModuleRecord to use them when
+        instantiating the module environment. Hold the source code in
+        JSModuleRecord to construct the executable in the link phase. And to
+        use HostResolveImportedModule operation from the C++ side, we expose
+        the JSMap from C++ to JS and use it in the builtin JS module loader
+        code.
+
+        * builtins/ModuleLoaderObject.js:
+        (requestResolveDependencies.resolveDependenciesPromise.this.requestInstantiate.then.):
+        (requestLink):
+        (requestReady):
+        (link):
+        (moduleEvaluation):
+        (loadModule):
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::ModuleAnalyzer):
+        (JSC::ModuleAnalyzer::analyze):
+        * parser/ModuleAnalyzer.h:
+        * runtime/Completion.cpp:
+        (JSC::checkModuleSyntax):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::finishCreation):
+        (JSC::JSModuleRecord::visitChildren):
+        (JSC::identifierToJSValue):
+        (JSC::JSModuleRecord::hostResolveImportedModule):
+        (JSC::JSModuleRecord::link):
+        (JSC::JSModuleRecord::execute):
+        * runtime/JSModuleRecord.h:
+        (JSC::JSModuleRecord::create):
+        (JSC::JSModuleRecord::sourceCode):
+        (JSC::JSModuleRecord::moduleKey):
+        (JSC::JSModuleRecord::exportEntries):
+        (JSC::JSModuleRecord::importEntries):
+        (JSC::JSModuleRecord::declaredVariables):
+        (JSC::JSModuleRecord::lexicalVariables):
+        (JSC::JSModuleRecord::JSModuleRecord):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::moduleLoaderObjectParseModule):
+        (JSC::moduleLoaderObjectRequestedModules):
+        (JSC::moduleLoaderObjectModuleDeclarationInstantiation):
+        (JSC::moduleLoaderObjectEvaluate):
+        (JSC::ModuleLoaderObject::requestInstantiateAll): Deleted.
+        * runtime/ModuleLoaderObject.h:
+
+2015-08-27  Mark Lam  <mark.lam@apple.com>
+
+        Add noDFG() to jsc to prevent DFG compilation of a specified function.
+        https://bugs.webkit.org/show_bug.cgi?id=148559
+
+        Reviewed by Geoffrey Garen and Saam Barati.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::setNeverInline):
+        (JSC::setNeverOptimize):
+        * API/JSCTestRunnerUtils.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::mightInlineFunctionForCall):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionNoDFG):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ecmaMode):
+        (JSC::ScriptExecutable::setNeverInline):
+        (JSC::ScriptExecutable::setNeverOptimize):
+        (JSC::ScriptExecutable::setDidTryToEnterInLoop):
+        (JSC::ScriptExecutable::neverInline):
+        (JSC::ScriptExecutable::neverOptimize):
+        (JSC::ScriptExecutable::didTryToEnterInLoop):
+        (JSC::ScriptExecutable::isInliningCandidate):
+        (JSC::ScriptExecutable::isOkToOptimize):
+        (JSC::ScriptExecutable::addressOfDidTryToEnterInLoop):
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::setNeverInline):
+        (JSC::setNeverOptimize):
+        (JSC::optimizeNextInvocation):
+        * runtime/TestRunnerUtils.h:
+
+2015-08-27  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189064 and r189084.
+        https://bugs.webkit.org/show_bug.cgi?id=148560
+
+        Breaks 117 JSC tests. (Requested by mlam on #webkit).
+
+        Reverted changesets:
+
+        "[ES6] Add TypedArray.prototype functionality."
+        https://bugs.webkit.org/show_bug.cgi?id=148035
+        http://trac.webkit.org/changeset/189064
+
+        "Unbreak JSC tests (broken since r189064)."
+        http://trac.webkit.org/changeset/189084
+
+2015-08-27  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r189079.
+        https://bugs.webkit.org/show_bug.cgi?id=148555
+
+        broke the build (Requested by jessieberlin on #webkit).
+
+        Reverted changeset:
+
+        "Create WebAssembly functions"
+        https://bugs.webkit.org/show_bug.cgi?id=148373
+        http://trac.webkit.org/changeset/189079
+
+2015-08-27  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Create WebAssembly functions
+        https://bugs.webkit.org/show_bug.cgi?id=148373
+
+        Reviewed by Geoffrey Garen.
+
+        Create functions from WebAssembly files generated by pack-asmjs
+        <https://github.com/WebAssembly/polyfill-prototype-1>.
+        WebAssembly functions created by this patch can only return 0.
+        Actual code generation will be implemented in subsequent patches.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::hash):
+        (JSC::CodeBlock::sourceCodeForTools):
+        (JSC::CodeBlock::dumpAssumingJITType):
+        (JSC::CodeBlock::dumpSource):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::install):
+        (JSC::CodeBlock::newReplacement):
+        (JSC::WebAssemblyCodeBlock::replacement):
+        (JSC::WebAssemblyCodeBlock::capabilityLevelInternal):
+        (JSC::CodeBlock::updateAllPredictions):
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ownerExecutable):
+        (JSC::CodeBlock::ownerScriptExecutable):
+        (JSC::CodeBlock::codeType):
+        (JSC::WebAssemblyCodeBlock::WebAssemblyCodeBlock):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::toggleBreakpoint):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::sourceIDForCallFrame):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::executable):
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::isSupportedForInlining):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::executableFor):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::CreateScriptCallStackFunctor::operator()):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::isWebAssemblyExecutable):
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::UnwindFunctor::operator()):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::sourceURL):
+        (JSC::StackVisitor::Frame::computeLineAndColumn):
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::isWebAssemblyExecutable):
+        (JSC::linkPolymorphicCall):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable):
+        (JSC::WebAssemblyExecutable::destroy):
+        (JSC::WebAssemblyExecutable::visitChildren):
+        (JSC::WebAssemblyExecutable::clearCode):
+        (JSC::WebAssemblyExecutable::prepareForExecution):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::isEvalExecutable):
+        (JSC::ExecutableBase::isFunctionExecutable):
+        (JSC::ExecutableBase::isProgramExecutable):
+        (JSC::ExecutableBase::isWebAssemblyExecutable):
+        (JSC::ExecutableBase::clearCodeVirtual):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::isBuiltinFunction):
+        * runtime/JSType.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::functions):
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::compile):
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::WASMModuleParser):
+        (JSC::WASMModuleParser::parse):
+        (JSC::WASMModuleParser::parseFunctionDeclarationSection):
+        (JSC::WASMModuleParser::parseFunctionDefinition):
+        (JSC::WASMModuleParser::parseExportSection):
+        (JSC::parseWebAssembly):
+        * wasm/WASMModuleParser.h:
+
+2015-08-27  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed build fix after r189064.
+
+        JSTypedArrayViewPrototypes.{h,cpp} -> JSTypedArrayViewPrototype.{h,cpp}
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-08-27  Alex Christensen  <achristensen@webkit.org>
+
+        Make DLLLauncherMain executables dependent on dll
+        https://bugs.webkit.org/show_bug.cgi?id=148548
+
+        Reviewed by Brent Fulgham.
+
+        * shell/CMakeLists.txt:
+        * shell/PlatformWin.cmake:
+
+2015-08-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::StrCat isn't really effectful
+        https://bugs.webkit.org/show_bug.cgi?id=148443
+
+        Reviewed by Geoffrey Garen.
+
+        I previously made the DFG StrCat node effectful because it is implemented by calling a
+        DFGOperations function that could cause arbitrary effects. But, the node is only generated from the
+        op_strcat bytecode operation, and that operation is only used when we first ensure that its
+        operands are primitives. Primitive operands to StrCat cannot cause arbitrary side-effects. The
+        reason why I didn't immediately mark StrCat as pure was because there was nothing in DFG IR that
+        guaranteed that StrCat's children were primitives.
+
+        This change adds a KnownPrimitiveUse use kind, and applies it to StrCat. This allows us to mark
+        StrCat as being pure. This should be a speed-up because we can CSE StrCat and because it means that
+        we can OSR exit after a StrCat (a pure node doesn't clobber exit state), so we can convert more
+        of a large string concatenation into MakeRope's.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::shouldNotHaveTypeCheck):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStrCat):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
+
+2015-08-27  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed build fix after r189064.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-08-27  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Add module loader "resolve" hook for local file system to test the loader in JSC shell
+        https://bugs.webkit.org/show_bug.cgi?id=148543
+
+        Reviewed by Filip Pizlo.
+
+        Add the module loader "resolve" hook to the JSC shell.
+        It takes the module name and the referrer module key and resolves the name to the unique module key.
+
+        resolve(ModuleName moduleName, ModuleKey referrer) -> Promise<ModuleKey>
+
+        In the JSC shell, since we load the module from the local file system, we treat an absolute file path
+        as a module key. So, in this patch, we implement the "resolve" hook that resolves the module name to
+        the absolute file path.
+
+        This local file system "resolve" functionality makes JSC shell easy to test the module loader.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (GlobalObject::moduleLoaderFetch):
+        (pathSeparator):
+        (extractDirectoryName):
+        (currentWorkingDirectory):
+        (resolvePath):
+        (GlobalObject::moduleLoaderResolve):
+        (functionDrainMicrotasks):
+        * runtime/JSInternalPromiseDeferred.cpp:
+        (JSC::JSInternalPromiseDeferred::resolve):
+        (JSC::JSInternalPromiseDeferred::reject):
+        * runtime/JSInternalPromiseDeferred.h:
+        * tests/stress/pathname-resolve.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-08-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix some FIXMEs and add some new ones, based on things we've learned from some
+        recent OSR exit work.
+
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGMayExit.h:
+
+2015-08-27  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add TypedArray.prototype functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=148035
+
+        Reviewed by Geoffrey Garen.
+
+        This patch should add most of the functionality for
+        the prototype properties of TypedArray objects in ES6.
+        There are a few exceptions to this, which will be added
+        in upcoming patches:
+
+        1) First we do not use the species constructor for some
+        of the TypedArray prototype functions (namely: map, filter,
+        slice, and subarray). That will need to be added when
+        species constructors are finished.
+
+        2) TypedArrays still have a length, byteOffset, byteLength,
+        and buffer are still attached to the TypedArray instance (in
+        the spec they are on the TypedArray.prototype instance object)
+        since the JIT currently assumes those properties are fixed.
+
+        3) The TypedArray.constructor property is not added yet
+        as it should point to the TypedArray instance object,
+        which will be added in a future patch.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/TypedArray.prototype.js: Added.
+        (every):
+        (find):
+        (findIndex):
+        (forEach):
+        (some):
+        (sort.min):
+        (sort.merge):
+        (sort.mergeSort):
+        (sort):
+        (reduce):
+        (reduceRight):
+        (map):
+        (filter):
+        (toLocaleString):
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::sortFloat):
+        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue):
+        (JSC::JSGenericTypedArrayView::setRangeToValue):
+        (JSC::JSGenericTypedArrayView::sort):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h: Added.
+        (JSC::argumentClampedIndexFromStartOrEnd):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncEntries):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncFill):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncKeys):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoGetterFuncLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteOffset):
+        (JSC::genericTypedArrayViewProtoFuncReverse):
+        (JSC::genericTypedArrayViewPrivateFuncSort):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewProtoFuncSubarray):
+        (JSC::typedArrayViewProtoFuncValues):
+        * runtime/JSGenericTypedArrayViewPrototypeInlines.h:
+        (JSC::JSGenericTypedArrayViewPrototype<ViewClass>::finishCreation):
+        (JSC::genericTypedArrayViewProtoFuncSet): Deleted.
+        (JSC::genericTypedArrayViewProtoFuncSubarray): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSObject.h:
+        * runtime/JSTypedArrayPrototypes.cpp:
+        * runtime/JSTypedArrayPrototypes.h:
+        * runtime/JSTypedArrayViewPrototype.cpp: Added.
+        (JSC::typedArrayViewPrivateFuncLength):
+        (JSC::typedArrayViewPrivateFuncSort):
+        (JSC::typedArrayViewProtoFuncSet):
+        (JSC::typedArrayViewProtoFuncEntries):
+        (JSC::typedArrayViewProtoFuncCopyWithin):
+        (JSC::typedArrayViewProtoFuncFill):
+        (JSC::typedArrayViewProtoFuncLastIndexOf):
+        (JSC::typedArrayViewProtoFuncIndexOf):
+        (JSC::typedArrayViewProtoFuncJoin):
+        (JSC::typedArrayViewProtoFuncKeys):
+        (JSC::typedArrayViewProtoGetterFuncLength):
+        (JSC::typedArrayViewProtoGetterFuncByteLength):
+        (JSC::typedArrayViewProtoGetterFuncByteOffset):
+        (JSC::typedArrayViewProtoFuncReverse):
+        (JSC::typedArrayViewProtoFuncSubarray):
+        (JSC::typedArrayViewProtoFuncSlice):
+        (JSC::typedArrayViewProtoFuncValues):
+        (JSC::JSTypedArrayViewPrototype::JSTypedArrayViewPrototype):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        (JSC::JSTypedArrayViewPrototype::create):
+        (JSC::JSTypedArrayViewPrototype::createStructure):
+        * runtime/JSTypedArrayViewPrototype.h: Copied from Source/JavaScriptCore/runtime/JSTypedArrayPrototypes.cpp.
+
+2015-08-27  Alex Christensen  <achristensen@webkit.org>
+
+        Isolate Source directories in CMake build
+        https://bugs.webkit.org/show_bug.cgi?id=148389
+
+        Reviewed by Brent Fulgham.
+
+        * PlatformWin.cmake:
+        Include ../include/private to find WTF headers in internal build.
+        Don't use a script to generate forwarding headers.
+        * shell/PlatformWin.cmake:
+        Copy inspector scripts to the forwarding headers directory to be used by WebCore.
+
+2015-08-27  Alex Christensen  <achristensen@webkit.org>
+
+        [Win CMake] Fix incremental build after r188673
+        https://bugs.webkit.org/show_bug.cgi?id=148539
+
+        Reviewed by Brent Fulgham.
+
+        * PlatformWin.cmake:
+        Use xcopy as a build step instead of file(COPY ...) to copy updated headers.
+
+2015-08-27  Jon Davis  <jond@apple.com>
+
+        Include ES6 Generators and Proxy object status to feature status page.
+        https://bugs.webkit.org/show_bug.cgi?id=148095
+
+        Reviewed by Timothy Hatcher.
+
+        * features.json:
+
+2015-08-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add a comment to describe something I learned about a confusingly-named function.
+
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::isCell):
+
+2015-08-27  Basile Clement  <basile_clement@apple.com>
+
+        REGRESSION(r184779): Possible read-after-free in JavaScriptCore/dfg/DFGClobberize.h
+        https://bugs.webkit.org/show_bug.cgi?id=148411
+
+        Reviewed by Geoffrey Garen and Filip Pizlo.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2015-08-27  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: FrontendChannel should know its own connection type
+        https://bugs.webkit.org/show_bug.cgi?id=148482
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/InspectorFrontendChannel.h: Add connectionType().
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+
+2015-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Node::origin should always be set, and the dead zone due to SSA Phis can just use exitOK=false
+        https://bugs.webkit.org/show_bug.cgi?id=148462
+
+        Reviewed by Saam Barati.
+
+        The need to label nodes that absolutely cannot exit was first observed when we introduced SSA form.
+        We indicated this by not setting the CodeOrigin.
+
+        But just recently (http://trac.webkit.org/changeset/188979), we added a more comprehensive "exitOK"
+        bit in NodeOrigin. After that change, there were two ways of indicating that you cannot exit:
+        !exitOK and an unset NodeOrigin. An unset NodeOrigin implied !exitOK.
+
+        Now, this change is about removing the old way so that we only use !exitOK. From now on, all nodes
+        must have their NodeOrigin set, and the IR validation will check this. This means that I could
+        remove various pieces of cruft for dealing with unset NodeOrigins, but I did have to add some new
+        cruft to ensure that all nodes we create have a NodeOrigin.
+
+        This change simplifies our IR by having a simpler rule about when NodeOrigin is set: it's always
+        set.
+
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::isInBlock):
+        (JSC::DFG::BasicBlock::removePredecessor):
+        (JSC::DFG::BasicBlock::firstOriginNode): Deleted.
+        (JSC::DFG::BasicBlock::firstOrigin): Deleted.
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::begin):
+        (JSC::DFG::BasicBlock::end):
+        (JSC::DFG::BasicBlock::numSuccessors):
+        (JSC::DFG::BasicBlock::successor):
+        * dfg/DFGCombinedLiveness.cpp:
+        (JSC::DFG::liveNodesAtHead):
+        * dfg/DFGConstantHoistingPhase.cpp:
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::CriticalEdgeBreakingPhase::breakCriticalEdge):
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKilledOperands):
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::createPreHeader):
+        (JSC::DFG::LoopPreHeaderCreationPhase::run):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::validateSSA):
+
+2015-08-26  Saam barati  <sbarati@apple.com>
+
+        MarkedBlock::allocateBlock will have the wrong allocation size when (sizeof(MarkedBlock) + bytes) is divisible by WTF::pageSize()
+        https://bugs.webkit.org/show_bug.cgi?id=148500
+
+        Reviewed by Mark Lam.
+
+        Consider the following scenario:
+        - On OS X, WTF::pageSize() is 4*1024 bytes.
+        - JSEnvironmentRecord::allocationSizeForScopeSize(6621) == 53000
+        - sizeof(MarkedBlock) == 248
+        - (248 + 53000) is a multiple of 4*1024.
+        - (248 + 53000)/(4*1024) == 13
+
+        We will allocate a chunk of memory of size 53248 bytes that looks like this:
+        0            248       256                       53248       53256
+        [Marked Block | 8 bytes |  payload     ......      ]  8 bytes  |
+                                ^                                      ^
+                           Our Environment record starts here.         ^
+                                                                       ^
+                                                                 Our last JSValue in the environment record will go from byte 53248 to 53256. But, we don't own this memory.
+
+        We need to ensure that we round up sizeof(MarkedBlock) to an
+        atomSize boundary. We need to do this because the first atom
+        inside the MarkedBlock will start at the rounded up multiple
+        of atomSize past MarkedBlock. If we end up with an allocation
+        that is perfectly aligned to the page size, then we will be short
+        8 bytes (in the current implementation where atomSize is 16 bytes,
+        and MarkedBlock is 248 bytes).
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock):
+        * tests/stress/heap-allocator-allocates-incorrect-size-for-activation.js: Added.
+        (use):
+        (makeFunction):
+
+2015-08-26  Mark Lam  <mark.lam@apple.com>
+
+        watchdog m_didFire state erroneously retained.
+        https://bugs.webkit.org/show_bug.cgi?id=131082
+
+        Reviewed by Geoffrey Garen.
+
+        The watchdog can fire for 2 reasons:
+        1. an external controlling entity (i.e. another thread) has scheduled termination
+           of the script thread via watchdog::terminateSoon().
+        2. the allowed CPU time has expired.
+
+        For case 1, we're doing away with the m_didFire flag.  Watchdog::terminateSoon() 
+        will set the timer deadlines and m_timeLimit to 0, and m_timerDidFire to true.
+        This will get the script thread to check Watchdog::didFire() and terminate
+        execution.
+
+        Note: the watchdog only guarantees that script execution will terminate as soon
+        as possible due to a time limit of 0.  Once we've exited the VM, the client of the
+        VM is responsible from keeping a flag to prevent new script execution.
+
+        In a race condition, if terminateSoon() is called just after execution has gotten
+        past the client's reentry check and the client is in the process of re-entering,
+        the worst that can happen is that we will schedule the watchdog timer to fire
+        after a period of 0.  This will terminate script execution quickly, and thereafter
+        the client's check should be able to prevent further entry into the VM.
+
+        The correctness (i.e. has no race condition) of this type of termination relies
+        on the termination state being sticky.  Once the script thread is terminated this
+        way, the VM will continue to terminate scripts quickly until the client sets the
+        time limit to a non-zero value (or clears it which sets the time limit to
+        noTimeLimit).
+
+        For case 2, the watchdog does not alter m_timeLimit.  If the CPU deadline has
+        been reached, the script thread will terminate execution and exit the VM.
+
+        If the client of the VM starts new script execution, the watchdog will allow
+        execution for the specified m_timeLimit.  In this case, since m_timeLimit is not
+        0, the script gets a fresh allowance of CPU time to execute.  Hence, terminations
+        due to watchdog time outs are no longer sticky.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupSetExecutionTimeLimit):
+        (JSContextGroupClearExecutionTimeLimit):
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        - Add test scenarios to verify that the watchdog is automatically reset by the VM
+          upon throwing the TerminatedExecutionException.
+
+        (testResetAfterTimeout):
+        (testExecutionTimeLimit):
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_hint):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::ensureWatchdog):
+        * runtime/VM.h:
+        * runtime/VMInlines.h: Added.
+        (JSC::VM::shouldTriggerTermination):
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::Watchdog):
+        (JSC::Watchdog::setTimeLimit):
+        (JSC::Watchdog::terminateSoon):
+        (JSC::Watchdog::didFireSlow):
+        (JSC::Watchdog::hasTimeLimit):
+        (JSC::Watchdog::enteredVM):
+        (JSC::Watchdog::exitedVM):
+        (JSC::Watchdog::startTimer):
+        (JSC::Watchdog::stopTimer):
+        (JSC::Watchdog::hasStartedTimer): Deleted.
+        (JSC::Watchdog::fire): Deleted.
+        * runtime/Watchdog.h:
+        (JSC::Watchdog::didFire):
+        (JSC::Watchdog::timerDidFireAddress):
+
+2015-08-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Implement tracking of active stylesheets in the frontend
+        https://bugs.webkit.org/show_bug.cgi?id=105828
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/CSS.json:
+        Add new events for when a StyleSheet is added or removed.
+
+2015-08-26  Chris Dumez  <cdumez@apple.com>
+
+        Distinguish Web IDL callback interfaces from Web IDL callback functions
+        https://bugs.webkit.org/show_bug.cgi?id=148434
+
+        Reviewed by Geoffrey Garen.
+
+        Add isNull() convenience method on PropertyName.
+
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::isNull):
+
+2015-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Node::origin should be able to tell you if it's OK to exit
+        https://bugs.webkit.org/show_bug.cgi?id=145204
+
+        Reviewed by Geoffrey Garen.
+
+        This is a major change to DFG IR, that makes it easier to reason about where nodes with
+        speculations can be soundly hoisted.
+
+        A program in DFG IR is a sequence of operations that compute the values of SSA variables,
+        perform effects on the heap or stack, and perform updates to the OSR exit state. Because
+        effects and OSR exit updates are interleaved, there are points in execution where exiting
+        simply won't work. For example, we may have some bytecode operation:
+
+            [  24] op_foo loc42 // does something, and puts a value in loc42.
+
+        that gets compiled down to a sequence of DFG IR nodes like:
+
+            a: Foo(W:Heap, R:World, bc#24) // writes heap, reads world - i.e. an observable effect.
+            b: MovHint(@a, loc42, bc#24)
+            c: SetLocal(Check:Int32:@a, loc42, bc#24, exit: bc#26)
+
+        Note that we can OSR exit at @a because we haven't yet performed any effects for bc#24 yet and
+        we have performed all effects for prior bytecode operations. That's what the origin.forExit
+        being set to "bc#24" guarantees. So, an OSR exit at @a would transfer execution to bc#24 and
+        this would not be observable. But at @b, if we try to exit to bc#24 as indicated by forExit, we
+        would end up causing the side effect of bc#24 to execute a second time. This would be
+        observable, so we cannot do it. And we cannot exit to the next instruction - bc#26 - either,
+        because @b is responsible for updating the OSR state to indicate that the result of @a should
+        be put into loc42. It's not until we get to @c that we can exit again.
+
+        This is a confusing, but useful, property of DFG IR. It's useful because it allows us to use IR
+        to spell out how we would have affected the bytecode state, and we use this to implement hard
+        things like object allocation elimination, where we use IR instructions to indicate what object
+        allocation and mutation operations we would have performed, and which bytecode variables would
+        have pointed to those objects. So long as IR allows us to describe how OSR exit state is
+        updated, there will be points in execution where that state is invalid - especially if the IR
+        to update exit state is separate from the IR to perform actual effects.
+
+        But this property is super confusing! It's difficult to explain that somehow magically, @b is a
+        bad place to put OSR exits, and that magically we will only have OSR exits at @a. Of course, it
+        all kind of makes sense - we insert OSR exit checks in phases that *know* where it's safe to
+        exit - but it's just too opaque. This also gets in the way of more sophisticated
+        transformations. For example, LICM barely works - it magically knows that loop pre-headers are
+        good places to exit from, but it has no way of determining if that is actually true. It would
+        be odd to introduce a restriction that anytime some block qualifies as a pre-header according
+        to our loop calculator, it must end with a terminal at which it is OK to exit. So, our choices
+        are to either leave LICM in a magical state and exercise extreme caution when introducing new
+        optimizations that hoist checks, or to do something to make the "can I exit here" property more
+        explicit in IR.
+
+        We have already, in a separate change, added a NodeOrigin::exitOK property, though it didn't do
+        anything yet. This change puts exitOK to work, and makes it an integral part of IR. The key
+        intuition behind this change is that if we know which nodes clobber exit state - i.e. after the
+        node, it's no longer possible to OSR exit until the exit state is fixed up - then we can figure
+        out where it's fine to exit. This change mostly adopts the already implicit rule that it's
+        always safe to exit right at the boundary of exit origins (in between two nodes where
+        origin.forExit differs), and adds a new node, called ExitOK, which is a kind of declaration
+        that exit state is good again. When making this change, I struggled with the question of
+        whether to make origin.exitOK be explicit, or something that we can compute with an analysis.
+        Of course if we are armed with a clobbersExitState(Node*) function, we can find the places
+        where it's fine to exit. But this kind of computation could get quite sophisticated if the
+        nodes belonging to an exit origin are lowered to a control-flow construct. It would also be
+        harder to see what the original intent was, if we found an error: is the bug that we shouldn't
+        be clobbering exit state, or that we shouldn't be exiting? This change opts to make exitOK be
+        an explicit property of IR, so that DFG IR validation will reject any program where exitOK is
+        true after a node that clobbersExitState(), or if exitOK is true after a node has exitOK set to
+        false - unless the latter node has a different exit origin or is an ExitOK node. It will also
+        reject any program where a node mayExit() with !exitOK.
+
+        It turns out that this revealed a lot of sloppiness and what almost looked like an outright
+        bug: the callee property of an inline closure call frame was being set up "as if" by the
+        callee's op_enter. If we did hoist a check per the old rule - to the boundary of exit origins -
+        then we would crash because the callee is unknown. It also revealed that LICM could *almost*
+        get hosed by having a pre-header where there are effects before the jump. I wasn't able to
+        construct a test case that would crash trunk, but I also couldn't quite prove why such a
+        program couldn't be constructed. I did fix the issue in loop pre-header creation, and the
+        validater does catch the issue because of its exitOK assertions.
+
+        This doesn't yet add any other safeguards to LICM - that phase still expects that pre-headers
+        are in place and that they were created in such a way that their terminal origins have exitOK.
+        It also still keeps the old way of saying "not OK to exit" - having a clear NodeOrigin. In a
+        later patch I'll remove that and use !exitOK everywhere. Note that I did consider using clear
+        NodeOrigins to signify that it's not OK to exit, but that would make DFGForAllKills a lot more
+        expensive - it would have to sometimes search to find nearby forExit origins if the current
+        node doesn't have it set - and that's a critical phase for DFG compilation performance.
+        Requiring that forExit is usually set to *something* and that properly shadows the original
+        bytecode is cheap and easy, so it seemed like a good trade-off.
+
+        This change has no performance effect. Its only effect is that it makes the compiler easier to
+        understand by turning a previously magical concept into an explicit one.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setDirect):
+        (JSC::DFG::ByteCodeParser::currentNodeOrigin):
+        (JSC::DFG::ByteCodeParser::branchData):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp: Added.
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGClobbersExitState.h: Added.
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::convertStringAddUse):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        (JSC::DFG::FixupPhase::fixupGetAndSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::fixupChecksInBlock):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::useKindFor):
+        (JSC::DFG::uncheckedUseKindFor):
+        (JSC::DFG::typeFilterFor):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::printWhiteSpace):
+        (JSC::DFG::Graph::dumpCodeOrigin):
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addSpeculationMode):
+        * dfg/DFGInsertionSet.cpp:
+        (JSC::DFG::InsertionSet::insertSlow):
+        (JSC::DFG::InsertionSet::execute):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::LoopPreHeaderCreationPhase::run):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        (WTF::printInternal):
+        * dfg/DFGMayExit.h:
+        * dfg/DFGMovHintRemovalPhase.cpp:
+        * dfg/DFGNodeOrigin.cpp: Added.
+        (JSC::DFG::NodeOrigin::dump):
+        * dfg/DFGNodeOrigin.h:
+        (JSC::DFG::NodeOrigin::NodeOrigin):
+        (JSC::DFG::NodeOrigin::isSet):
+        (JSC::DFG::NodeOrigin::withSemantic):
+        (JSC::DFG::NodeOrigin::withExitOK):
+        (JSC::DFG::NodeOrigin::withInvalidExit):
+        (JSC::DFG::NodeOrigin::takeValidExit):
+        (JSC::DFG::NodeOrigin::forInsertingAfter):
+        (JSC::DFG::NodeOrigin::operator==):
+        (JSC::DFG::NodeOrigin::operator!=):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        (JSC::DFG::OSRExit::setPatchableCodeOffset):
+        * dfg/DFGOSRExitBase.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPhantomInsertionPhase.cpp:
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::validate):
+        (JSC::DFG::Phase::beginPhase):
+        (JSC::DFG::Phase::endPhase):
+        * dfg/DFGPhase.h:
+        (JSC::DFG::Phase::vm):
+        (JSC::DFG::Phase::codeBlock):
+        (JSC::DFG::Phase::profiledBlock):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+
+2015-08-26  Andreas Kling  <akling@apple.com>
+
+        [JSC] StructureTransitionTable should eagerly deallocate single-transition WeakImpls.
+        <https://webkit.org/b/148478>
+
+        Reviewed by Geoffrey Garen.
+
+        Use a WeakHandleOwner to eagerly deallocate StructureTransitionTable's Weak pointers
+        when it's using the single-transition optimization and the Structure it transitioned
+        to has been GC'd.
+
+        This prevents Structures from keeping WeakBlocks alive longer than necessary when
+        they've been transitioned away from but are still in use themselves.
+
+        * runtime/Structure.cpp:
+        (JSC::singleSlotTransitionWeakOwner):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        (JSC::StructureTransitionTable::add):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::singleTransition): Deleted.
+        (JSC::StructureTransitionTable::setSingleTransition): Deleted.
+
+2015-08-26  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: REGRESSION(r188965): BackendDispatcher loses request ids when called re-entrantly
+        https://bugs.webkit.org/show_bug.cgi?id=148480
+
+        Reviewed by Joseph Pecoraro.
+
+        I added an assertion that m_currentRequestId is Nullopt when dispatch() is called, but this should
+        not hold if dispatching a backend command while debugger is paused. I will remove the assertion
+        and add proper scoping for all dispatch() branches.
+
+        No new tests, this wrong assert caused inspector/dom-debugger/node-removed.html to crash reliably.
+
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::dispatch): Cover each exit with an appropriate TemporaryChange scope.
+
+2015-08-26  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Remove the unused *Executable::unlinkCalls() and CodeBlock::unlinkCalls()
+        https://bugs.webkit.org/show_bug.cgi?id=148469
+
+        Reviewed by Geoffrey Garen.
+
+        We use CodeBlock::unlinkIncomingCalls() to unlink calls.
+        (...)Executable::unlinkCalls() and CodeBlock::unlinkCalls() are no longer used.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkCalls): Deleted.
+        * bytecode/CodeBlock.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::unlinkCalls): Deleted.
+        (JSC::ProgramExecutable::unlinkCalls): Deleted.
+        (JSC::FunctionExecutable::unlinkCalls): Deleted.
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::unlinkCalls): Deleted.
+
+2015-08-25  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: no need to allocate protocolErrors array for every dispatched backend command
+        https://bugs.webkit.org/show_bug.cgi?id=146466
+
+        Reviewed by Joseph Pecoraro.
+
+        Clean up some of the backend dispatcher code, with a focus on eliminating useless allocations
+        of objects in the common case when no protocol errors happen. This is done by saving the
+        current id of each request as it is being processed by the backend dispatcher, and tagging any
+        subsequent errors with that id. This also means we don't have to thread the requestId except
+        in the async command code path.
+
+        This patch also lifts some common code shared between all generated backend command
+        implementatations into the per-domain dispatch method instead. This reduces generated code size.
+
+        To be consistent, this patch standardizes on calling the id of a backend message its 'requestId'.
+        Requests can be handled synchronously or asynchronously (triggered via the 'async' property).
+
+        No new tests, covered by existing protocol tests.
+
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::CallbackBase::CallbackBase): Split the two code paths for reporting
+        success and failure.
+
+        (Inspector::BackendDispatcher::CallbackBase::sendFailure):
+        (Inspector::BackendDispatcher::CallbackBase::sendSuccess): Renamed from sendIfActive.
+        (Inspector::BackendDispatcher::dispatch): Reset counters and current requestId before dispatching.
+        No need to manually thread the requestId to all reportProtocolError calls.
+
+        (Inspector::BackendDispatcher::hasProtocolErrors): Added.
+        (Inspector::BackendDispatcher::sendResponse):
+        (Inspector::BackendDispatcher::sendPendingErrors): Send any saved protocol errors to the frontend.
+        Always send a 'data' member with all of the errors, even if there's just one. We might want to add
+        more information about errors later.
+
+        (Inspector::BackendDispatcher::reportProtocolError): Enqueue a protocol error to be sent later.
+        (Inspector::BackendDispatcher::getPropertyValue): Remove useless type parameters and nuke most of
+        the type conversion methods. Use std::function types instead of function pointer types.
+
+        (Inspector::castToInteger): Added.
+        (Inspector::castToNumber): Added.
+        (Inspector::BackendDispatcher::getInteger):
+        (Inspector::BackendDispatcher::getDouble):
+        (Inspector::BackendDispatcher::getString):
+        (Inspector::BackendDispatcher::getBoolean):
+        (Inspector::BackendDispatcher::getObject):
+        (Inspector::BackendDispatcher::getArray):
+        (Inspector::BackendDispatcher::getValue):
+        (Inspector::getPropertyValue): Deleted.
+        (Inspector::AsMethodBridges::asInteger): Deleted.
+        (Inspector::AsMethodBridges::asDouble): Deleted.
+        (Inspector::AsMethodBridges::asString): Deleted.
+        (Inspector::AsMethodBridges::asBoolean): Deleted.
+        (Inspector::AsMethodBridges::asObject): Deleted.
+        (Inspector::AsMethodBridges::asArray): Deleted.
+        (Inspector::AsMethodBridges::asValue): Deleted.
+        * inspector/InspectorBackendDispatcher.h:
+        * inspector/scripts/codegen/cpp_generator_templates.py: Extract 'params' object in domain dispatch method.
+        Omit requestIds where possible. Convert dispatch tables to use NeverDestroyed. Check the protocol error count
+        to decide whether to abort the dispatch or not, rather than allocating our own errors array.
+
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        (void):
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py: Revert to passing RefPtr<InspectorObject>
+        since parameters are now being passed rather than the message object. Some commands do not require parameters.
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator.generate_output):
+        (CppBackendDispatcherImplementationGenerator._generate_small_dispatcher_switch_implementation_for_domain):
+        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
+        (ObjCBackendDispatcherHeaderGenerator._generate_objc_handler_declaration_for_command):
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator._generate_handler_implementation_for_command):
+        (ObjCConfigurationImplementationGenerator._generate_success_block_for_command):
+        * inspector/scripts/codegen/objc_generator_templates.py:
+
+        Rebaseline some protocol generator tests.
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2015-08-25  Saam barati  <sbarati@apple.com>
+
+        Lets rename codeOriginIndex to callSiteIndex and get rid of CallFrame::Location.
+        https://bugs.webkit.org/show_bug.cgi?id=148213
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces a struct called CallSiteIndex which is
+        used as a wrapper for a 32-bit int to place things in the tag for ArgumentCount 
+        in the call frame. On 32-bit we place Instruction* into this slot for LLInt and Basline.
+        For 32-bit DFG we place a an index into the code origin table in this slot.
+        On 64-bit we place a bytecode offset into this slot for LLInt and Baseline.
+        On 64-bit we place the index into the code origin table in this slot in the
+        DFG/FTL.
+
+        This patch also gets rid of the encoding scheme that describes if something is a
+        bytecode index or a code origin table index. This information can always
+        be determined based on the CodeBlock's' JITType.
+
+        StructureStubInfo now also has a CallSiteIndex which it stores to
+        the call frame when making a call.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasCodeOrigins):
+        (JSC::CodeBlock::canGetCodeOrigin):
+        (JSC::CodeBlock::codeOrigin):
+        (JSC::CodeBlock::addFrequentExitSite):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::notifyCompilingStructureTransition):
+        (JSC::DFG::CommonData::addCodeOrigin):
+        (JSC::DFG::CommonData::shrinkToFit):
+        * dfg/DFGCommonData.h:
+        (JSC::DFG::CommonData::CommonData):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::setEndOfCode):
+        (JSC::DFG::JITCompiler::addCallSite):
+        (JSC::DFG::JITCompiler::emitStoreCodeOrigin):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::InlineCacheDescriptor::InlineCacheDescriptor):
+        (JSC::FTL::InlineCacheDescriptor::stackmapID):
+        (JSC::FTL::InlineCacheDescriptor::callSiteIndex):
+        (JSC::FTL::InlineCacheDescriptor::uid):
+        (JSC::FTL::GetByIdDescriptor::GetByIdDescriptor):
+        (JSC::FTL::PutByIdDescriptor::PutByIdDescriptor):
+        (JSC::FTL::CheckInDescriptor::CheckInDescriptor):
+        (JSC::FTL::InlineCacheDescriptor::codeOrigin): Deleted.
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callPreflight):
+        * ftl/FTLSlowPathCall.cpp:
+        (JSC::FTL::storeCodeOrigin):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::currentVPC):
+        (JSC::CallFrame::setCurrentVPC):
+        (JSC::CallFrame::callSiteBitsAsBytecodeOffset):
+        (JSC::CallFrame::bytecodeOffset):
+        (JSC::CallFrame::codeOrigin):
+        (JSC::CallFrame::topOfFrameInternal):
+        (JSC::CallFrame::locationAsBytecodeOffset): Deleted.
+        (JSC::CallFrame::setLocationAsBytecodeOffset): Deleted.
+        (JSC::CallFrame::bytecodeOffsetFromCodeOriginIndex): Deleted.
+        * interpreter/CallFrame.h:
+        (JSC::CallSiteIndex::CallSiteIndex):
+        (JSC::CallSiteIndex::bits):
+        (JSC::ExecState::returnPCOffset):
+        (JSC::ExecState::abstractReturnPC):
+        (JSC::ExecState::topOfFrame):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScope):
+        (JSC::ExecState::currentVPC): Deleted.
+        (JSC::ExecState::setCurrentVPC): Deleted.
+        * interpreter/CallFrameInlines.h:
+        (JSC::CallFrame::callSiteBitsAreBytecodeOffset):
+        (JSC::CallFrame::callSiteBitsAreCodeOriginIndex):
+        (JSC::CallFrame::callSiteAsRawBits):
+        (JSC::CallFrame::callSiteIndex):
+        (JSC::CallFrame::hasActivation):
+        (JSC::CallFrame::Location::encode): Deleted.
+        (JSC::CallFrame::Location::decode): Deleted.
+        (JSC::CallFrame::Location::encodeAsBytecodeOffset): Deleted.
+        (JSC::CallFrame::Location::encodeAsBytecodeInstruction): Deleted.
+        (JSC::CallFrame::Location::encodeAsCodeOriginIndex): Deleted.
+        (JSC::CallFrame::Location::isBytecodeLocation): Deleted.
+        (JSC::CallFrame::Location::isCodeOriginIndex): Deleted.
+        (JSC::CallFrame::hasLocationAsBytecodeOffset): Deleted.
+        (JSC::CallFrame::hasLocationAsCodeOriginIndex): Deleted.
+        (JSC::CallFrame::locationAsRawBits): Deleted.
+        (JSC::CallFrame::setLocationAsRawBits): Deleted.
+        (JSC::CallFrame::locationAsBytecodeOffset): Deleted.
+        (JSC::CallFrame::setLocationAsBytecodeOffset): Deleted.
+        (JSC::CallFrame::locationAsCodeOriginIndex): Deleted.
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::readFrame):
+        (JSC::StackVisitor::readNonInlinedFrame):
+        (JSC::StackVisitor::Frame::print):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::garbageStubInfo):
+        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITByIdGenerator::generateFastPathChecks):
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        (JSC::JITGetByIdGenerator::generateFastPath):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator):
+        (JSC::JITInlineCacheGenerator::stubInfo):
+        (JSC::JITByIdGenerator::JITByIdGenerator):
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        * jit/JITInlines.h:
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        (JSC::tryGetByValOptimize):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+
+2015-08-25 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        Function.prototype.toString is incorrect for ArrowFunction
+        https://bugs.webkit.org/show_bug.cgi?id=148148
+
+        Reviewed by Saam Barati.
+        
+        Added correct support of toString() method for arrow function.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionMetadata):
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        * parser/Nodes.cpp:
+        (JSC::FunctionMetadataNode::FunctionMetadataNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * tests/stress/arrowfunction-tostring.js: Added.
+
+2015-08-25  Saam barati  <sbarati@apple.com>
+
+        Callee can be incorrectly overridden when it's captured
+        https://bugs.webkit.org/show_bug.cgi?id=148400
+
+        Reviewed by Filip Pizlo.
+
+        We now resort to always creating the function name scope
+        when the function name is in scope. Because the bytecode
+        generator now has a notion of local lexical scoping,
+        this incurs no runtime penalty for function expression names
+        that aren't heap allocated. If they are heap allocated,
+        this means we may now have one more scope on the runtime
+        scope stack than before. This modification simplifies the
+        callee initialization code and uses the lexical scoping constructs
+        to implement this. This implementation also ensures
+        that everything Just Works for function's with default
+        parameter values. Before this patch, IIFE functions
+        with default parameter values and a captured function
+        name would crash JSC.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::popLexicalScopeInternal):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::resolveType):
+        (JSC::BytecodeGenerator::emitThrowTypeError):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::Variable::isReadOnly):
+        (JSC::Variable::isSpecial):
+        (JSC::Variable::isConst):
+        (JSC::Variable::setIsReadOnly):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::BindingNode::bindValue):
+        * tests/stress/IIFE-es6-default-parameters.js: Added.
+        (assert):
+        (.):
+        * tests/stress/IIFE-function-name-captured.js: Added.
+        (assert):
+        (.):
+
+2015-08-24  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: add protocol test for existing error handling performed by the backend
+        https://bugs.webkit.org/show_bug.cgi?id=147097
+
+        Reviewed by Joseph Pecoraro.
+
+        A new test revealed that the protocol "method" parameter was being parsed in a naive way.
+        Rewrite it to use String::split and improve error checking to avoid failing later.
+
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::dispatch):
+
+2015-08-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Return JSInternalPromise as result of evaluateModule
+        https://bugs.webkit.org/show_bug.cgi?id=148173
+
+        Reviewed by Saam Barati.
+
+        Now evaluateModule returns JSInternalPromise* as its result value.
+        When an error occurs while loading or executing the modules,
+        this promise is rejected by that error. By leveraging this, we implemented
+        asynchronous error reporting when executing the modules in JSC shell.
+
+        And this patch also changes the evaluateModule signature to accept the entry
+        point by the moduleName. By using it, JSC shell can start executing the modules
+        with the entry point module name.
+
+        * builtins/ModuleLoaderObject.js:
+        (loadModule):
+        * jsc.cpp:
+        (dumpException):
+        (runWithScripts):
+        * runtime/Completion.cpp:
+        (JSC::evaluateModule):
+        * runtime/Completion.h:
+        * runtime/JSInternalPromise.cpp:
+        (JSC::JSInternalPromise::then):
+        * runtime/JSInternalPromise.h:
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::ModuleLoaderObject::requestInstantiateAll):
+        (JSC::ModuleLoaderObject::loadModule):
+        (JSC::ModuleLoaderObject::resolve):
+        (JSC::ModuleLoaderObject::fetch):
+        (JSC::ModuleLoaderObject::translate):
+        (JSC::ModuleLoaderObject::instantiate):
+        (JSC::moduleLoaderObjectParseModule):
+        * runtime/ModuleLoaderObject.h:
+
+2015-08-24  Basile Clement  <basile_clement@apple.com>
+
+        REPTACH is not a word
+        https://bugs.webkit.org/show_bug.cgi?id=148401
+
+        Reviewed by Saam Barati.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::callWithSlowPathReturnType):
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::tailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::readCallTarget):
+        (JSC::MacroAssemblerX86_64::linkCall):
+        (JSC::MacroAssemblerX86_64::repatchCall):
+
+2015-08-24  Mark Lam  <mark.lam@apple.com>
+
+        Add support for setting JSC options from a file.
+        https://bugs.webkit.org/show_bug.cgi?id=148394
+
+        Reviewed by Saam Barati.
+
+        This is needed for environments where the JSC executable does not have access to
+        environmental variables.  This is only needed for debugging, and is currently
+        guarded under a #define USE_OPTIONS_FILE in Options.cpp, and is disabled by
+        default.
+
+        Also fixed Options::setOptions() to be allow for whitespace that is not a single
+        ' '.  This makes setOptions() much more flexible and friendlier to use for loading
+        options in general.
+
+        For example, this current use case of loading options from a file may have '\n's
+        in the character stream, and this feature is easier to implement if setOptions()
+        just support more than 1 whitespace char between options, and recognize whitespace
+        characters other than ' '.
+
+        * runtime/Options.cpp:
+        (JSC::parse):
+        (JSC::Options::initialize):
+        (JSC::Options::setOptions):
+
+2015-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::FixupPhase should use the lambda form of m_graph.doToChildren() rather than the old macro
+        https://bugs.webkit.org/show_bug.cgi?id=148397
+
+        Reviewed by Geoffrey Garen.
+
+        We used to iterate the edges of a node by using the DFG_NODE_DO_TO_CHILDREN macro. We
+        don't need to do that anymore since we have the lambda-based m_graph.doToChildren(). This
+        allows us to get rid of a bunch of helper methods in DFG::FixupPhase.
+
+        I also took the opportunity to give the injectTypeConversionsInBlock() method a more
+        generic name, since after https://bugs.webkit.org/show_bug.cgi?id=145204 it will be used
+        for fix-up of checks more broadly.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::run):
+        (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):
+        (JSC::DFG::FixupPhase::fixupChecksInBlock):
+        (JSC::DFG::FixupPhase::injectTypeConversionsInBlock): Deleted.
+        (JSC::DFG::FixupPhase::tryToRelaxRepresentation): Deleted.
+        (JSC::DFG::FixupPhase::fixEdgeRepresentation): Deleted.
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge): Deleted.
+
+2015-08-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Some renaming to clarify CodeBlock and UnlinkedCodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=148391
+
+        Reviewed by Saam Barati.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        (JSC::generateFunctionCodeBlock): Deleted.
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.h: Call our CodeBlocks "unlinked"
+        in the name for clarity, since we are unlinked. 
+
+        * heap/Heap.cpp:
+        (JSC::Heap::objectTypeCounts):
+        (JSC::Heap::deleteAllCodeBlocks):
+        (JSC::Heap::deleteAllUnlinkedCodeBlocks):
+        (JSC::Heap::clearUnmarkedExecutables):
+        (JSC::Heap::deleteOldCode):
+        (JSC::Heap::FinalizerOwner::finalize):
+        (JSC::Heap::addExecutable):
+        (JSC::Heap::collectAllGarbageIfNotDoneRecently):
+        (JSC::Heap::deleteAllCompiledCode): Deleted.
+        (JSC::Heap::deleteAllUnlinkedFunctionCode): Deleted.
+        (JSC::Heap::addCompiledCode): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::notifyIsSafeToCollect):
+        (JSC::Heap::isSafeToCollect):
+        (JSC::Heap::sizeBeforeLastFullCollection):
+        (JSC::Heap::sizeAfterLastFullCollection):
+        (JSC::Heap::compiledCode): Deleted.
+
+            deleteAllCompiledCode => deleteAllCodeBlocks because "compiled"
+            is a broad phrase these days.
+
+            m_compiledCode => m_executables for the same reason.
+
+            addCompiledCode => addExecutable for the same reason.
+
+            deleteAllUnlinkedFunctionCode => deleteAllUnlinkedCodeBlocks
+            for consistency.
+
+        * jsc.cpp:
+        (functionDeleteAllCompiledCode):
+
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor): codeBlockFor => unlinkedCodeBlockFor
+
+        (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilation): Deleted.
+        It was strange to put this function on executable, since its name implied
+        that it only changed the executable, but it actually changed all cached
+        code. Now, a client that wants to change cached code must do so explicitly.
+
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::finishCreation):
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllCode):
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope): Updated for renames above.
+
+2015-08-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::InsertionSet should be tolerant of occasional out-of-order insertions
+        https://bugs.webkit.org/show_bug.cgi?id=148367
+
+        Reviewed by Geoffrey Garen and Saam Barati.
+
+        Since forever, the DFG::InsertionSet has been the way we insert nodes into DFG IR, and it
+        requires that you walk a block in order and perform insertions in order: you can't insert
+        something at index J, then at index I where I < J, except if you do a second pass.
+
+        This restriction makes sense, because it enables a very fast algorithm. And it's very
+        rare that a phase would need to insert things out of order.
+
+        But sometimes - rarely - we need to insert things slightly out-of-order. For example we
+        may want to insert a node at index J, but to insert a check associated with that node, we
+        may need to use index I where I < J. This will come up from the work on
+        https://bugs.webkit.org/show_bug.cgi?id=145204. And it has already come up in the past.
+        It seems like it would be best to just lift this restriction.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGInsertionSet.cpp: Added.
+        (JSC::DFG::InsertionSet::insertSlow):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::InsertionSet):
+        (JSC::DFG::InsertionSet::graph):
+        (JSC::DFG::InsertionSet::insert):
+        (JSC::DFG::InsertionSet::execute):
+
+2015-08-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Create ById IC for ByVal operation only when the specific Id comes more than once
+        https://bugs.webkit.org/show_bug.cgi?id=148288
+
+        Reviewed by Geoffrey Garen.
+
+        After introducing byId ICs into byVal ops, byVal ops creates much ICs than before.
+        The failure fixed in r188767 figures out these ICs are created even if this op is executed only once.
+
+        The situation is the following;
+        In the current code, when byVal op is executed with the Id, we immediately set up the byId IC for that byVal op.
+        But setting up JITGetByIdGenerator generates the fast path IC code and consumes executable memory.
+        As a result, if we call eval("contains byVal ops") with the different strings repeatedly under no-llint environment, each eval call creates byId IC for byVal and consumes executable memory.
+
+        To solve it, we will add "seen" flag to ByValInfo.
+        And we will create the IC on the second byVal op call with the same Id.
+
+        * bytecode/ByValInfo.h:
+        (JSC::ByValInfo::ByValInfo):
+        * jit/JITOperations.cpp:
+        (JSC::tryGetByValOptimize):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByValWithCachedId): Deleted.
+        (JSC::JIT::privateCompilePutByValWithCachedId): Deleted.
+
+2015-08-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Get rid of NodePointerTraits
+        https://bugs.webkit.org/show_bug.cgi?id=148340
+
+        Reviewed by Anders Carlsson.
+
+        NodePointerTraits does exactly the same thing has the default trait.
+
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGCommon.h:
+        (JSC::DFG::NodePointerTraits::defaultValue): Deleted.
+        (JSC::DFG::NodePointerTraits::isEmptyForDump): Deleted.
+
+2015-08-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Reduce the memory usage of BytecodeLivenessAnalysis
+        https://bugs.webkit.org/show_bug.cgi?id=148353
+
+        Reviewed by Darin Adler.
+
+        BytecodeLivenessAnalysis easily takes kilobytes of memory for
+        non trivial blocks and that memory sticks around because
+        it stored on CodeBlock.
+
+        This patch reduces that memory use a bit.
+
+        Most of the memory is in the array of BytecodeBasicBlock.
+        BytecodeBasicBlock is shrunk by:
+        -Making it not ref-counted.
+        -Removing m_predecessors, it was only used for debugging and
+         is usually big.
+        -Added a shrinkToFit() phase to shrink the vectors once we are
+         done building the BytecodeBasicBlock.
+
+        There are more things we should do in the future:
+        -Store all the BytecodeBasicBlock direclty in the array.
+         We know the size ahead of time, this would be a pure win.
+         The only tricky part is changing m_successors to have the
+         index of the successor instead of a pointer.
+        -Stop putting duplicates in m_successors.
+
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::computeBytecodeBasicBlocks):
+        (JSC::BytecodeBasicBlock::shrinkToFit): Deleted.
+        (JSC::linkBlocks): Deleted.
+        * bytecode/BytecodeBasicBlock.h:
+        (JSC::BytecodeBasicBlock::addSuccessor):
+        (JSC::BytecodeBasicBlock::addPredecessor): Deleted.
+        (JSC::BytecodeBasicBlock::predecessors): Deleted.
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::getLeaderOffsetForBasicBlock):
+        (JSC::findBasicBlockWithLeaderOffset):
+        (JSC::findBasicBlockForBytecodeOffset):
+        (JSC::stepOverInstruction):
+        (JSC::computeLocalLivenessForBytecodeOffset):
+        (JSC::computeLocalLivenessForBlock):
+        (JSC::BytecodeLivenessAnalysis::dumpResults): Deleted.
+        * bytecode/BytecodeLivenessAnalysis.h:
+
+2015-08-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in r188792.
+        https://bugs.webkit.org/show_bug.cgi?id=148347
+
+        Previously reverted changesets:
+
+        "Unify code paths for manually deleting all code"
+        https://bugs.webkit.org/show_bug.cgi?id=148280
+        http://trac.webkit.org/changeset/188792
+
+        The previous patch caused some inspector tests to hang because it
+        introduced extra calls to sourceParsed, and sourceParsed is
+        pathologically slow in WK1 debug builds. This patch restores pre-existing
+        code to limit calls to sourceParsed, excluding code not being debugged
+        (i.e., inspector code).
+
+2015-08-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling back in r188803.
+
+        Previously reverted changesets:
+
+        "Debugger's VM should never be null"
+        https://bugs.webkit.org/show_bug.cgi?id=148341
+        http://trac.webkit.org/changeset/188803
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::attach):
+        (JSC::Debugger::detach):
+        (JSC::Debugger::isAttached):
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::registerCodeBlock):
+        (JSC::Debugger::toggleBreakpoint):
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::Debugger::setBreakpoint):
+        (JSC::Debugger::clearBreakpoints):
+        (JSC::Debugger::clearDebuggerRequests):
+        (JSC::Debugger::setBreakpointsActivated):
+        (JSC::Debugger::breakProgram):
+        (JSC::Debugger::stepOutOfFunction):
+        (JSC::Debugger::returnEvent):
+        (JSC::Debugger::didExecuteProgram):
+        * debugger/Debugger.h:
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        (Inspector::JSGlobalObjectScriptDebugServer::JSGlobalObjectScriptDebugServer):
+        (Inspector::JSGlobalObjectScriptDebugServer::removeListener):
+        (Inspector::JSGlobalObjectScriptDebugServer::runEventLoopWhilePaused):
+        (Inspector::JSGlobalObjectScriptDebugServer::recompileAllJSFunctions): Deleted.
+        * inspector/JSGlobalObjectScriptDebugServer.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::ScriptDebugServer):
+        * inspector/ScriptDebugServer.h:
+
+2015-08-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG string concatenation shouldn't be playing fast and loose with effects and OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=148338
+
+        Reviewed by Michael Saboff and Saam Barati.
+
+        Prior to this change, DFG string concatenation appeared to have various different ways of
+        creating an OSR exit right after a side effect. That's bad, because the exit will cause
+        us to reexecute the side effect. The code appears to have some hacks for avoiding this,
+        but some cases are basically unavoidable, like the OOM case of string concatenation: in
+        trunk that could cause two executions of the toString operation.
+
+        This changes the string concatenation code to either be speculative or effectful but
+        never both. It's already the case that when this code needs to be effectful, it also
+        needs to be slow (it does int->string conversions, calls JS functions, etc). So, this is
+        a small price to pay for sanity.
+
+        The biggest part of this change is the introduction of StrCat, which is like MakeRope but
+        does toString conversions on its own instead of relying on separate nodes. StrCat can
+        take either 2 or 3 children. It's the effectful but not speculative version of MakeRope.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::convertStringAddUse):
+        (JSC::DFG::FixupPhase::fixupToStringOrCallStringConstructor):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::JSValueOperand::JSValueOperand):
+        (JSC::DFG::JSValueOperand::~JSValueOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStrCat):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        * jit/JITOperations.h:
+        * tests/stress/exception-effect-strcat.js: Added. This test previously failed.
+        * tests/stress/exception-in-strcat-string-overflow.js: Added. An earlier version of this patch made this fail.
+        * tests/stress/exception-in-strcat.js: Added.
+
+2015-08-22  Andreas Kling  <akling@apple.com>
+
+        [JSC] Static hash tables should be 100% compile-time constant.
+        <https://webkit.org/b/148359>
+
+        Reviewed by Michael Saboff.
+
+        We were dirtying the memory pages containing static hash tables the
+        first time they were used, when a dynamically allocated index-to-key
+        table was built and cached in the HashTable struct.
+
+        It turns out that this "optimization" was completely useless, since
+        we've long since decoupled static hash tables from the JSC::VM and
+        we can get the key for an index via HashTable::values[index].m_key!
+
+        We also get rid of VM::keywords which was a little wrapper around
+        a VM-specific copy of JSC::mainTable. There was nothing VM-specific
+        about it at all, so clients now use JSC::mainTable directly.
+
+        After this change all fooHashTable structs end up in __DATA __const
+        and no runtime initialization/allocation takes place.
+
+        * create_hash_table:
+        * jsc.cpp:
+        * parser/Lexer.cpp:
+        (JSC::isLexerKeyword):
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        (JSC::Lexer<CharacterType>::parseIdentifierSlowCase):
+        (JSC::Keywords::Keywords): Deleted.
+        * parser/Lexer.h:
+        (JSC::Keywords::isKeyword): Deleted.
+        (JSC::Keywords::getKeyword): Deleted.
+        (JSC::Keywords::~Keywords): Deleted.
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::tryJSONPParse):
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable): Deleted.
+        (JSC::HashTable::deleteTable): Deleted.
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        (JSC::HashTable::ConstIterator::key):
+        (JSC::HashTable::ConstIterator::skipInvalidKeys):
+        (JSC::HashTable::copy): Deleted.
+        (JSC::HashTable::initializeIfNeeded): Deleted.
+        (JSC::HashTable::begin): Deleted.
+        (JSC::HashTable::end): Deleted.
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Deleted.
+        * runtime/VM.h:
+        * testRegExp.cpp:
+
+2015-08-21  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r188792 and r188803.
+        https://bugs.webkit.org/show_bug.cgi?id=148347
+
+        broke lots of tests, ggaren is going to investigate and reland
+        (Requested by thorton on #webkit).
+
+        Reverted changesets:
+
+        "Unify code paths for manually deleting all code"
+        https://bugs.webkit.org/show_bug.cgi?id=148280
+        http://trac.webkit.org/changeset/188792
+
+        "Debugger's VM should never be null"
+        https://bugs.webkit.org/show_bug.cgi?id=148341
+        http://trac.webkit.org/changeset/188803
+
+2015-08-21  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Parse control flow statements in WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=148333
+
+        Reviewed by Geoffrey Garen.
+
+        Parse control flow statements in WebAssembly files generated by pack-asmjs
+        <https://github.com/WebAssembly/polyfill-prototype-1>.
+
+        * wasm/WASMConstants.h:
+        * wasm/WASMFunctionParser.cpp:
+        (JSC::WASMFunctionParser::parseStatement):
+        (JSC::WASMFunctionParser::parseIfStatement):
+        (JSC::WASMFunctionParser::parseIfElseStatement):
+        (JSC::WASMFunctionParser::parseWhileStatement):
+        (JSC::WASMFunctionParser::parseDoStatement):
+        (JSC::WASMFunctionParser::parseLabelStatement):
+        (JSC::WASMFunctionParser::parseBreakStatement):
+        (JSC::WASMFunctionParser::parseBreakLabelStatement):
+        (JSC::WASMFunctionParser::parseContinueStatement):
+        (JSC::WASMFunctionParser::parseContinueLabelStatement):
+        (JSC::WASMFunctionParser::parseSwitchStatement):
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASMFunctionParser::WASMFunctionParser):
+        * wasm/WASMReader.cpp:
+        (JSC::WASMReader::readCompactInt32):
+        (JSC::WASMReader::readSwitchCase):
+        * wasm/WASMReader.h:
+
+2015-08-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Debugger's VM should never be null
+        https://bugs.webkit.org/show_bug.cgi?id=148341
+
+        Reviewed by Joseph Pecoraro.
+
+        It doesn't make sense for a Debugger's VM to be null, and code related
+        to maintaining that illusion just caused the Web Inspector to crash on
+        launch (https://bugs.webkit.org/show_bug.cgi?id=148312). So, let's stop
+        doing that.
+
+        Now, Debugger requires its subclass to provide a never-null VM&.
+
+        Also took the opportunity, based on review feedback, to remove some
+        confusion in the virtual recompileAllJSFunctions hierarchy, by eliminating
+        the pure virtual in ScriptDebugServer and the unnecessary override in
+        JSGlobalObjectScriptDebugServer.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::attach):
+        (JSC::Debugger::detach):
+        (JSC::Debugger::isAttached):
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::registerCodeBlock):
+        (JSC::Debugger::toggleBreakpoint):
+        (JSC::Debugger::recompileAllJSFunctions):
+        (JSC::Debugger::setBreakpoint):
+        (JSC::Debugger::clearBreakpoints):
+        (JSC::Debugger::clearDebuggerRequests):
+        (JSC::Debugger::setBreakpointsActivated):
+        (JSC::Debugger::breakProgram):
+        (JSC::Debugger::stepOutOfFunction):
+        (JSC::Debugger::returnEvent):
+        (JSC::Debugger::didExecuteProgram):
+        * debugger/Debugger.h:
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        (Inspector::JSGlobalObjectScriptDebugServer::JSGlobalObjectScriptDebugServer):
+        (Inspector::JSGlobalObjectScriptDebugServer::recompileAllJSFunctions):
+        (Inspector::JSGlobalObjectScriptDebugServer::runEventLoopWhilePaused):
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::ScriptDebugServer):
+        * inspector/ScriptDebugServer.h:
+
+2015-08-21  Basile Clement  <basile_clement@apple.com>
+
+        Remove unused code relative to allocation sinking
+        https://bugs.webkit.org/show_bug.cgi?id=148342
+
+        Reviewed by Mark Lam.
+
+        This removes two things:
+
+         - The DFGPromoteHeapAccess.h file which is a relic of the old sinking
+           phase and is no longer used (it has been subsumed by
+           ObjectAllocationSinking::promoteLocalHeap)
+
+         - Code in the allocation sinking phase for sinking
+           MaterializeCreateActivation and MaterializeNewObject. Handling those
+           is no longer necessary since the phase no longer runs in a fixpoint
+           and thus will never see those nodes, since no other phase creates
+           them.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPromoteHeapAccess.h: Removed.
+
+2015-08-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Unify code paths for manually deleting all code
+        https://bugs.webkit.org/show_bug.cgi?id=148280
+
+        Reviewed by Saam Barati.
+
+        We used to have three paths for manually deleting all code. Now we have
+        one shared path.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::attach): Notify the debugger of all previous code when
+        it attaches. We used to do this when recompiling, which was only correct
+        by accident.
+
+        (JSC::Debugger::recompileAllJSFunctions): Switch to the shared path.
+
+        * heap/Heap.h:
+        (JSC::Heap::compiledCode):
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::InspectorRuntimeAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorRuntimeAgent::setTypeProfilerEnabledState):
+        (Inspector::InspectorRuntimeAgent::getBasicBlocks):
+        (Inspector::TypeRecompiler::visit): Deleted.
+        (Inspector::TypeRecompiler::operator()): Deleted.
+        (Inspector::recompileAllJSFunctionsForTypeProfiling): Deleted. Switch
+        to the shared path.
+
+        * runtime/VM.cpp:
+        (JSC::VM::afterVMExit): Added a helper for scheduling an activity after
+        VM exit. We can't delete code while it's on the stack, and we can't
+        delete auxiliary profiling data while profiling code is on the stack,
+        so in those cases, we schedule the deletion for the next time we exit.
+
+        (JSC::VM::deleteAllCode): Use afterVMExit because we might have code
+        on the stack when debugger, profiler, or watchdog state changes.
+
+        * runtime/VM.h:
+
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::addDidPopListener):
+        (JSC::VMEntryScope::~VMEntryScope):
+        (JSC::VMEntryScope::setEntryScopeDidPopListener): Deleted.
+        * runtime/VMEntryScope.h:
+        (JSC::VMEntryScope::globalObject): Removed the uniquing feature from
+        the scope pop listener list because we don't have a client that wants
+        it, and it's not convenient to use correctly since you can't take
+        the address of a member function, a lambda, or an std::function. We can
+        add this feature back if we discover that we want it.
+
+2015-08-21  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement WebAssembly function parser
+        https://bugs.webkit.org/show_bug.cgi?id=147738
+
+        Reviewed by Filip Pizlo.
+
+        Implement WebAssembly function parser for WebAssembly files produced by pack-asmjs
+        <https://github.com/WebAssembly/polyfill-prototype-1>. This patch parses only
+        some instructions on statements and int32 expressions. Parsing of the rest
+        will be implemented in subsequent patches. The instruction lists in WASMConstants.h
+        are slightly modified from
+        <https://github.com/WebAssembly/polyfill-prototype-1/blob/master/src/shared.h>.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wasm/WASMConstants.h: Added.
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionParser.cpp: Added.
+        (JSC::WASMFunctionParser::checkSyntax):
+        (JSC::WASMFunctionParser::parseFunction):
+        (JSC::WASMFunctionParser::parseLocalVariables):
+        (JSC::WASMFunctionParser::parseStatement):
+        (JSC::WASMFunctionParser::parseSetLocalStatement):
+        (JSC::WASMFunctionParser::parseReturnStatement):
+        (JSC::WASMFunctionParser::parseBlockStatement):
+        (JSC::WASMFunctionParser::parseExpression):
+        (JSC::WASMFunctionParser::parseExpressionI32):
+        (JSC::WASMFunctionParser::parseImmediateExpressionI32):
+        * wasm/WASMFunctionParser.h: Added.
+        (JSC::WASMFunctionParser::WASMFunctionParser):
+        * wasm/WASMFunctionSyntaxChecker.h: Renamed from Source/JavaScriptCore/wasm/WASMMagicNumber.h.
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::WASMModuleParser):
+        (JSC::WASMModuleParser::parseFunctionDefinitionSection):
+        (JSC::WASMModuleParser::parseFunctionDefinition):
+        * wasm/WASMModuleParser.h:
+        * wasm/WASMReader.cpp:
+        (JSC::WASMReader::readType):
+        (JSC::WASMReader::readExpressionType):
+        (JSC::WASMReader::readExportFormat):
+        (JSC::WASMReader::readOpStatement):
+        (JSC::WASMReader::readOpExpressionI32):
+        (JSC::WASMReader::readVariableTypes):
+        (JSC::WASMReader::readOp):
+        * wasm/WASMReader.h:
+        (JSC::WASMReader::offset):
+        (JSC::WASMReader::setOffset):
+
+2015-08-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::PutStackSinkingPhase doesn't need to emit KillStack nodes
+        https://bugs.webkit.org/show_bug.cgi?id=148331
+
+        Reviewed by Geoffrey Garen.
+
+        PutStackSinkingPhase previously emitted a KillStack node when it sank a PutStack. This
+        isn't necessary because KillStack is only interesting for OSR exit, and PutStack nodes
+        that are relevant to OSR will already be preceded by a KillStack/MovHint pair.
+
+        * dfg/DFGPutStackSinkingPhase.cpp:
+
+2015-08-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::NodeOrigin should have a flag determining if exiting is OK right now
+        https://bugs.webkit.org/show_bug.cgi?id=148323
+
+        Reviewed by Saam Barati.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::currentNodeOrigin):
+        (JSC::DFG::ByteCodeParser::branchData):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertConstant):
+        (JSC::DFG::InsertionSet::insertConstantForUse):
+        (JSC::DFG::InsertionSet::insertBottomConstantForUse):
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGNodeOrigin.h:
+        (JSC::DFG::NodeOrigin::NodeOrigin):
+        (JSC::DFG::NodeOrigin::isSet):
+        (JSC::DFG::NodeOrigin::withSemantic):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
+2015-08-21  Saam barati  <sbarati@apple.com>
+
+        DFG callOperations should not implicitly emit an exception check. At callOperation call sites, we should explicitly emit exception checks
+        https://bugs.webkit.org/show_bug.cgi?id=147988
+
+        Reviewed by Geoffrey Garen.
+
+        This is in preparation for the DFG being able to handle exceptions. 
+        To do this, we need more control over when we emit exception checks.
+        Specifically, we want to be able to silentFill before emitting an exception check.
+        This patch does that. This patch also allows us to easily see which
+        operations do and do not emit exception checks. Finding this information
+        out before was a pain.
+
+        * assembler/AbortReason.h:
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        * dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::appendCall):
+        (JSC::DFG::JITCompiler::exceptionCheck):
+        * dfg/DFGSaneStringGetByValSlowPathGenerator.h:
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::CallSlowPathGenerator::CallSlowPathGenerator):
+        (JSC::DFG::CallSlowPathGenerator::tearDown):
+        (JSC::DFG::CallResultAndNoArgumentsSlowPathGenerator::CallResultAndNoArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndOneArgumentSlowPathGenerator::CallResultAndOneArgumentSlowPathGenerator):
+        (JSC::DFG::CallResultAndTwoArgumentsSlowPathGenerator::CallResultAndTwoArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndThreeArgumentsSlowPathGenerator::CallResultAndThreeArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndFourArgumentsSlowPathGenerator::CallResultAndFourArgumentsSlowPathGenerator):
+        (JSC::DFG::CallResultAndFiveArgumentsSlowPathGenerator::CallResultAndFiveArgumentsSlowPathGenerator):
+        (JSC::DFG::slowPathCall):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileArithRound):
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
+        (JSC::DFG::SpeculativeJIT::compileCreateScopedArguments):
+        (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):
+        (JSC::DFG::SpeculativeJIT::compileNotifyWrite):
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOnCell):
+        (JSC::DFG::SpeculativeJIT::emitSwitchImm):
+        (JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::callOperationWithCallFrameRollbackOnException):
+        (JSC::DFG::SpeculativeJIT::prepareForExternalCall):
+        (JSC::DFG::SpeculativeJIT::appendCall):
+        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnException):
+        (JSC::DFG::SpeculativeJIT::appendCallWithCallFrameRollbackOnExceptionSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck): Deleted.
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::CompareAndBoxBooleanSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::jitAssertArgumentCountSane):
+        (JSC::AssemblyHelpers::jitAssertNoException):
+        (JSC::AssemblyHelpers::callExceptionFuzz):
+        (JSC::AssemblyHelpers::emitExceptionCheck):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::jitAssertIsInt32):
+        (JSC::AssemblyHelpers::jitAssertIsJSInt32):
+        (JSC::AssemblyHelpers::jitAssertIsNull):
+        (JSC::AssemblyHelpers::jitAssertTagsInPlace):
+        (JSC::AssemblyHelpers::jitAssertArgumentCountSane):
+        (JSC::AssemblyHelpers::jitAssertNoException):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * runtime/VM.h:
+        (JSC::VM::scratchBufferForSize):
+        (JSC::VM::exceptionFuzzingBuffer):
+
+2015-08-21  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION (r188714): RELEASE_ASSERT in JSC::Heap::incrementDeferralDepth() opening Web Inspector on daringfireball.net
+        https://bugs.webkit.org/show_bug.cgi?id=148312
+
+        Reviewed by Mark Lam.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Use our vm argument instead of
+        m_vm because sometimes they are different and m_vm is null. (This behavior
+        is very strange, and we should probably eliminate it -- but we need a 
+        fix for this serious regression right now.)
+
+2015-08-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] prototyping module loader in JSC shell
+        https://bugs.webkit.org/show_bug.cgi?id=147876
+
+        Reviewed by Saam Barati.
+
+        This patch implements ES6 Module Loader part. The implementation is based on
+        the latest draft[1, 2]. The naive implementation poses several problems.
+        This patch attempts to solve the spec issues and proposes the fix[3, 4, 5].
+
+        We construct the JSC internal module loader based on the ES6 Promises.
+        The chain of the promises represents the dependency graph of the modules and
+        it automatically enables asynchronous module fetching.
+        To leverage the Promises internally, we use the InternalPromise landed in r188681.
+
+        The loader has several platform-dependent hooks. The platform can implement
+        these hooks to provide the functionality missing in the module loaders, like
+        "how to fetch the resources". The method table of the JSGlobalObject is extended
+        to accept these hooks from the platform.
+
+        This patch focus on the loading part. So we don't create the module environment
+        and don't link the modules yet.
+
+        To test the current module progress easily, we add the `-m` option to the JSC shell.
+        When this option is specified, we load the given script as the module. And to use
+        the module loading inside the JSC shell, we added the simple loader hook for fetching.
+        It fetches the module content from the file system.
+
+        And to use the ES6 Map in the Loader implementation, we added @get and @set methods to the Map.
+        But it conflicts with the existing `getPrivateName` method. Rename it to `lookUpPrivateName`.
+
+        [1]: https://whatwg.github.io/loader/
+        [2]: https://github.com/whatwg/loader/commit/214c7a6625b445bdf411c39984f36f01139a24be
+        [3]: https://github.com/whatwg/loader/pull/66
+        [4]: https://github.com/whatwg/loader/pull/67
+        [5]: https://github.com/whatwg/loader/issues/68
+        [6]: https://bugs.webkit.org/show_bug.cgi?id=148136
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::lookUpPrivateName):
+        (JSC::BuiltinNames::lookUpPublicName):
+        (JSC::BuiltinNames::getPrivateName): Deleted.
+        (JSC::BuiltinNames::getPublicName): Deleted.
+        * builtins/ModuleLoaderObject.js: Added.
+        (setStateToMax):
+        (newRegistryEntry):
+        (forceFulfillPromise):
+        (fulfillFetch):
+        (fulfillTranslate):
+        (fulfillInstantiate):
+        (instantiation):
+        (requestFetch):
+        (requestTranslate):
+        (requestInstantiate):
+        (requestResolveDependencies.resolveDependenciesPromise.this.requestInstantiate.then.):
+        (requestResolveDependencies.resolveDependenciesPromise.this.requestInstantiate.then):
+        (requestResolveDependencies):
+        (requestInstantiateAll):
+        (provide):
+        * jsc.cpp:
+        (stringFromUTF):
+        (jscSource):
+        (GlobalObject::moduleLoaderFetch):
+        (functionCheckModuleSyntax):
+        (dumpException):
+        (runWithScripts):
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        (jscmain):
+        (CommandLine::CommandLine): Deleted.
+        * parser/Lexer.cpp:
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::ModuleAnalyzer):
+        (JSC::ModuleAnalyzer::exportVariable):
+        (JSC::ModuleAnalyzer::analyze):
+        * parser/ModuleAnalyzer.h:
+        (JSC::ModuleAnalyzer::moduleRecord):
+        * parser/ModuleRecord.cpp:
+        (JSC::printableName): Deleted.
+        (JSC::ModuleRecord::dump): Deleted.
+        * parser/ModuleRecord.h:
+        (JSC::ModuleRecord::ImportEntry::isNamespace): Deleted.
+        (JSC::ModuleRecord::create): Deleted.
+        (JSC::ModuleRecord::appendRequestedModule): Deleted.
+        (JSC::ModuleRecord::addImportEntry): Deleted.
+        (JSC::ModuleRecord::addExportEntry): Deleted.
+        (JSC::ModuleRecord::addStarExportEntry): Deleted.
+        * parser/Nodes.h:
+        * parser/NodesAnalyzeModule.cpp:
+        (JSC::ImportDeclarationNode::analyzeModule):
+        (JSC::ExportAllDeclarationNode::analyzeModule):
+        (JSC::ExportNamedDeclarationNode::analyzeModule):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::lookUpPrivateName):
+        (JSC::CommonIdentifiers::lookUpPublicName):
+        (JSC::CommonIdentifiers::getPrivateName): Deleted.
+        (JSC::CommonIdentifiers::getPublicName): Deleted.
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkModuleSyntax):
+        (JSC::evaluateModule):
+        * runtime/Completion.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/Identifier.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::moduleLoader):
+        (JSC::JSGlobalObject::moduleRecordStructure):
+        * runtime/JSModuleRecord.cpp: Renamed from Source/JavaScriptCore/parser/ModuleRecord.cpp.
+        (JSC::JSModuleRecord::destroy):
+        (JSC::JSModuleRecord::finishCreation):
+        (JSC::printableName):
+        (JSC::JSModuleRecord::dump):
+        * runtime/JSModuleRecord.h: Renamed from Source/JavaScriptCore/parser/ModuleRecord.h.
+        (JSC::JSModuleRecord::ImportEntry::isNamespace):
+        (JSC::JSModuleRecord::createStructure):
+        (JSC::JSModuleRecord::create):
+        (JSC::JSModuleRecord::requestedModules):
+        (JSC::JSModuleRecord::JSModuleRecord):
+        (JSC::JSModuleRecord::appendRequestedModule):
+        (JSC::JSModuleRecord::addImportEntry):
+        (JSC::JSModuleRecord::addExportEntry):
+        (JSC::JSModuleRecord::addStarExportEntry):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/ModuleLoaderObject.cpp: Added.
+        (JSC::ModuleLoaderObject::ModuleLoaderObject):
+        (JSC::ModuleLoaderObject::finishCreation):
+        (JSC::ModuleLoaderObject::getOwnPropertySlot):
+        (JSC::printableModuleKey):
+        (JSC::ModuleLoaderObject::provide):
+        (JSC::ModuleLoaderObject::requestInstantiateAll):
+        (JSC::ModuleLoaderObject::resolve):
+        (JSC::ModuleLoaderObject::fetch):
+        (JSC::ModuleLoaderObject::translate):
+        (JSC::ModuleLoaderObject::instantiate):
+        (JSC::moduleLoaderObjectParseModule):
+        (JSC::moduleLoaderObjectRequestedModules):
+        (JSC::moduleLoaderObjectResolve):
+        (JSC::moduleLoaderObjectFetch):
+        (JSC::moduleLoaderObjectTranslate):
+        (JSC::moduleLoaderObjectInstantiate):
+        * runtime/ModuleLoaderObject.h: Added.
+        (JSC::ModuleLoaderObject::create):
+        (JSC::ModuleLoaderObject::createStructure):
+        * runtime/Options.h:
+
+2015-08-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have a KnownBooleanUse for cases where we are required to know that the child is a boolean and it's not OK to speculate
+        https://bugs.webkit.org/show_bug.cgi?id=148286
+
+        Reviewed by Benjamin Poulain.
+
+        This enables us to ensure that the Branch or LogicalNot after an effectful CompareXYZ can
+        be marked as !mayExit(). I need that for https://bugs.webkit.org/show_bug.cgi?id=145204.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::shouldNotHaveTypeCheck):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::boolify):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBoolean):
+
+2015-08-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Overflow check elimination fails for a simple test case
+        https://bugs.webkit.org/show_bug.cgi?id=147387
+
+        Reviewed by Benjamin Poulain.
+
+        Overflow check elimination was having issues when things got constant-folded, because whereas an
+        Add or LessThan operation teaches us about relationships between the things being added or
+        compared, we don't do that when we see a JSConstant. We don't create a relationship between every
+        JSConstant and every other JSConstant. So, if we constant-fold an Add, we forget the relationships
+        that it would have had with its inputs.
+
+        One solution would be to have every JSConstant create a relationship with every other JSConstant.
+        This is dangerous, since it would create O(n^2) explosion of relationships.
+
+        Instead, this patch teaches filtration and merging how to behave "as if" there were inter-constant
+        relationships. Normally those operations only work on two relationships involving the same node
+        pair. But now, if we have @x op @c and @x op @d, where @c and @d are different nodes but both are
+        constants, we will do merging or filtering by grokking the constant values.
+
+        This speeds up lots of tests in JSRegress, because it enables overflow check elimination on things
+        like:
+
+        for (var i = 0; i < 100; ++i)
+
+        Previously, the fact that this was all constants would throw off the analysis because the analysis
+        wouldn't "know" that 0 < 100.
+
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+
+2015-08-20  Geoffrey Garen  <ggaren@apple.com>
+
+        forEachCodeBlock should wait for all CodeBlocks automatically
+        https://bugs.webkit.org/show_bug.cgi?id=148255
+
+        Add back a line of code I deleted by accident in my last patch due to
+        incorrect merge.
+
+        Unreviewed.
+
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllCode):
+
+2015-08-20  Geoffrey Garen  <ggaren@apple.com>
+
+        forEachCodeBlock should wait for all CodeBlocks automatically
+        https://bugs.webkit.org/show_bug.cgi?id=148255
+
+        Reviewed by Saam Barati.
+
+        Previously, all clients needed to wait manually before calling
+        forEachCodeBlock. That's easy to get wrong, and at least one place
+        got it wrong. Let's do this automatically instead.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::toggleBreakpoint): No need to wait manually;
+        forEachCodeBlock will do it automatically now.
+
+        (JSC::Debugger::recompileAllJSFunctions): We still need to wait manually
+        here because this is an iteration of the heap, which does not wait
+        automatically. Use the new helper function for waiting.
+
+        (JSC::Debugger::clearBreakpoints):
+        (JSC::Debugger::clearDebuggerRequests):
+        (JSC::Debugger::setBreakpointsActivated):
+        (JSC::Debugger::forEachCodeBlock): Deleted. No need to wait manually.
+
+        * debugger/Debugger.h:
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::completeAllPlansForVM):
+        * dfg/DFGWorklist.h:
+        (JSC::DFG::completeAllPlansForVM): Added a helper function that replaces
+        vm.prepareToDeleteCode. This new function is clearer because we need
+        to call it sometimes even if we are not going to delete code.
+
+        * heap/HeapInlines.h:
+        (JSC::Heap::forEachCodeBlock): Moved.
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::recompileAllJSFunctionsForTypeProfiling): Use the new helper
+        function.
+
+        * runtime/JSCInlines.h:
+        (JSC::Heap::forEachCodeBlock): Do the waiting automatically.
+
+        * runtime/VM.cpp:
+        (JSC::VM::stopSampling):
+        (JSC::VM::deleteAllCode):
+        (JSC::VM::setEnabledProfiler):
+        (JSC::VM::prepareToDeleteCode): Deleted.
+        * runtime/VM.h: No need to wait manually.
+
+2015-08-20  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r188675.
+        https://bugs.webkit.org/show_bug.cgi?id=148244
+
+        "caused a 17% Mac PLT regression" (Requested by ggaren on
+        #webkit).
+
+        Reverted changeset:
+
+        "clearCode() should clear code"
+        https://bugs.webkit.org/show_bug.cgi?id=148203
+        http://trac.webkit.org/changeset/188675
+
+2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce put_by_id like IC into put_by_val when the given name is String or Symbol
+        https://bugs.webkit.org/show_bug.cgi?id=147760
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds put_by_id IC to put_by_val by caching the one candidate id,
+        it is the same thing to the get_by_val IC extension.
+        It will encourage the use of ES6 Symbols and ES6 computed properties in the object literals.
+
+        In this patch, we leverage the existing CheckIdent and PutById / PutByVal in DFG,
+        so this patch does not change FTL because the above operations are already supported in FTL.
+
+        And this patch also includes refactoring to leverage byValInfo->slowPathCount in the cached Id path.
+
+        Performance results report there's no regression in the existing tests. And in the synthetic
+        benchmarks created by modifying put-by-id to put-by-val, we can see significant performance
+        improvements up to 13.9x.
+
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JIT.h:
+        (JSC::JIT::compilePutByValWithCachedId):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        (JSC::tryGetByValOptimize):
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emitIdentifierCheck):
+        (JSC::JIT::privateCompilePutByValWithCachedId):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * tests/stress/put-by-val-with-string-break.js: Added.
+        (shouldBe):
+        (assign):
+        * tests/stress/put-by-val-with-string-generated.js: Added.
+        (shouldBe):
+        (gen1):
+        (gen2):
+        (assign):
+        * tests/stress/put-by-val-with-string-generic.js: Added.
+        (shouldBe):
+        (assign):
+        * tests/stress/put-by-val-with-symbol-break.js: Added.
+        (shouldBe):
+        (assign):
+        * tests/stress/put-by-val-with-symbol-generic.js: Added.
+        (shouldBe):
+        (assign):
+
+2015-08-20  Alex Christensen  <achristensen@webkit.org>
+
+        Clean up CMake build after r188673
+        https://bugs.webkit.org/show_bug.cgi?id=148234
+
+        Reviewed by Tim Horton.
+
+        * shell/PlatformWin.cmake:
+        Define WIN_CAIRO so the WinCairo jsc.exe can find the correct dlls.
+
+2015-08-20  Mark Lam  <mark.lam@apple.com>
+
+        A watchdog tests is failing on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=148228
+
+        Reviewed by Brent Fulgham.
+
+        The test just needed a little more time because Windows' timer resolution is low.
+        After increasing the test deadlines, the test started passing.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (testExecutionTimeLimit):
+
+2015-08-20  Mark Lam  <mark.lam@apple.com>
+
+        Fixed some warnings on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=148224
+
+        Reviewed by Brent Fulgham.
+
+        The Windows build was complaining that function params were hiding a global variable.
+        Since the function params were unused, I resolved this by removing the param names.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (currentCPUTimeAsJSFunctionCallback):
+        (shouldTerminateCallback):
+        (cancelTerminateCallback):
+        (extendTerminateCallback):
+
+2015-08-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Add InternalPromise to use Promises safely in the internals
+        https://bugs.webkit.org/show_bug.cgi?id=148136
+
+        Reviewed by Saam Barati.
+
+        This patch implements InternalPromise.
+        It is completely different instance set (constructor, prototype, instance)
+        but it has the same feature to the Promise.
+
+        In the Promise operations, when resolving the promise with the returned promise
+        from the fulfill handler, we need to look up "then" method.
+
+        e.g.
+            var p3 = p1.then(function handler(...) {
+                return p2;
+            });
+
+        When handler is executed, we retrieve the returned `p2` promise. And to resolve
+        the returned promise by "then" method (that is `p3`), we construct the chain by executing
+        `p2.then(resolving function for p3)`. So if the user modify the Promise.prototype.then,
+        we can observe the internal operations.
+
+        By using InternalPromise, we completely hide InternalPromise.prototype from the users.
+        It allows JSC to use Promises internally; even if the user modify / override
+        the Promise.prototype.then function, it does not effect on InternalPromise.
+
+        One limitation is that the implementation need to take care not to leak the InternalPromise instance
+        to the user space.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/InternalPromiseConstructor.js: Added.
+        (internalAll.newResolveElement):
+        (internalAll):
+        * builtins/Operations.Promise.js:
+        (newPromiseDeferred): Deleted.
+        * builtins/PromiseConstructor.js:
+        (privateAll.newResolveElement): Deleted.
+        (privateAll): Deleted.
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::promiseConstructor):
+        (JSC::JSGlobalObject::internalPromiseConstructor):
+        (JSC::JSGlobalObject::newPromiseCapabilityFunction):
+        (JSC::JSGlobalObject::newPromiseDeferredFunction): Deleted.
+        * runtime/JSInternalPromise.cpp: Copied from Source/JavaScriptCore/runtime/JSPromisePrototype.h.
+        (JSC::JSInternalPromise::create):
+        (JSC::JSInternalPromise::createStructure):
+        (JSC::JSInternalPromise::JSInternalPromise):
+        * runtime/JSInternalPromise.h: Copied from Source/JavaScriptCore/runtime/JSPromise.h.
+        * runtime/JSInternalPromiseConstructor.cpp: Added.
+        (JSC::JSInternalPromiseConstructor::create):
+        (JSC::JSInternalPromiseConstructor::createStructure):
+        (JSC::JSInternalPromiseConstructor::JSInternalPromiseConstructor):
+        (JSC::constructPromise):
+        (JSC::JSInternalPromiseConstructor::getConstructData):
+        (JSC::JSInternalPromiseConstructor::getCallData):
+        (JSC::JSInternalPromiseConstructor::getOwnPropertySlot):
+        * runtime/JSInternalPromiseConstructor.h: Copied from Source/JavaScriptCore/runtime/JSPromiseConstructor.h.
+        * runtime/JSInternalPromiseDeferred.cpp: Added.
+        (JSC::JSInternalPromiseDeferred::create):
+        (JSC::JSInternalPromiseDeferred::JSInternalPromiseDeferred):
+        (JSC::JSInternalPromiseDeferred::promise):
+        * runtime/JSInternalPromiseDeferred.h: Copied from Source/JavaScriptCore/runtime/JSPromisePrototype.h.
+        * runtime/JSInternalPromisePrototype.cpp: Copied from Source/JavaScriptCore/runtime/JSPromisePrototype.cpp.
+        (JSC::JSInternalPromisePrototype::create):
+        (JSC::JSInternalPromisePrototype::createStructure):
+        (JSC::JSInternalPromisePrototype::JSInternalPromisePrototype):
+        * runtime/JSInternalPromisePrototype.h: Copied from Source/JavaScriptCore/runtime/JSPromise.h.
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::create):
+        (JSC::JSPromise::JSPromise):
+        (JSC::JSPromise::initialize):
+        * runtime/JSPromise.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::JSPromiseConstructor):
+        (JSC::constructPromise):
+        (JSC::JSPromiseConstructor::getOwnPropertySlot):
+        (JSC::JSPromiseConstructor::finishCreation): Deleted.
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::newPromiseCapability):
+        (JSC::JSPromiseDeferred::create):
+        (JSC::JSPromiseDeferred::JSPromiseDeferred):
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::getOwnPropertySlot):
+        * runtime/JSPromisePrototype.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2015-08-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove WTF::SpinLock
+        https://bugs.webkit.org/show_bug.cgi?id=148208
+
+        Reviewed by Geoffrey Garen.
+
+        Remove the one remaining use of SpinLock.
+
+        * API/JSValue.mm:
+        (handerForStructTag):
+
+2015-08-19  Geoffrey Garen  <ggaren@apple.com>
+
+        clearCode() should clear code
+        https://bugs.webkit.org/show_bug.cgi?id=148203
+
+        Reviewed by Saam Barati.
+
+        Clearing code used to require two steps: clearCode() and
+        clearUnlinkedCodeForRecompilation(). Unsurprisingly, clients sometimes
+        did one or the other or both without much rhyme or reason.
+
+        This patch simplifies things by merging both functions into clearCode().
+
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * debugger/Debugger.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode):
+        (JSC::Heap::clearUnmarkedExecutables):
+        (JSC::Heap::deleteAllUnlinkedFunctionCode): Deleted. No need for this
+        function anymore since it was only used by clients who already called
+        clearCode() (and it would be terribly wrong to use without doing both.)
+
+        * heap/Heap.h:
+        (JSC::Heap::sizeAfterLastFullCollection):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::TypeRecompiler::visit):
+        (Inspector::TypeRecompiler::operator()):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::visitChildren):
+        (JSC::FunctionExecutable::clearCode):
+        (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilation): Deleted.
+        * runtime/Executable.h:
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllCode):
+
+2015-08-19  Alex Christensen  <achristensen@webkit.org>
+
+        CMake Windows build should not include files directly from other Source directories
+        https://bugs.webkit.org/show_bug.cgi?id=148198
+
+        Reviewed by Brent Fulgham.
+
+        * CMakeLists.txt:
+        JavaScriptCore_FORWARDING_HEADERS_FILES is no longer necessary because all the headers
+        that used to be in it are now in JavaScriptCore_FORWARDING_HEADERS_DIRECTORIES
+        * PlatformEfl.cmake:
+        * PlatformGTK.cmake:
+        * PlatformMac.cmake:
+        * PlatformWin.cmake:
+
+2015-08-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Remove ENABLE_WEBVTT_REGIONS
+        https://bugs.webkit.org/show_bug.cgi?id=148184
+
+        Reviewed by Jer Noble.
+
+        * Configurations/FeatureDefines.xcconfig: Remove ENABLE_WEBVTT_REGIONS.
+
+2015-08-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Unexpected node preview format for an element with newlines in className attribute
+        https://bugs.webkit.org/show_bug.cgi?id=148192
+
+        Reviewed by Brian Burg.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._nodePreview):
+        Replace whitespace blocks with single spaces to produce a simpler class string for previews.
+
+2015-08-19  Mark Lam  <mark.lam@apple.com>
+
+        Add support for CheckWatchdogTimer as slow path in DFG and FTL.
+        https://bugs.webkit.org/show_bug.cgi?id=147968
+
+        Reviewed by Michael Saboff.
+
+        Re-implement the DFG's CheckWatchdogTimer as a slow path instead of a speculation
+        check.  Since the watchdog timer can fire spuriously, this allows the code to
+        stay optimized if all we have are spurious fires.
+
+        Implement the equivalent slow path for CheckWatchdogTimer in the FTL. 
+
+        The watchdog tests in ExecutionTimeLimitTest.cpp has already been updated in
+        https://bugs.webkit.org/show_bug.cgi?id=148125 to test for the FTL's watchdog
+        implementation.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckWatchdogTimer):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isInlinableSize):
+
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        - Changed operationHandleWatchdogTimer() to return an unused nullptr.  This
+          allows me to reuse the existing DFG slow path generator mechanism.  I didn't
+          think that operationHandleWatchdogTimer() was worth introducing a whole new set
+          of machinery just so we can have a slow path that returns void.
+
+2015-08-19  Mark Lam  <mark.lam@apple.com>
+
+        Add ability to save and restore JSC options.
+        https://bugs.webkit.org/show_bug.cgi?id=148125
+
+        Reviewed by Saam Barati.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (testExecutionTimeLimit):
+        - Employ the new options getter/setter to run watchdog tests for each of the
+          execution engine tiers.
+        - Also altered the test scripts to be in a function instead of global code.
+          This is one of 2 changes needed to give them an opportunity to be FTL compiled.
+          The other is to add support for compiling CheckWatchdogTimer in the FTL (which
+          will be addressed in a separate patch).
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+        * runtime/Options.cpp:
+        (JSC::parse):
+        - Add the ability to clear a string option with a nullptr value.
+          This is needed to restore a default string option value which may be null.
+
+        (JSC::OptionRange::init):
+        - Add the ability to clear a range option with a null value.
+          This is needed to restore a default range option value which may be null.
+
+        (JSC::Options::initialize):
+        (JSC::Options::dumpOptionsIfNeeded):
+        - Factor code to dump options out to dumpOptionsIfNeeded() since we will need
+          that logic elsewhere.
+
+        (JSC::Options::setOptions):
+        - Parse an options string and set each of the specified options.
+
+        (JSC::Options::dumpAllOptions):
+        (JSC::Options::dumpAllOptionsInALine):
+        (JSC::Options::dumpOption):
+        (JSC::Option::dump):
+        - Refactored so that the underlying dumper dumps to a StringBuilder instead of
+          stderr.  This lets us reuse this code to serialize all the options into a
+          single string for dumpAllOptionsInALine().
+
+        * runtime/Options.h:
+        (JSC::OptionRange::rangeString):
+
+2015-08-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Replace all uses of std::mutex/std::condition_variable with WTF::Lock/WTF::Condition
+        https://bugs.webkit.org/show_bug.cgi?id=148140
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::registerDebuggable):
+        (Inspector::RemoteInspector::unregisterDebuggable):
+        (Inspector::RemoteInspector::updateDebuggable):
+        (Inspector::RemoteInspector::updateDebuggableAutomaticInspectCandidate):
+        (Inspector::RemoteInspector::sendMessageToRemoteFrontend):
+        (Inspector::RemoteInspector::setupFailed):
+        (Inspector::RemoteInspector::setupCompleted):
+        (Inspector::RemoteInspector::start):
+        (Inspector::RemoteInspector::stop):
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        (Inspector::RemoteInspector::setParentProcessInformation):
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        (Inspector::RemoteInspector::pushListingSoon):
+        (Inspector::RemoteInspector::receivedIndicateMessage):
+        (Inspector::RemoteInspector::receivedProxyApplicationSetupMessage):
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::close):
+        (Inspector::RemoteInspectorXPCConnection::closeFromMessage):
+        (Inspector::RemoteInspectorXPCConnection::deserializeMessage):
+        (Inspector::RemoteInspectorXPCConnection::handleEvent):
+
+2015-08-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Links for rules in <style> are incorrect, do not account for <style> offset in the document
+        https://bugs.webkit.org/show_bug.cgi?id=148141
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/CSS.json:
+        Extend StyleSheetHeader to include start offset information and a bit
+        for whether or not this was an inline style tag created by the parser.
+        These match additions to Blink's protocol.
+
+2015-08-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Optimize more cases of something-compared-to-null/undefined
+        https://bugs.webkit.org/show_bug.cgi?id=148157
+
+        Reviewed by Geoffrey Garen and Filip Pizlo.
+
+        CompareEq is fairly trivial if you assert one of the operands is either
+        null or undefined. Under those conditions, the only way to have "true"
+        is to have the other operand be null/undefined or have an object
+        that masquerades to undefined.
+
+        JSC already had a fast path in CompareEqConstant.
+        With this patch, I generalize this fast path to more cases and try
+        to eliminate the checks whenever possible.
+
+        CompareEq now does the job of CompareEqConstant. If any operand can
+        be proved to be undefined/other, its edge is set to OtherUse. Whenever
+        any edge is OtherUse, we generate the fast code we had for CompareEqConstant.
+
+        The AbstractInterpreter has additional checks to reduce the node to a constant
+        whenever possible.
+
+        There are two additional changes in this patch:
+        -The Fixup Phase tries to set edges to OtherUse early. This is done correctly
+         in ConstantFoldingPhase but setting it up early helps the phases relying
+         on Clobberize.
+        -The codegen for CompareEqConstant was improved. The reason is the comparison
+         for ObjectOrOther could be faster just because the codegen was better.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): Deleted.
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC): Deleted.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isUndefinedOrNullConstant):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isKnownNotOther):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): Deleted.
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): Deleted.
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull): Deleted.
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): Deleted.
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): Deleted.
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull): Deleted.
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate): Deleted.
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareEqConstant): Deleted.
+        * tests/stress/compare-eq-on-null-and-undefined-non-peephole.js: Added.
+        (string_appeared_here.useForMath):
+        (testUseForMath):
+        * tests/stress/compare-eq-on-null-and-undefined-optimized-in-constant-folding.js: Added.
+        (string_appeared_here.unreachableCodeTest):
+        (inlinedCompareToNull):
+        (inlinedComparedToUndefined):
+        (warmupInlineFunctions):
+        (testInlineFunctions):
+        * tests/stress/compare-eq-on-null-and-undefined.js: Added.
+        (string_appeared_here.compareConstants):
+        (opaqueNull):
+        (opaqueUndefined):
+        (compareConstantsAndDynamicValues):
+        (compareDynamicValues):
+        (compareDynamicValueToItself):
+        (arrayTesting):
+        (opaqueCompare1):
+        (testNullComparatorUpdate):
+        (opaqueCompare2):
+        (testUndefinedComparatorUpdate):
+        (opaqueCompare3):
+        (testNullAndUndefinedComparatorUpdate):
+
+2015-08-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce non-user-observable Promise functions to use Promises internally
+        https://bugs.webkit.org/show_bug.cgi?id=148118
+
+        Reviewed by Saam Barati.
+
+        To leverage the Promises internally (like ES6 Module Loaders), we add
+        the several non-user-observable private methods, like @then, @all. And
+        refactor the existing Promises implementation to make it easy to use
+        internally.
+
+        But still the trappable part remains. When resolving the promise with
+        the returned value, we look up the "then" function. So users can trap
+        by replacing "then" function of the Promise's prototype.
+        To avoid this situation, we'll introduce completely differnt promise
+        instances called InternalPromise in the subsequent patch[1].
+
+        No behavior change.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=148136
+
+        * builtins/PromiseConstructor.js:
+        (privateAll.newResolveElement):
+        (privateAll):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::promiseConstructor): Deleted.
+        (JSC::JSGlobalObject::promisePrototype): Deleted.
+        (JSC::JSGlobalObject::promiseStructure): Deleted.
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::finishCreation):
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::callFunction):
+        (JSC::JSPromiseDeferred::resolve):
+        (JSC::JSPromiseDeferred::reject):
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::create):
+        (JSC::JSPromisePrototype::JSPromisePrototype):
+        * runtime/JSPromisePrototype.h:
+
+2015-08-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the CLOOP build.
+
+        Unreviewed.
+
+        * bytecode/CodeBlock.cpp:
+
+2015-08-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Split InlineCallFrame into its own file
+        https://bugs.webkit.org/show_bug.cgi?id=148131
+
+        Reviewed by Saam Barati.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallLinkStatus.cpp:
+        * bytecode/CodeBlock.h:
+        (JSC::ExecState::r):
+        (JSC::baselineCodeBlockForInlineCallFrame): Deleted.
+        (JSC::baselineCodeBlockForOriginAndBaselineCodeBlock): Deleted.
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::inlineStack):
+        (JSC::CodeOrigin::codeOriginOwner):
+        (JSC::CodeOrigin::stackOffset):
+        (JSC::CodeOrigin::dump):
+        (JSC::CodeOrigin::dumpInContext):
+        (JSC::InlineCallFrame::calleeConstant): Deleted.
+        (JSC::InlineCallFrame::visitAggregate): Deleted.
+        (JSC::InlineCallFrame::calleeForCallFrame): Deleted.
+        (JSC::InlineCallFrame::hash): Deleted.
+        (JSC::InlineCallFrame::hashAsStringIfPossible): Deleted.
+        (JSC::InlineCallFrame::inferredName): Deleted.
+        (JSC::InlineCallFrame::baselineCodeBlock): Deleted.
+        (JSC::InlineCallFrame::dumpBriefFunctionInformation): Deleted.
+        (JSC::InlineCallFrame::dumpInContext): Deleted.
+        (JSC::InlineCallFrame::dump): Deleted.
+        (WTF::printInternal): Deleted.
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::deletedMarker):
+        (JSC::CodeOrigin::hash):
+        (JSC::CodeOrigin::operator==):
+        (JSC::CodeOriginHash::hash):
+        (JSC::CodeOriginHash::equal):
+        (JSC::InlineCallFrame::kindFor): Deleted.
+        (JSC::InlineCallFrame::varargsKindFor): Deleted.
+        (JSC::InlineCallFrame::specializationKindFor): Deleted.
+        (JSC::InlineCallFrame::isVarargs): Deleted.
+        (JSC::InlineCallFrame::InlineCallFrame): Deleted.
+        (JSC::InlineCallFrame::specializationKind): Deleted.
+        (JSC::InlineCallFrame::setStackOffset): Deleted.
+        (JSC::InlineCallFrame::callerFrameOffset): Deleted.
+        (JSC::InlineCallFrame::returnPCOffset): Deleted.
+        (JSC::CodeOrigin::stackOffset): Deleted.
+        (JSC::CodeOrigin::codeOriginOwner): Deleted.
+        * bytecode/InlineCallFrame.cpp: Copied from Source/JavaScriptCore/bytecode/CodeOrigin.cpp.
+        (JSC::InlineCallFrame::calleeConstant):
+        (JSC::CodeOrigin::inlineDepthForCallFrame): Deleted.
+        (JSC::CodeOrigin::inlineDepth): Deleted.
+        (JSC::CodeOrigin::isApproximatelyEqualTo): Deleted.
+        (JSC::CodeOrigin::approximateHash): Deleted.
+        (JSC::CodeOrigin::inlineStack): Deleted.
+        (JSC::CodeOrigin::dump): Deleted.
+        (JSC::CodeOrigin::dumpInContext): Deleted.
+        * bytecode/InlineCallFrame.h: Copied from Source/JavaScriptCore/bytecode/CodeOrigin.h.
+        (JSC::InlineCallFrame::isVarargs):
+        (JSC::InlineCallFrame::InlineCallFrame):
+        (JSC::InlineCallFrame::specializationKind):
+        (JSC::baselineCodeBlockForInlineCallFrame):
+        (JSC::baselineCodeBlockForOriginAndBaselineCodeBlock):
+        (JSC::CodeOrigin::CodeOrigin): Deleted.
+        (JSC::CodeOrigin::isSet): Deleted.
+        (JSC::CodeOrigin::operator!): Deleted.
+        (JSC::CodeOrigin::isHashTableDeletedValue): Deleted.
+        (JSC::CodeOrigin::operator!=): Deleted.
+        (JSC::CodeOrigin::deletedMarker): Deleted.
+        (JSC::CodeOrigin::stackOffset): Deleted.
+        (JSC::CodeOrigin::hash): Deleted.
+        (JSC::CodeOrigin::operator==): Deleted.
+        (JSC::CodeOrigin::codeOriginOwner): Deleted.
+        (JSC::CodeOriginHash::hash): Deleted.
+        (JSC::CodeOriginHash::equal): Deleted.
+        (JSC::CodeOriginApproximateHash::hash): Deleted.
+        (JSC::CodeOriginApproximateHash::equal): Deleted.
+        * bytecode/InlineCallFrameSet.cpp:
+        * dfg/DFGCommonData.cpp:
+        * dfg/DFGOSRExitBase.cpp:
+        * dfg/DFGVariableEventStream.cpp:
+        * ftl/FTLOperations.cpp:
+        * interpreter/CallFrame.cpp:
+        * interpreter/StackVisitor.cpp:
+        * jit/AssemblyHelpers.h:
+        * profiler/ProfilerOriginStack.cpp:
+        * runtime/ClonedArguments.cpp:
+
+2015-08-18  Mark Lam  <mark.lam@apple.com>
+
+        Removed an unused param in Interpreter::initialize().
+        https://bugs.webkit.org/show_bug.cgi?id=148129
+
+        Reviewed by Michael Saboff.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::initialize):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::stack):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+
+2015-08-17  Alex Christensen  <achristensen@webkit.org>
+
+        Add const to content extension parser
+        https://bugs.webkit.org/show_bug.cgi?id=148044
+
+        Reviewed by Benjamin Poulain.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::tryGetIndexQuickly):
+        (JSC::JSObject::getDirectIndex):
+        (JSC::JSObject::getIndex):
+        Added a few const keywords.
+
+2015-08-17  Alex Christensen  <achristensen@webkit.org>
+
+        Build Debug Suffix on Windows with CMake
+        https://bugs.webkit.org/show_bug.cgi?id=148083
+
+        Reviewed by Brent Fulgham.
+
+        * CMakeLists.txt:
+        * PlatformWin.cmake:
+        * shell/CMakeLists.txt:
+        * shell/PlatformWin.cmake:
+        Add DEBUG_SUFFIX
+
+2015-08-17  Saam barati  <sbarati@apple.com>
+
+        Web Inspector: Type profiler return types aren't showing up
+        https://bugs.webkit.org/show_bug.cgi?id=147348
+
+        Reviewed by Brian Burg.
+
+        Bug #145995 changed the starting offset of a function to 
+        be the open parenthesis of the function's parameter list.
+        This broke JSC's type profiler protocol of communicating 
+        return types of a function to the web inspector. This
+        is now fixed. The text offset used in the protocol is now
+        the first letter of the function/get/set/method name.
+        So "f" in "function a() {}", "s" in "set foo(){}", etc.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * jsc.cpp:
+        (functionReturnTypeFor):
+
+2015-08-17 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        [ES6] Implement ES6 arrow function syntax. Arrow function specific features. Lexical bind of this
+        https://bugs.webkit.org/show_bug.cgi?id=144956
+
+        Reviewed by Saam Barati.
+
+        Added support of ES6 arrow function specific feature, lexical bind of this and no constructor. http://wiki.ecmascript.org/doku.php?id=harmony:arrow_function_syntax
+        In patch were implemented the following cases:
+           this - variable |this| is point to the |this| of the function where arrow function is declared. Lexical bind of |this|
+           constructor - the using of the command |new| for arrow function leads to runtime error
+           call(), apply(), bind()  - methods can only pass in arguments, but has no effect on |this| 
+
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::isArrowFunction):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::isArrowFunction):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionCommon):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionThis):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrowFuncExprNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomNewFunction):
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::isFunctionAllocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPromotedHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLoadArrowFunctionThis):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileLoadArrowFunctionThis):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState): Added 3 arguments version for windows build.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_load_arrowfunction_this):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emitNewFuncExprCommon):
+        (JSC::JIT::emit_op_new_arrow_func_exp):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_load_arrowfunction_this):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::setUpCall):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionMetadata):
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        * parser/NodeConstructors.h:
+        (JSC::BaseFuncExprNode::BaseFuncExprNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::ArrowFuncExprNode::ArrowFuncExprNode):
+        * parser/Nodes.cpp:
+        (JSC::FunctionMetadataNode::FunctionMetadataNode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isArrowFuncExprNode):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/Executable.h:
+        * runtime/JSArrowFunction.cpp: Added.
+        (JSC::JSArrowFunction::destroy):
+        (JSC::JSArrowFunction::create):
+        (JSC::JSArrowFunction::JSArrowFunction):
+        (JSC::JSArrowFunction::createWithInvalidatedReallocationWatchpoint):
+        (JSC::JSArrowFunction::visitChildren):
+        (JSC::JSArrowFunction::getConstructData):
+        * runtime/JSArrowFunction.h: Added.
+        (JSC::JSArrowFunction::allocationSize):
+        (JSC::JSArrowFunction::createImpl):
+        (JSC::JSArrowFunction::boundThis):
+        (JSC::JSArrowFunction::createStructure):
+        (JSC::JSArrowFunction::offsetOfThisValue):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrowFunctionStructure):
+        * tests/stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js: Added.
+        * tests/stress/arrowfunction-activation-sink-osrexit-default-value.js: Added.
+        * tests/stress/arrowfunction-activation-sink-osrexit.js: Added.
+        * tests/stress/arrowfunction-activation-sink.js: Added.
+        * tests/stress/arrowfunction-bound.js: Added.
+        * tests/stress/arrowfunction-call.js: Added.
+        * tests/stress/arrowfunction-constructor.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-1.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-2.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-3.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-4.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-5.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-6.js: Added.
+        * tests/stress/arrowfunction-lexical-this-activation-sink-osrexit.js: Added.
+        * tests/stress/arrowfunction-lexical-this-activation-sink.js: Added.
+        * tests/stress/arrowfunction-lexical-this-sinking-no-double-allocate.js: Added.
+        * tests/stress/arrowfunction-lexical-this-sinking-osrexit.js: Added.
+        * tests/stress/arrowfunction-lexical-this-sinking-put.js: Added.
+        * tests/stress/arrowfunction-others.js: Added.
+        * tests/stress/arrowfunction-run-10-1.js: Added.
+        * tests/stress/arrowfunction-run-10-2.js: Added.
+        * tests/stress/arrowfunction-run-10000-1.js: Added.
+        * tests/stress/arrowfunction-run-10000-2.js: Added.
+        * tests/stress/arrowfunction-sinking-no-double-allocate.js: Added.
+        * tests/stress/arrowfunction-sinking-osrexit.js: Added.
+        * tests/stress/arrowfunction-sinking-put.js: Added.
+        * tests/stress/arrowfunction-tdz.js: Added.
+        * tests/stress/arrowfunction-typeof.js: Added.
+
+2015-07-28  Sam Weinig  <sam@webkit.org>
+
+        Cleanup the builtin JavaScript files
+        https://bugs.webkit.org/show_bug.cgi?id=147382
+
+        Reviewed by Geoffrey Garen.
+
+        * builtins/Array.prototype.js:
+        * builtins/ArrayConstructor.js:
+        * builtins/ArrayIterator.prototype.js:
+        * builtins/Function.prototype.js:
+        * builtins/Iterator.prototype.js:
+        * builtins/ObjectConstructor.js:
+        * builtins/StringConstructor.js:
+        * builtins/StringIterator.prototype.js:
+        Unify the style of the built JavaScript files.
+
+2015-08-17  Alex Christensen  <achristensen@webkit.org>
+
+        Move some commands from ./CMakeLists.txt to Source/cmake
+        https://bugs.webkit.org/show_bug.cgi?id=148003
+
+        Reviewed by Brent Fulgham.
+
+        * CMakeLists.txt:
+        Added commands needed to build JSC by itself.
+
+2015-08-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.get
+        https://bugs.webkit.org/show_bug.cgi?id=147925
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements Reflect.get API.
+        It can take the receiver object as the third argument.
+        When the receiver is specified and there's a getter for the given property name,
+        we call the getter with the receiver as the |this| value.
+
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectGet):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayEntry::get): Deleted.
+        * runtime/SparseArrayValueMap.h:
+        * tests/stress/reflect-get.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (.get shouldThrow):
+        (.get var):
+        (get var.object.get hello):
+        (.get shouldBe):
+        (get var.object.set hello):
+
+2015-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        will-change should sometimes trigger compositing
+        https://bugs.webkit.org/show_bug.cgi?id=148072
+
+        Reviewed by Tim Horton.
+        
+        Include will-change as a reason for compositing.
+
+        * inspector/protocol/LayerTree.json:
+
+2015-08-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=147929
+
+        Reviewed by Geoffrey Garen.
+
+        Implement Reflect.getOwnPropertyDescriptor.
+        The difference from the Object.getOwnPropertyDescriptor is
+        Reflect.getOwnPropertyDescriptor does not perform ToObject onto
+        the first argument. If the first argument is not an Object, it
+        immediately raises the TypeError.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectGetOwnPropertyDescriptor):
+        * tests/stress/reflect-get-own-property.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-08-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Use (x + x) instead of (x * 2) when possible
+        https://bugs.webkit.org/show_bug.cgi?id=148051
+
+        Reviewed by Michael Saboff.
+
+        When multiplying a number by 2, JSC was loading a constant "2"
+        in register and multiplying it with the first number:
+
+            mov $0x4000000000000000, %rcx
+            movd %rcx, %xmm0
+            mulsd %xmm0, %xmm1
+
+        This is a problem for a few reasons.
+        1) "movd %rcx, %xmm0" only set half of XMM0. This instruction
+           has to wait for any preceding instruction on XMM0 to finish
+           before executing.
+        2) The load and transform itself is large and unecessary.
+
+        To fix that, I added a StrengthReductionPhase to transform
+        multiplications by 2 into a addition.
+
+        Unfortunately, that turned the code into:
+            movsd %xmm0 %xmm1
+            mulsd %xmm1 %xmm0
+
+        The reason is GenerationInfo::canReuse() was not accounting
+        for nodes using other nodes multiple times.
+
+        After fixing that too, we now have the multiplications by 2
+        done as:
+            addsd %xmm0 %xmm0
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::useCount):
+        (JSC::DFG::GenerationInfo::canReuse): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::canReuse):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+
+2015-08-14  Basile Clement  <basile_clement@apple.com>
+
+        Occasional failure in v8-v6/v8-raytrace.js.ftl-eager
+        https://bugs.webkit.org/show_bug.cgi?id=147165
+
+        Reviewed by Saam Barati.
+
+        The object allocation sinking phase was not properly checking that a
+        MultiGetByOffset was safe to lower before lowering it.
+        This makes it so that we only lower MultiGetByOffset if it only loads
+        from direct properties of the object, and considers it as an escape in
+        any other case (e.g. a load from the prototype).
+
+        It also ensure proper conversion of MultiGetByOffset into
+        CheckStructureImmediate when needed.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::checkStructure):
+            We were not compiling properly CheckStructure and
+            CheckStructureImmediate nodes with an empty StructureSet.
+        * tests/stress/sink-multigetbyoffset.js: Regression test.
+
+2015-08-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Use WTF::Lock and WTF::Condition instead of WTF::Mutex, WTF::ThreadCondition, std::mutex, and std::condition_variable
+        https://bugs.webkit.org/show_bug.cgi?id=147999
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSVirtualMachine.mm:
+        (initWrapperCache):
+        (+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]):
+        (+[JSVMWrapperCache wrapperForJSContextGroupRef:]):
+        (wrapperCacheMutex): Deleted.
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        * dfg/DFGThreadData.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::~Worklist):
+        (JSC::DFG::Worklist::isActiveForVM):
+        (JSC::DFG::Worklist::enqueue):
+        (JSC::DFG::Worklist::compilationState):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::Worklist::removeDeadPlans):
+        (JSC::DFG::Worklist::queueLength):
+        (JSC::DFG::Worklist::dump):
+        (JSC::DFG::Worklist::runThread):
+        * dfg/DFGWorklist.h:
+        * disassembler/Disassembler.cpp:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        * heap/CopiedSpace.h:
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::recycleBorrowedBlock):
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        * heap/GCThread.cpp:
+        (JSC::GCThread::waitForNextPhase):
+        (JSC::GCThread::gcThreadMain):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::~GCThreadSharedData):
+        (JSC::GCThreadSharedData::startNextPhase):
+        (JSC::GCThreadSharedData::endCurrentPhase):
+        (JSC::GCThreadSharedData::didStartMarking):
+        (JSC::GCThreadSharedData::didFinishMarking):
+        * heap/GCThreadSharedData.h:
+        * heap/HeapTimer.h:
+        * heap/MachineStackMarker.cpp:
+        (JSC::ActiveMachineThreadsManager::Locker::Locker):
+        (JSC::ActiveMachineThreadsManager::add):
+        (JSC::ActiveMachineThreadsManager::remove):
+        (JSC::ActiveMachineThreadsManager::ActiveMachineThreadsManager):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThreadIfFound):
+        (JSC::MachineThreads::tryCopyOtherThreadStack):
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * heap/MachineStackMarker.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::containsOpaqueRootTriState):
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorHandleRunSourceGlobal):
+        (Inspector::RemoteInspectorQueueTaskOnGlobalQueue):
+        (Inspector::RemoteInspectorInitializeGlobalQueue):
+        (Inspector::RemoteInspectorHandleRunSourceWithInfo):
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        (Inspector::RemoteInspectorDebuggableConnection::closeFromDebuggable):
+        (Inspector::RemoteInspectorDebuggableConnection::close):
+        (Inspector::RemoteInspectorDebuggableConnection::sendMessageToBackend):
+        (Inspector::RemoteInspectorDebuggableConnection::queueTaskOnPrivateRunLoop):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::releaseExcessCapacity):
+        (JSC::JSStack::addToCommittedByteCount):
+        (JSC::JSStack::committedByteCount):
+        (JSC::stackStatisticsMutex): Deleted.
+        (JSC::JSStack::initializeThreading): Deleted.
+        * interpreter/JSStack.h:
+        (JSC::JSStack::gatherConservativeRoots):
+        (JSC::JSStack::sanitizeStack):
+        (JSC::JSStack::size):
+        (JSC::JSStack::initializeThreading): Deleted.
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::~DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators):
+        (JSC::DemandExecutableAllocator::bytesCommittedByAllocactors):
+        (JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators):
+        (JSC::DemandExecutableAllocator::allocators):
+        (JSC::DemandExecutableAllocator::allocatorsMutex):
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::ctiStub):
+        * jit/JITThunks.h:
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        (JSC::Profiler::Database::notifyDestruction):
+        * profiler/ProfilerDatabase.h:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/JSLock.cpp:
+        (JSC::GlobalJSLock::GlobalJSLock):
+        (JSC::GlobalJSLock::~GlobalJSLock):
+        (JSC::JSLockHolder::JSLockHolder):
+        (JSC::GlobalJSLock::initialize): Deleted.
+        * runtime/JSLock.h:
+
+2015-08-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        ES6 class syntax should allow computed name method
+        https://bugs.webkit.org/show_bug.cgi?id=142690
+
+        Reviewed by Saam Barati.
+
+        Added a new "attributes" attribute to op_put_getter_by_id, op_put_setter_by_id, op_put_getter_setter to specify
+        the property descriptor options so that we can use use op_put_setter_by_id and op_put_getter_setter to define
+        getters and setters for classes. Without this, getters and setters could erroneously override methods.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitPutGetterById):
+        (JSC::BytecodeGenerator::emitPutSetterById):
+        (JSC::BytecodeGenerator::emitPutGetterSetter):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode): Always use emitPutGetterSetter to emit getters and setters for classes
+        as done for object literals.
+        (JSC::PropertyListNode::emitPutConstantProperty):
+        (JSC::ClassExprNode::emitBytecode):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_getter_by_id):
+        (JSC::JIT::emit_op_put_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter_by_id):
+        (JSC::JIT::emit_op_put_setter_by_id):
+        (JSC::JIT::emit_op_put_getter_setter):
+        (JSC::JIT::emit_op_del_by_id):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::createPropertyList):
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode):
+        * parser/Nodes.h:
+        (JSC::PropertyNode::expressionName):
+        (JSC::PropertyNode::name):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass): Added the support for computed property name. We don't support computed names
+        for getters and setters.
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createProperty):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::allowsAccessFrom):
+        (JSC::JSObject::putGetter):
+        (JSC::JSObject::putSetter):
+        * runtime/JSObject.h:
+        * runtime/PropertyDescriptor.h:
+
+2015-08-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Add InspectorInstrumentation builtin object to instrument the code in JS builtins like Promises
+        https://bugs.webkit.org/show_bug.cgi?id=147942
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds new private global object, @InspectorInstrumentation.
+        It is intended to be used as the namespace object (like Reflect/Math) for Inspector's
+        instrumentation system and it is used to instrument the builtin JS code, like Promises.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/InspectorInstrumentationObject.js: Added.
+        (debug):
+        (promiseFulfilled):
+        (promiseRejected):
+        * builtins/Operations.Promise.js:
+        (rejectPromise):
+        (fulfillPromise):
+        * runtime/CommonIdentifiers.h:
+        * runtime/InspectorInstrumentationObject.cpp: Added.
+        (JSC::InspectorInstrumentationObject::InspectorInstrumentationObject):
+        (JSC::InspectorInstrumentationObject::finishCreation):
+        (JSC::InspectorInstrumentationObject::getOwnPropertySlot):
+        (JSC::InspectorInstrumentationObject::isEnabled):
+        (JSC::InspectorInstrumentationObject::enable):
+        (JSC::InspectorInstrumentationObject::disable):
+        (JSC::inspectorInstrumentationObjectDataLogImpl):
+        * runtime/InspectorInstrumentationObject.h: Added.
+        (JSC::InspectorInstrumentationObject::create):
+        (JSC::InspectorInstrumentationObject::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
+2015-08-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r188444.
+        https://bugs.webkit.org/show_bug.cgi?id=148029
+
+        Broke GTK and EFL (see bug #148027) (Requested by philn on
+        #webkit).
+
+        Reverted changeset:
+
+        "Use WTF::Lock and WTF::Condition instead of WTF::Mutex,
+        WTF::ThreadCondition, std::mutex, and std::condition_variable"
+        https://bugs.webkit.org/show_bug.cgi?id=147999
+        http://trac.webkit.org/changeset/188444
+
+2015-08-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Use WTF::Lock and WTF::Condition instead of WTF::Mutex, WTF::ThreadCondition, std::mutex, and std::condition_variable
+        https://bugs.webkit.org/show_bug.cgi?id=147999
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSVirtualMachine.mm:
+        (initWrapperCache):
+        (+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]):
+        (+[JSVMWrapperCache wrapperForJSContextGroupRef:]):
+        (wrapperCacheMutex): Deleted.
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        * dfg/DFGThreadData.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::~Worklist):
+        (JSC::DFG::Worklist::isActiveForVM):
+        (JSC::DFG::Worklist::enqueue):
+        (JSC::DFG::Worklist::compilationState):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::Worklist::removeDeadPlans):
+        (JSC::DFG::Worklist::queueLength):
+        (JSC::DFG::Worklist::dump):
+        (JSC::DFG::Worklist::runThread):
+        * dfg/DFGWorklist.h:
+        * disassembler/Disassembler.cpp:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        * heap/CopiedSpace.h:
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::recycleBorrowedBlock):
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        * heap/GCThread.cpp:
+        (JSC::GCThread::waitForNextPhase):
+        (JSC::GCThread::gcThreadMain):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::~GCThreadSharedData):
+        (JSC::GCThreadSharedData::startNextPhase):
+        (JSC::GCThreadSharedData::endCurrentPhase):
+        (JSC::GCThreadSharedData::didStartMarking):
+        (JSC::GCThreadSharedData::didFinishMarking):
+        * heap/GCThreadSharedData.h:
+        * heap/HeapTimer.h:
+        * heap/MachineStackMarker.cpp:
+        (JSC::ActiveMachineThreadsManager::Locker::Locker):
+        (JSC::ActiveMachineThreadsManager::add):
+        (JSC::ActiveMachineThreadsManager::remove):
+        (JSC::ActiveMachineThreadsManager::ActiveMachineThreadsManager):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThreadIfFound):
+        (JSC::MachineThreads::tryCopyOtherThreadStack):
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * heap/MachineStackMarker.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        (JSC::SlotVisitor::mergeOpaqueRoots):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::containsOpaqueRootTriState):
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorHandleRunSourceGlobal):
+        (Inspector::RemoteInspectorQueueTaskOnGlobalQueue):
+        (Inspector::RemoteInspectorInitializeGlobalQueue):
+        (Inspector::RemoteInspectorHandleRunSourceWithInfo):
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        (Inspector::RemoteInspectorDebuggableConnection::closeFromDebuggable):
+        (Inspector::RemoteInspectorDebuggableConnection::close):
+        (Inspector::RemoteInspectorDebuggableConnection::sendMessageToBackend):
+        (Inspector::RemoteInspectorDebuggableConnection::queueTaskOnPrivateRunLoop):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::releaseExcessCapacity):
+        (JSC::JSStack::addToCommittedByteCount):
+        (JSC::JSStack::committedByteCount):
+        (JSC::stackStatisticsMutex): Deleted.
+        (JSC::JSStack::initializeThreading): Deleted.
+        * interpreter/JSStack.h:
+        (JSC::JSStack::gatherConservativeRoots):
+        (JSC::JSStack::sanitizeStack):
+        (JSC::JSStack::size):
+        (JSC::JSStack::initializeThreading): Deleted.
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::~DemandExecutableAllocator):
+        (JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators):
+        (JSC::DemandExecutableAllocator::bytesCommittedByAllocactors):
+        (JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators):
+        (JSC::DemandExecutableAllocator::allocators):
+        (JSC::DemandExecutableAllocator::allocatorsMutex):
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::ctiStub):
+        * jit/JITThunks.h:
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        (JSC::Profiler::Database::notifyDestruction):
+        * profiler/ProfilerDatabase.h:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/JSLock.cpp:
+        (JSC::GlobalJSLock::GlobalJSLock):
+        (JSC::GlobalJSLock::~GlobalJSLock):
+        (JSC::JSLockHolder::JSLockHolder):
+        (JSC::GlobalJSLock::initialize): Deleted.
+        * runtime/JSLock.h:
+
+2015-08-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r188428.
+        https://bugs.webkit.org/show_bug.cgi?id=148015
+
+        broke cmake build (Requested by alexchristensen on #webkit).
+
+        Reverted changeset:
+
+        "Move some commands from ./CMakeLists.txt to Source/cmake"
+        https://bugs.webkit.org/show_bug.cgi?id=148003
+        http://trac.webkit.org/changeset/188428
+
+2015-08-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r188431.
+        https://bugs.webkit.org/show_bug.cgi?id=148013
+
+        JSC headers are too hard to understand (Requested by smfr on
+        #webkit).
+
+        Reverted changeset:
+
+        "Remove a few includes from JSGlobalObject.h"
+        https://bugs.webkit.org/show_bug.cgi?id=148004
+        http://trac.webkit.org/changeset/188431
+
+2015-08-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add support for GetByVal on arrays of Undecided shape
+        https://bugs.webkit.org/show_bug.cgi?id=147814
+
+        Reviewed by Filip Pizlo.
+
+        Previously, GetByVal on Array::Undecided would just take
+        the generic path. The problem is the generic path is so
+        slow that it could take a significant amount of time
+        even for unfrequent accesses.
+
+        With this patch, if the following conditions are met,
+        the GetByVal just returns a "undefined" constant:
+        -The object is an OriginalArray.
+        -The prototype chain is sane.
+        -The index is an integer.
+        -The integer is positive (runtime check).
+
+        Ideally, the 4th conditions should be removed
+        deducing a compile-time constant gives us so much better
+        opportunities at getting rid of this code.
+
+        There are two cases where this patch removes the runtime
+        check:
+        -If the index is constant (uncommon but easy)
+        -If the index is within a range known to be positive.
+         (common case and made possible with DFGIntegerRangeOptimizationPhase).
+
+        When we get into those cases, DFG just nukes everything
+        and all we have left is a structure check :)
+
+        This patch is a 14% improvement on audio-beat-detection,
+        a few percent faster here and there and no regression.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        If the index is a positive constant, we can get rid of the GetByVal
+        entirely. :)
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        The returned type is now Array::Undecided + profiling information.
+        The useful type is set in ArrayMode::refine().
+
+        (JSC::DFG::ArrayMode::refine):
+        If we meet the particular set conditions, we speculate an Undecided
+        array type with sane chain. Anything else comes back to Generic.
+
+        (JSC::DFG::ArrayMode::originalArrayStructure):
+        To enable the structure check for Undecided array.
+
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::withProfile):
+        (JSC::DFG::ArrayMode::canCSEStorage):
+        (JSC::DFG::ArrayMode::benefitsFromOriginalArray):
+        (JSC::DFG::ArrayMode::lengthNeedsStorage): Deleted.
+        (JSC::DFG::ArrayMode::isSpecific): Deleted.A
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic): Deleted.
+        This is somewhat unrelated.
+
+        Having Array::Undecided on ArrayPush was impossible before
+        since ArrayMode::fromObserved() used to return Array::Generic.
+
+        Now that Array::Undecided is possible, we must make sure not
+        to provide it to ArrayPush since there is no code to handle it
+        properly.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        The operation only depends on the index, it is pure.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Deleted.
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetByVal):
+        * tests/stress/get-by-val-on-undecided-array-type.js: Added.
+        * tests/stress/get-by-val-on-undecided-sane-chain-1.js: Added.
+        * tests/stress/get-by-val-on-undecided-sane-chain-2.js: Added.
+        * tests/stress/get-by-val-on-undecided-sane-chain-3.js: Added.
+        * tests/stress/get-by-val-on-undecided-sane-chain-4.js: Added.
+        * tests/stress/get-by-val-on-undecided-sane-chain-5.js: Added.
+        * tests/stress/get-by-val-on-undecided-sane-chain-6.js: Added.
+
+2015-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Remove a few includes from JSGlobalObject.h
+        https://bugs.webkit.org/show_bug.cgi?id=148004
+
+        Reviewed by Tim Horton.
+        
+        Remove 4 #includes from JSGlobalObject.h, and fix the fallout.
+
+        * parser/VariableEnvironment.cpp:
+        * parser/VariableEnvironment.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+
+2015-08-13  Alex Christensen  <achristensen@webkit.org>
+
+        Move some commands from ./CMakeLists.txt to Source/cmake
+        https://bugs.webkit.org/show_bug.cgi?id=148003
+
+        Reviewed by Brent Fulgham.
+
+        * CMakeLists.txt:
+        Added commands needed to build JSC by itself.
+
+2015-08-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unify JSParserCodeType, FunctionParseMode and ModuleParseMode into SourceParseMode
+        https://bugs.webkit.org/show_bug.cgi?id=147353
+
+        Reviewed by Saam Barati.
+
+        This is the follow-up patch after r188355.
+        It includes the following changes.
+
+        - Unify JSParserCodeType, FunctionParseMode and ModuleParseMode into SourceParseMode
+        - Make SourceParseMode to C++ strongly-typed enum.
+        - Fix the comments.
+        - Rename ModuleSpecifier to ModuleName.
+        - Add the type name `ImportEntry` before the C++11 uniform initialization.
+        - Fix the thrown message for duplicate 'default' names.
+        - Assert the all statements in the top-level source elements are the module declarations under the module analyzer phase.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateFunctionCodeBlock):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionMetadata):
+        (JSC::ASTBuilder::createModuleName):
+        (JSC::ASTBuilder::createImportDeclaration):
+        (JSC::ASTBuilder::createExportAllDeclaration):
+        (JSC::ASTBuilder::createExportNamedDeclaration):
+        (JSC::ASTBuilder::createModuleSpecifier): Deleted.
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::analyze):
+        * parser/NodeConstructors.h:
+        (JSC::ModuleNameNode::ModuleNameNode):
+        (JSC::ImportDeclarationNode::ImportDeclarationNode):
+        (JSC::ExportAllDeclarationNode::ExportAllDeclarationNode):
+        (JSC::ExportNamedDeclarationNode::ExportNamedDeclarationNode):
+        (JSC::ModuleSpecifierNode::ModuleSpecifierNode): Deleted.
+        * parser/Nodes.cpp:
+        (JSC::FunctionMetadataNode::FunctionMetadataNode):
+        * parser/Nodes.h:
+        (JSC::StatementNode::isModuleDeclarationNode):
+        (JSC::ModuleDeclarationNode::isModuleDeclarationNode):
+        (JSC::ImportDeclarationNode::moduleName):
+        (JSC::ExportAllDeclarationNode::moduleName):
+        (JSC::ExportNamedDeclarationNode::moduleName):
+        (JSC::ImportDeclarationNode::moduleSpecifier): Deleted.
+        (JSC::ExportAllDeclarationNode::moduleSpecifier): Deleted.
+        (JSC::ExportNamedDeclarationNode::moduleSpecifier): Deleted.
+        * parser/NodesAnalyzeModule.cpp:
+        (JSC::SourceElements::analyzeModule):
+        (JSC::ImportDeclarationNode::analyzeModule):
+        (JSC::ExportAllDeclarationNode::analyzeModule):
+        (JSC::ExportNamedDeclarationNode::analyzeModule):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseModuleSourceElements):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseModuleName):
+        (JSC::Parser<LexerType>::parseImportDeclaration):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseArrowFunctionExpression):
+        (JSC::Parser<LexerType>::parseModuleSpecifier): Deleted.
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        (JSC::parse):
+        * parser/ParserModes.h:
+        (JSC::isFunctionParseMode):
+        (JSC::isModuleParseMode):
+        (JSC::isProgramParseMode):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        (JSC::SyntaxChecker::createModuleName):
+        (JSC::SyntaxChecker::createImportDeclaration):
+        (JSC::SyntaxChecker::createExportAllDeclaration):
+        (JSC::SyntaxChecker::createExportNamedDeclaration):
+        (JSC::SyntaxChecker::createModuleSpecifier): Deleted.
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::checkModuleSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * tests/stress/modules-syntax-error-with-names.js:
+
+2015-08-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: A {Map, WeakMap, Set, WeakSet} object contains itself will hang the console
+        https://bugs.webkit.org/show_bug.cgi?id=147966
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._initialPreview):
+        Renamed to initial preview. This is not a complete preview for
+        this object, and it needs some processing in order to be a
+        complete accurate preview.
+
+        (InjectedScript.RemoteObject.prototype._emptyPreview):
+        This attempts to be an accurate empty preview for the given object.
+        For types with entries, it adds an empty entries list and updates
+        the overflow and lossless properties.
+
+        (InjectedScript.RemoteObject.prototype._createObjectPreviewForValue):
+        Take a generatePreview parameter to generate a full preview or empty preview.
+
+        (InjectedScript.RemoteObject.prototype._appendPropertyPreviews):
+        (InjectedScript.RemoteObject.prototype._appendEntryPreviews):
+        (InjectedScript.RemoteObject.prototype._isPreviewableObject):
+        Take care to avoid cycles.
+
+2015-08-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Periodic code deletion should delete RegExp code
+        https://bugs.webkit.org/show_bug.cgi?id=147990
+
+        Reviewed by Filip Pizlo.
+
+        The RegExp code cache was created for the sake of simple loops that
+        re-created the same RegExps. It's reasonable to delete it periodically.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteOldCode):
+
+2015-08-13  Geoffrey Garen  <ggaren@apple.com>
+
+        RegExpCache::finalize should not delete code
+        https://bugs.webkit.org/show_bug.cgi?id=147987
+
+        Reviewed by Mark Lam.
+
+        The RegExp object already knows how to delete its own code in its
+        destructor. Our job is just to clear our stale pointer.
+
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::finalize):
+        (JSC::RegExpCache::addToStrongCache):
+
+2015-08-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Standardize on the phrase "delete code"
+        https://bugs.webkit.org/show_bug.cgi?id=147984
+
+        Reviewed by Mark Lam.
+
+        Use "delete" when we talk about throwing away code, as opposed to
+        "invalidate" or "discard".
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::forEachCodeBlock):
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::recompileAllJSFunctions):
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::recompileAllJSFunctionsForTypeProfiling):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        (JSC::RegExp::deleteCode):
+        (JSC::RegExp::invalidateCode): Deleted.
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::finalize):
+        (JSC::RegExpCache::addToStrongCache):
+        (JSC::RegExpCache::deleteAllCode):
+        (JSC::RegExpCache::invalidateCode): Deleted.
+        * runtime/RegExpCache.h:
+        * runtime/VM.cpp:
+        (JSC::VM::stopSampling):
+        (JSC::VM::prepareToDeleteCode):
+        (JSC::VM::deleteAllCode):
+        (JSC::VM::setEnabledProfiler):
+        (JSC::VM::prepareToDiscardCode): Deleted.
+        (JSC::VM::discardAllCode): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::apiLock):
+        (JSC::VM::codeCache):
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::setTimeLimit):
+
+2015-08-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        X.[[SetPrototypeOf]](Y) should succeed if X.[[Prototype]] is already Y even if X is not extensible
+        https://bugs.webkit.org/show_bug.cgi?id=147930
+
+        Reviewed by Saam Barati.
+
+        When the passed prototype object to be set is the same to the existing
+        prototype object, [[SetPrototypeOf]] just finishes its operation even
+        if the extensibility of the target object is `false`.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectSetPrototypeOf):
+        * tests/stress/set-same-prototype.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-08-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed clearEvalCodeCache()
+        https://bugs.webkit.org/show_bug.cgi?id=147957
+
+        Reviewed by Filip Pizlo.
+
+        It was unused.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::linkIncomingCall):
+        (JSC::CodeBlock::install):
+        (JSC::CodeBlock::clearEvalCache): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfJumpTargets):
+        (JSC::CodeBlock::jumpTarget):
+        (JSC::CodeBlock::numberOfArgumentValueProfiles):
+
+2015-08-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.defineProperty
+        https://bugs.webkit.org/show_bug.cgi?id=147943
+
+        Reviewed by Saam Barati.
+
+        This patch implements Reflect.defineProperty.
+        The difference from the Object.defineProperty is,
+
+        1. Reflect.defineProperty does not perform ToObject operation onto the first argument.
+        2. Reflect.defineProperty does not throw a TypeError when the [[DefineOwnProperty]] operation fails.
+        3. Reflect.defineProperty returns the boolean value that represents whether [[DefineOwnProperty]] succeeded.
+
+        And this patch comments the links to the ES6 spec.
+
+        * builtins/ReflectObject.js:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectDefineProperty):
+        * tests/stress/reflect-define-property.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (.set getter):
+        (setter):
+        (.get testDescriptor):
+        (.set get var):
+        (.set testDescriptor):
+        (.set get testDescriptor):
+        (.set get shouldThrow):
+        (.get var):
+
+2015-08-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ByteCodeParser should attempt constant folding on loads from structures that are DFG-watchable
+        https://bugs.webkit.org/show_bug.cgi?id=147950
+
+        Reviewed by Michael Saboff.
+
+        Previously we reduced the constant folding power of ByteCodeParser::load() because that code was
+        responsible for memory corruption, since it would sometimes install watchpoints on structures that
+        weren't being traced.  It seemed like the safest fix was to remove the constant folding rule
+        entirely since later phases also do constant folding, and they do it without introducing the bug.
+        Well, that change (http://trac.webkit.org/changeset/188292) caused a big regression, because we
+        still have some constant folding rules that only exist in ByteCodeParser, and so ByteCodeParser must
+        be maximally aggressive in constant-folding whenever possible.
+
+        So, this change now brings back that constant folding rule - for loads from object constants that
+        have DFG-watchable structures - and implements it properly, by ensuring that we only call into
+        tryGetConstantProperty() if we have registered the structure set.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::load):
+
+2015-08-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Add ES6 Modules preparsing phase to collect the dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=147353
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements ModuleRecord and ModuleAnalyzer.
+        ModuleAnalyzer analyzes the produced AST from the parser.
+        By collaborating with the parser, ModuleAnalyzer collects the information
+        that is necessary to request the loading for the dependent modules and
+        construct module's environment and namespace object before executing the actual
+        module body.
+
+        In the parser, we annotate which variable is imported binding and which variable
+        is exported from the current module. This information is leveraged in the ModuleAnalyzer
+        to categorize the export entries.
+
+        To preparse the modules in the parser, we just add the new flag `ModuleParseMode`
+        instead of introducing a new TreeContext type. This is because only 2 users use the
+        parseModuleSourceElements; preparser and actual compiler. Adding the flag is simple
+        enough to switch the context to the SyntaxChecker when parsing the non-module related
+        statement in the preparsing phase.
+
+        To demonstrate the module analyzer, we added the new option dumpModuleRecord option
+        into the JSC shell. By specifying this, the result of analysis is dumped when the module
+        is parsed and analyzed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinNames.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createExportDefaultDeclaration):
+        * parser/ModuleAnalyzer.cpp: Added.
+        (JSC::ModuleAnalyzer::ModuleAnalyzer):
+        (JSC::ModuleAnalyzer::exportedBinding):
+        (JSC::ModuleAnalyzer::declareExportAlias):
+        (JSC::ModuleAnalyzer::exportVariable):
+        (JSC::ModuleAnalyzer::analyze):
+        * parser/ModuleAnalyzer.h: Added.
+        (JSC::ModuleAnalyzer::vm):
+        (JSC::ModuleAnalyzer::moduleRecord):
+        * parser/ModuleRecord.cpp: Added.
+        (JSC::printableName):
+        (JSC::ModuleRecord::dump):
+        * parser/ModuleRecord.h: Added.
+        (JSC::ModuleRecord::ImportEntry::isNamespace):
+        (JSC::ModuleRecord::create):
+        (JSC::ModuleRecord::appendRequestedModule):
+        (JSC::ModuleRecord::addImportEntry):
+        (JSC::ModuleRecord::addExportEntry):
+        (JSC::ModuleRecord::addStarExportEntry):
+        * parser/NodeConstructors.h:
+        (JSC::ModuleDeclarationNode::ModuleDeclarationNode):
+        (JSC::ImportDeclarationNode::ImportDeclarationNode):
+        (JSC::ExportAllDeclarationNode::ExportAllDeclarationNode):
+        (JSC::ExportDefaultDeclarationNode::ExportDefaultDeclarationNode):
+        (JSC::ExportLocalDeclarationNode::ExportLocalDeclarationNode):
+        (JSC::ExportNamedDeclarationNode::ExportNamedDeclarationNode):
+        * parser/Nodes.h:
+        (JSC::ExportDefaultDeclarationNode::localName):
+        * parser/NodesAnalyzeModule.cpp: Added.
+        (JSC::ScopeNode::analyzeModule):
+        (JSC::SourceElements::analyzeModule):
+        (JSC::ImportDeclarationNode::analyzeModule):
+        (JSC::ExportAllDeclarationNode::analyzeModule):
+        (JSC::ExportDefaultDeclarationNode::analyzeModule):
+        (JSC::ExportLocalDeclarationNode::analyzeModule):
+        (JSC::ExportNamedDeclarationNode::analyzeModule):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseModuleSourceElements):
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClassDeclaration):
+        (JSC::Parser<LexerType>::parseImportClauseItem):
+        (JSC::Parser<LexerType>::parseExportSpecifier):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        * parser/Parser.h:
+        (JSC::Scope::lexicalVariables):
+        (JSC::Scope::declareLexicalVariable):
+        (JSC::Parser::declareVariable):
+        (JSC::Parser::exportName):
+        (JSC::Parser<LexerType>::parse):
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createExportDefaultDeclaration):
+        * parser/VariableEnvironment.cpp:
+        (JSC::VariableEnvironment::markVariableAsImported):
+        (JSC::VariableEnvironment::markVariableAsExported):
+        * parser/VariableEnvironment.h:
+        (JSC::VariableEnvironmentEntry::isExported):
+        (JSC::VariableEnvironmentEntry::isImported):
+        (JSC::VariableEnvironmentEntry::setIsExported):
+        (JSC::VariableEnvironmentEntry::setIsImported):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkModuleSyntax):
+        * runtime/Options.h:
+
+2015-08-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Re-land r188339, since Alex fixed it in r188341 by landing the WebCore half.
+
+        * jit/ExecutableAllocator.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionAddressOf):
+        (functionVersion):
+        (functionReleaseExecutableMemory): Deleted.
+        * runtime/VM.cpp:
+        (JSC::StackPreservingRecompiler::operator()):
+        (JSC::VM::throwException):
+        (JSC::VM::updateFTLLargestStackSize):
+        (JSC::VM::gatherConservativeRoots):
+        (JSC::VM::releaseExecutableMemory): Deleted.
+        (JSC::releaseExecutableMemory): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::isCollectorBusy):
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::setTimeLimit):
+
+2015-08-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Roll out r188339, which broke the build.
+
+        Unreviewed.
+
+        * jit/ExecutableAllocator.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionReleaseExecutableMemory):
+        * runtime/VM.cpp:
+        (JSC::StackPreservingRecompiler::visit):
+        (JSC::StackPreservingRecompiler::operator()):
+        (JSC::VM::releaseExecutableMemory):
+        (JSC::releaseExecutableMemory):
+        * runtime/VM.h:
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::setTimeLimit):
+
+2015-08-12  Alex Christensen  <achristensen@webkit.org>
+
+        Fix Debug CMake builds on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=147940
+
+        Reviewed by Chris Dumez.
+
+        * PlatformWin.cmake:
+        Copy the plist to the JavaScriptCore.resources directory.
+
+2015-08-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Remove VM::releaseExecutableMemory
+        https://bugs.webkit.org/show_bug.cgi?id=147915
+
+        Reviewed by Saam Barati.
+
+        releaseExecutableMemory() was only used in one place, where discardAllCode()
+        would work just as well.
+
+        It's confusing to have two slightly different ways to discard code. Also,
+        releaseExecutableMemory() is unused in any production code, and it seems
+        to have bit-rotted.
+
+        * jit/ExecutableAllocator.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionAddressOf):
+        (functionVersion):
+        (functionReleaseExecutableMemory): Deleted.
+        * runtime/VM.cpp:
+        (JSC::StackPreservingRecompiler::operator()):
+        (JSC::VM::throwException):
+        (JSC::VM::updateFTLLargestStackSize):
+        (JSC::VM::gatherConservativeRoots):
+        (JSC::VM::releaseExecutableMemory): Deleted.
+        (JSC::releaseExecutableMemory): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::isCollectorBusy):
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::setTimeLimit):
+
+2015-08-12  Mark Lam  <mark.lam@apple.com>
+
+        Add a JSC option to enable the watchdog for testing.
+        https://bugs.webkit.org/show_bug.cgi?id=147939
+
+        Reviewed by Michael Saboff.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupSetExecutionTimeLimit):
+        (createWatchdogIfNeeded): Deleted.
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        (JSC::VM::sharedInstanceInternal):
+        (JSC::VM::ensureWatchdog):
+        (JSC::thunkGeneratorForIntrinsic):
+        * runtime/VM.h:
+
+2015-08-11  Mark Lam  <mark.lam@apple.com>
+
+        Implementation JavaScript watchdog using WTF::WorkQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=147107
+
+        Reviewed by Geoffrey Garen.
+
+        How the Watchdog works?
+        ======================
+
+        1. When do we start the Watchdog?
+           =============================
+           The watchdog should only be started if both the following conditions are true:
+           1. A time limit has been set.
+           2. We have entered the VM.
+ 
+        2. CPU time vs Wall Clock time
+           ===========================
+           Why do we need 2 time deadlines: m_cpuDeadline and m_wallClockDeadline?
+
+           The watchdog uses WorkQueue dispatchAfter() to queue a timer to measure the watchdog time
+           limit. WorkQueue timers measure time in monotonic wall clock time. m_wallClockDeadline
+           indicates the wall clock time point when the WorkQueue timer is expected to fire.
+
+           The time limit for which we allow JS code to run should be measured in CPU time, which can
+           differ from wall clock time.  m_cpuDeadline indicates the CPU time point when the watchdog
+           should fire.
+
+           Note: the timer firing is not the same thing as the watchdog firing.  When the timer fires,
+           we need to check if m_cpuDeadline has been reached.
+
+           If m_cpuDeadline has been reached, the watchdog is considered to have fired.
+
+           If not, then we have a remaining amount of CPU time, Tremainder, that we should allow JS
+           code to continue to run for.  Hence, we need to start a new timer to fire again after
+           Tremainder microseconds.
+    
+           See Watchdog::didFireSlow().
+
+        3. Spurious wake ups
+           =================
+           Because the WorkQueue timer cannot be cancelled, the watchdog needs to ignore stale timers.
+           It does this by checking the m_wallClockDeadline.  A wakeup that occurs right after
+           m_wallClockDeadline expires is considered to be the wakeup for the active timer.  All other
+           wake ups are considered to be spurious and will be ignored.
+ 
+           See Watchdog::didFireSlow().
+ 
+        4. Minimizing Timer creation cost
+           ==============================
+           Conceptually, we could start a new timer every time we start the watchdog. But we can do better
+           than this.
+ 
+           In practice, the time limit of a watchdog tends to be long, and the amount of time a watchdog
+           stays active tends to be short for well-behaved JS code. The user also tends to re-use the same
+           time limit. Consider the following example:
+ 
+               |---|-----|---|----------------|---------|
+               t0  t1    t2  t3            t0 + L    t2 + L 
+
+               |<--- T1 --------------------->|
+                         |<--- T2 --------------------->|
+               |<-- Td ->|                    |<-- Td ->|
+
+           1. The user initializes the watchdog with time limit L.
+           2. At t0, we enter the VM to execute JS code, and starts the watchdog timer, T1.
+              The timer is set to expire at t0 + L.
+           3. At t1, we exit the VM.
+           4. At t2, we enter the VM again, and would like to start a new watchdog timer, T2.
+         
+              However, we can note that the expiration time for T2 would be after the expiration time
+              of T1. Specifically, T2 would have expired at Td after T1 expires.
+         
+              Hence, we can just wait for T1 to expire, and then start a new timer T2' at time t0 + L
+              for a period or Td instead.
+
+           Note that didFireSlow() already compensates for time differences between wall clock and CPU time,
+           as well as handle spurious wake ups (see note 2 and 3 above).  As a result, didFireSlow() will
+           automatically take care of starting a new timer for the difference Td in the example above.
+           Instead of starting the new timer T2 and time t2, we just verify that if the active timer, T1's
+           expiration is less than T2s, then we are already covered by T1 and there's no need to start T2.
+
+           The benefit:
+
+           1. we minimize the number of timer instances we have queued in the workqueue at the same time
+              (ideally only 1 or 0), and use less peak memory usage.
+
+           2. we minimize the frequency of instantiating timer instances. By waiting for the current
+              active timer to expire first, on average, we get to start one timer per time limit
+              (which is infrequent because time limits tend to be long) instead of one timer per
+              VM entry (which tends to be frequent).
+
+           See Watchdog::startTimer().
+
+        * API/JSContextRef.cpp:
+        (createWatchdogIfNeeded):
+        (JSContextGroupClearExecutionTimeLimit):
+        - No need to create the watchdog (if not already created) just to clear it.
+          If the watchdog is not created yet, then it is effectively cleared.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (currentCPUTimeAsJSFunctionCallback):
+        (testExecutionTimeLimit):
+        (currentCPUTime): Deleted.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
+        - Enable watchdog tests for all platforms.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        - Remove now unneeded WatchdogMac.cpp and WatchdogNone.cpp.
+
+        * PlatformEfl.cmake:
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_hint):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOperations.cpp:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * runtime/VM.cpp:
+        - #include Watchdog.h in these files directly instead of doing it via VM.h.
+          These saves us from having to recompile the world when we change Watchdog.h.
+
+        * runtime/VM.h:
+        - See comment in Watchdog::startTimer() below for why the Watchdog needs to be
+          thread-safe ref counted.
+
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::~VMEntryScope):
+        - We have done away with the WatchdogScope and arming/disarming of the watchdog.
+          Instead, the VMEntryScope will inform the watchdog of when we have entered and
+          exited the VM.
+
+        * runtime/Watchdog.cpp:
+        (JSC::currentWallClockTime):
+        (JSC::Watchdog::Watchdog):
+        (JSC::Watchdog::hasStartedTimer):
+        (JSC::Watchdog::setTimeLimit):
+        (JSC::Watchdog::didFireSlow):
+        (JSC::Watchdog::hasTimeLimit):
+        (JSC::Watchdog::fire):
+        (JSC::Watchdog::enteredVM):
+        (JSC::Watchdog::exitedVM):
+
+        (JSC::Watchdog::startTimer):
+        - The Watchdog is now thread-safe ref counted because the WorkQueue may access it
+          (from a different thread) even after the VM shuts down.  We need to keep it
+          alive until the WorkQueue callback completes.
+
+          In Watchdog::startTimer(), we'll ref the Watchdog to keep it alive for each
+          WorkQueue callback we dispatch.  The callback will deref the Watchdog after it
+          is done with it.  This ensures that the Watchdog is kept alive until all
+          WorkQueue callbacks are done.
+
+        (JSC::Watchdog::stopTimer):
+        (JSC::Watchdog::~Watchdog): Deleted.
+        (JSC::Watchdog::didFire): Deleted.
+        (JSC::Watchdog::isEnabled): Deleted.
+        (JSC::Watchdog::arm): Deleted.
+        (JSC::Watchdog::disarm): Deleted.
+        (JSC::Watchdog::startCountdownIfNeeded): Deleted.
+        (JSC::Watchdog::startCountdown): Deleted.
+        (JSC::Watchdog::stopCountdown): Deleted.
+        * runtime/Watchdog.h:
+        (JSC::Watchdog::didFire):
+        (JSC::Watchdog::timerDidFireAddress):
+        (JSC::Watchdog::isArmed): Deleted.
+        (JSC::Watchdog::Scope::Scope): Deleted.
+        (JSC::Watchdog::Scope::~Scope): Deleted.
+        * runtime/WatchdogMac.cpp:
+        (JSC::Watchdog::initTimer): Deleted.
+        (JSC::Watchdog::destroyTimer): Deleted.
+        (JSC::Watchdog::startTimer): Deleted.
+        (JSC::Watchdog::stopTimer): Deleted.
+        * runtime/WatchdogNone.cpp:
+        (JSC::Watchdog::initTimer): Deleted.
+        (JSC::Watchdog::destroyTimer): Deleted.
+        (JSC::Watchdog::startTimer): Deleted.
+        (JSC::Watchdog::stopTimer): Deleted.
+
+2015-08-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Always use a byte-sized lock implementation
+        https://bugs.webkit.org/show_bug.cgi?id=147908
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/ConcurrentJITLock.h: Lock is now byte-sized and ByteLock is gone, so use Lock.
+
+2015-08-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Make ASan build not depend on asan.xcconfig
+        https://bugs.webkit.org/show_bug.cgi?id=147840
+        rdar://problem/21093702
+
+        Reviewed by Daniel Bates.
+
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::OSREntryData::dump):
+        (JSC::DFG::prepareOSREntry):
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::genericAddSpan):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::removeThreadIfFound):
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::Thread::captureStack):
+        (JSC::copyMemory):
+        * interpreter/Register.h:
+        (JSC::Register::operator=):
+        (JSC::Register::asanUnsafeJSValue):
+        (JSC::Register::jsValue):
+
+2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce get_by_id like IC into get_by_val when the given name is String or Symbol
+        https://bugs.webkit.org/show_bug.cgi?id=147480
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds get_by_id IC to get_by_val operation by caching the string / symbol id.
+        The IC site only caches one id. After checking that the given id is the same to the
+        cached one, we perform the get_by_id IC onto it.
+        And by collecting IC StructureStubInfo information, we pass it to the DFG and DFG
+        compiles get_by_val op code into CheckIdent (with edge type check) and GetById related
+        operations when the given get_by_val leverages the property load with the cached id.
+
+        To ensure the incoming value is the expected id, in DFG layer, we use SymbolUse and
+        StringIdentUse to enforce the type. To use it, this patch implements SymbolUse.
+        This can be leveraged to optimize symbol operations in DFG.
+
+        And since byValInfo is frequently used, we align the byValInfo design to the stubInfo like one.
+        Allocated by the Bag and operations take the raw byValInfo pointer directly instead of performing
+        binary search onto m_byValInfos. And by storing ArrayProfile* under the ByValInfo, we replaced the
+        argument ArrayProfile* in the operations with ByValInfo*.
+
+        * bytecode/ByValInfo.h:
+        (JSC::ByValInfo::ByValInfo):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::getByValInfoMap):
+        (JSC::CodeBlock::addByValInfo):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getByValInfo): Deleted.
+        (JSC::CodeBlock::setNumberOfByValInfos): Deleted.
+        (JSC::CodeBlock::numberOfByValInfos): Deleted.
+        (JSC::CodeBlock::byValInfo): Deleted.
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/GetByIdStatus.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasUidOperand):
+        (JSC::DFG::Node::uidOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCheckIdent):
+        (JSC::DFG::SpeculativeJIT::speculateSymbol):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::ByValCompilationInfo::ByValCompilationInfo):
+        (JSC::JIT::compileGetByValWithCachedId):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_has_indexed_property):
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_has_indexed_property):
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompileGetByValWithCachedId):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * runtime/Symbol.h:
+        * tests/stress/get-by-val-with-string-constructor.js: Added.
+        (Hello):
+        (get Hello.prototype.generate):
+        (ok):
+        * tests/stress/get-by-val-with-string-exit.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getStr1):
+        (getStr2):
+        * tests/stress/get-by-val-with-string-generated.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getStr1):
+        (getStr2):
+        * tests/stress/get-by-val-with-string-getter.js: Added.
+        (object.get hello):
+        (ok):
+        * tests/stress/get-by-val-with-string.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getStr1):
+        (getStr2):
+        * tests/stress/get-by-val-with-symbol-constructor.js: Added.
+        (Hello):
+        (get Hello.prototype.generate):
+        (ok):
+        * tests/stress/get-by-val-with-symbol-exit.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getSym1):
+        (getSym2):
+        * tests/stress/get-by-val-with-symbol-getter.js: Added.
+        (object.get hello):
+        (.get ok):
+        * tests/stress/get-by-val-with-symbol.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getSym1):
+        (getSym2):
+
+2015-08-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ByteCodeParser shouldn't call tryGetConstantProperty() with some StructureSet if it isn't checking that the base has a structure in that StructureSet
+        https://bugs.webkit.org/show_bug.cgi?id=147891
+        rdar://problem/22129447
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetByOffset): Get rid of this.
+        (JSC::DFG::ByteCodeParser::load): Don't call the version of handleGetByOffset() that assumes that we had CheckStructure'd some StructureSet, since we may not have CheckStructure'd anything.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::assertIsRegistered): Make this always assert even before the StructureRegistrationPhase.
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run): Add a FIXME that notes that we no longer believe that structures should be registered only at this phase. They should be registered before this phase and this phase should be removed.
+
+2015-08-11  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Switch Windows build to Visual Studio 2015
+        https://bugs.webkit.org/show_bug.cgi?id=147887
+        <rdar://problem/22235098>
+
+        Reviewed by Alex Christensen.
+
+        Update Visual Studio project file settings to use the current Visual
+        Studio and compiler. Continue targeting binaries to run on our minimum
+        supported configuration of Windows 7.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jscLauncher.vcxproj:
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncher.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapiLauncher.vcxproj:
+
+2015-08-10  Filip Pizlo  <fpizlo@apple.com>
+
+        WTF should have a ParkingLot for parking sleeping threads, so that locks can fit in 1.6 bits
+        https://bugs.webkit.org/show_bug.cgi?id=147665
+
+        Reviewed by Mark Lam.
+
+        Replace ByteSpinLock with ByteLock.
+
+        * runtime/ConcurrentJITLock.h:
+
+2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Numeric setter on prototype doesn't get called.
+        https://bugs.webkit.org/show_bug.cgi?id=144252
+
+        Reviewed by Darin Adler.
+
+        When switching the blank indexing type to the other one in putByIndex,
+        if the `structure(vm)->needsSlowPutIndexing()` is true, we need to switch
+        it to the slow put indexing type and reloop the putByIndex since there may
+        be some indexing accessor in the prototype chain. Previously, we just set
+        the value into the allocated vector.
+
+        In the putDirectIndex case, we just store the value to the vector.
+        This is because putDirectIndex is the operation to store the own property
+        and it does not check the accessors in the prototype chain.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        * tests/stress/injected-numeric-setter-on-prototype.js: Added.
+        (shouldBe):
+        (Trace):
+        (Trace.prototype.trace):
+        (Trace.prototype.get count):
+        (.):
+        * tests/stress/numeric-setter-on-prototype-non-blank-array.js: Added.
+        (shouldBe):
+        (Trace):
+        (Trace.prototype.trace):
+        (Trace.prototype.get count):
+        (.):
+        * tests/stress/numeric-setter-on-prototype.js: Added.
+        (shouldBe):
+        (Trace):
+        (Trace.prototype.trace):
+        (Trace.prototype.get count):
+        (.z.__proto__.set 3):
+        * tests/stress/numeric-setter-on-self.js: Added.
+        (shouldBe):
+        (Trace):
+        (Trace.prototype.trace):
+        (Trace.prototype.get count):
+        (.y.set 2):
+
+2015-08-11  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed gardening.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Add missing
+        file references so they appear in the proper IDE locations.
+
+2015-08-11  Brent Fulgham  <bfulgham@apple.com>
+
+        Unreviewed windows build fix for VS2015.
+
+        * bindings/ScriptValue.h: Add missing JSCJSValueInlines.h include.
+
+2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.has
+        https://bugs.webkit.org/show_bug.cgi?id=147875
+
+        Reviewed by Sam Weinig.
+
+        This patch implements Reflect.has[1].
+        Since the semantics is the same to the `in` operator in the JS[2],
+        we can implement it in builtin JS code.
+
+        [1]: http://www.ecma-international.org/ecma-262/6.0/#sec-reflect.has
+        [2]: http://www.ecma-international.org/ecma-262/6.0/#sec-relational-operators-runtime-semantics-evaluation
+
+        * builtins/ReflectObject.js:
+        (has):
+        * runtime/ReflectObject.cpp:
+        * tests/stress/reflect-has.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.getPrototypeOf and Reflect.setPrototypeOf
+        https://bugs.webkit.org/show_bug.cgi?id=147874
+
+        Reviewed by Darin Adler.
+
+        This patch implements ES6 Reflect.{getPrototypeOf, setPrototypeOf}.
+        The difference from the Object.* one is
+
+        1. They dont not perform ToObject onto the non-object arguments. They make it as a TypeError.
+        2. Reflect.setPrototyeOf returns false when the operation is failed. In Object.setPrototypeOf, it raises a TypeError.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::result):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+        (JSC::objectConstructorGetPrototypeOf):
+        * runtime/ObjectConstructor.h:
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectGetPrototypeOf):
+        (JSC::reflectObjectSetPrototypeOf):
+        * tests/stress/reflect-get-prototype-of.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (Base):
+        (Derived):
+        * tests/stress/reflect-set-prototype-of.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-08-11  Ting-Wei Lan  <lantw44@gmail.com>
+
+        Fix debug build when optimization is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=147816
+
+        Reviewed by Alexey Proskuryakov.
+
+        * llint/LLIntEntrypoint.cpp:
+        * runtime/FunctionExecutableDump.cpp:
+
+2015-08-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Ensure that Reflect.enumerate does not produce the deleted keys
+        https://bugs.webkit.org/show_bug.cgi?id=147677
+
+        Reviewed by Darin Adler.
+
+        Add tests for Reflect.enumerate that delete the property keys during the enumeration.
+
+        * tests/stress/reflect-enumerate.js:
+
+2015-08-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Start beating UnlinkedCodeBlock.h/.cpp with the "One Class per File" stick
+        https://bugs.webkit.org/show_bug.cgi?id=147856
+
+        Reviewed by Saam Barati.
+
+        Split out UnlinkedFunctionExecutable.h/.cpp and ExecutableInfo.h into separate files.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ExecutableInfo.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
+        (JSC::UnlinkedSimpleJumpTable::add): Deleted.
+        (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
+        (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
+        (JSC::UnlinkedCodeBlock::usesEval): Deleted.
+        (JSC::UnlinkedCodeBlock::needsFullScopeChain): Deleted.
+        (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setActivationRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addParameter): Deleted.
+        (JSC::UnlinkedCodeBlock::numParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
+        (JSC::UnlinkedCodeBlock::regexp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::vm): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
+        (JSC::UnlinkedCodeBlock::codeType): Deleted.
+        (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::activationRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::hasActivationRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
+        (JSC::UnlinkedCodeBlock::recordParse): Deleted.
+        (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
+        (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
+        (JSC::UnlinkedCodeBlock::firstLine): Deleted.
+        (JSC::UnlinkedCodeBlock::lineCount): Deleted.
+        (JSC::UnlinkedCodeBlock::startColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::endColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        (JSC::generateFunctionCodeBlock): Deleted.
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable): Deleted.
+        (JSC::UnlinkedFunctionExecutable::visitChildren): Deleted.
+        (JSC::UnlinkedFunctionExecutable::link): Deleted.
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode): Deleted.
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::ExecutableInfo::ExecutableInfo): Deleted.
+        (JSC::ExecutableInfo::needsActivation): Deleted.
+        (JSC::ExecutableInfo::usesEval): Deleted.
+        (JSC::ExecutableInfo::isStrictMode): Deleted.
+        (JSC::ExecutableInfo::isConstructor): Deleted.
+        (JSC::ExecutableInfo::isBuiltinFunction): Deleted.
+        (JSC::ExecutableInfo::constructorKind): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp.
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::getLineAndColumn): Deleted.
+        (JSC::dumpLineColumnEntry): Deleted.
+        (JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::visitChildren): Deleted.
+        (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock): Deleted.
+        (JSC::UnlinkedProgramCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedEvalCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionCodeBlock::destroy): Deleted.
+        (JSC::UnlinkedFunctionExecutable::destroy): Deleted.
+        (JSC::UnlinkedCodeBlock::setInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::instructions): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.h: Copied from Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h.
+        (JSC::ExecutableInfo::ExecutableInfo): Deleted.
+        (JSC::ExecutableInfo::needsActivation): Deleted.
+        (JSC::ExecutableInfo::usesEval): Deleted.
+        (JSC::ExecutableInfo::isStrictMode): Deleted.
+        (JSC::ExecutableInfo::isConstructor): Deleted.
+        (JSC::ExecutableInfo::isBuiltinFunction): Deleted.
+        (JSC::ExecutableInfo::constructorKind): Deleted.
+        (JSC::UnlinkedStringJumpTable::offsetForValue): Deleted.
+        (JSC::UnlinkedSimpleJumpTable::add): Deleted.
+        (JSC::UnlinkedInstruction::UnlinkedInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstructor): Deleted.
+        (JSC::UnlinkedCodeBlock::isStrictMode): Deleted.
+        (JSC::UnlinkedCodeBlock::usesEval): Deleted.
+        (JSC::UnlinkedCodeBlock::needsFullScopeChain): Deleted.
+        (JSC::UnlinkedCodeBlock::hasExpressionInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::setThisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setScopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setActivationRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::usesGlobalObject): Deleted.
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::globalObjectRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::setNumParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addParameter): Deleted.
+        (JSC::UnlinkedCodeBlock::numParameters): Deleted.
+        (JSC::UnlinkedCodeBlock::addRegExp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfRegExps): Deleted.
+        (JSC::UnlinkedCodeBlock::regexp): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfIdentifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifier): Deleted.
+        (JSC::UnlinkedCodeBlock::identifiers): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegisters): Deleted.
+        (JSC::UnlinkedCodeBlock::constantRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::isConstantRegisterIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfJumpTargets): Deleted.
+        (JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::jumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::lastJumpTarget): Deleted.
+        (JSC::UnlinkedCodeBlock::isBuiltinFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::constructorKind): Deleted.
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::switchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables): Deleted.
+        (JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::stringSwitchJumpTable): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::functionDecl): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionDecls): Deleted.
+        (JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::functionExpr): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfFunctionExprs): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers): Deleted.
+        (JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::exceptionHandler): Deleted.
+        (JSC::UnlinkedCodeBlock::vm): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addArrayAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addObjectAllocationProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addValueProfile): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfValueProfiles): Deleted.
+        (JSC::UnlinkedCodeBlock::addLLIntCallLinkInfo): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfLLintCallLinkInfos): Deleted.
+        (JSC::UnlinkedCodeBlock::codeType): Deleted.
+        (JSC::UnlinkedCodeBlock::thisRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::scopeRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::activationRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::hasActivationRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction): Deleted.
+        (JSC::UnlinkedCodeBlock::numberOfPropertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::propertyAccessInstructions): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBufferCount): Deleted.
+        (JSC::UnlinkedCodeBlock::addConstantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::constantBuffer): Deleted.
+        (JSC::UnlinkedCodeBlock::hasRareData): Deleted.
+        (JSC::UnlinkedCodeBlock::recordParse): Deleted.
+        (JSC::UnlinkedCodeBlock::codeFeatures): Deleted.
+        (JSC::UnlinkedCodeBlock::hasCapturedVariables): Deleted.
+        (JSC::UnlinkedCodeBlock::firstLine): Deleted.
+        (JSC::UnlinkedCodeBlock::lineCount): Deleted.
+        (JSC::UnlinkedCodeBlock::startColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::endColumn): Deleted.
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets): Deleted.
+        (JSC::UnlinkedCodeBlock::finishCreation): Deleted.
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary): Deleted.
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock): Deleted.
+        * runtime/Executable.h:
+
+2015-08-10  Mark Lam  <mark.lam@apple.com>
+
+        Refactor LiveObjectList and LiveObjectData into their own files.
+        https://bugs.webkit.org/show_bug.cgi?id=147843
+
+        Reviewed by Saam Barati.
+
+        There is no behavior change in this patch.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/HeapVerifier.cpp:
+        (JSC::HeapVerifier::HeapVerifier):
+        (JSC::LiveObjectList::findObject): Deleted.
+        * heap/HeapVerifier.h:
+        (JSC::LiveObjectData::LiveObjectData): Deleted.
+        (JSC::LiveObjectList::LiveObjectList): Deleted.
+        (JSC::LiveObjectList::reset): Deleted.
+        * heap/LiveObjectData.h: Added.
+        (JSC::LiveObjectData::LiveObjectData):
+        * heap/LiveObjectList.cpp: Added.
+        (JSC::LiveObjectList::findObject):
+        * heap/LiveObjectList.h: Added.
+        (JSC::LiveObjectList::LiveObjectList):
+        (JSC::LiveObjectList::reset):
+
+2015-08-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Let's rename FunctionBodyNode
+        https://bugs.webkit.org/show_bug.cgi?id=147292
+
+        Reviewed by Mark Lam & Saam Barati.
+
+        FunctionBodyNode => FunctionMetadataNode
+
+        Make FunctionMetadataNode inherit from Node instead of StatementNode
+        because a FunctionMetadataNode can appear in expression context and does
+        not have a next statement.
+
+        (I decided to continue allocating FunctionMetadataNode in the AST arena,
+        and to retain "Node" in its name, because it really is a parsing
+        construct, and we transform its data before consuming it elsewhere.
+
+        There is still room for a future patch to distill and simplify the
+        metadata we track about functions between FunDeclNode/FuncExprNode,
+        FunctionMetadataNode, and UnlinkedFunctionExecutable. But this is a start.)
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode): Deleted.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        * parser/NodeConstructors.h:
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionMetadataNode::FunctionMetadataNode):
+        (JSC::FunctionMetadataNode::finishParsing):
+        (JSC::FunctionMetadataNode::setEndPosition):
+        (JSC::FunctionBodyNode::FunctionBodyNode): Deleted.
+        (JSC::FunctionBodyNode::finishParsing): Deleted.
+        (JSC::FunctionBodyNode::setEndPosition): Deleted.
+        * parser/Nodes.h:
+        (JSC::FuncExprNode::body):
+        (JSC::FuncDeclNode::body):
+        * parser/Parser.h:
+        (JSC::Parser::isFunctionMetadataNode):
+        (JSC::Parser::next):
+        (JSC::Parser<LexerType>::parse):
+        (JSC::Parser::isFunctionBodyNode): Deleted.
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+
+2015-08-09  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r188105): Seems to have caused crashes during PLT on some iPads
+        https://bugs.webkit.org/show_bug.cgi?id=147818
+
+        Unreviewed, roll out r188105.
+
+        * bytecode/ByValInfo.h:
+        (JSC::ByValInfo::ByValInfo):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::getByValInfoMap): Deleted.
+        (JSC::CodeBlock::addByValInfo): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getByValInfo):
+        (JSC::CodeBlock::setNumberOfByValInfos):
+        (JSC::CodeBlock::numberOfByValInfos):
+        (JSC::CodeBlock::byValInfo):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString): Deleted.
+        * bytecode/ExitKind.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback): Deleted.
+        * bytecode/GetByIdStatus.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): Deleted.
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC): Deleted.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Deleted.
+        (JSC::DFG::FixupPhase::observeUseKindOnNode): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasUidOperand): Deleted.
+        (JSC::DFG::Node::uidOperand): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()): Deleted.
+        (JSC::DFG::safeToExecute): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
+        (JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted.
+        (JSC::DFG::SpeculativeJIT::speculate): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal): Deleted.
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor): Deleted.
+        (JSC::DFG::isCell): Deleted.
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculate): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::ByValCompilationInfo::ByValCompilationInfo):
+        (JSC::JIT::compileGetByValWithCachedId): Deleted.
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation): Deleted.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_has_indexed_property):
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_has_indexed_property):
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emitGetByValWithCachedId): Deleted.
+        (JSC::JIT::privateCompileGetByVal): Deleted.
+        (JSC::JIT::privateCompileGetByValWithCachedId): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emitGetByValWithCachedId): Deleted.
+        * runtime/Symbol.h:
+        * tests/stress/get-by-val-with-string-constructor.js: Removed.
+        * tests/stress/get-by-val-with-string-exit.js: Removed.
+        * tests/stress/get-by-val-with-string-generated.js: Removed.
+        * tests/stress/get-by-val-with-string-getter.js: Removed.
+        * tests/stress/get-by-val-with-string.js: Removed.
+        * tests/stress/get-by-val-with-symbol-constructor.js: Removed.
+        * tests/stress/get-by-val-with-symbol-exit.js: Removed.
+        * tests/stress/get-by-val-with-symbol-getter.js: Removed.
+        * tests/stress/get-by-val-with-symbol.js: Removed.
+
+2015-08-07  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
+
+        Reduce uses of PassRefPtr in bindings
+        https://bugs.webkit.org/show_bug.cgi?id=147781
+
+        Reviewed by Chris Dumez.
+
+        Use RefPtr when function can return null or an instance. If not, Ref is used.
+
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::toNativeTypedView):
+
+2015-08-07  Alex Christensen  <achristensen@webkit.org>
+
+        Build more testing binaries with CMake on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=147799
+
+        Reviewed by Brent Fulgham.
+
+        * shell/PlatformWin.cmake: Added.
+        Build jsc.dll and jsc.exe to find Apple Application Support or WinCairo dlls before using them.
+
+2015-08-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Lightweight locks should be adaptive
+        https://bugs.webkit.org/show_bug.cgi?id=147545
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGCommon.cpp:
+        (JSC::DFG::startCrashing):
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::workListLock):
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::shouldReportLiveBytes):
+        (JSC::CopiedBlock::reportLiveBytes):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneFillingBlock):
+        * heap/CopiedSpace.h:
+        (JSC::CopiedSpace::CopiedGeneration::CopiedGeneration):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::recycleEvacuatedBlock):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::didStartCopying):
+        * heap/GCThreadSharedData.h:
+        (JSC::GCThreadSharedData::getNextBlocksToCopy):
+        * heap/ListableHandler.h:
+        (JSC::ListableHandler::List::addThreadSafe):
+        (JSC::ListableHandler::List::addNotThreadSafe):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater):
+        * parser/SourceProvider.cpp:
+        (JSC::SourceProvider::~SourceProvider):
+        (JSC::SourceProvider::getID):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::addDatabaseToAtExit):
+        (JSC::Profiler::Database::removeDatabaseFromAtExit):
+        (JSC::Profiler::Database::removeFirstAtExitDatabase):
+        * runtime/TypeProfilerLog.h:
+
+2015-08-07  Mark Lam  <mark.lam@apple.com>
+
+        Rename some variables in the JSC watchdog implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=147790
+
+        Rubber stamped by Benjamin Poulain.
+
+        This is just a refactoring patch to give the variable better names that describe their
+        intended use.  There is no behavior change.
+
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::Watchdog):
+        (JSC::Watchdog::setTimeLimit):
+        (JSC::Watchdog::didFire):
+        (JSC::Watchdog::isEnabled):
+        (JSC::Watchdog::fire):
+        (JSC::Watchdog::startCountdownIfNeeded):
+        * runtime/Watchdog.h:
+
+2015-08-07  Saam barati  <saambarati1@gmail.com>
+
+        Interpreter::unwind shouldn't be responsible for assigning the correct scope.
+        https://bugs.webkit.org/show_bug.cgi?id=147666
+
+        Reviewed by Geoffrey Garen.
+
+        If we make the bytecode generator know about every local scope it 
+        creates, and if we give each local scope a unique register, the
+        bytecode generator has all the information it needs to assign
+        the correct scope to a catch handler. Because the bytecode generator
+        knows this information, it's a better separation of responsibilties
+        for it to set up the proper scope instead of relying on the exception
+        handling runtime to find the scope.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/HandlerInfo.h:
+        (JSC::UnlinkedHandlerInfo::UnlinkedHandlerInfo):
+        (JSC::HandlerInfo::initialize):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::emitGetScope):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitGetParentScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitPopWithScope):
+        (JSC::BytecodeGenerator::allocateAndEmitScope):
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::pushTry):
+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
+        (JSC::BytecodeGenerator::localScopeDepth):
+        (JSC::BytecodeGenerator::calculateTargetScopeDepthForExceptionHandler): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::WithNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwind):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::compileOpStrictEq):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_to_number):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::objectAtScope):
+        (JSC::isUnscopable):
+        (JSC::JSScope::depth): Deleted.
+        * runtime/JSScope.h:
+
+2015-08-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Add MacroAssembler::patchableBranch64 and fix ARM64's patchableBranchPtr
+        https://bugs.webkit.org/show_bug.cgi?id=147761
+
+        Reviewed by Mark Lam.
+
+        This patch implements MacroAssembler::patchableBranch64 in 64bit environments.
+        And fix the existing MacroAssemblerARM64::patchableBranchPtr, before this patch,
+        it truncates the immediate pointer into the 32bit immediate.
+        And use patchableBranch64 in the baseline JIT under the JSVALUE64 configuration.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::patchableBranchPtr):
+        (JSC::MacroAssemblerARM64::patchableBranch64):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::patchableBranch64):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::emitPatchableJumpIfNotImmediateInteger):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+
+2015-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce get_by_id like IC into get_by_val when the given name is String or Symbol
+        https://bugs.webkit.org/show_bug.cgi?id=147480
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds get_by_id IC to get_by_val operation by caching the string / symbol id.
+        The IC site only caches one id. After checking that the given id is the same to the
+        cached one, we perform the get_by_id IC onto it.
+        And by collecting IC StructureStubInfo information, we pass it to the DFG and DFG
+        compiles get_by_val op code into CheckIdent (with edge type check) and GetById related
+        operations when the given get_by_val leverages the property load with the cached id.
+
+        To ensure the incoming value is the expected id, in DFG layer, we use SymbolUse and
+        StringIdentUse to enforce the type. To use it, this patch implements SymbolUse.
+        This can be leveraged to optimize symbol operations in DFG.
+
+        And since byValInfo is frequently used, we align the byValInfo design to the stubInfo like one.
+        Allocated by the Bag and operations take the raw byValInfo pointer directly instead of performing
+        binary search onto m_byValInfos. And by storing ArrayProfile* under the ByValInfo, we replaced the
+        argument ArrayProfile* in the operations with ByValInfo*.
+
+        * bytecode/ByValInfo.h:
+        (JSC::ByValInfo::ByValInfo):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::getByValInfoMap):
+        (JSC::CodeBlock::addByValInfo):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getByValInfo): Deleted.
+        (JSC::CodeBlock::setNumberOfByValInfos): Deleted.
+        (JSC::CodeBlock::numberOfByValInfos): Deleted.
+        (JSC::CodeBlock::byValInfo): Deleted.
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/GetByIdStatus.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasUidOperand):
+        (JSC::DFG::Node::uidOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCheckIdent):
+        (JSC::DFG::SpeculativeJIT::speculateSymbol):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::ByValCompilationInfo::ByValCompilationInfo):
+        (JSC::JIT::compileGetByValWithCachedId):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_has_indexed_property):
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_has_indexed_property):
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::privateCompileGetByValWithCachedId):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * runtime/Symbol.h:
+        * tests/stress/get-by-val-with-string-constructor.js: Added.
+        (Hello):
+        (get Hello.prototype.generate):
+        (ok):
+        * tests/stress/get-by-val-with-string-exit.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getStr1):
+        (getStr2):
+        * tests/stress/get-by-val-with-string-generated.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getStr1):
+        (getStr2):
+        * tests/stress/get-by-val-with-string-getter.js: Added.
+        (object.get hello):
+        (ok):
+        * tests/stress/get-by-val-with-string.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getStr1):
+        (getStr2):
+        * tests/stress/get-by-val-with-symbol-constructor.js: Added.
+        (Hello):
+        (get Hello.prototype.generate):
+        (ok):
+        * tests/stress/get-by-val-with-symbol-exit.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getSym1):
+        (getSym2):
+        * tests/stress/get-by-val-with-symbol-getter.js: Added.
+        (object.get hello):
+        (.get ok):
+        * tests/stress/get-by-val-with-symbol.js: Added.
+        (shouldBe):
+        (getByVal):
+        (getSym1):
+        (getSym2):
+
+2015-08-06  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Parse the entire WebAssembly modules
+        https://bugs.webkit.org/show_bug.cgi?id=147393
+
+        Reviewed by Geoffrey Garen.
+
+        Parse the entire WebAssembly modules from files produced by pack-asmjs
+        <https://github.com/WebAssembly/polyfill-prototype-1>. This patch can only
+        parse modules whose function definition section contains only functions that
+        have "return 0;" as their only statement. Parsing of any functions will be
+        implemented in a subsequent patch.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wasm/JSWASMModule.cpp:
+        (JSC::JSWASMModule::destroy):
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::i32Constants):
+        (JSC::JSWASMModule::f32Constants):
+        (JSC::JSWASMModule::f64Constants):
+        (JSC::JSWASMModule::signatures):
+        (JSC::JSWASMModule::functionImports):
+        (JSC::JSWASMModule::functionImportSignatures):
+        (JSC::JSWASMModule::globalVariableTypes):
+        (JSC::JSWASMModule::functionDeclarations):
+        (JSC::JSWASMModule::functionPointerTables):
+        * wasm/WASMFormat.h: Added.
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::parse):
+        (JSC::WASMModuleParser::parseModule):
+        (JSC::WASMModuleParser::parseConstantPoolSection):
+        (JSC::WASMModuleParser::parseSignatureSection):
+        (JSC::WASMModuleParser::parseFunctionImportSection):
+        (JSC::WASMModuleParser::parseGlobalSection):
+        (JSC::WASMModuleParser::parseFunctionDeclarationSection):
+        (JSC::WASMModuleParser::parseFunctionPointerTableSection):
+        (JSC::WASMModuleParser::parseFunctionDefinitionSection):
+        (JSC::WASMModuleParser::parseFunctionDefinition):
+        (JSC::WASMModuleParser::parseExportSection):
+        * wasm/WASMModuleParser.h:
+        * wasm/WASMReader.cpp:
+        (JSC::WASMReader::readUInt32):
+        (JSC::WASMReader::readCompactUInt32):
+        (JSC::WASMReader::readString):
+        (JSC::WASMReader::readType):
+        (JSC::WASMReader::readExpressionType):
+        (JSC::WASMReader::readExportFormat):
+        (JSC::WASMReader::readByte):
+        (JSC::WASMReader::readUnsignedInt32): Deleted.
+        * wasm/WASMReader.h:
+
+2015-08-06  Keith Miller  <keith_miller@apple.com>
+
+        The typedArrayLength function in FTLLowerDFGToLLVM is dead code.
+        https://bugs.webkit.org/show_bug.cgi?id=147749
+
+        Reviewed by Filip Pizlo.
+
+        Removed dead code elimination. the TypedArray length is compiled in compileGetArrayLength()
+        thus no one calls this code.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::typedArrayLength): Deleted.
+
+2015-08-06  Keith Miller  <keith_miller@apple.com>
+
+        The JSONP parser incorrectly parsers -0 as +0.
+        https://bugs.webkit.org/show_bug.cgi?id=147590
+
+        Reviewed by Michael Saboff.
+
+        In the LiteralParser we should use a double to store the accumulator for numerical tokens
+        rather than an int. Using an int means that -0 is, incorrectly, parsed as +0.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::Lexer::lexNumber):
+
+2015-08-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Structures used for tryGetConstantProperty() should be registered first
+        https://bugs.webkit.org/show_bug.cgi?id=147750
+
+        Reviewed by Saam Barati and Michael Saboff.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetConstantProperty): Add an assertion to that effect. This should catch the bug sooner.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addStructureSet): Register structures when we make a structure set. That ensures that we won't call tryGetConstantProperty() on a structure that hasn't been registered yet.
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run): Don't register structure sets here anymore. Registering them before we get here means there is no chance of the code being DCE'd before the structures get registered. It also enables the tryGetConstantProperty() assertion, since that code runs before StructureRegisterationPhase.
+        (JSC::DFG::StructureRegistrationPhase::registerStructures):
+        (JSC::DFG::StructureRegistrationPhase::registerStructure):
+        (JSC::DFG::StructureRegistrationPhase::assertAreRegistered):
+        (JSC::DFG::StructureRegistrationPhase::assertIsRegistered):
+        (JSC::DFG::performStructureRegistration):
+
+2015-08-06  Keith Miller  <keith_miller@apple.com>
+
+        Remove UnspecifiedBoolType from JSC
+        https://bugs.webkit.org/show_bug.cgi?id=147597
+
+        Reviewed by Mark Lam.
+
+        We were using the safe bool pattern in the code base for implicit casting to booleans.
+        With C++11 this is no longer necessary and we can instead create an operator bool.
+
+        * API/JSRetainPtr.h:
+        (JSRetainPtr::operator bool):
+        (JSRetainPtr::operator UnspecifiedBoolType): Deleted.
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::operator bool):
+        (JSC::DFG::Edge::operator UnspecifiedBoolType*): Deleted.
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * heap/Weak.h:
+        * heap/WeakInlines.h:
+        (JSC::bool):
+        (JSC::UnspecifiedBoolType): Deleted.
+
+2015-08-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        [ES6] Class parser does not allow methods named set and get.
+        https://bugs.webkit.org/show_bug.cgi?id=147150
+
+        Reviewed by Oliver Hunt.
+
+        The bug was caused by parseClass assuming identifiers "get" and "set" could only appear
+        as the leading token for getter and setter methods. Fixed the bug by generalizing the code
+        so that we only treat them as such when it's followed by another token that could be a method name.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+
+2015-08-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/187972.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        * dfg/DFGThreadData.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::~Worklist):
+        (JSC::DFG::Worklist::isActiveForVM):
+        (JSC::DFG::Worklist::enqueue):
+        (JSC::DFG::Worklist::compilationState):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::Worklist::removeDeadPlans):
+        (JSC::DFG::Worklist::queueLength):
+        (JSC::DFG::Worklist::dump):
+        (JSC::DFG::Worklist::runThread):
+        * dfg/DFGWorklist.h:
+        * disassembler/Disassembler.cpp:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        * heap/CopiedSpace.h:
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::recycleBorrowedBlock):
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        * heap/HeapTimer.h:
+        * heap/MachineStackMarker.cpp:
+        (JSC::ActiveMachineThreadsManager::Locker::Locker):
+        (JSC::ActiveMachineThreadsManager::add):
+        (JSC::ActiveMachineThreadsManager::remove):
+        (JSC::ActiveMachineThreadsManager::ActiveMachineThreadsManager):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThreadIfFound):
+        (JSC::MachineThreads::tryCopyOtherThreadStack):
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * heap/MachineStackMarker.h:
+        * interpreter/JSStack.cpp:
+        (JSC::stackStatisticsMutex):
+        (JSC::JSStack::addToCommittedByteCount):
+        (JSC::JSStack::committedByteCount):
+        * jit/JITThunks.h:
+        * profiler/ProfilerDatabase.h:
+
+2015-08-05  Saam barati  <saambarati1@gmail.com>
+
+        Bytecodegenerator emits crappy code for returns in a lexical scope.
+        https://bugs.webkit.org/show_bug.cgi?id=147688
+
+        Reviewed by Mark Lam.
+
+        When returning, we only need to emit complex pop scopes if we're in 
+        a finally block. Otherwise, we can just return like normal. This saves
+        us from inefficiently emitting unnecessary pop scopes.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isInFinallyBlock):
+        (JSC::BytecodeGenerator::hasFinaliser): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ReturnNode::emitBytecode):
+
+2015-08-05  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add the Intl API to the status page
+
+        * features.json:
+        Andy VanWagoner landed the skeleton of the API and it is
+        enabled by default.
+
+2015-08-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename Mutex to DeprecatedMutex
+        https://bugs.webkit.org/show_bug.cgi?id=147675
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        * dfg/DFGThreadData.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::~Worklist):
+        (JSC::DFG::Worklist::isActiveForVM):
+        (JSC::DFG::Worklist::enqueue):
+        (JSC::DFG::Worklist::compilationState):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::completeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::Worklist::removeDeadPlans):
+        (JSC::DFG::Worklist::queueLength):
+        (JSC::DFG::Worklist::dump):
+        (JSC::DFG::Worklist::runThread):
+        * dfg/DFGWorklist.h:
+        * disassembler/Disassembler.cpp:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneFillingBlock):
+        (JSC::CopiedSpace::doneCopying):
+        * heap/CopiedSpace.h:
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::recycleBorrowedBlock):
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        * heap/HeapTimer.h:
+        * heap/MachineStackMarker.cpp:
+        (JSC::ActiveMachineThreadsManager::Locker::Locker):
+        (JSC::ActiveMachineThreadsManager::add):
+        (JSC::ActiveMachineThreadsManager::remove):
+        (JSC::ActiveMachineThreadsManager::ActiveMachineThreadsManager):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThreadIfFound):
+        (JSC::MachineThreads::tryCopyOtherThreadStack):
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * heap/MachineStackMarker.h:
+        * interpreter/JSStack.cpp:
+        (JSC::stackStatisticsMutex):
+        (JSC::JSStack::addToCommittedByteCount):
+        (JSC::JSStack::committedByteCount):
+        * jit/JITThunks.h:
+        * profiler/ProfilerDatabase.h:
+
+2015-08-05  Saam barati  <saambarati1@gmail.com>
+
+        Replace JSFunctionNameScope with JSLexicalEnvironment for the function name scope.
+        https://bugs.webkit.org/show_bug.cgi?id=147657
+
+        Reviewed by Mark Lam.
+
+        This kills the last of the name scope objects. Function name scopes are
+        now built on top of the scoping mechanisms introduced with ES6 block scoping.
+        A name scope is now just a JSLexicalEnvironment.  We treat assignments to the
+        function name scoped variable carefully depending on if the function is in
+        strict mode. If we're in strict mode, then we treat the variable exactly
+        like a "const" variable. If we're not in strict mode, we can't treat
+        this variable like like ES6 "const" because that would cause the bytecode
+        generator to throw an exception when it shouldn't.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::resolveType):
+        (JSC::BytecodeGenerator::emitThrowTypeError):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::pushScopedControlFlowContext):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        * debugger/DebuggerScope.cpp:
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_string):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_push_name_scope): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_to_string):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_push_name_scope): Deleted.
+        * jit/JITOperations.cpp:
+        (JSC::pushNameScope): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/Nodes.cpp:
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/JSFunctionNameScope.cpp: Removed.
+        * runtime/JSFunctionNameScope.h: Removed.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::strictEvalActivationStructure):
+        (JSC::JSGlobalObject::activationStructure):
+        (JSC::JSGlobalObject::directArgumentsStructure):
+        (JSC::JSGlobalObject::scopedArgumentsStructure):
+        (JSC::JSGlobalObject::outOfBandArgumentsStructure):
+        (JSC::JSGlobalObject::functionNameScopeStructure): Deleted.
+        * runtime/JSNameScope.cpp: Removed.
+        * runtime/JSNameScope.h: Removed.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toThis):
+        (JSC::JSObject::seal):
+        (JSC::JSObject::isFunctionNameScopeObject): Deleted.
+        * runtime/JSObject.h:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::isCatchScope):
+        (JSC::JSScope::isFunctionNameScopeObject):
+        (JSC::resolveModeName):
+        * runtime/JSScope.h:
+        * runtime/JSSymbolTableObject.cpp:
+        * runtime/SymbolTable.h:
+        * runtime/VM.cpp:
+
+2015-08-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Improve Support for PropertyName Iterator (Reflect.enumerate) in Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=147679
+
+        Reviewed by Timothy Hatcher.
+
+        Improve native iterator support for the PropertyName Iterator by
+        allowing inspection of the internal object within the iterator
+        and peeking of the next upcoming values of the iterator.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::iteratedValue):
+
+2015-08-04  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Update Apple Windows build for VS2015
+        https://bugs.webkit.org/show_bug.cgi?id=147653
+
+        Reviewed by Dean Jackson.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Drive-by-fix.
+        Show JSC files in proper project locations in IDE.
+
+2015-08-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Object previews for SVG elements shows SVGAnimatedString instead of text
+        https://bugs.webkit.org/show_bug.cgi?id=147328
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        Use classList and classList.toString instead of className.
+
+2015-08-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Support Module Syntax
+        https://bugs.webkit.org/show_bug.cgi?id=147422
+
+        Reviewed by Saam Barati.
+
+        This patch introduces ES6 Modules syntax parsing part.
+        In this patch, ASTBuilder just produces the corresponding nodes to the ES6 Modules syntax,
+        and this patch does not include the code generator part.
+
+        Modules require 2 phase parsing. In the first pass, we just analyze the dependent modules
+        and do not execute the body or construct the AST. And after analyzing all the dependent
+        modules, we will parse the dependent modules next.
+        After all analyzing part is done, we will start the second pass. In the second pass, we
+        will parse the module, produce the AST, and execute the body.
+        If we don't do so, we need to create all the ASTs in the module's dependent graph at first
+        because the given module can be executed after the all dependent modules are executed. It
+        means that we need to hold so many parser arenas. To avoid this, the first pass only extracts
+        the dependent modules' information.
+
+        In this patch, we don't add this analyzing part yet. This patch only implements the second pass.
+        This patch aims at just implementing the syntax parsing functionality correctly.
+        After this patch is landed, we will create the ModuleDependencyAnalyzer that inherits SyntaxChecker
+        to collect the dependent modules fast[1].
+
+        To test the parsing, we added the "checkModuleSyntax" function into jsc shell.
+        By using this, we can parse the given string as the module.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=147353
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ModuleProgramNode::emitBytecode):
+        (JSC::ImportDeclarationNode::emitBytecode):
+        (JSC::ExportAllDeclarationNode::emitBytecode):
+        (JSC::ExportDefaultDeclarationNode::emitBytecode):
+        (JSC::ExportLocalDeclarationNode::emitBytecode):
+        (JSC::ExportNamedDeclarationNode::emitBytecode):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionCheckModuleSyntax):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createModuleSpecifier):
+        (JSC::ASTBuilder::createImportSpecifier):
+        (JSC::ASTBuilder::createImportSpecifierList):
+        (JSC::ASTBuilder::appendImportSpecifier):
+        (JSC::ASTBuilder::createImportDeclaration):
+        (JSC::ASTBuilder::createExportAllDeclaration):
+        (JSC::ASTBuilder::createExportDefaultDeclaration):
+        (JSC::ASTBuilder::createExportLocalDeclaration):
+        (JSC::ASTBuilder::createExportNamedDeclaration):
+        (JSC::ASTBuilder::createExportSpecifier):
+        (JSC::ASTBuilder::createExportSpecifierList):
+        (JSC::ASTBuilder::appendExportSpecifier):
+        * parser/Keywords.table:
+        * parser/NodeConstructors.h:
+        (JSC::ModuleSpecifierNode::ModuleSpecifierNode):
+        (JSC::ImportSpecifierNode::ImportSpecifierNode):
+        (JSC::ImportDeclarationNode::ImportDeclarationNode):
+        (JSC::ExportAllDeclarationNode::ExportAllDeclarationNode):
+        (JSC::ExportDefaultDeclarationNode::ExportDefaultDeclarationNode):
+        (JSC::ExportLocalDeclarationNode::ExportLocalDeclarationNode):
+        (JSC::ExportNamedDeclarationNode::ExportNamedDeclarationNode):
+        (JSC::ExportSpecifierNode::ExportSpecifierNode):
+        * parser/Nodes.cpp:
+        (JSC::ModuleProgramNode::ModuleProgramNode):
+        * parser/Nodes.h:
+        (JSC::ModuleProgramNode::startColumn):
+        (JSC::ModuleProgramNode::endColumn):
+        (JSC::ModuleSpecifierNode::moduleName):
+        (JSC::ImportSpecifierNode::importedName):
+        (JSC::ImportSpecifierNode::localName):
+        (JSC::ImportSpecifierListNode::specifiers):
+        (JSC::ImportSpecifierListNode::append):
+        (JSC::ImportDeclarationNode::specifierList):
+        (JSC::ImportDeclarationNode::moduleSpecifier):
+        (JSC::ExportAllDeclarationNode::moduleSpecifier):
+        (JSC::ExportDefaultDeclarationNode::declaration):
+        (JSC::ExportLocalDeclarationNode::declaration):
+        (JSC::ExportSpecifierNode::exportedName):
+        (JSC::ExportSpecifierNode::localName):
+        (JSC::ExportSpecifierListNode::specifiers):
+        (JSC::ExportSpecifierListNode::append):
+        (JSC::ExportNamedDeclarationNode::specifierList):
+        (JSC::ExportNamedDeclarationNode::moduleSpecifier):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseModuleSourceElements):
+        (JSC::Parser<LexerType>::parseVariableDeclaration):
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseForStatement):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClassDeclaration):
+        (JSC::Parser<LexerType>::parseModuleSpecifier):
+        (JSC::Parser<LexerType>::parseImportClauseItem):
+        (JSC::Parser<LexerType>::parseImportDeclaration):
+        (JSC::Parser<LexerType>::parseExportSpecifier):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::isIdentifierOrKeyword):
+        (JSC::ModuleScopeData::create):
+        (JSC::ModuleScopeData::exportedBindings):
+        (JSC::ModuleScopeData::exportName):
+        (JSC::ModuleScopeData::exportBinding):
+        (JSC::Scope::Scope):
+        (JSC::Scope::setIsModule):
+        (JSC::Scope::moduleScopeData):
+        (JSC::Parser::matchContextualKeyword):
+        (JSC::Parser::matchIdentifierOrKeyword):
+        (JSC::Parser::isofToken): Deleted.
+        * parser/ParserModes.h:
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createModuleSpecifier):
+        (JSC::SyntaxChecker::createImportSpecifier):
+        (JSC::SyntaxChecker::createImportSpecifierList):
+        (JSC::SyntaxChecker::appendImportSpecifier):
+        (JSC::SyntaxChecker::createImportDeclaration):
+        (JSC::SyntaxChecker::createExportAllDeclaration):
+        (JSC::SyntaxChecker::createExportDefaultDeclaration):
+        (JSC::SyntaxChecker::createExportLocalDeclaration):
+        (JSC::SyntaxChecker::createExportNamedDeclaration):
+        (JSC::SyntaxChecker::createExportSpecifier):
+        (JSC::SyntaxChecker::createExportSpecifierList):
+        (JSC::SyntaxChecker::appendExportSpecifier):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkModuleSyntax):
+        * runtime/Completion.h:
+        * tests/stress/modules-syntax-error-with-names.js: Added.
+        (shouldThrow):
+        * tests/stress/modules-syntax-error.js: Added.
+        (shouldThrow):
+        (checkModuleSyntaxError.checkModuleSyntaxError.checkModuleSyntaxError):
+        * tests/stress/modules-syntax.js: Added.
+        (prototype.checkModuleSyntax):
+        (checkModuleSyntax):
+        * tests/stress/tagged-templates-syntax.js:
+
+2015-08-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Introduce COMPILER(GCC_OR_CLANG) guard and make COMPILER(GCC) true only for GCC
+        https://bugs.webkit.org/show_bug.cgi?id=146833
+
+        Reviewed by Alexey Proskuryakov.
+
+        * assembler/ARM64Assembler.h:
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::cacheFlush):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::isVFPPresent):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        * heap/MachineStackMarker.h:
+        * interpreter/StackVisitor.cpp: Removed redundant COMPILER(CLANG) guards.
+        (JSC::logF):
+        * jit/HostCallReturnValue.h:
+        * jit/JIT.h:
+        * jit/JITOperations.cpp:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86Common.h:
+        * jit/JITStubsX86_64.h:
+        * jit/ThunkGenerators.cpp:
+        * runtime/JSExportMacros.h:
+        * runtime/MathCommon.h: Removed redundant COMPILER(CLANG) guard.
+        (JSC::clz32):
+
+2015-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix uninitialized property leading to an assert.
+
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+
+2015-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Windows.
+
+        * bytecode/ObjectPropertyConditionSet.h:
+        (JSC::ObjectPropertyConditionSet::fromRawPointer):
+
+2015-07-31  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have adaptive structure watchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=146929
+
+        Reviewed by Geoffrey Garen.
+
+        Before this change, if you wanted to efficiently validate whether an object has (or doesn't have) a
+        property, you'd check that the object still has the structure that you first saw the object have. We
+        optimized this a bit with transition watchpoints on the structure, which sometimes allowed us to
+        elide the structure check.
+
+        But this approach fails when that object frequently has new properties added to it. This would
+        change the structure and fire the transition watchpoint, so the code we emitted would be invalid and
+        we'd have to recompile either the IC or an entire code block.
+
+        This change introduces a new concept: an object property condition. This value describes some
+        condition involving a property on some object. There are four kinds: presence, absence,
+        absence-of-setter, and equivalence. For example, a presence condition says that we expect that the
+        object has some property at some offset with some attributes. This allows us to implement a new kind
+        of watchpoint, which knows about the object property condition that it's being used to enforce. If
+        the watchpoint fires because of a structure transition, the watchpoint may simply reinstall itself
+        on the new structure.
+
+        Object property conditions are used on the prototype chain of PutById transitions, GetById misses,
+        and prototype accesses. They are also used for any DFG accesses to object constants, including
+        global property accesses.
+
+        Mostly because of the effect on global property access, this is a 9% speed-up on Kraken. It's
+        neutral on most other things. It's a 68x speed-up on a microbenchmark that illustrates the prototype
+        chain situation. It's also a small speed-up on getter-richards.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::printPutByIdCacheStatus):
+        * bytecode/CodeBlockJettisoningWatchpoint.cpp:
+        (JSC::CodeBlockJettisoningWatchpoint::fireInternal):
+        * bytecode/ComplexGetStatus.cpp:
+        (JSC::ComplexGetStatus::computeFor):
+        * bytecode/ComplexGetStatus.h:
+        (JSC::ComplexGetStatus::ComplexGetStatus):
+        (JSC::ComplexGetStatus::takesSlowPath):
+        (JSC::ComplexGetStatus::kind):
+        (JSC::ComplexGetStatus::offset):
+        (JSC::ComplexGetStatus::conditionSet):
+        (JSC::ComplexGetStatus::attributes): Deleted.
+        (JSC::ComplexGetStatus::specificValue): Deleted.
+        (JSC::ComplexGetStatus::chain): Deleted.
+        * bytecode/ConstantStructureCheck.cpp: Removed.
+        * bytecode/ConstantStructureCheck.h: Removed.
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::GetByIdVariant):
+        (JSC::GetByIdVariant::~GetByIdVariant):
+        (JSC::GetByIdVariant::operator=):
+        (JSC::GetByIdVariant::attemptToMerge):
+        (JSC::GetByIdVariant::dumpInContext):
+        (JSC::GetByIdVariant::baseStructure): Deleted.
+        * bytecode/GetByIdVariant.h:
+        (JSC::GetByIdVariant::operator!):
+        (JSC::GetByIdVariant::structureSet):
+        (JSC::GetByIdVariant::conditionSet):
+        (JSC::GetByIdVariant::offset):
+        (JSC::GetByIdVariant::callLinkStatus):
+        (JSC::GetByIdVariant::constantChecks): Deleted.
+        (JSC::GetByIdVariant::alternateBase): Deleted.
+        * bytecode/ObjectPropertyCondition.cpp: Added.
+        (JSC::ObjectPropertyCondition::dumpInContext):
+        (JSC::ObjectPropertyCondition::dump):
+        (JSC::ObjectPropertyCondition::structureEnsuresValidityAssumingImpurePropertyWatchpoint):
+        (JSC::ObjectPropertyCondition::validityRequiresImpurePropertyWatchpoint):
+        (JSC::ObjectPropertyCondition::isStillValid):
+        (JSC::ObjectPropertyCondition::structureEnsuresValidity):
+        (JSC::ObjectPropertyCondition::isWatchableAssumingImpurePropertyWatchpoint):
+        (JSC::ObjectPropertyCondition::isWatchable):
+        (JSC::ObjectPropertyCondition::isStillLive):
+        (JSC::ObjectPropertyCondition::validateReferences):
+        (JSC::ObjectPropertyCondition::attemptToMakeEquivalenceWithoutBarrier):
+        * bytecode/ObjectPropertyCondition.h: Added.
+        (JSC::ObjectPropertyCondition::ObjectPropertyCondition):
+        (JSC::ObjectPropertyCondition::presenceWithoutBarrier):
+        (JSC::ObjectPropertyCondition::presence):
+        (JSC::ObjectPropertyCondition::absenceWithoutBarrier):
+        (JSC::ObjectPropertyCondition::absence):
+        (JSC::ObjectPropertyCondition::absenceOfSetterWithoutBarrier):
+        (JSC::ObjectPropertyCondition::absenceOfSetter):
+        (JSC::ObjectPropertyCondition::equivalenceWithoutBarrier):
+        (JSC::ObjectPropertyCondition::equivalence):
+        (JSC::ObjectPropertyCondition::operator!):
+        (JSC::ObjectPropertyCondition::object):
+        (JSC::ObjectPropertyCondition::condition):
+        (JSC::ObjectPropertyCondition::kind):
+        (JSC::ObjectPropertyCondition::uid):
+        (JSC::ObjectPropertyCondition::hasOffset):
+        (JSC::ObjectPropertyCondition::offset):
+        (JSC::ObjectPropertyCondition::hasAttributes):
+        (JSC::ObjectPropertyCondition::attributes):
+        (JSC::ObjectPropertyCondition::hasPrototype):
+        (JSC::ObjectPropertyCondition::prototype):
+        (JSC::ObjectPropertyCondition::hasRequiredValue):
+        (JSC::ObjectPropertyCondition::requiredValue):
+        (JSC::ObjectPropertyCondition::hash):
+        (JSC::ObjectPropertyCondition::operator==):
+        (JSC::ObjectPropertyCondition::isHashTableDeletedValue):
+        (JSC::ObjectPropertyCondition::isCompatibleWith):
+        (JSC::ObjectPropertyCondition::watchingRequiresStructureTransitionWatchpoint):
+        (JSC::ObjectPropertyCondition::watchingRequiresReplacementWatchpoint):
+        (JSC::ObjectPropertyCondition::isValidValueForPresence):
+        (JSC::ObjectPropertyConditionHash::hash):
+        (JSC::ObjectPropertyConditionHash::equal):
+        * bytecode/ObjectPropertyConditionSet.cpp: Added.
+        (JSC::ObjectPropertyConditionSet::forObject):
+        (JSC::ObjectPropertyConditionSet::forConditionKind):
+        (JSC::ObjectPropertyConditionSet::numberOfConditionsWithKind):
+        (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition):
+        (JSC::ObjectPropertyConditionSet::slotBaseCondition):
+        (JSC::ObjectPropertyConditionSet::mergedWith):
+        (JSC::ObjectPropertyConditionSet::structuresEnsureValidity):
+        (JSC::ObjectPropertyConditionSet::structuresEnsureValidityAssumingImpurePropertyWatchpoint):
+        (JSC::ObjectPropertyConditionSet::needImpurePropertyWatchpoint):
+        (JSC::ObjectPropertyConditionSet::areStillLive):
+        (JSC::ObjectPropertyConditionSet::dumpInContext):
+        (JSC::ObjectPropertyConditionSet::dump):
+        (JSC::generateConditionsForPropertyMiss):
+        (JSC::generateConditionsForPropertySetterMiss):
+        (JSC::generateConditionsForPrototypePropertyHit):
+        (JSC::generateConditionsForPrototypePropertyHitCustom):
+        (JSC::generateConditionsForPropertySetterMissConcurrently):
+        * bytecode/ObjectPropertyConditionSet.h: Added.
+        (JSC::ObjectPropertyConditionSet::ObjectPropertyConditionSet):
+        (JSC::ObjectPropertyConditionSet::invalid):
+        (JSC::ObjectPropertyConditionSet::nonEmpty):
+        (JSC::ObjectPropertyConditionSet::isValid):
+        (JSC::ObjectPropertyConditionSet::isEmpty):
+        (JSC::ObjectPropertyConditionSet::begin):
+        (JSC::ObjectPropertyConditionSet::end):
+        (JSC::ObjectPropertyConditionSet::releaseRawPointer):
+        (JSC::ObjectPropertyConditionSet::adoptRawPointer):
+        (JSC::ObjectPropertyConditionSet::fromRawPointer):
+        (JSC::ObjectPropertyConditionSet::Data::Data):
+        * bytecode/PolymorphicGetByIdList.cpp:
+        (JSC::GetByIdAccess::GetByIdAccess):
+        (JSC::GetByIdAccess::~GetByIdAccess):
+        (JSC::GetByIdAccess::visitWeak):
+        * bytecode/PolymorphicGetByIdList.h:
+        (JSC::GetByIdAccess::GetByIdAccess):
+        (JSC::GetByIdAccess::structure):
+        (JSC::GetByIdAccess::conditionSet):
+        (JSC::GetByIdAccess::stubRoutine):
+        (JSC::GetByIdAccess::chain): Deleted.
+        (JSC::GetByIdAccess::chainCount): Deleted.
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::fromStructureStubInfo):
+        (JSC::PutByIdAccess::visitWeak):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::PutByIdAccess):
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::setter):
+        (JSC::PutByIdAccess::newStructure):
+        (JSC::PutByIdAccess::conditionSet):
+        (JSC::PutByIdAccess::stubRoutine):
+        (JSC::PutByIdAccess::chain): Deleted.
+        (JSC::PutByIdAccess::chainCount): Deleted.
+        * bytecode/PropertyCondition.cpp: Added.
+        (JSC::PropertyCondition::dumpInContext):
+        (JSC::PropertyCondition::dump):
+        (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint):
+        (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint):
+        (JSC::PropertyCondition::isStillValid):
+        (JSC::PropertyCondition::isWatchableWhenValid):
+        (JSC::PropertyCondition::isWatchableAssumingImpurePropertyWatchpoint):
+        (JSC::PropertyCondition::isWatchable):
+        (JSC::PropertyCondition::isStillLive):
+        (JSC::PropertyCondition::validateReferences):
+        (JSC::PropertyCondition::isValidValueForAttributes):
+        (JSC::PropertyCondition::isValidValueForPresence):
+        (JSC::PropertyCondition::attemptToMakeEquivalenceWithoutBarrier):
+        (WTF::printInternal):
+        * bytecode/PropertyCondition.h: Added.
+        (JSC::PropertyCondition::PropertyCondition):
+        (JSC::PropertyCondition::presenceWithoutBarrier):
+        (JSC::PropertyCondition::presence):
+        (JSC::PropertyCondition::absenceWithoutBarrier):
+        (JSC::PropertyCondition::absence):
+        (JSC::PropertyCondition::absenceOfSetterWithoutBarrier):
+        (JSC::PropertyCondition::absenceOfSetter):
+        (JSC::PropertyCondition::equivalenceWithoutBarrier):
+        (JSC::PropertyCondition::equivalence):
+        (JSC::PropertyCondition::operator!):
+        (JSC::PropertyCondition::kind):
+        (JSC::PropertyCondition::uid):
+        (JSC::PropertyCondition::hasOffset):
+        (JSC::PropertyCondition::offset):
+        (JSC::PropertyCondition::hasAttributes):
+        (JSC::PropertyCondition::attributes):
+        (JSC::PropertyCondition::hasPrototype):
+        (JSC::PropertyCondition::prototype):
+        (JSC::PropertyCondition::hasRequiredValue):
+        (JSC::PropertyCondition::requiredValue):
+        (JSC::PropertyCondition::hash):
+        (JSC::PropertyCondition::operator==):
+        (JSC::PropertyCondition::isHashTableDeletedValue):
+        (JSC::PropertyCondition::isCompatibleWith):
+        (JSC::PropertyCondition::watchingRequiresStructureTransitionWatchpoint):
+        (JSC::PropertyCondition::watchingRequiresReplacementWatchpoint):
+        (JSC::PropertyConditionHash::hash):
+        (JSC::PropertyConditionHash::equal):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::operator=):
+        (JSC::PutByIdVariant::transition):
+        (JSC::PutByIdVariant::setter):
+        (JSC::PutByIdVariant::makesCalls):
+        (JSC::PutByIdVariant::attemptToMerge):
+        (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
+        (JSC::PutByIdVariant::dumpInContext):
+        (JSC::PutByIdVariant::baseStructure): Deleted.
+        * bytecode/PutByIdVariant.h:
+        (JSC::PutByIdVariant::PutByIdVariant):
+        (JSC::PutByIdVariant::kind):
+        (JSC::PutByIdVariant::structure):
+        (JSC::PutByIdVariant::structureSet):
+        (JSC::PutByIdVariant::oldStructure):
+        (JSC::PutByIdVariant::conditionSet):
+        (JSC::PutByIdVariant::offset):
+        (JSC::PutByIdVariant::callLinkStatus):
+        (JSC::PutByIdVariant::constantChecks): Deleted.
+        (JSC::PutByIdVariant::alternateBase): Deleted.
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
+        (JSC::StructureStubClearingWatchpoint::push):
+        (JSC::StructureStubClearingWatchpoint::fireInternal):
+        (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo):
+        (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
+        (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
+        * bytecode/StructureStubClearingWatchpoint.h:
+        (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
+        (JSC::WatchpointsOnStructureStubInfo::codeBlock):
+        (JSC::WatchpointsOnStructureStubInfo::stubInfo):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::setSeen):
+        (JSC::StructureStubInfo::addWatchpoint):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp: Added.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::AdaptiveInferredPropertyValueWatchpoint):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::install):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::fire):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::fireInternal):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::fireInternal):
+        * dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h: Added.
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::key):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::StructureWatchpoint::StructureWatchpoint):
+        (JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::PropertyWatchpoint::PropertyWatchpoint):
+        * dfg/DFGAdaptiveStructureWatchpoint.cpp: Added.
+        (JSC::DFG::AdaptiveStructureWatchpoint::AdaptiveStructureWatchpoint):
+        (JSC::DFG::AdaptiveStructureWatchpoint::install):
+        (JSC::DFG::AdaptiveStructureWatchpoint::fireInternal):
+        * dfg/DFGAdaptiveStructureWatchpoint.h: Added.
+        (JSC::DFG::AdaptiveStructureWatchpoint::key):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::handlePutByOffset):
+        (JSC::DFG::ByteCodeParser::check):
+        (JSC::DFG::ByteCodeParser::promoteToConstant):
+        (JSC::DFG::ByteCodeParser::planLoad):
+        (JSC::DFG::ByteCodeParser::load):
+        (JSC::DFG::ByteCodeParser::presenceLike):
+        (JSC::DFG::ByteCodeParser::checkPresenceLike):
+        (JSC::DFG::ByteCodeParser::store):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::emitChecks): Deleted.
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::validateReferences):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        (JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.
+        * dfg/DFGDesiredWatchpoints.cpp:
+        (JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):
+        (JSC::DFG::InferredValueAdaptor::add):
+        (JSC::DFG::AdaptiveStructureWatchpointAdaptor::add):
+        (JSC::DFG::DesiredWatchpoints::DesiredWatchpoints):
+        (JSC::DFG::DesiredWatchpoints::addLazily):
+        (JSC::DFG::DesiredWatchpoints::consider):
+        (JSC::DFG::DesiredWatchpoints::reallyAdd):
+        (JSC::DFG::DesiredWatchpoints::areStillValid):
+        (JSC::DFG::DesiredWatchpoints::dumpInContext):
+        * dfg/DFGDesiredWatchpoints.h:
+        (JSC::DFG::SetPointerAdaptor::add):
+        (JSC::DFG::SetPointerAdaptor::hasBeenInvalidated):
+        (JSC::DFG::SetPointerAdaptor::dumpInContext):
+        (JSC::DFG::InferredValueAdaptor::hasBeenInvalidated):
+        (JSC::DFG::InferredValueAdaptor::dumpInContext):
+        (JSC::DFG::ArrayBufferViewWatchpointAdaptor::hasBeenInvalidated):
+        (JSC::DFG::ArrayBufferViewWatchpointAdaptor::dumpInContext):
+        (JSC::DFG::AdaptiveStructureWatchpointAdaptor::hasBeenInvalidated):
+        (JSC::DFG::AdaptiveStructureWatchpointAdaptor::dumpInContext):
+        (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
+        (JSC::DFG::GenericDesiredWatchpoints::isWatched):
+        (JSC::DFG::GenericDesiredWatchpoints::dumpInContext):
+        (JSC::DFG::DesiredWatchpoints::isWatched):
+        (JSC::DFG::GenericSetAdaptor::add): Deleted.
+        (JSC::DFG::GenericSetAdaptor::hasBeenInvalidated): Deleted.
+        * dfg/DFGDesiredWeakReferences.cpp:
+        (JSC::DFG::DesiredWeakReferences::addLazily):
+        (JSC::DFG::DesiredWeakReferences::contains):
+        * dfg/DFGDesiredWeakReferences.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::clearFlagsOnAllNodes):
+        (JSC::DFG::Graph::watchCondition):
+        (JSC::DFG::Graph::isSafeToLoad):
+        (JSC::DFG::Graph::livenessFor):
+        (JSC::DFG::Graph::tryGetConstantProperty):
+        (JSC::DFG::Graph::visitChildren):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::identifiers):
+        (JSC::DFG::Graph::watchpoints):
+        * dfg/DFGMultiGetByOffsetData.cpp: Added.
+        (JSC::DFG::GetByOffsetMethod::dumpInContext):
+        (JSC::DFG::GetByOffsetMethod::dump):
+        (JSC::DFG::MultiGetByOffsetCase::dumpInContext):
+        (JSC::DFG::MultiGetByOffsetCase::dump):
+        (WTF::printInternal):
+        * dfg/DFGMultiGetByOffsetData.h: Added.
+        (JSC::DFG::GetByOffsetMethod::GetByOffsetMethod):
+        (JSC::DFG::GetByOffsetMethod::constant):
+        (JSC::DFG::GetByOffsetMethod::load):
+        (JSC::DFG::GetByOffsetMethod::loadFromPrototype):
+        (JSC::DFG::GetByOffsetMethod::operator!):
+        (JSC::DFG::GetByOffsetMethod::kind):
+        (JSC::DFG::GetByOffsetMethod::prototype):
+        (JSC::DFG::GetByOffsetMethod::offset):
+        (JSC::DFG::MultiGetByOffsetCase::MultiGetByOffsetCase):
+        (JSC::DFG::MultiGetByOffsetCase::set):
+        (JSC::DFG::MultiGetByOffsetCase::method):
+        * dfg/DFGNode.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMultiGetByOffset):
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess):
+        (JSC::checkObjectPropertyCondition):
+        (JSC::checkObjectPropertyConditions):
+        (JSC::replaceWithJump):
+        (JSC::generateByIdStub):
+        (JSC::actionForCell):
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStub):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::addStructureTransitionCheck): Deleted.
+        (JSC::emitPutTransitionStubAndGetOldStructure): Deleted.
+        * runtime/IntendedStructureChain.cpp: Removed.
+        * runtime/IntendedStructureChain.h: Removed.
+        * runtime/JSCJSValue.h:
+        * runtime/JSObject.cpp:
+        (JSC::throwTypeError):
+        (JSC::JSObject::convertToDictionary):
+        (JSC::JSObject::shiftButterflyAfterFlattening):
+        * runtime/JSObject.h:
+        (JSC::JSObject::flattenDictionaryObject):
+        (JSC::JSObject::convertToDictionary): Deleted.
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        (JSC::normalizePrototypeChainForChainAccess): Deleted.
+        (JSC::isPrototypeChainNormalized): Deleted.
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::slotBase):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::attributeChangeTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::toCacheableDictionaryTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::ensurePropertyReplacementWatchpointSet):
+        (JSC::Structure::startWatchingPropertyForReplacements):
+        (JSC::Structure::didCachePropertyReplacement):
+        (JSC::Structure::dump):
+        * runtime/Structure.h:
+        * runtime/VM.h:
+        * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check-new.js: Added.
+        (foo):
+        (bar):
+        (baz):
+        * tests/stress/multi-get-by-offset-self-or-proto.js: Added.
+        (foo):
+        * tests/stress/replacement-watchpoint-dictionary.js: Added.
+        (foo):
+        * tests/stress/replacement-watchpoint.js: Added.
+        (foo):
+        * tests/stress/undefined-access-dictionary-then-proto-change.js: Added.
+        (foo):
+        * tests/stress/undefined-access-then-proto-change.js: Added.
+        (foo):
+
+2015-08-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        JavascriptCore Crash in JSC::ASTBuilder::Property JSC::Parser<JSC::Lexer<unsigned char> >::parseProperty<JSC::ASTBuilder>(JSC::ASTBuilder&, bool)
+        https://bugs.webkit.org/show_bug.cgi?id=147538
+
+        Reviewed by Geoffrey Garen.
+
+        Due to the order of the ARROWFUNCTION token in JSTokenType enum, it is categorized as the one of the Keyword.
+        As a result, when lexing the property name that can take the keywords, the ARROWFUNCTION token is accidentally accepted.
+        This patch changes the order of the ARROWFUNCTION token in JSTokenType to make it the operator token.
+
+        * parser/ParserTokens.h:
+        * tests/stress/arrow-function-token-is-not-keyword.js: Added.
+        (testSyntaxError):
+
+2015-08-03  Keith Miller  <keith_miller@apple.com>
+
+        Clean up the naming for AST expression generation.
+        https://bugs.webkit.org/show_bug.cgi?id=147581
+
+        Reviewed by Yusuke Suzuki.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createThisExpr):
+        (JSC::ASTBuilder::createSuperExpr):
+        (JSC::ASTBuilder::createNewTargetExpr):
+        (JSC::ASTBuilder::thisExpr): Deleted.
+        (JSC::ASTBuilder::superExpr): Deleted.
+        (JSC::ASTBuilder::newTargetExpr): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createThisExpr):
+        (JSC::SyntaxChecker::createSuperExpr):
+        (JSC::SyntaxChecker::createNewTargetExpr):
+        (JSC::SyntaxChecker::thisExpr): Deleted.
+        (JSC::SyntaxChecker::superExpr): Deleted.
+        (JSC::SyntaxChecker::newTargetExpr): Deleted.
+
+2015-08-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Don't set up the callsite to operationGetByValDefault when the optimization is already done
+        https://bugs.webkit.org/show_bug.cgi?id=147577
+
+        Reviewed by Filip Pizlo.
+
+        operationGetByValDefault should be called only when the IC is not set.
+        operationGetByValString breaks this invariant and `ASSERT(!byValInfo.stubRoutine)` in
+        operationGetByValDefault raises the assertion failure.
+        In this patch, we change the callsite setting up code in operationGetByValString when
+        the IC is already set. And to make the operation's meaning explicitly, we changed the
+        name operationGetByValDefault to operationGetByValOptimize, that is aligned to the
+        GetById case.
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        * tests/stress/operation-get-by-val-default-should-not-called-for-already-optimized-site.js: Added.
+        (hello):
+
+2015-08-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [FTL] Remove unused scripts related to native call inlining
+        https://bugs.webkit.org/show_bug.cgi?id=147448
+
+        Reviewed by Filip Pizlo.
+
+        * build-symbol-table-index.py: Removed.
+        * copy-llvm-ir-to-derived-sources.sh: Removed.
+        * create-llvm-ir-from-source-file.py: Removed.
+        * create-symbol-table-index.py: Removed.
+
+2015-08-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Investigate HashTable::HashTable(const HashTable&) and HashTable::operator=(const HashTable&) performance for hash-based static analyses
+        https://bugs.webkit.org/show_bug.cgi?id=118455
+
+        Reviewed by Filip Pizlo.
+
+        LivenessAnalysisPhase lights up like a christmas tree in profiles.
+
+        This patch cuts its cost by 4.
+        About half of the gains come from removing many rehash() when copying
+        the HashSet.
+        The last quarter is achieved by having a special add() function for initializing
+        a HashSet.
+
+        This makes benchmarks progress by 1-2% here and there. Nothing massive.
+
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::LivenessAnalysisPhase::process):
+        The m_live HashSet is only useful per block. When we are done with it,
+        we can transfer it to liveAtHead to avoid a copy.
+
+2015-08-01  Saam barati  <saambarati1@gmail.com>
+
+        Unreviewed. Remove unintentional "print" statement in test case.
+        https://bugs.webkit.org/show_bug.cgi?id=142567
+
+        * tests/stress/class-syntax-definition-semantics.js:
+        (shouldBeSyntaxError):
+
+2015-07-31  Alex Christensen  <achristensen@webkit.org>
+
+        Prepare for VS2015
+        https://bugs.webkit.org/show_bug.cgi?id=146579
+
+        Reviewed by Jon Honeycutt.
+
+        * heap/Heap.h:
+        Fix compiler error by explicitly casting zombifiedBits to the size of a pointer.
+
+2015-07-31  Saam barati  <saambarati1@gmail.com>
+
+        ES6 class syntax should use block scoping
+        https://bugs.webkit.org/show_bug.cgi?id=142567
+
+        Reviewed by Geoffrey Garen.
+
+        We treat class declarations like we do "let" declarations.
+        The class name is under TDZ until the class declaration
+        statement is evaluated. Class declarations also follow
+        the same rules as "let": No duplicate definitions inside
+        a lexical environment.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createClassDeclStatement):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClassDeclaration):
+        * tests/stress/class-syntax-block-scoping.js: Added.
+        (assert):
+        (truth):
+        (.):
+        * tests/stress/class-syntax-definition-semantics.js: Added.
+        (shouldBeSyntaxError):
+        (shouldNotBeSyntaxError):
+        (truth):
+        * tests/stress/class-syntax-tdz.js:
+        (assert):
+        (shouldThrowTDZ):
+        (truth):
+        (.):
+
+2015-07-31  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement WebAssembly module parser
+        https://bugs.webkit.org/show_bug.cgi?id=147293
+
+        Reviewed by Mark Lam.
+
+        Re-landing after fix for the "..\..\jsc.cpp(46): fatal error C1083: Cannot open
+        include file: 'JSWASMModule.h'" issue on Windows.
+
+        Implement WebAssembly module parser for WebAssembly files produced by pack-asmjs
+        <https://github.com/WebAssembly/polyfill-prototype-1>. This patch only checks
+        the magic number at the beginning of the files. Parsing of the rest will be
+        implemented in a subsequent patch.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionLoadWebAssembly):
+        * parser/SourceProvider.h:
+        (JSC::WebAssemblySourceProvider::create):
+        (JSC::WebAssemblySourceProvider::data):
+        (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::wasmModuleStructure):
+        * wasm/WASMMagicNumber.h: Added.
+        * wasm/WASMModuleParser.cpp: Added.
+        (JSC::WASMModuleParser::WASMModuleParser):
+        (JSC::WASMModuleParser::parse):
+        (JSC::WASMModuleParser::parseModule):
+        (JSC::parseWebAssembly):
+        * wasm/WASMModuleParser.h: Added.
+        * wasm/WASMReader.cpp: Added.
+        (JSC::WASMReader::readUnsignedInt32):
+        (JSC::WASMReader::readFloat):
+        (JSC::WASMReader::readDouble):
+        * wasm/WASMReader.h: Added.
+        (JSC::WASMReader::WASMReader):
+
+2015-07-30  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Add the "wasm" directory to the Additional Include Directories for jsc.exe
+        https://bugs.webkit.org/show_bug.cgi?id=147443
+
+        Reviewed by Mark Lam.
+
+        This patch should fix the "..\..\jsc.cpp(46): fatal error C1083:
+        Cannot open include file: 'JSWASMModule.h'" error in the Windows build.
+
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props:
+
+2015-07-30  Chris Dumez  <cdumez@apple.com>
+
+        Mark more classes as fast allocated
+        https://bugs.webkit.org/show_bug.cgi?id=147440
+
+        Reviewed by Sam Weinig.
+
+        Mark more classes as fast allocated for performance. We heap-allocate
+        objects of those types throughout the code base.
+
+        * API/JSCallbackObject.h:
+        * API/ObjCCallbackFunction.mm:
+        * bytecode/BytecodeKills.h:
+        * bytecode/BytecodeLivenessAnalysis.h:
+        * bytecode/CallLinkStatus.h:
+        * bytecode/FullBytecodeLiveness.h:
+        * bytecode/SamplingTool.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGBlockMap.h:
+        * dfg/DFGInPlaceAbstractState.h:
+        * dfg/DFGThreadData.h:
+        * heap/HeapVerifier.h:
+        * heap/SlotVisitor.h:
+        * parser/Lexer.h:
+        * runtime/ControlFlowProfiler.h:
+        * runtime/TypeProfiler.h:
+        * runtime/TypeProfilerLog.h:
+        * runtime/Watchdog.h:
+
+2015-07-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ArgumentsEliminationPhase should emit a PutStack for all of the GetStacks that the ByteCodeParser emitted
+        https://bugs.webkit.org/show_bug.cgi?id=147433
+        rdar://problem/21668986
+
+        Reviewed by Mark Lam.
+
+        Ideally, the ByteCodeParser would only emit SetArgument nodes for named arguments.  But
+        currently that's not what it does - it emits a SetArgument for every argument that a varargs
+        call may pass.  Each SetArgument gets turned into a GetStack.  This means that if
+        ArgumentsEliminationPhase optimizes away PutStacks for those varargs arguments that didn't
+        get passed or used, we get degenerate IR where we have a GetStack of something that didn't
+        have a PutStack.
+
+        This fixes the bug by removing the code to optimize away PutStacks in
+        ArgumentsEliminationPhase.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * tests/stress/varargs-inlining-underflow.js: Added.
+        (baz):
+        (bar):
+        (foo):
+
+2015-07-29  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        Implement basic types for ECMAScript Internationalization API
+        https://bugs.webkit.org/show_bug.cgi?id=146926
+
+        Reviewed by Benjamin Poulain.
+
+        Adds basic types for ECMA-402 2nd edition, but does not implement the full locale-aware features yet.
+        http://www.ecma-international.org/ecma-402/2.0/ECMA-402.pdf
+
+        * CMakeLists.txt: Added new Intl files.
+        * Configurations/FeatureDefines.xcconfig: Enable INTL.
+        * DerivedSources.make: Added Intl files.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added Intl files.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added Intl files.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Added Intl files.
+        * runtime/CommonIdentifiers.h: Added Collator, NumberFormat, and DateTimeFormat.
+        * runtime/DateConstructor.cpp: Made Date.now public.
+        * runtime/DateConstructor.h: Made Date.now public.
+        * runtime/IntlCollator.cpp: Added.
+        (JSC::IntlCollator::create):
+        (JSC::IntlCollator::createStructure):
+        (JSC::IntlCollator::IntlCollator):
+        (JSC::IntlCollator::finishCreation):
+        (JSC::IntlCollator::destroy):
+        (JSC::IntlCollator::visitChildren):
+        (JSC::IntlCollator::setBoundCompare):
+        (JSC::IntlCollatorFuncCompare): Added placeholder implementation using codePointCompare.
+        * runtime/IntlCollator.h: Added.
+        (JSC::IntlCollator::constructor):
+        (JSC::IntlCollator::boundCompare):
+        * runtime/IntlCollatorConstructor.cpp: Added.
+        (JSC::IntlCollatorConstructor::create):
+        (JSC::IntlCollatorConstructor::createStructure):
+        (JSC::IntlCollatorConstructor::IntlCollatorConstructor):
+        (JSC::IntlCollatorConstructor::finishCreation):
+        (JSC::constructIntlCollator): Added Collator constructor (10.1.2).
+        (JSC::callIntlCollator): Added Collator constructor (10.1.2).
+        (JSC::IntlCollatorConstructor::getConstructData):
+        (JSC::IntlCollatorConstructor::getCallData):
+        (JSC::IntlCollatorConstructor::getOwnPropertySlot):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf): Added placeholder implementation returning [].
+        (JSC::IntlCollatorConstructor::visitChildren):
+        * runtime/IntlCollatorConstructor.h: Added.
+        (JSC::IntlCollatorConstructor::collatorStructure):
+        * runtime/IntlCollatorPrototype.cpp: Added.
+        (JSC::IntlCollatorPrototype::create):
+        (JSC::IntlCollatorPrototype::createStructure):
+        (JSC::IntlCollatorPrototype::IntlCollatorPrototype):
+        (JSC::IntlCollatorPrototype::finishCreation):
+        (JSC::IntlCollatorPrototype::getOwnPropertySlot):
+        (JSC::IntlCollatorPrototypeGetterCompare): Added compare getter (10.3.3)
+        (JSC::IntlCollatorPrototypeFuncResolvedOptions): Added placeholder implementation returning {}.
+        * runtime/IntlCollatorPrototype.h: Added.
+        * runtime/IntlDateTimeFormat.cpp: Added.
+        (JSC::IntlDateTimeFormat::create):
+        (JSC::IntlDateTimeFormat::createStructure):
+        (JSC::IntlDateTimeFormat::IntlDateTimeFormat):
+        (JSC::IntlDateTimeFormat::finishCreation):
+        (JSC::IntlDateTimeFormat::destroy):
+        (JSC::IntlDateTimeFormat::visitChildren):
+        (JSC::IntlDateTimeFormat::setBoundFormat):
+        (JSC::IntlDateTimeFormatFuncFormatDateTime): Added placeholder implementation returning new Date(value).toString().
+        * runtime/IntlDateTimeFormat.h: Added.
+        (JSC::IntlDateTimeFormat::constructor):
+        (JSC::IntlDateTimeFormat::boundFormat):
+        * runtime/IntlDateTimeFormatConstructor.cpp: Added.
+        (JSC::IntlDateTimeFormatConstructor::create):
+        (JSC::IntlDateTimeFormatConstructor::createStructure):
+        (JSC::IntlDateTimeFormatConstructor::IntlDateTimeFormatConstructor):
+        (JSC::IntlDateTimeFormatConstructor::finishCreation):
+        (JSC::constructIntlDateTimeFormat): Added DateTimeFormat constructor (12.1.2).
+        (JSC::callIntlDateTimeFormat): Added DateTimeFormat constructor (12.1.2).
+        (JSC::IntlDateTimeFormatConstructor::getConstructData):
+        (JSC::IntlDateTimeFormatConstructor::getCallData):
+        (JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf): Added placeholder implementation returning [].
+        (JSC::IntlDateTimeFormatConstructor::visitChildren):
+        * runtime/IntlDateTimeFormatConstructor.h: Added.
+        (JSC::IntlDateTimeFormatConstructor::dateTimeFormatStructure):
+        * runtime/IntlDateTimeFormatPrototype.cpp: Added.
+        (JSC::IntlDateTimeFormatPrototype::create):
+        (JSC::IntlDateTimeFormatPrototype::createStructure):
+        (JSC::IntlDateTimeFormatPrototype::IntlDateTimeFormatPrototype):
+        (JSC::IntlDateTimeFormatPrototype::finishCreation):
+        (JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot):
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat): Added format getter (12.3.3).
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions): Added placeholder implementation returning {}.
+        * runtime/IntlDateTimeFormatPrototype.h: Added.
+        * runtime/IntlNumberFormat.cpp: Added.
+        (JSC::IntlNumberFormat::create):
+        (JSC::IntlNumberFormat::createStructure):
+        (JSC::IntlNumberFormat::IntlNumberFormat):
+        (JSC::IntlNumberFormat::finishCreation):
+        (JSC::IntlNumberFormat::destroy):
+        (JSC::IntlNumberFormat::visitChildren):
+        (JSC::IntlNumberFormat::setBoundFormat):
+        (JSC::IntlNumberFormatFuncFormatNumber): Added placeholder implementation returning Number(value).toString().
+        * runtime/IntlNumberFormat.h: Added.
+        (JSC::IntlNumberFormat::constructor):
+        (JSC::IntlNumberFormat::boundFormat):
+        * runtime/IntlNumberFormatConstructor.cpp: Added.
+        (JSC::IntlNumberFormatConstructor::create):
+        (JSC::IntlNumberFormatConstructor::createStructure):
+        (JSC::IntlNumberFormatConstructor::IntlNumberFormatConstructor):
+        (JSC::IntlNumberFormatConstructor::finishCreation):
+        (JSC::constructIntlNumberFormat): Added NumberFormat constructor (11.1.2).
+        (JSC::callIntlNumberFormat): Added NumberFormat constructor (11.1.2).
+        (JSC::IntlNumberFormatConstructor::getConstructData):
+        (JSC::IntlNumberFormatConstructor::getCallData):
+        (JSC::IntlNumberFormatConstructor::getOwnPropertySlot):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf): Added placeholder implementation returning [].
+        (JSC::IntlNumberFormatConstructor::visitChildren):
+        * runtime/IntlNumberFormatConstructor.h: Added.
+        (JSC::IntlNumberFormatConstructor::numberFormatStructure):
+        * runtime/IntlNumberFormatPrototype.cpp: Added.
+        (JSC::IntlNumberFormatPrototype::create):
+        (JSC::IntlNumberFormatPrototype::createStructure):
+        (JSC::IntlNumberFormatPrototype::IntlNumberFormatPrototype):
+        (JSC::IntlNumberFormatPrototype::finishCreation):
+        (JSC::IntlNumberFormatPrototype::getOwnPropertySlot):
+        (JSC::IntlNumberFormatPrototypeGetterFormat): Added format getter (11.3.3).
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions): Added placeholder implementation returning {}.
+        * runtime/IntlNumberFormatPrototype.h: Added.
+        * runtime/IntlObject.cpp:
+        (JSC::IntlObject::create):
+        (JSC::IntlObject::finishCreation): Added Collator, NumberFormat, and DateTimeFormat properties (8.1).
+        (JSC::IntlObject::visitChildren):
+        * runtime/IntlObject.h:
+        (JSC::IntlObject::collatorConstructor):
+        (JSC::IntlObject::collatorPrototype):
+        (JSC::IntlObject::collatorStructure):
+        (JSC::IntlObject::numberFormatConstructor):
+        (JSC::IntlObject::numberFormatPrototype):
+        (JSC::IntlObject::numberFormatStructure):
+        (JSC::IntlObject::dateTimeFormatConstructor):
+        (JSC::IntlObject::dateTimeFormatPrototype):
+        (JSC::IntlObject::dateTimeFormatStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
+2015-07-29  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r187550.
+        https://bugs.webkit.org/show_bug.cgi?id=147420
+
+        Broke Windows build (again) (Requested by smfr on #webkit).
+
+        Reverted changeset:
+
+        "Implement WebAssembly module parser"
+        https://bugs.webkit.org/show_bug.cgi?id=147293
+        http://trac.webkit.org/changeset/187550
+
+2015-07-29  Basile Clement  <basile_clement@apple.com>
+
+        Remove native call inlining
+        https://bugs.webkit.org/show_bug.cgi?id=147417
+
+        Rubber Stamped by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): Deleted.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC): Deleted.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction): Deleted.
+        (JSC::DFG::Node::hasCellOperand): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNativeCallOrConstruct): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::getFunctionBySymbol): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::getModuleByPathForSymbol): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::didOverflowStack): Deleted.
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State): Deleted.
+        * ftl/FTLState.h:
+        * runtime/BundlePath.cpp: Removed.
+        (JSC::bundlePath): Deleted.
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        * runtime/Options.h:
+
+2015-07-29  Basile Clement  <basile_clement@apple.com>
+
+        Unreviewed, skipping a test that is too complex for its own good
+        https://bugs.webkit.org/show_bug.cgi?id=147167
+
+        * tests/stress/math-pow-coherency.js:
+
+2015-07-29  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement WebAssembly module parser
+        https://bugs.webkit.org/show_bug.cgi?id=147293
+
+        Reviewed by Mark Lam.
+
+        Reupload the patch, since r187539 should fix the "Cannot open include file:
+        'JSWASMModule.h'" issue in the Windows build.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionLoadWebAssembly):
+        * parser/SourceProvider.h:
+        (JSC::WebAssemblySourceProvider::create):
+        (JSC::WebAssemblySourceProvider::data):
+        (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::wasmModuleStructure):
+        * wasm/WASMMagicNumber.h: Added.
+        * wasm/WASMModuleParser.cpp: Added.
+        (JSC::WASMModuleParser::WASMModuleParser):
+        (JSC::WASMModuleParser::parse):
+        (JSC::WASMModuleParser::parseModule):
+        (JSC::parseWebAssembly):
+        * wasm/WASMModuleParser.h: Added.
+        * wasm/WASMReader.cpp: Added.
+        (JSC::WASMReader::readUnsignedInt32):
+        (JSC::WASMReader::readFloat):
+        (JSC::WASMReader::readDouble):
+        * wasm/WASMReader.h: Added.
+        (JSC::WASMReader::WASMReader):
+
+2015-07-29  Basile Clement  <basile_clement@apple.com>
+
+        Unreviewed, lower the number of test iterations to prevent timing out on Debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=147167
+
+        * tests/stress/math-pow-coherency.js:
+
+2015-07-28  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Add the "wasm" directory to Visual Studio project files
+        https://bugs.webkit.org/show_bug.cgi?id=147400
+
+        Reviewed by Simon Fraser.
+
+        This patch should fix the "Cannot open include file: 'JSWASMModule.h'" issue
+        in the Windows build.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+
+2015-07-28  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r187531.
+        https://bugs.webkit.org/show_bug.cgi?id=147397
+
+        Broke Windows bild (Requested by smfr on #webkit).
+
+        Reverted changeset:
+
+        "Implement WebAssembly module parser"
+        https://bugs.webkit.org/show_bug.cgi?id=147293
+        http://trac.webkit.org/changeset/187531
+
+2015-07-28  Benjamin Poulain  <bpoulain@apple.com>
+
+        Speed up the Stringifier::toJSON() fast case
+        https://bugs.webkit.org/show_bug.cgi?id=147383
+
+        Reviewed by Andreas Kling.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::toJSONImpl):
+
+2015-07-28  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement WebAssembly module parser
+        https://bugs.webkit.org/show_bug.cgi?id=147293
+
+        Reviewed by Geoffrey Garen.
+
+        Implement WebAssembly module parser for WebAssembly files produced by pack-asmjs
+        <https://github.com/WebAssembly/polyfill-prototype-1>. This patch only checks
+        the magic number at the beginning of the files. Parsing of the rest will be
+        implemented in a subsequent patch.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionLoadWebAssembly):
+        * parser/SourceProvider.h:
+        (JSC::WebAssemblySourceProvider::create):
+        (JSC::WebAssemblySourceProvider::data):
+        (JSC::WebAssemblySourceProvider::WebAssemblySourceProvider):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::wasmModuleStructure):
+        * wasm/WASMMagicNumber.h: Added.
+        * wasm/WASMModuleParser.cpp: Added.
+        (JSC::WASMModuleParser::WASMModuleParser):
+        (JSC::WASMModuleParser::parse):
+        (JSC::WASMModuleParser::parseModule):
+        (JSC::parseWebAssembly):
+        * wasm/WASMModuleParser.h: Added.
+        * wasm/WASMReader.cpp: Added.
+        (JSC::WASMReader::readUnsignedInt32):
+        (JSC::WASMReader::readFloat):
+        (JSC::WASMReader::readDouble):
+        * wasm/WASMReader.h: Added.
+        (JSC::WASMReader::WASMReader):
+
+2015-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Add ENABLE_ES6_MODULES compile time flag with the default value "false"
+        https://bugs.webkit.org/show_bug.cgi?id=147350
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-07-28  Saam barati  <saambarati1@gmail.com>
+
+        Make the type profiler work with lexical scoping and add tests
+        https://bugs.webkit.org/show_bug.cgi?id=145438
+
+        Reviewed by Geoffrey Garen.
+
+        op_profile_type now knows how to resolve variables allocated within
+        the local scope stack. This means it knows how to resolve "let"
+        and "const" variables. Also, some refactoring was done inside
+        the BytecodeGenerator to make writing code to support the type
+        profiler much simpler and clearer.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::addExceptionHandler):
+        (JSC::UnlinkedCodeBlock::exceptionHandler):
+        (JSC::UnlinkedCodeBlock::vm):
+        (JSC::UnlinkedCodeBlock::addArrayProfile):
+        (JSC::UnlinkedCodeBlock::setSymbolTableConstantIndex): Deleted.
+        (JSC::UnlinkedCodeBlock::symbolTableConstantIndex): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitTypeProfilerExpressionInfo):
+        (JSC::BytecodeGenerator::emitProfileType):
+        (JSC::BytecodeGenerator::emitProfileControlFlow):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeForLeftHandSide):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::PrefixNode::emitBracket):
+        (JSC::PrefixNode::emitDot):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::EmptyVarExpression::emitBytecode):
+        (JSC::EmptyLetExpression::emitBytecode):
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        (JSC::BindingNode::bindValue):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_type):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_type):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * tests/typeProfiler/es6-block-scoping.js: Added.
+        (noop):
+        (arr):
+        (wrapper.changeFoo):
+        (wrapper.scoping):
+        (wrapper.scoping2):
+        (wrapper):
+        * tests/typeProfiler/es6-classes.js: Added.
+        (noop):
+        (wrapper.Animal):
+        (wrapper.Animal.prototype.methodA):
+        (wrapper.Dog):
+        (wrapper.Dog.prototype.methodB):
+        (wrapper):
+
+2015-07-28  Saam barati  <saambarati1@gmail.com>
+
+        Implement catch scope using lexical scoping constructs introduced with "let" scoping patch
+        https://bugs.webkit.org/show_bug.cgi?id=146979
+
+        Reviewed by Geoffrey Garen.
+
+        Now that BytecodeGenerator has a notion of local scope depth,
+        we can easily implement a catch scope that doesn't claim that
+        all variables are dynamically scoped. This means that functions
+        that use try/catch can have local variable resolution. This also
+        means that all functions that use try/catch don't have all
+        their variables marked as being captured.
+
+        Catch scopes now behave like a "let" scope (sans the TDZ logic) with a 
+        single variable. Catch scopes are now just JSLexicalEnvironments and the 
+        symbol table backing the catch scope knows that it corresponds to a catch scope.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::isCacheable):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::popLexicalScope):
+        (JSC::BytecodeGenerator::popLexicalScopeInternal):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::resolveType):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitPopWithScope):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        (JSC::BytecodeGenerator::popScopedControlFlowContext):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        (JSC::BytecodeGenerator::emitPopCatchScope):
+        (JSC::BytecodeGenerator::beginSwitch):
+        (JSC::BytecodeGenerator::emitPopWithOrCatchScope): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::lastOpcodeID):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::isCatchScope):
+        (JSC::DebuggerScope::isFunctionNameScope):
+        (JSC::DebuggerScope::isFunctionOrEvalScope):
+        (JSC::DebuggerScope::caughtValue):
+        * debugger/DebuggerScope.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::exceptionOrCaughtValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        * parser/NodeConstructors.h:
+        (JSC::ThrowNode::ThrowNode):
+        (JSC::TryNode::TryNode):
+        (JSC::FunctionParameters::FunctionParameters):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseTryStatement):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        * runtime/JSCatchScope.cpp:
+        * runtime/JSCatchScope.h:
+        (JSC::JSCatchScope::JSCatchScope): Deleted.
+        (JSC::JSCatchScope::create): Deleted.
+        (JSC::JSCatchScope::createStructure): Deleted.
+        * runtime/JSFunctionNameScope.h:
+        (JSC::JSFunctionNameScope::JSFunctionNameScope):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::strictEvalActivationStructure):
+        (JSC::JSGlobalObject::activationStructure):
+        (JSC::JSGlobalObject::functionNameScopeStructure):
+        (JSC::JSGlobalObject::directArgumentsStructure):
+        (JSC::JSGlobalObject::scopedArgumentsStructure):
+        (JSC::JSGlobalObject::catchScopeStructure): Deleted.
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::toThis):
+        * runtime/JSNameScope.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toThis):
+        (JSC::JSObject::isFunctionNameScopeObject):
+        (JSC::JSObject::isCatchScopeObject): Deleted.
+        * runtime/JSObject.h:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::collectVariablesUnderTDZ):
+        (JSC::JSScope::isLexicalScope):
+        (JSC::JSScope::isCatchScope):
+        (JSC::resolveModeName):
+        * runtime/JSScope.h:
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::cloneScopePart):
+        * runtime/SymbolTable.h:
+        * tests/stress/const-semantics.js:
+        (.):
+
+2015-07-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ArgumentsEliminationPhase has a redundant check for inserting CheckInBounds when converting GetByVal to GetStack in the inline non-varargs case
+        https://bugs.webkit.org/show_bug.cgi?id=147373
+
+        Reviewed by Mark Lam.
+
+        The code was doing a check for "index >= inlineCallFrame->arguments.size() - 1" in code where
+        safeToGetStack is true and we aren't in varargs context, but in a non-varargs context,
+        safeToGetStack can only be true if "index < inlineCallFrame->arguments.size() - 1".
+
+        When converting a GetByVal to GetStack, there are three possibilities:
+
+        1) Impossible to convert. This can happen if the GetByVal is out-of-bounds of the things we
+           know to have stored to the stack. For example, if we inline a function that does
+           "arguments[42]" at a call that passes no arguments.
+
+        2) Possible to convert, but we cannot prove statically that the GetByVal was in bounds. This
+           can happen for "arguments[42]" with no inline call frame (since we don't know statically
+           how many arguments we will be passed) or in a varargs call frame.
+
+        3) Possible to convert, and we know statically that the GetByVal is in bounds. This can
+           happen for "arguments[42]" if we have an inline call frame, and it's not a varargs call
+           frame, and we know that the caller passed 42 or more arguments.
+
+        The way the phase handles this is it first determines that we're not in case (1). This is
+        called safeToGetStack. safeToGetStack is true if we have case (2) or (3). For inline call
+        frames that have no varargs, this means that safeToGetStack is true exactly when the GetByVal
+        is in-bounds (i.e. case (3)).
+
+        But the phase was again doing a check for whether the index is in-bounds for non-varargs
+        inline call frames even when safeToGetStack was true. That check is redundant and should be
+        eliminated, since it makes the code confusing.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+
+2015-07-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::PutStackSinkingPhase should be more aggressive about its "no GetStack until put" rule
+        https://bugs.webkit.org/show_bug.cgi?id=147371
+
+        Reviewed by Mark Lam.
+
+        Two fixes:
+
+        - Make ConflictingFlush really mean that you can't load from the stack slot. This means not
+          using ConflictingFlush for arguments.
+
+        - Assert that a GetStack never sees ConflictingFlush.
+
+        * dfg/DFGPutStackSinkingPhase.cpp:
+
+2015-07-28  Basile Clement  <basile_clement@apple.com>
+
+        Misleading error message: "At least one digit must occur after a decimal point"
+        https://bugs.webkit.org/show_bug.cgi?id=146238
+
+        Reviewed by Geoffrey Garen.
+
+        Interestingly, we had a comment explaining what this error message was
+        about that is much clearer than the error message itself. This patch
+        simply replaces the error message with the explanation from the
+        comment.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+
+2015-07-28  Basile Clement  <basile_clement@apple.com>
+
+        Simplify call linking
+        https://bugs.webkit.org/show_bug.cgi?id=147363
+
+        Reviewed by Filip Pizlo.
+
+        Previously, we were passing both the CallLinkInfo and a
+        (CodeSpecializationKind, RegisterPreservationMode) pair to the
+        different call linking slow paths. However, the CallLinkInfo already
+        has all of that information, and we don't gain anything by having them
+        in additional static parameters - except possibly a very small
+        performance gain in presence of inlining. However since those are
+        already slow paths, this performance loss (if it exists) will not be
+        visible in practice.
+
+        This patch removes the various specialized thunks and JIT operations
+        for regular and polymorphic call linking with a single thunk and
+        operation for each case. Moreover, it removes the four specialized
+        virtual call thunks and operations with one virtual call thunk for each
+        call link info, allowing for better branch prediction by the CPU and
+        fixing a pre-existing FIXME.
+
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        (JSC::CallLinkInfo::dummy): Deleted.
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::registerPreservationMode):
+        (JSC::CallLinkInfo::setUpCallFromFTL):
+        (JSC::CallLinkInfo::setSlowStub):
+        (JSC::CallLinkInfo::clearSlowStub):
+        (JSC::CallLinkInfo::slowStub):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * ftl/FTLJSCallBase.cpp:
+        (JSC::FTL::JSCallBase::link):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        (JSC::operationLinkFor): Deleted.
+        (JSC::operationVirtualFor): Deleted.
+        (JSC::operationLinkPolymorphicCallFor): Deleted.
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::linkSlowFor):
+        (JSC::linkFor):
+        (JSC::revertCall):
+        (JSC::unlinkFor):
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        * jit/Repatch.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::linkCallThunkGenerator):
+        (JSC::linkPolymorphicCallThunkGenerator):
+        (JSC::virtualThunkFor):
+        (JSC::linkForThunkGenerator): Deleted.
+        (JSC::linkConstructThunkGenerator): Deleted.
+        (JSC::linkCallThatPreservesRegsThunkGenerator): Deleted.
+        (JSC::linkConstructThatPreservesRegsThunkGenerator): Deleted.
+        (JSC::linkPolymorphicCallForThunkGenerator): Deleted.
+        (JSC::linkPolymorphicCallThatPreservesRegsThunkGenerator): Deleted.
+        (JSC::virtualForThunkGenerator): Deleted.
+        (JSC::virtualCallThunkGenerator): Deleted.
+        (JSC::virtualConstructThunkGenerator): Deleted.
+        (JSC::virtualCallThatPreservesRegsThunkGenerator): Deleted.
+        (JSC::virtualConstructThatPreservesRegsThunkGenerator): Deleted.
+        * jit/ThunkGenerators.h:
+        (JSC::linkThunkGeneratorFor): Deleted.
+        (JSC::linkPolymorphicCallThunkGeneratorFor): Deleted.
+        (JSC::virtualThunkGeneratorFor): Deleted.
+
+2015-07-28  Basile Clement  <basile_clement@apple.com>
+
+        stress/math-pow-with-constants.js fails in cloop
+        https://bugs.webkit.org/show_bug.cgi?id=147167
+
+        Reviewed by Geoffrey Garen.
+
+        Baseline JIT, DFG and FTL are using a fast exponentiation fast path
+        when computing Math.pow() with an integer exponent that is not taken in
+        the LLInt (or the DFG abstract interpreter). This leads to the result
+        of pow changing depending on the compilation tier or the fact that
+        constant propagation kicks in, which is undesirable.
+
+        This patch adds the fast path to the slow operationMathPow in order to
+        maintain an illusion of consistency.
+
+        * runtime/MathCommon.cpp:
+        (JSC::operationMathPow):
+        * tests/stress/math-pow-coherency.js: Added.
+        (pow42):
+        (build42AsDouble.opaqueAdd):
+        (build42AsDouble):
+        (powDouble42):
+        (clobber):
+        (pow42NoConstantFolding):
+        (powDouble42NoConstantFolding):
+
+2015-07-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Show Pseudo Elements in DOM Tree
+        https://bugs.webkit.org/show_bug.cgi?id=139612
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/DOM.json:
+        Add new properties to DOMNode if it is a pseudo element or if it has
+        pseudo element children. Add new events for if a pseudo element is
+        added or removed dynamically to an existing DOMNode.
+
+2015-07-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Add logging when executable code gets deallocated
+        https://bugs.webkit.org/show_bug.cgi?id=147355
+
+        Reviewed by Mark Lam.
+
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::~JITCode): Print something when this is freed.
+        * jit/JITCode.cpp:
+        (JSC::JITCodeWithCodeRef::~JITCodeWithCodeRef): Print something when this is freed.
+
+2015-07-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::safeToExecute() cases for GetByOffset/PutByOffset don't handle clobbered structure abstract values correctly
+        https://bugs.webkit.org/show_bug.cgi?id=147354
+
+        Reviewed by Michael Saboff.
+
+        If m_structure.isClobbered(), it means that we had a side effect that clobbered
+        the abstract value but it may recover back to its original value at the next
+        invalidation point. Since the invalidation point hasn't been reached yet, we need
+        to conservatively treat the clobbered state as if it was top. At the invalidation
+        point, the clobbered set will return back to being unclobbered.
+
+        In addition to fixing the bug, this introduces isInfinite(), which should be used
+        in places where it's tempting to just use isTop().
+
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute): Fix the bug.
+        * dfg/DFGStructureAbstractValue.cpp:
+        (JSC::DFG::StructureAbstractValue::contains): Switch to using isInfinite().
+        (JSC::DFG::StructureAbstractValue::isSubsetOf): Switch to using isInfinite().
+        (JSC::DFG::StructureAbstractValue::isSupersetOf): Switch to using isInfinite().
+        (JSC::DFG::StructureAbstractValue::overlaps): Switch to using isInfinite().
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::isFinite): New convenience method.
+        (JSC::DFG::StructureAbstractValue::isInfinite): New convenience method.
+        (JSC::DFG::StructureAbstractValue::onlyStructure): Switch to using isInfinite().
+
+2015-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.enumerate
+        https://bugs.webkit.org/show_bug.cgi?id=147347
+
+        Reviewed by Sam Weinig.
+
+        This patch implements Reflect.enumerate.
+        It returns the iterator that iterates the enumerable keys of the given object.
+        It follows the for-in's enumeration order.
+
+        To implement it, we write down the same logic to the for-in's enumeration code in C++.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::propertyNameIteratorStructure):
+        * runtime/JSPropertyNameIterator.cpp: Added.
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::clone):
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::finishCreation):
+        (JSC::JSPropertyNameIterator::visitChildren):
+        (JSC::JSPropertyNameIterator::next):
+        (JSC::propertyNameIteratorFuncNext):
+        * runtime/JSPropertyNameIterator.h: Added.
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectEnumerate):
+        * tests/stress/reflect-enumerate.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.preventExtensions
+        https://bugs.webkit.org/show_bug.cgi?id=147331
+
+        Reviewed by Sam Weinig.
+
+        Implement Reflect.preventExtensions.
+        This is different from Object.preventExensions.
+
+        1. When preventExtensions is called onto the non-object, it raises the TypeError.
+        2. Reflect.preventExtensions does not raise the TypeError when the preventExtensions operation is failed.
+
+        For the (2) case, since there is no Proxy implementation currently, Reflect.preventExtensions always succeed.
+
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectPreventExtensions):
+        * tests/stress/reflect-prevent-extensions.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-07-27  Alex Christensen  <achristensen@webkit.org>
+
+        Use Ninja on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=147228
+
+        Reviewed by Martin Robinson.
+
+        * CMakeLists.txt:
+        Set the working directory when generating LowLevelInterpreterWin.asm to put LowLevelInterpreterWin.asm.sym in the right place.
+
+2015-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        SparseValueMap check is skipped when the butterfly's vectorLength is larger than the access-requested index
+        https://bugs.webkit.org/show_bug.cgi?id=147265
+
+        Reviewed by Geoffrey Garen.
+
+        JSObject's vector holds the indexed values and we leverage it to represent stored values and holes.
+        By checking that the given index is in-bound of the vector's length, we can look up the property fast.
+        And for the sparse array, we have also the separated SparseValueMap to hold the pairs.
+        And we need to take care that the length of the vector should not overlap the indices stored in the SparseValueMap.
+
+        The vector only holds the pure JS values to avoid additional checking for accessors when looking up the value
+        from the vector. To achieve this, we also store the accessors (and attributed properties) to SparseValueMap
+        even the index is less than MIN_SPARSE_ARRAY_INDEX.
+
+        As a result, if the length of the vector overlaps the indices of the accessors stored in the SparseValueMap,
+        we accidentally skip the phase looking up from the SparseValueMap. Instead, we just load from the vector and
+        if the loaded value is an array hole, we decide the given object does not have the value for the given index.
+
+        This patch fixes the problem.
+        When defining the attributed value that index is smaller than the length of the vector, we throw away the vector
+        and change the object to DictionaryIndexingMode. Since we can assume that indexed accessors rarely exist in
+        practice, we expect this does not hurt the performance while keeping the fast property access system without
+        checking the sparse map.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        * tests/stress/sparse-map-non-overlapping.js: Added.
+        (shouldBe):
+        (testing):
+        (object.get 1000):
+        * tests/stress/sparse-map-non-skip-getter-overriding.js: Added.
+        (shouldBe):
+        (obj.get 1):
+        (testing):
+        * tests/stress/sparse-map-non-skip.js: Added.
+        (shouldBe):
+        (testing):
+        (testing2):
+        (.get for):
+
+2015-07-27  Saam barati  <saambarati1@gmail.com>
+
+        Reduce execution time for "let" and "const" tests
+        https://bugs.webkit.org/show_bug.cgi?id=147291
+
+        Reviewed by Geoffrey Garen.
+
+        We don't need to loop so many times for things that will not make it 
+        into the DFG.  Also, we can loop a lot less for almost all the tests 
+        because they're mostly testing the bytecode generator.
+
+        * tests/stress/const-and-with-statement.js:
+        * tests/stress/const-exception-handling.js:
+        * tests/stress/const-loop-semantics.js:
+        * tests/stress/const-not-strict-mode.js:
+        * tests/stress/const-semantics.js:
+        * tests/stress/const-tdz.js:
+        * tests/stress/lexical-let-and-with-statement.js:
+        * tests/stress/lexical-let-exception-handling.js:
+        (assert):
+        * tests/stress/lexical-let-loop-semantics.js:
+        (assert):
+        (shouldThrowTDZ):
+        (.):
+        * tests/stress/lexical-let-not-strict-mode.js:
+        * tests/stress/lexical-let-semantics.js:
+        (.):
+        * tests/stress/lexical-let-tdz.js:
+        (shouldThrowTDZ):
+        (.):
+
+2015-07-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Rename PropertyNameMode::Both to PropertyNameMode::StringsAndSymbols
+        https://bugs.webkit.org/show_bug.cgi?id=147311
+
+        Reviewed by Sam Weinig.
+
+        To make the meaning clear in the user side (PropertyNameArray array(exec, PropertyNameMode::StringsAndSymbols)),
+        this patch renames PropertyNameMode::Both to PropertyNameMode::StringsAndSymbols.
+
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
+        * runtime/EnumerationMode.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ownEnumerablePropertyKeys):
+        (JSC::defineProperties):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::ownPropertyKeys):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectOwnKeys):
+
+2015-07-27  Saam barati  <saambarati1@gmail.com>
+
+        Added a comment explaining that all "addVar()"s should happen before
+        emitting bytecode for a function's default parameter expressions
+
+        Rubber Stamped by Mark Lam.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+
+2015-07-26  Sam Weinig  <sam@webkit.org>
+
+        Add missing builtin files to the JavaScriptCore Xcode project
+        https://bugs.webkit.org/show_bug.cgi?id=147312
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add missing files.
+
+2015-07-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.isExtensible
+        https://bugs.webkit.org/show_bug.cgi?id=147308
+
+        Reviewed by Sam Weinig.
+
+        This patch implements Reflect.isExtensible.
+        It is similar to Object.isExtensible.
+        The difference is that it raises an error if the first argument is not an object.
+
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectIsExtensible):
+        * tests/stress/reflect-is-extensible.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-07-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, fix the debug build due to touching the non-declared variable in ASSERT
+        https://bugs.webkit.org/show_bug.cgi?id=147307
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ownPropertyKeys):
+
+2015-07-25  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.ownKeys
+        https://bugs.webkit.org/show_bug.cgi?id=147307
+
+        Reviewed by Sam Weinig.
+
+        This patch implements Reflect.ownKeys.
+        In this patch, we refactor the existing code to list up own keys in the object.
+        Such code is used by Object.getOwnPropertyNames, Object.getOwnPropertyKeys, Object.keys and @ownEnumerableKeys.
+        We factor out the listing up own keys as ownPropertyKeys function and also use it in Reflect.ownKeys.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorGetOwnPropertySymbols):
+        (JSC::objectConstructorKeys):
+        (JSC::ownEnumerablePropertyKeys):
+        (JSC::ownPropertyKeys):
+        * runtime/ObjectConstructor.h:
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectOwnKeys):
+        * tests/stress/reflect-own-keys.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (shouldBeArray):
+
+2015-07-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.apply
+        https://bugs.webkit.org/show_bug.cgi?id=147306
+
+        Reviewed by Sam Weinig.
+
+        Implement Reflect.apply.
+        The large part of this can be implemented by the @apply builtin annotation.
+        The only thing which is different from the Funciton.prototype.apply is the third parameter,
+        "argumentsList" is needed to be an object.
+
+        * builtins/ReflectObject.js:
+        (apply):
+        (deleteProperty):
+        * runtime/ReflectObject.cpp:
+        * tests/stress/reflect-apply.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (get shouldThrow):
+        (.get shouldThrow):
+        (get var.array.get length):
+        (get var.array.get 0):
+        (.get var):
+        * tests/stress/reflect-delete-property.js:
+
+2015-07-25  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Add Reflect namespace and add Reflect.deleteProperty
+        https://bugs.webkit.org/show_bug.cgi?id=147287
+
+        Reviewed by Sam Weinig.
+
+        This patch just creates the namespace for ES6 Reflect APIs.
+        And add template files to implement the actual code.
+
+        Not to keep the JS generated properties C array empty,
+        we added one small method, Reflect.deleteProperty in this patch.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ReflectObject.js: Added.
+        (deleteProperty):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/ReflectObject.cpp: Added.
+        (JSC::ReflectObject::ReflectObject):
+        (JSC::ReflectObject::finishCreation):
+        (JSC::ReflectObject::getOwnPropertySlot):
+        * runtime/ReflectObject.h: Added.
+        (JSC::ReflectObject::create):
+        (JSC::ReflectObject::createStructure):
+        * tests/stress/reflect-delete-property.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-07-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Avoid 2 times name iteration in Object.assign
+        https://bugs.webkit.org/show_bug.cgi?id=147268
+
+        Reviewed by Geoffrey Garen.
+
+        Object.assign calls Object.getOwnPropertyNames & Object.getOwnPropertySymbols to collect all the names.
+        But exposing the private API that collects both at the same time makes the API efficient when the given Object has so many non-indexed properties.
+        Since Object.assign is so generic API (some form of utility API), the form of the given Object is not expected.
+        So the taken object may have so many non-indexed properties.
+
+        In this patch, we introduce `ownEnumerablePropertyKeys` private function.
+        It is minor changed version of `[[OwnPropertyKeys]]` in the ES6 spec;
+        It only includes enumerable properties.
+
+        By filtering out the non-enumerable properties in the exposed private function,
+        we avoid calling @objectGetOwnPropertyDescriptor for each property at the same time.
+
+        * builtins/ObjectConstructor.js:
+        (assign):
+        * runtime/CommonIdentifiers.h:
+        * runtime/EnumerationMode.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ownEnumerablePropertyKeys):
+        * runtime/ObjectConstructor.h:
+        * tests/stress/object-assign-enumerable.js: Added.
+        (shouldBe):
+        * tests/stress/object-assign-order.js: Added.
+        (shouldBe):
+
+2015-07-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Remove runtime flags for symbols
+        https://bugs.webkit.org/show_bug.cgi?id=147246
+
+        Reviewed by Alex Christensen.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Deleted.
+        * runtime/JSGlobalObject.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/RuntimeFlags.h:
+
+2015-07-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Object.getOwnPropertySymbols on large list takes very long
+        https://bugs.webkit.org/show_bug.cgi?id=146137
+
+        Reviewed by Mark Lam.
+
+        Before this patch, Object.getOwnPropertySymbols collects all the names including strings.
+        And after it's done, filter the names to only retrieve the symbols.
+        But it's so time consuming if the given object is a large non-holed array since it has
+        many indexed properties and all the indexes have to be converted to uniqued_strings and
+        added to the collection of property names (though they may not be of the requested type
+        and will be filtered out later)
+
+        This patch introduces PropertyNameMode.
+        We leverage this mode in 2 places.
+
+        1. PropertyNameArray side
+        It is set in PropertyNameArray and it filters the incoming added identifiers based on the mode.
+        It ensures that PropertyNameArray doesn't become so large in the pathological case.
+        And it ensures that non-expected typed keys by the filter (Symbols or Strings) are never added
+        to the property name array collections.
+        However it does not solve the whole problem because the huge array still incurs the many
+        "indexed property to uniqued string" conversion and the large iteration before adding the keys
+        to the property name array.
+
+        2. getOwnPropertyNames side
+        So we can use the PropertyNameMode in the caller side (getOwnPropertyNames) as a **hint**.
+        When the large iteration may occur, the caller side can use the PropertyNameMode as a hint to
+        avoid the iteration.
+        But we cannot exclusively rely on these caller side checks because it would require that we
+        exhaustively add the checks to all custom implementations of getOwnPropertyNames as well.
+        This process requires manual inspection of many pieces of code, and is error prone. Instead,
+        we only apply the caller side check in a few strategic places where it is known to yield
+        performance benefits; and we rely on the filter in PropertyNameArray::add() to reject the wrong
+        types of properties for all other calls to PropertyNameArray::add().
+
+        In this patch, there's a concept in use that is not clear just from reading the code, and hence
+        should be documented here. When selecting the PropertyNameMode for the PropertyNameArray to be
+        instantiated, we apply the following logic:
+
+        1. Only JavaScriptCore code is aware of ES6 Symbols.
+        We can assume that pre-existing external code that interfaces JSC are only looking for string named properties. This includes:
+            a. WebCore bindings
+            b. Serializer bindings
+            c. NPAPI bindings
+            d. Objective C bindings
+        2. In JSC, code that compute object storage space needs to iterate both Symbol and String named properties. Hence, use PropertyNameMode::Both.
+        3. In JSC, ES6 APIs that work with Symbols should use PropertyNameMode::Symbols.
+        4. In JSC, ES6 APIs that work with String named properties should use PropertyNameMode::Strings.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCopyPropertyNames):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
+        * runtime/EnumerationMode.h:
+        (JSC::EnumerationMode::EnumerationMode):
+        (JSC::EnumerationMode::includeSymbolProperties): Deleted.
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::getOwnPropertyNames):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertyNames):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyNames):
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::create):
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::propertyNameEnumerator):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorGetOwnPropertySymbols):
+        (JSC::objectConstructorKeys):
+        (JSC::defineProperties):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::mode):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::add):
+        (JSC::PropertyNameArray::isUidMatchedToTypeMode):
+        (JSC::PropertyNameArray::includeSymbolProperties):
+        (JSC::PropertyNameArray::includeStringProperties):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getPropertyNamesFromStructure):
+
+2015-07-24  Saam barati  <saambarati1@gmail.com>
+
+        [ES6] Add support for default parameters
+        https://bugs.webkit.org/show_bug.cgi?id=38409
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements ES6 default parameters according to the ES6
+        specification. This patch builds off the components introduced with 
+        "let" scoping and parsing function parameters in the same parser
+        arena as the function itself. "let" scoping allows functions with default 
+        parameter values to place their parameters under the TDZ. Parsing function
+        parameters in the same parser arena allows the FunctionParameters AST node
+        refer to ExpressionNodes.
+
+        The most subtle part of this patch is how we allocate lexical environments
+        when functions have default parameter values. If a function has default
+        parameter values then there must be a separate lexical environment for
+        its parameters. Then, the function's "var" lexical environment must have
+        the parameter lexical environment as its parent. The BytecodeGenerator
+        takes great care to not allocate the "var" lexical environment before its
+        really needed.
+
+        The "arguments" object for a function with default parameters will never be 
+        a mapped arugments object. It will always be a cloned arugments object.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::~BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeNextParameter):
+        (JSC::BytecodeGenerator::initializeVarLexicalEnvironment):
+        (JSC::BytecodeGenerator::visibleNameForParameter):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::popLexicalScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::lastOpcodeID):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionNode::emitBytecode):
+        * jit/JITOperations.cpp:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createElementList):
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::appendParameter):
+        (JSC::ASTBuilder::createClause):
+        (JSC::ASTBuilder::createClauseList):
+        * parser/Nodes.h:
+        (JSC::FunctionParameters::size):
+        (JSC::FunctionParameters::at):
+        (JSC::FunctionParameters::hasDefaultParameterValues):
+        (JSC::FunctionParameters::append):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createElementList):
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::appendParameter):
+        (JSC::SyntaxChecker::createClause):
+        (JSC::SyntaxChecker::createClauseList):
+        * tests/stress/es6-default-parameters.js: Added.
+        (assert):
+        (shouldThrow):
+        (shouldThrowSyntaxError):
+        (shouldThrowTDZ):
+        (basic):
+        (basicFunctionCaptureInDefault.basicFunctionCaptureInDefault.basicCaptured):
+        (basicCaptured.basicCaptured.tricky):
+        (strict):
+        (playground):
+        (scoping):
+        (augmentsArguments1):
+        (augmentsArguments2):
+        (augmentsArguments3):
+        (augmentsArguments4):
+        (augmentsArguments5):
+
+2015-07-24  Xabier Rodriguez Calvar  <calvaris@igalia.com>
+
+        Remove JS Promise constructor unused piece of code
+        https://bugs.webkit.org/show_bug.cgi?id=147262
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise): Deleted.
+        * runtime/JSPromiseConstructor.h: Removed JSC::constructPromise.
+
+2015-07-24  Mark Lam  <mark.lam@apple.com>
+
+        Add WASM files to vcxproj files.
+        https://bugs.webkit.org/show_bug.cgi?id=147264
+
+        Reviewed by Geoffrey Garen.
+
+        This is a follow up to http://trac.webkit.org/changeset/187254 where WASM files
+        were introduced but were not able to be added to the vcxproj files yet.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-07-23  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::safeToExecute() is wrong for MultiGetByOffset, doesn't consider the structures of the prototypes that get loaded from
+        https://bugs.webkit.org/show_bug.cgi?id=147250
+
+        Reviewed by Geoffrey Garen.
+        
+        This fixes a nasty - but currently benign - bug in DFG::safeToExecute(). That function
+        will tell you if hoisting a node to some point is safe in the sense that the node will
+        not crash the VM if it executes at that point. A node may be unsafe to execute if we
+        cannot prove that at that point, the memory it is loading is not garbage. This is a
+        necessarily loose notion - for example it's OK to hoist a load if we haven't proved
+        that the load makes semantic sense at that point, since anyway the place where the node
+        did get used will still be guarded by any such semantic checks. But because we may also
+        hoist uses of the load, we need to make sure that it doesn't produce a garbage value.
+        Also, we need to ensure that the load won't trap. Hence safeToExecute() returns true
+        anytime we can be sure that a node will not produce a garbage result (i.e. a malformed
+        JSValue or object pointer) and will not trap when executed at the point in question.
+        
+        The bug is that this verification isn't performed for the loads from prototypes inside
+        MultiGetByOffset. DFG::ByteCodeParser will guard MultiGetByOffset with CheckStructure's
+        on the prototypes. So, hypothetically, you might end up hoisting a MultiGetByOffset
+        above those structure checks, which would mean that we might load a value from a memory
+        location without knowing that the location is valid. It might then return the value
+        loaded.
+        
+        This never happens in practice. Those structure checks are more hoistable that the
+        MultiGetByOffset, since they read a strict subset of the MultiGetByOffset's abstract
+        heap reads. Also, we hoist in program order. So, those CheckStructure's will always be
+        hoisted before the MultiGetByOffset gets hoisted.
+        
+        But we should fix this anyway. DFG::safeToExecute() has a clear definition of what a
+        "true" return means for IR transformations, and it fails in satisfying that definition
+        for MultiGetByOffset.
+        
+        There are various approaches we can use for making this safe. I considered two:
+        
+        1) Have MultiGetByOffset refer to the prototypes it is loading from in IR, so that we
+           can check if it's safe to load from them.
+        
+        2) Turn off MultiGetByOffset hoisting when it will emit loads from prototypes, and the
+           prototype structure isn't being watched.
+        
+        I ended up using (2), because it will be the most natural solution once I finish
+        https://bugs.webkit.org/show_bug.cgi?id=146929. Already now, it's somewhat more natural
+        than (1) since that requires more extensive IR changes. Also, (2) will give us what we
+        want in *most* cases: we will usually watch the prototype structure, and we will
+        usually constant-fold loads from prototypes. Both of these usually-true things would
+        have to become false for MultiGetByOffset hoisting to be disabled by this change.
+        
+        This change also adds my attempt at a test, though it's not really a test of this bug.
+        This bug is currently benign. But, the test does at least trigger the logic to run,
+        which is better than nothing.
+
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * tests/stress/multi-get-by-offset-hoist-around-structure-check.js: Added.
+        (foo):
+
+2015-07-23  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement WebAssembly modules
+        https://bugs.webkit.org/show_bug.cgi?id=147222
+
+        Reviewed by Filip Pizlo.
+
+        Make JSWASMModule inherit from JSDestructibleObject so that the destructor is called.
+
+        * wasm/JSWASMModule.h:
+
+2015-07-23  Alex Christensen  <achristensen@webkit.org>
+
+        Remove compile and runtime flags for promises.
+        https://bugs.webkit.org/show_bug.cgi?id=147244
+
+        Reviewed by Yusuke Suzuki.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::JSCallbackObject):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        * Configurations/FeatureDefines.xcconfig:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::promiseConstructor):
+        (JSC::JSGlobalObject::nullGetterFunction):
+        (JSC::JSGlobalObject::nullSetterFunction):
+        (JSC::JSGlobalObject::applyFunction):
+        (JSC::JSGlobalObject::definePropertyFunction):
+        (JSC::JSGlobalObject::arrayProtoValuesFunction):
+        (JSC::JSGlobalObject::initializePromiseFunction):
+        (JSC::JSGlobalObject::newPromiseDeferredFunction):
+        (JSC::JSGlobalObject::throwTypeErrorGetterSetter):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::errorPrototype):
+        (JSC::JSGlobalObject::iteratorPrototype):
+        (JSC::JSGlobalObject::promisePrototype):
+        (JSC::JSGlobalObject::debuggerScopeStructure):
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::iteratorResultStructure):
+        (JSC::JSGlobalObject::iteratorResultStructureOffset):
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure):
+        (JSC::JSGlobalObject::promiseStructure):
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::result):
+        * runtime/JSPromise.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::visitChildren):
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::getOwnPropertySlot):
+        * runtime/JSPromisePrototype.h:
+        * runtime/RuntimeFlags.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2015-07-23  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Implement WebAssembly modules
+        https://bugs.webkit.org/show_bug.cgi?id=147222
+
+        Reviewed by Mark Lam.
+
+        Introducing the boilerplate data structure for the WebAssembly module.
+        WebAssembly functionality will be added in a subsequent patch.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wasm/JSWASMModule.cpp: Added.
+        (JSC::JSWASMModule::visitChildren):
+        * wasm/JSWASMModule.h: Added.
+        (JSC::JSWASMModule::create):
+        (JSC::JSWASMModule::createStructure):
+        (JSC::JSWASMModule::JSWASMModule):
+
+2015-07-23  Devin Rousso  <drousso@apple.com>
+
+        Web Inspector: Add a function to CSSCompletions to get a list of supported system fonts
+        https://bugs.webkit.org/show_bug.cgi?id=147009
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/protocol/CSS.json: Added getSupportedSystemFontFamilyNames function.
+
+2015-07-22  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Add ENABLE_WEBASSEMBLY feature flag for WebAssembly
+        https://bugs.webkit.org/show_bug.cgi?id=147212
+
+        Reviewed by Filip Pizlo.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Simplify DFG::DesiredIdentifiers and make it possible to turn a UniquedStringImpl* into an identifierNumber at any time
+        https://bugs.webkit.org/show_bug.cgi?id=147218
+
+        Reviewed by Sam Weinig.
+        
+        I want to be able to take a UniquedStringImpl* and turn it into an identifierNumber at
+        various points in my work on https://bugs.webkit.org/show_bug.cgi?id=146929. Currently,
+        most Nodes that deal with identifiers use identifierNumbers and you can only create an
+        identifierNumber in BytecodeGenerator. DFG::ByteCodeParser does sort of have the
+        ability to create new identifierNumbers when inlining - it takes the inlined code's
+        identifiers and either gives them new numbers or reuses numbers from the enclosing
+        code.
+        
+        This patch takes that basic functionality and puts it in
+        DFG::DesiredIdentifiers::ensure(). Anyone can call this at any time to turn a
+        UniquedStringImpl* into an identifierNumber. This data structure is already used by
+        Plan to properly install any newly created identifier table entries into the CodeBlock.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::noticeArgumentsUse):
+        (JSC::DFG::ByteCodeParser::linkBlocks):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::buildOperandMapsIfNecessary): Deleted.
+        * dfg/DFGDesiredIdentifiers.cpp:
+        (JSC::DFG::DesiredIdentifiers::DesiredIdentifiers):
+        (JSC::DFG::DesiredIdentifiers::numberOfIdentifiers):
+        (JSC::DFG::DesiredIdentifiers::ensure):
+        (JSC::DFG::DesiredIdentifiers::at):
+        (JSC::DFG::DesiredIdentifiers::addLazily): Deleted.
+        * dfg/DFGDesiredIdentifiers.h:
+
+2015-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Simplify things like CompareEq(@x,@x)
+        https://bugs.webkit.org/show_bug.cgi?id=145850
+
+        Reviewed by Sam Weinig.
+        
+        This simplifies x==x to true, except in cases where x might be a double (in which case this
+        might still be false if x is NaN).
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * tests/stress/nan-equal-untyped.js: Added.
+        (foo):
+        (test):
+        * tests/stress/nan-equal.js: Added.
+        (foo):
+
+2015-07-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Timeline should immediately start moving play head when starting a new recording
+        https://bugs.webkit.org/show_bug.cgi?id=147210
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+        Add timestamps to recordingStarted and recordingStopped events.
+
+2015-07-22  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introducing construct ability into JS executables
+        https://bugs.webkit.org/show_bug.cgi?id=147183
+
+        Reviewed by Geoffrey Garen.
+
+        Decouple the construct ability from the builtin functions.
+        Currently, all builtin functions are not constructors after r182995.
+        In that patch, when the given function is builtin JS function, we recognize it as the non-constructor function.
+
+        But, we need to relax it to implement some constructors in builtins JS.
+        By decoupling the construct ability from whether the function is builtin or not, we can provide
+
+        1. constructors written in builtin JS
+        2. non-constructors in normal JS functions
+
+        (1) is needed for Promise constructor.
+        And (2) is needed for method functions and arrow functions.
+
+        This patch introduces ConstructAbility into the unlinked function executables.
+        It holds whether the given JS function has the construct ability or not.
+        By leveraging this, this patch disables the construct ability of the method definitions, setters, getters and arrow functions.
+
+        And at the same time, this patch introduces the annotation for constructor in builtin JS.
+        We can define the function as follows,
+
+            constructor Promise(executor)
+            {
+                ...
+            }
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor):
+        (JSC::BuiltinExecutables::createExecutableInternal):
+        * builtins/BuiltinExecutables.h:
+        * builtins/Iterator.prototype.js:
+        (symbolIterator):
+        (SymbolIterator): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * generate-js-builtins:
+        (getCopyright):
+        (Function):
+        (Function.__init__):
+        (Function.mangleName):
+        (getFunctions):
+        (mangleName): Deleted.
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CommonIdentifiers.h:
+        * runtime/ConstructAbility.h: Copied from Source/JavaScriptCore/builtins/Iterator.prototype.js.
+        * runtime/Executable.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getConstructData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * tests/stress/non-constructors.js: Added.
+        (shouldThrow):
+        (.prototype.method):
+        (.prototype.get getter):
+        (.prototype.set setter):
+        (.method):
+        (.get shouldThrow):
+        (.set shouldThrow):
+        (set var.test.get getter):
+        (set var.test.set setter):
+        (set var.test.normal):
+        (.set var):
+        (.set new):
+
+2015-07-22  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [JSC] Enable exception fuzzing for GCC too
+        https://bugs.webkit.org/show_bug.cgi?id=146831
+
+        Reviewed by Darin Adler.
+
+        * jit/JITOperations.cpp:
+
+2015-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Fixed pool allocation should always be aligned
+        https://bugs.webkit.org/show_bug.cgi?id=147201
+
+        Reviewed by Simon Fraser.
+        
+        Passing an unaligned size to the allocator can cause asserts or even worse things. The
+        Options reservation value isn't going to be aligned.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+
+2015-07-22  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Enable STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE for GCC
+        https://bugs.webkit.org/show_bug.cgi?id=146829
+
+        Reviewed by Brent Fulgham.
+
+        * heap/GCAssertions.h:
+
+2015-07-22  Alex Christensen  <achristensen@webkit.org>
+
+        Fix quirks in CMake build on Mac and Windows
+        https://bugs.webkit.org/show_bug.cgi?id=147174
+
+        Reviewed by Gyuyoung Kim.
+
+        * PlatformMac.cmake:
+        Add JSRemoteInspector.cpp and remove semicolon from command to make it actually run.
+
+2015-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Add newTarget accessor to JS constructor written in C++
+        https://bugs.webkit.org/show_bug.cgi?id=147160
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds `ExecState#newTarget()` which returns `new.target` defined in ECMA262 6th.
+        It enables some C++ constructors (like Intl.XXX constructors) to leverage this to complete
+        its implementation.
+
+        When the constructor is called, |this| in the arguments is used for storing new.target instead.
+        So by adding the accessor for |this|, JS constructor written in C++ can access new.target.
+
+        And at the same time, this patch extends the existing `construct` to accept new.target value.
+        It is corresponding to the spec's Construct abstract operation.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::newTarget):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeConstruct):
+        * interpreter/Interpreter.h:
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        (JSC::construct):
+
+2015-07-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix a lot of tests. Need to initialize WTF threading sooner.
+
+        * jsc.cpp:
+        (main):
+
+2015-07-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Fixed VM pool allocation should have a reserve for allocations that cannot fail
+        https://bugs.webkit.org/show_bug.cgi?id=147154
+        rdar://problem/21847618
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds the notion of a JIT pool reserve fraction. Some fraction, currently 1/4, of
+        the JIT pool is reserved for allocations that cannot fail. It makes sense to make this
+        a fraction rather than a constant because each allocation that can fail may cause some
+        number of allocations that cannot fail (for example, the OSR exit thunks that we
+        compile when we exit from some CodeBlock cannot fail).
+        
+        I've tested this by adding a test mode where we artificially limit the JIT pool size.
+        Prior to the fix, we had >20 failures. Now we have none.
+
+        * heap/GCLogging.cpp:
+        (WTF::printInternal): I needed a dump method on Options members when debugging this.
+        * heap/GCLogging.h:
+        * jit/ExecutableAllocator.h: Raise the ARM64 limit to 32MB because 16MB is cutting it too close.
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): Add the ability to artificially limit JIT pool size for testing.
+        (JSC::ExecutableAllocator::memoryPressureMultiplier): Implement the reserve when computing memory pressure for JIT tier-up heuristics.
+        (JSC::ExecutableAllocator::allocate): Implement the reserve when allocating can-fail things.
+        * jsc.cpp: Rewire some options parsing so that CommandLine happens before we create the JIT pool.
+        (main):
+        (CommandLine::parseArguments):
+        (jscmain):
+        * runtime/Options.cpp: 
+        (JSC::OptionRange::dump): I needed a dump method on Options members when debugging this.
+        (JSC::Options::initialize): This can now be called more than once.
+        * runtime/Options.h:
+
+2015-07-21  Saam barati  <saambarati1@gmail.com>
+
+        ObjectPatternNode's entry should use "const Identifier&" instead of "Identifier"
+        https://bugs.webkit.org/show_bug.cgi?id=147156
+
+        Reviewed by Andreas Kling.
+
+        * parser/Nodes.h:
+
+2015-07-21  Basile Clement  <basile_clement@apple.com>
+
+        Object allocation sinking phase is performing needless HashMap copies
+        https://bugs.webkit.org/show_bug.cgi?id=147159
+
+        Reviewed by Geoffrey Garen.
+
+        The points-to analyzer in the object allocation sinking phase is
+        currently performing copies of its allocation and pointers tables in
+        several places. While this is not a huge problem since those tables are
+        usually small and we are in the FTL path anyway, we still shouldn't be
+        doing such useless copying.
+
+        This patch also removes the DFGInsertOSRHintsForUpdate files that are
+        no longer needed with the new object sinking phase and should have been
+        removed in r186795.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGInsertOSRHintsForUpdate.cpp: Removed.
+        (JSC::DFG::insertOSRHintsForUpdate): Deleted.
+        * dfg/DFGInsertOSRHintsForUpdate.h: Removed.
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
+2015-07-21  Saam barati  <saambarati1@gmail.com>
+
+        DestructuringPatternNode and DestructuringAssignmentNode should be ParserArenaFreeable
+        https://bugs.webkit.org/show_bug.cgi?id=147140
+
+        Reviewed by Geoffrey Garen.
+
+        The descendants of DestructuringPatternNode that need destruction also
+        inherit from ParserArenaDeletable.
+
+        * parser/Nodes.h:
+        (JSC::DestructuringPatternNode::~DestructuringPatternNode):
+        (JSC::ObjectPatternNode::appendEntry):
+        (JSC::DestructuringAssignmentNode::bindings):
+
+2015-07-21  Keith Miller  <keith_miller@apple.com>
+
+        Add support for the new.target syntax.
+        https://bugs.webkit.org/show_bug.cgi?id=147051
+
+        Reviewed by Yusuke Suzuki.
+
+        Add support for new.target. Essentially the implementation is, before constructor calls,
+        the target of a "new" is placed where "this" noramlly goes in the calling convention.
+        Then in the constructor before object is initialized we move the target of the "new"
+        into a local variable.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::NewTargetNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::newTargetExpr):
+        * parser/NodeConstructors.h:
+        (JSC::NewTargetNode::NewTargetNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::newTargetExpr):
+        * runtime/CommonIdentifiers.h:
+        * tests/stress/new-target.js: Added.
+        (test):
+        (call):
+        (Constructor.subCall):
+        (Constructor.SubConstructor):
+        (Constructor):
+        (noAssign):
+        (doWeirdThings):
+        (SuperClass):
+        (SubClass):
+
+2015-07-20  Saam barati  <saambarati1@gmail.com>
+
+        "let" scoping introduced incoherent story about symbol table cloning
+        https://bugs.webkit.org/show_bug.cgi?id=147046
+
+        Reviewed by Filip Pizlo.
+
+        This patch now establishes a clear set of rules for how SymbolTables
+        are owned by CodeBlock. Every SymbolTable that is used by a bytecode
+        instruction must live in CodeBlock's constant register pool. When CodeBlock
+        is being linked, it ensures that every SymbolTable in the constant pool is cloned. 
+        This leaves no room for an un-cloned symbol table to be used by a bytecode instruction. 
+        Some instructions may refer to SymbolTable's indirectly through a JSLexicalEnvironment. 
+        This is fine, all JSLexicalEnvironment's are allocated with references to cloned symbol tables.
+
+        Another goal of this patch is to remove the notion that a SymbolTable is 1 to 1 
+        with a CodeBlock. With lexical scoping, this view of the world is no longer
+        correct. This patch begins to remove this assumption by making CodeBlock's
+        symbolTable() getter method private. There is still one place where we need
+        to purge our codebase of this assumption and that is the type profiler. It 
+        has not been updated for lexical scoping. After it is updated in 
+        https://bugs.webkit.org/show_bug.cgi?id=145438
+        we will be able to remove CodeBlock's symbolTable() getter entirely.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addStringSwitchJumpTable):
+        (JSC::CodeBlock::stringSwitchJumpTable):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::symbolTable):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        (JSC::UnlinkedFunctionExecutable::link):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::addExceptionHandler):
+        (JSC::UnlinkedCodeBlock::exceptionHandler):
+        (JSC::UnlinkedCodeBlock::setSymbolTableConstantIndex):
+        (JSC::UnlinkedCodeBlock::symbolTableConstantIndex):
+        (JSC::UnlinkedCodeBlock::symbolTable): Deleted.
+        (JSC::UnlinkedCodeBlock::setSymbolTable): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::variableForLocalEntry):
+        (JSC::BytecodeGenerator::createVariable):
+        (JSC::BytecodeGenerator::resolveType):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::thisRegister):
+        (JSC::BytecodeGenerator::instructions):
+        (JSC::BytecodeGenerator::symbolTable): Deleted.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::baselineCodeBlockFor):
+        (JSC::DFG::Graph::isStrictModeFor):
+        (JSC::DFG::Graph::symbolTableFor): Deleted.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::baselineCodeBlock):
+        (JSC::AssemblyHelpers::argumentsStart):
+        (JSC::AssemblyHelpers::symbolTableFor): Deleted.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::visitChildren):
+        (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilation):
+        (JSC::FunctionExecutable::symbolTable): Deleted.
+        * runtime/Executable.h:
+
+2015-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(186691): OSR entry is broken on loop headers that have no live variables
+        https://bugs.webkit.org/show_bug.cgi?id=147074
+        rdar://problem/21869970
+
+        Reviewed by Michael Saboff.
+        
+        The OSR entry must-handle block/value widening introduced in r186691 would cause the
+        CFA to reexecute if it caused any live local variables to change value. But this fails
+        if the must-handle block has no live local variables, and the entry block otherwise
+        appears to be unreachable.
+        
+        This fixes the bug by having the change detection include whether the block hadn't been
+        visited in addition to whether any local variable values got widened.
+        
+        This is a ~4% speed-up on SunSpider in browser.
+
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::run):
+
+2015-07-20  Mark Lam  <mark.lam@apple.com>
+
+        Rollout r187020 and r187021: breaks JSC API tests on debug builds.
+        https://bugs.webkit.org/show_bug.cgi?id=147110
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::addCurrentThread):
+        * runtime/JSLock.cpp:
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::willDestroyVM):
+        (JSC::JSLock::setExclusiveThread):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        (JSC::JSLock::dropAllLocks):
+        * runtime/JSLock.h:
+        (JSC::JSLock::vm):
+        (JSC::JSLock::hasExclusiveThread):
+        (JSC::JSLock::exclusiveThread):
+        * runtime/VM.h:
+        (JSC::VM::hasExclusiveThread):
+        (JSC::VM::exclusiveThread):
+        (JSC::VM::setExclusiveThread):
+
+2015-07-20  Per Arne Vollan  <peavo@outlook.com>
+
+        Unreviewed debug build fix after r187020.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::addCurrentThread):
+        VM::exclusiveThread() has changed return type to ThreadIdentifier.
+
+2015-07-20  Per Arne Vollan  <peavo@outlook.com>
+
+        JavaScriptCore performance is very bad on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=146448
+
+        Reviewed by Mark Lam.
+
+        Profiling shows that std::this_thread::get_id() is slow on Windows.
+        Use WTF::currentThread() instead, which calls GetCurrentThreadId().
+        This is faster on Windows. The issue has been reported to Microsoft,
+        https://connect.microsoft.com/VisualStudio/feedback/details/1558211.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::willDestroyVM):
+        (JSC::JSLock::setExclusiveThread):
+        (JSC::JSLock::lock):
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        * runtime/JSLock.h:
+        (JSC::JSLock::vm):
+        (JSC::JSLock::hasExclusiveThread):
+        (JSC::JSLock::exclusiveThread):
+        * runtime/VM.h:
+        (JSC::VM::hasExclusiveThread):
+        (JSC::VM::exclusiveThread):
+        (JSC::VM::setExclusiveThread):
+
+2015-07-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        In strict mode, `Object.keys(arguments)` includes "length"
+        https://bugs.webkit.org/show_bug.cgi?id=147071
+
+        Reviewed by Darin Adler.
+
+        ClonedAguments didn't set the "length" with DontEnum.
+
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createWithInlineFrame):
+        (JSC::ClonedArguments::createByCopyingFrom):
+        * tests/stress/arguments-length-always-dont-enum.js: Added.
+        (shouldBe):
+        (argsSloppy):
+        (argsStrict):
+
+2015-07-19  Jordan Harband  <ljharb@gmail.com>
+
+        new Date(NaN).toJSON() must return null instead of throwing a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=141115
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToJSON):
+
+2015-07-19  Saam barati  <saambarati1@gmail.com>
+
+        Parser::parseFunctionInfo hits RELEASE_ASSERT for Arrow Functions
+        https://bugs.webkit.org/show_bug.cgi?id=147090
+
+        Reviewed by Yusuke Suzuki.
+
+        ArrowFunction's have there ParserFunctionInfo "name" field to 
+        be a non-null pointer. This is obviously allowed and valid except we 
+        had a RELEASE_ASSERT that claimed otherwise. This is a mistake. 
+
+        Note: ArrowFunction's will never actually have a function name;
+        there ParserFunctionInfo "name" field will be the empty string. 
+        This is not be mistaken with the name field being a null pointer.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+
+2015-07-18  Saam barati  <saambarati1@gmail.com>
+
+        [ES6] Add support for block scope const
+        https://bugs.webkit.org/show_bug.cgi?id=31813
+
+        Reviewed by Filip Pizlo.
+
+        'const' is now implemented in an ES6 spec compliant manner.
+        'const' variables are always block scoped and always live
+        either on the stack or in a JSLexicalEnvironment. 'const'
+        variables never live on the global object.
+
+        Inside the BytecodeGenerator, when assigning to a stack
+        'const' variable or a LocalClosureVar 'const' variable,
+        we will emit code that just throws a type error.
+        When assigning to a ClosureVar const variable, CodeBlock linking
+        will ensure that we perform a dynamic lookup of that variable so
+        that put_to_scope's slow path throws a type error.
+
+        The old 'const' implementation has been removed in this patch.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::variableForLocalEntry):
+        (JSC::BytecodeGenerator::createVariable):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::isArgumentNumber):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::variablePerSymbolTable): Deleted.
+        (JSC::BytecodeGenerator::emitInitGlobalConst): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::Variable::Variable):
+        (JSC::Variable::isReadOnly):
+        (JSC::Variable::isSpecial):
+        (JSC::Variable::isConst):
+        (JSC::BytecodeGenerator::thisRegister):
+        (JSC::BytecodeGenerator::emitTypeOf):
+        (JSC::BytecodeGenerator::emitIn):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::BindingNode::bindValue):
+        (JSC::ConstDeclNode::emitCodeSingle): Deleted.
+        (JSC::ConstDeclNode::emitBytecode): Deleted.
+        (JSC::ConstStatementNode::emitBytecode): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_to_arguments):
+        (JSC::JIT::emit_op_init_global_const): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_to_arguments):
+        (JSC::JIT::emit_op_init_global_const): Deleted.
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createDeclarationStatement):
+        (JSC::ASTBuilder::createEmptyVarExpression):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::appendStatement):
+        (JSC::ASTBuilder::createVarStatement): Deleted.
+        (JSC::ASTBuilder::createLetStatement): Deleted.
+        (JSC::ASTBuilder::createConstStatement): Deleted.
+        (JSC::ASTBuilder::appendConstDecl): Deleted.
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
+        (JSC::SourceElements::SourceElements):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::ConstStatementNode::ConstStatementNode): Deleted.
+        (JSC::ConstDeclNode::ConstDeclNode): Deleted.
+        * parser/Nodes.h:
+        (JSC::ConstDeclNode::hasInitializer): Deleted.
+        (JSC::ConstDeclNode::ident): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseVariableDeclaration):
+        (JSC::Parser<LexerType>::parseWhileStatement):
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseDefaultValueForDestructuringPattern):
+        (JSC::Parser<LexerType>::parseForStatement):
+        (JSC::Parser<LexerType>::parseTryStatement):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseConstDeclaration): Deleted.
+        (JSC::Parser<LexerType>::parseConstDeclarationList): Deleted.
+        * parser/Parser.h:
+        (JSC::isEvalNode):
+        (JSC::isEvalNode<EvalNode>):
+        (JSC::isArguments):
+        (JSC::isEval):
+        (JSC::isEvalOrArgumentsIdentifier):
+        (JSC::Scope::Scope):
+        (JSC::Scope::declareCallee):
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareLexicalVariable):
+        (JSC::Scope::hasDeclaredVariable):
+        (JSC::Scope::allowsVarDeclarations):
+        (JSC::Scope::allowsLexicalDeclarations):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::declareBoundParameter):
+        (JSC::Parser::destructuringKindFromDeclarationType):
+        (JSC::Parser::assignmentContextFromDeclarationType):
+        (JSC::Parser::isEvalOrArguments):
+        (JSC::Parser::currentScope):
+        (JSC::Parser::popScope):
+        (JSC::Parser::declareVariable):
+        (JSC::Parser::hasDeclaredVariable):
+        (JSC::Parser::setStrictMode):
+        (JSC::Parser::strictMode):
+        (JSC::Parser::isValidStrictMode):
+        (JSC::Parser::declareParameter):
+        (JSC::Parser::declareBoundParameter):
+        (JSC::Parser::breakIsValid):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createForOfLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createDeclarationStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createVarStatement): Deleted.
+        (JSC::SyntaxChecker::createLetStatement): Deleted.
+        * parser/VariableEnvironment.h:
+        (JSC::VariableEnvironmentEntry::isCaptured):
+        (JSC::VariableEnvironmentEntry::isConst):
+        (JSC::VariableEnvironmentEntry::isVar):
+        (JSC::VariableEnvironmentEntry::isLet):
+        (JSC::VariableEnvironmentEntry::setIsCaptured):
+        (JSC::VariableEnvironmentEntry::setIsConst):
+        (JSC::VariableEnvironmentEntry::setIsVar):
+        (JSC::VariableEnvironmentEntry::setIsLet):
+        (JSC::VariableEnvironmentEntry::isConstant): Deleted.
+        (JSC::VariableEnvironmentEntry::setIsConstant): Deleted.
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::defineOwnProperty):
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        (JSC::lastInPrototypeChain):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        (JSC::JSGlobalObject::addVar):
+        (JSC::JSGlobalObject::addConst): Deleted.
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::symbolTablePut):
+        * tests/stress/const-and-with-statement.js: Added.
+        (truth):
+        (assert):
+        (shouldThrowInvalidConstAssignment):
+        (.):
+        * tests/stress/const-exception-handling.js: Added.
+        (truth):
+        (assert):
+        (.):
+        * tests/stress/const-loop-semantics.js: Added.
+        (truth):
+        (assert):
+        (shouldThrowInvalidConstAssignment):
+        (.):
+        * tests/stress/const-not-strict-mode.js: Added.
+        (truth):
+        (assert):
+        (shouldThrowTDZ):
+        (.):
+        * tests/stress/const-semantics.js: Added.
+        (truth):
+        (assert):
+        (shouldThrowInvalidConstAssignment):
+        (.):
+        * tests/stress/const-tdz.js: Added.
+        (truth):
+        (assert):
+        (shouldThrowTDZ):
+        (.):
+
+2015-07-18  Saam barati  <saambarati1@gmail.com>
+
+        lexical scoping is broken with respect to "break" and "continue"
+        https://bugs.webkit.org/show_bug.cgi?id=147063
+
+        Reviewed by Filip Pizlo.
+
+        Bug #142944 which introduced "let" and lexical scoping
+        didn't properly hook into the bytecode generator's machinery
+        for calculating scope depth deltas for "break" and "continue". This
+        resulted in the bytecode generator popping an incorrect number
+        of scopes when lexical scopes were involved.
+
+        This patch fixes this problem and generalizes this machinery a bit.
+        This patch also renames old functions in a sensible way that is more
+        coherent in a world with lexical scoping.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::newLabelScope):
+        (JSC::BytecodeGenerator::emitProfileType):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::popLexicalScope):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::resolveType):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitGetFromScope):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitGetParentScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitPopWithOrCatchScope):
+        (JSC::BytecodeGenerator::emitPopScopes):
+        (JSC::BytecodeGenerator::calculateTargetScopeDepthForExceptionHandler):
+        (JSC::BytecodeGenerator::localScopeDepth):
+        (JSC::BytecodeGenerator::labelScopeDepth):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::pushScopedControlFlowContext):
+        (JSC::BytecodeGenerator::popScopedControlFlowContext):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        (JSC::BytecodeGenerator::currentScopeDepth): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::hasFinaliser):
+        (JSC::BytecodeGenerator::scopeDepth): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ContinueNode::trivialTarget):
+        (JSC::BreakNode::trivialTarget):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * tests/stress/lexical-scoping-break-continue.js: Added.
+        (assert):
+        (.):
+
+2015-07-18  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r186996.
+        https://bugs.webkit.org/show_bug.cgi?id=147070
+
+        Broke JSC tests (Requested by smfr on #webkit).
+
+        Reverted changeset:
+
+        "lexical scoping is broken with respect to "break" and
+        "continue""
+        https://bugs.webkit.org/show_bug.cgi?id=147063
+        http://trac.webkit.org/changeset/186996
+
+2015-07-18  Saam barati  <saambarati1@gmail.com>
+
+        lexical scoping is broken with respect to "break" and "continue"
+        https://bugs.webkit.org/show_bug.cgi?id=147063
+
+        Reviewed by Filip Pizlo.
+
+        Bug #142944 which introduced "let" and lexical scoping
+        didn't properly hook into the bytecode generator's machinery
+        for calculating scope depth deltas for "break" and "continue". This
+        resulted in the bytecode generator popping an incorrect number
+        of scopes when lexical scopes were involved.
+
+        This patch fixes this problem and generalizes this machinery a bit.
+        This patch also renames old functions in a sensible way that is more
+        coherent in a world with lexical scoping.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::newLabelScope):
+        (JSC::BytecodeGenerator::emitProfileType):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::popLexicalScope):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::resolveType):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitGetFromScope):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitGetParentScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitPopWithOrCatchScope):
+        (JSC::BytecodeGenerator::emitPopScopes):
+        (JSC::BytecodeGenerator::calculateTargetScopeDepthForExceptionHandler):
+        (JSC::BytecodeGenerator::localScopeDepth):
+        (JSC::BytecodeGenerator::labelScopeDepth):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::pushScopedControlFlowContext):
+        (JSC::BytecodeGenerator::popScopedControlFlowContext):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        (JSC::BytecodeGenerator::currentScopeDepth): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::hasFinaliser):
+        (JSC::BytecodeGenerator::scopeDepth): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ContinueNode::trivialTarget):
+        (JSC::BreakNode::trivialTarget):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * tests/stress/lexical-scoping-break-continue.js: Added.
+        (assert):
+        (.):
+
+2015-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should have some obvious mitigations against watching structures that are unprofitable to watch
+        https://bugs.webkit.org/show_bug.cgi?id=147034
+
+        Reviewed by Mark Lam and Michael Saboff.
+        
+        This implements two guards against the DFG watching structures that are likely to fire
+        their watchpoints:
+        
+        - Don't watch dictionaries or any structure that had a dictionary in its past. Dictionaries
+          can be flattened, and then they can transform back to dictionaries.
+        
+        - Don't watch structures whose past structures were transitioned-away from while their
+          transition watchpoints were being watched. This property gives us monotonicity: if we
+          recompile because we watched structure S1 of object O, then we won't make the same mistake
+          again when object O has structure S2, S3, and so on.
+        
+        This is a 1.5% speed-up on Kraken. It does penalize some Octane tests, but it also seems to
+        help some of them, so on Octane it's basically neutral.
+
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::invalidate):
+        (JSC::WatchpointSet::isBeingWatched):
+        (JSC::WatchpointSet::addressOfState):
+        (JSC::WatchpointSet::addressOfSetIsNotEmpty):
+        (JSC::InlineWatchpointSet::touch):
+        (JSC::InlineWatchpointSet::isBeingWatched):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::JSGlobalObject::registerWeakMap):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::didTransitionFromThisStructure):
+        * runtime/Structure.h:
+
+2015-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove DFG::DesiredWriteBarriers because it's just a very difficult way of saying "please barrier the machine code block owner"
+        https://bugs.webkit.org/show_bug.cgi?id=147030
+
+        Reviewed by Andreas Kling.
+        
+        All of the users of DesiredWriteBarriers were just using it to request that Plan
+        finalization executes a barrier on codeBlock->ownerExecutable. Indeed, that's the only
+        owning cell in the heap that compilation affects. So, we might as well just have Plan
+        unconditionally execute that barrier and then we don't need DesiredWriteBarriers at
+        all.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGDesiredWriteBarriers.cpp: Removed.
+        * dfg/DFGDesiredWriteBarriers.h: Removed.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::registerFrozenValues):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::reallyAdd):
+        (JSC::DFG::Plan::notifyCompiling):
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        (JSC::DFG::Plan::cancel):
+        * dfg/DFGPlan.h:
+
+2015-07-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Integrate automatic microtask draining into JSC framework and re-enable Promise
+        https://bugs.webkit.org/show_bug.cgi?id=146828
+
+        Reviewed by Sam Weinig.
+
+        Add automatic microtask draining system into JSC framework.
+        When the depth of VM lock becomes 0, before this, we drain the queued microtasks.
+        Enqueuing behavior can be injected by the JSGlobalObject's method table.
+        It is utilized in WebCore to post the microtask to WebCore's event loop.
+
+        In the case of JSC interactive shell, VM depth is always greater than 0.
+        So we manually drains the queued microtasks after evaluating the written line.
+
+        Since now JSC framework has the microtask queue, we can drain the queued microtasks.
+        So re-enable the Promise in the JSC framework context.
+
+        * API/JSContextRef.cpp:
+        (javaScriptRuntimeFlags): Deleted.
+        * API/tests/testapi.c:
+        (main):
+        * API/tests/testapi.mm:
+        (testObjectiveCAPIMain):
+        * jsc.cpp:
+        (runInteractive):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::queueMicrotask):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::willReleaseLock):
+        * runtime/VM.cpp:
+        (JSC::VM::queueMicrotask):
+        (JSC::VM::drainMicrotasks):
+        (JSC::QueuedTask::run):
+        * runtime/VM.h:
+        (JSC::QueuedTask::QueuedTask):
+
+2015-07-17  Saam barati  <saambarati1@gmail.com>
+
+        Function parameters should be parsed in the same parser arena as the function body
+        https://bugs.webkit.org/show_bug.cgi?id=145995
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch changes how functions are parsed in JSC. A function's
+        parameters are now parsed in the same arena as the function itself.
+        This allows us to arena allocate all destructuring AST nodes and
+        the FunctionParameters node. This will help make implementing ES6
+        default parameter values sane.
+
+        A source code that represents a function now includes the text of the function's 
+        parameters. The starting offset is at the opening parenthesis of the parameter
+        list or at the starting character of the identifier for arrow functions that
+        have single arguments and don't start with parenthesis.
+
+        For example:
+
+        "function (param1, param2) { ... }"
+                                   ^
+                                   | This offset used to be the starting offset of a function's SourceCode
+                  ^
+                  | This is the new starting offset for a function's SourceCode.
+
+        This requires us to change how some offsets are calculated
+        and also requires us to report some different line numbers for internal
+        metrics that use a SourceCode's starting line and column numbers.
+
+        This patch also does a bit of cleanup with regards to how
+        functions are parsed in general (especially arrow functions).
+        It removes some unnecessary #ifdefs and the likes for arrow
+        to make things clearer and more deliberate.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        (JSC::UnlinkedFunctionExecutable::parameterCount): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::DestructuringAssignmentNode::emitBytecode):
+        (JSC::assignDefaultValueIfUndefined):
+        (JSC::ArrayPatternNode::collectBoundIdentifiers):
+        (JSC::DestructuringPatternNode::~DestructuringPatternNode): Deleted.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createClassExpr):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createElementList):
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::appendParameter):
+        (JSC::ASTBuilder::createClause):
+        (JSC::ASTBuilder::createClauseList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createForOfLoop):
+        (JSC::ASTBuilder::isResolve):
+        (JSC::ASTBuilder::createDestructuringAssignment):
+        (JSC::ASTBuilder::createArrayPattern):
+        (JSC::ASTBuilder::appendArrayPatternSkipEntry):
+        (JSC::ASTBuilder::appendArrayPatternEntry):
+        (JSC::ASTBuilder::appendArrayPatternRestEntry):
+        (JSC::ASTBuilder::finishArrayPattern):
+        (JSC::ASTBuilder::createObjectPattern):
+        (JSC::ASTBuilder::appendObjectPatternEntry):
+        (JSC::ASTBuilder::createBindingLocation):
+        (JSC::ASTBuilder::setEndOffset):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::Lexer<T>::nextTokenIsColon):
+        (JSC::Lexer<T>::setTokenPosition):
+        (JSC::Lexer<T>::lex):
+        (JSC::Lexer<T>::clear):
+        * parser/Lexer.h:
+        (JSC::Lexer::setIsReparsingFunction):
+        (JSC::Lexer::isReparsingFunction):
+        (JSC::Lexer::lineNumber):
+        (JSC::Lexer::setIsReparsing): Deleted.
+        (JSC::Lexer::isReparsing): Deleted.
+        * parser/NodeConstructors.h:
+        (JSC::TryNode::TryNode):
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::ArrayPatternNode::ArrayPatternNode):
+        (JSC::ObjectPatternNode::ObjectPatternNode):
+        (JSC::BindingNode::BindingNode):
+        (JSC::DestructuringAssignmentNode::DestructuringAssignmentNode):
+        (JSC::ParameterNode::ParameterNode): Deleted.
+        (JSC::ArrayPatternNode::create): Deleted.
+        (JSC::ObjectPatternNode::create): Deleted.
+        (JSC::BindingNode::create): Deleted.
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        (JSC::FunctionNode::FunctionNode):
+        (JSC::FunctionNode::finishParsing):
+        (JSC::FunctionParameters::create): Deleted.
+        (JSC::FunctionParameters::FunctionParameters): Deleted.
+        (JSC::FunctionParameters::~FunctionParameters): Deleted.
+        * parser/Nodes.h:
+        (JSC::ProgramNode::startColumn):
+        (JSC::ProgramNode::endColumn):
+        (JSC::EvalNode::startColumn):
+        (JSC::EvalNode::endColumn):
+        (JSC::FunctionParameters::size):
+        (JSC::FunctionParameters::at):
+        (JSC::FunctionParameters::append):
+        (JSC::FuncExprNode::body):
+        (JSC::DestructuringPatternNode::~DestructuringPatternNode):
+        (JSC::DestructuringPatternNode::isBindingNode):
+        (JSC::DestructuringPatternNode::emitDirectBinding):
+        (JSC::ArrayPatternNode::appendIndex):
+        (JSC::ObjectPatternNode::appendEntry):
+        (JSC::BindingNode::boundProperty):
+        (JSC::BindingNode::divotStart):
+        (JSC::BindingNode::divotEnd):
+        (JSC::DestructuringAssignmentNode::bindings):
+        (JSC::FuncDeclNode::body):
+        (JSC::ParameterNode::pattern): Deleted.
+        (JSC::ParameterNode::nextParam): Deleted.
+        (JSC::FunctionParameters::patterns): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::~Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::allowAutomaticSemicolon):
+        (JSC::Parser<LexerType>::parseSourceElements):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
+        (JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
+        (JSC::Parser<LexerType>::parseSwitchClauses):
+        (JSC::Parser<LexerType>::parseSwitchDefaultClause):
+        (JSC::Parser<LexerType>::parseBlockStatement):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        (JSC::Parser<LexerType>::parseArrowFunctionExpression):
+        (JSC::operatorString):
+        (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBody): Deleted.
+        * parser/Parser.h:
+        (JSC::Parser::positionBeforeLastNewline):
+        (JSC::Parser::locationBeforeLastToken):
+        (JSC::Parser::findCachedFunctionInfo):
+        (JSC::Parser::isofToken):
+        (JSC::Parser::isEndOfArrowFunction):
+        (JSC::Parser::isArrowFunctionParamters):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::isLETMaskedAsIDENT):
+        (JSC::Parser::autoSemiColon):
+        (JSC::Parser::setEndOfStatement):
+        (JSC::Parser::canRecurse):
+        (JSC::Parser<LexerType>::parse):
+        (JSC::parse):
+        * parser/ParserFunctionInfo.h:
+        * parser/ParserModes.h:
+        (JSC::functionNameIsInScope):
+        * parser/SourceCode.h:
+        (JSC::makeSource):
+        (JSC::SourceCode::subExpression):
+        (JSC::SourceCode::subArrowExpression): Deleted.
+        * parser/SourceProviderCache.h:
+        (JSC::SourceProviderCache::get):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::endFunctionToken):
+        (JSC::SourceProviderCacheItem::usedVariables):
+        (JSC::SourceProviderCacheItem::writtenVariables):
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::createClassExpr):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createArrowFunctionExpr):
+        (JSC::SyntaxChecker::setFunctionNameStart):
+        (JSC::SyntaxChecker::createArguments):
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createElementList):
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::appendParameter):
+        (JSC::SyntaxChecker::createClause):
+        (JSC::SyntaxChecker::createClauseList):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * tests/controlFlowProfiler/conditional-expression.js:
+        (testConditionalFunctionCall):
+
+2015-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build for newer LLVMs.
+
+        * llvm/LLVMHeaders.h:
+        * llvm/library/LLVMExports.cpp:
+
+2015-07-16  Mark Lam  <mark.lam@apple.com>
+
+        RegExp::match() should set m_state to ByteCode if compilation fails.
+        https://bugs.webkit.org/show_bug.cgi?id=147023
+
+        Reviewed by Michael Saboff.
+
+        A RegExp has a YarrCodeBlock that has 4 MacroAssemblerCodeRefs for compiled code.
+        If one of these compilations succeeds, RegExp::m_state will be set to JITCode.
+        Subsequently, if RegExp tries to compile another one of these but fails, m_state
+        will be left untouched i.e. it still says JITCode.  As a result, when
+        RegExp::match() later tries to execute the non-existant compiled code, it will
+        crash.
+
+        The fix is to downgrade m_state to ByteCode if RegExp ever fails to compile.
+        This failure should be rare.  We'll do the minimal work here to fix the issue and
+        keep an eye on the perf bots.  If perf regresses, we can do some optimization work then.
+
+        This issue is difficult to test for since it either requires a low memory condition
+        to trigger a failed RegExp compilation at the right moment, or for the RegExp to
+        succeed compilation in the MatchedOnly mode but fail in IncludeSubpatterns mode.
+        Instead, I manually tested it by instrumenting RegExp::compile() to fail once in every
+        10 compilation attempts.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+
+2015-07-15  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Fix armv7 build.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState): The 64-bit argument
+        version of poke is not available on armv7 builds.
+
+2015-07-15  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] 64-bit Build Failure
+        https://bugs.webkit.org/show_bug.cgi?id=146989
+
+        Reviewed by Mark Lam.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState): Add missing
+        declaration for 64-bit type on 4-argument register machines (like
+        Windows).
+
+2015-07-15  Saam barati  <saambarati1@gmail.com>
+
+        [ES6] implement block scoping to enable 'let'
+        https://bugs.webkit.org/show_bug.cgi?id=142944
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal):
+        * bytecode/BytecodeList.json:
+        This patch adds a new opcode and removes op_pop_scope:
+        1) op_get_parent_scope returns the parent scope but doesn't 
+        implicitly write that scope into the scope register. op_pop_scope
+        is now reduced to op_get_parent_scope followed by op_mov.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addStringSwitchJumpTable):
+        (JSC::CodeBlock::stringSwitchJumpTable):
+        (JSC::CodeBlock::symbolTable):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::setConstantRegisters):
+        (JSC::CodeBlock::replaceConstant):
+        op_put_to_scope for LocalClosureVar now takes as an argument
+        the constant index for the Symbol Table it will be putting into.
+        This argument is only used to communicate from the BytecodeGenerator
+        to CodeBlock linking time and it is not present in the linked bytecode.
+
+        op_put_to_scope for non LocalClosureVar takes, at the same index, an
+        argument that represents the local scope depth which it uses for
+        JSScope::abstractResolve to know how many scopes it needs to skip.
+        Again, this is not in the linked code.
+        op_get_from_scope and op_resolve_scope also take as an argument
+        the local scope depth to use in JSScope::abstractResolve. Again,
+        this is not used in the linked code.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        (JSC::EvalCodeCache::clear):
+        (JSC::EvalCodeCache::isCacheable):
+        When direct eval is called and passed a scope that 
+        corresponds to a lexical scope, we can't safely cache 
+        that code because we won't be able to guarantee
+        that the cached code is always executed in the same scope.
+        Consider this example:
+        function foo() {
+            let x = 20;
+            eval("x;");
+            if (b) {
+                let x = 30;
+                if (b) {
+                    let y = 40;
+                    eval("x;")
+                }
+            }
+        }
+
+        We can't reuse resolution depth when linking get_from_scope in evals.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::parameterCount):
+        * bytecode/UnlinkedCodeBlock.h:
+        Unlinked functions now know the variables that were under TDZ in their parent
+        scope.
+
+        (JSC::UnlinkedCodeBlock::symbolTable):
+        (JSC::UnlinkedCodeBlock::setSymbolTable):
+        (JSC::UnlinkedCodeBlock::setSymbolTableConstantIndex):
+        (JSC::UnlinkedCodeBlock::symbolTableConstantIndex):
+        (JSC::UnlinkedCodeBlock::vm):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::~BytecodeGenerator):
+        (JSC::BytecodeGenerator::newRegister):
+        (JSC::BytecodeGenerator::reclaimFreeRegisters):
+        (JSC::BytecodeGenerator::newBlockScopeVariable):
+        (JSC::BytecodeGenerator::newTemporary):
+        (JSC::BytecodeGenerator::emitProfileType):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::popLexicalScope):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::variablePerSymbolTable):
+        (JSC::BytecodeGenerator::variableForLocalEntry):
+        (JSC::BytecodeGenerator::createVariable):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitGetFromScope):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::initializeVariable):
+        (JSC::BytecodeGenerator::emitTDZCheck):
+        (JSC::BytecodeGenerator::needsTDZCheck):
+        (JSC::BytecodeGenerator::emitTDZCheckIfNecessary):
+        (JSC::BytecodeGenerator::liftTDZCheckIfPossible):
+        (JSC::BytecodeGenerator::getVariablesUnderTDZ):
+        (JSC::BytecodeGenerator::emitNewObject):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitGetParentScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::pushIteratorCloseContext):
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::emitPopScopes):
+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
+        (JSC::BytecodeGenerator::calculateTargetScopeDepthForExceptionHandler):
+        (JSC::BytecodeGenerator::currentScopeDepth):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        (JSC::BytecodeGenerator::beginSwitch):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::Variable::Variable):
+        (JSC::Variable::isResolved):
+        (JSC::Variable::symbolTableConstantIndex):
+        (JSC::Variable::ident):
+        (JSC::BytecodeGenerator::ignoredResult):
+        (JSC::BytecodeGenerator::tempDestination):
+        (JSC::BytecodeGenerator::lastOpcodeID):
+        (JSC::BytecodeGenerator::makeFunction):
+        (JSC::BytecodeGenerator::symbolTable):
+        (JSC::BytecodeGenerator::shouldOptimizeLocals): Deleted.
+        (JSC::BytecodeGenerator::canOptimizeNonLocals): Deleted.
+        The heart of the changes in this patch are in the bytecode generator.
+        The bytecode generator now keeps a stack of tuples of 
+        {symbol table, scope register, flag indicating catch or with scope, symbol table index in constant pool}
+        that models the runtime scope stack. This symbol table stack is used
+        in resolving local variables.
+
+        Also, the bytecode generator handles pushing and popping of lexical scopes. 
+        This is relatively straight forward:
+        Captured 'let' variables end up in the JSLexicalEnvironment scope and non-captured
+        variables end up on the stack. Some trickiness is involved in generating
+        code for 'for' loops that have captured variables (I'm talking about variables in the loop
+        header, not the loop body). Each iteration of the for loop ends up with 
+        its own JSLexicalEnvironment. Static code must be generated in such a way 
+        to create this runtime behavior. This is done by emitting instructions to 
+        push and pop a lexical scope at the end of each loop and copying values
+        from the previous loop's scope into the new scope. This code must also
+        ensure that each loop iteration's scope refers to the same underlying 
+        SymbolTable so that no scope is accidentally mistaken as being a singleton scope.
+
+        When the debugger is enabled, all lexically defined variables will end up in the
+        JSLexicalEnvironment.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::BlockNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::DeclarationStatement::emitBytecode):
+        (JSC::EmptyVarExpression::emitBytecode):
+        (JSC::EmptyLetExpression::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::BindingNode::bindValue):
+        (JSC::VarStatementNode::emitBytecode): Deleted.
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::getOwnPropertySlot):
+        (JSC::DebuggerScope::put):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::castConstant):
+        (JSC::DFG::Node::initializationValueForActivation):
+        (JSC::DFG::Node::containsMovHint):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        CreateActivation nodes now have a second OpInfo that tracks the 
+        initial value that needs to be placed in the activation. This initial value 
+        is also used in allocation sinking to create proper bottom values for all 
+        scope variables.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeCreateActivation):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_create_lexical_environment):
+        (JSC::JIT::emit_op_get_parent_scope):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_get_scope):
+        (JSC::JIT::emit_op_pop_scope): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_to_number):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_create_lexical_environment):
+        (JSC::JIT::emit_op_get_parent_scope):
+        (JSC::JIT::emit_op_switch_imm):
+        (JSC::JIT::emit_op_enter):
+        (JSC::JIT::emit_op_get_scope):
+        (JSC::JIT::emit_op_pop_scope): Deleted.
+        * jit/JITOperations.cpp:
+        (JSC::canAccessArgumentIndexQuickly):
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createSourceElements):
+        (JSC::ASTBuilder::funcDeclarations):
+        (JSC::ASTBuilder::features):
+        (JSC::ASTBuilder::numConstants):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createClassDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createForOfLoop):
+        (JSC::ASTBuilder::isBindingNode):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createDeclarationStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createLetStatement):
+        (JSC::ASTBuilder::createEmptyVarExpression):
+        (JSC::ASTBuilder::createEmptyLetExpression):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::appendStatement):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::appendObjectPatternEntry):
+        (JSC::ASTBuilder::createBindingLocation):
+        (JSC::ASTBuilder::setEndOffset):
+        (JSC::ASTBuilder::Scope::Scope):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::varDeclarations): Deleted.
+        (JSC::ASTBuilder::addVar): Deleted.
+        * parser/Keywords.table:
+        * parser/NodeConstructors.h:
+        (JSC::ReadModifyResolveNode::ReadModifyResolveNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::ExprStatementNode::ExprStatementNode):
+        (JSC::DeclarationStatement::DeclarationStatement):
+        (JSC::EmptyVarExpression::EmptyVarExpression):
+        (JSC::EmptyLetExpression::EmptyLetExpression):
+        (JSC::IfElseNode::IfElseNode):
+        (JSC::WhileNode::WhileNode):
+        (JSC::ForNode::ForNode):
+        (JSC::CaseBlockNode::CaseBlockNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::ConstDeclNode::ConstDeclNode):
+        (JSC::BlockNode::BlockNode):
+        (JSC::EnumerationNode::EnumerationNode):
+        (JSC::ForInNode::ForInNode):
+        (JSC::ForOfNode::ForOfNode):
+        (JSC::ObjectPatternNode::create):
+        (JSC::BindingNode::create):
+        (JSC::BindingNode::BindingNode):
+        (JSC::VarStatementNode::VarStatementNode): Deleted.
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ScopeNode::singleStatement):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionNode::FunctionNode):
+        (JSC::FunctionNode::finishParsing):
+        (JSC::VariableEnvironmentNode::VariableEnvironmentNode):
+        * parser/Nodes.h:
+        (JSC::VariableEnvironmentNode::VariableEnvironmentNode):
+        (JSC::VariableEnvironmentNode::lexicalVariables):
+        (JSC::ScopeNode::usesThis):
+        (JSC::ScopeNode::needsActivationForMoreThanVariables):
+        (JSC::ScopeNode::needsActivation):
+        (JSC::ScopeNode::hasCapturedVariables):
+        (JSC::ScopeNode::captures):
+        (JSC::ScopeNode::varDeclarations):
+        (JSC::ScopeNode::functionStack):
+        (JSC::ScopeNode::neededConstants):
+        (JSC::ProgramNode::startColumn):
+        (JSC::ProgramNode::endColumn):
+        (JSC::EvalNode::startColumn):
+        (JSC::EvalNode::endColumn):
+        (JSC::BindingNode::boundProperty):
+        (JSC::BindingNode::divotStart):
+        (JSC::BindingNode::divotEnd):
+        (JSC::ScopeNode::capturedVariableCount): Deleted.
+        (JSC::ScopeNode::capturedVariables): Deleted.
+        (JSC::ScopeNode::varStack): Deleted.
+        There is a new class called 'VariableEnvironmentNode' that has the
+        necessary fields to model a lexical scope. Multiple AST nodes now 
+        also inherit from VariableEnvironmentNode.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::didFinishParsing):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseVariableDeclaration):
+        (JSC::Parser<LexerType>::parseWhileStatement):
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseConstDeclarationList):
+        (JSC::Parser<LexerType>::parseForStatement):
+        (JSC::Parser<LexerType>::parseBreakStatement):
+        (JSC::Parser<LexerType>::parseContinueStatement):
+        (JSC::Parser<LexerType>::parseSwitchStatement):
+        (JSC::Parser<LexerType>::parseTryStatement):
+        (JSC::Parser<LexerType>::parseBlockStatement):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseClassDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseVarDeclaration): Deleted.
+        (JSC::Parser<LexerType>::parseVarDeclarationList): Deleted.
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::isFunction):
+        (JSC::Scope::isFunctionBoundary):
+        (JSC::Scope::setIsLexicalScope):
+        (JSC::Scope::isLexicalScope):
+        (JSC::Scope::declaredVariables):
+        (JSC::Scope::finalizeLexicalEnvironment):
+        (JSC::Scope::computeLexicallyCapturedVariablesAndPurgeCandidates):
+        (JSC::Scope::declareCallee):
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareLexicalVariable):
+        (JSC::Scope::hasDeclaredVariable):
+        (JSC::Scope::hasLexicallyDeclaredVariable):
+        (JSC::Scope::hasDeclaredParameter):
+        (JSC::Scope::declareWrite):
+        (JSC::Scope::preventAllVariableDeclarations):
+        (JSC::Scope::preventVarDeclarations):
+        (JSC::Scope::allowsVarDeclarations):
+        (JSC::Scope::allowsLexicalDeclarations):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::declareBoundParameter):
+        (JSC::Scope::useVariable):
+        (JSC::Scope::setNeedsFullActivation):
+        (JSC::Scope::needsFullActivation):
+        (JSC::Scope::hasDirectSuper):
+        (JSC::Scope::setNeedsSuperBinding):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::getCapturedVars):
+        (JSC::Scope::copyCapturedVariablesToVector):
+        (JSC::Parser::AutoCleanupLexicalScope::AutoCleanupLexicalScope):
+        (JSC::Parser::AutoCleanupLexicalScope::~AutoCleanupLexicalScope):
+        (JSC::Parser::AutoCleanupLexicalScope::setIsValid):
+        (JSC::Parser::AutoCleanupLexicalScope::isValid):
+        (JSC::Parser::AutoCleanupLexicalScope::setPopped):
+        (JSC::Parser::AutoCleanupLexicalScope::scope):
+        (JSC::Parser::currentScope):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::popScopeInternal):
+        (JSC::Parser::popScope):
+        (JSC::Parser::declareVariable):
+        (JSC::Parser::hasDeclaredVariable):
+        (JSC::Parser::hasDeclaredParameter):
+        (JSC::Parser::declareWrite):
+        (JSC::Parser::findCachedFunctionInfo):
+        (JSC::Parser::isFunctionBodyNode):
+        (JSC::Parser::continueIsValid):
+        (JSC::Parser::pushLabel):
+        (JSC::Parser::popLabel):
+        (JSC::Parser::getLabel):
+        (JSC::Parser::isLETMaskedAsIDENT):
+        (JSC::Parser<LexerType>::parse):
+        (JSC::Scope::preventNewDecls): Deleted.
+        (JSC::Scope::allowsNewDecls): Deleted.
+        (JSC::Scope::getCapturedVariables): Deleted.
+        There are basic parser changes that now allow for the 'let'
+        keyword. The trickiest change is how we will still treat 'let' 
+        as an identifier for sloppy-mode code sometimes. For example,
+        "var let = ..." is allowed but "let let" or "const let" is not.
+
+        The most significant change to the parser made for this patch
+        is appropriating the Scope struct to also also model a lexical 
+        scope. Changes were made in how we track captured variables to 
+        account for this. In general, I think some of this code could 
+        benefit from a slight refactoring to make things cleaner.
+
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createEmptyVarExpression):
+        (JSC::SyntaxChecker::createEmptyLetExpression):
+        (JSC::SyntaxChecker::createClassExpr):
+        (JSC::SyntaxChecker::createClassDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createForLoop):
+        (JSC::SyntaxChecker::createForInLoop):
+        (JSC::SyntaxChecker::createForOfLoop):
+        (JSC::SyntaxChecker::createEmptyStatement):
+        (JSC::SyntaxChecker::createVarStatement):
+        (JSC::SyntaxChecker::createLetStatement):
+        (JSC::SyntaxChecker::createReturnStatement):
+        (JSC::SyntaxChecker::createBreakStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::appendStatement):
+        (JSC::SyntaxChecker::combineCommaNodes):
+        (JSC::SyntaxChecker::evalCount):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+        (JSC::SyntaxChecker::addVar): Deleted.
+        * parser/VariableEnvironment.cpp: Added.
+        (JSC::VariableEnvironment::markVariableAsCapturedIfDefined):
+        (JSC::VariableEnvironment::markVariableAsCaptured):
+        (JSC::VariableEnvironment::markAllVariablesAsCaptured):
+        (JSC::VariableEnvironment::hasCapturedVariables):
+        (JSC::VariableEnvironment::captures):
+        (JSC::VariableEnvironment::swap):
+        * parser/VariableEnvironment.h: Added.
+        (JSC::VariableEnvironmentEntry::isCaptured):
+        (JSC::VariableEnvironmentEntry::isConstant):
+        (JSC::VariableEnvironmentEntry::isVar):
+        (JSC::VariableEnvironmentEntry::isLet):
+        (JSC::VariableEnvironmentEntry::setIsCaptured):
+        (JSC::VariableEnvironmentEntry::setIsConstant):
+        (JSC::VariableEnvironmentEntry::setIsVar):
+        (JSC::VariableEnvironmentEntry::setIsLet):
+        (JSC::VariableEnvironmentEntry::clearIsVar):
+        (JSC::VariableEnvironment::begin):
+        (JSC::VariableEnvironment::end):
+        (JSC::VariableEnvironment::add):
+        (JSC::VariableEnvironment::size):
+        (JSC::VariableEnvironment::contains):
+        (JSC::VariableEnvironment::remove):
+        VariableEnvironment is a new class that keeps track
+        of the static environment in the parser and the bytecode generator.
+        VariableEnvironment behaves like SymbolTable but for the bytecode generator.
+        It keeps track of variable types, i.e, if a variable is a "var", "let", "const" 
+        and whether or not its captured.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC::CodeCache::clear):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createErrorForInvalidGlobalAssignment):
+        (JSC::createTDZError):
+        (JSC::throwOutOfMemoryError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::create):
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/Executable.h:
+        * runtime/JSCJSValue.h:
+        (JSC::jsUndefined):
+        (JSC::jsTDZValue):
+        (JSC::jsBoolean):
+        * runtime/JSEnvironmentRecord.h:
+        (JSC::JSEnvironmentRecord::finishCreationUninitialized):
+        (JSC::JSEnvironmentRecord::finishCreation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::weakRandomInteger):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::symbolTableGet):
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::JSLexicalEnvironment::create):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::abstractResolve):
+        (JSC::JSScope::collectVariablesUnderTDZ):
+        (JSC::JSScope::isLexicalScope):
+        (JSC::resolveModeName):
+        * runtime/JSScope.h:
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::setValue):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::cloneScopePart):
+        * runtime/SymbolTable.h:
+        SymbolTable now uses an extra bit to know if it corresponds
+        to a "let"-like environment or not.
+
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase<Unknown>::get):
+        (JSC::WriteBarrierBase<Unknown>::clear):
+        (JSC::WriteBarrierBase<Unknown>::setUndefined):
+        (JSC::WriteBarrierBase<Unknown>::setStartingValue):
+        (JSC::WriteBarrierBase<Unknown>::isNumber):
+        (JSC::WriteBarrierBase<Unknown>::isObject):
+        (JSC::WriteBarrierBase<Unknown>::isNull):
+        * tests/stress/activation-sink-default-value-tdz-error.js: Added.
+        (shouldThrowTDZ):
+        (bar):
+        (foo.cap):
+        * tests/stress/activation-sink-osrexit-default-value-tdz-error.js: Added.
+        (shouldThrowTDZ):
+        (bar):
+        * tests/stress/lexical-let-and-with-statement.js: Added.
+        (truth):
+        (assert):
+        (.):
+        * tests/stress/lexical-let-exception-handling.js: Added.
+        (truth):
+        (assert):
+        (.):
+        * tests/stress/lexical-let-global-not-captured-variables.js: Added.
+        (truth):
+        (assert):
+        (foo):
+        (.let.capY):
+        * tests/stress/lexical-let-loop-semantics.js: Added.
+        (truth):
+        (assert):
+        (shouldThrowTDZ):
+        (.):
+        * tests/stress/lexical-let-not-strict-mode.js: Added.
+        (truth):
+        (assert):
+        (shouldThrowTDZ):
+        (.):
+        * tests/stress/lexical-let-semantics.js: Added.
+        (truth):
+        (assert):
+        (let.globalFunction):
+        (let.retGlobalNumberCaptured):
+        (let.setGlobalNumberCaptured):
+        (.):
+        * tests/stress/lexical-let-tdz.js: Added.
+        (truth):
+        (assert):
+        (shouldThrowTDZ):
+        (.):
+
+2015-07-15  Anders Carlsson  <andersca@apple.com>
+
+        Make JavaScriptCore SPI headers used by WebCore SPI headers self-contained
+        https://bugs.webkit.org/show_bug.cgi?id=146978
+
+        Reviewed by Dan Bernstein.
+
+        * debugger/DebuggerPrimitives.h:
+        * disassembler/Disassembler.h:
+        * heap/Weak.h:
+        * inspector/InspectorValues.h:
+        * runtime/JSCJSValue.h:
+
+2015-07-14  Anders Carlsson  <andersca@apple.com>
+
+        Assertions.h should include ExportMacros.h
+        https://bugs.webkit.org/show_bug.cgi?id=146948
+
+        Reviewed by Tim Horton.
+
+        Remove now unneeded WTF_EXPORT_PRIVATE define.
+
+        * API/JSBase.h:
+
+2015-07-14  Matthew Mirman  <mmirman@apple.com>
+
+        Repatch. Makes compileArithSub in the DFG ensure that the constant is an int32.
+        https://bugs.webkit.org/show_bug.cgi?id=146910
+        rdar://problem/21729083
+
+        Reviewed by Filip Pizlo.
+        
+        Also fixes the debug build problem where all edges are assumed to 
+        have UntypedUse before the fixup phase.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateEdgeWithDoubleResultIfNecessary):
+        * tests/stress/arith-add-with-constants.js: Added some tests for this case.
+        (arithAdd42WrittenAsInteger):
+        (testArithAdd42WrittenAsInteger):
+        (arithSub42WrittenAsDouble):
+        (testArithSub42WrittenAsDouble):
+        (doubleConstant):
+        (testDoubleConstant): Added test for the case of +0.0 and Math.min(0.0)
+        (arithAdd42WrittenAsDouble): Deleted.
+        (testArithAdd42WrittenAsDouble): Deleted.
+
+2015-07-14  Matthew Mirman  <mmirman@apple.com>
+
+        Unreviewed, rolling out r186805.
+
+        Made raytracer on octane 80% slower
+
+        Reverted changeset:
+
+        "Makes compileArithSub in the DFG ensure that the constant is
+        an int32."
+        https://bugs.webkit.org/show_bug.cgi?id=146910
+        http://trac.webkit.org/changeset/186805
+
+2015-07-13  Matthew Mirman  <mmirman@apple.com>
+
+        Makes compileArithSub in the DFG ensure that the constant is an int32.
+        https://bugs.webkit.org/show_bug.cgi?id=146910
+        rdar://problem/21729083
+
+        Reviewed by Filip Pizlo.
+        
+        Also fixes the debug build problem where all edges are assumed to 
+        have UntypedUse before the fixup phase.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateEdgeWithDoubleResultIfNecessary):
+        * tests/stress/arith-add-with-constants.js: Added some tests for this case.
+        (arithAdd42WrittenAsInteger):
+        (testArithAdd42WrittenAsInteger):
+        (arithSub42WrittenAsDouble):
+        (testArithSub42WrittenAsDouble):
+        (doubleConstant):
+        (testDoubleConstant): Added test for the case of +0.0 and Math.min(0.0)
+        (arithAdd42WrittenAsDouble): Deleted.
+        (testArithAdd42WrittenAsDouble): Deleted.
+
+2015-07-13  Basile Clement  <basile_clement@apple.com>
+
+        Object cycles should not prevent allocation elimination/sinking
+        https://bugs.webkit.org/show_bug.cgi?id=143073
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces a new allocation sinking phase that is able to
+        sink cycles, in DFGAllocationCycleSinkingPhase.cpp. This phase
+        supersedes the old allocation sinking phase in
+        DFGObjectAllocationSinkingPhase.cpp, as that previous phase was never
+        able to sink allocation cycles while the new phase sometimes can; see
+        DFGAllocationCycleSinkingPhase.cpp for details.
+
+        For now, the new sinking phase is kept behind a
+        JSC_enableAllocationCycleSinking flag that reverts to the old sinking
+        phase when false (i.e., by default). This also removes the old
+        JSC_enableObjectAllocationSinking flag. run-javascriptcore-tests
+        defaults to using the new sinking phase.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addStructureSet): Allow empty structure sets
+        * dfg/DFGLazyNode.cpp:
+        (JSC::DFG::LazyNode::dump): Prettier dump
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::cellOperand): Move to opInfo for MaterializeCreateActivation
+        (JSC::DFG::Node::hasStructureSet): Add MaterializeNewObject
+        (JSC::DFG::Node::objectMaterializationData): Move to opInfo2
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp: Remove unused header
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::ObjectAllocationSinkingPhase): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::run): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::performSinking): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::resolve): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize): Deleted.
+        (JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize): Deleted.
+        * dfg/DFGObjectAllocationSinkingPhase.h:
+        * dfg/DFGPromotedHeapLocation.h: Add a hash and a helper function to PromotedLocationDescriptor
+        (JSC::DFG::PromotedLocationDescriptor::PromotedLocationDescriptor):
+        (JSC::DFG::PromotedLocationDescriptor::operator bool):
+        (JSC::DFG::PromotedLocationDescriptor::neededForMaterialization):
+        (JSC::DFG::PromotedLocationDescriptorHash::hash):
+        (JSC::DFG::PromotedLocationDescriptorHash::equal):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateSSA): Assert that most nodes never see a phantom allocation
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeNewObject): Use the new structureSet() operand
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMaterializeCreateActivation): Node has a new child
+        * ftl/FTLOSRExitCompiler.cpp: Handle materialization cycles
+        (JSC::FTL::compileStub):
+        * ftl/FTLOperations.cpp: Handle materialization cycles
+        (JSC::FTL::operationPopulateObjectInOSR):
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * ftl/FTLOperations.h: Handle materialization cycles
+        * tests/stress/correctly-sink-object-even-though-it-dies.js: Added.
+        (clobber):
+        (foo):
+        * tests/stress/eliminate-object-read-over-call.js: Added.
+        (clobber):
+        (foo):
+        * tests/stress/materialize-object-on-edge.js: Added.
+        (call):
+        (foo):
+        * tests/stress/object-sinking-stress.js: Added.
+        (foo):
+        * tests/stress/sink-object-cycle.js: Added.
+        (clobber):
+        (foo):
+        * tests/stress/sink-object-past-put.js: Added.
+        (clobber):
+        (foo):
+        * tests/stress/sinkable-new-object-in-loop.js: Added.
+        (foo):
+
+2015-07-13  Daniel Bates  <dabates@apple.com>
+
+        Cleanup: Avoid extraneous increment and decrement of reference count of ScriptArguments in ConsoleClient
+        https://bugs.webkit.org/show_bug.cgi?id=146920
+
+        Reviewed by Brian Burg.
+
+        Remove local variable RefPtr<ScriptArguments> and copy constructor call with an argument that
+        was initialized with an rvalue reference. The argument itself is an lvalue reference.
+
+        * runtime/ConsoleClient.cpp:
+        (JSC::ConsoleClient::printConsoleMessageWithArguments):
+        (JSC::ConsoleClient::internalMessageWithTypeAndLevel):
+
+2015-07-13  Anders Carlsson  <andersca@apple.com>
+
+        Apps linked with a deployment target of iOS 7.x or earlier crash when using modern WebKit API
+        https://bugs.webkit.org/show_bug.cgi?id=146913
+        rdar://problem/21789252
+
+        Reviewed by Dan Bernstein.
+
+        Make a top-level symlink from /System/Library/PrivateFrameworks/JavaScriptCore.framework to
+        /System/Library/Frameworks/JavaScriptCore.framework.
+    
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        If Watchpoint::fire() looks at the state of the world, it should definitely see its set invalidated, and maybe it should see the object of interest in the transitioned-to state
+        https://bugs.webkit.org/show_bug.cgi?id=146897
+
+        Reviewed by Mark Lam.
+        
+        The idea is to eventually support adaptive watchpoints. An adaptive watchpoint will be
+        able to watch for a condition that is more fine-grained than any one watchpoint set. For
+        example, we might watch a singleton object to see if it ever acquires a property called
+        "foo". So long as it doesn't have such a property, we don't want to invalidate any code.
+        But if it gets that property, then we should deoptimize. Current watchpoints will
+        invalidate code as soon as any property is added (or deleted), because they will use the
+        transition watchpoint set of the singleton object's structure, and that fires anytime
+        there is any transition.
+        
+        An adaptive watchpoint would remember the singleton object, and when it got fired, it
+        would check if the object's new structure has the property "foo". If not, it would check
+        if the object's new structure is watchable (i.e. has a valid transition watchpoint set).
+        If the property is missing and the structure is watchable, it would add itself to the
+        watchpoint set of the new structure. Otherwise, it would deoptimize.
+        
+        There are two problems with this idea, and this patch fixes these problems. First, we
+        usually fire the transition watchpoint before we do the structure transition. This means
+        that if the fire() method looked at the singleton object's structure, it would see the old
+        structure, not the new one. It would have no way of knowing what the new structure is.
+        Second, inside the fire() method, the watchpoint set being invalidated still appears
+        valid, since we change the state after we fire all watchpoints.
+        
+        This patch addresses both issues. Now, in the most important case (addPropertyTransition),
+        we fire the watchpoint set after we have modified the object. This is accomplished using
+        a deferral scope called DeferredStructureTransitionWatchpointFire. In cases where there is
+        no deferral, the adaptive watchpoint will conservatively resort to deoptimization because
+        it would find that the singleton object's structure is no longer watchable. This is
+        because in the absence of deferral, the singleton object would still have the original
+        structure, but that structure's watchpoint set would now report itself as having been
+        invalidated.
+
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::fireAllSlow): Change the state of the set before firing all watchpoints.
+        (JSC::WatchpointSet::fireAllWatchpoints):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal): Use the deferral scope.
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Pass the deferral scope to didTransitionFromThisStructure.
+        (JSC::Structure::addPropertyTransition): Pass the deferral scope to create().
+        (JSC::StructureFireDetail::dump): This is no longer anonymous.
+        (JSC::DeferredStructureTransitionWatchpointFire::DeferredStructureTransitionWatchpointFire): Start with a null structure.
+        (JSC::DeferredStructureTransitionWatchpointFire::~DeferredStructureTransitionWatchpointFire): Fire the watchpoint if there is a structure.
+        (JSC::DeferredStructureTransitionWatchpointFire::add): Add a structure. Logically this is a list of deferred things, but we assert that there only will be one (happens to be true now).
+        (JSC::Structure::didTransitionFromThisStructure): Defer the watchpoint firing if there is a deferral scope.
+        * runtime/Structure.h:
+        (JSC::StructureFireDetail::StructureFireDetail): Move this to the header.
+        * runtime/StructureInlines.h:
+        (JSC::Structure::create): Pass the deferral scope to the constructor.
+
+2015-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Watchpoints should be removed from their owning WatchpointSet before they are fired
+        https://bugs.webkit.org/show_bug.cgi?id=146895
+
+        Reviewed by Sam Weinig.
+        
+        This simplifies the WatchpointSet API by making it so that when Watchpoint::fire() is
+        called, the Watchpoint is no longer in the set. This means that you don't have to remember
+        to remove it from the set's list (currently we do that implicitly as part of whatever
+        any particular Watchpoint::fireInternal() does), and you can now write adaptive
+        watchpoints that re-add themselves to a different set if they determine that the thing
+        they are actually watching is still intact but now needs to be watched in a different way
+        (like watching for whether some singleton object has a property of some name).
+
+        * bytecode/Watchpoint.cpp:
+        (JSC::Watchpoint::~Watchpoint): Add a comment about why this is necessary.
+        (JSC::Watchpoint::fire): Make this out-of-line, private, and make it assert that we're no longer on the list.
+        (JSC::WatchpointSet::fireAllWatchpoints): Make this remove the watchpoint from the list before firing it.
+        * bytecode/Watchpoint.h:
+        (JSC::Watchpoint::fire): Deleted. I moved this to Watchpoint.cpp.
+
+2015-07-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::DesiredWatchpoints should accept WatchpointSetType's that aren't necessarily pointers
+        https://bugs.webkit.org/show_bug.cgi?id=146875
+
+        Reviewed by Dan Bernstein.
+        
+        In the future we'll want to add a desired watchpoint set that's something like "please
+        watch property 'Foo' for 'deletion' on structure 'S1'", so that the "set type" is struct
+        like "struct MySet { StringImpl* property; Mode mode; Structure* structure };".
+        
+        This is a very mechanical change for now - all of the current users happen to use sets
+        that are pointer typed, so it's just a matter of moving some "*"'s around.
+
+        * dfg/DFGDesiredWatchpoints.h:
+        (JSC::DFG::GenericSetAdaptor::add):
+        (JSC::DFG::GenericSetAdaptor::hasBeenInvalidated):
+        (JSC::DFG::GenericDesiredWatchpoints::GenericDesiredWatchpoints):
+        (JSC::DFG::GenericDesiredWatchpoints::addLazily):
+        (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
+        (JSC::DFG::GenericDesiredWatchpoints::areStillValid):
+        (JSC::DFG::GenericDesiredWatchpoints::isWatched):
+        (JSC::DFG::DesiredWatchpoints::isWatched):
+
+2015-07-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Watchpoints should be allocated with FastMalloc
+        https://bugs.webkit.org/show_bug.cgi?id=146874
+
+        Reviewed by Dan Bernstein.
+        
+        This is in preparation for adding new subclasses of Watchpoint. While starting to do this
+        I realized that the way Watchpoints allocated themselves was unusual.
+
+        * bytecode/CodeBlockJettisoningWatchpoint.h:
+        (JSC::CodeBlockJettisoningWatchpoint::CodeBlockJettisoningWatchpoint): No need for the default constructor.
+        * bytecode/Watchpoint.h:
+        (JSC::Watchpoint::Watchpoint): This should be noncopyable and fast-allocated.
+        * dfg/DFGCommonData.h: Use a Bag<> instead of SegmentedVector<>. Bag means "malloc things but allow me to free them all at once", which is what we are doing here.
+        * dfg/DFGDesiredWatchpoints.h:
+        (JSC::DFG::GenericDesiredWatchpoints::reallyAdd): Use the Bag<> API rather than the very awkward SegmentedVector<> API.
+
+2015-07-10  Filip Pizlo  <fpizlo@apple.com>
+
+        AI folding of IsObjectOrNull is broken for non-object types that may be null
+        https://bugs.webkit.org/show_bug.cgi?id=146867
+
+        Reviewed by Ryosuke Niwa.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Fix the bug and add some text describing what is going on.
+        * tests/stress/misc-is-object-or-null.js: Added. Test for the bug.
+        (foo):
+        * tests/stress/other-is-object-or-null.js: Added. Test for a bug I almost introduced.
+        (foo):
+
+2015-07-10  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be easy to measure total compile times.
+        https://bugs.webkit.org/show_bug.cgi?id=146857
+
+        Reviewed by Sam Weinig.
+        
+        This gives DFG::Plan the ability to track total compile times, and return them in a map
+        of stats that jsc.cpp can display.
+        
+        I want to do some work to bring down DFG compile times. This will help me measure whether
+        I'm making a difference or not.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::~Plan):
+        (JSC::DFG::Plan::computeCompileTimes):
+        (JSC::DFG::Plan::reportCompileTimes):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::cancel):
+        (JSC::DFG::Plan::compileTimeStats):
+        (JSC::DFG::dumpAndVerifyGraph): Deleted.
+        (JSC::DFG::profilerCompilationKindForMode): Deleted.
+        * dfg/DFGPlan.h:
+        (JSC::DFG::Plan::compileTimeStats):
+        * jsc.cpp:
+        (jscmain):
+        * runtime/Options.h:
+
+2015-07-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG fragile frozen values are fundamentally broken
+        https://bugs.webkit.org/show_bug.cgi?id=146602
+
+        Reviewed by Mark Lam.
+        
+        This change gets rid of the FragileValue value strength, because it was fundamentally
+        broken.
+        
+        FragileValue was a value known to the compiler but not tracked by the GC in any way -
+        it wasn't marked and it wasn't weak. This was used to support AI bootstrap for OSR
+        must-handle values. The philosophy was that if the compiler did use the value for
+        optimization, it would have been strengthened to a weak value (or maybe even a strong
+        value, though we probably won't do that). But this was too much of a pipe dream. I've
+        found at least one case where the compiler did use the value, but never strengthened
+        it: it would happen if the value ended up in an OSR entry data expected value. Then if
+        we GCed, we might have killed the value, but OSR entry would still try to use it for
+        validation. That might have sort of just worked, but it's clearly shady.
+
+        The reason why we made must-handle values fragile and not weak is that most of the time
+        the values disappear from the abstract state: they are LUBed to a non-constant. If we
+        kept them around as weak, we'd have too many cases of the GC killing the code because
+        it thought that the value was somehow meaningful to the code when it was only used as a
+        temporary artifact of optimization.
+
+        So, it's true that it's very important for must-handle values not to automatically be
+        weak or strong. It's also true that the values are necessary for AI bootstrap because
+        we need to know what values OSR entry will require. But we shouldn't accomplish these
+        goals by having the compiler hold onto what are essentially dangling pointers.
+        
+        This implements a better solution: instead of having InPlaceAbstractState bootstrap the
+        AI with must-handle values at the beginning, we now widen the valuesAtHead of the
+        must-handle block after AI converges. This widening is done in CFAPhase. This allows us
+        to see if the must-handle values are necessary at all. In most cases, the widening
+        takes a non-constant abstract value and simply amends something to its type based on
+        the type of the must-handle value, and so the must-handle value never actually shows up
+        in either the IR or any abstract value. In the unlikely event that the value at head is
+        bottom, we freeze the must-handle value. This change removes FragileValue, and this
+        freezing uses WeakValue as the strength. That makes sense: since the abstract value was
+        bottom, the must-handle value becomes integral to the IR and so it makes no sense for
+        the GC to keep the resulting CodeBlock alive if that must-handle value dies. This will
+        sometimes happen for example if you have a very long-running loop whose pre-header
+        allocates some object, but that pre-header appears to always exit to the optimizing JIT
+        because it was only profiled once in the LLInt and that profiling appears insufficient
+        to the DFG. In that case, we'll effectively constant-fold the references to the object
+        inside the loop, which is both efficient (yay constant folding!) and necessary
+        (otherwise we wouldn't know what the type of the variable should have been).
+        
+        Testing and debugging this is complicated. So, this adds some new capabilities:
+        
+        - DFG IR dumps also dump all of the FrozenValues that point to the heap along with
+          their strengths, so that it's easy to see what GC objects the DFG feels are necessary
+          for the compilation.
+        
+        - DFG OSR entry preparation prints out the OSR entry data structures, so that it's easy
+          to see what GC pointers (and other things) are used for OSR entry validation. The
+          printouts are quite detailed, and should also help other kinds of OSR entry
+          debugging.
+        
+        - DFG::Plan now validates whether all of the GC pointers planted in the various JITCode
+          data structures are also properly registered as either weak or strong pointers in the
+          CodeBlock. This validation check previously failed due to fragile values ending up in
+          the OSR entry data structures, both in the newly added test (dead-osr-entry-value.js)
+          and in some pre-existing tests (like earley-boyer and 3d-raytrace).
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::visitAggregate):
+        * bytecode/Operands.h:
+        (JSC::Operands::operand):
+        (JSC::Operands::hasOperand):
+        * bytecode/StructureSet.cpp:
+        (JSC::StructureSet::dump):
+        (JSC::StructureSet::validateReferences):
+        * bytecode/StructureSet.h:
+        * bytecode/TrackedReferences.cpp: Added.
+        (JSC::TrackedReferences::TrackedReferences):
+        (JSC::TrackedReferences::~TrackedReferences):
+        (JSC::TrackedReferences::add):
+        (JSC::TrackedReferences::check):
+        (JSC::TrackedReferences::dump):
+        * bytecode/TrackedReferences.h: Added.
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::observeTransitions):
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::fixTypeForRepresentation):
+        (JSC::DFG::AbstractValue::mergeOSREntryValue):
+        (JSC::DFG::AbstractValue::filter):
+        (JSC::DFG::AbstractValue::dumpInContext):
+        (JSC::DFG::AbstractValue::validateReferences):
+        (JSC::DFG::AbstractValue::setOSREntryValue): Deleted.
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::fullTop):
+        (JSC::DFG::AbstractValue::merge):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::run):
+        * dfg/DFGCommonData.cpp:
+        (JSC::DFG::CommonData::invalidate):
+        (JSC::DFG::CommonData::validateReferences):
+        * dfg/DFGCommonData.h:
+        (JSC::DFG::CommonData::requiredRegisterCountForExecutionAndExit):
+        * dfg/DFGFrozenValue.h:
+        (JSC::DFG::FrozenValue::FrozenValue):
+        (JSC::DFG::FrozenValue::strengthenTo):
+        (JSC::DFG::FrozenValue::pointsToHeap):
+        (JSC::DFG::FrozenValue::strength):
+        (JSC::DFG::FrozenValue::freeze):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::registerFrozenValues):
+        (JSC::DFG::Graph::visitChildren):
+        (JSC::DFG::Graph::freeze):
+        (JSC::DFG::Graph::freezeStrong):
+        (JSC::DFG::Graph::freezeFragile): Deleted.
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::setOptimizationThresholdBasedOnCompilationResult):
+        (JSC::DFG::JITCode::validateReferences):
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::addressOfDoubleConstant):
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::branchStructurePtr):
+        (JSC::DFG::JITCompiler::jitCode):
+        (JSC::DFG::JITCompiler::noticeOSREntry): Deleted.
+        * dfg/DFGMinifiedGraph.cpp: Added.
+        (JSC::DFG::MinifiedGraph::prepareAndShrink):
+        (JSC::DFG::MinifiedGraph::validateReferences):
+        * dfg/DFGMinifiedGraph.h:
+        (JSC::DFG::MinifiedGraph::append):
+        (JSC::DFG::MinifiedGraph::prepareAndShrink): Deleted.
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::OSREntryData::dumpInContext):
+        (JSC::DFG::OSREntryData::dump):
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        (JSC::DFG::getOSREntryDataBytecodeIndex):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::linkOSREntries):
+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
+        * dfg/DFGStructureAbstractValue.cpp:
+        (JSC::DFG::StructureAbstractValue::dump):
+        (JSC::DFG::StructureAbstractValue::validateReferences):
+        * dfg/DFGStructureAbstractValue.h:
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * dfg/DFGValueStrength.cpp:
+        (WTF::printInternal):
+        * dfg/DFGValueStrength.h:
+        (JSC::DFG::merge):
+        * ftl/FTLExitPropertyValue.cpp:
+        (JSC::FTL::ExitPropertyValue::dump):
+        (JSC::FTL::ExitPropertyValue::validateReferences):
+        * ftl/FTLExitPropertyValue.h:
+        * ftl/FTLExitTimeObjectMaterialization.cpp:
+        (JSC::FTL::ExitTimeObjectMaterialization::dump):
+        (JSC::FTL::ExitTimeObjectMaterialization::validateReferences):
+        * ftl/FTLExitTimeObjectMaterialization.h:
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dump):
+        (JSC::FTL::ExitValue::validateReferences):
+        * ftl/FTLExitValue.h:
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::dfgCommon):
+        (JSC::FTL::JITCode::validateReferences):
+        * ftl/FTLJITCode.h:
+        (JSC::FTL::JITCode::handles):
+        (JSC::FTL::JITCode::dataSections):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::validateReferences):
+        * ftl/FTLOSRExit.h:
+        (JSC::FTL::OSRExit::considerAddingAsFrequentExitSite):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::typeName):
+        (JSC::JITCode::validateReferences):
+        (JSC::JITCode::execute):
+        * jit/JITCode.h:
+        (JSC::JITCode::start):
+        * tests/stress/dead-osr-entry-value.js: Added.
+        (foo):
+
+2015-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to run the OSR exit fuzzer
+        https://bugs.webkit.org/show_bug.cgi?id=146814
+
+        Reviewed by Mark Lam.
+        
+        Fix a silly bug: the option matching was accidentally allowing a prefix match, which
+        always did the wrong thing for --fireOSRExitFuzzAt and --fireOSRExitFuzzAtStatic. Make
+        this an exact match instead.
+
+        * runtime/Options.cpp:
+        (JSC::Options::setOption):
+
+2015-07-09  Mark Lam  <mark.lam@apple.com>
+
+        SymbolTable::entryFor() should do a bounds check before indexing into the localToEntry vector.
+        https://bugs.webkit.org/show_bug.cgi?id=146807
+
+        Reviewed by Filip Pizlo.
+
+        When we capture an argument by name and we use "arguments", we put all of the
+        arguments into the scope.  But destructured arguments are put into the scope
+        anonymously i.e. the SymbolTable knows that the scope offset is in use via
+        SymbolTable::m_maxScopeOffset, but that ScopeOffset won't appear in
+        SymbolTable::m_map.
+
+        The SymbolTable's m_localToEntry vector is synthesized from its m_map, and will
+        have a size which is based on the largest ScopeOffset in the m_map.  If we have a
+        scenario where the anonymous argument is at a higher ScopeOffset than all the
+        named arguments, then the m_localsToEntry vector will not have an entry for it
+        i.e. the m_localsToEntry vector will have a size that is <= the ScopeOffset of
+        the anonymous argument.
+
+        Hence, SymbolTable::entryFor() should ensure that the requested ScopeOffset is
+        within the bounds of the m_localToEntry vector before indexing into it.
+
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::entryFor):
+
+2015-07-09  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r180248): Repro Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::createRangeError + 20
+        https://bugs.webkit.org/show_bug.cgi?id=146767
+
+        Reviewed by Geoffrey Garen.
+
+        If the stack check fails at the top most frame, we must use that frame to
+        generate the exception.  Reverted the code to always use the current frame to
+        throw an out of stack exception.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+2015-07-03  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR exit fuzzing should allow us to select a static exit site
+        https://bugs.webkit.org/show_bug.cgi?id=146601
+
+        Reviewed by Geoffrey Garen.
+        
+        The original implementation of the fuzzer allows us to trigger an exit based on its index
+        in the dynamic sequence of exit sites encountered. But there are usually millions of
+        dynamically encountered exit sites, even if the program only has thousands of static exit
+        sites. That means that we would at best be able to do a random sampling of exits, and
+        those would be biased to the hottest exit sites.
+        
+        This change allows us to also select exit sites based on their index in the static
+        sequence of exit sites that the compiler compiled. Then, once that static exit site is
+        selected, we can select which dynamic exit at that exit site we should trigger. Since the
+        number of static exit sites is usually smallish (it's bounded by program size), we can do
+        an exhaustive search over all exit sites in most programs.
+
+        * dfg/DFGOSRExitFuzz.cpp:
+        (JSC::numberOfStaticOSRExitFuzzChecks):
+        (JSC::numberOfOSRExitFuzzChecks):
+        * dfg/DFGOSRExitFuzz.h:
+        (JSC::DFG::doOSRExitFuzzing):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitOSRExitFuzzCheck):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        * jsc.cpp:
+        (jscmain):
+        * runtime/Options.h:
+        * runtime/TestRunnerUtils.h:
+
+2015-07-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix grammar issue in TypeError attempting to change an unconfigurable property
+        https://bugs.webkit.org/show_bug.cgi?id=146774
+
+        Reviewed by Brent Fulgham.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+
+2015-07-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove the unused HeapBlock.h
+        https://bugs.webkit.org/show_bug.cgi?id=146580
+
+        Reviewed by Andreas Kling.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopiedBlock.h:
+        * heap/CopiedSpace.h:
+        * heap/CopiedSpaceInlines.h:
+        * heap/HandleBlock.h:
+        * heap/HeapBlock.h: Removed.
+        * heap/MarkedBlock.h:
+
+2015-07-06  Saam barati  <saambarati1@gmail.com>
+
+        JSC's parser should follow the ES6 spec with respect to parsing Declarations
+        https://bugs.webkit.org/show_bug.cgi?id=146621
+
+        Reviewed by Mark Lam.
+
+        There were a few locations where JSC would allow declaration statements
+        in incorrect ways. JSC didn't distinguish between 'Statement' and
+        'StatementListItem' grammar productions. The relevant grammar is here:
+        http://www.ecma-international.org/ecma-262/6.0/index.html#sec-statements
+
+        From the ECMA Script 6.0 spec:
+        1. Section 13.6 The if Statement (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-if-statement) 
+         says that IfStatements only takes Statements for the "then-else" clauses, not StatementListItems.
+         (Same with 'while/for/do-while' loop bodies).
+        2. Section 13 ECMAScript Language: Statements and Declarations 
+         (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-ecmascript-language-statements-and-declarations)
+         defines the syntax of Statements, and they do not include ClassDeclarations and LexicalDeclarations 
+         (const, let, see 13.3.1 Let and Const Declarations).
+         Declarations can only be in the “then-else” clauses when embedded in a StatementListItem in a BlockStatement (see 13.2).
+
+        Hence, the following style of declarations are no longer allowed:
+            'if/for/while (condition) const x = 40;'
+            'if/for/while (condition) class C { }'
+
+        Instead, we mandate such declaration constructs are within a StatementList 
+       (which is the production that JSC's Parser::parseSourceElements function parses):
+           'if/for/while (condition) { const x = 40; }'
+           'if/for/while (condition) { class C { } }'
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseSourceElements):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseVarDeclaration):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseExpressionStatement):
+        * parser/Parser.h:
+        (JSC::Parser::getLabel):
+
+2015-07-06  Alex Christensen  <achristensen@webkit.org>
+
+        Unreviewed debug build fix after r186358.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::fastConcatWith):
+        Pass vm parameter to fastConcatType.
+
+2015-07-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Array.concat should be fast for integer or double arrays
+        https://bugs.webkit.org/show_bug.cgi?id=146260
+
+        Reviewed by Darin Adler.
+
+        Added a fast path to Array.prototype.concat. When concatenating two Int32, Double, or Contiguous
+        arrays, simply memcopy the arrays into a new uninitialized buffer.
+
+        This improves huffman encoding in CompressionBench by 3.7x on a Mid 2014 MacBookPro.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::fastConcatWith): Added.
+        * runtime/JSArray.h:
+        (JSC::JSArray::fastConcatType): Added. Returns the resultant array's indexing type if we can use
+        the fact path. Returns NonArray otherwise.
+
+2015-07-06  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Streams API] Remove ReadableStream custom constructor
+        https://bugs.webkit.org/show_bug.cgi?id=146547
+
+        Reviewed by Darin Adler.
+
+        Adding helper function to throw range errors.
+
+        * runtime/Error.h:
+        (JSC::throwRangeError):
+        (JSC::throwVMRangeError):
+
+2015-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement the latest Promise spec in JS
+        https://bugs.webkit.org/show_bug.cgi?id=146229
+
+        Reviewed by Sam Weinig.
+
+        Updated the Promise implementation to meet to the ES6 spec.
+        This patch
+        1. Implement ES6 Promise and related abstract operations in builtins JS
+        2. Expose @enqueueJob private function to JS world to post the microtask
+
+        Updated implementation has one-on-one correspondence to the ES6 spec description.
+        And keep the JSPromiseDeferred because it is the interface used from the WebCore.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/Array.prototype.js:
+        (reduce):
+        (reduceRight):
+        (every):
+        (forEach):
+        (filter):
+        (map):
+        (some):
+        (fill):
+        (find):
+        (findIndex):
+        (includes):
+        (copyWithin):
+        ToInteger / ToLength are renamed to toInteger and toLength.
+        * builtins/ArrayConstructor.js:
+        (from):
+        ToInteger / ToLength are renamed to toInteger and toLength.
+        * builtins/GlobalObject.js:
+        (toInteger):
+        (toLength):
+        (isObject):
+        (ToInteger): Deleted.
+        (ToLength): Deleted.
+        ToInteger / ToLength are renamed to toInteger and toLength.
+        Add new abstract operation, isObject.
+        * builtins/Operations.Promise.js: Added.
+        (isPromise):
+        (newPromiseReaction):
+        (newPromiseDeferred):
+        (newPromiseCapability.executor):
+        (newPromiseCapability):
+        (triggerPromiseReactions):
+        (rejectPromise):
+        (fulfillPromise):
+        (createResolvingFunctions.resolve):
+        (createResolvingFunctions.reject):
+        (createResolvingFunctions):
+        (promiseReactionJob):
+        (promiseResolveThenableJob):
+        (initializePromise):
+        Added Promise related abstract operations.
+        * builtins/Promise.prototype.js:
+        (catch):
+        (.onFulfilled):
+        (.onRejected):
+        (then):
+        Promise#then implementation in JS.
+        * builtins/PromiseConstructor.js: Added.
+        (all.newResolveElement):
+        (all):
+        (race):
+        (reject):
+        (resolve):
+        Promise static functions implementations in JS.
+        * builtins/StringConstructor.js:
+        (raw):
+        ToInteger / ToLength are renamed to toInteger and toLength.
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::enqueueJob):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::initializePromiseFunction):
+        (JSC::JSGlobalObject::newPromiseDeferredFunction):
+        * runtime/JSJob.cpp: Renamed from Source/JavaScriptCore/runtime/JSPromiseReaction.h.
+        (JSC::createJSJob):
+        (JSC::JSJobMicrotask::run):
+        * runtime/JSJob.h: Renamed from Source/JavaScriptCore/runtime/JSPromiseFunctions.h.
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::create):
+        (JSC::JSPromise::JSPromise):
+        (JSC::JSPromise::finishCreation):
+        (JSC::JSPromise::result):
+        (JSC::JSPromise::destroy): Deleted.
+        (JSC::JSPromise::visitChildren): Deleted.
+        (JSC::JSPromise::reject): Deleted.
+        (JSC::JSPromise::resolve): Deleted.
+        (JSC::JSPromise::appendResolveReaction): Deleted.
+        (JSC::JSPromise::appendRejectReaction): Deleted.
+        (JSC::triggerPromiseReactions): Deleted.
+        * runtime/JSPromise.h:
+        (JSC::JSPromise::status): Deleted.
+        (JSC::JSPromise::result): Deleted.
+        (JSC::JSPromise::constructor): Deleted.
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        (JSC::JSPromiseConstructorFuncResolve): Deleted.
+        (JSC::JSPromiseConstructorFuncReject): Deleted.
+        (JSC::performPromiseRaceLoop): Deleted.
+        (JSC::JSPromiseConstructorFuncRace): Deleted.
+        (JSC::performPromiseAll): Deleted.
+        (JSC::JSPromiseConstructorFuncAll): Deleted.
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::create):
+        (JSC::createJSPromiseDeferredFromConstructor): Deleted.
+        (JSC::updateDeferredFromPotentialThenable): Deleted.
+        (JSC::performDeferredResolve): Deleted.
+        (JSC::performDeferredReject): Deleted.
+        (JSC::abruptRejection): Deleted.
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPromiseFunctions.cpp: Removed.
+        (JSC::deferredConstructionFunction): Deleted.
+        (JSC::createDeferredConstructionFunction): Deleted.
+        (JSC::identifyFunction): Deleted.
+        (JSC::createIdentifyFunction): Deleted.
+        (JSC::promiseAllCountdownFunction): Deleted.
+        (JSC::createPromiseAllCountdownFunction): Deleted.
+        (JSC::promiseResolutionHandlerFunction): Deleted.
+        (JSC::createPromiseResolutionHandlerFunction): Deleted.
+        (JSC::rejectPromiseFunction): Deleted.
+        (JSC::createRejectPromiseFunction): Deleted.
+        (JSC::resolvePromiseFunction): Deleted.
+        (JSC::createResolvePromiseFunction): Deleted.
+        (JSC::throwerFunction): Deleted.
+        (JSC::createThrowerFunction): Deleted.
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototypeFuncThen): Deleted.
+        * runtime/JSPromiseReaction.cpp: Removed.
+        (JSC::createExecutePromiseReactionMicrotask): Deleted.
+        (JSC::ExecutePromiseReactionMicrotask::run): Deleted.
+        (JSC::JSPromiseReaction::create): Deleted.
+        (JSC::JSPromiseReaction::JSPromiseReaction): Deleted.
+        (JSC::JSPromiseReaction::finishCreation): Deleted.
+        (JSC::JSPromiseReaction::visitChildren): Deleted.
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Deleted.
+        * runtime/VM.h:
+
+2015-07-04  Chris Dumez  <cdumez@apple.com>
+
+        Drop RefPtr::clear() method
+        https://bugs.webkit.org/show_bug.cgi?id=146556
+
+        Reviewed by Brady Eidson.
+
+        Drop RefPtr::clear() method in favor of "= nullptr;" pattern.
+
+2015-07-03  Dan Bernstein  <mitz@apple.com>
+
+        Just give up on -Wunreachable-code in JavaScriptCore.
+
+        * Configurations/Base.xcconfig:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+
+2015-07-03  Dan Bernstein  <mitz@apple.com>
+
+        Fixed the LLINT CLoop build.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+
+2015-07-03  Dan Bernstein  <mitz@apple.com>
+
+        [Xcode] Update some build settings as recommended by Xcode 7
+        https://bugs.webkit.org/show_bug.cgi?id=146597
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/Base.xcconfig: Enabled CLANG_WARN_UNREACHABLE_CODE and
+        GCC_NO_COMMON_BLOCKS. Removed GCC_MODEL_TUNING.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Updated LastUpgradeCheck.
+
+        * dfg/DFGGraph.h: Tweaked the definition of DFG_CRASH to suppress unreachable code warnings.
+
+2015-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Relax builtin JS restriction about try-catch
+        https://bugs.webkit.org/show_bug.cgi?id=146555
+
+        Reviewed by Sam Weinig.
+
+        When retrieving the captured variables from the full activated scope,
+        it swapped the given vector with the stored declared variables vector.
+        This is because retrieving the captured variables are executed in the
+        last sequence of the parser, so declared variables are no longer used.
+        However, in builtins functions case, after retrieving the captured
+        variables, we check the variables by using declared variables vector.
+        So at that time, the declared variables vector becomes empty and it
+        raises assertion failures when the builtins function contains the full
+        activated scope. try-catch's catch scope requires the upper scope full
+        activated, so JS code in the builtins cannot use the try-catch.
+
+        This patch relaxes this restriction. When retrieving the captured
+        variables from the scope, just copy to the given vector.
+
+        * parser/Parser.h:
+        (JSC::Scope::getCapturedVariables):
+
+2015-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG and FTL should have an OSR exit fuzzer
+        https://bugs.webkit.org/show_bug.cgi?id=146562
+
+        Reviewed by Benjamin Poulain.
+        
+        Adds a basic OSR exit fuzzer to JSC. This isn't hooked into any test harnesses yet, but I
+        spot-checked it on v8-earley-boyer.js and so far found no bugs. I'd like to figure out how
+        to harness this after I land it.
+        
+        Since it's turned off by default, it should have no effect on behavior.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOSRExitFuzz.cpp: Added.
+        (JSC::numberOfOSRExitFuzzChecks):
+        * dfg/DFGOSRExitFuzz.h: Added.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitGetArgumentStart):
+        (JSC::DFG::SpeculativeJIT::emitOSRExitFuzzCheck):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        * jsc.cpp:
+        (jscmain):
+        * runtime/Options.h:
+        * runtime/TestRunnerUtils.h:
+
+2015-07-02  Saam barati  <saambarati1@gmail.com>
+
+        Rename "Deconstruction" to "Destructuring" throughout JSC
+        https://bugs.webkit.org/show_bug.cgi?id=146100
+
+        Reviewed by Mark Lam.
+
+        It is good to use the same naming conventions as the ES6 
+        spec because it is the de facto way of speaking about these 
+        language features. This also has the benefit of improving JSC's
+        hackability because it improves code readability for newcomers 
+        to JSC or newcomers to this part of the code base.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeNextParameter):
+        (JSC::BytecodeGenerator::visibleNameForParameter):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::registerFor):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::tryGetBoundLocal):
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::ClassExprNode::emitBytecode):
+        (JSC::DestructuringAssignmentNode::emitBytecode):
+        (JSC::DestructuringPatternNode::~DestructuringPatternNode):
+        (JSC::ArrayPatternNode::collectBoundIdentifiers):
+        (JSC::DeconstructingAssignmentNode::emitBytecode): Deleted.
+        (JSC::DeconstructionPatternNode::~DeconstructionPatternNode): Deleted.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createElementList):
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createClause):
+        (JSC::ASTBuilder::createClauseList):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createForOfLoop):
+        (JSC::ASTBuilder::isBindingNode):
+        (JSC::ASTBuilder::isResolve):
+        (JSC::ASTBuilder::createDestructuringAssignment):
+        (JSC::ASTBuilder::createArrayPattern):
+        (JSC::ASTBuilder::appendArrayPatternSkipEntry):
+        (JSC::ASTBuilder::appendArrayPatternEntry):
+        (JSC::ASTBuilder::appendArrayPatternRestEntry):
+        (JSC::ASTBuilder::createObjectPattern):
+        (JSC::ASTBuilder::appendObjectPatternEntry):
+        (JSC::ASTBuilder::createDeconstructingAssignment): Deleted.
+        * parser/NodeConstructors.h:
+        (JSC::TryNode::TryNode):
+        (JSC::ParameterNode::ParameterNode):
+        (JSC::ForOfNode::ForOfNode):
+        (JSC::DestructuringPatternNode::DestructuringPatternNode):
+        (JSC::ArrayPatternNode::ArrayPatternNode):
+        (JSC::ArrayPatternNode::create):
+        (JSC::ObjectPatternNode::ObjectPatternNode):
+        (JSC::BindingNode::create):
+        (JSC::BindingNode::BindingNode):
+        (JSC::DestructuringAssignmentNode::DestructuringAssignmentNode):
+        (JSC::DeconstructionPatternNode::DeconstructionPatternNode): Deleted.
+        (JSC::DeconstructingAssignmentNode::DeconstructingAssignmentNode): Deleted.
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::create):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isResolveNode):
+        (JSC::ExpressionNode::isBracketAccessorNode):
+        (JSC::ExpressionNode::isDotAccessorNode):
+        (JSC::ExpressionNode::isDestructuringNode):
+        (JSC::ExpressionNode::isFuncExprNode):
+        (JSC::ExpressionNode::isCommaNode):
+        (JSC::ExpressionNode::isSimpleArray):
+        (JSC::ParameterNode::pattern):
+        (JSC::ParameterNode::nextParam):
+        (JSC::FunctionParameters::size):
+        (JSC::FunctionParameters::at):
+        (JSC::FunctionParameters::patterns):
+        (JSC::DestructuringPatternNode::isBindingNode):
+        (JSC::DestructuringPatternNode::emitDirectBinding):
+        (JSC::ArrayPatternNode::appendIndex):
+        (JSC::ObjectPatternNode::appendEntry):
+        (JSC::BindingNode::boundProperty):
+        (JSC::DestructuringAssignmentNode::bindings):
+        (JSC::ExpressionNode::isDeconstructionNode): Deleted.
+        (JSC::DeconstructionPatternNode::isBindingNode): Deleted.
+        (JSC::DeconstructionPatternNode::emitDirectBinding): Deleted.
+        (JSC::DeconstructingAssignmentNode::bindings): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVarDeclaration):
+        (JSC::Parser<LexerType>::parseWhileStatement):
+        (JSC::Parser<LexerType>::parseVarDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseDefaultValueForDestructuringPattern):
+        (JSC::Parser<LexerType>::parseForStatement):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::tryParseDeconstructionPatternExpression): Deleted.
+        (JSC::Parser<LexerType>::parseDeconstructionPattern): Deleted.
+        (JSC::Parser<LexerType>::parseDefaultValueForDeconstructionPattern): Deleted.
+        * parser/Parser.h:
+        (JSC::isEvalNode):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createPropertyList):
+        (JSC::SyntaxChecker::createElementList):
+        (JSC::SyntaxChecker::createFormalParameterList):
+        (JSC::SyntaxChecker::createClause):
+        (JSC::SyntaxChecker::createClauseList):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * tests/stress/reserved-word-with-escape.js:
+        * tests/stress/rest-elements.js:
+
+2015-07-02  Mark Lam  <mark.lam@apple.com>
+
+        Build fix for Win EWS bot.
+        https://bugs.webkit.org/show_bug.cgi?id=146551
+
+        Not reviewed.
+
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionCrash):
+
+2015-07-02  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/21429613> [iOS] Stop making symlinks from PrivateFrameworks to Frameworks
+        https://bugs.webkit.org/show_bug.cgi?id=146542
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed the build phase that makes the symlink.
+
+2015-07-01  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Aggregate profile call information on the backend to drastically reduce profile sizes
+        https://bugs.webkit.org/show_bug.cgi?id=146536
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+        Change a CPUProfile from sending a required "calls" param to sending a required
+        "callInfo" param which includes aggregated information about the calls.
+
+2015-06-30  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::freezeFragile should register the frozen value's structure
+        https://bugs.webkit.org/show_bug.cgi?id=136055
+        rdar://problem/21042120
+
+        Reviewed by Mark Lam and Geoffrey Garen.
+        
+        This fixes weird concurrency bugs where the constant folding phase tries to convert
+        something to a constant but then crashes because the constant's structure wasn't
+        registered. The AI was registering the structure of any value it saw, but constant folding
+        wasn't - and that's fine so long as there ain't no concurrency.
+        
+        The best fix is to just make it impossible to introduce a constant into the IR without
+        registering its structure. That's what this change does. This is not only a great
+        concurrency fix - it also makes the compiler somewhat easier to hack on because it's one
+        less case of structure registering that you have to remember about.
+        
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::setOSREntryValue): No need to register.
+        (JSC::DFG::AbstractValue::set): We still call register, but just to get the watchpoint state.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::freezeFragile): Register the structure.
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run): Assert that these are all registered.
+
+2015-07-01  Matthew Mirman  <mmirman@apple.com>
+
+        Unreviewed, rolling out r185889
+        https://bugs.webkit.org/show_bug.cgi?id=146528
+        rdar://problem/21573959
+
+        Patch breaks chromeexperiments.com
+        
+        Reverted changeset:
+        
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * runtime/JSBoundSlotBaseFunction.cpp: Removed.
+        * runtime/JSBoundSlotBaseFunction.h: Removed.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Deleted.
+        (JSC::JSGlobalObject::visitChildren): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure): Deleted.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::getBoundSlotBaseFunctionForGetterSetter): Deleted.
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Deleted.
+        * runtime/VM.h:
+
+2015-07-01  Dean Jackson  <dino@apple.com>
+
+        Disable the experimental WebGL2 implementation
+        https://bugs.webkit.org/show_bug.cgi?id=146526
+        <rdar://problem/21641235>
+
+        Reviewed by Myles Maxfield.
+
+        Add (and disable) an ENABLE_WEBGL2 flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-07-01  Matthew Daiter  <mdaiter@apple.com>
+
+        Enable MEDIA_STREAM flag
+        https://bugs.webkit.org/show_bug.cgi?id=145947
+        <rdar://problem/21365829>
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig: Added MEDIA_STREAM flag
+
+2015-06-30  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        Implement ECMAScript Internationalization API
+        https://bugs.webkit.org/show_bug.cgi?id=90906
+
+        Reviewed by Benjamin Poulain.
+
+        * CMakeLists.txt: add IntlObject.cpp
+        * Configurations/FeatureDefines.xcconfig: add ENABLE_INTL flag
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: add IntlObject
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: add IntlObject
+        * JavaScriptCore.xcodeproj/project.pbxproj: add IntlObject
+        * runtime/CommonIdentifiers.h: add "Intl" name
+        * runtime/IntlObject.cpp: Added.
+        (JSC::IntlObject::IntlObject):
+        (JSC::IntlObject::create):
+        (JSC::IntlObject::finishCreation):
+        (JSC::IntlObject::createStructure):
+        * runtime/IntlObject.h: Added.
+        * runtime/JSGlobalObject.cpp: Add global Intl
+        (JSC::JSGlobalObject::init):
+
+2015-06-30  Basile Clement  <basile_clement@apple.com>
+
+        Allow object allocation sinking through GetScope, GetExecutable and SkipScope nodes
+        https://bugs.webkit.org/show_bug.cgi?id=146431
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isFunctionAllocation):
+        (JSC::DFG::Node::isPhantomFunctionAllocation):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGPromoteHeapAccess.h:
+        (JSC::DFG::promoteHeapAccess):
+
+2015-06-30  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: Reduce rendering frames "Other" time by instrumenting compositing
+        https://bugs.webkit.org/show_bug.cgi?id=146168
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/Timeline.json:
+        New timeline record type for compositing events.
+
+2015-06-29  Dean Jackson  <dino@apple.com>
+
+        Temporarily disable PICTURE_SIZES
+        https://bugs.webkit.org/show_bug.cgi?id=146435
+        <rdar://problem/21087013>
+
+        Reviewed by Tim Horton.
+
+        Temporarily disable PICTURE_SIZES because it causes problems with out
+        of date <picture> polyfills.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-06-29  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Binding generator should allow using JSC::Value for "any" parameter in lieu of ScriptValue
+        https://bugs.webkit.org/show_bug.cgi?id=146403
+
+        Reviewed by Darin Adler.
+
+        * bindings/ScriptValue.h: Added implicit conversion to JSC::JSValue.
+
+2015-06-28 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        [ES6] Implement ES6 arrow function syntax. No Line terminator between function parameters and =>
+        https://bugs.webkit.org/show_bug.cgi?id=146394
+
+        Reviewed by Yusuke Suzuki.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+
+2015-06-27  Darin Adler  <darin@apple.com>
+
+        Make converting JSString to StringView idiomatically safe
+        https://bugs.webkit.org/show_bug.cgi?id=146387
+
+        Reviewed by Anders Carlsson.
+
+        * jsc.cpp:
+        (functionPrint): Add explicit call to SafeView::get, needed since there
+        is no StringView temporary.
+        (functionDebug): Ditto.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::holesMustForwardToPrototype): Refactored into helper function.
+        (JSC::join): Refactored so that StringView is a function argument, making
+        the lifetime simpler.
+        (JSC::arrayProtoFuncJoin): Ditto.
+        (JSC::arrayProtoFuncReverse): Use new holesMustForwardToPrototype helper.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode): Add explicit call to SafeView::get.
+
+        * runtime/JSString.h: Moved declarations of functions to the top of the
+        file instead of mixing them in with the function definitions. Changed
+        return type of the view function to return a JSString::SafeView so that
+        the JSString's lifetime will last as long as the StringView does in
+        typical coding idioms.
+        (JSC::JSString::getIndex): Use unsafeView so we can index into the
+        view; could also have used view.get but here in this class this seems fine.
+        (JSC::JSRopeString::unsafeView): Renamed existing view function to this.
+        (JSC::JSString::unsafeView): Ditto.
+        (JSC::JSString::SafeView::SafeView): Contains reference to an ExecState
+        and a JSString. The ExecState is needed to create the StringView, and the
+        JSString needs to be kept alive as long as the StringView is.
+        (JSC::JSString::SafeView::operator StringView): Call unsafeView.
+        (JSC::JSString::SafeView::get): Convenience for when we want to call
+        StringView member functions.
+        (JSC::JSString::view): Added. Returns a SafeView.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncIndexOf): Add explicit call to SafeView::get.
+
+2015-06-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove ARMv7Assembler.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=146340
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.cpp: Removed.
+
+2015-06-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(ES6_ARROWFUNCTION_SYNTAX) build after r185989
+        https://bugs.webkit.org/show_bug.cgi?id=146344
+
+        Reviewed by Yusuke Suzuki.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseSourceElements):
+
+2015-06-26 Aleksandr Skachkov  <gskachkov@gmail.com>
+
+         [ES6] Implement ES6 arrow function syntax. Parser of arrow function with execution as common function. 
+         https://bugs.webkit.org/show_bug.cgi?id=144955
+
+         Reviewed by Yusuke Suzuki.
+
+         Added support of ES6 arrow function. Changes were made according to following spec http://wiki.ecmascript.org/doku.php?id=harmony:arrow_function_syntax. Patch does not include any arrow function specific behavior e.g. lexical bind this, arguments and etc.     
+        This patch implements the simplest cases of arrow function declaration:
+           parameters             () => 10 + 20
+           parameter               x => x + 20
+           parameters         (x, y) => x + y
+           function with block     x => { return x*10; }
+
+        Not implemented:
+           bind of the this, arguments, super and etc.
+           exception in case of trying to use 'new' with arrow function
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::setTokenPosition):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::lastTokenLocation):
+        (JSC::Lexer::setTerminator):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseSourceElements):
+        (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBody):
+        (JSC::Parser<LexerType>::parseSwitchClauses):
+        (JSC::Parser<LexerType>::parseSwitchDefaultClause):
+        (JSC::Parser<LexerType>::parseBlockStatement):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parseArrowFunctionExpression):
+        * parser/Parser.h:
+        (JSC::Parser::locationBeforeLastToken):
+        (JSC::Parser::isEndOfArrowFunction):
+        (JSC::Parser::isArrowFunctionParamters):
+        (JSC::Parser::setEndOfStatement):
+        * parser/ParserFunctionInfo.h:
+        * parser/ParserTokens.h:
+        * parser/SourceCode.h:
+        (JSC::SourceCode::subArrowExpression):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::endFunctionToken):
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createArrowFunctionExpr):
+        (JSC::SyntaxChecker::setFunctionNameStart):
+
+2015-06-25  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Support rest element in destructuring assignments
+        https://bugs.webkit.org/show_bug.cgi?id=146206
+
+        Reviewed by Oliver Hunt.
+
+        This patch enables rest element (...rest) in array binding patterns.
+        It generates array from the iterables.
+        In variable declarations and parameters, `[...identifier]` form is only allowed,
+        while expressions can take `[...[...rest]]` pattern.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::emitIteratorNext):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayPatternNode::bindValue):
+        (JSC::ArrayPatternNode::toString):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::appendArrayPatternSkipEntry):
+        (JSC::ASTBuilder::appendArrayPatternEntry):
+        (JSC::ASTBuilder::appendArrayPatternRestEntry):
+        * parser/Nodes.h:
+        (JSC::ArrayPatternNode::appendIndex):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseDeconstructionPattern):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+        * tests/stress/rest-elements.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-06-25  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r185956.
+        https://bugs.webkit.org/show_bug.cgi?id=146321
+
+        Causes massive crashes on test bots (Requested by bfulgham on
+        #webkit).
+
+        Reverted changeset:
+
+        "Enabling MEDIA_STREAM"
+        https://bugs.webkit.org/show_bug.cgi?id=145947
+        http://trac.webkit.org/changeset/185956
+
+2015-06-25  Michael Saboff  <msaboff@apple.com>
+
+        Minor fix to idx bounds check after 185954
+
+        Rubber Stamped by Ryosuke Niwa.
+
+        Changed "idx > 1" to "idx > 0" in two places.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::functionCallBase):
+
+2015-06-25  Keith Miller  <keith_miller@apple.com>
+
+        Address Sanitizer does not play well with memcpy in JSC::MachineThreads::tryCopyOtherThreadStack.
+        https://bugs.webkit.org/show_bug.cgi?id=146297
+
+        Reviewed by Filip Pizlo.
+
+        Since we cannot blacklist the system memcpy we must use our own naive implementation,
+        copyMemory. This is not a significant performance loss as tryCopyOtherThreadStack is
+        only called as part of an O(heapsize) operation. As the heap is generally much larger
+        than the stack the performance hit is minimal.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::copyMemory):
+        (JSC::MachineThreads::tryCopyOtherThreadStack):
+        (JSC::asanUnsafeMemcpy): Deleted.
+
+2015-06-25  Matthew Daiter  <mdaiter@apple.com>
+
+        Enabling MEDIA_STREAM
+        https://bugs.webkit.org/show_bug.cgi?id=145947
+        <rdar://problem/21365829>
+
+        Reviewed by Brent Fulgham.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-06-25  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r181889): basspro.com hangs on load under JSC::ErrorInstance::finishCreation(JSC::ExecState*, JSC::VM&, WTF::String const&, bool) + 2801 (JavaScriptCore + 3560689)
+        https://bugs.webkit.org/show_bug.cgi?id=146298
+
+        Reviewed by Mark Lam.
+
+        We were underflowing in ExceptionHelpers.cpp::functionCallBase() with a right to left
+        string index.  Added checks that idx stays within the string.  Also added a termination
+        condition when idx is 0.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::functionCallBase):
+
+2015-06-24  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, speculative build fix after r185942.
+
+        Add missing include for StrongInlines.h.
+
+        * runtime/ArrayPrototype.cpp:
+
+2015-06-24  Darin Adler  <darin@apple.com>
+
+        Optimize Array.join and Array.reverse for high speed array types
+        https://bugs.webkit.org/show_bug.cgi?id=146275
+
+        Reviewed by Mark Lam.
+
+        This seems to yield another 17% speed improvement in the array
+        test from the Peacekeeper benchmark.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isHole): Added. Helper to check for holes.
+        (JSC::containsHole): Ditto.
+        (JSC::arrayProtoFuncJoin): Added special cases for the various types
+        of arrays that could be in a butterfly.
+        (JSC::arrayProtoFuncReverse): Ditto.
+
+        * runtime/JSStringJoiner.h: Made appendEmptyString public so we can
+        call it from the new parts of Array.join.
+
+2015-06-24  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::SpeculativeJIT shouldn't use filter==Contradiction when it meant isClear
+        https://bugs.webkit.org/show_bug.cgi?id=146291
+        rdar://problem/21435366
+
+        Reviewed by Michael Saboff.
+        
+        The filter() method returns Contradiction only when a value *becomes* clear. This is
+        necessary for supporting the convention that non-JSValue nodes have a bottom proved
+        type. (We should fix that convention eventually, but for now let's just be consistent
+        about it.)
+        
+        * dfg/DFGFiltrationResult.h: Document the issue.
+        * dfg/DFGSpeculativeJIT32_64.cpp: Work around the issue.
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * dfg/DFGSpeculativeJIT64.cpp: Work around the issue.
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+
+2015-06-24  Michael Saboff  <msaboff@apple.com>
+
+        Crash on gog.com due to PolymorphicCallNode's having stale references to CallLinkInfo
+        https://bugs.webkit.org/show_bug.cgi?id=146285
+
+        Reviewed by Filip Pizlo.
+
+        CallLinkInfo's contain a RefPtr to a PolymorphicCallStubRoutine, named stub, which contains
+        a collection of PolymorphicCallNode.  Those PolymorphicCallNodes have a reference back to the
+        CallLinkInfo.  When a CallLinkInfo replaces or clears "stub", the ref count of the
+        PolymorphicCallStubRoutine is decremented as expected, but since it inherits from
+        GCAwareJITStubRoutine, it isn't actually deleted until GC.  In the mean time, the original
+        CallLinkInfo can go away.  If PolymorphicCallNode::unlink() is called at that point,
+        it will try to unlink a now deleted CallLinkInfo and crash as a result.
+
+        The fix is to clear the CallLinkInfo references from any PolymorphicCallNode objects when
+        when we set a new stub or clear an existing stub for a CallLinkInfo.  This is done by
+        calling PolymorphicCallNode::clearCallNodesFor() on the old stub.
+
+        The prior code would only call clearCallNodesFor() from the CallLinkInfo destructor.
+        This only took care of the last PolymorphicCallStubRoutine held in the CallLinkInfo.
+        Any prior PolymorphicCallStubRoutine would still have a, now bad, reference to the CallLinkInfo.
+
+        In the process I refactored CallLinkInfo from a struct to a class with proper accessors and
+        made all the data elements private.
+
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::clearStub): Updated to call PolymorphicCallStubRoutine::clearCallNodesFor()
+        to clear the back references to this CallLinkInfo.
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::~CallLinkInfo): Moved clearCallNodesFor() call to clearStub().
+        (JSC::CallLinkInfo::setStub): Clear any prior stub before changing to the new stub.
+
+2015-06-24  Michael Saboff  <msaboff@apple.com>
+
+        Refactor CallLinkInfo from a struct to a class
+        https://bugs.webkit.org/show_bug.cgi?id=146292
+
+        Rubber stamped by Filip Pizlo.
+
+        Refactored CallLinkInfo from a struct to a class with proper accessors and made all the
+        data elements private.
+
+        Done in preparation for fixing https://bugs.webkit.org/show_bug.cgi?id=146285.
+
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::clearStub):
+        (JSC::CallLinkInfo::unlink):
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::callTypeFor):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::~CallLinkInfo):
+        (JSC::CallLinkInfo::specializationKindFor):
+        (JSC::CallLinkInfo::specializationKind):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::CallLinkInfo::setUpCall):
+        (JSC::CallLinkInfo::setCallLocations):
+        (JSC::CallLinkInfo::setUpCallFromFTL):
+        (JSC::CallLinkInfo::callReturnLocation):
+        (JSC::CallLinkInfo::hotPathBegin):
+        (JSC::CallLinkInfo::hotPathOther):
+        (JSC::CallLinkInfo::setCallee):
+        (JSC::CallLinkInfo::clearCallee):
+        (JSC::CallLinkInfo::callee):
+        (JSC::CallLinkInfo::setLastSeenCallee):
+        (JSC::CallLinkInfo::clearLastSeenCallee):
+        (JSC::CallLinkInfo::lastSeenCallee):
+        (JSC::CallLinkInfo::haveLastSeenCallee):
+        (JSC::CallLinkInfo::setStub):
+        (JSC::CallLinkInfo::stub):
+        (JSC::CallLinkInfo::seenOnce):
+        (JSC::CallLinkInfo::clearSeen):
+        (JSC::CallLinkInfo::setSeen):
+        (JSC::CallLinkInfo::hasSeenClosure):
+        (JSC::CallLinkInfo::setHasSeenClosure):
+        (JSC::CallLinkInfo::clearedByGC):
+        (JSC::CallLinkInfo::setCallType):
+        (JSC::CallLinkInfo::callType):
+        (JSC::CallLinkInfo::addressOfMaxNumArguments):
+        (JSC::CallLinkInfo::maxNumArguments):
+        (JSC::CallLinkInfo::offsetOfSlowPathCount):
+        (JSC::CallLinkInfo::setCalleeGPR):
+        (JSC::CallLinkInfo::calleeGPR):
+        (JSC::CallLinkInfo::slowPathCount):
+        (JSC::CallLinkInfo::setCodeOrigin):
+        (JSC::CallLinkInfo::codeOrigin):
+        (JSC::getCallLinkInfoCodeOrigin):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+        (JSC::CallLinkStatus::computeDFGStatuses):
+        * bytecode/CallLinkStatus.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLJSCallBase.cpp:
+        (JSC::FTL::JSCallBase::link):
+        * jit/AccessorCallJITStubRoutine.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITOperations.cpp:
+        * jit/PolymorphicCallStubRoutine.cpp:
+        (JSC::PolymorphicCallNode::unlink):
+        (JSC::PolymorphicCallNode::clearCallLinkInfo):
+        * jit/PolymorphicCallStubRoutine.h:
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::linkSlowFor):
+        (JSC::linkFor):
+        (JSC::revertCall):
+        (JSC::unlinkFor):
+        (JSC::linkPolymorphicCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualForThunkGenerator):
+
+2015-06-24  Doug Russell  <d_russell@apple.com>
+
+        Bug 146177 - AX: AXObjectCache should try to use an unignored accessibilityObject 
+        when posting a selection notification when on the border between two accessibilityObjects
+        https://bugs.webkit.org/show_bug.cgi?id=146177
+
+        Add an adopt() function to simplify JSRetainPtr<JSStringRef> { Adopt, string } to adopt(string).
+
+        Reviewed by Darin Adler.
+
+        * API/JSRetainPtr.h:
+        (adopt):
+
+2015-06-24  Keith Miller  <keith_miller@apple.com>
+
+        Strict Equality on objects should only check that one of the two sides is an object.
+        https://bugs.webkit.org/show_bug.cgi?id=145992
+
+        This patch adds a new optimization for checking strict equality on objects.
+        If we speculate that a strict equality comparison has an object on one side
+        we only need to type check that side. Equality is then determined by a pointer
+        comparison between the two values (although in the 32-bit case we must also check
+        that the other side is a cell). Once LICM hoists type checks out of a loop we
+        can be cleverer about how we choose the operand we type check if both are
+        speculated to be objects.
+
+        For testing I added the addressOf function, which returns the address
+        of a Cell to the runtime.
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectStrictEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectStrictEquality):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectStrictEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectStrictEquality):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareStrictEq):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionAddressOf):
+        * tests/stress/equality-type-checking.js: Added.
+        (Foo):
+        (checkStrictEq):
+        (checkStrictEqOther):
+
+2015-06-24  Mark Lam  <mark.lam@apple.com>
+
+        Fixed assertion in JSStringJoiner::join() (regression from r185899).
+
+        Not reviewed.
+
+        JSStringJoiner did not account for the case where the array being joined can
+        have null or undefined elements.  As a result, its size may be less than
+        its initially reserved capacity (which was estimated based on the array length).
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::join):
+
+2015-06-24  Darin Adler  <darin@apple.com>
+
+        Fix Array.concat with RuntimeArray (regression from my last patch)
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat): Use getLength instead of JSArray::length.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty): Added comment about use of
+        JSArray::length here that is incorrect (in a really non-obvious way).
+        (JSC::JSArray::fillArgList): Ditto.
+        (JSC::JSArray::copyToArguments): Ditto.
+
+        * runtime/JSArray.h: Added a comment explaining that it is not always
+        safe to use JSArray::length.
+
+2015-06-23  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: Fixing 2 bad asserts from r185889.
+        https://bugs.webkit.org/show_bug.cgi?id=140575
+
+        Not reviewed.
+
+        * runtime/JSBoundSlotBaseFunction.cpp:
+        (JSC::JSBoundSlotBaseFunction::finishCreation):
+
+2015-06-23  Dan Bernstein  <mitz@apple.com>
+
+        Fixed iOS production builds.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-06-22  Darin Adler  <darin@apple.com>
+
+        Make Array.join work directly on substrings without reifying them
+        https://bugs.webkit.org/show_bug.cgi?id=146191
+
+        Reviewed by Andreas Kling.
+
+        Besides the Array.join change, this has other optimizations based on
+        profiling the Peacekeeper array benchmark.
+
+        I measured a 14% speed improvement in the Peacekeeper array benchmark.
+
+        Still a lot of low hanging fruit in that test because so many of functions
+        on the array prototype are not optimizing for simple cases. For example,
+        the reverse function does individual get and put calls even when the array
+        is entirely made up of integers in contiguous storage.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty): Use tryGetIndexQuickly first before getPropertySlot.
+        (JSC::argumentClampedIndexFromStartOrEnd): Marked inline.
+        (JSC::shift): Use the getProperty helper in this file instead of using
+        getPropertySlot. Use putByIndexInline instead of calling putByIndex directly.
+        In both cases this can yield a faster code path.
+        (JSC::unshift): Ditto.
+        (JSC::arrayProtoFuncToString): Updated to use the new JSStringJoiner
+        interface. Changed local variable name to thisArray since it's not a
+        JSObject*. Changed loop index to i instead of k.
+        (JSC::arrayProtoFuncToLocaleString): Updated to use the new JSStringJoiner
+        interface. Renamed thisObj to thisObject. Added a missing exception check
+        after the toLocaleString function is called, but before toString is called
+        the result of that function.
+        (JSC::arrayProtoFuncJoin): Updated to use the new JSStringJointer interface.
+        Added a missing exception check after calling toString on the separator
+        but before calling get to get the first element in the array-like object
+        being joined. Changed loop index to i instead of k. Added missing exception
+        check after calling toString on each string from the array before calling
+        get for the next element.
+        (JSC::arrayProtoFuncConcat): Use JSArray::length instead of using the
+        getLength function.
+        (JSC::arrayProtoFuncReverse): Ditto. Also use putByIndexInline.
+        (JSC::arrayProtoFuncShift): Ditto.
+        (JSC::arrayProtoFuncSplice): Use getIndex instead of get, which includes some
+        additional optimizations.
+        (JSC::getOrHole): Deleted. Unused function.
+        (JSC::arrayProtoFuncUnShift): Use putByIndexInline.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue): Removed the duplicate copy of the the logic
+        from JSValue::toString.
+
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toStringSlowCase): Improved the performance when converting a
+        small integer to a single character string.
+        (JSC::JSValue::toWTFStringSlowCase): Moved the contents of the
+        inlineJSValueNotStringtoString function here.
+        * runtime/JSCJSValue.h: Removed no longer used toWTFStringInline and fixed
+        a comment with a typo.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putByIndexInline): Marked ALWAYS_INLINE because this was not
+        getting inlined at some call sites.
+        (JSC::JSObject::indexingData): Deleted. Unused function.
+        (JSC::JSObject::currentIndexingData): Deleted. Unused function.
+        (JSC::JSObject::getHolyIndexQuickly): Deleted. Unused function.
+        (JSC::JSObject::relevantLength): Deleted. Unused function.
+        (JSC::JSObject::currentRelevantLength): Deleted. Unused function.
+
+        * runtime/JSString.h: Added the StringViewWithUnderlyingString struct and
+        the viewWithUnderlyingString function. Removed the inlineJSValueNotStringtoString
+        and toWTFStringInline functions.
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::appendStringToData): Changed this to be a template instead of writing
+        it out, since StringView::getCharactersWithUpconvert does almsot exactly what
+        this function was trying to do.
+        (JSC::joinStrings): Rewrote this to use StringView.
+        (JSC::JSStringJoiner::joinedLength): Added. Factored out from the join function.
+        (JSC::JSStringJoiner::join): Rewrote to make it a bit simpler. Added an assertion
+        that we entirely filled capacity, since we are now reserving capacity and using
+        uncheckedAppend. Use String instead of RefPtr<StringImpl> because there was no
+        particular value to using the impl directly.
+
+        * runtime/JSStringJoiner.h: Changed the interface to the class to use StringView.
+        Also changed this class so it now has the responsibility to convert each JSValue
+        into a string. This let us share more code between toString and join, and also
+        lets us use the new viewWithUnderlyingString function, which could be confusing at
+        all the call sites, but is easier to understand here.
+
+2015-06-23  Matthew Mirman  <mmirman@apple.com>
+
+        Completes native binding descriptors with native getters and potentially setters.
+        https://bugs.webkit.org/show_bug.cgi?id=140575
+        rdar://problem/19506502
+
+        Reviewed by Mark Lam.
+
+        * CMakeLists.txt:  Added JSBoundSlotBaseFunction.cpp
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptSource.js: Added case for descriptor having a native getter.
+        * runtime/JSBoundSlotBaseFunction.cpp: Added.
+        (JSC::boundSlotBaseFunctionCall):
+        (JSC::JSBoundSlotBaseFunction::JSBoundSlotBaseFunction):  
+        Necessary wrapper for custom getters and setters as objects.
+        (JSC::JSBoundSlotBaseFunction::create):
+        (JSC::JSBoundSlotBaseFunction::visitChildren):
+        (JSC::JSBoundSlotBaseFunction::finishCreation):
+        * runtime/JSBoundSlotBaseFunction.h: Added.
+        (JSC::JSBoundSlotBaseFunction::createStructure):
+        (JSC::JSBoundSlotBaseFunction::boundSlotBase):
+        (JSC::JSBoundSlotBaseFunction::customGetterSetter):
+        (JSC::JSBoundSlotBaseFunction::isGetter):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Added a globally initialized structure for JSBoundSlotBaseFunction
+        (JSC::JSGlobalObject::visitChildren): visits that structure
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure): added a getter for that structure
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor): extends the case for CustomGetterSetter to 
+        actually include GetterSetter as a JSBoundSlotBaseFunction
+        * runtime/VM.cpp: Added initializer for customGetterSetterFunctionMap
+        * runtime/VM.h: Added cache for JSBoundSlotBaseFunction
+
+2015-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Allow trailing comma in ArrayBindingPattern and ObjectBindingPattern
+        https://bugs.webkit.org/show_bug.cgi?id=146192
+
+        Reviewed by Darin Adler.
+
+        According to the ES6 spec, trailing comma in ArrayBindingPattern and ObjectBindingPattern is allowed.
+        And empty ArrayBindingPattern and ObjectBindingPattern is also allowed.
+
+        This patch allows trailing comma and empty binding patterns.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayPatternNode::bindValue):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseDeconstructionPattern):
+        * tests/stress/trailing-comma-in-patterns.js: Added.
+        (shouldBe):
+        (iterator):
+
+2015-06-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Destructuring assignment need to accept iterables
+        https://bugs.webkit.org/show_bug.cgi?id=144111
+
+        Reviewed by Darin Adler.
+
+        This patch makes that destructuring assignments to array binding patterns accept iterables.
+        Previously, it just access the indexed properties.
+        After this patch, it iterates the given value by using ES6 iterator protocol.
+
+        The iteration becomes different from the for-of case.
+        1. Since there's no break/continue case, finally scope is not necessary.
+        2. When the error is raised, the close status of the iterator becomes true. So IteratorClose is not called for that.
+        3. Since the array binding patterns requires a limited count of iterations (if there is no rest(...rest) case), IteratorClose is called when the iteration does not consume the all values of the iterator.
+        4. Since the array binding patterns requires a specified count of iterations, iterator's next call is skipped when iterator becomes closed.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitIteratorClose):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayPatternNode::bindValue):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::finishArrayPattern):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseDeconstructionPattern):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+        * tests/stress/destructuring-assignment-accepts-iterables.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (.set shouldThrow):
+
+2015-06-19  Devin Rousso  <drousso@apple.com>
+
+        Web Inspector: Highlight currently edited CSS selector
+        https://bugs.webkit.org/show_bug.cgi?id=145658
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/protocol/DOM.json: Added highlightSelector to show highlight over multiple nodes.
+
+2015-06-19  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix build for EWS bots.
+
+        Not reviewed.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWithArrayStorage):
+
+2015-06-19  Michael Saboff  <msaboff@apple.com>
+
+        Crash in com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::FTL::fixFunctionBasedOnStackMaps + 17225
+        https://bugs.webkit.org/show_bug.cgi?id=146133
+
+        Reviewed by Geoffrey Garen.
+
+        When generating code to put in inline caching areas, if there isn't enough space,
+        then create and link to an out of line area.  We connect the inline code to this
+        out of line code area by planting a jump from the inline area to the out of line
+        code and appending a jump at the end of the out of line code bck to the instruction
+        following the inline area.  We fill the unused inline area with nops, primarily to 
+        ensure the disassembler doesn't get confused.
+
+        * ftl/FTLCompile.cpp:
+        (generateInlineIfPossibleOutOfLineIfNot): New function that determines if there is enough space
+        in the inline code area for the code to link.  If so, it links inline, otherwise it links the
+        code out of line and plants appropriate jumps to/from the out of line code.
+        (generateICFastPath):
+        (generateCheckInICFastPath):
+        (fixFunctionBasedOnStackMaps):
+        Use generateInlineIfPossibleOutOfLineIfNot() to link code intended for inline cache space.
+
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        (JSC::FTL::OutOfLineCodeInfo::OutOfLineCodeInfo):
+        Added code to finalize any out of line LinkBuffer created by generateInlineIfPossibleOutOfLineIfNot().
+
+2015-06-19  Geoffrey Garen  <ggaren@apple.com>
+
+        WebKit crash while loading nytimes at JavaScriptCore: JSC::ExecutableAllocator::allocate + 276
+        https://bugs.webkit.org/show_bug.cgi?id=146163
+        <rdar://problem/20392986>
+
+        Reviewed by Michael Saboff.
+
+        There's no good way to test this in our test harness because we don't
+        have a way to simulate executable memory pressure, and doing so would
+        cause the cases that still use JITCompilationMustSucceed to crash.
+
+        Instead, I tested by manually forcing all regexp JIT compilation to
+        fail and running the JavaScriptCore tests.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile): Allow compilation to fail. We can
+        fall back to the regexp interpreter if we need to.
+
+2015-06-19  Mark Lam  <mark.lam@apple.com>
+
+        Employ explicit operator bool() instead of using the UnspecifiedBoolType workaround.
+        https://bugs.webkit.org/show_bug.cgi?id=146154
+
+        Reviewed by Darin Adler.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::dataLocation):
+        (JSC::MacroAssemblerCodePtr::operator bool):
+        (JSC::MacroAssemblerCodePtr::operator==):
+        (JSC::MacroAssemblerCodeRef::tryToDisassemble):
+        (JSC::MacroAssemblerCodeRef::operator bool):
+        (JSC::MacroAssemblerCodeRef::dump):
+        (JSC::MacroAssemblerCodePtr::operator UnspecifiedBoolType*): Deleted.
+        (JSC::MacroAssemblerCodeRef::operator UnspecifiedBoolType*): Deleted.
+
+        * bytecode/CodeOrigin.cpp:
+        (JSC::CodeOrigin::isApproximatelyEqualTo):
+        - Fixed a bug here where we were expecting to compare Executable pointers, but
+          ended up comparing a (UnspecifiedBoolType*)1 with another
+          (UnspecifiedBoolType*)1.
+
+        * bytecode/LLIntCallLinkInfo.h:
+        (JSC::LLIntCallLinkInfo::~LLIntCallLinkInfo):
+        (JSC::LLIntCallLinkInfo::isLinked):
+        (JSC::LLIntCallLinkInfo::unlink):
+        * dfg/DFGBlockWorklist.h:
+        (JSC::DFG::BlockWith::BlockWith):
+        (JSC::DFG::BlockWith::operator bool):
+        (JSC::DFG::BlockWithOrder::BlockWithOrder):
+        (JSC::DFG::BlockWithOrder::operator bool):
+        (JSC::DFG::BlockWith::operator UnspecifiedBoolType*): Deleted.
+        (JSC::DFG::BlockWithOrder::operator UnspecifiedBoolType*): Deleted.
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * dfg/DFGLazyNode.h:
+        (JSC::DFG::LazyNode::operator!):
+        (JSC::DFG::LazyNode::operator bool):
+        (JSC::DFG::LazyNode::operator UnspecifiedBoolType*): Deleted.
+        * heap/CopyWriteBarrier.h:
+        (JSC::CopyWriteBarrier::operator!):
+        (JSC::CopyWriteBarrier::operator bool):
+        (JSC::CopyWriteBarrier::get):
+        (JSC::CopyWriteBarrier::operator UnspecifiedBoolType*): Deleted.
+        * heap/Handle.h:
+        (JSC::HandleBase::operator!):
+        (JSC::HandleBase::operator bool):
+        (JSC::HandleBase::slot):
+        (JSC::HandleBase::operator UnspecifiedBoolType*): Deleted.
+        * heap/Strong.h:
+        (JSC::Strong::operator!):
+        (JSC::Strong::operator bool):
+        (JSC::Strong::swap):
+        (JSC::Strong::operator UnspecifiedBoolType*): Deleted.
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrierBase::operator bool):
+        (JSC::JITWriteBarrierBase::operator!):
+        (JSC::JITWriteBarrierBase::setFlagOnBarrier):
+        (JSC::JITWriteBarrierBase::operator UnspecifiedBoolType*): Deleted.
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWithArrayStorage):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator UnspecifiedBoolType*): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::hasSparseMap):
+        * runtime/PropertyDescriptor.h:
+        (JSC::PropertyDescriptor::writablePresent):
+        (JSC::PropertyDescriptor::enumerablePresent):
+        (JSC::PropertyDescriptor::configurablePresent):
+        (JSC::PropertyDescriptor::setterPresent):
+        (JSC::PropertyDescriptor::getterPresent):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::slot):
+        (JSC::WriteBarrierBase::operator bool):
+        (JSC::WriteBarrierBase::operator!):
+        (JSC::WriteBarrierBase<Unknown>::tagPointer):
+        (JSC::WriteBarrierBase<Unknown>::payloadPointer):
+        (JSC::WriteBarrierBase<Unknown>::operator bool):
+        (JSC::WriteBarrierBase<Unknown>::operator!):
+        (JSC::WriteBarrierBase::operator UnspecifiedBoolType*): Deleted.
+        (JSC::WriteBarrierBase<Unknown>::operator UnspecifiedBoolType*): Deleted.
+
+2015-06-19  Anders Carlsson  <andersca@apple.com>
+
+        Add a JSC symlink in /System/Library/PrivateFrameworks
+        https://bugs.webkit.org/show_bug.cgi?id=146158
+        rdar://problem/21465968
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-06-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Avoid getOwnPropertyNames/Symbols on very large lists
+        https://bugs.webkit.org/show_bug.cgi?id=146141
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._propertyDescriptors):
+        Avoid calling getOwnPropertyNames/Symbols on very large lists. Instead
+        just generate property descriptors for the first 100 indexes. Note
+        this would behave poorly for sparse arrays with a length > 100, but
+        general support for lists with more than 100 elements is poor. See:
+        <https://webkit.org/b/143589> Web Inspector: Better handling for large collections in Object Trees
+
+2015-06-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG] Avoid OSR exit in the middle of string concatenation
+        https://bugs.webkit.org/show_bug.cgi?id=145820
+
+        Reviewed by Filip Pizlo.
+
+        DFG attempt to compile ValueAdd with String type into MakeRope(left, ToString(ToPrimitive(right))).
+
+        So when right is speculated as SpecObject, ToPrimitive(SpecObject) is speculated as SpecString.
+        It leads ToString to become Identity with a speculated type check.
+
+        However, ToPrimitive and ToString are originated from the same bytecode. And ToPrimitive may have
+        an observable side effect when the given parameter is an object (calling object.{toString,valueOf}).
+
+        So when object.toString() returns a number (it is allowed in the ES spec), ToPrimitive performs
+        observable `object.toString()` calling. But ToString is converted into a speculated type check for
+        SpecString and it raises OSR exit. And we exit to the original ValueAdd's bytecode position and
+        it redundantly performs an observable ToPrimitive execution.
+
+        To fix this, this patch avoid fixing up for newly introduced ToString node.
+        Since fix up phase is not iterated repeatedly, by avoiding fixing up when generating the node,
+        we can avoid conversion from ToString to Check.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        * tests/stress/toprimitive-speculated-types.js: Added.
+        (shouldBe):
+        (raw):
+        (Counter):
+
+2015-06-18  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: improve generated types for objects passed to backend commands
+        https://bugs.webkit.org/show_bug.cgi?id=146091
+
+        Reviewed by Joseph Pecoraro.
+
+        The main change is that objects passed in will have a type like const T& or const T*,
+        rather than const RefPtr<T>&&. These protocol objects are owned by the generated dispatcher
+        methods and only exist to pass data to backend command implementations. So, there is no
+        reason for callees to add a reference or take ownership of these inputs.
+
+        Some small improvements were made in the code generator to standardize how these
+        expressions are generated for parameters. Optional in parameters are now prefixed with
+        'opt_in_' to make the generated method signatures and implementations clearer.
+
+        * inspector/InspectorValues.cpp:
+        (Inspector::InspectorArrayBase::get): Add const qualifier.
+        * inspector/InspectorValues.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::parseLocation):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::saveResult):
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * inspector/agents/InspectorRuntimeAgent.h:
+
+        * inspector/scripts/codegen/cpp_generator.py: Always generate PrimitiveType('array').
+        (CppGenerator.cpp_type_for_unchecked_formal_in_parameter): Alter the type signature
+        for an unchecked input to use pointers or references.
+
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
+        (CppBackendDispatcherHeaderGenerator._generate_handler_declaration_for_command):
+        (CppBackendDispatcherHeaderGenerator._generate_async_handler_declaration_for_command):
+        Local variables for optional parameters now have the 'opt_' prefix.
+
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator._generate_async_dispatcher_class_for_domain):
+        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        Local variables for optional parameters now have the 'opt_' prefix.
+        Split parameterName and parameterKey into two separate template variables to avoid mixups.
+
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+
+2015-06-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed. Rollout r185670 as it caused some tests to be flakey.
+
+        * debugger/Debugger.cpp:
+
+2015-06-17  Alex Christensen  <achristensen@webkit.org>
+
+        [Content Extensions] Log blocked loads to the WebInspector console
+        https://bugs.webkit.org/show_bug.cgi?id=146089
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::messageSourceValue):
+        * inspector/protocol/Console.json:
+        * runtime/ConsoleTypes.h:
+        Add content blocker message source.
+
+2015-06-18  Saam Barati  <saambarati1@gmail.com>
+
+        [ES6] support default values in deconstruction parameter nodes
+        https://bugs.webkit.org/show_bug.cgi?id=142679
+
+        Reviewed by Darin Adler.
+
+        ES6 destructuring allows destructuring properties to assign 
+        default values. A link to the spec: 
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-destructuring-binding-patterns
+
+        This patch implements default values for all places where deconstruction
+        is allowed besides function parameters. This is because function
+        parameters are parsed in a separate parser arena than the function
+        body itself and ExpresionNode's which are default values for
+        deconstruction parameters will be deallocated by the time we parse the body
+        of the function. I have opened a bug to address this problem:
+        https://bugs.webkit.org/show_bug.cgi?id=145995
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::DeconstructionPatternNode::~DeconstructionPatternNode):
+        (JSC::assignDefaultValueIfUndefined):
+        (JSC::ArrayPatternNode::bindValue):
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        (JSC::ArrayPatternNode::toString):
+        (JSC::ArrayPatternNode::collectBoundIdentifiers):
+        (JSC::ObjectPatternNode::bindValue):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::appendArrayPatternSkipEntry):
+        (JSC::ASTBuilder::appendArrayPatternEntry):
+        (JSC::ASTBuilder::createObjectPattern):
+        (JSC::ASTBuilder::appendObjectPatternEntry):
+        (JSC::ASTBuilder::createBindingLocation):
+        * parser/Nodes.h:
+        (JSC::ArrayPatternNode::appendIndex):
+        (JSC::ObjectPatternNode::appendEntry):
+        (JSC::ObjectPatternNode::Entry::Entry): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseDeconstructionPattern):
+        (JSC::Parser<LexerType>::parseDefaultValueForDeconstructionPattern):
+        (JSC::Parser<LexerType>::parseConstDeclarationList):
+        * parser/Parser.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2015-06-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Do not show JavaScriptCore builtins in inspector
+        https://bugs.webkit.org/show_bug.cgi?id=146049
+
+        Reviewed by Timothy Hatcher.
+
+        * debugger/Debugger.cpp:
+
+2015-06-17  Andreas Kling  <akling@apple.com>
+
+        [JSC] jsSubstring() should have a fast path for 0..baseLength "substrings."
+        <https://webkit.org/b/146051>
+
+        Reviewed by Anders Carlsson.
+
+        If asked to make a substring that actually spans the entire base string,
+        have jsSubstring() just return the base instead of allocating a new JSString.
+
+        3% speed-up on Octane/regexp.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring):
+
+2015-06-16  Alex Christensen  <achristensen@webkit.org>
+
+        32-bit build fix after r185640.
+
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        Explicitly cast clamped int64_t to an int.
+
+2015-06-09  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should eliminate array bounds checks in loops
+        https://bugs.webkit.org/show_bug.cgi?id=145768
+
+        Reviewed by Benjamin Poulain.
+        
+        This adds a phase that does forward propagation of integer inequalities. This allows us
+        to do the algebraic reasoning we need to eliminate array bounds checks in loops. It
+        also eliminates overflow checks on ArithAdd with a constant.
+        
+        The phase's analysis produces results that are powerful enough to do speculative bounds
+        check hoisting, but this phase currently only does elimination. We can implement
+        hoisting later.
+        
+        On programs that just loop over an array like:
+        
+            for (var i = 0; i < array.length; ++i)
+                thingy += array[i]
+        
+        This change is a 60% speed-up.
+        
+        This is also a ~3% speed-up on Kraken, and it shows various speed-ups on individual
+        tests in Octane.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp: Added.
+        (JSC::DFG::performIntegerRangeOptimization):
+        * dfg/DFGIntegerRangeOptimizationPhase.h: Added.
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * tests/stress/add-overflows-after-not-equal.js: Added.
+        * tests/stress/no-abc-skippy-loop.js: Added.
+        * tests/stress/no-abc-skippy-paired-loop.js: Added.
+        * tests/stress/sub-overflows-after-not-equal.js: Added.
+
+2015-06-16  Andreas Kling  <akling@apple.com>
+
+        Remove unused template parameter InlineCapacity from SegmentedVector.
+        <https://webkit.org/b/146044>
+
+        Reviewed by Anders Carlsson.
+
+        * bytecode/ArrayProfile.h:
+        * dfg/DFGCommonData.h:
+
+2015-06-16  Michael Saboff  <msaboff@apple.com>
+
+        Inlining in the DFG trashes ByteCodeParser::m_currentInstruction for the calling function
+        https://bugs.webkit.org/show_bug.cgi?id=146029
+
+        Reviewed by Benjamin Poulain.
+
+        Save and restore m_currentInstruction around call to ByteCodeParser::inlineCall() as it will
+        use m_currentInstruction during its own parsing.  This happens because inlineCall() parses the
+        inlined callee's bytecodes by calling parseCodeBlock() which calls parseBlock() on each block.
+        It is in parseBlock() that we set m_currentInstruction to an instruction before we parse it.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::parseBlock): Added an ASSERT to catch this issue.
+
+2015-06-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out unintended JSC change from https://trac.webkit.org/changeset/185425.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasExitSite):
+        (JSC::CodeBlock::exitProfile):
+        (JSC::CodeBlock::numberOfExitSites): Deleted.
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::ExitProfile::add):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::ExitProfile::hasExitSite):
+        (JSC::DFG::ExitProfile::size): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        * runtime/Options.h:
+
+2015-06-16  Mark Lam  <mark.lam@apple.com>
+
+        Use NakedPtr<Exception>& to return exception results.
+        https://bugs.webkit.org/show_bug.cgi?id=145870
+
+        Reviewed by Anders Carlsson and Filip Pizlo.
+
+        Before r185259, calls into the VM takes a JSValue* exception result argument for
+        returning any uncaught exception that may have been thrown while executing JS code.
+        As a result, clients of the VM functions will declare a local JSValue exception
+        result which is automatically initialized to a null value (i.e. the empty value,
+        not the JS null value).
+
+        With r185259, the VM functions were changed to take an Exception*& exception result
+        instead, and the VM functions are responsible for initializing the exception result
+        to null if no exception is thrown.
+
+        This introduces 2 issues:
+
+        1. the VM functions are vulnerable to modifications that may add early returns
+           before the exception result is nullified.  This can result in the exception
+           result being used without initialization.
+
+        2. Previously, a client could technically use the same exception result for more
+           than one calls into the VM functions.  If an earlier call sets it to a thrown
+           value, the thrown value will stick unless a subsequent call throws a different
+           exception.
+
+           With the new Exception*& exception result, the VM functions will always clear
+           the exception result before proceeding.  As a result, the client's exception
+           result will be null after the second call even though the first call saw an
+           exception thrown.  This is a change in the expected behavior.
+
+        To fix these issues, we'll introduce a NakedPtr smart pointer whose sole purpose
+        is to guarantee that the pointer is initialized.  The VM functions will now take
+        a NakedPtr<Exception>& instead of the Exception*&.  This ensures that the
+        exception result is initialized.
+
+        The VM functions be also reverted to only set the exception result if a new
+        exception is thrown.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSScriptRef.cpp:
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptFunctionCall::call):
+        * bindings/ScriptFunctionCall.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::hasBreakpoint):
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisValue):
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::isValid):
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::createInjectedScript):
+        * inspector/InspectorEnvironment.h:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptCallFrame.h:
+        (Inspector::JavaScriptCallFrame::vmEntryGlobalObject):
+        (Inspector::JavaScriptCallFrame::thisValue):
+        (Inspector::JavaScriptCallFrame::evaluate):
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction):
+        * jsc.cpp:
+        (functionRun):
+        (functionLoad):
+        (runWithScripts):
+        (runInteractive):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::evaluate):
+
+2015-06-15  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL boolify() UntypedUse is wrong in the masquerades-as-undefined case
+        https://bugs.webkit.org/show_bug.cgi?id=146002
+
+        Reviewed by Darin Adler.
+
+        * ftl/FTLLowerDFGToLLVM.cpp: Put this in an anonymous namespace. We should have done that all along. It makes it easier to add debug code.
+        (JSC::FTL::DFG::LowerDFGToLLVM::boolify): Fix the bug.
+        * tests/stress/logical-not-masquerades.js: Added. This test creates a masquerader so that the watchpoint is invalid. Previously this would fail for the normal object cases.
+        (foo):
+
+2015-06-16  Andreas Kling  <akling@apple.com>
+
+        [JSC] Pre-bake final Structure for RegExp matches arrays.
+        <https://webkit.org/b/146006>
+
+        Reviewed by Darin Adler.
+
+        Since we always add the "index" and "input" fields to RegExp matches arrays,
+        cache a finished structure on the global object so we can create these arrays without
+        starting from scratch with a bare array every time.
+
+        10% progression on Octane/regexp (on my MBP.)
+
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        (JSC::JSArray::createWithButterfly): Factored out JSArray construction into a helper
+        so we can call this from RegExpMatchesArray.cpp.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure): Add a cached Structure for RegExp
+        subpattern matches arrays.
+
+        * runtime/JSObject.h:
+        (JSC::JSNonFinalObject::finishCreation): Tweak assertion that used to check that
+        JSNonFinalObjects always start out with zero capacity. Since RegExp matches arrays now
+        start out with capacity for 2 properties, that won't work. Change it to check that we
+        don't have inline storage instead, since that should only be used by final objects.
+
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::tryCreateUninitializedRegExpMatchesArray): Helper to construct a JSArray with
+        the cached Structure and a Butterfly with 2 slots of property storage.
+
+        (JSC::createRegExpMatchesArray):
+        (JSC::createRegExpMatchesArrayStructure): Creates the array Structure that gets cached
+        by the JSGlobalObject.
+
+2015-06-16  Saam Barati  <saambarati1@gmail.com>
+
+        LLInt's code path for get_from_scope with case GlobalVarWithVarInjectionChecks has dead code
+        https://bugs.webkit.org/show_bug.cgi?id=144268
+
+        Reviewed by Darin Adler.
+
+        The call to loadVariable(.) both for 32bit and 64bit is unnecessary. 
+        It grabs a value that is immediately overwritten by a call to getGlobalVar(). 
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2015-06-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Introduce %IteratorPrototype% and drop all XXXIteratorConstructor
+        https://bugs.webkit.org/show_bug.cgi?id=145963
+
+        Reviewed by Darin Adler.
+
+        ES6 iterators inherit %IteratorPrototype%.
+        And these prototype objects of derived iterators don't have @@iterator methods.
+        Instead they use the %IteratorPrototype%[@@iterator] method.
+
+        To encourage inlining in for-of statement, we define this method in JS builtins.
+
+        And these iterator prototype objects don't have any constructor function.
+        This patch drops them (like StringIteratorConstructor).
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/Iterator.prototype.js: Renamed from Source/JavaScriptCore/runtime/StringIteratorConstructor.cpp.
+        (SymbolIterator):
+        * runtime/ArrayIteratorConstructor.cpp:
+        (JSC::ArrayIteratorConstructor::finishCreation): Deleted.
+        * runtime/ArrayIteratorConstructor.h: Removed.
+        (JSC::ArrayIteratorConstructor::create): Deleted.
+        (JSC::ArrayIteratorConstructor::createStructure): Deleted.
+        (JSC::ArrayIteratorConstructor::ArrayIteratorConstructor): Deleted.
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::arrayIteratorProtoFuncIterator): Deleted.
+        * runtime/IteratorPrototype.cpp: Renamed from Source/JavaScriptCore/runtime/ArrayIteratorConstructor.cpp.
+        (JSC::IteratorPrototype::finishCreation):
+        * runtime/IteratorPrototype.h: Renamed from Source/JavaScriptCore/runtime/SetIteratorConstructor.h.
+        (JSC::IteratorPrototype::create):
+        (JSC::IteratorPrototype::createStructure):
+        (JSC::IteratorPrototype::IteratorPrototype):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::createBuiltinFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::iteratorPrototype):
+        * runtime/MapIteratorConstructor.cpp: Removed.
+        (JSC::MapIteratorConstructor::finishCreation): Deleted.
+        * runtime/MapIteratorConstructor.h: Removed.
+        (JSC::MapIteratorConstructor::create): Deleted.
+        (JSC::MapIteratorConstructor::createStructure): Deleted.
+        (JSC::MapIteratorConstructor::MapIteratorConstructor): Deleted.
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototype::finishCreation): Deleted.
+        (JSC::MapIteratorPrototypeFuncIterator): Deleted.
+        * runtime/SetIteratorConstructor.cpp: Removed.
+        (JSC::SetIteratorConstructor::finishCreation): Deleted.
+        * runtime/SetIteratorConstructor.h:
+        (JSC::SetIteratorConstructor::create): Deleted.
+        (JSC::SetIteratorConstructor::createStructure): Deleted.
+        (JSC::SetIteratorConstructor::SetIteratorConstructor): Deleted.
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototype::finishCreation): Deleted.
+        (JSC::SetIteratorPrototypeFuncIterator): Deleted.
+        * runtime/StringIteratorConstructor.cpp:
+        (JSC::StringIteratorConstructor::finishCreation): Deleted.
+        * runtime/StringIteratorConstructor.h: Removed.
+        (JSC::StringIteratorConstructor::create): Deleted.
+        (JSC::StringIteratorConstructor::createStructure): Deleted.
+        (JSC::StringIteratorConstructor::StringIteratorConstructor): Deleted.
+        * runtime/StringIteratorPrototype.cpp:
+        (JSC::StringIteratorPrototype::finishCreation):
+        (JSC::stringIteratorPrototypeIterator): Deleted.
+        * tests/stress/iterator-prototype.js: Added.
+        (shouldBe):
+        (inheritIteratorPrototype):
+        (testChain):
+
+2015-06-15  Michael Saboff  <msaboff@apple.com>
+
+        JIT bug - fails when inspector closed, works when open
+        https://bugs.webkit.org/show_bug.cgi?id=145243
+
+        Reviewed by Oliver Hunt.
+
+        We need to provide the Arguments object as the base when creating the HeapLocation for
+        GetFromArguments and PutToArguments.  Otherwise we endup creating a HeapLocation for
+        any arguments object, not the one we need.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2015-06-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: console.table() with a list of objects no longer works
+        https://bugs.webkit.org/show_bug.cgi?id=145952
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.RemoteObject.prototype._generatePreview):
+        Calling generatePreview again was actually starting with a preview
+        of the current object instead of the sub-value. Go down the other
+        path that correctly generates sub-previews. Leave filtering on the
+        backend unimplemented, which we were already ignoring.
+
+2015-06-13  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Streams API] ReadableJSStream should handle promises returned by JS source start callback
+        https://bugs.webkit.org/show_bug.cgi?id=145792
+
+        Reviewed by Darin Adler.
+
+        Added support for JSFunction implemented by std::function.
+
+        * runtime/JSFunction.cpp:
+        (JSC::getNativeExecutable): Refactored code to share it with the two JSFunction::create
+        (JSC::JSFunction::create):
+        (JSC::runStdFunction):
+        * runtime/JSFunction.h: Added std::function based JSFunction::create prototype.
+        * runtime.JSPromise.h:
+
+2015-06-12  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
+
+        Purge PassRefPtr in JavaScriptCore - 2
+        https://bugs.webkit.org/show_bug.cgi?id=145834
+
+        Reviewed by Darin Adler.
+
+        As a step to remove PassRefPtr, this patch cleans up PassRefPtr as much as possible
+        in JavaScriptCore.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::create):
+        * API/JSClassRef.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::callerFrame):
+        * debugger/DebuggerCallFrame.h:
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::jitCode):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStack):
+        (Inspector::createScriptCallStackForConsole):
+        (Inspector::createScriptCallStackFromException):
+        (Inspector::createScriptArguments):
+        * inspector/ScriptCallStackFactory.h:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::stopProfiling):
+        * profiler/LegacyProfiler.h:
+        * runtime/DateInstanceCache.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/Executable.h:
+        * runtime/GenericTypedArrayView.h:
+        * runtime/GenericTypedArrayViewInlines.h:
+        (JSC::GenericTypedArrayView<Adaptor>::create):
+        (JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
+
+2015-06-12  Darin Adler  <darin@apple.com>
+
+        Fix minor ES6 compliance issue in RegExp.prototype.toString and optimize performance a little
+        https://bugs.webkit.org/show_bug.cgi?id=145935
+
+        Reviewed by Anders Carlsson.
+
+        Test: js/regexp-toString.html
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::getFlags): Avoid memory allocation for the flags string by returning it in a character
+        buffer instead of constructing a WTF::String for it.
+        (JSC::regExpProtoFuncToString): Require only that the this value be an object; don't require
+        that it is actually a regular expression object. This is covered in the ES6 specification.
+        Also removed comment about the "/(?:)/" trick since that is now the repsonsibility of the
+        getter for the "source" property. Updated to use getFlags so we do one less memory allocation.
+        (JSC::regExpProtoGetterFlags): Chagned to use getFlags instead of the old flagsString.
+
+2015-06-12  Basile Clement  <basile_clement@apple.com>
+
+        DFG Object Allocation Sinking should not consider GetClosureVar as escapes
+        https://bugs.webkit.org/show_bug.cgi?id=145904
+
+        Reviewed by Filip Pizlo.
+
+        The object allocation sinking phase is currently able to sink
+        CreateActivation nodes, but will consider any GetClosureVar node as
+        escaping.
+
+        This is not problematic in general as most of the GetClosureVar nodes
+        we would have been able to sink over will have been eliminated by CSE
+        anyway. Still, this is an oversight that we should fix since the
+        machinery is already in place.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGPromoteHeapAccess.h:
+        (JSC::DFG::promoteHeapAccess):
+
+2015-06-11  Mark Lam  <mark.lam@apple.com>
+
+        WebCore::reportException() needs to be able to accept a raw thrown value in addition to Exception objects.
+        https://bugs.webkit.org/show_bug.cgi?id=145872
+
+        Reviewed by Michael Saboff.
+
+        In r185259, we changed exception handling code inside the VM to work with
+        Exception objects instead of the thrown JSValue.  The handling code will get the
+        exception stack trace from the Exception object.
+
+        However, there is some code that cannot be updated to pass the Exception object.
+        An example of this are the ObjC API functions.  Those functions are specified to
+        return any thrown exception JSValue in a JSValueRef.  Since these APIs are
+        public, we cannot arbitrarily change them to use the Exception object.
+
+        There are client code that calls these APIs and then passes the returned exception
+        JSValue to WebCore::reportException() to be reported.  WebCore::reportException()
+        previously relied on the VM::exceptionStackTrace() to provide a cache of the
+        stack trace of the last thrown exception.  VM::exceptionStackTrace() no longer
+        exists in the current code.
+
+        To restore this functionality, we will introduce VM::lastException() which
+        caches the last thrown Exception object.  With this, if the exception passed to
+        WebCore::reportException() to be reported isn't an Exception object (which has its
+        own stack trace), reportException() can again use the cached exception stack trace
+        which is available from VM::lastException().
+
+        * heap/Heap.cpp:
+        (JSC::Heap::visitException):
+        - visit VM::m_lastException on GCs.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::lastException):
+        (JSC::ExecState::clearLastException):
+        - convenience functions to get and clear the last exception.
+
+        * runtime/Exception.cpp:
+        (JSC::Exception::create):
+        (JSC::Exception::finishCreation):
+        - add support to create an Exception object without capturing the JS stack trace.
+          This is needed for making an Exception object to wrap a thrown value that does
+          not have a stack trace.
+          Currently, this is only used by WebCore::reportException() when there is no
+          Exception object and no last exception available to provide a stack trace.
+
+        * runtime/Exception.h:
+        (JSC::Exception::cast): Deleted.  No longer needed.
+
+        * runtime/VM.h:
+        (JSC::VM::clearLastException):
+        (JSC::VM::setException):
+        (JSC::VM::lastException):
+        (JSC::VM::addressOfLastException):
+        - Added support for VM::m_lastException.
+          VM::m_lastException serves to cache the exception stack of the most recently
+          thrown exception like VM::exceptionStackTrace() used to before r185259.
+
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        - Clear VM::m_lastException when we re-enter the VM.  Exceptions should have been
+          handled before we re-enter the VM anyway.  So, this is a good place to release
+          the cached last exception.
+
+          NOTE: this is also where the old code before r185259 clears the last exception
+          stack trace.  So, we're just restoring the previous behavior here in terms of
+          the lifecycle of the last exception stack.
+
+2015-06-11  Andreas Kling  <akling@apple.com>
+
+        jsSubstring() should support creating substrings from substrings.
+        <https://webkit.org/b/145427>
+
+        Reviewed by Geoffrey Garen
+
+        Tweak jsSubstring() to support base strings that are themselves substrings.
+        They will now share the same grandparent base. This avoids creating a new StringImpl.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring): Don't force rope resolution here. Instead do that in finishCreation()
+        if the base string is a non-substring rope. Note that resolveRope() is the very last thing
+        called, since it may allocate and the JSRopeString needs to be ready for marking.
+
+        (JSC::JSString::isSubstring): Added a helper to find out if a JSString is
+        a substring. This is just for internal use, so you don't have to cast to
+        JSRopeString for the real substringness flag.
+
+2015-06-11  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r185465.
+        https://bugs.webkit.org/show_bug.cgi?id=145893
+
+        "This patch is breaking 32bit mac build" (Requested by youenn
+        on #webkit).
+
+        Reverted changeset:
+
+        "[Streams API] ReadableJSStream should handle promises
+        returned by JS source start callback"
+        https://bugs.webkit.org/show_bug.cgi?id=145792
+        http://trac.webkit.org/changeset/185465
+
+2015-06-11  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Streams API] ReadableJSStream should handle promises returned by JS source start callback
+        https://bugs.webkit.org/show_bug.cgi?id=145792
+
+        Reviewed by Darin Adler.
+
+        Added support for JSFunction implemented by std::function.
+
+        * runtime/JSFunction.cpp:
+        (JSC::getNativeExecutable): Refactored code to share it with the two JSFunction::create
+        (JSC::JSFunction::create):
+        (JSC::runStdFunction):
+        * runtime/JSFunction.h: Added std::function based JSFunction::create prototype.
+        * runtime.JSPromise.h:
+
+2015-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        ASSERTION FAILED: s.length() > 1 on LayoutTests/js/regexp-flags.html
+        https://bugs.webkit.org/show_bug.cgi?id=145599
+
+        Unreviewed, simple follow up patch.
+
+        use jsString instead of jsMakeNontrivialString
+        since the flag string may be trivial (0 or 1 length).
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoGetterFlags):
+
+2015-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        JavaScript: Drop the “escaped reserved words as identifiers” compatibility measure
+        https://bugs.webkit.org/show_bug.cgi?id=90678
+
+        Reviewed by Darin Adler.
+
+        After ES6, escaped reserved words in identifiers are prohibited.
+        After parsing Identifier, we should perform `m_buffer16.shrink(0)`.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<CharacterType>::parseIdentifierSlowCase):
+        * tests/mozilla/ecma_3/Unicode/uc-003.js:
+        (test): Deleted.
+        * tests/stress/reserved-word-with-escape.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+
+2015-06-10  Jordan Harband  <ljharb@gmail.com>
+
+        Implement RegExp.prototype.flags
+        https://bugs.webkit.org/show_bug.cgi?id=145599
+
+        Reviewed by Geoffrey Garen.
+        Per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-get-regexp.prototype.flags
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::flagsString):
+        (JSC::regExpProtoFuncToString):
+        (JSC::regExpProtoGetterFlags):
+        * tests/stress/static-getter-in-names.js:
+
+2015-06-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ASSERTION FAILED: !iterate() on stress/singleton-scope-then-overwrite.js.ftl-eager
+        https://bugs.webkit.org/show_bug.cgi?id=145853
+
+        Unreviewed, remove the assertion.
+
+        * dfg/DFGCSEPhase.cpp:
+
+2015-06-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r185414.
+        https://bugs.webkit.org/show_bug.cgi?id=145844
+
+        broke debug and jsc tests (Requested by alexchristensen on
+        #webkit).
+
+        Reverted changeset:
+
+        "JavaScript: Drop the “escaped reserved words as identifiers”
+        compatibility measure"
+        https://bugs.webkit.org/show_bug.cgi?id=90678
+        http://trac.webkit.org/changeset/185414
+
+2015-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        JavaScript: Drop the “escaped reserved words as identifiers” compatibility measure
+        https://bugs.webkit.org/show_bug.cgi?id=90678
+
+        Reviewed by Darin Adler.
+
+        After ES6, escaped reserved words in identifiers are prohibited.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<CharacterType>::parseIdentifierSlowCase):
+        * tests/stress/reserved-word-with-escape.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+
+2015-06-10  Andreas Kling  <akling@apple.com>
+
+        [JSC] InlineCallFrame::arguments should be sized-to-fit.
+        <https://webkit.org/b/145782>
+
+        Reviewed by Darin Adler.
+
+        I spotted this Vector<ValueRecovery> looking a bit chubby in Instruments,
+        with 354 kB of memory allocated on cnet.com.
+
+        Use resizeToFit() instead of resize() since we know the final size up front.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+
+2015-06-09  Chris Dumez  <cdumez@apple.com>
+
+        Allow one sync GC per gcTimer interval on critical memory pressure warning
+        https://bugs.webkit.org/show_bug.cgi?id=145773
+
+        Reviewed by Geoffrey Garen.
+
+        On critical memory pressure warning, we were calling GCController::garbageCollectSoon(),
+        which does not offer any guarantee on when the garbage collection will actually take
+        place.
+
+        On critical memory pressure, we need to free up memory as soon as possible to avoid
+        getting killed so this is an issue. Also, the fact that we clear the PageCache on
+        critical memory pressure means a GC would likely be useful, even if the last
+        collection did not free much memory.
+
+        This patch adds a new GCController::garbageCollectNowIfNotDoneRecently() API that allows
+        one synchronous GC per gcTimer interval on critical memory pressure warning. This makes
+        us more responsive to critical memory pressure and avoids doing synchronous GCs too
+        often.
+
+        * heap/FullGCActivityCallback.cpp:
+        (JSC::FullGCActivityCallback::doCollection):
+        * heap/FullGCActivityCallback.h:
+        (JSC::GCActivityCallback::createFullTimer):
+        * heap/GCActivityCallback.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbageIfNotDoneRecently):
+        * heap/Heap.h:
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doWork): Deleted.
+        * heap/IncrementalSweeper.h:
+
+        Drop fullSweep() API as it no longer seems useful. garbageCollectNow()
+        already does a sweep after the full collection.
+
+2015-06-09  Andreas Kling  <akling@apple.com>
+
+        [JSC] CodeBlock::m_constantRegisters should be sized-to-fit.
+        <https://webkit.org/b/145784>
+
+        Reviewed by Darin Adler.
+
+        Spotted this Vector looking chubby on cnet.com, with 1.23 MB of memory
+        allocated below CodeBlock::setConstantRegisters().
+
+        Use resizeToFit() instead since we know the final size up front.
+        Also removed some unused functions that operated on this constants vector
+        and the corresponding one in UnlinkedCodeBlock.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::addOrFindConstant): Deleted.
+        (JSC::CodeBlock::findConstant): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setConstantRegisters):
+        (JSC::CodeBlock::numberOfConstantRegisters): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::addOrFindConstant): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::numberOfConstantRegisters): Deleted.
+        (JSC::UnlinkedCodeBlock::getConstant): Deleted.
+
+2015-06-09  Andreas Kling  <akling@apple.com>
+
+        [JSC] Polymorphic{Get,Put}ByIdList::addAccess() should optimize for size, not speed.
+        <https://webkit.org/b/145786>
+
+        Reviewed by Darin Adler.
+
+        These functions already contained comments saying they optimize for size over speed,
+        but they were using Vector::resize() which adds the usual slack for faster append().
+
+        Switch them over to using Vector::resizeToFit() instead, which makes the Vector
+        allocate a perfectly sized backing store.
+
+        Spotted 670 kB of the GetById ones, and 165 kB of PutById on cnet.com, so these
+        Vectors are definitely worth shrink-wrapping.
+
+        * bytecode/PolymorphicGetByIdList.cpp:
+        (JSC::PolymorphicGetByIdList::addAccess):
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PolymorphicPutByIdList::addAccess):
+
+2015-06-09  Andreas Kling  <akling@apple.com>
+
+        [JSC] JSPropertyNameEnumerator's property name vector should be sized-to-fit.
+        <https://webkit.org/b/145787>
+
+        Reviewed by Darin Adler.
+
+        Saw 108 kB worth of JSPropertyNameEnumerator backing store Vectors on cnet.com.
+        Use Vector::resizeToFit() since we know the perfect size up front.
+
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::finishCreation):
+
+2015-06-09  Andreas Kling  <akling@apple.com>
+
+        FunctionExecutable::isCompiling() is weird and wrong.
+        <https://webkit.org/b/145689>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove FunctionExecutable::isCompiling() and the clearCodeIfNotCompiling() style
+        functions that called it before throwing away code.
+
+        isCompiling() would consider the executable to be "compiling" if it had a CodeBlock
+        but no JITCode. In practice, every executable gets a JITCode at the same time as it
+        gets a CodeBlock, by way of prepareForExecutionImpl().
+
+        * debugger/Debugger.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode):
+        (JSC::Heap::deleteAllUnlinkedFunctionCode):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::TypeRecompiler::visit):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilation):
+        (JSC::FunctionExecutable::clearCodeIfNotCompiling): Deleted.
+        (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilationIfNotCompiling): Deleted.
+        * runtime/Executable.h:
+        * runtime/VM.cpp:
+        (JSC::StackPreservingRecompiler::visit):
+
+2015-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce getter definition into static hash tables and use it for getters in RegExp.prototype.
+        https://bugs.webkit.org/show_bug.cgi?id=145705
+
+        Reviewed by Darin Adler.
+
+        In this patch, we introduce Accessor type into property tables.
+        With Accessor type, create_hash_table creates a static getter property.
+        This getter property is reified as the same to the static functions.
+
+        In the mean time, we only support getter because `putEntry` and `lookupPut`
+        only work with null setter currently. However, in the spec, there's
+        no need to add static setter properties. So we will add it if it becomes
+        necessary in the future.
+
+        And at the same time, this patch fixes the issue 145738. Before this patch,
+        `putEntry` in `JSObject::deleteProperty` adds `undefined` property if
+        `isValidOffset(...)` is false (deleted). As the result, deleting twice
+        revives the property with `undefined` value.
+
+        If the static functions are reified and the entry is
+        `BuiltinOrFunctionOrAccessor`, there's no need to execute `putEntry` with
+        static hash table entry. They should be handled in the normal structure's
+        looking up because they should be already reified. So added guard for this.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_hash_table:
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        * runtime/Lookup.cpp:
+        (JSC::reifyStaticAccessor):
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::propertyGetter):
+        (JSC::HashTableValue::propertyPutter):
+        (JSC::HashTableValue::accessorGetter):
+        (JSC::HashTableValue::accessorSetter):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::putEntry):
+        (JSC::reifyStaticProperties):
+        * runtime/PropertySlot.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+        (JSC::regExpObjectGlobal): Deleted.
+        (JSC::regExpObjectIgnoreCase): Deleted.
+        (JSC::regExpObjectMultiline): Deleted.
+        (JSC::appendLineTerminatorEscape<LChar>): Deleted.
+        (JSC::appendLineTerminatorEscape<UChar>): Deleted.
+        (JSC::regExpObjectSourceInternal): Deleted.
+        (JSC::regExpObjectSource): Deleted.
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        (JSC::regExpProtoGetterGlobal):
+        (JSC::regExpProtoGetterIgnoreCase):
+        (JSC::regExpProtoGetterMultiline):
+        (JSC::appendLineTerminatorEscape<LChar>):
+        (JSC::appendLineTerminatorEscape<UChar>):
+        (JSC::regExpProtoGetterSourceInternal):
+        (JSC::regExpProtoGetterSource):
+        * tests/stress/static-function-delete.js: Added.
+        (shouldBe):
+        * tests/stress/static-function-put.js: Added.
+        (shouldBe):
+        * tests/stress/static-getter-delete.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        * tests/stress/static-getter-descriptors.js: Added.
+        (shouldBe):
+        * tests/stress/static-getter-enumeration.js: Added.
+        (shouldBe):
+        * tests/stress/static-getter-get.js: Added.
+        (shouldBe):
+        * tests/stress/static-getter-in-names.js: Added.
+        (shouldBe):
+        * tests/stress/static-getter-names.js: Added.
+        (shouldBe):
+        * tests/stress/static-getter-put.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-06-09  Andreas Kling  <akling@apple.com>
+
+        [JSC] JSString::getIndex() should avoid reifying substrings.
+        <https://webkit.org/b/145803>
+
+        Reviewed by Darin Adler.
+
+        Implement getIndex() using JSString::view(), which cuts it down to a one-liner
+        and also avoids reifying substrings.
+
+        I saw 178 kB of reified substrings below operationGetByVal -> getIndex()
+        on cnet.com, so this should help.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::getIndexSlowCase): Deleted.
+        * runtime/JSString.h:
+        (JSC::JSString::getIndex):
+
+2015-06-09  Andreas Kling  <akling@apple.com>
+
+        [JSC] String.prototype.indexOf() should use StringView.
+        <https://webkit.org/b/145351>
+
+        Reviewed by Darin Adler.
+
+        Use StringView::find() to implement String.prototype.indexOf().
+        This avoids reifying the needle and haystack JSStrings in case they
+        are substrings.
+
+        Reduces malloc memory by ~190 kB on cnet.com.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncIndexOf):
+
+2015-06-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Fix the style issues in cmake project files
+        https://bugs.webkit.org/show_bug.cgi?id=145755
+
+        Reviewed by Darin Adler.
+
+        * CMakeLists.txt:
+
+2015-06-08  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
+
+        Purge PassRefPtr in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=145750
+
+        As a step to purge PassRefPtr, this patch replaces PassRefPtr with Ref or RefPtr.
+
+        Reviewed by Darin Adler.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::createNoAutomaticPrototype):
+        * API/JSClassRef.h:
+        * API/JSContextRef.cpp:
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::create):
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        (JSStringCreateWithUTF8CString):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::create):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString::create):
+        * bytecompiler/StaticPropertyAnalysis.h:
+        (JSC::StaticPropertyAnalysis::create):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::create):
+        * dfg/DFGToFTLDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLDeferredCompilationCallback::create):
+        * dfg/DFGToFTLDeferredCompilationCallback.h:
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        (JSC::DFG::Ref<ToFTLForOSREntryDeferredCompilationCallback>ToFTLForOSREntryDeferredCompilationCallback::create):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::create): Deleted.
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::create):
+        (JSC::DFG::ensureGlobalDFGWorklist):
+        (JSC::DFG::ensureGlobalFTLWorklist):
+        * dfg/DFGWorklist.h:
+        * heap/EdenGCActivityCallback.h:
+        (JSC::GCActivityCallback::createEdenTimer):
+        * heap/FullGCActivityCallback.h:
+        (JSC::GCActivityCallback::createFullTimer):
+        * heap/GCActivityCallback.h:
+        * inspector/InjectedScriptHost.h:
+        * inspector/JavaScriptCallFrame.h:
+        (Inspector::JavaScriptCallFrame::create):
+        * inspector/ScriptArguments.cpp:
+        (Inspector::ScriptArguments::create):
+        * inspector/ScriptArguments.h:
+        * jit/JITStubRoutine.h:
+        (JSC::JITStubRoutine::createSelfManagedRoutine):
+        * jit/JITToDFGDeferredCompilationCallback.cpp:
+        (JSC::JITToDFGDeferredCompilationCallback::create):
+        * jit/JITToDFGDeferredCompilationCallback.h:
+        * jsc.cpp:
+        (jscmain):
+        * parser/NodeConstructors.h:
+        (JSC::ArrayPatternNode::create):
+        (JSC::ObjectPatternNode::create):
+        (JSC::BindingNode::create):
+        * parser/Nodes.cpp:
+        (JSC::FunctionParameters::create):
+        * parser/Nodes.h:
+        * parser/SourceProvider.h:
+        (JSC::StringSourceProvider::create):
+        * profiler/Profile.cpp:
+        (JSC::Profile::create):
+        * profiler/Profile.h:
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::create):
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::create):
+        * runtime/DataView.cpp:
+        (JSC::DataView::create):
+        * runtime/DataView.h:
+        * runtime/DateInstanceCache.h:
+        (JSC::DateInstanceData::create):
+        * runtime/JSPromiseReaction.cpp:
+        (JSC::createExecutePromiseReactionMicrotask):
+        * runtime/JSPromiseReaction.h:
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::create):
+        * runtime/TypeSet.h:
+        (JSC::StructureShape::create):
+        (JSC::TypeSet::create):
+        * runtime/TypedArrayBase.h:
+        (JSC::TypedArrayBase::create):
+        (JSC::TypedArrayBase::createUninitialized):
+        (JSC::TypedArrayBase::subarrayImpl):
+        * runtime/VM.cpp:
+        (JSC::VM::createContextGroup):
+        (JSC::VM::create):
+        (JSC::VM::createLeaked):
+        * runtime/VM.h:
+        * yarr/RegularExpression.cpp:
+        (JSC::Yarr::RegularExpression::Private::create):
+
+2015-06-08  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to hoist all constants in DFG SSA
+        https://bugs.webkit.org/show_bug.cgi?id=145769
+
+        Reviewed by Geoffrey Garen.
+        
+        It's sometimes somewhat more efficient, and convenient, to have all constants at the
+        top of the root block. We don't require this as an IR invariant because too many phases
+        want to be able to insert constants in weird places. But, this phase will be great for
+        preparing for https://bugs.webkit.org/show_bug.cgi?id=145768.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGConstantHoistingPhase.cpp: Added.
+        (JSC::DFG::performConstantHoisting):
+        * dfg/DFGConstantHoistingPhase.h: Added.
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2015-06-07  Filip Pizlo  <fpizlo@apple.com>
+
+        The tiny set magic in StructureSet should be available in WTF
+        https://bugs.webkit.org/show_bug.cgi?id=145722
+
+        Reviewed by Geoffrey Garen.
+        
+        I moved the generic logic of small sets of pointers and moved it into WTF. Now,
+        StructureSet is a subclass of TinyPtrSet<Structure*>. There shouldn't be any functional
+        change.
+
+        * bytecode/StructureSet.cpp:
+        (JSC::StructureSet::filter):
+        (JSC::StructureSet::filterArrayModes):
+        (JSC::StructureSet::speculationFromStructures):
+        (JSC::StructureSet::arrayModesFromStructures):
+        (JSC::StructureSet::dumpInContext):
+        (JSC::StructureSet::dump):
+        (JSC::StructureSet::clear): Deleted.
+        (JSC::StructureSet::add): Deleted.
+        (JSC::StructureSet::remove): Deleted.
+        (JSC::StructureSet::contains): Deleted.
+        (JSC::StructureSet::merge): Deleted.
+        (JSC::StructureSet::exclude): Deleted.
+        (JSC::StructureSet::isSubsetOf): Deleted.
+        (JSC::StructureSet::overlaps): Deleted.
+        (JSC::StructureSet::operator==): Deleted.
+        (JSC::StructureSet::addOutOfLine): Deleted.
+        (JSC::StructureSet::containsOutOfLine): Deleted.
+        (JSC::StructureSet::copyFromOutOfLine): Deleted.
+        (JSC::StructureSet::OutOfLineList::create): Deleted.
+        (JSC::StructureSet::OutOfLineList::destroy): Deleted.
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::onlyStructure):
+        (JSC::StructureSet::StructureSet): Deleted.
+        (JSC::StructureSet::operator=): Deleted.
+        (JSC::StructureSet::~StructureSet): Deleted.
+        (JSC::StructureSet::isEmpty): Deleted.
+        (JSC::StructureSet::genericFilter): Deleted.
+        (JSC::StructureSet::isSupersetOf): Deleted.
+        (JSC::StructureSet::size): Deleted.
+        (JSC::StructureSet::at): Deleted.
+        (JSC::StructureSet::operator[]): Deleted.
+        (JSC::StructureSet::last): Deleted.
+        (JSC::StructureSet::iterator::iterator): Deleted.
+        (JSC::StructureSet::iterator::operator*): Deleted.
+        (JSC::StructureSet::iterator::operator++): Deleted.
+        (JSC::StructureSet::iterator::operator==): Deleted.
+        (JSC::StructureSet::iterator::operator!=): Deleted.
+        (JSC::StructureSet::begin): Deleted.
+        (JSC::StructureSet::end): Deleted.
+        (JSC::StructureSet::ContainsOutOfLine::ContainsOutOfLine): Deleted.
+        (JSC::StructureSet::ContainsOutOfLine::operator()): Deleted.
+        (JSC::StructureSet::copyFrom): Deleted.
+        (JSC::StructureSet::OutOfLineList::list): Deleted.
+        (JSC::StructureSet::OutOfLineList::OutOfLineList): Deleted.
+        (JSC::StructureSet::deleteStructureListIfNecessary): Deleted.
+        (JSC::StructureSet::isThin): Deleted.
+        (JSC::StructureSet::pointer): Deleted.
+        (JSC::StructureSet::singleStructure): Deleted.
+        (JSC::StructureSet::structureList): Deleted.
+        (JSC::StructureSet::set): Deleted.
+        (JSC::StructureSet::setEmpty): Deleted.
+        (JSC::StructureSet::getReservedFlag): Deleted.
+        (JSC::StructureSet::setReservedFlag): Deleted.
+        * dfg/DFGStructureAbstractValue.cpp:
+        (JSC::DFG::StructureAbstractValue::clobber):
+        (JSC::DFG::StructureAbstractValue::filter):
+        (JSC::DFG::StructureAbstractValue::filterSlow):
+        (JSC::DFG::StructureAbstractValue::contains):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::makeTop):
+
+2015-06-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Add the missing setupArgumentsWithExecState functions after r185240
+        https://bugs.webkit.org/show_bug.cgi?id=145754
+
+        Reviewed by Benjamin Poulain.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2015-06-08  Brady Eidson  <beidson@apple.com>
+
+        Completely remove all IDB properties/constructors when it is disabled at runtime.
+        rdar://problem/18429374 and https://bugs.webkit.org/show_bug.cgi?id=137034
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/CommonIdentifiers.h:
+
+2015-06-06  Mark Lam  <mark.lam@apple.com>
+
+        Returned Exception* values need to be initialized to nullptr when no exceptions are thrown.
+        https://bugs.webkit.org/show_bug.cgi?id=145720
+
+        Reviewed by Dan Bernstein.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+
+2015-06-05  Mark Lam  <mark.lam@apple.com>
+
+        Subclasses of JSNonFinalObject with gc'able children need to implement visitChildren().
+        https://bugs.webkit.org/show_bug.cgi?id=145709
+
+        Reviewed by Geoffrey Garen.
+
+        * jsc.cpp:
+        (functionSetElementRoot):
+        - The Element class has a member of type Root which extends JSDestructibleObject.
+          It should be stored in a WriteBarrier, and visited by visitChildren().  
+
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::materializeSpecialsIfNecessary):
+        (JSC::ClonedArguments::visitChildren):
+        * runtime/ClonedArguments.h:
+        - Add missing visitChildren().
+
+        * tests/stress/cloned-arguments-should-visit-callee-during-gc.js: Added.
+        (makeTransientFunction.transientFunc):
+        (makeTransientFunction):
+
+2015-06-05  Geoffrey Garen  <ggaren@apple.com>
+
+        DropAllLocks RELEASE_ASSERT on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=139654
+
+        Reviewed by Mark Lam.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::dropAllLocks): Removed a comment because it duplicated
+        the code beneath it. Removed a FIXME because we can't ASSERT that
+        we're holding the lock. WebKit1 on iOS drops the lock before calling to
+        delegates, not knowing whether it holds the lock or not.
+
+        (JSC::JSLock::DropAllLocks::DropAllLocks): Only ASSERT that we are not
+        GC'ing if we hold the lock. If we do not hold the lock, it is perfectly
+        valid for some other thread, which does hold the lock, to be GC'ing.
+        What is not valid is to drop the lock in the middle of GC, since GC
+        must be atomic.
+
+2015-06-05  Filip Pizlo  <fpizlo@apple.com>
+
+        speculateRealNumber() should early exit if you're already a real number, not if you're already a real double.
+
+        Rubber stamped by Mark Lam.
+        
+        This was causing: https://build.webkit.org/results/Apple%20Yosemite%20Debug%20WK1%20(Tests)/r185261%20(5180)/webaudio/note-grain-on-timing-crash-log.txt
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+
+2015-06-05  Mark Lam  <mark.lam@apple.com>
+
+        finally blocks should not set the exception stack trace when re-throwing the exception.
+        https://bugs.webkit.org/show_bug.cgi?id=145525
+
+        Reviewed by Geoffrey Garen.
+
+        How exceptions presently work:
+        =============================
+        1. op_throw can throw any JSValue.
+        2. the VM tries to capture the stack at the throw point and propagate that as needed.
+        3. finally blocks are implemented using op_catch to catch the thrown value, and throws it again using op_throw.
+
+        What's wrong with how it presently works:
+        ========================================
+        1. finally's makes for bad exception throw line numbers in the Inspector console.
+
+           The op_throw in finally will throw the value anew i.e. it captures a stack from the re-throw point.
+           As a result, the Inspector sees the finally block as the throw point.  The original stack is lost.
+
+        2. finally's breaks the Inspector's "Breaks on Uncaught Exception"
+
+           This is because finally blocks are indistinguishable from catch blocks.  As a result, a try-finally,
+           which should break in the Inspector on the throw, does not because the Inspector thought the
+           exception was "caught".
+
+        3. finally's yields confusing break points when the Inspector "Breaks on All Exceptions"
+
+           a. In a try-finally scenario, the Inspector breaks 2 times: 1 at the throw, 1 at the finally.
+           b. In a for-of loop (which has synthesized finallys), the Inspector will do another break.
+              Similarly for other cases of JS code which synthesize finallys.
+           c. At VM re-entry boundaries (e.g. js throws & returns to native code, which returns to js),
+              the Inspector will do another break if there's an uncaught exception.
+
+        How this patch fixes the issues:
+        ===============================
+        1. We introduce an Exception object that wraps the thrown value and the exception stack.
+
+           When throwing an exception, the VM will check if the thrown value is an Exception
+           object or not.  If it is not an Exception object, then we must be throwing a new
+           exception.  The VM will create an Exception object to wrap the thrown value and
+           capture the current stack for it.
+
+           If the thrown value is already an Exception object, then the requested throw operation
+           must be a re-throw.  The VM will not capture a new stack for it.
+
+        2. op_catch will now populate 2 locals: 1 for the Exception, 1 for the thrown JSValue.
+
+           The VM is aware of the Exception object and uses it for rethrows in finally blocks.
+           JS source code is never aware of the Exception object.
+
+           JS code is aware of the thrown value.  If it throws the caught thrown value, that
+           constitutes a new throw, and a new Exception object will be created for it.
+
+        3. The VM no longer tracks the thrown JSValue and the exception stack.  It will only
+           track a m_exception field which is an Exception*.
+
+        4. The BytecodeGenerator has already been updated in a prior patch to distinguish
+           between Catch, Finally, and SynthesizedFinally blocks.  The interpreter runtime will
+           now report to the debugger whether we have a Catch handler, not just any handlers.
+
+           The debugger will use this detail to determine whether to break or not.  "Break on
+           uncaught exceptions" will only break if no Catch handler was found.
+
+           This solves the issue of the debugger breaking at finally blocks, and for-of statements.
+
+        5. The Exception object will also have a flag to indicate whether the debugger has been
+           notified of the Exception being thrown.  Once the Interpreter notifies the debugger
+           of the Exception object, it will mark this flag and not repeat the notify the debugger
+           again of the same Exception.
+
+           This solves the issue of the debugger breaking at VM re-entry points due to uncaught
+           exceptions.
+
+        6. The life-cycle of the captured exception stack trace will now follow the life-cycle
+           of the Exception object.
+
+        Other changes:
+        7. Change all clients of the VM::exception() to expect an Exception* instead of JSValue.
+
+        8. Fixed a few bugs where thrown exceptions are not cleared before exiting the VM.
+
+        9. Also renamed some variables and classes to better describe what they are.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+
+        * API/JSObjectRef.cpp:
+        (handleExceptionIfNeeded):
+        - The functions below all do the same exception check.  Added this helper
+          to simplify the code.
+        (JSClassCreate):
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+
+        * API/JSScriptRef.cpp:
+        * API/JSValue.mm:
+        (JSContainerConvertor::take):
+        (reportExceptionToInspector):
+
+        * API/JSValueRef.cpp:
+        (handleExceptionIfNeeded):
+        - The functions below all do the same exception check.  Added this helper
+          to simplify the code.
+        (evernoteHackNeeded):
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueCreateJSONString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        - Added new files Exception.h and Exception.cpp.
+
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptFunctionCall::call):
+        * bindings/ScriptFunctionCall.h:
+
+        * bytecode/BytecodeList.json:
+        - op_catch now had 2 operands: the exception register, and the thrown value register.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        - handlerForBytecodeOffset() now can look for just Catch handlers only.
+
+        * bytecode/HandlerInfo.h:
+        - Cleaned up some white space I accidentally added in a previous patch.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::pushTry):
+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitThrow):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+        - Adding support for op_catch's 2 operands.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::hasBreakpoint):
+        (JSC::Debugger::pauseIfNeeded):
+        (JSC::Debugger::exception):
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisValue):
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::isValid):
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::createInjectedScript):
+        * inspector/InspectorEnvironment.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::appendAPIBacktrace):
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectScriptDebugServer.h:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptCallFrame.h:
+        (Inspector::JavaScriptCallFrame::vmEntryGlobalObject):
+        (Inspector::JavaScriptCallFrame::thisValue):
+        (Inspector::JavaScriptCallFrame::evaluate):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::extractSourceInformationFromException):
+        (Inspector::createScriptCallStackFromException):
+        * inspector/ScriptCallStackFactory.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction):
+        (Inspector::ScriptDebugServer::handleBreakpointHit):
+        (Inspector::ScriptDebugServer::handleExceptionInBreakpointCondition):
+        * inspector/ScriptDebugServer.h:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearException):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::hadException):
+        (JSC::ExecState::atomicStringTable):
+        (JSC::ExecState::propertyNames):
+        (JSC::ExecState::clearSupplementaryExceptionInfo): Deleted.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::Interpreter::stackTraceAsString):
+        (JSC::GetCatchHandlerFunctor::GetCatchHandlerFunctor):
+        (JSC::GetCatchHandlerFunctor::operator()):
+        (JSC::Interpreter::unwind):
+        - Added a check for didNotifyInspectorOfThrow() here to prevent duplicate reports
+          of the same Exception to the debugger.
+
+        (JSC::GetExceptionHandlerFunctor::GetExceptionHandlerFunctor): Deleted.
+        (JSC::GetExceptionHandlerFunctor::operator()): Deleted.
+        - Renamed GetExceptionHandlerFunctor to GetCatchHandlerFunctor since the debugger
+          is only interested in knowing whether we have Catch handlers.
+
+        * interpreter/Interpreter.h:
+        (JSC::SuspendExceptionScope::SuspendExceptionScope):
+        (JSC::SuspendExceptionScope::~SuspendExceptionScope):
+        (JSC::Interpreter::sampler):
+        (JSC::ClearExceptionScope::ClearExceptionScope): Deleted.
+        (JSC::ClearExceptionScope::~ClearExceptionScope): Deleted.
+        - Renamed ClearExceptionScope to SuspendExceptionScope because "clear" implies that
+          we're purging the exception.  Instead, we're merely suspending any handling of
+          that exception for a period defined by the scope.
+
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitExceptionCheck):
+
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        - Removed the exception argument.  It is always the value in VM::exception() anyway.
+          genericUnwind() can just get it from the VM, and save everyone some work.
+
+        * jit/JITExceptions.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_catch):
+        - Add support for the new op_catch operands.
+
+        * jit/JITOperations.cpp:
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * jsc.cpp:
+        (functionRun):
+        (functionLoad):
+        (runWithScripts):
+        (runInteractive):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        - Add support for the new op_catch operands.  Also update the code to handle
+          VM::m_exception being an Exception pointer, not a JSValue.
+
+        * parser/NodeConstructors.h:
+        (JSC::TryNode::TryNode):
+        * parser/Nodes.h:
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::evaluate):
+        - Change evaluate() to take a reference to the returned exception value instead
+          of a pointer.  In all but 2 or 3 cases, we want the returned exception anyway.
+          Might as well simplify the code by requiring the reference.
+
+        * runtime/Error.h:
+        (JSC::throwVMError):
+        (JSC::throwVMTypeError):
+
+        * runtime/Exception.cpp: Added.
+        (JSC::Exception::create):
+        (JSC::Exception::destroy):
+        (JSC::Exception::createStructure):
+        (JSC::Exception::visitChildren):
+        (JSC::Exception::Exception):
+        (JSC::Exception::~Exception):
+        * runtime/Exception.h: Added.
+        (JSC::Exception::valueOffset):
+        (JSC::Exception::cast):
+        (JSC::Exception::value):
+        (JSC::Exception::stack):
+        (JSC::Exception::didNotifyInspectorOfThrow):
+        (JSC::Exception::setDidNotifyInspectorOfThrow):
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createTerminatedExecutionException):
+        (JSC::isTerminatedExecutionException):
+        (JSC::createStackOverflowError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/GetterSetter.cpp:
+        (JSC::callGetter):
+        * runtime/IteratorOperations.cpp:
+        (JSC::iteratorClose):
+        * runtime/JSObject.cpp:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::updateDeferredFromPotentialThenable):
+        (JSC::abruptRejection):
+        * runtime/JSPromiseReaction.cpp:
+        (JSC::ExecutePromiseReactionMicrotask::run):
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::releaseExecutableMemory):
+        (JSC::VM::throwException):
+        (JSC::VM::setStackPointerAtVMEntry):
+        (JSC::VM::getExceptionInfo): Deleted.
+        (JSC::VM::setExceptionInfo): Deleted.
+        (JSC::VM::clearException): Deleted.
+        (JSC::clearExceptionStack): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::targetMachinePCForThrowOffset):
+        (JSC::VM::clearException):
+        (JSC::VM::setException):
+        (JSC::VM::exception):
+        (JSC::VM::addressOfException):
+        (JSC::VM::exceptionStack): Deleted.
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::setEntryScopeDidPopListener):
+
+2015-06-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Always track out-of-bounds array access explicitly instead of relying on the slow case
+        https://bugs.webkit.org/show_bug.cgi?id=145673
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, we were deciding to use out-of-bounds speculation based on two informations:
+        -Explicitly detected out-of-bounds accesses tracked on ArrayProfile.
+        -The number of time we took the slow cases in the baseline JIT.
+
+        The heuristic based on slow cases was a little too fragile.
+
+        In some cases, we were running into that limit just because the indexing type changes between
+        two values (typically Int32Array and DoubleArray). Sometimes we were just unlucky on what
+        we used for the inline cache.
+
+        In Kraken, this was hurting us on "audio-beat-detection" and "audio-fft". The array types we see
+        change between Int32 and Double. We run into the slow path a bit but never hit
+        out-of-bounds.
+
+        By the time we compile in DFG, we have stable Double Arrays but we speculate out-of-bounds based
+        on the number of slow cases we took. Because of that, we start boxing the double on GetByVal,
+        using DoubleRep, etc. adding a ton of overhead over otherwise very simple operations.
+
+        WebXPRT was also suffering from this problem but the other way arround: we were missing
+        the out-of-bounds accesses due to changes in indexing types, we were below the threshold
+        of slow-path access, thus we predicted in-bounds accesses for code that was doing plenty
+        of out-of-bands.
+
+
+        This patch fixes the problem by tracking the out-of-bounds access explicitly any time we go
+        into the slow path in baseline JIT. Since we no longer miss any out-of-bounds, we can remove
+        the slow-path heuristic.
+
+        There is new additional special case in the C code regarding out-of-bounds: Arguments access.
+        Mispredicting out-of-bounds accesses on arguments is a disaster for performance, so those are
+        tracked in the way DFG expect it.
+
+
+        There are a few important cases that are still not covered optimally:
+        -PutByVal on Arguments.
+        -Get/Put ByVal on TypedArray.
+        Those are simply not used by DFG in any way. TypedArrays should probably be looked at in the future.
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::ArrayProfile::computeUpdatedPrediction):
+        The inline-cache repatch cases now update the ArrayProfile information. This has no value in baseline
+        JIT but it helps avoiding one recompile in DFG for the missing ArrayProfile information.
+
+        * bytecode/ArrayProfile.h:
+        (JSC::ArrayProfile::setOutOfBounds):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::getArrayModeConsideringSlowPath): Deleted.
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        * jit/JITOperations.cpp:
+        (JSC::canUseFastArgumentAccess):
+        This is not my favorite part of this patch.
+
+        I tried having JSObject::canGetIndexQuickly() handle arguments which would put everything
+        on the generic path. Unfortunately, that code is very performance sensitive and some benchmarks were
+        impacted by over 10%
+
+        I left JSObject::canGetIndexQuickly() alone, and I added the canUseFastArgumentAccess() mirroring
+        how DFG uses out-of-bounds for Arguments.
+
+        (JSC::getByVal):
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        * runtime/JSPromiseFunctions.cpp:
+        * tests/stress/get-by-val-out-of-bounds-basics.js: Added.
+        (opaqueGetByValOnInt32ArrayEarlyOutOfBounds):
+        (testInt32ArrayEarlyOutOfBounds):
+        (testIndexingTypeChangesOnInt32Array):
+        (opaqueGetByValOnStringArrayHotOutOfBounds):
+        (testStringArrayHotOutOfBounds):
+        (testIndexingTypeChangesOnStringArray):
+        (opaqueGetByValOnStringAndInt32ArrayHotOutOfBounds):
+        (testStringAndInt32ArrayHotOutOfBounds):
+        (opaqueGetByValOnDoubleArrayHotOutOfBounds):
+        * tests/stress/put-by-val-out-of-bounds-basics.js: Added.
+        (opaquePutByValOnInt32ArrayEarlyOutOfBounds):
+        (testInt32ArrayEarlyOutOfBounds):
+        (opaquePutByValOnStringArrayHotOutOfBounds):
+        (testStringArrayHotOutOfBounds):
+
+2015-06-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Simplify unboxing of double JSValues known to be not NaN and not Int32
+        https://bugs.webkit.org/show_bug.cgi?id=145618
+
+        Reviewed by Geoffrey Garen.
+        
+        In many cases we know that we most likely loaded a non-NaN double value from the heap.
+        Prior to this patch, we would do two branches before unboxing the double. This patch
+        reduces this to one branch in the common case. Before:
+        
+            if (is int32)
+                unbox int32 and convert to double
+            else if (is number)
+                unbox double
+            else
+                exit
+        
+        After:
+
+            tmp = unbox double
+            if (tmp == tmp)
+                done
+            else if (is int32)
+                unbox int32 and convert to double
+            else
+                exit
+        
+        We only use the new style if we have profiling that tells us that we are unlikely to see
+        either Int32 or NaN - since we will now exit on NaN and int32 requires an extra branch.
+        
+        This is a 8% speed-up on Octane/box2d. On one microbenchmark this is a 25% speed-up.
+        
+        Rolling this back in after I made DFG::SpeculativeJIT call a new version of unboxDouble()
+        that doesn't assert that the JSValue is a double, since we are intentionally using it
+        before doing the "is a double" test. This wasn't a problem on 32-bit since unboxDouble()
+        does no such assertion on 32-bit.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::fixEdgeRepresentation):
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateDouble):
+        (JSC::DFG::Node::shouldSpeculateDoubleReal):
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+        (JSC::DFG::SpeculativeJIT::speculateDoubleRepReal):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        (JSC::DFG::SpeculativeJIT::speculateDoubleReal): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isNumerical):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+        (JSC::FTL::LowerDFGToLLVM::boxDouble):
+        (JSC::FTL::LowerDFGToLLVM::jsValueToStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateNumber):
+        (JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
+        (JSC::FTL::LowerDFGToLLVM::speculateDoubleRepReal):
+        (JSC::FTL::LowerDFGToLLVM::jsValueToDouble): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::speculateDoubleReal): Deleted.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfNotOther):
+        (JSC::AssemblyHelpers::branchIfInt32):
+        (JSC::AssemblyHelpers::branchIfNotInt32):
+        (JSC::AssemblyHelpers::branchIfNumber):
+
+2015-06-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Class constructor appearing as Object Tree property does not include parameters
+        https://bugs.webkit.org/show_bug.cgi?id=145661
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._classPreview):
+        (InjectedScript.RemoteObject.prototype._appendPropertyPreviews):
+        The string we will return for previews of class constructor functions.
+
+        (InjectedScript.RemoteObject):
+        (InjectedScript.RemoteObject.prototype._describe):
+        No longer return the class name as the description string.
+        Instead return the class name for the RemoteObject.className.
+
+2015-06-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r185216.
+        https://bugs.webkit.org/show_bug.cgi?id=145666
+
+        it caused a bunch of debug crashes (Requested by pizlo on
+        #webkit).
+
+        Reverted changeset:
+
+        "Simplify unboxing of double JSValues known to be not NaN and
+        not Int32"
+        https://bugs.webkit.org/show_bug.cgi?id=145618
+        http://trac.webkit.org/changeset/185216
+
+2015-06-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Simplify unboxing of double JSValues known to be not NaN and not Int32
+        https://bugs.webkit.org/show_bug.cgi?id=145618
+
+        Reviewed by Geoffrey Garen.
+        
+        In many cases we know that we most likely loaded a non-NaN double value from the heap.
+        Prior to this patch, we would do two branches before unboxing the double. This patch
+        reduces this to one branch in the common case. Before:
+        
+            if (is int32)
+                unbox int32 and convert to double
+            else if (is number)
+                unbox double
+            else
+                exit
+        
+        After:
+
+            tmp = unbox double
+            if (tmp == tmp)
+                done
+            else if (is int32)
+                unbox int32 and convert to double
+            else
+                exit
+        
+        We only use the new style if we have profiling that tells us that we are unlikely to see
+        either Int32 or NaN - since we will now exit on NaN and int32 requires an extra branch.
+        
+        This is a 8% speed-up on Octane/box2d. On one microbenchmark this is a 25% speed-up.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::fixEdgeRepresentation):
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateDouble):
+        (JSC::DFG::Node::shouldSpeculateDoubleReal):
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+        (JSC::DFG::SpeculativeJIT::speculateDoubleRepReal):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        (JSC::DFG::SpeculativeJIT::speculateDoubleReal): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isNumerical):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+        (JSC::FTL::LowerDFGToLLVM::boxDouble):
+        (JSC::FTL::LowerDFGToLLVM::jsValueToStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::speculateNumber):
+        (JSC::FTL::LowerDFGToLLVM::speculateRealNumber):
+        (JSC::FTL::LowerDFGToLLVM::speculateDoubleRepReal):
+        (JSC::FTL::LowerDFGToLLVM::jsValueToDouble): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::speculateDoubleReal): Deleted.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfNotOther):
+        (JSC::AssemblyHelpers::branchIfInt32):
+        (JSC::AssemblyHelpers::branchIfNotInt32):
+        (JSC::AssemblyHelpers::branchIfNumber):
+
+2015-06-04  Filip Pizlo  <fpizlo@apple.com>
+
+        SideState should be a distinct abstract heap from Heap and Stack
+        https://bugs.webkit.org/show_bug.cgi?id=145653
+
+        Reviewed by Geoffrey Garen.
+        
+        Before, SideState fit into the hierarchy like so:
+        
+        World
+           |
+           +-- Stack
+           |
+           +-- Heap
+                 |
+                 +-- SideState
+        
+        Now we will have:
+        
+        World
+           |
+           +-- Stack
+           |
+           +-- Heap
+           |
+           +-- SideState
+        
+        This makes it easy to ask if a writing operation wrote to anything that is observable even
+        if we don't exit. SideState is only observable if we exit.
+
+        * dfg/DFGAbstractHeap.h:
+        (JSC::DFG::AbstractHeap::AbstractHeap):
+        (JSC::DFG::AbstractHeap::supertype):
+
+2015-06-04  Chris Dumez  <cdumez@apple.com>
+
+        [WK2] Prune more resources from the MemoryCache before process suspension
+        https://bugs.webkit.org/show_bug.cgi?id=145633
+
+        Reviewed by Andreas Kling.
+
+        No longer move protect IncrementalSweeper::fullSweep() behind
+        USE(CF) so we don't need #ifdefs at call sites, similarly to what is
+        done for the rest of the IncrementalSweeper API.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::fullSweep):
+        * heap/IncrementalSweeper.h:
+
+2015-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        CallLinkStatus should return takesSlowPath if the GC often cleared the IC
+        https://bugs.webkit.org/show_bug.cgi?id=145502
+
+        Reviewed by Geoffrey Garen.
+        
+        CallLinkInfo now remembers when it has been cleared by GC. This has some safeguards for when
+        a call gets cleared by GC only because we hadn't converted it into a closure call; in that
+        case the GC will just tell us that it should be a closure call. The DFG will not optimize
+        a call that was cleared by GC, and the DFG will always prefer a closure call if the GC told
+        us that the specific callee was dead but the executable wasn't.
+        
+        This guards us from some scenarios that came up in Speedometer. It's neutral on the pure JS
+        benchmarks, most likely just because those benchmarks aren't real enough to have interesting
+        GC of code.
+
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::visitWeak):
+        (JSC::CallLinkInfo::dummy):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+
+2015-06-02  Filip Pizlo  <fpizlo@apple.com>
+
+        GetById and PutById profiling should be more precise about it takes slow path
+        https://bugs.webkit.org/show_bug.cgi?id=145590
+
+        Reviewed by Geoffrey Garen.
+        
+        If a ById access ever takes slow path, we want the DFG and FTL to know this. Previously we
+        were relying on slow path counts, which conflate slow paths taken due to a megamorphic
+        access and slow paths taken due to IC building.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+
+2015-06-03  Michael Saboff  <msaboff@apple.com>
+
+        Improve test coverage for changes made in 145527
+        https://bugs.webkit.org/show_bug.cgi?id=145578
+
+        Reviewed by Geoffrey Garen.
+
+        Added more complexity to poly-setter-combo.js stress test to create more turmoil in the
+        polymorphic get-by-id / put-by-id with getters and setters to exercise the code change in
+        https://bugs.webkit.org/show_bug.cgi?id=145527.  By changing the objects that the main test
+        function sees, we are able to test those paths.  Verified with temporary logging code.
+
+        * tests/stress/poly-setter-combo.js:
+        (Cons2):
+        (Cons3):
+        (Cons4):
+        (foo):
+        (test):
+        (runTestWithConstructors):
+
+2015-06-02  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix broken CLoop build.
+
+        Not reviewed.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeExitSiteData):
+
+2015-06-02  Keith Miller  <keith_miller@apple.com>
+
+        JavaScriptCore: JSExport protocol with an NSInteger property converts negative values to 18446744073709552000
+        https://bugs.webkit.org/show_bug.cgi?id=145563
+
+        Reviewed by Darin Adler.
+
+        The Objective-C bindings were improperly converting negative
+        long long/NSIntegers to 18446744073709552000 because they
+        were converted to unsigned numbers.
+
+        * API/ObjcRuntimeExtras.h:
+        (parseObjCType):
+        * API/tests/testapi.mm:
+        (testObjectiveCAPIMain):
+        (checkNegativeNSIntegers):
+        (testObjectiveCAPI):
+
+2015-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Heap-use-after-free read of size 4 in JavaScriptCore: WTF::StringImpl::isSymbol() (StringImpl.h:496)
+        https://bugs.webkit.org/show_bug.cgi?id=145532
+
+        Reviewed by Geoffrey Garen.
+
+        AtomicStringImpl::lookUp returns AtomicStringImpl*,
+        it doesn't give any ownership to the caller.
+        Originally, this is ok because the ownership is taken
+        by AtomicStringImpl's table (& the register side).
+
+        But if we would like to use this returned AtomicStringImpl*,
+        we should take its ownership immediately.
+        Because if the register side releases its ownership (ref count),
+        it will be destroyed.
+
+        In JSString::toExistingAtomicString, it returns AtomicStringImpl*.
+        But it's not appropriate.
+        If the owner of AtomicStringImpl* is always JSString*, it is ok.
+        But it looks up the table-registered AtomicStringImpl* from
+        the AtomicStringImpl table. So JSString* may not have the ownership
+        of the returned AtomicStringImpl*.
+
+        The failure situation is the following.
+
+        1. A creates AtomicStringImpl. A has its ownership.
+           And A registers it to AtomicStringImpl table.
+        2. JSString looks up the AtomicStringImpl from the table.
+           It gets AtomicStringImpl*. And JSString doesn't have its ownership.
+           It returns the raw pointer immediately to the users
+        3. A is released. There's no owner for AtomicStringImpl*.
+           So it's also destroyed.
+        4. Use looked up AtomicStringImpl in (2). It becomes use-after-free.
+
+        This patch fixes it by the following changes.
+
+        1. Change the signature of `AtomicStringImpl* AtomicStringImpl::lookUp(...)`
+           to `RefPtr<AtomicStringImpl> AtomicStringImpl::lookUp(..)`.
+           Use `RefPtr` because it may return `nullptr`.
+        2. Change the signature of `AtomicStringImpl* JSString::toExistingAtomicString(...)`
+           to `RefPtr<AtomicStringImpl> JSString::toExistingAtomicString(...)`.
+           Using `RefPtr` is the same reason.
+        3. Receive the result with `RefPtr<AtomicStringImpl>` in the caller side.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeToExistingAtomicString):
+        * runtime/JSString.h:
+        (JSC::JSString::toExistingAtomicString):
+
+2015-05-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Any exit from any JIT due to profiling for an inline cache should force all future compilations to be wary
+        https://bugs.webkit.org/show_bug.cgi?id=145496
+
+        Reviewed by Geoffrey Garen.
+        
+        This pessimizes compilation a bit, but it reduces the likelihood of exiting from FTL. I
+        couldn't find any convincing reason not to do this, and we know from Speedometer that this
+        change is necessary for weirder code.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeExitSiteData):
+        (JSC::CallLinkStatus::computeDFGStatuses):
+        * bytecode/CallLinkStatus.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::appendVariant):
+        (JSC::GetByIdStatus::hasExitSite):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::appendVariant):
+        (JSC::PutByIdStatus::hasExitSite):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+
+2015-05-31  Filip Pizlo  <fpizlo@apple.com>
+
+        If a call has ever taken the virtual slow path, make sure that the DFG knows this
+        https://bugs.webkit.org/show_bug.cgi?id=145501
+
+        Reviewed by Geoffrey Garen.
+        
+        Now now return higher fidelity information in the case of no polymorphic call stub. If the
+        virtual slow path was ever taken, we note this, and we note either zero or one call variant
+        based on the IC's last callee.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+        (JSC::CallLinkStatus::computeFor):
+
+2015-06-01  Michael Saboff  <msaboff@apple.com>
+
+        Crash in com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::revertCall + 24
+        https://bugs.webkit.org/show_bug.cgi?id=145527
+
+        Reviewed by Filip Pizlo.
+
+        If a CallLinkInfo is GC'ed, we need to notify any PolymorphicCallNode's that reference it.
+        Added plumbling to clear the m_callLinkInfo of a PolymorphicCallNode when that CallLinkInfo
+        is going away.
+
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::~CallLinkInfo):
+        * jit/PolymorphicCallStubRoutine.cpp:
+        (JSC::PolymorphicCallNode::unlink):
+        (JSC::PolymorphicCallNode::clearCallLinkInfo):
+        (JSC::PolymorphicCallCase::dump):
+        (JSC::PolymorphicCallStubRoutine::edges):
+        (JSC::PolymorphicCallStubRoutine::clearCallNodesFor):
+        (JSC::PolymorphicCallStubRoutine::visitWeak):
+        * jit/PolymorphicCallStubRoutine.h:
+        (JSC::PolymorphicCallNode::hasCallLinkInfo):
+
+2015-06-01  Mark Lam  <mark.lam@apple.com>
+
+        Add the ability to tell between Catch and Finally blocks.
+        https://bugs.webkit.org/show_bug.cgi?id=145524 
+
+        Reviewed by Michael Saboff.
+
+        ... and also SynthesizedFinally blocks too.  A SynthesizedFinally block
+        is a finally block that is synthesized by the bytecode generator but
+        does not actually correspond to any exception handling construct at the
+        JS source code level.  An example of this is the "for ... of" statement
+        where it needs to do some "final" clean up before passing on the
+        exception.
+
+        Manually tested by inspecting the bytecode dump of functions with
+        try-catch-finally blocks as well as for of statements which have
+        synthesized finally blocks.  The bytecode dumps contains the exception
+        handlers table which has these blocks labelled with their newly added
+        types.  No automatic test because this type info is not visible to JS
+        code.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/HandlerInfo.h:
+        (JSC::HandlerInfoBase::type):
+        (JSC::HandlerInfoBase::setType):
+        (JSC::HandlerInfoBase::typeName):
+        (JSC::HandlerInfoBase::isCatchHandler):
+        (JSC::UnlinkedHandlerInfo::UnlinkedHandlerInfo):
+        (JSC::HandlerInfo::initialize):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::pushTry):
+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitThrow):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+
+2015-05-29  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: These sorting idioms used by Peacekeeper and Browsermark are ~20X slower
+        https://bugs.webkit.org/show_bug.cgi?id=145412
+
+        Reviewed by Darin Adler.
+
+        Moar speedup.
+
+        Added a bucket sort for string sorting.
+
+        * builtins/Array.prototype.js:
+        (sort.compactSparse):
+        (sort.compactSlow):
+        (sort.compact): Split out a compaction fast path for dense arrays. Without
+        it, compaction can increase sort time by 2X for simple sorts.
+
+        (sort.bucketSort):
+        (sort.stringSort): Use a bucket sorting algorithm if we know we're sorting
+        strings. This makes average case string sorting O(N) with O(N) additional
+        memory use.
+
+        The worst case bucket sort can require O(M * N) additional
+        space. We avoid this by falling back to merge sort when things are
+        simple or overly duplicative. These are the two cases that accumulate
+        excessive -- and potentially pathological -- bucketing overhead.
+
+2015-06-01  Mark Lam  <mark.lam@apple.com>
+
+        HandlerInfo::initialize() should not assume that CodeLocationLabel is available.
+        https://bugs.webkit.org/show_bug.cgi?id=145515
+
+        Reviewed by Csaba Osztrogonác.
+
+        CodeLocationLabel is only defined for ENABLE(ASSEMBLER) builds.  r185022's
+        attempt at simplifying code to increase readability failed to take this into
+        account.  This patch fixes it.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/HandlerInfo.h:
+        (JSC::HandlerInfo::initialize):
+
+2015-05-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add a FIXME referencing https://bugs.webkit.org/show_bug.cgi?id=145503.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::inliningCost):
+
+2015-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Drop WeakMap#clear
+        https://bugs.webkit.org/show_bug.cgi?id=145489
+
+        Reviewed by Mark Lam.
+
+        ES6 spec intentionally drops the WeakMap#clear
+        to allow engine to implement WeakMap as a per-object table.
+
+        This patch drops WeakMap.prototype.clear.
+
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::WeakMapPrototype::finishCreation): Deleted.
+        (JSC::protoFuncWeakMapClear): Deleted.
+
+2015-05-31  Jordan Harband  <ljharb@gmail.com>
+
+        Array#reduce and reduceRight don't follow ToLength
+        https://bugs.webkit.org/show_bug.cgi?id=145364
+        Per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-tolength
+
+        Reviewed by Yusuke Suzuki.
+
+        * builtins/Array.prototype.js:
+        (reduce):
+        (reduceRight):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoFuncReduce): Deleted.
+        (JSC::arrayProtoFuncReduceRight): Deleted.
+
+2015-05-29  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL codegen for MultiGetByOffset and MultiPutByOffset where the structure set is already proved should have an unreachable default case instead of an exit
+        https://bugs.webkit.org/show_bug.cgi?id=145469
+
+        Reviewed by Geoffrey Garen.
+        
+        Omitting the speculation on the fail path when the speculation is guaranteed not to be
+        taken hints to LLVM that the default case is impossible. This enables some useful
+        optimizations.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+
+2015-05-29  Mark Lam  <mark.lam@apple.com>
+
+        Refactoring HandlerInfo and UnlinkedHandlerInfo.
+        https://bugs.webkit.org/show_bug.cgi?id=145480
+
+        Reviewed by Benjamin Poulain.
+
+        HandlerInfo and UnlinkedHandlerInfo have common parts, but are not currently
+        expressed as 2 unrelated structs that happen to have near identical fields.
+        We can refactor them to better express their relationship.  We can also add
+        some convenience functions to make the code that uses them a little more
+        readable.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        * bytecode/HandlerInfo.h:
+        (JSC::UnlinkedHandlerInfo::UnlinkedHandlerInfo):
+        (JSC::HandlerInfo::initialize):
+        - I chose to include CodeLocationLabel arg even though it is unused by
+          by non-JIT builds.  This makes the call site cleaner to read.
+
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedSimpleJumpTable::add):
+        (JSC::UnlinkedInstruction::UnlinkedInstruction):
+        (JSC::UnlinkedCodeBlock::numberOfExceptionHandlers):
+        (JSC::UnlinkedCodeBlock::addExceptionHandler):
+        (JSC::UnlinkedCodeBlock::exceptionHandler):
+        (JSC::UnlinkedCodeBlock::symbolTable):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+
+2015-05-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Non-speculative Branch should be fast in the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=145452
+
+        Reviewed by Andreas Kling.
+        
+        Inlines the code for convertJSValueToBoolean into the FTL. This also includes some other
+        clean-ups that I found along the way.
+        
+        I found this by looking at the hottest functions in DeltaBlue. Despite having so many
+        Branch specializations, apparently there was still a hot one that we missed that was going
+        down the untyped path. It was either Int32 or Other. Maybe we could specialize for that
+        combo, but it makes so much sense to just make all of this nonsense fast.
+
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle): Need to watch the masquerades watchpoint on UntypedUse: forms of Branch now.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::boolify): The actual fix.
+        (JSC::FTL::LowerDFGToLLVM::int52ToStrictInt52):
+        (JSC::FTL::LowerDFGToLLVM::isInt32):
+        (JSC::FTL::LowerDFGToLLVM::isNotInt32):
+        (JSC::FTL::LowerDFGToLLVM::unboxInt32):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::toBoolean): Symbol is always true.
+        (JSC::JSCell::pureToBoolean): Symbol is always true.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        (JSC::JSString::toBoolean): Deleted. This is a tiny method. It doesn't need to be out-of-line.
+        * runtime/JSString.h:
+        (JSC::JSString::length):
+        (JSC::JSString::toBoolean): This method shouldbe inline.
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::toPrimitive):
+        (JSC::Symbol::getPrimitiveNumber):
+        (JSC::Symbol::toBoolean): Deleted. A Symbol is always true, so we don't need a method for this.
+        * runtime/Symbol.h:
+
+2015-05-29  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r184860.
+        https://bugs.webkit.org/show_bug.cgi?id=145456
+
+        May have caused ~1% Octane regression (Requested by kling on
+        #webkit).
+
+        Reverted changeset:
+
+        "Try to use StringView when comparing JSStrings for equality."
+        https://bugs.webkit.org/show_bug.cgi?id=145379
+        http://trac.webkit.org/changeset/184860
+
+2015-05-28  Michael Saboff  <msaboff@apple.com>
+
+        mozilla/js1_5/Array/regress-154338.js test causes ARM 32 bit iOS devices to run out of memory
+        https://bugs.webkit.org/show_bug.cgi?id=145444
+
+        Reviewed by Geoffrey Garen.
+
+        Disabled mozilla/js1_5/Array/regress-154338.js when run on iOS ARM 32 bit devices and
+        the --memory-limited option is passed to run-jsc-stress-tests.
+
+        * tests/mozilla/mozilla-tests.yaml:
+
+2015-05-28  Benjamin Poulain  <benjamin@webkit.org>
+
+        [iOS8][ARMv7(s)] Optimized Object.create in 'use strict' context sometimes breaks.
+        https://bugs.webkit.org/show_bug.cgi?id=138038
+
+        Reviewed by Michael Saboff.
+
+        TL;DR: sometimes the baseline JIT could accidentally nuke the tag before calling
+               to C++, making put_by_id behave erratically.
+
+        The bug was that put_by_id would randomly not work correctly in 32bits. It happened
+        in the baseline JIT if we were unlucky enough:
+        -The code get hot enough and the structure is stable so we get a fast path for
+         put_by_id.
+        -We repatch the fast-path branch with a stub generated by
+         emitPutTransitionStubAndGetOldStructure().
+        -In emitPutTransitionStubAndGetOldStructure(), we only preserve the payload of the base
+         register, the tag register is ignored.
+        -emitPutTransitionStubAndGetOldStructure() allocate 2 to 3 registers. Any of those
+         could be the one used for the base's tag before the fast path and the value is trashed.
+        -If we hit one of the failure case, we fallback to the slow path, but we destroyed
+         the tag pointer.
+        -We now have unrelated bits in the tag, the most likely value type is now "double"
+         and we fail the put_by_id because we try to set a property on a number.
+
+        The most obvious solution would be to change emitPutTransitionStubAndGetOldStructure()
+        to preserve the tag register in addition to the value register.
+        I decided against that option because of the added complexity. The DFG does not need
+        that case, so I would have to add branches everywhere to distinguish the cases
+        were we need to preserve the tag or not.
+
+        Instead, I just load the tag back from memory in the slow path. The function in the slow
+        path is several order of magnitude slower than a load, it is not worth eliminating it,
+        especially in baseline JIT.
+
+        I also discovered 4 useless loads in the fast path, so even with my extra load, this patch
+        makes the baseline faster :)
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::emit_op_put_by_id): Deleted.
+        * tests/stress/put-by-id-on-new-object-after-prototype-transition-non-strict.js: Added.
+        (opaqueNewObject):
+        (putValueOnNewObject):
+        * tests/stress/put-by-id-on-new-object-after-prototype-transition-strict.js: Added.
+        (string_appeared_here.opaqueNewObject):
+        (putValueOnNewObject):
+
+2015-05-28  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] reduction the iteration count of the DoubleRep stress tests
+
+        Once again, I used big numbers for manual testing and I forgot to fix them before landing.
+
+        * tests/stress/double-rep-with-non-cell.js:
+        * tests/stress/double-rep-with-null.js:
+        * tests/stress/double-rep-with-undefined.js:
+
+2015-05-28  Basile Clement  <basile_clement@apple.com>
+
+        Add debug mode assertions for accessors casting JSC::DFG::Node.m_opInfo
+        https://bugs.webkit.org/show_bug.cgi?id=145441
+
+        Reviewed by Filip Pizlo.
+
+        Most accessor functions casting m_opInfo in JSC::DFG::Node are
+        performing debug checks that they are only accessed for node types that
+        should have them. This patch adds similar checks for the accessors that
+        were missing them.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::watchpointSet):
+        (JSC::DFG::Node::storagePointer):
+        (JSC::DFG::Node::multiGetByOffsetData):
+        (JSC::DFG::Node::multiPutByOffsetData):
+        (JSC::DFG::Node::hasTypeLocation):
+        (JSC::DFG::Node::typeLocation):
+        (JSC::DFG::Node::hasBasicBlockLocation):
+        (JSC::DFG::Node::basicBlockLocation):
+
+2015-05-28  Matt Rajca  <mrajca@apple.com>
+
+        Add ENABLE_MEDIA_SESSION feature flag (which is off by default).
+        https://bugs.webkit.org/show_bug.cgi?id=145415
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-05-27  Jordan Harband  <ljharb@gmail.com>
+
+        Array.of should work with other constructors
+        https://bugs.webkit.org/show_bug.cgi?id=145365
+        Per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.of
+        step 4
+
+        Reviewed by Yusuke Suzuki.
+
+        * builtins/ArrayConstructor.js:
+        (of):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::arrayConstructorOf): Deleted.
+
+2015-05-27  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add undefined->double conversion to DoubleRep
+        https://bugs.webkit.org/show_bug.cgi?id=145293
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds undefined to double conversion to the DoubleRep
+        node for the cases were we speculate "undefined" as part of the types
+        processed.
+
+        The use case is doing math with accidental out-of-bounds access. For example,
+        something like:
+            for (var i = 0; i <= length; ++i)
+                ouptput += array[i];
+
+        would cause us to OSR exit every time i === length.
+
+        When hitting one of those cases, we would already speculate double math,
+        but the DoubleRep node was unable to convert the undefined and would exit.
+
+        With this patch the use kind NotCellUse cover this conversion for DoubleRep.
+        I have been quite conservative so in general we will not find "undefined"
+        until a few recompile but being optimistic seems better since this is a corner case.
+
+        This patch is a 80% progression on WebXPRT's DNA Sequencing test.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::sawUndefined):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+        (JSC::FTL::LowerDFGToLLVM::jsValueToDouble):
+        * tests/stress/double-rep-with-undefined.js: Added.
+        (addArgsNumberAndUndefined):
+        (addArgsInt32AndUndefined):
+        (testFallbackWithDouble):
+        (addArgsDoubleAndUndefined):
+        (testFallbackWithObject.):
+        (testFallbackWithObject):
+        (addArgsOnlyUndefined):
+        (testFallbackWithString):
+
+2015-05-27  Dean Jackson  <dino@apple.com>
+
+        img.currentSrc problem in strict mode with old picturefill
+        https://bugs.webkit.org/show_bug.cgi?id=144095
+        <rdar://problem/21087013>
+
+        Reviewed by Simon Fraser.
+
+        Add a PICTURE_SIZES flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-05-27  Basile Clement  <basile_clement@apple.com>
+
+        LazyNode comparison can return incorrect results when comparing an empty value
+        https://bugs.webkit.org/show_bug.cgi?id=145421
+
+        Reviewed by Geoffrey Garen.
+
+        When comparing a LazyNode to another, we compare the value pointers if
+        we have one, and otherwise compare the nodes.
+        We should be comparing value pointers if the other LazyNode has one as
+        well, otherwise we risk an incoherency when we are a empty LazyNode
+        being compared to a FrozenValue without node.
+
+        Note that this is not a problem in any other case because if we don't
+        have a FrozenValue and we are not an empty LazyNode, we are a
+        non-constant node, and comparing the node pointers is correct.
+
+        * dfg/DFGLazyNode.h:
+        (JSC::DFG::LazyNode::operator==):
+
+2015-05-27  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: These sorting idioms used by Peacekeeper and Browsermark are ~20X slower
+        https://bugs.webkit.org/show_bug.cgi?id=145412
+
+        Reviewed by Benjamin Poulain.
+
+        Cache strings when doing a string-converting sort.
+
+        This is a 21% speedup.
+
+        * builtins/Array.prototype.js:
+        (sort.stringComparator): Use subtraction instead of branching because
+        it's slightly faster.
+
+        (sort.comparatorSort):
+        (sort.stringSort):
+        (sort): Add a special case for string sorting to avoid redundant string
+        conversion.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::createBindingPattern): Names can be empty if
+        they are private names.
+
+2015-05-26  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT-generated store barrier code should assume the buffer pointer and capacity to be compile-time constants
+        https://bugs.webkit.org/show_bug.cgi?id=145404
+
+        Reviewed by Andreas Kling.
+        
+        We never change the capacity of a write barrier buffer. We never repoint the buffer
+        pointer. So, the JIT shouldn't load those from memory; it should take advantage of the
+        fact that these are compile-time constants.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+        * heap/WriteBarrierBuffer.h:
+        (JSC::WriteBarrierBuffer::currentIndexAddress):
+        (JSC::WriteBarrierBuffer::capacity):
+        (JSC::WriteBarrierBuffer::buffer):
+        (JSC::WriteBarrierBuffer::currentIndexOffset): Deleted.
+        (JSC::WriteBarrierBuffer::capacityOffset): Deleted.
+        (JSC::WriteBarrierBuffer::bufferOffset): Deleted.
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStubAndGetOldStructure):
+
+2015-05-27  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: These sorting idioms used by Peacekeeper and Browsermark are ~20X slower
+        https://bugs.webkit.org/show_bug.cgi?id=145412
+
+        Reviewed by Darin Adler.
+
+        Use @toString instead of the String constructor because calls to the
+        String constructor are never optimized. (See
+        https://bugs.webkit.org/show_bug.cgi?id=144458.)
+
+        This is a ~2X speedup.
+
+        * builtins/Array.prototype.js:
+        (sort.stringComparator):
+
+2015-05-27  Dan Bernstein  <mitz@apple.com>
+
+        Remove JSC_OBJC_API_AVAILABLE_MAC_OS_X_1080
+        https://bugs.webkit.org/show_bug.cgi?id=145403
+
+        Reviewed by Anders Carlsson.
+
+        JSC_OBJC_API_AVAILABLE_MAC_OS_X_1080 was used to enable the JavaScriptCore Objective-C API
+        for WebKit and Safari projects building with JavaScriptCore targeting OS X 10.8. We don’t
+        need it anymore.
+
+        * API/JSBase.h:
+        * API/JSContext.h:
+        * API/JSManagedValue.h:
+        * API/JSValue.h:
+        * API/JSVirtualMachine.h:
+        * Configurations/Base.xcconfig:
+        * postprocess-headers.sh:
+
+2015-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Photo Booth hangs under JSC::MachineThreads::tryCopyOtherThreadStacks
+        https://bugs.webkit.org/show_bug.cgi?id=145395
+
+        Reviewed by Mark Hahnenberg.
+
+        No test case because we already have --threaded mode, which runs lots of
+        parallel GC, but it (and the original in-app test case) can't reproduce
+        this bug.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::tryCopyOtherThreadStacks): Use a lock to prevent
+        two threads from mutually suspending each other.
+
+2015-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Add Array.prototype.copyWithin to JSC features.json
+        https://bugs.webkit.org/show_bug.cgi?id=145387
+
+        Reviewed by Darin Adler.
+
+        * features.json:
+
+2015-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Reflect nits for r184863
+        https://bugs.webkit.org/show_bug.cgi?id=145107
+
+        Reviewed by Darin Adler.
+
+        1. Added the copyright line.
+        2. Added an optional argument (/*, end */). To do so, fixed generate-js-builtins.
+        3. Dropped the unnecessary variable `thisValue`.
+        4. Fix the type error messages. This is also found in StringIterator.prototype.js.
+        5. Added tests for 0 arguments.
+
+        * builtins/Array.prototype.js:
+        (copyWithin):
+        * builtins/StringIterator.prototype.js:
+        (next):
+        * generate-js-builtins:
+        * tests/stress/array-copywithin.js:
+        * tests/stress/string-iterators.js:
+
+2015-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Inline @Array / @Object callsites
+        https://bugs.webkit.org/show_bug.cgi?id=145382
+
+        Reviewed by Geoffrey Garen.
+
+        As the same to Array/Object callsite inlining, @Array/@Object also
+        should be inlined in bytecode level.
+        While `new @Object` style is not encouraged in the builtins,
+        `@Array(len)` is already used at least in Array.from code.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::expectedFunctionForIdentifier):
+
+2015-05-26  Andreas Kling  <akling@apple.com>
+
+        String.prototype.charCodeAt() should use StringView.
+        <https://webkit.org/b/145353>
+
+        Reviewed by Darin Adler.
+
+        Use JSString::view() in charCodeAt() to avoid reifying the JSString if it's
+        a substring. This avoids StringImpl allocation in some cases and ref churn
+        in all cases.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharCodeAt):
+
+2015-05-26  Andreas Kling  <akling@apple.com>
+
+        String.prototype.charAt() should use StringView.
+        <https://webkit.org/b/145352>
+
+        Reviewed by Darin Adler.
+
+        Remove the jsSingleCharacterSubstring() function since it's actually completely
+        counter-productive: it could create a single-character string that would retain
+        a much larger string for the duration of its lifetime.
+
+        This made sense before StringImpl learned to put its characters at the tail end
+        of its own allocation. Now that it does, it's far better to just create a new
+        single-character StringImpl.
+
+        With that out of the way, we can make String.prototype.charAt() use StringView
+        to avoid reifying substring JSStrings (and avoid some ref churn too.)
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::getIndexSlowCase):
+        * runtime/JSString.h:
+        (JSC::JSString::getIndex):
+        (JSC::jsSingleCharacterSubstring): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncSplit):
+
+2015-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Array.prototype.copyWithin
+        https://bugs.webkit.org/show_bug.cgi?id=145107
+
+        Reviewed by Darin Adler.
+
+        This patch implements ES6 Array.prototype.copyWithin.
+        It is intended to be used for copying the region to the other region
+        in the callee array itself safely (like memmove, not memcpy).
+        This function is proposed in the context of WebGL.
+
+        * builtins/Array.prototype.js:
+        (.maxWithPositives):
+        (.minWithMaybeNegativeZeroAndPositive):
+        (copyWithin):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * tests/stress/array-copywithin.js: Added.
+        (shouldBe):
+        (shouldBeArray):
+        (shouldThrow):
+        (arrayToObject):
+        (valueOf):
+
+2015-05-26  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/21104551> Update build settings
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2015-05-26  Andreas Kling  <akling@apple.com>
+
+        Try to use StringView when comparing JSStrings for equality.
+        <https://webkit.org/b/145379>
+
+        Reviewed by Darin Adler.
+
+        Use JSString::view() when sending two JSStrings to WTF::equal()
+        for comparison. This avoids creating new objects in the case where
+        the strings are actually substrings.
+
+        * jit/JITOperations.cpp:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+
+2015-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Generate put_by_val_direct for indexed identifiers instead of put_by_id with direct postfix
+        https://bugs.webkit.org/show_bug.cgi?id=145360
+
+        Reviewed by Darin Adler.
+
+        JSObject::putDirect only accepts non-indexed properties.
+        So when generating put_by_id (with direct postfix) for indexed property,
+        we should generate put_by_val_direct instead.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitPutConstantProperty):
+        * tests/stress/put-by-id-direct-should-be-done-for-non-index-property.js: Added.
+
+2015-05-24  Jordan Harband  <ljharb@gmail.com>
+
+        Array#findIndex/find should not skip holes
+        https://bugs.webkit.org/show_bug.cgi?id=145361
+        per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.prototype.findindex
+        and https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.prototype.find
+
+        Reviewed by Yusuke Suzuki.
+
+        * builtins/Array.prototype.js:
+        (find): Deleted.
+        (findIndex): Deleted.
+
+2015-05-24  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: Uncaught exception when using Inspect tool on SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=145363
+
+        Reviewed by Joseph Pecoraro.
+
+        The injected script failed by chaining a call to String.prototype.trim to the result of
+        SVG*Element.className, which is an SVGAnimatedString and lacks useful methods. So, obtain
+        the class name using Node.getAttribute, which always returns a DOMString.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScriptSource.prototype._getDescription): use getAttribute instead of className.
+
+2015-05-23  Dan Bernstein  <mitz@apple.com>
+
+        Remove unused definitions of WEBKIT_VERSION_MIN_REQUIRED
+        https://bugs.webkit.org/show_bug.cgi?id=145345
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/Base.xcconfig: Also changed to use $(inherited).
+
+2015-05-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce UniquedStringImpl and SymbolImpl to separate symbolic strings from AtomicStringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=144848
+
+        Reviewed by Darin Adler.
+
+        Use UniquedStringImpl, SymbolImpl and AtomicStringImpl.
+
+        * API/JSCallbackObject.h:
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::isPrivateName):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/ComplexGetStatus.cpp:
+        (JSC::ComplexGetStatus::computeFor):
+        * bytecode/ComplexGetStatus.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeFor):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::visibleNameForParameter):
+        (JSC::BytecodeGenerator::hasConstant):
+        (JSC::BytecodeGenerator::addConstant):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGDesiredIdentifiers.cpp:
+        (JSC::DFG::DesiredIdentifiers::addLazily):
+        (JSC::DFG::DesiredIdentifiers::at):
+        (JSC::DFG::DesiredIdentifiers::reallyAdd):
+        * dfg/DFGDesiredIdentifiers.h:
+        (JSC::DFG::DesiredIdentifiers::operator[]):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::identifierUID):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::InlineCacheDescriptor::InlineCacheDescriptor):
+        (JSC::FTL::InlineCacheDescriptor::uid):
+        (JSC::FTL::GetByIdDescriptor::GetByIdDescriptor):
+        (JSC::FTL::PutByIdDescriptor::PutByIdDescriptor):
+        (JSC::FTL::CheckInDescriptor::CheckInDescriptor):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::LowerDFGToLLVM::compileMaterializeCreateActivation):
+        (JSC::FTL::LowerDFGToLLVM::getById):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * ftl/FTLSlowPathCall.cpp:
+        (JSC::FTL::callOperation):
+        * ftl/FTLSlowPathCall.h:
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::setClosedVariables):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::captures):
+        (JSC::ScopeNode::setClosedVariables):
+        (JSC::ProgramNode::closedVariables):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::didFinishParsing):
+        (JSC::Parser<LexerType>::parseContinueStatement):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::pushLabel):
+        (JSC::Scope::getLabel):
+        (JSC::Scope::declareCallee):
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::declareBoundParameter):
+        (JSC::Scope::useVariable):
+        (JSC::Scope::copyCapturedVariablesToVector):
+        (JSC::Parser::closedVariables):
+        (JSC::ScopeLabelInfo::ScopeLabelInfo): Deleted.
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::usedVariables):
+        (JSC::SourceProviderCacheItem::writtenVariables):
+        (JSC::SourceProviderCacheItem::create):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::isPrivateName):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Identifier.h:
+        (JSC::Identifier::impl):
+        (JSC::Identifier::Identifier):
+        (JSC::parseIndex):
+        (JSC::IdentifierRepHash::hash):
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::fromUid):
+        * runtime/IntendedStructureChain.cpp:
+        (JSC::IntendedStructureChain::mayInterceptStoreTo):
+        * runtime/IntendedStructureChain.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        * runtime/MapData.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertySymbols):
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+        (JSC::PrivateName::uid):
+        * runtime/PropertyMapHashTable.h:
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+        (JSC::PropertyName::uid):
+        (JSC::PropertyName::publicName):
+        (JSC::parseIndex):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::add):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::add):
+        (JSC::Structure::addPropertyTransitionToExistingStructureImpl):
+        (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
+        (JSC::Structure::getConcurrently):
+        (JSC::Structure::add):
+        (JSC::Structure::remove):
+        (JSC::Structure::toStructureShape):
+        * runtime/Structure.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::getConcurrently):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::Hash::hash):
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::Symbol):
+        * runtime/Symbol.h:
+        * runtime/SymbolConstructor.cpp:
+        (JSC::symbolConstructorFor):
+        (JSC::symbolConstructorKeyFor):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::uniqueIDForVariable):
+        (JSC::SymbolTable::globalTypeSetForVariable):
+        * runtime/SymbolTable.h:
+        * runtime/TypeSet.cpp:
+        (JSC::StructureShape::addProperty):
+        (JSC::StructureShape::propertyHash):
+        * runtime/TypeSet.h:
+
+2015-05-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Arguments elimination phase mishandles arity check failure in its reduction of LoadVarargs to GetStack/PutStacks
+        https://bugs.webkit.org/show_bug.cgi?id=145298
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp: Fix the bug. I restructured the loop to make it more obvious that we're initializing everything that we're supposed to initialize.
+        * dfg/DFGNode.h: Add a comment to clarify something I was confused about while writing this code.
+        * dfg/DFGPutStackSinkingPhase.cpp: Hacking on PutStacks made me think deep thoughts, and I added some FIXMEs.
+        * tests/stress/fold-load-varargs-arity-check-fail-barely.js: Added. This test crashes or fails before this patch.
+        * tests/stress/fold-load-varargs-arity-check-fail.js: Added. This is even more sure to crash or fail.
+        * tests/stress/simplify-varargs-mandatory-minimum-smaller-than-limit.js: Added. Not sure if we had coverage for this case before.
+
+2015-05-22  Basile Clement  <basile_clement@apple.com>
+
+        Allow DFGClobberize to return non-node constants that must be later created
+        https://bugs.webkit.org/show_bug.cgi?id=145272
+
+        Reviewed by Filip Pizlo.
+
+        This adds a new LazyNode class in DFG that represents either a Node*,
+        or a FrozenValue* with a way to convert it to a Node* provided a block
+        to insert it into. DFGClobberize is converted to use LazyNode instead
+        of Node* when def()'ing values, which allows to now define the array's
+        length as well as the value of its various fields in NewArray and
+        NewArrayBuffer nodes.
+
+        We also introduce a Vector<uint32_t> in DFG::Graph to collect all the
+        values that can be used as index, in order to avoid def()'ing too many
+        values at once for big NewArrayBuffers.
+
+        HeapLocation had to be updated to use a LazyNode as its index to be
+        able to define array values.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        (JSC::DFG::DefMethodClobberize::operator()):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::freezeFragile):
+        * dfg/DFGGraph.h:
+        * dfg/DFGHeapLocation.h:
+        (JSC::DFG::HeapLocation::HeapLocation):
+        (JSC::DFG::HeapLocation::index):
+        (JSC::DFG::HeapLocation::hash):
+        * dfg/DFGLazyNode.cpp: Added.
+        (JSC::DFG::LazyNode::dump):
+        * dfg/DFGLazyNode.h: Added.
+        (JSC::DFG::LazyNode::LazyNode):
+        (JSC::DFG::LazyNode::setNode):
+        (JSC::DFG::LazyNode::isHashTableDeletedValue):
+        (JSC::DFG::LazyNode::isNode):
+        (JSC::DFG::LazyNode::op):
+        (JSC::DFG::LazyNode::asNode):
+        (JSC::DFG::LazyNode::asValue):
+        (JSC::DFG::LazyNode::hash):
+        (JSC::DFG::LazyNode::operator==):
+        (JSC::DFG::LazyNode::operator!=):
+        (JSC::DFG::LazyNode::ensureIsNode):
+        (JSC::DFG::LazyNode::operator->):
+        (JSC::DFG::LazyNode::operator*):
+        (JSC::DFG::LazyNode::operator!):
+        (JSC::DFG::LazyNode::operator UnspecifiedBoolType*):
+        (JSC::DFG::LazyNode::setFrozenValue):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::def):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+
+2015-05-22  Andreas Kling  <akling@apple.com>
+
+        [JSC] Speed up new array construction in Array.prototype.splice().
+        <https://webkit.org/b/145303>
+
+        Reviewed by Benjamin Poulain.
+
+        Give splice() a fast path just like slice(), for indexing types where the backing
+        store can be memcpy'd. I generalized JSArray::fastSlice() a little bit so it works
+        for this optimization as well.
+
+        7% progression on Kraken/stanford-crypto-pbkdf2.
+
+        * runtime/JSArray.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::fastSlice): Tweak this to return JSArray*, and don't bother throwing
+        out-of-memory exceptions. Let the caller worry about that.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSlice): Update for fastSlice() changes.
+        (JSC::arrayProtoFuncSplice): If the object we're splicing out of is a bona fide
+        JSArray, use fastSlice() to create the returned array instead of doing a generic
+        get/put loop.
+
+2015-05-21  Filip Pizlo  <fpizlo@apple.com>
+
+        CPS rethreading should really get rid of GetLocals
+        https://bugs.webkit.org/show_bug.cgi?id=145290
+
+        Reviewed by Benjamin Poulain.
+        
+        CPS rethreading is intended to get rid of redundant GetLocals. CSE can also do it, but
+        the idea is that you should be able to disable CSE and everything would still work. This
+        fixes a bug in CPS rethreading's GetLocal elimination: we should be calling replaceWith
+        rather than setReplacement, since setReplacement still leaves the original node.
+
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor): Fix the bug.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Eliminating GetLocals means that they turn into Check. We should handle Checks that have zero inputs.
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS): Add a validation for what a GetLocal should look like in ThreadedCPS.
+        * tests/stress/get-local-elimination.js: Added.
+        (foo):
+
+2015-05-21  Saam Barati  <saambarati1@gmail.com>
+
+        Object allocation sinking phase should explicitly create bottom values for CreateActivation sink candidates and CreateActivation should have SymbolTable as a child node
+        https://bugs.webkit.org/show_bug.cgi?id=145192
+
+        Reviewed by Filip Pizlo.
+
+        When we sink CreateActivation and generate MaterializeCreateActivation
+        in the object allocation sinking phase, we now explictly add PutHints for 
+        all variables on the activation setting those variables to their default value 
+        (undefined for Function activations and soon to be JS Empty Value for block scope activations). 
+        This allows us to remove code that fills FTL fast activation allocations with Undefined.
+
+        This patch also adds the constant SymbolTable as an OpInfo of CreateActivation and MaterializeCreateActivation
+        nodes. This is in preparation for ES6 block scoping which will introduce a new 
+        op code that gets lowered to CreateActivation.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::cellOperand):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        (JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize):
+        (JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize):
+        * dfg/DFGPromotedHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCreateActivation):
+        (JSC::FTL::LowerDFGToLLVM::compileMaterializeCreateActivation):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * tests/stress/activation-sink-default-value.js: Added.
+        (bar):
+        * tests/stress/activation-sink-osrexit-default-value.js: Added.
+        (foo.set result):
+
+2015-05-21  Per Arne Vollan  <peavo@outlook.com>
+
+        MSVC internal compiler error when compiling TemplateRegistryKey class.
+        https://bugs.webkit.org/show_bug.cgi?id=145259
+
+        Reviewed by Alex Christensen.
+
+        MSVC is not able to handle the brace initialization of a class member in this case.
+
+        * runtime/TemplateRegistryKey.h:
+
+2015-05-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(ES6_TEMPLATE_LITERAL_SYNTAX) build after r184337
+        https://bugs.webkit.org/show_bug.cgi?id=145248
+
+        Reviewed by Yusuke Suzuki.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseMemberExpression):
+
+2015-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: array previews should have a much smaller cap on values
+        https://bugs.webkit.org/show_bug.cgi?id=145195
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.RemoteObject.prototype._generatePreview):
+        Reduce the indexes threshold for previews.
+
+2015-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Use native Arguments detection instead of using toString
+        https://bugs.webkit.org/show_bug.cgi?id=145235
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._subtype):
+        Deleted the old string code.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        Replaced with a stricter, more accurate check.
+
+2015-05-20  Andreas Kling  <akling@apple.com>
+
+        Remove unused MarkedBlock::m_rememberedSet.
+        <https://webkit.org/b/145224>
+
+        Reviewed by Mark Hahnenberg.
+
+        The MarkedBlock had a copy of the remembered bit for each of its cells,
+        and we were maintaining that bitmap despite no one actually ever consulting it.
+
+        This patch removes MarkedBlock::m_rememberedSet, freeing up 128 bytes in each
+        block and making write barriers a little faster.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::clearRememberedSet):
+        (JSC::Heap::addToRememberedSet):
+        * heap/HeapInlines.h:
+        (JSC::Heap::isRemembered):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::clearRememberedSet): Deleted.
+        (JSC::MarkedBlock::clearMarksWithCollectionType):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::setRemembered): Deleted.
+        (JSC::MarkedBlock::clearRemembered): Deleted.
+        (JSC::MarkedBlock::atomicClearRemembered): Deleted.
+        (JSC::MarkedBlock::isRemembered): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::ClearRememberedSet::operator()): Deleted.
+        (JSC::MarkedSpace::clearRememberedSet): Deleted.
+
+2015-05-20  Andreas Kling  <akling@apple.com>
+
+        Eden collections should extend the IncrementalSweeper work list, not replace it.
+        <https://webkit.org/b/145213>
+        <rdar://problem/21002666>
+
+        Reviewed by Geoffrey Garen.
+
+        After an eden collection, the garbage collector was adding all MarkedBlocks containing
+        new objects to the IncrementalSweeper's work list, to make sure they didn't have to
+        wait until the next full collection before getting swept.
+
+        Or at least, that's what it thought it was doing. It turns out that IncrementalSweeper's
+        internal work list is really just a reference to Heap::m_blockSnapshot. I didn't realize
+        this when writing the post-eden sweep code, and instead made eden collections cancel
+        all pending sweeps and *replace* them with the list of blocks with new objects.
+
+        This made it so that rapidly occurring eden collections could prevent large numbers of
+        heap blocks from ever getting swept. This would manifest as accumulation of MarkedBlocks
+        when a system under heavy load was also allocating short lived objects at a high rate.
+        Things would eventually get cleaned up when there was a lull and a full collection was
+        allowed to run its heap sweep to completion.
+
+        Fix this by moving all management of the block snapshot to Heap. snapshotMarkedSpace()
+        now handles eden collections by merging the list of blocks with new objects into the
+        existing block snapshot.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::snapshotMarkedSpace):
+        (JSC::Heap::notifyIncrementalSweeper):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::startSweeping):
+        (JSC::IncrementalSweeper::addBlocksAndContinueSweeping): Deleted.
+        * heap/IncrementalSweeper.h:
+
+2015-05-20  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        AudioContext resume/close/suspend should reject promises with a DOM exception in lieu of throwing exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=145064
+
+        Reviewed by Darin Adler.
+
+        Added default message for TypeError.
+
+        * runtime/Error.cpp:
+        (JSC::throwTypeError):
+        * runtime/Error.h:
+
+2015-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        No LLInt Test Failure: jsc-layout-tests.yaml/js/script-tests/object-literal-duplicate-properties.js.layout-no-llint
+        https://bugs.webkit.org/show_bug.cgi?id=145219
+
+        Reviewed by Mark Lam.
+
+        * jit/JITOperations.cpp:
+        Throw the error we just got, instead of a stack overflow exception.
+        This matches other error handling for callers of prepareForExecution.
+
+2015-05-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Add some assertions about the CFG in the loop pre-header creation phase
+        https://bugs.webkit.org/show_bug.cgi?id=145205
+
+        Reviewed by Geoffrey Garen.
+        
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::currentNodeOrigin): Add a FIXME.
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run): Add a FIXME.
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::LoopPreHeaderCreationPhase::run): Add the assertions.
+
+2015-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6: Implement Object.setPrototypeOf
+        https://bugs.webkit.org/show_bug.cgi?id=145202
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        (JSC::checkProtoSetterAccessAllowed):
+        Extract a helper to share this code between __proto__ setter and setPrototypeOf.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        Implementation is very similiar to __proto__ setter.
+
+2015-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6: Should not allow duplicate basic __proto__ properties in Object Literals
+        https://bugs.webkit.org/show_bug.cgi?id=145138
+
+        Reviewed by Darin Adler.
+
+        Implement ES6 Annex B.3.1, which disallows duplicate basic __proto__
+        properties in object literals. This doesn't affect computed properties,
+        shorthand properties, or getters/setters all of which avoid setting
+        the actual prototype of the object anyway.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        Remove out of date comment. Duplicate property names are allowed
+        now in ES6, they were not in ES5 strict mode.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::getName):
+        (JSC::ASTBuilder::getType):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::getName):
+        Add back getName to get the property name depending on the tree builder.
+        Also tighten up the parameter types.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        In quick JSON literal parsing for eval, we actually need to evaluate
+        the __proto__ property assignment, instead of just building up a list
+        of direct properties. Only do this when not doing a strict JSON parse.
+
+        * parser/Nodes.h:
+        Add "Shorthand" to the list of PropertyNode types to allow it to
+        be distinguished without relying on other information.
+
+        * parser/Parser.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseProperty):
+        Add the Shorthand type when parsing a shorthand property.
+
+        (JSC::Parser<LexerType>::shouldCheckPropertyForUnderscoreProtoDuplicate):
+        (JSC::Parser<LexerType>::parseObjectLiteral):
+        (JSC::Parser<LexerType>::parseStrictObjectLiteral):
+        Check for duplicate __proto__ properties, and throw a SyntaxError
+        if that was the case.
+
+2015-05-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [JSC] Add missing copyrights and licenses for some scripts
+        https://bugs.webkit.org/show_bug.cgi?id=145044
+
+        Reviewed by Darin Adler.
+
+        * build-symbol-table-index.py:
+        * create-llvm-ir-from-source-file.py:
+        * create-symbol-table-index.py:
+
+2015-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Slightly better node previews in arrays
+        https://bugs.webkit.org/show_bug.cgi?id=145188
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._nodeDescription):
+        (InjectedScript.prototype._nodePreview):
+        Different stringified representations for a basic object description or in a preview.
+
+        (InjectedScript.RemoteObject.prototype._appendPropertyPreviews):
+        Use the node preview string representation inside previews.
+
+2015-05-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r184613 and r184614.
+        https://bugs.webkit.org/show_bug.cgi?id=145206
+
+        Broke 10 tests :| (Requested by kling on #webkit).
+
+        Reverted changesets:
+
+        "[JSC] Speed up URL encode/decode by using bitmaps instead of
+        strchr()."
+        https://bugs.webkit.org/show_bug.cgi?id=145115
+        http://trac.webkit.org/changeset/184613
+
+        "[JSC] Speed up URL encode/decode by using bitmaps instead of
+        strchr()."
+        https://bugs.webkit.org/show_bug.cgi?id=145115
+        http://trac.webkit.org/changeset/184614
+
+2015-05-19  Andreas Kling  <akling@apple.com>
+
+        Give StringView a utf8() API.
+        <https://webkit.org/b/145201>
+
+        Reviewed by Anders Carlsson.
+
+        Use JSString::view() in a few places where we couldn't before due to StringView
+        lacking a utf8() API. This is a minor speed-up on Kraken's crypto subtests,
+        which like to call encode() with substring JSStrings.
+
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+
+2015-05-19  Andreas Kling  <akling@apple.com>
+
+        [JSC] Speed up URL encode/decode by using bitmaps instead of strchr().
+        <https://webkit.org/b/145115>
+
+        Incorporate review feedback from Darin, removing some unnecessary zero checks.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEscape):
+
+2015-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Move AtomicStringImpl table related operations from AtomicString to AtomicStringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=145109
+
+        Reviewed by Darin Adler.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::nameForRegister):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::add8):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::add):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeToExistingAtomicString):
+        * runtime/JSString.h:
+        (JSC::JSString::toExistingAtomicString):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/TypeSet.cpp:
+        (JSC::StructureShape::propertyHash):
+
+2015-05-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Improve Preview for NodeList / array like collections
+        https://bugs.webkit.org/show_bug.cgi?id=145177
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.RemoteObject.prototype._appendPropertyPreviews):
+        For "array" like object previews skip over non-index properties.
+        We are not marking the object as lossless by choice, but we
+        may return to this decision later.
+
+2015-05-19  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(183787): JIT is enabled for all builds
+        https://bugs.webkit.org/show_bug.cgi?id=145179
+
+        Reviewed by Geoffrey Garen.
+
+        Eliminated the setting of ENABLE_JIT, as wtf/Platform.h has appropriate logic to
+        set it depending on OS and CPU type.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-05-19  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Rename createIterResultObject as createIteratorResultObject
+        https://bugs.webkit.org/show_bug.cgi?id=145116
+
+        Reviewed by Darin Adler.
+
+        Renamed createIterResultObject as createIteratorResultObject.
+        Made this function exportable for future use by streams API.
+
+        * runtime/IteratorOperations.cpp:
+        (JSC::createIteratorResultObject):
+        * runtime/IteratorOperations.h:
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototypeFuncNext):
+
+2015-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Array.prototype methods must use ToLength
+        https://bugs.webkit.org/show_bug.cgi?id=144128
+
+        Reviewed by Oliver Hunt.
+
+        Patch by Jordan Harband  <ljharb@gmail.com> and Yusuke Suzuki <utatane.tea@gmail.com>
+
+        Per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-tolength
+
+        This patch introduces ToLength and ToInteger JS implementation to encourage the DFG/FTL's inlining.
+        These implementations are located in GlobalObject.js.
+        And set to the JSGlobalObject with the private symbols @ToLength and @ToInteger manually.
+
+        * builtins/Array.prototype.js:
+        (every):
+        (forEach):
+        (filter):
+        (map):
+        (some):
+        (fill):
+        (find):
+        (findIndex):
+        (includes):
+        * builtins/ArrayConstructor.js:
+        (from):
+        * builtins/GlobalObject.js: Copied from Source/JavaScriptCore/builtins/StringConstructor.js.
+        (ToInteger):
+        (ToLength):
+        * builtins/StringConstructor.js:
+        (raw):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObjectFunctions.h:
+
+2015-05-19  Mark Lam  <mark.lam@apple.com>
+
+        Fix the build of a universal binary with ARMv7k of JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=145143
+
+        Reviewed by Geoffrey Garen.
+
+        The offlineasm works in 3 phases:
+
+        Phase 1:
+           Parse the llint asm files for config options and desired offsets.
+           Let's say the offlineasm discovers C unique options and O unique offsets.
+           The offlineasm will then generate a LLIntDesiredOffsets.h file with
+           C x C build configurations, each with a set of O offsets.
+
+           Each of these build configurations is given a unique configuration index number.
+
+        Phase 2: 
+           Compile the LLIntDesiredOffsets.h file into a JSCLLIntOffsetsExtractor binary.
+
+           If we're building a fat binary with 2 configurations: armv7, and armv7k,
+           then the fat binary will contain 2 blobs of offsets, one for each of these
+           build configurations.
+
+        Phase 3:
+           Parse the llint asm files and emit asm code using the offsets that are
+           extracted from the JSCLLIntOffsetsExtractor binary for the corresponding
+           configuration index number.
+
+        In the pre-existing code, there are no "if ARMv7k" statements in the llint asm
+        source.  As a result, OFFLINE_ASM_ARMv7k is not one of the config options in
+        the set of C unique options.
+
+        For armv7k builds, OFFLINE_ASM_ARMv7 is also true.  As a result, for an armv7k
+        target, we will end up building armv7 source.  In general, this is fine except:
+
+        1. armv7k has different alignment requirements from armv7.  Hence, their offset
+           values (in JSCLLIntOffsetsExtractor) will be different.
+
+        2. The offlineasm was never told that it needed to make a different configuration
+           for armv7k builds.  Hence, the armv7k build of LLIntDesiredOffsets.h will
+           build the armv7 configuration, and consequently, the armv7k blob of offsets in
+           JSCLLIntOffsetsExtractor will have the same configuration index number as
+           the armv7 blob of offsets.
+
+        In phase 3, when the offlineasm parses the JSCLLIntOffsetsExtractor fat binary
+        looking for the armv7 build's configuration index number, it discovers the
+        armv7k blob which has the same configuration number.  As a result, it
+        erroneously thinks the armv7k offsets are appropriate for emitting armv7 code.
+        Needless to say, armv7 code using armv7k offsets will lead to incorrect behavior
+        and all round badness.
+
+        The fix is to add a simple "if ARMv7k" statement to the llint asm files.  While
+        the if statement has no body, it does make the offlineasm aware of the need for
+        ARMv7k as a configuration option.  As a result, it will generate an armv7k
+        variant configuration in the LLIntDesiredOffsets.h file with its own unique
+        configuration index number.  With that, the JSCLLIntOffsetsExtractor fat binary
+        will no longer have duplicate configuration index numbers for the armv7 and
+        armv7k blobs of offsets, and the issue is resolved.
+
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LowLevelInterpreter.asm:
+
+2015-05-19  Andreas Kling  <akling@apple.com>
+
+        Give JSString a StringView getter and start using it.
+        <https://webkit.org/b/145131>
+
+        Reviewed by Anders Carlsson.
+
+        When JSString is a substring internally, calling value(ExecState*) on it
+        will reify the baseString/start/length tuple into a new StringImpl.
+
+        For clients that only want to look at the characters of a JSString, but
+        don't actually need a reffable StringImpl, adding a light-weight StringView
+        getter lets them avoid constructing anything.
+
+        This patch adds JSString::view(ExecState*) and uses it in a few places.
+        There are many more opportunities to use this API, but let's do a few things
+        at a time.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::decode):
+        (JSC::parseInt):
+        (JSC::jsToNumber):
+        (JSC::parseFloat):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        * runtime/JSString.h:
+        (JSC::JSRopeString::view):
+        (JSC::JSString::view):
+
+2015-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Better optimize 'if' with ternaries conditional tests.
+        https://bugs.webkit.org/show_bug.cgi?id=144136
+
+        Reviewed by Benjamin Poulain.
+        
+        This is the last fix I'll do for this for now. BooleanToNumber(Untyped:) where the input
+        is proved to be either BoolInt32 or Boolean should be optimized to just masking the
+        lowest bit.
+        
+        This is another 37% speed-up on JSRegress/slow-ternaries.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileBooleanToNumber):
+
+2015-05-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        <rdar://problem/21003555> cloberrize() is wrong for ArithRound because it doesn't account for the arith mode
+        https://bugs.webkit.org/show_bug.cgi?id=145147
+
+        Reviewed by Filip Pizlo.
+
+        Really stupid bug: ArithRound nodes with different rounding modes
+        were not distinguished and CSE would happily unify with a node of
+        a different rounding mode.
+
+        DFG::clobberize() already support additional data but I was not using it.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * tests/stress/math-round-arith-rounding-mode.js: Added.
+        (firstCareAboutZeroSecondDoesNot):
+        (firstDoNotCareAboutZeroSecondDoes):
+        (warmup):
+        (verifyNegativeZeroIsPreserved):
+
+2015-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Add SpecBoolInt32 type that means "I'm an int and I'm either 0 or 1"
+        https://bugs.webkit.org/show_bug.cgi?id=145137
+
+        Reviewed by Benjamin Poulain.
+        
+        It's super useful to know if an integer value could be either zero or one. We have an
+        immediate need for this because of Int32|Boolean uses, where knowing that the Int32 is
+        either 0 or 1 means that there is no actual polymorphism if you just look at the low bit
+        (1 behaves like true, 0 behaves like false, and the low bit of 1|true is 1, and the low
+        bit of 0|false is 0).
+        
+        We do this by splitting the SpecInt32 type into SpecBoolInt32 and SpecNonBoolInt32. This
+        change doesn't have any effect on behavior, yet. But it does give us the ability to
+        predict and prove when values are SpecBoolInt32; it's just we don't leverage this yet.
+        
+        This is perf-neutral.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromValue):
+        * bytecode/SpeculatedType.h:
+        (JSC::isStringOrStringObjectSpeculation):
+        (JSC::isBoolInt32Speculation):
+        (JSC::isInt32Speculation):
+        (JSC::isInt32OrBooleanSpeculation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2015-05-18  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        [CMake] Ignore warnings in system headers
+        https://bugs.webkit.org/show_bug.cgi?id=144747
+
+        Reviewed by Darin Adler.
+
+        Separate include directories into WebKit project includes and system includes. Suppress all
+        warnings from headers in system include directories using the SYSTEM argument to
+        the include_directories command.
+
+        * CMakeLists.txt:
+        * PlatformGTK.cmake:
+
+2015-05-18  Skachkov Alexandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Feature flag for arrow function
+        https://bugs.webkit.org/show_bug.cgi?id=145108
+
+        Reviewed by Ryosuke Niwa.
+
+        Added feature flag ENABLE_ES6_ARROWFUNCTION_SYNTAX for arrow function
+
+        * Configurations/FeatureDefines.xcconfig:
+        
+2015-05-18  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] When entering a CheckTierUp without OSREntry, force the CheckTierUp for the outer loops with OSR Entry
+        https://bugs.webkit.org/show_bug.cgi?id=145092
+
+        Reviewed by Filip Pizlo.
+
+        When we have a hot loop without OSR Entry inside a slower loop that support OSR Entry,
+        we get the inside loop driving the tierUpCounter and we have very little chance of
+        doing a CheckTierUp on the outer loop. In turn, this give almost no opportunity to tier
+        up in the outer loop and OSR Enter there.
+
+        This patches changes CheckTierUp to force its outer loops to do a CheckTierUp themselves.
+
+        To do that, CheckTierUp sets a flag "nestedTriggerIsSet" to force the outer loop to
+        enter their CheckTierUp regardless of the tier-up counter.
+
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter<countingVariant>::setThreshold):
+        This is somewhat unrelated. This assertion is incorrect because it relies on
+        m_counter, which changes on an other thread.
+
+        I have hit it a couple of times with this patch because we are a bit more aggressive
+        on CheckTierUp. What happens is:
+        1) ExecutionCounter<countingVariant>::checkIfThresholdCrossedAndSet() first checks
+           hasCrossedThreshold(), and it is false.
+        2) On the main thread, the hot loops keeps running and the counter becomes large
+           enough to cross the threshold.
+        3) ExecutionCounter<countingVariant>::checkIfThresholdCrossedAndSet() runs the next
+           test, setThreshold(), where the assertion is. Since the counter is now large enough,
+           the assertion fails.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+        * dfg/DFGJITCode.h:
+        I used a uint8_t instead of a boolean to make the code generation clearer
+        in DFGSpeculativeJIT64.
+
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        This is a bit annoying: we have the NaturalLoops analysis that provides us
+        everything we need to know about loops, but the TierUpCheck are conservative
+        and set on LoopHint.
+
+        To make the two work together, we first find all the CheckTierUp that cannot
+        OSR enter and we keep a list of all the natural loops containing them.
+
+        Then we do a second pass over the LoopHints, get their NaturalLoop, and check
+        if it contains a loop that cannot OSR enter.
+
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        (JSC::DFG::TierUpCheckInjectionPhase::canOSREnterAtLoopHint):
+
+2015-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a Int-or-Boolean speculation to Branch
+        https://bugs.webkit.org/show_bug.cgi?id=145134
+
+        Reviewed by Benjamin Poulain.
+        
+        After https://bugs.webkit.org/show_bug.cgi?id=126778 we no longer have a reason not to do the
+        int-or-boolean optimization that we already do everywhere else.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2015-05-18  Andreas Kling  <akling@apple.com>
+
+        [JSC] Speed up URL encode/decode by using bitmaps instead of strchr().
+        <https://webkit.org/b/145115>
+
+        Reviewed by Anders Carlsson.
+
+        We were calling strchr() for every character when doing URL encoding/decoding and it stood out
+        like a sore O(n) thumb in Instruments. Optimize this by using a Bitmap<256> instead.
+
+        5.5% progression on Kraken/stanford-crypto-sha256-iterative.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::makeCharacterBitmap):
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+
+2015-05-17  Benjamin Poulain  <benjamin@webkit.org>
+
+        Do not use fastMallocGoodSize anywhere
+        https://bugs.webkit.org/show_bug.cgi?id=145103
+
+        Reviewed by Michael Saboff.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerData::AssemblerData):
+        (JSC::AssemblerData::grow):
+
+2015-05-17  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Make StringRecursionChecker faster in the simple cases without any recursion
+        https://bugs.webkit.org/show_bug.cgi?id=145102
+
+        Reviewed by Darin Adler.
+
+        In general, the array targeted by Array.toString() or Array.join() are pretty
+        simple. In those simple cases, we spend as much time in StringRecursionChecker
+        as we do on the actual operation.
+
+        The reason for this is the HashSet stringRecursionCheckVisitedObjects used
+        to detect recursion. We are constantly adding and removing objects which
+        dirty buckets and force constant rehash.
+
+        This patch adds a simple shortcut for those simple case: in addition to the HashSet,
+        we keep a pointer to the root object of the recursion.
+        In the vast majority of cases, we no longer touch the HashSet at all.
+
+        This patch is a 12% progression on the overall score of ArrayWeighted.
+
+        * runtime/StringRecursionChecker.h:
+        (JSC::StringRecursionChecker::performCheck):
+        (JSC::StringRecursionChecker::~StringRecursionChecker):
+        * runtime/VM.h:
+
+2015-05-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Insert store barriers late so that IR transformations don't have to worry about them
+        https://bugs.webkit.org/show_bug.cgi?id=145015
+
+        Reviewed by Geoffrey Garen.
+        
+        We have had three kinds of bugs with store barriers. For the sake of discussion we say
+        that a store barrier is needed when we have something like:
+        
+            base.field = value
+        
+        - We sometimes fail to realize that we could remove a barrier when value is a non-cell.
+          This might happen if we prove value to be a non-cell even though in the FixupPhase it
+          wasn't predicted non-cell.
+        
+        - We sometimes have a barrier in the wrong place after object allocation sinking. We
+          might sink an allocation to just above the store, but that puts it just after the
+          StoreBarrier that FixupPhase inserted.
+        
+        - We don't remove redundant barriers across basic blocks.
+        
+        This comprehensively fixes these issues by doing store barrier insertion late, and
+        removing the store barrier elision phase. Store barrier insertion uses an epoch-based
+        algorithm to determine when stores need barriers. Briefly, a barrier is not needed if
+        base is in the current GC epoch (i.e. was the last object that we allocated or had a
+        barrier since last GC) or if base has a newer GC epoch than value (i.e. value would have
+        always been allocated before base). We do conservative things when merging epoch state
+        between basic blocks, and we only do such inter-block removal in the FTL. FTL also
+        queries AI to determine what type we've proved about value, and avoids barriers when
+        value is not a cell. FixupPhase still inserts type checks on some stores, to maximize
+        the likelihood that this AI-based removal is effective.
+        
+        Rolling back in after fixing some debug build test failures.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBlockMap.h:
+        (JSC::DFG::BlockMap::at):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGEpoch.h:
+        (JSC::DFG::Epoch::operator<):
+        (JSC::DFG::Epoch::operator>):
+        (JSC::DFG::Epoch::operator<=):
+        (JSC::DFG::Epoch::operator>=):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::speculateForBarrier):
+        (JSC::DFG::FixupPhase::insertStoreBarrier): Deleted.
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGStoreBarrierElisionPhase.cpp: Removed.
+        * dfg/DFGStoreBarrierElisionPhase.h: Removed.
+        * dfg/DFGStoreBarrierInsertionPhase.cpp: Added.
+        (JSC::DFG::performFastStoreBarrierInsertion):
+        (JSC::DFG::performGlobalStoreBarrierInsertion):
+        * dfg/DFGStoreBarrierInsertionPhase.h: Added.
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR): Fix an unrelated debug-only bug.
+        * tests/stress/load-varargs-then-inlined-call-and-exit.js: Test for that debug-only bug.
+        * tests/stress/load-varargs-then-inlined-call-and-exit-strict.js: Strict version of that test.
+
+2015-05-16  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r184415.
+        https://bugs.webkit.org/show_bug.cgi?id=145096
+
+        Broke several tests (Requested by msaboff on #webkit).
+
+        Reverted changeset:
+
+        "Insert store barriers late so that IR transformations don't
+        have to worry about them"
+        https://bugs.webkit.org/show_bug.cgi?id=145015
+        http://trac.webkit.org/changeset/184415
+
+2015-05-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Insert store barriers late so that IR transformations don't have to worry about them
+        https://bugs.webkit.org/show_bug.cgi?id=145015
+
+        Reviewed by Geoffrey Garen.
+        
+        We have had three kinds of bugs with store barriers. For the sake of discussion we say
+        that a store barrier is needed when we have something like:
+        
+            base.field = value
+        
+        - We sometimes fail to realize that we could remove a barrier when value is a non-cell.
+          This might happen if we prove value to be a non-cell even though in the FixupPhase it
+          wasn't predicted non-cell.
+        
+        - We sometimes have a barrier in the wrong place after object allocation sinking. We
+          might sink an allocation to just above the store, but that puts it just after the
+          StoreBarrier that FixupPhase inserted.
+        
+        - We don't remove redundant barriers across basic blocks.
+        
+        This comprehensively fixes these issues by doing store barrier insertion late, and
+        removing the store barrier elision phase. Store barrier insertion uses an epoch-based
+        algorithm to determine when stores need barriers. Briefly, a barrier is not needed if
+        base is in the current GC epoch (i.e. was the last object that we allocated or had a
+        barrier since last GC) or if base has a newer GC epoch than value (i.e. value would have
+        always been allocated before base). We do conservative things when merging epoch state
+        between basic blocks, and we only do such inter-block removal in the FTL. FTL also
+        queries AI to determine what type we've proved about value, and avoids barriers when
+        value is not a cell. FixupPhase still inserts type checks on some stores, to maximize
+        the likelihood that this AI-based removal is effective.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBlockMap.h:
+        (JSC::DFG::BlockMap::at):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGEpoch.h:
+        (JSC::DFG::Epoch::operator<):
+        (JSC::DFG::Epoch::operator>):
+        (JSC::DFG::Epoch::operator<=):
+        (JSC::DFG::Epoch::operator>=):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::speculateForBarrier):
+        (JSC::DFG::FixupPhase::insertStoreBarrier): Deleted.
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGStoreBarrierElisionPhase.cpp: Removed.
+        * dfg/DFGStoreBarrierElisionPhase.h: Removed.
+        * dfg/DFGStoreBarrierInsertionPhase.cpp: Added.
+        (JSC::DFG::performFastStoreBarrierInsertion):
+        (JSC::DFG::performGlobalStoreBarrierInsertion):
+        * dfg/DFGStoreBarrierInsertionPhase.h: Added.
+
+2015-05-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [ARM64] Do not fail branchConvertDoubleToInt32 when the result is zero and not negative zero
+        https://bugs.webkit.org/show_bug.cgi?id=144976
+
+        Reviewed by Michael Saboff.
+
+        Failing the conversion on zero is pretty dangerous as we discovered on x86.
+
+        This patch does not really impact performance significantly because
+        r184220 removed the zero checks from Kraken. This patch is just to be
+        on the safe side for cases not covered by existing benchmarks.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branchConvertDoubleToInt32):
+
+2015-05-15  Sungmann Cho  <sungmann.cho@navercorp.com>
+
+        Remove unnecessary forward declarations in PropertyNameArray.h.
+        https://bugs.webkit.org/show_bug.cgi?id=145058
+
+        Reviewed by Andreas Kling.
+
+        No new tests, no behavior change.
+
+        * runtime/PropertyNameArray.h:
+
+2015-05-15  Mark Lam  <mark.lam@apple.com>
+
+        JSArray::setLength() should reallocate instead of zero-filling if the reallocation would be small enough.
+        https://bugs.webkit.org/show_bug.cgi?id=144622
+
+        Reviewed by Geoffrey Garen.
+
+        When setting the array to a new length that is shorter, we now check if it is worth
+        just making a new butterfly instead of clearing out the slots in the old butterfly
+        that resides beyond the new length.  If so, we will make a new butterfly instead.
+
+        There is no perf differences in the benchmark results.  However, this does benefit
+        the perf of pathological cases where we need to shorten the length of a very large
+        array, as is the case in tests/mozilla/js1_5/Array/regress-101964.js.  With this
+        patch, we can expect that test to complete in a short time again.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::reallocateAndShrinkButterfly):
+        - makes a new butterfly with a new shorter length.
+        * runtime/JSObject.h:
+        * tests/mozilla/js1_5/Array/regress-101964.js:
+        - Undo this test change since this patch will prevent us from spending a lot of time
+          clearing a large butterfly.
+
+2015-05-15  Basile Clement  <basile_clement@apple.com>
+
+        DFGLICMPhase shouldn't create NodeOrigins with forExit but without semantic
+        https://bugs.webkit.org/show_bug.cgi?id=145062
+
+        Reviewed by Filip Pizlo.
+
+        We assert in various places (including NodeOrigin::isSet()) that a
+        NodeOrigin's semantic and forExit must be either both set, or both
+        unset.  However, LICM'ing a node with unset NodeOrigin would only set
+        forExit, and leave semantic unset. This can for instance happen when a
+        Phi node is constant-folded into a JSConstant, which in turn gets
+        LICM'd.
+
+        This patch changes DFGLICMPhase to set the NodeOrigin's semantic in
+        addition to its forExit if semantic was previously unset.
+
+        It also adds two validators to DFGValidate.cpp:
+         - In both SSA and CPS form, a NodeOrigin semantic and forExit must be either both set or both unset
+         - In CPS form, all nodes must have a set NodeOrigin forExit (this is
+           the CPS counterpart to the SSA validator that checks that all nodes
+           must have a set NodeOrigin except possibly for a continuous chunk of
+           nodes at the top of a block)
+
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::validateCPS):
+
+2015-05-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, remove an unused declaration.
+
+        * dfg/DFGSpeculativeJIT.h:
+
+2015-05-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove unused constant-base and constant-value store barrier code in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=145039
+
+        Reviewed by Andreas Kling.
+        
+        Just killing dead code.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer): Deleted.
+        (JSC::DFG::SpeculativeJIT::writeBarrier): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+
+2015-05-15  Alexandr Skachkov  <gskachkov@gmail.com>
+
+        Fix typo in function name parseFunctionParamters -> parseFunctionParameters
+        https://bugs.webkit.org/show_bug.cgi?id=145040
+
+        Reviewed by Mark Lam.
+
+        * parser/Parser.h:
+        * parser/Parser.cpp:
+
+2015-05-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove StoreBarrierWithNullCheck, nobody ever generates this.
+        
+        Rubber stamped by Benjamin Poulain and Michael Saboff.
+
+        If we did bring something like this back in the future, we would just use UntypedUse instead
+        of CellUse to indicate that this is what we want.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::isStoreBarrier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck): Deleted.
+
+2015-05-14  Filip Pizlo  <fpizlo@apple.com>
+
+        PutGlobalVar should reference the global object it's storing into
+        https://bugs.webkit.org/show_bug.cgi?id=145036
+
+        Reviewed by Michael Saboff.
+        
+        This makes it easier to reason about store barrier insertion and elimination. This changes
+        the format of PutGlobalVar so that child1 is the global object and child2 is the value.
+        Previously it just had child1, and that was the value.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compilePutGlobalVar):
+
+2015-05-14  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        [CMake] Error out when ruby is too old
+        https://bugs.webkit.org/show_bug.cgi?id=145014
+
+        Reviewed by Martin Robinson.
+
+        Don't enforce the check for the Ruby executable here; it's now enforced in the top-level
+        CMakeLists.txt instead.
+
+        * CMakeLists.txt:
+
+2015-05-12  Basile Clement  <basile_clement@apple.com>
+
+        Enforce options coherency
+        https://bugs.webkit.org/show_bug.cgi?id=144921
+
+        Reviewed by Mark Lam.
+
+        JavaScriptCore should be failing early when the options are set in such
+        a way that we don't have a meaningful way to execute JavaScript, rather
+        than failing for obscure reasons at some point during execution.
+
+        This patch adds a new function that checks whether the options are set
+        in a coherent way, and makes JSC::Options::initialize() crash when the
+        environment enforces incoherent options.
+        Client applications able to add or change additional options are
+        responsible to check for coherency again before starting to actually
+        execute JavaScript, if any additional options have been set. This is
+        implemented for the jsc executable in this patch.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        (JSC::Options::ensureOptionsAreCoherent): Added.
+        * runtime/Options.h:
+        (JSC::Options::ensureOptionsAreCoherent): Added.
+
+2015-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION (r184337): [EFL] unresolved reference errors in ARM builds
+        https://bugs.webkit.org/show_bug.cgi?id=145019
+
+        Reviewed by Ryosuke Niwa.
+
+        Attempt to fix compile errors in EFL ARM buildbots.
+        By executing `nm`, found JSTemplateRegistryKey.cpp.o and TemplateRegistry.cpp.o have
+        unresolved reference to Structure::get. That is inlined function in StructureInlines.h.
+
+        * runtime/JSTemplateRegistryKey.cpp:
+        * runtime/TemplateRegistry.cpp:
+
+2015-05-14  Alexandr Skachkov  <gskachkov@gmail.com>
+
+        Small refactoring before implementation of the ES6 arrow function.
+        https://bugs.webkit.org/show_bug.cgi?id=144954
+
+        Reviewed by Ryosuke Niwa.
+
+        * parser/Parser.h:
+        * parser/Parser.cpp:
+
+2015-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION (r184337): ASSERT failed in debug builds for tagged templates
+        https://bugs.webkit.org/show_bug.cgi?id=145013
+
+        Reviewed by Filip Pizlo.
+
+        Fix the regression introduced by r184337.
+
+        1. JSTemporaryRegistryKey::s_info should inherit the Base::s_info,
+           JSDestructibleObject::s_info.
+
+        2. The first register argument of BytecodeGenerator::emitNode
+           should be a referenced register if it is a temporary register.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TaggedTemplateNode::emitBytecode):
+        * runtime/JSTemplateRegistryKey.cpp:
+
+2015-05-14  Andreas Kling  <akling@apple.com>
+
+        String.prototype.split() should create efficient substrings.
+        <https://webkit.org/b/144985>
+        <rdar://problem/20949344>
+
+        Reviewed by Geoffrey Garen.
+
+        Teach split() how to make substring JSStrings instead of relying on StringImpl's
+        substring sharing mechanism. The optimization works by deferring the construction
+        of a StringImpl until the substring's value is actually needed.
+
+        This knocks ~2MB off of theverge.com by avoiding the extra StringImpl allocations.
+        Out of ~70000 substrings created by split(), only ~2000 of them get reified.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSubstring):
+        (JSC::splitStringByOneCharacterImpl):
+        (JSC::stringProtoFuncSplit):
+
+2015-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Change the status of ES6 tagged templates to Done in features.json
+        https://bugs.webkit.org/show_bug.cgi?id=145003
+
+        Reviewed by Benjamin Poulain.
+
+        Now it's implemented in r184337.
+
+        * features.json:
+
+2015-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce SymbolType into SpeculativeTypes
+        https://bugs.webkit.org/show_bug.cgi?id=142651
+
+        Reviewed by Filip Pizlo.
+
+        Introduce SpecSymbol type into speculative types.
+        Previously symbol type is categorized into SpecCellOther.
+        But SpecCellOther is not intended to be used for such cells.
+
+        This patch just introduces SpecSymbol.
+        It represents the type of target value is definitely the symbol type.
+        It is the part of SpecCell.
+
+        In this patch, we do not introduce SymbolUse tracking.
+        It will be added in the separate patch.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationFromStructure):
+        * bytecode/SpeculatedType.h:
+        (JSC::isSymbolSpeculation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::setType):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * tests/stress/typeof-symbol.js: Added.
+
+2015-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement tagged templates
+        https://bugs.webkit.org/show_bug.cgi?id=143183
+
+        Reviewed by Oliver Hunt.
+
+        This patch implements ES6 tagged templates.
+        In tagged templates, the function takes the template object.
+
+        The template object contains the raw and cooked template strings,
+        so when parsing the tagged templates, we need to tokenize the raw and cooked strings.
+        While tagged templates require the both strings, the template literal only requires
+        the cooked strings. So when tokenizing under the template literal context,
+        we only builds the cooked strings.
+
+        As per ES6 spec, the template objects for the same raw strings are shared in the same realm.
+        The template objects is cached. And every time we evaluate the same tagged templates,
+        the same (cached) template objects are used.
+        Since the spec freezes this template objects completely,
+        we cannot attach some properties to it.
+        So we can say that it behaves as if the template objects are the primitive values (like JSString).
+        Since we cannot attach properties, the only way to test the identity of the template object is comparing. (===)
+        As the result, when there is no reference to the template object, we can garbage collect it
+        because the user has no way to test that the newly created template object does not equal
+        to the already collected template object.
+
+        So, to implement tagged templates, we implement the following components.
+
+        1. JSTemplateRegistryKey
+        It holds the template registry key and it does not exposed to users.
+        TemplateRegistryKey holds the vector of raw and cooked strings with the pre-computed hash value.
+        When obtaining the template object for the (statically, a.k.a. at the parsing time) given raw string vectors,
+        we use this JSTemplateRegistryKey as a key to the map and look up the template object from
+        TemplateRegistry.
+        JSTemplateRegistryKey is created at the bytecode compiling time and
+        stored in the CodeBlock as like as JSString content values.
+
+        2. TemplateRegistry
+        This manages the cached template objects.
+        It holds the weak map (JSTemplateRegistryKey -> the template object).
+        The template object is weakly referenced.
+        So if there is no reference to the template object,
+        the template object is automatically GC-ed.
+        When looking up the template object, it searches the cached template object.
+        If it is found, it is returned to the users.
+        If there is no cached template objects, it creates the new template object and
+        stores it with the given template registry key.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addTemplateRegistryKeyConstant):
+        (JSC::BytecodeGenerator::emitGetTemplateObject):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TaggedTemplateNode::emitBytecode):
+        (JSC::TemplateLiteralNode::emitBytecode): Deleted.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createTaggedTemplate):
+        (JSC::ASTBuilder::createTemplateLiteral): Deleted.
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::setCode):
+        (JSC::Lexer<T>::parseTemplateLiteral):
+        (JSC::Lexer<T>::lex):
+        (JSC::Lexer<T>::scanTrailingTemplateString):
+        (JSC::Lexer<T>::clear):
+        * parser/Lexer.h:
+        (JSC::Lexer<T>::makeEmptyIdentifier):
+        * parser/NodeConstructors.h:
+        (JSC::TaggedTemplateNode::TaggedTemplateNode):
+        (JSC::TemplateLiteralNode::TemplateLiteralNode): Deleted.
+        * parser/Nodes.h:
+        (JSC::TemplateLiteralNode::templateStrings):
+        (JSC::TemplateLiteralNode::templateExpressions):
+        (JSC::TaggedTemplateNode::templateLiteral):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseTemplateString):
+        (JSC::Parser<LexerType>::parseTemplateLiteral):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::makeEmptyIdentifier):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createTaggedTemplate):
+        (JSC::SyntaxChecker::createTemplateLiteral): Deleted.
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::getTemplateObject):
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::templateRegistry):
+        * runtime/JSTemplateRegistryKey.cpp: Added.
+        (JSC::JSTemplateRegistryKey::JSTemplateRegistryKey):
+        (JSC::JSTemplateRegistryKey::create):
+        (JSC::JSTemplateRegistryKey::destroy):
+        * runtime/JSTemplateRegistryKey.h: Added.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorFreeze):
+        * runtime/ObjectConstructor.h:
+        * runtime/TemplateRegistry.cpp: Added.
+        (JSC::TemplateRegistry::TemplateRegistry):
+        (JSC::TemplateRegistry::getTemplateObject):
+        * runtime/TemplateRegistry.h: Added.
+        * runtime/TemplateRegistryKey.h: Added.
+        (JSC::TemplateRegistryKey::isDeletedValue):
+        (JSC::TemplateRegistryKey::isEmptyValue):
+        (JSC::TemplateRegistryKey::hash):
+        (JSC::TemplateRegistryKey::rawStrings):
+        (JSC::TemplateRegistryKey::cookedStrings):
+        (JSC::TemplateRegistryKey::operator==):
+        (JSC::TemplateRegistryKey::operator!=):
+        (JSC::TemplateRegistryKey::Hasher::hash):
+        (JSC::TemplateRegistryKey::Hasher::equal):
+        (JSC::TemplateRegistryKey::TemplateRegistryKey):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * tests/stress/tagged-templates-identity.js: Added.
+        (shouldBe):
+        * tests/stress/tagged-templates-raw-strings.js: Added.
+        (shouldBe):
+        (tag):
+        (testEval):
+        * tests/stress/tagged-templates-syntax.js: Added.
+        (tag):
+        (testSyntax):
+        (testSyntaxError):
+        * tests/stress/tagged-templates-template-object.js: Added.
+        (shouldBe):
+        (tag):
+        * tests/stress/tagged-templates-this.js: Added.
+        (shouldBe):
+        (tag):
+        * tests/stress/tagged-templates.js: Added.
+        (shouldBe):
+        (raw):
+        (cooked):
+        (Counter):
+
+2015-05-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r180595): same-callee profiling no longer works
+        https://bugs.webkit.org/show_bug.cgi?id=144787
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces a DFG optimization to use NewObject node when the callee of op_create_this is
+        always the same JSFunction. This condition doesn't hold when the byte code creates multiple
+        JSFunction objects at runtime as in: function y() { return function () {} }; new y(); new y();
+
+        To enable this optimization, LLint and baseline JIT now store the last callee we saw in the newly
+        added fourth operand of op_create_this. We use this JSFunction's structure in DFG after verifying
+        our speculation that the callee is the same. To avoid recompiling the same code for different callee
+        objects in the polymorphic case, the special value of seenMultipleCalleeObjects() is set in
+        LLint and baseline JIT when multiple callees are observed.
+
+        Tests: stress/create-this-with-callee-variants.js
+
+        * bytecode/BytecodeList.json: Increased the number of operands to 5.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Dump the newly added callee cache.
+        (JSC::CodeBlock::finalizeUnconditionally): Clear the callee cache if the callee is no longer alive.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCreateThis): Add the instruction to propertyAccessInstructions so that
+        we can clear the callee cache in CodeBlock::finalizeUnconditionally. Also initialize the newly added
+        operand.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Implement the optimization. Speculate the actual callee to
+        match the cache. Use the cached callee's structure if the speculation succeeds. Otherwise, OSR exit.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_this): Go to the slow path to update the cache unless it's already marked
+        as seenMultipleCalleeObjects() to indicate the polymorphic behavior and/or we've OSR exited here.
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_this): Ditto.
+        (JSC::JIT::emitSlow_op_create_this):
+        * llint/LowLevelInterpreter32_64.asm:
+        (_llint_op_create_this): Ditto.
+        * llint/LowLevelInterpreter64.asm:
+        (_llint_op_create_this): Ditto.
+        * runtime/CommonSlowPaths.cpp:
+        (slow_path_create_this): Set the callee cache to the actual callee if it's not set. If the cache has
+        been set to a JSFunction* different from the actual callee, set it to seenMultipleCalleeObjects().
+        * runtime/JSCell.h:
+        (JSC::JSCell::seenMultipleCalleeObjects): Added.
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::unvalidatedGet): Removed the compile guard around it.
+        * tests/stress/create-this-with-callee-variants.js: Added.
+
+2015-05-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Clean up some possible RefPtr to PassRefPtr churn
+        https://bugs.webkit.org/show_bug.cgi?id=144779
+
+        Reviewed by Darin Adler.
+
+        * runtime/GenericTypedArrayViewInlines.h:
+        (JSC::GenericTypedArrayView<Adaptor>::create):
+        (JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/Structure.cpp:
+        (JSC::Structure::toStructureShape):
+        * runtime/TypedArrayBase.h:
+        (JSC::TypedArrayBase::create):
+        (JSC::TypedArrayBase::createUninitialized):
+        * tools/FunctionOverrides.cpp:
+        (JSC::initializeOverrideInfo):
+        Release the last use of a RefPtr as it is passed on.
+
+2015-05-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6: Allow duplicate property names
+        https://bugs.webkit.org/show_bug.cgi?id=142895
+
+        Reviewed by Geoffrey Garen.
+
+        Introduce new `op_put_getter_by_id` and `op_put_setter_by_id` opcodes
+        that will define a single getter or setter property on an object.
+
+        The existing `op_put_getter_setter` opcode is still preferred for
+        putting both a getter and setter at the same time but cannot be used
+        for putting an individual getter or setter which is needed in
+        some cases.
+
+        Add a new slow path when generating bytecodes for a property list
+        with computed properties, as computed properties are the only time
+        the list of properties cannot be determined statically.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        - fast path for all constant properties
+        - slow but paired getter/setter path if there are no computed properties
+        - slow path, individual put operation for every property, if there are computed properties
+
+        * parser/Nodes.h:
+        Distinguish a Computed property from a Constant property.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        Distingish Computed and Constant properties.
+
+        (JSC::Parser<LexerType>::parseObjectLiteral):
+        When we drop into strict mode it is because we saw a getter
+        or setter, so be more explicit.
+
+        (JSC::Parser<LexerType>::parseStrictObjectLiteral):
+        Eliminate duplicate property syntax error exception.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::getName):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::getName): Deleted.
+        No longer used.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        When updating a property. If the Accessor attribute changed
+        update the Structure.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putGetter):
+        (JSC::JSObject::putSetter):
+        Called by the opcodes, just perform the same operation that
+        __defineGetter__ or __defineSetter__ would do.
+
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        This transition is now handled in putDirectInternal.
+
+        * runtime/Structure.h:
+        Add needed export.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutGetterById):
+        (JSC::BytecodeGenerator::emitPutSetterById):
+        * bytecompiler/BytecodeGenerator.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_getter_by_id):
+        (JSC::JIT::emit_op_put_setter_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_getter_by_id):
+        (JSC::JIT::emit_op_put_setter_by_id):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        New bytecodes. Modelled after existing op_put_getter_setter.
+
+2015-05-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Creating a new blank document in icloud pages causes an AI error: Abstract value (CellBytecodedoubleBoolOther, TOP, TOP) for double node has type outside SpecFullDouble.
+        https://bugs.webkit.org/show_bug.cgi?id=144856
+
+        Reviewed by Benjamin Poulain.
+        
+        First I made fixTypeForRepresentation() print out better diagnostics when it dies.
+        
+        Then I fixed the bug: Node::convertToIdentityOn(Node*) needs to make sure that when it
+        converts to a representation-changing node, it needs to use one of the UseKinds that such
+        a node expects. For example, DoubleRep(UntypedUse:) doesn't make sense; it needs to be
+        something like DoubleRep(NumberUse:) since it will speculate that the input is a number.
+
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::fixTypeForRepresentation):
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToIdentityOn):
+        * tests/stress/cloned-arguments-get-by-val-double-array.js: Added.
+        (foo):
+
+2015-05-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r184313.
+        https://bugs.webkit.org/show_bug.cgi?id=144974
+
+        Introduced an assertion failure in class-syntax-
+        declaration.js, class-syntax-expression.js, and object-
+        literal-syntax.js (Requested by rniwa on #webkit).
+
+        Reverted changeset:
+
+        "Small refactoring before ES6 Arrow function implementation."
+        https://bugs.webkit.org/show_bug.cgi?id=144954
+        http://trac.webkit.org/changeset/184313
+
+2015-05-13  Oliver Hunt  <oliver@apple.com>
+        Ensure that all the smart pointer types in WTF clear their pointer before deref
+        https://bugs.webkit.org/show_bug.cgi?id=143789
+
+        Reviewed by Ryosuke Niwa.
+
+        One of the simpler cases of this in JavaScriptCore. There
+        are other cases where we need to guard the derefs but they
+        are more complex cases.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::releaseImpl):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::releaseImpl):
+
+2015-05-13  Alexandr Skachkov  <gskachkov@gmail.com>
+
+        Small refactoring before ES6 Arrow function implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=144954
+
+        Reviewed by Filip Pizlo.
+
+        * parser/Parser.h:
+        * parser/Parser.cpp:
+
+2015-05-13  Filip Pizlo  <fpizlo@apple.com>
+
+        The liveness pruning done by ObjectAllocationSinkingPhase ignores the possibility of an object's bytecode liveness being longer than its DFG liveness
+        https://bugs.webkit.org/show_bug.cgi?id=144945
+
+        Reviewed by Michael Saboff.
+        
+        We were making the mistake of using DFG liveness for object allocation sinking decisions.
+        This is wrong. In fact we almost never want to use DFG liveness directly. The only place
+        where that makes sense is pruning in DFG AI.
+        
+        So, I created a CombinedLiveness class that combines the DFG liveness with bytecode
+        liveness.
+        
+        In the process of doing this, I realized that the DFGForAllKills definition of combined
+        liveness at block tail was not strictly right; it was using the bytecode liveness at the
+        block terminal instead of the union of the bytecode live-at-heads of successor blocks. So,
+        I changed DFGForAllKills to work in terms of CombinedLiveness.
+        
+        This allows me to unskip the test I added in r184260. I also added a new test that tries to
+        trigger this bug more directly.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGCombinedLiveness.cpp: Added.
+        (JSC::DFG::liveNodesAtHead):
+        (JSC::DFG::CombinedLiveness::CombinedLiveness):
+        * dfg/DFGCombinedLiveness.h: Added.
+        (JSC::DFG::CombinedLiveness::CombinedLiveness):
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKillsInBlock):
+        (JSC::DFG::forAllLiveNodesAtTail): Deleted.
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::performSinking):
+        (JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+        * tests/stress/escape-object-in-diamond-then-exit.js: Added.
+        * tests/stress/sink-object-past-invalid-check-sneaky.js:
+
+2015-05-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        I skipped a wrong test in r184270. Fix that.
+        The failure is tracked by webkit.org/b/144947.
+
+        * tests/stress/arith-modulo-node-behaviors.js:
+        * tests/stress/arith-mul-with-constants.js:
+
+2015-05-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Avoid always running some debug code in type profiling
+        https://bugs.webkit.org/show_bug.cgi?id=144775
+
+        Reviewed by Daniel Bates.
+
+        * runtime/TypeProfilerLog.cpp:
+        (JSC::TypeProfilerLog::processLogEntries):
+
+2015-05-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Pass String as reference in more places
+        https://bugs.webkit.org/show_bug.cgi?id=144769
+
+        Reviewed by Daniel Bates.
+
+        * debugger/Breakpoint.h:
+        (JSC::Breakpoint::Breakpoint):
+        * parser/Parser.h:
+        (JSC::Parser::setErrorMessage):
+        (JSC::Parser::updateErrorWithNameAndMessage):
+        * parser/ParserError.h:
+        (JSC::ParserError::ParserError):
+        * runtime/RegExp.cpp:
+        (JSC::RegExpFunctionalTestCollector::outputOneTest):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectSourceInternal):
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::typeInformationForExpressionAtOffset):
+        * runtime/TypeProfilerLog.cpp:
+        (JSC::TypeProfilerLog::processLogEntries):
+        * runtime/TypeProfilerLog.h:
+        * tools/FunctionOverrides.cpp:
+        (JSC::initializeOverrideInfo):
+        * inspector/scripts/codegen/generate_objc_conversion_helpers.py:
+        (ObjCConversionHelpersGenerator._generate_enum_from_protocol_string):
+
+        * inspector/scripts/codegen/objc_generator_templates.py:
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        Rebaseline tests after updating the generator.
+
+2015-05-13  Michael Saboff  <msaboff@apple.com>
+
+        com.apple.WebKit.WebContent crashed at JavaScriptCore: JSC::CodeBlock::finalizeUnconditionally
+        https://bugs.webkit.org/show_bug.cgi?id=144933
+
+        Changed the RELEASE_ASSERT_NOT_REACHED into an ASSERT.  Added some diagnostic messages to
+        help determine the cause for any crash.
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finalizeUnconditionally):
+
+2015-05-13  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r184260): arguments elimination has stopped working because of Check(UntypedUse:) from SSAConversionPhase
+        https://bugs.webkit.org/show_bug.cgi?id=144951
+
+        Reviewed by Michael Saboff.
+        
+        There were two issues here:
+        
+        - In r184260 we expected a small number of possible use kinds in Check nodes, and
+          UntypedUse was not one of them. That seemed like a sensible assumption because we don't
+          create Check nodes unless it's to have a check. But, SSAConversionPhase was creating a
+          Check that could have UntypedUse. I fixed this. It's cleaner for SSAConversionPhase to
+          follow the same idiom as everyone else and not create tautological checks.
+        
+        - It's clearly not very robust to assume that Checks will not be used tautologically. So,
+          this changes how we validate Checks in the escape analyses. We now use willHaveCheck,
+          which catches cases that AI would have already marked as unnecessary. It then also uses
+          a new helper called alreadyChecked(), which allows us to just ask if the check is
+          unnecessary for objects. That's a good fall-back in case AI hadn't run yet.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::alreadyChecked):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+
+k
+2015-05-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement String.raw
+        https://bugs.webkit.org/show_bug.cgi?id=144330
+
+        Reviewed by Filip Pizlo.
+
+        Implement String.raw. It is intended to be used with tagged-templates syntax.
+        To implement ToString abstract operation efficiently,
+        we introduce @toString bytecode intrinsic. It emits op_to_string directly.
+
+        * CMakeLists.txt:
+        * builtins/StringConstructor.js: Added.
+        (raw):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_toString):
+        * runtime/CommonIdentifiers.h:
+        * runtime/StringConstructor.cpp:
+        * tests/stress/string-raw.js: Added.
+        (shouldBe):
+        (.get shouldBe):
+        (Counter):
+
+2015-05-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Temporarily disable the test on Windows. The failure is tracked in webkit.org/b/144897.
+
+        * tests/stress/arith-mul-with-constants.js:
+
+2015-05-12  Filip Pizlo  <fpizlo@apple.com>
+
+        js/dom/stack-trace.html fails with eager compilation
+        https://bugs.webkit.org/show_bug.cgi?id=144853
+
+        Reviewed by Benjamin Poulain.
+        
+        All of our escape analyses were mishandling Check(). They were assuming that this is a
+        non-escaping operation. But, if we do for example a Check(Int32:@x) and @x is an escape
+        candidate, then we need to do something: if we eliminate or sink @x, then the check no
+        longer makes any sense since a phantom allocation has no type. This will make us forget
+        that this operation would have exited. This was causing us to not call a valueOf method in
+        js/dom/stack-trace.html with eager compilation enabled, because it was doing something like
+        +o where o had a valueOf method, and o was otherwise sinkable.
+        
+        This changes our escape analyses to basically pretend that any Check() that isn't obviously
+        unnecessary is an escape. We don't have to be super careful here. Most checks will be
+        completely eliminated by constant-folding. If that doesn't run in time, then the most
+        common check we will see is CellUse. So, we just recognize some very obvious check kinds
+        that we know would have passed, and for all of the rest we just assume that it's an escape.
+        
+        This was super tricky to test. The obvious way to test it is to use +o like
+        stack-trace.html, except that doing so relies on the fact that we still haven't implemented
+        the optimal behavior for op_to_number. So, I take four approaches in testing this patch:
+        
+        1) Use +o. These will test what we want it to test for now, but at some point in the future
+           these tests will just be a good sanity-check that our op_to_number implementation is
+           right.
+        
+        2) Do fancy control flow tricks to fool the profiling into thinking that some arithmetic
+           operation always sees integers even though we eventually feed it an object and that
+           object is a sink candidate.
+        
+        3) Introduce a new jsc.cpp intrinsic called isInt32() which returns true if the incoming
+           value is an int32. This intrinsic is required to be implemented by DFG by
+           unconditionally speculating that the input is int32. This allows us to write much more
+           targetted tests of the underlying issue.
+        
+        4) I made a version of stack-trace.html that runs in run-jsc-stress-tests, so that we can
+           get regression test coverage of this test in eager mode.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionIsInt32):
+        * runtime/Intrinsic.h:
+        * tests/stress/sink-arguments-past-invalid-check-dfg.js: Added.
+        * tests/stress/sink-arguments-past-invalid-check-int32-dfg.js: Added.
+        * tests/stress/sink-arguments-past-invalid-check-int32.js: Added.
+        * tests/stress/sink-arguments-past-invalid-check-sneakier.js: Added.
+        * tests/stress/sink-arguments-past-invalid-check.js: Added.
+        * tests/stress/sink-function-past-invalid-check-sneakier.js: Added.
+        * tests/stress/sink-function-past-invalid-check-sneaky.js: Added.
+        * tests/stress/sink-object-past-invalid-check-int32.js: Added.
+        * tests/stress/sink-object-past-invalid-check-sneakier.js: Added.
+        * tests/stress/sink-object-past-invalid-check-sneaky.js: Added.
+        * tests/stress/sink-object-past-invalid-check.js: Added.
+
+2015-05-12  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix the iteration count of arith-modulo-node-behaviors.js
+
+        * tests/stress/arith-modulo-node-behaviors.js:
+        No need for big numbers for the real testing.
+
+2015-05-12  Mark Lam  <mark.lam@apple.com>
+
+        Windows: Cannot use HANDLE from GetCurrentThread() to get the CONTEXT of another thread.
+        https://bugs.webkit.org/show_bug.cgi?id=144924
+
+        Reviewed by Alex Christensen.
+
+        The present stack scanning code in the Windows port is expecting that the
+        GetCurrentThread() API will provide a unique HANDLE for each thread.  The code
+        then saves and later uses that HANDLE with GetThreadContext() to get the
+        runtime state of the target thread from the GC thread.  According to
+        https://msdn.microsoft.com/en-us/library/windows/desktop/ms683182(v=vs.85).aspx,
+        GetCurrentThread() does not provide this unique HANDLE that we expect:
+
+            "The function cannot be used by one thread to create a handle that can
+            be used by other threads to refer to the first thread. The handle is
+            always interpreted as referring to the thread that is using it. A
+            thread can create a "real" handle to itself that can be used by other
+            threads, or inherited by other processes, by specifying the pseudo
+            handle as the source handle in a call to the DuplicateHandle function."
+
+        As a result of this, GetCurrentThread() always returns the same HANDLE value, and
+        we end up never scanning the stacks of other threads because we wrongly think that
+        they are all equal (in identity) to the scanning thread.  This, in turn, results
+        in crashes due to objects that are incorrectly collected.
+
+        The fix is to call DuplicateHandle() to create a HANDLE that we can use.  The
+        MachineThreads::Thread class already accurately tracks the period of time when
+        we need that HANDLE for the VM.  Hence, the life-cycle of the HANDLE can be tied
+        to the life-cycle of the MachineThreads::Thread object for the corresponding thread.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::getCurrentPlatformThread):
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::MachineThreads::Thread::~Thread):
+        (JSC::MachineThreads::Thread::suspend):
+        (JSC::MachineThreads::Thread::resume):
+        (JSC::MachineThreads::Thread::getRegisters):
+
+2015-05-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make the NegZero backward propagated flags of ArithMod stricter
+        https://bugs.webkit.org/show_bug.cgi?id=144897
+
+        Reviewed by Geoffrey Garen.
+
+        The NegZero flags of ArithMod were the same as ArithDiv: both children were
+        marked as needing to handle NegativeZero.
+
+        Lucky for us, ArithMod is quite a bit different than ArithDiv.
+
+        First, the sign of the result is completely independent from
+        the sign of the divisor. A zero on the divisor always produces a NaN.
+        That's great, we can remove the NodeBytecodeNeedsNegZero
+        from the flags propagated to child2.
+
+        Second, the sign of the result is always the same as the sign of
+        the dividend. A dividend of zero produces a zero of same sign
+        unless the divisor is zero (in which case the result is NaN).
+        This is great too: we can just pass the flags we got into
+        ArithMod.
+
+        With those two out of the way, we can make a faster version of ArithRound
+        for Kraken's oscillator. Since we no longer care about negative zero,
+        rounding becomes cast<int32>(value + 0.5). This gives ~3% faster runtime
+        on the benchmark.
+
+        Unfortunatelly, most of the time is spent in FTL and the same optimization
+        does not apply well just yet: rdar://problem/20904149.
+
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        Never add NodeBytecodeNeedsNegZero unless needed by the users of this node.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithRound):
+        Faster Math.round() when negative zero is not important.
+
+        * tests/stress/arith-modulo-node-behaviors.js: Added.
+        (moduloWithNegativeZeroDividend):
+        (moduloWithUnusedNegativeZeroDividend):
+        (moduloWithNegativeZeroDivisor):
+
+2015-05-12  Mark Lam  <mark.lam@apple.com>
+
+        Refactor MachineStackMarker.cpp so that it's easier to reason about MachineThreads::Thread.
+        https://bugs.webkit.org/show_bug.cgi?id=144925
+
+        Reviewed by Michael Saboff.
+
+        Currently, the code in MachineStackMarker.cpp is written as a bunch of functions that
+        operate on the platformThread value in the MachineThreads::Thread struct.  Instead, we
+        can apply better OO encapsulation and convert all these functions into methods of the
+        MachineThreads::Thread struct.
+
+        This will also make it easier to reason about the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=144924 later.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::getCurrentPlatformThread):
+        (JSC::MachineThreads::Thread::createForCurrentThread):
+        (JSC::MachineThreads::Thread::operator!=):
+        (JSC::MachineThreads::Thread::operator==):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThreadIfFound):
+        (JSC::MachineThreads::Thread::suspend):
+        (JSC::MachineThreads::Thread::resume):
+        (JSC::MachineThreads::Thread::getRegisters):
+        (JSC::MachineThreads::Thread::Registers::stackPointer):
+        (JSC::MachineThreads::Thread::freeRegisters):
+        (JSC::MachineThreads::Thread::captureStack):
+        (JSC::MachineThreads::tryCopyOtherThreadStack):
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        (JSC::equalThread): Deleted.
+        (JSC::suspendThread): Deleted.
+        (JSC::resumeThread): Deleted.
+        (JSC::getPlatformThreadRegisters): Deleted.
+        (JSC::otherThreadStackPointer): Deleted.
+        (JSC::freePlatformThreadRegisters): Deleted.
+        (JSC::otherThreadStack): Deleted.
+
+2015-05-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Array.slice should have a fast path like Array.splice
+        https://bugs.webkit.org/show_bug.cgi?id=144901
+
+        Reviewed by Geoffrey Garen.
+
+        Add a fast memcpy path to Array.prototype.slice as done for Array.prototype.splice.
+        In Kraken, this appears to be 30% win on stanford-crypto-ccm and 10% win on stanford-crypto-pbkdf2.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSlice):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::fastSlice): Added.
+        * runtime/JSArray.h:
+
+2015-05-11  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR availability analysis would be more scalable (and correct) if it did more liveness pruning
+        https://bugs.webkit.org/show_bug.cgi?id=143078
+
+        Reviewed by Andreas Kling.
+        
+        In https://bugs.webkit.org/show_bug.cgi?id=144883, we found an example of where liveness
+        pruning is actually necessary. Well, not quite: we just need to prune out keys from the
+        heap availability map where the base node doesn't dominate the point where we are asking
+        for availability. If we don't do this, then eventually the IR gets corrupt because we'll
+        insert PutHints that reference the base node in places where the base node doesn't
+        dominate. But if we're going to do any pruning, then it makes sense to prune by bytecode
+        liveness. This is the strongest possible pruning we can do, and it should be sound. We
+        shouldn't have a node available for a virtual register if that register is live and the
+        node doesn't dominate.
+        
+        Making this work meant reusing the prune-to-liveness algorithm from the FTL backend. So, I
+        abstracted this a bit better. You can now availabilityMap.pruneByLiveness(graph, origin).
+
+        * dfg/DFGAvailabilityMap.cpp:
+        (JSC::DFG::AvailabilityMap::pruneHeap):
+        (JSC::DFG::AvailabilityMap::pruneByLiveness):
+        (JSC::DFG::AvailabilityMap::prune): Deleted.
+        * dfg/DFGAvailabilityMap.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        * tests/stress/liveness-pruning-needed-for-osr-availability.js: Added. This is a proper regression test.
+        * tests/stress/liveness-pruning-needed-for-osr-availability-eager.js: Added. This is the original reduced test case, requires eager-no-cjit to fail prior to this changeset.
+
+2015-05-12  Gabor Loki  <loki@webkit.org>
+
+        Workaround for Cortex-A53 erratum 843419
+        https://bugs.webkit.org/show_bug.cgi?id=144680
+
+        Reviewed by Michael Saboff.
+
+        This patch is about to give simple workaround for Cortex-A53 erratum 843419.
+        It inserts nops after ADRP instruction to avoid wrong address accesses.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::adrp):
+        (JSC::ARM64Assembler::nopCortexA53Fix843419):
+
+2015-05-11  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r184009.
+        https://bugs.webkit.org/show_bug.cgi?id=144900
+
+        Caused crashes on inspector tests (Requested by ap on
+        #webkit).
+
+        Reverted changeset:
+
+        "MapDataImpl::add() shouldn't do the same hash lookup twice."
+        https://bugs.webkit.org/show_bug.cgi?id=144759
+        http://trac.webkit.org/changeset/184009
+
+2015-05-11  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r184123.
+        https://bugs.webkit.org/show_bug.cgi?id=144899
+
+        Seems to have introduced flaky crashes in many JS tests
+        (Requested by rniwa on #webkit).
+
+        Reverted changeset:
+
+        "REGRESSION(r180595): same-callee profiling no longer works"
+        https://bugs.webkit.org/show_bug.cgi?id=144787
+        http://trac.webkit.org/changeset/184123
+
+2015-05-11  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Move Windows build target to Windows 7 (or newer)
+        https://bugs.webkit.org/show_bug.cgi?id=144890
+        <rdar://problem/20707307>
+
+        Reviewed by Anders Carlsson.
+
+        Update linked SDK and minimal Windows level to be compatible with
+        Windows 7 or newer.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
+        * JavaScriptCore.vcxproj/jsc/jscLauncher.vcxproj:
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncher.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapiLauncher.vcxproj:
+        * config.h:
+
+2015-05-08  Filip Pizlo  <fpizlo@apple.com>
+
+        CPS rethreading phase's flush detector flushes way too many SetLocals
+        https://bugs.webkit.org/show_bug.cgi?id=144819
+
+        Reviewed by Geoffrey Garen.
+        
+        After probably unrelated changes, this eventually caused some arguments elimination to stop
+        working because it would cause more SetLocals to turn into PutStacks. But it was a bug for
+        a long time. Basically, we don't want the children of a SetLocal to be flushed. Flushing is
+        meant to only affect the SetLocal itself.
+        
+        This is a speed-up on Octane/earley.
+
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::computeIsFlushed):
+
+2015-05-11  Filip Pizlo  <fpizlo@apple.com>
+
+        gmail and google maps fail to load with eager compilation: Failed to insert inline cache for varargs call (specifically, CallForwardVarargs) because we thought the size would be 250 but it ended up being 262 prior to compaction.
+        https://bugs.webkit.org/show_bug.cgi?id=144854
+
+        Reviewed by Oliver Hunt.
+        
+        This is easy: just lift the threshold. Also remove the need for some duplicate thresholds.
+        It used to be that Construct required less code, but that's not the case for now.
+
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfCallForwardVarargs):
+        (JSC::FTL::sizeOfConstructVarargs):
+        (JSC::FTL::sizeOfConstructForwardVarargs):
+
+2015-05-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r180595): same-callee profiling no longer works
+        https://bugs.webkit.org/show_bug.cgi?id=144787
+
+        Reviewed by Michael Saboff.
+
+        This patch introduces a DFG optimization to use NewObject node when the callee of op_create_this is
+        always the same JSFunction. This condition doesn't hold when the byte code creates multiple
+        JSFunction objects at runtime as in: function y() { return function () {} }; new y(); new y();
+
+        To enable this optimization, LLint and baseline JIT now store the last callee we saw in the newly
+        added fourth operand of op_create_this. We use this JSFunction's structure in DFG after verifying
+        our speculation that the callee is the same. To avoid recompiling the same code for different callee
+        objects in the polymorphic case, the special value of seenMultipleCalleeObjects() is set in
+        LLint and baseline JIT when multiple callees are observed.
+
+        Tests: stress/create-this-with-callee-variants.js
+
+        * bytecode/BytecodeList.json: Increased the number of operands to 5.
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset): op_create_this uses 2nd (constructor) and 4th (callee cache)
+        operands.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Dump the newly added callee cache.
+        (JSC::CodeBlock::finalizeUnconditionally): Clear the callee cache if the callee is no longer alive.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCreateThis): Add the instruction to propertyAccessInstructions so that
+        we can clear the callee cache in CodeBlock::finalizeUnconditionally. Also initialize the newly added
+        operand.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Implement the optimization. Speculate the actual callee to
+        match the cache. Use the cached callee's structure if the speculation succeeds. Otherwise, OSR exit.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_this): Go to the slow path to update the cache unless it's already marked
+        as seenMultipleCalleeObjects() to indicate the polymorphic behavior.
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_this): Ditto.
+        (JSC::JIT::emitSlow_op_create_this):
+        * llint/LowLevelInterpreter32_64.asm:
+        (_llint_op_create_this): Ditto.
+        * llint/LowLevelInterpreter64.asm:
+        (_llint_op_create_this): Ditto.
+        * runtime/CommonSlowPaths.cpp:
+        (slow_path_create_this): Set the callee cache to the actual callee if it's not set. If the cache has
+        been set to a JSFunction* different from the actual callee, set it to seenMultipleCalleeObjects().
+        * runtime/JSCell.h:
+        (JSC::JSCell::seenMultipleCalleeObjects): Added.
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::unvalidatedGet): Removed the compile guard around it.
+        * tests/stress/create-this-with-callee-variants.js: Added.
+
+2015-05-11  Andreas Kling  <akling@apple.com>
+
+        PropertyNameArray should use a Vector when there are few entries.
+        <https://webkit.org/b/144874>
+
+        Reviewed by Geoffrey Garen.
+
+        Bring back an optimization that was lost in the for-in refactoring.
+        PropertyNameArray now holds a Vector<AtomicStringImpl*> until there are
+        enough (20) entries to justify converting to a HashSet for contains().
+
+        Also inlined the code while we're here, since it has so few clients and
+        the call overhead adds up.
+
+        ~5% progression on Kraken/json-stringify-tinderbox.
+
+        * runtime/PropertyNameArray.cpp: Removed.
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::canAddKnownUniqueForStructure):
+        (JSC::PropertyNameArray::add):
+        (JSC::PropertyNameArray::addKnownUnique):
+
+2015-05-11  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: REGRESSION (r175203): No profile information is shown in Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=144808
+
+        Reviewed by Darin Adler.
+
+        Since a profile can be started after a timeline recording has already begun, we can't assume a zero start time.
+        The start time for the root node's call entry should be based on the stopwatch used by the ProfileGenerator.
+
+        * profiler/Profile.cpp:
+        (JSC::Profile::create):
+        (JSC::Profile::Profile):
+        * profiler/Profile.h:
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::AddParentForConsoleStartFunctor::operator()):
+
+2015-05-11  Basile Clement  <basile_clement@apple.com>
+
+        Unreviewed, remove unintended change.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2015-05-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it easy to enable eager/non-concurrent JIT compilation
+        https://bugs.webkit.org/show_bug.cgi?id=144877
+
+        Reviewed by Michael Saboff.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2015-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        We shouldn't promote LoadVarargs to a sequence of GetStacks and PutStacks if doing so would exceed the LoadVarargs' limit
+        https://bugs.webkit.org/show_bug.cgi?id=144851
+
+        Reviewed by Michael Saboff.
+        
+        LoadVarargs loads arguments from some object and puts them on the stack. The region of
+        stack is controlled by a bunch of meta-data, including InlineCallFrame. InlineCallFrame
+        shouldn't really be edited after ByteCodeParser, so we cannot convert LoadVarargs to
+        something that uses more stack than the LoadVarargs wanted to.
+        
+        This check was missing in the ArgumentsEliminationPhase's LoadVarargs->GetStack+PutStack
+        promoter. This is an important promotion rule for performance, and in cases where we are
+        compiling truly hot code, the LoadVarargs limit will be at least as big as the length of
+        the phantom arguments array that this phase sees. The LoadVarargs limit is based on
+        profiling and the phantom arguments array is a proof; in most cases the profiling is more
+        conservative.
+        
+        But, you could write some crazy code where the statically obvious arguments array value is
+        bigger than what the profiling would have told you. When this happens, this promotion
+        effectively removes a bounds check. This either results in us clobbering a bunch of stack,
+        or it means that we never initialize a region of the stack that a later operation will read
+        (the uninitialization happens because PutStackSinkingPhase removes PutStacks that appear
+        unnecessary, and a GetMyArgumentByVal will claim not to use the region of the stack outside
+        the original LoadVarargs limit).
+        
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * tests/stress/load-varargs-elimination-bounds-check-barely.js: Added.
+        (foo):
+        (bar):
+        (baz):
+        * tests/stress/load-varargs-elimination-bounds-check.js: Added.
+        (foo):
+        (bar):
+        (baz):
+
+2015-05-11  Andreas Kling  <akling@apple.com>
+
+        JSON.stringify shouldn't use generic get() to access Array.length
+        <https://webkit.org/b/144847>
+
+        Reviewed by Geoffrey Garen.
+
+        If the value being serialized is a JSArray object, we can downcast and call its
+        length() directly instead of doing a generic property lookup.
+
+        0.5% progression on Kraken/json-stringify-tinderbox.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+
+2015-05-10  Andreas Kling  <akling@apple.com>
+
+        Remove unnecessary AtomicStringImpl* hash specification in PropertyNameArray.
+
+        Follow up to r184050 suggested by Darin.
+
+        * runtime/PropertyNameArray.h:
+
+2015-05-10  Andreas Kling  <akling@apple.com>
+
+        Remove unused things from PropertyNameArray.
+        <https://webkit.org/b/144834>
+
+        Reviewed by Filip Pizlo.
+
+        PropertyNameArray had a bunch of bells and whistles added to it when for-in iteration
+        was refactored and optimized last year. Then more refactoring happened and this class
+        doesn't need to ring and toot anymore.
+
+        The RefCountedIdentifierSet class disappears since the JSPropertyNameEnumerator wasn't
+        actually using it for anything and we were just wasting time creating these.
+
+        Also made the member functions take AtomicStringImpl* instead of plain StringImpl*.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::create):
+        (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
+        * runtime/JSPropertyNameEnumerator.h:
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        (JSC::PropertyNameArray::setPreviouslyEnumeratedProperties): Deleted.
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::add):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::canAddKnownUniqueForStructure):
+        (JSC::RefCountedIdentifierSet::contains): Deleted.
+        (JSC::RefCountedIdentifierSet::size): Deleted.
+        (JSC::RefCountedIdentifierSet::add): Deleted.
+        (JSC::PropertyNameArray::identifierSet): Deleted.
+        (JSC::PropertyNameArray::numCacheableSlots): Deleted.
+        (JSC::PropertyNameArray::setNumCacheableSlotsForObject): Deleted.
+        (JSC::PropertyNameArray::setBaseObject): Deleted.
+        (JSC::PropertyNameArray::setPreviouslyEnumeratedLength): Deleted.
+
+2015-05-09  Yoav Weiss  <yoav@yoav.ws>
+
+        Remove the PICTURE_SIZES build flag
+        https://bugs.webkit.org/show_bug.cgi?id=144679
+
+        Reviewed by Benjamin Poulain.
+
+        Removed the PICTURE_SIZES build time flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-05-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Extend the SaneChain optimization to Contiguous arrays
+        https://bugs.webkit.org/show_bug.cgi?id=144664
+
+        Reviewed by Mark Lam.
+        
+        Previously if you loaded from a hole, you'd either have to take slow path for the array
+        load (which means C++ calls and prototype chain walks) or you'd exit (if you hadn't
+        gathered the necessary profiling yet). But that's unnecessary if we know that the
+        prototype chain is sane - i.e. has no indexed properties. Then we can just return
+        Undefined for the hole.
+        
+        Making this change requires setting more watchpoints on the array prototype chain. But
+        that hit a horrible bug: ArrayPrototype still uses the static lookup tables and builds
+        itself up lazily. This means that this increased the number of recompilations we'd get
+        due to the array prototype chain being built up.
+        
+        So, this change also removes the laziness and static tables from ArrayPrototype.
+        
+        But to make that change, I also had to add a helper for eagerly building up a prototype
+        that has builtin functions.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * dfg/DFGArrayMode.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::ArrayPrototype::getOwnPropertySlot): Deleted.
+        * runtime/ArrayPrototype.h:
+        * runtime/JSObject.h:
+
+2015-05-08  Michael Saboff  <msaboff@apple.com>
+
+        Creating a large MarkedBlock sometimes results in more than one cell in the block
+        https://bugs.webkit.org/show_bug.cgi?id=144815
+
+        Reviewed by Mark Lam.
+
+        Large MarkedBlocks should have one and only one cell.  Changed the calculation of
+        m_endAtom for large blocks to use the location of the first cell + 1.  This
+        assures that large blocks only have one cell.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+
+2015-05-08  Oliver Hunt  <oliver@apple.com>
+
+        MapDataImpl::add() shouldn't do the same hash lookup twice.
+        https://bugs.webkit.org/show_bug.cgi?id=144759
+
+        Reviewed by Gavin Barraclough.
+
+        We don't actually need to do a double lookup here, all we need to
+        do is update the index to point to the correct m_size.
+
+        * runtime/MapDataInlines.h:
+        (JSC::JSIterator>::add):
+
+2015-05-08  Andreas Kling  <akling@apple.com>
+
+        Micro-optimize JSON serialization of string primitives.
+        <https://webkit.org/b/144800>
+
+        Reviewed by Sam Weinig.
+
+        Don't use the out-of-line JSValue::getString() to grab at string primitives
+        in serialization. Just check if it's a JSString and then downcast to grab at
+        the WTF::String inside.
+
+        2% progression on Kraken/json-stringify-tinderbox.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+
+2015-05-08  Andreas Kling  <akling@apple.com>
+
+        Optimize serialization of quoted JSON strings.
+        <https://webkit.org/b/144754>
+
+        Reviewed by Darin Adler.
+
+        Optimized the serialization of quoted strings into JSON by moving the logic into
+        StringBuilder so it can make smarter decisions about buffering.
+
+        12% progression on Kraken/json-stringify-tinderbox (on my Mac Pro.)
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ObjectPatternNode::toString): Use the new StringBuilder API.
+
+        * runtime/JSONObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::appendStringToStringBuilder): Deleted.
+        (JSC::appendQuotedJSONStringToBuilder): Deleted.
+        (JSC::Stringifier::appendQuotedString): Deleted.
+        (JSC::Stringifier::appendStringifiedValue): Moved the bulk of this logic
+        to StringBuilder and call that from here.
+
+2015-05-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r183961.
+        https://bugs.webkit.org/show_bug.cgi?id=144784
+
+        Broke js/dom/JSON-stringify.html (Requested by kling on
+        #webkit).
+
+        Reverted changeset:
+
+        "Optimize serialization of quoted JSON strings."
+        https://bugs.webkit.org/show_bug.cgi?id=144754
+        http://trac.webkit.org/changeset/183961
+
+2015-05-07  Filip Pizlo  <fpizlo@apple.com>
+
+        GC has trouble with pathologically large array allocations
+        https://bugs.webkit.org/show_bug.cgi?id=144609
+
+        Reviewed by Geoffrey Garen.
+
+        The bug was that SlotVisitor::copyLater() would return early for oversize blocks (right
+        after pinning them), and would skip the accounting. The GC calculates the size of the heap
+        in tandem with the scan to save time, and that accounting was part of how the GC would
+        know how big the heap was. The GC would then think that oversize copied blocks use no
+        memory, and would then mess up its scheduling of the next GC.
+        
+        Fixing this bug is harder than it seems. When running an eden GC, we figure out the heap
+        size by summing the size from the last collection and the size by walking the eden heap.
+        But this breaks when we eagerly delete objects that the last collection touched. We can do
+        that in one corner case: copied block reallocation. The old block will be deleted from old
+        space during the realloc and a new block will be allocated in new space. In order for the
+        GC to know that the size of old space actually shrank, we need a field to tell us how much
+        such shrinkage could occur. Since this is a very dirty corner case and it only works for
+        very particular reasons arising from the special properties of copied space (single owner,
+        and the realloc is used in places where the compiler already knows that it cannot register
+        allocate a pointer to the old block), I opted for an equally dirty shrinkage counter
+        devoted just to this case. It's called bytesRemovedFromOldSpaceDueToReallocation.
+        
+        To test this, I needed to add an Option to force a particular RAM size in the GC. This
+        allows us to write tests that assert that the GC heap size is some value X, without
+        worrying about machine-to-machine variations due to GC heuristics changing based on RAM
+        size.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::CopiedSpace): Initialize the dirty shrinkage counter.
+        (JSC::CopiedSpace::tryReallocateOversize): Bump the dirty shrinkage counter.
+        * heap/CopiedSpace.h:
+        (JSC::CopiedSpace::takeBytesRemovedFromOldSpaceDueToReallocation): Swap out the counter. Used by the GC when it does its accounting.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap): Allow the user to force the RAM size.
+        (JSC::Heap::updateObjectCounts): Use the dirty shrinkage counter to good effect. Also, make this code less confusing.
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater): The early return for isOversize() was the bug. We still need to report these bytes as live. Otherwise the GC doesn't know that it owns this memory.
+        * jsc.cpp: Add size measuring hooks to write the largeish test.
+        (GlobalObject::finishCreation):
+        (functionGCAndSweep):
+        (functionFullGC):
+        (functionEdenGC):
+        (functionHeapSize):
+        * runtime/Options.h:
+        * tests/stress/new-array-storage-array-with-size.js: Fix this so that it actually allocates ArrayStorage arrays and tests the thing it was supposed to test.
+        * tests/stress/new-largeish-contiguous-array-with-size.js: Added. This tests what the other test accidentally started testing, but does so without running your system out of memory.
+        (foo):
+        (test):
+
+2015-05-07  Saam Barati  <saambarati1@gmail.com>
+
+        Global functions should be initialized as JSFunctions in byte code
+        https://bugs.webkit.org/show_bug.cgi?id=144178
+
+        Reviewed by Geoffrey Garen.
+
+        This patch makes the initialization of global functions more explicit by
+        moving initialization into bytecode. It also prepares JSC for having ES6
+        style lexical scoping because initializing global functions in bytecode
+        easily allows global functions to be initialized with the proper scope that
+        will have access to global lexical variables. Global lexical variables
+        should be visible to global functions but don't live on the global object.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedProgramCodeBlock::visitChildren):
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        * runtime/JSGlobalObject.h:
+
+2015-05-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        Fix the x86 32bits build
+
+        * assembler/X86Assembler.h:
+
+2015-05-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add basic DFG/FTL support for Math.round
+        https://bugs.webkit.org/show_bug.cgi?id=144725
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds two optimizations targeting Math.round():
+        -Add a DFGNode ArithRound corresponding to the intrinsic RoundIntrinsic.
+        -Change the MacroAssembler to be stricter on how we fail to convert a double
+         to ingeter. Previously, any number valued zero would fail, now we only
+         fail for -0.
+
+        Since ArithRound speculate it produces int32, the MacroAssembler assembler
+        part became necessary because zero is a pretty common output of Math.round()
+        and we would OSR exit a lot (and eventually recompile for doubles).
+
+        The implementation itself of the inline Math.round() is exactly the same
+        as the C function that exists for Math.round(). We can very likely do better
+        but it is a good start known to be valid and inlining alone alread provides
+        significant speedups.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movmskpd_rr):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        When we have a zero, get the sign bit out of the double and check if is one.
+
+        I'll look into doing the same improvement for ARM.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::typeOfDoubleRounding):
+        (JSC::typeOfDoubleFRound): Deleted.
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::roundShouldSpeculateInt32):
+        (JSC::DFG::Graph::negateShouldSpeculateMachineInt): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasArithMode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithRound):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::convertDoubleToInt32):
+        (JSC::FTL::LowerDFGToLLVM::compileDoubleAsInt32):
+        (JSC::FTL::LowerDFGToLLVM::compileArithRound):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::ceil64):
+        * jit/ThunkGenerators.cpp:
+        * runtime/MathCommon.cpp:
+        * runtime/MathCommon.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRound):
+        * tests/stress/math-round-basics.js: Added.
+        (mathRoundOnIntegers):
+        (mathRoundOnDoubles):
+        (mathRoundOnBooleans):
+        (uselessMathRound):
+        (mathRoundWithOverflow):
+        (mathRoundConsumedAsDouble):
+        (mathRoundDoesNotCareAboutMinusZero):
+        (mathRoundNoArguments):
+        (mathRoundTooManyArguments):
+        (testMathRoundOnConstants):
+        (mathRoundStructTransition):
+        (Math.round):
+
+2015-05-07  Saam Barati  <saambarati1@gmail.com>
+
+        exceptionFuzz tests should explicitly initialize the exceptionFuzz boolean in JavaScript code through a function in jsc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=144753
+
+        Reviewed by Mark Lam.
+
+        This allows the BytecodeGenerator to freely emit startup code that "may"
+        throw exceptions without worrying that this startup code will trigger
+        the exceptionFuzz exception. The exceptionFuzz counter will only begin
+        ticking when the 'enableExceptionFuzz' function is explicitly called in 
+        the exceptionFuzz tests.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionEnableExceptionFuzz):
+        * tests/exceptionFuzz/3d-cube.js:
+        * tests/exceptionFuzz/date-format-xparb.js:
+        * tests/exceptionFuzz/earley-boyer.js:
+
+2015-05-07  Andreas Kling  <akling@apple.com>
+
+        Optimize serialization of quoted JSON strings.
+        <https://webkit.org/b/144754>
+
+        Reviewed by Darin Adler.
+
+        Optimized the serialization of quoted strings into JSON by moving the logic into
+        StringBuilder so it can make smarter decisions about buffering.
+
+        12% progression on Kraken/json-stringify-tinderbox (on my Mac Pro.)
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ObjectPatternNode::toString): Use the new StringBuilder API.
+
+        * runtime/JSONObject.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::appendStringToStringBuilder): Deleted.
+        (JSC::appendQuotedJSONStringToBuilder): Deleted.
+        (JSC::Stringifier::appendQuotedString): Deleted.
+        (JSC::Stringifier::appendStringifiedValue): Moved the bulk of this logic
+        to StringBuilder and call that from here.
+
+2015-05-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        FunctionCallBracketNode should store the base value to the temporary when subscript has assignment
+        https://bugs.webkit.org/show_bug.cgi?id=144678
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, FunctionCallBracketNode directly use the RegisterID returned by emitNode.
+        But if the base part is the local register and the subscript part has assignment to it, the base result is accidentally rewritten.
+
+        function t() { var ok = {null: function () { } }; ok[ok = null](); }
+        t();  // Should not throw error.
+
+        This patch takes care about `subscriptHasAssignment`.
+        By using `emitNodeForLeftHandSide`, when there's assignment to local variables in RHS,
+        it correctly moves the LHS value to a temporary register.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        * parser/NodeConstructors.h:
+        (JSC::FunctionCallBracketNode::FunctionCallBracketNode):
+        * parser/Nodes.h:
+        * tests/stress/assignment-in-function-call-bracket-node.js: Added.
+        (shouldBe):
+        (shouldBe.):
+
+2015-05-07  Basile Clement  <basile_clement@apple.com>
+
+        Unreviewed, add missing braces on a single-line if that got expanded in r183939
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+
+2015-05-05  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Revert "Introducing the Platform Abstraction Layer (PAL)"
+        https://bugs.webkit.org/show_bug.cgi?id=144751
+
+        Unreviewed.
+
+        PAL should be a new target inside WebCore, rather than a top-level folder.
+
+        * Configurations/FeatureDefines.xcconfig: Updated
+
+2015-05-07  Basile Clement  <basile_clement@apple.com>
+
+        Dumping OSR ExitValue should expand materializations only once
+        https://bugs.webkit.org/show_bug.cgi?id=144694
+
+        Reviewed by Filip Pizlo.
+
+        Currently, dumping OSR exit values will print the full materialization
+        information each time it is encountered. We change it to print only a
+        brief description (only the materialization's address), and print the
+        whole set of materializations later on.
+
+        This makes the dump less confusing (less likely to think that two
+        instances of the same materialization are different), and will be a
+        necessary change if/when we support materialization cycles.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+
+2015-05-07  Andreas Kling  <akling@apple.com>
+
+        Worker threads leak WeakBlocks (as seen on leaks bot)
+        <https://webkit.org/b/144721>
+        <rdar://problem/20848288>
+
+        Reviewed by Darin Adler.
+
+        Nuke any remaining empty WeakBlocks when the Heap is being torn down.
+        Trying to peek into these blocks after the VM is dead would be a bug anyway.
+
+        This fixes a ~750 KB leak seen on the leaks bot.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::~Heap):
+
+2015-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Don't branch when accessing the callee
+        https://bugs.webkit.org/show_bug.cgi?id=144645
+
+        Reviewed by Michael Saboff.
+
+        The branch was added in <http://trac.webkit.org/changeset/81040> without
+        explanation.
+
+        kling found it to be a performance problem. See <https://webkit.org/b/144586>.
+
+        Our theory of access to Registers is that it's up to the client to access
+        them in the right way. So, let's do that.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callee):
+        (JSC::ExecState::setCallee): Call the field object instead of function
+        because nothing guarantees that it's a function.
+        * interpreter/ProtoCallFrame.h:
+        (JSC::ProtoCallFrame::callee):
+        (JSC::ProtoCallFrame::setCallee):
+        * interpreter/Register.h:
+        * runtime/JSObject.h:
+        (JSC::Register::object): Just do a cast like our other accessors do.
+        (JSC::Register::operator=):
+        (JSC::Register::function): Deleted.
+        (JSC::Register::withCallee): Deleted.
+
+2015-05-07  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/19317140> [Xcode] Remove usage of AspenFamily.xcconfig in Source/
+        https://bugs.webkit.org/show_bug.cgi?id=144727
+
+        Reviewed by Darin Adler.
+
+        * Configurations/Base.xcconfig: Don’t include AspenFamily.xcconfig, and define
+        INSTALL_PATH_PREFIX and LD_DYLIB_INSTALL_NAME for the iOS 8.x Simulator.
+
+2015-05-07  Andreas Kling  <akling@apple.com>
+
+        Special-case Int32 values in JSON.stringify().
+        <https://webkit.org/b/144731>
+
+        Reviewed by Michael Saboff.
+
+        Add a fast path for serializing Int32 values to JSON. This is far faster than dragging
+        simple integers through the full-blown dtoa() machinery.
+
+        ~50% speedup on Kraken/json-stringify-tinderbox.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+
+2015-05-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        ToT WebKit crashes while loading ES6 compatibility table
+        https://bugs.webkit.org/show_bug.cgi?id=144726
+
+        Reviewed by Filip Pizlo.
+
+        The bug was caused by parseClass superfluously avoiding to build up the string after seeing {.
+
+        Always build the identifier here as it could be a method name.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+
+2015-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Sane chain and string watchpoints should be set in FixupPhase or the backend rather than WatchpointCollectionPhase
+        https://bugs.webkit.org/show_bug.cgi?id=144665
+
+        Reviewed by Michael Saboff.
+        
+        This is a step towards getting rid of WatchpointCollectionPhase. It's also a step towards
+        extending SaneChain to all indexing shapes.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Set the watchpoints here so that we don't need a case in WatchpointCollectionPhase.
+        (JSC::DFG::FixupPhase::checkArray): Clarify the need for checking the structure. We often forget why we do this instead of always using CheckArray.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString): Set the watchpoints here so that we don't need a case in WatchpointCollectionPhase.
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle): Remove some code.
+        (JSC::DFG::WatchpointCollectionPhase::handleStringGetByVal): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharAt): Set the watchpoints here so that we don't need a case in WatchpointCollectionPhase.
+
+2015-04-02  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Introducing the Platform Abstraction Layer (PAL)
+        https://bugs.webkit.org/show_bug.cgi?id=143358
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig: Updated
+
+2015-05-06  Andreas Kling  <akling@apple.com>
+
+        Don't allocate a StringImpl for every Number JSValue in JSON.stringify().
+        <https://webkit.org/b/144676>
+
+        Reviewed by Darin Adler.
+
+        We were creating a new String for every number JSValue passing through the JSON stringifier.
+        These StringImpl allocations were dominating one of the Kraken JSON benchmarks.
+        Optimize this by using StringBuilder::appendECMAScriptNumber() which uses a stack buffer
+        for the conversion instead.
+
+        13% progression on Kraken/json-stringify-tinderbox.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+
+2015-05-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r183847.
+        https://bugs.webkit.org/show_bug.cgi?id=144691
+
+        Caused many assertion failures (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "GC has trouble with pathologically large array allocations"
+        https://bugs.webkit.org/show_bug.cgi?id=144609
+        http://trac.webkit.org/changeset/183847
+
+2015-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        PutGlobalVar shouldn't have an unconditional store barrier
+        https://bugs.webkit.org/show_bug.cgi?id=133104
+
+        Reviewed by Benjamin Poulain.
+        
+        We don't need a store barrier on PutGlobalVar if the value being stored can be
+        speculated to not be a cell.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2015-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        CopiedBlock::reportLiveBytes() should be totally cool with oversize blocks
+        https://bugs.webkit.org/show_bug.cgi?id=144667
+
+        Reviewed by Andreas Kling.
+        
+        We are now calling this method for oversize blocks. It had an assertion that indirectly
+        implied that the block is not oversize, because it was claiming that the number of live
+        bytes should be smaller than the non-oversize-block size.
+
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+
+2015-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        GC has trouble with pathologically large array allocations
+        https://bugs.webkit.org/show_bug.cgi?id=144609
+
+        Reviewed by Mark Lam.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::updateObjectCounts): Make this code less confusing.
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::copyLater): The early return for isOversize() was the bug. We still need to report these bytes as live. Otherwise the GC doesn't know that it owns this memory.
+        * jsc.cpp: Add size measuring hooks to write the largeish test.
+        (GlobalObject::finishCreation):
+        (functionGCAndSweep):
+        (functionFullGC):
+        (functionEdenGC):
+        (functionHeapSize):
+        * tests/stress/new-array-storage-array-with-size.js: Fix this so that it actually allocates ArrayStorage arrays and tests the thing it was supposed to test.
+        * tests/stress/new-largeish-contiguous-array-with-size.js: Added. This tests what the other test accidentally started testing, but does so without running your system out of memory.
+        (foo):
+        (test):
+
+2015-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL SwitchString slow case creates duplicate switch cases
+        https://bugs.webkit.org/show_bug.cgi?id=144634
+
+        Reviewed by Geoffrey Garen.
+        
+        The problem of duplicate switches is sufficiently annoying that I fixed the issue and also
+        added mostly-debug-only asserts to catch such issues earlier.
+
+        * bytecode/CallVariant.cpp:
+        (JSC::variantListWithVariant): Assertion to prevent similar bugs.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::switchStringRecurse): Assertion to prevent similar bugs.
+        (JSC::FTL::LowerDFGToLLVM::switchStringSlow): This is the bug.
+        * jit/BinarySwitch.cpp:
+        (JSC::BinarySwitch::BinarySwitch): Assertion to prevent similar bugs.
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall): Assertion to prevent similar bugs.
+        * tests/stress/ftl-switch-string-slow-duplicate-cases.js: Added. This tests the FTL SwitchString bug. It was previously crashing every time.
+        (foo):
+        (cat):
+
+2015-05-05  Basile Clement  <basile_clement@apple.com>
+
+        Fix debug builds after r183812
+        https://bugs.webkit.org/show_bug.cgi?id=144300
+
+        Rubber stamped by Andreas Kling and Filip Pizlo.
+
+        hasObjectMaterializationData() didn't treat MaterializeCreateActivation
+        as having materialization data, which was causing an assertion failure when
+        sinking CreateActivations on debug builds.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasObjectMaterializationData):
+
+2015-05-04  Basile Clement  <basile_clement@apple.com>
+
+        Allow CreateActivation sinking
+        https://bugs.webkit.org/show_bug.cgi?id=144300
+
+        Reviewed by Filip Pizlo.
+
+        This pursues the work started in
+        https://bugs.webkit.org/show_bug.cgi?id=144016 to expand the set of
+        allocations we are able to sink by allowing sinking of CreateActivation
+        node.
+
+        This is achieved by following closely the way NewObject is currently
+        sunk: we add a new PhantomCreateActivation node to record the initial
+        position of the CreateActivation node, new ClosureVarPLoc promoted heap
+        locations to keep track of the variables put in the activation, and a
+        new MaterializeCreateActivation node to allocate and populate the sunk
+        activation.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToPutClosureVarHint):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomCreateActivation):
+        (JSC::DFG::Node::isActivationAllocation):
+        (JSC::DFG::Node::isPhantomActivationAllocation):
+        (JSC::DFG::Node::isPhantomAllocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        (JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize):
+        (JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPromotedHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileMaterializeCreateActivation):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * tests/stress/activation-sink-osrexit.js: Added.
+        (bar):
+        (foo.set result):
+        * tests/stress/activation-sink.js: Added.
+        (bar):
+
+2015-05-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix stale comment.
+
+        * tests/mozilla/js1_5/Array/regress-101964.js:
+
+2015-05-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Large array shouldn't be slow
+        https://bugs.webkit.org/show_bug.cgi?id=144617
+
+        Rubber stamped by Mark Lam.
+
+        * tests/mozilla/js1_5/Array/regress-101964.js: 500ms isn't enough in debug mode. We don't care how long this takes so long as we run it to completion. I've raised the limit much higher.
+
+2015-05-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Large array shouldn't be slow
+        https://bugs.webkit.org/show_bug.cgi?id=144617
+
+        Rubber stamped by Mark Lam.
+
+        * tests/mozilla/js1_5/Array/regress-101964.js: Mozilla may have cared about this being fast a decade ago (or more), but we don't care. We've consistently found that an array implementation that punishes this case to get speed on common-case array accesses is better. This should fix some test failures on the bots.
+
+2015-05-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r183789.
+        https://bugs.webkit.org/show_bug.cgi?id=144620
+
+        Causing flakiness on exceptionFuzz tests locally on 32-bit
+        build (Requested by saamyjoon on #webkit).
+
+        Reverted changeset:
+
+        "Global functions should be initialized as JSFunctions in byte
+        code"
+        https://bugs.webkit.org/show_bug.cgi?id=144178
+        http://trac.webkit.org/changeset/183789
+
+2015-05-04  Saam Barati  <saambarati1@gmail.com>
+
+        Global functions should be initialized as JSFunctions in byte code
+        https://bugs.webkit.org/show_bug.cgi?id=144178
+
+        Reviewed by Geoffrey Garen.
+
+        This patch makes the initialization of global functions more explicit by
+        moving initialization into bytecode. It also prepares JSC for having ES6
+        style lexical scoping because initializing global functions in bytecode
+        easily allows global functions to be initialized with the proper scope that
+        will have access to global lexical variables. Global lexical variables
+        should be visible to global functions but don't live on the global object.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedProgramCodeBlock::visitChildren):
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        * runtime/JSGlobalObject.h:
+
+2015-05-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Large array shouldn't be slow
+        https://bugs.webkit.org/show_bug.cgi?id=144617
+
+        Reviewed by Geoffrey Garen.
+        
+        Decouple MIN_SPARSE_ARRAY_INDEX, which is the threshold for storing to the sparse map when
+        you're already using ArrayStorage mode, from the minimul array length required to use
+        ArrayStorage in a new Array(length) allocation.
+        
+        Lift the array allocation length threshold to something very high. If this works, we'll
+        probably remove that threshold entirely.
+        
+        This is a 27% speed-up on JetStream/hash-map. Because run-jsc-benchmarks still can't run
+        JetStream as a discrete suite, this adds hash-map to LongSpider so that we run it somewhere
+        for now.
+
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
+        * runtime/ArrayConventions.h:
+        * runtime/JSArray.h:
+        (JSC::JSArray::create):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray):
+        * tests/stress/new-array-storage-array-with-size.js: Skip this test until we fix https://bugs.webkit.org/show_bug.cgi?id=144609.
+
+2015-05-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Add backed intrinsics to private functions exposed with private symbols in global object
+        https://bugs.webkit.org/show_bug.cgi?id=144545
+
+        Reviewed by Darin Adler.
+
+        Math.abs and Math.floor have ASM intrinsics And it is further accelerated in DFG/FTL layers.
+        This patch adds intrinsic to private functions exposed with private symbols in global object,
+        @floor and @abs.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalPrivateFuncAbs): Deleted.
+        (JSC::globalPrivateFuncFloor): Deleted.
+        * runtime/MathObject.cpp:
+        * runtime/MathObject.h:
+        * tests/stress/array-from-abs-and-floor.js: Added.
+        (target1):
+        (target2):
+        (target3):
+
+2015-05-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] ARM related build system cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=144566
+
+        Reviewed by Darin Adler.
+
+        * CMakeLists.txt:
+
+2015-05-04  Andreas Kling  <akling@apple.com>
+
+        Optimize WeakBlock's "reap" and "visit" operations.
+        <https://webkit.org/b/144585>
+
+        Reviewed by Geoffrey Garen.
+
+        WeakBlock was using Heap::isLive(void*) to determine the liveness of weak pointees.
+        That function was really written with conservative roots marking in mind, and will do a bunch
+        of sanity and bounds checks.
+
+        For weaks, we know that the pointer will have been a valid cell pointer into a block
+        of appropriate cell size, so we can skip a lot of the checks.
+
+        We now keep a pointer to the MarkedBlock in each WeakBlock. That way we no longer have to do
+        MarkedBlock::blockFor() for every single cell when iterating.
+
+        Note that a WeakBlock's MarkedBlock pointer becomes null when we detach a logically empty
+        WeakBlock from its WeakSet and transfer ownership to Heap. At that point, the block will never
+        be pointing to any live cells, and the only operation that will run on the block is sweep().
+
+        Finally, MarkedBlock allows liveness queries in three states: Marked, Retired, and Allocated.
+        In Allocated state, all cells are reported as live. This state will reset to Marked on next GC.
+        This patch uses that knowledge to avoid branching on the MarkedBlock's state for every cell.
+
+        This is a ~3x speedup of visit() and a ~2x speedup of reap() on Dromaeo/dom-modify, netting
+        what looks like a 1% speedup locally.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock): Pass *this to the WeakSet's ctor.
+
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated): Added, stripped-down version of isLive() when the
+        block's state is known to be either Marked or Retired.
+
+        (JSC::MarkedBlock::isAllocated): Added, tells WeakBlock it's okay to skip reap/visit since isLive()
+        would report that all cells are live anyway.
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::WeakBlock): Stash a MarkedBlock* on each WeakBlock.
+
+        (JSC::WeakBlock::visit):
+        (JSC::WeakBlock::reap): Optimized these two to avoid a bunch of pointer arithmetic and branches.
+
+        * heap/WeakBlock.h:
+        (JSC::WeakBlock::disconnectMarkedBlock): Added.
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::sweep): Call the above when removing a WeakBlock from WeakSet and transferring
+        ownership to Heap until it can die peacefully.
+
+        (JSC::WeakSet::addAllocator):
+        * heap/WeakSet.h:
+        (JSC::WeakSet::WeakSet): Give WeakSet a MarkedBlock& for passing on to WeakBlocks.
+
+2015-05-04  Basile Clement  <basile_clement@apple.com>
+
+        Allocation sinking is prohibiting the creation of phis between a Phantom object and its materialization
+        https://bugs.webkit.org/show_bug.cgi?id=144587
+
+        Rubber stamped by Filip Pizlo.
+
+        When sinking object allocations, we ensure in
+        determineMaterializationPoints that whenever an allocation is
+        materialized on a path to a block, it is materialized in all such
+        paths. Thus when running the SSA calculator to place Phis in
+        placeMaterializationPoints, we can't encounter a situation where some
+        Upsilons are referring to a materialization while others are referring
+        to the phantom object.
+
+        This replaces the code that was adding a materialization late in
+        placeMaterializationPoints to handle that case by an assertion that it
+        does not happen, which will make
+        https://bugs.webkit.org/show_bug.cgi?id=143073 easier to implement.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
+
+2015-05-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Extending undefined in class syntax should throw a TypeError
+        https://bugs.webkit.org/show_bug.cgi?id=144284
+
+        Reviewed by Darin Adler.
+
+        The bug was caused by op_eq_null evaluating to true when compared to undefined.
+        Explicitly check op_eq_undefined first to detect the case where we're extending undefined.
+
+        We also had bogus test cases checked in class-syntax-extends.html. This patch also fixes them.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ClassExprNode::emitBytecode):
+
+2015-05-04  Ryosuke Niwa  <rniwa@webkit.org>
+
+        new super should be a syntax error
+        https://bugs.webkit.org/show_bug.cgi?id=144282
+
+        Reviewed by Joseph Pecoraro.
+
+        Disallow "new super" as ES6 spec doesn't allow this.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseMemberExpression):
+
+2015-05-04  Saam Barati  <saambarati1@gmail.com>
+
+        JSCallbackObject does not maintain symmetry between accesses for getOwnPropertySlot and put
+        https://bugs.webkit.org/show_bug.cgi?id=144265
+
+        Reviewed by Geoffrey Garen.
+
+        JSCallbackObject will defer to a parent's implementation of getOwnPropertySlot
+        for a static function if the parent has that property slot. JSCallbackObject::put 
+        did not maintain this symmetry of also calling ::put on the parent if the parent 
+        has the property. We should ensure that this symmetry exists.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::put):
+        * API/tests/testapi.c:
+        * API/tests/testapi.js:
+        (globalStaticFunction2):
+        (this.globalStaticFunction2):
+        (iAmNotAStaticFunction):
+        (this.iAmNotAStaticFunction):
+
+2015-05-04  Andreas Kling  <akling@apple.com>
+
+        Make ExecState::vm() branchless in release builds.
+        <https://webkit.org/b/144586>
+
+        Reviewed by Geoffrey Garen.
+
+        Avoid null checking the ExecState's callee() before getting the
+        VM from it. The code was already dereferencing it anyway, since we
+        know it's not gonna be null.
+
+        * runtime/JSCellInlines.h:
+        (JSC::ExecState::vm):
+
+2015-05-04  Basile Clement  <basile_clement@apple.com>
+
+        Object allocation not sinking properly through CheckStructure
+        https://bugs.webkit.org/show_bug.cgi?id=144465
+
+        Reviewed by Filip Pizlo.
+
+        Currently, sinking an allocation through a CheckStructure will
+        completely ignore all structure checking, which is obviously wrong.
+
+        A CheckStructureImmediate node type was present for that purpose, but
+        the CheckStructures were not properly replaced.  This ensures that
+        CheckStructure nodes are replaced by CheckStructureImmediate nodes when
+        sunk through, and that structure checking happens correctly.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToCheckStructureImmediate): Added.
+        (JSC::DFG::Node::hasStructureSet):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckStructureImmediate):
+        (JSC::FTL::LowerDFGToLLVM::checkStructure):
+        * tests/stress/sink_checkstructure.js: Added.
+        (foo):
+
+2015-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION(r183570): jslib-traverse-jquery is 22% slower
+        https://bugs.webkit.org/show_bug.cgi?id=144476
+
+        Reviewed by Sam Weinig.
+
+        jslib-traverse-jquery is now 31% faster than its unregressed baseline.
+
+        The jQuery algorithm for sorting DOM nodes is so pathologically slow that,
+        to my knowledge, the topic of how to optimize it is not covered in any
+        literature about sorting.
+
+        On the slowest jQuery sorting test -- prevAll -- our new
+        Array.prototype.sort, compared to its predecessor, performed 12% fewer
+        comparisons and requireed 10X less overhead per comparison. Yet, it was
+        slower.
+
+        It was slower because it inadvertantly increased the average cost of the
+        comparison function by 2X. jQuery uses compareDocumentPosition to compare
+        DOM nodes, and compareDocumentPosition(a, b) is O(N) in the distance
+        required to traverse backwards from b to a. In prevAll, we encounter the
+        worst case for merge sort of compareDocumentPosition: A long list of DOM
+        nodes in mostly reverse order. In this case, merge sort will sequentially
+        compareDocumentPosition(a, b), where a is not reachable backwards from
+        b, and therefore compareDocumentPosition will traverse the whole sibling
+        list.
+
+        The solution is simple enough: Call compareDocumentPosition(b, a) instead.
+
+        This is a pretty silly thing to do, but it is harmless, and jQuery is
+        popular, so let's do it.
+
+        We do not risk suffering the same problem in reverse when sorting a long
+        list of DOM nodes in forward order. (We still have a 37% speedup on the
+        nextAll benchmark.) The reason is that merge sort performs 2X fewer
+        comparisons when the list is already sorted, so we can worry less about
+        the cost of each comparison.
+
+        A fully principled soultion to this problem would probably do something
+        like Python's timsort, which special-cases ordered ranges to perform
+        only O(n) comparisons. But that would contradict our original
+        goal of just having something simple that works.
+
+        Another option is for elements to keep a compareDocumentPosition cache,
+        like a node list cache, which allows you to determine the absolute
+        position of a node using a hash lookup. I will leave this as an exercise
+        for kling.
+
+        * builtins/Array.prototype.js:
+        (sort.merge): Compare in an order that is favorable to a comparator
+        that calls compareDocumentPosition.
+
+2015-05-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Fix generate-js-builtins related incremental build issue
+        https://bugs.webkit.org/show_bug.cgi?id=144094
+
+        Reviewed by Michael Saboff.
+
+        * CMakeLists.txt: Generated JSCBuiltins.<cpp|h> should depend on Source/JavaScriptCore/builtins directory.
+        Pass input directory to generate-js-builtins instead of Source/JavaScriptCore/builtins/*.js.
+        * DerivedSources.make:
+        Pass input directory to generate-js-builtins instead of Source/JavaScriptCore/builtins/*.js.
+        * generate-js-builtins: Accept input files and input directory too.
+
+2015-05-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Make some static data const
+        https://bugs.webkit.org/show_bug.cgi?id=144552
+
+        Reviewed by Andreas Kling.
+        
+        Turn characterSetInfo into const data.
+
+        * yarr/YarrCanonicalizeUCS2.cpp:
+        * yarr/YarrCanonicalizeUCS2.h:
+
+2015-05-01  Filip Pizlo  <fpizlo@apple.com>
+
+        TypeOf should be fast
+        https://bugs.webkit.org/show_bug.cgi?id=144396
+
+        Reviewed by Geoffrey Garen.
+        
+        Adds comprehensive support for fast typeof to the optimizing JITs. Calls into the runtime
+        are only used for very exotic objects - they must have either the MasqueradesAsUndefined or
+        TypeOfShouldCallGetCallData type flags set. All other cases are handled inline.
+        
+        This means optimizing IsObjectOrNull, IsFunction, and TypeOf - all node types that used to
+        rely heavily on C++ calls to fulfill their function.
+        
+        Because TypeOf is now so fast, we no longer need to do any speculations on this node.
+        
+        In the FTL, we take this further by querying AI for each branch in the TypeOf decision tree.
+        This means that if the TypeOf is dominated by any type checks, we will automatically prune
+        out cases that are redundant.
+        
+        This patch anticipates the addition of SwitchTypeOf or something like that. So, the TypeOf
+        code generation is designed to be reusable.
+        
+        This is a speed-up on most typeof benchmarks. But, it is a slow-down on benchmarks that take
+        the exotic call trap hook. That hook is now in a deeper slow path than before.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): TypeOf was pure all along, but we failed to realize this.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIsObjectOrNull):
+        (JSC::DFG::SpeculativeJIT::compileIsFunction):
+        (JSC::DFG::SpeculativeJIT::compileTypeOf):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::blessedBooleanResult):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileIsObjectOrNull):
+        (JSC::FTL::LowerDFGToLLVM::compileIsFunction):
+        (JSC::FTL::LowerDFGToLLVM::compileTypeOf):
+        (JSC::FTL::LowerDFGToLLVM::buildTypeOf): Reusable TypeOf building for the FTL.
+        (JSC::FTL::LowerDFGToLLVM::isExoticForTypeof):
+        * ftl/FTLSwitchCase.h:
+        (JSC::FTL::SwitchCase::SwitchCase):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfNotEqual):
+        (JSC::AssemblyHelpers::branchIfEqual):
+        (JSC::AssemblyHelpers::branchIfNumber):
+        (JSC::AssemblyHelpers::branchIfNotNumber):
+        (JSC::AssemblyHelpers::branchIfBoolean):
+        (JSC::AssemblyHelpers::branchIfNotBoolean):
+        (JSC::AssemblyHelpers::boxBooleanPayload):
+        (JSC::AssemblyHelpers::boxBoolean):
+        (JSC::AssemblyHelpers::emitTypeOf): Reusable TypeOf building for assembly JITs.
+        * jit/JITOperations.h:
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::typeString):
+        * runtime/TypeofType.cpp: Added.
+        (WTF::printInternal):
+        * runtime/TypeofType.h: Added.
+        * tests/stress/type-of-functions-and-objects.js: Modified this test to give more comprehensive feedback.
+
+2015-05-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add a FIXME referencing https://bugs.webkit.org/show_bug.cgi?id=144527.
+
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+
+2015-05-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add FIXMEs referencing https://bugs.webkit.org/show_bug.cgi?id=144524 and
+        https://bugs.webkit.org/show_bug.cgi?id=144525.
+
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGPhantomInsertionPhase.cpp:
+
+2015-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Static property hashtable should only lookup with non-symbol key
+        https://bugs.webkit.org/show_bug.cgi?id=144438
+
+        Reviewed by Darin Adler.
+
+        Static property hashtable compares the Identifier's uid
+        with the normal C string without interning it.
+        So this comparison is performed in their contents.
+        As the result, in this comparison, symbol-ness is not considered.
+
+        So if accidentally the hash collision occur with the symbol and the string
+        and they have the same contents, the hash table entry is looked up incorrectly.
+
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+
+2015-05-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Class syntax should allow string and numeric identifiers for method names
+        https://bugs.webkit.org/show_bug.cgi?id=144254
+
+        Reviewed by Darin Adler.
+
+        Added the support for string and numeric identifiers in class syntax.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo): Instead of using ConstructorKind to indicate whether we're
+        inside a class or not, use the newly added SuperBinding argument instead. ConstructorKind is now None
+        outside a class constructor as it should be.
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass): No longer expects an identifier at the beginning of every class
+        element to allow numeric and string method names. For both of those method names, parse it here instead
+        of parseFunctionInfo since it doesn't support either type. Also pass in SuperBinding::Needed.
+        (JSC::Parser<LexerType>::parsePropertyMethod): Call parseFunctionInfo with SuperBinding::NotNeeded since
+        this function is never used to parse a class method.
+        (JSC::Parser<LexerType>::parseGetterSetter): Pass in superBinding argument to parseFunctionInfo.
+        (JSC::Parser<LexerType>::parsePrimaryExpression): Call parseFunctionInfo with SuperBinding::NotNeeded.
+        * parser/Parser.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createProperty):
+
+2015-05-01  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should use AI more
+        https://bugs.webkit.org/show_bug.cgi?id=144500
+
+        Reviewed by Oliver Hunt.
+        
+        This makes our type check folding even more comprehensive by ensuring that even if the FTL
+        decides to emit some checks, it will still do another query to the abstract interpreter to
+        see if the check is necessary. This helps with cases where we decided early on to speculate
+        one way, but later proved a more specific type of the value in question, and the constant
+        folder didn't catch it.
+        
+        This also makes it more natural to query the abstract interpreter. For example, if you just
+        want the proven type, you can now say provenType(node) or provenType(edge).
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        * dfg/DFGArrayMode.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileBooleanToNumber):
+        (JSC::FTL::LowerDFGToLLVM::compileToThis):
+        (JSC::FTL::LowerDFGToLLVM::compileValueAdd):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithPow):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::compileCheckArray):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileToStringOrCallStringConstructor):
+        (JSC::FTL::LowerDFGToLLVM::compileToPrimitive):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::compileIsBoolean):
+        (JSC::FTL::LowerDFGToLLVM::compileIsNumber):
+        (JSC::FTL::LowerDFGToLLVM::compileIsString):
+        (JSC::FTL::LowerDFGToLLVM::compileIsObject):
+        (JSC::FTL::LowerDFGToLLVM::compileInstanceOf):
+        (JSC::FTL::LowerDFGToLLVM::numberOrNotCellToInt32):
+        (JSC::FTL::LowerDFGToLLVM::baseIndex):
+        (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
+        (JSC::FTL::LowerDFGToLLVM::typedArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::boolify):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::lowInt32):
+        (JSC::FTL::LowerDFGToLLVM::lowInt52):
+        (JSC::FTL::LowerDFGToLLVM::lowCell):
+        (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+        (JSC::FTL::LowerDFGToLLVM::lowDouble):
+        (JSC::FTL::LowerDFGToLLVM::isCellOrMisc):
+        (JSC::FTL::LowerDFGToLLVM::isNotCellOrMisc):
+        (JSC::FTL::LowerDFGToLLVM::isNumber):
+        (JSC::FTL::LowerDFGToLLVM::isNotNumber):
+        (JSC::FTL::LowerDFGToLLVM::isNotCell):
+        (JSC::FTL::LowerDFGToLLVM::isCell):
+        (JSC::FTL::LowerDFGToLLVM::isNotMisc):
+        (JSC::FTL::LowerDFGToLLVM::isMisc):
+        (JSC::FTL::LowerDFGToLLVM::isNotBoolean):
+        (JSC::FTL::LowerDFGToLLVM::isBoolean):
+        (JSC::FTL::LowerDFGToLLVM::isNotOther):
+        (JSC::FTL::LowerDFGToLLVM::isOther):
+        (JSC::FTL::LowerDFGToLLVM::isProvenValue):
+        (JSC::FTL::LowerDFGToLLVM::isObject):
+        (JSC::FTL::LowerDFGToLLVM::isNotObject):
+        (JSC::FTL::LowerDFGToLLVM::isNotString):
+        (JSC::FTL::LowerDFGToLLVM::isString):
+        (JSC::FTL::LowerDFGToLLVM::isFunction):
+        (JSC::FTL::LowerDFGToLLVM::isNotFunction):
+        (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
+        (JSC::FTL::LowerDFGToLLVM::speculateStringObjectForStructureID):
+        (JSC::FTL::LowerDFGToLLVM::speculateNotStringVar):
+        (JSC::FTL::LowerDFGToLLVM::abstractValue):
+        (JSC::FTL::LowerDFGToLLVM::provenType):
+        (JSC::FTL::LowerDFGToLLVM::provenValue):
+        (JSC::FTL::LowerDFGToLLVM::abstractStructure):
+
+2015-05-01  Martin Robinson  <mrobinson@igalia.com>
+
+        USE(...) macro should expect unprefixed variables
+        https://bugs.webkit.org/show_bug.cgi?id=144454
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt: Replace all occurrences WTF_USE with USE.
+
+2015-05-01  Jordan Harband  <ljharb@gmail.com>
+
+        String#startsWith/endsWith/includes don't handle Infinity position/endPosition args correctly
+        https://bugs.webkit.org/show_bug.cgi?id=144314
+
+        Reviewed by Darin Adler.
+
+        Fixing handling of Infinity position args, per
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-string.prototype.includes
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-string.prototype.startswith
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-string.prototype.endswith
+
+        * runtime/StringPrototype.cpp:
+        (JSC::clampInt32):
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+
+2015-05-01  Basile Clement  <basile_clement@apple.com>
+
+        Math.abs() returns negative
+        https://bugs.webkit.org/show_bug.cgi?id=137827
+
+        Reviewed by Michael Saboff.
+
+        Math.abs() on doubles was mistakenly assumed by the DFG AI to be the
+        identity function.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * tests/stress/math-abs-positive.js: Added, was previously failing.
+        (foo):
+
+2015-05-01  Basile Clement  <basile_clement@apple.com>
+
+        Function allocation sinking shouldn't be performed on singleton functions
+        https://bugs.webkit.org/show_bug.cgi?id=144166
+
+        Reviewed by Geoffrey Garen.
+
+        Function allocations usually are free of any other side effects, but
+        this is not the case for allocations performed while the underlying
+        FunctionExecutable is still a singleton (as this allogation will fire
+        watchpoints invalidating code that depends on it being a singleton).
+        As the object allocation sinking phase assumes object allocation is
+        free of side-effects, sinking these allocations is not correct.
+
+        This also means that when materializing a function allocation on OSR
+        exit, that function's executable will never be a singleton, and we don't have
+        to worry about its watchpoint, allowing us to use
+        JSFunction::createWithInvalidatedRellocationWatchpoint instead of
+        JSFunction::create.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+
+2015-04-30  Jon Davis  <jond@apple.com>
+
+        Web Inspector: console should show an icon for console.info() messages
+        https://bugs.webkit.org/show_bug.cgi?id=18530
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::messageLevelValue):
+        * inspector/protocol/Console.json:
+        * runtime/ConsoleClient.cpp:
+        (JSC::appendMessagePrefix):
+        * runtime/ConsolePrototype.cpp:
+        (JSC::ConsolePrototype::finishCreation):
+        (JSC::consoleProtoFuncInfo):
+        * runtime/ConsoleTypes.h:
+
+2015-04-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Move all of the branchIs<type> helpers from SpeculativeJIT into AssemblyHelpers
+        https://bugs.webkit.org/show_bug.cgi?id=144462
+
+        Reviewed by Geoffrey Garen and Mark Lam.
+        
+        At some point we started adding representation-agnostic helpers for doing common type tests.
+        We added some in SpeculativeJIT, and then some in AssemblyHelpers. Prior to this change,
+        they had overlapping powers, though SpeculativeJIT was a bit better.
+        
+        This removes SpeculativeJIT's helpers and strengthens AssemblyHelpers' helpers. This is
+        better because now all of these helpers can be used in all of the assembly-based JITs, not
+        just the DFG. It also settles on what I find to be a slightly better naming convention.
+        For example where we previously would have said branchIsString, now we say
+        branchIfString. Similarly, branchNotString becomes branchIfNotString.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+        (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
+        (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateNotStringVar):
+        (JSC::DFG::SpeculativeJIT::speculateNotCell):
+        (JSC::DFG::SpeculativeJIT::speculateOther):
+        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+        (JSC::DFG::SpeculativeJIT::emitSwitchString):
+        (JSC::DFG::SpeculativeJIT::branchIsObject): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchNotObject): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchIsString): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchNotString): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::branchIsCell): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchNotCell): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchIsOther): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchNotOther): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        (JSC::DFG::SpeculativeJIT::branchIsCell): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchNotCell): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchIsOther): Deleted.
+        (JSC::DFG::SpeculativeJIT::branchNotOther): Deleted.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfCell):
+        (JSC::AssemblyHelpers::branchIfOther):
+        (JSC::AssemblyHelpers::branchIfNotOther):
+        (JSC::AssemblyHelpers::branchIfObject):
+        (JSC::AssemblyHelpers::branchIfNotObject):
+        (JSC::AssemblyHelpers::branchIfType):
+        (JSC::AssemblyHelpers::branchIfNotType):
+        (JSC::AssemblyHelpers::branchIfString):
+        (JSC::AssemblyHelpers::branchIfNotString):
+        (JSC::AssemblyHelpers::branchIfSymbol):
+        (JSC::AssemblyHelpers::branchIfNotSymbol):
+        (JSC::AssemblyHelpers::branchIfFunction):
+        (JSC::AssemblyHelpers::branchIfNotFunction):
+        (JSC::AssemblyHelpers::branchIfEmpty):
+        (JSC::AssemblyHelpers::branchIsEmpty): Deleted.
+        (JSC::AssemblyHelpers::branchIfCellNotObject): Deleted.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitScopedArgumentsGetByVal):
+
+2015-04-30  Filip Pizlo  <fpizlo@apple.com>
+
+        js/regress/is-string-fold-tricky.html and js/regress/is-string-fold.html are crashing
+        https://bugs.webkit.org/show_bug.cgi?id=144463
+
+        Reviewed by Benjamin Poulain.
+        
+        Fixup phase was super cleverly folding an IsString(@x) when @x is predicted SpecString
+        into a Check(String:@x) followed by JSConstant(true). Then in these tests the
+        ValueAdd(IsString(@x), @stuff) would try to turn this into an integer add by cleverly
+        converting the boolean into an integer. But as part of doing that, it would try to
+        short-circuit any profiling by leveraging the fact that the IsString is now a constant,
+        and it would try to figure out if the addition might overflow. Part of that logic
+        involved checking if the immediate is either a boolean or a sufficiently small integer.
+        But: it would check if it's a sufficiently small integer before checking if it was a
+        boolean, so it would try to call asNumber() on the boolean.
+        
+        All of this cleverness was very deliberate, but apparently the @stuff + booleanConstant
+        case was previously never hit until I wrote these tests, and so we never knew that
+        calling asNumber() on a boolean was wrong.
+        
+        The fix is super simple: the expression should just check for boolean first.
+        
+        This bug was benign in release builds. JSValue::asNumber() on a boolean would return
+        garbage, and that's OK, since we'd take the boolean case anyway.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInt32):
+
+2015-04-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, add a FIXME comment referencing https://bugs.webkit.org/show_bug.cgi?id=144458.
+
+        * jit/JITOperations.cpp:
+
+2015-04-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a comment clarifying the behavior and semantics of getCallData/getConstructData, in
+        particular that they cannot change their minds and may be called from compiler threads.
+
+        Rubber stamped by Geoffrey Garen.
+
+        * runtime/JSCell.h:
+
+2015-04-29  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Is<Blah> versions of TypeOf should fold based on proven input type
+        https://bugs.webkit.org/show_bug.cgi?id=144409
+
+        Reviewed by Geoffrey Garen.
+        
+        We were missing some obvious folding opportunities here. I don't know how this affects real
+        code, but in general, we like to ensure that our constant folding is comprehensive. So this
+        is more about placating my static analysis OCD than anything else.
+        
+        I added a bunch of speed/correctness tests for this in LayoutTests/js/regress.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2015-04-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Use the default hash value for Symbolized StringImpl
+        https://bugs.webkit.org/show_bug.cgi?id=144347
+
+        Reviewed by Darin Adler.
+
+        Before this patch, symbolized StringImpl* has a special hash value
+        to avoid the hash collision with the other normal StringImpl*.
+        I guess that it is introduced when private symbols are introduced.
+        However, it prevents using symbolized StringImpl* in the other place
+        For example, using it as WTFString cause a problem because of its special hash value.
+
+        When only using private symbols, they are not exposed to the outside of JSC,
+        so we can handle it carefully. But now, it's extended to symbols.
+        So I think storing a special hash value in StringImpl* causes an error.
+
+        To avoid this, I propose using the usual hash value in symbolized StringImpl*.
+        And to provide significantly different hash value when using it as symbol,
+        store the additional hash value in symbolized StringImpl*. It is used when
+        the hash value is required by IdentifierRepHash.
+
+        * runtime/Identifier.h:
+        (JSC::IdentifierRepHash::hash):
+        * runtime/Lookup.h:
+        (JSC::HashTable::entry):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::get):
+        * runtime/Structure.cpp:
+        (JSC::PropertyTable::checkConsistency):
+
+2015-04-29  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove RageConvert array conversion
+        https://bugs.webkit.org/show_bug.cgi?id=144433
+
+        Reviewed by Filip Pizlo.
+
+        RageConvert was causing a subtle bug that was hitting the Kraken crypto tests
+        pretty hard:
+        -The indexing types shows that the array access varies between Int32 and DoubleArray.
+        -ArrayMode::fromObserved() decided to use the most generic type: DoubleArray.
+         An Arrayify node would convert the Int32 to that type.
+        -Somewhere, a GetByVal or PutByVal would have the flag NodeBytecodeUsesAsInt. That
+         node would use RageConvert instead of Convert.
+        -The Arrayify for that GetByVal with RageConvert would not convert the array to
+         Contiguous.
+        -All the following array access that do not have the flag NodeBytecodeUsesAsInt would
+         now expect a DoubleArray and always get a Contiguous Array. The CheckStructure
+         fail systematically and we never get to run the later code.
+
+        Getting rid of RageConvert fixes the problem and does not seems to have any
+        negative side effect on other benchmarks.
+
+        The improvments on Kraken are:
+            -stanford-crypto-aes: definitely 1.0915x faster.
+            -stanford-crypto-pbkdf2: definitely 1.2446x faster.
+            -stanford-crypto-sha256-iterative: definitely 1.0544x faster.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        (JSC::DFG::arrayConversionToString):
+        * dfg/DFGArrayMode.h:
+        * dfg/DFGArrayifySlowPathGenerator.h:
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::convertDoubleToContiguous):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::genericConvertDoubleToContiguous): Deleted.
+        (JSC::JSObject::rageConvertDoubleToContiguous): Deleted.
+        (JSC::JSObject::rageEnsureContiguousSlow): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::rageEnsureContiguous): Deleted.
+
+2015-04-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Gracefully handle missing auto pause key on remote inspector setup
+        https://bugs.webkit.org/show_bug.cgi?id=144411
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::receivedSetupMessage):
+
+2015-04-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        NodeList has issues with Symbol and empty string
+        https://bugs.webkit.org/show_bug.cgi?id=144310
+
+        Reviewed by Darin Adler.
+
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::isSymbol):
+        Helper to check if the PropertyName is a string or symbol property.
+
+2015-04-29  Alex Christensen  <achristensen@webkit.org>
+
+        Fix non-cygwin incremental builds on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=143264
+
+        Reviewed by Brent Fulgham.
+
+        * generate-js-builtins:
+        Remove stale headers before calling os.rename to replace them.
+
+2015-04-29  Filip Pizlo  <fpizlo@apple.com>
+
+        JSTypeInfo should have an inline type flag to indicate of getCallData() has been overridden
+        https://bugs.webkit.org/show_bug.cgi?id=144397
+
+        Reviewed by Andreas Kling.
+        
+        Add the flag to JSTypeInfo. It's an inline flag so that it's fast to query. Slap the flag on
+        callback objects and internal functions. Modify the TypeOf operation to use this flag to avoid
+        making a getCallData() call if it isn't necessary.
+
+        * API/JSCallbackObject.h:
+        * runtime/InternalFunction.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::typeOfShouldCallGetCallData):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        * tests/stress/type-of-functions-and-objects.js: Added.
+        (foo):
+        (bar):
+        (baz):
+        (fuzz):
+        (expect):
+        (test):
+
+2015-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        It shouldn't take 1846 lines of code and 5 FIXMEs to sort an array.
+        https://bugs.webkit.org/show_bug.cgi?id=144013
+
+        Reviewed by Mark Lam.
+
+        This patch implements Array.prototype.sort in JavaScript, removing the
+        C++ implementations. It is simpler and less error-prone to express our
+        operations in JavaScript, which provides memory safety, exception safety,
+        and recursion safety.
+
+        The performance result is mixed, but net positive in my opinion. It's
+        difficult to enumerate all the results, since we used to have so many
+        different sorting modes, and there are lots of different data patterns
+        across which you might want to measure sorting. Suffice it to say:
+
+            (*) The benchmarks we track are faster or unchanged.
+
+            (*) Sorting random input using a comparator -- which we think is
+            common -- is 3X faster.
+
+            (*) Sorting random input in a non-array object -- which jQuery does
+            -- is 4X faster.
+
+            (*) Sorting random input in a compact array of integers using a
+            trivial pattern-matchable comparator is 2X *slower*.
+
+        * builtins/Array.prototype.js:
+        (sort.min):
+        (sort.stringComparator):
+        (sort.compactSparse): Special case compaction for sparse arrays because
+        we don't want to hang when sorting new Array(BIG).
+
+        (sort.compact):
+        (sort.merge):
+        (sort.mergeSort): Use merge sort because it's a reasonably efficient
+        stable sort. We have evidence that some sites depend on stable sort,
+        even though the ES6 spec does not mandate it. (See
+        <http://trac.webkit.org/changeset/33967>.)
+
+        This is a textbook implementation of merge sort with three optimizations:
+
+            (1) Use iteration instead of recursion;
+
+            (2) Use array subscripting instead of array copying in order to
+            create logical sub-lists without creating physical sub-lists;
+
+            (3) Swap src and dst at each iteration instead of copying src into
+            dst, and only copy src into the subject array at the end if src is
+            not the subject array.
+
+        (sort.inflate):
+        (sort.comparatorSort):
+        (sort): Sort in JavaScript for the win.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal): Allow non-private
+        names so we can use helper functions.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isNumericCompareFunction): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::setIsNumericCompareFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::isNumericCompareFunction): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::setIsNumericCompareFunction): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionNode::emitBytecode): We don't do this special casing based
+        on pattern matching anymore. This was mainly an optimization to avoid 
+        the overhead of calling from C++ to JS, which we now avoid by
+        sorting in JS.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::pushTempSortVector): Deleted.
+        (JSC::Heap::popTempSortVector): Deleted.
+        (JSC::Heap::visitTempSortVectors): Deleted.
+        * heap/Heap.h: We don't have temp sort vectors anymore because we sort
+        in JavaScript using a normal JavaScript array for our temporary storage.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner): Allow capturing so we can use
+        helper functions.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction): Deleted.
+        (JSC::attemptFastSort): Deleted.
+        (JSC::performSlowSort): Deleted.
+        (JSC::arrayProtoFuncSort): Deleted.
+
+        * runtime/CommonIdentifiers.h: New strings used by sort.
+
+        * runtime/JSArray.cpp:
+        (JSC::compareNumbersForQSortWithInt32): Deleted.
+        (JSC::compareNumbersForQSortWithDouble): Deleted.
+        (JSC::compareNumbersForQSort): Deleted.
+        (JSC::compareByStringPairForQSort): Deleted.
+        (JSC::JSArray::sortNumericVector): Deleted.
+        (JSC::JSArray::sortNumeric): Deleted.
+        (JSC::ContiguousTypeAccessor::getAsValue): Deleted.
+        (JSC::ContiguousTypeAccessor::setWithValue): Deleted.
+        (JSC::ContiguousTypeAccessor::replaceDataReference): Deleted.
+        (JSC::ContiguousTypeAccessor<ArrayWithDouble>::getAsValue): Deleted.
+        (JSC::ContiguousTypeAccessor<ArrayWithDouble>::setWithValue): Deleted.
+        (JSC::ContiguousTypeAccessor<ArrayWithDouble>::replaceDataReference): Deleted.
+        (JSC::JSArray::sortCompactedVector): Deleted.
+        (JSC::JSArray::sort): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::get_less): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::set_less): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::get_greater): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::set_greater): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::get_balance_factor): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::set_balance_factor): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_node): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_node_node): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::null): Deleted.
+        (JSC::JSArray::sortVector): Deleted.
+        (JSC::JSArray::compactForSorting): Deleted.
+        * runtime/JSArray.h:
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation): Provide some builtins used
+        by sort.
+
+2015-04-29  Mark Lam  <mark.lam@apple.com>
+
+        Safari WebKit crash when loading Google Spreadsheet.
+        https://bugs.webkit.org/show_bug.cgi?id=144020
+
+        Reviewed by Filip Pizlo.
+
+        The bug is that the object allocation sinking phase did not account for a case
+        where a property of a sunken object is only initialized on one path and not
+        another.  As a result, on the path where the property is not initialized, we'll
+        encounter an Upsilon with a BottomValue (which is not allowed by definition).
+
+        The fix is to use a JSConstant(undefined) as the bottom value instead (of
+        BottomValue).  If the property is uninitialized, it should still be accessible
+        and have the value undefined.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+        * tests/stress/object-allocation-sinking-with-uninitialized-property-on-one-path.js: Added.
+        (foo):
+        (foo2):
+
+2015-04-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION (r183373): ASSERT failed in wtf/SHA1.h
+        https://bugs.webkit.org/show_bug.cgi?id=144257
+
+        Reviewed by Darin Adler.
+
+        SHA1 is used to calculate CodeBlockHash.
+        To calculate hash value, we pass the source code UTF-8 CString to SHA1::addBytes.
+        However, the source code can contain null character.
+        So when performing `strlen` on the source code's CString, it returns the incorrect length.
+        In SHA1::addBytes, there's assertion `input.length() == strlen(string)` and it fails.
+
+        In the template-literal-syntax.js, we perform `eval` with the script contains "\0".
+        As the result, `strlen(string)` accidentally shortened by the contained "\0", and assertion fails.
+
+        CString will be changed not to contain a null-character[1]. However, inserting the assertion here
+        is not correct. Because
+
+        1. If CString should not contain a null character, this should be asserted in CString side instead of SHA1::addBytes.
+        2. If CString can contain a null character, this assertion becomes incorrect.
+
+        So this patch just drops the assertion.
+
+        In the current implementation, we once convert the entire source code to the newly allocated
+        UTF-8 string and pass it to the SHA1 processing. However, this is memory consuming.
+        Ideally, we should stream the decoded bytes into the SHA1 processing iteratively.
+        We'll implement it in the separate patch[2].
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=144339
+        [2]: https://bugs.webkit.org/show_bug.cgi?id=144263
+
+        * tests/stress/eval-script-contains-null-character.js: Added.
+        (shouldBe):
+        (test):
+        * tests/stress/template-literal-line-terminators.js:
+        * tests/stress/template-literal-syntax.js:
+        * tests/stress/template-literal.js:
+
+2015-04-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Evict IsEnvironmentRecord from inline type flags
+        https://bugs.webkit.org/show_bug.cgi?id=144398
+
+        Reviewed by Mark Lam and Michael Saboff.
+        
+        In https://bugs.webkit.org/show_bug.cgi?id=144397, we'll need an extra bit in the inline
+        type flags. This change picks the least important inline type flag - IsEnvironmentRecord -
+        and evicts it into the out-of-line type flags. This change has no performance implications
+        because we never even accessed IsEnvironmentRecord via the StructureIDBlob. The only place
+        where we access it at all is in String.prototype.repeat, and there we already load the
+        structure anyway.
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::implementsHasInstance):
+        (JSC::TypeInfo::structureIsImmortal):
+        (JSC::TypeInfo::isEnvironmentRecord):
+
+2015-04-29  Darin Adler  <darin@apple.com>
+
+        [ES6] Implement Unicode code point escapes
+        https://bugs.webkit.org/show_bug.cgi?id=144377
+
+        Reviewed by Antti Koivisto.
+
+        * parser/Lexer.cpp: Moved the UnicodeHexValue class in here from
+        the header. Made it a non-member class so it doesn't need to be part
+        of a template. Made it use UChar32 instead of int for the value to
+        make it clearer what goes into this class.
+        (JSC::ParsedUnicodeEscapeValue::isIncomplete): Added. Replaces the
+        old type() function.
+        (JSC::Lexer<CharacterType>::parseUnicodeEscape): Renamed from
+        parseFourDigitUnicodeHex and added support for code point escapes.
+        (JSC::isLatin1): Added an overload for UChar32.
+        (JSC::isIdentStart): Changed this to take UChar32; no caller tries
+        to call it with a UChar, so no need to overload for that type for now.
+        (JSC::isNonLatin1IdentPart): Changed argument type to UChar32 for clarity.
+        Also added FIXME about a subtle ES6 change that we might want to make later.
+        (JSC::isIdentPart): Changed this to take UChar32; no caller tries
+        to call it with a UChar, so no need to overload for that type for now.
+        (JSC::isIdentPartIncludingEscapeTemplate): Made this a template so that we
+        don't need to repeat the code twice. Added code to handle code point escapes.
+        (JSC::isIdentPartIncludingEscape): Call the template instead of having the
+        code in line.
+        (JSC::Lexer<CharacterType>::recordUnicodeCodePoint): Added.
+        (JSC::Lexer<CharacterType>::parseIdentifierSlowCase): Made small tweaks and
+        updated to call parseUnicodeEscape instead of parseFourDigitUnicodeHex.
+        (JSC::Lexer<CharacterType>::parseComplexEscape): Call parseUnicodeEscape
+        instead of parseFourDigitUnicodeHex. Move the code to handle "\u" before
+        the code that handles the escapes, since the code point escape code now
+        consumes characters while parsing rather than peeking ahead. Test case
+        covers this: Symptom would be that "\u{" would evaluate to "u" instead of
+        giving a syntax error.
+
+        * parser/Lexer.h: Updated for above changes.
+
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCodePoint): Use ICU's UCHAR_MAX_VALUE instead of writing
+        out 0x10FFFF; clearer this way.
+
+2015-04-29  Martin Robinson  <mrobinson@igalia.com>
+
+        [CMake] [GTK] Organize and clean up unused CMake variables
+        https://bugs.webkit.org/show_bug.cgi?id=144364
+
+        Reviewed by Gyuyoung Kim.
+
+        * PlatformGTK.cmake: Add variables specific to this project.
+
+2015-04-28  Filip Pizlo  <fpizlo@apple.com>
+
+        TypeOf should return SpecStringIdent and the DFG should know this
+        https://bugs.webkit.org/show_bug.cgi?id=144376
+
+        Reviewed by Andreas Kling.
+        
+        Make TypeOf return atomic strings. That's a simple change in SmallStrings.
+        
+        Make the DFG know this and use it for optimization. This makes Switch(TypeOf) a bit less
+        bad.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::setType):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::setType):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::initialize):
+        * tests/stress/switch-typeof-indirect.js: Added.
+        (bar):
+        (foo):
+        (test):
+        * tests/stress/switch-typeof-slightly-indirect.js: Added.
+        (foo):
+        (test):
+        * tests/stress/switch-typeof.js: Added.
+        (foo):
+        (test):
+
+2015-04-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(181868): Windows Live SkyDrive cannot open an excel file
+        https://bugs.webkit.org/show_bug.cgi?id=144373
+
+        Reviewed by Darin Adler.
+
+        Revert r181868 as it caused a failure on live.com. We can try
+        re-enabling this exception after we make idl attributes configurable,
+        which may have prevented this particular failure.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+
+2015-04-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Deadlock on applications using JSContext on non-main thread
+        https://bugs.webkit.org/show_bug.cgi?id=144370
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::singleton):
+        Prevent a possible deadlock by assuming we can synchronously
+        run something on the main queue at this time.
+
+2015-04-28  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should fully support Switch (it currently lacks the SwitchString variant)
+        https://bugs.webkit.org/show_bug.cgi?id=144348
+
+        Reviewed by Benjamin Poulain.
+        
+        This adds SwitchString support to the FTL. This is already tested by switch microbenchmarks
+        in LayoutTests/js/regress.
+
+        * dfg/DFGCommon.cpp:
+        (JSC::DFG::stringLessThan):
+        * dfg/DFGCommon.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::StringSwitchCase::operator<): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::StringSwitchCase::operator<):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::switchString):
+        (JSC::FTL::LowerDFGToLLVM::StringSwitchCase::StringSwitchCase):
+        (JSC::FTL::LowerDFGToLLVM::StringSwitchCase::operator<):
+        (JSC::FTL::LowerDFGToLLVM::CharacterCase::CharacterCase):
+        (JSC::FTL::LowerDFGToLLVM::CharacterCase::operator<):
+        (JSC::FTL::LowerDFGToLLVM::switchStringRecurse):
+        (JSC::FTL::LowerDFGToLLVM::switchStringSlow):
+        (JSC::FTL::LowerDFGToLLVM::appendOSRExit):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::check):
+        * ftl/FTLOutput.h:
+        * ftl/FTLWeight.h:
+        (JSC::FTL::Weight::inverse):
+        * jit/JITOperations.h:
+
+2015-04-28  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        Fully replace ENABLE_LLINT_C_LOOP with ENABLE_JIT
+        https://bugs.webkit.org/show_bug.cgi?id=144304
+
+        Reviewed by Geoffrey Garen.
+
+        * Configurations/FeatureDefines.xcconfig: Define ENABLE_JIT, enabled by default, instead of
+        ENABLE_LLINT_C_LOOP, disabled by default.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Check ENABLE_JIT instead of ENABLE_LLINT_C_LOOP.
+
+2015-04-28  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r183514.
+        https://bugs.webkit.org/show_bug.cgi?id=144359
+
+        It broke cloop test bots (Requested by mcatanzaro on #webkit).
+
+        Reverted changeset:
+
+        "Fully replace ENABLE_LLINT_C_LOOP with ENABLE_JIT"
+        https://bugs.webkit.org/show_bug.cgi?id=144304
+        http://trac.webkit.org/changeset/183514
+
+2015-04-28  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        Fully replace ENABLE_LLINT_C_LOOP with ENABLE_JIT
+        https://bugs.webkit.org/show_bug.cgi?id=144304
+
+        Reviewed by Geoffrey Garen.
+
+        * Configurations/FeatureDefines.xcconfig: Define ENABLE_JIT, enabled by default, instead of
+        ENABLE_LLINT_C_LOOP, disabled by default.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Check ENABLE_JIT instead of ENABLE_LLINT_C_LOOP.
+
+2015-04-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix common typo "targetting" => "targeting"
+        https://bugs.webkit.org/show_bug.cgi?id=144349
+
+        Reviewed by Daniel Bates.
+
+        * bytecode/ExecutionCounter.h:
+
+2015-04-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Update the features.json for WeakSet, WeakMap, Template literals, Tagged templates
+        https://bugs.webkit.org/show_bug.cgi?id=144328
+
+        Reviewed by Andreas Kling.
+
+        Update the status of ES6 features.
+
+        * features.json:
+
+2015-04-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should not use or preserve Phantoms during transformations
+        https://bugs.webkit.org/show_bug.cgi?id=143736
+
+        Reviewed by Geoffrey Garen.
+        
+        Since http://trac.webkit.org/changeset/183207 and http://trac.webkit.org/changeset/183406, it is
+        no longer necessary to preserve Phantoms during transformations. They are still useful just
+        before FixupPhase to support backwards propagation analyses. They are still inserted late in the
+        game in the DFG backend. But transformations don't need to worry about them. Inside a basic
+        block, we can be sure that so long as the IR pinpoints the place where the value becomes
+        available in a bytecode register (using MovHint) and so long as there is a SetLocal anytime some
+        other block would need the value (either for OSR or for DFG execution), then we don't need any
+        liveness markers.
+        
+        So, this removes any places where we inserted Phantoms just for liveness during transformation
+        and it replaces convertToPhantom() with remove(), which just converts the node to a Check. A
+        Check node only keeps its children so long as those children have checks.
+        
+        The fact that we no longer convertToPhantom() means that we have to be more careful when
+        constant-folding GetLocal. Previously we would convertToPhantom() and use the fact that
+        Phantom(Phi) was a valid construct. It's not valid anymore. So, when constant folding encounters
+        a GetLocal it needs to insert a PhantomLocal directly. This allows us to simplify
+        Graph::convertToConstant() a bit. Luckily, none of the other users of this method would see
+        GetLocals.
+        
+        The only Phantom-like cruft left over after this patch is:
+        
+        - Phantoms before FixupPhase. I kind of like these. It means that before FixupPhase, we can do
+          backwards analyses and rely on the fact that the users of a node in DFG IR are a superset of
+          the users of the original local's live range in bytecode. This is essential for supporting our
+          BackwardsPropagationPhase, which is an important optimization for things like asm.js.
+        
+        - PhantomLocals and GetLocals being NodeMustGenerate. See discussion in
+          https://bugs.webkit.org/show_bug.cgi?id=144086. It appears that this is not as evil as the
+          alternatives. The best long-term plan is to simply ditch the ThreadedCPS IR entirely and have
+          the DFG use SSA. For now, so long as any new DFG optimizations we add are block-local and
+          treat GetLocal/SetLocal conservatively, this should all be sound.
+        
+        This change should be perf-neutral although it does reduce the total work that the compiler
+        does.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAdjacencyList.h:
+        (JSC::DFG::AdjacencyList::justChecks):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::replaceTerminal):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::findTerminal):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
+        (JSC::DFG::CPSRethreadingPhase::clearVariables):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGCleanUpPhase.cpp: Copied from Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.cpp.
+        (JSC::DFG::CleanUpPhase::CleanUpPhase):
+        (JSC::DFG::CleanUpPhase::run):
+        (JSC::DFG::performCleanUp):
+        (JSC::DFG::PhantomRemovalPhase::PhantomRemovalPhase): Deleted.
+        (JSC::DFG::PhantomRemovalPhase::run): Deleted.
+        (JSC::DFG::performPhantomRemoval): Deleted.
+        * dfg/DFGCleanUpPhase.h: Copied from Source/JavaScriptCore/dfg/DFGPhantomRemovalPhase.h.
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
+        (JSC::DFG::ConstantFoldingPhase::fixUpsilons):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        (JSC::DFG::DCEPhase::fixupBlock):
+        (JSC::DFG::DCEPhase::cleanVariables):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupBlock):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::convertStringAddUse):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        (JSC::DFG::FixupPhase::checkArray):
+        (JSC::DFG::FixupPhase::fixIntConvertingEdge):
+        (JSC::DFG::FixupPhase::fixIntOrBooleanEdge):
+        (JSC::DFG::FixupPhase::fixDoubleOrBooleanEdge):
+        (JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
+        (JSC::DFG::FixupPhase::tryToRelaxRepresentation):
+        (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+        (JSC::DFG::FixupPhase::addRequiredPhantom): Deleted.
+        (JSC::DFG::FixupPhase::addPhantomsIfNecessary): Deleted.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::convertToConstant):
+        (JSC::DFG::Graph::mergeRelevantToOSR): Deleted.
+        * dfg/DFGGraph.h:
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertCheck):
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::remove):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::replaceWith):
+        (JSC::DFG::Node::convertToPhantom): Deleted.
+        (JSC::DFG::Node::convertToCheck): Deleted.
+        (JSC::DFG::Node::willHaveCodeGenOrOSR): Deleted.
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGPhantomCanonicalizationPhase.cpp: Removed.
+        * dfg/DFGPhantomCanonicalizationPhase.h: Removed.
+        * dfg/DFGPhantomRemovalPhase.cpp: Removed.
+        * dfg/DFGPhantomRemovalPhase.h: Removed.
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGResurrectionForValidationPhase.cpp: Removed.
+        * dfg/DFGResurrectionForValidationPhase.h: Removed.
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        * dfg/DFGStoreBarrierElisionPhase.cpp:
+        (JSC::DFG::StoreBarrierElisionPhase::elideBarrier):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        (JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::validateCPS):
+        (JSC::DFG::Validate::validateSSA):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileNoOp):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantom): Deleted.
+
+2015-04-28  Andreas Kling  <akling@apple.com>
+
+        DFG+FTL should generate efficient code for branching on a string's boolean value.
+        <https://webkit.org/b/144317>
+
+        Reviewed by Geoff Garen & Filip Pizlo
+
+        Teach Branch nodes about StringUse and have them generate an efficient zero-length string check
+        instead of dropping out to C++ whenever we branch on a string.
+
+        The FTL JIT already handled Branch nodes with StringUse through its use of boolify(), so only
+        the DFG JIT gets some new codegen logic in this patch.
+
+        Test: js/regress/branch-on-string-as-boolean.js (~4.5x speedup)
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitStringBranch):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+
+2015-04-28  Filip Pizlo  <fpizlo@apple.com>
+
+        VarargsForwardingPhase should only consider MovHints that have the candidate as a child
+        https://bugs.webkit.org/show_bug.cgi?id=144340
+
+        Reviewed by Michael Saboff and Mark Lam.
+        
+        Since we were considering all MovHints, we'd assume that the CreateDirectArguments or
+        CreateClosedArguments node was live so long as any MovHinted bytecode variable was alive.
+        Basically, we'd keep it alive until the end of the block. This maximized the chances of
+        there being an interfering operation, which would prevent elimination.
+        
+        The fix is to only consider MovHints that have the arguments candidate as a child. We only
+        care to track the liveness of those bytecode locals that would need an arguments object
+        recovery on OSR exit.
+        
+        This is a speed-up on V8Spider/raytrace and Octane/raytrace because it undoes the regression
+        introduced in http://trac.webkit.org/changeset/183406.
+
+        * dfg/DFGVarargsForwardingPhase.cpp:
+
+2015-04-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove WinCE cruft from cmake build system
+        https://bugs.webkit.org/show_bug.cgi?id=144325
+
+        Reviewed by Gyuyoung Kim.
+
+        * CMakeLists.txt:
+        * create_jit_stubs: Removed.
+
+2015-04-27  Andreas Kling  <akling@apple.com>
+
+        RegExp matches arrays should use contiguous indexing.
+        <https://webkit.org/b/144286>
+
+        Reviewed by Geoffrey Garen.
+
+        We had a custom Structure being used for RegExp matches arrays that would
+        put the arrays into SlowPutArrayStorageShape mode. This was just left
+        from when matches arrays were custom, lazily initialized objects.
+
+        This change removes that Structure and switches the matches arrays to
+        using the default ContiguousShape Structure. This allows the FTL JIT
+        to compile the inner loop of the Octane/regexp benchmark.
+
+        Also made a version of initializeIndex() [inline] that takes the indexing
+        type in an argument, allowing createRegExpMatchesArray() to initialize
+        the entire array without branching on the indexing type for each entry.
+
+        ~3% progression on Octane/regexp.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::mapStructure):
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::initializeIndex):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::createRegExpMatchesArray):
+
+2015-04-27  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL failed to initialize arguments.callee on the slow path as well as the fast path
+        https://bugs.webkit.org/show_bug.cgi?id=144293
+
+        Reviewed by Mark Lam.
+        
+        The slow path doesn't fully initialize DirectArguments - it leaves callee blank. So, we need
+        to initialize the callee on the common path after the fast and slow path.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCreateDirectArguments):
+        * tests/stress/arguments-callee-uninitialized.js: Added.
+        (foo):
+
+2015-04-27  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add support for typed arrays to the Array profiling
+        https://bugs.webkit.org/show_bug.cgi?id=143913
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds ArrayModes for every typed arrays. Having that information
+        let us generate better GetByVal and PutByVal when the type speculation
+        are not good enough.
+
+        A typical case where this is useful is any basic block for which the type
+        of the object is always more restrictive than the speculation (for example, 
+        a basic block gated by a branch only taken for on type).
+
+        * bytecode/ArrayProfile.cpp:
+        (JSC::dumpArrayModes):
+        * bytecode/ArrayProfile.h:
+        (JSC::arrayModeFromStructure):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::fromObserved):
+        (JSC::DFG::ArrayMode::refine):
+        Maintain the refine() semantic. We do not support OutOfBounds access
+        for GetByVal on typed array.
+
+        * runtime/IndexingType.h:
+        * tests/stress/typed-array-get-by-val-profiling.js: Added.
+        (testArray.testCode):
+        (testArray):
+        * tests/stress/typed-array-put-by-val-profiling.js: Added.
+        (testArray.testCode):
+        (testArray):
+
+2015-04-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out r183438 "RegExp matches arrays should use contiguous indexing". It
+        causes many debug test failures.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::initializeIndex):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::createRegExpMatchesArray):
+
+2015-04-27  Andreas Kling  <akling@apple.com>
+
+        RegExp matches arrays should use contiguous indexing.
+        <https://webkit.org/b/144286>
+
+        Reviewed by Geoffrey Garen.
+
+        We had a custom Structure being used for RegExp matches arrays that would
+        put the arrays into SlowPutArrayStorageShape mode. This was just left
+        from when matches arrays were custom, lazily initialized objects.
+
+        This change removes that Structure and switches the matches arrays to
+        using the default ContiguousShape Structure. This allows the FTL JIT
+        to compile the inner loop of the Octane/regexp benchmark.
+
+        Also made a version of initializeIndex() [inline] that takes the indexing
+        type in an argument, allowing createRegExpMatchesArray() to initialize
+        the entire array without branching on the indexing type for each entry.
+
+        ~3% progression on Octane/regexp.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::mapStructure):
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::initializeIndex):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::createRegExpMatchesArray):
+
+2015-04-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION (r183373): ASSERT failed in wtf/SHA1.h
+        https://bugs.webkit.org/show_bug.cgi?id=144257
+
+        Temporarily disable skip these tests.
+
+        * tests/stress/template-literal-line-terminators.js:
+        * tests/stress/template-literal-syntax.js:
+        * tests/stress/template-literal.js:
+
+2015-04-27  Basile Clement  <basile_clement@apple.com>
+
+        Function allocations shouldn't sink through Put operations
+        https://bugs.webkit.org/show_bug.cgi?id=144176
+
+        Reviewed by Filip Pizlo.
+
+        By design, we don't support function allocation sinking through any
+        related operation ; however object allocation can sink through PutByOffset et
+        al.
+
+        Currently, the checks to prevent function allocation to sink through
+        these are misguided and do not prevent anything ; function allocation sinking
+        through these operations is prevented as a side effect of requiring an
+        AllocatePropertyStorage through which the function allocation is seen as
+        escaping.
+
+        This changes it so that ObjectAllocationSinkingPhase::handleNode()
+        checks properly that only object allocations sink through related write
+        operations.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+
+2015-04-25  Filip Pizlo  <fpizlo@apple.com>
+
+        VarargsForwardingPhase should use bytecode liveness in addition to other uses to determine the last point that a candidate is used
+        https://bugs.webkit.org/show_bug.cgi?id=143843
+
+        Reviewed by Geoffrey Garen.
+        
+        It will soon come to pass that Phantom isn't available at the time that
+        VarargsForwardingPhase runs. So, it needs to use some other mechanism for discovering when
+        a value dies for OSR.
+        
+        This is simplified by two things:
+        
+        1) The bytecode kill analysis is now reusable. This patch makes it even more reusable than
+           before by polishing the API.
+        
+        2) This phase already operates on one node at a time and allows itself to do a full search
+           of the enclosing basic block for that node. This is fine because CreateDirectArguments
+           and friends is a rarely occurring node. The fact that it operates on one node at a time
+           makes it even easier to reason about OSR liveness - we just track the list of locals in
+           which it is live.
+        
+        This change has no effect right now but it is a necessary prerequisite to implementing
+        https://bugs.webkit.org/show_bug.cgi?id=143736.
+
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::tryAt):
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKilledOperands):
+        * dfg/DFGPhantomInsertionPhase.cpp:
+        * dfg/DFGVarargsForwardingPhase.cpp:
+
+2015-04-27  Jordan Harband  <ljharb@gmail.com>
+
+        Map#entries and Map#keys error for non-Maps is swapped
+        https://bugs.webkit.org/show_bug.cgi?id=144253
+
+        Reviewed by Simon Fraser.
+
+        Correcting error messages on Set/Map methods when called on
+        incompatible objects.
+
+        * runtime/MapPrototype.cpp:
+        (JSC::mapProtoFuncEntries):
+        (JSC::mapProtoFuncKeys):
+        * runtime/SetPrototype.cpp:
+        (JSC::setProtoFuncEntries):
+
+2015-04-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize DFG DCE handling of nodes that perform checks that propagate through AI
+        https://bugs.webkit.org/show_bug.cgi?id=144186
+
+        Reviewed by Geoffrey Garen.
+        
+        If I do ArithAdd(Int32Use, Int32Use, CheckOverflow) then AI will prove that this returns
+        Int32. We may later perform code simplifications based on the proof that this is Int32, and
+        we may kill all DFG users of this ArithAdd. Then we may prove that there is no exit site at
+        which the ArithAdd is live. This seems like it is sufficient to then kill the ArithAdd,
+        except that we still need the overflow check!
+
+        Previously we mishandled this:
+
+        - In places where we want the overflow check we need to use MustGenerate(@ArithAdd) as a hack
+          to keep it alive. That's dirty and it's just indicative of a deeper issue.
+
+        - Our MovHint removal doesn't do Phantom canonicalization which essentially makes it
+          powerless. This was sort of hiding the bug.
+
+        - Nodes that have checks that AI leverages should always be NodeMustGenerate. You can't kill
+          something that you are relying on for subsequent simplifications.
+        
+        This fixes MovHint removal to also canonicalize Phantoms. This also adds ModeMustGenerate to
+        nodes that may perform checks that are used by AI to guarantee the result type. As a result,
+        we no longer need the weird MustGenerate node.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::tryToRelaxRepresentation):
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
+        (JSC::DFG::IntegerCheckCombiningPhase::insertMustAdd): Deleted.
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGPhantomCanonicalizationPhase.cpp:
+        (JSC::DFG::PhantomCanonicalizationPhase::run):
+        * dfg/DFGPhantomRemovalPhase.cpp:
+        (JSC::DFG::PhantomRemovalPhase::run):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * tests/stress/fold-based-on-int32-proof-mul-branch.js: Added.
+        (foo):
+        * tests/stress/fold-based-on-int32-proof-mul.js: Added.
+        (foo):
+        * tests/stress/fold-based-on-int32-proof-or-zero.js: Added.
+        (foo):
+        * tests/stress/fold-based-on-int32-proof.js: Added.
+        (foo):
+
+2015-04-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Class body ending with a semicolon throws a SyntaxError
+        https://bugs.webkit.org/show_bug.cgi?id=144244
+
+        Reviewed by Darin Adler.
+
+        The bug was caused by parseClass's inner loop for method definitions not moving onto the next iteration
+        it encounters a semicolon. As a result, we always expected a method to appear after a semicolon. Fixed
+        it by continue'ing when it encounters a semicolon.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+
+2015-04-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Getter or setter method named "prototype" or "constrcutor" should throw SyntaxError
+        https://bugs.webkit.org/show_bug.cgi?id=144243
+
+        Reviewed by Darin Adler.
+
+        Fixed the bug by adding explicit checks in parseGetterSetter when we're parsing class methods.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseGetterSetter):
+
+2015-04-26  Jordan Harband  <ljharb@gmail.com>
+
+        Map#forEach does not pass "map" argument to callback.
+        https://bugs.webkit.org/show_bug.cgi?id=144187
+
+        Reviewed by Darin Adler.
+
+        Per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-map.prototype.foreach
+        step 7.a.i., the callback should be called with three arguments.
+
+        * runtime/MapPrototype.cpp:
+        (JSC::mapProtoFuncForEach):
+
+2015-04-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement ES6 template literals
+        https://bugs.webkit.org/show_bug.cgi?id=142691
+
+        Reviewed by Darin Adler.
+
+        This patch implements TemplateLiteral.
+        Since TaggedTemplate requires some global states and
+        primitive operations like GetTemplateObject,
+        we separate the patch. It will be implemented in a subsequent patch.
+
+        Template Literal Syntax is guarded by ENABLE_ES6_TEMPLATE_LITERAL_SYNTAX compile time flag.
+        By disabling it, we can disable Template Literal support.
+
+        To implement template literals, in this patch,
+        we newly introduces bytecode op_to_string.
+        In template literals, we alternately evaluate the expression and
+        perform ToString onto the result of evaluation.
+        For example,
+
+        `${f1()} ${f2()}`
+
+        In this template literal, execution order is the following,
+        1. calling f1()
+        2. ToString(the result of f1())
+        3. calling f2()
+        4. ToString(the result of f2())
+
+        op_strcat also performs ToString. However, performing ToString
+        onto expressions are batched in op_strcat, it's not the same to the
+        template literal spec. In the above example,
+        ToString(f1()) should be called before calling f2().
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitToString):
+        (JSC::BytecodeGenerator::emitToNumber): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TemplateStringNode::emitBytecode):
+        (JSC::TemplateLiteralNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_string):
+        (JSC::JIT::emitSlow_op_to_string):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_to_string):
+        (JSC::JIT::emitSlow_op_to_string):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createTemplateString):
+        (JSC::ASTBuilder::createTemplateStringList):
+        (JSC::ASTBuilder::createTemplateExpressionList):
+        (JSC::ASTBuilder::createTemplateLiteral):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::Lexer<T>::parseIdentifierSlowCase):
+        (JSC::Lexer<T>::parseString):
+        (JSC::LineNumberAdder::LineNumberAdder):
+        (JSC::LineNumberAdder::clear):
+        (JSC::LineNumberAdder::add):
+        (JSC::Lexer<T>::parseTemplateLiteral):
+        (JSC::Lexer<T>::lex):
+        (JSC::Lexer<T>::scanRegExp):
+        (JSC::Lexer<T>::scanTrailingTemplateString):
+        (JSC::Lexer<T>::parseStringSlowCase): Deleted.
+        * parser/Lexer.h:
+        * parser/NodeConstructors.h:
+        (JSC::TemplateExpressionListNode::TemplateExpressionListNode):
+        (JSC::TemplateStringNode::TemplateStringNode):
+        (JSC::TemplateStringListNode::TemplateStringListNode):
+        (JSC::TemplateLiteralNode::TemplateLiteralNode):
+        * parser/Nodes.h:
+        (JSC::TemplateExpressionListNode::value):
+        (JSC::TemplateExpressionListNode::next):
+        (JSC::TemplateStringNode::cooked):
+        (JSC::TemplateStringNode::raw):
+        (JSC::TemplateStringListNode::value):
+        (JSC::TemplateStringListNode::next):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseTemplateString):
+        (JSC::Parser<LexerType>::parseTemplateLiteral):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        * parser/Parser.h:
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createTemplateString):
+        (JSC::SyntaxChecker::createTemplateStringList):
+        (JSC::SyntaxChecker::createTemplateExpressionList):
+        (JSC::SyntaxChecker::createTemplateLiteral):
+        (JSC::SyntaxChecker::createSpreadExpression): Deleted.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * tests/stress/template-literal-line-terminators.js: Added.
+        (test):
+        (testEval):
+        (testEvalLineNumber):
+        * tests/stress/template-literal-syntax.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        * tests/stress/template-literal.js: Added.
+        (test):
+        (testEval):
+        (testEmbedded):
+
+2015-04-26  Jordan Harband  <ljharb@gmail.com>
+
+        Set#forEach does not pass "key" or "set" arguments to callback.
+        https://bugs.webkit.org/show_bug.cgi?id=144188
+
+        Reviewed by Darin Adler.
+
+        Per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-set.prototype.foreach
+        Set#forEach should pass 3 arguments to the callback.
+
+        * runtime/SetPrototype.cpp:
+        (JSC::setProtoFuncForEach):
+
+2015-04-26  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Implement Math.clz32(), remove Number.clz()
+        https://bugs.webkit.org/show_bug.cgi?id=144205
+
+        Reviewed by Michael Saboff.
+
+        This patch adds the ES6 function Math.clz32(), and remove the non-standard
+        Number.clz(). Number.clz() probably came from an older draft.
+
+        The new function has a corresponding instrinsic: Clz32Intrinsic,
+        and a corresponding DFG node: ArithClz32, optimized all the way to LLVM.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::countLeadingZeros32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::bsr_rr):
+        The x86 assembler did not have countLeadingZeros32() because there is
+        no native CLZ instruction on that architecture.
+
+        I have added the version with bsr + branches for the case of zero.
+        An other popular version uses cmov to handle the case of zero. I kept
+        it simple since the Assembler has no support for cmov.
+
+        It is unlikely to matter much. If the code is hot enough, LLVM picks
+        something good based on the surrounding code.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        Constant handling + effect propagation. The node only produces integer (between 0 and 32).
+
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        Thanks to the definition of toUint32(), we can ignore plenty of details
+        from doubles.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithClz32):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithClz32):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::ctlz32):
+        * jit/ThunkGenerators.cpp:
+        (JSC::clz32ThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/Intrinsic.h:
+        * runtime/MathCommon.h:
+        (JSC::clz32):
+        Fun fact: InstCombine does not recognize this pattern to eliminate
+        the branch which makes our FTL version better than the C version.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        (JSC::mathProtoFuncClz32):
+        * runtime/NumberPrototype.cpp:
+        (JSC::clz): Deleted.
+        (JSC::numberProtoFuncClz): Deleted.
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+        * tests/stress/math-clz32-basics.js: Added.
+        (mathClz32OnInteger):
+        (testMathClz32OnIntegers):
+        (verifyMathClz32OnIntegerWithOtherTypes):
+        (mathClz32OnDouble):
+        (testMathClz32OnDoubles):
+        (verifyMathClz32OnDoublesWithOtherTypes):
+        (mathClz32NoArguments):
+        (mathClz32TooManyArguments):
+        (testMathClz32OnConstants):
+        (mathClz32StructTransition):
+        (Math.clz32):
+
+2015-04-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Array.from need to accept iterables
+        https://bugs.webkit.org/show_bug.cgi?id=141055
+
+        Reviewed by Darin Adler.
+
+        ES6 spec requires that Array.from accepts iterable objects.
+        This patch introduces this functionality, Array.from accepting iterable objects.
+
+        Currently, `isConstructor` is not used. Instead of it, `typeof thiObj === "function"` is used.
+        However, it doesn't conform to the spec. While `isConstructor` queries the given object has `[[Construct]]`,
+        `typeof thisObj === "function"` queries the given object has `[[Call]]`.
+        This will be fixed in the subsequent patch[1].
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=144093
+
+        * builtins/ArrayConstructor.js:
+        (from):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * tests/stress/array-from-with-iterable.js: Added.
+        (shouldBe):
+        (.set for):
+        (.set var):
+        (.get var):
+        (argumentsGenerators):
+        (.set shouldBe):
+        (.set new):
+        * tests/stress/array-from-with-iterator.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (createIterator.iterator.return):
+        (createIterator):
+        (.):
+
+2015-04-25  Jordan Harband  <ljharb@gmail.com>
+
+        Set#keys !== Set#values
+        https://bugs.webkit.org/show_bug.cgi?id=144190
+
+        Reviewed by Darin Adler.
+
+        per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-set.prototype.keys
+        Set#keys should === Set#values
+
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        (JSC::setProtoFuncValues):
+        (JSC::setProtoFuncEntries):
+        (JSC::setProtoFuncKeys): Deleted.
+
+2015-04-25  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Allow for pausing a JSContext when opening a Web Inspector
+        <rdar://problem/20564788>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        * inspector/remote/RemoteInspectorConstants.h:
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        On any incoming setup message, we may want to automatically
+        pause the debuggable. If requested, pause the debuggable
+        after we have setup the frontend connection.
+
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::pause):
+        Pass through to the inspector controller.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::pause):
+        Enable pause on next statement.
+
+2015-04-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        class methods should be non-enumerable
+        https://bugs.webkit.org/show_bug.cgi?id=143181
+
+        Reviewed by Darin Adler.
+
+        Fixed the bug by using Object.defineProperty to define methods.
+
+        This patch adds the concept of link time constants and uses it to resolve Object.defineProperty
+        inside CodeBlock's constructor since bytecode can be linked against multiple global objects.
+
+        * bytecode/CodeBlock.cpp: 
+        (JSC::CodeBlock::CodeBlock): Resolve link time constants that are used. Ignore ones with register
+        index of zero.
+        * bytecode/SpecialPointer.h: Added a new enum for link time constants. It currently contains
+        exactly one entry for Object.defineProperty.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::addConstant): Added. Like addConstant that takes JSValue, allocate a new
+        constant register for the link time constant we're adding.
+        (JSC::UnlinkedCodeBlock::registerIndexForLinkTimeConstant): Added.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitMoveLinkTimeConstant): Added. Like addConstantValue, allocate a new
+        register for the specified link time constant and notify UnlinkedCodeBlock about it.
+        (JSC::BytecodeGenerator::emitCallDefineProperty): Added. Create a new property descriptor and call
+        Object.defineProperty with it.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode): Make static and non-static getters and setters for classes
+        non-enumerable by using emitCallDefineProperty to define them.
+        (JSC::PropertyListNode::emitPutConstantProperty): Ditto for a non-accessor properties.
+        (JSC::ClassExprNode::emitBytecode): Make prototype.constructor non-enumerable and make prototype
+        property on the class non-writable, non-configurable, and non-enumerable by using defineProperty.
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Set m_definePropertyFunction.
+        (JSC::JSGlobalObject::visitChildren): Visit m_definePropertyFunction.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::definePropertyFunction): Added.
+        (JSC::JSGlobalObject::actualPointerFor): Added a variant that takes LinkTimeConstant.
+        (JSC::JSGlobalObject::jsCellForLinkTimeConstant): Like actualPointerFor, takes LinkTimeConstant and
+        returns a JSCell; e.g. Object.defineProperty.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::addDefineProperty): Added. Returns Object.defineProperty.
+        * runtime/ObjectConstructor.h:
+
+2015-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement String.fromCodePoint
+        https://bugs.webkit.org/show_bug.cgi?id=144160
+
+        Reviewed by Darin Adler.
+
+        This patch implements String.fromCodePoint.
+        It accepts multiple code points and generates a string that consists of given code points.
+        The range [0x0000 - 0x10FFFF] is valid for code points.
+        If the given value is out of range, throw a range error.
+
+        When a 0xFFFF <= valid code point is given,
+        String.fromCodePoint generates a string that contains surrogate pairs.
+
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCodePoint):
+        (JSC::constructWithStringConstructor):
+        * tests/stress/string-from-code-point.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (toCodePoints):
+        (passThrough):
+
+2015-04-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Rename ENABLE_3D_RENDERING to ENABLE_3D_TRANSFORMS
+        https://bugs.webkit.org/show_bug.cgi?id=144182
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig: Replace all instances of 3D_RENDERING with 3D_TRANSFORMS.
+
+2015-04-25  Mark Lam  <mark.lam@apple.com>
+
+        mayExit() is wrong about Branch nodes with ObjectOrOtherUse: they can exit.
+        https://bugs.webkit.org/show_bug.cgi?id=144152
+
+        Reviewed by Filip Pizlo.
+
+        Changed the EdgeMayExit functor to recognize ObjectUse, ObjectOrOtherUse,
+        StringObjectUse, and StringOrStringObjectUse kinds as potentially triggering
+        OSR exits.  This was overlooked in the original code.
+
+        While only the ObjectOrOtherUse kind is relevant for manifesting this bug with
+        the Branch node, the other 3 may also trigger the same bug for other nodes.
+        To prevent this bug from manifesting with other nodes (and future ones that
+        are yet to be added to mayExits()'s "potential won't exit" set), we fix the
+        EdgeMayExit functor to handle all 4 use kinds (instead of just ObjectOrOtherUse).
+
+        Also added a test to exercise a code path that will trigger this bug with
+        the Branch node before the fix is applied.
+
+        * dfg/DFGMayExit.cpp:
+        * tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js: Added.
+        (inlinedFunction):
+        (foo):
+
+2015-04-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r183288.
+        https://bugs.webkit.org/show_bug.cgi?id=144189
+
+        Made js/sort-with-side-effecting-comparisons.html time out in
+        debug builds (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "It shouldn't take 1846 lines of code and 5 FIXMEs to sort an
+        array."
+        https://bugs.webkit.org/show_bug.cgi?id=144013
+        http://trac.webkit.org/changeset/183288
+
+2015-04-24  Filip Pizlo  <fpizlo@apple.com>
+
+        CRASH in operationCreateDirectArgumentsDuringExit()
+        https://bugs.webkit.org/show_bug.cgi?id=143962
+
+        Reviewed by Geoffrey Garen.
+        
+        We shouldn't assume that constant-like OSR exit values are always recoverable. They are only
+        recoverable so long as they are live. Therefore, OSR exit should track liveness of
+        constants instead of assuming that they are always live.
+
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::noticeOSRBirth):
+        (JSC::DFG::GenerationInfo::appendBirth):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGVariableEvent.cpp:
+        (JSC::DFG::VariableEvent::dump):
+        * dfg/DFGVariableEvent.h:
+        (JSC::DFG::VariableEvent::birth):
+        (JSC::DFG::VariableEvent::id):
+        (JSC::DFG::VariableEvent::dataFormat):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * tests/stress/phantom-direct-arguments-clobber-argument-count.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/phantom-direct-arguments-clobber-callee.js: Added.
+        (foo):
+        (bar):
+
+2015-04-24  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] When inserting a NaN into a Int32 array, we convert it to DoubleArray then to ContiguousArray
+        https://bugs.webkit.org/show_bug.cgi?id=144169
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::convertInt32ForValue):
+        DoubleArray do not store NaN, they are used for holes.
+        What happened was:
+        1) We fail to insert the NaN in the Int32 array because it is a double.
+        2) We were converting the array to DoubleArray.
+        3) We were trying to insert the value again. We would fail again because
+           DoubleArray does not store NaN.
+        4) We would convert the DoubleArrayt to Contiguous Array, converting the values
+           to boxed values.
+
+        * tests/stress/int32array-transition-on-nan.js: Added.
+        The behavior is not really observable. This only test nothing crashes in those
+        cases.
+
+        (insertNaNWhileFilling):
+        (testInsertNaNWhileFilling):
+        (insertNaNAfterFilling):
+        (testInsertNaNAfterFilling):
+        (pushNaNWhileFilling):
+        (testPushNaNWhileFilling):
+
+2015-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        It shouldn't take 1846 lines of code and 5 FIXMEs to sort an array.
+        https://bugs.webkit.org/show_bug.cgi?id=144013
+
+        Reviewed by Mark Lam.
+
+        This patch implements Array.prototype.sort in JavaScript, removing the
+        C++ implementations. It is simpler and less error-prone to express our
+        operations in JavaScript, which provides memory safety, exception safety,
+        and recursion safety.
+
+        The performance result is mixed, but net positive in my opinion. It's
+        difficult to enumerate all the results, since we used to have so many
+        different sorting modes, and there are lots of different data patterns
+        across which you might want to measure sorting. Suffice it to say:
+
+            (*) The benchmarks we track are faster or unchanged.
+
+            (*) Sorting random input using a comparator -- which we think is
+            common -- is 3X faster.
+
+            (*) Sorting random input in a non-array object -- which jQuery does
+            -- is 4X faster.
+
+            (*) Sorting random input in a compact array of integers using a
+            trivial pattern-matchable comparator is 2X *slower*.
+
+        * builtins/Array.prototype.js:
+        (sort.min):
+        (sort.stringComparator):
+        (sort.compactSparse): Special case compaction for sparse arrays because
+        we don't want to hang when sorting new Array(BIG).
+
+        (sort.compact):
+        (sort.merge):
+        (sort.mergeSort): Use merge sort because it's a reasonably efficient
+        stable sort. We have evidence that some sites depend on stable sort,
+        even though the ES6 spec does not mandate it. (See
+        <http://trac.webkit.org/changeset/33967>.)
+
+        This is a textbook implementation of merge sort with three optimizations:
+
+            (1) Use iteration instead of recursion;
+
+            (2) Use array subscripting instead of array copying in order to
+            create logical sub-lists without creating physical sub-lists;
+
+            (3) Swap src and dst at each iteration instead of copying src into
+            dst, and only copy src into the subject array at the end if src is
+            not the subject array.
+
+        (sort.inflate):
+        (sort.comparatorSort):
+        (sort): Sort in JavaScript for the win.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal): Allow non-private
+        names so we can use helper functions.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isNumericCompareFunction): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::setIsNumericCompareFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::isNumericCompareFunction): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::setIsNumericCompareFunction): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionNode::emitBytecode): We don't do this special casing based
+        on pattern matching anymore. This was mainly an optimization to avoid 
+        the overhead of calling from C++ to JS, which we now avoid by
+        sorting in JS.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::pushTempSortVector): Deleted.
+        (JSC::Heap::popTempSortVector): Deleted.
+        (JSC::Heap::visitTempSortVectors): Deleted.
+        * heap/Heap.h: We don't have temp sort vectors anymore because we sort
+        in JavaScript using a normal JavaScript array for our temporary storage.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner): Allow capturing so we can use
+        helper functions.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction): Deleted.
+        (JSC::attemptFastSort): Deleted.
+        (JSC::performSlowSort): Deleted.
+        (JSC::arrayProtoFuncSort): Deleted.
+
+        * runtime/CommonIdentifiers.h: New strings used by sort.
+
+        * runtime/JSArray.cpp:
+        (JSC::compareNumbersForQSortWithInt32): Deleted.
+        (JSC::compareNumbersForQSortWithDouble): Deleted.
+        (JSC::compareNumbersForQSort): Deleted.
+        (JSC::compareByStringPairForQSort): Deleted.
+        (JSC::JSArray::sortNumericVector): Deleted.
+        (JSC::JSArray::sortNumeric): Deleted.
+        (JSC::ContiguousTypeAccessor::getAsValue): Deleted.
+        (JSC::ContiguousTypeAccessor::setWithValue): Deleted.
+        (JSC::ContiguousTypeAccessor::replaceDataReference): Deleted.
+        (JSC::ContiguousTypeAccessor<ArrayWithDouble>::getAsValue): Deleted.
+        (JSC::ContiguousTypeAccessor<ArrayWithDouble>::setWithValue): Deleted.
+        (JSC::ContiguousTypeAccessor<ArrayWithDouble>::replaceDataReference): Deleted.
+        (JSC::JSArray::sortCompactedVector): Deleted.
+        (JSC::JSArray::sort): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::get_less): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::set_less): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::get_greater): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::set_greater): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::get_balance_factor): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::set_balance_factor): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_node): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_node_node): Deleted.
+        (JSC::AVLTreeAbstractorForArrayCompare::null): Deleted.
+        (JSC::JSArray::sortVector): Deleted.
+        (JSC::JSArray::compactForSorting): Deleted.
+        * runtime/JSArray.h:
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation): Provide some builtins used
+        by sort.
+
+2015-04-24  Matthew Mirman  <mmirman@apple.com>
+
+        Made Object.prototype.__proto__ native getter and setter check that this object not null or undefined
+        https://bugs.webkit.org/show_bug.cgi?id=141865
+        rdar://problem/19927273
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+
+2015-04-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove a useless branch on DFGGraph::addShouldSpeculateMachineInt()
+        https://bugs.webkit.org/show_bug.cgi?id=144118
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateMachineInt):
+        Both block do the same thing.
+
+2015-04-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Speculative fix for non-main thread auto-attach failures
+        https://bugs.webkit.org/show_bug.cgi?id=144134
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::singleton):
+
+2015-04-23  Basile Clement  <basile_clement@apple.com>
+
+        Allow function allocation sinking
+        https://bugs.webkit.org/show_bug.cgi?id=144016
+
+        Reviewed by Filip Pizlo.
+
+        This adds the ability to sink function allocations in the
+        DFGObjectAllocationSinkingPhase.
+
+        In order to enable this, we add a new PhantomNewFunction node that is
+        used similarily to the PhantomNewObject node, i.e. as a placeholder to replace
+        a sunk NewFunction and keep track of the allocations that have to be performed
+        in case of OSR exit after the sunk allocation but before the real one.
+        The FunctionExecutable and JSLexicalEnvironment (activation) of the function
+        are stored onto the PhantomNewFunction through PutHints in order for them
+        to be recovered on OSR exit.
+
+        Contrary to sunk object allocations, sunk function allocations do not
+        support any kind of operations (e.g. storing into a field) ; any such operation
+        will mark the function allocation as escaping and trigger materialization. As
+        such, function allocations can only be sunk to places where it would have been
+        correct to syntactically move them, and we don't need a special
+        MaterializeNewFunction node to recover possible operations on the function. A
+        sunk NewFunction node will simply create new NewFunction nodes, then replace
+        itself with a PhantomNewFunction node.
+
+        In itself, this change is not expected to have a significant impact on
+        performances other than in degenerate cases (see e.g.
+        JSRegress/sink-function), but it is a step towards being able to sink recursive
+        closures onces we support CreateActivation sinking as well as allocation cycles
+        sinking.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomNewFunction):
+        (JSC::DFG::Node::isPhantomAllocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        (JSC::DFG::ObjectAllocationSinkingPhase::createMaterialize):
+        (JSC::DFG::ObjectAllocationSinkingPhase::populateMaterialize):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPromotedHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * tests/stress/function-sinking-no-double-allocate.js: Added.
+        (call):
+        (.f):
+        (sink):
+        * tests/stress/function-sinking-osrexit.js: Added.
+        (.g):
+        (sink):
+        * tests/stress/function-sinking-put.js: Added.
+        (.g):
+        (sink):
+
+2015-04-23  Basile Clement  <basile_clement@apple.com>
+
+        Make FunctionRareData allocation thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=144001
+
+        Reviewed by Mark Lam.
+
+        The two things we want to prevent are:
+
+         1. A thread seeing a pointer to a not-yet-fully-created rare data from
+            a JSFunction
+         2. A thread seeing a pointer to a not-yet-fully-created Structure from
+            an ObjectAllocationProfile
+
+        For 1., only the JS thread can be creating the rare data (in
+        runtime/CommonSlowPaths.cpp or in dfg/DFGOperations.cpp), so we don't need to
+        worry about concurrent writes, and we don't need any fences when *reading* the
+        rare data from the JS thread. Thus we only need a storeStoreFence between the
+        rare data creation and assignment to m_rareData in
+        JSFunction::createAndInitializeRareData() to ensure that when the store to
+        m_rareData is issued, the rare data has been properly created.
+
+        For the DFG compilation threads, the only place they can access the
+        rare data is through JSFunction::rareData(), and so we only need a
+        loadLoadFence there to ensure that when we see a non-null pointer in
+        m_rareData, the pointed object will be seen as a fully created
+        FunctionRareData.
+
+
+        For 2., the structure is created in
+        ObjectAllocationProfile::initialize() (which appears to be called only by the
+        JS thread as well, in bytecode/CodeBlock.cpp and on rare data initialization,
+        which always happen in the JS thread), and read through
+        ObjectAllocationProfile::structure() and
+        ObjectAllocationProfile::inlineCapacity(), so following the same reasoning we
+        put a storeStoreFence in ObjectAllocationProfile::initialize() and a
+        loadLoadFence in ObjectAllocationProfile::structure() (and change
+        ObjectAllocationProfile::inlineCapacity() to go through
+        ObjectAllocationProfile::structure()).
+
+        We don't need a fence in ObjectAllocationProfile::clear() because
+        clearing the structure is already as atomic as it gets.
+
+        Finally, notice that we don't care about the ObjectAllocationProfile's
+        m_allocator as that is only used by ObjectAllocationProfile::initialize() and
+        ObjectAllocationProfile::clear() that are always run in the JS thread.
+        ObjectAllocationProfile::isNull() could cause some trouble, but it is
+        currently only used in the ObjectAllocationProfile::clear()'s ASSERT in the JS
+        thread.  Doing isNull()-style pre-checks would be wrong in any other concurrent
+        thread anyway.
+
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::initialize):
+        (JSC::ObjectAllocationProfile::structure):
+        (JSC::ObjectAllocationProfile::inlineCapacity):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::allocateAndInitializeRareData):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::rareData):
+        (JSC::JSFunction::allocationStructure): Deleted.
+        This is no longer used, as all the accesses to the ObjectAllocationProfile go through the rare data.
+
+2015-04-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should insert Phantoms late using BytecodeKills and block-local OSR availability
+        https://bugs.webkit.org/show_bug.cgi?id=143735
+
+        Reviewed by Geoffrey Garen.
+        
+        We've always had bugs arising from the fact that we would MovHint something into a local,
+        and then fail to keep it alive. We would then try to keep things alive by putting Phantoms
+        on those Nodes that were MovHinted. But this became increasingly tricky. Given the
+        sophistication of the transformations we are doing today, this approach is just not sound
+        anymore.
+        
+        This comprehensively fixes these bugs by having the DFG backend automatically insert
+        Phantoms just before codegen based on bytecode liveness. To make this practical, this also
+        makes it much faster to query bytecode liveness.
+        
+        It's about as perf-neutral as it gets for a change that increases compiler work without
+        actually optimizing anything. Later changes will remove the old Phantom-preserving logic,
+        which should then speed us up. I can't really report concrete slow-down numbers because
+        they are low enough to basically be in the noise. For example, a 20-iteration run of
+        SunSpider yields "maybe 0.8% slower", whatever that means.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
+        * bytecode/FullBytecodeLiveness.h:
+        (JSC::FullBytecodeLiveness::getLiveness):
+        * bytecode/VirtualRegister.h:
+        (JSC::VirtualRegister::operator+):
+        (JSC::VirtualRegister::operator-):
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllLiveNodesAtTail):
+        (JSC::DFG::forAllKilledOperands):
+        (JSC::DFG::forAllKilledNodesAtNodeIndex):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isLiveInBytecode):
+        (JSC::DFG::Graph::localsLiveInBytecode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
+        (JSC::DFG::Graph::forAllLiveInBytecode):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGMovHintRemovalPhase.cpp:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPhantomInsertionPhase.cpp: Added.
+        (JSC::DFG::performPhantomInsertion):
+        * dfg/DFGPhantomInsertionPhase.h: Added.
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGScoreBoard.h:
+        (JSC::DFG::ScoreBoard::sortFree):
+        (JSC::DFG::ScoreBoard::assertClear):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        * tests/stress/phantom-inadequacy.js: Added.
+        (bar):
+        (baz):
+        (foo):
+
+2015-04-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename HardPhantom to MustGenerate.
+
+        Rubber stamped by Geoffrey Garen.
+        
+        We are steadily moving towards Phantom just being a backend hack in the DFG. HardPhantom
+        is more than that; it's a utility for forcing the execution of otherwise killable nodes.
+        NodeMustGenerate is the flag we use to indicate that something isn't killable. So this
+        node should just be called MustGenerate.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::tryToRelaxRepresentation):
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::insertMustAdd):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGPhantomCanonicalizationPhase.cpp:
+        (JSC::DFG::PhantomCanonicalizationPhase::run):
+        * dfg/DFGPhantomRemovalPhase.cpp:
+        (JSC::DFG::PhantomRemovalPhase::run):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+
+2015-04-23  Jordan Harband  <ljharb@gmail.com>
+
+        Implement `Object.assign`
+        https://bugs.webkit.org/show_bug.cgi?id=143980
+
+        Reviewed by Filip Pizlo.
+
+        per https://people.mozilla.org/~jorendorff/es6-draft.html#sec-object.assign
+
+        * builtins/ObjectConstructor.js: Added.
+        (assign):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/ObjectConstructor.cpp:
+        * runtime/ObjectConstructor.h:
+
+2015-04-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix debug build.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::performSubstitutionForEdge):
+
+2015-04-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Nodes should have an optional epoch field
+        https://bugs.webkit.org/show_bug.cgi?id=144084
+
+        Reviewed by Ryosuke Niwa and Mark Lam.
+        
+        This makes it easier to do epoch-based analyses on nodes. I plan to do just that in
+        https://bugs.webkit.org/show_bug.cgi?id=143735. Currently the epoch field is not yet
+        used.
+
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGEpoch.h:
+        (JSC::DFG::Epoch::fromUnsigned):
+        (JSC::DFG::Epoch::toUnsigned):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::clearReplacements):
+        (JSC::DFG::Graph::clearEpochs):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::performSubstitutionForEdge):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::replaceWith):
+        (JSC::DFG::Node::replacement):
+        (JSC::DFG::Node::setReplacement):
+        (JSC::DFG::Node::epoch):
+        (JSC::DFG::Node::setEpoch):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+
+2015-04-22  Mark Lam  <mark.lam@apple.com>
+
+        Fix assertion failure and race condition in Options::dumpSourceAtDFGTime().
+        https://bugs.webkit.org/show_bug.cgi?id=143898
+
+        Reviewed by Filip Pizlo.
+
+        CodeBlock::dumpSource() will access SourceCode strings in a way that requires
+        ref'ing of the underlying StringImpls. This is unsafe to do from arbitrary
+        compilation threads because StringImpls are not thread safe. As a result, we get
+        an assertion failure when we run with JSC_dumpSourceAtDFGTime=true on a debug
+        build.
+
+        This patch fixes the issue by only collecting the CodeBlock (and associated info)
+        into a DeferredSourceDump record while compiling, and stashing it away in a
+        deferredSourceDump list in the DeferredCompilationCallback object to be dumped
+        later.
+
+        When compilation is done, the callback object will be notified that
+        compilationDidComplete().  We will dump the SourceCode strings from there. 
+        Since compilationDidComplete() is guaranteed to only be called on the thread
+        doing JS execution, it is safe to access the SourceCode strings there and ref
+        their underlying StringImpls as needed.        
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/DeferredCompilationCallback.cpp:
+        (JSC::DeferredCompilationCallback::compilationDidComplete):
+        (JSC::DeferredCompilationCallback::sourceDumpInfo):
+        (JSC::DeferredCompilationCallback::dumpCompiledSources):
+        * bytecode/DeferredCompilationCallback.h:
+        * bytecode/DeferredSourceDump.cpp: Added.
+        (JSC::DeferredSourceDump::DeferredSourceDump):
+        (JSC::DeferredSourceDump::dump):
+        * bytecode/DeferredSourceDump.h: Added.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+
+2015-04-22  Benjamin Poulain  <benjamin@webkit.org>
+
+        Implement String.codePointAt()
+        https://bugs.webkit.org/show_bug.cgi?id=143934
+
+        Reviewed by Darin Adler.
+
+        This patch adds String.codePointAt() as defined by ES6.
+        I opted for a C++ implementation for now.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::codePointAt):
+        (JSC::stringProtoFuncCodePointAt):
+
+2015-04-22  Mark Lam  <mark.lam@apple.com>
+
+        SparseArrayEntry's write barrier owner should be the SparseArrayValueMap.
+        https://bugs.webkit.org/show_bug.cgi?id=144067
+
+        Reviewed by Michael Saboff.
+
+        Currently, there are a few places where the JSObject that owns the
+        SparseArrayValueMap is designated as the owner of the SparseArrayEntry
+        write barrier.  This is a bug and can result in the GC collecting the
+        SparseArrayEntry even though it is being referenced by the
+        SparseArrayValueMap.  This patch fixes the bug.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
+        (JSC::JSObject::putIndexedDescriptor):
+        * tests/stress/sparse-array-entry-update-144067.js: Added.
+        (useMemoryToTriggerGCs):
+        (foo):
+
+2015-04-22  Mark Lam  <mark.lam@apple.com>
+
+        Give the heap object iterators the ability to return early.
+        https://bugs.webkit.org/show_bug.cgi?id=144011
+
+        Reviewed by Michael Saboff.
+
+        JSDollarVMPrototype::isValidCell() uses a heap object iterator to validate
+        candidate cell pointers, and, when in use, is called a lot more often than
+        the normal way those iterators are used.  As a result, I see my instrumented
+        VM killed with a SIGXCPU (CPU time limit exceeded).  This patch gives the
+        callback functor the ability to tell the iterators to return early when the
+        functor no longer needs to continue iterating.  With this, my instrumented
+        VM is useful again for debugging.
+
+        Since heap iteration is not something that we do in a typical fast path,
+        I don't expect this to have any noticeable impact on performance.
+
+        I also renamed ObjectAddressCheckFunctor to CellAddressCheckFunctor since
+        it checks JSCell addresses, not just JSObjects.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        * heap/GCLogging.cpp:
+        (JSC::LoggingFunctor::operator()):
+        * heap/Heap.cpp:
+        (JSC::Zombify::visit):
+        (JSC::Zombify::operator()):
+        * heap/HeapStatistics.cpp:
+        (JSC::StorageStatistics::visit):
+        (JSC::StorageStatistics::operator()):
+        * heap/HeapVerifier.cpp:
+        (JSC::GatherLiveObjFunctor::visit):
+        (JSC::GatherLiveObjFunctor::operator()):
+        * heap/MarkedBlock.cpp:
+        (JSC::SetNewlyAllocatedFunctor::operator()):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::forEachCell):
+        (JSC::MarkedBlock::forEachLiveCell):
+        (JSC::MarkedBlock::forEachDeadCell):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::forEachLiveCell):
+        (JSC::MarkedSpace::forEachDeadCell):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::TypeRecompiler::visit):
+        (Inspector::TypeRecompiler::operator()):
+        * runtime/IterationStatus.h: Added.
+        * runtime/JSGlobalObject.cpp:
+        * runtime/VM.cpp:
+        (JSC::StackPreservingRecompiler::visit):
+        (JSC::StackPreservingRecompiler::operator()):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::CellAddressCheckFunctor::CellAddressCheckFunctor):
+        (JSC::CellAddressCheckFunctor::operator()):
+        (JSC::JSDollarVMPrototype::isValidCell):
+        (JSC::ObjectAddressCheckFunctor::ObjectAddressCheckFunctor): Deleted.
+        (JSC::ObjectAddressCheckFunctor::operator()): Deleted.
+
+2015-04-22  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [[Set]] should be properly executed in JS builtins
+        https://bugs.webkit.org/show_bug.cgi?id=143996
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, all assignments in builtins JS code is compiled into put_by_val_direct.
+        However,
+
+        1. Some functions (like Array.from) needs [[Set]]. (but it is now compiled into put_by_val_direct, [[DefineOwnProperty]]).
+        2. It's different from the default JS behavior.
+
+        In this patch, we implement the bytecode intrinsic emitting put_by_val_direct and use it explicitly.
+        And dropping the current hack for builtins.
+
+        * builtins/Array.prototype.js:
+        (filter):
+        (map):
+        (find):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPutByVal):
+        * tests/stress/array-fill-put-by-val.js: Added.
+        (shouldThrow):
+        (.set get array):
+        * tests/stress/array-filter-put-by-val-direct.js: Added.
+        (shouldBe):
+        (.set get var):
+        * tests/stress/array-find-does-not-lookup-twice.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (.get shouldBe):
+        * tests/stress/array-from-put-by-val-direct.js: Added.
+        (shouldBe):
+        (.set get var):
+        * tests/stress/array-from-set-length.js: Added.
+        (shouldBe):
+        (ArrayLike):
+        (ArrayLike.prototype.set length):
+        (ArrayLike.prototype.get length):
+        * tests/stress/array-map-put-by-val-direct.js: Added.
+        (shouldBe):
+        (.set get var):
+
+2015-04-22  Basile Clement  <basile_clement@apple.com>
+ 
+        Don't de-allocate FunctionRareData
+        https://bugs.webkit.org/show_bug.cgi?id=144000
+
+        Reviewed by Michael Saboff.
+
+        A function rare data (containing most notably its allocation profile) is currently
+        freed and re-allocated each time the function's prototype is cleared.
+        This is not optimal as it means we are invalidating the watchpoint and recompiling the
+        scope each time the prototype is cleared.
+
+        This makes it so that a single rare data is reused, clearing the underlying
+        ObjectAllocationProfile instead of throwing away the whole rare data on
+        .prototype updates.
+
+        * runtime/FunctionRareData.cpp:
+        (JSC::FunctionRareData::create):
+        (JSC::FunctionRareData::finishCreation):
+        * runtime/FunctionRareData.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::allocateAndInitializeRareData):
+        (JSC::JSFunction::initializeRareData):
+
+2015-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix 32-bit. Forgot to make this simple change to 32_64 as well.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2015-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should allow Phantoms after terminals
+        https://bugs.webkit.org/show_bug.cgi?id=126778
+
+        Reviewed by Mark Lam.
+        
+        It's important for us to be able to place liveness-marking nodes after nodes that do
+        things. These liveness-marking nodes are nops. Previously, we disallowed such nodes after
+        terminals. That made things awkward, especially for Switch and Branch, which may do
+        things that necessitate liveness markers (for example they might want to use a converted
+        version of a value rather than the value that was MovHinted). We previously made this
+        work by disallowing certain optimizations on Switch and Branch, which was probably a bad
+        thing.
+        
+        This changes our IR to allow for the terminal to not be the last node in a block. Asking
+        for the terminal involves a search. DFG::validate() checks that the nodes after the
+        terminal are liveness markers that have no effects or checks.
+        
+        This is perf-neutral but will allow more optimizations in the future. It will also make
+        it cleaner to fix https://bugs.webkit.org/show_bug.cgi?id=143735.
+
+        * dfg/DFGBasicBlock.cpp:
+        (JSC::DFG::BasicBlock::replaceTerminal):
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::findTerminal):
+        (JSC::DFG::BasicBlock::terminal):
+        (JSC::DFG::BasicBlock::insertBeforeTerminal):
+        (JSC::DFG::BasicBlock::numSuccessors):
+        (JSC::DFG::BasicBlock::successor):
+        (JSC::DFG::BasicBlock::successorForCondition):
+        (JSC::DFG::BasicBlock::successors):
+        (JSC::DFG::BasicBlock::last): Deleted.
+        (JSC::DFG::BasicBlock::takeLast): Deleted.
+        (JSC::DFG::BasicBlock::insertBeforeLast): Deleted.
+        (JSC::DFG::BasicBlock::SuccessorsIterable::SuccessorsIterable): Deleted.
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::iterator): Deleted.
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator*): Deleted.
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator++): Deleted.
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator==): Deleted.
+        (JSC::DFG::BasicBlock::SuccessorsIterable::iterator::operator!=): Deleted.
+        (JSC::DFG::BasicBlock::SuccessorsIterable::begin): Deleted.
+        (JSC::DFG::BasicBlock::SuccessorsIterable::end): Deleted.
+        * dfg/DFGBasicBlockInlines.h:
+        (JSC::DFG::BasicBlock::appendNonTerminal):
+        (JSC::DFG::BasicBlock::replaceTerminal):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::linkBlock):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::run):
+        (JSC::DFG::CFGSimplificationPhase::convertToJump):
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::NodeAndIndex::NodeAndIndex):
+        (JSC::DFG::NodeAndIndex::operator!):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupBlock):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::injectTypeConversionsInBlock):
+        (JSC::DFG::FixupPhase::clearPhantomsAtEnd): Deleted.
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllLiveNodesAtTail):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::terminalsAreValid):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGGraph.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::mergeToSuccessors):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGMovHintRemovalPhase.cpp:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::SuccessorsIterable::SuccessorsIterable):
+        (JSC::DFG::Node::SuccessorsIterable::iterator::iterator):
+        (JSC::DFG::Node::SuccessorsIterable::iterator::operator*):
+        (JSC::DFG::Node::SuccessorsIterable::iterator::operator++):
+        (JSC::DFG::Node::SuccessorsIterable::iterator::operator==):
+        (JSC::DFG::Node::SuccessorsIterable::iterator::operator!=):
+        (JSC::DFG::Node::SuccessorsIterable::begin):
+        (JSC::DFG::Node::SuccessorsIterable::end):
+        (JSC::DFG::Node::successors):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::determineMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::placeMaterializationPoints):
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+        * dfg/DFGPhantomRemovalPhase.cpp:
+        (JSC::DFG::PhantomRemovalPhase::run):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStaticExecutionCountEstimationPhase.cpp:
+        (JSC::DFG::StaticExecutionCountEstimationPhase::run):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * tests/stress/closure-call-exit.js: Added.
+        (foo):
+
+2015-04-21  Basile Clement  <basile_clement@apple.com>
+
+        PhantomNewObject should be marked NodeMustGenerate
+        https://bugs.webkit.org/show_bug.cgi?id=143974
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomNewObject):
+        Was not properly marking NodeMustGenerate when converting.
+
+2015-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG Call/ConstructForwardVarargs fails to restore the stack pointer
+        https://bugs.webkit.org/show_bug.cgi?id=144007
+
+        Reviewed by Mark Lam.
+        
+        We were conditioning the stack pointer restoration on isVarargs, but we also need to do it
+        if isForwardVarargs.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * tests/stress/varargs-then-slow-call.js: Added.
+        (foo):
+        (bar):
+        (fuzz):
+        (baz):
+
+2015-04-21  Basile Clement  <basile_clement@apple.com>
+
+        Remove AllocationProfileWatchpoint node
+        https://bugs.webkit.org/show_bug.cgi?id=143999
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCellOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::rareData):
+        (JSC::JSFunction::allocationProfileWatchpointSet): Deleted.
+
+2015-04-19  Filip Pizlo  <fpizlo@apple.com>
+
+        MovHint should be a strong use
+        https://bugs.webkit.org/show_bug.cgi?id=143734
+
+        Reviewed by Geoffrey Garen.
+        
+        This disables any DCE that assumes equivalence between DFG IR uses and bytecode uses. Doing
+        so is a major step towards allowing more fancy DFG transformations and also probably fixing
+        some bugs.
+        
+        Just making MovHint a strong use would also completely disable DCE. So we mitigate this by
+        introducing a MovHint removal phase that runs in FTL.
+        
+        This is a slight slowdown on Octane/gbemu, but it's basically neutral on suite averages.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::dumpInContext):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::fixupBlock):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::createDumpList):
+        * dfg/DFGEpoch.cpp: Added.
+        (JSC::DFG::Epoch::dump):
+        * dfg/DFGEpoch.h: Added.
+        (JSC::DFG::Epoch::Epoch):
+        (JSC::DFG::Epoch::first):
+        (JSC::DFG::Epoch::operator!):
+        (JSC::DFG::Epoch::next):
+        (JSC::DFG::Epoch::bump):
+        (JSC::DFG::Epoch::operator==):
+        (JSC::DFG::Epoch::operator!=):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGMovHintRemovalPhase.cpp: Added.
+        (JSC::DFG::performMovHintRemoval):
+        * dfg/DFGMovHintRemovalPhase.h: Added.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/Options.h:
+
+2015-04-21  Basile Clement  <basile_clement@apple.com>
+
+        REGRESSION (r182899): icloud.com crashes
+        https://bugs.webkit.org/show_bug.cgi?id=143960
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::allocationStructure):
+        * tests/stress/dfg-rare-data.js: Added.
+        (F): Regression test
+
+2015-04-21  Michael Saboff  <msaboff@apple.com>
+
+        Crash in JSC::Interpreter::execute
+        https://bugs.webkit.org/show_bug.cgi?id=142625
+
+        Reviewed by Filip Pizlo.
+
+        We need to keep the FunctionExecutables in the code block for the eval flavor of 
+        Interpreter::execute() in order to create the scope used to eval.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettisonFunctionDeclsAndExprs): Deleted.
+        * bytecode/CodeBlock.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::registerFrozenValues):
+
+2015-04-21  Chris Dumez  <cdumez@apple.com>
+
+        Make Vector(const Vector<T, otherCapacity, otherOverflowBehaviour>&) constructor explicit
+        https://bugs.webkit.org/show_bug.cgi?id=143970
+
+        Reviewed by Darin Adler.
+
+        Make Vector(const Vector<T, otherCapacity, otherOverflowBehaviour>&)
+        constructor explicit as it copies the vector and it is easy to call it
+        by mistake.
+
+        * bytecode/UnlinkedInstructionStream.cpp:
+        (JSC::UnlinkedInstructionStream::UnlinkedInstructionStream):
+        * bytecode/UnlinkedInstructionStream.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+
+2015-04-20  Basile Clement  <basile_clement@apple.com>
+
+        PhantomNewObject should be marked NodeMustGenerate
+        https://bugs.webkit.org/show_bug.cgi?id=143974
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGNodeType.h: Mark PhantomNewObject as NodeMustGenerate
+
+2015-04-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Cleanup some StringBuilder use
+        https://bugs.webkit.org/show_bug.cgi?id=143550
+
+        Reviewed by Darin Adler.
+
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::descriptiveString):
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::typeInformationForExpressionAtOffset):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::toJSONString):
+        (JSC::StructureShape::propertyHash):
+        (JSC::StructureShape::stringRepresentation):
+        (JSC::StructureShape::toJSONString):
+
+2015-04-20  Mark Lam  <mark.lam@apple.com>
+
+        Add debugging tools to test if a given pointer is a valid object and in the heap.
+        https://bugs.webkit.org/show_bug.cgi?id=143910
+
+        Reviewed by Geoffrey Garen.
+
+        When doing debugging from lldb, sometimes, it is useful to be able to tell if a
+        purported JSObject is really a valid object in the heap or not.  We can add the
+        following utility functions to help:
+            isValidCell(heap, candidate) - returns true if the candidate is a "live" cell in the heap.
+            isInHeap(heap, candidate) - returns true if the candidate is the heap's Object space or Storage space.
+            isInObjectSpace(heap, candidate) - returns true if the candidate is the heap's Object space.
+            isInStorageSpace(heap, candidate) - returns true if the candidate is the heap's Storage space.
+
+        Also moved lldb callable debug utility function prototypes from
+        JSDollarVMPrototype.cpp to JSDollarVMPrototype.h as static members of the
+        JSDollarVMPrototype class.  This is so that we can conveniently #include that
+        file to get the prototypes when we need to call them programmatically from
+        instrumentation that we add while debugging an issue.
+
+        * heap/Heap.h:
+        (JSC::Heap::storageSpace):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::currentThreadOwnsJSLock):
+        (JSC::ensureCurrentThreadOwnsJSLock):
+        (JSC::JSDollarVMPrototype::gc):
+        (JSC::functionGC):
+        (JSC::JSDollarVMPrototype::edenGC):
+        (JSC::functionEdenGC):
+        (JSC::JSDollarVMPrototype::isInHeap):
+        (JSC::JSDollarVMPrototype::isInObjectSpace):
+        (JSC::JSDollarVMPrototype::isInStorageSpace):
+        (JSC::ObjectAddressCheckFunctor::ObjectAddressCheckFunctor):
+        (JSC::ObjectAddressCheckFunctor::operator()):
+        (JSC::JSDollarVMPrototype::isValidCell):
+        (JSC::JSDollarVMPrototype::isValidCodeBlock):
+        (JSC::JSDollarVMPrototype::codeBlockForFrame):
+        (JSC::functionCodeBlockForFrame):
+        (JSC::codeBlockFromArg):
+        (JSC::JSDollarVMPrototype::printCallFrame):
+        (JSC::JSDollarVMPrototype::printStack):
+        (JSC::JSDollarVMPrototype::printValue):
+        (JSC::currentThreadOwnsJSLock): Deleted.
+        (JSC::gc): Deleted.
+        (JSC::edenGC): Deleted.
+        (JSC::isValidCodeBlock): Deleted.
+        (JSC::codeBlockForFrame): Deleted.
+        (JSC::printCallFrame): Deleted.
+        (JSC::printStack): Deleted.
+        (JSC::printValue): Deleted.
+        * tools/JSDollarVMPrototype.h:
+
+2015-04-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Improve Support for WeakSet in Console
+        https://bugs.webkit.org/show_bug.cgi?id=143951
+
+        Reviewed by Darin Adler.
+
+        * inspector/InjectedScriptSource.js:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        (Inspector::JSInjectedScriptHost::weakSetSize):
+        (Inspector::JSInjectedScriptHost::weakSetEntries):
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetSize):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetEntries):
+        Treat WeakSets like special sets.
+
+        * inspector/protocol/Runtime.json:
+        Add a new object subtype, "weakset".
+
+2015-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        HashMap storing PropertyKey StringImpl* need to use IdentifierRepHash to handle Symbols
+        https://bugs.webkit.org/show_bug.cgi?id=143947
+
+        Reviewed by Darin Adler.
+
+        Type profiler has map between PropertyKey (StringImpl*) and offset.
+        StringImpl* is also used for Symbol PropertyKey.
+        So equality of hash tables is considered by interned StringImpl*'s pointer value.
+        To do so, use IdentifierRepHash instead of StringHash.
+
+        * runtime/SymbolTable.h:
+
+2015-04-20  Jordan Harband  <ljharb@gmail.com>
+
+        Implement `Object.is`
+        https://bugs.webkit.org/show_bug.cgi?id=143865
+
+        Reviewed by Darin Adler.
+
+        Expose sameValue to JS, via Object.is
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-object.is
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorIs):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::sameValue):
+
+2015-04-19  Darin Adler  <darin@apple.com>
+
+        Remove all the remaining uses of OwnPtr and PassOwnPtr in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=143941
+
+        Reviewed by Gyuyoung Kim.
+
+        * API/JSCallbackObject.h: Use unique_ptr for m_callbackObjectData.
+        * API/JSCallbackObjectFunctions.h: Ditto.
+
+        * API/ObjCCallbackFunction.h: Use unique_ptr for the arguments to the
+        create function and the constructor and for m_impl.
+        * API/ObjCCallbackFunction.mm:
+        (CallbackArgumentOfClass::CallbackArgumentOfClass): Streamline this
+        class by using RetainPtr<Class>.
+        (ArgumentTypeDelegate::typeInteger): Use make_unique.
+        (ArgumentTypeDelegate::typeDouble): Ditto.
+        (ArgumentTypeDelegate::typeBool): Ditto.
+        (ArgumentTypeDelegate::typeVoid): Ditto.
+        (ArgumentTypeDelegate::typeId): Ditto.
+        (ArgumentTypeDelegate::typeOfClass): Ditto.
+        (ArgumentTypeDelegate::typeBlock): Ditto.
+        (ArgumentTypeDelegate::typeStruct): Ditto.
+        (ResultTypeDelegate::typeInteger): Ditto.
+        (ResultTypeDelegate::typeDouble): Ditto.
+        (ResultTypeDelegate::typeBool): Ditto.
+        (ResultTypeDelegate::typeVoid): Ditto.
+        (ResultTypeDelegate::typeId): Ditto.
+        (ResultTypeDelegate::typeOfClass): Ditto.
+        (ResultTypeDelegate::typeBlock): Ditto.
+        (ResultTypeDelegate::typeStruct): Ditto.
+        (JSC::ObjCCallbackFunctionImpl::ObjCCallbackFunctionImpl): Use
+        unique_ptr for the arguments to the constructor, m_arguments, and m_result.
+        Use RetainPtr<Class> for m_instanceClass.
+        (JSC::objCCallbackFunctionCallAsConstructor): Use nullptr instead of nil or 0
+        for non-Objective-C object pointer null.
+        (JSC::ObjCCallbackFunction::ObjCCallbackFunction): Use unique_ptr for
+        the arguments to the constructor and for m_impl.
+        (JSC::ObjCCallbackFunction::create): Use unique_ptr for arguments.
+        (skipNumber): Mark this static since it's local to this source file.
+        (objCCallbackFunctionForInvocation): Call parseObjCType without doing any
+        explicit adoptPtr since the types in the traits are now unique_ptr. Also use
+        nullptr instead of nil for JSObjectRef values.
+        (objCCallbackFunctionForMethod): Tweaked comment.
+        (objCCallbackFunctionForBlock): Use nullptr instead of 0 for JSObjectRef.
+
+        * bytecode/CallLinkInfo.h: Removed unneeded include of OwnPtr.h.
+
+        * heap/GCThread.cpp:
+        (JSC::GCThread::GCThread): Use unique_ptr.
+        * heap/GCThread.h: Use unique_ptr for arguments to the constructor and for
+        m_slotVisitor and m_copyVisitor.
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData): Ditto.
+
+        * parser/SourceProvider.h: Removed unneeded include of PassOwnPtr.h.
+
+2015-04-19  Benjamin Poulain  <benjamin@webkit.org>
+
+        Improve the feature.json files
+
+        * features.json:
+
+2015-04-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Introduce bytecode intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=143926
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces bytecode level intrinsics into builtins/*.js JS code.
+        When implementing functions in builtins/*.js,
+        sometimes we require lower level functionality.
+
+        For example, in the current Array.from, we use `result[k] = value`.
+        The spec requires `[[DefineOwnProperty]]` operation here.
+        However, usual `result[k] = value` is evaluated as `[[Set]]`. (`PutValue` => `[[Set]]`)
+        So if we implement `Array.prototype[k]` getter/setter, the difference is observable.
+
+        Ideally, reaching here, we would like to use put_by_val_direct bytecode.
+        However, there's no syntax to generate it directly.
+
+        This patch introduces bytecode level intrinsics into JSC BytecodeCompiler.
+        Like @call, @apply, we introduce a new node, Intrinsic.
+        These are generated when calling appropriate private symbols in privileged code.
+        AST parser detects them and generates Intrinsic nodes and
+        BytecodeCompiler detects them and generate required bytecodes.
+
+        Currently, Array.from implementation works fine without this patch.
+        This is because when the target code is builtin JS,
+        BytecodeGenerator emits put_by_val_direct instead of put_by_val.
+        This solves the above issue. However, instead of solving this issue,
+        it raises another issue; There's no way to emit `[[Set]]` operation.
+        `[[Set]]` operation is actually used in the spec (Array.from's "length" is set by `[[Set]]`).
+        So to implement it precisely, introducing bytecode level intrinsics is necessary.
+
+        In the subsequent fixes, we'll remove that special path emitting put_by_val_direct
+        for `result[k] = value` under builtin JS environment. Instead of that special handling,
+        use bytecode intrinsics instead. It solves problems and it is more intuitive
+        because written JS code in builtin works as the same to the usual JS code.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ArrayConstructor.js:
+        (from):
+        * bytecode/BytecodeIntrinsicRegistry.cpp: Added.
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h: Added.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emitBytecode):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_putByValDirect):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        * parser/NodeConstructors.h:
+        (JSC::BytecodeIntrinsicNode::BytecodeIntrinsicNode):
+        * parser/Nodes.h:
+        (JSC::BytecodeIntrinsicNode::identifier):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        (JSC::CommonIdentifiers::bytecodeIntrinsicRegistry):
+        * tests/stress/array-from-with-accessors.js: Added.
+        (shouldBe):
+
+2015-04-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Make Builtin functions non constructible
+        https://bugs.webkit.org/show_bug.cgi?id=143923
+
+        Reviewed by Darin Adler.
+
+        Builtin functions defined by builtins/*.js accidentally have [[Construct]].
+        According to the spec, these functions except for explicitly defined as a constructor do not have [[Construct]].
+        This patch fixes it. When the JS function used for a construction is builtin function, throw not a constructor error.
+
+        Ideally, returning ConstructTypeNone in JSFunction::getConstructData is enough.
+        However, to avoid calling getConstructData (it involves indirect call of function pointer of getConstructData), some places do not check ConstructType.
+        In these places, they only check the target function is JSFunction because previously JSFunction always has [[Construct]].
+        So in this patch, we check `isBuiltinFunction()` in those places.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getConstructData):
+        * tests/stress/builtin-function-is-construct-type-none.js: Added.
+        (shouldThrow):
+
+2015-04-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement WeakSet
+        https://bugs.webkit.org/show_bug.cgi?id=142408
+
+        Reviewed by Darin Adler.
+
+        This patch implements ES6 WeakSet.
+        Current implementation simply leverages WeakMapData with undefined value.
+        This WeakMapData should be optimized in the same manner as MapData/SetData in the subsequent patch[1].
+
+        And in this patch, we also fix WeakMap/WeakSet behavior to conform the ES6 spec.
+        Except for adders (WeakMap.prototype.set/WeakSet.prototype.add),
+        methods return false (or undefined for WeakMap.prototype.get)
+        when a key is not Object instead of throwing a type error.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=143919
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSWeakSet.cpp: Added.
+        (JSC::JSWeakSet::finishCreation):
+        (JSC::JSWeakSet::visitChildren):
+        * runtime/JSWeakSet.h: Added.
+        (JSC::JSWeakSet::createStructure):
+        (JSC::JSWeakSet::create):
+        (JSC::JSWeakSet::weakMapData):
+        (JSC::JSWeakSet::JSWeakSet):
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::getWeakMapData):
+        (JSC::protoFuncWeakMapDelete):
+        (JSC::protoFuncWeakMapGet):
+        (JSC::protoFuncWeakMapHas):
+        * runtime/WeakSetConstructor.cpp: Added.
+        (JSC::WeakSetConstructor::finishCreation):
+        (JSC::callWeakSet):
+        (JSC::constructWeakSet):
+        (JSC::WeakSetConstructor::getConstructData):
+        (JSC::WeakSetConstructor::getCallData):
+        * runtime/WeakSetConstructor.h: Added.
+        (JSC::WeakSetConstructor::create):
+        (JSC::WeakSetConstructor::createStructure):
+        (JSC::WeakSetConstructor::WeakSetConstructor):
+        * runtime/WeakSetPrototype.cpp: Added.
+        (JSC::WeakSetPrototype::finishCreation):
+        (JSC::getWeakMapData):
+        (JSC::protoFuncWeakSetDelete):
+        (JSC::protoFuncWeakSetHas):
+        (JSC::protoFuncWeakSetAdd):
+        * runtime/WeakSetPrototype.h: Added.
+        (JSC::WeakSetPrototype::create):
+        (JSC::WeakSetPrototype::createStructure):
+        (JSC::WeakSetPrototype::WeakSetPrototype):
+        * tests/stress/weak-set-constructor-adder.js: Added.
+        (WeakSet.prototype.add):
+        * tests/stress/weak-set-constructor.js: Added.
+
+2015-04-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Remove unused BoundsCheckedPointer
+        https://bugs.webkit.org/show_bug.cgi?id=143896
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/SpeculatedType.cpp: The header was included here.
+
+2015-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Fix name enumeration of static functions for Symbol constructor
+        https://bugs.webkit.org/show_bug.cgi?id=143891
+
+        Reviewed by Geoffrey Garen.
+
+        Fix missing symbolPrototypeTable registration to the js class object.
+        This patch fixes name enumeration of static functions (Symbol.key, Symbol.keyFor) for Symbol constructor.
+
+        * runtime/SymbolConstructor.cpp:
+
+2015-04-17  Basile Clement  <basile_clement@apple.com>
+
+        Inline JSFunction allocation in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=143858
+
+        Reviewed by Filip Pizlo.
+
+        Followup to my previous patch which inlines JSFunction allocation when
+        using FTL, now also enabled in DFG.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+
+2015-04-16  Jordan Harband  <ljharb@gmail.com>
+
+        Number.parseInt is not === global parseInt in nightly r182673
+        https://bugs.webkit.org/show_bug.cgi?id=143799
+
+        Reviewed by Darin Adler.
+
+        Ensuring parseInt === Number.parseInt, per spec
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-number.parseint
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::parseIntFunction):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+
+2015-04-16  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix CLOOP build after r182927.
+
+        Not reviewed.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::print):
+
+2015-04-16  Basile Clement  <basile_clement@apple.com>
+
+        Inline JSFunction allocation in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=143851
+
+        Reviewed by Filip Pizlo.
+
+        JSFunction allocation is a simple operation that should be inlined when possible.
+
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNewFunction):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::allocationSize):
+
+2015-04-16  Mark Lam  <mark.lam@apple.com>
+
+        Add $vm debugging tool.
+        https://bugs.webkit.org/show_bug.cgi?id=143809
+
+        Reviewed by Geoffrey Garen.
+
+        For debugging VM bugs, it would be useful to be able to dump VM data structures
+        from JS code that we instrument.  To this end, let's introduce a
+        JS_enableDollarVM option that, if true, installs an $vm property into each JS
+        global object at creation time.  The $vm property refers to an object that
+        provides a collection of useful utility functions.  For this initial
+        implementation, $vm will have the following:
+
+            crash() - trigger an intentional crash.
+
+            dfgTrue() - returns true if the current function is DFG compiled, else returns false.
+            jitTrue() - returns true if the current function is compiled by the baseline JIT, else returns false.
+            llintTrue() - returns true if the current function is interpreted by the LLINT, else returns false.
+
+            gc() - runs a full GC.
+            edenGC() - runs an eden GC.
+
+            codeBlockForFrame(frameNumber) - gets the codeBlock at the specified frame (0 = current, 1 = caller, etc).
+            printSourceFor(codeBlock) - prints the source code for the codeBlock.
+            printByteCodeFor(codeBlock) - prints the bytecode for the codeBlock.
+
+            print(str) - prints a string to dataLog output.
+            printCallFrame() - prints the current CallFrame.
+            printStack() - prints the JS stack.
+            printInternal(value) - prints the JSC internal info for the specified value.
+
+        With JS_enableDollarVM=true, JS code can use the above functions like so:
+
+            $vm.print("Using $vm features\n");
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        - FTL compiled functions don't like it when we try to compute the CallLinkStatus.
+          Hence, we skip this step if we're dumping an FTL codeBlock.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAndSweep):
+        (JSC::Heap::collectAllGarbage): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::collectAllGarbage):
+        - Add ability to do an Eden collection and sweep.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::printIndents):
+        (JSC::log):
+        (JSC::logF):
+        (JSC::StackVisitor::Frame::print):
+        (JSC::jitTypeName): Deleted.
+        (JSC::printif): Deleted.
+        - Modernize the implementation of StackVisitor::Frame::print(), and remove some
+          now redundant code.
+        - Also fix it so that it downgrades gracefully when encountering inlined DFG
+          and compiled FTL functions.
+
+        (DebugPrintFrameFunctor::DebugPrintFrameFunctor): Deleted.
+        (DebugPrintFrameFunctor::operator()): Deleted.
+        (debugPrintCallFrame): Deleted.
+        (debugPrintStack): Deleted.
+        - these have been moved into JSDollarVMPrototype.cpp. 
+
+        * interpreter/StackVisitor.h:
+        - StackVisitor::Frame::print() is now enabled for release builds as well so that
+          we can call it from $vm.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        - Added the $vm instance to global objects conditional on the JSC_enableDollarVM
+          option.
+
+        * runtime/Options.h:
+        - Added the JSC_enableDollarVM option.
+
+        * tools/JSDollarVM.cpp: Added.
+        * tools/JSDollarVM.h: Added.
+        (JSC::JSDollarVM::createStructure):
+        (JSC::JSDollarVM::create):
+        (JSC::JSDollarVM::JSDollarVM):
+
+        * tools/JSDollarVMPrototype.cpp: Added.
+        - This file contains 2 sets of functions:
+
+          a. a C++ implementation of debugging utility functions that are callable when
+             doing debugging from lldb.  To the extent possible, these functions try to
+             be cautious and not cause unintended crashes should the user call them with
+             the wrong info.  Hence, they are designed to be robust rather than speedy.
+
+          b. the native implementations of JS functions in the $vm object.  Where there
+             is overlapping functionality, these are built on top of the C++ functions
+             above to do the work.
+
+          Note: it does not make sense for all of the $vm functions to have a C++
+          counterpart for lldb debugging.  For example, the $vm.dfgTrue() function is
+          only useful for JS code, and works via the DFG intrinsics mechanism.
+          When doing debugging via lldb, the optimization level of the currently
+          executing JS function can be gotten by dumping the current CallFrame instead.
+
+        (JSC::currentThreadOwnsJSLock):
+        (JSC::ensureCurrentThreadOwnsJSLock):
+        (JSC::JSDollarVMPrototype::addFunction):
+        (JSC::functionCrash): - $vm.crash()
+        (JSC::functionDFGTrue): - $vm.dfgTrue()
+        (JSC::CallerFrameJITTypeFunctor::CallerFrameJITTypeFunctor):
+        (JSC::CallerFrameJITTypeFunctor::operator()):
+        (JSC::CallerFrameJITTypeFunctor::jitType):
+        (JSC::functionLLintTrue): - $vm.llintTrue()
+        (JSC::functionJITTrue): - $vm.jitTrue()
+        (JSC::gc):
+        (JSC::functionGC): - $vm.gc()
+        (JSC::edenGC):
+        (JSC::functionEdenGC): - $vm.edenGC()
+        (JSC::isValidCodeBlock):
+        (JSC::codeBlockForFrame):
+        (JSC::functionCodeBlockForFrame): - $vm.codeBlockForFrame(frameNumber)
+        (JSC::codeBlockFromArg):
+        (JSC::functionPrintSourceFor): - $vm.printSourceFor(codeBlock)
+        (JSC::functionPrintByteCodeFor): - $vm.printBytecodeFor(codeBlock)
+        (JSC::functionPrint): - $vm.print(str)
+        (JSC::PrintFrameFunctor::PrintFrameFunctor):
+        (JSC::PrintFrameFunctor::operator()):
+        (JSC::printCallFrame):
+        (JSC::printStack):
+        (JSC::functionPrintCallFrame): - $vm.printCallFrame()
+        (JSC::functionPrintStack): - $vm.printStack()
+        (JSC::printValue):
+        (JSC::functionPrintValue): - $vm.printValue()
+        (JSC::JSDollarVMPrototype::finishCreation):
+        * tools/JSDollarVMPrototype.h: Added.
+        (JSC::JSDollarVMPrototype::create):
+        (JSC::JSDollarVMPrototype::createStructure):
+        (JSC::JSDollarVMPrototype::JSDollarVMPrototype):
+
+2015-04-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Speculative fix after r182915
+        https://bugs.webkit.org/show_bug.cgi?id=143404
+
+        Reviewed by Alexey Proskuryakov.
+
+        * runtime/SymbolConstructor.h:
+
+2015-04-16  Mark Lam  <mark.lam@apple.com>
+
+        Fixed some typos in a comment.
+
+        Not reviewed.
+
+        * dfg/DFGGenerationInfo.h:
+
+2015-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Symbol.for and Symbol.keyFor
+        https://bugs.webkit.org/show_bug.cgi?id=143404
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements Symbol.for and Symbol.keyFor.
+        SymbolRegistry maintains registered StringImpl* symbols.
+        And to make this mapping enabled over realms,
+        VM owns this mapping (not JSGlobalObject).
+
+        While there's Default AtomicStringTable per thread,
+        SymbolRegistry should not exist over VMs.
+        So everytime VM is created, SymbolRegistry is also created.
+
+        In SymbolRegistry implementation, we don't leverage WeakGCMap (or weak reference design).
+        Theres are several reasons.
+        1. StringImpl* which represents identity of Symbols is not GC-managed object.
+           So we cannot use WeakGCMap directly.
+           While Symbol* is GC-managed object, holding weak reference to Symbol* doesn't maintain JS symbols (exposed primitive values to users) liveness,
+           because distinct Symbol* can exist.
+           Distinct Symbol* means the Symbol* object that pointer value (Symbol*) is different from weakly referenced Symbol* but held StringImpl* is the same.
+
+        2. We don't use WTF::WeakPtr. If we add WeakPtrFactory into StringImpl's member, we can track StringImpl*'s liveness by WeakPtr.
+           However there's problem about when we prune staled entries in SymbolRegistry.
+           Since the memory allocated for the Symbol is typically occupied by allocated symbolized StringImpl*'s content,
+           and it is not in GC-heap.
+           While heavily registering Symbols and storing StringImpl* into SymbolRegistry, Heap's EdenSpace is not so occupied.
+           So GC typically attempt to perform EdenCollection, and it doesn't call WeakGCMap's pruleStaleEntries callback.
+           As a result, before pruning staled entries in SymbolRegistry, fast malloc-ed memory fills up the system memory.
+
+        So instead of using Weak reference, we take relatively easy design.
+        When we register symbolized StringImpl* into SymbolRegistry, symbolized StringImpl* is aware of that.
+        And when destructing it, it removes its reference from SymbolRegistry as if atomic StringImpl do so with AtomicStringTable.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * runtime/SymbolConstructor.cpp:
+        (JSC::SymbolConstructor::getOwnPropertySlot):
+        (JSC::symbolConstructorFor):
+        (JSC::symbolConstructorKeyFor):
+        * runtime/SymbolConstructor.h:
+        * runtime/VM.cpp:
+        * runtime/VM.h:
+        (JSC::VM::symbolRegistry):
+        * tests/stress/symbol-registry.js: Added.
+        (test):
+
+2015-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Use specific functions for @@iterator functions
+        https://bugs.webkit.org/show_bug.cgi?id=143838
+
+        Reviewed by Geoffrey Garen.
+
+        In ES6, some methods are defined with the different names.
+
+        For example,
+
+        Map.prototype[Symbol.iterator] === Map.prototype.entries
+        Set.prototype[Symbol.iterator] === Set.prototype.values
+        Array.prototype[Symbol.iterator] === Array.prototype.values
+        %Arguments%[Symbol.iterator] === Array.prototype.values
+
+        However, current implementation creates different function objects per name.
+        This patch fixes it by setting the object that is used for the other method to @@iterator.
+        e.g. Setting Array.prototype.values function object to Array.prototype[Symbol.iterator].
+
+        And we drop Arguments' iterator implementation and replace Argument[@@iterator] implementation
+        with Array.prototype.values to conform to the spec.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * runtime/ArgumentsIteratorConstructor.cpp: Removed.
+        * runtime/ArgumentsIteratorConstructor.h: Removed.
+        * runtime/ArgumentsIteratorPrototype.cpp: Removed.
+        * runtime/ArgumentsIteratorPrototype.h: Removed.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/ArrayPrototype.h:
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        (JSC::ClonedArguments::put):
+        (JSC::ClonedArguments::deleteProperty):
+        (JSC::ClonedArguments::defineOwnProperty):
+        (JSC::ClonedArguments::materializeSpecials):
+        * runtime/ClonedArguments.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/DirectArguments.cpp:
+        (JSC::DirectArguments::overrideThings):
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::getOwnPropertySlot):
+        (JSC::GenericArguments<Type>::getOwnPropertyNames):
+        (JSC::GenericArguments<Type>::put):
+        (JSC::GenericArguments<Type>::deleteProperty):
+        (JSC::GenericArguments<Type>::defineOwnProperty):
+        * runtime/JSArgumentsIterator.cpp: Removed.
+        * runtime/JSArgumentsIterator.h: Removed.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrayProtoValuesFunction):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/ScopedArguments.cpp:
+        (JSC::ScopedArguments::overrideThings):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        * tests/stress/arguments-iterator.js: Added.
+        (test):
+        (testArguments):
+        * tests/stress/iterator-functions.js: Added.
+        (test):
+        (argumentsTests):
+
+2015-04-14  Mark Lam  <mark.lam@apple.com>
+
+        Add JSC_functionOverrides=<overrides file> debugging tool.
+        https://bugs.webkit.org/show_bug.cgi?id=143717
+
+        Reviewed by Geoffrey Garen.
+
+        This tool allows us to do runtime replacement of function bodies with alternatives
+        for debugging purposes.  For example, this is useful when we need to debug VM bugs
+        which manifest in scripts executing in webpages downloaded from remote servers
+        that we don't control.  The tool allows us to augment those scripts with logging
+        or test code to help isolate the bugs.
+
+        This tool works by substituting the SourceCode at FunctionExecutable creation
+        time.  It identifies which SourceCode to substitute by comparing the source
+        string against keys in a set of key value pairs.
+
+        The keys are function body strings defined by 'override' clauses in the overrides
+        file specified by in the JSC_functionOverrides option.  The values are function
+        body strings defines by 'with' clauses in the overrides file.
+        See comment blob at top of FunctionOverrides.cpp on the formatting
+        of the overrides file.
+
+        At FunctionExecutable creation time, if the SourceCode string matches one of the
+        'override' keys from the overrides file, the tool will replace the SourceCode with
+        a new one based on the corresponding 'with' value string.  The FunctionExecutable
+        will then be created with the new SourceCode instead.
+
+        Some design decisions:
+        1. We opted to require that the 'with' clause appear on a separate line than the
+           'override' clause because this makes it easier to read and write when the
+           'override' clause's function body is single lined and long.
+
+        2. The user can use any sequence of characters for the delimiter (except for '{',
+           '}' and white space characters) because this ensures that there can always be
+           some delimiter pattern that does not appear in the function body in the clause
+           e.g. in the body of strings in the JS code.
+
+           '{' and '}' are disallowed because they are used to mark the boundaries of the
+           function body string.  White space characters are disallowed because they can
+           be error prone (the user may not be able to tell between spaces and tabs).
+
+        3. The start and end delimiter must be an identical sequence of characters.
+
+           I had considered allowing the use of complementary characters like <>, [], and
+           () for making delimiter pairs like:
+               [[[[ ... ]]]]
+               <[([( ... )])]>
+
+           But in the end, decided against it because:
+           a. These sequences of complementary characters can exists in JS code.
+              In contrast, a repeating delimiter like %%%% is unlikely to appear in JS
+              code.
+           b. It can be error prone for the user to have to type the exact complement
+              character for the end delimiter in reverse order.
+              In contrast, a repeating delimiter like %%%% is much easier to type and
+              less error prone.  Even a sequence like @#$%^ is less error prone than
+              a complementary sequence because it can be copy-pasted, and need not be
+              typed in reverse order.
+           c. It is easier to parse for the same delimiter string for both start and end.
+
+        4. The tool does a lot of checks for syntax errors in the overrides file because
+           we don't want any overrides to fail silently.  If a syntax error is detected,
+           the tool will print an error message and call exit().  This avoids the user
+           wasting time doing debugging only to be surprised later that their specified
+           overrides did not take effect because of some unnoticed typo.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::link):
+        * runtime/Executable.h:
+        * runtime/Options.h:
+        * tools/FunctionOverrides.cpp: Added.
+        (JSC::FunctionOverrides::overrides):
+        (JSC::FunctionOverrides::FunctionOverrides):
+        (JSC::initializeOverrideInfo):
+        (JSC::FunctionOverrides::initializeOverrideFor):
+        (JSC::hasDisallowedCharacters):
+        (JSC::parseClause):
+        (JSC::FunctionOverrides::parseOverridesInFile):
+        * tools/FunctionOverrides.h: Added.
+
+2015-04-16  Basile Clement  <basile_clement@apple.com>
+ 
+        Extract the allocation profile from JSFunction into a rare object
+        https://bugs.webkit.org/show_bug.cgi?id=143807
+ 
+        Reviewed by Filip Pizlo.
+ 
+        The allocation profile is only needed for those functions that are used
+        to create objects with [new].
+        Extracting it into its own JSCell removes the need for JSFunction and
+        JSCallee to be JSDestructibleObjects, which should improve performances in most
+        cases at the cost of an extra pointer dereference when the allocation profile
+        is actually needed.
+ 
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_this):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/FunctionRareData.cpp: Added.
+        (JSC::FunctionRareData::create):
+        (JSC::FunctionRareData::destroy):
+        (JSC::FunctionRareData::createStructure):
+        (JSC::FunctionRareData::visitChildren):
+        (JSC::FunctionRareData::FunctionRareData):
+        (JSC::FunctionRareData::~FunctionRareData):
+        (JSC::FunctionRareData::finishCreation):
+        * runtime/FunctionRareData.h: Added.
+        (JSC::FunctionRareData::offsetOfAllocationProfile):
+        (JSC::FunctionRareData::allocationProfile):
+        (JSC::FunctionRareData::allocationStructure):
+        (JSC::FunctionRareData::allocationProfileWatchpointSet):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::destroy): Deleted.
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCallee.cpp:
+        (JSC::JSCallee::destroy): Deleted.
+        * runtime/JSCallee.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::createRareData):
+        (JSC::JSFunction::visitChildren):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        (JSC::JSFunction::destroy): Deleted.
+        (JSC::JSFunction::createAllocationProfile): Deleted.
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::offsetOfRareData):
+        (JSC::JSFunction::rareData):
+        (JSC::JSFunction::allocationStructure):
+        (JSC::JSFunction::allocationProfileWatchpointSet):
+        (JSC::JSFunction::offsetOfAllocationProfile): Deleted.
+        (JSC::JSFunction::allocationProfile): Deleted.
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::JSFunction):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+ 
+2015-04-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove the unnecessary WTF_CHANGES define
+        https://bugs.webkit.org/show_bug.cgi?id=143825
+
+        Reviewed by Andreas Kling.
+
+        * config.h:
+
+2015-04-15  Andreas Kling  <akling@apple.com>
+
+        Make MarkedBlock and WeakBlock 4x smaller.
+        <https://webkit.org/b/143802>
+
+        Reviewed by Mark Hahnenberg.
+
+        To reduce GC heap fragmentation and generally use less memory, reduce the size of MarkedBlock
+        and its buddy WeakBlock by 4x, bringing them from 64kB+4kB to 16kB+1kB.
+
+        In a sampling of cool web sites, I'm seeing ~8% average reduction in overall GC heap size.
+        Some examples:
+
+                   apple.com:  6.3MB ->  5.5MB (14.5% smaller)
+                  reddit.com:  4.5MB ->  4.1MB ( 9.7% smaller)
+                 twitter.com: 23.2MB -> 21.4MB ( 8.4% smaller)
+            cuteoverload.com: 24.5MB -> 23.6MB ( 3.8% smaller)
+
+        Benchmarks look mostly neutral.
+        Some small slowdowns on Octane, some slightly bigger speedups on Kraken and SunSpider.
+
+        * heap/MarkedBlock.h:
+        * heap/WeakBlock.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+
+2015-04-15  Jordan Harband  <ljharb@gmail.com>
+
+        String.prototype.startsWith/endsWith/includes have wrong length in r182673
+        https://bugs.webkit.org/show_bug.cgi?id=143659
+
+        Reviewed by Benjamin Poulain.
+
+        Fix lengths of String.prototype.{includes,startsWith,endsWith} per spec
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-string.prototype.includes
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-string.prototype.startswith
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-string.prototype.endswith
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2015-04-15  Mark Lam  <mark.lam@apple.com>
+
+        Remove obsolete VMInspector debugging tool.
+        https://bugs.webkit.org/show_bug.cgi?id=143798
+
+        Reviewed by Michael Saboff.
+
+        I added the VMInspector tool 3 years ago to aid in VM hacking work.  Some of it
+        has bit rotted, and now the VM also has better ways to achieve its functionality.
+        Hence this code is now obsolete and should be removed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        * interpreter/VMInspector.cpp: Removed.
+        * interpreter/VMInspector.h: Removed.
+        * llint/LowLevelInterpreter.cpp:
+
+2015-04-15  Jordan Harband  <ljharb@gmail.com>
+
+        Math.imul has wrong length in Safari 8.0.4
+        https://bugs.webkit.org/show_bug.cgi?id=143658
+
+        Reviewed by Benjamin Poulain.
+
+        Correcting function length from 1, to 2, to match spec
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-math.imul
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+
+2015-04-15  Jordan Harband  <ljharb@gmail.com>
+
+        Number.parseInt in nightly r182673 has wrong length
+        https://bugs.webkit.org/show_bug.cgi?id=143657
+
+        Reviewed by Benjamin Poulain.
+
+        Correcting function length from 1, to 2, to match spec
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-number.parseint
+
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+
+2015-04-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Harden DFGForAllKills
+        https://bugs.webkit.org/show_bug.cgi?id=143792
+
+        Reviewed by Geoffrey Garen.
+        
+        Unfortunately, we don't have a good way to test this yet - but it will be needed to prevent
+        bugs in https://bugs.webkit.org/show_bug.cgi?id=143734.
+        
+        Previously ForAllKills used the bytecode kill analysis. That seemed like a good idea because
+        that analysis is cheaper than the full liveness analysis. Unfortunately, it's probably wrong:
+        
+        - It looks for kill sites at forExit origin boundaries. But, something might have been killed
+          by an operation that was logically in between the forExit origins at the boundary, but was
+          removed from the DFG for whatever reason. The DFG is allowed to have bytecode instruction
+          gaps.
+        
+        - It overlooked the fact that a MovHint that addresses a local that is always live kills that
+          local. For example, storing to an argument means that the prior value of the argument is
+          killed.
+        
+        This fixes the analysis by making it handle MovHints directly, and making it define kills in
+        the most conservative way possible: it asks if you were live before but dead after. If we
+        have the compile time budget to afford this more direct approach, then it's definitel a good
+        idea since it's so fool-proof.
+
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKilledOperands):
+        (JSC::DFG::forAllKilledNodesAtNodeIndex):
+        (JSC::DFG::forAllDirectlyKilledOperands): Deleted.
+
+2015-04-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Provide SPI to allow changing whether JSContexts are remote debuggable by default
+        https://bugs.webkit.org/show_bug.cgi?id=143681
+
+        Reviewed by Darin Adler.
+
+        * API/JSRemoteInspector.h:
+        * API/JSRemoteInspector.cpp:
+        (JSRemoteInspectorGetInspectionEnabledByDefault):
+        (JSRemoteInspectorSetInspectionEnabledByDefault):
+        Provide SPI to toggle the default enabled inspection state of debuggables.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        Respect the default setting.
+
+2015-04-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JavaScriptCore: Use kCFAllocatorDefault where possible
+        https://bugs.webkit.org/show_bug.cgi?id=143747
+
+        Reviewed by Darin Adler.
+
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::HeapTimer):
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorInitializeGlobalQueue):
+        (Inspector::RemoteInspectorDebuggableConnection::setupRunLoop):
+        For consistency and readability use the constant instead of
+        different representations of null.
+
+2015-04-14  Michael Saboff  <msaboff@apple.com>
+
+        Remove JavaScriptCoreUseJIT default from JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=143746
+
+        Reviewed by Mark Lam.
+
+        * runtime/VM.cpp:
+        (JSC::enableAssembler):
+
+2015-04-14  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r180020): Web Inspector crashes on pages that have a stylesheet with an invalid MIME type
+        https://bugs.webkit.org/show_bug.cgi?id=143745
+        <rdar://problem/20243916>
+
+        Reviewed by Joseph Pecoraro.
+
+        Add assertion in ContentSearchUtilities::findMagicComment() to make
+        sure the content String is not null or we would crash in
+        JSC::Yarr::interpret() later.
+
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::findMagicComment):
+
+2015-04-14  Michael Saboff  <msaboff@apple.com>
+
+        DFG register fillSpeculate*() functions should validate incoming spill format is compatible with requested fill format
+        https://bugs.webkit.org/show_bug.cgi?id=143727
+
+        Reviewed by Geoffrey Garen.
+
+        Used the result of AbstractInterpreter<>::filter() to check that the current spill format is compatible
+        with the requested fill format.  If filter() reports a contradiction, then we force an OSR exit.
+        Removed individual checks made redundant by the new check.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+
+2015-04-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Replace JavaScriptCoreOutputConsoleMessagesToSystemConsole default with an SPI
+        https://bugs.webkit.org/show_bug.cgi?id=143691
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSRemoteInspector.h:
+        * API/JSRemoteInspector.cpp:
+        (JSRemoteInspectorSetLogToSystemConsole):
+        Add SPI to enable/disable logging to the system console.
+        This only affects JSContext `console` logs and warnings.
+
+        * inspector/JSGlobalObjectConsoleClient.h:
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::logToSystemConsole):
+        (Inspector::JSGlobalObjectConsoleClient::setLogToSystemConsole):
+        (Inspector::JSGlobalObjectConsoleClient::messageWithTypeAndLevel):
+        (Inspector::JSGlobalObjectConsoleClient::initializeLogToSystemConsole): Deleted.
+        Simplify access to the setting now that it doesn't need to
+        initialize its value from preferences.
+
+2015-04-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Auto-attach fails after r179562, initialization too late after dispatch
+        https://bugs.webkit.org/show_bug.cgi?id=143682
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::singleton):
+        If we are on the main thread, run the initialization immediately.
+        Otherwise dispatch to the main thread. This way if the first JSContext
+        was created on the main thread it can get auto-attached if applicable.
+
+2015-04-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed build fix for Mavericks.
+
+        Mavericks includes this file but does not enable ENABLE_REMOTE_INSPECTOR
+        so the Inspector namespace is not available when compiling this file.
+
+        * API/JSRemoteInspector.cpp:
+
+2015-04-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Expose private APIs to interact with RemoteInspector instead of going through WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=143729
+
+        Reviewed by Timothy Hatcher.
+
+        * API/JSRemoteInspector.h: Added.
+        * API/JSRemoteInspector.cpp: Added.
+        (JSRemoteInspectorDisableAutoStart):
+        (JSRemoteInspectorStart):
+        (JSRemoteInspectorSetParentProcessInformation):
+        Add the new SPIs for basic remote inspection behavior.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add the new files to Mac only, since remote inspection is only
+        enabled there anyways.
+
+2015-04-14  Mark Lam  <mark.lam@apple.com>
+
+        Rename JSC_dfgFunctionWhitelistFile to JSC_dfgWhitelist.
+        https://bugs.webkit.org/show_bug.cgi?id=143722
+
+        Reviewed by Michael Saboff.
+
+        Renaming JSC_dfgFunctionWhitelistFile to JSC_dfgWhitelist so that it is
+        shorter, and easier to remember (without having to look it up) and to
+        type.  JSC options now support descriptions, and one can always look up
+        the description if the option's purpose is not already obvious.
+
+        * dfg/DFGFunctionWhitelist.cpp:
+        (JSC::DFG::FunctionWhitelist::ensureGlobalWhitelist):
+        (JSC::DFG::FunctionWhitelist::contains):
+        * runtime/Options.h:
+
+2015-04-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix Windows build. Windows doesn't take kindly to private classes that use FAST_ALLOCATED.
+
+        * runtime/InferredValue.h:
+
+2015-04-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build. I introduced a new cell type at the same time as kling changed how new cell types are written.
+
+        * runtime/InferredValue.h:
+
+2015-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should detect singleton functions
+        https://bugs.webkit.org/show_bug.cgi?id=143232
+
+        Reviewed by Geoffrey Garen.
+        
+        This started out as an attempt to make constructors faster by detecting when a constructor is a
+        singleton. The idea is that each FunctionExecutable has a VariableWatchpointSet - a watchpoint
+        along with an inferred value - that detects if only one JSFunction has been allocated for that
+        executable, and if so, what that JSFunction is. Then, inside the code for the FunctionExecutable,
+        if the watchpoint set has an inferred value (i.e. it's been initialized and it is still valid),
+        we can constant-fold GetCallee.
+        
+        Unfortunately, constructors don't use GetCallee anymore, so that didn't pan out. But in the
+        process I realized a bunch of things:
+        
+        - This allows us to completely eliminate the GetCallee/GetScope sequence that we still sometimes
+          had even in code where our singleton-closure detection worked. That's because singleton-closure
+          inference worked at the op_resolve_scope, and that op_resolve_scope still needed to keep alive
+          the incoming scope in case we OSR exit. But by constant-folding GetCallee, that sequence
+          disappears. OSR exit can rematerialize the callee or the scope by just knowing their constant
+          values.
+          
+        - Singleton detection should be a reusable thing. So, I got rid of VariableWatchpointSet and
+          created InferredValue. InferredValue is a cell, so it can handle its own GC magic.
+          FunctionExecutable uses an InferredValue to tell you about singleton JSFunctions.
+        
+        - The old singleton-scope detection in op_resolve_scope is better abstracted as a SymbolTable
+          detecting a singleton JSSymbolTableObject. So, SymbolTable uses an InferredValue to tell you
+          about singleton JSSymbolTableObjects. It's curious that we want to have singleton detection in
+          SymbolTable if we already have it in FunctionExecutable. This comes into play in two ways.
+          First, it means that the DFG can realize sooner that a resolve_scope resolves to a constant
+          scope. Ths saves compile times and it allows prediction propagation to benefit from the
+          constant folding. Second, it means that we will detect a singleton scope even if it is
+          referenced from a non-singleton scope that is nearer to us in the scope chain. This refactoring
+          allows us to eliminate the function reentry watchpoint.
+        
+        - This allows us to use a normal WatchpointSet, instead of a VariableWatchpointSet, for inferring
+          constant values in scopes. Previously when the DFG inferred that a closure variable was
+          constant, it wouldn't know which closure that variable was in and so it couldn't just load that
+          value. But now we are first inferring that the function is a singleton, which means that we
+          know exactly what scope it points to, and we can load the value from the scope. Using a
+          WatchpointSet instead of a VariableWatchpointSet saves some memory and simplifies a bunch of
+          code. This also means that now, the only user of VariableWatchpointSet is FunctionExecutable.
+          I've tweaked the code of VariableWatchpointSet to reduce its power to just be what
+          FunctionExecutable wants.
+        
+        This also has the effect of simplifying the implementation of block scoping. Prior to this
+        change, block scoping would have needed to have some story for the function reentry watchpoint on
+        any nested symbol table. That's totally weird to think about; it's not really a function reentry
+        but a scope reentry. Now we don't have to think about this. Constant inference on nested scopes
+        will "just work": if we prove that we know the constant value of the scope then the machinery
+        kicks in, otherwise it doesn't.
+        
+        This is a small Octane and AsmBench speed-up. AsmBench sees 1% while Octane sees sub-1%.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::valueProfileForBytecodeOffset): Deleted.
+        * bytecode/CodeOrigin.cpp:
+        (JSC::InlineCallFrame::calleeConstant):
+        (JSC::InlineCallFrame::visitAggregate):
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::calleeConstant): Deleted.
+        (JSC::InlineCallFrame::visitAggregate): Deleted.
+        * bytecode/Instruction.h:
+        * bytecode/VariableWatchpointSet.cpp: Removed.
+        * bytecode/VariableWatchpointSet.h: Removed.
+        * bytecode/VariableWatchpointSetInlines.h: Removed.
+        * bytecode/VariableWriteFireDetail.cpp: Added.
+        (JSC::VariableWriteFireDetail::dump):
+        (JSC::VariableWriteFireDetail::touch):
+        * bytecode/VariableWriteFireDetail.h: Added.
+        (JSC::VariableWriteFireDetail::VariableWriteFireDetail):
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::stateOnJSThread):
+        (JSC::WatchpointSet::startWatching):
+        (JSC::WatchpointSet::fireAll):
+        (JSC::WatchpointSet::touch):
+        (JSC::WatchpointSet::invalidate):
+        (JSC::InlineWatchpointSet::stateOnJSThread):
+        (JSC::InlineWatchpointSet::state):
+        (JSC::InlineWatchpointSet::hasBeenInvalidated):
+        (JSC::InlineWatchpointSet::invalidate):
+        (JSC::InlineWatchpointSet::touch):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::getScope): Deleted.
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDesiredWatchpoints.cpp:
+        (JSC::DFG::InferredValueAdaptor::add):
+        (JSC::DFG::DesiredWatchpoints::addLazily):
+        (JSC::DFG::DesiredWatchpoints::reallyAdd):
+        (JSC::DFG::DesiredWatchpoints::areStillValid):
+        * dfg/DFGDesiredWatchpoints.h:
+        (JSC::DFG::InferredValueAdaptor::hasBeenInvalidated):
+        (JSC::DFG::DesiredWatchpoints::isWatched):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::tryGetConstantClosureVar):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasWatchpointSet):
+        (JSC::DFG::Node::watchpointSet):
+        (JSC::DFG::Node::hasVariableWatchpointSet): Deleted.
+        (JSC::DFG::Node::variableWatchpointSet): Deleted.
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
+        (JSC::DFG::SpeculativeJIT::compileNotifyWrite):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCreateActivation):
+        (JSC::FTL::LowerDFGToLLVM::compileNewFunction):
+        (JSC::FTL::LowerDFGToLLVM::compileNotifyWrite):
+        * interpreter/Interpreter.cpp:
+        (JSC::StackFrame::friendlySourceURL):
+        (JSC::StackFrame::friendlyFunctionName):
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::friendlySourceURL): Deleted.
+        (JSC::StackFrame::friendlyFunctionName): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::emitNotifyWrite):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_touch_entry): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitPutGlobalVar):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emitNotifyWrite): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitPutGlobalVar):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emitNotifyWrite): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL): Deleted.
+        * runtime/CommonSlowPaths.h:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::finishCreation):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::singletonFunction):
+        * runtime/InferredValue.cpp: Added.
+        (JSC::InferredValue::create):
+        (JSC::InferredValue::destroy):
+        (JSC::InferredValue::createStructure):
+        (JSC::InferredValue::visitChildren):
+        (JSC::InferredValue::InferredValue):
+        (JSC::InferredValue::~InferredValue):
+        (JSC::InferredValue::notifyWriteSlow):
+        (JSC::InferredValue::ValueCleanup::ValueCleanup):
+        (JSC::InferredValue::ValueCleanup::~ValueCleanup):
+        (JSC::InferredValue::ValueCleanup::finalizeUnconditionally):
+        * runtime/InferredValue.h: Added.
+        (JSC::InferredValue::inferredValue):
+        (JSC::InferredValue::state):
+        (JSC::InferredValue::isStillValid):
+        (JSC::InferredValue::hasBeenInvalidated):
+        (JSC::InferredValue::add):
+        (JSC::InferredValue::notifyWrite):
+        (JSC::InferredValue::invalidate):
+        * runtime/JSEnvironmentRecord.cpp:
+        (JSC::JSEnvironmentRecord::visitChildren):
+        * runtime/JSEnvironmentRecord.h:
+        (JSC::JSEnvironmentRecord::isValid):
+        (JSC::JSEnvironmentRecord::finishCreation):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createWithInvalidatedReallocationWatchpoint):
+        (JSC::JSFunction::createImpl):
+        (JSC::JSFunction::create): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::symbolTablePut):
+        * runtime/JSScope.h:
+        (JSC::ResolveOp::ResolveOp):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::finishCreation):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::setSymbolTable):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/PutPropertySlot.h:
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::prepareToWatch):
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::finishCreation):
+        (JSC::SymbolTable::visitChildren):
+        (JSC::SymbolTableEntry::inferredValue): Deleted.
+        (JSC::SymbolTableEntry::notifyWriteSlow): Deleted.
+        (JSC::SymbolTable::WatchpointCleanup::WatchpointCleanup): Deleted.
+        (JSC::SymbolTable::WatchpointCleanup::~WatchpointCleanup): Deleted.
+        (JSC::SymbolTable::WatchpointCleanup::finalizeUnconditionally): Deleted.
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTableEntry::disableWatching):
+        (JSC::SymbolTableEntry::watchpointSet):
+        (JSC::SymbolTable::singletonScope):
+        (JSC::SymbolTableEntry::notifyWrite): Deleted.
+        * runtime/TypeProfiler.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * tests/stress/infer-uninitialized-closure-var.js: Added.
+        (foo.f):
+        (foo):
+        * tests/stress/singleton-scope-then-overwrite.js: Added.
+        (foo.f):
+        (foo):
+        * tests/stress/singleton-scope-then-realloc-and-overwrite.js: Added.
+        (foo):
+        * tests/stress/singleton-scope-then-realloc.js: Added.
+        (foo):
+
+2015-04-13  Andreas Kling  <akling@apple.com>
+
+        Don't segregate heap objects based on Structure immortality.
+        <https://webkit.org/b/143638>
+
+        Reviewed by Darin Adler.
+
+        Put all objects that need a destructor call into the same MarkedBlock.
+        This reduces memory consumption in many situations, while improving locality,
+        since much more of the MarkedBlock space can be shared.
+
+        Instead of branching on the MarkedBlock type, we now check a bit in the
+        JSCell's inline type flags (StructureIsImmortal) to see whether it's safe
+        to access the cell's Structure during destruction or not.
+
+        Performance benchmarks look mostly neutral. Maybe a small regression on
+        SunSpider's date objects.
+
+        On the amazon.com landing page, this saves us 50 MarkedBlocks (3200kB) along
+        with a bunch of WeakBlocks that were hanging off of them. That's on the higher
+        end of savings we can get from this, but still a very real improvement.
+
+        Most of this patch is removing the "hasImmortalStructure" constant from JSCell
+        derived classes and passing that responsibility to the StructureIsImmortal flag.
+        StructureFlags is made public so that it's accessible from non-member functions.
+        I made sure to declare it everywhere and make classes final to try to make it
+        explicit what each class is doing to its inherited flags.
+
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * bytecode/UnlinkedCodeBlock.h:
+        * debugger/DebuggerScope.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileMakeRope):
+        * heap/Heap.h:
+        (JSC::Heap::subspaceForObjectDestructor):
+        (JSC::Heap::allocatorForObjectWithDestructor):
+        (JSC::Heap::subspaceForObjectNormalDestructor): Deleted.
+        (JSC::Heap::subspaceForObjectsWithImmortalStructure): Deleted.
+        (JSC::Heap::allocatorForObjectWithNormalDestructor): Deleted.
+        (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor): Deleted.
+        * heap/HeapInlines.h:
+        (JSC::Heap::allocateWithDestructor):
+        (JSC::Heap::allocateObjectOfType):
+        (JSC::Heap::subspaceForObjectOfType):
+        (JSC::Heap::allocatorForObjectOfType):
+        (JSC::Heap::allocateWithNormalDestructor): Deleted.
+        (JSC::Heap::allocateWithImmortalStructureDestructor): Deleted.
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::needsDestruction):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::init):
+        (JSC::MarkedAllocator::destructorType): Deleted.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::callDestructor):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelper):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::needsDestruction):
+        (JSC::MarkedBlock::destructorType): Deleted.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::forEachAllocator):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::subspaceForObjectsWithDestructor):
+        (JSC::MarkedSpace::destructorAllocatorFor):
+        (JSC::MarkedSpace::allocateWithDestructor):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::subspaceForObjectsWithNormalDestructor): Deleted.
+        (JSC::MarkedSpace::subspaceForObjectsWithImmortalStructure): Deleted.
+        (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor): Deleted.
+        (JSC::MarkedSpace::normalDestructorAllocatorFor): Deleted.
+        (JSC::MarkedSpace::allocateWithImmortalStructureDestructor): Deleted.
+        (JSC::MarkedSpace::allocateWithNormalDestructor): Deleted.
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHostPrototype.h:
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFramePrototype.h:
+        * jsc.cpp:
+        * runtime/ArrayBufferNeuteringWatchpoint.h:
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayIteratorPrototype.h:
+        * runtime/BooleanPrototype.h:
+        * runtime/ClonedArguments.h:
+        * runtime/CustomGetterSetter.h:
+        * runtime/DateConstructor.h:
+        * runtime/DatePrototype.h:
+        * runtime/ErrorPrototype.h:
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.h:
+        * runtime/GenericArguments.h:
+        * runtime/GetterSetter.h:
+        * runtime/InternalFunction.h:
+        * runtime/JSAPIValueWrapper.h:
+        * runtime/JSArgumentsIterator.h:
+        * runtime/JSArray.h:
+        * runtime/JSArrayBuffer.h:
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCallee.h:
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::classInfo):
+        * runtime/JSDataViewPrototype.h:
+        * runtime/JSEnvironmentRecord.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSLexicalEnvironment.h:
+        * runtime/JSNameScope.h:
+        * runtime/JSNotAnObject.h:
+        * runtime/JSONObject.h:
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::JSFinalObject):
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromiseDeferred.h:
+        * runtime/JSPromisePrototype.h:
+        * runtime/JSPromiseReaction.h:
+        * runtime/JSPropertyNameEnumerator.h:
+        * runtime/JSProxy.h:
+        * runtime/JSScope.h:
+        * runtime/JSString.h:
+        * runtime/JSSymbolTableObject.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::structureIsImmortal):
+        * runtime/MathObject.h:
+        * runtime/NumberConstructor.h:
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.h:
+        * runtime/PropertyMapHashTable.h:
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.h:
+        * runtime/ScopedArgumentsTable.h:
+        * runtime/SparseArrayValueMap.h:
+        * runtime/StrictEvalActivation.h:
+        * runtime/StringConstructor.h:
+        * runtime/StringIteratorPrototype.h:
+        * runtime/StringObject.h:
+        * runtime/StringPrototype.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+        * runtime/StructureChain.h:
+        * runtime/StructureRareData.h:
+        * runtime/Symbol.h:
+        * runtime/SymbolPrototype.h:
+        * runtime/SymbolTable.h:
+        * runtime/WeakMapData.h:
+
+2015-04-13  Mark Lam  <mark.lam@apple.com>
+
+        DFG inlining of op_call_varargs should keep the callee alive in case of OSR exit.
+        https://bugs.webkit.org/show_bug.cgi?id=143407
+
+        Reviewed by Filip Pizlo.
+
+        DFG inlining of a varargs call / construct needs to keep the local
+        containing the callee alive with a Phantom node because the LoadVarargs
+        node may OSR exit.  After the OSR exit, the baseline JIT executes the
+        op_call_varargs with that callee in the local.
+
+        Previously, because that callee local was not explicitly kept alive,
+        the op_call_varargs case can OSR exit a DFG function and leave an
+        undefined value in that local.  As a result, the baseline observes the
+        side effect of an op_call_varargs on an undefined value instead of the
+        function it expected.
+
+        Note: this issue does not manifest with op_construct_varargs because
+        the inlined constructor will have an op_create_this which operates on
+        the incoming callee value, thereby keeping it alive.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * tests/stress/call-varargs-with-different-arguments-length-after-warmup.js: Added.
+        (foo):
+        (Foo):
+        (doTest):
+
+2015-04-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Array.prototype.values
+        https://bugs.webkit.org/show_bug.cgi?id=143633
+
+        Reviewed by Darin Adler.
+
+        Symbol.unscopables is implemented, so we can implement Array.prototype.values
+        without largely breaking the web. The following script passes.
+
+        var array = [];
+        var values = 42;
+        with (array) {
+            assert(values, 42);
+        }
+
+        * runtime/ArrayPrototype.cpp:
+        * tests/stress/array-iterators-next.js:
+        * tests/stress/map-iterators-next.js:
+        * tests/stress/set-iterators-next.js:
+        * tests/stress/values-unscopables.js: Added.
+        (test):
+
+2015-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Run flaky conservative GC related test first before polluting stack and registers
+        https://bugs.webkit.org/show_bug.cgi?id=143634
+
+        Reviewed by Ryosuke Niwa.
+
+        After r182653, JSC API tests fail. However, it's not related to the change.
+        After investigating the cause of this failure, I've found that the failed test is flaky
+        because JSC's GC is conservative. If previously allocated JSGlobalObject is accidentally alive
+        due to conservative roots in C stack and registers, this test fails.
+
+        Since GC marks C stack and registers as roots conservatively,
+        objects not referenced logically can be accidentally marked and alive.
+        To avoid this situation as possible as we can,
+        1. run this test first before stack is polluted,
+        2. extract this test as a function to suppress stack height.
+
+        * API/tests/testapi.mm:
+        (testWeakValue):
+        (testObjectiveCAPIMain):
+        (testObjectiveCAPI):
+
+2015-04-11  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: create content view and details sidebar for Frames timeline
+        https://bugs.webkit.org/show_bug.cgi?id=143533
+
+        Reviewed by Timothy Hatcher.
+
+        Refactoring: RunLoop prefix changed to RenderingFrame.
+
+        * inspector/protocol/Timeline.json:
+
+2015-04-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Enable Symbol in web pages
+        https://bugs.webkit.org/show_bug.cgi?id=143375
+
+        Reviewed by Ryosuke Niwa.
+
+        Expose Symbol to web pages.
+        Symbol was exposed, but it was hidden since it breaks Facebook comments.
+        This is because at that time Symbol is implemented,
+        but methods for Symbol.iterator and Object.getOwnPropertySymbols are not implemented yet
+        and it breaks React.js and immutable.js.
+
+        Now methods for Symbol.iterator and Object.getOwnPropertySymbols are implemented
+        and make sure that Facebook comment input functionality is not broken with exposed Symbol.
+
+        So this patch replaces runtime flags SymbolEnabled to SymbolDisabled
+        and makes enabling symbols by default.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/RuntimeFlags.h:
+
+2015-04-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        ES6: Iterator toString names should be consistent
+        https://bugs.webkit.org/show_bug.cgi?id=142424
+
+        Reviewed by Geoffrey Garen.
+
+        Iterator Object Names in the spec right now have spaces.
+        In our implementation some do and some don't.
+        This patch aligns JSC to the spec.
+
+        * runtime/JSArrayIterator.cpp:
+        * runtime/JSStringIterator.cpp:
+        * tests/stress/iterator-names.js: Added.
+        (test):
+        (iter):
+        (check):
+
+2015-04-10  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (182567): regress/script-tests/sorting-benchmark.js fails on 32 bit dfg-eager tests
+        https://bugs.webkit.org/show_bug.cgi?id=143582
+
+        Reviewed by Mark Lam.
+
+        For 32 bit builds, we favor spilling unboxed values.  The ASSERT at the root of this bug doesn't
+        fire for 64 bit builds, because we spill an "Other" value as a full JS value (DataFormatJS).
+        For 32 bit builds however, if we are able, we spill Other values as JSCell* (DataFormatCell).
+        The fix is to add a check in fillSpeculateInt32Internal() before the ASSERT that always OSR exits
+        if the spillFormat is DataFormatCell.  Had we spilled in DataFormatJS and the value was a JSCell*,
+        we would still OSR exit after the speculation check.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Fixed an error in a comment while debugging.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+
+2015-04-10  Milan Crha  <mcrha@redhat.com>
+
+        Disable Linux-specific code in a Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=137973
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::appendAPIBacktrace):
+
+2015-04-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Fix calleeSaveRegisters() on non iOS platforms after r180516
+        https://bugs.webkit.org/show_bug.cgi?id=143368
+
+        Reviewed by Michael Saboff.
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::calleeSaveRegisters):
+
+2015-04-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Use jsNontrivialString in more places if the string is guaranteed to be 2 or more characters
+        https://bugs.webkit.org/show_bug.cgi?id=143430
+
+        Reviewed by Darin Adler.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::symbolProtoFuncToString):
+
+2015-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        JSArray::sortNumeric should handle ArrayWithUndecided
+        https://bugs.webkit.org/show_bug.cgi?id=143535
+
+        Reviewed by Geoffrey Garen.
+        
+        ArrayWithUndecided is what you get if you haven't stored anything into the array yet. We need to handle it.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortNumeric):
+        * tests/stress/sort-array-with-undecided.js: Added.
+
+2015-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::IntegerCheckCombiningPhase's wrap-around check shouldn't trigger C++ undef behavior on wrap-around
+        https://bugs.webkit.org/show_bug.cgi?id=143532
+
+        Reviewed by Gavin Barraclough.
+        
+        Oh the irony!  We were protecting an optimization that only worked if there was no wrap-around in JavaScript.
+        But the C++ code had wrap-around, which is undef in C++.  So, if the compiler was smart enough, our compiler
+        would think that there never was wrap-around.
+        
+        This fixes a failure in stress/tricky-array-boiunds-checks.js when JSC is compiled with bleeding-edge clang.
+
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::IntegerCheckCombiningPhase::isValid):
+
+2015-04-07  Michael Saboff  <msaboff@apple.com>
+
+        Lazily initialize LogToSystemConsole flag to reduce memory usage
+        https://bugs.webkit.org/show_bug.cgi?id=143506
+
+        Reviewed by Mark Lam.
+
+        Only call into CF preferences code when we need to in order to reduce memory usage.
+
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::logToSystemConsole):
+        (Inspector::JSGlobalObjectConsoleClient::setLogToSystemConsole):
+        (Inspector::JSGlobalObjectConsoleClient::initializeLogToSystemConsole):
+        (Inspector::JSGlobalObjectConsoleClient::JSGlobalObjectConsoleClient):
+
+2015-04-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get the features.json files ready for open contributions
+        https://bugs.webkit.org/show_bug.cgi?id=143436
+
+        Reviewed by Darin Adler.
+
+        * features.json:
+
+2015-04-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Constant folding of typed array properties should be handled by AI rather than strength reduction
+        https://bugs.webkit.org/show_bug.cgi?id=143496
+
+        Reviewed by Geoffrey Garen.
+        
+        Handling constant folding in AI is better because it precludes us from having to fixpoint the CFA
+        phase and whatever other phase did the folding in order to find all constants.
+        
+        This also removes the TypedArrayWatchpoint node type because we can just set the watchpoint
+        directly.
+        
+        This also fixes a bug in FTL lowering of GetTypedArrayByteOffset. The bug was previously not
+        found because all of the tests for it involved the property getting constant folded. I found that
+        the codegen was bad because an earlier version of the patch broke that constant folding. This
+        adds a new test for that node type, which makes constant folding impossible by allocating a new
+        typed array every type. The lesson here is: if you write a test for something, run the test with
+        full IR dumps to make sure it's actually testing the thing you want it to test.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::tryGetFoldableView):
+        (JSC::DFG::Graph::tryGetFoldableViewForChild1): Deleted.
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasTypedArray): Deleted.
+        (JSC::DFG::Node::typedArray): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        (JSC::DFG::StrengthReductionPhase::foldTypedArrayPropertyToConstant): Deleted.
+        (JSC::DFG::StrengthReductionPhase::prepareToFoldTypedArray): Deleted.
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        (JSC::DFG::WatchpointCollectionPhase::addLazily):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetTypedArrayByteOffset):
+        (JSC::FTL::LowerDFGToLLVM::typedArrayLength):
+        * tests/stress/fold-typed-array-properties.js:
+        (foo):
+        * tests/stress/typed-array-byte-offset.js: Added.
+        (foo):
+
+2015-04-07  Matthew Mirman  <mmirman@apple.com>
+
+        Source and stack information should get appended only to native errors
+        and should be added directly after construction rather than when thrown. 
+        This fixes frozen objects being unfrozen when thrown while conforming to 
+        ecma script standard and other browser behavior.
+        rdar://problem/19927293
+        https://bugs.webkit.org/show_bug.cgi?id=141871
+        
+        Reviewed by Geoffrey Garen.
+
+        Appending stack, source, line, and column information to an object whenever that object is thrown 
+        is incorrect because it violates the ecma script standard for the behavior of throw.  Suppose for example
+        that the object being thrown already has one of these properties or is frozen.  Adding the properties 
+        would then violate the frozen contract or overwrite those properties.  Other browsers do not do this,
+        and doing this causes unnecessary performance hits in code with heavy use of the throw construct as
+        a control flow construct rather than just an error reporting mechanism.  
+        
+        Because WebCore adds "native" errors which do not inherit from any JSC native error, 
+        appending the error properties as a seperate call after construction of the error is required 
+        to avoid having to manually truncate the stack and gather local source information due to 
+        the stack being extended by a nested call to construct one of the native jsc error.
+        
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * interpreter/Interpreter.h:
+        * parser/ParserError.h:
+        (JSC::ParserError::toErrorObject):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::createError):
+        (JSC::createEvalError):
+        (JSC::createRangeError):
+        (JSC::createReferenceError):
+        (JSC::createSyntaxError):
+        (JSC::createTypeError):
+        (JSC::createNotEnoughArgumentsError):
+        (JSC::createURIError):
+        (JSC::createOutOfMemoryError):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::FindFirstCallerFrameWithCodeblockFunctor):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::operator()):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::foundCallFrame):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::index):
+        (JSC::addErrorInfoAndGetBytecodeOffset):  Added.
+        (JSC::addErrorInfo): Added special case for appending complete error info 
+        to a newly constructed error object.
+        * runtime/Error.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        (JSC::Interpreter::callErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::appendSourceToError): Moved from VM.cpp
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::FindFirstCallerFrameWithCodeblockFunctor):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::operator()):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::foundCallFrame):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::index):
+        (JSC::addErrorInfoAndGetBytecodeOffset):
+        (JSC::ErrorInstance::finishCreation):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::finishCreation):
+        * runtime/ExceptionFuzz.cpp:
+        (JSC::doExceptionFuzzing):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        (JSC::createInvalidFunctionApplyParameterError):
+        (JSC::createInvalidInParameterError):
+        (JSC::createInvalidInstanceofParameterError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        (JSC::throwOutOfMemoryError):
+        (JSC::createStackOverflowError): Deleted.
+        (JSC::createOutOfMemoryError): Deleted.
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::create):
+        (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor):
+        (JSC::Interpreter::callNativeErrorConstructor):
+        * runtime/VM.cpp:
+        (JSC::VM::throwException):
+        (JSC::appendSourceToError): Moved to Error.cpp
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::FindFirstCallerFrameWithCodeblockFunctor): Deleted.
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::operator()): Deleted.
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::foundCallFrame): Deleted.
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::index): Deleted.
+        * tests/stress/freeze_leek.js: Added.
+
+2015-04-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ES6: Show Symbol properties on Objects
+        https://bugs.webkit.org/show_bug.cgi?id=141279
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Runtime.json:
+        Give PropertyDescriptor a reference to the Symbol RemoteObject
+        if the property is a symbol property.
+
+        * inspector/InjectedScriptSource.js:
+        Enumerate symbol properties on objects.
+
+2015-04-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it possible to enable LLVM FastISel
+        https://bugs.webkit.org/show_bug.cgi?id=143489
+
+        Reviewed by Michael Saboff.
+
+        The decision to enable FastISel is made by Options.h|cpp, but the LLVM library can disable it if it finds that it is built
+        against a version of LLVM that doesn't support it. Thereafter, JSC::enableLLVMFastISel is the flag that tells the system
+        if we should enable it.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * llvm/InitializeLLVM.cpp:
+        (JSC::initializeLLVMImpl):
+        * llvm/InitializeLLVM.h:
+        * llvm/InitializeLLVMLinux.cpp:
+        (JSC::getLLVMInitializerFunction):
+        (JSC::initializeLLVMImpl): Deleted.
+        * llvm/InitializeLLVMMac.cpp:
+        (JSC::getLLVMInitializerFunction):
+        (JSC::initializeLLVMImpl): Deleted.
+        * llvm/InitializeLLVMPOSIX.cpp:
+        (JSC::getLLVMInitializerFunctionPOSIX):
+        (JSC::initializeLLVMPOSIX): Deleted.
+        * llvm/InitializeLLVMPOSIX.h:
+        * llvm/InitializeLLVMWin.cpp:
+        (JSC::getLLVMInitializerFunction):
+        (JSC::initializeLLVMImpl): Deleted.
+        * llvm/LLVMAPI.cpp:
+        * llvm/LLVMAPI.h:
+        * llvm/library/LLVMExports.cpp:
+        (initCommandLine):
+        (initializeAndGetJSCLLVMAPI):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+
+2015-04-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        put_by_val_direct need to check the property is index or not for using putDirect / putDirectIndex
+        https://bugs.webkit.org/show_bug.cgi?id=140426
+
+        Reviewed by Darin Adler.
+
+        In the put_by_val_direct operation, we use JSObject::putDirect.
+        However, it only accepts non-index property. For index property, we need to use JSObject::putDirectIndex.
+        This patch checks toString-ed Identifier is index or not to choose putDirect / putDirectIndex.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::putByVal):
+        (JSC::DFG::operationPutByValInternal):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Identifier.h:
+        (JSC::isIndex):
+        (JSC::parseIndex):
+        * tests/stress/dfg-put-by-val-direct-with-edge-numbers.js: Added.
+        (lookupWithKey):
+        (toStringThrowsError.toString):
+
+2015-04-06  Alberto Garcia  <berto@igalia.com>
+
+        [GTK] Fix HPPA build
+        https://bugs.webkit.org/show_bug.cgi?id=143453
+
+        Reviewed by Darin Adler.
+
+        Add HPPA to the list of supported CPUs.
+
+        * CMakeLists.txt:
+
+2015-04-06  Mark Lam  <mark.lam@apple.com>
+
+        In the 64-bit DFG and FTL, Array::Double case for HasIndexedProperty should set its result to true when all is well.
+        <https://webkit.org/b/143396>
+
+        Reviewed by Filip Pizlo.
+
+        The DFG was neglecting to set the result boolean.  The FTL was setting it with
+        an inverted value.  Both of these are now resolved.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileHasIndexedProperty):
+        * tests/stress/for-in-array-mode.js: Added.
+        (.):
+        (test):
+
+2015-04-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] DFG and FTL should be aware of that StringConstructor behavior for symbols becomes different from ToString
+        https://bugs.webkit.org/show_bug.cgi?id=143424
+
+        Reviewed by Geoffrey Garen.
+
+        In ES6, StringConstructor behavior becomes different from ToString abstract operations in the spec. (and JSValue::toString).
+
+        ToString(symbol) throws a type error.
+        However, String(symbol) produces SymbolDescriptiveString(symbol).
+
+        So, in DFG and FTL phase, they should not inline StringConstructor to ToString.
+
+        Now, in the template literals patch, ToString DFG operation is planned to be used.
+        And current ToString behavior is aligned to the spec (and JSValue::toString) and it's better.
+        So intead of changing ToString behavior, this patch adds CallStringConstructor operation into DFG and FTL.
+        In CallStringConstructor, all behavior in DFG analysis is the same.
+        Only the difference from ToString is, when calling DFG operation functions, it calls
+        operationCallStringConstructorOnCell and operationCallStringConstructor instead of
+        operationToStringOnCell and operationToString.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToStringOrCallStringConstructor):
+        (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
+        (JSC::DFG::FixupPhase::fixupToString): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOnCell):
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileToStringOrCallStringConstructor):
+        (JSC::FTL::LowerDFGToLLVM::compileToString): Deleted.
+        * runtime/StringConstructor.cpp:
+        (JSC::stringConstructor):
+        (JSC::callStringConstructor):
+        * runtime/StringConstructor.h:
+        * tests/stress/symbol-and-string-constructor.js: Added.
+        (performString):
+
+2015-04-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Return Optional<uint32_t> from PropertyName::asIndex
+        https://bugs.webkit.org/show_bug.cgi?id=143422
+
+        Reviewed by Darin Adler.
+
+        PropertyName::asIndex returns uint32_t and use UINT_MAX as NotAnIndex.
+        But it's not obvious to callers.
+
+        This patch changes
+        1. PropertyName::asIndex() to return Optional<uint32_t> and
+        2. function name `asIndex()` to `parseIndex()`.
+        It forces callers to check the value is index or not explicitly.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStubAndGetOldStructure):
+        * jsc.cpp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::getOwnPropertySlot):
+        (JSC::GenericArguments<Type>::put):
+        (JSC::GenericArguments<Type>::deleteProperty):
+        (JSC::GenericArguments<Type>::defineOwnProperty):
+        * runtime/Identifier.h:
+        (JSC::parseIndex):
+        (JSC::Identifier::isSymbol):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
+        (JSC::JSGenericTypedArrayView<Adaptor>::put):
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::putDirectCustomAccessor):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::putDirectMayBeIndex):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        * runtime/PropertyName.h:
+        (JSC::parseIndex):
+        (JSC::toUInt32FromCharacters): Deleted.
+        (JSC::toUInt32FromStringImpl): Deleted.
+        (JSC::PropertyName::asIndex): Deleted.
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+        * runtime/Structure.cpp:
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+
+2015-04-05  Andreas Kling  <akling@apple.com>
+
+        URI encoding/escaping should use efficient string building instead of calling snprintf().
+        <https://webkit.org/b/143426>
+
+        Reviewed by Gavin Barraclough.
+
+        I saw 0.5% of main thread time in snprintf() on <http://polymerlabs.github.io/benchmarks/>
+        which seemed pretty silly. This change gets that down to nothing in favor of using our
+        existing JSStringBuilder and HexNumber.h facilities.
+
+        These APIs are well-exercised by our existing test suite.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
+
+2015-04-05  Masataka Yakura  <masataka.yakura@gmail.com>
+
+        documentation for ES Promises points to the wrong one
+        https://bugs.webkit.org/show_bug.cgi?id=143263
+
+        Reviewed by Darin Adler.
+
+        * features.json:
+
+2015-04-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Remove "go ahead and" from comments
+        https://bugs.webkit.org/show_bug.cgi?id=143421
+
+        Reviewed by Darin Adler, Benjamin Poulain.
+
+        Remove the phrase "go ahead and" from comments where it doesn't add
+        anything (which is almost all of them).
+
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::growSlowCase):
+
+2015-04-04  Andreas Kling  <akling@apple.com>
+
+        Logically empty WeakBlocks should not pin down their MarkedBlocks indefinitely.
+        <https://webkit.org/b/143210>
+
+        Reviewed by Geoffrey Garen.
+
+        Since a MarkedBlock cannot be destroyed until all the WeakBlocks pointing into it are gone,
+        we had a little problem where WeakBlocks with only null pointers would still keep their
+        MarkedBlock alive.
+
+        This patch fixes that by detaching WeakBlocks from their MarkedBlock once a sweep discovers
+        that the WeakBlock contains no pointers to live objects. Ownership of the WeakBlock is passed
+        to the Heap, which will sweep the list of these detached WeakBlocks as part of a full GC,
+        destroying them once they're fully dead.
+
+        This allows the garbage collector to reclaim the 64kB MarkedBlocks much sooner, and resolves
+        a mysterious issue where doing two full garbage collections back-to-back would free additional
+        memory in the second collection.
+
+        Management of detached WeakBlocks is implemented as a Vector<WeakBlock*> in Heap, along with
+        an index of the next block in that vector that needs to be swept. The IncrementalSweeper then
+        calls into Heap::sweepNextLogicallyEmptyWeakBlock() to sweep one block at a time.
+
+        * heap/Heap.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage): Add a final pass where we sweep the logically empty WeakBlocks
+        owned by Heap, after everything else has been swept.
+
+        (JSC::Heap::notifyIncrementalSweeper): Set up an incremental sweep of logically empty WeakBlocks
+        after a full garbage collection ends. Note that we don't do this after Eden collections, since
+        they are unlikely to cause entire WeakBlocks to go empty.
+
+        (JSC::Heap::addLogicallyEmptyWeakBlock): Added. Interface for passing ownership of a WeakBlock
+        to the Heap when it's detached from a WeakSet.
+
+        (JSC::Heap::sweepAllLogicallyEmptyWeakBlocks): Helper for collectAllGarbage() that sweeps all
+        of the logically empty WeakBlocks owned by Heap.
+
+        (JSC::Heap::sweepNextLogicallyEmptyWeakBlock): Sweeps one logically empty WeakBlock if needed
+        and updates the next-logically-empty-weak-block-to-sweep index.
+
+        (JSC::Heap::lastChanceToFinalize): call sweepAllLogicallyEmptyWeakBlocks() here, since there
+        won't be another chance after this.
+
+        * heap/IncrementalSweeper.h:
+        (JSC::IncrementalSweeper::hasWork): Deleted.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::fullSweep):
+        (JSC::IncrementalSweeper::doSweep):
+        (JSC::IncrementalSweeper::sweepNextBlock): Restructured IncrementalSweeper a bit to simplify
+        adding a new sweeping stage for the Heap's logically empty WeakBlocks. sweepNextBlock() is
+        changed to return a bool (true if there's more work to be done.)
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::sweep): This now figures out if the WeakBlock is logically empty, i.e doesn't
+        contain any pointers to live objects. The answer is stored in a new SweepResult member.
+
+        * heap/WeakBlock.h:
+        (JSC::WeakBlock::isLogicallyEmptyButNotFree): Added. Can be queried after a sweep to determine
+        if the WeakBlock could be detached from the MarkedBlock.
+
+        (JSC::WeakBlock::SweepResult::SweepResult): Deleted in favor of initializing member variables
+        when declaring them.
+
+2015-04-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Implement ES6 Object.getOwnPropertySymbols
+        https://bugs.webkit.org/show_bug.cgi?id=141106
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements `Object.getOwnPropertySymbols`.
+        One technical issue is that, since we use private symbols (such as `@Object`) in the
+        privileged JS code in `builtins/`, they should not be exposed.
+        To distinguish them from the usual symbols, check the target `StringImpl*` is a not private name
+        before adding it into PropertyNameArray.
+
+        To check the target `StringImpl*` is a private name, we leverage privateToPublic map in `BuiltinNames`
+        since all private symbols are held in this map.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal):
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::isPrivateName):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::isPrivateName):
+        * runtime/CommonIdentifiers.h:
+        * runtime/EnumerationMode.h:
+        (JSC::EnumerationMode::EnumerationMode):
+        (JSC::EnumerationMode::includeSymbolProperties):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        (JSC::objectConstructorGetOwnPropertySymbols):
+        (JSC::defineProperties):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::create):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getPropertyNamesFromStructure):
+        * tests/stress/object-get-own-property-symbols-perform-to-object.js: Added.
+        (compare):
+        * tests/stress/object-get-own-property-symbols.js: Added.
+        (forIn):
+        * tests/stress/symbol-define-property.js: Added.
+        (testSymbol):
+        * tests/stress/symbol-seal-and-freeze.js: Added.
+        * tests/stress/symbol-with-json.js: Added.
+
+2015-04-03  Mark Lam  <mark.lam@apple.com>
+
+        Add Options::jitPolicyScale() as a single knob to make all compilations happen sooner.
+        <https://webkit.org/b/143385>
+
+        Reviewed by Geoffrey Garen.
+
+        For debugging purposes, sometimes, we want to be able to make compilation happen
+        sooner to see if we can accelerate the manifestation of certain events / bugs.
+        Currently, in order to achieve this, we'll have to tweak multiple JIT thresholds
+        which make up the compilation policy.  Let's add a single knob that can tune all
+        the thresholds up / down in one go proportionately so that we can easily tweak
+        how soon compilation occurs.
+
+        * runtime/Options.cpp:
+        (JSC::scaleJITPolicy):
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2015-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        is* API methods should be @properties
+        https://bugs.webkit.org/show_bug.cgi?id=143388
+
+        Reviewed by Mark Lam.
+
+        This appears to be the preferred idiom in WebKit, CA, AppKit, and
+        Foundation.
+
+        * API/JSValue.h: Be @properties.
+
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI): Use the @properties.
+
+2015-04-03  Mark Lam  <mark.lam@apple.com>
+
+        Some JSC Options refactoring and enhancements.
+        <https://webkit.org/b/143384>
+
+        Rubber stamped by Benjamin Poulain.
+
+        Create a better encapsulated Option class to make working with options easier.  This
+        is a building block towards a JIT policy scaling debugging option I will introduce later.
+
+        This work entails:
+        1. Convert Options::Option into a public class Option (who works closely with Options).
+        2. Convert Options::EntryType into an enum class Options::Type and make it public.
+        3. Renamed Options::OPT_<option name> to Options::<option name>ID because it reads better.
+        4. Add misc methods to class Option to make it more useable.
+
+        * runtime/Options.cpp:
+        (JSC::Options::dumpOption):
+        (JSC::Option::dump):
+        (JSC::Option::operator==):
+        (JSC::Options::Option::dump): Deleted.
+        (JSC::Options::Option::operator==): Deleted.
+        * runtime/Options.h:
+        (JSC::Option::Option):
+        (JSC::Option::operator!=):
+        (JSC::Option::name):
+        (JSC::Option::description):
+        (JSC::Option::type):
+        (JSC::Option::isOverridden):
+        (JSC::Option::defaultOption):
+        (JSC::Option::boolVal):
+        (JSC::Option::unsignedVal):
+        (JSC::Option::doubleVal):
+        (JSC::Option::int32Val):
+        (JSC::Option::optionRangeVal):
+        (JSC::Option::optionStringVal):
+        (JSC::Option::gcLogLevelVal):
+        (JSC::Options::Option::Option): Deleted.
+        (JSC::Options::Option::operator!=): Deleted.
+
+2015-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptCore API should support type checking for Array and Date
+        https://bugs.webkit.org/show_bug.cgi?id=143324
+
+        Follow-up to address a comment by Dan.
+
+        * API/WebKitAvailability.h: __MAC_OS_X_VERSION_MIN_REQUIRED <= 101100
+        is wrong, since this API is available when __MAC_OS_X_VERSION_MIN_REQUIRED
+        is equal to 101100.
+
+2015-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptCore API should support type checking for Array and Date
+        https://bugs.webkit.org/show_bug.cgi?id=143324
+
+        Follow-up to address a comment by Dan.
+
+        * API/WebKitAvailability.h: Do use 10.0 because it was right all along.
+        Added a comment explaining why.
+
+2015-04-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+        FTL JIT tests should fail if LLVM library isn't available
+        https://bugs.webkit.org/show_bug.cgi?id=143374
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * runtime/Options.h:
+
+2015-04-03  Zan Dobersek  <zdobersek@igalia.com>
+
+        Fix the EFL and GTK build after r182243
+        https://bugs.webkit.org/show_bug.cgi?id=143361
+
+        Reviewed by Csaba Osztrogonác.
+
+        * CMakeLists.txt: InspectorBackendCommands.js is generated in the
+        DerivedSources/JavaScriptCore/inspector/ directory.
+
+2015-04-03  Zan Dobersek  <zdobersek@igalia.com>
+
+        Unreviewed, fixing Clang builds of the GTK port on Linux.
+
+        * runtime/Options.cpp:
+        Include the <math.h> header for isnan().
+
+2015-04-02  Mark Lam  <mark.lam@apple.com>
+
+        Enhance ability to dump JSC Options.
+        <https://webkit.org/b/143357>
+
+        Reviewed by Benjamin Poulain.
+
+        Some enhancements to how the JSC options work:
+
+        1. Add a JSC_showOptions option which take values: 0 = None, 1 = Overridden only,
+           2 = All, 3 = Verbose.
+
+           The default is 0 (None).  This dumps nothing.
+           With the Overridden setting, at VM initialization time, we will dump all
+           option values that have been changed from their default.
+           With the All setting, at VM initialization time, we will dump all option values.
+           With the Verbose setting, at VM initialization time, we will dump all option
+           values along with their descriptions (if available).
+
+        2. We now store a copy of the default option values.
+
+           We later use this for comparison to tell if an option has been overridden, and
+           print the default value for reference.  As a result, we no longer need the
+           didOverride flag since we can compute whether the option is overridden at any time.
+
+        3. Added description strings to some options to be printed when JSC_showOptions=3 (Verbose).
+
+           This will come in handy later when we want to rename some of the options to more sane
+           names that are easier to remember.  For example, we can change
+           Options::dfgFunctionWhitelistFile() to Options::dfgWhiteList(), and
+           Options::slowPathAllocsBetweenGCs() to Options::forcedGcRate().  With the availability
+           of the description, we can afford to use shorter and less descriptive option names,
+           but they will be easier to remember and use for day to day debugging work.
+
+           In this patch, I did not change the names of any of the options yet.  I only added
+           description strings for options that I know about, and where I think the option name
+           isn't already descriptive enough.
+
+        4. Also deleted some unused code.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        (JSC::Options::setOption):
+        (JSC::Options::dumpAllOptions):
+        (JSC::Options::dumpOption):
+        (JSC::Options::Option::dump):
+        (JSC::Options::Option::operator==):
+        * runtime/Options.h:
+        (JSC::OptionRange::rangeString):
+        (JSC::Options::Option::Option):
+        (JSC::Options::Option::operator!=):
+
+2015-04-02  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptCore API should support type checking for Array and Date
+        https://bugs.webkit.org/show_bug.cgi?id=143324
+
+        Reviewed by Darin Adler, Sam Weinig, Dan Bernstein.
+
+        * API/JSValue.h:
+        * API/JSValue.mm:
+        (-[JSValue isArray]):
+        (-[JSValue isDate]): Added an ObjC API.
+
+        * API/JSValueRef.cpp:
+        (JSValueIsArray):
+        (JSValueIsDate):
+        * API/JSValueRef.h: Added a C API.
+
+        * API/WebKitAvailability.h: Brought our availability macros up to date
+        and fixed a harmless bug where "10_10" translated to "10.0".
+
+        * API/tests/testapi.c:
+        (main): Added a test and corrected a pre-existing leak.
+
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI): Added a test.
+
+2015-04-02  Mark Lam  <mark.lam@apple.com>
+
+        Add Options::dumpSourceAtDFGTime().
+        <https://webkit.org/b/143349>
+
+        Reviewed by Oliver Hunt, and Michael Saboff.
+
+        Sometimes, we will want to see the JS source code that we're compiling, and it
+        would be nice to be able to do this without having to jump thru a lot of hoops.
+        So, let's add a Options::dumpSourceAtDFGTime() option just like we have a
+        Options::dumpBytecodeAtDFGTime() option.
+
+        Also added versions of CodeBlock::dumpSource() and CodeBlock::dumpBytecode()
+        that explicitly take no arguments (instead of relying on the version that takes
+        the default argument).  These versions are friendlier to use when we want to call
+        them from an interactive debugging session.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpSource):
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * runtime/Options.h:
+
+2015-04-02  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Clean up EnumerationMode to easily extend
+        https://bugs.webkit.org/show_bug.cgi?id=143276
+
+        Reviewed by Geoffrey Garen.
+
+        To make the followings easily,
+        1. Adding new flag Include/ExcludeSymbols in the Object.getOwnPropertySymbols patch
+        2. Make ExcludeSymbols implicitly default for the existing flags
+        we encapsulate EnumerationMode flags into EnumerationMode class.
+
+        And this class manages 2 flags. Later it will be extended to 3.
+        1. DontEnumPropertiesMode (default is Exclude)
+        2. JSObjectPropertiesMode (default is Include)
+        3. SymbolPropertiesMode (default is Exclude)
+            SymbolPropertiesMode will be added in Object.getOwnPropertySymbols patch.
+
+        This patch replaces places using ExcludeDontEnumProperties
+        to EnumerationMode() value which represents default mode.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
+        * API/JSObjectRef.cpp:
+        (JSObjectCopyPropertyNames):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        * runtime/EnumerationMode.h:
+        (JSC::EnumerationMode::EnumerationMode):
+        (JSC::EnumerationMode::includeDontEnumProperties):
+        (JSC::EnumerationMode::includeJSObjectProperties):
+        (JSC::shouldIncludeDontEnumProperties): Deleted.
+        (JSC::shouldExcludeDontEnumProperties): Deleted.
+        (JSC::shouldIncludeJSObjectPropertyNames): Deleted.
+        (JSC::modeThatSkipsJSObject): Deleted.
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::getOwnPropertyNames):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnNonIndexPropertyNames):
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::getOwnNonIndexPropertyNames):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        * runtime/JSFunction.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnNonIndexPropertyNames):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        (JSC::JSObject::getGenericPropertyNames):
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::propertyNameEnumerator):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::defineProperties):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnNonIndexPropertyNames):
+        (JSC::RegExpObject::getPropertyNames):
+        (JSC::RegExpObject::getGenericPropertyNames):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::getOwnPropertyNames):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getPropertyNamesFromStructure):
+
+2015-04-01  Alex Christensen  <achristensen@webkit.org>
+
+        Progress towards CMake on Windows and Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=143293
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+        Enabled using assembly on Windows.
+        Replaced unix commands with CMake commands.
+        * PlatformMac.cmake:
+        Tell open source builders where to find unicode headers.
+
+2015-04-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        IteratorClose should be called when jumping over the target for-of loop
+        https://bugs.webkit.org/show_bug.cgi?id=143140
+
+        Reviewed by Geoffrey Garen.
+
+        This patch fixes labeled break/continue behaviors with for-of and iterators.
+
+        1. Support IteratorClose beyond multiple loop contexts
+        Previously, IteratorClose is only executed in for-of's breakTarget().
+        However, this misses IteratorClose execution when statement roll-ups multiple control flow contexts.
+        For example,
+        outer: for (var e1 of outer) {
+            inner: for (var e2 of inner) {
+                break outer;
+            }
+        }
+        In this case, return method of inner should be called.
+        We leverage the existing system for `finally` to execute inner.return method correctly.
+        Leveraging `finally` system fixes `break`, `continue` and `return` cases.
+        `throw` case is already supported by emitting try-catch handlers in for-of.
+
+        2. Incorrect LabelScope creation is done in ForOfNode
+        ForOfNode creates duplicated LabelScope.
+        It causes infinite loop when executing the following program that contains
+        explicitly labeled for-of loop.
+        For example,
+        inner: for (var elm of array) {
+            continue inner;
+        }
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::pushIteratorCloseContext):
+        (JSC::BytecodeGenerator::popFinallyContext):
+        (JSC::BytecodeGenerator::popIteratorCloseContext):
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::emitIteratorClose):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForOfNode::emitBytecode):
+        * tests/stress/iterator-return-beyond-multiple-iteration-scopes.js: Added.
+        (createIterator.iterator.return):
+        (createIterator):
+        * tests/stress/raise-error-in-iterator-close.js: Added.
+        (createIterator.iterator.return):
+        (createIterator):
+
+2015-04-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Symbol.unscopables
+        https://bugs.webkit.org/show_bug.cgi?id=142829
+
+        Reviewed by Geoffrey Garen.
+
+        This patch introduces Symbol.unscopables functionality.
+        In ES6, some generic names (like keys, values) are introduced
+        as Array's method name. And this breaks the web since some web sites
+        use like the following code.
+
+        var values = ...;
+        with (array) {
+            values;  // This values is trapped by array's method "values".
+        }
+
+        To fix this, Symbol.unscopables introduces blacklist
+        for with scope's trapping. When resolving scope,
+        if name is found in the target scope and the target scope is with scope,
+        we check Symbol.unscopables object to filter generic names.
+
+        This functionality is only active for with scopes.
+        Global scope does not have unscopables functionality.
+
+        And since
+        1) op_resolve_scope for with scope always return Dynamic resolve type,
+        2) in that case, JSScope::resolve is always used in JIT and LLInt,
+        3) the code which contains op_resolve_scope that returns Dynamic cannot be compiled with DFG and FTL,
+        to implement this functionality, we just change JSScope::resolve and no need to change JIT code.
+        So performance regression is only visible in Dynamic resolving case, and it is already much slow.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::runtimeFlags):
+        * runtime/JSScope.cpp:
+        (JSC::isUnscopable):
+        (JSC::JSScope::resolve):
+        * runtime/JSScope.h:
+        (JSC::ScopeChainIterator::scope):
+        * tests/stress/global-environment-does-not-trap-unscopables.js: Added.
+        (test):
+        * tests/stress/unscopables.js: Added.
+        (test):
+        (.):
+
+2015-03-31  Ryosuke Niwa  <rniwa@webkit.org>
+
+        ES6 class syntax should allow static setters and getters
+        https://bugs.webkit.org/show_bug.cgi?id=143180
+
+        Reviewed by Filip Pizlo
+
+        Apparently I misread the spec when I initially implemented parseClass.
+        ES6 class syntax allows static getters and setters so just allow that.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+
+2015-03-31  Filip Pizlo  <fpizlo@apple.com>
+
+        PutClosureVar CSE def() rule has a wrong base
+        https://bugs.webkit.org/show_bug.cgi?id=143280
+
+        Reviewed by Michael Saboff.
+        
+        I think that this code was incorrect in a benign way, since the base of a
+        PutClosureVar is not a JS-visible object. But it was preventing some optimizations.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2015-03-31  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r182200.
+        https://bugs.webkit.org/show_bug.cgi?id=143279
+
+        Probably causing assertion extravaganza on bots. (Requested by
+        kling on #webkit).
+
+        Reverted changeset:
+
+        "Logically empty WeakBlocks should not pin down their
+        MarkedBlocks indefinitely."
+        https://bugs.webkit.org/show_bug.cgi?id=143210
+        http://trac.webkit.org/changeset/182200
+
+2015-03-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Clean up Identifier factories to clarify the meaning of StringImpl*
+        https://bugs.webkit.org/show_bug.cgi?id=143146
+
+        Reviewed by Filip Pizlo.
+
+        In the a lot of places, `Identifier(VM*/ExecState*, StringImpl*)` constructor is used.
+        However, it's ambiguous because `StringImpl*` has 2 different meanings.
+        1) normal string, it is replacable with `WTFString` and
+        2) `uid`, which holds `isSymbol` information to represent Symbols.
+        So we dropped Identifier constructors for strings and instead, introduced 2 factory functions.
+        + `Identifier::fromString(VM*/ExecState*, const String&)`.
+        Just construct Identifier from strings. The symbol-ness of StringImpl* is not kept.
+        + `Identifier::fromUid(VM*/ExecState*, StringImpl*)`.
+        This function is used for 2) `uid`. So symbol-ness of `StringImpl*` is kept.
+
+        And to clean up `StringImpl` which is used as uid,
+        we introduce `StringKind` into `StringImpl`. There's 3 kinds
+        1. StringNormal (non-atomic, non-symbol)
+        2. StringAtomic (atomic, non-symbol)
+        3. StringSymbol (non-atomic, symbol)
+        They are mutually exclusive. And (atomic, symbol) case should not exist.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::getOwnNonIndexPropertyNames):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::identifier):
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptFunctionCall::call):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal):
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::BuiltinNames):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitThrowReferenceError):
+        (JSC::BytecodeGenerator::emitThrowTypeError):
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        * dfg/DFGDesiredIdentifiers.cpp:
+        (JSC::DFG::DesiredIdentifiers::reallyAdd):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::functionDetails):
+        (Inspector::constructInternalProperty):
+        (Inspector::JSInjectedScriptHost::weakMapEntries):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::extractSourceInformationFromException):
+        * jit/JITOperations.cpp:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (GlobalObject::addFunction):
+        (GlobalObject::addConstructableFunction):
+        (functionRun):
+        (runWithScripts):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::addVar):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::makeIdentifier):
+        (JSC::IdentifierArena::makeIdentifierLCharFromUChar):
+        (JSC::IdentifierArena::makeNumericIdentifier):
+        * runtime/ArgumentsIteratorPrototype.cpp:
+        (JSC::ArgumentsIteratorPrototype::finishCreation):
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoFuncPush):
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfo):
+        (JSC::hasErrorInfo):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::getOwnPropertySlot):
+        * runtime/Identifier.h:
+        (JSC::Identifier::isSymbol):
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::from): Deleted.
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::Identifier):
+        (JSC::Identifier::fromUid):
+        (JSC::Identifier::fromString):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContextAssumingStructure):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::toPropertyKey):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        * runtime/JSObject.h:
+        (JSC::makeIdentifier):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructorFuncRace):
+        (JSC::JSPromiseConstructorFuncAll):
+        * runtime/JSString.h:
+        (JSC::JSString::toIdentifier):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::tryJSONPParse):
+        (JSC::LiteralParser<CharType>::makeIdentifier):
+        * runtime/Lookup.h:
+        (JSC::reifyStaticProperties):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototype::finishCreation):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::get):
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+        (JSC::PropertyName::publicName):
+        (JSC::PropertyName::asIndex):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::addKnownUnique):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::finishCreation):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototype::finishCreation):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        * runtime/StringIteratorPrototype.cpp:
+        (JSC::StringIteratorPrototype::finishCreation):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getPropertyNamesFromStructure):
+        * runtime/SymbolConstructor.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::throwException):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+
+2015-03-31  Andreas Kling  <akling@apple.com>
+
+        Logically empty WeakBlocks should not pin down their MarkedBlocks indefinitely.
+        <https://webkit.org/b/143210>
+
+        Reviewed by Geoffrey Garen.
+
+        Since a MarkedBlock cannot be destroyed until all the WeakBlocks pointing into it are gone,
+        we had a little problem where WeakBlocks with only null pointers would still keep their
+        MarkedBlock alive.
+
+        This patch fixes that by detaching WeakBlocks from their MarkedBlock once a sweep discovers
+        that the WeakBlock contains no pointers to live objects. Ownership of the WeakBlock is passed
+        to the Heap, which will sweep the list of these detached WeakBlocks as part of a full GC,
+        destroying them once they're fully dead.
+
+        This allows the garbage collector to reclaim the 64kB MarkedBlocks much sooner, and resolves
+        a mysterious issue where doing two full garbage collections back-to-back would free additional
+        memory in the second collection.
+
+        Management of detached WeakBlocks is implemented as a Vector<WeakBlock*> in Heap, along with
+        an index of the next block in that vector that needs to be swept. The IncrementalSweeper then
+        calls into Heap::sweepNextLogicallyEmptyWeakBlock() to sweep one block at a time.
+
+        * heap/Heap.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage): Add a final pass where we sweep the logically empty WeakBlocks
+        owned by Heap, after everything else has been swept.
+
+        (JSC::Heap::notifyIncrementalSweeper): Set up an incremental sweep of logically empty WeakBlocks
+        after a full garbage collection ends. Note that we don't do this after Eden collections, since
+        they are unlikely to cause entire WeakBlocks to go empty.
+
+        (JSC::Heap::addLogicallyEmptyWeakBlock): Added. Interface for passing ownership of a WeakBlock
+        to the Heap when it's detached from a WeakSet.
+
+        (JSC::Heap::sweepAllLogicallyEmptyWeakBlocks): Helper for collectAllGarbage() that sweeps all
+        of the logically empty WeakBlocks owned by Heap.
+
+        (JSC::Heap::sweepNextLogicallyEmptyWeakBlock): Sweeps one logically empty WeakBlock if needed
+        and updates the next-logically-empty-weak-block-to-sweep index.
+
+        (JSC::Heap::lastChanceToFinalize): call sweepAllLogicallyEmptyWeakBlocks() here, since there
+        won't be another chance after this.
+
+        * heap/IncrementalSweeper.h:
+        (JSC::IncrementalSweeper::hasWork): Deleted.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::fullSweep):
+        (JSC::IncrementalSweeper::doSweep):
+        (JSC::IncrementalSweeper::sweepNextBlock): Restructured IncrementalSweeper a bit to simplify
+        adding a new sweeping stage for the Heap's logically empty WeakBlocks. sweepNextBlock() is
+        changed to return a bool (true if there's more work to be done.)
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::sweep): This now figures out if the WeakBlock is logically empty, i.e doesn't
+        contain any pointers to live objects. The answer is stored in a new SweepResult member.
+
+        * heap/WeakBlock.h:
+        (JSC::WeakBlock::isLogicallyEmptyButNotFree): Added. Can be queried after a sweep to determine
+        if the WeakBlock could be detached from the MarkedBlock.
+
+        (JSC::WeakBlock::SweepResult::SweepResult): Deleted in favor of initializing member variables
+        when declaring them.
+
+2015-03-31  Ryosuke Niwa  <rniwa@webkit.org>
+
+        eval("this.foo") causes a crash if this had not been initialized in a derived class's constructor
+        https://bugs.webkit.org/show_bug.cgi?id=142883
+
+        Reviewed by Filip Pizlo.
+
+        The crash was caused by eval inside the constructor of a derived class not checking TDZ.
+
+        Fixed the bug by adding a parser flag that forces the TDZ check to be always emitted when accessing "this"
+        in eval inside a derived class' constructor.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::getSlow):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::thisExpr):
+        * parser/NodeConstructors.h:
+        (JSC::ThisNode::ThisNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::thisExpr):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::SourceCodeKey):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::create):
+        * runtime/Executable.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * tests/stress/class-syntax-no-tdz-in-eval.js: Added.
+        * tests/stress/class-syntax-tdz-in-eval.js: Added.
+
+2015-03-31  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r182186.
+        https://bugs.webkit.org/show_bug.cgi?id=143270
+
+        it crashes all the WebGL tests on the Debug bots (Requested by
+        dino on #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: add 2D/WebGL canvas instrumentation
+        infrastructure"
+        https://bugs.webkit.org/show_bug.cgi?id=137278
+        http://trac.webkit.org/changeset/182186
+
+2015-03-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Object type restrictions on a first parameter of several Object.* functions are relaxed
+        https://bugs.webkit.org/show_bug.cgi?id=142937
+
+        Reviewed by Darin Adler.
+
+        In ES6, Object type restrictions on a first parameter of several Object.* functions are relaxed.
+        In ES5 or prior, when a first parameter is not object type, these functions raise TypeError.
+        But now, several functions perform ToObject onto a non-object parameter.
+        And others behaves as if a parameter is a non-extensible ordinary object with no own properties.
+        It is described in ES6 Annex E.
+        Functions different from ES5 are following.
+
+        1. An attempt is make to coerce the argument using ToObject.
+            Object.getOwnPropertyDescriptor
+            Object.getOwnPropertyNames
+            Object.getPrototypeOf
+            Object.keys
+
+        2. Treated as if it was a non-extensible ordinary object with no own properties.
+            Object.freeze
+            Object.isExtensible
+            Object.isFrozen
+            Object.isSealed
+            Object.preventExtensions
+            Object.seal
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+        * tests/stress/object-freeze-accept-non-object.js: Added.
+        * tests/stress/object-get-own-property-descriptor-perform-to-object.js: Added.
+        (canary):
+        * tests/stress/object-get-own-property-names-perform-to-object.js: Added.
+        (compare):
+        * tests/stress/object-get-prototype-of-perform-to-object.js: Added.
+        * tests/stress/object-is-extensible-accept-non-object.js: Added.
+        * tests/stress/object-is-frozen-accept-non-object.js: Added.
+        * tests/stress/object-is-sealed-accept-non-object.js: Added.
+        * tests/stress/object-keys-perform-to-object.js: Added.
+        (compare):
+        * tests/stress/object-prevent-extensions-accept-non-object.js: Added.
+        * tests/stress/object-seal-accept-non-object.js: Added.
+
+2015-03-31  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: add 2D/WebGL canvas instrumentation infrastructure
+        https://bugs.webkit.org/show_bug.cgi?id=137278
+
+        Reviewed by Timothy Hatcher.
+
+        Added Canvas protocol which defines types used by InspectorCanvasAgent.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * inspector/protocol/Canvas.json: Added.
+
+        * inspector/scripts/codegen/generator.py:
+        (Generator.stylized_name_for_enum_value):
+        Added special handling for 2D (always uppercase) and WebGL (rename mapping) enum strings.
+
+2015-03-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Extending null should set __proto__ to null
+        https://bugs.webkit.org/show_bug.cgi?id=142882
+
+        Reviewed by Geoffrey Garen and Benjamin Poulain.
+
+        Set Derived.prototype.__proto__ to null when extending null.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ClassExprNode::emitBytecode):
+
+2015-03-30  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION (r181993): inspector-protocol/debugger/setBreakpoint-dfg-and-modify-local.html crashes.
+        <https://webkit.org/b/143105>
+
+        Reviewed by Filip Pizlo.
+
+        With r181993, the DFG and FTL may elide the storing of the scope register.  As a result,
+        on OSR exits from DFG / FTL frames where this elision has take place, we may get baseline
+        JIT frames that may have its scope register not set.  The Debugger's current implementation
+        which relies on the scope register is not happy about this.  For example, this results in a
+        crash in the layout test inspector-protocol/debugger/setBreakpoint-dfg-and-modify-local.html.
+
+        The fix is to disable inlining when the debugger is in use.  Also, we add Flush nodes to
+        ensure that the scope register value is flushed to the register in the stack frame.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::flush):
+        - Add code to flush the scope register.
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        - Pretend that all codeBlocks are too expensive to inline if the debugger is in use, thereby
+          disabling inlining whenever the debugger is in use.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::hasDebuggerEnabled):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        - Update the DFG codeBlock's scopeRegister since it can be moved during stack layout.
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        - Update the FTL codeBlock's scopeRegister since it can be moved during stack layout.
+
+2015-03-30  Michael Saboff  <msaboff@apple.com>
+
+        Fix flakey float32-repeat-out-of-bounds.js and int8-repeat-out-of-bounds.js tests for ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=138391
+
+        Reviewed by Mark Lam.
+
+        Re-enabling these tests as I can't get them to fail on local iOS test devices.
+        There have been many changes since these tests were disabled.
+        I'll watch automated test results for failures.  If there are failures running automated
+        testing, it might be due to the device's relative CPU performance.
+        
+        * tests/stress/float32-repeat-out-of-bounds.js:
+        * tests/stress/int8-repeat-out-of-bounds.js:
+
+2015-03-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Regression: Preview for [[null]] shouldn't be []
+        https://bugs.webkit.org/show_bug.cgi?id=143208
+
+        Reviewed by Mark Lam.
+
+        * inspector/InjectedScriptSource.js:
+        Handle null when generating simple object previews.
+
+2015-03-30  Per Arne Vollan  <peavo@outlook.com>
+
+        Avoid using hardcoded values for JSValue::Int32Tag, if possible.
+        https://bugs.webkit.org/show_bug.cgi?id=143134
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JSInterfaceJIT.h:
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+
+2015-03-30  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: js/regress/inline-arguments-local-escape.html is flaky
+        https://bugs.webkit.org/show_bug.cgi?id=143104
+
+        Reviewed by Geoffrey Garen.
+        
+        Created a test that is a 100% repro of the flaky failure. This test is called
+        get-my-argument-by-val-for-inlined-escaped-arguments.js. It fails all of the time because it
+        always causes the compiler to emit a GetMyArgumentByVal of the arguments object returned by
+        the inlined function. Other than that, it's the same as inline-arguments-local-escape.
+        
+        Also created three more tests for three similar, but not identical, failures.
+        
+        Then fixed the bug: PreciseLocalClobberize was assuming that if we read(Stack) then we are
+        only reading those parts of the stack that are relevant to the current semantic code origin.
+        That's false after ArgumentsEliminationPhase - we might have operations on phantom arguments,
+        like GetMyArgumentByVal, ForwardVarargs, CallForwardVarargs, and ConstructForwardVarargs, that
+        read parts of the stack associated with the inline call frame for the phantom arguments. This
+        may not be subsumed by the current semantic origin's stack area in cases that the arguments
+        were allowed to "locally" escape.
+        
+        The higher-order lesson here is that in DFG SSA IR, the current semantic origin's stack area
+        is not really a meaningful concept anymore. It is only meaningful for nodes that will read
+        the stack due to function.arguments, but there are a bunch of other ways that we could also
+        read the stack and those operations may read any stack slot. I believe that this change makes
+        PreciseLocalClobberize right: it will refine a read(Stack) from Clobberize correctly by casing
+        on node type. In future, if we add a read(Stack) to Clobberize, we'll have to make sure that
+        readTop() in PreciseLocalClobberize does the right thing.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * tests/stress/call-forward-varargs-for-inlined-escaped-arguments.js: Added.
+        * tests/stress/construct-forward-varargs-for-inlined-escaped-arguments.js: Added.
+        * tests/stress/forward-varargs-for-inlined-escaped-arguments.js: Added.
+        * tests/stress/get-my-argument-by-val-for-inlined-escaped-arguments.js: Added.
+        * tests/stress/real-forward-varargs-for-inlined-escaped-arguments.js: Added.
+
+2015-03-30  Benjamin Poulain  <benjamin@webkit.org>
+
+        Start the features.json files
+        https://bugs.webkit.org/show_bug.cgi?id=143207
+
+        Reviewed by Darin Adler.
+
+        Start the features.json files to have something to experiment
+        with for the UI.
+
+        * features.json: Added.
+
+2015-03-29  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [Win] Addresing post-review comment after r182122
+        https://bugs.webkit.org/show_bug.cgi?id=143189
+
+        Unreviewed.
+
+2015-03-29  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [Win] Allow building JavaScriptCore without Cygwin
+        https://bugs.webkit.org/show_bug.cgi?id=143189
+
+        Reviewed by Brent Fulgham.
+
+        Paths like /usr/bin/ don't exist on Windows.
+        Hashbangs don't work on Windows. Instead we must explicitly call the executable.
+        Prefixing commands with environment variables doesn't work on Windows.
+        Windows doesn't have 'cmp'
+        Windows uses 'del' instead of 'rm'
+        Windows uses 'type NUL' intead of 'touch'
+
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.pl:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make:
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.pl:
+        * JavaScriptCore.vcxproj/build-generated-files.pl:
+        * UpdateContents.py: Copied from Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.pl.
+
+2015-03-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Clean up JavaScriptCore/builtins
+        https://bugs.webkit.org/show_bug.cgi?id=143177
+
+        Reviewed by Ryosuke Niwa.
+
+        * builtins/ArrayConstructor.js:
+        (from):
+        - We can compare to undefined instead of using a typeof undefined check.
+        - Converge on double quoted strings everywhere.
+
+        * builtins/ArrayIterator.prototype.js:
+        (next):
+        * builtins/StringIterator.prototype.js:
+        (next):
+        - Use shorthand object construction to avoid duplication.
+        - Improve grammar in error messages.
+
+        * tests/stress/array-iterators-next-with-call.js:
+        * tests/stress/string-iterators.js:
+        - Update for new error message strings.
+
+2015-03-28  Saam Barati  <saambarati1@gmail.com>
+
+        Web Inspector: ES6: Better support for Symbol types in Type Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=141257
+
+        Reviewed by Joseph Pecoraro.
+
+        ES6 introduces the new primitive type Symbol. This patch makes JSC's 
+        type profiler support this new primitive type.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * inspector/protocol/Runtime.json:
+        * runtime/RuntimeType.cpp:
+        (JSC::runtimeTypeForValue):
+        * runtime/RuntimeType.h:
+        (JSC::runtimeTypeIsPrimitive):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::TypeSet::dumpTypes):
+        (JSC::TypeSet::doesTypeConformTo):
+        (JSC::TypeSet::displayName):
+        (JSC::TypeSet::inspectorTypeSet):
+        (JSC::TypeSet::toJSONString):
+        * runtime/TypeSet.h:
+        (JSC::TypeSet::seenTypes):
+        * tests/typeProfiler/driver/driver.js:
+        * tests/typeProfiler/symbol.js: Added.
+        (wrapper.foo):
+        (wrapper.bar):
+        (wrapper.bar.bar.baz):
+        (wrapper):
+
+2015-03-27  Saam Barati  <saambarati1@gmail.com>
+
+        Deconstruction parameters are bound too late
+        https://bugs.webkit.org/show_bug.cgi?id=143148
+
+        Reviewed by Filip Pizlo.
+
+        Currently, a deconstruction pattern named with the same
+        name as a function will shadow the function. This is
+        wrong. It should be the other way around.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+
+2015-03-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        parse doesn't initialize the 16-bit version of the JSC parser with defaultConstructorKind
+        https://bugs.webkit.org/show_bug.cgi?id=143170
+
+        Reviewed by Benjamin Poulain.
+
+        Assert that we never use 16-bit version of the parser to parse a default constructor
+        since both base and derived default constructors should be using a 8-bit string.
+
+        * parser/Parser.h:
+        (JSC::parse):
+
+2015-03-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        ES6 Classes: Runtime error in JIT'd class calling super() with arguments and superclass has default constructor
+        https://bugs.webkit.org/show_bug.cgi?id=142862
+
+        Reviewed by Benjamin Poulain.
+
+        Add a test that used to fail in DFG now that the bug has been fixed by r181993.
+
+        * tests/stress/class-syntax-derived-default-constructor.js: Added.
+
+2015-03-27  Michael Saboff  <msaboff@apple.com>
+
+        load8Signed() and load16Signed() should be renamed to avoid confusion
+        https://bugs.webkit.org/show_bug.cgi?id=143168
+
+        Reviewed by Benjamin Poulain.
+
+        Renamed load8Signed() to load8SignedExtendTo32() and load16Signed() to load16SignedExtendTo32().
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::load8SignedExtendTo32):
+        (JSC::MacroAssemblerARM::load16SignedExtendTo32):
+        (JSC::MacroAssemblerARM::load8Signed): Deleted.
+        (JSC::MacroAssemblerARM::load16Signed): Deleted.
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
+        (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
+        (JSC::MacroAssemblerARM64::load16Signed): Deleted.
+        (JSC::MacroAssemblerARM64::load8Signed): Deleted.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load16SignedExtendTo32):
+        (JSC::MacroAssemblerARMv7::load8SignedExtendTo32):
+        (JSC::MacroAssemblerARMv7::load16Signed): Deleted.
+        (JSC::MacroAssemblerARMv7::load8Signed): Deleted.
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load8SignedExtendTo32):
+        (JSC::MacroAssemblerMIPS::load16SignedExtendTo32):
+        (JSC::MacroAssemblerMIPS::load8Signed): Deleted.
+        (JSC::MacroAssemblerMIPS::load16Signed): Deleted.
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::load8SignedExtendTo32):
+        (JSC::MacroAssemblerSH4::load8):
+        (JSC::MacroAssemblerSH4::load16SignedExtendTo32):
+        (JSC::MacroAssemblerSH4::load16):
+        (JSC::MacroAssemblerSH4::load8Signed): Deleted.
+        (JSC::MacroAssemblerSH4::load16Signed): Deleted.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load8SignedExtendTo32):
+        (JSC::MacroAssemblerX86Common::load16SignedExtendTo32):
+        (JSC::MacroAssemblerX86Common::load8Signed): Deleted.
+        (JSC::MacroAssemblerX86Common::load16Signed): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+
+2015-03-27  Michael Saboff  <msaboff@apple.com>
+
+        Fix flakey dfg-int8array.js and dfg-int16array.js tests for ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=138390
+
+        Reviewed by Mark Lam.
+
+        Changed load8Signed() and load16Signed() to only sign extend the loaded value to 32 bits
+        instead of 64 bits.  This is what X86-64 does.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::load16Signed):
+        (JSC::MacroAssemblerARM64::load8Signed):
+
+2015-03-27  Saam Barati  <saambarati1@gmail.com>
+
+        Add back previously broken assert from bug 141869
+        https://bugs.webkit.org/show_bug.cgi?id=143005
+
+        Reviewed by Michael Saboff.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::invalidParameterInSourceAppender):
+
+2015-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Make some more objects use FastMalloc
+        https://bugs.webkit.org/show_bug.cgi?id=143122
+
+        Reviewed by Csaba Osztrogonác.
+
+        * API/JSCallbackObject.h:
+        * heap/IncrementalSweeper.h:
+        * jit/JITThunks.h:
+        * runtime/JSGlobalObjectDebuggable.h:
+        * runtime/RegExpCache.h:
+
+2015-03-27  Michael Saboff  <msaboff@apple.com>
+
+        Objects with numeric properties intermittently get a phantom 'length' property
+        https://bugs.webkit.org/show_bug.cgi?id=142792
+
+        Reviewed by Csaba Osztrogonác.
+
+        Fixed a > (greater than) that should be a >> (right shift) in the code that disassembles
+        test and branch instructions.  This function is used for linking tbz/tbnz branches between
+        two seperately JIT'ed sections of code.  Sometime we'd create a bogus tbz instruction in
+        the failure case checks in the GetById array length stub created for "obj.length" access.
+        If the failure case code address was at a negative offset from the stub, we'd look for bit 1
+        being set when we should have been looking for bit 0.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::disassembleTestAndBranchImmediate):
+
+2015-03-27  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Insert exception check around toPropertyKey call
+        https://bugs.webkit.org/show_bug.cgi?id=142922
+
+        Reviewed by Geoffrey Garen.
+
+        In some places, exception check is missing after/before toPropertyKey.
+        However, since it calls toString, it's observable to users,
+
+        Missing exception checks in Object.prototype methods can be
+        observed since it would be overridden with toObject(null/undefined) errors.
+        We inserted exception checks after toPropertyKey.
+
+        Missing exception checks in GetById related code can be
+        observed since it would be overridden with toObject(null/undefined) errors.
+        In this case, we need to insert exception checks before/after toPropertyKey
+        since RequireObjectCoercible followed by toPropertyKey can cause exceptions.
+
+        JSValue::get checks null/undefined and raise an exception if |this| is null or undefined.
+        However, we need to check whether the baseValue is object coercible before executing JSValue::toPropertyKey.
+        According to the spec, we first perform RequireObjectCoercible and check the exception.
+        And second, we perform ToPropertyKey and check the exception.
+        Since JSValue::toPropertyKey can cause toString call, this is observable to users.
+        For example, if the target is not object coercible,
+        ToPropertyKey should not be executed, and toString should not be executed by ToPropertyKey.
+        So the order of observable actions (RequireObjectCoercible and ToPropertyKey) should be correct to the spec.
+
+        This patch introduces JSValue::requireObjectCoercible and use it because of the following 2 reasons.
+
+        1. Using toObject instead of requireObjectCoercible produces unnecessary wrapper object.
+
+        toObject converts primitive types into wrapper objects.
+        But it is not efficient since wrapper objects are not necessary
+        if we look up methods from primitive values's prototype. (using synthesizePrototype is better).
+
+        2. Using the result of toObject is not correct to the spec.
+
+        To align to the spec correctly, we cannot use JSObject::get
+        by using the wrapper object produced by the toObject suggested in (1).
+        If we use JSObject that is converted by toObject, getter will be called by using this JSObject as |this|.
+        It is not correct since getter should be called with the original |this| value that may be primitive types.
+
+        So in this patch, we use JSValue::requireObjectCoercible
+        to check the target is object coercible and raise an error if it's not.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::requireObjectCoercible):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        * tests/stress/exception-in-to-property-key-should-be-handled-early-in-object-methods.js: Added.
+        (shouldThrow):
+        (if):
+        * tests/stress/exception-in-to-property-key-should-be-handled-early.js: Added.
+        (shouldThrow):
+        (.):
+
+2015-03-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        WebContent Crash when instantiating class with Type Profiling enabled
+        https://bugs.webkit.org/show_bug.cgi?id=143037
+
+        Reviewed by Ryosuke Niwa.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitMoveEmptyValue):
+        We cannot profile the type of an uninitialized empty JSValue.
+        Nor do we expect this to be necessary, since it is effectively
+        an unseen undefined value. So add a way to put the empty value
+        without profiling.
+
+        (JSC::BytecodeGenerator::emitMove):
+        Add an assert to try to catch this issue early on, and force
+        callers to explicitly use emitMoveEmptyValue instead.
+
+        * tests/typeProfiler/classes.js: Added.
+        (wrapper.Base):
+        (wrapper.Derived):
+        (wrapper):
+        Add test coverage both for this case and classes in general.
+
+2015-03-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ES6: Provide a better view for Classes in the console
+        https://bugs.webkit.org/show_bug.cgi?id=142999
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Runtime.json:
+        Provide a new `subtype` enum "class". This is a subtype of `type`
+        "function", all other subtypes are subtypes of `object` types.
+        For a class, the frontend will immediately want to get the prototype
+        to enumerate its methods, so include the `classPrototype`.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        Denote class construction functions as "class" subtypes.
+
+        * inspector/InjectedScriptSource.js:
+        Handling for the new "class" type.
+
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::isClassConstructorFunction):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::isClassConstructorFunction):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::isClassConstructorFunction):
+        Check if this function is a class constructor function. That information
+        is on the UnlinkedFunctionExecutable, so plumb it through to JSFunction.
+
+2015-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Function.prototype.toString should not decompile the AST
+        https://bugs.webkit.org/show_bug.cgi?id=142853
+
+        Reviewed by Darin Adler.
+
+        Following up on Darin's review comments.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+
+2015-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        "lineNo" does not match WebKit coding style guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=143119
+
+        Reviewed by Michael Saboff.
+
+        We can afford to use whole words.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::link):
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::WhileNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::toggleBreakpoint):
+        * interpreter/Interpreter.cpp:
+        (JSC::StackFrame::computeLineAndColumn):
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::Interpreter::execute):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::computeLineAndColumn):
+        * parser/Nodes.h:
+        (JSC::Node::firstLine):
+        (JSC::Node::lineNo): Deleted.
+        (JSC::StatementNode::firstLine): Deleted.
+        * parser/ParserError.h:
+        (JSC::ParserError::toErrorObject):
+        * profiler/LegacyProfiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::firstLine):
+        (JSC::ScriptExecutable::setOverrideLineNumber):
+        (JSC::ScriptExecutable::hasOverrideLineNumber):
+        (JSC::ScriptExecutable::overrideLineNumber):
+        (JSC::ScriptExecutable::lineNo): Deleted.
+        (JSC::ScriptExecutable::setOverrideLineNo): Deleted.
+        (JSC::ScriptExecutable::hasOverrideLineNo): Deleted.
+        (JSC::ScriptExecutable::overrideLineNo): Deleted.
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+        * tools/CodeProfile.cpp:
+        (JSC::CodeProfile::report):
+        * tools/CodeProfile.h:
+        (JSC::CodeProfile::CodeProfile):
+
+2015-03-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Assertion firing in JavaScriptCore/parser/parser.h for statesman.com site
+        https://bugs.webkit.org/show_bug.cgi?id=142974
+
+        Reviewed by Joseph Pecoraro.
+
+        This patch does two things:
+
+        (1) Restore JavaScriptCore's sanitization of line and column numbers to
+        one-based values.
+
+        We need this because WebCore sometimes provides huge negative column
+        numbers.
+
+        (2) Solve the attribute event listener line numbering problem a different
+        way: Rather than offseting all line numbers by -1 in an attribute event
+        listener in order to arrange for a custom result, instead use an explicit
+        feature for saying "all errors in this code should map to this line number".
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::link):
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        * bytecode/UnlinkedCodeBlock.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::StackFrame::computeLineAndColumn):
+        (JSC::GetStackTraceFunctor::operator()):
+        * interpreter/Interpreter.h:
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::computeLineAndColumn):
+        * parser/ParserError.h:
+        (JSC::ParserError::toErrorObject): Plumb through an override line number.
+        When a function has an override line number, all syntax and runtime
+        errors in the function will map to it. This is useful for attribute event
+        listeners.
+ 
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode): Restore the old sanitization of line and
+        column numbers to one-based integers. It was kind of a hack to remove this.
+
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::setOverrideLineNo):
+        (JSC::ScriptExecutable::hasOverrideLineNo):
+        (JSC::ScriptExecutable::overrideLineNo):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h: Plumb through an override line number.
+
+2015-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        If we're in code for accessing scoped arguments, we should probably check if the object is a scoped arguments rather than checking if it's a direct arguments.
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitScopedArgumentsGetByVal):
+        * tests/stress/scoped-then-direct-arguments-get-by-val-in-baseline.js: Added.
+
+2015-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL ScopedArguments GetArrayLength generates incorrect code and crashes in LLVM
+        https://bugs.webkit.org/show_bug.cgi?id=143098
+
+        Reviewed by Csaba Osztrogonác.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength): Fix a typo.
+        * tests/stress/scoped-arguments-array-length.js: Added. This test previously always crashed in ftl-no-cjit mode.
+
+2015-03-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed gardening, skip failing tests on AArch64 Linux.
+
+        * tests/mozilla/mozilla-tests.yaml:
+        * tests/stress/cached-prototype-setter.js:
+
+2015-03-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fixes to silly things. While landing fixes to r181993, I introduced crashes. This fixes them.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants): I landed a fix for a VS warning. It broke this. Now I'm fixing it.
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile): Make sure we pass the module when dumping. This makes FTL debugging possible again.
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::dumpState): New overload that takes a module, so that we can call this after FTL::compile() clears State's module.
+        * ftl/FTLState.h:
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix obvious goof that was causing 32-bit debug crashes. The 64-bit version did it
+        right, so this just makes 32-bit do the same.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix a typo that ggaren found but that I didn't fix before.
+
+        * runtime/DirectArgumentsOffset.h:
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, VC found a bug. This fixes the bug.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, try to fix Windows build.
+
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createWithInlineFrame):
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix debug build.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConstDeclNode::emitCodeSingle):
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix CLOOP build.
+
+        * dfg/DFGMinifiedID.h:
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Heap variables shouldn't end up in the stack frame
+        https://bugs.webkit.org/show_bug.cgi?id=141174
+
+        Reviewed by Geoffrey Garen.
+        
+        This is a major change to how JavaScriptCore handles declared variables (i.e. "var"). It removes
+        any ambiguity about whether a variable should be in the heap or on the stack. A variable will no
+        longer move between heap and stack during its lifetime. This enables a bunch of optimizations and
+        simplifications:
+        
+        - Accesses to variables no longer need checks or indirections to determine where the variable is
+          at that moment in time. For example, loading a closure variable now takes just one load instead
+          of two. Loading an argument by index now takes a bounds check and a load in the fastest case
+          (when no arguments object allocation is required) while previously that same operation required
+          a "did I allocate arguments yet" check, a bounds check, and then the load.
+        
+        - Reasoning about the allocation of an activation or arguments object now follows the same simple
+          logic as the allocation of any other kind of object. Previously, those objects were lazily
+          allocated - so an allocation instruction wasn't the actual allocation site, since it might not
+          allocate anything at all. This made the implementation of traditional escape analyses really
+          awkward, and ultimately it meant that we missed important cases. Now, we can reason about the
+          arguments object using the usual SSA tricks which allows for more comprehensive removal.
+        
+        - The allocations of arguments objects, functions, and activations are now much faster. While
+          this patch generally expands our ability to eliminate arguments object allocations, an earlier
+          version of the patch - which lacked that functionality - was a progression on some arguments-
+          and closure-happy benchmarks because although no allocations were eliminated, all allocations
+          were faster.
+        
+        - There is no tear-off. The runtime no loner needs to know about where on the stack a frame keeps
+          its arguments objects or activations. The runtime doesn't have to do things to the arguments
+          objects and activations that a frame allocated, when the frame is unwound. We always had horrid
+          bugs in that code, so it's good to see it go. This removes *a ton* of machinery from the DFG,
+          FTL, CodeBlock, and other places. All of the things having to do with "captured variables" is
+          now gone. This also enables implementing block-scoping. Without this change, block-scope
+          support would require telling CodeBlock and all of the rest of the runtime about all of the
+          variables that store currently-live scopes. That would have been so disastrously hard that it
+          might as well be impossible. With this change, it's fair game for the bytecode generator to
+          simply allocate whatever activations it wants, wherever it wants, and to keep them live for
+          however long it wants. This all works, because after bytecode generation, an activation is just
+          an object and variables that refer to it are just normal variables.
+        
+        - SymbolTable can now tell you explicitly where a variable lives. The answer is in the form of a
+          VarOffset object, which has methods like isStack(), isScope(), etc. VirtualRegister is never
+          used for offsets of non-stack variables anymore. We now have shiny new objects for other kinds
+          of offsets - ScopeOffset for offsets into scopes, and DirectArgumentsOffset for offsets into
+          an arguments object.
+        
+        - Functions that create activations can now tier-up into the FTL. Previously they couldn't. Also,
+          using activations used to prevent inlining; now functions that use activations can be inlined
+          just fine.
+        
+        This is a >1% speed-up on Octane. This is a >2% speed-up on CompressionBench. This is a tiny
+        speed-up on AsmBench (~0.4% or something). This looks like it might be a speed-up on SunSpider.
+        It's only a slow-down on very short-running microbenchmarks we had previously written for our old
+        style of tear-off-based arguments optimization. Those benchmarks are not part of any major suite.
+        
+        The easiest way of understanding this change is to start by looking at the changes in runtime/,
+        and then the changes in bytecompiler/, and then sort of work your way up the compiler tiers.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbortReason.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::BaseIndex::withOffset):
+        * bytecode/ByValInfo.h:
+        (JSC::hasOptimizableIndexingForJSType):
+        (JSC::hasOptimizableIndexing):
+        (JSC::jitArrayModeForJSType):
+        (JSC::jitArrayModePermitsPut):
+        (JSC::jitArrayModeForStructure):
+        * bytecode/BytecodeKills.h: Added.
+        (JSC::BytecodeKills::BytecodeKills):
+        (JSC::BytecodeKills::operandIsKilled):
+        (JSC::BytecodeKills::forEachOperandKilledAt):
+        (JSC::BytecodeKills::KillSet::KillSet):
+        (JSC::BytecodeKills::KillSet::add):
+        (JSC::BytecodeKills::KillSet::forEachLocal):
+        (JSC::BytecodeKills::KillSet::contains):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::isValidRegisterForLiveness):
+        (JSC::stepOverInstruction):
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
+        (JSC::BytecodeLivenessAnalysis::getLivenessInfoAtBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::operandIsLiveAtBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
+        (JSC::BytecodeLivenessAnalysis::computeKills):
+        (JSC::indexForOperand): Deleted.
+        (JSC::BytecodeLivenessAnalysis::getLivenessInfoForNonCapturedVarsAtBytecodeOffset): Deleted.
+        (JSC::getLivenessInfo): Deleted.
+        * bytecode/BytecodeLivenessAnalysis.h:
+        * bytecode/BytecodeLivenessAnalysisInlines.h:
+        (JSC::operandIsAlwaysLive):
+        (JSC::operandThatIsNotAlwaysLiveIsLive):
+        (JSC::operandIsLive):
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::nameForRegister):
+        (JSC::CodeBlock::validate):
+        (JSC::CodeBlock::isCaptured): Deleted.
+        (JSC::CodeBlock::framePointerOffsetToGetActivationRegisters): Deleted.
+        (JSC::CodeBlock::machineSlowArguments): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::unmodifiedArgumentsRegister): Deleted.
+        (JSC::CodeBlock::setArgumentsRegister): Deleted.
+        (JSC::CodeBlock::argumentsRegister): Deleted.
+        (JSC::CodeBlock::uncheckedArgumentsRegister): Deleted.
+        (JSC::CodeBlock::usesArguments): Deleted.
+        (JSC::CodeBlock::captureCount): Deleted.
+        (JSC::CodeBlock::captureStart): Deleted.
+        (JSC::CodeBlock::captureEnd): Deleted.
+        (JSC::CodeBlock::argumentIndexAfterCapture): Deleted.
+        (JSC::CodeBlock::hasSlowArguments): Deleted.
+        (JSC::ExecState::argumentAfterCapture): Deleted.
+        * bytecode/CodeOrigin.h:
+        * bytecode/DataFormat.h:
+        (JSC::dataFormatToString):
+        * bytecode/FullBytecodeLiveness.h:
+        (JSC::FullBytecodeLiveness::getLiveness):
+        (JSC::FullBytecodeLiveness::operandIsLive):
+        (JSC::FullBytecodeLiveness::FullBytecodeLiveness): Deleted.
+        (JSC::FullBytecodeLiveness::getOut): Deleted.
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * bytecode/Operands.h:
+        (JSC::Operands::virtualRegisterForIndex):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromClassInfo):
+        * bytecode/SpeculatedType.h:
+        (JSC::isDirectArgumentsSpeculation):
+        (JSC::isScopedArgumentsSpeculation):
+        (JSC::isActionableMutableArraySpeculation):
+        (JSC::isActionableArraySpeculation):
+        (JSC::isArgumentsSpeculation): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::setArgumentsRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::usesArguments): Deleted.
+        (JSC::UnlinkedCodeBlock::argumentsRegister): Deleted.
+        * bytecode/ValueRecovery.cpp:
+        (JSC::ValueRecovery::dumpInContext):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::directArgumentsThatWereNotCreated):
+        (JSC::ValueRecovery::outOfBandArgumentsThatWereNotCreated):
+        (JSC::ValueRecovery::nodeID):
+        (JSC::ValueRecovery::argumentsThatWereNotCreated): Deleted.
+        * bytecode/VirtualRegister.h:
+        (JSC::VirtualRegister::operator==):
+        (JSC::VirtualRegister::operator!=):
+        (JSC::VirtualRegister::operator<):
+        (JSC::VirtualRegister::operator>):
+        (JSC::VirtualRegister::operator<=):
+        (JSC::VirtualRegister::operator>=):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeNextParameter):
+        (JSC::BytecodeGenerator::visibleNameForParameter):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::createVariable):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitGetFromScope):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::initializeVariable):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::isArgumentNumber):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::addVar): Deleted.
+        (JSC::BytecodeGenerator::emitInitLazyRegister): Deleted.
+        (JSC::BytecodeGenerator::initializeCapturedVariable): Deleted.
+        (JSC::BytecodeGenerator::resolveCallee): Deleted.
+        (JSC::BytecodeGenerator::addCallee): Deleted.
+        (JSC::BytecodeGenerator::addParameter): Deleted.
+        (JSC::BytecodeGenerator::willResolveToArgumentsRegister): Deleted.
+        (JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister): Deleted.
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary): Deleted.
+        (JSC::BytecodeGenerator::isCaptured): Deleted.
+        (JSC::BytecodeGenerator::local): Deleted.
+        (JSC::BytecodeGenerator::constLocal): Deleted.
+        (JSC::BytecodeGenerator::emitResolveConstantLocal): Deleted.
+        (JSC::BytecodeGenerator::emitGetArgumentsLength): Deleted.
+        (JSC::BytecodeGenerator::emitGetArgumentByVal): Deleted.
+        (JSC::BytecodeGenerator::emitLazyNewFunction): Deleted.
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::Variable::Variable):
+        (JSC::Variable::isResolved):
+        (JSC::Variable::ident):
+        (JSC::Variable::offset):
+        (JSC::Variable::isLocal):
+        (JSC::Variable::local):
+        (JSC::Variable::isSpecial):
+        (JSC::BytecodeGenerator::argumentsRegister):
+        (JSC::BytecodeGenerator::emitNode):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::Local::Local): Deleted.
+        (JSC::Local::operator bool): Deleted.
+        (JSC::Local::get): Deleted.
+        (JSC::Local::isSpecial): Deleted.
+        (JSC::ResolveScopeInfo::ResolveScopeInfo): Deleted.
+        (JSC::ResolveScopeInfo::isLocal): Deleted.
+        (JSC::ResolveScopeInfo::localIndex): Deleted.
+        (JSC::BytecodeGenerator::hasSafeLocalArgumentsRegister): Deleted.
+        (JSC::BytecodeGenerator::captureMode): Deleted.
+        (JSC::BytecodeGenerator::shouldTearOffArgumentsEagerly): Deleted.
+        (JSC::BytecodeGenerator::shouldCreateArgumentsEagerly): Deleted.
+        (JSC::BytecodeGenerator::hasWatchableVariable): Deleted.
+        (JSC::BytecodeGenerator::watchableVariableIdentifier): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::isPure):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::EmptyVarExpression::emitBytecode):
+        (JSC::ForInNode::tryGetBoundLocal):
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        (JSC::BindingNode::bindValue):
+        (JSC::getArgumentByVal): Deleted.
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreter.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberWorld):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberCapturedVars): Deleted.
+        * dfg/DFGAbstractValue.h:
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::ArgumentPosition::addVariable):
+        * dfg/DFGArgumentsEliminationPhase.cpp: Added.
+        (JSC::DFG::performArgumentsElimination):
+        * dfg/DFGArgumentsEliminationPhase.h: Added.
+        * dfg/DFGArgumentsSimplificationPhase.cpp: Removed.
+        * dfg/DFGArgumentsSimplificationPhase.h: Removed.
+        * dfg/DFGArgumentsUtilities.cpp: Added.
+        (JSC::DFG::argumentsInvolveStackSlot):
+        (JSC::DFG::emitCodeToGetArgumentsArrayLength):
+        * dfg/DFGArgumentsUtilities.h: Added.
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        (JSC::DFG::ArrayMode::alreadyChecked):
+        (JSC::DFG::arrayTypeToString):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::canCSEStorage):
+        (JSC::DFG::ArrayMode::modeForPut):
+        * dfg/DFGAvailabilityMap.cpp:
+        (JSC::DFG::AvailabilityMap::prune):
+        * dfg/DFGAvailabilityMap.h:
+        (JSC::DFG::AvailabilityMap::closeOverNodes):
+        (JSC::DFG::AvailabilityMap::closeStartingWithLocal):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::newVariableAccessData):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::getArgument):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::noticeArgumentsUse):
+        (JSC::DFG::ByteCodeParser::handleVarargsCall):
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h: Added.
+        (JSC::DFG::CallCreateDirectArgumentsSlowPathGenerator::CallCreateDirectArgumentsSlowPathGenerator):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::isSupportedForInlining):
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.h:
+        * dfg/DFGCommonData.h:
+        (JSC::DFG::CommonData::CommonData):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::cleanVariables):
+        * dfg/DFGDisassembler.h:
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGFlushFormat.cpp:
+        (WTF::printInternal):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::resultFor):
+        (JSC::DFG::useKindFor):
+        (JSC::DFG::dataFormatFor):
+        * dfg/DFGForAllKills.h: Added.
+        (JSC::DFG::forAllLiveNodesAtTail):
+        (JSC::DFG::forAllDirectlyKilledOperands):
+        (JSC::DFG::forAllKilledOperands):
+        (JSC::DFG::forAllKilledNodesAtNodeIndex):
+        (JSC::DFG::forAllKillsInBlock):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::substituteGetLocal):
+        (JSC::DFG::Graph::livenessFor):
+        (JSC::DFG::Graph::killsFor):
+        (JSC::DFG::Graph::tryGetConstantClosureVar):
+        (JSC::DFG::Graph::tryGetRegisters): Deleted.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::symbolTableFor):
+        (JSC::DFG::Graph::uses):
+        (JSC::DFG::Graph::bytecodeRegisterForArgument): Deleted.
+        (JSC::DFG::Graph::capturedVarsFor): Deleted.
+        (JSC::DFG::Graph::usesArguments): Deleted.
+        (JSC::DFG::Graph::argumentsRegisterFor): Deleted.
+        (JSC::DFG::Graph::machineArgumentsRegisterFor): Deleted.
+        (JSC::DFG::Graph::uncheckedArgumentsRegisterFor): Deleted.
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGMinifiedID.h:
+        * dfg/DFGMinifiedNode.cpp:
+        (JSC::DFG::MinifiedNode::fromNode):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        (JSC::DFG::MinifiedNode::hasInlineCallFrame):
+        (JSC::DFG::MinifiedNode::inlineCallFrame):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToIdentityOn):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasConstant):
+        (JSC::DFG::Node::constant):
+        (JSC::DFG::Node::hasScopeOffset):
+        (JSC::DFG::Node::scopeOffset):
+        (JSC::DFG::Node::hasDirectArgumentsOffset):
+        (JSC::DFG::Node::capturedArgumentsOffset):
+        (JSC::DFG::Node::variablePointer):
+        (JSC::DFG::Node::hasCallVarargsData):
+        (JSC::DFG::Node::hasLoadVarargsData):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::objectMaterializationData):
+        (JSC::DFG::Node::isPhantomAllocation):
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        (JSC::DFG::Node::shouldSpeculateDirectArguments):
+        (JSC::DFG::Node::shouldSpeculateScopedArguments):
+        (JSC::DFG::Node::isPhantomArguments): Deleted.
+        (JSC::DFG::Node::hasVarNumber): Deleted.
+        (JSC::DFG::Node::varNumber): Deleted.
+        (JSC::DFG::Node::registerPointer): Deleted.
+        (JSC::DFG::Node::shouldSpeculateArguments): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::emitRestoreArguments):
+        * dfg/DFGOSRExitCompiler.h:
+        (JSC::DFG::OSRExitCompiler::badIndex): Deleted.
+        (JSC::DFG::OSRExitCompiler::initializePoisoned): Deleted.
+        (JSC::DFG::OSRExitCompiler::poisonIndex): Deleted.
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        (JSC::DFG::ArgumentsRecoveryGenerator::ArgumentsRecoveryGenerator): Deleted.
+        (JSC::DFG::ArgumentsRecoveryGenerator::~ArgumentsRecoveryGenerator): Deleted.
+        (JSC::DFG::ArgumentsRecoveryGenerator::generateFor): Deleted.
+        * dfg/DFGOSRExitCompilerCommon.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::read):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::write):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::def):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        (JSC::DFG::preciseLocalClobberize):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::writeTop): Deleted.
+        (JSC::DFG::forEachLocalReadByUnwind): Deleted.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::run):
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
+        (JSC::DFG::PredictionPropagationPhase::propagateThroughArgumentPositions):
+        * dfg/DFGPromoteHeapAccess.h:
+        (JSC::DFG::promoteHeapAccess):
+        * dfg/DFGPromotedHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
+        (JSC::DFG::SpeculativeJIT::emitGetLength):
+        (JSC::DFG::SpeculativeJIT::emitGetCallee):
+        (JSC::DFG::SpeculativeJIT::emitGetArgumentStart):
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        (JSC::DFG::SpeculativeJIT::compileForwardVarargs):
+        (JSC::DFG::SpeculativeJIT::compileCreateActivation):
+        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetFromArguments):
+        (JSC::DFG::SpeculativeJIT::compilePutToArguments):
+        (JSC::DFG::SpeculativeJIT::compileCreateScopedArguments):
+        (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):
+        (JSC::DFG::SpeculativeJIT::emitAllocateArguments): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        (JSC::DFG::SpeculativeJIT::framePointerOffsetToGetActivationRegisters): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS):
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h:
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::valueSourceKindToDataFormat):
+        (JSC::DFG::ValueSource::ValueSource):
+        (JSC::DFG::ValueSource::forFlushFormat):
+        (JSC::DFG::ValueSource::valueRecovery):
+        * dfg/DFGVarargsForwardingPhase.cpp: Added.
+        (JSC::DFG::performVarargsForwarding):
+        * dfg/DFGVarargsForwardingPhase.h: Added.
+        * dfg/DFGVariableAccessData.cpp:
+        (JSC::DFG::VariableAccessData::VariableAccessData):
+        (JSC::DFG::VariableAccessData::flushFormat):
+        (JSC::DFG::VariableAccessData::mergeIsCaptured): Deleted.
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldNeverUnbox):
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
+        (JSC::DFG::VariableAccessData::isCaptured): Deleted.
+        (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias): Deleted.
+        (JSC::DFG::VariableAccessData::isArgumentsAlias): Deleted.
+        * dfg/DFGVariableAccessDataDump.cpp:
+        (JSC::DFG::VariableAccessDataDump::dump):
+        * dfg/DFGVariableAccessDataDump.h:
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
+        * dfg/DFGVariableEventStream.h:
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::AbstractHeap::dump):
+        (JSC::FTL::AbstractField::dump):
+        (JSC::FTL::IndexedAbstractHeap::dump):
+        (JSC::FTL::NumberedAbstractHeap::dump):
+        (JSC::FTL::AbsoluteAbstractHeap::dump):
+        * ftl/FTLAbstractHeap.h:
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExitArgument.cpp:
+        (JSC::FTL::ExitArgument::dump):
+        * ftl/FTLExitPropertyValue.cpp:
+        (JSC::FTL::ExitPropertyValue::withLocalsOffset):
+        * ftl/FTLExitPropertyValue.h:
+        * ftl/FTLExitTimeObjectMaterialization.cpp:
+        (JSC::FTL::ExitTimeObjectMaterialization::ExitTimeObjectMaterialization):
+        (JSC::FTL::ExitTimeObjectMaterialization::accountForLocalsOffset):
+        * ftl/FTLExitTimeObjectMaterialization.h:
+        (JSC::FTL::ExitTimeObjectMaterialization::origin):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::withLocalsOffset):
+        (JSC::FTL::ExitValue::valueFormat):
+        (JSC::FTL::ExitValue::dumpInContext):
+        * ftl/FTLExitValue.h:
+        (JSC::FTL::ExitValue::isArgument):
+        (JSC::FTL::ExitValue::argumentsObjectThatWasNotCreated): Deleted.
+        (JSC::FTL::ExitValue::isArgumentsObjectThatWasNotCreated): Deleted.
+        (JSC::FTL::ExitValue::valueFormat): Deleted.
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfCallForwardVarargs):
+        (JSC::FTL::sizeOfConstructForwardVarargs):
+        (JSC::FTL::sizeOfICFor):
+        * ftl/FTLInlineCacheSize.h:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLJSCallVarargs.cpp:
+        (JSC::FTL::JSCallVarargs::JSCallVarargs):
+        (JSC::FTL::JSCallVarargs::emit):
+        * ftl/FTLJSCallVarargs.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compilePutStack):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
+        (JSC::FTL::LowerDFGToLLVM::compileCreateActivation):
+        (JSC::FTL::LowerDFGToLLVM::compileNewFunction):
+        (JSC::FTL::LowerDFGToLLVM::compileCreateDirectArguments):
+        (JSC::FTL::LowerDFGToLLVM::compileCreateScopedArguments):
+        (JSC::FTL::LowerDFGToLLVM::compileCreateClonedArguments):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharAt):
+        (JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):
+        (JSC::FTL::LowerDFGToLLVM::compileGetGlobalVar):
+        (JSC::FTL::LowerDFGToLLVM::compilePutGlobalVar):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArgumentCount):
+        (JSC::FTL::LowerDFGToLLVM::compileGetClosureVar):
+        (JSC::FTL::LowerDFGToLLVM::compilePutClosureVar):
+        (JSC::FTL::LowerDFGToLLVM::compileGetFromArguments):
+        (JSC::FTL::LowerDFGToLLVM::compilePutToArguments):
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::LowerDFGToLLVM::compileForwardVarargs):
+        (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname):
+        (JSC::FTL::LowerDFGToLLVM::ArgumentsLength::ArgumentsLength):
+        (JSC::FTL::LowerDFGToLLVM::getArgumentsLength):
+        (JSC::FTL::LowerDFGToLLVM::getCurrentCallee):
+        (JSC::FTL::LowerDFGToLLVM::getArgumentsStart):
+        (JSC::FTL::LowerDFGToLLVM::baseIndex):
+        (JSC::FTL::LowerDFGToLLVM::allocateObject):
+        (JSC::FTL::LowerDFGToLLVM::allocateVariableSizedObject):
+        (JSC::FTL::LowerDFGToLLVM::isArrayType):
+        (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
+        (JSC::FTL::LowerDFGToLLVM::loadStructure):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantomArguments): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileGetClosureRegisters): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileCheckArgumentsNotCreated): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::checkArgumentsNotCreated): Deleted.
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileRecovery):
+        (JSC::FTL::compileStub):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::zeroExtPtr):
+        * heap/CopyToken.h:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::getArgumentUnsafe):
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeOfVarargs):
+        (JSC::sizeFrameForVarargs):
+        (JSC::loadVarargs):
+        (JSC::unwindCallFrame):
+        * interpreter/Interpreter.h:
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::createArguments):
+        (JSC::StackVisitor::Frame::existingArguments): Deleted.
+        * interpreter/StackVisitor.h:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::storeValue):
+        (JSC::AssemblyHelpers::loadValue):
+        (JSC::AssemblyHelpers::storeTrustedValue):
+        (JSC::AssemblyHelpers::branchIfNotCell):
+        (JSC::AssemblyHelpers::branchIsEmpty):
+        (JSC::AssemblyHelpers::argumentsStart):
+        (JSC::AssemblyHelpers::baselineArgumentsRegisterFor): Deleted.
+        (JSC::AssemblyHelpers::offsetOfLocals): Deleted.
+        (JSC::AssemblyHelpers::offsetOfArguments): Deleted.
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgument):
+        * jit/GPRInfo.h:
+        (JSC::JSValueRegs::withTwoAvailableRegs):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_lexical_environment):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_create_direct_arguments):
+        (JSC::JIT::emit_op_create_scoped_arguments):
+        (JSC::JIT::emit_op_create_out_of_band_arguments):
+        (JSC::JIT::emit_op_tear_off_arguments): Deleted.
+        (JSC::JIT::emit_op_create_arguments): Deleted.
+        (JSC::JIT::emit_op_init_lazy_reg): Deleted.
+        (JSC::JIT::emit_op_get_arguments_length): Deleted.
+        (JSC::JIT::emitSlow_op_get_arguments_length): Deleted.
+        (JSC::JIT::emit_op_get_argument_by_val): Deleted.
+        (JSC::JIT::emitSlow_op_get_argument_by_val): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_lexical_environment):
+        (JSC::JIT::emit_op_tear_off_arguments): Deleted.
+        (JSC::JIT::emit_op_create_arguments): Deleted.
+        (JSC::JIT::emit_op_init_lazy_reg): Deleted.
+        (JSC::JIT::emit_op_get_arguments_length): Deleted.
+        (JSC::JIT::emitSlow_op_get_arguments_length): Deleted.
+        (JSC::JIT::emit_op_get_argument_by_val): Deleted.
+        (JSC::JIT::emitSlow_op_get_argument_by_val): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_get_from_arguments):
+        (JSC::JIT::emit_op_put_to_arguments):
+        (JSC::JIT::emit_op_init_global_const):
+        (JSC::JIT::privateCompileGetByVal):
+        (JSC::JIT::emitDirectArgumentsGetByVal):
+        (JSC::JIT::emitScopedArgumentsGetByVal):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetClosureVar):
+        (JSC::JIT::emitPutClosureVar):
+        (JSC::JIT::emit_op_get_from_arguments):
+        (JSC::JIT::emit_op_put_to_arguments):
+        (JSC::JIT::emit_op_init_global_const):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetupVarargsFrameFastCase):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/Nodes.h:
+        (JSC::ScopeNode::captures):
+        * runtime/Arguments.cpp: Removed.
+        * runtime/Arguments.h: Removed.
+        * runtime/ArgumentsMode.h: Added.
+        * runtime/DirectArgumentsOffset.cpp: Added.
+        (JSC::DirectArgumentsOffset::dump):
+        * runtime/DirectArgumentsOffset.h: Added.
+        (JSC::DirectArgumentsOffset::DirectArgumentsOffset):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/ConstantMode.cpp: Added.
+        (WTF::printInternal):
+        * runtime/ConstantMode.h:
+        (JSC::modeForIsConstant):
+        * runtime/DirectArguments.cpp: Added.
+        (JSC::DirectArguments::DirectArguments):
+        (JSC::DirectArguments::createUninitialized):
+        (JSC::DirectArguments::create):
+        (JSC::DirectArguments::createByCopying):
+        (JSC::DirectArguments::visitChildren):
+        (JSC::DirectArguments::copyBackingStore):
+        (JSC::DirectArguments::createStructure):
+        (JSC::DirectArguments::overrideThings):
+        (JSC::DirectArguments::overrideThingsIfNecessary):
+        (JSC::DirectArguments::overrideArgument):
+        (JSC::DirectArguments::copyToArguments):
+        (JSC::DirectArguments::overridesSize):
+        * runtime/DirectArguments.h: Added.
+        (JSC::DirectArguments::internalLength):
+        (JSC::DirectArguments::length):
+        (JSC::DirectArguments::canAccessIndexQuickly):
+        (JSC::DirectArguments::getIndexQuickly):
+        (JSC::DirectArguments::setIndexQuickly):
+        (JSC::DirectArguments::callee):
+        (JSC::DirectArguments::argument):
+        (JSC::DirectArguments::overrodeThings):
+        (JSC::DirectArguments::offsetOfCallee):
+        (JSC::DirectArguments::offsetOfLength):
+        (JSC::DirectArguments::offsetOfMinCapacity):
+        (JSC::DirectArguments::offsetOfOverrides):
+        (JSC::DirectArguments::storageOffset):
+        (JSC::DirectArguments::offsetOfSlot):
+        (JSC::DirectArguments::allocationSize):
+        (JSC::DirectArguments::storage):
+        * runtime/FunctionPrototype.cpp:
+        * runtime/GenericArguments.h: Added.
+        (JSC::GenericArguments::GenericArguments):
+        * runtime/GenericArgumentsInlines.h: Added.
+        (JSC::GenericArguments<Type>::getOwnPropertySlot):
+        (JSC::GenericArguments<Type>::getOwnPropertySlotByIndex):
+        (JSC::GenericArguments<Type>::getOwnPropertyNames):
+        (JSC::GenericArguments<Type>::put):
+        (JSC::GenericArguments<Type>::putByIndex):
+        (JSC::GenericArguments<Type>::deleteProperty):
+        (JSC::GenericArguments<Type>::deletePropertyByIndex):
+        (JSC::GenericArguments<Type>::defineOwnProperty):
+        (JSC::GenericArguments<Type>::copyToArguments):
+        * runtime/GenericOffset.h: Added.
+        (JSC::GenericOffset::GenericOffset):
+        (JSC::GenericOffset::operator!):
+        (JSC::GenericOffset::offsetUnchecked):
+        (JSC::GenericOffset::offset):
+        (JSC::GenericOffset::operator==):
+        (JSC::GenericOffset::operator!=):
+        (JSC::GenericOffset::operator<):
+        (JSC::GenericOffset::operator>):
+        (JSC::GenericOffset::operator<=):
+        (JSC::GenericOffset::operator>=):
+        (JSC::GenericOffset::operator+):
+        (JSC::GenericOffset::operator-):
+        (JSC::GenericOffset::operator+=):
+        (JSC::GenericOffset::operator-=):
+        * runtime/JSArgumentsIterator.cpp:
+        (JSC::JSArgumentsIterator::finishCreation):
+        (JSC::argumentsFuncIterator):
+        * runtime/JSArgumentsIterator.h:
+        (JSC::JSArgumentsIterator::create):
+        (JSC::JSArgumentsIterator::next):
+        * runtime/JSEnvironmentRecord.cpp:
+        (JSC::JSEnvironmentRecord::visitChildren):
+        * runtime/JSEnvironmentRecord.h:
+        (JSC::JSEnvironmentRecord::variables):
+        (JSC::JSEnvironmentRecord::isValid):
+        (JSC::JSEnvironmentRecord::variableAt):
+        (JSC::JSEnvironmentRecord::offsetOfVariables):
+        (JSC::JSEnvironmentRecord::offsetOfVariable):
+        (JSC::JSEnvironmentRecord::allocationSizeForScopeSize):
+        (JSC::JSEnvironmentRecord::allocationSize):
+        (JSC::JSEnvironmentRecord::JSEnvironmentRecord):
+        (JSC::JSEnvironmentRecord::finishCreationUninitialized):
+        (JSC::JSEnvironmentRecord::finishCreation):
+        (JSC::JSEnvironmentRecord::registers): Deleted.
+        (JSC::JSEnvironmentRecord::registerAt): Deleted.
+        (JSC::JSEnvironmentRecord::addressOfRegisters): Deleted.
+        (JSC::JSEnvironmentRecord::offsetOfRegisters): Deleted.
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addFunction):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::directArgumentsStructure):
+        (JSC::JSGlobalObject::scopedArgumentsStructure):
+        (JSC::JSGlobalObject::outOfBandArgumentsStructure):
+        (JSC::JSGlobalObject::argumentsStructure): Deleted.
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::symbolTableGet):
+        (JSC::JSLexicalEnvironment::symbolTablePut):
+        (JSC::JSLexicalEnvironment::getOwnNonIndexPropertyNames):
+        (JSC::JSLexicalEnvironment::symbolTablePutWithAttributes):
+        (JSC::JSLexicalEnvironment::visitChildren): Deleted.
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::JSLexicalEnvironment::create):
+        (JSC::JSLexicalEnvironment::JSLexicalEnvironment):
+        (JSC::JSLexicalEnvironment::registersOffset): Deleted.
+        (JSC::JSLexicalEnvironment::storageOffset): Deleted.
+        (JSC::JSLexicalEnvironment::storage): Deleted.
+        (JSC::JSLexicalEnvironment::allocationSize): Deleted.
+        (JSC::JSLexicalEnvironment::isValidIndex): Deleted.
+        (JSC::JSLexicalEnvironment::isValid): Deleted.
+        (JSC::JSLexicalEnvironment::registerAt): Deleted.
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::visitChildren): Deleted.
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::value):
+        (JSC::JSNameScope::finishCreation):
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::findVariableIndex):
+        (JSC::JSSegmentedVariableObject::addVariables):
+        (JSC::JSSegmentedVariableObject::visitChildren):
+        (JSC::JSSegmentedVariableObject::findRegisterIndex): Deleted.
+        (JSC::JSSegmentedVariableObject::addRegisters): Deleted.
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::variableAt):
+        (JSC::JSSegmentedVariableObject::assertVariableIsInThisObject):
+        (JSC::JSSegmentedVariableObject::registerAt): Deleted.
+        (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject): Deleted.
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::offsetOfSymbolTable):
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/JSType.h:
+        * runtime/Options.h:
+        * runtime/ClonedArguments.cpp: Added.
+        (JSC::ClonedArguments::ClonedArguments):
+        (JSC::ClonedArguments::createEmpty):
+        (JSC::ClonedArguments::createWithInlineFrame):
+        (JSC::ClonedArguments::createWithMachineFrame):
+        (JSC::ClonedArguments::createByCopyingFrom):
+        (JSC::ClonedArguments::createStructure):
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        (JSC::ClonedArguments::getOwnPropertyNames):
+        (JSC::ClonedArguments::put):
+        (JSC::ClonedArguments::deleteProperty):
+        (JSC::ClonedArguments::defineOwnProperty):
+        (JSC::ClonedArguments::materializeSpecials):
+        (JSC::ClonedArguments::materializeSpecialsIfNecessary):
+        * runtime/ClonedArguments.h: Added.
+        (JSC::ClonedArguments::specialsMaterialized):
+        * runtime/ScopeOffset.cpp: Added.
+        (JSC::ScopeOffset::dump):
+        * runtime/ScopeOffset.h: Added.
+        (JSC::ScopeOffset::ScopeOffset):
+        * runtime/ScopedArguments.cpp: Added.
+        (JSC::ScopedArguments::ScopedArguments):
+        (JSC::ScopedArguments::finishCreation):
+        (JSC::ScopedArguments::createUninitialized):
+        (JSC::ScopedArguments::create):
+        (JSC::ScopedArguments::createByCopying):
+        (JSC::ScopedArguments::createByCopyingFrom):
+        (JSC::ScopedArguments::visitChildren):
+        (JSC::ScopedArguments::createStructure):
+        (JSC::ScopedArguments::overrideThings):
+        (JSC::ScopedArguments::overrideThingsIfNecessary):
+        (JSC::ScopedArguments::overrideArgument):
+        (JSC::ScopedArguments::copyToArguments):
+        * runtime/ScopedArguments.h: Added.
+        (JSC::ScopedArguments::internalLength):
+        (JSC::ScopedArguments::length):
+        (JSC::ScopedArguments::canAccessIndexQuickly):
+        (JSC::ScopedArguments::getIndexQuickly):
+        (JSC::ScopedArguments::setIndexQuickly):
+        (JSC::ScopedArguments::callee):
+        (JSC::ScopedArguments::overrodeThings):
+        (JSC::ScopedArguments::offsetOfOverrodeThings):
+        (JSC::ScopedArguments::offsetOfTotalLength):
+        (JSC::ScopedArguments::offsetOfTable):
+        (JSC::ScopedArguments::offsetOfScope):
+        (JSC::ScopedArguments::overflowStorageOffset):
+        (JSC::ScopedArguments::allocationSize):
+        (JSC::ScopedArguments::overflowStorage):
+        * runtime/ScopedArgumentsTable.cpp: Added.
+        (JSC::ScopedArgumentsTable::ScopedArgumentsTable):
+        (JSC::ScopedArgumentsTable::~ScopedArgumentsTable):
+        (JSC::ScopedArgumentsTable::destroy):
+        (JSC::ScopedArgumentsTable::create):
+        (JSC::ScopedArgumentsTable::clone):
+        (JSC::ScopedArgumentsTable::setLength):
+        (JSC::ScopedArgumentsTable::set):
+        (JSC::ScopedArgumentsTable::createStructure):
+        * runtime/ScopedArgumentsTable.h: Added.
+        (JSC::ScopedArgumentsTable::length):
+        (JSC::ScopedArgumentsTable::get):
+        (JSC::ScopedArgumentsTable::lock):
+        (JSC::ScopedArgumentsTable::offsetOfLength):
+        (JSC::ScopedArgumentsTable::offsetOfArguments):
+        (JSC::ScopedArgumentsTable::at):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTableEntry::prepareToWatch):
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::visitChildren):
+        (JSC::SymbolTable::localToEntry):
+        (JSC::SymbolTable::entryFor):
+        (JSC::SymbolTable::cloneScopePart):
+        (JSC::SymbolTable::prepareForTypeProfiling):
+        (JSC::SymbolTable::uniqueIDForOffset):
+        (JSC::SymbolTable::globalTypeSetForOffset):
+        (JSC::SymbolTable::cloneCapturedNames): Deleted.
+        (JSC::SymbolTable::uniqueIDForRegister): Deleted.
+        (JSC::SymbolTable::globalTypeSetForRegister): Deleted.
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTableEntry::varOffsetFromBits):
+        (JSC::SymbolTableEntry::scopeOffsetFromBits):
+        (JSC::SymbolTableEntry::Fast::varOffset):
+        (JSC::SymbolTableEntry::Fast::scopeOffset):
+        (JSC::SymbolTableEntry::Fast::isDontEnum):
+        (JSC::SymbolTableEntry::Fast::getAttributes):
+        (JSC::SymbolTableEntry::SymbolTableEntry):
+        (JSC::SymbolTableEntry::varOffset):
+        (JSC::SymbolTableEntry::isWatchable):
+        (JSC::SymbolTableEntry::scopeOffset):
+        (JSC::SymbolTableEntry::setAttributes):
+        (JSC::SymbolTableEntry::constantMode):
+        (JSC::SymbolTableEntry::isDontEnum):
+        (JSC::SymbolTableEntry::disableWatching):
+        (JSC::SymbolTableEntry::pack):
+        (JSC::SymbolTableEntry::isValidVarOffset):
+        (JSC::SymbolTable::createNameScopeTable):
+        (JSC::SymbolTable::maxScopeOffset):
+        (JSC::SymbolTable::didUseScopeOffset):
+        (JSC::SymbolTable::didUseVarOffset):
+        (JSC::SymbolTable::scopeSize):
+        (JSC::SymbolTable::nextScopeOffset):
+        (JSC::SymbolTable::takeNextScopeOffset):
+        (JSC::SymbolTable::add):
+        (JSC::SymbolTable::set):
+        (JSC::SymbolTable::argumentsLength):
+        (JSC::SymbolTable::setArgumentsLength):
+        (JSC::SymbolTable::argumentOffset):
+        (JSC::SymbolTable::setArgumentOffset):
+        (JSC::SymbolTable::arguments):
+        (JSC::SlowArgument::SlowArgument): Deleted.
+        (JSC::SymbolTableEntry::Fast::getIndex): Deleted.
+        (JSC::SymbolTableEntry::getIndex): Deleted.
+        (JSC::SymbolTableEntry::isValidIndex): Deleted.
+        (JSC::SymbolTable::captureStart): Deleted.
+        (JSC::SymbolTable::setCaptureStart): Deleted.
+        (JSC::SymbolTable::captureEnd): Deleted.
+        (JSC::SymbolTable::setCaptureEnd): Deleted.
+        (JSC::SymbolTable::captureCount): Deleted.
+        (JSC::SymbolTable::isCaptured): Deleted.
+        (JSC::SymbolTable::parameterCount): Deleted.
+        (JSC::SymbolTable::parameterCountIncludingThis): Deleted.
+        (JSC::SymbolTable::setParameterCountIncludingThis): Deleted.
+        (JSC::SymbolTable::slowArguments): Deleted.
+        (JSC::SymbolTable::setSlowArguments): Deleted.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * runtime/VarOffset.cpp: Added.
+        (JSC::VarOffset::dump):
+        (WTF::printInternal):
+        * runtime/VarOffset.h: Added.
+        (JSC::VarOffset::VarOffset):
+        (JSC::VarOffset::assemble):
+        (JSC::VarOffset::isValid):
+        (JSC::VarOffset::operator!):
+        (JSC::VarOffset::kind):
+        (JSC::VarOffset::isStack):
+        (JSC::VarOffset::isScope):
+        (JSC::VarOffset::isDirectArgument):
+        (JSC::VarOffset::stackOffsetUnchecked):
+        (JSC::VarOffset::scopeOffsetUnchecked):
+        (JSC::VarOffset::capturedArgumentsOffsetUnchecked):
+        (JSC::VarOffset::stackOffset):
+        (JSC::VarOffset::scopeOffset):
+        (JSC::VarOffset::capturedArgumentsOffset):
+        (JSC::VarOffset::rawOffset):
+        (JSC::VarOffset::checkSanity):
+        (JSC::VarOffset::operator==):
+        (JSC::VarOffset::operator!=):
+        (JSC::VarOffset::hash):
+        (JSC::VarOffset::isHashTableDeletedValue):
+        (JSC::VarOffsetHash::hash):
+        (JSC::VarOffsetHash::equal):
+        * tests/stress/arguments-exit-strict-mode.js: Added.
+        * tests/stress/arguments-exit.js: Added.
+        * tests/stress/arguments-inlined-exit-strict-mode-fixed.js: Added.
+        * tests/stress/arguments-inlined-exit-strict-mode.js: Added.
+        * tests/stress/arguments-inlined-exit.js: Added.
+        * tests/stress/arguments-interference.js: Added.
+        * tests/stress/arguments-interference-cfg.js: Added.
+        * tests/stress/dead-get-closure-var.js: Added.
+        * tests/stress/get-declared-unpassed-argument-in-direct-arguments.js: Added.
+        * tests/stress/get-declared-unpassed-argument-in-scoped-arguments.js: Added.
+        * tests/stress/varargs-closure-inlined-exit-strict-mode.js: Added.
+        * tests/stress/varargs-closure-inlined-exit.js: Added.
+        * tests/stress/varargs-exit.js: Added.
+        * tests/stress/varargs-inlined-exit.js: Added.
+        * tests/stress/varargs-inlined-simple-exit-aliasing-weird-reversed-args.js: Added.
+        * tests/stress/varargs-inlined-simple-exit-aliasing-weird.js: Added.
+        * tests/stress/varargs-inlined-simple-exit-aliasing.js: Added.
+        * tests/stress/varargs-inlined-simple-exit.js: Added.
+        * tests/stress/varargs-too-few-arguments.js: Added.
+        * tests/stress/varargs-varargs-closure-inlined-exit.js: Added.
+        * tests/stress/varargs-varargs-inlined-exit-strict-mode.js: Added.
+        * tests/stress/varargs-varargs-inlined-exit.js: Added.
+
+2015-03-25  Andy Estes  <aestes@apple.com>
+
+        [Cocoa] RemoteInspectorXPCConnection::deserializeMessage() leaks a NSDictionary under Objective-C GC
+        https://bugs.webkit.org/show_bug.cgi?id=143068
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::deserializeMessage): Used RetainPtr::autorelease(), which does the right thing under GC.
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Use JITCompilationCanFail in more places, and make the fail path of JITCompilationMustSucceed a crash instead of attempting GC
+        https://bugs.webkit.org/show_bug.cgi?id=142993
+
+        Reviewed by Geoffrey Garen and Mark Lam.
+        
+        This changes the most commonly invoked paths that relied on JITCompilationMustSucceed
+        into using JITCompilationCanFail and having a legit fallback path. This mostly involves
+        having the FTL JIT do the same trick as the DFG JIT in case of any memory allocation
+        failure, but also involves adding the same kind of thing to the stub generators in
+        Repatch.
+        
+        Because of that change, there are relatively few uses of JITCompilationMustSucceed. Most
+        of those uses cannot handle a GC, and so cannot do releaseExecutableMemory(). Only a few,
+        like host call stub generation, could handle a GC, but those get invoked very rarely. So,
+        this patch changes the releaseExecutableMemory() call into a crash with some diagnostic
+        printout.
+        
+        Also add a way of inducing executable allocation failure, so that we can test this.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::link): Deleted.
+        (JSC::DFG::JITCompiler::linkFunction): Deleted.
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateCodeSection):
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLState.h:
+        * jit/ArityCheckFailReturnThunks.cpp:
+        (JSC::ArityCheckFailReturnThunks::returnPCsFor):
+        * jit/ExecutableAllocationFuzz.cpp: Added.
+        (JSC::numberOfExecutableAllocationFuzzChecks):
+        (JSC::doExecutableAllocationFuzzing):
+        * jit/ExecutableAllocationFuzz.h: Added.
+        (JSC::doExecutableAllocationFuzzingIfEnabled):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITCompilationEffort.h:
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStubAndGetOldStructure):
+        (JSC::tryCachePutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::linkPolymorphicCall):
+        * jsc.cpp:
+        (jscmain):
+        * runtime/Options.h:
+        * runtime/TestRunnerUtils.h:
+        * runtime/VM.cpp:
+        * tests/executableAllocationFuzz: Added.
+        * tests/executableAllocationFuzz.yaml: Added.
+        * tests/executableAllocationFuzz/v8-raytrace.js: Added.
+
+2015-03-25  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION(169139): LLINT intermittently fails JSC testapi tests.
+        <https://webkit.org/b/135719>
+
+        Reviewed by Geoffrey Garen.
+
+        This is a regression introduced in http://trac.webkit.org/changeset/169139 which
+        changed VM::watchdog from an embedded field into a std::unique_ptr, but did not
+        update the LLINT to access it as such.
+
+        The issue has only manifested so far on the CLoop tests because those are LLINT
+        only.  In the non-CLoop cases, the JIT kicks in and does the right thing, thereby
+        hiding the bug in the LLINT.
+
+        * API/JSContextRef.cpp:
+        (createWatchdogIfNeeded):
+        (JSContextGroupSetExecutionTimeLimit):
+        (JSContextGroupClearExecutionTimeLimit):
+        * llint/LowLevelInterpreter.asm:
+
+2015-03-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Change Atomic methods from using the_wrong_naming_conventions to using theRightNamingConventions. Also make seq_cst the default.
+
+        Rubber stamped by Geoffrey Garen.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+
+2015-03-25  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix formatting in BuiltinExecutables
+        https://bugs.webkit.org/show_bug.cgi?id=143061
+
+        Reviewed by Ryosuke Niwa.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutableInternal):
+
+2015-03-25  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6: Classes: Program level class statement throws exception in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=143038
+
+        Reviewed by Ryosuke Niwa.
+
+        Classes expose a name to the current lexical environment. This treats
+        "class X {}" like "var X = class X {}". Ideally it would be "let X = class X {}".
+        Also, improve error messages for class statements where the class is missing a name.
+
+        * parser/Parser.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        Fill name in info parameter if needed. Better error message if name is needed and missing.
+
+        (JSC::Parser<LexerType>::parseClassDeclaration):
+        Pass info parameter to get name, and expose the name as a variable name.
+
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        Pass info parameter that is ignored.
+
+        * parser/ParserFunctionInfo.h:
+        Add a parser info for class, to extract the name.
+
+2015-03-25  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        New map and set modification tests in r181922 fails
+        https://bugs.webkit.org/show_bug.cgi?id=143031
+
+        Reviewed and tweaked by Geoffrey Garen.
+
+        When packing Map/Set backing store, we need to decrement Map/Set iterator's m_index
+        to adjust for the packed backing store.
+
+        Consider the following map data.
+
+        x: deleted, o: exists
+        0 1 2 3 4
+        x x x x o
+
+        And iterator with m_index 3.
+
+        When packing the map data, map data will become,
+
+        0
+        o
+
+        At that time, we perfom didRemoveEntry 4 times on iterators.
+        times => m_index/index/result
+        1 => 3/0/dec
+        2 => 2/1/dec
+        3 => 1/2/nothing
+        4 => 1/3/nothing
+
+        After iteration, iterator's m_index becomes 1. But we expected that becomes 0.
+        This is because if we use decremented m_index for comparison,
+        while provided deletedIndex is the index in old storage, m_index is the index in partially packed storage.
+
+        In this patch, we compare against the packed index instead.
+        times => m_index/packedIndex/result
+        1 => 3/0/dec
+        2 => 2/0/dec
+        3 => 1/0/dec
+        4 => 0/0/nothing
+
+        So m_index becomes 0 as expected.
+
+        And according to the spec, once the iterator is closed (becomes done: true),
+        its internal [[Map]]/[[Set]] is set to undefined.
+        So after the iterator is finished, we don't revive the iterator (e.g. by clearing m_index = 0).
+
+        In this patch, we change 2 things.
+        1.
+        Compare an iterator's index against the packed index when removing an entry.
+
+        2.
+        If the iterator is closed (isFinished()), we don't apply adjustment to the iterator.
+
+        * runtime/MapData.h:
+        (JSC::MapDataImpl::IteratorData::finish):
+        (JSC::MapDataImpl::IteratorData::isFinished):
+        (JSC::MapDataImpl::IteratorData::didRemoveEntry):
+        (JSC::MapDataImpl::IteratorData::didRemoveAllEntries):
+        (JSC::MapDataImpl::IteratorData::startPackBackingStore):
+        * runtime/MapDataInlines.h:
+        (JSC::JSIterator>::replaceAndPackBackingStore):
+        * tests/stress/modify-map-during-iteration.js:
+        * tests/stress/modify-set-during-iteration.js:
+
+2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Setter should have a single formal parameter, Getter no parameters
+        https://bugs.webkit.org/show_bug.cgi?id=142903
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        Enforce no parameters for getters and a single parameter
+        for setters, with informational error messages.
+
+2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6: Classes: Early return in sub-class constructor results in returning undefined instead of instance
+        https://bugs.webkit.org/show_bug.cgi?id=143012
+
+        Reviewed by Ryosuke Niwa.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        Fix handling of "undefined" when returned from a Derived class. It was
+        returning "undefined" when it should have returned "this".
+
+2015-03-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION (r181458): Heap use-after-free in JSSetIterator destructor
+        https://bugs.webkit.org/show_bug.cgi?id=142696
+
+        Reviewed and tweaked by Geoffrey Garen.
+
+        Before r142556, JSSetIterator::destroy was not defined.
+        So accidentally MapData::const_iterator in JSSet was never destroyed.
+        But it had non trivial destructor, decrementing MapData->m_iteratorCount.
+
+        After r142556, JSSetIterator::destroy works.
+        It correctly destruct MapData::const_iterator and m_iteratorCount partially works.
+        But JSSetIterator::~JSSetIterator requires owned JSSet since it mutates MapData->m_iteratorCount.
+
+        It is guaranteed that JSSet is live since JSSetIterator has a reference to JSSet
+        and marks it in visitChildren (WriteBarrier<Unknown>).
+        However, the order of destructions is not guaranteed in GC-ed system.
+
+        Consider the following case,
+        allocate JSSet and subsequently allocate JSSetIterator.
+        And they resides in the separated MarkedBlock, <1> and <2>.
+
+        JSSet<1> <- JSSetIterator<2>
+
+        And after that, when performing GC, Marker decides that the above 2 objects are not marked.
+        And Marker also decides MarkedBlocks <1> and <2> can be sweeped.
+
+        First Sweeper sweep <1>, destruct JSSet<1> and free MarkedBlock<1>.
+        Second Sweeper sweep <2>, attempt to destruct JSSetIterator<2>.
+        However, JSSetIterator<2>'s destructor,
+        JSSetIterator::~JSSetIterator requires live JSSet<1>, it causes use-after-free.
+
+        In this patch, we introduce WeakGCMap into JSMap/JSSet to track live iterators.
+        When packing the removed elements in JSSet/JSMap, we apply the change to all live
+        iterators tracked by WeakGCMap.
+
+        WeakGCMap can only track JSCell since they are managed by GC.
+        So we drop JSSet/JSMap C++ style iterators. Instead of C++ style iterator, this patch
+        introduces JS style iterator signatures into C++ class IteratorData.
+        If we need to iterate over JSMap/JSSet, use JSSetIterator/JSMapIterator instead of using
+        IteratorData directly.
+
+        * runtime/JSMap.cpp:
+        (JSC::JSMap::destroy):
+        * runtime/JSMap.h:
+        (JSC::JSMap::JSMap):
+        (JSC::JSMap::begin): Deleted.
+        (JSC::JSMap::end): Deleted.
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::destroy):
+        * runtime/JSMapIterator.h:
+        (JSC::JSMapIterator::next):
+        (JSC::JSMapIterator::nextKeyValue):
+        (JSC::JSMapIterator::iteratorData):
+        (JSC::JSMapIterator::JSMapIterator):
+        * runtime/JSSet.cpp:
+        (JSC::JSSet::destroy):
+        * runtime/JSSet.h:
+        (JSC::JSSet::JSSet):
+        (JSC::JSSet::begin): Deleted.
+        (JSC::JSSet::end): Deleted.
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::destroy):
+        * runtime/JSSetIterator.h:
+        (JSC::JSSetIterator::next):
+        (JSC::JSSetIterator::iteratorData):
+        (JSC::JSSetIterator::JSSetIterator):
+        * runtime/MapData.h:
+        (JSC::MapDataImpl::IteratorData::finish):
+        (JSC::MapDataImpl::IteratorData::isFinished):
+        (JSC::MapDataImpl::shouldPack):
+        (JSC::JSIterator>::MapDataImpl):
+        (JSC::JSIterator>::KeyType::KeyType):
+        (JSC::JSIterator>::IteratorData::IteratorData):
+        (JSC::JSIterator>::IteratorData::next):
+        (JSC::JSIterator>::IteratorData::ensureSlot):
+        (JSC::JSIterator>::IteratorData::applyMapDataPatch):
+        (JSC::JSIterator>::IteratorData::refreshCursor):
+        (JSC::MapDataImpl::const_iterator::key): Deleted.
+        (JSC::MapDataImpl::const_iterator::value): Deleted.
+        (JSC::MapDataImpl::const_iterator::operator++): Deleted.
+        (JSC::MapDataImpl::const_iterator::finish): Deleted.
+        (JSC::MapDataImpl::const_iterator::atEnd): Deleted.
+        (JSC::MapDataImpl::begin): Deleted.
+        (JSC::MapDataImpl::end): Deleted.
+        (JSC::MapDataImpl<Entry>::MapDataImpl): Deleted.
+        (JSC::MapDataImpl<Entry>::clear): Deleted.
+        (JSC::MapDataImpl<Entry>::KeyType::KeyType): Deleted.
+        (JSC::MapDataImpl<Entry>::const_iterator::internalIncrement): Deleted.
+        (JSC::MapDataImpl<Entry>::const_iterator::ensureSlot): Deleted.
+        (JSC::MapDataImpl<Entry>::const_iterator::const_iterator): Deleted.
+        (JSC::MapDataImpl<Entry>::const_iterator::~const_iterator): Deleted.
+        (JSC::MapDataImpl<Entry>::const_iterator::operator): Deleted.
+        (JSC::=): Deleted.
+        * runtime/MapDataInlines.h:
+        (JSC::JSIterator>::clear):
+        (JSC::JSIterator>::find):
+        (JSC::JSIterator>::contains):
+        (JSC::JSIterator>::add):
+        (JSC::JSIterator>::set):
+        (JSC::JSIterator>::get):
+        (JSC::JSIterator>::remove):
+        (JSC::JSIterator>::replaceAndPackBackingStore):
+        (JSC::JSIterator>::replaceBackingStore):
+        (JSC::JSIterator>::ensureSpaceForAppend):
+        (JSC::JSIterator>::visitChildren):
+        (JSC::JSIterator>::copyBackingStore):
+        (JSC::JSIterator>::applyMapDataPatch):
+        (JSC::MapDataImpl<Entry>::find): Deleted.
+        (JSC::MapDataImpl<Entry>::contains): Deleted.
+        (JSC::MapDataImpl<Entry>::add): Deleted.
+        (JSC::MapDataImpl<Entry>::set): Deleted.
+        (JSC::MapDataImpl<Entry>::get): Deleted.
+        (JSC::MapDataImpl<Entry>::remove): Deleted.
+        (JSC::MapDataImpl<Entry>::replaceAndPackBackingStore): Deleted.
+        (JSC::MapDataImpl<Entry>::replaceBackingStore): Deleted.
+        (JSC::MapDataImpl<Entry>::ensureSpaceForAppend): Deleted.
+        (JSC::MapDataImpl<Entry>::visitChildren): Deleted.
+        (JSC::MapDataImpl<Entry>::copyBackingStore): Deleted.
+        * runtime/MapPrototype.cpp:
+        (JSC::mapProtoFuncForEach):
+        * runtime/SetPrototype.cpp:
+        (JSC::setProtoFuncForEach):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::forEach):
+        * tests/stress/modify-map-during-iteration.js: Added.
+        (testValue):
+        (identityPairs):
+        (.set if):
+        (var):
+        (set map):
+        * tests/stress/modify-set-during-iteration.js: Added.
+        (testValue):
+        (set forEach):
+        (set delete):
+
+2015-03-24  Mark Lam  <mark.lam@apple.com>
+
+        The ExecutionTimeLimit test should use its own JSGlobalContextRef.
+        <https://webkit.org/b/143024>
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, the ExecutionTimeLimit test is using a JSGlobalContextRef
+        passed in from testapi.c.  It should create its own for better
+        encapsulation of the test.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (currentCPUTimeAsJSFunctionCallback):
+        (testExecutionTimeLimit):
+        * API/tests/ExecutionTimeLimitTest.h:
+        * API/tests/testapi.c:
+        (main):
+
+2015-03-24  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6: Object Literal Methods toString is missing method name
+        https://bugs.webkit.org/show_bug.cgi?id=142992
+
+        Reviewed by Geoffrey Garen.
+
+        Always stringify functions in the pattern:
+
+          "function " + <function name> + <text from opening parenthesis to closing brace>.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        Update the path that was not stringifying in this pattern.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::parametersStartOffset):
+        * parser/Nodes.h:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::parametersStartOffset):
+        Pass the already known function parameter opening parenthesis
+        start offset through to the FunctionExecutable. 
+
+        * tests/mozilla/js1_5/Scope/regress-185485.js:
+        (with.g):
+        Add back original space in this test that was removed by r181810
+        now that we have the space again in stringification.
+
+2015-03-24  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (172175-172177): Change in for...in processing causes properties added in loop to be enumerated
+        https://bugs.webkit.org/show_bug.cgi?id=142856
+
+        Reviewed by Filip Pizlo.
+
+        Refactored the way the for .. in enumeration over objects is done.  We used to make three C++ calls to
+        get info for three loops to iterate over indexed properties, structure properties and other properties,
+        respectively.  We still have the three loops, but now we make one C++ call to get all the info needed
+        for all loops before we exectue any enumeration.
+
+        The JSPropertyEnumerator has a count of the indexed properties and a list of named properties.
+        The named properties are one list, with structured properties in the range [0,m_endStructurePropertyIndex)
+        and the generic properties in the range [m_endStructurePropertyIndex, m_endGenericPropertyIndex);
+
+        Eliminated the bytecodes op_get_structure_property_enumerator, op_get_generic_property_enumerator and
+        op_next_enumerator_pname.
+        Added the bytecodes op_get_property_enumerator, op_enumerator_structure_pname and op_enumerator_generic_pname.
+        The bytecodes op_enumerator_structure_pname and op_enumerator_generic_pname are similar except for what
+        end value we stop iterating on.
+
+        Made corresponding node changes to the DFG and FTL for the bytecode changes.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetPropertyEnumerator):
+        (JSC::BytecodeGenerator::emitEnumeratorStructurePropertyName):
+        (JSC::BytecodeGenerator::emitEnumeratorGenericPropertyName):
+        (JSC::BytecodeGenerator::emitGetStructurePropertyEnumerator): Deleted.
+        (JSC::BytecodeGenerator::emitGetGenericPropertyEnumerator): Deleted.
+        (JSC::BytecodeGenerator::emitNextEnumeratorPropertyName): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetEnumerableLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetPropertyEnumerator):
+        (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorStructurePname):
+        (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorGenericPname):
+        (JSC::FTL::LowerDFGToLLVM::compileGetStructurePropertyEnumerator): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileGetGenericPropertyEnumerator): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compileGetEnumeratorPname): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_enumerator_structure_pname):
+        (JSC::JIT::emit_op_enumerator_generic_pname):
+        (JSC::JIT::emit_op_get_property_enumerator):
+        (JSC::JIT::emit_op_next_enumerator_pname): Deleted.
+        (JSC::JIT::emit_op_get_structure_property_enumerator): Deleted.
+        (JSC::JIT::emit_op_get_generic_property_enumerator): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_enumerator_structure_pname):
+        (JSC::JIT::emit_op_enumerator_generic_pname):
+        (JSC::JIT::emit_op_next_enumerator_pname): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::create):
+        (JSC::JSPropertyNameEnumerator::finishCreation):
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::JSPropertyNameEnumerator::indexedLength):
+        (JSC::JSPropertyNameEnumerator::endStructurePropertyIndex):
+        (JSC::JSPropertyNameEnumerator::endGenericPropertyIndex):
+        (JSC::JSPropertyNameEnumerator::indexedLengthOffset):
+        (JSC::JSPropertyNameEnumerator::endStructurePropertyIndexOffset):
+        (JSC::JSPropertyNameEnumerator::endGenericPropertyIndexOffset):
+        (JSC::JSPropertyNameEnumerator::cachedInlineCapacityOffset):
+        (JSC::propertyNameEnumerator):
+        (JSC::JSPropertyNameEnumerator::cachedPropertyNamesLengthOffset): Deleted.
+        (JSC::structurePropertyNameEnumerator): Deleted.
+        (JSC::genericPropertyNameEnumerator): Deleted.
+        * runtime/Structure.cpp:
+        (JSC::Structure::setCachedPropertyNameEnumerator):
+        (JSC::Structure::cachedPropertyNameEnumerator):
+        (JSC::Structure::canCachePropertyNameEnumerator):
+        (JSC::Structure::setCachedStructurePropertyNameEnumerator): Deleted.
+        (JSC::Structure::cachedStructurePropertyNameEnumerator): Deleted.
+        (JSC::Structure::setCachedGenericPropertyNameEnumerator): Deleted.
+        (JSC::Structure::cachedGenericPropertyNameEnumerator): Deleted.
+        (JSC::Structure::canCacheStructurePropertyNameEnumerator): Deleted.
+        (JSC::Structure::canCacheGenericPropertyNameEnumerator): Deleted.
+        * runtime/Structure.h:
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::visitChildren):
+        (JSC::StructureRareData::cachedPropertyNameEnumerator):
+        (JSC::StructureRareData::setCachedPropertyNameEnumerator):
+        (JSC::StructureRareData::cachedStructurePropertyNameEnumerator): Deleted.
+        (JSC::StructureRareData::setCachedStructurePropertyNameEnumerator): Deleted.
+        (JSC::StructureRareData::cachedGenericPropertyNameEnumerator): Deleted.
+        (JSC::StructureRareData::setCachedGenericPropertyNameEnumerator): Deleted.
+        * runtime/StructureRareData.h:
+        * tests/stress/for-in-delete-during-iteration.js:
+
+2015-03-24  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix for debug builds.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::invalidParameterInSourceAppender):
+
+2015-03-24  Saam Barati  <saambarati1@gmail.com>
+
+        Improve error messages in JSC
+        https://bugs.webkit.org/show_bug.cgi?id=141869
+
+        Reviewed by Geoffrey Garen.
+
+        JavaScriptCore has some unintuitive error messages associated
+        with certain common errors. This patch changes some specific
+        error messages to be more understandable and also creates a
+        mechanism that will allow for easy modification of error messages
+        in the future. The specific errors we change are not a function
+        errors and invalid parameter errors.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeOfVarargs):
+        * jit/JITOperations.cpp:
+        op_throw_static_error always has a JSString as its argument.
+        There is no need to dance around this, and we should assert
+        that this always holds. This JSString represents the error 
+        message we want to display to the user, so there is no need
+        to pass it into errorDescriptionForValue which will now place
+        quotes around the string.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::hasSourceAppender):
+        (JSC::ErrorInstance::sourceAppender):
+        (JSC::ErrorInstance::setSourceAppender):
+        (JSC::ErrorInstance::clearSourceAppender):
+        (JSC::ErrorInstance::setRuntimeTypeForCause):
+        (JSC::ErrorInstance::runtimeTypeForCause):
+        (JSC::ErrorInstance::clearRuntimeTypeForCause):
+        (JSC::ErrorInstance::appendSourceToMessage): Deleted.
+        (JSC::ErrorInstance::setAppendSourceToMessage): Deleted.
+        (JSC::ErrorInstance::clearAppendSourceToMessage): Deleted.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue):
+        (JSC::defaultApproximateSourceError):
+        (JSC::defaultSourceAppender):
+        (JSC::functionCallBase):
+        (JSC::notAFunctionSourceAppender):
+        (JSC::invalidParameterInSourceAppender):
+        (JSC::invalidParameterInstanceofSourceAppender):
+        (JSC::createError):
+        (JSC::createInvalidFunctionApplyParameterError):
+        (JSC::createInvalidInParameterError):
+        (JSC::createInvalidInstanceofParameterError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+        (JSC::createInvalidParameterError): Deleted.
+        * runtime/ExceptionHelpers.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        * runtime/RuntimeType.cpp: Added.
+        (JSC::runtimeTypeForValue):
+        (JSC::runtimeTypeAsString):
+        * runtime/RuntimeType.h: Added.
+        * runtime/TypeProfilerLog.cpp:
+        (JSC::TypeProfilerLog::processLogEntries):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::getRuntimeTypeForValue): Deleted.
+        * runtime/TypeSet.h:
+        * runtime/VM.cpp:
+        (JSC::appendSourceToError):
+        (JSC::VM::throwException):
+
+2015-03-23  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should have a low-cost asynchronous disassembler
+        https://bugs.webkit.org/show_bug.cgi?id=142997
+
+        Reviewed by Mark Lam.
+        
+        This adds a JSC_asyncDisassembly option that disassembles on a thread. Disassembly
+        doesn't block execution. Some code will live a little longer because of this, since the
+        work tasks hold a ref to the code, but other than that there is basically no overhead.
+        
+        At present, this isn't really a replacement for JSC_showDisassembly, since it doesn't
+        provide contextual IR information for Baseline and DFG disassemblies, and it doesn't do
+        the separate IR dumps for FTL. Using JSC_showDisassembly and friends along with
+        JSC_asyncDisassembly has bizarre behavior - so just choose one.
+        
+        A simple way of understanding how great this is, is to run a small benchmark like
+        V8Spider/earley-boyer.
+        
+        Performance without any disassembly flags: 60ms
+        Performance with JSC_showDisassembly=true: 477ms
+        Performance with JSC_asyncDisassembly=true: 65ms
+        
+        So, the overhead of disassembly goes from 8x to 8%.
+        
+        Note that JSC_asyncDisassembly=true does make it incorrect to run "time" as a way of
+        measuring benchmark performance. This is because at VM exit, we wait for all async
+        disassembly requests to finish. For example, for earley-boyer, we spend an extra ~130ms
+        after the benchmark completely finishes to finish the disassemblies. This small weirdness
+        should be OK for the intended use-cases, since all you have to do to get around it is to
+        measure the execution time of the benchmark payload rather than the end-to-end time of
+        launching the VM.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::wasAlreadyDisassembled):
+        (JSC::LinkBuffer::didAlreadyDisassemble):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::disassemble):
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalize):
+        (JSC::DFG::JITFinalizer::finalizeFunction):
+        * disassembler/Disassembler.cpp:
+        (JSC::disassembleAsynchronously):
+        (JSC::waitForAsynchronousDisassembly):
+        * disassembler/Disassembler.h:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jsc.cpp:
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::~VM):
+
+2015-03-23  Dean Jackson  <dino@apple.com>
+
+        ES7: Implement Array.prototype.includes
+        https://bugs.webkit.org/show_bug.cgi?id=142707
+
+        Reviewed by Geoffrey Garen.
+
+        Add support for the ES7 includes method on Arrays.
+        https://github.com/tc39/Array.prototype.includes
+
+        * builtins/Array.prototype.js:
+        (includes): Implementation in JS.
+        * runtime/ArrayPrototype.cpp: Add 'includes' to the lookup table.
+
+2015-03-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        __defineGetter__/__defineSetter__ should throw exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=142934
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        Throw exceptions when these functions are used directly.
+
+2015-03-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix DO_PROPERTYMAP_CONSTENCY_CHECK enabled build
+        https://bugs.webkit.org/show_bug.cgi?id=142952
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/Structure.cpp:
+        (JSC::PropertyTable::checkConsistency):
+        The check offset method doesn't exist in PropertyTable, it exists in Structure.
+
+        (JSC::Structure::checkConsistency):
+        So move it here, and always put it at the start to match normal behavior.
+
+2015-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove DFG::ValueRecoveryOverride; it's been dead since we removed forward speculations
+        https://bugs.webkit.org/show_bug.cgi?id=142956
+
+        Rubber stamped by Gyuyoung Kim.
+        
+        Just removing dead code.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGValueRecoveryOverride.h: Removed.
+
+2015-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit shouldn't assume that the frame count for exit is greater than the frame count in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=142948
+
+        Reviewed by Sam Weinig.
+        
+        It's necessary to ensure that the stack pointer accounts for the extent of our stack usage
+        since a signal may clobber the area below the stack pointer. When the DFG is executing,
+        the stack pointer accounts for the DFG's worst-case stack usage. When we OSR exit back to
+        baseline, we will use a different amount of stack. This is because baseline is a different
+        compiler. It will make different decisions. So it will use a different amount of stack.
+        
+        This gets tricky when we are in the process of doing an OSR exit, because we are sort of
+        incrementally transforming the stack from how it looked in the DFG to how it will look in
+        baseline. The most conservative approach would be to set the stack pointer to the max of
+        DFG and baseline.
+        
+        When this code was written, a reckless assumption was made: that the stack usage in
+        baseline is always at least as large as the stack usage in DFG. Based on this incorrect
+        assumption, the code first adjusts the stack pointer to account for the baseline stack
+        usage. This sort of usually works, because usually baseline does happen to use more stack.
+        But that's not an invariant. Nobody guarantees this. We will never make any changes that
+        would make this be guaranteed, because that would be antithetical to how optimizing
+        compilers work. The DFG should be allowed to use however much stack it decides that it
+        should use in order to get good performance, and it shouldn't try to guarantee that it
+        always uses less stack than baseline.
+        
+        As such, we must always assume that the frame size for DFG execution (i.e.
+        frameRegisterCount) and the frame size in baseline once we exit (i.e.
+        requiredRegisterCountForExit) are two independent quantities and they have no
+        relationship.
+        
+        Fortunately, though, this code can be made correct by just moving the stack adjustment to
+        just before we do conversions. This is because we have since changed the OSR exit
+        algorithm to first lift up all state from the DFG state into a scratch buffer, and then to
+        drop it out of the scratch buffer and into the stack according to the baseline layout. The
+        point just before conversions is the point where we have finished reading the DFG frame
+        and will not read it anymore, and we haven't started writing the baseline frame. So, at
+        this point it is safe to set the stack pointer to account for the frame size at exit.
+        
+        This is benign because baseline happens to create larger frames than DFG.
+
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::adjustAndJumpToTarget):
+
+2015-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Shorten the number of iterations to 10,000 since that's enough to test all tiers.
+
+        Rubber stamped by Sam Weinig.
+
+        * tests/stress/equals-masquerader.js:
+
+2015-03-22  Filip Pizlo  <fpizlo@apple.com>
+
+        tests/stress/*tdz* tests do 10x more iterations than necessary
+        https://bugs.webkit.org/show_bug.cgi?id=142946
+
+        Reviewed by Ryosuke Niwa.
+        
+        The stress test harness runs all of these tests in various configurations. This includes
+        no-cjit, which has tier-up heuristics locked in such a way that 10,000 iterations is
+        enough to get to the highest tier. The only exceptions are very large functions or
+        functions that have some reoptimizations. That happens rarely, and when it does happen,
+        usually 20,000 iterations is enough.
+        
+        Therefore, these tests use 10x too many iterations. This is bad, since these tests
+        allocate on each iteration, and so they run very slowly in debug mode.
+
+        * tests/stress/class-syntax-no-loop-tdz.js:
+        * tests/stress/class-syntax-no-tdz-in-catch.js:
+        * tests/stress/class-syntax-no-tdz-in-conditional.js:
+        * tests/stress/class-syntax-no-tdz-in-loop-no-inline-super.js:
+        * tests/stress/class-syntax-no-tdz-in-loop.js:
+        * tests/stress/class-syntax-no-tdz.js:
+        * tests/stress/class-syntax-tdz-in-catch.js:
+        * tests/stress/class-syntax-tdz-in-conditional.js:
+        * tests/stress/class-syntax-tdz-in-loop.js:
+        * tests/stress/class-syntax-tdz.js:
+
+2015-03-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix a typo in Parser error message
+        https://bugs.webkit.org/show_bug.cgi?id=142942
+
+        Reviewed by Alexey Proskuryakov.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        Fix a common identifier typo.
+
+2015-03-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Computed Property names should allow only AssignmentExpressions not any Expression
+        https://bugs.webkit.org/show_bug.cgi?id=142902
+
+        Reviewed by Ryosuke Niwa.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseProperty):
+        Limit computed expressions to just assignment expressions instead of
+        any expression (which allowed comma expressions).
+
+2015-03-21  Andreas Kling  <akling@apple.com>
+
+        Make UnlinkedFunctionExecutable fit in a 128-byte cell.
+        <https://webkit.org/b/142939>
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-arrange the members of UnlinkedFunctionExecutable so it can fit inside
+        a 128-byte heap cell instead of requiring a 256-byte one.
+
+        Threw in a static_assert to catch anyone pushing it over the limit again.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::functionMode):
+
+2015-03-20  Mark Hahnenberg  <mhahnenb@gmail.com>
+
+        GCTimer should know keep track of nested GC phases
+        https://bugs.webkit.org/show_bug.cgi?id=142675
+
+        Reviewed by Darin Adler.
+
+        This improves the GC phase timing output in Heap.cpp by linking
+        phases nested inside other phases together, allowing tools
+        to compute how much time we're spending in various nested phases.
+
+        * heap/Heap.cpp:
+
+2015-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        FunctionBodyNode should known where its parameters started
+        https://bugs.webkit.org/show_bug.cgi?id=142926
+
+        Reviewed by Ryosuke Niwa.
+
+        This will allow us to re-parse parameters instead of keeping the
+        parameters piece of the AST around forever.
+
+        I also took the opportunity to initialize most FunctionBodyNode data
+        members at construction time, to help clarify that they are set right.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionExpr): No need to pass
+        functionKeywordStart here; we now provide it at FunctionBodyNode
+        creation time.
+
+        (JSC::ASTBuilder::createFunctionBody): Require everything we need at
+        construction time, including the start of our parameters.
+
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createFuncDeclStatement):  No need to pass
+        functionKeywordStart here; we now provide it at FunctionBodyNode
+        creation time.
+
+        (JSC::ASTBuilder::setFunctionNameStart): Deleted.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode): Initialize everything at
+        construction time.
+
+        * parser/Nodes.h: Added a field for the location of our parameters.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        * parser/Parser.h: Refactored to match above interface changes.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty): Refactored to match
+        above interface changes.
+
+        (JSC::SyntaxChecker::setFunctionNameStart): Deleted.
+
+2015-03-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Observably effectful nodes in DFG IR should come last in their bytecode instruction (i.e. forExit section), except for Hint nodes
+        https://bugs.webkit.org/show_bug.cgi?id=142920
+
+        Reviewed by Oliver Hunt, Geoffrey Garen, and Mark Lam.
+        
+        Observably effectful, n.: If we reexecute the bytecode instruction after this node has
+        executed, then something other than the bytecode instruction's specified outcome will
+        happen.
+
+        We almost never had observably effectful nodes except at the end of the bytecode
+        instruction.  The exception is a lowered transitioning PutById:
+
+        PutStructure(@o, S1 -> S2)
+        PutByOffset(@o, @o, @v)
+
+        The PutStructure is observably effectful: if you try to reexecute the bytecode after
+        doing the PutStructure, then we'll most likely crash.  The generic PutById handling means
+        first checking what the old structure of the object is; but if we reexecute, the old
+        structure will seem to be the new structure.  But the property ensured by the new
+        structure hasn't been stored yet, so any attempt to load it or scan it will crash.
+
+        Intriguingly, however, none of the other operations involved in the PutById are
+        observably effectful.  Consider this example:
+
+        PutByOffset(@o, @o, @v)
+        PutStructure(@o, S1 -> S2)
+
+        Note that the PutStructure node doesn't reallocate property storage; see further below
+        for an example that does that. Because no property storage is happening, we know that we
+        already had room for the new property.  This means that the PutByOffset is no observable
+        until the PutStructure executes and "reveals" the property.  Hence, PutByOffset is not
+        observably effectful.
+
+        Now consider this:
+
+        b: AllocatePropertyStorage(@o)
+        PutByOffset(@b, @o, @v)
+        PutStructure(@o, S1 -> S2)
+
+        Surprisingly, this is also safe, because the AllocatePropertyStorage is not observably
+        effectful. It *does* reallocate the property storage and the new property storage pointer
+        is stored into the object. But until the PutStructure occurs, the world will just think
+        that the reallocation didn't happen, in the sense that we'll think that the property
+        storage is using less memory than what we just allocated. That's harmless.
+
+        The AllocatePropertyStorage is safe in other ways, too. Even if we GC'd after the
+        AllocatePropertyStorage but before the PutByOffset (or before the PutStructure),
+        everything could be expected to be fine, so long as all of @o, @v and @b are on the
+        stack. If they are all on the stack, then the GC will leave the property storage alone
+        (so the extra memory we just allocated would be safe). The GC will not scan the part of
+        the property storage that contains @v, but that's fine, so long as @v is on the stack.
+        
+        The better long-term solution is probably bug 142921.
+        
+        But for now, this:
+        
+        - Fixes an object materialization bug, exemplified by the two tests, that previously
+          crashed 100% of the time with FTL enabled and concurrent JIT disabled.
+        
+        - Allows us to remove the workaround introduced in r174856.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::insertCheck):
+        (JSC::DFG::FixupPhase::indexOfNode): Deleted.
+        (JSC::DFG::FixupPhase::indexOfFirstNodeOfExitOrigin): Deleted.
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertOutOfOrder): Deleted.
+        (JSC::DFG::InsertionSet::insertOutOfOrderNode): Deleted.
+        * tests/stress/materialize-past-butterfly-allocation.js: Added.
+        (bar):
+        (foo0):
+        (foo1):
+        (foo2):
+        (foo3):
+        (foo4):
+        * tests/stress/materialize-past-put-structure.js: Added.
+        (foo):
+
+2015-03-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION (r179429): Potential Use after free in JavaScriptCore`WTF::StringImpl::ref + 83
+        https://bugs.webkit.org/show_bug.cgi?id=142410
+
+        Reviewed by Geoffrey Garen.
+
+        Before this patch, added function JSValue::toPropertyKey returns PropertyName.
+        Since PropertyName doesn't have AtomicStringImpl ownership,
+        if Identifier is implicitly converted to PropertyName and Identifier is destructed,
+        PropertyName may refer freed AtomicStringImpl*.
+
+        This patch changes the result type of JSValue::toPropertyName from PropertyName to Identifier,
+        to keep AtomicStringImpl* ownership after the toPropertyName call is done.
+        And receive the result value as Identifier type to keep ownership in the caller side.
+
+        To catch the result of toPropertyKey as is, we catch the result of toPropertyName as auto.
+
+        However, now we don't need to have both Identifier and PropertyName.
+        So we'll merge PropertyName to Identifier in the subsequent patch.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::toPropertyKey):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+
+2015-03-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Function.prototype.toString should not decompile the AST
+        https://bugs.webkit.org/show_bug.cgi?id=142853
+
+        Reviewed by Sam Weinig.
+
+        To recover the function parameter string, Function.prototype.toString
+        decompiles the function parameters from the AST. This is bad for a few
+        reasons:
+
+        (1) It requires us to keep pieces of the AST live forever. This is an
+        awkward design and a waste of memory.
+
+        (2) It doesn't match Firefox or Chrome (because it changes whitespace
+        and ES6 destructuring expressions).
+
+        (3) It doesn't scale to ES6 default argument parameters, which require
+        arbitrarily complex decompilation.
+
+        (4) It can counterfeit all the line numbers in a function (because
+        whitespace can include newlines).
+
+        (5) It's expensive, and we've seen cases where websites invoke
+        Function.prototype.toString a lot by accident.
+
+        The fix is to do what we do for the rest of the function: Just quote the
+        original source text.
+
+        Since this change inevitably changes some function stringification, I
+        took the opportunity to make our stringification match Firefox's and
+        Chrome's.
+
+        * API/tests/testapi.c:
+        (assertEqualsAsUTF8String): Be more informative when this fails.
+
+        (main): Updated to match new stringification rules.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::paramString): Deleted. Yay!
+        * bytecode/UnlinkedCodeBlock.h:
+
+        * parser/Nodes.h:
+        (JSC::StatementNode::isFuncDeclNode): New helper for constructing
+        anonymous functions.
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::SourceCode): Allow zero because WebCore wants it.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Updated for use
+        of function declaration over function expression.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString): Deleted. Yay!
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::parameterCount):
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck): Added a newline after
+        the opening brace to match Firefox and Chrome, and a space after the comma
+        to match Firefox and WebKit coding style. Added the function name to
+        the text of the function so it would look right when stringify-ing. Switched
+        from parentheses to braces to produce a function declaration instead of
+        a function expression because we are required to exclude the function's
+        name from its scope, and that's what a function declaration does.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Removed an old workaround because the
+        library it worked around doesn't really exist anymore, and the behavior
+        doesn't match Firefox or Chrome. Use type profiling offsets instead of
+        function body offsets because we want to include the function name and
+        the parameter string, rather than stitching them in manually by
+        decompiling the AST.
+
+        (JSC::insertSemicolonIfNeeded): Deleted.
+
+        * tests/mozilla/js1_2/function/tostring-1.js:
+        * tests/mozilla/js1_5/Scope/regress-185485.js:
+        (with.g): Updated these test results for formatting changes.
+
+2015-03-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        SyntaxChecker assertion is trapped with computed property name and getter
+        https://bugs.webkit.org/show_bug.cgi?id=142863
+
+        Reviewed by Ryosuke Niwa.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::getName):
+        Remove invalid assert. Computed properties will not have a name
+        and the calling code is checking for null expecting it. The
+        AST path (non-CheckingPath) already does this without the assert
+        so it is well tested.
+
+2015-03-19  Mark Lam  <mark.lam@apple.com>
+
+        JSCallbackObject<JSGlobalObject> should not destroy its JSCallbackObjectData before all its finalizers have been called.
+        <https://webkit.org/b/142846>
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, JSCallbackObject<JSGlobalObject> registers weak finalizers via 2 mechanisms:
+        1. JSCallbackObject<Parent>::init() registers a weak finalizer for all JSClassRef
+           that a JSCallbackObject references.
+        2. JSCallbackObject<JSGlobalObject>::create() registers a finalizer via
+           vm.heap.addFinalizer() which destroys the JSCallbackObject.
+
+        The first finalizer is implemented as a virtual function of a JSCallbackObjectData
+        instance that will be destructed if the 2nd finalizer is called.  Hence, if the
+        2nd finalizer if called first, the later invocation of the 1st finalizer will
+        result in a crash.
+
+        This patch fixes the issue by eliminating the finalizer registration in init().
+        Instead, we'll have the JSCallbackObject destructor call all the JSClassRef finalizers
+        if needed.  This ensures that these finalizers are called before the JSCallbackObject
+        is destructor.
+
+        Also added assertions to a few Heap functions because JSCell::classInfo() expects
+        all objects that are allocated from MarkedBlock::Normal blocks to be derived from
+        JSDestructibleObject.  These assertions will help us catch violations of this
+        expectation earlier.
+
+        * API/JSCallbackObject.cpp:
+        (JSC::JSCallbackObjectData::finalize): Deleted.
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::~JSCallbackObjectData):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::~JSCallbackObject):
+        (JSC::JSCallbackObject<Parent>::init):
+        * API/tests/GlobalContextWithFinalizerTest.cpp: Added.
+        (finalize):
+        (testGlobalContextWithFinalizer):
+        * API/tests/GlobalContextWithFinalizerTest.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/HeapInlines.h:
+        (JSC::Heap::allocateObjectOfType):
+        (JSC::Heap::subspaceForObjectOfType):
+        (JSC::Heap::allocatorForObjectOfType):
+
+2015-03-19  Andreas Kling  <akling@apple.com>
+
+        JSCallee unnecessarily overrides a bunch of things in the method table.
+        <https://webkit.org/b/142855>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove JSCallee method table overrides that simply call to base class.
+        This makes JSFunction property slot lookups slightly more efficient since
+        they can take the fast path when passing over JSCallee in the base class chain.
+
+        * runtime/JSCallee.cpp:
+        (JSC::JSCallee::getOwnPropertySlot): Deleted.
+        (JSC::JSCallee::getOwnNonIndexPropertyNames): Deleted.
+        (JSC::JSCallee::put): Deleted.
+        (JSC::JSCallee::deleteProperty): Deleted.
+        (JSC::JSCallee::defineOwnProperty): Deleted.
+        * runtime/JSCallee.h:
+
+2015-03-19  Andreas Kling  <akling@apple.com>
+
+        DFGAllocator should use bmalloc's aligned allocator.
+        <https://webkit.org/b/142871>
+
+        Reviewed by Geoffrey Garen.
+
+        Switch DFGAllocator to using bmalloc through fastAlignedMalloc().
+
+        * dfg/DFGAllocator.h:
+        (JSC::DFG::Allocator<T>::allocateSlow):
+        (JSC::DFG::Allocator<T>::freeRegionsStartingAt):
+        * heap/CopiedSpace.h:
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.h:
+
+2015-03-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6 Classes: Extends should accept an expression without parenthesis
+        https://bugs.webkit.org/show_bug.cgi?id=142840
+
+        Reviewed by Ryosuke Niwa.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        "extends" allows a LeftHandExpression (new expression / call expression,
+        which includes a member expression), not a primary expression. Our
+        parseMemberExpression does all of these.
+
+2015-03-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Debugger Popovers and Probes should use FormattedValue/ObjectTreeView instead of Custom/ObjectPropertiesSection
+        https://bugs.webkit.org/show_bug.cgi?id=142830
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        Give Probe Samples object previews.
+
+2015-03-17  Ryuan Choi  <ryuan.choi@navercorp.com>
+
+        [EFL] Expose JavaScript binding interface through ewk_extension
+        https://bugs.webkit.org/show_bug.cgi?id=142033
+
+        Reviewed by Gyuyoung Kim.
+
+        * PlatformEfl.cmake: Install Javascript APIs.
+
+2015-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Function bodies should always include braces
+        https://bugs.webkit.org/show_bug.cgi?id=142795
+
+        Reviewed by Michael Saboff.
+
+        Having a mode for excluding the opening and closing braces from a function
+        body was unnecessary and confusing.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Adopt the new one true linking function.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::link):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor): No need to pass through
+        a boolean: there is only one kind of function now.
+
+        (JSC::UnlinkedFunctionExecutable::linkInsideExecutable): Deleted.
+        (JSC::UnlinkedFunctionExecutable::linkGlobalCode): Deleted. Let's only
+        have one way to do things. This removes the old mode that would pretend
+        that a function always started at column 1. That pretense was not true:
+        an attribute event listener does not necessarily start at column 1.
+
+        * bytecode/UnlinkedCodeBlock.h:
+        * generate-js-builtins: Adopt the new one true linking function.
+
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        (JSC::parse): needsReparsingAdjustment is always true now, so I removed it.
+
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::create):
+        (JSC::FunctionExecutable::bodyIncludesBraces): Deleted. Removed unused stuff.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck): Always provide a
+        leading space because that's what this function's comment says is required
+        for web compatibility. We used to fake this up after the fact when
+        stringifying, based on the bodyIncludesBraces flag, but that flag is gone now.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString): No need to add braces and/or a space
+        after the fact -- we always have them now.
+
+2015-03-17  Mark Lam  <mark.lam@apple.com>
+
+        Refactor execution time limit tests out of testapi.c.
+        <https://webkit.org/b/142798>
+
+        Rubber stamped by Michael Saboff.
+
+        These tests were sometimes failing to time out on C loop builds.  Let's
+        refactor them out of the big monolith that is testapi.c so that we can
+        reason more easily about them and make adjustments if needed.
+
+        * API/tests/ExecutionTimeLimitTest.cpp: Added.
+        (currentCPUTime):
+        (currentCPUTimeAsJSFunctionCallback):
+        (shouldTerminateCallback):
+        (cancelTerminateCallback):
+        (extendTerminateCallback):
+        (testExecutionTimeLimit):
+        * API/tests/ExecutionTimeLimitTest.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        (currentCPUTime): Deleted.
+        (currentCPUTime_callAsFunction): Deleted.
+        (shouldTerminateCallback): Deleted.
+        (cancelTerminateCallback): Deleted.
+        (extendTerminateCallback): Deleted.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-03-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Built-in functions should know that they use strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=142788
+
+        Reviewed by Mark Lam.
+
+        Even though all of our builtin functions use strict mode, the parser
+        thinks that they don't. This is because Executable::toStrictness treats
+        builtin-ness and strict-ness as mutually exclusive.
+
+        The fix is to disambiguate builtin-ness from strict-ness.
+
+        This bug is currently unobservable because of some other parser bugs. But
+        it causes lots of test failures once those other bugs are fixed.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable): Adopt the new API
+        for a separate value to indicate builtin-ness vs strict-ness.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor): Ditto.
+
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::toStrictness): Deleted. This function
+        was misleading since it pretended that no builtin function was ever
+        strict, which is the opposite of true.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        * parser/Lexer.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        * parser/Parser.h:
+        (JSC::parse): Adopt the new API.
+
+        * parser/ParserModes.h: Added JSParserBuiltinMode, and tried to give
+        existing modes clearer names.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Adopt the new API.
+
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::SourceCodeKey): Be sure to treat strict-ness and
+        bulitin-ness as separate pieces of the code cache key. We would not want
+        a user function to match a built-in function in the cache, even if they
+        agreed about strictness, since builtin functions have different lexing
+        rules.
+
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::create):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock): Adopt the new API.
+
+2015-03-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG IR shouldn't have a separate node for every kind of put hint that could be described using PromotedLocationDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=142769
+
+        Reviewed by Michael Saboff.
+        
+        When we sink an object allocation, we need to have some way of tracking what stores would
+        have happened had the allocation not been sunk, so that we know how to rematerialize the
+        object on OSR exit. Prior to this change, trunk had two ways of describing such a "put
+        hint":
+        
+        - The PutStrutureHint and PutByOffsetHint node types.
+        - The PromotedLocationDescriptor class, which has an enum with cases StructurePLoc and
+          NamedPropertyPLoc.
+        
+        We also had ways of converting from a Node with those two node types to a
+        PromotedLocationDescriptor, and we had a way of converting a PromotedLocationDescriptor to
+        a Node.
+        
+        This change removes the redundancy. We now have just one node type that corresponds to a
+        put hint, and it's called PutHint. It has a PromotedLocationDescriptor as metadata.
+        Converting between a PutHint node and a PromotedLocationDescriptor and vice-versa is now
+        trivial.
+        
+        This means that if we add new kinds of sunken objects, we'll have less pro-forma to write
+        for the put hints to those objects. This is mainly to simplify the implementation of
+        arguments elimination in bug 141174.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::mergeRelevantToOSR):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToPutHint):
+        (JSC::DFG::Node::convertToPutStructureHint):
+        (JSC::DFG::Node::convertToPutByOffsetHint):
+        (JSC::DFG::Node::promotedLocationDescriptor):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::hasPromotedLocationDescriptor):
+        (JSC::DFG::Node::convertToPutByOffsetHint): Deleted.
+        (JSC::DFG::Node::convertToPutStructureHint): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::run):
+        (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+        (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPromoteHeapAccess.h:
+        (JSC::DFG::promoteHeapAccess):
+        * dfg/DFGPromotedHeapLocation.cpp:
+        (JSC::DFG::PromotedHeapLocation::createHint):
+        * dfg/DFGPromotedHeapLocation.h:
+        (JSC::DFG::PromotedLocationDescriptor::imm1):
+        (JSC::DFG::PromotedLocationDescriptor::imm2):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+
+2015-03-17  Michael Saboff  <msaboff@apple.com>
+
+        Windows X86-64 should use the fixed executable allocator
+        https://bugs.webkit.org/show_bug.cgi?id=142749
+
+        Reviewed by Filip Pizlo.
+
+        Added jit/ExecutableAllocatorFixedVMPool.cpp to Windows build.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Don't include unistd.h on Windows.
+
+2015-03-17  Matt Baker  <mattbaker@apple.com>
+
+        Web Inspector: Show rendering frames (and FPS) in Layout and Rendering timeline
+        https://bugs.webkit.org/show_bug.cgi?id=142029
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+        Added new event type for runloop timeline records.
+
+2015-03-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Enable ES6 classes by default
+        https://bugs.webkit.org/show_bug.cgi?id=142774
+
+        Reviewed by Gavin Barraclough.
+
+        Enabled the feature and unskipped tests.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * tests/stress/class-syntax-no-loop-tdz.js:
+        * tests/stress/class-syntax-no-tdz-in-catch.js:
+        * tests/stress/class-syntax-no-tdz-in-conditional.js:
+        * tests/stress/class-syntax-no-tdz-in-loop-no-inline-super.js:
+        * tests/stress/class-syntax-no-tdz-in-loop.js:
+        * tests/stress/class-syntax-no-tdz.js:
+        * tests/stress/class-syntax-tdz-in-catch.js:
+        * tests/stress/class-syntax-tdz-in-conditional.js:
+        * tests/stress/class-syntax-tdz-in-loop.js:
+        * tests/stress/class-syntax-tdz.js:
+
+2015-03-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Better Console Previews for Arrays / Small Objects
+        https://bugs.webkit.org/show_bug.cgi?id=142322
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        Create deep valuePreviews for simple previewable objects,
+        such as arrays with 5 values, or basic objects with
+        3 properties.
+
+2015-03-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Add support for default constructor
+        https://bugs.webkit.org/show_bug.cgi?id=142388
+
+        Reviewed by Filip Pizlo.
+
+        Added the support for default constructors. They're generated by ClassExprNode::emitBytecode
+        via BuiltinExecutables::createDefaultConstructor.
+
+        UnlinkedFunctionExecutable now has the ability to override SourceCode provided by the owner
+        executable. We can't make store SourceCode in UnlinkedFunctionExecutable since CodeCache can use
+        the same UnlinkedFunctionExecutable to generate code blocks for multiple functions.
+
+        Parser now has the ability to treat any function expression as a constructor of the kind specified
+        by m_defaultConstructorKind member variable.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor): Added.
+        (JSC::BuiltinExecutables::createExecutableInternal): Generalized from createBuiltinExecutable.
+        Parse default constructors as normal non-builtin functions. Override SourceCode in the unlinked
+        function executable since the Miranda function's code is definitely not in the owner executable's
+        source code. That's the whole point.
+        * builtins/BuiltinExecutables.h:
+        (UnlinkedFunctionExecutable::createBuiltinExecutable): Added. Wraps createExecutableInternal.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::linkInsideExecutable):
+        (JSC::UnlinkedFunctionExecutable::linkGlobalCode):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedFunctionExecutable::create):
+        (JSC::UnlinkedFunctionExecutable::symbolTable): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewDefaultConstructor): Added.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ClassExprNode::emitBytecode): Generate the default constructor if needed.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseFunctionInfo): Override ownerClassKind and assume the function as
+        a constructor if we're parsing a default constructor.
+        (JSC::Parser<LexerType>::parseClass): Allow omission of the class constructor.
+        * parser/Parser.h:
+        (JSC::parse):
+
+2015-03-16  Alex Christensen  <achristensen@webkit.org>
+
+        Progress towards CMake on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=142747
+
+        Reviewed by Chris Dumez.
+
+        * CMakeLists.txt:
+        Include AugmentableInspectorController.h in CMake build.
+
+2015-03-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Enable generating idiv instructions if it is supported
+        https://bugs.webkit.org/show_bug.cgi?id=142725
+
+        Reviewed by Michael Saboff.
+
+        * assembler/ARMAssembler.h: Added sdiv and udiv implementation for ARM Traditional instruction set.
+        (JSC::ARMAssembler::sdiv):
+        (JSC::ARMAssembler::udiv):
+        * assembler/ARMv7Assembler.h: Use HAVE(ARM_IDIV_INSTRUCTIONS) instead of CPU(APPLE_ARMV7S).
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isARMv7IDIVSupported):
+        (JSC::optimizeForARMv7IDIVSupported):
+        (JSC::isARMv7s): Renamed to isARMv7IDIVSupported().
+        (JSC::optimizeForARMv7s): Renamed to optimizeForARMv7IDIVSupported().
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+
+2015-03-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::PutStackSinkingPhase should eliminate GetStacks that have an obviously known source, and emit GetStacks when the stack's value is needed and none is deferred
+        https://bugs.webkit.org/show_bug.cgi?id=141624
+
+        Reviewed by Geoffrey Garen.
+
+        Not eliminating GetStacks was an obvious omission from the original PutStackSinkingPhase.
+        Previously, we would treat GetStacks conservatively and assume that the stack slot
+        escaped. That's pretty dumb, since a GetStack is a local load of the stack. This change
+        makes GetStack a no-op from the standpoint of this phase's deferral analysis. At the end
+        we either keep the GetStack (if there was no concrete deferral) or we replace it with an
+        identity over the value that would have been stored by the deferred PutStack. Note that
+        this might be a Phi that the phase creates, so this is strictly stronger than what GCSE
+        could do.
+        
+        But this change revealed the fact that this phase never correctly handled side effects in
+        case that we had done a GetStack, then a side-effect, and then found ourselves wanting the
+        value on the stack due to (for example) a Phi on a deferred PutStack and that GetStack.
+        Basically, it's only correct to use the SSA converter's incoming value mapping if we have
+        a concrete deferral - since anything but a concrete deferral may imply that the value has
+        been clobbered.
+        
+        This has no performance change. I believe that the bug was previously benign because we
+        have so few operations that clobber the stack anymore, and most of those get used in a
+        very idiomatic way. The GetStack elimination will be very useful for the varargs
+        simplification that is part of bug 141174.
+        
+        This includes a test for the case that Speedometer hit, plus tests for the other cases I
+        thought of once I realized the deeper issue.
+
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * tests/stress/get-stack-identity-due-to-sinking.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/get-stack-mapping-with-dead-get-stack.js: Added.
+        (bar):
+        (foo):
+        * tests/stress/get-stack-mapping.js: Added.
+        (bar):
+        (foo):
+        * tests/stress/weird-put-stack-varargs.js: Added.
+        (baz):
+        (foo):
+        (fuzz):
+        (bar):
+
+2015-03-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Update Map/Set to treat -0 and 0 as the same value
+        https://bugs.webkit.org/show_bug.cgi?id=142709
+
+        Reviewed by Csaba Osztrogonác.
+
+        * runtime/MapData.h:
+        (JSC::MapDataImpl<Entry>::KeyType::KeyType):
+        No longer special case -0. It will be treated as the same as 0.
+
+2015-03-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Better handle displaying -0
+        https://bugs.webkit.org/show_bug.cgi?id=142708
+
+        Reviewed by Timothy Hatcher.
+
+        Modeled after a blink change:
+
+        Patch by <aandrey@chromium.org>
+        DevTools: DevTools: Show -0 for negative zero in console
+        https://src.chromium.org/viewvc/blink?revision=162605&view=revision
+
+        * inspector/InjectedScriptSource.js:
+        When creating a description string, or preview value string
+        for -0, be sure the string is "-0" and not "0".
+
+2015-03-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        parseClass should popScope after pushScope
+        https://bugs.webkit.org/show_bug.cgi?id=142689
+
+        Reviewed by Benjamin Poulain.
+
+        Pop the parser scope as needed.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+
+2015-03-14  Dean Jackson  <dino@apple.com>
+
+        Feature flag for Animations Level 2
+        https://bugs.webkit.org/show_bug.cgi?id=142699
+        <rdar://problem/20165097>
+
+        Reviewed by Brent Fulgham.
+
+        Add ENABLE_CSS_ANIMATIONS_LEVEL_2 and a runtime flag animationTriggersEnabled.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-03-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r181487.
+        https://bugs.webkit.org/show_bug.cgi?id=142695
+
+        Caused Speedometer/Full.html to fail (Requested by smfr on
+        #webkit).
+
+        Reverted changeset:
+
+        "DFG::PutStackSinkingPhase should eliminate GetStacks that
+        have an obviously known source"
+        https://bugs.webkit.org/show_bug.cgi?id=141624
+        http://trac.webkit.org/changeset/181487
+
+2015-03-14  Michael Saboff  <msaboff@apple.com>
+
+        ES6: Add binary and octal literal support
+        https://bugs.webkit.org/show_bug.cgi?id=142681
+
+        Reviewed by Ryosuke Niwa.
+
+        Added a binary literal parser function, parseBinary(), to Lexer patterned after the octal parser.
+        Refactored the parseBinary, parseOctal and parseDecimal to use a constant size for the number of
+        characters to try and handle directly. Factored out the shifting past any prefix to be handled by
+        the caller. Added binary and octal parsing to toDouble() via helper functions.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::parseHex):
+        (JSC::Lexer<T>::parseBinary):
+        (JSC::Lexer<T>::parseOctal):
+        (JSC::Lexer<T>::parseDecimal):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        * parser/ParserTokens.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::jsBinaryIntegerLiteral):
+        (JSC::jsOctalIntegerLiteral):
+        (JSC::toDouble):
+
+2015-03-13  Alex Christensen  <achristensen@webkit.org>
+
+        Progress towards CMake on Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=142680
+
+        Reviewed by Gyuyoung Kim.
+
+        * PlatformMac.cmake:
+        Generate TracingDtrace.h based on project.pbxproj.
+
+2015-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Object allocation sinking phase shouldn't re-decorate previously sunken allocations on each fixpoint operation
+        https://bugs.webkit.org/show_bug.cgi?id=142686
+
+        Reviewed by Oliver Hunt.
+        
+        Just because promoteHeapAccess() notifies us of an effect to a heap location in a node doesn't
+        mean that we should handle it as if it was for one of our sinking candidates. Instead we should
+        prune based on m_sinkCandidates.
+        
+        This fixes a benign bug where we would generate a lot of repeated IR for some pathological
+        tests.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::ObjectAllocationSinkingPhase::promoteSunkenFields):
+
+2015-03-13  Eric Carlson  <eric.carlson@apple.com>
+
+        [Mac] Enable WIRELESS_PLAYBACK_TARGET
+        https://bugs.webkit.org/show_bug.cgi?id=142635
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-03-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Class constructor should throw TypeError when "called"
+        https://bugs.webkit.org/show_bug.cgi?id=142566
+
+        Reviewed by Michael Saboff.
+
+        Added ConstructorKind::None to denote code that doesn't belong to an ES6 class.
+        This allows BytecodeGenerator to emit code to throw TypeError when generating code block
+        to call ES6 class constructors.
+
+        Most of changes are about increasing the number of bits to store ConstructorKind from one
+        bit to two bits.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::needsActivation):
+        (JSC::ExecutableInfo::usesEval):
+        (JSC::ExecutableInfo::isStrictMode):
+        (JSC::ExecutableInfo::isConstructor):
+        (JSC::ExecutableInfo::isBuiltinFunction):
+        (JSC::ExecutableInfo::constructorKind):
+        (JSC::UnlinkedFunctionExecutable::constructorKind):
+        (JSC::UnlinkedCodeBlock::constructorKind):
+        (JSC::UnlinkedFunctionExecutable::constructorKindIsDerived): Deleted.
+        (JSC::UnlinkedCodeBlock::constructorKindIsDerived): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Don't emit bytecode when we had already emitted code
+        to throw TypeError.
+        (JSC::BytecodeGenerator::BytecodeGenerator): Emit code to throw TypeError when generating
+        code to call.
+        (JSC::BytecodeGenerator::emitReturn):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::constructorKind):
+        (JSC::BytecodeGenerator::constructorKindIsDerived): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo): Renamed the incoming function argument to
+        ownerClassKind. Set constructorKind to Base or Derived only if we're parsing a constructor.
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass): Don't parse static methods using MethodMode since that
+        would result in BytecodeGenerator erroneously treating static method named "constructor" as
+        a class constructor.
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        * parser/Parser.h:
+        * parser/ParserModes.h:
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::executableInfo):
+        (JSC::ProgramExecutable::executableInfo):
+
+2015-03-13  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::PutStackSinkingPhase should eliminate GetStacks that have an obviously known source
+        https://bugs.webkit.org/show_bug.cgi?id=141624
+
+        Reviewed by Oliver Hunt.
+        
+        This was an obvious omission from the original PutStackSinkingPhase. Previously, we would treat
+        GetStacks conservatively and assume that the stack slot escaped. That's pretty dumb, since a
+        GetStack is a local load of the stack. This change makes GetStack a no-op from the standpoint of
+        this phase's deferral analysis. At the end we either keep the GetStack (if there was no concrete
+        deferral) or we replace it with an identity over the value that would have been stored by the
+        deferred PutStack. Note that this might be a Phi that the phase creates, so this is strictly
+        stronger than what GCSE could do.
+        
+        This is probably not a speed-up now, but it will be very useful for the varargs simplification
+        done in bug 141174.
+
+        * dfg/DFGPutStackSinkingPhase.cpp:
+
+2015-03-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Prohibit GC while sweeping
+        https://bugs.webkit.org/show_bug.cgi?id=142638
+
+        Reviewed by Andreas Kling.
+
+        I noticed in https://bugs.webkit.org/show_bug.cgi?id=142636 that a GC
+        could trigger a sweep which could trigger another GC. Yo Dawg.
+
+        I tried to figure out whether this could cause problems or not and it
+        made me cross-eyed.
+
+        (Some clients like to report extra memory cost during deallocation as a
+        way to indicate that the GC now owns something exclusively. It's
+        arguably a bug to communicate with the GC in this way, but we shouldn't
+        do crazy when this happens.)
+
+        This patch makes explicit the fact that we don't allow GC while sweeping.
+
+        Usually, sweeping implicitly defers GC by virtue of happening during
+        allocation. But not always.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage): Defer GC while sweeping due to an
+        explicit GC request.
+
+        (JSC::Heap::didFinishCollection): Make sure that zombifying sweep
+        defers GC by not returning to the non-GC state until we're all done.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::sweepNextBlock): Defer GC while sweeping due
+        to a timer.
+
+2015-03-13  Mark Lam  <mark.lam@apple.com>
+
+        Replace TCSpinLock with a new WTF::SpinLock based on WTF::Atomic.
+        <https://webkit.org/b/142674>
+
+        Reviewed by Filip Pizlo.
+
+        * API/JSValue.mm:
+        (handerForStructTag):
+        * API/JSWrapperMap.mm:
+        * dfg/DFGCommon.cpp:
+        (JSC::DFG::startCrashing):
+        (JSC::DFG::isCrashing):
+        - Changed to use a StaticSpinLock since that's what this code was trying to do
+          anyway.
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::CopiedBlock):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::CopiedSpace):
+        * heap/CopiedSpace.h:
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        * heap/GCThreadSharedData.h:
+        * heap/ListableHandler.h:
+        (JSC::ListableHandler::List::List):
+        * parser/SourceProvider.cpp:
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::addDatabaseToAtExit):
+        (JSC::Profiler::Database::removeDatabaseFromAtExit):
+        (JSC::Profiler::Database::removeFirstAtExitDatabase):
+
+2015-03-13  Ryosuke Niwa  <rniwa@webkit.org>
+
+        BytecodeGenerator needs to be re-entrant to support miranda functions
+        https://bugs.webkit.org/show_bug.cgi?id=142627
+
+        Reviewed by Filip Pizlo.
+
+        Made CodeCache::getGlobalCodeBlock and CodeCache::getFunctionExecutableFromGlobalCode re-entrant
+        by not keeping AddResult while invoking BytecodeGenerator::generate.
+
+        This is needed to support Miranda functions since they need to be lazily initialized.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC::CodeCacheMap::findCacheAndUpdateAge): Extracted from add.
+        (JSC::CodeCacheMap::addCache): Extracted from add.
+        (JSC::CodeCacheMap::add): Deleted.
+
+2015-03-13  Mark Lam  <mark.lam@apple.com>
+
+        Introduce WTF::Atomic to wrap std::atomic for a friendlier CAS.
+        <https://webkit.org/b/142661>
+
+        Reviewed by Filip Pizlo.
+
+        Changed CodeBlock, and the DFG's crashLock to use WTF::Atomic instead of
+        std::atomic.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGCommon.cpp:
+        (JSC::DFG::startCrashing):
+
+2015-03-12  Mark Lam  <mark.lam@apple.com>
+
+        Change the DFG crashLock to use std::atomic.
+        <https://webkit.org/b/142649>
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGCommon.cpp:
+        (JSC::DFG::startCrashing):
+        (JSC::DFG::isCrashing):
+
+2015-03-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Bytecode liveness analysis should have more lambdas and fewer sets
+        https://bugs.webkit.org/show_bug.cgi?id=142647
+
+        Reviewed by Mark Lam.
+        
+        In bug 141174 I'll need to identify all of the bytecode kill sites. This requires hooking into
+        the bytecode analysis' stepOverFunction method, except in such a way that we observe uses that
+        are not in outs. This refactors stepOverFunction so that you can pass it use/def functors that
+        can either be used to propagate outs (as we do right now) or to additionally detect kills or
+        whatever else.
+        
+        In order to achieve this, the liveness analysis was moved off of maintaining uses/defs
+        bitvectors. This wasn't helping the abstraction and was probably inefficient. The new code
+        should be a bit faster since we don't have to clear uses/defs bitvectors on each instruction. On
+        the other hand, being able to intercept each use means that our code for exception handlers is
+        no longer a bitwise-merge; it requires finding set bits. Fortunately, this code only kicks in
+        for instructions inside a try, and its performance is O(live at catch), so that's probably not
+        bad.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::indexForOperand):
+        (JSC::stepOverInstruction):
+        (JSC::computeLocalLivenessForBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
+        (JSC::setForOperand): Deleted.
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+
+2015-03-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        "this" should be in TDZ until super is called in the constructor of a derived class
+        https://bugs.webkit.org/show_bug.cgi?id=142527
+
+        Reviewed by Mark Hahnenberg.
+
+        DFG and FTL implementations co-authored by Filip Pizlo.
+
+        In ES6 class syntax, "this" register must be in the "temporal dead zone" (TDZ) and throw ReferenceError until
+        super() is called inside the constructor of a derived class.
+
+        Added op_check_tdz, a new OP code, which throws a reference error when the first operand is an empty value
+        to all tiers of JIT and LLint. The op code throws in the slow path on the basis that a TDZ error should be
+        a programming error and not a part of the programs' normal control flow. In DFG, this op code is represented
+        by a no-op must-generate node CheckNotEmpty modeled after CheckCell.
+
+        Also made the constructor of a derived class assign the empty value to "this" register rather than undefined
+        so that ThisNode can emit the op_check_tdz to check the initialized-ness of "this" in such a constructor.
+
+        * bytecode/BytecodeList.json: Added op_check_tdz.
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset): Ditto.
+        (JSC::computeDefsForBytecodeOffset): Ditto.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Ditto.
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString): Added TDZFailure.
+        * bytecode/ExitKind.h: Ditto.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Assign the empty value to "this" register to indicate it's in TDZ.
+        (JSC::BytecodeGenerator::emitTDZCheck): Added.
+        (JSC::BytecodeGenerator::emitReturn): Emit the TDZ check since "this" can still be in TDZ if super() was never
+        called. e.g. class B extends A { constructor() { } }
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode): Always emit the TDZ check if we're inside the constructor of a derived class.
+        We can't omit this check even if the result was ignored per spec.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Previously, empty value could never appear
+        in a local variable. This is no longer true so generalize this code. Also added the support for CheckNotEmpty.
+        Like CheckCell, we phantomize this DFG node in the constant folding phase if the type of the operand is already
+        found to be not empty. Otherwise filter out SpecEmpty.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Added op_check_tdz.
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel): op_check_tdz can be compiled and inlined.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): CheckNotEmpty doesn't read or write values.
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants): Convert CheckNotEmpty to a phantom if non-emptiness had already
+        been proven for the operand prior to this node.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC): CheckNotEmpty does not trigger GC.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): CheckNotEmpty is a no-op in the fixup phase.
+        * dfg/DFGNodeType.h: CheckNotEmpty cannot be removed even if the result was ignored. See ThisNode::emitBytecode.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate): CheckNotEmpty doesn't return any value.
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute): CheckNotEmpty doesn't load from heap so it's safe.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Speculative the operand to be not empty. OSR exit if the speculation fails.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Ditto.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile): CheckNotEmpty can be compiled in FTL.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode): Calls compileCheckNotEmpty for CheckNotEmpty.
+        (JSC::FTL::LowerDFGToLLVM::compileCheckNotEmpty): OSR exit with "TDZFailure" if the operand is not empty.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Added op_check_tdz.
+        (JSC::JIT::privateCompileSlowCases): Ditto.
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_check_tdz): Implements op_check_tdz in Baseline JIT.
+        (JSC::JIT::emitSlow_op_check_tdz): Ditto.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_check_tdz): Ditto.
+        (JSC::JIT::emitSlow_op_check_tdz): Ditto.
+        * llint/LowLevelInterpreter32_64.asm: Implements op_check_tdz in LLint.
+        * llint/LowLevelInterpreter64.asm: Ditto.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL): Throws a reference error for op_check_tdz. Shared by LLint and Baseline JIT.
+        * runtime/CommonSlowPaths.h:
+        * tests/stress/class-syntax-no-loop-tdz.js: Added.
+        * tests/stress/class-syntax-no-tdz-in-catch.js: Added.
+        * tests/stress/class-syntax-no-tdz-in-conditional.js: Added.
+        * tests/stress/class-syntax-no-tdz-in-loop-no-inline-super.js: Added.
+        * tests/stress/class-syntax-no-tdz-in-loop.js: Added.
+        * tests/stress/class-syntax-no-tdz.js: Added.
+        * tests/stress/class-syntax-tdz-in-catch.js: Added.
+        * tests/stress/class-syntax-tdz-in-conditional.js: Added.
+        * tests/stress/class-syntax-tdz-in-loop.js: Added.
+        * tests/stress/class-syntax-tdz.js: Added.
+
+2015-03-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Integrate MapData into JSMap and JSSet
+        https://bugs.webkit.org/show_bug.cgi?id=142556
+
+        Reviewed by Filip Pizlo.
+
+        This patch integrates MapData into JSMap and JSSet.
+        This removes 2 object allocation per one JSMap / JSSet.
+
+        MapDataImpl is specialized into MapData and SetData.
+        In the case of SetData, it does not have the dummy values
+        previously stored in the MapDataImpl. So the storage size of SetData
+        becomes the half of the previous implementation.
+
+        And now MapData and SetData are completely integrated into JSMap and JSSet,
+        these structures are not exposed to the other code even in WebCore world.
+
+        And at the same time, this patch fixes missing destroy functions
+        in JSMapIterator and JSSetIterator.
+        They are needed because MapData::const_iterator is a non-trivial destructor.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSMap.cpp:
+        (JSC::JSMap::destroy):
+        (JSC::JSMap::visitChildren):
+        (JSC::JSMap::copyBackingStore):
+        (JSC::JSMap::has):
+        (JSC::JSMap::size):
+        (JSC::JSMap::get):
+        (JSC::JSMap::set):
+        (JSC::JSMap::clear):
+        (JSC::JSMap::remove):
+        (JSC::JSMap::finishCreation): Deleted.
+        * runtime/JSMap.h:
+        (JSC::JSMap::Entry::key):
+        (JSC::JSMap::Entry::value):
+        (JSC::JSMap::Entry::visitChildren):
+        (JSC::JSMap::Entry::setKey):
+        (JSC::JSMap::Entry::setKeyWithoutWriteBarrier):
+        (JSC::JSMap::Entry::setValue):
+        (JSC::JSMap::Entry::clear):
+        (JSC::JSMap::begin):
+        (JSC::JSMap::end):
+        (JSC::JSMap::JSMap):
+        (JSC::JSMap::mapData): Deleted.
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::finishCreation):
+        (JSC::JSMapIterator::destroy):
+        (JSC::JSMapIterator::visitChildren):
+        * runtime/JSMapIterator.h:
+        (JSC::JSMapIterator::JSMapIterator):
+        * runtime/JSSet.cpp:
+        (JSC::JSSet::destroy):
+        (JSC::JSSet::visitChildren):
+        (JSC::JSSet::copyBackingStore):
+        (JSC::JSSet::has):
+        (JSC::JSSet::size):
+        (JSC::JSSet::add):
+        (JSC::JSSet::clear):
+        (JSC::JSSet::remove):
+        (JSC::JSSet::finishCreation): Deleted.
+        * runtime/JSSet.h:
+        (JSC::JSSet::Entry::key):
+        (JSC::JSSet::Entry::value):
+        (JSC::JSSet::Entry::visitChildren):
+        (JSC::JSSet::Entry::setKey):
+        (JSC::JSSet::Entry::setKeyWithoutWriteBarrier):
+        (JSC::JSSet::Entry::setValue):
+        (JSC::JSSet::Entry::clear):
+        (JSC::JSSet::begin):
+        (JSC::JSSet::end):
+        (JSC::JSSet::JSSet):
+        (JSC::JSSet::mapData): Deleted.
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::finishCreation):
+        (JSC::JSSetIterator::visitChildren):
+        (JSC::JSSetIterator::destroy):
+        * runtime/JSSetIterator.h:
+        (JSC::JSSetIterator::JSSetIterator):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MapData.h:
+        (JSC::MapDataImpl::const_iterator::key):
+        (JSC::MapDataImpl::const_iterator::value):
+        (JSC::MapDataImpl::size):
+        (JSC::MapDataImpl<Entry>::MapDataImpl):
+        (JSC::MapDataImpl<Entry>::clear):
+        (JSC::MapDataImpl<Entry>::KeyType::KeyType):
+        (JSC::MapDataImpl<Entry>::const_iterator::internalIncrement):
+        (JSC::MapDataImpl<Entry>::const_iterator::ensureSlot):
+        (JSC::MapDataImpl<Entry>::const_iterator::const_iterator):
+        (JSC::MapDataImpl<Entry>::const_iterator::~const_iterator):
+        (JSC::MapDataImpl<Entry>::const_iterator::operator):
+        (JSC::=):
+        (JSC::MapData::const_iterator::key): Deleted.
+        (JSC::MapData::const_iterator::value): Deleted.
+        (JSC::MapData::create): Deleted.
+        (JSC::MapData::createStructure): Deleted.
+        (JSC::MapData::size): Deleted.
+        (JSC::MapData::clear): Deleted.
+        (JSC::MapData::KeyType::KeyType): Deleted.
+        (JSC::MapData::const_iterator::internalIncrement): Deleted.
+        (JSC::MapData::const_iterator::ensureSlot): Deleted.
+        (JSC::MapData::const_iterator::const_iterator): Deleted.
+        (JSC::MapData::const_iterator::~const_iterator): Deleted.
+        (JSC::MapData::const_iterator::operator*): Deleted.
+        (JSC::MapData::const_iterator::end): Deleted.
+        (JSC::MapData::const_iterator::operator!=): Deleted.
+        (JSC::MapData::const_iterator::operator==): Deleted.
+        * runtime/MapDataInlines.h: Renamed from Source/JavaScriptCore/runtime/MapData.cpp.
+        (JSC::MapDataImpl<Entry>::find):
+        (JSC::MapDataImpl<Entry>::contains):
+        (JSC::MapDataImpl<Entry>::add):
+        (JSC::MapDataImpl<Entry>::set):
+        (JSC::MapDataImpl<Entry>::get):
+        (JSC::MapDataImpl<Entry>::remove):
+        (JSC::MapDataImpl<Entry>::replaceAndPackBackingStore):
+        (JSC::MapDataImpl<Entry>::replaceBackingStore):
+        (JSC::MapDataImpl<Entry>::ensureSpaceForAppend):
+        (JSC::MapDataImpl<Entry>::visitChildren):
+        (JSC::MapDataImpl<Entry>::copyBackingStore):
+        * runtime/MapPrototype.cpp:
+        (JSC::getMap):
+        (JSC::mapProtoFuncClear):
+        (JSC::mapProtoFuncDelete):
+        (JSC::mapProtoFuncForEach):
+        (JSC::mapProtoFuncGet):
+        (JSC::mapProtoFuncHas):
+        (JSC::mapProtoFuncSet):
+        (JSC::mapProtoFuncSize):
+        (JSC::getMapData): Deleted.
+        * runtime/SetPrototype.cpp:
+        (JSC::getSet):
+        (JSC::setProtoFuncAdd):
+        (JSC::setProtoFuncClear):
+        (JSC::setProtoFuncDelete):
+        (JSC::setProtoFuncForEach):
+        (JSC::setProtoFuncHas):
+        (JSC::setProtoFuncSize):
+        (JSC::getMapData): Deleted.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2015-03-12  Mark Lam  <mark.lam@apple.com>
+
+        Use std::atomic for CodeBlock::m_visitAggregateHasBeenCalled.
+        <https://webkit.org/b/142640>
+
+        Reviewed by Mark Hahnenberg.
+
+        We used to spin our own compare and swap on a uint8_t.  Now that we can
+        use C++11, let's use std::atomic instead.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitAggregate):
+        - The CAS here needs std::memory_order_acquire ordering because it
+          requires lock acquisition semantics to visit the CodeBlock.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlockSet::mark):
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::clearMarksForFullCollection):
+        (JSC::CodeBlockSet::clearMarksForEdenCollection):
+        - These can go with relaxed ordering because they are all done before
+          the GC starts parallel marking.
+
+2015-03-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Fix the incremental build issue revealed by r181419
+        https://bugs.webkit.org/show_bug.cgi?id=142613
+
+        Reviewed by Carlos Garcia Campos.
+
+        * CMakeLists.txt:
+
+2015-03-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        "static" should not be a reserved keyword in non-strict mode even when ES6 class is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=142600
+
+        Reviewed by Mark Lam.
+
+        Make "static" RESERVED_IF_STRICT and manually detect it in parseClass.
+
+        No new tests. This is already checked by js/reserved-words.html and js/keywords-and-reserved_words.html
+
+        * parser/Keywords.table:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        * parser/ParserTokens.h:
+
+2015-03-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Many users of Heap::reportExtraMemory* are wrong, causing lots of memory growth
+        https://bugs.webkit.org/show_bug.cgi?id=142593
+
+        Reviewed by Andreas Kling.
+
+        Adopt deprecatedReportExtraMemory as a short-term fix for runaway
+        memory growth in these cases where we have not adopted
+        reportExtraMemoryVisited.
+
+        Long-term, we should use reportExtraMemoryAllocated+reportExtraMemoryVisited.
+        That's tracked by https://bugs.webkit.org/show_bug.cgi?id=142595.
+
+        * API/JSBase.cpp:
+        (JSReportExtraMemoryCost):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::add):
+
+2015-03-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored the JSC::Heap extra cost API for clarity and to make some known bugs more obvious
+        https://bugs.webkit.org/show_bug.cgi?id=142589
+
+        Reviewed by Andreas Kling.
+
+        * API/JSBase.cpp:
+        (JSReportExtraMemoryCost): Added a FIXME to annotate a known bug.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::visitAggregate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode): Updated for rename.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::reportExtraMemoryAllocatedSlowCase):
+        (JSC::Heap::deprecatedReportExtraMemorySlowCase): Renamed our reporting
+        APIs to clarify their relationship to each other: One must report extra
+        memory at the time of allocation, and at the time the GC visits it.
+
+        (JSC::Heap::extraMemorySize):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::sizeAfterCollect):
+        (JSC::Heap::willStartCollection): Updated for renames. Added explicit
+        API for deprecated users who can't use our best API.
+ 
+        (JSC::Heap::reportExtraMemoryCostSlowCase): Deleted.
+        (JSC::Heap::extraSize): Deleted.
+
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::reportExtraMemoryAllocated):
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::deprecatedReportExtraMemory):
+        (JSC::Heap::reportExtraMemoryCost): Deleted. Ditto.
+
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExtraMemoryVisited):
+        (JSC::SlotVisitor::reportExtraMemoryUsage): Deleted. Moved this
+        functionality into the Heap since it's pretty detailed in its access
+        to the heap.
+
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren): Updated for
+        renames.
+
+        * runtime/JSString.cpp:
+        (JSC::JSString::visitChildren):
+        (JSC::JSRopeString::resolveRopeToAtomicString):
+        (JSC::JSRopeString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::JSString::finishCreation): Updated for renames.
+
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::add): Added FIXME.
+
+        * runtime/WeakMapData.cpp:
+        (JSC::WeakMapData::visitChildren): Updated for rename.
+
+2015-03-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Calling super() in a base class results in a crash
+        https://bugs.webkit.org/show_bug.cgi?id=142563
+
+        Reviewed by Filip Pizlo.
+
+        The bug was caused by BytecodeGenerator trying to generate "super" expression inside the constructor of a base class.
+        Disallow that by keeping track of whether "super" has been used in the current scope or not (needsSuperBinding flag)
+        and then throwing a syntax error in parseFunctionInfo if it was used and the current scope wasn't the constructor of
+        a derived class.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo): Don't allow super() or super.foo outside the constructor of a derived class.
+        (JSC::Parser<LexerType>::parseClass): Pass in the constructor kind to parseGetterSetter.
+        (JSC::Parser<LexerType>::parseGetterSetter): Ditto to parseFunctionInfo.
+        (JSC::Parser<LexerType>::parseMemberExpression): Set needsSuperBinding flag true on the containing scope.
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::needsSuperBinding): Added.
+        (JSC::Scope::setNeedsSuperBinding): Added.
+
+2015-03-10  Darin Adler  <darin@apple.com>
+
+        Some event handler fixes
+        https://bugs.webkit.org/show_bug.cgi?id=142474
+
+        Reviewed by Anders Carlsson.
+
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::createInjectedScript): Call clearException.
+        I spotted the fact it was missing by auditing all the calls to JSC::call.
+
+2015-03-10  Matthew Mirman  <mmirman@apple.com>
+
+        Functions should have initialization precedence over arguments. 
+        https://bugs.webkit.org/show_bug.cgi?id=142550
+        rdar://problem/19702564
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeCapturedVariable):
+        * tests/stress/initialize_functions_after_arguments.js: Added.
+
+2015-03-10  Andreas Kling  <akling@apple.com>
+
+        Eden collections should trigger sweep of MarkedBlocks containing new objects.
+        <https://webkit.org/b/142538>
+
+        Reviewed by Geoffrey Garen.
+
+        Take a snapshot of all MarkedBlocks with new objects as part of Eden collections,
+        and append that to the IncrementalSweeper's working set.
+
+        This ensures that we run destructors for objects that were discovered to be garbage during
+        Eden collections, instead of delaying their teardown until the next full collection,
+        or the next allocation cycle for their block.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::snapshotMarkedSpace): For Eden collections, snapshot the list of MarkedBlocks
+        that contain new objects, since those are the only ones we're interested in.
+        Also use Vector::resizeToFit() to allocate the snapshot for full collections, since we know
+        the final size we need up front.
+
+        (JSC::Heap::notifyIncrementalSweeper): For Eden collections, tell the IncrementalSweeper
+        to add the block snapshot (taken earlier) to its existing set of blocks instead of replacing
+        it entirely. This allows Eden collections and incremental sweeping to occur interleaved with
+        each other without missing destruction opportunities.
+
+        * heap/IncrementalSweeper.h:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doSweep):
+        (JSC::IncrementalSweeper::sweepNextBlock): Change the way we iterate over the sweeper's
+        work list: instead of keeping an index for the next block, just pop from the end of the list.
+        This allows us to add new blocks and deduplicate the list without disturbing iteration.
+
+        (JSC::IncrementalSweeper::startSweeping): Make this take a Vector<MarkedBlock>&& so we can
+        pass ownership of this Vector efficiently from Heap to IncrementalSweeper.
+
+        (JSC::IncrementalSweeper::addBlocksAndContinueSweeping): Added. This is used by Eden
+        collections to add a set of MarkedBlocks with new objects to the sweeper's existing
+        working set and kick the timer.
+
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::blocksWithNewObjects): Expose the list of MarkedBlocks with new objects.
+
+2015-03-10  Alex Christensen  <achristensen@webkit.org>
+
+        Use unsigned for HashSet size.
+        https://bugs.webkit.org/show_bug.cgi?id=142518
+
+        Reviewed by Benjamin Poulain.
+
+        * dfg/DFGAvailabilityMap.cpp:
+        (JSC::DFG::AvailabilityMap::prune):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * heap/MarkedBlockSet.h:
+        (JSC::MarkedBlockSet::remove):
+        * runtime/WeakMapData.h:
+
+2015-03-10  Mark Lam  <mark.lam@apple.com>
+
+        Use std::numeric_limits<unsigned>::max() instead of (unsigned)-1.
+        <https://webkit.org/b/142539>
+
+        Reviewed by Benjamin Poulain.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        (JSC::JIT::emitGetVirtualRegister):
+        * jit/SlowPathCall.h:
+        (JSC::JITSlowPathCall::call):
+        * yarr/Yarr.h:
+
+2015-03-10  Mark Lam  <mark.lam@apple.com>
+
+        [Win] JSC Build Warnings Need to be Resolved.
+        <https://webkit.org/b/142366>
+
+        Reviewed by Brent Fulgham.
+
+        Applied some benign changes to make the MSVC compiler happy.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        * runtime/BasicBlockLocation.cpp:
+        (JSC::BasicBlockLocation::getExecutedRanges):
+        * runtime/ControlFlowProfiler.cpp:
+        (JSC::ControlFlowProfiler::hasBasicBlockAtTextOffsetBeenExecuted):
+
+2015-03-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Upgrade Map, Set and WeakMap constructor interface
+        https://bugs.webkit.org/show_bug.cgi?id=142348
+
+        Reviewed by Filip Pizlo.
+
+        In the latest ES6 spec, Map and Set constructors take initialization data sets
+        as iterable value. And iterate it and add the values into the constructed one.
+
+        This is breaking change because the old constructor interface is
+        already shipped in Safari 8.
+
+        * runtime/MapConstructor.cpp:
+        (JSC::callMap):
+        (JSC::constructMap):
+        (JSC::MapConstructor::getCallData):
+        * runtime/SetConstructor.cpp:
+        (JSC::callSet):
+        (JSC::constructSet):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::callWeakMap):
+        (JSC::constructWeakMap):
+        (JSC::WeakMapConstructor::getCallData):
+        * tests/stress/map-constructor-adder.js: Added.
+        * tests/stress/map-constructor.js: Added.
+        (testCallTypeError):
+        (testTypeError):
+        (for):
+        * tests/stress/set-constructor-adder.js: Added.
+        (Set.prototype.add):
+        * tests/stress/set-constructor.js: Added.
+        (for):
+        * tests/stress/weak-map-constructor-adder.js: Added.
+        * tests/stress/weak-map-constructor.js: Added.
+        (testCallTypeError):
+        (testTypeError):
+        (for):
+
+2015-03-10  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        GCC: CRASH() should be annotated with NORETURN
+        https://bugs.webkit.org/show_bug.cgi?id=142524
+
+        Reviewed by Anders Carlsson.
+
+        Don't return from a NORETURN function. This used to avoid a warning from GCC, but now it
+        causes one.
+
+        * jsc.cpp:
+
+2015-03-10  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix bleeding debug test bots.
+        https://webkit.org/b/142513>
+
+        Not reviewed.
+
+        The test needs to initialize WTF threading explicitly before using it.
+
+        * API/tests/CompareAndSwapTest.cpp:
+        (testCompareAndSwap):
+
+2015-03-10  Alex Christensen  <achristensen@webkit.org>
+
+        [WinCairo] Unreviewed build fix.
+
+        * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props:
+        Added directory containing config.h, like r181304.
+
+2015-03-09  Mark Lam  <mark.lam@apple.com>
+
+        Yet another build fix for Windows.
+        https://webkit.org/b/142513>
+
+        Reviewed by Alex Christensen.
+
+        Looks like MSVC requires the function be explicitly declared in a header file
+        in order for it to be linkable from another file in the same project.  This is
+        strange, but it seems to make MSVC happy.
+
+        Also fixed a typo in testapi.vcxproj.filters.
+
+        * API/tests/CompareAndSwapTest.cpp:
+        * API/tests/CompareAndSwapTest.h: Added.
+        * API/tests/testapi.c:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-03-09  Chris Dumez  <cdumez@apple.com>
+
+        [iOS] Sweep all collected objects on critical memory pressure
+        https://bugs.webkit.org/show_bug.cgi?id=142457
+        <rdar://problem/20044440>
+
+        Reviewed by Geoffrey Garen.
+
+        All fullSweep() API to IncrementalSweeper so that we can call it in the
+        memory pressure handler.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::fullSweep):
+        * heap/IncrementalSweeper.h:
+        (JSC::IncrementalSweeper::hasWork):
+
+2015-03-09  Mark Lam  <mark.lam@apple.com>
+
+        Another build fix for Windows.
+        https://webkit.org/b/142513>
+
+        Not reviewed.
+
+        * API/tests/CompareAndSwapTest.cpp:
+        - Added JS_EXPORT_PRIVATE attribute.
+
+2015-03-09  Mark Lam  <mark.lam@apple.com>
+
+        Build fix for Windows after r181305.
+        https://webkit.org/b/142513>
+
+        Reviewed by Alex Christensen.
+
+        Windows doesn't like pthreads anymore.  Changed test to use WTF threading.
+
+        * API/tests/CompareAndSwapTest.cpp:
+        (setBitThreadFunc):
+        (testCompareAndSwap):
+
+2015-03-09  Mark Lam  <mark.lam@apple.com>
+
+        8-bit version of weakCompareAndSwap() can cause an infinite loop.
+        https://webkit.org/b/142513>
+
+        Reviewed by Filip Pizlo.
+
+        Added a test that exercises the 8-bit CAS from multiple threads.  The threads
+        will contend to set bits in a large array of bytes using the CAS function.
+
+        * API/tests/CompareAndSwapTest.cpp: Added.
+        (Bitmap::Bitmap):
+        (Bitmap::numBits):
+        (Bitmap::clearAll):
+        (Bitmap::concurrentTestAndSet):
+        (setBitThreadFunc):
+        (testCompareAndSwap):
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-03-09  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] testapi project is unable to find the 'config.h' file.
+
+        Rubberstamped by Mark Lam.
+
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props: Add JavaScriptCore source directory
+        to the include path.
+
+2015-03-09  Andreas Kling  <akling@apple.com>
+
+        Stale entries in WeakGCMaps are keeping tons of WeakBlocks alive unnecessarily.
+        <https://webkit.org/b/142115>
+        <rdar://problem/19992268>
+
+        Reviewed by Geoffrey Garen.
+
+        Prune stale entries from WeakGCMaps as part of every full garbage collection.
+        This frees up tons of previously-stuck WeakBlocks that were only sitting around
+        with finalized handles waiting to die.
+
+        Note that WeakGCMaps register/unregister themselves with the GC heap in their
+        ctor/dtor, so creating one now requires passing the VM.
+
+        Average time spent in the PruningStaleEntriesFromWeakGCMaps GC phase appears
+        to be between 0.01ms and 0.3ms, though I've seen a few longer ones at ~1.2ms.
+        It seems somewhat excessive to do this on every Eden collection, so it's only
+        doing work in full collections for now.
+
+        Because the GC may now mutate WeakGCMap below object allocation, I've made it
+        so that the classic HashMap::add() optimization can't be used with WeakGCMap.
+        This caused intermittent test failures when originally landed due to having
+        an invalid iterator on the stack after add() inserted a new entry and we
+        proceeded to allocate the new object, triggering GC.
+
+        * API/JSWeakObjectMapRefInternal.h:
+        (OpaqueJSWeakObjectMap::create):
+        (OpaqueJSWeakObjectMap::OpaqueJSWeakObjectMap):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JSWrapperMap.mm:
+        (-[JSWrapperMap initWithContext:]):
+        (-[JSWrapperMap jsWrapperForObject:]): Pass VM to WeakGCMap constructor.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add WeakGCMapInlines.h and make
+        it project-private so WebCore clients can access it.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        (JSC::Heap::pruneStaleEntriesFromWeakGCMaps): Added a new GC phase for pruning
+        stale entries from WeakGCMaps. This is only executed during full collections.
+
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::registerWeakGCMap):
+        (JSC::Heap::unregisterWeakGCMap): Added a mechanism for WeakGCMaps to register
+        themselves with the Heap and provide a pruning callback.
+
+        * runtime/PrototypeMap.h:
+        (JSC::PrototypeMap::PrototypeMap):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::add): Pass VM to WeakGCMap constructor.
+
+        * runtime/JSCInlines.h: Add "WeakGCMapInlines.h"
+
+        * runtime/JSGlobalObject.cpp: Include "WeakGCMapInlines.h" so this builds.
+
+        * runtime/JSString.cpp:
+        (JSC::jsStringWithCacheSlowCase):
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::addPrototype):
+        (JSC::PrototypeMap::emptyObjectStructureForPrototype): Remove HashMap add()
+        optimization since it's not safe in the GC-managed WeakGCMap world.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Pass VM to WeakGCMap constructor.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::WeakGCMap): Deleted.
+        (JSC::WeakGCMap::gcMap): Deleted.
+        (JSC::WeakGCMap::gcMapIfNeeded): Deleted.
+        * runtime/WeakGCMapInlines.h: Added.
+        (JSC::WeakGCMap::WeakGCMap):
+        (JSC::WeakGCMap::~WeakGCMap):
+        (JSC::WeakGCMap::pruneStaleEntries): Moved ctor, dtor and pruning callback
+        to WeakGCMapInlines.h to fix interdependent header issues. Removed code that
+        prunes WeakGCMap at certain growth milestones and instead rely on the GC
+        callback for housekeeping.
+
+2015-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Support extends and super keywords
+        https://bugs.webkit.org/show_bug.cgi?id=142200
+
+        Reviewed by Filip Pizlo.
+
+        Added the support for ES6 class syntax inheritance.
+
+        Added ConstructorKind as well as boolean flags indicating the constructor kind to
+        various classes in UnlinkedCodeBlock as well as AST nodes.
+
+        Each method stores the associated class as its homeObjectPrivateName. This value is used to
+        make super calls.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::UnlinkedFunctionExecutable::constructorKindIsDerived): Added.
+        (JSC::UnlinkedCodeBlock::constructorKindIsDerived): Added.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Don't emit op_create_this in a derived class
+        as the object is allocated by the highest base class's constructor. Also set "this" to null
+        and store the original value in m_newTargetRegister. "this" is supposed to be in TDZ but
+        that will be implemented in a separate patch.
+        (JSC::BytecodeGenerator::emitReturn): Allow "undefined" to be returned from a derived class.
+        In a derived class's constructor, not returning "undefined" or an object results in a type
+        error instead of "this" being returned.
+        (JSC::BytecodeGenerator::emitThrowTypeError): Added.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::constructorKindIsDerived): Added.
+        (JSC::BytecodeGenerator::newTarget): Added.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::SuperNode::emitBytecode): Added. Emits the code to obtain the callee's parent class.
+        (JSC::emitSuperBaseForCallee): Added. Emits the code to obtain the parent class's prototype.
+        (JSC::emitPutHomeObject): Added.
+        (JSC::PropertyListNode::emitBytecode): Stores the home object when adding methods.
+        (JSC::PropertyListNode::emitPutConstantProperty): Ditto.
+        (JSC::BracketAccessorNode::emitBytecode): Added the support for super['foo'].
+        (JSC::DotAccessorNode::emitBytecode): Added the support for super.foo.
+        (JSC::FunctionCallValueNode::emitBytecode): Added the support for super().
+        (JSC::FunctionCallBracketNode::emitBytecode): Added the support for super['foo']().
+        (JSC::FunctionCallDotNode::emitBytecode): Added the support for super.foo().
+        (JSC::DeleteBracketNode::emitBytecode): Forbid "delete super.foo".
+        (JSC::DeleteDotNode::emitBytecode): Forbid "delete super['foo']".
+        (JSC::ClassExprNode::emitBytecode): Added the support for "classHeritage". This is the main
+        logic for inheritance. When a class B inherits from a class A, set B.__proto__ to A and set
+        B.prototype.__proto__ to A.prototype. Throw exceptions when either A or A.__proto__ is not
+        an object.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::superExpr): Added.
+
+        * parser/NodeConstructors.h:
+        (JSC::SuperNode::SuperNode): Added.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isSuperNode):
+        (JSC::PropertyNode::type):
+        (JSC::PropertyNode::needsSuperBinding):
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::Parser<LexerType>::parseFunctionInfo): Throw a parser error if super() is used outside
+        of class constructors.
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass): ConstructorKind is "derived" if and only if the parent
+        class is specified in the declaration / expression.
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression): Added the support for "super()", "super.foo",
+        and "super['foo']". Throw a semantic error if "super" appears by itself.
+
+        * parser/Parser.h:
+        (JSC::Scope::Scope): Added m_hasDirectSuper. This variable keeps track of the use of "super()"
+        so that parseFunctionInfo can spit an error if it's used outside of class constructors.
+        (JSC::Scope::hasDirectSuper): Added.
+        (JSC::Scope::setHasDirectSuper): Added.
+
+        * parser/ParserModes.h:
+        (JSC::ConstructorKind): Added.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::superExpr): Added.
+
+        * runtime/CommonIdentifiers.h: Added homeObjectPrivateName.
+
+        * runtime/Executable.h:
+        (JSC::EvalExecutable::executableInfo): 
+        (JSC::ProgramExecutable::executableInfo):
+
+2015-03-08  Andreas Kling  <akling@apple.com>
+
+        JITThunks keeps finalized Weaks around, pinning WeakBlocks.
+        <https://webkit.org/b/142454>
+
+        Reviewed by Darin Adler.
+
+        Make JITThunks a WeakHandleOwner so it can keep its host function map free of stale entries.
+        This fixes an issue I was seeing where a bunch of WeakBlocks stuck around with nothing but
+        finalized Weak<NativeExecutable> entries.
+
+        * jit/JITThunks.h:
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::finalize): Make JITThunks inherit from WeakHandleOwner so it can receive
+        a callback when the NativeExecutables get garbage collected.
+
+        (JSC::JITThunks::hostFunctionStub): Pass 'this' as the handle owner when creating Weaks.
+
+2015-03-08  Andreas Kling  <akling@apple.com>
+
+        BuiltinExecutables keeps finalized Weaks around, pinning WeakBlocks.
+        <https://webkit.org/b/142460>
+
+        Reviewed by Geoffrey Garen.
+
+        Make BuiltinExecutables a WeakHandleOwner so it can clear out its respective Weak members
+        if and when their pointees get garbage collected.
+
+        This fixes an issue I've seen locally where a WeakBlock is pinned down by a single one of
+        these Weak<BuiltinExecutables>.
+
+        * builtins/BuiltinExecutables.h: Make BuiltinExecutables inherit from WeakHandleOwner.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::finalize): Clear out the relevant member pointer when it's been
+        garbage collected. We use the WeakImpl's "context" field to pass the address of the member.
+
+2015-03-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-landing just the removal of BlockAllocator, which is now unused.
+
+        * API/JSBase.cpp:
+        * CMakeLists.txt:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/BlockAllocator.cpp: Removed.
+        * heap/BlockAllocator.h: Removed.
+        * heap/GCThreadSharedData.h:
+        * heap/HandleBlockInlines.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::blockAllocator): Deleted.
+        * heap/HeapTimer.cpp:
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.h:
+        * heap/Region.h: Removed.
+        * heap/SuperRegion.cpp: Removed.
+        * heap/SuperRegion.h: Removed.
+
+2015-03-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r181010.
+        https://bugs.webkit.org/show_bug.cgi?id=142442
+
+        Broke media/video-src-invalid-poster.html (Requested by kling
+        on #webkit).
+
+        Reverted changeset:
+
+        "Stale entries in WeakGCMaps are keeping tons of WeakBlocks
+        alive unnecessarily."
+        https://bugs.webkit.org/show_bug.cgi?id=142115
+        http://trac.webkit.org/changeset/181010
+
+2015-03-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        The code to link FunctionExecutable is duplicated everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=142436
+
+        Reviewed by Darin Adler.
+
+        Reduced code duplication by factoring out linkInsideExecutable and linkGlobalCode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Calls linkInsideExecutable.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::linkInsideExecutable): Renamed from link. Now takes care of startOffset.
+        This change was needed to use this function in CodeBlock::CodeBlock. Also, this function no longer takes
+        lineOffset since this information is already stored in the source code.
+        (JSC::UnlinkedFunctionExecutable::linkGlobalCode): Extracted from FunctionExecutable::fromGlobalCode.
+
+        * bytecode/UnlinkedCodeBlock.h:
+
+        * generate-js-builtins: Calls linkGlobalCode.
+
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties): Calls linkGlobalCode.
+        (JSC::FunctionExecutable::fromGlobalCode): Calls linkGlobalCode.
+
+2015-03-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-landing just the MarkedBlock piece of this patch.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::capacity):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+
+2015-03-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        fromGlobalCode has an unused Debugger* argument
+        https://bugs.webkit.org/show_bug.cgi?id=142430
+
+        Reviewed by Darin Adler.
+
+        Removed the debugger argument from UnlinkedFunctionExecutable::fromGlobalCode and
+        FunctionExecutable::fromGlobalCode since it's not used in either function.
+
+        Also use reference in other arguments.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        * bytecode/UnlinkedCodeBlock.h:
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+
+2015-03-06  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Turn off a warning on Windows.
+
+        Reduce build logging noise on Windows.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
+
+2015-03-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ES6: Improved Support for Iterator Objects
+        https://bugs.webkit.org/show_bug.cgi?id=142420
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Runtime.json:
+        Add new object subtype "iterator" for built-in iterator objects.
+
+        * inspector/InjectedScriptSource.js:
+        Return iterator values as Entry objects.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        Identify "iterator" typed objects.
+
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        Provide internal properties for the different Iterator objects.
+
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        Fetch the next few iterator entries of a built-in iterator object.
+
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionIteratorEntries):
+        Call through to JSInjectedScriptHost.
+
+        * runtime/JSArgumentsIterator.cpp:
+        (JSC::JSArgumentsIterator::clone):
+        * runtime/JSArgumentsIterator.h:
+        (JSC::JSArgumentsIterator::iteratedValue):
+        * runtime/JSArrayIterator.cpp:
+        (JSC::JSArrayIterator::kind):
+        (JSC::JSArrayIterator::iteratedValue):
+        (JSC::JSArrayIterator::clone):
+        * runtime/JSArrayIterator.h:
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::finishCreation):
+        (JSC::JSMapIterator::clone):
+        * runtime/JSMapIterator.h:
+        (JSC::JSMapIterator::kind):
+        (JSC::JSMapIterator::iteratedValue):
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::finishCreation):
+        (JSC::JSSetIterator::clone):
+        * runtime/JSSetIterator.h:
+        (JSC::JSSetIterator::kind):
+        (JSC::JSSetIterator::iteratedValue):
+        * runtime/JSStringIterator.cpp:
+        (JSC::JSStringIterator::iteratedValue):
+        (JSC::JSStringIterator::clone):
+        * runtime/JSStringIterator.h:
+        Add accessors for internal properties and provide a way to clone the
+        iterator so we can be at the same index and peek at the next few
+        objects without modifying the original iterator object.
+
+2015-03-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r180595): construct varargs fails in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=142030
+
+        Reviewed by Michael Saboff.
+
+        Increase sizeOfCallVarargs as done for sizeOfConstructVarargs in r180651.
+
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfCallVarargs):
+
+2015-03-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Adopt Object Literal Shorthand Property Construction Syntax
+        https://bugs.webkit.org/show_bug.cgi?id=142374
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+
+2015-03-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6: Object Literal Extensions - Methods
+        https://bugs.webkit.org/show_bug.cgi?id=142390
+
+        Reviewed by Geoffrey Garen.
+
+        Support method syntax in object literals.
+
+        * parser/Parser.h:
+        * parser/Parser.cpp:
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseProperty):
+        Methods are allowed for identifier, string, and numeric names,
+        and computed property names.
+
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        Helper for parsing a property method.
+
+2015-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        __proto__ shorthand property should not modify prototype in Object Literal construction
+        https://bugs.webkit.org/show_bug.cgi?id=142382
+
+        Reviewed by Geoffrey Garen.
+
+        When parsing shorthand property syntax we know we will do a
+        put direct, even if the property name is __proto__. Pass that
+        information through to bytecode generation.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitPutConstantProperty):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createProperty):
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode):
+        * parser/Nodes.h:
+        (JSC::PropertyNode::putType):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseProperty):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createProperty):
+
+2015-03-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix crashes seen on the the 32-bit buildbots after my last patch.
+
+        Unreviewed.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::payload):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateOversize): Round up to the right alignment,
+        since the size of the CopiedBlock class is not guaranteed to be the
+        right alignment, and is in fact the wrong alignment on 32-bit.
+
+2015-03-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-landing just the CopiedBlock piece of this patch.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::createNoZeroFill):
+        (JSC::CopiedBlock::destroy):
+        (JSC::CopiedBlock::create):
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::isOversize):
+        (JSC::CopiedBlock::payloadEnd):
+        (JSC::CopiedBlock::capacity):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::~CopiedSpace):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::recycleEvacuatedBlock):
+        (JSC::CopiedSpace::recycleBorrowedBlock):
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        (JSC::CopiedSpace::allocateBlock):
+        (JSC::CopiedSpace::startedCopying):
+        * heap/CopyWorkList.h:
+
+2015-03-06  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [iOS] SVG fonts are garbled
+        https://bugs.webkit.org/show_bug.cgi?id=142377
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ES6: Object Literal Extensions - Shorthand Properties (Identifiers)
+        https://bugs.webkit.org/show_bug.cgi?id=142353
+
+        Reviewed by Geoffrey Garen.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseProperty):
+        Parsing an identifier property followed by a comma or end brace treat
+        as a shorthand property and create a property that has the same
+        property name as the identifier name and value of a variable with that
+        identifier. Otherwise, fall through to getter/setter parsing.
+
+2015-03-05  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed gardening.
+
+        Confirmed with JSC that warning 4611 (interaction between '_setjmp' and C++ object
+        destruction is non-portable) should be ignored in the JavaScriptCore project.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props: Silence warning 4611.
+
+2015-03-05  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r173761): ASSERTION FAILED: !is8Bit() in StringImpl::characters16()
+        https://bugs.webkit.org/show_bug.cgi?id=142350
+
+        Reviewed by Michael Saboff and Benjamin Poulain.
+
+        Call WTFString::hasInfixStartingAt() / hasInfixEndingAt() now that these
+        methods have been renamed for clarity.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+
+2015-03-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Implement ES6 StringIterator
+        https://bugs.webkit.org/show_bug.cgi?id=142080
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces ES6 String Iterator.
+        It enumerates code points instead of elements in String.
+        So surrogate pairs should be handled correctly.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/StringIterator.prototype.js: Added.
+        (next):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSStringIterator.cpp: Added.
+        (JSC::JSStringIterator::finishCreation):
+        * runtime/JSStringIterator.h: Added.
+        (JSC::JSStringIterator::createStructure):
+        (JSC::JSStringIterator::create):
+        (JSC::JSStringIterator::JSStringIterator):
+        * runtime/StringIteratorConstructor.cpp: Added.
+        (JSC::StringIteratorConstructor::finishCreation):
+        * runtime/StringIteratorConstructor.h: Added.
+        (JSC::StringIteratorConstructor::create):
+        (JSC::StringIteratorConstructor::createStructure):
+        (JSC::StringIteratorConstructor::StringIteratorConstructor):
+        * runtime/StringIteratorPrototype.cpp: Added.
+        (JSC::StringIteratorPrototype::finishCreation):
+        (JSC::StringIteratorPrototype::getOwnPropertySlot):
+        (JSC::stringIteratorPrototypeIterator):
+        * runtime/StringIteratorPrototype.h: Added.
+        (JSC::StringIteratorPrototype::create):
+        (JSC::StringIteratorPrototype::createStructure):
+        (JSC::StringIteratorPrototype::StringIteratorPrototype):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncIterator):
+        * tests/stress/string-iterators.js: Added.
+        (testSurrogatePair):
+        (increment):
+        (for):
+
+2015-03-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Fix the FTL build on Aarch64 Linux after r177421
+        https://bugs.webkit.org/show_bug.cgi?id=142040
+
+        Reviewed by Mark Lam.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2015-03-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Upgrade ES6 Iterator interfaces
+        https://bugs.webkit.org/show_bug.cgi?id=141351
+
+        Reviewed by Filip Pizlo.
+
+        This patch upgrades the exising ES6 iterator to align the latest spec.
+        In the latest spec,
+        1. `Iterator.next` returns object that implements IteratorResult interface { value: value, done, boolean }.
+        2. `Iterator.return` is introduced. When the iteration is terminated by the abrupt completion,
+        it is called to close iterator state.
+        3. Iterator.next of Array is moved from an iterator object to `%ArrayIteratorPrototype%`.
+
+        To upgrade it, we changes the bytecode that represents for-of loops.
+        And to embody the efficient iteration with an iterator object,
+        we implemented %ArrayIteratorPrototype%.next in JavaScript and
+        it is located in builtins/ArrayIterator.prototype.js.
+        Implementing it in JavaScript encourages inlining and
+        utilizes escape analysis for an iterator result object in DFG JIT.
+        And we dropped the intrinsic version of %ArrayIteratorPrototype%.next.
+
+        And we introduced IteratorOperations that is defined in the spec.
+        It aligns the iteration in the runtime to the latest spec.
+        Currently, Promise.all and Promise.race uses an iterable object.
+        However, Promise.all and Promise.race implementation is also based on the old spec.
+        Subsequent patches will upgrade it.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ArrayIterator.prototype.js: Copied from Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h.
+        (next):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitThrowTypeError):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::emitIsObject):
+        (JSC::BytecodeGenerator::emitIsUndefined):
+        * bytecompiler/BytecodeGenerator.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::arrayIteratorNextThunkGenerator): Deleted.
+        (JSC::arrayIteratorNextKeyThunkGenerator): Deleted.
+        (JSC::arrayIteratorNextValueThunkGenerator): Deleted.
+        * jit/ThunkGenerators.h:
+        * runtime/ArgumentsIteratorPrototype.cpp:
+        (JSC::ArgumentsIteratorPrototype::finishCreation):
+        (JSC::argumentsIteratorPrototypeFuncNext):
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::ArrayIteratorPrototype::getOwnPropertySlot):
+        (JSC::arrayIteratorProtoFuncIterator):
+        (JSC::arrayIteratorPrototypeIterate): Deleted.
+        * runtime/ArrayIteratorPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+        * runtime/IteratorOperations.cpp: Added.
+        (JSC::iteratorNext):
+        (JSC::iteratorValue):
+        (JSC::iteratorComplete):
+        (JSC::iteratorStep):
+        (JSC::iteratorClose):
+        (JSC::createIterResultObject):
+        * runtime/IteratorOperations.h: Copied from Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp.
+        * runtime/JSArrayIterator.cpp:
+        (JSC::JSArrayIterator::finishCreation):
+        (JSC::JSArrayIterator::visitChildren): Deleted.
+        (JSC::createIteratorResult): Deleted.
+        (JSC::arrayIteratorNext): Deleted.
+        (JSC::arrayIteratorNextKey): Deleted.
+        (JSC::arrayIteratorNextValue): Deleted.
+        (JSC::arrayIteratorNextGeneric): Deleted.
+        * runtime/JSArrayIterator.h:
+        (JSC::JSArrayIterator::JSArrayIterator):
+        (JSC::JSArrayIterator::iterationKind): Deleted.
+        (JSC::JSArrayIterator::iteratedObject): Deleted.
+        (JSC::JSArrayIterator::nextIndex): Deleted.
+        (JSC::JSArrayIterator::setNextIndex): Deleted.
+        (JSC::JSArrayIterator::finish): Deleted.
+        (JSC::JSArrayIterator::offsetOfIterationKind): Deleted.
+        (JSC::JSArrayIterator::offsetOfIteratedObject): Deleted.
+        (JSC::JSArrayIterator::offsetOfNextIndex): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::performPromiseRaceLoop):
+        (JSC::JSPromiseConstructorFuncRace):
+        (JSC::performPromiseAll):
+        (JSC::JSPromiseConstructorFuncAll):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototype::finishCreation):
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototype::finishCreation):
+        (JSC::SetIteratorPrototypeFuncNext):
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+        * tests/stress/array-iterators-next-with-call.js: Added.
+        (increment):
+        (for):
+        * tests/stress/array-iterators-next.js: Added.
+
+        Revive the older Array iterator tests that manually call 'next' method.
+
+        * tests/stress/custom-iterators.js: Added.
+        (iter.next):
+        (iter.Symbol.iterator):
+        (iter.return):
+        (iter.get next):
+        (iter.get return):
+        (iteratorInterfaceErrorTest.iter.next):
+        (iteratorInterfaceErrorTest.iter.Symbol.iterator):
+        (iteratorInterfaceErrorTest.iter.return):
+        (iteratorInterfaceErrorTest):
+        (iteratorInterfaceErrorTestReturn.iter.next):
+        (iteratorInterfaceErrorTestReturn.iter.Symbol.iterator):
+        (iteratorInterfaceErrorTestReturn.iter.return):
+        (iteratorInterfaceErrorTestReturn):
+        (iteratorInterfaceBreakTestReturn.iter.next):
+        (iteratorInterfaceBreakTestReturn.iter.Symbol.iterator):
+        (iteratorInterfaceBreakTestReturn.iter.return):
+        (iteratorInterfaceBreakTestReturn):
+
+        This tests the behavior of custom iterators.
+        'next' and 'return' of iterator work with for-of.
+
+        * tests/stress/iterators-shape.js: Added.
+        (iteratorShape):
+        (sameNextMethods):
+        (set var):
+
+        This tests the shape of iterators; iterators of Array have 'next' method in %ArrayIteratorPrototype%.
+
+        * tests/stress/map-iterators-next.js: Added.
+        (set var):
+        (.get if):
+        (otherKey):
+        * tests/stress/set-iterators-next.js: Added.
+        (otherKey):
+
+2015-03-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Hide Promise with runtime flags under Cocoa JSContext API
+        https://bugs.webkit.org/show_bug.cgi?id=141965
+
+        Reviewed by Filip Pizlo.
+
+        Since there's no run loop in JavaScriptCore APIs, Promises don't work currently.
+        So until they work, we hide Promise from a global object.
+        Introduce new JSC runtime flag, PromiseDisabled. When `isPromiseDisabled` is true,
+        Promise constructor is not attached to JSGlobalObject.
+
+        To make 0 as default runtime flags, we choose PromiseDisabled flag
+        instead of PromiseEnabled flag. So by default, Promise is enabled.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::JSCallbackObject):
+        * API/JSContextRef.cpp:
+        (javaScriptRuntimeFlags):
+        (JSGlobalContextCreateInGroup):
+        * API/tests/testapi.c:
+        (main):
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        * runtime/RuntimeFlags.h:
+        (JSC::RuntimeFlags::createAllEnabled):
+
+2015-03-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Array/Collection Sizes should be visible and distinct
+        https://bugs.webkit.org/show_bug.cgi?id=142254
+
+        Reviewed by Timothy Hatcher.
+
+        * runtime/WeakMapData.h:
+        (JSC::WeakMapData::size):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::weakMapSize):
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapSize):
+        Add a way to get a WeakMap's size.
+
+        * inspector/protocol/Runtime.json:
+        Include size in RemoteObject and ObjectPreview.
+
+        * inspector/InjectedScriptSource.js:
+        Set the size of RemoteObjects and previews if they
+        are array/collection types.
+
+2015-03-04  Andreas Kling  <akling@apple.com>
+
+        GC should compute stack bounds and dump registers at the earliest opportunity.
+        <https://webkit.org/b/142310>
+        <rdar://problem/20045624>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Heap::collect() a wrapper function around a collectImpl() where the work is actually done.
+        The wrapper function that grabs a snapshot of the current stack boundaries and register values
+        on entry, and sanitizes the stack on exit.
+
+        This is a speculative fix for what appears to be overly conservative behavior in the garbage
+        collector following r178364 which caused a measurable regression in memory usage on Membuster.
+        The theory being that we were putting pointers to dead things on the stack before scanning it,
+        and by doing that ended up marking things that we'd otherwise discover to be garbage.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::gatherStackRoots):
+        (JSC::Heap::collect):
+        (JSC::Heap::collectImpl):
+        * heap/Heap.h:
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * heap/MachineStackMarker.h:
+
+2015-03-04  Debarshi Ray  <debarshir@gnome.org>
+
+        Silence GCC's -Wstrict-prototypes
+        https://bugs.webkit.org/show_bug.cgi?id=142278
+
+        Reviewed by Alexey Proskuryakov.
+
+        * API/JSContextRef.h:
+
+2015-03-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add a node for Math.log()
+        https://bugs.webkit.org/show_bug.cgi?id=142126
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds the DFG node ArithLog for LogIntrinsic.
+
+        Having a direct call to log has very little value by itself, the implementation
+        in DFG and FTL is a simple function call.
+
+        What is useful in ArithLog is that we know the operation is pure.
+        This allow us to hoist it out of loops when the argument is independent
+        is an invariant of the loop.
+
+        Perf wise, this patch gives:
+        -Kraken's imaging-darkroom: definitely 1.2372x faster.
+        -AsmBench's Towers.c: definitely 1.0261x faster.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithLog):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithLog):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleLog):
+        * tests/stress/math-log-basics.js: Added.
+        * tests/stress/math-log-with-constants.js: Added.
+
+2015-03-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Only Heap should be in charge of deciding how to select a subspace for a type
+        https://bugs.webkit.org/show_bug.cgi?id=142304
+
+        Reviewed by Mark Lam.
+        
+        This slightly reduces the code duplication for selecting subspace based on type, and what
+        duplication is left is at least localized in HeapInlines.h. The immediate effect is that
+        the DFG and FTL don't have to duplicate this pattern.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        (JSC::DFG::SpeculativeJIT::emitAllocateVariableSizedJSObject):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::allocateObject):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::allocateObjectOfType):
+        (JSC::Heap::subspaceForObjectOfType):
+        (JSC::Heap::allocatorForObjectOfType):
+        * runtime/JSCellInlines.h:
+        (JSC::allocateCell):
+
+2015-03-04  Andreas Kling  <akling@apple.com>
+
+        Stale entries in WeakGCMaps are keeping tons of WeakBlocks alive unnecessarily.
+        <https://webkit.org/b/142115>
+        <rdar://problem/19992268>
+
+        Reviewed by Geoffrey Garen.
+
+        Prune stale entries from WeakGCMaps as part of every full garbage collection.
+        This frees up tons of previously-stuck WeakBlocks that were only sitting around
+        with finalized handles waiting to die.
+
+        Note that WeakGCMaps register/unregister themselves with the GC heap in their
+        ctor/dtor, so creating one now requires passing the VM.
+
+        Average time spent in the PruningStaleEntriesFromWeakGCMaps GC phase appears
+        to be between 0.01ms and 0.3ms, though I've seen a few longer ones at ~1.2ms.
+        It seems somewhat excessive to do this on every Eden collection, so it's only
+        doing work in full collections for now.
+
+        * API/JSWeakObjectMapRefInternal.h:
+        (OpaqueJSWeakObjectMap::create):
+        (OpaqueJSWeakObjectMap::OpaqueJSWeakObjectMap):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JSWrapperMap.mm:
+        (-[JSWrapperMap initWithContext:]):
+        (-[JSWrapperMap jsWrapperForObject:]): Pass VM to WeakGCMap constructor.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add WeakGCMapInlines.h and make
+        it project-private so WebCore clients can access it.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        (JSC::Heap::pruneStaleEntriesFromWeakGCMaps): Added a new GC phase for pruning
+        stale entries from WeakGCMaps. This is only executed during full collections.
+
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::registerWeakGCMap):
+        (JSC::Heap::unregisterWeakGCMap): Added a mechanism for WeakGCMaps to register
+        themselves with the Heap and provide a pruning callback.
+
+        * runtime/PrototypeMap.h:
+        (JSC::PrototypeMap::PrototypeMap):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::add): Pass VM to WeakGCMap constructor.
+
+        * runtime/JSCInlines.h: Add "WeakGCMapInlines.h"
+
+        * runtime/JSGlobalObject.cpp: Include "WeakGCMapInlines.h" so this builds.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Pass VM to WeakGCMap constructor.
+
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        (JSC::WeakGCMap::add):
+        (JSC::WeakGCMap::WeakGCMap): Deleted.
+        (JSC::WeakGCMap::gcMap): Deleted.
+        (JSC::WeakGCMap::gcMapIfNeeded): Deleted.
+        * runtime/WeakGCMapInlines.h: Added.
+        (JSC::WeakGCMap::WeakGCMap):
+        (JSC::WeakGCMap::~WeakGCMap):
+        (JSC::WeakGCMap::pruneStaleEntries): Moved ctor, dtor and pruning callback
+        to WeakGCMapInlines.h to fix interdependent header issues. Removed code that
+        prunes WeakGCMap at certain growth milestones and instead rely on the GC
+        callback for housekeeping.
+
+2015-03-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG IR should refer to FunctionExecutables directly and not via the CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=142229
+
+        Reviewed by Mark Lam and Benjamin Poulain.
+        
+        Anytime a DFG IR node refers to something in CodeBlock, it has three effects:
+
+        - Cumbersome API for accessing the thing that the node refers to.
+        
+        - Not obvious how to create a new such node after bytecode parsing, especially if the
+          thing it refers to isn't already in the CodeBlock. We have done this in the past, but
+          it usually involves subtle changes to CodeBlock.
+        
+        - Not obvious how to inline code that ends up using such nodes. Again, when we have done
+          this, it involved subtle changes to CodeBlock.
+        
+        Prior to this change, the NewFunction* node types used an index into tables in CodeBlock.
+        For this reason, those operations were not inlineable. But the functin tables in CodeBlock
+        just point to FunctionExecutables, which are cells; this means that we can just abstract
+        these operands in DFG IR as cellOperands. cellOperands use DFG::FrozenValue, which means
+        that GC registration happens automagically. Even better, our dumping for cellOperand
+        already did FunctionExecutable dumping - so that functionality gets to be deduplicated.
+        
+        Because this change increases the number of users of cellOperand, it also adds some
+        convenience methods for using it. For example, whereas before you'd say things like:
+        
+            jsCast<Foo*>(node->cellOperand()->value())
+        
+        you can now just say:
+        
+            node->castOperand<Foo*>()
+        
+        This change also changes existing cellOperand users to use the new conveniance API when
+        applicable.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettisonFunctionDeclsAndExprs):
+        * bytecode/CodeBlock.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGFrozenValue.h:
+        (JSC::DFG::FrozenValue::cell):
+        (JSC::DFG::FrozenValue::dynamicCast):
+        (JSC::DFG::FrozenValue::cast):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::registerFrozenValues):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::castOperand):
+        (JSC::DFG::Node::hasFunctionDeclIndex): Deleted.
+        (JSC::DFG::Node::functionDeclIndex): Deleted.
+        (JSC::DFG::Node::hasFunctionExprIndex): Deleted.
+        (JSC::DFG::Node::functionExprIndex): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileCheckCell):
+        (JSC::FTL::LowerDFGToLLVM::compileNativeCallOrConstruct):
+
+2015-03-03  Michael Saboff  <msaboff@apple.com>
+
+        DelayedReleaseScope drops locks during GC which can cause a thread switch and code reentry
+        https://bugs.webkit.org/show_bug.cgi?id=141275
+
+        Reviewed by Geoffrey Garen.
+
+        The original issue is that the CodeCache uses an unsafe method to add new UnlinkedCodeBlocks.
+        It basically adds a null UnlinkedCodeBlock if there isn't a cached entry and then later
+        updates the null entry to the result of the compilation.  If during that compilation and
+        related processing we need to garbage collect, the DelayedReleaseScope would drop locks
+        possibly allowing another thread to try to get the same source out of the CodeCache.
+        This second thread would find the null entry and crash.  The fix is to move the processing of
+        DelayedReleaseScope to when we drop locks and not drop locks during GC.  That was done in
+        the original patch with the new function releaseDelayedReleasedObjects().
+
+        Updated releaseDelayedReleasedObjects() so that objects are released with all locks
+        dropped.  Now its processing follows these steps
+            Increment recursion counter and do recursion check and exit if recursing
+            While there are objects to release
+                ASSERT that lock is held by current thread
+                Take all items from delayed release Vector and put into temporary Vector
+                Release API lock
+                Release and clear items from temporary vector
+                Reaquire API lock
+        This meets the requirement that we release while the API lock is released and it is
+        safer processing of the delayed release Vector.
+
+        Added new regression test to testapi.
+
+        Also added comment describing how recursion into releaseDelayedReleasedObjects() is
+        prevented.
+
+        * API/tests/Regress141275.h: Added.
+        * API/tests/Regress141275.mm: Added.
+        (+[JSTEvaluatorTask evaluatorTaskWithEvaluateBlock:completionHandler:]):
+        (-[JSTEvaluator init]):
+        (-[JSTEvaluator initWithScript:]):
+        (-[JSTEvaluator _accessPendingTasksWithBlock:]):
+        (-[JSTEvaluator insertSignPostWithCompletion:]):
+        (-[JSTEvaluator evaluateScript:completion:]):
+        (-[JSTEvaluator evaluateBlock:completion:]):
+        (-[JSTEvaluator waitForTasksDoneAndReportResults]):
+        (__JSTRunLoopSourceScheduleCallBack):
+        (__JSTRunLoopSourcePerformCallBack):
+        (__JSTRunLoopSourceCancelCallBack):
+        (-[JSTEvaluator _jsThreadMain]):
+        (-[JSTEvaluator _sourceScheduledOnRunLoop:]):
+        (-[JSTEvaluator _setupEvaluatorThreadContextIfNeeded]):
+        (-[JSTEvaluator _callCompletionHandler:ifNeededWithError:]):
+        (-[JSTEvaluator _sourcePerform]):
+        (-[JSTEvaluator _sourceCanceledOnRunLoop:]):
+        (runRegress141275):
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::releaseDelayedReleasedObjects):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::unlock):
+
+2015-03-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should constant fold GetScope, and accesses to the scope register in the ByteCodeParser should not pretend that it's a constant as that breaks OSR exit liveness tracking
+        https://bugs.webkit.org/show_bug.cgi?id=106202
+
+        Rubber stamped by Benjamin Poulain.
+        
+        This fixes a bug discovered by working on https://bugs.webkit.org/show_bug.cgi?id=142229,
+        which was in turn discovered by working on https://bugs.webkit.org/show_bug.cgi?id=141174.
+        Our way of dealing with scopes known to be constant is very sketchy, and only really works
+        when a function is inlined. When it is, we pretend that every load of the scopeRegister sees
+        a constant. But this breaks the DFG's tracking of the liveness of the scopeRegister. The way
+        this worked made us miss oppportunities for optimizing based on a constant scope, and it also
+        meant that in some cases - particularly like when we inline code that uses NewFuction and
+        friends, as I do in bug 142229 - it makes OSR exit think that the scope is dead even though
+        it's most definitely alive and it's a constant.
+        
+        The problem here is that we were doing too many optimizations in the ByteCodeParser, and not
+        later. Later optimization phases know how to preserve OSR exit liveness. They're actually
+        really good at it. Also, later phases know how to infer that any variable is a constant no
+        matter how that constant arose - rather than the inlining-specific thing in ByteCodeParser.
+        
+        This changes the ByteCodeParser to largely avoid doing constant folding on the scope, except
+        making the GetScope operation itself a constant. This is a compilation-time hack for small
+        functions, and it doesn't break the loads of local variables - so OSR exit liveness still
+        sees that the scopeRegister is in use. This then adds a vastly more powerful GetScope and
+        GetClosureVar constant folder in the AbstractInterpreter. This handles most general cases
+        including those that arise in complex control flow. This will catch cases where the scope
+        is constant for any number of reasons. Basically anytime that the callee is inferred constant
+        this will give us a constant scope. Also, we still have the parse-time constant folding of
+        ResolveScope based on the reentry watchpoint, which luckily did the right thing with respect
+        to OSR exit liveness (it splats a Phantom on its inputs, and it produces a constant result
+        which is then set() normally).
+        
+        This appears to be a broad speed-up, albeit a small one. But mainly it unblocks bug 142229,
+        which then should unblock bug 141174.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::getLocal):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::parse):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::tryGetConstantClosureVar):
+        (JSC::DFG::Graph::tryGetRegisters):
+        (JSC::DFG::Graph::tryGetActivation): Deleted.
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasVariableWatchpointSet):
+        (JSC::DFG::Node::hasSymbolTable): Deleted.
+        (JSC::DFG::Node::symbolTable): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetClosureVar):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::visitChildren):
+        (JSC::SymbolTable::localToEntry):
+        (JSC::SymbolTable::entryFor):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::add):
+        (JSC::SymbolTable::set):
+        * tests/stress/function-expression-exit.js: Added.
+        * tests/stress/function-reentry-infer-on-self.js: Added.
+        (thingy):
+        * tests/stress/goofy-function-reentry-incorrect-inference.js: Added.
+
+2015-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Remove unused compression code
+        https://bugs.webkit.org/show_bug.cgi?id=142237
+
+        Reviewed by Geoffrey Garen.
+
+        * bytecode/UnlinkedCodeBlock.h:
+
+2015-03-03  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT debugging features that selectively disable the JITs for code blocks need to stay out of the way of the critical path of JIT management
+        https://bugs.webkit.org/show_bug.cgi?id=142234
+
+        Reviewed by Mark Lam and Benjamin Poulain.
+        
+        Long ago, we used to selectively disable compilation of CodeBlocks for debugging purposes by
+        adding hacks to DFGDriver.cpp.  This was all well and good.  It used the existing
+        CompilationFailed mode of the DFG driver to signal failure of CodeBlocks that we didn't want
+        to compile.  That's great because CompilationFailed is a well-supported return value on the
+        critical path, usually used for when we run out of JIT memory.
+
+        Later, this was moved into DFGCapabilities. This was basically incorrect. It introduced a bug
+        where disabling compiling of a CodeBlock meant that we stopped inlining it as well.  So if
+        you had a compiler bug that arose if foo was inlined into bar, and you bisected down to bar,
+        then foo would no longer get inlined and you wouldn't see the bug.  That's busted.
+
+        So then we changed the code in DFGCapabilities to mark bar as CanCompile and foo as
+        CanInline. Now, foo wouldn't get compiled alone but it would get inlined.
+
+        But then we removed CanCompile because that capability mode only existed for the purpose of
+        our old varargs hacks.  After that removal, "CanInline" became CannotCompile.  This means
+        that if you bisect down on bar in the "foo inlined into bar" case, you'll crash in the DFG
+        because the baseline JIT wouldn't have known to insert profiling on foo.
+
+        We could fix this by bringing back CanInline.
+
+        But this is all a pile of nonsense.  The debug support to selectively disable compilation of
+        some CodeBlocks shouldn't cross-cut our entire engine and should most certainly never involve
+        adding new capability modes.  This support is a hack at best and is for use by JSC hackers
+        only.  It should be as unintrusive as possible.
+
+        So, as in the ancient times, the only proper place to put this hack is in DFGDriver.cpp, and
+        return CompilationFailed.  This is correct not just because it takes capability modes out of
+        the picture (and obviates the need to introduce new ones), but also because it means that
+        disabling compilation doesn't change the profiling mode of other CodeBlocks in the Baseline
+        JIT.  Capability mode influences profiling mode which in turn influences code generation in
+        the Baseline JIT, sometimes in very significant ways - like, we sometimes do additional
+        double-to-int conversions in Baseline if we know that we might tier-up into the DFG, since
+        this buys us more precise profiling.
+        
+        This change reduces the intrusiveness of debugging hacks by making them use the very simple
+        CompilationFailed mechanism rather than trying to influence capability modes. Capability
+        modes have very subtle effects on the whole engine, while CompilationFailed just makes the
+        engine pretend like the DFG compilation will happen at timelike infinity. That makes these
+        hacks much more likely to continue working as we make other changes to the system.
+        
+        This brings back the ability to bisect down onto a function bar when bar inlines foo. Prior
+        to this change, we would crash in that case.
+
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::isSupported):
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        * dfg/DFGCapabilities.h:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+
+2015-03-03  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win64] JSC compile error.
+        https://bugs.webkit.org/show_bug.cgi?id=142216
+
+        Reviewed by Mark Lam.
+
+        There is missing a version of setupArgumentsWithExecState when NUMBER_OF_ARGUMENT_REGISTERS == 4.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2015-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG compile time measurements should really report milliseconds
+        https://bugs.webkit.org/show_bug.cgi?id=142209
+
+        Reviewed by Benjamin Poulain.
+        
+        Fix this to record milliseconds instead of seconds.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2015-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove op_get_callee, it's unused
+        https://bugs.webkit.org/show_bug.cgi?id=142206
+
+        Reviewed by Andreas Kling.
+        
+        It's a bit of a shame that we stopped using this opcode since it gives us same-callee
+        profiling. But, if we were to add this functionality back in, we would almost certainly do
+        it by adding a JSFunction allocation watchpoint on FunctionExecutable.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_callee): Deleted.
+        (JSC::JIT::emitSlow_op_get_callee): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_callee): Deleted.
+        (JSC::JIT::emitSlow_op_get_callee): Deleted.
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL): Deleted.
+
+2015-03-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Context Menu to Log a Particular Object
+        https://bugs.webkit.org/show_bug.cgi?id=142198
+
+        Reviewed by Timothy Hatcher.
+
+        Add a protocol method to assign a $n index to a value. For an object
+        use the injected script context for that object. For a value, use
+        the execution context to know where to save the value.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::saveResult):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptSource.js:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::saveResult):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Debugger.json:
+        * inspector/protocol/Runtime.json:
+
+2015-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        SpeculativeJIT::emitAllocateArguments() should be a bit faster, and shouldn't do destructor initialization
+        https://bugs.webkit.org/show_bug.cgi?id=142197
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateArguments): Use shift instead of mul, since mul doesn't automatically strength-reduce to shift. Also pass the structure as a TrustedImmPtr.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateVariableSizedJSObject): Rationalize this a bit. The other emitAllocate... methods take a templated structure so that it can be either a TrustedImmPtr or a register. Also don't do destructor initialization, since its one client doesn't need it, and it's actually probably wrong.
+
+2015-03-02  Mark Lam  <mark.lam@apple.com>
+
+        Exception stack unwinding in JSC hangs while the Timeline Profiler is enabled.
+        <https://webkit.org/b/142191>
+
+        Reviewed by Geoffrey Garen.
+
+        Imagine a scenario where the Inspector is paused / suspended at a breakpoint or
+        while the user is stepping through JS code. The user then tries to evaluate an
+        expression in the console, and that evaluation results in an exception being
+        thrown. Currently, if the Timeline Profiler is enabled while this exception is
+        being thrown, the WebProcess will hang while trying to handle that exception.
+
+        The issue is that the Timeline Profiler's ProfileGenerator::didExecute() will
+        return early and decline to process ProfileNodes if the Inspector is paused.
+        This is proper because it does not want to count work done for injected scripts
+        (e.g. from the console) towards the timeline profile of the webpage being run.
+        However, this is in conflict with ProfileGenerator::exceptionUnwind()'s
+        expectation that didExecute() will process ProfileNodes in order to do the stack
+        unwinding for the exception handling. As a result,
+        ProfileGenerator::exceptionUnwind() hangs.
+
+        ProfileGenerator::exceptionUnwind() is in error. While the Inspector is paused,
+        there will not be any ProfileNodes that it needs to "unwind". Hence, the fix is
+        simply to return early also in ProfileGenerator::exceptionUnwind() if the
+        Inspector is paused.
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::exceptionUnwind):
+
+2015-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should correctly document where it puts the argument count for inlined varargs frames
+        https://bugs.webkit.org/show_bug.cgi?id=142187
+
+        Reviewed by Geoffrey Garn.
+        
+        After LLVM tells us where the captured variables alloca landed in the frame, we need to
+        tell all of our meta-data about it. We were forgetting to do so for the argument count
+        register, which is used by inlined varargs calls.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * tests/stress/inline-varargs-get-arguments.js: Added.
+        (foo):
+        (bar):
+        (baz):
+
+2015-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Deduplicate slow path calling code in JITOpcodes.cpp/JITOpcodes32_64.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=142184
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_enumerable_length):
+        (JSC::JIT::emitSlow_op_has_structure_property):
+        (JSC::JIT::emit_op_has_generic_property):
+        (JSC::JIT::emit_op_get_structure_property_enumerator):
+        (JSC::JIT::emit_op_get_generic_property_enumerator):
+        (JSC::JIT::emit_op_to_index_string):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_enumerable_length): Deleted.
+        (JSC::JIT::emitSlow_op_has_structure_property): Deleted.
+        (JSC::JIT::emit_op_has_generic_property): Deleted.
+        (JSC::JIT::emit_op_get_structure_property_enumerator): Deleted.
+        (JSC::JIT::emit_op_get_generic_property_enumerator): Deleted.
+        (JSC::JIT::emit_op_to_index_string): Deleted.
+        (JSC::JIT::emit_op_profile_control_flow): Deleted.
+
+2015-03-02  Antti Koivisto  <antti@apple.com>
+
+        Add way to dump cache meta data to file
+        https://bugs.webkit.org/show_bug.cgi?id=142183
+
+        Reviewed by Andreas Kling.
+
+        Export appendQuotedJSONStringToBuilder.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ObjectPatternNode::toString):
+        * runtime/JSONObject.cpp:
+        (JSC::appendQuotedJSONStringToBuilder):
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::escapeStringToBuilder): Deleted.
+        * runtime/JSONObject.h:
+
+2015-03-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add Context Menus to Object Tree properties
+        https://bugs.webkit.org/show_bug.cgi?id=142125
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::functionDetails):
+        Update to include columnNumber.
+
+2015-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        BytecodeGenerator shouldn't emit op_resolve_scope as a roundabout way of returning the scopeRegister
+        https://bugs.webkit.org/show_bug.cgi?id=142153
+
+        Reviewed by Michael Saboff.
+        
+        We don't need a op_resolve_scope if we know that it will simply return the scope register.
+        This changes the BytecodeGenerator to use the scope register directly in those cases where
+        we know statically that we would just have returned that from op_resolve_scope.
+        
+        This doesn't appear to have a significant impact on performance.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitGetOwnScope): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::EmptyVarExpression::emitBytecode):
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::BindingNode::bindValue):
+
+2015-02-27  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Use the way number constants are written to help type speculation
+        https://bugs.webkit.org/show_bug.cgi?id=142072
+
+        Reviewed by Filip Pizlo.
+
+        This patch changes how we interpret numeric constant based on how they appear
+        in the source.
+
+        Constants that are integers but written with a decimal point now carry that information
+        to the optimizating tiers. From there, we use that to be more aggressive about typing
+        math operations toward double operations.
+
+        For example, in:
+            var a = x + 1.0;
+            var b = y + 1;
+        The Add for a would be biased toward doubles, the Add for b would speculate
+        integer as usual.
+
+
+        The gains are tiny but this is a prerequisite to make my next patch useful:
+        -SunSpider's access-fannkuch: definitely 1.0661x faster
+        -SunSpider's math-cordic: definitely 1.0266x slower
+            overal: might be 1.0066x slower.
+        -Kraken's imaging-darkroom: definitely 1.0333x faster.
+
+        * parser/Lexer.cpp:
+        (JSC::tokenTypeForIntegerLikeToken):
+        (JSC::Lexer<T>::lex):
+        The lexer now create two types of tokens for number: INTEGER and DOUBLE.
+        Those token types only carry information about how the values were
+        entered, an INTEGER does not have to be an integer, it is only written like one.
+        Large integer still end up represented as double in memory.
+
+        One trap I fell into was typing numbers like 12e3 as double. This kind of literal
+        is frequently used in integer-typed code, while 12.e3 would appear in double-typed
+        code.
+        Because of that, the only signals for double are: decimal point, negative zero,
+        and ridiculously large values.
+
+        * parser/NodeConstructors.h:
+        (JSC::DoubleNode::DoubleNode):
+        (JSC::IntegerNode::IntegerNode):
+        * parser/Nodes.h:
+        (JSC::NumberNode::value):
+        (JSC::NumberNode::setValue): Deleted.
+        Number get specialized in two new kind of nodes in the AST: IntegerNode and DoubleNode.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::NumberNode::emitBytecode):
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createDoubleExpr):
+        (JSC::ASTBuilder::createIntegerExpr):
+        (JSC::ASTBuilder::createIntegerLikeNumber):
+        (JSC::ASTBuilder::createDoubleLikeNumber):
+        (JSC::ASTBuilder::createNumberFromBinaryOperation):
+        (JSC::ASTBuilder::createNumberFromUnaryOperation):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::createNumberExpr): Deleted.
+        (JSC::ASTBuilder::createNumber): Deleted.
+        The AST has some optimization to resolve constants before emitting bytecode.
+        In the new code, the intger representation is kept if both operands where
+        also represented as integers.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseDeconstructionPattern):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::printUnexpectedTokenText):
+        * parser/ParserTokens.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createDoubleExpr):
+        (JSC::SyntaxChecker::createIntegerExpr):
+        (JSC::SyntaxChecker::createNumberExpr): Deleted.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::registerName):
+        (JSC::CodeBlock::constantName):
+        Change constantName(r, getConstant(r)) -> constantName(r) to simplify
+        the dump code.
+
+        (JSC::CodeBlock::dumpBytecode):
+        Dump thre soure representation information we have with each constant.
+
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::constantName): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::constantsSourceCodeRepresentation):
+        (JSC::CodeBlock::addConstant):
+        (JSC::CodeBlock::addConstantLazily):
+        (JSC::CodeBlock::constantSourceCodeRepresentation):
+        (JSC::CodeBlock::setConstantRegisters):
+
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::addConstant):
+        (JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation):
+        (JSC::UnlinkedCodeBlock::shrinkToFit):
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/BytecodeGenerator.h:
+        We have to differentiate between constants that have the same values but are
+        represented differently in the source. Values like 1.0 and 1 now end up
+        as different constants.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::addConstantToGraph):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::registerFrozenValues):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addSpeculationMode):
+        (JSC::DFG::Graph::addImmediateShouldSpeculateInt32):
+        ArithAdd is very aggressive toward using Int52, which is quite useful
+        in many benchmarks.
+
+        Here we need to specialize to make sure we don't force our literals
+        to Int52 if there were represented as double.
+
+        There is one exception to that rule: when the other operand is guaranteed
+        to come from a NodeResultInt32. This is because there is some weird code
+        doing stuff like:
+            var b = a|0;
+            var c = b*2.0;
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::setOpAndDefaultFlags):
+        (JSC::DFG::Node::sourceCodeRepresentation):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * runtime/JSCJSValue.h:
+        (JSC::EncodedJSValueWithRepresentationHashTraits::emptyValue):
+        (JSC::EncodedJSValueWithRepresentationHashTraits::constructDeletedValue):
+        (JSC::EncodedJSValueWithRepresentationHashTraits::isDeletedValue):
+        (JSC::EncodedJSValueWithRepresentationHash::hash):
+        (JSC::EncodedJSValueWithRepresentationHash::equal):
+        * tests/stress/arith-add-with-constants.js: Added.
+        * tests/stress/arith-mul-with-constants.js: Added.
+
+2015-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out r180723. It broke a bunch of tests.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::constLocal):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConstDeclNode::emitCodeSingle):
+        * tests/stress/const-arguments.js: Removed.
+
+2015-02-26  Mark Lam  <mark.lam@apple.com>
+
+        Assertion fix for r180711: The bool returning form of BytecodeGenerator::addVar() can be removed.
+        <https://webkit.org/b/142064>
+
+        Reviewed by Joseph Pecoraro.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+
+2015-02-26  Mark Lam  <mark.lam@apple.com>
+
+        MachineThreads::Thread clean up has a use after free race condition.
+        <https://webkit.org/b/141990>
+
+        Reviewed by Filip Pizlo.
+
+        MachineThreads::Thread clean up relies on the clean up mechanism
+        implemented in _pthread_tsd_cleanup_key(), which looks like this:
+
+        void _pthread_tsd_cleanup_key(pthread_t self, pthread_key_t key)
+        {
+            void (*destructor)(void *);
+            if (_pthread_key_get_destructor(key, &destructor)) {
+                void **ptr = &self->tsd[key];
+                void *value = *ptr;
+
+            // === Start of window for the bug to manifest =================
+
+                // At this point, this thread has cached "destructor" and "value"
+                // (which is a MachineThreads*).  If the VM gets destructed (along
+                // with its MachineThreads registry) by another thread, then this
+                // thread will have no way of knowing that the MachineThreads* is
+                // now pointing to freed memory.  Calling the destructor below will
+                // therefore result in a use after free scenario when it tries to
+                // access the MachineThreads' data members.
+
+                if (value) {
+                    *ptr = NULL;
+                    if (destructor) {
+
+            // === End of window for the bug to manifest ==================
+
+                        destructor(value);
+                    }
+                }
+            }
+        }
+
+        The fix is to add each active MachineThreads to an ActiveMachineThreadsManager,
+        and always check if the manager still contains that MachineThreads object
+        before we call removeCurrentThread() on it.  When MachineThreads is destructed,
+        it will remove itself from the manager.  The add, remove, and checking
+        operations are all synchronized on the manager's lock, thereby ensuring that
+        the MachineThreads object, if found in the manager, will remain alive for the
+        duration of time we call removeCurrentThread() on it.
+
+        There's also possible for the MachineThreads object to already be destructed
+        and another one happened to have been instantiated at the same address.
+        Hence, we should only remove the exiting thread if it is found in the
+        MachineThreads object.
+
+        There is no test for this issue because this bug requires a race condition
+        between 2 threads where:
+        1. Thread B, which had previously used the VM, exiting and
+           getting to the bug window shown in _pthread_tsd_cleanup_key() above.
+        2. Thread A destructing the VM (and its MachineThreads object)
+           within that window of time before Thread B calls the destructor.
+
+        It is not possible to get a reliable test case without invasively
+        instrumenting _pthread_tsd_cleanup_key() or MachineThreads::removeCurrentThread()
+        to significantly increase that window of opportunity.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::ActiveMachineThreadsManager::Locker::Locker):
+        (JSC::ActiveMachineThreadsManager::add):
+        (JSC::ActiveMachineThreadsManager::remove):
+        (JSC::ActiveMachineThreadsManager::contains):
+        (JSC::ActiveMachineThreadsManager::ActiveMachineThreadsManager):
+        (JSC::activeMachineThreadsManager):
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::removeThread):
+        (JSC::MachineThreads::removeThreadIfFound):
+        (JSC::MachineThreads::removeCurrentThread): Deleted.
+        * heap/MachineStackMarker.h:
+
+2015-02-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Save Console Evaluations into Command Line variables $1-$99 ($n)
+        https://bugs.webkit.org/show_bug.cgi?id=142061
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Debugger.json:
+        * inspector/protocol/Runtime.json:
+        Input flag "saveResult" on whether we should try to save a result.
+        Output int "savedResultIndex" to tell the frontend the saved state.
+
+        * inspector/InjectedScriptSource.js:
+        Handle saving and clearing $1-$99 values.
+        Include in BasicCommandLineAPI for JSContext inspection.
+
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::makeEvalCall):
+        * inspector/InjectedScriptBase.h:
+        Allow an optional "savedResultIndex" out value on evals.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::evaluate):
+        (Inspector::InjectedScript::evaluateOnCallFrame):
+        * inspector/InjectedScript.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::evaluate):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        Plumbing for new in and out parameters.
+
+2015-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        The bool returning form of BytecodeGenerator::addVar() can be removed
+        https://bugs.webkit.org/show_bug.cgi?id=142064
+
+        Reviewed by Mark Lam.
+        
+        It's easier to implement addVar() when you don't have to return whether it's a new
+        variable or not.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::addVar): Deleted.
+
+2015-02-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Various array access corner cases should take OSR exit feedback
+        https://bugs.webkit.org/show_bug.cgi?id=142056
+
+        Reviewed by Geoffrey Garen.
+        
+        Two major changes here:
+        
+        - Don't keep converting GetById into GetArrayLength if we exited due to any kind of array
+          type check.
+        
+        - Use a generic form of GetByVal/PutByVal if we exited due to any kind of exotic checks,
+          like the Arguments safety checks. We use the "ExoticObjectMode" for out-of-bounds on
+          arguments for now, since it's a convenient way of forcing out-of-bounds to be handled by
+          the Generic array mode.
+
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
+        * tests/stress/array-length-array-storage-plain-object.js: Added.
+        (foo):
+        * tests/stress/array-length-plain-object.js: Added.
+        (foo):
+
+2015-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SSA stack accesses shouldn't speak of VariableAccessDatas
+        https://bugs.webkit.org/show_bug.cgi?id=142036
+
+        Reviewed by Michael Saboff.
+        
+        VariableAccessData is a useful thing in LoadStore and ThreadedCPS, but it's purely harmful in
+        SSA because you can't cook up new VariableAccessDatas. So, if you know that you want to load
+        or store to the stack, and you know what format to use as well as the location, then prior to
+        this patch you couldn't do it unless you found some existing VariableAccessData that matched
+        your requirements. That can be a hard task.
+        
+        It's better if SSA doesn't speak of VariableAccessDatas but instead just has stack accesses
+        that speak of the things that a stack access needs: local, machineLocal, and format. This
+        patch changes the SSA way of accessing the stack to do just that.
+        
+        Also add more IR validation.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::isConcrete):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::hasVariableAccessData):
+        * dfg/DFGNode.h:
+        (JSC::DFG::StackAccessData::StackAccessData):
+        (JSC::DFG::StackAccessData::flushedAt):
+        (JSC::DFG::Node::convertToPutStack):
+        (JSC::DFG::Node::convertToGetStack):
+        (JSC::DFG::Node::hasUnlinkedLocal):
+        (JSC::DFG::Node::hasStackAccessData):
+        (JSC::DFG::Node::stackAccessData):
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPutLocalSinkingPhase.cpp: Removed.
+        * dfg/DFGPutLocalSinkingPhase.h: Removed.
+        * dfg/DFGPutStackSinkingPhase.cpp: Copied from Source/JavaScriptCore/dfg/DFGPutLocalSinkingPhase.cpp.
+        (JSC::DFG::performPutStackSinking):
+        (JSC::DFG::performPutLocalSinking): Deleted.
+        * dfg/DFGPutStackSinkingPhase.h: Copied from Source/JavaScriptCore/dfg/DFGPutLocalSinkingPhase.h.
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::validateCPS):
+        (JSC::DFG::Validate::validateSSA):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::VirtualRegisterAllocationPhase::run):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetStack):
+        (JSC::FTL::LowerDFGToLLVM::compilePutStack):
+        (JSC::FTL::LowerDFGToLLVM::compileGetLocal): Deleted.
+        (JSC::FTL::LowerDFGToLLVM::compilePutLocal): Deleted.
+        * ftl/FTLOSRExit.h:
+        * tests/stress/many-sunken-locals.js: Added. This failure mode was caught by some miscellaneous test, so I figured I should write an explicit test for it.
+        (foo):
+        (bar):
+        (baz):
+        (fuzz):
+        (buzz):
+
+2015-02-26  Mark Lam  <mark.lam@apple.com>
+
+        Rolling out r180602, r180608, r180613, r180617, r180671.
+        <https://webkit.org/b/141990>
+
+        Not reviewed.
+
+        The r180602 solution does result in more work for GC when worker
+        threads are in use.  Filip is uncomfortable with that.
+        The EFL and GTK ports also seem to be unhappy with this change.
+        Rolling out while we investigate.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::gatherStackRoots):
+        (JSC::Heap::machineThreads): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::machineThreads):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        * heap/MachineStackMarker.h:
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::didAcquireLock):
+
+2015-02-26  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [Mac] [iOS] Parsing support for -apple-trailing-word
+        https://bugs.webkit.org/show_bug.cgi?id=141939
+
+        Reviewed by Andreas Kling.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-02-26  Michael Saboff  <msaboff@apple.com>
+
+        [Win] Debug-only JavaScriptCore failures
+        https://bugs.webkit.org/show_bug.cgi?id=142045
+
+        Rubber stamped by Filip Pizlo.
+
+        Reduced loop count to a more reasonable value of 10,000.  This still gets us to tier up
+        to the FTL, but doesn't take too long to run.
+
+        * tests/stress/repeated-arity-check-fail.js:
+
+2015-02-26  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Make build logs more legible by reducing noise
+        https://bugs.webkit.org/show_bug.cgi?id=142034
+
+        Reviewed by Alexey Proskuryakov.
+
+        Modify batch files, makefiles, and DOS commands to remove
+        uninteresting/unhelpful output.
+
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make:
+        * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscLauncherPreBuild.cmd:
+        * JavaScriptCore.vcxproj/jsc/jscPreBuild.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncherPreBuild.cmd:
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiLauncherPostBuild.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiLauncherPreBuild.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiPostBuild.cmd:
+        * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd:
+
+2015-02-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Add calleeSaveRegisters() implementation for ARM Traditional
+        https://bugs.webkit.org/show_bug.cgi?id=141903
+
+        Reviewed by Darin Adler.
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::calleeSaveRegisters):
+
+2015-02-25  Michael Saboff  <msaboff@apple.com>
+
+        Web Inspector: CRASH when debugger pauses inside a Promise handler
+        https://bugs.webkit.org/show_bug.cgi?id=141396
+
+        Reviewed by Mark Lam.
+
+        For frames that don't have a scope, typically native frames, use the lexicalGlobalObject to
+        create the DebuggerScope for that frame.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::scope):
+
+2015-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG abstract heaps should respect the difference between heap and stack
+        https://bugs.webkit.org/show_bug.cgi?id=142022
+
+        Reviewed by Geoffrey Garen.
+        
+        We will soon (https://bugs.webkit.org/show_bug.cgi?id=141174) be in a world where a "world
+        clobbering" operation cannot write to our stack, but may be able to read from it. This
+        means that we need to change the DFG abstract heap hierarchy to have a notion of Heap that
+        subsumes all that World previously subsumed, and a new notion of Stack that is a subtype
+        of World and a sibling of Heap.
+
+        So, henceforth "clobbering the world" means reading World and writing Heap.
+        
+        This makes a bunch of changes to make this work, including changing the implementation of
+        disjointness in AbstractHeap to make it support a more general hierarchy. I was expecting
+        a slow-down, but I measured the heck out of this and found no perf difference.
+
+        * dfg/DFGAbstractHeap.cpp:
+        (JSC::DFG::AbstractHeap::dump):
+        * dfg/DFGAbstractHeap.h:
+        (JSC::DFG::AbstractHeap::supertype):
+        (JSC::DFG::AbstractHeap::isStrictSubtypeOf):
+        (JSC::DFG::AbstractHeap::isSubtypeOf):
+        (JSC::DFG::AbstractHeap::overlaps):
+        (JSC::DFG::AbstractHeap::isDisjoint):
+        * dfg/DFGClobberize.cpp:
+        (JSC::DFG::clobbersHeap):
+        (JSC::DFG::clobbersWorld): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+
+2015-02-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r180595): construct varargs fails in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=142030
+
+        Reviewed by Geoffrey Garen.
+
+        The bug was caused by IC size being too small for construct_varargs even though we've added a new argument.
+        Fixed the bug by increasing the IC size to match call_varargs.
+
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfConstructVarargs):
+
+2015-02-25  Mark Lam  <mark.lam@apple.com>
+
+        ASan does not like JSC::MachineThreads::tryCopyOtherThreadStack.
+        <https://webkit.org/b/141672>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ASan does not like the fact that we memcpy the stack for GC scans.  So,
+        we're working around this by using our own memcpy (asanUnsafeMemcpy)
+        implementation that we can tell ASan to ignore.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::asanUnsafeMemcpy):
+
+2015-02-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        CodeBlock crashes when dumping op_push_name_scope
+        https://bugs.webkit.org/show_bug.cgi?id=141953
+
+        Reviewed by Filip Pizlo and Csaba Osztrogonác.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * tests/stress/op-push-name-scope-crashes-profiler.js: Added.
+
+2015-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Make ParserError immutable by design
+        https://bugs.webkit.org/show_bug.cgi?id=141955
+
+        Reviewed by Geoffrey Garen.
+
+        This patch enforce that no field of ParserError can
+        be modified after the constructor.
+
+        * parser/ParserError.h:
+        Move the attributes to pack the integer + 2 bytes together.
+        This is irrelevant for memory impact, it is to remve a load-store
+        when copying by value.
+
+        Also move the attributes to be private.
+
+        (JSC::ParserError::isValid):
+        To client of the interface cared about the type of the error,
+        the only information needed was: is there an error.
+
+        (JSC::ParserError::ParserError):
+        (JSC::ParserError::syntaxErrorType):
+        (JSC::ParserError::token):
+        (JSC::ParserError::message):
+        (JSC::ParserError::line):
+        (JSC::ParserError::toErrorObject):
+        * API/JSScriptRef.cpp:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        (JSC::UnlinkedFunctionExecutable::codeBlockFor):
+        * bytecode/UnlinkedCodeBlock.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::parse):
+        * jsc.cpp:
+        (runInteractive):
+        * parser/Parser.h:
+        (JSC::parse):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/Completion.h:
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+
+2015-02-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Need to pass RTLD_DEEPBIND to dlopen() to ensure that our LLVMOverrides take effect on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=142006
+
+        Reviewed by Csaba Osztrogonác.
+
+        This fixes hard-to-reproduce concurrency-related crashes when running stress tests with FTL and
+        concurrent JIT enabled.
+
+        * llvm/InitializeLLVMPOSIX.cpp:
+        (JSC::initializeLLVMPOSIX):
+
+2015-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        CMake build of libllvmForJSC.so should limit its export list like the Xcode build does
+        https://bugs.webkit.org/show_bug.cgi?id=141989
+
+        Reviewed by Gyuyoung Kim.
+
+        * CMakeLists.txt:
+        * llvm/library/libllvmForJSC.version: Added.
+
+2015-02-24  Alexey Proskuryakov  <ap@apple.com>
+
+        More iOS build fix after r180602.
+
+        * heap/Heap.h: Export Heap::machineThreads().
+
+2015-02-24  Brent Fulgham  <bfulgham@apple.com>
+
+        Unreviewed build fix after r180602.
+
+        * heap/MachineStackMarker.h: Add missing 'no return'
+        declaration for Windows.
+
+2015-02-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r180599.
+        https://bugs.webkit.org/show_bug.cgi?id=141998
+
+        Lots of new test failures (Requested by smfr on #webkit).
+
+        Reverted changeset:
+
+        "Parsing support for -webkit-trailing-word"
+        https://bugs.webkit.org/show_bug.cgi?id=141939
+        http://trac.webkit.org/changeset/180599
+
+2015-02-24  Mark Lam  <mark.lam@apple.com>
+
+        MachineThreads::Thread clean up has a use after free race condition.
+        <https://webkit.org/b/141990>
+
+        Reviewed by Michael Saboff.
+
+        MachineThreads::Thread clean up relies on the clean up mechanism
+        implemented in _pthread_tsd_cleanup_key(), which looks like this:
+
+        void _pthread_tsd_cleanup_key(pthread_t self, pthread_key_t key)
+        {
+            void (*destructor)(void *);
+            if (_pthread_key_get_destructor(key, &destructor)) {
+                void **ptr = &self->tsd[key];
+                void *value = *ptr;
+
+                // At this point, this thread has cached "destructor" and "value"
+                // (which is a MachineThreads*).  If the VM gets destructed (along
+                // with its MachineThreads registry) by another thread, then this
+                // thread will have no way of knowing that the MachineThreads* is
+                // now pointing to freed memory.  Calling the destructor below will
+                // therefore result in a use after free scenario when it tries to
+                // access the MachineThreads' data members.
+
+                if (value) {
+                    *ptr = NULL;
+                    if (destructor) {
+                        destructor(value);
+                    }
+                }
+            }
+        }
+
+        The solution is simply to change MachineThreads from a per VM thread
+        registry to a process global singleton thread registry i.e. the
+        MachineThreads registry is now immortal and we cannot have a use after
+        free scenario since we never free it.
+
+        The cost of this change is that all VM instances will have to scan
+        stacks of all threads ever touched by a VM, and not just those that
+        touched a specific VM.  However, stacks tend to be shallow.  Hence,
+        those additional scans will tend to be cheap.
+
+        Secondly, it is not common for there to be multiple JSC VMs in use
+        concurrently on multiple threads.  Hence, this cost should rarely
+        manifest in real world applications.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::machineThreads):
+        (JSC::Heap::gatherStackRoots):
+        * heap/Heap.h:
+        (JSC::Heap::machineThreads): Deleted.
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        * heap/MachineStackMarker.h:
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::didAcquireLock):
+
+2015-02-24  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [Mac] [iOS] Parsing support for -apple-trailing-word
+        https://bugs.webkit.org/show_bug.cgi?id=141939
+
+        Reviewed by Andreas Kling.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-02-24  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Use "this" instead of "callee" to get the constructor
+        https://bugs.webkit.org/show_bug.cgi?id=141019
+
+        Reviewed by Filip Pizlo.
+
+        This patch uses "this" register to pass the constructor (newTarget) to op_create_this from
+        op_construct or op_construct_varargs. This will allow future patches that implement ES6 class
+        to pass in the most derived class' constructor through "this" argument.
+
+        BytecodeGenerator's emitConstruct and emitConstructVarargs now passes thisRegister like
+        regular calls and emitCreateThis passes in this register to op_create_this as constructor.
+
+        The rest of the code change removes the code for special casing "this" register not being used
+        in call to construct.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCreateThis):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::NewExprNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        (JSC::DFG::ByteCodeParser::handleVarargsCall):
+        (JSC::DFG::ByteCodeParser::emitArgumentPhantoms):
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::reconstruct):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLJSCallVarargs.cpp:
+        (JSC::FTL::JSCallVarargs::emit):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNativeCallOrConstruct):
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeConstruct):
+        * jit/JITOperations.cpp:
+
+2015-02-24  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Make Getter/Setter RemoteObject property and ObjectPreview handling consistent
+        https://bugs.webkit.org/show_bug.cgi?id=141587
+
+        Reviewed by Timothy Hatcher.
+
+        Convert getProperties(ownAndGetterProperties) to getDisplayableProperties().
+        Mark PropertyDescriptors that are presumed to be native getters / bindings
+        separately so that the frontend may display them differently.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getProperties):
+        (Inspector::InjectedScript::getDisplayableProperties):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptSource.js:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        (Inspector::InspectorRuntimeAgent::getDisplayableProperties):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Runtime.json:
+
+2015-02-24  Mark Lam  <mark.lam@apple.com>
+
+        Rolling out r179753.  The fix was invalid.
+        <https://webkit.org/b/141990>
+
+        Not reviewed.
+
+        * API/tests/testapi.mm:
+        (threadMain):
+        (useVMFromOtherThread): Deleted.
+        (useVMFromOtherThreadAndOutliveVM): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::gatherStackRoots):
+        * heap/Heap.h:
+        (JSC::Heap::machineThreads):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        (JSC::MachineThreads::removeCurrentThread):
+        * heap/MachineStackMarker.h:
+
+2015-02-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Constructor returning null should construct an object instead of null
+        https://bugs.webkit.org/show_bug.cgi?id=141640
+
+        Reviewed by Filip Pizlo.
+
+        When constructor code doesn't return object, constructor should return `this` object instead.
+        Since we used `op_is_object` for this check and `op_is_object` is intended to be used for `typeof`,
+        it allows `null` as an object.
+        This patch fixes it by introducing an new bytecode `op_is_object_or_null` for `typeof` use cases.
+        Instead, constructor uses simplified `is_object`.
+
+        As a result, `op_is_object` becomes fairly simple. So we introduce optimization for `op_is_object`.
+
+        1. LLInt and baseline JIT support `op_is_object` as a fast path.
+        2. DFG abstract interpreter support `op_is_object`. And recognize its speculated type and read-write effects.
+        3. DFG introduces inlined asm for `op_is_object` rather than calling a C++ function.
+        4. FTL lowers DFG's IsObject into LLVM IR.
+
+        And at the same time, this patch fixes isString / isObject predicate used for `op_is_object` and others
+        in LLInt, JIT, DFG and FTL.
+        Before introducing ES6 Symbol, JSCell is only used for object and string in user observable area.
+        So in many places, when the cell is not object, we recognize it as a string, and vice versa.
+        However, now ES6 Symbol is implemented as a JSCell, this assumption is broken.
+        So this patch stop using !isString as isObject.
+        To check whether a cell is an object, instead of seeing that structure ID of a cell is not stringStructure,
+        we examine typeInfo in JSCell.
+
+        * JavaScriptCore.order:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitReturn):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+        IsObject operation only touches JSCell typeInfoType.
+        And this value would be changed through structure transition.
+        As a result, IsObject can report that it doesn't read any information.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+        Just like IsString, IsObject is also fixed up.
+
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality):
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateNotStringVar):
+        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+        (JSC::DFG::SpeculativeJIT::emitSwitchString):
+        (JSC::DFG::SpeculativeJIT::branchIsObject):
+        (JSC::DFG::SpeculativeJIT::branchNotObject):
+        (JSC::DFG::SpeculativeJIT::branchIsString):
+        (JSC::DFG::SpeculativeJIT::branchNotString):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileToString):
+        (JSC::FTL::LowerDFGToLLVM::compileIsObject):
+        (JSC::FTL::LowerDFGToLLVM::compileIsObjectOrNull):
+        (JSC::FTL::LowerDFGToLLVM::speculateTruthyObject):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::isObject):
+        (JSC::FTL::LowerDFGToLLVM::isNotObject):
+        (JSC::FTL::LowerDFGToLLVM::isNotString):
+        (JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::emitJumpIfCellObject):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_object):
+        (JSC::JIT::emit_op_to_primitive):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_object):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::compileOpStrictEq):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Operations.cpp:
+        (JSC::jsIsObjectTypeOrNull):
+        (JSC::jsIsObjectType): Deleted.
+        * runtime/Operations.h:
+        * tests/stress/constructor-with-return.js: Added.
+        (Test):
+
+        When constructor doesn't return an object, `this` should be returned instead.
+        In this test, we check all primitives. And test object, array and wrappers.
+
+        * tests/stress/dfg-to-primitive-pass-symbol.js: Added.
+        (toPrimitiveTarget):
+        (doToPrimitive):
+
+        op_to_primitive operation passes Symbol in fast path.
+
+2015-02-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION(r179429): Can't type comments in Facebook
+        https://bugs.webkit.org/show_bug.cgi?id=141859
+
+        Reviewed by Brent Fulgham.
+
+        When window.Symbol is exposed to user-space pages,
+        Facebook's JavaScript use it (maybe, for immutable-js and React.js's unique key).
+        However, to work with Symbols completely, it also requires
+        1) Object.getOwnPropertySymbols (for mixin including Symbols)
+        2) the latest ES6 Iterator interface that uses Iterator.next and it returns { done: boolean, value: value }.
+        Since they are not landed yet, comments in Facebook don't work.
+
+        This patch introduces RuntimeFlags for JavaScriptCore.
+        Specifying SymbolEnabled flag under test runner and inspector to continue to work with Symbol.
+        And drop JavaScriptExperimentsEnabled flag
+        because it is no longer used and use case of this is duplicated to runtime flags.
+
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (GlobalObject::javaScriptRuntimeFlags):
+        (GlobalObject::javaScriptExperimentsEnabled): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        (JSC::JSGlobalObject::javaScriptRuntimeFlags):
+        (JSC::JSGlobalObject::javaScriptExperimentsEnabled): Deleted.
+        * runtime/RuntimeFlags.h: Added.
+        (JSC::RuntimeFlags::RuntimeFlags):
+        (JSC::RuntimeFlags::createAllEnabled):
+
+2015-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Our bizarre behavior on Arguments::defineOwnProperty should be deliberate rather than a spaghetti incident
+        https://bugs.webkit.org/show_bug.cgi?id=141951
+
+        Reviewed by Benjamin Poulain.
+        
+        This patch has no behavioral change, but it simplifies a bunch of wrong code. The code is
+        still wrong in exactly the same way, but at least it's obvious what's going on. The wrongness
+        is covered by this bug: https://bugs.webkit.org/show_bug.cgi?id=141952.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyBackingStore): We should only see the arguments token; assert otherwise. This works because if the GC sees the butterfly token it calls the JSObject::copyBackingStore method directly.
+        (JSC::Arguments::defineOwnProperty): Make our bizarre behavior deliberate rather than an accident of a decade of patches.
+        * tests/stress/arguments-bizarre-behavior.js: Added.
+        (foo):
+        * tests/stress/arguments-bizarre-behaviour-disable-enumerability.js: Added. My choice of spellings of the word "behavio[u]r" is almost as consistent as our implementation of arguments.
+        (foo):
+        * tests/stress/arguments-custom-properties-gc.js: Added. I added this test because at first I was unsure if we GCd arguments correctly.
+        (makeBaseArguments):
+        (makeArray):
+        (cons):
+
+2015-02-23  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r180547 and r180550.
+        https://bugs.webkit.org/show_bug.cgi?id=141957
+
+        Broke 10 Windows tests. (Requested by bfulgham_ on #webkit).
+
+        Reverted changesets:
+
+        "REGRESSION(r179429): Can't type comments in Facebook"
+        https://bugs.webkit.org/show_bug.cgi?id=141859
+        http://trac.webkit.org/changeset/180547
+
+        "Constructor returning null should construct an object instead
+        of null"
+        https://bugs.webkit.org/show_bug.cgi?id=141640
+        http://trac.webkit.org/changeset/180550
+
+2015-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Constructor returning null should construct an object instead of null
+        https://bugs.webkit.org/show_bug.cgi?id=141640
+
+        Reviewed by Geoffrey Garen.
+
+        When constructor code doesn't return object, constructor should return `this` object instead.
+        Since we used `op_is_object` for this check and `op_is_object` is intended to be used for `typeof`,
+        it allows `null` as an object.
+        This patch fixes it by introducing an new bytecode `op_is_object_or_null` for `typeof` use cases.
+        Instead, constructor uses simplified `is_object`.
+
+        As a result, `op_is_object` becomes fairly simple. So we introduce optimization for `op_is_object`.
+
+        1. LLInt and baseline JIT support `op_is_object` as a fast path.
+        2. DFG abstract interpreter support `op_is_object`. And recognize its speculated type and read-write effects.
+        3. DFG introduces inlined asm for `op_is_object` rather than calling a C++ function.
+        4. FTL lowers DFG's IsObject into LLVM IR.
+
+        And at the same time, this patch fixes isString / isObject predicate used for `op_is_object` and others
+        in LLInt, JIT, DFG and FTL.
+        Before introducing ES6 Symbol, JSCell is only used for object and string in user observable area.
+        So in many places, when the cell is not object, we recognize it as a string, and vice versa.
+        However, now ES6 Symbol is implemented as a JSCell, this assumption is broken.
+        So this patch stop using !isString as isObject.
+        To check whether a cell is an object, instead of seeing that structure ID of a cell is not stringStructure,
+        we examine typeInfo in JSCell.
+
+        * JavaScriptCore.order:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitReturn):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+        IsObject operation only touches JSCell typeInfoType.
+        And this value would not be changed through structure transition.
+        As a result, IsObject can report that it doesn't read any information.
+
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+        Just like IsString, IsObject is also fixed up.
+
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality):
+        (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality):
+        (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
+        (JSC::DFG::SpeculativeJIT::speculateObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateNotStringVar):
+        (JSC::DFG::SpeculativeJIT::emitSwitchChar):
+        (JSC::DFG::SpeculativeJIT::emitSwitchString):
+        (JSC::DFG::SpeculativeJIT::branchIsObject):
+        (JSC::DFG::SpeculativeJIT::branchNotObject):
+        (JSC::DFG::SpeculativeJIT::branchIsString):
+        (JSC::DFG::SpeculativeJIT::branchNotString):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileToString):
+        (JSC::FTL::LowerDFGToLLVM::compileIsObject):
+        (JSC::FTL::LowerDFGToLLVM::compileIsObjectOrNull):
+        (JSC::FTL::LowerDFGToLLVM::speculateTruthyObject):
+        (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
+        (JSC::FTL::LowerDFGToLLVM::isObject):
+        (JSC::FTL::LowerDFGToLLVM::isNotObject):
+        (JSC::FTL::LowerDFGToLLVM::isNotString):
+        (JSC::FTL::LowerDFGToLLVM::speculateNonNullObject):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::emitJumpIfCellObject):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_object):
+        (JSC::JIT::emit_op_to_primitive):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_object):
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::compileOpStrictEq):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Operations.cpp:
+        (JSC::jsIsObjectTypeOrNull):
+        (JSC::jsIsObjectType): Deleted.
+        * runtime/Operations.h:
+
+2015-02-23  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Disable font loading events until our implementation gets updated to match the latest spec
+        https://bugs.webkit.org/show_bug.cgi?id=141938
+
+        Reviewed by Andreas Kling.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION(r179429): Can't type comments in Facebook
+        https://bugs.webkit.org/show_bug.cgi?id=141859
+
+        Reviewed by Geoffrey Garen.
+
+        When window.Symbol is exposed to user-space pages,
+        Facebook's JavaScript use it (maybe, for immutable-js and React.js's unique key).
+        However, to work with Symbols completely, it also requires
+        1) Object.getOwnPropertySymbols (for mixin including Symbols)
+        2) the latest ES6 Iterator interface that uses Iterator.next and it returns { done: boolean, value: value }.
+        Since they are not landed yet, comments in Facebook don't work.
+
+        This patch introduces RuntimeFlags for JavaScriptCore.
+        Specifying SymbolEnabled flag under test runner and inspector to continue to work with Symbol.
+        And drop JavaScriptExperimentsEnabled flag
+        because it is no longer used and use case of this is duplicated to runtime flags.
+
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp:
+        (GlobalObject::javaScriptRuntimeFlags):
+        (GlobalObject::javaScriptExperimentsEnabled): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        (JSC::JSGlobalObject::javaScriptRuntimeFlags):
+        (JSC::JSGlobalObject::javaScriptExperimentsEnabled): Deleted.
+        * runtime/RuntimeFlags.h: Added.
+        (JSC::RuntimeFlags::RuntimeFlags):
+        (JSC::RuntimeFlags::createAllEnabled):
+
+2015-02-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        Set the semantic origin of delayed SetLocal to the Bytecode that originated it
+        https://bugs.webkit.org/show_bug.cgi?id=141727
+
+        Reviewed by Filip Pizlo.
+
+        Previously, delayed SetLocals would have the NodeOrigin of the next
+        bytecode. This was because delayed SetLocal are...delayed... and
+        currentCodeOrigin() is the one where the node is emitted.
+
+        This made debugging a little awkward since the OSR exits on SetLocal
+        were reported for the next bytecode. This patch changes the semantic
+        origin to keep the original bytecode.
+
+        From benchmarks, this looks like it could be a tiny bit faster
+        but it likely just noise.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setDirect):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::currentNodeOrigin):
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::DelayedSetLocal::DelayedSetLocal):
+        (JSC::DFG::ByteCodeParser::DelayedSetLocal::execute):
+
+2015-02-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove DFGNode::predictHeap()
+        https://bugs.webkit.org/show_bug.cgi?id=141864
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::predictHeap): Deleted.
+        Unused code.
+
+2015-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of JSLexicalEnvironment::argumentsGetter
+        https://bugs.webkit.org/show_bug.cgi?id=141930
+
+        Reviewed by Mark Lam.
+        
+        This function is unused, and the way it's written is bizarre - it's a return statement that
+        dominates a bunch of dead code.
+
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::argumentsGetter): Deleted.
+        * runtime/JSLexicalEnvironment.h:
+
+2015-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove unused activationCount and allTheThingsCount variable declarations.
+
+        Rubber stamped by Mark Lam and Michael Saboff.
+
+        * runtime/JSLexicalEnvironment.h:
+
+2015-02-23  Saam Barati  <saambarati1@gmail.com>
+
+        Adjust the ranges of basic block statements in JSC's control flow profiler to be mutually exclusive
+        https://bugs.webkit.org/show_bug.cgi?id=141095
+
+        Reviewed by Mark Lam.
+
+        Suppose the control flow of a program forms basic block A with successor block
+        B. A's end offset will be the *same* as B's start offset in the current architecture 
+        of the control flow profiler. This makes reasoning about the text offsets of
+        the control flow profiler unsound. To make reasoning about offsets sound, all 
+        basic block ranges should be mutually exclusive.  All calls to emitProfileControlFlow 
+        now pass in the *start* of a basic block as the text offset argument. This simplifies 
+        all calls to emitProfileControlFlow because the previous implementation had a
+        lot of edge cases for getting the desired basic block text boundaries.
+
+        This patch also ensures that the basic block boundary of a block statement 
+        is the exactly the block's open and close brace offsets (inclusive). For example,
+        in if/for/while statements. This also has the consequence that for statements 
+        like "if (cond) foo();", the whitespace preceding "foo()" is not part of 
+        the "foo()" basic block, but instead is part of the "if (cond) " basic block. 
+        This is okay because these text offsets aren't meant to be human readable.
+        Instead, they reflect the text offsets of JSC's AST nodes. The Web Inspector 
+        is the only client of this API and user of these text offsets and it is 
+        not negatively effected by this new behavior.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
+        When computing basic block boundaries in CodeBlock, we ensure that every
+        block's end offset is one less than its successor's start offset to
+        maintain that boundaries' ranges should be mutually exclusive.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        Because the control flow profiler needs to know which functions
+        have executed, we can't lazily create functions. This was a bug 
+        from before that was hidden because the Type Profiler was always 
+        enabled when the control flow profiler was enabled when profiling 
+        was turned on from the Web Inspector. But, JSC allows for Control 
+        Flow profiling to be turned on without Type Profiling, so we need 
+        to ensure the Control Flow profiler has all the data it needs.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * jsc.cpp:
+        (functionHasBasicBlockExecuted):
+        We now assert that the substring argument is indeed a substring
+        of the function argument's text because subtle bugs could be
+        introduced otherwise.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::setStartOffset):
+        * parser/Nodes.h:
+        (JSC::Node::setStartOffset):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseBlockStatement):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        For the various function call AST nodes, their m_position member 
+        variable is now the start of the entire function call expression 
+        and not at the start of the open paren of the arguments list.
+
+        * runtime/BasicBlockLocation.cpp:
+        (JSC::BasicBlockLocation::getExecutedRanges):
+        * runtime/ControlFlowProfiler.cpp:
+        (JSC::ControlFlowProfiler::getBasicBlocksForSourceID):
+        Function ranges inserted as gaps should follow the same criteria
+        that the bytecode generator uses to ensure that basic blocks
+        start and end offsets are mutually exclusive.
+
+        * tests/controlFlowProfiler/brace-location.js: Added.
+        (foo):
+        (bar):
+        (baz):
+        (testIf):
+        (testForRegular):
+        (testForIn):
+        (testForOf):
+        (testWhile):
+        (testIfNoBraces):
+        (testForRegularNoBraces):
+        (testForInNoBraces):
+        (testForOfNoBraces):
+        (testWhileNoBraces):
+        * tests/controlFlowProfiler/conditional-expression.js: Added.
+        (foo):
+        (bar):
+        (baz):
+        (testConditionalBasic):
+        (testConditionalFunctionCall):
+        * tests/controlFlowProfiler/driver/driver.js:
+        (checkBasicBlock):
+
+2015-02-23  Matthew Mirman  <mmirman@apple.com>
+
+        r9 is volatile on ARMv7 for iOS 3 and up. 
+        https://bugs.webkit.org/show_bug.cgi?id=141489
+        rdar://problem/19432916
+
+        Reviewed by Michael Saboff.
+
+        * jit/RegisterSet.cpp: 
+        (JSC::RegisterSet::calleeSaveRegisters): removed r9 from the list of ARMv7 callee save registers.
+        * tests/stress/regress-141489.js: Added.
+        (foo):
+
+2015-02-23  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Add the necessary setupArgumentsWithExecState after bug141915
+        https://bugs.webkit.org/show_bug.cgi?id=141921
+
+        Reviewed by Michael Saboff.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2015-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Scopes should always be created with a previously-created symbol table rather than creating one on the fly
+        https://bugs.webkit.org/show_bug.cgi?id=141915
+
+        Reviewed by Mark Lam.
+        
+        The main effect of this change is that pushing name scopes no longer requires creating symbol
+        tables on the fly.
+        
+        This also makes it so that JSEnvironmentRecords must always have an a priori symbol table.
+        
+        JSSegmentedVariableObject still does a hack where it creates a blank symbol table on-demand.
+        This is needed because that's what JSGlobalObject and all of its many subclasses want. That's
+        harmless; I mainly needed a prior symbol tables for JSEnvironmentRecords anyway.
+
+        * bytecode/BytecodeList.json:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOperations.cpp:
+        (JSC::pushNameScope):
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/JSCatchScope.h:
+        (JSC::JSCatchScope::JSCatchScope):
+        (JSC::JSCatchScope::create):
+        * runtime/JSEnvironmentRecord.h:
+        (JSC::JSEnvironmentRecord::JSEnvironmentRecord):
+        * runtime/JSFunctionNameScope.h:
+        (JSC::JSFunctionNameScope::JSFunctionNameScope):
+        (JSC::JSFunctionNameScope::create):
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::create):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::finishCreation):
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::finishCreation):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::finishCreation): Deleted.
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::createNameScopeTable):
+
+2015-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a comment to clarify that the test was taken from the bug report, in response to
+        feedback from Michael Saboff and Benjamin Poulain.
+        
+        * tests/stress/regress-141883.js:
+
+2015-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Function name scope is only created on the function instance that triggered parsing rather than on every function instance that needs it
+        https://bugs.webkit.org/show_bug.cgi?id=141881
+
+        Reviewed by Michael Saboff.
+        
+        Previously we only created the function name scope in a way that made it visible to the
+        function that triggered parsing/linking of the executable/codeBlock, and to the linker for
+        that code block. This was sort of the bare minimum for the feature to appear to work right to
+        synthetic tests.
+
+        There are two valid "times" to create the function name scope. Either it's created for each
+        JSFunction instance that needs a name scope, or it's created for each execution of such a
+        JSFunction. This change chooses the latter, because it happens to be the easiest to implement
+        with what we have right now. I opened a bug for optimizing this if we ever need to:
+        https://bugs.webkit.org/show_bug.cgi?id=141887.
+        
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::prepareForExecution):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::addNameScopeIfNeeded): Deleted.
+        * runtime/JSFunction.h:
+        * tests/stress/function-name-scope.js: Added.
+        (check.verify):
+        (check):
+
+2015-02-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Crash in DFGFrozenValue
+        https://bugs.webkit.org/show_bug.cgi?id=141883
+
+        Reviewed by Benjamin Poulain.
+        
+        If a value might be a cell, then we have to have Graph freeze it rather than trying to
+        create the FrozenValue directly. Creating it directly is just an optimization for when you
+        know for sure that it cannot be a cell.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * tests/stress/regress-141883.js: Added. Hacked the original test to be faster while still crashing before this fix.
+
+2015-02-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Generate Previews more often for RemoteObject interaction
+        https://bugs.webkit.org/show_bug.cgi?id=141875
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Runtime.json:
+        Add generatePreview to getProperties.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getProperties):
+        (Inspector::InjectedScript::getInternalProperties):
+        * inspector/InjectedScript.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        Plumb the generatePreview boolean through to the injected script.
+
+        * inspector/InjectedScriptSource.js:
+        Add generatePreview for getProperties.
+        Fix callFunctionOn to generatePreviews if asked.
+
+2015-02-20  Mark Lam  <mark.lam@apple.com>
+
+        Refactor JSWrapperMap.mm to defer creation of the ObjC JSValue until the latest possible moment.
+        <https://webkit.org/b/141856>
+
+        Reviewed by Geoffrey Garen.
+
+        1. Make JSObjCClassInfo's -constructor and -wrapperForObject return a
+           JSC::JSObject* just like -prototype.
+        2. Defer the creation of the ObjC JSValue from JSC::JSObject* until
+           the latest moment when it is needed.  This allows us to not have to
+           keep converting back to a JSC::JSObject* in intermediate code.
+
+        * API/JSWrapperMap.mm:
+        (makeWrapper):
+        (objectWithCustomBrand):
+        (constructorWithCustomBrand):
+        (allocateConstructorForCustomClass):
+        (-[JSObjCClassInfo allocateConstructorAndPrototype]):
+        (-[JSObjCClassInfo wrapperForObject:]):
+        (-[JSObjCClassInfo constructor]):
+        (-[JSWrapperMap jsWrapperForObject:]):
+
+2015-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Build fix for gcc.
+
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::create):
+
+2015-02-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of JSNameScope::m_type
+        https://bugs.webkit.org/show_bug.cgi?id=141851
+
+        Reviewed by Geoffrey Garen.
+        
+        This is a big step towards getting rid of JSEnvironmentRecord::m_registers. To do it we need
+        to ensure that subclasses of JSEnvironmentRecord never have additional C++ fields, so that
+        JSEnvironmentRecord can always place "registers" right after the end of itself.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::isCatchScope):
+        (JSC::DebuggerScope::isFunctionNameScope):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSCatchScope.cpp: Added.
+        * runtime/JSCatchScope.h: Added.
+        (JSC::JSCatchScope::JSCatchScope):
+        (JSC::JSCatchScope::create):
+        (JSC::JSCatchScope::createStructure):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::addNameScopeIfNeeded):
+        * runtime/JSFunctionNameScope.cpp: Added.
+        * runtime/JSFunctionNameScope.h: Added.
+        (JSC::JSFunctionNameScope::JSFunctionNameScope):
+        (JSC::JSFunctionNameScope::create):
+        (JSC::JSFunctionNameScope::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::catchScopeStructure):
+        (JSC::JSGlobalObject::functionNameScopeStructure):
+        (JSC::JSGlobalObject::nameScopeStructure): Deleted.
+        * runtime/JSNameScope.cpp:
+        (JSC::JSNameScope::create):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::JSNameScope):
+        (JSC::JSNameScope::createStructure): Deleted.
+        (JSC::JSNameScope::isFunctionNameScope): Deleted.
+        (JSC::JSNameScope::isCatchScope): Deleted.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::isCatchScopeObject):
+        (JSC::JSObject::isFunctionNameScopeObject):
+        * runtime/JSObject.h:
+
+2015-02-20  Mark Lam  <mark.lam@apple.com>
+
+        [JSObjCClassInfo reallocateConstructorAndOrPrototype] should also reallocate super class prototype chain.
+        <https://webkit.org/b/141809>
+
+        Reviewed by Geoffrey Garen.
+
+        A ObjC class that implement the JSExport protocol will have a JS prototype
+        chain and constructor automatically synthesized for its JS wrapper object.
+        However, if there are no more instances of that ObjC class reachable by a
+        JS GC root scan, then its synthesized prototype chain and constructors may
+        be released by the GC.  If a new instance of that ObjC class is subsequently
+        instantiated, then [JSObjCClassInfo reallocateConstructorAndOrPrototype]
+        should re-construct the prototype chain and constructor (if they were
+        previously released).  However, the current implementation only
+        re-constructs the immediate prototype, but not every other prototype
+        object upstream in the prototype chain.
+
+        To fix this, we do the following:
+        1. We no longer allocate the JSObjCClassInfo's prototype and constructor
+           eagerly.  Hence, -initWithContext:forClass: will no longer call
+           -allocateConstructorAndPrototypeWithSuperClassInfo:.
+        2. Instead, we'll always access the prototype and constructor thru
+           accessor methods.  The accessor methods will call
+           -allocateConstructorAndPrototype: if needed.
+        3. -allocateConstructorAndPrototype: will fetch the needed superClassInfo
+           from the JSWrapperMap itself.  This makes it so that we no longer
+           need to pass the superClassInfo all over.
+        4. -allocateConstructorAndPrototype: will get the super class prototype
+           by invoking -prototype: on the superClassInfo, thereby allowing the
+           super class to allocate its prototype and constructor if needed and
+           fixing the issue in this bug.
+
+        5. Also removed the GC warning comments, and ensured that needed JS
+           objects are kept alive by having a local var pointing to it from the
+           stack (which makes a GC root).
+
+        * API/JSWrapperMap.mm:
+        (-[JSObjCClassInfo initWithContext:forClass:]):
+        (-[JSObjCClassInfo allocateConstructorAndPrototype]):
+        (-[JSObjCClassInfo wrapperForObject:]):
+        (-[JSObjCClassInfo constructor]):
+        (-[JSObjCClassInfo prototype]):
+        (-[JSWrapperMap classInfoForClass:]):
+        (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]): Deleted.
+        (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): Deleted.
+        (-[JSObjCClassInfo reallocateConstructorAndOrPrototype]): Deleted.
+        * API/tests/Regress141809.h: Added.
+        * API/tests/Regress141809.mm: Added.
+        (-[TestClassB name]):
+        (-[TestClassC name]):
+        (runRegress141809):
+        * API/tests/testapi.mm:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-02-20  Alexey Proskuryakov  <ap@apple.com>
+
+        Remove svn:keywords property.
+
+        As far as I can tell, the property had no effect on any of these files, but also,
+        when it has effect it's likely harmful.
+
+        * builtins/ArrayConstructor.js: Removed property svn:keywords.
+
+2015-02-20  Michael Saboff  <msaboff@apple.com>
+
+        DFG JIT needs to check for stack overflow at the start of Program and Eval execution
+        https://bugs.webkit.org/show_bug.cgi?id=141676
+
+        Reviewed by Filip Pizlo.
+
+        Added stack check to the beginning of the code the DFG copmiler emits for Program and Eval nodes.
+        To aid in testing the code, I replaced the EvalCodeCache::maxCacheableSourceLength const
+        a options in runtime/Options.h.  The test script, run-jsc-stress-tests, sets that option
+        to a huge value when running with the "Eager" options.  This allows the updated test to 
+        reliably exercise the code in questions.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        Added stack check.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        * runtime/Options.h:
+        Replaced EvalCodeCache::imaxCacheableSourceLength with Options::maximumEvalCacheableSourceLength
+        so that it can be configured when running the related test.
+
+2015-02-20  Eric Carlson  <eric.carlson@apple.com>
+
+        [iOS] cleanup AirPlay code
+        https://bugs.webkit.org/show_bug.cgi?id=141811
+
+        Reviewed by Jer Noble.
+
+        * Configurations/FeatureDefines.xcconfig: IOS_AIRPLAY -> WIRELESS_PLAYBACK_TARGET.
+
+2015-02-19  Dean Jackson  <dino@apple.com>
+
+        ES6: Implement Array.from()
+        https://bugs.webkit.org/show_bug.cgi?id=141054
+        <rdar://problem/19654521>
+
+        Reviewed by Filip Pizlo.
+
+        Implement the Array.from() ES6 method
+        as defined in Section 22.1.2.1 of the specification.
+
+        Given that we can't rely on the built-in
+        global functions or objects to be untainted,
+        I had to expose a few of them directly to
+        the function via private names. In particular:
+        - Math.floor -> @floor
+        - Math.abs -> @abs
+        - Number -> @Number
+        - Array -> @Array
+        - isFinite -> @isFinite
+
+        * builtins/ArrayConstructor.js: Added.
+        (from): Implementation of Array.from in JavaScript.
+        * runtime/ArrayConstructor.cpp: Add "from" to the lookup
+        table for the constructor object.
+        * runtime/CommonIdentifiers.h: Add the private versions
+        of the identifiers listed above.
+        * runtime/JSGlobalObject.cpp: Add the implementations of
+        those identifiers to the global object (using their
+        private names).
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalPrivateFuncAbs): Implementation of the abs function.
+        (JSC::globalPrivateFuncFloor): Implementation of the floor function.
+        * runtime/JSGlobalObjectFunctions.h:
+
+2015-02-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        Refine the FTL part of ArithPow
+        https://bugs.webkit.org/show_bug.cgi?id=141792
+
+        Reviewed by Filip Pizlo.
+
+        This patch refines the FTL lowering of ArithPow. This was left out
+        of the original patch to keep it simpler.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileArithPow):
+        Two improvements here:
+        1) Do not generate the NaN check unless we know the exponent might be a NaN.
+        2) Use one BasicBlock per check with the appropriate weight. Now that we have
+           one branch per test, move the Infinity check before the check for 1 since
+           it is the less common case.
+
+        * tests/stress/math-pow-becomes-custom-function.js: Added.
+        Test for changing the Math.pow() function after it has been optimized.
+
+        * tests/stress/math-pow-nan-behaviors.js:
+        The previous tests were only going as far as the DFGAbstractInterpreter
+        were the operations were replaced by the equivalent constant.
+
+        I duplicated the test functions to also test the dynamic behavior of DFG
+        and FTL.
+
+        * tests/stress/math-pow-with-constants.js:
+        Add cases covering exponent constants. LLVM removes many value
+        checks for those.
+
+        * tests/stress/math-pow-with-never-NaN-exponent.js: Added.
+        Test for the new optimization removing the NaN check.
+
+2015-02-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r180279): It broke 20 tests on ARM Linux
+        https://bugs.webkit.org/show_bug.cgi?id=141771
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Align 64-bit values to respect ARM EABI.
+
+2015-02-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove BytecodeGenerator's numberMap, it is dead code
+        https://bugs.webkit.org/show_bug.cgi?id=141779
+
+        Reviewed by Filip Pizlo.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        The JSValueMap seems better in every way.
+
+        The emitLoad() taking a double was the only way to use numberMap
+        and that code has no caller.
+
+2015-02-18  Michael Saboff  <msaboff@apple.com>
+
+        Rollout r180247 & r180249 from trunk
+        https://bugs.webkit.org/show_bug.cgi?id=141773
+
+        Reviewed by Filip Pizlo.
+
+        Theses changes makes sense to fix the crash reported in https://bugs.webkit.org/show_bug.cgi?id=141730
+        only for branches.  The change to fail the FTL compile but continue running is not comprehensive
+        enough for general use on trunk.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+        (JSC::FTL::LowerDFGToLLVM::compileValueRep):
+        (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+        (JSC::FTL::LowerDFGToLLVM::compilePutLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAbs):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArray):
+        (JSC::FTL::LowerDFGToLLVM::compileToString):
+        (JSC::FTL::LowerDFGToLLVM::compileMakeRope):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::compare):
+        (JSC::FTL::LowerDFGToLLVM::boolify):
+        (JSC::FTL::LowerDFGToLLVM::opposite):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::isArrayType):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
+        (JSC::FTL::LowerDFGToLLVM::setInt52):
+        (JSC::FTL::lowerDFGToLLVM):
+        (JSC::FTL::LowerDFGToLLVM::loweringFailed): Deleted.
+        * ftl/FTLLowerDFGToLLVM.h:
+
+2015-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should really support varargs
+        https://bugs.webkit.org/show_bug.cgi?id=141332
+
+        Reviewed by Oliver Hunt.
+        
+        This adds comprehensive vararg call support to the DFG and FTL compilers. Previously, if a
+        function had a varargs call, then it could only be compiled if that varargs call was just
+        forwarding arguments and we were inlining the function rather than compiling it directly. Also,
+        only varargs calls were dealt with; varargs constructs were not.
+        
+        This lifts all of those restrictions. Every varargs call or construct can now be compiled by both
+        the DFG and the FTL. Those calls can also be inlined, too - provided that profiling gives us a
+        sensible bound on arguments list length. When we inline a varargs call, the act of loading the
+        varargs is now made explicit in IR. I believe that we have enough IR machinery in place that we
+        would be able to do the arguments forwarding optimization as an IR transformation. This patch
+        doesn't implement that yet, and keeps the old bytecode-based varargs argument forwarding
+        optimization for now.
+        
+        There are three major IR features introduced in this patch:
+        
+        CallVarargs/ConstructVarargs: these are like Call/Construct except that they take an arguments
+        array rather than a list of arguments. Currently, they splat this arguments array onto the stack
+        using the same basic technique as the baseline JIT has always done. Except, these nodes indicate
+        that we are not interested in doing the non-escaping "arguments" optimization.
+        
+        CallForwardVarargs: this is a form of CallVarargs that just does the non-escaping "arguments"
+        optimization, aka forwarding arguments. It's somewhat lazy that this doesn't include
+        ConstructForwardVarargs, but the reason is that once we eliminate the lazy tear-off for
+        arguments, this whole thing will have to be tweaked - and for now forwarding on construct is just
+        not important in benchmarks. ConstructVarargs will still do forwarding, just not inlined.
+        
+        LoadVarargs: loads all elements out of an array onto the stack in a manner suitable for a varargs
+        call. This is used only when a varargs call (or construct) was inlined. The bytecode parser will
+        make room on the stack for the arguments, and will use LoadVarars to put those arguments into
+        place.
+        
+        In the future, we can consider adding strength reductions like:
+        
+        - If CallVarargs/ConstructVarargs see an array of known size with known elements, turn them into
+          Call/Construct.
+        
+        - If CallVarargs/ConstructVarargs are passed an unmodified, unescaped Arguments object, then
+          turn them into CallForwardVarargs/ConstructForwardVarargs.
+        
+        - If LoadVarargs sees an array of known size, then turn it into a sequence of GetByVals and
+          PutLocals.
+        
+        - If LoadVarargs sees an unmodified, unescaped Arguments object, then turn it into something like
+          LoadForwardVarargs.
+        
+        - If CallVarargs/ConstructVarargs/LoadVarargs see the result of a splice (or other Array
+          prototype function), then do the splice and varargs loading in one go (maybe via a new node
+          type).
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::rshiftPtr):
+        (JSC::MacroAssembler::urshiftPtr):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::urshift64):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::urshift64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::shrq_i8r):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::setProvenConstantCallee):
+        (JSC::CallLinkStatus::dump):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::maxNumArguments):
+        (JSC::CallLinkStatus::setIsProved): Deleted.
+        * bytecode/CodeOrigin.cpp:
+        (WTF::printInternal):
+        * bytecode/CodeOrigin.h:
+        (JSC::InlineCallFrame::varargsKindFor):
+        (JSC::InlineCallFrame::specializationKindFor):
+        (JSC::InlineCallFrame::isVarargs):
+        (JSC::InlineCallFrame::isNormalCall): Deleted.
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/ValueRecovery.cpp:
+        (JSC::ValueRecovery::dumpInContext):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::addCall):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleVarargsCall):
+        (JSC::DFG::ByteCodeParser::emitFunctionChecks):
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::removeLastNodeFromGraph): Deleted.
+        (JSC::DFG::ByteCodeParser::undoFunctionChecks): Deleted.
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::functionCapabilityLevel):
+        (JSC::DFG::mightCompileFunctionFor):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCommon.cpp:
+        (WTF::printInternal):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::canInline):
+        (JSC::DFG::leastUpperBound):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::isLiveInBytecode):
+        (JSC::DFG::Graph::valueProfileFor):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueProfileFor): Deleted.
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor): Deleted.
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCallVarargsData):
+        (JSC::DFG::Node::callVarargsData):
+        (JSC::DFG::Node::hasLoadVarargsData):
+        (JSC::DFG::Node::loadVarargsData):
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::dumpAndVerifyGraph):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::writeTop):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSSAConversionPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::isFlushed):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        (JSC::DFG::StackLayoutPhase::assign):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::functionType):
+        (JSC::FTL::buildCall):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfCall):
+        (JSC::FTL::sizeOfCallVarargs):
+        (JSC::FTL::sizeOfCallForwardVarargs):
+        (JSC::FTL::sizeOfConstructVarargs):
+        (JSC::FTL::sizeOfIn):
+        (JSC::FTL::sizeOfICFor):
+        (JSC::FTL::sizeOfCheckIn): Deleted.
+        * ftl/FTLInlineCacheSize.h:
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::JSCall):
+        * ftl/FTLJSCallBase.cpp:
+        * ftl/FTLJSCallBase.h:
+        * ftl/FTLJSCallVarargs.cpp: Added.
+        (JSC::FTL::JSCallVarargs::JSCallVarargs):
+        (JSC::FTL::JSCallVarargs::numSpillSlotsNeeded):
+        (JSC::FTL::JSCallVarargs::emit):
+        (JSC::FTL::JSCallVarargs::link):
+        * ftl/FTLJSCallVarargs.h: Added.
+        (JSC::FTL::JSCallVarargs::node):
+        (JSC::FTL::JSCallVarargs::stackmapID):
+        (JSC::FTL::JSCallVarargs::operator<):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::LowerDFGToLLVM::compileLoadVarargs):
+        (JSC::FTL::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):
+        (JSC::FTL::LowerDFGToLLVM::vmCall):
+        (JSC::FTL::LowerDFGToLLVM::vmCallNoExceptions):
+        (JSC::FTL::LowerDFGToLLVM::callCheck):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::call):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * ftl/FTLState.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeOfVarargs):
+        (JSC::sizeFrameForVarargs):
+        * interpreter/Interpreter.h:
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::readInlinedFrame):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitExceptionCheck):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::addressFor):
+        (JSC::AssemblyHelpers::calleeFrameSlot):
+        (JSC::AssemblyHelpers::calleeArgumentSlot):
+        (JSC::AssemblyHelpers::calleeFrameTagSlot):
+        (JSC::AssemblyHelpers::calleeFramePayloadSlot):
+        (JSC::AssemblyHelpers::calleeArgumentTagSlot):
+        (JSC::AssemblyHelpers::calleeArgumentPayloadSlot):
+        (JSC::AssemblyHelpers::calleeFrameCallerFrame):
+        (JSC::AssemblyHelpers::selectScratchGPR):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/GPRInfo.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITOperations.h:
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetupVarargsFrameFastCase):
+        * jit/SetupVarargsFrame.h:
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::registerArraySizeInBytes):
+        (JSC::Arguments::finishCreation):
+        * runtime/Options.h:
+        * tests/stress/construct-varargs-inline-smaller-Foo.js: Added.
+        (Foo):
+        (bar):
+        (checkEqual):
+        (test):
+        * tests/stress/construct-varargs-inline.js: Added.
+        (Foo):
+        (bar):
+        (checkEqual):
+        (test):
+        * tests/stress/construct-varargs-no-inline.js: Added.
+        (Foo):
+        (bar):
+        (checkEqual):
+        (test):
+        * tests/stress/get-argument-by-val-in-inlined-varargs-call-out-of-bounds.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/get-argument-by-val-safe-in-inlined-varargs-call-out-of-bounds.js: Added.
+        (foo):
+        (bar):
+        * tests/stress/get-my-argument-by-val-creates-arguments.js: Added.
+        (blah):
+        (foo):
+        (bar):
+        (checkEqual):
+        (test):
+        * tests/stress/load-varargs-then-inlined-call-exit-in-foo.js: Added.
+        (foo):
+        (bar):
+        (checkEqual):
+        * tests/stress/load-varargs-then-inlined-call-inlined.js: Added.
+        (foo):
+        (bar):
+        (baz):
+        (checkEqual):
+        (test):
+        * tests/stress/load-varargs-then-inlined-call.js: Added.
+        (foo):
+        (bar):
+        (checkEqual):
+        (test):
+
+2015-02-17  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed, Restoring the C LOOP insta-crash fix in r180184.
+
+        Fixed a typo that only affected the C Loop in the prologue() macro in LowLevelInterpreter.asm.
+        After the stackHeightOKGetCodeBlock label, codeBlockSetter(t1) should be codeBlockGetter(t1).
+
+        * llint/LowLevelInterpreter.asm: Fixed a typo.
+
+2015-02-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        URTBF after r180258 to fix Windows build.
+
+        * runtime/MathCommon.cpp:
+        (JSC::mathPowInternal):
+
+2015-02-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(r180235): It broke the !ENABLE(PROMISES) build
+        https://bugs.webkit.org/show_bug.cgi?id=141746
+
+        Unreviewed build fix.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        Wrap JSPromise related code in ENABLE(PROMISES) guard.
+
+2015-02-18  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix the C-Loop LLInt build
+        https://bugs.webkit.org/show_bug.cgi?id=141618
+
+        Reviewed by Filip Pizlo.
+
+        I broke C-Loop when moving the common code of pow()
+        to JITOperations because that file is #ifdefed out
+        when the JITs are disabled.
+
+        It would be weird to move it back to MathObject since
+        the function needs to know about the calling conventions.
+
+        To avoid making a mess, I just gave the function its own file
+        that is used by both the runtime and the JIT.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * runtime/MathCommon.cpp: Added.
+        (JSC::fdlibmScalbn):
+        (JSC::fdlibmPow):
+        (JSC::isDenormal):
+        (JSC::isEdgeCase):
+        (JSC::mathPowInternal):
+        (JSC::operationMathPow):
+        * runtime/MathCommon.h: Added.
+        * runtime/MathObject.cpp:
+
+2015-02-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        Clean up OSRExit's considerAddingAsFrequentExitSite()
+        https://bugs.webkit.org/show_bug.cgi?id=141690
+
+        Reviewed by Anders Carlsson.
+
+        Looks like some code was removed from CodeBlock::tallyFrequentExitSites()
+        and the OSRExit were left untouched.
+
+        This patch cleans up the two loops and remove the boolean return
+        on considerAddingAsFrequentExitSite().
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::tallyFrequentExitSites):
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitBase.cpp:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
+        * ftl/FTLOSRExit.h:
+        (JSC::FTL::OSRExit::considerAddingAsFrequentExitSite):
+
+2015-02-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Debug build fix after r180247.
+
+        * ftl/FTLLowerDFGToLLVM.cpp: (JSC::FTL::LowerDFGToLLVM::loweringFailed):
+
+2015-02-17  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r180184.
+        https://bugs.webkit.org/show_bug.cgi?id=141733
+
+        Caused infinite recursion on js/function-apply-aliased.html
+        (Requested by ap_ on #webkit).
+
+        Reverted changeset:
+
+        "REGRESSION(r180060): C Loop crashes"
+        https://bugs.webkit.org/show_bug.cgi?id=141671
+        http://trac.webkit.org/changeset/180184
+
+2015-02-17  Michael Saboff  <msaboff@apple.com>
+
+        CrashTracer: DFG_CRASH beneath JSC::FTL::LowerDFGToLLVM::compileNode
+        https://bugs.webkit.org/show_bug.cgi?id=141730
+
+        Reviewed by Geoffrey Garen.
+
+        Added a new failure handler, loweringFailed(), to LowerDFGToLLVM that reports failures
+        while processing DFG lowering.  For debug builds, the failures are logged identical
+        to the way the DFG_CRASH() reports them.  For release builds, the failures are reported
+        and that FTL compilation is terminated, but the process is allowed to continue.
+        Wrapped calls to loweringFailed() in a macro LOWERING_FAILED so the function and
+        line number are reported at the point of the inconsistancy.
+
+        Converted instances of DFG_CRASH to LOWERING_FAILED.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl): Added lowerDFGToLLVM() failure check that
+        will fail the FTL compile.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+        Added new member variable, m_loweringSucceeded, to stop compilation on the first
+        reported failure.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        * ftl/FTLLowerDFGToLLVM.h:
+        Added check for compilation failures and now report those failures via a boolean
+        return value.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+        (JSC::FTL::LowerDFGToLLVM::compileValueRep):
+        (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+        (JSC::FTL::LowerDFGToLLVM::compilePutLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+        (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+        (JSC::FTL::LowerDFGToLLVM::compileArithAbs):
+        (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileGetById):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+        (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+        (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
+        (JSC::FTL::LowerDFGToLLVM::compileNewArray):
+        (JSC::FTL::LowerDFGToLLVM::compileToString):
+        (JSC::FTL::LowerDFGToLLVM::compileMakeRope):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::LowerDFGToLLVM::compare):
+        (JSC::FTL::LowerDFGToLLVM::boolify):
+        (JSC::FTL::LowerDFGToLLVM::opposite):
+        (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+        (JSC::FTL::LowerDFGToLLVM::speculate):
+        (JSC::FTL::LowerDFGToLLVM::isArrayType):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
+        (JSC::FTL::LowerDFGToLLVM::setInt52):
+        Changed DFG_CRASH() to LOWERING_FAILED().  Updated related control flow as appropriate.
+
+        (JSC::FTL::LowerDFGToLLVM::loweringFailed): New error reporting member function.
+
+2015-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        StackLayoutPhase should use CodeBlock::usesArguments rather than FunctionExecutable::usesArguments
+        https://bugs.webkit.org/show_bug.cgi?id=141721
+        rdar://problem/17198633
+
+        Reviewed by Michael Saboff.
+        
+        I've seen cases where the two are out of sync.  We know we can trust the CodeBlock::usesArguments because
+        we use it everywhere else.
+        
+        No test because I could never reproduce the crash.
+
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::usesArguments):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+
+2015-02-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Improved Console Support for Bound Functions
+        https://bugs.webkit.org/show_bug.cgi?id=141635
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        Expose internal properties of a JSBoundFunction.
+
+2015-02-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ES6: Improved Console Support for Promise Objects
+        https://bugs.webkit.org/show_bug.cgi?id=141634
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getInternalProperties):
+        * inspector/InjectedScriptSource.js:
+        Include internal properties in previews. Share code
+        with normal internal property handling.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::constructInternalProperty):
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        Provide internal state of Promises.
+
+        * inspector/protocol/Runtime.json:
+        Provide an optional field to distinguish if a PropertyPreview
+        is for an Internal property or not.
+
+2015-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Throwing from an FTL call IC slow path may result in tag registers being clobbered on 64-bit CPUs
+        https://bugs.webkit.org/show_bug.cgi?id=141717
+        rdar://problem/19863382
+
+        Reviewed by Geoffrey Garen.
+        
+        The best solution is to ensure that the engine catching an exception restores tag registers.
+        
+        Each of these new test cases reliably crashed prior to this patch and they don't crash at all now.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * tests/stress/throw-from-ftl-call-ic-slow-path-cells.js: Added.
+        * tests/stress/throw-from-ftl-call-ic-slow-path-undefined.js: Added.
+        * tests/stress/throw-from-ftl-call-ic-slow-path.js: Added.
+
+2015-02-17  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Add the necessary setupArgumentsWithExecState after bug141332
+        https://bugs.webkit.org/show_bug.cgi?id=141714
+
+        Reviewed by Michael Saboff.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2015-02-15  Sam Weinig  <sam@webkit.org>
+
+        Add experimental <attachment> element support
+        https://bugs.webkit.org/show_bug.cgi?id=141626
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-02-16  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r180060): C Loop crashes
+        https://bugs.webkit.org/show_bug.cgi?id=141671
+
+        Reviewed by Geoffrey Garen.
+
+        Fixed a typo that only affected the C Loop in the prologue() macro in LowLevelInterpreter.asm.
+        After the stackHeightOKGetCodeBlock label, codeBlockSetter(t1) should be codeBlockGetter(t1).
+        Fixed the processing of an out of stack exception in llint_stack_check to not get the caller's
+        frame.  This isn't needed, since this helper is only called to check the stack on entry.  Any
+        exception will be handled by a call ancestor.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_stack_check): Changed to use the current frame for processing an exception.
+        * llint/LowLevelInterpreter.asm: Fixed a typo.
+
+2015-02-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Scope details sidebar should label objects with constructor names
+        https://bugs.webkit.org/show_bug.cgi?id=139449
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::internalConstructorName):
+        * runtime/Structure.cpp:
+        (JSC::Structure::toStructureShape):
+        Share calculatedClassName.
+
+        * runtime/JSObject.h:        
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+        Elaborate on a way to get an Object's class name.
+
+2015-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SSA should use GetLocal for arguments, and the GetArgument node type should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=141623
+
+        Reviewed by Oliver Hunt.
+        
+        During development of https://bugs.webkit.org/show_bug.cgi?id=141332, I realized that I
+        needed to use GetArgument for loading something that has magically already appeared on the
+        stack, so currently trunk sort of allows this. But then I realized three things:
+        
+        - A GetArgument with a non-JSValue flush format means speculating that the value on the
+          stack obeys that format, rather than just assuming that that it already has that format.
+          In bug 141332, I want it to assume rather than speculate. That also happens to be more
+          intuitive; I don't think I was wrong to expect that.
+        
+        - The node I really want is GetLocal. I'm just getting the value of the local and I don't
+          want to do anything else.
+        
+        - Maybe it would be easier if we just used GetLocal for all of the cases where we currently
+          use GetArgument.
+        
+        This changes the FTL to do argument speculations in the prologue just like the DFG does.
+        This brings some consistency to our system, and allows us to get rid of the GetArgument
+        node. The speculations that the FTL must do are now made explicit in the m_argumentFormats
+        vector in DFG::Graph. This has natural DCE behavior: even if all uses of the argument are
+        dead we will still speculate. We already have safeguards to ensure we only speculate if
+        there are uses that benefit from speculation (which is a much more conservative criterion
+        than DCE).
+        
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::run):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGFlushFormat.h:
+        (JSC::DFG::typeFilterFor):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::valueProfileFor):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::hasVariableAccessData):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::OSRAvailabilityAnalysisPhase::run):
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPutLocalSinkingPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+        (JSC::FTL::LowerDFGToLLVM::compileGetArgument): Deleted.
+        * tests/stress/dead-speculating-argument-use.js: Added.
+        (foo):
+        (o.valueOf):
+
+2015-02-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Rare case profiling should actually work
+        https://bugs.webkit.org/show_bug.cgi?id=141632
+
+        Reviewed by Michael Saboff.
+        
+        This simple adjustment appears to be a 2% speed-up on Octane. Over time, the slow case
+        heuristic has essentially stopped working because the typical execution count threshold for a
+        bytecode instruction is around 66 while the slow case threshold is 100: virtually
+        guaranteeing that the DFG will never think that a bytecode instruction has taken the slow
+        case even if it took it every single time. So, this changes the slow case threshold to 20.
+        
+        I checked if we could lower this down further, like to 10. That is worse than 20, and about
+        as bad as 100.
+
+        * runtime/Options.h:
+
+2015-02-15  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: remove unused XHR replay code
+        https://bugs.webkit.org/show_bug.cgi?id=141622
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Network.json: remove XHR replay methods.
+
+2015-02-15  David Kilzer  <ddkilzer@apple.com>
+
+        REGRESSION (r180082): WebCore Debug builds fail on Mavericks due to weak export symbols
+        <http://webkit.org/b/141607>
+
+        More work towards fixing the Mavericks Debug build.
+
+        * inspector/ScriptDebugServer.h:
+        (Inspector::ScriptDebugServer::Task):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        (Inspector::InspectorDebuggerAgent::Listener):
+        - Remove subclass exports. They did not help.
+
+        * runtime/JSCJSValue.h:
+        (JSC::JSValue::toFloat): Do not mark inline method for export.
+
+2015-02-09  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: remove some unnecessary Inspector prefixes from class names in Inspector namespace
+        https://bugs.webkit.org/show_bug.cgi?id=141372
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::addToFrontend):
+        (Inspector::ConsoleMessage::updateRepeatCountInConsole):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorAgentBase.h:
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::AgentRegistry::AgentRegistry):
+        (Inspector::AgentRegistry::append):
+        (Inspector::AgentRegistry::appendExtraAgent):
+        (Inspector::AgentRegistry::didCreateFrontendAndBackend):
+        (Inspector::AgentRegistry::willDestroyFrontendAndBackend):
+        (Inspector::AgentRegistry::discardAgents):
+        (Inspector::InspectorAgentRegistry::InspectorAgentRegistry): Deleted.
+        (Inspector::InspectorAgentRegistry::append): Deleted.
+        (Inspector::InspectorAgentRegistry::appendExtraAgent): Deleted.
+        (Inspector::InspectorAgentRegistry::didCreateFrontendAndBackend): Deleted.
+        (Inspector::InspectorAgentRegistry::willDestroyFrontendAndBackend): Deleted.
+        (Inspector::InspectorAgentRegistry::discardAgents): Deleted.
+        * inspector/InspectorAgentRegistry.h:
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::CallbackBase::CallbackBase):
+        (Inspector::BackendDispatcher::CallbackBase::isActive):
+        (Inspector::BackendDispatcher::CallbackBase::sendFailure):
+        (Inspector::BackendDispatcher::CallbackBase::sendIfActive):
+        (Inspector::BackendDispatcher::create):
+        (Inspector::BackendDispatcher::registerDispatcherForDomain):
+        (Inspector::BackendDispatcher::dispatch):
+        (Inspector::BackendDispatcher::sendResponse):
+        (Inspector::BackendDispatcher::reportProtocolError):
+        (Inspector::BackendDispatcher::getInteger):
+        (Inspector::BackendDispatcher::getDouble):
+        (Inspector::BackendDispatcher::getString):
+        (Inspector::BackendDispatcher::getBoolean):
+        (Inspector::BackendDispatcher::getObject):
+        (Inspector::BackendDispatcher::getArray):
+        (Inspector::BackendDispatcher::getValue):
+        (Inspector::InspectorBackendDispatcher::CallbackBase::CallbackBase): Deleted.
+        (Inspector::InspectorBackendDispatcher::CallbackBase::isActive): Deleted.
+        (Inspector::InspectorBackendDispatcher::CallbackBase::sendFailure): Deleted.
+        (Inspector::InspectorBackendDispatcher::CallbackBase::sendIfActive): Deleted.
+        (Inspector::InspectorBackendDispatcher::create): Deleted.
+        (Inspector::InspectorBackendDispatcher::registerDispatcherForDomain): Deleted.
+        (Inspector::InspectorBackendDispatcher::dispatch): Deleted.
+        (Inspector::InspectorBackendDispatcher::sendResponse): Deleted.
+        (Inspector::InspectorBackendDispatcher::reportProtocolError): Deleted.
+        (Inspector::InspectorBackendDispatcher::getInteger): Deleted.
+        (Inspector::InspectorBackendDispatcher::getDouble): Deleted.
+        (Inspector::InspectorBackendDispatcher::getString): Deleted.
+        (Inspector::InspectorBackendDispatcher::getBoolean): Deleted.
+        (Inspector::InspectorBackendDispatcher::getObject): Deleted.
+        (Inspector::InspectorBackendDispatcher::getArray): Deleted.
+        (Inspector::InspectorBackendDispatcher::getValue): Deleted.
+        * inspector/InspectorBackendDispatcher.h:
+        (Inspector::SupplementalBackendDispatcher::SupplementalBackendDispatcher):
+        (Inspector::SupplementalBackendDispatcher::~SupplementalBackendDispatcher):
+        (Inspector::InspectorSupplementalBackendDispatcher::InspectorSupplementalBackendDispatcher): Deleted.
+        (Inspector::InspectorSupplementalBackendDispatcher::~InspectorSupplementalBackendDispatcher): Deleted.
+        * inspector/InspectorFrontendChannel.h:
+        (Inspector::FrontendChannel::~FrontendChannel):
+        (Inspector::InspectorFrontendChannel::~InspectorFrontendChannel): Deleted.
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::dispatchMessageFromFrontend):
+        (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorAgent::willDestroyFrontendAndBackend):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorConsoleAgent::willDestroyFrontendAndBackend):
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorDebuggerAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
+        (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (Inspector::InspectorDebuggerAgent::pause):
+        (Inspector::InspectorDebuggerAgent::scriptExecutionBlockedByCSP):
+        (Inspector::InspectorDebuggerAgent::didPause):
+        (Inspector::InspectorDebuggerAgent::breakProgram):
+        (Inspector::InspectorDebuggerAgent::clearBreakDetails):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::willDestroyFrontendAndBackend):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        (Inspector::JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend):
+        (Inspector::JSGlobalObjectRuntimeAgent::willDestroyFrontendAndBackend):
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        * inspector/augmentable/AlternateDispatchableAgent.h:
+        * inspector/augmentable/AugmentableInspectorController.h:
+        * inspector/remote/RemoteInspectorDebuggable.h:
+        * inspector/remote/RemoteInspectorDebuggableConnection.h:
+        * inspector/scripts/codegen/cpp_generator.py:
+        (CppGenerator.cpp_type_for_formal_out_parameter):
+        (CppGenerator.cpp_type_for_stack_out_parameter):
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        (AlternateBackendDispatcher):
+        (Alternate):
+        (void):
+        (AlternateInspectorBackendDispatcher): Deleted.
+        (AlternateInspector): Deleted.
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
+        (CppBackendDispatcherHeaderGenerator._generate_alternate_handler_forward_declarations_for_domains.Alternate):
+        (CppBackendDispatcherHeaderGenerator._generate_dispatcher_declaration_for_command):
+        (CppBackendDispatcherHeaderGenerator._generate_alternate_handler_forward_declarations_for_domains.AlternateInspector): Deleted.
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator._generate_handler_class_destructor_for_domain):
+        (CppBackendDispatcherImplementationGenerator._generate_large_dispatcher_switch_implementation_for_domain):
+        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::connect):
+        (JSC::JSGlobalObjectDebuggable::disconnect):
+        * runtime/JSGlobalObjectDebuggable.h:
+
+2015-02-14  David Kilzer  <ddkilzer@apple.com>
+
+        REGRESSION (r180082): WebCore Debug builds fail on Mavericks due to weak export symbols
+        <http://webkit.org/b/141607>
+
+        Work towards fixing the Mavericks Debug build.
+
+        * inspector/ScriptDebugServer.h:
+        (Inspector::ScriptDebugServer::Task): Export class.
+        * inspector/agents/InspectorDebuggerAgent.h:
+        (Inspector::InspectorDebuggerAgent::Listener): Export class.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::setConsoleClient): Do not mark inline
+        method for export.
+
+2015-02-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Symbol RemoteObject should not send sub-type
+        https://bugs.webkit.org/show_bug.cgi?id=141604
+
+        Reviewed by Brian Burg.
+
+        * inspector/InjectedScriptSource.js:
+
+2015-02-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        Attempt to fix 32bits build after r180098
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        I copied the attribute from the MathObject version of that function when I moved
+        it over. DFG has no version of a function call taking those attributes.
+
+2015-02-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSContext Inspector: Do not stash console messages for non-debuggable JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=141589
+
+        Reviewed by Timothy Hatcher.
+
+        Consider developer extras disabled for JSContext inspection if the
+        RemoteInspector server is not enabled (typically a non-debuggable
+        process rejected by webinspectord) or if remote debugging on the
+        JSContext was explicitly disabled via SPI.
+
+        When developer extras are disabled, console message will not be stashed.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::developerExtrasEnabled):
+        * inspector/JSGlobalObjectInspectorController.h:
+
+2015-02-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        Add a DFG node for the Pow Intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=141540
+
+        Reviewed by Filip Pizlo.
+
+        Add a DFG Node for PowIntrinsic. This patch covers the basic cases
+        need to avoid massive regression. I will iterate over the node to cover
+        the missing types.
+
+        With this patch I get the following progressions on benchmarks:
+        -LongSpider's math-partial-sums: +5%.
+        -Kraken's imaging-darkroom: +17%
+        -AsmBench's cray.c: +6.6%
+        -CompressionBench: +2.2% globally.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        Cover a couple of trivial cases:
+        -If the exponent is zero, the result is always one, regardless of the base.
+        -If both arguments are constants, compute the result at compile time.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        We only support 2 basic cases at this time:
+        -Math.pow(double, int)
+        -Math.pow(double, double).
+
+        I'll cover Math.pow(int, int) in a follow up.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToArithSqrt):
+        (JSC::DFG::Node::arithNodeFlags):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::compileArithPowIntegerFastPath):
+        (JSC::DFG::SpeculativeJIT::compileArithPow):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileArithPow):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doublePow):
+        (JSC::FTL::Output::doublePowi):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncPow):
+        (JSC::isDenormal): Deleted.
+        (JSC::isEdgeCase): Deleted.
+        (JSC::mathPow): Deleted.
+
+        * tests/stress/math-pow-basics.js: Added.
+        * tests/stress/math-pow-integer-exponent-fastpath.js: Added.
+        * tests/stress/math-pow-nan-behaviors.js: Added.
+        * tests/stress/math-pow-with-constants.js: Added.
+        Start some basic testing of Math.pow().
+        Due to the various transform, the value change when the code tiers up,
+        I covered this by checking for approximate values.
+
+2015-02-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        ArithSqrt should not be conditional on supportsFloatingPointSqrt
+        https://bugs.webkit.org/show_bug.cgi?id=141546
+
+        Reviewed by Geoffrey Garen and Filip Pizlo.
+
+        Just fallback to the function call in the DFG codegen.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSqrt):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * tests/stress/math-sqrt-basics.js: Added.
+        Basic coverage.
+
+        * tests/stress/math-sqrt-basics-disable-architecture-specific-optimizations.js: Added.
+        Same tests but forcing the function call.
+
+2015-02-13  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r180060) New js/regress-141098 test crashes when LLInt is disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=141577
+
+        Reviewed by Benjamin Poulain.
+
+        Changed the prologue of the baseline JIT to check for stack space for all
+        types of code blocks.  Previously, it was only checking Function.  Now
+        it checks Program and Eval as well.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2015-02-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        Generate incq instead of addq when the immediate value is one
+        https://bugs.webkit.org/show_bug.cgi?id=141548
+
+        Reviewed by Gavin Barraclough.
+
+        JSC emits "addq #1 (rXX)" *a lot*.
+        This patch replace that by incq, which is one byte shorter
+        and is the adviced form.
+
+        Sunspider: +0.47%
+        Octane: +0.28%
+        Kraken: +0.44%
+        AsmBench, CompressionBench: neutral.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::incq_m):
+
+2015-02-13  Benjamin Poulain  <benjamin@webkit.org>
+
+        Little clean up of Bytecode Generator's Label
+        https://bugs.webkit.org/show_bug.cgi?id=141557
+
+        Reviewed by Michael Saboff.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        Label was a friend of BytecodeGenerator in order to access
+        m_instructions. There is no need for that, BytecodeGenerator
+        has a public getter.
+
+        * bytecompiler/Label.h:
+        (JSC::Label::Label):
+        (JSC::Label::setLocation):
+        (JSC::BytecodeGenerator::newLabel):
+        Make it explicit that the generator must exist.
+
+2015-02-13  Michael Saboff  <msaboff@apple.com>
+
+        Google doc spreadsheet reproducibly crashes when sorting
+        https://bugs.webkit.org/show_bug.cgi?id=141098
+
+        Reviewed by Oliver Hunt.
+
+        Moved the stack check to before the callee registers are allocated in the
+        prologue() by movving it from the functionInitialization() macro.  This
+        way we can check the stack before moving the stack pointer, avoiding a
+        crash during a "call" instruction.  Before this change, we weren't even
+        checking the stack for program and eval execution.
+
+        Made a couple of supporting changes.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_stack_check): We can't just go up one frame as we
+        may be processing an exception to an entry frame.
+
+        * llint/LowLevelInterpreter.asm:
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        (llint_throw_from_slow_path_trampoline): Changed method to get the vm
+        from the code block to not use the codeBlock, since we may need to
+        continue from an exception in a native function.
+
+2015-02-12  Benjamin Poulain  <benjamin@webkit.org>
+
+        Simplify the initialization of BytecodeGenerator a bit
+        https://bugs.webkit.org/show_bug.cgi?id=141505
+
+        Reviewed by Anders Carlsson.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        Setup the default initialization at the declaration level
+        instead of the constructor.
+
+        Also made m_scopeNode and m_codeType const to make it explicit
+        that they are invariant after construction.
+
+        * parser/Nodes.cpp:
+        * runtime/Executable.cpp:
+        Remove 2 useless #includes.
+
+2015-02-12  Benjamin Poulain  <benjamin@webkit.org>
+
+        Move the generators for GetScope and SkipScope to the common core in DFGSpeculativeJIT
+        https://bugs.webkit.org/show_bug.cgi?id=141506
+
+        Reviewed by Michael Saboff.
+
+        The generators for the nodes GetScope and SkipScope were
+        completely identical between 32 and 64bits.
+
+        This patch moves the duplicated code to DFGSpeculativeJIT.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetScope):
+        (JSC::DFG::SpeculativeJIT::compileSkipScope):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2015-02-11  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] [64-bit] Work around MSVC2013 Runtime Bug
+        https://bugs.webkit.org/show_bug.cgi?id=141498
+        <rdar://problem/19803642>
+
+        Reviewed by Anders Carlsson.
+
+        Disable FMA3 instruction use in the MSVC math library to
+        work around a VS2013 runtime crash. We can remove this
+        workaround when we switch to VS2015.
+
+        * API/tests/testapi.c: Call _set_FMA3_enable(0) to disable
+        FMA3 support.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add new files.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
+        * JavaScriptCore.vcxproj/JavaScriptCoreDLL.cpp: Added.
+        * JavaScriptCore.vcxproj/jsc/DLLLauncherMain.cpp: Call _set_FMA3_enable(0)
+        to disable FMA3 support.
+        * jsc.cpp: Ditto.
+        * testRegExp.cpp: Ditto.
+
+2015-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        The callee frame helpers in DFG::SpeculativeJIT should be available to other JITs
+        https://bugs.webkit.org/show_bug.cgi?id=141493
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::calleeFrameSlot): Deleted.
+        (JSC::DFG::SpeculativeJIT::calleeArgumentSlot): Deleted.
+        (JSC::DFG::SpeculativeJIT::calleeFrameTagSlot): Deleted.
+        (JSC::DFG::SpeculativeJIT::calleeFramePayloadSlot): Deleted.
+        (JSC::DFG::SpeculativeJIT::calleeArgumentTagSlot): Deleted.
+        (JSC::DFG::SpeculativeJIT::calleeArgumentPayloadSlot): Deleted.
+        (JSC::DFG::SpeculativeJIT::calleeFrameCallerFrame): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::calleeFrameSlot):
+        (JSC::AssemblyHelpers::calleeArgumentSlot):
+        (JSC::AssemblyHelpers::calleeFrameTagSlot):
+        (JSC::AssemblyHelpers::calleeFramePayloadSlot):
+        (JSC::AssemblyHelpers::calleeArgumentTagSlot):
+        (JSC::AssemblyHelpers::calleeArgumentPayloadSlot):
+        (JSC::AssemblyHelpers::calleeFrameCallerFrame):
+
+2015-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        SetupVarargsFrame should not assume that an inline stack frame would have identical layout to a normal stack frame
+        https://bugs.webkit.org/show_bug.cgi?id=141485
+
+        Reviewed by Oliver Hunt.
+        
+        The inlineStackOffset argument was meant to make it easy for the DFG to use this helper for
+        vararg calls from inlined code, but that doesn't work since the DFG inline call frame
+        doesn't actually put the argument count at the JSStack::ArgumentCount offset. In fact there
+        is really no such thing as an inlineStackOffset except when we OSR exit; while the code is
+        running the stack layout is compacted so that the stackOffset is not meaningful.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetupVarargsFrameFastCase):
+        * jit/SetupVarargsFrame.h:
+
+2015-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Split FTL::JSCall into the part that knows about call inline caching and the part that interacts with LLVM patchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=141455
+
+        Reviewed by Mark Lam.
+        
+        The newly introduced FTL::JSCallBase can be used to build other things, like the FTL portion
+        of https://bugs.webkit.org/show_bug.cgi?id=141332.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::specializationKindFor):
+        (JSC::CallLinkInfo::specializationKind):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::JSCall):
+        (JSC::FTL::JSCall::emit): Deleted.
+        (JSC::FTL::JSCall::link): Deleted.
+        * ftl/FTLJSCall.h:
+        * ftl/FTLJSCallBase.cpp: Added.
+        (JSC::FTL::JSCallBase::JSCallBase):
+        (JSC::FTL::JSCallBase::emit):
+        (JSC::FTL::JSCallBase::link):
+        * ftl/FTLJSCallBase.h: Added.
+
+2015-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2015-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        op_call_varargs should only load the length once
+        https://bugs.webkit.org/show_bug.cgi?id=141440
+        rdar://problem/19761683
+
+        Reviewed by Michael Saboff.
+        
+        Refactors the pair of calls that set up the varargs frame so that the first call returns the
+        length, and the second call uses the length returned by the first one. It turns out that this
+        gave me an opportunity to shorten a lot of the code.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeFrameForVarargs):
+        (JSC::loadVarargs):
+        (JSC::setupVarargsFrame):
+        (JSC::setupVarargsFrameAndSetThis):
+        * interpreter/Interpreter.h:
+        (JSC::calleeFrameForVarargs):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetVarargsFrame):
+        (JSC::emitSetupVarargsFrameFastCase):
+        * jit/SetupVarargsFrame.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToArguments):
+        * runtime/Arguments.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArray.h:
+        * runtime/VM.h:
+        * tests/stress/call-varargs-length-effects.js: Added.
+        (foo):
+        (bar):
+
+2015-02-10  Michael Saboff  <msaboff@apple.com>
+
+        Crash in JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq
+        https://bugs.webkit.org/show_bug.cgi?id=139398
+
+        Reviewed by Filip Pizlo.
+
+        Due to CFA analysis, the CompareStrictEq node was determined to be unreachable, but later
+        was determined to be reachable.  When we go to lower to LLVM, the edges for the CompareStrictEq
+        node are UntypedUse which we can't compile.  Fixed this by checking that the IR before
+        lowering can still be handled by the FTL.
+
+        Had to add GetArgument as a node that the FTL can compile as the SSA conversion phase converts
+        a SetArgument to a GetArgument.  Before this change FTL::canCompile() would never see a GetArgument
+        node.  With the check right before lowering, we see this node.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl): Added a final FTL::canCompile() check before lowering
+        to verify that after all the transformations we still have valid IR for the FTL.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile): Added GetArgument as a node the FTL can compile.
+
+2015-02-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove unused DFG::SpeculativeJIT::calleeFrameOffset().
+
+        Rubber stamped by Michael Saboff.
+        
+        Not only was this not used, I believe that the math was wrong. The callee frame doesn't
+        actually land past m_nextMachineLocal; instead it lands just below wherever we put SP and
+        that decision is made elsewhere. Also, it makes no sense to subtract 1 from
+        m_nextMachineLocal when trying to deduce the number of in-use stack slots.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::calleeFrameOffset): Deleted.
+
+2015-02-10  Saam Barati  <saambarati1@gmail.com>
+
+        Parser::parseVarDeclarationList gets the wrong JSToken for the last identifier
+        https://bugs.webkit.org/show_bug.cgi?id=141272
+
+        Reviewed by Oliver Hunt.
+
+        This patch fixes a bug where the wrong text location would be 
+        assigned to a variable declaration inside a ForIn/ForOf loop. 
+        It also fixes a bug in the type profiler where the type profiler 
+        emits the wrong text offset for a ForIn loop's variable declarator 
+        when it's not a pattern node.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitLoopHeader):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVarDeclarationList):
+        * tests/typeProfiler/loop.js:
+        (testForIn):
+        (testForOf):
+
+2015-02-09  Saam Barati  <saambarati1@gmail.com>
+
+        JSC's Type Profiler doesn't profile the type of the looping variable in ForOf/ForIn loops
+        https://bugs.webkit.org/show_bug.cgi?id=141241
+
+        Reviewed by Filip Pizlo.
+
+        Type information is now recorded for ForIn and ForOf statements. 
+        It was an oversight to not have these statements profiled before.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        * tests/typeProfiler/loop.js: Added.
+        (testForIn):
+        (testForOf):
+
+2015-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::StackLayoutPhase should always set the scopeRegister to VirtualRegister() because the DFG doesn't do anything to make its value valid
+        https://bugs.webkit.org/show_bug.cgi?id=141412
+
+        Reviewed by Michael Saboff.
+        
+        StackLayoutPhase was attempting to ensure that the register that
+        CodeBlock::scopeRegister() points to is the right one for the DFG. But the DFG did nothing
+        else to maintain the validity of the scopeRegister(). It wasn't captured as far as I can
+        tell. StackLayoutPhase didn't explicitly mark it live. PreciseLocalClobberize didn't mark
+        it as being live. So, by the time we got here the register referred to by
+        CodeBlock::scopeRegister() would have been junk. Moreover, CodeBlock::scopeRegister() was
+        not used for DFG code blocks, and was hardly ever used outside of bytecode generation.
+        
+        So, this patch just removes the code to manipulate this field and replaces it with an
+        unconditional setScopeRegister(VirtualRegister()). Setting it to the invalid register
+        ensures that any attempst to read the scopeRegister in a DFG or FTL frame immediately
+        punts.
+
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+
+2015-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Varargs frame set-up should be factored out for use by other JITs
+        https://bugs.webkit.org/show_bug.cgi?id=141388
+
+        Reviewed by Michael Saboff.
+        
+        Previously the code that dealt with varargs always assumed that we were setting up a varargs call
+        frame by literally following the execution semantics of op_call_varargs. This isn't how it'll
+        happen once the DFG and FTL do varargs calls, or when varargs calls get inlined. The DFG and FTL
+        don't literally execute bytecode; for example their stack frame layout has absolutely nothing in
+        common with what the bytecode says, and that will never change.
+        
+        This patch makes two changes:
+        
+        Setting up the varargs callee frame can be done in smaller steps: particularly in the case of a
+        varargs call that gets inlined, we aren't going to actually want to set up a callee frame in
+        full - we just want to put the arguments somewhere, and that place will not have much (if
+        anything) in common with the call frame format. This patch factors that out into something called
+        a loadVarargs. The thing we used to call loadVarargs is now called setupVarargsFrame. This patch
+        also separates loading varargs from setting this, since the fact that those two things are done
+        together is a detail made explicit in bytecode but it's not at all required in the higher-tier
+        engines. In the process of factoring this code out, I found a bunch of off-by-one errors in the
+        various calculations. I fixed them. The distance from the caller's frame pointer to the callee
+        frame pointer is always:
+        
+            numUsedCallerSlots + argCount + 1 + CallFrameSize
+        
+        where numUsedCallerSlots is toLocal(firstFreeRegister) - 1, which simplifies down to just
+        -firstFreeRegister. The code now speaks of numUsedCallerSlots rather than firstFreeRegister,
+        since the latter is a bytecode peculiarity that doesn't apply in the DFG or FTL. In the DFG, the
+        internally-computed frame size, minus the parameter slots, will be used for numUsedCallerSlots.
+        In the FTL, we will essentially compute numUsedCallerSlots dynamically by subtracting SP from FP.
+        Eventually, LLVM might give us some cleaner way of doing this, but it probably doesn't matter
+        very much.
+        
+        The arguments forwarding optimization is factored out of the Baseline JIT: the DFG and FTL will
+        want to do this optimization as well, but it involves quite a bit of code. So, this code is now
+        factored out into SetupVarargsFrame.h|cpp, so that other JITs can use it. In the process of factoring
+        this code out I noticed that the 32-bit and 64-bit code is nearly identical, so I combined them.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::ExecState::r):
+        (JSC::ExecState::uncheckedR):
+        * bytecode/VirtualRegister.h:
+        (JSC::VirtualRegister::operator+):
+        (JSC::VirtualRegister::operator-):
+        (JSC::VirtualRegister::operator+=):
+        (JSC::VirtualRegister::operator-=):
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeFrameForVarargs):
+        (JSC::loadVarargs):
+        (JSC::setupVarargsFrame):
+        (JSC::setupVarargsFrameAndSetThis):
+        * interpreter/Interpreter.h:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeader32):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeader64):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr): Deleted.
+        (JSC::JIT::emitGetFromCallFrameHeader32): Deleted.
+        (JSC::JIT::emitGetFromCallFrameHeader64): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/SetupVarargsFrame.cpp: Added.
+        (JSC::emitSetupVarargsFrameFastCase):
+        * jit/SetupVarargsFrame.h: Added.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToArguments):
+        * runtime/Arguments.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArray.h:
+
+2015-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG call codegen should resolve the callee operand as late as possible
+        https://bugs.webkit.org/show_bug.cgi?id=141398
+
+        Reviewed by Mark Lam.
+        
+        This is mostly a benign restructuring to help with the implementation of
+        https://bugs.webkit.org/show_bug.cgi?id=141332.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
+2015-02-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should only have two mechanisms for describing effectfulness of nodes; previously there were three
+        https://bugs.webkit.org/show_bug.cgi?id=141369
+
+        Reviewed by Michael Saboff.
+
+        We previously used the NodeMightClobber and NodeClobbersWorld NodeFlags to describe
+        effectfulness.  Starting over a year ago, we introduced a more powerful mechanism - the
+        DFG::clobberize() function.  Now we only have one remaining client of the old NodeFlags,
+        and everyone else uses DFG::clobberize().  We should get rid of those NodeFlags and
+        finally switch everyone over to DFG::clobberize().
+        
+        Unfortunately there is still another place where effectfulness of nodes is described: the
+        AbstractInterpreter. This is because the AbstractInterpreter has special tuning both for
+        compile time performance and there are places where the AI is more precise than
+        clobberize() because of its flow-sensitivity.
+        
+        This means that after this change there will be only two places, rather than three, where
+        the effectfulness of a node has to be described:
+
+        - DFG::clobberize()
+        - DFG::AbstractInterpreter
+
+        * dfg/DFGClobberize.cpp:
+        (JSC::DFG::clobbersWorld):
+        * dfg/DFGClobberize.h:
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteLength):
+        (JSC::DFG::FixupPhase::convertToGetArrayLength):
+        (JSC::DFG::FixupPhase::attemptToMakeGetTypedArrayByteOffset):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::isPredictedNumerical): Deleted.
+        (JSC::DFG::Graph::byValIsPure): Deleted.
+        (JSC::DFG::Graph::clobbersWorld): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToConstant):
+        (JSC::DFG::Node::convertToGetLocalUnlinked):
+        (JSC::DFG::Node::convertToGetByOffset):
+        (JSC::DFG::Node::convertToMultiGetByOffset):
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::convertToMultiPutByOffset):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGNodeType.h:
+
+2015-02-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(DFG_JIT) build
+        https://bugs.webkit.org/show_bug.cgi?id=141387
+
+        Reviewed by Darin Adler.
+
+        * jit/Repatch.cpp:
+
+2015-02-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove a few duplicate propagation steps from the DFG's PredictionPropagation phase
+        https://bugs.webkit.org/show_bug.cgi?id=141363
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        Some blocks were duplicated, they probably evolved separately
+        to the same state.
+
+2015-02-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove useless declarations and a stale comment from DFGByteCodeParser.h
+        https://bugs.webkit.org/show_bug.cgi?id=141361
+
+        Reviewed by Darin Adler.
+
+        The comment refers to the original form of the ByteCodeParser:
+            parse(Graph&, JSGlobalData*, CodeBlock*, unsigned startIndex);
+
+        That form is long dead, the comment is more misleading than anything.
+
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGByteCodeParser.h:
+
+2015-02-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Encapsulate DFG::Plan's beforeFTL timestamp
+        https://bugs.webkit.org/show_bug.cgi?id=141360
+
+        Reviewed by Darin Adler.
+
+        Make the attribute private, it is an internal state.
+
+        Rename beforeFTL->timeBeforeFTL for readability.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+
+2015-02-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove DFGNode::hasArithNodeFlags()
+        https://bugs.webkit.org/show_bug.cgi?id=141319
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArithNodeFlags): Deleted.
+        Unused code is unused.
+
+2015-02-07  Chris Dumez  <cdumez@apple.com>
+
+        Add Vector::removeFirstMatching() / removeAllMatching() methods taking lambda functions
+        https://bugs.webkit.org/show_bug.cgi?id=141321
+
+        Reviewed by Darin Adler.
+
+        Use new Vector::removeFirstMatching() / removeAllMatching() methods.
+
+2015-02-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG SSA shouldn't have SetArgument nodes
+        https://bugs.webkit.org/show_bug.cgi?id=141342
+
+        Reviewed by Mark Lam.
+
+        I was wondering why we kept the SetArgument around for captured
+        variables. It turns out we did so because we thought we had to, even
+        though we didn't have to. The node is meaningless in SSA.
+
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+
+2015-02-06  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to use the DFG SetArgument node to indicate that someone set the value of a local out-of-band
+        https://bugs.webkit.org/show_bug.cgi?id=141337
+
+        Reviewed by Mark Lam.
+
+        This mainly involved ensuring that SetArgument behaves just like SetLocal from a CPS standpoint, but with a special case for those SetArguments that
+        are associated with the prologue.
+
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::run):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeSet):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+        (JSC::DFG::CPSRethreadingPhase::specialCaseArguments):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeSetLocal): Deleted.
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeSetArgument): Deleted.
+
+2015-02-06  Mark Lam  <mark.lam@apple.com>
+
+        MachineThreads should be ref counted.
+        <https://webkit.org/b/141317>
+
+        Reviewed by Filip Pizlo.
+
+        The VM's MachineThreads registry object is being referenced from other
+        threads as a raw pointer.  In a scenario where the VM is destructed on
+        the main thread, there is no guarantee that another thread isn't still
+        holding a reference to the registry and will eventually invoke
+        removeThread() on it on thread exit.  Hence, there's a possible use
+        after free scenario here.
+
+        The fix is to make MachineThreads ThreadSafeRefCounted, and have all
+        threads that references keep a RefPtr to it to ensure that it stays
+        alive until the very last thread is done with it.
+
+        * API/tests/testapi.mm:
+        (useVMFromOtherThread): - Renamed to be more descriptive.
+        (useVMFromOtherThreadAndOutliveVM):
+        - Added a test that has another thread which uses the VM outlive the
+          VM to confirm that there is no crash.
+
+          However, I was not actually able to get the VM to crash without this
+          patch because I wasn't always able to the thread destructor to be
+          called.  With this patch applied, I did verify with some logging that
+          the MachineThreads registry is only destructed after all threads
+          have removed themselves from it.
+
+        (threadMain): Deleted.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::~Heap):
+        (JSC::Heap::gatherStackRoots):
+        * heap/Heap.h:
+        (JSC::Heap::machineThreads):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeCurrentThread):
+        * heap/MachineStackMarker.h:
+
+2015-02-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r179743.
+        https://bugs.webkit.org/show_bug.cgi?id=141335
+
+        caused missing symbols in non-WebKit clients of WTF::Vector
+        (Requested by kling on #webkit).
+
+        Reverted changeset:
+
+        "Remove WTF::fastMallocGoodSize()."
+        https://bugs.webkit.org/show_bug.cgi?id=141020
+        http://trac.webkit.org/changeset/179743
+
+2015-02-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove BytecodeGenerator::preserveLastVar() and replace it with a more robust mechanism for preserving non-temporary registers
+        https://bugs.webkit.org/show_bug.cgi?id=141211
+
+        Reviewed by Mark Lam.
+
+        Previously, the way non-temporary registers were preserved (i.e. not reclaimed anytime
+        we did newTemporary()) by calling preserveLastVar() after all non-temps are created. It
+        would raise the refcount on the last (highest-numbered) variable created, and rely on
+        the fact that register reclamation started at higher-numbered registers and worked its
+        way down. So any retained register would block any lower-numbered registers from being
+        reclaimed.
+        
+        Also, preserveLastVar() sets a thing called m_firstConstantIndex. It's unused.
+        
+        This removes preserveLastVar() and makes addVar() retain each register it creates. This
+        is more explicit, since addVar() is the mechanism for creating non-temporary registers.
+        
+        To make this work I had to remove an assertion that Register::setIndex() can only be
+        called when the refcount is zero. This method might be called after a var is created to
+        change its index. This previously worked because preserveLastVar() would be called after
+        we had already made all index changes, so the vars would still have refcount zero. Now
+        they have refcount 1. I think it's OK to lose this assertion; I can't remember this
+        assertion ever firing in a way that alerted me to a serious issue.
+        
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::preserveLastVar): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::addVar):
+        * bytecompiler/RegisterID.h:
+        (JSC::RegisterID::setIndex):
+
+2015-02-06  Andreas Kling  <akling@apple.com>
+
+        Remove WTF::fastMallocGoodSize().
+        <https://webkit.org/b/141020>
+
+        Reviewed by Anders Carlsson.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerData::AssemblerData):
+        (JSC::AssemblerData::grow):
+
+2015-02-05  Michael Saboff  <msaboff@apple.com>
+
+        CodeCache is not thread safe when adding the same source from two different threads
+        https://bugs.webkit.org/show_bug.cgi?id=141275
+
+        Reviewed by Mark Lam.
+
+        The issue for this bug is that one thread, takes a cache miss in CodeCache::getGlobalCodeBlock,
+        but in the process creates a cache entry with a nullptr UnlinkedCodeBlockType* which it
+        will fill in later in the function.  During the body of that function, it allocates
+        objects that may garbage collect.  During that garbage collection, we drop the all locks.
+        While the locks are released by the first thread, another thread can enter the VM and might
+        have exactly the same source and enter CodeCache::getGlobalCodeBlock() itself.  When it
+        looks up the code block, it sees it as a cache it and uses the nullptr UnlinkedCodeBlockType*
+        and crashes.  This fixes the problem by not dropping the locks during garbage collection.
+        There are other likely scenarios where we have a data structure like this code cache in an
+        unsafe state for arbitrary reentrance.
+
+        Moved the functionality of DelayedReleaseScope directly into Heap.  Changed it into
+        a simple list that is cleared with the new function Heap::releaseDelayedReleasedObjects.
+        Now we accumulate objects to be released and release them when all locks are dropped or
+        when destroying the Heap.  This eliminated the dropping and reaquiring of locks associated
+        with the old scope form of this list.
+
+        Given that all functionality of DelayedReleaseScope is now used and referenced by Heap
+        and the lock management no longer needs to be done, just made the list a member of Heap.
+        We do need to guard against the case that releasing an object can create more objects
+        by calling into JS.  That is why releaseDelayedReleasedObjects() is written to remove
+        an object to release so that we aren't recursively in Vector code.  The other thing we
+        do in releaseDelayedReleasedObjects() is to guard against recursive calls to itself using
+        the m_delayedReleaseRecursionCount.  We only release at the first entry into the function.
+        This case is already tested by testapi.mm.
+
+        * heap/DelayedReleaseScope.h: Removed file
+
+        * API/JSAPIWrapperObject.mm:
+        * API/ObjCCallbackFunction.mm:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doSweep):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::tryAllocate):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweep):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+        (JSC::MarkedSpace::didFinishIterating):
+        * heap/MarkedSpace.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::zombifyDeadObjects):
+        Removed references to DelayedReleaseScope and DelayedReleaseScope.h.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap): Initialized m_delayedReleaseRecursionCount.
+        (JSC::Heap::lastChanceToFinalize): Call releaseDelayedObjectsNow() as the VM is going away.
+        (JSC::Heap::releaseDelayedReleasedObjects): New function that released the accumulated
+        delayed release objects.
+
+        * heap/Heap.h:
+        (JSC::Heap::m_delayedReleaseObjects): List of objects to be released later.
+        (JSC::Heap::m_delayedReleaseRecursionCount): Counter to indicate that
+        releaseDelayedReleasedObjects is being called recursively.
+        * heap/HeapInlines.h:
+        (JSC::Heap::releaseSoon): Changed location of list to add delayed release objects.
+        
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::willReleaseLock):
+        Call Heap::releaseDelayedObjectsNow() when releasing the lock.
+
+2015-02-05  Youenn Fablet  <youenn.fablet@crf.canon.fr> and Xabier Rodriguez Calvar <calvaris@igalia.com>
+
+        [Streams API] Implement a barebone ReadableStream interface
+        https://bugs.webkit.org/show_bug.cgi?id=141045
+
+        Reviewed by Benjamin Poulain.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-02-05  Saam Barati  <saambarati1@gmail.com>
+
+        Crash in uninitialized deconstructing variable.
+        https://bugs.webkit.org/show_bug.cgi?id=141070
+
+        Reviewed by Michael Saboff.
+
+        According to the ES6 spec, when a destructuring pattern occurs
+        as the left hand side of an assignment inside a var declaration 
+        statement, the assignment must also have a right hand side value.
+        "var {x} = {};" is a legal syntactic statement, but,
+        "var {x};" is a syntactic error.
+
+        Section 13.2.2 of the latest draft ES6 spec specifies this requirement:
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-variable-statement
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVarDeclaration):
+        (JSC::Parser<LexerType>::parseVarDeclarationList):
+        (JSC::Parser<LexerType>::parseForStatement):
+        * parser/Parser.h:
+
+2015-02-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed, fix a build break on EFL port since r179648.
+
+        * heap/MachineStackMarker.cpp: EFL port doesn't use previousThread variable. 
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+
+2015-02-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ES6: Improved Console Support for Symbol Objects
+        https://bugs.webkit.org/show_bug.cgi?id=141173
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Runtime.json:
+        New type, "symbol".
+
+        * inspector/InjectedScriptSource.js:
+        Handle Symbol objects in a few places. They don't have properties
+        and they cannot be implicitly converted to strings.
+
+2015-02-04  Mark Lam  <mark.lam@apple.com>
+
+        Undo gardening: Restoring the expected ERROR message since that is not the cause of the bot unhappiness.
+
+        Not reviewed.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+
+2015-02-04  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: Changed expected ERROR message to WARNING to make test bots happy.
+
+        Rubber stamped by Simon Fraser.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+
+2015-02-04  Mark Lam  <mark.lam@apple.com>
+
+        r179576 introduce a deadlock potential during GC thread suspension.
+        <https://webkit.org/b/141268>
+
+        Reviewed by Michael Saboff.
+
+        http://trac.webkit.org/r179576 introduced a potential for deadlocking.
+        In the GC thread suspension loop, we currently delete
+        MachineThreads::Thread that we detect to be invalid.  This is unsafe
+        because we may have already suspended some threads, and one of those
+        suspended threads may still be holding the C heap lock which we need
+        for deleting the invalid thread.
+
+        The fix is to put the invalid threads in a separate toBeDeleted list,
+        and delete them only after GC has resumed all threads.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::removeCurrentThread):
+        - Undo refactoring removeThreadWithLockAlreadyAcquired() out of
+          removeCurrentThread() since it is no longer needed.
+
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        - Put invalid Threads on a threadsToBeDeleted list, and delete those
+          Threads only after all threads have been resumed.
+
+        (JSC::MachineThreads::removeThreadWithLockAlreadyAcquired): Deleted.
+        * heap/MachineStackMarker.h:
+
+2015-02-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Clean up Object Property Descriptor Collection
+        https://bugs.webkit.org/show_bug.cgi?id=141222
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        Use a list of options when determining which properties to collect
+        instead of a few booleans with overlapping responsibilities.
+
+2015-02-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: console.table with columnName filter for non-existent property should still show column
+        https://bugs.webkit.org/show_bug.cgi?id=141066
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::addToFrontend):
+        When a user provides a second argument, e.g. console.table(..., columnNames),
+        then pass that second argument to the frontend.
+
+        * inspector/InjectedScriptSource.js:
+        Add a FIXME about the old, unused path now.
+
+2015-02-04  Saam Barati  <saambarati1@gmail.com>
+
+        TypeSet can use 1 byte instead of 4 bytes for its m_seenTypes member variable
+        https://bugs.webkit.org/show_bug.cgi?id=141204
+
+        Reviewed by Darin Adler.
+
+        There is no need to use 32 bits to store a TypeSet::RuntimeType set 
+        bit-vector when the largest value for a single TypeSet::RuntimeType 
+        is 0x80. 8 bits is enough to represent the set of seen types.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::doesTypeConformTo):
+        * runtime/TypeSet.h:
+        (JSC::TypeSet::seenTypes):
+
+2015-02-04  Mark Lam  <mark.lam@apple.com>
+
+        Remove concept of makeUsableFromMultipleThreads().
+        <https://webkit.org/b/141221>
+
+        Reviewed by Mark Hahnenberg.
+
+        Currently, we rely on VM::makeUsableFromMultipleThreads() being called before we
+        start acquiring the JSLock and entering the VM from different threads.
+        Acquisition of the JSLock will register the acquiring thread with the VM's thread
+        registry if not already registered.  However, it will only do this if the VM's
+        thread specific key has been initialized by makeUsableFromMultipleThreads().
+
+        This is fragile, and also does not read intuitively because one would expect to
+        acquire the JSLock before calling any methods on the VM.  This is exactly what
+        JSGlobalContextCreateInGroup() did (i.e. acquire the lock before calling
+        makeUsableFromMultipleThreads()), but is wrong.  The result is that the invoking
+        thread will not have been registered with the VM during that first entry into
+        the VM.
+
+        The fix is to make it so that we initialize the VM's thread specific key on
+        construction of the VM's MachineThreads registry instead of relying on
+        makeUsableFromMultipleThreads() being called.  With this, we can eliminate
+        makeUsableFromMultipleThreads() altogether.
+
+        Performance results are neutral in aggregate.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        (JSC::MachineThreads::makeUsableFromMultipleThreads): Deleted.
+        * heap/MachineStackMarker.h:
+        * runtime/VM.cpp:
+        (JSC::VM::sharedInstance):
+        * runtime/VM.h:
+        (JSC::VM::makeUsableFromMultipleThreads): Deleted.
+
+2015-02-04  Chris Dumez  <cdumez@apple.com>
+
+        Add removeFirst(value) / removeAll(value) methods to WTF::Vector
+        https://bugs.webkit.org/show_bug.cgi?id=141192
+
+        Reviewed by Benjamin Poulain.
+
+        Use new Vector::removeFirst(value) / removeAll(value) API to simplify the
+        code a bit.
+
+        * inspector/InspectorValues.cpp:
+        (Inspector::InspectorObjectBase::remove):
+
+2015-02-03  Mark Lam  <mark.lam@apple.com>
+
+        Workaround a thread library bug where thread destructors may not get called.
+        <https://webkit.org/b/141209>
+
+        Reviewed by Michael Saboff.
+
+        There's a bug where thread destructors may not get called.  As far as
+        we know, this only manifests on darwin ports.  We will work around this
+        by checking at GC time if the platform thread is still valid.  If not,
+        we'll purge it from the VM's registeredThreads list before proceeding
+        with thread scanning activity.
+
+        Note: it is important that we do this invalid thread detection during
+        suspension, because the validity (and liveness) of the other thread is
+        only guaranteed while it is suspended.
+
+        * API/tests/testapi.mm:
+        (threadMain):
+        - Added a test to enter the VM from another thread before we GC on
+          the main thread.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::removeThreadWithLockAlreadyAcquired):
+        (JSC::MachineThreads::removeCurrentThread):
+        - refactored removeThreadWithLockAlreadyAcquired() out from
+          removeCurrentThread() so that we can also call it for purging invalid
+          threads.
+        (JSC::suspendThread):
+        - Added a return status to tell if the suspension succeeded or not.
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        - Check if the suspension failed, and purge the thread if we can't
+          suspend it.  Failure to suspend implies that the thread has
+          terminated without calling its destructor.
+        * heap/MachineStackMarker.h:
+
+2015-02-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ASSERT mainThreadPthread launching remote debuggable JSContext app with Debug JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=141189
+
+        Reviewed by Michael Saboff.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::singleton):
+        Ensure we call WTF::initializeMainThread() on the main thread so that
+        we can perform automatic String <-> NSString conversions.
+
+2015-02-03  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Project file cleanups after r179429.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2015-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        arguments[-1] should have well-defined behavior
+        https://bugs.webkit.org/show_bug.cgi?id=141183
+
+        Reviewed by Mark Lam.
+        
+        According to JSC's internal argument numbering, 0 is "this" and 1 is the first argument.
+        In the "arguments[i]" expression, "this" is not accessible and i = 0 refers to the first
+        argument. Previously we handled the bounds check in "arguments[i]" - where "arguments" is
+        statically known to be the current function's arguments object - as follows:
+        
+            add 1, i
+            branchAboveOrEqual i, callFrame.ArgumentCount, slowPath
+        
+        The problem with this is that if i = -1, this passes the test, and we end up accessing
+        what would be the "this" argument slot. That's wrong, since we should really be bottoming
+        out in arguments["-1"], which is usually undefined but could be anything. It's even worse
+        if the function is inlined or if we're in a constructor - in that case the "this" slot
+        could be garbage.
+        
+        It turns out that we had this bug in all of our engines.
+        
+        This fixes the issue by changing the algorithm to:
+        
+            load32 callFrame.ArgumentCount, tmp
+            sub 1, tmp
+            branchAboveOrEqual i, tmp, slowPath
+        
+        In some engines, we would have used the modified "i" (the one that had 1 added to it) for
+        the subsequent argument load; since we don't do this anymore I also had to change some of
+        the offsets on the BaseIndex arguments load.
+        
+        This also includes tests that are written in such a way as to get coverage on LLInt and
+        Baseline JIT (get-my-argument-by-val-wrap-around-no-warm-up), DFG and FTL
+        (get-my-argument-by-val-wrap-around), and DFG when we're being paranoid about the user
+        overwriting the "arguments" variable (get-my-argument-by-val-safe-wrap-around). This also
+        includes off-by-1 out-of-bounds tests for each of these cases, since in the process of
+        writing the patch I broke the arguments[arguments.length] case in the DFG and didn't see
+        any test failures.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::offsetOfArguments):
+        (JSC::AssemblyHelpers::offsetOfArgumentsIncludingThis): Deleted.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_argument_by_val):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * tests/stress/get-my-argument-by-val-out-of-bounds-no-warm-up.js: Added.
+        (foo):
+        * tests/stress/get-my-argument-by-val-out-of-bounds.js: Added.
+        (foo):
+        * tests/stress/get-my-argument-by-val-safe-out-of-bounds.js: Added.
+        (foo):
+        * tests/stress/get-my-argument-by-val-safe-wrap-around.js: Added.
+        (foo):
+        * tests/stress/get-my-argument-by-val-wrap-around-no-warm-up.js: Added.
+        (foo):
+        * tests/stress/get-my-argument-by-val-wrap-around.js: Added.
+        (foo):
+
+2015-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        MultiGetByOffset should be marked NodeMustGenerate
+        https://bugs.webkit.org/show_bug.cgi?id=140137
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToGetByOffset): We were sloppy - we should also clear NodeMustGenerate once it's a GetByOffset.
+        (JSC::DFG::Node::convertToMultiGetByOffset): Assert that we converted from something that already had NodeMustGenerate.
+        * dfg/DFGNodeType.h: We shouldn't DCE a node that does checks and could be effectful in baseline. Making MultiGetByOffset as NodeMustGenerate prevents DCE. FTL could still DCE the actual loads, but the checks will stay.
+        * tests/stress/multi-get-by-offset-dce.js: Added. This previously failed because the getter wasn't called.
+        (foo):
+
+2015-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        [FTL] inlined GetMyArgumentByVal with no arguments passed causes instant crash
+        https://bugs.webkit.org/show_bug.cgi?id=141180
+        rdar://problem/19677552
+
+        Reviewed by Benjamin Poulain.
+        
+        If we do a GetMyArgumentByVal on an inlined call frame that has no arguments, then the
+        bounds check already terminates execution. This means we can skip the part where we
+        previously did an out-of-bound array access on the inlined call frame arguments vector.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::safelyInvalidateAfterTermination):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+        (JSC::FTL::LowerDFGToLLVM::terminate):
+        (JSC::FTL::LowerDFGToLLVM::didAlreadyTerminate):
+        (JSC::FTL::LowerDFGToLLVM::crash):
+        * tests/stress/get-my-argument-by-val-inlined-no-formal-parameters.js: Added.
+        (foo):
+        (bar):
+
+2015-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r179477): arguments simplification no longer works
+        https://bugs.webkit.org/show_bug.cgi?id=141169
+
+        Reviewed by Mark Lam.
+        
+        The operations involved in callee/scope access don't exit and shouldn't get in the way
+        of strength-reducing a Flush to a PhantomLocal. Then the PhantomLocal shouldn't get in
+        the way of further such strength-reduction. We also need to canonicalize PhantomLocal
+        before running arguments simplification.
+
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+
+2015-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        VirtualRegister should really know how to dump itself
+        https://bugs.webkit.org/show_bug.cgi?id=141171
+
+        Reviewed by Geoffrey Garen.
+        
+        Gives VirtualRegister a dump() method that pretty-prints the virtual register. The rest of
+        the patch is all about using this new power.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::constantName):
+        (JSC::CodeBlock::registerName):
+        * bytecode/CodeBlock.h:
+        (JSC::missingThisObjectMarker): Deleted.
+        * bytecode/VirtualRegister.cpp: Added.
+        (JSC::VirtualRegister::dump):
+        * bytecode/VirtualRegister.h:
+        (WTF::printInternal): Deleted.
+        * dfg/DFGArgumentPosition.h:
+        (JSC::DFG::ArgumentPosition::dump):
+        * dfg/DFGFlushedAt.cpp:
+        (JSC::DFG::FlushedAt::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGPutLocalSinkingPhase.cpp:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::reportValidationContext):
+        * dfg/DFGValueSource.cpp:
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGVariableEvent.cpp:
+        (JSC::DFG::VariableEvent::dump):
+        (JSC::DFG::VariableEvent::dumpSpillInfo):
+        * ftl/FTLExitArgumentForOperand.cpp:
+        (JSC::FTL::ExitArgumentForOperand::dump):
+        * ftl/FTLExitValue.cpp:
+        (JSC::FTL::ExitValue::dumpInContext):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::BytecodeSequence):
+
+2015-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-landing just the HandleBlock piece of this patch.
+
+        * heap/HandleBlock.h:
+        * heap/HandleBlockInlines.h:
+        (JSC::HandleBlock::create):
+        (JSC::HandleBlock::destroy):
+        (JSC::HandleBlock::HandleBlock):
+        (JSC::HandleBlock::payloadEnd):
+        * heap/HandleSet.cpp:
+        (JSC::HandleSet::~HandleSet):
+        (JSC::HandleSet::grow):
+
+2015-02-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Support console.table
+        https://bugs.webkit.org/show_bug.cgi?id=141058
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        Include the firstLevelKeys filter when generating previews.
+
+        * runtime/ConsoleClient.cpp:
+        (JSC::appendMessagePrefix):
+        Differentiate console.table logs to system log.
+
+2015-01-31  Filip Pizlo  <fpizlo@apple.com>
+
+        BinarySwitch should be faster on average
+        https://bugs.webkit.org/show_bug.cgi?id=141046
+
+        Reviewed by Anders Carlsson.
+        
+        This optimizes our binary switch using math. It's strictly better than what we had before
+        assuming we bottom out in some case (rather than fall through), assuming all cases get
+        hit with equal probability. The difference is particularly large for large switch
+        statements. For example, a switch statement with 1000 cases would previously require on
+        average 13.207 branches to get to some case, while now it just requires 10.464.
+        
+        This is also a progression for the fall-through case, though we could shave off another
+        1/6 branch on average if we wanted to - though it would regress taking a case (not falling
+        through) by 1/6 branch. I believe it's better to bias the BinarySwitch for not falling
+        through.
+        
+        This also adds some randomness to the algorithm to minimize the likelihood of us
+        generating a switch statement that is always particularly bad for some input. Note that
+        the randomness has no effect on average-case performance assuming all cases are equally
+        likely.
+        
+        This ought to have no actual performance change because we don't rely on binary switches
+        that much. The main reason why this change is interesting is that I'm finding myself
+        increasingly relying on BinarySwitch, and I'd like to know that it's optimal.
+
+        * jit/BinarySwitch.cpp:
+        (JSC::BinarySwitch::BinarySwitch):
+        (JSC::BinarySwitch::~BinarySwitch):
+        (JSC::BinarySwitch::build):
+        * jit/BinarySwitch.h:
+
+2015-02-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Extend CSS.getSupportedCSSProperties to provide values for properties for CSS Augmented JSContext
+        https://bugs.webkit.org/show_bug.cgi?id=141064
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/CSS.json:
+
+2015-02-02  Daniel Bates  <dabates@apple.com>
+
+        [iOS] ASSERTION FAILED: m_scriptExecutionContext->isContextThread() in ContextDestructionObserver::observeContext
+        https://bugs.webkit.org/show_bug.cgi?id=141057
+        <rdar://problem/19068790>
+
+        Reviewed by Alexey Proskuryakov.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::receivedIndicateMessage): Modified to call WTF::callOnWebThreadOrDispatchAsyncOnMainThread().
+        (Inspector::dispatchAsyncOnQueueSafeForAnyDebuggable): Deleted; moved logic to common helper function,
+        WTF::callOnWebThreadOrDispatchAsyncOnMainThread() so that it can be called from both RemoteInspector::receivedIndicateMessage()
+        and CryptoKeyRSA::generatePair().
+
+2015-02-02  Saam Barati  <saambarati1@gmail.com>
+
+        Create tests for JSC's Control Flow Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=141123
+
+        Reviewed by Filip Pizlo.
+
+        This patch creates a control flow profiler testing API in jsc.cpp 
+        that accepts a function and a string as arguments. The string must 
+        be a substring of the text of the function argument. The API returns 
+        a boolean indicating whether or not the basic block that encloses the 
+        substring has executed.
+
+        This patch uses this API to test that the control flow profiler
+        behaves as expected on basic block boundaries. These tests do not
+        provide full coverage for all JavaScript statements that can create
+        basic blocks boundaries. Full coverage will come in a later patch.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionHasBasicBlockExecuted):
+        * runtime/ControlFlowProfiler.cpp:
+        (JSC::ControlFlowProfiler::hasBasicBlockAtTextOffsetBeenExecuted):
+        * runtime/ControlFlowProfiler.h:
+        * tests/controlFlowProfiler: Added.
+        * tests/controlFlowProfiler.yaml: Added.
+        * tests/controlFlowProfiler/driver: Added.
+        * tests/controlFlowProfiler/driver/driver.js: Added.
+        (assert):
+        * tests/controlFlowProfiler/if-statement.js: Added.
+        (testIf):
+        (noMatches):
+        * tests/controlFlowProfiler/loop-statements.js: Added.
+        (forRegular):
+        (forIn):
+        (forOf):
+        (whileLoop):
+        * tests/controlFlowProfiler/switch-statements.js: Added.
+        (testSwitch):
+        * tests/controlFlowProfiler/test-jit.js: Added.
+        (tierUpToBaseline):
+        (tierUpToDFG):
+        (baselineTest):
+        (dfgTest):
+
+2015-01-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Polymorphic call inlining should be based on polymorphic call inline caching rather than logging
+        https://bugs.webkit.org/show_bug.cgi?id=140660
+
+        Reviewed by Geoffrey Garen.
+        
+        When we first implemented polymorphic call inlining, we did the profiling based on a call
+        edge log. The idea was to store each call edge (a tuple of call site and callee) into a
+        global log that was processed lazily. Processing the log would give precise counts of call
+        edges, and could be used to drive well-informed inlining decisions - polymorphic or not.
+        This was a speed-up on throughput tests but a slow-down for latency tests. It was a net win
+        nonetheless.
+        
+        Experience with this code shows three things. First, the call edge profiler is buggy and
+        complex. It would take work to fix the bugs. Second, the call edge profiler incurs lots of
+        overhead for latency code that we care deeply about. Third, it's not at all clear that
+        having call edge counts for every possible callee is any better than just having call edge
+        counts for the limited number of callees that an inline cache would catch.
+        
+        So, this patch removes the call edge profiler and replaces it with a polymorphic call inline
+        cache. If we miss the basic call inline cache, we inflate the cache to be a jump to an
+        out-of-line stub that cases on the previously known callees. If that misses again, then we
+        rewrite that stub to include the new callee. We do this up to some number of callees. If we
+        hit the limit then we switch to using a plain virtual call.
+        
+        Substantial speed-up on V8Spider; undoes the slow-down that the original call edge profiler
+        caused. Might be a SunSpider speed-up (below 1%), depending on hardware.
+        
+        Rolling this back in after fixing https://bugs.webkit.org/show_bug.cgi?id=141107.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallEdge.h:
+        (JSC::CallEdge::count):
+        (JSC::CallEdge::CallEdge):
+        * bytecode/CallEdgeProfile.cpp: Removed.
+        * bytecode/CallEdgeProfile.h: Removed.
+        * bytecode/CallEdgeProfileInlines.h: Removed.
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkInfo.h:
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+        (JSC::CallLinkStatus::isClosureCall):
+        (JSC::CallLinkStatus::makeClosureCall):
+        (JSC::CallLinkStatus::dump):
+        (JSC::CallLinkStatus::computeFromCallEdgeProfile): Deleted.
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::variants):
+        (JSC::CallLinkStatus::size):
+        (JSC::CallLinkStatus::at):
+        (JSC::CallLinkStatus::operator[]):
+        (JSC::CallLinkStatus::canOptimize):
+        (JSC::CallLinkStatus::edges): Deleted.
+        (JSC::CallLinkStatus::canTrustCounts): Deleted.
+        * bytecode/CallVariant.cpp:
+        (JSC::variantListWithVariant):
+        (JSC::despecifiedVariantList):
+        * bytecode/CallVariant.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::linkIncomingPolymorphicCall):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::noticeIncomingCall):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isIncomingCallAlreadyLinked): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        (JSC::DFG::TierUpCheckInjectionPhase::removeFTLProfiling): Deleted.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * jit/BinarySwitch.h:
+        * jit/ClosureCallStubRoutine.cpp: Removed.
+        * jit/ClosureCallStubRoutine.h: Removed.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        (JSC::operationLinkPolymorphicCallFor):
+        (JSC::operationLinkClosureCallFor): Deleted.
+        * jit/JITStubRoutine.h:
+        * jit/JITWriteBarrier.h:
+        * jit/PolymorphicCallStubRoutine.cpp: Added.
+        (JSC::PolymorphicCallNode::~PolymorphicCallNode):
+        (JSC::PolymorphicCallNode::unlink):
+        (JSC::PolymorphicCallCase::dump):
+        (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
+        (JSC::PolymorphicCallStubRoutine::~PolymorphicCallStubRoutine):
+        (JSC::PolymorphicCallStubRoutine::variants):
+        (JSC::PolymorphicCallStubRoutine::edges):
+        (JSC::PolymorphicCallStubRoutine::visitWeak):
+        (JSC::PolymorphicCallStubRoutine::markRequiredObjectsInternal):
+        * jit/PolymorphicCallStubRoutine.h: Added.
+        (JSC::PolymorphicCallNode::PolymorphicCallNode):
+        (JSC::PolymorphicCallCase::PolymorphicCallCase):
+        (JSC::PolymorphicCallCase::variant):
+        (JSC::PolymorphicCallCase::codeBlock):
+        * jit/Repatch.cpp:
+        (JSC::linkSlowFor):
+        (JSC::linkFor):
+        (JSC::revertCall):
+        (JSC::unlinkFor):
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        (JSC::linkClosureCall): Deleted.
+        * jit/Repatch.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::linkPolymorphicCallForThunkGenerator):
+        (JSC::linkPolymorphicCallThunkGenerator):
+        (JSC::linkPolymorphicCallThatPreservesRegsThunkGenerator):
+        (JSC::linkClosureCallForThunkGenerator): Deleted.
+        (JSC::linkClosureCallThunkGenerator): Deleted.
+        (JSC::linkClosureCallThatPreservesRegsThunkGenerator): Deleted.
+        * jit/ThunkGenerators.h:
+        (JSC::linkPolymorphicCallThunkGeneratorFor):
+        (JSC::linkClosureCallThunkGeneratorFor): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::prepareToDiscardCode):
+        (JSC::VM::ensureCallEdgeLog): Deleted.
+        * runtime/VM.h:
+
+2015-01-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Converting Flushes and PhantomLocals to Phantoms requires an OSR availability analysis rather than just using the SetLocal's child
+        https://bugs.webkit.org/show_bug.cgi?id=141107
+
+        Reviewed by Michael Saboff.
+        
+        See the bugzilla for a discussion of the problem. This addresses the problem by ensuring
+        that Flushes are always strength-reduced to PhantomLocals, and CPS rethreading does a mini
+        OSR availability analysis to determine the right MovHint value to use for the Phantom.
+
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        (JSC::DFG::CPSRethreadingPhase::clearVariables):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
+        (JSC::DFG::CPSRethreadingPhase::clearVariablesAtHeadAndTail): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertPhantomToPhantomLocal):
+        (JSC::DFG::Node::convertFlushToPhantomLocal):
+        (JSC::DFG::Node::convertToPhantomLocal): Deleted.
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * tests/stress/inline-call-that-doesnt-use-all-args.js: Added.
+        (foo):
+        (bar):
+        (baz):
+
+2015-01-31  Michael Saboff  <msaboff@apple.com>
+
+        Crash (DFG assertion) beneath AbstractInterpreter::verifyEdge() @ http://experilous.com/1/planet-generator/2014-09-28/version-1
+        https://bugs.webkit.org/show_bug.cgi?id=141111
+
+        Reviewed by Filip Pizlo.
+
+        In LowerDFGToLLVM::compileNode(), if we determine while compiling a node that we would have
+        exited, we don't need to process the OSR availability or abstract interpreter.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::safelyInvalidateAfterTermination): Broke this out a a separate
+        method since we need to call it at the top and near the bottom of compileNode().
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+
+2015-01-31  Sam Weinig  <sam@webkit.org>
+
+        Remove even more Mountain Lion support
+        https://bugs.webkit.org/show_bug.cgi?id=141124
+
+        Reviewed by Alexey Proskuryakov.
+
+        * API/tests/DateTests.mm:
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2015-01-31  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r179426.
+        https://bugs.webkit.org/show_bug.cgi?id=141119
+
+        "caused a memory use regression" (Requested by Guest45 on
+        #webkit).
+
+        Reverted changeset:
+
+        "Use FastMalloc (bmalloc) instead of BlockAllocator for GC
+        pages"
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+        http://trac.webkit.org/changeset/179426
+
+2015-01-30  Daniel Bates  <dabates@apple.com>
+
+        Clean up: Remove unnecessary <dispatch/dispatch.h> header from RemoteInspectorDebuggableConnection.h
+        https://bugs.webkit.org/show_bug.cgi?id=141067
+
+        Reviewed by Timothy Hatcher.
+
+        Remove the header <dispatch/dispatch.h> from RemoteInspectorDebuggableConnection.h as we
+        do not make use of its functionality. Instead, include this header in RemoteInspectorDebuggableConnection.mm
+        and RemoteInspector.mm. The latter depended on <dispatch/dispatch.h> being included via
+        header RemoteInspectorDebuggableConnection.h.
+
+        * inspector/remote/RemoteInspector.mm: Include header <dispatch/dispatch.h>.
+        * inspector/remote/RemoteInspectorDebuggableConnection.h: Remove header <dispatch/dispatch.h>.
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm: Include header <dispatch/dispatch.h>.
+
+2015-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Implement ES6 Symbol
+        https://bugs.webkit.org/show_bug.cgi?id=140435
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements ES6 Symbol. In this patch, we don't support
+        Symbol.keyFor, Symbol.for, Object.getOwnPropertySymbols. They will be
+        supported in the subsequent patches.
+
+        Since ES6 Symbol is introduced as new primitive value, we implement
+        Symbol as a derived class from JSCell. And now JSValue accepts Symbol*
+        as a new primitive value.
+
+        Symbol has a *unique* flagged StringImpl* as an `uid`. Which pointer
+        value represents the Symbol's identity. So don't compare Symbol's
+        JSCell pointer value for comparison.
+        This enables re-producing Symbol primitive value from StringImpl* uid
+        by executing`Symbol::create(vm, uid)`. This is needed to produce
+        Symbol primitive values from stored StringImpl* in `Object.getOwnPropertySymbols`.
+
+        And Symbol.[[Description]] is folded into the string value of Symbol's uid.
+        By doing so, we can represent ES6 Symbol without extending current PropertyTable key; StringImpl*.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.order:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * builtins/BuiltinNames.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        * interpreter/Interpreter.cpp:
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::synthesizePrototype):
+        (JSC::JSValue::dumpInContextAssumingStructure):
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isSymbol):
+        (JSC::JSValue::isPrimitive):
+        (JSC::JSValue::toPropertyKey):
+
+        It represents ToPropertyKey abstract operation in the ES6 spec.
+        It cleans up the old implementation's `isName` checks.
+        And to prevent performance regressions in
+            js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html
+            js/regress/fold-get-by-id-to-multi-get-by-offset.html
+        we annnotate this function as ALWAYS_INLINE.
+
+        (JSC::JSValue::getPropertySlot):
+        (JSC::JSValue::get):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::putByIndex):
+        (JSC::JSCell::toPrimitive):
+        (JSC::JSCell::getPrimitiveNumber):
+        (JSC::JSCell::toNumber):
+        (JSC::JSCell::toObject):
+        * runtime/JSCell.h:
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::isSymbol):
+        (JSC::JSCell::toBoolean):
+        (JSC::JSCell::pureToBoolean):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::symbolPrototype):
+        (JSC::JSGlobalObject::symbolObjectStructure):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::isName): Deleted.
+        * runtime/MapData.cpp:
+        (JSC::MapData::find):
+        (JSC::MapData::add):
+        (JSC::MapData::remove):
+        (JSC::MapData::replaceAndPackBackingStore):
+        * runtime/MapData.h:
+        (JSC::MapData::clear):
+        * runtime/NameInstance.h: Removed.
+        * runtime/NamePrototype.cpp: Removed.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+        (JSC::PrivateName::operator==):
+        (JSC::PrivateName::operator!=):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::get):
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+        (JSC::PropertyName::publicName):
+        * runtime/SmallStrings.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::callStringConstructor):
+
+        In ES6, String constructor accepts Symbol to execute `String(symbol)`.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::getPropertyNamesFromStructure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/Symbol.cpp: Added.
+        (JSC::Symbol::Symbol):
+        (JSC::SymbolObject::create):
+        (JSC::Symbol::toPrimitive):
+        (JSC::Symbol::toBoolean):
+        (JSC::Symbol::getPrimitiveNumber):
+        (JSC::Symbol::toObject):
+        (JSC::Symbol::toNumber):
+        (JSC::Symbol::destroy):
+        (JSC::Symbol::descriptiveString):
+        * runtime/Symbol.h: Added.
+        (JSC::Symbol::createStructure):
+        (JSC::Symbol::create):
+        (JSC::Symbol::privateName):
+        (JSC::Symbol::finishCreation):
+        (JSC::asSymbol):
+        * runtime/SymbolConstructor.cpp: Renamed from Source/JavaScriptCore/runtime/NameConstructor.cpp.
+        (JSC::SymbolConstructor::SymbolConstructor):
+        (JSC::SymbolConstructor::finishCreation):
+        (JSC::callSymbol):
+        (JSC::SymbolConstructor::getConstructData):
+        (JSC::SymbolConstructor::getCallData):
+        * runtime/SymbolConstructor.h: Renamed from Source/JavaScriptCore/runtime/NameConstructor.h.
+        (JSC::SymbolConstructor::create):
+        (JSC::SymbolConstructor::createStructure):
+        * runtime/SymbolObject.cpp: Renamed from Source/JavaScriptCore/runtime/NameInstance.cpp.
+        (JSC::SymbolObject::SymbolObject):
+        (JSC::SymbolObject::finishCreation):
+        (JSC::SymbolObject::defaultValue):
+
+        Now JSC doesn't support @@toPrimitive. So instead of it, we implement
+        Symbol.prototype[@@toPrimitive] as ES5 Symbol.[[DefaultValue]].
+
+        * runtime/SymbolObject.h: Added.
+        (JSC::SymbolObject::create):
+        (JSC::SymbolObject::internalValue):
+        (JSC::SymbolObject::createStructure):
+        * runtime/SymbolPrototype.cpp: Added.
+        (JSC::SymbolPrototype::SymbolPrototype):
+        (JSC::SymbolPrototype::finishCreation):
+        (JSC::SymbolPrototype::getOwnPropertySlot):
+        (JSC::symbolProtoFuncToString):
+        (JSC::symbolProtoFuncValueOf):
+        * runtime/SymbolPrototype.h: Renamed from Source/JavaScriptCore/runtime/NamePrototype.h.
+        (JSC::SymbolPrototype::create):
+        (JSC::SymbolPrototype::createStructure):
+
+        SymbolPrototype object is ordinary JS object. Not wrapper object of Symbol.
+        It is tested in js/symbol-prototype-is-ordinary-object.html.
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2015-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-landing just the HandleBlock piece of this patch.
+
+        * heap/HandleBlock.h:
+        * heap/HandleBlockInlines.h:
+        (JSC::HandleBlock::create):
+        (JSC::HandleBlock::destroy):
+        (JSC::HandleBlock::HandleBlock):
+        (JSC::HandleBlock::payloadEnd):
+        * heap/HandleSet.cpp:
+        (JSC::HandleSet::~HandleSet):
+        (JSC::HandleSet::grow):
+
+2015-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        GC marking threads should clear malloc caches
+        https://bugs.webkit.org/show_bug.cgi?id=141097
+
+        Reviewed by Sam Weinig.
+
+        Follow-up based on Mark Hahnenberg's review: Release after the copy
+        phase, rather than after any phase, since we'd rather not release
+        between marking and copying.
+
+        * heap/GCThread.cpp:
+        (JSC::GCThread::waitForNextPhase):
+        (JSC::GCThread::gcThreadMain):
+
+2015-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        GC marking threads should clear malloc caches
+        https://bugs.webkit.org/show_bug.cgi?id=141097
+
+        Reviewed by Andreas Kling.
+
+        This is an attempt to ameliorate a potential memory use regression
+        caused by https://bugs.webkit.org/show_bug.cgi?id=140900
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages.
+
+        FastMalloc may accumulate a per-thread cache on each of the 8-ish
+        GC marking threads, which can be expensive.
+
+        * heap/GCThread.cpp:
+        (JSC::GCThread::waitForNextPhase): Scavenge the current thread before
+        going to sleep. There's probably not too much value to keeping our
+        per-thread cache between GCs, and it has some memory footprint.
+
+2015-01-30  Chris Dumez  <cdumez@apple.com>
+
+        Rename shared() static member functions to singleton() for singleton classes.
+        https://bugs.webkit.org/show_bug.cgi?id=141088
+
+        Reviewed by Ryosuke Niwa and Benjamin Poulain.
+
+        Rename shared() static member functions to singleton() for singleton
+        classes as per the recent coding style change.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::singleton):
+        (Inspector::RemoteInspector::start):
+        (Inspector::RemoteInspector::shared): Deleted.
+        * inspector/remote/RemoteInspectorDebuggable.cpp:
+        (Inspector::RemoteInspectorDebuggable::~RemoteInspectorDebuggable):
+        (Inspector::RemoteInspectorDebuggable::init):
+        (Inspector::RemoteInspectorDebuggable::update):
+        (Inspector::RemoteInspectorDebuggable::setRemoteDebuggingAllowed):
+        (Inspector::RemoteInspectorDebuggable::pauseWaitingForAutomaticInspection):
+        (Inspector::RemoteInspectorDebuggable::unpauseForInitializedInspector):
+        * inspector/remote/RemoteInspectorDebuggableConnection.mm:
+        (Inspector::RemoteInspectorDebuggableConnection::setup):
+        (Inspector::RemoteInspectorDebuggableConnection::sendMessageToFrontend):
+
+2015-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-landing just the CopyWorkListSegment piece of this patch.
+
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        * heap/CopyWorkList.h:
+        (JSC::CopyWorkListSegment::create):
+        (JSC::CopyWorkListSegment::destroy):
+        (JSC::CopyWorkListSegment::CopyWorkListSegment):
+        (JSC::CopyWorkList::CopyWorkList):
+        (JSC::CopyWorkList::~CopyWorkList):
+        (JSC::CopyWorkList::append):
+
+2015-01-29  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r179357 and r179358.
+        https://bugs.webkit.org/show_bug.cgi?id=141062
+
+        Suspect this caused WebGL tests to start flaking (Requested by
+        kling on #webkit).
+
+        Reverted changesets:
+
+        "Polymorphic call inlining should be based on polymorphic call
+        inline caching rather than logging"
+        https://bugs.webkit.org/show_bug.cgi?id=140660
+        http://trac.webkit.org/changeset/179357
+
+        "Unreviewed, fix no-JIT build."
+        http://trac.webkit.org/changeset/179358
+
+2015-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed op_ret_object_or_this
+        https://bugs.webkit.org/show_bug.cgi?id=141048
+
+        Reviewed by Michael Saboff.
+
+        op_ret_object_or_this was one opcode that would keep us out of the
+        optimizing compilers.
+
+        We don't need a special-purpose opcode; we can just use a branch.
+
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::isTerminal): Removed.
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset): Removed.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Removed.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn): Use an explicit branch to determine
+        if we need to substitute 'this' for the return value. Our engine no longer
+        benefits from fused opcodes that dispatch less in the interpreter.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret_object_or_this): Deleted.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret_object_or_this): Deleted.
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Removed.
+
+2015-01-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Implement ES6 class syntax without inheritance support
+        https://bugs.webkit.org/show_bug.cgi?id=140918
+
+        Reviewed by Geoffrey Garen.
+
+        Added the most basic support for ES6 class syntax. After this patch, we support basic class definition like:
+        class A {
+            constructor() { }
+            someMethod() { }
+        }
+
+        We'll add the support for "extends" keyword and automatically generating a constructor in follow up patches.
+        We also don't support block scoping of a class declaration.
+
+        We support both class declaration and class expression. A class expression is implemented by the newly added
+        ClassExprNode AST node. A class declaration is implemented by ClassDeclNode, which is a thin wrapper around
+        AssignResolveNode.
+
+        Tests: js/class-syntax-declaration.html
+               js/class-syntax-expression.html
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ObjectLiteralNode::emitBytecode): Create a new object instead of delegating the work to PropertyListNode.
+        Also fixed the 5-space indentation.
+        (JSC::PropertyListNode::emitBytecode): Don't create a new object now that ObjectLiteralNode does this.
+        (JSC::ClassDeclNode::emitBytecode): Added. Just let the AssignResolveNode node emit the byte code.
+        (JSC::ClassExprNode::emitBytecode): Create the class constructor and add static methods to the constructor by
+        emitting the byte code for PropertyListNode. Add instance methods to the class's prototype object the same way.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createClassExpr): Added. Creates a ClassExprNode.
+        (JSC::ASTBuilder::createClassDeclStatement): Added. Creates a AssignResolveNode and wraps it by a ClassDeclNode.
+
+        * parser/NodeConstructors.h:
+        (JSC::ClassDeclNode::ClassDeclNode): Added.
+        (JSC::ClassExprNode::ClassExprNode): Added.
+
+        * parser/Nodes.h:
+        (JSC::ClassExprNode): Added.
+        (JSC::ClassDeclNode): Added.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatement): Added the support for class declaration.
+        (JSC::stringForFunctionMode): Return "method" for MethodMode.
+        (JSC::Parser<LexerType>::parseClassDeclaration): Added. Uses parseClass to create a class expression and wraps
+        it with ClassDeclNode as described above.
+        (JSC::Parser<LexerType>::parseClass): Parses a class expression.
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parseGetterSetter): Extracted from parseProperty to share the code between parseProperty
+        and parseClass.
+        (JSC::Parser<LexerType>::parsePrimaryExpression): Added the support for class expression.
+
+        * parser/Parser.h:
+        (FunctionParseMode): Added MethodMode.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createClassExpr): Added.
+        (JSC::SyntaxChecker::createClassDeclStatement): Added.
+
+2015-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        Not reviewed.
+
+        * heap/WeakBlock.h: Use the fully qualified name when declaring our friend.
+
+2015-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-landing just the WeakBlock piece of this patch.
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::destroy):
+        (JSC::WeakBlock::WeakBlock):
+        * heap/WeakBlock.h:
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::~WeakSet):
+        (JSC::WeakSet::addAllocator):
+        (JSC::WeakSet::removeAllocator):
+
+2015-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Use Vector instead of GCSegmentedArray in CodeBlockSet
+        https://bugs.webkit.org/show_bug.cgi?id=141044
+
+        Reviewed by Ryosuke Niwa.
+
+        This is allowed now that we've gotten rid of fastMallocForbid.
+
+        4kB was a bit overkill for just storing a few pointers.
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::CodeBlockSet):
+        * heap/CodeBlockSet.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+
+2015-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix no-JIT build.
+
+        * jit/PolymorphicCallStubRoutine.cpp:
+
+2015-01-28  Filip Pizlo  <fpizlo@apple.com>
+
+        Polymorphic call inlining should be based on polymorphic call inline caching rather than logging
+        https://bugs.webkit.org/show_bug.cgi?id=140660
+
+        Reviewed by Geoffrey Garen.
+        
+        When we first implemented polymorphic call inlining, we did the profiling based on a call
+        edge log. The idea was to store each call edge (a tuple of call site and callee) into a
+        global log that was processed lazily. Processing the log would give precise counts of call
+        edges, and could be used to drive well-informed inlining decisions - polymorphic or not.
+        This was a speed-up on throughput tests but a slow-down for latency tests. It was a net win
+        nonetheless.
+        
+        Experience with this code shows three things. First, the call edge profiler is buggy and
+        complex. It would take work to fix the bugs. Second, the call edge profiler incurs lots of
+        overhead for latency code that we care deeply about. Third, it's not at all clear that
+        having call edge counts for every possible callee is any better than just having call edge
+        counts for the limited number of callees that an inline cache would catch.
+        
+        So, this patch removes the call edge profiler and replaces it with a polymorphic call inline
+        cache. If we miss the basic call inline cache, we inflate the cache to be a jump to an
+        out-of-line stub that cases on the previously known callees. If that misses again, then we
+        rewrite that stub to include the new callee. We do this up to some number of callees. If we
+        hit the limit then we switch to using a plain virtual call.
+        
+        Substantial speed-up on V8Spider; undoes the slow-down that the original call edge profiler
+        caused. Might be a SunSpider speed-up (below 1%), depending on hardware.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CallEdge.h:
+        (JSC::CallEdge::count):
+        (JSC::CallEdge::CallEdge):
+        * bytecode/CallEdgeProfile.cpp: Removed.
+        * bytecode/CallEdgeProfile.h: Removed.
+        * bytecode/CallEdgeProfileInlines.h: Removed.
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::unlink):
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkInfo.h:
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+        (JSC::CallLinkStatus::isClosureCall):
+        (JSC::CallLinkStatus::makeClosureCall):
+        (JSC::CallLinkStatus::dump):
+        (JSC::CallLinkStatus::computeFromCallEdgeProfile): Deleted.
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::isSet):
+        (JSC::CallLinkStatus::variants):
+        (JSC::CallLinkStatus::size):
+        (JSC::CallLinkStatus::at):
+        (JSC::CallLinkStatus::operator[]):
+        (JSC::CallLinkStatus::canOptimize):
+        (JSC::CallLinkStatus::edges): Deleted.
+        (JSC::CallLinkStatus::canTrustCounts): Deleted.
+        * bytecode/CallVariant.cpp:
+        (JSC::variantListWithVariant):
+        (JSC::despecifiedVariantList):
+        * bytecode/CallVariant.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::linkIncomingPolymorphicCall):
+        (JSC::CodeBlock::unlinkIncomingCalls):
+        (JSC::CodeBlock::noticeIncomingCall):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isIncomingCallAlreadyLinked): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        (JSC::DFG::TierUpCheckInjectionPhase::removeFTLProfiling): Deleted.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * jit/BinarySwitch.h:
+        * jit/ClosureCallStubRoutine.cpp: Removed.
+        * jit/ClosureCallStubRoutine.h: Removed.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        (JSC::operationLinkPolymorphicCallFor):
+        (JSC::operationLinkClosureCallFor): Deleted.
+        * jit/JITStubRoutine.h:
+        * jit/JITWriteBarrier.h:
+        * jit/PolymorphicCallStubRoutine.cpp: Added.
+        (JSC::PolymorphicCallNode::~PolymorphicCallNode):
+        (JSC::PolymorphicCallNode::unlink):
+        (JSC::PolymorphicCallCase::dump):
+        (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
+        (JSC::PolymorphicCallStubRoutine::~PolymorphicCallStubRoutine):
+        (JSC::PolymorphicCallStubRoutine::variants):
+        (JSC::PolymorphicCallStubRoutine::edges):
+        (JSC::PolymorphicCallStubRoutine::visitWeak):
+        (JSC::PolymorphicCallStubRoutine::markRequiredObjectsInternal):
+        * jit/PolymorphicCallStubRoutine.h: Added.
+        (JSC::PolymorphicCallNode::PolymorphicCallNode):
+        (JSC::PolymorphicCallCase::PolymorphicCallCase):
+        (JSC::PolymorphicCallCase::variant):
+        (JSC::PolymorphicCallCase::codeBlock):
+        * jit/Repatch.cpp:
+        (JSC::linkSlowFor):
+        (JSC::linkFor):
+        (JSC::revertCall):
+        (JSC::unlinkFor):
+        (JSC::linkVirtualFor):
+        (JSC::linkPolymorphicCall):
+        (JSC::linkClosureCall): Deleted.
+        * jit/Repatch.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::linkPolymorphicCallForThunkGenerator):
+        (JSC::linkPolymorphicCallThunkGenerator):
+        (JSC::linkPolymorphicCallThatPreservesRegsThunkGenerator):
+        (JSC::linkClosureCallForThunkGenerator): Deleted.
+        (JSC::linkClosureCallThunkGenerator): Deleted.
+        (JSC::linkClosureCallThatPreservesRegsThunkGenerator): Deleted.
+        * jit/ThunkGenerators.h:
+        (JSC::linkPolymorphicCallThunkGeneratorFor):
+        (JSC::linkClosureCallThunkGeneratorFor): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::prepareToDiscardCode):
+        (JSC::VM::ensureCallEdgeLog): Deleted.
+        * runtime/VM.h:
+
+2015-01-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ES6: Improved Console Format for Set and Map Objects (like Arrays)
+        https://bugs.webkit.org/show_bug.cgi?id=122867
+
+        Reviewed by Timothy Hatcher.
+
+        Add new Runtime.RemoteObject object subtypes for "map", "set", and "weakmap".
+
+        Upgrade Runtime.ObjectPreview to include type/subtype information. Now,
+        an ObjectPreview can be used for any value, in place of a RemoteObject,
+        and not capture / hold a reference to the value. The value will be in
+        the string description.
+
+        Adding this information to ObjectPreview can duplicate some information
+        in the protocol messages if a preview is provided, but simplifies
+        previews, so that all the information you need for any RemoteObject
+        preview is available. To slim messages further, make "overflow" and
+        "properties" only available on previews that may contain properties.
+        So, not primitives or null.
+
+        Finally, for "Map/Set/WeakMap" add an "entries" list to the preview
+        that will return previews with "key" and "value" properties depending
+        on the collection type. To get live, non-preview objects from a
+        collection, use Runtime.getCollectionEntries.
+
+        In order to keep the WeakMap's values Weak the frontend may provide
+        a unique object group name when getting collection entries. It may
+        then release that object group, e.g. when not showing the WeakMap's
+        values to the user, and thus remove the strong reference to the keys
+        so they may be garbage collected.
+
+        * runtime/WeakMapData.h:
+        (JSC::WeakMapData::begin):
+        (JSC::WeakMapData::end):
+        Expose iterators so the Inspector may access WeakMap keys/values.
+
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapEntries):
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        Discern "map", "set", and "weakmap" object subtypes.
+
+        (Inspector::JSInjectedScriptHost::weakMapEntries):
+        Return a list of WeakMap entries. These are strong references
+        that the Inspector code is responsible for releasing.
+
+        * inspector/protocol/Runtime.json:
+        Update types and expose the new getCollectionEntries command.
+
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getCollectionEntries):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getInternalProperties):
+        (Inspector::InjectedScript::getCollectionEntries):
+        Pass through to the InjectedScript and call getCollectionEntries.
+
+        * inspector/scripts/codegen/generator.py:
+        Add another type with runtime casting.
+
+        * inspector/InjectedScriptSource.js:
+        - Implement getCollectionEntries to get a range of values from a
+        collection. The non-Weak collections have an order to their keys (in
+        order of added) so range'd gets are okay. WeakMap does not have an
+        order, so only allow fetching a number of values.
+        - Update preview generation to address the Runtime.ObjectPreview
+        type changes.
+
+2015-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Re-landing just the GCArraySegment piece of this patch.
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::CodeBlockSet):
+        * heap/CodeBlockSet.h:
+        * heap/GCSegmentedArray.h:
+        (JSC::GCArraySegment::GCArraySegment):
+        * heap/GCSegmentedArrayInlines.h:
+        (JSC::GCSegmentedArray<T>::GCSegmentedArray):
+        (JSC::GCSegmentedArray<T>::~GCSegmentedArray):
+        (JSC::GCSegmentedArray<T>::clear):
+        (JSC::GCSegmentedArray<T>::expand):
+        (JSC::GCSegmentedArray<T>::refill):
+        (JSC::GCArraySegment<T>::create):
+        (JSC::GCArraySegment<T>::destroy):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::MarkStackArray):
+        * heap/MarkStack.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+
+2015-01-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Move HAVE_DTRACE definition back to Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=141033
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2015-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed fastMallocForbid / fastMallocAllow
+        https://bugs.webkit.org/show_bug.cgi?id=141012
+
+        Reviewed by Mark Hahnenberg.
+
+        Copy non-current thread stacks before scanning them instead of scanning
+        them in-place.
+
+        This operation is uncommon (i.e., never in the web content process),
+        and even in a stress test with 4 threads it only copies about 27kB,
+        so I think the performance cost is OK.
+
+        Scanning in-place requires a complex dance where we constrain our GC
+        data structures not to use malloc, free, or any other interesting functions
+        that might acquire locks. We've gotten this wrong many times in the past,
+        and I just got it wrong again yesterday. Since this code path is rarely
+        tested, I want it to just make sense, and not depend on or constrain the
+        details of the rest of the GC heap's design.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::otherThreadStack): Factored out a helper function for dealing with
+        unaligned and/or backwards pointers.
+
+        (JSC::MachineThreads::tryCopyOtherThreadStack): This is now the only
+        constrained function, and it only calls memcpy and low-level thread APIs.
+
+        (JSC::MachineThreads::tryCopyOtherThreadStacks): The design here is that
+        you do one pass over all the threads to compute their combined size,
+        and then a second pass to do all the copying. In theory, the threads may
+        grow in between passes, in which case you'll continue until the threads
+        stop growing. In practice, you never continue.
+
+        (JSC::growBuffer): Helper function for growing.
+
+        (JSC::MachineThreads::gatherConservativeRoots):
+        (JSC::MachineThreads::gatherFromOtherThread): Deleted.
+        * heap/MachineStackMarker.h: Updated for interface changes.
+
+2015-01-28  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: remove CSS.setPropertyText, CSS.toggleProperty and related dead code
+        https://bugs.webkit.org/show_bug.cgi?id=140961
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/CSS.json: Remove unused protocol methods.
+
+2015-01-28  Dana Burkart  <dburkart@apple.com>
+
+        Move ASan flag settings from DebugRelease.xcconfig to Base.xcconfig
+        https://bugs.webkit.org/show_bug.cgi?id=136765
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2015-01-27  Filip Pizlo  <fpizlo@apple.com>
+
+        ExitSiteData saying m_takesSlowPath shouldn't mean early returning takesSlowPath() since for the non-LLInt case we later set m_couldTakeSlowPath, which is more precise
+        https://bugs.webkit.org/show_bug.cgi?id=140980
+
+        Reviewed by Oliver Hunt.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+
+2015-01-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Move DFGBinarySwitch out of the DFG so that all of the JITs can use it
+        https://bugs.webkit.org/show_bug.cgi?id=140959
+
+        Rubber stamped by Geoffrey Garen.
+        
+        I want to use this for polymorphic stubs for https://bugs.webkit.org/show_bug.cgi?id=140660.
+        This code no longer has DFG dependencies so this is a very clean move.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGBinarySwitch.cpp: Removed.
+        * dfg/DFGBinarySwitch.h: Removed.
+        * dfg/DFGSpeculativeJIT.cpp:
+        * jit/BinarySwitch.cpp: Copied from Source/JavaScriptCore/dfg/DFGBinarySwitch.cpp.
+        * jit/BinarySwitch.h: Copied from Source/JavaScriptCore/dfg/DFGBinarySwitch.h.
+
+2015-01-27  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r179192.
+        https://bugs.webkit.org/show_bug.cgi?id=140953
+
+        Caused numerous layout test failures (Requested by mattbaker_
+        on #webkit).
+
+        Reverted changeset:
+
+        "Use FastMalloc (bmalloc) instead of BlockAllocator for GC
+        pages"
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+        http://trac.webkit.org/changeset/179192
+
+2015-01-27  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r178591): 20% regression in Octane box2d
+        https://bugs.webkit.org/show_bug.cgi?id=140948
+
+        Reviewed by Geoffrey Garen.
+
+        Added check that we have a lexical environment to the arguments is captured check.
+        It doesn't make sense to resolve "arguments" when it really isn't captured.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::willResolveToArgumentsRegister):
+
+2015-01-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Use FastMalloc (bmalloc) instead of BlockAllocator for GC pages
+        https://bugs.webkit.org/show_bug.cgi?id=140900
+
+        Reviewed by Mark Hahnenberg.
+
+        Removes some more custom allocation code.
+
+        Looks like a speedup. (See results attached to bugzilla.)
+
+        Will hopefully reduce memory use by improving sharing between the GC and
+        malloc heaps.
+
+        * API/JSBase.cpp:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Feed the compiler.
+
+        * heap/BlockAllocator.cpp: Removed.
+        * heap/BlockAllocator.h: Removed. No need for a custom allocator anymore.
+
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::CodeBlockSet):
+        * heap/CodeBlockSet.h: Feed the compiler.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::createNoZeroFill):
+        (JSC::CopiedBlock::create):
+        (JSC::CopiedBlock::CopiedBlock):
+        (JSC::CopiedBlock::isOversize):
+        (JSC::CopiedBlock::payloadEnd):
+        (JSC::CopiedBlock::capacity):
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes): Each copied block now tracks its
+        own size, since we can't rely on Region to tell us our size anymore.
+
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::~CopiedSpace):
+        (JSC::CopiedSpace::tryAllocateOversize):
+        (JSC::CopiedSpace::tryReallocateOversize):
+        * heap/CopiedSpaceInlines.h:
+        (JSC::CopiedSpace::recycleEvacuatedBlock):
+        (JSC::CopiedSpace::recycleBorrowedBlock):
+        (JSC::CopiedSpace::allocateBlockForCopyingPhase):
+        (JSC::CopiedSpace::allocateBlock):
+        (JSC::CopiedSpace::startedCopying): Deallocate blocks directly, rather
+        than pushing them onto the block allocator's free list; the block
+        allocator doesn't exist anymore.
+
+        * heap/CopyWorkList.h:
+        (JSC::CopyWorkListSegment::create):
+        (JSC::CopyWorkListSegment::CopyWorkListSegment):
+        (JSC::CopyWorkList::~CopyWorkList):
+        (JSC::CopyWorkList::append):
+        (JSC::CopyWorkList::CopyWorkList): Deleted.
+        * heap/GCSegmentedArray.h:
+        (JSC::GCArraySegment::GCArraySegment):
+        * heap/GCSegmentedArrayInlines.h:
+        (JSC::GCSegmentedArray<T>::GCSegmentedArray):
+        (JSC::GCSegmentedArray<T>::~GCSegmentedArray):
+        (JSC::GCSegmentedArray<T>::clear):
+        (JSC::GCSegmentedArray<T>::expand):
+        (JSC::GCSegmentedArray<T>::refill):
+        (JSC::GCArraySegment<T>::create):
+        * heap/GCThreadSharedData.cpp:
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        * heap/GCThreadSharedData.h: Feed the compiler.
+
+        * heap/HandleBlock.h:
+        * heap/HandleBlockInlines.h:
+        (JSC::HandleBlock::create):
+        (JSC::HandleBlock::HandleBlock):
+        (JSC::HandleBlock::payloadEnd):
+        * heap/HandleSet.cpp:
+        (JSC::HandleSet::~HandleSet):
+        (JSC::HandleSet::grow): Same as above.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        * heap/Heap.h: Removed the block allocator since it is unused now.
+
+        * heap/HeapBlock.h:
+        (JSC::HeapBlock::destroy):
+        (JSC::HeapBlock::HeapBlock):
+        (JSC::HeapBlock::region): Deleted. Removed the Region pointer from each
+        HeapBlock since a HeapBlock is just a normal allocation now.
+
+        * heap/HeapInlines.h:
+        (JSC::Heap::blockAllocator): Deleted.
+
+        * heap/HeapTimer.cpp:
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackArray::MarkStackArray):
+        * heap/MarkStack.h: Feed the compiler.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock): No need to use a custom code path
+        based on size, since we use a general purpose allocator now.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::capacity): Track block size explicitly, like CopiedBlock.
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::freeBlock):
+        * heap/MarkedSpace.h:
+
+        * heap/Region.h: Removed.
+
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor): Removed reference to block allocator.
+
+        * heap/SuperRegion.cpp: Removed.
+        * heap/SuperRegion.h: Removed.
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::WeakBlock):
+        * heap/WeakBlock.h:
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::~WeakSet):
+        (JSC::WeakSet::addAllocator):
+        (JSC::WeakSet::removeAllocator): Removed reference to block allocator.
+
+2015-01-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Typo fix after r176083
+        https://bugs.webkit.org/show_bug.cgi?id=140937
+
+        Reviewed by Anders Carlsson.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ldrh):
+
+2015-01-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Win] Unreviewed gardening, skip failing tests.
+
+        * tests/exceptionFuzz.yaml: Skip exception fuzz tests due to bug140928.
+        * tests/mozilla/mozilla-tests.yaml: Skip ecma/Date/15.9.5.28-1.js due to bug140927.
+
+2015-01-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Win] Enable JSC stress tests by default
+        https://bugs.webkit.org/show_bug.cgi?id=128307
+
+        Unreviewed typo fix after r179165.
+
+        * tests/mozilla/mozilla-tests.yaml:
+
+2015-01-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Win] Enable JSC stress tests by default
+        https://bugs.webkit.org/show_bug.cgi?id=128307
+
+        Reviewed by Brent Fulgham.
+
+        * tests/mozilla/mozilla-tests.yaml: Skipped on Windows.
+        * tests/stress/ftl-arithcos.js: Skipped on Windows.
+
+2015-01-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Parse a function expression as a primary expression
+        https://bugs.webkit.org/show_bug.cgi?id=140908
+
+        Reviewed by Mark Lam.
+
+        Moved the code to generate an AST node for a function expression from parseMemberExpression
+        to parsePrimaryExpression to match the ES6 specification terminology:
+        https://people.mozilla.org/~jorendorff/es6-draft.html#sec-primary-expression
+
+        There should be no behavior change from this change since parsePrimaryExpression is only
+        called in parseMemberExpression other than the fact failIfStackOverflow() is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+
+2015-01-26  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [iOS] [SVG -> OTF Converter] Flip the switch off on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=140860
+
+        Reviewed by Darin Adler.
+
+        The fonts it makes are grotesque. (See what I did there? Typographic
+        humor is the best humor.)
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-01-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Rename InjectedScriptHost::type to subtype
+        https://bugs.webkit.org/show_bug.cgi?id=140841
+
+        Reviewed by Timothy Hatcher.
+
+        We were using this to set the subtype of an "object" type RemoteObject
+        so we should clean up the name and call it subtype.
+
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptSource.js:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        (Inspector::JSInjectedScriptHost::type): Deleted.
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionSubtype):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionType): Deleted.
+
+2015-01-23  Michael Saboff  <msaboff@apple.com>
+
+        LayoutTests/js/script-tests/reentrant-caching.js crashing on 32 bit builds
+        https://bugs.webkit.org/show_bug.cgi?id=140843
+
+        Reviewed by Oliver Hunt.
+
+        When we are in vmEntryToJavaScript, we keep the stack pointer at an
+        alignment sutiable for pointing to a call frame header, which is the
+        alignment post making a call.  We adjust the sp when calling to JS code,
+        but don't adjust it before calling the out of stack handler.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        Moved stack point down 8 bytes to get it aligned.
+
+2015-01-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Object Previews in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=129204
+
+        Reviewed by Timothy Hatcher.
+
+        Update the very old, unused object preview code. Part of this comes from
+        the earlier WebKit legacy implementation, and the Blink implementation.
+
+        A RemoteObject may include a preview, if it is asked for, and if the
+        RemoteObject is an object. Previews are a shallow (single level) list
+        of a limited number of properties on the object. The previewed
+        properties are always stringified (even if primatives). Previews are
+        limited to just 5 properties or 100 indices. Previews are marked
+        as lossless if they are a complete snapshot of the object.
+
+        There is a path to make previews two levels deep, that is currently
+        unused but should soon be used for tables (e.g. IndexedDB).
+
+        * inspector/InjectedScriptSource.js:
+        - Move some code off of InjectedScript to be generic functions
+        usable by RemoteObject as well.
+        - Update preview generation to use 
+
+        * inspector/protocol/Runtime.json:
+        - Add a new type, "accessor" for preview objects. This represents
+        a getter / setter. We currently don't get the value.
+
+2015-01-23  Michael Saboff  <msaboff@apple.com>
+
+        Immediate crash when setting JS breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=140811
+
+        Reviewed by Mark Lam.
+
+        When the DFG stack layout phase doesn't allocate a register for the scope register,
+        it incorrectly sets the scope register in the code block to a bad value, one with
+        an offset of 0.  Changed it so that we set the code block's scope register to the 
+        invalid VirtualRegister instead.
+
+        No tests needed as adding the ASSERT in setScopeRegister() was used to find the bug.
+        We crash with that ASSERT in testapi and likely many other tests as well.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setScopeRegister):
+        (JSC::CodeBlock::scopeRegister):
+        Added ASSERTs to catch any future improper setting of the code block's scope register.
+
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+
+2015-01-22  Mark Hahnenberg  <mhahnenb@gmail.com>
+
+        EdenCollections unnecessarily visit SmallStrings
+        https://bugs.webkit.org/show_bug.cgi?id=140762
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::copyBackingStores): Also added a GCPhase for copying
+        backing stores, which is a significant portion of garbage collection.
+        (JSC::Heap::visitSmallStrings): Check to see if we need to visit
+        SmallStrings based on the collection type.
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::visitStrongReferences): Set the fact that we have
+        visited the SmallStrings since the last modification.
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::needsToBeVisited): If we're doing a
+        FullCollection, we need to visit. Otherwise, it depends on whether
+        we've been visited since the last modification/allocation.
+
+2015-01-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Add a build flag for ES6 class syntax
+        https://bugs.webkit.org/show_bug.cgi?id=140760
+
+        Reviewed by Michael Saboff.
+
+        Added ES6_CLASS_SYNTAX build flag and used it in tokenizer to recognize
+        "class", "extends", "static" and "super" keywords.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * parser/Keywords.table:
+        * parser/ParserTokens.h:
+
+2015-01-22  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r178894.
+        https://bugs.webkit.org/show_bug.cgi?id=140775
+
+        Broke JSC and bindings tests (Requested by ap_ on #webkit).
+
+        Reverted changeset:
+
+        "put_by_val_direct need to check the property is index or not
+        for using putDirect / putDirectIndex"
+        https://bugs.webkit.org/show_bug.cgi?id=140426
+        http://trac.webkit.org/changeset/178894
+
+2015-01-22  Mark Lam  <mark.lam@apple.com>
+
+        BytecodeGenerator::initializeCapturedVariable() sets a misleading value for the 5th operand of op_put_to_scope.
+        <https://webkit.org/b/140743>
+
+        Reviewed by Oliver Hunt.
+
+        BytecodeGenerator::initializeCapturedVariable() was setting the 5th operand to
+        op_put_to_scope to an inappropriate value (i.e. 0).  As a result, the execution
+        of put_to_scope could store a wrong inferred value into the VariableWatchpointSet
+        for which ever captured variable is at local index 0.  In practice, this turns
+        out to be the local for the Arguments object.  In this reproduction case in the
+        bug, the wrong inferred value written there is the boolean true.
+
+        Subsequently, DFG compilation occurs and CreateArguments is emitted to first do
+        a check of the local for the Arguments object.  But because that local has a
+        wrong inferred value, the check always discovers a non-null value and we never
+        actually create the Arguments object.  Immediately after this, an OSR exit
+        occurs leaving the Arguments object local uninitialized.  Later on at arguments
+        tear off, we run into a boolean true where we had expected to find an Arguments
+        object, which in turn, leads to the crash.
+
+        The fix is to:
+        1. In the case where the resolveModeType is LocalClosureVar, change the
+           5th operand of op_put_to_scope to be a boolean.  True means that the
+           local var is watchable.  False means it is not watchable.  We no longer
+           pass the local index (instead of true) and UINT_MAX (instead of false).
+
+           This allows us to express more clearer in the code what that value means,
+           as well as remove the redundant way of getting the local's identifier.
+           The identifier is always the one passed in the 2nd operand. 
+
+        2. Previously, though intuitively, we know that the watchable variable
+           identifier should be the same as the one that is passed in operand 2, this
+           relationship was not clear in the code.  By code analysis, I confirmed that 
+           the callers of BytecodeGenerator::emitPutToScope() always use the same
+           identifier for operand 2 and for filling out the ResolveScopeInfo from
+           which we get the watchable variable identifier later.  I've changed the
+           code to make this clear now by always using the identifier passed in
+           operand 2.
+
+        3. In the case where the resolveModeType is LocalClosureVar,
+           initializeCapturedVariable() and emitPutToScope() will now query
+           hasWatchableVariable() to determine if the local is watchable or not.
+           Accordingly, we pass the boolean result of hasWatchableVariable() as
+           operand 5 of op_put_to_scope.
+
+        Also added some assertions.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::initializeCapturedVariable):
+        (JSC::BytecodeGenerator::hasConstant):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::hasWatchableVariable):
+        (JSC::BytecodeGenerator::watchableVariableIdentifier):
+        (JSC::BytecodeGenerator::watchableVariable): Deleted.
+
+2015-01-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        PropertyListNode::emitNode duplicates the code to put a constant property
+        https://bugs.webkit.org/show_bug.cgi?id=140761
+
+        Reviewed by Geoffrey Garen.
+
+        Extracted PropertyListNode::emitPutConstantProperty to share the code.
+
+        Also made PropertyListNode::emitBytecode private since nobody is calling this function directly.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        (JSC::PropertyListNode::emitPutConstantProperty): Added.
+        * parser/Nodes.h:
+
+2015-01-22  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        put_by_val_direct need to check the property is index or not for using putDirect / putDirectIndex
+        https://bugs.webkit.org/show_bug.cgi?id=140426
+
+        Reviewed by Geoffrey Garen.
+
+        In the put_by_val_direct operation, we use JSObject::putDirect.
+        However, it only accepts non-index property. For index property, we need to use JSObject::putDirectIndex.
+        This patch changes Identifier::asIndex() to return Optional<uint32_t>.
+        It forces callers to check the value is index or not explicitly.
+        Additionally, it checks toString-ed Identifier is index or not to choose putDirect / putDirectIndex.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStubAndGetOldStructure):
+        * jsc.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        (JSC::Arguments::defineOwnProperty):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
+        (JSC::JSGenericTypedArrayView<Adaptor>::put):
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::putDirectCustomAccessor):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::putDirectMayBeIndex):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        * runtime/PropertyName.h:
+        (JSC::toUInt32FromCharacters):
+        (JSC::toUInt32FromStringImpl):
+        (JSC::PropertyName::asIndex):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+        * runtime/Structure.cpp:
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+
+2015-01-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Consolidate out arguments of parseFunctionInfo into a struct
+        https://bugs.webkit.org/show_bug.cgi?id=140754
+
+        Reviewed by Oliver Hunt.
+
+        Introduced ParserFunctionInfo for storing out arguments of parseFunctionInfo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createGetterOrSetterProperty): This one takes a property name in addition to
+        ParserFunctionInfo since the property name and the function name could differ.
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        * parser/ParserFunctionInfo.h: Added.
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createClassDeclStatement):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+
+2015-01-21  Mark Hahnenberg  <mhahnenb@gmail.com>
+
+        Change Heap::m_compiledCode to use a Vector
+        https://bugs.webkit.org/show_bug.cgi?id=140717
+
+        Reviewed by Andreas Kling.
+
+        Right now it's a DoublyLinkedList, which is iterated during each
+        collection. This contributes to some of the longish Eden pause times.
+        A Vector would be more appropriate and would also allow ExecutableBase
+        to be 2 pointers smaller.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteAllCompiledCode):
+        (JSC::Heap::deleteAllUnlinkedFunctionCode):
+        (JSC::Heap::clearUnmarkedExecutables):
+        * heap/Heap.h:
+        * runtime/Executable.h: No longer need to inherit from DoublyLinkedListNode.
+
+2015-01-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        BytecodeGenerator shouldn't expose all of its member variables
+        https://bugs.webkit.org/show_bug.cgi?id=140752
+
+        Reviewed by Mark Lam.
+
+        Added "private:" and removed unused data members as detected by clang.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::lastOpcodeID): Added. Used in BinaryOpNode::emitBytecode.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BinaryOpNode::emitBytecode):
+
+2015-01-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ASSERT expanding objects in console PrimitiveBindingTraits<T>::assertValueHasExpectedType
+        https://bugs.webkit.org/show_bug.cgi?id=140746
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        Do not add impure properties to the descriptor object that will
+        eventually be sent to the frontend.
+
+2015-01-21  Matthew Mirman  <mmirman@apple.com>
+
+        Updated split such that it does not include the empty end of input string match.
+        https://bugs.webkit.org/show_bug.cgi?id=138129
+        <rdar://problem/18807403>
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit):
+        * tests/stress/empty_eos_regex_split.js: Added.
+
+2015-01-21  Michael Saboff  <msaboff@apple.com>
+
+        Eliminate Scope slot from JavaScript CallFrame
+        https://bugs.webkit.org/show_bug.cgi?id=136724
+
+        Reviewed by Geoffrey Garen.
+
+        This finishes the removal of the scope chain slot from the call frame header.
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::emit):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNativeCallOrConstruct):
+        (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+        * interpreter/JSStack.h:
+        * interpreter/VMInspector.cpp:
+        (JSC::VMInspector::dumpFrame):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::linkClosureCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualForThunkGenerator):
+        (JSC::nativeForGenerator):
+        Deleted ScopeChain slot from JSStack.  Removed all code where ScopeChain was being
+        read or set.  In most cases this was where we make JS calls.
+
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setArgument):
+        (JSC::CallFrameClosure::resetCallFrame): Deleted.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/ProtoCallFrame.cpp:
+        (JSC::ProtoCallFrame::init):
+        * interpreter/ProtoCallFrame.h:
+        (JSC::ProtoCallFrame::scope): Deleted.
+        (JSC::ProtoCallFrame::setScope): Deleted.
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Removed the related scopeChainValue member from ProtoCallFrame.  Reduced the number of
+        registers that needed to be copied from the ProtoCallFrame to a callee's frame
+        from 5 to 4.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        In addition to the prior changes, also deleted the unused macro getDeBruijnScope.
+
+2015-01-21  Michael Saboff  <msaboff@apple.com>
+
+        Eliminate construct methods from NullGetterFunction and NullSetterFunction classes
+        https://bugs.webkit.org/show_bug.cgi?id=140708
+
+        Reviewed by Mark Lam.
+
+        Eliminated construct methods and change getConstructData() for both classes to return
+        ConstructTypeNone as they can never be called.
+
+        * runtime/NullGetterFunction.cpp:
+        (JSC::NullGetterFunction::getConstructData):
+        (JSC::constructReturnUndefined): Deleted.
+        * runtime/NullSetterFunction.cpp:
+        (JSC::NullSetterFunction::getConstructData):
+        (JSC::constructReturnUndefined): Deleted.
+
+2015-01-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove ENABLE(INSPECTOR) ifdef guards
+        https://bugs.webkit.org/show_bug.cgi?id=140668
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/ScriptValue.cpp:
+        (Deprecated::ScriptValue::toInspectorValue):
+        * bindings/ScriptValue.h:
+        * inspector/ConsoleMessage.cpp:
+        * inspector/ConsoleMessage.h:
+        * inspector/ContentSearchUtilities.cpp:
+        * inspector/ContentSearchUtilities.h:
+        * inspector/IdentifiersFactory.cpp:
+        * inspector/IdentifiersFactory.h:
+        * inspector/InjectedScript.cpp:
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptBase.cpp:
+        * inspector/InjectedScriptBase.h:
+        * inspector/InjectedScriptHost.cpp:
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptManager.cpp:
+        * inspector/InjectedScriptManager.h:
+        * inspector/InjectedScriptModule.cpp:
+        * inspector/InjectedScriptModule.h:
+        * inspector/InspectorAgentRegistry.cpp:
+        * inspector/InspectorBackendDispatcher.cpp:
+        * inspector/InspectorBackendDispatcher.h:
+        * inspector/InspectorProtocolTypes.h:
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        * inspector/JSGlobalObjectScriptDebugServer.h:
+        * inspector/JSInjectedScriptHost.cpp:
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        * inspector/JSInjectedScriptHostPrototype.h:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        * inspector/JSJavaScriptCallFramePrototype.h:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/ScriptCallFrame.cpp:
+        (Inspector::ScriptCallFrame::buildInspectorObject):
+        * inspector/ScriptCallFrame.h:
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::buildInspectorArray):
+        * inspector/ScriptCallStack.h:
+        * inspector/ScriptDebugServer.cpp:
+        * inspector/agents/InspectorAgent.cpp:
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectConsoleAgent.cpp:
+        * inspector/agents/JSGlobalObjectConsoleAgent.h:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        * inspector/agents/JSGlobalObjectDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.cpp:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        (CppGeneratorTemplates):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::inspectorTypeSet):
+        (JSC::StructureShape::inspectorRepresentation):
+
+2015-01-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Clean up InjectedScriptSource.js
+        https://bugs.webkit.org/show_bug.cgi?id=140709
+
+        Reviewed by Timothy Hatcher.
+
+        This patch includes some relevant Blink patches and small changes.
+        
+        Patch by <aandrey@chromium.org>
+        DevTools: Remove console last result $_ on console clear.
+        https://src.chromium.org/viewvc/blink?revision=179179&view=revision
+
+        Patch by <eustas@chromium.org>
+        [Inspect DOM properties] incorrect CSS Selector Syntax
+        https://src.chromium.org/viewvc/blink?revision=156903&view=revision
+
+        * inspector/InjectedScriptSource.js:
+
+2015-01-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Cleanup RuntimeAgent a bit
+        https://bugs.webkit.org/show_bug.cgi?id=140706
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScript.h:
+        * inspector/InspectorBackendDispatcher.h:
+        * inspector/ScriptCallFrame.cpp:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::evaluate):
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        (Inspector::InspectorRuntimeAgent::run):
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::recompileAllJSFunctionsForTypeProfiling):
+        (Inspector::InspectorRuntimeAgent::setTypeProfilerEnabledState):
+
+2015-01-20  Matthew Mirman  <mmirman@apple.com>
+
+        Made Identity in the DFG allocate a new temp register and move 
+        the old data to it.
+        https://bugs.webkit.org/show_bug.cgi?id=140700
+        <rdar://problem/19339106>
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): 
+        Added scratch registers for Identity. 
+        * tests/mozilla/mozilla-tests.yaml: enabled previously failing test
+
+2015-01-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Expanding event objects in console shows undefined for most values, it should have real values
+        https://bugs.webkit.org/show_bug.cgi?id=137306
+
+        Reviewed by Timothy Hatcher.
+
+        Provide another optional parameter to getProperties, to gather a list
+        of all own and getter properties.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getProperties):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptSource.js:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Runtime.json:
+
+2015-01-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Should show dynamic specificity values
+        https://bugs.webkit.org/show_bug.cgi?id=140647
+
+        Reviewed by Benjamin Poulain.
+
+        * inspector/protocol/CSS.json:
+        Clarify CSSSelector optional values and add "dynamic" property indicating
+        if the selector can be dynamic based on the element it is matched against.
+
+2015-01-20  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r178751.
+        https://bugs.webkit.org/show_bug.cgi?id=140694
+
+        Caused 32-bit JSC test failures (Requested by JoePeck on
+        #webkit).
+
+        Reverted changeset:
+
+        "put_by_val_direct need to check the property is index or not
+        for using putDirect / putDirectIndex"
+        https://bugs.webkit.org/show_bug.cgi?id=140426
+        http://trac.webkit.org/changeset/178751
+
+2015-01-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        put_by_val_direct need to check the property is index or not for using putDirect / putDirectIndex
+        https://bugs.webkit.org/show_bug.cgi?id=140426
+
+        Reviewed by Geoffrey Garen.
+
+        In the put_by_val_direct operation, we use JSObject::putDirect.
+        However, it only accepts non-index property. For index property, we need to use JSObject::putDirectIndex.
+        This patch changes Identifier::asIndex() to return Optional<uint32_t>.
+        It forces callers to check the value is index or not explicitly.
+        Additionally, it checks toString-ed Identifier is index or not to choose putDirect / putDirectIndex.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFor):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStubAndGetOldStructure):
+        * jsc.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        (JSC::Arguments::defineOwnProperty):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
+        (JSC::JSGenericTypedArrayView<Adaptor>::put):
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::putDirectCustomAccessor):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::putDirectMayBeIndex):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::putDirectInternal):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        * runtime/PropertyName.h:
+        (JSC::toUInt32FromCharacters):
+        (JSC::toUInt32FromStringImpl):
+        (JSC::PropertyName::asIndex):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::deleteProperty):
+        * runtime/Structure.cpp:
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+
+2015-01-20  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(178696): Sporadic crashes while garbage collecting
+        https://bugs.webkit.org/show_bug.cgi?id=140688
+
+        Reviewed by Geoffrey Garen.
+
+        Added missing visitor.append(&thisObject->m_nullSetterFunction).
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+
+2015-01-19  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: code generator should take supplemental specifications and allow cross-framework references
+        https://bugs.webkit.org/show_bug.cgi?id=136312
+
+        Reviewed by Joseph Pecoraro.
+
+        Some types are shared between replay inputs from different frameworks.
+        Previously, these type declarations were duplicated in every input
+        specification file in which they were used. This caused some type encoding
+        traits to be emitted twice if used from WebCore inputs and WebKit2 inputs.
+
+        This patch teaches the replay inputs code generator to accept multiple
+        input specification files. Inputs can freely reference types from other
+        frameworks without duplicating declarations.
+
+        On the code generation side, the model could contain types and inputs from
+        frameworks that are not the target framework. Only generate code for the
+        target framework.
+
+        To properly generate cross-framework type encoding traits, use
+        Type.encoding_type_argument in more places, and add the export macro for WebCore
+        and the Test framework.
+
+        Adjust some tests so that enum coverage is preserved by moving the enum types
+        into "Test" (the target framework for tests).
+
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        For Windows, copy over JSInputs.json as if it were a private header.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Make JSInputs.json a private header.
+        * replay/JSInputs.json:
+        Put all primitive types and WTF types in this specification file.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Input.__init__):
+        (InputsModel.__init__): Keep track of the input's framework.
+        (InputsModel.parse_specification): Parse the framework here. Adjust to new format,
+        and allow either types or inputs to be missing from a single file.
+
+        (InputsModel.parse_type_with_framework):
+        (InputsModel.parse_input_with_framework):
+        (Generator.should_generate_item): Added helper method.
+        (Generator.generate_header): Filter inputs to generate.
+        (Generator.generate_implementation): Filter inputs to generate.
+        (Generator.generate_enum_trait_declaration): Filter enums to generate.
+        Add WEBCORE_EXPORT macro to enum encoding traits.
+
+        (Generator.generate_for_each_macro): Filter inputs to generate.
+        (Generator.generate_enum_trait_implementation): Filter enums to generate.
+        (generate_from_specifications): Added.
+        (generate_from_specifications.parse_json_from_file):
+        (InputsModel.parse_toplevel): Deleted.
+        (InputsModel.parse_type_with_framework_name): Deleted.
+        (InputsModel.parse_input): Deleted.
+        (generate_from_specification): Deleted.
+        * replay/scripts/CodeGeneratorReplayInputsTemplates.py:
+        * replay/scripts/tests/expected/fail-on-no-inputs.json-error: Removed.
+        * replay/scripts/tests/expected/fail-on-no-types.json-error: Removed.
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.cpp:
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp:
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.cpp:
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp:
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.h:
+        * replay/scripts/tests/fail-on-c-style-enum-no-storage.json:
+        * replay/scripts/tests/fail-on-duplicate-enum-type.json:
+        * replay/scripts/tests/fail-on-duplicate-input-names.json:
+        * replay/scripts/tests/fail-on-duplicate-type-names.json:
+        * replay/scripts/tests/fail-on-enum-type-missing-values.json:
+        * replay/scripts/tests/fail-on-missing-input-member-name.json:
+        * replay/scripts/tests/fail-on-missing-input-name.json:
+        * replay/scripts/tests/fail-on-missing-input-queue.json:
+        * replay/scripts/tests/fail-on-missing-type-mode.json:
+        * replay/scripts/tests/fail-on-missing-type-name.json:
+        * replay/scripts/tests/fail-on-no-inputs.json:
+        Removed, no longer required to be in a single file.
+
+        * replay/scripts/tests/fail-on-no-types.json:
+        Removed, no longer required to be in a single file.
+
+        * replay/scripts/tests/fail-on-unknown-input-queue.json:
+        * replay/scripts/tests/fail-on-unknown-member-type.json:
+        * replay/scripts/tests/fail-on-unknown-type-mode.json:
+        * replay/scripts/tests/generate-enum-encoding-helpers-with-guarded-values.json:
+        * replay/scripts/tests/generate-enum-encoding-helpers.json:
+        * replay/scripts/tests/generate-enum-with-guard.json:
+        Include enums that are and are not generated.
+
+        * replay/scripts/tests/generate-enums-with-same-base-name.json:
+        * replay/scripts/tests/generate-event-loop-shape-types.json:
+        * replay/scripts/tests/generate-input-with-guard.json:
+        * replay/scripts/tests/generate-input-with-vector-members.json:
+        * replay/scripts/tests/generate-inputs-with-flags.json:
+        * replay/scripts/tests/generate-memoized-type-modes.json:
+
+2015-01-20  Tomas Popela  <tpopela@redhat.com>
+
+        [GTK] Cannot compile 2.7.3 on PowerPC machines
+        https://bugs.webkit.org/show_bug.cgi?id=140616
+
+        Include climits for INT_MAX and wtf/DataLog.h for dataLogF
+
+        Reviewed by Csaba Osztrogonác.
+
+        * runtime/BasicBlockLocation.cpp:
+
+2015-01-19  Michael Saboff  <msaboff@apple.com>
+
+        A "cached" null setter should throw a TypeException when called in strict mode and doesn't
+        https://bugs.webkit.org/show_bug.cgi?id=139418
+
+        Reviewed by Filip Pizlo.
+
+        Made a new NullSetterFunction class similar to NullGetterFunction.  The difference is that 
+        NullSetterFunction will throw a TypeError per the ECMA262 spec for a strict mode caller.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added new files NullSetterFunction.cpp and NullSetterFunction.h.
+
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::isSetterNull):
+        (JSC::GetterSetter::setSetter):
+        Change setter instances from using NullGetterFunction to using NullSetterFunction.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::nullSetterFunction):
+        Added m_nullSetterFunction and accessor.
+
+        * runtime/NullSetterFunction.cpp: Added.
+        (JSC::GetCallerStrictnessFunctor::GetCallerStrictnessFunctor):
+        (JSC::GetCallerStrictnessFunctor::operator()):
+        (JSC::GetCallerStrictnessFunctor::callerIsStrict):
+        (JSC::callerIsStrict):
+        Method to determine if the caller is in strict mode.
+
+        (JSC::callReturnUndefined):
+        (JSC::constructReturnUndefined):
+        (JSC::NullSetterFunction::getCallData):
+        (JSC::NullSetterFunction::getConstructData):
+        * runtime/NullSetterFunction.h: Added.
+        (JSC::NullSetterFunction::create):
+        (JSC::NullSetterFunction::createStructure):
+        (JSC::NullSetterFunction::NullSetterFunction):
+        Class with handlers for a null setter.
+
+2015-01-19  Saam Barati  <saambarati1@gmail.com>
+
+        Web Inspector: Provide a front end for JSC's Control Flow Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=138454
+
+        Reviewed by Timothy Hatcher.
+
+        This patch puts the final touches on what JSC needs to provide
+        for the Web Inspector to show a UI for the control flow profiler.
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::recompileAllJSFunctionsForTypeProfiling):
+        * runtime/ControlFlowProfiler.cpp:
+        (JSC::ControlFlowProfiler::getBasicBlocksForSourceID):
+        * runtime/FunctionHasExecutedCache.cpp:
+        (JSC::FunctionHasExecutedCache::getFunctionRanges):
+        (JSC::FunctionHasExecutedCache::getUnexecutedFunctionRanges): Deleted.
+        * runtime/FunctionHasExecutedCache.h:
+
+2015-01-19  David Kilzer  <ddkilzer@apple.com>
+
+        [iOS] Only use LLVM static library arguments on 64-bit builds of libllvmForJSC.dylib
+        <http://webkit.org/b/140658>
+
+        Reviewed by Filip Pizlo.
+
+        * Configurations/LLVMForJSC.xcconfig: Set OTHER_LDFLAGS_LLVM
+        only when building for 64-bit architectures.
+
+2015-01-19  Filip Pizlo  <fpizlo@apple.com>
+
+        ClosureCallStubRoutine no longer needs codeOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=140659
+
+        Reviewed by Michael Saboff.
+        
+        Once upon a time, we would look for the CodeOrigin associated with a return PC. This search
+        would start with the CodeBlock according to the caller frame's call frame header. But if the
+        call was a closure call, the return PC would be inside some closure call stub. So if the
+        CodeBlock search failed, we would search *all* closure call stub routines to see which one
+        encompasses the return PC. Then, we would use the CodeOrigin stored in the stub routine
+        object. This was all a bunch of madness, and we actually got rid of it - we now determine
+        the CodeOrigin for a call frame using the encoded code origin bits inside the tag of the
+        argument count.
+        
+        This patch removes the final vestiges of the madness:
+        
+        - Remove the totally unused method declaration for the thing that did the closure call stub
+          search.
+        
+        - Remove the CodeOrigin field from the ClosureCallStubRoutine. Except for that crazy search
+          that we no longer do, everyone else who finds a ClosureCallStubRoutine will find it via
+          the CallLinkInfo. The CallLinkInfo also has the CodeOrigin, so we don't need this field
+          anymore.
+
+        * bytecode/CodeBlock.h:
+        * jit/ClosureCallStubRoutine.cpp:
+        (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
+        * jit/ClosureCallStubRoutine.h:
+        (JSC::ClosureCallStubRoutine::executable):
+        (JSC::ClosureCallStubRoutine::codeOrigin): Deleted.
+        * jit/Repatch.cpp:
+        (JSC::linkClosureCall):
+
+2015-01-19  Saam Barati  <saambarati1@gmail.com>
+
+        Basic block start offsets should never be larger than end offsets in the control flow profiler
+        https://bugs.webkit.org/show_bug.cgi?id=140377
+
+        Reviewed by Filip Pizlo.
+
+        The bytecode generator will emit code more than once for some AST nodes. For instance, 
+        the finally block of TryNode will emit two code paths for its finally block: one for 
+        the normal path, and another for the path where an exception is thrown in the catch block. 
+        
+        This repeated code emission of the same AST node previously broke how the control 
+        flow profiler computed text ranges of basic blocks because when the same AST node 
+        is emitted multiple times, there is a good chance that there are ranges that span 
+        from the end offset of one of these duplicated nodes back to the start offset of 
+        the same duplicated node. This caused a basic block range to report a larger start 
+        offset than end offset. This was incorrect. Now, when this situation is encountered 
+        while linking a CodeBlock, the faulty range in question is ignored.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
+        * bytecode/CodeBlock.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseConditionalExpression):
+        * runtime/ControlFlowProfiler.cpp:
+        (JSC::ControlFlowProfiler::ControlFlowProfiler):
+        * runtime/ControlFlowProfiler.h:
+        (JSC::ControlFlowProfiler::dummyBasicBlock):
+
+2015-01-19  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [SVG -> OTF Converter] Flip the switch on
+        https://bugs.webkit.org/show_bug.cgi?id=140592
+
+        Reviewed by Antti Koivisto.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-01-19  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: convert to is<T> and downcast<T> for decoding replay inputs
+        https://bugs.webkit.org/show_bug.cgi?id=140512
+
+        Reviewed by Chris Dumez.
+
+        Generate a SPECIALIZE_TYPE_TRAITS_* chunk of code for each input. This cannot
+        be done using REPLAY_INPUT_NAMES_FOR_EACH macro since that doesn't fully qualify
+        input types, and the type traits macro is defined in namespace WTF.
+
+        * replay/NondeterministicInput.h: Make overridden methods public.
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Generator.generate_header):
+        (Generator.qualified_input_name): Allow forcing qualification. WTF is never a target framework.
+        (Generator.generate_input_type_trait_declaration): Added.
+        * replay/scripts/CodeGeneratorReplayInputsTemplates.py: Add a template.
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.h:
+
+2015-01-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r178653.
+        https://bugs.webkit.org/show_bug.cgi?id=140634
+
+        Broke multiple SVG tests on Mountain Lion (Requested by ap on
+        #webkit).
+
+        Reverted changeset:
+
+        "[SVG -> OTF Converter] Flip the switch on"
+        https://bugs.webkit.org/show_bug.cgi?id=140592
+        http://trac.webkit.org/changeset/178653
+
+2015-01-18  Dean Jackson  <dino@apple.com>
+
+        ES6: Support Array.of construction
+        https://bugs.webkit.org/show_bug.cgi?id=140605
+        <rdar://problem/19513655>
+
+        Reviewed by Geoffrey Garen.
+
+        Add and implementation of Array.of, described in 22.1.2.3 of the ES6
+        specification (15 Jan 2015). The Array.of() method creates a new Array
+        instance with a variable number of arguments, regardless of number or type
+        of the arguments.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::arrayConstructorOf): Create a new empty Array, then iterate
+        over the arguments, setting them to the appropriate index.
+
+2015-01-19  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        [SVG -> OTF Converter] Flip the switch on
+        https://bugs.webkit.org/show_bug.cgi?id=140592
+
+        Reviewed by Antti Koivisto.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-01-17  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: highlight data for overlay should use protocol type builders
+        https://bugs.webkit.org/show_bug.cgi?id=129441
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new domain for overlay types.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * inspector/protocol/OverlayTypes.json: Added.
+
+2015-01-17  Michael Saboff  <msaboff@apple.com>
+
+        Crash in JSScope::resolve() on tools.ups.com
+        https://bugs.webkit.org/show_bug.cgi?id=140579
+
+        Reviewed by Geoffrey Garen.
+
+        For op_resolve_scope of a global property or variable that needs to check for the var
+        injection check watchpoint, we need to keep the scope around with a Phantom.  The
+        baseline JIT slowpath for op_resolve_scope needs the scope value if the watchpoint
+        fired.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2015-01-16  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: code generator should introduce typedefs for protocol types that are arrays
+        https://bugs.webkit.org/show_bug.cgi?id=140557
+
+        Reviewed by Joseph Pecoraro.
+
+        Currently, there is no generated type name for "array" type declarations such as Console.CallStack.
+        This makes it longwinded and confusing to use the type in C++ code.
+
+        This patch adds a typedef for array type declarations, so types such as Console::CallStack
+        can be referred to directly, rather than using Inspector::Protocol::Array<Console::CallFrame>.
+
+        Some tests were updated to cover array type declarations used as parameters and type members.
+
+        * inspector/ScriptCallStack.cpp: Use the new typedef.
+        (Inspector::ScriptCallStack::buildInspectorArray):
+        * inspector/ScriptCallStack.h:
+        * inspector/scripts/codegen/cpp_generator.py:
+        (CppGenerator.cpp_protocol_type_for_type): If an ArrayType is nominal, use the typedef'd name instead.
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
+        (_generate_typedefs_for_domain): Also generate typedefs for array type declarations.
+        (_generate_typedefs_for_domain.Inspector):
+        * inspector/scripts/codegen/models.py: Save the name of an ArrayType when it is a type declaration.
+        (ArrayType.__init__):
+        (Protocol.resolve_types):
+        (Protocol.lookup_type_reference):
+        * inspector/scripts/tests/commands-with-async-attribute.json:
+        * inspector/scripts/tests/commands-with-optional-call-return-parameters.json:
+        * inspector/scripts/tests/events-with-optional-parameters.json:
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * inspector/scripts/tests/type-declaration-object-type.json:
+
+2015-01-16  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: purge remaining PassRefPtr uses and minor cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=140456
+
+        Reviewed by Andreas Kling.
+
+        Get rid of PassRefPtr. Introduce default initializers where it makes sense.
+        Remove mistaken uses of AtomicString that were not removed as part of r174113.
+
+        * replay/EmptyInputCursor.h:
+        * replay/InputCursor.h:
+        (JSC::InputCursor::InputCursor):
+
+2015-01-16  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: code generator should fail on duplicate parameter and member names
+        https://bugs.webkit.org/show_bug.cgi?id=140555
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/scripts/codegen/models.py:
+        (find_duplicates): Add a helper function to find duplicates in a list.
+        (Protocol.parse_type_declaration):
+        (Protocol.parse_command):
+        (Protocol.parse_event):
+        * inspector/scripts/tests/expected/fail-on-duplicate-command-call-parameter-names.json-error: Added.
+        * inspector/scripts/tests/expected/fail-on-duplicate-command-return-parameter-names.json-error: Added.
+        * inspector/scripts/tests/expected/fail-on-duplicate-event-parameter-names.json-error: Added.
+        * inspector/scripts/tests/expected/fail-on-duplicate-type-member-names.json-error: Added.
+        * inspector/scripts/tests/fail-on-duplicate-command-call-parameter-names.json: Added.
+        * inspector/scripts/tests/fail-on-duplicate-command-return-parameter-names.json: Added.
+        * inspector/scripts/tests/fail-on-duplicate-event-parameter-names.json: Added.
+        * inspector/scripts/tests/fail-on-duplicate-type-member-names.json: Added.
+
+2015-01-16  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r174226): Header on huffingtonpost.com is too large
+        https://bugs.webkit.org/show_bug.cgi?id=140306
+
+        Reviewed by Filip Pizlo.
+
+        BytecodeGenerator::willResolveToArguments() is used to check to see if we can use the
+        arguments register or whether we need to resolve "arguments".  If the arguments have
+        been captured, then they are stored in the lexical environment and the arguments
+        register is not used.
+
+        Changed BytecodeGenerator::willResolveToArguments() to also check to see if the arguments
+        register is captured.  Renamed the function to willResolveToArgumentsRegister() to
+        better indicate what we are checking.
+
+        Aligned 32 and 64 bit paths in ArgumentsRecoveryGenerator::generateFor() for creating
+        an arguments object that was optimized out of an inlined callFrame.  The 32 bit path
+        incorrectly calculated the location of the reified callee frame.  This alignment resulted
+        in the removal of operationCreateInlinedArgumentsDuringOSRExit()
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::willResolveToArgumentsRegister):
+        (JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::willResolveToArguments): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::getArgumentByVal):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::ArgumentsRecoveryGenerator::generateFor):
+        * dfg/DFGOperations.cpp:
+        (JSC::operationCreateInlinedArgumentsDuringOSRExit): Deleted.
+        * dfg/DFGOperations.h:
+        (JSC::operationCreateInlinedArgumentsDuringOSRExit): Deleted.
+
+2015-01-15  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove ENABLE(SQL_DATABASE) guards
+        https://bugs.webkit.org/show_bug.cgi?id=140434
+
+        Reviewed by Darin Adler.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * inspector/protocol/Database.json:
+
+2015-01-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Web Inspector and regular console use different source code locations for messages
+        https://bugs.webkit.org/show_bug.cgi?id=140478
+
+        Reviewed by Brian Burg.
+
+        * inspector/ConsoleMessage.h: Expose computed source location.
+
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::addMessageToConsole):
+        (Inspector::InspectorConsoleAgent::stopTiming):
+        (Inspector::InspectorConsoleAgent::count):
+        * inspector/agents/InspectorConsoleAgent.h:
+        addMessageToConsole() now takes a pre-made ConsoleMessage object.
+
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::messageWithTypeAndLevel):
+        (Inspector::JSGlobalObjectConsoleClient::warnUnimplemented):
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        * inspector/agents/JSGlobalObjectDebuggerAgent.cpp:
+        (Inspector::JSGlobalObjectDebuggerAgent::breakpointActionLog):
+        Updated for the above changes.
+
+2015-01-15  Mark Lam  <mark.lam@apple.com>
+
+        [Part 2] Argument object created by "Function dot arguments" should use a clone of argument values.
+        <https://webkit.org/b/140093>
+
+        Reviewed by Geoffrey Garen.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::createArguments):
+        - We should not fetching the lexicalEnvironment here.  The reason we've
+          introduced the ClonedArgumentsCreationMode is because the lexicalEnvironment
+          may not be available to us at this point.  Instead, we'll just pass a nullptr.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::tearOffForCloning):
+        * runtime/Arguments.h:
+        (JSC::Arguments::finishCreation):
+        - Use the new tearOffForCloning() to tear off arguments right out of the values
+          passed on the stack.  tearOff() is not appropriate for this purpose because
+          it takes slowArgumentsData into account.
+
+2015-01-14  Matthew Mirman  <mmirman@apple.com>
+
+        Removed accidental commit of "invalid_array.js" 
+        http://trac.webkit.org/changeset/178439
+
+        * tests/stress/invalid_array.js: Removed.
+
+2015-01-14  Matthew Mirman  <mmirman@apple.com>
+
+        Fixes operationPutByIdOptimizes such that they check that the put didn't
+        change the structure of the object who's property access is being
+        cached.  Also removes uses of the new base value from the cache generation code.
+        https://bugs.webkit.org/show_bug.cgi?id=139500
+
+        Reviewed by Filip Pizlo.
+
+        * jit/JITOperations.cpp:
+        (JSC::operationPutByIdStrictOptimize): saved the structure before the put.
+        (JSC::operationPutByIdNonStrictOptimize): ditto.
+        (JSC::operationPutByIdDirectStrictOptimize): ditto.
+        (JSC::operationPutByIdDirectNonStrictOptimize): ditto.
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+        (JSC::emitPutReplaceStub):
+        (JSC::emitPutTransitionStubAndGetOldStructure): Added.
+        (JSC::tryCachePutByID):
+        (JSC::repatchPutByID):
+        (JSC::tryBuildPutByIdList):
+        (JSC::tryRepatchIn):
+        (JSC::emitPutTransitionStub): Deleted.
+        * jit/Repatch.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::genericPropertyNameEnumerator):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChainForChainAccess): restructured to not use the base value.
+        (JSC::normalizePrototypeChain): restructured to not use the base value.
+        * tests/mozilla/mozilla-tests.yaml:
+        * tests/stress/proto-setter.js: Added.
+        * tests/stress/put-by-id-build-list-order-recurse.js: Added.
+        Added test that fails without this patch.
+
+2015-01-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused ResizeImage and DecodeImageData timeline events
+        https://bugs.webkit.org/show_bug.cgi?id=140404
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Timeline.json:
+
+2015-01-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        DFG can call PutByValDirect for generic arrays
+        https://bugs.webkit.org/show_bug.cgi?id=140389
+
+        Reviewed by Geoffrey Garen.
+
+        Computed properties in object initializers (ES6) use the put_by_val_direct operation.
+        However, current DFG asserts that put_by_val_direct is not used for the generic array,
+        the assertion failure is raised.
+        This patch allow DFG to use put_by_val_direct to generic arrays.
+
+        And fix the DFG put_by_val_direct implementation for string properties.
+        At first, put_by_val_direct is inteded to be used for spread elements.
+        So the property keys were limited to numbers (indexes).
+        But now, it's also used for computed properties in object initializers.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2015-01-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Out of bounds access in BytecodeGenerator::emitGetById under DotAccessorNode::emitBytecode
+        https://bugs.webkit.org/show_bug.cgi?id=140397
+
+        Reviewed by Geoffrey Garen.
+
+        Patch by Alexey Proskuryakov.
+
+        Reviewed, performance tested, and ChangeLogged by Geoffrey Garen.
+
+        No performance change.
+
+        No test, since this is a small past-the-end read, which is very
+        difficult to turn into a reproducible failing test -- and existing tests
+        crash reliably using ASan.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::PostfixNode::emitResolve):
+        (JSC::DeleteBracketNode::emitBytecode):
+        (JSC::DeleteDotNode::emitBytecode):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BitwiseNotNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+        (JSC::StrictEqualNode::emitBytecode):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode): Use RefPtr in more places. Any
+        register used across a call to a function that might allocate a new
+        temporary register must be held in a RefPtr.
+
+2015-01-12  Michael Saboff  <msaboff@apple.com>
+
+        Local JSArray* "keys" in objectConstructorKeys() is not marked during garbage collection
+        https://bugs.webkit.org/show_bug.cgi?id=140348
+
+        Reviewed by Mark Lam.
+
+        We used to read registers in MachineThreads::gatherFromCurrentThread(), but that is too late
+        because those registers may have been spilled on the stack and replaced with other values by
+        the time we call down to gatherFromCurrentThread().
+
+        Now we get the register contents at the same place that we demarcate the current top of
+        stack using the address of a local variable, in Heap::markRoots().  The register contents
+        buffer is passed along with the demarcation pointer.  These need to be done at this level 
+        in the call tree and no lower, as markRoots() calls various functions that visit object
+        pointers that may be latter proven dead.  Any of those pointers that are left on the
+        stack or in registers could be incorrectly marked as live if we scan the stack contents
+        from a called function or one of its callees.  The stack demarcation pointer and register
+        saving need to be done in the same function so that we have a consistent stack, active
+        and spilled registers.
+
+        Because we don't want to make unnecessary calls to get the register contents, we use
+        a macro to allocated, and possibly align, the register structure and get the actual
+        register contents.
+
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::gatherStackRoots):
+        * heap/Heap.h:
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * heap/MachineStackMarker.h:
+
+2015-01-12  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add basic pattern matching support to the url filters
+        https://bugs.webkit.org/show_bug.cgi?id=140283
+
+        Reviewed by Andreas Kling.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Make YarrParser.h private in order to use it from WebCore.
+
+2015-01-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Out of bounds read in IdentifierArena::makeIdentifier
+        https://bugs.webkit.org/show_bug.cgi?id=140376
+
+        Patch by Alexey Proskuryakov.
+
+        Reviewed and ChangeLogged by Geoffrey Garen.
+
+        No test, since this is a small past-the-end read, which is very
+        difficult to turn into a reproducible failing test -- and existing tests
+        crash reliably using ASan.
+
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::makeIdentifier):
+        (JSC::IdentifierArena::makeIdentifierLCharFromUChar): Check for a
+        zero-length string input, like we do in the literal parser, since it is
+        not valid to dereference characters in a zero-length string.
+
+        A zero-length string is allowed in JavaScript -- for example, "".
+
+2015-01-11  Sam Weinig  <sam@webkit.org>
+
+        Remove support for SharedWorkers
+        https://bugs.webkit.org/show_bug.cgi?id=140344
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-01-12  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Allow targetting the SVG->OTF font converter with ENABLE(SVG_OTF_CONVERTER)
+        https://bugs.webkit.org/show_bug.cgi?id=136769
+
+        Reviewed by Antti Koivisto.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-01-12  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r178266.
+        https://bugs.webkit.org/show_bug.cgi?id=140363
+
+        Broke a JSC test (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Local JSArray* "keys" in objectConstructorKeys() is not
+        marked during garbage collection"
+        https://bugs.webkit.org/show_bug.cgi?id=140348
+        http://trac.webkit.org/changeset/178266
+
+2015-01-12  Michael Saboff  <msaboff@apple.com>
+
+        Local JSArray* "keys" in objectConstructorKeys() is not marked during garbage collection
+        https://bugs.webkit.org/show_bug.cgi?id=140348
+
+        Reviewed by Mark Lam.
+
+        Move the address of the local variable that is used to demarcate the top of the stack for 
+        conservative roots down to MachineThreads::gatherFromCurrentThread() since it also gets
+        the register values using setjmp().  That way we don't lose any callee save register
+        contents between Heap::markRoots(), where it was set, and gatherFromCurrentThread().
+        If we lose any JSObject* that are only in callee save registers, they will be GC'ed
+        erroneously.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::gatherStackRoots):
+        * heap/Heap.h:
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::gatherConservativeRoots):
+        * heap/MachineStackMarker.h:
+
+2015-01-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Fix typo in testate.c error messages
+        https://bugs.webkit.org/show_bug.cgi?id=140305
+
+        Reviewed by Geoffrey Garen.
+
+        * API/tests/testapi.c:
+        (main): "... script did not timed out ..." -> "... script did not time out ..."
+
+2015-01-09  Michael Saboff  <msaboff@apple.com>
+
+        Breakpoint doesn't fire in this HTML5 game
+        https://bugs.webkit.org/show_bug.cgi?id=140269
+
+        Reviewed by Mark Lam.
+
+        When parsing a single line cached function, use the lineStartOffset of the
+        location where we found the cached function instead of the cached lineStartOffset.
+        The cache location's lineStartOffset has not been adjusted for any possible
+        containing functions.
+
+        This change is not needed for multi-line cached functions.  Consider the
+        single line source:
+
+        function outer(){function inner1(){doStuff();}; (function inner2() {doMoreStuff()})()}
+
+        The first parser pass, we parse and cache inner1() and inner2() with a lineStartOffset
+        of 0.  Later when we parse outer() and find inner1() in the cache, SourceCode start
+        character is at outer()'s outermost open brace.  That is what we should use for
+        lineStartOffset for inner1().  When done parsing inner1() we set the parsing token
+        to the saved location for inner1(), including the lineStartOffset of 0.  We need
+        to use the value of lineStartOffset before we started parsing inner1().  That is
+        what the fix does.  When we parse inner2() the lineStartOffset will be correct.
+
+        For a multi-line function, the close brace is guaranteed to be on a different line
+        than the open brace.  Hence, its lineStartOffset will not change with the change of
+        the SourceCode start character
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+
+2015-01-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Uncaught Exception in ProbeManager deleting breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=140279
+        rdar://problem/19422299
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/MapData.cpp:
+        (JSC::MapData::replaceAndPackBackingStore):
+        The cell table also needs to have its values fixed.
+
+2015-01-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove or use TimelineAgent Resource related event types
+        https://bugs.webkit.org/show_bug.cgi?id=140155
+
+        Reviewed by Timothy Hatcher.
+
+        Remove unused / stale Timeline event types.
+
+        * inspector/protocol/Timeline.json:
+
+2015-01-09  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r177925): It broke the !ENABLE(INSPECTOR) build
+        https://bugs.webkit.org/show_bug.cgi?id=140098
+
+        Reviewed by Brian Burg.
+
+        * inspector/InspectorBackendDispatcher.h: Missing ENABLE(INSPECTOR) guard added.
+
+2015-01-08  Mark Lam  <mark.lam@apple.com>
+
+        Argument object created by "Function dot arguments" should use a clone of the argument values.
+        <https://webkit.org/b/140093>
+
+        Reviewed by Geoffrey Garen.
+
+        After the change in <https://webkit.org/b/139827>, the dfg-tear-off-arguments-not-activation.js
+        test will crash.  The relevant code which manifests the issue is as follows:
+
+            function bar() {
+                return foo.arguments;
+            }
+
+            function foo(p) {
+                var x = 42;
+                if (p)
+                    return (function() { return x; });
+                else
+                    return bar();
+            }
+
+        In this case, foo() has no knowledge of bar() needing its LexicalEnvironment and
+        has dead code eliminated the SetLocal that stores it into its designated local.
+        In bar(), the factory for the Arguments object (for creating foo.arguments) tries
+        to read foo's LexicalEnvironment from its designated lexicalEnvironment local,
+        but instead, finds it to be uninitialized.  This results in a null pointer access
+        which causes a crash.
+
+        This can be resolved by having bar() instantiate a clone of the Arguments object
+        instead, and populate its elements with values fetched directly from foo's frame.
+        There's no need to reference foo's LexicalEnvironment (whether present or not).
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::createArguments):
+        * runtime/Arguments.h:
+        (JSC::Arguments::finishCreation):
+
+2015-01-08  Mark Lam  <mark.lam@apple.com>
+
+        Make the LLINT and Baseline JIT's op_create_arguments and op_get_argument_by_val use their lexicalEnvironment operand.
+        <https://webkit.org/b/140236>
+
+        Reviewed by Geoffrey Garen.
+
+        Will change the DFG to use the operand on a subsequent pass.  For now,
+        the DFG uses a temporary thunk (operationCreateArgumentsForDFG()) to
+        retain the old behavior of getting the lexicalEnviroment from the
+        ExecState.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitGetArgumentByVal):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        - When the lexicalEnvironment is not available, pass the invalid VirtualRegister
+          instead of an empty JSValue as the lexicalEnvironment operand.
+
+        * dfg/DFGOperations.cpp:
+        - Use the lexicalEnvironment from the ExecState for now.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        - Use the operationCreateArgumentsForDFG() thunk for now.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::lexicalEnvironmentOrNullptr):
+        * interpreter/CallFrame.h:
+        - Added this convenience function to return either the
+          lexicalEnvironment or a nullptr so that we don't need to do a
+          conditional check on codeBlock->needsActivation() at multiple sites.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::createArguments):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emitSlow_op_get_argument_by_val):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::finishCreation):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::argumentsGetter):
+
+2015-01-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Pause Reason Improvements (Breakpoint, Debugger Statement, Pause on Next Statement)
+        https://bugs.webkit.org/show_bug.cgi?id=138991
+
+        Reviewed by Timothy Hatcher.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::pauseIfNeeded):
+        (JSC::Debugger::didReachBreakpoint):
+        When actually pausing, if we hit a breakpoint ensure the reason
+        is PausedForBreakpoint, otherwise use the current reason.
+
+        * debugger/Debugger.h:
+        Make pause reason and pausing breakpoint ID public.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::buildAssertPauseReason):
+        (Inspector::buildCSPViolationPauseReason):
+        (Inspector::InspectorDebuggerAgent::buildBreakpointPauseReason):
+        (Inspector::InspectorDebuggerAgent::buildExceptionPauseReason):
+        (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
+        (Inspector::buildObjectForBreakpointCookie):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::removeBreakpoint):
+        (Inspector::InspectorDebuggerAgent::resolveBreakpoint):
+        (Inspector::InspectorDebuggerAgent::pause):
+        (Inspector::InspectorDebuggerAgent::scriptExecutionBlockedByCSP):
+        (Inspector::InspectorDebuggerAgent::currentCallFrames):
+        (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
+        Clean up creation of pause reason objects and other cleanup
+        of PassRefPtr use and InjectedScript use.
+
+        (Inspector::InspectorDebuggerAgent::didPause):
+        Clean up so that we first check for an Exception, and then fall
+        back to including a Pause Reason derived from the Debugger.
+
+        * inspector/protocol/Debugger.json:
+        Add new DebuggerStatement, Breakpoint, and PauseOnNextStatement reasons.
+
+2015-01-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Type check NSArray's in ObjC Interfaces have the right object types
+        https://bugs.webkit.org/show_bug.cgi?id=140209
+
+        Reviewed by Timothy Hatcher.
+
+        Check the types of objects in NSArrays for all interfaces (commands, events, types)
+        when the user can set an array of objects. Previously we were only type checking
+        they were RWIJSONObjects, now we add an explicit check for the exact object type.
+
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator._generate_success_block_for_command):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event):
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
+        (ObjCProtocolTypesImplementationGenerator._generate_setter_for_member):
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator.objc_class_for_array_type):
+        (ObjCGenerator):
+
+2015-01-07  Mark Lam  <mark.lam@apple.com>
+
+        Add the lexicalEnvironment as an operand to op_get_argument_by_val.
+        <https://webkit.org/b/140233>
+
+        Reviewed by Filip Pizlo.
+
+        This patch only adds the operand to the bytecode.  It is not in use yet.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetArgumentByVal):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2015-01-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Investigate the character type of repeated string instead of checking is8Bit flag
+        https://bugs.webkit.org/show_bug.cgi?id=140139
+
+        Reviewed by Darin Adler.
+
+        Instead of checking is8Bit flag of the repeated string, investigate
+        the actual value of the repeated character since i8Bit flag give a false negative case.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::repeatCharacter):
+        (JSC::stringProtoFuncRepeat):
+        (JSC::repeatSmallString): Deleted.
+
+2015-01-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ObjC Generate types from the GenericTypes domain
+        https://bugs.webkit.org/show_bug.cgi?id=140229
+
+        Reviewed by Timothy Hatcher.
+
+        Generate types from the GenericTypes domain, as they are expected
+        by other domains (like Page domain). Also, don't include the @protocol
+        forward declaration for a domain if it doesn't have any commands.
+
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
+        (ObjCBackendDispatcherHeaderGenerator._generate_objc_forward_declarations):
+        (ObjCBackendDispatcherHeaderGenerator): Deleted.
+        (ObjCBackendDispatcherHeaderGenerator._generate_objc_forward_declarations_for_domains): Deleted.
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator):
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2015-01-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unnecessary copyRef for paramsObject in generated dispatchers
+        https://bugs.webkit.org/show_bug.cgi?id=140228
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event_out_parameters):
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+
+2015-01-07  Saam Barati  <saambarati1@gmail.com>
+
+        interpret op_profile_type in the LLInt instead of unconditionally calling into the slow path
+        https://bugs.webkit.org/show_bug.cgi?id=140165
+
+        Reviewed by Michael Saboff.
+
+        Inlining the functionality of TypeProfilerLog::recordTypeInformationForLocation
+        into the LLInt speeds up type profiling.
+
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/TypeProfilerLog.h:
+        (JSC::TypeProfilerLog::recordTypeInformationForLocation): Deleted.
+
+2015-01-07  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: purge PassRefPtr from Inspector code and use Ref for typed and untyped protocol objects
+        https://bugs.webkit.org/show_bug.cgi?id=140053
+
+        Reviewed by Andreas Kling.
+
+        This patch replaces uses of PassRefPtr with uses of RefPtr&& and WTF::move() in code
+        related to Web Inspector. It also converts many uses of RefPtr to Ref where
+        references are always non-null. These two refactorings have been combined since
+        they tend to require similar changes to the code.
+
+        Creation methods for subclasses of InspectorValue now return a Ref, and callsites
+        have been updated to take a Ref instead of RefPtr.
+
+        Builders for typed protocol objects now return a Ref. Since there is no implicit
+        call to operator&, callsites now must explicitly call .release() to convert a
+        builder object into the corresponding protocol object once required fields are set.
+        Update callsites and use auto to eliminate repetition of longwinded protocol types.
+
+        Tests for inspector protocol and replay inputs have been rebaselined.
+
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        (Deprecated::ScriptValue::toInspectorValue):
+        * bindings/ScriptValue.h:
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::addToFrontend):
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::buildObjectForSearchMatch):
+        (Inspector::ContentSearchUtilities::searchInTextByLines):
+        * inspector/ContentSearchUtilities.h:
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getFunctionDetails):
+        (Inspector::InjectedScript::getProperties):
+        (Inspector::InjectedScript::getInternalProperties):
+        (Inspector::InjectedScript::wrapCallFrames):
+        (Inspector::InjectedScript::wrapObject):
+        (Inspector::InjectedScript::wrapTable):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::makeEvalCall): Split the early exits.
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::InspectorBackendDispatcher::CallbackBase::CallbackBase):
+        (Inspector::InspectorBackendDispatcher::CallbackBase::sendIfActive):
+        (Inspector::InspectorBackendDispatcher::create):
+        (Inspector::InspectorBackendDispatcher::dispatch):
+        (Inspector::InspectorBackendDispatcher::sendResponse):
+        (Inspector::InspectorBackendDispatcher::reportProtocolError):
+        (Inspector::getPropertyValue): Add a comment to clarify what this clever code does.
+        (Inspector::InspectorBackendDispatcher::getInteger):
+        (Inspector::InspectorBackendDispatcher::getDouble):
+        (Inspector::InspectorBackendDispatcher::getString):
+        (Inspector::InspectorBackendDispatcher::getBoolean):
+        (Inspector::InspectorBackendDispatcher::getObject):
+        (Inspector::InspectorBackendDispatcher::getArray):
+        (Inspector::InspectorBackendDispatcher::getValue):
+        * inspector/InspectorBackendDispatcher.h: Use a typed protocol object to collect
+        protocol error strings.
+        (Inspector::InspectorSupplementalBackendDispatcher::InspectorSupplementalBackendDispatcher):
+        Convert the supplemental dispatcher's reference to Ref since it is never null.
+        * inspector/InspectorEnvironment.h:
+        * inspector/InspectorProtocolTypes.h: Get rid of ArrayItemHelper and
+        StructItemTraits. Add more versions of addItem to handle pushing various types.
+        (Inspector::Protocol::Array::openAccessors):
+        (Inspector::Protocol::Array::addItem):
+        (Inspector::Protocol::Array::create):
+        (Inspector::Protocol::StructItemTraits::push):
+        (Inspector::Protocol::BindingTraits<Protocol::Array<T>>::runtimeCast): Assert argument.
+        (Inspector::Protocol::StructItemTraits::pushRefPtr): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<String>::Traits::pushRaw): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<int>::Traits::pushRaw): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<double>::Traits::pushRaw): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<bool>::Traits::pushRaw): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<InspectorValue>::Traits::pushRefPtr): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<InspectorObject>::Traits::pushRefPtr): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<InspectorArray>::Traits::pushRefPtr): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<Protocol::Array<T>>::Traits::pushRefPtr): Deleted.
+        * inspector/InspectorValues.cpp: Straighten out getArray and getObject to have
+        the same call signature as other getters. Use Ref where possible.
+        (Inspector::InspectorObjectBase::getBoolean):
+        (Inspector::InspectorObjectBase::getString):
+        (Inspector::InspectorObjectBase::getObject):
+        (Inspector::InspectorObjectBase::getArray):
+        (Inspector::InspectorObjectBase::getValue):
+        (Inspector::InspectorObjectBase::writeJSON):
+        (Inspector::InspectorArrayBase::get):
+        (Inspector::InspectorObject::create):
+        (Inspector::InspectorArray::create):
+        (Inspector::InspectorValue::null):
+        (Inspector::InspectorString::create):
+        (Inspector::InspectorBasicValue::create):
+        (Inspector::InspectorObjectBase::get): Deleted.
+        * inspector/InspectorValues.h:
+        (Inspector::InspectorObjectBase::setValue):
+        (Inspector::InspectorObjectBase::setObject):
+        (Inspector::InspectorObjectBase::setArray):
+        (Inspector::InspectorArrayBase::pushValue):
+        (Inspector::InspectorArrayBase::pushObject):
+        (Inspector::InspectorArrayBase::pushArray):
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::messageWithTypeAndLevel):
+        (Inspector::JSGlobalObjectConsoleClient::count):
+        (Inspector::JSGlobalObjectConsoleClient::timeEnd):
+        (Inspector::JSGlobalObjectConsoleClient::timeStamp):
+        * inspector/JSGlobalObjectConsoleClient.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::executionStopwatch):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/ScriptCallFrame.cpp:
+        (Inspector::ScriptCallFrame::buildInspectorObject):
+        * inspector/ScriptCallFrame.h:
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::create):
+        (Inspector::ScriptCallStack::buildInspectorArray):
+        * inspector/ScriptCallStack.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::enable):
+        (Inspector::InspectorAgent::inspect):
+        (Inspector::InspectorAgent::activateExtraDomain):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
+        (Inspector::buildObjectForBreakpointCookie):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        (Inspector::InspectorDebuggerAgent::resolveBreakpoint):
+        (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (Inspector::InspectorDebuggerAgent::scriptExecutionBlockedByCSP):
+        (Inspector::InspectorDebuggerAgent::currentCallFrames):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        (Inspector::InspectorDebuggerAgent::breakProgram):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::buildErrorRangeObject):
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::InspectorRuntimeAgent::getBasicBlocks):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/scripts/codegen/cpp_generator.py:
+        (CppGenerator.cpp_type_for_unchecked_formal_in_parameter):
+        (CppGenerator.cpp_type_for_type_with_name):
+        (CppGenerator.cpp_type_for_formal_async_parameter):
+        (CppGenerator.should_use_references_for_type):
+        (CppGenerator):
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
+        (CppBackendDispatcherHeaderGenerator.generate_output):
+        (CppBackendDispatcherHeaderGenerator._generate_async_handler_declaration_for_command):
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator._generate_small_dispatcher_switch_implementation_for_domain):
+        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
+        (CppFrontendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
+        (CppProtocolTypesHeaderGenerator.generate_output):
+        (_generate_class_for_object_declaration):
+        (_generate_unchecked_setter_for_member):
+        (_generate_forward_declarations_for_binding_traits):
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator._generate_success_block_for_command):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event):
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event_out_parameters):
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator.generate_output):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * replay/EncodedValue.cpp:
+        (JSC::EncodedValue::asObject):
+        (JSC::EncodedValue::asArray):
+        (JSC::EncodedValue::put<EncodedValue>):
+        (JSC::EncodedValue::append<EncodedValue>):
+        (JSC::EncodedValue::get<EncodedValue>):
+        * replay/EncodedValue.h:
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Type.borrow_type):
+        (Type.argument_type):
+        (Generator.generate_member_move_expression):
+        * runtime/ConsoleClient.cpp:
+        (JSC::ConsoleClient::printConsoleMessageWithArguments):
+        (JSC::ConsoleClient::internalMessageWithTypeAndLevel):
+        (JSC::ConsoleClient::logWithLevel):
+        (JSC::ConsoleClient::clear):
+        (JSC::ConsoleClient::dir):
+        (JSC::ConsoleClient::dirXML):
+        (JSC::ConsoleClient::table):
+        (JSC::ConsoleClient::trace):
+        (JSC::ConsoleClient::assertCondition):
+        (JSC::ConsoleClient::group):
+        (JSC::ConsoleClient::groupCollapsed):
+        (JSC::ConsoleClient::groupEnd):
+        * runtime/ConsoleClient.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::allStructureRepresentations):
+        (JSC::TypeSet::inspectorTypeSet):
+        (JSC::StructureShape::inspectorRepresentation):
+        * runtime/TypeSet.h:
+
+2015-01-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r178039.
+        https://bugs.webkit.org/show_bug.cgi?id=140187
+
+        Breaks ObjC Inspector Protocol (Requested by JoePeck on
+        #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: purge PassRefPtr from Inspector code and use
+        Ref for typed and untyped protocol objects"
+        https://bugs.webkit.org/show_bug.cgi?id=140053
+        http://trac.webkit.org/changeset/178039
+
+2015-01-06  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: purge PassRefPtr from Inspector code and use Ref for typed and untyped protocol objects
+        https://bugs.webkit.org/show_bug.cgi?id=140053
+
+        Reviewed by Andreas Kling.
+
+        This patch replaces uses of PassRefPtr with uses of RefPtr&& and WTF::move() in code
+        related to Web Inspector. It also converts many uses of RefPtr to Ref where
+        references are always non-null. These two refactorings have been combined since
+        they tend to require similar changes to the code.
+
+        Creation methods for subclasses of InspectorValue now return a Ref, and callsites
+        have been updated to take a Ref instead of RefPtr.
+
+        Builders for typed protocol objects now return a Ref. Since there is no implicit
+        call to operator&, callsites now must explicitly call .release() to convert a
+        builder object into the corresponding protocol object once required fields are set.
+        Update callsites and use auto to eliminate repetition of longwinded protocol types.
+
+        Tests for inspector protocol and replay inputs have been rebaselined.
+
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        (Deprecated::ScriptValue::toInspectorValue):
+        * bindings/ScriptValue.h:
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::addToFrontend):
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::buildObjectForSearchMatch):
+        (Inspector::ContentSearchUtilities::searchInTextByLines):
+        * inspector/ContentSearchUtilities.h:
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getFunctionDetails):
+        (Inspector::InjectedScript::getProperties):
+        (Inspector::InjectedScript::getInternalProperties):
+        (Inspector::InjectedScript::wrapCallFrames):
+        (Inspector::InjectedScript::wrapObject):
+        (Inspector::InjectedScript::wrapTable):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::makeEvalCall): Split the early exits.
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::InspectorBackendDispatcher::CallbackBase::CallbackBase):
+        (Inspector::InspectorBackendDispatcher::CallbackBase::sendIfActive):
+        (Inspector::InspectorBackendDispatcher::create):
+        (Inspector::InspectorBackendDispatcher::dispatch):
+        (Inspector::InspectorBackendDispatcher::sendResponse):
+        (Inspector::InspectorBackendDispatcher::reportProtocolError):
+        (Inspector::getPropertyValue): Add a comment to clarify what this clever code does.
+        (Inspector::InspectorBackendDispatcher::getInteger):
+        (Inspector::InspectorBackendDispatcher::getDouble):
+        (Inspector::InspectorBackendDispatcher::getString):
+        (Inspector::InspectorBackendDispatcher::getBoolean):
+        (Inspector::InspectorBackendDispatcher::getObject):
+        (Inspector::InspectorBackendDispatcher::getArray):
+        (Inspector::InspectorBackendDispatcher::getValue):
+        * inspector/InspectorBackendDispatcher.h: Use a typed protocol object to collect
+        protocol error strings.
+        (Inspector::InspectorSupplementalBackendDispatcher::InspectorSupplementalBackendDispatcher):
+        Convert the supplemental dispatcher's reference to Ref since it is never null.
+        * inspector/InspectorEnvironment.h:
+        * inspector/InspectorProtocolTypes.h: Get rid of ArrayItemHelper and
+        StructItemTraits. Add more versions of addItem to handle pushing various types.
+        (Inspector::Protocol::Array::openAccessors):
+        (Inspector::Protocol::Array::addItem):
+        (Inspector::Protocol::Array::create):
+        (Inspector::Protocol::StructItemTraits::push):
+        (Inspector::Protocol::BindingTraits<Protocol::Array<T>>::runtimeCast): Assert argument.
+        (Inspector::Protocol::StructItemTraits::pushRefPtr): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<String>::Traits::pushRaw): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<int>::Traits::pushRaw): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<double>::Traits::pushRaw): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<bool>::Traits::pushRaw): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<InspectorValue>::Traits::pushRefPtr): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<InspectorObject>::Traits::pushRefPtr): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<InspectorArray>::Traits::pushRefPtr): Deleted.
+        (Inspector::Protocol::ArrayItemHelper<Protocol::Array<T>>::Traits::pushRefPtr): Deleted.
+        * inspector/InspectorValues.cpp: Straighten out getArray and getObject to have
+        the same call signature as other getters. Use Ref where possible.
+        (Inspector::InspectorObjectBase::getBoolean):
+        (Inspector::InspectorObjectBase::getString):
+        (Inspector::InspectorObjectBase::getObject):
+        (Inspector::InspectorObjectBase::getArray):
+        (Inspector::InspectorObjectBase::getValue):
+        (Inspector::InspectorObjectBase::writeJSON):
+        (Inspector::InspectorArrayBase::get):
+        (Inspector::InspectorObject::create):
+        (Inspector::InspectorArray::create):
+        (Inspector::InspectorValue::null):
+        (Inspector::InspectorString::create):
+        (Inspector::InspectorBasicValue::create):
+        (Inspector::InspectorObjectBase::get): Deleted.
+        * inspector/InspectorValues.h:
+        (Inspector::InspectorObjectBase::setValue):
+        (Inspector::InspectorObjectBase::setObject):
+        (Inspector::InspectorObjectBase::setArray):
+        (Inspector::InspectorArrayBase::pushValue):
+        (Inspector::InspectorArrayBase::pushObject):
+        (Inspector::InspectorArrayBase::pushArray):
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::messageWithTypeAndLevel):
+        (Inspector::JSGlobalObjectConsoleClient::count):
+        (Inspector::JSGlobalObjectConsoleClient::timeEnd):
+        (Inspector::JSGlobalObjectConsoleClient::timeStamp):
+        * inspector/JSGlobalObjectConsoleClient.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::executionStopwatch):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/ScriptCallFrame.cpp:
+        (Inspector::ScriptCallFrame::buildInspectorObject):
+        * inspector/ScriptCallFrame.h:
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::create):
+        (Inspector::ScriptCallStack::buildInspectorArray):
+        * inspector/ScriptCallStack.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::enable):
+        (Inspector::InspectorAgent::inspect):
+        (Inspector::InspectorAgent::activateExtraDomain):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
+        (Inspector::buildObjectForBreakpointCookie):
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::setBreakpoint):
+        (Inspector::InspectorDebuggerAgent::continueToLocation):
+        (Inspector::InspectorDebuggerAgent::resolveBreakpoint):
+        (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (Inspector::InspectorDebuggerAgent::scriptExecutionBlockedByCSP):
+        (Inspector::InspectorDebuggerAgent::currentCallFrames):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        (Inspector::InspectorDebuggerAgent::breakProgram):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::buildErrorRangeObject):
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::InspectorRuntimeAgent::getBasicBlocks):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/scripts/codegen/cpp_generator.py:
+        (CppGenerator.cpp_type_for_unchecked_formal_in_parameter):
+        (CppGenerator.cpp_type_for_type_with_name):
+        (CppGenerator.cpp_type_for_formal_async_parameter):
+        (CppGenerator.should_use_references_for_type):
+        (CppGenerator):
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
+        (CppBackendDispatcherHeaderGenerator.generate_output):
+        (CppBackendDispatcherHeaderGenerator._generate_async_handler_declaration_for_command):
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator._generate_small_dispatcher_switch_implementation_for_domain):
+        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
+        (CppFrontendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
+        (CppProtocolTypesHeaderGenerator.generate_output):
+        (_generate_class_for_object_declaration):
+        (_generate_unchecked_setter_for_member):
+        (_generate_forward_declarations_for_binding_traits):
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator._generate_success_block_for_command):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event):
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event_out_parameters):
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator.generate_output):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * replay/EncodedValue.cpp:
+        (JSC::EncodedValue::asObject):
+        (JSC::EncodedValue::asArray):
+        (JSC::EncodedValue::put<EncodedValue>):
+        (JSC::EncodedValue::append<EncodedValue>):
+        (JSC::EncodedValue::get<EncodedValue>):
+        * replay/EncodedValue.h:
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Type.borrow_type):
+        (Type.argument_type):
+        (Generator.generate_member_move_expression):
+        * runtime/ConsoleClient.cpp:
+        (JSC::ConsoleClient::printConsoleMessageWithArguments):
+        (JSC::ConsoleClient::internalMessageWithTypeAndLevel):
+        (JSC::ConsoleClient::logWithLevel):
+        (JSC::ConsoleClient::clear):
+        (JSC::ConsoleClient::dir):
+        (JSC::ConsoleClient::dirXML):
+        (JSC::ConsoleClient::table):
+        (JSC::ConsoleClient::trace):
+        (JSC::ConsoleClient::assertCondition):
+        (JSC::ConsoleClient::group):
+        (JSC::ConsoleClient::groupCollapsed):
+        (JSC::ConsoleClient::groupEnd):
+        * runtime/ConsoleClient.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::allStructureRepresentations):
+        (JSC::TypeSet::inspectorTypeSet):
+        (JSC::StructureShape::inspectorRepresentation):
+        * runtime/TypeSet.h:
+
+2015-01-06  Chris Dumez  <cdumez@apple.com>
+
+        Drop ResourceResponseBase::connectionID and connectionReused members
+        https://bugs.webkit.org/show_bug.cgi?id=140158
+
+        Reviewed by Sam Weinig.
+
+        Drop ResourceResponseBase::connectionID and connectionReused members.
+        Those were needed by the Chromium port but are no longer used.
+
+        * inspector/protocol/Network.json:
+
+2015-01-06  Mark Lam  <mark.lam@apple.com>
+
+        Add the lexicalEnvironment as an operand to op_create_arguments.
+        <https://webkit.org/b/140148>
+
+        Reviewed by Geoffrey Garen.
+
+        This patch only adds the operand to the bytecode.  It is not in use yet.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        - Adds the lexicalEnvironment register (if present) as an operand to
+          op_create_arguments.  Else, adds a constant empty JSValue.
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2015-01-06  Alexey Proskuryakov  <ap@apple.com>
+
+        ADDRESS_SANITIZER macro is overloaded
+        https://bugs.webkit.org/show_bug.cgi?id=140130
+
+        Reviewed by Anders Carlsson.
+
+        * interpreter/JSStack.cpp: (JSC::JSStack::sanitizeStack): Use the new macro.
+        This code is nearly unused (only compiled in when JIT is disabled at build time),
+        however I've been told that it's best to keep it.
+
+2015-01-06  Mark Lam  <mark.lam@apple.com>
+
+        Fix Use details for op_create_arguments.
+        <https://webkit.org/b/140110>
+
+        Rubber stamped by Filip Pizlo.
+
+        The previous patch was wrong about op_create_arguments not using its 1st operand.
+        It does read from it (hence, used) to check if the Arguments object has already
+        been created or not.  This patch reverts the change for op_create_arguments.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+
+2015-01-06  Mark Lam  <mark.lam@apple.com>
+
+        Fix Use details for op_create_lexical_environment and op_create_arguments.
+        <https://webkit.org/b/140110>
+
+        Reviewed by Filip Pizlo.
+
+        The current "Use" details for op_create_lexical_environment and
+        op_create_arguments are wrong.  op_create_argument uses nothing instead of the
+        1st operand (the output local).  op_create_lexical_environment uses its 2nd
+        operand (the scope chain) instead of the 1st (the output local).
+        This patch fixes them to specify the proper uses.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+
+2015-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Implement ES6 String.prototype.repeat(count)
+        https://bugs.webkit.org/show_bug.cgi?id=140047
+
+        Reviewed by Darin Adler.
+
+        Introducing ES6 String.prototype.repeat(count) function.
+
+        * runtime/JSString.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::repeatSmallString):
+        (JSC::stringProtoFuncRepeat):
+
+2015-01-03  Michael Saboff  <msaboff@apple.com>
+
+        Crash in operationNewFunction when scrolling on Google+
+        https://bugs.webkit.org/show_bug.cgi?id=140033
+
+        Reviewed by Oliver Hunt.
+
+        In DFG code, the scope register can be eliminated because all uses have been
+        dead code eliminated.  In the case where one of the uses was creating a function
+        that is never used, the baseline code will still create the function.  If we OSR
+        exit to a path where that function gets created, check the scope register value
+        and set the new, but dead, function to undefined instead of creating a new function.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func_exp):
+
+2015-01-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        String includes methods perform toString on searchString before toInt32 on a offset
+        https://bugs.webkit.org/show_bug.cgi?id=140031
+
+        Reviewed by Darin Adler.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+
+2015-01-01  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Change to return std::unique_ptr<> in fooCreate()
+        https://bugs.webkit.org/show_bug.cgi?id=139983
+
+        Reviewed by Darin Adler.
+
+        To avoid unnecessary std::unique_ptr<> casting, fooCreate() returns std::unique_ptr<> directly.
+
+        * create_regex_tables:
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::YarrPattern::reset):
+        (JSC::Yarr::YarrPattern::newlineCharacterClass):
+        (JSC::Yarr::YarrPattern::digitsCharacterClass):
+        (JSC::Yarr::YarrPattern::spacesCharacterClass):
+        (JSC::Yarr::YarrPattern::wordcharCharacterClass):
+        (JSC::Yarr::YarrPattern::nondigitsCharacterClass):
+        (JSC::Yarr::YarrPattern::nonspacesCharacterClass):
+        (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
+
+2015-01-01  Jeff Miller  <jeffm@apple.com>
+
+        Update user-visible copyright strings to include 2015
+        https://bugs.webkit.org/show_bug.cgi?id=139880
+
+        Reviewed by Darin Adler.
+
+        * Info.plist:
+
+2015-01-01  Darin Adler  <darin@apple.com>
+
+        We often misspell identifier as "identifer"
+        https://bugs.webkit.org/show_bug.cgi?id=140025
+
+        Reviewed by Michael Saboff.
+
+        * runtime/ArrayConventions.h: Fix it.
+
+2014-12-29  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Move JavaScriptCore/yarr to std::unique_ptr
+        https://bugs.webkit.org/show_bug.cgi?id=139621
+
+        Reviewed by Anders Carlsson.
+
+        Final clean up OwnPtr|PassOwnPtr in JavaScriptCore/yarr.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
+        (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
+        (JSC::Yarr::YarrGenerator::opCompileBody):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::reset):
+        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::YarrPatternConstructor::copyDisjunction):
+        (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
+        (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::PatternDisjunction::addNewAlternative):
+        (JSC::Yarr::YarrPattern::newlineCharacterClass):
+        (JSC::Yarr::YarrPattern::digitsCharacterClass):
+        (JSC::Yarr::YarrPattern::spacesCharacterClass):
+        (JSC::Yarr::YarrPattern::wordcharCharacterClass):
+        (JSC::Yarr::YarrPattern::nondigitsCharacterClass):
+        (JSC::Yarr::YarrPattern::nonspacesCharacterClass):
+        (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
+
+2014-12-26  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/19348208> REGRESSION (r177027): iOS builds use the wrong toolchain
+        https://bugs.webkit.org/show_bug.cgi?id=139950
+
+        Reviewed by David Kilzer.
+
+        * Configurations/Base.xcconfig: Only define TOOLCHAINS when building for OS X, doing so
+        in a manner that works with Xcode 5.1.1.
+
+2014-12-22  Mark Lam  <mark.lam@apple.com>
+
+        Use ctiPatchCallByReturnAddress() in JITOperations.cpp.
+        <https://webkit.org/b/139892>
+
+        Reviewed by Michael Saboff.
+
+        The code in JITOperations.cpp sometimes calls RepatchBuffer::relinkCallerToFunction()
+        directly, and sometimes uses a helper function, ctiPatchCallByReturnAddress().
+        This patch changes it to use the helper function consistently.
+
+        * jit/JITOperations.cpp:
+
+2014-12-22  Mark Lam  <mark.lam@apple.com>
+
+        Fix some typos in a comment.
+        <https://webkit.org/b/139882>
+
+        Reviewed by Michael Saboff.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+
+2014-12-22  Mark Lam  <mark.lam@apple.com>
+
+        Assert that Array elements not copied when changing shape to ArrayStorage type are indeed holes.
+        <https://webkit.org/b/138118>
+
+        Reviewed by Michael Saboff.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+
+2014-12-20  Eric Carlson  <eric.carlson@apple.com>
+
+        [iOS] add optimized fullscreen API
+        https://bugs.webkit.org/show_bug.cgi?id=139833
+        <rdar://problem/18844486>
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE_VIDEO_PRESENTATION_MODE.
+
+2014-12-20  David Kilzer  <ddkilzer@apple.com>
+
+        Switch from using PLATFORM_NAME to SDK selectors in WebCore, WebInspectorUI, WebKit, WebKit2
+        <http://webkit.org/b/139463>
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        - Simplify SECTORDER_FLAGS.
+
+2014-12-19  Andreas Kling  <akling@apple.com>
+
+        Plug leak below LLVMCopyStringRepOfTargetData().
+        <https://webkit.org/b/139832>
+
+        Reviewed by Michael Saboff.
+
+        LLVMCopyStringRepOfTargetData() returns a strdup()'ed string, so make sure
+        to free() it after we're done using it.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+
+2014-12-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: CRASH inspector-protocol/debugger/breakpoint-action-detach.html
+        https://bugs.webkit.org/show_bug.cgi?id=139797
+
+        Reviewed by Mark Lam.
+
+        * debugger/Debugger.h:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::isAttached):
+        Check if we are the debugger for a particular global object.
+        (JSC::Debugger::pauseIfNeeded):
+        Pass the global object on when hitting a brekapoint.
+
+        * inspector/ScriptDebugServer.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::handleBreakpointHit):
+        Stop evaluting breakpoint actions if a previous action caused the
+        debugger to detach from this global object.
+        (Inspector::ScriptDebugServer::handlePause):
+        Standardize on passing JSGlobalObject parameter first.
+
+2014-12-19  Mark Lam  <mark.lam@apple.com>
+
+        [Win] Endless compiler warnings created by DFGEdge.h.
+        <https://webkit.org/b/139801>
+
+        Reviewed by Brent Fulgham.
+
+        Add a cast to fix the type just the way the 64-bit version does.
+
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::makeWord):
+
+2014-12-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r177574.
+        https://bugs.webkit.org/show_bug.cgi?id=139821
+
+        "Broke Production builds by installing
+        libWebCoreTestSupport.dylib in the wrong directory" (Requested
+        by ddkilzer on #webkit).
+
+        Reverted changeset:
+
+        "Switch from using PLATFORM_NAME to SDK selectors in WebCore,
+        WebInspectorUI, WebKit, WebKit2"
+        https://bugs.webkit.org/show_bug.cgi?id=139463
+        http://trac.webkit.org/changeset/177574
+
+2014-12-19  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(174226): Captured arguments in a using function compiled by the DFG have the initial value when the closure was invoked
+        https://bugs.webkit.org/show_bug.cgi?id=139808
+
+        Reviewed by Oliver Hunt.
+
+        There are three changes here.
+        1) Create a VariableWatchpointSet for captured arguments variables.
+        2) Properly use the VariableWatchpointSet* found in op_put_to_scope in the 64 bit LLInt code.
+        3) Add the same putLocalClosureVar path to the 32 bit LLInt code that exists in the 64 bit version.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-12-19  David Kilzer  <ddkilzer@apple.com>
+
+        Switch from using PLATFORM_NAME to SDK selectors in WebCore, WebInspectorUI, WebKit, WebKit2
+        <http://webkit.org/b/139463>
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        - Simplify SECTORDER_FLAGS.
+
+2014-12-18  Brent Fulgham  <bfulgham@apple.com>
+
+        Unreviewed build fix.
+
+        * jsc.cpp: Remove typo.
+
+2014-12-17  Michael Saboff  <msaboff@apple.com>
+
+        Tests with infinite recursion frequently crash
+        https://bugs.webkit.org/show_bug.cgi?id=139548
+
+        Reviewed by Geoffrey Garen.
+
+        While unwinding, if the call frame doesn't have a codeblock, then we
+        are in native code, handle appropriately.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::unwindCallFrame):
+        (JSC::UnwindFunctor::operator()):
+        Added checks for null CodeBlock.
+
+        (JSC::Interpreter::unwind): Removed wrong ASSERT.
+
+2014-12-17  Chris Dumez  <cdumez@apple.com>
+
+        [iOS] Make it possible to toggle FeatureCounter support at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=139688
+        <rdar://problem/19266254>
+
+        Reviewed by Andreas Kling.
+
+        Stop linking against AppSupport framework as the functionality is no
+        longer in WTF (it was moved to WebCore).
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2014-12-17  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Correct DebugSuffix builds under MSBuild
+        https://bugs.webkit.org/show_bug.cgi?id=139733
+        <rdar://problem/19276880>
+
+        Reviewed by Simon Fraser.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj: Make sure to use the
+        '_debug' suffix when building the DebugSuffix target.
+
+2014-12-16  Enrica Casucci  <enrica@apple.com>
+
+        Fix iOS builders for 8.0
+        https://bugs.webkit.org/show_bug.cgi?id=139495
+
+        Reviewed by Michael Saboff.
+
+        * Configurations/LLVMForJSC.xcconfig:
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-12-16  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r177380.
+        https://bugs.webkit.org/show_bug.cgi?id=139707
+
+        "Breaks js/regres/elidable-new-object-* tests" (Requested by
+        msaboff_ on #webkit).
+
+        Reverted changeset:
+
+        "Fixes operationPutByIdOptimizes such that they check that the
+        put didn't"
+        https://bugs.webkit.org/show_bug.cgi?id=139500
+        http://trac.webkit.org/changeset/177380
+
+2014-12-16  Matthew Mirman  <mmirman@apple.com>
+
+        Fixes operationPutByIdOptimizes such that they check that the put didn't
+        change the structure of the object who's property access is being
+        cached.
+        https://bugs.webkit.org/show_bug.cgi?id=139500
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITOperations.cpp:
+        (JSC::operationPutByIdStrictOptimize): saved the structure before the put.
+        (JSC::operationPutByIdNonStrictOptimize): ditto.
+        (JSC::operationPutByIdDirectStrictOptimize): ditto.
+        (JSC::operationPutByIdDirectNonStrictOptimize): ditto.
+        * jit/Repatch.cpp:
+        (JSC::tryCachePutByID): Added argument for the old structure
+        (JSC::repatchPutByID): Added argument for the old structure
+        * jit/Repatch.h:
+        * tests/stress/put-by-id-build-list-order-recurse.js: 
+        Added test that fails without this patch.
+
+2014-12-15  Chris Dumez  <cdumez@apple.com>
+
+        [iOS] Add feature counting support
+        https://bugs.webkit.org/show_bug.cgi?id=139652
+        <rdar://problem/19255690>
+
+        Reviewed by Gavin Barraclough.
+
+        Link against AppSupport framework on iOS as we need it to implement
+        the new FeatureCounter API in WTF.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2014-12-15  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r177284.
+        https://bugs.webkit.org/show_bug.cgi?id=139658
+
+        "Breaks API tests and LayoutTests on Yosemite Debug"
+        (Requested by msaboff on #webkit).
+
+        Reverted changeset:
+
+        "Make sure range based iteration of Vector<> still receives
+        bounds checking"
+        https://bugs.webkit.org/show_bug.cgi?id=138821
+        http://trac.webkit.org/changeset/177284
+
+2014-12-15  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        [EFL] FTL JIT not working on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=139295
+
+        Reviewed by Michael Saboff.
+
+        Added the missing code for stack unwinding and some additional small fixes
+        to get FTL working correctly.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLUnwindInfo.cpp:
+        (JSC::FTL::UnwindInfo::parse):
+
+2014-12-15  Oliver Hunt  <oliver@apple.com>
+
+        Make sure range based iteration of Vector<> still receives bounds checking
+        https://bugs.webkit.org/show_bug.cgi?id=138821
+
+        Reviewed by Mark Lam.
+
+        Update code to deal with slightly changed iterator semantics.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::visitChildren):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::mdNode):
+        (JSC::FTL::buildCall):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::sortCompactedVector):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::dumpInternal):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+
+2014-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        PutLocalSinkingPhase has an invalid assertion about incoming values, because both liveness and deferral analyses are conservative
+        https://bugs.webkit.org/show_bug.cgi?id=139630
+
+        Reviewed by Oliver Hunt.
+        
+        Replaces a faulty assertion with code to handle an awesome special case. Also adds a lot of
+        comments that reconstruct my reasoning about this code. I had to work hard to remember how
+        deferral worked so I wrote my discoveries down.
+
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertBottomConstantForUse):
+        * dfg/DFGPutLocalSinkingPhase.cpp:
+        * tests/stress/put-local-conservative.js: Added.
+        (foo):
+        (.result):
+        (bar):
+
+2014-12-14  Andreas Kling  <akling@apple.com>
+
+        Replace PassRef with Ref/Ref&& across the board.
+        <https://webkit.org/b/139587>
+
+        Reviewed by Darin Adler.
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::add8):
+        * runtime/Identifier.h:
+        (JSC::Identifier::add):
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::add):
+
+2014-12-12  Matthew Mirman  <mmirman@apple.com>
+
+        shiftCountWithArrayStorage should exit to slow path if the object has a sparse map.
+        https://bugs.webkit.org/show_bug.cgi?id=139598
+        <rdar://problem/18779367>
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::shiftCountWithArrayStorage): Added check for object having a sparse map.
+        * tests/stress/sparse_splice.js: Added.
+
+2014-12-12  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Final clean up OwnPtr in JSC - runtime, ftl, and tool directories
+        https://bugs.webkit.org/show_bug.cgi?id=139532
+
+        Reviewed by Mark Lam.
+
+        Final remove OwnPtr, PassOwnPtr in runtime, ftl, and tools directories of JSC.
+
+        * builtins/BuiltinExecutables.h:
+        * bytecode/CodeBlock.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::IndexedAbstractHeap::atSlow):
+        * ftl/FTLAbstractHeap.h:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLJITFinalizer.h:
+        * jsc.cpp:
+        (jscmain):
+        * parser/Lexer.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::clearDeletedOffsets):
+        (JSC::PropertyTable::addDeletedOffset):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/RegExpObject.cpp:
+        * runtime/SmallStrings.cpp:
+        * runtime/Structure.cpp:
+        * runtime/StructureIDTable.cpp:
+        (JSC::StructureIDTable::StructureIDTable):
+        (JSC::StructureIDTable::resize):
+        * runtime/StructureIDTable.h:
+        * runtime/StructureTransitionTable.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        * runtime/VM.h:
+        * tools/CodeProfile.h:
+        (JSC::CodeProfile::CodeProfile):
+        (JSC::CodeProfile::addChild):
+
+2014-12-11  Dan Bernstein  <mitz@apple.com>
+
+        iOS Simulator production build fix.
+
+        * Configurations/JavaScriptCore.xcconfig: Don’t use an order file when building for the iOS
+        Simulator, as we did prior to 177027.
+
+2014-12-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Explicitly export somre more RWIProtocol classes.
+        rdar://problem/19220408
+
+        Unreviewed build fix.
+
+        * inspector/scripts/codegen/generate_objc_configuration_header.py:
+        (ObjCConfigurationHeaderGenerator._generate_configuration_interface_for_domains):
+        * inspector/scripts/codegen/generate_objc_header.py:
+        (ObjCHeaderGenerator._generate_event_interfaces):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2014-12-11  Alexey Proskuryakov  <ap@apple.com>
+
+        Explicitly export some RWIProtocol classes
+        rdar://problem/19220408
+
+        * inspector/scripts/codegen/generate_objc_header.py:
+        (ObjCHeaderGenerator._generate_type_interface):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2014-12-11  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken build after r177146.
+        https://bugs.webkit.org/show_bug.cgi?id=139533 
+
+        Not reviewed.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init):
+        - Restored CallFrame::init() minus the unused JSScope* arg.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        - Remove JSScope* arg when calling CallFrame::init().
+
+2014-12-11  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION: Use of undefined CallFrame::ScopeChain value
+        https://bugs.webkit.org/show_bug.cgi?id=139533
+
+        Reviewed by Mark Lam.
+
+        Removed CallFrame::scope() and CallFrame::setScope() and eliminated or changed
+        all usages of these funcitons.  In some cases the scope is passed in or determined
+        another way.  In some cases the scope is used to calculate other values.  Lastly
+        were places where these functions where used that are no longer needed.  For
+        example when making a call, the caller's ScopeChain was copied to the callee's
+        ScopeChain.  This change no longer uses the ScopeChain call frame header slot.
+        That slot will be removed in a future patch.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::JSLexicalEnvironment::create):
+        (JSC::JSLexicalEnvironment::JSLexicalEnvironment):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_lexical_environment):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_lexical_environment):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        (JSC::LLInt::llint_throw_stack_overflow_error):
+        Pass the current scope value to the helper operationCreateActivation() and
+        the call to JSLexicalEnvironment::create() instead of using the stack frame
+        scope chain value.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        CreateActivation now has a second child, the scope.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::init): Deleted.  This is dead code.
+        (JSC::ExecState::scope): Deleted.
+        (JSC::ExecState::setScope): Deleted.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters): Changed so we didn't access the scope
+        chain slot.  
+        
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        Changed process to find JSScope values on the stack or by some other means.
+
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::JSWithScope): Deleted.
+        Eliminated unused constructor.
+
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::create):
+        Changed to pass in the current scope.
+
+2014-12-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Use std::unique_ptr instead of OwnPtr in JSC - heap, jit, runtime, and parser directories
+        https://bugs.webkit.org/show_bug.cgi?id=139351
+
+        Reviewed by Filip Pizlo.
+
+        As a step to use std::unique_ptr<>, this cleans up OwnPtr and PassOwnPtr.
+
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::didSurviveGC):
+        (JSC::CopiedBlock::pin):
+        * heap/CopiedBlockInlines.h:
+        (JSC::CopiedBlock::reportLiveBytes):
+        * heap/GCActivityCallback.h:
+        * heap/GCThread.cpp:
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::markListSet):
+        * jit/ExecutableAllocator.cpp:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::clearHostFunctionStubs):
+        * jit/JITThunks.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::pushLabel):
+        * parser/ParserArena.cpp:
+        * parser/ParserArena.h:
+        (JSC::ParserArena::identifierArena):
+        * parser/SourceProviderCache.h:
+        * runtime/CodeCache.h:
+        * runtime/Executable.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::sortVector):
+        * runtime/JSGlobalObject.h:
+
+2014-12-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Please disable the webkitFirstVersionWithInitConstructorSupport check on Apple TV
+        https://bugs.webkit.org/show_bug.cgi?id=139501
+
+        Reviewed by Gavin Barraclough.
+
+        NSVersionOfLinkTimeLibrary only works if you link directly against
+        JavaScriptCore, which is a bit awkward for our Apple TV client to do.
+
+        It's easy enough just to disable this check on Apple TV, since it has no
+        backwards compatibility requirement.
+
+        * API/JSWrapperMap.mm:
+        (supportsInitMethodConstructors):
+
+2014-12-10  Matthew Mirman  <mmirman@apple.com>
+
+        Fixes operationPutByIds such that they check that the put didn't
+        change the structure of the object who's property access is being
+        cached.
+        https://bugs.webkit.org/show_bug.cgi?id=139196
+
+        Reviewed by Filip Pizlo.
+
+        * jit/JITOperations.cpp:
+        (JSC::operationGetByIdOptimize): changed get to getPropertySlot
+        (JSC::operationPutByIdStrictBuildList): saved the structure before the put.
+        (JSC::operationPutByIdNonStrictBuildList): ditto.
+        (JSC::operationPutByIdDirectStrictBuildList): ditto.
+        (JSC::operationPutByIdDirectNonStrictBuildList): ditto.
+        * jit/Repatch.cpp:
+        (JSC::tryCachePutByID): fixed structure() to use the existant vm. 
+        (JSC::tryBuildPutByIdList): Added a check that the old structure's id 
+        is the same as the new.
+        (JSC::buildPutByIdList): Added an argument
+        * jit/Repatch.h: 
+        (JSC::buildPutByIdList): Added an argument
+        * tests/stress/put-by-id-strict-build-list-order.js: Added.
+
+2014-12-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        URTBF after r177030.
+
+        Fix linking failure occured on ARM buildbots:
+        lib/libjavascriptcore_efl.so.1.11.0: undefined reference to `JSC::Structure::get(JSC::VM&, JSC::PropertyName, unsigned int&)'
+
+        * runtime/NullGetterFunction.cpp:
+
+2014-12-09  Michael Saboff  <msaboff@apple.com>
+
+        DFG Tries using an inner object's getter/setter when one hasn't been defined
+        https://bugs.webkit.org/show_bug.cgi?id=139229
+
+        Reviewed by Filip Pizlo.
+
+        Added a new NullGetterFunction singleton class to use for getters and setters that
+        haven't been set to a user defined value.  The NullGetterFunction callReturnUndefined()
+        and createReturnUndefined() methods return undefined.  Changed all null checks of the
+        getter and setter pointers to the newly added isGetterNull() and isSetterNull()
+        helper methods.  
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added NullGetterFunction.cpp & .h to build files.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        Changed checking getter and setter to null to use new isGetterNull() and isSetterNull()
+        helpers.
+
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        Updated calls to GetterSetter::create(), setGetter(), setSetter(), withGetter()
+        and withSetter() to provide a global object.
+
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::withGetter):
+        (JSC::GetterSetter::withSetter):
+        (JSC::callGetter):
+        (JSC::callSetter):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::create):
+        (JSC::GetterSetter::isGetterNull):
+        (JSC::GetterSetter::isSetterNull):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setSetter):
+        Changed to use NullGetterFunction for unspecified getters / setters.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::createThrowTypeError):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::nullGetterFunction):
+        (JSC::JSGlobalObject::evalFunction):
+        Added m_nullGetterFunction singleton.  Updated calls to GetterSetter::create(),
+        setGetter() and setSetter() to provide a global object.
+
+        * runtime/NullGetterFunction.cpp: Added.
+        (JSC::callReturnUndefined):
+        (JSC::constructReturnUndefined):
+        (JSC::NullGetterFunction::getCallData):
+        (JSC::NullGetterFunction::getConstructData):
+        * runtime/NullGetterFunction.h: Added.
+        (JSC::NullGetterFunction::create):
+        (JSC::NullGetterFunction::createStructure):
+        (JSC::NullGetterFunction::NullGetterFunction):
+        New singleton class that returns undefined when called.
+
+2014-12-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Re-enable function.arguments
+        https://bugs.webkit.org/show_bug.cgi?id=139452
+        <rdar://problem/18848149>
+
+        Reviewed by Sam Weinig.
+
+        Disabling function.arguments broke a few websites, and we don't have
+        time right now to work through the details.
+
+        I'm re-enabling function.arguments but leaving in the infrastructure
+        to re-disable it, so we can try this experiment again in the future.
+
+        * runtime/Options.h:
+
+2014-12-09  David Kilzer  <ddkilzer@apple.com>
+
+        Switch from using PLATFORM_NAME to SDK selectors in ANGLE, bmalloc, gtest, JavaScriptCore, WTF
+        <http://webkit.org/b/139212>
+
+        Reviewed by Joseph Pecoraro.
+
+        * Configurations/Base.xcconfig:
+        - Only set GCC_ENABLE_OBJC_GC, GCC_MODEL_TUNING and TOOLCHAINS
+          on OS X.
+        - Only set LLVM_LOCAL_HEADER_PATH and LLVM_SYSTEM_HEADER_PATH on
+          OS X.
+        - Set JAVASCRIPTCORE_CONTENTS_DIR and
+          JAVASCRIPTCORE_FRAMEWORKS_DIR separately for iOS and OS X.
+
+        * Configurations/DebugRelease.xcconfig:
+        - Only set MACOSX_DEPLOYMENT_TARGET and SDKROOT on OS X.
+
+        * Configurations/JSC.xcconfig:
+        - Only set CODE_SIGN_ENTITLEMENTS for iOS hardware builds.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        - Set OTHER_LDFLAGS separately for iOS and OS X.
+        - Set SECTORDER_FLAGS separately for iOS and OS X, but only for
+          Production builds.
+        - Only set EXCLUDED_SOURCE_FILE_NAMES for iOS.
+
+        * Configurations/LLVMForJSC.xcconfig:
+        - Rename LLVM_LIBS_iphoneos to LLVM_LIBS_ios.
+        - Set LLVM_LIBRARY_PATHS and OTHER_LDFLAGS_LLVM_ENABLE_FTL_JIT
+          separately for iOS hardware and OS X.
+        - Fix curly braces in LIBRARY_SEARCH_PATHS.
+        - Merge OTHER_LDFLAGS_BASE into OTHER_LDFLAGS. (Could have been
+          done before this patch.)
+
+        * Configurations/ToolExecutable.xcconfig:
+        - Only set CODE_SIGN_ENTITLEMENTS for iOS, per target.
+        - Only set CLANG_ENABLE_OBJC_ARC for i386 on the iOS Simulator.
+        - Add missing newline.
+
+        * Configurations/Version.xcconfig:
+        - Set SYSTEM_VERSION_PREFIX separately for iOS and OS X.
+
+2014-12-08  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Fix EFL build fix since r177001
+        https://bugs.webkit.org/show_bug.cgi?id=139428
+
+        Unreviewed, EFL build fix.
+
+        Do not inherit duplicated class. ExpressionNode is already
+        child of ParserArenaFreeable class.
+
+        * parser/Nodes.h:
+
+2014-12-08  Shivakumar JM  <shiva.jm@samsung.com>
+
+        Fix Build Warning in JavaScriptCore ControlFlowProfiler::dumpData() api.
+        https://bugs.webkit.org/show_bug.cgi?id=139384
+
+        Reviewed by Mark Lam.
+
+        Fix Build Warning by using dataLog() function instead of dataLogF() function.
+
+        * runtime/ControlFlowProfiler.cpp:
+        (JSC::ControlFlowProfiler::dumpData):
+
+2014-12-08  Saam Barati  <saambarati1@gmail.com>
+
+        Web Inspector: Enable runtime API for JSC's control flow profiler
+        https://bugs.webkit.org/show_bug.cgi?id=139346
+
+        Reviewed by Joseph Pecoraro.
+
+        This patch creates an API that the Web Inspector can use
+        to get information about which basic blocks have exectued
+        from JSC's control flow profiler.
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getBasicBlocks):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Runtime.json:
+
+2014-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed some allocation and cruft from the parser
+        https://bugs.webkit.org/show_bug.cgi?id=139416
+
+        Reviewed by Mark Lam.
+
+        Now, the only AST nodes that require a destructor are the ones that
+        relate to pickling a function's arguments -- which will required some
+        deeper thinking to resolve.
+
+        This is a < 1% parser speedup.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed NodeInfo because it
+        was unused.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CommaNode::emitBytecode):
+        (JSC::SourceElements::lastStatement):
+        (JSC::SourceElements::emitBytecode): Updated for interface change to linked list.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::varDeclarations):
+        (JSC::ASTBuilder::funcDeclarations):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::addVar): Removed the ParserArenaData abstraction because
+        it wasn't buying us anything. We can just use Vector directly.
+
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::appendToCommaExpr): Changed to use a linked list instead
+        of a vector, to avoid allocating a vector with inline capacity in the
+        common case in which an expression is not followed by a vector.
+
+        (JSC::ASTBuilder::Scope::Scope): Use Vector directly to avoid new'ing
+        up a Vector*.
+
+        (JSC::ASTBuilder::appendToComma): Deleted.
+        (JSC::ASTBuilder::combineCommaNodes): Deleted.
+
+        * parser/Lexer.cpp:
+
+        * parser/NodeConstructors.h:
+        (JSC::StatementNode::StatementNode):
+        (JSC::CommaNode::CommaNode):
+        (JSC::SourceElements::SourceElements): Updated for interface change to linked list.
+
+        * parser/NodeInfo.h: Removed.
+
+        * parser/Nodes.cpp:
+        (JSC::SourceElements::append):
+        (JSC::SourceElements::singleStatement): Use a linked list instead of a
+        vector to track the statements in a list. This removes some allocation
+        and it means that we don't need a destructor anymore.
+
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionNode::FunctionNode): Updated for interface change to reference,
+        since these values are never null.
+
+        * parser/Nodes.h:
+        (JSC::StatementNode::next):
+        (JSC::StatementNode::setNext):
+        (JSC::CommaNode::append): Deleted. Updated for interface change to linked list.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::didFinishParsing): Updated for interface change to reference.
+
+        (JSC::Parser<LexerType>::parseVarDeclarationList):
+        (JSC::Parser<LexerType>::parseExpression): Track comma expressions as
+        an explicit list of CommaNodes, removing a use of vector and a destructor.
+
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::appendToCommaExpr):
+        (JSC::SyntaxChecker::appendToComma): Deleted. Updated for interface changes.
+
+2014-12-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r176979.
+        https://bugs.webkit.org/show_bug.cgi?id=139424
+
+        "New JSC test in this patch is failing" (Requested by mlam on
+        #webkit).
+
+        Reverted changeset:
+
+        "Fixes operationPutByIds such that they check that the put
+        didn't"
+        https://bugs.webkit.org/show_bug.cgi?id=139196
+        http://trac.webkit.org/changeset/176979
+
+2014-12-08  Matthew Mirman  <mmirman@apple.com>
+
+        Fixes operationPutByIds such that they check that the put didn't
+        change the structure of the object who's property access is being
+        cached.
+        https://bugs.webkit.org/show_bug.cgi?id=139196
+
+        Reviewed by Filip Pizlo.
+
+        * jit/JITOperations.cpp:
+        (JSC::operationGetByIdOptimize): changed get to getPropertySlot
+        (JSC::operationPutByIdStrictBuildList): saved the structure before the put.
+        (JSC::operationPutByIdNonStrictBuildList): ditto.
+        (JSC::operationPutByIdDirectStrictBuildList): ditto.
+        (JSC::operationPutByIdDirectNonStrictBuildList): ditto.
+        * jit/Repatch.cpp:
+        (JSC::tryCachePutByID): fixed structure() to use the existant vm. 
+        (JSC::tryBuildPutByIdList): Added a check that the old structure's id 
+        is the same as the new.
+        (JSC::buildPutByIdList): Added an argument
+        * jit/Repatch.h: 
+        (JSC::buildPutByIdList): Added an argument
+        * tests/stress/put-by-id-build-list-order-recurse.js: Test that failed before the change
+        * tests/stress/put-by-id-strict-build-list-order.js: Added.
+
+ 
+2014-12-08  Anders Carlsson  <andersca@apple.com>
+
+        Change WTF::currentCPUTime to return std::chrono::microseconds and get rid of currentCPUTimeMS
+        https://bugs.webkit.org/show_bug.cgi?id=139410
+
+        Reviewed by Andreas Kling.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupSetExecutionTimeLimit):
+        (JSContextGroupClearExecutionTimeLimit):
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::setTimeLimit):
+        (JSC::Watchdog::didFire):
+        (JSC::Watchdog::startCountdownIfNeeded):
+        (JSC::Watchdog::startCountdown):
+        * runtime/Watchdog.h:
+        * runtime/WatchdogMac.cpp:
+        (JSC::Watchdog::startTimer):
+
+2014-12-08  Mark Lam  <mark.lam@apple.com>
+
+        CFA wrongly assumes that a speculation for SlowPutArrayStorageShape disallows ArrayStorageShape arrays.
+        <https://webkit.org/b/139327>
+
+        Reviewed by Michael Saboff.
+
+        The code generator and runtime slow paths expects otherwise.  This patch fixes
+        CFA to match the code generator's expectation.
+
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
+        (JSC::DFG::ArrayMode::arrayModesWithIndexingShapes):
+
+2014-12-08  Chris Dumez  <cdumez@apple.com>
+
+        Revert r176293 & r176275
+
+        Unreviewed, revert r176293 & r176275 changing the Vector API to use unsigned type
+        instead of size_t. There is some disagreement regarding the long-term direction
+        of the API and we shouldn’t leave the API partly transitioned to unsigned type
+        while making a decision.
+
+        * bytecode/PreciseJumpTargets.cpp:
+        * replay/EncodedValue.h:
+
+2014-12-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove the unused WTF_USE_GCC_COMPUTED_GOTO_WORKAROUND after r129453.
+        https://bugs.webkit.org/show_bug.cgi?id=139373
+
+        Reviewed by Sam Weinig.
+
+        * interpreter/Interpreter.cpp:
+
+2014-12-06  Anders Carlsson  <andersca@apple.com>
+
+        Fix build with newer versions of clang.
+        rdar://problem/18978716
+
+        * ftl/FTLJITCode.h:
+        Add missing overrides.
+
+2014-12-05  Roger Fong  <roger_fong@apple.com>
+
+        [Win] proj files copying over too many resources..
+        https://bugs.webkit.org/show_bug.cgi?id=139315.
+        <rdar://problem/19148278>
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj: Only copy resource folders and JavaScriptCore.dll.
+
+2014-12-05  Juergen Ributzka  <juergen@apple.com>
+
+        [JSC][FTL] Add the data layout to the module and fix the pass order.
+        https://bugs.webkit.org/show_bug.cgi?id=138748
+
+        Reviewed by Oliver Hunt.
+
+        This adds the data layout to the module, so it can be used by all
+        optimization passes in the LLVM optimizer pipeline. This also allows
+        FastISel to select more instructions, because less non-legal types are
+        generated.
+        
+        Also fix the order of the alias analysis passes in the optimization
+        pipeline.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+
+2014-12-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed an unused function.
+
+        Reviewed by Michael Saboff.
+
+        Broken out from https://bugs.webkit.org/show_bug.cgi?id=139305.
+
+        * parser/ParserArena.h:
+
+2014-12-05  David Kilzer  <ddkilzer@apple.com>
+
+        FeatureDefines.xcconfig: Workaround bug in Xcode 5.1.1 when defining ENABLE_WEB_REPLAY
+        <http://webkit.org/b/139286>
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/FeatureDefines.xcconfig: Switch back to using
+        PLATFORM_NAME to workaround a bug in Xcode 5.1.1 on 10.8.
+
+2014-12-04  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r176836.
+
+        Reviewed by Mark Lam.
+
+        * runtime/VM.h:
+        (JSC::VM::controlFlowProfiler): Don't try to export an inline function.
+        Doing so results in a weak external symbol being generated.
+
+2014-12-04  Saam Barati  <saambarati1@gmail.com>
+
+        JavaScript Control Flow Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=137785
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces a mechanism for JavaScriptCore to profile
+        which basic blocks have executed. This mechanism will then be
+        used by the Web Inspector to indicate which basic blocks
+        have and have not executed.
+        
+        The profiling works by compiling in an op_profile_control_flow
+        at the start of every basic block. Then, whenever this op code 
+        executes, we know that a particular basic block has executed.
+        
+        When we tier up a CodeBlock that contains an op_profile_control_flow
+        that corresponds to an already executed basic block, we don't
+        have to emit code for that particular op_profile_control_flow
+        because the internal data structures used to keep track of 
+        basic block locations has already recorded that the corresponding
+        op_profile_control_flow has executed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/Instruction.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitProfileControlFlow):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::CaseClauseNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::basicBlockLocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_control_flow):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_control_flow):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionFindTypeForExpression):
+        (functionReturnTypeFor):
+        (functionDumpBasicBlockExecutionRanges):
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::endOffset):
+        (JSC::ASTBuilder::setStartOffset):
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        * parser/Nodes.h:
+        (JSC::CaseClauseNode::setStartOffset):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseSwitchClauses):
+        (JSC::Parser<LexerType>::parseSwitchDefaultClause):
+        (JSC::Parser<LexerType>::parseBlockStatement):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseIfStatement):
+        (JSC::Parser<LexerType>::parseExpression):
+        (JSC::Parser<LexerType>::parseConditionalExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/BasicBlockLocation.cpp: Added.
+        (JSC::BasicBlockLocation::BasicBlockLocation):
+        (JSC::BasicBlockLocation::insertGap):
+        (JSC::BasicBlockLocation::getExecutedRanges):
+        (JSC::BasicBlockLocation::dumpData):
+        (JSC::BasicBlockLocation::emitExecuteCode):
+        * runtime/BasicBlockLocation.h: Added.
+        (JSC::BasicBlockLocation::startOffset):
+        (JSC::BasicBlockLocation::endOffset):
+        (JSC::BasicBlockLocation::setStartOffset):
+        (JSC::BasicBlockLocation::setEndOffset):
+        (JSC::BasicBlockLocation::hasExecuted):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        * runtime/ControlFlowProfiler.cpp: Added.
+        (JSC::ControlFlowProfiler::~ControlFlowProfiler):
+        (JSC::ControlFlowProfiler::getBasicBlockLocation):
+        (JSC::ControlFlowProfiler::dumpData):
+        (JSC::ControlFlowProfiler::getBasicBlocksForSourceID):
+        * runtime/ControlFlowProfiler.h: Added. This class is in 
+        charge of generating BasicBlockLocations and also
+        providing an interface that the Web Inspector can use to ping
+        which basic blocks have executed based on the source id of a script.
+
+        (JSC::BasicBlockKey::BasicBlockKey):
+        (JSC::BasicBlockKey::isHashTableDeletedValue):
+        (JSC::BasicBlockKey::operator==):
+        (JSC::BasicBlockKey::hash):
+        (JSC::BasicBlockKeyHash::hash):
+        (JSC::BasicBlockKeyHash::equal):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/FunctionHasExecutedCache.cpp:
+        (JSC::FunctionHasExecutedCache::getUnexecutedFunctionRanges):
+        * runtime/FunctionHasExecutedCache.h:
+        * runtime/Options.h:
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::logTypesForTypeLocation):
+        (JSC::TypeProfiler::typeInformationForExpressionAtOffset):
+        (JSC::TypeProfiler::findLocation):
+        (JSC::TypeProfiler::dumpTypeProfilerData):
+        * runtime/TypeProfiler.h:
+        (JSC::TypeProfiler::functionHasExecutedCache): Deleted.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::enableProfilerWithRespectToCount):
+        (JSC::disableProfilerWithRespectToCount):
+        (JSC::VM::enableTypeProfiler):
+        (JSC::VM::disableTypeProfiler):
+        (JSC::VM::enableControlFlowProfiler):
+        (JSC::VM::disableControlFlowProfiler):
+        (JSC::VM::dumpTypeProfilerData):
+        * runtime/VM.h:
+        (JSC::VM::functionHasExecutedCache):
+        (JSC::VM::controlFlowProfiler):
+
+2014-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        printInternal(PrintStream& out, JSC::JITCode::JITType type) ends up dumping a literal %s
+        https://bugs.webkit.org/show_bug.cgi?id=139274
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITCode.cpp:
+        (WTF::printInternal):
+
+2014-12-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed the concept of ParserArenaRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=139277
+
+        Reviewed by Oliver Hunt.
+
+        This is a step toward a parser speedup.
+
+        Now that we have a clear root node type for each parse tree, there's no
+        need to have a concept for "I might be refcounted or arena allocated".
+        Instead, we can just use unique_ptr to manage the tree as a whole.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable): Updated for type change.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock): Use unique_ptr. No need to call
+        destroyData() explicitly: the unique_ptr destructor will do everything
+        we need, as Bjarne intended.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaRoot::ParserArenaRoot):
+        (JSC::ParserArenaRefCounted::ParserArenaRefCounted): Deleted.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionNode::FunctionNode):
+        (JSC::ProgramNode::create): Deleted.
+        (JSC::EvalNode::create): Deleted.
+        (JSC::FunctionNode::create): Deleted. All special create semantics can
+        just go away now that we play by C++ constructor / destructor rules.
+
+        * parser/Nodes.h:
+        (JSC::ParserArenaRoot::parserArena):
+        (JSC::ParserArenaRoot::~ParserArenaRoot): Just a normal class now, which
+        holds onto the whole parse tree by virtue of owning the arena in which
+        all the parsed nodes (except for itself) were allocated.
+
+        (JSC::ProgramNode::closedVariables):
+        (JSC::ParserArenaRefCounted::~ParserArenaRefCounted): Deleted.
+
+        (JSC::ScopeNode::destroyData): Deleted. No need to destroy anything
+        explicitly anymore -- we can just rely on destructors.
+
+        (JSC::ScopeNode::parserArena): Deleted.
+
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        (JSC::parse): unique_ptr all the things.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::reset):
+        (JSC::ParserArena::isEmpty):
+        (JSC::ParserArena::contains): Deleted.
+        (JSC::ParserArena::last): Deleted.
+        (JSC::ParserArena::removeLast): Deleted.
+        (JSC::ParserArena::derefWithArena): Deleted.
+        * parser/ParserArena.h:
+        (JSC::ParserArena::swap): Much delete. Such wow.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax): unique_ptr all the things.
+
+2014-12-04  Andreas Kling  <akling@apple.com>
+
+        REGRESSION(r173188): Text inserted when trying to delete a word from the Twitter message box.
+        <https://webkit.org/b/139076>
+
+        Reviewed by Geoffrey Garen.
+
+        The StringImpl* -> Weak<JSString> cache used by the DOM bindings
+        had a bug where the key could become a stale pointer if the cached
+        JSString had its internal StringImpl atomicized.
+
+        If a new StringImpl was then later constructed at the exact same
+        address as the stale key, before the Weak<JSString> got booted out
+        of the string cache, we'd now have a situation where asking the
+        string cache for that key would return the old JSString.
+
+        Solve this by not allowing JSString::toExistingAtomicString() to
+        change the JSString's internal StringImpl unless it's resolving a
+        rope string. (The StringImpl nullity determines rope state.)
+
+        This means that calling toExistingAtomicString() may now have to
+        query the AtomicString table on each call rather than just once.
+        All clients of this API would be forced to do this regardless,
+        since they return value will be used to key into containers with
+        AtomicStringImpl* keys.
+
+        No test because this relies on malloc putting two StringImpls
+        at the same address at different points in time and we have no
+        mechanism to reliably test that.
+
+        * runtime/JSString.h:
+        (JSC::JSString::toExistingAtomicString):
+
+2014-12-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Marked some final things final.
+
+        Reviewed by Andreas Kling.
+
+        * parser/Nodes.h:
+
+2014-12-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Split out FunctionNode from FunctionBodyNode
+        https://bugs.webkit.org/show_bug.cgi?id=139273
+
+        Reviewed by Andreas Kling.
+
+        This is step toward a parser speedup.
+
+        We used to use FunctionBodyNode for two different purposes:
+
+        (1) "I am the root function you are currently parsing";
+
+        (2) "I am a lazy record of a nested function, which you will parse later".
+
+        This made for awkward lifetime semantics and interfaces.
+
+        Now, case (1) is handled by FunctionBodyNode, and case (2) is handled by
+        a new node named FunctionNode.
+
+        Since case (1) no longer needs to handle being the root of the parse
+        tree, FunctionBodyNode can be a normal arena-allocated node.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock): Use FunctionNode instead of
+        FunctionBodyNode, since we are producing the root of the function parse
+        tree.
+
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable): Removed
+        some unused data, and default-initialized other data, which isn't filled
+        in meaningfully until recordParse() is called. (The previous values were
+        incorrect / meaningless, since the FunctionBodyNode didn't have
+        meaningful values in this case.)
+
+        * bytecode/UnlinkedCodeBlock.h: Ditto.
+
+        (JSC::UnlinkedFunctionExecutable::forceUsesArguments): Deleted.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Use FunctionNode instead of
+        FunctionBodyNode, since we are generating code starting at the root of
+        the parse tree.
+
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::addCallee):
+        * bytecompiler/BytecodeGenerator.h: Ditto.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode): Moved the emitBytecode implementation
+        to FunctionNode, since we never generate code for FunctionBodyNode,
+        since it's just a placeholder in the AST.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::setUsesArguments): Deleted. Updated for interface
+        changes.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        (JSC::FunctionBodyNode::setEndPosition):
+        (JSC::FunctionNode::FunctionNode):
+        (JSC::FunctionNode::create):
+        (JSC::FunctionNode::finishParsing):
+        (JSC::FunctionBodyNode::create): Deleted.
+
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::source):
+        (JSC::FunctionBodyNode::startStartOffset):
+        (JSC::FunctionBodyNode::isInStrictContext):
+        (JSC::FunctionNode::parameters):
+        (JSC::FunctionNode::ident):
+        (JSC::FunctionNode::functionMode):
+        (JSC::FunctionNode::startColumn):
+        (JSC::FunctionNode::endColumn):
+        (JSC::ScopeNode::setSource): Deleted.
+        (JSC::FunctionBodyNode::parameterCount): Deleted. Split out the differences
+        between FunctionNode and FunctionBodyNode.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createClauseList):
+        (JSC::SyntaxChecker::setUsesArguments): Deleted. Removed setUsesArguments
+        since it wasn't used.
+
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax): Removed a branch that was always
+        false.
+
+2014-12-02  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: timeline probe records have inaccurate per-probe hit counts
+        https://bugs.webkit.org/show_bug.cgi?id=138976
+
+        Reviewed by Joseph Pecoraro.
+
+        Previously, the DebuggerAgent was responsible for assigning unique ids to samples.
+        However, this makes it impossible for the frontend's Timeline manager to associate
+        a Probe Sample timeline record with the corresponding probe sample data. The record
+        only included the probe batchId (misnamed as hitCount in ScriptDebugServer).
+
+        This patch moves both the batchId and sampleId counters into ScriptDebugServer, so
+        any client of ScriptDebugListener will get the correct sampleId for each sample.
+
+        * inspector/ScriptDebugListener.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::ScriptDebugServer):
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe):
+        (Inspector::ScriptDebugServer::handleBreakpointHit):
+        * inspector/ScriptDebugServer.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        * inspector/agents/InspectorDebuggerAgent.h:
+
+2014-12-04  Oliver Hunt  <oliver@apple.com>
+
+        Serialization of MapData object provides unsafe access to internal types
+        https://bugs.webkit.org/show_bug.cgi?id=138653
+
+        Reviewed by Geoffrey Garen.
+
+        Converting these ASSERTs into RELEASE_ASSERTs, as it is now obvious
+        that despite trying hard to be safe in all cases it's simply to easy
+        to use an iterator in an unsafe state.
+
+        * runtime/MapData.h:
+        (JSC::MapData::const_iterator::key):
+        (JSC::MapData::const_iterator::value):
+
+2014-12-03  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Move JavaScriptCore/dfg to std::unique_ptr
+        https://bugs.webkit.org/show_bug.cgi?id=139169
+
+        Reviewed by Filip Pizlo.
+
+        Use std::unique_ptr<>|std::make_unique<> in JavaScriptCore/dfg directory.
+
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::linkFunction):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::cancel):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSlowPathGenerator.h:
+        * dfg/DFGWorklist.h:
+        * ftl/FTLFail.cpp:
+        (JSC::FTL::fail):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+
+2014-12-03  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r176479): DFG ASSERTION beneath emitOSRExitCall running Kraken/imaging-gaussian-blur.js.ftl-no-cjit-osr-validation and other tests
+        https://bugs.webkit.org/show_bug.cgi?id=139246
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+        The DFG_ASSERT that checks liveness at exit time doesn't properly
+        handle the case where the local is not available at OSR exit time,
+        but the local is live in the bytecode.  This now happens with the
+        allocated scope register when we are compiling for FTLForOSREntryMode
+        due to DCE done when the control flow was changed and a new entrypoint
+        was added in the OSR entrypoint creation phase.  Therefore we silence
+        the assert when compiling for FTLForOSREntryMode.
+
+2014-12-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed the global parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=139236
+
+        Reviewed by Sam Weinig.
+
+        Simplifies parser lifetime logic.
+
+        There's no need to keep a global arena. We can create a new arena
+        each time we parse.
+
+        * bytecompiler/BytecodeGenerator.h: Global replace to pass around a
+        ParserArena instead of VM*, since the VM no longer owns the arena.
+        (JSC::BytecodeGenerator::parserArena):
+
+        * bytecompiler/NodesCodegen.cpp: Ditto.
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * parser/ASTBuilder.h: Ditto.
+        (JSC::ASTBuilder::ASTBuilder):
+        (JSC::ASTBuilder::createSourceElements):
+        (JSC::ASTBuilder::createCommaExpr):
+        (JSC::ASTBuilder::createLogicalNot):
+        (JSC::ASTBuilder::createUnaryPlus):
+        (JSC::ASTBuilder::createVoid):
+        (JSC::ASTBuilder::thisExpr):
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::createObjectLiteral):
+        (JSC::ASTBuilder::createArray):
+        (JSC::ASTBuilder::createNumberExpr):
+        (JSC::ASTBuilder::createString):
+        (JSC::ASTBuilder::createBoolean):
+        (JSC::ASTBuilder::createNull):
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::createSpreadExpression):
+        (JSC::ASTBuilder::createRegExp):
+        (JSC::ASTBuilder::createNewExpr):
+        (JSC::ASTBuilder::createConditionalExpr):
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArguments):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::createPropertyList):
+        (JSC::ASTBuilder::createElementList):
+        (JSC::ASTBuilder::createFormalParameterList):
+        (JSC::ASTBuilder::createClause):
+        (JSC::ASTBuilder::createClauseList):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createExprStatement):
+        (JSC::ASTBuilder::createIfStatement):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::createForOfLoop):
+        (JSC::ASTBuilder::createEmptyStatement):
+        (JSC::ASTBuilder::createVarStatement):
+        (JSC::ASTBuilder::createEmptyVarExpression):
+        (JSC::ASTBuilder::createReturnStatement):
+        (JSC::ASTBuilder::createBreakStatement):
+        (JSC::ASTBuilder::createContinueStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::createWhileStatement):
+        (JSC::ASTBuilder::createDoWhileStatement):
+        (JSC::ASTBuilder::createLabelStatement):
+        (JSC::ASTBuilder::createWithStatement):
+        (JSC::ASTBuilder::createThrowStatement):
+        (JSC::ASTBuilder::createDebugger):
+        (JSC::ASTBuilder::createConstStatement):
+        (JSC::ASTBuilder::appendConstDecl):
+        (JSC::ASTBuilder::combineCommaNodes):
+        (JSC::ASTBuilder::createDeconstructingAssignment):
+        (JSC::ASTBuilder::Scope::Scope):
+        (JSC::ASTBuilder::createNumber):
+        (JSC::ASTBuilder::makeTypeOfNode):
+        (JSC::ASTBuilder::makeDeleteNode):
+        (JSC::ASTBuilder::makeNegateNode):
+        (JSC::ASTBuilder::makeBitwiseNotNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeAddNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeLeftShiftNode):
+        (JSC::ASTBuilder::makeRightShiftNode):
+        (JSC::ASTBuilder::makeURightShiftNode):
+        (JSC::ASTBuilder::makeBitOrNode):
+        (JSC::ASTBuilder::makeBitAndNode):
+        (JSC::ASTBuilder::makeBitXOrNode):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+
+        * parser/NodeConstructors.h: Ditto.
+        (JSC::ParserArenaFreeable::operator new):
+        (JSC::ParserArenaDeletable::operator new):
+        (JSC::ParserArenaRefCounted::ParserArenaRefCounted):
+
+        * parser/Nodes.cpp: Ditto.
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+
+        * parser/Nodes.h: Ditto.
+        (JSC::ScopeNode::parserArena):
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseProperty): The parser now owns its own
+        arena, and transfers ownership of its contents when invoking the ScopeNode
+        constructor.
+
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse): No need to explicitly reset the arena,
+        since its lifetime is tied to the parser's lifetime now.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty):
+
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h: The point of the patch: no more global.
+
+2014-12-03  Geoffrey Garen  <ggaren@apple.com>
+
+        The parser should allocate all pieces of the AST
+        https://bugs.webkit.org/show_bug.cgi?id=139230
+
+        Reviewed by Oliver Hunt.
+
+        This is a step toward a 14% parsing speedup.
+
+        Previously, allocation was split between the parser and certain node
+        constructor functions. This made for some duplicated code and circular
+        dependencies.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createGetterOrSetterProperty): No need to pass through
+        the VM, since our callee no longer needs to allocate anything.
+
+        (JSC::ASTBuilder::createProperty): Allocate the identifier for our
+        callee, since that is simpler than requiring our callee to notice that
+        we didn't do so, and do it for us.
+
+        (JSC::ASTBuilder::createForInLoop): Allocate the DeconstructingAssignmentNode
+        for our callee, since that is simpler than requiring our callee to notice
+        that we didn't do so, and do it for us.
+
+        Also, reuse some code instead of duplicating it.
+
+        (JSC::ASTBuilder::createForOfLoop): Ditto.
+
+        (JSC::ASTBuilder::createArrayPattern):
+        (JSC::ASTBuilder::createObjectPattern):
+        (JSC::ASTBuilder::createBindingLocation): No need to pass through a VM
+        pointer, since our callee no longer needs to allocate anything.
+
+        (JSC::ASTBuilder::createBreakStatement): Deleted.
+        (JSC::ASTBuilder::createContinueStatement): Deleted.
+
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode):
+        (JSC::DeconstructionPatternNode::DeconstructionPatternNode):
+        (JSC::ArrayPatternNode::ArrayPatternNode):
+        (JSC::ArrayPatternNode::create):
+        (JSC::ObjectPatternNode::ObjectPatternNode):
+        (JSC::ObjectPatternNode::create):
+        (JSC::BindingNode::create):
+        (JSC::BindingNode::BindingNode):
+        (JSC::ContinueNode::ContinueNode): Deleted.
+        (JSC::BreakNode::BreakNode): Deleted.
+        (JSC::EnumerationNode::EnumerationNode): Deleted.
+        (JSC::ForInNode::ForInNode): Deleted.
+        (JSC::ForOfNode::ForOfNode): Deleted. Deleted a bunch of special cases
+        that don't exist anymore, now that the parser allocates all pieces of
+        the AST unconditionally.
+
+        * parser/Nodes.h: Ditto.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseBreakStatement):
+        (JSC::Parser<LexerType>::parseContinueStatement): Allocate the null
+        identifier for our callee, since that is simpler than requiring our
+        callee to notice that we didn't do so, and do it for us.
+
+        (JSC::Parser<LexerType>::parseProperty):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createProperty): No need to pass through a VM
+        pointer, since our callee no longer needs to allocate anything.
+
+2014-12-03  Zsolt Borbely  <zsborbely.u-szeged@partner.samsung.com>
+
+        Remove unused JSC runtime options
+        https://bugs.webkit.org/show_bug.cgi?id=133070
+
+        Reviewed by Csaba Osztrogonác.
+
+        * runtime/Options.h:
+
+2014-12-02  Mark Lam  <mark.lam@apple.com>
+
+        Rolling out r176592, r176603, r176616, and r176705 until build and perf issues are resolved.
+        https://bugs.webkit.org/show_bug.cgi?id=138821
+
+        Not reviewed.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::visitChildren):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::mdNode):
+        (JSC::FTL::buildCall):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::sortCompactedVector):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::dumpInternal):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+
+2014-12-02  Michael Saboff  <msaboff@apple.com>
+
+        Change CallFrame::globalThisValue() to not use CallFrame::scope()
+        https://bugs.webkit.org/show_bug.cgi?id=139202
+
+        Reviewed by Mark Lam.
+
+        Changed to use the globalThis() on the globalObject associated with the
+        callee.  Moved the inline definition to JSGlobalObject.h instead of
+        including JSGlobalObject.h in JSScope.h.  Also moved it as JSScope
+        objects are no longer involved in getting the value.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::ExecState::globalThisValue):
+        * runtime/JSScope.h:
+        (JSC::ExecState::globalThisValue): Deleted.
+
+2014-12-02  Matthew Mirman  <mmirman@apple.com>
+
+        Fixes inline cache fast path accessing nonexistant getters.
+        <rdar://problem/18416918>
+        https://bugs.webkit.org/show_bug.cgi?id=136961
+
+        Reviewed by Filip Pizlo.
+
+        Fixes a bug in inline caching where getters would have been able to 
+        modify the property they are getting during 
+        building the inline cache and then accessing that 
+        property through the inline cache site causing a recursive 
+        inline cache building and allowing the fast path of the cache to 
+        try to load a getter for the property that no longer exists.
+                
+        * jit/JITOperations.cpp: Switched use of get to getPropertySlot.
+        * runtime/JSCJSValue.h: 
+        added getPropertySlot for when you don't want to perform the get quite yet but want 
+        to fill out the slot.
+        * runtime/JSCJSValueInlines.h: Added implementation for getPropertySlot
+        (JSC::JSValue::get): changed to simply call getPropertySlot
+        (JSC::JSValue::getPropertySlot): added.
+        * tests/stress/recursive_property_redefine_during_inline_caching.js: Added test case for bug.
+        (test):
+        
+2014-12-01  Michael Saboff  <msaboff@apple.com>
+
+        Remove GetMyScope node from DFG
+        https://bugs.webkit.org/show_bug.cgi?id=139166
+
+        Reviewed by Oliver Hunt.
+
+        Eliminated GetMyScope DFG node type.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isLiveInBytecode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compileGetMyScope): Deleted.
+
+2014-12-01  Michael Saboff  <msaboff@apple.com>
+
+        Crash (integer overflow) beneath ByteCodeParser::handleGetById typing in search field on weather.com
+        https://bugs.webkit.org/show_bug.cgi?id=139165
+
+        Reviewed by Oliver Hunt.
+
+        If we don't have any getById or putById variants, emit non-cached versions of these operations.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+
+2014-12-01  Andreas Kling  <akling@apple.com>
+
+        Optimize constructing JSC::Identifier from AtomicString.
+        <https://webkit.org/b/139157>
+
+        Reviewed by Michael Saboff.
+
+        Add constructors for Identifier taking AtomicString and AtomicStringImpl.
+        This avoids branching on the string's isAtomic flag, which is obviously
+        always true for AtomicString & AtomicStringImpl.
+
+        Had to add a Identifier(const char*) constructor to resolve implicit
+        ambiguity between String / AtomicString.
+
+        Also made PrivateName::uid() return AtomicStringImpl* to take advantage
+        of the new constructor in a few places.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::Identifier):
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::Identifier):
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::uid):
+
+2014-12-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Several JavaScriptCore date tests are flaky, because they expect time to be frozen during execution
+        https://bugs.webkit.org/show_bug.cgi?id=139138
+
+        Reviewed by Mark Lam.
+
+        Merged a fix by Bob Clary.
+
+        * tests/mozilla/ecma/Date/15.9.1.1-1.js:
+        * tests/mozilla/ecma/Date/15.9.1.1-2.js:
+        * tests/mozilla/ecma/Date/15.9.2.1.js:
+        * tests/mozilla/ecma/Date/15.9.2.2-1.js:
+        * tests/mozilla/ecma/Date/15.9.2.2-2.js:
+        * tests/mozilla/ecma/Date/15.9.2.2-3.js:
+        * tests/mozilla/ecma/Date/15.9.2.2-4.js:
+        * tests/mozilla/ecma/Date/15.9.2.2-5.js:
+        * tests/mozilla/ecma/Date/15.9.2.2-6.js:
+
+2014-11-17  Oliver Hunt  <oliver@apple.com>
+
+        Make sure range based iteration of Vector<> still receives bounds checking
+        https://bugs.webkit.org/show_bug.cgi?id=138821
+
+        Reviewed by Mark Lam.
+
+        There are a few uses of begin()/end() that explicitly require pointers,
+        so we use getPtr() to extract the underlying pointer generically.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::visitChildren):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::mdNode):
+        (JSC::FTL::buildCall):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        * profiler/ProfileNode.cpp:
+        (JSC::ProfileNode::debugPrintRecursively):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::sortCompactedVector):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::dumpInternal):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+
+2014-11-29  Andreas Kling  <akling@apple.com>
+
+        PropertyTable keys should be AtomicStringImpl.
+        <https://webkit.org/b/139096>
+
+        Reviewed by Sam Weinig.
+
+        Since PropertyTable keys are really always Identifiers, switch the key
+        type from StringImpl* to AtomicStringImpl*.
+
+        We have code in the GetByVal opcode implementations that assumes things
+        about this, so this change adds confidence to those algorithms.
+
+        * bytecode/ComplexGetStatus.cpp:
+        (JSC::ComplexGetStatus::computeFor):
+        * bytecode/ComplexGetStatus.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeFor):
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGDesiredIdentifiers.cpp:
+        (JSC::DFG::DesiredIdentifiers::addLazily):
+        (JSC::DFG::DesiredIdentifiers::at):
+        * dfg/DFGDesiredIdentifiers.h:
+        (JSC::DFG::DesiredIdentifiers::operator[]):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
+        * runtime/Identifier.h:
+        (JSC::Identifier::impl):
+        * runtime/IntendedStructureChain.cpp:
+        (JSC::IntendedStructureChain::mayInterceptStoreTo):
+        * runtime/IntendedStructureChain.h:
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::Structure::addPropertyTransitionToExistingStructureImpl):
+        (JSC::Structure::addPropertyTransitionToExistingStructureConcurrently):
+        (JSC::Structure::getConcurrently):
+        (JSC::Structure::add):
+        (JSC::Structure::remove):
+        * runtime/Structure.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::getConcurrently):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::Hash::hash):
+
+2014-11-28  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Use std::unique_ptr<>|make_unique<> in ftl, bytecode of JSC
+        https://bugs.webkit.org/show_bug.cgi?id=139063
+
+        Reviewed by Andreas Kling.
+
+        Clean up OwnPtr and PassOwnPtr in JSC.
+
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        (JSC::StructureStubClearingWatchpoint::push):
+        * bytecode/StructureStubClearingWatchpoint.h:
+        (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * parser/SourceProviderCacheItem.h:
+
+2014-11-27  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Use std::unique_ptr instead of OwnPtr in JSC classes
+        https://bugs.webkit.org/show_bug.cgi?id=139009
+
+        Reviewed by Filip Pizlo.
+
+        As a step of using std::unique_ptr<>, this patch replaces OwnPtr with
+        std::unique_ptr<>|std::make_unique<>.
+
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::ExitProfile::add):
+        * bytecode/DFGExitProfile.h:
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::CompressedLazyOperandValueProfileHolder::add):
+        * bytecode/LazyOperandValueProfile.h:
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::stopAllocating):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::clearNewlyAllocated):
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::findMagicComment):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::invalidateCode):
+        * runtime/RegExp.h:
+        * yarr/RegularExpression.cpp:
+        (JSC::Yarr::RegularExpression::Private::compile):
+        (JSC::Yarr::RegularExpression::isValid):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::byteCompile):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+
+2014-11-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Clean up OwnPtr and PassOwnPtr in JSC - bytecode, jit, inspector, and interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=139022
+
+        Reviewed by Filip Pizlo.
+
+        As a step of using std::unique_ptr<>, this patch replaces OwnPtr with
+        std::unique_ptr<>|std::make_unique<>.
+
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::ExitProfile::add):
+        * bytecode/DFGExitProfile.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::linkFunction):
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::JITFinalizer):
+        * dfg/DFGJITFinalizer.h:
+        * heap/IncrementalSweeper.h:
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::findMagicComment):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/JSGlobalObjectRuntimeAgent.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::enableSampler):
+        * interpreter/Interpreter.h:
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        * jit/ExecutableAllocator.h:
+
+2014-11-22  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Clean up OwnPtr and PassOwnPtr in some of JS classes
+        https://bugs.webkit.org/show_bug.cgi?id=138724
+
+        Reviewed by Filip Pizlo.
+
+        As a step to use std::unique_ptr<> and std::make_unique<>, this patch replaces
+        OwnPtr with std::unique_ptr<>. Besides create() factory function is removed as well.
+
+        * builtins/BuiltinExecutables.h:
+        (JSC::BuiltinExecutables::create): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::createRareDataIfNecessary):
+        * bytecode/StructureStubInfo.h:
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::hasRareData):
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        * runtime/CodeCache.h:
+        (JSC::CodeCache::create): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::clearRareData):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createRareDataIfNeeded):
+        * runtime/RegExpConstructor.h:
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::createSingleCharacterString):
+        (JSC::SmallStrings::singleCharacterStringRep):
+        * runtime/SmallStrings.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2014-11-21  Michael Saboff  <msaboff@apple.com>
+
+        r176455: ASSERT(!m_vector.isEmpty()) in IntendedStructureChain.cpp(143)
+        https://bugs.webkit.org/show_bug.cgi?id=139000
+
+        Reviewed by Darin Adler.
+
+        Check that the chainCount is non-zero before using a StructureChain.
+
+        * bytecode/ComplexGetStatus.cpp:
+        (JSC::ComplexGetStatus::computeFor):
+
+2014-11-21  Michael Saboff  <msaboff@apple.com>
+
+        Allocate local ScopeChain register
+        https://bugs.webkit.org/show_bug.cgi?id=138793
+
+        Reviewed by Geoffrey Garen.
+
+        Now we allocate the scope register as a local.  The allocated register is stored in the 
+        CodeBlock for use by other components.  Update the DFG to work with a local scope register.
+        Changed usage of JSStack::ScopeChain access to the CallFrame header to use the allocated
+        local register.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        Updated to properly represent the operand inputs and bytecode result.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setScopeRegister):
+        (JSC::CodeBlock::scopeRegister):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::setScopeRegister):
+        (JSC::UnlinkedCodeBlock::scopeRegister):
+        Added scope register member and accessors.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::allocateAndEmitScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::scopeRegister):
+        Change m_scopeRegister to an allocated register.  Added allocateAndEmitScope helper to
+        allocate the scope register, set the CodeBlock with its value and emit op_get_scope.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::scope): Changed to access the scope using the new convention.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        Changed op_create_lexical_environment to set the scope VirtualRegister operand.
+        Filled out op_get_scope processing to emit a GetScope node putting the result in
+        the scope VirtualRegister result operand.
+        Added Phantoms where appropriate to keep the Scope register alive in places where
+        it use is optimized away, but where the baseline JIT would need to use its value.
+        Eliminated uses of JSStack::ScopeChain.
+
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        Make sure that the scope register stack location is allocated using the same place
+        that the codeBlock expects. 
+
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        Allow strength reduction of Flush to skip of GetScope nodes looking for a prior
+        corresponding SetLocal.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::scope):
+        (JSC::ExecState::setScope):
+        Added new scope() and setScope() helpers that take a VirtualRegister offset.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        Changed eval() to get the scope from the caller's scope register instead of from the
+        temporary frame created for eval.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwind):
+        Changed unwind() to manipulate the scope n the allocated register instead of from the
+        call frame slot.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::readNonInlinedFrame):
+        (JSC::StackVisitor::readInlinedFrame):
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::Frame::callee):
+        (JSC::StackVisitor::Frame::scope): Deleted.
+        Eliminated the scope member as it needed to change and no StackVisitor users use it.
+
+        * jit/JITOperations.cpp:
+        (JSC::operationPushNameScope):
+        (JSC::operationPushWithScope):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::create):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::create): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        Deleted JSNameScope::create() and JSWithScope::create() flavors tht used the ScopeChain slot
+        in the CallFrame header.  Changed the only user of these function, op_push_name_scope and
+        op_push_with_scope helpers, to use the remaining create variants that require explicit scope.  
+        Those operations get the scope from the register pointed to by their scope operands.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Changed resolveScope to use the allocated register.
+
+2014-11-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [JSC] Disable verifyHeap
+        https://bugs.webkit.org/show_bug.cgi?id=138962
+
+        Reviewed by Mark Lam.
+
+        * runtime/Options.h:
+
+2014-11-20  Mark Lam  <mark.lam@apple.com>
+
+        Add some comments to describe the DFG UseKind representations.
+        <https://webkit.org/b/138934>
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGUseKind.h:
+        - Also regrouped the UseKind enums by representation to be more readable.
+
+2014-11-20  Mark Lam  <mark.lam@apple.com>
+
+        Add Heap verification infrastructure.
+        <https://webkit.org/b/138851>
+
+        Reviewed by Geoffrey Garen.
+
+        The verification infrastructure code is always built in but disabled by
+        default.  When disabled, the cost is minimal:
+        1. Heap has a m_verifier field.
+        2. GC does a few "if (m_verifier)" checks that should fail.
+        3. HeapVerifier takes up code space though not used.
+
+        When enabled:
+        1. The HeapVerifier will keep N number of GC cycle data.
+           Each GC cycle will contain a "before marking" and "after marking" live
+           object list.
+           The GC cycles is a circular buffer.  Only data for the last N GC cycles
+           will be retained.
+        2. During GC, the current GC cycle's live objects lists will be populated
+           before and after marking.
+        3. The current GC cycle's live object lists will be validated before GC,
+           after marking, and after GC.
+
+        Currently, the only validation being done is to verify that object
+        butterflies are allocated from valid blocks in the Storage (aka Copied)
+        space.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::collect):
+        * heap/Heap.h:
+        * heap/HeapVerifier.cpp: Added.
+        (JSC::LiveObjectList::findObject):
+        (JSC::HeapVerifier::HeapVerifier):
+        (JSC::HeapVerifier::collectionTypeName):
+        (JSC::HeapVerifier::phaseName):
+        (JSC::getButterflyDetails):
+        (JSC::HeapVerifier::initializeGCCycle):
+        (JSC::GatherLiveObjFunctor::GatherLiveObjFunctor):
+        (JSC::GatherLiveObjFunctor::operator()):
+        (JSC::HeapVerifier::gatherLiveObjects):
+        (JSC::HeapVerifier::liveObjectListForGathering):
+        (JSC::trimDeadObjectsFromList):
+        (JSC::HeapVerifier::trimDeadObjects):
+        (JSC::HeapVerifier::verifyButterflyIsInStorageSpace):
+        (JSC::HeapVerifier::verify):
+        (JSC::HeapVerifier::reportObject):
+        (JSC::HeapVerifier::checkIfRecorded):
+        * heap/HeapVerifier.h: Added.
+        (JSC::LiveObjectData::LiveObjectData):
+        (JSC::LiveObjectList::LiveObjectList):
+        (JSC::LiveObjectList::reset):
+        (JSC::HeapVerifier::GCCycle::GCCycle):
+        (JSC::HeapVerifier::GCCycle::collectionTypeName):
+        (JSC::HeapVerifier::incrementCycle):
+        (JSC::HeapVerifier::currentCycle):
+        (JSC::HeapVerifier::cycleForIndex):
+        * runtime/Options.h:
+
+2014-11-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Rename String.prototype.contains to String.prototype.includes
+        https://bugs.webkit.org/show_bug.cgi?id=138923
+
+        As per the latest TC39 meeting[1, 2], String.prototype.contains is
+        renamed to String.prototype.includes. This is because the name
+        `contains` breaks the web since it conflicts with existing `contains`
+        implementations in major libraries.
+
+        [1]: https://github.com/mathiasbynens/String.prototype.includes
+        [2]: https://github.com/tc39/test262/pull/119
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::stringProtoFuncContains): Deleted.
+
+2014-11-19  Mark Lam  <mark.lam@apple.com>
+
+        WTFCrashWithSecurityImplication under SpeculativeJIT::compile() when loading a page from theblaze.com.
+        <https://webkit.org/b/137642>
+
+        Reviewed by Filip Pizlo.
+
+        In the DFG, we have a ConstantFolding phase that occurs after all LocalCSE
+        phases have already transpired.  Hence, Identity nodes introduced in the
+        ConstantFolding phase will be left in the node graph.  Subsequently, the
+        DFG code generator asserts that CSE phases have consumed all Identity nodes.
+        This turns out to not be true.  Hence, the crash.  We fix this by teaching
+        the DFG code generator to emit code for Identity nodes.
+
+        Unlike the DFG, the FTL does not have this issue.  That is because the FTL
+        plan has GlobalCSE phases that come after ConstantFolding and any other
+        phases that can generate Identity nodes.  Hence, for the FTL, it is true that
+        CSE will consume all Identity nodes, and the code generator should not see any
+        Identity nodes.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-11-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JSContext inspection Resource search does not work
+        https://bugs.webkit.org/show_bug.cgi?id=131252
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::searchInContent):
+        * inspector/protocol/Debugger.json:
+        Do some cleanup of the description and implementation of content searching.
+
+2014-11-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Provide $exception in the console for the thrown exception value
+        https://bugs.webkit.org/show_bug.cgi?id=138726
+
+        Reviewed by Timothy Hatcher.
+
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::caughtValue):
+        * debugger/DebuggerScope.h:
+        Access the caught value if this scope is a catch scope.
+
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::isFunctionNameScope):
+        (JSC::JSNameScope::isCatchScope):
+        (JSC::JSNameScope::value):
+        Provide an accessor for the single value in the JSNameScope (with / catch block).
+
+        * inspector/InjectedScriptSource.js:
+        Save the exception value and expose it via $exception. Since the command line api
+        is recreated on each evaluation, $exception is essentially readonly.
+
+        * inspector/ScriptDebugServer.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchDidPause):
+        (Inspector::ScriptDebugServer::exceptionOrCaughtValue):
+        When pausing, get the exception or caught value. The exception will be provided
+        if we are breaking on an explicit exception. When inside of a catch block, we
+        can get the caught value by walking up the scope chain.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (Inspector::InspectorDebuggerAgent::resume):
+        (Inspector::InspectorDebuggerAgent::stepOver):
+        (Inspector::InspectorDebuggerAgent::stepInto):
+        (Inspector::InspectorDebuggerAgent::stepOut):
+        Clearing state can be done in didContinue.
+
+        (Inspector::InspectorDebuggerAgent::didPause):
+        Set the exception value explicitly in the injected script when we have it.
+
+        (Inspector::InspectorDebuggerAgent::didContinue):
+        Clear state saved when we had paused, including clearly an exception value if needed.
+
+        (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState):
+        (Inspector::InspectorDebuggerAgent::clearExceptionValue):
+        Call into the injected script only when needed.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::setExceptionValue):
+        (Inspector::InjectedScript::clearExceptionValue):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::clearExceptionValue):
+        * inspector/InjectedScriptManager.h:
+        Clear on all injected scripts.
+
+2014-11-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed build fixes after r176329.
+
+          - export all of the codegen python files as they are included by the main generator
+          - update the imports of the main generator to match __init__.py
+          - remove bundling the python scripts as framework resources, just have them PrivateHeaders
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+
+2014-11-18  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: standardize language-specific protocol generator file, class, and method prefixes
+        https://bugs.webkit.org/show_bug.cgi?id=138237
+
+        Reviewed by Joseph Pecoraro.
+
+        Settle on cpp/objc/js file prefixes and Cpp/ObjC/JS class prefixes for generators.
+        Move C++-specific static methods into CppGenerator and add cpp_ prefixes where relevant.
+        Split the templates file into language-specific template files.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/scripts/codegen/__init__.py:
+        * inspector/scripts/codegen/cpp_generator.py: Copied from Source/JavaScriptCore/inspector/scripts/codegen/generator.py.
+        * inspector/scripts/codegen/cpp_generator_templates.py: Copied from Source/JavaScriptCore/inspector/scripts/codegen/generator_templates.py.
+        (CppGeneratorTemplates):
+        * inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_alternate_backend_dispatcher_header.py.
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_backend_dispatcher_header.py.
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_backend_dispatcher_implementation.py.
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_frontend_dispatcher_header.py.
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_frontend_dispatcher_implementation.py.
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_protocol_types_header.py.
+        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_protocol_types_implementation.py.
+        * inspector/scripts/codegen/generate_js_backend_commands.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_backend_commands.py.
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_backend_dispatcher_header.py.
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_backend_dispatcher_implementation.py.
+        * inspector/scripts/codegen/generate_objc_configuration_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_configuration_header.py.
+        * inspector/scripts/codegen/generate_objc_configuration_implementation.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_configuration_implementation.py.
+        * inspector/scripts/codegen/generate_objc_conversion_helpers.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_conversion_helpers.py.
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_frontend_dispatcher_implementation.py.
+        * inspector/scripts/codegen/generate_objc_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_header.py.
+        * inspector/scripts/codegen/generate_objc_internal_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_internal_header.py.
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c_types_implementation.py.
+        * inspector/scripts/codegen/generator.py:
+        * inspector/scripts/codegen/generator_templates.py:
+        * inspector/scripts/codegen/objc_generator.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objective_c.py.
+        * inspector/scripts/codegen/objc_generator_templates.py: Added.
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+
+2014-11-19  Juergen Ributzka  <juergen@apple.com>
+
+        Update WebKit to build with LLVM TOT
+        https://bugs.webkit.org/show_bug.cgi?id=138519
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/LLVMForJSC.xcconfig:
+        * llvm/LLVMAPIFunctions.h:
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-11-18  David Kilzer  <ddkilzer@apple.com>
+
+        FeatureDefines.xcconfig: Switch from using PLATFORM_NAME to SDK selectors
+        <http://webkit.org/b/138813>
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/FeatureDefines.xcconfig: Switch to using SDK
+        selectors.
+
+2014-11-18  Chris Dumez  <cdumez@apple.com>
+
+        Update the Vector API to deal with unsigned types instead of size_t
+        https://bugs.webkit.org/show_bug.cgi?id=138824
+
+        Reviewed by Andreas Kling.
+
+        Update code base to fix build errors related to the typing changes
+        in the Vector API (size_t -> unsigned).
+
+        * bytecode/PreciseJumpTargets.cpp:
+        * replay/EncodedValue.h:
+
+2014-11-18  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r176207.
+        https://bugs.webkit.org/show_bug.cgi?id=138836
+
+        Not ready yet (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Update WebKit to build with LLVM TOT"
+        https://bugs.webkit.org/show_bug.cgi?id=138519
+        http://trac.webkit.org/changeset/176207
+
+2014-11-17  Mark Lam  <mark.lam@apple.com>
+
+        Add printing functionality in JITted code for debugging purposes.
+        <https://webkit.org/b/138660>
+
+        Reviewed by Geoffrey Garen.
+
+        Sometimes, for debugging, it'd be nice to be able to just print the
+        values of constants or registers used in JITted code, or even just
+        a string to log that certain pieces of JITted code have been executed.
+        Using the JIT probe mechanism, we can make this happen.
+
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CPUState::registerName):
+        (JSC::AbstractMacroAssembler::CPUState::registerValue):
+        (JSC::AbstractMacroAssembler::print):
+        (JSC::AbstractMacroAssembler::PrintArg::PrintArg):
+        (JSC::AbstractMacroAssembler::appendPrintArg):
+        (JSC::AbstractMacroAssembler::printInternal):
+        (JSC::AbstractMacroAssembler::printCallback):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::printCPURegisters):
+        (JSC::MacroAssemblerARM::printRegister):
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.cpp:
+        (JSC::MacroAssemblerARMv7::printCPURegisters):
+        (JSC::MacroAssemblerARMv7::printRegister):
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86Common.cpp:
+        (JSC::MacroAssemblerX86Common::printRegister):
+        * assembler/MacroAssemblerX86Common.h:
+
+2014-11-17  Anders Carlsson  <andersca@apple.com>
+
+        Fix JavaScriptCore build with newer versions of clang.
+        <rdar://problem/18978716>
+
+        * heap/Heap.cpp:
+        (JSC::Heap::visitTempSortVectors):
+        (JSC::Heap::deleteAllCompiledCode): Deleted.
+        * inspector/agents/InspectorConsoleAgent.h:
+
+2014-11-17  Juergen Ributzka  <juergen@apple.com>
+
+        Update WebKit to build with LLVM TOT
+        https://bugs.webkit.org/show_bug.cgi?id=138519
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Configurations/LLVMForJSC.xcconfig:
+        * llvm/LLVMAPIFunctions.h:
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-11-14  Benjamin Poulain  <bpoulain@apple.com>
+
+        STRH can store values with the wrong offset
+        https://bugs.webkit.org/show_bug.cgi?id=138723
+
+        Reviewed by Michael Saboff.
+
+        This is the counterpart of r176083 for the str instruction.
+
+        I believe this code is currently unreachable because there is only one client of strh()
+        in the MacroAssembler and it always setup the scale explicitely.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::strh):
+
+2014-11-13  Mark Lam  <mark.lam@apple.com>
+
+        Reduce amount of cut-and-paste needed for probe mechanism implementations.
+        <https://webkit.org/b/138671>
+
+        Reviewed by Geoffrey Garen.
+
+        The existing code requires that each MacroAssembler implementation provide
+        their own copy of all of the probe implementations even when most of it is
+        identical.  This patch hoists the common parts into AbstractMacroAssembler
+        (with some minor renaming).  Each target specific MacroAssembler now only
+        need to implement a few target specific methods that are expected by and
+        documented in AbstractMacroAssembler.h in the ENABLE(MASM_PROBE) section.
+
+        In this patch, I also simplified the X86 and X86_64 ports to use the same
+        port implementation.  The ARMv7 probe implementation should not conditionally
+        exclude the higher FP registers (since the JIT doesn't).  Fixed the ARMv7
+        probe code to include the higher FP registers always. 
+
+        This is all done in preparation to add printing functionality in JITted code
+        for debugging.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::AbstractMacroAssembler::DataLabel32::DataLabel32):
+        (JSC::AbstractMacroAssembler::DataLabelCompact::DataLabelCompact):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::JumpList::link):
+        (JSC::AbstractMacroAssembler::JumpList::linkTo):
+        (JSC::AbstractMacroAssembler::ProbeContext::print):
+        (JSC::AbstractMacroAssembler::printIndent):
+        (JSC::AbstractMacroAssembler::printCPU):
+        (JSC::AbstractMacroAssembler::CachedTempRegister::CachedTempRegister):
+        - Except for the 3 printing methods (which are for the probe), the rest
+          are touched simply because we need to add the MacroAssemblerType to the
+          template args.
+          The MacroAssemblerType is used by the abstract probe code to call the
+          few probe methods that need to have CPU specific implementations.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::printCPURegisters):
+        - This was refactored from ProbeContext::dumpCPURegisters() which no
+          longer exists.
+        (JSC::MacroAssemblerARM::ProbeContext::dumpCPURegisters): Deleted.
+        (JSC::MacroAssemblerARM::ProbeContext::dump): Deleted.
+
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARM64.h:
+
+        * assembler/MacroAssemblerARMv7.cpp:
+        (JSC::MacroAssemblerARMv7::printCPURegisters):
+        - This was refactored from ProbeContext::dumpCPURegisters() which no
+          longer exists.
+        (JSC::MacroAssemblerARMv7::ProbeContext::dumpCPURegisters): Deleted.
+        (JSC::MacroAssemblerARMv7::ProbeContext::dump): Deleted.
+
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerSH4.h:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::trustedImm32FromPtr): Deleted.
+        (JSC::MacroAssemblerX86::probe): Deleted.
+
+        * assembler/MacroAssemblerX86Common.cpp:
+        (JSC::MacroAssemblerX86Common::printCPURegisters):
+        - This was refactored from ProbeContext::dumpCPURegisters() which no
+          longer exists.
+        (JSC::MacroAssemblerX86Common::probe):
+        - This implementation of probe() is based on the one originally in
+          MacroAssemblerX86_64.h.  It is generic and should work for both
+          32-bit and 64-bit.
+        (JSC::MacroAssemblerX86Common::ProbeContext::dumpCPURegisters): Deleted.
+        (JSC::MacroAssemblerX86Common::ProbeContext::dump): Deleted.
+
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::trustedImm64FromPtr): Deleted.
+        (JSC::MacroAssemblerX86_64::probe): Deleted.
+        * jit/JITStubsARMv7.h:
+
+2014-11-13  Michael Saboff  <msaboff@apple.com>
+
+        Add scope operand to op_new_func* byte codes
+        https://bugs.webkit.org/show_bug.cgi?id=138707
+
+        Reviewed by Mark Lam.
+
+        Added scope operand to op_new_func and op_new_func_expr to replace the implicit use
+        of exec->scope().
+
+        * bytecode/BytecodeList.json: Increased size of op_new_func & op_new_func_expr bytecodes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Added scope operand to dump output.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        Emit scope operand.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        Added new scope source nodes to NewFunction, NewFunctionExpression & NewFunctionNoCheck.
+        
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
+        (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        Use scope children when making new function JIT_Operation calls.  Use JSScope* value instead of
+        exec->scope().
+
+        * dfg/DFGOperations.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_new_func_exp):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        Added new Jsc JIT_Operation parameter type for JSScope* values.  Created declarations and
+        definitions for new JIT_Operations with Jsc parameters.  Use the JSScope* parameters in lieu
+        of exec->scope() in operationNewFunction().
+        Removed comment for unused Jsa (JSLexicalEnvironment*) JIT_Operation parameter type.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        Use the scope operand instead of exec->scope().
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Changed the operand indecies for added scope operand.
+
+2014-11-13  Mark Lam  <mark.lam@apple.com>
+
+        Change X86/64 JIT probes to save/restore xmm regs as double instead of __m128. [Follow up]
+        <https://webkit.org/b/138708>
+
+        Reviewed by Michael Saboff.
+
+        Removed a stale comment and a now unnecessary #include. 
+
+        * assembler/X86Assembler.h:
+
+2014-11-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r176087.
+        https://bugs.webkit.org/show_bug.cgi?id=138714
+
+        Broke the build (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Update WebKit to build with LLVM TOT"
+        https://bugs.webkit.org/show_bug.cgi?id=138519
+        http://trac.webkit.org/changeset/176087
+
+2014-11-13  Mark Lam  <mark.lam@apple.com>
+
+        Change X86/64 JIT probes to save/restore xmm regs as double instead of __m128.
+        <https://webkit.org/b/138708>
+
+        Reviewed by Michael Saboff.
+
+        The JIT code only uses the xmm regs as double registers.  This patch changes
+        the storage types of the FP registers in X86Assembler.h to double instead of
+        __m128, and updates the X86 and X86_64 JIT probe implementations accordingly.
+
+        Also made some minor cosmetic changes in the output of the probe dump functions.
+
+        * assembler/MacroAssemblerX86Common.cpp:
+        (JSC::MacroAssemblerX86Common::ProbeContext::dumpCPURegisters):
+        * assembler/X86Assembler.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86Common.h:
+        * jit/JITStubsX86_64.h:
+
+2014-11-13  Juergen Ributzka  <juergen@apple.com>
+
+        Update WebKit to build with LLVM TOT
+        https://bugs.webkit.org/show_bug.cgi?id=138519
+
+        Reviewed by Geoffrey Garen.
+
+        * Configurations/LLVMForJSC.xcconfig:
+        * llvm/LLVMAPIFunctions.h:
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+
+2014-11-13  Benjamin Poulain  <benjamin@webkit.org>
+
+        ARMv7(s) Assembler: LDRH with immediate offset is loading from the wrong offset
+        https://bugs.webkit.org/show_bug.cgi?id=136914
+
+        Reviewed by Michael Saboff.
+
+        TLDR: the immediate offset of half-word load was divided by 2.
+
+        Story time: So I started getting those weird reports of :nth-child() behaving bizarrely
+        on ARMv7 and ARMv7s. To make things worse, the behavior changes depending on style updates.
+
+        I started looking the disassembly on the tests cases...
+
+        The first thing I noticed was that the computation of An+B looked wrong. For example,
+        in the case of n+6, the instruction should have been:
+            subs r1, r1, #6
+        but was
+            subs r1, r1, #2
+
+        After spending a lot of time trying to find the error in the assembler, I discovered
+        the problem was not real, but just a bug in the disassembler.
+        This is the first fix: ARMv7DOpcodeAddSubtractImmediate3's immediate3() was truncating
+        the value to 2 bits instead of 3 bits.
+
+        The disassembler being fixed, I still have no lead on the weird bug. Some disassembly later,
+        I realize the LDRH instruction is not decoded at all. The reason is that both LDRH and STRH
+        were under the umbrella ARMv7DOpcodeLoadStoreRegisterImmediateHalfWord but the pattern
+        only matched SRTH.
+
+        I fix that next, ARMv7DOpcodeLoadStoreRegisterImmediateHalfWord is split into
+        ARMv7DOpcodeStoreRegisterImmediateHalfWord and ARMv7DOpcodeLoadRegisterImmediateHalfWord,
+        each with their own pattern and their instruction group.
+
+        Now that I can see the LDRHs correctly, there is something fishy about them, their offset
+        is way too small for the data I load.
+
+        This time, looking at the binary, the generated code is indeed incorrect. It turns out that
+        the ARMv7 assembler shifted the offset of half-word load as if they were byte load: divided by 4.
+        As a result, all the load of half-words with more than zero offset were loading
+        values with a smaller offset than what they should have.
+
+        That being fixed, I dump the assembly: still wrong. I am ready to throw my keyboard through
+        my screen at that point.
+
+        Looking at the disassembler, there is yet again a bug. The computation of the scale() adjustment
+        of the offset was incorrect for anything but word loads.
+        I replaced it by a switch-case to make it explicit.
+
+        STRH is likely incorrect too. I'll fix that in a follow up, I want to survey all the 16 bits cases
+        that are not directly used by the CSS JIT.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::ldrh):
+        Fix the immediate scaling. Add an assertion to make sure the alignment of the input is correct.
+
+        * disassembler/ARMv7/ARMv7DOpcode.cpp:
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::scale):
+        Fix the scaling code. Just hardcode instruction-to-scale table.
+
+        * disassembler/ARMv7/ARMv7DOpcode.h:
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeAddSubtractImmediate3::immediate3):
+        The mask for a 3 bits immediate is not 3 :)
+
+        (JSC::ARMv7Disassembler::ARMv7DOpcodeLoadStoreRegisterImmediate::scale): Deleted.
+
+2014-11-13  Andreas Kling  <akling@apple.com>
+
+        Generate put_by_id for bracket assignment with constant string subscript.
+        <https://webkit.org/b/138702>
+
+        Reviewed by Geoffrey Garen.
+
+        Transform o["f"]=x to o.f=x when generating bytecode. This allows our JIT
+        to inline-cache those accesses instead of always dropping out to C++.
+
+        Just like the get_by_id transformations, this gets a bunch of use on
+        real-web content (and Speedometer) but little/none on raw JS benchmarks.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignBracketNode::emitBytecode):
+
+2014-11-12  Mark Lam  <mark.lam@apple.com>
+
+        Create canonical lists of registers used by both the Assemblers and the JIT probes.
+        <https://webkit.org/b/138681>
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/X86Assembler.h:
+        - The FP register storage type is still defined as __m128 because the JIT
+          probe code still expects that amount of storage to be available.  Will
+          change this to double when the JIT probe code is updated accordingly in a
+          later patch.
+
+2014-11-12  Andreas Kling  <akling@apple.com>
+
+        Generate get_by_id for bracket access with constant string subscript.
+        <https://webkit.org/b/138663>
+
+        Reviewed by Michael Saboff.
+
+        Transform o["f"] into o.f when generating bytecode. This allows our JIT
+        to inline-cache those accesses instead of always dropping out to C++.
+
+        This is surprisingly common in real-web content, less so in benchmarks.
+        Interestingly, Speedometer does hit the optimization quite a bit.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode):
+
+2014-11-12  Mark Lam  <mark.lam@apple.com>
+
+        Rename USE(MASM_PROBE) to ENABLE(MASM_PROBE).
+        <https://webkit.org/b/138661>
+
+        Reviewed by Michael Saboff.
+
+        Also move the switch for enabling the use of MASM_PROBE from JavaScriptCore's
+        config.h to WTF's Platform.h.  This ensures that the setting is consistently
+        applied even when building WebCore parts as well.
+
+        * assembler/ARMAssembler.h:
+        * assembler/ARMv7Assembler.h:
+        * assembler/MacroAssemblerARM.cpp:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.cpp:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.cpp:
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * assembler/X86Assembler.h:
+        * config.h:
+        * jit/JITStubs.h:
+        * jit/JITStubsARM.h:
+        * jit/JITStubsARMv7.h:
+        * jit/JITStubsX86.h:
+        * jit/JITStubsX86Common.h:
+        * jit/JITStubsX86_64.h:
+
+2014-11-12  peavo@outlook.com  <peavo@outlook.com>
+
+        [WinCairo] Incorrect names for test executables in debug mode.
+        https://bugs.webkit.org/show_bug.cgi?id=138659
+
+        Reviewed by Alex Christensen.
+
+        In debug mode, jsc.exe, and testapi.exe are not created, causing JSC test failures.
+
+        * JavaScriptCore.vcxproj/jsc/jscLauncher.vcxproj:
+        * JavaScriptCore.vcxproj/testapi/testapiLauncher.vcxproj:
+
+2014-11-11  Michael Saboff  <msaboff@apple.com>
+
+        Change DFG to use scope operand for op_resolve_scope
+        https://bugs.webkit.org/show_bug.cgi?id=138651
+
+        Reviewed by Geoffrey Garen.
+
+        Changed to use the provided scope VirtualRegister.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getScope): Changed to use an argument scope register.
+        (JSC::DFG::ByteCodeParser::parseBlock): Created VirtualRegister from scope operand.
+
+2014-11-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Remove IncrementalSweeper::create()
+        https://bugs.webkit.org/show_bug.cgi?id=138243
+
+        Reviewed by Filip Pizlo.
+
+        As a step to use std::unique_ptr<> and std::make_unique<>, this patch removes
+        IncrementalSweeper::create(), then set constructor of IncrementalSweeper to public.
+        Now we begins to use std::make_unique<> to create IncrementalSweeper instance.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::setIncrementalSweeper):
+        * heap/Heap.h:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::create): Deleted.
+        * heap/IncrementalSweeper.h:
+
+2014-11-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Handle activating extra agents properly after inspector has connected
+        https://bugs.webkit.org/show_bug.cgi?id=138639
+
+        Reviewed by Timothy Hatcher.
+
+        Instead of having the protocol configuration directly add the extra agent
+        to the inspector registry, isntead go through the augmentable controller.
+        The controller will initialize as required if we are already connected or not,
+        and will add to the registry.
+
+        The functional change here is that the frontend can be notified to activate
+        extra agents multiple times as agents eventually become available.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::activateExtraDomain):
+        * inspector/agents/InspectorAgent.h:
+        * inspector/augmentable/AugmentableInspectorController.h:
+        * inspector/scripts/codegen/generator_templates.py:
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        Rebased results.
+
+2014-11-11  Michael Saboff  <msaboff@apple.com>
+
+        Use scope register when processing op_resolve_scope in LLInt and Baseline JIT
+        https://bugs.webkit.org/show_bug.cgi?id=138637
+
+        Reviewed by Mark Lam.
+
+        Filled out op_resolve_scope processing to use the scope operand to access the current
+        scope chain.
+
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        Added scope virtual register parameter to emitResolveClosure().  Added new callOperation() to
+        support the additional argument.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitResolveClosure):
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitResolveClosure):
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        Added "scope" parameter to emitResolveClosure().  Passed scope register index to slow path.
+        Used scope virtual register instead of JSStack::ScopeChain.
+
+2014-11-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Don't require a debugger be attached for inspector auto attach
+        https://bugs.webkit.org/show_bug.cgi?id=138638
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::updateDebuggableAutomaticInspectCandidate):
+
+2014-11-11  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Handle cases in StackVisitor::Frame::existingArguments() when lexicalEnvironment and/or unmodifiedArgumentsRegister is not set up yet
+        https://bugs.webkit.org/show_bug.cgi?id=138543
+
+        Reviewed by Geoffrey Garen.
+
+        Exception fuzzing may may raise exceptions in places where they would be
+        otherwise impossible. Therefore, a callFrame may lack activation even if
+        the codeBlock signals need of activation. Also, even if codeBlock
+        signals the use of arguments, the unmodifiedArgumentsRegister may not be
+        initialized yet (neither locally nor in lexicalEnvironment).
+
+        If codeBlock()->needsActivation() is false, unmodifiedArgumentsRegister
+        is already checked for Undefined. This patch applies the same check when
+        the condition is true (and also checks whether
+        callFrame()->hasActivation()).
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hasActivation):
+        Moved to interpreter/CallFrameInlines.h.
+        * interpreter/CallFrameInlines.h:
+        (JSC::CallFrame::hasActivation):
+        Fixed to verify that the JSValue returned by uncheckedActivation() is a
+        cell.
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::existingArguments):
+
+2014-11-11  Andreas Kling  <akling@apple.com>
+
+        Another assertion fix for debug builds after r175846.
+
+        generateByIdStub() can now be called with an empty prototype chain
+        if kind == GetUndefined, so tweak the assertion to cover that.
+
+        * jit/Repatch.cpp:
+        (JSC::generateByIdStub):
+
+2014-11-10  Andreas Kling  <akling@apple.com>
+
+        Assertion fix for debug builds after r175846.
+
+        PropertySlot::slotBase() will assert if the slot is unset, so reorder
+        the tests to check for isCacheableValue() first.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+
+2014-11-10  Andreas Kling  <akling@apple.com>
+
+        The JIT should cache property lookup misses.
+        <https://webkit.org/b/135578>
+
+        Add support for inline caching of missed property lookups.
+        Previously this would banish us to C++ slow path.
+
+        It's implemented as a simple GetById cache that returns jsUndefined()
+        as long as the Structure chain check passes. There's no DFG exploitation
+        of this knowledge in this patch.
+
+        Test: js/regress/undefined-property-access.js (~5.5x speedup)
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/PolymorphicGetByIdList.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+
+            Add GetByIdAccess::SimpleMiss so we can communicate to the DFG that
+            the access has been cached.
+
+        * jit/Repatch.cpp:
+        (JSC::toString):
+        (JSC::kindFor):
+        (JSC::generateByIdStub):
+        (JSC::tryCacheGetByID):
+        (JSC::tryBuildGetByIDList):
+
+            Added a GetUndefined stub kind, just a simple "store jsUndefined()" snippet.
+            Use this to cache missed lookups, piggybacking mostly on the GetValue kind.
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isUnset):
+
+            Exposed the unset state so PropertySlot can communicate that lookup failed.
+
+2014-11-10  Michael Saboff  <msaboff@apple.com>
+
+        Add scope operand to op_create_lexical_environment
+        https://bugs.webkit.org/show_bug.cgi?id=138588
+
+        Reviewed by Geoffrey Garen.
+
+        Added a second operand to op_create_lexical_environment that contains the scope register
+        to update.  Note that the DFG relies on operationCreateActivation() to update the
+        scope register since we can't issue a set() with a non-local, non-argument register.
+        This is temporary until the scope register is allocated as a local.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        Added the scope register operand.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        Filled in the scope register operand.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_lexical_environment):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_lexical_environment):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Set the scope register with the result of the appropriate create activation slow call.
+
+2014-11-09  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Fix 'noreturn' function does return warning in LLVMOverrides.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=138306
+
+        Reviewed by Filip Pizlo.
+
+        Adding NO_RETURN where needed.
+
+        * llvm/library/LLVMExports.cpp:
+        (initializeAndGetJSCLLVMAPI):
+        * llvm/library/LLVMOverrides.cpp:
+        * llvm/library/LLVMTrapCallback.h:
+
+2014-11-07  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        Fix an alignment issue with operationPushCatchScope on ARMv7
+        https://bugs.webkit.org/show_bug.cgi?id=138510
+
+        Reviewed by Csaba Osztrogonác.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+
+2014-11-07  Michael Saboff  <msaboff@apple.com>
+
+        Update scope related slow path code to use scope register added to opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=138254
+
+        Reviewed by Mark Lam.
+
+        Updated slow paths for op_pop_scope, op_push_name_scope and op_push_with_scope.
+        Added scope register index parameter to the front of the relevant argument lists of the
+        slow functions.  In the case of op_push_name_scope for x86 (32 bit), there aren't enough
+        registers to accomodate all the parameters.  Therefore, added two new JSVALUE32_64 slow
+        paths called operationPushCatchScope() and operationPushFunctionNameScope() to eliminate
+        the last "type" argument.
+        
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr): Added a new template to take 6 arguments.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        New variants of setupArgumentsWithExecState() and callOperation() to handle the new
+        combinations of argument types and counts.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_pop_scope):
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_pop_scope):
+        (JSC::JIT::emit_op_push_name_scope):
+        Use the new slow paths.
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        Updates to set the scope result using the scope register index.  Added operationPushCatchScope()
+        and operationPushFunctionNameScope().
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        Updated the scope slow paths to use the scope register index in the instruction to read and
+        write the register instead of using CallFrame::scope() and CallFrame::setScope().
+
+2014-11-07  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Apply std::unique_ptr to slowPathCall()
+        https://bugs.webkit.org/show_bug.cgi?id=138489
+
+        Reviewed by Mark Lam.
+
+        As a step to use std::unique_ptr<>, this patch makes slowPathCall() use std::unique_ptr<>,
+        std::make_unique<>, and WTF::move(). 
+
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::slowPathCall):
+        (JSC::DFG::slowPathMove):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
+        (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::arrayify):
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2014-11-06  Mark Lam  <mark.lam@apple.com>
+
+        slow_path_get_direct_pname() needs to be hardened against a constant baseValue.
+        <https://webkit.org/b/138476>
+
+        Reviewed by Michael Saboff.
+
+        slow_path_get_direct_pname() currently assumes that the baseValue is always a
+        non-constant virtual register.  However, this is not always the case like in the
+        following:
+
+            function foo() {
+                var o = { a:1 };
+                for (var n in o)
+                    0[n];
+            }
+            foo();
+
+        This patch fixes it to also check for constant virtual register indexes.
+
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+
+2014-11-06  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r174985-174986): Site display disappears 
+        https://bugs.webkit.org/show_bug.cgi?id=138082
+
+        Reviewed by Geoffrey Garen.
+
+        In support of the change in WebCore, this adds a new functor class to unwind to our
+        caller's frame possibly skipping of intermediate C++ frames.
+
+        * interpreter/StackVisitor.h:
+        (JSC::CallerFunctor::CallerFunctor):
+        (JSC::CallerFunctor::callerFrame):
+        (JSC::CallerFunctor::operator()):
+
+2014-11-06  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Use std::unique_ptr in CodeBlock class
+        https://bugs.webkit.org/show_bug.cgi?id=138395
+
+        Reviewed by Darin Adler.
+
+        * bytecode/CodeBlock.h: Use std::unique_ptr.
+        (JSC::CodeBlock::setJITCodeMap):
+        * jit/CompactJITCodeMap.h: Use std::unique_ptr instead of OwnPtr|PassOwnPtr.
+        (JSC::CompactJITCodeMap::CompactJITCodeMap):
+        (JSC::CompactJITCodeMap::Encoder::finish): Use std::unique_ptr instead of PassOwnPtr.
+
+2014-11-05  Mark Lam  <mark.lam@apple.com>
+
+        PutById inline caches should have a store barrier when it triggers a structure transition.
+        <https://webkit.org/b/138441>
+
+        Reviewed by Geoffrey Garen.
+
+        After r174025, we no longer insert DFG store barriers when the payload of a
+        PutById operation is not a cell.  However, this can lead to a crash when we have
+        PutById inline cache code transitioning the structure and re-allocating the
+        butterfly of an old gen object.  The lack of a store barrier in that inline
+        cache results in the old gen object not being noticed during an eden GC scan.
+        As a result, its newly allocated butterfly will not be kept alive, which leads
+        to a stale butterfly pointer and, eventually, a crash.
+
+        It is also possible that the new structure can be collected by the eden GC if
+        (at GC time):
+        1. It is in the eden gen.
+        2. The inline cache that installed it has been evicted.
+        3. There are no live eden gen objects referring to it.
+
+        The chances of this should be more rare than the butterfly re-allocation, but
+        it is still possible.  Hence, the fix is to always add a store barrier if the
+        inline caches performs a structure transition.
+
+        * jit/Repatch.cpp:
+        (JSC::emitPutTransitionStub):
+        - Added store barrier code based on SpeculativeJIT::storeToWriteBarrierBuffer()'s
+          implementation.
+
+2014-11-05  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Use std::unique_ptr in JSClassRef and JSCallbackObject
+        https://bugs.webkit.org/show_bug.cgi?id=138402
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSCallbackObject.h: Use std::unique_ptr instead of OwnPtr|PassOwnPtr.
+        (JSC::JSCallbackObjectData::setPrivateProperty): ditto.
+        * API/JSClassRef.cpp: ditto.
+        * API/JSClassRef.h: ditto.
+
+2014-11-05  Michael Saboff  <msaboff@apple.com>
+
+        Disable flakey float32-repeat-out-of-bounds.js and int8-repeat-out-of-bounds.js tests for ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=138381
+
+        Reviewed by Mark Lam.
+
+        Disabled these test for ARM64.  Will address the failures and then re-enable.
+
+        * tests/stress/float32-repeat-out-of-bounds.js:
+        * tests/stress/int8-repeat-out-of-bounds.js:
+
+2014-11-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Incorrect sandbox_check in RemoteInspector.mm
+        https://bugs.webkit.org/show_bug.cgi?id=138408
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::canAccessWebInspectorMachPort):
+
+2014-11-03  Dean Jackson  <dino@apple.com>
+
+        Add ENABLE_FILTERS_LEVEL_2 feature guard.
+        https://bugs.webkit.org/show_bug.cgi?id=138362
+
+        Reviewed by Tim Horton.
+
+        Add a new feature define for Level 2 of CSS Filters.
+        http://dev.w3.org/fxtf/filters-2/
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-11-04  Mark Lam  <mark.lam@apple.com>
+
+        Rename checkMarkByte() to jumpIfIsRememberedOrInEden().
+        <https://webkit.org/b/138369>
+
+        Reviewed by Geoffrey Garen.
+
+        Write barriers are needed for GC Eden collections so that we can scan pointers
+        pointing from old generation objects to eden generation objects.  The barrier
+        currently checks the mark byte in a cell to see if we should skip adding the
+        cell to the GC remembered set.  The addition should be skipped if:
+
+        1. The cell is in the young generation.  It has no old to eden pointers by
+           definition.
+        2. The cell is already in the remembered set.  While it is ok to add the cell
+           to the GC remembered set more than once, it would be redundant.  Hence,
+           we skip this as an optimization to avoid doing unnecessary work.
+
+        The barrier currently names this check as checkMarkByte().  We should rename it
+        to jumpIfIsRememberedOrInEden() to be clearer about its intent.
+
+        Similarly, Jump results of this check are currently named
+        ownerNotMarkedOrAlreadyRemembered.  This can be misinterpreted as the owner is
+        not marked or not already remembered.  We should rename it to
+        ownerIsRememberedOrInEden which is clearer about the intent of the
+        check.  What we are really checking for is that the cell is in the eden gen,
+        which is implied by it being "not marked".
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::osrWriteBarrier):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::writeBarrier):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::jumpIfIsRememberedOrInEden):
+        (JSC::AssemblyHelpers::checkMarkByte): Deleted.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSCell.h:
+
+2014-11-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Pause on exceptions should show the actual exception
+        https://bugs.webkit.org/show_bug.cgi?id=63096
+
+        Reviewed by Timothy Hatcher.
+
+        * debugger/Debugger.h:
+        Expose accessor for the pause reason to subclasses.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::type):
+        New "error" subtype for error objects.
+
+        * inspector/InjectedScriptSource.js:
+        When an object is an error object, use toString to provide a richer description.
+
+        * inspector/protocol/Runtime.json:
+        Expose a new "error" subtype for Error types (TypeError, ReferenceError, EvalError, etc).
+
+        * inspector/protocol/Debugger.json:
+        Provide type checked objects for different Debugger.pause pause reasons.
+        An exception provides the thrown object, but assert / CSP pauses provide
+        a richer typed object as the auxiliary data.
+
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchDidPause):
+        When paused because of an exception, pass the exception on.
+
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::handleConsoleAssert):
+        (Inspector::InspectorDebuggerAgent::scriptExecutionBlockedByCSP):
+        Provide richer data in pause events.
+
+        * inspector/scripts/codegen/generate_backend_commands.py:
+        (BackendCommandsGenerator.generate_domain.is_anonymous_enum_param):
+        (BackendCommandsGenerator.generate_domain):
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        Generate frontend enums for anonymous enum event parameters.
+
+2014-11-04  Michael Saboff  <msaboff@apple.com>
+
+        Disable flakey float32-repeat-out-of-bounds.js and int8-repeat-out-of-bounds.js tests for ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=138381
+
+        Reviewed by Mark Lam.
+
+        Disabled these test for ARM64.  Will address the failures and then re-enable.
+
+        * tests/stress/float32-repeat-out-of-bounds.js:
+        * tests/stress/int8-repeat-out-of-bounds.js:
+
+2014-11-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Enum value collisions between different generators
+        https://bugs.webkit.org/show_bug.cgi?id=138343
+
+        Reviewed by Brian Burg.
+
+        Each generator was using its own filtered list of domains_to_generate
+        to build the shared unique list of enum value encodings. This list
+        was slightly different across different generators. Instead always
+        use the list of all non-supplemental domains to generate the shared
+        list of enum values.
+
+        * inspector/scripts/codegen/generator.py:
+        (Generator.non_supplemental_domains):
+        (Generator.domains_to_generate):
+        (Generator._traverse_and_assign_enum_values):
+        * inspector/scripts/tests/enum-values.json: Added.
+        * inspector/scripts/tests/expected/enum-values.json-result: Added.
+
+2014-11-03  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Workaround for Cortex-A53 erratum 835769
+        https://bugs.webkit.org/show_bug.cgi?id=138315
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces CMake variable and preprocessor macro
+        WTF_CPU_ARM64_CORTEXA53 with the aim of enabling Cortex-A53-specific
+        code paths, if set true. The patch also implements one case where such
+        code paths are needed: the workaround for Cortex-A53 erratum 835769. If
+        WTF_CPU_ARM64_CORTEXA53 is set then:
+        - CMake checks whether the compiler already has support for a workaround
+          and adds -mfix-cortex-a53-835769 to the compiler flags if so,
+        - the ARM64 backend of offlineasm inserts a nop between memory and
+          multiply-accumulate instructions, and
+        - the ARM64 assembler also inserts a nop between memory and (64-bit) 
+          multiply-accumulate instructions.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::madd):
+        Call nopCortexA53Fix835769() to insert a nop if CPU(ARM64_CORTEXA53) and
+        if necessary.
+        (JSC::ARM64Assembler::msub): Likewise.
+        (JSC::ARM64Assembler::smaddl): Likewise.
+        (JSC::ARM64Assembler::smsubl): Likewise.
+        (JSC::ARM64Assembler::umaddl): Likewise.
+        (JSC::ARM64Assembler::umsubl): Likewise.
+        (JSC::ARM64Assembler::nopCortexA53Fix835769):
+        Added. Insert a nop if the previously emitted instruction was a load, a
+        store, or a prefetch, and if the current instruction is 64-bit.
+        * offlineasm/arm64.rb:
+        Add the arm64CortexA53Fix835769 phase and call it from
+        getModifiedListARM64 to insert nopCortexA53Fix835769 between appropriate
+        macro instructions. Also, lower nopCortexA53Fix835769 to nop if
+        CPU(ARM64_CORTEXA53), to nothing otherwise.
+        * offlineasm/instructions.rb:
+        Define macro instruction nopFixCortexA53Err835769.
+
+2014-11-03  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r175509.
+        https://bugs.webkit.org/show_bug.cgi?id=138349
+
+        broke some builds (Requested by msaboff on #webkit).
+
+        Reverted changeset:
+
+        "Update scope related slow path code to use scope register
+        added to opcodes"
+        https://bugs.webkit.org/show_bug.cgi?id=138254
+        http://trac.webkit.org/changeset/175509
+
+2014-11-03  Michael Saboff  <msaboff@apple.com>
+
+        Update scope related slow path code to use scope register added to opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=138254
+
+        Reviewed by Mark Lam.
+
+        Updated slow paths for op_pop_scope, op_push_name_scope and op_push_with_scope.
+        Added scope register index parameter to the front of the relevant argument lists of the
+        slow functions.  In the case of op_push_name_scope for x86 (32 bit), there aren't enough
+        registers to accomodate all the parameters.  Therefore, added two new JSVALUE32_64 slow
+        paths called operationPushCatchScope() and operationPushFunctionNameScope() to eliminate
+        the last "type" argument.
+        
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr): Added a new template to take 6 arguments.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        New variants of setupArgumentsWithExecState() and callOperation() to handle the new
+        combinations of argument types and counts.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_pop_scope):
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_pop_scope):
+        (JSC::JIT::emit_op_push_name_scope):
+        Use the new slow paths.
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        Updates to set the scope result using the scope register index.  Added operationPushCatchScope()
+        and operationPushFunctionNameScope().
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        Updated the scope slow paths to use the scope register index in the instruction to read and
+        write the register instead of using CallFrame::scope() and CallFrame::setScope().
+
+2014-11-03  Michael Saboff  <msaboff@apple.com>
+
+        Add "get scope" byte code
+        https://bugs.webkit.org/show_bug.cgi?id=138326
+
+        Reviewed by Mark Lam.
+
+        Added op_get_scope.  Added implementations for the LLInt and baseline JIT.
+        Provided nop implementation for DFG and FTL.  The new byte code is emitted
+        after op_enter for any function, program or eval.  It is expected that the
+        DFG will be implemented such that unneeded op_get_scope would be eliminated
+        during DFG compilation.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        Added new op_get_scope bytecode.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitGetScope):
+        * bytecompiler/BytecodeGenerator.h:
+        Emit new op_get_scope bytecode.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        Added framework for new op_get_scope bytecode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_scope):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Implementation of op_get_scope bytecode.
+
+2014-11-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Fix RWIProtocol 64-to-32 bit conversion warnings
+        https://bugs.webkit.org/show_bug.cgi?id=138325
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InspectorValues.h:
+        Vector's length really is an unsigned, so a static_cast here is fine.
+
+        * inspector/scripts/codegen/generate_objective_c.py:
+        (ObjCGenerator.objc_type_for_raw_name):
+        Use int instead of NSInteger for APIs that eventually map to
+        InspectorObject's setInteger, which takes an int.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        Rebaselined results with the type change.
+
+2014-11-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Show Selector's Specificity
+        https://bugs.webkit.org/show_bug.cgi?id=138189
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/CSS.json:
+        Create a new named type CSSSelector to include a selector's text and specificity.
+        The specificity tuple is optional as it may soon be made dynamic in some cases.
+
+2014-11-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ObjC Protocol Interfaces should throw exceptions for nil arguments
+        https://bugs.webkit.org/show_bug.cgi?id=138221
+
+        Reviewed by Timothy Hatcher.
+
+        The RWIProtocol APIs will now raise exceptions when:
+
+          - any properties are set on a type with a nil value or key (handled by RWIProtocolJSONObject)
+          - required parameters in type constructors have nil value
+          - required or optional command return parameters have nil values
+          - required or optional event parameters have nil values
+
+        The exceptions include the name of the field when possible.
+
+        * inspector/scripts/codegen/generate_objective_c.py:
+        (ObjCGenerator.is_type_objc_pointer_type):
+        Provide a quick check to see if type would be a pointer or not
+        in the ObjC API. Enums for example are not pointers in the API
+        because we manage converting them to/from strings.
+
+        * inspector/scripts/codegen/generate_objective_c_backend_dispatcher_implementation.py:
+        (ObjectiveCConfigurationImplementationGenerator._generate_success_block_for_command):
+        * inspector/scripts/codegen/generate_objective_c_frontend_dispatcher_implementation.py:
+        (ObjectiveCFrontendDispatcherImplementationGenerator._generate_event):
+        * inspector/scripts/codegen/generate_objective_c_types_implementation.py:
+        (ObjectiveCTypesImplementationGenerator._generate_init_method_for_required_members):
+        (ObjectiveCTypesImplementationGenerator._generate_setter_for_member):
+        Throw exceptions when nil values are disallowed.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        Rebaseline tests which include the exception raise calls.
+
+2014-11-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ALTERNATE_DISPATCHERS Let the frontend know about extra agents
+        https://bugs.webkit.org/show_bug.cgi?id=138236
+
+        Reviewed by Brian Burg.
+
+        Inform the frontend about any extra domains the backend may have
+        above and beyond the default list of domains for the debuggable type.
+        This approach means there is almost no cost to normal debugging.
+        When a JSContext is debugged with extra agents, a message is sent
+        to the frontend letting it know which domains to then activate,
+        and perform any initialization work that may be required.
+
+        * inspector/InspectorAgentBase.h:
+        (Inspector::InspectorAgentBase::domainName):
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::InspectorAgentRegistry::appendExtraAgent):
+        * inspector/InspectorAgentRegistry.h:
+        * inspector/scripts/codegen/generator_templates.py:
+        Provide a way to get a list of just the extra domains.
+        To aggregate this list provide a different "append"
+        specifically for extra agents.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        When a frontend connects, inform it of the extra domains.
+
+        * inspector/protocol/Inspector.json:
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::enable):
+        (Inspector::InspectorAgent::activateExtraDomains):
+        Send an event with the extra domains to activate.
+
+2014-11-01  Michael Saboff  <msaboff@apple.com>
+
+        Add scope operand to op_resolve_scope
+        https://bugs.webkit.org/show_bug.cgi?id=138253
+
+        Reviewed by Mark Lam.
+
+        Added scope operand to op_resolve_scope.  Although the scope register is filled in with
+        the ScopeChain register, this operand is not used in the processing of the bytecode.
+        That will be addressed in a future patch.
+
+        * bytecode/BytecodeList.json: Lengthened the three bytecodes.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Added code to dump the scope operand.
+
+        (JSC::CodeBlock::CodeBlock): 
+        (JSC::CodeBlock::finalizeUnconditionally):
+        Updated the operand indecies for the processing of op_resolve_scope.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitGetOwnScope):
+        (JSC::BytecodeGenerator::emitReturn):
+        Added scope register to these emit functions and the bytecodes they emit.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        Updated the operand indecies for the processing of op_resolve_scope.
+
+2014-11-01  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(CMake): Make it possible to build without introspection
+        https://bugs.webkit.org/show_bug.cgi?id=138006
+
+        Reviewed by Philippe Normand.
+
+        Do not install introspection files when introspection is disabled.
+
+        * PlatformGTK.cmake:
+
+2014-10-31  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Use std::unique_ptr for TypeCountSet
+        https://bugs.webkit.org/show_bug.cgi?id=138242
+
+        Reviewed by Andreas Kling.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::protectedObjectTypeCounts):
+        Use std::unique_ptr<> instead of PassOwnPtr|OwnPtr.
+        (JSC::Heap::objectTypeCounts): ditto.
+        * heap/Heap.h:
+
+2014-10-31  Michael Saboff  <msaboff@apple.com>
+
+        Add scope operand to op_push_with_scope, op_push_name_scope and op_pop_scope
+        https://bugs.webkit.org/show_bug.cgi?id=138252
+
+        Reviewed by Geoffrey Garen.
+
+        Added scope operand to op_push_with_scope, op_push_name_scope and op_pop_scope.
+        Although the scope register is filled in with the ScopeChain register for all 
+        three bytecodes, this operand is not used in the processing of the bytecodes.
+        That will be addressed in a future patch.
+
+        * bytecode/BytecodeList.json: Lengthened the three bytecodes.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Added code to dump the scope operand.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::emitPopScopes):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::scopeRegister):
+        Added scope register to these emit functions and the bytecodes they emit.
+        New m_scopeRegister and accessor.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        Created a RegisterID for the ScopeChain register and used it to emit the updated
+        bytecodes.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_push_name_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        (JSC::JIT::emit_op_push_name_scope):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        Updated the operand indecies for the processing of the updated bytecodes.
+
+2014-10-31  Andreas Kling  <akling@apple.com>
+
+        Make writes to RegExpObject.lastIndex cacheable.
+        <https://webkit.org/b/138255>
+
+        Reviewed by Geoffrey Garen.
+
+        We were neglecting to IC the puts to RegExpObject.lastIndex on Octane/regexp,
+        and ended up spending 4.5% of a time profile in operationPutByIdNonStrict.
+
+        ~3% progression on Octane/regexp.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectSetLastIndexStrict):
+        (JSC::regExpObjectSetLastIndexNonStrict):
+        (JSC::RegExpObject::put):
+
+2014-10-31  Chris Dumez  <cdumez@apple.com>
+
+        Fix a couple of warnings in JSC reported by clang static analyzer
+        https://bugs.webkit.org/show_bug.cgi?id=138240
+
+        Reviewed by Geoffrey Garen.
+
+        Fix a couple of warnings in JSC reported by clang static analyzer about
+        value stored in variables never being read. This is addressed by
+        reducing the scope of the variable or removing the variable entirely.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        * runtime/VM.cpp:
+        (JSC::VM::throwException):
+
+2014-10-30  Dana Burkart  <dburkart@apple.com>
+
+        <rdar://problem/18821260> Prepare for the mysterious future
+
+        Reviewed by Lucas Forschler.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2014-10-30  Saam Barati  <saambarati1@gmail.com>
+
+        AST Nodes should keep track of their end offset
+        https://bugs.webkit.org/show_bug.cgi?id=138143
+
+        Reviewed by Filip Pizlo.
+
+        AST nodes nodes now have an int property for their end text 
+        offsets. This change lays some foundational work that will be 
+        needed in profiling which basic blocks have executed.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::setEndOffset):
+        * parser/Nodes.h:
+        (JSC::Node::endOffset):
+        (JSC::Node::setEndOffset):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        * parser/Parser.h:
+        (JSC::Parser<LexerType>::parse):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2014-10-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Generate ObjC inspector protocol types and alternate dispatcher interfaces
+        https://bugs.webkit.org/show_bug.cgi?id=138048
+
+        Reviewed by Brian Burg.
+
+        Generate Objective-C interfaces for inspector protocol types, command, and event dispatchers.
+        This is very much like the InspectorProtocolTypes, BackendDispatchers, and FrontendDispatchers,
+        but with an ObjC spin on things.
+
+        The private API that clients would use is all encapsulated in RWIProtocol.h. It includes the
+        types interfaces, command handler protocol, and event dispatcher interface. Where possible the
+        API uses real enums, which hides the raw protocol enum strings from clients.
+
+        Inspector protocol types are, like InspectorProtocolObjects, built on top of an InspectorObject.
+        This offers the flexibilty of adding arbitrary key/values using the RWIProtocolJSONObject
+        interface, which may be required for certain protocol objects like "Network.Headers" which
+        have no fields, but expect arbitrary properties to be added.
+
+        Command handler protocols always have two callbacks. An error callback and a success callback.
+        The signature is very much like BackendDispatchers. In parameters are passed directly to
+        the selectors, and out parameters are defined by the success callback. It will be the client's
+        responsibility to call either of these callbacks to complete handling of a request.
+
+        Event dispatcher interfaces are straight forward, just packaging up the arguments and sending
+        the message to the frontend.
+
+        ObjC <-> Protocol conversion happens in each of the generated files. In type getters / setters,
+        in commands parameters and event parameters. For this to work we generate conversion helpers
+        for all enums, ObjC enum <-> protocol strings. For NSArray <-> InspectorArray there are some
+        static helpers to do the conversions. We do lose some type safety in these conversions.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/scripts/codegen/__init__.py:
+        * inspector/scripts/codegen/generate_alternate_backend_dispatcher_header.py:
+        (AlternateBackendDispatcherHeaderGenerator._generate_handler_declarations_for_domain):
+        * inspector/scripts/codegen/generate_backend_dispatcher_header.py:
+        (BackendDispatcherHeaderGenerator._generate_alternate_handler_forward_declarations_for_domains.AlternateInspector):
+        (BackendDispatcherHeaderGenerator._generate_handler_declarations_for_domain):
+        (BackendDispatcherHeaderGenerator._generate_dispatcher_declarations_for_domain):
+        * inspector/scripts/codegen/generate_backend_dispatcher_implementation.py:
+        (BackendDispatcherImplementationGenerator._generate_handler_class_destructor_for_domain):
+        (BackendDispatcherImplementationGenerator._generate_dispatcher_implementations_for_domain):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_header.py:
+        (FrontendDispatcherHeaderGenerator._generate_dispatcher_declarations_for_domain):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_implementation.py:
+        (FrontendDispatcherImplementationGenerator._generate_dispatcher_implementations_for_domain):
+        * inspector/scripts/codegen/generate_objective_c.py: Added.
+        (join_type_and_name):
+        (strip_comment_markers):
+        (remove_duplicate_from_str):
+        (ObjCTypeCategory):
+        (ObjCTypeCategory.category_of_type):
+        (ObjCGenerator):
+        (ObjCGenerator.identifier_to_objc_identifier):
+        (ObjCGenerator.objc_identifier_to_identifier):
+        (ObjCGenerator.should_generate_domain_types_filter):
+        (ObjCGenerator.should_generate_domain_types_filter.should_generate_domain_types):
+        (ObjCGenerator.should_generate_domain_command_handler_filter):
+        (ObjCGenerator.should_generate_domain_command_handler_filter.should_generate_domain_command_handler):
+        (ObjCGenerator.should_generate_domain_event_dispatcher_filter):
+        (ObjCGenerator.should_generate_domain_event_dispatcher_filter.should_generate_domain_event_dispatcher):
+        (ObjCGenerator.objc_name_for_type):
+        (ObjCGenerator.objc_enum_name_for_anonymous_enum_declaration):
+        (ObjCGenerator.objc_enum_name_for_anonymous_enum_member):
+        (ObjCGenerator.objc_enum_name_for_anonymous_enum_parameter):
+        (ObjCGenerator.objc_enum_name_for_non_anonymous_enum):
+        (ObjCGenerator.variable_name_prefix_for_domain):
+        (ObjCGenerator.objc_accessor_type_for_raw_name):
+        (ObjCGenerator.objc_type_for_raw_name):
+        (ObjCGenerator.objc_class_for_raw_name):
+        (ObjCGenerator.protocol_type_for_raw_name):
+        (ObjCGenerator.protocol_type_for_type):
+        (ObjCGenerator.objc_class_for_type):
+        (ObjCGenerator.objc_accessor_type_for_member):
+        (ObjCGenerator.objc_accessor_type_for_member_internal):
+        (ObjCGenerator.objc_type_for_member):
+        (ObjCGenerator.objc_type_for_member_internal):
+        (ObjCGenerator.objc_type_for_param):
+        (ObjCGenerator.objc_type_for_param_internal):
+        (ObjCGenerator.objc_protocol_export_expression_for_variable):
+        (ObjCGenerator.objc_protocol_import_expression_for_member):
+        (ObjCGenerator.objc_protocol_import_expression_for_parameter):
+        (ObjCGenerator.objc_protocol_import_expression_for_variable):
+        (ObjCGenerator.objc_to_protocol_expression_for_member):
+        (ObjCGenerator.protocol_to_objc_expression_for_member):
+        (ObjCGenerator.objc_setter_method_for_member):
+        (ObjCGenerator.objc_setter_method_for_member_internal):
+        (ObjCGenerator.objc_getter_method_for_member):
+        (ObjCGenerator.objc_getter_method_for_member_internal):
+        * inspector/scripts/codegen/generate_objective_c_backend_dispatcher_header.py: Copied from Source/JavaScriptCore/inspector/scripts/codegen/generate_alternate_backend_dispatcher_header.py.
+        (ObjectiveCBackendDispatcherHeaderGenerator):
+        (ObjectiveCBackendDispatcherHeaderGenerator.output_filename):
+        (ObjectiveCBackendDispatcherHeaderGenerator.domains_to_generate):
+        (ObjectiveCBackendDispatcherHeaderGenerator.generate_output):
+        (ObjectiveCBackendDispatcherHeaderGenerator._generate_objc_forward_declarations):
+        (ObjectiveCBackendDispatcherHeaderGenerator._generate_objc_forward_declarations_for_domains):
+        (ObjectiveCBackendDispatcherHeaderGenerator._generate_objc_handler_declarations_for_domain):
+        (ObjectiveCBackendDispatcherHeaderGenerator._generate_objc_handler_declaration_for_command):
+        * inspector/scripts/codegen/generate_objective_c_backend_dispatcher_implementation.py: Added.
+        (ObjectiveCConfigurationImplementationGenerator):
+        (ObjectiveCConfigurationImplementationGenerator.__init__):
+        (ObjectiveCConfigurationImplementationGenerator.output_filename):
+        (ObjectiveCConfigurationImplementationGenerator.domains_to_generate):
+        (ObjectiveCConfigurationImplementationGenerator.generate_output):
+        (ObjectiveCConfigurationImplementationGenerator._generate_handler_implementation_for_domain):
+        (ObjectiveCConfigurationImplementationGenerator._generate_handler_implementation_for_command):
+        (ObjectiveCConfigurationImplementationGenerator._generate_success_block_for_command):
+        (ObjectiveCConfigurationImplementationGenerator._generate_conversions_for_command):
+        (ObjectiveCConfigurationImplementationGenerator._generate_invocation_for_command):
+        * inspector/scripts/codegen/generate_objective_c_configuration_header.py: Copied from Source/JavaScriptCore/inspector/scripts/codegen/generate_alternate_backend_dispatcher_header.py.
+        (ObjectiveCConfigurationHeaderGenerator):
+        (ObjectiveCConfigurationHeaderGenerator.output_filename):
+        (ObjectiveCConfigurationHeaderGenerator.generate_output):
+        (ObjectiveCConfigurationHeaderGenerator._generate_configuration_interface_for_domains):
+        (ObjectiveCConfigurationHeaderGenerator._generate_properties_for_domain):
+        * inspector/scripts/codegen/generate_objective_c_configuration_implementation.py: Added.
+        (ObjectiveCBackendDispatcherImplementationGenerator):
+        (ObjectiveCBackendDispatcherImplementationGenerator.__init__):
+        (ObjectiveCBackendDispatcherImplementationGenerator.output_filename):
+        (ObjectiveCBackendDispatcherImplementationGenerator.generate_output):
+        (ObjectiveCBackendDispatcherImplementationGenerator._generate_configuration_implementation_for_domains):
+        (ObjectiveCBackendDispatcherImplementationGenerator._generate_ivars):
+        (ObjectiveCBackendDispatcherImplementationGenerator._generate_dealloc):
+        (ObjectiveCBackendDispatcherImplementationGenerator._generate_handler_setter_for_domain):
+        (ObjectiveCBackendDispatcherImplementationGenerator._generate_event_dispatcher_getter_for_domain):
+        * inspector/scripts/codegen/generate_objective_c_conversion_helpers.py: Added.
+        (add_whitespace_separator):
+        (ObjectiveCConversionHelpersGenerator):
+        (ObjectiveCConversionHelpersGenerator.__init__):
+        (ObjectiveCConversionHelpersGenerator.output_filename):
+        (ObjectiveCConversionHelpersGenerator.domains_to_generate):
+        (ObjectiveCConversionHelpersGenerator.generate_output):
+        (ObjectiveCConversionHelpersGenerator._generate_enum_conversion_functions):
+        (ObjectiveCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_declaration):
+        (ObjectiveCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_member):
+        (ObjectiveCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_parameter):
+        (ObjectiveCConversionHelpersGenerator._generate_enum_objc_to_protocol_string):
+        (ObjectiveCConversionHelpersGenerator._generate_enum_from_protocol_string):
+        * inspector/scripts/codegen/generate_objective_c_frontend_dispatcher_implementation.py: Added.
+        (ObjectiveCFrontendDispatcherImplementationGenerator):
+        (ObjectiveCFrontendDispatcherImplementationGenerator.__init__):
+        (ObjectiveCFrontendDispatcherImplementationGenerator.output_filename):
+        (ObjectiveCFrontendDispatcherImplementationGenerator.domains_to_generate):
+        (ObjectiveCFrontendDispatcherImplementationGenerator.generate_output):
+        (ObjectiveCFrontendDispatcherImplementationGenerator._generate_event_dispatcher_implementations):
+        (ObjectiveCFrontendDispatcherImplementationGenerator._generate_event):
+        (ObjectiveCFrontendDispatcherImplementationGenerator._generate_event_signature):
+        (ObjectiveCFrontendDispatcherImplementationGenerator._generate_event_out_parameters):
+        * inspector/scripts/codegen/generate_objective_c_header.py: Added.
+        (add_whitespace_separator):
+        (ObjectiveCHeaderGenerator):
+        (ObjectiveCHeaderGenerator.__init__):
+        (ObjectiveCHeaderGenerator.output_filename):
+        (ObjectiveCHeaderGenerator.generate_output):
+        (ObjectiveCHeaderGenerator._generate_forward_declarations):
+        (ObjectiveCHeaderGenerator._generate_enums):
+        (ObjectiveCHeaderGenerator._generate_types):
+        (ObjectiveCHeaderGenerator._generate_anonymous_enum_for_declaration):
+        (ObjectiveCHeaderGenerator._generate_anonymous_enum_for_member):
+        (ObjectiveCHeaderGenerator._generate_anonymous_enum_for_parameter):
+        (ObjectiveCHeaderGenerator._generate_enum):
+        (ObjectiveCHeaderGenerator._generate_enum.NS_ENUM):
+        (ObjectiveCHeaderGenerator._generate_type_interface):
+        (ObjectiveCHeaderGenerator._generate_init_method_for_required_members):
+        (ObjectiveCHeaderGenerator._generate_member_property):
+        (ObjectiveCHeaderGenerator._generate_command_protocols):
+        (ObjectiveCHeaderGenerator._generate_single_command_protocol):
+        (ObjectiveCHeaderGenerator._callback_block_for_command):
+        (ObjectiveCHeaderGenerator._generate_event_interfaces):
+        (ObjectiveCHeaderGenerator._generate_single_event_interface):
+        * inspector/scripts/codegen/generate_objective_c_internal_header.py: Copied from Source/JavaScriptCore/inspector/scripts/codegen/generate_alternate_backend_dispatcher_header.py.
+        (ObjectiveCTypesInternalHeaderGenerator):
+        (ObjectiveCTypesInternalHeaderGenerator.output_filename):
+        (ObjectiveCTypesInternalHeaderGenerator.generate_output):
+        (ObjectiveCTypesInternalHeaderGenerator._generate_event_dispatcher_private_interfaces):
+        * inspector/scripts/codegen/generate_objective_c_types_implementation.py: Added.
+        (add_whitespace_separator):
+        (ObjectiveCTypesImplementationGenerator):
+        (ObjectiveCTypesImplementationGenerator.__init__):
+        (ObjectiveCTypesImplementationGenerator.output_filename):
+        (ObjectiveCTypesImplementationGenerator.domains_to_generate):
+        (ObjectiveCTypesImplementationGenerator.generate_output):
+        (ObjectiveCTypesImplementationGenerator.generate_type_implementations):
+        (ObjectiveCTypesImplementationGenerator.generate_type_implementation):
+        (ObjectiveCTypesImplementationGenerator._generate_init_method_for_required_members):
+        (ObjectiveCTypesImplementationGenerator._generate_setter_for_member):
+        (ObjectiveCTypesImplementationGenerator._generate_getter_for_member):
+        * inspector/scripts/codegen/generate_protocol_types_header.py:
+        (ProtocolTypesHeaderGenerator._generate_forward_declarations):
+        (_generate_typedefs_for_domain):
+        (_generate_builders_for_domain):
+        * inspector/scripts/codegen/generator.py:
+        (Generator.wrap_with_guard_for_domain):
+        (Generator):
+        (Generator.wrap_with_guard):
+        * inspector/scripts/codegen/generator_templates.py:
+        (AlternateInspector):
+        (ObjCInspector):
+        * inspector/scripts/codegen/models.py:
+        (Framework.fromString):
+        (Frameworks):
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        (generate_from_specification):
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2014-10-30  Andreas Kling  <akling@apple.com>
+
+        Unreviewed assertion fix.
+
+        RegExpCachedResult::m_reified is now the dedicated member that knows whether
+        the result was reified into an array or not. Check that instead of m_result
+        which is now single-purpose.
+
+        * runtime/RegExpCachedResult.cpp:
+        (JSC::RegExpCachedResult::setInput):
+
+2014-10-29  Andreas Kling  <akling@apple.com>
+
+        Use plain JSArray for RegExp matches instead of a lazily populated custom object.
+        <https://webkit.org/b/138191>
+
+        Reviewed by Geoffrey Garen.
+
+        We're already offering two RegExp matching APIs, one that collects subpattern
+        matches (exec), and one that simply tests for a match (test).
+        Given that, it was pretty overkill to lazily populate the resulting array of
+        matches, since the user could simply use test() if they didn't need them.
+
+        This allows the JIT to generate better code for RegExp match arrays, and also
+        enables some fast paths in the JSC runtime that check if an object isJSArray().
+
+        Looks like ~1.5% improvement on Octane/regexp according to run-jsc-benchmarks.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        * runtime/JSArray.h:
+        (JSC::createArrayButterflyWithExactLength): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/RegExpCachedResult.cpp:
+        (JSC::RegExpCachedResult::visitChildren):
+        (JSC::RegExpCachedResult::lastResult):
+        (JSC::RegExpCachedResult::leftContext):
+        (JSC::RegExpCachedResult::rightContext):
+        * runtime/RegExpCachedResult.h:
+        (JSC::RegExpCachedResult::RegExpCachedResult):
+        (JSC::RegExpCachedResult::record):
+        (JSC::RegExpCachedResult::input):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::createRegExpMatchesArray):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray): Deleted.
+        (JSC::RegExpMatchesArray::create): Deleted.
+        (JSC::RegExpMatchesArray::finishCreation): Deleted.
+        (JSC::RegExpMatchesArray::visitChildren): Deleted.
+        (JSC::RegExpMatchesArray::reifyAllProperties): Deleted.
+        (JSC::RegExpMatchesArray::reifyMatchProperty): Deleted.
+        (JSC::RegExpMatchesArray::leftContext): Deleted.
+        (JSC::RegExpMatchesArray::rightContext): Deleted.
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::createStructure): Deleted.
+        (JSC::RegExpMatchesArray::reifyAllPropertiesIfNecessary): Deleted.
+        (JSC::RegExpMatchesArray::reifyMatchPropertyIfNecessary): Deleted.
+        (JSC::RegExpMatchesArray::getOwnPropertySlot): Deleted.
+        (JSC::RegExpMatchesArray::getOwnPropertySlotByIndex): Deleted.
+        (JSC::RegExpMatchesArray::put): Deleted.
+        (JSC::RegExpMatchesArray::putByIndex): Deleted.
+        (JSC::RegExpMatchesArray::deleteProperty): Deleted.
+        (JSC::RegExpMatchesArray::deletePropertyByIndex): Deleted.
+        (JSC::RegExpMatchesArray::getOwnPropertyNames): Deleted.
+        (JSC::RegExpMatchesArray::defineOwnProperty): Deleted.
+        (JSC::isRegExpMatchesArray): Deleted.
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::exec):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+
+2014-10-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Fix Type Dependency Issues
+        https://bugs.webkit.org/show_bug.cgi?id=125664
+
+        Reviewed by Brian Burg.
+
+        Now that all JSON protocol files are processed together again
+        in r174892, we can remove the duplicated types which were only
+        needed when the domains were split.
+
+        * inspector/protocol/Console.json:
+        * inspector/protocol/Runtime.json:
+
+2014-10-28  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r175249.
+        https://bugs.webkit.org/show_bug.cgi?id=138138
+
+        Appears to be failing some JS tests (Requested by mlam_ on
+        #webkit).
+
+        Reverted changeset:
+
+        "Holes are not copied properly when Arrays change shape to
+        ArrayStorage type."
+        https://bugs.webkit.org/show_bug.cgi?id=138118
+        http://trac.webkit.org/changeset/175249
+
+2014-10-27  Mark Lam  <mark.lam@apple.com>
+
+        Holes are not copied properly when Arrays change shape to ArrayStorage type.
+        <https://webkit.org/b/138118>
+
+        Reviewed by Mark Hahnenberg.
+
+        When we convert non-ArrayStorage typed arrays into ArrayStorage typed arrays,
+        we skipped the holes.  As a result, the slots in the ArrayStorage vector that
+        corresponds to those holes are uninitialize.  This is now fixed.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+
+2014-10-27  Mark Lam  <mark.lam@apple.com>
+
+        Crash when attempting to perform array iteration on a non-array with numeric keys not initialized.
+        <https://webkit.org/b/137814>
+
+        Reviewed by Geoffrey Garen.
+
+        The arrayIteratorNextThunkGenerator() thunk was not checking for the case where
+        the butterfly may be NULL.  This was the source of the crash, and is now fixed.
+
+        In addition, it is also not checking for the case where a property named "length"
+        may have been set on the iterated object.  The thunk only checks the butterfly's
+        publicLength for its iteration operation.  Array objects will work fine with this
+        because it always updates its butterfly's publicLength when its length changes.
+        In the case of iterable non-Array objects, the "length" property will require a
+        look up outside of the scope of this thunk.  The fix is simply to limit the fast
+        case checks in this thunk to Array objects.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::arrayIteratorNextThunkGenerator):
+
+2014-10-27  Mark Lam  <mark.lam@apple.com>
+
+        Simplified some JSObject methods for converting arrays to ArrayStorage shape.
+        <https://webkit.org/b/138119>
+
+        Reviewed by Filip Pizlo.
+
+        Currently, for each Undecided, Int32, Double, and Contiguous array shapes,
+        there are 3 JSObject methods to convert them to ArrayStorage shape:
+            ArrayStorage* convert<shape>ToArrayStorage(VM&, NonPropertyTransition, unsigned neededLength);
+            ArrayStorage* convert<shape>ToArrayStorage(VM&, NonPropertyTransition);
+            ArrayStorage* convert<shape>ToArrayStorage(VM&);
+
+        However, the neededLength that is passed is always m_butterfly->vectorLength().
+        Hence, the method that takes a neededLength is really not needed.  This patch
+        removes this unneeded verbosity.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        - Also reordered the placement of the DeferGC statement so this Int32 function
+          will look more similar to the others.
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        * runtime/JSObject.h:
+
+2014-10-25  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: timelines should not count time elapsed while paused in the debugger
+        https://bugs.webkit.org/show_bug.cgi?id=136351
+
+        Unreviewed, follow-up fix after r175203. The debugger agent should not assume
+        that the inspector environment's stopwatch has already been started.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::didPause): Check if the stopwatch isActive() before stopping.
+
+2014-10-18  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Inspector: timelines should not count time elapsed while paused in the debugger
+        https://bugs.webkit.org/show_bug.cgi?id=136351
+
+        Reviewed by Timothy Hatcher.
+
+        Now that we have a stopwatch to provide pause-aware timing data, we can remove the
+        profiler's handling of debugger pause/continue callbacks. The debugger agent accounts
+        for suspended execution by pausing and resuming the stopwatch.
+
+        * API/JSProfilerPrivate.cpp:
+        (JSStartProfiling): Use a fresh stopwatch when profiling from the JSC API.
+        * inspector/InspectorEnvironment.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::executionStopwatch):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::handlePause):
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::didPause):
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        (Inspector::InspectorDebuggerAgent::didContinue):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * profiler/LegacyProfiler.cpp:
+        (JSC::LegacyProfiler::profiler): Use nullptr.
+        (JSC::LegacyProfiler::startProfiling): Hand off a stopwatch to the profile generator.
+        (JSC::LegacyProfiler::stopProfiling): Use nullptr.
+        (JSC::LegacyProfiler::didPause): Deleted.
+        (JSC::LegacyProfiler::didContinue): Deleted.
+        * profiler/LegacyProfiler.h:
+        * profiler/Profile.cpp: The root node should always have a start time of 0.0.
+        (JSC::Profile::Profile):
+        * profiler/ProfileGenerator.cpp: Remove debugger pause/continue callbacks and the
+        timestamp member that was used to track time elapsed by the debugger. Just use the
+        stopwatch's elapsed times to generate start/elapsed times for function calls.
+
+        (JSC::ProfileGenerator::create):
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::AddParentForConsoleStartFunctor::operator()): The parent node of |console.profile|
+        should have a start time of 0.0, since it represents the starting node of profiling.
+
+        (JSC::ProfileGenerator::beginCallEntry):
+        (JSC::ProfileGenerator::endCallEntry):
+        (JSC::ProfileGenerator::didPause): Deleted.
+        (JSC::ProfileGenerator::didContinue): Deleted.
+        * profiler/ProfileGenerator.h:
+
+2014-10-24  Mark Lam  <mark.lam@apple.com>
+
+        Simplified IndexingType's hasAnyArrayStorage().
+        <https://webkit.org/b/138051>
+
+        Reviewed by Michael Saboff.
+
+        IndexingType's hasAnyArrayStorage() currently does subtraction of ArrayStorageShape
+        with the purpose of making non-ArrayStorage types underflow (with that subtraction)
+        and have a result that exceeds SlowPutArrayStorageShape.  What it is doing is
+        basically checking for a shape value that is greater equal to ArrayStorageShape.
+        We can just simplify the code as such.
+
+        Also added a comment to describe the structure of the bits in IndexingType.
+
+        * runtime/IndexingType.h:
+        (JSC::hasAnyArrayStorage):
+
+2014-10-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Provide a way to have alternate inspector agents
+        https://bugs.webkit.org/show_bug.cgi?id=137901
+
+        Reviewed by Brian Burg.
+
+        Provide a way to use alternate inspector agents debugging a JSContext.
+        Expose a very slim private API that a client could use to know when
+        an inspector has connected/disconnected, and a way to register its
+        augmentative agents.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        New feature guard. New files.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextGetAugmentableInspectorController):
+        * API/JSContextRefInspectorSupport.h: Added.
+        Access to the private interface from a JSContext.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/augmentable/AugmentableInspectorController.h: Added.
+        (Inspector::AugmentableInspectorController::~AugmentableInspectorController):
+        (Inspector::AugmentableInspectorController::connected):
+        * inspector/augmentable/AugmentableInspectorControllerClient.h: Added.
+        (Inspector::AugmentableInspectorControllerClient::~AugmentableInspectorControllerClient):
+        * inspector/augmentable/AlternateDispatchableAgent.h: Added.
+        (Inspector::AlternateDispatchableAgent::AlternateDispatchableAgent):
+        Provide the private APIs a client could use to add alternate agents using alternate backend dispatchers.
+
+        * inspector/scripts/codegen/__init__.py:
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        (generate_from_specification):
+        New includes, and use the new generator.
+        
+        * inspector/scripts/codegen/generate_alternate_backend_dispatcher_header.py: Added.
+        (AlternateBackendDispatcherHeaderGenerator):
+        (AlternateBackendDispatcherHeaderGenerator.__init__):
+        (AlternateBackendDispatcherHeaderGenerator.output_filename):
+        (AlternateBackendDispatcherHeaderGenerator.generate_output):
+        (AlternateBackendDispatcherHeaderGenerator._generate_handler_declarations_for_domain):
+        (AlternateBackendDispatcherHeaderGenerator._generate_handler_declaration_for_command):
+        Generate the abstract AlternateInspectorBackendDispatcher interfaces.
+
+        * inspector/scripts/codegen/generate_backend_dispatcher_header.py:
+        (BackendDispatcherHeaderGenerator.generate_output):
+        (BackendDispatcherHeaderGenerator._generate_alternate_handler_forward_declarations_for_domains):
+        (BackendDispatcherHeaderGenerator._generate_alternate_handler_forward_declarations_for_domains.AlternateInspector):
+        Forward declare alternate dispatchers, and allow setting an alternate dispatcher on a domain dispatcher.
+
+        * inspector/scripts/codegen/generate_backend_dispatcher_implementation.py:
+        (BackendDispatcherImplementationGenerator.generate_output):
+        (BackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        Check for and dispatch on an AlternateInspectorBackendDispatcher if there is one for this domain.
+
+        * inspector/scripts/codegen/generator_templates.py:
+        (AlternateInspectorBackendDispatcher):
+        (AlternateInspector):
+        Template boilerplate for prelude and postlude.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        Rebaseline tests.
+
+2014-10-23  Michael Saboff  <msaboff@apple.com>
+
+        offsets.rb:183:in `buildOffsetsMap': unhandled exception - is offlineasm dependency tracking broken? (132668)
+        https://bugs.webkit.org/show_bug.cgi?id=138017
+
+        Reviewed by Mark Lam.
+
+        Removed from the nput file $(SRCROOT)/llint/LowLevelAssembler.asm and output file
+        $(BUILT_PRODUCTS_DIR)/LLIntOffsets/LLIntDesiredOffsets.h from the Generate Derived Sources
+        build phase in the LLInt Offset target.  There is no need for Xcode to do any dependency
+        checking with these files as the ruby script offlineasm/generate_offset_extractor.rb will
+        do that for us.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2014-10-23  Michael Saboff  <msaboff@apple.com>
+
+        Change CallFrame::lexicalGlobalObject() to use Callee instead of JSScope
+        https://bugs.webkit.org/show_bug.cgi?id=136901
+
+        Reviewed by Mark Lam.
+
+        Implement ExecState::lexicalGlobalObject() using Callee.
+        
+        * runtime/JSScope.h:
+        (JSC::ExecState::lexicalGlobalObject):
+
+2014-10-22  Milan Crha  <mcrha@redhat.com>
+
+        Prefix isnan() with std::.
+        <https://webkit.org/b/137966>.
+
+        Reviewed by Carlos Garcia Campos.
+
+        * profiler/ProfileNode.h:
+        (JSC::ProfileNode::Call::setStartTime):
+        (JSC::ProfileNode::Call::setElapsedTime):
+
+2014-10-22  Mark Lam  <mark.lam@apple.com>
+
+        Refactoring to simplify some code in DatePrototype.cpp.
+        <https://webkit.org/b/137997>
+
+        Reviewed by Filip Pizlo.
+
+        A bunch of functions in DatePrototype.cpp have the pattern of loading a
+        constant into a local variable only to pass it to a callee function
+        immediately after.  There is no other use for that variable.  This adds
+        additional verbosity with no added benefit.
+
+        This patch refactors those functions to just pass the constant arg directly.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+
+2014-10-22  Byungseon Shin  <sun.shin@lge.com>
+
+        String(new Date(Mar 30 2014 01:00:00)) is wrong in CET
+        https://bugs.webkit.org/show_bug.cgi?id=130967
+
+        Reviewed by Mark Lam.
+
+        By definition of calculateLocalTimeOffset, input time should be UTC time.
+        But there are many cases when input time is based on local time.
+        So, it gives erroneous results while calculating offset of DST boundary time.
+        By adding a argument to distinguish UTC and local time, we can get the correct offset.
+
+        * JavaScriptCore.order:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateUTC):
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::calculateGregorianDateTime):
+        (JSC::DateInstance::calculateGregorianDateTimeUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/JSDateMath.cpp:
+        (JSC::localTimeOffset):
+        (JSC::gregorianDateTimeToMS):
+        (JSC::msToGregorianDateTime):
+        (JSC::parseDateFromNullTerminatedCharacters):
+        * runtime/JSDateMath.h:
+        * runtime/VM.h:
+        (JSC::LocalTimeOffsetCache::LocalTimeOffsetCache):
+        (JSC::LocalTimeOffsetCache::reset):
+        Passing TimeType argument to distingush UTC time and local time.
+
+2014-10-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Fix generator importing of protocol type "any", treat as value
+        https://bugs.webkit.org/show_bug.cgi?id=137931
+
+        Reviewed by Timothy Hatcher.
+
+        Treat incoming "any" objects as InspectorValues, which can be any type.
+        Add the necessary boilerplate to import.
+
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::AsMethodBridges::asValue):
+        (Inspector::InspectorBackendDispatcher::getValue):
+        * inspector/InspectorBackendDispatcher.h:
+        * inspector/scripts/codegen/generator.py:
+        (Generator.keyed_get_method_for_type):
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+
+2014-10-22  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r174996): Broke C_LOOP
+        https://bugs.webkit.org/show_bug.cgi?id=137971
+
+        Reviewed by Mark Lam.
+
+        Removed incorrect move to cfr (CallFrameRegister) before we make the call to a native function.
+        After r174996, the source register for the move contained garbage causing the crash.  The move
+        to cfr before making the call to the native function is wrong and should have been removed
+        some time ago.  This brings the ARM64 / C_LOOP code path inline with the other CPU paths.
+        Tested on ARM64 as well as a C_LOOP build.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2014-10-21  Mark Lam  <mark.lam@apple.com>
+
+        Remove erroneous canUseJIT() in the intrinsics version of JITThunks::hostFunctionStub().
+        <https://webkit.org/b/137937>
+
+        Reviewed by Michael Saboff.
+
+        This version of JITThunks::hostFunctionStub() can only be called from the intrinsics
+        version of VM::getHostFunction() which asserts canUseJIT().  Hence, we can eliminate
+        the canUseJIT() check in JITThunks::hostFunctionStub().  We don't handle the
+        !canUseJIT() case properly there anyway.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::hostFunctionStub):
+
+2014-10-21  Michael Saboff  <msaboff@apple.com>
+
+        Add operator==(PropertyName, const char*)
+        https://bugs.webkit.org/show_bug.cgi?id=137925
+
+        Reviewed by Mark Lam.
+
+        * runtime/PropertyName.h:
+        (JSC::operator==): Added to simplify comparison with string literals.
+
+
+2014-10-21  Michael Saboff  <msaboff@apple.com>
+
+        Change native call frames to use the scope from their Callee instead of their caller's scope
+        https://bugs.webkit.org/show_bug.cgi?id=137907
+
+        Reviewed by Mark Lam.
+
+        Changed setting of scope for native CallFrames to use the scope associated with the
+        Callee instead of the caller's scope.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2014-10-21  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
+
+        Add missing ENABLE(FTL_NATIVE_CALL_INLINING) guard to BundlePath.cpp after r174940
+        https://bugs.webkit.org/show_bug.cgi?id=137924
+
+        Reviewed by Csaba Osztrogonác.
+
+        * runtime/BundlePath.cpp:
+
+2014-10-21  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
+
+        Fix FTL Native Inlining for EFL
+        https://bugs.webkit.org/show_bug.cgi?id=137774
+
+        Reviewed by Michael Saboff.
+
+        Added required functionality for Native Inlining to EFL, and fixed a bug/typo in the original code,
+        which caused incorrect memory allocation.
+
+        * CMakeLists.txt:
+        * create-llvm-ir-from-source-file.py: Added.
+        * create-symbol-table-index.py: Added.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::lower):
+        (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForAvailability):
+        (JSC::FTL::LowerDFGToLLVM::exitValueForNode):
+        * runtime/BundlePath.cpp: Added.
+        (JSC::bundlePath):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        * runtime/MathObject.cpp:
+
+2014-10-21  Milan Crha  <mcrha@redhat.com>
+
+        Move JSC::MacroAssemblerX86Common::s_sse2CheckState definition to MacroAssemblerX86Common.cpp.
+        <https://webkit.org/b/137807>
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/MacroAssemblerX86Common.cpp:
+        * jit/JIT.cpp:
+
+2014-10-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed add back copyright line that was accidentally removed.
+
+        * inspector/scripts/codegen/generator_templates.py:
+        (GeneratorTemplates):
+
+2014-10-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: InspectorBackendCommands should include when to activate particular domains
+        https://bugs.webkit.org/show_bug.cgi?id=137753
+
+        Reviewed by Timothy Hatcher.
+
+        Add an availability property to domains that only activate for
+        particular debuggable types. If missing, the domain is always
+        activated. Otherwise it must be a debuggable type string.
+        When a frontend is opened for that debuggable type, the domain
+        will be activated.
+
+        * inspector/scripts/codegen/models.py:
+        (Protocol.parse_domain):
+        (Domain.__init__):
+        (Domains):
+        Parse and validate the Domain's "availability" property.
+
+        * inspector/scripts/codegen/generate_backend_commands.py:
+        (BackendCommandsGenerator.generate_domain):
+        Emit InspectorBackend.activateDomain with debuggable type filter.
+
+        * inspector/protocol/ApplicationCache.json:
+        * inspector/protocol/CSS.json:
+        * inspector/protocol/DOM.json:
+        * inspector/protocol/DOMDebugger.json:
+        * inspector/protocol/DOMStorage.json:
+        * inspector/protocol/Database.json:
+        * inspector/protocol/IndexedDB.json:
+        * inspector/protocol/LayerTree.json:
+        * inspector/protocol/Network.json:
+        * inspector/protocol/Page.json:
+        * inspector/protocol/Replay.json:
+        * inspector/protocol/Timeline.json:
+        * inspector/protocol/Worker.json:
+        These domains only activate for Web debuggables.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        Update existing tests that now have activate output.
+
+        * inspector/scripts/tests/expected/fail-on-domain-availability.json-error: Added.
+        * inspector/scripts/tests/fail-on-domain-availability.json: Added.
+        Add a test for "availability" validation.
+
+2014-10-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [Win] Build fix for generated inspector files.
+
+        Rubberstamped by Brent Fulgham.
+
+        * inspector/scripts/codegen/generate_backend_dispatcher_header.py:
+        (BackendDispatcherHeaderGenerator._generate_async_handler_declaration_for_command):
+        * inspector/scripts/codegen/generator_templates.py:
+        (GeneratorTemplates):
+
+2014-10-20  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed build fix.
+
+        We need to (1) pass the 'windows' argument to our script for checking feature definitions,
+        and (2) we must use Cwd::realpath on our path input arguments to avoid Cygwin and Windows
+        getting confused about path separators versus escape characters.
+
+
+        * JavaScriptCore.vcxproj/build-generated-files.pl:
+
+2014-10-20  Mark Lam  <mark.lam@apple.com>
+
+        [Follow up] Web Process crash when starting the web inspector after r174025.
+        <https://webkit.org/b/137340>
+
+        Reviewed by Geoffrey Garen.
+
+        Applied Geoff's feedback to clean up some code for better clarity after
+        r174856.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::insertCheck):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertOutOfOrder):
+
+2014-10-20  Mark Lam  <mark.lam@apple.com>
+
+        Factor out JITCode::typeName() for debugging use.
+        <https://webkit.org/b/137888>
+
+        Reviewed by Geoffrey Garen.
+
+        JITCode's printInternal() currently decodes the JITType into a string and
+        prints it.  This change factors out the part that decodes the JITType into
+        JITCode::typeName() so that we can call it from lldb while debugging to
+        quickly decode a JITType value.
+
+        * jit/JITCode.cpp:
+        (JSC::JITCode::typeName):
+        (WTF::printInternal):
+        * jit/JITCode.h:
+
+2014-10-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed Windows Build Fix #2 after r174892.
+
+        * JavaScriptCore.vcxproj/build-generated-files.pl:
+        Define FEATURE_DEFINES for JavaScriptCore's DerivedSources.make.
+        This uses the same technique as WebCore.
+
+2014-10-20  Mark Lam  <mark.lam@apple.com>
+
+        Fix placement of a few items in vcxproj ItemGroups.
+        <https://webkit.org/b/137886>
+
+        Reviewed by Geoffrey Garen.
+
+        https://webkit.org/b/137873 is likely a cut-and-paste error that manifested
+        because we had ClCompile and ClInclude entries mixed up in the wrong ItemGroups.
+        We should fix these so that ClCompile entries are in the ClCompile ItemGroup,
+        and ClInclude entries in the ClInclude ItemGroup.  This will help reduce the
+        chance of future cut-and-paste errors of this nature.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2014-10-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed Windows Build Fix after r174892.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        Update file name to the new generated file name.
+
+2014-10-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Rename generated Inspector.json to CombinedDomains.json to prevent name collisions
+        https://bugs.webkit.org/show_bug.cgi?id=137825
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/protocol/Inspector.json: Renamed from Source/JavaScriptCore/inspector/protocol/InspectorDomain.json.
+
+2014-10-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Generate all Inspector domains together in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=137748
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/ApplicationCache.json: Renamed from Source/WebCore/inspector/protocol/ApplicationCache.json.
+        * inspector/protocol/CSS.json: Renamed from Source/WebCore/inspector/protocol/CSS.json.
+        * inspector/protocol/DOM.json: Renamed from Source/WebCore/inspector/protocol/DOM.json.
+        * inspector/protocol/DOMDebugger.json: Renamed from Source/WebCore/inspector/protocol/DOMDebugger.json.
+        * inspector/protocol/DOMStorage.json: Renamed from Source/WebCore/inspector/protocol/DOMStorage.json.
+        * inspector/protocol/Database.json: Renamed from Source/WebCore/inspector/protocol/Database.json.
+        * inspector/protocol/IndexedDB.json: Renamed from Source/WebCore/inspector/protocol/IndexedDB.json.
+        * inspector/protocol/LayerTree.json: Renamed from Source/WebCore/inspector/protocol/LayerTree.json.
+        * inspector/protocol/Network.json: Renamed from Source/WebCore/inspector/protocol/Network.json.
+        * inspector/protocol/Page.json: Renamed from Source/WebCore/inspector/protocol/Page.json.
+        * inspector/protocol/Replay.json: Renamed from Source/WebCore/inspector/protocol/Replay.json.
+        * inspector/protocol/Timeline.json: Renamed from Source/WebCore/inspector/protocol/Timeline.json.
+        * inspector/protocol/Worker.json: Renamed from Source/WebCore/inspector/protocol/Worker.json.
+        Move all protocol files into this directory.
+
+        * inspector/InspectorProtocolTypesBase.h: Renamed from Source/JavaScriptCore/inspector/InspectorProtocolTypes.h.
+        Renamed the base types file to not clash with the generated types file.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.vcxproj/copy-files.cmd:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Update build phases for new JSON files and new filenames.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        Updated names of things now that prefixes are no longer needed.
+
+        * inspector/ConsoleMessage.h:
+        * inspector/ContentSearchUtilities.cpp:
+        * inspector/ContentSearchUtilities.h:
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptBase.h:
+        * inspector/ScriptCallFrame.h:
+        * inspector/ScriptCallStack.h:
+        * inspector/agents/InspectorAgent.h:
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::breakpointActionTypeForString):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * runtime/TypeProfiler.cpp:
+        * runtime/TypeSet.cpp:
+        Update includes and update a few function names that are generated.
+
+        * inspector/scripts/codegen/generate_protocol_types_header.py:
+        (ProtocolTypesHeaderGenerator.output_filename):
+        (ProtocolTypesHeaderGenerator.generate_output):
+        Include an export macro for type string constants defined in the implementation file.
+
+        * inspector/scripts/codegen/generate_backend_commands.py:
+        (BackendCommandsGenerator.output_filename):
+        * inspector/scripts/codegen/generate_backend_dispatcher_header.py:
+        (BackendDispatcherHeaderGenerator.output_filename):
+        (BackendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_backend_dispatcher_implementation.py:
+        (BackendDispatcherImplementationGenerator.output_filename):
+        (BackendDispatcherImplementationGenerator.generate_output):
+        (BackendDispatcherImplementationGenerator._generate_async_dispatcher_class_for_domain):
+        (BackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_header.py:
+        (FrontendDispatcherHeaderGenerator.output_filename):
+        (FrontendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_implementation.py:
+        (FrontendDispatcherImplementationGenerator.output_filename):
+        (FrontendDispatcherImplementationGenerator.generate_output):
+        (FrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        (_generate_class_for_object_declaration):
+        (_generate_builder_setter_for_member):
+        (_generate_unchecked_setter_for_member):
+        * inspector/scripts/codegen/generate_protocol_types_implementation.py:
+        (ProtocolTypesImplementationGenerator.output_filename):
+        (ProtocolTypesImplementationGenerator.generate_output):
+        (ProtocolTypesImplementationGenerator._generate_enum_mapping):
+        * inspector/scripts/codegen/models.py:
+        (Framework.fromString):
+        (Frameworks):
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        Simplify generator now that prefixes are no longer needed. This updates
+        filenames, includes, and the list of supported directories.
+
+2014-10-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove obsolete comments after r99798
+        https://bugs.webkit.org/show_bug.cgi?id=137871
+
+        Reviewed by Darin Adler.
+
+        r99798 removed the comment in MacroAssemblerARMv7::supportsFloatingPointTruncate(),
+        so we should remove the stale references to this removed comment.
+
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+
+2014-10-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        MacroAssemblerX86Common.cpp should be built on Windows too
+        https://bugs.webkit.org/show_bug.cgi?id=137873
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2014-10-20  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Remove duplicated source files
+        https://bugs.webkit.org/show_bug.cgi?id=137875
+
+        Reviewed by Gyuyoung Kim.
+
+        * CMakeLists.txt:
+
+2014-10-18  Brian J. Burg  <burg@cs.washington.edu>
+
+        Web Replay: code generator shouldn't complain about enums without a storage type if they are in an enclosing scope
+        https://bugs.webkit.org/show_bug.cgi?id=137084
+
+        Reviewed by Joseph Pecoraro.
+
+        In order to generate encode/decode method declarations without pulling in lots of headers,
+        the generator must forward declare enums (for enum classes or enums with explicit sizes).
+
+        Change the generator to not require an explicit size if an enum is declared inside a struct
+        or class definition. In that case, it must pull in headers since scoped enums can't be
+        forward declared.
+
+        This patch also fixes some chained if-statements that should be if-else statements.
+
+        Test: updated replay/scripts/tests/generate-enum-encoding-helpers.json to cover the new case.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (InputsModel.parse_type_with_framework_name.is):
+        (InputsModel.parse_type_with_framework_name.is.must):
+        (Generator.generate_enum_trait_implementation):
+        (InputsModel.parse_type_with_framework_name): Deleted.
+        * replay/scripts/CodeGeneratorReplayInputsTemplates.py:
+        * replay/scripts/tests/expected/fail-on-c-style-enum-no-storage.json-error:
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.cpp:
+        (JSC::EncodingTraits<WebCore::MouseButton>::decodeValue):
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp:
+        (JSC::EncodingTraits<WebCore::MouseButton>::decodeValue):
+        (JSC::EncodingTraits<WebCore::PlatformEvent::Type>::encodeValue):
+        (JSC::EncodingTraits<WebCore::PlatformEvent::Type>::decodeValue):
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp:
+        (JSC::EncodingTraits<WebCore::FormData1::Type>::decodeValue):
+        (JSC::EncodingTraits<PlatformEvent1::Type>::decodeValue):
+        * replay/scripts/tests/generate-enum-encoding-helpers.json: Added a new input to cover this case.
+
+2014-10-17  Mark Lam  <mark.lam@apple.com>
+
+        Web Process crash when starting the web inspector after r174025.
+        <https://webkit.org/b/137340>
+
+        Reviewed by Filip Pizlo.
+
+        After r174025, we can generate a bad graph in the DFG fixup phase like so:
+
+            102:<!0:-> StoreBarrier(Check:KnownCell:@19, ..., bc#44)
+            60:<!0:->  PutStructure(Check:KnownCell:@19, ..., bc#44)
+            103:<!0:-> Check(Check:NotCell:@54, ..., bc#44)
+                    // ^-- PutByOffset's StoreBarrier has been elided and replaced
+                    //     with a speculation check which can OSR exit.
+            61:<!0:->  PutByOffset(Check:KnownCell:@19, ..., bc#44)
+
+        As a result, the structure change will get executed even if we end up OSR
+        exiting before the PutByOffset.  In the baseline JIT code, the structure now
+        erroneously tells the put operation that there is a value in that property
+        slot when it is actually uninitialized (hence, the crash).
+
+        The fix is to insert the Check at the earliest point possible:
+
+        1. If the checked node is in the same bytecode as the PutByOffset, then
+           the earliest point where we can insert the Check is right after the
+           checked node.
+
+        2. If the checked node is from a preceding bytecode (before the PutByOffset),
+           then the earliest point where we can insert the Check is at the start
+           of the current bytecode.
+
+        Also reverted the workaround from r174749: https://webkit.org/b/137758.
+
+        Benchmark results appear to be a wash on aggregate.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::indexOfNode):
+        (JSC::DFG::FixupPhase::indexOfFirstNodeOfExitOrigin):
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::insertCheck):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertOutOfOrder):
+        (JSC::DFG::InsertionSet::insertOutOfOrderNode):
+
+2014-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Various arguments optimisations in codegen fail to account for arguments being in lexical record
+        https://bugs.webkit.org/show_bug.cgi?id=137617
+
+        Reviewed by Michael Saboff.
+
+        Rework the way we track |arguments| references so that we don't try
+        to use the |arguments| reference on the stack if it's not safe.
+
+        To do this without nuking performance it was necessary to update
+        the parser to track modification of the |arguments| reference
+        itself.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::willResolveToArguments):
+        (JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::uncheckedRegisterForArguments): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::hasSafeLocalArgumentsRegister):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::getArgumentByVal):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::existingArguments):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::modifiesArguments):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        * parser/Parser.h:
+        (JSC::Scope::getCapturedVariables):
+        * parser/ParserModes.h:
+
+2014-10-17  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Use WTF::move() instead of std::move() to help ensure move semantics in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=137809
+
+        Reviewed by Csaba Osztrogonác.
+
+        Substitution of WTF::move() for std::move(). Clean up std::move() in JavaScriptCore.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::setter):
+
+2014-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Use a single allocation for the Arguments object
+        https://bugs.webkit.org/show_bug.cgi?id=137751
+
+        Reviewed by Filip Pizlo.
+
+        This patch removes the secondary allocation for parameters in the Arguments
+        object.  This is faily simple, but we needed to make it possible for the JIT
+        to allocate a variable GC object.  To do this i've added a new 
+        emitAllocateVariableSizedJSObject function to the JIT that does the work to
+        find the correct heap for a variable sized allocation and then bump that
+        allocator.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateArguments):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateVariableSizedJSObject):
+        * heap/CopyToken.h:
+        * heap/Heap.h:
+        (JSC::Heap::subspaceForObjectWithoutDestructor):
+        (JSC::Heap::subspaceForObjectNormalDestructor):
+        (JSC::Heap::subspaceForObjectsWithImmortalStructure):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::subspaceForObjectsWithNormalDestructor):
+        (JSC::MarkedSpace::subspaceForObjectsWithImmortalStructure):
+        (JSC::MarkedSpace::subspaceForObjectsWithoutDestructor):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::createArguments):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::visitChildren):
+        (JSC::Arguments::copyBackingStore):
+        (JSC::Arguments::tearOff):
+        (JSC::Arguments::allocateRegisterArray): Deleted.
+        * runtime/Arguments.h:
+        (JSC::Arguments::create):
+        (JSC::Arguments::isTornOff):
+        (JSC::Arguments::offsetOfRegisterArray):
+        (JSC::Arguments::registerArraySizeInBytes):
+        (JSC::Arguments::registerArray):
+        (JSC::Arguments::allocationSize): Deleted.
+
+2014-10-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Apparently we've had a hole in arguments capture all along
+        https://bugs.webkit.org/show_bug.cgi?id=137767
+
+        Reviewed by Oliver Hunt.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArgument):
+        * tests/stress/arguments-captured.js: Added.
+        (foo):
+        (bar):
+
+2014-10-16  Saam Barati  <saambarati1@gmail.com>
+
+        Have the ProfileType node in the DFG convert to a structure check where it can
+        https://bugs.webkit.org/show_bug.cgi?id=137596
+
+        Reviewed by Filip Pizlo.
+
+        TypeSet now keeps track of the live set of Structures it has seen.
+        It no longer nukes everything during GC. It now only removes unmarked
+        structures during GC. This modification allows the ProfileType node 
+        to convert into a CheckStructure node safely in the DFG. 
+
+        This change brings up the conversion rate from ProfileType to Check 
+        or CheckStructrue from ~45% to ~65%. This change also speeds the 
+        type profiler up significantly: consistently between 2x-20x faster. 
+
+        This patch also does some slight refactoring: a few type profiler
+        related fields are moved from VM to TypeProfiler.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToCheckStructure):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::uniqueIDForVariable):
+        * runtime/SymbolTable.h:
+        * runtime/TypeLocationCache.cpp:
+        (JSC::TypeLocationCache::getTypeLocation):
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::TypeProfiler):
+        (JSC::TypeProfiler::nextTypeLocation):
+        (JSC::TypeProfiler::invalidateTypeSetCache):
+        (JSC::TypeProfiler::dumpTypeProfilerData):
+        * runtime/TypeProfiler.h:
+        (JSC::TypeProfiler::getNextUniqueVariableID):
+        * runtime/TypeProfilerLog.cpp:
+        (JSC::TypeProfilerLog::processLogEntries):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::TypeSet::invalidateCache):
+        * runtime/TypeSet.h:
+        (JSC::TypeSet::structureSet):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::enableTypeProfiler):
+        (JSC::VM::disableTypeProfiler):
+        (JSC::VM::dumpTypeProfilerData):
+        (JSC::VM::nextTypeLocation): Deleted.
+        (JSC::VM::invalidateTypeSetCache): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::typeProfiler):
+        (JSC::VM::getNextUniqueVariableID): Deleted.
+        * tests/typeProfiler/dfg-jit-optimizations.js:
+
+2014-10-16  Adrien Destugues  <pulkomandy@gmail.com>
+
+        Use isnan from std namespace in ProfileGenerator.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=137653
+
+        Reviewed by Darin Adler.
+
+        The C++ isnan() function is in the std namespace. The unprefixed isnan
+        may be available because of C99 headers leakage in C++, but should not
+        be used.
+
+        No new tests: no functional change, build fix on platforms which don't
+        export C99 functions in C++.
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::beginCallEntry):
+        (JSC::ProfileGenerator::endCallEntry):
+        (JSC::ProfileGenerator::didPause):
+        (JSC::ProfileGenerator::didContinue):
+
+2014-10-15  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r174025): remote inspector crashes frequently when executing inspector frontend's JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=137758
+
+        Rubber stamped by Filip Pizlo.
+
+        Reverted r174025 for just PutByOffset Nodes.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2014-10-14  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Clean up unnecessary PassOwnPtr.h inclusion
+        https://bugs.webkit.org/show_bug.cgi?id=137726
+
+        Reviewed by Chris Dumez.
+
+        * API/JSCallbackObject.h: Remove PassOwnPtr.h inclusion.
+        * bytecode/DFGExitProfile.cpp: ditto.
+
+2014-10-14  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Unreviewed gardening. Ignore Visual Studio *.sdf files.
+
+        * JavaScriptCore.vcxproj: Modified properties svn:ignore and svn:ignore.
+        * JavaScriptCore.vcxproj/jsc: Modified property svn:ignore.
+
+2014-10-14  Matthew Mirman  <mmirman@apple.com>
+
+        Removes references to LLVMJIT which is no longer part of LLVM
+        https://bugs.webkit.org/show_bug.cgi?id=137708
+
+        Reviewed by Filip Pizlo.
+
+        * Configurations/LLVMForJSC.xcconfig: removed -lLLVMJIT
+        * llvm/LLVMAPIFunctions.h: removed LinkInJIT
+
+2014-10-14  peavo@outlook.com  <peavo@outlook.com>
+
+        [Win32] Thunk is not implemented.
+        https://bugs.webkit.org/show_bug.cgi?id=137691
+
+        Reviewed by Mark Lam.
+
+        Thunks for functions with double operands (floor, etc.) are not implemented on Win32.
+
+        * jit/ThunkGenerators.cpp:
+
+2014-10-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Adding svn:ignore so that .pyc files don't show up as new.
+
+        * inspector/scripts/codegen: Added property svn:ignore.
+
+2014-10-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r174606.
+        https://bugs.webkit.org/show_bug.cgi?id=137621
+
+        broke a JSC test (Requested by estes on #webkit).
+
+        Reverted changeset:
+
+        "Various arguments optimisations in codegen fail to account
+        for arguments being in lexical record"
+        https://bugs.webkit.org/show_bug.cgi?id=137617
+        http://trac.webkit.org/changeset/174606
+
+2014-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Various arguments optimisations in codegen fail to account for arguments being in lexical record
+        https://bugs.webkit.org/show_bug.cgi?id=137617
+
+        Reviewed by Michael Saboff.
+
+        Rework the way we track |arguments| references so that we don't try
+        to use the |arguments| reference on the stack if it's not safe.
+
+        To do this without nuking performance it was necessary to update
+        the parser to track modification of the |arguments| reference
+        itself.
+
+        * bytecode/CodeBlock.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::willResolveToArguments):
+        (JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitEnumeration):
+        (JSC::BytecodeGenerator::uncheckedRegisterForArguments): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::hasSafeLocalArgumentsRegister):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::getArgumentByVal):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::existingArguments):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::modifiesArguments):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        * parser/Parser.h:
+        (JSC::Scope::getCapturedVariables):
+        * parser/ParserModes.h:
+
+2014-10-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused generator code
+        https://bugs.webkit.org/show_bug.cgi?id=137564
+
+        Reviewed by Brian Burg.
+
+        * inspector/scripts/codegen/generate_backend_dispatcher_header.py:
+        (BackendDispatcherHeaderGenerator.generate_output): Deleted.
+        * inspector/scripts/codegen/generate_backend_dispatcher_implementation.py:
+        (BackendDispatcherImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_header.py:
+        (FrontendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_frontend_dispatcher_implementation.py:
+        (FrontendDispatcherImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_protocol_types_header.py:
+        (ProtocolTypesHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_protocol_types_implementation.py:
+        (ProtocolTypesImplementationGenerator.generate_output):
+        inputFilename is now handled by the generic generator base class.
+
+        * inspector/scripts/codegen/models.py:
+        (Framework.fromString):
+        (Frameworks):
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        The WTF framework is unused. Remove unexpected frameworks.
+
+2014-10-09  Dean Jackson  <dino@apple.com>
+
+        Remove ENABLE_CSS3_CONDITIONAL_RULES
+        https://bugs.webkit.org/show_bug.cgi?id=137571
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2014-10-09  Adrien Destugues  <pulkomandy@gmail.com>
+
+        Fix compiler warning on noreturn function
+        https://bugs.webkit.org/show_bug.cgi?id=137558
+
+        Reviewed by Darin Adler.
+
+        The function is marked "noreturn", but the stub implementation does
+        return. No new tests: function is never called. Only fixes a warning.
+
+        * heap/HeapStatistics.cpp:
+        (JSC::HeapStatistics::exitWithFailure):
+
+2014-10-09  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Ensure that inline assembly Thunk functions don't conflict with the section designations of the compiler
+        https://bugs.webkit.org/show_bug.cgi?id=137434
+
+        Reviewed by Michael Saboff.
+
+        The ARM64 version of the defineUnaryDoubleOpWrapper macro in
+        ThunkGenerators.cpp contains inline assembly with .text assembler
+        directive followed by a static variable declaration. This macro gets
+        expanded several times afterwards, however, only during the compilation
+        of the first expansion does gcc insert a .data assembler directive
+        before the assembled version of the static variable. Thus, only the
+        first variable gets allocated in the .data section, all the others
+        remain in .text. If JavaScriptCore is built as a shared library then
+        this causes a segmentation fault during dynamic linking.
+
+        This patch puts a .previous directive at the end of the inline assembly
+        to ensure that the assumptions of the compiler about the sections are
+        not broken and the following variable goes to the right place.
+
+        * jit/ThunkGenerators.cpp:
+
+2014-10-08  Oliver Hunt  <oliver@apple.com>
+
+        Make sure arguments tearoff is performed through the environment record if necessary
+        https://bugs.webkit.org/show_bug.cgi?id=137538
+
+        Reviewed by Michael Saboff.
+
+        Fairly simple change.  If we have a lexical record we need to pull the unmodified
+        arguments object from the record and then use the standard op_tear_off_arguments
+        instruction on the temporary.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetOwnScope):
+        (JSC::BytecodeGenerator::emitReturn):
+        * bytecompiler/BytecodeGenerator.h:
+
+2014-10-08  peavo@outlook.com  <peavo@outlook.com>
+
+        [WinCairo] Enable JIT on 32-bit.
+        https://bugs.webkit.org/show_bug.cgi?id=137521
+
+        Reviewed by Mark Lam.
+
+        Enable JIT on Windows 32-bit, but disable it at runtime if SSE2 is not present.
+
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.pl:
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2014-10-08  Brent Fulgham  <bfulgham@apple.com>
+
+        [Win] Resolve some static analysis warnings in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=137508
+
+        Reviewed by Geoffrey Garen.
+
+        * API/tests/testapi.c:
+        (assertEqualsAsCharactersPtr): MSVC insists on using %Iu as its format specifier
+        for size_t. Make the format string conditional on Windows.
+        * bytecode/Watchpoint.h:
+        (JSC::InlineWatchpointSet::encodeState): Silence warning about left-shifting 'state'
+        as a 32-bit value before OR-ing it with a 64-bit value.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Silence warning about operator prescedence
+        causing the || operation to take place before the >= test.
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock): Ditto (|| before !=)
+        * testRegExp.cpp:
+        (testOneRegExp): Ditto %Iu format specifier.
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext): Silence warning about
+        using a 32-bit value as part of a 64-bit calculation.
+
+2014-10-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Roll-over Changelogs.
+
+        * ChangeLog-2014-10-07: Copied from Source/JavaScriptCore/ChangeLog.
+
+== Rolled over to ChangeLog-2014-10-07 ==
diff --git a/ChangeLog-2016-09-26 b/ChangeLog-2016-09-26
new file mode 100644
index 0000000..aeb7523
--- /dev/null
+++ b/ChangeLog-2016-09-26
@@ -0,0 +1,72058 @@
+2016-09-24  Chris Dumez  <cdumez@apple.com>
+
+        REGRESSION (r206221): [USER] com.apple.WebKit.WebContent.Development at com.apple.JavaScriptCore: vmEntryToJavaScript + 299
+        https://bugs.webkit.org/show_bug.cgi?id=162536
+        <rdar://problem/28415971>
+
+        Reviewed by Gavin Barraclough.
+
+        Drop API on PropertySlot for setting a cacheable custom getter/setter
+        given that this is not supported yet and will lead to crashes if used.
+
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::isCacheableCustom):
+        (JSC::PropertySlot::isCacheableCustomAccessor): Deleted.
+        (JSC::PropertySlot::setCacheableCustomGetterSetter): Deleted.
+
+2016-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Need a store-load fence between setting cell state and visiting the object in SlotVisitor
+        https://bugs.webkit.org/show_bug.cgi?id=162354
+
+        Reviewed by Mark Lam.
+        
+        This was meant to be a small change, but then it became bigger as I found small
+        opportunities for improving this code. This adds a store-load fence and is performance-
+        neutral. That's probably partly due to other optimizations that I did to visitChildren().
+        
+        Initially, I found that adding an mfence as a store-load fence was terribly expensive. So,
+        I thought that I needed to buffer up a bunch of objects, set their states, do one mfence,
+        and then visit all of them. This seemed like a win, so I went with it. Unfortunately, this
+        made no sense for two reasons:
+        
+        - I shouldn't use mfence. I should use ortop (lock orl $0, (%rsp)) instead. Ortop is
+          basically free, and it's what WTF now uses for storeLoadFence().
+        
+        - My data saying that buffering up objects was not a slow-down was wrong. That was actually
+          almost as expensive as the mfence.
+        
+        But in order to implement that, I made some other improvements that I think we should stick
+        with:
+        
+        - SlotVisitor::visitChildren() now uses a switch on type. This replaces what used to be
+          some nasty ClassInfo look-ups.
+        
+        - We no longer save the object's old CellState. We would do that so that we would know what
+          state the object had been before we blackened it. But I believe that the more logical
+          solution is to have two kinds of black - one for black-for-the-first-time objects and one
+          for repeat offenders. This is a lot easier to reason about, since you can now just figure
+          this out by looking at the cell directly.
+        
+        The latter change meant rewiring a bunch of barriers. It didn't make them any more
+        expensive.
+        
+        Relanding after fixing a nasty build failure in cloop and elsewhere.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isARMv7IDIVSupported): Deleted.
+        (JSC::isARM64): Deleted.
+        (JSC::isX86): Deleted.
+        (JSC::isX86_64): Deleted.
+        (JSC::optimizeForARMv7IDIVSupported): Deleted.
+        (JSC::optimizeForARM64): Deleted.
+        (JSC::optimizeForX86): Deleted.
+        (JSC::optimizeForX86_64): Deleted.
+        * assembler/CPU.h: Added.
+        (JSC::isARMv7IDIVSupported):
+        (JSC::isARM64):
+        (JSC::isX86):
+        (JSC::isX86_64):
+        (JSC::optimizeForARMv7IDIVSupported):
+        (JSC::optimizeForARM64):
+        (JSC::optimizeForX86):
+        (JSC::optimizeForX86_64):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
+        * heap/CellState.h:
+        (JSC::isBlack):
+        (JSC::blacken):
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::writeBarrier):
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::reportExternalMemoryVisited):
+        * heap/MarkStack.cpp:
+        * heap/MarkStack.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::visitChildren):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExtraMemoryVisited):
+        (JSC::SlotVisitor::reportExternalMemoryVisited):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::jumpIfIsRememberedOrInEden):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSObject.h:
+        (JSC::isJSFinalObject):
+
+2016-09-23  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] Implement parsing of Async Functions
+        https://bugs.webkit.org/show_bug.cgi?id=161409
+
+        Reviewed by Yusuke Suzuki.
+
+        Introduces frontend parsing for the async function proposal soon to be
+        ratified in ECMA262 (https://tc39.github.io/ecmascript-asyncawait/).
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * Configurations/FeatureDefines.xcconfig:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutable):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::CacheKey::CacheKey):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::scriptMode):
+        (JSC::ExecutableInfo::commentMode): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::scriptMode):
+        (JSC::UnlinkedCodeBlock::commentMode): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewMethodDefinition):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::scriptMode):
+        (JSC::BytecodeGenerator::makeFunction):
+        (JSC::BytecodeGenerator::commentMode): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AwaitExprNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAwait):
+        (JSC::ASTBuilder::createAsyncFunctionBody):
+        * parser/Keywords.table:
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        * parser/NodeConstructors.h:
+        (JSC::AwaitExprNode::AwaitExprNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        (JSC::Parser<LexerType>::parseAsyncFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionDeclarationStatement):
+        (JSC::Parser<LexerType>::maybeParseAsyncFunctionDeclarationStatement):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseAsyncFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
+        (JSC::Parser<LexerType>::parseImportClauseItem):
+        (JSC::Parser<LexerType>::parseImportDeclaration):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseProperty): Deleted.
+        (JSC::Parser<LexerType>::parsePropertyMethod): Deleted.
+        (JSC::Parser<LexerType>::parsePrimaryExpression): Deleted.
+        (JSC::Parser<LexerType>::parseMemberExpression): Deleted.
+        (JSC::Parser<LexerType>::parseArrowFunctionExpression): Deleted.
+        (JSC::Parser<LexerType>::parseUnaryExpression): Deleted.
+        (JSC::Parser<LexerType>::printUnexpectedTokenText): Deleted.
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::setSourceParseMode):
+        (JSC::Scope::isAsyncFunction):
+        (JSC::Scope::isAsyncFunctionBoundary):
+        (JSC::Scope::setIsAsyncArrowFunction):
+        (JSC::Scope::setIsAsyncFunction):
+        (JSC::Scope::setIsAsyncFunctionBody):
+        (JSC::Scope::setIsAsyncArrowFunctionBody):
+        (JSC::Parser::ExpressionErrorClassifier::forceClassifyExpressionError):
+        (JSC::Parser::ExpressionErrorClassifier::propagateExpressionErrorClass):
+        (JSC::Parser::ExpressionErrorClassifier::indicatesPossibleAsyncArrowFunction):
+        (JSC::Parser::forceClassifyExpressionError):
+        (JSC::Parser::declarationTypeToVariableKind):
+        (JSC::Parser::upperScope):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::matchSpecIdentifier):
+        (JSC::Parser::isDisallowedIdentifierAwait):
+        (JSC::Parser::disallowedIdentifierAwaitReason):
+        (JSC::parse):
+        (JSC::Scope::isGeneratorBoundary): Deleted.
+        (JSC::Parser::ExpressionErrorClassifier::indicatesPossiblePattern): Deleted.
+        * parser/ParserModes.h:
+        (JSC::SourceParseModeSet::SourceParseModeSet):
+        (JSC::SourceParseModeSet::contains):
+        (JSC::SourceParseModeSet::mergeSourceParseModes):
+        (JSC::isFunctionParseMode):
+        (JSC::isAsyncFunctionParseMode):
+        (JSC::isAsyncArrowFunctionParseMode):
+        (JSC::isAsyncFunctionWrapperParseMode):
+        (JSC::isAsyncFunctionBodyParseMode):
+        (JSC::isMethodParseMode):
+        (JSC::isModuleParseMode):
+        (JSC::isProgramParseMode):
+        (JSC::constructAbilityForParseMode):
+        * parser/ParserTokens.h:
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeFlags::SourceCodeFlags):
+        (JSC::SourceCodeKey::SourceCodeKey):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createAwait):
+        (JSC::SyntaxChecker::createAsyncFunctionBody):
+        (JSC::SyntaxChecker::createYield): Deleted.
+        (JSC::SyntaxChecker::createFunctionExpr): Deleted.
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::checkModuleSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/Executable.h:
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+
+2016-09-23  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r206314, r206316, and r206319.
+        https://bugs.webkit.org/show_bug.cgi?id=162506
+
+        These changes broke various builds (Requested by ryanhaddad on
+        #webkit).
+
+        Reverted changesets:
+
+        "Need a store-load fence between setting cell state and
+        visiting the object in SlotVisitor"
+        https://bugs.webkit.org/show_bug.cgi?id=162354
+        http://trac.webkit.org/changeset/206314
+
+        "Unreviewed, fix cloop."
+        http://trac.webkit.org/changeset/206316
+
+        "Unreviewed, fix all other builds."
+        http://trac.webkit.org/changeset/206319
+
+2016-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix all other builds.
+
+        * assembler/AbstractMacroAssembler.h:
+
+2016-09-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop.
+
+        * assembler/AbstractMacroAssembler.h:
+        * heap/SlotVisitor.cpp:
+
+2016-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Need a store-load fence between setting cell state and visiting the object in SlotVisitor
+        https://bugs.webkit.org/show_bug.cgi?id=162354
+
+        Reviewed by Mark Lam.
+        
+        This was meant to be a small change, but then it became bigger as I found small
+        opportunities for improving this code. This adds a store-load fence and is performance-
+        neutral. That's probably partly due to other optimizations that I did to visitChildren().
+        
+        Initially, I found that adding an mfence as a store-load fence was terribly expensive. So,
+        I thought that I needed to buffer up a bunch of objects, set their states, do one mfence,
+        and then visit all of them. This seemed like a win, so I went with it. Unfortunately, this
+        made no sense for two reasons:
+        
+        - I shouldn't use mfence. I should use ortop (lock orl $0, (%rsp)) instead. Ortop is
+          basically free, and it's what WTF now uses for storeLoadFence().
+        
+        - My data saying that buffering up objects was not a slow-down was wrong. That was actually
+          almost as expensive as the mfence.
+        
+        But in order to implement that, I made some other improvements that I think we should stick
+        with:
+        
+        - SlotVisitor::visitChildren() now uses a switch on type. This replaces what used to be
+          some nasty ClassInfo look-ups.
+        
+        - We no longer save the object's old CellState. We would do that so that we would know what
+          state the object had been before we blackened it. But I believe that the more logical
+          solution is to have two kinds of black - one for black-for-the-first-time objects and one
+          for repeat offenders. This is a lot easier to reason about, since you can now just figure
+          this out by looking at the cell directly.
+        
+        The latter change meant rewiring a bunch of barriers. It didn't make them any more
+        expensive.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
+        * heap/CellState.h:
+        (JSC::blacken):
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::writeBarrier):
+        (JSC::Heap::reportExtraMemoryVisited):
+        (JSC::Heap::reportExternalMemoryVisited):
+        * heap/MarkStack.cpp:
+        * heap/MarkStack.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::visitChildren):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExtraMemoryVisited):
+        (JSC::SlotVisitor::reportExternalMemoryVisited):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::jumpIfIsRememberedOrInEden):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSObject.h:
+        (JSC::isJSFinalObject):
+
+2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
+
+        ARM EABI buildfix after r206289
+        https://bugs.webkit.org/show_bug.cgi?id=162486
+
+        Unreviewed buildfix.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2016-09-23  Antoine Quint  <graouts@apple.com>
+
+        Add a new runtime flag for work on modern media controls (off by default)
+        https://bugs.webkit.org/show_bug.cgi?id=162420
+        <rdar://problem/27989489>
+
+        Reviewed by Eric Carlson.
+
+        * runtime/CommonIdentifiers.h:
+
+2016-09-23  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(r194387): Crash on github.com in IntlDateTimeFormat::resolvedOptions in C locale
+        https://bugs.webkit.org/show_bug.cgi?id=162139
+
+        Reviewed by Michael Catanzaro.
+
+        The crash happens in unix ports because the resolved locale is empty when system locale is "C". IntlObject
+        considers any language tag with a size < 2 to be an invalid language, so "C" is not a valid language to resolve
+        the locale. We should ensure that WTF::platformUserPreferredLanguages() never returns invalid languages, but
+        that's not enough, because languages can be overriden from the public API, so we need to handle those cases and
+        throw exceptions instead of crashing.
+
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::initializeCollator): Throw a exception when we fail to resolve the locale.
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat): Ditto.
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::initializeNumberFormat): Ditto.
+
+2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Use an inline cache to generate op_negate
+        https://bugs.webkit.org/show_bug.cgi?id=162371
+
+        Reviewed by Saam Barati.
+
+        Use an inline cache to reduce the amount of code
+        required to implement op_negate.
+
+        For pure integer negate, the generated asm shrinks
+        from 147 bytes to 125 bytes (14%).
+        For double negate, the generated asm shrinks
+        to 130 bytes (11%).
+        The average size on Sunspider is 100bytes, this is due
+        to the op_negates that are never executed and do not
+        generate much.
+
+        * bytecode/ArithProfile.h:
+        (JSC::ArithProfile::ArithProfile):
+        (JSC::ArithProfile::observeLHS):
+        (JSC::ArithProfile::observeLHSAndRHS):
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::addJITNegIC):
+        * bytecode/CodeBlock.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::UnaryOpNode::emitBytecode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMathIC):
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMathIC):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emitMathICFast):
+        (JSC::JIT::emitMathICSlow):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITMathIC.h:
+        (JSC::JITMathIC::generateInline):
+        (JSC::canGenerateWithBinaryProfile):
+        (JSC::canGenerateWithUnaryProfile):
+        * jit/JITMathICForwards.h:
+        * jit/JITNegGenerator.cpp:
+        (JSC::JITNegGenerator::generateInline):
+        (JSC::JITNegGenerator::generateFastPath):
+        * jit/JITNegGenerator.h:
+        (JSC::JITNegGenerator::JITNegGenerator):
+        (JSC::JITNegGenerator::arithProfile):
+        (JSC::JITNegGenerator::didEmitFastPath): Deleted.
+        (JSC::JITNegGenerator::endJumpList): Deleted.
+        (JSC::JITNegGenerator::slowPathJumpList): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::updateArithProfileForUnaryArithOp):
+        (JSC::SLOW_PATH_DECL):
+
+2016-09-22  Mark Lam  <mark.lam@apple.com>
+
+        Removed unused hasErrorInfo().
+        https://bugs.webkit.org/show_bug.cgi?id=162473
+
+        Reviewed by Saam Barati.
+
+        * JavaScriptCore.order:
+        * runtime/Error.cpp:
+        (JSC::hasErrorInfo): Deleted.
+        * runtime/Error.h:
+
+2016-09-22  Mark Lam  <mark.lam@apple.com>
+
+        Array.prototype.join should do overflow checks on string joins.
+        https://bugs.webkit.org/show_bug.cgi?id=162459
+
+        Reviewed by Saam Barati.
+
+        Change the 2 JSRopeString::create() functions that do joins to be private, and
+        force all clients of it to go through the jsString() utility functions that do
+        overflow checks before creating the ropes.
+
+        * dfg/DFGOperations.cpp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::slowJoin):
+        * runtime/JSString.h:
+        * runtime/Operations.h:
+        (JSC::jsString):
+
+2016-09-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Fences on x86 should be a lot cheaper
+        https://bugs.webkit.org/show_bug.cgi?id=162417
+
+        Reviewed by Mark Lam and Geoffrey Garen.
+
+        It turns out that:
+        
+            lock; orl $0, (%rsp)
+        
+        does everything that we wanted from:
+        
+            mfence
+        
+        And it's a lot faster. When I tried mfence for making object visiting concurrent-GC-TSO-
+        friendly, it was a 9% regression on Octane/splay. But when I tried ortop, it was neutral.
+        So, we should use ortop from now on.
+        
+        This part of the change is for the JITs. MacroAssembler::memoryFence() appears to always
+        mean something like an acqrel fence, so it's safe to make this use ortop. Since B3's Fence
+        compiles to Air MemoryFence, which is just MacroAssembler::memoryFence(), this also changes
+        B3 codegen.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::memoryFence):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::lock):
+        * b3/testb3.cpp:
+        (JSC::B3::testX86MFence):
+        (JSC::B3::testX86CompilerFence):
+
+2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: Function length should be number of parameters before parameters with default values
+        https://bugs.webkit.org/show_bug.cgi?id=162377
+
+        Reviewed by Saam Barati.
+
+        https://tc39.github.io/ecma262/#sec-function-definitions-static-semantics-expectedargumentcount
+
+        > NOTE: The ExpectedArgumentCount of a FormalParameterList is the number of
+        > FormalParameters to the left of either the rest parameter or the first
+        > FormalParameter with an Initializer. A FormalParameter without an
+        > initializer is allowed after the first parameter with an initializer
+        > but such parameters are considered to be optional with undefined as
+        > their default value.
+
+        Alongside the parameterCount value, maintain a separate count,
+        functionLength, which will be the count before seeing a rest parameter
+        or parameter with a default value. This will be the function's length.
+
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionMetadata):
+        * parser/Nodes.cpp:
+        (JSC::FunctionMetadataNode::FunctionMetadataNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        * parser/ParserFunctionInfo.h:
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        * runtime/Executable.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::createBuiltinFunction):
+        (JSC::JSFunction::reifyLength):
+
+2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove a bunch of unnecessary includes
+        https://bugs.webkit.org/show_bug.cgi?id=162376
+
+        Reviewed by Mark Lam.
+
+2016-09-21  Keith Miller  <keith_miller@apple.com>
+
+        Fix build for future versions of Clang.
+        https://bugs.webkit.org/show_bug.cgi?id=162346
+
+        Reviewed by Filip Pizlo.
+
+        This fixes issues with the WebCore build where inline
+        template-class function definitions are marked as exported. This
+        genereates a weak external symobl that our build does not like.
+
+
+        * runtime/VM.h:
+        (JSC::VM::setGlobalConstRedeclarationShouldThrow):
+
+2016-09-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Inline function only used in one place
+        https://bugs.webkit.org/show_bug.cgi?id=162363
+
+        Reviewed by Saam Barati.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        * parser/Nodes.h:
+        No need for the extra function, it adds no clarification.
+
+2016-09-21  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r206222 and r206227.
+        https://bugs.webkit.org/show_bug.cgi?id=162361
+
+        "broke the windows build" (Requested by keith_mi_ on #webkit).
+
+        Reverted changesets:
+
+        "Fix build for future versions of Clang."
+        https://bugs.webkit.org/show_bug.cgi?id=162346
+        http://trac.webkit.org/changeset/206222
+
+        "Attempt to fix windows build after r206222."
+        http://trac.webkit.org/changeset/206227
+
+2016-09-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a Fence opcode to B3
+        https://bugs.webkit.org/show_bug.cgi?id=162343
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds the most basic fence support to B3. Currently, this is optimal on x86 and correct
+        on ARM. It also happens to be sufficient and optimal for what we'll do in the concurrent GC.
+        
+        The idea of Fence is that it can represent any standalone fence instruction by having two
+        additional params: a read range and a write range. If the write range is empty, this is
+        taken to be a store-store fence, which turns into zero code on x86 and a cheaper fence on
+        ARM.
+        
+        It turns out that this is powerful enough to express store-load and store-store fences. For
+        load-store and load-load fences, you wouldn't have wanted to use any code on x86 and you
+        wouldn't have wanted a standalone barrier on ARM. For those cases, you'd want either a
+        fenced load (load acquire) or a dependency. See bug 162349 and bug 162350, respectively.
+        
+        This isn't yet optimized for store-store fences on ARM because we don't have the
+        MacroAssembler support. Also, the support for "dmb ish" is not really what we want (it seems
+        to use a heavier fence). I don't think that this is urgent because of how the concurrent GC
+        will use this facility. I've left that to bug 162342.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerCodeRef.cpp:
+        (JSC::MacroAssemblerCodeRef::tryToDisassemble):
+        (JSC::MacroAssemblerCodeRef::disassembly):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodeRef::size): Deleted.
+        (JSC::MacroAssemblerCodeRef::tryToDisassemble): Deleted.
+        * b3/B3Compilation.h:
+        (JSC::B3::Compilation::codeRef):
+        (JSC::B3::Compilation::disassembly):
+        (JSC::B3::Compilation::code): Deleted.
+        * b3/B3Effects.h:
+        * b3/B3FenceValue.cpp: Added.
+        (JSC::B3::FenceValue::~FenceValue):
+        (JSC::B3::FenceValue::cloneImpl):
+        (JSC::B3::FenceValue::FenceValue):
+        * b3/B3FenceValue.h: Added.
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::checkUsesInstruction):
+        (JSC::B3::checkDoesNotUseInstruction):
+        (JSC::B3::testX86MFence):
+        (JSC::B3::testX86CompilerFence):
+        (JSC::B3::run):
+
+2016-09-21  Keith Miller  <keith_miller@apple.com>
+
+        Fix build for future versions of Clang.
+        https://bugs.webkit.org/show_bug.cgi?id=162346
+
+        Reviewed by Filip Pizlo.
+
+        This fixes issues with the WebCore build where inline
+        template-class function definitions are marked as exported. This
+        genereates a weak external symobl that our build does not like.
+
+
+        * runtime/VM.h:
+        (JSC::VM::setGlobalConstRedeclarationShouldThrow):
+
+2016-09-21  Chris Dumez  <cdumez@apple.com>
+
+        Object.getOwnPropertyDescriptor() does not work correctly cross origin
+        https://bugs.webkit.org/show_bug.cgi?id=162311
+
+        Reviewed by Gavin Barraclough.
+
+        Add a CustomGetterSetter field to PropertySlot that gets populated
+        by getOwnPropertySlot() and use it in getOwnPropertyDescriptor()
+        to properly populate the descriptor. We used to rely on reifying
+        the properties and then call getDirect() in order to get the
+        CustomGetterSetter. However, this hack was insufficient to support
+        the cross-origin case because we need to control more precisely
+        the visibility of the getter and the setter. For example, Location's
+        href property has both a getter and a setter in the same origin
+        case but only has a setter in the cross-origin case.
+
+        In the future, we can extend the use of PropertySlot's
+        customGetterSetter field to the same origin case and get rid of the
+        reification + getDirect() hack in getOwnPropertyDescriptor().
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::customAccessorGetter):
+        * runtime/PropertySlot.h:
+
+2016-09-21  Michael Saboff  <msaboff@apple.com>
+
+        FTL needs to reserve callee stack space in bytes
+        https://bugs.webkit.org/show_bug.cgi?id=162324
+
+        Reviewed by Geoffrey Garen.
+
+        Changed two instances where we call B3::Procedure::requestCallArgAreaSize() with the
+        number of JSValue sized objects of stack space instead of bytes.  The correct units
+        to use is bytes.
+
+        Renamed both the Air and B3 related callArgAreaSize() to callArgAreaSizeInBytes().
+
+        No new tests as this doesn't surface as an issue when arguments are passed on the stack.
+
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::callArgAreaSizeInBytes):
+        (JSC::B3::Procedure::requestCallArgAreaSizeInBytes):
+        (JSC::B3::Procedure::callArgAreaSize): Deleted.
+        (JSC::B3::Procedure::requestCallArgAreaSize): Deleted.
+        * b3/B3Procedure.h:
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirCCallingConvention.cpp:
+        (JSC::B3::Air::computeCCallingConvention):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::callArgAreaSizeInBytes):
+        (JSC::B3::Air::Code::requestCallArgAreaSizeInBytes):
+        (JSC::B3::Air::Code::callArgAreaSize): Deleted.
+        (JSC::B3::Air::Code::requestCallArgAreaSize): Deleted.
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
+
+2016-09-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Unreviewed buildfix after r206136.
+
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchPtr): Added.
+
+2016-09-20  Alex Christensen  <achristensen@webkit.org>
+
+        Require WTFMove for String::adopt
+        https://bugs.webkit.org/show_bug.cgi?id=162313
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::build):
+
+2016-09-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(r205692): Minified builds have broken inspector
+        https://bugs.webkit.org/show_bug.cgi?id=162327
+        <rdar://problem/28370137>
+
+        Reviewed by Matt Baker.
+
+        * Scripts/cssmin.py:
+        (cssminify):
+        Converge on the newer cssmin that we mistakenly dropped in r205692.
+        This knows how to handle more cases.
+
+2016-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::StoreBarrierInsertionPhase should assume that any epoch increment may make objects older
+        https://bugs.webkit.org/show_bug.cgi?id=162319
+
+        Reviewed by Saam Barati.
+        
+        The store barrier phase needs to be aware of the fact that an object that is not in the
+        OldBlack state may be concurrently brought into that state. That means that:
+        
+        - We cannot reason about the relative ages of objects. An object is either new, in which
+          case we can store to it without barriers, or it's not in which case it needs a barrier.
+        
+        - After we insert a barrier on an object, the object is no longer new, because now the GC
+          knows about it and the GC may do things to it, like make it OldBlack.
+        
+        This is a perf-neutral change. These optimizations were never particularly profitable.
+
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+
+2016-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename MarkedSpace::version/MarkedBlock::version to MarkedSpace::markingVersion/MarkedBlock::markingVersion
+        https://bugs.webkit.org/show_bug.cgi?id=162310
+
+        Reviewed by Geoffrey Garen.
+        
+        In bug 162309, which is part of my concurrent GC work, I'll need to introduce a second
+        version-based flip. This one will be for newlyAllocated bits. This will allow me to
+        cheaply preserve per-object live state during marking. MarkedBlock::aboutToMarkSlow() will
+        do this instead of clearMarks():
+        
+            - Walk the mark bits, simultaneously counting the number of set bits and clearing
+              them.
+            - If the count is zero, then we're done.
+            - If the count is equal to the max number of cells in the block, then set the
+              allocated bit for the block.
+            - If the count is something else, create a newlyAllocated vector.
+        
+        The hope is that the last mode is going to be rare, since most blocks are not fragmented
+        at end of GC. Usually, we will fill them in with objects by allocating! But if we do
+        create newlyAllocated bits then we need to have some way of blowing them away later.
+        
+        This is where a second version comes in. We can have a version for newlyAllocated bits,
+        which we increment at the end of marking, at around the same time that we clear all
+        allocated bits.
+        
+        This means that the MarkedBlock will have two different version-based flips, so terms like
+        "flip" and "version" aren't enough.
+        
+        This patch gets rid of the term "flip" entirely. It's a term of art in GCs that refers to
+        the state change at the beginning or end of GC. It refers to the logical state change, not
+        the physical one. It doesn't actually make sense to speak of a block being flipped
+        independently of other blocks. It's true that our implementation of the flip makes some
+        state updates happen lazily, but the block updating itself in some way (like clearing mark
+        bits) isn't the flip - the flip already happened when the version was incremented.
+        
+        We no longer refer to a version without qualifying what kind of version it is. The type is
+        HeapVersion. All of the version members were renamed to markingVersion, to reflect the
+        fact that this version is just used for doing things to marking state. Instead of asking
+        if the block needsFlip(), we ask if areMarksStale().
+        
+        This will let us introduce a second version for newlyAllocated, and will let us speak of
+        the two versions unambiguously.
+
+        * heap/CellContainer.h:
+        * heap/CellContainerInlines.h:
+        (JSC::CellContainer::isMarked):
+        (JSC::CellContainer::isMarkedOrNewlyAllocated):
+        (JSC::CellContainer::aboutToMark):
+        (JSC::CellContainer::areMarksStale):
+        (JSC::CellContainer::needsFlip): Deleted.
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::genericAddSpan):
+        * heap/HeapInlines.h:
+        (JSC::Heap::isMarked):
+        (JSC::Heap::isMarkedConcurrently):
+        (JSC::Heap::testAndSetMarked):
+        * heap/HeapUtil.h:
+        (JSC::HeapUtil::findGCObjectPointersForMarking):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::isPagedOut):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::Handle::specializedSweep):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectSweepMode):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectMarksMode):
+        (JSC::MarkedBlock::aboutToMarkSlow):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::assertMarksNotStale):
+        (JSC::MarkedBlock::areMarksStale):
+        (JSC::MarkedBlock::Handle::areMarksStale):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::markCount):
+        (JSC::MarkedBlock::Handle::isLive):
+        (JSC::MarkedBlock::Handle::isLiveCell):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectFlipMode): Deleted.
+        (JSC::MarkedBlock::assertFlipped): Deleted.
+        (JSC::MarkedBlock::needsFlip): Deleted.
+        (JSC::MarkedBlock::Handle::needsFlip): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::areMarksStale):
+        (JSC::MarkedBlock::aboutToMark):
+        (JSC::MarkedBlock::assertMarksNotStale):
+        (JSC::MarkedBlock::Handle::assertMarksNotStale):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::isMarkedConcurrently):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::needsFlip): Deleted.
+        (JSC::MarkedBlock::assertFlipped): Deleted.
+        (JSC::MarkedBlock::Handle::assertFlipped): Deleted.
+        * heap/MarkedBlockInlines.h:
+        (JSC::MarkedBlock::Handle::isLive):
+        (JSC::MarkedBlock::Handle::isLiveCell):
+        (JSC::MarkedBlock::resetMarkingVersion):
+        (JSC::MarkedBlock::resetVersion): Deleted.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::beginMarking):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::markingVersion):
+        (JSC::MarkedSpace::version): Deleted.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        (JSC::SlotVisitor::markAuxiliary):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::markingVersion):
+        (JSC::SlotVisitor::version): Deleted.
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::specializedVisit):
+        (JSC::WeakBlock::reap):
+
+2016-09-20  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Rebaseline builtins generator tests after r206155.
+
+        Unreviewed test gardening.
+
+        * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:
+
+2016-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop build.
+
+        * runtime/VM.h:
+
+2016-09-20  Filip Pizlo  <fpizlo@apple.com>
+
+        Make MarkedBlock state tracking support overlapped allocation and marking state
+        https://bugs.webkit.org/show_bug.cgi?id=161581
+
+        Reviewed by Geoffrey Garen.
+        
+        Concurrent GCs must allow for mutation and allocation during collection. We already know
+        how to mutate during collection. We have a write barrier for that. Allocation during
+        collection is more involved: the collector modifies the the mark bits, as well as other
+        kinds of MarkedBlock state, in-place during a collection. The allocator uses that same
+        MarkedBlock state to decide which regions of memory are free. This works if the allocator
+        never runs while the collector is running, but if we want to allow them to run at the same
+        time, then we need to have two versions of the state: one version built up by the
+        collector and another consumed by the allocator. We clear the collector state at the
+        beginning of collection, and splat the collector state onto the allocator state after
+        collection.
+        
+        This could be super expensive, but we can make it cheap with some cleverness. The biggest
+        observation is just that most of the state is a handful of bits per block: is the block
+        free-listed? is it completely full? completely empty? in the incremental sweeper's
+        snapshot? is it retired? is it in eden? There is also state inside blocks, like the mark
+        bits, but I have a solid plan there and I'll save it for another patch. Once we view the
+        state of blocks as bits, we can put that state into bitvectors, so that if the collector
+        needs to transform the state of some blocks, it can do it with a single operation over
+        bitvectors. I like to think of this as 32-way parallelizing block operations, since
+        doing one operation on a 32-bit word in one of those bitvectors instantly affects 32
+        blocks.
+        
+        This change converts all previous collections of MarkedBlocks, along with the MarkedBlock
+        state, into 8 bitvectors (live, empty, allocated, canAllocateButNotEmpty, eden, unswept,
+        markingNotEmpty, and markingRetired). The bitvectors separate allocator state (empty,
+        allocated, canAllocateButNotEmpty) from marking state (markingNotEmpty, markingRetired).
+        
+        As a nice side-effect of switching to bitvectors, we get size class rebalancing for free.
+        It used to be that if a MarkedAllocator had an empty block, we would only allow that
+        memory to be reused by a different MarkedAllocator if we did an incremental sweep or a
+        full eager sweep. Now we hunt down all destructorless empty blocks before allocating new
+        MarkedBlocks. It would be relatively easy to also hunt down destructor empty blocks, but
+        the theory is that those might be expensive to sweep, so it might still be better to leave
+        those to the incremental sweeper.
+        
+        This change is perf-neutral all around. I did some tests with two different kinds of
+        allocation strategies - something that is somewhat easier to do now that you can look for
+        blocks that are candidates for allocation by just scanning some bitvectors. I tried two
+        variants:
+        
+        - Allocate out of non-empty blocks first, leaving empty blocks for last in case a
+          different allocator needed them. This is sort of a best-fit strategy. I tried this
+          first, and it can be expressed as:
+          
+          m_allocationCursor = m_canAllocateButNotEmpty.findBit(m_allocationCursor, true)
+        
+        - Allocate out of lower-indexed blocks first, treating empty and canAllocateButNotEmpty
+          blocks equally. This is sort of a first-fit strategy. This is what I ended up settling
+          on, and it can be expressed as:
+          
+          m_allocationCursor = (m_canAllocateButNotEmpty | m_empty).findBit(m_allocationCursor, true)
+        
+        The best-fit strategy meant 1% regressions in LongSpider and Octane overall, and a 11%
+        regression on Octane/earley. First-fit means perf-neutrality. Most great allocators skew
+        towards first-fit because it's empirically better, so this result is not surprising.
+        
+        Overall, the performance of this patch on my machine is as follows, where "neutral" means
+        less than 1% and not statistically significant.
+        
+        run-jsc-benchmarks:
+            SunSpider: neutral
+            LongSpider: 0.6% slower
+            V8Spider: neutral
+            Octane: neutral
+            Kraken: neutral
+            Microbenchmarks: 0.37% slower
+            AsmBench: neutral
+            CompressionBench: maybe 1% faster
+        
+        For browser benchmarks, I report the ratio of means (bigger / smaller) along with a T-test
+        from Mathematica reported as % chance of not [sic] the null hypothesis. Note that we
+        normally consider anything less than 95% confidence to be inconclusive.
+        
+        Browser benchmarks:
+            PLT3: 0.3% faster with 67% confidence
+            membuster:
+                Snap2FinishedLoadingPost: 0.68% more memory with 50% confidence
+                Snap3EndPost: 2.4% more memory with 61% confidence
+            JetStream: 0.2% slower with 32% confidence
+            Speedometer: 0.7% faster with 82% confidence
+        
+        Additionally, Octane/splay's heap capacity goes down to ~180KB from ~200KB, so about a 10%
+        progression. This is due to the allocator rebalancing feature.
+        
+        Finally, this breaks --useImmortalObjects. It was already broken as far as I can tell. I
+        filed a bug to reimplement it (bug 162296). Unless someone urgently needs this internal
+        tool, it's probably best to reimplement it after I'm done refactoring MarkedSpace. 
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        * heap/CellContainer.h:
+        * heap/CellContainerInlines.h:
+        (JSC::CellContainer::vm):
+        (JSC::CellContainer::heap):
+        (JSC::CellContainer::isMarkedOrNewlyAllocated):
+        (JSC::CellContainer::aboutToMark):
+        (JSC::CellContainer::isMarked): Deleted.
+        (JSC::CellContainer::flipIfNecessary): Deleted.
+        * heap/ConservativeRoots.cpp:
+        * heap/Heap.cpp:
+        (JSC::Heap::beginMarking):
+        (JSC::Heap::endMarking):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::snapshotMarkedSpace):
+        (JSC::Heap::prepareForAllocation):
+        (JSC::Heap::zombifyDeadObjects):
+        (JSC::MarkedBlockSnapshotFunctor::MarkedBlockSnapshotFunctor): Deleted.
+        (JSC::MarkedBlockSnapshotFunctor::operator()): Deleted.
+        (JSC::Heap::resetAllocators): Deleted.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::isMarked):
+        (JSC::Heap::isMarkedConcurrently):
+        (JSC::Heap::testAndSetMarked):
+        * heap/HeapStatistics.cpp:
+        * heap/HeapUtil.h:
+        (JSC::HeapUtil::findGCObjectPointersForMarking):
+        (JSC::HeapUtil::isPointerGCObjectJSCell):
+        * heap/HeapVerifier.cpp:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::doSweep):
+        (JSC::IncrementalSweeper::sweepNextBlock):
+        (JSC::IncrementalSweeper::startSweeping):
+        (JSC::IncrementalSweeper::willFinishSweeping):
+        * heap/IncrementalSweeper.h:
+        * heap/LargeAllocation.h:
+        (JSC::LargeAllocation::isMarked):
+        (JSC::LargeAllocation::isMarkedConcurrently):
+        (JSC::LargeAllocation::isMarkedOrNewlyAllocated):
+        (JSC::LargeAllocation::aboutToMark):
+        (JSC::LargeAllocation::isMarkedDuringWeakVisiting): Deleted.
+        (JSC::LargeAllocation::flipIfNecessary): Deleted.
+        (JSC::LargeAllocation::flipIfNecessaryDuringMarking): Deleted.
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::isPagedOut):
+        (JSC::MarkedAllocator::findEmptyBlock):
+        (JSC::MarkedAllocator::tryAllocateWithoutCollectingImpl):
+        (JSC::MarkedAllocator::allocateIn):
+        (JSC::MarkedAllocator::tryAllocateIn):
+        (JSC::MarkedAllocator::allocateSlowCaseImpl):
+        (JSC::MarkedAllocator::tryAllocateBlock):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::stopAllocating):
+        (JSC::MarkedAllocator::prepareForAllocation):
+        (JSC::MarkedAllocator::lastChanceToFinalize):
+        (JSC::MarkedAllocator::resumeAllocating):
+        (JSC::MarkedAllocator::beginMarkingForFullCollection):
+        (JSC::MarkedAllocator::endMarking):
+        (JSC::MarkedAllocator::snapshotForEdenCollection):
+        (JSC::MarkedAllocator::snapshotForFullCollection):
+        (JSC::MarkedAllocator::findBlockToSweep):
+        (JSC::MarkedAllocator::sweep):
+        (JSC::MarkedAllocator::shrink):
+        (JSC::MarkedAllocator::assertSnapshotEmpty):
+        (JSC::MarkedAllocator::dump):
+        (JSC::MarkedAllocator::dumpBits):
+        (JSC::MarkedAllocator::retire): Deleted.
+        (JSC::MarkedAllocator::filterNextBlock): Deleted.
+        (JSC::MarkedAllocator::setNextBlockToSweep): Deleted.
+        (JSC::MarkedAllocator::reset): Deleted.
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::forEachBitVector):
+        (JSC::MarkedAllocator::forEachBitVectorWithName):
+        (JSC::MarkedAllocator::nextAllocator):
+        (JSC::MarkedAllocator::setNextAllocator):
+        (JSC::MarkedAllocator::forEachBlock):
+        (JSC::MarkedAllocator::resumeAllocating): Deleted.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::tryCreate):
+        (JSC::MarkedBlock::Handle::Handle):
+        (JSC::MarkedBlock::Handle::~Handle):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::Handle::specializedSweep):
+        (JSC::MarkedBlock::Handle::sweep):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectScribbleMode):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectEmptyMode):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectHasNewlyAllocated):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectSweepMode):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectFlipMode):
+        (JSC::MarkedBlock::Handle::unsweepWithNoNewlyAllocated):
+        (JSC::MarkedBlock::Handle::setIsFreeListed):
+        (JSC::MarkedBlock::Handle::stopAllocating):
+        (JSC::MarkedBlock::Handle::lastChanceToFinalize):
+        (JSC::MarkedBlock::Handle::resumeAllocating):
+        (JSC::MarkedBlock::aboutToMarkSlow):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::Handle::didConsumeFreeList):
+        (JSC::MarkedBlock::markCount):
+        (JSC::MarkedBlock::Handle::isEmpty):
+        (JSC::MarkedBlock::noteMarkedSlow):
+        (JSC::MarkedBlock::Handle::removeFromAllocator):
+        (JSC::MarkedBlock::Handle::didAddToAllocator):
+        (JSC::MarkedBlock::Handle::didRemoveFromAllocator):
+        (JSC::MarkedBlock::Handle::isLive):
+        (JSC::MarkedBlock::Handle::isLiveCell):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectStateAndSweepMode): Deleted.
+        (JSC::MarkedBlock::flipIfNecessary): Deleted.
+        (JSC::MarkedBlock::Handle::flipIfNecessary): Deleted.
+        (JSC::MarkedBlock::flipIfNecessarySlow): Deleted.
+        (JSC::MarkedBlock::flipIfNecessaryDuringMarkingSlow): Deleted.
+        (JSC::MarkedBlock::Handle::willRemoveBlock): Deleted.
+        (WTF::printInternal): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::Handle::isFreeListed):
+        (JSC::MarkedBlock::Handle::index):
+        (JSC::MarkedBlock::aboutToMark):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::isMarkedConcurrently):
+        (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::Handle::isOnBlocksToSweep): Deleted.
+        (JSC::MarkedBlock::Handle::setIsOnBlocksToSweep): Deleted.
+        (JSC::MarkedBlock::Handle::state): Deleted.
+        (JSC::MarkedBlock::flipIfNecessary): Deleted.
+        (JSC::MarkedBlock::flipIfNecessaryDuringMarking): Deleted.
+        (JSC::MarkedBlock::Handle::flipIfNecessary): Deleted.
+        (JSC::MarkedBlock::Handle::flipIfNecessaryDuringMarking): Deleted.
+        (JSC::MarkedBlock::Handle::flipForEdenCollection): Deleted.
+        (JSC::MarkedBlock::isMarkedDuringWeakVisiting): Deleted.
+        (JSC::MarkedBlock::Handle::isLive): Deleted.
+        (JSC::MarkedBlock::Handle::isLiveCell): Deleted.
+        (JSC::MarkedBlock::Handle::forEachLiveCell): Deleted.
+        (JSC::MarkedBlock::Handle::forEachDeadCell): Deleted.
+        (JSC::MarkedBlock::Handle::needsSweeping): Deleted.
+        (JSC::MarkedBlock::Handle::isAllocated): Deleted.
+        (JSC::MarkedBlock::Handle::isMarked): Deleted.
+        * heap/MarkedBlockInlines.h: Added.
+        (JSC::MarkedBlock::Handle::isLive):
+        (JSC::MarkedBlock::Handle::isLiveCell):
+        (JSC::MarkedBlock::Handle::forEachLiveCell):
+        (JSC::MarkedBlock::Handle::forEachDeadCell):
+        (JSC::MarkedBlock::resetVersion):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::tryAllocate):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::prepareForAllocation):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        (JSC::MarkedSpace::beginMarking):
+        (JSC::MarkedSpace::endMarking):
+        (JSC::MarkedSpace::didAllocateInBlock):
+        (JSC::MarkedSpace::findEmptyBlock):
+        (JSC::MarkedSpace::snapshot):
+        (JSC::MarkedSpace::assertSnapshotEmpty):
+        (JSC::MarkedSpace::dumpBits):
+        (JSC::MarkedSpace::zombifySweep): Deleted.
+        (JSC::MarkedSpace::resetAllocators): Deleted.
+        (JSC::VerifyMarked::operator()): Deleted.
+        (JSC::MarkedSpace::flip): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::nextVersion):
+        (JSC::MarkedSpace::firstAllocator):
+        (JSC::MarkedSpace::allocatorForEmptyAllocation):
+        (JSC::MarkedSpace::forEachAllocator):
+        (JSC::MarkedSpace::blocksWithNewObjects): Deleted.
+        (JSC::MarkedSpace::setIsMarking): Deleted.
+        (JSC::MarkedSpace::forEachLiveCell): Deleted.
+        (JSC::MarkedSpace::forEachDeadCell): Deleted.
+        * heap/MarkedSpaceInlines.h: Added.
+        (JSC::MarkedSpace::forEachLiveCell):
+        (JSC::MarkedSpace::forEachDeadCell):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        (JSC::SlotVisitor::markAuxiliary):
+        (JSC::SlotVisitor::visitChildren):
+        * heap/Weak.h:
+        (WTF::HashTraits<JSC::Weak<T>>::emptyValue):
+        (WTF::HashTraits<JSC::Weak<T>>::peek):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::specializedVisit):
+        (JSC::WeakBlock::reap):
+        * heap/WeakInlines.h:
+        (WTF::HashTraits<JSC::Weak<T>>::emptyValue): Deleted.
+        (WTF::HashTraits<JSC::Weak<T>>::peek): Deleted.
+        * jit/JITThunks.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/PrototypeMap.h:
+        * runtime/SamplingProfiler.cpp:
+        * runtime/WeakGCMap.h:
+        * tools/JSDollarVMPrototype.cpp:
+
+2016-09-20  Jonathan Bedard  <jbedard@apple.com>
+
+        Undefined behavior: Left shift negative number
+        https://bugs.webkit.org/show_bug.cgi?id=161866
+
+        Reviewed by Keith Miller.
+
+        Left shifting a negative number is undefined behavior in C/C++, although most implementations do define it. Explicitly clarifying the intended behavior due to shifting negative number in some cases.
+
+        * dfg/DFGAbstractHeap.h:
+        (JSC::DFG::AbstractHeap::encode): Explicitly cast signed integer for left shift.
+
+2016-09-20  Saam Barati  <sbarati@apple.com>
+
+        Unreviewed fix for 32-bit DFG x86 implementation of HasOwnProperty.
+
+        Fixup phase is always setting ObjectUse on child1() of HasOwnProperty.
+        However, on x86 32-bit, I omitted a call to speculateObject() on child1().
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
+        https://bugs.webkit.org/show_bug.cgi?id=162253
+
+        Reviewed by Sam Weinig.
+
+        Add `typeof value === "symbol"` handling to the bytecode compiler.
+        The effect is tiny, but it keeps consistency since the bytecode compiler
+        already has the similar optimization for "string" case.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromJSType):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+
+2016-09-19  Saam Barati  <sbarati@apple.com>
+
+        Make HasOwnProperty faster
+        https://bugs.webkit.org/show_bug.cgi?id=161708
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds a cache for HasOwnProperty. The cache holds tuples
+        of {StructureID, UniquedStringImpl*, boolean} where the boolean indicates
+        the result of performing hasOwnProperty on an object with StructureID and
+        UniquedStringImpl*. If the cache contains an item, we can be guaranteed
+        that it contains the same result as performing hasOwnProperty on an
+        object O with a given structure and key. To guarantee this, we only add
+        items into the cache when the Structure of the given item is cacheable.
+
+        The caching strategy is simple: when adding new items into the cache,
+        we will evict any item that was in the location that the new item
+        is hashed into. We also clear the cache on every GC. This strategy
+        proves to be successful on speedometer, which sees a cache hit rate
+        over 90%. This caching strategy is now inlined into the DFG/FTL JITs
+        by now recognizing hasOwnProperty as an intrinsic with the corresponding
+        HasOwnProperty node. The goal of the node is to emit inlined code for
+        the cache lookup to prevent the overhead of the call for the common
+        case where we get a cache hit.
+
+        I'm seeing around a 1% to 1.5% percent improvement on Speedometer on
+        my machine. Hopefully the perf bots agree with my machine.
+
+        This patch also speeds up the microbenchmark I added by 2.5x.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileHasOwnProperty):
+        * heap/Heap.cpp:
+        (JSC::Heap::collectImpl):
+        * jit/JITOperations.h:
+        * runtime/HasOwnPropertyCache.h: Added.
+        (JSC::HasOwnPropertyCache::Entry::offsetOfStructureID):
+        (JSC::HasOwnPropertyCache::Entry::offsetOfImpl):
+        (JSC::HasOwnPropertyCache::Entry::offsetOfResult):
+        (JSC::HasOwnPropertyCache::operator delete):
+        (JSC::HasOwnPropertyCache::create):
+        (JSC::HasOwnPropertyCache::hash):
+        (JSC::HasOwnPropertyCache::get):
+        (JSC::HasOwnPropertyCache::tryAdd):
+        (JSC::HasOwnPropertyCache::clear):
+        (JSC::VM::ensureHasOwnPropertyCache):
+        * runtime/Intrinsic.h:
+        * runtime/JSObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::hasOwnProperty):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::finishCreation):
+        (JSC::objectProtoFuncHasOwnProperty):
+        * runtime/Symbol.h:
+        * runtime/VM.cpp:
+        * runtime/VM.h:
+        (JSC::VM::hasOwnPropertyCache):
+
+2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make the rounding-related nodes support any type
+        https://bugs.webkit.org/show_bug.cgi?id=161895
+
+        Reviewed by Geoffrey Garen.
+
+        This patch changes ArithRound, ArithFloor, ArithCeil and ArithTrunc
+        to support polymorphic input without exiting on entry.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        The 4 functions ignore any input past the first argument. It is okay
+        to use the nodes with the first argument and let the Phantoms keep
+        the remaining arguments live.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        Our fixup had the issue we have seen on previous nodes: unaryArithShouldSpeculateInt32()
+        prevents us from picking a good type if we do not see any double.
+
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        Prediction propagation of those nodes are fully determined
+        from their flags and results's prediction. They are moved
+        to the invariant processing.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithRounding):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithTrunc):
+
+2016-09-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, build fix for Win64
+        https://bugs.webkit.org/show_bug.cgi?id=162132
+
+        In Windows 64bit, t3 register in LLInt is not r[a-d]x.
+        It means that this cannot be used for byte operation.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2016-09-19  Daniel Bates  <dabates@apple.com>
+
+        Remove ENABLE(TEXT_AUTOSIZING) automatic text size adjustment code
+        https://bugs.webkit.org/show_bug.cgi?id=162167
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-09-19  Keith Miller  <keith_miller@apple.com>
+
+        Update WASM towards 0xc
+        https://bugs.webkit.org/show_bug.cgi?id=162067
+
+        Reviewed by Geoffrey Garen.
+
+        This patch updates some of the core parts of the WASM frontend to the 0xc standard.
+        First, it changes the section names from strings to bytecodes. It also adds support
+        for inline block signatures. This is a change from the old version that used to have
+        each branch indicate the arity. Finally, this patch updates all the tests and deletes
+        a duplicate test.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * testWASM.cpp:
+        (runWASMTests):
+        * wasm/WASMB3IRGenerator.cpp:
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::FunctionParser):
+        (JSC::WASM::FunctionParser<Context>::parseBlock):
+        (JSC::WASM::FunctionParser<Context>::parseExpression):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASM::ModuleParser::parse):
+        * wasm/WASMSections.cpp: Removed.
+        (JSC::WASM::Sections::lookup): Deleted.
+        * wasm/WASMSections.h:
+        (JSC::WASM::Sections::validateOrder):
+
+2016-09-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Use is_cell_with_type for @isRegExpObject, @isMap, and @isSet
+        https://bugs.webkit.org/show_bug.cgi?id=162142
+
+        Reviewed by Michael Saboff.
+
+        Use is_cell_with_type for @isRegExpObject, @isMap and @isSet.
+        Previously, they were implemented as functions and only @isRegExpObject was handled in the DFG and FTL.
+        The recently added op_is_cell_with_type bytecode and DFG IsCellWithType node allows us to simplify the above checks in all JIT tiers.
+        Changed these checks to bytecode intrinsics using op_is_cell_with_type.
+
+        * builtins/BuiltinNames.h:
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromJSType):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitIsRegExpObject):
+        (JSC::BytecodeGenerator::emitIsMap):
+        (JSC::BytecodeGenerator::emitIsSet):
+        (JSC::BytecodeGenerator::emitIsProxyObject): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_isRegExpObject):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_isMap):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_isSet):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * runtime/ECMAScriptSpecInternalFunctions.cpp:
+        (JSC::esSpecIsRegExpObject): Deleted.
+        * runtime/ECMAScriptSpecInternalFunctions.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/MapPrototype.cpp:
+        (JSC::privateFuncIsMap): Deleted.
+        * runtime/MapPrototype.h:
+        * runtime/SetPrototype.cpp:
+        (JSC::privateFuncIsSet): Deleted.
+        * runtime/SetPrototype.h:
+
+2016-09-19  Brian Burg  <bburg@apple.com>
+
+        Web Replay: teach the replay inputs generator to encode and decode OptionSet<T>
+        https://bugs.webkit.org/show_bug.cgi?id=162107
+
+        Reviewed by Anders Carlsson.
+
+        Add a new type flag OPTION_SET. This means that the type is a typechecked enum class
+        declaration, but it's stored in an OptionSet object and can contain multiple
+        distinct enumeration values like an untyped enum declaration.
+
+        Do some cleanup since the generator now supports three different enumerable types:
+        'enum', 'enum class', and 'OptionSet<T>' where T is an enum class.
+
+        Also clean up some sloppy variable names. Using an 'enum_' prefix is really confusing now.
+
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Type.is_enum_declaration):
+        (Type.is_enum_class_declaration):
+        (Type.is_option_set):
+        (Type):
+        (Type.is_enumerable):
+        When we want all enumerable types, this property includes all three variants.
+
+        (Type.declaration_kind): Forward-declare OptionSet's type parameter as an enum class.
+        (VectorType.is_enum_declaration): Renamed from is_enum().
+        (VectorType.is_enum_class_declaration): Renamed from is_enum_class().
+        (VectorType.is_option_set): Added.
+        (InputsModel.enumerable_types): Added.
+        (InputsModel.parse_type_with_framework):
+        (Generator.generate_header):
+        (Generator.generate_implementation):
+        (Generator.generate_includes):
+        (Generator.generate_type_forward_declarations):
+        (Generator.generate_enumerable_type_trait_declaration):
+        (Generator.generate_enum_trait_declaration): Renamed.
+        (Generator.generate_enum_trait_implementation): Renamed.
+
+        * replay/scripts/CodeGeneratorReplayInputsTemplates.py:
+        Add new templates for OptionSet types. Clean up parameter names and simplify the
+        enumerable type declaration template, which is the same for all enumerable type variants.
+
+        * replay/scripts/tests/expected/fail-on-c-style-enum-no-storage.json-error:
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp:
+        (JSC::EncodingTraits<Test::PlatformEvent::OtherType>::encodeValue):
+        (JSC::EncodingTraits<Test::PlatformEvent::OtherType>::decodeValue):
+        * replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h:
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h:
+        Rebaseline test results.
+
+        * replay/scripts/tests/generate-enum-encoding-helpers.json:
+        Add a new type for OptionSet<PlatformEvent::Modifier> to capture generated encode/decode methods.
+
+2016-09-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC][LLInt] Introduce is_cell_with_type
+        https://bugs.webkit.org/show_bug.cgi?id=162132
+
+        Reviewed by Sam Weinig.
+
+        In this patch, we introduce is_cell_with_type bytecode. This bytecode can unify the following predicates,
+        op_is_string, op_is_jsarray, op_is_proxy_object, and op_is_derived_array!
+        And we now drop DFG node IsString since we can use IsCellWithType instead.
+        This automatically offers optimization to previous IsString node: dropping cell check by using CellUse edge filter.
+
+        Later, we are planning to use this is_cell_with_type to optimize @isRegExpObject, @isSet, and @isMap[1].
+
+        The performance results are neutral.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=162142
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromJSType):
+        * bytecode/SpeculatedType.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitIsCellWithType):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitIsJSArray):
+        (JSC::BytecodeGenerator::emitIsProxyObject):
+        (JSC::BytecodeGenerator::emitIsDerivedArray):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupIsCellWithType):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::speculatedTypeForQuery):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsString): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_cell_with_type):
+        (JSC::JIT::emitIsCellWithType): Deleted.
+        (JSC::JIT::emit_op_is_string): Deleted.
+        (JSC::JIT::emit_op_is_jsarray): Deleted.
+        (JSC::JIT::emit_op_is_proxy_object): Deleted.
+        (JSC::JIT::emit_op_is_derived_array): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_cell_with_type):
+        (JSC::JIT::emitIsCellWithType): Deleted.
+        (JSC::JIT::emit_op_is_string): Deleted.
+        (JSC::JIT::emit_op_is_jsarray): Deleted.
+        (JSC::JIT::emit_op_is_proxy_object): Deleted.
+        (JSC::JIT::emit_op_is_derived_array): Deleted.
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Assert length of LLInt opcodes using isCellWithType is 3
+        https://bugs.webkit.org/show_bug.cgi?id=162134
+
+        Reviewed by Saam Barati.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+
+2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Do not need to use defineProperty to define methods for object literals
+        https://bugs.webkit.org/show_bug.cgi?id=162111
+
+        Reviewed by Saam Barati.
+
+        When we receive the following code,
+
+            var object = { method() { } };
+
+        currently, we use defineProperty to define "method" function for "object".
+        This patch replaces it with the ordinary put_by_id_direct / put_by_val_direct
+        because the following 2 conditions are met.
+
+        1. While methods in classes have special attributes ({configurable: true, writable: true, enumerable: false}),
+           the attributes of methods in object literals is just the same to the other normal properties ({configurable: true, writable: true, enumerable: true}).
+           This means that we can use the usual put_by_id_direct / put_by_val_direct to define method properties for object literals.
+
+        2. Furthermore, all the own properties that can reside in objects created by object literals have {configurable: true}.
+           So there is no need to check conflict by defineProperty. Always overwriting is OK.
+
+                let name = 'method';
+                var object = { get [name]() { }, method() { } };
+                // Latter method wins.
+
+            On the other hand, in class syntax, conflict check is necessary since "prototype" own property is defined as {configurable: false}.
+
+                class Hello { static prototype() { } }  // Should throw error by defineProperty's check.
+
+            This means that conflict check done in defneProperty is not necessary for object literals' properties.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitPutConstantProperty):
+
+2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
+        https://bugs.webkit.org/show_bug.cgi?id=162000
+
+        Reviewed by Filip Pizlo.
+
+        Sampling profiler tells that ES6SampleBench/Basic frequently calls Array.isArray(). This function is introduced in
+        ES5 and it is well-used to distinguish Array from the other objects. Moreover, this function is used in Array.prototype.xxx
+        methods as @isArray. So it's worth optimizing.
+
+        The difference between Array.isArray and @isJSArray is that Array.isArray need to consider about ProxyObject while
+        @isJSArray builtin intrinsic does not. So in this patch, we leverage the existing @isJSArray to implement Array.isArray.
+        Array.isArray is written in builtin JS code using @isJSArray and newly added @isProxyObject(). That allow us to inline
+        Array.isArray() code and the inlined code uses existing DFG nodes well.
+
+        Another problem is RuntimeArray and ArrayPrototype. They inherit JSArray and their JSType is ObjectType. But Array.isArray need
+        to return true for those types. While optimizing type checking in generic way by type display is nice, RuntimeArray and
+        ArrayPrototype are a bit tricky and it is super rare that these functions are passed to Array.isArray(). So instead of introducing
+        type display in this patch, we just introduce a new JSType, DerivedArrayType and use it in the above 2 use classes. Since
+        Array.isArray is specially handled in the spec (while we don't have any Date.isDate() like functions, only Array.isArray
+        is specified in the spec because we frequently want to distinguish Arrays from other Objects), optimizing Array.isArray specially
+        by introducing special DerivedArrayType is reasonable.
+
+        In LLInt level, we add a new opcode, op_is_proxy_object and op_is_derived_array. This works similar to op_is_jsarray.
+        And we also perform LLInt code cleanup by introducing a macro isCellWithType.
+
+        In baseline, we perform some clean up for op_is_proxy_object etc. Now duplicate code is reduced.
+
+        In DFG, we unify IsJSArray, IsRegExpObject, IsProxyObject, and IsDerivedArray into one IsCellWithType node. And we clean up
+        some AI code related to IsJSArray and IsRegExpObject since SpeculatedType now recognizes ProxyObject. IsJSArray and IsRegExpObject
+        does not do anything special for proxy objects.
+
+        The above change simplify things to create a new IsXXX DFG handling and paves the way for optimizing @isMap & @isSet in DFG.
+        Furthermore, introducing @isProxyObject() is nice for the first step to optimize ProxyObject handling.
+
+        Here is microbenchmark result. We can see stable performance improvement (Even if we use Proxies!).
+
+                                                    baseline                  patched
+
+            is-array-for-array                   2.5156+-0.0288     ^      2.0668+-0.0285        ^ definitely 1.2171x faster
+            is-array-for-mixed-case              4.7787+-0.0755     ^      4.4722+-0.0789        ^ definitely 1.0686x faster
+            is-array-for-non-array-object        2.3596+-0.0368     ^      1.8178+-0.0262        ^ definitely 1.2980x faster
+            is-array-for-proxy                   4.0469+-0.0437     ^      3.3845+-0.0404        ^ definitely 1.1957x faster
+
+        And ES6SampleBench/Basic reports 5.2% perf improvement. And now sampling result in ES6SampleBench/Basic does not pose Array.isArray.
+
+            Benchmark             First Iteration        Worst 2%               Steady State
+            baseline:Basic        28.59 ms +- 1.03 ms    15.08 ms +- 0.28 ms    1656.96 ms +- 18.02 ms
+            patched:Basic         27.82 ms +- 0.44 ms    14.59 ms +- 0.16 ms    1574.65 ms +- 8.44 ms
+
+        * builtins/ArrayConstructor.js:
+        (isArray):
+        (from): Deleted.
+        * builtins/BuiltinNames.h:
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationFromClassInfo):
+        (JSC::speculationFromStructure):
+        * bytecode/SpeculatedType.h:
+        (JSC::isProxyObjectSpeculation):
+        (JSC::isDerivedArraySpeculation):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitIsProxyObject):
+        (JSC::BytecodeGenerator::emitIsDerivedArray):
+        (JSC::BytecodeGenerator::emitIsJSArray): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_isProxyObject):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_isDerivedArray):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupIsCellWithType):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasQueriedType):
+        (JSC::DFG::Node::queriedType):
+        (JSC::DFG::Node::hasSpeculatedTypeForQuery):
+        (JSC::DFG::Node::speculatedTypeForQuery):
+        (JSC::DFG::Node::shouldSpeculateProxyObject):
+        (JSC::DFG::Node::shouldSpeculateDerivedArray):
+        (JSC::DFG::Node::loadVarargsData): Deleted.
+        (JSC::DFG::Node::shouldSpeculateArray): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIsCellWithType):
+        (JSC::DFG::SpeculativeJIT::speculateProxyObject):
+        (JSC::DFG::SpeculativeJIT::speculateDerivedArray):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        (JSC::DFG::SpeculativeJIT::compileIsJSArray): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileIsRegExpObject): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsCellWithType):
+        (JSC::FTL::DFG::LowerDFGToB3::speculate):
+        (JSC::FTL::DFG::LowerDFGToB3::isCellWithType):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateProxyObject):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateDerivedArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsRegExpObject): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::isArray): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::isRegExpObject): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitIsCellWithType):
+        (JSC::JIT::emit_op_is_string):
+        (JSC::JIT::emit_op_is_jsarray):
+        (JSC::JIT::emit_op_is_proxy_object):
+        (JSC::JIT::emit_op_is_derived_array):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitIsCellWithType):
+        (JSC::JIT::emit_op_is_string):
+        (JSC::JIT::emit_op_is_jsarray):
+        (JSC::JIT::emit_op_is_proxy_object):
+        (JSC::JIT::emit_op_is_derived_array):
+        * jsc.cpp:
+        (WTF::RuntimeArray::createStructure):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::isArraySlowInline):
+        (JSC::isArraySlow):
+        (JSC::arrayConstructorPrivateFuncIsArraySlow):
+        (JSC::arrayConstructorIsArray): Deleted.
+        * runtime/ArrayConstructor.h:
+        (JSC::isArray):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::finishCreation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSType.h:
+
+2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG] Introduce ArrayUse
+        https://bugs.webkit.org/show_bug.cgi?id=162063
+
+        Reviewed by Keith Miller.
+
+        ArrayUse is particularly useful: for IsJSArray.
+        We can drop IsJSArray in fixup phase by setting ArrayUse edge filter.
+
+        Since @isJSArray user is limited (Array.prototype.concat), the effect of this patch is small.
+        But later, I'll update {@isArray, Array.isArray} to use @isJSArray[1]. In that patch, we are planning
+        to implement more aggressive optimization like, setting CellUse edge filter to avoid cell check in
+        SpeculativeJIT::compileIsJSArray.
+
+        In the benchmark using Array.prototype.concat, we can see perf improvement since we can drop IsJSArray in fixup phase.
+
+                                                     baseline                  patched
+
+            lazy-array-species-watchpoints       25.0911+-0.0516     ^     24.7687+-0.0767        ^ definitely 1.0130x faster
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=162000
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateArray):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::speculate):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateArray):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateObject): Deleted.
+
+2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: Various Constructors length properties should be configurable
+        https://bugs.webkit.org/show_bug.cgi?id=161998
+
+        Reviewed by Saam Barati.
+
+        https://tc39.github.io/ecma262/#sec-ecmascript-standard-built-in-objects
+        Unless otherwise specified, the length property of a built-in Function
+        object has the attributes:
+        { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
+
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::finishCreation):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::finishCreation):
+        * runtime/MapConstructor.cpp:
+        (JSC::MapConstructor::finishCreation):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::ProxyConstructor::finishCreation):
+        * runtime/SetConstructor.cpp:
+        (JSC::SetConstructor::finishCreation):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::WeakMapConstructor::finishCreation):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::WeakSetConstructor::finishCreation):
+
+2016-09-16  Youenn Fablet  <youenn@apple.com>
+
+        Custom promise-returning functions should not throw if callee has not the expected type
+        https://bugs.webkit.org/show_bug.cgi?id=162011
+
+        Reviewed by Sam Weinig.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Making JSPromiseConstructor.h private
+
+2016-09-15  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r205462): Lot of leaks
+        https://bugs.webkit.org/show_bug.cgi?id=161946
+
+        Reviewed by Saam Barati.
+        
+        We were forgetting to delete LargeAllocations on VM exit!
+
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::~MarkedSpace):
+
+2016-09-15  Keith Miller  <keith_miller@apple.com>
+
+
+        Pragma out undefined-var-template warnings in JSC for JSObjects that are templatized
+        https://bugs.webkit.org/show_bug.cgi?id=161985
+
+        Reviewed by Alex Christensen.
+
+        I started a true fix for this in
+        https://bugs.webkit.org/show_bug.cgi?id=161979, however the fix
+        for this issue is not sustainable. Since the scope of this issue
+        is just limited to the static const ClassInfo member it is
+        simpler to just pragma out this warning. This works because
+        COMDAT will, AFAIK, pick the actual specialization.  If, in the
+        future, we want to expose these classes to WebCore we will need to
+        do what we do for JSGenericTypedArrayViews and create a custom
+        info() function with a switch.
+
+        This patch also fixes a bunch of weak external symbols due to one of:
+        1) out of line template member definitions functions not being marked inline.
+        2) inline member functions definitions being marked as exported.
+        3) missing header file includes for forward function declarations.
+
+        * API/JSCallbackObject.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::as):
+        * runtime/HashMapImpl.cpp:
+        (JSC::getHashMapBucketKeyClassInfo):
+        (JSC::getHashMapBucketKeyValueClassInfo):
+        (JSC::getHashMapImplKeyClassInfo):
+        (JSC::getHashMapImplKeyValueClassInfo):
+        * runtime/HashMapImpl.h:
+        (JSC::HashMapBucket::info):
+        (JSC::HashMapImpl::info):
+        * runtime/JSCJSValue.h:
+        (JSC::toUInt32): Deleted.
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble):
+        * runtime/JSGenericTypedArrayViewConstructor.h:
+        * runtime/JSGenericTypedArrayViewPrototype.h:
+        * runtime/MathCommon.h:
+        (JSC::toUInt32):
+        * runtime/TypedArrayAdaptors.h:
+        * runtime/VM.h:
+        (JSC::VM::watchdog):
+        (JSC::VM::heapProfiler):
+        (JSC::VM::samplingProfiler):
+
+2016-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        There is no good reason for WeakBlock to care about newly allocated objects
+        https://bugs.webkit.org/show_bug.cgi?id=162006
+
+        Reviewed by Geoffrey Garen.
+
+        WeakBlock scans itself in two modes:
+
+        visit: if a Weak in the block belongs to an unmarked object, ask the Weak to consider whether
+            it should do things.
+        
+        reap: if a Weak in a block belongs to an unmarked object, delete the Weak.
+
+        Except that "unmarked" has a peculiar meaning: WeakBlock defines it as
+        !markedOrNewlyAllocated. So, a newly allocated object will never be consulted about anything. 
+        That sounds scary until you realize that newlyAllocated must have been cleared before we even
+        got here.
+
+        So, we were paying the price of checking newlyAllocated for no reason. This switches the code
+        to using isMarked(). I don't know why the code previously checked newlyAllocated, but I do
+        trust my reasoning.
+
+        * heap/LargeAllocation.h:
+        (JSC::LargeAllocation::isMarkedDuringWeakVisiting):
+        (JSC::LargeAllocation::isMarkedOrNewlyAllocatedDuringWeakVisiting): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isMarkedDuringWeakVisiting):
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocatedDuringWeakVisiting): Deleted.
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::specializedVisit):
+        (JSC::WeakBlock::reap):
+
+2016-09-15  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r205931.
+        https://bugs.webkit.org/show_bug.cgi?id=162021
+
+        Tests for this change fail on 32-bit JSC bots (Requested by
+        ryanhaddad on #webkit).
+
+        Reverted changeset:
+
+        "[JSC] Make the rounding-related nodes support any type"
+        https://bugs.webkit.org/show_bug.cgi?id=161895
+        http://trac.webkit.org/changeset/205931
+
+2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
+        https://bugs.webkit.org/show_bug.cgi?id=162013
+
+        Reviewed by Saam Barati.
+
+        https://tc39.github.io/ecma262/#sec-function-definitions-static-semantics-early-errors
+        It is a Syntax Error if IsSimpleParameterList of FormalParameterList is
+        false and BoundNames of FormalParameterList contains any duplicate elements.
+
+        Non-simple parameter lists include rest parameters, destructuring,
+        and default parameters.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        Previously, we were not failing if there were default parameters
+        early in the parameter list that were not yet identified as duplicates
+        and simple parameters later were duplicates. Now, we fail if there
+        are default parameters anywhere in the parameter list with a duplicate.
+
+2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
+        https://bugs.webkit.org/show_bug.cgi?id=162003
+
+        Reviewed by Saam Barati.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayNode::isSimpleArray):
+        Don't treat an Array that has a spread expression inside it as simple.
+        This avoids a fast path for f.apply(x, simpleArray) that was not handling
+        spread expressions within arrays, and instead taking a path that can
+        handle the spreading.
+
+2016-09-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r205933 and r205936.
+        https://bugs.webkit.org/show_bug.cgi?id=162002
+
+        broke the build (Requested by keith_miller on #webkit).
+
+        Reverted changesets:
+
+        "Pragma out undefined-var-template warnings in JSC for
+        JSObjects that are templatized"
+        https://bugs.webkit.org/show_bug.cgi?id=161985
+        http://trac.webkit.org/changeset/205933
+
+        "Unreviewed, fix the Windows build."
+        http://trac.webkit.org/changeset/205936
+
+2016-09-14  Chris Dumez  <cdumez@apple.com>
+
+        REGRESSION (r205670): ASSERTION FAILED: methodTable(vm)->toThis(this, exec, NotStrictMode) == this
+        https://bugs.webkit.org/show_bug.cgi?id=161982
+
+        Reviewed by Saam Barati.
+
+        Update JSProxy::setPrototype() to return false unconditionally instead
+        of forwarding the call to its target. We used to forward to the target
+        and then the JSDOMWindow's [[SetPrototypeOf]] would return false.
+        However, the JSC tests use a different GlobalObject and forwarding
+        the setPrototypeOf() call to the GlobalObject lead to hitting an
+        assertion. This patch aligns the behavior of the GlobalObject used by
+        the JSC tests with JSDOMWindow.
+
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setPrototype):
+
+2016-09-14  Michael Saboff  <msaboff@apple.com>
+
+        YARR doesn't check for invalid flags for literal regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=161995
+
+        Reviewed by Mark Lam.
+
+        Added a new error and a check that the flags are valid when we create a
+        literal regular expression.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::finishCreation):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPattern::errorMessage):
+        (JSC::Yarr::YarrPattern::compile):
+        * yarr/YarrPattern.h:
+
+2016-09-14  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, fix the Windows build.
+
+        * runtime/HashMapImpl.cpp:
+
+2016-09-14  Keith Miller  <keith_miller@apple.com>
+
+        Pragma out undefined-var-template warnings in JSC for JSObjects that are templatized
+        https://bugs.webkit.org/show_bug.cgi?id=161985
+
+        Reviewed by Geoffrey Garen.
+
+        I started a true fix for this in
+        https://bugs.webkit.org/show_bug.cgi?id=161979, however the fix
+        for this issue is not sustainable. Since the scope of this issue
+        is just limited to the static const ClassInfo member it is
+        simpler to just pragma out this warning. This works because
+        COMDAT will, AFAIK, pick the actual specialization.  If, in the
+        future, we want to expose these classes to WebCore we will need to
+        do what we do for JSGenericTypedArrayViews and create a custom
+        info() function with a switch.
+
+        This patch also fixes a bunch of weak external symbols due to one of:
+        1) out of line template member definitions functions not being marked inline.
+        2) inline member functions definitions being marked as exported.
+        3) missing header file includes for forward function declarations.
+
+        * API/JSCallbackObject.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::as):
+        * runtime/HashMapImpl.h:
+        * runtime/JSCJSValue.h:
+        (JSC::toUInt32): Deleted.
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndexQuicklyToDouble):
+        * runtime/JSGenericTypedArrayViewConstructor.h:
+        * runtime/JSGenericTypedArrayViewPrototype.h:
+        * runtime/MathCommon.h:
+        (JSC::toUInt32):
+        * runtime/TypedArrayAdaptors.h:
+        * runtime/VM.h:
+        (JSC::VM::watchdog):
+        (JSC::VM::heapProfiler):
+        (JSC::VM::samplingProfiler):
+
+2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: TypedArray constructors length should be 3 and configurable
+        https://bugs.webkit.org/show_bug.cgi?id=161955
+
+        Reviewed by Mark Lam.
+
+        https://tc39.github.io/ecma262/#sec-ecmascript-standard-built-in-objects
+        Unless otherwise specified, the length property of a built-in Function
+        object has the attributes:
+        { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
+
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
+
+2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make the rounding-related nodes support any type
+        https://bugs.webkit.org/show_bug.cgi?id=161895
+
+        Reviewed by Geoffrey Garen.
+
+        This patch changes ArithRound, ArithFloor, ArithCeil and ArithTrunc
+        to support polymorphic input without exiting on entry.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        The 4 functions ignore any input past the first argument. It is okay
+        to use the nodes with the first argument and let the Phantoms keep
+        the remaining arguments live.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        Our fixup had the issue we have seen on previous nodes: unaryArithShouldSpeculateInt32()
+        prevents us from picking a good type if we do not see any double.
+
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        Prediction propagation of those nodes are fully determined
+        from their flags and results's prediction. They are moved
+        to the invariant processing.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithRounding):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithTrunc):
+
+2016-09-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove Heap::setMarked()
+
+        Rubber stamped by Keith Miller.
+        
+        Nobody uses this function.
+
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::setMarked): Deleted.
+        * heap/LargeAllocation.h:
+        (JSC::LargeAllocation::testAndSetMarked):
+        (JSC::LargeAllocation::setMarked): Deleted.
+        * heap/MarkedBlock.h:
+
+2016-09-14  Mark Lam  <mark.lam@apple.com>
+
+        Use Options::validateExceptionChecks() instead of VM::m_verifyExceptionEvents.
+        https://bugs.webkit.org/show_bug.cgi?id=161975
+
+        Reviewed by Keith Miller.
+
+        This makes it less burdensome (no longer needs a rebuild to enable checks) to do
+        incremental work towards enabling checks all the time.
+
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::verifyExceptionCheckNeedIsSatisfied):
+        * runtime/VM.h:
+
+2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        TaggedTemplateString function calls should emit tail position calls
+        https://bugs.webkit.org/show_bug.cgi?id=161948
+
+        Reviewed by Yusuke Suzuki.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TaggedTemplateNode::emitBytecode):
+        The tagged template string function call can be a tail call:
+        https://tc39.github.io/ecma262/#sec-tagged-templates-runtime-semantics-evaluation
+
+2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        test262: Array.prototype.slice should always set length
+        https://bugs.webkit.org/show_bug.cgi?id=161953
+
+        Reviewed by Mark Lam.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+
+2016-09-13  Michael Saboff  <msaboff@apple.com>
+
+        Promises aren't resolved properly when making a ObjC API callback
+        https://bugs.webkit.org/show_bug.cgi?id=161929
+
+        Reviewed by Geoffrey Garen.
+
+        When we go to call out to an Objective C function registered via the API,
+        we first drop all JSC locks to make the call.  As part of dropping the locks,
+        we drain the microtask queue that is used among other things for handling deferred
+        promise resolution.  The DropAllLocks scope class that drops the locks while in
+        scope, resets the current thread's AtomicStringTable to the default table.  This
+        is wrong for two reasons, first it happens before we drain the microtask queue and
+        second it isn't needed as JSLock::willReleaseLock() restores the current thread's
+        AtomicStringTable to the table before the lock was acquired.
+
+        In fact, the manipulation of the current thread's AtomicStringTable is already 
+        properly handled as a stack in JSLock::didAcquireLock() and willReleaseLock().
+        Therefore the manipulation of the AtomicStringTable in DropAllLocks constructor
+        and destructor should be removed.
+
+        * API/tests/testapi.mm:
+        (testObjectiveCAPIMain): Added a new test.
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+
+2016-09-13  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove Heap::isLive()
+        https://bugs.webkit.org/show_bug.cgi?id=161933
+
+        Reviewed by Mark Lam.
+        
+        Before I put any more effort into maintaining this weird function, I decided to check how it
+        was used. It turns out it's not.
+
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::isLive): Deleted.
+
+2016-09-13  Mark Lam  <mark.lam@apple.com>
+
+        DFG NewArrayBuffer node should watch for "have a bad time" state change.
+        https://bugs.webkit.org/show_bug.cgi?id=161927
+        <rdar://problem/27995222>
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2016-09-13  JF Bastien  <jfbastien@apple.com>
+
+        Support jsc shell builtin `read`
+        https://bugs.webkit.org/show_bug.cgi?id=161662
+
+        Reviewed by Keith Miller.
+
+        The jsc shell currently supports a `readFile` method which returns
+        a string. SpiderMonkey's js shell and V8's d8 shell both support
+        similar file-to-string functions, as well as a
+        binary-file-to-Uint8Array function. jsc should support a similar
+        binary file method to simplify testing, including testing of
+        WebAssembly blobs.
+
+        Emscripten's shell.js (which is also used for some WebAssembly
+        things) has a polyfill [1] for a builtin called `read`. jsc should
+        therefore have a builtin with the same name if we want things to
+        "Just Work".
+
+          [1]: https://github.com/kripken/emscripten/blob/5f0918409a1407dd168f57cfa34b109cd1770a8a/src/shell.js#L138
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation): add `read`, make `readFile` take up to 2 arguments.
+        (functionReadFile): support binary files, as per SpiderMonkey.
+        * runtime/Error.h:
+        (JSC::throwVMError): convenience function, I'll add more uses in a follow-up
+        * runtime/JSTypedArrays.cpp:
+        (JSC::createUint8TypedArray): JS private export of JSUint8Array::create.
+        * runtime/JSTypedArrays.h: expose private export.
+
+2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        ES6: Classes: Should be allowed to create a static method with name "arguments"
+        https://bugs.webkit.org/show_bug.cgi?id=152985
+
+        Reviewed by Keith Miller.
+
+        Current patch covered 16.2 Forbidden Extensions - first topic 
+        (https://tc39.github.io/ecma262/#sec-forbidden-extensions) ECMAScript Functions 
+        should not have own properties named "caller" or "arguments".
+        Also added possibility to declare static methods and getters with 
+        name 'arguments' and 'caller' for classes. i.e.:
+        class A { static arguments() { return 'value'; } }
+        A.arguments() === 'value';
+        To implement this patch 'caller' and 'arguments' were put to the FunctionPrototype
+        object. Also was changed approach to init throwTypeErrorArgumentsCalleeAndCallerGetterSetter
+        property from Lazy to common because it necessary to use execState during init of the accessors 
+        properties.
+
+        * runtime/Executable.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::initRestrictedProperties):
+        (JSC::FunctionPrototype::addFunctionProperties): Deleted.
+        * runtime/FunctionPrototype.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsCalleeAndCallerGetterSetter):
+
+2016-09-12  Filip Pizlo  <fpizlo@apple.com>
+
+        MarkedBlock should be able to use flipIfNecessary() as the "I'm not empty" trigger
+        https://bugs.webkit.org/show_bug.cgi?id=161869
+
+        Reviewed by Saam Barati.
+        
+        In bug 161581, I'm going to use flipIfNecessary() during marking to trigger the "I'm not
+        empty" hook, which will set a bit in the markingNotEmpty bitvector.
+        
+        For this to work, we need to ensure that nobody else uses flipIfNecessary() during marking.
+        If anyone else does it but they aren't marking new objects, then this prevents
+        flipIfNecessary() from triggering when the first object is marked, which means we won't
+        always detect when a block became non-empty.
+        
+        I addressed this by adding a isMarking flag, and asserting in flipIfNecessary() that the flag
+        isn't set. flipIfNecessaryDuringMarking() is used only on the marking path, so that code
+        knows that it can trigger something like noteMarked(). The only places that were using
+        flipIfNecessary() should have been using needsFlip() anyway.
+
+        * heap/CellContainer.h:
+        * heap/CellContainerInlines.h:
+        (JSC::CellContainer::needsFlip):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::beginMarking):
+        (JSC::Heap::endMarking):
+        (JSC::Heap::clearLivenessData): Deleted.
+        (JSC::Heap::converge): Deleted.
+        (JSC::Heap::resetVisitors): Deleted.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::testAndSetMarked):
+        * heap/LargeAllocation.h:
+        (JSC::LargeAllocation::flipIfNecessaryDuringMarking):
+        (JSC::LargeAllocation::flipIfNecessaryConcurrently): Deleted.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::flipIfNecessarySlow):
+        (JSC::MarkedBlock::flipIfNecessaryDuringMarkingSlow):
+        (JSC::MarkedBlock::flipIfNecessaryConcurrentlySlow): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::flipIfNecessaryDuringMarking):
+        (JSC::MarkedBlock::Handle::flipIfNecessaryDuringMarking):
+        (JSC::MarkedBlock::flipIfNecessaryConcurrently): Deleted.
+        (JSC::MarkedBlock::Handle::flipIfNecessaryConcurrently): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::isMarking):
+        (JSC::MarkedSpace::setIsMarking):
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionSize): Deleted.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::visit):
+
+2016-09-12  Saam Barati  <sbarati@apple.com>
+
+        HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
+        https://bugs.webkit.org/show_bug.cgi?id=161640
+
+        Reviewed by Geoffrey Garen.
+
+        HashMapImpl now takes into account m_deleteCount in its load factor.
+        It now knows how to rehash to either decrease its capacity, stay at
+        the same capacity, or increase its capacity. The reason we can sometimes
+        stay at the same capacity is that we can reduce the load factor enough
+        by rehashing that growing isn't warranted. The reason for this is that
+        anytime we rehash, we remove all deleted sentinels from the buffer.
+        Therefore, staying at the same same capacity, when there are deleted entries,
+        can still reduce the load factor because it removes all deleted sentinels.
+
+        * runtime/HashMapImpl.h:
+        (JSC::HashMapBuffer::create):
+        (JSC::HashMapBuffer::reset):
+        (JSC::HashMapImpl::HashMapImpl):
+        (JSC::HashMapImpl::add):
+        (JSC::HashMapImpl::remove):
+        (JSC::HashMapImpl::size):
+        (JSC::HashMapImpl::clear):
+        (JSC::HashMapImpl::approximateSize):
+        (JSC::HashMapImpl::shouldRehashAfterAdd):
+        (JSC::HashMapImpl::shouldShrink):
+        (JSC::HashMapImpl::rehash):
+        (JSC::HashMapImpl::checkConsistency):
+        (JSC::HashMapImpl::makeAndSetNewBuffer):
+        (JSC::HashMapImpl::assertBufferIsEmpty):
+
+2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
+        https://bugs.webkit.org/show_bug.cgi?id=161671
+
+        Reviewed by Geoffrey Garen.
+
+        UndecidedShape is a type with storage. When we allocate an uninitialized JSArray,
+        it gets a butterfly with its length.
+        When we were querying that length, we were generating a generic GetById with inline cache.
+
+        This patch adds the missing bits to treat Undecided like the other types with storage.
+
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::canBecomeGetArrayLength):
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::usesButterfly):
+        (JSC::DFG::ArrayMode::lengthNeedsStorage):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
+
+2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG][FTL] Add ArithTan
+        https://bugs.webkit.org/show_bug.cgi?id=161857
+
+        Reviewed by Filip Pizlo.
+
+        While ArithSin and ArithCos are supported, ArithTan is not supported yet.
+        And we also find that Math.tan is included in MotionMark's Multiply benchmark.
+
+        This patch adds ArithTan support in DFG and FTL. And it also cleans up the
+        existing ArithSin, ArithCos, and ArithLog compilations by unifying them.
+        The microbenchmark shows the 9% perf improvement.
+
+            tan    322.4819+-0.3766     ^    295.8700+-0.3094        ^ definitely 1.0899x faster
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDoubleUnaryOp):
+        (JSC::DFG::SpeculativeJIT::compileArithCos):
+        (JSC::DFG::SpeculativeJIT::compileArithTan):
+        (JSC::DFG::SpeculativeJIT::compileArithSin):
+        (JSC::DFG::SpeculativeJIT::compileArithLog):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithTan):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::doubleTan):
+        * ftl/FTLOutput.h:
+        * runtime/Intrinsic.h:
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+
+2016-09-12  Saam Barati  <sbarati@apple.com>
+
+        MapHash should do constant folding when it has a constant argument and its legal to hash that value
+        https://bugs.webkit.org/show_bug.cgi?id=161639
+
+        Reviewed by Filip Pizlo.
+
+        We now constant fold the MapHash node. We're careful to not resolve
+        ropes from the compiler thread, and to only hash strings if they're
+        not too large. The microbenchmark I added runs about 12% faster with
+        this patch.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * runtime/HashMapImpl.h:
+        (JSC::wangsInt64Hash):
+        (JSC::jsMapHash):
+        (JSC::concurrentJSMapHash):
+
+2016-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::forAllKilledOperands() could use a faster bitvector scan in the same-inline-stack fast path
+        https://bugs.webkit.org/show_bug.cgi?id=161849
+
+        Reviewed by Saam Barati.
+        
+        This is a fairly obvious change. This turns a loop that would query each bit individually
+        into a loop that will process a word at a time. I would expect a very tiny progression in
+        DFG compile times.
+        
+        This also gave me an opportunity to test and fix the new FastBitVector functionality.
+
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKilledOperands):
+
+2016-09-11  Filip Pizlo  <fpizlo@apple.com>
+
+        FastBitVector should have efficient and easy-to-use vector-vector operations
+        https://bugs.webkit.org/show_bug.cgi?id=161847
+
+        Reviewed by Saam Barati.
+        
+        Adapt existing users of FastBitVector to the new API.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::BytecodeLivenessAnalysis::computeKills):
+        (JSC::BytecodeLivenessAnalysis::dumpResults):
+        * bytecode/BytecodeLivenessAnalysisInlines.h:
+        (JSC::operandThatIsNotAlwaysLiveIsLive):
+        (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::stepOverInstruction):
+        (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::runLivenessFixpoint):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::validate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flushForTerminal):
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKilledOperands):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp:
+        (JSC::DFG::LiveCatchVariablePreservationPhase::willCatchException):
+        (JSC::DFG::LiveCatchVariablePreservationPhase::handleBlock):
+        * dfg/DFGNaturalLoops.cpp:
+        (JSC::DFG::NaturalLoops::NaturalLoops):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
+
+2016-09-10  Chris Dumez  <cdumez@apple.com>
+
+        parseHTMLInteger() should take a StringView in parameter
+        https://bugs.webkit.org/show_bug.cgi?id=161669
+
+        Reviewed by Ryosuke Niwa.
+
+        * runtime/DateConversion.cpp:
+        (JSC::formatDateTime):
+        Explicitly construct a String from the const WCHAR* on Windows because
+        it is ambiguous otherwise now that there is a StringBuilder::append()
+        overload taking an AtomicString in.
+
+2016-09-08  Keith Miller  <keith_miller@apple.com>
+
+        WASM should support if-then-else
+        https://bugs.webkit.org/show_bug.cgi?id=161778
+
+        Reviewed by Michael Saboff.
+
+        This patch makes some major changes to the way that the WASM
+        function parser works. First, the control stack has been moved
+        from the parser's context to the parser itself. This simplifies
+        the way that the parser works and allows us to make the decoder
+        iterative rather than recursive. Since the control stack has been
+        moved to the parser, any context operation that refers to some
+        block now receives that block by reference.
+
+        For any if block, regardless of whether or not it is an
+        if-then-else or not, we will allocate both the entire control flow
+        diamond. This is not a major issue in the if-then case since B3
+        will immediately cleanup these blocks. In order to support if-then
+        and if-then-else we needed to be able to distinguish what the type
+        of the top block on the control stack is. This will be necessary
+        when validating the else opcode in the future. In the B3 IR
+        generator we decide to the type of the block strictly by the
+        shape.
+
+        Currently, if blocks don't handle passed and returned stack values
+        correctly. I plan to fix this when I add support for the block
+        signatures. See: https://github.com/WebAssembly/design/pull/765
+
+        * testWASM.cpp:
+        (runWASMTests):
+        * wasm/WASMB3IRGenerator.cpp:
+        (dumpProcedure):
+        (JSC::WASM::parseAndCompile):
+        * wasm/WASMB3IRGenerator.h:
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::parseBlock):
+        (JSC::WASM::FunctionParser<Context>::parseExpression):
+        (JSC::WASM::FunctionParser<Context>::parseUnreachableExpression):
+        * wasm/WASMOps.h:
+
+2016-09-09  Filip Pizlo  <fpizlo@apple.com>
+
+        jsc.cpp should call initializeMainThread() to make sure that GC thread assertions work
+        https://bugs.webkit.org/show_bug.cgi?id=161801
+
+        Reviewed by Keith Miller.
+        
+        The GC has debug assertions that certain things don't happen on GC threads. Those assertions
+        are no-ops unless initializeGCThreads() is called, and I think the most canonical way to do
+        that is to call initializeMainThread().
+
+        * jsc.cpp:
+        (jscmain):
+
+2016-09-09  Saam Barati  <sbarati@apple.com>
+
+        Make hasOwnProperty ALWAYS_INLINE
+        https://bugs.webkit.org/show_bug.cgi?id=161775
+
+        Reviewed by Ryosuke Niwa.
+
+        Speedometer spends around 2.5% of its time in hasOwnProperty.
+        Let's reduce the overhead of calling that function by marking
+        it as inline. Also, it's likely that the function will call into
+        JSObject::getOwnPropertySlot. I added a check to see if that's
+        the function we're calling, if it is, we do a direct call instead
+        of an indirect call.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasOwnProperty): Deleted.
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::hasOwnProperty):
+
+2016-09-09  Filip Pizlo  <fpizlo@apple.com>
+
+        HashMapImpl needs to m_buffer.clear() in its constructor
+        https://bugs.webkit.org/show_bug.cgi?id=161796
+
+        Reviewed by Keith Miller.
+        
+        This is the second time that I'm fixing a bug because AuxiliaryBarrier does not initialize
+        itself. That seemed like a good idea because maybe sometimes the user knows better how to
+        initialize it. But, it's not worth it if it's a constant source of bugs.
+        
+        So, I'm fixing it for good by making AuxiliaryBarrier::AuxiliaryBarrier() initialize its
+        m_value.
+
+        * runtime/AuxiliaryBarrier.h:
+        (JSC::AuxiliaryBarrier::AuxiliaryBarrier):
+        * runtime/DirectArguments.cpp:
+        (JSC::DirectArguments::DirectArguments):
+
+2016-09-09  Youenn Fablet  <youenn@apple.com>
+
+        ASSERTION FAILED: promise.inherits(JSPromise::info())
+        https://bugs.webkit.org/show_bug.cgi?id=161632
+        <rdar://problem/28184743>
+
+        Reviewed by Mark Lam.
+
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::create): Returning null if promise object is not created.
+
+2016-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Heap::isMarked() shouldn't pay the price of concurrent lazy flipping
+        https://bugs.webkit.org/show_bug.cgi?id=161760
+
+        Reviewed by Mark Lam.
+        
+        To fix a race condition in marking, I made Heap::isMarked() and Heap::isLive() atomic by
+        using flipIfNecessaryConcurrently() instead of flipIfNecessary().
+        
+        This introduces three unnecessary overheads:
+        
+        - isLive() is not called by marking, so that change was not necessary.
+        
+        - isMarked() gets calls many times outside of marking, so it shouldn't always do the
+          concurrent thing. This adds isMarkedConcurrently() for use in marking, and reverts
+          isMarked().
+        
+        - isMarked() and isMarkedConcurrently() don't actually have to do the lazy flip. They can
+          return false if the flip is necessary.
+        
+        I added a bunch of debug assertions to make sure that isLive() and isMarked() are not called
+        during marking.
+        
+        If we needed to, we could remove most of the calls to isMarkedConcurrently(). As a kind of
+        optimization, CodeBlock does an initial fixpoint iteration during marking, and so all of the
+        code called from CodeBlock's fixpoint iterator needs to use isMarkedConcurrently(). But we
+        could probably arrange for CodeBlock only do fixpoint iterating during the weak reference
+        thing.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitWeakly):
+        (JSC::CodeBlock::shouldJettisonDueToOldAge):
+        (JSC::shouldMarkTransition):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::determineLiveness):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::propagateTransitions):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::isLive):
+        (JSC::Heap::isMarked):
+        (JSC::Heap::isMarkedConcurrently):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::flipIfNecessarySlow):
+        (JSC::MarkedBlock::flipIfNecessaryConcurrentlySlow):
+        (JSC::MarkedBlock::needsFlip):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::needsFlip):
+        (JSC::MarkedBlock::flipIfNecessary):
+        (JSC::MarkedBlock::flipIfNecessaryConcurrently):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::markAuxiliary):
+        (JSC::SlotVisitor::visitChildren):
+        * runtime/Structure.cpp:
+        (JSC::Structure::isCheapDuringGC):
+        (JSC::Structure::markIfCheap):
+
+2016-09-08  Saam Barati  <sbarati@apple.com>
+
+        We should inline operationConvertJSValueToBoolean into JIT code
+        https://bugs.webkit.org/show_bug.cgi?id=161729
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces an AssemblyHelpers emitter function
+        that replaces operationConvertJSValueToBoolean. This operation
+        was showing up when I was doing performance analysis for the
+        speedometer benchmark. I saw that it was spending about 1% of
+        its time in this function. Hopefully this patch can help us speedup
+        up speedometer by a little bit.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitConvertValueToBoolean):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jfalse): Deleted.
+        (JSC::JIT::emitSlow_op_jtrue): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jfalse): Deleted.
+        (JSC::JIT::emitSlow_op_jtrue): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+
+2016-09-08  Chris Dumez  <cdumez@apple.com>
+
+        Align proto getter / setter behavior with other browsers
+        https://bugs.webkit.org/show_bug.cgi?id=161455
+
+        Reviewed by Saam Barati.
+
+        Drop allowsAccessFrom from the methodTable and delegate cross-origin
+        checking to the DOM bindings for [[SetPrototypeOf]] / [[GetPrototypeOf]].
+        This is more consistent with other operations (e.g. [[GetOwnProperty]]).
+
+        * jsc.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+        (JSC::globalFuncBuiltinLog): Deleted.
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        Remove check added in r197648. This check was added to match
+        the latest EcmaScript spec:
+        - https://tc39.github.io/ecma262/#sec-ordinarysetprototypeof (step 8)
+        This check allowed for [[Prototype]] chain cycles if the prototype
+        chain includes objects that do not use the ordinary object definitions
+        for [[GetPrototypeOf]] and [[SetPrototypeOf]].
+        The issue is that the rest of our code base does not properly handle
+        such cycles and we can end up in infinite loops. This became obvious
+        because this patch updates Window / Location so that they no longer
+        use the default [[GetPrototypeOf]] / [[SetPrototypeOf]]. If I do not
+        remove this check, I get an infinite loop in
+        Structure::anyObjectInChainMayInterceptIndexedAccesses(), which is
+        called from JSObject::setPrototypeDirect(), when running the following
+        layout test:
+        - html/browsers/history/the-location-interface/allow_prototype_cycle_through_location.sub.html
+        I filed https://bugs.webkit.org/show_bug.cgi?id=161534 to track this
+        issue.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getArrayLength): Deleted.
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setPrototype):
+        (JSC::JSProxy::getPrototype):
+        * runtime/JSProxy.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor): Deleted.
+        (JSC::objectConstructorGetOwnPropertyDescriptors): Deleted.
+        * runtime/ObjectConstructor.h:
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectGetPrototypeOf):
+        (JSC::reflectObjectSetPrototypeOf):
+
+2016-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove CopiedSpace and use MarkedSpace instead
+        https://bugs.webkit.org/show_bug.cgi?id=159658
+
+        Reviewed by Keith Miller.
+        
+        This removes the final client of CopiedSpace, the overrides array of DirectArguments. That
+        is a simple change.
+        
+        Then this stubs out some remaining internal debugging code that referenced CopiedSpace in
+        JSDollarVM and HeapVerifier. I filed FIXMEs to restore that debugging functionality.
+        
+        The rest of this patch is deleting CopiedSpace.
+
+        * API/JSObjectRef.cpp:
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOperations.cpp:
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddPointer):
+        * heap/CopiedAllocator.h: Removed.
+        * heap/CopiedBlock.cpp: Removed.
+        * heap/CopiedBlock.h: Removed.
+        * heap/CopiedBlockInlines.h: Removed.
+        * heap/CopiedSpace.cpp: Removed.
+        * heap/CopiedSpace.h: Removed.
+        * heap/CopiedSpaceInlines.h: Removed.
+        * heap/CopyBarrier.h: Removed.
+        * heap/CopyToken.h: Removed.
+        * heap/CopyVisitor.cpp: Removed.
+        * heap/CopyVisitor.h: Removed.
+        * heap/CopyVisitorInlines.h: Removed.
+        * heap/CopyWorkList.h: Removed.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::isPagedOut):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::size):
+        (JSC::Heap::capacity):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::stopAllocation):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::copyBackingStores): Deleted.
+        (JSC::Heap::threadBytesCopied): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::objectSpace):
+        (JSC::Heap::allocatorForAuxiliaryData):
+        (JSC::Heap::storageSpace): Deleted.
+        (JSC::Heap::storageAllocator): Deleted.
+        * heap/HeapCellInlines.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::tryAllocateStorage): Deleted.
+        (JSC::Heap::tryReallocateStorage): Deleted.
+        * heap/HeapVerifier.cpp:
+        (JSC::HeapVerifier::verifyButterflyIsInStorageSpace):
+        (JSC::HeapVerifier::reportObject):
+        (JSC::getButterflyDetails): Deleted.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::copyLater): Deleted.
+        * heap/SlotVisitor.h:
+        * jit/AssemblyHelpers.h:
+        * jit/JITOpcodes.cpp:
+        * jsc.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/Butterfly.h:
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::createUninitializedDuringCollection): Deleted.
+        * runtime/ClassInfo.h:
+        * runtime/DirectArguments.cpp:
+        (JSC::DirectArguments::visitChildren):
+        (JSC::DirectArguments::overrideThings):
+        (JSC::DirectArguments::copyBackingStore): Deleted.
+        * runtime/DirectArguments.h:
+        * runtime/JSArray.cpp:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::copyBackingStore): Deleted.
+        * runtime/JSCell.h:
+        * runtime/JSLexicalEnvironment.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSTypedArrays.cpp:
+        * runtime/LiteralParser.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/RegExpObject.cpp:
+        * runtime/StringPrototype.cpp:
+        * runtime/WeakMapData.cpp:
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::isInStorageSpace):
+
+2016-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Heap version should be 32-bit
+        https://bugs.webkit.org/show_bug.cgi?id=161751
+
+        Reviewed by Mark Lam.
+        
+        32-bit devices are probably getting hurt by the 64-bit version number. The reason why I made
+        it 64-bit initially is so that I wouldn't have to worry about wrap-around. But wrap-around is
+        easy to handle.
+
+        * heap/CellContainer.h:
+        * heap/CellContainerInlines.h:
+        (JSC::CellContainer::flipIfNecessary):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::genericAddSpan):
+        * heap/ConservativeRoots.h:
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::testAndSetMarked):
+        * heap/HeapUtil.h:
+        (JSC::HeapUtil::findGCObjectPointersForMarking):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::flipIfNecessary):
+        (JSC::MarkedBlock::flipIfNecessaryConcurrently):
+        (JSC::MarkedBlock::Handle::flipIfNecessary):
+        (JSC::MarkedBlock::Handle::flipIfNecessaryConcurrently):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::flip):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::version):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+        * heap/SlotVisitor.h:
+
+2016-09-08  Mark Lam  <mark.lam@apple.com>
+
+        Add support for a ternary sub32 emitter for ARM64 and 32-bit ARM.
+        https://bugs.webkit.org/show_bug.cgi?id=161724
+
+        Reviewed by Filip Pizlo.
+
+        ARM architectures support ternary sub instructions.  We should make use of them
+        in emitAllocateWithNonNullAllocator().
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::sub32):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::sub32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::sub32):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::sub32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::sub32):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testTernarySubInstructionSelection):
+        (JSC::B3::run):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
+
+2016-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Move JSMap/JSSet over to Auxiliary MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=161744
+
+        Reviewed by Saam Barati.
+        
+        This moves the buffer out of CopiedSpace and into Auxiliary MarkedSpace.
+        
+        Also removes MapData.h/MapDataInlines.h since they are not used anywhere, but they still
+        speak of CopiedSpace.
+        
+        This is a purely mechanical change.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopyToken.h:
+        * runtime/HashMapImpl.cpp:
+        (JSC::HashMapImpl<HashMapBucket>::visitChildren):
+        (JSC::HashMapImpl<HashMapBucket>::copyBackingStore): Deleted.
+        * runtime/HashMapImpl.h:
+        (JSC::HashMapBuffer::create):
+        * runtime/JSMapIterator.cpp:
+        * runtime/JSMapIterator.h:
+        * runtime/JSSetIterator.cpp:
+        * runtime/JSSetIterator.h:
+        * runtime/MapBase.cpp:
+        * runtime/MapData.h: Removed.
+        * runtime/MapDataInlines.h: Removed.
+        * runtime/MapPrototype.cpp:
+        * runtime/SetConstructor.cpp:
+        * runtime/SetPrototype.cpp:
+        * runtime/VM.cpp:
+
+2016-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Typed arrays should use MarkedSpace instead of CopiedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=161100
+
+        Reviewed by Geoffrey Garen.
+        
+        This moves typed array backing stores out of CopiedSpace and into Auxiliary MarkedSpace.
+        
+        This is a purely mechanical change since Auxiliary MarkedSpace already knows how to do
+        everything that typed arrays want.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::newTypedArrayWithSize):
+        * dfg/DFGOperations.h:
+        (JSC::DFG::operationNewTypedArrayWithSizeForType):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage): Deleted.
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+        (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
+        (JSC::FTL::DFG::LowerDFGToB3::splatWords):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorage): Deleted.
+        * heap/CopyToken.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::markAuxiliary):
+        * jit/JITOperations.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        (JSC::JSArrayBufferView::JSArrayBufferView):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        (JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore): Deleted.
+
+2016-09-08  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win64] Compile fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=161682
+
+        Reviewed by Brent Fulgham.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * runtime/ArrayConventions.cpp:
+        (JSC::clearArrayMemset):
+
+2016-09-08  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Exception fuzz tests fail
+        https://bugs.webkit.org/show_bug.cgi?id=140928
+
+        Reviewed by Mark Lam.
+
+        Flush stdout when throwing the exception to make sure the output comes before output in the exception handler.
+        The tests depend on the output to stdout being written in the correct order.
+
+        * runtime/ExceptionFuzz.cpp:
+        (JSC::doExceptionFuzzing):
+
+2016-09-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable the <meter> element on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=161714
+        rdar://problem/8978410
+
+        Reviewed by Tim Horton.
+
+        Define ENABLE_METER_ELEMENT unconditionally now.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-09-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Modernize Debugger to use nullptr
+        https://bugs.webkit.org/show_bug.cgi?id=161718
+
+        Reviewed by Mark Lam.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::~Debugger):
+        (JSC::Debugger::detach):
+        (JSC::Debugger::stepOutOfFunction):
+        (JSC::Debugger::updateCallFrameAndPauseIfNeeded):
+        * debugger/Debugger.h:
+
+2016-09-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove always false case in Debugger
+        https://bugs.webkit.org/show_bug.cgi?id=161717
+
+        Reviewed by Brian Burg.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::didExecuteProgram):
+        We would have earlier returned a few statements ago if this case was true.
+        And we would have crashed in the previous statement if this case was true.
+
+2016-09-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, build fix after r205569
+
+        Tweak CMakeLists.txt
+
+        * CMakeLists.txt:
+
+2016-09-07  Mark Lam  <mark.lam@apple.com>
+
+        Add CatchScope and force all exception checks to be via ThrowScope or CatchScope.
+        https://bugs.webkit.org/show_bug.cgi?id=161498
+
+        Reviewed by Geoffrey Garen.
+
+        This patch refactors the ThrowScope class, and introduces a base ExceptionScope
+        that ThrowScope extends.  A CatchScope which extends the ExceptionScope is also
+        introduced.
+
+        ENABLE(THROW_SCOPE_VERIFICATION) is now renamed to ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+        which is a more suitable name now.
+
+        Note: exception scope verification is still disabled by default.  There are still
+        many places that need to be fixed up or re-expressed in a way that is friendly
+        to the verification.  I'll address those in subsequent patches.
+
+        After this patch, the code will statically enforce that:
+        1. all calls to throwException() go through a ThrowScope.
+        2. all calls to clearException() go through a CatchScope.
+        3. all exception checks go through an ExceptionScope in the form of a ThrowScope
+           or CatchScope.
+
+        A Summary of how to use ExceptionScopes
+        =======================================
+        1. If a function can throw a JS exception, it should declare a ThrowScope at the
+           top of the function (as early as possible).
+
+        2. If a function can clear JS exceptions, it should declare a CatchScope at the
+           top of the function (as early as possible).
+
+        Declaring a ThrowScope in a function means that the function may throw an exception
+        that its caller will have to handle.  Declaring a CatchScope in a function means
+        that the function intends to clear pending exceptions before returning to its
+        caller. 
+
+        For more details, see the notes below.
+        
+        Everything you may want to know about ExceptionScopes
+        =====================================================
+        ExceptionScope verification works to simulate exception throws and detect cases
+        where exception checks are missing.  The notes below will cover:
+
+            1. The VM::m_needExceptionCheck bit
+            2. ThrowScopes and CatchScopes
+            3. Verification of needed exception checks
+            3. Checking Exceptions
+            4. Simulating throws
+            5. Using ThrowScope::release()
+            6. Checking exceptions with ThrowScope::exception() / CatchScope::exception()
+            7. Checking exceptions by checking callee results
+            8. Debugging verification errors
+
+        1. The VM::m_needExceptionCheck bit
+
+           The VM has a m_needExceptionCheck bit that indicates when an exception may be
+           thrown.  You can think of the m_needExceptionCheck bit being set as a simulated
+           throw.
+
+        2. ThrowScopes and CatchScopes
+
+           Only ThrowScopes may throwException.  Only CatchScopes may catchException.
+
+           Every throw site must declare a ThrowScope instance using DECLARE_THROW_SCOPE
+           at the top of its function (as early as possible) e.g.
+ 
+                void foo(...)
+                {
+                    auto scope = DECLARE_THROW_SCOPE(vm);
+                    ...
+                    throwException(exec, scope, ...);
+                }
+
+           Note: by convention, every throw helper function must take a ThrowScope argument
+           instead of instantiating its own ThrowScope.  This allows the throw to be
+           attributed to the client code rather than the throw helper itself.
+
+           Every catch site (i.e. a site that calls clearException()) must declare a
+           CatchScope instance using DECLARE_CATCH_SCOPE at the top of its function.
+
+           If a function can both throw or clear exceptions, then the ThrowScope should
+           be declared first so that it can simulate a throw to the function's caller.
+
+           Note: ThrowScope and CatchScope both extend ExceptionScope so that ThrowScopes
+           can be aware if there's an enclosing CatchScope between it and the point where
+           C++ code returns to JS code.  This is needed to determine if the ThrowScope
+           should simulate a re-throw or not.  See (4) below for more details on returning
+           to JS code.
+
+        3. Verification of needed exception checks
+
+           a. On construction, each ThrowScope and CatchScope will verify that
+              VM::m_needExceptionCheck is not set.
+ 
+              This ensures that the caller of the current function has checked for exceptions
+              where needed before doing more work which lead to calling the current function.
+
+           b. On destruction, each ThrowScope and CatchScope will verify that
+              VM::m_needExceptionCheck is not set. This verification will be skipped if
+              the ThrowScope has been released (see (5) below).
+
+              This ensures that the function that owns this exception scope is not missing
+              any exception checks before returning.
+
+           c. When throwing an exception, the ThrowScope will verify that VM::m_needExceptionCheck
+              is not already set, unless it's been ask to rethrow the same Exception object.
+
+        4. Simulating throws
+
+           Throws are simulated by setting the m_needExceptionCheck bit.
+
+           The bit will only be set in the ThrowScope destructor except when the ThrowScope
+           detects the caller is a LLInt or JIT function.  LLInt or JIT functions will always
+           check for exceptions after a host C++ function returns to it.  However, they will
+           not clear the m_needExceptionCheck bit.
+
+           Hence, if the ThrowScope destructor detects the caller is a LLInt or JIT function,
+           it will just skip the setting of the bit.
+
+           Note: it is not needed nor correct to set the m_needExceptionCheck bit in the
+           throwException methods.  This is because, in practice, we always return
+           immediately after throwing an exception.  It doesn't make sense to set the bit in
+           the throw just to have to clear it immediately after before we do verification in
+           the ThrowScope destructor.
+
+        5. Using ThrowScope::release()
+
+           Calling release() means that the scope is released from its obligation to
+           verify the VM::m_needExceptionCheck bit on destruction.
+
+           release() should only be used at the bottom of a function if:
+
+           a. This function is going to let its caller check and handle the exception, e.g.
+
+                void foo(...)
+                {
+                    auto scope = DECLARE_THROW_SCOPE(vm);
+                    auto result = goo(); // may throw.
+
+                    ... // Code that will are not affected by a pending exceptions.
+
+                    scope.release(); // tell the ThrowScope that the caller will handle the exception.
+                    return result;
+                }
+
+           b. This function is going to do a tail call that may throw.
+
+                void foo(...)
+                {
+                    auto scope = DECLARE_THROW_SCOPE(vm);
+                    ...
+                    scope.release(); // tell the ThrowScope that the caller will handle the exception.
+                    return goo(); // may throw.
+                }
+
+              release() should not be used in code paths that branch. For example:
+
+                void foo(...)
+                {
+                    auto scope = DECLARE_THROW_SCOPE(vm);
+
+                    auto result = goo1(); // may throw.
+                    scope.release(); // WRONG !!! Don't do this.
+                    if (result)
+                        return;
+
+                    result = goo2(); // may throw.
+                    ...
+                    return result;
+                }
+
+            The above will result in a verification error in goo2()'s ThrowScope.  The
+            proper way to fix this verification is to do either (6) or (7) below.
+
+         6. Checking exceptions with ThrowScope::exception() / CatchScope::exception()
+
+            ThrowScope/CatchScope::exception() returns the thrown Exception object if
+            there is one pending.  Else, it returns nullptr.
+
+            It also clears the m_needExceptionCheck bit thereby indicating that we've
+            satisfied the needed exception check.  For example,
+
+                void foo(...)
+                {
+                    auto scope = DECLARE_THROW_SCOPE(vm);
+
+                    auto result = goo1(); // may throw.
+                    if (scope.exception())
+                        return;
+
+                    result = goo2(); // may throw.
+                    ...
+                    return result;
+                }
+
+            But sometimes, for optimization reasons, we may choose to test the result of
+            the callee function instead doing a load of the VM exception value.  See (7)
+            below.
+
+         7. Checking exceptions by checking callee results
+
+            This approach should only be applied when it makes a difference to performance.
+            If we need to do this, we should add an ASSERT() that invokes the scope's
+            exception() method to verify the result.  Since exception scope verification
+            is only done on DEBUG builds, this ASSERT will satisfy the verification
+            requirements without impacting performance.  For example,
+
+                void foo(...)
+                {
+                    auto scope = DECLARE_THROW_SCOPE(vm);
+
+                    bool failed = goo1(); // may throw.
+                    ASSERT(!!scope.exception() == failed)
+                    if (failed)
+                        return;
+
+                    result = goo2(); // may throw.
+                    ...
+                    return result;
+                }
+
+         8. Debugging verification errors
+
+            a. When verification fails, you will see a message followed by an assertion
+               failure.  For example:
+
+            ERROR: Unchecked JS exception:
+                This scope can throw a JS exception: setUpCall @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1245
+                    (ExceptionScope::m_recursionDepth was ...)
+                But the exception was unchecked as of this scope: varargsSetup @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1398
+                    (ExceptionScope::m_recursionDepth was ...)
+                [ backtrace here ]
+
+               The message tells you that failure was detected at in varargsSetup() at
+               LLIntSlowPaths.cpp line 1398, and that the missing exception check should
+               have happened somewhere between the call to setUpCall() at LLIntSlowPaths.cpp
+               line 1245 and it.
+
+               If that is insufficient information, you can ...
+
+            b. Dump simulated throws
+
+               Re-run the test case with JSC_dumpSimulatedThrows=true.  You will also see
+               back traces at each simulated throw.
+
+            c. Narrowing down the source of a simulated throw
+
+               Another technique for narrowing down the source of simulated throws is by
+               further dividing a function to smaller regions by separating each region
+               with additional local throw scopes.  For example,
+
+                ... // Region 1
+                { auto scope = DECLARE_THROW_SCOPE(vm); }
+                ... // Region 2
+                { auto scope = DECLARE_THROW_SCOPE(vm); }
+                ... // Region 3
+
+        * API/APIUtils.h:
+        (handleExceptionIfNeeded):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptFunctionCall::call):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::ScriptValue::toString):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::pauseIfNeeded):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluateWithScopeExtension):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::createInjectedScript):
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        (Inspector::JSInjectedScriptHost::weakMapEntries):
+        (Inspector::JSInjectedScriptHost::weakSetEntries):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::extractSourceInformationFromException):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearException): Deleted.
+        (JSC::ExecState::exception): Deleted.
+        (JSC::ExecState::hadException): Deleted.
+        (JSC::ExecState::lastException): Deleted.
+        (JSC::ExecState::clearLastException): Deleted.
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::sizeOfVarargs):
+        (JSC::notifyDebuggerOfUnwinding):
+        (JSC::Interpreter::unwind):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::debug):
+        * interpreter/Interpreter.h:
+        (JSC::SuspendExceptionScope::SuspendExceptionScope):
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::functionsOnStack):
+        * jit/JITCode.cpp:
+        (JSC::JITCode::execute):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * jsc.cpp:
+        (WTF::ImpureGetter::getOwnPropertySlot):
+        (GlobalObject::moduleLoaderResolve):
+        (GlobalObject::moduleLoaderFetch):
+        (functionCreateElement):
+        (functionRun):
+        (functionRunString):
+        (functionLoad):
+        (functionLoadString):
+        (functionReadFile):
+        (functionCheckSyntax):
+        (functionSetRandomSeed):
+        (functionLoadModule):
+        (functionCreateBuiltin):
+        (functionCheckModuleSyntax):
+        (functionGenerateHeapSnapshot):
+        (functionSamplingProfilerStackTraces):
+        (dumpException):
+        (checkUncaughtException):
+        (runWithScripts):
+        (runInteractive):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::addSequenceProperties):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::toJS):
+        * profiler/ProfilerOSRExitSite.cpp:
+        (JSC::Profiler::OSRExitSite::toJS):
+        * profiler/ProfilerOriginStack.cpp:
+        (JSC::Profiler::OriginStack::toJS):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::slowJoin):
+        (JSC::fastJoin):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        (JSC::moveElements):
+        (JSC::concatAppendOne):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructWithBooleanConstructor):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CatchScope.cpp: Added.
+        (JSC::CatchScope::CatchScope):
+        (JSC::CatchScope::~CatchScope):
+        * runtime/CatchScope.h: Added.
+        (JSC::CatchScope::clearException):
+        (JSC::CatchScope::CatchScope):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/CommonSlowPathsExceptions.cpp:
+        (JSC::CommonSlowPaths::interpreterThrowInCaller):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        (JSC::rejectPromise):
+        (JSC::loadAndEvaluateModule):
+        (JSC::loadModule):
+        * runtime/ConsoleObject.cpp:
+        (JSC::consoleProtoFuncAssert):
+        (JSC::consoleProtoFuncProfile):
+        (JSC::consoleProtoFuncProfileEnd):
+        (JSC::consoleProtoFuncTakeHeapSnapshot):
+        (JSC::consoleProtoFuncTime):
+        (JSC::consoleProtoFuncTimeEnd):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToPrimitiveSymbol):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::sanitizedToString):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionEventLocation.cpp: Added.
+        (WTF::printInternal):
+        * runtime/ExceptionEventLocation.h: Copied from Source/JavaScriptCore/runtime/ThrowScopeLocation.h.
+        (JSC::ExceptionEventLocation::ExceptionEventLocation):
+        (JSC::ThrowScopeLocation::ThrowScopeLocation): Deleted.
+        * runtime/ExceptionHelpers.h:
+        * runtime/ExceptionScope.cpp: Added.
+        (JSC::ExceptionScope::ExceptionScope):
+        (JSC::ExceptionScope::~ExceptionScope):
+        * runtime/ExceptionScope.h: Added.
+        (JSC::ExceptionScope::vm):
+        (JSC::ExceptionScope::recursionDepth):
+        (JSC::ExceptionScope::exception):
+        (JSC::ExceptionScope::ExceptionScope):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::copyToArguments):
+        * runtime/GetterSetter.cpp:
+        (JSC::callGetter):
+        * runtime/InspectorInstrumentationObject.cpp:
+        (JSC::inspectorInstrumentationObjectLog):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::initializeCollator):
+        (JSC::IntlCollator::createCollator):
+        (JSC::IntlCollator::resolvedOptions):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorFuncCompare):
+        (JSC::IntlCollatorPrototypeGetterCompare):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::toDateTimeOptionsAnyDate):
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        (JSC::IntlDateTimeFormat::resolvedOptions):
+        (JSC::IntlDateTimeFormat::format):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatFuncFormatDateTime):
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        (JSC::IntlNumberFormat::createNumberFormat):
+        (JSC::IntlNumberFormat::resolvedOptions):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatFuncFormatNumber):
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        * runtime/IntlObject.cpp:
+        (JSC::intlBooleanOption):
+        (JSC::intlStringOption):
+        (JSC::intlNumberOption):
+        (JSC::canonicalizeLocaleList):
+        (JSC::supportedLocales):
+        * runtime/IntlObjectInlines.h:
+        (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
+        * runtime/IteratorOperations.cpp:
+        (JSC::iteratorNext):
+        (JSC::iteratorStep):
+        (JSC::iteratorClose):
+        (JSC::iteratorForIterable):
+        * runtime/IteratorOperations.h:
+        (JSC::forEachInIterable):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSArrayInlines.h:
+        (JSC::getLength):
+        (JSC::toLength):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::getBoundFunctionStructure):
+        (JSC::JSBoundFunction::create):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::toPreferredPrimitiveType):
+        (JSC::JSValue::getPropertySlot):
+        (JSC::JSValue::equalSlowCaseInline):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::setFunctionName):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndex):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncIncludes):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        (JSC::constructArrayNegativeIndexed):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSJob.cpp:
+        (JSC::JSJobMicrotask::run):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::getOwnPropertySlot):
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::fetch):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::finishCreation):
+        (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        * runtime/JSObject.cpp:
+        (JSC::ordinarySetSlow):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::callToPrimitiveFunction):
+        (JSC::JSObject::ordinaryToPrimitive):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::JSObject::getGenericPropertyNames):
+        (JSC::JSObject::getMethod):
+        * runtime/JSObjectInlines.h:
+        (JSC::createListFromArrayLike):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getNonIndexPropertySlot):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::propertyNameEnumerator):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSScope.cpp:
+        (JSC::isUnscopable):
+        (JSC::JSScope::resolve):
+        * runtime/JSString.cpp:
+        (JSC::JSString::equalSlowCase):
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::join):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncClz32):
+        (JSC::mathProtoFuncHypot):
+        (JSC::mathProtoFuncIMul):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+        (JSC::moduleLoaderPrototypeRequestedModules):
+        (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyDescriptors):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorGetOwnPropertySymbols):
+        (JSC::objectConstructorKeys):
+        (JSC::ownEnumerablePropertyKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::defineProperties):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+        (JSC::ownPropertyKeys):
+        * runtime/ObjectConstructor.h:
+        (JSC::constructObjectFromPropertyDescriptor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        * runtime/Options.h:
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::slowGetterSetter):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::makeRevocableProxy):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::toStringName):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::performPut):
+        (JSC::ProxyObject::putByIndexCommon):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectConstruct):
+        (JSC::reflectObjectDefineProperty):
+        (JSC::reflectObjectGet):
+        (JSC::reflectObjectGetOwnPropertyDescriptor):
+        (JSC::reflectObjectIsExtensible):
+        (JSC::reflectObjectPreventExtensions):
+        (JSC::reflectObjectSet):
+        (JSC::reflectObjectSetPrototypeOf):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::toFlags):
+        (JSC::regExpCreate):
+        (JSC::constructRegExp):
+        * runtime/RegExpConstructor.h:
+        (JSC::isRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::collectMatches):
+        (JSC::RegExpObject::matchGlobal):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::flagsString):
+        (JSC::regExpProtoFuncToString):
+        (JSC::regExpProtoGetterFlags):
+        (JSC::regExpProtoFuncSearchFast):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCodePoint):
+        (JSC::constructWithStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
+        (JSC::replaceUsingStringSearch):
+        (JSC::replace):
+        (JSC::stringProtoFuncReplaceUsingRegExp):
+        (JSC::stringProtoFuncReplaceUsingStringSearch):
+        (JSC::stringProtoFuncCodePointAt):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::toLocaleCase):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringIncludesImpl):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::stringProtoFuncNormalize):
+        * runtime/SymbolConstructor.cpp:
+        (JSC::symbolConstructorFor):
+        * runtime/TemplateRegistry.cpp:
+        (JSC::TemplateRegistry::getTemplateObject):
+        * runtime/ThrowScope.cpp:
+        (JSC::ThrowScope::ThrowScope):
+        (JSC::ThrowScope::~ThrowScope):
+        (JSC::ThrowScope::throwException):
+        (JSC::ThrowScope::simulateThrow):
+        (JSC::ThrowScope::printIfNeedCheck): Deleted.
+        (JSC::ThrowScope::verifyExceptionCheckNeedIsSatisfied): Deleted.
+        * runtime/ThrowScope.h:
+        (JSC::ThrowScope::release):
+        (JSC::ThrowScope::ThrowScope):
+        (JSC::ThrowScope::throwException):
+        (JSC::ThrowScope::vm): Deleted.
+        (JSC::ThrowScope::exception): Deleted.
+        * runtime/ThrowScopeLocation.h: Removed.
+        * runtime/VM.cpp:
+        (JSC::VM::verifyExceptionCheckNeedIsSatisfied):
+        * runtime/VM.h:
+        (JSC::VM::exception):
+        (JSC::VM::clearException):
+        (JSC::VM::setException): Deleted.
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::constructWeakSet):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionPrint):
+
+2016-09-07  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] some valid language tags cause errors in Intl constructors
+        https://bugs.webkit.org/show_bug.cgi?id=161672
+
+        Reviewed by Mark Lam.
+
+        Fix private use tag parsing to match spec, allowing single character parts.
+        https://www.rfc-editor.org/rfc/bcp/bcp47.txt
+
+        ```
+        privateuse    = "x" 1*("-" (1*8alphanum))
+        ```
+
+        * runtime/IntlObject.cpp:
+        (JSC::privateUseLangTag): Allow singleton parts in private use tag.
+
+2016-09-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove a couple of useless forward declaration
+        https://bugs.webkit.org/show_bug.cgi?id=161676
+
+        Reviewed by Mark Lam.
+
+        JITMathICForwards.h should take care of declarating the Math ICs.
+
+        * bytecode/CodeBlock.h:
+        * jit/JITOperations.h:
+
+2016-09-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Make emitAllocateWithNonNullAllocator's sub32() disallow-scratch-friendly
+        https://bugs.webkit.org/show_bug.cgi?id=161706
+
+        Reviewed by Geoffrey Garen.
+        
+        You can't sub32(Addr, Reg) on not-x86 without using a scratch register. So, on those CPUs, we
+        have to do something different.
+
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
+
+2016-09-07  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        Unreviewed CMake build fix after r205552
+
+        * CMakeLists.txt:
+
+2016-09-03  Keith Miller  <keith_miller@apple.com>
+
+        Add support for WASM Loops and Branches
+        https://bugs.webkit.org/show_bug.cgi?id=161569
+
+        Reviewed by Benjamin Poulain.
+
+        This patch adds support for loops and branches to WASM. In order
+        to support loops, we needed to change the way the B3IRGenerator
+        tracked control information. Now, the control data holds three
+        pieces of information: The continuation block, the loop branch
+        target, and variables exiting the block. Whenever we branch to
+        some control point we first check if it is a loop by checking that
+        the loop branch target is non-null. If the branch is not targeting
+        a loop, we map the stack values to the associated B3 variables for
+        that stack slot.
+
+        Another interesting thing of note is that we now only allocate the
+        continuation basic block lazily. This is beneficial when the
+        continuation would just fall through to another block anyway. For
+        example, in code like: (block ... (block (add 1 2) end) end) the
+        continuation for the inner block just falls through to the outer
+        block's continuation so we don't need an extra block.
+
+        * B3CallingConventions.cpp:
+        (JSC::B3::jscCallingConvention): Deleted.
+        * B3CallingConventions.h:
+        (JSC::B3::CallingConvention::CallingConvention): Deleted.
+        (JSC::B3::CallingConvention::iterate): Deleted.
+        (JSC::B3::nextJSCOffset): Deleted.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Type.h:
+        * testWASM.cpp:
+        (runWASMTests):
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::B3IRGenerator::LazyBlock::LazyBlock):
+        (JSC::WASM::B3IRGenerator::LazyBlock::operator bool):
+        (JSC::WASM::B3IRGenerator::LazyBlock::get):
+        (JSC::WASM::B3IRGenerator::LazyBlock::dump):
+        (JSC::WASM::B3IRGenerator::ControlData::ControlData):
+        (JSC::WASM::B3IRGenerator::ControlData::dump):
+        (JSC::WASM::B3IRGenerator::ControlData::targetBlockForBranch):
+        (JSC::WASM::B3IRGenerator::ControlData::isLoop):
+        (JSC::WASM::B3IRGenerator::addLocal):
+        (JSC::WASM::B3IRGenerator::addArguments):
+        (JSC::WASM::B3IRGenerator::setLocal):
+        (JSC::WASM::B3IRGenerator::addBlock):
+        (JSC::WASM::B3IRGenerator::addLoop):
+        (JSC::WASM::B3IRGenerator::endBlock):
+        (JSC::WASM::B3IRGenerator::addReturn):
+        (JSC::WASM::B3IRGenerator::addBranch):
+        (JSC::WASM::B3IRGenerator::initializeIncommingTypes):
+        (JSC::WASM::B3IRGenerator::unifyValuesWithBlock):
+        (JSC::WASM::B3IRGenerator::controlDataForLevel):
+        (JSC::WASM::B3IRGenerator::dumpGraphAndControlStack):
+        (JSC::WASM::parseAndCompile):
+        (JSC::WASM::B3IRGenerator::unifyValuesWithLevel): Deleted.
+        (JSC::WASM::B3IRGenerator::stackForControlLevel): Deleted.
+        (JSC::WASM::B3IRGenerator::blockForControlLevel): Deleted.
+        * wasm/WASMCallingConvention.cpp: Renamed from Source/JavaScriptCore/B3CallingConventions.cpp.
+        (JSC::WASM::jscCallingConvention):
+        * wasm/WASMCallingConvention.h: Renamed from Source/JavaScriptCore/B3CallingConventions.h.
+        (JSC::WASM::CallingConvention::CallingConvention):
+        (JSC::WASM::CallingConvention::iterate):
+        (JSC::WASM::nextJSCOffset):
+        * wasm/WASMFormat.h:
+        (JSC::WASM::toB3Type):
+        (JSC::WASM::isValueType):
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::parse):
+        (JSC::WASM::FunctionParser<Context>::parseExpression):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASM::ModuleParser::parseFunctionTypes):
+        * wasm/WASMOps.h:
+
+2016-09-07  Youenn Fablet  <youenn@apple.com>
+
+        [Streams API] Separate compile flag for ReadableStream and WritableStream
+        https://bugs.webkit.org/show_bug.cgi?id=161044
+
+        Reviewed by Alex Christensen.
+
+        Moving from STREAMS_API to READABLE_STREAM_API and WRITABLE_STREAM_API compilation flags.
+        Updated builtin test to cover the case of @conditional taking ENABLE(XX) || ENABLE(YY) flag.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * Scripts/tests/builtins/WebCore-GuardedInternalBuiltin-Separate.js:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:
+
+2016-09-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the ENABLE(WEBASSEMBLY) build on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=161685
+
+        Unreviewed buildfix.
+
+        * wasm/JSWASMModule.cpp:
+
+2016-09-06  Saam Barati  <sbarati@apple.com>
+
+        ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
+        https://bugs.webkit.org/show_bug.cgi?id=161558
+
+        Reviewed by Benjamin Poulain.
+
+        ProxyObject had ObjectPrototype as its direct prototype.
+        This could lead to infinite loops when doing a getDirectPrototype()
+        loop.
+
+        Fixing this bug revealed another bug, which I made when implementing Proxy.
+        We should not special case "__proto__" in get and set for Proxy Object's
+        hooks. "__proto__" should just go through the normal set and get path.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::put):
+
+2016-09-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Make JSC::PrivateName copyable
+        https://bugs.webkit.org/show_bug.cgi?id=161666
+
+        Reviewed by Ryosuke Niwa.
+
+        Define the custom copy constructor to make PrivateName copyable while using Ref<SymbolImpl>.
+        And since the custom copy constructor deletes the default move constructor, we explcitly define
+        it by `= default;`.
+
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+
+2016-09-06  Daniel Bates  <dabates@apple.com>
+
+        [iOS] Build fails in JSCLLIntOffsetsExtractor - Ad Hoc code signing is not allowed with SDK 'Simulator - iOS 10.0'
+        https://bugs.webkit.org/show_bug.cgi?id=161296
+
+        Reviewed by Dan Bernstein.
+
+        Allow ad-hoc code signing when building JavaScriptCore command line tools for simulator
+        with the iOS 10 beta SDK.
+
+        * Configurations/Base.xcconfig:
+
+2016-09-06  Saam Barati  <sbarati@apple.com>
+
+        Unreviewed build fix for 32-bit platforms after r205520.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Deleted.
+
+2016-09-06  Saam Barati  <sbarati@apple.com>
+
+        Member call on NULL pointer in JavaScriptCore/dfg/DFGAbstractInterpretterInlines.h
+        https://bugs.webkit.org/show_bug.cgi?id=160870
+
+        Reviewed by Darin Adler.
+
+        Credit goes to Jonathan Bedard for finding this bug using the undefined
+        behavior sanitizer.
+
+        The rule for MaterializeNewObject inside AI was assuming that the graph
+        is in SSA form. This used to be true when MaterializeNewObject was only
+        inserted by the allocation sinking phase. However, Filip added more uses
+        of MaterializeNewObject in his RegExp constant folding patch. This fixes
+        the bug by using the structure set inside the Node's OpInfo rather than
+        generating it from m_phiChildren inside AI.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2016-09-06  Saam Barati  <sbarati@apple.com>
+
+        Make JSMap and JSSet faster
+        https://bugs.webkit.org/show_bug.cgi?id=160989
+
+        Reviewed by Filip Pizlo.
+
+        This patch revamps how we implement Map and Set. It uses
+        a new hash map implementation. The hash map uses linear
+        probing and it uses Wang's 64 bit hash function for JSValues
+        that aren't strings. Strings use StringImpl's hash function.
+        The reason I wanted to roll our own HashTable is twofold:
+        I didn't want to inline WTF::HashMap's implementation into our
+        JIT, since that seems error prone and unmaintainable. Also, I wanted
+        a different structure for hash map buckets where buckets also exist in
+        a linked list.
+
+        The reason for making buckets part of a linked list is that iteration
+        is now simple. Iteration works by just traversing a linked list.
+        This design also allows for a simple implementation when doing iteration
+        while the hash table is mutating. Whenever we remove a bucket from
+        the hash table, it is removed from the list, meaning items in the
+        list don't point to it. However, the removed bucket will still point
+        to things that are either in the list, or have also been removed.
+        e.g, from a removed bucket, you can always follow pointers until you
+        either find an item in the list, or you find the tail of the list.
+        This is a really nice property because it means that a Map or Set
+        does not need to reason about the all the iterators that point
+        into its list. Also, whenever we add items to the Map or Set, we
+        hijack the tail as the new item, and make the new item point to a newly
+        created tail. This means that any iterator that pointed to the "tail" now
+        points to non-tail items. This makes the implementation of adding things
+        to the Map/Set while iterating easy.
+
+        I also made Map.prototype.get, Map.prototype.has, and Set.prototype.has
+        into intrinsics in the DFG. The IR can now reason about hash map
+        operations and can even do CSE over Wang's hash function, hash map
+        bucket lookups, hash map bucket loads, and testing if a key is in
+        the hash table. This makes code patterns for Map like so, super fast
+        in the FTL, since we will only be doing a single hash and hash bucket lookup:
+
+        ```
+        function getKeyIfPresent(map, key) {
+            if (map.has(key))
+                return map.get(key);
+        }
+        ```
+
+        This patch is roughly an 8% speedup on ES6SampleBench.
+
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::not64):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromClassInfo):
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::shift):
+        (JSC::DFG::Edge::makeWord):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateMapObject):
+        (JSC::DFG::SpeculativeJIT::speculateSetObject):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLoadFromJSMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsNonEmptyMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::lowMapObject):
+        (JSC::FTL::DFG::LowerDFGToB3::lowSetObject):
+        (JSC::FTL::DFG::LowerDFGToB3::lowMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::speculate):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateMapObject):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateSetObject):
+        (JSC::FTL::DFG::LowerDFGToB3::setMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::lowRegExpObject): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::lowStorage): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::speculateRegExpObject): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::setStorage): Deleted.
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::wangsInt64Hash):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.
+        * jit/JITOperations.h:
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::ModuleAnalyzer):
+        * runtime/HashMapImpl.cpp: Added.
+        (JSC::HashMapBucket<Data>::visitChildren):
+        (JSC::HashMapImpl<HashMapBucket>::visitChildren):
+        (JSC::HashMapImpl<HashMapBucket>::copyBackingStore):
+        * runtime/HashMapImpl.h: Added.
+        (JSC::HashMapBucket::selectStructure):
+        (JSC::HashMapBucket::createStructure):
+        (JSC::HashMapBucket::create):
+        (JSC::HashMapBucket::HashMapBucket):
+        (JSC::HashMapBucket::setNext):
+        (JSC::HashMapBucket::setPrev):
+        (JSC::HashMapBucket::setKey):
+        (JSC::HashMapBucket::setValue):
+        (JSC::HashMapBucket::key):
+        (JSC::HashMapBucket::value):
+        (JSC::HashMapBucket::next):
+        (JSC::HashMapBucket::prev):
+        (JSC::HashMapBucket::deleted):
+        (JSC::HashMapBucket::setDeleted):
+        (JSC::HashMapBucket::offsetOfKey):
+        (JSC::HashMapBucket::offsetOfValue):
+        (JSC::HashMapBuffer::allocationSize):
+        (JSC::HashMapBuffer::buffer):
+        (JSC::HashMapBuffer::create):
+        (JSC::areKeysEqual):
+        (JSC::normalizeMapKey):
+        (JSC::jsMapHash):
+        (JSC::HashMapImpl::selectStructure):
+        (JSC::HashMapImpl::createStructure):
+        (JSC::HashMapImpl::create):
+        (JSC::HashMapImpl::HashMapImpl):
+        (JSC::HashMapImpl::buffer):
+        (JSC::HashMapImpl::finishCreation):
+        (JSC::HashMapImpl::emptyValue):
+        (JSC::HashMapImpl::isEmpty):
+        (JSC::HashMapImpl::deletedValue):
+        (JSC::HashMapImpl::isDeleted):
+        (JSC::HashMapImpl::findBucket):
+        (JSC::HashMapImpl::get):
+        (JSC::HashMapImpl::has):
+        (JSC::HashMapImpl::add):
+        (JSC::HashMapImpl::remove):
+        (JSC::HashMapImpl::size):
+        (JSC::HashMapImpl::clear):
+        (JSC::HashMapImpl::bufferSizeInBytes):
+        (JSC::HashMapImpl::offsetOfBuffer):
+        (JSC::HashMapImpl::offsetOfCapacity):
+        (JSC::HashMapImpl::head):
+        (JSC::HashMapImpl::tail):
+        (JSC::HashMapImpl::approximateSize):
+        (JSC::HashMapImpl::findBucketAlreadyHashedAndNormalized):
+        (JSC::HashMapImpl::rehash):
+        (JSC::HashMapImpl::makeAndSetNewBuffer):
+        * runtime/Intrinsic.h:
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::sameValue):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSMap.cpp:
+        (JSC::JSMap::destroy): Deleted.
+        (JSC::JSMap::estimatedSize): Deleted.
+        (JSC::JSMap::visitChildren): Deleted.
+        (JSC::JSMap::copyBackingStore): Deleted.
+        (JSC::JSMap::has): Deleted.
+        (JSC::JSMap::size): Deleted.
+        (JSC::JSMap::get): Deleted.
+        (JSC::JSMap::set): Deleted.
+        (JSC::JSMap::clear): Deleted.
+        (JSC::JSMap::remove): Deleted.
+        * runtime/JSMap.h:
+        (JSC::JSMap::createStructure):
+        (JSC::JSMap::create):
+        (JSC::JSMap::get):
+        (JSC::JSMap::set):
+        (JSC::JSMap::JSMap):
+        (JSC::JSMap::Entry::key): Deleted.
+        (JSC::JSMap::Entry::value): Deleted.
+        (JSC::JSMap::Entry::visitChildren): Deleted.
+        (JSC::JSMap::Entry::setKey): Deleted.
+        (JSC::JSMap::Entry::setKeyWithoutWriteBarrier): Deleted.
+        (JSC::JSMap::Entry::setValue): Deleted.
+        (JSC::JSMap::Entry::clear): Deleted.
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::finishCreation):
+        (JSC::JSMapIterator::visitChildren):
+        (JSC::JSMapIterator::clone):
+        * runtime/JSMapIterator.h:
+        (JSC::JSMapIterator::advanceIter):
+        (JSC::JSMapIterator::next):
+        (JSC::JSMapIterator::nextKeyValue):
+        (JSC::JSMapIterator::JSMapIterator):
+        (JSC::JSMapIterator::setIterator):
+        (JSC::JSMapIterator::finish): Deleted.
+        (JSC::JSMapIterator::iteratorData): Deleted.
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::finishCreation):
+        * runtime/JSModuleLoader.h:
+        (JSC::JSModuleLoader::create):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::finishCreation):
+        * runtime/JSModuleRecord.h:
+        (JSC::JSModuleRecord::create):
+        * runtime/JSSet.cpp:
+        (JSC::JSSet::destroy): Deleted.
+        (JSC::JSSet::estimatedSize): Deleted.
+        (JSC::JSSet::visitChildren): Deleted.
+        (JSC::JSSet::copyBackingStore): Deleted.
+        (JSC::JSSet::has): Deleted.
+        (JSC::JSSet::size): Deleted.
+        (JSC::JSSet::add): Deleted.
+        (JSC::JSSet::clear): Deleted.
+        (JSC::JSSet::remove): Deleted.
+        * runtime/JSSet.h:
+        (JSC::JSSet::createStructure):
+        (JSC::JSSet::create):
+        (JSC::JSSet::add):
+        (JSC::JSSet::JSSet):
+        (JSC::JSSet::Entry::key): Deleted.
+        (JSC::JSSet::Entry::value): Deleted.
+        (JSC::JSSet::Entry::visitChildren): Deleted.
+        (JSC::JSSet::Entry::setKey): Deleted.
+        (JSC::JSSet::Entry::setKeyWithoutWriteBarrier): Deleted.
+        (JSC::JSSet::Entry::setValue): Deleted.
+        (JSC::JSSet::Entry::clear): Deleted.
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::finishCreation):
+        (JSC::JSSetIterator::visitChildren):
+        (JSC::JSSetIterator::clone):
+        * runtime/JSSetIterator.h:
+        (JSC::JSSetIterator::advanceIter):
+        (JSC::JSSetIterator::next):
+        (JSC::JSSetIterator::JSSetIterator):
+        (JSC::JSSetIterator::setIterator):
+        (JSC::JSSetIterator::finish): Deleted.
+        (JSC::JSSetIterator::iteratorData): Deleted.
+        * runtime/JSType.h:
+        * runtime/MapBase.cpp: Added.
+        (JSC::MapBase<HashMapBucketType>::visitChildren):
+        (JSC::MapBase<HashMapBucketType>::estimatedSize):
+        * runtime/MapBase.h: Added.
+        (JSC::MapBase::size):
+        (JSC::MapBase::has):
+        (JSC::MapBase::clear):
+        (JSC::MapBase::remove):
+        (JSC::MapBase::findBucket):
+        (JSC::MapBase::offsetOfHashMapImpl):
+        (JSC::MapBase::impl):
+        (JSC::MapBase::finishCreation):
+        (JSC::MapBase::MapBase):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        (JSC::getMap):
+        (JSC::privateFuncIsMap):
+        (JSC::privateFuncMapIteratorNext):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::sameValue): Deleted.
+        * runtime/PropertyDescriptor.h:
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototypeFuncNext):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        (JSC::getSet):
+        (JSC::privateFuncSetIteratorNext):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make ArithClz32 work with Cell arguments
+        https://bugs.webkit.org/show_bug.cgi?id=161369
+
+        Reviewed by Geoffrey Garen.
+
+        ArithClz32 was already working with all primitive types
+        thanks to the magic of ValueToInt32.
+        This patch adds support for cell arguments through a function
+        call.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithClz32):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithClz32):
+
+2016-09-06  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: change to use old header guard to appease Win EWS.
+
+        Not reviewed.
+
+        * runtime/AuxiliaryBarrier.h:
+
+2016-09-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r205494.
+        https://bugs.webkit.org/show_bug.cgi?id=161646
+
+        This change broke the Windows build (Requested by ryanhaddad
+        on #webkit).
+
+        Reverted changeset:
+
+        "Typed arrays should use MarkedSpace instead of CopiedSpace"
+        https://bugs.webkit.org/show_bug.cgi?id=161100
+        http://trac.webkit.org/changeset/205494
+
+2016-09-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r205504.
+        https://bugs.webkit.org/show_bug.cgi?id=161645
+
+        Broke the iOS device build (Requested by ryanhaddad on
+        #webkit).
+
+        Reverted changeset:
+
+        "Make JSMap and JSSet faster"
+        https://bugs.webkit.org/show_bug.cgi?id=160989
+        http://trac.webkit.org/changeset/205504
+
+2016-09-06  Saam Barati  <sbarati@apple.com>
+
+        Make JSMap and JSSet faster
+        https://bugs.webkit.org/show_bug.cgi?id=160989
+
+        Reviewed by Filip Pizlo.
+
+        This patch revamps how we implement Map and Set. It uses
+        a new hash map implementation. The hash map uses linear
+        probing and it uses Wang's 64 bit hash function for JSValues
+        that aren't strings. Strings use StringImpl's hash function.
+        The reason I wanted to roll our own HashTable is twofold:
+        I didn't want to inline WTF::HashMap's implementation into our
+        JIT, since that seems error prone and unmaintainable. Also, I wanted
+        a different structure for hash map buckets where buckets also exist in
+        a linked list.
+
+        The reason for making buckets part of a linked list is that iteration
+        is now simple. Iteration works by just traversing a linked list.
+        This design also allows for a simple implementation when doing iteration
+        while the hash table is mutating. Whenever we remove a bucket from
+        the hash table, it is removed from the list, meaning items in the
+        list don't point to it. However, the removed bucket will still point
+        to things that are either in the list, or have also been removed.
+        e.g, from a removed bucket, you can always follow pointers until you
+        either find an item in the list, or you find the tail of the list.
+        This is a really nice property because it means that a Map or Set
+        does not need to reason about the all the iterators that point
+        into its list. Also, whenever we add items to the Map or Set, we
+        hijack the tail as the new item, and make the new item point to a newly
+        created tail. This means that any iterator that pointed to the "tail" now
+        points to non-tail items. This makes the implementation of adding things
+        to the Map/Set while iterating easy.
+
+        I also made Map.prototype.get, Map.prototype.has, and Set.prototype.has
+        into intrinsics in the DFG. The IR can now reason about hash map
+        operations and can even do CSE over Wang's hash function, hash map
+        bucket lookups, hash map bucket loads, and testing if a key is in
+        the hash table. This makes code patterns for Map like so, super fast
+        in the FTL, since we will only be doing a single hash and hash bucket lookup:
+
+        ```
+        function getKeyIfPresent(map, key) {
+            if (map.has(key))
+                return map.get(key);
+        }
+        ```
+
+        This patch is roughly an 8% speedup on ES6SampleBench.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SpeculatedType.cpp:
+        (JSC::speculationFromClassInfo):
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::execute):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::shift):
+        (JSC::DFG::Edge::makeWord):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateMapObject):
+        (JSC::DFG::SpeculativeJIT::speculateSetObject):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMapHash):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLoadFromJSMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsNonEmptyMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::lowMapObject):
+        (JSC::FTL::DFG::LowerDFGToB3::lowSetObject):
+        (JSC::FTL::DFG::LowerDFGToB3::lowMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::speculate):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateMapObject):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateSetObject):
+        (JSC::FTL::DFG::LowerDFGToB3::setMapBucket):
+        (JSC::FTL::DFG::LowerDFGToB3::lowRegExpObject): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::lowStorage): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::speculateRegExpObject): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::setStorage): Deleted.
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::wangsInt64Hash):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.
+        * jit/JITOperations.h:
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::ModuleAnalyzer):
+        * runtime/HashMapImpl.cpp: Added.
+        (JSC::HashMapBucket<Data>::visitChildren):
+        (JSC::HashMapImpl<HashMapBucket>::visitChildren):
+        (JSC::HashMapImpl<HashMapBucket>::copyBackingStore):
+        * runtime/HashMapImpl.h: Added.
+        (JSC::HashMapBucket::selectStructure):
+        (JSC::HashMapBucket::createStructure):
+        (JSC::HashMapBucket::create):
+        (JSC::HashMapBucket::HashMapBucket):
+        (JSC::HashMapBucket::setNext):
+        (JSC::HashMapBucket::setPrev):
+        (JSC::HashMapBucket::setKey):
+        (JSC::HashMapBucket::setValue):
+        (JSC::HashMapBucket::key):
+        (JSC::HashMapBucket::value):
+        (JSC::HashMapBucket::next):
+        (JSC::HashMapBucket::prev):
+        (JSC::HashMapBucket::deleted):
+        (JSC::HashMapBucket::setDeleted):
+        (JSC::HashMapBucket::offsetOfKey):
+        (JSC::HashMapBucket::offsetOfValue):
+        (JSC::HashMapBuffer::allocationSize):
+        (JSC::HashMapBuffer::buffer):
+        (JSC::HashMapBuffer::create):
+        (JSC::areKeysEqual):
+        (JSC::normalizeMapKey):
+        (JSC::jsMapHash):
+        (JSC::HashMapImpl::selectStructure):
+        (JSC::HashMapImpl::createStructure):
+        (JSC::HashMapImpl::create):
+        (JSC::HashMapImpl::HashMapImpl):
+        (JSC::HashMapImpl::buffer):
+        (JSC::HashMapImpl::finishCreation):
+        (JSC::HashMapImpl::emptyValue):
+        (JSC::HashMapImpl::isEmpty):
+        (JSC::HashMapImpl::deletedValue):
+        (JSC::HashMapImpl::isDeleted):
+        (JSC::HashMapImpl::findBucket):
+        (JSC::HashMapImpl::get):
+        (JSC::HashMapImpl::has):
+        (JSC::HashMapImpl::add):
+        (JSC::HashMapImpl::remove):
+        (JSC::HashMapImpl::size):
+        (JSC::HashMapImpl::clear):
+        (JSC::HashMapImpl::bufferSizeInBytes):
+        (JSC::HashMapImpl::offsetOfBuffer):
+        (JSC::HashMapImpl::offsetOfCapacity):
+        (JSC::HashMapImpl::head):
+        (JSC::HashMapImpl::tail):
+        (JSC::HashMapImpl::approximateSize):
+        (JSC::HashMapImpl::findBucketAlreadyHashedAndNormalized):
+        (JSC::HashMapImpl::rehash):
+        (JSC::HashMapImpl::makeAndSetNewBuffer):
+        * runtime/Intrinsic.h:
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::sameValue):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSMap.cpp:
+        (JSC::JSMap::destroy): Deleted.
+        (JSC::JSMap::estimatedSize): Deleted.
+        (JSC::JSMap::visitChildren): Deleted.
+        (JSC::JSMap::copyBackingStore): Deleted.
+        (JSC::JSMap::has): Deleted.
+        (JSC::JSMap::size): Deleted.
+        (JSC::JSMap::get): Deleted.
+        (JSC::JSMap::set): Deleted.
+        (JSC::JSMap::clear): Deleted.
+        (JSC::JSMap::remove): Deleted.
+        * runtime/JSMap.h:
+        (JSC::JSMap::createStructure):
+        (JSC::JSMap::create):
+        (JSC::JSMap::get):
+        (JSC::JSMap::set):
+        (JSC::JSMap::JSMap):
+        (JSC::JSMap::Entry::key): Deleted.
+        (JSC::JSMap::Entry::value): Deleted.
+        (JSC::JSMap::Entry::visitChildren): Deleted.
+        (JSC::JSMap::Entry::setKey): Deleted.
+        (JSC::JSMap::Entry::setKeyWithoutWriteBarrier): Deleted.
+        (JSC::JSMap::Entry::setValue): Deleted.
+        (JSC::JSMap::Entry::clear): Deleted.
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::finishCreation):
+        (JSC::JSMapIterator::visitChildren):
+        (JSC::JSMapIterator::clone):
+        * runtime/JSMapIterator.h:
+        (JSC::JSMapIterator::advanceIter):
+        (JSC::JSMapIterator::next):
+        (JSC::JSMapIterator::nextKeyValue):
+        (JSC::JSMapIterator::JSMapIterator):
+        (JSC::JSMapIterator::setIterator):
+        (JSC::JSMapIterator::finish): Deleted.
+        (JSC::JSMapIterator::iteratorData): Deleted.
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::finishCreation):
+        * runtime/JSModuleLoader.h:
+        (JSC::JSModuleLoader::create):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::finishCreation):
+        * runtime/JSModuleRecord.h:
+        (JSC::JSModuleRecord::create):
+        * runtime/JSSet.cpp:
+        (JSC::JSSet::destroy): Deleted.
+        (JSC::JSSet::estimatedSize): Deleted.
+        (JSC::JSSet::visitChildren): Deleted.
+        (JSC::JSSet::copyBackingStore): Deleted.
+        (JSC::JSSet::has): Deleted.
+        (JSC::JSSet::size): Deleted.
+        (JSC::JSSet::add): Deleted.
+        (JSC::JSSet::clear): Deleted.
+        (JSC::JSSet::remove): Deleted.
+        * runtime/JSSet.h:
+        (JSC::JSSet::createStructure):
+        (JSC::JSSet::create):
+        (JSC::JSSet::add):
+        (JSC::JSSet::JSSet):
+        (JSC::JSSet::Entry::key): Deleted.
+        (JSC::JSSet::Entry::value): Deleted.
+        (JSC::JSSet::Entry::visitChildren): Deleted.
+        (JSC::JSSet::Entry::setKey): Deleted.
+        (JSC::JSSet::Entry::setKeyWithoutWriteBarrier): Deleted.
+        (JSC::JSSet::Entry::setValue): Deleted.
+        (JSC::JSSet::Entry::clear): Deleted.
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::finishCreation):
+        (JSC::JSSetIterator::visitChildren):
+        (JSC::JSSetIterator::clone):
+        * runtime/JSSetIterator.h:
+        (JSC::JSSetIterator::advanceIter):
+        (JSC::JSSetIterator::next):
+        (JSC::JSSetIterator::JSSetIterator):
+        (JSC::JSSetIterator::setIterator):
+        (JSC::JSSetIterator::finish): Deleted.
+        (JSC::JSSetIterator::iteratorData): Deleted.
+        * runtime/JSType.h:
+        * runtime/MapBase.cpp: Added.
+        (JSC::MapBase<HashMapBucketType>::visitChildren):
+        (JSC::MapBase<HashMapBucketType>::estimatedSize):
+        * runtime/MapBase.h: Added.
+        (JSC::MapBase::size):
+        (JSC::MapBase::has):
+        (JSC::MapBase::clear):
+        (JSC::MapBase::remove):
+        (JSC::MapBase::findBucket):
+        (JSC::MapBase::offsetOfHashMapImpl):
+        (JSC::MapBase::impl):
+        (JSC::MapBase::finishCreation):
+        (JSC::MapBase::MapBase):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        (JSC::getMap):
+        (JSC::privateFuncIsMap):
+        (JSC::privateFuncMapIteratorNext):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::sameValue): Deleted.
+        * runtime/PropertyDescriptor.h:
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototypeFuncNext):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        (JSC::getSet):
+        (JSC::privateFuncSetIteratorNext):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-09-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Typed arrays should use MarkedSpace instead of CopiedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=161100
+
+        Reviewed by Geoffrey Garen.
+        
+        This moves typed array backing stores out of CopiedSpace and into Auxiliary MarkedSpace.
+        
+        This is a purely mechanical change since Auxiliary MarkedSpace already knows how to do
+        everything that typed arrays want.
+
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::newTypedArrayWithSize):
+        * dfg/DFGOperations.h:
+        (JSC::DFG::operationNewTypedArrayWithSizeForType):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage): Deleted.
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+        (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
+        (JSC::FTL::DFG::LowerDFGToB3::splatWords):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorage): Deleted.
+        * heap/CopyToken.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::markAuxiliary):
+        * jit/JITOperations.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        (JSC::JSArrayBufferView::JSArrayBufferView):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::createWithFastVector):
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        (JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore): Deleted.
+
+2016-09-06  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        Silence GCC warning spam introduced in r205462
+
+        Rubber-stamped by Filip Pizlo.
+
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+
+2016-09-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Heap::isMarked() should use concurrent lazy flipping
+        https://bugs.webkit.org/show_bug.cgi?id=161613
+
+        Reviewed by Michael Catanzaro.
+        
+        I found out about this race condition via
+        https://bugs.webkit.org/show_bug.cgi?id=160125#c233.
+        
+        The problem is that we use isMarked, and maybe even isLive, inside the concurrent mark
+        phase. So, they need to lazy-flip in a non-racy way.
+
+        * heap/HeapInlines.h:
+        (JSC::Heap::isLive):
+        (JSC::Heap::isMarked):
+
+2016-09-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, reset generator test results after the butterflies.
+
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
+        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:
+
+2016-09-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop build.
+
+        * bytecode/SuperSampler.cpp:
+
+2016-08-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
+        https://bugs.webkit.org/show_bug.cgi?id=160125
+
+        Reviewed by Geoffrey Garen and Keith Miller.
+
+        In order to make the GC concurrent (bug 149432), we would either need to enable concurrent
+        copying or we would need to not copy. Concurrent copying carries a 1-2% throughput overhead
+        from the barriers alone. Considering that MarkedSpace does a decent job of avoiding
+        fragmentation, it's unlikely that it's worth paying 1-2% throughput for copying. So, we want
+        to get rid of copied space. This change moves copied space's biggest client over to marked
+        space.
+        
+        Moving butterflies to marked space means having them use the new Auxiliary HeapCell
+        allocation path. This is a fairly mechanical change, but it caused performance regressions
+        everywhere, so this change also fixes MarkedSpace's performance issues.
+        
+        At a high level the mechanical changes are:
+        
+        - We use AuxiliaryBarrier instead of CopyBarrier.
+        
+        - We use tryAllocateAuxiliary instead of tryAllocateStorage. I got rid of the silly
+          CheckedBoolean stuff, since it's so much more trouble than it's worth.
+        
+        - The JITs have to emit inlined marked space allocations instead of inline copy space
+          allocations.
+        
+        - Everyone has to get used to zeroing their butterflies after allocation instead of relying
+          on them being pre-zeroed by the GC. Copied space would zero things for you, while marked
+          space doesn't.
+        
+        That's about 1/3 of this change. But this led to performance problems, which I fixed with
+        optimizations that amounted to a major MarkedSpace rewrite:
+        
+        - MarkedSpace always causes internal fragmentation for array allocations because the vector
+          length we choose when we resize usually leads to a cell size that doesn't correspond to any
+          size class. I got around this by making array allocations usually round up vectorLength to
+          the maximum allowed by the size class that we would have allocated in. Also,
+          ensureLengthSlow() and friends first make sure that the requested length can't just be
+          fulfilled with the current allocation size. This safeguard means that not every array
+          allocation has to do size class queries. For example, the fast path of new Array(length)
+          never does any size class queries, under the assumption that (1) the speed gained from
+          avoiding an ensureLengthSlow() call, which then just changes the vectorLength by doing the
+          size class query, is too small to offset the speed lost by doing the query on every
+          allocation and (2) new Array(length) is a pretty good hint that resizing is not very
+          likely.
+        
+        - Size classes in MarkedSpace were way too precise, which led to external fragmentation. This
+          changes MarkedSpace size classes to use a linear progression for very small sizes followed
+          by a geometric progression that naturally transitions to a hyperbolic progression. We want
+          hyperbolic sizes when we get close to blockSize: for example the largest size we want is
+          payloadSize / 2 rounded down, to ensure we get exactly two cells with minimal slop. The
+          next size down should be payloadSize / 3 rounded down, and so on. After the last precise
+          size (80 bytes), we proceed using a geometric progression, but round up each size to
+          minimize slop at the end of the block. This naturally causes the geometric progression to
+          turn hyperbolic for large sizes. The size class configuration happens at VM start-up, so
+          it can be controlled with runtime options. I found that a base of 1.4 works pretty well.
+        
+        - Large allocations caused massive internal fragmentation, since the smallest large
+          allocation had to use exactly blockSize, and the largest small allocation used
+          blockSize / 2. The next size up - the first large allocation size to require two blocks -
+          also had 50% internal fragmentation. This is because we required large allocations to be
+          blockSize aligned, so that MarkedBlock::blockFor() would work. I decided to rewrite all of
+          that. Cells no longer have to be owned by a MarkedBlock. They can now alternatively be
+          owned by a LargeAllocation. These two things are abstracted as CellContainer. You know that
+          a cell is owned by a LargeAllocation if the MarkedBlock::atomSize / 2 bit is set.
+          Basically, large allocations are deliberately misaligned by 8 bytes. This actually works
+          out great since (1) typed arrays won't use large allocations anyway since they have their
+          own malloc fallback and (2) large array butterflies already have a 8 byte header, which
+          means that the 8 byte base misalignment aligns the large array payload on a 16 byte
+          boundary. I took extreme care to make sure that the isLargeAllocation bit checks are as
+          rare as possible; for example, ExecState::vm() skips the check because we know that callees
+          must be small allocations. It's also possible to use template tricks to do one check for
+          cell container kind, and then invoke a function specialized for MarkedBlock or a function
+          specialized for LargeAllocation. LargeAllocation includes stubs for all MarkedBlock methods
+          that get used from functions that are template-specialized like this. That's mostly to
+          speed up the GC marking code. Most other code can use CellContainer API or HeapCell API
+          directly. That's another thing: HeapCell, the common base of JSCell and auxiliary
+          allocations, is now smart enough to do a lot of things for you, like HeapCell::vm(),
+          HeapCell::heap(), HeapCell::isLargeAllocation(), and HeapCell::cellContainer(). The size
+          cutoff for large allocations is runtime-configurable, so long as you don't choose something
+          so small that callees end up large. I found that 400 bytes is roughly optimal. This means
+          that the MarkedBlock size classes end up being:
+          
+          16, 32, 48, 64, 80, 112, 160, 224, 320
+          
+          The next size class would have been 432, but that's above the 400 byte cutoff. All of this
+          is configurable with --sizeClassProgression and --largeAllocationCutoff. You can see what
+          size classes you end up with by doing --dumpSizeClasses=true.
+        
+        - Copied space uses 64KB blocks, while marked space used to use 16KB blocks. Allocating a lot
+          of stuff in 16KB blocks was slower than allocating it in 64KB blocks because the GC had a
+          lot of per-block overhead. I removed this overhead: It's now 2x faster to scan all
+          MarkedBlocks because the list that contains the interesting meta-data is allocated on the
+          side, for better locality during a sequential walk. It's no longer necessary to scan
+          MarkedBlocks to find WeakSets, since the sets of WeakSets for eden scan and full scan are
+          maintained on-the-fly. It's no longer necessary to scan all MarkedBlocks to clear mark
+          bits because we now use versioned mark bits: to clear then, just increment the 64-bit
+          heap version. It's no longer necessary to scan retired MarkedBlocks while allocating
+          because marking retires them on-the-fly. It's no longer necessary to sort all blocks in
+          the IncrementalSweeper's snapshot because blocks now know if they are in the snapshot. Put
+          together, these optimizations allowed me to reduce block size to 16KB without losing much
+          performance. There is some small perf loss on JetStream/splay, but not enough to hurt
+          JetStream overall. I tried reducing block sizes further, to 4KB, since that is a
+          progression on membuster. That's not possible yet, since there is still enough per-block
+          overhead yet that such a reduction hurts JetStream too much. I filed a bug about improving
+          this further: https://bugs.webkit.org/show_bug.cgi?id=161581.
+        
+        - Even after all of that, copying butterflies was still faster because it allowed us to skip
+          sweeping dead space. A good GC allocates over dead bytes without explicitly freeing them,
+          so the GC pause is O(size of live), not O(size of live + dead). O(dead) is usually much
+          larger than O(live), especially in an eden collection. Copying satisfies this premise while
+          mark+sweep does not. So, I invented a new kind of allocator: bump'n'pop. Previously, our
+          MarkedSpace allocator was a freelist pop. That's simple and easy to inline but requires
+          that we walk the block to build a free list. This means walking dead space. The new
+          allocator allows totally free MarkedBlocks to simply set up a bump-pointer arena instead.
+          The allocator is a hybrid of bump-pointer and freelist pop. It tries bump first. The bump
+          pointer always bumps by cellSize, so the result of filling a block with bumping looks as if
+          we had used freelist popping to fill it. Additionally, each MarkedBlock now has a bit to
+          quickly tell if the block is entirely free. This makes sweeping O(1) whenever a MarkedBlock
+          is completely empty, which is the common case because of the generational hypothesis: the
+          number of objects that survive an eden collection is a tiny fraction of the number of
+          objects that had been allocated, and this fraction is so small that there are typically
+          fewer than one survivors per MarkedBlock. This change was enough to make this change a net
+          win over tip-of-tree.
+        
+        - FTL now shares the same allocation fast paths as everything else, which is great, because
+          bump'n'pop has gnarly control flow. We don't really want B3 to have to think about that
+          control flow, since it won't be able to improve the machine code we write ourselves. GC
+          fast paths are best written in assembly. So, I've empowered B3 to have even better support
+          for Patchpoint terminals. It's now totally fine for a Patchpoint terminal to be non-Void.
+          So, the new FTL allocation fast paths are just Patchpoint terminals that call through to
+          AssemblyHelpers::emitAllocate(). B3 still reasons about things like constant-folding the
+          size class calculation and constant-hoisting the allocator. Also, I gave the FTL the
+          ability to constant-fold some allocator logic (in case we first assume that we're doing a
+          variable-length allocation but then realize that the length is known). I think it makes
+          sense to have constant folding rules in FTL::Output, or whatever the B3 IR builder is,
+          since this makes lowering easier (you can constant fold during lowering more easily) and it
+          reduces the amount of malloc traffic. In the future, we could teach B3 how to better
+          constant-fold this code. That would require allowing loads to be constant-folded, which is
+          doable but hella tricky.
+        
+        - It used to be that if a logical object allocation required two physical allocations (first
+          the butterfly and then the cell), then the JIT would emit the code in such a way that a
+          failure in the second fast path would cause us to forget the successful first physical
+          allocation. This was pointlessly wasteful. It turns out that it's very cheap to devote a
+          register to storing either the butterfly or null, because the butterfly register is anyway
+          going to be free inside the first allocation. The only overhead here is zeroing the
+          butterfly register. With that in place, we can just pass the butterfly-or-null to the slow
+          path, which can then either allocate a butterfly or not. So now we never waste a successful
+          allocation. This patch implements such a solution both in DFG (where it's easy to do this
+          since we control registers already) and in FTL (where it's annoying, because mutable
+          "butterfly-or-null" variables are hard to say in SSA; also I realized that we had code
+          duplicated the JSArray allocation utility, so I deduplicated it). This came up because in
+          one version of this patch, this wastage would resonate with some Kraken benchmark: the
+          benchmark would always allocate N small things followed by one bigger thing. The problem
+          was I accidentally adjusted the various fixed overheads in MarkedBlock in such a way that
+          the JSObject size class, which both the small and big thing shared for their cell, could
+          hold exactly N cells per MarkedBlock. Then the benchmark would always call slow path when
+          it allocated the big thing. So, it would end up having to allocate the big thing's large
+          butterfly twice, every single time! Ouch!
+        
+        - It used to be that we zeroed CopiedBlocks using memset, and so array allocations enjoyed
+          amortization of the cost of zeroing. This doesn't work anymore - it's now up to the client
+          of the allocator to initialize the object to whatever state they need. It used to be that
+          we would just use a dumb loop. I initially changed this so that we would end up in memset
+          for large allocations, but this didn't actually help performance that much. I got a much
+          better result by playing with different memsets written in assembly. First I wrote one
+          using non-temporal stores. That was a small speed-up over memset. Then I tried the classic
+          "rep stos" approach, and holy cow that version was fast. It's a ~20% speed-up on array
+          allocation microbenchmarks. So, this patch adds code paths to do "rep stos" on x86_64, or
+          memset, or use a loop, as appropriate, for both "contiguous" arrays (holes are zero) and
+          double arrays (holes are PNaN). Note that the JIT always emits either a loop or a flat slab
+          of stores (if the size is known), but those paths in the JIT won't trigger for
+          NewArrayWithSize() if the size is large, since that takes us to the
+          operationNewArrayWithSize() slow path, which calls into JSArray::create(). That's why the
+          optimizations here are all in JSArray::create() - that's the hot place for large arrays
+          that need to be filled with holes.
+        
+        All of this put together gives us neutral perf on JetStream,  membuster, and PLT3, a ~1%
+        regression on Speedometer, and up to a 4% regression Kraken. The Kraken regression is
+        because Kraken was allocating exactly 1024 element arrays at a rate of 400MB/sec. This is a
+        best-case scenario for bump allocation. I think that we should fix bmalloc to make up the
+        difference, but take the hit for now because it's a crazy corner case. By comparison, the
+        alternative approach of using a copy barrier would have cost us 1-2%. That's the real
+        apples-to-apples comparison if your premise is that we should have a concurrent GC. After we
+        finish removing copied space, we will be barrier-ready for concurrent GC: we already have a
+        marking barrier and we simply won't need a copying barrier. This change gets us there for
+        the purposes of our benchmarks, since the remaining clients of copied space are not very
+        important. On the other hand, if we keep copying, then getting barrier-ready would mean
+        adding back the copy barrier, which costs more perf.
+        
+        We might get bigger speed-ups once we remove CopiedSpace altogether. That requires moving
+        typed arrays and a few other weird things over to Aux MarkedSpace.
+        
+        This also includes some header sanitization. The introduction of AuxiliaryBarrier, HeapCell,
+        and CellContainer meant that I had to include those files from everywhere. Fortunately,
+        just including JSCInlines.h (instead of manually including the files that includes) is
+        usually enough. So, I made most of JSC's cpp files include JSCInlines.h, which is something
+        that we were already basically doing. In places where JSCInlines.h would be too much, I just
+        included HeapInlines.h. This got weird, because we previously included HeapInlines.h from
+        JSObject.h. That's bad because it led to some circular dependencies, so I fixed it - but that
+        meant having to manually include HeapInlines.h from the places that previously got it
+        implicitly via JSObject.h. But that led to more problems for some reason: I started getting
+        build errors because non-JSC files were having trouble including Opcode.h. That's just silly,
+        since Opcode.h is meant to be an internal JSC header. So, I made it an internal header and
+        made it impossible to include it from outside JSC. This was a lot of work, but it was
+        necessary to get the patch to build on all ports. It's also a net win. There were many places
+        in WebCore that were transitively including a *ton* of JSC headers just because of the
+        JSObject.h->HeapInlines.h edge and a bunch of dependency edges that arose from some public
+        (for WebCore) JSC headers needing Interpreter.h or Opcode.h for bad reasons.
+
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue initWithValue:]):
+        * API/JSTypedArray.cpp:
+        * API/ObjCCallbackFunction.mm:
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI):
+        (testWeakValue): Deleted.
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Scripts/builtins/builtins_generate_combined_implementation.py:
+        (BuiltinsCombinedImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
+        (BuiltinsInternalsWrapperImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generate_separate_implementation.py:
+        (BuiltinsSeparateImplementationGenerator.generate_secondary_header_includes):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::link):
+        (JSC::AbstractMacroAssembler::JumpList::linkTo):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::add32):
+        * assembler/MacroAssemblerCodeRef.cpp: Added.
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
+        (JSC::MacroAssemblerCodePtr::dumpWithName):
+        (JSC::MacroAssemblerCodePtr::dump):
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
+        (JSC::MacroAssemblerCodeRef::dump):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr): Deleted.
+        (JSC::MacroAssemblerCodePtr::dumpWithName): Deleted.
+        (JSC::MacroAssemblerCodePtr::dump): Deleted.
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef): Deleted.
+        (JSC::MacroAssemblerCodeRef::dump): Deleted.
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::appendBoolConstant):
+        * b3/B3BasicBlock.h:
+        * b3/B3DuplicateTails.cpp:
+        * b3/B3StackmapGenerationParams.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testPatchpointTerminalReturnValue):
+        (JSC::B3::run):
+        * bindings/ScriptValue.cpp:
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp:
+        * bytecode/BytecodeBasicBlock.cpp:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        * bytecode/BytecodeUseDef.h:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::callTypeFor):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::callTypeFor): Deleted.
+        * bytecode/CallLinkStatus.cpp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::clearLLIntGetByIdCache):
+        (JSC::CodeBlock::predictedMachineCodeSize):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::jitCodeMap): Deleted.
+        (JSC::clearLLIntGetByIdCache): Deleted.
+        * bytecode/ExecutionCounter.h:
+        * bytecode/Instruction.h:
+        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:
+        (JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::fireInternal):
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::isNull):
+        (JSC::ObjectAllocationProfile::initialize):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/PolymorphicAccess.h:
+        * bytecode/PreciseJumpTargets.cpp:
+        * bytecode/StructureStubInfo.cpp:
+        * bytecode/StructureStubInfo.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::vm): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecode/UnlinkedInstructionStream.cpp:
+        * bytecode/UnlinkedInstructionStream.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLJITFinalizer.cpp:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateHeapCell):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatorForSize):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileAllocateArrayWithSize): Deleted.
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::add):
+        (JSC::FTL::Output::shl):
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        (JSC::FTL::Output::above):
+        (JSC::FTL::Output::aboveOrEqual):
+        (JSC::FTL::Output::below):
+        (JSC::FTL::Output::belowOrEqual):
+        (JSC::FTL::Output::greaterThan):
+        (JSC::FTL::Output::greaterThanOrEqual):
+        (JSC::FTL::Output::lessThan):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::select):
+        (JSC::FTL::Output::appendSuccessor):
+        (JSC::FTL::Output::addIncomingToPhi):
+        * ftl/FTLOutput.h:
+        * ftl/FTLValueFromBlock.h:
+        (JSC::FTL::ValueFromBlock::operator bool):
+        (JSC::FTL::ValueFromBlock::ValueFromBlock): Deleted.
+        * ftl/FTLWeightedTarget.h:
+        (JSC::FTL::WeightedTarget::frequentedBlock):
+        * heap/CellContainer.h: Added.
+        (JSC::CellContainer::CellContainer):
+        (JSC::CellContainer::operator bool):
+        (JSC::CellContainer::isMarkedBlock):
+        (JSC::CellContainer::isLargeAllocation):
+        (JSC::CellContainer::markedBlock):
+        (JSC::CellContainer::largeAllocation):
+        * heap/CellContainerInlines.h: Added.
+        (JSC::CellContainer::isMarked):
+        (JSC::CellContainer::isMarkedOrNewlyAllocated):
+        (JSC::CellContainer::noteMarked):
+        (JSC::CellContainer::cellSize):
+        (JSC::CellContainer::weakSet):
+        (JSC::CellContainer::flipIfNecessary):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::~ConservativeRoots):
+        (JSC::ConservativeRoots::grow):
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::genericAddSpan):
+        * heap/ConservativeRoots.h:
+        (JSC::ConservativeRoots::roots):
+        * heap/CopyToken.h:
+        * heap/FreeList.cpp: Added.
+        (JSC::FreeList::dump):
+        * heap/FreeList.h: Added.
+        (JSC::FreeList::FreeList):
+        (JSC::FreeList::list):
+        (JSC::FreeList::bump):
+        (JSC::FreeList::operator==):
+        (JSC::FreeList::operator!=):
+        (JSC::FreeList::operator bool):
+        (JSC::FreeList::allocationWillFail):
+        (JSC::FreeList::allocationWillSucceed):
+        * heap/GCTypeMap.h: Added.
+        (JSC::GCTypeMap::operator[]):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::finalizeUnconditionalFinalizers):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::gatherStackRoots):
+        (JSC::Heap::gatherJSStackRoots):
+        (JSC::Heap::gatherScratchBufferRoots):
+        (JSC::Heap::clearLivenessData):
+        (JSC::Heap::visitSmallStrings):
+        (JSC::Heap::visitConservativeRoots):
+        (JSC::Heap::removeDeadCompilerWorklistEntries):
+        (JSC::Heap::gatherExtraHeapSnapshotData):
+        (JSC::Heap::removeDeadHeapSnapshotNodes):
+        (JSC::Heap::visitProtectedObjects):
+        (JSC::Heap::visitArgumentBuffers):
+        (JSC::Heap::visitException):
+        (JSC::Heap::visitStrongHandles):
+        (JSC::Heap::visitHandleStack):
+        (JSC::Heap::visitSamplingProfiler):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        (JSC::Heap::converge):
+        (JSC::Heap::visitWeakHandles):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::clearUnmarkedExecutables):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::collectWithoutAnySweep):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::suspendCompilerThreads):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::flushOldStructureIDTables):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        (JSC::Heap::stopAllocation):
+        (JSC::Heap::prepareForMarking):
+        (JSC::Heap::reapWeakHandles):
+        (JSC::Heap::pruneStaleEntriesFromWeakGCMaps):
+        (JSC::Heap::sweepArrayBuffers):
+        (JSC::MarkedBlockSnapshotFunctor::MarkedBlockSnapshotFunctor):
+        (JSC::MarkedBlockSnapshotFunctor::operator()):
+        (JSC::Heap::snapshotMarkedSpace):
+        (JSC::Heap::deleteSourceProviderCaches):
+        (JSC::Heap::notifyIncrementalSweeper):
+        (JSC::Heap::writeBarrierCurrentlyExecutingCodeBlocks):
+        (JSC::Heap::resetAllocators):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::resumeCompilerThreads):
+        (JSC::Zombify::visit):
+        (JSC::Heap::forEachCodeBlockImpl):
+        * heap/Heap.h:
+        (JSC::Heap::allocatorForObjectWithoutDestructor):
+        (JSC::Heap::allocatorForObjectWithDestructor):
+        (JSC::Heap::allocatorForAuxiliaryData):
+        (JSC::Heap::jitStubRoutines):
+        (JSC::Heap::codeBlockSet):
+        (JSC::Heap::storageAllocator): Deleted.
+        * heap/HeapCell.h:
+        (JSC::HeapCell::isZapped): Deleted.
+        * heap/HeapCellInlines.h: Added.
+        (JSC::HeapCell::isLargeAllocation):
+        (JSC::HeapCell::cellContainer):
+        (JSC::HeapCell::markedBlock):
+        (JSC::HeapCell::largeAllocation):
+        (JSC::HeapCell::heap):
+        (JSC::HeapCell::vm):
+        (JSC::HeapCell::cellSize):
+        (JSC::HeapCell::allocatorAttributes):
+        (JSC::HeapCell::destructionMode):
+        (JSC::HeapCell::cellKind):
+        * heap/HeapInlines.h:
+        (JSC::Heap::heap):
+        (JSC::Heap::isLive):
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::setMarked):
+        (JSC::Heap::cellSize):
+        (JSC::Heap::forEachCodeBlock):
+        (JSC::Heap::allocateObjectOfType):
+        (JSC::Heap::subspaceForObjectOfType):
+        (JSC::Heap::allocatorForObjectOfType):
+        (JSC::Heap::allocateAuxiliary):
+        (JSC::Heap::tryAllocateAuxiliary):
+        (JSC::Heap::tryReallocateAuxiliary):
+        (JSC::Heap::isPointerGCObject): Deleted.
+        (JSC::Heap::isValueGCObject): Deleted.
+        * heap/HeapOperation.cpp: Added.
+        (WTF::printInternal):
+        * heap/HeapOperation.h:
+        * heap/HeapUtil.h: Added.
+        (JSC::HeapUtil::findGCObjectPointersForMarking):
+        (JSC::HeapUtil::isPointerGCObjectJSCell):
+        (JSC::HeapUtil::isValueGCObject):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::sweepNextBlock):
+        * heap/IncrementalSweeper.h:
+        * heap/LargeAllocation.cpp: Added.
+        (JSC::LargeAllocation::tryCreate):
+        (JSC::LargeAllocation::LargeAllocation):
+        (JSC::LargeAllocation::lastChanceToFinalize):
+        (JSC::LargeAllocation::shrink):
+        (JSC::LargeAllocation::visitWeakSet):
+        (JSC::LargeAllocation::reapWeakSet):
+        (JSC::LargeAllocation::flip):
+        (JSC::LargeAllocation::isEmpty):
+        (JSC::LargeAllocation::sweep):
+        (JSC::LargeAllocation::destroy):
+        (JSC::LargeAllocation::dump):
+        * heap/LargeAllocation.h: Added.
+        (JSC::LargeAllocation::fromCell):
+        (JSC::LargeAllocation::cell):
+        (JSC::LargeAllocation::isLargeAllocation):
+        (JSC::LargeAllocation::heap):
+        (JSC::LargeAllocation::vm):
+        (JSC::LargeAllocation::weakSet):
+        (JSC::LargeAllocation::clearNewlyAllocated):
+        (JSC::LargeAllocation::isNewlyAllocated):
+        (JSC::LargeAllocation::isMarked):
+        (JSC::LargeAllocation::isMarkedOrNewlyAllocated):
+        (JSC::LargeAllocation::isLive):
+        (JSC::LargeAllocation::hasValidCell):
+        (JSC::LargeAllocation::cellSize):
+        (JSC::LargeAllocation::aboveLowerBound):
+        (JSC::LargeAllocation::belowUpperBound):
+        (JSC::LargeAllocation::contains):
+        (JSC::LargeAllocation::attributes):
+        (JSC::LargeAllocation::flipIfNecessary):
+        (JSC::LargeAllocation::flipIfNecessaryConcurrently):
+        (JSC::LargeAllocation::testAndSetMarked):
+        (JSC::LargeAllocation::setMarked):
+        (JSC::LargeAllocation::clearMarked):
+        (JSC::LargeAllocation::noteMarked):
+        (JSC::LargeAllocation::headerSize):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::isPagedOut):
+        (JSC::MarkedAllocator::retire):
+        (JSC::MarkedAllocator::filterNextBlock):
+        (JSC::MarkedAllocator::setNextBlockToSweep):
+        (JSC::MarkedAllocator::tryAllocateWithoutCollectingImpl):
+        (JSC::MarkedAllocator::tryAllocateWithoutCollecting):
+        (JSC::MarkedAllocator::allocateSlowCase):
+        (JSC::MarkedAllocator::tryAllocateSlowCase):
+        (JSC::MarkedAllocator::allocateSlowCaseImpl):
+        (JSC::blockHeaderSize):
+        (JSC::MarkedAllocator::blockSizeForBytes):
+        (JSC::MarkedAllocator::tryAllocateBlock):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::stopAllocating):
+        (JSC::MarkedAllocator::reset):
+        (JSC::MarkedAllocator::lastChanceToFinalize):
+        (JSC::MarkedAllocator::setFreeList):
+        (JSC::isListPagedOut): Deleted.
+        (JSC::MarkedAllocator::tryAllocateHelper): Deleted.
+        (JSC::MarkedAllocator::tryPopFreeList): Deleted.
+        (JSC::MarkedAllocator::tryAllocate): Deleted.
+        (JSC::MarkedAllocator::allocateBlock): Deleted.
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::takeLastActiveBlock):
+        (JSC::MarkedAllocator::offsetOfFreeList):
+        (JSC::MarkedAllocator::offsetOfCellSize):
+        (JSC::MarkedAllocator::tryAllocate):
+        (JSC::MarkedAllocator::allocate):
+        (JSC::MarkedAllocator::forEachBlock):
+        (JSC::MarkedAllocator::offsetOfFreeListHead): Deleted.
+        (JSC::MarkedAllocator::MarkedAllocator): Deleted.
+        (JSC::MarkedAllocator::init): Deleted.
+        (JSC::MarkedAllocator::stopAllocating): Deleted.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::tryCreate):
+        (JSC::MarkedBlock::Handle::Handle):
+        (JSC::MarkedBlock::Handle::~Handle):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::Handle::specializedSweep):
+        (JSC::MarkedBlock::Handle::sweep):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectScribbleMode):
+        (JSC::MarkedBlock::Handle::sweepHelperSelectStateAndSweepMode):
+        (JSC::MarkedBlock::Handle::unsweepWithNoNewlyAllocated):
+        (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor):
+        (JSC::SetNewlyAllocatedFunctor::operator()):
+        (JSC::MarkedBlock::Handle::stopAllocating):
+        (JSC::MarkedBlock::Handle::lastChanceToFinalize):
+        (JSC::MarkedBlock::Handle::resumeAllocating):
+        (JSC::MarkedBlock::Handle::zap):
+        (JSC::MarkedBlock::Handle::forEachFreeCell):
+        (JSC::MarkedBlock::flipIfNecessary):
+        (JSC::MarkedBlock::Handle::flipIfNecessary):
+        (JSC::MarkedBlock::flipIfNecessarySlow):
+        (JSC::MarkedBlock::flipIfNecessaryConcurrentlySlow):
+        (JSC::MarkedBlock::clearMarks):
+        (JSC::MarkedBlock::assertFlipped):
+        (JSC::MarkedBlock::needsFlip):
+        (JSC::MarkedBlock::Handle::needsFlip):
+        (JSC::MarkedBlock::Handle::willRemoveBlock):
+        (JSC::MarkedBlock::Handle::didConsumeFreeList):
+        (JSC::MarkedBlock::markCount):
+        (JSC::MarkedBlock::Handle::isEmpty):
+        (JSC::MarkedBlock::clearHasAnyMarked):
+        (JSC::MarkedBlock::noteMarkedSlow):
+        (WTF::printInternal):
+        (JSC::MarkedBlock::create): Deleted.
+        (JSC::MarkedBlock::destroy): Deleted.
+        (JSC::MarkedBlock::callDestructor): Deleted.
+        (JSC::MarkedBlock::specializedSweep): Deleted.
+        (JSC::MarkedBlock::sweep): Deleted.
+        (JSC::MarkedBlock::sweepHelper): Deleted.
+        (JSC::MarkedBlock::stopAllocating): Deleted.
+        (JSC::MarkedBlock::clearMarksWithCollectionType): Deleted.
+        (JSC::MarkedBlock::lastChanceToFinalize): Deleted.
+        (JSC::MarkedBlock::resumeAllocating): Deleted.
+        (JSC::MarkedBlock::didRetireBlock): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::VoidFunctor::returnValue):
+        (JSC::MarkedBlock::CountFunctor::CountFunctor):
+        (JSC::MarkedBlock::CountFunctor::count):
+        (JSC::MarkedBlock::CountFunctor::returnValue):
+        (JSC::MarkedBlock::Handle::hasAnyNewlyAllocated):
+        (JSC::MarkedBlock::Handle::isOnBlocksToSweep):
+        (JSC::MarkedBlock::Handle::setIsOnBlocksToSweep):
+        (JSC::MarkedBlock::Handle::state):
+        (JSC::MarkedBlock::needsDestruction):
+        (JSC::MarkedBlock::handle):
+        (JSC::MarkedBlock::Handle::block):
+        (JSC::MarkedBlock::firstAtom):
+        (JSC::MarkedBlock::atoms):
+        (JSC::MarkedBlock::isAtomAligned):
+        (JSC::MarkedBlock::Handle::cellAlign):
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::Handle::allocator):
+        (JSC::MarkedBlock::Handle::heap):
+        (JSC::MarkedBlock::Handle::vm):
+        (JSC::MarkedBlock::vm):
+        (JSC::MarkedBlock::Handle::weakSet):
+        (JSC::MarkedBlock::weakSet):
+        (JSC::MarkedBlock::Handle::shrink):
+        (JSC::MarkedBlock::Handle::visitWeakSet):
+        (JSC::MarkedBlock::Handle::reapWeakSet):
+        (JSC::MarkedBlock::Handle::cellSize):
+        (JSC::MarkedBlock::cellSize):
+        (JSC::MarkedBlock::Handle::attributes):
+        (JSC::MarkedBlock::attributes):
+        (JSC::MarkedBlock::Handle::needsDestruction):
+        (JSC::MarkedBlock::Handle::destruction):
+        (JSC::MarkedBlock::Handle::cellKind):
+        (JSC::MarkedBlock::Handle::markCount):
+        (JSC::MarkedBlock::Handle::size):
+        (JSC::MarkedBlock::atomNumber):
+        (JSC::MarkedBlock::flipIfNecessary):
+        (JSC::MarkedBlock::flipIfNecessaryConcurrently):
+        (JSC::MarkedBlock::Handle::flipIfNecessary):
+        (JSC::MarkedBlock::Handle::flipIfNecessaryConcurrently):
+        (JSC::MarkedBlock::Handle::flipForEdenCollection):
+        (JSC::MarkedBlock::assertFlipped):
+        (JSC::MarkedBlock::Handle::assertFlipped):
+        (JSC::MarkedBlock::isMarked):
+        (JSC::MarkedBlock::testAndSetMarked):
+        (JSC::MarkedBlock::Handle::isNewlyAllocated):
+        (JSC::MarkedBlock::Handle::setNewlyAllocated):
+        (JSC::MarkedBlock::Handle::clearNewlyAllocated):
+        (JSC::MarkedBlock::Handle::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::Handle::isLive):
+        (JSC::MarkedBlock::isAtom):
+        (JSC::MarkedBlock::Handle::isLiveCell):
+        (JSC::MarkedBlock::Handle::forEachCell):
+        (JSC::MarkedBlock::Handle::forEachLiveCell):
+        (JSC::MarkedBlock::Handle::forEachDeadCell):
+        (JSC::MarkedBlock::Handle::needsSweeping):
+        (JSC::MarkedBlock::Handle::isAllocated):
+        (JSC::MarkedBlock::Handle::isMarked):
+        (JSC::MarkedBlock::Handle::isFreeListed):
+        (JSC::MarkedBlock::hasAnyMarked):
+        (JSC::MarkedBlock::noteMarked):
+        (WTF::MarkedBlockHash::hash):
+        (JSC::MarkedBlock::FreeList::FreeList): Deleted.
+        (JSC::MarkedBlock::allocator): Deleted.
+        (JSC::MarkedBlock::heap): Deleted.
+        (JSC::MarkedBlock::shrink): Deleted.
+        (JSC::MarkedBlock::visitWeakSet): Deleted.
+        (JSC::MarkedBlock::reapWeakSet): Deleted.
+        (JSC::MarkedBlock::willRemoveBlock): Deleted.
+        (JSC::MarkedBlock::didConsumeFreeList): Deleted.
+        (JSC::MarkedBlock::markCount): Deleted.
+        (JSC::MarkedBlock::isEmpty): Deleted.
+        (JSC::MarkedBlock::destruction): Deleted.
+        (JSC::MarkedBlock::cellKind): Deleted.
+        (JSC::MarkedBlock::size): Deleted.
+        (JSC::MarkedBlock::capacity): Deleted.
+        (JSC::MarkedBlock::setMarked): Deleted.
+        (JSC::MarkedBlock::clearMarked): Deleted.
+        (JSC::MarkedBlock::isNewlyAllocated): Deleted.
+        (JSC::MarkedBlock::setNewlyAllocated): Deleted.
+        (JSC::MarkedBlock::clearNewlyAllocated): Deleted.
+        (JSC::MarkedBlock::isLive): Deleted.
+        (JSC::MarkedBlock::isLiveCell): Deleted.
+        (JSC::MarkedBlock::forEachCell): Deleted.
+        (JSC::MarkedBlock::forEachLiveCell): Deleted.
+        (JSC::MarkedBlock::forEachDeadCell): Deleted.
+        (JSC::MarkedBlock::needsSweeping): Deleted.
+        (JSC::MarkedBlock::isAllocated): Deleted.
+        (JSC::MarkedBlock::isMarkedOrRetired): Deleted.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::initializeSizeClassForStepSize):
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::~MarkedSpace):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::tryAllocate):
+        (JSC::MarkedSpace::allocateLarge):
+        (JSC::MarkedSpace::tryAllocateLarge):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::sweepLargeAllocations):
+        (JSC::MarkedSpace::zombifySweep):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        (JSC::MarkedSpace::stopAllocating):
+        (JSC::MarkedSpace::prepareForMarking):
+        (JSC::MarkedSpace::resumeAllocating):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::freeOrShrinkBlock):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        (JSC::VerifyMarked::operator()):
+        (JSC::MarkedSpace::flip):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        (JSC::MarkedSpace::addActiveWeakSet):
+        (JSC::MarkedSpace::didAddBlock):
+        (JSC::MarkedSpace::didAllocateInBlock):
+        (JSC::MarkedSpace::forEachAllocator): Deleted.
+        (JSC::VerifyMarkedOrRetired::operator()): Deleted.
+        (JSC::MarkedSpace::clearMarks): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::sizeClassToIndex):
+        (JSC::MarkedSpace::indexToSizeClass):
+        (JSC::MarkedSpace::version):
+        (JSC::MarkedSpace::blocksWithNewObjects):
+        (JSC::MarkedSpace::largeAllocations):
+        (JSC::MarkedSpace::largeAllocationsNurseryOffset):
+        (JSC::MarkedSpace::largeAllocationsOffsetForThisCollection):
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionBegin):
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionEnd):
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionSize):
+        (JSC::MarkedSpace::forEachLiveCell):
+        (JSC::MarkedSpace::forEachDeadCell):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::destructorAllocatorFor):
+        (JSC::MarkedSpace::auxiliaryAllocatorFor):
+        (JSC::MarkedSpace::allocateWithoutDestructor):
+        (JSC::MarkedSpace::allocateWithDestructor):
+        (JSC::MarkedSpace::allocateAuxiliary):
+        (JSC::MarkedSpace::tryAllocateAuxiliary):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::forEachAllocator):
+        (JSC::MarkedSpace::optimalSizeFor):
+        (JSC::MarkedSpace::didAddBlock): Deleted.
+        (JSC::MarkedSpace::didAllocateInBlock): Deleted.
+        (JSC::MarkedSpace::objectCount): Deleted.
+        (JSC::MarkedSpace::size): Deleted.
+        (JSC::MarkedSpace::capacity): Deleted.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::SlotVisitor):
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset):
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::markAuxiliary):
+        (JSC::SlotVisitor::noteLiveAuxiliaryCell):
+        (JSC::SlotVisitor::visitChildren):
+        * heap/SlotVisitor.h:
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::WeakBlock):
+        (JSC::WeakBlock::visit):
+        (JSC::WeakBlock::reap):
+        * heap/WeakBlock.h:
+        (JSC::WeakBlock::disconnectContainer):
+        (JSC::WeakBlock::disconnectMarkedBlock): Deleted.
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::~WeakSet):
+        (JSC::WeakSet::sweep):
+        (JSC::WeakSet::shrink):
+        (JSC::WeakSet::addAllocator):
+        * heap/WeakSet.h:
+        (JSC::WeakSet::container):
+        (JSC::WeakSet::setContainer):
+        (JSC::WeakSet::WeakSet):
+        (JSC::WeakSet::visit):
+        (JSC::WeakSet::shrink): Deleted.
+        * heap/WeakSetInlines.h:
+        (JSC::WeakSet::allocate):
+        * inspector/InjectedScriptManager.cpp:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        * inspector/ScriptDebugServer.cpp:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        (JSC::StackFrame::sourceID): Deleted.
+        (JSC::StackFrame::sourceURL): Deleted.
+        (JSC::StackFrame::functionName): Deleted.
+        (JSC::StackFrame::computeLineAndColumn): Deleted.
+        (JSC::StackFrame::toString): Deleted.
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::isNative): Deleted.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
+        (JSC::AssemblyHelpers::emitAllocate):
+        (JSC::AssemblyHelpers::emitAllocateJSCell):
+        (JSC::AssemblyHelpers::emitAllocateJSObject):
+        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
+        (JSC::AssemblyHelpers::emitAllocateVariableSized):
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileCTINativeCall):
+        (JSC::JIT::link):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTINativeCall): Deleted.
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITExceptions.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+        * jit/JITThunks.cpp:
+        * jit/JITThunks.h:
+        * jsc.cpp:
+        (functionDescribeArray):
+        (main):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntExceptions.cpp:
+        * llint/LLIntThunks.cpp:
+        * llint/LLIntThunks.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ModuleAnalyzer.cpp:
+        * parser/NodeConstructors.h:
+        * parser/Nodes.h:
+        * profiler/ProfilerBytecode.cpp:
+        * profiler/ProfilerBytecode.h:
+        * profiler/ProfilerBytecodeSequence.cpp:
+        * runtime/ArrayConventions.h:
+        (JSC::indexingHeaderForArrayStorage):
+        (JSC::baseIndexingHeaderForArrayStorage):
+        (JSC::indexingHeaderForArray): Deleted.
+        (JSC::baseIndexingHeaderForArray): Deleted.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        (JSC::concatAppendOne):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        * runtime/ArrayStorage.h:
+        (JSC::ArrayStorage::vectorLength):
+        (JSC::ArrayStorage::totalSizeFor):
+        (JSC::ArrayStorage::totalSize):
+        (JSC::ArrayStorage::availableVectorLength):
+        (JSC::ArrayStorage::optimalVectorLength):
+        (JSC::ArrayStorage::sizeFor): Deleted.
+        * runtime/AuxiliaryBarrier.h: Added.
+        (JSC::AuxiliaryBarrier::AuxiliaryBarrier):
+        (JSC::AuxiliaryBarrier::clear):
+        (JSC::AuxiliaryBarrier::get):
+        (JSC::AuxiliaryBarrier::slot):
+        (JSC::AuxiliaryBarrier::operator bool):
+        (JSC::AuxiliaryBarrier::setWithoutBarrier):
+        * runtime/AuxiliaryBarrierInlines.h: Added.
+        (JSC::AuxiliaryBarrier<T>::AuxiliaryBarrier):
+        (JSC::AuxiliaryBarrier<T>::set):
+        * runtime/Butterfly.h:
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::availableContiguousVectorLength):
+        (JSC::Butterfly::optimalContiguousVectorLength):
+        (JSC::Butterfly::createUninitialized):
+        (JSC::Butterfly::growArrayRight):
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createEmpty):
+        * runtime/CommonSlowPathsExceptions.cpp:
+        * runtime/CommonSlowPathsExceptions.h:
+        * runtime/DataView.cpp:
+        * runtime/DirectArguments.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp:
+        * runtime/Error.cpp:
+        * runtime/Error.h:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorInstance.h:
+        * runtime/Exception.cpp:
+        * runtime/Exception.h:
+        * runtime/GeneratorFrame.cpp:
+        * runtime/GeneratorPrototype.cpp:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/IntlCollator.cpp:
+        * runtime/IntlCollatorConstructor.cpp:
+        * runtime/IntlCollatorPrototype.cpp:
+        * runtime/IntlDateTimeFormat.cpp:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        * runtime/IntlNumberFormat.cpp:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        * runtime/IntlNumberFormatPrototype.cpp:
+        * runtime/IntlObject.cpp:
+        * runtime/IteratorPrototype.cpp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::tryCreateUninitialized):
+        (JSC::JSArray::setLengthWritable):
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::fastSlice):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArray.h:
+        (JSC::createContiguousArrayButterfly):
+        (JSC::createArrayButterfly):
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized): Deleted.
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSCInlines.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContextAssumingStructure):
+        * runtime/JSCallee.cpp:
+        (JSC::JSCallee::JSCallee):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::estimatedSize):
+        * runtime/JSCell.h:
+        (JSC::JSCell::cellStateOffset): Deleted.
+        * runtime/JSCellInlines.h:
+        (JSC::ExecState::vm):
+        (JSC::JSCell::classInfo):
+        (JSC::JSCell::callDestructor):
+        (JSC::JSCell::vm): Deleted.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::allocateAndInitializeRareData):
+        (JSC::JSFunction::initializeRareData):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty):
+        (JSC::JSFunction::setFunctionName):
+        (JSC::JSFunction::reifyLength):
+        (JSC::JSFunction::reifyName):
+        (JSC::JSFunction::reifyLazyPropertyIfNeeded):
+        (JSC::JSFunction::reifyBoundNameIfNeeded):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::createWithInvalidatedReallocationWatchpoint):
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        * runtime/JSInternalPromise.cpp:
+        * runtime/JSInternalPromiseConstructor.cpp:
+        * runtime/JSInternalPromiseDeferred.cpp:
+        * runtime/JSInternalPromisePrototype.cpp:
+        * runtime/JSJob.cpp:
+        * runtime/JSMapIterator.cpp:
+        * runtime/JSModuleNamespaceObject.cpp:
+        * runtime/JSModuleRecord.cpp:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::createInitialArrayStorage):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::JSObject::copyButterfly): Deleted.
+        (JSC::JSObject::copyBackingStore): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::globalObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): Deleted.
+        * runtime/JSObjectInlines.h:
+        * runtime/JSPromise.cpp:
+        * runtime/JSPromiseConstructor.cpp:
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/JSPromisePrototype.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+        * runtime/JSScope.h:
+        (JSC::JSScope::globalObject):
+        (JSC::JSScope::vm): Deleted.
+        * runtime/JSSetIterator.cpp:
+        * runtime/JSStringIterator.cpp:
+        * runtime/JSTemplateRegistryKey.cpp:
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        * runtime/JSWeakMap.cpp:
+        * runtime/JSWeakSet.cpp:
+        * runtime/MapConstructor.cpp:
+        * runtime/MapIteratorPrototype.cpp:
+        * runtime/MapPrototype.cpp:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeStdFunctionCell.cpp:
+        * runtime/Operations.h:
+        (JSC::scribbleFreeCells):
+        (JSC::scribble):
+        * runtime/Options.h:
+        * runtime/PropertyTable.cpp:
+        * runtime/ProxyConstructor.cpp:
+        * runtime/ProxyObject.cpp:
+        * runtime/ProxyRevoke.cpp:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        (JSC::RegExp::matchConcurrently):
+        (JSC::RegExp::matchCompareWithInterpreter):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpInlines.h:
+        (JSC::RegExp::matchInline):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::tryCreateUninitializedRegExpMatchesArray):
+        (JSC::createRegExpMatchesArray):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::genericSplit):
+        * runtime/RuntimeType.cpp:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        * runtime/SetConstructor.cpp:
+        * runtime/SetIteratorPrototype.cpp:
+        * runtime/SetPrototype.cpp:
+        * runtime/StackFrame.cpp: Added.
+        (JSC::StackFrame::sourceID):
+        (JSC::StackFrame::sourceURL):
+        (JSC::StackFrame::functionName):
+        (JSC::StackFrame::computeLineAndColumn):
+        (JSC::StackFrame::toString):
+        * runtime/StackFrame.h: Added.
+        (JSC::StackFrame::isNative):
+        * runtime/StringConstructor.cpp:
+        * runtime/StringIteratorPrototype.cpp:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::propertyTable):
+        * runtime/TemplateRegistry.cpp:
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::finalizeStatsAtEndOfTesting):
+        * runtime/TestRunnerUtils.h:
+        * runtime/TypeProfilerLog.cpp:
+        * runtime/TypeSet.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::ensureStackCapacityForCLoop):
+        (JSC::VM::isSafeToRecurseSoftCLoop):
+        * runtime/VM.h:
+        * runtime/VMEntryScope.h:
+        * runtime/VMInlines.h:
+        (JSC::VM::ensureStackCapacityFor):
+        (JSC::VM::isSafeToRecurseSoft):
+        * runtime/WeakMapConstructor.cpp:
+        * runtime/WeakMapData.cpp:
+        * runtime/WeakMapPrototype.cpp:
+        * runtime/WeakSetConstructor.cpp:
+        * runtime/WeakSetPrototype.cpp:
+        * testRegExp.cpp:
+        (testOneRegExp):
+        * tools/JSDollarVM.cpp:
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::isInObjectSpace):
+
+2016-09-04  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r205415.
+        https://bugs.webkit.org/show_bug.cgi?id=161573
+
+        Many bots see inspector test failures, rolling out now and
+        investigating later. (Requested by brrian on #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: unify Main.html and Test.html sources and
+        generate different copies with the preprocessor"
+        https://bugs.webkit.org/show_bug.cgi?id=161212
+        http://trac.webkit.org/changeset/205415
+
+2016-09-01  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: unify Main.html and Test.html sources and generate different copies with the preprocessor
+        https://bugs.webkit.org/show_bug.cgi?id=161212
+        <rdar://problem/28017961>
+
+        Reviewed by Joseph Pecoraro.
+
+        * CMakeLists.txt: Remove some unnecessary MAKE_DIRECTORY commands.
+
+2016-09-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Use ASCIILiteral in some more places
+        https://bugs.webkit.org/show_bug.cgi?id=161557
+
+        Reviewed by Darin Adler.
+
+        * runtime/TypeSet.h:
+        (JSC::StructureShape::setConstructorName):
+
+2016-09-01  Michael Saboff  <msaboff@apple.com>
+
+        Import Chakra tests to JSC
+        https://bugs.webkit.org/show_bug.cgi?id=154697
+
+        Reviewed by Saam Barati.
+
+        Added --dumpException option to jsc command line utility to dump uncaught exception
+        text even for the last exception that matches --exception.  This is used to
+        check the exception text for a text that is expected to end on an exception.
+        Chakra has several tests of this form and does the same thing when such a test
+        ends with an exception.  Tests that rely on this behavior have had their expected
+        output updated for JSC specific text.
+
+        * jsc.cpp:
+
+2016-09-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove some more useless cases from FTL Capabilities
+        https://bugs.webkit.org/show_bug.cgi?id=161466
+
+        Reviewed by Geoffrey Garen.
+
+        Some cases do not make sense:
+        -In: Fixup only generate CellUse.
+        -PutByIdXXX: same.
+        -GetIndexedPropertyStorage: those cases are the only ones supported
+         by DFG. We would have crashed in SpeculativeJIT if other modes
+         were generated.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
+
+2016-09-02  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, roll out r205354 because it caused JSC test failures
+
+        * jsc.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::allowsAccessFrom):
+        (JSC::JSGlobalObject::setDebugger): Deleted.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
+        (JSC::GlobalFuncProtoGetterFunctor::result):
+        (JSC::GlobalFuncProtoGetterFunctor::operator()):
+        (JSC::globalFuncProtoGetter):
+        (JSC::GlobalFuncProtoSetterFunctor::GlobalFuncProtoSetterFunctor):
+        (JSC::GlobalFuncProtoSetterFunctor::allowsAccess):
+        (JSC::GlobalFuncProtoSetterFunctor::operator()):
+        (JSC::checkProtoSetterAccessAllowed):
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::allowsAccessFrom):
+        * runtime/JSObject.h:
+        * runtime/JSProxy.cpp:
+        * runtime/JSProxy.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::result):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorSetPrototypeOf):
+        * runtime/ObjectConstructor.h:
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectGetPrototypeOf):
+        (JSC::reflectObjectSetPrototypeOf):
+
+2016-09-02  Caio Lima  <ticaiolima@gmail.com>
+
+        Register usage optimization in mathIC when LHS and RHS are constants isn't configured correctly
+        https://bugs.webkit.org/show_bug.cgi?id=160802
+
+        Reviewed by Saam Barati.
+
+        This patch is fixing a broken mechanism of MathIC that avoids allocate
+        a register to LHS or RHS if one of these operands are proven as valid
+        constant for JIT*Generator. In previous implementation, even if the
+        JIT*Generator was not using an operand register because it was proven as a
+        constant, compileMathIC and emitICFast were allocating a register for
+        it. This was broken because mathIC->isLeftOperandValidConstant and
+        mathIC->isLeftOperandValidConstant were being called before its Generator be
+        properly initialized. We changed this mechanism to enable Generators write
+        their validConstant rules using static methods isLeftOperandValidConstant(SnippetOperand)
+        and isRightOperandValidConstant(SnippetOperand).
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMathIC):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::JITAddGenerator):
+        (JSC::JITAddGenerator::isLeftOperandValidConstant):
+        (JSC::JITAddGenerator::isRightOperandValidConstant):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitMathICFast):
+        * jit/JITMathIC.h:
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::JITMulGenerator):
+        (JSC::JITMulGenerator::isLeftOperandValidConstant):
+        (JSC::JITMulGenerator::isRightOperandValidConstant):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::isLeftOperandValidConstant):
+        (JSC::JITSubGenerator::isRightOperandValidConstant):
+
+2016-09-02  JF Bastien  <jfbastien@apple.com>
+
+        GetByValWithThis: fix opInfo in DFG creation
+        https://bugs.webkit.org/show_bug.cgi?id=161541
+
+        Reviewed by Saam Barati.
+
+        super-get-by-val-with-this-monomorphic might be 1.0148x faster after this change.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): fix OpInfo
+
+2016-09-02  Chris Dumez  <cdumez@apple.com>
+
+        Object.preventExtensions() should throw cross-origin
+        https://bugs.webkit.org/show_bug.cgi?id=161486
+
+        Reviewed by Geoffrey Garen.
+
+        Update JSProxy to forward preventExtensions() calls to its target.
+
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::preventExtensions):
+        * runtime/JSProxy.h:
+
+2016-09-02  Chris Dumez  <cdumez@apple.com>
+
+        Align proto getter / setter behavior with other browsers
+        https://bugs.webkit.org/show_bug.cgi?id=161455
+
+        Reviewed by Mark Lam.
+
+        Drop allowsAccessFrom from the methodTable and delegate cross-origin
+        checking to the DOM bindings for [[SetPrototypeOf]] / [[GetPrototypeOf]].
+        This is more consistent with other operations (e.g. [[GetOwnProperty]]).
+
+        * jsc.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+        (JSC::globalFuncBuiltinLog): Deleted.
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::getArrayLength): Deleted.
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setPrototype):
+        (JSC::JSProxy::getPrototype):
+        * runtime/JSProxy.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor): Deleted.
+        (JSC::objectConstructorGetOwnPropertyDescriptors): Deleted.
+        * runtime/ObjectConstructor.h:
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectGetPrototypeOf):
+        (JSC::reflectObjectSetPrototypeOf):
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        Comment out check added in r197648. This check was added to match
+        the latest EcmaScript spec:
+        - https://tc39.github.io/ecma262/#sec-ordinarysetprototypeof (step 8)
+        This check allowed for [[Prototype]] chain cycles if the prototype
+        chain includes objects that do not use the ordinary object definitions
+        for [[GetPrototypeOf]] and [[SetPrototypeOf]].
+        The issue is that the rest of our code base does not properly handle
+        such cycles and we can end up in infinite loops. This became obvious
+        because this patch updates Window / Location so that they no longer
+        use the default [[GetPrototypeOf]] / [[SetPrototypeOf]]. If I do not
+        comment out this check, I get an infinite loop in
+        Structure::anyObjectInChainMayInterceptIndexedAccesses(), which is
+        called from JSObject::setPrototypeDirect(), when running the following
+        layout test:
+        - html/browsers/history/the-location-interface/allow_prototype_cycle_through_location.sub.html
+        I filed https://bugs.webkit.org/show_bug.cgi?id=161534 to track this
+        issue.
+
+2016-09-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Add toJS for JSC::PrivateName
+        https://bugs.webkit.org/show_bug.cgi?id=161522
+
+        Reviewed by Ryosuke Niwa.
+
+        Add the export annotation.
+        And we perform refactoring RefPtr<SymbolImpl> => Ref<SymbolImpl> for PrivateName,
+        since PrivateName never holds null SymbolImpl pointer. And along with this change,
+        we changed SymbolImpl* to SymbolImpl& in PrivateName::uid() callers.
+
+        * runtime/Completion.cpp:
+        (JSC::createSymbolForEntryPointModule):
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::fromUid):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::setFunctionName):
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+        (JSC::PrivateName::uid): Ugly const_cast. But const annotation is meaningless for SymbolImpl.
+        StringImpl should be observed as an immutable object. (Of course, its hash members etc. are mutable.
+        But most of the users (One of the exceptions is the concurrent JIT compiling thread!) should not care about this.)
+        (JSC::PrivateName::operator==):
+        (JSC::PrivateName::operator!=):
+        * runtime/PropertyName.h:
+        (JSC::PropertyName::PropertyName):
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::finishCreation):
+        * runtime/Symbol.h:
+        * runtime/SymbolConstructor.cpp:
+        (JSC::symbolConstructorKeyFor):
+
+2016-09-01  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-09-01  JF Bastien  <jfbastien@apple.com>
+
+        jsc: fix cmake build missing symbol getPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=161521
+
+        Reviewed by Saam Barati.
+
+        * runtime/IntlDateTimeFormat.cpp: include JSCInlines.h
+        * runtime/IntlNumberFormat.cpp: include JSCInlines.h
+
+2016-09-01  JF Bastien  <jfbastien@apple.com>
+
+        jsc: provide printErr()
+        https://bugs.webkit.org/show_bug.cgi?id=161513
+
+        Reviewed by Mark Lam.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (printInternal): renamed from functionPrint, add error checking
+        (functionPrintStdOut): punt to printInternal
+        (functionPrintStdErr): punt to printInternal
+        (functionPrint): Deleted.
+
+2016-09-01  Mark Lam  <mark.lam@apple.com>
+
+        Move some JSObject and JSArray inline functions to their respective Inlines.h files.
+        https://bugs.webkit.org/show_bug.cgi?id=161499
+
+        Reviewed by Saam Barati.
+
+        This is just a refactoring patch to move some inline functions to their Inlines.h
+        files.  This will be needed to enable https://bugs.webkit.org/show_bug.cgi?id=161498
+        later.
+
+        * bindings/ScriptValue.cpp:
+        * interpreter/Interpreter.cpp:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        * runtime/IntlNumberFormatPrototype.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/JSArray.h:
+        (JSC::getLength): Deleted.
+        (JSC::toLength): Deleted.
+        * runtime/JSArrayInlines.h:
+        (JSC::JSArray::mergeIndexingTypeForCopying):
+        (JSC::JSArray::canFastCopy):
+        (JSC::getLength):
+        (JSC::toLength):
+        * runtime/JSInternalPromise.cpp:
+        * runtime/JSInternalPromiseDeferred.cpp:
+        * runtime/JSJob.cpp:
+        * runtime/JSModuleRecord.cpp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::getPropertySlot): Deleted.
+        (JSC::JSObject::getNonIndexPropertySlot): Deleted.
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getNonIndexPropertySlot):
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        * runtime/MapConstructor.cpp:
+        * runtime/SamplingProfiler.cpp:
+        * runtime/SetConstructor.cpp:
+        * runtime/WeakMapConstructor.cpp:
+        * runtime/WeakSetConstructor.cpp:
+
+2016-09-01  JF Bastien  <jfbastien@apple.com>
+
+        GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
+        https://bugs.webkit.org/show_bug.cgi?id=160922
+
+        Reviewed by Keith Miller.
+
+        Add value profiling to GetBy{Id,Val}WithThis.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finishCreation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitGetByVal):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+
+2016-09-01  Keith Miller  <keith_miller@apple.com>
+
+        WASM functions should be able to use arguments
+        https://bugs.webkit.org/show_bug.cgi?id=161471
+
+        Reviewed by Benjamin Poulain.
+
+        This patch does a couple of changes:
+
+        1) Adds a new Calling Convention class for B3. This class is used to make it easy to specify the calling convention of a function. In particular it knows which arguments are in registers and which ones should be on the stack. For now, nothing uses the argument registers, in the future we will use these for WASM and/or JS. Additonally, it knows the callee save registers for any given function. The main advantage of this class is that it makes it easy to iterate over the arguments of your function without having to worry about the details of the calling convention you are using.
+
+        2) Makes the WASM calling convention the same as the JS one. Currently, the CodeBlock, CodeOrigin, and Callee are all 0. Since they have no value. Additionally, since we call into WASM from C++ through vmEntryToJavaScript, if there are no arguments to the callee we insert a null pointer as the first argument.
+
+        3) Since WASM expects the arguments to be mapped to function locals we map the argument stack slots to variables immediately after the function prologue.
+
+        * B3CallingConventions.cpp: Copied from Source/JavaScriptCore/llint/LLIntThunks.h.
+        (JSC::B3::jscCallingConvention):
+        * B3CallingConventions.h: Added.
+        (JSC::B3::CallingConvention::CallingConvention):
+        (JSC::B3::CallingConvention::iterate):
+        (JSC::B3::nextJSCOffset):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/ProtoCallFrame.h:
+        * llint/LLIntThunks.cpp:
+        (JSC::vmEntryToWASM):
+        * llint/LLIntThunks.h:
+        * testWASM.cpp:
+        (invoke):
+        (box):
+        (runWASMTests):
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::B3IRGenerator::addLocal):
+        (JSC::WASM::B3IRGenerator::addArguments):
+        (JSC::WASM::B3IRGenerator::getLocal):
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::FunctionParser):
+        (JSC::WASM::FunctionParser<Context>::parseExpression):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASM::ModuleParser::parseFunctionTypes):
+        (JSC::WASM::ModuleParser::parseFunctionSignatures):
+        * wasm/WASMModuleParser.h:
+        * wasm/WASMOps.h:
+
+2016-09-01  Keith Miller  <keith_miller@apple.com>
+
+        Rename WASM classes dropping the WASM prefix
+        https://bugs.webkit.org/show_bug.cgi?id=161500
+
+        Reviewed by Mark Lam.
+
+        Having to write WASM::WASMModule seems silly. Also, this patch
+        merges WASMFunctionReturnType and WASMValueType into one type
+        that is a typedef of B3::Type. Using B3::Type as the WASM
+        primitive type makes it trivial to convert a Vector of WASM
+        types into a Vector of B3 types.
+
+        * b3/B3Type.h:
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::signatures):
+        (JSC::JSWASMModule::functionImports):
+        (JSC::JSWASMModule::functionImportSignatures):
+        (JSC::JSWASMModule::globalVariableTypes):
+        (JSC::JSWASMModule::functionDeclarations):
+        (JSC::JSWASMModule::functionPointerTables):
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::toB3Op):
+        (JSC::WASM::B3IRGenerator::addLocal):
+        (JSC::WASM::B3IRGenerator::unaryOp):
+        (JSC::WASM::B3IRGenerator::binaryOp):
+        (JSC::WASM::B3IRGenerator::addConstant):
+        (JSC::WASM::parseAndCompile):
+        * wasm/WASMB3IRGenerator.h:
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::FunctionParser<Context>::FunctionParser):
+        (JSC::WASM::FunctionParser<Context>::parse):
+        (JSC::WASM::FunctionParser<Context>::parseBlock):
+        (JSC::WASM::FunctionParser<Context>::parseExpression):
+        (JSC::WASM::WASMFunctionParser<Context>::WASMFunctionParser): Deleted.
+        (JSC::WASM::WASMFunctionParser<Context>::parse): Deleted.
+        (JSC::WASM::WASMFunctionParser<Context>::parseBlock): Deleted.
+        (JSC::WASM::WASMFunctionParser<Context>::parseExpression): Deleted.
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASM::ModuleParser::parse):
+        (JSC::WASM::ModuleParser::parseFunctionTypes):
+        (JSC::WASM::ModuleParser::parseFunctionSignatures):
+        (JSC::WASM::ModuleParser::parseFunctionDefinitions):
+        (JSC::WASM::WASMModuleParser::parse): Deleted.
+        (JSC::WASM::WASMModuleParser::parseFunctionTypes): Deleted.
+        (JSC::WASM::WASMModuleParser::parseFunctionSignatures): Deleted.
+        (JSC::WASM::WASMModuleParser::parseFunctionDefinitions): Deleted.
+        * wasm/WASMModuleParser.h:
+        (JSC::WASM::ModuleParser::ModuleParser):
+        (JSC::WASM::ModuleParser::functionInformation):
+        (JSC::WASM::WASMModuleParser::WASMModuleParser): Deleted.
+        (JSC::WASM::WASMModuleParser::functionInformation): Deleted.
+        * wasm/WASMOps.h:
+        * wasm/WASMParser.h:
+        (JSC::WASM::Parser::Parser):
+        (JSC::WASM::Parser::consumeCharacter):
+        (JSC::WASM::Parser::consumeString):
+        (JSC::WASM::Parser::parseUInt32):
+        (JSC::WASM::Parser::parseUInt7):
+        (JSC::WASM::Parser::parseVarUInt1):
+        (JSC::WASM::Parser::parseValueType):
+        (JSC::WASM::WASMParser::WASMParser): Deleted.
+        (JSC::WASM::WASMParser::consumeCharacter): Deleted.
+        (JSC::WASM::WASMParser::consumeString): Deleted.
+        (JSC::WASM::WASMParser::parseUInt32): Deleted.
+        (JSC::WASM::WASMParser::parseUInt7): Deleted.
+        (JSC::WASM::WASMParser::parseVarUInt1): Deleted.
+        (JSC::WASM::WASMParser::parseValueType): Deleted.
+        * wasm/WASMPlan.cpp:
+        (JSC::WASM::Plan::Plan):
+        * wasm/WASMSections.cpp:
+        (JSC::WASM::Sections::lookup):
+        (JSC::WASM::WASMSections::lookup): Deleted.
+        * wasm/WASMSections.h:
+        (JSC::WASM::Sections::validateOrder):
+        (JSC::WASM::WASMSections::validateOrder): Deleted.
+
+2016-09-01  Filip Pizlo  <fpizlo@apple.com>
+
+        ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=161492
+
+        Reviewed by Mark Lam.
+        
+        If you materialize a sunken object that is referenced from another sunken object, then you
+        have to emit a PutHint to tell OSR that the latter object now refers to a materialized
+        object rather than to the old sunken one.
+        
+        The ObjectAllocationSinkingPhase totally knows how to do this, but for some reason it only
+        did it when the PromotedLocationDescriptor for the field used for referring to the other
+        object is !neededForMaterialization(), i.e. it's a NamedPropertyPLoc or a ClosureVarPLoc.
+        I can sort of imagine why we thought that would be right - neededForMaterialization() means
+        it's a special meta-data field initialized on construction. But just because it's immutable
+        and special doesn't mean that materialization can't change its physical representation.
+        Removing the requirement that it's !neededForMaterialization() fixes the test and doesn't
+        regress anything.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
+2016-09-01  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r205297.
+
+        Caused some JSC test failures
+
+        Reverted changeset:
+
+        "Align cross-origin proto getter / setter behavior with the
+        specification"
+        https://bugs.webkit.org/show_bug.cgi?id=161455
+        http://trac.webkit.org/changeset/205297
+
+2016-09-01  Chris Dumez  <cdumez@apple.com>
+
+        Align cross-origin proto getter / setter behavior with the specification
+        https://bugs.webkit.org/show_bug.cgi?id=161455
+
+        Reviewed by Mark Lam.
+
+        Align cross-origin proto getter / setter behavior with the specification:
+
+        The setter should throw a TypeError:
+        - https://html.spec.whatwg.org/#windowproxy-setprototypeof
+        - https://html.spec.whatwg.org/#location-setprototypeof
+        - https://tc39.github.io/ecma262/#sec-object.setprototypeof (step 5)
+
+        The getter should return null:
+        - https://html.spec.whatwg.org/#windowproxy-getprototypeof
+        - https://html.spec.whatwg.org/#location-getprototypeof
+
+        I have verified that this aligns our behavior with Firefox and Chrome.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::GlobalFuncProtoGetterFunctor::operator()):
+        (JSC::globalFuncProtoSetter):
+
+2016-09-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed ARM buildfix after r205283.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::patchableJumpSize):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::patchableJumpSize):
+
+2016-09-01  Saam Barati  <sbarati@apple.com>
+
+        JITMathIC was misusing maxJumpReplacementSize
+        https://bugs.webkit.org/show_bug.cgi?id=161356
+        <rdar://problem/28065560>
+
+        Reviewed by Benjamin Poulain.
+
+        JITMathIC was assuming that maxJumpReplacementSize is the size
+        you'd get if you emitted a patchableJump() using the macro assembler.
+        This is not true, however. It happens to be true on arm64, x86 and x86-64,
+        however, it is not true on armv7. This patch introduces an alternative to
+        maxJumpReplacementSize called patchableJumpSize, and switches JITMathIC
+        to use that number instead.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::patchableJumpSize):
+        (JSC::ARM64Assembler::maxJumpReplacementSize): Deleted.
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::patchableJumpSize):
+        (JSC::ARMv7Assembler::maxJumpReplacementSize): Deleted.
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::patchableJumpSize):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::patchableJumpSize):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::patchableJumpSize):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchableJumpSize):
+        (JSC::X86Assembler::maxJumpReplacementSize): Deleted.
+        * jit/JITMathIC.h:
+        (JSC::JITMathIC::generateInline):
+
+2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Add initiator parameter to module pipeline
+        https://bugs.webkit.org/show_bug.cgi?id=161470
+
+        Reviewed by Saam Barati.
+
+        The fetching semantics of the <script type="module"> tag has per module-tag context.
+        For example, "nonce", "crossorigin" etc. attributes are shared in the fetching requests
+        issued from the module-tag. To transfer this information, we add a new parameter "initiator"
+        to the module loader pipeline. We are planning to transfer information by this parameter.
+
+        At the same time, we also perform some clean up.
+
+        - Use arrow function in ModuleLoaderPrototype.js.
+        - Rename "ResolveDependencies" to "Satisfy" to align to the loader spec.
+
+        * builtins/ModuleLoaderPrototype.js:
+        (newRegistryEntry):
+        (commitInstantiated):
+        (requestFetch):
+        (requestTranslate):
+        (requestInstantiate):
+        (requestSatisfy):
+        (requestInstantiateAll):
+        (requestLink):
+        (moduleEvaluation):
+        (provide):
+        (loadAndEvaluateModule):
+        (requestResolveDependencies.): Deleted.
+        (requestResolveDependencies): Deleted.
+        (requestReady): Deleted.
+        (link): Deleted.
+        (loadModule): Deleted.
+        (linkAndEvaluateModule): Deleted.
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * jsc.cpp:
+        (GlobalObject::moduleLoaderResolve):
+        (GlobalObject::moduleLoaderFetch):
+        * runtime/Completion.cpp:
+        (JSC::loadAndEvaluateModule):
+        (JSC::loadModule):
+        (JSC::linkAndEvaluateModule):
+        * runtime/Completion.h:
+        * runtime/JSGlobalObject.h:
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::loadAndEvaluateModule):
+        (JSC::JSModuleLoader::loadModule):
+        (JSC::JSModuleLoader::linkAndEvaluateModule):
+        (JSC::JSModuleLoader::resolve):
+        (JSC::JSModuleLoader::fetch):
+        (JSC::JSModuleLoader::translate):
+        (JSC::JSModuleLoader::instantiate):
+        (JSC::JSModuleLoader::evaluate):
+        * runtime/JSModuleLoader.h:
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeResolve):
+        (JSC::moduleLoaderPrototypeFetch):
+        (JSC::moduleLoaderPrototypeTranslate):
+        (JSC::moduleLoaderPrototypeInstantiate):
+        (JSC::moduleLoaderPrototypeEvaluate):
+
+2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] linking and evaluating the modules are done in a sync manner
+        https://bugs.webkit.org/show_bug.cgi?id=161467
+
+        Reviewed by Saam Barati.
+
+        While the fetching and the other stages are done in an asynchronous manner,
+        linking and evaluating are done in a sync manner.
+        Just return the result value and do not wrap them with the internal promise.
+
+        * builtins/ModuleLoaderPrototype.js:
+        (linkAndEvaluateModule):
+        * runtime/Completion.cpp:
+        (JSC::linkAndEvaluateModule):
+        * runtime/Completion.h:
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::linkAndEvaluateModule):
+        * runtime/JSModuleLoader.h:
+
+2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
+        https://bugs.webkit.org/show_bug.cgi?id=161436
+
+        Reviewed by Filip Pizlo.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionGetRandomSeed):
+        (functionSetRandomSeed):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::weakRandom):
+        (JSC::JSGlobalObject::weakRandomInteger): Deleted.
+
+2016-08-31  Chris Dumez  <cdumez@apple.com>
+
+        Object.getPrototypeOf() should return null cross-origin
+        https://bugs.webkit.org/show_bug.cgi?id=161393
+
+        Reviewed by Geoffrey Garen.
+
+        Object.getPrototypeOf() should return null cross-origin:
+        - https://html.spec.whatwg.org/#windowproxy-getprototypeof
+        - https://html.spec.whatwg.org/#location-getprototypeof
+
+        Firefox and Chrome return null. However, WebKit was returning undefined.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+
+2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] AbstractValue can contain padding which is not zero-filled
+        https://bugs.webkit.org/show_bug.cgi?id=161427
+
+        Reviewed by Saam Barati.
+
+        We checked that AbstractValue is zero-filled when initializing it to ensure
+        that zero-filled memory can be used as the initialized AbstractValue.
+        However, since the size of SpeculatedType becomes 64bit, AbstractValue can have
+        padding now. And this padding is not ensured that it is initialized with zeros.
+        So debug assertion fails when building with GCC.
+
+        This patch changes the strategy. Instead of checking the initialized
+        AbstractValue is zero-filled, we ensure that zero-filled AbstractValue can be
+        considered to be equal to the initialized AbstractValue.
+
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::ensureCanInitializeWithZeros):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::AbstractValue):
+
+2016-08-31  Brady Eidson  <beidson@apple.com>
+
+        WK2 Gamepad provider on iOS.
+        https://bugs.webkit.org/show_bug.cgi?id=161412
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-08-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Some arith nodes are too pessimistic with the types supported on the fast path
+        https://bugs.webkit.org/show_bug.cgi?id=161410
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        DoubleRep is able to convert numbers, undefined, booleans and null.
+        I was too pessimistic when I gated the double implementations
+        on number-or-boolean speculation. We can just let DoubleRep convert
+        the other cases as long as it is not a Cell.
+
+2016-08-30  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, fix build after r205205.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+
+2016-08-30  Chris Dumez  <cdumez@apple.com>
+
+        Object.setPrototypeOf() should throw when used on a cross-origin Window / Location object
+        https://bugs.webkit.org/show_bug.cgi?id=161396
+
+        Reviewed by Ryosuke Niwa.
+
+        Object.setPrototypeOf() should throw when used on a cross-origin Window / Location object:
+        - https://html.spec.whatwg.org/#windowproxy-setprototypeof
+        - https://html.spec.whatwg.org/#location-setprototypeof
+        - https://tc39.github.io/ecma262/#sec-object.setprototypeof (step 5)
+
+        Firefox and Chrome already throw. However, WebKit merely ignores the call and logs an error message.
+
+        Note that technically, we should also throw in the same origin case.
+        However, not all browsers agree on this yet so I haven't not changed
+        the behavior for the same origin case.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+
+2016-08-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Clean up the remaining compare nodes in FTLCapabilities
+        https://bugs.webkit.org/show_bug.cgi?id=161400
+
+        Reviewed by Geoffrey Garen.
+
+        It looks like we implemented all the cases without realizing it.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compare):
+
+2016-08-30  Mark Lam  <mark.lam@apple.com>
+
+        Introduce the ThrowScope and force every throw site to instantiate a ThrowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=161171
+
+        Reviewed by Filip Pizlo and Geoffrey Garen.
+
+        This is the first step towards having a mechanism (using the ThrowScope) to
+        verify that we're properly checking for exceptions in all the needed places.
+        See comments at the top of ThrowScope.cpp for details on how the ThrowScope works.
+
+        This patch only introduces the ThrowScope, and changes all throw sites to throw
+        using a ThrowScope instance.  VM::throwException() functions are now private, and
+        cannot be accessed directly.  All throws must now go through a ThrowScope.
+
+        Verification is disabled for the moment until we can fix all the verification
+        failures that will show up.
+
+        I also did a smoke test of the ThrowScope mechanisms by running verification on
+        the JSTests/stress/op-add-exceptions.js test with a local build with verification
+        turned on.
+
+        Performance is neutral on aggregate with this patch.
+
+        Misc other changes:
+        - deleted the unused CALL_THROW() macro from LLIntSlowPaths.cpp.
+        - moved createListFromArrayLike() from JSObject.h to JSObjectInlines.h.
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call):
+        (JSC::APICallbackFunction::construct):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
+        (JSC::JSCallbackObject<Parent>::defaultValue):
+        (JSC::JSCallbackObject<Parent>::put):
+        (JSC::JSCallbackObject<Parent>::putByIndex):
+        (JSC::JSCallbackObject<Parent>::deleteProperty):
+        (JSC::JSCallbackObject<Parent>::construct):
+        (JSC::JSCallbackObject<Parent>::customHasInstance):
+        (JSC::JSCallbackObject<Parent>::call):
+        (JSC::JSCallbackObject<Parent>::getStaticValue):
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+        * API/JSTypedArray.cpp:
+        (createTypedArray):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::newTypedArrayWithSize):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionInternalConstructorName):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapSize):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapEntries):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetSize):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetEntries):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionIteratorEntries):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionSubtype):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionFunctionDetails):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionGetInternalProperties):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions):
+        (Inspector::jsJavaScriptCallFrameAttributeCaller):
+        (Inspector::jsJavaScriptCallFrameAttributeSourceID):
+        (Inspector::jsJavaScriptCallFrameAttributeLine):
+        (Inspector::jsJavaScriptCallFrameAttributeColumn):
+        (Inspector::jsJavaScriptCallFrameAttributeFunctionName):
+        (Inspector::jsJavaScriptCallFrameAttributeScopeChain):
+        (Inspector::jsJavaScriptCallFrameAttributeThisObject):
+        (Inspector::jsJavaScriptCallFrameAttributeType):
+        (Inspector::jsJavaScriptCallFrameIsTailDeleted):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::sizeOfVarargs):
+        (JSC::sizeFrameForForwardArguments):
+        (JSC::sizeFrameForVarargs):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JITOperations.cpp:
+        * jsc.cpp:
+        (WTF::CustomGetter::customGetter):
+        (WTF::RuntimeArray::lengthGetter):
+        (functionCreateElement):
+        (functionRun):
+        (functionRunString):
+        (functionLoad):
+        (functionLoadString):
+        (functionReadFile):
+        (functionCheckSyntax):
+        (functionTransferArrayBuffer):
+        (functionLoadModule):
+        (functionCheckModuleSyntax):
+        (functionSamplingProfilerStackTraces):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        (JSC::LLInt::llint_throw_stack_overflow_error):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayConstructor.h:
+        (JSC::isArray):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::concatAppendOne):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/CommonSlowPathsExceptions.cpp:
+        (JSC::CommonSlowPaths::interpreterThrowInCaller):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/DatePrototype.cpp:
+        (JSC::formateDateInstance):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncToPrimitiveSymbol):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/Error.cpp:
+        (JSC::throwConstructorCannotBeCalledAsFunctionTypeError):
+        (JSC::throwTypeError):
+        (JSC::throwSyntaxError):
+        * runtime/Error.h:
+        (JSC::throwRangeError):
+        (JSC::throwVMError):
+        (JSC::throwVMTypeError):
+        (JSC::throwVMRangeError):
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionFuzz.cpp:
+        (JSC::doExceptionFuzzing):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        (JSC::throwStackOverflowError):
+        (JSC::throwTerminatedExecutionException):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::EvalExecutable::create):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncBind):
+        * runtime/GetterSetter.cpp:
+        (JSC::callSetter):
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::compareStrings):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototypeGetterCompare):
+        (JSC::IntlCollatorPrototypeFuncResolvedOptions):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        (JSC::IntlDateTimeFormat::format):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        (JSC::IntlNumberFormat::formatNumber):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObject.cpp:
+        (JSC::intlStringOption):
+        (JSC::intlNumberOption):
+        (JSC::canonicalizeLocaleList):
+        (JSC::lookupSupportedLocales):
+        * runtime/IteratorOperations.cpp:
+        (JSC::iteratorNext):
+        (JSC::iteratorClose):
+        (JSC::createIteratorResultObject):
+        (JSC::iteratorForIterable):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::put):
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        (JSC::callArrayBuffer):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSCInlines.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::synthesizePrototype):
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::toPreferredPrimitiveType):
+        (JSC::JSValue::requireObjectCoercible):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::create):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        (JSC::dataViewProtoGetterBuffer):
+        (JSC::dataViewProtoGetterByteLength):
+        (JSC::dataViewProtoGetterByteOffset):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndex):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        (JSC::callGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::create):
+        (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
+        (JSC::JSGenericTypedArrayView<Adaptor>::validateRange):
+        (JSC::JSGenericTypedArrayView<Adaptor>::throwNeuteredTypedArrayTypeError):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncIncludes):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoGetterFuncBuffer):
+        (JSC::genericTypedArrayViewProtoGetterFuncLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteOffset):
+        (JSC::genericTypedArrayViewProtoFuncReverse):
+        (JSC::genericTypedArrayViewPrivateFuncSort):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncThrowTypeError):
+        (JSC::globalFuncThrowTypeErrorArgumentsCalleeAndCaller):
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::put):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
+        (JSC::JSModuleNamespaceObject::put):
+        (JSC::JSModuleNamespaceObject::putByIndex):
+        (JSC::JSModuleNamespaceObject::defineOwnProperty):
+        (JSC::moduleNamespaceObjectSymbolIterator):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::getModuleNamespace):
+        (JSC::JSModuleRecord::link):
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::callToPrimitiveFunction):
+        (JSC::JSObject::ordinaryToPrimitive):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::validateAndApplyPropertyDescriptor):
+        (JSC::JSObject::getMethod):
+        * runtime/JSObject.h:
+        (JSC::createListFromArrayLike): Deleted.
+        * runtime/JSObjectInlines.h:
+        (JSC::createListFromArrayLike):
+        (JSC::JSObject::putInline):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        (JSC::callPromise):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::propertyNameIteratorFuncNext):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::outOfMemory):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::build):
+        (JSC::jsMakeNontrivialString):
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::joinedLength):
+        (JSC::JSStringJoiner::join):
+        * runtime/JSStringJoiner.h:
+        (JSC::JSStringJoiner::JSStringJoiner):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::constructTypedArrayView):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncLength):
+        (JSC::typedArrayViewPrivateFuncSort):
+        (JSC::typedArrayViewProtoFuncSet):
+        (JSC::typedArrayViewProtoFuncCopyWithin):
+        (JSC::typedArrayViewProtoFuncIncludes):
+        (JSC::typedArrayViewProtoFuncLastIndexOf):
+        (JSC::typedArrayViewProtoFuncIndexOf):
+        (JSC::typedArrayViewProtoFuncJoin):
+        (JSC::typedArrayViewProtoGetterFuncBuffer):
+        (JSC::typedArrayViewProtoGetterFuncLength):
+        (JSC::typedArrayViewProtoGetterFuncByteLength):
+        (JSC::typedArrayViewProtoGetterFuncByteOffset):
+        (JSC::typedArrayViewProtoFuncReverse):
+        (JSC::typedArrayViewPrivateFuncSubarrayCreate):
+        (JSC::typedArrayViewProtoFuncSlice):
+        * runtime/MapConstructor.cpp:
+        (JSC::callMap):
+        (JSC::constructMap):
+        * runtime/MapDataInlines.h:
+        (JSC::JSIterator>::ensureSpaceForAppend):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/MapPrototype.cpp:
+        (JSC::getMap):
+        (JSC::mapProtoFuncValues):
+        (JSC::mapProtoFuncEntries):
+        (JSC::mapProtoFuncKeys):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+        * runtime/NullSetterFunction.cpp:
+        (JSC::callReturnUndefined):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsStringFromRegisterArray):
+        (JSC::jsStringFromArguments):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::makeRevocableProxy):
+        (JSC::proxyRevocableConstructorThrowError):
+        (JSC::constructProxyObject):
+        (JSC::callProxy):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::finishCreation):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        (JSC::ProxyObject::performPut):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectConstruct):
+        (JSC::reflectObjectDefineProperty):
+        (JSC::reflectObjectEnumerate):
+        (JSC::reflectObjectGet):
+        (JSC::reflectObjectGetOwnPropertyDescriptor):
+        (JSC::reflectObjectGetPrototypeOf):
+        (JSC::reflectObjectIsExtensible):
+        (JSC::reflectObjectOwnKeys):
+        (JSC::reflectObjectPreventExtensions):
+        (JSC::reflectObjectSet):
+        (JSC::reflectObjectSetPrototypeOf):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::toFlags):
+        (JSC::regExpCreate):
+        * runtime/RegExpObject.cpp:
+        (JSC::collectMatches):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTestFast):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncMatchFast):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        (JSC::regExpProtoGetterGlobal):
+        (JSC::regExpProtoGetterIgnoreCase):
+        (JSC::regExpProtoGetterMultiline):
+        (JSC::regExpProtoGetterSticky):
+        (JSC::regExpProtoGetterUnicode):
+        (JSC::regExpProtoGetterFlags):
+        (JSC::regExpProtoGetterSource):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/Reject.h:
+        (JSC::reject):
+        * runtime/SetConstructor.cpp:
+        (JSC::callSet):
+        (JSC::constructSet):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototypeFuncNext):
+        * runtime/SetPrototype.cpp:
+        (JSC::getSet):
+        (JSC::setProtoFuncValues):
+        (JSC::setProtoFuncEntries):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayEntry::put):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCodePoint):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::StringObject::putByIndex):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::repeatCharacter):
+        (JSC::replace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncCodePointAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::toLocaleCase):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::stringProtoFuncIterator):
+        (JSC::normalize):
+        (JSC::stringProtoFuncNormalize):
+        * runtime/StringRecursionChecker.cpp:
+        (JSC::StringRecursionChecker::throwStackOverflowError):
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::toNumber):
+        * runtime/SymbolConstructor.cpp:
+        (JSC::symbolConstructorKeyFor):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::symbolProtoFuncToString):
+        (JSC::symbolProtoFuncValueOf):
+        * runtime/ThrowScope.cpp: Added.
+        (JSC::ThrowScope::ThrowScope):
+        (JSC::ThrowScope::~ThrowScope):
+        (JSC::ThrowScope::throwException):
+        (JSC::ThrowScope::printIfNeedCheck):
+        (JSC::ThrowScope::simulateThrow):
+        (JSC::ThrowScope::verifyExceptionCheckNeedIsSatisfied):
+        * runtime/ThrowScope.h: Added.
+        (JSC::ThrowScope::vm):
+        (JSC::ThrowScope::exception):
+        (JSC::ThrowScope::release):
+        (JSC::ThrowScope::ThrowScope):
+        (JSC::ThrowScope::throwException):
+        (JSC::throwException):
+        * runtime/ThrowScopeLocation.h: Added.
+        (JSC::ThrowScopeLocation::ThrowScopeLocation):
+        * runtime/VM.h:
+        * runtime/VMEntryScope.h:
+        (JSC::VMEntryScope::vm):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::callWeakMap):
+        (JSC::constructWeakMap):
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::getWeakMapData):
+        (JSC::protoFuncWeakMapSet):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::callWeakSet):
+        (JSC::constructWeakSet):
+        * runtime/WeakSetPrototype.cpp:
+        (JSC::getWeakMapData):
+        (JSC::protoFuncWeakSetAdd):
+
+2016-08-30  Alex Christensen  <achristensen@webkit.org>
+
+        Fix WebInspectorUI in internal Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=161221
+        rdar://problem/28019023
+
+        Reviewed by Brent Fulgham and Joseph Pecoraro.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj:
+
+2016-08-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(r202568): Web Inspector: Expanding Array Prototype in Console shows no properties
+        https://bugs.webkit.org/show_bug.cgi?id=161263
+        <rdar://problem/28035849>
+
+        Reviewed by Matt Baker.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._propertyDescriptors):
+        Previously we only took the "numeric index fast path" if an object was
+        array like with length > 100. When we dropped the length check we
+        ended up breaking our display of Array prototype, because [].__proto__
+        is an array instance. Get it back by just doing a check of length > 0.
+        We may want to address this differently in the future by knowing if
+        we are getting properties for a prototype or not.
+
+2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Clean up FTL Capabilities for CompareEq
+        https://bugs.webkit.org/show_bug.cgi?id=161353
+
+        Reviewed by Geoffrey Garen.
+
+        It looks like we already have code for every case.
+        This patch removes the tests from FTLCapabilities
+        and move the generic case last as usual.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareEq):
+
+2016-08-29  Keith Miller  <keith_miller@apple.com>
+
+        Fix toStringName for Proxies and add support for normal instances
+        https://bugs.webkit.org/show_bug.cgi?id=161275
+
+        Reviewed by Saam Barati.
+
+        toStringName on proxies needs to follow the chain of proxies until it finds a non-proxy target.
+        Additionally, there are a couple of other classes that need to return "Object" for their
+        toStringName. Since this isn't tested by test262 I will propose a new test there.
+
+        * runtime/ClassInfo.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::toStringName):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toStringName):
+        * runtime/JSCell.h:
+        * runtime/JSMap.cpp:
+        (JSC::JSMap::toStringName):
+        * runtime/JSMap.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toStringName):
+        * runtime/JSObject.h:
+        * runtime/JSSet.cpp:
+        (JSC::JSSet::destroy):
+        (JSC::JSSet::toStringName):
+        * runtime/JSSet.h:
+        * runtime/JSWeakMap.cpp:
+        (JSC::JSWeakMap::toStringName):
+        * runtime/JSWeakMap.h:
+        * runtime/JSWeakSet.cpp:
+        (JSC::JSWeakSet::toStringName):
+        * runtime/JSWeakSet.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::toStringName):
+        * runtime/ProxyObject.h:
+        * runtime/SymbolObject.cpp:
+        (JSC::SymbolObject::toStringName):
+        * runtime/SymbolObject.h:
+        (JSC::SymbolObject::internalValue):
+
+2016-08-29  Youenn Fablet  <youenn@apple.com>
+
+        [Fetch API] Response cloning should structureClone when teeing Response stream
+        https://bugs.webkit.org/show_bug.cgi?id=161147
+
+        Reviewed by Darin Adler.
+
+        * builtins/BuiltinNames.h: Adding ArrayBuffer and isView identifiers.
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::finishCreation): Adding @isView as private method.
+        * runtime/JSDataView.h: Exporting create method.
+
+2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve ArithAbs with polymorphic input
+        https://bugs.webkit.org/show_bug.cgi?id=161286
+
+        Reviewed by Saam Barati.
+
+        This is similar to the previous patches: if we have polymorphic
+        input, do a function call.
+
+        I also discovered a few problems with the tests and fixed them:
+        -I forgot to add NodeMustGenerate to the previous nodes I changed.
+         They could have been eliminated by DCE.
+        -ArithAbs was always exiting if the input types do not include numbers.
+         The cause was the node was using isInt32OrBooleanSpeculationForArithmetic()
+         instead of isInt32OrBooleanSpeculation(). The test of
+         isInt32OrBooleanSpeculationForArithmetic() only verify the input does not
+         contains double or int52. If we were in that case, we were always speculating
+         Int32. That always fails and we were recompiling the same code over and over.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        Now that we have toNumberFromPrimitive(), we can improve constant folding here :)
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasResult):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasInt32Result): Deleted.
+        The accessor hasInt32Result() was unused.
+
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithAbs):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithAbs):
+
+2016-08-28  Saam Barati  <sbarati@apple.com>
+
+        Make SpeculatedType a 64-bit integer
+        https://bugs.webkit.org/show_bug.cgi?id=161268
+
+        Reviewed by Filip Pizlo and Benjamin Poulain.
+
+        I'm going to introduce two new types into this and we only
+        have room for one in 32-bits. So, this patch widens SpeculatedType
+        to 64 bits. This also pulls this information through the DFG where
+        we needed to change DFGNode to support this.
+
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToPutHint):
+        (JSC::DFG::Node::promotedLocationDescriptor):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::Node):
+        (JSC::DFG::Node::convertToCheckStructure):
+        (JSC::DFG::Node::constant):
+        (JSC::DFG::Node::convertToConstant):
+        (JSC::DFG::Node::convertToConstantStoragePointer):
+        (JSC::DFG::Node::convertToPutStack):
+        (JSC::DFG::Node::convertToGetStack):
+        (JSC::DFG::Node::convertToGetByOffset):
+        (JSC::DFG::Node::convertToMultiGetByOffset):
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::convertToMultiPutByOffset):
+        (JSC::DFG::Node::convertToPhantomNewObject):
+        (JSC::DFG::Node::convertToPhantomNewFunction):
+        (JSC::DFG::Node::convertToPhantomNewGeneratorFunction):
+        (JSC::DFG::Node::convertToPhantomCreateActivation):
+        (JSC::DFG::Node::convertToGetLocal):
+        (JSC::DFG::Node::lazyJSValue):
+        (JSC::DFG::Node::initializationValueForActivation):
+        (JSC::DFG::Node::tryGetVariableAccessData):
+        (JSC::DFG::Node::variableAccessData):
+        (JSC::DFG::Node::unlinkedLocal):
+        (JSC::DFG::Node::unlinkedMachineLocal):
+        (JSC::DFG::Node::stackAccessData):
+        (JSC::DFG::Node::phi):
+        (JSC::DFG::Node::identifierNumber):
+        (JSC::DFG::Node::getPutInfo):
+        (JSC::DFG::Node::accessorAttributes):
+        (JSC::DFG::Node::newArrayBufferData):
+        (JSC::DFG::Node::indexingType):
+        (JSC::DFG::Node::typedArrayType):
+        (JSC::DFG::Node::inlineCapacity):
+        (JSC::DFG::Node::scopeOffset):
+        (JSC::DFG::Node::capturedArgumentsOffset):
+        (JSC::DFG::Node::variablePointer):
+        (JSC::DFG::Node::callVarargsData):
+        (JSC::DFG::Node::loadVarargsData):
+        (JSC::DFG::Node::targetBytecodeOffsetDuringParsing):
+        (JSC::DFG::Node::targetBlock):
+        (JSC::DFG::Node::branchData):
+        (JSC::DFG::Node::switchData):
+        (JSC::DFG::Node::getHeapPrediction):
+        (JSC::DFG::Node::cellOperand):
+        (JSC::DFG::Node::watchpointSet):
+        (JSC::DFG::Node::storagePointer):
+        (JSC::DFG::Node::uidOperand):
+        (JSC::DFG::Node::typeInfoOperand):
+        (JSC::DFG::Node::transition):
+        (JSC::DFG::Node::structureSet):
+        (JSC::DFG::Node::structure):
+        (JSC::DFG::Node::storageAccessData):
+        (JSC::DFG::Node::multiGetByOffsetData):
+        (JSC::DFG::Node::multiPutByOffsetData):
+        (JSC::DFG::Node::objectMaterializationData):
+        (JSC::DFG::Node::arrayMode):
+        (JSC::DFG::Node::arithMode):
+        (JSC::DFG::Node::arithRoundingMode):
+        (JSC::DFG::Node::setArithRoundingMode):
+        (JSC::DFG::Node::executionCounter):
+        (JSC::DFG::Node::typeLocation):
+        (JSC::DFG::Node::basicBlockLocation):
+        (JSC::DFG::Node::numberOfArgumentsToSkip):
+        (JSC::DFG::Node::OpInfoWrapper::OpInfoWrapper):
+        (JSC::DFG::Node::OpInfoWrapper::operator=):
+        * dfg/DFGOpInfo.h:
+        (JSC::DFG::OpInfo::OpInfo):
+        * dfg/DFGPromotedHeapLocation.h:
+        (JSC::DFG::PromotedLocationDescriptor::imm1):
+        (JSC::DFG::PromotedLocationDescriptor::imm2):
+
+2016-08-27  Don Olmstead  <don.olmstead@am.sony.com>
+
+        Unused cxxabi.h include in JSGlobalObjectInspectorController.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=161120
+
+        Reviewed by Darin Adler.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+
+2016-08-26  Sam Weinig  <sam@webkit.org>
+
+        Remove support for ENABLE_LEGACY_WEB_AUDIO
+        https://bugs.webkit.org/show_bug.cgi?id=161262
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Remove ENABLE_LEGACY_WEB_AUDIO
+
+2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Implement CompareStrictEq(String, Untyped) in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=161229
+
+        Reviewed by Geoffrey Garen.
+
+        Add (String, Untyped) uses to FTL CompareStrictEq.
+        This was the last use type not implemented, the node is fully
+        supported by FTL after this patch.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringToUntypedStrictEquality):
+
+        (JSC::FTL::DFG::LowerDFGToB3::nonSpeculativeCompare):
+        Remove the type checks when possible.
+
+2016-08-26  Johan K. Jensen  <johan_jensen@apple.com>
+
+        Web Inspector: Frontend should have access to Resource Timing information
+        https://bugs.webkit.org/show_bug.cgi?id=160095
+
+        Reviewed by Alex Christensen.
+
+        Rename ResourceTiming property.
+
+        * inspector/protocol/Network.json:
+        Rename navigationStart to startTime so it's applicable
+        for all resources and not just the main resource.
+
+2016-08-25  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Provide a way to clear an IndexedDB object store
+        https://bugs.webkit.org/show_bug.cgi?id=161167
+        <rdar://problem/27996932>
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/IndexedDB.json:
+        Cleanup the protocol file.
+
+2016-08-26  Devin Rousso  <dcrousso+webkit@gmail.com>
+
+        Web Inspector: Some CSS selectors in the UI aren't escaped
+        https://bugs.webkit.org/show_bug.cgi?id=151378
+
+        Reviewed by Joseph Pecoraro.
+
+        Change ElementData from sending a className string to using an array of
+        classes, allowing for proper escaping of each class value.
+
+        * inspector/protocol/OverlayTypes.json:
+
+2016-08-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ScriptProfilerAgent and HeapAgent should do less work when frontend disconnects
+        https://bugs.webkit.org/show_bug.cgi?id=161213
+        <rdar://problem/28017986>
+
+        Reviewed by Brian Burg.
+
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::willDestroyFrontendAndBackend):
+        Don't take a final snapshot when disconnecting.
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorScriptProfilerAgent::stopSamplingWhenDisconnecting):
+        * inspector/agents/InspectorScriptProfilerAgent.h:
+        * runtime/SamplingProfiler.h:
+        Don't process samples when disconnecting.
+
+2016-08-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: HeapProfiler/ScriptProfiler do not destruct safely when JSContext is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=161027
+        <rdar://problem/27871349>
+
+        Reviewed by Mark Lam.
+
+        For JSContext inspection, when a frontend connects keep the target alive.
+        This means ref'ing the JSGlobalObject / VM when the first frontend
+        connects and deref'ing when the last frontend disconnects.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::globalObjectDestroyed):
+        (Inspector::JSGlobalObjectInspectorController::disconnectAllFrontends): Deleted.
+        Now that frontends keep the global object alive, when the global object
+        is destroyed that must mean that no frontends exist. Remove the now
+        stale code path.
+
+        (Inspector::JSGlobalObjectInspectorController::connectFrontend):
+        (Inspector::JSGlobalObjectInspectorController::disconnectFrontend):
+        Ref the target when the first frontend connects, deref when the last disconnects.
+
+2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] newPromiseCapabilities should check the given argument is constructor
+        https://bugs.webkit.org/show_bug.cgi?id=161226
+
+        Reviewed by Mark Lam.
+
+        Use @isConstructor.
+
+        * builtins/PromiseOperations.js:
+
+2016-08-25  Keith Miller  <keith_miller@apple.com>
+
+        toString called on proxies returns incorrect tag
+        https://bugs.webkit.org/show_bug.cgi?id=161111
+
+        Reviewed by Benjamin Poulain.
+
+        This patch adds a new Method table function toStringName. This function
+        is used by Object.prototype.toString to create the string tag that it
+        inserts. Right now it only changes the stringification of proxy objects.
+        In future patches I plan to make it work for other classes of objects as
+        well.
+
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::toStringName):
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toStringName):
+        * runtime/JSObject.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::toStringName):
+        * runtime/ProxyObject.h:
+
+2016-08-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the ENABLE(WEBASSEMBLY) build on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=161197
+
+        Reviewed by Mark Lam.
+
+        * CMakeLists.txt:
+        * b3/B3Common.cpp:
+        (JSC::B3::shouldDumpIR):
+        * shell/CMakeLists.txt:
+        * wasm/JSWASMModule.h:
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::toB3Op):
+        * wasm/WASMB3IRGenerator.h:
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionParser.h:
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASM::WASMModuleParser::parseFunctionTypes):
+        * wasm/WASMModuleParser.h:
+        * wasm/WASMParser.h:
+        * wasm/WASMPlan.cpp:
+        * wasm/WASMPlan.h:
+        * wasm/WASMSections.cpp:
+
+2016-08-26  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Compile fix.
+        https://bugs.webkit.org/show_bug.cgi?id=161235
+
+        Reviewed by Brent Fulgham.
+
+        YarrPattern::errorMessage has inconsistent dll linkage.
+
+        * yarr/YarrPattern.h:
+
+2016-08-25  Alex Christensen  <achristensen@webkit.org>
+
+        CMake build fix.
+
+        * ForwardingHeaders/JavaScriptCore/JSObjectRefPrivate.h: Added.
+        This is needed for the internal Windows build.
+
+2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
+        https://bugs.webkit.org/show_bug.cgi?id=161181
+
+        Reviewed by Geoffrey Garen.
+
+        All the nodes are doing the exact same thing with a single
+        difference: how to process constants. I made that into a separate
+        function called from each node.
+
+        I also generalized the constant-to-number code of DoubleRep
+        to make it available for all those nodes.
+
+        * dfg/DFGAbstractInterpreter.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toNumberFromPrimitive):
+        * runtime/JSCJSValue.h:
+
+2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG][FTL] Implement ES6 Generators in DFG / FTL
+        https://bugs.webkit.org/show_bug.cgi?id=152723
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces DFG and FTL support for ES6 generators.
+        ES6 generator is compiled by the BytecodeGenerator. But at the last phase, BytecodeGenerator performs "generatorification" onto the unlinked code.
+        In BytecodeGenerator phase, we just emit op_yield for each yield point. And we don't emit any generator related switch, save, and resume sequences
+        here. Those are emitted by the generatorification phase.
+
+        So the graph is super simple! Before the generatorification, the graph looks like this.
+
+             op_enter -> ...... -> op_yield -> ..... -> op_yield -> ...
+
+        Roughly speaking, in the generatorification phase, we turn out which variables should be saved and resumed at each op_yield.
+        This is done by liveness analysis. After that, we convert op_yield to the sequence of "op_put_to_scope", "op_ret", and "op_get_from_scope".
+        op_put_to_scope and op_get_from_scope sequences are corresponding to the save and resume sequences. We set up the scope for the generator frame and
+        perform op_put_to_scope and op_get_from_scope onto it. The live registers are saved and resumed over the generator's next() calls by using this
+        special generator frame scope. And we also set up the global switch for the generator.
+
+        In the generatorification phase,
+
+        1. We construct the BytecodeGraph from the unlinked instructions. This constructs the basic blocks, and it is used in the subsequent analysis.
+        2. We perform the analysis onto the unlinked code. We extract the live variables at each op_yield.
+        3. We insert the get_from_scope and put_to_scope at each op_yield. Which registers should be saved and resumed is offered by (2).
+           Then, clip the op_yield themselves. And we also insert the switch_imm. The jump targets of this switch are just after this op_switch_imm and each op_yield point.
+
+        One interesting point is the try-range. We split the try-range at the op_yield point in BytecodeGenerator phase.
+        This drops the hacky thing that is introduced in [1].
+        If the try-range covers the resume sequences, the exception handler's use-registers are incorrectly transferred to the entry block.
+        For example,
+
+            handler uses r2
+                                                             try-range
+            label:(entry block can jump here)                 ^
+                r1 = get_from_scope # resume sequence starts  | use r2 is transferred to the entry block!
+                r2 = get_from_scope                           |
+                starts usual sequences                        |
+                ...                                           |
+
+        Handler's r2 use should be considered at the `r1 = get_from_scope` point.
+        Previously, we handle this edge case by treating op_resume specially in the liveness analysis[1].
+        To drop this workaround, we split the try-range not to cover this resume sequence.
+
+            handler uses r2
+                                                             try-range
+            label:(entry block can jump here)
+                r1 = get_from_scope # resume sequence starts
+                r2 = get_from_scope
+                starts usual sequences                        ^ try-range should start from here.
+                ...                                           |
+
+        OK. Let's show the detailed example.
+
+            1. First, there is the normal bytecode sequence. Here, | represents the offsets, and [] represents the bytecodes.
+
+                bytecodes   | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
+                try-range   <----------------------------------->
+
+            2. When we emit the op_yield in the bytecode generator, we carefully split the try-range.
+
+                bytecodes   | [ ] | [ ] | [op_yield] | [ ] | [ ] | [ ] |
+                try-range   <----------->            <----------------->
+
+            3. And in the generatorification phase, we insert the switch's jump target and save & resume sequences. And we also drop op_yield.
+
+                        Insert save seq  Insert resume seq
+                        before op_yield. after op_yield's point.
+                                       v v
+                bytecodes   | [ ] | [ ] | [op_yield] | [ ] | [ ] | [ ] |
+                try-range   <----------->     ^      <----------------->
+                                        ^     |
+                             Jump to here.    Drop this op_yield.
+
+            4. The final layout is the following.
+
+                bytecodes   | [ ] | [ ][save seq][op_ret] | [resume seq] | [ ] | [ ] | [ ] |
+                try-range   <----------------------------->               <---------------->
+                                                          ^
+                                              Jump to here.
+
+        The rewriting done by the BytecodeRewriter is executed in a batch manner. Since these modification changes the basic blocks and size of unlinked instructions,
+        BytecodeRewriter also performs the offset adjustment for UnlinkedCodeBlock. So, this rewriting is performed onto the BytecodeGraph rather than BytecodeBasicBlock.
+        The reason why we take this design is simple: we don't want to newly create the basic blocks and opcodes for this early phase like DFG. Instead, we perform the
+        modification and adjustment to the unlinked instructions and UnlinkedCodeBlock in a in-place manner.
+
+        Bytecode rewriting functionality is offered by BytecodeRewriter. BytecodeRewriter allows us to insert any bytecodes to any places
+        in a in-place manner. BytecodeRewriter handles the original bytecode offsets as labels. And you can insert bytecodes before and after
+        these labels. You can also insert any jumps to any places. When you insert jumps, you need to specify jump target with this labels.
+        These labels (original bytecode offsets) are automatically converted to the appropriate offsets by BytecodeRewriter.
+
+        After that phase, the data flow of the generator-saved-and-resumed-registers are explicitly represented by the get_from_scope and put_to_scope.
+        And the switch is inserted to represent the actual control flow for the generator. And op_yield is removed. Since we use the existing bytecodes (op_switch_imm, op_put_to_scope
+        op_ret, and op_get_from_scope), DFG and FTL changes are not necessary. This patch also drops data structures and implementations for the old generator,
+        op_resume, op_save implementations and GeneratorFrame.
+
+        Note that this patch does not leverage the recent multi entrypoints support in B3. After this patch is introduced, we will submit a new patch that leverages the multi
+        entrypoints for generator's resume and sees the performance gain.
+
+        Microbenchmarks related to generators show up to 2.9x improvements.
+
+                                                        Baseline                  Patched
+
+            generator-fib                          102.0116+-3.2880     ^     34.9670+-0.2221        ^ definitely 2.9174x faster
+            generator-sunspider-access-nsieve        5.8596+-0.0371     ^      4.9051+-0.0720        ^ definitely 1.1946x faster
+            generator-with-several-types           332.1478+-4.2425     ^    124.6642+-2.4826        ^ definitely 2.6643x faster
+
+            <geometric>                             58.2998+-0.7758     ^     27.7425+-0.2577        ^ definitely 2.1015x faster
+
+        In ES6SampleBench's Basic, we can observe 41% improvement (Macbook Pro).
+
+            Baseline:
+                Geometric Mean Result: 133.55 ms +- 4.49 ms
+
+                Benchmark    First Iteration        Worst 2%               Steady State
+                Air          54.03 ms +- 7.51 ms    29.06 ms +- 3.13 ms    2276.59 ms +- 61.17 ms
+                Basic        30.18 ms +- 1.86 ms    18.85 ms +- 0.45 ms    2851.16 ms +- 41.87 ms
+
+            Patched:
+                Geometric Mean Result: 121.78 ms +- 3.96 ms
+
+                Benchmark    First Iteration        Worst 2%               Steady State
+                Air          52.09 ms +- 6.89 ms    29.59 ms +- 3.16 ms    2239.90 ms +- 54.60 ms
+                Basic        29.28 ms +- 1.46 ms    16.26 ms +- 0.66 ms    2025.15 ms +- 38.56 ms
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=159281
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/GeneratorPrototype.js:
+        (globalPrivate.generatorResume):
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::BytecodeBasicBlock::shrinkToFit):
+        (JSC::BytecodeBasicBlock::computeImpl):
+        (JSC::BytecodeBasicBlock::compute):
+        (JSC::isBranch): Deleted.
+        (JSC::isUnconditionalBranch): Deleted.
+        (JSC::isTerminal): Deleted.
+        (JSC::isThrow): Deleted.
+        (JSC::linkBlocks): Deleted.
+        (JSC::computeBytecodeBasicBlocks): Deleted.
+        * bytecode/BytecodeBasicBlock.h:
+        (JSC::BytecodeBasicBlock::isEntryBlock):
+        (JSC::BytecodeBasicBlock::isExitBlock):
+        (JSC::BytecodeBasicBlock::leaderOffset):
+        (JSC::BytecodeBasicBlock::totalLength):
+        (JSC::BytecodeBasicBlock::offsets):
+        (JSC::BytecodeBasicBlock::successors):
+        (JSC::BytecodeBasicBlock::index):
+        (JSC::BytecodeBasicBlock::addSuccessor):
+        (JSC::BytecodeBasicBlock::BytecodeBasicBlock):
+        (JSC::BytecodeBasicBlock::addLength):
+        (JSC::BytecodeBasicBlock::leaderBytecodeOffset): Deleted.
+        (JSC::BytecodeBasicBlock::totalBytecodeLength): Deleted.
+        (JSC::BytecodeBasicBlock::bytecodeOffsets): Deleted.
+        (JSC::BytecodeBasicBlock::addBytecodeLength): Deleted.
+        * bytecode/BytecodeGeneratorification.cpp: Added.
+        (JSC::BytecodeGeneratorification::BytecodeGeneratorification):
+        (JSC::BytecodeGeneratorification::graph):
+        (JSC::BytecodeGeneratorification::yields):
+        (JSC::BytecodeGeneratorification::enterPoint):
+        (JSC::BytecodeGeneratorification::storageForGeneratorLocal):
+        (JSC::GeneratorLivenessAnalysis::GeneratorLivenessAnalysis):
+        (JSC::GeneratorLivenessAnalysis::computeDefsForBytecodeOffset):
+        (JSC::GeneratorLivenessAnalysis::computeUsesForBytecodeOffset):
+        (JSC::GeneratorLivenessAnalysis::run):
+        (JSC::BytecodeGeneratorification::run):
+        (JSC::performGeneratorification):
+        * bytecode/BytecodeGeneratorification.h: Copied from Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysisInlines.h.
+        * bytecode/BytecodeGraph.h: Added.
+        (JSC::BytecodeGraph::codeBlock):
+        (JSC::BytecodeGraph::instructions):
+        (JSC::BytecodeGraph::basicBlocksInReverseOrder):
+        (JSC::BytecodeGraph::blockContainsBytecodeOffset):
+        (JSC::BytecodeGraph::findBasicBlockForBytecodeOffset):
+        (JSC::BytecodeGraph::findBasicBlockWithLeaderOffset):
+        (JSC::BytecodeGraph::size):
+        (JSC::BytecodeGraph::at):
+        (JSC::BytecodeGraph::operator[]):
+        (JSC::BytecodeGraph::begin):
+        (JSC::BytecodeGraph::end):
+        (JSC::BytecodeGraph::first):
+        (JSC::BytecodeGraph::last):
+        (JSC::BytecodeGraph<Block>::BytecodeGraph):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::BytecodeLivenessAnalysis::BytecodeLivenessAnalysis):
+        (JSC::BytecodeLivenessAnalysis::computeDefsForBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::computeUsesForBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::getLivenessInfoAtBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
+        (JSC::BytecodeLivenessAnalysis::computeKills):
+        (JSC::BytecodeLivenessAnalysis::dumpResults):
+        (JSC::BytecodeLivenessAnalysis::compute):
+        (JSC::isValidRegisterForLiveness): Deleted.
+        (JSC::getLeaderOffsetForBasicBlock): Deleted.
+        (JSC::findBasicBlockWithLeaderOffset): Deleted.
+        (JSC::blockContainsBytecodeOffset): Deleted.
+        (JSC::findBasicBlockForBytecodeOffset): Deleted.
+        (JSC::stepOverInstruction): Deleted.
+        (JSC::computeLocalLivenessForBytecodeOffset): Deleted.
+        (JSC::computeLocalLivenessForBlock): Deleted.
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint): Deleted.
+        * bytecode/BytecodeLivenessAnalysis.h:
+        * bytecode/BytecodeLivenessAnalysisInlines.h:
+        (JSC::isValidRegisterForLiveness):
+        (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::stepOverInstruction):
+        (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::computeLocalLivenessForBytecodeOffset):
+        (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::computeLocalLivenessForBlock):
+        (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::getLivenessInfoAtBytecodeOffset):
+        (JSC::BytecodeLivenessPropagation<DerivedAnalysis>::runLivenessFixpoint):
+        * bytecode/BytecodeRewriter.cpp: Added.
+        (JSC::BytecodeRewriter::applyModification):
+        (JSC::BytecodeRewriter::execute):
+        (JSC::BytecodeRewriter::adjustJumpTargetsInFragment):
+        (JSC::BytecodeRewriter::insertImpl):
+        (JSC::BytecodeRewriter::adjustJumpTarget):
+        * bytecode/BytecodeRewriter.h: Added.
+        (JSC::BytecodeRewriter::InsertionPoint::InsertionPoint):
+        (JSC::BytecodeRewriter::InsertionPoint::operator<):
+        (JSC::BytecodeRewriter::InsertionPoint::operator==):
+        (JSC::BytecodeRewriter::Insertion::length):
+        (JSC::BytecodeRewriter::Fragment::Fragment):
+        (JSC::BytecodeRewriter::Fragment::appendInstruction):
+        (JSC::BytecodeRewriter::BytecodeRewriter):
+        (JSC::BytecodeRewriter::insertFragmentBefore):
+        (JSC::BytecodeRewriter::insertFragmentAfter):
+        (JSC::BytecodeRewriter::removeBytecode):
+        (JSC::BytecodeRewriter::graph):
+        (JSC::BytecodeRewriter::adjustAbsoluteOffset):
+        (JSC::BytecodeRewriter::adjustJumpTarget):
+        (JSC::BytecodeRewriter::calculateDifference):
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::handlerForIndex):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::valueProfileForBytecodeOffset):
+        (JSC::CodeBlock::livenessAnalysisSlow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+        (JSC::CodeBlock::livenessAnalysis):
+        (JSC::CodeBlock::liveCalleeLocalsAtYield): Deleted.
+        * bytecode/HandlerInfo.h:
+        (JSC::HandlerInfoBase::handlerForIndex):
+        * bytecode/Opcode.h:
+        (JSC::isBranch):
+        (JSC::isUnconditionalBranch):
+        (JSC::isTerminal):
+        (JSC::isThrow):
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::getJumpTargetsForBytecodeOffset):
+        (JSC::computePreciseJumpTargetsInternal):
+        (JSC::computePreciseJumpTargets):
+        (JSC::recomputePreciseJumpTargets):
+        (JSC::findJumpTargetsForBytecodeOffset):
+        * bytecode/PreciseJumpTargets.h:
+        * bytecode/PreciseJumpTargetsInlines.h: Added.
+        (JSC::extractStoredJumpTargetsForBytecodeOffset):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::handlerForBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::handlerForIndex):
+        (JSC::UnlinkedCodeBlock::applyModification):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedStringJumpTable::offsetForValue):
+        (JSC::UnlinkedCodeBlock::numCalleeLocals):
+        * bytecode/VirtualRegister.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::prepareJumpTableForStringSwitch):
+        (JSC::BytecodeGenerator::emitYieldPoint):
+        (JSC::BytecodeGenerator::emitSave): Deleted.
+        (JSC::BytecodeGenerator::emitResume): Deleted.
+        (JSC::BytecodeGenerator::emitGeneratorStateLabel): Deleted.
+        (JSC::BytecodeGenerator::beginGenerator): Deleted.
+        (JSC::BytecodeGenerator::endGenerator): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::generatorStateRegister):
+        (JSC::BytecodeGenerator::generatorValueRegister):
+        (JSC::BytecodeGenerator::generatorResumeModeRegister):
+        (JSC::BytecodeGenerator::generatorFrameRegister):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionNode::emitBytecode):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::findExceptionHandler):
+        (JSC::GetCatchHandlerFunctor::operator()):
+        (JSC::UnwindFunctor::operator()):
+        * interpreter/Interpreter.h:
+        * interpreter/InterpreterInlines.h: Copied from Source/JavaScriptCore/bytecode/PreciseJumpTargets.h.
+        (JSC::Interpreter::getOpcodeID):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_save): Deleted.
+        (JSC::JIT::emit_op_resume): Deleted.
+        * llint/LowLevelInterpreter.asm:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
+        (JSC::Parser<LexerType>::createGeneratorParameters):
+        * parser/Parser.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL): Deleted.
+        * runtime/CommonSlowPaths.h:
+        * runtime/GeneratorFrame.cpp: Removed.
+        (JSC::GeneratorFrame::GeneratorFrame): Deleted.
+        (JSC::GeneratorFrame::finishCreation): Deleted.
+        (JSC::GeneratorFrame::createStructure): Deleted.
+        (JSC::GeneratorFrame::create): Deleted.
+        (JSC::GeneratorFrame::save): Deleted.
+        (JSC::GeneratorFrame::resume): Deleted.
+        (JSC::GeneratorFrame::visitChildren): Deleted.
+        * runtime/GeneratorFrame.h: Removed.
+        (JSC::GeneratorFrame::locals): Deleted.
+        (JSC::GeneratorFrame::localAt): Deleted.
+        (JSC::GeneratorFrame::offsetOfLocals): Deleted.
+        (JSC::GeneratorFrame::allocationSizeForLocals): Deleted.
+        * runtime/JSGeneratorFunction.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-08-25  JF Bastien  <jfbastien@apple.com>
+
+        TryGetById should have a ValueProfile so that it can predict its output type
+        https://bugs.webkit.org/show_bug.cgi?id=160921
+
+        Reviewed by Saam Barati.
+
+        Add a ValueProfile to TryGetById, and make sure DFG picks it up.
+
+        A microbenchmark for perfectly predicted computation shows a 20%
+        runtime reduction with no hit if the prediction goes polymorphic.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finishCreation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitTryGetById):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_try_get_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_try_get_by_id):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+
+2016-08-25  Csaba Osztrogonác  <ossy@webkit.org>
+
+        generate-js-builtins.py should generate platform independent files
+        https://bugs.webkit.org/show_bug.cgi?id=161196
+
+        Reviewed by Mark Lam.
+
+        * Scripts/generate-js-builtins.py: Files should be processed in fixed order.
+
+2016-08-25  Caio Lima  <ticaiolima@gmail.com>
+
+        NewRegexp should not prevent inlining
+        https://bugs.webkit.org/show_bug.cgi?id=154808
+
+        Reviewed by Geoffrey Garen.
+
+        In this patch we are changing the current mechanism used to represent
+        RegExp in NewRegexp nodes. We are changing the use of a index
+        pointing to RegExp in
+        CodeBlock->m_unlinkedCodeBlock->m_rareData->m_regexps as the operand of
+        NewRegexp node to RegExp address as the operand. To make sure that RegExp* is
+        pointing to a valid object, we are using m_graph.freezeStrong
+        mechanism.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::hasRegexpIndex): Deleted.
+        (JSC::DFG::Node::regexpIndex): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
+
+2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Make FRound work with any type
+        https://bugs.webkit.org/show_bug.cgi?id=161129
+
+        Reviewed by Geoffrey Garen.
+
+        Math.fround() does nothing with arguments past the first one
+        (https://tc39.github.io/ecma262/#sec-math.fround).
+        We can unify ArithFRound with the other single-input intrinsics.
+
+        Everything else is same old: if the input type is not a number,
+        be pessimistic about everything and do a C call.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithFRound):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithFRound):
+
+2016-08-24  Andreas Kling  <akling@apple.com>
+
+        Shrink DFG::OSRExit a bit.
+        <https://webkit.org/b/161169>
+
+        Reviewed by Geoffrey Garen.
+
+        Rearrange the members of OSRExitBase and DFG::OSRExit to save 16 bytes per instance.
+
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::OSRExitBase):
+
+2016-08-24  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Rebaseline builtins-generator-tests since r204854 was rolled out.
+
+        Unreviewed test gardening.
+
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
+        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:
+
+2016-08-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Move generic data structures out of B3
+        https://bugs.webkit.org/show_bug.cgi?id=161155
+
+        Reviewed by Saam Barati.
+
+        Move B3's good generic data structures to WTF.
+        They can be used for the other kind of basic blocks and nodes.
+        For example, the generator patch[1] will make BytecodeBasicBlock usable with these structures.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=152723
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3BasicBlockUtils.h:
+        * b3/B3BlockWorklist.h:
+        * b3/B3CFG.h:
+        * b3/B3DuplicateTails.cpp:
+        * b3/B3FixSSA.cpp:
+        * b3/B3FixSSA.h:
+        * b3/B3IndexMap.h:
+        (JSC::B3::IndexMap::IndexMap): Deleted.
+        (JSC::B3::IndexMap::resize): Deleted.
+        (JSC::B3::IndexMap::clear): Deleted.
+        (JSC::B3::IndexMap::size): Deleted.
+        (JSC::B3::IndexMap::operator[]): Deleted.
+        * b3/B3IndexSet.h:
+        (JSC::B3::IndexSet::IndexSet): Deleted.
+        (JSC::B3::IndexSet::add): Deleted.
+        (JSC::B3::IndexSet::addAll): Deleted.
+        (JSC::B3::IndexSet::remove): Deleted.
+        (JSC::B3::IndexSet::contains): Deleted.
+        (JSC::B3::IndexSet::size): Deleted.
+        (JSC::B3::IndexSet::isEmpty): Deleted.
+        (JSC::B3::IndexSet::Iterable::Iterable): Deleted.
+        (JSC::B3::IndexSet::Iterable::iterator::iterator): Deleted.
+        (JSC::B3::IndexSet::Iterable::iterator::operator*): Deleted.
+        (JSC::B3::IndexSet::Iterable::iterator::operator++): Deleted.
+        (JSC::B3::IndexSet::Iterable::iterator::operator==): Deleted.
+        (JSC::B3::IndexSet::Iterable::iterator::operator!=): Deleted.
+        (JSC::B3::IndexSet::Iterable::begin): Deleted.
+        (JSC::B3::IndexSet::Iterable::end): Deleted.
+        (JSC::B3::IndexSet::values): Deleted.
+        (JSC::B3::IndexSet::indices): Deleted.
+        (JSC::B3::IndexSet::dump): Deleted.
+        * b3/B3LowerToAir.cpp:
+        * b3/B3PhiChildren.h:
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::iterator::iterator): Deleted.
+        (JSC::B3::Procedure::iterator::operator*): Deleted.
+        (JSC::B3::Procedure::iterator::operator++): Deleted.
+        (JSC::B3::Procedure::iterator::operator==): Deleted.
+        (JSC::B3::Procedure::iterator::operator!=): Deleted.
+        (JSC::B3::Procedure::iterator::findNext): Deleted.
+        * b3/B3ReduceDoubleToFloat.cpp:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3SSACalculator.h:
+        * b3/B3UseCounts.h:
+        * b3/air/AirCode.h:
+        * b3/air/AirEliminateDeadCode.cpp:
+        * b3/air/AirFixObviousSpills.cpp:
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+        * b3/air/AirGenerate.cpp:
+        * b3/air/AirGenerationContext.h:
+        * b3/air/AirLiveness.h:
+        * b3/air/AirSpillEverything.cpp:
+
+2016-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
+
+        * API/JSTypedArray.cpp:
+        * API/ObjCCallbackFunction.mm:
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Scripts/builtins/builtins_generate_combined_implementation.py:
+        (BuiltinsCombinedImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
+        (BuiltinsInternalsWrapperImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generate_separate_implementation.py:
+        (BuiltinsSeparateImplementationGenerator.generate_secondary_header_includes):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::link):
+        (JSC::AbstractMacroAssembler::JumpList::linkTo):
+        * assembler/MacroAssembler.h:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::add32):
+        * assembler/MacroAssemblerCodeRef.cpp: Removed.
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
+        (JSC::MacroAssemblerCodePtr::dumpWithName):
+        (JSC::MacroAssemblerCodePtr::dump):
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
+        (JSC::MacroAssemblerCodeRef::dump):
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::appendBoolConstant): Deleted.
+        * b3/B3BasicBlock.h:
+        * b3/B3DuplicateTails.cpp:
+        * b3/B3StackmapGenerationParams.h:
+        * b3/testb3.cpp:
+        (JSC::B3::run):
+        (JSC::B3::testPatchpointTerminalReturnValue): Deleted.
+        * bindings/ScriptValue.cpp:
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp:
+        * bytecode/BytecodeBasicBlock.cpp:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        * bytecode/BytecodeUseDef.h:
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::callTypeFor): Deleted.
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::callTypeFor):
+        * bytecode/CallLinkStatus.cpp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::clearLLIntGetByIdCache): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::jitCodeMap):
+        (JSC::clearLLIntGetByIdCache):
+        * bytecode/Instruction.h:
+        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:
+        (JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::fireInternal):
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::isNull):
+        (JSC::ObjectAllocationProfile::initialize):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/PolymorphicAccess.h:
+        * bytecode/PreciseJumpTargets.cpp:
+        * bytecode/StructureStubInfo.cpp:
+        * bytecode/StructureStubInfo.h:
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::vm):
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecode/UnlinkedInstructionStream.cpp:
+        * bytecode/UnlinkedInstructionStream.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLJITFinalizer.cpp:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileAllocateArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateArrayWithSize): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::allocateHeapCell): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::allocatorForSize): Deleted.
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::add):
+        (JSC::FTL::Output::shl):
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        (JSC::FTL::Output::above):
+        (JSC::FTL::Output::aboveOrEqual):
+        (JSC::FTL::Output::below):
+        (JSC::FTL::Output::belowOrEqual):
+        (JSC::FTL::Output::greaterThan):
+        (JSC::FTL::Output::greaterThanOrEqual):
+        (JSC::FTL::Output::lessThan):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::select):
+        (JSC::FTL::Output::addIncomingToPhi):
+        (JSC::FTL::Output::appendSuccessor): Deleted.
+        * ftl/FTLOutput.h:
+        * ftl/FTLValueFromBlock.h:
+        (JSC::FTL::ValueFromBlock::ValueFromBlock):
+        (JSC::FTL::ValueFromBlock::operator bool): Deleted.
+        * ftl/FTLWeightedTarget.h:
+        (JSC::FTL::WeightedTarget::frequentedBlock): Deleted.
+        * heap/CellContainer.h: Removed.
+        * heap/CellContainerInlines.h: Removed.
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::~ConservativeRoots):
+        (JSC::ConservativeRoots::grow):
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::genericAddSpan):
+        * heap/ConservativeRoots.h:
+        (JSC::ConservativeRoots::roots):
+        * heap/CopyToken.h:
+        * heap/FreeList.cpp: Removed.
+        * heap/FreeList.h: Removed.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::lastChanceToFinalize):
+        (JSC::Heap::finalizeUnconditionalFinalizers):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::gatherStackRoots):
+        (JSC::Heap::gatherJSStackRoots):
+        (JSC::Heap::gatherScratchBufferRoots):
+        (JSC::Heap::clearLivenessData):
+        (JSC::Heap::visitSmallStrings):
+        (JSC::Heap::visitConservativeRoots):
+        (JSC::Heap::removeDeadCompilerWorklistEntries):
+        (JSC::Heap::gatherExtraHeapSnapshotData):
+        (JSC::Heap::removeDeadHeapSnapshotNodes):
+        (JSC::Heap::visitProtectedObjects):
+        (JSC::Heap::visitArgumentBuffers):
+        (JSC::Heap::visitException):
+        (JSC::Heap::visitStrongHandles):
+        (JSC::Heap::visitHandleStack):
+        (JSC::Heap::visitSamplingProfiler):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        (JSC::Heap::converge):
+        (JSC::Heap::visitWeakHandles):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::clearUnmarkedExecutables):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::suspendCompilerThreads):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::flushOldStructureIDTables):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        (JSC::Heap::stopAllocation):
+        (JSC::Heap::reapWeakHandles):
+        (JSC::Heap::pruneStaleEntriesFromWeakGCMaps):
+        (JSC::Heap::sweepArrayBuffers):
+        (JSC::Heap::snapshotMarkedSpace):
+        (JSC::Heap::deleteSourceProviderCaches):
+        (JSC::Heap::notifyIncrementalSweeper):
+        (JSC::Heap::writeBarrierCurrentlyExecutingCodeBlocks):
+        (JSC::Heap::resetAllocators):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::resumeCompilerThreads):
+        (JSC::Zombify::visit):
+        (JSC::Heap::collectWithoutAnySweep): Deleted.
+        (JSC::Heap::prepareForMarking): Deleted.
+        (JSC::Heap::forEachCodeBlockImpl): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::allocatorForObjectWithoutDestructor):
+        (JSC::Heap::allocatorForObjectWithDestructor):
+        (JSC::Heap::storageAllocator):
+        (JSC::Heap::jitStubRoutines):
+        (JSC::Heap::codeBlockSet):
+        (JSC::Heap::allocatorForAuxiliaryData): Deleted.
+        * heap/HeapCell.h:
+        (JSC::HeapCell::isZapped):
+        * heap/HeapCellInlines.h: Removed.
+        * heap/HeapInlines.h:
+        (JSC::Heap::heap):
+        (JSC::Heap::isLive):
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::setMarked):
+        (JSC::Heap::forEachCodeBlock):
+        (JSC::Heap::allocateObjectOfType):
+        (JSC::Heap::subspaceForObjectOfType):
+        (JSC::Heap::allocatorForObjectOfType):
+        (JSC::Heap::isPointerGCObject):
+        (JSC::Heap::isValueGCObject):
+        (JSC::Heap::cellSize): Deleted.
+        (JSC::Heap::allocateAuxiliary): Deleted.
+        (JSC::Heap::tryAllocateAuxiliary): Deleted.
+        (JSC::Heap::tryReallocateAuxiliary): Deleted.
+        * heap/HeapUtil.h: Removed.
+        * heap/LargeAllocation.cpp: Removed.
+        * heap/LargeAllocation.h: Removed.
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::retire):
+        (JSC::MarkedAllocator::tryAllocateHelper):
+        (JSC::MarkedAllocator::tryPopFreeList):
+        (JSC::MarkedAllocator::tryAllocate):
+        (JSC::MarkedAllocator::allocateSlowCase):
+        (JSC::MarkedAllocator::allocateBlock):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::reset):
+        (JSC::MarkedAllocator::MarkedAllocator): Deleted.
+        (JSC::MarkedAllocator::tryAllocateWithoutCollectingImpl): Deleted.
+        (JSC::MarkedAllocator::tryAllocateWithoutCollecting): Deleted.
+        (JSC::MarkedAllocator::tryAllocateSlowCase): Deleted.
+        (JSC::MarkedAllocator::allocateSlowCaseImpl): Deleted.
+        (JSC::blockHeaderSize): Deleted.
+        (JSC::MarkedAllocator::blockSizeForBytes): Deleted.
+        (JSC::MarkedAllocator::tryAllocateBlock): Deleted.
+        (JSC::MarkedAllocator::setFreeList): Deleted.
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::offsetOfFreeListHead):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::init):
+        (JSC::MarkedAllocator::allocate):
+        (JSC::MarkedAllocator::stopAllocating):
+        (JSC::MarkedAllocator::offsetOfFreeList): Deleted.
+        (JSC::MarkedAllocator::offsetOfCellSize): Deleted.
+        (JSC::MarkedAllocator::tryAllocate): Deleted.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::callDestructor):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelper):
+        (JSC::MarkedBlock::stopAllocating):
+        (JSC::MarkedBlock::clearMarksWithCollectionType):
+        (JSC::MarkedBlock::resumeAllocating):
+        (JSC::MarkedBlock::didRetireBlock):
+        (JSC::MarkedBlock::tryCreate): Deleted.
+        (JSC::MarkedBlock::sweepHelperSelectScribbleMode): Deleted.
+        (JSC::MarkedBlock::sweepHelperSelectStateAndSweepMode): Deleted.
+        (JSC::MarkedBlock::forEachFreeCell): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::FreeList::FreeList):
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::setHasAnyMarked): Deleted.
+        (JSC::MarkedBlock::hasAnyMarked): Deleted.
+        (JSC::MarkedBlock::clearHasAnyMarked): Deleted.
+        (JSC::MarkedBlock::cellAlign): Deleted.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::zombifySweep):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        (JSC::MarkedSpace::forEachAllocator):
+        (JSC::MarkedSpace::stopAllocating):
+        (JSC::MarkedSpace::resumeAllocating):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::MarkedSpace::initializeSizeClassForStepSize): Deleted.
+        (JSC::MarkedSpace::allocate): Deleted.
+        (JSC::MarkedSpace::tryAllocate): Deleted.
+        (JSC::MarkedSpace::allocateLarge): Deleted.
+        (JSC::MarkedSpace::tryAllocateLarge): Deleted.
+        (JSC::MarkedSpace::sweepLargeAllocations): Deleted.
+        (JSC::MarkedSpace::prepareForMarking): Deleted.
+        (JSC::MarkedSpace::objectCount): Deleted.
+        (JSC::MarkedSpace::size): Deleted.
+        (JSC::MarkedSpace::capacity): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::blocksWithNewObjects):
+        (JSC::MarkedSpace::forEachLiveCell):
+        (JSC::MarkedSpace::forEachDeadCell):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::destructorAllocatorFor):
+        (JSC::MarkedSpace::auxiliaryAllocatorFor):
+        (JSC::MarkedSpace::allocateWithoutDestructor):
+        (JSC::MarkedSpace::allocateWithDestructor):
+        (JSC::MarkedSpace::allocateAuxiliary):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        (JSC::MarkedSpace::sizeClassToIndex): Deleted.
+        (JSC::MarkedSpace::indexToSizeClass): Deleted.
+        (JSC::MarkedSpace::largeAllocations): Deleted.
+        (JSC::MarkedSpace::largeAllocationsNurseryOffset): Deleted.
+        (JSC::MarkedSpace::largeAllocationsOffsetForThisCollection): Deleted.
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionBegin): Deleted.
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionEnd): Deleted.
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionSize): Deleted.
+        (JSC::MarkedSpace::tryAllocateAuxiliary): Deleted.
+        (JSC::MarkedSpace::forEachAllocator): Deleted.
+        (JSC::MarkedSpace::optimalSizeFor): Deleted.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset):
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::visitChildren):
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary): Deleted.
+        (JSC::SlotVisitor::markAuxiliary): Deleted.
+        (JSC::SlotVisitor::noteLiveAuxiliaryCell): Deleted.
+        * heap/SlotVisitor.h:
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::WeakBlock):
+        (JSC::WeakBlock::visit):
+        (JSC::WeakBlock::reap):
+        * heap/WeakBlock.h:
+        (JSC::WeakBlock::disconnectMarkedBlock):
+        (JSC::WeakBlock::disconnectContainer): Deleted.
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::sweep):
+        (JSC::WeakSet::addAllocator):
+        * heap/WeakSet.h:
+        (JSC::WeakSet::WeakSet):
+        * heap/WeakSetInlines.h:
+        (JSC::WeakSet::allocate):
+        * inspector/InjectedScriptManager.cpp:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        * inspector/ScriptDebugServer.cpp:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::StackFrame::sourceID):
+        (JSC::StackFrame::sourceURL):
+        (JSC::StackFrame::functionName):
+        (JSC::loadVarargs):
+        (JSC::StackFrame::computeLineAndColumn):
+        (JSC::StackFrame::toString):
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::isNative):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocate):
+        (JSC::AssemblyHelpers::emitAllocateJSCell):
+        (JSC::AssemblyHelpers::emitAllocateJSObject):
+        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
+        (JSC::AssemblyHelpers::emitAllocateVariableSized):
+        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator): Deleted.
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileCTINativeCall): Deleted.
+        * jit/JIT.h:
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind): Deleted.
+        * jit/JITExceptions.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emitSlow_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+        * jit/JITThunks.cpp:
+        * jit/JITThunks.h:
+        * jsc.cpp:
+        (functionDescribeArray):
+        (main):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntExceptions.cpp:
+        * llint/LLIntThunks.cpp:
+        * llint/LLIntThunks.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ModuleAnalyzer.cpp:
+        * parser/NodeConstructors.h:
+        * parser/Nodes.h:
+        * profiler/ProfilerBytecode.cpp:
+        * profiler/ProfilerBytecode.h:
+        * profiler/ProfilerBytecodeSequence.cpp:
+        * runtime/ArrayConventions.h:
+        (JSC::indexingHeaderForArray):
+        (JSC::baseIndexingHeaderForArray):
+        (JSC::indexingHeaderForArrayStorage): Deleted.
+        (JSC::baseIndexingHeaderForArrayStorage): Deleted.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        (JSC::concatAppendOne):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        * runtime/ArrayStorage.h:
+        (JSC::ArrayStorage::vectorLength):
+        (JSC::ArrayStorage::sizeFor):
+        (JSC::ArrayStorage::totalSizeFor): Deleted.
+        (JSC::ArrayStorage::totalSize): Deleted.
+        (JSC::ArrayStorage::availableVectorLength): Deleted.
+        (JSC::ArrayStorage::optimalVectorLength): Deleted.
+        * runtime/AuxiliaryBarrier.h: Removed.
+        * runtime/AuxiliaryBarrierInlines.h: Removed.
+        * runtime/Butterfly.h:
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::createUninitialized):
+        (JSC::Butterfly::growArrayRight):
+        (JSC::Butterfly::availableContiguousVectorLength): Deleted.
+        (JSC::Butterfly::optimalContiguousVectorLength): Deleted.
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createEmpty):
+        * runtime/CommonSlowPathsExceptions.cpp:
+        * runtime/CommonSlowPathsExceptions.h:
+        * runtime/DataView.cpp:
+        * runtime/DirectArguments.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp:
+        * runtime/Error.cpp:
+        * runtime/Error.h:
+        * runtime/ErrorInstance.cpp:
+        * runtime/ErrorInstance.h:
+        * runtime/Exception.cpp:
+        * runtime/Exception.h:
+        * runtime/GeneratorFrame.cpp:
+        * runtime/GeneratorPrototype.cpp:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/IntlCollator.cpp:
+        * runtime/IntlCollatorConstructor.cpp:
+        * runtime/IntlCollatorPrototype.cpp:
+        * runtime/IntlDateTimeFormat.cpp:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        * runtime/IntlNumberFormat.cpp:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        * runtime/IntlNumberFormatPrototype.cpp:
+        * runtime/IntlObject.cpp:
+        * runtime/IteratorPrototype.cpp:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLengthWritable):
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::fastSlice):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        (JSC::JSArray::tryCreateUninitialized): Deleted.
+        * runtime/JSArray.h:
+        (JSC::createContiguousArrayButterfly):
+        (JSC::createArrayButterfly):
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSCInlines.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContextAssumingStructure):
+        * runtime/JSCallee.cpp:
+        (JSC::JSCallee::JSCallee):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::estimatedSize):
+        * runtime/JSCell.h:
+        (JSC::JSCell::cellStateOffset):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::vm):
+        (JSC::ExecState::vm):
+        (JSC::JSCell::classInfo):
+        (JSC::JSCell::callDestructor): Deleted.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::allocateAndInitializeRareData):
+        (JSC::JSFunction::initializeRareData):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty):
+        (JSC::JSFunction::setFunctionName):
+        (JSC::JSFunction::reifyLength):
+        (JSC::JSFunction::reifyName):
+        (JSC::JSFunction::reifyLazyPropertyIfNeeded):
+        (JSC::JSFunction::reifyBoundNameIfNeeded):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::createWithInvalidatedReallocationWatchpoint):
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        * runtime/JSInternalPromise.cpp:
+        * runtime/JSInternalPromiseConstructor.cpp:
+        * runtime/JSInternalPromiseDeferred.cpp:
+        * runtime/JSInternalPromisePrototype.cpp:
+        * runtime/JSJob.cpp:
+        * runtime/JSMapIterator.cpp:
+        * runtime/JSModuleNamespaceObject.cpp:
+        * runtime/JSModuleRecord.cpp:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::copyBackingStore):
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::createInitialArrayStorage):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::growOutOfLineStorage):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::globalObject): Deleted.
+        * runtime/JSObjectInlines.h:
+        * runtime/JSPromise.cpp:
+        * runtime/JSPromiseConstructor.cpp:
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/JSPromisePrototype.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+        * runtime/JSScope.h:
+        (JSC::JSScope::vm):
+        (JSC::JSScope::globalObject): Deleted.
+        * runtime/JSSetIterator.cpp:
+        * runtime/JSStringIterator.cpp:
+        * runtime/JSTemplateRegistryKey.cpp:
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        * runtime/JSWeakMap.cpp:
+        * runtime/JSWeakSet.cpp:
+        * runtime/MapConstructor.cpp:
+        * runtime/MapIteratorPrototype.cpp:
+        * runtime/MapPrototype.cpp:
+        * runtime/NativeErrorConstructor.cpp:
+        * runtime/NativeStdFunctionCell.cpp:
+        * runtime/Operations.h:
+        (JSC::scribbleFreeCells): Deleted.
+        (JSC::scribble): Deleted.
+        * runtime/Options.h:
+        * runtime/PropertyTable.cpp:
+        * runtime/ProxyConstructor.cpp:
+        * runtime/ProxyObject.cpp:
+        * runtime/ProxyRevoke.cpp:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        (JSC::RegExp::matchConcurrently):
+        (JSC::RegExp::matchCompareWithInterpreter):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpInlines.h:
+        (JSC::RegExp::matchInline):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::tryCreateUninitializedRegExpMatchesArray):
+        (JSC::createRegExpMatchesArray):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::genericSplit):
+        * runtime/RuntimeType.cpp:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        * runtime/SetConstructor.cpp:
+        * runtime/SetIteratorPrototype.cpp:
+        * runtime/SetPrototype.cpp:
+        * runtime/StackFrame.cpp: Removed.
+        * runtime/StackFrame.h: Removed.
+        * runtime/StringConstructor.cpp:
+        * runtime/StringIteratorPrototype.cpp:
+        * runtime/TemplateRegistry.cpp:
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::finalizeStatsAtEndOfTesting): Deleted.
+        * runtime/TestRunnerUtils.h:
+        * runtime/TypeProfilerLog.cpp:
+        * runtime/TypeSet.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::ensureStackCapacityForCLoop): Deleted.
+        (JSC::VM::isSafeToRecurseSoftCLoop): Deleted.
+        * runtime/VM.h:
+        * runtime/VMEntryScope.h:
+        * runtime/VMInlines.h:
+        (JSC::VM::ensureStackCapacityFor):
+        (JSC::VM::isSafeToRecurseSoft):
+        * runtime/WeakMapConstructor.cpp:
+        * runtime/WeakMapData.cpp:
+        * runtime/WeakMapPrototype.cpp:
+        * runtime/WeakSetConstructor.cpp:
+        * runtime/WeakSetPrototype.cpp:
+        * testRegExp.cpp:
+        (testOneRegExp):
+        * tools/JSDollarVM.cpp:
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::isInObjectSpace):
+
+2016-08-23  Filip Pizlo  <fpizlo@apple.com>
+
+        js/regress/put-by-id-transition-with-indexing-header.html and svg/carto.net/window.svg fail in debug after r204854
+        https://bugs.webkit.org/show_bug.cgi?id=161115
+
+        Reviewed by Keith Miller.
+        
+        There were two small goofs.
+
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::isNull): The new policy is that the allocator can be null. So now the way you tell if the profile is null is by checking the structure.
+        * jit/JITOperations.cpp: This was using DeferGC, which is now definitely wrong. It forces the GC to happen when the structure and butterfly are mismatched. It's better for the GC to happen before we put the butterfly in the object.
+
+2016-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        AssemblyHelpers::emitAllocateWithNonNullAllocator() crashes in the FTL on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=161138
+        rdar://problem/27985868
+
+        Reviewed by Saam Barati.
+        
+        The FTL expects that this method can be used with scratch registers disallowed, but it
+        uses addPtr(Addr, Reg).
+
+        The solution is to only use addPtr(Addr, Reg) on x86.
+
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
+
+2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES2016] Allow assignment in for-in head in not-strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=160955
+
+        Reviewed by Saam Barati.
+
+        This patch allow make assignment in for..in head in not-strict mode, 
+        according to the spec https://tc39.github.io/ecma262/#sec-initializers-in-forin-statement-heads
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isAssignResolveNode):
+        (JSC::AssignResolveNode::identifier):
+        (JSC::ExpressionNode::isResolveNode): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseForStatement):
+
+2016-08-23  Saam Barati  <sbarati@apple.com>
+
+        It should be easy to run ES6SampleBench from the jsc shell
+        https://bugs.webkit.org/show_bug.cgi?id=161085
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch adds a new function called `runString` to the shell.
+        It takes in a string, and executes it in a new global object.
+        Then, it returns the global object it executed the code in.
+        This allows the code to stash some kind of a result on the global,
+        and then have the caller of `runString` extract the result.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionRunString):
+
+2016-08-23  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Make ArithLog works with any type
+        https://bugs.webkit.org/show_bug.cgi?id=161110
+
+        Reviewed by Geoffrey Garen.
+
+        Same old: if the type is not a number, assume the worst in every
+        phase and generate a fallback function call.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithLog):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithLog):
+
+2016-08-23  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Rebaseline builtins-generator-tests after r204854.
+
+        Unreviewed test gardening.
+
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
+        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result:
+
+2016-08-23  Keith Miller  <keith_miller@apple.com>
+
+        %TypedArray%.prototype.slice needs to check that the source and destination have not been detached.
+        https://bugs.webkit.org/show_bug.cgi?id=161031
+        <rdar://problem/27937019>
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+
+2016-08-23  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(204854): ASan is unhappy
+        https://bugs.webkit.org/show_bug.cgi?id=161109
+
+        Reviewed by Geoffrey Garen.
+        
+        I messed up RegExpConstructor: it ends up being a callee and a large allocation.
+        
+        This fixes it to not be a large allocation.
+
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        (JSC::RegExp::matchConcurrently):
+        (JSC::RegExp::matchCompareWithInterpreter):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.h:
+        * runtime/RegExpInlines.h:
+        (JSC::RegExp::matchInline):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::genericSplit):
+        * testRegExp.cpp:
+        (testOneRegExp):
+
+2016-08-23  Saam Barati  <sbarati@apple.com>
+
+        strict mode eval should not fire the var injection watch point
+        https://bugs.webkit.org/show_bug.cgi?id=161104
+
+        Reviewed by Geoffrey Garen.
+
+        Strict mode eval can't do any variable injections. It was
+        an oversight that we fired the var injection watchpoint when
+        the eval is in strict mode.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2016-07-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Spilling of constant tmps should make it easier for the spill code optimizer to rematerialize the constant
+        https://bugs.webkit.org/show_bug.cgi?id=160150
+        
+        Reviewed by Benjamin Poulain.
+        
+        When we spill in-place for admitsStack()==true, we prevent rematerialization if that
+        argument doesn't also admit immediates (which it almost certainly won't do).  So, we
+        prevent remat.
+        
+        This fixes the issue by avoiding in-place spilling for warm uses of constants. I don't
+        know if this helps performance, but I do know that it make the codegen for
+        bigswitch-indirect-symbol look a lot better. Prior to this change, the prolog would have
+        a constant materialization for each symbol that function used, and then it would spill
+        that constant. This removes all of that yucky code.
+        
+        This also changes how IRC detects constant Tmps. Previously we would say that a Tmp is a
+        constant if the number of const defs was equal to the number of defs. But it's possible
+        for each of the const defs to produce a different value. This is unlikely considering
+        how B3->Air lowering works and how our SSA works - each def would have its own register.
+        But, regardless, this picks a more precise way of detecting constants: the number of
+        const defs must be 1 and the number of defs must be 1.
+        
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        
+2016-08-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix CLoop build.
+        
+        This fixes the CLoop build while still ensuring that Interpreter.h is a project header.
+
+        * llint/LowLevelInterpreter.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::ensureStackCapacityForCLoop):
+        (JSC::VM::isSafeToRecurseSoftCLoop):
+        * runtime/VM.h:
+        * runtime/VMInlines.h:
+        (JSC::VM::ensureStackCapacityFor):
+        (JSC::VM::isSafeToRecurseSoft):
+
+2016-08-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
+        https://bugs.webkit.org/show_bug.cgi?id=160125
+
+        Reviewed by Geoffrey Garen.
+
+        In order to make the GC concurrent (bug 149432), we would either need to enable concurrent
+        copying or we would need to not copy. Concurrent copying carries a 1-2% throughput overhead
+        from the barriers alone. Considering that MarkedSpace does a decent job of avoiding
+        fragmentation, it's unlikely that it's worth paying 1-2% throughput for copying. So, we want
+        to get rid of copied space. This change moves copied space's biggest client over to marked
+        space.
+        
+        Moving butterflies to marked space means having them use the new Auxiliary HeapCell
+        allocation path. This is a fairly mechanical change, but it caused performance regressions
+        everywhere, so this change also fixes MarkedSpace's performance issues.
+        
+        At a high level the mechanical changes are:
+        
+        - We use AuxiliaryBarrier instead of CopyBarrier.
+        
+        - We use tryAllocateAuxiliary instead of tryAllocateStorage. I got rid of the silly
+          CheckedBoolean stuff, since it's so much more trouble than it's worth.
+        
+        - The JITs have to emit inlined marked space allocations instead of inline copy space
+          allocations.
+        
+        - Everyone has to get used to zeroing their butterflies after allocation instead of relying
+          on them being pre-zeroed by the GC. Copied space would zero things for you, while marked
+          space doesn't.
+        
+        That's about 1/3 of this change. But this led to performance problems, which I fixed with
+        optimizations that amounted to a major MarkedSpace rewrite:
+        
+        - MarkedSpace always causes internal fragmentation for array allocations because the vector
+          length we choose when we resize usually leads to a cell size that doesn't correspond to any
+          size class. I got around this by making array allocations usually round up vectorLength to
+          the maximum allowed by the size class that we would have allocated in. Also,
+          ensureLengthSlow() and friends first make sure that the requested length can't just be
+          fulfilled with the current allocation size. This safeguard means that not every array
+          allocation has to do size class queries. For example, the fast path of new Array(length)
+          never does any size class queries, under the assumption that (1) the speed gained from
+          avoiding an ensureLengthSlow() call, which then just changes the vectorLength by doing the
+          size class query, is too small to offset the speed lost by doing the query on every
+          allocation and (2) new Array(length) is a pretty good hint that resizing is not very
+          likely.
+        
+        - Size classes in MarkedSpace were way too precise, which led to external fragmentation. This
+          changes MarkedSpace size classes to use a linear progression for very small sizes followed
+          by a geometric progression that naturally transitions to a hyperbolic progression. We want
+          hyperbolic sizes when we get close to blockSize: for example the largest size we want is
+          payloadSize / 2 rounded down, to ensure we get exactly two cells with minimal slop. The
+          next size down should be payloadSize / 3 rounded down, and so on. After the last precise
+          size (80 bytes), we proceed using a geometric progression, but round up each size to
+          minimize slop at the end of the block. This naturally causes the geometric progression to
+          turn hyperbolic for large sizes. The size class configuration happens at VM start-up, so
+          can be controlled with runtime options. I found that a base of 1.4 works pretty well.
+        
+        - Large allocations caused massive internal fragmentation, since the smallest large
+          allocation had to use exactly blockSize, and the largest small allocation used
+          blockSize / 2. The next size up - the first large allocation size to require two blocks -
+          also had 50% internal fragmentation. This is because we required large allocations to be
+          blockSize aligned, so that MarkedBlock::blockFor() would work. I decided to rewrite all of
+          that. Cells no longer have to be owned by a MarkedBlock. They can now alternatively be
+          owned by a LargeAllocation. These two things are abstracted as CellContainer. You know that
+          a cell is owned by a LargeAllocation if the MarkedBlock::atomSize / 2 bit is set.
+          Basically, large allocations are deliberately misaligned by 8 bytes. This actually works
+          out great since (1) typed arrays won't use large allocations anyway since they have their
+          own malloc fallback and (2) large array butterflies already have a 8 byte header, which
+          means that the 8 byte base misalignment aligns the large array payload on a 16 byte
+          boundary. I took extreme care to make sure that the isLargeAllocation bit checks are as
+          rare as possible; for example, ExecState::vm() skips the check because we know that callees
+          must be small allocations. It's also possible to use template tricks to do one check for
+          cell container kind, and then invoke a function specialized for MarkedBlock or a function
+          specialized for LargeAllocation. LargeAllocation includes stubs for all MarkedBlock methods
+          that get used from functions that are template-specialized like this. That's mostly to
+          speed up the GC marking code. Most other code can use CellContainer API or HeapCell API
+          directly. That's another thing: HeapCell, the common base of JSCell and auxiliary
+          allocations, is now smart enough to do a lot of things for you, like HeapCell::vm(),
+          HeapCell::heap(), HeapCell::isLargeAllocation(), and HeapCell::cellContainer(). The size
+          cutoff for large allocations is runtime-configurable, so long as you don't choose something
+          so small that callees end up large. I found that 400 bytes is roughly optimal. This means
+          that the MarkedBlock size classes end up being:
+          
+          16, 32, 48, 64, 80, 112, 160, 224, 320
+          
+          The next size class would have been 432, but that's above the 400 byte cutoff. All of this
+          is configurable with --sizeClassProgression and --largeAllocationCutoff. You can see what
+          size classes you end up with by doing --dumpSizeClasses=true.
+        
+        - Copied space uses 64KB blocks, while marked space used to use 16KB blocks. Allocating a lot
+          of stuff in 16KB blocks is slower than allocating it in 64KB blocks. I got more speed from
+          changing MarkedBlock::blockSize to 64KB. This would have been a space fail before, but now
+          that we have LargeAllocation, it ends up being an overall win.
+        
+        - Even after all of that, copying butterflies was still faster because it allowed us to skip
+          sweeping dead space. A good GC allocates over dead bytes without explicitly freeing them,
+          so the GC pause is O(size of live), not O(size of live + dead). O(dead) is usually much
+          larger than O(live), especially in an eden collection. Copying satisfies this premise while
+          mark+sweep does not. So, I invented a new kind of allocator: bump'n'pop. Previously, our
+          MarkedSpace allocator was a freelist pop. That's simple and easy to inline but requires
+          that we walk the block to build a free list. This means walking dead space. The new
+          allocator allows totally free MarkedBlocks to simply set up a bump-pointer arena instead.
+          The allocator is a hybrid of bump-pointer and freelist pop. It tries bump first. The bump
+          pointer always bumps by cellSize, so the result of filling a block with bumping looks as if
+          we had used freelist popping to fill it. Additionally, each MarkedBlock now has a bit to
+          quickly tell if the block is entirely free. This makes sweeping O(1) whenever a MarkedBlock
+          is completely empty, which is the common case because of the generational hypothesis: the
+          number of objects that survive an eden collection is a tiny fraction of the number of
+          objects that had been allocated, and this fraction is so small that there are typically
+          fewer than one survivors per MarkedBlock. This change was enough to make this change a net
+          win over tip-of-tree.
+        
+        - FTL now shares the same allocation fast paths as everything else, which is great, because
+          bump'n'pop has gnarly control flow. We don't really want B3 to have to think about that
+          control flow, since it won't be able to improve the machine code we write ourselves. GC
+          fast paths are best written in assembly. So, I've empowered B3 to have even better support
+          for Patchpoint terminals. It's now totally fine for a Patchpoint terminal to be non-Void.
+          So, the new FTL allocation fast paths are just Patchpoint terminals that call through to
+          AssemblyHelpers::emitAllocate(). B3 still reasons about things like constant-folding the
+          size class calculation and constant-hoisting the allocator. Also, I gave the FTL the
+          ability to constant-fold some allocator logic (in case we first assume that we're doing a
+          variable-length allocation but then realize that the length is known). I think it makes
+          sense to have constant folding rules in FTL::Output, or whatever the B3 IR builder is,
+          since this makes lowering easier (you can constant fold during lowering more easily) and it
+          reduces the amount of malloc traffic. In the future, we could teach B3 how to better
+          constant-fold this code. That would require allowing loads to be constant-folded, which is
+          doable but hella tricky.
+        
+        All of this put together gives us neutral perf on JetStream, Speedometer, and PLT3. SunSpider
+        sometimes gets penalized depending on how you run it. By comparison, the alternative approach
+        of using a copy barrier would have cost us 1-2%. That's the real apples-to-apples comparison
+        if your premise is that we should have a concurrent GC. After we finish removing copied
+        space, we will be barrier-ready for concurrent GC: we already have a marking barrier and we
+        simply won't need a copying barrier. This change gets us there for the purposes of our
+        benchmarks, since the remaining clients of copied space are not very important. On the other
+        hand, if we keep copying, then getting barrier-ready would mean adding back the copy barrier,
+        which costs more perf.
+        
+        We might get bigger speed-ups once we remove CopiedSpace altogether. That requires moving
+        typed arrays and a few other weird things over to Aux MarkedSpace.
+        
+        This also includes some header sanitization. The introduction of AuxiliaryBarrier, HeapCell,
+        and CellContainer meant that I had to include those files from everywhere. Fortunately,
+        just including JSCInlines.h (instead of manually including the files that includes) is
+        usually enough. So, I made most of JSC's cpp files include JSCInlines.h, which is something
+        that we were already basically doing. In places where JSCInlines.h would be too much, I just
+        included HeapInlines.h. This got weird, because we previously included HeapInlines.h from
+        JSObject.h. That's bad because it led to some circular dependencies, so I fixed it - but that
+        meant having to manually include HeapInlines.h from the places that previously got it
+        implicitly via JSObject.h. But that led to more problems for some reason: I started getting
+        build errors because non-JSC files were having trouble including Opcode.h. That's just silly,
+        since Opcode.h is meant to be an internal JSC header. So, I made it an internal header and
+        made it impossible to include it from outside JSC. This was a lot of work, but it was
+        necessary to get the patch to build on all ports. It's also a net win. There were many places
+        in WebCore that were transitively including a *ton* of JSC headers just because of the
+        JSObject.h->HeapInlines.h edge and a bunch of dependency edges that arose from some public
+        (for WebCore) JSC headers needing Interpreter.h or Opcode.h for bad reasons.
+
+        * API/JSTypedArray.cpp:
+        * API/ObjCCallbackFunction.mm:
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Scripts/builtins/builtins_generate_combined_implementation.py:
+        (BuiltinsCombinedImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
+        (BuiltinsInternalsWrapperImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generate_separate_implementation.py:
+        (BuiltinsSeparateImplementationGenerator.generate_secondary_header_includes):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::JumpList::JumpList):
+        (JSC::AbstractMacroAssembler::JumpList::link):
+        (JSC::AbstractMacroAssembler::JumpList::linkTo):
+        (JSC::AbstractMacroAssembler::JumpList::append):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::add32):
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::appendIntConstant):
+        (JSC::B3::BasicBlock::appendBoolConstant):
+        (JSC::B3::BasicBlock::clearSuccessors):
+        * b3/B3BasicBlock.h:
+        * b3/B3DuplicateTails.cpp:
+        * b3/B3StackmapGenerationParams.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testBranchBitAndImmFusion):
+        (JSC::B3::testPatchpointTerminalReturnValue):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+        * bindings/ScriptValue.cpp:
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp:
+        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:
+        * bytecode/ObjectAllocationProfile.h:
+        (JSC::ObjectAllocationProfile::initialize):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * bytecode/StructureStubInfo.cpp:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
+        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLJITFinalizer.cpp:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
+        (JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateHeapCell):
+        (JSC::FTL::DFG::LowerDFGToB3::storeStructure):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatorForSize):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::constInt32):
+        (JSC::FTL::Output::add):
+        (JSC::FTL::Output::shl):
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        (JSC::FTL::Output::above):
+        (JSC::FTL::Output::aboveOrEqual):
+        (JSC::FTL::Output::below):
+        (JSC::FTL::Output::belowOrEqual):
+        (JSC::FTL::Output::greaterThan):
+        (JSC::FTL::Output::greaterThanOrEqual):
+        (JSC::FTL::Output::lessThan):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::select):
+        (JSC::FTL::Output::unreachable):
+        (JSC::FTL::Output::appendSuccessor):
+        (JSC::FTL::Output::speculate):
+        (JSC::FTL::Output::addIncomingToPhi):
+        * ftl/FTLOutput.h:
+        * ftl/FTLValueFromBlock.h:
+        (JSC::FTL::ValueFromBlock::ValueFromBlock):
+        (JSC::FTL::ValueFromBlock::operator bool):
+        (JSC::FTL::ValueFromBlock::value):
+        (JSC::FTL::ValueFromBlock::block):
+        * ftl/FTLWeightedTarget.h:
+        (JSC::FTL::WeightedTarget::target):
+        (JSC::FTL::WeightedTarget::weight):
+        (JSC::FTL::WeightedTarget::frequentedBlock):
+        * heap/CellContainer.h: Added.
+        (JSC::CellContainer::CellContainer):
+        (JSC::CellContainer::operator bool):
+        (JSC::CellContainer::isMarkedBlock):
+        (JSC::CellContainer::isLargeAllocation):
+        (JSC::CellContainer::markedBlock):
+        (JSC::CellContainer::largeAllocation):
+        * heap/CellContainerInlines.h: Added.
+        (JSC::CellContainer::isMarkedOrRetired):
+        (JSC::CellContainer::isMarked):
+        (JSC::CellContainer::isMarkedOrNewlyAllocated):
+        (JSC::CellContainer::setHasAnyMarked):
+        (JSC::CellContainer::cellSize):
+        (JSC::CellContainer::weakSet):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::~ConservativeRoots):
+        (JSC::ConservativeRoots::grow):
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::genericAddSpan):
+        * heap/ConservativeRoots.h:
+        (JSC::ConservativeRoots::size):
+        (JSC::ConservativeRoots::roots):
+        * heap/CopyToken.h:
+        * heap/FreeList.cpp: Added.
+        (JSC::FreeList::dump):
+        * heap/FreeList.h: Added.
+        (JSC::FreeList::FreeList):
+        (JSC::FreeList::list):
+        (JSC::FreeList::bump):
+        (JSC::FreeList::operator==):
+        (JSC::FreeList::operator!=):
+        (JSC::FreeList::operator bool):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::finalizeUnconditionalFinalizers):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::copyBackingStores):
+        (JSC::Heap::gatherStackRoots):
+        (JSC::Heap::gatherJSStackRoots):
+        (JSC::Heap::gatherScratchBufferRoots):
+        (JSC::Heap::clearLivenessData):
+        (JSC::Heap::visitSmallStrings):
+        (JSC::Heap::visitConservativeRoots):
+        (JSC::Heap::removeDeadCompilerWorklistEntries):
+        (JSC::Heap::gatherExtraHeapSnapshotData):
+        (JSC::Heap::removeDeadHeapSnapshotNodes):
+        (JSC::Heap::visitProtectedObjects):
+        (JSC::Heap::visitArgumentBuffers):
+        (JSC::Heap::visitException):
+        (JSC::Heap::visitStrongHandles):
+        (JSC::Heap::visitHandleStack):
+        (JSC::Heap::visitSamplingProfiler):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        (JSC::Heap::converge):
+        (JSC::Heap::visitWeakHandles):
+        (JSC::Heap::updateObjectCounts):
+        (JSC::Heap::clearUnmarkedExecutables):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collect):
+        (JSC::Heap::collectWithoutAnySweep):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::suspendCompilerThreads):
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::flushOldStructureIDTables):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        (JSC::Heap::stopAllocation):
+        (JSC::Heap::reapWeakHandles):
+        (JSC::Heap::pruneStaleEntriesFromWeakGCMaps):
+        (JSC::Heap::sweepArrayBuffers):
+        (JSC::Heap::snapshotMarkedSpace):
+        (JSC::Heap::deleteSourceProviderCaches):
+        (JSC::Heap::notifyIncrementalSweeper):
+        (JSC::Heap::writeBarrierCurrentlyExecutingCodeBlocks):
+        (JSC::Heap::resetAllocators):
+        (JSC::Heap::updateAllocationLimits):
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::resumeCompilerThreads):
+        (JSC::Zombify::visit):
+        * heap/Heap.h:
+        (JSC::Heap::subspaceForObjectDestructor):
+        (JSC::Heap::subspaceForAuxiliaryData):
+        (JSC::Heap::allocatorForObjectWithoutDestructor):
+        (JSC::Heap::allocatorForObjectWithDestructor):
+        (JSC::Heap::allocatorForAuxiliaryData):
+        (JSC::Heap::storageAllocator):
+        * heap/HeapCell.h:
+        (JSC::HeapCell::zap):
+        (JSC::HeapCell::isZapped):
+        * heap/HeapCellInlines.h: Added.
+        (JSC::HeapCell::isLargeAllocation):
+        (JSC::HeapCell::cellContainer):
+        (JSC::HeapCell::markedBlock):
+        (JSC::HeapCell::largeAllocation):
+        (JSC::HeapCell::heap):
+        (JSC::HeapCell::vm):
+        (JSC::HeapCell::cellSize):
+        (JSC::HeapCell::allocatorAttributes):
+        (JSC::HeapCell::destructionMode):
+        (JSC::HeapCell::cellKind):
+        * heap/HeapInlines.h:
+        (JSC::Heap::isCollecting):
+        (JSC::Heap::heap):
+        (JSC::Heap::isLive):
+        (JSC::Heap::isMarked):
+        (JSC::Heap::testAndSetMarked):
+        (JSC::Heap::setMarked):
+        (JSC::Heap::cellSize):
+        (JSC::Heap::writeBarrier):
+        (JSC::Heap::allocateWithoutDestructor):
+        (JSC::Heap::allocateObjectOfType):
+        (JSC::Heap::subspaceForObjectOfType):
+        (JSC::Heap::allocatorForObjectOfType):
+        (JSC::Heap::allocateAuxiliary):
+        (JSC::Heap::tryAllocateAuxiliary):
+        (JSC::Heap::tryReallocateAuxiliary):
+        (JSC::Heap::tryAllocateStorage):
+        (JSC::Heap::didFreeBlock):
+        (JSC::Heap::isPointerGCObject): Deleted.
+        (JSC::Heap::isValueGCObject): Deleted.
+        * heap/HeapUtil.h: Added.
+        (JSC::HeapUtil::findGCObjectPointersForMarking):
+        (JSC::HeapUtil::isPointerGCObjectJSCell):
+        (JSC::HeapUtil::isValueGCObject):
+        * heap/LargeAllocation.cpp: Added.
+        (JSC::LargeAllocation::tryCreate):
+        (JSC::LargeAllocation::LargeAllocation):
+        (JSC::LargeAllocation::lastChanceToFinalize):
+        (JSC::LargeAllocation::shrink):
+        (JSC::LargeAllocation::visitWeakSet):
+        (JSC::LargeAllocation::reapWeakSet):
+        (JSC::LargeAllocation::clearMarks):
+        (JSC::LargeAllocation::clearMarksWithCollectionType):
+        (JSC::LargeAllocation::isEmpty):
+        (JSC::LargeAllocation::sweep):
+        (JSC::LargeAllocation::destroy):
+        (JSC::LargeAllocation::dump):
+        * heap/LargeAllocation.h: Added.
+        (JSC::LargeAllocation::fromCell):
+        (JSC::LargeAllocation::cell):
+        (JSC::LargeAllocation::isLargeAllocation):
+        (JSC::LargeAllocation::heap):
+        (JSC::LargeAllocation::vm):
+        (JSC::LargeAllocation::weakSet):
+        (JSC::LargeAllocation::clearNewlyAllocated):
+        (JSC::LargeAllocation::isNewlyAllocated):
+        (JSC::LargeAllocation::isMarked):
+        (JSC::LargeAllocation::isMarkedOrNewlyAllocated):
+        (JSC::LargeAllocation::isLive):
+        (JSC::LargeAllocation::hasValidCell):
+        (JSC::LargeAllocation::cellSize):
+        (JSC::LargeAllocation::aboveLowerBound):
+        (JSC::LargeAllocation::belowUpperBound):
+        (JSC::LargeAllocation::contains):
+        (JSC::LargeAllocation::attributes):
+        (JSC::LargeAllocation::testAndSetMarked):
+        (JSC::LargeAllocation::setMarked):
+        (JSC::LargeAllocation::clearMarked):
+        (JSC::LargeAllocation::setHasAnyMarked):
+        (JSC::LargeAllocation::headerSize):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::isListPagedOut):
+        (JSC::MarkedAllocator::isPagedOut):
+        (JSC::MarkedAllocator::retire):
+        (JSC::MarkedAllocator::tryAllocateWithoutCollectingImpl):
+        (JSC::MarkedAllocator::tryAllocateWithoutCollecting):
+        (JSC::MarkedAllocator::allocateSlowCase):
+        (JSC::MarkedAllocator::tryAllocateSlowCase):
+        (JSC::MarkedAllocator::allocateSlowCaseImpl):
+        (JSC::blockHeaderSize):
+        (JSC::MarkedAllocator::blockSizeForBytes):
+        (JSC::MarkedAllocator::tryAllocateBlock):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::removeBlock):
+        (JSC::MarkedAllocator::reset):
+        (JSC::MarkedAllocator::lastChanceToFinalize):
+        (JSC::MarkedAllocator::setFreeList):
+        (JSC::MarkedAllocator::tryAllocateHelper): Deleted.
+        (JSC::MarkedAllocator::tryPopFreeList): Deleted.
+        (JSC::MarkedAllocator::tryAllocate): Deleted.
+        (JSC::MarkedAllocator::allocateBlock): Deleted.
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::destruction):
+        (JSC::MarkedAllocator::cellKind):
+        (JSC::MarkedAllocator::heap):
+        (JSC::MarkedAllocator::takeLastActiveBlock):
+        (JSC::MarkedAllocator::offsetOfFreeList):
+        (JSC::MarkedAllocator::offsetOfCellSize):
+        (JSC::MarkedAllocator::tryAllocate):
+        (JSC::MarkedAllocator::allocate):
+        (JSC::MarkedAllocator::stopAllocating):
+        (JSC::MarkedAllocator::resumeAllocating):
+        (JSC::MarkedAllocator::offsetOfFreeListHead): Deleted.
+        (JSC::MarkedAllocator::MarkedAllocator): Deleted.
+        (JSC::MarkedAllocator::init): Deleted.
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::tryCreate):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::sweepHelperSelectResetMode):
+        (JSC::MarkedBlock::sweepHelperSelectStateAndSweepMode):
+        (JSC::MarkedBlock::stopAllocating):
+        (JSC::MarkedBlock::clearMarksWithCollectionType):
+        (JSC::MarkedBlock::lastChanceToFinalize):
+        (JSC::MarkedBlock::resumeAllocating):
+        (JSC::MarkedBlock::didRetireBlock):
+        (JSC::MarkedBlock::forEachFreeCell):
+        (JSC::MarkedBlock::create): Deleted.
+        (JSC::MarkedBlock::callDestructor): Deleted.
+        (JSC::MarkedBlock::sweepHelper): Deleted.
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::VoidFunctor::returnValue):
+        (JSC::MarkedBlock::setHasAnyMarked):
+        (JSC::MarkedBlock::hasAnyMarked):
+        (JSC::MarkedBlock::clearHasAnyMarked):
+        (JSC::MarkedBlock::firstAtom):
+        (JSC::MarkedBlock::isAtomAligned):
+        (JSC::MarkedBlock::cellAlign):
+        (JSC::MarkedBlock::blockFor):
+        (JSC::MarkedBlock::isEmpty):
+        (JSC::MarkedBlock::cellSize):
+        (JSC::MarkedBlock::isMarkedOrRetired):
+        (JSC::MarkedBlock::FreeList::FreeList): Deleted.
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::initializeSizeClassForStepSize):
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+        (JSC::MarkedSpace::allocateLarge):
+        (JSC::MarkedSpace::tryAllocateLarge):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::sweepABit):
+        (JSC::MarkedSpace::sweepLargeAllocations):
+        (JSC::MarkedSpace::zombifySweep):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        (JSC::MarkedSpace::stopAllocating):
+        (JSC::MarkedSpace::resumeAllocating):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::MarkedSpace::didFinishIterating):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        (JSC::MarkedSpace::forEachAllocator): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::sizeClassIndex):
+        (JSC::MarkedSpace::subspaceForObjectsWithDestructor):
+        (JSC::MarkedSpace::subspaceForObjectsWithoutDestructor):
+        (JSC::MarkedSpace::subspaceForAuxiliaryData):
+        (JSC::MarkedSpace::blocksWithNewObjects):
+        (JSC::MarkedSpace::largeAllocations):
+        (JSC::MarkedSpace::largeAllocationsNurseryOffset):
+        (JSC::MarkedSpace::largeAllocationsOffsetForThisCollection):
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionBegin):
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionEnd):
+        (JSC::MarkedSpace::largeAllocationsForThisCollectionSize):
+        (JSC::MarkedSpace::forEachLiveCell):
+        (JSC::MarkedSpace::forEachDeadCell):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::destructorAllocatorFor):
+        (JSC::MarkedSpace::auxiliaryAllocatorFor):
+        (JSC::MarkedSpace::allocate):
+        (JSC::MarkedSpace::tryAllocate):
+        (JSC::MarkedSpace::allocateWithoutDestructor):
+        (JSC::MarkedSpace::allocateWithDestructor):
+        (JSC::MarkedSpace::allocateAuxiliary):
+        (JSC::MarkedSpace::tryAllocateAuxiliary):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::didAllocateInBlock):
+        (JSC::MarkedSpace::forEachAllocator):
+        (JSC::MarkedSpace::forEachSubspace):
+        (JSC::MarkedSpace::optimalSizeFor):
+        (JSC::MarkedSpace::objectCount): Deleted.
+        (JSC::MarkedSpace::size): Deleted.
+        (JSC::MarkedSpace::capacity): Deleted.
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset):
+        (JSC::SlotVisitor::clearMarkStack):
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::appendJSCellOrAuxiliary):
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::markAuxiliary):
+        (JSC::SlotVisitor::noteLiveAuxiliaryCell):
+        (JSC::SetCurrentCellScope::SetCurrentCellScope):
+        (JSC::SlotVisitor::visitChildren):
+        * heap/SlotVisitor.h:
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::create):
+        (JSC::WeakBlock::destroy):
+        (JSC::WeakBlock::WeakBlock):
+        (JSC::WeakBlock::visit):
+        (JSC::WeakBlock::reap):
+        * heap/WeakBlock.h:
+        (JSC::WeakBlock::disconnectContainer):
+        (JSC::WeakBlock::disconnectMarkedBlock): Deleted.
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::sweep):
+        (JSC::WeakSet::addAllocator):
+        * heap/WeakSet.h:
+        (JSC::WeakSet::WeakSet):
+        * heap/WeakSetInlines.h:
+        (JSC::WeakSet::allocate):
+        * inspector/InjectedScriptManager.cpp:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        * inspector/ScriptDebugServer.cpp:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocate):
+        (JSC::AssemblyHelpers::emitAllocateJSCell):
+        (JSC::AssemblyHelpers::emitAllocateJSObject):
+        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
+        (JSC::AssemblyHelpers::emitAllocateVariableSized):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitWriteBarrier):
+        * jsc.cpp:
+        (functionDescribeArray):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ModuleAnalyzer.cpp:
+        * runtime/ArrayConventions.h:
+        (JSC::indexIsSufficientlyBeyondLengthForSparseMap):
+        (JSC::indexingHeaderForArrayStorage):
+        (JSC::baseIndexingHeaderForArrayStorage):
+        (JSC::indexingHeaderForArray): Deleted.
+        (JSC::baseIndexingHeaderForArray): Deleted.
+        * runtime/ArrayStorage.h:
+        (JSC::ArrayStorage::length):
+        (JSC::ArrayStorage::setLength):
+        (JSC::ArrayStorage::vectorLength):
+        (JSC::ArrayStorage::setVectorLength):
+        (JSC::ArrayStorage::copyHeaderFromDuringGC):
+        (JSC::ArrayStorage::sizeFor):
+        (JSC::ArrayStorage::totalSizeFor):
+        (JSC::ArrayStorage::totalSize):
+        (JSC::ArrayStorage::availableVectorLength):
+        (JSC::ArrayStorage::optimalVectorLength):
+        * runtime/AuxiliaryBarrier.h: Added.
+        (JSC::AuxiliaryBarrier::AuxiliaryBarrier):
+        (JSC::AuxiliaryBarrier::clear):
+        (JSC::AuxiliaryBarrier::get):
+        (JSC::AuxiliaryBarrier::slot):
+        (JSC::AuxiliaryBarrier::operator bool):
+        (JSC::AuxiliaryBarrier::setWithoutBarrier):
+        * runtime/AuxiliaryBarrierInlines.h: Added.
+        (JSC::AuxiliaryBarrier<T>::AuxiliaryBarrier):
+        (JSC::AuxiliaryBarrier<T>::set):
+        * runtime/Butterfly.h:
+        (JSC::Butterfly::fromBase):
+        (JSC::Butterfly::fromPointer):
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::availableContiguousVectorLength):
+        (JSC::Butterfly::optimalContiguousVectorLength):
+        (JSC::Butterfly::createUninitialized):
+        (JSC::Butterfly::growArrayRight):
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createEmpty):
+        * runtime/DataView.cpp:
+        * runtime/DirectArguments.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp:
+        * runtime/GeneratorFrame.cpp:
+        * runtime/GeneratorPrototype.cpp:
+        * runtime/IntlCollator.cpp:
+        * runtime/IntlCollatorConstructor.cpp:
+        * runtime/IntlCollatorPrototype.cpp:
+        * runtime/IntlDateTimeFormat.cpp:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        * runtime/IntlNumberFormat.cpp:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        * runtime/IntlNumberFormatPrototype.cpp:
+        * runtime/JSArray.cpp:
+        (JSC::createArrayButterflyInDictionaryIndexingMode):
+        (JSC::JSArray::tryCreateUninitialized):
+        (JSC::JSArray::setLengthWritable):
+        (JSC::JSArray::unshiftCountSlowCase):
+        (JSC::JSArray::setLengthWithArrayStorage):
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::fastSlice):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArray.h:
+        (JSC::createContiguousArrayButterfly):
+        (JSC::createArrayButterfly):
+        (JSC::JSArray::create):
+        (JSC::JSArray::tryCreateUninitialized): Deleted.
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSCInlines.h:
+        * runtime/JSCJSValue.cpp:
+        * runtime/JSCallee.cpp:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::estimatedSize):
+        (JSC::JSCell::copyBackingStore):
+        * runtime/JSCell.h:
+        (JSC::JSCell::cellStateOffset):
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::visitChildren):
+        (JSC::ExecState::vm):
+        (JSC::JSCell::canUseFastGetOwnProperty):
+        (JSC::JSCell::classInfo):
+        (JSC::JSCell::toBoolean):
+        (JSC::JSCell::pureToBoolean):
+        (JSC::JSCell::callDestructor):
+        (JSC::JSCell::vm): Deleted.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::allocateAndInitializeRareData):
+        (JSC::JSFunction::initializeRareData):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty):
+        (JSC::JSFunction::setFunctionName):
+        (JSC::JSFunction::reifyLength):
+        (JSC::JSFunction::reifyName):
+        (JSC::JSFunction::reifyLazyPropertyIfNeeded):
+        (JSC::JSFunction::reifyBoundNameIfNeeded):
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::createWithInvalidatedReallocationWatchpoint):
+        (JSC::JSFunction::JSFunction):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        * runtime/JSInternalPromise.cpp:
+        * runtime/JSInternalPromiseConstructor.cpp:
+        * runtime/JSInternalPromiseDeferred.cpp:
+        * runtime/JSInternalPromisePrototype.cpp:
+        * runtime/JSJob.cpp:
+        * runtime/JSMapIterator.cpp:
+        * runtime/JSModuleNamespaceObject.cpp:
+        * runtime/JSModuleRecord.cpp:
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::heapSnapshot):
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::createInitialArrayStorage):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectNativeFunctionWithoutTransition):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::increaseVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::JSObject::copyButterfly): Deleted.
+        (JSC::JSObject::copyBackingStore): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::globalObject):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putOwnDataProperty):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): Deleted.
+        * runtime/JSObjectInlines.h:
+        * runtime/JSPromise.cpp:
+        * runtime/JSPromiseConstructor.cpp:
+        * runtime/JSPromiseDeferred.cpp:
+        * runtime/JSPromisePrototype.cpp:
+        * runtime/JSPropertyNameIterator.cpp:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+        * runtime/JSScope.h:
+        (JSC::JSScope::globalObject):
+        (JSC::Register::operator=):
+        (JSC::JSScope::vm): Deleted.
+        * runtime/JSSetIterator.cpp:
+        * runtime/JSStringIterator.cpp:
+        * runtime/JSTemplateRegistryKey.cpp:
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        * runtime/JSWeakMap.cpp:
+        * runtime/JSWeakSet.cpp:
+        * runtime/MapConstructor.cpp:
+        * runtime/MapPrototype.cpp:
+        * runtime/NativeStdFunctionCell.cpp:
+        * runtime/Operations.h:
+        (JSC::jsAdd):
+        (JSC::resetFreeCellsBadly):
+        (JSC::resetBadly):
+        * runtime/Options.h:
+        * runtime/PropertyTable.cpp:
+        * runtime/ProxyConstructor.cpp:
+        * runtime/ProxyObject.cpp:
+        * runtime/ProxyRevoke.cpp:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::tryCreateUninitializedRegExpMatchesArray):
+        (JSC::createRegExpMatchesArray):
+        * runtime/RuntimeType.cpp:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        * runtime/SetConstructor.cpp:
+        * runtime/SetPrototype.cpp:
+        * runtime/TemplateRegistry.cpp:
+        * runtime/TypeProfilerLog.cpp:
+        * runtime/TypeSet.cpp:
+        * runtime/WeakMapConstructor.cpp:
+        * runtime/WeakMapData.cpp:
+        * runtime/WeakMapPrototype.cpp:
+        * runtime/WeakSetConstructor.cpp:
+        * runtime/WeakSetPrototype.cpp:
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::isInObjectSpace):
+        (JSC::JSDollarVMPrototype::isInStorageSpace):
+
+2016-08-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make Math.cos() and Math.sin() work with any argument type
+        https://bugs.webkit.org/show_bug.cgi?id=161069
+
+        Reviewed by Geoffrey Garen.
+
+        Same as the ArithSqrt patch: add a generic path if the argument
+        is not a number.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithCos):
+        (JSC::DFG::SpeculativeJIT::compileArithSin):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithSin):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithCos):
+
+2016-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Module namespace object's Symbol.iterator method should only accept module namespace objects
+        https://bugs.webkit.org/show_bug.cgi?id=161097
+
+        Reviewed by Keith Miller.
+
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::moduleNamespaceObjectSymbolIterator):
+
+2016-08-22  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Modules' `export default function/class` should be declaration
+        https://bugs.webkit.org/show_bug.cgi?id=160499
+
+        Reviewed by Saam Barati.
+
+        Previously, we parsed the following cases as FunctionExpression and ClassExpression.
+
+            ```
+            export default function () { }
+            export default class { }
+            ```
+
+        But, as per ES6 spec, the above `function ...` and `class ...` parts should be parsed
+        as function declaration and class declaration. This has big difference; the instantiation
+        of the function declarations are done in the function prologue.
+
+        In this patch, we correctly parse the above cases as declaration. To handle no-named
+        declarations, we add a new flag, DeclarationDefaultContext. This indicates [Default]
+        flag in the ES6 spec's BNF.
+
+        Furthermore, this patch also fixes the following name related bugs.
+
+        1. The bug related to "export default"'s function name. If the name is not provided (like the above case), the name of the function becomes
+        "default", not "*default*". This is special handling in ES6 spec. We handle this in JSFunction's reifyName.
+
+        2. `class Hello { hello hello() { } }` is accepted. We introduced FunctionRequirements::Unnamed and fix this bug.
+
+        * parser/ModuleScopeData.h:
+        (JSC::ModuleScopeData::exportBinding):
+        Exported names are already guranteed uniqueness by m_exportedNames. Not necessary to use set here. Use vector instead.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        If we pass FunctionRequirements::NoRequirements, we need to initialize functionInfo.name / classInfo.className
+        with the default fallback name. For example, in the above `export default` case, we initialize it with `*default*`.
+
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClassDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parseClassExpression):
+        (JSC::Parser<LexerType>::parseFunctionExpression):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseArrowFunctionExpression):
+        * parser/Parser.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::reifyName):
+
+2016-08-23  Saam Barati  <sbarati@apple.com>
+
+        JIT::updateTopCallframe() in the baseline JIT should use PC instead of PC+1
+        https://bugs.webkit.org/show_bug.cgi?id=158955
+
+        Reviewed by Mark Lam.
+
+        This will make the baseline JIT consistent with the rest of the tiers.
+
+        * jit/JITInlines.h:
+        (JSC::JIT::updateTopCallFrame):
+
+2016-08-22  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Warning fix.
+        https://bugs.webkit.org/show_bug.cgi?id=161043
+
+        Reviewed by Mark Lam.
+
+        Ignore warning about bit shift by too large amount.
+
+        * jit/PCToCodeOriginMap.cpp:
+
+2016-08-22  Keith Miller  <keith_miller@apple.com>
+
+        Actually enable the WASM build.
+        https://bugs.webkit.org/show_bug.cgi?id=160933
+
+        Reviewed by Geoffrey Garen.
+
+        Fix bug where we assumed that every frame would have a CodeBlock.
+
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::CreateScriptCallStackFunctor::operator()):
+
+2016-08-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Rename CustomElementsRegistry to CustomElementRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=161028
+
+        Reviewed by Darin Adler.
+
+        Added customElements and CustomElementRegistry to the common identifiers list as they're used on JSDOMWindow
+        to hide window.customElements and CustomElementRegistry interface behind a runtime flag.
+
+        * runtime/CommonIdentifiers.h:
+
+2016-08-22  Mark Lam  <mark.lam@apple.com>
+
+        Remove dead code.
+        https://bugs.webkit.org/show_bug.cgi?id=161049
+
+        Reviewed by Michael Saboff.
+
+        * runtime/VM.h:
+        - Deleted unused friend class ClearExceptionScope.
+
+2016-08-22  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Module should not allow HTML comments
+        https://bugs.webkit.org/show_bug.cgi?id=161041
+
+        Reviewed by Saam Barati.
+
+        ES6 Modules intentionally disable HTML comments[1].
+
+        [1]: https://tc39.github.io/ecma262/#sec-html-like-comments
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutable):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::CacheKey::CacheKey):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::commentMode):
+        (JSC::ExecutableInfo::superBinding): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::commentMode):
+        (JSC::UnlinkedCodeBlock::superBinding): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::commentMode):
+        (JSC::BytecodeGenerator::makeFunction):
+        (JSC::BytecodeGenerator::superBinding): Deleted.
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::Lexer):
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeFlags::SourceCodeFlags):
+        (JSC::SourceCodeKey::SourceCodeKey):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::checkModuleSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/Executable.h:
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG] Should not fixup AnyIntUse in 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        Reviewed by Saam Barati.
+
+        DFG fixup phase uses AnyIntUse even in 32bit DFG. This patch removes this incorrect filtering.
+        If the 32bit DFG see the TypeAnyInt, it should fallback to the NumberUse case.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, rolling out r204697
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        32bit is OK. DFGSpeculativeJIT64.cpp shortcut also need some cares.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2016-08-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG] Should not fixup AnyIntUse in 32_64
+        https://bugs.webkit.org/show_bug.cgi?id=161029
+
+        Reviewed by Saam Barati.
+
+        DFG fixup phase uses AnyIntUse even in 32bit DFG. This patch removes this incorrect filtering.
+        If the 32bit DFG see the TypeAnyInt, it should fallback to the NumberUse case.
+
+        And this patch also fixes the case that the type set only contains TypeNumber. Previously,
+        we used NumberUse edge filtering. But it misses AnyInt logging: While the NumberUse filter
+        passes both TypeAnyInt and TypeNumber, the type set only logged TypeNumber.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2016-08-20  Brian Burg  <bburg@apple.com>
+
+        Remote Inspector: some methods don't need to be marked virtual anymore
+        https://bugs.webkit.org/show_bug.cgi?id=161033
+
+        Reviewed by Darin Adler.
+
+        This probably happened when this code was last refactored and moved around.
+
+        * inspector/remote/RemoteConnectionToTarget.h:
+
+2016-08-19  Sam Weinig  <sam@webkit.org>
+
+        Location.ancestorOrigins should return a FrozenArray<USVString>
+        https://bugs.webkit.org/show_bug.cgi?id=161018
+
+        Reviewed by Ryosuke Niwa and Chris Dumez.
+
+        * runtime/ObjectConstructor.h:
+        (JSC::objectConstructorFreeze):
+        Export objectConstructorFreeze so it can be used to freeze DOM FrozenArrays.
+
+2016-08-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] ArithSqrt should work with any argument type
+        https://bugs.webkit.org/show_bug.cgi?id=160954
+
+        Reviewed by Saam Barati.
+
+        Previsouly, ArithSqrt would always OSR Exit if the argument
+        is not typed Integer, Double, or Boolean.
+        Since we can't recover by generalizing to those, we continuously
+        OSR Exit and recompile the same code over and over again.
+
+        This patch introduces a fallback to handle the remaining types.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+        * dfg/DFGMayExit.cpp:
+        This is somewhat unrelated. While discussing the design of this
+        with Filip, we decided not to use ToNumber+ArithSqrt despite
+        the guarantee that ToNumber does not OSR Exit.
+        Since it does not OSR Exit, we should say so in mayExitImpl().
+
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSqrt):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithSqrt):
+
+2016-08-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Make custom Error properties (line, column, sourceURL) configurable and writable
+        https://bugs.webkit.org/show_bug.cgi?id=160984
+        <rdar://problem/27905979>
+
+        Reviewed by Saam Barati.
+
+        * runtime/Error.cpp:
+        (JSC::addErrorInfoAndGetBytecodeOffset):
+        (JSC::addErrorInfo):
+
+2016-08-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove empty files and empty namespace blocks
+        https://bugs.webkit.org/show_bug.cgi?id=160990
+
+        Reviewed by Alex Christensen.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ValueProfile.cpp: Removed.
+        * runtime/WatchdogMac.cpp: Removed.
+        * runtime/WatchdogNone.cpp: Removed.
+
+        * runtime/StringIteratorPrototype.cpp:
+        Remove empty namespace block.
+
+        * runtime/JSDestructibleObject.h:
+        Drive-by add missing copyright.
+
+2016-08-19  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Warning fix.
+        https://bugs.webkit.org/show_bug.cgi?id=160995
+
+        Avoid setting unknown compile option on source file.
+
+        Reviewed by Anders Carlsson.
+
+        * CMakeLists.txt:
+
+2016-08-18  Mark Lam  <mark.lam@apple.com>
+
+        ScopedArguments is using the wrong owner object for a write barrier.
+        https://bugs.webkit.org/show_bug.cgi?id=160976
+        <rdar://problem/27328506>
+
+        Reviewed by Keith Miller.
+
+        * runtime/ScopedArguments.h:
+        (JSC::ScopedArguments::setIndexQuickly):
+
+2016-08-18  Mark Lam  <mark.lam@apple.com>
+
+        Add LLINT probe() macro for X86_64.
+        https://bugs.webkit.org/show_bug.cgi?id=160968
+
+        Reviewed by Geoffrey Garen.
+
+        * llint/LowLevelInterpreter.asm:
+
+2016-08-18  Mark Lam  <mark.lam@apple.com>
+
+        Remove unused SlotVisitor::append() variant.
+        https://bugs.webkit.org/show_bug.cgi?id=160961
+
+        Reviewed by Saam Barati.
+
+        * heap/SlotVisitor.h:
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrier::get):
+        (JSC::SlotVisitor::append): Deleted.
+
+2016-08-18  Saam Barati  <sbarati@apple.com>
+
+        Make @Array(size) a bytecode intrinsic
+        https://bugs.webkit.org/show_bug.cgi?id=160867
+
+        Reviewed by Mark Lam.
+
+        There were a few places in the code where we were emitting `@Array(size)`
+        or `new @Array(size)`. Since we have a bytecode operation that already
+        represents this, called new_array_with_size, it's faster to just make a
+        bytecode intrinsic for the this operation. This patch does that and
+        the intrinsic is called `@newArrayWithSize`. This might be around a
+        1% speedup on ES6 sample bench, but it's within the noise. This is just
+        a good bytecode operation to have because it's common enough to
+        create arrays and it's good to make that fast in all tiers.
+
+        * builtins/ArrayConstructor.js:
+        (of):
+        (from):
+        * builtins/ArrayPrototype.js:
+        (filter):
+        (map):
+        (sort.stringSort):
+        (sort):
+        (concatSlowPath):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_isObject):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_newArrayWithSize):
+
+2016-08-18  Rawinder Singh  <rawinder.singh-webkit@cisra.canon.com.au>
+
+        [web-animations] Add Animatable, AnimationEffect, KeyframeEffect and Animation interface
+        https://bugs.webkit.org/show_bug.cgi?id=156096
+
+        Reviewed by Dean Jackson.
+
+        Adds:
+        - Animatable interface and implementation of getAnimations in Element.
+        - Interface and implementation for Document getAnimations method.
+        - AnimationEffect interface and class stub.
+        - KeyframeEffect interface and constructor implementation.
+        - 'Animation' interface, constructor and query methods for effect and timeline.
+        - Remove runtime condition on Web animation interfaces (compile time flag is specified).
+
+        * runtime/CommonIdentifiers.h:
+
+2016-08-17  Keith Miller  <keith_miller@apple.com>
+
+        Add WASM support for i64 simple opcodes.
+        https://bugs.webkit.org/show_bug.cgi?id=160928
+
+        Reviewed by Michael Saboff.
+
+        This patch also removes the unsigned int32 mod operator, which is not supported by B3 yet.
+
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::toB3Op):
+        (JSC::WASM::B3IRGenerator::unaryOp):
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::WASMFunctionParser<Context>::parseExpression):
+        * wasm/WASMOps.h:
+
+2016-08-17  JF Bastien  <jfbastien@apple.com>
+
+        We allow assignments to const variables when in a for-in/for-of loop
+        https://bugs.webkit.org/show_bug.cgi?id=156673
+
+        Reviewed by Filip Pizlo.
+
+        for-in and for-of weren't checking whether iteration variable from
+        parent scopes were const. Assigning to such variables should
+        throw, but used not to.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+
+2016-08-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a potential bug in MarkedArgumentBuffer.
+        https://bugs.webkit.org/show_bug.cgi?id=160948
+        <rdar://problem/27889416>
+
+        Reviewed by Oliver Hunt.
+
+        I haven't been able to produce an observable test case after some trying.
+
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::addMarkSet): New helper function -- I broke
+        this out from existing code for clarity, but the behavior is the same.
+
+        (JSC::MarkedArgumentBuffer::expandCapacity): Ditto.
+
+        (JSC::MarkedArgumentBuffer::slowAppend): Always addMarkSet() on the slow
+        path. This is faster than the old linear scan, and I think it might
+        avoid cases the old scan could miss.
+
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::append): Account for the case where someone
+        has called clear() or removeLast().
+
+        (JSC::MarkedArgumentBuffer::mallocBase): No behavior change -- but it's
+        clearer to test the buffers directly instead of inferring what they
+        might be based on capacity.
+
+2016-08-17  Mark Lam  <mark.lam@apple.com>
+
+        Remove an invalid assertion in the DFG backend's GetById emitter.
+        https://bugs.webkit.org/show_bug.cgi?id=160925
+        <rdar://problem/27248961>
+
+        Reviewed by Filip Pizlo.
+
+        The DFG backend's GetById assertion that the node's prediction not be SpecNone
+        is just plain wrong.  It assumes that we can never have a GetById node without a
+        type prediction, but this is not true.  The following test case proves otherwise:
+
+            function foo() {
+                "use strict";
+                return --arguments["callee"];
+            }
+
+        Will remove the assertion.  Nothing else needs to change as the DFG is working
+        correctly without the assertion.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-08-16  Mark Lam  <mark.lam@apple.com>
+
+        Heap::collectAllGarbage() should work with JSC_useImmortalObjects=true.
+        https://bugs.webkit.org/show_bug.cgi?id=160917
+
+        Reviewed by Filip Pizlo.
+
+        If we do an synchronous GC when JSC_useImmortalObjects=true, we'll get a
+        RELEASE_ASSERT failure:
+
+            $ JSC_useImmortalObjects=true jsc
+            >>> gc()
+            Trace/BPT trap: 5
+
+        This is because Heap::collectAllGarbage() is doing an explicit sweep of the
+        MarkedSpace, and the sweeper is expecting to see no RetiredBlocks.  However, we
+        make objects immortal by retiring their blocks.  As a result, there is a mismatch
+        in expectancy.
+
+        The fix is simply to not run the sweeper when JSC_useImmortalObjects=true.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+
+2016-08-16  Keith Miller  <keith_miller@apple.com>
+
+        Add WASM I32 simple operators.
+        https://bugs.webkit.org/show_bug.cgi?id=160914
+
+        Reviewed by Benjamin Poulain.
+
+        This patch adds support for the i32 simple binary operators.
+
+        * wasm/WASMB3IRGenerator.cpp:
+        (JSC::WASM::toB3Op):
+        (JSC::WASM::B3IRGenerator::binaryOp):
+        * wasm/WASMFunctionParser.h:
+        (JSC::WASM::WASMFunctionParser<Context>::parseExpression):
+        * wasm/WASMOps.h:
+
+2016-08-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Conversion to sequence<T> is broken for iterable objects
+        https://bugs.webkit.org/show_bug.cgi?id=160801
+
+        Reviewed by Darin Adler.
+
+        Export functions used to iterate over iterable objects.
+
+        * runtime/IteratorOperations.h:
+        (JSC::forEachInIterable):
+
+2016-08-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Regression 204203-204210] 32-bit ASSERTION FAILED: !m_data[index].name.isValid()
+        https://bugs.webkit.org/show_bug.cgi?id=160881
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        We were trying to set the result of the Identity node to the same
+        value as the source of the Identity.
+        That is pretty messed up.
+
+2016-08-15  Saam Barati  <sbarati@apple.com>
+
+        Web Inspector: Introduce a method to enable code coverage profiler without enabling type profiler
+        https://bugs.webkit.org/show_bug.cgi?id=160750
+        <rdar://problem/27793469>
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::disableTypeProfiler):
+        (Inspector::InspectorRuntimeAgent::enableControlFlowProfiler):
+        (Inspector::InspectorRuntimeAgent::disableControlFlowProfiler):
+        (Inspector::InspectorRuntimeAgent::setTypeProfilerEnabledState):
+        (Inspector::InspectorRuntimeAgent::setControlFlowProfilerEnabledState):
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Runtime.json:
+
+2016-08-15  Saam Barati  <sbarati@apple.com>
+
+        Array.prototype.map builtin should go on the fast path when constructor===@Array
+        https://bugs.webkit.org/show_bug.cgi?id=160836
+
+        Reviewed by Keith Miller.
+
+        In the FTL, we were not compiling the result array in Array.prototype.map
+        efficiently when the result array should use the Array constructor
+        (which is the common case). We used to compile it as:
+        x: JSConstant(Array)
+        y: Construct(@x, ...)
+        instead of
+        y: NewArrayWithSize(...)
+
+        This patch changes the builtin to go down the fast path when certain
+        conditions are met. Often, the check to go down the fast path will
+        be constant folded because we always create a normal array from the
+        Array constructor.
+
+        This is around a 5% speedup on ES6 Sample Bench.
+
+        I also made similar changes for Array.prototype.filter
+        and Array.prototype.concat on its slow path.
+
+        * builtins/ArrayPrototype.js:
+
+2016-08-15  Mark Lam  <mark.lam@apple.com>
+
+        Make JSValue::strictEqual() handle failures to resolve JSRopeStrings.
+        https://bugs.webkit.org/show_bug.cgi?id=160832
+        <rdar://problem/27577556>
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, JSValue::strictEqualSlowCaseInline() (and peers) will blindly try to
+        access the StringImpl of a JSRopeString that fails to resolve its rope.  As a
+        result, we'll crash with null pointer dereferences.
+
+        We can fix this by introducing a JSString::equal() method that will do the
+        equality comparison, but is aware of the potential failures to resolve ropes.
+        JSValue::strictEqualSlowCaseInline() (and peers) will now call JSString::equal()
+        instead of accessing the underlying StringImpl directly.
+
+        Also added some exception checks.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITOperations.cpp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        * runtime/JSString.cpp:
+        (JSC::JSString::equalSlowCase):
+        * runtime/JSString.h:
+        * runtime/JSStringInlines.h: Added.
+        (JSC::JSString::equal):
+
+2016-08-15  Keith Miller  <keith_miller@apple.com>
+
+        Implement WASM Parser and B3 IR generator
+        https://bugs.webkit.org/show_bug.cgi?id=160681
+
+        Reviewed by Benjamin Poulain.
+
+        This patch adds the skeleton for a WebAssembly pipeline. The
+        pipeline is designed in order to make it easy to have as much of
+        the compilation process threaded as possible. The flow of the
+        pipeline roughly goes as follows:
+
+        1) Create a WASMPlan with the VM and a Vector of the
+        assembly. Currently the plan will process all the work
+        synchronously, however, in the future this can be offloaded to
+        other threads.
+
+        2) The plan will run the WASMModuleParser, which collates all the
+        information needed to compile each module function
+        independently. Since, we are still in the early phases, the only
+        information is the starting and ending byte of the function's
+        body. The module parser, however, still scans both and
+        semi-validates the type and the function sections.
+
+        3) Each function is decoded and compiled. In the future this
+        should also include a opcode validation phase. The
+        WASMFunctionParser is templatized so that a validator should be
+        able to use most of the same code the B3 IR generator does.
+
+        4) When the plan has finished it will fill a Vector of
+        B3::Compilation objects that correspond to the respective function
+        in the WASM module.
+
+
+        The current testing plan for the modules is to inline the the
+        binary generated by the spec's OCaml prototype. The inlined binary
+        is passed to a WASMPlan then invoked to check the result of the
+        function. In the future we should add a more robust testing
+        infrastructure.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * testWASM.cpp:
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        (invoke):
+        (runWASMTests):
+        (main):
+        * wasm/JSWASMModule.h:
+        (JSC::JSWASMModule::globalVariableTypes):
+        * wasm/WASMB3IRGenerator.cpp: Added.
+        (JSC::WASM::B3IRGenerator::B3IRGenerator):
+        (JSC::WASM::B3IRGenerator::addLocal):
+        (JSC::WASM::B3IRGenerator::binaryOp):
+        (JSC::WASM::B3IRGenerator::addConstant):
+        (JSC::WASM::B3IRGenerator::addBlock):
+        (JSC::WASM::B3IRGenerator::endBlock):
+        (JSC::WASM::B3IRGenerator::addReturn):
+        (JSC::WASM::B3IRGenerator::unify):
+        (JSC::WASM::B3IRGenerator::initializeIncommingTypes):
+        (JSC::WASM::B3IRGenerator::unifyValuesWithLevel):
+        (JSC::WASM::B3IRGenerator::stackForControlLevel):
+        (JSC::WASM::B3IRGenerator::blockForControlLevel):
+        (JSC::WASM::parseAndCompile):
+        * wasm/WASMB3IRGenerator.h: Copied from Source/WTF/wtf/DataLog.h.
+        * wasm/WASMFormat.h:
+        * wasm/WASMFunctionParser.h: Added.
+        (JSC::WASM::WASMFunctionParser<Context>::WASMFunctionParser):
+        (JSC::WASM::WASMFunctionParser<Context>::parse):
+        (JSC::WASM::WASMFunctionParser<Context>::parseBlock):
+        (JSC::WASM::WASMFunctionParser<Context>::parseExpression):
+        * wasm/WASMModuleParser.cpp: Added.
+        (JSC::WASM::WASMModuleParser::parse):
+        (JSC::WASM::WASMModuleParser::parseFunctionTypes):
+        (JSC::WASM::WASMModuleParser::parseFunctionSignatures):
+        (JSC::WASM::WASMModuleParser::parseFunctionDefinitions):
+        * wasm/WASMModuleParser.h: Copied from Source/WTF/wtf/DataLog.h.
+        (JSC::WASM::WASMModuleParser::WASMModuleParser):
+        (JSC::WASM::WASMModuleParser::functionInformation):
+        * wasm/WASMOps.h: Copied from Source/WTF/wtf/DataLog.h.
+        * wasm/WASMParser.h: Added.
+        (JSC::WASM::WASMParser::parseVarUInt32):
+        (JSC::WASM::WASMParser::WASMParser):
+        (JSC::WASM::WASMParser::consumeCharacter):
+        (JSC::WASM::WASMParser::consumeString):
+        (JSC::WASM::WASMParser::parseUInt32):
+        (JSC::WASM::WASMParser::parseUInt7):
+        (JSC::WASM::WASMParser::parseVarUInt1):
+        (JSC::WASM::WASMParser::parseValueType):
+        * wasm/WASMPlan.cpp: Copied from Source/WTF/wtf/DataLog.h.
+        (JSC::WASM::Plan::Plan):
+        * wasm/WASMPlan.h: Copied from Source/WTF/wtf/DataLog.h.
+        * wasm/WASMSections.cpp: Copied from Source/WTF/wtf/DataLog.h.
+        (JSC::WASM::WASMSections::lookup):
+        * wasm/WASMSections.h: Copied from Source/WTF/wtf/DataLog.h.
+        (JSC::WASM::WASMSections::validateOrder):
+
+2016-08-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] B3 Neg opcode should support float
+        https://bugs.webkit.org/show_bug.cgi?id=160795
+
+        Reviewed by Geoffrey Garen.
+
+        This is required to implement WASM f32.neg opcode.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::negateFloat):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3ReduceDoubleToFloat.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testNegDouble):
+        (JSC::B3::testNegFloat):
+        (JSC::B3::testNegFloatWithUselessDoubleConversion):
+        (JSC::B3::run):
+
+2016-08-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Use #pragma once in inspector headers
+        https://bugs.webkit.org/show_bug.cgi?id=160861
+
+        Reviewed by Mark Lam.
+
+        * inspector/*.h:
+
+2016-08-15  Daniel Bates  <dabates@apple.com>
+
+        Cannot build WebKit for iOS device using Xcode 7.3/iOS 9.3 public SDK due to missing
+        private frameworks and libraries
+        https://bugs.webkit.org/show_bug.cgi?id=155931
+        <rdar://problem/25807989>
+
+        Reviewed by Dan Bernstein.
+
+        Add directory WebKitLibraries/WebKitPrivateFrameworkStubs/iOS/X to the framework search path
+        where X is the major version of the active iOS SDK.
+
+        * Configurations/Base.xcconfig:
+
+2016-08-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Reduce includes of Debugger.h
+        https://bugs.webkit.org/show_bug.cgi?id=160827
+
+        Reviewed by Mark Lam.
+
+        * API/JSTypedArray.cpp:
+        * bytecode/UnlinkedCodeBlock.h:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        * dfg/DFGPlan.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * ftl/FTLJITCode.h:
+        * inspector/ScriptCallStackFactory.cpp:
+        * inspector/agents/InspectorDebuggerAgent.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITOperations.cpp:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * parser/Nodes.cpp:
+        * parser/Parser.cpp:
+        * parser/Parser.h:
+        * runtime/Completion.cpp:
+        * runtime/Executable.cpp:
+        * runtime/Executable.h:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/SamplingProfiler.cpp:
+        * runtime/SamplingProfiler.h:
+        * runtime/VMEntryScope.cpp:
+
+2016-08-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unused includes of wtf headers
+        https://bugs.webkit.org/show_bug.cgi?id=160839
+
+        Reviewed by Alex Christensen.
+
+        * Lots of files.
+
+2016-08-13  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Warning fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=160803
+
+        Reviewed by Brent Fulgham.
+
+        Initialize local variables.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        * runtime/Error.cpp:
+        (JSC::addErrorInfoAndGetBytecodeOffset):
+
+2016-08-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove always true JSC::Debugger::needPauseHandling virtual method
+        https://bugs.webkit.org/show_bug.cgi?id=160822
+
+        Reviewed by Mark Lam.
+
+        All subclasses return true for this method. Just remove the method.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::pauseIfNeeded):
+        * inspector/ScriptDebugServer.h:
+
+2016-08-12  Saam Barati  <sbarati@apple.com>
+
+        Inline store loop for CopyRest in DFG and FTL for certain array modes
+        https://bugs.webkit.org/show_bug.cgi?id=159612
+
+        Reviewed by Filip Pizlo.
+
+        This patch changes the old copy_rest bytecode to actually allocate the rest array itself.
+        The bytecode is now called create_rest with an analogous CreateRest node in the DFG/FTL.
+        This allows the bytecode to be in control of what type of indexingType the array is allocated
+        with. We always allocate using ArrayWithContiguous storage unless we're havingABadTime().
+        This also makes allocating and writing into the array fast. On the fast path, the DFG/FTL
+        JIT will fast allocate the array and its storage, and we will do a memmove from the rest
+        region of arguments into the array's storage.
+
+        I'm seeing a 1-2% speedup on ES6SampleBench, and about a 2x speedup
+        on micro benchmarks that just test rest creation speed.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitRestParameter):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
+        (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::uses):
+        (JSC::DFG::Graph::isWatchingHavingABadTimeWatchpoint):
+        (JSC::DFG::Graph::compilation):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::numberOfArgumentsToSkip):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):
+        (JSC::DFG::SpeculativeJIT::compileCreateRest):
+        (JSC::DFG::SpeculativeJIT::compileGetRestLength):
+        (JSC::DFG::SpeculativeJIT::compileCopyRest): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileArithRandom):
+        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileArithRandom):
+        (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateClonedArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetRestLength):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayBuffer):
+        (JSC::FTL::DFG::LowerDFGToB3::compileAllocateArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCopyRest): Deleted.
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::addressOfArgumentsStart):
+        (JSC::ExecState::argument):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_argument_count):
+        (JSC::JIT::emit_op_create_rest):
+        (JSC::JIT::emit_op_copy_rest): Deleted.
+        * jit/JITOperations.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+
+2016-08-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Add a helper class for enumerating elements in an iterable object
+        https://bugs.webkit.org/show_bug.cgi?id=160800
+
+        Reviewed by Benjamin Poulain.
+
+        Added iteratorForIterable which provides an abstraction for iterating over an iterable object,
+        and deployed it in the constructors of Set, WeakSet, Map, and WeakMap.
+
+        Also added a helper function iteratorForIterable, which retrieves the iterator out of an iterable object.
+
+        * runtime/IteratorOperations.cpp:
+        (JSC::iteratorForIterable): Added.
+        * runtime/IteratorOperations.h:
+        (JSC::forEachInIterable): Added.
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::constructWeakSet):
+
+2016-08-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unused includes of RefCountedLeakCounter.h
+        https://bugs.webkit.org/show_bug.cgi?id=160817
+
+        Reviewed by Mark Lam.
+
+        * parser/Nodes.cpp:
+        * runtime/Structure.cpp:
+
+2016-08-12  Pranjal Jumde  <pjumde@apple.com>
+
+        ASSERTION FAILED: : line >= firstLine in BytecodeGenerator::emitExpressionInfo.
+        https://bugs.webkit.org/show_bug.cgi?id=160535
+        <rdar://problem/27328151>
+        
+        Reviewed by Saam Barati.
+
+        lineNumber from the savePoint was not being restored before calling next() causing discrepancy in the offset and line for the token
+
+        * parser/Parser.h:
+        (JSC::Parser::restoreLexerState):
+
+2016-08-12  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES2016] Implement Object.entries
+        https://bugs.webkit.org/show_bug.cgi?id=160412
+
+        Reviewed by Saam Barati.
+
+        This patch adds entries function to Object that returns list of 
+        key+values pairs. Patch did according to the point of
+        spec https://tc39.github.io/ecma262/#sec-object.entries
+
+        * builtins/ObjectConstructor.js:
+        (globalPrivate.enumerableOwnProperties):
+        (entries):
+        * runtime/ObjectConstructor.cpp:
+
+2016-08-11  Mark Lam  <mark.lam@apple.com>
+
+        OverridesHasInstance should not branch across register allocations.
+        https://bugs.webkit.org/show_bug.cgi?id=160792
+        <rdar://problem/27361778>
+
+        Reviewed by Benjamin Poulain.
+
+        The OverrideHasInstance node has a branch test that is emitted conditionally.
+        It also has a bug where it allocated a register after this branch, which is not
+        allowed and would fail an assertion introduced in https://trac.webkit.org/r145931.
+        From the ChangeLog for r145931:
+
+        "This [assertion that register allocations are not branched around] protects
+        against the case where an allocation could have spilled register contents to free
+        up a register and that spill only occurs on one path of many through the code.
+        A subsequent fill of the spilled register may load garbage."
+
+        Because the branch isn't always emitted, this bug has gone unnoticed until now.
+        This patch fixes this issue by pre-allocating the registers before emitting the
+        branch in OverrideHasInstance.
+
+        Note: this issue is only present in DFGSpeculativeJIT64.cpp.  The 32-bit version
+        is doing it right.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-08-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make B3 Return opcode work without arguments
+        https://bugs.webkit.org/show_bug.cgi?id=160787
+
+        Reviewed by Keith Miller.
+
+        We need a way to create functions that do not return values.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::retVoid):
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::appendNewControlValue):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Validate.cpp:
+        * b3/B3Value.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testReturnVoid):
+        (JSC::B3::run):
+
+2016-08-11  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix gcc builds after r204387. 
+
+        Not reviewed.
+
+        Apparently, gcc is not sophisticated enough to realize that the end of the
+        function is unreachable, and is wrongly complaining about "control reaches end of
+        non-void function".  I'm restoring the RELEASE_ASSERT_NOT_REACHED() and return
+        statement at the end of MarkedBlock::sweepHelper() to appease gcc.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper):
+
+2016-08-11  Alex Christensen  <achristensen@webkit.org>
+
+        Use StringBuilder::appendLiteral when possible don't append result of makeString
+        https://bugs.webkit.org/show_bug.cgi?id=160772
+
+        Reviewed by Sam Weinig.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (testExecutionTimeLimit):
+        * API/tests/PingPongStackOverflowTest.cpp:
+        (PingPongStackOverflowObject_hasInstance):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayPatternNode::toString):
+        (JSC::RestParameterNode::toString):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::sanitizedToString):
+        * runtime/Options.cpp:
+        (JSC::Options::dumpOption):
+
+2016-08-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Revert most of r203808
+        https://bugs.webkit.org/show_bug.cgi?id=160784
+
+        Reviewed by Geoffrey Garen.
+
+        Switching to fastMalloc() caused regressions on Jetstream and Octane
+        on MacBook Air. I was able to get back some of it in the following
+        patches but the tests that never go to FTL are still regressed.
+
+        This patch revert r203808 except of the node index.
+        Nodes are allocated with the custom allocator like before but they are
+        now also kept in a table, addressed by the node index.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3SparseCollection.h:
+        (JSC::B3::SparseCollection::packIndices): Deleted.
+        * dfg/DFGAllocator.h: Added.
+        (JSC::DFG::Allocator::Region::size):
+        (JSC::DFG::Allocator::Region::headerSize):
+        (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
+        (JSC::DFG::Allocator::Region::data):
+        (JSC::DFG::Allocator::Region::isInThisRegion):
+        (JSC::DFG::Allocator::Region::regionFor):
+        (JSC::DFG::Allocator<T>::Allocator):
+        (JSC::DFG::Allocator<T>::~Allocator):
+        (JSC::DFG::Allocator<T>::allocate):
+        (JSC::DFG::Allocator<T>::free):
+        (JSC::DFG::Allocator<T>::freeAll):
+        (JSC::DFG::Allocator<T>::reset):
+        (JSC::DFG::Allocator<T>::indexOf):
+        (JSC::DFG::Allocator<T>::allocatorOf):
+        (JSC::DFG::Allocator<T>::bumpAllocate):
+        (JSC::DFG::Allocator<T>::freeListAllocate):
+        (JSC::DFG::Allocator<T>::allocateSlow):
+        (JSC::DFG::Allocator<T>::freeRegionsStartingAt):
+        (JSC::DFG::Allocator<T>::startBumpingIn):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::~Graph):
+        (JSC::DFG::Graph::addNodeToMapByIndex):
+        (JSC::DFG::Graph::deleteNode):
+        (JSC::DFG::Graph::packNodeIndices):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addNode):
+        (JSC::DFG::Graph::maxNodeCount):
+        (JSC::DFG::Graph::nodeAt):
+        * dfg/DFGLongLivedState.cpp: Added.
+        (JSC::DFG::LongLivedState::LongLivedState):
+        (JSC::DFG::LongLivedState::~LongLivedState):
+        (JSC::DFG::LongLivedState::shrinkToFit):
+        * dfg/DFGLongLivedState.h: Added.
+        * dfg/DFGNode.h:
+        * dfg/DFGNodeAllocator.h: Added.
+        (operator new ):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::runThread):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-08-11  Mark Lam  <mark.lam@apple.com>
+
+        The jsc shell's Element host constructor should throw if it fails to construct an object.
+        https://bugs.webkit.org/show_bug.cgi?id=160773
+        <rdar://problem/27328608>
+
+        Reviewed by Saam Barati.
+
+        The Element object is a test object provided in the jsc shell for testing use only.
+        JavaScriptCore expects host constructors to either throw an error or return a
+        constructed object.  Element has a host constructor that did not obey this contract.
+        As a result, the following statement will fail a RELEASE_ASSERT:
+
+            new (Element.bind())
+
+        This is now fixed.
+
+        * jsc.cpp:
+        (functionCreateElement):
+
+2016-08-11  Mark Lam  <mark.lam@apple.com>
+
+        Disallow synchronous sweeping for eden GCs.
+        https://bugs.webkit.org/show_bug.cgi?id=160716
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collectAndSweep): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::collectAllGarbage): Deleted.
+        - No need for a separate collectAndSweep() anymore since we only call it for
+          FullCollections.
+        - Since we've already swept all the blocks, I cleared m_blockSnapshot so that the
+          IncrementalSweeper can bail earlier when it runs later.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper):
+        - Removed the unreachable return statement.
+
+        * heap/MarkedBlock.h:
+        - Document what "Retired" means.
+
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::edenGC):
+
+2016-08-11  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Warning fix.
+        https://bugs.webkit.org/show_bug.cgi?id=160734
+
+        Reviewed by Sam Weinig.
+
+        Add static cast from int to uint32_t.
+
+        * bytecode/ArithProfile.h:
+
+2016-08-10  Michael Saboff  <msaboff@apple.com>
+
+        Baseline GetByVal and PutByVal for cache ID stubs need to handle exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=160749
+
+        Reviewed by Filip Pizlo.
+
+        We were emitting "callOperation()" calls in emitGetByValWithCachedId() and
+        emitPutByValWithCachedId() without linking the exception checks created by the
+        code emitted.  This manifested itself in various ways depending on the processor.
+        This is due to what the destination is for an unlinked branch.  On X86, an unlinked
+        branch goes tot he next instructions.  On ARM64, we end up with an infinite loop
+        as we branch to the same instruction.  On ARM we branch to 0 as the branch is to
+        an absolute address of 0.
+
+        Now we save the exception handler address for the original generated function and
+        link the exception cases for these by-val stubs to this handler.
+
+        * bytecode/ByValInfo.h:
+        (JSC::ByValInfo::ByValInfo): Added the address of the exception handler we should
+        link to.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::link): Compute the linked exception handler address and pass it to
+        the ByValInfo constructor.
+        (JSC::JIT::privateCompileExceptionHandlers): Make sure that we generate the
+        exception handler if we have any by-val handlers.
+
+        * jit/JIT.h:
+        Added a label for the exception handler.  We'll link this later for the
+        by value handlers.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByValWithCachedId):
+        (JSC::JIT::privateCompilePutByValWithCachedId):
+        Link exception branches to the exception handler for the main function.
+
+2016-08-10  Mark Lam  <mark.lam@apple.com>
+
+        DFG's flushForTerminal() needs to add PhantomLocals for bytecode live locals.
+        https://bugs.webkit.org/show_bug.cgi?id=160755
+        <rdar://problem/27488507>
+
+        Reviewed by Filip Pizlo.
+
+        If the DFG sees that an inlined function will result in an OSR exit every time,
+        it will treat all downstream blocks as dead.  However, it still needs to keep
+        locals that are alive in the bytecode alive for the compiled function so that
+        those locals are properly written to the stack by the OSR exit ramp.
+
+        The existing code neglected to do this.  This patch remedies this issue.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::flushDirect):
+        (JSC::DFG::ByteCodeParser::addFlushOrPhantomLocal):
+        (JSC::DFG::ByteCodeParser::phantomLocalDirect):
+        (JSC::DFG::ByteCodeParser::flushForTerminal):
+
+2016-08-09  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES2016] Implement Object.values
+        https://bugs.webkit.org/show_bug.cgi?id=160410
+
+        Reviewed by Saam Barati, Yusuke Suzuki.
+
+        This patch adds values function to Object that return list of 
+        own values of the object. Patch did according to the point of 
+        spec http://tc39.github.io/ecma262/#sec-object.values
+        
+        Also patch adds generic builtin intrinsic constants: 
+        @IterationKindKey/@IterationKindValue/@IterationKindKeyValue 
+        that is used in  EnumerableOwnProperties to set Kind of operation  
+        and replace own IterationKind enums in following iterators: 
+        ArrayIterator, MapIterator, and SetIterator 
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ObjectConstructor.js:
+        (globalPrivate.enumerableOwnProperties):
+        (values):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        * runtime/ArrayIteratorPrototype.h:
+        * runtime/IterationKind.h: Copied from Source/JavaScriptCore/builtins/ObjectConstructor.js.
+        * runtime/JSMapIterator.h:
+        (JSC::JSMapIterator::create):
+        (JSC::JSMapIterator::next):
+        (JSC::JSMapIterator::kind):
+        (JSC::JSMapIterator::JSMapIterator):
+        * runtime/JSSetIterator.h:
+        (JSC::JSSetIterator::create):
+        (JSC::JSSetIterator::next):
+        (JSC::JSSetIterator::kind):
+        (JSC::JSSetIterator::JSSetIterator):
+        * runtime/MapPrototype.cpp:
+        (JSC::mapProtoFuncValues):
+        (JSC::mapProtoFuncEntries):
+        (JSC::mapProtoFuncKeys):
+        (JSC::privateFuncMapIterator):
+        * runtime/ObjectConstructor.cpp:
+        * runtime/SetPrototype.cpp:
+        (JSC::setProtoFuncValues):
+        (JSC::setProtoFuncEntries):
+        (JSC::privateFuncSetIterator):
+
+2016-08-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Speed up SparseCollection & related maps
+        https://bugs.webkit.org/show_bug.cgi?id=160733
+
+        Reviewed by Saam Barati.
+
+        On MBA, Graph::addNode() shows up in profiles due to SparseCollection::add().
+        This is unfortunate.
+
+        The first improvement is to build the new unique_ptr in the empty slot
+        instead of moving a new value into it.
+
+        Previously, the code would load the previous value, test if it is null
+        then invoke the destructor and finally fastFree(). The initial test
+        obviously fails so that's a whole bunch of code that is never executed.
+
+        With the new code, we just have a store.
+
+        I also removed the bounds checking on our maps based on node index.
+        Those bounds checks are never eliminated by clang because the index
+        is always loaded from memory instead of being computed.
+        There are unfortunately too many nodes processed and the bounds checks
+        get costly.
+
+        * b3/B3SparseCollection.h:
+        (JSC::B3::SparseCollection::add):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::abstractValuesCache):
+        * dfg/DFGInPlaceAbstractState.h:
+
+2016-08-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove some useless code I left when rewriting CSE's large maps
+        https://bugs.webkit.org/show_bug.cgi?id=160720
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGCSEPhase.cpp:
+        The maps m_worldMap && m_sideStateMap are useless. They come from the previous
+        iteration that had weaker constraints.
+
+        Also move m_heapMap after m_fallbackStackMap since that is the order
+        in which they are used in the algorithm.
+
+2016-08-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        Remove AbstractInterpreter::executeEdges(unsigned), it is no longer used anywhere
+        https://bugs.webkit.org/show_bug.cgi?id=160708
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGAbstractInterpreter.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEdges): Deleted.
+
+2016-08-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Sort the feature flags in the FEATURE_DEFINES lines
+        https://bugs.webkit.org/show_bug.cgi?id=160742
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-08-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Add ModuleLoaderPrototype and move methods to it
+        https://bugs.webkit.org/show_bug.cgi?id=160633
+
+        Reviewed by Saam Barati.
+
+        In the future, we need to add the ability to create the new Loader object (by users).
+        So rather than holding all the methods in the ModuleLoaderObject instance, moving them
+        to ModuleLoaderPrototype and create the default JSModuleLoader instance is better.
+
+        No behavior change.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ModuleLoaderObject.js:
+        (setStateToMax): Deleted.
+        (newRegistryEntry): Deleted.
+        (ensureRegistered): Deleted.
+        (forceFulfillPromise): Deleted.
+        (fulfillFetch): Deleted.
+        (fulfillTranslate): Deleted.
+        (fulfillInstantiate): Deleted.
+        (commitInstantiated): Deleted.
+        (instantiation): Deleted.
+        (requestFetch): Deleted.
+        (requestTranslate): Deleted.
+        (requestInstantiate): Deleted.
+        (requestResolveDependencies.): Deleted.
+        (requestResolveDependencies): Deleted.
+        (requestInstantiateAll): Deleted.
+        (requestLink): Deleted.
+        (requestReady): Deleted.
+        (link): Deleted.
+        (moduleEvaluation): Deleted.
+        (provide): Deleted.
+        (loadAndEvaluateModule): Deleted.
+        (loadModule): Deleted.
+        (linkAndEvaluateModule): Deleted.
+        * builtins/ModuleLoaderPrototype.js: Renamed from Source/JavaScriptCore/builtins/ModuleLoaderObject.js.
+        (setStateToMax):
+        (newRegistryEntry):
+        (ensureRegistered):
+        (forceFulfillPromise):
+        (fulfillFetch):
+        (fulfillTranslate):
+        (fulfillInstantiate):
+        (commitInstantiated):
+        (instantiation):
+        (requestFetch):
+        (requestTranslate):
+        (requestInstantiate):
+        (requestResolveDependencies.):
+        (requestResolveDependencies):
+        (requestInstantiateAll):
+        (requestLink):
+        (requestReady):
+        (link):
+        (moduleEvaluation):
+        (provide):
+        (loadAndEvaluateModule):
+        (loadModule):
+        (linkAndEvaluateModule):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * jsc.cpp:
+        (GlobalObject::moduleLoaderResolve):
+        (GlobalObject::moduleLoaderFetch):
+        * runtime/Completion.cpp:
+        (JSC::loadAndEvaluateModule):
+        (JSC::loadModule):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::moduleLoader):
+        (JSC::JSGlobalObject::moduleLoaderStructure):
+        * runtime/JSModuleLoader.cpp: Added.
+        (JSC::JSModuleLoader::JSModuleLoader):
+        (JSC::JSModuleLoader::finishCreation):
+        (JSC::printableModuleKey):
+        (JSC::JSModuleLoader::provide):
+        (JSC::JSModuleLoader::loadAndEvaluateModule):
+        (JSC::JSModuleLoader::loadModule):
+        (JSC::JSModuleLoader::linkAndEvaluateModule):
+        (JSC::JSModuleLoader::resolve):
+        (JSC::JSModuleLoader::fetch):
+        (JSC::JSModuleLoader::translate):
+        (JSC::JSModuleLoader::instantiate):
+        (JSC::JSModuleLoader::evaluate):
+        * runtime/JSModuleLoader.h: Copied from Source/JavaScriptCore/runtime/ModuleLoaderObject.h.
+        (JSC::JSModuleLoader::create):
+        (JSC::JSModuleLoader::createStructure):
+        * runtime/JSModuleRecord.h:
+        * runtime/ModuleLoaderObject.cpp: Removed.
+        (JSC::ModuleLoaderObject::ModuleLoaderObject): Deleted.
+        (JSC::ModuleLoaderObject::finishCreation): Deleted.
+        (JSC::printableModuleKey): Deleted.
+        (JSC::ModuleLoaderObject::provide): Deleted.
+        (JSC::ModuleLoaderObject::loadAndEvaluateModule): Deleted.
+        (JSC::ModuleLoaderObject::loadModule): Deleted.
+        (JSC::ModuleLoaderObject::linkAndEvaluateModule): Deleted.
+        (JSC::ModuleLoaderObject::resolve): Deleted.
+        (JSC::ModuleLoaderObject::fetch): Deleted.
+        (JSC::ModuleLoaderObject::translate): Deleted.
+        (JSC::ModuleLoaderObject::instantiate): Deleted.
+        (JSC::ModuleLoaderObject::evaluate): Deleted.
+        (JSC::moduleLoaderObjectParseModule): Deleted.
+        (JSC::moduleLoaderObjectRequestedModules): Deleted.
+        (JSC::moduleLoaderObjectModuleDeclarationInstantiation): Deleted.
+        (JSC::moduleLoaderObjectResolve): Deleted.
+        (JSC::moduleLoaderObjectFetch): Deleted.
+        (JSC::moduleLoaderObjectTranslate): Deleted.
+        (JSC::moduleLoaderObjectInstantiate): Deleted.
+        (JSC::moduleLoaderObjectEvaluate): Deleted.
+        * runtime/ModuleLoaderObject.h:
+        (JSC::ModuleLoaderObject::create): Deleted.
+        (JSC::ModuleLoaderObject::createStructure): Deleted.
+        * runtime/ModuleLoaderPrototype.cpp: Added.
+        (JSC::ModuleLoaderPrototype::ModuleLoaderPrototype):
+        (JSC::moduleLoaderPrototypeParseModule):
+        (JSC::moduleLoaderPrototypeRequestedModules):
+        (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):
+        (JSC::moduleLoaderPrototypeResolve):
+        (JSC::moduleLoaderPrototypeFetch):
+        (JSC::moduleLoaderPrototypeTranslate):
+        (JSC::moduleLoaderPrototypeInstantiate):
+        (JSC::moduleLoaderPrototypeEvaluate):
+        * runtime/ModuleLoaderPrototype.h: Renamed from Source/JavaScriptCore/runtime/ModuleLoaderObject.h.
+        (JSC::ModuleLoaderPrototype::create):
+        (JSC::ModuleLoaderPrototype::createStructure):
+
+2016-08-09  Saam Barati  <sbarati@apple.com>
+
+        JSBoundFunction should lazily generate its name string
+        https://bugs.webkit.org/show_bug.cgi?id=160678
+        <rdar://problem/27043194>
+
+        Reviewed by Mark Lam.
+
+        We were eagerly allocating the BoundFunction's 'name' string
+        by prepending the "bound " prefix. This patch makes the 'name'
+        string creation lazy like we do with ordinary JSFunctions.
+
+        This is a 25% speedup on the microbenchmark I added that measures
+        bound function creation speed. Hopefully this also helps us recover
+        from a 1% Speedometer regression that was introduced in the original
+        bound function "bound " prefixing patch.
+
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::JSBoundFunction):
+        (JSC::JSBoundFunction::finishCreation):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty):
+        (JSC::JSFunction::reifyLazyPropertyIfNeeded):
+        (JSC::JSFunction::reifyBoundNameIfNeeded):
+        * runtime/JSFunction.h:
+
+2016-08-09  George Ruan  <gruan@apple.com>
+
+        Implement functionality of media capture on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=158945
+        <rdar://problem/26893343>
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig: Enable media capture feature
+        for iOS.
+
+2016-08-09  Saam Barati  <sbarati@apple.com>
+
+        Parser<LexerType>::parseFunctionInfo() has the wrong info about captured vars when a function is not cached.
+        https://bugs.webkit.org/show_bug.cgi?id=160671
+        <rdar://problem/27756112>
+
+        Reviewed by Mark Lam.
+
+        There was a bug in our captured variable analysis when a function has a default
+        parameter expression that is a function that captures something from the parent scope.
+        The bug was that we were relying on the SourceProviderCache to succeed for the
+        analysis to work. This is obviously wrong. I've fixed this to work regardless
+        of getting a cache hit. To prevent future bugs that rely on the success of the
+        SourceProviderCache, I've made the validate testing mode disable the SourceProviderCache
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Scope::setInnerArrowFunctionUsesEvalAndUseArgumentsIfNeeded):
+        (JSC::Scope::addClosedVariableCandidateUnconditionally):
+        (JSC::Scope::collectFreeVariables):
+        * runtime/Options.h:
+
+2016-08-08  Mark Lam  <mark.lam@apple.com>
+
+        ASSERTION FAILED: hasInlineStorage() in JSFinalObject::visitChildren().
+        https://bugs.webkit.org/show_bug.cgi?id=160666
+
+        Reviewed by Keith Miller.
+
+        This assertion is benign.  JSFinalObject::visitChildren() calls
+        JSObject::inlineStorage() to get a pointer to the object's inline storage, and
+        later passes it to visitor.appendValuesHidden() with a previously computed
+        storageSize.  When storageSize is 0, appendValuesHidden() ends up doing nothing.
+        However, before we get there, JSObject::inlineStorage() will be asserting
+        hasInlineStorage() and this assertion will fail when storageSize is 0.
+
+        We can fix this assertion failure by simply adding a storageSize check before
+        calling hasInlineStorage() and visitor.appendValuesHidden().
+
+        * runtime/JSObject.cpp:
+        (JSC::JSFinalObject::visitChildren):
+
+2016-08-08  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: clean up prefixing of Automation protocol generated files
+        https://bugs.webkit.org/show_bug.cgi?id=160635
+        <rdar://problem/27735327>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduce different settings for the 'protocol group' name for C++ vs. Objective-C.
+
+        Use 'WD' as the prefix for generated Objective-C frontend dispatchers and helpers.
+        Continue using 'Automation' as the prefix for generated C++ backend dispatchers.
+
+        * inspector/scripts/codegen/cpp_generator.py:
+        (CppGenerator.protocol_name):
+        * inspector/scripts/codegen/generate_objc_protocol_type_conversions_implementation.py:
+        (ObjCProtocolTypeConversionsImplementationGenerator.generate_output):
+        (ObjCProtocolTypeConversionsImplementationGenerator._generate_type_factory_category_interface):
+        (ObjCProtocolTypeConversionsImplementationGenerator._generate_type_factory_category_implementation):
+        Adjust the class name. Generate one category per protocol domain to keep it easy to read.
+
+        * inspector/scripts/codegen/models.py:
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator.protocol_name):
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        Rebaseline test results.
+
+2016-08-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Module namespace object should not allow unset IC
+        https://bugs.webkit.org/show_bug.cgi?id=160553
+
+        Reviewed by Saam Barati.
+
+        Previously, module namespace object accidentally allow "unset IC". But this "unsetness" does not rely on
+        the structure. We should disable inline caching onto the namespace object. Once it is needed, we should
+        create the special caching for namespace object like the following: it should be similar to monomorphic IC,
+        but it caches the object itself instead of the structure. It checks the object itself (And in DFG, it should be
+        CheckCell) and loads the value from the target module environment directly[1].
+
+        And this patch also set setIsTaintedByProxy for the module namespace object to notify to the caller that
+        this object has impure ::getOwnPropertySlot. Then this function is now renamed to setIsTaintedByOpaqueObject.
+
+        We drop the hack in JSModuleNamespaceObject::getOwnPropertySlot since we already introduced InternalMethodType
+        for ProxyObject. Previously we cannot distinguish ::HasProperty and ::GetOwnProperty. So not to throw any
+        errors for ::HasProperty case, we used slot.setCustom to delay the observable operation.
+        But, this hack lacks the support for hasOwnProperty: hasOwnProperty uses [[GetOwnProperty]], so it should throw an error.
+        However the previous implementation does not throw an error since the delayed observable part (custom function part) is
+        skipped in hasOwnProperty implementation. We now remove this custom property hack and fix the corresponding failure
+        in test262.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=160590
+
+        * jit/JITOperations.cpp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
+        (JSC::callbackGetter): Deleted.
+        * runtime/JSModuleNamespaceObject.h:
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::getPureResult):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::setIsTaintedByOpaqueObject):
+        (JSC::PropertySlot::isTaintedByOpaqueObject):
+        (JSC::PropertySlot::setIsTaintedByProxy): Deleted.
+        (JSC::PropertySlot::isTaintedByProxy): Deleted.
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+
+2016-08-05  Keith Miller  <keith_miller@apple.com>
+
+        Add LEBDecoder and tests
+        https://bugs.webkit.org/show_bug.cgi?id=160625
+
+        Reviewed by Benjamin Poulain.
+
+        Adds a new target testWASM that is currently used to test the LEB decoder.
+        In the future, if we add more support for WASM we will put more tests
+        here.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * testWASM.cpp: Added.
+        (CommandLine::CommandLine):
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        (runLEBTests):
+        (main):
+
+2016-08-05  Keith Miller  <keith_miller@apple.com>
+
+        32-bit JSC test failure: stress/instanceof-late-constant-folding.js
+        https://bugs.webkit.org/show_bug.cgi?id=160620
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-08-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove the first LocalCSE
+        https://bugs.webkit.org/show_bug.cgi?id=160615
+
+        Reviewed by Saam Barati.
+
+        LocalCSE is the most expensive phase in DFG (excluding FTL).
+
+        The combination of two LocalCSEs does not seem to pay for its cost.
+        Doing a single LocalCSE is always after ConstantFolding and StrengthReduction
+        is always a win on my machine.
+
+        * dfg/DFGCleanUpPhase.cpp:
+        (JSC::DFG::CleanUpPhase::run):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+
+2016-08-05  Saam Barati  <sbarati@apple.com>
+
+        various math operations don't properly check for an exception after calling toNumber() on the lhs
+        https://bugs.webkit.org/show_bug.cgi?id=160154
+
+        Reviewed by Mark Lam.
+
+        We must check for an exception after calling toNumber() on the lhs
+        because this can throw an exception. If we called toNumber() on
+        the rhs without first checking for an exception after the toNumber()
+        on the lhs, this can lead us to execute effectful code or deviate
+        from the standard in subtle ways. I fixed this bug in various places
+        by always checking for an exception after calling toNumber() on the
+        lhs for the various bit and arithmetic operations.
+
+        This patch also found a commutativity bug inside DFGStrengthReduction.
+        We could end up commuting the lhs and rhs of say an "|" expression
+        even when the lhs/rhs may not be numbers. This is wrong because
+        executing toNumber() on the lhs/rhs has strict ordering guarantees
+        by the specification and is observable by user programs.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleCommutativity):
+        * jit/JITOperations.cpp:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+
+2016-08-05  Michael Saboff  <msaboff@apple.com>
+
+        compilePutByValForIntTypedArray() has a slow path in the middle of its processing
+        https://bugs.webkit.org/show_bug.cgi?id=160614
+
+        Reviewed by Keith Miller.
+
+        In compilePutByValForIntTypedArray() we were calling out to the slow path
+        operationToInt32() and then returning back to the middle of code to finish
+        the processing of writing the value to the array.  When we make the slow
+        path call, we trash any temporary registers that have been allocated.
+        In general slow path calls should finish the operation in progress and
+        continue processing at the beginning of the next node.
+
+        This was discovered while working on the register argument changes, when
+        we SpeculateStrictInt32Operand on the value child node.  That child node's
+        value was live in register with a spill format of DataFormatJSInt32.  In that
+        case we allocate a new temporary register and copy just the lower 32 bits from
+        the child register to the new temp register.  That temp register gets trashed
+        when we make the operationToInt32() slow path call.
+
+        I spent some time trying to devise a test with the current code base and wasn't
+        successful.  This case is tested with the register argument changes in progress.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+
+2016-08-05  Saam Barati  <sbarati@apple.com>
+
+        Assertion failure when accessing TDZ variable in catch through eval
+        https://bugs.webkit.org/show_bug.cgi?id=160554
+
+        Reviewed by Mark Lam and Keith Miller.
+
+        When we were calculating the variables under TDZ from a JSScope,
+        the algorithm was not taking into account that a catch scope
+        has variables under TDZ.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::collectVariablesUnderTDZ):
+
+2016-08-05  Keith Miller  <keith_miller@apple.com>
+
+        Delete out of date WASM code.
+        https://bugs.webkit.org/show_bug.cgi?id=160603
+
+        Reviewed by Saam Barati.
+
+        This patch removes a bunch of the wasm files that we are unlikey to use
+        with the newer wasm spec. If we end up needing any of the deleted code
+        later we can restore it at that time.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITOperations.cpp:
+        * jsc.cpp:
+        (GlobalObject::finishCreation): Deleted.
+        (functionLoadWebAssembly): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall): Deleted.
+        * runtime/Executable.cpp:
+        (JSC::WebAssemblyExecutable::prepareForExecution): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Deleted.
+        (JSC::JSGlobalObject::visitChildren): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::wasmModuleStructure): Deleted.
+        * wasm/WASMConstants.h: Removed.
+        * wasm/WASMFunctionB3IRGenerator.h: Removed.
+        (JSC::WASMFunctionB3IRGenerator::MemoryAddress::MemoryAddress): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::startFunction): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::endFunction): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildSetLocal): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildSetGlobal): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildReturn): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildImmediateI32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildImmediateF32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildImmediateF64): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildGetLocal): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildGetGlobal): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildConvertType): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildLoad): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildStore): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildUnaryI32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildUnaryF32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildUnaryF64): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildBinaryI32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildBinaryF32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildBinaryF64): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildRelationalI32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildRelationalF32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildRelationalF64): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildMinOrMaxI32): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildMinOrMaxF64): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildCallInternal): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildCallIndirect): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildCallImport): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::appendExpressionList): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::discard): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::linkTarget): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::jumpToTarget): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::jumpToTargetIf): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::startLoop): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::endLoop): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::startSwitch): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::endSwitch): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::startLabel): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::endLabel): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::breakTarget): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::continueTarget): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::breakLabelTarget): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::continueLabelTarget): Deleted.
+        (JSC::WASMFunctionB3IRGenerator::buildSwitch): Deleted.
+        * wasm/WASMFunctionCompiler.h: Removed.
+        (JSC::operationConvertJSValueToInt32): Deleted.
+        (JSC::operationConvertJSValueToDouble): Deleted.
+        (JSC::operationDiv): Deleted.
+        (JSC::operationMod): Deleted.
+        (JSC::operationUnsignedDiv): Deleted.
+        (JSC::operationUnsignedMod): Deleted.
+        (JSC::operationConvertUnsignedInt32ToDouble): Deleted.
+        (JSC::sizeOfMemoryType): Deleted.
+        (JSC::WASMFunctionCompiler::MemoryAddress::MemoryAddress): Deleted.
+        (JSC::WASMFunctionCompiler::WASMFunctionCompiler): Deleted.
+        (JSC::WASMFunctionCompiler::startFunction): Deleted.
+        (JSC::WASMFunctionCompiler::endFunction): Deleted.
+        (JSC::WASMFunctionCompiler::buildSetLocal): Deleted.
+        (JSC::WASMFunctionCompiler::buildSetGlobal): Deleted.
+        (JSC::WASMFunctionCompiler::buildReturn): Deleted.
+        (JSC::WASMFunctionCompiler::buildImmediateI32): Deleted.
+        (JSC::WASMFunctionCompiler::buildImmediateF32): Deleted.
+        (JSC::WASMFunctionCompiler::buildImmediateF64): Deleted.
+        (JSC::WASMFunctionCompiler::buildGetLocal): Deleted.
+        (JSC::WASMFunctionCompiler::buildGetGlobal): Deleted.
+        (JSC::WASMFunctionCompiler::buildConvertType): Deleted.
+        (JSC::WASMFunctionCompiler::buildLoad): Deleted.
+        (JSC::WASMFunctionCompiler::buildStore): Deleted.
+        (JSC::WASMFunctionCompiler::buildUnaryI32): Deleted.
+        (JSC::WASMFunctionCompiler::buildUnaryF32): Deleted.
+        (JSC::WASMFunctionCompiler::buildUnaryF64): Deleted.
+        (JSC::WASMFunctionCompiler::buildBinaryI32): Deleted.
+        (JSC::WASMFunctionCompiler::buildBinaryF32): Deleted.
+        (JSC::WASMFunctionCompiler::buildBinaryF64): Deleted.
+        (JSC::WASMFunctionCompiler::buildRelationalI32): Deleted.
+        (JSC::WASMFunctionCompiler::buildRelationalF32): Deleted.
+        (JSC::WASMFunctionCompiler::buildRelationalF64): Deleted.
+        (JSC::WASMFunctionCompiler::buildMinOrMaxI32): Deleted.
+        (JSC::WASMFunctionCompiler::buildMinOrMaxF64): Deleted.
+        (JSC::WASMFunctionCompiler::buildCallInternal): Deleted.
+        (JSC::WASMFunctionCompiler::buildCallIndirect): Deleted.
+        (JSC::WASMFunctionCompiler::buildCallImport): Deleted.
+        (JSC::WASMFunctionCompiler::appendExpressionList): Deleted.
+        (JSC::WASMFunctionCompiler::discard): Deleted.
+        (JSC::WASMFunctionCompiler::linkTarget): Deleted.
+        (JSC::WASMFunctionCompiler::jumpToTarget): Deleted.
+        (JSC::WASMFunctionCompiler::jumpToTargetIf): Deleted.
+        (JSC::WASMFunctionCompiler::startLoop): Deleted.
+        (JSC::WASMFunctionCompiler::endLoop): Deleted.
+        (JSC::WASMFunctionCompiler::startSwitch): Deleted.
+        (JSC::WASMFunctionCompiler::endSwitch): Deleted.
+        (JSC::WASMFunctionCompiler::startLabel): Deleted.
+        (JSC::WASMFunctionCompiler::endLabel): Deleted.
+        (JSC::WASMFunctionCompiler::breakTarget): Deleted.
+        (JSC::WASMFunctionCompiler::continueTarget): Deleted.
+        (JSC::WASMFunctionCompiler::breakLabelTarget): Deleted.
+        (JSC::WASMFunctionCompiler::continueLabelTarget): Deleted.
+        (JSC::WASMFunctionCompiler::buildSwitch): Deleted.
+        (JSC::WASMFunctionCompiler::localAddress): Deleted.
+        (JSC::WASMFunctionCompiler::temporaryAddress): Deleted.
+        (JSC::WASMFunctionCompiler::appendCall): Deleted.
+        (JSC::WASMFunctionCompiler::appendCallWithExceptionCheck): Deleted.
+        (JSC::WASMFunctionCompiler::emitNakedCall): Deleted.
+        (JSC::WASMFunctionCompiler::appendCallSetResult): Deleted.
+        (JSC::WASMFunctionCompiler::callOperation): Deleted.
+        (JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer): Deleted.
+        (JSC::WASMFunctionCompiler::callAndUnboxResult): Deleted.
+        (JSC::WASMFunctionCompiler::convertValueToInt32): Deleted.
+        (JSC::WASMFunctionCompiler::convertValueToDouble): Deleted.
+        (JSC::WASMFunctionCompiler::convertDoubleToValue): Deleted.
+        * wasm/WASMFunctionParser.cpp: Removed.
+        (JSC::nameOfType): Deleted.
+        (JSC::WASMFunctionParser::checkSyntax): Deleted.
+        (JSC::WASMFunctionParser::compile): Deleted.
+        (JSC::WASMFunctionParser::parseFunction): Deleted.
+        (JSC::WASMFunctionParser::parseLocalVariables): Deleted.
+        (JSC::WASMFunctionParser::parseStatement): Deleted.
+        (JSC::WASMFunctionParser::parseReturnStatement): Deleted.
+        (JSC::WASMFunctionParser::parseBlockStatement): Deleted.
+        (JSC::WASMFunctionParser::parseIfStatement): Deleted.
+        (JSC::WASMFunctionParser::parseIfElseStatement): Deleted.
+        (JSC::WASMFunctionParser::parseWhileStatement): Deleted.
+        (JSC::WASMFunctionParser::parseDoStatement): Deleted.
+        (JSC::WASMFunctionParser::parseLabelStatement): Deleted.
+        (JSC::WASMFunctionParser::parseBreakStatement): Deleted.
+        (JSC::WASMFunctionParser::parseBreakLabelStatement): Deleted.
+        (JSC::WASMFunctionParser::parseContinueStatement): Deleted.
+        (JSC::WASMFunctionParser::parseContinueLabelStatement): Deleted.
+        (JSC::WASMFunctionParser::parseSwitchStatement): Deleted.
+        (JSC::WASMFunctionParser::parseExpression): Deleted.
+        (JSC::WASMFunctionParser::parseExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseImmediateExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseUnaryExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseBinaryExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseRelationalI32ExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseRelationalF32ExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseRelationalF64ExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseMinOrMaxExpressionI32): Deleted.
+        (JSC::WASMFunctionParser::parseExpressionF32): Deleted.
+        (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionF32): Deleted.
+        (JSC::WASMFunctionParser::parseImmediateExpressionF32): Deleted.
+        (JSC::WASMFunctionParser::parseUnaryExpressionF32): Deleted.
+        (JSC::WASMFunctionParser::parseBinaryExpressionF32): Deleted.
+        (JSC::WASMFunctionParser::parseExpressionF64): Deleted.
+        (JSC::WASMFunctionParser::parseConstantPoolIndexExpressionF64): Deleted.
+        (JSC::WASMFunctionParser::parseImmediateExpressionF64): Deleted.
+        (JSC::WASMFunctionParser::parseUnaryExpressionF64): Deleted.
+        (JSC::WASMFunctionParser::parseBinaryExpressionF64): Deleted.
+        (JSC::WASMFunctionParser::parseMinOrMaxExpressionF64): Deleted.
+        (JSC::WASMFunctionParser::parseExpressionVoid): Deleted.
+        (JSC::WASMFunctionParser::parseGetLocalExpression): Deleted.
+        (JSC::WASMFunctionParser::parseGetGlobalExpression): Deleted.
+        (JSC::WASMFunctionParser::parseSetLocal): Deleted.
+        (JSC::WASMFunctionParser::parseSetGlobal): Deleted.
+        (JSC::WASMFunctionParser::parseMemoryAddress): Deleted.
+        (JSC::WASMFunctionParser::parseLoad): Deleted.
+        (JSC::WASMFunctionParser::parseStore): Deleted.
+        (JSC::WASMFunctionParser::parseCallArguments): Deleted.
+        (JSC::WASMFunctionParser::parseCallInternal): Deleted.
+        (JSC::WASMFunctionParser::parseCallIndirect): Deleted.
+        (JSC::WASMFunctionParser::parseCallImport): Deleted.
+        (JSC::WASMFunctionParser::parseConditional): Deleted.
+        (JSC::WASMFunctionParser::parseComma): Deleted.
+        (JSC::WASMFunctionParser::parseConvertType): Deleted.
+        * wasm/WASMFunctionParser.h: Removed.
+        (JSC::WASMFunctionParser::WASMFunctionParser): Deleted.
+        * wasm/WASMFunctionSyntaxChecker.h: Removed.
+        (JSC::WASMFunctionSyntaxChecker::MemoryAddress::MemoryAddress): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::startFunction): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::endFunction): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildSetLocal): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildSetGlobal): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildReturn): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildImmediateI32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildImmediateF32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildImmediateF64): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildGetLocal): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildGetGlobal): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildConvertType): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildLoad): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildStore): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildUnaryI32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildUnaryF32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildUnaryF64): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildBinaryI32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildBinaryF32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildBinaryF64): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildRelationalI32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildRelationalF32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildRelationalF64): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildMinOrMaxI32): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildMinOrMaxF64): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildCallInternal): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildCallImport): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildCallIndirect): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::appendExpressionList): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::discard): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::linkTarget): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::jumpToTarget): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::jumpToTargetIf): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::startLoop): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::endLoop): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::startSwitch): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::endSwitch): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::startLabel): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::endLabel): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::breakTarget): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::continueTarget): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::breakLabelTarget): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::continueLabelTarget): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::buildSwitch): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::stackHeight): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::updateTempStackHeight): Deleted.
+        (JSC::WASMFunctionSyntaxChecker::updateTempStackHeightForCall): Deleted.
+        * wasm/WASMModuleParser.cpp: Removed.
+        (JSC::WASMModuleParser::WASMModuleParser): Deleted.
+        (JSC::WASMModuleParser::parse): Deleted.
+        (JSC::WASMModuleParser::parseModule): Deleted.
+        (JSC::WASMModuleParser::parseConstantPoolSection): Deleted.
+        (JSC::WASMModuleParser::parseSignatureSection): Deleted.
+        (JSC::WASMModuleParser::parseFunctionImportSection): Deleted.
+        (JSC::WASMModuleParser::parseGlobalSection): Deleted.
+        (JSC::WASMModuleParser::parseFunctionDeclarationSection): Deleted.
+        (JSC::WASMModuleParser::parseFunctionPointerTableSection): Deleted.
+        (JSC::WASMModuleParser::parseFunctionDefinitionSection): Deleted.
+        (JSC::WASMModuleParser::parseFunctionDefinition): Deleted.
+        (JSC::WASMModuleParser::parseExportSection): Deleted.
+        (JSC::WASMModuleParser::getImportedValue): Deleted.
+        (JSC::parseWebAssembly): Deleted.
+        * wasm/WASMModuleParser.h: Removed.
+        * wasm/WASMReader.cpp: Removed.
+        (JSC::WASMReader::readUInt32): Deleted.
+        (JSC::WASMReader::readFloat): Deleted.
+        (JSC::WASMReader::readDouble): Deleted.
+        (JSC::WASMReader::readCompactInt32): Deleted.
+        (JSC::WASMReader::readCompactUInt32): Deleted.
+        (JSC::WASMReader::readString): Deleted.
+        (JSC::WASMReader::readType): Deleted.
+        (JSC::WASMReader::readExpressionType): Deleted.
+        (JSC::WASMReader::readExportFormat): Deleted.
+        (JSC::WASMReader::readByte): Deleted.
+        (JSC::WASMReader::readOpStatement): Deleted.
+        (JSC::WASMReader::readOpExpressionI32): Deleted.
+        (JSC::WASMReader::readOpExpressionF32): Deleted.
+        (JSC::WASMReader::readOpExpressionF64): Deleted.
+        (JSC::WASMReader::readOpExpressionVoid): Deleted.
+        (JSC::WASMReader::readVariableTypes): Deleted.
+        (JSC::WASMReader::readOp): Deleted.
+        (JSC::WASMReader::readSwitchCase): Deleted.
+        * wasm/WASMReader.h: Removed.
+        (JSC::WASMReader::WASMReader): Deleted.
+        (JSC::WASMReader::offset): Deleted.
+        (JSC::WASMReader::setOffset): Deleted.
+
+2016-08-05  Keith Miller  <keith_miller@apple.com>
+
+        Fix 32-bit OverridesHasInstance in the DFG.
+        https://bugs.webkit.org/show_bug.cgi?id=160600
+
+        Reviewed by Mark Lam.
+
+        In https://trac.webkit.org/changeset/204140, we fixed an issue where the DFG might
+        do the wrong thing if it proved that the Symbol.hasInstance value for a constructor
+        was a constant late in compilation. That fix was ommited from the 32-bit version,
+        causing the new test to fail.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-08-04  Saam Barati  <sbarati@apple.com>
+
+        Restore CodeBlock jettison code to jettison when a CodeBlock has been alive for a long time
+        https://bugs.webkit.org/show_bug.cgi?id=151241
+
+        Reviewed by Benjamin Poulain.
+
+        This patch rolls back in the jettisoning policy from https://bugs.webkit.org/show_bug.cgi?id=149727.
+        We can now jettison a CodeBlock when it has been alive for a long time
+        and is only pointed to by its owner executable. I haven't been able to get this
+        patch to crash on anything it used to crash on, so I suspect we've fixed the bugs that
+        were causing this before. I've also added some stress options for this feature that
+        will cause us to either eagerly old-age jettison or to old-age jettison whenever it's legal.
+        These options helped me find a bug where we would ask an Executable to create a CodeBlock,
+        and then the Executable would do some other allocations, causing a GC, immediately causing
+        the CodeBlock to jettison. There is a small chance that this was the bug we were seeing before,
+        however, it's unlikely given that the previous timing metrics require at least 5 second between
+        compiling to jettisoning.
+
+        This patch also enables the stress options for various modes
+        of JSC stress tests.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference):
+        (JSC::timeToLive):
+        (JSC::CodeBlock::shouldJettisonDueToOldAge):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callee):
+        (JSC::ExecState::unsafeCallee):
+        (JSC::ExecState::codeBlock):
+        (JSC::ExecState::addressOfCodeBlock):
+        (JSC::ExecState::unsafeCodeBlock):
+        (JSC::ExecState::scope):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode):
+        (JSC::setupJIT):
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::prepareForExecution):
+        * runtime/Options.h:
+
+2016-08-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] JSModuleNamespaceObject's Symbol.iterator function should have name
+        https://bugs.webkit.org/show_bug.cgi?id=160549
+
+        Reviewed by Saam Barati.
+
+        ES6 Module's namespace[Symbol.iterator] function should have the name, "[Symbol.iterator]".
+
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::finishCreation):
+
+2016-08-04  Keith Miller  <keith_miller@apple.com>
+
+        ASSERTION FAILED: !hasInstanceValueNode->isCellConstant() || defaultHasInstanceFunction == hasInstanceValueNode->asCell()
+        https://bugs.webkit.org/show_bug.cgi?id=160562
+        <rdar://problem/27704825>
+
+        Reviewed by Mark Lam.
+
+        This patch fixes an issue where we would emit incorrect code in the DFG when constant folding would
+        convert a GetByOffset into a constant late in compilation. Additionally, it removes invalid assertions
+        associated with the assumption that this could not happen.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance): Deleted.
+
+2016-08-04  Keith Miller  <keith_miller@apple.com>
+
+        Remove unused intrinsic member of NativeExecutable
+        https://bugs.webkit.org/show_bug.cgi?id=160560
+
+        Reviewed by Saam Barati.
+
+        NativeExecutable has an Intrinsic member. It appears that this member is never
+        used. Instead we use the Intrinsic member NativeExecutable's super class,
+        ExecutableBase.
+
+        * runtime/Executable.h:
+
+2016-08-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Speed up InPlaceAbstractState::endBasicBlock()
+        https://bugs.webkit.org/show_bug.cgi?id=160539
+
+        Reviewed by Mark Lam.
+
+        This patch does small improvements to our handling
+        of value propagation to the successors.
+
+        One key insight is that using HashMap to map Nodes
+        to Value in valuesAtTail is too inefficient at the scale
+        we use it. Instead, I reuse our existing mapping
+        from every Node to its value, abstracted by forNode().
+
+        Since we are not going to use the mapping after endBasicBlock()
+        I can replace whatever we had there. The next beginBasicBlock()
+        will setup the new value as needed.
+
+        In endBasicBlock(), valuesAtTail is now a vector of all values live
+        at tail. For each node, I merge the previous live at tail with
+        the new value, then replace the value in the mapping.
+        Liveness Analysis guarantees we won't have duplicates there which
+        make the replacement sound.
+
+        Next, when propagating, I take the vector of values lives at head
+        and use the global node->value mapping to find its new abstract value.
+        Again, Liveness Analysis guarantees I won't find a value live at head
+        that was not replaced by the merging at tail of the predecessor.
+
+        All our live lists have become vectors instead of HashTable.
+        The mapping from Node to Value is always done by array indexing.
+        Same big-O, much smaller constant.
+
+        * dfg/DFGAtTailAbstractState.cpp:
+        (JSC::DFG::AtTailAbstractState::AtTailAbstractState):
+        (JSC::DFG::AtTailAbstractState::createValueForNode):
+        (JSC::DFG::AtTailAbstractState::forNode):
+        * dfg/DFGAtTailAbstractState.h:
+        I did not look much into this state, I just made it equivalent
+        to the previous mapping.
+
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+
+        (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
+        AbstractValue is big enough that we really don't want to copy it twice.
+
+        (JSC::DFG::InPlaceAbstractState::merge):
+        (JSC::DFG::setLiveValues): Deleted.
+        * dfg/DFGInPlaceAbstractState.h:
+
+        * dfg/DFGPhiChildren.h:
+        This is heap allocated by AbstractInterpreter. It should use fastMalloc().
+
+2016-08-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES7] Update features.json for exponentiation expression
+        https://bugs.webkit.org/show_bug.cgi?id=160541
+
+        Reviewed by Mark Lam.
+
+        * features.json:
+
+2016-08-03  Chris Dumez  <cdumez@apple.com>
+
+        Drop DocumentType.internalSubset attribute
+        https://bugs.webkit.org/show_bug.cgi?id=160530
+
+        Reviewed by Alex Christensen.
+
+        Drop DocumentType.internalSubset attribute.
+
+        * inspector/protocol/DOM.json:
+
+2016-08-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve the memory locality of DFG Node's AbstractValues
+        https://bugs.webkit.org/show_bug.cgi?id=160443
+
+        Reviewed by Mark Lam.
+
+        The AbstractInterpreter spends a lot of time on memory operations
+        for AbstractValues. This patch attempts to improve the situation
+        by putting the values closer together in memory.
+
+        First, AbstractValue is moved out of DFG::Node and it kept in
+        a vector addressed by node indices.
+
+        I initially moved them to InPlaceAbstractState but I quickly discovered
+        initializing the values in the vector was costly.
+        I moved the vector to Graph as a cache shared by every instantiation of
+        InPlaceAbstractState. It is mainly there to avoid constructors and destructors
+        of AbstractValue. The patch of https://bugs.webkit.org/show_bug.cgi?id=160370
+        should also help eventually.
+
+        I instrumented CFA to find how packed is SparseCollection.
+        The answer is it can be very sparse, which is bad for CFA.
+        I added packIndices() to repack the collection before running
+        liveness since that's where we start using the memory intensively.
+        This is a measurable improvement but it implies we can no longer
+        keep indices on a side channel between phases since they may change.
+
+        * b3/B3SparseCollection.h:
+        (JSC::B3::SparseCollection::packIndices):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::packNodeIndices):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::abstractValuesCache):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::InPlaceAbstractState):
+        * dfg/DFGInPlaceAbstractState.h:
+        (JSC::DFG::InPlaceAbstractState::forNode):
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::performLivenessAnalysis):
+        * dfg/DFGNode.h:
+
+2016-08-03  Caitlin Potter  <caitp@igalia.com>
+
+        Clarify SyntaxErrors around yield and unskip tests
+        https://bugs.webkit.org/show_bug.cgi?id=158460
+
+        Reviewed by Saam Barati.
+
+        Fix and unskip tests which erroneously asserted that `yield` is not a
+        valid BindingIdentifier, and improve error message for YieldExpressions
+        occuring in Arrow formal parameters.
+
+        * parser/Parser.cpp:
+        (JSC::Scope::MaybeParseAsGeneratorForScope::MaybeParseAsGeneratorForScope):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseYieldExpression):
+        * parser/Parser.h:
+
+2016-08-03  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r203368): broke some test262 tests
+        https://bugs.webkit.org/show_bug.cgi?id=160479
+
+        Reviewed by Mark Lam.
+        
+        The optimization in r203368 overlooked a subtle detail: freezing should not set ReadOnly on
+        Accessor properties.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::nonPropertyTransition):
+        * runtime/StructureTransitionTable.h:
+        (JSC::setsDontDeleteOnAllProperties):
+        (JSC::setsReadOnlyOnNonAccessorProperties):
+        (JSC::setsReadOnlyOnAllProperties): Deleted.
+
+2016-08-03  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Lacking support on a arm-traditional disassembler.
+        https://bugs.webkit.org/show_bug.cgi?id=123717
+
+        Reviewed by Mark Lam.
+
+        * CMakeLists.txt:
+        * disassembler/ARMLLVMDisassembler.cpp: Added, based on pre r196729 LLVMDisassembler, but it is ARM traditional only now.
+        (JSC::tryToDisassemble):
+
+2016-08-03  Saam Barati  <sbarati@apple.com>
+
+        Implement nested rest destructuring w.r.t the ES7 spec
+        https://bugs.webkit.org/show_bug.cgi?id=160423
+
+        Reviewed by Filip Pizlo.
+
+        The spec has updated the BindingRestElement grammar production to be:
+        BindingRestElement:
+           BindingIdentifier
+           BindingingPattern.
+
+        It used to only allow BindingIdentifier in the grammar production.
+        I've updated our engine to account for this. The semantics are exactly
+        what you'd expect.  For example:
+        `let [a, ...[b, ...c]] = expr();`
+        means that we create an array for the first rest element `...[b, ...c]`
+        and then perform the binding of `[b, ...c]` to that array. And so on, 
+        applied recursively through the pattern.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RestParameterNode::collectBoundIdentifiers):
+        (JSC::RestParameterNode::toString):
+        (JSC::RestParameterNode::bindValue):
+        (JSC::RestParameterNode::emit):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createBindingLocation):
+        (JSC::ASTBuilder::createRestParameter):
+        (JSC::ASTBuilder::createAssignmentElement):
+        * parser/NodeConstructors.h:
+        (JSC::AssignmentElementNode::AssignmentElementNode):
+        (JSC::RestParameterNode::RestParameterNode):
+        (JSC::DestructuringAssignmentNode::DestructuringAssignmentNode):
+        * parser/Nodes.h:
+        (JSC::RestParameterNode::name): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2016-08-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Fix Windows build after r204065
+
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::observeTransitions):
+        AbstractValue is bigger on Windows for an unknown reason.
+
+2016-08-02  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Fix 32bits jsc after r204065
+
+        Default constructed JSValue() are not equal to zero in 32bits.
+
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::AbstractValue):
+
+2016-08-02  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Simplify the initialization of AbstractValue in the AbstractInterpreter
+        https://bugs.webkit.org/show_bug.cgi?id=160370
+
+        Reviewed by Saam Barati.
+
+        We use a ton of AbstractValue to run the Abstract Interpreter.
+
+        When we set up the initial values, the compiler sets
+        a zero on a first word, a one on a second word, and a zero
+        again on a third word.
+        Since no vector or double-store can deal with 3 words, unrolling
+        is done by repeating those instructions.
+
+        The reason for the one was TinyPtrSet. It needed a flag for
+        empty value to identify the set as thin. I flipped the flag to "fat"
+        to make sure TinyPtrSet is initialized to zero.
+
+        With that done, I just had to clean some places to make
+        the initialization shorter.
+        It makes the binary easier to follow but this does not help with
+        the bigger problem: the time spent per block on Abstract Interpreter.
+
+        * bytecode/Operands.h:
+        The traits were useless, no client code defines it.
+
+        (JSC::Operands::Operands):
+        (JSC::Operands::ensureLocals):
+        Because of the size of the function, llvm is not inlining it.
+        We were literally loading 3 registers from memory and storing
+        them in the vector.
+        Now that AbstractValue has a VectorTraits, we should just rely
+        on the memset of Vector when possible.
+
+        (JSC::Operands::getLocal):
+        (JSC::Operands::setArgumentFirstTime):
+        (JSC::Operands::setLocalFirstTime):
+        (JSC::Operands::clear):
+        (JSC::OperandValueTraits::defaultValue): Deleted.
+        (JSC::OperandValueTraits::isEmptyForDump): Deleted.
+        * bytecode/OperandsInlines.h:
+        (JSC::Operands<T>::dumpInContext):
+        (JSC::Operands<T>::dump):
+        (JSC::Traits>::dumpInContext): Deleted.
+        (JSC::Traits>::dump): Deleted.
+        * dfg/DFGAbstractValue.cpp:
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::AbstractValue):
+
+2016-08-02  Saam Barati  <sbarati@apple.com>
+
+        update a class extending null w.r.t the ES7 spec
+        https://bugs.webkit.org/show_bug.cgi?id=160417
+
+        Reviewed by Keith Miller.
+
+        When a class extends null, it should not be marked as a derived class.
+        This was changed in the ES2016 spec, and this patch makes the needed
+        changes in JSC to follow the spec. This allows classes to extend
+        null and have their default constructor invoked without throwing an exception.
+        This also prevents |this| from being under TDZ at the start of the constructor.
+        Because ES6 allows arbitrary expressions in the `class <ident> extends <expr>`
+        syntax, we don't know statically if a constructor is extending null or not.
+        Therefore, we don't always know statically if it's a base or derived constructor.
+        I solved this by putting a boolean on the constructor function under a private
+        symbol named isDerivedConstructor when doing class construction. We only need
+        to put this boolean on constructors that may extend null. Constructors that are
+        declared in a class with no extends syntax can tell statically that they are a base constructor.
+
+        I've also renamed the ConstructorKind::Derived enum value to be
+        ConstructorKind::Extends to better indicate that we can't answer
+        the "am I a derived constructor?" question statically.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor):
+        * builtins/BuiltinNames.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::ensureThis):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        (JSC::ClassExprNode::emitBytecode):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/ParserModes.h:
+
+2016-08-02  Enrica Casucci  <enrica@apple.com>
+
+        Allow building with content filtering disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=160454
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-08-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Disable Inline Caching on ARMv7 traditional until proper fix
+        https://bugs.webkit.org/show_bug.cgi?id=159759
+
+        Reviewed by Saam Barati.
+
+        * jit/JITMathIC.h:
+        (JSC::JITMathIC::generateInline):
+
+2016-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r203990): JSC Debug test stress/arity-check-ftl-throw.js failing
+        https://bugs.webkit.org/show_bug.cgi?id=160438
+
+        Reviewed by Mark Lam.
+        
+        In r203990 I fixed a bug where CommonSlowPaths.h/arityCheckFor() was basically failing at
+        catching stack overflow due to large parameter count. It would only catch regular old stack
+        overflow, like if the frame pointer was already past the limit.
+        
+        This had a secondary problem: unfortunately all of our tests for what happens when you overflow
+        the stack due to large parameter count were not going down that path at all, so we haven't had
+        test coverage for this in ages.  There were bugs in all tiers of the engine when handling this
+        case.
+
+        We need to be able to roll back the topCallFrame on paths that are meant to throw an exception
+        from the caller. Otherwise, we'd crash in StackVisitor because it would see a busted stack
+        frame. Rolling back like this "just works" except when the caller is the VM entry frame. I had
+        some choices here. I could have forced anyone who is rolling back to always skip VM entry
+        frames. They can't do it in a way that changes the value of VM::topVMEntryFrame, which is what
+        a stack frame roll back normally does, since exception unwinding needs to see the current value
+        of topVMEntryFrame. So, we have a choice to either try to magically avoid all of the paths that
+        look at topCallFrame, or give topCallFrame a state that unambiguously signals that we are
+        sitting right on top of a VM entry frame without having succeeded at making a JS call. The only
+        place that really needs to know is StackVisitor, which wants to start scanning at topCallFrame.
+        To signal this, I could have either made topCallFrame point to the real top JS call frame
+        without also rolling back topVMEntryFrame, or I could make topCallFrame == topVMEntryFrame. The
+        latter felt somehow cleaner. I filed a bug (https://bugs.webkit.org/show_bug.cgi?id=160441) for
+        converting topCallFrame to a void*, which would give us a chance to harden the rest of the
+        engine against this case.
+        
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::StackVisitor):
+        We may do ShadowChicken processing, which invokes StackVisitor, when we have topCallFrame
+        pointing at topVMEntryFrame. This teaches StackVisitor how to handle this case. I believe that
+        StackVisitor is the only place that needs to be taught about this at this time, because it's
+        one of the few things that access topCallFrame along this special path.
+        
+        * jit/JITOperations.cpp: Roll back the top call frame.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL): Roll back the top call frame.
+
+2016-08-01  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC][ARM64] Fix branchTest32/64 taking an immediate as mask
+        https://bugs.webkit.org/show_bug.cgi?id=160439
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branchTest64):
+        * b3/air/AirOpcode.opcodes:
+        Fix the ARM64 codegen to lower BitImm64 without using a scratch register.
+
+2016-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        [B3] Fusing immediates into test instructions should work again
+        https://bugs.webkit.org/show_bug.cgi?id=160073
+
+        Reviewed by Sam Weinig.
+
+        When we introduced BitImm, we forgot to change the Branch(BitAnd(value, constant))
+        fusion.  This emits test instructions, so it should use BitImm for the constant.  But it
+        was still using Imm!  This meant that isValidForm() always returned false.
+        
+        This fixes the code path to use BitImm, and turns off our use of BitImm64 on x86 since
+        it provides no benefit on x86 and has some risk (the code appears to play fast and loose
+        with the scratch register).
+        
+        This is not an obvious progression on anything, so I added comprehensive tests to
+        testb3, which check that we selected the optimal instruction in a variety of situations.
+        We should add more tests like this!
+
+        Rolling this back in after fixing ARM64. The bug was that branchTest32|64 on ARM64 doesn't
+        actually support BitImm or BitImm64, at least not yet. Disabling that in AirOpcodes makes
+        this patch not a regression on ARM64. That change was reviewed by Benjamin Poulain.
+
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::successorBlock):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        * b3/B3LowerToAir.h:
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::usesTmp):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::castToType):
+        (JSC::B3::Air::Arg::asNumber):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::size):
+        (JSC::B3::Air::Code::at):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirValidate.h:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (JSC::B3::compile):
+        (JSC::B3::compileAndRun):
+        (JSC::B3::lowerToAirForTesting):
+        (JSC::B3::testSomeEarlyRegister):
+        (JSC::B3::testBranchBitAndImmFusion):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+
+2016-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize varargs stack overflow checks
+        https://bugs.webkit.org/show_bug.cgi?id=160425
+
+        Reviewed by Michael Saboff.
+
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link): AboveOrEqual 0 is a tautology. The code meant GreaterThanOrEqual, since the error code is -1.
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor): Use roundUpToMultipleOf(), which is almost certainly what we meant when we said %.
+
+2016-08-01  Saam Barati  <sbarati@apple.com>
+
+        Sub should be a Math IC
+        https://bugs.webkit.org/show_bug.cgi?id=160270
+
+        Reviewed by Mark Lam.
+
+        This makes Sub an IC like Mul and Add. I'm seeing the following
+        improvements of average Sub size on Unity and JetStream:
+
+                   |   JetStream  |  Unity 3D  |
+             ------| -------------|--------------
+              Old  |   202 bytes  |  205 bytes |
+             ------| -------------|--------------
+              New  |   134  bytes |  134 bytes |
+             ------------------------------------
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::addJITMulIC):
+        (JSC::CodeBlock::addJITSubIC):
+        (JSC::CodeBlock::findStubInfo):
+        (JSC::CodeBlock::dumpMathICStats):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::stubInfoBegin):
+        (JSC::CodeBlock::stubInfoEnd):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithAddOrSub):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        (JSC::JIT::emit_op_pow):
+        * jit/JITMathIC.h:
+        * jit/JITMathICForwards.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITSubGenerator.cpp:
+        (JSC::JITSubGenerator::generateInline):
+        (JSC::JITSubGenerator::generateFastPath):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::JITSubGenerator):
+        (JSC::JITSubGenerator::isLeftOperandValidConstant):
+        (JSC::JITSubGenerator::isRightOperandValidConstant):
+        (JSC::JITSubGenerator::arithProfile):
+        (JSC::JITSubGenerator::didEmitFastPath): Deleted.
+        (JSC::JITSubGenerator::endJumpList): Deleted.
+        (JSC::JITSubGenerator::slowPathJumpList): Deleted.
+
+2016-08-01  Keith Miller  <keith_miller@apple.com>
+
+        We should not keep the JavaScript tests inside the Source/JavaScriptCore/ directory.
+        https://bugs.webkit.org/show_bug.cgi?id=160372
+
+        Rubber stamped by Geoffrey Garen.
+
+        This patch moves all the JavaScript tests from Source/JavaScriptCore/tests to
+        a new top level directory, JSTests. Having the tests in the Source directory
+        was both confusing an inconvenient for people that just want to checkout the
+        source code of WebKit. Since there is no other obvious place to put all the
+        JavaScript tests a new top level directory seemed the most sensible.
+
+        * tests/: Deleted.
+
+2016-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Should check Test262Error correctly
+        https://bugs.webkit.org/show_bug.cgi?id=159862
+
+        Reviewed by Saam Barati.
+
+        Test262Error in the harness does not have "name" property.
+        Rather than checking "name" property, peforming `instanceof` is better to check the class of the exception.
+
+        * jsc.cpp:
+        (checkUncaughtException):
+        * runtime/JSObject.h:
+        * tests/test262.yaml:
+
+2016-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Module binding can be exported by multiple names
+        https://bugs.webkit.org/show_bug.cgi?id=160343
+
+        Reviewed by Saam Barati.
+
+        ES6 Module can export the same local binding by using multiple names.
+        For example,
+
+            ```
+            var value = 42;
+
+            export { value };
+            export { value as value2 };
+            ```
+
+        Currently, we only allowed one local binding to be exported with one name. So, in the above case,
+        the local binding "value" is exported as "value2" and "value" name is not exported. This is wrong.
+
+        To fix this issue, we collect the correspondence (local name => exported name) to the local bindings
+        in the parser. Previously, we only maintained the exported local bindings in the parser. And utilize
+        this information when creating the export entries in ModuleAnalyzer.
+
+        And this patch also moves ModuleScopeData from the Scope object to the Parser class since exported
+        names should be managed per-module, not per-scope.
+
+        This change fixes several test262 failures.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::exportVariable):
+        (JSC::ModuleAnalyzer::analyze):
+        (JSC::ModuleAnalyzer::exportedBinding): Deleted.
+        (JSC::ModuleAnalyzer::declareExportAlias): Deleted.
+        * parser/ModuleAnalyzer.h:
+        * parser/ModuleScopeData.h: Copied from Source/JavaScriptCore/parser/ModuleAnalyzer.h.
+        (JSC::ModuleScopeData::create):
+        (JSC::ModuleScopeData::exportedBindings):
+        (JSC::ModuleScopeData::exportName):
+        (JSC::ModuleScopeData::exportBinding):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ModuleProgramNode::ModuleProgramNode):
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionNode::FunctionNode):
+        * parser/Nodes.h:
+        (JSC::ModuleProgramNode::moduleScopeData):
+        * parser/NodesAnalyzeModule.cpp:
+        (JSC::ExportDefaultDeclarationNode::analyzeModule):
+        (JSC::ExportNamedDeclarationNode::analyzeModule): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseModuleSourceElements):
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClassDeclaration):
+        (JSC::Parser<LexerType>::parseExportSpecifier):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        * parser/Parser.h:
+        (JSC::Parser::exportName):
+        (JSC::Parser<LexerType>::parse):
+        (JSC::ModuleScopeData::create): Deleted.
+        (JSC::ModuleScopeData::exportedBindings): Deleted.
+        (JSC::ModuleScopeData::exportName): Deleted.
+        (JSC::ModuleScopeData::exportBinding): Deleted.
+        (JSC::Scope::Scope): Deleted.
+        (JSC::Scope::setSourceParseMode): Deleted.
+        (JSC::Scope::moduleScopeData): Deleted.
+        (JSC::Scope::setIsModule): Deleted.
+        * tests/modules/aliased-names.js: Added.
+        * tests/modules/aliased-names/main.js: Added.
+        (change):
+        * tests/stress/modules-syntax-error-with-names.js:
+        (export.Cocoa):
+        (SyntaxError.Cannot.export.a.duplicate.name):
+        * tests/test262.yaml:
+
+2016-07-30  Mark Lam  <mark.lam@apple.com>
+
+        Assertion failure while setting the length of an ArrayClass array.
+        https://bugs.webkit.org/show_bug.cgi?id=160381
+        <rdar://problem/27328703>
+
+        Reviewed by Filip Pizlo.
+
+        When setting large length values, we're currently treating ArrayClass as a
+        ContiguousIndexingType array.  This results in an assertion failure.  This is
+        now fixed.
+
+        There are currently only 2 places where we create arrays with indexing type
+        ArrayClass: ArrayPrototype and RuntimeArray.  The fix in JSArray:;setLength()
+        takes care of ArrayPrototype.
+
+        RuntimeArray already checks for the setting of its length property, and will
+        throw a RangeError.  Hence, there's no change is needed for the RuntimeArray.
+        Instead, I added some test cases ensure that the check and throw behavior does
+        not change without notice.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+        * tests/stress/array-setLength-on-ArrayClass-with-large-length.js: Added.
+        (toString):
+        (assertEqual):
+        * tests/stress/array-setLength-on-ArrayClass-with-small-length.js: Added.
+        (toString):
+        (assertEqual):
+
+2016-07-29  Keith Miller  <keith_miller@apple.com>
+
+        TypedArray super constructor has some incompatabilities
+        https://bugs.webkit.org/show_bug.cgi?id=160369
+
+        Reviewed by Filip Pizlo.
+
+        This patch fixes the length proprety of the TypedArray super constructor.
+        Additionally, the TypedArray super constructor should no longer be callable.
+
+        Also, this patch fixes the expected result of some test262 tests.
+
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::JSTypedArrayViewConstructor::finishCreation):
+        (JSC::constructTypedArrayView):
+        (JSC::JSTypedArrayViewConstructor::getCallData):
+        * tests/test262.yaml:
+
+2016-07-29  Jonathan Bedard  <jbedard@apple.com>
+
+        Undefined Behavior in JSValue cast from NaN
+        https://bugs.webkit.org/show_bug.cgi?id=160322
+
+        Reviewed by Mark Lam.
+
+        JSValues can be constructed from doubles, and in some cases, are deliberately constructed with NaN values.
+
+        In circumstances where NaN is bound through the default JSValue constructor, however, an undefined conversion
+        to int32_t occurs.  While the subsequent if statement should fail and construct the JSValue through the explicit
+        double constructor, given that the deliberate use of NaN is fairly common, it seems that the jsNaN() function
+        should immediately call the explicit double constructor both for efficiency and to prevent inadvertent
+        suppressing of any other bugs which may be instantiating a JSValue with a NaN double.
+
+        * runtime/JSCJSValueInlines.h:
+        (JSC::jsNaN): Explicit double construction for NaN JSValues to avoid undefined behavior.
+
+2016-07-29  Michael Saboff  <msaboff@apple.com>
+
+        Refactor DFG::Node::hasLocal() to accessesStack()
+        https://bugs.webkit.org/show_bug.cgi?id=160357
+
+        Reviewed by Filip Pizlo.
+
+        Refactoring in preparation for using register arguments for JavaScript calls.
+
+        Renamed Node::hasLocal() to Node::accessesStack() and changed all uses accordingly.
+        Also changed uses of Node::hasVariableAccessData() to accessesStack() where that
+        use guards stack operation logic associated with the Node's VariableAccessData.
+
+        The hasVariableAccessData() check now implies no more than the node has a
+        VariableAccessData and nothing about its use of that data to coordinate stack   
+        accesses.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp:
+        (JSC::DFG::LiveCatchVariablePreservationPhase::handleBlock):
+        * dfg/DFGMaximalFlushInsertionPhase.cpp:
+        (JSC::DFG::MaximalFlushInsertionPhase::treatRegularBlock):
+        (JSC::DFG::MaximalFlushInsertionPhase::treatRootBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::containsMovHint):
+        (JSC::DFG::Node::accessesStack):
+        (JSC::DFG::Node::hasLocal): Deleted.
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::PredictionInjectionPhase::run):
+        * dfg/DFGValidate.cpp:
+
+2016-07-29  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Use the same data structures for DFG and Air Liveness Analysis
+        https://bugs.webkit.org/show_bug.cgi?id=160346
+
+        Reviewed by Geoffrey Garen.
+
+        In Air, we minimized memory accesses during liveness analysis
+        with a couple of tricks:
+        -Use a single Sparse Set ADT for the live value of each block.
+        -Manipulate compact positive indices instead of hashing values.
+
+        This patch brings the same ideas to DFG.
+
+        This patch still uses the same fixpoint algorithms.
+        The reason is Edge's KillStatus used by other phases. We cannot
+        use a block-boundary liveness algorithm and update KillStatus
+        simultaneously. It's something I'll probably revisit at some point.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::maxNodeCount):
+        (JSC::DFG::Graph::nodeAt):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::setLiveValues):
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::LivenessAnalysisPhase::LivenessAnalysisPhase):
+        (JSC::DFG::LivenessAnalysisPhase::run):
+        (JSC::DFG::LivenessAnalysisPhase::processBlock):
+        (JSC::DFG::LivenessAnalysisPhase::addChildUse):
+        (JSC::DFG::LivenessAnalysisPhase::process): Deleted.
+
+2016-07-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, ByValInfo is only used in JIT enabled environments
+        https://bugs.webkit.org/show_bug.cgi?id=158908
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+
+2016-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        JSC::Symbol should be hash-consed
+        https://bugs.webkit.org/show_bug.cgi?id=158908
+
+        Reviewed by Filip Pizlo.
+
+        Previously, SymbolImpls held by symbols represent identity of symbols.
+        When we check the equality between symbols, we need to load SymbolImpls of symbols and compare them.
+
+        This patch performs hash-consing onto the symbols. We cache symbols in per-VM's SymbolImpl-keyed WeakGCMap.
+        When creating a new symbol from SymbolImpl, we first query to this map and reuse the previously created symbol
+        if it is found. This ensures that one-on-one correspondence between SymbolImpl and symbol. So now, we can use
+        pointer-comparison to query the equality of symbols.
+
+        This change drops SymbolImpl loads when checking the equality. Furthermore, we can use DFG CheckCell to symbol
+        when we would like to ensure that the given value is the expected symbol. This cleans up GetByVal's symbol-keyd
+        caching. Then, we changed CheckIdent to CheckStringIdent since it only checks the string case now. The symbol
+        case is handled by CheckCell.
+
+        Additionally, this patch also cleans up Map / Set implementation since we can use the logic for JSCell to symbols.
+
+        The performance effects in the related benchmarks are the followings.
+
+                                                               baseline                   patch
+
+            bigswitch-indirect-symbol-or-undefined         85.6214+-1.0063     ^     63.0522+-0.8615        ^ definitely 1.3579x faster
+            bigswitch-indirect-symbol                      84.9653+-0.6258     ^     80.4900+-0.8008        ^ definitely 1.0556x faster
+            fold-put-by-val-with-symbol-to-multi-put-by-offset
+                                                            9.4396+-0.3726            9.2941+-0.3311          might be 1.0157x faster
+            inlined-put-by-val-with-symbol-transition
+                                                           49.5477+-0.2401     ?     49.7533+-0.3369        ?
+            get-by-val-with-symbol-self-or-proto           11.9740+-0.0798     ?     12.1706+-0.2723        ? might be 1.0164x slower
+            get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple
+                                                            4.1364+-0.0841            4.0872+-0.0925          might be 1.0120x faster
+            put-by-val-with-symbol                         11.3709+-0.0223           11.3613+-0.0264
+            get-by-val-with-symbol-proto-or-self           11.8984+-0.0706     ?     11.9030+-0.0787        ?
+            polymorphic-put-by-val-with-symbol             31.4176+-0.0558           31.3825+-0.0447
+            implicit-bigswitch-indirect-symbol             61.3115+-0.6577     ^     58.0098+-0.1212        ^ definitely 1.0569x faster
+            get-by-val-with-symbol-bimorphic-check-structure-elimination-simple
+                                                            3.3139+-0.0565     ^      2.9947+-0.0732        ^ definitely 1.1066x faster
+            get-by-val-with-symbol-chain-from-try-block
+                                                            2.2316+-0.0179            2.2137+-0.0210
+            get-by-val-with-symbol-bimorphic-check-structure-elimination
+                                                           10.6031+-0.2216     ^     10.0939+-0.1977        ^ definitely 1.0504x faster
+            get-by-val-with-symbol-check-structure-elimination
+                                                            8.5576+-0.1521     ^      7.7107+-0.1308        ^ definitely 1.1098x faster
+            put-by-val-with-symbol-slightly-polymorphic
+                                                            3.1957+-0.0538     ^      2.9181+-0.0708        ^ definitely 1.0951x faster
+            put-by-val-with-symbol-replace-and-transition
+                                                           11.8253+-0.0757     ^     11.6590+-0.0351        ^ definitely 1.0143x faster
+
+            <geometric>                                    13.3911+-0.0527     ^     12.7376+-0.0457        ^ definitely 1.0513x faster
+
+        * bytecode/ByValInfo.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasUidOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSymbolEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleSymbolEquality):
+        (JSC::DFG::SpeculativeJIT::compileCheckStringIdent):
+        (JSC::DFG::SpeculativeJIT::extractStringImplFromBinarySymbols): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileSymbolUntypedEquality): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSymbolUntypedEquality):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSymbolUntypedEquality):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckStringIdent):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckIdent): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::lowSymbolUID): Deleted.
+        * jit/JIT.h:
+        * jit/JITOperations.cpp:
+        (JSC::tryGetByValOptimize):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitPutByValWithCachedId):
+        (JSC::JIT::emitByValIdentifierCheck):
+        (JSC::JIT::privateCompileGetByValWithCachedId):
+        (JSC::JIT::privateCompilePutByValWithCachedId):
+        (JSC::JIT::emitIdentifierCheck): Deleted.
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emitPutByValWithCachedId):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpInContextAssumingStructure):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqualSlowCaseInline): Deleted.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::setFunctionName):
+        * runtime/MapData.h:
+        * runtime/MapDataInlines.h:
+        (JSC::JSIterator>::clear): Deleted.
+        (JSC::JSIterator>::find): Deleted.
+        (JSC::JSIterator>::add): Deleted.
+        (JSC::JSIterator>::remove): Deleted.
+        (JSC::JSIterator>::replaceAndPackBackingStore): Deleted.
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::finishCreation):
+        (JSC::Symbol::create):
+        * runtime/Symbol.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * tests/stress/symbol-equality-over-gc.js: Added.
+        (shouldBe):
+        (test):
+
+2016-07-28  Mark Lam  <mark.lam@apple.com>
+
+        ASSERTION FAILED in errorProtoFuncToString() when Error name is a single char string.
+        https://bugs.webkit.org/show_bug.cgi?id=160324
+        <rdar://problem/27389572>
+
+        Reviewed by Keith Miller.
+
+        The issue is that errorProtoFuncToString() was using jsNontrivialString() to
+        generate the error string even when the name string can be a single character
+        string.  This is incorrect.  We should be using jsString() instead.
+
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * tests/stress/errors-with-simple-names-or-messages-should-not-crash-toString.js: Added.
+
+2016-07-28  Michael Saboff  <msaboff@apple.com>
+
+        ARM64: Fused left shift with a right shift can create NaNs from integers
+        https://bugs.webkit.org/show_bug.cgi?id=160329
+
+        Reviewed by Geoffrey Garen.
+
+        When we fuse a left shift and a right shift of integers where the shift amounts
+        are the same and the size of the quantity being shifted is 8 bits, we rightly
+        generate a sign extend byte instruction.  On ARM64, we were sign extending
+        to a 64 bit quantity, when we really wanted to sign extend to a 32 bit quantity.
+
+        Checking the ARM64 marco assembler and we were extending to 64 bits for all
+        four combinations of zero / sign and 8 / 16 bits.
+        
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::zeroExtend16To32):
+        (JSC::MacroAssemblerARM64::signExtend16To32):
+        (JSC::MacroAssemblerARM64::zeroExtend8To32):
+        (JSC::MacroAssemblerARM64::signExtend8To32):
+        * tests/stress/regress-160329.js: New test added.
+        (narrow):
+
+2016-07-28  Mark Lam  <mark.lam@apple.com>
+
+        StringView should have an explicit m_is8Bit field.
+        https://bugs.webkit.org/show_bug.cgi?id=160282
+        <rdar://problem/27327943>
+
+        Reviewed by Benjamin Poulain.
+
+        * tests/stress/string-joining-long-strings-should-not-crash.js: Added.
+        (catch):
+
+2016-07-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Typo fix after r121885
+        https://bugs.webkit.org/show_bug.cgi?id=160288
+
+        Reviewed by Zoltan Herczeg.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::maxJumpReplacementSize):
+
+2016-07-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        64-bit alignment check isn't necessary in ARMAssembler::prepareExecutableCopy after r202214
+        https://bugs.webkit.org/show_bug.cgi?id=159711
+
+        Reviewed by Mark Lam.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::prepareExecutableCopy):
+
+2016-07-27  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove some unused code from FTL
+        https://bugs.webkit.org/show_bug.cgi?id=160285
+
+        Reviewed by Mark Lam.
+
+        All the liveness and swapping is done inside B3,
+        this code is no longer needed.
+
+        * dfg/DFGEdge.h:
+        (JSC::DFG::Edge::doesNotKill): Deleted.
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::doesKill): Deleted.
+
+2016-07-27  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] DFG::Node should not have its own allocator
+        https://bugs.webkit.org/show_bug.cgi?id=160098
+
+        Reviewed by Geoffrey Garen.
+
+        We need some design changes for DFG::Node:
+        -Accessing the index must be fast. B3 uses indices for sets
+         and maps, it is a lot faster than hashing pointers.
+        -We should be able to subclass DFG::Node to specialize it.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAllocator.h: Removed.
+        (JSC::DFG::Allocator::Region::size): Deleted.
+        (JSC::DFG::Allocator::Region::headerSize): Deleted.
+        (JSC::DFG::Allocator::Region::numberOfThingsPerRegion): Deleted.
+        (JSC::DFG::Allocator::Region::data): Deleted.
+        (JSC::DFG::Allocator::Region::isInThisRegion): Deleted.
+        (JSC::DFG::Allocator::Region::regionFor): Deleted.
+        (JSC::DFG::Allocator<T>::Allocator): Deleted.
+        (JSC::DFG::Allocator<T>::~Allocator): Deleted.
+        (JSC::DFG::Allocator<T>::allocate): Deleted.
+        (JSC::DFG::Allocator<T>::free): Deleted.
+        (JSC::DFG::Allocator<T>::freeAll): Deleted.
+        (JSC::DFG::Allocator<T>::reset): Deleted.
+        (JSC::DFG::Allocator<T>::indexOf): Deleted.
+        (JSC::DFG::Allocator<T>::allocatorOf): Deleted.
+        (JSC::DFG::Allocator<T>::bumpAllocate): Deleted.
+        (JSC::DFG::Allocator<T>::freeListAllocate): Deleted.
+        (JSC::DFG::Allocator<T>::allocateSlow): Deleted.
+        (JSC::DFG::Allocator<T>::freeRegionsStartingAt): Deleted.
+        (JSC::DFG::Allocator<T>::startBumpingIn): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
+        * dfg/DFGCleanUpPhase.cpp:
+        (JSC::DFG::CleanUpPhase::run):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        * dfg/DFGConstantHoistingPhase.cpp:
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::fixupBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::deleteNode):
+        (JSC::DFG::Graph::killBlockAndItsContents):
+        (JSC::DFG::Graph::~Graph): Deleted.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addNode):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGLongLivedState.cpp: Removed.
+        (JSC::DFG::LongLivedState::LongLivedState): Deleted.
+        (JSC::DFG::LongLivedState::~LongLivedState): Deleted.
+        (JSC::DFG::LongLivedState::shrinkToFit): Deleted.
+        * dfg/DFGLongLivedState.h: Removed.
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::index): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::index):
+        * dfg/DFGNodeAllocator.h: Removed.
+        (operator new ): Deleted.
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::runThread):
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Deleted.
+        * runtime/VM.h:
+
+2016-07-27  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Fix a bunch of use-after-free of DFG::Node
+        https://bugs.webkit.org/show_bug.cgi?id=160228
+
+        Reviewed by Mark Lam.
+
+        FTL had a few places where we use a node after it has been
+        deleted. The dangling pointers come from the SSA liveness information
+        kept on the basic blocks.
+
+        This patch fixes the issues I could find and adds liveness invalidation
+        to help finding dependencies like these.
+
+        * dfg/DFGBasicBlock.h:
+        (JSC::DFG::BasicBlock::SSAData::invalidate):
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        Constant folding phase was deleting nodes in the loop over basic blocks.
+        The problem is the deleted nodes can be referenced by other blocks.
+        When the abstract interpreter was manipulating the abstract values of those
+        it was doing so on the dead nodes.
+
+        * dfg/DFGConstantHoistingPhase.cpp:
+        Just invalidation. Nothing wrong here since the useless nodes were
+        kept live while iterating the blocks.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::killBlockAndItsContents):
+        (JSC::DFG::Graph::killUnreachableBlocks):
+        (JSC::DFG::Graph::invalidateNodeLiveness):
+
+        * dfg/DFGGraph.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        We had a lot of use-after-free in LCIM because we were using the stale
+        live nodes deleted by previous phases.
+
+2016-07-27  Keith Miller  <keith_miller@apple.com>
+
+        concatAppendOne should allocate using the indexing type of the array if it cannot merge
+        https://bugs.webkit.org/show_bug.cgi?id=160261
+        <rdar://problem/27530122>
+
+        Reviewed by Mark Lam.
+
+        Before, if we could not merge the indexing types for copying, we would allocate the
+        the array as ArrayWithUndecided. Instead, we should allocate an array with the original
+        array's indexing type.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::concatAppendOne):
+        * tests/stress/concat-append-one-with-sparse-array.js: Added.
+
+2016-07-27  Saam Barati  <sbarati@apple.com>
+
+        We don't optimize for-in properly in baseline JIT (maybe other JITs too) with an object with symbols
+        https://bugs.webkit.org/show_bug.cgi?id=160211
+        <rdar://problem/27572612>
+
+        Reviewed by Geoffrey Garen.
+
+        The fast for-in iteration mode assumes all inline/out-of-line properties
+        can be iterated in linear order. This is not true if we have Symbols
+        because Symbols should not be iterated by for-in.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::add):
+        * tests/stress/symbol-should-not-break-for-in.js: Added.
+        (assert):
+        (foo):
+
+2016-07-27  Mark Lam  <mark.lam@apple.com>
+
+        The second argument for Function.prototype.apply should be array-like or null/undefined.
+        https://bugs.webkit.org/show_bug.cgi?id=160212
+        <rdar://problem/27328525>
+
+        Reviewed by Filip Pizlo.
+
+        The spec for Function.prototype.apply says its second argument can only be null,
+        undefined, or must be array-like.  See
+        https://tc39.github.io/ecma262/#sec-function.prototype.apply and
+        https://tc39.github.io/ecma262/#sec-createlistfromarraylike.
+
+        Our previous implementation was not handling this correctly for SymbolType.
+        This is now fixed.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeOfVarargs):
+        * tests/stress/apply-second-argument-must-be-array-like.js: Added.
+
+2016-07-27  Saam Barati  <sbarati@apple.com>
+
+        MathICs should be able to emit only a jump along the inline path when they don't have any type data
+        https://bugs.webkit.org/show_bug.cgi?id=160110
+
+        Reviewed by Mark Lam.
+
+        This patch allows for MathIC fast-path generation to be delayed.
+        We delay when we don't see any observed type information for
+        the lhs/rhs operand, which implies that the MathIC has never
+        executed. This is profitable for two main reasons:
+        1. If the math operation never executes, we emit much less code.
+        2. Once we get type information for the lhs/rhs, we can emit better code.
+
+        To implement this, we just emit a jump to the slow path call
+        that will repatch on first execution.
+
+        New data for add:
+                   |   JetStream  |  Unity 3D  |
+             ------| -------------|--------------
+              Old  |   148 bytes  |  143 bytes |
+             ------| -------------|--------------
+              New  |   116  bytes |  113 bytes |
+             ------------------------------------
+
+        New data for mul:
+                   |   JetStream  |  Unity 3D  |
+             ------| -------------|--------------
+              Old  |   210 bytes  |  185 bytes |
+             ------| -------------|--------------
+              New  |   170  bytes |  137 bytes |
+             ------------------------------------
+
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateInline):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::isLeftOperandValidConstant):
+        (JSC::JITAddGenerator::isRightOperandValidConstant):
+        (JSC::JITAddGenerator::arithProfile):
+        * jit/JITMathIC.h:
+        (JSC::JITMathIC::generateInline):
+        (JSC::JITMathIC::generateOutOfLine):
+        (JSC::JITMathIC::finalizeInlineCode):
+        * jit/JITMathICInlineResult.h:
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateInline):
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::isLeftOperandValidConstant):
+        (JSC::JITMulGenerator::isRightOperandValidConstant):
+        (JSC::JITMulGenerator::arithProfile):
+        * jit/JITOperations.cpp:
+
+2016-07-26  Saam Barati  <sbarati@apple.com>
+
+        rollout r203666
+        https://bugs.webkit.org/show_bug.cgi?id=160226
+
+        Unreviewed rollout.
+
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::successorBlock):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        * b3/B3LowerToAir.h:
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::usesTmp):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::asNumber):
+        (JSC::B3::Air::Arg::castToType): Deleted.
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::size):
+        (JSC::B3::Air::Code::at):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirValidate.h:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (JSC::B3::compileAndRun):
+        (JSC::B3::testSomeEarlyRegister):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+        (JSC::B3::lowerToAirForTesting): Deleted.
+        (JSC::B3::testBranchBitAndImmFusion): Deleted.
+
+2016-07-26  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] Object.getOwnPropertyDescriptors should not add undefined props to result
+        https://bugs.webkit.org/show_bug.cgi?id=159409
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptors):
+        * tests/es6.yaml:
+        * tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js:
+        (testPropertiesIndexedSetterOnPrototypeThrows.set get var): Deleted.
+        (testPropertiesIndexedSetterOnPrototypeThrows): Deleted.
+        * tests/stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js: Renamed from Source/JavaScriptCore/tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js.
+        * tests/stress/Object_static_methods_Object.getOwnPropertyDescriptors.js: Renamed from Source/JavaScriptCore/tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js.
+
+2016-07-26  Mark Lam  <mark.lam@apple.com>
+
+        Remove unused DEBUG_WITH_BREAKPOINT configuration.
+        https://bugs.webkit.org/show_bug.cgi?id=160203
+
+        Reviewed by Keith Miller.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDebugHook):
+
+2016-07-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Unreviewed, rolling out r203703.
+
+        It breaks some internal tests
+
+        Reverted changeset:
+
+        "[JSC] DFG::Node should not have its own allocator"
+        https://bugs.webkit.org/show_bug.cgi?id=160098
+        http://trac.webkit.org/changeset/203703
+
+2016-07-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] DFG::Node should not have its own allocator
+        https://bugs.webkit.org/show_bug.cgi?id=160098
+
+        Reviewed by Geoffrey Garen.
+
+        We need some design changes for DFG::Node:
+        -Accessing the index must be fast. B3 uses indices for sets
+         and maps, it is a lot faster than hashing pointers.
+        -We should be able to subclass DFG::Node to specialize it.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAllocator.h: Removed.
+        (JSC::DFG::Allocator::Region::size): Deleted.
+        (JSC::DFG::Allocator::Region::headerSize): Deleted.
+        (JSC::DFG::Allocator::Region::numberOfThingsPerRegion): Deleted.
+        (JSC::DFG::Allocator::Region::data): Deleted.
+        (JSC::DFG::Allocator::Region::isInThisRegion): Deleted.
+        (JSC::DFG::Allocator::Region::regionFor): Deleted.
+        (JSC::DFG::Allocator<T>::Allocator): Deleted.
+        (JSC::DFG::Allocator<T>::~Allocator): Deleted.
+        (JSC::DFG::Allocator<T>::allocate): Deleted.
+        (JSC::DFG::Allocator<T>::free): Deleted.
+        (JSC::DFG::Allocator<T>::freeAll): Deleted.
+        (JSC::DFG::Allocator<T>::reset): Deleted.
+        (JSC::DFG::Allocator<T>::indexOf): Deleted.
+        (JSC::DFG::Allocator<T>::allocatorOf): Deleted.
+        (JSC::DFG::Allocator<T>::bumpAllocate): Deleted.
+        (JSC::DFG::Allocator<T>::freeListAllocate): Deleted.
+        (JSC::DFG::Allocator<T>::allocateSlow): Deleted.
+        (JSC::DFG::Allocator<T>::freeRegionsStartingAt): Deleted.
+        (JSC::DFG::Allocator<T>::startBumpingIn): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
+        * dfg/DFGCleanUpPhase.cpp:
+        (JSC::DFG::CleanUpPhase::run):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::run):
+        * dfg/DFGConstantHoistingPhase.cpp:
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::DCEPhase::fixupBlock):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::deleteNode):
+        (JSC::DFG::Graph::killBlockAndItsContents):
+        (JSC::DFG::Graph::~Graph): Deleted.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addNode):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGLongLivedState.cpp: Removed.
+        (JSC::DFG::LongLivedState::LongLivedState): Deleted.
+        (JSC::DFG::LongLivedState::~LongLivedState): Deleted.
+        (JSC::DFG::LongLivedState::shrinkToFit): Deleted.
+        * dfg/DFGLongLivedState.h: Removed.
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::index): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::index):
+        * dfg/DFGNodeAllocator.h: Removed.
+        (operator new ): Deleted.
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::SSAConversionPhase::run):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::runThread):
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Deleted.
+        * runtime/VM.h:
+
+2016-07-25  Filip Pizlo  <fpizlo@apple.com>
+
+        AssemblyHelpers should own all of the cell allocation methods
+        https://bugs.webkit.org/show_bug.cgi?id=160171
+
+        Reviewed by Saam Barati.
+        
+        Prior to this change we had some code in DFGSpeculativeJIT.h and some code in JIT.h that
+        did cell allocation.
+        
+        This change moves all of that code into AssemblyHelpers.h.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):
+        (JSC::DFG::SpeculativeJIT::emitAllocateVariableSizedJSObject):
+        (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitAllocate):
+        (JSC::AssemblyHelpers::emitAllocateJSCell):
+        (JSC::AssemblyHelpers::emitAllocateJSObject):
+        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
+        (JSC::AssemblyHelpers::emitAllocateVariableSized):
+        (JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
+        (JSC::AssemblyHelpers::emitAllocateDestructibleObject):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::isOperandConstantChar):
+        (JSC::JIT::emitValueProfilingSite):
+        (JSC::JIT::emitAllocateJSObject): Deleted.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_new_object):
+        (JSC::JIT::emit_op_create_this):
+
+2016-07-25  Saam Barati  <sbarati@apple.com>
+
+        MathICs should be able to take and dump stats about code size
+        https://bugs.webkit.org/show_bug.cgi?id=160148
+
+        Reviewed by Filip Pizlo.
+
+        This will make testing changes on MathIC going forward much easier.
+        We will be able to easily see if modifications to MathIC will lead
+        to us generating smaller code. We now only dump average size when we
+        regenerate any MathIC. This works out for large tests/pages, but is not
+        great for testing small programs. We can add more dump points later if
+        we find that we want to dump stats while running small small programs.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::dumpMathICStats):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isStrictMode):
+        (JSC::CodeBlock::ecmaMode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileMathIC):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileMathIC):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitMathICFast):
+        (JSC::JIT::emitMathICSlow):
+        * jit/JITMathIC.h:
+        (JSC::JITMathIC::finalizeInlineCode):
+        (JSC::JITMathIC::codeSize):
+        * jit/JITOperations.cpp:
+
+2016-07-25  Saam Barati  <sbarati@apple.com>
+
+        op_mul/ArithMul(Untyped,Untyped) should be an IC
+        https://bugs.webkit.org/show_bug.cgi?id=160108
+
+        Reviewed by Mark Lam.
+
+        This patch makes Mul a type based IC in much the same way that we made
+        Add a type-based IC. I implemented Mul in the same way. I abstracted the
+        implementation of the Add IC in the various JITs to allow for it to
+        work over arbitrary IC snippets. This will make adding Div/Sub/Pow in the
+        future easy. This patch also adds a new boolean argument to the various
+        snippet generateFastPath() methods to indicate if we should emit result profiling.
+        I added this because we want this profiling to be emitted for Mul in
+        the baseline, but not in the DFG. We used to indicate this through passing
+        in a nullptr for the ArithProfile, but we no longer do that in the upper
+        JIT tiers. So we are passing an explicit request from the JIT tier about
+        whether or not it's worth it for the IC to emit profiling.
+
+        We now emit much less code for Mul. Here is some data on the average
+        Mul snippet/IC size:
+
+                   |   JetStream  |  Unity 3D  |
+             ------| -------------|--------------
+              Old  |  ~280 bytes  | ~280 bytes |
+             ------| -------------|--------------
+              New  |   210  bytes |  185 bytes |
+             ------------------------------------
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::addJITAddIC):
+        (JSC::CodeBlock::addJITMulIC):
+        (JSC::CodeBlock::findStubInfo):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::stubInfoBegin):
+        (JSC::CodeBlock::stubInfoEnd):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::GPRTemporary::adopt):
+        (JSC::DFG::FPRTemporary::FPRTemporary):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileMathIC):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        (JSC::DFG::GPRTemporary::GPRTemporary):
+        (JSC::DFG::GPRTemporary::operator=):
+        (JSC::DFG::FPRTemporary::~FPRTemporary):
+        (JSC::DFG::FPRTemporary::fpr):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileToThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMathIC):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
+        * jit/JIT.h:
+        (JSC::JIT::getSlowCase):
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateInline):
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::JITAddGenerator):
+        (JSC::JITAddGenerator::isLeftOperandValidConstant):
+        (JSC::JITAddGenerator::isRightOperandValidConstant):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emitMathICFast):
+        (JSC::JIT::emitMathICSlow):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_sub):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITMathIC.h:
+        (JSC::JITMathIC::slowPathStartLocation):
+        (JSC::JITMathIC::slowPathCallLocation):
+        (JSC::JITMathIC::isLeftOperandValidConstant):
+        (JSC::JITMathIC::isRightOperandValidConstant):
+        (JSC::JITMathIC::generateInline):
+        (JSC::JITMathIC::generateOutOfLine):
+        * jit/JITMathICForwards.h:
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateInline):
+        (JSC::JITMulGenerator::generateFastPath):
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::JITMulGenerator):
+        (JSC::JITMulGenerator::isLeftOperandValidConstant):
+        (JSC::JITMulGenerator::isRightOperandValidConstant):
+        (JSC::JITMulGenerator::didEmitFastPath): Deleted.
+        (JSC::JITMulGenerator::endJumpList): Deleted.
+        (JSC::JITMulGenerator::slowPathJumpList): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+
+2016-07-25  Darin Adler  <darin@apple.com>
+
+        Speed up make process slightly by improving "list of files" idiom
+        https://bugs.webkit.org/show_bug.cgi?id=160164
+
+        Reviewed by Mark Lam.
+
+        * DerivedSources.make: Change rules that build lists of files to only run when
+        DerivedSources.make has been modified since the last time they were run. Since the
+        list of files are inside this file, this is safe, and this is faster than always
+        comparing and regenerating the file containing the list of files each time.
+
+2016-07-24  Youenn Fablet  <youenn@apple.com>
+
+        [Fetch API] Request should be created with any HeadersInit data
+        https://bugs.webkit.org/show_bug.cgi?id=159672
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/builtins/builtins_generator.py:
+        (WK_lcfirst): Synchronized with CodeGenerator.pm version.
+
+2016-07-24  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should support multiple entrypoints
+        https://bugs.webkit.org/show_bug.cgi?id=159391
+
+        Reviewed by Saam Barati.
+        
+        This teaches B3 how to compile procedures with multiple entrypoints in the best way ever.
+        
+        Multiple entrypoints are useful. We could use them to reduce the cost of compiling OSR
+        entrypoints. We could use them to implement better try/catch.
+        
+        Multiple entrypoints are hard to support. All of the code that assumed that the root block
+        is the entrypoint would have to be changed. Transformations like moveConstants() would have
+        to do crazy things if the existence of multiple entrypoints prevented it from finding a
+        single common dominator.
+        
+        Therefore, we want to add multiple entrypoints without actually teaching the compiler that
+        there is such a thing. That's sort of what this change does.
+        
+        This adds a new opcode to both B3 and Air called EntrySwitch. It's a terminal that takes
+        one or more successors and no value children. The number of successors must match
+        Procedure::numEntrypoints(), which could be arbitrarily large. The semantics of EntrySwitch
+        are:
+        
+        - Each of the entrypoints sets a hidden Entry variable to that entrypoint's index and jumps
+          to the procedure's root block.
+        
+        - An EntrySwitch is a switch statement over this hidden Entry variable.
+        
+        The way that we actually implement this is that Air has a very late phase - after all
+        register and stack layout - that clones all code where the Entry variable is live; i.e all
+        code in the closure over predecessors of all blocks that do EntrySwitch.
+        
+        Usually, you would use this by creating an EntrySwitch in the root block, but you don't
+        have to do that. Just remember that the code before EntrySwitch gets cloned for each
+        entrypoint. We allow cloning of an arbitrarily large amount of code because restricting it,
+        and so restricing the placement of EntrySwitches, would be unelegant. It would be hard to
+        preserve this invariant. For example we wouldn't be able to lower any value before an
+        EntrySwitch to a control flow diamond.
+        
+        This patch gives us an easy-to-use way to use B3 to compile code with multiple entrypoints.
+        Inside the compiler, only code that runs very late in Air has to know about this feature.
+        We get the best of both worlds!
+        
+        Also, I finally got rid of the requirement that you explicitly cast BasicBlock* to
+        FrequentedBlock. I can no longer remember why I thought that was a good idea. Removing it
+        doesn't cause any problems and it makes code easier to write.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3BasicBlockUtils.h:
+        (JSC::B3::updatePredecessorsAfter):
+        (JSC::B3::clearPredecessors):
+        (JSC::B3::recomputePredecessors):
+        * b3/B3FrequencyClass.h:
+        (JSC::B3::maxFrequency):
+        * b3/B3Generate.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3MoveConstants.cpp:
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::isFastConstant):
+        (JSC::B3::Procedure::entrypointLabel):
+        (JSC::B3::Procedure::addDataSection):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::numEntrypoints):
+        (JSC::B3::Procedure::setNumEntrypoints):
+        (JSC::B3::Procedure::setLastPhaseName):
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::cCallSpecial):
+        (JSC::B3::Air::Code::isEntrypoint):
+        (JSC::B3::Air::Code::resetReachability):
+        (JSC::B3::Air::Code::dump):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::setFrameSize):
+        (JSC::B3::Air::Code::numEntrypoints):
+        (JSC::B3::Air::Code::entrypoints):
+        (JSC::B3::Air::Code::entrypoint):
+        (JSC::B3::Air::Code::setEntrypoints):
+        (JSC::B3::Air::Code::entrypointLabel):
+        (JSC::B3::Air::Code::setEntrypointLabels):
+        (JSC::B3::Air::Code::calleeSaveRegisters):
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::PatchCustom::isTerminal):
+        (JSC::B3::Air::PatchCustom::hasNonArgEffects):
+        (JSC::B3::Air::PatchCustom::hasNonArgNonControlEffects):
+        (JSC::B3::Air::PatchCustom::generate):
+        (JSC::B3::Air::CommonCustomBase::hasNonArgEffects):
+        (JSC::B3::Air::CCallCustom::forEachArg):
+        (JSC::B3::Air::ColdCCallCustom::forEachArg):
+        (JSC::B3::Air::ShuffleCustom::forEachArg):
+        (JSC::B3::Air::EntrySwitchCustom::forEachArg):
+        (JSC::B3::Air::EntrySwitchCustom::isValidFormStatic):
+        (JSC::B3::Air::EntrySwitchCustom::isValidForm):
+        (JSC::B3::Air::EntrySwitchCustom::admitsStack):
+        (JSC::B3::Air::EntrySwitchCustom::isTerminal):
+        (JSC::B3::Air::EntrySwitchCustom::hasNonArgNonControlEffects):
+        (JSC::B3::Air::EntrySwitchCustom::generate):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        (JSC::B3::Air::generate):
+        * b3/air/AirLowerEntrySwitch.cpp: Added.
+        (JSC::B3::Air::lowerEntrySwitch):
+        * b3/air/AirLowerEntrySwitch.h: Added.
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirOptimizeBlockOrder.cpp:
+        (JSC::B3::Air::blocksInOptimizedOrder):
+        * b3/air/AirSpecial.cpp:
+        (JSC::B3::Air::Special::isTerminal):
+        (JSC::B3::Air::Special::hasNonArgEffects):
+        (JSC::B3::Air::Special::hasNonArgNonControlEffects):
+        * b3/air/AirSpecial.h:
+        * b3/air/AirValidate.cpp:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+
+2016-07-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix broken test. I don't know why I goofed this up without seeing it before landing.
+
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::run):
+
+2016-07-22  Filip Pizlo  <fpizlo@apple.com>
+
+        [B3] Fusing immediates into test instructions should work again
+        https://bugs.webkit.org/show_bug.cgi?id=160073
+
+        Reviewed by Sam Weinig.
+
+        When we introduced BitImm, we forgot to change the Branch(BitAnd(value, constant))
+        fusion.  This emits test instructions, so it should use BitImm for the constant.  But it
+        was still using Imm!  This meant that isValidForm() always returned false.
+        
+        This fixes the code path to use BitImm, and turns off our use of BitImm64 on x86 since
+        it provides no benefit on x86 and has some risk (the code appears to play fast and loose
+        with the scratch register).
+        
+        This is not an obvious progression on anything, so I added comprehensive tests to
+        testb3, which check that we selected the optimal instruction in a variety of situations.
+        We should add more tests like this!
+
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::successorBlock):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        * b3/B3LowerToAir.h:
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::usesTmp):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::castToType):
+        (JSC::B3::Air::Arg::asNumber):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::size):
+        (JSC::B3::Air::Code::at):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirValidate.h:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (JSC::B3::compile):
+        (JSC::B3::compileAndRun):
+        (JSC::B3::lowerToAirForTesting):
+        (JSC::B3::testSomeEarlyRegister):
+        (JSC::B3::testBranchBitAndImmFusion):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+
+2016-07-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, update the exponentiation expression error message
+        https://bugs.webkit.org/show_bug.cgi?id=159969
+
+        Follow up patch for r203499.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseBinaryExpression):
+        * tests/stress/pow-expects-update-expression-on-lhs.js:
+        (throw.new.Error):
+
+2016-07-24  Darin Adler  <darin@apple.com>
+
+        Adding a new WebCore JavaScript built-in source file does not trigger rebuild of WebCoreJSBuiltins*
+        https://bugs.webkit.org/show_bug.cgi?id=160115
+
+        Reviewed by Youenn Fablet.
+
+        * make-generated-sources.sh: Removed. Was unused.
+
+2016-07-23  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r203641.
+        https://bugs.webkit.org/show_bug.cgi?id=160116
+
+        It broke make-based builds (Requested by youenn on #webkit).
+
+        Reverted changeset:
+
+        "[Fetch API] Request should be created with any HeadersInit
+        data"
+        https://bugs.webkit.org/show_bug.cgi?id=159672
+        http://trac.webkit.org/changeset/203641
+
+2016-07-23  Youenn Fablet  <youenn@apple.com>
+
+        [Fetch API] Request should be created with any HeadersInit data
+        https://bugs.webkit.org/show_bug.cgi?id=159672
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/builtins/builtins_generator.py:
+        (WK_lcfirst): Synchronized with CodeGenerator.pm version.
+
+2016-07-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Teach MarkedSpace how to allocate auxiliary storage
+        https://bugs.webkit.org/show_bug.cgi?id=160053
+
+        Reviewed by Sam Weinig.
+        
+        Previously, we had two kinds of subspaces in MarkedSpace: destructor and non-destructor. This
+        was described using "bool needsDestruction" that would get passed around. We'd iterate over
+        these spaces using duplicated code - one loop for destructors and one for non-destructors, or
+        a single loop that does one thing for destructors and one for non-destructors.
+        
+        But now we want a third subspace: non-destructor non-JSCell, aka Auxiliary.
+        
+        So, this changes all of the reflection and iteration over subspaces to use functors, so that
+        the looping is written once and reused. Most places don't even have to know that there is a
+        third subspace; they just know that they must do things for each subspace, for each
+        allocator, or for each block - and the functor magic handles it for you.
+        
+        To make this somewhat nice, this change also fixes how we describe subspaces. Instead of a
+        bool, we now have AllocatorAttributes, which is a struct. If we ever add more subspaces, we
+        can add fields to AllocatorAttributes to describe how those subspaces differ. For now it just
+        contains two properties: a DestructionMode and a HeapCell::Kind. The DesctructionMode
+        replaces bool needsDestruction. I deliberately used a non-class enum to avoid tautologies.
+        DestructionMode has two members: NeedsDestruction and DoesNotNeedDestruction. I almost went
+        with DestructionMode::Needed and DestructionMode::NotNeeded, but I felt like that involves
+        more typing and doesn't actually avoid any kind of namespace issues.
+        
+        This is intended to have no behavior change other than the addition of a totally unused
+        space, which should always be empty. So hopefully it doesn't cost anything.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/AllocatorAttributes.cpp: Added.
+        (JSC::AllocatorAttributes::dump):
+        * heap/AllocatorAttributes.h: Added.
+        (JSC::AllocatorAttributes::AllocatorAttributes):
+        * heap/DestructionMode.cpp: Added.
+        (WTF::printInternal):
+        * heap/DestructionMode.h: Added.
+        * heap/Heap.h:
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock):
+        (JSC::MarkedAllocator::addBlock):
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::cellSize):
+        (JSC::MarkedAllocator::attributes):
+        (JSC::MarkedAllocator::needsDestruction):
+        (JSC::MarkedAllocator::destruction):
+        (JSC::MarkedAllocator::cellKind):
+        (JSC::MarkedAllocator::heap):
+        (JSC::MarkedAllocator::takeLastActiveBlock):
+        (JSC::MarkedAllocator::MarkedAllocator):
+        (JSC::MarkedAllocator::init):
+        (JSC::MarkedAllocator::allocate):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::callDestructor):
+        (JSC::MarkedBlock::sweep):
+        (JSC::MarkedBlock::stopAllocating):
+        (JSC::MarkedBlock::didRetireBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::cellSize):
+        (JSC::MarkedBlock::attributes):
+        (JSC::MarkedBlock::needsDestruction):
+        (JSC::MarkedBlock::destruction):
+        (JSC::MarkedBlock::cellKind):
+        (JSC::MarkedBlock::size):
+        (JSC::MarkedBlock::forEachCell):
+        (JSC::MarkedBlock::forEachLiveCell):
+        (JSC::MarkedBlock::forEachDeadCell):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::~MarkedSpace):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::forEachAllocator):
+        (JSC::MarkedSpace::stopAllocating):
+        (JSC::MarkedSpace::resumeAllocating):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::shrink):
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        (JSC::clearNewlyAllocatedInBlock): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::subspaceForObjectsWithDestructor):
+        (JSC::MarkedSpace::subspaceForObjectsWithoutDestructor):
+        (JSC::MarkedSpace::subspaceForAuxiliaryData):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::destructorAllocatorFor):
+        (JSC::MarkedSpace::auxiliaryAllocatorFor):
+        (JSC::MarkedSpace::allocateWithoutDestructor):
+        (JSC::MarkedSpace::allocateWithDestructor):
+        (JSC::MarkedSpace::allocateAuxiliary):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::didAddBlock):
+        (JSC::MarkedSpace::capacity):
+        (JSC::MarkedSpace::forEachSubspace):
+
+2016-07-22  Saam Barati  <sbarati@apple.com>
+
+        REGRESSION(r203537): It made many tests crash on ARMv7 Linux platforms
+        https://bugs.webkit.org/show_bug.cgi?id=160082
+
+        Reviewed by Keith Miller.
+
+        We were improperly linking the Jump in the link buffer.
+        It caused us to be linking against the executable address
+        which always has bit 0 set. We shouldn't be doing that.
+        This patch fixes this, by using the same idiom that
+        PolymorphicAccess uses to link a jump to out of line code.
+
+        * jit/JITMathIC.h:
+        (JSC::JITMathIC::generateOutOfLine):
+
+2016-07-22  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r203603.
+        https://bugs.webkit.org/show_bug.cgi?id=160096
+
+        Caused CLoop tests to fail with assertions (Requested by
+        perarne on #webkit).
+
+        Reverted changeset:
+
+        "[Win] jsc.exe sometimes never exits."
+        https://bugs.webkit.org/show_bug.cgi?id=158073
+        http://trac.webkit.org/changeset/203603
+
+2016-07-22  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] jsc.exe sometimes never exits.
+        https://bugs.webkit.org/show_bug.cgi?id=158073
+
+        Reviewed by Mark Lam.
+
+        Make sure the VM is deleted after the test has finished. This will gracefully stop the sampling profiler thread,
+        and give the thread the opportunity to release the machine thread lock aquired in SamplingProfiler::takeSample.  
+        If the sampling profiler thread was terminated while holding the machine thread lock, the machine thread will
+        not be able to grab the lock afterwards. 
+ 
+        * jsc.cpp:
+        (jscmain):
+
+2016-07-22  Per Arne Vollan  <pvollan@apple.com>
+
+        Fix the Windows 64-bit build after r203537
+        https://bugs.webkit.org/show_bug.cgi?id=160080
+
+        Reviewed by Csaba Osztrogonác.
+
+        Added new version of setupArgumentsWithExecState method.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2016-07-22  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Unreviewed EABI buildfix after r203537.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState): Added.
+
+2016-07-22  Youenn Fablet  <youenn@apple.com>
+
+        run-builtins-generator-tests should be able to test WebCore builtins wrapper with more than one file
+        https://bugs.webkit.org/show_bug.cgi?id=159921
+
+        Reviewed by Brian Burg.
+
+        Updated built-in generator to generate only wrapper files when passed the --wrappers-only option.
+        When this option is used, wrapper files are generated but no individual file is generated.
+        When this option is not used, individual files are generated but not wrapper file is generated.
+        This allows the builtin generator test runner to generate a single WebCore-Wrappers.h-result generated for all
+        WebCore test files, like used for real in WebCore.
+        Previously wrapper code was generated individually for each WebCore test file.
+
+        Added new built-in test file to cover the case of concatenating several guards in generated WebCore wrapper files.
+
+        * Scripts/generate-js-builtins.py:
+        (concatenated_output_filename): Compute a decent name for wrapper files in case of test mode.
+        (generate_bindings_for_builtins_files): When --wrappers-only is activated, this generates only the wrapper files, not the individual files.
+        * Scripts/tests/builtins/WebCore-AnotherGuardedInternalBuiltin-Separate.js: Added.
+        * Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result: Added.
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Removed wrapper code.
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Removed wrapper code.
+        * Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result: Added, contains wrapper code for all WebCore valid test cases.
+
+2016-07-21  Saam Barati  <sbarati@apple.com>
+
+        callOperation(.) variants in the DFG that explicitly take a tag/payload register should take a JSValueRegs instead
+        https://bugs.webkit.org/show_bug.cgi?id=160007
+
+        Reviewed by Filip Pizlo.
+
+        This patch is the first step in my plan to remove all callOperation(.) variants
+        in the various JITs and to unify them using a couple template variations.
+        The steps are as follows:
+        1. Replace all explicit tag/payload pairs with JSValueRegs in the DFG
+        2. Replace all explicit tag/payload pairs with JSValueRegs in the baseline
+        3. remove callOperation(.) variants and teach setupArgumentsWithExecState
+           about JSValueRegs.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileGetDynamicVar):
+        (JSC::DFG::SpeculativeJIT::compilePutDynamicVar):
+        (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
+        (JSC::DFG::CompareAndBoxBooleanSlowPathGenerator::generateInternal):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-07-21  Saam Barati  <sbarati@apple.com>
+
+        op_add/ValueAdd should be an IC in all JIT tiers
+        https://bugs.webkit.org/show_bug.cgi?id=159649
+
+        Reviewed by Benjamin Poulain.
+
+        This patch makes Add an IC inside all JIT tiers. It does so in a
+        simple, but effective, way. We will try to generate an int+int add
+        that will repatch itself if its type checks fail. Sometimes though,
+        we have runtime type data saying that the add won't be int+int.
+        In those cases, we will just generate a full snippet that doesn't patch itself.
+        Other times, we may generate no inline code and defer to making a C call. A lot
+        of this patch is just refactoring ResultProfile into what we're now calling ArithProfile.
+        ArithProfile does everything ResultProfile used to do, and more. It records simple type
+        data about the LHS/RHS operands it sees. This allows us to determine if an op_add
+        has only seen int+int operands, etc. ArithProfile will also contain the ResultType
+        for the LHS/RHS that the parser feeds into op_add. ArithProfile now fits into 32-bits.
+        This means instead of having a side table like we did for ResultProfile, we just
+        inject the ArithProfile into the bytecode instruction stream. This makes asking
+        for ArithProfile faster; we no longer need to lock around this operation.
+
+        The size of an Add has gone down on average, but we can still do better.
+        We still generate a lot of code because we generate calls to the slow path.
+        I think we can make this better by moving the slow path to a shared thunk
+        system. This patch mostly lays the foundation for future improvements to Add,
+        and a framework to move all other arithmetic operations to be typed-based ICs.
+
+        Here is some data I took on the average op_add/ValueAdd size on various benchmarks:
+                   |   JetStream  |  Speedometer |  Unity 3D  |
+             ------| -------------|-----------------------------
+              Old  |  189 bytes   |  169 bytes   |  192 bytes |
+             ------| -------------|-----------------------------
+              New  |  148 bytes   |  124 bytes   |  143 bytes |
+             ---------------------------------------------------
+
+        Making an arithmetic IC is now easy. The JITMathIC class will hold a snippet
+        generator as a member variable. To make a snippet an IC, you need to implement
+        a generateInline(.) method, which generates the inline IC. Then, you need to
+        generate the IC where you used to generate the snippet. When generating the
+        IC, we need to inform JITMathIC of various data like we do with StructureStubInfo.
+        We need to tell it about where the slow path starts, where the slow path call is, etc.
+        When generating a JITMathIC, it may tell you that it didn't generate any code inline.
+        This is a request to the user of JITMathIC to just generate a C call along the
+        fast path. JITMathIC may also have the snippet tell it to just generate the full
+        snippet instead of the int+int path along the fast path.
+
+        In subsequent patches, we can improve upon how we decide to generate int+int or
+        the full snippet. I tried to get clever by having double+double, double+int, int+double,
+        fast paths, but they didn't work out nearly as well as the int+int fast path. I ended up
+        generating a lot of code when I did this and ended up using more memory than just generating
+        the full snippet. There is probably some way we can be clever and generate specialized fast
+        paths that are more successful than what I tried implementing, but I think that's worth deferring
+        this to follow up patches once the JITMathIC foundation has landed.
+
+        This patch also fixes a bug inside the slow path lambdas in the DFG.
+        Before, it was not legal to emit an exception check inside them. Now,
+        it is. So it's now easy to define arbitrary late paths using the DFG
+        slow path lambda API.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ArithProfile.cpp: Added.
+        (JSC::ArithProfile::emitObserveResult):
+        (JSC::ArithProfile::shouldEmitSetDouble):
+        (JSC::ArithProfile::emitSetDouble):
+        (JSC::ArithProfile::shouldEmitSetNonNumber):
+        (JSC::ArithProfile::emitSetNonNumber):
+        (WTF::printInternal):
+        * bytecode/ArithProfile.h: Added.
+        (JSC::ObservedType::ObservedType):
+        (JSC::ObservedType::sawInt32):
+        (JSC::ObservedType::isOnlyInt32):
+        (JSC::ObservedType::sawNumber):
+        (JSC::ObservedType::isOnlyNumber):
+        (JSC::ObservedType::sawNonNumber):
+        (JSC::ObservedType::isOnlyNonNumber):
+        (JSC::ObservedType::isEmpty):
+        (JSC::ObservedType::bits):
+        (JSC::ObservedType::withInt32):
+        (JSC::ObservedType::withNumber):
+        (JSC::ObservedType::withNonNumber):
+        (JSC::ObservedType::withoutNonNumber):
+        (JSC::ObservedType::operator==):
+        (JSC::ArithProfile::ArithProfile):
+        (JSC::ArithProfile::fromInt):
+        (JSC::ArithProfile::lhsResultType):
+        (JSC::ArithProfile::rhsResultType):
+        (JSC::ArithProfile::lhsObservedType):
+        (JSC::ArithProfile::rhsObservedType):
+        (JSC::ArithProfile::setLhsObservedType):
+        (JSC::ArithProfile::setRhsObservedType):
+        (JSC::ArithProfile::tookSpecialFastPath):
+        (JSC::ArithProfile::didObserveNonInt32):
+        (JSC::ArithProfile::didObserveDouble):
+        (JSC::ArithProfile::didObserveNonNegZeroDouble):
+        (JSC::ArithProfile::didObserveNegZeroDouble):
+        (JSC::ArithProfile::didObserveNonNumber):
+        (JSC::ArithProfile::didObserveInt32Overflow):
+        (JSC::ArithProfile::didObserveInt52Overflow):
+        (JSC::ArithProfile::setObservedNonNegZeroDouble):
+        (JSC::ArithProfile::setObservedNegZeroDouble):
+        (JSC::ArithProfile::setObservedNonNumber):
+        (JSC::ArithProfile::setObservedInt32Overflow):
+        (JSC::ArithProfile::setObservedInt52Overflow):
+        (JSC::ArithProfile::addressOfBits):
+        (JSC::ArithProfile::observeResult):
+        (JSC::ArithProfile::lhsSawInt32):
+        (JSC::ArithProfile::lhsSawNumber):
+        (JSC::ArithProfile::lhsSawNonNumber):
+        (JSC::ArithProfile::rhsSawInt32):
+        (JSC::ArithProfile::rhsSawNumber):
+        (JSC::ArithProfile::rhsSawNonNumber):
+        (JSC::ArithProfile::observeLHSAndRHS):
+        (JSC::ArithProfile::bits):
+        (JSC::ArithProfile::hasBits):
+        (JSC::ArithProfile::setBit):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpRareCaseProfile):
+        (JSC::CodeBlock::dumpArithProfile):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::addStubInfo):
+        (JSC::CodeBlock::addJITAddIC):
+        (JSC::CodeBlock::findStubInfo):
+        (JSC::CodeBlock::resetJITData):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::dumpValueProfiles):
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset):
+        (JSC::CodeBlock::arithProfileForBytecodeOffset):
+        (JSC::CodeBlock::arithProfileForPC):
+        (JSC::CodeBlock::couldTakeSpecialFastCase):
+        (JSC::CodeBlock::dumpResultProfile): Deleted.
+        (JSC::CodeBlock::resultProfileForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::specialFastCaseProfileCountForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::ensureResultProfile): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::stubInfoBegin):
+        (JSC::CodeBlock::stubInfoEnd):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::numberOfResultProfiles): Deleted.
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        (JSC::MethodOfGettingAValueProfile::emitReportValue):
+        * bytecode/MethodOfGettingAValueProfile.h:
+        (JSC::MethodOfGettingAValueProfile::MethodOfGettingAValueProfile):
+        * bytecode/ValueProfile.cpp:
+        (JSC::ResultProfile::emitDetectNumericness): Deleted.
+        (JSC::ResultProfile::emitSetDouble): Deleted.
+        (JSC::ResultProfile::emitSetNonNumber): Deleted.
+        (WTF::printInternal): Deleted.
+        * bytecode/ValueProfile.h:
+        (JSC::getRareCaseProfileBytecodeOffset):
+        (JSC::ResultProfile::ResultProfile): Deleted.
+        (JSC::ResultProfile::bytecodeOffset): Deleted.
+        (JSC::ResultProfile::specialFastPathCount): Deleted.
+        (JSC::ResultProfile::didObserveNonInt32): Deleted.
+        (JSC::ResultProfile::didObserveDouble): Deleted.
+        (JSC::ResultProfile::didObserveNonNegZeroDouble): Deleted.
+        (JSC::ResultProfile::didObserveNegZeroDouble): Deleted.
+        (JSC::ResultProfile::didObserveNonNumber): Deleted.
+        (JSC::ResultProfile::didObserveInt32Overflow): Deleted.
+        (JSC::ResultProfile::didObserveInt52Overflow): Deleted.
+        (JSC::ResultProfile::setObservedNonNegZeroDouble): Deleted.
+        (JSC::ResultProfile::setObservedNegZeroDouble): Deleted.
+        (JSC::ResultProfile::setObservedNonNumber): Deleted.
+        (JSC::ResultProfile::setObservedInt32Overflow): Deleted.
+        (JSC::ResultProfile::setObservedInt52Overflow): Deleted.
+        (JSC::ResultProfile::addressOfFlags): Deleted.
+        (JSC::ResultProfile::addressOfSpecialFastPathCount): Deleted.
+        (JSC::ResultProfile::detectNumericness): Deleted.
+        (JSC::ResultProfile::hasBits): Deleted.
+        (JSC::ResultProfile::setBit): Deleted.
+        (JSC::getResultProfileBytecodeOffset): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitBinaryOp):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::exceptionCheck):
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::generate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentSpillAllRegistersImpl):
+        (JSC::DFG::SpeculativeJIT::silentSpillAllRegisters):
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStrCat):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        (JSC::CCallHelpers::setupArguments):
+        * jit/JIT.h:
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateInline):
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::JITAddGenerator):
+        (JSC::JITAddGenerator::didEmitFastPath): Deleted.
+        (JSC::JITAddGenerator::endJumpList): Deleted.
+        (JSC::JITAddGenerator::slowPathJumpList): Deleted.
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::getOperandTypes):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        * jit/JITDivGenerator.cpp:
+        (JSC::JITDivGenerator::generateFastPath):
+        * jit/JITDivGenerator.h:
+        (JSC::JITDivGenerator::JITDivGenerator):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITMathIC.h: Added.
+        (JSC::JITMathIC::doneLocation):
+        (JSC::JITMathIC::slowPathStartLocation):
+        (JSC::JITMathIC::slowPathCallLocation):
+        (JSC::JITMathIC::generateInline):
+        (JSC::JITMathIC::generateOutOfLine):
+        (JSC::JITMathIC::finalizeInlineCode):
+        * jit/JITMathICForwards.h: Added.
+        * jit/JITMathICInlineResult.h: Added.
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath):
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::JITMulGenerator):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITSubGenerator.cpp:
+        (JSC::JITSubGenerator::generateFastPath):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::JITSubGenerator):
+        * jit/Repatch.cpp:
+        (JSC::readCallTarget):
+        (JSC::ftlThunkAwareRepatchCall):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::appropriateGenericPutByIdFunction):
+        (JSC::tryCachePutByID):
+        (JSC::repatchPutByID):
+        (JSC::tryRepatchIn):
+        (JSC::repatchIn):
+        (JSC::linkSlowFor):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::repatchCall): Deleted.
+        * jit/Repatch.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ResultType.h:
+        (JSC::ResultType::ResultType):
+        (JSC::ResultType::isInt32):
+        (JSC::ResultType::definitelyIsNumber):
+        (JSC::ResultType::definitelyIsString):
+        (JSC::ResultType::definitelyIsBoolean):
+        (JSC::ResultType::mightBeNumber):
+        (JSC::ResultType::isNotNumber):
+        (JSC::ResultType::forBitOp):
+        (JSC::ResultType::bits):
+        (JSC::OperandTypes::OperandTypes):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        (JSC::updateArithProfileForBinaryArithOp):
+        (JSC::updateResultProfileForBinaryArithOp): Deleted.
+        * tests/stress/op-add-exceptions.js: Added.
+        (assert):
+        (f1):
+        (f2):
+        (f3):
+        (let.oException.valueOf):
+        (foo):
+        (ident):
+        (bar):
+
+2016-07-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Clarify testing mode names in run-jsc-stress-tests
+        https://bugs.webkit.org/show_bug.cgi?id=160021
+
+        Reviewed by Mark Lam.
+
+        Default should mean really default, not default with disabled FTL, renamed
+        - runMozillaTestDefault to runMozillaTestNoFTL
+        - runMozillaTestDefaultFTL to runMozillaTestDefault
+        - runDefault to runNoFTL
+        - runDefaultFTL to runDefault
+        - runLayoutTestDefault to runLayoutTestNoFTL
+        - runLayoutTestDefaultFTL to runLayoutTestDefault
+        - runNoisyTestDefault to runNoisyTestNoFTL
+        - runNoisyTestDefaultFTL to runNoisyTestDefault
+
+        * tests/mozilla/mozilla-tests.yaml:
+        * tests/stress/lift-tdz-bypass-catch.js:
+        * tests/stress/obscure-error-message-dont-crash.js:
+        * tests/stress/shadow-chicken-disabled.js:
+
+2016-07-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES7] Introduce exponentiation expression
+        https://bugs.webkit.org/show_bug.cgi?id=159969
+
+        Reviewed by Saam Barati.
+
+        This patch implements the exponentiation expression, e.g. `x ** y`.
+        The exponentiation expression is introduced in ECMA262 2016 and ECMA262 2016
+        is already released. So this is not the draft spec.
+
+        The exponentiation expression has 2 interesting points.
+
+        1. Right associative
+
+            To follow the Math expression, ** operator is right associative.
+            When we execute `x ** y ** z`, this is handled as `x ** (y ** z)`, not `(x ** y) ** z`.
+            This patch introduces the right associativity to the binary operator and handles it
+            in the operator precedence parser in Parser.cpp.
+
+        2. LHS of the exponentiation expression is UpdateExpression
+
+            ExponentiationExpression[Yield]:
+                UnaryExpression[?Yield]
+                UpdateExpression[?Yield] ** ExponentiationExpression[?Yield]
+
+            As we can see, the left hand side of the ExponentiationExpression is UpdateExpression, not UnaryExpression.
+            It means that `+x ** y` becomes a syntax error. This is intentional. Without superscript in JS,
+            `-x**y` is confusing between `-(x ** y)` and `(-x) ** y`. So ECMA262 intentionally avoids UnaryExpression here.
+            If we need to use a negated value, we need to write parentheses explicitly e.g. `(-x) ** y`.
+            In this patch, we ensure that the left hand side is not an unary expression by checking an operator in
+            parseBinaryExpression. This works since `**` has the highest operator precedence in the binary operators.
+
+        We introduce a new bytecode, op_pow. That simply works as similar as the other binary operators.
+        And it is converted to ArithPow in DFG and handled in DFG and FTL.
+        In this patch, we take the approach just introducing a new bytecode instead of calling Math.pow.
+        This is because we would like to execute ToNumber in the caller side, not in the callee (Math.pow) side.
+        And we don't want to compile ** into the following.
+
+            lhsNumber = to_number (lhs)
+            rhsNumber = to_number (rhs)
+            call Math.pow(lhsNumber, rhsNumber)
+
+        We ensure that this patch passes all the test262 tests related to the exponentiation expression.
+
+        The only sensitive part to the performance is the parser changes.
+        So we measured the code-load performance and it is neutral in my x64 Linux box (hanayamata).
+
+            Collected 30 samples per benchmark/VM, with 30 VM invocations per benchmark. Emitted a call to
+            gc() between sample measurements. Used 1 benchmark iteration per VM invocation for warm-up. Used
+            the jsc-specific preciseTime() function to get microsecond-level timing. Reporting benchmark
+            execution times with 95% confidence intervals in milliseconds.
+
+                                     baseline                  patched
+
+            closure              0.60499+-0.00250          0.60180+-0.00244
+            jquery               7.89175+-0.02433    ?     7.91287+-0.04759       ?
+
+            <geometric>          2.18499+-0.00523          2.18207+-0.00689         might be 1.0013x faster
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::emitReadModifyAssignment):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_pow):
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::operatorStackShouldReduce):
+        (JSC::ASTBuilder::makePowNode):
+        (JSC::ASTBuilder::makeMultNode):
+        (JSC::ASTBuilder::makeDivNode):
+        (JSC::ASTBuilder::makeModNode):
+        (JSC::ASTBuilder::makeSubNode):
+        (JSC::ASTBuilder::makeBinaryNode):
+        (JSC::ASTBuilder::operatorStackHasHigherPrecedence): Deleted.
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+        * parser/NodeConstructors.h:
+        (JSC::PowNode::PowNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::isUnaryOpExcludingUpdateOp):
+        (JSC::Parser<LexerType>::parseBinaryExpression):
+        (JSC::isUnaryOp): Deleted.
+        * parser/ParserTokens.h:
+        (JSC::isUpdateOp):
+        (JSC::isUnaryOp):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * tests/stress/pow-basics.js: Added.
+        (valuesAreClose):
+        (mathPowDoubleDouble1):
+        (mathPowDoubleInt1):
+        (test1):
+        (mathPowDoubleDouble2):
+        (mathPowDoubleInt2):
+        (test2):
+        (mathPowDoubleDouble3):
+        (mathPowDoubleInt3):
+        (test3):
+        (mathPowDoubleDouble4):
+        (mathPowDoubleInt4):
+        (test4):
+        (mathPowDoubleDouble5):
+        (mathPowDoubleInt5):
+        (test5):
+        (mathPowDoubleDouble6):
+        (mathPowDoubleInt6):
+        (test6):
+        (mathPowDoubleDouble7):
+        (mathPowDoubleInt7):
+        (test7):
+        (mathPowDoubleDouble8):
+        (mathPowDoubleInt8):
+        (test8):
+        (mathPowDoubleDouble9):
+        (mathPowDoubleInt9):
+        (test9):
+        (mathPowDoubleDouble10):
+        (mathPowDoubleInt10):
+        (test10):
+        (mathPowDoubleDouble11):
+        (mathPowDoubleInt11):
+        (test11):
+        * tests/stress/pow-coherency.js: Added.
+        (pow42):
+        (build42AsDouble.opaqueAdd):
+        (build42AsDouble):
+        (powDouble42):
+        (clobber):
+        (pow42NoConstantFolding):
+        (powDouble42NoConstantFolding):
+        * tests/stress/pow-evaluation-order.js: Added.
+        (shouldBe):
+        (throw.new.Error):
+        * tests/stress/pow-expects-update-expression-on-lhs.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (throw.new.Error):
+        (let.token.of.tokens.testSyntax.pow):
+        (testSyntax.pow):
+        * tests/stress/pow-integer-exponent-fastpath.js: Added.
+        (valuesAreClose):
+        (mathPowDoubleDoubleTestExponentFifty):
+        (mathPowDoubleIntTestExponentFifty):
+        (testExponentFifty):
+        (mathPowDoubleDoubleTestExponentTenThousands):
+        (mathPowDoubleIntTestExponentTenThousands):
+        (testExponentTenThousands):
+        * tests/stress/pow-nan-behaviors.js: Added.
+        (testIntegerBaseWithNaNExponentStatic):
+        (mathPowIntegerBaseWithNaNExponentDynamic):
+        (testIntegerBaseWithNaNExponentDynamic):
+        (testFloatingPointBaseWithNaNExponentStatic):
+        (mathPowFloatingPointBaseWithNaNExponentDynamic):
+        (testFloatingPointBaseWithNaNExponentDynamic):
+        (testNaNBaseStatic):
+        (mathPowNaNBaseDynamic1):
+        (mathPowNaNBaseDynamic2):
+        (mathPowNaNBaseDynamic3):
+        (mathPowNaNBaseDynamic4):
+        (testNaNBaseDynamic):
+        (infiniteExponentsStatic):
+        (mathPowInfiniteExponentsDynamic1):
+        (mathPowInfiniteExponentsDynamic2):
+        (mathPowInfiniteExponentsDynamic3):
+        (mathPowInfiniteExponentsDynamic4):
+        (infiniteExponentsDynamic):
+        * tests/stress/pow-simple.js: Added.
+        (shouldBe):
+        (throw.new.Error):
+        * tests/stress/pow-stable-results.js: Added.
+        (opaquePow):
+        (isIdentical):
+        * tests/stress/pow-to-number-should-be-executed-in-code-side.js: Added.
+        (shouldBe):
+        (throw.new.Error):
+        * tests/stress/pow-with-constants.js: Added.
+        (exponentIsZero):
+        (testExponentIsZero):
+        (exponentIsOne):
+        (testExponentIsOne):
+        (powUsedAsSqrt):
+        (testPowUsedAsSqrt):
+        (powUsedAsOneOverSqrt):
+        (testPowUsedAsOneOverSqrt):
+        (powUsedAsSquare):
+        (testPowUsedAsSquare):
+        (intIntConstantsSmallNumbers):
+        (intIntConstantsLargeNumbers):
+        (intIntSmallConstants):
+        (intDoubleConstants):
+        (doubleDoubleConstants):
+        (doubleIntConstants):
+        (testBaseAndExponentConstantLiterals):
+        (exponentIsIntegerConstant):
+        (testExponentIsIntegerConstant):
+        (exponentIsDoubleConstant):
+        (testExponentIsDoubleConstant):
+        (exponentIsInfinityConstant):
+        (testExponentIsInfinityConstant):
+        (exponentIsNegativeInfinityConstant):
+        (testExponentIsNegativeInfinityConstant):
+        * tests/stress/pow-with-never-NaN-exponent.js: Added.
+        (exponentIsNonNanDouble1):
+        (exponentIsNonNanDouble2):
+        (testExponentIsDoubleConstant):
+        * tests/test262.yaml:
+
+2016-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Switching on symbols should be fast
+        https://bugs.webkit.org/show_bug.cgi?id=158892
+
+        Reviewed by Keith Miller.
+        
+        This does two things: fixes some goofs in our lowering of symbol equality and adds a new phase
+        to B3 to infer switch statements from linear chains of branches.
+        
+        This changes how we compile equality to Symbols to constant-fold the load of the Symbol's UID.
+        This is necessary for making switches on Symbols inferrable. This also gives us the ability to
+        efficiently compile strict equality comparisons of SymbolUse and UntypedUse.
+
+        This adds a new phase to B3, which finds chains of branches that test for (in)equality on the
+        same value and constants, and turns them into a Switch. This can turn O(n) code into
+        O(log n) code, or even O(1) code if the switch cases are dense.
+        
+        This can make a big difference in JS. Say you write a switch in which the case statements are
+        variable resolutions. The bytecode generator cannot use a bytecode switch in this case, since
+        we're required to evaluate the resolutions in order. But in DFG IR, we will often turn those
+        variable resolutions into constants, since we do that for any immutable singleton. This means
+        that B3 will see a chain of Branches: the else case of one Branch will point to a basic block
+        that does nothing but Branch on equality on the same value as the first Branch.
+
+        The inference algorithm is quite simple. The basic building block is the ability to summarize
+        a block's switch behavior. For a block that ends in a switch, this is just the collection of
+        switch cases. For a block that ends in a branch, we recognize Branch(Equal(value, const)),
+        Branch(NotEqual(value, const)), and Branch(value). Each of these are summarized as if they
+        were one-case switches. We infer a new switch if both some block and its sole predecessor
+        can be described as switches on the same value, nothing shady is going on (like loops), and
+        the block in question does no work other than this switch. In that case, the block is killed
+        and its cases (which we get from the summary) are added to the predecessor's switch. This
+        algorithm runs to fixpoint.
+        
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3InferSwitches.cpp: Added.
+        (JSC::B3::inferSwitches):
+        * b3/B3InferSwitches.h: Added.
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::cfg):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::performSubstitution):
+        (JSC::B3::Value::isFree):
+        (JSC::B3::Value::dumpMeta):
+        * b3/B3Value.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckIdent):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        (JSC::FTL::DFG::LowerDFGToB3::lowSymbol):
+        (JSC::FTL::DFG::LowerDFGToB3::lowSymbolUID):
+        (JSC::FTL::DFG::LowerDFGToB3::lowNonNullObject):
+
+2016-07-20  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL snippet generators should be able to request a different register for output and input
+        https://bugs.webkit.org/show_bug.cgi?id=160010
+        rdar://problem/27439330
+
+        Reviewed by Saam Barati.
+        
+        The BitOr and BitXor snippet generators have problems if the register for the right input is
+        the same as the register for the result. We could fix those generators, but I'm not convinced
+        that the other snippet generators don't have this bug. So, the approach that this patch takes
+        is to teach the FTL to request that B3 to use a different register for the result than for
+        any input to the snippet patchpoint.
+        
+        Air already has the ability to let any instruction do an EarlyDef, which means exactly this.
+        But B3 did not expose this via ValueRep. This patch exposes this in ValueRep as
+        SomeEarlyRegister. That's most of the change.
+        
+        This adds a testb3 test for SomeEarlyRegister and a regression test for this particular
+        problem. The regression test failed on trunk JSC before this.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::forEachArg):
+        (JSC::B3::PatchpointSpecial::admitsStack):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        (JSC::B3::StackmapSpecial::isArgValidForRep):
+        * b3/B3Validate.cpp:
+        * b3/B3ValueRep.cpp:
+        (JSC::B3::ValueRep::addUsedRegistersTo):
+        (JSC::B3::ValueRep::dump):
+        (WTF::printInternal):
+        * b3/B3ValueRep.h:
+        (JSC::B3::ValueRep::ValueRep):
+        (JSC::B3::ValueRep::reg):
+        (JSC::B3::ValueRep::isAny):
+        (JSC::B3::ValueRep::isReg):
+        (JSC::B3::ValueRep::isSomeRegister): Deleted.
+        * b3/testb3.cpp:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet):
+        (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
+        (JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet):
+        * tests/stress/ftl-bit-xor-right-result-interference.js: Added.
+
+2016-07-20  Michael Saboff  <msaboff@apple.com>
+
+        CrashOnOverflow in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets
+        https://bugs.webkit.org/show_bug.cgi?id=159954
+
+        Reviewed by Benjamin Poulain.
+
+        YarrPatternConstructor::setupAlternativeOffsets() is using the checked arithmetic class
+        Checked<>, for offset calculations.  However the default use will just crash on
+        overflow.  Instead we should stop processing and propagate the error up the call stack.
+
+        Consolidated explicit error string with the common RegExp parsing error logic.
+        Moved that logic to YarrPattern as that seems like a better common place to put it.
+
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * tests/stress/regress-159954.js: New test.
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::isIdentityEscapeAnError):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parseCharacterClass):
+        (JSC::Yarr::Parser::parseParenthesesBegin):
+        (JSC::Yarr::Parser::parseParenthesesEnd):
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::disjunction):
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
+        (JSC::Yarr::YarrPatternConstructor::setupOffsets):
+        (JSC::Yarr::YarrPattern::errorMessage):
+        (JSC::Yarr::YarrPattern::compile):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::YarrPattern::reset):
+
+2016-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        The default testing mode should not involve disabling the FTL JIT
+        https://bugs.webkit.org/show_bug.cgi?id=159929
+
+        Rubber stamped by Mark Lam and Saam Barati.
+        
+        Use the new powers to make some tests run only in the default configuration (i.e. FTL,
+        concurrent JIT).
+
+        * tests/mozilla/mozilla-tests.yaml:
+
+2016-07-19  Keith Miller  <keith_miller@apple.com>
+
+        Test262 should have a file with the revision and url
+        https://bugs.webkit.org/show_bug.cgi?id=159937
+
+        Reviewed by Mark Lam.
+
+        The file.
+
+        * tests/test262/test262-Revision.txt: Added.
+
+2016-07-19  Anders Carlsson  <andersca@apple.com>
+
+        WebCore-7602.1.42 fails to build: error: private field 'm_vm' is not used
+        https://bugs.webkit.org/show_bug.cgi?id=159944
+        rdar://problem/27420308
+
+        Reviewed by Dan Bernstein.
+
+        Wrap the m_vm declaration and initialization in conditional guards.
+
+        * Scripts/builtins/builtins_generate_internals_wrapper_header.py:
+        (generate_members):
+        * Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
+        (BuiltinsInternalsWrapperImplementationGenerator.generate_constructor):
+        Add guards.
+
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+        Update expected results.
+
+2016-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION (r203348-r203368): ASSERTION FAILED: from.isCell() && from.asCell()->JSCell::inherits(std::remove_pointer<To>::type::info())
+        https://bugs.webkit.org/show_bug.cgi?id=159930
+
+        Reviewed by Geoffrey Garen.
+        
+        The problem is that the 32-bit DFG can flush the scope register as an unboxed cell, but the
+        Register::scope() method was causing us to assert that it's a JSValue with proper cell
+        boxing. We could have forced the DFG to flush it as a boxed JSValue, but I don't think that
+        would have made anything better. This fixes the issue by teaching Register::scope() that it
+        might see unboxed cells.
+
+        * runtime/JSScope.h:
+        (JSC::Register::scope):
+        (JSC::ExecState::lexicalGlobalObject):
+
+2016-07-19  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 methods that mutate the successors array should take FrequentedBlock by value
+        https://bugs.webkit.org/show_bug.cgi?id=159935
+
+        Reviewed by Michael Saboff.
+        
+        This bug was found by ASan testing. setSuccessors() takes a const FrequentedBlock&, and the
+        caller that caused the ASan crash was doing:
+
+        block->setSuccessors(block->notTaken())
+
+        So, inside setSuccessors(), after we resize() the successors array, the const
+        FrequentedBlock& points to nonsense.
+
+        The fix is to pass FrequentedBlock by value in all of these kinds of methods.
+        
+        No new tests, but ASan testing catches this instantly for anything that triggers CFG
+        simplification in B3. So like half of our tests.
+
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::clearSuccessors):
+        (JSC::B3::BasicBlock::appendSuccessor):
+        (JSC::B3::BasicBlock::setSuccessors):
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::successors):
+        (JSC::B3::BasicBlock::successorBlock):
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::replaceWithPhi):
+        (JSC::B3::Value::replaceWithJump):
+        (JSC::B3::Value::replaceWithOops):
+        * b3/B3Value.h:
+
+2016-07-18  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Make builtin TypeErrors consistent
+        https://bugs.webkit.org/show_bug.cgi?id=159899
+
+        Reviewed by Keith Miller.
+
+        Converge on the single TypeError for non-coercible this objects in builtins.
+        Also update some other style to be more consistent with-in builtins.
+
+        * builtins/ArrayIteratorPrototype.js:
+        (next):
+        * builtins/ArrayPrototype.js:
+        (values):
+        (keys):
+        (entries):
+        (reduce):
+        (reduceRight):
+        (every):
+        (forEach):
+        (filter):
+        (map):
+        (some):
+        (fill):
+        (find):
+        (findIndex):
+        (includes):
+        (sort):
+        (concatSlowPath):
+        (copyWithin):
+        * builtins/StringPrototype.js:
+        (match):
+        (repeat):
+        (padStart):
+        (padEnd):
+        (intrinsic.StringPrototypeReplaceIntrinsic.replace):
+        (localeCompare):
+        (search):
+        (split):
+        * tests/es6/String.prototype_methods_String.prototype.padEnd.js:
+        * tests/es6/String.prototype_methods_String.prototype.padStart.js:
+        * tests/stress/array-iterators-next-error-messages.js:
+        (catch):
+        * tests/stress/array-iterators-next-with-call.js:
+        * tests/stress/regexp-match.js:
+        (shouldThrow):
+        * tests/stress/regexp-search.js:
+        (shouldThrow):
+
+2016-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Implement table-based switches in B3/Air
+        https://bugs.webkit.org/show_bug.cgi?id=151141
+
+        Reviewed by Benjamin Poulain.
+
+        If a switch statement gets large, it's better to express it as an indirect jump rather than
+        using a binary switch (divide-and-conquer tree of comparisons leading to O(log n) branches to
+        get to the switch case). When dealing with integer switches, FTL will already use the B3
+        Switch and expect this to get lowered as efficiently as possible; it's a bug that B3 will
+        always use a binary switch rather than indirect jumps. When dealing with switches over some
+        more sophisticated types, we'd want FTL to build an indirect jump table itself and use
+        something like a hashtable to feed it. In that case, there will be no B3 Switch; we'll want
+        some way for the FTL to directly express an indirection jump when emitting B3.
+        
+        This implies that we want B3 to have the ability to lower Switch to indirect jumps and to
+        expose those indirect jumps in IR so that the FTL could do its own indirect jumps for
+        switches over more complicated things like strings. But indirect jumps are tough to express
+        in IR. For example, the LLVM approach ("indirectbr" and "blockaddress", see
+        http://blog.llvm.org/2010/01/address-of-label-and-indirect-branches.html) means that some
+        control flow edges cannot be split. Indirectbr takes an address as input and jumps to it, and
+        blockaddress lets you build jump tables out of basic block addresses. This means that the
+        compiler can never change any successor of an indirectbr, since the client will have already
+        arranged for that indirectbr to jump to exactly those successors. We don't want such
+        restrictions in B3, since B3 relies on being able to break critical edges for SSA conversion.
+        Also, indirectbr is not cloneable, which would break any hope of doing specialization-based
+        transformations like we want to do for multiple entrypoints (bug 159391). The goal of this
+        change is to let clients do indirect jumps without placing any restrictions on IR.
+        
+        The trick is to allow Patchpoints to be used as block terminals. Patchpoints already allow
+        clients of B3 to emit whatever code they like. Patchpoints are friendly to B3's other
+        transformations because the client of the patchpoint has to play along with whatever
+        decisions B3 had made around the patchpoint: what registers got used, what the control flow
+        looks like, etc. Patchpoints can even be cloned by B3, and the client has to accommodate this
+        in their patchpoint generator. It turns out that using Patchpoints as terminals is quite
+        natural. We accomplish this by moving the successor edges out of ControlValue and into
+        BasicBlock, and removing ControlValue entirely. This way, any Value subclass can be a
+        terminal. It was already true that a Value is a terminal if value->effects().terminal, which
+        works great with Patchpoints since they control their effects via PatchpointValue::effects.
+        You can make your Patchpoint into a terminal by placing it at the end of a block and doing:
+        
+        patchpoint->effects.terminal = true;
+        
+        A Patchpoints in terminal position gets access to additional API in StackmapGenerationParams.
+        The generator can get a Box<Label> for each successor to its owning block. For example, to
+        implement a jump-table-based switch, you would make your patchpoint take the table index as
+        its sole input. Inside the generator, you allocate the jump table and emit a BaseIndex jump
+        that uses the jump table pointer (which will be a constant known to the generator since it
+        just allocated it) as the base and the patchpoint input as an index. The jump table can be
+        populated by MacroAssemblerCodePtr's computed by installing a link task to resolve the labels
+        to concrete locations. This change makes LowerMacros do such a lowering for Switches that can
+        benefit from jump tables. This happens recursively: if the original Switch is too sparse, we
+        will divide-and-conquer as before. If at any recursion step we find that the remaining cases
+        are dense and large enough to profit from a jump table, then those cases will be lowered to a
+        Patchpoint that does the table jump. This is a fun way to do stepwise lowering: LowerMacros
+        is essentially pre-lowering the Switch directly to machine code, and wrapping that machine
+        code in a Patchpoint so that the rest of the compiler doesn't have to know anything about
+        what happened. I suspect that in the future we will want to do other pre-lowerings this way,
+        whenever the B3 IR phases have some special knowledge about what machine code should be
+        emitted and it would be annoying to drag that knowledge through the rest of the compiler.
+        
+        One downside of this change is that we used ControlValue in so many places. Most of this
+        patch involves removing references to ControlValue. It would be less than 100kb if it wasn't
+        for that. To make this a bit easier, I added "appendNewControlValue" methods to BasicBlock,
+        which allocate a Value and set the successors as if you had done "appendNew<ControlValue>".
+        This made for an easy search-and-replace in testb3 and FTLOutput. I filed bug 159440 to
+        remove this ugly stopgap method.
+        
+        I think that we will also end up using this facility to extend our use of snippets. We
+        already use shared snippet generators for the generic forms of arithmetic. We will probably
+        also want to do this for generic forms of branches. This wouldn't have been possible prior to
+        this change, since there would have been no way to emit a control snippet in FTL. Now we can
+        emit control snippets using terminal patchpoints.
+
+        This is a ~30% speed-up on microbenchmarks that have big switch statements (~60 cases). It's
+        not a speed-up on mainstream benchmarks.
+        
+        This also adds a new test to testb3 for terminal Patchpoints, Get, and Set. The FTL does not
+        currently use terminal Patchpoints directly, but we want this to be possible. It also doesn't
+        use Get/Set directly even though we want this to be possible. It's important to test these
+        since opcodes that result from lowering don't affect early phases, so we could have
+        regressions in early phases related to these opcodes that wouldn't be caught by any JS test.
+        So, this adds a very basic threaded interpreter to testb3 for a Brainfuck-style language, and
+        tests it by having it run a program that prints the numbers 1..100 in a loop. Unlike a real
+        threaded interpreter, it uses a common dispatch block rather than having dispatch at the
+        terminus of each opcode. That's necessary because PolyJump is not cloneable. The state of the
+        interpreter is represented using Variables that we Get and Set, so it tests Get/Set as well.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::jump):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::jump):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jmp_m):
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::append):
+        (JSC::B3::BasicBlock::appendNonTerminal):
+        (JSC::B3::BasicBlock::removeLast):
+        (JSC::B3::BasicBlock::appendIntConstant):
+        (JSC::B3::BasicBlock::clearSuccessors):
+        (JSC::B3::BasicBlock::appendSuccessor):
+        (JSC::B3::BasicBlock::setSuccessors):
+        (JSC::B3::BasicBlock::replaceSuccessor):
+        (JSC::B3::BasicBlock::addPredecessor):
+        (JSC::B3::BasicBlock::deepDump):
+        (JSC::B3::BasicBlock::appendNewControlValue):
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::numSuccessors):
+        (JSC::B3::BasicBlock::successor):
+        (JSC::B3::BasicBlock::successors):
+        (JSC::B3::BasicBlock::successorBlock):
+        (JSC::B3::BasicBlock::successorBlocks):
+        (JSC::B3::BasicBlock::numPredecessors):
+        (JSC::B3::BasicBlock::predecessor):
+        (JSC::B3::BasicBlock::frequency):
+        * b3/B3BasicBlockInlines.h:
+        (JSC::B3::BasicBlock::replaceLastWithNew):
+        (JSC::B3::BasicBlock::taken):
+        (JSC::B3::BasicBlock::notTaken):
+        (JSC::B3::BasicBlock::fallThrough):
+        (JSC::B3::BasicBlock::numSuccessors): Deleted.
+        (JSC::B3::BasicBlock::successor): Deleted.
+        (JSC::B3::BasicBlock::successors): Deleted.
+        (JSC::B3::BasicBlock::successorBlock): Deleted.
+        (JSC::B3::BasicBlock::successorBlocks): Deleted.
+        * b3/B3BlockInsertionSet.cpp:
+        (JSC::B3::BlockInsertionSet::splitForward):
+        * b3/B3BreakCriticalEdges.cpp:
+        (JSC::B3::breakCriticalEdges):
+        * b3/B3CaseCollection.cpp: Added.
+        (JSC::B3::CaseCollection::dump):
+        * b3/B3CaseCollection.h: Added.
+        (JSC::B3::CaseCollection::CaseCollection):
+        (JSC::B3::CaseCollection::operator[]):
+        (JSC::B3::CaseCollection::iterator::iterator):
+        (JSC::B3::CaseCollection::iterator::operator*):
+        (JSC::B3::CaseCollection::iterator::operator++):
+        (JSC::B3::CaseCollection::iterator::operator==):
+        (JSC::B3::CaseCollection::iterator::operator!=):
+        (JSC::B3::CaseCollection::begin):
+        (JSC::B3::CaseCollection::end):
+        * b3/B3CaseCollectionInlines.h: Added.
+        (JSC::B3::CaseCollection::fallThrough):
+        (JSC::B3::CaseCollection::size):
+        (JSC::B3::CaseCollection::at):
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::CheckSpecial):
+        (JSC::B3::CheckSpecial::hiddenBranch):
+        * b3/B3Common.h:
+        (JSC::B3::is64Bit):
+        * b3/B3ControlValue.cpp: Removed.
+        * b3/B3ControlValue.h: Removed.
+        * b3/B3DataSection.cpp:
+        (JSC::B3::DataSection::DataSection):
+        * b3/B3DuplicateTails.cpp:
+        * b3/B3FixSSA.cpp:
+        * b3/B3FoldPathConstants.cpp:
+        * b3/B3LowerMacros.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3MathExtras.cpp:
+        (JSC::B3::powDoubleInt32):
+        * b3/B3Opcode.h:
+        (JSC::B3::isConstant):
+        (JSC::B3::isDefinitelyTerminal):
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::generate):
+        (JSC::B3::PatchpointSpecial::isTerminal):
+        (JSC::B3::PatchpointSpecial::dumpImpl):
+        * b3/B3PatchpointSpecial.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::resetReachability):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::lastPhaseName):
+        (JSC::B3::Procedure::byproducts):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3StackmapGenerationParams.cpp:
+        (JSC::B3::StackmapGenerationParams::unavailableRegisters):
+        (JSC::B3::StackmapGenerationParams::successorLabels):
+        (JSC::B3::StackmapGenerationParams::fallsThroughToSuccessor):
+        (JSC::B3::StackmapGenerationParams::proc):
+        * b3/B3StackmapGenerationParams.h:
+        (JSC::B3::StackmapGenerationParams::gpScratch):
+        (JSC::B3::StackmapGenerationParams::fpScratch):
+        * b3/B3SwitchValue.cpp:
+        (JSC::B3::SwitchValue::~SwitchValue):
+        (JSC::B3::SwitchValue::removeCase):
+        (JSC::B3::SwitchValue::hasFallThrough):
+        (JSC::B3::SwitchValue::setFallThrough):
+        (JSC::B3::SwitchValue::appendCase):
+        (JSC::B3::SwitchValue::dumpSuccessors):
+        (JSC::B3::SwitchValue::dumpMeta):
+        (JSC::B3::SwitchValue::cloneImpl):
+        (JSC::B3::SwitchValue::SwitchValue):
+        * b3/B3SwitchValue.h:
+        (JSC::B3::SwitchValue::accepts):
+        (JSC::B3::SwitchValue::caseValues):
+        (JSC::B3::SwitchValue::cases):
+        (JSC::B3::SwitchValue::fallThrough): Deleted.
+        (JSC::B3::SwitchValue::size): Deleted.
+        (JSC::B3::SwitchValue::at): Deleted.
+        (JSC::B3::SwitchValue::operator[]): Deleted.
+        (JSC::B3::SwitchValue::iterator::iterator): Deleted.
+        (JSC::B3::SwitchValue::iterator::operator*): Deleted.
+        (JSC::B3::SwitchValue::iterator::operator++): Deleted.
+        (JSC::B3::SwitchValue::iterator::operator==): Deleted.
+        (JSC::B3::SwitchValue::iterator::operator!=): Deleted.
+        (JSC::B3::SwitchValue::begin): Deleted.
+        (JSC::B3::SwitchValue::end): Deleted.
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::replaceWithPhi):
+        (JSC::B3::Value::replaceWithJump):
+        (JSC::B3::Value::replaceWithOops):
+        (JSC::B3::Value::dump):
+        (JSC::B3::Value::deepDump):
+        (JSC::B3::Value::dumpSuccessors):
+        (JSC::B3::Value::negConstant):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::addFastTmp):
+        (JSC::B3::Air::Code::addDataSection):
+        (JSC::B3::Air::Code::jsHash):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::isFastTmp):
+        (JSC::B3::Air::Code::setLastPhaseName):
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::PatchCustom::shouldTryAliasingDef):
+        (JSC::B3::Air::PatchCustom::isTerminal):
+        (JSC::B3::Air::PatchCustom::hasNonArgNonControlEffects):
+        (JSC::B3::Air::PatchCustom::generate):
+        (JSC::B3::Air::CCallCustom::admitsStack):
+        (JSC::B3::Air::CCallCustom::isTerminal):
+        (JSC::B3::Air::CCallCustom::hasNonArgNonControlEffects):
+        (JSC::B3::Air::ShuffleCustom::admitsStack):
+        (JSC::B3::Air::ShuffleCustom::isTerminal):
+        (JSC::B3::Air::ShuffleCustom::hasNonArgNonControlEffects):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirGenerationContext.h:
+        * b3/air/AirInst.h:
+        (JSC::B3::Air::Inst::hasNonControlEffects):
+        * b3/air/AirSimplifyCFG.cpp:
+        (JSC::B3::Air::simplifyCFG):
+        * b3/air/AirSpecial.cpp:
+        (JSC::B3::Air::Special::shouldTryAliasingDef):
+        (JSC::B3::Air::Special::isTerminal):
+        (JSC::B3::Air::Special::hasNonArgNonControlEffects):
+        * b3/air/AirSpecial.h:
+        * b3/air/AirValidate.cpp:
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        * ftl/FTLLowerDFGToB3.cpp:
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::jump):
+        (JSC::FTL::Output::branch):
+        (JSC::FTL::Output::ret):
+        (JSC::FTL::Output::unreachable):
+        (JSC::FTL::Output::speculate):
+        (JSC::FTL::Output::trap):
+        (JSC::FTL::Output::anchor):
+        (JSC::FTL::Output::decrementSuperSamplerCount):
+        (JSC::FTL::Output::addIncomingToPhi):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::constIntPtr):
+        (JSC::FTL::Output::callWithoutSideEffects):
+        (JSC::FTL::Output::switchInstruction):
+        (JSC::FTL::Output::phi):
+        (JSC::FTL::Output::addIncomingToPhi):
+
+2016-07-18  Anders Carlsson  <andersca@apple.com>
+
+        WebKit nightly fails to build on macOS Sierra
+        https://bugs.webkit.org/show_bug.cgi?id=159902
+        rdar://problem/27365672
+
+        Reviewed by Tim Horton.
+
+        * icu/unicode/ucurr.h: Added.
+        Add ucurr.h from ICU.
+
+2016-07-18  Michael Saboff  <msaboff@apple.com>
+
+        ASSERTION FAILED: : (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0) -- WTF/wtf/DateMath.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=159883
+
+        Reviewed by Filip Pizlo.
+
+        New test.
+
+        * tests/stress/regress-159883.js: Added.
+
+2016-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        MarkedBlocks should know that they can be used for more than JSCells
+        https://bugs.webkit.org/show_bug.cgi?id=159643
+
+        Reviewed by Geoffrey Garen.
+        
+        This teaches the Heap that a MarkedBlock may hold either JSCells, or Auxiliary, which is
+        not a JSCell. It teaches the heap and all of the things that walk the heap to ignore
+        non-JSCells whenever they are looking for global objects, JSObjects, and things to trace
+        for debugging or profiling. The idea is that we will be able to allocate butterflies and
+        typed array backing stores as Auxiliary in MarkedSpace rather than allocating those things
+        in CopiedSpace. That's what bug 159658 is all about.
+        
+        This gives us a new type, called HeapCell, which is just meant to be a class distinct from
+        JSCell or any type we would use for Auxiliary. For convenience, JSCell is a subclass of
+        HeapCell. HeapCell has an enum called HeapCell::Kind, which is either HeapCell::JSCell or
+        HeapCell::Auxiliary. MarkedSpace no longer speaks of JSCells directly except when dealing
+        with destruction.
+        
+        This change required doing a lot of stuff to all of those functor callbacks, since they
+        now take HeapCell* instead of JSCell* and they take an extra HeapCell::Kind argument to
+        tell them if they are dealing with JSCells or Auxiliary. I figured that this would be as
+        good a time as any to convert those functors to being lambda-compatible. This means that
+        operator() must be const. In some cases, converting the operator() to be const would have
+        taken more work than just turning the whole thing into a lambda. Whenever this was the
+        case, I converted the code to use lambdas. I left a lot of functors alone. In cases where
+        the functor would benefit from being a lambda, for example because it would get rid of
+        const_casts or mutables, I put in a FIXME referencing bug 159644.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::SetSteppingModeFunctor::SetSteppingModeFunctor):
+        (JSC::Debugger::SetSteppingModeFunctor::operator()):
+        (JSC::Debugger::ToggleBreakpointFunctor::ToggleBreakpointFunctor):
+        (JSC::Debugger::ToggleBreakpointFunctor::operator()):
+        (JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor::ClearCodeBlockDebuggerRequestsFunctor):
+        (JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor::operator()):
+        (JSC::Debugger::ClearDebuggerRequestsFunctor::ClearDebuggerRequestsFunctor):
+        (JSC::Debugger::ClearDebuggerRequestsFunctor::operator()):
+        * heap/CodeBlockSet.h:
+        (JSC::CodeBlockSet::iterate):
+        * heap/HandleSet.h:
+        (JSC::HandleNode::next):
+        (JSC::HandleSet::forEachStrongHandle):
+        * heap/Heap.cpp:
+        (JSC::GatherHeapSnapshotData::GatherHeapSnapshotData):
+        (JSC::GatherHeapSnapshotData::operator()):
+        (JSC::RemoveDeadHeapSnapshotNodes::RemoveDeadHeapSnapshotNodes):
+        (JSC::RemoveDeadHeapSnapshotNodes::operator()):
+        (JSC::Heap::protectedGlobalObjectCount):
+        (JSC::Heap::globalObjectCount):
+        (JSC::Heap::protectedObjectCount):
+        (JSC::Heap::protectedObjectTypeCounts):
+        (JSC::Heap::objectTypeCounts):
+        (JSC::Heap::deleteAllCodeBlocks):
+        (JSC::MarkedBlockSnapshotFunctor::MarkedBlockSnapshotFunctor):
+        (JSC::MarkedBlockSnapshotFunctor::operator()):
+        (JSC::Zombify::visit):
+        (JSC::Zombify::operator()):
+        (JSC::Heap::zombifyDeadObjects):
+        (JSC::Heap::flushWriteBarrierBuffer):
+        * heap/Heap.h:
+        (JSC::Heap::handleSet):
+        (JSC::Heap::handleStack):
+        * heap/HeapCell.cpp: Added.
+        (WTF::printInternal):
+        * heap/HeapCell.h: Added.
+        (JSC::HeapCell::HeapCell):
+        (JSC::HeapCell::zap):
+        (JSC::HeapCell::isZapped):
+        * heap/HeapInlines.h:
+        (JSC::Heap::deprecatedReportExtraMemory):
+        (JSC::Heap::forEachCodeBlock):
+        (JSC::Heap::forEachProtectedCell):
+        (JSC::Heap::allocateWithDestructor):
+        * heap/HeapStatistics.cpp:
+        (JSC::StorageStatistics::visit):
+        (JSC::StorageStatistics::operator()):
+        * heap/HeapVerifier.cpp:
+        (JSC::GatherLiveObjFunctor::visit):
+        (JSC::GatherLiveObjFunctor::operator()):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateBlock):
+        (JSC::MarkedAllocator::addBlock):
+        (JSC::MarkedAllocator::reset):
+        (JSC::MarkedAllocator::lastChanceToFinalize):
+        (JSC::LastChanceToFinalize::operator()): Deleted.
+        * heap/MarkedAllocator.h:
+        (JSC::MarkedAllocator::takeLastActiveBlock):
+        (JSC::MarkedAllocator::resumeAllocating):
+        (JSC::MarkedAllocator::forEachBlock):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::create):
+        (JSC::MarkedBlock::destroy):
+        (JSC::MarkedBlock::MarkedBlock):
+        (JSC::MarkedBlock::callDestructor):
+        (JSC::MarkedBlock::specializedSweep):
+        (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor):
+        (JSC::SetNewlyAllocatedFunctor::operator()):
+        (JSC::MarkedBlock::stopAllocating):
+        (JSC::MarkedBlock::didRetireBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::CountFunctor::CountFunctor):
+        (JSC::MarkedBlock::CountFunctor::count):
+        (JSC::MarkedBlock::CountFunctor::returnValue):
+        (JSC::MarkedBlock::needsDestruction):
+        (JSC::MarkedBlock::cellKind):
+        (JSC::MarkedBlock::size):
+        (JSC::MarkedBlock::clearNewlyAllocated):
+        (JSC::MarkedBlock::isMarkedOrNewlyAllocated):
+        (JSC::MarkedBlock::isLive):
+        (JSC::MarkedBlock::isLiveCell):
+        (JSC::MarkedBlock::forEachCell):
+        (JSC::MarkedBlock::forEachLiveCell):
+        (JSC::MarkedBlock::forEachDeadCell):
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::~MarkedSpace):
+        (JSC::MarkedSpace::lastChanceToFinalize):
+        (JSC::MarkedSpace::sweep):
+        (JSC::MarkedSpace::zombifySweep):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::visitWeakSets):
+        (JSC::MarkedSpace::reapWeakSets):
+        (JSC::MarkedSpace::forEachAllocator):
+        (JSC::MarkedSpace::stopAllocating):
+        (JSC::MarkedSpace::resumeAllocating):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::shrink):
+        (JSC::clearNewlyAllocatedInBlock):
+        (JSC::MarkedSpace::clearNewlyAllocated):
+        (JSC::MarkedSpace::clearMarks):
+        (JSC::Free::Free): Deleted.
+        (JSC::Free::operator()): Deleted.
+        (JSC::FreeOrShrink::FreeOrShrink): Deleted.
+        (JSC::FreeOrShrink::operator()): Deleted.
+        (JSC::VisitWeakSet::VisitWeakSet): Deleted.
+        (JSC::VisitWeakSet::operator()): Deleted.
+        (JSC::ReapWeakSet::operator()): Deleted.
+        (JSC::LastChanceToFinalize::operator()): Deleted.
+        (JSC::StopAllocatingFunctor::operator()): Deleted.
+        (JSC::ResumeAllocatingFunctor::operator()): Deleted.
+        (JSC::ClearNewlyAllocated::operator()): Deleted.
+        (JSC::VerifyNewlyAllocated::operator()): Deleted.
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::forEachLiveCell):
+        (JSC::MarkedSpace::forEachDeadCell):
+        (JSC::MarkedSpace::allocatorFor):
+        (JSC::MarkedSpace::allocateWithDestructor):
+        (JSC::MarkedSpace::forEachBlock):
+        (JSC::MarkedSpace::didAddBlock):
+        (JSC::MarkedSpace::objectCount):
+        (JSC::MarkedSpace::size):
+        (JSC::MarkedSpace::capacity):
+        (JSC::ClearMarks::operator()): Deleted.
+        (JSC::Sweep::operator()): Deleted.
+        (JSC::ZombifySweep::operator()): Deleted.
+        (JSC::MarkCount::operator()): Deleted.
+        (JSC::Size::operator()): Deleted.
+        * runtime/JSCell.h:
+        (JSC::JSCell::zap): Deleted.
+        (JSC::JSCell::isZapped): Deleted.
+        * runtime/JSCellInlines.h:
+        (JSC::allocateCell):
+        (JSC::JSCell::isObject):
+        (JSC::isZapped): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::CellAddressCheckFunctor::CellAddressCheckFunctor):
+        (JSC::CellAddressCheckFunctor::operator()):
+
+2016-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Repeatedly creating and destroying workers that enqueue DFG plans can outpace the DFG worklist, which then causes VM shutdown to stall, which then causes memory growth
+        https://bugs.webkit.org/show_bug.cgi?id=159754
+
+        Reviewed by Geoffrey Garen.
+        
+        If you create and destroy workers at a high rate and those workers enqueue some DFG plans
+        that are still not compiled at the time that the worker is closed, then the closed workers
+        end up stalling in VM::~VM waiting for the DFG worklist thread to finish those plans. Since
+        we don't actually cancel the plans, it's easy to create a situation where the workers
+        outpace the DFG worklist, especially if you create many workers at a time and each one
+        finishes just after enqueueing those plans.
+        
+        The solution is to allow VM::~VM to remove plans from the DFG worklist that are related to
+        that VM but aren't currently being worked on. That turns out to be an easy change.
+        
+        I have a test that repros this, but it's quite long-running. I call it workers/bomb.html. We
+        may want to exclude it from test runs because of how long it takes.
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::removeDeadPlans):
+        (JSC::DFG::Worklist::removeNonCompilingPlansForVM):
+        (JSC::DFG::Worklist::queueLength):
+        (JSC::DFG::Worklist::runThread):
+        * dfg/DFGWorklist.h:
+        * runtime/VM.cpp:
+        (JSC::VM::~VM):
+
+2016-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Object.preventExtensions/seal/freeze makes code much slower
+        https://bugs.webkit.org/show_bug.cgi?id=143247
+
+        Reviewed by Michael Saboff.
+        
+        This has been a huge pet peeve of mine for a long time, but I was always afraid of fixing
+        it because I thought that it would be hard. Well, it looks like it's not hard at all.
+        
+        The problem is that you cannot mutate a structure that participates in transition caching.
+        You can only clone the structure and mutate that one. But if you do this, you have to make
+        a hard choice:
+        
+        1) Clone the structure without caching the transition. This is what the code did before
+           this change. It's the most obvious choice, but it introduces an uncacheable transition
+           that leads to an explosion of structures, which then breaks all inline caches.
+        
+        2) Perform one of the existing cacheable transitions. Cacheable transitions can either add
+           properties or they can do one of the NonPropertyTransitions, which until now have been
+           restricted to just IndexingType transitions. So, only adding transitions or making
+           certain prescribed changes to the indexing type count as cacheable transitions.
+        
+        This change decouples NonPropertyTransition from IndexingType and adds three new kinds of
+        transitions: PreventExtensions, Seal, and Freeze. We have to give any cacheable transition
+        a name that fully disambiguates this transition from any other, so that the transition can
+        be cached. Since we're already giving them names in an enum, I figured that the most
+        pragmatic way to implement them is to have Structure::nonPropertyTransition() case on the
+        NonPropertyTransition and implement all of the mutations associated with that transition.
+        The alternative would have been to allow callers of nonPropertyTransition() to supply
+        something like a lambda that describes the mutation, but this seemed awkward since each
+        set of mutations has to anyway be tied to one of the NonPropertyTransition members.
+        
+        This is an enormous speed-up on microbenchmarks that use Object.preventExtensions(),
+        Object.seal(), or Object.freeze(). I don't know if "real" benchmarks use these features
+        and I don't really care. This should be fast.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::notifyPresenceOfIndexedAccessors):
+        (JSC::JSObject::createInitialUndecided):
+        (JSC::JSObject::createInitialInt32):
+        (JSC::JSObject::createInitialDouble):
+        (JSC::JSObject::createInitialContiguous):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::convertDoubleToContiguous):
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        * runtime/Structure.cpp:
+        (JSC::Structure::suggestedArrayStorageTransition):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::toUncacheableDictionaryTransition):
+        (JSC::Structure::sealTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::pin):
+        (JSC::Structure::pinForCaching):
+        (JSC::Structure::allocateRareData):
+        * runtime/Structure.h:
+        * runtime/StructureTransitionTable.h:
+        (JSC::toAttributes):
+        (JSC::changesIndexingType):
+        (JSC::newIndexingType):
+        (JSC::preventsExtensions):
+        (JSC::setsDontDeleteOnAllProperties):
+        (JSC::setsReadOnlyOnAllProperties):
+
+2016-07-17  Filip Pizlo  <fpizlo@apple.com>
+
+        RegisterSet should use a Bitmap instead of a BitVector so that it never allocates memory and is trivial to copy
+        https://bugs.webkit.org/show_bug.cgi?id=159863
+
+        Reviewed by Saam Barati.
+        
+        Switch RegisterSet set to Bitmap because Bitmap doesn't ever allocate memory and can be
+        assigned by memcpy. This should be a performance improvement for compiler code that does a
+        lot of things with RegisterSet. For example, it's one of the fundamental data structures in
+        Air. The previous use of BitVector meant that almost every operation on RegisterSet would
+        have a slow path call. On ARM64, it would mean memory allocation for any RegisterSet that
+        used all available registers.
+        
+        This meant adding even more GPR/FPR reflection to the MacroAssembler API: we now have consts
+        called numGPRs and numFPRs. This is necessary to statically size the Bitmap in RegisterSet.
+        
+        Here's the breakdown of sizes of RegisterSet on different CPUs:
+        
+        x86-32: 8 bits (GPRs) + 8 bits (FPRs) + 1 bit (is deleted) = 1x uint32_t.
+        x86-64: 16 bits + 16 bits + 1 bit = 2x uint32_t.
+        ARMv7: 16 bits + 16 bits + 1 bit = 2x uint32_t.
+        ARM64: 32 bits + 32 bits + 1 bit = 3x uint32_t.
+
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARM64.h:
+        * assembler/MacroAssemblerARMv7.h:
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::scratchRegister):
+        * assembler/MacroAssemblerX86_64.h:
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::set):
+        (JSC::RegisterSet::get):
+        (JSC::RegisterSet::setAll):
+        (JSC::RegisterSet::merge):
+        (JSC::RegisterSet::filter):
+        (JSC::RegisterSet::exclude):
+        (JSC::RegisterSet::numberOfSetRegisters):
+        (JSC::RegisterSet::RegisterSet):
+        (JSC::RegisterSet::isEmptyValue):
+        (JSC::RegisterSet::isDeletedValue):
+        (JSC::RegisterSet::operator==):
+        (JSC::RegisterSet::operator!=):
+        (JSC::RegisterSet::hash):
+        (JSC::RegisterSet::forEach):
+        (JSC::RegisterSet::setMany):
+
+2016-07-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG and FTL should support op_call_eval
+        https://bugs.webkit.org/show_bug.cgi?id=159786
+
+        Reviewed by Saam Barati.
+        
+        This adds support for op_call_eval in DFG and FTL by brute force:
+        
+        - There is now a CallEval() node type, which compiles exactly the same way that we do in
+          baseline.
+        
+        - We teach the DFG and bytecode liveness that the scope register and 'this' are read by
+          CallEval()/op_call_eval.
+        
+        We can compile eval quite well, except that right now we cannot inline functions that use
+        eval. It would be nice to do that, but the payoff is probably smaller. "Don't inline users
+        of eval" may even be an OK inlining heuristic. Not inlining users of eval allows me to
+        reuse the baseline implementation, which is really great. Otherwise, I'd have to get rid
+        of things like the rogue reads of scope register and 'this'.
+        
+        The goal here is to produce speed-ups for code that has functions that do both eval and
+        some computational stuff. Obviously, we're not producing any benefit for the eval itself.
+        But now the other stuff in a function that uses eval will get to participate in
+        optimization.
+        
+        This is a huge speed-up on microbenchmarks.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printCallOp):
+        (JSC::CodeBlock::dumpBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::setArgument):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::needsScopeRegister):
+        (JSC::DFG::Graph::needsFlushedThis):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLoadVarargs):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::emitDumbVirtualCall):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitTypeOf):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileCallEvalSlowCase):
+        * jit/JITOperations.cpp:
+        * tests/stress/exit-then-eval.js: Added.
+        (foo):
+        * tests/stress/force-exit-then-eval-dfg.js: Added.
+        (foo):
+        * tests/stress/force-exit-then-eval.js: Added.
+        (foo):
+
+2016-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should really support jneq_ptr
+        https://bugs.webkit.org/show_bug.cgi?id=159700
+
+        Reviewed by Keith Miller.
+        
+        Prior to this change, DFG statically speculated that jneq_ptr would always fall through. This
+        meant that programs that called o.apply() or o.call() where apply or call weren't the
+        expected ones (i.e. the function.prototype.apply/call) would rage-recompile forever.
+        
+        This adds profiling to jneq_ptr. We now know if it always falls through or sometimes doesn't.
+        If it sometimes doesn't, we now emit an actual control flow diamond. I decided to add a new
+        NodeType for "equal pointer", since none of the existing ones really captured that. For
+        example, there was no way to express "equal pointer" for strings or symbols. We don't use it
+        for that right now, but we might, and if we did, then it would be hugely surprising that the
+        DFG interpreted this as value equality. So, the DFG now has CompareEqPtr, which means exactly
+        what jneq_ptr means by "equal pointer".
+        
+        This is an enormous speed-up on microbenchmarks. I would assume that it's a speed-up on some
+        real things, too, but I don't know that for a fact.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCellOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileRecordRegExpCachedResult):
+        (JSC::DFG::SpeculativeJIT::compileCompareEqPtr):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareEqPtr):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareLess):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEqConstant): Deleted.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_eq):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_eq):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2016-07-12  Filip Pizlo  <fpizlo@apple.com>
+
+        OSR entry into DFG has problems with lexical scoping
+        https://bugs.webkit.org/show_bug.cgi?id=159687
+
+        Reviewed by Saam Barati.
+        
+        What a fun bug! It turns out that uses of lexical scoping, like "let", may sometimes cause us
+        to not be able to OSR enter into a loop from baseline to DFG. The bug is in a mitigation for
+        a different bug, which in turn had a mitigation for yet another bug, so the story here is a
+        long one.
+        
+        DFG OSR entry has long had a mitigation for the following bug: the DFG bytecode parser may
+        choose to make us always OSR exit at some instruction if it thinks that it doesn't have
+        enough profiling for that instruction. We will do this if some kinds of put_by_id only
+        execute once, for example. This causes problems for loopy benchmarks like this:
+        
+            put_by_id(something crazy);
+            for (var i = 0; i < bigNumber; ++i) simpleMath;
+        
+        In this case, the put_by_id will have only executed once, and since it did something crazy
+        that one time, the bytecode parser will replace it with ForceOSRExit.
+        
+        This creates an OSR entry bug: DFG CFA will then prove that the loop is unreachable, and will
+        tell OSR entry that it's impossible to enter into that loop.
+        
+        We mitigated this bug a long time ago by recording mustHandleValues for loops at which we
+        want to enter. We inject these values into DFG CFA and we force CFA to recognize that the
+        loop is reachable even if CFA wanted to prove that it wasn't.
+        
+        But this leads to another bug: we need to scrape the values from the stack inside
+        operationOptimize() and then we need to reason about them in the compiler. Some of those
+        values may be garbage, which would cause pandemonium inside the compiler. We also mitigated
+        this bug, by only recording the "vars", since those are guaranteed to be reset by op_enter.
+        
+        And that's where the lexical scoping bug happens: "let" bound variables aren't part of the
+        "vars". DFG will see that they are live, but mustHandleValues will not have anything for
+        those variables, so CFA will prove that the values are Bottom. Then OSR entry will always
+        fail because no value is ever a subset of Bottom.
+        
+        The first part of the fix is to ensure that mustHandleValues record all of the values on the
+        stack (i.e. within m_numCalleeLocals, rather than just m_numVars). But this creates a second
+        problem: we may record garbage. This patch includes a better fix for the garbage: before
+        touching mustHandleValues we run the bytecode liveness analysis and clear any values that are
+        not live. This ensures that we clear the garbage.
+        
+        This is an enormous speed-up on microbenchmarks that use lexical scoping and have some crazy
+        put_by_id in the lead-up to the hot loop.
+
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::run):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        (JSC::DFG::Plan::cancel):
+        (JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
+        * dfg/DFGPlan.h:
+        (JSC::DFG::Plan::canTierUpAndOSREnter):
+        * jit/JITOperations.cpp:
+
+2016-07-18  Youenn Fablet  <youenn@apple.com>
+
+        REGRESSION(r202975): --minimal build is broken
+        https://bugs.webkit.org/show_bug.cgi?id=159765
+
+        Reviewed by Chris Dumez.
+
+        Covered partially by builtin generated test code.
+
+        Updating generator to add a global compilation guard around the code that generates all global internal properties.
+        Split the generate_methods function in two, one dedicated to the visit method and the second one dedicated to
+        the initialize method.
+
+        * Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
+        (BuiltinsInternalsWrapperImplementationGenerator.generate_section_for_object): Use splitted generation functions.
+        (BuiltinsInternalsWrapperImplementationGenerator.generate_visit_method): Response to generate the visit method.
+        (BuiltinsInternalsWrapperImplementationGenerator._generate_initialize_static_globals): Responsible to generate
+        the code to initialize the internal globals. This code is put in a global compilation guard in case all
+        internals are compiled out by specific builds.
+        (BuiltinsInternalsWrapperImplementationGenerator):
+        (BuiltinsInternalsWrapperImplementationGenerator.generate_initialize_method): Responsible to generate the
+        initialize method.
+        (BuiltinsInternalsWrapperImplementationGenerator.generate_methods): Deleted.
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Copyright change.
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Reflects partially the built-in
+        generator change.
+
+2016-07-18  Keith Miller  <keith_miller@apple.com>
+
+        Fix bad assertions in genericTypedArrayViewPrivateFuncSubarrayCreate
+        https://bugs.webkit.org/show_bug.cgi?id=159882
+        <rdar://problem/27327111>
+
+        Reviewed by Mark Lam.
+
+        According the spec toInteger can return values we don't consider ints.
+        Such as, -0 and +/-Infinity. This broke some assertions in
+        genericTypedArrayViewPrivateFuncSubarrayCreate.
+
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * tests/stress/typedarray-subarray.js:
+
+2016-07-16  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG CSE is broken for MultiGetByOffset
+        https://bugs.webkit.org/show_bug.cgi?id=159858
+
+        Reviewed by Saam Barati.
+        
+        This disabled CSE for MultiGetByOffset. I opened bug 159859 for the long-term fix, which
+        would teach CSE (and other passes also) how to decay a removed MultiGetByOffset to a
+        CheckStructure. Since we currently just decay MultiGetByOffset to Check, we forget the
+        structure checks. So, if we CSE a MultiGetByOffset that checks for one set of structures with
+        a heap access on the same property and base that checks for different structures, then we
+        will forget some structure checks that we had previously. It's unsound to forget checks in
+        DFG IR.
+        
+        This bug mostly manifested as a high-volume crash at Unreachable in FTL, because we'd prove
+        that the code after the MultiGetByOffset was unreachable due to the structure checks and then
+        CSE would remove everything but the Unreachable.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): Remove the def() for MultiGetByOffset to disable CSE for this node for now.
+        * tests/stress/cse-multi-get-by-offset-remove-checks.js: Added. This used to fail with FTL enabled.
+        (Cons1):
+        (Cons2):
+        (Cons3):
+        (foo):
+        (bar):
+
+2016-07-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Enable test262 module tests
+        https://bugs.webkit.org/show_bug.cgi?id=159854
+
+        Reviewed by Saam Barati.
+
+        This patch enables test262 module tests. Before this patch, the modules tests in test262 do not work fine.
+        This patch fixes the following 2 things.
+
+        1. Test harness
+
+            Before this patch, there is only one global switch "-m" in jsc shell. So we cannot load the test262 test harness before evaluating the module tests.
+            This patch adds a new option, "--module-file=". It is similar to "--strict-file=". When we specify the file with "--module-file=", it is evaluated as
+            a module, while the other files are evaluated by following the JSC's default manner. This option allows us to load the test harness files into the
+            global context before loading the module tests.
+
+        2. Module's asynchronous errors
+
+            Before this patch, the errors caused in the module evaluation are not handled as the same to the usual sync files. In synchronous execution, we have
+            "--exception=" option to pass the expected exception to the JSC shell. But this option does not work in the module evaluation.
+            This patch correctly handles this expected exception in the module evaluation promise's fulfill and reject handlers.
+
+        And we fix the YAML file. Now the recorded :fail and :normal are the correct test results for the module tests.
+
+        * jsc.cpp:
+        (Script::Script):
+        (checkUncaughtException):
+        (runWithScripts):
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        (dumpException): Deleted.
+        * tests/test262.yaml:
+
+2016-07-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Mask TrustedImm32 to 8bit in MacroAssembler for 8bit operations
+        https://bugs.webkit.org/show_bug.cgi?id=159334
+
+        Reviewed by Filip Pizlo.
+
+        Previously, in 8bit operations (like add8, compare8, test8, branch8, branchTest8 etc.),
+        we require that the given TrustedImm32 is in range of 8bit. While achieving this in
+        the manual MacroAssembler calling is easy, in Air, we don't guarantee that the higher bit
+        of the 8bit argument is cleared. So the current assertions are invalid.
+
+        This patch relaxes the above restriction. By removing this assertion,
+        8bit operations can take arbitrary 32bit imms. And only lower 8bit are effective when
+        emitting the code in these methods.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::branchTest8):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::store8):
+        (JSC::MacroAssemblerARM::branch8):
+        (JSC::MacroAssemblerARM::branchTest8):
+        (JSC::MacroAssemblerARM::compare8):
+        (JSC::MacroAssemblerARM::test8):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::store8):
+        (JSC::MacroAssemblerARM64::branch8):
+        (JSC::MacroAssemblerARM64::branchTest8):
+        (JSC::MacroAssemblerARM64::compare8):
+        (JSC::MacroAssemblerARM64::test8):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::store8):
+        (JSC::MacroAssemblerARMv7::branch8):
+        (JSC::MacroAssemblerARMv7::branchTest8):
+        (JSC::MacroAssemblerARMv7::compare8):
+        (JSC::MacroAssemblerARMv7::test8):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::store8):
+        (JSC::MacroAssemblerMIPS::branch8):
+        (JSC::MacroAssemblerMIPS::compare8):
+        (JSC::MacroAssemblerMIPS::branchTest8):
+        (JSC::MacroAssemblerMIPS::test8):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::store8):
+        (JSC::MacroAssemblerSH4::branchTest8):
+        (JSC::MacroAssemblerSH4::branch8):
+        (JSC::MacroAssemblerSH4::compare8):
+        (JSC::MacroAssemblerSH4::test8):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::store8):
+        (JSC::MacroAssemblerX86::branch8):
+        (JSC::MacroAssemblerX86::branchTest8):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add8):
+        (JSC::MacroAssemblerX86Common::store8):
+        (JSC::MacroAssemblerX86Common::branch8):
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::compare8):
+        (JSC::MacroAssemblerX86Common::test8):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::store8):
+        (JSC::MacroAssemblerX86_64::branch8):
+        (JSC::MacroAssemblerX86_64::branchTest8):
+
+2016-07-16  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r203318.
+
+        Regressed most JS Benchmarks on MacBook Air by ~2% (7% on
+        SunSpider)
+
+        Reverted changeset:
+
+        "[JSC] Change some parameters based on a random search"
+        https://bugs.webkit.org/show_bug.cgi?id=158514
+        http://trac.webkit.org/changeset/203318
+
+2016-07-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Convert the remaining createOutOfMemoryError()+throwException() into throwOutOfMemoryError()
+        https://bugs.webkit.org/show_bug.cgi?id=159665
+
+        Reviewed by Saam Barati.
+
+        * API/JSTypedArray.cpp:
+        (createTypedArray):
+        * runtime/Error.cpp:
+        (JSC::createOutOfMemoryError):
+        * runtime/Error.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::create):
+        (JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
+
+2016-07-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Change some parameters based on a random search
+        https://bugs.webkit.org/show_bug.cgi?id=158514
+
+        Reviewed by Saam Barati.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::optimizationThresholdScalingFactor):
+        * runtime/Options.h:
+
+2016-07-15  Mark Lam  <mark.lam@apple.com>
+
+        Assertion failures and crashes with missing TDZ checks for catch-node bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=158797
+
+        Reviewed by Saam Barati.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        (JSC::BytecodeGenerator::emitPopCatchScope):
+        * tests/stress/catch-clause-should-be-under-tdz1.js: Added.
+        * tests/stress/catch-clause-should-be-under-tdz2.js: Added.
+        * tests/stress/catch-clause-should-be-under-tdz3.js: Added.
+        * tests/stress/catch-clause-should-be-under-tdz4.js: Added.
+        * tests/stress/catch-clause-should-be-under-tdz5.js: Added.
+
+2016-07-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Added a makeRef<T> helper
+        https://bugs.webkit.org/show_bug.cgi?id=159835
+
+        Reviewed by Andreas Kling.
+
+        Anders told me to!
+
+        * inspector/InjectedScriptHost.cpp:
+        (Inspector::InjectedScriptHost::wrapper):
+
+2016-07-15  Mark Lam  <mark.lam@apple.com>
+
+        FunctionOverride's parseClause() needs to keep the CString instance in scope while its data is being used.
+        https://bugs.webkit.org/show_bug.cgi?id=159828
+
+        Reviewed by Saam Barati.
+
+        Otherwise, we'll have a use after free.  This issue was caught when running an
+        ASan debug build of testapi.
+
+        * tools/FunctionOverrides.cpp:
+        (JSC::parseClause):
+
+2016-07-15  Keith Miller  <keith_miller@apple.com>
+
+        %TypedArray%.prototype.indexOf is coercing non-integers or non-floats to numbers wrongly
+        https://bugs.webkit.org/show_bug.cgi?id=159400
+
+        Reviewed by Geoffrey Garen.
+
+        This patch fixes coercion of non-numbers in indexOf/lastIndexOf.
+        Additionally, this patch fixes an issue with includes where it
+        would not check that the buffer remained non-neutered after
+        calling the toInteger() function. Lastly, some extra release
+        asserts have been added in some places to inform us of any issues
+        in the future.
+
+        Additionally, this patch changes bool toNativeFromDouble to
+        Optional<Type> toNativeFromDoubleWithoutCoercion. This makes it a
+        little clearer what the function does and also removes the return
+        argument. The only behavior change is that the function no longer
+        coerces non-numbers into numbers. That behavior was unused (maybe
+        unintended), however.
+
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValueWithoutCoercion):
+        (JSC::JSGenericTypedArrayView::sort):
+        (JSC::JSGenericTypedArrayView::toAdaptorNativeFromValue): Deleted.
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncIncludes):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        * runtime/ToNativeFromValue.h:
+        (JSC::toNativeFromValueWithoutCoercion):
+        (JSC::toNativeFromValue): Deleted.
+        * runtime/TypedArrayAdaptors.h:
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32WithoutCoercion):
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
+        (JSC::FloatTypedArrayAdaptor::toNativeFromInt32WithoutCoercion):
+        (JSC::FloatTypedArrayAdaptor::toNativeFromDoubleWithoutCoercion):
+        (JSC::Uint8ClampedAdaptor::toNativeFromInt32WithoutCoercion):
+        (JSC::Uint8ClampedAdaptor::toNativeFromDoubleWithoutCoercion):
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromInt32): Deleted.
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromUint32): Deleted.
+        (JSC::IntegralTypedArrayAdaptor::toNativeFromDouble): Deleted.
+        (JSC::FloatTypedArrayAdaptor::toNativeFromInt32): Deleted.
+        (JSC::FloatTypedArrayAdaptor::toNativeFromDouble): Deleted.
+        (JSC::Uint8ClampedAdaptor::toNativeFromInt32): Deleted.
+        (JSC::Uint8ClampedAdaptor::toNativeFromDouble): Deleted.
+        * tests/stress/resources/typedarray-test-helper-functions.js:
+        * tests/stress/typedarray-functions-with-neutered.js:
+        (callWithArgs):
+        * tests/stress/typedarray-includes.js: Added.
+        * tests/stress/typedarray-indexOf.js:
+        * tests/stress/typedarray-lastIndexOf.js:
+
+2016-07-15  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Add new functions to ARMAssembler after r202214
+        https://bugs.webkit.org/show_bug.cgi?id=159713
+
+        Reviewed by Saam Barati.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::fillNops):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::patchableBranch32):
+        (JSC::MacroAssemblerARM::internalCompare32):
+
+2016-07-15  Mark Lam  <mark.lam@apple.com>
+
+        Stack overflow error for deeply nested classes.
+        https://bugs.webkit.org/show_bug.cgi?id=157086
+
+        Reviewed by Geoffrey Garen.
+
+        Changed the StructureStubClearingWatchpoint destructor to iteratively destruct
+        its chain of next StructureStubClearingWatchpoints instead of recursively doing
+        so.
+
+        The added deep-StructureStubClearingWatchpoint-destructor-recursion.js test
+        produces a crash before the fix is applied, but takes about 14 minutes to run.
+        Hence, it is skipped.
+
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
+        * tests/stress/deep-StructureStubClearingWatchpoint-destructor-recursion.js: Added.
+
+2016-07-15  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix expectations in test262.yaml
+        https://bugs.webkit.org/show_bug.cgi?id=159810
+
+        Reviewed by Keith Miller.
+
+        * tests/test262.yaml:
+
+2016-07-15  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Disable Inline Caching on ARMv7 traditional until proper fix
+        https://bugs.webkit.org/show_bug.cgi?id=159759
+
+        Reviewed by Saam Barati.
+
+        * jit/Repatch.cpp:
+        (JSC::forceICFailure):
+
+2016-07-14  Keith Miller  <keith_miller@apple.com>
+
+        Add Test262 test files and yaml
+
+        Rubber Stamped by Benjamin Poulain.
+
+        This patch adds all the test262 test files and the yaml that drives
+        run-jsc-stress-tests.
+
+        * tests/test262.yaml: Added. Yaml file to drive the test262 test suite with our driver.
+        * tests/test262/LICENSE: Added. License for the test262 test suite.
+        * tests/test262/harness/: Added. Harness directory for the test262 tests.
+        * tests/test262/test/: Added. Directory with all the actual test files.
+
+2016-07-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Return the correct value from Heap::externalMemorySize
+        https://bugs.webkit.org/show_bug.cgi?id=159797
+        <rdar://problem/27362446>
+
+        Reviewed by Timothy Hatcher.
+
+        * heap/Heap.h:
+        (JSC::Heap::externalMemorySize):
+        We should have been returning m_externalMemorySize which is a subset
+        of m_extraMemorySize. In practice the difference can be small. A major
+        difference in "extra memory size" may be from deprecated memory size
+        and array buffer sizes.
+
+2016-07-14  Saam Barati  <sbarati@apple.com>
+
+        It should be a syntax error to have a 'use strict' directive inside a function that has a non-simple parameter list
+        https://bugs.webkit.org/show_bug.cgi?id=159790
+        <rdar://problem/27171636>
+
+        Reviewed by Geoffrey Garen.
+
+        Is is a syntax error for a function's parameter list to be non-simple
+        and for the function to also contain a 'use strict' directive.
+
+        See section 14.2.1 of the spec:
+        https://tc39.github.io/ecma262/#sec-arrow-function-definitions-static-semantics-early-errors
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseSourceElements):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::strictMode):
+        (JSC::Scope::isValidStrictMode):
+        (JSC::Scope::shadowsArguments):
+        (JSC::Scope::setHasNonSimpleParameterList):
+        (JSC::Scope::hasNonSimpleParameterList):
+        (JSC::Scope::copyCapturedVariablesToVector):
+
+2016-07-14  Geoffrey Garen  <ggaren@apple.com>
+
+        ASSERTION FAILED: : this != replacement()
+        https://bugs.webkit.org/show_bug.cgi?id=159779
+
+        Reviewed by Michael Saboff.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison): If we jettison during GC, and our owner
+        is dead, we choose not to replace ourselves. (See
+        https://bugs.webkit.org/show_bug.cgi?id=159588.) So, it's possible to
+        invalidate and still be our owner's CodeBlock. Relax our ASSERT to allow
+        for this.
+
+2016-07-14  Mark Lam  <mark.lam@apple.com>
+
+        JSONObject Walker::walk must save array length before processing array elements.
+        https://bugs.webkit.org/show_bug.cgi?id=153485
+
+        Reviewed by Darin Adler and Michael Saboff.
+
+        According to https://tc39.github.io/ecma262/#sec-internalizejsonproperty,
+        JSON.parse() should cache the length of an array and use the cached length when
+        iterating array elements (see section 24.3.1.1 2.b.iii).
+
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * tests/stress/JSON-parse-should-cache-array-lengths.js: Added.
+        (toString):
+        (shouldBe):
+        (test):
+        (test2):
+
+2016-07-14  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Handle properly unaligned halfword load
+        https://bugs.webkit.org/show_bug.cgi?id=153226
+
+        Reviewed by Michael Catanzaro.
+
+        Waiting for the kernel to silently fix-up unaligned accesses is
+        not efficient, so let's provide an implementation of load16Unaligned
+        in mips macro assembler.
+
+        Performance improvement seen with SunSpider's regexp-dna test.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::load16Unaligned):
+        (JSC::MacroAssemblerMIPS::load32WithUnalignedHalfWords):
+
+2016-07-14  Youenn Fablet  <youenn@apple.com>
+
+        DOM value iterable interfaces should use Array prototype methods
+        https://bugs.webkit.org/show_bug.cgi?id=159296
+
+        Reviewed by Chris Dumez and Mark Lam.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Marking some header files as private so that they can be included in
+        WebCore.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation): copying iterable methods (entries, forEach, keys and values) to private slots.
+
+2016-07-13  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the magic numbers for ARM traditional in InlineAccess.h
+        https://bugs.webkit.org/show_bug.cgi?id=159708
+
+        Reviewed by Saam Barati.
+
+        * bytecode/InlineAccess.h:
+        (JSC::InlineAccess::sizeForPropertyAccess):
+        (JSC::InlineAccess::sizeForPropertyReplace):
+        (JSC::InlineAccess::sizeForLengthAccess):
+
+2016-07-13  Michael Saboff  <msaboff@apple.com>
+
+        YARR uses mixture of int and unsigned values to index into subject string
+        https://bugs.webkit.org/show_bug.cgi?id=159744
+
+        Reviewed by Benjamin Poulain.
+
+        In most cases, we refer to characters in subject strings using a negative index from the number of
+        "checked" characters in a subject string.  The required length is compared against the actual length
+        and then we use that required length as the checked amount.  For example, when matching the string of
+        4 digits in the RegExp /abc \d{4}/, we know that need 8 characters in the subject string.  We refer
+        to the digits part of the expression from an already checked index of 8 and use negative offsets of
+        -4 through -1.  In many cases we used a signed int for the negative offsets.  There are other cases
+        where we used unsigned values as the amount of negative offset to use when accessing subject characters.
+
+        Changed all occurrances of character offsets to unsigned or Checked Arithmetic unsigned values.  Note
+        that the pre-existing Checked class is used in other places to check for under/overflow with arithmetic
+        operations.  Those unsigned offsets are always the number of characters before (negative) from the
+        current checked character offset.  Also added some asserts for cases where arithmetic is not protected
+        by other checks or with Checked<> wrapped values.
+
+        In the case of the JIT, subject characters are accessed using base with scaled index and offset
+        addressing.  The MacroAssembler provides this addressing using the BaseIndex struct.  The offset for
+        this struct is a 32 bit signed quantity.  Since we only care about negative offsets, we really only
+        have 31 bits.  Changed the generation of a BaseOffset address to handle the case when the offset and
+        scaled combination will exceed the 31 bits of negative offset.  This is done by moving the base value
+        into a temp register and biasing the temp base and offset to smaller values so that we can emit
+        instructions that can reference characters without exceeding the 31 bits of negative offset.
+
+        To abstract the character address generation, put the base with scaled index and offset into
+        one function and used that function everywhere the YARR JIT wants to access subject characters.
+        Also consilidated a few cases where we were generating inline what readCharacter() does.  Usually
+        this was due to using a different index register.
+
+        Added a new regression test.
+
+        * tests/stress/regress-159744.js: Added regression test.
+        (testRegExp):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::recordParenthesesMatch):
+        (JSC::Yarr::Interpreter::resetMatches):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
+        (JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BOL):
+        (JSC::Yarr::ByteTerm::UncheckInput):
+        (JSC::Yarr::ByteTerm::EOL):
+        (JSC::Yarr::ByteTerm::WordBoundary):
+        (JSC::Yarr::ByteTerm::BackReference):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::notAtEndOfInput):
+        (JSC::Yarr::YarrGenerator::negativeOffsetIndexedAddress):
+        (JSC::Yarr::YarrGenerator::readCharacter):
+        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::YarrGenerator::storeToFrame):
+        (JSC::Yarr::YarrGenerator::generateAssertionBOL):
+        (JSC::Yarr::YarrGenerator::backtrackAssertionBOL):
+        (JSC::Yarr::YarrGenerator::generateAssertionEOL):
+        (JSC::Yarr::YarrGenerator::matchAssertionWordchar):
+        (JSC::Yarr::YarrGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassOnce):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+        (JSC::Yarr::YarrGenerator::generate):
+        (JSC::Yarr::YarrGenerator::backtrack):
+        (JSC::Yarr::YarrGenerator::YarrGenerator):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::PatternTerm::PatternTerm):
+
+2016-07-13  Keith Miller  <keith_miller@apple.com>
+
+        Crashes with detached ArrayBuffers
+        https://bugs.webkit.org/show_bug.cgi?id=157088
+        <rdar://problem/27327362>
+
+        Reviewed by Filip Pizlo.
+
+        TypedArray.prototype.fill was incorrect because it should perform
+        ToNumber coercion each time it tries to store the
+        object. Currently, we only perform the coercion once at the
+        beginning of the loop. If we find that we need to improve the
+        performance of this function, we can add a faster C++ path back
+        that only handles the primitive case.
+
+        This patch also moves the isNeutered() checks from put and
+        putByIndex into setIndex. This fixes an issue where setIndex might
+        store to a no longer valid offset.
+
+        * builtins/TypedArrayPrototype.js:
+        (globalPrivate.typedArrayClampArgumentToStartOrEnd):
+        (fill):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndexQuickly):
+        (JSC::JSGenericTypedArrayView::setIndex):
+        (JSC::JSGenericTypedArrayView::setRangeToValue): Deleted.
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::put): Deleted.
+        (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex): Deleted.
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncFill): Deleted.
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        (JSC::typedArrayViewProtoFuncFill): Deleted.
+        * tests/stress/typedarray-fill.js:
+        * tests/stress/typedarray-functions-with-neutered.js:
+        (defaultForArg):
+        (test2):
+        (checkArgumentsForType): Deleted.
+        (checkArguments): Deleted.
+
+2016-07-13  Michael Saboff  <msaboff@apple.com>
+
+        Some bad unicode regex escapes aren't flagged as errors
+        https://bugs.webkit.org/show_bug.cgi?id=158080
+
+        Reviewed by Saam Barati.
+
+        If we have a partial unicode escape, eg /\u{1/u or /\u12|abc/u, we
+        didn't check for the closing '}' and processed the unicode escape with
+        the hex value provided.  
+
+        Added a check that we properly terminated a \u{} unicode escape.
+        If we fail that check and there isn't a prior error, we record that we
+        have an invalid unicode escape.  The next existing line in the code will
+        terminate parsing and bubble up the error.
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::parseEscape):
+
+2016-07-13  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r203199.
+
+        Broke the build
+
+        Reverted changeset:
+
+        "Crashes with detached ArrayBuffers"
+        https://bugs.webkit.org/show_bug.cgi?id=157088
+        http://trac.webkit.org/changeset/203199
+
+2016-07-13  Keith Miller  <keith_miller@apple.com>
+
+        Crashes with detached ArrayBuffers
+        https://bugs.webkit.org/show_bug.cgi?id=157088
+        <rdar://problem/27327362>
+
+        Reviewed by Filip Pizlo.
+
+        TypedArray.prototype.fill was incorrect because it should perform
+        ToNumber coercion each time it tries to store the
+        object. Currently, we only perform the coercion once at the
+        beginning of the loop. If we find that we need to improve the
+        performance of this function, we can add a faster C++ path back
+        that only handles the primitive case.
+
+        This patch also moves the isNeutered() checks from put and
+        putByIndex into setIndex. This fixes an issue where setIndex might
+        store to a no longer valid offset.
+
+        * builtins/TypedArrayPrototype.js:
+        (globalPrivate.typedArrayClampArgumentToStartOrEnd):
+        (fill):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndexQuickly):
+        (JSC::JSGenericTypedArrayView::setIndex):
+        (JSC::JSGenericTypedArrayView::setRangeToValue): Deleted.
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::put): Deleted.
+        (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex): Deleted.
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncFill): Deleted.
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        (JSC::typedArrayViewProtoFuncFill): Deleted.
+        * tests/stress/typedarray-fill.js:
+        * tests/stress/typedarray-functions-with-neutered.js:
+        (defaultForArg):
+        (test2):
+        (checkArgumentsForType): Deleted.
+        (checkArguments): Deleted.
+
+2016-07-13  Enrica Casucci  <enrica@apple.com>
+
+        Update supported platforms in xcconfig files to match the sdk names.
+        https://bugs.webkit.org/show_bug.cgi?id=159728
+
+        Reviewed by Tim Horton.
+
+        * Configurations/Base.xcconfig:
+
+2016-07-13  Csaba Osztrogonác  <ossy@webkit.org>
+
+        CLoop buildfix after r203142
+        https://bugs.webkit.org/show_bug.cgi?id=159706
+
+        Unreviewed buildfix.
+
+        * interpreter/CLoopStack.cpp:
+        (JSC::CLoopStack::isSafeToRecurse):
+        * interpreter/CLoopStack.h:
+        * interpreter/CLoopStackInlines.h:
+        (JSC::CLoopStack::isSafeToRecurse): Deleted.
+
+2016-07-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Array.prototype.join() fails some conformance tests
+        https://bugs.webkit.org/show_bug.cgi?id=159657
+
+        Reviewed by Saam Barati.
+
+        There were a couple of failures:
+        -separator.toString() was called *before* we get the length
+         and process ToLength() on it.
+        -We were using toUInt32() on length instead of ToLength(),
+         failing on big integers and various negative numbers.
+
+        Additionally, I replaced the "fast" ArrayStorage path
+        by a fully generic implementation that does not depends on StringJoiner.
+
+        The reason is StringJoiner was doing poorly on sparse objects
+        in certain cases.
+        If you have a sparse object with a length > INT_MAX but very few
+        indices defined, and you join on the empty string, it should be possible
+        to join the array (albeit very slowly). With StringJoiner, we fail
+        because we try to allocate > INT_MAX empty strings in a contiguous vector.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::slowJoin):
+        (JSC::canUseFastJoin):
+        (JSC::fastJoin):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::join): Deleted.
+        * runtime/JSArray.h:
+        (JSC::toLength):
+
+2016-07-12  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: C Loop build fix after r203142.
+
+        Not reviewed.
+
+        * interpreter/CLoopStackInlines.h:
+        (JSC::CLoopStack::isSafeToRecurse):
+
+2016-07-12  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r203131.
+        https://bugs.webkit.org/show_bug.cgi?id=159698
+
+        This change caused an existing LayoutTest to time out on debug
+        testers (Requested by ryanhaddad on #webkit).
+
+        Reverted changeset:
+
+        "[JSC] Array.prototype.join() fails some conformance tests"
+        https://bugs.webkit.org/show_bug.cgi?id=159657
+        http://trac.webkit.org/changeset/203131
+
+2016-07-12  Mark Lam  <mark.lam@apple.com>
+
+        We should use different stack limits for stack checks from JS and host code.
+        https://bugs.webkit.org/show_bug.cgi?id=159442
+        <rdar://problem/26889188>
+
+        Reviewed by Geoffrey Garen.
+
+        We have 2 stack reservedZoneSizes:
+        1. Options::softReservedZoneSize()
+        2. Options::reservedZoneSize()
+
+        Respectively, there are used to define 2 stack limits based on these reserved
+        zone sizes:
+        1. VM::m_softStackLimit
+        2. VM::m_stackLimit
+
+        Options::reservedZoneSize() is the amount of the stack space that JSC guarantees
+        to the VM and client host code for it's use.  Host code that has well known
+        stack usage characteristics (i.e. doesn't call arbitrary code) may do stack
+        checks against the VM::m_stackLimit limit (which is computed using
+        Options::reservedZoneSize()).
+
+        Options::softReservedZoneSize() is a more conservative amount of reserved stack
+        space.  This is used to compute the VM::m_softStackLimit limit.  Any code that
+        is difficult to have its stack usage characterized (i.e. may call arbitrary code)
+        may need more stack space for its work.  Hence, these should do stack checks
+        against the VM::m_softStackLimit limit.
+
+        JS code and host code that may call into JS code falls into the category of code
+        that may call arbitrary code.  Hence, they should do stack checks against the
+        VM::m_softStackLimit limit.
+
+        Accordingly, the VM now provides 2 recursion check functions:
+
+        1. VM::isSafeToRecurseSoft() will do a stack check against VM::m_softStackLimit.
+           In addition, for C Loop builds, VM::isSafeToRecurseSoft() will also
+           check the CLoopStack against VM::m_cloopStackLimit.
+
+        2. VM::isSafeToRecurse() will do a stack check against VM::m_stackLimit.
+
+        Also added a promise-infinite-recursion-should-not-crash.js test.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeInTailPosition):
+        (JSC::BytecodeGenerator::emitNodeInConditionContext):
+        * interpreter/CLoopStack.cpp:
+        (JSC::CLoopStack::grow):
+        * interpreter/CLoopStack.h:
+        (JSC::CLoopStack::size):
+        * interpreter/CLoopStackInlines.h:
+        (JSC::CLoopStack::ensureCapacityFor):
+        (JSC::CLoopStack::isSafeToRecurse):
+        (JSC::CLoopStack::topOfFrameFor):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/Parser.cpp:
+        * runtime/Options.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        (JSC::ProxyObject::performPut):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::finishCreation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+        * runtime/StringRecursionChecker.h:
+        (JSC::StringRecursionChecker::performCheck):
+        * runtime/VM.cpp:
+        (JSC::VM::setStackPointerAtVMEntry):
+        (JSC::VM::updateSoftReservedZoneSize):
+        (JSC::preCommitStackMemory):
+        (JSC::VM::updateStackLimits):
+        (JSC::VM::updateStackLimit): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::stackLimit):
+        (JSC::VM::softStackLimit):
+        (JSC::VM::addressOfSoftStackLimit):
+        (JSC::VM::setCLoopStackLimit):
+        (JSC::VM::isSafeToRecurse):
+        (JSC::VM::lastStackTop):
+        (JSC::VM::setException):
+        * runtime/VMInlines.h:
+        (JSC::VM::ensureStackCapacityFor):
+        (JSC::VM::isSafeToRecurseSoft):
+        (JSC::VM::shouldTriggerTermination):
+        * tests/stress/promise-infinite-recursion-should-not-crash.js: Added.
+        (testPromise):
+        (promiseFunc):
+        * yarr/YarrPattern.cpp:
+
+2016-07-12  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Fix for build error when trying to version stamp dll.
+        https://bugs.webkit.org/show_bug.cgi?id=159692
+
+        Reviewed by Brent Fulgham.
+
+        Use correct path to version stamp script.
+
+        * CMakeLists.txt:
+
+2016-07-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Array.prototype.join() fails some conformance tests
+        https://bugs.webkit.org/show_bug.cgi?id=159657
+
+        Reviewed by Saam Barati.
+
+        There were a couple of failures:
+        -separator.toString() was called *before* we get the length
+         and process ToLength() on it.
+        -We were using toUInt32() on length instead of ToLength(),
+         failing on big integers and various negative numbers.
+
+        Additionally, I replaced the "fast" ArrayStorage path
+        by a fully generic implementation that does not depends on StringJoiner.
+
+        The reason is StringJoiner was doing poorly on sparse objects
+        in certain cases.
+        If you have a sparse object with a length > INT_MAX but very few
+        indices defined, and you join on the empty string, it should be possible
+        to join the array (albeit very slowly). With StringJoiner, we fail
+        because we try to allocate > INT_MAX empty strings in a contiguous vector.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::slowJoin):
+        (JSC::canUseFastJoin):
+        (JSC::fastJoin):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::join): Deleted.
+        * runtime/JSArray.h:
+        (JSC::toLength):
+
+2016-07-12  Mark Lam  <mark.lam@apple.com>
+
+        More stack limit and reserved zone renaming.
+        https://bugs.webkit.org/show_bug.cgi?id=159690
+
+        Rubber-stamped by Geoffrey Garen.
+
+        We should rename the following:
+            osStackLimitWithReserve => softStackLimit
+            reservedZoneSize => softReservedZoneSize
+            errorModeReservedZoneSize => reservedZoneSize
+
+        * API/tests/PingPongStackOverflowTest.cpp:
+        (testPingPongStackOverflow):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        * interpreter/CLoopStack.cpp:
+        (JSC::CLoopStack::CLoopStack):
+        (JSC::CLoopStack::grow):
+        (JSC::CLoopStack::releaseExcessCapacity):
+        (JSC::CLoopStack::addToCommittedByteCount):
+        (JSC::CLoopStack::setSoftReservedZoneSize):
+        (JSC::CLoopStack::setReservedZoneSize): Deleted.
+        * interpreter/CLoopStack.h:
+        (JSC::CLoopStack::size):
+        * interpreter/CLoopStackInlines.h:
+        (JSC::CLoopStack::shrink):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetupVarargsFrameFastCase):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ErrorHandlingScope.cpp:
+        (JSC::ErrorHandlingScope::ErrorHandlingScope):
+        (JSC::ErrorHandlingScope::~ErrorHandlingScope):
+        * runtime/ErrorHandlingScope.h:
+        * runtime/Options.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::finishCreation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::setStackPointerAtVMEntry):
+        (JSC::VM::updateSoftReservedZoneSize):
+        (JSC::VM::updateStackLimit):
+        (JSC::VM::updateReservedZoneSize): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::stackPointerAtVMEntry):
+        (JSC::VM::softReservedZoneSize):
+        (JSC::VM::softStackLimit):
+        (JSC::VM::addressOfSoftStackLimit):
+        (JSC::VM::cloopStackLimit):
+        (JSC::VM::setCLoopStackLimit):
+        (JSC::VM::isSafeToRecurse):
+        (JSC::VM::reservedZoneSize): Deleted.
+        (JSC::VM::osStackLimitWithReserve): Deleted.
+        (JSC::VM::addressOfOSStackLimitWithReserve): Deleted.
+        * runtime/VMInlines.h:
+        (JSC::VM::ensureStackCapacityFor):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+
+2016-07-12  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
+
+        Remove ENABLE_CSS3_TEXT_LINE_BREAK flag
+        https://bugs.webkit.org/show_bug.cgi?id=159671
+
+        Reviewed by Csaba Osztrogonác.
+
+        ENABLE_CSS3_TEXT_LINE_BREAK feature was implemented without guards.
+        https://bugs.webkit.org/show_bug.cgi?id=89235
+
+        So this guard can be removed in build scripts.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-07-12  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] DLLs are missing version information.
+        https://bugs.webkit.org/show_bug.cgi?id=159349
+
+        Reviewed by Brent Fulgham.
+
+        Generate autoversion.h and run perl version stamp utility.
+
+        * CMakeLists.txt:
+
+2016-07-11  Caio Lima  <ticaiolima@gmail.com>
+
+        ECMAScript 2016: %TypedArray%.prototype.includes implementation
+        https://bugs.webkit.org/show_bug.cgi?id=159385
+
+        Reviewed by Benjamin Poulain.
+
+        This patch implements the ECMAScript 2016:
+        %TypedArray%.prototype.includes
+        following spec 22.2.3.14
+        https://tc39.github.io/ecma262/2016/#sec-%typedarray%.prototype.includes
+
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncIncludes):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewProtoFuncIncludes):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+
+2016-07-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Array.from() and Array.of() try to build objects even if "this" is not a constructor
+        https://bugs.webkit.org/show_bug.cgi?id=159604
+
+        Reviewed by Yusuke Suzuki.
+
+        The spec says IsConstructor(), we were just checking if "this"
+        is any function.
+
+        * builtins/ArrayConstructor.js:
+        (of):
+        (from):
+
+2016-07-11  Keith Miller  <keith_miller@apple.com>
+
+        defineProperty on a index of a TypedArray should throw if configurable
+        https://bugs.webkit.org/show_bug.cgi?id=159653
+
+        Reviewed by Saam Barati.
+
+        When I fixed this before I misread the spec and thought it said we
+        should throw if the descriptor said the proprety is not
+        configurable. This is the opposite. We should throw if the
+        descriptor says the property is configurable.
+
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        * tests/stress/typedarray-access-monomorphic-neutered.js:
+        * tests/stress/typedarray-access-neutered.js:
+        * tests/stress/typedarray-configure-index.js: Added.
+        (assert):
+        (assertThrows):
+        (makeDescriptor):
+        (test):
+
+2016-07-11  Saam Barati  <sbarati@apple.com>
+
+        some paths in Array.prototype.splice don't account for the array not having certain indexed properties
+        https://bugs.webkit.org/show_bug.cgi?id=159641
+        <rdar://problem/27171999>
+
+        Reviewed by Filip Pizlo and Keith Miller.
+
+        Array.prototype.splice was incorrectly putting properties on
+        the result array even if the |this| array didn't have those
+        properties. This is not the behavior of the spec. However, this
+        could also cause a crash because we can construct a program where
+        we would putByIndex on a typed array where the value we are
+        putting is JSValue(). This is bad because the typed array will
+        try to convert JSValue() into an integer.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+        * tests/stress/array-prototype-splice-making-typed-array.js: Added.
+        (assert):
+        (test):
+
+2016-07-11  Mark Lam  <mark.lam@apple.com>
+
+        Refactor JSStack to only be the stack data structure for the C Loop.
+        https://bugs.webkit.org/show_bug.cgi?id=159545
+
+        Reviewed by Geoffrey Garen.
+
+        Changes made:
+        1. Renamed JSStack to CLoopStack.
+        2. Made all of CLoopStack code to conditional on #if !ENABLE(JIT) i.e. they will
+           only be in effect for the C Loop build.
+        3. Changed clients of JSStack to use new equivalent VM APIs:
+            a. JSStack::ensureCapacityFor() => VM::ensureStackCapacityFor()
+            b. JSStack::committedByteCount() => VM::committedStackByteCount()
+        4. Made VM::updateReservedZoneSize() call CLoopStack::setReservedZoneSize()
+           instead of calling it from all the clients of VM::updateReservedZoneSize().
+        5. Removed all unnecessary references to JSStack.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MaxFrameExtentForSlowPathCall.h:
+        * bytecode/BytecodeConventions.h:
+        * dfg/DFGGraph.h:
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * heap/Heap.cpp:
+        (JSC::Heap::finalizeUnconditionalFinalizers):
+        (JSC::Heap::willStartIterating):
+        (JSC::Heap::gatherJSStackRoots):
+        (JSC::Heap::stack): Deleted.
+        * heap/Heap.h:
+        * interpreter/CLoopStack.cpp: Copied from Source/JavaScriptCore/interpreter/JSStack.cpp.
+        (JSC::commitSize):
+        (JSC::CLoopStack::CLoopStack):
+        (JSC::CLoopStack::~CLoopStack):
+        (JSC::CLoopStack::grow):
+        (JSC::CLoopStack::gatherConservativeRoots):
+        (JSC::CLoopStack::sanitizeStack):
+        (JSC::CLoopStack::releaseExcessCapacity):
+        (JSC::CLoopStack::addToCommittedByteCount):
+        (JSC::CLoopStack::setReservedZoneSize):
+        (JSC::CLoopStack::committedByteCount):
+        (JSC::JSStack::JSStack): Deleted.
+        (JSC::JSStack::~JSStack): Deleted.
+        (JSC::JSStack::growSlowCase): Deleted.
+        (JSC::JSStack::gatherConservativeRoots): Deleted.
+        (JSC::JSStack::sanitizeStack): Deleted.
+        (JSC::JSStack::releaseExcessCapacity): Deleted.
+        (JSC::JSStack::addToCommittedByteCount): Deleted.
+        (JSC::JSStack::setReservedZoneSize): Deleted.
+        (JSC::JSStack::lowAddress): Deleted.
+        (JSC::JSStack::highAddress): Deleted.
+        (JSC::JSStack::committedByteCount): Deleted.
+        * interpreter/CLoopStack.h: Copied from Source/JavaScriptCore/interpreter/JSStack.h.
+        (JSC::CLoopStack::containsAddress):
+        (JSC::CLoopStack::lowAddress):
+        (JSC::CLoopStack::highAddress):
+        (JSC::CLoopStack::reservationTop):
+        (JSC::JSStack::containsAddress): Deleted.
+        (JSC::JSStack::lowAddress): Deleted.
+        (JSC::JSStack::highAddress): Deleted.
+        (JSC::JSStack::reservationTop): Deleted.
+        * interpreter/CLoopStackInlines.h: Copied from Source/JavaScriptCore/interpreter/JSStackInlines.h.
+        (JSC::CLoopStack::ensureCapacityFor):
+        (JSC::CLoopStack::topOfFrameFor):
+        (JSC::CLoopStack::topOfStack):
+        (JSC::CLoopStack::shrink):
+        (JSC::CLoopStack::setCLoopStackLimit):
+        (JSC::JSStack::ensureCapacityFor): Deleted.
+        (JSC::JSStack::topOfFrameFor): Deleted.
+        (JSC::JSStack::topOfStack): Deleted.
+        (JSC::JSStack::shrink): Deleted.
+        (JSC::JSStack::grow): Deleted.
+        (JSC::JSStack::setCLoopStackLimit): Deleted.
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::unsafeCallSiteIndex):
+        (JSC::CallFrame::currentVPC):
+        (JSC::CallFrame::stack): Deleted.
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::callerFrameAndPC):
+        (JSC::ExecState::unsafeCallerFrameAndPC):
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeOfVarargs):
+        (JSC::sizeFrameForForwardArguments):
+        (JSC::sizeFrameForVarargs):
+        (JSC::Interpreter::Interpreter):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::cloopStack):
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::isCallBytecode):
+        (JSC::Interpreter::stack): Deleted.
+        * interpreter/JSStack.cpp: Removed.
+        * interpreter/JSStack.h: Removed.
+        * interpreter/JSStackInlines.h: Removed.
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::dump):
+        * jit/JIT.h:
+        * jit/JITOperations.cpp:
+        * jit/JSInterfaceJIT.h:
+        * jit/SpecializedThunkJIT.h:
+        * jit/ThunkGenerators.cpp:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::llint_stack_check_at_vm_entry):
+        * llint/LLIntThunks.cpp:
+        * llint/LowLevelInterpreter.cpp:
+        (JSC::CLoop::execute):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        * runtime/ErrorHandlingScope.cpp:
+        (JSC::ErrorHandlingScope::ErrorHandlingScope):
+        (JSC::ErrorHandlingScope::~ErrorHandlingScope):
+        * runtime/JSGlobalObject.h:
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+        * runtime/StackAlignment.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::updateReservedZoneSize):
+        (JSC::sanitizeStackForVM):
+        (JSC::VM::committedStackByteCount):
+        * runtime/VM.h:
+        (JSC::VM::reservedZoneSize):
+        (JSC::VM::osStackLimitWithReserve):
+        (JSC::VM::addressOfOSStackLimitWithReserve):
+        * runtime/VMInlines.h:
+        (JSC::VM::ensureStackCapacityFor):
+        (JSC::VM::shouldTriggerTermination):
+
+2016-07-11  Keith Miller  <keith_miller@apple.com>
+
+        STP TypedArray.subarray 5x slowdown compared to 9.1
+        https://bugs.webkit.org/show_bug.cgi?id=156404
+        <rdar://problem/26493032>
+
+        Reviewed by Geoffrey Garen.
+
+        This patch moves the species constructor work for
+        %TypedArray%.prototype.subarray to a js wrapper. By moving the
+        species constructor work to JS we are able to completely optimize
+        it out in DFG. The actual work of creating a TypedArray is still
+        done in C++ since we are able to avoid calling into the
+        constructor, which is expensive. This patch also changes the error
+        message when a %TypedArray%.prototype function is passed a non-typed
+        array this value. Finally, we used to check that the this value
+        had not been detached, however, this behavior was incorrect.
+
+        * builtins/BuiltinNames.h:
+        * builtins/TypedArrayPrototype.js:
+        (globalPrivate.typedArraySpeciesConstructor):
+        (subarray):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        (JSC::genericTypedArrayViewProtoFuncSubarray): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncLength):
+        (JSC::typedArrayViewPrivateFuncSubarrayCreate):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        (JSC::typedArrayViewProtoFuncSubarray): Deleted.
+        * runtime/JSTypedArrayViewPrototype.h:
+
+2016-07-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION(r202992): JSC varargs tests are broken
+        https://bugs.webkit.org/show_bug.cgi?id=159616
+
+        Reviewed by Csaba Osztrogonác.
+
+        The substitution miss in r202992 causes varargs tests failures in GTK port.
+
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetupVarargsFrameFastCase):
+
+2016-07-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Promise.{all,race} no longer use @@species
+        https://bugs.webkit.org/show_bug.cgi?id=159615
+
+        Reviewed by Keith Miller.
+
+        As per the latest ES draft, Promise.{all,race} no longer use @@species.
+        So, this patch drops FIXMEs.
+
+        * builtins/PromiseConstructor.js:
+        (all):
+        (race):
+        * tests/stress/ignore-promise-species.js: Added.
+        (shouldBe):
+        (DerivedPromise.prototype.get Symbol):
+        (DerivedPromise):
+
+2016-07-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r203037.
+        https://bugs.webkit.org/show_bug.cgi?id=159614
+
+        The JSC tests are breaking in elcapitan-debug-tests-jsc and
+        elcapitan-release-tests-jsc (Requested by caiolima on
+        #webkit).
+
+        Reverted changeset:
+
+        "ECMAScript 2016: %TypedArray%.prototype.includes
+        implementation"
+        https://bugs.webkit.org/show_bug.cgi?id=159385
+        http://trac.webkit.org/changeset/203037
+
+2016-07-10  Caio Lima  <ticaiolima@gmail.com>
+
+        ECMAScript 2016: %TypedArray%.prototype.includes implementation
+        https://bugs.webkit.org/show_bug.cgi?id=159385
+
+        Reviewed by Benjamin Poulain.
+
+        This patch implements the ECMAScript 2016:
+        %TypedArray%.prototype.includes
+        following spec 22.2.3.14
+        https://tc39.github.io/ecma262/2016/#sec-%typedarray%.prototype.includes
+
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncIncludes):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewProtoFuncIncludes):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+
+2016-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(201900): validation failure for GetByOffset/PutByOffset in VALIDATE((node), node->child1().node() == node->child2().node() || node->child1()->result() == NodeResultStorage)
+        https://bugs.webkit.org/show_bug.cgi?id=159603
+
+        Reviewed by Keith Miller.
+        
+        This removes an incorrect validation rule and replaces it with a FIXME about how to make this
+        aspect of IR easier to validate soundly.
+        
+        It's not valid to assert that two children of a node are the same. It should always be valid
+        to take:
+        
+        Foo(@x, @x)
+        
+        and turn it into:
+        
+        a: ValueRep(@x)
+        b: ValueRep(@x)
+        Foo(@a, @b)
+        
+        or even something like:
+        
+        y: Identity(@y)
+        Foo(@x, @y)
+        
+        That's because it should be possible to rewire any data flow edge something that produces an
+        equivalent value.
+        
+        The validation rule that this patch removes meant that such rewirings were invalid on
+        GetByOffset/PutByOffset. FixupPhase did such a rewiring sometimes.
+
+        * dfg/DFGValidate.cpp:
+        * tests/stress/get-by-offset-double.js: Added.
+
+2016-07-09  Keith Miller  <keith_miller@apple.com>
+
+        appendMemcpy might fail in concatAppendOne
+        https://bugs.webkit.org/show_bug.cgi?id=159601
+        <rdar://problem/27211300>
+
+        Reviewed by Mark Lam.
+
+        There are multiple reasons why we might fail appendMemcpy. One
+        reason, which I suspect was the source of the crashes, is that one
+        of the Array prototypes has an indexed property. This patch
+        consolidates the two old cases by just creating an array then
+        attempting to memcpy append. If that fails, we fall back to
+        moveElements.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::concatAppendOne):
+        * tests/stress/concat-with-holesMustForwardToPrototype.js: Added.
+        (arrayEq):
+
+2016-07-09  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Fix the Template Raw Value of \ (escape) + LineTerminatorSequence
+        https://bugs.webkit.org/show_bug.cgi?id=159595
+
+        Reviewed by Yusuke Suzuki.
+
+        The spec (https://tc39.github.io/ecma262/#sec-static-semantics-tv-and-trv)
+        says:
+        "The TRV of LineContinuation::\LineTerminatorSequence is the sequence
+         consisting of the code unit value 0x005C followed by the code units
+         of TRV of LineTerminatorSequence."
+        
+        We were not normalizing the LineTerminatorSequence in that case, but it should
+        be as it is the TRV of LineTerminatorSequence.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::parseTemplateLiteral):
+        * tests/stress/tagged-templates-raw-strings.js:
+
+2016-07-08  Saam Barati  <sbarati@apple.com>
+
+        We may add a ReadOnly property without setting the corresponding bit on Structure
+        https://bugs.webkit.org/show_bug.cgi?id=159542
+        <rdar://problem/27084591>
+
+        Reviewed by Benjamin Poulain.
+
+        The reason this usually is OK is due to happenstance. Often, instances that putDirectWithoutTransition
+        also happen to have a static property table. Having a static property table causes the
+        HasReadOnlyOrGetterSetterPropertiesExcludingProto on the structure to be set. However, 
+        there are times where an object calls putDirectWithoutTransition, and it doesn't have a
+        static property hash table. The fix is simple, putDirectWithTransition needs to set the
+        HasReadOnlyOrGetterSetterPropertiesExcludingProto if it puts a ReadOnly property.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectWithoutTransition):
+        * tests/stress/proper-property-store-with-prototype-property-that-is-not-writable.js: Added.
+        (assert):
+
+2016-07-08  Michael Saboff  <msaboff@apple.com>
+
+        ASSERTION FAILED: Heap::isMarked(cell) in SlotVisitor::appendToMarkStack(JSC::JSCell *)
+        https://bugs.webkit.org/show_bug.cgi?id=159588
+
+        Reviewed by Geoffrey Garen.
+
+        We were jettisoning a CodeBlock during GC that won't survive and its owning script
+        won't survive either.  We can't install any code on the owning script as that involves
+        a write barrier that will "pull" the script back into the remembered set.  Badness would
+        ensue.  Added an early return in CodeBlock::jettison() when we are garbage collecting
+        and the owning script isn't marked.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+
+2016-07-08  Mark Lam  <mark.lam@apple.com>
+
+        Move CallFrame header info from JSStack.h to CallFrame.h
+        https://bugs.webkit.org/show_bug.cgi?id=159549
+
+        Reviewed by Geoffrey Garen.
+
+        CallFrame.h is a much better location for CallFrame header info.
+
+        Replaced CallFrame::init() with ExecState::initGlobalExec() because normal
+        CallFrames are setup by a different mechanism now.  Only the globalExec is still
+        using it.  So, might as well change it to be specifically for the globalExec.
+
+        Removed the use of JSStack::containsAddress() in ExecState::initGlobalExec()
+        because it is not relevant to the globalExec.
+
+        Also removed some unused code: JSStack::gatherConservativeRoots() and
+        JSStack::sanitizeStack() is never called for JIT builds.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * bytecode/VirtualRegister.h:
+        (JSC::VirtualRegister::isValid):
+        (JSC::VirtualRegister::isLocal):
+        (JSC::VirtualRegister::isArgument):
+        (JSC::VirtualRegister::isHeader):
+        (JSC::VirtualRegister::isConstant):
+        (JSC::VirtualRegister::toLocal):
+        (JSC::VirtualRegister::toArgument):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::thisRegister):
+        (JSC::CallArguments::argumentRegister):
+        (JSC::CallArguments::stackOffset):
+        (JSC::CallArguments::argumentCountIncludingThis):
+        (JSC::CallArguments::argumentsNode):
+        (JSC::BytecodeGenerator::registerFor):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::emitHomeObjectForCallee):
+        (JSC::emitGetSuperFunctionForConstruct):
+        (JSC::CallArguments::CallArguments):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGArgumentsUtilities.cpp:
+        (JSC::DFG::argumentsInvolveStackSlot):
+        (JSC::DFG::emitCodeToGetArgumentsArrayLength):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::get):
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
+        (JSC::DFG::ByteCodeParser::getArgumentCount):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isLiveInBytecode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntry):
+        (JSC::DFG::JITCompiler::compileSetupRegistersForEntry):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::emitStoreCallSiteIndex):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::emitRestoreArguments):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGOSRExitCompilerCommon.h:
+        (JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitGetLength):
+        (JSC::DFG::SpeculativeJIT::emitGetCallee):
+        (JSC::DFG::SpeculativeJIT::emitGetArgumentStart):
+        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrEntryThunkGenerator):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetCallee):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetArgumentCountIncludingThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetScope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLogShadowChickenPrologue):
+        (JSC::FTL::DFG::LowerDFGToB3::getArgumentsLength):
+        (JSC::FTL::DFG::LowerDFGToB3::getCurrentCallee):
+        (JSC::FTL::DFG::LowerDFGToB3::getArgumentsStart):
+        (JSC::FTL::DFG::LowerDFGToB3::callPreflight):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLSlowPathCall.h:
+        (JSC::FTL::callOperation):
+        * interpreter/CallFrame.cpp:
+        (JSC::ExecState::initGlobalExec):
+        (JSC::CallFrame::callSiteBitsAreBytecodeOffset):
+        (JSC::CallFrame::callSiteAsRawBits):
+        (JSC::CallFrame::unsafeCallSiteAsRawBits):
+        (JSC::CallFrame::callSiteIndex):
+        (JSC::CallFrame::setCurrentVPC):
+        (JSC::CallFrame::callSiteBitsAsBytecodeOffset):
+        * interpreter/CallFrame.h:
+        (JSC::CallSiteIndex::CallSiteIndex):
+        (JSC::ExecState::calleeAsValue):
+        (JSC::ExecState::callee):
+        (JSC::ExecState::unsafeCallee):
+        (JSC::ExecState::codeBlock):
+        (JSC::ExecState::unsafeCodeBlock):
+        (JSC::ExecState::scope):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScope):
+        (JSC::ExecState::argumentCount):
+        (JSC::ExecState::argumentCountIncludingThis):
+        (JSC::ExecState::argumentOffset):
+        (JSC::ExecState::argumentOffsetIncludingThis):
+        (JSC::ExecState::offsetFor):
+        (JSC::ExecState::noCaller):
+        (JSC::ExecState::setArgumentCountIncludingThis):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock):
+        (JSC::ExecState::setReturnPC):
+        (JSC::ExecState::argIndexForRegister):
+        (JSC::ExecState::callerFrameAndPC):
+        (JSC::ExecState::unsafeCallerFrameAndPC):
+        (JSC::ExecState::init): Deleted.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::dumpRegisters):
+        * interpreter/Interpreter.h:
+        (JSC::calleeFrameForVarargs):
+        * interpreter/JSStack.h:
+        (JSC::JSStack::containsAddress):
+        (JSC::JSStack::gatherConservativeRoots): Deleted.
+        (JSC::JSStack::sanitizeStack): Deleted.
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::jitAssertArgumentCountSane):
+        (JSC::AssemblyHelpers::emitRandomThunk):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::restoreReturnAddressBeforeReturn):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeader32):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeader64):
+        (JSC::AssemblyHelpers::emitPutToCallFrameHeader):
+        (JSC::AssemblyHelpers::emitPutToCallFrameHeaderBeforePrologue):
+        (JSC::AssemblyHelpers::emitPutPayloadToCallFrameHeaderBeforePrologue):
+        (JSC::AssemblyHelpers::emitPutTagToCallFrameHeaderBeforePrologue):
+        (JSC::AssemblyHelpers::calleeFrameSlot):
+        * jit/CCallHelpers.cpp:
+        (JSC::CCallHelpers::logShadowChickenProloguePacket):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::prepareForTailCallSlow):
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::CallFrameShuffler):
+        (JSC::CallFrameShuffler::dump):
+        (JSC::CallFrameShuffler::extendFrameIfNeeded):
+        (JSC::CallFrameShuffler::prepareForSlowPath):
+        (JSC::CallFrameShuffler::prepareForTailCall):
+        (JSC::CallFrameShuffler::prepareAny):
+        * jit/CallFrameShuffler.h:
+        (JSC::CallFrameShuffler::snapshot):
+        (JSC::CallFrameShuffler::setCalleeJSValueRegs):
+        (JSC::CallFrameShuffler::assumeCalleeIsCell):
+        (JSC::CallFrameShuffler::numLocals):
+        (JSC::CallFrameShuffler::getOld):
+        (JSC::CallFrameShuffler::setOld):
+        (JSC::CallFrameShuffler::firstOld):
+        (JSC::CallFrameShuffler::lastOld):
+        (JSC::CallFrameShuffler::isValidOld):
+        (JSC::CallFrameShuffler::argCount):
+        (JSC::CallFrameShuffler::getNew):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileCallEvalSlowCase):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlines.h:
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::emitPutIntToCallFrameHeader):
+        (JSC::JIT::updateTopCallFrame):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_scope):
+        (JSC::JIT::emit_op_argument_count):
+        (JSC::JIT::emit_op_get_rest_length):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        (JSC::JIT::emit_op_get_scope):
+        * jit/JSInterfaceJIT.h:
+        (JSC::JSInterfaceJIT::emitJumpIfNotType):
+        (JSC::JSInterfaceJIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JSInterfaceJIT::emitPutToCallFrameHeader):
+        (JSC::JSInterfaceJIT::emitPutCellToCallFrameHeader):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetVarargsFrame):
+        (JSC::emitSetupVarargsFrameFastCase):
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        (JSC::arityFixupGenerator):
+        (JSC::boundThisNoArgsFunctionCallGenerator):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::genericCall):
+        (JSC::LLInt::varargsSetup):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        * runtime/StackAlignment.h:
+        (JSC::roundArgumentCountToAlignFrame):
+        (JSC::roundLocalRegisterCountForFramePointerOffset):
+        (JSC::logStackAlignmentRegisters):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+        (JSC::WASMFunctionCompiler::endFunction):
+        (JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
+        (JSC::WASMFunctionCompiler::callAndUnboxResult):
+        * wasm/WASMFunctionSyntaxChecker.h:
+        (JSC::WASMFunctionSyntaxChecker::updateTempStackHeightForCall):
+
+2016-07-08  Chris Dumez  <cdumez@apple.com>
+
+        Object.defineProperty() should maintain existing getter / setter if not overridden in the new descriptor
+        https://bugs.webkit.org/show_bug.cgi?id=159576
+        <rdar://problem/27242197>
+
+        Reviewed by Mark Lam.
+
+        Object.defineProperty() should maintain existing getter / setter if not
+        overridden in the new descriptor. Previously, if the property is a had
+        a custom getter / setter, and if the new descriptor only had a setter
+        (or only a getter), JSC would clear the existing getter (or setter).
+        This behavior did not match the EcmaScript specification or Firefox /
+        Chrome. This patch fixes the issue.
+
+        This fixes searching and search suggestions on www.iciba.com.
+
+        * runtime/JSObject.cpp:
+        (JSC::validateAndApplyPropertyDescriptor):
+
+2016-07-08  Michael Saboff  <msaboff@apple.com>
+
+        Dumping the object graph doesn't work with verbose GC logging
+        https://bugs.webkit.org/show_bug.cgi?id=159569
+
+        Reviewed by Mark Lam.
+
+        The current object graph logging code tries to revisits the graph.  This doesn't work
+        correctly and asking around it isn't used.  The only way to dump the true object graph
+        is to log while we GC and that has obvious performance implications.
+        Therefore I eliminated GCLogging::dumpObjectGraph() and related code.  
+
+        * heap/GCLogging.cpp:
+        (JSC::GCLogging::levelAsString):
+        (JSC::LoggingFunctor::LoggingFunctor): Deleted.
+        (JSC::LoggingFunctor::~LoggingFunctor): Deleted.
+        (JSC::LoggingFunctor::operator()): Deleted.
+        (JSC::LoggingFunctor::log): Deleted.
+        (JSC::LoggingFunctor::reviveCells): Deleted.
+        (JSC::LoggingFunctor::returnValue): Deleted.
+        (JSC::GCLogging::dumpObjectGraph): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::didFinishCollection):
+
+2016-07-08  Keith Miller  <keith_miller@apple.com>
+
+        speculateTypedArrayIsNotNeutered has an inverted speculation
+        https://bugs.webkit.org/show_bug.cgi?id=159571
+
+        Reviewed by Mark Lam.
+
+        For some confusing reason FTLLowerDFGToB3 takes the condition the
+        speculation wants to be false. This issue caused
+        typedarray-access-monomorphic-neutered.js to fail on the bots.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):
+
+2016-07-08  Mark Lam  <mark.lam@apple.com>
+
+        Rename jsCPUStackLimit to osStackLimitWithReserve and jsEmulatedStackLimit to cloopStackLimit.
+        https://bugs.webkit.org/show_bug.cgi?id=159544
+
+        Reviewed by Geoffrey Garen.
+
+        This patch does the following refactoring:
+        1. Rename jsCPUStackLimit to osStackLimitWithReserve.
+        2. Rename jsEmulatedStackLimit to cloopStackLimit.
+        2. Remove llintStackLimit (which previously is either an alias for
+           jsCPUStackLimit or jsEmulatedStackLimit depending on whether we have a JIT or
+           C Loop build).  Instead, we'll change the LLINT to conditionally use the
+           osStackLimitWithReserve or cloopStackLimit.
+
+        There are no semantic changes.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::growSlowCase):
+        (JSC::JSStack::lowAddress):
+        (JSC::JSStack::highAddress):
+        * interpreter/JSStack.h:
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::ensureCapacityFor):
+        (JSC::JSStack::shrink):
+        (JSC::JSStack::grow):
+        (JSC::JSStack::setCLoopStackLimit):
+        (JSC::JSStack::setJSEmulatedStackLimit): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetupVarargsFrameFastCase):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::finishCreation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+        * runtime/VM.cpp:
+        (JSC::VM::updateStackLimit):
+        * runtime/VM.h:
+        (JSC::VM::reservedZoneSize):
+        (JSC::VM::osStackLimitWithReserve):
+        (JSC::VM::addressOfOSStackLimitWithReserve):
+        (JSC::VM::cloopStackLimit):
+        (JSC::VM::setCLoopStackLimit):
+        (JSC::VM::isSafeToRecurse):
+        (JSC::VM::jsCPUStackLimit): Deleted.
+        (JSC::VM::addressOfJSCPUStackLimit): Deleted.
+        (JSC::VM::jsEmulatedStackLimit): Deleted.
+        (JSC::VM::setJSEmulatedStackLimit): Deleted.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+
+2016-07-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r202799.
+        https://bugs.webkit.org/show_bug.cgi?id=159568
+
+        Caused build failure (Requested by perarne on #webkit).
+
+        Reverted changeset:
+
+        "[Win] DLLs are missing version information."
+        https://bugs.webkit.org/show_bug.cgi?id=159349
+        http://trac.webkit.org/changeset/202799
+
+2016-07-08  Youenn Fablet  <youenn@apple.com>
+
+        Built-in generator should generate files with a default copyright
+        https://bugs.webkit.org/show_bug.cgi?id=159561
+
+        Reviewed by Alex Christensen.
+
+        * Scripts/builtins/builtins_model.py:
+        (BuiltinsCollection._parse_copyright_lines): Adding default copyright to the parsed copyrights.
+        * Scripts/builtins/builtins_templates.py:
+        (BuiltinsGeneratorTemplates): Adding a default copyright.
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result: Rebasing with added default copyright.
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result: Ditto.
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result: Ditto.
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Ditto.
+
+
+2016-07-08  Keith Miller  <keith_miller@apple.com>
+
+        TypedArrays need more isNeutered checks.
+        https://bugs.webkit.org/show_bug.cgi?id=159231
+
+        Reviewed by Filip Pizlo.
+
+        According to the ES6 spec if a user tries to get, set, or define a
+        property on a neutered TypedArray we should throw an
+        exception. Currently, if a user tries to get an out of bounds
+        access on a TypedArray we will always OSR.  This makes handling
+        the exception easy as all we need to do is make out of bounds gets
+        in PolymorphicAccess go to the slow path, which will then throw
+        the appropriate exception. For the case of set, we need ensure we
+        don't OSR on each out of bounds put since, for some confusing
+        reason, people do this.  Thus, for GetByVal in the DFG/FTL if the
+        user accesses out of bounds we then need to check if the view has
+        been neutered. If it is neutered then we will OSR.
+
+        Additionally, this patch adds a bunch of isNeutered checks to
+        various prototype functions for TypedArray, which are needed for
+        correctness.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSCJSValue.h:
+        (JSC::encodedJSUndefined):
+        (JSC::encodedJSValue):
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::throwNeuteredTypedArrayTypeError):
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
+        (JSC::JSGenericTypedArrayView<Adaptor>::put):
+        (JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
+        (JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
+        (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
+        (JSC::JSGenericTypedArrayView<Adaptor>::deletePropertyByIndex):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncFill):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewProtoFuncSubarray):
+        * tests/stress/fold-typed-array-properties.js:
+        * tests/stress/typedarray-access-monomorphic-neutered.js: Added.
+        (check):
+        (test):
+        (testFTL):
+        * tests/stress/typedarray-access-neutered.js: Added.
+        (check):
+        (test):
+        * tests/stress/typedarray-functions-with-neutered.js:
+        (defaultForArg):
+        (callWithArgs):
+        (checkArgumentsForType):
+        (checkArguments):
+        * tests/stress/typedarray-view-string-properties-neutered.js: Added.
+        (call):
+        (test):
+
+2016-07-08  Youenn Fablet  <youenn@apple.com>
+
+        Generate WebCore builtin wrapper files
+        https://bugs.webkit.org/show_bug.cgi?id=159461
+
+        Reviewed by Brian Burg.
+
+        Updating builtin generator to generate wrapper files used in WebCore (See WebCore change log).
+        Rebasing builtins generator test results according generator changes by activating wrapper file generation for
+        WebCore builtins tests.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Scripts/builtins/builtins.py: Adding new generators.
+        * Scripts/builtins/builtins_generate_internals_wrapper_header.py: Added to generate WebCoreJSBuiltinInternals.h.
+        * Scripts/builtins/builtins_generate_internals_wrapper_implementation.py: Added to generate WebCoreJSBuiltinInternals.cpp.
+        * Scripts/builtins/builtins_generate_wrapper_header.py: Added to generate WebCoreJSBuiltins.h.
+        * Scripts/builtins/builtins_generate_wrapper_implementation.py: Added to generate WebCoreJSBuiltins.cpp.
+        * Scripts/generate-js-builtins.py: Adding new option to activate generation of the wrapper files.
+        (generate_bindings_for_builtins_files):
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+
+2016-07-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        padStart/padEnd with Infinity produces unexpected result
+        https://bugs.webkit.org/show_bug.cgi?id=159543
+
+        Reviewed by Benjamin Poulain.
+
+        * builtins/GlobalOperations.js:
+        (globalPrivate.toLength):
+        Fix style.
+
+        * builtins/StringPrototype.js:
+        (padStart):
+        (padEnd):
+        After all observable operations, and after empty string has been handled,
+        throw an out of memory error if the resulting string would be greater
+        than the maximum string size.
+
+        * tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js:
+        (shouldThrow): Deleted.
+        * tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js:
+        (shouldThrow):
+        (testMeta):
+        * tests/es6/String.prototype_methods_String.prototype.padEnd.js:
+        (shouldThrow):
+        (TestToLength):
+        (TestMemoryLimits):
+        (TestMeta): Deleted.
+        * tests/es6/String.prototype_methods_String.prototype.padStart.js:
+        (shouldThrow):
+        (TestToLength):
+        (TestMemoryLimits):
+        Replace incorrect shouldThrow(..., errorType) with explicit shouldThrow(..., errorMessage).
+        The old shouldThrow would incorrectly succeed if the expected error type was just "Error".
+        Now we explicitly check the error message.
+
+2016-07-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] String.prototype[Symbol.iterator] needs a name
+        https://bugs.webkit.org/show_bug.cgi?id=159541
+
+        Reviewed by Yusuke Suzuki.
+
+        A man needs a name.
+        Spec: https://tc39.github.io/ecma262/#sec-string.prototype-@@iterator
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2016-07-07  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(184445): Need to insert a StoreBarrier when we don't know child's epoch
+        https://bugs.webkit.org/show_bug.cgi?id=159537
+
+        Reviewed by Benjamin Poulain.
+
+        We weren't checking the case of a child node with a null epoch.  The problem surfaces
+        when the base node of a PutByVal variant has a non-null epoch, because it represents an
+        allocation in the current function, while the child of the same node has an unknown epoch.
+        Added a check that the child node is not null before comparing the epochs of the base and
+        child nodes.
+
+        The added test creates the problem circumstance by doing a full GC to place an array in
+        remembered space, allocating a new object followed by an eden GC.  The new object is
+        only referenced by the array and therefore won't be visited Without the store barrier.
+        The test may crash or more likely get the wrong answer with the bug.
+
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * tests/stress/regress-159537.js: Added test.
+        (MyNumber):
+        (MyNumber.prototype.plusOne):
+        (bar):
+        (foo):
+        (test):
+
+2016-07-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unexpected "Out of memory" error for "x".repeat(-1)
+        https://bugs.webkit.org/show_bug.cgi?id=159529
+
+        Reviewed by Benjamin Poulain.
+
+        * builtins/StringPrototype.js:
+        (globalPrivate.repeatSlowPath):
+        (repeat):
+        Move the @toInteger and range checking to the always path,
+        since the spec does say it should always happen. Also remove
+        the duplication of the fast path here.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::repeatCharacter):
+        Remove unused function.
+
+        (JSC::stringProtoFuncRepeatCharacter):
+        ASSERT if given a negative number. This is a private function
+        only used internally.
+
+        * tests/stress/string-repeat-edge-cases.js:
+        (shouldThrow):
+        Update expected error message.
+
+2016-07-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Array.prototype[Symbol.unscopables] should have the "includes" property
+        https://bugs.webkit.org/show_bug.cgi?id=159504
+
+        Reviewed by Keith Miller.
+
+        The property "includes" was missing.
+        Spec: https://tc39.github.io/ecma262/#sec-array.prototype-@@unscopables
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * tests/stress/unscopables.js:
+
+2016-07-07  Saam Barati  <sbarati@apple.com>
+
+        ToThis constant folding in DFG is incorrect when the structure indicates that toThis is overridden
+        https://bugs.webkit.org/show_bug.cgi?id=159501
+        <rdar://problem/27109354>
+
+        Reviewed by Mark Lam.
+
+        We *cannot* constant fold ToThis when the structure of an object
+        indicates that toThis() is overridden. isToThisAnIdentity() inside
+        AbstractInterpreterInlines accidentally wrote the opposite rule.
+        The rule was written as we can constant fold ToThis only when
+        toThis() is overridden. To fix the bug, we must write the rule
+        as isToThisAnIdentity() can only be true as long as the structure
+        set indicates that no structures override toThis().
+
+        We could probably get more clever in the future and notice
+        when we're dealing with a constant |this| values. For example,
+        a ToThis might occur on a constant JSLexicalEnvironment. We could
+        implement the rules of JSLexicalEnvironment's toThis() implementation
+        inside AI/constant folding.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::isToThisAnIdentity):
+        * tests/stress/to-this-on-constant-lexical-environment.js: Added.
+        (foo.bar):
+        (foo.inner):
+        (foo):
+
+2016-07-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Array.prototype.includes uses ToInt32 instead of ToInteger on the index argument
+        https://bugs.webkit.org/show_bug.cgi?id=159505
+
+        Reviewed by Mark Lam.
+
+        The code was using (value)|0 which is effectively a ToInt32.
+        This fails on large integers and +-Infinity.
+
+        Spec: https://tc39.github.io/ecma262/#sec-array.prototype.includes
+
+        * builtins/ArrayPrototype.js:
+        (includes):
+
+2016-07-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] String.prototype.normalize should have a length of zero
+        https://bugs.webkit.org/show_bug.cgi?id=159506
+
+        Reviewed by Yusuke Suzuki.
+
+        Spec: https://tc39.github.io/ecma262/#sec-string.prototype.normalize
+        The argument is optional, the length should be zero.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2016-07-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARMv7] REGRESSION(r197655): ASSERTION FAILED: (cond == Zero) || (cond == NonZero)
+        https://bugs.webkit.org/show_bug.cgi?id=159419
+
+        Reviewed by Benjamin Poulain.
+
+        Allow Signed and PositiveOrZero conditions too because tst instruction updates N and Z flags.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branchTest32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchTest32): Add assertions to avoid possible bugs in the future.
+
+2016-07-06  Youenn Fablet  <youenn@apple.com>
+
+        Builtin generator should use pragma once for header files
+        https://bugs.webkit.org/show_bug.cgi?id=159462
+
+        Reviewed by Alex Christensen.
+
+        * Scripts/builtins/builtins_generate_combined_header.py:
+        (BuiltinsCombinedHeaderGenerator.generate_output): 
+        * Scripts/builtins/builtins_generate_separate_header.py:
+        (BuiltinsSeparateHeaderGenerator.generate_output):
+        * Scripts/builtins/builtins_templates.py:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+
+2016-07-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Unify how we throw TypeError from C++
+        https://bugs.webkit.org/show_bug.cgi?id=159500
+
+        Reviewed by Saam Barati.
+
+        Throwing a TypeError is an uncommon case. We should minimize the impact
+        on the call sites.
+
+        This patch does that by:
+        -Replace the 2 calls createTypeError()->throwException() by throwTypeError().
+        -Use ASCIILiteral when possible.
+        -Add an overload of throwTypeError() taking ASCIILiteral directly
+         (that way, the String creation and destruction is done by the callee).
+
+        On x86_64, this reduces the __TEXT__ segment by 29kb.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToJSON):
+        * runtime/Error.cpp:
+        (JSC::throwConstructorCannotBeCalledAsFunctionTypeError):
+        (JSC::throwTypeError):
+        * runtime/Error.h:
+        (JSC::throwVMTypeError):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::toPreferredPrimitiveType):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncSubarray):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::callToPrimitiveFunction):
+        (JSC::JSObject::ordinaryToPrimitive):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::validateAndApplyPropertyDescriptor):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::constructTypedArrayView):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncLength):
+        (JSC::typedArrayViewProtoFuncSet):
+        (JSC::typedArrayViewProtoFuncCopyWithin):
+        (JSC::typedArrayViewProtoFuncFill):
+        (JSC::typedArrayViewProtoFuncLastIndexOf):
+        (JSC::typedArrayViewProtoFuncIndexOf):
+        (JSC::typedArrayViewProtoFuncJoin):
+        (JSC::typedArrayViewProtoGetterFuncBuffer):
+        (JSC::typedArrayViewProtoGetterFuncLength):
+        (JSC::typedArrayViewProtoGetterFuncByteLength):
+        (JSC::typedArrayViewProtoGetterFuncByteOffset):
+        (JSC::typedArrayViewProtoFuncReverse):
+        (JSC::typedArrayViewProtoFuncSubarray):
+        (JSC::typedArrayViewProtoFuncSlice):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::toNumber):
+
+2016-07-06  Saam Barati  <sbarati@apple.com>
+
+        InlineAccess::sizeForLengthAccess() is wrong on some platforms because it should also consider "length" not being array length
+        https://bugs.webkit.org/show_bug.cgi?id=159429
+
+        Reviewed by Filip Pizlo.
+
+        The calculation inside sizeForLengthAccess() was not taking into
+        account that an access to a "length" property might not be an
+        array length access. sizeForLengthAccess() should always have enough
+        room for a regular self property accesses. This only changes how
+        much of a nop sled we emit if array length access size is smaller
+        than self access size. This matters on ARM64.
+
+        * bytecode/InlineAccess.h:
+        (JSC::InlineAccess::sizeForPropertyAccess):
+        (JSC::InlineAccess::sizeForPropertyReplace):
+        (JSC::InlineAccess::sizeForLengthAccess):
+
+2016-07-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r198928 and r198985.
+        https://bugs.webkit.org/show_bug.cgi?id=159478
+
+        "It's breaking some websites" (Requested by saamyjoon on
+        #webkit).
+
+        Reverted changesets:
+
+        "[ES6] Disallow var assignments in for-in loops"
+        https://bugs.webkit.org/show_bug.cgi?id=155451
+        http://trac.webkit.org/changeset/198928
+
+        "Unreviewed, turn ES6 for-in loop test success"
+        https://bugs.webkit.org/show_bug.cgi?id=155451
+        http://trac.webkit.org/changeset/198985
+
+2016-07-05  Mark Lam  <mark.lam@apple.com>
+
+        Rename VM stack limit fields to better describe their purpose.
+        https://bugs.webkit.org/show_bug.cgi?id=159451
+
+        Reviewed by Keith Miller.
+
+        This is in preparation for an upcoming patch that changes what stack limit values
+        are used under various circumstances.  This patch aims to do some minimal work to
+        rename the fields so that it will be easier to reason about the upcoming patch.
+    
+        In this patch, we make the following changes:
+
+        1. Rename VM::m_stackLimit to VM::m_jsCPUStackLimit.
+
+        2. VM::m_jsStackLimit used to have an overloaded meaning:
+           a. For JIT builds, m_jsStackLimit is synonymous with m_stackLimit.
+           b. For C Loop builds, m_jsStackLimit is a separate pointer that points to the
+              emulated JS stack that the C Loop uses.
+
+           In place of m_jsStackLimit, this patch introduces 2 new fields:
+           VM::m_jsEmulatedStackLimit and VM::m_llintStackLimit.
+
+           m_llintStackLimit is the limit that the LLInt assembly uses for its stack
+           check.  m_llintStackLimit behaves like the old m_jsStackLimit in that:
+           a. For JIT builds, m_llintStackLimit is synonymous with m_jsCPUStackLimit.
+           b. For C Loop builds, m_llintStackLimit is synonymous with m_jsEmulatedStackLimit.
+
+           m_jsEmulatedStackLimit is used for the emulated stack that the C Loop uses.
+
+        3. Rename the following methods to match the above:
+             VM::stackLimit() ==> VM::jsCPUStackLimit()
+             VM::addressOfStackLimit() ==> VM::addressOfJSCPUStackLimit()
+             VM::jsStackLimit() ==> VM::jsEmulatedStackLimit()
+             VM::setJSStackLimit() ==> VM::setJSEmulatedStackLimit()
+             JSStack::setStackLimit() ==> JSStack::setEmulatedStackLimit()
+
+        4. With change (2) and (3), the limits will be used as follows:
+           a. VM code doing stack recursion checks will only use m_jsCPUStackLimit.
+           b. JIT code will only use m_jsCPUStackLimit.
+           c. C Loop emulated stack code in JSStack will only use m_jsEmulatedStackLimit.
+              Note: the part of JSStack that operates on a JIT build will use
+                    m_jsCPUStackLimit as expected.
+           d. LLINT assembly code will only use m_llintStackLimit.
+
+        This patch only contains the above refactoring changes.  There is no behavior
+        change.
+
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::growSlowCase):
+        (JSC::JSStack::lowAddress):
+        (JSC::JSStack::highAddress):
+        * interpreter/JSStack.h:
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::ensureCapacityFor):
+        (JSC::JSStack::shrink):
+        (JSC::JSStack::grow):
+        (JSC::JSStack::setJSEmulatedStackLimit):
+        (JSC::JSStack::setStackLimit): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        * jit/SetupVarargsFrame.cpp:
+        (JSC::emitSetupVarargsFrameFastCase):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::finishCreation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::updateStackLimit):
+        * runtime/VM.h:
+        (JSC::VM::reservedZoneSize):
+        (JSC::VM::jsCPUStackLimit):
+        (JSC::VM::addressOfJSCPUStackLimit):
+        (JSC::VM::jsEmulatedStackLimit):
+        (JSC::VM::setJSEmulatedStackLimit):
+        (JSC::VM::isSafeToRecurse):
+        (JSC::VM::jsStackLimit): Deleted.
+        (JSC::VM::setJSStackLimit): Deleted.
+        (JSC::VM::stackLimit): Deleted.
+        (JSC::VM::addressOfStackLimit): Deleted.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::startFunction):
+
+2016-07-05  Saam Barati  <sbarati@apple.com>
+
+        StackVisitor::unwindToMachineCodeBlockFrame() may unwind past a VM entry frame when catching an exception and the frame has inlined tail calls
+        https://bugs.webkit.org/show_bug.cgi?id=159448
+        <rdar://problem/27084459>
+
+        Reviewed by Mark Lam.
+
+        Consider the following stack trace:
+        (machine) foo -> VM entry frame -> (machine) bar -> (inlined tailcall) baz
+
+        If an exception is thrown at 'baz', we will do exception unwinding,
+        which will eventually call unwindToMachineCodeBlockFrame() which will call
+        gotoNextFrame() on the 'baz' frame. The next logical frame for 'baz' is 'foo' because
+        'bar' tail called 'baz' even though there is a machine frame for 'bar' on the stack.
+        This is a bug. unwindToMachineCodeBlockFrame() should not care about the next
+        logical frame, it just wants to move StackVisitor's state to the current machine
+        frame. The bug here is that we would end up unwinding past the VM entry frame
+        which can have all kinds of terrible consequences.
+
+        This bug fixes unwindToMachineCodeBlockFrame() by having it not rely
+        on gotoNextFrame() and instead using its own mechanism for setting
+        the StackVisotor's state to the current machine frame.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::unwindToMachineCodeBlockFrame):
+        * tests/stress/dont-unwind-past-vm-entry-frame.js: Added.
+        (let.p.new.Proxy):
+        (let.p.new.Proxy.apply):
+        (bar):
+        (let.good):
+        (getItem):
+        (start):
+
+2016-07-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        RELEASE_ASSERT(!thisObject) in ObjCCallbackFunctionImpl::call when calling JSExport ObjC Constructor without operator new
+        https://bugs.webkit.org/show_bug.cgi?id=159446
+
+        Reviewed by Mark Lam.
+
+        Treat ObjC JSExport init constructors like ES6 Class Constructors
+        and throw a TypeError when called without 'new'.
+
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunctionImpl::type):
+        (JSC::objCCallbackFunctionCallAsFunction):
+        When calling an init method as a function instead of construction
+        throw a TypeError.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        Improve error message.
+
+        * API/tests/testapi.mm:
+        (testObjectiveCAPIMain):
+        Test we get an exception when calling an ObjC constructor without 'new'.
+
+2016-07-05  Mark Lam  <mark.lam@apple.com>
+
+        Remove some unneeded #include "CachedCall.h".
+        https://bugs.webkit.org/show_bug.cgi?id=159449
+
+        Reviewed by Saam Barati.
+
+        * runtime/ArrayPrototype.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/MapPrototype.cpp:
+        * runtime/SetPrototype.cpp:
+
+2016-07-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Crash @ bankofamerica.com, University of Vienna
+        https://bugs.webkit.org/show_bug.cgi?id=159439
+
+        Reviewed by Saam Barati.
+
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link): Do check for stack overflow in the arity mismatch thunk
+        because it can happen. Don't store a CallSiteIndex because we haven't
+        stored a CodeBlock yet, and our stack frame is not fully constructed,
+        so it would be an error for any client to try to load this value (and
+        operationCallArityCheck does not load this value).
+
+        * tests/stress/arity-check-ftl-throw.js: Added. New test case for stressing
+        a stack overflow with arity mismatch. Sadly, after hours of fiddling, I
+        can't seem to get this to fail in trunk. Still, it's good to have some
+        more testing in this area.
+
+2016-07-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] The prototype cycle checks throws the wrong error type
+        https://bugs.webkit.org/show_bug.cgi?id=159393
+
+        Reviewed by Geoffrey Garen.
+
+        We were supposed to throw the TypeError:
+        -https://tc39.github.io/ecma262/#sec-set-object.prototype.__proto__
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+
+2016-07-05  Saam Barati  <sbarati@apple.com>
+
+        our parsing for "use strict" is wrong when we first parse other directives that are not "use strict" but are located in a place where "use strict" would be valid
+        https://bugs.webkit.org/show_bug.cgi?id=159376
+        <rdar://problem/27108773>
+
+        Reviewed by Benjamin Poulain.
+
+        Our strict mode detection algorithm used to break if we ever saw a directive
+        that is not "use strict" but is syntactically located in a location where our
+        parser looks for "use strict". It broke as follows:
+
+        If a function started with a non "use strict" string literal, we will allow
+        "use strict" to be in any arbitrary statement inside the top level block in
+        the function body. For example, this meant that if we parsed a sequence of string
+        literals, followed by arbitrary statements, followed by "use strict", we would parse
+        the function as if it's in strict mode. This is the wrong behavior with respect to
+        the spec. This has consequences in other ways that break invariants of the language.
+        For example, we used to allow functions that are lexically nested inside what we deemed
+        a strict function to be non-strict. This used to fire an assertion if we ever skipped over
+        that function using the source provider cache, but it worked just fine in release builds.
+
+        This patch fixes this bug.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseSourceElements):
+        (JSC::Parser<LexerType>::parseStatement):
+        * tests/stress/ensure-proper-strict-mode-parsing.js: Added.
+        (foo.bar):
+        (foo):
+        (bar.foo):
+        (bar):
+        (bar.call.undefined.this.throw.new.Error.string_appeared_here.baz):
+        (baz.call.undefined.undefined.throw.new.Error.string_appeared_here.jaz):
+        (jaz.call.undefined.this.throw.new.Error.string_appeared_here.vaz):
+
+2016-07-05  Saam Barati  <sbarati@apple.com>
+
+        reportAbandonedObjectGraph should report abandoned bytes based on capacity() so it works even if a GC has never happened
+        https://bugs.webkit.org/show_bug.cgi?id=159222
+        <rdar://problem/27001991>
+
+        Reviewed by Geoffrey Garen.
+
+        When reportAbandonedObjectGraph() was called before the first GC, it used to
+        not indicate to the GC timers that we have memory that needs to be collected
+        because the calculation was based on m_sizeAfterLastCollect (which was zero).
+        This patch makes the calculation based on capacity() which is a valid number
+        even before the first GC.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::reportAbandonedObjectGraph):
+        (JSC::Heap::protect):
+        (JSC::Heap::didAbandon): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::jitStubRoutines):
+
+2016-07-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Typo fix after r202214
+        https://bugs.webkit.org/show_bug.cgi?id=159416
+
+        Reviewed by Saam Barati.
+
+        * bytecode/InlineAccess.h:
+
+2016-07-03  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] DLLs are missing version information.
+        https://bugs.webkit.org/show_bug.cgi?id=159349
+
+        Reviewed by Brent Fulgham.
+
+        Run perl version stamp utility.
+        
+        * CMakeLists.txt:
+
+2016-07-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] MacroAssemblerX86::branch8 should accept unsigned 8bit value
+        https://bugs.webkit.org/show_bug.cgi?id=159334
+
+        Reviewed by Benjamin Poulain.
+
+        As described in branchTest8 functions, byte in TrustedImm32 is not well defined.
+        So the assertion here should be a little permissive; accepting -128 to 255.
+
+        This assertion is originally fired when executing misc-bugs-847389-jpeg2000 benchmark in Debug build.
+        So this patch includes misc-bugs-847389-jpeg2000 benchmark.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branchTest8):
+        (JSC::MacroAssemblerX86Common::branch8):
+        * b3/testb3.cpp:
+        (JSC::B3::testBranch8WithLoad8ZIndex):
+        (JSC::B3::run):
+
+2016-07-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] __lookupGetter__ and __lookupSetter__ should not ignore exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=159390
+
+        Reviewed by Mark Lam.
+
+        See:
+        -https://tc39.github.io/ecma262/#sec-object.prototype.__lookupGetter__
+        -https://tc39.github.io/ecma262/#sec-object.prototype.__lookupSetter__
+
+        They are both supposed to be regular [[GetOwnProperty]].
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+
+2016-07-03  Saam Barati  <sbarati@apple.com>
+
+        BytecodeGenerator::getVariablesUnderTDZ is too conservative
+        https://bugs.webkit.org/show_bug.cgi?id=159387
+
+        Reviewed by Filip Pizlo.
+
+        We were too conservative in the following type of programs:
+        ```
+        {
+            {
+                let x;
+                ...
+            }
+            let x;
+        }
+        ```
+        We used to report "x" as under TDZ when calling getVariablesUnderTDZ at the
+        "...", even though "x" is not under TDZ. This patch removes this conservatism
+        and makes the algorithm precise.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::getVariablesUnderTDZ):
+        * bytecompiler/BytecodeGenerator.h:
+
+2016-07-03  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should refer to B3 types directly
+        https://bugs.webkit.org/show_bug.cgi?id=159389
+
+        Reviewed by Saam Barati.
+        
+        When we used LLVM, types were objects that were allocated by the LLVMContext. We had to
+        remember pointers to them or else call through the C API every time we wanted the type. We
+        stored the type pointers inside FTL::CommonValues.
+        
+        But in B3, types are just members of an enum. We don't have to remember pointers to them.
+        
+        This change replaces all prior uses of things like "m_out.int32" with just "Int32", and
+        likewise for m_out.boolean, m_out.int64, m_out.intPtr, m_out.floatType, m_out.doubleType,
+        and m_out.voidType.
+        
+        We still use FTL::CommonValues for common constants that we have pre-hoisted. Hopefully we
+        will come up with a better story for those eventually, since that's still kinda ugly.
+
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::createPhiVariables):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
+        (JSC::FTL::DFG::LowerDFGToB3::compileBooleanToNumber):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStrCat):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithMinOrMax):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithPow):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByIdWithThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByValWithThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByIdWithThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByValWithThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutAccessorById):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutGetterSetterById):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutAccessorByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateScopedArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateClonedArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCopyRest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetRestLength):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayBuffer):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToNumber):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToPrimitive):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringFromCharCode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLoadVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSwitch):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsString):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsRegExpObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsTypedArrayView):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
+        (JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckTypeInfoFlags):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCountExecution):
+        (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
+        (JSC::FTL::DFG::LowerDFGToB3::compileHasGenericProperty):
+        (JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumerableLength):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetPropertyEnumerator):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorStructurePname):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorGenericPname):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToIndexString):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckStructureImmediate):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSetFunctionName):
+        (JSC::FTL::DFG::LowerDFGToB3::numberOrNotCellToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
+        (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        (JSC::FTL::DFG::LowerDFGToB3::compare):
+        (JSC::FTL::DFG::LowerDFGToB3::compileResolveScope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetDynamicVar):
+        (JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateTruthyObject):
+        (JSC::FTL::DFG::LowerDFGToB3::nonSpeculativeCompare):
+        (JSC::FTL::DFG::LowerDFGToB3::stringsEqual):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::ensureShadowChickenPacket):
+        (JSC::FTL::DFG::LowerDFGToB3::boolify):
+        (JSC::FTL::DFG::LowerDFGToB3::equalNullOrUndefined):
+        (JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
+        (JSC::FTL::DFG::LowerDFGToB3::buildSwitch):
+        (JSC::FTL::DFG::LowerDFGToB3::switchStringSlow):
+        (JSC::FTL::DFG::LowerDFGToB3::doubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::sensibleDoubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::strictInt52ToJSValue):
+        (JSC::FTL::DFG::LowerDFGToB3::strictInt52ToInt52):
+        (JSC::FTL::DFG::LowerDFGToB3::unboxInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::boxInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::isCellOrMisc):
+        (JSC::FTL::DFG::LowerDFGToB3::unboxDouble):
+        (JSC::FTL::DFG::LowerDFGToB3::boxDouble):
+        (JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
+        (JSC::FTL::DFG::LowerDFGToB3::doubleToStrictInt52):
+        (JSC::FTL::DFG::LowerDFGToB3::convertDoubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::callCheck):
+        (JSC::FTL::DFG::LowerDFGToB3::crash):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::bitCast):
+
+2016-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG LICM needs to go all-in on the idea that some loops can't be LICMed
+        https://bugs.webkit.org/show_bug.cgi?id=159388
+
+        Reviewed by Mark Lam.
+        
+        Some time ago I acknowledged that LICM required loops to meet certain requirements that
+        may get broken by the time we do LICM, like that the terminal of the pre-header is ExitOK.
+        It used to be that we just ignored that requirement and would hoist anyway, but since
+        r189126 we've stopped hoisting out of loops that don't have ExitOK.  We also added tests
+        for the case that the pre-header doesn't exist or is invalid.
+
+        It turns out that this patch didn't go far enough: even though it made LICM avoid loops
+        that had an invalid pre-header, the part that updated the AI state in nested loops still
+        assumed that these loops had valid pre-headers.  We would crash in null dereference in
+        that loop if a nested loop had an invalid pre-header.
+
+        The fix is simple: don't update the AI state of nested loops that don't have pre-headers,
+        since we won't try to hoist out of those loops anyway.
+
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * tests/stress/licm-no-pre-header-nested.js: Added. This would always crash before this fix.
+        (foo):
+        * tests/stress/licm-pre-header-cannot-exit-nested.js: Added. This was a failed attempt at a test, but I figure it's good to have weird code anyway.
+        (foo):
+        (valueOf):
+
+2016-06-30  Filip Pizlo  <fpizlo@apple.com>
+
+        Scopes that are not under TDZ should still push their variables onto the TDZ stack so that lifting TDZ doesn't bypass that scope
+        https://bugs.webkit.org/show_bug.cgi?id=159332
+        rdar://problem/27018958
+
+        Reviewed by Saam Barati.
+        
+        This fixes an instacrash in this code:
+        
+            try{}catch(e){}print(e);let e;
+        
+        We lift TDZ for "e" in "catch (e){}", but since that scope doesn't push anything onto the
+        TDZ stack, we lift TDZ from "let e".
+        
+        The problem is that we weren't tracking the set of variables that do not have TDZ. We need
+        to track them to "block" the traversal that lifts TDZ. This change fixes this issue by
+        using a map that tracks all known variables, and tells you if they are under TDZ or not.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numParameters):
+        * bytecode/CodeOrigin.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::Label::setLocation):
+        (JSC::Variable::dump):
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::popLexicalScope):
+        (JSC::BytecodeGenerator::popLexicalScopeInternal):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::needsTDZCheck):
+        (JSC::BytecodeGenerator::liftTDZCheckIfPossible):
+        (JSC::BytecodeGenerator::pushTDZVariables):
+        (JSC::BytecodeGenerator::getVariablesUnderTDZ):
+        (JSC::BytecodeGenerator::endGenerator):
+        (WTF::printInternal):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::Variable::isConst):
+        (JSC::Variable::setIsReadOnly):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::topOfFrame):
+        * tests/stress/lift-tdz-bypass-catch.js: Added.
+        (foo):
+        (catch):
+
+2016-07-01  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] RegExp.compile is not returning the regexp when it succeed
+        https://bugs.webkit.org/show_bug.cgi?id=159381
+
+        Reviewed by Mark Lam.
+
+        Spec:
+        -https://tc39.github.io/ecma262/#sec-regexp.prototype.compile
+        -https://tc39.github.io/ecma262/#sec-regexpinitialize
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+
+2016-07-01  Saam Barati  <sbarati@apple.com>
+
+        fix "ASSERTION FAILED: currentOffset() >= currentLineStartOffset()"
+        https://bugs.webkit.org/show_bug.cgi?id=158572
+        <rdar://problem/26884092>
+
+        Reviewed by Mark Lam.
+
+        There is a bug in our lexer when we notice the pattern:
+        ```<return|continue|break|...etc> // some comment here```
+        Our code will say that the token for the comment is a semicolon.
+        This is the correct semantics, however, it would give the semicolon
+        a start offset of the comment, but it will give its line start offset
+        the newline after the comment.  This breaks the invariant in the lexer/parser
+        that the offset for the current line starting point must be less than or equal to
+        than the start offset of any token on that line. This invariant was broken because
+        the line start offset was greater than the token start offset. To maintain this
+        invariant, we claim that the semicolon token is located where the comment starts,
+        and that its line start offset is the line start offset for the line with the
+        comment on it.  There are other solutions that maintain this invariant, but this
+        solution provides the best error messages.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+        * parser/Parser.h:
+        (JSC::Parser::internalSaveLexerState):
+        * tests/stress/obscure-error-message-dont-crash.js: Added.
+        (try.eval.or.catch):
+
+2016-07-01  Benjamin Poulain  <bpoulain@apple.com>
+
+        __defineGetter__/__defineSetter__ should throw exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=142934
+
+        Reviewed by Mark Lam.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+
+2016-07-01  Jon Davis  <jond@apple.com>
+
+        Moved Web Animations and Resource Timing feature entries to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=159356
+
+        Reviewed by Timothy Hatcher.
+
+        * features.json:
+
+2016-07-01  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Date.toGMTString should be the Date.toUTCString function
+        https://bugs.webkit.org/show_bug.cgi?id=159318
+
+        Reviewed by Mark Lam.
+
+        See https://tc39.github.io/ecma262/#sec-date.prototype.togmtstring
+
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+        (JSC::dateProtoFuncToGMTString): Deleted.
+
+2016-07-01  Mark Lam  <mark.lam@apple.com>
+
+        Update JSC_functionOverrides to handle the new SourceCode strings that have params.
+        https://bugs.webkit.org/show_bug.cgi?id=159321
+
+        Reviewed by Geoffrey Garen.
+
+        And add tests so that this won't fail silently and bit rot anymore.
+
+        * API/tests/FunctionOverridesTest.cpp: Added.
+        (testFunctionOverrides):
+        * API/tests/FunctionOverridesTest.h: Added.
+        * API/tests/testapi-function-overrides.js: Added.
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::link):
+        * shell/PlatformWin.cmake:
+        * tools/FunctionOverrides.cpp:
+        (JSC::FunctionOverrides::FunctionOverrides):
+        (JSC::FunctionOverrides::reinstallOverrides):
+        (JSC::initializeOverrideInfo):
+        (JSC::FunctionOverrides::initializeOverrideFor):
+        * tools/FunctionOverrides.h:
+        (JSC::FunctionOverrides::clear):
+
+2016-07-01  Caio Lima  <ticaiolima@gmail.com>
+
+        ES6: Implement HasRestrictedGlobalProperty when checking for global lexical tier conflicts
+        https://bugs.webkit.org/show_bug.cgi?id=148763
+
+        Reviewed by Saam Barati
+
+        I've implemented the ES6 spec 8.1.1.4.14
+        (http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasrestrictedglobalproperty)
+        that defines when a global property can be shadowed.
+
+        Added some test cases into global-lexical-redeclare-variable.js
+
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * tests/stress/global-lexical-redeclare-variable.js:
+        (catch):
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/eighth.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/nineth.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/seventh.js: Added.
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/sixth.js:
+        * tests/stress/multiple-files-tests/global-lexical-redeclare-variable/tenth.js: Added.
+
+2016-07-01  Youenn Fablet  <youennf@gmail.com>
+
+        Add a runtime flag for DOM iterators
+        https://bugs.webkit.org/show_bug.cgi?id=159300
+
+        Reviewed by Alex Christensen.
+
+        * runtime/CommonIdentifiers.h:
+
+2016-06-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Wrong function name next to scope
+        https://bugs.webkit.org/show_bug.cgi?id=158210
+        <rdar://problem/26543093>
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add DebuggerLocation. A helper for describing a unique location.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::setConstantRegisters):
+        When compiled with debug info, add a SymbolTable rare data pointer
+        back to the CodeBlock. This will be used later to get JSScope debug
+        info if Web Inspector pauses.
+
+        * runtime/SymbolTable.h:
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::cloneScopePart):
+        (JSC::SymbolTable::prepareForTypeProfiling):
+        (JSC::SymbolTable::uniqueIDForVariable):
+        (JSC::SymbolTable::uniqueIDForOffset):
+        (JSC::SymbolTable::globalTypeSetForOffset):
+        (JSC::SymbolTable::globalTypeSetForVariable):
+        Rename rareData and include a CodeBlock pointer.
+
+        (JSC::SymbolTable::rareDataCodeBlock):
+        (JSC::SymbolTable::setRareDataCodeBlock):
+        Setter and getter for the rare data. It should only be set once.
+
+        (JSC::SymbolTable::visitChildren):
+        Visit the rare data code block if we have one.
+
+        * runtime/JSSymbolTableObject.h:
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::deleteProperty):
+        (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
+        Give JSSymbolTable its own class info. JSWithScope was unexpectedly
+        inheriting from JSSymbolTable since it did not have its own and
+        was using JSScope's class info. Also do a bit of cleanup.
+
+        * debugger/DebuggerLocation.cpp: Added.
+        (JSC::DebuggerLocation::DebuggerLocation):
+        * debugger/DebuggerLocation.h: Added.
+        (JSC::DebuggerLocation::DebuggerLocation):
+        Construction from a ScriptExecutable.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::symbolTable):
+        * runtime/JSScope.h:
+        * debugger/DebuggerScope.h:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::name):
+        (JSC::DebuggerScope::location):
+        Name and location for a scope. This uses:
+        JSScope -> SymbolTable -> CodeBlock -> Executable
+
+        * inspector/protocol/Debugger.json:
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        (InjectedScript.CallFrameProxy._createScopeJson):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::valueForScopeType):
+        (Inspector::valueForScopeLocation):
+        (Inspector::JSJavaScriptCallFrame::scopeDescriptions):
+        (Inspector::JSJavaScriptCallFrame::scopeType): Deleted.
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeType): Deleted.
+        Simplify this code to build the objects we will send across the protocol
+        to descript a Scope.
+
+2016-06-30  Saam Barati  <sbarati@apple.com>
+
+        missing exception checks in arrayProtoFuncReverse
+        https://bugs.webkit.org/show_bug.cgi?id=159319
+        <rdar://problem/27083696>
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncReverse):
+
+2016-06-30  Saam Barati  <sbarati@apple.com>
+
+        get_by_id_with_this does not trigger a to_this in caller.
+        https://bugs.webkit.org/show_bug.cgi?id=159226
+
+        Reviewed by Keith Miller.
+
+        This is a bug if the caller is in sloppy mode and the callee is in strict
+        mode. This can't happen with ES6 classes because they're all in strict mode,
+        but it can happen with method syntax on an object literal. The caller must
+        to_this on |this| when it knows that it performs super property accesses.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * tests/stress/super-property-access-object-literal-to-this-2.js: Added.
+        (assert):
+        (test):
+        (let.o1.get foo):
+        (let.o2.a):
+        (let.o2.aa):
+        * tests/stress/super-property-access-object-literal-to-this.js: Added.
+        (assert):
+        (test):
+        (let.o1.get foo):
+        (let.o2.a):
+        (let.o2.aa):
+        (let.o2.b):
+        (let.o2.bb):
+        * tests/stress/super-property-access-to-this.js: Added.
+        (assert):
+        (test):
+        (Base.prototype.get foo):
+        (Base):
+        (Child.prototype.a):
+        (Child.prototype.b):
+        (Child):
+
+2016-06-30  Saam Barati  <sbarati@apple.com>
+
+        We need to to_this when an inner arrow function uses 'this'
+        https://bugs.webkit.org/show_bug.cgi?id=159290
+        <rdar://problem/27058322>
+
+        Reviewed by Geoffrey Garen.
+
+        We put the |this| value into the closure object when there
+        is an arrow function that uses |this|. However, an arrow function
+        using |this| wasn't causing the creator of the closure that
+        holds |this| to to_this its value before putting it in the
+        closure. That's a huge bug because it means some arrow functions
+        can capture the raw |this| value, which might be a JSLexicalEnvironment.
+        This patch fixes this by adding an easy to check to see if any
+        inner arrow functions use |this|, and if any do, it will to_this
+        the |this| value.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * tests/stress/to-this-before-arrow-function-closes-over-this-that-starts-as-lexical-environment.js: Added.
+        (assert):
+        (obj):
+        (foo.capture):
+        (foo.wrapper.let.x.):
+        (foo2.capture):
+        (foo2.wrapper.let.x.):
+        (foo2.wrapper.bar):
+
+2016-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Generators violate bytecode liveness validation
+        https://bugs.webkit.org/show_bug.cgi?id=159279
+
+        Reviewed by Yusuke Suzuki.
+        
+        Fix a liveness bug found by Basic. The problem is that resume's intended liveness rule is:
+        "live-in is just the token argument", but the liveness analysis thought that the rule was
+        "live-in is live-out minus defs plus live-at-catch". Clearly these two rules are quite
+        different. The way this sort of worked before is that we would define the defs of resume
+        as being equal to our prediction of what the live-outs would be. We did this in the hope
+        that we would subtract all live-outs. But, this misses the live-at-catch part. So, this
+        change adds another hack to neutralize live-at-catch.
+        
+        This would make a lot more sense if we wrote a new liveness analysis that was just for
+        generator conversion. It could reuse BytecodeUseDef but otherwise it would be a new thing.
+        It would be easy to write crazy rules for save/resume in such an analysis, especially if
+        that analysis rewrote the bytecode. We could then just have an op_yield that is a no-op.
+        We would just record the live-outs of op_yield and use that for rewriting the code in terms
+        of a switch statement.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::stepOverInstruction):
+        (JSC::BytecodeLivenessAnalysis::dumpResults):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+
+2016-06-30  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r202659.
+        https://bugs.webkit.org/show_bug.cgi?id=159305
+
+        The test for this change times out on mac-wk2 debug and caused
+        an existing test to crash. (Requested by ryanhaddad on
+        #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: Wrong function name next to scope"
+        https://bugs.webkit.org/show_bug.cgi?id=158210
+        http://trac.webkit.org/changeset/202659
+
+2016-06-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Date.setYear() misses timeClip()
+        https://bugs.webkit.org/show_bug.cgi?id=159289
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncSetYear):
+
+2016-06-30  Joseph Pecoraro  <pecoraro@apple.com> and Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Implement isFinite / isNaN in JS and make DFG ToNumber accept non number values
+        https://bugs.webkit.org/show_bug.cgi?id=154022
+
+        Reviewed by Filip Pizlo.
+
+        We aim at optimizing @toInteger operation.
+        While it still has an unoptimized part[1], this patch should be a first step.
+
+        We introduce the @toNumber builtin intrinsic operation.
+        This converts the given value to the JS number by emitting op_to_number bytecode.
+        Previously @toInteger called C++ @Number constructor for that purpose.
+
+        And in DFG, op_to_number is converted to DFG ToNumber node.
+        During DFG, we attempt to convert this to edge filtering and Identity, but if we fail,
+        we just fall back to calling the C++ function.
+
+        To utilize ToNumber in user-land side, we add a path attempting to convert Number constructor calls
+        to ToNumber DFG nodes. This conversion is useful because `Number(value)` is used to convert a value to a number in JS.
+
+        Before this patch, we emit simple edge filtering (NumberUse) instead of emitting DFG node like ToNumber for op_to_number.
+        But emitting ToNumber is useful, because in the case of `Number(value)`, considering `value` may not be a number is reasonable.
+
+        By leveraging @toNumber operation, we rewrite Number.{isFinite, isNaN}, global.{isFinite, isNaN} and @toInteger.
+
+        ToNumber DFG node has a value profiling. This profiling is leveraged to determine the result number type of the ToNumber operation.
+        This value profiling is provided from either NumberConstructor's call operation or op_to_number.
+
+        The results (with the added performance tests) show that, while existing cases are performance neutral, the newly added cases gain the performance benefit.
+        And ASMBench/n-body.c also shows stable ~2% progression.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=153738
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinNames.h:
+        * builtins/GlobalObject.js:
+        (globalPrivate.isFinite):
+        (globalPrivate.isNaN):
+        (globalPrivate.toInteger): Deleted.
+        (globalPrivate.toLength): Deleted.
+        (globalPrivate.isDictionary): Deleted.
+        (globalPrivate.speciesGetter): Deleted.
+        (globalPrivate.speciesConstructor): Deleted.
+        * builtins/GlobalOperations.js: Copied from Source/JavaScriptCore/builtins/GlobalObject.js.
+        (globalPrivate.toInteger):
+        (globalPrivate.toLength):
+        (globalPrivate.isDictionary):
+        (globalPrivate.speciesGetter):
+        (globalPrivate.speciesConstructor):
+        * builtins/NumberConstructor.js: Added.
+        (isFinite):
+        (isNaN):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finishCreation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        (JSC::BytecodeGenerator::emitUnaryOpProfiled):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitToNumber):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_toNumber):
+        (JSC::UnaryPlusNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        We use `getPrediction()` to retrieve the heap prediction from the to_number bytecode.
+        According to the benchmark results, choosing `getPredictionWithoutOSRExit()` causes performance regression (1.5%) in kraken stanford-crypto-aes.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToNumber):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        Always on the heap prediction.
+
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        As of 64bit version, we carefully manage the register reuse. The largest difference between 32bit and 64bit is
+        `branchIfNotNumber()` requires the temporary register. We should not use the result registers for that since
+        it may be reuse the argument registers and it can break the argument registers before using them to call the operation.
+        Currently, we allocate the additional temporary register for that scratch register.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        Reuse the argument register for the result if possible. And manually decrement the use count in the middle of the node.
+        This is similar technique used in ToPrimitive. Typically, the child of ToNumber is only used by this ToNumber node since
+        we would like to perform the type conversion onto this child node here. So this careful register reuse effectively removes
+        the spills to call the operation. The example of the actually emitted code is the following.
+
+        76:<!2:loc11>     ToNumber(Untyped:@68, JS|MustGen|UseAsOther, DoubleimpurenanTopEmpty, R:World, W:Heap, Exits, ClobbersExit, bc#48)  predicting DoubleimpurenanTopEmpty
+            0x7f986d5fe693: test %rax, %r14
+            0x7f986d5fe696: jz 0x7f986d5fe6a1
+            0x7f986d5fe69c: jmp 0x7f986d5fe6d1
+            0x7f986d5fe6a1: mov %rax, %rsi
+            0x7f986d5fe6a4: mov %rbp, %rdi
+            0x7f986d5fe6a7: mov $0x2, 0x24(%rbp)
+            0x7f986d5fe6ae: mov $0x7f98711ea5f0, %r11
+            0x7f986d5fe6b8: call *%r11
+            0x7f986d5fe6bb: mov $0x7f982d3f72d0, %r11
+            0x7f986d5fe6c5: mov (%r11), %r11
+            0x7f986d5fe6c8: test %r11, %r11
+            0x7f986d5fe6cb: jnz 0x7f986d5fe88c
+
+        It effectively removes the unnecessary spill to call the operation!
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToNumber):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfNumber):
+        (JSC::AssemblyHelpers::branchIfNotNumber):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_number):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_to_number):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/Nodes.h:
+        (JSC::UnaryOpNode::opcodeID):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncIsNaN): Deleted.
+        (JSC::globalFuncIsFinite): Deleted.
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/MathCommon.h:
+        (JSC::maxSafeInteger):
+        (JSC::minSafeInteger):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+        (JSC::numberConstructorFuncIsFinite): Deleted.
+        (JSC::numberConstructorFuncIsNaN): Deleted.
+        * runtime/NumberConstructor.h:
+        * tests/stress/Number-isNaN-basics.js: Added.
+        (numberIsNaNOnInteger):
+        (testNumberIsNaNOnIntegers):
+        (verifyNumberIsNaNOnIntegerWithOtherTypes):
+        (numberIsNaNOnDouble):
+        (testNumberIsNaNOnDoubles):
+        (verifyNumberIsNaNOnDoublesWithOtherTypes):
+        (numberIsNaNNoArguments):
+        (numberIsNaNTooManyArguments):
+        (testNumberIsNaNOnConstants):
+        (numberIsNaNStructTransition):
+        (Number.isNaN):
+        * tests/stress/global-is-finite.js: Added.
+        (shouldBe):
+        * tests/stress/global-is-nan.js: Added.
+        (shouldBe):
+        * tests/stress/global-isNaN-basics.js: Added.
+        (isNaNOnInteger):
+        (testIsNaNOnIntegers):
+        (verifyIsNaNOnIntegerWithOtherTypes):
+        (isNaNOnDouble):
+        (testIsNaNOnDoubles):
+        (verifyIsNaNOnDoublesWithOtherTypes):
+        (verifyIsNaNOnCoercedTypes):
+        (isNaNNoArguments):
+        (isNaNTooManyArguments):
+        (testIsNaNOnConstants):
+        (isNaNTypeCoercionSideEffects):
+        (i.value.isNaNTypeCoercionSideEffects.valueOf):
+        (isNaNStructTransition):
+        (isNaN):
+        * tests/stress/number-is-finite.js: Added.
+        (shouldBe):
+        (test2):
+        (test3):
+        * tests/stress/number-is-nan.js: Added.
+        (shouldBe):
+        (test2):
+        (test3):
+        * tests/stress/to-number-basics.js: Added.
+        (shouldBe):
+        * tests/stress/to-number-convert-identity-without-execution.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        (valueOf):
+        * tests/stress/to-number-int52.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-intrinsic-convert-to-identity-without-execution.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        (valueOf):
+        * tests/stress/to-number-intrinsic-int52.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-intrinsic-object-without-execution.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-intrinsic-value-profiling.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-object-without-execution.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-object.js: Added.
+        (shouldBe):
+        (test12):
+        (object1.valueOf):
+        (test2):
+        (test22):
+        (object2.valueOf):
+        (test3):
+        (test32):
+        (object3.valueOf):
+        * tests/stress/to-number-value-profiling.js: Added.
+        (shouldBe):
+        (object.valueOf):
+
+2016-06-29  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix the debug build after r202667
+
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        The putDirect was missing the Accessor flag for the GetterSetter.
+
+2016-06-29  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(200114): Netflix app does not see ChromeCast
+        https://bugs.webkit.org/show_bug.cgi?id=159287
+
+        Reviewed by Benjamin Poulain.
+
+        Change set 200114 changed the behavior of how we check for whether or not we
+        wrap Objective C init methods in JavaScript constructors.  The prior method
+        checked the version of JavaScriptCore that was linked with the application.
+        If the application was not directly linked with JavaScriptCore the prior
+        method indicated that we shouldn't create constructors.  The new method uses
+        the SDK the application was compiled with.  Using the new method, an
+        application compiled with iOS SDK 8.0 or greater would create constructors
+        and not export init methods to JavaScript.  The problem is that an existing
+        application that hasn't been recompiled will get a different answer using
+        the new method.  We need to come up with a method that works in a compatible
+        way with existing programs, but provides a newly compiled program with the
+        "is built with SDK N or greater" check.
+        
+        Added back the prior check of the version of JavaScriptCore the program was
+        directly linked against.  However we only use this check if we directly linked
+        with JavaScriptCore.  Otherwise we fall through to check against the SDK the
+        program was built with.  Changed the iOS SDK version we check
+        against to be the new version of iOS, iOS 10.
+
+        This provides compatible behavior for existing programs.  It may be the case
+        that some of those programs may require changes when they are rebuilt with the
+        iOS 10 SDK or later.
+
+        * API/JSWrapperMap.mm:
+        (supportsInitMethodConstructors):
+
+2016-06-29  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Minor TypedArray fixes
+        https://bugs.webkit.org/show_bug.cgi?id=159286
+
+        Reviewed by Keith Miller.
+
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
+        See https://tc39.github.io/ecma262/#sec-%typedarray%
+
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncLength):
+        See https://tc39.github.io/ecma262/#sec-get-%typedarray%.prototype.length
+
+        (JSC::typedArrayViewProtoGetterFuncToStringTag):
+        Yep, that's odd.
+        See https://tc39.github.io/ecma262/#sec-get-%typedarray%.prototype-@@tostringtag
+
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        See the last paragraph of https://tc39.github.io/ecma262/#sec-ecmascript-standard-built-in-objects
+
+2016-06-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: API View of Native DOM APIs looks poor (TypeErrors for native getters)
+        https://bugs.webkit.org/show_bug.cgi?id=158334
+        <rdar://problem/26615366>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._getProperties):
+        (InjectedScript.prototype._propertyDescriptors):
+        Do not create fake value property descriptors for native accessors
+        unless requested. This means, getProperties for a native prototype
+        should return  accessors for native accessors just like it does
+        for normal non-native accessors (getters/setters).
+
+        (InjectedScript.prototype.getProperties):
+        Do not produce fake value accessors for native accessors.
+
+        (InjectedScript.prototype.getDisplayableProperties):
+        (InjectedScript.RemoteObject.prototype._generatePreview):
+        Do produce fake value accessors for native accessors.
+
+2016-06-29  Saam barati  <sbarati@apple.com>
+
+        JSGlobalLexicalEnvironment needs a toThis implementation
+        https://bugs.webkit.org/show_bug.cgi?id=159285
+
+        Reviewed by Mark Lam.
+
+        This was a huge oversight of my original implementation. It gave users
+        of the language direct access to the JSGlobalLexicalEnvironment object.
+
+        * runtime/JSGlobalLexicalEnvironment.cpp:
+        (JSC::JSGlobalLexicalEnvironment::isConstVariable):
+        (JSC::JSGlobalLexicalEnvironment::toThis):
+        * runtime/JSGlobalLexicalEnvironment.h:
+        (JSC::JSGlobalLexicalEnvironment::isEmpty):
+        * tests/stress/global-lexical-environment-to-this.js: Added.
+        (assert):
+        (let.f):
+        (let.fStrict):
+
+2016-06-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Wrong function name next to scope
+        https://bugs.webkit.org/show_bug.cgi?id=158210
+        <rdar://problem/26543093>
+
+        Reviewed by Brian Burg.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add DebuggerLocation. A helper for describing a unique location.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::setConstantRegisters):
+        When compiled with debug info, add a SymbolTable rare data pointer
+        back to the CodeBlock. This will be used later to get JSScope debug
+        info if Web Inspector pauses.
+
+        * runtime/SymbolTable.h:
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::cloneScopePart):
+        (JSC::SymbolTable::prepareForTypeProfiling):
+        (JSC::SymbolTable::uniqueIDForVariable):
+        (JSC::SymbolTable::uniqueIDForOffset):
+        (JSC::SymbolTable::globalTypeSetForOffset):
+        (JSC::SymbolTable::globalTypeSetForVariable):
+        Rename rareData and include a CodeBlock pointer.
+
+        (JSC::SymbolTable::rareDataCodeBlock):
+        (JSC::SymbolTable::setRareDataCodeBlock):
+        Setter and getter for the rare data. It should only be set once.
+
+        (JSC::SymbolTable::visitChildren):
+        Visit the rare data code block if we have one.
+
+        * debugger/DebuggerLocation.cpp: Added.
+        (JSC::DebuggerLocation::DebuggerLocation):
+        * debugger/DebuggerLocation.h: Added.
+        (JSC::DebuggerLocation::DebuggerLocation):
+        Construction from a ScriptExecutable.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::symbolTable):
+        * runtime/JSScope.h:
+        * debugger/DebuggerScope.h:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::name):
+        (JSC::DebuggerScope::location):
+        Name and location for a scope. This uses:
+        JSScope -> SymbolTable -> CodeBlock -> Executable
+
+        * inspector/protocol/Debugger.json:
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        (InjectedScript.CallFrameProxy._createScopeJson):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::valueForScopeType):
+        (Inspector::valueForScopeLocation):
+        (Inspector::JSJavaScriptCallFrame::scopeDescriptions):
+        (Inspector::JSJavaScriptCallFrame::scopeType): Deleted.
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeType): Deleted.
+        Simplify this code to build the objects we will send across the protocol
+        to descript a Scope.
+
+2016-06-29  Saam barati  <sbarati@apple.com>
+
+        We don't emit TDZ checks for call_eval
+        https://bugs.webkit.org/show_bug.cgi?id=159277
+        <rdar://problem/27018801>
+
+        Reviewed by Benjamin Poulain.
+
+        This is a problem if you're trying to call a TDZ variable
+        that is named 'eval'.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        * tests/stress/variable-named-eval-under-tdz.js: Added.
+        (shouldThrowTDZ):
+        (test):
+        (test.foo):
+        (throw.new.Error):
+
+2016-06-29  Mark Lam  <mark.lam@apple.com>
+
+        Add support for collecting cumulative LLINT stats via a JSC_llintStatsFile option.
+        https://bugs.webkit.org/show_bug.cgi?id=159274
+
+        Reviewed by Keith Miller.
+
+        * jsc.cpp:
+        (main):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::initialize):
+        (JSC::LLInt::Data::finalizeStats):
+        (JSC::LLInt::compareStats):
+        (JSC::LLInt::Data::dumpStats):
+        (JSC::LLInt::Data::ensureStats):
+        (JSC::LLInt::Data::loadStats):
+        (JSC::LLInt::Data::resetStats):
+        (JSC::LLInt::Data::saveStats):
+        * llint/LLIntData.h:
+        (JSC::LLInt::Data::opcodeStats):
+        * runtime/Options.cpp:
+        (JSC::Options::isAvailable):
+        (JSC::recomputeDependentOptions):
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+
+2016-06-29  Saam barati  <sbarati@apple.com>
+
+        Destructuring variable declaration is missing a validation of the syntax of a sub production when there is a rhs
+        https://bugs.webkit.org/show_bug.cgi?id=159267
+
+        Reviewed by Mark Lam.
+
+        We were parsing something without checking if it had a syntax error.
+        This is wrong for many reasons, but it could actually cause a crash
+        in a debug build if you parsed particular programs.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+
+2016-06-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Show Shadow Root type in DOM Tree
+        https://bugs.webkit.org/show_bug.cgi?id=159236
+        <rdar://problem/27068521>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/DOM.json:
+        Include optional shadowRootType property for DOMNodes.
+
+2016-06-29  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r202627.
+        https://bugs.webkit.org/show_bug.cgi?id=159266
+
+        patch is broken on arm (Requested by keith_miller on #webkit).
+
+        Reverted changeset:
+
+        "LLInt should support other types of prototype GetById
+        caching."
+        https://bugs.webkit.org/show_bug.cgi?id=158083
+        http://trac.webkit.org/changeset/202627
+
+2016-06-29  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Fix small issues of TypedArray prototype
+        https://bugs.webkit.org/show_bug.cgi?id=159248
+
+        Reviewed by Saam Barati.
+
+        First, TypedArray's toString and Array's toString
+        should be the same function.
+        I moved the function to GlobalObject and each array type
+        gets it as needed.
+
+        Then TypedArray length was supposed to be configurable.
+        I removed the "DontDelete" flag accordingly.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrayProtoToStringFunction):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+
+2016-06-29  Caio Lima  <ticaiolima@gmail.com>
+
+        LLInt should support other types of prototype GetById caching.
+        https://bugs.webkit.org/show_bug.cgi?id=158083
+
+        Recently, we started supporting prototype load caching for get_by_id
+        in the LLInt. This patch is expading the caching strategy to enable
+        cache the prototype accessor and custom acessors.
+
+        Similarly to the get_by_id_proto_load bytecode, we are adding new
+        bytecodes called get_by_id_proto_accessor that uses the calculated
+        offset of a object to call a getter function and get_by_id_proto_custom
+        that stores the pointer to the custom function and call them directly
+        from LowLevelInterpreter.
+
+        Reviewed by Keith Miller
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finalizeLLIntInlineCaches):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setupGetByIdPrototypeCache):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2016-06-28  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r202580.
+        https://bugs.webkit.org/show_bug.cgi?id=159245
+
+        Caused all WKTR tests to fail on GuardMalloc and Production
+        only for unknown reasons, investigating offline. (Requested by
+        brrian on #webkit).
+
+        Reverted changeset:
+
+        "RunLoop::Timer should use constructor templates instead of
+        class templates"
+        https://bugs.webkit.org/show_bug.cgi?id=159153
+        http://trac.webkit.org/changeset/202580
+
+2016-06-28  Keith Miller  <keith_miller@apple.com>
+
+        We should not crash there is a finally inside a for-in loop
+        https://bugs.webkit.org/show_bug.cgi?id=159243
+        <rdar://problem/27018910>
+
+        Reviewed by Benjamin Poulain.
+
+        Previously we would swap the m_forInContext with an empty vector
+        then attempt to shrink the size of m_forInContext by the amount
+        we expected. This meant that if there was more than one ForInContext
+        on the stack and we wanted to pop exactly one off we would crash.
+        This patch makes ForInContexts RefCounted so they can be duplicated
+        into other vectors. It also has ForInContexts copy the entire stack
+        rather than do the swap that we did before. This makes ForInContexts
+        work the same as the other contexts.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexPopScopes):
+        (JSC::BytecodeGenerator::pushIndexedForInScope):
+        (JSC::BytecodeGenerator::pushStructureForInScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * tests/stress/finally-for-in.js: Added.
+        (repeat):
+        (createSimple):
+
+2016-06-28  Saam Barati  <sbarati@apple.com>
+
+        Assertion failure or crash when accessing let-variable in TDZ with eval with a function in it that returns let variable
+        https://bugs.webkit.org/show_bug.cgi?id=158796
+        <rdar://problem/26984659>
+
+        Reviewed by Michael Saboff.
+
+        There was a bug where some functions inside of an eval were
+        omitting a necessary TDZ check. This obviously leads to bad
+        things because a variable under TDZ is the null pointer.
+        The eval's bytecode was generated with the correct TDZ set, but 
+        it created all its functions before pushing that TDZ set onto
+        the stack. That's a mistake. Those functions need to be created with
+        that TDZ set. The solution is simple, the TDZ set that the eval
+        is created with needs to be pushed onto the TDZ stack before
+        the eval creates any functions.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * tests/stress/variable-under-tdz-eval-tricky.js: Added.
+        (assert):
+        (throw.new.Error):
+        (assert.try.underTDZ):
+
+2016-06-28  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r200946): Improper backtracking from last alternative in sticky patterns
+        https://bugs.webkit.org/show_bug.cgi?id=159233
+
+        Reviewed by Mark Lam.
+
+        Jump to fail exit code when the last alternative of a sticky pattern fails.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrack):
+
+2016-06-28  Saam Barati  <sbarati@apple.com>
+
+        some Watchpoints' ::fireInternal method will call operations that might GC where the GC will cause the watchpoint itself to destruct
+        https://bugs.webkit.org/show_bug.cgi?id=159198
+        <rdar://problem/26302360>
+
+        Reviewed by Filip Pizlo.
+
+        Firing a watchpoint may cause a GC to happen. This GC could destroy various
+        Watchpoints themselves while they're in the process of firing. It's not safe
+        for most Watchpoints to be destructed while they're in the middle of firing.
+        This GC could also destroy the WatchpointSet itself, and it's not in a safe
+        state to be destroyed. WatchpointSet::fireAllWatchpoints now defers gc for a
+        while. This prevents a GC from destructing any Watchpoints while they're
+        in the process of firing. This bug was being hit by the stress GC bots
+        because we would destruct a particular Watchpoint while it was firing,
+        and then we would access its field after it had already been destroyed.
+        This was causing all kinds of weird symptoms. Also, this was easier to
+        catch when running with guard malloc because the first access after
+        destruction would lead to a crash.
+
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp:
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::fire):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        * bytecode/VariableWriteFireDetail.cpp:
+        (JSC::VariableWriteFireDetail::dump):
+        (JSC::VariableWriteFireDetail::touch):
+        * bytecode/VariableWriteFireDetail.h:
+        * bytecode/Watchpoint.cpp:
+        (JSC::WatchpointSet::add):
+        (JSC::WatchpointSet::fireAllSlow):
+        (JSC::WatchpointSet::fireAllWatchpoints):
+        (JSC::InlineWatchpointSet::add):
+        (JSC::InlineWatchpointSet::fireAll):
+        (JSC::InlineWatchpointSet::inflateSlow):
+        * bytecode/Watchpoint.h:
+        (JSC::WatchpointSet::startWatching):
+        (JSC::WatchpointSet::fireAll):
+        (JSC::WatchpointSet::touch):
+        (JSC::WatchpointSet::invalidate):
+        (JSC::WatchpointSet::isBeingWatched):
+        (JSC::WatchpointSet::offsetOfState):
+        (JSC::WatchpointSet::addressOfSetIsNotEmpty):
+        (JSC::InlineWatchpointSet::startWatching):
+        (JSC::InlineWatchpointSet::fireAll):
+        (JSC::InlineWatchpointSet::invalidate):
+        (JSC::InlineWatchpointSet::touch):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * jsc.cpp:
+        (WTF::Masquerader::create):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+        (JSC::ArrayBufferNeuteringWatchpoint::fireAll):
+        * runtime/FunctionRareData.cpp:
+        (JSC::FunctionRareData::clear):
+        * runtime/InferredType.cpp:
+        (JSC::InferredType::willStoreValueSlow):
+        (JSC::InferredType::makeTopSlow):
+        (JSC::InferredType::set):
+        (JSC::InferredType::removeStructure):
+        (JSC::InferredType::InferredStructureWatchpoint::fireInternal):
+        * runtime/InferredValue.cpp:
+        (JSC::InferredValue::notifyWriteSlow):
+        (JSC::InferredValue::ValueCleanup::finalizeUnconditionally):
+        * runtime/InferredValue.h:
+        (JSC::InferredValue::notifyWrite):
+        (JSC::InferredValue::invalidate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::haveABadTime):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePutTouchWatchpointSet):
+        (JSC::symbolTablePutInvalidateWatchpointSet):
+        * runtime/Structure.cpp:
+        (JSC::Structure::didCachePropertyReplacement):
+        (JSC::Structure::startWatchingInternalProperties):
+        (JSC::DeferredStructureTransitionWatchpointFire::~DeferredStructureTransitionWatchpointFire):
+        (JSC::DeferredStructureTransitionWatchpointFire::add):
+        (JSC::Structure::didTransitionFromThisStructure):
+        (JSC::Structure::prototypeForLookup):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::didReplaceProperty):
+        (JSC::Structure::propertyReplacementWatchpointSet):
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTableEntry::isDontEnum):
+        (JSC::SymbolTableEntry::disableWatching):
+        * runtime/VM.cpp:
+        (JSC::VM::addImpureProperty):
+        (JSC::enableProfilerWithRespectToCount):
+
+2016-06-28  Filip Pizlo  <fpizlo@apple.com>
+
+        JSRopeString should use release asserts, not debug asserts, about substring bounds
+        https://bugs.webkit.org/show_bug.cgi?id=159227
+
+        Reviewed by Saam Barati.
+        
+        According to my experiments this change costs nothing.  That's not surprising since the
+        most common way to construct a rope these days is inlined into the JIT, which does its own
+        safety checks.  This makes us crash sooner rather than corrupting memory.
+
+        * runtime/JSString.h:
+
+2016-06-28  Brian Burg  <bburg@apple.com>
+
+        RunLoop::Timer should use constructor templates instead of class templates
+        https://bugs.webkit.org/show_bug.cgi?id=159153
+
+        Reviewed by Alex Christensen.
+
+        Remove the RunLoop::Timer class template argument, and pass its constructor
+        a reference to `this` instead of a pointer to `this`.
+
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::SendGarbageCollectionEventsTask::SendGarbageCollectionEventsTask):
+
+2016-06-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: selectElement.options shows unexpected entries in console (named indexes beyond collection length)
+        https://bugs.webkit.org/show_bug.cgi?id=159192
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype.arrayIndexPropertyNames):
+        Start with an empty array because we just push valid indexes.
+
+        (InjectedScript.prototype._propertyDescriptors):
+        Avoid the >100 length requirement, and always treat the
+        array-like objects the same. The frontend currently
+        doesn't show named indexes for arrays anyways, so they
+        would have been unused.
+
+2016-06-28  Per Arne Vollan  <pvollan@apple.com>
+
+        [Win] Skip failing INTL test.
+        https://bugs.webkit.org/show_bug.cgi?id=159141
+
+        Reviewed by Brent Fulgham.
+
+        INTL is not enabled on Windows.
+
+        * tests/stress/intl-constructors-with-proxy.js:
+        (shouldBe):
+
+2016-06-28  Joonghun Park  <jh718.park@samsung.com>
+
+        [JSC] Fix build break since r202502 - 2
+        https://bugs.webkit.org/show_bug.cgi?id=159194
+
+        Reviewed by Gyuyoung Kim.
+
+        Fix about the error message below.
+        error: control reaches end of non-void function [-Werror=return-type]
+
+        * b3/B3TypeMap.h: add #pragma GCC diagnostic ignored "-Wreturn-type".
+
+2016-06-28  Joonghun Park  <jh718.park@samsung.com>
+
+        [JSC] Fix build break since r202502
+        https://bugs.webkit.org/show_bug.cgi?id=159194
+
+        Reviewed by Alex Christensen.
+
+        Fix about the error message below.
+        error: control reaches end of non-void function [-Werror=return-type]
+
+        * b3/B3TypeMap.h:
+        (JSC::B3::TypeMap::at): add missing ASSERT_NOT_REACHED().
+
+2016-06-27  Keith Miller  <keith_miller@apple.com>
+
+        Fix bad assert in StructureRareData::setObjectToStringValue
+        https://bugs.webkit.org/show_bug.cgi?id=159171
+        <rdar://problem/26987355>
+
+        Reviewed by Mark Lam.
+
+        We should not have expected the generateConditionsForPrototypePropertyHit would succeed.
+        There are many reasons it might fail including that there is a proxy somewhere on the
+        prototype chain of the object.
+
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::setObjectToStringValue):
+        * tests/stress/object-toString-with-proxy.js: Added.
+        (get target):
+
+2016-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Crashing at an unreachable code trap in FTL should give more information
+        https://bugs.webkit.org/show_bug.cgi?id=159177
+
+        Reviewed by Saam Barati.
+        
+        This stuffs information into registers so that we have some chance of seeing what happened
+        by looking at the register dumps.
+
+        * assembler/AbortReason.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::ftlUnreachable):
+        (JSC::FTL::DFG::LowerDFGToB3::compileBlock):
+        (JSC::FTL::DFG::LowerDFGToB3::crash):
+
+2016-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Clean up resetting reachability in B3/Air
+        https://bugs.webkit.org/show_bug.cgi?id=159170
+
+        Reviewed by Geoffrey Garen.
+        
+        When I fixed bug 159165, I took the brute force approach. I still used the
+        B3::resetReachability() method, and changed the callback to record the set of deleted values
+        instead of deleting them eagerly. But this means tracking the set of deleted values, even
+        though resetReachability() already internally tracks the set of deleted blocks. You can find
+        out if a value is deleted by asking if its owning block was deleted.
+        
+        So, this change refactors B3::resetReachability() into a new helper called
+        B3::recomputePredecessors(). This new helper skips the block deletion step, and lets the
+        client delete blocks. This lets Air delete blocks the same way that it did before, and it
+        lets B3 use the isBlockDead() method (which is a glorified proxy for
+        block->predecessors().isEmpty()) to track which values are deleted. This allows B3 to turn
+        Upsilons that point to dead Phis into Nops before deleting the blocks.
+        
+        This shouldn't affect performance or anything real. It just makes the code cleaner.
+
+        * b3/B3BasicBlockUtils.h:
+        (JSC::B3::updatePredecessorsAfter):
+        (JSC::B3::recomputePredecessors):
+        (JSC::B3::isBlockDead):
+        (JSC::B3::resetReachability): Deleted.
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::resetReachability):
+        (JSC::B3::Procedure::invalidateCFG):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::resetReachability):
+        (JSC::B3::Air::Code::dump):
+
+2016-06-27  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: CRASH in backend at Inspector::HeapFrontendDispatcher::garbageCollected + 552 when closing frontend/inspected page
+        https://bugs.webkit.org/show_bug.cgi?id=159075
+        <rdar://problem/26094341>
+
+        Reviewed by Filip Pizlo.
+
+        This change caused JSC stress tests to all hit an assertion in RunLoop.
+        We should use RunLoop::current() to create the RunLoop::Timer since JSC-only
+        clients like testapi and jsc don't ever call initializeMainRunLoop().
+
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::SendGarbageCollectionEventsTask::SendGarbageCollectionEventsTask):
+
+2016-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::Procedure::resetReachability() can create dangling references from Upsilons to Phis
+        https://bugs.webkit.org/show_bug.cgi?id=159165
+
+        Reviewed by Mark Lam.
+        
+        You can delete an unreachable block that has a Phi but some prior block may still have an
+        Upsilon pointing to that Phi. This can happen if the Upsilon precedes a Check that always
+        exits or it can happen if we remove some successor of a block and this block had an Upsilon
+        for one of the removed successors. These things are valid IR even if they are not canonical.
+        Our policy for not-canonical-but-valid IR is that the compiler should still emit valid code
+        in the end.
+        
+        The solution is to have Procedure::resetReachability() turn those Upsilons into Nops.
+
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::resetReachability): Fix the bug.
+        * b3/B3Validate.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testResetReachabilityDanglingReference): Add a test. This always crashes prior to this change.
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::killUnreachableBlocks): Add a FIXME about a possible similar bug.
+
+2016-06-27  Keith Miller  <keith_miller@apple.com>
+
+        Add comment to Module feature in features.json
+        https://bugs.webkit.org/show_bug.cgi?id=159159
+
+        Reviewed by Saam Barati.
+
+        * features.json:
+
+2016-06-27  Keith Miller  <keith_miller@apple.com>
+
+        Update features.json for ES6 completed features.
+        https://bugs.webkit.org/show_bug.cgi?id=159152
+
+        Reviewed by Mark Lam.
+
+        * features.json:
+
+2016-06-25  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should not use Nops when deleting unreachable code
+        https://bugs.webkit.org/show_bug.cgi?id=159120
+        rdar://problem/26500743
+
+        Reviewed by Michael Saboff.
+        
+        Prior to this change, transformations that obviated the need for some value could choose
+        from these ways to kill it:
+        
+        - replaceWithIdentity() if we're replacing with another value.
+        - replaceWithNop() if the type is Void or if we know that we'll fix any users of this
+          value.
+        - deleteValue() if the code is unreachable.
+        
+        The bug here is that reduceStrength() was being clever about how to get rid of a value.
+        reduceStrength() may find a Check that must always exit. The goal is to remove any code
+        dominated by the Check. But it would be awkward to eagerly delete all of the blocks
+        dominated by this one. So this code took a much simpler approach: it would
+        replaceWithNop() for all of the values in this block after the Check and it would replace
+        the terminal with Oops.
+        
+        But this corrupts the IR in a subtle way: some of those values may have been non-Void but
+        now they are Nops so they are Void. reduceStrength() will not yet realize that the blocks
+        dominated by the one with the Check are unreachable, so it will run all sorts of
+        optimizations on those blocks. This could have probably manifested as many different kinds
+        of badness, but the way I found out about this issue was through a crash in
+        IntRange::top(Type) when inlined into ReduceStrength::rangeFor(). We'd die in a switch
+        statement over a child's type.
+        
+        We could fix this by making rangeFor() tolerate Void. But I think that this would be
+        dangerous. There could easily be other places in reduceStrength() that assume that value's
+        children are non-Void. So, this change fixes the Check optimization and adds mechanisms to
+        prevent other optimizations from breaking the children-are-not-Void rule.
+        
+        This introduces two high-level changes:
+        
+        - It's no longer legal to replaceWithNop() if the value is not Void. This change alone
+          would cause reduceStrength() to instacrash in its Check optimization. Almost all other
+          uses of replaceWithNop() were already following this rule, so they were fine. One other
+          place was using replaceWithNop() on non-Void values after arranging for them to no
+          longer have any parents. That was changed to call replaceWithNopIgnoringType(), which
+          doesn't have any type assertions.
+        
+        - For reduceStrength() there is a new Value::replaceWithBottom() method that works with
+          Void or non-Void and behaves like you would want replaceWithNop() to behave: if you know
+          that the code is unreachable then it produces something that is guaranteed to be deleted
+          by later optimizations, and if it's not unreachable, then it's guaranteed to be compiled
+          to something harmless and cheap. This means replacing the value with an identity that
+          points to a bottom constant (the 0 for whatever type we have), or just replacing it with
+          Nop if it's Void.
+        
+        This also adds a test case for the reason why we do this: we may have two blocks, where
+        the first block unconditionally exits while dominating the second block. The second block
+        references values in the part of the first block that is unreachable. In trunk, this test
+        would assert in ReduceStrength::rangeFor() because the CheckAdd in the second block would
+        reference a Nop in the first block.
+        
+        This fixes a high volume crash in ReduceStrength::rangeFor(). This crash was very
+        confusing. Even though we were crashing at a RELEASE_ASSERT_NOT_REACHED() in a switch
+        statement in IntRange::top(Type), clang was merging that trap with the trap it used for
+        Vector OOB. The top of the stack in crash dumps looked like:
+        
+            JSC::B3::(anonymous namespace)::ReduceStrength::rangeFor(JSC::B3::Value*, unsigned int) + 4477 (Vector.h:655)
+        
+        Where Vector.h:655 is:
+        
+            OverflowHandler::overflowed();
+
+        But this crash was not at Vector.h:655. It was at B3ReduceStrength.cpp:121. The two lines
+        are both traps, so they got merged despite differences in debug info. This bug would have
+        been so much easier to fix if I had the right line number.
+
+        * b3/B3BottomProvider.h: Added. This is a utility for creating bottom values.
+        (JSC::B3::BottomProvider::BottomProvider):
+        (JSC::B3::BottomProvider::operator()):
+        * b3/B3InsertionSet.cpp: Optimized adding bottom values a bit. We will no longer create pointless duplicates.
+        (JSC::B3::InsertionSet::insertBottom):
+        (JSC::B3::InsertionSet::execute):
+        (JSC::B3::InsertionSet::bottomForType):
+        * b3/B3InsertionSet.h:
+        * b3/B3MoveConstants.cpp: Use replaceWithNopIgnoringType() because we *know* that we can replaceWithNop even for non-Void.
+        * b3/B3Procedure.h:
+        * b3/B3ReduceStrength.cpp: Use replaceWithBottom().
+        * b3/B3ReduceStrength.h:
+        * b3/B3TypeMap.h: I figured if I wrote type-casing code like this once then I'd never want to write it again.
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::replaceWithIdentity):
+        (JSC::B3::Value::replaceWithNop):
+        (JSC::B3::Value::replaceWithNopIgnoringType):
+        * b3/B3Value.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::replaceWithBottom): This is the new method of killing unreachable code.
+        (JSC::B3::Value::as):
+        * b3/testb3.cpp: Add new tests!
+        (JSC::B3::testLateRegister):
+        (JSC::B3::testReduceStrengthCheckBottomUseInAnotherBlock):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+
+2016-06-27  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION: Web Inspector: Text search broken in resources with <CR>
+        https://bugs.webkit.org/show_bug.cgi?id=159110
+        <rdar://problem/27008485>
+
+        Reviewed by Brian Burg.
+
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::lineEndings):
+        The frontend moved to only treated newlines as line endings in
+        the TextEditor. The backend however was looking for many
+        different types of line endings (\r\n, \r, \n). This caused
+        the line endings to ultimately differ between the frontend
+        and the backend, so the frontend couldn't find the lines that
+        the backend was claiming search results were on. Change the
+        backend to only look for \n line endings.
+
+2016-06-27  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: CRASH in backend at Inspector::HeapFrontendDispatcher::garbageCollected + 552 when closing frontend/inspected page
+        https://bugs.webkit.org/show_bug.cgi?id=159075
+        <rdar://problem/26094341>
+
+        Reviewed by Timothy Hatcher.
+
+        Move the asynchronous work to a task class that can be cancelled when the
+        heap agent is reset, disabled or destroyed.
+
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::SendGarbageCollectionEventsTask::SendGarbageCollectionEventsTask):
+        (Inspector::SendGarbageCollectionEventsTask::addGarbageCollection):
+        (Inspector::SendGarbageCollectionEventsTask::reset):
+        (Inspector::SendGarbageCollectionEventsTask::timerFired):
+        Added. This holds onto GarbageCollectionData that needs to be sent asynchronously.
+        It uses the RunLoop variant of Timer and can queue multiple collections to be sent.
+        The data vector is guarded with a lock so that garbageCollected() can safely add
+        collection data from a non-main thread while the main thread sends out events.
+
+        (Inspector::InspectorHeapAgent::InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::~InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::disable):
+        Reset the task when disabling or tearing down the agent so the timer doesn't fire after destruction.
+
+        (Inspector::InspectorHeapAgent::didGarbageCollect):
+        Add the collection data to the task, which will dispatch an event for it asynchronously.
+
+        * inspector/agents/InspectorHeapAgent.h:
+
+2016-06-27  Michael Saboff  <msaboff@apple.com>
+
+        ES6 Change: Unify handling of RegExp CharacterClassEscapes \w and \W and Word Asserts \b and \B
+        https://bugs.webkit.org/show_bug.cgi?id=158505
+
+        Reviewed by Geoffrey Garen.
+
+        This change makes it so that the CharacterClassEscape \w matches the inverse of
+        \W and vice versa for unicode, ignore case RegExp's.
+
+        Before this change, both /\w/ui and /\W/ui RegExp's would match the characters
+        k, K, s, S, \u017f (Latin Small Letter Long S) and \u212a (Kelvin Sign).
+        This was due to how the ES6 standard defined matching of character classes
+        specifically that the abstract operation "Canonicalize()" is called for the
+        character to be matched AND for the characters in the character class we are
+        matching against.  This change is to make \W always be the inverse of \w.
+        It is still the case that the characters that match against \w changes
+        depending on a regular expression's flags.
+
+        The only real changes occur for regular expressions with both the unicode and
+        ignore case flags set.  Updated the character class generator to make 
+        nonwordUnicodeIgnoreCaseChar not include k, K, s, S, \u017f and \u212a.
+        Changed BytecodePattern.wordcharCharacterClass to use the correct
+        word character class for the flags.  Simplfied character class set up in
+        in the pattern to use m_pattern.wordUnicodeIgnoreCaseCharCharacterClass and
+        invert as appropriate when unicode and ignore case are both set.
+
+        * create_regex_tables:
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomBuiltInCharacterClass):
+
+2016-06-25  Keith Miller  <keith_miller@apple.com>
+
+        DFGByteCodeParsing does not handle calling the Object constructor with no arguments correctly
+        https://bugs.webkit.org/show_bug.cgi?id=159117
+        <rdar://problem/26996781>
+
+        Reviewed by Saam Barati.
+
+        DFGByteCodeParsing always assumed there would be an argument to the Object constructor.
+        This is clearly not always the case and we should be able to handle it.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * tests/stress/indirect-call-object-constructor-with-no-arguments.js: Added.
+        (let.foo.Object.test):
+
+2016-06-24  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should die sooner if a Value has the wrong number of children
+        https://bugs.webkit.org/show_bug.cgi?id=159108
+
+        Reviewed by Mark Lam.
+        
+        I've been looking at a bug (rdar://problem/26500743) that's about a Vector OOB crash in
+        ReduceStrength::rangeFor(). The only Vector accesses are to Value::m_children, and all of
+        the accesses in rangeFor() are for child(0) or child(1) of binary arithmetic opcodes.
+        Clearly those should never go out-of-bounds.
+        
+        Maybe we have horrible memory corruption. Or maybe some path creates a Value with the
+        wrong number of children, and that path is not tested by any of our tests. This patch adds
+        release assertions that will catch the latter.
+        
+        I've tested this a lot. It's not a regression on our benchmarks.
+
+        * b3/B3Opcode.h:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::dumpMeta):
+        (JSC::B3::Value::typeFor):
+        (JSC::B3::Value::badOpcode):
+        (JSC::B3::Value::checkOpcode): Deleted.
+        * b3/B3Value.h:
+
+2016-06-24  Mark Lam  <mark.lam@apple.com>
+
+        [JSC] Error prototypes are called on remote scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=52192
+
+        Reviewed by Keith Miller.
+
+        Added a sanitizedToString() to the Error instance object so that it can be used
+        to get an error string without invoking getters and proxies.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finishCreation):
+        (JSC::ErrorInstance::sanitizedToString):
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::createStructure):
+        (JSC::ErrorInstance::runtimeTypeForCause):
+        (JSC::ErrorInstance::clearRuntimeTypeForCause):
+
+2016-06-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r202443.
+        https://bugs.webkit.org/show_bug.cgi?id=159105
+
+        Introduced memory corruption crashes (Requested by ap on
+        #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: CRASH in backend at
+        Inspector::HeapFrontendDispatcher::garbageCollected + 552 when
+        closing frontend/inspected page"
+        https://bugs.webkit.org/show_bug.cgi?id=159075
+        http://trac.webkit.org/changeset/202443
+
+2016-06-24  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: CRASH in backend at Inspector::HeapFrontendDispatcher::garbageCollected + 552 when closing frontend/inspected page
+        https://bugs.webkit.org/show_bug.cgi?id=159075
+        <rdar://problem/26094341>
+
+        Reviewed by Joseph Pecoraro.
+
+        Move the asynchronous work to a task class that can be cancelled when the
+        heap agent is reset, disabled or destroyed.
+
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::SendGarbageCollectionEventsTask::SendGarbageCollectionEventsTask):
+        (Inspector::SendGarbageCollectionEventsTask::addGarbageCollection):
+        (Inspector::SendGarbageCollectionEventsTask::reset):
+        (Inspector::SendGarbageCollectionEventsTask::timerFired):
+        Added. This holds onto GarbageCollection objects that need to be sent asynchronously.
+        It uses the RunLoop variant of Timer and can queue multiple pending objects to be sent.
+
+        (Inspector::InspectorHeapAgent::InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::~InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::disable):
+        Reset the task when disabling or tearing down the agent so the timer doesn't fire after destruction.
+
+        (Inspector::InspectorHeapAgent::didGarbageCollect):
+        Send the object to the task to be dispatched asynchronously.
+
+        * inspector/agents/InspectorHeapAgent.h:
+
+2016-06-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r202413.
+        https://bugs.webkit.org/show_bug.cgi?id=159097
+
+        Broke many JSC tests (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "[JSC] Implement isFinite / isNaN in JS and make DFG ToNumber
+        accept non number values"
+        https://bugs.webkit.org/show_bug.cgi?id=154022
+        http://trac.webkit.org/changeset/202413
+
+2016-06-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        OOM Assertion failure in Array.prototype.toString
+        https://bugs.webkit.org/show_bug.cgi?id=158793
+
+        Reviewed by Saam Barati.
+
+        JSString::create() taking a StringImpl was using a signed integer
+        for the length of the string.
+        The problem is StringImpl uses an unsigned integer. When a large string
+        was passed to JSString, the signed integer would be negative and crash
+        JSString.
+
+        * runtime/JSString.h:
+        (JSC::JSString::create):
+
+2016-06-23  Joseph Pecoraro  <pecoraro@apple.com> and Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Implement isFinite / isNaN in JS and make DFG ToNumber accept non number values
+        https://bugs.webkit.org/show_bug.cgi?id=154022
+
+        Reviewed by Filip Pizlo.
+
+        We aim at optimizing @toInteger operation.
+        While it still has an unoptimized part[1], this patch should be a first step.
+
+        We introduce the @toNumber builtin intrinsic operation.
+        This converts the given value to the JS number by emitting op_to_number bytecode.
+        Previously @toInteger called C++ @Number constructor for that purpose.
+
+        And in DFG, op_to_number is converted to DFG ToNumber node.
+        During DFG, we attempt to convert this to edge filtering and Identity, but if we fail,
+        we just fall back to calling the C++ function.
+
+        To utilize ToNumber in user-land side, we add a path attempting to convert Number constructor calls
+        to ToNumber DFG nodes. This conversion is useful because `Number(value)` is used to convert a value to a number in JS.
+
+        Before this patch, we emit simple edge filtering (NumberUse) instead of emitting DFG node like ToNumber for op_to_number.
+        But emitting ToNumber is useful, because in the case of `Number(value)`, considering `value` may not be a number is reasonable.
+
+        By leveraging @toNumber operation, we rewrite Number.{isFinite, isNaN}, global.{isFinite, isNaN} and @toInteger.
+
+        ToNumber DFG node has a value profiling. This profiling is leveraged to determine the result number type of the ToNumber operation.
+        This value profiling is provided from either NumberConstructor's call operation or op_to_number.
+
+        The results (with the added performance tests) show that, while existing cases are performance neutral, the newly added cases gain the performance benefit.
+        And ASMBench/n-body.c also shows stable ~2% progression.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=153738
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinNames.h:
+        * builtins/GlobalObject.js:
+        (globalPrivate.isFinite):
+        (globalPrivate.isNaN):
+        (globalPrivate.toInteger): Deleted.
+        (globalPrivate.toLength): Deleted.
+        (globalPrivate.isDictionary): Deleted.
+        (globalPrivate.speciesGetter): Deleted.
+        (globalPrivate.speciesConstructor): Deleted.
+        * builtins/GlobalOperations.js: Copied from Source/JavaScriptCore/builtins/GlobalObject.js.
+        (globalPrivate.toInteger):
+        (globalPrivate.toLength):
+        (globalPrivate.isDictionary):
+        (globalPrivate.speciesGetter):
+        (globalPrivate.speciesConstructor):
+        * builtins/NumberConstructor.js: Added.
+        (isFinite):
+        (isNaN):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finishCreation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        (JSC::BytecodeGenerator::emitUnaryOpProfiled):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitToNumber):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_toNumber):
+        (JSC::UnaryPlusNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        We use `getPrediction()` to retrieve the heap prediction from the to_number bytecode.
+        According to the benchmark results, choosing `getPredictionWithoutOSRExit()` causes performance regression (1.5%) in kraken stanford-crypto-aes.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToNumber):
+        ToNumber tells its predicted type by its heap prediction. So the fixup phase need to consider about it.
+        If the heap prediction is Int32, we should attempt to convert the child value to Int32.
+        Without this, misc-bugs-847389-jpeg2000 in assorted tests poses 53% regression.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        Alway rely on the heap prediction.
+
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        As of 64bit version, we carefully manage the register reuse. The largest difference between 32bit and 64bit is
+        `branchIfNotNumber()` requires the temporary register. We should not use the result registers for that since
+        it may be reuse the argument registers and it can break the argument registers before using them to call the operation.
+        Currently, we allocate the additional temporary register for that scratch register.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        Reuse the argument register for the result if possible. And manually decrement the use count in the middle of the node.
+        This is similar technique used in ToPrimitive. Typically, the child of ToNumber is only used by this ToNumber node since
+        we would like to perform the type conversion onto this child node here. So this careful register reuse effectively removes
+        the spills to call the operation. The example of the actually emitted code is the following.
+
+        76:<!2:loc11>     ToNumber(Untyped:@68, JS|MustGen|UseAsOther, DoubleimpurenanTopEmpty, R:World, W:Heap, Exits, ClobbersExit, bc#48)  predicting DoubleimpurenanTopEmpty
+            0x7f986d5fe693: test %rax, %r14
+            0x7f986d5fe696: jz 0x7f986d5fe6a1
+            0x7f986d5fe69c: jmp 0x7f986d5fe6d1
+            0x7f986d5fe6a1: mov %rax, %rsi
+            0x7f986d5fe6a4: mov %rbp, %rdi
+            0x7f986d5fe6a7: mov $0x2, 0x24(%rbp)
+            0x7f986d5fe6ae: mov $0x7f98711ea5f0, %r11
+            0x7f986d5fe6b8: call *%r11
+            0x7f986d5fe6bb: mov $0x7f982d3f72d0, %r11
+            0x7f986d5fe6c5: mov (%r11), %r11
+            0x7f986d5fe6c8: test %r11, %r11
+            0x7f986d5fe6cb: jnz 0x7f986d5fe88c
+
+        It effectively removes the unnecessary spill to call the operation!
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToNumber):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfNumber):
+        (JSC::AssemblyHelpers::branchIfNotNumber):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_number):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_to_number):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/Nodes.h:
+        (JSC::UnaryOpNode::opcodeID):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncIsNaN): Deleted.
+        (JSC::globalFuncIsFinite): Deleted.
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/MathCommon.h:
+        (JSC::maxSafeInteger):
+        (JSC::minSafeInteger):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+        (JSC::numberConstructorFuncIsFinite): Deleted.
+        (JSC::numberConstructorFuncIsNaN): Deleted.
+        * runtime/NumberConstructor.h:
+        * tests/stress/Number-isNaN-basics.js: Added.
+        (numberIsNaNOnInteger):
+        (testNumberIsNaNOnIntegers):
+        (verifyNumberIsNaNOnIntegerWithOtherTypes):
+        (numberIsNaNOnDouble):
+        (testNumberIsNaNOnDoubles):
+        (verifyNumberIsNaNOnDoublesWithOtherTypes):
+        (numberIsNaNNoArguments):
+        (numberIsNaNTooManyArguments):
+        (testNumberIsNaNOnConstants):
+        (numberIsNaNStructTransition):
+        (Number.isNaN):
+        * tests/stress/global-is-finite.js: Added.
+        (shouldBe):
+        * tests/stress/global-is-nan.js: Added.
+        (shouldBe):
+        * tests/stress/global-isNaN-basics.js: Added.
+        (isNaNOnInteger):
+        (testIsNaNOnIntegers):
+        (verifyIsNaNOnIntegerWithOtherTypes):
+        (isNaNOnDouble):
+        (testIsNaNOnDoubles):
+        (verifyIsNaNOnDoublesWithOtherTypes):
+        (verifyIsNaNOnCoercedTypes):
+        (isNaNNoArguments):
+        (isNaNTooManyArguments):
+        (testIsNaNOnConstants):
+        (isNaNTypeCoercionSideEffects):
+        (i.value.isNaNTypeCoercionSideEffects.valueOf):
+        (isNaNStructTransition):
+        (isNaN):
+        * tests/stress/number-is-finite.js: Added.
+        (shouldBe):
+        (test2):
+        (test3):
+        * tests/stress/number-is-nan.js: Added.
+        (shouldBe):
+        (test2):
+        (test3):
+        * tests/stress/to-number-basics.js: Added.
+        (shouldBe):
+        * tests/stress/to-number-convert-identity-without-execution.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        (valueOf):
+        * tests/stress/to-number-int52.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-intrinsic-convert-to-identity-without-execution.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        (valueOf):
+        * tests/stress/to-number-intrinsic-int52.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-intrinsic-object-without-execution.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-intrinsic-value-profiling.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-object-without-execution.js: Added.
+        (shouldBe):
+        (object.valueOf):
+        * tests/stress/to-number-object.js: Added.
+        (shouldBe):
+        (test12):
+        (object1.valueOf):
+        (test2):
+        (test22):
+        (object2.valueOf):
+        (test3):
+        (test32):
+        (object3.valueOf):
+        * tests/stress/to-number-value-profiling.js: Added.
+        (shouldBe):
+        (object.valueOf):
+
+2016-06-23  Saam Barati  <sbarati@apple.com>
+
+        DFGSpeculativeJIT's m_slowPathLambdas should restore the current node field and DFG OSR entry functions should use DeferGCForAWhile instead of DeferGC
+        https://bugs.webkit.org/show_bug.cgi?id=159064
+        <rdar://problem/26599119>
+
+        Reviewed by Filip Pizlo.
+
+        The DFG has a list of m_slowPathLambdas that are code generators it emits
+        amongst its slow paths. These lambdas, however, did not update the m_currentNode field.
+        This caused us to use whatever Node happened to be used as the currentNode at the time
+        we call the slowPathLambda. This means the wrong CallSiteIndex was stored into the call
+        frame when we made a call. This may lead to a crash if the CallSiteIndex corresponds to
+        the wrong CodeOrigin. For example, the wrong CodeOrigin could have an InlineCallFrame with
+        a calleeRecovery that will not be in sync with the current stack state. Trying
+        to recover that callee will often lead to a crash. The solution is to update
+        m_currentNode to the DFG::Node* it corresponds to when emitting these slowPathLambdas.
+
+        I found this bug because we were inside this bad state when calling an operation
+        that happened to have a DeferGC. When this DeferGC actually GCed, it would
+        take a StackTrace, which would lead to a crash because we were updating
+        ShadowChicken with vm.topCallFrame. It just so happened that the CallSiteIndex
+        in the call frame in this program corresponded to an InlineCallFrame with a calleeRecover.
+        However, this CallSiteIndex didn't correspond to the actual state of execution
+        of the program. I'm adding new options to make reproducing DeferGC related
+        bugs easier by making DeferGC force a GC according to some probability. To
+        always have DeferGC force a GC, you can set that probability to 1.
+
+        There is a second bug that I discovered after solving the above bug. We were
+        using DeferGC instead of DeferGCForAWhile in the OSR entry related functions
+        in the DFG. This would cause us to take a stack trace when the call frame was
+        in an inconsistent state. For example, the operation would call FTL::prepareOSREntry,
+        which would replace the DFG CodeBlock in the call frame with the FTL CodeBlock.
+        However, we wouldn't update the CallSiteIndex to correspond to an FTL CallSiteIndex.
+        This would lead to a crash when taking a stack trace. The solution is to prevent
+        stack traces from being taken when the program is in this state by using
+        DeferGCForAWhie instead of DeferGC.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        * dfg/DFGSpeculativeJIT.h:
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::collectIfNecessaryOrDefer):
+        (JSC::Heap::collectAccordingToDeferGCProbability):
+        (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
+        (JSC::Heap::markListSet):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+        * tests/stress/slow-path-generator-updating-current-node-dfg.js: Added.
+        (foo):
+        (bar):
+
+2016-06-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Failing baseline JIT compilation of a code block and then trying to compile it from OSR from DFG/FTL will corrupt the CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=158806
+
+        Reviewed by Saam Barati.
+        
+        If we try to compile a CodeBlock that we already tried compiling in the past then we need
+        to clean up the data structures that were partly filled in by the failed compile. That
+        causes some races, since the DFG may be trying to parse those data structures while we are
+        clearing them. This patch introduces such a clean-up (CodeBlock::resetJITData()) and fixes
+        the races.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::getStubInfoMap):
+        (JSC::CodeBlock::getCallLinkInfoMap):
+        (JSC::CodeBlock::getByValInfoMap):
+        (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
+        (JSC::CodeBlock::resetJITData):
+        (JSC::CodeBlock::visitOSRExitTargets):
+        (JSC::CodeBlock::setSteppingMode):
+        (JSC::CodeBlock::addRareCaseProfile):
+        (JSC::CodeBlock::rareCaseProfileForBytecodeOffset):
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset):
+        (JSC::CodeBlock::resultProfileForBytecodeOffset):
+        (JSC::CodeBlock::specialFastCaseProfileCountForBytecodeOffset):
+        (JSC::CodeBlock::couldTakeSpecialFastCase):
+        (JSC::CodeBlock::ensureResultProfile):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getFromAllValueProfiles):
+        (JSC::CodeBlock::numberOfRareCaseProfiles):
+        (JSC::CodeBlock::numberOfResultProfiles):
+        (JSC::CodeBlock::numberOfArrayProfiles):
+        (JSC::CodeBlock::arrayProfiles):
+        (JSC::CodeBlock::addRareCaseProfile): Deleted.
+        (JSC::CodeBlock::specialFastCaseProfileCountForBytecodeOffset): Deleted.
+        (JSC::CodeBlock::couldTakeSpecialFastCase): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * jit/JIT.cpp:
+        (JSC::JIT::link):
+        * jit/JITWorklist.cpp:
+        (JSC::JITWorklist::compileNow):
+
+2016-06-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Memory Timeline sometimes shows impossible value for bmalloc size (underflowed)
+        https://bugs.webkit.org/show_bug.cgi?id=158110
+        <rdar://problem/26498584>
+
+        Reviewed by Andreas Kling.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::willStartCollection):
+        (JSC::Heap::didFinishCollection):
+        * heap/Heap.h:
+        (JSC::Heap::externalMemorySize):
+        * heap/HeapInlines.h:
+        (JSC::Heap::reportExternalMemoryVisited):
+        Keep count of external memory we visit.
+
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::reportExternalMemoryVisited):
+        Report external memory visited like we do extra memory, since
+        it will be some subset of extra memory that is external.
+
+2016-06-23  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Snapshots should be cleared at some point
+        https://bugs.webkit.org/show_bug.cgi?id=157907
+        <rdar://problem/26373610>
+
+        Reviewed by Timothy Hatcher.
+
+        * heap/HeapSnapshotBuilder.h:
+        * heap/HeapSnapshotBuilder.cpp:
+        (JSC::HeapSnapshotBuilder::resetNextAvailableObjectIdentifier):
+        Provide a way to reset the object identifier counter.
+
+        * inspector/agents/InspectorHeapAgent.h:
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::clearHeapSnapshots):
+        Make clearHeapSnapshots protected, so it can be called from a
+        a PageHeapAgent on page navigations.
+
+2016-06-22  Saam barati  <sbarati@apple.com>
+
+        TypeProfiler and TypeProfilerLog don't play nicely with the concurrent JIT
+        https://bugs.webkit.org/show_bug.cgi?id=159037
+        <rdar://problem/26935349>
+
+        Reviewed by Benjamin Poulain.
+
+        The primary focus of this patch is to make the concurrent
+        baseline JIT work with the type profiler. We were clearing
+        the type profiler log on the background baseline compiler
+        thread which lead to bad things happening. This patch fixes
+        this by processing the log before we launch the compile on
+        a background thread.
+
+        Secondly, I audited the type profiler code inside the DFG,
+        and found that we were doing some racy things. I haven't
+        seen any crashes because of these things, but it is possible
+        that they exist. We were grabbing a RefPtr to a TypeSet,
+        even though TypeSet was RefCounted and not ThreadSafeRefCounted.
+        This patch makes TypeSet ThreadSafeRefCounted. We were
+        also copying a StructureSet while the execution thread could
+        be augmenting the StructureSet. This patch puts changes to 
+        TypeSet's StructureSet behind a ConcurrentJITLock.
+
+        I've also added two more large running tests that run with the
+        type profiler enabled. These are here just to catch any major bugs
+        in the type profiler implementation.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileWithoutLinking):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileExceptionHandlers):
+        (JSC::JIT::doMainThreadPreparationBeforeCompile):
+        (JSC::JIT::frameRegisterCountFor):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        * jit/JITWorklist.cpp:
+        (JSC::JITWorklist::Plan::Plan):
+        (JSC::JITWorklist::Plan::compileInThread):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::addTypeInformation):
+        (JSC::TypeSet::invalidateCache):
+        * runtime/TypeSet.h:
+        (JSC::TypeSet::create):
+        (JSC::TypeSet::isEmpty):
+        (JSC::TypeSet::seenTypes):
+        (JSC::TypeSet::structureSet):
+        * tests/typeProfiler/deltablue-for-of.js: Added.
+        * tests/typeProfiler/getter-richards.js: Added.
+
+2016-06-22  Keith Miller  <keith_miller@apple.com>
+
+        We should have a DFG intrinsic that checks if a value is a TypedArrayView
+        https://bugs.webkit.org/show_bug.cgi?id=159048
+
+        Reviewed by Saam Barati.
+
+        This patch adds a new DFG Intrinsic that checks if a value is a TypedArrayView.
+        The intrinsic, IsTypedArrayView, works in the same way that the other Is<insert-type>
+        DFG nodes work. Additionally, a new builtin function isTypedArrayView has been added.
+        These changes are needed to fix regressions in %TypedArray%.prototype.subarray.
+
+        * builtins/BuiltinNames.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIsTypedArrayView):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsTypedArrayView):
+        (JSC::FTL::DFG::LowerDFGToB3::isTypedArrayView):
+        * runtime/Intrinsic.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncIsTypedArrayView):
+        * runtime/JSTypedArrayViewPrototype.h:
+        * tests/stress/istypedarrayview-intrinsic.js: Added.
+        (makeFn):
+        (typedArrays.forEach):
+        (let.test):
+        (test):
+
+2016-06-21  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-06-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Options::useImmortalObjects is not safe for conservative GC
+        https://bugs.webkit.org/show_bug.cgi?id=158999
+
+        Reviewed by Geoffrey Garen.
+
+        useImmortalObjects set the mark bit to keep an object from being
+        reallocated. This had the negative side-effect of convincing the
+        conservative marker that the object was a valid and live cell, which
+        would cause us to visit garbage.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::didFinishCollection):
+        (JSC::Heap::resumeCompilerThreads):
+        (JSC::Heap::setFullActivityCallback):
+        (JSC::Heap::markDeadObjects): Deleted.
+        * heap/Heap.h: Don't set the mark bit on a dead object. That's a bug in
+        a conservative GC.
+
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::retire): New helper.
+
+        (JSC::MarkedAllocator::reset): Automatically retire old blocks when
+        we're doing the immortal objects thing. This has the effect of
+        preserving memory for debugging because we never recycle a previously
+        allocated block.
+
+2016-06-21  Anders Carlsson  <andersca@apple.com>
+
+        Begin moving the Apple Pay code to the open source repository
+        https://bugs.webkit.org/show_bug.cgi?id=158998
+
+        Reviewed by Tim Horton.
+
+        * Configurations/FeatureDefines.xcconfig:
+        Add ENABLE_APPLE_PAY.
+
+2016-06-21  Saam Barati  <sbarati@apple.com>
+
+        CodeBlock::shrinkToFit is racy
+        https://bugs.webkit.org/show_bug.cgi?id=158994
+        <rdar://problem/26920212>
+
+        Reviewed by Filip Pizlo.
+
+        To see why this is racy, consider the following scenario:
+        - CodeBlock A is link()ing its baseline compile.
+        - CodeBlock B is inlining A, and asks A for a result profile in DFGBytecodeParser.
+        - The race occurs when the link() step of the baseline compile calls shrinkToFit
+          on its m_resultProfiles field without grabbing a lock. This leads to a bad
+          time because the DFG compile will be reading from that vector as it's getting
+          changed by the baseline link() method.
+
+        This race has always existed, though the move to a concurrent baseline
+        JIT has made it more likely to occur. The solution is to have CodeBlock::shrinkToFit
+        grab its lock before shrinking the vector.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shrinkToFit):
+
+2016-06-21  David Kilzer  <ddkilzer@apple.com>
+
+        Migrate testair & testb3 settings from Xcode project to ToolExecutable.xcconfig
+        <https://webkit.org/b/158989>
+
+        Reviewed by Andy Estes.
+
+        * Configurations/ToolExecutable.xcconfig:
+        (CODE_SIGN_ENTITLEMENTS_ios_testair): Add from Xcode project.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        (CODE_SIGN_ENTITLEMENTS_ios_testair): Move to
+        ToolExecutable.xcconfig.
+        (PRODUCT_NAME): Remove.  This variable is already set for both
+        testair and testb3 since those build configurations use
+        ToolExecutable.xcconfig as a base.
+
+2016-06-21  Saam Barati  <sbarati@apple.com>
+
+        LLInt doesn't throw stack exception overflow from parent frame
+        https://bugs.webkit.org/show_bug.cgi?id=158962
+        <rdar://problem/26902188>
+
+        Reviewed by Filip Pizlo.
+
+        All JIT tiers will throw stack overflow exceptions from the parent frame.
+        The LLInt, on the other hand, did not use to. I've changed the LLInt to be
+        consistent with the JITs. The reason I found this bug is because we had a
+        test that would give different results depending on if the function was compiled
+        in the baseline or the LLInt. Since Filip recently landed the concurrent baseline
+        JIT patch, this otherwise deterministic test became dependent on it being compiled
+        in the LLInt or one of the JIT tiers. I've added a new test that is deterministic
+        because it runs the test with --useJIT=false.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * tests/stress/llint-stack-overflow-location.js: Added.
+        (stackTraceDescription):
+        (foo):
+        (catch):
+
+2016-06-21  David Kilzer  <ddkilzer@apple.com>
+
+        CODE_SIGN_ENTITLEMENTS should be applied to iOS Simulator builds
+        <https://webkit.org/b/158990>
+        <rdar://problem/26906273>
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/JSC.xcconfig:
+        (CODE_SIGN_ENTITLEMENTS): Change [sdk=iphoneos*] to
+        [sdk=iphone*] to apply setting to iOS Simulator as well.
+        * Configurations/ToolExecutable.xcconfig:
+        (CODE_SIGN_ENTITLEMENTS): Ditto.
+
+2016-06-21  Keith Miller  <keith_miller@apple.com>
+
+        It should be easy to add a private global helper function for builtins
+        https://bugs.webkit.org/show_bug.cgi?id=158893
+
+        Reviewed by Mark Lam.
+
+        This patch does two things. First it moves all the builtin names
+        out of CommonIdentifiers and into BuiltinNames. This means that
+        adding a new function to the Builtins does not require rebuilding
+        all of JavaScriptCore. This patch also adds a new decorator to our
+        builtins @privateGlobal that will automatically put the function
+        on the global object. The name of the property will be the same as
+        the private name of the function.
+
+        This patch, also, removes the JSArrayIterator.h/.cpp files
+        as they no longer appear to be used in any real way. Finally,
+        the builtins tests have been rebaselined. It appears this has
+        not been done for a while so the expected files contain other
+        changes.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Scripts/builtins/builtins_generate_combined_header.py:
+        (BuiltinsCombinedHeaderGenerator.generate_output):
+        (generate_section_for_code_name_macro):
+        (generate_section_for_global_private_code_name_macro):
+        * Scripts/builtins/builtins_model.py:
+        (BuiltinFunction.__init__):
+        (BuiltinFunction.fromString):
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+        * builtins/ArrayIteratorPrototype.js:
+        * builtins/ArrayPrototype.js:
+        * builtins/BuiltinNames.h:
+        * builtins/GeneratorPrototype.js:
+        * builtins/GlobalObject.js:
+        * builtins/PromiseOperations.js:
+        * builtins/RegExpPrototype.js:
+        * builtins/StringPrototype.js:
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::expectedFunctionForIdentifier):
+        (JSC::BytecodeGenerator::emitGetTemplateObject):
+        (JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitGeneratorStateChange):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::emitHomeObjectForCallee):
+        (JSC::emitPutHomeObject):
+        (JSC::FunctionNode::emitBytecode):
+        * dfg/DFGOperations.cpp:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        (Inspector::JSInjectedScriptHost::getInternalProperties): Deleted.
+        * parser/Lexer.cpp:
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::createGeneratorParameters):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        * runtime/ArrayIteratorPrototype.cpp:
+        * runtime/ArrayIteratorPrototype.h:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers): Deleted.
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/IntlDateTimeFormat.cpp:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObjectInlines.h:
+        (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
+        * runtime/JSArrayIterator.cpp: Removed.
+        (JSC::JSArrayIterator::finishCreation): Deleted.
+        (JSC::JSArrayIterator::kind): Deleted.
+        (JSC::JSArrayIterator::iteratedValue): Deleted.
+        * runtime/JSArrayIterator.h: Removed.
+        (JSC::JSArrayIterator::createStructure): Deleted.
+        (JSC::JSArrayIterator::create): Deleted.
+        (JSC::JSArrayIterator::JSArrayIterator): Deleted.
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSInternalPromise.cpp:
+        * runtime/JSInternalPromiseDeferred.cpp:
+        (JSC::JSInternalPromiseDeferred::create):
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::finishCreation):
+        (JSC::JSPromise::result):
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::create):
+        * runtime/JSStringIterator.cpp:
+        (JSC::JSStringIterator::finishCreation):
+        (JSC::JSStringIterator::iteratedValue):
+        (JSC::JSStringIterator::clone):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/ReflectObject.cpp:
+        (JSC::ReflectObject::finishCreation):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        * runtime/TypedArrayInlines.h:
+
+2016-06-20  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Use bytecode intrinsic to expose Module's loading status to builtin JS
+        https://bugs.webkit.org/show_bug.cgi?id=158871
+
+        Reviewed by Sam Weinig.
+
+        Now JSC has bytecode intrinsic system. Use it instead of exposing status values through the loader's properties.
+
+        * builtins/ModuleLoaderObject.js:
+        (newRegistryEntry):
+        (fulfillFetch):
+        (fulfillTranslate):
+        (commitInstantiated):
+        (requestFetch):
+        (requestTranslate):
+        (requestInstantiate):
+        (requestResolveDependencies.):
+        (requestResolveDependencies):
+        (requestLink):
+        (link):
+        (provide):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::ModuleLoaderObject::finishCreation): Deleted.
+
+2016-06-20  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r202248.
+        https://bugs.webkit.org/show_bug.cgi?id=158960
+
+        breaks builds on the simulator (Requested by keith_mi_ on
+        #webkit).
+
+        Reverted changeset:
+
+        "It should be easy to add a private global helper function for
+        builtins"
+        https://bugs.webkit.org/show_bug.cgi?id=158893
+        http://trac.webkit.org/changeset/202248
+
+2016-06-20  Keith Miller  <keith_miller@apple.com>
+
+        It should be easy to add a private global helper function for builtins
+        https://bugs.webkit.org/show_bug.cgi?id=158893
+
+        Reviewed by Mark Lam.
+
+        This patch does two things. First it moves all the builtin names
+        out of CommonIdentifiers and into BuiltinNames. This means that
+        adding a new function to the Builtins does not require rebuilding
+        all of JavaScriptCore. This patch also adds a new decorator to our
+        builtins @privateGlobal that will automatically put the function
+        on the global object. The name of the property will be the same as
+        the private name of the function.
+
+        This patch, also, removes the JSArrayIterator.h/.cpp files
+        as they no longer appear to be used in any real way. Finally,
+        the builtins tests have been rebaselined. It appears this has
+        not been done for a while so the expected files contain other
+        changes.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Scripts/builtins/builtins_generate_combined_header.py:
+        (BuiltinsCombinedHeaderGenerator.generate_output):
+        (generate_section_for_code_name_macro):
+        (generate_section_for_global_private_code_name_macro):
+        * Scripts/builtins/builtins_model.py:
+        (BuiltinFunction.__init__):
+        (BuiltinFunction.fromString):
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result:
+        * Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result:
+        * Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
+        * Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:
+        * builtins/ArrayIteratorPrototype.js:
+        * builtins/ArrayPrototype.js:
+        * builtins/BuiltinNames.h:
+        * builtins/GeneratorPrototype.js:
+        * builtins/GlobalObject.js:
+        * builtins/PromiseOperations.js:
+        * builtins/RegExpPrototype.js:
+        * builtins/StringPrototype.js:
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::expectedFunctionForIdentifier):
+        (JSC::BytecodeGenerator::emitGetTemplateObject):
+        (JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitGeneratorStateChange):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::emitHomeObjectForCallee):
+        (JSC::emitPutHomeObject):
+        (JSC::FunctionNode::emitBytecode):
+        * dfg/DFGOperations.cpp:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        (Inspector::JSInjectedScriptHost::getInternalProperties): Deleted.
+        * parser/Lexer.cpp:
+        (JSC::Lexer<LChar>::parseIdentifier):
+        (JSC::Lexer<UChar>::parseIdentifier):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::createGeneratorParameters):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        * runtime/ArrayIteratorPrototype.cpp:
+        * runtime/ArrayIteratorPrototype.h:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers): Deleted.
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/IntlDateTimeFormat.cpp:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObjectInlines.h:
+        (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
+        * runtime/JSArrayIterator.cpp: Removed.
+        (JSC::JSArrayIterator::finishCreation): Deleted.
+        (JSC::JSArrayIterator::kind): Deleted.
+        (JSC::JSArrayIterator::iteratedValue): Deleted.
+        * runtime/JSArrayIterator.h: Removed.
+        (JSC::JSArrayIterator::createStructure): Deleted.
+        (JSC::JSArrayIterator::create): Deleted.
+        (JSC::JSArrayIterator::JSArrayIterator): Deleted.
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSInternalPromise.cpp:
+        * runtime/JSInternalPromiseDeferred.cpp:
+        (JSC::JSInternalPromiseDeferred::create):
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::finishCreation):
+        (JSC::JSPromise::result):
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::create):
+        * runtime/JSStringIterator.cpp:
+        (JSC::JSStringIterator::finishCreation):
+        (JSC::JSStringIterator::iteratedValue):
+        (JSC::JSStringIterator::clone):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/ReflectObject.cpp:
+        (JSC::ReflectObject::finishCreation):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        * runtime/TypedArrayInlines.h:
+
+2016-06-20  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt64 Float64 get_by_val doesn't purify NaN
+        https://bugs.webkit.org/show_bug.cgi?id=158956
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter64.asm: Fix the bug.
+        * tests/stress/float64-array-nan-inlined.js: Make this test also run in LLInt-only mode to catch this bug.
+
+2016-06-20  Keith Rollin  <krollin@apple.com>
+
+        Remove RefPtr::release() and change calls sites to use WTFMove()
+        https://bugs.webkit.org/show_bug.cgi?id=158369
+
+        Reviewed by Chris Dumez.
+
+        RefPtr::release() releases its managed pointer awkwardly. It's more
+        direct and clearer to use WTFMove to transfer ownership of the managed
+        pointer.
+
+        As part of this cleanup, also change a lot of explicit data types to
+        'auto'.
+
+        * API/JSObjectRef.cpp:
+        (JSClassCreate):
+        * API/JSScriptRef.cpp:
+        * API/JSValueRef.cpp:
+        (JSValueToStringCopy):
+        * bytecompiler/StaticPropertyAnalyzer.h:
+        (JSC::StaticPropertyAnalyzer::newObject):
+        (JSC::StaticPropertyAnalyzer::mov):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::invalidate):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * inspector/InspectorValues.cpp:
+        (Inspector::InspectorValue::parseJSON):
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::activateExtraDomain):
+        (Inspector::InspectorAgent::activateExtraDomains):
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+        * runtime/GenericTypedArrayViewInlines.h:
+        (JSC::GenericTypedArrayView<Adaptor>::create):
+        (JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::releaseData):
+        * runtime/Structure.cpp:
+        (JSC::Structure::toStructureShape):
+        * runtime/TypeSet.cpp:
+        (JSC::StructureShape::merge):
+        * tools/FunctionOverrides.cpp:
+        (JSC::initializeOverrideInfo):
+
+2016-06-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: console.profile should use the new Sampling Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=153499
+        <rdar://problem/24352431>
+
+        Reviewed by Timothy Hatcher.
+
+        Currently console.profile/profileEnd behave slightly differently
+        between JSContext and Web inspection. Unifying will be part of:
+        <https://webkit.org/b/158753> Generalize the concept of Instruments on the backend
+
+        Both JSContext and Web inspection keep track of active
+        profiles started and stopped via console.profile/profileEnd.
+
+        JSContext inspection sends its programmatic start/stop
+        via the ScriptProfiler domain.
+
+        Web inspection sends its programmatic start/stop
+        via the Timeline domain, and also will start/stop backend
+        list of Instruments.
+
+        The functional differences between these is that for JSContext
+        inspection, console.profile only starts/stops the ScriptProfiler
+        domain, and does not auto-start other instruments. This isn't really
+        a problem right now given the instruments available for JSContext
+        inspection; but it will be nice to unify as we add more instruments.
+        Also, JSContext inspection won't have "Profile (name)" records in
+        its Events view, since those are currently generated only by the
+        Web's Timeline domain.
+
+        * inspector/protocol/ScriptProfiler.json:
+        * inspector/protocol/Timeline.json:
+        Events to inform the frontend of programmatic start/stop.
+
+        * debugger/Debugger.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::breakpointsActive):
+        (Inspector::InspectorDebuggerAgent::isPaused):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        Expose breakpoints active state, since programmatic recording
+        will temporarily disabled breakpoints if needed.
+
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::JSGlobalObjectConsoleClient):
+        (Inspector::JSGlobalObjectConsoleClient::profile):
+        (Inspector::JSGlobalObjectConsoleClient::profileEnd):
+        (Inspector::JSGlobalObjectConsoleClient::startConsoleProfile):
+        (Inspector::JSGlobalObjectConsoleClient::stopConsoleProfile):
+        * inspector/JSGlobalObjectConsoleClient.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::programmaticCaptureStarted):
+        (Inspector::InspectorScriptProfilerAgent::programmaticCaptureStopped):
+        * inspector/agents/InspectorScriptProfilerAgent.h:
+        JSContext implementation of console.profile/profileEnd.
+
+2016-06-19  Saam Barati  <sbarati@apple.com>
+
+        We should be able to generate more types of ICs inline
+        https://bugs.webkit.org/show_bug.cgi?id=158719
+        <rdar://problem/26825641>
+
+        Reviewed by Filip Pizlo.
+
+        This patch changes how we emit code for *byId ICs inline.
+        We no longer keep data labels to patch structure checks, etc.
+        Instead, we just regenerate the entire IC into a designated
+        region of code that the Baseline/DFG/FTL JIT will emit inline.
+        This makes it much simpler to patch inline ICs. All that's
+        needed to patch an inline IC is to memcpy the code from
+        a macro assembler inline using LinkBuffer. This architecture
+        will be easy to extend into other forms of ICs, such as one
+        for add, in the future.
+
+        To support this change, I've reworked the fields inside
+        StructureStubInfo. It now has one field that is the CodeLocationLabel 
+        of the start of the inline IC. Then it has a few ints that track deltas
+        to other locations in the IC such as the slow path start, slow path call, the
+        ICs 'done' location. We used to perform math on these ints in a bunch of different
+        places. I've consolidated that math into methods inside StructureStubInfo.
+
+        To generate inline ICs, I've implemented a new class called InlineAccess.
+        InlineAccess is stateless: it just has a bunch of static methods for
+        generating code into the inline region specified by StructureStubInfo.
+        Repatch will now decide when it wants to generate such an inline
+        IC, and it will ask InlineAccess to do so.
+
+        I've implemented three types of inline ICs to begin with (extending
+        this in the future should be easy):
+        - Self property loads (both inline and out of line offsets).
+        - Self property replace (both inline and out of line offsets).
+        - Array length on specific array types.
+        (An easy extension would be to implement JSString length.)
+
+        To know how much inline space to reserve, I've implemented a
+        method that stubs out the various inline cache shapes and 
+        dumps their size. This is used to determine how much space
+        to save inline. When InlineAccess ends up generating more
+        code than can fit inline, we will fall back to generating
+        code with PolymorphicAccess instead.
+
+        To make generating code into already allocated executable memory
+        efficient, I've made AssemblerData have 128 bytes of inline storage.
+        This saves us a malloc when splatting code into the inline region.
+
+        This patch also tidies up LinkBuffer's API for generating
+        into already allocated executable memory. Now, when generating
+        code that has less size than the already allocated space, LinkBuffer
+        will fill the extra space with nops. Also, if branch compaction shrinks
+        the code, LinkBuffer will add a nop sled at the end of the shrunken
+        code to take up the entire allocated size.
+
+        This looks like it could be a 1% octane progression.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::nop):
+        (JSC::ARM64Assembler::fillNops):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::nopw):
+        (JSC::ARMv7Assembler::nopPseudo16):
+        (JSC::ARMv7Assembler::nopPseudo32):
+        (JSC::ARMv7Assembler::fillNops):
+        (JSC::ARMv7Assembler::dmbSY):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::addLinkTask):
+        (JSC::AbstractMacroAssembler::emitNops):
+        (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerData::AssemblerData):
+        (JSC::AssemblerData::operator=):
+        (JSC::AssemblerData::~AssemblerData):
+        (JSC::AssemblerData::buffer):
+        (JSC::AssemblerData::grow):
+        (JSC::AssemblerData::isInlineBuffer):
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::ensureSpace):
+        (JSC::AssemblerBuffer::codeSize):
+        (JSC::AssemblerBuffer::setCodeSize):
+        (JSC::AssemblerBuffer::label):
+        (JSC::AssemblerBuffer::debugOffset):
+        (JSC::AssemblerBuffer::releaseAssemblerData):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::allocate):
+        (JSC::LinkBuffer::performFinalization):
+        (JSC::LinkBuffer::shrink): Deleted.
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::debugAddress):
+        (JSC::LinkBuffer::size):
+        (JSC::LinkBuffer::wasAlreadyDisassembled):
+        (JSC::LinkBuffer::didAlreadyDisassemble):
+        (JSC::LinkBuffer::applyOffset):
+        (JSC::LinkBuffer::code):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::patchableBranch32):
+        (JSC::MacroAssemblerARM64::patchableBranch64):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::patchableBranch32):
+        (JSC::MacroAssemblerARMv7::patchableBranchPtrWithPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::nop):
+        (JSC::X86Assembler::fillNops):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        * bytecode/InlineAccess.cpp: Added.
+        (JSC::InlineAccess::dumpCacheSizesAndCrash):
+        (JSC::linkCodeInline):
+        (JSC::InlineAccess::generateSelfPropertyAccess):
+        (JSC::getScratchRegister):
+        (JSC::hasFreeRegister):
+        (JSC::InlineAccess::canGenerateSelfPropertyReplace):
+        (JSC::InlineAccess::generateSelfPropertyReplace):
+        (JSC::InlineAccess::isCacheableArrayLength):
+        (JSC::InlineAccess::generateArrayLength):
+        (JSC::InlineAccess::rewireStubAsJump):
+        * bytecode/InlineAccess.h: Added.
+        (JSC::InlineAccess::sizeForPropertyAccess):
+        (JSC::InlineAccess::sizeForPropertyReplace):
+        (JSC::InlineAccess::sizeForLengthAccess):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initArrayLength):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::deref):
+        (JSC::StructureStubInfo::aboutToDie):
+        (JSC::StructureStubInfo::propagateTransitions):
+        (JSC::StructureStubInfo::containsPC):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::considerCaching):
+        (JSC::StructureStubInfo::slowPathCallLocation):
+        (JSC::StructureStubInfo::doneLocation):
+        (JSC::StructureStubInfo::slowPathStartLocation):
+        (JSC::StructureStubInfo::patchableJumpForIn):
+        (JSC::StructureStubInfo::valueRegs):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITByIdGenerator::finalize):
+        (JSC::JITByIdGenerator::generateFastCommon):
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        (JSC::JITGetByIdGenerator::generateFastPath):
+        (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
+        (JSC::JITPutByIdGenerator::generateFastPath):
+        (JSC::JITPutByIdGenerator::slowPathFunction):
+        (JSC::JITByIdGenerator::generateFastPathChecks): Deleted.
+        * jit/JITInlineCacheGenerator.h:
+        (JSC::JITByIdGenerator::reportSlowPathCall):
+        (JSC::JITByIdGenerator::slowPathBegin):
+        (JSC::JITByIdGenerator::slowPathJump):
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/Repatch.cpp:
+        (JSC::repatchCall):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::appropriateGenericPutByIdFunction):
+        (JSC::tryCachePutByID):
+        (JSC::repatchPutByID):
+        (JSC::tryRepatchIn):
+        (JSC::repatchIn):
+        (JSC::linkSlowFor):
+        (JSC::resetGetByID):
+        (JSC::resetPutByID):
+        (JSC::resetIn):
+        (JSC::repatchByIdSelfAccess): Deleted.
+        (JSC::resetGetByIDCheckAndLoad): Deleted.
+        (JSC::resetPutByIDCheckAndLoad): Deleted.
+        (JSC::replaceWithJump): Deleted.
+
+2016-06-19  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(concurrent baseline JIT): Kraken/ai-astar runs 20% slower
+        https://bugs.webkit.org/show_bug.cgi?id=158906
+
+        Reviewed by Benjamin Poulain.
+        
+        The concurrent baseline JIT was a 2-3% progression on JSBench, possibly a 1% progression
+        on PLT3, but a 2-5% regression on Kraken. This patch fixes the Kraken regression without
+        affecting the other tests.
+        
+        The problem is that Kraken/ai-astar's initialization code had a ginormous piece of init
+        code that took about 16ms to compile in baseline. There's no good way to avoid letting it
+        tier-up into baseline since it has a compute loop. The time it takes to run this code is
+        never measured. The concurrent baseline JIT caused us to schedule the compilation of this
+        huge code rather than doing it eagerly. This meant that after initialization was done and
+        we started actually running real stuff, all of the real stuff's compiles would be convoyed
+        behind this super-expensive baseline compile. Note that DFG and FTL compiles convoy behind
+        baseline compiles, since you can't schedule a DFG compile for a code block until that code
+        block is in baseline.
+        
+        This uses the simplest fix: if we are thinking about scheduling some compile and the
+        thread is busy, do the compile on the main thread instead. This doesn't completely
+        eliminate the ai-astar regression (we still have a 4% regression on that test) but it now
+        results in concurrent baseline JIT being an overall progression on Kraken as a whole (1%
+        on my machine). This is because concurrent baseline appears to help on other tests.
+
+        In the future, we could fix this even better by allowing the JITWorklist to spawn more
+        threads or by being smarter about baseline compilation. I think it's nasty that if a giant
+        piece of initialization code ends in a compute loop, we compile all of the code instead of
+        just the loop. It's also gross that a constant-like object creation expression will result
+        in so much code. It would result in less code if we allowed ourselves to do a bit more
+        static reasoning about object literals.
+        
+        But for now, I think that this is a great way to recover the Kraken regression while still
+        keeping the other progressions from concurrent baseline.
+
+        * jit/JITWorklist.cpp:
+        (JSC::JITWorklist::Plan::Plan):
+        (JSC::JITWorklist::Plan::compileInThread):
+        (JSC::JITWorklist::Plan::finalize):
+        (JSC::JITWorklist::Plan::codeBlock):
+        (JSC::JITWorklist::Plan::isFinishedCompiling):
+        (JSC::JITWorklist::Plan::compileNow):
+        (JSC::JITWorklist::JITWorklist):
+        (JSC::JITWorklist::compileLater):
+        (JSC::JITWorklist::compileNow):
+        (JSC::JITWorklist::runThread):
+        (JSC::JITWorklist::Plan::isFinalized): Deleted.
+        * jit/JITWorklist.h:
+
+2016-06-17  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r202152.
+        https://bugs.webkit.org/show_bug.cgi?id=158897
+
+        The new test is very unstable, timing out frequently
+        (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: console.profile should use the new Sampling
+        Profiler"
+        https://bugs.webkit.org/show_bug.cgi?id=153499
+        http://trac.webkit.org/changeset/202152
+
+2016-06-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should be concurrent
+        https://bugs.webkit.org/show_bug.cgi?id=158755
+
+        Reviewed by Geoffrey Garen.
+        
+        This makes the baseline JIT concurrent. We want it to be concurrent because it takes up
+        about 1% of PLT3 and 10% of JSBench (though the JSBench number might be down from recent
+        optimizations).
+        
+        The idea is really simple: I separated the compile and link phases of JIT::privateCompile(),
+        and arranged to call the compile phase from another thread. This doesn't reuse the old
+        DFG::Worklist code, because that code does things we don't need (like compilation plan
+        cancellation to allow GC to interleave with compilations) and is structured in a way that
+        would have required more changes to the baseline JIT. Also, I think that code uses the wrong
+        API, and as a result, clients of that API have a bad time. For example, it's never clear who
+        has the responsibility of setting the JIT thresholds and the DFG::Worklist goes to great
+        lengths to try to help its client set those things correctly, but since it doesn't set them
+        directly, the client then has to have additional complex logic to combine what it learned
+        from the Worklist and what it knows to set the thresholds. This patch takes a simpler
+        approach: the JITWorklist takes complete control over scheduling compilations. It's like a
+        combination of DFG::Worklist and operationOptimize().
+        
+        Because the baseline JIT runs quickly, we can take some shortcuts. The JITWorklist requires
+        that all of its plans complete before a GC begins. This ensures that we don't have to worry
+        about interactions between the concurrent baseline JIT and the GC.
+        
+        I needed to do a bunch of minor changes to the JIT to handle the races that emerged. For
+        example, I needed to do things to opcodes that read profiling both in the main path code
+        generator and the slow path one. One trick I used was to create a copy of the instruction
+        stream and provide that for anyone interested in the original value of the profiles. Most
+        code still uses the CodeBlock's instruction stream because it may emit JIT code that points
+        at the stream.
+        
+        This also fixes a LLInt bug in prototype caching. This bug was revealed by this change
+        because more of our LayoutTests now run in LLInt.
+        
+        This looks like it might be a ~1% Octane speed-up (on command line) and a ~0.7% PLT3
+        speed-up. This also looks like a ~2% JSBench speed-up.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::toggleBreakpoint):
+        (JSC::Debugger::clearBreakpoints):
+        (JSC::Debugger::clearDebuggerRequests):
+        * dfg/DFGOSRExitPreparation.cpp:
+        (JSC::DFG::prepareCodeOriginForOSRExit):
+        * heap/Heap.cpp:
+        (JSC::Heap::didFinishIterating):
+        (JSC::Heap::completeAllJITPlans):
+        (JSC::Heap::deleteAllCodeBlocks):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::completeAllDFGPlans): Deleted.
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::forEachCodeBlock):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitNotifyWrite):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::compileWithoutLinking):
+        (JSC::JIT::link):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JIT.h:
+        (JSC::JIT::compile):
+        (JSC::JIT::getSlowCase):
+        (JSC::JIT::linkSlowCase):
+        (JSC::JIT::linkDummySlowCase):
+        * jit/JITInlines.h:
+        (JSC::JIT::emitTagBool):
+        (JSC::JIT::originalInstruction):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_resolve_scope):
+        (JSC::JIT::emitSlow_op_resolve_scope):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITWorklist.cpp: Added.
+        (JSC::JITWorklist::Plan::Plan):
+        (JSC::JITWorklist::Plan::compileInThread):
+        (JSC::JITWorklist::Plan::finalize):
+        (JSC::JITWorklist::Plan::codeBlock):
+        (JSC::JITWorklist::Plan::vm):
+        (JSC::JITWorklist::Plan::isFinishedCompiling):
+        (JSC::JITWorklist::Plan::isFinalized):
+        (JSC::JITWorklist::JITWorklist):
+        (JSC::JITWorklist::~JITWorklist):
+        (JSC::JITWorklist::completeAllForVM):
+        (JSC::JITWorklist::poll):
+        (JSC::JITWorklist::compileLater):
+        (JSC::JITWorklist::compileNow):
+        (JSC::JITWorklist::runThread):
+        (JSC::JITWorklist::finalizePlans):
+        (JSC::JITWorklist::instance):
+        * jit/JITWorklist.h: Added.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
+        * runtime/VM.cpp:
+        (JSC::VM::~VM):
+
+2016-06-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: console.profile should use the new Sampling Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=153499
+        <rdar://problem/24352431>
+
+        Reviewed by Timothy Hatcher.
+
+        Currently console.profile/profileEnd behave slightly differently
+        between JSContext and Web inspection. Unifying will be part of:
+        <https://webkit.org/b/158753> Generalize the concept of Instruments on the backend
+
+        Both JSContext and Web inspection keep track of active
+        profiles started and stopped via console.profile/profileEnd.
+
+        JSContext inspection sends its programmatic start/stop
+        via the ScriptProfiler domain.
+
+        Web inspection sends its programmatic start/stop
+        via the Timeline domain, and also will start/stop backend
+        list of Instruments.
+
+        The functional differences between these is that for JSContext
+        inspection, console.profile only starts/stops the ScriptProfiler
+        domain, and does not auto-start other instruments. This isn't really
+        a problem right now given the instruments available for JSContext
+        inspection; but it will be nice to unify as we add more instruments.
+        Also, JSContext inspection won't have "Profile (name)" records in
+        its Events view, since those are currently generated only by the
+        Web's Timeline domain.
+
+        * inspector/protocol/ScriptProfiler.json:
+        * inspector/protocol/Timeline.json:
+        Events to inform the frontend of programmatic start/stop.
+
+        * debugger/Debugger.h:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::breakpointsActive):
+        (Inspector::InspectorDebuggerAgent::isPaused):
+        * inspector/agents/InspectorDebuggerAgent.h:
+        Expose breakpoints active state, since programmatic recording
+        will temporarily disabled breakpoints if needed.
+
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::JSGlobalObjectConsoleClient):
+        (Inspector::JSGlobalObjectConsoleClient::profile):
+        (Inspector::JSGlobalObjectConsoleClient::profileEnd):
+        (Inspector::JSGlobalObjectConsoleClient::startConsoleProfile):
+        (Inspector::JSGlobalObjectConsoleClient::stopConsoleProfile):
+        * inspector/JSGlobalObjectConsoleClient.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::programmaticCaptureStarted):
+        (Inspector::InspectorScriptProfilerAgent::programmaticCaptureStopped):
+        * inspector/agents/InspectorScriptProfilerAgent.h:
+        JSContext implementation of console.profile/profileEnd.
+
+2016-06-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Kraken/stanford-crypto-pbkdf2.js sometimes crashes with an OSR assertion in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=158850
+
+        Reviewed by Keith Miller.
+        
+        Bytecode liveness was incorrectly claiming that all tail-deleted locals are live! That's
+        crazy! We never noticed this because extending OSR liveness is usually not a showstopper and
+        until recently we didn't have a lot of tail-call test cases to play with. Well, we do now,
+        thanks to the increasing reliance on tail calls in our builtins.
+
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::localsLiveInBytecode): Fix the bug and add some optional tracing. Also restructure the code so that we don't break to return true, since that's counterintuitive.
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::buildExitArguments): Make this assertion print more useful information.
+
+2016-06-16  Mark Lam  <mark.lam@apple.com>
+
+        Add collecting of LLINT slow path stats.
+        https://bugs.webkit.org/show_bug.cgi?id=158829
+
+        Reviewed by Keith Miller.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::dumpStats):
+        * llint/LLIntData.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2016-06-15  Keith Miller  <keith_miller@apple.com>
+
+        Add support for Symbol.isConcatSpreadable (round 2)
+        https://bugs.webkit.org/show_bug.cgi?id=158769
+
+        Reviewed by Mark Lam.
+
+        This patch adds support for Symbol.isConcatSpreadable. In order to
+        do so, it was necessary to move the Array.prototype.concat function
+        to JS. A number of different optimizations were needed to make
+        such the move to a builtin performant. First, this patch adds a
+        new Bytecode intrinsic, isJSArray, that checks if the value is a
+        JSArray object. Specifically, isJSArray checks that the array
+        object is a normal instance of JSArray and not a RuntimeArray or
+        Array.prototype. isJSArray can also be converted into a constant
+        by the DFG if we are able to prove that the incomming value is
+        already a JSArray.
+
+        In order to further improve the perfomance we also now cover more
+        indexing types in our fast path memcpy code. Before we would only
+        memcpy Arrays if they had the same indexing type and did not have
+        Array storage or were undecided. Now the memcpy code covers the
+        following additional three cases:
+
+        1) One array is undecided and the other does not have array storage
+
+        2) One array is Int32 and the other is contiguous (we map this
+        into a contiguous array).
+
+        3) The this value is an array and first argument is a non-array
+        that does not have Symbol.isConcatSpreadable set.
+
+        This patch also adds a new fast path for concat with more than one
+        array argument by using memcpy to append values onto the result
+        array. This works roughly the same as the two array fast path
+        using the same methodology to decide if we can memcpy the other
+        butterfly into the result butterfly.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ArrayPrototype.js:
+        (concatSlowPath):
+        (concat):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitIsJSArray):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_isJSArray):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileIsJSArray):
+        (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::isArray):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_jsarray):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_jsarray):
+        * jit/JITOperations.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayConstructor.h:
+        (JSC::isArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::speciesWatchpointsValid):
+        (JSC::speciesConstructArray):
+        (JSC::moveElements):
+        (JSC::concatAppendOne):
+        (JSC::arrayProtoFuncConcat): Deleted.
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/IndexingType.h:
+        (JSC::indexingTypeForValue):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::fastConcatWith): Deleted.
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::isJSArray):
+        (JSC::JSArray::fastConcatType): Deleted.
+        * runtime/JSArrayInlines.h: Added.
+        (JSC::JSArray::mergeIndexingTypeForCopying):
+        (JSC::JSArray::canFastCopy):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::convertUndecidedForValue):
+        * runtime/JSType.h:
+        * runtime/ObjectConstructor.h:
+        (JSC::constructObject):
+        * tests/es6.yaml:
+        * tests/stress/array-concat-spread-object.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-spread-proxy-exception-check.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-spread-proxy.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-with-slow-indexingtypes.js: Added.
+        (arrayEq):
+        * tests/stress/array-species-config-array-constructor.js:
+
+2016-06-15  Mark Lam  <mark.lam@apple.com>
+
+        Assertion failure when returning incomplete property descriptor from proxy trap.
+        https://bugs.webkit.org/show_bug.cgi?id=157078
+
+        Reviewed by Saam Barati.
+
+        If the proxy returns a descriptor that expects a value but does not specify one,
+        we should use undefined for the value.
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        * tests/stress/proxy-returning-incomplete-property-descriptor.js: Added.
+        (truthiness):
+        (compare):
+        (shouldBe):
+        (test):
+        (get test):
+
+2016-06-15  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, fix typo in test and move tests to the correct files.
+
+        * tests/stress/multi-get-by-offset-proto-or-unset.js:
+        * tests/stress/multi-get-by-offset-proto-self-or-unset.js:
+
+2016-06-15  Keith Miller  <keith_miller@apple.com>
+
+        DFGByteCodeParser should be able to infer the value of unset properties in MultiGetByOffset
+        https://bugs.webkit.org/show_bug.cgi?id=158802
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds support for unset properties in MultiGetByOffset. Since MultiGetByOffset
+        already supports constant values this patch just adds a constant case where the fetched
+        value is undefined. Fortunately (or unfortunately) we don't support object allocation
+        sinking for constant cases of MultiGetByOffset, which means we don't need to adjust any
+        in that phase.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::planLoad):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        * dfg/DFGMultiGetByOffsetData.h:
+        * tests/stress/multi-get-by-offset-proto-or-unset.js: Added.
+        (foo):
+        * tests/stress/multi-get-by-offset-proto-self-or-unset.js: Added.
+        (foo):
+        * tests/stress/multi-get-by-offset-self-or-unset.js: Added.
+        (foo):
+
+2016-06-15  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed GCC build fix after r202098.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::thresholdForJIT):
+
+2016-06-14  Geoffrey Garen  <ggaren@apple.com>
+
+        compilation policy should adapt to past behavior
+        https://bugs.webkit.org/show_bug.cgi?id=158759
+
+        Reviewed by Saam Barati.
+
+        This looks like a ~9% speedup on JSBench.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock): Record when a CodeBlock dies without ever
+        making it to DFG.
+
+        (JSC::CodeBlock::thresholdForJIT): CodeBlocks that make it to DFG should
+        compile sooner; CodeBlocks that don't should compile later. The goal is
+        to use past behavior, in addition to execution counts, to determine
+        whether compilation is profitable.
+
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon): Apply the thresholdForJIT rule.
+
+        * bytecode/CodeBlock.h: Moved some code into the .cpp file so I could
+        change stuff without recompiling.
+        (JSC::CodeBlock::jitAfterWarmUp): Deleted.
+        (JSC::CodeBlock::jitSoon): Deleted.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::didOptimize):
+        (JSC::UnlinkedCodeBlock::setDidOptimize): Added a piece of data to track
+        whether we made it to DFG.
+
+        * jit/JITOperations.cpp: Record when we make it to DFG.
+
+2016-06-15  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Only Mac port needs ObjC API for JSC.
+        https://bugs.webkit.org/show_bug.cgi?id=158780
+
+        Reviewed by Philippe Normand.
+
+        * API/JSBase.h: Removed !defined(BUILDING_GTK__)
+
+2016-06-15  Keith Miller  <keith_miller@apple.com>
+
+        DFGByteCodeParser should be able to infer a property is unset from the Baseline inline cache.
+        https://bugs.webkit.org/show_bug.cgi?id=158774
+
+        Reviewed by Filip Pizlo.
+
+        This patch allows the DFGByteCodeParser to speculatively convert a property access into a
+        constant if that access was always a miss in the Baseline inline cache. This patch does
+        not add support for MultiGetByOffset and unset properties. That functionality will come
+        a future patch.
+
+        * bytecode/ComplexGetStatus.cpp:
+        (JSC::ComplexGetStatus::computeFor):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/GetByIdVariant.h:
+        (JSC::GetByIdVariant::isPropertyUnset):
+        * bytecode/PutByIdVariant.h:
+        (JSC::PutByIdVariant::isPropertyUnset):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::load):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        * tests/stress/undefined-access-then-self-change.js: Added.
+        (foo):
+
+2016-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Move calling convention flags to WTF
+        https://bugs.webkit.org/show_bug.cgi?id=158661
+
+        Reviewed by Keith Miller.
+
+        Due to some calling convention flags and JIT_OPERATION flags, MathCommon.h includes MacroAssemblerCodeRef and JITOperations.h.
+        But MacroAssembler and JIT part should not be necessary for the MathCommon component.
+        As with other calling convention flags like JSC_HOST_CALL, these flags should be in WTF.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        * jit/JITOperations.h:
+        Add wtf/Platform.h inclusion driven by the Windows port build failure.
+
+        * runtime/MathCommon.h:
+
+2016-06-15  Romain Bellessort  <romain.bellessort@crf.canon.fr>
+
+        Enabling Shadow DOM for all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=158738
+
+        Reviewed by Ryosuke Niwa.
+
+        Removed Shadow DOM from options (enabled by default)
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-06-14  Caio Lima  <ticaiolima@gmail.com>
+
+        The parser doesn't properly parse "super" when default parameter is an
+        arrow function.
+        https://bugs.webkit.org/show_bug.cgi?id=157872.
+
+        Reviewed by Saam Barati.
+
+        The "super" member or "super()" could not be used when default parameter is an
+        arrow function, resuling in sytax error. It happened because the
+        "closestOrdinaryFunctionScope" was not being initialized properly
+        before "parseFunctionParameters" step and the condition
+        "functionSuperBinding == SuperBinding::NotNeeded" or
+        "functionConstructorKind != ConstructorKind::Derived" on
+        "Parser<LexerType>::parseMemberExpression" step were being true
+        resulting in SyntaxError.
+
+        * parser/Parser.cpp: 
+        (JSC::Parser<LexerType>::parseFunctionInfo): setting
+        "functionScope->setExpectedSuperBinding(expectedSuperBinding)" and
+        "functionScope->setConstructorKind(constructorKind)" before
+        "parseFunctionParameters" step.
+
+2016-06-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Rename Timeline.setAutoCaptureInstruments to Timeline.setInstruments
+        https://bugs.webkit.org/show_bug.cgi?id=158762
+
+        Reviewed by Timothy Hatcher.
+
+        Rename the protocol methods since the backend may use the instruments
+        for purposes other then auto-capture, such as programmatic capture
+        via console.profile.
+
+        * inspector/protocol/Timeline.json:
+
+2016-06-14  David Kilzer  <ddkilzer@apple.com>
+
+        Document the native format of JSChar type
+        <http://webkit.org/b/156137>
+
+        Reviewed by Darin Adler.
+
+        * API/JSStringRef.h:
+        (typedef JSChar): Update documentation.
+
+2016-06-14  Keith Miller  <keith_miller@apple.com>
+
+        The Array species constructor watchpoints should be created the first time they are needed rather than on creation
+        https://bugs.webkit.org/show_bug.cgi?id=158754
+
+        Reviewed by Benjamin Poulain.
+
+        We use adaptive watchpoints for some Array prototype functions to
+        ensure that the user has not overridden the value of the
+        Array.prototype.constructor or Array[Symbol.species]. This patch
+        changes when the Array species constructor watchpoints are
+        initialized. Before, those watchpoints would be created when the
+        global object is initialized. This had the advantage that it did
+        not require validating the constructor and Symbol.species
+        properties. On the other hand, it also meant that if the user were
+        to reconfigure properties Array.prototype, which would cause the
+        structure of the property to become an uncachable dictionary,
+        prior to running code that the watchpoints would be
+        invalidated. It turns out that JSBench amazon, for instance, does
+        reconfigure some of Array.prototype's properties. This patch
+        initializes the watchpoints the first time they are needed. Since
+        we only initialize once we also flatten the structure of Array and
+        Array.prototype.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        (JSC::ArrayPrototype::attemptToInitializeSpeciesWatchpoint):
+        (JSC::ArrayPrototypeAdaptiveInferredPropertyWatchpoint::handleFire):
+        (JSC::ArrayPrototype::setConstructor): Deleted.
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::speciesWatchpointStatus):
+        (JSC::ArrayPrototype::didChangeConstructorOrSpeciesProperties): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::speciesGetterSetter):
+        (JSC::JSGlobalObject::arrayConstructor):
+        * tests/stress/array-symbol-species-lazy-watchpoints.js: Added.
+        (test):
+        (arrayEq):
+        (A):
+
+2016-06-14  Keith Miller  <keith_miller@apple.com>
+
+        REGRESSION(202002-202014): 845 32-bit JSC Stress Test failures
+        https://bugs.webkit.org/show_bug.cgi?id=158737
+
+        Reviewed by Filip Pizlo.
+
+        When the this child and arguments child for the varargs nodes was switched I missed one
+        case in the 32-bit build.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
+2016-06-13  Gavin & Ellie Barraclough  <barraclough@apple.com>
+
+        setUpStaticFunctionSlot does not handle Builtin|Accessor properties
+        https://bugs.webkit.org/show_bug.cgi?id=158637
+
+        Reviewed by Geoff Garen.
+
+        setUpStaticFunctionSlot contains a duplicate copy of the body of the function reifyStaticProperty
+        - however it is missing handling for Accessor type under Builtin functions.
+        Fix the bug by de-duplicating - setUpStaticFunctionSlot should just call reifyStaticProperty.
+
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+            - should just call reifyStaticProperty.
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        (JSC::reifyStaticProperty):
+            - changed reifyStaticProperty to take PropertyName.
+
+2016-06-13  Gavin & Ellie Barraclough  <barraclough@apple.com>
+
+        JSBoundSlotBaseFunction no longer binds slot base
+        https://bugs.webkit.org/show_bug.cgi?id=157978
+
+        Reviewed by Geoff Garen.
+
+        This class is basically currently named after a bug. We should never have
+        been binding function to slot bases - this was not ever correct behavior.
+        This was fixed earlier in the year, but there is still some cruft including
+        the class name to clean up.
+
+            - renamed JSBoundSlotBaseFunction -> JSCustomGetterSetterFunction
+            - removed m_boundSlotBase - don't retain the original slot base
+              (we were not really using it anyway).
+            - ASSERT customGetterSetter->getter/setter are non-null, rather than checking.
+            - Store the PropertyName such that we can pass this to the getter
+              (we're currently reperforming the String->Identifier conversion every time).
+            - Removed JSFunction::lookUpOrCreateNativeExecutable - this is just overhead,
+              and not used consistently.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSBoundSlotBaseFunction.cpp: Removed.
+        * runtime/JSBoundSlotBaseFunction.h: Removed.
+            - JSBoundSlotBaseFunction -> JSCustomGetterSetterFunction
+        * runtime/JSCustomGetterSetterFunction.cpp: Copied from Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.cpp.
+        (JSC::JSCustomGetterSetterFunction::customGetterSetterFunctionCall):
+            - made a static function on JSCustomGetterSetterFunction such that accessor
+              to member properties could be made private. Call variant of callCustomSetter
+              that does not require slotBase, ASSERT getter/setter present, pass stored
+              PropertyName to getter.
+        (JSC::JSCustomGetterSetterFunction::JSCustomGetterSetterFunction):
+            - renamed, store propertyName.
+        (JSC::JSCustomGetterSetterFunction::create):
+            - use same function name to Executable as is being passed to Function::finishCreation.
+        (JSC::JSCustomGetterSetterFunction::visitChildren):
+        (JSC::JSCustomGetterSetterFunction::finishCreation):
+            - removed m_boundSlotBase.
+        * runtime/JSCustomGetterSetterFunction.h: Copied from Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.h.
+        (JSC::JSCustomGetterSetterFunction::customGetterSetter):
+        (JSC::JSCustomGetterSetterFunction::isSetter):
+            - made private.
+        (JSC::JSCustomGetterSetterFunction::propertyName):
+            - new accessor.
+        (JSC::JSBoundSlotBaseFunction::boundSlotBase): Deleted.
+            - removed.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::lookUpOrCreateNativeExecutable): Deleted.
+            - removed lookUpOrCreateNativeExecutable. This inconsistently used wrapper was providing no value, only bloat.
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+            - renamed JSBoundSlotBaseFunction -> JSCustomGetterSetterFunction, etc.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::customGetterSetterFunctionStructure):
+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure): Deleted.
+            - renamed JSBoundSlotBaseFunction -> JSCustomGetterSetterFunction, etc.
+        * runtime/JSNativeStdFunction.cpp:
+        (JSC::JSNativeStdFunction::create):
+            - removed lookUpOrCreateNativeExecutable.
+        * runtime/JSObject.cpp:
+        (JSC::getCustomGetterSetterFunctionForGetterSetter):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::getBoundSlotBaseFunctionForGetterSetter): Deleted.
+            - renamed JSBoundSlotBaseFunction -> JSCustomGetterSetterFunction, etc.
+        * runtime/VM.h:
+            - renamed JSBoundSlotBaseFunction -> JSCustomGetterSetterFunction, etc.
+
+2016-06-13  Saam Barati  <sbarati@apple.com>
+
+        The sampling profiler should further protect itself against certain forms of sampling bias that arise due to the sampling interval being in sync with some other system process
+        https://bugs.webkit.org/show_bug.cgi?id=158678
+
+        Reviewed by Benjamin Poulain.
+
+        I first became aware of this problem when I read this paper:
+        http://plv.colorado.edu/papers/mytkowicz-pldi10.pdf
+
+        To provide background for this change, I'll quote a paragraph
+        from section 6.2:
+        "One statically sound method for collecting random samples is to collect a
+        sample at every t + r milliseconds, where t is the desired sampling interval
+        and r is a random number between −t and t. One might think that sampling every
+        t seconds is enough (i.e., drop the r component) but it is not: specifically,
+        if a profiler samples every t seconds, the sampling rate would be synchronized
+        with any program or system activity that occurs at regular time intervals [17].
+        For example, if the thread scheduler switches between threads every 10ms and our
+        sampling interval was also 10ms, then we may always take samples immediately after
+        a thread switch. Because performance is often different immediately after a thread
+        switch than at other points (e.g., due to cache and TLB warm-up effects) we would
+        get biased data. The random component, r, guards against such situations."
+
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::timerLoop):
+
+2016-06-13  Oliver Hunt  <oliver@apple.com>
+
+        DFG Validation fails when performing a concatenation with only a single entry
+        https://bugs.webkit.org/show_bug.cgi?id=158699
+
+        Reviewed by Saam Barati.
+
+        Fairly simple short circuiting of a single replacement template string
+        without any padding to be planted as a simple to string rather than
+        op_strcat.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TemplateLiteralNode::emitBytecode):
+        * tests/stress/template-literal.js:
+        (testSingleNode):
+
+2016-06-13  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL::Output methods should be out-of-line whenever possible
+        https://bugs.webkit.org/show_bug.cgi?id=158704
+
+        Reviewed by Benjamin Poulain.
+        
+        These methods turn into a non-trivial amount of code because of the template-based B3 API.
+        Inlining them didn't achieve any performance advantages for the FTL, but it did make the
+        code larger. This outlines most methods in FTL::Output. It makes FTL::LowerDFGToB3 smaller
+        and it doesn't change performance.
+
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::appendTo):
+        (JSC::FTL::Output::framePointer):
+        (JSC::FTL::Output::lockedStackSlot):
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::constInt32):
+        (JSC::FTL::Output::constInt64):
+        (JSC::FTL::Output::constDouble):
+        (JSC::FTL::Output::phi):
+        (JSC::FTL::Output::add):
+        (JSC::FTL::Output::sub):
+        (JSC::FTL::Output::mul):
+        (JSC::FTL::Output::div):
+        (JSC::FTL::Output::chillDiv):
+        (JSC::FTL::Output::mod):
+        (JSC::FTL::Output::chillMod):
+        (JSC::FTL::Output::neg):
+        (JSC::FTL::Output::doubleAdd):
+        (JSC::FTL::Output::doubleSub):
+        (JSC::FTL::Output::doubleMul):
+        (JSC::FTL::Output::doubleDiv):
+        (JSC::FTL::Output::doubleMod):
+        (JSC::FTL::Output::bitAnd):
+        (JSC::FTL::Output::bitOr):
+        (JSC::FTL::Output::bitXor):
+        (JSC::FTL::Output::shl):
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::bitNot):
+        (JSC::FTL::Output::logicalNot):
+        (JSC::FTL::Output::ctlz32):
+        (JSC::FTL::Output::doubleAbs):
+        (JSC::FTL::Output::doubleCeil):
+        (JSC::FTL::Output::doubleFloor):
+        (JSC::FTL::Output::doubleTrunc):
+        (JSC::FTL::Output::doubleSin):
+        (JSC::FTL::Output::doubleCos):
+        (JSC::FTL::Output::doublePow):
+        (JSC::FTL::Output::doublePowi):
+        (JSC::FTL::Output::doubleSqrt):
+        (JSC::FTL::Output::doubleLog):
+        (JSC::FTL::Output::hasSensibleDoubleToInt):
+        (JSC::FTL::Output::doubleToUInt):
+        (JSC::FTL::Output::signExt32To64):
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::intToDouble):
+        (JSC::FTL::Output::unsignedToDouble):
+        (JSC::FTL::Output::castToInt32):
+        (JSC::FTL::Output::doubleToFloat):
+        (JSC::FTL::Output::floatToDouble):
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::baseIndex):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        (JSC::FTL::Output::above):
+        (JSC::FTL::Output::aboveOrEqual):
+        (JSC::FTL::Output::below):
+        (JSC::FTL::Output::belowOrEqual):
+        (JSC::FTL::Output::greaterThan):
+        (JSC::FTL::Output::greaterThanOrEqual):
+        (JSC::FTL::Output::lessThan):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::doubleEqual):
+        (JSC::FTL::Output::doubleEqualOrUnordered):
+        (JSC::FTL::Output::doubleNotEqualOrUnordered):
+        (JSC::FTL::Output::doubleLessThan):
+        (JSC::FTL::Output::doubleLessThanOrEqual):
+        (JSC::FTL::Output::doubleGreaterThan):
+        (JSC::FTL::Output::doubleGreaterThanOrEqual):
+        (JSC::FTL::Output::doubleNotEqualAndOrdered):
+        (JSC::FTL::Output::doubleLessThanOrUnordered):
+        (JSC::FTL::Output::doubleLessThanOrEqualOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrEqualOrUnordered):
+        (JSC::FTL::Output::isZero32):
+        (JSC::FTL::Output::notZero32):
+        (JSC::FTL::Output::isZero64):
+        (JSC::FTL::Output::notZero64):
+        (JSC::FTL::Output::select):
+        (JSC::FTL::Output::jump):
+        (JSC::FTL::Output::branch):
+        (JSC::FTL::Output::check):
+        (JSC::FTL::Output::ret):
+        (JSC::FTL::Output::unreachable):
+        (JSC::FTL::Output::speculate):
+        (JSC::FTL::Output::speculateAdd):
+        (JSC::FTL::Output::speculateSub):
+        (JSC::FTL::Output::speculateMul):
+        (JSC::FTL::Output::patchpoint):
+        (JSC::FTL::Output::trap):
+        (JSC::FTL::Output::anchor):
+        (JSC::FTL::Output::bitCast):
+        (JSC::FTL::Output::fround):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::setOrigin):
+        (JSC::FTL::Output::origin):
+        (JSC::FTL::Output::constIntPtr):
+        (JSC::FTL::Output::doubleNeg):
+        (JSC::FTL::Output::zeroExtPtr):
+        (JSC::FTL::Output::load32NonNegative):
+        (JSC::FTL::Output::isNull):
+        (JSC::FTL::Output::notNull):
+        (JSC::FTL::Output::testIsZeroPtr):
+        (JSC::FTL::Output::testNonZeroPtr):
+        (JSC::FTL::Output::call):
+        (JSC::FTL::Output::operation):
+        (JSC::FTL::Output::branch):
+        (JSC::FTL::Output::switchInstruction):
+        (JSC::FTL::Output::addIncomingToPhi):
+        (JSC::FTL::Output::framePointer): Deleted.
+        (JSC::FTL::Output::constBool): Deleted.
+        (JSC::FTL::Output::constInt32): Deleted.
+        (JSC::FTL::Output::constInt64): Deleted.
+        (JSC::FTL::Output::constDouble): Deleted.
+        (JSC::FTL::Output::phi): Deleted.
+        (JSC::FTL::Output::add): Deleted.
+        (JSC::FTL::Output::sub): Deleted.
+        (JSC::FTL::Output::mul): Deleted.
+        (JSC::FTL::Output::div): Deleted.
+        (JSC::FTL::Output::chillDiv): Deleted.
+        (JSC::FTL::Output::mod): Deleted.
+        (JSC::FTL::Output::chillMod): Deleted.
+        (JSC::FTL::Output::doubleAdd): Deleted.
+        (JSC::FTL::Output::doubleSub): Deleted.
+        (JSC::FTL::Output::doubleMul): Deleted.
+        (JSC::FTL::Output::doubleDiv): Deleted.
+        (JSC::FTL::Output::doubleMod): Deleted.
+        (JSC::FTL::Output::bitAnd): Deleted.
+        (JSC::FTL::Output::bitOr): Deleted.
+        (JSC::FTL::Output::bitXor): Deleted.
+        (JSC::FTL::Output::shl): Deleted.
+        (JSC::FTL::Output::aShr): Deleted.
+        (JSC::FTL::Output::lShr): Deleted.
+        (JSC::FTL::Output::ctlz32): Deleted.
+        (JSC::FTL::Output::addWithOverflow32): Deleted.
+        (JSC::FTL::Output::subWithOverflow32): Deleted.
+        (JSC::FTL::Output::mulWithOverflow32): Deleted.
+        (JSC::FTL::Output::addWithOverflow64): Deleted.
+        (JSC::FTL::Output::subWithOverflow64): Deleted.
+        (JSC::FTL::Output::mulWithOverflow64): Deleted.
+        (JSC::FTL::Output::doubleAbs): Deleted.
+        (JSC::FTL::Output::doubleCeil): Deleted.
+        (JSC::FTL::Output::doubleFloor): Deleted.
+        (JSC::FTL::Output::doubleSin): Deleted.
+        (JSC::FTL::Output::doubleCos): Deleted.
+        (JSC::FTL::Output::doublePow): Deleted.
+        (JSC::FTL::Output::doubleSqrt): Deleted.
+        (JSC::FTL::Output::doubleLog): Deleted.
+        (JSC::FTL::Output::signExt32To64): Deleted.
+        (JSC::FTL::Output::zeroExt): Deleted.
+        (JSC::FTL::Output::intToDouble): Deleted.
+        (JSC::FTL::Output::castToInt32): Deleted.
+        (JSC::FTL::Output::doubleToFloat): Deleted.
+        (JSC::FTL::Output::floatToDouble): Deleted.
+        (JSC::FTL::Output::equal): Deleted.
+        (JSC::FTL::Output::notEqual): Deleted.
+        (JSC::FTL::Output::above): Deleted.
+        (JSC::FTL::Output::aboveOrEqual): Deleted.
+        (JSC::FTL::Output::below): Deleted.
+        (JSC::FTL::Output::belowOrEqual): Deleted.
+        (JSC::FTL::Output::greaterThan): Deleted.
+        (JSC::FTL::Output::greaterThanOrEqual): Deleted.
+        (JSC::FTL::Output::lessThan): Deleted.
+        (JSC::FTL::Output::lessThanOrEqual): Deleted.
+        (JSC::FTL::Output::doubleEqual): Deleted.
+        (JSC::FTL::Output::doubleEqualOrUnordered): Deleted.
+        (JSC::FTL::Output::doubleNotEqualOrUnordered): Deleted.
+        (JSC::FTL::Output::doubleLessThan): Deleted.
+        (JSC::FTL::Output::doubleLessThanOrEqual): Deleted.
+        (JSC::FTL::Output::doubleGreaterThan): Deleted.
+        (JSC::FTL::Output::doubleGreaterThanOrEqual): Deleted.
+        (JSC::FTL::Output::doubleNotEqualAndOrdered): Deleted.
+        (JSC::FTL::Output::doubleLessThanOrUnordered): Deleted.
+        (JSC::FTL::Output::doubleLessThanOrEqualOrUnordered): Deleted.
+        (JSC::FTL::Output::doubleGreaterThanOrUnordered): Deleted.
+        (JSC::FTL::Output::doubleGreaterThanOrEqualOrUnordered): Deleted.
+        (JSC::FTL::Output::isZero32): Deleted.
+        (JSC::FTL::Output::notZero32): Deleted.
+        (JSC::FTL::Output::isZero64): Deleted.
+        (JSC::FTL::Output::notZero64): Deleted.
+        (JSC::FTL::Output::select): Deleted.
+        (JSC::FTL::Output::extractValue): Deleted.
+        (JSC::FTL::Output::jump): Deleted.
+        (JSC::FTL::Output::ret): Deleted.
+        (JSC::FTL::Output::unreachable): Deleted.
+        (JSC::FTL::Output::speculate): Deleted.
+        (JSC::FTL::Output::speculateAdd): Deleted.
+        (JSC::FTL::Output::speculateSub): Deleted.
+        (JSC::FTL::Output::speculateMul): Deleted.
+        (JSC::FTL::Output::patchpoint): Deleted.
+        (JSC::FTL::Output::trap): Deleted.
+        (JSC::FTL::Output::anchor): Deleted.
+        (JSC::FTL::Output::bitCast): Deleted.
+        (JSC::FTL::Output::fround): Deleted.
+
+2016-06-13  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, Cloop build fix.
+
+        * bytecode/BytecodeList.json:
+
+2016-06-12  Keith Miller  <keith_miller@apple.com>
+
+        Add new builtin opcode tailCallForwardArguments
+        https://bugs.webkit.org/show_bug.cgi?id=158666
+
+        Reviewed by Filip Pizlo.
+
+        We should support the ability to have a builtin forward its
+        arguments to a helper without allocating an arguments object. This
+        patch adds a new bytecode intrinsic @tailCallForwardArguments that
+        takes two values. The first is the target of the call and the
+        second is the new this value. This opcode will tail call to the
+        passed function without triggering an allocation of an arguments
+        object for the caller function.
+
+        In the LLInt and Baseline this function acts the same way a normal
+        tail call does.  The bytecode will allocate a new stack frame
+        copying all the arguments of the caller function into the new
+        frame, along with the new this. Then when the actual call happens
+        the new frame is copied over the caller frame. While this is not
+        necessary, it allows the target function to have more arguments
+        than the caller function via arity fixup.
+
+        Once we get to the DFG we reuse existing DFG Nodes for forwarding
+        arguments, although there were some minor changes. This patch
+        swaps the meaning of the second and third children for each DFG
+        varargs node, exchanging the argmuments and this child,
+        respectively. It also makes the arguments child for each varargs
+        node, as well as the ForwardVarargs node optional. If the optional
+        child is missing, then forwarding node assumes that the arguments
+        for the node's inlineCallFrame should be used instead. Finally,
+        when inlining the target of an inlined
+        op_tail_call_forward_arguments we make sure the arguments of the
+        forwarding function are marked as non-unboxable since this would
+        normally be done by the caller's create arguments object node,
+        which does not exist in this case.
+
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CallLinkInfo.h:
+        (JSC::CallLinkInfo::callTypeFor):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finishCreation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCallForwardArgumentsInTailPosition):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_tailCallForwardArguments):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleVarargsCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArgumentsChild):
+        (JSC::DFG::Node::argumentsChild):
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileForwardVarargs):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeFrameForForwardArguments):
+        (JSC::setupForwardArgumentsFrame):
+        (JSC::setupForwardArgumentsFrameAndSetThis):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::JIT::emit_op_tail_call_forward_arguments):
+        (JSC::JIT::emitSlow_op_tail_call_forward_arguments):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emitSlow_op_tail_call_forward_arguments):
+        (JSC::JIT::emit_op_tail_call_forward_arguments):
+        (JSC::JIT::compileSetupVarargsFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::varargsSetup):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * tests/stress/tailCallForwardArguments.js: Added.
+        (putFuncToPrivateName.createBuiltin):
+        (putFuncToPrivateName):
+        (createTailCallForwardingFuncWith):
+        (baz):
+        (baz2):
+        (baz3):
+        (let.bodyText):
+        (baz4):
+        (baz5):
+        (arrayEq):
+
+2016-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, follow up patch for r201964
+        https://bugs.webkit.org/show_bug.cgi?id=158619
+
+        Fix typo in the comment.
+
+        * runtime/MathCommon.h:
+        (JSC::toInt32):
+
+2016-06-13  Mark Lam  <mark.lam@apple.com>
+
+        Add a mechanism for collecting LLINT stats.
+        https://bugs.webkit.org/show_bug.cgi?id=158668
+
+        Reviewed by Filip Pizlo.
+
+        This patch will add a mechanism for collecting the stats on LLINT opcode
+        execution counts.  The changes made to enable this are:
+
+        1. Refactored how Options availability work so that we can add a new category:
+           Configurable (in addition to the pre-existing Normal and Restricted
+           availability).
+               Normal options - always available.
+               Restricted options - only available on debug builds.
+               Configurable options - depends on #define flag options.
+
+           This change is necessary so that:
+           a. we won't have to rebuild the world when we want to enable that #define flag
+              to make that Configurable option available.
+           b. when the #define flag is disabled, the option will be invisible to the user.
+
+           With this, we add our first configurable option, JSC_reportLLIntStats, which
+           is dependent on the ENABLE_LLINT_STATS flag.  See next.
+
+        2. Added the ENABLE_LLINT_STATS flag in LLIntCommon.h.  To enable LLINT stats
+           collection, we'll need to set this flag to a non-zero value, and rebuilding
+           the project.  By design, this will only require a minimal set of files to
+           be rebuilt.
+
+           ENABLE_LLINT_STATS is 0 (i.e. disabled) by default.
+
+        3. Added a slow path callback to the LLINT's traceExecution() macro, to call
+           _llint_count_opcode(), which in turns counts the opcode.  This callback will
+           only be built into the LLINT if ENABLE_LLINT_STATS is non-zero.
+
+        4. Added s_opcodeStatsArray to LLInt::Data.  This is where the stats are
+           recorded and stored.
+
+        5. Added calls to LLInt::Data::dumpStats() in jsc.cpp and DumpRenderTree.mm
+           to dump the LLINT stats if enabled.  If enabled, the LLINT stats will be
+           sorted and dumped (via dataLog) before the programs terminate.
+
+        * interpreter/Interpreter.h:
+        * jsc.cpp:
+        (main):
+        * llint/LLIntCommon.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::initialize):
+        (JSC::LLInt::Data::dumpStats):
+        * llint/LLIntData.h:
+        (JSC::LLInt::Data::opcodeStats):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_crash):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/Options.cpp:
+        (JSC::parse):
+        (JSC::Options::isAvailable):
+        (JSC::overrideOptionWithHeuristic):
+        (JSC::scaleJITPolicy):
+        (JSC::Options::initialize):
+        (JSC::Options::setOptionWithoutAlias):
+        (JSC::Options::dumpAllOptions):
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+        (JSC::Option::Option):
+        (JSC::Option::operator!=):
+        (JSC::Option::id):
+
+2016-06-11  Mark Lam  <mark.lam@apple.com>
+
+        Minimize the amount of memcpy done for allocating Error stacks.
+        https://bugs.webkit.org/show_bug.cgi?id=158664
+
+        Reviewed by Darin Adler.
+
+        Currently, Vector<StackFrame> are being copied around multiple times in the
+        process of creating Error stacks.
+
+        This patch avoids this unnecessary copying by:
+        1. Sizing the StackFrame vector correctly to begin with, and skipping
+           undesirable top frames before filling in the vector.
+        2. Using perfect forwarding or passing by reference to pass the vector data around
+           instead of copying the vectors.
+        3. Changing the Exception object to take a Vector<StackFrame> instead of a
+           RefCountedArray<StackFrame>.
+
+        This patch has passed the JSC and layout tests.  Benchmarks show that perf is
+        neutral.
+
+        * API/tests/testapi.mm:
+        (testObjectiveCAPI):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStackFromException):
+        * interpreter/Interpreter.cpp:
+        (JSC::GetStackTraceFunctor::GetStackTraceFunctor):
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::Interpreter::stackTraceAsString):
+        (JSC::findExceptionHandler):
+        * interpreter/Interpreter.h:
+        * runtime/Error.cpp:
+        (JSC::addErrorInfoAndGetBytecodeOffset):
+        * runtime/Exception.cpp:
+        (JSC::Exception::finishCreation):
+        * runtime/Exception.h:
+        (JSC::Exception::valueOffset):
+        (JSC::Exception::value):
+        (JSC::Exception::stack):
+        (JSC::Exception::didNotifyInspectorOfThrow):
+        (JSC::Exception::setDidNotifyInspectorOfThrow):
+
+2016-06-11  Mark Lam  <mark.lam@apple.com>
+
+        Tests that overflows the stack should not be run with the sampling profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=158663
+
+        Reviewed by Saam Barati.
+
+        The sampling profiler will be sampling the whole stack, and the amount of memory
+        churn will make this tests time out, especially with debug builds.  Hence,
+        let's not run the test with the sampling profiler configuration.
+
+        * tests/stress/mutual-tail-call-no-stack-overflow.js:
+        (shouldThrow):
+
+2016-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, attempt to fix r201964 failure on Apple ports
+        https://bugs.webkit.org/show_bug.cgi?id=158619
+
+        Reviewed by Mark Lam.
+
+        Add Private attributes to MathCommon.h.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2016-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Inline JSC::toInt32 to improve kraken
+        https://bugs.webkit.org/show_bug.cgi?id=158619
+
+        Reviewed by Mark Lam.
+
+        Several kraken benchmarks show that JSC::toInt32 is frequently called.
+        For example, stanford-crypto-pbkdf2 reports that the hottest runtime function is JSC::toInt32.
+
+        The data is below (taken by Linux perf tools).
+        5.50%  jsc      libJavaScriptCore.so.1.0.0  [.] _ZN3JSC7toInt32Ed
+        3.96%  jsc      libJavaScriptCore.so.1.0.0  [.] _ZN3JSC20arrayProtoFuncConcatEPNS_9ExecStateE
+        2.48%  jsc      libJavaScriptCore.so.1.0.0  [.] _ZN3JSC19arrayProtoFuncSliceEPNS_9ExecStateE
+        1.69%  jsc      libJavaScriptCore.so.1.0.0  [.] _ZNK3JSC9Structure27holesMustForwardToPrototypeERNS_2VME
+
+        This is because of CommonSlowPaths' bit operations's JSValue::toInt32.
+        Due to the slow path, in `value | 0`, `value` may be a double number value. In that case, JSC::toInt32 is called.
+
+        While JSC::toIn32 is hot, the function itself is very small. It's worth inlining.
+
+        This change offers the following kraken improvements.
+
+                                                         baseline                  patched
+        Kraken:
+           audio-beat-detection                       47.492+-1.701             46.657+-1.232           might be 1.0179x faster
+           stanford-crypto-aes                        43.669+-0.210      ^      42.862+-0.115         ^ definitely 1.0188x faster
+           stanford-crypto-ccm                        45.213+-1.424             44.490+-1.290           might be 1.0162x faster
+           stanford-crypto-pbkdf2                    107.665+-0.581      ^     106.229+-0.807         ^ definitely 1.0135x faster
+
+        This patch only focused on the call to toInt32 from the runtime functions.
+        So JSC::toInt32 calls from the baseline / DFG remain.
+        We ensure that JIT code uses operationToInt32 instead of JSC::toInt32 since JSC::toInt32 is now marked as ALWAYS_INLINE.
+        Linux perf profiler also finds that this `operationToInt32` is frequently called in the above benchmarks.
+        It may be good to introduce asm emit for that instead of calling JSC::toInt32 operation in the separated patch.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::doubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::sensibleDoubleToInt32):
+        * runtime/JSCJSValue.cpp:
+        (JSC::toInt32): Deleted.
+        * runtime/JSCJSValueInlines.h:
+        * runtime/MathCommon.cpp:
+        (JSC::operationToInt32):
+        * runtime/MathCommon.h:
+        (JSC::toInt32):
+
+2016-06-10  Filip Pizlo  <fpizlo@apple.com>
+
+        The backend should be happy to compile Unreachable even if AI didn't prove it to be unreachable
+        https://bugs.webkit.org/show_bug.cgi?id=158631
+
+        Reviewed by Keith Miller.
+        
+        We've been slowly making the DFG Unreachable opcode behave like a grown-up. When we first
+        added it, it was a hack for Throw, and we could always rely on AI proving that Unreachable
+        was not reachable. But then we started using Unreachable as a proper Unreachable opcode,
+        like Oops in B3 for example, which has a more nuanced meaning: you use it whenever you
+        emit code that *you* know will not return, and you need some way of terminating the basic
+        block. The DFG is not a proof-carrying compiler, and it never will be. So, when you have
+        proved that something is not reachable, you should be able to use Unreachable even if
+        there is no guarantee that the compiler will later be able to replicate your proof. This
+        means that the backend may find itself compiling Unreachable because AI did not prove that
+        it was unreachable.
+        
+        Prior to this change, we would crash compiling Unreachable because we would rely on AI
+        preventing us from reaching Unreachable in the backend. But that's silly! We don't want
+        users of Unreachable to have to also convince AI that their Unreachable is really
+        Unreachable.
+        
+        This fixes crashes on real websites. I couldn't work out how to turn them into a reduced
+        test.
+
+        * assembler/AbortReason.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitInvalidationPoint):
+        (JSC::DFG::SpeculativeJIT::unreachable):
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutDynamicVar):
+        (JSC::FTL::DFG::LowerDFGToB3::compileUnreachable):
+        (JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
+
+2016-06-09  Alex Christensen  <achristensen@webkit.org>
+
+        Clean up JavaScriptCore.vcxproj directory after switching to CMake.
+
+        * JavaScriptCore.vcxproj/LLInt: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.make: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.pl: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/build-LLIntDesiredOffsets.pl: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.props: Removed.
+        * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Removed.
+        * JavaScriptCore.vcxproj/jsc: Removed.
+        * JavaScriptCore.vcxproj/jsc/DLLLauncherMain.cpp: Removed.
+        * JavaScriptCore.vcxproj/jsc/DLLLauncherWinCairo.props: Removed.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscCommon.props: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscDebug.props: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscLauncher.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscLauncherPostBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscLauncherPreBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscLauncherPreLink.cmd: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscPreBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscProduction.props: Removed.
+        * JavaScriptCore.vcxproj/jsc/jscRelease.props: Removed.
+        * JavaScriptCore.vcxproj/testRegExp: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncher.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncherPostBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncherPreBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpLauncherPreLink.cmd: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpProduction.props: Removed.
+        * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props: Removed.
+        * JavaScriptCore.vcxproj/testapi: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiCommon.props: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiDebug.props: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiDebugCFLite.props: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncher.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncherPostBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncherPreBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiLauncherPreLink.cmd: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiPostBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiProduction.props: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiRelease.props: Removed.
+        * JavaScriptCore.vcxproj/testapi/testapiReleaseCFLite.props: Removed.
+        * shell/DLLLauncherMain.cpp: Copied from JavaScriptCore.vcxproj/jsc/DLLLauncherMain.cpp.
+        * shell/PlatformWin.cmake:
+
+2016-06-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Rare failure in stress/v8-deltablue-strict.js.ftl-eager
+        https://bugs.webkit.org/show_bug.cgi?id=158591
+
+        Reviewed by Saam Barati.
+        
+        This is a simple and sensible fix to an amazing compiler bug that previously only
+        manifested rarely in the v8-deltablue-strict test. It required on average 1000 runs while
+        the system was under load for the bug to manifest. Fortunately, the bug is 100% repro with
+        concurrent JIT disabled in the new "constant-fold-multi-get-by-offset-to-get-by-offset-on-
+        prototype-and-sink-allocation.js" test.
+        
+        The problem here is that we were allowing ourselves to be super sloppy with the meaning of
+        the two children of GetByOffset, and to a lesser extent, PutByOffset. The first two
+        children of these nodes have these meanings:
+        
+        child1: the storage from which to load (or to which to store)
+        child2: the logical object base
+        
+        Normally, child1 == child2, but child1 may point to a node that vends the storage pointer
+        in case we are using multiple indirections to get to the property. That's fairly common.
+        
+        Where this gets nutty is that we don't validate the behavior of child1. Previously, the
+        DFG::Validate phase would accept code that had child1 point to one object and child2 point
+        to another object. That's bad because then, analyses will assume that we're loading from
+        one object while we are actually loading from another. One of the fixes is to make
+        Validate smarter about this, so that future problems with this get caught sooner.
+        
+        The actual bug was in ConstantFoldingPhase. When we first wrote ConstantFoldingPhase's
+        logic for converting GetByIds and MultiGetByOffsets to GetByOffset, we assumed that this
+        was only for non-prototype loads. This was becuase the logic was originally written based
+        on a static GetByIdStatus analysis, which does not handle prototypes. So, as a shortcut,
+        we would convert the GetById (or MultiGetByOffset) to a GetByOffset by doing this
+        shuffling of children:
+        
+        child1 got the storage pointer, which might be a new GetButterfly node that we created.
+        child2 got the old value of child1.
+        
+        The bug was introduced when I later made it possible for a monomorphic prototype
+        MultiGetByOffset to be converted to a GetByOffset. Then this algorithm would mean that:
+        
+        child1 got either a pointer to the prototype or a storage pointer derived from the
+            prototype.
+        child2 got the old value of child1, which was a pointer to the base object (i.e. not the
+            prototype).
+        
+        This happens super rarely because most prototype loads that we can statically reason about
+        also happen to load constants, so we don't convert to GetByOffset at all. You need the
+        strange combination of a MultiGetByOffset (not GetById or GetByOffset) on some prototypes
+        and some static reasoning about the base so that we can convert it to a GetByOffset, but
+        not enough static reasoning that we can convert it to a constant.
+        
+        Even if the bad thing happened, then this is not enough for it to cause symptons. If we
+        did nothing else - like none of the other optimizations succeeded - then this would
+        be OK because the backend will emit code based on child1, which is right. But disaster
+        strikes when the code otherwise looks sane enough for ObjectAllocationSinkingPhase to kick
+        in. This phase operates on child2, as any good phase should: child1 is only interesting
+        for knowing *how* to load, not *what* we are loading. The phase is right to ignore child1.
+
+        So the phase would assume that we are loading the prototype property ("f" in the new test
+        or "addToGraph" in deltablue) from the sunken base object allocation in the inlined
+        constructor. The base object has no such property, but the phase conservatively assumes
+        that it does indeed have such a property. That's just how the phase does things: it is
+        very abstract and general, so it assumes that the set of properties on an allocation is
+        the set of properties that accesses to the allocation speak of. Clearly, this GetByOffset
+        was speaking of the property as being on the allocation. When sinking completed, it would
+        convert the GetByOffset to the sunken (a.k.a. promoted) property. But nobody stored to
+        this property on the allocation, so we'd get the bottom value, which is 1927. Why 1927? I
+        don't remember anymore, but apparently I chose it. It helped here - when I started seeing
+        that value come up, it took a quick grep to realize that this was the object allocation
+        sinking phase's bottom value.
+        
+        The real fix to the bug is to make Node::convertToGetByOffset() take an explicit new base
+        since its clients will use it to potentially create a load on a different object than the
+        base of the original operation, as in the relatively new
+        MultiGetByOffset(prototype)->GetByOffset optimization. As far as I know, the PutByOffset
+        code did not have the same bug because we don't have any optimizations that turn a PutById
+        or MultiPutByOffset into a PutByOffset on anything but the base object. But the logical
+        bug is definitely there: there's code in ConstantFoldingPhase that claims to be able to
+        convert any node to a PutByOffset on any base, but it actually silently reuses the
+        original node's child1 as the logical base (i.e. child2). This patch makes all of this
+        stuff explicit. You can't make this mistake anymore.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToGetStack):
+        (JSC::DFG::Node::convertToGetByOffset):
+        (JSC::DFG::Node::convertToMultiGetByOffset):
+        (JSC::DFG::Node::convertToPutByOffset):
+        * dfg/DFGValidate.cpp:
+        * tests/stress/constant-fold-multi-get-by-offset-to-get-by-offset-on-prototype-and-sink-allocation.js: Added.
+        (ThingA):
+        (ThingB):
+        (foo):
+        (bar):
+        * tests/stress/sink-to-impossible-multi-get-by-offset-on-prototypes.js: Added.
+        (ThingA):
+        (ThingB):
+        (ThingC):
+        (bar):
+        (foo):
+
+2016-06-09  Mark Lam  <mark.lam@apple.com>
+
+        Make some methods const.
+        https://bugs.webkit.org/show_bug.cgi?id=158594
+
+        Reviewed by Benjamin Poulain.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::columnNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        * bytecode/ExpressionRangeInfo.h:
+        (JSC::ExpressionRangeInfo::encodeFatColumnMode):
+        (JSC::ExpressionRangeInfo::decodeFatLineMode):
+        (JSC::ExpressionRangeInfo::decodeFatColumnMode):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::lineNumberForBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::getLineAndColumn):
+        (JSC::UnlinkedCodeBlock::expressionRangeForBytecodeOffset):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::createRareDataIfNecessary):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::isOpcode):
+        (JSC::StackFrame::computeLineAndColumn):
+        (JSC::StackFrame::toString):
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::isNative):
+
+2016-06-09  Michael Saboff  <msaboff@apple.com>
+
+        ES6: Reusing function name as a parameter name shouldn't throw Syntax Error
+        https://bugs.webkit.org/show_bug.cgi?id=158575
+
+        Reviewed by Benjamin Poulain.
+
+        The check for a parameter with a duplicate name doesn't take into account the
+        type of the prior variable.  Added a check that the duplicate is also a
+        parameter.
+
+        See the relevant spec section at:
+        http://www.ecma-international.org/ecma-262/6.0/#sec-function-definitions-static-semantics-early-errors
+
+        * parser/Parser.h:
+        (JSC::Scope::declareParameter):
+
+2016-06-09  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r201836, r201845, and r201848.
+
+        Looks like a 1-2% PLT regression on iOS
+
+        Reverted changesets:
+
+        "[JSC] Change some parameters based on a random search"
+        https://bugs.webkit.org/show_bug.cgi?id=158514
+        http://trac.webkit.org/changeset/201836
+
+        "Tempory fix for the debug bots"
+        http://trac.webkit.org/changeset/201845
+
+        "Change thresholdForOptimizeSoon to match
+        thresholdForOptimizeAfterWarmUp"
+        http://trac.webkit.org/changeset/201848
+
+2016-06-09  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r201810.
+        https://bugs.webkit.org/show_bug.cgi?id=158563
+
+        breaks build without ENABLE_WEB_ANIMATION (Requested by
+        mcatanzaro on #webkit).
+
+        Reverted changeset:
+
+        "[web-animations] Add Animatable, AnimationEffect,
+        KeyframeEffect and Animation interface"
+        https://bugs.webkit.org/show_bug.cgi?id=156096
+        http://trac.webkit.org/changeset/201810
+
+2016-06-08  Gavin & Ellie Barraclough  <barraclough@apple.com>
+
+        JSObject::reifyAllStaticProperties cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=158543
+
+        Reviewed by Mark Lam.
+
+        - JSObject & Structure contain fields labeled 'staticFunctionsReified', however reification now
+          affects all properties, not just functions. Rename to 'staticPropertiesReified'.
+        - reifyAllStaticProperties relies on a 'hasStaticProperties' method on ClassInfo that walks the
+          ClassInfo inheritance chain looking for static property tables. We can now more efficiently
+          get this information from TypeInfo.
+        - reifyAllStaticProperties triggers a 'toUncacheableDictionaryTransition'; this is overzealous,
+          cacheable dictionary is sufficient - this is what we do in the case of DOM prototype property
+          reification (see 'reifyStaticProperties' in Lookup.h). (Changing this with an eye on switching
+          DOM prototype property reification to use JSObject:: reifyAllStaticProperties, rather than
+          having its own special purpose code path.)
+
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::hasStaticProperties): Deleted.
+            - deprecated by TypeInfo::hasStaticPropertyTable.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+            - staticFunctionsReified -> staticPropertiesReified
+        (JSC::JSObject::reifyAllStaticProperties):
+            - hasStaticProperties -> TypeInfo::hasStaticPropertyTable
+            - toUncacheableDictionaryTransition -> toCacheableDictionaryTransition
+            - staticFunctionsReified -> staticPropertiesReified
+        * runtime/JSObject.h:
+        (JSC::JSObject::staticPropertiesReified):
+        (JSC::JSObject::staticFunctionsReified): Deleted.
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlotFromTable):
+        (JSC::replaceStaticPropertySlot):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        * runtime/Structure.h:
+            - staticFunctionsReified -> staticPropertiesReified
+
+2016-06-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Change thresholdForOptimizeSoon to match thresholdForOptimizeAfterWarmUp
+
+        Unreviewed.
+
+        This adds back the assertion removed in r201845.
+        Making those threshold equal is completely perf neutral
+        (on Haswell rMBP with 20 runs).
+
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+
+2016-06-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Tempory fix for the debug bots
+
+        Unreviewed.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        Weaken an assertion while I test values for thresholdForOptimizeSoon.
+
+2016-06-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Change some parameters based on a random search
+        https://bugs.webkit.org/show_bug.cgi?id=158514
+
+        Reviewed by Filip Pizlo.
+
+        Over the weekend, I left an iMac running the JSC benchmarks
+        while changing a bunch of parameters.
+
+        The parameters were changed randomly, with a random deviation
+        from the original value.
+        To converge toward good values, the range was subject
+        to exponential annealing over time.
+
+        The values in this patch is the best outcome my iMac could
+        find over the weekend. It is about 1% better on the Haswell
+        machines I tested.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::optimizationThresholdScalingFactor):
+        * runtime/Options.h:
+
+2016-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove removeDirect
+        https://bugs.webkit.org/show_bug.cgi?id=158516
+
+        Reviewed by Ryosuke Niwa.
+
+        removeDirect is typically used as a subroutine of deleteProperty, but is also available to
+        call directly. Having this functionality factored out to a separate routine is a bad idea
+        on a couple of fronts:
+
+        - for the main use within deleteProperty there is redundancy (presence of the property
+          was being checked twice) and inconsistency (the two functions returned different results
+          in the case of a nonexistent property; the result from removeDirect was never observed).
+
+        - all uses of removeDirect are in practical terms incorrect. removeDirect had the
+          advantage of ignoring the configurable (DontDelete) attributes, but this is achievable
+          using the DeletePropertyMode setting - and the disadvantage of failing delete static
+          table properties. Last uses were one that was removed in bug #158295 (where failure to
+          delete static properties was a problem), and as addressed in this patch removeDirect is
+          being used to implement runtime enabled features. This only works because we currently
+          force reification of all properties on the DOM prototype objects, so in effect there are
+          no static properties. In order to make the code robust such that runtime enabled
+          features would still work even if we were not reifying static properties (a change we
+          may want to make) we should be calling deleteProperty in this case too.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+            - incorporated removeDirect functionality, added comments & ASSERT.
+        (JSC::JSObject::removeDirect): Deleted.
+            - removed.
+        * runtime/JSObject.h:
+            - removed removeDirect.
+
+2016-06-08  Mark Lam  <mark.lam@apple.com>
+
+        Simplify Interpreter::StackFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=158498
+
+        Reviewed by Saam Barati.
+
+        Previously, Interpreter::StackFrame (which is used to capture info for
+        Error.stack) eagerly extracts info out of CodeBlock and duplicates the work that
+        CodeBlock does to compute line and column numbers (amongst other things).
+
+        This patch does away with the eager extraction and only stashes the CodeBlock
+        pointer in the Interpreter::StackFrame.  Instead, Interpreter::StackFrame will
+        provide methods for computing the desired values on request later.
+
+        One difference in implementation: the old StackFrame offers a sourceURL and a
+        friendlySourceURL().  The only difference between the 2 is that for native
+        functions, sourceURL returns an empty string, and friendlySourceURL() returns
+        "[native code]".  This is how it affects the clients of StackFrame:
+
+            - In the old code, the Error object's addErrorInfoAndGetBytecodeOffset() and
+              the inspector's createScriptCallStackFromException() would check if
+              sourceURL is empty.  If so, they will use this as an indicator to use
+              alternate source info in the Error object e.g. url and line numbers from
+              the parser that produced a SyntaxError.
+
+            - In the new implementation, StackFrame only has a sourceURL() function that
+              behaves like the old friendlySourceURL().  The client code which were
+              relying on sourceURL being empty, will now explicitly check if the
+              StackFrame is for native code using a new isNative() query in addition to
+              the sourceURL being empty.  This achieve functional parity with the old
+              behavior.
+
+        Also fix Error.cpp's addErrorInfoAndGetBytecodeOffset() to take a bytecodeOffset
+        pointer instead of a reference.  The bytecodeOffset arg is supposed to be
+        optional, but was implemented in a unclear way.  This change clarifies it.
+
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStackFromException):
+        * interpreter/Interpreter.cpp:
+        (JSC::StackFrame::sourceID):
+        (JSC::StackFrame::sourceURL):
+        (JSC::StackFrame::functionName):
+        (JSC::eval):
+        (JSC::Interpreter::isOpcode):
+        (JSC::StackFrame::computeLineAndColumn):
+        (JSC::StackFrame::toString):
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::StackFrame::friendlySourceURL): Deleted.
+        (JSC::StackFrame::friendlyFunctionName): Deleted.
+        (JSC::getStackFrameCodeType): Deleted.
+        (JSC::StackFrame::expressionInfo): Deleted.
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::isNative):
+        * runtime/Error.cpp:
+        (JSC::addErrorInfoAndGetBytecodeOffset):
+        (JSC::addErrorInfo):
+        * runtime/Error.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finishCreation):
+
+2016-06-08  Keith Miller  <keith_miller@apple.com>
+
+        We should be able to lookup symbols by identifier in builtins
+        https://bugs.webkit.org/show_bug.cgi?id=158530
+
+        Reviewed by Mark Lam.
+
+        This patch allows us to lookup the value of a symbol property on a
+        object by identifier in builtins. Before, it was only possible to
+        do so if we were directly emitting the bytecodes, such as in a
+        for-of loop looking for Symbol.iterator. As we tier up we convert
+        the builtin's get_by_val symbol lookups into get_by_id
+        lookups. However, there is still a significant performance
+        difference between get_by_id and get_by_val in the LLInt, where
+        this transformation does not take place.
+
+        In order to make this work we hijack BuiltinNames'
+        m_publicToPrivateMap so that it points the @<symbol>Symbol to the
+        appropriate vm symbol. This way when we lex the identifier it will
+        become the appropriate symbol's identifier.  Currently, if the
+        symbol is used to name a property in an object literal we will not
+        keep a cache of the Symbol objects we have already seen. We could
+        add a map for symbols but since we can only load symbols by
+        identifier in builtins its likely not worth it. Additionally, even
+        in builtins it is extremely rare to use Symbols in object
+        literals.
+
+        * builtins/ArrayConstructor.js:
+        (from):
+        * builtins/ArrayPrototype.js:
+        (filter):
+        (map):
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::BuiltinNames):
+        * builtins/BuiltinUtils.h:
+        * builtins/GlobalObject.js:
+        (speciesConstructor):
+        * builtins/StringPrototype.js:
+        (match):
+        (intrinsic.StringPrototypeReplaceIntrinsic.replace):
+        (search):
+        (split):
+        * builtins/TypedArrayConstructor.js:
+        (from):
+        * builtins/TypedArrayPrototype.js:
+        (map):
+        (filter):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry): Deleted.
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+
+2016-06-08  Rawinder Singh  <rawinder.singh-webkit@cisra.canon.com.au>
+
+        [web-animations] Add Animatable, AnimationEffect, KeyframeEffect and Animation interface
+        https://bugs.webkit.org/show_bug.cgi?id=156096
+
+        Reviewed by Dean Jackson.
+
+        Adds:
+        - Animatable interface and implementation of getAnimations in Element
+        - Interface and implementation for Document getAnimations method.
+        - AnimationEffect interface and class stub.
+        - KeyframeEffect interface and constructor implementation.
+        - 'Animation' interface, constructor and query methods for effect and timeline.
+        - Remove runtime condition on Web animation interfaces (compile time flag is specified).
+
+        * runtime/CommonIdentifiers.h:
+
+2016-06-08  Chris Dumez  <cdumez@apple.com>
+
+        self.hasOwnProperty() does not work inside Web workers
+        https://bugs.webkit.org/show_bug.cgi?id=158446
+        <rdar://problem/26638397>
+
+        Reviewed by Geoffrey Garen.
+
+        Add a factory function to JSProxy to create a JSProxy without a target.
+        Also make the setTarget() method public so that the target can now be
+        set after creation. This is needed so that we can create a proxy for
+        JSWorkerGlobalScope, then create the JSWorkerGlobalScope object,
+        passing it the proxy and finally set the target on the proxy.
+
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::create):
+
+2016-06-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Add result validation to JSAir
+        https://bugs.webkit.org/show_bug.cgi?id=158493
+
+        Reviewed by Saam Barati.
+        
+        Add a ::jsHash() method to some things, to compute a hash code that is suitable for
+        comparing a C++ Code to a JSAir Code. This is different from existing hashing functionality
+        because it errs on the side of easy reproducibility from JS rather than speed.
+
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::isCompatibleType):
+        (JSC::B3::Air::Arg::jsHash):
+        (JSC::B3::Air::Arg::dump):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::asDoubleCondition):
+        (JSC::B3::Air::Arg::isInvertible):
+        (JSC::B3::Air::Arg::isUnsignedCond):
+        (JSC::B3::Air::Arg::Arg):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::addFastTmp):
+        (JSC::B3::Air::Code::jsHash):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::lastPhaseName):
+        * b3/air/AirDumpAsJS.cpp:
+        (JSC::B3::Air::dumpAsJS):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        * b3/air/AirInst.cpp:
+        (JSC::B3::Air::Inst::hasArgEffects):
+        (JSC::B3::Air::Inst::jsHash):
+        (JSC::B3::Air::Inst::dump):
+        * b3/air/AirInst.h:
+        * b3/air/AirStackSlot.cpp:
+        (JSC::B3::Air::StackSlot::setOffsetFromFP):
+        (JSC::B3::Air::StackSlot::jsHash):
+        (JSC::B3::Air::StackSlot::dump):
+        * b3/air/AirStackSlot.h:
+        * b3/air/opcode_generator.rb:
+
+2016-06-07  Mark Lam  <mark.lam@apple.com>
+
+        Need an exception check after constructEmptyArray().
+        https://bugs.webkit.org/show_bug.cgi?id=158411
+
+        Reviewed by Saam Barati.
+
+        Added an exception check after each call to constructEmptyArray().
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        (Inspector::JSInjectedScriptHost::weakMapEntries):
+        (Inspector::JSInjectedScriptHost::weakSetEntries):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::functionsOnStack):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::addSequenceProperties):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::toJS):
+        * profiler/ProfilerOSRExitSite.cpp:
+        (JSC::Profiler::OSRExitSite::toJS):
+        * profiler/ProfilerOriginStack.cpp:
+        (JSC::Profiler::OriginStack::toJS):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::parse):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::moduleLoaderObjectRequestedModules):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ownPropertyKeys):
+        * runtime/RegExpObject.cpp:
+        (JSC::collectMatches):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplitFast):
+        * runtime/TemplateRegistry.cpp:
+        (JSC::TemplateRegistry::getTemplateObject):
+
+        * tests/stress/regress-158411.js: Added.
+
+2016-06-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Implement Air::allocateStack() in ES6 to see how much of a bad idea that is
+        https://bugs.webkit.org/show_bug.cgi?id=158318
+
+        Reviewed by Saam Barati.
+        
+        Most of these changes are to support dumpAsJS(). But I also found some duplicate and dead
+        code while rewriting it to JS.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/air/AirAllocateStack.cpp:
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isSomeImm):
+        (JSC::B3::Air::Arg::isAddr):
+        (JSC::B3::Air::Arg::tmpIndex):
+        (JSC::B3::Air::Arg::isValidImmForm):
+        (JSC::B3::Air::Arg::withOffset): Deleted. This was dead code.
+        * b3/air/AirArgInlines.h: It turns out that Inst has a ForEach thing that duplicated some of the logic of ArgThingHelper, so I just made ArgThingHelper more powerful.
+        (JSC::B3::Air::ArgThingHelper<Arg>::forEach):
+        (JSC::B3::Air::ArgThingHelper<Reg>::is):
+        (JSC::B3::Air::ArgThingHelper<Reg>::as):
+        (JSC::B3::Air::ArgThingHelper<Reg>::forEachFast):
+        (JSC::B3::Air::ArgThingHelper<Reg>::forEach):
+        (JSC::B3::Air::Arg::is):
+        * b3/air/AirDumpAsJS.cpp: Added.
+        (JSC::B3::Air::dumpAsJS):
+        * b3/air/AirDumpAsJS.h: Added.
+        * b3/air/AirFixObviousSpills.cpp:
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::forEach):
+        (JSC::B3::Air::Inst::extraClobberedRegs):
+        (JSC::B3::Air::ForEach<Tmp>::forEach): Deleted. This was doing what ArgThingHelper would have done but not as well.
+        (JSC::B3::Air::ForEach<Arg>::forEach): Deleted.
+        (JSC::B3::Air::ForEach<Reg>::forEach): Deleted.
+        * b3/air/AirLogRegisterPressure.cpp:
+        * b3/air/AirReportUsedRegisters.cpp:
+        * b3/air/AirSpillEverything.cpp:
+        * b3/air/opcode_generator.rb: Make this dump opcode.js, which is like what it dumps for C++.
+        * jit/Reg.cpp:
+        (JSC::Reg::debugName):
+        (JSC::Reg::dump):
+        * jit/Reg.h:
+        (JSC::Reg::hash):
+        * jsc.cpp: Fix jsc so that it reports the filename and line number of parser errors.
+        (dumpException):
+        * parser/ParserError.h: Make it easier to debug this code.
+        (WTF::printInternal):
+        * runtime/Options.h:
+
+2016-06-07  Keith Rollin  <krollin@apple.com>
+
+        Remove all uses of PassRefPtr in WTF
+        https://bugs.webkit.org/show_bug.cgi?id=157596
+        <rdar://problem/26234391>
+
+        Reviewed by Chris Dumez.
+
+        Update calls to interfaces that no longer take or return PassRefPtrs.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRope):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::jsSubstring):
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::replaceUsingStringSearch):
+        (JSC::repeatCharacter):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncLink):
+        (JSC::normalize):
+
+2016-06-07  Saam barati  <sbarati@apple.com>
+
+        InvalidationPointInjectionPhase creates bogus InvalidationPoints that may even be inserted when it's not OK to exit
+        https://bugs.webkit.org/show_bug.cgi?id=158499
+        <rdar://problem/26647473>
+
+        Reviewed by Mark Lam and Benjamin Poulain.
+
+        InvalidationPointInjectionPhase forgot to clear m_originThatHadFire 
+        before analyzing the current block it's analyzing. This meant that
+        the phase allowed a residual m_originThatHadFire that was set from the
+        previous block to effect a completely unrelated block. This is usually
+        harmless, but sometimes we would insert an InvalidationPoint at a point
+        in the graph when exiting is invalid. This would cause a crash.
+
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        (JSC::DFG::InvalidationPointInjectionPhase::run):
+        * tests/stress/dont-crash-on-bad-invalidation-point.js: Added.
+        (dontCrash):
+
+2016-06-07  Saam Barati  <sbarati@apple.com>
+
+        operationProcessTypeProfilerLogDFG doesn't update topCallFrame
+        https://bugs.webkit.org/show_bug.cgi?id=158428
+        <rdar://problem/26571493>
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGOperations.cpp:
+
+2016-06-07  Mark Lam  <mark.lam@apple.com>
+
+        calculatedDisplayName() and friends actually need a VM& and not a ExecState/CallFrame.
+        https://bugs.webkit.org/show_bug.cgi?id=158488
+
+        Reviewed by Geoffrey Garen.
+
+        calculatedDisplayName() (and some of its friends) actually just need a VM&.
+        Their work has nothing to do with an ExecState at all.  This patch will make that
+        clear by changing these functions to take a VM& arg instead of an ExecState* or
+        CallFrame*.
+
+        Also removed the JS_EXPORT_PRIVATE attribute from Interpreter::StackFrame::toString().
+        The JS_EXPORT_PRIVATE attribute was a holdover from the days when WebInspector
+        was entirely in WebCore.  It is no longer needed.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::functionDetails):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStackFromException):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::friendlyFunctionName):
+        * interpreter/Interpreter.cpp:
+        (JSC::StackFrame::friendlySourceURL):
+        (JSC::StackFrame::friendlyFunctionName):
+        (JSC::StackFrame::expressionInfo):
+        (JSC::StackFrame::toString):
+        (JSC::Interpreter::stackTraceAsString):
+        * interpreter/Interpreter.h:
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::functionName):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::getCallData):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        (JSC::JSFunction::calculatedDisplayName):
+        (JSC::JSFunction::getConstructData):
+        (JSC::getCalculatedDisplayName):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::executable):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+
+2016-06-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Do not allocate unnecessary UTF-8 string for encodeXXX functions
+        https://bugs.webkit.org/show_bug.cgi?id=158416
+
+        Reviewed by Darin Adler and Geoffrey Garen.
+
+        Previously, encodeXXX functions first allocate new UTF-8 string, and generate (& allocate) the results from this UTF-8 string.
+        It is costly since this UTF-8 string is always wasted. In this patch, we generate the results without this UTF-8 string.
+        We precisely implement ECMA262's Encode abstract operation[1].
+
+        This optimized encodeXXX functions provide great improvement in kraken stanford-crypto-sha256-iterative since it frequently calls
+        these functions. We can see 6 - 7% improvements.
+
+                                                      baseline                  patched
+
+        stanford-crypto-sha256-iterative           37.952+-0.155      ^      35.484+-0.265         ^ definitely 1.0695x faster
+
+
+        [1]: https://tc39.github.io/ecma262/#sec-encode
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::toSafeView):
+        Use this helper function to retrieve JSString::SafeView.
+
+        (JSC::makeCharacterBitmap):
+        (JSC::encode):
+        In encode, we reserve N length buffer at first. This is important when the length of the given string is long enough,
+        preventing frequent unnecessary buffer reallocations. This reserving contributes to 1% kraken stanford-crypto-sha256-iterative progression.
+
+        (JSC::decode):
+        Previously, Bitmap accidentally includes \0. And instead of removing this \0, we checked character != 0.
+        This patch fixes it for the Bitmap not to include \0.
+
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * tests/stress/encode-decode-ascii.js: Added.
+        (shouldBe):
+        * tests/stress/encode-decode-unicode.js: Added.
+        (shouldBe):
+        (isLowSurrogate):
+        (isHighSurrogate):
+        (isSurrogate):
+        * tests/stress/encode-decode-uri-component-surrogates.js: Added.
+        (shouldBe):
+        (toHighSurrogate):
+        (toLowSurrogate):
+        * tests/stress/encode-decode-uri-surrogates.js: Added.
+        (shouldBe):
+        (toHighSurrogate):
+        (toLowSurrogate):
+        * tests/stress/encode-decode-zero.js: Added.
+        (shouldBe):
+        * tests/stress/escape-unescape-surrogates.js: Added.
+        (shouldBe):
+        (toHighSurrogate):
+        (toLowSurrogate):
+
+2016-06-07  Ting-Wei Lan  <lantw44@gmail.com>
+
+        [GTK] Include locale.h before using LC_ALL
+        https://bugs.webkit.org/show_bug.cgi?id=158470
+
+        Reviewed by Darin Adler.
+
+        * jsc.cpp:
+
+2016-06-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unskip generator related stress tests
+        https://bugs.webkit.org/show_bug.cgi?id=158461
+
+        Reviewed by Darin Adler.
+
+        * tests/stress/generator-methods.js:
+        * tests/stress/generator-syntax.js:
+        * tests/stress/yield-and-line-terminator.js:
+        * tests/stress/yield-label-generator.js:
+        * tests/stress/yield-named-accessors-generator.js:
+        * tests/stress/yield-named-variable-generator.js:
+        * tests/stress/yield-out-of-generator.js:
+
+2016-06-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix typo in test name trailing-comma-in-function-paramters.js
+        https://bugs.webkit.org/show_bug.cgi?id=158462
+
+        Reviewed by Mark Lam.
+
+        * tests/stress/trailing-comma-in-function-parameters.js: Renamed from Source/JavaScriptCore/tests/stress/trailing-comma-in-function-paramters.js.
+
+2016-06-06  Andreas Kling  <akling@apple.com>
+
+        REGRESSION(r197595): 2% JSBench regression on iPhone 5.
+        <https://webkit.org/b/158459>
+
+        Unreviewed rollout.
+
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllRegExpCode): Deleted.
+        * runtime/VM.h:
+
+2016-06-06  Michael Saboff  <msaboff@apple.com>
+
+        octal and binary parsing is wrong for some programs
+        https://bugs.webkit.org/show_bug.cgi?id=158437
+
+        Reviewed by Saam Barati.
+
+        When there is an error parsing an binary or octal literal, we need to clear the returnValue
+        of any residual value.  This is because the processing of returnValue happens before the
+        syntax check for the extra character.  Without clearing returnValue, we end trying to
+        categorize the value as an INTEGER or DOUBLE token.  If the value happens to be an
+        impure NaN, we ASSERT.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::parseBinary):
+        (JSC::Lexer<T>::parseOctal):
+        * tests/stress/regress-158437.js: New test.
+
+2016-06-06  Mark Lam  <mark.lam@apple.com>
+
+        32-bit JSC stress test failing: stress/recursive-try-catch.js.ftl-no-cjit-validate-sampling-profiler
+        https://bugs.webkit.org/show_bug.cgi?id=158362
+
+        Reviewed by Michael Saboff.
+
+        The test does infinite recursion until it overflows the stack.  That means the
+        sampling profiler will have to capture excessively large samples, which in turn
+        makes it run very slowly.  This is what causes the test time out.
+
+        The fix is to not run the test with the sampling profiler.
+
+        * tests/stress/recursive-try-catch.js:
+
+2016-06-06  Andreas Kling  <akling@apple.com>
+
+        Don't reportAbandonedObjectGraph() after throwing out linked code or RegExps.
+        <https://webkit.org/b/158444>
+
+        Unreviewed.
+
+        This is a speculative change for iOS performance bots. The calls to reportAbandonedObjectGraph
+        were basically redundant, since mainframe navigation will cause GC acceleration anyway via
+        ScriptController.
+
+        This appears successful at recovering the ~0.7% regression I could reproduce locally on newer
+        hardware but it's a bit too noisy to say for sure.
+
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllLinkedCode):
+        (JSC::VM::deleteAllRegExpCode):
+
+2016-06-06  Skachkov Oleksandr  <gskachkov@gmail.com>
+        [ESNext] Trailing commas in function parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=158020
+
+        Reviewed by Keith Miller.
+
+        ESNext allow to add trailing commas in function parameters and function arguments.
+        Link to spec - https://jeffmo.github.io/es-trailing-function-commas 
+        Example of using - (function (a, b,) { return a + b; })(1,2,);
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseArguments):
+        * tests/stress/trailing-comma-in-function-paramters.js: Added.
+
+2016-06-05  Gavin & Ellie Barraclough  <barraclough@apple.com>
+
+        Deprecate remaining uses of Lookup getStatic*, use HasStaticPropertyTable instead.
+        https://bugs.webkit.org/show_bug.cgi?id=158178
+
+        Reviewed by Darin Adler.
+
+        As of bug #158059 most JSC static table property access no longer requires getOwnPropertySlot to be
+        overridden. Port remaining calls to the getStatic* functions in Lookup.h over to the new mechanism.
+
+        Deprecate getStatic* functions in Lookup.h
+
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot): Deleted.
+        (JSC::getStaticFunctionSlot): Deleted.
+        (JSC::getStaticValueSlot): Deleted.
+            - No longer required. Static table access now via JSObject.
+
+2016-06-06  Guillaume Emont  <guijemont@igalia.com>
+
+        [jsc][mips] Implement absDouble()
+        https://bugs.webkit.org/show_bug.cgi?id=158206
+
+        Reviewed by Mark Lam.
+
+        Implement absDouble() for MIPS. This is needed because Math.pow() uses
+        it since r200208.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::absd):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::absDouble):
+
+2016-06-03  Oliver Hunt  <oliver@apple.com>
+
+        RegExp unicode parsing reads an extra character before failing
+        https://bugs.webkit.org/show_bug.cgi?id=158376
+
+        Reviewed by Saam Barati.
+
+        This was a probably harmless bug, but keeps triggering assertions
+        for me locally. Essentially we'd see a parse error, set the error
+        type, but then carry on parsing. In debug builds this asserts, in
+        release builds you are pretty safe unless you're exceptionally
+        unlucky with where the error occurs.
+
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::parseEscape):
+
+2016-06-06  Guillaume Emont  <guijemont@igalia.com>
+
+        [jsc][mips] fix JIT::emit_op_log_shadow_chicken_prologue/_tail
+        https://bugs.webkit.org/show_bug.cgi?id=158209
+
+        Reviewed by Mark Lam.
+
+        On MIPS, changes GPRInfo::nonArgGPR0 to be regT4 instead of regT0,
+        since the code of JIT::emit_op_log_shadow_chicken_prologue/_tail()
+        expects nonArgGPR0 to be a different register from regT0 and regT2.
+
+        * jit/GPRInfo.h:
+
+2016-06-06  Chris Dumez  <cdumez@apple.com>
+
+        Crash under JSObject::getOwnPropertyDescriptor()
+        https://bugs.webkit.org/show_bug.cgi?id=158382
+        <rdar://problem/26605004>
+
+        Reviewed by Mark Lam.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        We were crashing under getOwnPropertyDescriptor() because the
+        CustomAccessor was not properly reset on window.statusbar when
+        setting it to false (which is allowed because the property is
+        marked as [Replaceable] in the IDL). We now property reset the
+        CustomAccessor flag in putDirectInternal() when needed. This
+        fixes the crash.
+
+2016-06-06  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
+
+        [EFL] Move efl include paths to JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
+        https://bugs.webkit.org/show_bug.cgi?id=158418
+
+        Reviewed by Csaba Osztrogonác.
+
+        In Source/JavaScriptCore/PlatformEfl.cmake, we don't use JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
+        for efl include paths.
+
+        * PlatformEfl.cmake:
+        * tests/stress/encode-decode-ascii.js: Added.
+        (shouldBe):
+        * tests/stress/encode-decode-unicode.js: Added.
+        (shouldBe):
+        (isLowSurrogate):
+        (isHighSurrogate):
+        (isSurrogate):
+        * tests/stress/encode-decode-uri-component-surrogates.js: Added.
+        (shouldBe):
+        (toHighSurrogate):
+        (toLowSurrogate):
+        * tests/stress/encode-decode-uri-surrogates.js: Added.
+        (shouldBe):
+        (toHighSurrogate):
+        (toLowSurrogate):
+        * tests/stress/encode-decode-zero.js: Added.
+        (shouldBe):
+        * tests/stress/escape-unescape-surrogates.js: Added.
+        (shouldBe):
+        (toHighSurrogate):
+        (toLowSurrogate):
+
+2016-06-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Change ProxyObject.[[Get]] not to use custom accessor
+        https://bugs.webkit.org/show_bug.cgi?id=157080
+
+        Reviewed by Darin Adler.
+
+        This patch focuses on introducing the second part of the followings.
+        But to do so, first and third parts are necessary.
+
+        1. Insert missing exception checks for getPropertySlot.
+
+            While getPropertySlot can perform user-observable behavior if the slot is not VMInquiry,
+            several places miss exeption checks. For example, ProxyObject's hasProperty already can
+            throw any errors. Looking through the code, we found several missing error checks after
+            hasProperty, but this will be fixed in the separated patch[1].
+
+        2. Do not use custom accessor to implement ProxyObject's [[Get]].
+
+            The caller already allows getOwnPropertySlot to throw an exception if the type
+            is not VMInquiry. So instead of using custom accessor, we simply implement it
+            directly in the ProxyObject's method.
+
+        3. Strip slotBase from custom accessor.
+
+            The custom accessor should not be bound to the specific slot base[2], since it
+            is just an accessor. There is an alternative design: makeing this custom accessor
+            to custom value accessor and accept both the slot base and the receiver instead
+            of allowing throwing an error from getOwnPropertySlot. But we take the first design
+            that allows getPropertySlot to throw an error, since hasProperty (that does not call
+            getValue of the custom getters) can already throw any errors.
+
+            To query the property with the non-user-observable way, we already provided the way for that:
+            use VMInquiry and isTaintedByProxy() instead.
+
+        Tests just ensure that the current semantics works correctly after this patch.
+        And this patch is performance neutral.
+
+        Later, we will attempt to rename "thisValue" to "receiver"[3].
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=158398
+        [2]: https://bugs.webkit.org/show_bug.cgi?id=157978
+        [3]: https://bugs.webkit.org/show_bug.cgi?id=158397
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * jsc.cpp:
+        (WTF::ImpureGetter::getOwnPropertySlot):
+        (WTF::CustomGetter::customGetter):
+        (WTF::RuntimeArray::lengthGetter):
+        (GlobalObject::finishCreation):
+        (GlobalObject::moduleLoaderFetch):
+        (functionGetGetterSetter):
+        (functionRun):
+        (functionLoad):
+        (functionLoadString):
+        (functionReadFile):
+        (functionCheckSyntax):
+        (functionLoadWebAssembly):
+        (functionLoadModule):
+        (functionCreateBuiltin):
+        (functionCheckModuleSyntax):
+        (dumpException):
+        (runWithScripts):
+        (runInteractive):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSBoundSlotBaseFunction.cpp:
+        (JSC::boundSlotBaseFunctionCall):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::getPropertySlot):
+        * runtime/JSCellInlines.h:
+        (JSC::ExecState::vm):
+        This change is super important for performance. We add several `exec->hadException()` calls into the super hot path, like JSC::operationGetByIdOptimize.
+        Without this change, we call ExecState::vm() and it is not inlined. This causes 1 - 2% performance regression in Octane PDFJS.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        * runtime/JSFunction.h:
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::callbackGetter):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        Here's UNLIKELY is important for Kraken's json-stringify-tinderbox. Without it, we can observe 0.5% regression.
+
+        (JSC::Walker::walk):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getPropertySlot):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::customGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::thisValue):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performGet):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        * runtime/ProxyObject.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        * tests/stress/get-from-scope-dynamic-onto-proxy.js: Added.
+        (shouldBe):
+        (shouldThrow.handler.has):
+        (handler.has):
+        (try.handler.has):
+        * tests/stress/operation-in-throw-error.js: Added.
+        (testCase.handler.has):
+        (testCase):
+        * tests/stress/proxy-and-json-stringify.js: Added.
+        (shouldThrow):
+        * tests/stress/proxy-and-typed-array.js: Added.
+        * tests/stress/proxy-json-path.js: Added.
+        * tests/stress/proxy-with-statement.js: Added.
+
+2016-06-03  Gavin & Ellie Barraclough  <barraclough@apple.com>
+
+        Deprecate remaining uses of Lookup getStatic*, use HasStaticPropertyTable instead.
+        https://bugs.webkit.org/show_bug.cgi?id=158178
+
+        Reviewed by Darin Adler.
+
+        As of bug #158059 most JSC static table property access no longer requires getOwnPropertySlot to be
+        overridden. Port remaining calls to the getStatic* functions in Lookup.h over to the new mechanism.
+
+        Part 1: Switch JSGlobalObject & JSDOMWindow to use HasStaticPropertyTable.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+            - Override is still required for symbol table,
+              but regular property access is now via Base::getOwnPropertySlot.
+        * runtime/JSGlobalObject.h:
+            - add HasStaticPropertyTable to structureFlags.
+
+2016-06-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        Eager FTL failure for strict comparison of NaN with number check
+        https://bugs.webkit.org/show_bug.cgi?id=158368
+
+        Reviewed by Darin Adler.
+
+        DoupleRep with a RealNumberUse starts by handling double
+        then falls back to Int32 if the unboxed double is NaN.
+
+        Before handling integers, the code is checking if the input
+        is indeed an int32. The problem was that this check failed
+        to account for NaN as an original input of the DoubleRep.
+
+        The call to isNotInt32() filter the doubles checks because
+        that was handled by the previous block.
+        The problem is the previous block handles any double except NaN.
+        If the original input was NaN, the masking by "~SpecFullDouble"
+        filter that possibility and isNotInt32() fails to test that case.
+
+        This patch fixes the issue by changing the filter to SpecDoubleReal.
+        The type SpecDoubleReal does not include the NaN types.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
+        * tests/stress/double-rep-real-number-use-on-nan.js: Added.
+        To ensure the isNotInt32() does not test anything, we want
+        proven numbers as input. The (+value) are there to enforce
+        a ToNumber() which in turn give us a proven Number type.
+
+2016-06-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        JSON.stringify replacer function calls with numeric array indices
+        https://bugs.webkit.org/show_bug.cgi?id=158262
+        rdar://problem/26613876
+
+        Reviewed by Saam Barati.
+
+        The spec of SerializeJSONArray is pretty clear that the index
+        should be transformed into a string before calling SerializeJSONProperty.
+        See http://www.ecma-international.org/ecma-262/6.0/#sec-serializejsonarray
+
+        * runtime/JSONObject.cpp:
+        (JSC::PropertyNameForFunctionCall::value):
+
+2016-06-03  Saam barati  <sbarati@apple.com>
+
+        Proxy.ownKeys should no longer throw an exception when duplicate keys are returned and the target is non-extensible
+        https://bugs.webkit.org/show_bug.cgi?id=158350
+        <rdar://problem/26626211>
+
+        Reviewed by Michael Saboff.
+
+        The spec was recently changes in Proxy [[OwnPropertyKeys]]
+        to allow for duplicate property names under certain circumstances.
+        This patch fixes our implementation to match the spec.
+        See: https://github.com/tc39/ecma262/pull/594
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        * tests/stress/proxy-own-keys.js:
+        (i.catch):
+        (ownKeys):
+        (assert):
+
+2016-06-03  Saam barati  <sbarati@apple.com>
+
+        Some shadow chicken code is wrong when run on a big endian CPU
+        https://bugs.webkit.org/show_bug.cgi?id=158361
+
+        Reviewed by Mark Lam.
+
+        This code was wrong on a big endian CPU, and it was
+        also an anti-pattern in the file. The code was harmless
+        on a little endian CPU, but it's better to remove it.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2016-06-03  Keith Miller  <keith_miller@apple.com>
+
+        Add argument_count bytecode for concat
+        https://bugs.webkit.org/show_bug.cgi?id=158358
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds a new argument count bytecode. Normally, we would
+        just make sure that the argument.length bytecode was fast enough
+        that we shouldn't need such an bytecode.  However, for the case of
+        Array.prototype.concat the overhead of the arguments object
+        allocation in the LLInt was too high and caused regressions.
+
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_argumentCount):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getArgumentCount):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_argument_count):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * tests/stress/argument-count-bytecode.js: Added.
+        (inlineCount):
+        (inlineCount1):
+        (inlineCount2):
+        (inlineCountVarArgs):
+        (assert):
+
+2016-06-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Clients of PolymorphicAccess::addCases shouldn't have to malloc
+        https://bugs.webkit.org/show_bug.cgi?id=158357
+
+        Reviewed by Keith Miller.
+
+        We only ever have 1 or 2 cases, so we can use inline Vector capacity.
+
+        This shows up a little in the JSBench profile.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::PolymorphicAccess::addCases):
+        (JSC::PolymorphicAccess::addCase):
+        * bytecode/PolymorphicAccess.h:
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::addAccessCase):
+
+2016-06-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        Fix some more INFINITI->INFINITY typos
+
+        Unreviewed.
+
+        The tests were not covering the edge cases they were supposed to test.
+
+        * tests/stress/math-ceil-basics.js:
+        (testMathCeilOnConstants):
+        * tests/stress/math-clz32-basics.js:
+        (testMathClz32OnDoubles):
+        (testMathClz32OnConstants):
+        * tests/stress/math-floor-basics.js:
+        (testMathFloorOnConstants):
+        * tests/stress/math-round-basics.js:
+        (testMathRoundOnConstants):
+        * tests/stress/math-trunc-basics.js:
+        (testMathTruncOnConstants):
+
+2016-06-02  Gavin & Ellie Barraclough  <barraclough@apple.com>
+
+        JSGlobalObject::addFunction should call deleteProperty rather than removeDirect
+        https://bugs.webkit.org/show_bug.cgi?id=158295
+
+        Reviewed by Saam Barati.
+
+        When a function in declared in program code, this replaces any previosly existing
+        property from the global object. JSGlobalObject::addFunction is currently calling
+        removeDirect rather than deleteProperty to remove the existing property. This fails
+        to remove any properties from static tables.
+
+        We currently get away with this because (a) JSObject & JSGlobalObject don't currently
+        have any properties in static tables, and (b) the current quirky property precedence
+        means that the symbol table properties end up taking precedence over JSDOMWindow's
+        static table, so window object properties end up being shadowed.
+
+        As a part of bug #158178 the precedence of static tables will change, requiring this
+        to be fixed.
+
+        The deleteProperty function does what we want (has the ability to remove properties,
+        including those from the static tables). Normally deleteProperty will not remove
+        properties that are non-configurable (DontDelete) - we need to do so. The function
+        does already support this, through a flag on VM named 'isInDefineOwnProperty', which
+        causes configurability to be ignored. Generalize this mechanism for use outside of
+        defineOwnProperty, renaming & moving DefineOwnPropertyScope helper class out to VM.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::deleteProperty):
+            - isInDefineOwnProperty -> deletePropertyMode.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addFunction):
+            - removeDirect -> deleteProperty.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+            - isInDefineOwnProperty -> deletePropertyMode.
+        (JSC::JSObject::defineOwnNonIndexProperty):
+            - DefineOwnPropertyScope -> VM::DeletePropertyModeScope.
+        (JSC::DefineOwnPropertyScope::DefineOwnPropertyScope): Deleted.
+        (JSC::DefineOwnPropertyScope::~DefineOwnPropertyScope): Deleted.
+            - DefineOwnPropertyScope -> VM::DeletePropertyModeScope.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+            - removed m_inDefineOwnProperty.
+        * runtime/VM.h:
+        (JSC::VM::deletePropertyMode):
+            - isInDefineOwnProperty -> deletePropertyMode.
+        (JSC::VM::DeletePropertyModeScope::DeletePropertyModeScope):
+        (JSC::VM::DeletePropertyModeScope::~DeletePropertyModeScope):
+            - DefineOwnPropertyScope -> VM::DeletePropertyModeScope.
+        (JSC::VM::setInDefineOwnProperty): Deleted.
+            - Replaced with deletePropertyMode, can now only be set via VM::DeletePropertyModeScope.
+        (JSC::VM::isInDefineOwnProperty): Deleted.
+            - isInDefineOwnProperty -> deletePropertyMode.
+
+2016-06-03  Mark Lam  <mark.lam@apple.com>
+
+        ARMv7 vstm and vldm instructions can only operate on a maximum of 16 registers.
+        https://bugs.webkit.org/show_bug.cgi?id=158349
+
+        Reviewed by Filip Pizlo.
+
+        According to the ARM Assembler Reference, the vstm and vldm instructions can only
+        operate on a maximum of 16 registers.  See
+        http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dht0002a/ch01s03s02.html
+        and http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dht0002a/ch01s03s02.html.
+
+        The ARMv7 probe code was wrongly using these instructions to store and load all
+        32 'd' registers.  This is now fixed.
+
+        * assembler/MacroAssemblerARMv7.cpp:
+
+2016-06-03  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: CLOOP build fix (needs a #include).
+
+        Not reviewed.
+
+        * interpreter/StackVisitor.h:
+
+2016-06-03  Andreas Kling  <akling@apple.com>
+
+        Eliminate two large sources of temporary StringImpl objects.
+        <https://webkit.org/b/158336>
+
+        Reviewed by Anders Carlsson.
+
+        We were jumping through some inefficient hoops when creating Identifiers due to the
+        convenience of our String(const char*) constructor.
+
+        This patch avoids just over 1 million temporary StringImpl objects on the PLUM benchmark.
+
+        * runtime/JSObject.h:
+        (JSC::makeIdentifier): Add an overload for string literals so we can stop creating a temporary
+        String just for passing to Identifier::fromString().
+
+        * runtime/Lookup.h:
+        (JSC::reifyStaticProperties): Use the Identifier::fromString() that takes an LChar* and a length
+        instead of creating a temporary String.
+
+2016-06-03  Mark Lam  <mark.lam@apple.com>
+
+        Clean up how StackVisitor dumps its frames.
+        https://bugs.webkit.org/show_bug.cgi?id=158316
+
+        Reviewed by Keith Miller.
+
+        1. Updated to do dumping to a PrintStream.
+        2. Added support for printing a prefix for each frame.
+           This is currently used by JSDollarVMPrototype to print frame numbers.
+        3. Fix the incrementing of the frame index in StackVisitor.
+           It was initialized but never incremented before when iterating the frames.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::gotoNextFrame):
+        (JSC::StackVisitor::Frame::codeType):
+        (JSC::StackVisitor::Frame::functionName):
+        (JSC::StackVisitor::Frame::sourceURL):
+        (JSC::StackVisitor::Frame::toString):
+        (JSC::StackVisitor::Frame::createArguments):
+        (JSC::StackVisitor::Frame::computeLineAndColumn):
+        (JSC::StackVisitor::Frame::retrieveExpressionInfo):
+        (JSC::StackVisitor::Frame::setToEnd):
+        (JSC::StackVisitor::Frame::dump):
+        (JSC::StackVisitor::Indent::dump):
+        (JSC::printIndents): Deleted.
+        (JSC::log): Deleted.
+        (JSC::logF): Deleted.
+        (JSC::StackVisitor::Frame::print): Deleted.
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::Indent::Indent):
+        (JSC::StackVisitor::Indent::operator++):
+        (JSC::StackVisitor::Indent::operator--):
+        (JSC::StackVisitor::Frame::isJSFrame):
+        (JSC::StackVisitor::Frame::isInlinedFrame):
+        (JSC::StackVisitor::Frame::vmEntryFrame):
+        (JSC::StackVisitor::Frame::callFrame):
+        (JSC::StackVisitor::Frame::Frame):
+        (JSC::StackVisitor::Frame::~Frame):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::PrintFrameFunctor::operator()):
+
+2016-06-02  Saam Barati  <sbarati@apple.com>
+
+        global lexical environment variables are not accessible through functions created using the function constructor
+        https://bugs.webkit.org/show_bug.cgi?id=158319
+
+        Reviewed by Filip Pizlo.
+
+        When creating a function using the Function constructor, we were
+        using the global object instead of the global lexical environment
+        as the function's scope. We should be using the global lexical environment.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * tests/stress/function-constructor-reading-from-global-lexical-environment.js: Added.
+        (assert):
+        (test):
+        (ClassTDZ):
+
+2016-06-02  Oliver Hunt  <oliver@apple.com>
+
+        JS parser incorrectly handles invalid utf8 in error messages.
+        https://bugs.webkit.org/show_bug.cgi?id=158128
+
+        Reviewed by Saam Barati.
+
+        The bug here was caused by us using PrintStream's toString method
+        to produce the error message for a parse error, even though toString
+        may produce a null string in the event of invalid utf8 that causes
+        the error in first case. So when we try to create an error message
+        containing the invalid character code, we set m_errorMessage to the
+        null string, as that signals "no error" we don't stop parsing, and
+        everything goes down hill from there.
+
+        Now we use the new toStringWithLatin1Fallback so that we can always
+        produce an error message, even if it contains invalid unicode. We
+        also add an additional fallback so that we can guarantee an error
+        message is set even if we're given a null string. There's a debug
+        mode assertion to prevent anyone accidentally attempting to clear
+        the message via setErrorMessage.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::logError):
+        * parser/Parser.h:
+        (JSC::Parser::setErrorMessage):
+
+2016-06-02  Saam Barati  <sbarati@apple.com>
+
+        Teach bytecode liveness about the debugger
+        https://bugs.webkit.org/show_bug.cgi?id=158288
+
+        Reviewed by Filip Pizlo.
+
+        There was a bug where we wouldn't always keep the scope register
+        on the stack when the debugger is enabled. The debugger always assumes
+        it can read from the scope. The bug happened in OSR exit from the FTL.
+        The FTL uses bytecode liveness for OSR exit. Bytecode liveness proved
+        that the scope register was dead, so the FTL OSR exit wrote `undefined`
+        into the scope's stack slot when OSR exiting to the baseline.
+
+        To fix this, I taught bytecode liveness' computeUsesForBytecodeOffset() that the
+        scope is used by every instruction except op_enter. This causes the
+        scope to be live-in at every instruction except op_enter.
+
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::blockContainsBytecodeOffset):
+        (JSC::addAlwaysLiveLocals):
+        (JSC::findBasicBlockForBytecodeOffset):
+        (JSC::stepOverInstruction):
+        (JSC::computeLocalLivenessForBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * tests/stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js: Added.
+        (foo):
+        (catch):
+
+2016-06-02  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r200694): %ThrowTypeError% is not unique
+        https://bugs.webkit.org/show_bug.cgi?id=158231
+
+        Reviewed by Joseph Pecoraro.
+
+        The ES6 standard in section 9.2.7.1 states that %ThrowTypeError% is unique.  This
+        change reverts the handling of TypeError before r200694 and then rolls in
+        throwTypeErrorGetterSetter() with the renamed throwTypeErrorArgumentsCalleeAndCallerGetterSetter().
+
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        (JSC::ClonedArguments::materializeSpecials):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::finishCreation):
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSFunction.cpp:
+        (JSC::getThrowTypeErrorGetterSetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::regExpProtoSymbolReplaceFunction):
+        (JSC::JSGlobalObject::regExpProtoGlobalGetter):
+        (JSC::JSGlobalObject::regExpProtoUnicodeGetter):
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsCalleeAndCallerGetterSetter):
+        (JSC::JSGlobalObject::moduleLoader):
+        (JSC::JSGlobalObject::throwTypeErrorGetterSetter): Deleted.
+        (JSC::JSGlobalObject::throwTypeErrorCalleeAndCallerGetterSetter): Deleted.
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsAndCallerInStrictModeGetterSetter): Deleted.
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsAndCallerInClassContextGetterSetter): Deleted.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncThrowTypeError):
+        (JSC::globalFuncThrowTypeErrorArgumentsCalleeAndCaller):
+        (JSC::globalFuncThrowTypeErrorCalleeAndCaller): Deleted.
+        (JSC::globalFuncThrowTypeErrorArgumentsAndCallerInStrictMode): Deleted.
+        (JSC::globalFuncThrowTypeErrorArgumentsAndCallerInClassContext): Deleted.
+        * runtime/JSGlobalObjectFunctions.h:
+        * tests/stress/reflect-set.js:
+
+2016-06-02  Michael Saboff  <msaboff@apple.com>
+
+        [iOS]: Some JSC stress tests fail running out of executable memory when the LLInt is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=158317
+
+        Reviewed by Saam Barati.
+
+        Updated these test to not run the "no-llint" variant when running on ARM machines.
+
+        * tests/stress/arrowfunction-lexical-bind-superproperty.js: Skip no-llint for ARM
+        (testCase):
+        * tests/stress/proxy-revoke.js: Skipp no-lint for ARM and ARM64
+        (assert):
+
+2016-06-02  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, reland r201532. The associated regressions have been fixed
+        by r201584.
+
+2016-06-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Use "= delete" for Locker(int) 
+
+        Rubber stamped by Saam Barati.
+
+        * runtime/ConcurrentJITLock.h:
+        (JSC::ConcurrentJITLocker::ConcurrentJITLocker):
+
+2016-06-02  Keith Miller  <keith_miller@apple.com>
+
+        ObjectPropertyCondition should have a isStillValidAssumingImpurePropertyWatchpoint function
+        https://bugs.webkit.org/show_bug.cgi?id=158308
+
+        Reviewed by Filip Pizlo.
+
+        Recently, structureEnsuresValidityAssumingImpurePropertyWatchpoint was converted to check
+        what should be isStillValidAssumingImpurePropertyWatchpoint. This patch fixes the API so
+        it should work as expected. This patch also changes generateConditions in
+        ObjectPropertyConditionSet to use isStillValidAssumingImpurePropertyWatchpoint.
+
+        * bytecode/ObjectPropertyCondition.cpp:
+        (JSC::ObjectPropertyCondition::structureEnsuresValidityAssumingImpurePropertyWatchpoint):
+        (JSC::ObjectPropertyCondition::isStillValidAssumingImpurePropertyWatchpoint):
+        * bytecode/ObjectPropertyCondition.h:
+        * bytecode/ObjectPropertyConditionSet.cpp:
+
+2016-06-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it harder to accidentally pass an integer to a locker.
+
+        Rubber stamped by Keith Miller.
+
+        * runtime/ConcurrentJITLock.h:
+        (JSC::ConcurrentJITLocker::ConcurrentJITLocker):
+
+2016-06-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it easier to use NoLockingNecessary
+        https://bugs.webkit.org/show_bug.cgi?id=158306
+
+        Reviewed by Keith Miller.
+        
+        Adapt to the new NoLockingNecessary API. More details in the WTF ChangeLog.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::instantiateLexicalVariables):
+        (JSC::BytecodeGenerator::emitPrefillStackTDZVariables):
+        (JSC::BytecodeGenerator::initializeBlockScopedFunctions):
+        (JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary):
+        (JSC::BytecodeGenerator::popLexicalScopeInternal):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::createVariable):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        * runtime/ConcurrentJITLock.h:
+        (JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase):
+        (JSC::ConcurrentJITLocker::ConcurrentJITLocker):
+
+2016-06-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure::previousID() races with Structure::allocateRareData()
+        https://bugs.webkit.org/show_bug.cgi?id=158280
+
+        Reviewed by Mark Lam.
+        
+        The problem is that previousID() would test hasRareData() and then either load the
+        previous Structure from the rare data, or load it directly. allocateRareData() would set
+        the hasRareData() bit separately from moving the Structure pointer into the rare data. So
+        we'd have a race that would cause previousID() to sometimes return the rarae data instead
+        of the previous Structure.
+
+        The fix is to get rid of the hasRareData bit. We can use the structureID of the
+        previousOrRareData cell to determine if it's the previousID or the RareData. This fixes the
+        race and it's probably not any slower.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::allocateRareData):
+        * runtime/Structure.h:
+
+2016-06-01  Michael Saboff  <msaboff@apple.com>
+
+        Runaway WebContent process CPU & memory @ foxnews.com
+        https://bugs.webkit.org/show_bug.cgi?id=158290
+
+        Reviewed by Mark Lam.
+
+        Clear the thrown value at the end of the catch block so that the stack scanner won't
+        find the value during GC.
+
+        Added a new stress test.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+        * tests/stress/recursive-try-catch.js: Added.
+        (logError):
+        (tryCallingBadFunction):
+        (recurse):
+        (test):
+
+2016-06-01  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Some setters for components of Date do not timeClip() their result
+        https://bugs.webkit.org/show_bug.cgi?id=158278
+        rdar://problem/25131426
+
+        Reviewed by Geoffrey Garen.
+
+        Many of the setters where not doing timeClip() on the computed UTC
+        time since Epoch.
+
+        See http://www.ecma-international.org/ecma-262/6.0/#sec-date.prototype.setdate
+        and the following sections for the definition.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+
+2016-06-01  Keith Miller  <keith_miller@apple.com>
+
+        canOptimizeStringObjectAccess should use ObjectPropertyConditions rather than structure watchpoints
+        https://bugs.webkit.org/show_bug.cgi?id=158291
+
+        Reviewed by Benjamin Poulain.
+
+        The old StringObject primitive access code used structure watchpoints. This meant that
+        if you set a watchpoint on String.prototype prior to tiering up to the DFG then added
+        a new property to String.prototype then we would never use StringObject optimizations.
+        This made property caching in the LLInt bad because it meant we would watchpoint
+        String.prototype very early in the program, which hurt date-format-xpab.js since that
+        benchmark relies on the StringObject optimizations.
+
+        This patch also extends ObjectPropertyConditionSet to be able to handle a slotBase
+        equivalence condition. Since that makes the code for generating the DFG watchpoints
+        significantly cleaner.
+
+        * bytecode/ObjectPropertyCondition.cpp:
+        (JSC::ObjectPropertyCondition::structureEnsuresValidityAssumingImpurePropertyWatchpoint):
+        * bytecode/ObjectPropertyConditionSet.cpp:
+        (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition):
+        (JSC::ObjectPropertyConditionSet::slotBaseCondition):
+        (JSC::generateConditionsForPrototypeEquivalenceConcurrently):
+        * bytecode/ObjectPropertyConditionSet.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::isStringPrototypeMethodSane):
+        (JSC::DFG::Graph::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.h:
+
+2016-06-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling in r201436.
+        https://bugs.webkit.org/show_bug.cgi?id=158143
+
+        r201562 should haved fixed the Dromaeo DOM core regression.
+
+        Restored changeset:
+
+        "REGRESSION: JSBench spends a lot of time transitioning
+        to/from dictionary"
+        https://bugs.webkit.org/show_bug.cgi?id=158045
+        http://trac.webkit.org/changeset/201436
+
+
+2016-06-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r201488.
+        https://bugs.webkit.org/show_bug.cgi?id=158268
+
+        Caused 23% regression on JetStream's crypto-md5 (Requested by
+        rniwa on #webkit).
+
+        Reverted changeset:
+
+        "[ESNext] Support trailing commas in function param lists"
+        https://bugs.webkit.org/show_bug.cgi?id=158020
+        http://trac.webkit.org/changeset/201488
+
+2016-05-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Dictionary property access should be fast
+        https://bugs.webkit.org/show_bug.cgi?id=158250
+
+        Reviewed by Keith Miller.
+
+        We have some remnant code that unnecessarily takes a slow path for
+        dictionaries. This caused the Dromaeo regression in r201436. Let's fix
+        that.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID): Attempt to flatten a dictionary if necessary, but
+        not too much. This is our idiom in other places.
+
+        (JSC::tryCachePutByID): See tryCacheGetByID.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setupGetByIdPrototypeCache): See tryCacheGetByID.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::fillCustomGetterPropertySlot): The rules for caching a
+        getter are the same as the rules for caching anything else: We're
+        allowed to cache even in dictionaries, as long as they're cacheable
+        dictionaries. Any transition that would change to/from getter/setter
+        or change other attributes requires a structure transition.
+
+2016-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Drop "replace" from JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL_NOT_IMPLEMENTED_YET
+        https://bugs.webkit.org/show_bug.cgi?id=158223
+
+        Reviewed by Darin Adler.
+
+        This list maintains "not implemented yet" well-known symbols.
+        `Symbol.replace` is already implemented.
+
+        * runtime/CommonIdentifiers.h:
+
+2016-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, roll out r201481, r201523: 0.3% regression in Octane code-load
+        https://bugs.webkit.org/show_bug.cgi?id=158249
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/AsyncFunctionPrototype.js: Removed.
+        (asyncFunctionResume): Deleted.
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutable):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset): Deleted.
+        (JSC::computeDefsForBytecodeOffset): Deleted.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::isArrowFunction):
+        (JSC::UnlinkedCodeBlock::isOrdinaryArrowFunction): Deleted.
+        (JSC::UnlinkedCodeBlock::isAsyncArrowFunction): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewMethodDefinition):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitNewFunctionExpressionCommon): Deleted.
+        (JSC::BytecodeGenerator::emitNewFunction): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionNode::emitBytecode): Deleted.
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::parse):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Deleted.
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncCommon): Deleted.
+        (JSC::JIT::emit_op_new_async_func): Deleted.
+        (JSC::JIT::emitNewFuncExprCommon): Deleted.
+        (JSC::JIT::emit_op_new_async_func_exp): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (runInteractive):
+        (printUsageStatement): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Deleted.
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAsyncFunctionBody): Deleted.
+        * parser/Keywords.table:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseImportClauseItem):
+        (JSC::Parser<LexerType>::parseImportDeclaration):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        (JSC::Parser<LexerType>::parseArrowFunctionExpression):
+        (JSC::Parser<LexerType>::printUnexpectedTokenText):
+        (JSC::Parser<LexerType>::parseAsyncFunctionSourceElements): Deleted.
+        (JSC::Parser<LexerType>::parseVariableDeclarationList): Deleted.
+        (JSC::Parser<LexerType>::parseDestructuringPattern): Deleted.
+        (JSC::Parser<LexerType>::parseFunctionDeclarationStatement): Deleted.
+        (JSC::Parser<LexerType>::parseFormalParameters): Deleted.
+        (JSC::stringForFunctionMode): Deleted.
+        (JSC::Parser<LexerType>::parseAsyncFunctionDeclaration): Deleted.
+        (JSC::Parser<LexerType>::parseExpressionOrLabelStatement): Deleted.
+        (JSC::Parser<LexerType>::parseAwaitExpression): Deleted.
+        (JSC::Parser<LexerType>::parseAsyncFunctionExpression): Deleted.
+        (JSC::Parser<LexerType>::parseUnaryExpression): Deleted.
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Parser::ExpressionErrorClassifier::propagateExpressionErrorClass):
+        (JSC::Parser::closestParentOrdinaryFunctionNonLexicalScope):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::popScopeInternal):
+        (JSC::Parser::matchSpecIdentifier):
+        (JSC::parse):
+        (JSC::Scope::setSourceParseMode): Deleted.
+        (JSC::Scope::isAsyncFunction): Deleted.
+        (JSC::Scope::isAsyncFunctionBoundary): Deleted.
+        (JSC::Scope::isModule): Deleted.
+        (JSC::Scope::setIsFunction): Deleted.
+        (JSC::Scope::setIsAsyncArrowFunction): Deleted.
+        (JSC::Scope::setIsAsyncFunction): Deleted.
+        (JSC::Scope::setIsAsyncFunctionBody): Deleted.
+        (JSC::Scope::setIsAsyncArrowFunctionBody): Deleted.
+        (JSC::Parser::ExpressionErrorClassifier::forceClassifyExpressionError): Deleted.
+        (JSC::Parser::ExpressionErrorClassifier::indicatesPossibleAsyncArrowFunction): Deleted.
+        (JSC::Parser::forceClassifyExpressionError): Deleted.
+        (JSC::Parser::declarationTypeToVariableKind): Deleted.
+        (JSC::Parser::upperScope): Deleted.
+        (JSC::Parser::isDisallowedIdentifierAwait): Deleted.
+        (JSC::Parser::disallowedIdentifierAwaitReason): Deleted.
+        * parser/ParserModes.h:
+        (JSC::isFunctionParseMode):
+        (JSC::isModuleParseMode):
+        (JSC::isProgramParseMode):
+        (JSC::SourceParseModeSet::SourceParseModeSet): Deleted.
+        (JSC::SourceParseModeSet::contains): Deleted.
+        (JSC::SourceParseModeSet::mergeSourceParseModes): Deleted.
+        (JSC::isAsyncFunctionParseMode): Deleted.
+        (JSC::isAsyncArrowFunctionParseMode): Deleted.
+        (JSC::isAsyncFunctionWrapperParseMode): Deleted.
+        (JSC::isAsyncFunctionBodyParseMode): Deleted.
+        (JSC::constructAbilityForParseMode): Deleted.
+        * parser/ParserTokens.h:
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::operator==):
+        (JSC::SourceCodeKey::runtimeFlags): Deleted.
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createAsyncFunctionBody): Deleted.
+        * runtime/AsyncFunctionConstructor.cpp: Removed.
+        (JSC::AsyncFunctionConstructor::AsyncFunctionConstructor): Deleted.
+        (JSC::AsyncFunctionConstructor::finishCreation): Deleted.
+        (JSC::callAsyncFunctionConstructor): Deleted.
+        (JSC::constructAsyncFunctionConstructor): Deleted.
+        (JSC::AsyncFunctionConstructor::getCallData): Deleted.
+        (JSC::AsyncFunctionConstructor::getConstructData): Deleted.
+        * runtime/AsyncFunctionConstructor.h: Removed.
+        (JSC::AsyncFunctionConstructor::create): Deleted.
+        (JSC::AsyncFunctionConstructor::createStructure): Deleted.
+        * runtime/AsyncFunctionPrototype.cpp: Removed.
+        (JSC::AsyncFunctionPrototype::AsyncFunctionPrototype): Deleted.
+        (JSC::AsyncFunctionPrototype::finishCreation): Deleted.
+        * runtime/AsyncFunctionPrototype.h: Removed.
+        (JSC::AsyncFunctionPrototype::create): Deleted.
+        (JSC::AsyncFunctionPrototype::createStructure): Deleted.
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::checkModuleSyntax):
+        * runtime/Completion.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/Executable.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSAsyncFunction.cpp: Removed.
+        (JSC::JSAsyncFunction::JSAsyncFunction): Deleted.
+        (JSC::JSAsyncFunction::createImpl): Deleted.
+        (JSC::JSAsyncFunction::create): Deleted.
+        (JSC::JSAsyncFunction::createWithInvalidatedReallocationWatchpoint): Deleted.
+        * runtime/JSAsyncFunction.h: Removed.
+        (JSC::JSAsyncFunction::allocationSize): Deleted.
+        (JSC::JSAsyncFunction::createStructure): Deleted.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        (JSC::JSGlobalObject::init): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::asyncFunctionPrototype): Deleted.
+        (JSC::JSGlobalObject::asyncFunctionStructure): Deleted.
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::moduleLoaderObjectParseModule):
+        * runtime/RuntimeFlags.h:
+        (JSC::RuntimeFlags::operator==): Deleted.
+        (JSC::RuntimeFlags::operator!=): Deleted.
+        * tests/stress/async-await-basic.js: Removed.
+        (shouldBe): Deleted.
+        (shouldBeAsync): Deleted.
+        (shouldThrow): Deleted.
+        (shouldThrowAsync): Deleted.
+        (shouldThrowSyntaxError): Deleted.
+        (let.AsyncFunction.async): Deleted.
+        (async.asyncFunctionForProto): Deleted.
+        (Object.getPrototypeOf.async): Deleted.
+        (Object.getPrototypeOf.async.method): Deleted.
+        (async): Deleted.
+        (async.method): Deleted.
+        (async.asyncNonConstructorDecl): Deleted.
+        (shouldThrow.new.async): Deleted.
+        (shouldThrow.new.async.nonConstructor): Deleted.
+        (async.asyncDecl): Deleted.
+        (async.f): Deleted.
+        (MyError): Deleted.
+        (async.asyncDeclThrower): Deleted.
+        (shouldThrowAsync.async): Deleted.
+        (resolveLater): Deleted.
+        (rejectLater): Deleted.
+        (async.resumeAfterNormal): Deleted.
+        (O.async.resumeAfterNormal): Deleted.
+        (resumeAfterNormalArrow.async): Deleted.
+        (async.resumeAfterThrow): Deleted.
+        (O.async.resumeAfterThrow): Deleted.
+        (resumeAfterThrowArrow.async): Deleted.
+        (catch): Deleted.
+        * tests/stress/async-await-module-reserved-word.js: Removed.
+        (shouldThrow): Deleted.
+        (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await): Deleted.
+        (checkModuleSyntaxError.String.raw.await): Deleted.
+        (checkModuleSyntaxError.String.raw.async.await): Deleted.
+        (SyntaxError.Cannot.declare.named): Deleted.
+        * tests/stress/async-await-mozilla.js: Removed.
+        (shouldBe): Deleted.
+        (shouldBeAsync): Deleted.
+        (shouldThrow): Deleted.
+        (shouldThrowAsync): Deleted.
+        (assert): Deleted.
+        (shouldThrowSyntaxError): Deleted.
+        (mozSemantics.async.empty): Deleted.
+        (mozSemantics.async.simpleReturn): Deleted.
+        (mozSemantics.async.simpleAwait): Deleted.
+        (mozSemantics.async.simpleAwaitAsync): Deleted.
+        (mozSemantics.async.returnOtherAsync): Deleted.
+        (mozSemantics.async.simpleThrower): Deleted.
+        (mozSemantics.async.delegatedThrower): Deleted.
+        (mozSemantics.async.tryCatch): Deleted.
+        (mozSemantics.async.tryCatchThrow): Deleted.
+        (mozSemantics.async.wellFinally): Deleted.
+        (mozSemantics.async.finallyMayFail): Deleted.
+        (mozSemantics.async.embedded.async.inner): Deleted.
+        (mozSemantics.async.embedded): Deleted.
+        (mozSemantics.async.fib): Deleted.
+        (mozSemantics.async.isOdd.async.isEven): Deleted.
+        (mozSemantics.async.isOdd): Deleted.
+        (mozSemantics.hardcoreFib.async.fib2): Deleted.
+        (mozSemantics.namedAsyncExpr.async.simple): Deleted.
+        (mozSemantics.async.executionOrder.async.first): Deleted.
+        (mozSemantics.async.executionOrder.async.second): Deleted.
+        (mozSemantics.async.executionOrder.async.third): Deleted.
+        (mozSemantics.async.executionOrder): Deleted.
+        (mozSemantics.async.miscellaneous): Deleted.
+        (mozSemantics.thrower): Deleted.
+        (mozSemantics.async.defaultArgs): Deleted.
+        (mozSemantics.shouldThrow): Deleted.
+        (mozSemantics): Deleted.
+        (mozMethods.X): Deleted.
+        (mozMethods.X.prototype.async.getValue): Deleted.
+        (mozMethods.X.prototype.setValue): Deleted.
+        (mozMethods.X.prototype.async.increment): Deleted.
+        (mozMethods.X.prototype.async.getBaseClassName): Deleted.
+        (mozMethods.X.async.getStaticValue): Deleted.
+        (mozMethods.Y.prototype.async.getBaseClassName): Deleted.
+        (mozMethods.Y): Deleted.
+        (mozFunctionNameInferrence.async.test): Deleted.
+        (mozSyntaxErrors): Deleted.
+        * tests/stress/async-await-reserved-word.js: Removed.
+        (assert): Deleted.
+        (shouldThrowSyntaxError): Deleted.
+        (AsyncFunction.async): Deleted.
+        * tests/stress/async_arrow_functions_lexical_arguments_binding.js: Removed.
+        (shouldBe): Deleted.
+        (shouldBeAsync): Deleted.
+        (shouldThrowAsync): Deleted.
+        (noArgumentsArrow2.async): Deleted.
+        * tests/stress/async_arrow_functions_lexical_new.target_binding.js: Removed.
+        (shouldBe): Deleted.
+        (shouldBeAsync): Deleted.
+        (shouldThrowAsync): Deleted.
+        (C1): Deleted.
+        (C2): Deleted.
+        (shouldThrowAsync.async): Deleted.
+        * tests/stress/async_arrow_functions_lexical_super_binding.js: Removed.
+        (shouldBe): Deleted.
+        (shouldBeAsync): Deleted.
+        (BaseClass.prototype.baseClassValue): Deleted.
+        (BaseClass.prototype.get property): Deleted.
+        (BaseClass): Deleted.
+        (ChildClass.prototype.asyncSuperProp): Deleted.
+        (ChildClass.prototype.asyncSuperProp2): Deleted.
+        (ChildClass): Deleted.
+        (ChildClass2): Deleted.
+        * tests/stress/async_arrow_functions_lexical_this_binding.js: Removed.
+        (shouldBe): Deleted.
+        (shouldBeAsync): Deleted.
+        (d.y): Deleted.
+
+2016-05-31  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r201363 and r201456.
+        https://bugs.webkit.org/show_bug.cgi?id=158240
+
+        "40% regression on date-format-xparb" (Requested by
+        keith_miller on #webkit).
+
+        Reverted changesets:
+
+        "LLInt should be able to cache prototype loads for values in
+        GetById"
+        https://bugs.webkit.org/show_bug.cgi?id=158032
+        http://trac.webkit.org/changeset/201363
+
+        "get_by_id should support caching unset properties in the
+        LLInt"
+        https://bugs.webkit.org/show_bug.cgi?id=158136
+        http://trac.webkit.org/changeset/201456
+
+2016-05-31  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r201359.
+        https://bugs.webkit.org/show_bug.cgi?id=158238
+
+        "It was not a speedup on anything" (Requested by saamyjoon on
+        #webkit).
+
+        Reverted changeset:
+
+        "We can cache lookups to JSScope::abstractResolve inside
+        CodeBlock::finishCreation"
+        https://bugs.webkit.org/show_bug.cgi?id=158036
+        http://trac.webkit.org/changeset/201359
+
+2016-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Recover parser performance regression by async support
+        https://bugs.webkit.org/show_bug.cgi?id=158228
+
+        Reviewed by Saam Barati.
+
+        This patch recovers parser performance regression caused in r201481.
+
+        Compared to the version that reverts r201481, still ~1% regression remains.
+        But compared to ToT, this patch significantly improves the code-load performance.
+
+        In Linux x64 JSCOnly port, with GCC 5.3.1.
+
+        reverted v.s. patched.
+                                 reverted                  patched
+
+        closure              0.61805+-0.00376    ?     0.62280+-0.00525       ?
+        jquery               8.03778+-0.02114          8.03453+-0.04646
+
+        <geometric>          2.22883+-0.00836    ?     2.23688+-0.00995       ? might be 1.0036x slower
+
+        ToT v.s. patched.
+                                 baseline                  patched
+
+        closure              0.65490+-0.00351    ^     0.62473+-0.00363       ^ definitely 1.0483x faster
+        jquery               8.25373+-0.06256    ^     8.04701+-0.03455       ^ definitely 1.0257x faster
+
+        <geometric>          2.32488+-0.00921    ^     2.24210+-0.00592       ^ definitely 1.0369x faster
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        Extend SourceParseMode.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        Do not call `matchSpecIdentifier()` as much as we can. This greatly improves the performance.
+
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        Do not touch `currentScope()->isGenerator()` even if it is unnecessary in parseFunctionInfo.
+        And accidental `syntaxChecker => context` changes are fixed.
+
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
+        (JSC::Parser<LexerType>::parseImportClauseItem):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        Do not use matchSpecIdentifier() in the hot paths.
+
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        (JSC::Parser<LexerType>::parseUnaryExpression):
+        (JSC::Parser<LexerType>::printUnexpectedTokenText): Deleted.
+        * parser/Parser.h:
+        (JSC::isIdentifierOrKeyword):
+        AWAIT shoud be one of the keywords. This AWAIT check is unnecessary.
+
+        (JSC::Parser::upperScope):
+        (JSC::Parser::matchSpecIdentifier):
+        Touching currentScope() and its member causes significant performance degradation.
+        We carefully remove the above access in the hot paths.
+
+        (JSC::Parser::isDisallowedIdentifierAwait):
+        * parser/ParserModes.h:
+        (JSC::SourceParseModeSet::SourceParseModeSet):
+        (JSC::SourceParseModeSet::contains):
+        (JSC::SourceParseModeSet::mergeSourceParseModes):
+        (JSC::isFunctionParseMode):
+        (JSC::isAsyncFunctionParseMode):
+        (JSC::isAsyncArrowFunctionParseMode):
+        (JSC::isAsyncFunctionWrapperParseMode):
+        (JSC::isAsyncFunctionBodyParseMode):
+        (JSC::isModuleParseMode):
+        (JSC::isProgramParseMode):
+        (JSC::constructAbilityForParseMode):
+        The parser frequently checks SourceParseMode. And variety of SourceParseMode becomes many.
+        So using switch onto SourceParseMode degrades the performance. Instead, we use bit tests to guard against
+        many SourceParseModes. We expect that this will be efficiently compiled into test & jmp.
+
+        * parser/ParserTokens.h:
+        Change AWAIT to one of the keywords, as the same to YIELD / LET.
+
+2016-05-31  Saam Barati  <sbarati@apple.com>
+
+        Web Inspector: capturing with Allocations timeline causes GC to take 100x longer and cause frame drops
+        https://bugs.webkit.org/show_bug.cgi?id=158054
+        <rdar://problem/25280762>
+
+        Reviewed by Joseph Pecoraro.
+
+        HeapSnapshot::sweepCell was taking a long time on 
+        http://bl.ocks.org/syntagmatic/6c149c08fc9cde682635
+        because it has to do a binary search to find if
+        an item is or is not in the list. 90% of the binary searches
+        would not find anything. This resulted in a lot of wasted time.
+
+        This patch adds a TinyBloomFilter member variable to HeapSnapshot.
+        We use this filter to try to bypass doing a binary search when the
+        filter tells us that a particular JSCell is definitely not in our
+        list. This is a 2x speedup on the steady state GC of the above
+        website.
+
+        * heap/HeapSnapshot.cpp:
+        (JSC::HeapSnapshot::appendNode):
+        (JSC::HeapSnapshot::sweepCell):
+        (JSC::HeapSnapshot::shrinkToFit):
+        (JSC::HeapSnapshot::nodeForCell):
+        * heap/HeapSnapshot.h:
+
+2016-05-29  Saam barati  <sbarati@apple.com>
+
+        Stack overflow crashes with deep or cyclic proxy prototype chains
+        https://bugs.webkit.org/show_bug.cgi?id=157087
+
+        Reviewed by Filip Pizlo and Mark Lam.
+
+        Because a Proxy can call back into the JS runtime in arbitrary
+        ways, we may have effectively cyclic prototype chains and property lookups
+        by using a Proxy. We may also have arbitrarily long Proxy chains
+        where we call into a C frame for each link in the Proxy chain.
+        This means that every Proxy hook must be aware that it can stack overflow.
+        Before, only certain hooks were aware of this fact. That was a bug,
+        all hooks must assume they can stack overflow.
+
+        Also, because we may have effectively cyclic prototype chains, we
+        compile ProxyObject.cpp with -fno-optimize-sibling-calls. This prevents
+        tail call optimization from happening on any of the calls from
+        ProxyObject.cpp. We do this because we rely on the machine stack
+        growing for throwing a stack overflow error. It's better for developers
+        to be able to see a stack overflow error than to have their program
+        infinite loop because the compiler performed TCO.
+
+        This patch also fixes a couple call sites of various methods
+        where we didn't check for an exception.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeOfVarargs):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/JSArray.h:
+        (JSC::getLength):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToString):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        (JSC::ProxyObject::performPut):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::getOwnPropertyNames):
+        (JSC::ProxyObject::getPropertyNames):
+        (JSC::ProxyObject::getOwnNonIndexPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        * runtime/ProxyObject.h:
+        (JSC::ProxyObject::create):
+        * tests/stress/proxy-stack-overflow-exceptions.js: Added.
+        (shouldThrowStackOverflow):
+        (const.emptyFunction):
+        (makeLongProxyChain):
+        (shouldThrowStackOverflow.longProxyChain):
+        (shouldThrowStackOverflow.effecivelyCyclicProxyProtoChain1):
+        (shouldThrowStackOverflow.effecivelyCyclicProxyProtoChain2):
+        (shouldThrowStackOverflow.effecivelyCyclicProxyProtoChain3):
+        (shouldThrowStackOverflow.longProxyChainBind):
+        (shouldThrowStackOverflow.longProxyChainPropertyAccess):
+        (shouldThrowStackOverflow.longProxyChainReflectConstruct):
+        (shouldThrowStackOverflow.longProxyChainReflectSet):
+        (shouldThrowStackOverflow.longProxyChainReflectOwnKeys):
+        (shouldThrowStackOverflow.longProxyChainGetPrototypeOf):
+        (shouldThrowStackOverflow.longProxyChainSetPrototypeOf):
+        (shouldThrowStackOverflow.longProxyChainGetOwnPropertyDescriptor):
+        (shouldThrowStackOverflow.longProxyChainDefineProperty):
+        (shouldThrowStackOverflow.longProxyChainIsExtensible):
+        (shouldThrowStackOverflow.longProxyChainPreventExtensions):
+        (shouldThrowStackOverflow.longProxyChainDeleteProperty):
+        (shouldThrowStackOverflow.longProxyChainWithScope):
+        (shouldThrowStackOverflow.longProxyChainWithScope2):
+        (shouldThrowStackOverflow.longProxyChainWithScope3):
+        (shouldThrowStackOverflow.longProxyChainArrayPrototypePush):
+        (shouldThrowStackOverflow.longProxyChainWithScope4):
+        (shouldThrowStackOverflow.longProxyChainCall):
+        (shouldThrowStackOverflow.longProxyChainConstruct):
+        (shouldThrowStackOverflow.longProxyChainHas):
+
+2016-05-28  Andreas Kling  <akling@apple.com>
+
+        JSGlobalLexicalEnvironment leaks SegmentedVector due to lack of destructor.
+        <https://webkit.org/b/158186>
+
+        Reviewed by Saam Barati.
+
+        Give JSGlobalLexicalEnvironment a destroy() and set up a finalizer for it
+        like we do with JSGlobalObject. (This is needed because they don't inherit
+        from JSDestructibleObjects and thus can't use JSCell::needsDestruction to
+        ask for allocation in destructor space.)
+
+        This stops us from leaking all the SegmentedVector backing stores.
+
+        * runtime/JSGlobalLexicalEnvironment.cpp:
+        (JSC::JSGlobalLexicalEnvironment::destroy):
+        * runtime/JSGlobalLexicalEnvironment.h:
+        (JSC::JSGlobalLexicalEnvironment::create):
+
+2016-05-28  Skachkov Oleksandr  <gskachkov@gmail.com>
+        [ESNext] Trailing commas in function parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=158020
+
+        Reviewed by Keith Miller.
+
+        ESNext allow to add trailing commas in function parameters and function arguments.
+        Link to spec - https://jeffmo.github.io/es-trailing-function-commas 
+        Example of using - (function (a, b,) { return a + b; })(1,2,);
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseArguments):
+        * tests/stress/trailing-comma-in-function-paramters.js: Added.
+
+2016-05-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] op_new_arrow_func_exp is no longer necessary
+        https://bugs.webkit.org/show_bug.cgi?id=158180
+
+        Reviewed by Saam Barati.
+
+        This patch removes op_new_arrow_func_exp bytecode since
+        what op_new_arrow_func_exp is doing is completely the same to op_new_func_exp.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset): Deleted.
+        (JSC::computeDefsForBytecodeOffset): Deleted.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewFunctionExpressionCommon):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Deleted.
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncExprCommon):
+        (JSC::JIT::emit_op_new_arrow_func_exp): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Deleted.
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+
+2016-05-27  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] implement async functions proposal
+        https://bugs.webkit.org/show_bug.cgi?id=156147
+
+        Reviewed by Yusuke Suzuki.
+
+        Adds support for `async` functions, proposed in https://tc39.github.io/ecmascript-asyncawait/.
+
+        On the front-end side, "await" becomes a contextual keyword when used within an async function,
+        which triggers parsing an AwaitExpression. "await" becomes an illegal identifier name within
+        these contexts. The bytecode generated from an "await" expression is identical to that generated
+        in a "yield" expression in a Generator, as AsyncFunction reuses generator's state machine mechanism.
+
+        There are numerous syntactic forms for language features, including a variation on ArrowFunctions,
+        requiring the keyword `async` to precede ArrowFormalParameters, and similarly, MethodDefinitions,
+        which are ordinary MethodDefinitions preceded by the keyword `async`.
+
+        An async function desugars to the following:
+
+        ```
+        async function asyncFn() {
+        }
+
+        becomes:
+
+        function asyncFn() {
+            let generator = {
+                @generatorNext: function(@generator, @generatorState, @generatorValue, @generatorResumeMode) {
+                  // generator state machine stuff here
+                },
+                @generatorState: 0,
+                @generatorThis: this,
+                @generatorFrame: null
+            };
+            return @asyncFunctionResume(generator, undefined, GeneratorResumeMode::NormalMode);
+        }
+        ```
+
+        `@asyncFunctionResume()` is similar to `@generatorResume`, with the exception that it will wrap the
+        result of invoking `@generatorNext()` in a Promise, and will avoid allocating an iterator result
+        object.
+
+        If the generator has yielded (an AwaitExpression has occurred), resumption will occur automatically
+        once the await-expression operand is finished, via Promise chaining.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/AsyncFunctionPrototype.js: Added.
+        (asyncFunctionResume):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createExecutable):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finishCreation):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::isArrowFunction):
+        (JSC::UnlinkedCodeBlock::isOrdinaryArrowFunction):
+        (JSC::UnlinkedCodeBlock::isAsyncArrowFunction):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionExpressionCommon):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewMethodDefinition):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionNode::emitBytecode):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::parse):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncCommon):
+        (JSC::JIT::emit_op_new_async_func):
+        (JSC::JIT::emitNewFuncExprCommon):
+        (JSC::JIT::emit_op_new_async_func_exp):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (runInteractive):
+        (printUsageStatement):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAsyncFunctionBody):
+        * parser/Keywords.table:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        (JSC::Parser<LexerType>::parseAsyncFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionDeclarationStatement):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseAsyncFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
+        (JSC::Parser<LexerType>::parseImportClauseItem):
+        (JSC::Parser<LexerType>::parseImportDeclaration):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseAwaitExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseAsyncFunctionExpression):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        (JSC::Parser<LexerType>::parseArrowFunctionExpression):
+        (JSC::Parser<LexerType>::parseUnaryExpression):
+        (JSC::Parser<LexerType>::printUnexpectedTokenText):
+        * parser/Parser.h:
+        (JSC::isIdentifierOrKeyword):
+        (JSC::Scope::Scope):
+        (JSC::Scope::setSourceParseMode):
+        (JSC::Scope::isAsyncFunction):
+        (JSC::Scope::isAsyncFunctionBoundary):
+        (JSC::Scope::isModule):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::setIsAsyncArrowFunction):
+        (JSC::Scope::setIsAsyncFunction):
+        (JSC::Scope::setIsAsyncFunctionBody):
+        (JSC::Scope::setIsAsyncArrowFunctionBody):
+        (JSC::Parser::ExpressionErrorClassifier::forceClassifyExpressionError):
+        (JSC::Parser::ExpressionErrorClassifier::propagateExpressionErrorClass):
+        (JSC::Parser::ExpressionErrorClassifier::indicatesPossibleAsyncArrowFunction):
+        (JSC::Parser::forceClassifyExpressionError):
+        (JSC::Parser::declarationTypeToVariableKind):
+        (JSC::Parser::closestParentOrdinaryFunctionNonLexicalScope):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::popScopeInternal):
+        (JSC::Parser::matchSpecIdentifier):
+        (JSC::Parser::isDisallowedIdentifierAwait):
+        (JSC::Parser::disallowedIdentifierAwaitReason):
+        (JSC::parse):
+        * parser/ParserModes.h:
+        (JSC::isFunctionParseMode):
+        (JSC::isAsyncFunctionParseMode):
+        (JSC::isAsyncArrowFunctionParseMode):
+        (JSC::isAsyncFunctionWrapperParseMode):
+        (JSC::isAsyncFunctionBodyParseMode):
+        (JSC::isModuleParseMode):
+        (JSC::isProgramParseMode):
+        (JSC::constructAbilityForParseMode):
+        * parser/ParserTokens.h:
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::runtimeFlags):
+        (JSC::SourceCodeKey::operator==):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createAsyncFunctionBody):
+        * runtime/AsyncFunctionConstructor.cpp: Added.
+        (JSC::AsyncFunctionConstructor::AsyncFunctionConstructor):
+        (JSC::AsyncFunctionConstructor::finishCreation):
+        (JSC::callAsyncFunctionConstructor):
+        (JSC::constructAsyncFunctionConstructor):
+        (JSC::AsyncFunctionConstructor::getCallData):
+        (JSC::AsyncFunctionConstructor::getConstructData):
+        * runtime/AsyncFunctionConstructor.h: Added.
+        (JSC::AsyncFunctionConstructor::create):
+        (JSC::AsyncFunctionConstructor::createStructure):
+        * runtime/AsyncFunctionPrototype.cpp: Added.
+        (JSC::AsyncFunctionPrototype::AsyncFunctionPrototype):
+        (JSC::AsyncFunctionPrototype::finishCreation):
+        * runtime/AsyncFunctionPrototype.h: Added.
+        (JSC::AsyncFunctionPrototype::create):
+        (JSC::AsyncFunctionPrototype::createStructure):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::checkModuleSyntax):
+        * runtime/Completion.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/Executable.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSAsyncFunction.cpp: Added.
+        (JSC::JSAsyncFunction::JSAsyncFunction):
+        (JSC::JSAsyncFunction::createImpl):
+        (JSC::JSAsyncFunction::create):
+        (JSC::JSAsyncFunction::createWithInvalidatedReallocationWatchpoint):
+        * runtime/JSAsyncFunction.h: Added.
+        (JSC::JSAsyncFunction::allocationSize):
+        (JSC::JSAsyncFunction::createStructure):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::asyncFunctionPrototype):
+        (JSC::JSGlobalObject::asyncFunctionStructure):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::moduleLoaderObjectParseModule):
+        * runtime/RuntimeFlags.h:
+        (JSC::RuntimeFlags::operator==):
+        (JSC::RuntimeFlags::operator!=):
+        * tests/stress/async-await-basic.js: Added.
+        (shouldBe):
+        (shouldBeAsync):
+        (shouldThrow):
+        (shouldThrowAsync):
+        (let.AsyncFunction.async):
+        (async.asyncFunctionForProto):
+        (Object.getPrototypeOf.async):
+        (Object.getPrototypeOf.async.method):
+        (async):
+        (async.method):
+        (async.asyncNonConstructorDecl):
+        (shouldThrow.new.async):
+        (shouldThrow.new.async.nonConstructor):
+        (async.asyncDecl):
+        (async.f):
+        (MyError):
+        (async.asyncDeclThrower):
+        (shouldThrowAsync.async):
+        (resolveLater):
+        (rejectLater):
+        (async.resumeAfterNormal):
+        (O.async.resumeAfterNormal):
+        (resumeAfterNormalArrow.async):
+        (async.resumeAfterThrow):
+        (O.async.resumeAfterThrow):
+        (resumeAfterThrowArrow.async):
+        (catch):
+        * tests/stress/async-await-module-reserved-word.js: Added.
+        (shouldThrow):
+        (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
+        (checkModuleSyntaxError.String.raw.await):
+        (checkModuleSyntaxError.String.raw.async.await):
+        (SyntaxError.Cannot.declare.named):
+        * tests/stress/async-await-mozilla.js: Added.
+        (shouldBe):
+        (shouldBeAsync):
+        (shouldThrow):
+        (shouldThrowAsync):
+        (assert):
+        (shouldThrowSyntaxError):
+        (mozSemantics.async.empty):
+        (mozSemantics.async.simpleReturn):
+        (mozSemantics.async.simpleAwait):
+        (mozSemantics.async.simpleAwaitAsync):
+        (mozSemantics.async.returnOtherAsync):
+        (mozSemantics.async.simpleThrower):
+        (mozSemantics.async.delegatedThrower):
+        (mozSemantics.async.tryCatch):
+        (mozSemantics.async.tryCatchThrow):
+        (mozSemantics.async.wellFinally):
+        (mozSemantics.async.finallyMayFail):
+        (mozSemantics.async.embedded.async.inner):
+        (mozSemantics.async.embedded):
+        (mozSemantics.async.fib):
+        (mozSemantics.async.isOdd.async.isEven):
+        (mozSemantics.async.isOdd):
+        (mozSemantics.hardcoreFib.async.fib2):
+        (mozSemantics.namedAsyncExpr.async.simple):
+        (mozSemantics.async.executionOrder.async.first):
+        (mozSemantics.async.executionOrder.async.second):
+        (mozSemantics.async.executionOrder.async.third):
+        (mozSemantics.async.executionOrder):
+        (mozSemantics.async.miscellaneous):
+        (mozSemantics.thrower):
+        (mozSemantics.async.defaultArgs):
+        (mozSemantics.shouldThrow):
+        (mozSemantics):
+        (mozMethods.X):
+        (mozMethods.X.prototype.async.getValue):
+        (mozMethods.X.prototype.setValue):
+        (mozMethods.X.prototype.async.increment):
+        (mozMethods.X.prototype.async.getBaseClassName):
+        (mozMethods.X.async.getStaticValue):
+        (mozMethods.Y.prototype.async.getBaseClassName):
+        (mozMethods.Y):
+        (mozFunctionNameInferrence.async.test):
+        (mozSyntaxErrors):
+        * tests/stress/async-await-reserved-word.js: Added.
+        (assert):
+        (shouldThrowSyntaxError):
+        (AsyncFunction.async):
+        * tests/stress/async_arrow_functions_lexical_arguments_binding.js: Added.
+        (shouldBe):
+        (shouldBeAsync):
+        (shouldThrowAsync):
+        (noArgumentsArrow2.async):
+        * tests/stress/async_arrow_functions_lexical_new.target_binding.js: Added.
+        (shouldBe):
+        (shouldBeAsync):
+        (shouldThrowAsync):
+        (C1):
+        (C2):
+        (shouldThrowAsync.async):
+        * tests/stress/async_arrow_functions_lexical_super_binding.js: Added.
+        (shouldBe):
+        (shouldBeAsync):
+        (BaseClass.prototype.baseClassValue):
+        (BaseClass):
+        (ChildClass.prototype.asyncSuperProp):
+        (ChildClass.prototype.asyncSuperProp2):
+        (ChildClass):
+        * tests/stress/async_arrow_functions_lexical_this_binding.js: Added.
+        (shouldBe):
+        (shouldBeAsync):
+        (d.y):
+
+2016-05-27  Saam barati  <sbarati@apple.com>
+
+        DebuggerCallFrame crashes when updated with the globalExec because neither ShadowChicken's algorithm nor StackVisitor's algorithm reasons about the globalExec
+        https://bugs.webkit.org/show_bug.cgi?id=158104
+
+        Reviewed by Filip Pizlo.
+
+        I think globalExec is a special enough case that it should be handled
+        at the layers above ShadowChicken and StackVisitor. Those APIs should
+        deal with real stack frames on the machine stack, not a heap constructed frame.
+
+        This patch makes DebuggerCallFrame::create aware that it may be
+        created with the globalObject->globalExec() by having it construct
+        a single DebuggerCallFrame that wraps the globalExec.
+
+        This fixes a crasher because we will construct a DebuggerCallFrame
+        with the globalExec when the Inspector is set to pause on all uncaught
+        exceptions and the JS program has a syntax error. Because the program
+        hasn't begun execution, there is no machine JS stack frame yet. So
+        DebuggerCallFrame is created with globalExec, which will cause it
+        to hit an assertion that dictates that the stack have size greater
+        than zero.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::create):
+
+2016-05-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::LazyJSValue::tryGetStringImpl() crashes for empty values
+        https://bugs.webkit.org/show_bug.cgi?id=158170
+
+        Reviewed by Michael Saboff.
+
+        The problem here is that jsDynamicCast<>() is evil! It avoids checking for the empty
+        value, presumably because this makes it soooper fast. In DFG IR, empty values can appear
+        anywhere because of TDZ.
+        
+        This patch doesn't change jsDynamicCast<>(), but it hardens our wrappers for it in the DFG
+        and it has the affected code use one of those wrappers.
+        
+        * dfg/DFGFrozenValue.h:
+        (JSC::DFG::FrozenValue::dynamicCast): Harden this.
+        (JSC::DFG::FrozenValue::cast):
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::tryGetStringImpl): Use the hardened wrapper.
+        * tests/stress/strcat-emtpy.js: Added. This used to crash every time.
+        (foo):
+        (i.catch):
+
+2016-05-27  Filip Pizlo  <fpizlo@apple.com>
+
+        regExpProtoFuncSplitFast should OOM before it swaps
+        https://bugs.webkit.org/show_bug.cgi?id=158157
+
+        Reviewed by Mark Lam.
+        
+        This is a huge speed-up on some jsfunfuzz test cases because it makes us realize much
+        sooner that running a regexp split will result in swapping. It uses the same basic
+        approach as http://trac.webkit.org/changeset/201451: if the result array crosses a certain
+        size threshold, we proceed with a dry run to see how big the array will get before
+        allocating anything else. This way, bogus uses of split that would have OOMed only after
+        killing the user's machine will now OOM before killing the user's machine.
+        
+        This is an enormous speed-up on some jsfunfuzz tests: they go from running for a long
+        time to running instantly.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::advanceStringIndex):
+        (JSC::genericSplit):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/StringObject.h:
+        (JSC::jsStringWithReuse):
+        (JSC::jsSubstring):
+        * tests/stress/big-split-captures.js: Added.
+        * tests/stress/big-split.js: Added.
+
+2016-05-27  Saam barati  <sbarati@apple.com>
+
+        ShadowChicken/DebuggerCallFrame don't properly handle when the entry stack frame is a tail deleted frame
+        https://bugs.webkit.org/show_bug.cgi?id=158131
+
+        Reviewed by Yusuke Suzuki.
+
+        There were bugs both in DebuggerCallFrame and ShadowChicken when the entry stack
+        frame(s) are tail deleted.
+
+        DebuggerCallFrame had an assertion saying that the entry frame shouldn't be
+        tail deleted. This is clearly wrong. The following program proves that this assertion
+        was misguided:
+        ```
+        "use strict";
+        setTimeout(function foo() { return bar(); }, 0);
+        ```
+
+        ShadowChicken had a very subtle bug when creating the shadow stack when 
+        the entry frames of the stack were tail deleted. Because it places frames into its shadow
+        stack by walking the machine frame and looking up entries in the log,
+        the machine frame doesn't have any notion of those tail deleted frames
+        at the entry of execution. ShadowChicken would never find those frames
+        because it would look for tail deleted frames *before* consulting the
+        current machine frame. This is wrong because if the entry frames
+        are tail deleted, then there is no machine frame for them because there
+        is no machine frame before them! Therefore, we must search for tail deleted
+        frames *after* consulting a machine frame. This is sound because we will always
+        have at least one machine frame on the stack (when we are using StackVisitor on a valid ExecState).
+        So when we consult the machine frame that is the entry frame on the machine stack,
+        we will search for tail deleted frames that come before it in the shadow stack.
+        This will allow us to find those tail deleted frames that are the entry frames
+        for the shadow stack.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::create):
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::Packet::dump):
+        (JSC::ShadowChicken::update):
+        (JSC::ShadowChicken::dump):
+
+2016-05-27  Chris Dumez  <cdumez@apple.com>
+
+        WorkQueue::dispatch() / RunLoop::dispatch() should not copy captured lambda variables
+        https://bugs.webkit.org/show_bug.cgi?id=158111
+
+        Reviewed by Darin Adler.
+
+        WorkQueue::dispatch() / RunLoop::dispatch() should not copy captured lambda variables.
+        These are often used cross-thread and copying the captured lambda variables can be
+        dangerous (e.g. we do not want to copy a String after calling isolatedCopy() upon
+        capture).
+
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::startTimer):
+        (JSC::Watchdog::Watchdog): Deleted.
+        (JSC::Watchdog::setTimeLimit): Deleted.
+        * runtime/Watchdog.h:
+
+2016-05-27  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Removed unused headers from ExecutableAllocatorFixedVMPool.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=158159
+
+        Reviewed by Darin Adler.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2016-05-27  Keith Miller  <keith_miller@apple.com>
+
+        get_by_id should support caching unset properties in the LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=158136
+
+        Reviewed by Benjamin Poulain.
+
+        Recently, we started supporting prototype load caching for get_by_id
+        in the LLInt. This patch extends that to caching unset properties.
+        While it is uncommon in general for a program to see a single structure
+        without a given property, the Array.prototype.concat function needs to
+        lookup the Symbol.isConcatSpreadable property. For any existing code
+        That property will never be set as it did not exist prior to ES6.
+
+        Similarly to the get_by_id_proto_load bytecode, this patch adds a new
+        bytecode, get_by_id_unset that checks the structureID of the base and
+        assigns undefined to the result.
+
+        There are no new tests here since we already have many tests that
+        incidentally cover this change.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finalizeLLIntInlineCaches):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setupGetByIdPrototypeCache):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2016-05-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Bogus uses of regexp matching should realize that they will OOM before they start swapping
+        https://bugs.webkit.org/show_bug.cgi?id=158142
+
+        Reviewed by Michael Saboff.
+        
+        Refactored the RegExpObject::matchGlobal() code so that there is less duplication. Took
+        advantage of this to make the code more resilient in case of absurd situations: if the
+        result array gets large, it proceeds with a dry run to detect how many matches there will
+        be. This allows it to OOM before it starts swapping.
+        
+        This also improves the overall performance of the code by using lightweight substrings and
+        skipping the whole intermediate argument array.
+        
+        This makes some jsfunfuzz tests run a lot faster and use a lot less memory.
+        
+        * builtins/RegExpPrototype.js:
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/MatchResult.cpp: Added.
+        (JSC::MatchResult::dump):
+        * runtime/MatchResult.h:
+        (JSC::MatchResult::empty):
+        (MatchResult::empty): Deleted.
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        (JSC::collectMatches):
+        (JSC::RegExpObject::matchGlobal):
+        * runtime/StringObject.h:
+        (JSC::jsStringWithReuse):
+        (JSC::jsSubstring):
+        * tests/stress/big-match.js: Added. Make sure that this optimization doesn't break big matches.
+
+2016-05-26  Gavin & Ellie Barraclough  <barraclough@apple.com>
+
+        Static table property lookup should not require getOwnPropertySlot override.
+        https://bugs.webkit.org/show_bug.cgi?id=158059
+
+        Reviewed by Darin Adler.
+
+        Currently JSObject does not handle property lookup of entries in the static
+        table. Each subclass with static properties mut override getOwnPropertySlot,
+        and explicitly call the lookup functions. This has the following drawbacks:
+
+        - Performance: for any class with static properties, property acces becomes
+          virtual (via method table).
+        - Poor encapsulation: implementation detail of static property access is
+          spread throughout & cross projects, rather than being contained in JSObject.
+        - Code size: this results in a great many additional functions.
+        - Inconsistency: static table presence has to be be taken into account in many
+          other operations, e.g. presence of read-only properties for put.
+        - Memory: in order to avoid the virtual lookup, DOM prototypes eagerly reify
+          all properties. This is likely suboptimal.
+
+        Instead, JSObject::getPropertySlot / JSObject::getOwnPropertySlot should be
+        able to handle static properties.
+
+        This is actually a fairly small & simple change.
+
+        The common pattern is for subclasses of JObject to override getOwnPropertySlot
+        to first defer to JSObject for property storage lookup, and only if this fails
+        consult the static table. They just want the static tables to be consulted after
+        regular property storgae lookup. So just add a fast flag in TypeInfo for JSObject
+        to check, and where it is set, do so. Then it's just a question of switching
+        classes over to start setting this flag, and drop the override.
+
+        The new mechanism does change static table lookup order from oldest-ancestor
+        first to most-derived first. The new ordering makes more sense (means derived
+        class static tables can now override entries from parents), and shoudn't affect
+        any existing code (since overriding didn't previously work, there likely aren't
+        shadowing properties in more derived types).
+
+        This patch changes all classes in JavaScriptCore over to using the new mechanism,
+        except JSGlobalObject. I'll move classes in WebCore over as a separate patch
+        (this is also why I've not moved JSGlobalObject in this patch - doing so would
+        move JSDOMWindow, and I'd rather handle that separately).
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::hasStaticPropertyTable):
+            - Add HasStaticPropertyTable flag.
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+            - Change setUpStaticFunctionSlot to take a VM&.
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlotFromTable):
+            - Added helper function to perform static lookup alone.
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+            - setUpStaticFunctionSlot changed to take a VM&.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnStaticPropertySlot):
+            - Added, walks ClassInfo chain looking for static properties.
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnNonIndexPropertySlot):
+            - getOwnNonIndexPropertySlot is used internally by getPropertySlot
+              & getOwnPropertySlot. If property is not present in storage array
+              then check the static table.
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::constructArrayWithSizeQuirk):
+        (JSC::ArrayConstructor::getOwnPropertySlot): Deleted.
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::create):
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::ArrayIteratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/ArrayIteratorPrototype.h:
+        (JSC::ArrayIteratorPrototype::create):
+        (JSC::ArrayIteratorPrototype::ArrayIteratorPrototype):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::finishCreation):
+        (JSC::booleanProtoFuncToString):
+        (JSC::BooleanPrototype::getOwnPropertySlot): Deleted.
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::create):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        (JSC::millisecondsFromComponents):
+        (JSC::DateConstructor::getOwnPropertySlot): Deleted.
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::create):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+        (JSC::dateProtoFuncToString):
+        (JSC::DatePrototype::getOwnPropertySlot): Deleted.
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::finishCreation):
+        (JSC::ErrorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+        * runtime/GeneratorPrototype.cpp:
+        (JSC::GeneratorPrototype::finishCreation):
+        (JSC::GeneratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/GeneratorPrototype.h:
+        (JSC::GeneratorPrototype::create):
+        (JSC::GeneratorPrototype::createStructure):
+        (JSC::GeneratorPrototype::GeneratorPrototype):
+        * runtime/InspectorInstrumentationObject.cpp:
+        (JSC::InspectorInstrumentationObject::finishCreation):
+        (JSC::InspectorInstrumentationObject::isEnabled):
+        (JSC::InspectorInstrumentationObject::getOwnPropertySlot): Deleted.
+        * runtime/InspectorInstrumentationObject.h:
+        (JSC::InspectorInstrumentationObject::create):
+        (JSC::InspectorInstrumentationObject::createStructure):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::IntlCollatorConstructor::getCallData):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        (JSC::IntlCollatorConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlCollatorConstructor.h:
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototype::finishCreation):
+        (JSC::IntlCollatorFuncCompare):
+        (JSC::IntlCollatorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlCollatorPrototype.h:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::IntlDateTimeFormatConstructor::getCallData):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        (JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlDateTimeFormatConstructor.h:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototype::finishCreation):
+        (JSC::IntlDateTimeFormatFuncFormatDateTime):
+        (JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlDateTimeFormatPrototype.h:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::IntlNumberFormatConstructor::getCallData):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        (JSC::IntlNumberFormatConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlNumberFormatConstructor.h:
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototype::finishCreation):
+        (JSC::IntlNumberFormatFuncFormatNumber):
+        (JSC::IntlNumberFormatPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlNumberFormatPrototype.h:
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::createStructure):
+        (JSC::getData):
+        (JSC::JSDataViewPrototype::getOwnPropertySlot): Deleted.
+        * runtime/JSDataViewPrototype.h:
+        * runtime/JSInternalPromiseConstructor.cpp:
+        (JSC::JSInternalPromiseConstructor::getCallData):
+        (JSC::JSInternalPromiseConstructor::getOwnPropertySlot): Deleted.
+        * runtime/JSInternalPromiseConstructor.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::Walker):
+        (JSC::JSONObject::getOwnPropertySlot): Deleted.
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getCallData):
+        (JSC::JSPromiseConstructor::getOwnPropertySlot): Deleted.
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::addOwnInternalSlots):
+        (JSC::JSPromisePrototype::getOwnPropertySlot): Deleted.
+        * runtime/JSPromisePrototype.h:
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        (JSC::getMap):
+        (JSC::MapPrototype::getOwnPropertySlot): Deleted.
+        * runtime/MapPrototype.h:
+        (JSC::MapPrototype::create):
+        (JSC::MapPrototype::MapPrototype):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::ModuleLoaderObject::finishCreation):
+        (JSC::printableModuleKey):
+        (JSC::ModuleLoaderObject::getOwnPropertySlot): Deleted.
+        * runtime/ModuleLoaderObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::finishCreation):
+        (JSC::toThisNumber):
+        (JSC::NumberPrototype::getOwnPropertySlot): Deleted.
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::create):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::addDefineProperty):
+        (JSC::constructObject):
+        (JSC::ObjectConstructor::getOwnPropertySlot): Deleted.
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::create):
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ReflectObject.cpp:
+        (JSC::ReflectObject::finishCreation):
+        (JSC::ReflectObject::getOwnPropertySlot): Deleted.
+        * runtime/ReflectObject.h:
+        (JSC::ReflectObject::create):
+        (JSC::ReflectObject::createStructure):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar):
+        (JSC::RegExpConstructor::getOwnPropertySlot): Deleted.
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::create):
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        (JSC::getSet):
+        (JSC::SetPrototype::getOwnPropertySlot): Deleted.
+        * runtime/SetPrototype.h:
+        (JSC::SetPrototype::create):
+        (JSC::SetPrototype::SetPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::finishCreation):
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::StringConstructor::getOwnPropertySlot): Deleted.
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::create):
+        * runtime/StringIteratorPrototype.cpp:
+        (JSC::StringIteratorPrototype::finishCreation):
+        (JSC::StringIteratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/StringIteratorPrototype.h:
+        (JSC::StringIteratorPrototype::create):
+        (JSC::StringIteratorPrototype::StringIteratorPrototype):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::create):
+        (JSC::substituteBackreferencesSlow):
+        (JSC::StringPrototype::getOwnPropertySlot): Deleted.
+        * runtime/StringPrototype.h:
+        * runtime/SymbolConstructor.cpp:
+        (JSC::SymbolConstructor::finishCreation):
+        (JSC::callSymbol):
+        (JSC::SymbolConstructor::getOwnPropertySlot): Deleted.
+        * runtime/SymbolConstructor.h:
+        (JSC::SymbolConstructor::create):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::SymbolPrototype::finishCreation):
+        (JSC::SymbolPrototype::getOwnPropertySlot): Deleted.
+        * runtime/SymbolPrototype.h:
+        (JSC::SymbolPrototype::create):
+            - remove getOwnPropertySlot, replace OverridesGetOwnPropertySlot flag with HasStaticPropertyTable.
+
+2016-05-26  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r201436.
+        https://bugs.webkit.org/show_bug.cgi?id=158143
+
+        Caused 30% regression on Dromaeo DOM core tests (Requested by
+        rniwa on #webkit).
+
+        Reverted changeset:
+
+        "REGRESSION: JSBench spends a lot of time transitioning
+        to/from dictionary"
+        https://bugs.webkit.org/show_bug.cgi?id=158045
+        http://trac.webkit.org/changeset/201436
+
+2016-05-26  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION: JSBench spends a lot of time transitioning to/from dictionary
+        https://bugs.webkit.org/show_bug.cgi?id=158045
+
+        Reviewed by Saam Barati.
+
+        15% speedup on jsbench-amazon-firefox, possibly 5% speedup overall on jsbench.
+
+        This regression seems to have two parts:
+
+        (1) Transitioning the window object to/from dictionary is more expensive
+        than it used to be to because the window object has lots more properties.
+        The window object has more properties because, for WebIDL compatibility,
+        we reify DOM APIs as properties when you delete.
+
+        (2) DOM prototypes transition to/from dictionary upon creation
+        because, once again for WebIDL compatibility, we reify their static
+        APIs eagerly.
+
+        The solution is to chill out a bit on dictionary transitions.
+
+        * bytecode/ObjectPropertyConditionSet.cpp: Don't flatten a dictionary
+        if we've already done so before. This avoids pathological churn, and it
+        is our idiom in other places.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute): Do flatten the global object unconditionally
+        if it is an uncacheable dictionary because the global object is super
+        important.
+
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer): Deleted.
+        Don't transition away from dictionary after a batched set of property
+        puts because normal dictionaries are cacheable and that's a perfectly
+        fine state to be in -- and the transition is expensive.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Do start the global object out as a cacheable
+        dictionary because it will inevitably have enough properties to become
+        a dictionary.
+
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): Same as ObjectPropertyConditionSet.cpp.
+
+2016-05-25  Geoffrey Garen  <ggaren@apple.com>
+
+        replaceable own properties seem to ignore replacement after property caching
+        https://bugs.webkit.org/show_bug.cgi?id=158091
+
+        Reviewed by Darin Adler.
+
+        * runtime/Lookup.h:
+        (JSC::replaceStaticPropertySlot): New helper function for replacing a
+        static property with a direct property. We need to do an attribute changed
+        transition because client code might have cached our static property.
+
+2016-05-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr
+        https://bugs.webkit.org/show_bug.cgi?id=158011
+        rdar://problem/25946592
+
+        Reviewed by Saam Barati.
+
+        When generating the meta-data required for compilation,
+        Yarr uses a recursive function over the various expression in the pattern.
+
+        If you have many nested expressions, you can run out of stack
+        and crash the WebProcess.
+        This patch changes that into a soft failure. The expression is just
+        considered invalid.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::finishCreation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::setupOffsets):
+        (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse):
+        (JSC::Yarr::YarrPattern::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted.
+        (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted.
+        * yarr/YarrPattern.h:
+
+2016-05-25  Alex Christensen  <achristensen@webkit.org>
+
+        Fix Win64 build after r201335
+        https://bugs.webkit.org/show_bug.cgi?id=158078
+
+        Reviewed by Mark Lam.
+
+        * offlineasm/x86.rb:
+        Add intel implementations for loadbs and loadhs
+
+2016-05-25  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(r201066): [GTK] Several intl tests started to fail in GTK+ bot after r201066
+        https://bugs.webkit.org/show_bug.cgi?id=158066
+
+        Reviewed by Darin Adler.
+
+        run-javascriptcore-tests does $ENV{LANG}="en_US.UTF-8"; but we are not actually honoring the environment
+        variables at all when using jsc binary. We are using setlocale() with a nullptr locale to get the current one, but
+        the current one is always "C", because to set the locale according to the environment variables we need to call
+        setlocale with an empty string as locale. That's done by gtk_init(), which is called by all our binaries (web
+        process, network process, etc.), but not by jsc (because jsc doesn't depend on GTK+). The reason why it has
+        always worked for EFL is because they call ecore_init() in jsc that calls setlocale.
+
+        * jsc.cpp:
+        (main): Call setlocale(LC_ALL, "") on GTK+.
+
+2016-05-25  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Fix the Wcast-align warning in LinkBuffer.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=157889
+
+        Reviewed by Darin Adler.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::recordLinkOffsets):
+
+2016-05-24  Keith Miller  <keith_miller@apple.com>
+
+        TypedArray.prototype.slice should not throw if no arguments are provided
+        https://bugs.webkit.org/show_bug.cgi?id=158044
+        <rdar://problem/26433280>
+
+        Reviewed by Geoffrey Garen.
+
+        We were throwing an exception if the TypedArray.prototype.slice function
+        was not provided arguments. This was wrong. Instead we should just assume
+        the first argument was 0.
+
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncSlice): Deleted.
+        * tests/stress/typedarray-slice.js:
+
+2016-05-24  Keith Miller  <keith_miller@apple.com>
+
+        LLInt should be able to cache prototype loads for values in GetById
+        https://bugs.webkit.org/show_bug.cgi?id=158032
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds prototype value caching to the LLInt for op_get_by_id.
+        Two previously unused words in the op_get_by_id bytecode have been
+        repurposed to hold extra information for the cache. The first is a
+        counter that records the number of get_by_ids that hit a cacheable value
+        on a prototype. When the counter is decremented from one to zero we
+        attempt to cache the prototype load, which will be discussed further
+        below. The second word is used to hold the prototype object when we have
+        started caching.
+
+        When the counter is decremented to zero we first attempt to generate and
+        watch the property conditions needed to ensure the validity of prototype
+        load. If the watchpoints are successfully created and installed we
+        replace the op_get_by_id opcode with the new op_get_by_id_proto_load
+        opcode, which tells the LLInt to use the cache prototype object for the
+        load rather than the base value.
+
+        Prior to this patch there was not LLInt specific data onCodeBlocks.
+        Since the CodeBlock needs to own the Watchpoints for the cache, a weak
+        map from each base structure to a bag of Watchpoints created for that
+        structure by some op_get_by_id has been added to the CodeBlock. During
+        GC, if we find that the a structure in the map has not been marked we
+        free the associated bag on the CodeBlock.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::printGetByIdCacheStatus):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finalizeLLIntInlineCaches):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::llintGetByIdWatchpointMap):
+        (JSC::clearLLIntGetByIdCache):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp: Added.
+        (JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::LLIntPrototypeLoadAdaptiveStructureWatchpoint):
+        (JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::install):
+        (JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::fireInternal):
+        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h: Added.
+        * bytecode/ObjectPropertyConditionSet.cpp:
+        (JSC::ObjectPropertyConditionSet::isValidAndWatchable):
+        * bytecode/ObjectPropertyConditionSet.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setupGetByIdPrototypeCache):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/Options.h:
+        * tests/stress/llint-get-by-id-cache-prototype-load-from-dictionary.js: Added.
+        (test):
+
+2016-05-24  Keith Miller  <keith_miller@apple.com>
+
+        We should be able to use the sampling profiler with DRT/WTR.
+        https://bugs.webkit.org/show_bug.cgi?id=158041
+
+        Reviewed by Saam Barati.
+
+        This patch makes the sampling profiler use a new option, samplingProfilerPath, which
+        specifies the path to a directory to output sampling profiler data when the program
+        terminates or the VM is destroyed. Additionally, it fixes some other issues with the
+        bytecode profiler that would cause crashes on debug builds.
+
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        (JSC::Profiler::Database::performAtExitSave):
+        * runtime/Options.h:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::registerForReportAtExit):
+        (JSC::SamplingProfiler::reportDataToOptionFile):
+        (JSC::SamplingProfiler::reportTopFunctions):
+        (JSC::SamplingProfiler::reportTopBytecodes):
+        * runtime/SamplingProfiler.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+
+2016-05-24  Saam barati  <sbarati@apple.com>
+
+        We can cache lookups to JSScope::abstractResolve inside CodeBlock::finishCreation
+        https://bugs.webkit.org/show_bug.cgi?id=158036
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements a 1 item cache for JSScope::abstractResolve. I also tried
+        implementing the cache as a HashMap, but it seemed either less profitable on some
+        benchmarks or just as profitable on others. Therefore, it's cleaner to just
+        use a 1 item cache.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::AbstractResolveKey::AbstractResolveKey):
+        (JSC::AbstractResolveKey::operator==):
+        (JSC::AbstractResolveKey::isEmptyValue):
+        (JSC::CodeBlock::finishCreation):
+        * runtime/GetPutInfo.h:
+        (JSC::needsVarInjectionChecks):
+        (JSC::ResolveOp::ResolveOp):
+
+2016-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviwed, add a comment to describe the test's failure mode. Suggested by mlam.
+
+        * tests/stress/override-map-constructor.js:
+        (Map):
+
+2016-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Map should not be in JSGlobalObject's static hashtable because it's initialized eagerly via FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR
+        https://bugs.webkit.org/show_bug.cgi?id=158031
+        rdar://problem/26353661
+
+        Reviewed by Geoffrey Garen.
+        
+        We were listing Map as being a lazy class structure. It's not. m_mapStructure is a WriteBarrier<>
+        not a LazyClassStructure<> and there is nothing lazy about it.
+
+        * runtime/JSGlobalObject.cpp: The fix is to remove Map here.
+        * runtime/Lookup.cpp: Add some dumping on the assert path.
+        (JSC::setUpStaticFunctionSlot):
+        * tests/stress/override-map-constructor.js: Added. This test used to crash.
+        (Map):
+
+2016-05-24  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt64 should have typed array fast paths for get_by_val
+        https://bugs.webkit.org/show_bug.cgi?id=157931
+
+        Reviewed by Keith Miller.
+
+        I think that the LLInt should be able to access typed arrays more quickly than it does now.
+        Ideally we would have fast paths for every major typed array operation and we would use
+        inline cache optimizations. I don't want to do this all in one go, so my plan is to
+        incrementally add support for this as time allows.
+        
+        This change just adds the easy typed array fast paths for get_by_val in the 64-bit version
+        of LLInt.
+        
+        Another bug, https://bugs.webkit.org/show_bug.cgi?id=157922, tracks the overall task of
+        adding all typed array fast paths to both versions of the LLInt.
+        
+        This is a 30% speed-up on typed array benchmarks in LLInt. This is not a speed-up when the
+        JITs are enabled.
+
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/backends.rb:
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSType.h:
+
+2016-05-24  Saam barati  <sbarati@apple.com> and Yusuke Suzuki <utatane.tea@gmail.com>
+
+        ThisTDZMode is no longer needed
+        https://bugs.webkit.org/show_bug.cgi?id=157209
+
+        Reviewed by Saam Barati.
+
+        ThisTDZMode is no longer needed because we have ConstructorKind
+        and DerivedContextType. The value of ThisTDZMode is strictly less
+        expressive than the combination of those two values. We were
+        using those values anyways, and this patch just makes it official
+        by removing ThisTDZMode.
+
+        This patch also cleans up caching keys. We extract SourceCodeFlags
+        from SourceCodeKey and use it in EvalCodeCache. It correctly
+        contains needed cache attributes: EvalContextType, DerivedContextType,
+        etc. Here, we still use specialized keys for EvalCodeCache instead
+        of SourceCodeKey for performance; it does not include name String and
+        does not allocate SourceCode.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::CacheKey::CacheKey):
+        (JSC::EvalCodeCache::CacheKey::operator==):
+        (JSC::EvalCodeCache::CacheKey::Hash::equal):
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode): Deleted.
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluateWithScopeExtension):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createThisExpr):
+        * parser/NodeConstructors.h:
+        (JSC::ThisNode::ThisNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeFlags::SourceCodeFlags):
+        (JSC::SourceCodeFlags::operator==):
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::Hash::hash):
+        (JSC::SourceCodeKey::Hash::equal):
+        (JSC::SourceCodeKey::HashTraits::isEmptyValue):
+        (JSC::SourceCodeKeyHash::hash): Deleted.
+        (JSC::SourceCodeKeyHash::equal): Deleted.
+        (JSC::SourceCodeKeyHashTraits::isEmptyValue): Deleted.
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createThisExpr):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::create):
+        * runtime/Executable.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * tests/stress/code-cache-incorrect-caching.js: Added.
+        (shouldBe):
+        (hello):
+        (catch):
+        (shouldBe.test.hello):
+        (globalEval.ok):
+        (global.hello.hello):
+
+2016-05-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Assertion failure for Reflect.get with Proxy and primitive value as explicit receiver
+        https://bugs.webkit.org/show_bug.cgi?id=157080
+
+        Reviewed by Saam Barati.
+
+        In custom accessor getter, the argument "thisValue" can be altered by using `Reflect.get`.
+        In this patch, we add a new parameter, "slotBase". This represents the base value offering
+        this custom getter. And use it in ProxyObject's performGet custom accessor getter.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        In PolymorphicAccess case, the thisValue and the slotBase are always cells.
+        This is because IC is enabled in the case that the base value is a cell.
+        And slotBase is always on the prototype chain from this base value.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jsc.cpp:
+        (WTF::CustomGetter::customGetter):
+        (WTF::RuntimeArray::lengthGetter):
+        * runtime/CustomGetterSetter.cpp:
+        (JSC::callCustomSetter):
+        * runtime/JSBoundSlotBaseFunction.cpp:
+        (JSC::boundSlotBaseFunctionCall):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        * runtime/JSFunction.h:
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::callbackGetter):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::customGetter):
+        * runtime/PropertySlot.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::regExpConstructorDollar1): Deleted.
+        (JSC::regExpConstructorDollar2): Deleted.
+        (JSC::regExpConstructorDollar3): Deleted.
+        (JSC::regExpConstructorDollar4): Deleted.
+        (JSC::regExpConstructorDollar5): Deleted.
+        (JSC::regExpConstructorDollar6): Deleted.
+        (JSC::regExpConstructorDollar7): Deleted.
+        (JSC::regExpConstructorDollar8): Deleted.
+        (JSC::regExpConstructorDollar9): Deleted.
+        * tests/stress/proxy-get-with-primitive-receiver.js: Added.
+        (shouldBe):
+
+2016-05-23  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION (196374): deleting a global property is expensive
+        https://bugs.webkit.org/show_bug.cgi?id=158005
+
+        Reviewed by Chris Dumez.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::deleteProperty): We only need to reify static properties
+        if the name being deleted matches a static property. Otherwise, we can
+        be sure that delete won't observe any static properties.
+
+2016-05-23  Saam barati  <sbarati@apple.com>
+
+        The baseline JIT crashes when compiling "(1,1)/1"
+        https://bugs.webkit.org/show_bug.cgi?id=157933
+
+        Reviewed by Benjamin Poulain.
+
+        op_div in the baseline JIT needed to better handle when both the lhs
+        and rhs are constants. It needs to make sure to load either the lhs or
+        the rhs into a register since the div generator can't handle both
+        the lhs and rhs being constants.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+        * tests/stress/jit-gracefully-handle-double-constants-in-math-operators.js: Added.
+        (assert):
+        (test):
+
+2016-05-23  Saam barati  <sbarati@apple.com>
+
+        String template don't handle let initialization properly inside eval
+        https://bugs.webkit.org/show_bug.cgi?id=157991
+
+        Reviewed by Oliver Hunt.
+
+        The fix is to make sure we emit TDZ checks. 
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TaggedTemplateNode::emitBytecode):
+        * tests/stress/tagged-template-tdz.js: Added.
+        (shouldThrowTDZ):
+        (test):
+
+2016-05-22  Saam barati  <sbarati@apple.com>
+
+        Unreviewed. Fixed debug assertion failures from r201235.
+
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+
+2016-05-22  Brady Eidson  <beidson@apple.com>
+
+        Attempted Yosemite build fix after http://trac.webkit.org/changeset/201255
+
+        Suggested by and reviewed by Anders Carlsson.
+
+        * b3/B3CCallValue.h: Initialize the effects member more conventionally.
+
+2016-05-22  Brady Eidson  <beidson@apple.com>
+
+        Move to C++14.
+        https://bugs.webkit.org/show_bug.cgi?id=157948
+
+        Reviewed by Michael Catanzaro.
+
+        * Configurations/Base.xcconfig:
+
+2016-05-22  Saam barati  <sbarati@apple.com>
+
+        REGRESSION(r199075): String.prototype.replace fails after being used many times with different replace values
+        https://bugs.webkit.org/show_bug.cgi?id=157968
+        <rdar://problem/26404735>
+
+        Reviewed by Ryosuke Niwa and Filip Pizlo.
+
+        There was a bug in the DFG where we were checking a condition
+        on the wrong variable.
+
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+
+2016-05-22  Chris Dumez  <cdumez@apple.com>
+
+        Remove uses of PassRefPtr in JS bindings code
+        https://bugs.webkit.org/show_bug.cgi?id=157949
+
+        Reviewed by Andreas Kling.
+
+        Remove uses of PassRefPtr in JS bindings code.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::queueMicrotask):
+        * runtime/JSGlobalObject.h:
+
+2016-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove LegacyProfiler
+        https://bugs.webkit.org/show_bug.cgi?id=153565
+
+        Reviewed by Mark Lam.
+
+        JavaScriptCore now provides a sampling profiler and it is enabled
+        by all ports. Web Inspector switched months ago to using the
+        sampling profiler and displaying its data. Remove the legacy
+        profiler, as it is no longer being used by anything other then
+        console.profile and tests. We will update console.profile's
+        behavior soon to have new behavior and use the sampling data.
+
+        * API/JSProfilerPrivate.cpp: Removed.
+        * API/JSProfilerPrivate.h: Removed.
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset): Deleted.
+        (JSC::computeDefsForBytecodeOffset): Deleted.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::profileHookRegister): Deleted.
+        (JSC::BytecodeGenerator::shouldEmitProfileHooks): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::CallArguments::CallArguments): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Deleted.
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): Deleted.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC): Deleted.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::callFunctionWithEvalEnabled):
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::operator()): Deleted.
+        (JSC::Interpreter::execute): Deleted.
+        (JSC::Interpreter::executeCall): Deleted.
+        (JSC::Interpreter::executeConstruct): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Deleted.
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_will_call): Deleted.
+        (JSC::JIT::emit_op_profile_did_call): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_will_call): Deleted.
+        (JSC::JIT::emit_op_profile_did_call): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Deleted.
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ParserModes.h:
+        * profiler/CallIdentifier.h: Removed.
+        * profiler/LegacyProfiler.cpp: Removed.
+        * profiler/LegacyProfiler.h: Removed.
+        * profiler/Profile.cpp: Removed.
+        * profiler/Profile.h: Removed.
+        * profiler/ProfileGenerator.cpp: Removed.
+        * profiler/ProfileGenerator.h: Removed.
+        * profiler/ProfileNode.cpp: Removed.
+        * profiler/ProfileNode.h: Removed.
+        * profiler/ProfilerJettisonReason.cpp:
+        (WTF::printInternal): Deleted.
+        * profiler/ProfilerJettisonReason.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        * runtime/CodeCache.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        (JSC::JSGlobalObject::~JSGlobalObject): Deleted.
+        (JSC::JSGlobalObject::hasLegacyProfiler): Deleted.
+        * runtime/JSGlobalObject.h:
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Deleted.
+        (JSC::SetEnabledProfilerFunctor::operator()): Deleted.
+        (JSC::VM::setEnabledProfiler): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::enabledProfiler): Deleted.
+        (JSC::VM::enabledProfilerAddress): Deleted.
+
+2016-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove LegacyProfiler
+        https://bugs.webkit.org/show_bug.cgi?id=153565
+
+        Reviewed by Saam Barati.
+
+        * inspector/protocol/Timeline.json:
+        * jsc.cpp:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::hasLegacyProfiler):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsLegacyProfiling): Deleted.
+
+2016-05-20  Saam barati  <sbarati@apple.com>
+
+        JSScope::abstractAccess doesn't need to copy the SymbolTableEntry, it can use it by reference
+        https://bugs.webkit.org/show_bug.cgi?id=157956
+
+        Reviewed by Geoffrey Garen.
+
+        A SymbolTableEntry may be a FatEntry. Copying a FatEntry is slow because we have to
+        malloc memory for it, then free the malloced memory once the entry goes out of
+        scope. abstractAccess uses a SymbolTableEntry temporarily when performing scope
+        accesses during bytecode linking. It copies out the SymbolTableEntry every time
+        it does a SymbolTable lookup. This is not cheap when the entry happens to be a
+        FatEntry. We should really just be using a reference to the entry because
+        there is no need to copy it in such a scenario.
+
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+
+2016-05-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: retained size for typed arrays does not count native backing store
+        https://bugs.webkit.org/show_bug.cgi?id=157945
+        <rdar://problem/26392238>
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSArrayBuffer.h:
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::estimatedSize):
+        Include an estimatedSize implementation for JSArrayBuffer.
+        ArrayBuffer has a unique path, different from other data
+        stored in the Heap.
+
+        * tests/heapProfiler/typed-array-sizes.js: Added.
+        Test sizes of TypedArray with and without an ArrayBuffer.
+        When the TypedArray is a view wrapping an ArrayBuffer, the
+        ArrayBuffer has the size.
+
+2016-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        reifyAllStaticProperties makes two copies of every string
+        https://bugs.webkit.org/show_bug.cgi?id=157953
+
+        Reviewed by Mark Lam.
+
+        Let's not do that.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::reifyAllStaticProperties): Pass our Identifier to
+        reifyStaticProperty so it doesn't have to make its own.
+
+        * runtime/Lookup.h:
+        (JSC::reifyStaticProperty): No need to null check because callers never
+        pass null anymore. No need to make an identifier because callers pass
+        us one.
+
+        (JSC::reifyStaticProperties): Honor new interface.
+
+2016-05-20  Geoffrey Garen  <ggaren@apple.com>
+
+        JSBench regression: CodeBlock linking always copies the symbol table
+        https://bugs.webkit.org/show_bug.cgi?id=157951
+
+        Reviewed by Saam Barati.
+
+        We always put a SymbolTable into the constant pool, even in simple
+        functions in which it won't be used -- i.e., there's on eval and there
+        are no captured variables and so on.
+
+        This is costly because linking must copy any provided symbol tables.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitProfileType): Only add the symbol table
+        as a constant if we will use it at runtime.
+
+2016-05-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve int->float conversion in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=157936
+
+        Reviewed by Filip Pizlo.
+
+        The integer -> floating point lowering was very barebone.
+
+        For example, converting a constant integer to double
+        was doing:
+            mov #const, %eax
+            xor %xmm0, %xmm0
+            cvtsi2sd %eax, %xmm0
+
+        Conversion from integer to float was also missing.
+        We were always converting to double then rounding the double
+        to float.
+
+        This patch adds the basics:
+        -Constant folding.
+        -Integer to Float opcode.
+        -Reducing int->double to int->float when used by DoubleToFloat.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::convertInt32ToFloat):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::convertInt64ToDouble):
+        (JSC::MacroAssemblerX86_64::convertInt64ToFloat):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cvtsi2ss_rr):
+        (JSC::X86Assembler::cvtsi2ssq_rr):
+        (JSC::X86Assembler::cvtsi2sdq_mr):
+        (JSC::X86Assembler::cvtsi2ssq_mr):
+        (JSC::X86Assembler::cvtsi2ss_mr):
+        * assembler/MacroAssemblerARM64.h:
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::iToDConstant):
+        (JSC::B3::Const32Value::iToFConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::iToDConstant):
+        (JSC::B3::Const64Value::iToFConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceDoubleToFloat.cpp:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::iToDConstant):
+        (JSC::B3::Value::iToFConstant):
+        (JSC::B3::Value::isRounded):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::materialize):
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::int64Operands):
+        (JSC::B3::testIToD64Arg):
+        (JSC::B3::testIToF64Arg):
+        (JSC::B3::testIToD32Arg):
+        (JSC::B3::testIToF32Arg):
+        (JSC::B3::testIToD64Mem):
+        (JSC::B3::testIToF64Mem):
+        (JSC::B3::testIToD32Mem):
+        (JSC::B3::testIToF32Mem):
+        (JSC::B3::testIToD64Imm):
+        (JSC::B3::testIToF64Imm):
+        (JSC::B3::testIToD32Imm):
+        (JSC::B3::testIToF32Imm):
+        (JSC::B3::testIToDReducedToIToF64Arg):
+        (JSC::B3::testIToDReducedToIToF32Arg):
+        (JSC::B3::run):
+
+2016-05-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] FTL can crash on stack overflow
+        https://bugs.webkit.org/show_bug.cgi?id=157881
+        rdar://problem/24665964
+
+        Reviewed by Michael Saboff.
+
+        The VM's m_largestFTLStackSize was never set anywhere (updateFTLLargestStackSize()
+        was never called). We forgot to change that when implementing B3.
+
+        Even when it is set, we still have a problem on OSR Exit.
+        If the last frame is a FTL frame and it OSR Exits, the space required for
+        that frame becomes significantly larger. What happens is we crash in the OSR Exit
+        instead of the FTL frame (this is what happens in rdar://problem/24665964).
+
+        This patch changes the stack boundary checks in FTL to be the same as DFG:
+        we verify that we have enough space for the current optimized function but
+        also for the baseline version (including inlining) in case of exit.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        (JSC::FTL::DFG::LowerDFGToB3::didOverflowStack): Deleted.
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Deleted.
+        (JSC::VM::updateStackLimit): Deleted.
+        (JSC::VM::updateFTLLargestStackSize): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::addressOfFTLStackLimit): Deleted.
+
+2016-05-18  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::LICMPhase shouldn't hoist type checks unless it knows that the check will succeed at the loop pre-header
+        https://bugs.webkit.org/show_bug.cgi?id=144527
+
+        Reviewed by Saam Barati.
+        
+        This adds a control flow equivalence analysis (called ControlEquivalenceAnalysis) based on
+        dominator analysis over the backwards CFG. Two basic blocks are control flow equivalent if
+        the execution of one implies that the other one must also execute. It means that the two
+        blocks' forward and backward dominance are reciprocated: (A dom B and B backdom A) or (B dom
+        A and A backdom B). LICM now uses it to become more conservative about hoisting checks, if
+        this has caused problems in the past. If we hoist something that may exit from a block that
+        was not control equivalent to the pre-header then it's possible that the node's speculation
+        will fail even though it wouldn't have if it wasn't hoisted. So, we flag these nodes'
+        origins as being "wasHoisted" and we track all of their exits as "HoistingFailed". LICM will
+        turn off such speculative hoisting if the CodeBlock from which we are hoisting had the
+        HoistingFailed exit kind.
+        
+        Note that this deliberately still allows us to hoist things that may exit even if they are
+        not control equivalent to the pre-header. This is necessary because the profitability of
+        hoisting is so huge in all of the cases that we're aware of that it's worth giving it a
+        shot.
+        
+        This is neutral on macrobenchmarks since none of the benchmarks we track have a hoistable
+        operation that would exit only if hoisted. I added microbenchmarks to illustrate the problem
+        and two of them speed up by ~40% while one of them is neutral (Int52 saves us from having
+        problems on that program even though LICM previously did the wrong thing).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * dfg/DFGAtTailAbstractState.h:
+        (JSC::DFG::AtTailAbstractState::operator bool):
+        (JSC::DFG::AtTailAbstractState::initializeTo):
+        * dfg/DFGBackwardsCFG.h: Added.
+        (JSC::DFG::BackwardsCFG::BackwardsCFG):
+        * dfg/DFGBackwardsDominators.h: Added.
+        (JSC::DFG::BackwardsDominators::BackwardsDominators):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::checkAndSet): Deleted.
+        * dfg/DFGControlEquivalenceAnalysis.h: Added.
+        (JSC::DFG::ControlEquivalenceAnalysis::ControlEquivalenceAnalysis):
+        (JSC::DFG::ControlEquivalenceAnalysis::dominatesEquivalently):
+        (JSC::DFG::ControlEquivalenceAnalysis::areEquivalent):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::dumpBlockHeader):
+        (JSC::DFG::Graph::invalidateCFG):
+        (JSC::DFG::Graph::substituteGetLocal):
+        (JSC::DFG::Graph::handleAssertionFailure):
+        (JSC::DFG::Graph::ensureDominators):
+        (JSC::DFG::Graph::ensurePrePostNumbering):
+        (JSC::DFG::Graph::ensureNaturalLoops):
+        (JSC::DFG::Graph::ensureBackwardsCFG):
+        (JSC::DFG::Graph::ensureBackwardsDominators):
+        (JSC::DFG::Graph::ensureControlEquivalenceAnalysis):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::hasDebuggerEnabled):
+        * dfg/DFGInPlaceAbstractState.h:
+        (JSC::DFG::InPlaceAbstractState::operator bool):
+        (JSC::DFG::InPlaceAbstractState::createValueForNode):
+        (JSC::DFG::InPlaceAbstractState::forNode):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::LICMPhase::run):
+        (JSC::DFG::LICMPhase::attemptHoist):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGMayExit.h:
+        * dfg/DFGNode.h:
+        * dfg/DFGNodeOrigin.cpp:
+        (JSC::DFG::NodeOrigin::dump):
+        * dfg/DFGNodeOrigin.h:
+        (JSC::DFG::NodeOrigin::takeValidExit):
+        (JSC::DFG::NodeOrigin::withWasHoisted):
+        (JSC::DFG::NodeOrigin::forInsertingAfter):
+        * dfg/DFGNullAbstractState.h: Added.
+        (JSC::DFG::NullAbstractState::NullAbstractState):
+        (JSC::DFG::NullAbstractState::operator bool):
+        (JSC::DFG::NullAbstractState::forNode):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExitBase.cpp:
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::OSRExitBase):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
+        (JSC::FTL::OSRExit::OSRExit):
+        * ftl/FTLOSRExit.h:
+
+2016-05-19  Mark Lam  <mark.lam@apple.com>
+
+        Code that null checks the VM pointer before any use should ref the VM.
+        https://bugs.webkit.org/show_bug.cgi?id=157864
+
+        Reviewed by Filip Pizlo and Keith Miller.
+
+        JSLock::willReleaseLock() and HeapTimer::timerDidFire() need to reference the VM
+        through a RefPtr.  Otherwise, there's no guarantee that the VM won't be deleted
+        after their null checks.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::vm):
+        (JSC::CodeBlock::setVM): Deleted.
+        - Not used, and suggests that it can be changed during the lifetime of the
+          CodeBlock (which should not be).
+
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::timerDidFire):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::willReleaseLock):
+        - Store the VM pointer in a RefPtr first, and null check the RefPtr instead of
+          the raw VM pointer.  This makes the null check a strong guarantee that the
+          VM pointer is valid while these functions are using it.
+
+2016-05-19  Saam barati  <sbarati@apple.com>
+
+        arrow function lexical environment should reuse the same environment as the function's lexical environment where possible
+        https://bugs.webkit.org/show_bug.cgi?id=157908
+
+        Reviewed by Filip Pizlo.
+
+        We can safely combine these two environment when we have
+        a simple parameter list (no default parameters, no destructring parameters).
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        * bytecompiler/BytecodeGenerator.h:
+
+2016-05-19  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix.
+
+        Skipping this new test as it times out on the bots.
+
+        Issue tracked in https://bugs.webkit.org/show_bug.cgi?id=157903
+
+        * tests/stress/regress-157595.js:
+        (MyRegExp):
+
+2016-05-19  Guillaume Emont  <guijemont@igalia.com>
+
+        JSC: DFG::SpeculativeJIT::compile special case for MIPS for PutByValWithThis
+        https://bugs.webkit.org/show_bug.cgi?id=157741
+
+        Reviewed by Saam Barati.
+
+        The PutByValWithThis case needs a special case for MIPS because we
+        don't have enough registers. The special case needs to be different
+        from the x86 one because we have a different ABI.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-05-19  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: use a consistent prefix for injected scripts
+        https://bugs.webkit.org/show_bug.cgi?id=157715
+        <rdar://problem/26287188>
+
+        Reviewed by Timothy Hatcher.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * inspector/InjectedScriptSource.js:
+
+2016-05-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Remove redefined macro after r200606
+        https://bugs.webkit.org/show_bug.cgi?id=157890
+
+        Reviewed by Michael Saboff.
+
+        * bytecode/PolymorphicAccess.cpp:
+        * jit/CCallHelpers.h:
+
+2016-05-18  Saam barati  <sbarati@apple.com>
+
+        Function with default parameter values that are arrow functions that capture this isn't working
+        https://bugs.webkit.org/show_bug.cgi?id=157786
+        <rdar://problem/26327329>
+
+        Reviewed by Geoffrey Garen.
+
+        To make the scopes ordered properly, I needed to initialize the arrow 
+        function lexical environment before initializing default parameter values.
+        I also made the code easier to reason about by never reusing the function's
+        var lexical environment for the arrow function lexical environment. The
+        reason for this is that that code was wrong, and we just didn't have code to
+        that properly tested it. It was easy for that code to be wrong because
+        sometimes the function's lexical environment isn't the top-most scope
+        (namely, when a function's parameter list is non-simple) and sometimes
+        it is (when the function's parameter list is simple).
+
+        Also, because a function's default parameter values may capture the
+        'arguments' variable inside an arrow function, I needed to take care
+        to initialize the 'arguments' variable as part of whichever scope
+        is the top-most scope. It's either the function's var environment
+        if the parameter list is simple, or it's the function's parameter
+        environment if the parameter list is non-simple.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::initializeParameters):
+        (JSC::BytecodeGenerator::initializeVarLexicalEnvironment):
+        (JSC::BytecodeGenerator::visibleNameForParameter):
+        * bytecompiler/BytecodeGenerator.h:
+        * tests/stress/arrow-functions-as-default-parameter-values.js: Added.
+        (assert):
+        (test):
+        (test.foo):
+        * tests/stress/op-push-name-scope-crashes-profiler.js:
+        (test):
+
+2016-05-18  Michael Saboff  <msaboff@apple.com>
+
+        r199812 broke test262
+        https://bugs.webkit.org/show_bug.cgi?id=157595
+
+        Reviewed by Filip Pizlo.
+
+        Added a reasonable limit to the size of the match result array to catch possible
+        infinite loops when matching.
+        Added a new tests that creates an infinite loop in RegExp.prototype.[Symbol.match]
+        by creating a subclass of RegExp where the base RegExp's global flag is false and
+        the subclass overrides .global with a getter that always returns true.
+
+        * builtins/RegExpPrototype.js:
+        (match):
+        * tests/stress/regress-157595.js: Added.
+        (MyRegExp):
+        (MyRegExp.prototype.get global):
+        (test):
+        (catch):
+
+2016-05-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Namespace object re-export should be handled as local export
+        https://bugs.webkit.org/show_bug.cgi?id=157806
+
+        Reviewed by Mark Lam.
+
+        We align the implementation of ExportEntry to the spec; remove Type::Namespace.
+        This Type::Namespace is used for re-exported namespace object binding. For example,
+
+            import * as namespace from "namespace.js"
+            export { namespace }
+
+        In the above case, we used ExportEntry(Type::Namespace). In this patch, we drop this
+        and use normal local export (Type::Local) instead because namespace object actually has
+        the local binding in the above module environment. And this handling strictly meets the
+        spec (Sec 15.2.1.16.1 step 11-a-ii-2-b).
+
+        And we also clean up the ExportEntry implementation; dropping unnecessary information.
+        This change fixes the test262/test/language/module-code/instn-star-equality.js crash.
+
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::exportVariable):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::getExportedNames):
+        (JSC::JSModuleRecord::dump): Deleted.
+        * runtime/JSModuleRecord.h:
+        * tests/modules/namespace-re-export.js: Added.
+        * tests/modules/namespace-re-export/namespace-re-export-fixture.js: Added.
+        * tests/modules/namespace-re-export/namespace-re-export.js: Added.
+        * tests/modules/resources/assert.js:
+        (export.shouldNotBe):
+
+2016-05-17  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should detect the right default locale even when it's not embedded in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=157755
+        rdar://problem/24665424
+
+        Reviewed by Keith Miller.
+        
+        This makes JSC try to use WTF's platform user preferred language detection if the DOM did
+        not register a defaultLanguage callback. The result is that when JSC runs standalone it
+        will detect the platform user preferred language almost the same way as when it's embedded
+        in WebCore. The only difference is that WebCore may have its own additional overrides via
+        the WK API. But in the absence of overrides, WebCore uses the same WTF logic that JSC falls
+        back to.
+        
+        We first found this bug because on iOS, the intl tests would fail because ICU would report
+        a somewhat bogus locale on that platform. Prior to this change, standalone JSC would fall
+        back to ICU's locale detection. It turns out that the ICU default locale is also bogus on
+        OS X, just less so. For example, setting things to Poland did not result in the jsc shell
+        printing dates Polish-style. Now it will print them Polish-style if your system preferences
+        say so. Also, the tests don't fail on iOS anymore.
+        
+        * runtime/IntlObject.cpp:
+        (JSC::defaultLocale):
+
+2016-05-17  Dean Jackson  <dino@apple.com>
+
+        Remove ES6_GENERATORS flag
+        https://bugs.webkit.org/show_bug.cgi?id=157815
+        <rdar://problem/26332894>
+
+        Reviewed by Geoffrey Garen.
+
+        This flag isn't needed. Generators are enabled everywhere and
+        part of a stable specification.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionDeclaration): Deleted.
+        (JSC::Parser<LexerType>::parseClass): Deleted.
+        (JSC::Parser<LexerType>::parseExportDeclaration): Deleted.
+        (JSC::Parser<LexerType>::parseAssignmentExpression): Deleted.
+        (JSC::Parser<LexerType>::parseProperty): Deleted.
+        (JSC::Parser<LexerType>::parseFunctionExpression): Deleted.
+
+2016-05-17  Keith Miller  <keith_miller@apple.com>
+
+        Rollout r200426 since it causes PLT regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=157812
+
+        Unreviewed rollout of r200426 since the bots see a ~.6% PLT regression from the patch.
+
+2016-05-17  Keith Miller  <keith_miller@apple.com>
+
+        Add test262 harness support code
+        https://bugs.webkit.org/show_bug.cgi?id=157797
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds some new tooling needed to run Test262 with the jsc
+        CLI. There were three options that needed to be added for Test262:
+
+        1) "--test262-async" This option overrides the print function in the test runner to look for
+        'Test262:AsyncTestComplete' instead of printing the passed text. If test262-async mode is on
+        and that string is not passed then the test is marked as failing.
+
+        2) "--strict-file=<file>" This option appends `"use strict";\n` to the beginning of the
+        passed file before passing the source code to the VM. This option can, in theory, be passed
+        multiple times.
+
+        3) "--exception=<name>" This option asserts that at the end of the last script file passed
+        the VM has an uncaught exception with its name property equal to the passed name.
+
+        * jsc.cpp:
+        (Script::Script):
+        (fillBufferWithContentsOfFile):
+        (functionPrint):
+        (checkUncaughtException):
+        (runWithScripts):
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        (runJSC):
+
+2016-05-17  Filip Pizlo  <fpizlo@apple.com>
+
+        WTF should know about Language
+        https://bugs.webkit.org/show_bug.cgi?id=157756
+
+        Reviewed by Geoffrey Garen.
+
+        Teach our scripts that a ObjC class beginning with WTF is totally cool.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2016-05-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        console namespace breaks putting properties on console.__proto__
+        https://bugs.webkit.org/show_bug.cgi?id=157782
+        <rdar://problem/26250526>
+
+        Reviewed by Geoffrey Garen.
+
+        Some websites currently depend on console.__proto__ existing and being
+        a separate object from Object.prototype. This patch adds back a basic
+        console.__proto__ object, but all the console functions are left on
+        the ConsoleObject itself.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::createConsoleProperty):
+
+2016-05-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, dump more information when math-pow-stable-results.js failed
+        https://bugs.webkit.org/show_bug.cgi?id=157168
+
+        * tests/stress/math-pow-stable-results.js:
+
+2016-05-16  Saam barati  <sbarati@apple.com>
+
+        ShadowChicken crashes when reading a scope from the frame during a stack overflow exception
+        https://bugs.webkit.org/show_bug.cgi?id=157770
+
+        Reviewed by Filip Pizlo.
+
+        ShadowChicken was reading the scope from a half formed
+        frame as it threw a stack overflow exception. The frame had
+        a valid CodeBlock pointer, but it did not have a valid scope.
+        The code in ShadowChicken's throw packet logging mechanism didn't
+        account for this. The fix is to respect whether genericUnwind wants
+        to unwind from the current frame or the caller's frame. For stack
+        overflow errors, we always unwind the caller's frame.
+
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+
+2016-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION(r200208): It made 2 JSC stress tests fail on x86
+        https://bugs.webkit.org/show_bug.cgi?id=157168
+
+        Reviewed by Benjamin Poulain.
+
+        The fast path in operationMathPow produces different results between x87 and the other environments.
+        This is because x87 calculates the double value in 80bit precision.
+        The situation is the following: in x86 32bit environment, floating point operations are compiled to
+        x87 operations by default even if we can use SSE2. But in DFG environment, we aggressively use SSE2
+        if the cpuid reports SSE2 is available. As a result, the implementations differ between C runtime
+        and DFG JIT code. The C runtime uses x87 while DFG JIT code uses SSE2. This causes a precision
+        problem since x87 has 80bit precision while SSE2 has 64bit precision.
+
+        In this patch, in x86 32bit environment, we use `volatile double` if the `-mfpmath=sse and -msse2 (or later)`
+        is not specified. This will round the x87 value into 64bit per multiplying. Note that this problem does not
+        occur in OS X clang 32bit environment. This is because `-mfpmath=sse` is enabled by default in OS X clang 32bit.
+
+        * b3/B3MathExtras.cpp:
+        (JSC::B3::powDoubleInt32):
+        * runtime/MathCommon.cpp:
+        (JSC::operationMathPow):
+
+2016-05-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] "return this" in a constructor does not need a branch on isObject(this)
+        https://bugs.webkit.org/show_bug.cgi?id=157775
+
+        Reviewed by Saam Barati and Ryosuke Niwa.
+
+        When returning "this" in a constructor, the bytecode generator was generating:
+            is_object         locX, this
+            jtrue             locX, 5(->second ret)
+            ret               this
+            ret               this
+
+        That code is eliminated in DFG but it is pretty costly lower tiers.
+
+        This patch changes bytecode generation to avoid the is_object test
+        when possible and not generate two ret if they encode the same thing.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReturn):
+
+2016-05-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove the index check from op_get_by_val/op_put_by_val when the index is constant
+        https://bugs.webkit.org/show_bug.cgi?id=157766
+
+        Reviewed by Geoffrey Garen.
+
+        If the index is an integer constant, do not generate the index check.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emitSlow_op_put_by_val):
+
+2016-05-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC][DFG] Fill spilled Int32 as Int32 instead of JSInt32
+        https://bugs.webkit.org/show_bug.cgi?id=157700
+
+        Reviewed by Michael Saboff.
+
+        In general, fillSpeculateInt32() originate from SpeculateInt32
+        and the user does not care about the tag.
+
+        This is particularily obvious on Sunspider's math-spectral-norm.js.
+        In that test, registers are frequently spilled because of x86's DIV.
+
+        When they are re-filled, they were always tagged.
+        Since the loops are small, all the tagging adds up.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+
+2016-05-16  Saam barati  <sbarati@apple.com>
+
+        Unreviewed Cloop build fix.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex):
+
+2016-05-16  Saam barati  <sbarati@apple.com>
+
+        Hook up ShadowChicken to the debugger to show tail deleted frames
+        https://bugs.webkit.org/show_bug.cgi?id=156685
+        <rdar://problem/25770521>
+
+        Reviewed by Filip Pizlo and Mark Lam and Joseph Pecoraro.
+
+        The heart of this patch hooks up ShadowChicken to DebuggerCallFrame to
+        allow the Web Inspector to display the ShadowChicken's shadow stack.
+        This means the Web Inspector can now display tail deleted frames.
+        To make this work, I made the necessary changes to ShadowChicken and
+        DebuggerCallFrame to allow DebuggerCallFrame to keep the same API
+        when representing both machine frames and tail deleted frames.
+
+        - ShadowChicken prologue packets now log the current scope. Tail packets
+          log the current scope, the 'this' value, the CodeBlock, and the
+          CallSiteIndex. This allows the inspector to not only show the
+          tail deleted frame, but also show exactly where the tail call happened (line and column numbers),
+          with which scope it executed, and with which 'this' value. This
+          patch also allows DebuggerCallFrame to execute console statements
+          in a tail deleted frame.
+
+        - I changed ShadowChicken's stack resizing algorithm. ShadowChicken
+          now only keeps a maximum number of tail deleted frames in its shadow stack.
+          It will happily represent all machine frames without limit. Right now, the
+          maximum number of tail deleted frames I chose to keep alive is 128.
+          We will keep frames alive starting from the top of the stack. This
+          allows us to have a strong defense against runaway memory usage. We will only
+          keep around at most 128 "shadow" frames that wouldn't have naturally been kept
+          alive by the executing program. We can play around with this number
+          if we find that 128 is either too many or too few frames.
+
+        - DebuggerCallFrame is no longer a cheap class to create. When it is created,
+          we will eagerly create the entire virtual debugger stack. So I modified the
+          existing code to lazily create DebuggerCallFrames only when necessary. We
+          used to eagerly create them at each op_debug statement even though we would
+          just throw them away if we didn't hit a breakpoint.
+
+        - A valid DebuggerCallFrame will always have a valid CallFrame* pointer
+          into the stack. This pointer won't always refer to the logical frame
+          that the DebuggerCallFrame represents because a DebuggerCallFrame can
+          now represent a tail deleted frame. To do this, DebuggerCallFrame now
+          has a ShadowChicken::Frame member variable. This allows DebuggerCallFrame
+          to know when it represents a tail deleted frame and gives DebuggerCallFrame
+          a mechanism to ask the tail deleted frame for interesting information
+          (like its 'this' value, scope, CodeBlock, etc). A tail deleted frame's
+          machine frame pointer will be the machine caller of the tail deleted frame
+          (or the machine caller of the first of a series of consecutive tail calls).
+
+        - I added a new flag to UnlinkedCodeBlock to indicate when it is compiled
+          with debugging opcodes. I did this because ShadowChicken may read a JSScope
+          from the machine stack. This is only safe if the machine CodeBlock was
+          compiled with debugging opcodes. This is safer than asking if the
+          CodeBlock's global object has an interactive debugger enabled because
+          it's theoretically possible for the debugger to be enabled while code
+          compiled without a debugger is still live on the stack. This field is
+          also now used to indicate to the DFGGraph that the interactive debugger
+          is enabled.
+
+        - Finally, this patch adds a new field to the Inspector's CallFrame protocol
+          object called 'isTailDeleted' to allow the Inspector to know when a
+          CallFrame represents a tail deleted frame.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::findPC):
+        (JSC::CodeBlock::bytecodeOffsetFromCallSiteIndex):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearDebuggerRequests):
+        (JSC::CodeBlock::wasCompiledWithDebuggingOpcodes):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::wasCompiledWithDebuggingOpcodes):
+        (JSC::UnlinkedCodeBlock::finishCreation):
+        (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitEnter):
+        (JSC::BytecodeGenerator::emitLogShadowChickenPrologueIfNecessary):
+        (JSC::BytecodeGenerator::emitLogShadowChickenTailIfNecessary):
+        (JSC::BytecodeGenerator::emitCallDefineProperty):
+        * debugger/Debugger.cpp:
+        (JSC::DebuggerPausedScope::DebuggerPausedScope):
+        (JSC::DebuggerPausedScope::~DebuggerPausedScope):
+        (JSC::Debugger::didReachBreakpoint):
+        (JSC::Debugger::currentDebuggerCallFrame):
+        * debugger/Debugger.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::LineAndColumnFunctor::operator()):
+        (JSC::DebuggerCallFrame::create):
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::callerFrame):
+        (JSC::DebuggerCallFrame::globalExec):
+        (JSC::DebuggerCallFrame::vmEntryGlobalObject):
+        (JSC::DebuggerCallFrame::sourceID):
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::scope):
+        (JSC::DebuggerCallFrame::type):
+        (JSC::DebuggerCallFrame::thisValue):
+        (JSC::DebuggerCallFrame::evaluateWithScopeExtension):
+        (JSC::DebuggerCallFrame::invalidate):
+        (JSC::DebuggerCallFrame::currentPosition):
+        (JSC::DebuggerCallFrame::positionForCallFrame):
+        (JSC::DebuggerCallFrame::sourceIDForCallFrame):
+        (JSC::FindCallerMidStackFunctor::FindCallerMidStackFunctor): Deleted.
+        (JSC::FindCallerMidStackFunctor::operator()): Deleted.
+        (JSC::FindCallerMidStackFunctor::getCallerFrame): Deleted.
+        (JSC::DebuggerCallFrame::thisValueForCallFrame): Deleted.
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::isValid):
+        (JSC::DebuggerCallFrame::isTailDeleted):
+        (JSC::DebuggerCallFrame::create): Deleted.
+        (JSC::DebuggerCallFrame::exec): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::~Graph):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::addCallSite):
+        (JSC::DFG::JITCompiler::emitStoreCodeOrigin):
+        (JSC::DFG::JITCompiler::emitStoreCallSiteIndex):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileLogShadowChickenPrologue):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLogShadowChickenTail):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRecordRegExpCachedResult):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::ensureShadowChickenPacket):
+        (JSC::FTL::DFG::LowerDFGToB3::setupShadowChickenPacket): Deleted.
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.CallFrameProxy):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::thisObject):
+        (Inspector::JSJavaScriptCallFrame::isTailDeleted):
+        (Inspector::JSJavaScriptCallFrame::type):
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension):
+        (Inspector::jsJavaScriptCallFrameAttributeType):
+        (Inspector::jsJavaScriptCallFrameIsTailDeleted):
+        * inspector/JavaScriptCallFrame.h:
+        (Inspector::JavaScriptCallFrame::type):
+        (Inspector::JavaScriptCallFrame::scopeChain):
+        (Inspector::JavaScriptCallFrame::vmEntryGlobalObject):
+        (Inspector::JavaScriptCallFrame::isTailDeleted):
+        (Inspector::JavaScriptCallFrame::thisValue):
+        (Inspector::JavaScriptCallFrame::evaluateWithScopeExtension):
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction):
+        * inspector/protocol/Debugger.json:
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::update):
+        (JSC::ShadowChicken::visitChildren):
+        (JSC::ShadowChicken::reset):
+        * interpreter/ShadowChicken.h:
+        (JSC::ShadowChicken::Packet::throwMarker):
+        (JSC::ShadowChicken::Packet::prologue):
+        (JSC::ShadowChicken::Packet::tail):
+        (JSC::ShadowChicken::Frame::Frame):
+        (JSC::ShadowChicken::Frame::operator==):
+        * jit/CCallHelpers.cpp:
+        (JSC::CCallHelpers::logShadowChickenProloguePacket):
+        (JSC::CCallHelpers::logShadowChickenTailPacket):
+        (JSC::CCallHelpers::ensureShadowChickenPacket):
+        (JSC::CCallHelpers::setupShadowChickenPacket): Deleted.
+        * jit/CCallHelpers.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_type):
+        (JSC::JIT::emit_op_log_shadow_chicken_prologue):
+        (JSC::JIT::emit_op_log_shadow_chicken_tail):
+        (JSC::JIT::emit_op_get_enumerable_length):
+        (JSC::JIT::emit_op_resume):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_type):
+        (JSC::JIT::emit_op_log_shadow_chicken_prologue):
+        (JSC::JIT::emit_op_log_shadow_chicken_tail):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::webAssemblyCalleeSaveRegisters):
+        (JSC::RegisterSet::argumentGPRS):
+        (JSC::RegisterSet::registersToNotSaveForJSCall):
+        * jit/RegisterSet.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        * runtime/Options.h:
+        * tests/stress/shadow-chicken-enabled.js:
+        (test5a.foo):
+        (test5a):
+        (test5b.foo):
+        (test5b):
+        (test6.foo):
+        (test6):
+
+2016-05-16  Saam barati  <sbarati@apple.com>
+
+        TypeSet/StructureShape have a flawed sense of JS prototype chains
+        https://bugs.webkit.org/show_bug.cgi?id=157760
+
+        Reviewed by Joseph Pecoraro.
+
+        There was an assumption that we would bottom out in "Object". This is
+        not true for many reasons. JS objects may not end in Object.prototype.
+        Also, our mechanism of grabbing an Object's class name may also not
+        bottom out in "Object". We were seeing this in the JS objects we use
+        in the InjectedScriptSource.js inspector script.
+
+        * runtime/TypeSet.cpp:
+        (JSC::StructureShape::leastCommonAncestor):
+        * tests/typeProfiler/weird-prototype-chain.js: Added.
+        (wrapper.foo):
+        (wrapper.let.o2):
+        (wrapper):
+
+2016-05-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout r200924. Caused js/regress/string-replace-generic.html to fail.
+
+        * API/JSProfilerPrivate.cpp: Copied from Source/JavaScriptCore/profiler/ProfilerJettisonReason.h.
+        (JSStartProfiling):
+        (JSEndProfiling):
+        * API/JSProfilerPrivate.h: Copied from Source/JavaScriptCore/profiler/ProfilerJettisonReason.h.
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::profileHookRegister):
+        (JSC::BytecodeGenerator::shouldEmitProfileHooks):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallArguments::CallArguments):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::callFunctionWithEvalEnabled):
+        * inspector/protocol/Timeline.json:
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::operator()):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ParserModes.h:
+        * profiler/CallIdentifier.h: Added.
+        (JSC::CallIdentifier::CallIdentifier):
+        (JSC::CallIdentifier::functionName):
+        (JSC::CallIdentifier::url):
+        (JSC::CallIdentifier::lineNumber):
+        (JSC::CallIdentifier::columnNumber):
+        (JSC::CallIdentifier::operator==):
+        (JSC::CallIdentifier::operator!=):
+        (JSC::CallIdentifier::Hash::hash):
+        (JSC::CallIdentifier::Hash::equal):
+        (JSC::CallIdentifier::hash):
+        (JSC::CallIdentifier::operator const char*):
+        (JSC::CallIdentifier::c_str):
+        (WTF::HashTraits<JSC::CallIdentifier>::constructDeletedValue):
+        (WTF::HashTraits<JSC::CallIdentifier>::isDeletedValue):
+        * profiler/LegacyProfiler.cpp: Added.
+        (JSC::LegacyProfiler::profiler):
+        (JSC::LegacyProfiler::startProfiling):
+        (JSC::LegacyProfiler::stopProfiling):
+        (JSC::callFunctionForProfilesWithGroup):
+        (JSC::LegacyProfiler::suspendProfiling):
+        (JSC::LegacyProfiler::unsuspendProfiling):
+        (JSC::LegacyProfiler::willExecute):
+        (JSC::LegacyProfiler::didExecute):
+        (JSC::LegacyProfiler::exceptionUnwind):
+        (JSC::LegacyProfiler::createCallIdentifier):
+        (JSC::createCallIdentifierFromFunctionImp):
+        * profiler/LegacyProfiler.h: Added.
+        (JSC::LegacyProfiler::currentProfiles):
+        * profiler/Profile.cpp: Added.
+        (JSC::Profile::create):
+        (JSC::Profile::Profile):
+        (JSC::Profile::~Profile):
+        (JSC::Profile::debugPrint):
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintSampleStyle):
+        * profiler/Profile.h: Copied from Source/JavaScriptCore/profiler/ProfilerJettisonReason.h.
+        * profiler/ProfileGenerator.cpp: Added.
+        (JSC::ProfileGenerator::create):
+        (JSC::ProfileGenerator::ProfileGenerator):
+        (JSC::AddParentForConsoleStartFunctor::AddParentForConsoleStartFunctor):
+        (JSC::AddParentForConsoleStartFunctor::foundParent):
+        (JSC::AddParentForConsoleStartFunctor::operator()):
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        (JSC::ProfileGenerator::title):
+        (JSC::ProfileGenerator::beginCallEntry):
+        (JSC::ProfileGenerator::endCallEntry):
+        (JSC::ProfileGenerator::willExecute):
+        (JSC::ProfileGenerator::didExecute):
+        (JSC::ProfileGenerator::exceptionUnwind):
+        (JSC::ProfileGenerator::stopProfiling):
+        (JSC::ProfileGenerator::removeProfileStart):
+        (JSC::ProfileGenerator::removeProfileEnd):
+        * profiler/ProfileGenerator.h: Added.
+        (JSC::ProfileGenerator::profile):
+        (JSC::ProfileGenerator::origin):
+        (JSC::ProfileGenerator::profileGroup):
+        (JSC::ProfileGenerator::setIsSuspended):
+        * profiler/ProfileNode.cpp: Added.
+        (JSC::ProfileNode::ProfileNode):
+        (JSC::ProfileNode::addChild):
+        (JSC::ProfileNode::removeChild):
+        (JSC::ProfileNode::spliceNode):
+        (JSC::ProfileNode::traverseNextNodePostOrder):
+        (JSC::ProfileNode::debugPrint):
+        (JSC::ProfileNode::debugPrintSampleStyle):
+        (JSC::ProfileNode::debugPrintRecursively):
+        (JSC::ProfileNode::debugPrintSampleStyleRecursively):
+        * profiler/ProfileNode.h: Added.
+        (JSC::ProfileNode::create):
+        (JSC::ProfileNode::Call::Call):
+        (JSC::ProfileNode::Call::startTime):
+        (JSC::ProfileNode::Call::setStartTime):
+        (JSC::ProfileNode::Call::elapsedTime):
+        (JSC::ProfileNode::Call::setElapsedTime):
+        (JSC::ProfileNode::operator==):
+        (JSC::ProfileNode::callerCallFrame):
+        (JSC::ProfileNode::callIdentifier):
+        (JSC::ProfileNode::id):
+        (JSC::ProfileNode::functionName):
+        (JSC::ProfileNode::url):
+        (JSC::ProfileNode::lineNumber):
+        (JSC::ProfileNode::columnNumber):
+        (JSC::ProfileNode::parent):
+        (JSC::ProfileNode::setParent):
+        (JSC::ProfileNode::calls):
+        (JSC::ProfileNode::lastCall):
+        (JSC::ProfileNode::appendCall):
+        (JSC::ProfileNode::children):
+        (JSC::ProfileNode::firstChild):
+        (JSC::ProfileNode::lastChild):
+        (JSC::ProfileNode::nextSibling):
+        (JSC::ProfileNode::setNextSibling):
+        (JSC::ProfileNode::forEachNodePostorder):
+        (JSC::CalculateProfileSubtreeDataFunctor::operator()):
+        (JSC::CalculateProfileSubtreeDataFunctor::returnValue):
+        * profiler/ProfilerJettisonReason.cpp:
+        (WTF::printInternal):
+        * profiler/ProfilerJettisonReason.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        * runtime/CodeCache.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::hasLegacyProfiler):
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsLegacyProfiling):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::SetEnabledProfilerFunctor::operator()):
+        (JSC::VM::setEnabledProfiler):
+        * runtime/VM.h:
+        (JSC::VM::enabledProfiler):
+        (JSC::VM::enabledProfilerAddress):
+
+2016-05-16  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Unreviewed, fixed typo in a comment.
+
+        * assembler/MacroAssembler.h: Replaced "onvenience" with
+        "convenience".
+
+2016-05-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FixupPhase should be more eager to demote bit math to untyped
+        https://bugs.webkit.org/show_bug.cgi?id=157746
+
+        Reviewed by Mark Lam.
+        
+        This just makes the logic for how we fixup bit math match the way we do it in other places.
+        This doesn't affect performance on any major benchmark but it's a big win on new
+        microbenchmarks added in this change.
+        
+        Details:
+
+        object-and                                     11.1610+-0.7602     ^      4.8105+-0.1690        ^ definitely 2.3201x faster
+        object-or                                      11.0845+-0.2487     ^      4.7146+-0.0374        ^ definitely 2.3511x faster
+        object-xor                                     10.2946+-0.9946     ^      4.7278+-0.0814        ^ definitely 2.1775x faster
+        object-lshift                                  10.4896+-1.0867     ^      4.7699+-0.0721        ^ definitely 2.1991x faster
+        object-rshift                                  11.1239+-0.5010     ^      4.7194+-0.0445        ^ definitely 2.3570x faster
+        object-urshift                                 10.9745+-0.1315     ^      4.7848+-0.0479        ^ definitely 2.2936x faster
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2016-05-15  Michael Saboff  <msaboff@apple.com>
+
+        RegExp /y flag incorrect handling of mixed-length alternation
+        https://bugs.webkit.org/show_bug.cgi?id=157723
+
+        Reviewed by Filip Pizlo.
+
+        Previously for sticky patterns, we were bailing out and exiting when backtracking
+        alternatives with dissimilar match lengths.  Deleted that code.  Instead, for
+        sticky patterns we need to process the backtracking except for advancing to the
+        next input index.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::backtrack):
+
+2016-05-15  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::Plan shouldn't read from its VM once it's been cancelled
+        https://bugs.webkit.org/show_bug.cgi?id=157726
+
+        Reviewed by Saam Barati.
+        
+        Plan::vm was a reference, not a pointer, and so wasn't nulled by Plan::cancel(). So, a
+        cancelled plan may have a dangling pointer to a VM: we could delete the VM after cancelling
+        the plan.
+        
+        Prior to http://trac.webkit.org/changeset/200705, this was probably fine because nobody
+        would read Plan::vm if the plan was cancelled. But r200705 changed that. It was a hard
+        regression to spot because usually a cancelled plan will still refer to a valid VM.
+        
+        This change fixes the regression and makes it a lot easier to spot the regression in the
+        future. Plan::vm is now a pointer and we null it in Plan::cancel(). Now if you make this
+        mistake, you will get a crash anytime the Plan is cancelled, not just anytime the plan is
+        cancelled and the VM gets deleted. Also, it's now very clear what to do when you want to
+        use Plan::vm on the cancel path: you can null-check vm; if it's null, assume the worst.
+        
+        Because we null the VM of a cancelled plan, we cannot have Safepoint::vm() return the
+        plan's VM anymore. That's because when we cancel a plan that is at a safepoint, we use the
+        safepoint's VM to determine whether this is one of our safepoints *after* the plan is
+        already cancelled. So, Safepoint now has its own copy of m_vm, and that copy gets nulled
+        when the Safepoint is cancelled. The Safepoint's m_vm will be nulled moments after Plan's
+        vm gets nulled (see Worklist::removeDeadPlans(), which has a cancel path for Plans in one
+        loop and a cancel path for Safepoints in the loop after it).
+
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        (JSC::DFG::Plan::computeCompileTimes):
+        (JSC::DFG::Plan::reportCompileTimes):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::reallyAdd):
+        (JSC::DFG::Plan::notifyCompiling):
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        (JSC::DFG::Plan::cancel):
+        * dfg/DFGPlan.h:
+        (JSC::DFG::Plan::canTierUpAndOSREnter):
+        * dfg/DFGSafepoint.cpp:
+        (JSC::DFG::Safepoint::cancel):
+        (JSC::DFG::Safepoint::vm):
+        * dfg/DFGSafepoint.h:
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::isActiveForVM):
+        (JSC::DFG::Worklist::waitUntilAllPlansForVMAreReady):
+        (JSC::DFG::Worklist::removeAllReadyPlansForVM):
+        (JSC::DFG::Worklist::rememberCodeBlocks):
+        (JSC::DFG::Worklist::visitWeakReferences):
+        (JSC::DFG::Worklist::removeDeadPlans):
+        (JSC::DFG::Worklist::runThread):
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+
+2016-05-15  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Modernize Intl constructors; using InternalFunction::createSubclassStructure
+        https://bugs.webkit.org/show_bug.cgi?id=157082
+
+        Reviewed by Darin Adler.
+
+        Previously, Intl constructors retrieve "prototype" to inherit the "new.target".
+        At that time, this mis-assumed that getDirect() always returns meaningful JS value.
+        Actually, it returns an empty value if a property does not exist.
+
+        Instead of fixing this assertion, we now use InternalFunction::createSubclassStructure
+        in Intl constructors. It is modern and preferable way since it can cache the derived
+        structures in InternalFunction.
+
+        This patch also cleans up the workaround in Intl.NumberFormat and Intl.DateTimeFormat.
+        Those code are largely duplicate. This is now extracted into
+        constructIntlInstanceWithWorkaroundForLegacyIntlConstructor. This clean up does not
+        have any behavior changes. They are already tested in LayoutTests/js/intl-datetimeformat
+        and LayoutTests/js/intl-numberformat.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::create):
+        * runtime/IntlCollator.h:
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        (JSC::callIntlCollator):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::create):
+        * runtime/IntlDateTimeFormat.h:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        (JSC::callIntlDateTimeFormat):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::create):
+        * runtime/IntlNumberFormat.h:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        (JSC::callIntlNumberFormat):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObjectInlines.h: Added.
+        (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):
+        * tests/stress/intl-constructors-with-proxy.js: Added.
+        (shouldBe):
+        (throw.new.Error.Empty):
+        (throw.new.Error):
+        (shouldBe.Empty):
+
+2016-05-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove LegacyProfiler
+        https://bugs.webkit.org/show_bug.cgi?id=153565
+
+        Reviewed by Mark Lam.
+
+        JavaScriptCore now provides a sampling profiler and it is enabled
+        by all ports. Web Inspector switched months ago to using the
+        sampling profiler and displaying its data. Remove the legacy
+        profiler, as it is no longer being used by anything other then
+        console.profile and tests. We will update console.profile's
+        behavior soon to have new behavior and use the sampling data.
+
+        * API/JSProfilerPrivate.cpp: Removed.
+        * API/JSProfilerPrivate.h: Removed.
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset): Deleted.
+        (JSC::computeDefsForBytecodeOffset): Deleted.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        (JSC::BytecodeGenerator::emitConstructVarargs):
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::CallArguments::profileHookRegister): Deleted.
+        (JSC::BytecodeGenerator::shouldEmitProfileHooks): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::CallArguments::CallArguments): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock): Deleted.
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): Deleted.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC): Deleted.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::callFunctionWithEvalEnabled):
+        * inspector/protocol/Timeline.json:
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::operator()): Deleted.
+        (JSC::Interpreter::execute): Deleted.
+        (JSC::Interpreter::executeCall): Deleted.
+        (JSC::Interpreter::executeConstruct): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Deleted.
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_will_call): Deleted.
+        (JSC::JIT::emit_op_profile_did_call): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_will_call): Deleted.
+        (JSC::JIT::emit_op_profile_did_call): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Deleted.
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ParserModes.h:
+        * profiler/CallIdentifier.h: Removed.
+        * profiler/LegacyProfiler.cpp: Removed.
+        * profiler/LegacyProfiler.h: Removed.
+        * profiler/Profile.cpp: Removed.
+        * profiler/Profile.h: Removed.
+        * profiler/ProfileGenerator.cpp: Removed.
+        * profiler/ProfileGenerator.h: Removed.
+        * profiler/ProfileNode.cpp: Removed.
+        * profiler/ProfileNode.h: Removed.
+        * profiler/ProfilerJettisonReason.cpp:
+        (WTF::printInternal): Deleted.
+        * profiler/ProfilerJettisonReason.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        * runtime/CodeCache.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        (JSC::JSGlobalObject::~JSGlobalObject): Deleted.
+        (JSC::JSGlobalObject::hasLegacyProfiler): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsLegacyProfiling): Deleted.
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM): Deleted.
+        (JSC::SetEnabledProfilerFunctor::operator()): Deleted.
+        (JSC::VM::setEnabledProfiler): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::enabledProfiler): Deleted.
+        (JSC::VM::enabledProfilerAddress): Deleted.
+
+2016-05-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        jsc: samplingProfilerStackTraces() without starting sampling should not cause jsc to crash
+        https://bugs.webkit.org/show_bug.cgi?id=157704
+
+        Reviewed by Saam Barati.
+
+        * jsc.cpp:
+        (functionStartSamplingProfiler):
+        (functionSamplingProfilerStackTraces):
+        Throw an exception instead of crashing if we haven't started sampling.
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::startTracking):
+        * runtime/VM.h:
+        * runtime/VM.cpp:
+        (JSC::VM::ensureSamplingProfiler):
+        Switch ensure to returning a reference, like most other ensures.
+
+2016-05-13  Saam barati  <sbarati@apple.com>
+
+        DFG/FTL have a few bugs in their reasoning about the scope
+        https://bugs.webkit.org/show_bug.cgi?id=157696
+
+        Reviewed by Benjamin Poulain.
+
+        1. When the debugger is enabled, it is easier for the DFG to reason
+        about the scope register by simply claiming all nodes read the scope
+        register. This prevents us from ever entering the runtime where we
+        may take a stack trace but there isn't a scope on the stack.
+
+        2. This patch fixes a bug where the FTL compilation wasn't properly
+        setting the CodeBlock register. It was only doing this when there
+        was inline data, but when the debugger is enabled, we never inline.
+        So this code just needed to be removed from that loop. It was never
+        right for it to be inside the loop.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+
+2016-05-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] SetLocal without exit do not need phantoms
+        https://bugs.webkit.org/show_bug.cgi?id=157653
+
+        Reviewed by Filip Pizlo.
+
+        I made a mistake in r200498.
+
+        If a SetLocal cannot possibly exit, we were not clearing
+        the source of the operand. As a result, we sometime kept
+        a value alive up to the end of the block.
+
+        That's uncommon because SetLocal typically appear
+        toward the end of blocks. That's probably why there was
+        no perf impact with that fix.
+
+        * dfg/DFGPhantomInsertionPhase.cpp:
+
+2016-05-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Move the CheckTierUp function calls out of the main path
+        https://bugs.webkit.org/show_bug.cgi?id=157668
+
+        Reviewed by Mark Lam.
+
+        If you have a tiny tiny loop (for example, Sunspider's bits-in-byte),
+        the size of CheckTierUp is a problem.
+
+        On multi-issue CPUs, the node is so big that we do not
+        get to run anything from the loop in the instruction fetch.
+
+        On x86, having a bigger loop also pushes us out of the LSD.
+
+        This is a 6% improvement on bits-in-byte. Other Sunspider tests
+        only improves marginally.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::silentSpill):
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-05-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Emit the loads of emitLoadWithStructureCheck() in the order they are used
+        https://bugs.webkit.org/show_bug.cgi?id=157671
+
+        Reviewed by Mark Lam.
+
+        This improves the chances of having a value
+        when issuing the TEST.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitLoadWithStructureCheck):
+
+2016-05-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Inform augmenting client when inspector controller is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=157688
+        <rdar://problem/25832724>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::~JSGlobalObjectInspectorController):
+        * inspector/augmentable/AugmentableInspectorControllerClient.h:
+        There is a weak relationship between the InspectorController and the
+        AugmentingClient. Let the augmenting client know when the controller
+        is destroyed so it doesn't try to use us anymore.
+
+2016-05-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Runaway malloc memory usage in this simple JSC program
+        https://bugs.webkit.org/show_bug.cgi?id=157682
+
+        Reviewed by Mark Lam.
+
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::sweep): Whenever we might add a block to
+        m_logicallyEmptyWeakBlocks, be sure also to sweep a block in
+        m_logicallyEmptyWeakBlocks. Otherwise, additions might outpace removals
+        even when all memory is freed.
+
+        We do this whenever we *might* add a block and not just whenever we *do*
+        add a block because we'd like to sweep the entries in
+        m_logicallyEmptyWeakBlocks promptly even when it's not growing, and this
+        is a reasonably rate-limited opportunity to do so.
+
+2016-05-13  Mark Lam  <mark.lam@apple.com>
+
+        We should have one calleeSaveRegistersBuffer per VMEntryFrame, not one per VM.
+        https://bugs.webkit.org/show_bug.cgi?id=157537
+        <rdar://problem/24794845>
+
+        Reviewed by Michael Saboff.
+
+        The pre-existing code behaves this way:
+
+        1. When JS code throws an exception, it saves callee save registers in
+           the VM calleeSaveRegistersBuffer.  These values are meant to be restored
+           to the callee save registers later either at the catch handler or at the
+           uncaught exception handler.
+
+        2. If the Inspector is enable, the VM will invoke inspector C++ code to inspect
+           the exception.  That C++ code can change the values of the callee save
+           registers.
+
+           The inspector code in turn re-enters the VM to execute JS inspector code.
+
+           The JS inspector code can run hot enough that we do an enterOptimizationCheck
+           on it.  The enterOptimizationCheck first saves all callee save registers
+           into the VM calleeSaveRegistersBuffer.
+
+           This effectively overwrites the values in the VM calleeSaveRegistersBuffer
+           from (1).
+
+        3. Eventually, execution returns to the catch handler or the uncaught exception
+           handler which restores the overwritten values in the VM
+           calleeSaveRegistersBuffer to the callee save registers.
+
+           When execution returns to the C++ code that entered the VM before (1), the
+           values in the callee registers are not what that code expects, and badness
+           and/or crashes ensues.
+
+        This patch applies the following fix:
+        
+        1. Allocate space in the VMEntryFrame for the calleeSaveRegistersBuffer.
+           This ensures that each VM entry session has its own buffer to use, and will
+           not corrupt the one from the previous VM entry session.
+
+           Delete the VM calleeSaveRegistersBuffer.
+
+        2. Change all locations that uses the VM calleeSaveRegistersBuffer to use the
+           calleeSaveRegistersBuffer in the current VMEntryFrame.
+
+        3. Renamed all uses of the term "VMCalleeSavesBuffer" to
+           "VMEntryFrameCalleeSavesBuffer".
+
+        This fix has been tested on the following configurations:
+        1. JSC and layout tests on a debug ASan build for 64-bit x86_64.
+        2. JSC tests on a release ASan build for 32-bit x86.
+        3. JSC tests on a release normal (non-ASan) build for ARM64.
+        4. JSC tests on a release normal (non-ASan) build for ARMv7 and ARMv7s.
+        5. JSC tests on a release ASan CLOOP build for x86_64.
+
+        These test runs did not produce any new crashes.  The ASan CLOOP has some
+        pre-existing crashes which are not due to this patch.
+
+        This bug can be tested by running the inspector/debugger/regress-133182.html test
+        on an ASan build.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::emitExplicitExceptionHandler):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileExceptionHandlers):
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrEntryThunkGenerator):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * interpreter/Interpreter.cpp:
+        (JSC::UnwindFunctor::operator()):
+        (JSC::UnwindFunctor::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
+        (JSC::UnwindFunctor::copyCalleeSavesToVMCalleeSavesBuffer): Deleted.
+        * interpreter/Interpreter.h:
+        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
+        * interpreter/VMEntryRecord.h:
+        (JSC::VMEntryRecord::calleeSaveRegistersBufferOffset):
+        (JSC::VMEntryRecord::prevTopCallFrame):
+        (JSC::VMEntryRecord::unsafePrevTopCallFrame):
+        (JSC::VMEntryFrame::vmEntryRecordOffset):
+        (JSC::VMEntryFrame::calleeSaveRegistersBufferOffset):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitRandomThunk):
+        (JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer): Deleted.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitRestoreSavedTagRegisters):
+        (JSC::AssemblyHelpers::copyCalleeSavesToVMEntryFrameCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::copyCalleeSavesToVMCalleeSavesBuffer): Deleted.
+        (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMCalleeSavesBuffer): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::emitEnterOptimizationCheck):
+        (JSC::JIT::privateCompileExceptionHandlers):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_throw):
+        (JSC::JIT::emit_op_catch):
+        * jit/ThunkGenerators.cpp:
+        (JSC::throwExceptionFromCallSlowPathGenerator):
+        (JSC::nativeForGenerator):
+        * llint/LLIntThunks.cpp:
+        (JSC::vmEntryRecord):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/VM.h:
+        (JSC::VM::getCTIStub):
+        (JSC::VM::calleeSaveRegistersBufferOffset): Deleted.
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::endFunction):
+
+2016-05-13  Beth Dakin  <bdakin@apple.com>
+
+        Add dyldSPI.h for linked on or after checks, and add one for link preview
+        https://bugs.webkit.org/show_bug.cgi?id=157401
+        -and corresponding-
+        rdar://problem/26253396
+
+        Reviewed by Darin Adler.
+
+        Import #import <wtf/spi/darwin/dyldSPI.h> which now declares all of the 
+        needed dyld code.
+        * API/JSWrapperMap.mm:
+
+2016-05-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Assertion failure for direct eval in non-class method
+        https://bugs.webkit.org/show_bug.cgi?id=157138
+
+        Reviewed by Saam Barati.
+
+        This assertion was incorrect. In method definitions in object literals,
+        it can be sloppy mode, but its DerivedContextType may not be DerivedContextType::None.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::CacheKey::CacheKey):
+        (JSC::EvalCodeCache::CacheKey::operator==):
+        (JSC::EvalCodeCache::CacheKey::Hash::equal):
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * tests/stress/direct-eval-in-object-literal-methods.js: Added.
+        (shouldBe):
+        (throw.new.Error):
+        (shouldBe.Parent.prototype.l):
+        (shouldBe.Parent):
+        (shouldBe.Derived.prototype.m):
+        (shouldBe.Derived):
+
+2016-05-13  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        Assertion failure for super() call in arrow function default parameters
+        https://bugs.webkit.org/show_bug.cgi?id=157079
+
+        Reviewed by Saam Barati.
+
+        Root of the issue that in arrow function we load bounded variables this/super/new.target just after 
+        input parameters were initialized, and did not covered case of default values for 
+        function parameters. 
+        Current patch tried to fix issue and allow to load bounded variables earlier, before the input 
+        parameters are assigned by default values.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * tests/stress/arrowfunction-lexical-bind-this-2.js:
+
+2016-05-12  Mark Lam  <mark.lam@apple.com>
+
+        Baseline and DFG's JSC_report...CompileTimes needs CodeBlock hashes.
+        https://bugs.webkit.org/show_bug.cgi?id=157643
+
+        Reviewed by Keith Miller.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-05-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove ENABLE(ES6_ARROWFUNCTION_SYNTAX) guards
+        https://bugs.webkit.org/show_bug.cgi?id=157564
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * parser/Parser.cpp:
+
+2016-05-12  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: CRASH getting internal properties of function with no bound arguments causes
+        https://bugs.webkit.org/show_bug.cgi?id=157613
+        <rdar://problem/26238754>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        Gracefully handle a JSBoundFunction with no bound arguments.
+        In this case boundArgs is JSValue() which we don't want to
+        expose as the value of the internal property.
+
+2016-05-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make sure StringRange is passed to Vector by register
+        https://bugs.webkit.org/show_bug.cgi?id=157603
+
+        Reviewed by Darin Adler.
+
+        This is bizarre, but on my SDK, Vector::append(StringRange)
+        is passing the values on the stack.
+        The two integers are written to the stack, the address given
+        to append(), then append() reads it back and store it.
+
+        This patch changes the code to use constructAndAppend(), ensuring
+        the values are used directly.
+
+        On my machine, this helps Sunspider and Octane.
+        This might be something wrong with my SDK but the fix is so easy
+        that we might as well do this.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::removeUsingRegExpSearch):
+        (JSC::replaceUsingRegExpSearch):
+
+2016-05-11  Zan Dobersek  <zdobersek@igalia.com>
+
+        ARMv7Assembler: suppress a -Wnarrowing warning when compiling with GCC
+        https://bugs.webkit.org/show_bug.cgi?id=157576
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::revertJumpTo_movT3movtcmpT2): Explicitly cast the
+        `OP_CMP_reg_T2 | left` value to uint16_t, avoiding a narrowing conversion
+        warning that's being reported when compiling with GCC. The warning is sprung
+        due to RegisterID (which is the type of `left`) being an enum based on int,
+        even when the enum itself only declares 23 values.
+
+2016-05-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: `this` in Scope Chain Sidebar does not have preview, looks poor
+        https://bugs.webkit.org/show_bug.cgi?id=157602
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.CallFrameProxy):
+        Include a preview when creating the RemoteObject for `this`.
+
+2016-05-11  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, correct the title of the ChangeLog for r200667.
+
+2016-05-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSC test stress/reflect-set.js failing after 200694
+        https://bugs.webkit.org/show_bug.cgi?id=157586
+
+        Unreviewed test rebaseline.
+
+        * tests/stress/reflect-set.js:
+        Update the expected error message. We are in strict mode, so the
+        improved error message makes sense.
+
+2016-05-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Beef up JSC profiler event log
+        https://bugs.webkit.org/show_bug.cgi?id=157584
+
+        Reviewed by Saam Barati.
+        
+        Also log more about compilation.
+
+        * bytecode/ExecutionCounter.cpp: Changed the meaning of codeBlock to be the codeBlock that is doing the profiling. This will now get the baseline version if it needs it. This is needed for logging the threshold checking event.
+        (JSC::applyMemoryUsageHeuristics):
+        (JSC::ExecutionCounter<countingVariant>::hasCrossedThreshold):
+        * dfg/DFGJITCode.cpp: Pass the right codeBlock.
+        (JSC::DFG::JITCode::checkIfOptimizationThresholdReached):
+        (JSC::DFG::JITCode::optimizeNextInvocation):
+        (JSC::DFG::JITCode::dontOptimizeAnytimeSoon):
+        (JSC::DFG::JITCode::optimizeSoon):
+        (JSC::DFG::JITCode::forceOptimizationSlowPathConcurrently):
+        * dfg/DFGPlan.cpp: Log things about compile times and whether the compiler succeeded or failed.
+        (JSC::DFG::Plan::computeCompileTimes):
+        (JSC::DFG::Plan::reportCompileTimes):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Make it possible to look at memory usage, though separately from the log, for now.
+        (JSC::ExecutableAllocator::allocate):
+        * runtime/Options.h:
+
+2016-05-11  Saam barati  <sbarati@apple.com>
+
+        Air may decide to put the result register of an arithmetic snippet in the tag register
+        https://bugs.webkit.org/show_bug.cgi?id=157548
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds a new ValueRep to B3 called LateRegister. The semantics
+        are similar to Register in that it can be used to pin an argument to
+        a particular register. It differs from ValueRep::Register in that the semantics of
+        LateRegister are that it is used after the result of the node its an argument to
+        is computed. This means that a LateRegister argument will interfere with the result
+        of a node. LateRegister is not a valid result ValueRep.
+
+        This was needed because there was a bug where B3/Air would assign the
+        result of a patchpoint to the TagTypeNumber register. This broke our
+        code when we would box a double into a JSValue in a snippet when the
+        result is the same as the TagTypeNumber register. To fix the issue,
+        we pass TagMaskRegister and TagTypeNumberRegister as ValueRep::LateRegister
+        arguments to various patchpoints.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::admitsStack):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        (JSC::B3::StackmapSpecial::isArgValidForRep):
+        * b3/B3Validate.cpp:
+        * b3/B3ValueRep.cpp:
+        (JSC::B3::ValueRep::addUsedRegistersTo):
+        (JSC::B3::ValueRep::dump):
+        (JSC::B3::ValueRep::emitRestore):
+        (JSC::B3::ValueRep::recoveryForJSValue):
+        (WTF::printInternal):
+        * b3/B3ValueRep.h:
+        (JSC::B3::ValueRep::reg):
+        (JSC::B3::ValueRep::lateReg):
+        (JSC::B3::ValueRep::stack):
+        (JSC::B3::ValueRep::operator==):
+        (JSC::B3::ValueRep::isSomeRegister):
+        (JSC::B3::ValueRep::isReg):
+        * b3/testb3.cpp:
+        (JSC::B3::testSpillUseLargerThanDef):
+        (JSC::B3::testLateRegister):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        (JSC::FTL::DFG::LowerDFGToB3::emitBinarySnippet):
+        (JSC::FTL::DFG::LowerDFGToB3::emitBinaryBitOpSnippet):
+        (JSC::FTL::DFG::LowerDFGToB3::emitRightShiftSnippet):
+
+2016-05-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Improve error messages for accessing arguments.callee and similar getters in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=157545
+
+        Reviewed by Mark Lam.
+
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        (JSC::ClonedArguments::materializeSpecials):
+        Provide better error GetterSetter in strict mode.
+
+        * runtime/JSFunction.cpp:
+        (JSC::getThrowTypeErrorGetterSetter):
+        (JSC::JSFunction::defineOwnProperty):
+        Provide better error GetterSetter in strict mode.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::throwTypeErrorGetterSetter):
+        (JSC::JSGlobalObject::throwTypeErrorCalleeAndCallerGetterSetter):
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsAndCallerInStrictModeGetterSetter):
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsAndCallerInClassContextGetterSetter):
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsAndCallerGetterSetter): Deleted.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncThrowTypeErrorCalleeAndCaller):
+        (JSC::globalFuncThrowTypeErrorArgumentsAndCallerInStrictMode):
+        (JSC::globalFuncThrowTypeErrorArgumentsAndCallerInClassContext):
+        (JSC::globalFuncThrowTypeErrorArgumentsAndCaller): Deleted.
+        * runtime/JSGlobalObjectFunctions.h:
+        Rename and expose new handles for new error getter setter native functions.
+
+2016-05-11  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r200481.
+        https://bugs.webkit.org/show_bug.cgi?id=157573
+
+        it's bad news for asm.js (Requested by pizlo on #webkit).
+
+        Reverted changeset:
+
+        "Reduce maximum JIT pool size on X86_64."
+        http://trac.webkit.org/changeset/200481
+
+2016-05-10  Keith Miller  <keith_miller@apple.com>
+
+        TypedArray.prototype.slice should not use the byteLength of the passed array for memmove
+        https://bugs.webkit.org/show_bug.cgi?id=157551
+        <rdar://problem/26179914>
+
+        Reviewed by Michael Saboff.
+
+        The TypedArray.prototype.slice function would use the byteLength of the passed array
+        to determine the amount of data to copy. It should have been using the passed length
+        times the size of each element. This fixes a crash on JavaPoly.com
+
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::set):
+        * tests/stress/typedarray-slice.js:
+
+2016-05-10  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r200447): Unable to build C_LOOP with clang version 800.0.12 or higher
+        https://bugs.webkit.org/show_bug.cgi?id=157549
+
+        Reviewed by Keith Miller.
+
+        Disable debug annotations for C_LOOP builds.  They are inline assembly directives,
+        unnecessary and they cause syntax errors.
+
+        * offlineasm/asm.rb:
+
+2016-05-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Internal JSC profiler should have a timestamped log of events for each code block
+        https://bugs.webkit.org/show_bug.cgi?id=157538
+
+        Reviewed by Benjamin Poulain.
+        
+        For example, in 3d-cube, I can query the events for MMulti and I get:
+
+        1462917476.17083  MMulti#DTZ7qc                          installCode        
+        1462917476.179663 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline installCode        
+        1462917476.179664 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline osrEntry           at bc#49
+        1462917476.185651 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 1011.214233/1717.000000, -707
+        1462917476.187913 MMulti#DTZ7qc MMulti#DTZ7qc-2-DFG      installCode        
+        1462917476.187917 MMulti#DTZ7qc MMulti#DTZ7qc-2-DFG      osrEntry           at bc#49
+        1462917476.205365 MMulti#DTZ7qc MMulti#DTZ7qc-2-DFG      jettison           due to OSRExit, counting = true, detail = (null)
+        1462917476.205368 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline frequentExit       bc#65: BadCache/FromDFG
+        1462917476.205369 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline installCode        
+        1462917476.205482 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 1013.000000/3434.000000, -1000
+        1462917476.211547 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 2013.000000/3434.000000, -1000
+        1462917476.213721 MMulti#DTZ7qc MMulti#DTZ7qc-3-DFG      installCode        
+        1462917476.213726 MMulti#DTZ7qc MMulti#DTZ7qc-3-DFG      osrEntry           at bc#49
+        1462917476.223976 MMulti#DTZ7qc MMulti#DTZ7qc-3-DFG      jettison           due to OSRExit, counting = true, detail = (null)
+        1462917476.223981 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline frequentExit       bc#77: BadCache/FromDFG
+        1462917476.223982 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline frequentExit       bc#94: BadCache/FromDFG
+        1462917476.223982 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline installCode        
+        1462917476.224064 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 1013.000000/6868.000000, -1000
+        1462917476.224151 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 2013.000000/6868.000000, -1000
+        1462917476.224258 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 3013.000000/6868.000000, -1000
+        1462917476.224337 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 4023.000000/6868.000000, -1000
+        1462917476.224425 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 5023.000000/6868.000000, -1000
+        1462917476.224785 MMulti#DTZ7qc MMulti#DTZ7qc-1-Baseline delayOptimizeToDFG counter = 6023.396484/6868.000000, -862
+        1462917476.227669 MMulti#DTZ7qc MMulti#DTZ7qc-4-DFG      installCode        
+        1462917476.227675 MMulti#DTZ7qc MMulti#DTZ7qc-4-DFG      osrEntry           at bc#0
+        
+        The output is ugly but useful. We can make it less ugly later.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        (JSC::ScriptExecutable::forEachCodeBlock):
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::ExitProfile::add):
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::finalizeCommon):
+        * dfg/DFGOperations.cpp:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::jitCompileAndSetHeuristics):
+        (JSC::LLInt::entryOSR):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::Compilation):
+        (JSC::Profiler::Compilation::setJettisonReason):
+        (JSC::Profiler::Compilation::dump):
+        (JSC::Profiler::Compilation::toJS):
+        * profiler/ProfilerCompilation.h:
+        (JSC::Profiler::Compilation::uid):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::ensureBytecodesFor):
+        (JSC::Profiler::Database::notifyDestruction):
+        (JSC::Profiler::Database::addCompilation):
+        (JSC::Profiler::Database::toJS):
+        (JSC::Profiler::Database::registerToSaveAtExit):
+        (JSC::Profiler::Database::logEvent):
+        (JSC::Profiler::Database::addDatabaseToAtExit):
+        * profiler/ProfilerDatabase.h:
+        * profiler/ProfilerEvent.cpp: Added.
+        (JSC::Profiler::Event::dump):
+        (JSC::Profiler::Event::toJS):
+        * profiler/ProfilerEvent.h: Added.
+        (JSC::Profiler::Event::Event):
+        (JSC::Profiler::Event::operator bool):
+        (JSC::Profiler::Event::time):
+        (JSC::Profiler::Event::bytecodes):
+        (JSC::Profiler::Event::compilation):
+        (JSC::Profiler::Event::summary):
+        (JSC::Profiler::Event::detail):
+        * profiler/ProfilerUID.cpp: Added.
+        (JSC::Profiler::UID::create):
+        (JSC::Profiler::UID::dump):
+        (JSC::Profiler::UID::toJS):
+        * profiler/ProfilerUID.h: Added.
+        (JSC::Profiler::UID::UID):
+        (JSC::Profiler::UID::fromInt):
+        (JSC::Profiler::UID::toInt):
+        (JSC::Profiler::UID::operator==):
+        (JSC::Profiler::UID::operator!=):
+        (JSC::Profiler::UID::operator bool):
+        (JSC::Profiler::UID::isHashTableDeletedValue):
+        (JSC::Profiler::UID::hash):
+        (JSC::Profiler::UIDHash::hash):
+        (JSC::Profiler::UIDHash::equal):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::installCode):
+        * runtime/VM.h:
+        (JSC::VM::bytecodeIntrinsicRegistry):
+        (JSC::VM::shadowChicken):
+        * runtime/VMInlines.h:
+        (JSC::VM::shouldTriggerTermination):
+        (JSC::VM::logEvent):
+
+2016-05-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Backend should initiate timeline recordings on page navigations to ensure nothing is missed
+        https://bugs.webkit.org/show_bug.cgi?id=157504
+        <rdar://problem/26188642>
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/Timeline.json:
+        Add protocol commands to enable/disable auto capture and list the
+        instruments that should be enabled when auto capture starts.
+        Add protocol event for when the backend starts an auto capture.
+
+2016-05-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Make the different evaluateWithScopeExtension implementations more consistent
+        https://bugs.webkit.org/show_bug.cgi?id=157536
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        Throw the exception consistent with JSJavaScriptCallFrame.
+
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        Better error message consistent with InjectedScriptHost.
+
+        * runtime/Completion.h:
+        * runtime/Completion.cpp:
+        (JSC::evaluateWithScopeExtension):
+        Give this an Exception out parameter like other evaluations
+        so the caller can decide what to do with it.
+
+2016-05-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] FTL can produce GetByVal nodes without proper bounds checking
+        https://bugs.webkit.org/show_bug.cgi?id=157502
+        rdar://problem/26027027
+
+        Reviewed by Filip Pizlo.
+
+        It was possible for FTL to generates GetByVal on arbitrary offsets
+        without any bounds checking.
+
+        The bug is caused by the order of optimization phases:
+        -First, the Integer Range Optimization proves that a CheckInBounds
+         test can never fail.
+         This proof is based on control flow or preceeding instructions
+         inside a loop.
+        -The Loop Invariant Code Motion phase finds that the GetByVal does not
+         depend on anything in the loop and hoist it out of the loop.
+        -> As a result, the conditions that were necessary to eliminate
+           the CheckInBounds are no longer met before the GetByVal.
+
+        This patch just moves the Integer Range Optimization phase after
+        Loop Invariant Code Motion to make sure no code is moved after
+        its integer ranges bounds proofs have been used.
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * tests/stress/bounds-check-not-eliminated-by-licm.js: Added.
+        (testInLoopTests):
+
+2016-05-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Eliminate the crazy code for evaluateOnCallFrame
+        https://bugs.webkit.org/show_bug.cgi?id=157510
+        <rdar://problem/26191332>
+
+        Reviewed by Timothy Hatcher.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluateWithScopeExtension):
+        Set and clear an optional scope extension object.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype.evaluate):
+        (InjectedScript.prototype._evaluateOn):
+        (InjectedScript.prototype.evaluateOnCallFrame):
+        Unify the code to use the passed in evaluate function and object.
+        When evaluating on a call frame the evaluate function ends up being
+        DebuggerCallFrame::evaluateWithScopeExtension. When evaluating globally
+        this ends up being JSInjectedScriptHost::evaluateWithScopeExtension.
+        In both cases "object" is the preferred this object to use.
+
+        * debugger/DebuggerCallFrame.h:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        (Inspector::JSJavaScriptCallFrame::evaluate): Deleted.
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension):
+        * inspector/JavaScriptCallFrame.h:
+        (Inspector::JavaScriptCallFrame::evaluateWithScopeExtension):
+        (Inspector::JavaScriptCallFrame::evaluate): Deleted.
+        Pass through to DebuggerCallFrame with the proper arguments.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::hasBreakpoint):
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction):
+        Use the new evaluate on call frame method name and no scope extension object.
+
+2016-05-10  Saam barati  <sbarati@apple.com>
+
+        Make super-property-access.js test run for less time because it was timing out in debug builds.
+
+        Rubber stamped by Filip Pizlo.
+
+        * tests/stress/super-property-access.js:
+        (test):
+        (test.value):
+        (test.foo):
+        (test.B.prototype.bar):
+        (test.B):
+
+2016-05-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [JSC] Fix the !ENABLE(DFG_JIT) build
+        https://bugs.webkit.org/show_bug.cgi?id=157512
+
+        Reviewed by Mark Lam.
+
+        * jit/Repatch.cpp:
+
+2016-05-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: CRASH under JSC::DebuggerCallFrame::thisValue when hitting breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=157442
+        <rdar://problem/24172015>
+
+        Reviewed by Saam Barati.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisValueForCallFrame):
+        When the thisValue is JSValue() return undefined and avoid calling
+        toThisValue which would lead to a crash. Having `this` be an empty
+        JSValue could happen inside an ES6 class constructor, before
+        calling super.
+
+2016-05-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop.
+
+        * bytecode/ValueProfile.cpp:
+        (JSC::ResultProfile::emitDetectNumericness):
+        (JSC::ResultProfile::emitSetNonNumber):
+        * bytecode/ValueProfile.h:
+        (JSC::ResultProfile::addressOfFlags):
+        (JSC::ResultProfile::addressOfSpecialFastPathCount):
+        (JSC::ResultProfile::detectNumericness):
+        (JSC::ResultProfile::hasBits):
+
+2016-05-09  Michael Saboff  <msaboff@apple.com>
+
+        Crash beneath ObjCCallbackFunctionImpl::call
+        https://bugs.webkit.org/show_bug.cgi?id=157491
+
+        Reviewed by Saam Barati.
+
+        Clear any exceptions after the micro task runs.
+
+        Tried creating a test case, but I don't have source for the app.
+        I can't seem to find the right combination of Promises and ObjC code.
+
+        * runtime/JSJob.cpp:
+        (JSC::JSJobMicrotask::run):
+
+2016-05-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Polymorphic operands in operators coerces downstream values to double.
+        https://bugs.webkit.org/show_bug.cgi?id=151793
+
+        Reviewed by Mark Lam.
+        
+        Previously if an object flowed into arithmetic, the prediction propagation phase would either
+        assume that the output of the arithmetic had to be double or sometimes it would assume that it
+        couldn't be double. We want it to only assume that the output is double if it actually had been.
+        
+        The first part of this patch is to roll out http://trac.webkit.org/changeset/200502. That removed
+        some of the machinery that we had in place to detect whether the output of an operation is int or
+        double. That changeset claimed that the machinery was "fundamentally broken". It actually wasn't.
+        The reason why it didn't work was that ByteCodeParser was ignoring it if likelyToTakeSlowCase was
+        false. I think this was a complete goof-up: the code in ByteCodeParser::makeSafe was structured
+        in a way that made it non-obvious that the method is a no-op if !likelyToTakeSlowCase. So, this
+        change rolls out r200502 and makes ResultProfile do its job by reshaping how makeSafe processes
+        it.
+        
+        This also makes two other changes to shore up ResultProfile:
+        - OSR exit can now refine a ResultProfile the same way that it refines ValueProfile.
+        - Baseline JIT slow paths now set bits in ResultProfile.
+        
+        Based on this stuff, the DFG now predicts int/double/string in op_add/op_sub/op_mul based on
+        ResultProfiles. To be conservative, we still only use the ResultProfiles if the incoming
+        prediction is not number-or-boolean. This ensures that we exactly retain our old behavior in
+        those cases for which it was tuned. But I hope to remove this soon. I believe that ResultProfile
+        is already strictly better than what prediction propagation was doing before.
+        
+        This can be an enormous win. This patch adds some simple microbenchmarks that demonstrate the
+        problem of assuming that arithmetic on objects returns double. The most extreme of these speeds
+        up 8x with this change (object-int-add-array).
+        
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addFrequentExitSite):
+        (JSC::CodeBlock::hasExitSite):
+        * bytecode/DFGExitProfile.cpp:
+        (JSC::DFG::FrequentExitSite::dump):
+        (JSC::DFG::ExitProfile::ExitProfile):
+        (JSC::DFG::ExitProfile::~ExitProfile):
+        (JSC::DFG::ExitProfile::add):
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::FrequentExitSite::isHashTableDeletedValue):
+        * bytecode/MethodOfGettingAValueProfile.cpp:
+        (JSC::MethodOfGettingAValueProfile::fromLazyOperand):
+        (JSC::MethodOfGettingAValueProfile::emitReportValue):
+        (JSC::MethodOfGettingAValueProfile::getSpecFailBucket): Deleted.
+        * bytecode/MethodOfGettingAValueProfile.h:
+        (JSC::MethodOfGettingAValueProfile::MethodOfGettingAValueProfile):
+        (JSC::MethodOfGettingAValueProfile::operator bool):
+        (JSC::MethodOfGettingAValueProfile::operator!): Deleted.
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+        * bytecode/ValueProfile.cpp:
+        (JSC::ResultProfile::emitDetectBitsLight):
+        (JSC::ResultProfile::emitSetDouble):
+        (JSC::ResultProfile::emitSetNonNumber):
+        (WTF::printInternal):
+        * bytecode/ValueProfile.h:
+        (JSC::ResultProfile::ResultProfile):
+        (JSC::ResultProfile::bytecodeOffset):
+        (JSC::ResultProfile::specialFastPathCount):
+        (JSC::ResultProfile::didObserveNonInt32):
+        (JSC::ResultProfile::didObserveDouble):
+        (JSC::ResultProfile::didObserveNonNegZeroDouble):
+        (JSC::ResultProfile::didObserveNegZeroDouble):
+        (JSC::ResultProfile::didObserveNonNumber):
+        (JSC::ResultProfile::didObserveInt32Overflow):
+        (JSC::ResultProfile::didObserveInt52Overflow):
+        (JSC::ResultProfile::setObservedNonNegZeroDouble):
+        (JSC::ResultProfile::setObservedNegZeroDouble):
+        (JSC::ResultProfile::setObservedNonNumber):
+        (JSC::ResultProfile::setObservedInt32Overflow):
+        (JSC::ResultProfile::addressOfFlags):
+        (JSC::ResultProfile::addressOfSpecialFastPathCount):
+        (JSC::ResultProfile::detectBitsLight):
+        (JSC::ResultProfile::hasBits):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::ensureNaturalLoops):
+        (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
+        (JSC::DFG::Graph::valueProfileFor): Deleted.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::hasExitSite):
+        (JSC::DFG::Graph::numBlocks):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::mayHaveNonIntResult):
+        (JSC::DFG::Node::mayHaveDoubleResult):
+        (JSC::DFG::Node::mayHaveNonNumberResult):
+        (JSC::DFG::Node::hasConstantBuffer):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchIfEqual):
+        (JSC::AssemblyHelpers::branchIfNotCell):
+        (JSC::AssemblyHelpers::branchIfNotNumber):
+        (JSC::AssemblyHelpers::branchIfNotDoubleKnownNotInt32):
+        (JSC::AssemblyHelpers::branchIfBoolean):
+        (JSC::AssemblyHelpers::branchIfEmpty):
+        (JSC::AssemblyHelpers::branchStructure):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::CCallHelpers):
+        (JSC::CCallHelpers::setupArguments):
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/IntrinsicEmitter.cpp:
+        (JSC::AccessCase::emitIntrinsicGetter):
+        * jit/JIT.h:
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::JITAddGenerator):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        (JSC::JIT::emit_op_sub):
+        (JSC::JIT::emitSlow_op_sub):
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        (JSC::JIT::callOperationNoExceptionCheck):
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITSubGenerator.cpp:
+        (JSC::JITSubGenerator::generateFastPath):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::JITSubGenerator):
+        * jit/TagRegistersMode.cpp: Added.
+        (WTF::printInternal):
+        * jit/TagRegistersMode.h: Added.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::updateResultProfileForBinaryArithOp):
+
+2016-05-09  Keith Miller  <keith_miller@apple.com>
+
+        CallObjectConstructor should not call operationToThis in the FTL
+        https://bugs.webkit.org/show_bug.cgi?id=157492
+        <rdar://problem/26149904>
+
+        Reviewed by Mark Lam.
+
+        At some point when I was working on intrinsifying the Object
+        constructor, I realized that the Object constructor was different
+        from the ToObject operation. I fixed the DFG but I guess I didn't
+        fix the FTL.
+
+        This patch fixes an issue with www.wunderground.com not loading
+        the 10-day forecast and local map.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
+        * tests/stress/call-object-constructor.js: Added.
+        (test):
+        (assert):
+
+2016-05-09  Saam barati  <sbarati@apple.com>
+
+        Getter and setter on super are called with wrong "this" object
+        https://bugs.webkit.org/show_bug.cgi?id=147064
+        <rdar://problem/21885916>
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements calls to 'super' getters and setters.
+        The problem before is we were passing the 'super' (i.e, the prototype
+        object) as the this value to these getters/setters, which is wrong. 
+        We should be passing the caller's this value.
+
+        To implement this behavior, I've introduced four new opcodes and their corresponding DFG nodes:
+        - op_get_by_id_with_this | GetByIdWithThis
+        - op_put_by_id_with_this | PutByIdWithThis
+        - op_get_by_val_with_this | GetByValWithThis
+        - op_put_by_val_with_this | PutByValWithThis
+
+        These are implemented with no optimizations. The future plan is 
+        to unite them with the *by_id and *by_val opcodes and nodes:
+        https://bugs.webkit.org/show_bug.cgi?id=157215
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        (JSC::BytecodeGenerator::emitDirectPutByVal):
+        (JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::ensureThis):
+        (JSC::BytecodeGenerator::isThisUsedInInnerArrowFunction):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::emitHomeObjectForCallee):
+        (JSC::emitSuperBaseForCallee):
+        (JSC::emitGetSuperFunctionForConstruct):
+        (JSC::SuperNode::emitBytecode):
+        (JSC::NewTargetNode::emitBytecode):
+        (JSC::TaggedTemplateNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+        (JSC::PrefixNode::emitBracket):
+        (JSC::PrefixNode::emitDot):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::AssignmentElementNode::bindValue):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::newTypedArrayWithSize):
+        (JSC::DFG::putWithThis):
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByIdWithThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByValWithThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByIdWithThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByValWithThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutById):
+        * jit/CCallHelpers.cpp:
+        (JSC::CCallHelpers::setupShadowChickenPacket):
+        (JSC::CCallHelpers::setupFourStubArgsGPR):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        (JSC::CCallHelpers::setupThreeStubArgsGPR):
+        (JSC::CCallHelpers::setupTwoStubArgsFPR):
+        (JSC::CCallHelpers::setupStubArguments134):
+        * jit/GPRInfo.h:
+        (JSC::argumentRegisterFor): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_put_by_val_with_this):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emit_op_get_by_id_with_this):
+        (JSC::JIT::emit_op_get_by_val_with_this):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emit_op_put_by_id_with_this):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_to_arguments):
+        (JSC::JIT::emit_op_get_by_id_with_this):
+        (JSC::JIT::emit_op_get_by_val_with_this):
+        (JSC::JIT::emit_op_put_by_id_with_this):
+        (JSC::JIT::emit_op_put_by_val_with_this):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * tests/stress/super-property-access-exceptions.js: Added.
+        (assert):
+        (test):
+        (test.fooProp):
+        (test.A.prototype.get foo):
+        (test.A.prototype.get x):
+        (test.A):
+        (test.B):
+        (test.B.prototype.bar):
+        (test.B.prototype.baz):
+        (test.foo):
+        (test.func):
+        (test.A.prototype.set foo):
+        * tests/stress/super-property-access-tdz.js: Added.
+        (assert):
+        (test):
+        (shouldThrowTDZ):
+        (test.A.prototype.get foo):
+        (test.A.prototype.set foo):
+        (test.A):
+        (test.fooProp):
+        (test.B):
+        (test.C):
+        (test.D):
+        (test.E):
+        (test.F):
+        * tests/stress/super-property-access.js: Added.
+        (assert):
+        (test):
+        (func):
+        (test.A):
+        (test.A.prototype.set value):
+        (test.A.prototype.get value):
+        (test.B.prototype.set value):
+        (test.B.prototype.get value):
+        (test.B):
+        (test.value):
+        (test.A.prototype.get func):
+        (test.B.prototype.inc):
+        (test.B.prototype.dec):
+        (test.B.prototype.preInc):
+        (test.B.prototype.preDec):
+        (test.B.prototype.plusEq):
+        (test.B.prototype.minusEq):
+        (test.B.prototype.timesEq):
+        (test.B.prototype.divEq):
+        (test.B.prototype.funcDot):
+        (test.B.prototype.funcBracket):
+        (test.foo):
+        (test.B.prototype.baz):
+        (test.B.prototype.jaz):
+        (test.B.prototype.bar):
+        (test.B.prototype.index):
+        (test.):
+        (test.prototype.bar):
+        (test.A.prototype.set foo):
+        (test.A.prototype.get array):
+        (test.A.prototype.get foo):
+        (test.obj):
+        (test.A.prototype.get call):
+        (test.A.prototype.get apply):
+        (test.B.prototype.foo):
+        (test.A.prototype.get i):
+
+2016-05-08  Chris Dumez  <cdumez@apple.com>
+
+        [COCOA] Disable HAVE_DTRACE at build time
+        https://bugs.webkit.org/show_bug.cgi?id=157433
+        <rdar://problem/26148841>
+
+        Reviewed by Mark Lam.
+
+        Drop DTRACE-related code from JSC since it is very old and seems
+        unused.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * PlatformMac.cmake:
+        * heap/Heap.cpp:
+        (JSC::Heap::collectImpl): Deleted.
+        (JSC::Heap::didFinishCollection): Deleted.
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::willExecute): Deleted.
+        (JSC::ProfileGenerator::didExecute): Deleted.
+        * runtime/Tracing.d: Removed.
+        * runtime/Tracing.h: Removed.
+
+2016-05-07  Mark Lam  <mark.lam@apple.com>
+
+        Add JSC options bytecodeRangeToJITCompile and jitWhitelist.
+        https://bugs.webkit.org/show_bug.cgi?id=157428
+
+        Reviewed by Michael Saboff.
+
+        1. Added Options::bytecodeRangeToJITCompile and Options::jitWhitelist options.
+
+        2. Moved DFGFunctionWhitelist* to FunctionWhitelist* and made it generic so that
+           it can be used for more than one whitelist instance.  In this case, we now have
+           two: the dfgWhitelist and the jitWhitelist.
+
+        3. Added "can compile" checks in LLInt::shouldJIT() to check
+           Options::bytecodeRangeToJITCompile and Options::jitWhitelist.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::getNumCompilations):
+        (JSC::DFG::ensureGlobalDFGWhitelist):
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFunctionWhitelist.cpp: Removed.
+        * dfg/DFGFunctionWhitelist.h: Removed.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::ensureGlobalJITWhitelist):
+        (JSC::LLInt::shouldJIT):
+
+        * runtime/Options.h:
+
+        * tools/FunctionWhitelist.cpp: Copied from Source/JavaScriptCore/dfg/DFGFunctionWhitelist.cpp.
+        (JSC::FunctionWhitelist::FunctionWhitelist):
+        (JSC::FunctionWhitelist::contains):
+        (JSC::DFG::FunctionWhitelist::ensureGlobalWhitelist): Deleted.
+        (JSC::DFG::FunctionWhitelist::FunctionWhitelist): Deleted.
+        (JSC::DFG::FunctionWhitelist::parseFunctionNamesInFile): Deleted.
+        (JSC::DFG::FunctionWhitelist::contains): Deleted.
+        * tools/FunctionWhitelist.h: Copied from Source/JavaScriptCore/dfg/DFGFunctionWhitelist.h.
+
+2016-05-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC][32bit] stress/tagged-templates-template-object.js fails in debug
+        https://bugs.webkit.org/show_bug.cgi?id=157436
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        The node OverridesHasInstance had a speculation after a jump.
+
+2016-05-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Misc CommandLineAPI cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=157450
+
+        Reviewed by Ryosuke Niwa.
+
+        * inspector/InjectedScriptSource.js:
+        (BasicCommandLineAPI):
+        Fix mistake in r200533, and modernize related code.
+
+2016-05-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Improve console.count()
+        https://bugs.webkit.org/show_bug.cgi?id=157439
+        <rdar://problem/26152654>
+
+        Reviewed by Timothy Hatcher.
+
+          - make console.count() increment an unnamed global counter.
+          - make console.count(label) increment a counter with that label name.
+
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::count):
+
+2016-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Enable IOS_TEXT_AUTOSIZING on Mac and make it testable
+        https://bugs.webkit.org/show_bug.cgi?id=157432
+        rdar://problem/16406720
+
+        Reviewed by Dean Jackson.
+
+        Enable IOS_TEXT_AUTOSIZING on Mac so it can be tested.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-05-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Console: Variables defined with let/const aren't accessible outside of console's scope
+        https://bugs.webkit.org/show_bug.cgi?id=150752
+        <rdar://problem/23343385>
+
+        Reviewed by Mark Lam.
+
+        This approach allows Web Inspector to hang a "Scope Extension", a
+        WithObjectScope, off the GlobalObject. When resolving identifiers
+        in fails to resolve anything in the normal scope chain, consult
+        the scope extension.
+
+        This allows us to eliminate the `with (commandLineAPI) { ... }`
+        block in global console evaluations, and instead makes it a full
+        program evaluation, with the commandLineAPI available and safely
+        shadowed by actual variables as expected.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._evaluateOn):
+        Use the new evaluateWithScopeExtension and provide the CommandLineAPI
+        object as the scope extension object.
+
+        (BasicCommandLineAPI):
+        (BasicCommandLineAPI.inScopeVariables): Deleted.
+        Simplify now that we don't need to check for variable shadowing ourselves.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        * inspector/JSInjectedScriptHost.h:
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension):
+        Provide a new InjectedScriptHost method to evaluate a program
+        with a scope extension.
+
+        * runtime/Completion.cpp:
+        (JSC::evaluateWithScopeExtension):
+        * runtime/Completion.h:
+        General JSC::evaluate function to evaluate a program with a scope extension.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setGlobalScopeExtension):
+        (JSC::JSGlobalObject::clearGlobalScopeExtension):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::globalScopeExtension):
+        Hang a scope extension off the global object.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+        Consult the scope extension when resolve fails to find anything normally.
+
+2016-05-06  Mark Lam  <mark.lam@apple.com>
+
+        Add JSC options reportBaselineCompileTimes and reportDFGCompileTimes.
+        https://bugs.webkit.org/show_bug.cgi?id=157427
+
+        Reviewed by Filip Pizlo and Keith Miller.
+
+        The compile times reporting options are now:
+            reportCompileTimes         -> report compile times in all tiers.
+            reportBaselineCompileTimes -> report compile times in baseline JIT.
+            reportDFGCompileTimes      -> report compile times in DFG and FTL.
+            reportFTLCompileTimes      -> report compile times in FTL.
+
+        Also updated reportTotalCompileTimes() to collect stats that include the baseline
+        JIT.  compileTimeStats() is now moved into JIT.cpp (from DFGPlan.cpp). 
+
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::reportCompileTimes):
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::cancel):
+        (JSC::DFG::Plan::compileTimeStats): Deleted.
+        * dfg/DFGPlan.h:
+        (JSC::DFG::Plan::compileTimeStats): Deleted.
+        * jit/JIT.cpp:
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::stackPointerOffsetFor):
+        (JSC::JIT::reportCompileTimes):
+        (JSC::JIT::computeCompileTimes):
+        (JSC::JIT::compileTimeStats):
+        * jit/JIT.h:
+        (JSC::JIT::shouldEmitProfiling):
+        * jsc.cpp:
+        (runJSC):
+        * runtime/Options.h:
+
+2016-05-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Get rid of NonNegZeroDouble, it is broken
+        https://bugs.webkit.org/show_bug.cgi?id=157399
+        rdar://problem/25339647
+
+        Reviewed by Mark Lam.
+
+        The profile "NonNegZeroDouble" is fundamentally broken.
+
+        It is used by DFG to predict the result of ArithMul as being a Double
+        or Int32.
+        The problem is you are likely to mispredict, and when you do, you are
+        guaranteed to end up in a recompile loop.
+
+        The compile loops usually happen like this:
+        -We speculate you have Int32 despite producing doubles.
+        -We OSR exit on another node (ValueToInt32 for example) from the result of this ArithMul.
+        -When we compile this block again, ArithMul will do the same misprediction
+         because it unconditionally predicts Int32.
+
+        The flag NonNegZeroDouble was very unlikely to be set correctly
+        in the first place.
+
+        In LLINT, the flag is only set on the slow path.
+        Since double*double is on the fast path, those cases are ignored.
+
+        In Baseline, the flag is set for any case that falls back on double
+        multiplication. BUT, the DFG flag was only set for nodes that spend
+        many iteration in slow path, which obviously does not apply to double*double.
+
+        Given the perf drawbacks and the recompile loops, I removed
+        the whole flag for now.
+
+        * bytecode/ValueProfile.cpp:
+        (WTF::printInternal):
+        * bytecode/ValueProfile.h:
+        (JSC::ResultProfile::didObserveNonInt32): Deleted.
+        (JSC::ResultProfile::didObserveDouble): Deleted.
+        (JSC::ResultProfile::didObserveNonNegZeroDouble): Deleted.
+        (JSC::ResultProfile::setObservedNonNegZeroDouble): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::mayHaveNonIntResult): Deleted.
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags): Deleted.
+        * dfg/DFGNodeFlags.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath): Deleted.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::updateResultProfileForBinaryArithOp): Deleted.
+
+2016-05-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(r200422): Web Inspector: Make new Array Iterator objects play nice with Web Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=157361
+        <rdar://problem/26099793>
+
+        Reviewed by Timothy Hatcher.
+
+        * builtins/ArrayPrototype.js:
+        (createArrayIterator):
+        (values):
+        (keys):
+        (entries):
+        * builtins/TypedArrayPrototype.js:
+        (values):
+        (keys):
+        (entries):
+        * runtime/CommonIdentifiers.h:
+        Set the kind on the iterator object, that can be shown
+        to the inspector if the object is shown in the console.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._describe):
+        Get a better name for the new Array Iterator which is just an Object.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        Detect and handle ArrayIterator object instances. Porting the code
+        from the JSArrayIterator code path.
+
+2016-05-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] In DFG, an OSR Exit on SetLocal can trash its child node
+        https://bugs.webkit.org/show_bug.cgi?id=157358
+        rdar://problem/25339647
+
+        Reviewed by Filip Pizlo.
+
+        When we OSR Exit on SetLocal, the child is never restored if its representation
+        was changed since the MovHint.
+
+        For example, say we have:
+            @1 = SomethingProducingDouble()
+            @2 = MovHint(@1)
+            @3 = ValueRep(@1)
+            @4 = SetLocal(@3, FlushedInt32)
+
+        When we lower SetLocal(), we start by speculating that @3 is an Int32.
+        Now this can fail if @1 was really a double.
+        When that happens, we go over the VariableEventStream to find where values
+        are, and @1 died at @3. Since the speculation failure happens before
+        the SetLocal event, we don't do anything with @3.
+
+        In this patch, I extend the PhantomInsertion phase to keep the MovHint
+        alive past the SetLocal.
+
+        * dfg/DFGPhantomInsertionPhase.cpp:
+        * tests/stress/multiply-typed-double-and-object.js: Added.
+        (otherObject.valueOf):
+        (targetDFG.multiply):
+        (targetFTL.multiply):
+
+2016-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Enable separated heap by default on ios
+        https://bugs.webkit.org/show_bug.cgi?id=156720
+
+        Reviewed by Geoffrey Garen.
+
+        We've fixed the xnu side of things, so we can reland this.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-05-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSContext Inspector: Better CommandLineAPI in JSContext inspection
+        https://bugs.webkit.org/show_bug.cgi?id=157387
+        <rdar://problem/22630583>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._evaluateOn):
+        (BasicCommandLineAPI.inScopeVariables):
+        (BasicCommandLineAPI):
+        When creating a BasicCommandLineAPI, pass the call frame so
+        that we don't shadow variables in the callstack.
+
+        (BasicCommandLineAPI.methods):
+        (clear):
+        (table):
+        (profile):
+        (profileEnd):
+        (keys):
+        (values):
+        Some just pass through to console, others are tiny methods.
+        Implement them, and give them the expected toString string.
+
+2016-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Reduce maximum JIT pool size on X86_64.
+
+        Rubber stamped by Geoffrey Garen.
+        
+        This changes our maximum pool size to 100MB. The problem with letting a page allocate much
+        more than this is that we will sometimes call deleteAllCode() or one of its friends. Deleting
+        a huge amount of memory is expensive in our allocator.
+        
+        So long as we allow for such large-scale code death to happen, and so long as it's expensive,
+        we should bound the amount of code we end up with in the first place.
+        
+        In the long run, we should fix our executable allocator so that it's not so expensive to kill
+        all code.
+        
+        * jit/ExecutableAllocator.h:
+
+2016-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Reduce thresholds that control the maximum IC stub size.
+
+        Rubber stamped by Chris Dumez and Benjamin Poulain.
+        
+        This reduces the thresholds to before the megamorphic load optimizations to see if that
+        recovers a PLT regression.
+
+        * runtime/Options.h:
+
+2016-05-05  Filip Pizlo  <fpizlo@apple.com>
+
+        We shouldn't crash if DFG AI proved that something was unreachable on one run but then decided not to prove it on another run
+        https://bugs.webkit.org/show_bug.cgi?id=157379
+
+        Reviewed by Mark Lam.
+        
+        Any run of DFG AI is a fixpoint that loosens the proof until it can't find any more
+        counterexamples to the proof.  It errs on the side of loosening proofs, i.e., on the side of
+        proving fewer things.
+
+        We run this fixpoint multiple times since there are multiple points in the DFG optimization
+        pipeline when we run DFG AI.  Each of those runs completes a fixpoint and produces the
+        tightest proof it can that did not result in counterexamples being found.
+
+        It's possible that on run K of DFG AI, we prove some property, but on run K+1, we don't prove
+        that property. The code could have changed between the two runs due to other phases. Other
+        phases may modify the code in such a way that it's less amenable to AI's analysis. Our design
+        allows this because DFG AI is not 100% precise. It defends itself from making unsound choices
+        or running forever by sometimes punting on proving some property. It must be able to do this,
+        and so therefore, it might sometimes prove fewer things on a later run.
+
+        Currently in trunk if the property that AI proves on run K but fails to prove on run K+1 is
+        the reachability of a piece of code, then run K+1 will crash on an assertion at the
+        Unreachable node. It will complain that it reached an Unreachable. But it might be reaching
+        that Unreachable because it failed to prove that something earlier was always exiting. That's
+        OK, see above.
+
+        So, we should remove the assertion that AI doesn't see Unreachable.
+        
+        No new tests because I don't know how to make this happen. I believe that this happens in the
+        wild based on crash logs.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2016-05-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Crash if you type "debugger" in the console and continue
+        https://bugs.webkit.org/show_bug.cgi?id=156924
+        <rdar://problem/25884189>
+
+        Reviewed by Mark Lam.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::evaluateOnCallFrame):
+        Bail with an error when we are not paused.
+
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::callFunctionOn):
+        (Inspector::InspectorRuntimeAgent::getProperties):
+        (Inspector::InspectorRuntimeAgent::getDisplayableProperties):
+        (Inspector::InspectorRuntimeAgent::getCollectionEntries):
+        (Inspector::InspectorRuntimeAgent::saveResult):
+        Update poor error message.
+
+2016-05-05  Keith Miller  <keith_miller@apple.com>
+
+        Add support for delete by value to the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=157372
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds basic support for delete by value to the DFG. delete by value
+        just calls out to a C++ operation on each execution. Additionally, this patch
+        fixes an issue with delete by id where we would crash if the base was null
+        or undefined.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDeleteById):
+        (JSC::DFG::SpeculativeJIT::compileDeleteByVal):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_del_by_val):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_del_by_val):
+        * tests/stress/delete-by-val.js: Added.
+        (assert):
+        (test):
+        * tests/stress/delete-to-object-exception.js: Added.
+        (assert):
+        (test):
+
+2016-05-05  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed build fix after change set r200447.
+
+        Made the detection of clang version XCode build specific.
+        Now shouldEnableDebugAnnotations() should return false for all other build types.
+
+        * offlineasm/config.rb:
+
+2016-05-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Create console object lazily
+        https://bugs.webkit.org/show_bug.cgi?id=157328
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::createConsoleProperty):
+        (JSC::JSGlobalObject::init): Deleted.
+
+2016-05-04  Michael Saboff  <msaboff@apple.com>
+
+        Enable Dwarf2 debug information in offline assembler for clang compiler
+        https://bugs.webkit.org/show_bug.cgi?id=157364.
+
+        Reviewed by Mark Lam.
+
+        Added a new function shouldEnableDebugAnnotations() that determines if
+        we are using clang and a new enough version to support the debug annotations.
+
+        * offlineasm/config.rb:
+        (shouldEnableDebugAnnotations): Added.
+
+2016-05-04  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, fix test for new ArrayIteratorPrototype.next() error message.
+
+        * tests/stress/array-iterators-next-with-call.js:
+
+2016-05-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Speed up JSGlobalObject initialization by making some properties lazy
+        https://bugs.webkit.org/show_bug.cgi?id=157045
+
+        Reviewed by Keith Miller.
+        
+        This makes about half of JSGlobalObject's state lazy. There are three categories of
+        state in JSGlobalObject:
+        
+        1) C++ fields in JSGlobalObject.
+        2) JS object properties in JSGlobalObject's JSObject superclass.
+        3) JS variables in JSGlobalObject's JSSegmentedVariableObject superclass.
+        
+        State held in JS variables cannot yet be made lazy. That's why this patch only goes
+        half-way.
+        
+        State in JS object properties can be made lazy if we move it to the static property
+        hashtable. JSGlobalObject already had one of those. This patch makes static property
+        hashtables a lot more powerful, by adding three new kinds of static properties. These
+        new kinds allow us to make almost all of JSGlobalObject's object properties lazy.
+        
+        State in C++ fields can now be made lazy thanks in part to WTF's support for stateless
+        lambdas. You can of course make anything lazy by hand, but there are many C++ fields in
+        JSGlobalObject and we are adding more all the time. We don't want to require that each
+        of these has a getter with an initialization check and a corresponding out-of-line slow
+        path that does the initialization. We want this kind of boilerplate to be handled by
+        some abstractions.
+        
+        The primary abstraction introduced in this patch is LazyProperty<Type>. Currently, this
+        only works where Type is a subclass of JSCell. Such a property holds a pointer to Type.
+        You can use it like you would a WriteBarrier<Type>. It even has set() and get() methods,
+        so it's almost a drop-in replacement.
+        
+        The key to LazyProperty<Type>'s power is that you can do this:
+        
+            class Bar {
+                ...
+                LazyProperty<Foo> m_foo;
+            };
+            ...
+            m_foo.initLater(
+                [] (const LazyProperty<Foo>::Initializer<Bar>& init) {
+                    init.set(Foo::create(init.vm, init.owner));
+                });
+        
+        This initLater() call requires that you pass a stateless lambda (see WTF changelog for
+        the definition). Miraculously, this initLater() call is guaranteed to compile to a store
+        of a pointer constant to m_foo, as in:
+        
+            movabsq 0xBLAH, %rax
+            movq %rax, &m_foo
+        
+        This magical pointer constant points to a callback that was generated by the template
+        instantiation of initLater(). That callback knows to call your stateless lambda, but
+        also does some other bookkeeping: it makes sure that you indeed initialized the property
+        inside the callback and it manages recursive initializations. It's totally legal to call
+        m_foo.get() inside the initLater() callback. If you do that before you call init.set(),
+        m_foo.get() will return null. This is an excellent escape hatch if we ever find
+        ourselves in a dependency cycle. I added this feature because I already had to create a
+        dependency cycle.
+        
+        Note that using LazyProperties from DFG threads is super awkward. It's going to be hard
+        to get this right. The DFG thread cannot initialize those fields, so it has to make sure
+        that it does conservative things. But for some nodes this could mean adding a lot of new
+        logic, like NewTypedArray, which currently is written in such a way that it assumes that
+        we always have the typed array structure. Currently we take a two-fold approach: for
+        typed arrays we don't handle the NewTypedArray intrinsic if the structure isn't
+        initialized, and for everything else we don't make the properties lazy if the DFG needs
+        them. As we optimize this further we might need to teach the DFG to handle more lazy
+        properties. I tried to do this for RegExp but found it to be very confusing. With typed
+        arrays I got lucky.
+        
+        There is also a somewhat more powerful construct called LazyClassStructure. We often
+        need to keep around the structure of some standard JS class, like Date. We also need to
+        make sure that the constructor ends up in the global object's property table. And we
+        often need to keep the original value of the constructor for ourselves. In this case, we
+        want to make sure that the creation of the structure-prototype-constructor constellation
+        is atomic. We don't want code to start looking at the structure if it points to a
+        prototype that doesn't have its "constructor" property set yet, for example.
+        LazyClassStructure solves this by abstracting that whole initialization. You provide the
+        callback that allocates everything, since we are super inconsistent about the way we
+        initialize things, but LazyClassStructure establishes the workflow and helps you not
+        mess up.
+        
+        Finally, the new static hashtable attributes allow for all of this to work with the JS
+        property table:
+        
+        PropertyCallback: if you use this attribute, the second column in the table should be
+        the name of a function to call to initialize this property. This is useful for things
+        like the Math property. The Math object turns out to be very expensive to allocate.
+        Delaying its allocation is super easy with the PropertyCallback attribute.
+        
+        CellProperty: with this attribute the second column should be a C++ field name like
+        JSGlobalObject::m_evalErrorConstructor. The static hashtable will grab the offset of
+        this property, and when it needs to be initialized, Lookup will assume you have a
+        LazyProperty<JSCell> and call its get() method. It will initialize the property to
+        whatever get() returned. Note that it's legal to cast a LazyProperty<Anything> to
+        LazyProperty<JSCell> for the purpose of calling get() because the get() method will just
+        call whatever callback function pointer is encoded in the property and it does not need
+        to know anything about what type that callback will instantiate.
+        
+        ClassStructure: with this attribute the second column should be a C++ field name. The
+        static hashtable will initialize the property by treating the field as a
+        LazyClassStructure and it will call get(). LazyClassStructure completely owns the whole
+        initialization workflow, so Lookup assumes that when LazyClassStructure::get() returns,
+        the property in question will already be set. By convention, we have LazyClassStructure
+        initialize the property with a pointer to the constructor, since that's how all of our
+        classes work: "globalObject.Date" points to the DateConstructor.
+        
+        This is a 2x speed-up in JSGlobalObject initialization time in a microbenchmark that
+        calls our C API. This is a 1% speed-up on SunSpider and JSRegress.
+        
+        Rolling this back in after fixing the function pointer alignment issue. The last version
+        relied on function pointers being aligned to a 4-byte boundary. We cannot rely on this,
+        especially since ARMv7 uses the low bit of function pointers as a tag to indicate the
+        instruction set. This version adds an extra indirection, so that
+        LazyProperty<>::m_pointer points to a pointer that points to the function. A pointer to
+        a pointer is guaranteed to be at least 4-byte aligned.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::create):
+        * API/ObjCCallbackFunction.h:
+        (JSC::ObjCCallbackFunction::impl):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunction::ObjCCallbackFunction):
+        (JSC::ObjCCallbackFunction::create):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_hash_table:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::create):
+        (JSC::DebuggerScope::DebuggerScope):
+        * debugger/DebuggerScope.h:
+        (JSC::DebuggerScope::jsScope):
+        (JSC::DebuggerScope::create): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::originalArrayStructure):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        (JSC::ClonedArguments::materializeSpecials):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::visitChildren):
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::calculatedDisplayName):
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/InternalFunction.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::finishCreation):
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSBoundSlotBaseFunction.cpp:
+        (JSC::JSBoundSlotBaseFunction::create):
+        * runtime/JSFunction.cpp:
+        (JSC::retrieveCallerFunction):
+        (JSC::getThrowTypeErrorGetterSetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::createProxyProperty):
+        (JSC::createJSONProperty):
+        (JSC::createMathProperty):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::toThis):
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        (JSC::JSGlobalObject::createThrowTypeError): Deleted.
+        (JSC::JSGlobalObject::createThrowTypeErrorArgumentsAndCaller): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::objectConstructor):
+        (JSC::JSGlobalObject::promiseConstructor):
+        (JSC::JSGlobalObject::internalPromiseConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::nullGetterFunction):
+        (JSC::JSGlobalObject::nullSetterFunction):
+        (JSC::JSGlobalObject::callFunction):
+        (JSC::JSGlobalObject::applyFunction):
+        (JSC::JSGlobalObject::definePropertyFunction):
+        (JSC::JSGlobalObject::arrayProtoValuesFunction):
+        (JSC::JSGlobalObject::initializePromiseFunction):
+        (JSC::JSGlobalObject::newPromiseCapabilityFunction):
+        (JSC::JSGlobalObject::functionProtoHasInstanceSymbolFunction):
+        (JSC::JSGlobalObject::regExpProtoExecFunction):
+        (JSC::JSGlobalObject::regExpProtoSymbolReplaceFunction):
+        (JSC::JSGlobalObject::regExpProtoGlobalGetter):
+        (JSC::JSGlobalObject::regExpProtoUnicodeGetter):
+        (JSC::JSGlobalObject::throwTypeErrorGetterSetter):
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsAndCallerGetterSetter):
+        (JSC::JSGlobalObject::moduleLoader):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::symbolPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::errorPrototype):
+        (JSC::JSGlobalObject::iteratorPrototype):
+        (JSC::JSGlobalObject::generatorFunctionPrototype):
+        (JSC::JSGlobalObject::generatorPrototype):
+        (JSC::JSGlobalObject::debuggerScopeStructure):
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::strictEvalActivationStructure):
+        (JSC::JSGlobalObject::activationStructure):
+        (JSC::JSGlobalObject::moduleEnvironmentStructure):
+        (JSC::JSGlobalObject::directArgumentsStructure):
+        (JSC::JSGlobalObject::scopedArgumentsStructure):
+        (JSC::JSGlobalObject::clonedArgumentsStructure):
+        (JSC::JSGlobalObject::isOriginalArrayStructure):
+        (JSC::JSGlobalObject::booleanObjectStructure):
+        (JSC::JSGlobalObject::callbackConstructorStructure):
+        (JSC::JSGlobalObject::callbackFunctionStructure):
+        (JSC::JSGlobalObject::callbackObjectStructure):
+        (JSC::JSGlobalObject::propertyNameIteratorStructure):
+        (JSC::JSGlobalObject::objcCallbackFunctionStructure):
+        (JSC::JSGlobalObject::objcWrapperObjectStructure):
+        (JSC::JSGlobalObject::dateStructure):
+        (JSC::JSGlobalObject::nullPrototypeObjectStructure):
+        (JSC::JSGlobalObject::errorStructure):
+        (JSC::JSGlobalObject::calleeStructure):
+        (JSC::JSGlobalObject::functionStructure):
+        (JSC::JSGlobalObject::boundFunctionStructure):
+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure):
+        (JSC::JSGlobalObject::getterSetterStructure):
+        (JSC::JSGlobalObject::nativeStdFunctionStructure):
+        (JSC::JSGlobalObject::namedFunctionStructure):
+        (JSC::JSGlobalObject::functionNameOffset):
+        (JSC::JSGlobalObject::numberObjectStructure):
+        (JSC::JSGlobalObject::privateNameStructure):
+        (JSC::JSGlobalObject::mapStructure):
+        (JSC::JSGlobalObject::regExpStructure):
+        (JSC::JSGlobalObject::generatorFunctionStructure):
+        (JSC::JSGlobalObject::setStructure):
+        (JSC::JSGlobalObject::stringObjectStructure):
+        (JSC::JSGlobalObject::symbolObjectStructure):
+        (JSC::JSGlobalObject::iteratorResultObjectStructure):
+        (JSC::JSGlobalObject::lazyTypedArrayStructure):
+        (JSC::JSGlobalObject::typedArrayStructure):
+        (JSC::JSGlobalObject::typedArrayStructureConcurrently):
+        (JSC::JSGlobalObject::isOriginalTypedArrayStructure):
+        (JSC::JSGlobalObject::typedArrayConstructor):
+        (JSC::JSGlobalObject::actualPointerFor):
+        (JSC::JSGlobalObject::internalFunctionStructure): Deleted.
+        * runtime/JSNativeStdFunction.cpp:
+        (JSC::JSNativeStdFunction::create):
+        * runtime/JSWithScope.cpp:
+        (JSC::JSWithScope::create):
+        (JSC::JSWithScope::visitChildren):
+        (JSC::JSWithScope::createStructure):
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::object):
+        (JSC::JSWithScope::create): Deleted.
+        (JSC::JSWithScope::createStructure): Deleted.
+        (JSC::JSWithScope::JSWithScope): Deleted.
+        * runtime/LazyClassStructure.cpp: Added.
+        (JSC::LazyClassStructure::Initializer::Initializer):
+        (JSC::LazyClassStructure::Initializer::setPrototype):
+        (JSC::LazyClassStructure::Initializer::setStructure):
+        (JSC::LazyClassStructure::Initializer::setConstructor):
+        (JSC::LazyClassStructure::visit):
+        (JSC::LazyClassStructure::dump):
+        * runtime/LazyClassStructure.h: Added.
+        (JSC::LazyClassStructure::LazyClassStructure):
+        (JSC::LazyClassStructure::get):
+        (JSC::LazyClassStructure::prototype):
+        (JSC::LazyClassStructure::constructor):
+        (JSC::LazyClassStructure::getConcurrently):
+        (JSC::LazyClassStructure::prototypeConcurrently):
+        (JSC::LazyClassStructure::constructorConcurrently):
+        * runtime/LazyClassStructureInlines.h: Added.
+        (JSC::LazyClassStructure::initLater):
+        * runtime/LazyProperty.h: Added.
+        (JSC::LazyProperty::Initializer::Initializer):
+        (JSC::LazyProperty::LazyProperty):
+        (JSC::LazyProperty::get):
+        (JSC::LazyProperty::getConcurrently):
+        * runtime/LazyPropertyInlines.h: Added.
+        (JSC::ElementType>::Initializer::set):
+        (JSC::ElementType>::initLater):
+        (JSC::ElementType>::setMayBeNull):
+        (JSC::ElementType>::set):
+        (JSC::ElementType>::visit):
+        (JSC::ElementType>::dump):
+        (JSC::ElementType>::callFunc):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::function):
+        (JSC::HashTableValue::functionLength):
+        (JSC::HashTableValue::propertyGetter):
+        (JSC::HashTableValue::propertyPutter):
+        (JSC::HashTableValue::accessorGetter):
+        (JSC::HashTableValue::accessorSetter):
+        (JSC::HashTableValue::constantInteger):
+        (JSC::HashTableValue::lexerValue):
+        (JSC::HashTableValue::lazyCellPropertyOffset):
+        (JSC::HashTableValue::lazyClassStructureOffset):
+        (JSC::HashTableValue::lazyPropertyCallback):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::putEntry):
+        (JSC::reifyStaticProperty):
+        * runtime/PropertySlot.h:
+        * runtime/TypedArrayType.h:
+
+2016-05-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Improve the grammar of some error messages 'a argument list' => 'an argument list'
+        https://bugs.webkit.org/show_bug.cgi?id=157350
+        <rdar://problem/26082108>
+
+        Reviewed by Mark Lam.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseIfStatement):
+        (JSC::Parser<LexerType>::parseImportDeclaration):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseObjectLiteral):
+        (JSC::Parser<LexerType>::parseStrictObjectLiteral):
+        (JSC::Parser<LexerType>::parseArguments):
+        Use the alternate error message formatter macro which outputs 'an'
+        instead of 'a' preceding the last argument.
+
+2016-05-04  Keith Miller  <keith_miller@apple.com>
+
+        Corrections to r200422
+        https://bugs.webkit.org/show_bug.cgi?id=157351
+
+        Reviewed by Joseph Pecoraro.
+
+        Fix some typos in various files. Also, make separate error messages
+        for the this value being undefined vs null in the ArrayIteratorprototype
+        next function and add test.
+
+        * Scripts/builtins/builtins_model.py:
+        * builtins/ArrayIteratorPrototype.js:
+        (next):
+        (arrayIteratorValueNext):
+        (arrayIteratorKeyNext):
+        (arrayIteratorKeyValueNext):
+        * builtins/ArrayPrototype.js:
+        (keys):
+        (entries):
+        * builtins/TypedArrayPrototype.js:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Deleted.
+        * tests/stress/array-iterators-next-error-messages.js: Added.
+        (assert):
+        (catch):
+
+2016-05-04  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, reland r200149 since the rollout had inconclusive PLT AB testing results.
+
+2016-05-04  Mark Lam  <mark.lam@apple.com>
+
+        ES6 Function.name inferred from property names of literal objects can break some websites.
+        https://bugs.webkit.org/show_bug.cgi?id=157246
+
+        Reviewed by Geoffrey Garen.
+
+        Specifically, the library mathjs (see http://mathjs.org and https://github.com/josdejong/mathjs)
+        uses an idiom where it created literal objects with property names that look like
+        this: 'number | BigNumber | Unit'.  Later, this name is used in a string to create
+        function source code that gets eval'ed.  Since 'number | BigNumber | Unit' is not
+        a valid function name, we get a syntax error.
+
+        Here are the details:
+
+        1. mathjs uses object literals with the funky property names for its function members.
+           For example, 
+
+              // helper function to type check the middle value of the array
+              var middle = typed({
+                'number | BigNumber | Unit': function (value) {
+                  return value;
+                }
+              });
+
+        2. mathjs' getName() uses Function.name to get the name of functions (hence, picks
+           up the property name as inferred value of Function.name as specified by ES6):
+
+                /**
+                 * Retrieve the function name from a set of functions, and check
+                 * whether the name of all functions match (if given)
+                 ...
+                 */
+                function getName (fns) {
+                  var name = '';
+
+                  for (var i = 0; i < fns.length; i++) {
+                    var fn = fns[i];
+                    ...
+                        name = fn.name;
+                    ...
+                  return name;
+                }
+
+        3. mathjs uses that name to assembler new function source code that gets eval'ed:
+
+                /**
+                 * Compose a function from sub-functions each handling a single type signature.
+                 ...
+                 */
+                function _typed(name, signatures) {
+                  ...
+                  // generate code for the typed function
+                  var code = [];
+                  var _name = name || '';
+                  ...
+                  code.push('function ' + _name + '(' + _args.join(', ') + ') {');
+                  code.push('  "use strict";');
+                  code.push('  var name = \'' + _name + '\';');
+                  code.push(node.toCode(refs, '  '));
+                  code.push('}');
+
+                  // generate body for the factory function
+                  var body = [
+                    refs.toCode(),
+                    'return ' + code.join('\n')
+                  ].join('\n');
+
+                  // evaluate the JavaScript code and attach function references
+                  var factory = (new Function(refs.name, 'createError', body));  // <== Syntax Error here!
+                  var fn = factory(refs, createError);
+                  ...
+                  return fn;
+                }
+
+        Until mathjs (and any other frameworks that does similar things) and sites that
+        uses mathjs has been updated to work with ES6, we'll need a compatibility hack to
+        work around it.
+
+        Here's what we'll do:
+        1. Introduce a needsSiteSpecificQuirks flag in JSGlobalObject.
+        2. Have WebCore's JSDOMWindowBase set that flag if the browser's
+           needsSiteSpecificQuirks is enabled in its settings.
+        3. If needsSiteSpecificQuirks is enabled, have JSFunction::reifyName() check for
+           ' ' or '|' in the name string it will use to reify the Function.name property.
+           If those characters exists in the name, we'll replace the name string with a
+           null string.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::reifyName):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::needsSiteSpecificQuirks):
+        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
+        (JSC::JSGlobalObject::setNeedsSiteSpecificQuirks):
+
+2016-05-04  Keith Miller  <keith_miller@apple.com>
+
+        Speedup array iterators
+        https://bugs.webkit.org/show_bug.cgi?id=157315
+
+        Reviewed by Michael Saboff.
+
+        This patch improves the performance of Array iterators in ES6. There are two main changes
+        that make things faster. The first is that the value, keys and entries functions have been
+        moved to JS. This enables us to inline the construction of the iterator. Thus, when we get
+        to the FTL we are able to sink the allocation of the iterator object. This significantly
+        improves the performance of any for-of loop since we are now able to have both the iteration
+        counter and the iterated object in local variables rather than in the heap.
+
+        Secondly, instead of using a number to store the iteratation kind we now use a virtual
+        method on the iteration object to indicate which next function to use. This ends up being
+        helpful because it means we can eliminate the branches in the old next function that decide
+        what value to return. With those branches gone the various next functions are now small
+        enough to inline. Once the next functions are inlined then the FTL is able to sink the
+        allocation of next() result object. There is still room for optimization in the loop since
+        we currently don't recognize that the array access in the next function is in bounds or that
+        the increment to the loop counter cannot overflow.
+
+        The overall performance changes appear to be a ~4-6x speedup in a simple microbenchmark that
+        computes the sum of an array with some extra arithmetic. The variance depends on the exact
+        body of the loop. Additionally, on a new regress test that changes all the loops in
+        deltablue into for-of loops this patch is a 1.8x progression. Overall, it still looks like
+        for-of loops are significantly slower than an indexed for loop. In the first test it's ~2-4x
+        slower with the difference depending on the body of the loop. If the loop is just the sum
+        then we see a much larger regression than if the loop does even simple arithmetic. It looks
+        like the indexed for loop without extra arithmetic is small enough to fit into the x86
+        replay buffer on my machine, which would explain why there is such a big difference between
+        the for of loop in that case. On the deltablue benchmark it's 1.4x slower. It's clear from
+        these numbers that there is still a lot of work we can do to make for of loops faster.
+
+        This patch also makes some changes to the way that we decorate our builtin js
+        functions. Instead of the old syntax (putting the decorated values in [] before the function
+        declaration i.e. [intrinsic=foo]) this patch changes the syntax to be closer to the way that
+        decorators are proposed in a future ECMAScript proposal (using @ followed by the entry on a
+        new line before the function declaration i.e. @intrinsic=foo).
+
+        Finally, in the builtin scripts regular expressions re.S has been changed to re.DOTALL since
+        DOTALL is easier to understand without going to the reference page for python regular
+        expressions.
+
+        * Scripts/builtins/builtins_model.py:
+        * builtins/ArrayIteratorPrototype.js:
+        (next):
+        (arrayIteratorValueNext):
+        (arrayIteratorKeyNext):
+        (arrayIteratorKeyValueNext):
+        * builtins/ArrayPrototype.js:
+        (createArrayIterator):
+        (values):
+        (keys):
+        (entries):
+        * builtins/RegExpPrototype.js:
+        (intrinsic.RegExpTestIntrinsic.test):
+        * builtins/StringPrototype.js:
+        (intrinsic.StringPrototypeReplaceIntrinsic.replace):
+        * builtins/TypedArrayPrototype.js:
+        (values):
+        (keys):
+        (entries):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::cloneArrayIteratorObject):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * jit/ThunkGenerators.cpp:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoFuncValues): Deleted.
+        (JSC::arrayProtoFuncEntries): Deleted.
+        (JSC::arrayProtoFuncKeys): Deleted.
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSArrayIterator.cpp:
+        (JSC::JSArrayIterator::clone): Deleted.
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncEntries): Deleted.
+        (JSC::genericTypedArrayViewProtoFuncKeys): Deleted.
+        (JSC::typedArrayViewProtoFuncValues): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        (JSC::typedArrayViewProtoFuncEntries): Deleted.
+        (JSC::typedArrayViewProtoFuncKeys): Deleted.
+        (JSC::typedArrayViewProtoFuncValues): Deleted.
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+
+2016-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Object constructor need to be aware of new.target
+        https://bugs.webkit.org/show_bug.cgi?id=157196
+
+        Reviewed by Darin Adler.
+
+        Object constructor should be aware of new.target.
+        When the new.target is specified, we should store it.prototype to the newly created
+        object's [[Prototype]].
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        Take the design that caches the structure used for empty object.
+        This structure is also used in constructEmptyObject frequently.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::objectStructureForObjectConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::constructWithObjectConstructor):
+        (JSC::callObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        (JSC::constructEmptyObject):
+        Construct the object by using the plain structure that is also used in the ObjectConstructor.
+
+        * tests/stress/object-constructor-should-be-new-target-aware.js: Added.
+        (shouldBe):
+        (Hello):
+
+2016-05-04  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r200383 and r200406.
+
+        Seems to have caused crashes on iOS / ARMv7s
+
+        Reverted changesets:
+
+        "Speed up JSGlobalObject initialization by making some
+        properties lazy"
+        https://bugs.webkit.org/show_bug.cgi?id=157045
+        http://trac.webkit.org/changeset/200383
+
+        "REGRESSION(r200383): Setting lazily initialized properties
+        across frame boundaries crashes"
+        https://bugs.webkit.org/show_bug.cgi?id=157333
+        http://trac.webkit.org/changeset/200406
+
+2016-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Assertion failure for super() call in direct eval in method function
+        https://bugs.webkit.org/show_bug.cgi?id=157091
+
+        Reviewed by Darin Adler.
+
+        While we ensure that direct super is under the correct context,
+        we don't check it for the eval code. This patch moves the check from the end of parsing the function
+        to the places where we found the direct super or the super bindings. This covers the direct eval that
+        contains the direct super calls.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Scope::hasDirectSuper):
+        (JSC::Scope::setHasDirectSuper):
+        (JSC::Scope::needsSuperBinding):
+        (JSC::Scope::setNeedsSuperBinding):
+        (JSC::Parser::closestParentOrdinaryFunctionNonLexicalScope):
+        * tests/stress/eval-and-super.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (prototype.m):
+        (prototype.n):
+        * tests/stress/generator-and-super.js: Added.
+        (testSyntaxError):
+        (testSyntaxError.Base.prototype.hello):
+        (testSyntaxError.Base.prototype.ok):
+        (testSyntaxError.Base):
+        (Hello.prototype.gen):
+        (Hello):
+        (testSyntaxError.hello):
+
+2016-05-03  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r200383): Setting lazily initialized properties across frame boundaries crashes
+        https://bugs.webkit.org/show_bug.cgi?id=157333
+
+        Reviewed by Benjamin Poulain.
+        
+        I forgot to add logic for lazy properties in putEntry(). It turns out that it's easy to
+        add.
+
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/PropertySlot.h:
+
+2016-05-03  Filip Pizlo  <fpizlo@apple.com>
+
+        References from code to Structures should be stronger than weak
+        https://bugs.webkit.org/show_bug.cgi?id=157324
+
+        Reviewed by Mark Lam.
+        
+        If code refers to a Structure and the Structure dies, then previously we'd kill the code. 
+        This makes sense because the Structure could be the only thing left referring to some global
+        object or prototype.
+
+        But this also causes unnecessary churn. Sometimes there will be a structure that we just
+        haven't really done anything with recently and so it appears dead. The approach we use
+        elsewhere in our type inference is that the type that the code uses is general enough to
+        handle every past execution. Having the GC clear code when some Structure it uses dies means
+        that we forget that the code used that Structure. We'll either assume that the code is more
+        monomorphic than it really is (because after GC we patch in some other structure but not the
+        deleted one, so it looks like we only ever saw the new structure), or we'll assume that it's
+        crazier than it really is (because we'll remember that there had been some structure that
+        caused deletion, so we'll assume that deletions might happen in the future, so we'll use a
+        fully dynamic IC).
+
+        This change introduces a more nuanced policy: if it's cheap to mark a dead Structure then we
+        should mark it just so that all of the code that refers to it remembers that there had been
+        this exact Structure in the past. If the code often goes through different Structures then
+        we already have great mechanisms to realize that the code is nutty (namely, the
+        PolymorphicAccess size limit). But if the code just does this a handful of times then
+        remembering this old Structure is probably net good:
+
+        - It obeys the "handle all past executions" law.
+        - It preserves the history of the property access, allowing a precise measure of its past
+          polymorphism.
+        - It makes the code ready to run fast if the user decides to use that Structure again.
+          Marking the Structure means it will stay in whatever property transition tables it was in,
+          so if the program does the same thing it did in the past, it will get this old Structure.
+
+        It looks like this is a progression in gbemu and it makes gbemu perform more
+        deterministically. Also, it seems that this makes JetStream run faster.
+        
+        Over five in-browser runs of JetStream, here's what we see before and after:
+        
+        Geometric Mean:
+            Before              After
+            229.23 +- 8.2523    230.70 +- 12.888
+            232.91 +- 15.638    239.04 +- 13.766
+            234.79 +- 12.760    236.32 +- 15.562
+            236.20 +- 23.125    242.02 +- 3.3865
+            237.22 +- 2.1929    237.23 +- 17.664
+        
+        Just gbemu:
+            Before              After
+            541.0 +- 135.8      481.7 +- 143.4
+            518.9 +- 15.65      508.1 +- 136.3
+            362.5 +- 0.8884     489.7 +- 101.4
+            470.7 +- 313.3      530.7 +- 11.49
+            418.7 +- 180.6      537.2 +- 6.514
+        
+        Notice that there is plenty of noise before and after, but the noise is now far less severe.
+        After this change I did not see any runs like "470.7 +- 313.3" where the size of the 
+        confidence interval (313.3 * 2) is greater than the score (470.7). Also, notice that the
+        least noisy run before the change also got a lower score than we ever observed after the
+        change (36.5 +- 0.8884). The noise, and these occasional very low scores, are due to a
+        pathology where the GC would reset some stubs at an unfortunate time during profiling,
+        causing the optimizing compiler to make many poor decisions. That pathology doesn't exist
+        anymore.
+        
+        On the other hand, prior to this change it was possible for gbemu to sometimes run sooooper
+        fast because the GC would cause the profiler to forget gbemu's behavior on the first tick
+        and focus only on its behavior in subsequent ticks. So, in steady state, we'd optimize gbemu
+        for its later behavior rather than a combination of its early behavior and later behavior.
+        We rarely got lucky this way, so it's not fair to view this quirk as a feature.
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::propagateTransitions):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::visitWeak):
+        (JSC::AccessCase::propagateTransitions):
+        (JSC::AccessCase::generateWithGuard):
+        (JSC::PolymorphicAccess::visitWeak):
+        (JSC::PolymorphicAccess::propagateTransitions):
+        (JSC::PolymorphicAccess::dump):
+        * bytecode/PolymorphicAccess.h:
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::visitWeakReferences):
+        (JSC::StructureStubInfo::propagateTransitions):
+        (JSC::StructureStubInfo::containsPC):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::considerCaching):
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+        (JSC::Structure::isCheapDuringGC):
+        (JSC::Structure::markIfCheap):
+        (JSC::Structure::prototypeChainMayInterceptStoreTo):
+        * runtime/Structure.h:
+
+2016-05-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Simplify console.clear
+        https://bugs.webkit.org/show_bug.cgi?id=157316
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/ScriptArguments.cpp:
+        (Inspector::ScriptArguments::createEmpty):
+        (Inspector::ScriptArguments::ScriptArguments):
+        * inspector/ScriptArguments.h:
+        Provide a way to create an empty list.
+
+        * runtime/ConsoleClient.cpp:
+        (JSC::ConsoleClient::clear):
+        * runtime/ConsoleClient.h:
+        Drop unnecessary parameter.
+
+        * runtime/ConsoleObject.cpp:
+        (JSC::consoleProtoFuncClear):
+        No need to parse arguments.
+
+2016-05-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Improve Symbol() to string coercion error message
+        https://bugs.webkit.org/show_bug.cgi?id=157317
+
+        Reviewed by Geoffrey Garen.
+
+        Improve error messages related to Symbols.
+
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::toNumber):
+        * runtime/SymbolConstructor.cpp:
+        (JSC::symbolConstructorKeyFor):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::symbolProtoFuncToString):
+        (JSC::symbolProtoFuncValueOf):
+        * tests/stress/dfg-to-primitive-pass-symbol.js:
+        * tests/stress/floating-point-div-to-mul.js:
+        (i.catch):
+        * tests/stress/string-from-code-point.js:
+        (shouldThrow):
+        (string_appeared_here.shouldThrow):
+        * tests/stress/symbol-error-messages.js: Added.
+        (shouldThrow):
+        * tests/stress/symbol-registry.js:
+
+2016-05-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Give console.time/timeEnd a default label and warnings
+        https://bugs.webkit.org/show_bug.cgi?id=157325
+        <rdar://problem/26073290>
+
+        Reviewed by Timothy Hatcher.
+
+        Provide more user friendly console.time/timeEnd. The timer name
+        is now optional, and is "default" if not provided. Also provide
+        warnings when attempting to start an already started timer,
+        or stop a timer that does not exist.
+
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::startTiming):
+        (Inspector::InspectorConsoleAgent::stopTiming):
+        Warnings for bad cases.
+
+        * runtime/ConsoleObject.cpp:
+        (JSC::defaultLabelString):
+        (JSC::consoleProtoFuncTime):
+        (JSC::consoleProtoFuncTimeEnd):
+        Optional label becomes "default".
+
+2016-05-03  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the ENABLE(WEBASSEMBLY) build
+        https://bugs.webkit.org/show_bug.cgi?id=157312
+
+        Reviewed by Darin Adler.
+
+        * runtime/Executable.cpp:
+        (JSC::WebAssemblyExecutable::WebAssemblyExecutable):
+        * wasm/WASMFunctionCompiler.h:
+        (JSC::WASMFunctionCompiler::convertValueToDouble):
+
+2016-05-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove unused parameter of ScriptArguments::getFirstArgumentAsString
+        https://bugs.webkit.org/show_bug.cgi?id=157301
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/ScriptArguments.cpp:
+        (Inspector::ScriptArguments::getFirstArgumentAsString):
+        * inspector/ScriptArguments.h:
+        Remove unused argument and related code.
+
+        * runtime/ConsoleClient.cpp:
+        (JSC::ConsoleClient::printConsoleMessageWithArguments):
+        Drive by remove unnecessary cast.
+
+2016-05-03  Michael Saboff  <msaboff@apple.com>
+
+        Crash: Array.prototype.slice() and .splice() can call fastSlice() after an array is truncated
+        https://bugs.webkit.org/show_bug.cgi?id=157322
+
+        Reviewed by Filip Pizlo.
+
+        Check to see if the source array has changed length before calling fastSlice().
+        If it has, take the slow path.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        * tests/stress/regress-157322.js: New test.
+
+2016-05-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Eliminate PassRefPtr conversion from ConsoleObject
+        https://bugs.webkit.org/show_bug.cgi?id=157300
+
+        Reviewed by Timothy Hatcher.
+
+        * runtime/ConsoleObject.cpp:
+        (JSC::consoleLogWithLevel):
+        (JSC::consoleProtoFuncClear):
+        (JSC::consoleProtoFuncDir):
+        (JSC::consoleProtoFuncDirXML):
+        (JSC::consoleProtoFuncTable):
+        (JSC::consoleProtoFuncTrace):
+        (JSC::consoleProtoFuncAssert):
+        (JSC::consoleProtoFuncCount):
+        (JSC::consoleProtoFuncTimeStamp):
+        (JSC::consoleProtoFuncGroup):
+        (JSC::consoleProtoFuncGroupCollapsed):
+        (JSC::consoleProtoFuncGroupEnd):
+        No need to release to a PassRefPtr, we can just move into the RefPtr<>&&.
+
+2016-05-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Speed up JSGlobalObject initialization by making some properties lazy
+        https://bugs.webkit.org/show_bug.cgi?id=157045
+
+        Reviewed by Keith Miller.
+        
+        This makes about half of JSGlobalObject's state lazy. There are three categories of
+        state in JSGlobalObject:
+        
+        1) C++ fields in JSGlobalObject.
+        2) JS object properties in JSGlobalObject's JSObject superclass.
+        3) JS variables in JSGlobalObject's JSSegmentedVariableObject superclass.
+        
+        State held in JS variables cannot yet be made lazy. That's why this patch only goes
+        half-way.
+        
+        State in JS object properties can be made lazy if we move it to the static property
+        hashtable. JSGlobalObject already had one of those. This patch makes static property
+        hashtables a lot more powerful, by adding three new kinds of static properties. These
+        new kinds allow us to make almost all of JSGlobalObject's object properties lazy.
+        
+        State in C++ fields can now be made lazy thanks in part to WTF's support for stateless
+        lambdas. You can of course make anything lazy by hand, but there are many C++ fields in
+        JSGlobalObject and we are adding more all the time. We don't want to require that each
+        of these has a getter with an initialization check and a corresponding out-of-line slow
+        path that does the initialization. We want this kind of boilerplate to be handled by
+        some abstractions.
+        
+        The primary abstraction introduced in this patch is LazyProperty<Type>. Currently, this
+        only works where Type is a subclass of JSCell. Such a property holds a pointer to Type.
+        You can use it like you would a WriteBarrier<Type>. It even has set() and get() methods,
+        so it's almost a drop-in replacement.
+        
+        The key to LazyProperty<Type>'s power is that you can do this:
+        
+            class Bar {
+                ...
+                LazyProperty<Foo> m_foo;
+            };
+            ...
+            m_foo.initLater(
+                [] (const LazyProperty<Foo>::Initializer<Bar>& init) {
+                    init.set(Foo::create(init.vm, init.owner));
+                });
+        
+        This initLater() call requires that you pass a stateless lambda (see WTF changelog for
+        the definition). Miraculously, this initLater() call is guaranteed to compile to a store
+        of a pointer constant to m_foo, as in:
+        
+            movabsq 0xBLAH, %rax
+            movq %rax, &m_foo
+        
+        This magical pointer constant points to a callback that was generated by the template
+        instantiation of initLater(). That callback knows to call your stateless lambda, but
+        also does some other bookkeeping: it makes sure that you indeed initialized the property
+        inside the callback and it manages recursive initializations. It's totally legal to call
+        m_foo.get() inside the initLater() callback. If you do that before you call init.set(),
+        m_foo.get() will return null. This is an excellent escape hatch if we ever find
+        ourselves in a dependency cycle. I added this feature because I already had to create a
+        dependency cycle.
+        
+        Note that using LazyProperties from DFG threads is super awkward. It's going to be hard
+        to get this right. The DFG thread cannot initialize those fields, so it has to make sure
+        that it does conservative things. But for some nodes this could mean adding a lot of new
+        logic, like NewTypedArray, which currently is written in such a way that it assumes that
+        we always have the typed array structure. Currently we take a two-fold approach: for
+        typed arrays we don't handle the NewTypedArray intrinsic if the structure isn't
+        initialized, and for everything else we don't make the properties lazy if the DFG needs
+        them. As we optimize this further we might need to teach the DFG to handle more lazy
+        properties. I tried to do this for RegExp but found it to be very confusing. With typed
+        arrays I got lucky.
+        
+        There is also a somewhat more powerful construct called LazyClassStructure. We often
+        need to keep around the structure of some standard JS class, like Date. We also need to
+        make sure that the constructor ends up in the global object's property table. And we
+        often need to keep the original value of the constructor for ourselves. In this case, we
+        want to make sure that the creation of the structure-prototype-constructor constellation
+        is atomic. We don't want code to start looking at the structure if it points to a
+        prototype that doesn't have its "constructor" property set yet, for example.
+        LazyClassStructure solves this by abstracting that whole initialization. You provide the
+        callback that allocates everything, since we are super inconsistent about the way we
+        initialize things, but LazyClassStructure establishes the workflow and helps you not
+        mess up.
+        
+        Finally, the new static hashtable attributes allow for all of this to work with the JS
+        property table:
+        
+        PropertyCallback: if you use this attribute, the second column in the table should be
+        the name of a function to call to initialize this property. This is useful for things
+        like the Math property. The Math object turns out to be very expensive to allocate.
+        Delaying its allocation is super easy with the PropertyCallback attribute.
+        
+        CellProperty: with this attribute the second column should be a C++ field name like
+        JSGlobalObject::m_evalErrorConstructor. The static hashtable will grab the offset of
+        this property, and when it needs to be initialized, Lookup will assume you have a
+        LazyProperty<JSCell> and call its get() method. It will initialize the property to
+        whatever get() returned. Note that it's legal to cast a LazyProperty<Anything> to
+        LazyProperty<JSCell> for the purpose of calling get() because the get() method will just
+        call whatever callback function pointer is encoded in the property and it does not need
+        to know anything about what type that callback will instantiate.
+        
+        ClassStructure: with this attribute the second column should be a C++ field name. The
+        static hashtable will initialize the property by treating the field as a
+        LazyClassStructure and it will call get(). LazyClassStructure completely owns the whole
+        initialization workflow, so Lookup assumes that when LazyClassStructure::get() returns,
+        the property in question will already be set. By convention, we have LazyClassStructure
+        initialize the property with a pointer to the constructor, since that's how all of our
+        classes work: "globalObject.Date" points to the DateConstructor.
+        
+        This is a 2x speed-up in JSGlobalObject initialization time in a microbenchmark that
+        calls our C API. This is a 1% speed-up on SunSpider and JSRegress.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::create):
+        * API/ObjCCallbackFunction.h:
+        (JSC::ObjCCallbackFunction::impl):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunction::ObjCCallbackFunction):
+        (JSC::ObjCCallbackFunction::create):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_hash_table:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::originalArrayStructure):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        (JSC::ClonedArguments::materializeSpecials):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::visitChildren):
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::calculatedDisplayName):
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/InternalFunction.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::finishCreation):
+        (JSC::JSBoundFunction::visitChildren):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::createProxyProperty):
+        (JSC::createJSONProperty):
+        (JSC::createMathProperty):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::visitChildren):
+        (JSC::JSGlobalObject::toThis):
+        (JSC::JSGlobalObject::getOwnPropertySlot):
+        (JSC::JSGlobalObject::createThrowTypeError): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::objectConstructor):
+        (JSC::JSGlobalObject::promiseConstructor):
+        (JSC::JSGlobalObject::internalPromiseConstructor):
+        (JSC::JSGlobalObject::evalErrorConstructor):
+        (JSC::JSGlobalObject::rangeErrorConstructor):
+        (JSC::JSGlobalObject::referenceErrorConstructor):
+        (JSC::JSGlobalObject::syntaxErrorConstructor):
+        (JSC::JSGlobalObject::typeErrorConstructor):
+        (JSC::JSGlobalObject::URIErrorConstructor):
+        (JSC::JSGlobalObject::nullGetterFunction):
+        (JSC::JSGlobalObject::nullSetterFunction):
+        (JSC::JSGlobalObject::callFunction):
+        (JSC::JSGlobalObject::applyFunction):
+        (JSC::JSGlobalObject::definePropertyFunction):
+        (JSC::JSGlobalObject::arrayProtoValuesFunction):
+        (JSC::JSGlobalObject::initializePromiseFunction):
+        (JSC::JSGlobalObject::newPromiseCapabilityFunction):
+        (JSC::JSGlobalObject::functionProtoHasInstanceSymbolFunction):
+        (JSC::JSGlobalObject::regExpProtoExecFunction):
+        (JSC::JSGlobalObject::regExpProtoSymbolReplaceFunction):
+        (JSC::JSGlobalObject::regExpProtoGlobalGetter):
+        (JSC::JSGlobalObject::regExpProtoUnicodeGetter):
+        (JSC::JSGlobalObject::throwTypeErrorGetterSetter):
+        (JSC::JSGlobalObject::moduleLoader):
+        (JSC::JSGlobalObject::objectPrototype):
+        (JSC::JSGlobalObject::functionPrototype):
+        (JSC::JSGlobalObject::arrayPrototype):
+        (JSC::JSGlobalObject::booleanPrototype):
+        (JSC::JSGlobalObject::stringPrototype):
+        (JSC::JSGlobalObject::symbolPrototype):
+        (JSC::JSGlobalObject::numberPrototype):
+        (JSC::JSGlobalObject::datePrototype):
+        (JSC::JSGlobalObject::regExpPrototype):
+        (JSC::JSGlobalObject::errorPrototype):
+        (JSC::JSGlobalObject::iteratorPrototype):
+        (JSC::JSGlobalObject::generatorFunctionPrototype):
+        (JSC::JSGlobalObject::generatorPrototype):
+        (JSC::JSGlobalObject::debuggerScopeStructure):
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::strictEvalActivationStructure):
+        (JSC::JSGlobalObject::activationStructure):
+        (JSC::JSGlobalObject::moduleEnvironmentStructure):
+        (JSC::JSGlobalObject::directArgumentsStructure):
+        (JSC::JSGlobalObject::scopedArgumentsStructure):
+        (JSC::JSGlobalObject::clonedArgumentsStructure):
+        (JSC::JSGlobalObject::isOriginalArrayStructure):
+        (JSC::JSGlobalObject::booleanObjectStructure):
+        (JSC::JSGlobalObject::callbackConstructorStructure):
+        (JSC::JSGlobalObject::callbackFunctionStructure):
+        (JSC::JSGlobalObject::callbackObjectStructure):
+        (JSC::JSGlobalObject::propertyNameIteratorStructure):
+        (JSC::JSGlobalObject::objcCallbackFunctionStructure):
+        (JSC::JSGlobalObject::objcWrapperObjectStructure):
+        (JSC::JSGlobalObject::dateStructure):
+        (JSC::JSGlobalObject::nullPrototypeObjectStructure):
+        (JSC::JSGlobalObject::errorStructure):
+        (JSC::JSGlobalObject::calleeStructure):
+        (JSC::JSGlobalObject::functionStructure):
+        (JSC::JSGlobalObject::boundFunctionStructure):
+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure):
+        (JSC::JSGlobalObject::getterSetterStructure):
+        (JSC::JSGlobalObject::nativeStdFunctionStructure):
+        (JSC::JSGlobalObject::namedFunctionStructure):
+        (JSC::JSGlobalObject::functionNameOffset):
+        (JSC::JSGlobalObject::numberObjectStructure):
+        (JSC::JSGlobalObject::privateNameStructure):
+        (JSC::JSGlobalObject::mapStructure):
+        (JSC::JSGlobalObject::regExpStructure):
+        (JSC::JSGlobalObject::generatorFunctionStructure):
+        (JSC::JSGlobalObject::setStructure):
+        (JSC::JSGlobalObject::stringObjectStructure):
+        (JSC::JSGlobalObject::symbolObjectStructure):
+        (JSC::JSGlobalObject::iteratorResultObjectStructure):
+        (JSC::JSGlobalObject::lazyTypedArrayStructure):
+        (JSC::JSGlobalObject::typedArrayStructure):
+        (JSC::JSGlobalObject::typedArrayStructureConcurrently):
+        (JSC::JSGlobalObject::isOriginalTypedArrayStructure):
+        (JSC::JSGlobalObject::typedArrayConstructor):
+        (JSC::JSGlobalObject::actualPointerFor):
+        (JSC::JSGlobalObject::internalFunctionStructure): Deleted.
+        * runtime/JSNativeStdFunction.cpp:
+        (JSC::JSNativeStdFunction::create):
+        * runtime/JSWithScope.cpp:
+        (JSC::JSWithScope::create):
+        (JSC::JSWithScope::visitChildren):
+        (JSC::JSWithScope::createStructure):
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::object):
+        (JSC::JSWithScope::create): Deleted.
+        (JSC::JSWithScope::createStructure): Deleted.
+        (JSC::JSWithScope::JSWithScope): Deleted.
+        * runtime/LazyClassStructure.cpp: Added.
+        (JSC::LazyClassStructure::Initializer::Initializer):
+        (JSC::LazyClassStructure::Initializer::setPrototype):
+        (JSC::LazyClassStructure::Initializer::setStructure):
+        (JSC::LazyClassStructure::Initializer::setConstructor):
+        (JSC::LazyClassStructure::visit):
+        (JSC::LazyClassStructure::dump):
+        * runtime/LazyClassStructure.h: Added.
+        (JSC::LazyClassStructure::LazyClassStructure):
+        (JSC::LazyClassStructure::get):
+        (JSC::LazyClassStructure::prototype):
+        (JSC::LazyClassStructure::constructor):
+        (JSC::LazyClassStructure::getConcurrently):
+        (JSC::LazyClassStructure::prototypeConcurrently):
+        (JSC::LazyClassStructure::constructorConcurrently):
+        * runtime/LazyClassStructureInlines.h: Added.
+        (JSC::LazyClassStructure::initLater):
+        * runtime/LazyProperty.h: Added.
+        (JSC::LazyProperty::Initializer::Initializer):
+        (JSC::LazyProperty::LazyProperty):
+        (JSC::LazyProperty::get):
+        (JSC::LazyProperty::getConcurrently):
+        * runtime/LazyPropertyInlines.h: Added.
+        (JSC::LazyProperty<ElementType>::Initializer<OwnerType>::set):
+        (JSC::LazyProperty<ElementType>::initLater):
+        (JSC::LazyProperty<ElementType>::setMayBeNull):
+        (JSC::LazyProperty<ElementType>::set):
+        (JSC::LazyProperty<ElementType>::visit):
+        (JSC::LazyProperty<ElementType>::dump):
+        (JSC::LazyProperty<ElementType>::callFunc):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::HashTableValue::function):
+        (JSC::HashTableValue::functionLength):
+        (JSC::HashTableValue::propertyGetter):
+        (JSC::HashTableValue::propertyPutter):
+        (JSC::HashTableValue::accessorGetter):
+        (JSC::HashTableValue::accessorSetter):
+        (JSC::HashTableValue::constantInteger):
+        (JSC::HashTableValue::lexerValue):
+        (JSC::HashTableValue::lazyCellPropertyOffset):
+        (JSC::HashTableValue::lazyClassStructureOffset):
+        (JSC::HashTableValue::lazyPropertyCallback):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::reifyStaticProperty):
+        * runtime/PropertySlot.h:
+        * runtime/TypedArrayType.h:
+
+2016-05-03  Per Arne Vollan  <peavo@outlook.com>
+
+        [Win] Remove Windows XP Compatibility Requirements
+        https://bugs.webkit.org/show_bug.cgi?id=152899
+
+        Reviewed by Brent Fulgham.
+
+        Windows XP is not supported anymore, we can remove workarounds.
+
+        * JavaScriptCore.vcxproj/jsc/DLLLauncherMain.cpp:
+        (enableTerminationOnHeapCorruption):
+
+2016-05-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: console.assert should do far less work when the assertion is true
+        https://bugs.webkit.org/show_bug.cgi?id=157297
+        <rdar://problem/26056556>
+
+        Reviewed by Timothy Hatcher.
+
+        * runtime/ConsoleClient.h:
+        * runtime/ConsoleClient.cpp:
+        (JSC::ConsoleClient::assertion):
+        (JSC::ConsoleClient::assertCondition): Deleted.
+        Rename, now that this will only get called when the assertion failed.
+
+        * runtime/ConsoleObject.cpp:
+        (JSC::consoleProtoFuncAssert):
+        Avoid doing any work if the assertion succeeded.
+
+2016-05-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed follow-up testapi fix after r200355.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        Revert back to non-enumerable. This matches our older behavior,
+        we can decide to make this Enumerable later if needed.
+
+2016-05-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Reflect.toString() should be [object Object] not [object Reflect]
+        https://bugs.webkit.org/show_bug.cgi?id=157288
+
+        Reviewed by Darin Adler.
+
+        * runtime/ReflectObject.cpp:
+        * tests/stress/reflect.js: Added.
+
+2016-05-02  Jon Davis  <jond@apple.com>
+
+        Add Resource Timing entry to the Feature Status page.
+        https://bugs.webkit.org/show_bug.cgi?id=157285
+
+        Reviewed by Timothy Hatcher.
+
+        * features.json:
+
+2016-05-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Make console a namespace object (like Math/JSON), allowing functions to be called unbound
+        https://bugs.webkit.org/show_bug.cgi?id=157286
+        <rdar://problem/26052830>
+
+        Reviewed by Timothy Hatcher.
+
+        This changes `console` to be a global namespace object, like `Math` and `JSON`.
+        It just holds a bunch of functions, that can be used on their own, unbound.
+        For example, `[1,2,3].forEach(console.log)` and `var log = console.log; log(1)`
+        used to throw exceptions and now do not.
+
+        Previously console was an Object/Prototype pair, so functions were on
+        ConsolePrototype (console.__proto__.log) and they needed to be called
+        Console objects as the `this` value. Now, `console` is just a standard
+        object with a bunch of functions. Since there is no console prototype the
+        functions can be passed around and called as expected and they will
+        just do the right thing.
+
+        For compatability with other browsers, `console` was made enumerable
+        on the global object.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Add new files and remove old files.
+
+        * runtime/CommonIdentifiers.h:
+        Add "console".
+
+        * runtime/ConsoleObject.cpp: Renamed from Source/JavaScriptCore/runtime/ConsolePrototype.cpp.
+        (JSC::ConsoleObject::ConsoleObject):
+        (JSC::ConsoleObject::finishCreation):
+        (JSC::valueToStringWithUndefinedOrNullCheck):
+        (JSC::consoleLogWithLevel):
+        (JSC::consoleProtoFuncDebug):
+        (JSC::consoleProtoFuncError):
+        (JSC::consoleProtoFuncLog):
+        (JSC::consoleProtoFuncInfo):
+        (JSC::consoleProtoFuncWarn):
+        (JSC::consoleProtoFuncClear):
+        (JSC::consoleProtoFuncDir):
+        (JSC::consoleProtoFuncDirXML):
+        (JSC::consoleProtoFuncTable):
+        (JSC::consoleProtoFuncTrace):
+        (JSC::consoleProtoFuncAssert):
+        (JSC::consoleProtoFuncCount):
+        (JSC::consoleProtoFuncProfile):
+        (JSC::consoleProtoFuncProfileEnd):
+        (JSC::consoleProtoFuncTakeHeapSnapshot):
+        (JSC::consoleProtoFuncTime):
+        (JSC::consoleProtoFuncTimeEnd):
+        (JSC::consoleProtoFuncTimeStamp):
+        (JSC::consoleProtoFuncGroup):
+        (JSC::consoleProtoFuncGroupCollapsed):
+        (JSC::consoleProtoFuncGroupEnd):
+        Console functions no longer need to check if the this object is
+        a Console object. They will always just work now.
+
+        * runtime/MathObject.cpp:
+        * runtime/MathObject.h:
+        * runtime/ConsoleObject.h: Renamed from Source/JavaScriptCore/runtime/ConsolePrototype.h.
+        (JSC::ConsoleObject::create):
+        (JSC::ConsoleObject::createStructure):
+        ConsoleObject is a basic object like MathObject.
+
+        * runtime/JSConsole.cpp: Removed.
+        * runtime/JSConsole.h: Removed.
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        Remove JSConsole / ConsolePrototype in favor of the single ConsoleObject.
+
+2016-05-02  Per Arne Vollan  <peavo@outlook.com>
+
+        [Win] Clean up annoying compiler warnings
+        https://bugs.webkit.org/show_bug.cgi?id=149813
+
+        Reviewed by Alex Christensen.
+
+        * bytecode/PropertyCondition.cpp:
+        (JSC::PropertyCondition::isWatchableWhenValid):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::sendPendingErrors):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::createWithInlineFrame):
+        * runtime/Error.cpp:
+        (JSC::addErrorInfoAndGetBytecodeOffset):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::heapSnapshot):
+        (JSC::callToPrimitiveFunction):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::flagsString):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::StackFrame::functionStartColumn):
+
+2016-05-02  Keith Miller  <keith_miller@apple.com>
+
+        ToThis should be able to be eliminated in Constant Folding
+        https://bugs.webkit.org/show_bug.cgi?id=157213
+
+        Reviewed by Saam Barati.
+
+        This patch enables eliminating the ToThis value when we have abstract interpreter
+        indicates the node is not needed. Since there are Objects that override their
+        ToThis behavior we first check if we can eliminate the node by looking at its
+        speculated type. If the function is in strict mode then we can eliminate ToThis as
+        long as the speculated type is not SpecObjectOther since that contains objects
+        that may set OverridesToThis. If the function is not in strict mode then we can
+        eliminate ToThis as long is the speculated type is an object that is not SpecObjectOther.
+
+        If we can't eliminate with type information we can still eliminate the ToThis node with
+        the proven structure set. When ToThis only sees structures that do not set OverridesToThis
+        it can be eliminated. Additionally, if the function is in strict mode then we can eliminate
+        ToThis as long as all only the object structures don't set OverridesToThis.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::isToThisAnIdentity):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupToThis):
+        * tests/stress/to-this-global-object.js: Added.
+        (test):
+        (test2):
+        (get for):
+
+2016-05-01  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        Class contructor and methods shouldn't have "arguments" and "caller"
+        https://bugs.webkit.org/show_bug.cgi?id=144238
+
+        Reviewed by Ryosuke Niwa.
+
+        Added TypeError that is raised in case of access to properties 'arguments' or 'caller'
+        of constructor or method of class. Actually TypeError already raised for most cases, except
+        case with undeclared constructor e. g. 
+        class A {}
+        (new A).constructor.caller 
+        (new A).constructor.arguments
+
+        * runtime/JSFunction.cpp:
+        (JSC::getThrowTypeErrorGetterSetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createThrowTypeErrorArgumentsAndCaller):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::throwTypeErrorArgumentsAndCallerGetterSetter):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncThrowTypeErrorArgumentsAndCaller):
+        * runtime/JSGlobalObjectFunctions.h:
+
+2016-05-02  Yoav Weiss  <yoav@yoav.ws>
+
+        Move ResourceTiming behind a runtime flag
+        https://bugs.webkit.org/show_bug.cgi?id=157133
+
+        Reviewed by Alex Christensen.
+
+        * runtime/CommonIdentifiers.h: Added PerformanceEntry, PerformanceEntryList and PerformanceResourceTiming as property names.
+
+2016-05-02  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Assertion failure for bound function with custom prototype and Reflect.construct
+        https://bugs.webkit.org/show_bug.cgi?id=157081
+
+        Reviewed by Saam Barati.
+
+        We ensured `newTarget != exec->callee()`. However, it does not mean `newTarget.get("prototype") != exec->callee()->get("prototype")`.
+        When the given `prototype` is the same to `baseStructure->sotredPrototype()`, it is unnecessary to create a new structure from this
+        baseStructure.
+
+        * bytecode/InternalFunctionAllocationProfile.h:
+        (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
+        * tests/stress/custom-prototype-may-be-same-to-original-one.js: Added.
+        (shouldBe):
+        (boundFunction):
+
+2016-04-30  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Guard ObjC-specific code in Heap.cpp with USE(FOUNDATION)
+        https://bugs.webkit.org/show_bug.cgi?id=157236
+
+        Reviewed by Darin Adler.
+
+        This also fixes build with GCC 4.8 which does not provide
+        __has_include.
+
+        * heap/Heap.cpp:
+
+2016-04-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Assertion failure for destructuring assignment with new.target and unary operator
+        https://bugs.webkit.org/show_bug.cgi?id=157149
+
+        Reviewed by Saam Barati.
+
+        The caller of parseDefaultValueForDestructuringPattern() should propagate errors.
+        And this patch also cleans up createSavePoint and createSavePointForError; introducing SavePointWithError.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseSourceElements):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        Add propagateErorr() for parseDefaultValueForDestructuringPattern.
+
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::Parser::restoreLexerState):
+        (JSC::Parser::internalSaveState):
+        (JSC::Parser::createSavePointForError):
+        (JSC::Parser::createSavePoint):
+        (JSC::Parser::internalRestoreState):
+        (JSC::Parser::restoreSavePointWithError):
+        (JSC::Parser::restoreSavePoint):
+        * tests/stress/default-value-parsing-should-propagate-error.js: Added.
+        (testSyntaxError):
+        (testSyntaxError.f):
+
+2016-04-28  Darin Adler  <darin@apple.com>
+
+        First step in using "enum class" instead of "String" for enumerations in DOM
+        https://bugs.webkit.org/show_bug.cgi?id=157163
+
+        Reviewed by Chris Dumez.
+
+        * runtime/JSString.h:
+        (JSC::jsStringWithCache): Deleted unneeded overload for AtomicString.
+
+2016-04-29  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC][ARMv7S] Arithmetic module results change when tiering up to DFG
+        https://bugs.webkit.org/show_bug.cgi?id=157217
+        rdar://problem/24733432
+
+        Reviewed by Mark Lam.
+
+        ARMv7's fmod() returns less accurate results than an integer division.
+        Since we have integer div on ARMv7s, the results start changing when
+        we reach DFG.
+
+        In this patch, I change our fmod slow path to behave like the fast path
+        on ARMv7s.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMod):
+        (JSC::DFG::fmodAsDFGOperation): Deleted.
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/MathCommon.cpp:
+        (JSC::isStrictInt32):
+        * runtime/MathCommon.h:
+
+2016-04-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Issues inspecting the inspector, pausing on breakpoints causes content to not load
+        https://bugs.webkit.org/show_bug.cgi?id=157198
+        <rdar://problem/26011049>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::sendResponse):
+        While auditing the code, add a WTFMove.
+
+2016-04-29  Mark Lam  <mark.lam@apple.com>
+
+        Make RegExp.prototype.test spec compliant.
+        https://bugs.webkit.org/show_bug.cgi?id=155862
+
+        Reviewed by Saam Barati.
+
+        * builtins/RegExpPrototype.js:
+        (intrinsic.RegExpTestIntrinsic.test):
+
+        * create_hash_table:
+        - Delete obsoleted code.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::addToGraph):
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        - We now have 2 intrinsics for RegExp.prototype.test:
+          RegExpTestIntrinsic and RegExpTestFastIntrinsic.
+
+          RegExpTestIntrinsic maps to the entry at the top of the builtin ES6
+          RegExp.prototype.test.
+          RegExpTestFastIntrinsic maps to the fast path in the builtin ES6
+          RegExp.prototype.test.
+
+          Both will end up using the RegExpTest DFG node to implement the fast path
+          of RegExp.prototype.test.  RegExpTestIntrinsic will have some additional checks
+          before the RegExpTest node.  Those checks are for speculating that it is ok for
+          us to take the fast path.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        - Added the regExpTestFast function.
+        - Also fixed the parameter length on 2 other functions that were erroneous.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncTestFast):
+        (JSC::regExpProtoFuncTest): Deleted.
+        * runtime/RegExpPrototype.h:
+        * tests/es6.yaml:
+
+2016-04-29  Benjamin Poulain  <benjamin@webkit.org>
+
+        Extend math-pow-stable-results.js to get more information about the failure
+
+        * tests/stress/math-pow-stable-results.js:
+
+2016-04-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Assertion failure for exception in "prototype" property getter and Reflect.construct
+        https://bugs.webkit.org/show_bug.cgi?id=157084
+
+        Reviewed by Mark Lam.
+
+        InternalFunction::createSubclassStrucuture may throw exceptions because it performs [[Get]] to
+        look up the "prototype" object. The current assertion is invalid.
+        We also found that Object constructor is not aware of new.target. This is filed[1].
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=157196
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+        * tests/stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js: Added.
+        (shouldThrow):
+        (bf):
+
+2016-04-29  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r200232.
+        https://bugs.webkit.org/show_bug.cgi?id=157189
+
+        This change broke the Mac CMake build and its LayoutTest is
+        failing and/or flaky on all platforms (Requested by ryanhaddad
+        on #webkit).
+
+        Reverted changeset:
+
+        "Move ResourceTiming behind a runtime flag"
+        https://bugs.webkit.org/show_bug.cgi?id=157133
+        http://trac.webkit.org/changeset/200232
+
+2016-04-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] RegExp.prototype.@@replace should use @isObject instead of `instanceof` for object guard
+        https://bugs.webkit.org/show_bug.cgi?id=157124
+
+        Reviewed by Keith Miller.
+
+        Use @isObject instead of `instanceof @Object`.
+        The `instanceof` check is not enough to check Object Type.
+        This fix itself is the same to r199647, and this patch is for RegExp.prototype.@@replace.
+
+        * builtins/RegExpPrototype.js:
+        (replace):
+        * tests/stress/regexp-replace-in-other-realm-should-work.js: Added.
+        (shouldBe):
+        * tests/stress/regexp-replace-should-work-with-objects-not-inheriting-object-prototype.js: Added.
+        (shouldBe):
+        (regexp.exec):
+
+2016-04-29  Yoav Weiss  <yoav@yoav.ws>
+
+        Move ResourceTiming behind a runtime flag
+        https://bugs.webkit.org/show_bug.cgi?id=157133
+
+        Reviewed by Alex Christensen.
+
+        * runtime/CommonIdentifiers.h: Added PerformanceEntry, PerformanceEntryList and PerformanceResourceTiming as property names.
+
+2016-04-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unused bool parameter in CodeCache::getGlobalCodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=157156
+
+        Reviewed by Mark Lam.
+
+        The bool parameter appears to be isArrowFunctionContext, but the method's
+        contents just get that property from the Executable, so the parameter is
+        unnecessary and unused.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        * runtime/CodeCache.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::create):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+
+2016-04-28  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] re-implement String#padStart and String#padEnd in JavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=157146
+
+        Reviewed by Saam Barati.
+
+        * builtins/StringPrototype.js:
+        (repeatCharactersSlowPath):
+        (padStart):
+        (padEnd):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation): Deleted.
+        (JSC::repeatStringPattern): Deleted.
+        (JSC::padString): Deleted.
+        (JSC::stringProtoFuncPadEnd): Deleted.
+        (JSC::stringProtoFuncPadStart): Deleted.
+
+2016-04-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Tweak auto attach initialization on some platforms
+        https://bugs.webkit.org/show_bug.cgi?id=157150
+        <rdar://problem/21222045>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/EventLoop.cpp:
+        (Inspector::EventLoop::cycle):
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
+
+2016-04-28  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Unify Math.pow() accross all tiers
+        https://bugs.webkit.org/show_bug.cgi?id=157121
+
+        Reviewed by Geoffrey Garen.
+
+        My previous optimizations of DFG compile time have slowly
+        regressed Sunspider's math-partial-sums.
+
+        What is happenning is baseline used a thunk for Math.pow()
+        that has a special case for an exponent of -0.5, while
+        DFG/FTL have other special cases for other exponents.
+        The faster we get to DFG, the less time we spend in that fast
+        case for -0.5.
+
+        While looking into this, I discovered some correctness issues. Baseline
+        optimizes y=-0.5 by turning it into 1/sqrt(). DFG/FTL optimize constant
+        y=0.5 by turning it into sqrt(). The problem is sqrt() behaves differently
+        for -0 and -Infinity. With sqrt(), negative numbers are undefined,
+        and the result is NaN. With pow(), they have a result.
+
+        Something else that has bothered me for a while is that Math.pow()
+        with the same arguments give you different results in LLINT, Baseline,
+        and DFG/FTL. This seems a bit dangerous for numerical stability.
+
+        With this patch, I unify the behaviors for all tiers while keeping
+        the "special cases".
+
+        We have pow() that is super slow, but most callers don't need the
+        full power. We have:
+        -pow() with an exponent between 0 and 1000 is a fast path implemented
+         by multiplication only.
+        -pow(x, 0.5) is sqrt with special checks for negative values.
+        -pow(x, -0.5) is sqrt with special checks for negative values.
+
+        The C++ implementation handles all those optimizations too. This ensure
+        you get the same results from LLINT to FTL.
+
+        The thunk is eliminated, it was producing incorrect results and only
+        optimized Sunspider's partial-sums.
+
+        DFG gets the optimized integer, 0.5 and -0.5 cases since those are important
+        for somewhat-hot code. DFG falls back to the C++ code for any non-obvious case.
+
+        FTL gets the full C++ implementation inlined in B3. B3 knows how to eliminate
+        all the dead cases so you get the best if your code is hot enough to reach FTL.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Deleted.
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToArithSqrt): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::compileArithPowIntegerFastPath):
+        (JSC::DFG::SpeculativeJIT::compileArithPow):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithPow):
+        * jit/ThunkGenerators.cpp:
+        (JSC::powThunkGenerator): Deleted.
+        * jit/ThunkGenerators.h:
+        * runtime/MathCommon.cpp:
+        (JSC::operationMathPow):
+        * runtime/MathCommon.h:
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic): Deleted.
+        * tests/stress/math-pow-stable-results.js: Added.
+        Getting consistent results when tiering up is new.
+        This test verify that results always remains the same as LLINT.
+
+        * tests/stress/math-pow-with-constants.js:
+        (testPowUsedAsSqrt):
+        (powUsedAsOneOverSqrt):
+        (testPowUsedAsOneOverSqrt):
+        (powUsedAsSquare):
+        (testPowUsedAsSquare):
+
+2016-04-28  Mark Lam  <mark.lam@apple.com>
+
+        DebuggerScope::className() should not assert scope->isValid().
+        https://bugs.webkit.org/show_bug.cgi?id=157143
+
+        Reviewed by Keith Miller.
+
+        DebuggerScope::className() should not assert scope->isValid() because the
+        TypeProfiler logs objects it encounters, and may indirectly call
+        JSObject::calculatedClassName() on those objects later, thereby calling
+        DebuggerScope::className() on an invalidated DebuggerScope.
+
+        The existing handling in DebuggerScope::className() for an invalidated scope
+        (that returns a null string) is sufficient.
+
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::className):
+
+2016-04-28  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] implement spec changes for String#padStart and String#padEnd
+        https://bugs.webkit.org/show_bug.cgi?id=157139
+
+        Reviewed by Keith Miller.
+
+        Previously, if the fill string was the empty string, it was treated as a
+        single U+0020 SPACE character. Now, if this occurs, the original string
+        is returned instead.
+
+        Change was discussed at TC39 in March [1], and is reflected in new
+        test262 tests for the feature.
+
+        [1] https://github.com/tc39/tc39-notes/blob/master/es7/2016-03/march-29.md#stringprototypepadstartpadend
+
+        * runtime/StringPrototype.cpp:
+        (JSC::padString):
+        * tests/es6/String.prototype_methods_String.prototype.padEnd.js:
+        (TestFillerToString):
+        (TestFillerEmptyString):
+        * tests/es6/String.prototype_methods_String.prototype.padStart.js:
+        (TestFillerToString):
+        (TestFillerEmptyString):
+
+2016-04-28  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        Crash for non-static super property call in derived class constructor
+        https://bugs.webkit.org/show_bug.cgi?id=157089
+
+        Reviewed by Darin Adler.
+       
+        Added tdz check of the 'this' before access to the 'super' for FunctionCallBracketNode, 
+        the same as it was done for FunctionCallDotNode.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallBracketNode::emitBytecode):
+
+2016-04-27  Mark Lam  <mark.lam@apple.com>
+
+        The GetterSetter structure needs a globalObject.
+        https://bugs.webkit.org/show_bug.cgi?id=157120
+
+        Reviewed by Filip Pizlo.
+
+        In r199170: <http://trac.webkit.org/r199170>, GetterSetter was promoted from
+        being a JSCell to a JSObject.  JSObject methods expect their structure to have a
+        globalObject.  For example, see JSObject::calculatedClassName().  GetterSetter
+        was previously using a singleton getterSetterStructure owned by the VM.  That
+        singleton getterSetterStructure is not associated with any globalObjects.  As a
+        result, JSObject::calculatedClassName() will run into a null globalObject when it
+        is called on a GetterSetter object.
+
+        This patch removes the VM singleton getterSetterStructure, and instead, creates
+        a getterSetterStructure for each JSGlobalObject.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * runtime/GetterSetter.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::functionStructure):
+        (JSC::JSGlobalObject::boundFunctionStructure):
+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure):
+        (JSC::JSGlobalObject::getterSetterStructure):
+        (JSC::JSGlobalObject::nativeStdFunctionStructure):
+        (JSC::JSGlobalObject::namedFunctionStructure):
+        (JSC::JSGlobalObject::functionNameOffset):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-04-27  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, Revert r199397 due to PLT regressions
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ArrayPrototype.js:
+        (concatSlowPath): Deleted.
+        (concat): Deleted.
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry): Deleted.
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC): Deleted.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute): Deleted.
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileIsJSArray): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileIsArrayObject): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile): Deleted.
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayObject): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayConstructor): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::isArray): Deleted.
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDataLogValue): Deleted.
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        (JSC::isArrayConstructor): Deleted.
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoPrivateFuncIsJSArray): Deleted.
+        (JSC::moveElements): Deleted.
+        (JSC::arrayProtoPrivateFuncConcatMemcpy): Deleted.
+        (JSC::arrayProtoPrivateFuncAppendMemcpy): Deleted.
+        * runtime/ArrayPrototype.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::fastConcatWith):
+        (JSC::JSArray::appendMemcpy): Deleted.
+        * runtime/JSArray.h:
+        (JSC::JSArray::fastConcatType):
+        (JSC::JSArray::createStructure):
+        (JSC::isJSArray):
+        * runtime/JSArrayInlines.h: Removed.
+        (JSC::JSArray::memCopyWithIndexingType): Deleted.
+        (JSC::JSArray::canFastCopy): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSType.h:
+        * runtime/ObjectConstructor.h:
+        (JSC::constructObject): Deleted.
+        * tests/es6.yaml:
+        * tests/stress/array-concat-spread-object.js: Removed.
+        (arrayEq): Deleted.
+        * tests/stress/array-concat-spread-proxy-exception-check.js: Removed.
+        (arrayEq): Deleted.
+        * tests/stress/array-concat-spread-proxy.js: Removed.
+        (arrayEq): Deleted.
+        * tests/stress/array-concat-with-slow-indexingtypes.js: Removed.
+        (arrayEq): Deleted.
+        * tests/stress/array-species-config-array-constructor.js:
+
+2016-04-27  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r200117): Crash in lowerDFGToB3::compileStringReplace()
+        https://bugs.webkit.org/show_bug.cgi?id=157099
+
+        Reviewed by Saam Barati.
+
+        Given that the DFGFixupPhase could mark the edge of child2 as StringUse,
+        we need to lower that edge appropriately.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
+
+2016-04-27  Mark Lam  <mark.lam@apple.com>
+
+        Address feedback from https://bugs.webkit.org/show_bug.cgi?id=157048#c5.
+        https://bugs.webkit.org/show_bug.cgi?id=157096
+
+        Reviewed by Geoffrey Garen.
+
+        1. Check for USE(APPLE_INTERNAL_SDK) instead of __has_include(<mach-o/dyld_priv.h>).
+        2. Rename webkitFirstSDKVersionWithInitConstructorSupport to
+           firstSDKVersionWithInitConstructorSupport.
+
+        * API/JSWrapperMap.mm:
+        (supportsInitMethodConstructors):
+
+2016-04-27  Mark Lam  <mark.lam@apple.com>
+
+        Restrict the availability of some JSC options to local debug builds only.
+        https://bugs.webkit.org/show_bug.cgi?id=157058
+
+        Reviewed by Geoffrey Garen.
+
+        1. Each option will be given an availability flag.
+        2. The functionOverrides and useDollarVM (along with its alias, enableDollarVM)
+           will have "Restricted" availability.
+        3. All other options will have “Normal” availability.
+        4. Any options with "Restricted" availability will only be accessible if function
+           allowRestrictedOptions() returns true.
+        5. For now, allowRestrictedOptions() always returns false for release builds, and
+           true for debug builds.
+
+        If an option is "Restricted" and restricted options are not allowed, the VM will
+        behave semantically as if that option does not exist at all:
+        1. Option dumps will not show the option.
+        2. Attempts to set the option will fail as if the option does not exist.
+
+        Behind the scene, the option does exist, and is set to its default value
+        (whatever that may be) once and only once on options initialization.
+
+        * runtime/Options.cpp:
+        (JSC::allowRestrictedOptions):
+        (JSC::parse):
+        (JSC::overrideOptionWithHeuristic):
+        (JSC::Options::initialize):
+        (JSC::Options::setOptionWithoutAlias):
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+        (JSC::Option::type):
+        (JSC::Option::availability):
+        (JSC::Option::isOverridden):
+
+2016-04-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Enable separated heap by default on ios
+        https://bugs.webkit.org/show_bug.cgi?id=156720
+        <rdar://problem/25841790>
+
+        Unreviewed rollout - caused memory regression.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-04-27  Benjamin Poulain  <bpoulain@apple.com>
+
+        Follow up for r200113 on 32bit
+
+        I forgot to do the 32bit counterpart of r200113.
+        The test fails on the bots.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-04-27  Alberto Garcia  <berto@igalia.com>
+
+        [GTK] Fails to build randomly when generating LLIntDesiredOffsets.h
+        https://bugs.webkit.org/show_bug.cgi?id=155427
+
+        Reviewed by Carlos Garcia Campos.
+
+        If the build directory contains the -I string, the script that
+        generates LLIntDesiredOffsets.h will confuse it with an option to
+        declare an include directory.
+
+        In order to avoid that we should only use the arguments that start
+        with -I when extracting the list of include directories, instead
+        of using the ones that simply contain that string.
+
+        * offlineasm/parser.rb:
+
+2016-04-27  Saam barati  <sbarati@apple.com>
+
+        JSC should have an option to allow global const redeclarations
+        https://bugs.webkit.org/show_bug.cgi?id=157006
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements an option that dictates whether
+        const redeclarations at the program level will throw.
+        This option defaults to true but allows users of JSC
+        to set it to false. This option is per VM. This is needed
+        for backwards compatibility with our old const implementation.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionShadowChickenFunctionsOnStack):
+        (functionSetGlobalConstRedeclarationShouldNotThrow):
+        (functionReadline):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/JSGlobalLexicalEnvironment.cpp:
+        (JSC::JSGlobalLexicalEnvironment::put):
+        (JSC::JSGlobalLexicalEnvironment::isConstVariable):
+        * runtime/JSGlobalLexicalEnvironment.h:
+        (JSC::JSGlobalLexicalEnvironment::isEmpty):
+        * runtime/VM.h:
+        (JSC::VM::setGlobalConstRedeclarationShouldThrow):
+        (JSC::VM::globalConstRedeclarationShouldThrow):
+        * tests/stress/global-const-redeclaration-setting: Added.
+        * tests/stress/global-const-redeclaration-setting-2.js: Added.
+        (assert):
+        * tests/stress/global-const-redeclaration-setting-3.js: Added.
+        (assert):
+        (catch):
+        * tests/stress/global-const-redeclaration-setting-4.js: Added.
+        (assert):
+        (catch):
+        * tests/stress/global-const-redeclaration-setting-5.js: Added.
+        (assert):
+        (catch):
+        * tests/stress/global-const-redeclaration-setting.js: Added.
+        (assert):
+        * tests/stress/global-const-redeclaration-setting/first.js: Added.
+        * tests/stress/global-const-redeclaration-setting/let.js: Added.
+        * tests/stress/global-const-redeclaration-setting/second.js: Added.
+        * tests/stress/global-const-redeclaration-setting/strict.js: Added.
+
+2016-04-26  Michael Saboff  <msaboff@apple.com>
+
+        [ES] Implement RegExp.prototype.@@replace and use it for String.prototype.replace
+        https://bugs.webkit.org/show_bug.cgi?id=156562
+
+        Reviewed by Filip Pizlo.
+
+        Added builtins for String.prototype.replace as well as RegExp.prototype[Symbol.replace].
+
+        The String.prototype.replace also has an intrinsic, StringPrototypeReplaceIntrinsic.
+        This original intrinsic was copied to make StringPrototypeReplaceRegExpIntrinsic.
+        The difference between the two intrinsics is that StringPrototypeReplaceIntrinsic has
+        the same checks found in the new builtin hasObservableSideEffectsForStringReplace.
+        We implement these primordial checks for StringPrototypeReplaceIntrinsic in two places.
+        First, we do a trial check during ByteCode parsing time to see if the current
+        RegExp.prototype properties have changed from the original.  If they have, we don't
+        inline the intrinsic.  Later, in the fixup phase, we add nodes to the IR to emit the
+        checks at runtime.
+
+        The new intrinsic StringPrototypeReplaceRegExpIntrinsic is only available via the
+        private @replaceUsingRegExp, which is called in the String.prototype.replace builtin.
+        It is only called after hasObservableSideEffectsForStringReplace has been called
+
+        Both of these intrinsics are needed, because the JS code containing String.replace() calls
+        runs initially in the LLint and then the baseline JIT.  Even after the function tiers up
+        to the DFG JIT, the inlining budget may not allow StringPrototypeReplaceIntrinsic to be inlined.
+        Having StringPrototypeReplaceRegExpIntrinsic allows for the String.prototype.replace builtin to
+        get reasonable performance before the other intrinsic is inlined or when it can't.
+
+        * builtins/RegExpPrototype.js:
+        (match):
+        (getSubstitution):
+        (replace):
+        (search):
+        (split):
+        * builtins/StringPrototype.js:
+        (repeat):
+        (hasObservableSideEffectsForStringReplace):
+        (intrinsic.StringPrototypeReplaceIntrinsic.replace):
+        (localeCompare):
+        New builtins for String.prototype.replace and RegExp.prototype[Symbol.replace].
+
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupGetAndSetLocalsInBlock):
+        (JSC::DFG::FixupPhase::tryAddStringReplacePrimordialChecks):
+        (JSC::DFG::FixupPhase::checkArray):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::getRegExpPrototypeProperty):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::getRegExpPrototypeProperty):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasHeapPrediction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::replace):
+        (JSC::stringProtoFuncReplaceUsingRegExp):
+        (JSC::stringProtoFuncReplaceUsingStringSearch):
+        (JSC::operationStringProtoFuncReplaceGeneric):
+        (JSC::stringProtoFuncReplace): Deleted.
+        Added StringReplaceRegExp intrinsic.  Added checks for RegExp profiled arguments to StringReplace
+        that mirror what is in hasObservableSideEffectsForStringReplace().  If we aren't able to add the
+        checks, we OSR exit.  Add Graph::getPrimordialRegExpPrototypeProperty() as a helper to get the
+        primordial values from RegExp.prototype.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Added @regExpPrototypeSymbolReplace and
+        @hasObservableSideEffectsForStringReplace here instead og String.prototype so that we reduce the
+        number of objects we have to traverse.
+
+        * tests/es6.yaml: Changed expectations for the various replace related tests to passing.
+
+        * tests/stress/regexp-replace-proxy.js:
+        (assert):
+        (let.getProxyNullExec.new.Proxy):
+        (let.getSetProxyNullExec.new.Proxy):
+        (get resetTracking):
+        (let.getSetProxyMatches_comma.new.Proxy):
+        (set get getSetProxyNullExec):
+        (let.getSetProxyReplace_phoneNumber.new.Proxy):
+        (set get getSetProxyMatches_comma):
+        (let.getSetProxyReplaceUnicode_digit_nonGreedy.new.Proxy):
+        (set get resetTracking):
+        * tests/stress/string-replace-proxy.js:
+        (assert):
+        (let.getSetProxyReplace.new.Proxy.replace):
+        New tests.
+
+2016-04-26  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: speculative build fix.
+
+        Not reviewed.
+
+        * API/JSWrapperMap.mm:
+
+2016-04-26  Mark Lam  <mark.lam@apple.com>
+
+        Update the compatibility version check for the ObjC API's InitConstructorSupport to use dyld_get_program_sdk_version().
+        https://bugs.webkit.org/show_bug.cgi?id=157048
+
+        Reviewed by Geoffrey Garen.
+
+        * API/JSWrapperMap.mm:
+        (supportsInitMethodConstructors):
+        (getJSExportProtocol):
+
+2016-04-26  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] GetByVal on Undecided use its children before its OSR Exit
+        https://bugs.webkit.org/show_bug.cgi?id=157046
+
+        Reviewed by Mark Lam.
+
+        Very silly bug: GetByVal on Undecided uses its children before
+        the speculationCheck(). If we fail the speculation, we have already
+        lost how to recover the values.
+
+        The existing tests did not catch this because we tier up to B3
+        before such Exits happen. B3 has explicit liveness and did not suffer
+        from this bug.
+        The new test has a smaller warmup to exercise the OSR Exit in DFG
+        instead of FTL.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * tests/stress/get-by-val-on-undecided-out-of-bounds.js: Added.
+        (string_appeared_here.opaqueGetByValKnownArray):
+
+2016-04-26  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        calling super() a second time in a constructor should throw
+        https://bugs.webkit.org/show_bug.cgi?id=151113
+
+        Reviewed by Saam Barati.
+
+        Currently, our implementation checks if 'super()' was called in a constructor more
+        than once and raises a RuntimeError before the second call. According to the spec
+        we need to raise an error just after the second super() is finished and before
+        the new 'this' is assigned https://esdiscuss.org/topic/duplicate-super-call-behaviour.
+        To implement this behavior this patch adds a new op code, op_is_empty, that is used
+        to check if 'this' is empty.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitIsEmpty):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallValueNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsEmpty):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_empty):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_empty):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * tests/stress/class-syntax-double-constructor.js: Added.
+
+2016-04-26  Mark Lam  <mark.lam@apple.com>
+
+        Changed jsc options title to be more descriptive.
+        https://bugs.webkit.org/show_bug.cgi?id=157036
+
+        Reviewed by Joseph Pecoraro.
+
+        Let the title for --dumpOptions be "Modified JSC runtime options:" since it only
+        dumps overridden options.  The title for --options will remain "All JSC runtime
+        options:" since it dumps all all options with verbose detail.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+
+2016-04-26  Oliver Hunt  <oliver@apple.com>
+
+        Enable separated heap by default on ios
+        https://bugs.webkit.org/show_bug.cgi?id=156720
+
+        Unreviewed roll-in of this change. There is only one
+        additional allocation involved in this logic, and that
+        is a duplicate mapping.
+
+        Either our tools are not report real memory usage
+        or this revision is not responsible for the regression.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-04-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG backends shouldn't emit type checks at KnownBlah edges
+        https://bugs.webkit.org/show_bug.cgi?id=157025
+
+        Reviewed by Michael Saboff.
+        
+        This fixes a crash I found when browsing Bing maps with forceEagerCompilation. I include a
+        100% repro test case.
+        
+        The issue is that our code still doesn't fully appreciate the devious implications of
+        KnownBlah use kinds. Consider KnownCell for example. It means: "trust me, I know that this
+        value will be a cell". You aren't required to provide a proof when you use KnownCell. Often,
+        we use it as a result of a path-sensitive proof. The abstract interpreter is not
+        path-sensitive, so AI will be absolutely sure that the KnownCell use might see a non-cell.
+        This can lead to debug assertions (which this change removes) and it can lead to the backends
+        emitting a type check. That type check can be pure evil if the node that has this edge does
+        not have an exit origin. Such a node would have passed validation because the validater would
+        have thought that the node cannot exit (after all, according to the IR semantics, there is no
+        speculation at KnownCell).
+
+        This comprehensively fixes the issue by recognizing that Foo(KnownCell:@x) means: I have
+        already proved that by the time you start executing Foo, @x will already be a cell. I cannot
+        tell you how I proved this but you can rely on it anyway. AI now takes advantage of this
+        meaning and will always do filtering of KnownBlah edges regardless of whether the backend
+        actually emits any type checks for those edges. Since the filtering runs before the backend,
+        the backend will not emit any checks because it will know that the edge was already checked
+        (by whatever mechanism we used when we made the edge KnownBlah).
+        
+        Note that it's good that we found this bug now. The DFG currently does very few
+        sparse-conditional or path-sensitive optimizations, but it will probably do more in the
+        future. The bug happens because GetByOffset and friends can achieve path-sensitive proofs via
+        watchpoints on the inferred type. Normally, AI can follow along with this proof. But in the
+        example program, and on Bing maps, we would GCSE one GetByOffset with another that had a
+        weaker proven type. That turned out to be completely sound - between the two GetByOffset's
+        there was a Branch to null check it. The inferred type of the second GetByOffset ended up
+        knowing that it cannot be null because null only occurred in some structures but not others.
+        If we added more sparse-conditional stuff to Branch, then AI would know how to follow along
+        with the proof but it would also create more situations where we'd have a path-sensitive
+        proof. So, it's good that we're now getting this right.
+
+        * dfg/DFGAbstractInterpreter.h:
+        (JSC::DFG::AbstractInterpreter::filterEdgeByUse):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEdges):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeKnownEdgeTypes):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        * tests/stress/path-sensitive-known-cell-crash.js: Added.
+        (bar):
+        (foo):
+
+2016-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Enable separated heap by default on ios
+        https://bugs.webkit.org/show_bug.cgi?id=156720
+
+        Unreviewed rollout - caused memory regression.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-04-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Improve jsc --help and making sampling options
+        https://bugs.webkit.org/show_bug.cgi?id=157015
+
+        Reviewed by Saam Barati.
+
+        Simplify sampling options to be easier to remember:
+
+          * --reportSamplingProfilerData => --sample
+          * --samplingProfilerTimingInterval => --sampleInterval
+
+        Update the --help to mention --sample, and restore the behavior of
+        --options outputing all possible options so you can discover which
+        options are available.        
+
+        * jsc.cpp:
+        (printUsageStatement):
+        (CommandLine::parseArguments):
+        Improve help and modify option dumping.
+
+        * runtime/Options.h:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::SamplingProfiler):
+        Rename the sampling interval option.
+
+2016-04-26  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r200083.
+        https://bugs.webkit.org/show_bug.cgi?id=157033
+
+         It brokes the debug build (Requested by gskachkov on
+        #webkit).
+
+        Reverted changeset:
+
+        "calling super() a second time in a constructor should throw"
+        https://bugs.webkit.org/show_bug.cgi?id=151113
+        http://trac.webkit.org/changeset/200083
+
+2016-04-26  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        calling super() a second time in a constructor should throw
+        https://bugs.webkit.org/show_bug.cgi?id=151113
+
+        Reviewed by Saam Barati.
+
+        Currently, our implementation checks if 'super()' was called in a constructor more 
+        than once and raises a RuntimeError before the second call. According to the spec 
+        we need to raise an error just after the second super() is finished and before 
+        the new 'this' is assigned https://esdiscuss.org/topic/duplicate-super-call-behaviour. 
+        To implement this behavior this patch adds a new op code, op_is_empty, that is used 
+        to check if 'this' is empty.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitIsEmpty):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallValueNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsEmpty):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_empty):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_empty):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * tests/stress/class-syntax-double-constructor.js: Added.
+
+2016-04-25  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove the build flag for template elements
+        https://bugs.webkit.org/show_bug.cgi?id=157022
+
+        Reviewed by Daniel Bates.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-04-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Constant folding of UInt32ToNumber is incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=157011
+        rdar://problem/25769641
+
+        Reviewed by Geoffrey Garen.
+
+        UInt32ToNumber should return the unsigned 32bit value of
+        its child. The abstract interpreter fails to do that when handling
+        Int52.
+
+        None of the tests caught that because the bytecode generator already
+        fold the operation if given a constant. If the constant is not visible
+        from the bytecode generator (for example because it comes from an inlined call),
+        then the abstract interpreter folding was producing invalid results.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * tests/stress/uint32-to-number-constant-folding.js: Added.
+        (uint32ToNumberMinusOne):
+        (uint32ToNumberMinusOnePlusInteger):
+        (inlineMinusOne):
+        (uint32ToNumberOnHiddenMinusOne):
+        (uint32ToNumberOnHiddenMinusOnePlusInteger):
+        (inlineLargeNegativeNumber1):
+        (inlineLargeNegativeNumber2):
+        (inlineLargeNegativeNumber3):
+        (uint32ToNumberOnHiddenLargeNegativeNumber1):
+        (uint32ToNumberOnHiddenLargeNegativeNumber2):
+        (uint32ToNumberOnHiddenLargeNegativeNumber3):
+
+2016-04-25  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        Heap corruption is detected when destructing JSGlobalObject
+        https://bugs.webkit.org/show_bug.cgi?id=156831
+
+        Reviewed by Mark Lam.
+
+        WebKit uses CRT static library on Windows.  Each copy of the CRT
+        library has its own heap manager, allocating memory in one CRT
+        library and passing the pointer across a DLL boundary to be freed
+        by a different copy of the CRT library is a potential cause for
+        heap corruption.
+
+          Potential Errors Passing CRT Objects Across DLL Boundaries
+          <https://msdn.microsoft.com/en-us/library/ms235460(v=vs.140).aspx>
+
+        JSGlobalObject::createRareDataIfNeeded is inlined but
+        JSGlobalObject::~JSGlobalObject is not.  Then, the heap of
+        allocating JSGlobalObjectRareData is WebKit.dll, but deallocating
+        JavaScriptCore.dll.  Adding WTF_MAKE_FAST_ALLOCATED to
+        JSGlobalObjectRareData ensures heap consistency of it.  WTF::Lock
+        also needs WTF_MAKE_FAST_ALLOCATED because it is allocated from
+        the inlined constructor of JSGlobalObjectRareData.
+
+        Test: fast/dom/insertedIntoDocument-iframe.html
+
+        * runtime/JSGlobalObject.h:
+        Add WTF_MAKE_FAST_ALLOCATED to JSGlobalObjectRareData.
+
+2016-04-25  Michael Saboff  <msaboff@apple.com>
+
+        Crash using @tryGetById in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=156992
+
+        Reviewed by Filip Pizlo.
+
+        We need to spill live registers when compiling TryGetById in DFG.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileTryGetById):
+        * tests/stress/regress-156992.js: New test.
+        (tryMultipleGetByIds):
+        (test):
+
+2016-04-25  Saam barati  <sbarati@apple.com>
+
+        We don't have to parse a function's parameters every time if the function is in the source provider cache
+        https://bugs.webkit.org/show_bug.cgi?id=156943
+
+        Reviewed by Filip Pizlo.
+
+        This patch makes a few changes to make parsing inner functions
+        faster.
+
+        First, we were always parsing an inner function's parameter
+        list using the templatized TreeBuiler. This means if our parent scope
+        was building an AST, we ended up building AST nodes for the inner
+        function's parameter list even though these nodes would go unused.
+        This patch fixes that to *always* build an inner function's parameter
+        list using the SyntaxChecker. (Note that this is consistent now with
+        always building an inner function's body with a SyntaxChecker.)
+
+        Second, we were always parsing an inner function's parameter list
+        even if we had that function saved in the source provider cache.
+        I've fixed that bug and made it so that we skip over the parsing 
+        of a function's parameter list when it's in the source provider
+        cache. We could probably enhance this in the future to skip
+        over the entirety of a function starting at the "function"
+        keyword or any other start of the function (depending on
+        the function type: arrow function, method, etc).
+
+        This patch also renames a few fields. First, I fixed a typo
+        from "tocken" => "token" for a few field names. Secondly,
+        I renamed a field that was called 'bodyStartColumn' to 
+        'parametersStartColumn' because the field really held the
+        parameter list's start column.
+
+        I'm benchmarking this as a 1.5-2% octane/jquery speedup
+        on a 15" MBP.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createMethodDefinition):
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::currentPosition):
+        (JSC::Lexer::positionBeforeLastNewline):
+        (JSC::Lexer::lastTokenLocation):
+        (JSC::Lexer::setLastLineNumber):
+        (JSC::Lexer::lastLineNumber):
+        (JSC::Lexer::prevTerminator):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Scope::usedVariablesContains):
+        (JSC::Scope::forEachUsedVariable):
+        (JSC::Scope::useVariable):
+        (JSC::Scope::copyCapturedVariablesToVector):
+        (JSC::Scope::fillParametersForSourceProviderCache):
+        (JSC::Scope::restoreFromSourceProviderCache):
+        * parser/ParserFunctionInfo.h:
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::endFunctionToken):
+        (JSC::SourceProviderCacheItem::usedVariables):
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+
+2016-04-25  Mark Lam  <mark.lam@apple.com>
+
+        Renaming SpecInt32, SpecInt52, MachineInt to SpecInt32Only, SpecInt52Only, AnyInt.
+        https://bugs.webkit.org/show_bug.cgi?id=156941
+
+        Reviewed by Filip Pizlo.
+
+        While looking at https://bugs.webkit.org/show_bug.cgi?id=153431, it was decided
+        that SpecInt32Only, SpecInt52Only, and AnyInt would be better names for
+        SpecInt32, SpecInt52, and MachineInt.  Let's do a bulk rename.
+
+        This is only a renaming patch, and deletion of a piece of unused code.  There are
+        no semantic changes.
+
+        * bindings/ScriptValue.cpp:
+        (Inspector::jsToInspectorValue):
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromValue):
+        (JSC::leastUpperBoundOfStrictlyEquivalentSpeculations):
+        (JSC::typeOfDoubleNegation):
+        (JSC::typeOfDoubleRounding):
+        * bytecode/SpeculatedType.h:
+        (JSC::isInt32Speculation):
+        (JSC::isInt32OrBooleanSpeculation):
+        (JSC::isInt32SpeculationForArithmetic):
+        (JSC::isInt32OrBooleanSpeculationForArithmetic):
+        (JSC::isInt32OrBooleanSpeculationExpectingDefined):
+        (JSC::isInt52Speculation):
+        (JSC::isAnyIntSpeculation):
+        (JSC::isAnyIntAsDoubleSpeculation):
+        (JSC::isDoubleRealSpeculation):
+        (JSC::isMachineIntSpeculation): Deleted.
+        (JSC::isInt52AsDoubleSpeculation): Deleted.
+        (JSC::isIntegerSpeculation): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::set):
+        (JSC::DFG::AbstractValue::fixTypeForRepresentation):
+        (JSC::DFG::AbstractValue::checkConsistency):
+        (JSC::DFG::AbstractValue::resultType):
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::validateType):
+        * dfg/DFGArgumentsUtilities.cpp:
+        (JSC::DFG::emitCodeToGetArgumentsArrayLength):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToThis):
+        (JSC::DFG::FixupPhase::observeUseKindOnNode):
+        (JSC::DFG::FixupPhase::fixIntConvertingEdge):
+        (JSC::DFG::FixupPhase::fixIntOrBooleanEdge):
+        (JSC::DFG::FixupPhase::fixDoubleOrBooleanEdge):
+        (JSC::DFG::FixupPhase::truncateConstantToInt32):
+        (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
+        (JSC::DFG::FixupPhase::prependGetArrayLength):
+        (JSC::DFG::FixupPhase::fixupChecksInBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateInt32):
+        (JSC::DFG::Graph::addShouldSpeculateAnyInt):
+        (JSC::DFG::Graph::binaryArithShouldSpeculateInt32):
+        (JSC::DFG::Graph::binaryArithShouldSpeculateAnyInt):
+        (JSC::DFG::Graph::unaryArithShouldSpeculateInt32):
+        (JSC::DFG::Graph::unaryArithShouldSpeculateAnyInt):
+        (JSC::DFG::Graph::addShouldSpeculateMachineInt): Deleted.
+        (JSC::DFG::Graph::binaryArithShouldSpeculateMachineInt): Deleted.
+        (JSC::DFG::Graph::unaryArithShouldSpeculateMachineInt): Deleted.
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToIdentityOn):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::asNumber):
+        (JSC::DFG::Node::isAnyIntConstant):
+        (JSC::DFG::Node::asAnyInt):
+        (JSC::DFG::Node::isBooleanConstant):
+        (JSC::DFG::Node::shouldSpeculateInt32OrBooleanExpectingDefined):
+        (JSC::DFG::Node::shouldSpeculateAnyInt):
+        (JSC::DFG::Node::shouldSpeculateDouble):
+        (JSC::DFG::Node::shouldSpeculateNumber):
+        (JSC::DFG::Node::isMachineIntConstant): Deleted.
+        (JSC::DFG::Node::asMachineInt): Deleted.
+        (JSC::DFG::Node::shouldSpeculateMachineInt): Deleted.
+        * dfg/DFGOSREntry.cpp:
+        (JSC::DFG::OSREntryData::dumpInContext):
+        (JSC::DFG::prepareOSREntry):
+        * dfg/DFGOSREntry.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSSALoweringPhase.cpp:
+        (JSC::DFG::SSALoweringPhase::handleNode):
+        (JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentFill):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileArithAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithNegate):
+        (JSC::DFG::SpeculativeJIT::speculateInt32):
+        (JSC::DFG::SpeculativeJIT::speculateNumber):
+        (JSC::DFG::SpeculativeJIT::speculateMisc):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::isKnownInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
+        (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
+        (JSC::DFG::SpeculativeJIT::isKnownNotCell):
+        (JSC::DFG::SpeculativeJIT::isKnownNotOther):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::blessBoolean):
+        (JSC::DFG::SpeculativeJIT::convertAnyInt):
+        (JSC::DFG::SpeculativeJIT::speculateAnyInt):
+        (JSC::DFG::SpeculativeJIT::speculateDoubleRepAnyInt):
+        (JSC::DFG::SpeculativeJIT::convertMachineInt): Deleted.
+        (JSC::DFG::SpeculativeJIT::speculateMachineInt): Deleted.
+        (JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt): Deleted.
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isNumerical):
+        (JSC::DFG::isDouble):
+        * dfg/DFGValidate.cpp:
+        * dfg/DFGVariableAccessData.cpp:
+        (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
+        (JSC::DFG::VariableAccessData::couldRepresentInt52Impl):
+        (JSC::DFG::VariableAccessData::flushFormat):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileInt52Constant):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInt52Rep):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
+        (JSC::FTL::DFG::LowerDFGToB3::lowInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::strictInt52ToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::isInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::isNotInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
+        (JSC::FTL::DFG::LowerDFGToB3::doubleToStrictInt52):
+        (JSC::FTL::DFG::LowerDFGToB3::speculate):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateAnyInt):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepReal):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepAnyInt):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateMachineInt): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepMachineInt): Deleted.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_profile_type):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_profile_type):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::isInt52):
+        (JSC::JSValue::isAnyInt):
+        (JSC::JSValue::asAnyInt):
+        (JSC::JSValue::isMachineInt): Deleted.
+        (JSC::JSValue::asMachineInt): Deleted.
+        * runtime/RuntimeType.cpp:
+        (JSC::runtimeTypeForValue):
+        (JSC::runtimeTypeAsString):
+        * runtime/RuntimeType.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::dumpTypes):
+        (JSC::TypeSet::displayName):
+        (JSC::TypeSet::inspectorTypeSet):
+        (JSC::TypeSet::toJSONString):
+
+2016-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Optimize JSON.parse string fast path
+        https://bugs.webkit.org/show_bug.cgi?id=156953
+
+        Reviewed by Mark Lam.
+
+        This patch further optimizes the string parsing fast path.
+        Previously, we generated the WTF::String to hold the ownership of the token's string.
+        And always copied the token in LiteralParser side.
+        Instead, we hold the ownership of the token String by the StringBuilder in LiteralParser::Lexer,
+        and remove the processing in the string parsing fast path.
+        This patch gives us stable 1 - 2.5% improvement in Kraken json-parse-financial.
+
+                                       Baseline                  Modified
+
+        json-parse-financial        41.383+-0.248      ^      40.894+-0.189         ^ definitely 1.0120x faster
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser<CharType>::tryJSONPParse):
+        (JSC::LiteralParser<CharType>::Lexer::lex):
+        (JSC::LiteralParser<CharType>::Lexer::lexStringSlow):
+        (JSC::LiteralParser<CharType>::parse):
+        (JSC::LiteralParser<CharType>::Lexer::lexString): Deleted.
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::tryLiteralParse):
+        (JSC::LiteralParser::Lexer::currentToken):
+        (JSC::LiteralParser::Lexer::LiteralParserTokenPtr::LiteralParserTokenPtr):
+        (JSC::LiteralParser::Lexer::LiteralParserTokenPtr::operator->):
+
+2016-04-24  Filip Pizlo <fpizlo@apple.com> and Andy VanWagoner <thetalecrafter@gmail.com>
+
+        [INTL] Implement String.prototype.localeCompare in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147607
+
+        Reviewed by Darin Adler.
+        
+        Part of this change is just rolling 194394 back in.
+        
+        The other part is making that not a regression on CDjs. Other than the fact that it uses
+        bound functions, the problem with this new localeCompare implementation is that it uses
+        the arguments object. It uses it in a way that *seems* like ArgumentsEliminationPhase
+        ought to handle, but to my surprise it didn't:
+        
+        - If we have a ForceExit GetByVal on the arguments object, we would previously assume that
+          it escaped. That's false since we just exit at ForceExit. On the other hand we probably
+          should be pruning unreachable paths before we get here, but that's a separate issue. I
+          don't want to play with phase order right now.
+        
+        - If we have a OutOfBounds GetByVal on the arguments object, then the best that would
+          previously happen is that we'd compile it into an in-bounds arguments access. That's quite
+          bad, as Andy's localeCompare illustrates: it uses out-of-bounds access on the arguments
+          object to detect if an argument was passed. This change introduces an OutOfBounds version
+          of GetMyArgumentByVal for this purpose.
+        
+        This change required registering sane chain watchpoints. In the process, I noticed that the
+        old way of doing it had a race condition: we might register watchpoints for the structure
+        that had become insane. This change introduces a double-checking idiom that I believe works
+        because once the structure becomes insane it can't go back to sane and watchpoints
+        registration already involves executing the hardest possible fences.
+
+        * builtins/StringPrototype.js:
+        (repeat):
+        (localeCompare):
+        (search):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::ArrayMode::refine):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPreciseLocalClobberize.h:
+        (JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValidate.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
+        * ftl/FTLTypedPointer.h:
+        (JSC::FTL::TypedPointer::TypedPointer):
+        (JSC::FTL::TypedPointer::operator bool):
+        (JSC::FTL::TypedPointer::heap):
+        (JSC::FTL::TypedPointer::operator!): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2016-04-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, unbreak cloop.
+
+        * runtime/VM.cpp:
+        (JSC::VM::getHostFunction):
+
+2016-04-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Speed up bound functions a bit
+        https://bugs.webkit.org/show_bug.cgi?id=156889
+
+        Reviewed by Saam Barati.
+        
+        Bound functions are hard to optimize because JSC doesn't have a good notion of non-JS code
+        that does JS-ey things like make JS calls. What I mean by "non-JS code" is code that did not
+        originate from JS source. A bound function does a highly polymorphic call to the target
+        stored in the JSBoundFunction. Prior to this change, we represented it as native code that
+        used the generic native->JS call API. That's not cheap.
+        
+        We could model bound functions using a builtin, but it's not clear that this would be easy
+        to grok, since so much of the code would have to access special parts of the JSBoundFunction
+        type. Doing it that way might solve the performance problems but it would mean extra work to
+        arrange for the builtin to have speedy access to the call target, the bound this, and the
+        bound arguments. Also, optimizing bound functions that way would mean that bound function
+        performance would be gated on the performance of a bunch of other things in our system. For
+        example, we'd want this polymorphic call to be handled like the funnel that it is: if we're
+        compiling the bound function's outgoing call with no context then we should compile it as
+        fully polymorphic but we can let it assume basic sanity like that the callee is a real
+        function; but if we're compiling the call with any amount of calling context then we want to
+        use normal call IC's.
+        
+        Since the builtin path wouldn't lead to a simpler patch and since I think that the VM will
+        benefit in the long run from using custom handling for bound functions, I kept the native
+        code and just added Intrinsic/thunk support.
+        
+        This just adds an Intrinsic for bound function calls where the JSBoundFunction targets a
+        JSFunction instance and has no bound arguments (only bound this). This intrinsic is
+        currently only implemented as a thunk and not yet recognized by the DFG bytecode parser.
+
+        I needed to loosen some restrictions to do this. For one, I was really tired of our bad use
+        of ENABLE(JIT) conditionals, which made it so that any serious client of Intrinsics would
+        have to have #ifdefs. Really what should happen is that if the JIT is not enabled then we
+        just ignore intrinsics. Also, the code was previously assuming that having a native
+        constructor and knowing the Intrinsic for your native call were mutually exclusive. This
+        change makes it possible to have a native executable that has a custom function, custom
+        constructor, and an Intrinsic.
+        
+        This is a >4x speed-up on bound function calls with no bound arguments.
+
+        In the future, we should teach the DFG Intrinsic handling to deal with bound functions and
+        we should teach the inliner (and ByteCodeParser::handleCall() in general) how to deal with
+        the function call inside the bound function. That would be super awesome.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::timesPtr):
+        (JSC::AbstractMacroAssembler::Address::withOffset):
+        (JSC::AbstractMacroAssembler::BaseIndex::BaseIndex):
+        (JSC::MacroAssemblerType>::Address::indexedBy):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::storeCell):
+        (JSC::AssemblyHelpers::loadCell):
+        (JSC::AssemblyHelpers::storeValue):
+        (JSC::AssemblyHelpers::emitSaveCalleeSaves):
+        (JSC::AssemblyHelpers::emitSaveThenMaterializeTagRegisters):
+        (JSC::AssemblyHelpers::emitRestoreCalleeSaves):
+        (JSC::AssemblyHelpers::emitRestoreSavedTagRegisters):
+        (JSC::AssemblyHelpers::copyCalleeSavesToVMCalleeSavesBuffer):
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::ctiNativeTailCall):
+        (JSC::JITThunks::ctiNativeTailCallWithoutSavedTags):
+        (JSC::JITThunks::ctiStub):
+        (JSC::JITThunks::hostFunctionStub):
+        (JSC::JITThunks::clearHostFunctionStubs):
+        * jit/JITThunks.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::callDoubleToDoublePreservingReturn):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        (JSC::SpecializedThunkJIT::emitSaveThenMaterializeTagRegisters): Deleted.
+        (JSC::SpecializedThunkJIT::emitRestoreSavedTagRegisters): Deleted.
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualThunkFor):
+        (JSC::nativeForGenerator):
+        (JSC::nativeCallGenerator):
+        (JSC::nativeTailCallGenerator):
+        (JSC::nativeTailCallWithoutSavedTagsGenerator):
+        (JSC::nativeConstructGenerator):
+        (JSC::randomThunkGenerator):
+        (JSC::boundThisNoArgsFunctionCallGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/Executable.cpp:
+        (JSC::NativeExecutable::create):
+        (JSC::NativeExecutable::destroy):
+        (JSC::NativeExecutable::createStructure):
+        (JSC::NativeExecutable::finishCreation):
+        (JSC::NativeExecutable::NativeExecutable):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        * runtime/Executable.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototypeGetterCompare):
+        * runtime/Intrinsic.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::boundThisNoArgsFunctionCall):
+        (JSC::boundFunctionCall):
+        (JSC::boundThisNoArgsFunctionConstruct):
+        (JSC::boundFunctionConstruct):
+        (JSC::getBoundFunctionStructure):
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::customHasInstance):
+        (JSC::JSBoundFunction::JSBoundFunction):
+        * runtime/JSBoundFunction.h:
+        (JSC::JSBoundFunction::targetFunction):
+        (JSC::JSBoundFunction::boundThis):
+        (JSC::JSBoundFunction::boundArgs):
+        (JSC::JSBoundFunction::createStructure):
+        (JSC::JSBoundFunction::offsetOfTargetFunction):
+        (JSC::JSBoundFunction::offsetOfBoundThis):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::lookUpOrCreateNativeExecutable):
+        (JSC::JSFunction::create):
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+        (JSC::VM::getHostFunction):
+        * runtime/VM.h:
+        (JSC::VM::getCTIStub):
+        (JSC::VM::exceptionOffset):
+
+2016-04-22  Joonghun Park  <jh718.park@samsung.com>
+
+        [JSC] Fix build break since r199866
+        https://bugs.webkit.org/show_bug.cgi?id=156892
+
+        Reviewed by Darin Adler.
+
+        * runtime/MathCommon.cpp: Follow up to r199913. Remove 'include cmath' in cpp file.
+
+2016-04-22  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Optimize number parsing and string parsing in LiteralParser
+        https://bugs.webkit.org/show_bug.cgi?id=156896
+
+        Reviewed by Mark Lam.
+
+        This patch aim to improve JSON.parse performance. Major 2 optimizations are included.
+
+        1. Change `double result` to `int32_t result` in integer parsing case.
+        We already have the optimized path for integer parsing, when it's digits are less than 10.
+        At that case, the maximum number is 999999999, and the minimum number is -99999999.
+        The both are in range of Int32. So We can use int32_t for accumulation instead of double.
+
+        2. Add the string parsing fast / slow cases.
+        We add the fast case for string parsing, which does not include any escape sequences.
+
+        Both optimizations improve Kraken json-parse-financial, roughly 3.5 - 4.5%.
+
+        json-parse-financial        49.128+-1.589             46.979+-0.912           might be 1.0457x faster
+
+        * runtime/LiteralParser.cpp:
+        (JSC::isJSONWhiteSpace):
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser<CharType>::Lexer::lexString):
+        (JSC::LiteralParser<CharType>::Lexer::lexStringSlow):
+        (JSC::LiteralParser<CharType>::Lexer::lexNumber):
+        * runtime/LiteralParser.h:
+
+2016-04-22  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Source directives lost when using Function constructor repeatedly
+        https://bugs.webkit.org/show_bug.cgi?id=156863
+        <rdar://problem/25861064>
+
+        Reviewed by Geoffrey Garen.
+
+        Source directives (sourceURL and sourceMappingURL) are normally accessed through
+        the SourceProvider and normally set when the script is parsed. However, when a
+        CodeCache lookup skips parsing, the new SourceProvider never gets the directives
+        (sourceURL/sourceMappingURL). This patch stores the directives on the UnlinkedCodeBlock
+        and UnlinkedFunctionExecutable when entering the cache, and copies to the new providers
+        when the cache is used.
+
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::sourceURLDirective):
+        (JSC::UnlinkedCodeBlock::sourceMappingURLDirective):
+        (JSC::UnlinkedCodeBlock::setSourceURLDirective):
+        (JSC::UnlinkedCodeBlock::setSourceMappingURLDirective):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * parser/SourceProvider.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        Store directives on the unlinked code block / executable when adding
+        to the cache, so they can be used to update new providers when the
+        cache gets used.
+
+        * runtime/JSGlobalObject.cpp:
+        Add needed header after CodeCache header cleanup.
+
+2016-04-22  Mark Lam  <mark.lam@apple.com>
+
+        javascript jit bug affecting Google Maps.
+        https://bugs.webkit.org/show_bug.cgi?id=153431
+
+        Reviewed by Filip Pizlo.
+
+        The issue was due to the abstract interpreter wrongly marking the type of the
+        value read from the Uint3Array as SpecInt52, which precludes it from being an
+        Int32.  This proves to be false, and the generated code failed to handle the case
+        where the read value is actually an Int32.
+
+        The fix is to have the abstract interpreter use SpecMachineInt instead of
+        SpecInt52.
+
+        * bytecode/SpeculatedType.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+2016-04-22  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] PredictionPropagation should not be in the top 5 heaviest phases
+        https://bugs.webkit.org/show_bug.cgi?id=156891
+
+        Reviewed by Mark Lam.
+
+        In DFG, PredictionPropagation is often way too high in profiles.
+        It is a simple phase, it should not be that hot.
+
+        Most of the time is spent accessing memory. This patch attempts
+        to reduce that.
+
+        First, propagate() is split in processInvariants() and propagates().
+        The step processInvariants() sets all the types for nodes for which
+        the type does not depends on other nodes.
+
+        Adding processInvariants() lowers two hotspot inside PredictionPropagation:
+        speculationFromValue() and setPrediction().
+
+        Next, to avoid touching all the nodes at every operation, we keep
+        track of the nodes that actually need propagate().
+        The vector m_dependentNodes keeps the list of those nodes and propagate()
+        only need to process them at each phase.
+
+        This is a smaller gain because growing m_dependentNodes negates
+        some of the gains.
+
+        On 3d-cube, this moves PredictionPropagation from fifth position
+        to ninth. A lot of the remaining overhead is caused by double-voting
+        and cannot be fixed by moving stuff around.
+
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagateToFixpoint): Deleted.
+        (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
+        (JSC::DFG::PredictionPropagationPhase::propagateForward): Deleted.
+        (JSC::DFG::PredictionPropagationPhase::propagateBackward): Deleted.
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting): Deleted.
+        (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting): Deleted.
+        (JSC::DFG::PredictionPropagationPhase::propagateThroughArgumentPositions): Deleted.
+
+2016-04-22  Geoffrey Garen  <ggaren@apple.com>
+
+        super should be available in object literals
+        https://bugs.webkit.org/show_bug.cgi?id=156933
+
+        Reviewed by Saam Barati.
+
+        When we originally implemented classes, super seemed to be a class-only
+        feature. But the final spec says it's available in object literals too.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode): Having 'super' and being a class
+        property are no longer synonymous, so we track two separate variables.
+
+        (JSC::PropertyListNode::emitPutConstantProperty): Being inside the super
+        branch no longer guarantees that you're a class property, so we decide
+        our attributes and our function name dynamically.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArguments):
+        (JSC::ASTBuilder::createArgumentsList):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::createPropertyList): Pass through state to indicate
+        whether we're a class property, since we can't infer it from 'super'
+        anymore.
+
+        * parser/NodeConstructors.h:
+        (JSC::PropertyNode::PropertyNode): See ASTBuilder.h.
+
+        * parser/Nodes.h:
+        (JSC::PropertyNode::expressionName):
+        (JSC::PropertyNode::name):
+        (JSC::PropertyNode::type):
+        (JSC::PropertyNode::needsSuperBinding):
+        (JSC::PropertyNode::isClassProperty):
+        (JSC::PropertyNode::putType): See ASTBuilder.h.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        (JSC::Parser<LexerType>::parseMemberExpression): I made these error
+        messages generic because it is no longer practical to say concise things
+        about the list of places you can use super.
+
+        * parser/Parser.h:
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createArgumentsList):
+        (JSC::SyntaxChecker::createProperty):
+        (JSC::SyntaxChecker::appendExportSpecifier):
+        (JSC::SyntaxChecker::appendConstDecl):
+        (JSC::SyntaxChecker::createGetterOrSetterProperty): Updated for
+        interface change.
+
+        * tests/stress/generator-with-super.js:
+        (test):
+        * tests/stress/modules-syntax-error.js:
+        * tests/stress/super-in-lexical-scope.js:
+        (testSyntaxError):
+        (testSyntaxError.test):
+        * tests/stress/tagged-templates-syntax.js: Updated for error message
+        changes. See Parser.cpp.
+
+2016-04-22  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERT(m_stack.last().isTailDeleted) at ShadowChicken.cpp:127 inspecting the inspector
+        https://bugs.webkit.org/show_bug.cgi?id=156930
+
+        Reviewed by Joseph Pecoraro.
+        
+        The loop that prunes the stack from the top should preserve the invariant that the top frame
+        cannot be tail-deleted.
+
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::update):
+
+2016-04-22  Benjamin Poulain  <benjamin@webkit.org>
+
+        Attempt to fix the CLoop after r199866
+
+        * runtime/MathCommon.h:
+
+2016-04-22  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Integer Multiply of a number by itself does not need negative zero support
+        https://bugs.webkit.org/show_bug.cgi?id=156895
+
+        Reviewed by Saam Barati.
+
+        You cannot produce negative zero by squaring an integer.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        Minor codegen fixes:
+        -Use the right form of multiply for ARM.
+        -Use a sign-extended 32bit immediates, that's the one with fast forms
+         in the MacroAssembler.
+
+2016-04-21  Darin Adler  <darin@apple.com>
+
+        Follow-on to the build fix.
+
+        * runtime/MathCommon.h: Use the C++ std namespace version of the
+        frexp function too.
+
+2016-04-21  Joonghun Park  <jh718.park@samsung.com>
+
+        [JSC] Fix build break since r199866. Unreviewed.
+        https://bugs.webkit.org/show_bug.cgi?id=156892
+
+        * runtime/MathCommon.h: Add namespace std to isnormal invoking.
+
+2016-04-21  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add primitive String support to compare operators
+        https://bugs.webkit.org/show_bug.cgi?id=156783
+
+        Reviewed by Geoffrey Garen.
+
+        Just the basics.
+        We should eventually inline some of the simplest cases.
+
+        This is a 2% improvement on Longspider. It is unfortunately neutral
+        for Sunspider on my machine because most of the comparison are from
+        baseline.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStringCompare):
+        (JSC::DFG::SpeculativeJIT::compileStringIdentCompare):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareLess):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareLessEq):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareGreater):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareGreaterEq):
+        (JSC::FTL::DFG::LowerDFGToB3::compare):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::callWithoutSideEffects):
+        * jit/JITOperations.h:
+        * tests/stress/string-compare.js: Added.
+        (makeRope):
+        (makeString):
+        (let.operator.of.operators.eval.compareStringIdent):
+        (let.operator.of.operators.compareStringString):
+        (let.operator.of.operators.compareStringIdentString):
+        (let.operator.of.operators.compareStringStringIdent):
+        (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.eval):
+
+2016-04-21  Benjamin Poulain  <bpoulain@webkit.org>
+
+        [JSC] Commute FDiv-by-constant into FMul-by-reciprocal when it is safe
+        https://bugs.webkit.org/show_bug.cgi?id=156871
+
+        Reviewed by Filip Pizlo.
+
+        FMul is significantly faster than FDiv.
+        For example, on Haswell, FMul has a latency of 5, a throughput of 1
+        while FDiv has latency 10-24, throughput 8-18.
+
+        Fortunately for us, Sunspider and Kraken have plenty of division
+        by a simple power of 2 constant. Those are just exponent operations
+        and can be easily reversed to use FMul instead of FDiv.
+
+        LLVM does something similar in InstCombine.
+
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * jit/JITDivGenerator.cpp:
+        (JSC::JITDivGenerator::loadOperand):
+        (JSC::JITDivGenerator::generateFastPath):
+        * jit/SnippetOperand.h:
+        (JSC::SnippetOperand::asConstNumber):
+        * runtime/MathCommon.h:
+        (JSC::safeReciprocalForDivByConst):
+        * tests/stress/floating-point-div-to-mul.js: Added.
+        (opaqueDivBy2):
+        (opaqueDivBy3):
+        (opaqueDivBy4):
+        (opaqueDivBySafeMaxMinusOne):
+        (opaqueDivBySafeMax):
+        (opaqueDivBySafeMaxPlusOne):
+        (opaqueDivBySafeMin):
+        (opaqueDivBySafeMinMinusOne):
+        (i.catch):
+        (i.result.opaqueDivBySafeMin.valueOf):
+
+2016-04-21  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Improve the absThunkGenerator() for 64bit
+        https://bugs.webkit.org/show_bug.cgi?id=156888
+
+        Reviewed by Michael Saboff.
+
+        A few tests spend a lot of time in this abs() with double argument.
+
+        This patch adds custom handling for the JSValue64 representation.
+        In particular:
+        -Do not load the value twice. Unbox the GPR if it is not an Int32.
+        -Deal with IntMin inline instead of falling back to the C function call.
+        -Box the values ourself to avoid a duplicate function tail and return.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::absThunkGenerator):
+
+2016-04-21  Saam barati  <sbarati@apple.com>
+
+        LLInt CallSiteIndex off by 1
+        https://bugs.webkit.org/show_bug.cgi?id=156886
+
+        Reviewed by Benjamin Poulain.
+
+        I think was done for historical reasons but isn't needed anymore.
+
+        * llint/LLIntSlowPaths.cpp:
+
+2016-04-21  Keith Miller  <keith_miller@apple.com>
+
+        FTL should handle exceptions in operationInOptimize
+        https://bugs.webkit.org/show_bug.cgi?id=156885
+
+        Reviewed by Michael Saboff.
+
+        For some reasone we didn't handle any exceptions in "in" when we called
+        operationInOptimize in the FTL.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpAssumingJITType):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
+        * ftl/FTLPatchpointExceptionHandle.h: Add comments explaining which
+        function to use for different exception types.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionNoFTL):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::setNeverFTLOptimize):
+        (JSC::ScriptExecutable::neverFTLOptimize):
+        * tests/stress/in-ftl-exception-check.js: Added.
+        (foo):
+        (bar):
+        (catch):
+
+2016-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC virtual call thunk shouldn't do a structure->classInfo lookup
+        https://bugs.webkit.org/show_bug.cgi?id=156874
+
+        Reviewed by Keith Miller.
+        
+        This lookup was unnecessary because we can just test the inlined type field.
+
+        But also, this meant that we were exempting JSBoundFunction from the virtual call optimization.
+        That's pretty bad.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualThunkFor):
+
+2016-04-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: sourceMappingURL not loaded in generated script
+        https://bugs.webkit.org/show_bug.cgi?id=156022
+        <rdar://problem/25438595>
+
+        Reviewed by Geoffrey Garen.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::appendAPIBacktrace):
+        Synthetic CallFrames for native code will not have script identifiers.
+
+        * inspector/ScriptCallFrame.cpp:
+        (Inspector::ScriptCallFrame::ScriptCallFrame):
+        (Inspector::ScriptCallFrame::isEqual):
+        (Inspector::ScriptCallFrame::buildInspectorObject):
+        * inspector/ScriptCallFrame.h:
+        * inspector/protocol/Console.json:
+        Include the script identifier in ScriptCallFrame so we can correlate this
+        to the exactly script, even if there isn't a URL. The Script may have a
+        sourceURL, so the Web Inspector frontend may decide to show / link to it.
+
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::CreateScriptCallStackFunctor::operator()):
+        (Inspector::createScriptCallStackFromException):
+        Include SourceID when we have it.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::GetStackTraceFunctor::operator()):
+        * interpreter/Interpreter.h:
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::sourceID):
+        * interpreter/StackVisitor.h:
+        Access the SourceID when we have it.
+
+2016-04-21  Saam barati  <sbarati@apple.com>
+
+        Lets do less locking of symbol tables in the BytecodeGenerator where we don't have race conditions
+        https://bugs.webkit.org/show_bug.cgi?id=156821
+
+        Reviewed by Filip Pizlo.
+
+        The BytecodeGenerator allocates all the SymbolTables that it uses.
+        This is before any concurrent compiler thread can use that SymbolTable.
+        This means we don't actually need to lock for any operations of the
+        SymbolTable. This patch makes this change by removing all locking.
+        To do this, I've introduced a new constructor for ConcurrentJITLocker
+        which implies no locking is necessary. You instantiate such a ConcurrentJITLocker like so:
+        `ConcurrentJITLocker locker(ConcurrentJITLocker::NoLockingNecessary);`
+
+        This patch also removes all uses of Strong<SymbolTable> from the bytecode
+        generator and instead wraps bytecode generation in a DeferGC.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::instantiateLexicalVariables):
+        (JSC::BytecodeGenerator::emitPrefillStackTDZVariables):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::initializeBlockScopedFunctions):
+        (JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary):
+        (JSC::BytecodeGenerator::popLexicalScopeInternal):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::createVariable):
+        (JSC::BytecodeGenerator::emitResolveScope):
+        (JSC::BytecodeGenerator::emitPushWithScope):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::constructorKind):
+        (JSC::BytecodeGenerator::superBinding):
+        (JSC::BytecodeGenerator::generate):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        * runtime/ConcurrentJITLock.h:
+        (JSC::ConcurrentJITLockerBase::ConcurrentJITLockerBase):
+        (JSC::ConcurrentJITLockerBase::~ConcurrentJITLockerBase):
+        (JSC::ConcurrentJITLocker::ConcurrentJITLocker):
+
+2016-04-21  Saam barati  <sbarati@apple.com>
+
+        Remove some unnecessary RefPtrs in the parser
+        https://bugs.webkit.org/show_bug.cgi?id=156865
+
+        Reviewed by Filip Pizlo.
+
+        The IdentifierArena or the SourceProviderCacheItem will own these UniquedStringImpls
+        while we are using them. There is no need for us to reference count them.
+
+        This might be a 0.5% speedup on octane code-load.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        * parser/Parser.h:
+        (JSC::Scope::setIsLexicalScope):
+        (JSC::Scope::isLexicalScope):
+        (JSC::Scope::closedVariableCandidates):
+        (JSC::Scope::declaredVariables):
+        (JSC::Scope::lexicalVariables):
+        (JSC::Scope::finalizeLexicalEnvironment):
+        (JSC::Scope::computeLexicallyCapturedVariablesAndPurgeCandidates):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::getCapturedVars):
+        (JSC::Scope::setStrictMode):
+        (JSC::Scope::isValidStrictMode):
+        (JSC::Scope::shadowsArguments):
+        (JSC::Scope::copyCapturedVariablesToVector):
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::usedVariables):
+        (JSC::SourceProviderCacheItem::~SourceProviderCacheItem):
+        (JSC::SourceProviderCacheItem::create):
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        (JSC::SourceProviderCacheItem::writtenVariables): Deleted.
+
+2016-04-21  Filip Pizlo  <fpizlo@apple.com>
+
+        PolymorphicAccess adds sizeof(CallerFrameAndPC) rather than subtracting it when calculating stack height
+        https://bugs.webkit.org/show_bug.cgi?id=156872
+
+        Reviewed by Geoffrey Garen.
+        
+        The code that added sizeof(CallerFrameAndPC) emerged from a bad copy-paste in r189586. That was
+        the revision that created the PolymorphicAccess class. It moved code for generating a
+        getter/setter call from Repatch.cpp to PolymorphicAccess.cpp. You can see the code doing a
+        subtraction here:
+        
+            http://trac.webkit.org/changeset/189586/trunk/Source/JavaScriptCore/jit/Repatch.cpp
+        
+        This makes the world right again.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateImpl):
+
+2016-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Build warning: CODE_SIGN_ENTITLEMENTS specified without specifying CODE_SIGN_IDENTITY
+        https://bugs.webkit.org/show_bug.cgi?id=156862
+
+        Reviewed by Joseph Pecoraro.
+
+        * Configurations/Base.xcconfig: Specify the ad hoc signing identity by
+        default. See <http://trac.webkit.org/changeset/143544>.
+
+2016-04-21  Andy Estes  <aestes@apple.com>
+
+        REGRESSION (r199734): WebKit crashes loading numerous websites in iOS Simulator
+        https://bugs.webkit.org/show_bug.cgi?id=156842
+
+        Reviewed by Daniel Bates.
+
+        Disable separated heap on iOS Simulator.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2016-04-21  Michael Saboff  <msaboff@apple.com>
+
+        Align RegExp[@@match] with other @@ methods
+        https://bugs.webkit.org/show_bug.cgi?id=156832
+
+        Reviewed by Mark Lam.
+
+        Various changes to align the RegExp[@@match] with [@@search] and [@@split].
+
+        Made RegExp.prototype.@exec a hidden property on the global object and
+        called it @regExpBuiltinExec to match the name it has in the standard.
+        Changed all places that used the old name to use the new one.
+
+        Made the match fast path function, which used to be call @match, to be called
+        @regExpMatchFast and put it on the global object.  Changed it to also handle
+        expressions both with and without the global flag.  Refactored the builtin
+        @match accordingly.
+
+        Added the builtin function @hasObservableSideEffectsForRegExpMatch() that
+        checks to see if we can use the fast path of if we need the explicit version.
+
+        Put the main RegExp functions @match, @search and @split in alphabetical
+        order in RegExpPrototype.js.  Did the same for @match, @repeat, @search and 
+        @split in StringPrototype.js.
+        
+        * builtins/RegExpPrototype.js:
+        (regExpExec):
+        (hasObservableSideEffectsForRegExpMatch): New.
+        (match):
+        (search):
+        (hasObservableSideEffectsForRegExpSplit):
+        Reordered in the file and updated to use @regExpBuiltinExec.
+
+        * builtins/StringPrototype.js:
+        (match):
+        (repeatSlowPath):
+        (repeat):
+        (search):
+        (split):
+        Reordered functions in the file.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setGlobalThis):
+        (JSC::getById):
+        (JSC::getGetterById):
+        (JSC::JSGlobalObject::init):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncMatchFast):
+        (JSC::regExpProtoFuncMatchPrivate): Deleted.
+        * runtime/RegExpPrototype.h:
+
+2016-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        JavaScriptCore garbage collection is missing an autorelease pool
+        https://bugs.webkit.org/show_bug.cgi?id=156751
+        <rdar://problem/25787802>
+
+        Reviewed by Mark Lam.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::releaseDelayedReleasedObjects): Add an autorelease pool to
+        catch autoreleases when we call out to arbitrary ObjC code.
+
+        We use the C interface here because this is not an ObjC compilation unit.
+
+2016-04-20  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG del_by_id support forgets to set()
+        https://bugs.webkit.org/show_bug.cgi?id=156830
+
+        Reviewed by Saam Barati.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * tests/stress/dfg-del-by-id.js: Added.
+
+2016-04-20  Saam barati  <sbarati@apple.com>
+
+        Improve sampling profiler CLI JSC tool
+        https://bugs.webkit.org/show_bug.cgi?id=156824
+
+        Reviewed by Mark Lam.
+
+        This patch enhances the Sampling Profiler CLI tool from the JSC shell
+        to display the JITType of a particular CodeBlock. Because this happens
+        once we process a log of stack frames, the data for a particular frame
+        being in LLInt vs. Baseline could be wrong. For example, we may have taken 
+        a stack trace of a CodeBlock while it was executing in the LLInt, then 
+        it tiers up to the baseline, then we process the log. We will show such CodeBlocks
+        as being in the baseline JIT. We could be smarter about this in the future if
+        it turns out to truly be a problem.
+
+        This patch also adds a 'samplingProfilerTimingInterval' JSC option to allow
+        CLI users to control the sleep time between stack traces.
+
+        * jsc.cpp:
+        (jscmain):
+        * runtime/Options.h:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::SamplingProfiler):
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        (JSC::SamplingProfiler::reportTopBytecodes):
+        * runtime/SamplingProfiler.h:
+        (JSC::SamplingProfiler::StackFrame::hasExpressionInfo):
+
+2016-04-20  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] DFG should not generate two jumps when the target of DoubleBranch is the next block  
+        https://bugs.webkit.org/show_bug.cgi?id=156815
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
+
+2016-04-20  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add register reuse for ArithAdd of an Int32 and constant in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=155164
+
+        Reviewed by Mark Lam.
+
+        Every "inc" in loop was looking like this:
+            move rX, rY
+            inc rY
+            jo 0x230f4a200580
+
+        This patch add register Reuse to that case to remove
+        the extra "move".
+
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::SpeculationRecovery::SpeculationRecovery):
+        (JSC::DFG::SpeculationRecovery::immediate):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithAdd):
+        * tests/stress/arith-add-with-constant-overflow.js: Added.
+        (opaqueAdd):
+
+2016-04-20  Saam barati  <sbarati@apple.com>
+
+        We don't need a manual stack for an RAII object when the machine's stack will do just fine
+        https://bugs.webkit.org/show_bug.cgi?id=156807
+
+        Reviewed by Mark Lam.
+
+        We kept around a vector for an RAII object to maintain
+        the recursive nature of having these RAII objects on
+        the stack as the parser recursed. Instead, the RAII object
+        can just have a field with the value it wants to restore
+        and use the machine's stack.
+
+        This is a 1% octane code-load progression.
+
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::BinaryExprContext::BinaryExprContext):
+        (JSC::SyntaxChecker::BinaryExprContext::~BinaryExprContext):
+        (JSC::SyntaxChecker::UnaryExprContext::UnaryExprContext):
+        (JSC::SyntaxChecker::UnaryExprContext::~UnaryExprContext):
+        (JSC::SyntaxChecker::operatorStackPop):
+
+2016-04-20  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r190289): Spin trying to view/sign in to hbogo.com
+        https://bugs.webkit.org/show_bug.cgi?id=156765
+
+        Reviewed by Saam Barati.
+
+        In the op_get_by_val case, we were holding the lock on a profiled CodeBlock
+        when we call into handleGetById(). Changed to drop the lock before calling
+        handleGetById().
+
+        The bug here was that the call to handleGetById() may end up calling in to
+        getPredictionWithoutOSRExit() for a tail call opcode. As part of that
+        processing, we walk back up the stack to find the effective caller and when
+        found, we lock the corresponding CodeBlock to get the predicition.
+        That CodeBLock may be the same one locked above. There is no need anyway
+        to hold the CodeBlock lock when calling handleGetById().
+
+        Added a new stress test.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * tests/stress/regress-156765.js: Added.
+        (realValue):
+        (object.get hello):
+        (ok):
+
+2016-04-20  Mark Lam  <mark.lam@apple.com>
+
+        Unindent an unnecessary block in stringProtoFuncSplitFast().
+        https://bugs.webkit.org/show_bug.cgi?id=156802
+
+        Reviewed by Filip Pizlo.
+
+        In webkit.org/b/156013, I refactored stringProtoFuncSplit into
+        stringProtoFuncSplitFast.  In that patch, I left an unnecessary block of code in
+        its original block (with FIXMEs) to keep the diff for that patch minimal.  Now
+        that the patch for webkit.org/b/156013 has landed, I will unindent that block and
+        remove the FIXMEs.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplitFast):
+
+2016-04-20  Brady Eidson  <beidson@apple.com>
+
+        Modern IDB (Workers): Enable INDEXED_DATABASE_IN_WORKERS compile time flag, but disabled in RuntimeEnabledFeatures.
+        https://bugs.webkit.org/show_bug.cgi?id=156782
+
+        Reviewed by Alex Christensen.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-04-20  Saam barati  <sbarati@apple.com>
+
+        Remove unused m_writtenVariables from the parser and related bits
+        https://bugs.webkit.org/show_bug.cgi?id=156784
+
+        Reviewed by Yusuke Suzuki.
+
+        This isn't a octane/codeload speedup even though we're doing less work in
+        collectFreeVariables. But it's good to get rid of things that are not used.
+
+        * parser/Nodes.h:
+        (JSC::ScopeNode::usesEval):
+        (JSC::ScopeNode::usesArguments):
+        (JSC::ScopeNode::usesArrowFunction):
+        (JSC::ScopeNode::isStrictMode):
+        (JSC::ScopeNode::setUsesArguments):
+        (JSC::ScopeNode::usesThis):
+        (JSC::ScopeNode::modifiesParameter): Deleted.
+        (JSC::ScopeNode::modifiesArguments): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::hasDeclaredParameter):
+        (JSC::Scope::preventAllVariableDeclarations):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::mergeInnerArrowFunctionFeatures):
+        (JSC::Scope::getSloppyModeHoistedFunctions):
+        (JSC::Scope::getCapturedVars):
+        (JSC::Scope::setStrictMode):
+        (JSC::Scope::strictMode):
+        (JSC::Scope::fillParametersForSourceProviderCache):
+        (JSC::Scope::restoreFromSourceProviderCache):
+        (JSC::Parser::hasDeclaredParameter):
+        (JSC::Parser::exportName):
+        (JSC::Scope::declareWrite): Deleted.
+        (JSC::Parser::declareWrite): Deleted.
+        * parser/ParserModes.h:
+
+2016-04-19  Saam barati  <sbarati@apple.com>
+
+        Unreviewed, fix cloop build after r199754.
+
+        * jsc.cpp:
+        (jscmain):
+
+2016-04-19  Michael Saboff  <msaboff@apple.com>
+
+        iTunes crashing JavaScriptCore.dll
+        https://bugs.webkit.org/show_bug.cgi?id=156647
+
+        Reviewed by Filip Pizlo.
+
+        Given that there there are only 128 FLS indices compared to over a 1000 for TLS,
+        I eliminated the thread specific m_threadSpecificForThread and instead we look
+        for the current thread in m_registeredThreads list when we need it.
+        In most cases there will only be one thread.
+
+        Added THREAD_SPECIFIC_CALL to signature of ThreadSpecific remove callbacks
+        to set the calling convention correctly for Windows 32 bit.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::ActiveMachineThreadsManager::remove):
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::machineThreadForCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        * heap/MachineStackMarker.h:
+
+2016-04-19  Benjamin Poulain  <bpoulain@webkit.org>
+
+        [JSC] Small cleanup of RegisterAtOffsetList
+        https://bugs.webkit.org/show_bug.cgi?id=156779
+
+        Reviewed by Mark Lam.
+
+        I was wondering why RegisterAtOffsetList always cache-miss.
+        It looks like it is doing more than it needs to.
+
+        We do not need to sort the values. The total order of
+        RegisterAtOffset is:
+        1) Order of Reg.
+        2) Order of offsets.
+        We already generate the list in order.
+
+        Also allocate the right array size ahead of filling the array.
+
+        * jit/RegisterAtOffsetList.cpp:
+        (JSC::RegisterAtOffsetList::RegisterAtOffsetList):
+        (JSC::RegisterAtOffsetList::sort): Deleted.
+        * jit/RegisterAtOffsetList.h:
+        (JSC::RegisterAtOffsetList::append): Deleted.
+
+2016-04-19  Saam barati  <sbarati@apple.com>
+
+        Add a couple UNLIKELY macros in parseMemberExpression
+        https://bugs.webkit.org/show_bug.cgi?id=156775
+
+        Reviewed by Filip Pizlo.
+
+        These UNLIKELY macros have to do with the base of the
+        member expression being 'super'. I think it's safe to
+        argue that this is truly UNLIKELY. I am seeing speedups
+        sometimes on Octane codeload. Usually around 0.5%. Sometimes 1%.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseMemberExpression):
+
+2016-04-19  Saam barati  <sbarati@apple.com>
+
+        allow jsc shell to dump sampling profiler data
+        https://bugs.webkit.org/show_bug.cgi?id=156725
+
+        Reviewed by Benjamin Poulain.
+
+        This patch adds a '--reportSamplingProfilerData' option to the
+        JSC shell which will enable the sampling profiler and dump
+        its data at the end of execution. The dump will include the
+        40 hottest functions and the 80 hottest bytecode locations.
+        If you're using this option to debug, it's easy to just hack
+        on the code to make it dump more or less information.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+        (jscmain):
+        * runtime/Options.h:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        (JSC::SamplingProfiler::stackTracesAsJSON):
+        (JSC::SamplingProfiler::reportTopFunctions):
+        (JSC::SamplingProfiler::reportTopBytecodes):
+        * runtime/SamplingProfiler.h:
+        (JSC::SamplingProfiler::StackFrame::hasExpressionInfo):
+        (JSC::SamplingProfiler::StackFrame::hasBytecodeIndex):
+        (JSC::SamplingProfiler::StackFrame::hasCodeBlockHash):
+        (JSC::SamplingProfiler::setStopWatch):
+
+2016-04-19  Mark Lam  <mark.lam@apple.com>
+
+        Re-landing: ES6: Implement RegExp.prototype[@@search].
+        https://bugs.webkit.org/show_bug.cgi?id=156331
+
+        Reviewed by Keith Miller.
+
+        What changed?
+        1. Implemented search builtin in RegExpPrototype.js.
+           The native path is now used as a fast path.
+        2. Added DFG support for an IsRegExpObjectIntrinsic (modelled after the
+           IsJSArrayIntrinsic).
+        3. Renamed @isRegExp to @isRegExpObject to match the new IsRegExpObjectIntrinsic.
+        4. Change the esSpecIsRegExpObject() implementation to check if the object's
+           JSType is RegExpObjectType instead of walking the classinfo chain.
+
+        * builtins/RegExpPrototype.js:
+        (search):
+        * builtins/StringPrototype.js:
+        (search):
+        - fixed some indentation.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor):
+        (JSC::DFG::SpeculativeJIT::compileIsRegExpObject):
+        (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsRegExpObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
+        (JSC::FTL::DFG::LowerDFGToB3::isExoticForTypeof):
+        (JSC::FTL::DFG::LowerDFGToB3::isRegExpObject):
+        (JSC::FTL::DFG::LowerDFGToB3::isType):
+        * runtime/Intrinsic.h:
+        - Added IsRegExpObjectIntrinsic.
+
+        * runtime/CommonIdentifiers.h:
+
+        * runtime/ECMAScriptSpecInternalFunctions.cpp:
+        (JSC::esSpecIsConstructor):
+        - Changed to use uncheckedArgument since this is only called from internal code.
+        (JSC::esSpecIsRegExpObject):
+        (JSC::esSpecIsRegExp): Deleted.
+        * runtime/ECMAScriptSpecInternalFunctions.h:
+        - Changed to check the object for a JSType of RegExpObjectType.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        - Added split fast path.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncSearchFast):
+        (JSC::regExpProtoFuncSearch): Deleted.
+        * runtime/RegExpPrototype.h:
+
+        * tests/es6.yaml:
+        * tests/stress/regexp-search.js:
+        - Rebased test.
+
+2016-04-19  Mark Lam  <mark.lam@apple.com>
+
+        Replace $vm.printValue() with $vm.value().
+        https://bugs.webkit.org/show_bug.cgi?id=156767
+
+        Reviewed by Saam Barati.
+
+        When debugging with $vm, this change allows us to do this:
+
+            $vm.print("myObj = " + $vm.value(myObj) + "\n");
+
+        ... instead of having to do this:
+
+            $vm.print("myObj = ");
+            $vm.printValue(myObj);
+            $vm.print("\n");
+
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::printValue):
+        (JSC::functionValue):
+        (JSC::JSDollarVMPrototype::finishCreation):
+        (JSC::functionPrintValue): Deleted.
+
+2016-04-19  Mark Lam  <mark.lam@apple.com>
+
+        Re-landing: ES6: Implement String.prototype.split and RegExp.prototype[@@split].
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+
+        Reviewed by Keith Miller.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/GlobalObject.js:
+        (speciesConstructor):
+        * builtins/PromisePrototype.js:
+        - refactored to use the @speciesConstructor internal function.
+
+        * builtins/RegExpPrototype.js:
+        (advanceStringIndex):
+        - refactored from @advanceStringIndexUnicode() to be match the spec.
+          Benchmarks show that there's no advantage in doing the unicode check outside
+          of the advanceStringIndexUnicode part.  So, I simplified the code to match the
+          spec (especially since @@split needs to call advanceStringIndex from more than
+          1 location).
+        (match):
+        - Removed an unnecessary call to @Object because it was already proven above.
+        - Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
+          Again, there's no perf regression for this.
+        (regExpExec):
+        (hasObservableSideEffectsForRegExpSplit):
+        (split):
+        (advanceStringIndexUnicode): Deleted.
+
+        * builtins/StringPrototype.js:
+        (split):
+        - Modified to use RegExp.prototype[@@split].
+
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        - Added the @@split symbol.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
+        (JSC::esSpecIsConstructor):
+        (JSC::esSpecIsRegExp):
+        * runtime/ECMAScriptSpecInternalFunctions.h: Added.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::getGetterById):
+        (JSC::JSGlobalObject::init):
+
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        - Removed an assert that is no longer valid.
+
+        * runtime/RegExpObject.h:
+        - Made advanceStringUnicode() public so that it can be re-used by the regexp split
+          fast path.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncSearch):
+        (JSC::advanceStringIndex):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/RegExpPrototype.h:
+
+        * runtime/StringObject.h:
+        (JSC::jsStringWithReuse):
+        (JSC::jsSubstring):
+        - Hoisted some utility functions from StringPrototype.cpp so that they can be
+          reused by the regexp split fast path.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::builtinStringSubstrInternal):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringIncludesImpl):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::jsStringWithReuse): Deleted.
+        (JSC::jsSubstring): Deleted.
+        (JSC::stringProtoFuncSplit): Deleted.
+        * runtime/StringPrototype.h:
+
+        * tests/es6.yaml:
+
+2016-04-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199726.
+        https://bugs.webkit.org/show_bug.cgi?id=156748
+
+        WebKit tests crash on Windows 32 (Requested by msaboff on
+        #webkit).
+
+        Reverted changeset:
+
+        "iTunes crashing JavaScriptCore.dll"
+        https://bugs.webkit.org/show_bug.cgi?id=156647
+        http://trac.webkit.org/changeset/199726
+
+2016-04-19  Michael Saboff  <msaboff@apple.com>
+
+        iTunes crashing JavaScriptCore.dll
+        https://bugs.webkit.org/show_bug.cgi?id=156647
+
+        Reviewed by Saam Barati.
+
+        Given that there there are only 128 FLS indices compared to over a 1000 for TLS, I
+        eliminated the thread specific m_threadSpecificForThread and instead we look for the
+        current thread in m_registeredThreads list when we need it.  In most cases there
+        will only be one thread.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::machineThreadForCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        * heap/MachineStackMarker.h:
+
+2016-04-19  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [INTL] Use @thisNumberValue instead of `instanceof @Number`
+        https://bugs.webkit.org/show_bug.cgi?id=156680
+
+        Reviewed by Saam Barati.
+
+        Use @thisNumberValue instead of `instanceof @Number`.
+        `instanceof @Number` is not enough;
+        For example, given 2 realms, the object created in one realm does not
+        inherit the Number of another realm.
+        Another example is that the object which does not inherit Number.
+
+        ```
+        var number = new Number(42);
+        number.__proto__ = null;
+        ```
+
+        * builtins/NumberPrototype.js:
+        (toLocaleString):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncValueOf):
+        * runtime/NumberPrototype.h:
+        * tests/stress/number-to-locale-string-should-accept-strange-number-objects.js: Added.
+        (shouldBe):
+
+2016-04-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199712.
+        https://bugs.webkit.org/show_bug.cgi?id=156741
+
+        It caused a serious regression on 32 bit platform (Requested
+        by gskachkov on #webkit).
+
+        Reverted changeset:
+
+        "calling super() a second time in a constructor should throw"
+        https://bugs.webkit.org/show_bug.cgi?id=151113
+        http://trac.webkit.org/changeset/199712
+
+2016-04-09  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        calling super() a second time in a constructor should throw
+        https://bugs.webkit.org/show_bug.cgi?id=151113
+
+        Reviewed by Saam Barati and Keith Miller.
+
+        Currently, our implementation checks if 'super()' was called in a constructor more 
+        than once and raises a RuntimeError before the second call. According to the spec 
+        we need to raise an error just after the second super() is finished and before 
+        the new 'this' is assigned https://esdiscuss.org/topic/duplicate-super-call-behaviour. 
+        To implement this behavior this patch adds a new op code, op_is_empty, that is used 
+        to check if 'this' is empty.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitIsEmpty):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallValueNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsEmpty):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_is_empty):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_is_empty):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * tests/stress/class-syntax-double-constructor.js: Added.
+
+2016-04-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Fix some overhead affecting small codegen
+        https://bugs.webkit.org/show_bug.cgi?id=156728
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::AbstractMacroAssembler):
+        (JSC::AbstractMacroAssembler::random):
+        cryptographicallyRandomNumber() is very costly.
+        We only need it in lowering some very particular cases
+        of non-trusted immediates. No inline cache needs that.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::link):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::addSlowCase):
+        Do not copy the JumpList to access its elements.
+
+2016-04-18  Saam barati  <sbarati@apple.com>
+
+        implement dynamic scope accesses in the DFG/FTL
+        https://bugs.webkit.org/show_bug.cgi?id=156567
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds dynamic scope operations to the DFG/FTL.
+        This patch adds three new DFG nodes: ResolveScope, PutDynamicVar and GetDynamicVar.
+        When we encounter a Dynamic/UnresolvedProperty/UnresolvedPropertyWithVarInjectionChecks
+        resolve type, we will compile dynamic scope resolution nodes. When we encounter
+        a resolve type that needs var injection checks and the var injection
+        watchpoint has already been fired, we will compile dynamic scope resolution
+        nodes.
+
+        This patch also adds a new value to the InitializationMode enum: ConstInitialization.
+        There was a subtle bug where we used to never compile the var injection variant of the 
+        resolve type for an eval that injected a var where there was also a global lexical variable with the same name. 
+        For example, the store compiled in this eval("var foo = 20;") wouldn't be compiled 
+        with var injection checks if there was global let/const variable named "foo".
+        So there was the potential for the injected var to store to the GlobalLexicalObject.
+        I found this bug because my initial implementation in the DFG/FTL ran into it.
+        The reason this bug existed is because when we compile a const initialization,
+        we never need a var injections check. The const initialization always
+        knows where to store its value. This same logic leaked into the above eval's 
+        "var foo = 20" store. This new enum value allows us to distinguish const
+        initialization stores from non-const initialization stores.
+
+        (I also changed InitializationMode to be an enum class instead of an enum).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeBlockScopedFunctions):
+        (JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary):
+        (JSC::BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration):
+        (JSC::BytecodeGenerator::emitGetFromScope):
+        (JSC::BytecodeGenerator::initializeVariable):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::pushScopedControlFlowContext):
+        (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::initializationModeForAssignmentContext):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::EmptyLetExpression::emitBytecode):
+        (JSC::ForInNode::emitLoopHeader):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::ClassExprNode::emitBytecode):
+        (JSC::BindingNode::bindValue):
+        (JSC::AssignmentElementNode::bindValue):
+        (JSC::RestParameterNode::emit):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::noticeArgumentsUse):
+        (JSC::DFG::ByteCodeParser::promoteToConstant):
+        (JSC::DFG::ByteCodeParser::needsDynamicLookup):
+        (JSC::DFG::ByteCodeParser::planLoad):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        (JSC::DFG::Node::identifierNumber):
+        (JSC::DFG::Node::hasGetPutInfo):
+        (JSC::DFG::Node::getPutInfo):
+        (JSC::DFG::Node::hasAccessorAttributes):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutGetterSetterById):
+        (JSC::DFG::SpeculativeJIT::compileResolveScope):
+        (JSC::DFG::SpeculativeJIT::compileGetDynamicVar):
+        (JSC::DFG::SpeculativeJIT::compilePutDynamicVar):
+        (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compare):
+        (JSC::FTL::DFG::LowerDFGToB3::compileResolveScope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetDynamicVar):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutDynamicVar):
+        (JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/GetPutInfo.h:
+        (JSC::resolveModeName):
+        (JSC::initializationModeName):
+        (JSC::isInitialization):
+        (JSC::makeType):
+        (JSC::GetPutInfo::GetPutInfo):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+
+2016-04-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Disable AVX.
+
+        Rubber stampted by Benjamin Poulain.
+
+        AVX is silly. If you use it and some of your other code isn't careful with float register bits, you
+        will run 10x slower. We could fix the underlying issue, but it's better to stay away from this odd
+        instruction subset.
+
+        This fixes a massive regression on some real code.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::supportsAVX):
+        (JSC::MacroAssemblerX86Common::updateEax1EcxFlags):
+
+2016-04-18  Filip Pizlo  <fpizlo@apple.com>
+
+        ToThis should have a fast path based on type info flags
+        https://bugs.webkit.org/show_bug.cgi?id=156712
+
+        Reviewed by Geoffrey Garen.
+
+        Prior to this change, if we couldn't nail down the type of ToThis to something easy, we'd emit code
+        that would take slow path if the argument was not a final object. We'd end up taking that slow path
+        a lot.
+
+        This adds a type info flag for ToThis having non-obvious behavior and changes the DFG and FTL paths
+        to test this flag. This is a sub-1% speed-up on SunSpider and Octane.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileToThis):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::create):
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::JSLexicalEnvironment::create):
+        * runtime/JSString.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetOwnPropertySlot):
+        (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero):
+        (JSC::TypeInfo::structureIsImmortal):
+        (JSC::TypeInfo::overridesToThis):
+        (JSC::TypeInfo::overridesGetPropertyNames):
+        (JSC::TypeInfo::prohibitsPropertyCaching):
+        (JSC::TypeInfo::getOwnPropertySlotIsImpure):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::create):
+        * runtime/Symbol.h:
+
+2016-04-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Check to see how the perf bots react to megamorphic load being disabled.
+
+        Rubber stamped by Chris Dumez.
+
+        * runtime/Options.h:
+
+2016-04-18  Keith Miller  <keith_miller@apple.com>
+
+        We should support delete in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=156607
+
+        Reviewed by Benjamin Poulain.
+
+        This patch adds support for the delete in the DFG as it appears that
+        some major frameworks use the operation in particularly hot functions.
+        As a result, even if the function rarely ever calls delete we would never
+        tier up to the DFG. This patch also changes operationDeleteById to take a
+        UniquedStringImpl and return a size_t.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileDeleteById):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_del_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_del_by_id):
+
+2016-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should pin the tag registers at inline caches
+        https://bugs.webkit.org/show_bug.cgi?id=156678
+
+        Reviewed by Saam Barati.
+
+        This is a long-overdue fix to our inline caches. Back when we had LLVM, we couldn't rely on the tags
+        being pinned to any registers. So, if the inline caches needed tags, they'd have to materialize them.
+        
+        This removes those materializations. This should reduce the amount of code generated in inline caches
+        and it should make inline caches faster. The effect appears to be small.
+
+        It may be that after this change, we'll even be able to kill the
+        HaveTagRegisters/DoNotHaveTagRegisters logic.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generateWithGuard):
+        (JSC::AccessCase::generateImpl):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIn):
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        * jit/Repatch.cpp:
+        (JSC::readCallTarget):
+        (JSC::linkPolymorphicCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualThunkFor):
+
+2016-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES7] yield star should not return if the inner iterator.throw returns { done: true }
+        https://bugs.webkit.org/show_bug.cgi?id=156576
+
+        Reviewed by Saam Barati.
+
+        This is slight generator fix in ES7. When calling generator.throw(),
+        the yield-star should call the throw() of the inner generator. At that
+        time, when the result of throw() is { done: true}, the generator should
+        not stop itself.
+
+            function * gen()
+            {
+                yield * (function * () {
+                    try {
+                        yield 42;
+                    } catch (error) { }
+                }());
+                // Continue executing.
+                yield 42;
+            }
+
+            let g = gen();
+            g.next();
+            shouldBe(g.throw().value, 42);
+
+
+        * builtins/GeneratorPrototype.js:
+        (generatorResume):
+        (next):
+        (return):
+        (throw):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitDelegateYield):
+        * runtime/JSGeneratorFunction.h:
+        * tests/stress/generator-yield-star.js:
+        (gen):
+        * tests/stress/yield-star-throw-continue.js: Added.
+        (shouldBe):
+        (generator):
+        (shouldThrow):
+
+2016-04-17  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>
+
+        Fix incorrect assumption that APPLE implies Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=156683
+    
+        Addresses build failure introduced in r199094
+
+        Reviewed by Alex Christensen.
+
+        * CMakeLists.txt:
+
+2016-04-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] ReduceDoubleToFloat should work accross Phis
+        https://bugs.webkit.org/show_bug.cgi?id=156603
+        <rdar://problem/25736205>
+
+        Reviewed by Saam Barati and Filip Pizlo.
+
+        This patch extends B3's ReduceDoubleToFloat phase to work accross
+        Upsilon-Phis. This is important to optimize loops and some crazy cases.
+
+        In its simplest form, we can have conversion propagated from something
+        like this:
+            Double @1 = Phi()
+            Float @2 = DoubleToFloat(@1)
+
+        When that happens, we just need to propagate that the result only
+        need float precision accross all values coming to this Phi.
+
+
+        There are more complicated cases when the value produced is effectively Float
+        but the user of the value does not do DoubleToFloat.
+
+        Typically, we have something like:
+            #1
+                @1 = ConstDouble(1)
+                @2 = Upsilon(@1, ^5)
+            #2
+                @3 = FloatToDouble(@x)
+                @4 = Upsilon(@3, ^5)
+            #3
+                @5 = Phi()
+                @6 = Add(@5, @somethingFloat)
+                @7 = DoubleToFloat(@6)
+
+        Here with a Phi-Upsilon that is a Double but can be represented
+        as Float without loss of precision.
+
+        It is valuable to convert such Phis to float if and only if the value
+        is used as float. Otherwise, you may be just adding useless conversions
+        (for example, two double constants that flow into a double Add should not
+        turn into two float constant flowing into a FloatToDouble then Add).
+
+
+        ReduceDoubleToFloat do two analysis passes to gather the necessary
+        meta information. Then we have a simplify() phase to actually reduce
+        operation. Finally, the cleanup() pass put the graph into a valid
+        state again.
+
+        The two analysis passes work by disproving that something is float.
+        -findCandidates() accumulates anything used as Double.
+        -findPhisContainingFloat() accumulates phis that would lose precision
+         by converting the input to float.
+
+        With this change, Unity3D improves by ~1.5%, box2d-f32 improves
+        by ~2.8% (on Haswell).
+
+        * b3/B3ReduceDoubleToFloat.cpp:
+        (JSC::B3::reduceDoubleToFloat):
+        * b3/testb3.cpp:
+        (JSC::B3::testCompareTwoFloatToDouble):
+        (JSC::B3::testCompareOneFloatToDouble):
+        (JSC::B3::testCompareFloatToDoubleThroughPhi):
+        (JSC::B3::testDoubleToFloatThroughPhi):
+        (JSC::B3::testDoubleProducerPhiToFloatConversion):
+        (JSC::B3::testDoubleProducerPhiToFloatConversionWithDoubleConsumer):
+        (JSC::B3::testDoubleProducerPhiWithNonFloatConst):
+        (JSC::B3::testStoreDoubleConstantAsFloat):
+        (JSC::B3::run):
+        * tests/stress/double-compare-to-float.js: Added.
+        (canSimplifyToFloat):
+        (canSimplifyToFloatWithConstant):
+        (cannotSimplifyA):
+        (cannotSimplifyB):
+        * tests/stress/double-to-float.js: Added.
+        (upsilonReferencingItsPhi):
+        (upsilonReferencingItsPhiAllFloat):
+        (upsilonReferencingItsPhiWithoutConversion):
+        (conversionPropagages):
+        (chainedUpsilonBothConvert):
+        (chainedUpsilonFirstConvert):
+
+2016-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Use @isObject to check Object Type instead of using instanceof
+        https://bugs.webkit.org/show_bug.cgi?id=156676
+
+        Reviewed by Darin Adler.
+
+        Use @isObject instead of `instanceof @Object`.
+        The `instanceof` check is not enough to check Object Type.
+        For example, given 2 realms, the object created in one realm does not inherit the Object of another realm.
+        Another example is that the object which does not inherit Object.
+        This object can be easily created by calling `Object.create(null)`.
+
+        * builtins/RegExpPrototype.js:
+        (match):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionCreateGlobalObject):
+        * tests/stress/regexp-match-in-other-realm-should-work.js: Added.
+        (shouldBe):
+        * tests/stress/regexp-match-should-work-with-objects-not-inheriting-object-prototype.js: Added.
+        (shouldBe):
+        (regexp.exec):
+
+2016-04-17  Darin Adler  <darin@apple.com>
+
+        Remove more uses of Deprecated::ScriptXXX
+        https://bugs.webkit.org/show_bug.cgi?id=156660
+
+        Reviewed by Antti Koivisto.
+
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptCallArgumentHandler::appendArgument): Deleted
+        unneeded overloads that take a ScriptObject and ScriptValue.
+        * bindings/ScriptFunctionCall.h: Ditto.
+
+        * bindings/ScriptObject.h: Added operator so this can change
+        itself into a JSObject*. Helps while phasing this class out.
+
+        * bindings/ScriptValue.h: Export toInspectorValue so it can be
+        used in WebCore.
+
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::createInjectedScript): Changed
+        return value from Deprecated::ScriptObject to JSObject*.
+        (Inspector::InjectedScriptManager::injectedScriptFor): Updated for
+        the return value change above.
+        * inspector/InjectedScriptManager.h: Ditto.
+
+2016-04-16  Benjamin Poulain  <bpoulain@webkit.org>
+
+        [JSC] DFG should support relational comparisons of Number and Other
+        https://bugs.webkit.org/show_bug.cgi?id=156669
+
+        Reviewed by Darin Adler.
+
+        In Sunspider/3d-raytrace, DFG falls back to JSValue in some important
+        relational compare because profiling sees "undefined" from time to time.
+
+        This case is fairly common outside Sunspider too because of out-of-bounds array access.
+        Unfortunately for us, our fallback for compare is really inefficient.
+
+        Fortunately, relational comparison with null/undefined/true/false are trival.
+        We can just convert both side to Double. That's what this patch adds.
+
+        I also extended constant folding for those cases because I noticed
+        a bunch of "undefined" constant going through DoubleRep at runtime.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * tests/stress/compare-number-and-other.js: Added.
+        (opaqueSideEffect):
+        (let.operator.of.operators.eval.testPolymorphic):
+        (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.eval.testMonomorphic):
+        (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.testMonomorphicLeftConstant):
+        (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.testMonomorphicRightConstant):
+        (let.operator.of.operators.let.left.of.typeCases.let.right.of.typeCases.i.testPolymorphic):
+
+2016-04-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] FRound/Negate can produce an impure NaN out of a pure NaN
+        https://bugs.webkit.org/show_bug.cgi?id=156528
+
+        Reviewed by Filip Pizlo.
+
+        If you fround a double with the bits 0xfff7000000000000
+        you get 0xfffe000000000000. The first is a pure NaN, the second isn't.
+
+        This is without test because I could not find a way to create a 0xfff7000000000000
+        while convincing DFG that its pure.
+        When we purify NaNs from typed array, we use a specific value of NaN if the input
+        is any NaN, making testing tricky.
+
+        * bytecode/SpeculatedType.cpp:
+        (JSC::typeOfDoubleNegation):
+
+2016-04-16  Konstantin Tokarev  <annulen@yandex.ru>
+
+        JS::DFG::nodeValuePairListDump does not compile with libstdc++ 4.8
+        https://bugs.webkit.org/show_bug.cgi?id=156670
+
+        Reviewed by Darin Adler.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::nodeValuePairListDump): Modified to use lambda as comparator.
+
+2016-04-16  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Implemented moveZeroToDouble.
+        https://bugs.webkit.org/show_bug.cgi?id=155429
+
+        Reviewed by Darin Adler.
+
+        This function is required to fix compilation after r197687.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::moveZeroToDouble):
+
+2016-04-15  Darin Adler  <darin@apple.com>
+
+        Reduce use of Deprecated::ScriptXXX classes
+        https://bugs.webkit.org/show_bug.cgi?id=156632
+
+        Reviewed by Alex Christensen.
+
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptCallArgumentHandler::appendArgument): Deleted version that takes a Deprecated::ScriptValue.
+        (Deprecated::ScriptFunctionCall::call): Changed to return a JSValue.
+        * bindings/ScriptFunctionCall.h: Updated for the above.
+
+        * bindings/ScriptValue.cpp:
+        (Inspector::jsToInspectorValue): Moved from Deprecated namespace to Inspector namespace. Later, we should
+        move this to another source file in the inspector directory.
+        (Inspector::toInspectorValue): Added.
+        (Deprecated::ScriptValue::toInspectorValue): Updated for change to underlying function.
+        * bindings/ScriptValue.h: Update for the above.
+
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::evaluateOnCallFrame): Changed arguments and return values from
+        Deprecated::ScriptValue to JSC::JSValue.
+        (Inspector::InjectedScript::functionDetails): Ditto.
+        (Inspector::InjectedScript::wrapCallFrames): Ditto.
+        (Inspector::InjectedScript::wrapObject): Ditto.
+        (Inspector::InjectedScript::wrapTable): Ditto.
+        (Inspector::InjectedScript::previewValue): Ditto.
+        (Inspector::InjectedScript::setExceptionValue): Ditto.
+        (Inspector::InjectedScript::findObjectById): Ditto.
+        (Inspector::InjectedScript::inspectObject): Ditto.
+        * inspector/InjectedScript.h: Ditto.
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::callFunctionWithEvalEnabled): Ditto.
+        (Inspector::InjectedScriptBase::makeCall): Ditto.
+        * inspector/InjectedScriptBase.h: Ditto.
+        * inspector/InjectedScriptModule.cpp:
+        (Inspector::InjectedScriptModule::ensureInjected): Ditto.
+        * inspector/ScriptDebugListener.h: Ditto.
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::evaluateBreakpointAction): Ditto.
+        (Inspector::ScriptDebugServer::dispatchDidPause): Ditto.
+        (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe): Ditto.
+        (Inspector::ScriptDebugServer::exceptionOrCaughtValue): Ditto.
+        * inspector/ScriptDebugServer.h: Ditto.
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::buildExceptionPauseReason): Ditto.
+        (Inspector::InspectorDebuggerAgent::didPause): Ditto.
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe): Ditto.
+        (Inspector::InspectorDebuggerAgent::didContinue): Ditto.
+        (Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState): Ditto.
+        * inspector/agents/InspectorDebuggerAgent.h: Ditto.
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::getPreview): Ditto.
+        (Inspector::InspectorHeapAgent::getRemoteObject): Ditto.
+
+2016-04-15  Keith Miller  <keith_miller@apple.com>
+
+        Some JIT/DFG operations need NativeCallFrameTracers
+        https://bugs.webkit.org/show_bug.cgi?id=156650
+
+        Reviewed by Michael Saboff.
+
+        Some of our operation functions did not have native call frame
+        tracers. This meant that we would crash occasionally on some
+        of our tests when they triggered a GC in one of the functions
+        without a tracer. In particular, this was exemplified by another
+        upcoming patch when calling operationSetFunctionName.
+
+        This patch does not add tests since this happens consistently in
+        the patch adding delete_by_id to the DFG.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperations.cpp:
+
+2016-04-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: sourceMappingURL not used when sourceURL is set
+        https://bugs.webkit.org/show_bug.cgi?id=156021
+        <rdar://problem/25438417>
+
+        Reviewed by Timothy Hatcher.
+
+        Clean up Debugger.sourceParsed to separately include:
+
+            - url ("resource URL", "source url" in JSC APIs)
+            - sourceURL - //# sourceURL directive
+
+        By always having the resource URL the Web Inspector frontend
+        can better match this Script to a Resource of the same URL,
+        and decide to use the sourceURL if it is available when
+        appropriate.
+
+        * inspector/protocol/Debugger.json:
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::didParseSource):
+        Send the new sourceParsed parameters.
+
+2016-04-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Cleanup inspector/debugger tests
+        https://bugs.webkit.org/show_bug.cgi?id=156619
+
+        Reviewed by Brian Burg.
+
+        While cleaning up the tests it exposed the fact that breakpoints
+        were not getting disabled when the inspector closes. This means
+        that opening the inspector, with breakpoints, and closing the
+        inspector, would leave the JSC::Debugger thinking breakpoints
+        are active. The JSC::Debugger should be reset.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::disable):
+
+2016-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        CopiedBlock should be 64kB
+
+        Reviewed by Benjamin Poulain.
+
+        Let's try another value.
+
+        This is 25% faster on kraken-audio-beat-detection on Mac Pro.
+
+        * heap/CopiedBlock.h:
+
+2016-04-15  Zan Dobersek  <zdobersek@igalia.com>
+
+        Tail call optimizations lead to crashes on ARM Thumb + Linux
+        https://bugs.webkit.org/show_bug.cgi?id=150083
+
+        Reviewed by Csaba Osztrogonác.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::repatchNearCall): In case of a tail call relink to the
+        data location of the destination, and not the executable address. This is needed for
+        the ARM Thumb2 platform where both the source and destination addresses of a jump relink
+        must not have the bottom bit decorated, as asserted in ARMv7Assembler::relinkJump().
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall): Similarly, when linking a tail call we must link to the
+        address that has a non-decorated bottom bit, as asserted in ARMv7Assembler::linkJumpAbsolute().
+
+2016-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling out r199567.
+
+        performance regression on kraken on macbook*
+
+        Reverted changeset:
+
+        "CopiedBlock should be 8kB"
+        https://bugs.webkit.org/show_bug.cgi?id=156610
+        http://trac.webkit.org/changeset/199567
+
+2016-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        CopiedBlock should be 8kB
+        https://bugs.webkit.org/show_bug.cgi?id=156610
+
+        Reviewed by Michael Saboff.
+
+        On Mac Pro, this is:
+
+            15% faster on kraken-audio-beat-detection
+
+            5% faster on v8-splay
+
+        Hopefully, this will be OK on MacBook* bots as well.
+
+        32kB is the full size of L1 cache on x86. So, allocating and zero-filling
+        a 32kB CopiedBlock would basically flush the L1 cache. We can ameliorate
+        this problem by using smaller blocks -- or, if that doesn't work, we can
+        use larger blocks to amortize the cost.
+
+        * heap/CopiedBlock.h:
+
+2016-04-14  Filip Pizlo  <fpizlo@apple.com>
+
+        PolymorphicAccess should try to generate a stub only once
+        https://bugs.webkit.org/show_bug.cgi?id=156555
+
+        Reviewed by Geoffrey Garen.
+        
+        This changes the PolymorphicAccess heuristics to reduce the amount of code generation even
+        more than before. We used to always generate a monomorphic stub for the first case we saw.
+        This change disables that. This change also increases the buffering countdown to match the
+        cool-down repatch count. This means that we will allow for ten slow paths for adding cases,
+        then we will generate a stub, and then we will go into cool-down and the repatching slow
+        paths will not even attempt repatching for a while. After we emerge from cool-down - which
+        requires a bunch of slow path calls - we will again wait for ten slow paths to get new
+        cases. Note that it only takes 13 cases to cause the stub to give up on future repatching
+        entirely. Also, most stubs don't ever get to 10 cases. Therefore, for most stubs this change
+        means that each IC will repatch once. If they make it to two repatching, then the likelihood
+        of a third becomes infinitesimal because of all of the rules that come into play at that
+        point (the size limit being 13, the fact that we go into exponential cool-down every time we
+        generate code, and the fact that if we have lots of self cases then we will create a
+        catch-all megamorphic load case).
+
+        This also undoes a change to the megamorphic optimization that I think was unintentional.
+        As in the change that originally introduced megamorphic loads, we want to do this only if we
+        would otherwise exhaust the max size of the IC. This is because megamorphic loads are pretty
+        expensive and it's best to use them only if we know that the alternative is giving up on
+        caching.
+
+        This is neutral on JS benchmarks, but looks like it's another speed-up for page loading.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::canBeReplacedByMegamorphicLoad):
+        (JSC::AccessCase::canReplace):
+        (JSC::AccessCase::dump):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * runtime/Options.h:
+
+2016-04-14  Mark Lam  <mark.lam@apple.com>
+
+        Update treatment of invoking RegExp.prototype methods on RegExp.prototype.
+        https://bugs.webkit.org/show_bug.cgi?id=155922
+
+        Reviewed by Keith Miller.
+
+        According to the TC39 committee, when invoking the following RegExp.prototype
+        methods on the RegExp.prototype:
+        1. RegExp.prototype.flags yields ""
+        2. RegExp.prototype.global yields undefined
+        3. RegExp.prototype.ignoreCase yields undefined
+        4. RegExp.prototype.multiline yields undefined
+        5. RegExp.prototype.unicode yields undefined
+        6. RegExp.prototype.source yields "(?:)"
+        7. RegExp.prototype.sticky yields undefined
+        8. RegExp.prototype.toString() yields "/(?:)/"
+
+        and RegExp.prototype is still NOT an instance of RegExp.  The above behavior
+        changes is a special dispensation applicable only to RegExp.prototype.  The ES6
+        spec of throwing errors still applies if those methods are applied to anything =
+        else that is not a RegExp object.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoGetterGlobal):
+        (JSC::regExpProtoGetterIgnoreCase):
+        (JSC::regExpProtoGetterMultiline):
+        (JSC::regExpProtoGetterSticky):
+        (JSC::regExpProtoGetterUnicode):
+        (JSC::regExpProtoGetterFlags):
+        (JSC::regExpProtoGetterSource):
+        - Implemented new behavior.
+
+        * tests/es6/miscellaneous_built-in_prototypes_are_not_instances.js:
+        (test):
+        - Updated to match current kangax test.
+
+2016-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Some imported ES6 tests are missing __createIterableObject
+        https://bugs.webkit.org/show_bug.cgi?id=156584
+
+        Reviewed by Keith Miller.
+
+        These tests were failing because I neglected to include __createIterableObject
+        when I first imported them. Now they pass.
+
+        * tests/es6.yaml:
+        * tests/es6/Array_static_methods_Array.from_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/Array_static_methods_Array.from_instances_of_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/Array_static_methods_Array.from_iterator_closing.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/Array_static_methods_Array.from_map_function_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/Array_static_methods_Array.from_map_function_instances_of_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/Map_iterator_closing.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/Promise_Promise.all_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test.asyncTestPassed):
+        * tests/es6/Promise_Promise.race_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test.asyncTestPassed):
+        * tests/es6/Set_iterator_closing.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/WeakMap_iterator_closing.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/WeakSet_iterator_closing.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/destructuring_iterator_closing.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/destructuring_with_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/destructuring_with_instances_of_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/for..of_loops_iterator_closing_break.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/for..of_loops_iterator_closing_throw.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/for..of_loops_with_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/for..of_loops_with_instances_of_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/generators_yield_star_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/generators_yield_star_iterator_closing_via_throw.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/spread_..._operator_with_generic_iterables_in_arrays.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/spread_..._operator_with_generic_iterables_in_calls.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/spread_..._operator_with_instances_of_iterables_in_arrays.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+        * tests/es6/spread_..._operator_with_instances_of_iterables_in_calls.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        (test):
+
+2016-04-13  Alex Christensen  <achristensen@webkit.org>
+
+        CMake MiniBrowser should be an app bundle
+        https://bugs.webkit.org/show_bug.cgi?id=156521
+
+        Reviewed by Brent Fulgham.
+
+        * PlatformMac.cmake:
+        Unreviewed build fix.  Define __STDC_WANT_LIB_EXT1__ so we can find memset_s.
+
+2016-04-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSContext Inspector: Improve Class instances and JSC API Exported Values view in Console / ObjectTree
+        https://bugs.webkit.org/show_bug.cgi?id=156566
+        <rdar://problem/16392365>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.RemoteObject.prototype._appendPropertyPreviews):
+        Treat non-basic object types as not lossless so they can be expanded.
+        Show non-enumerable native getters in Object previews.
+
+2016-04-13  Michael Saboff  <msaboff@apple.com>
+
+        Some tests fail with ES6 `u` (Unicode) flag for regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=151597
+
+        Reviewed by Geoffrey Garen.
+
+        Added two new tables to handle the anomolies of \w and \W CharacterClassEscapes
+        when specified in RegExp's with both the unicode and ignoreCase flags.  Given the
+        case folding rules described in the standard vie the meta function Canonicalize(),
+        which allow cross ASCII case folding when unicode is specified, the unicode characters
+        \u017f (small sharp s) and \u212a (kelvin symbol) are part of the \w (word) characterClassEscape.
+        This is true because they case fold to 's' and 'k' respectively.  Because they case fold
+        to lower case letters, the corresponding letters, 'k', 'K', 's' and 'S', are also matched with
+        \W with the unicode and ignoreCase flags.
+
+        * create_regex_tables:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::atomBuiltInCharacterClass):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::YarrPattern::wordcharCharacterClass):
+        (JSC::Yarr::YarrPattern::wordUnicodeIgnoreCaseCharCharacterClass):
+        (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
+        (JSC::Yarr::YarrPattern::nonwordUnicodeIgnoreCaseCharCharacterClass):
+
+2016-04-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199502 and r199511.
+        https://bugs.webkit.org/show_bug.cgi?id=156557
+
+        Appears to have in-browser perf regression (Requested by mlam
+        on #webkit).
+
+        Reverted changesets:
+
+        "ES6: Implement String.prototype.split and
+        RegExp.prototype[@@split]."
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+        http://trac.webkit.org/changeset/199502
+
+        "ES6: Implement RegExp.prototype[@@search]."
+        https://bugs.webkit.org/show_bug.cgi?id=156331
+        http://trac.webkit.org/changeset/199511
+
+2016-04-13  Keith Miller  <keith_miller@apple.com>
+
+        isJSArray should use ArrayType rather than the ClassInfo
+        https://bugs.webkit.org/show_bug.cgi?id=156551
+
+        Reviewed by Filip Pizlo.
+
+        Using the JSType rather than the ClassInfo should be slightly faster
+        since the type is inline on the cell whereas the ClassInfo is only
+        on the structure.
+
+        * runtime/JSArray.h:
+        (JSC::isJSArray):
+
+2016-04-13  Mark Lam  <mark.lam@apple.com>
+
+        ES6: Implement RegExp.prototype[@@search].
+        https://bugs.webkit.org/show_bug.cgi?id=156331
+
+        Reviewed by Keith Miller.
+
+        What changed?
+        1. Implemented search builtin in RegExpPrototype.js.
+           The native path is now used as a fast path.
+        2. Added DFG support for an IsRegExpObjectIntrinsic (modelled after the
+           IsJSArrayIntrinsic).
+        3. Renamed @isRegExp to @isRegExpObject to match the new IsRegExpObjectIntrinsic.
+        4. Change the esSpecIsRegExpObject() implementation to check if the object's
+           JSType is RegExpObjectType instead of walking the classinfo chain.
+
+        * builtins/RegExpPrototype.js:
+        (search):
+        * builtins/StringPrototype.js:
+        (search):
+        - fixed some indentation.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor):
+        (JSC::DFG::SpeculativeJIT::compileIsRegExpObject):
+        (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsRegExpObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
+        (JSC::FTL::DFG::LowerDFGToB3::isExoticForTypeof):
+        (JSC::FTL::DFG::LowerDFGToB3::isRegExpObject):
+        (JSC::FTL::DFG::LowerDFGToB3::isType):
+        * runtime/Intrinsic.h:
+        - Added IsRegExpObjectIntrinsic.
+
+        * runtime/CommonIdentifiers.h:
+
+        * runtime/ECMAScriptSpecInternalFunctions.cpp:
+        (JSC::esSpecIsConstructor):
+        - Changed to use uncheckedArgument since this is only called from internal code.
+        (JSC::esSpecIsRegExpObject):
+        (JSC::esSpecIsRegExp): Deleted.
+        * runtime/ECMAScriptSpecInternalFunctions.h:
+        - Changed to check the object for a JSType of RegExpObjectType.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        - Added split fast path.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncSearchFast):
+        (JSC::regExpProtoFuncSearch): Deleted.
+        * runtime/RegExpPrototype.h:
+
+        * tests/es6.yaml:
+        * tests/stress/regexp-search.js:
+        - Rebased test.
+
+2016-04-12  Filip Pizlo  <fpizlo@apple.com>
+
+        PolymorphicAccess::regenerate() shouldn't have to clone non-generated AccessCases
+        https://bugs.webkit.org/show_bug.cgi?id=156493
+
+        Reviewed by Geoffrey Garen.
+
+        Cloning AccessCases is only necessary if they hold some artifacts that are used by code that
+        they already generated. So, if the state is not Generated, we don't have to bother with
+        cloning them.
+
+        This should speed up PolymorphicAccess regeneration a bit more.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::commit):
+        (JSC::PolymorphicAccess::regenerate):
+
+2016-04-13  Mark Lam  <mark.lam@apple.com>
+
+        ES6: Implement String.prototype.split and RegExp.prototype[@@split].
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+
+        Reviewed by Keith Miller.
+
+        Re-landing r199393 now that the shadow chicken crash has been fixed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/GlobalObject.js:
+        (speciesConstructor):
+        * builtins/PromisePrototype.js:
+        - refactored to use the @speciesConstructor internal function.
+
+        * builtins/RegExpPrototype.js:
+        (advanceStringIndex):
+        - refactored from @advanceStringIndexUnicode() to be match the spec.
+          Benchmarks show that there's no advantage in doing the unicode check outside
+          of the advanceStringIndexUnicode part.  So, I simplified the code to match the
+          spec (especially since @@split needs to call advanceStringIndex from more than
+          1 location).
+        (match):
+        - Removed an unnecessary call to @Object because it was already proven above.
+        - Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
+          Again, there's no perf regression for this.
+        (regExpExec):
+        (hasObservableSideEffectsForRegExpSplit):
+        (split):
+        (advanceStringIndexUnicode): Deleted.
+
+        * builtins/StringPrototype.js:
+        (split):
+        - Modified to use RegExp.prototype[@@split].
+
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        - Added the @@split symbol.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
+        (JSC::esSpecIsConstructor):
+        (JSC::esSpecIsRegExp):
+        * runtime/ECMAScriptSpecInternalFunctions.h: Added.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::getGetterById):
+        (JSC::JSGlobalObject::init):
+
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        - Removed an assert that is no longer valid.
+
+        * runtime/RegExpObject.h:
+        - Made advanceStringUnicode() public so that it can be re-used by the regexp split
+          fast path.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncSearch):
+        (JSC::advanceStringIndex):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/RegExpPrototype.h:
+
+        * runtime/StringObject.h:
+        (JSC::jsStringWithReuse):
+        (JSC::jsSubstring):
+        - Hoisted some utility functions from StringPrototype.cpp so that they can be
+          reused by the regexp split fast path.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::builtinStringSubstrInternal):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringIncludesImpl):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::jsStringWithReuse): Deleted.
+        (JSC::jsSubstring): Deleted.
+        (JSC::stringProtoFuncSplit): Deleted.
+        * runtime/StringPrototype.h:
+
+        * tests/es6.yaml:
+
+2016-04-13  Mark Lam  <mark.lam@apple.com>
+
+        ShadowChicken::visitChildren() should not visit tailMarkers and throwMarkers.
+        https://bugs.webkit.org/show_bug.cgi?id=156532
+
+        Reviewed by Saam Barati and Filip Pizlo.
+
+        ShadowChicken can store tailMarkers and throwMarkers in its log, specifically in
+        the callee field of a log packet.  However, ShadowChicken::visitChildren()
+        unconditionally visits the callee field of each packet as if they are real
+        objects.  If visitChildren() encounters one of these markers in the log, we get a
+        crash.
+
+        This crash was observed in the v8-v6/v8-regexp.js stress test running with shadow
+        chicken when r199393 landed.  r199393 introduced tail calls to a RegExp split
+        fast path, and the v8-regexp.js test exercised this fast path a lot.  Throw in
+        some timely GCs, and we get a crash party.
+
+        The fix is to have ShadowChicken::visitChildren() filter out the tailMarker and
+        throwMarker.
+
+        Alternatively, if perf is an issue, we can allocate 2 dedicated objects for
+        these markers so that ShadowChicken can continue to visit them.  For now, I'm
+        going with the filter.
+
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::visitChildren):
+
+2016-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Add @@toStringTag to GeneratorFunction
+        https://bugs.webkit.org/show_bug.cgi?id=156499
+
+        Reviewed by Mark Lam.
+
+        GeneratorFunction.prototype has @@toStringTag property, "GeneratorFunction".
+        https://tc39.github.io/ecma262/#sec-generatorfunction.prototype-@@tostringtag
+
+        * runtime/GeneratorFunctionPrototype.cpp:
+        (JSC::GeneratorFunctionPrototype::finishCreation):
+        * tests/es6.yaml:
+        * tests/es6/well-known_symbols_Symbol.toStringTag_new_built-ins.js: Added.
+        (test):
+
+2016-04-13  Alberto Garcia  <berto@igalia.com>
+
+        Fix build in glibc-based BSD systems
+        https://bugs.webkit.org/show_bug.cgi?id=156533
+
+        Reviewed by Carlos Garcia Campos.
+
+        Change the order of the #elif conditionals so glibc-based BSD
+        systems (e.g. Debian GNU/kFreeBSD) use the code inside the
+        OS(FREEBSD) blocks.
+
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::Thread::Registers::stackPointer):
+        (JSC::MachineThreads::Thread::Registers::framePointer):
+        (JSC::MachineThreads::Thread::Registers::instructionPointer):
+        (JSC::MachineThreads::Thread::Registers::llintPC):
+
+2016-04-12  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed undo change from ArrayClass to ArrayWithUndecided, which
+        was not intedend to land with r199397.
+
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+
+2016-04-12  Mark Lam  <mark.lam@apple.com>
+
+        Rollout: ES6: Implement String.prototype.split and RegExp.prototype[@@split].
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+
+        Speculative rollout to fix 32-bit shadow-chicken.yaml/tests/v8-v6/v8-regexp.js.shadow-chicken test failure.
+
+        Not reviewed.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/GlobalObject.js:
+        (speciesGetter):
+        (speciesConstructor): Deleted.
+        * builtins/PromisePrototype.js:
+        * builtins/RegExpPrototype.js:
+        (advanceStringIndexUnicode):
+        (match):
+        (advanceStringIndex): Deleted.
+        (regExpExec): Deleted.
+        (hasObservableSideEffectsForRegExpSplit): Deleted.
+        (split): Deleted.
+        * builtins/StringPrototype.js:
+        (repeat):
+        (split): Deleted.
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp: Removed.
+        * runtime/ECMAScriptSpecInternalFunctions.h: Removed.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setGlobalThis):
+        (JSC::JSGlobalObject::init):
+        (JSC::getGetterById): Deleted.
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::offsetOfLastIndexIsWritable):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncSearch):
+        (JSC::advanceStringIndex): Deleted.
+        (JSC::regExpProtoFuncSplitFast): Deleted.
+        * runtime/RegExpPrototype.h:
+        * runtime/StringObject.h:
+        (JSC::jsStringWithReuse): Deleted.
+        (JSC::jsSubstring): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::jsStringWithReuse):
+        (JSC::jsSubstring):
+        (JSC::substituteBackreferencesSlow):
+        (JSC::splitStringByOneCharacterImpl):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::stringProtoFuncIterator):
+        (JSC::stringProtoFuncSplitFast): Deleted.
+        (JSC::builtinStringSubstrInternal): Deleted.
+        (JSC::stringIncludesImpl): Deleted.
+        (JSC::builtinStringIncludesInternal): Deleted.
+        * runtime/StringPrototype.h:
+        * tests/es6.yaml:
+
+2016-04-12  Mark Lam  <mark.lam@apple.com>
+
+        Remove 2 unused JSC options.
+        https://bugs.webkit.org/show_bug.cgi?id=156526
+
+        Reviewed by Benjamin Poulain.
+
+        The options JSC_assertICSizing and JSC_dumpFailedICSizing are no longer in use
+        now that we have B3.
+
+        * runtime/Options.h:
+
+2016-04-12  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add support for Symbol.isConcatSpreadable.
+        https://bugs.webkit.org/show_bug.cgi?id=155351
+
+        Reviewed by Saam Barati.
+
+        This patch adds support for Symbol.isConcatSpreadable. In order to do so it was necessary to move the
+        Array.prototype.concat function to JS. A number of different optimizations were needed to make such the move to
+        a builtin performant. First, four new DFG intrinsics were added.
+
+        1) IsArrayObject (I would have called it IsArray but we use the same name for an IndexingType): an intrinsic of
+           the Array.isArray function.
+        2) IsJSArray: checks the first child is a JSArray object.
+        3) IsArrayConstructor: checks the first child is an instance of ArrayConstructor.
+        4) CallObjectConstructor: an intrinsic of the Object constructor.
+
+        IsActualObject, IsJSArray, and CallObjectConstructor can all be converted into constants in the abstract interpreter if
+        we are able to prove that the first child is an Array or for ToObject an Object.
+
+        In order to further improve the perfomance we also now cover more indexing types in our fast path memcpy
+        code. Before we would only memcpy Arrays if they had the same indexing type and did not have Array storage and
+        were not undecided. Now the memcpy code covers the following additional two cases: One array is undecided and
+        the other is a non-array storage and the case where one array is Int32 and the other is contiguous (we map this
+        into a contiguous array).
+
+        This patch also adds a new fast path for concat with more than one array argument by using memcpy to append
+        values onto the result array. This works roughly the same as the two array fast path using the same methodology
+        to decide if we can memcpy the other butterfly into the result butterfly.
+
+        Two new debugging tools are also added to the jsc cli. One is a version of the print function with a private
+        name so it can be used for debugging builtins. The other is dumpDataLog, which takes a JSValue and runs our
+        dataLog function on it.
+
+        Finally, this patch add a new constructor to JSValueRegsTemporary that allows it to reuse the the registers of a
+        JSValueOperand if the operand's use count is one.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ArrayPrototype.js:
+        (concatSlowPath):
+        (concat):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileIsJSArray):
+        (JSC::DFG::SpeculativeJIT::compileIsArrayObject):
+        (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor):
+        (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::isArray):
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDataLogValue):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        (JSC::isArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoPrivateFuncIsJSArray):
+        (JSC::moveElements):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        (JSC::arrayProtoPrivateFuncAppendMemcpy):
+        (JSC::arrayProtoFuncConcat): Deleted.
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::fastConcatWith): Deleted.
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::JSArray::fastConcatType): Deleted.
+        * runtime/JSArrayInlines.h: Added.
+        (JSC::JSArray::memCopyWithIndexingType):
+        (JSC::JSArray::canFastCopy):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSType.h:
+        * runtime/ObjectConstructor.h:
+        (JSC::constructObject):
+        * tests/es6.yaml:
+        * tests/stress/array-concat-spread-object.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-spread-proxy-exception-check.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-spread-proxy.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-with-slow-indexingtypes.js: Added.
+        (arrayEq):
+        * tests/stress/array-species-config-array-constructor.js:
+
+2016-04-12  Saam barati  <sbarati@apple.com>
+
+        Lets not iterate over the constant pool twice every time we link a code block
+        https://bugs.webkit.org/show_bug.cgi?id=156517
+
+        Reviewed by Mark Lam.
+
+        I introduced a second iteration over the constant pool when I implemented
+        block scoping. I did this because we must clone all the symbol tables when
+        we link a CodeBlock. We can just do this cloning when setting the constant
+        registers for the first time. There is no need to iterate over the constant
+        pool a second time.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::setConstantRegisters):
+        (JSC::CodeBlock::setAlternative):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::replaceConstant):
+        (JSC::CodeBlock::setConstantRegisters): Deleted.
+
+2016-04-12  Mark Lam  <mark.lam@apple.com>
+
+        ES6: Implement String.prototype.split and RegExp.prototype[@@split].
+        https://bugs.webkit.org/show_bug.cgi?id=156013
+
+        Reviewed by Keith Miller.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/GlobalObject.js:
+        (speciesConstructor):
+        * builtins/PromisePrototype.js:
+        - refactored to use the @speciesConstructor internal function.
+
+        * builtins/RegExpPrototype.js:
+        (advanceStringIndex):
+        - refactored from @advanceStringIndexUnicode() to be match the spec.
+          Benchmarks show that there's no advantage in doing the unicode check outside
+          of the advanceStringIndexUnicode part.  So, I simplified the code to match the
+          spec (especially since @@split needs to call advanceStringIndex from more than
+          1 location).
+        (match):
+        - Removed an unnecessary call to @Object because it was already proven above.
+        - Changed to use advanceStringIndex instead of advanceStringIndexUnicode.
+          Again, there's no perf regression for this.
+        (regExpExec):
+        (hasObservableSideEffectsForRegExpSplit):
+        (split):
+        (advanceStringIndexUnicode): Deleted.
+
+        * builtins/StringPrototype.js:
+        (split):
+        - Modified to use RegExp.prototype[@@split].
+
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        - Added the @@split symbol.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ECMAScriptSpecInternalFunctions.cpp: Added.
+        (JSC::esSpecIsConstructor):
+        (JSC::esSpecIsRegExp):
+        * runtime/ECMAScriptSpecInternalFunctions.h: Added.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::getGetterById):
+        (JSC::JSGlobalObject::init):
+
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        - Removed an assert that is no longer valid.
+
+        * runtime/RegExpObject.h:
+        - Made advanceStringUnicode() public so that it can be re-used by the regexp split
+          fast path.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncSearch):
+        (JSC::advanceStringIndex):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/RegExpPrototype.h:
+
+        * runtime/StringObject.h:
+        (JSC::jsStringWithReuse):
+        (JSC::jsSubstring):
+        - Hoisted some utility functions from StringPrototype.cpp so that they can be
+          reused by the regexp split fast path.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncSplitFast):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::builtinStringSubstrInternal):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringIncludesImpl):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::builtinStringIncludesInternal):
+        (JSC::jsStringWithReuse): Deleted.
+        (JSC::jsSubstring): Deleted.
+        (JSC::stringProtoFuncSplit): Deleted.
+        * runtime/StringPrototype.h:
+
+        * tests/es6.yaml:
+
+2016-04-12  Keith Miller  <keith_miller@apple.com>
+
+        AbstractValue should use the result type to filter structures
+        https://bugs.webkit.org/show_bug.cgi?id=156516
+
+        Reviewed by Geoffrey Garen.
+
+        When filtering an AbstractValue with a SpeculatedType we would not use the merged type when
+        filtering out the valid structures (despite what the comment directly above said). This
+        would cause us to crash if our structure-set was Top and the two speculated types were
+        different kinds of cells.
+
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::filter):
+        * tests/stress/ai-consistency-filter-cells.js: Added.
+        (get value):
+        (attribute.value.get record):
+        (attribute.attrs.get this):
+        (get foo):
+        (let.thisValue.return.serialize):
+        (let.thisValue.transformFor):
+
+2016-04-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, remove FIXME for https://bugs.webkit.org/show_bug.cgi?id=156457 and replace it
+        with a comment that describes what we do now.
+
+        * bytecode/PolymorphicAccess.h:
+
+2016-04-12  Saam barati  <sbarati@apple.com>
+
+        isLocked() assertion broke builds because ConcurrentJITLock isn't always a real lock.
+
+        Rubber-stamped by Filip Pizlo.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resultProfileForBytecodeOffset):
+        (JSC::CodeBlock::ensureResultProfile):
+
+2016-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        PolymorphicAccess should buffer AccessCases before regenerating
+        https://bugs.webkit.org/show_bug.cgi?id=156457
+
+        Reviewed by Benjamin Poulain.
+
+        Prior to this change, whenever we added an AccessCase to a PolymorphicAccess, we would
+        regenerate the whole stub. That meant that we'd do O(N^2) work for N access cases.
+
+        One way to fix this is to have each AccessCase generate a stub just for itself, which
+        cascades down to the already-generated cases. But that removes the binary switch
+        optimization, which makes the IC perform great even when there are many cases.
+
+        This change fixes the issue by buffering access cases. When we take slow path and try to add
+        a new case, the StructureStubInfo will usually just buffer the new case without generating
+        new code. We simply guarantee that after we buffer a case, we will take at most
+        Options::repatchBufferingCountdown() slow path calls before generating code for it. That
+        option is currently 7. Taking 7 more slow paths means that we have 7 more opportunities to
+        gather more access cases, or to realize that this IC is too crazy to bother with.
+
+        This change ensures that the DFG still gets the same kind of profiling. This is because the
+        buffered AccessCases are still part of PolymorphicAccess and so are still scanned by
+        GetByIdStatus and PutByIdStatus. The fact that the AccessCases hadn't been generated and so
+        hadn't executed doesn't change much. Mainly, it increases the likelihood that the DFG will
+        see an access case that !couldStillSucceed(). The DFG's existing profile parsing logic can
+        handle this just fine.
+        
+        There are a bunch of algorithmic changes here. StructureStubInfo now caches the set of
+        structures that it has seen as a guard to prevent adding lots of redundant cases, in case
+        we see the same 7 cases after buffering the first one. This cache means we won't wastefully
+        allocate 7 identical AccessCase instances. PolymorphicAccess is now restructured around
+        having separate addCase() and regenerate() calls. That means a bit more moving data around.
+        So far that seems OK for performance, probably since it's O(N) work rather than O(N^2) work.
+        There is room for improvement for future patches, to be sure.
+        
+        This is benchmarking as slightly positive or neutral on JS benchmarks. It's meant to reduce
+        pathologies I saw in page loads.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::PolymorphicAccess::PolymorphicAccess):
+        (JSC::PolymorphicAccess::~PolymorphicAccess):
+        (JSC::PolymorphicAccess::addCases):
+        (JSC::PolymorphicAccess::addCase):
+        (JSC::PolymorphicAccess::visitWeak):
+        (JSC::PolymorphicAccess::dump):
+        (JSC::PolymorphicAccess::commit):
+        (JSC::PolymorphicAccess::regenerate):
+        (JSC::PolymorphicAccess::aboutToDie):
+        (WTF::printInternal):
+        (JSC::PolymorphicAccess::regenerateWithCases): Deleted.
+        (JSC::PolymorphicAccess::regenerateWithCase): Deleted.
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::isGetter):
+        (JSC::AccessCase::callLinkInfo):
+        (JSC::AccessGenerationResult::AccessGenerationResult):
+        (JSC::AccessGenerationResult::madeNoChanges):
+        (JSC::AccessGenerationResult::gaveUp):
+        (JSC::AccessGenerationResult::buffered):
+        (JSC::AccessGenerationResult::generatedNewCode):
+        (JSC::AccessGenerationResult::generatedFinalCode):
+        (JSC::AccessGenerationResult::shouldGiveUpNow):
+        (JSC::AccessGenerationResult::generatedSomeCode):
+        (JSC::PolymorphicAccess::isEmpty):
+        (JSC::PolymorphicAccess::size):
+        (JSC::PolymorphicAccess::at):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::addAccessCase):
+        (JSC::StructureStubInfo::reset):
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::considerCaching):
+        (JSC::StructureStubInfo::willRepatch): Deleted.
+        (JSC::StructureStubInfo::willCoolDown): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::repatchPutByID):
+        (JSC::tryRepatchIn):
+        (JSC::repatchIn):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::putByIndex):
+        (JSC::JSValue::structureOrNull):
+        (JSC::JSValue::structureOrUndefined):
+        * runtime/Options.h:
+
+2016-04-12  Saam barati  <sbarati@apple.com>
+
+        There is a race with the compiler thread and the main thread with result profiles
+        https://bugs.webkit.org/show_bug.cgi?id=156503
+
+        Reviewed by Filip Pizlo.
+
+        The compiler thread should not be asking for a result
+        profile while the execution thread is creating one.
+        We must guard against such races with a lock.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resultProfileForBytecodeOffset):
+        (JSC::CodeBlock::ensureResultProfile):
+        (JSC::CodeBlock::capabilityLevel):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::numberOfResultProfiles):
+        (JSC::CodeBlock::specialFastCaseProfileCountForBytecodeOffset):
+        (JSC::CodeBlock::ensureResultProfile): Deleted.
+
+2016-04-12  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199339.
+        https://bugs.webkit.org/show_bug.cgi?id=156505
+
+        memset_s is indeed necessary (Requested by alexchristensen_ on
+        #webkit).
+
+        Reverted changeset:
+
+        "Build fix after r199299."
+        https://bugs.webkit.org/show_bug.cgi?id=155508
+        http://trac.webkit.org/changeset/199339
+
+2016-04-12  Guillaume Emont  <guijemont@igalia.com>
+
+        MIPS: add MacroAssemblerMIPS::store8(TrustedImm32,ImplicitAddress)
+        https://bugs.webkit.org/show_bug.cgi?id=156481
+
+        This method with this signature is used by r199075, and therefore
+        WebKit doesn't build on MIPS since then.
+
+        Reviewed by Mark Lam.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::store8):
+
+2016-04-12  Saam barati  <sbarati@apple.com>
+
+        We incorrectly parse arrow function expressions
+        https://bugs.webkit.org/show_bug.cgi?id=156373
+
+        Reviewed by Mark Lam.
+
+        This patch removes the notion of "isEndOfArrowFunction".
+        This was a very weird function and it was incorrect.
+        It checked that the arrow functions with concise body
+        grammar production "had a valid ending". "had a valid
+        ending" is in quotes because concise body arrow functions
+        have a valid ending as long as their body has a valid
+        assignment expression. I've removed all notion of this
+        function because it was wrong and was causing us
+        to throw syntax errors on valid programs.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::nextTokenIsColon):
+        (JSC::Lexer<T>::lex):
+        (JSC::Lexer<T>::setTokenPosition): Deleted.
+        * parser/Lexer.h:
+        (JSC::Lexer::setIsReparsingFunction):
+        (JSC::Lexer::isReparsingFunction):
+        (JSC::Lexer::lineNumber):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Parser::matchIdentifierOrKeyword):
+        (JSC::Parser::tokenStart):
+        (JSC::Parser::autoSemiColon):
+        (JSC::Parser::canRecurse):
+        (JSC::Parser::isEndOfArrowFunction): Deleted.
+        (JSC::Parser::setEndOfStatement): Deleted.
+        * tests/stress/arrowfunction-others.js:
+        (testCase):
+        (simpleArrowFunction):
+        (truthy):
+        (falsey):
+
+2016-04-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] addStaticGlobals should emit SymbolTableEntry watchpoints to encourage constant folding in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=155110
+
+        Reviewed by Saam Barati.
+
+        `addStaticGlobals` does not emit SymbolTableEntry watchpoints for the added entries.
+        So, all the global variable lookups pointing to these static globals are not converted
+        into constants in DFGBytecodeGenerator: this fact leaves these lookups as GetGlobalVar.
+        Such thing avoids constant folding chance and emits CheckCell for @privateFunction inlining.
+        This operation is pure overhead.
+
+        Static globals are not configurable, and they are typically non-writable.
+        So they are constants in almost all the cases.
+
+        This patch initializes watchpoints for these static globals.
+        These watchpoints allow DFG to convert these nodes into constants in DFG BytecodeParser.
+        These watchpoints includes many builtin operations and `undefined`.
+
+        The microbenchmark, many-foreach-calls shows 5 - 7% improvement since it removes unnecessary CheckCell.
+
+        * bytecode/VariableWriteFireDetail.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::addGlobalVar):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePutTouchWatchpointSet):
+        (JSC::symbolTablePutInvalidateWatchpointSet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributesTouchWatchpointSet): Deleted.
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTableEntry::SymbolTableEntry):
+        (JSC::SymbolTableEntry::operator=):
+        (JSC::SymbolTableEntry::swap):
+
+2016-04-12  Alex Christensen  <achristensen@webkit.org>
+
+        Build fix after r199299.
+        https://bugs.webkit.org/show_bug.cgi?id=155508
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
+        memset_s is not defined.  __STDC_WANT_LIB_EXT1__ is not defined anywhere.
+        Since the return value is unused and set_constraint_handler_s is never called
+        I'm chaning it to memset.
+
+2016-04-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] B3 can use undefined bits or not defined required bits when spilling
+        https://bugs.webkit.org/show_bug.cgi?id=156486
+
+        Reviewed by Filip Pizlo.
+
+        Spilling had issues when replacing arguments in place.
+
+        The problems are:
+        1) If we have a 32bit stackslot, a x86 instruction could still try to load 64bits from it.
+        2) If we have a 64bit stackslot, Move32 would only set half the bits.
+        3) We were reducing Move to Move32 even if the top bits are read from the stack slot.
+
+        The case 1 appear with something like this:
+            Move32 %tmp0, %tmp1
+            Op64 %tmp1, %tmp2, %tmp3
+        When we spill %tmp1, the stack slot is 32bit, Move32 sets 32bits
+        but Op64 supports addressing for %tmp1. When we substitute %tmp1 in Op64,
+        we are creating a 64bit read for a 32bit stack slot.
+
+        The case 2 is an other common one. If we have:
+            BB#1
+                Move32 %tmp0, %tmp1
+                Jump #3
+            BB#2
+                Op64 %tmp0, %tmp1
+                Jump #3
+            BB#3
+                Use64 %tmp1
+
+        We have a stack slot of 64bits. When spilling %tmp1 in #1, we are
+        effectively doing a 32bit store on the stack slot, leaving the top bits undefined.
+
+        Case 3 is pretty much the same as 2 but we create the Move32 ourself
+        because the source is a 32bit with ZDef.
+
+        Case (1) is solved by requiring that the stack slot is at least as large as the largest
+        use/def of that tmp.
+
+        Case (2) and (3) are solved by not replacing a Tmp by an Address if the Def
+        is smaller than the stack slot.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/testb3.cpp:
+        (JSC::B3::testSpillDefSmallerThanUse):
+        (JSC::B3::testSpillUseLargerThanDef):
+        (JSC::B3::run):
+
+2016-04-11  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: get rid of InspectorBasicValue and InspectorString subclasses
+        https://bugs.webkit.org/show_bug.cgi?id=156407
+        <rdar://problem/25627659>
+
+        Reviewed by Joseph Pecoraro.
+
+        There's no point having these subclasses as they don't save any space.
+        Add a StringImpl to the union and merge some implementations of writeJSON.
+
+        Rename m_data to m_map and explicitly name the union as InspectorValue::m_value.
+        If the value is a string and the string is not empty or null (i.e., it has a
+        StringImpl), then we need to ref() and deref() the string as the InspectorValue
+        is created or destroyed.
+
+        Move uses of the subclass to InspectorValue and delete redundant methods.
+        Now, most InspectorValue methods are non-virtual so they can be templated.
+
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::makeCall):
+        Don't used deleted subclasses.
+
+        * inspector/InspectorValues.cpp:
+        (Inspector::InspectorValue::null):
+        (Inspector::InspectorValue::create):
+        (Inspector::InspectorValue::asValue):
+        (Inspector::InspectorValue::asBoolean):
+        (Inspector::InspectorValue::asDouble):
+        (Inspector::InspectorValue::asInteger):
+        (Inspector::InspectorValue::asString):
+        These only need one implementation now.
+
+        (Inspector::InspectorValue::writeJSON):
+        Still a virtual method since Object and Array need their members.
+
+        (Inspector::InspectorObjectBase::InspectorObjectBase):
+        (Inspector::InspectorBasicValue::asBoolean): Deleted.
+        (Inspector::InspectorBasicValue::asDouble): Deleted.
+        (Inspector::InspectorBasicValue::asInteger): Deleted.
+        (Inspector::InspectorBasicValue::writeJSON): Deleted.
+        (Inspector::InspectorString::asString): Deleted.
+        (Inspector::InspectorString::writeJSON): Deleted.
+        (Inspector::InspectorString::create): Deleted.
+        (Inspector::InspectorBasicValue::create): Deleted.
+
+        * inspector/InspectorValues.h:
+        (Inspector::InspectorObjectBase::find):
+        (Inspector::InspectorObjectBase::setBoolean):
+        (Inspector::InspectorObjectBase::setInteger):
+        (Inspector::InspectorObjectBase::setDouble):
+        (Inspector::InspectorObjectBase::setString):
+        (Inspector::InspectorObjectBase::setValue):
+        (Inspector::InspectorObjectBase::setObject):
+        (Inspector::InspectorObjectBase::setArray):
+        (Inspector::InspectorArrayBase::pushBoolean):
+        (Inspector::InspectorArrayBase::pushInteger):
+        (Inspector::InspectorArrayBase::pushDouble):
+        (Inspector::InspectorArrayBase::pushString):
+        (Inspector::InspectorArrayBase::pushValue):
+        (Inspector::InspectorArrayBase::pushObject):
+        (Inspector::InspectorArrayBase::pushArray):
+        Use new factory methods.
+
+        * replay/EncodedValue.cpp:
+        (JSC::ScalarEncodingTraits<bool>::encodeValue):
+        (JSC::ScalarEncodingTraits<double>::encodeValue):
+        (JSC::ScalarEncodingTraits<float>::encodeValue):
+        (JSC::ScalarEncodingTraits<int32_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<int64_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<uint32_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<uint64_t>::encodeValue):
+        * replay/EncodedValue.h:
+        Use new factory methods.
+
+2016-04-11  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to edit StructureStubInfo without recompiling the world
+        https://bugs.webkit.org/show_bug.cgi?id=156470
+
+        Reviewed by Keith Miller.
+
+        This change makes it less painful to make changes to the IC code. It used to be that any
+        change to StructureStubInfo caused every JIT-related file to get recompiled. Now only a
+        smaller set of files - ones that actually peek into StructureStubInfo - will recompile. This
+        is mainly because CodeBlock.h no longer includes StructureStubInfo.h.
+
+        * bytecode/ByValInfo.h:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        * bytecode/GetByIdStatus.h:
+        * bytecode/PutByIdStatus.cpp:
+        * bytecode/PutByIdStatus.h:
+        * bytecode/StructureStubInfo.h:
+        (JSC::getStructureStubInfoCodeOrigin):
+        * dfg/DFGByteCodeParser.cpp:
+        * dfg/DFGJITCompiler.cpp:
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLLowerDFGToB3.cpp:
+        * ftl/FTLSlowPathCall.h:
+        * jit/IntrinsicEmitter.cpp:
+        * jit/JITInlineCacheGenerator.cpp:
+        * jit/JITInlineCacheGenerator.h:
+        * jit/JITOperations.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+
+2016-04-11  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        Remove NewArrowFunction from DFG IR
+        https://bugs.webkit.org/show_bug.cgi?id=156439
+
+        Reviewed by Saam Barati.
+
+        It seems that NewArrowFunction was left in DFG IR during refactoring by mistake.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp:
+        * dfg/DFGDoesGC.cpp:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGMayExit.cpp:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomNewFunction):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        * ftl/FTLCapabilities.cpp:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
+
+2016-04-05  Oliver Hunt  <oliver@apple.com>
+
+        Remove compile time define for SEPARATED_HEAP
+        https://bugs.webkit.org/show_bug.cgi?id=155508
+
+        Reviewed by Mark Lam.
+
+        Remove the SEPARATED_HEAP compile time flag. The separated
+        heap is available, but off by default, on x86_64, ARMv7, and
+        ARM64.
+
+        Working through the issues that happened last time essentially
+        required implementing the ARMv7 path for the separated heap
+        just so I could find all the ways it was going wrong.
+
+        We fixed all the logic by making the branch and jump logic in
+        the linker and assemblers take two parameters, the location to
+        write to, and the location we'll actually be writing to. We 
+        need to do this because it's no longer sufficient to compute
+        jumps relative to region the linker is writing to.
+
+        The repatching jump, branch, and call functions only need the
+        executable address as the patching is performed directly using
+        performJITMemcpy function which works in terms of the executable
+        address.
+
+        There is no performance impact on jsc-benchmarks with the separate
+        heap either emabled or disabled.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::linkJump):
+        (JSC::ARM64Assembler::linkCall):
+        (JSC::ARM64Assembler::relinkJump):
+        (JSC::ARM64Assembler::relinkCall):
+        (JSC::ARM64Assembler::link):
+        (JSC::ARM64Assembler::linkJumpOrCall):
+        (JSC::ARM64Assembler::linkCompareAndBranch):
+        (JSC::ARM64Assembler::linkConditionalBranch):
+        (JSC::ARM64Assembler::linkTestAndBranch):
+        (JSC::ARM64Assembler::relinkJumpOrCall):
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::revertJumpTo_movT3movtcmpT2):
+        (JSC::ARMv7Assembler::revertJumpTo_movT3):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::linkJump):
+        (JSC::ARMv7Assembler::relinkJump):
+        (JSC::ARMv7Assembler::repatchCompact):
+        (JSC::ARMv7Assembler::replaceWithJump):
+        (JSC::ARMv7Assembler::replaceWithLoad):
+        (JSC::ARMv7Assembler::replaceWithAddressComputation):
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::setUInt7ForLoad):
+        (JSC::ARMv7Assembler::isB):
+        (JSC::ARMv7Assembler::isBX):
+        (JSC::ARMv7Assembler::isMOV_imm_T3):
+        (JSC::ARMv7Assembler::isMOVT):
+        (JSC::ARMv7Assembler::isNOP_T1):
+        (JSC::ARMv7Assembler::isNOP_T2):
+        (JSC::ARMv7Assembler::linkJumpT1):
+        (JSC::ARMv7Assembler::linkJumpT2):
+        (JSC::ARMv7Assembler::linkJumpT3):
+        (JSC::ARMv7Assembler::linkJumpT4):
+        (JSC::ARMv7Assembler::linkConditionalJumpT4):
+        (JSC::ARMv7Assembler::linkBX):
+        (JSC::ARMv7Assembler::linkConditionalBX):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::link):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::link):
+        * jit/ExecutableAllocator.h:
+        (JSC::performJITMemcpy):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
+        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
+        (JSC::FixedVMPoolExecutableAllocator::genericWriteToJITRegion):
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): Deleted.
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2016-04-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Clean up how we reason about the states of AccessCases
+        https://bugs.webkit.org/show_bug.cgi?id=156454
+
+        Reviewed by Mark Lam.
+        
+        Currently when we add an AccessCase to a PolymorphicAccess stub, we regenerate the stub.
+        That means that as we grow a stub to have N cases, we will do O(N^2) generation work. I want
+        to explore buffering AccessCases so that we can do O(N) generation work instead. But to
+        before I go there, I want to make sure that the statefulness of AccessCase makes sense. So,
+        I broke it down into three different states and added assertions about the transitions. I
+        also broke out a separate operation called AccessCase::commit(), which is the work that
+        cannot be buffered since there cannot be any JS effects between when the AccessCase was
+        created and when we do the work in commit().
+        
+        This opens up a fairly obvious path to buffering AccessCases: add them to the list without
+        regenerating. Then when we do eventually trigger regeneration, those cases will get cloned
+        and generated automagically. This patch doesn't implement this technique yet, but gives us
+        an opportunity to independently test the scaffolding necessary to do it.
+
+        This is perf-neutral on lots of tests.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationResult::dump):
+        (JSC::AccessCase::clone):
+        (JSC::AccessCase::commit):
+        (JSC::AccessCase::guardedByStructureCheck):
+        (JSC::AccessCase::dump):
+        (JSC::AccessCase::generateWithGuard):
+        (JSC::AccessCase::generate):
+        (JSC::AccessCase::generateImpl):
+        (JSC::PolymorphicAccess::regenerateWithCases):
+        (JSC::PolymorphicAccess::regenerate):
+        (WTF::printInternal):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::type):
+        (JSC::AccessCase::state):
+        (JSC::AccessCase::offset):
+        (JSC::AccessCase::viaProxy):
+        (JSC::AccessCase::callLinkInfo):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::addAccessCase):
+        * bytecode/Watchpoint.h:
+        * dfg/DFGOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::repatchGetByID):
+        (JSC::repatchPutByID):
+        (JSC::repatchIn):
+        * runtime/VM.cpp:
+        (JSC::VM::dumpRegExpTrace):
+        (JSC::VM::ensureWatchpointSetForImpureProperty):
+        (JSC::VM::registerWatchpointForImpureProperty):
+        (JSC::VM::addImpureProperty):
+        * runtime/VM.h:
+
+2016-04-11  Fujii Hironori  <Hironori.Fujii@jp.sony.com>
+
+        [CMake] Make FOLDER property INHERITED
+        https://bugs.webkit.org/show_bug.cgi?id=156460
+
+        Reviewed by Brent Fulgham.
+
+        * CMakeLists.txt:
+        * shell/CMakeLists.txt:
+        * shell/PlatformWin.cmake:
+        Set FOLDER property as a directory property not a target property
+
+2016-04-09  Keith Miller  <keith_miller@apple.com>
+
+        tryGetById should be supported by the DFG/FTL
+        https://bugs.webkit.org/show_bug.cgi?id=156378
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds support for tryGetById in the DFG/FTL. It adds a new DFG node
+        TryGetById, which acts similarly to the normal GetById DFG node. One key
+        difference between GetById and TryGetById is that in the LLInt and Baseline
+        we do not profile the result type. This profiling is unnessary for the current
+        use case of tryGetById, which is expected to be a strict equality comparision
+        against a specific object or undefined. In either case other DFG optimizations
+        will make this equally fast with or without the profiling information.
+
+        Additionally, this patch adds new reuse modes for JSValueRegsTemporary that take
+        an operand and attempt to reuse the registers for that operand if they are free
+        after the current DFG node.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIdentifier):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileTryGetById):
+        (JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::GPRTemporary::operator=):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * tests/stress/try-get-by-id.js:
+        (tryGetByIdTextStrict):
+        (get let):
+        (let.get createBuiltin):
+        (get throw):
+        (getCaller.obj.1.throw.new.Error): Deleted.
+
+2016-04-09  Saam barati  <sbarati@apple.com>
+
+        Allocation sinking SSA Defs are allowed to have replacements
+        https://bugs.webkit.org/show_bug.cgi?id=156444
+
+        Reviewed by Filip Pizlo.
+
+        Consider the following program and the annotations that explain why
+        the SSA defs we create in allocation sinking can have replacements.
+
+        function foo(a1) {
+            let o1 = {x: 20, y: 50};
+            let o2 = {y: 40, o1: o1};
+            let o3 = {};
+        
+            // We're Defing a new variable here, call it o3_field.
+            // o3_field is defing the value that is the result of 
+            // a GetByOffset that gets eliminated through allocation sinking.
+            o3.field = o1.y;
+        
+            dontCSE();
+        
+            // This control flow is here to not allow the phase to consult
+            // its local SSA mapping (which properly handles replacements)
+            // for the value of o3_field.
+            if (a1) {
+                a1 = true; 
+            } else {
+                a1 = false;
+            }
+        
+            // Here, we ask for the reaching def of o3_field, and assert
+            // it doesn't have a replacement. It does have a replacement
+            // though. The original Def was the GetByOffset. We replaced
+            // that GetByOffset with the value of the o1_y variable.
+            let value = o3.field;
+            assert(value === 50);
+        }
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * tests/stress/allocation-sinking-defs-may-have-replacements.js: Added.
+        (dontCSE):
+        (assert):
+        (foo):
+
+2016-04-09  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199242.
+        https://bugs.webkit.org/show_bug.cgi?id=156442
+
+        Caused many many leaks (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: get rid of InspectorBasicValue and
+        InspectorString subclasses"
+        https://bugs.webkit.org/show_bug.cgi?id=156407
+        http://trac.webkit.org/changeset/199242
+
+2016-04-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Debug JSC test failure: stress/multi-put-by-offset-reallocation-butterfly-cse.js.ftl-no-cjit-small-pool
+        https://bugs.webkit.org/show_bug.cgi?id=156406
+
+        Reviewed by Saam Barati.
+
+        The failure was because the GC ran from within the butterfly allocation call in a put_by_id
+        transition AccessCase that had to deal with indexing storage. When the GC runs in a call from a stub,
+        then we need to be extra careful:
+
+        1) The GC may reset the IC and delete the stub. So, the stub needs to tell the GC that it might be on
+           the stack during GC, so that the GC keeps it alive if it's currently running.
+        
+        2) If the stub uses (dereferences or stores) some object after the call, then we need to ensure that
+           the stub routine knows about that object independently of the IC.
+        
+        In the case of put_by_id transitions that use a helper to allocate the butterfly, we have both
+        issues. A long time ago, we had to deal with (2), and we still had code to handle that case, although
+        it appears to be dead. This change revives that code and glues it together with PolymorphicAccess.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::alternateBase):
+        (JSC::AccessCase::doesCalls):
+        (JSC::AccessCase::couldStillSucceed):
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::customSlotBase):
+        (JSC::AccessCase::isGetter):
+        (JSC::AccessCase::doesCalls): Deleted.
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
+        (JSC::MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine):
+        (JSC::MarkingGCAwareJITStubRoutine::~MarkingGCAwareJITStubRoutine):
+        (JSC::MarkingGCAwareJITStubRoutine::markRequiredObjectsInternal):
+        (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler):
+        (JSC::createJITStubRoutine):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject): Deleted.
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject): Deleted.
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal): Deleted.
+        * jit/GCAwareJITStubRoutine.h:
+        (JSC::createJITStubRoutine):
+
+2016-04-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: XHRs and Web Worker scripts are not searchable
+        https://bugs.webkit.org/show_bug.cgi?id=154214
+        <rdar://problem/24643587>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Page.json:
+        Add optional requestId to search results properties and search
+        parameters for when the frameId and url are not enough. XHR
+        resources, and "Other" resources will use this.
+
+2016-04-08  Guillaume Emont  <guijemont@igalia.com>
+
+        MIPS: support Signed cond in branchTest32()
+        https://bugs.webkit.org/show_bug.cgi?id=156260
+
+        This is needed since r197688 makes use of it.
+
+        Reviewed by Mark Lam.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchTest32):
+
+2016-04-08  Alex Christensen  <achristensen@webkit.org>
+
+        Progress towards running CMake WebKit2 on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=156426
+
+        Reviewed by Tim Horton.
+
+        * PlatformMac.cmake:
+
+2016-04-08  Saam barati  <sbarati@apple.com>
+
+        Debugger may dereference m_currentCallFrame even after the VM has gone idle
+        https://bugs.webkit.org/show_bug.cgi?id=156413
+
+        Reviewed by Mark Lam.
+
+        There is a bug where the debugger may dereference its m_currentCallFrame
+        pointer after that pointer becomes invalid to read from. This happens like so:
+
+        We may step over an instruction which causes the end of execution for the
+        current program. This causes the VM to exit. Then, we perform a GC which
+        causes us to collect the global object. The global object being collected
+        causes us to detach the debugger. In detaching, we think we still have a 
+        valid m_currentCallFrame, we dereference it, and crash. The solution is to
+        make sure we're paused when dereferencing this pointer inside ::detach().
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::detach):
+
+2016-04-08  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: get rid of InspectorBasicValue and InspectorString subclasses
+        https://bugs.webkit.org/show_bug.cgi?id=156407
+        <rdar://problem/25627659>
+
+        Reviewed by Timothy Hatcher.
+
+        There's no point having these subclasses as they don't save any space.
+        Add m_stringValue to the union and merge some implementations of writeJSON.
+        Move uses of the subclass to InspectorValue and delete redundant methods.
+        Now, most InspectorValue methods are non-virtual so they can be templated.
+
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::makeCall):
+        Don't used deleted subclasses.
+
+        * inspector/InspectorValues.cpp:
+        (Inspector::InspectorValue::null):
+        (Inspector::InspectorValue::create):
+        (Inspector::InspectorValue::asValue):
+        (Inspector::InspectorValue::asBoolean):
+        (Inspector::InspectorValue::asDouble):
+        (Inspector::InspectorValue::asInteger):
+        (Inspector::InspectorValue::asString):
+        These only need one implementation now.
+
+        (Inspector::InspectorValue::writeJSON):
+        Still a virtual method since Object and Array need their members.
+
+        (Inspector::InspectorObjectBase::InspectorObjectBase):
+        (Inspector::InspectorBasicValue::asBoolean): Deleted.
+        (Inspector::InspectorBasicValue::asDouble): Deleted.
+        (Inspector::InspectorBasicValue::asInteger): Deleted.
+        (Inspector::InspectorBasicValue::writeJSON): Deleted.
+        (Inspector::InspectorString::asString): Deleted.
+        (Inspector::InspectorString::writeJSON): Deleted.
+        (Inspector::InspectorString::create): Deleted.
+        (Inspector::InspectorBasicValue::create): Deleted.
+
+        * inspector/InspectorValues.h:
+        (Inspector::InspectorObjectBase::setBoolean):
+        (Inspector::InspectorObjectBase::setInteger):
+        (Inspector::InspectorObjectBase::setDouble):
+        (Inspector::InspectorObjectBase::setString):
+        (Inspector::InspectorArrayBase::pushBoolean):
+        (Inspector::InspectorArrayBase::pushInteger):
+        (Inspector::InspectorArrayBase::pushDouble):
+        (Inspector::InspectorArrayBase::pushString):
+        Use new factory methods.
+
+        * replay/EncodedValue.cpp:
+        (JSC::ScalarEncodingTraits<bool>::encodeValue):
+        (JSC::ScalarEncodingTraits<double>::encodeValue):
+        (JSC::ScalarEncodingTraits<float>::encodeValue):
+        (JSC::ScalarEncodingTraits<int32_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<int64_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<uint32_t>::encodeValue):
+        (JSC::ScalarEncodingTraits<uint64_t>::encodeValue):
+        * replay/EncodedValue.h:
+        Use new factory methods.
+
+2016-04-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Add IC support for arguments.length
+        https://bugs.webkit.org/show_bug.cgi?id=156389
+
+        Reviewed by Geoffrey Garen.
+        
+        This adds support for caching accesses to arguments.length for both DirectArguments and
+        ScopedArguments. In strict mode, we already cached these accesses since they were just
+        normal properties.
+
+        Amazingly, we also already supported caching of overridden arguments.length in both
+        DirectArguments and ScopedArguments. This is because when you override, the property gets
+        materialized as a normal JS property and the structure is changed.
+        
+        This patch painstakingly preserves our previous caching of overridden length while
+        introducing caching of non-overridden length (i.e. the common case). In fact, we even cache
+        the case where it could either be overridden or not, since we just end up with an AccessCase
+        for each and they cascade to each other.
+
+        This is a >3x speed-up on microbenchmarks that do arguments.length in a polymorphic context.
+        Entirely monomorphic accesses were already handled by the DFG.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
+        (JSC::AccessCase::guardedByStructureCheck):
+        (JSC::AccessCase::generateWithGuard):
+        (JSC::AccessCase::generate):
+        (WTF::printInternal):
+        * bytecode/PolymorphicAccess.h:
+        * jit/ICStats.h:
+        * jit/JITOperations.cpp:
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        * tests/stress/direct-arguments-override-length-then-access-normal-length.js: Added.
+        (args):
+        (foo):
+        (result.foo):
+
+2016-04-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        UInt32ToNumber should have an Int52 path
+        https://bugs.webkit.org/show_bug.cgi?id=125704
+
+        Reviewed by Filip Pizlo.
+
+        When dealing with big numbers, fall back to Int52 instead
+        of double when possible.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileUInt32ToNumber):
+
+2016-04-08  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: protocol generator should emit an error when 'type' is used instead of '$ref'
+        https://bugs.webkit.org/show_bug.cgi?id=156275
+        <rdar://problem/25569331>
+
+        Reviewed by Darin Adler.
+
+        * inspector/protocol/Heap.json: Fix a mistake that's now caught by the protocol generator.
+
+        * inspector/scripts/codegen/models.py:
+        (TypeReference.__init__): Check here if type_kind is on a whitelist of primitive types.
+        (TypeReference.referenced_name): Update comment.
+
+        Add a new test specifically for the case when the type would otherwise be resolved. Rebaseline.
+
+        * inspector/scripts/tests/expected/fail-on-type-reference-as-primitive-type.json-error: Added.
+        * inspector/scripts/tests/expected/fail-on-unknown-type-reference-in-type-declaration.json-error:
+        * inspector/scripts/tests/fail-on-type-reference-as-primitive-type.json: Added.
+
+2016-04-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove ENABLE(ENABLE_ES6_CLASS_SYNTAX) guards
+        https://bugs.webkit.org/show_bug.cgi?id=156384
+
+        Reviewed by Ryosuke Niwa.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * features.json: Mark as Done.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+
+2016-04-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Implementing caching transition puts that need to reallocate with indexing storage
+        https://bugs.webkit.org/show_bug.cgi?id=130914
+
+        Reviewed by Saam Barati.
+
+        This enables the IC's put_by_id path to handle reallocating the out-of-line storage even if
+        the butterfly has indexing storage. Like the DFG, we do this by calling operations that
+        reallocate the butterfly. Those use JSObject API and do all of the nasty work for us, like
+        triggering a barrier.
+
+        This does a bunch of refactoring to how PolymorphicAccess makes calls. It's a lot easier to
+        do it now because the hard work is hidden under AccessGenerationState methods. This means
+        that custom accessors now share logic with put_by_id transitions.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::succeed):
+        (JSC::AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling):
+        (JSC::AccessGenerationState::preserveLiveRegistersToStackForCall):
+        (JSC::AccessGenerationState::originalCallSiteIndex):
+        (JSC::AccessGenerationState::emitExplicitExceptionHandler):
+        (JSC::AccessCase::AccessCase):
+        (JSC::AccessCase::transition):
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessGenerationState::needsToRestoreRegistersIfException):
+        (JSC::AccessGenerationState::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+
+2016-04-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remote Inspector: When disallowing remote inspection on a debuggable, a listing is still sent to debuggers
+        https://bugs.webkit.org/show_bug.cgi?id=156380
+        <rdar://problem/25323727>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::updateTarget):
+        (Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
+        When a target has been updated and it no longer generates a listing,
+        we should remove the old listing as that is now stale and should
+        not be sent. Not generating a listing means this target is no
+        longer allowed to be debugged.
+
+2016-04-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Not necessary to validate webinspectord connection on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=156377
+        <rdar://problem/25612460>
+
+        Reviewed by Simon Fraser.
+
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::handleEvent):
+
+2016-04-07  Keith Miller  <keith_miller@apple.com>
+
+        Rename ArrayMode::supportsLength to supportsSelfLength
+        https://bugs.webkit.org/show_bug.cgi?id=156374
+
+        Reviewed by Filip Pizlo.
+
+        The name supportsLength is confusing because TypedArray have a
+        length function however it is on the prototype and not on the
+        instance. supportsSelfLength makes more sense since we use the
+        function during fixup to tell if we can intrinsic the length
+        property lookup on self accesses.
+
+        * dfg/DFGArrayMode.h:
+        (JSC::DFG::ArrayMode::supportsSelfLength):
+        (JSC::DFG::ArrayMode::supportsLength): Deleted.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):
+
+2016-04-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: ProfileView source links are off by 1 line, worse in pretty printed code
+        https://bugs.webkit.org/show_bug.cgi?id=156371
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/ScriptProfiler.json:
+        Clarify that these locations are 1-based.
+
+2016-04-07  Jon Davis  <jond@apple.com>
+
+        Add Web Animations API to Feature Status Page
+        https://bugs.webkit.org/show_bug.cgi?id=156360
+
+        Reviewed by Timothy Hatcher.
+
+        * features.json:
+
+2016-04-07  Saam barati  <sbarati@apple.com>
+
+        Invalid assertion inside DebuggerScope::getOwnPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=156357
+
+        Reviewed by Keith Miller.
+
+        The Type Profiler might profile JS code that uses DebuggerScope and accesses properties
+        on it. Therefore, it may have a DebuggerScope object in its log. Objects in the log
+        are subject to having their getOwnPropertySlot method called. Therefore, the DebuggerScope
+        might not always be in a valid state when its getOwnPropertySlot method is called.
+        Therefore, the assertion invalid.
+
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::getOwnPropertySlot):
+
+2016-04-07  Saam barati  <sbarati@apple.com>
+
+        Initial implementation of annex b.3.3 behavior was incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=156276
+
+        Reviewed by Keith Miller.
+
+        I almost got annex B.3.3 correct in my first implementation.
+        There is a subtlety here I got wrong. We always create a local binding for
+        a function at the very beginning of execution of a block scope. So we
+        hoist function declarations to their local binding within a given
+        block scope. When we actually evaluate the function declaration statement
+        itself, we must lookup the binding in the current scope, and bind the
+        value to the binding in the "var" scope. We perform the following
+        abstract operations when executing a function declaration statement.
+
+        f = lookupBindingInCurrentScope("func")
+        store(varScope, "func", f)
+
+        I got this wrong by performing the store to the var binding at the beginning
+        of the block scope instead of when we evaluate the function declaration statement.
+        This behavior is observable. For example, a program could change the value
+        of "func" before the actual function declaration statement executes.
+        Consider the following two functions:
+        ```
+        function foo1() {
+            // func === undefined
+            {
+                // typeof func === "function"
+                function func() { } // Executing this statement binds the local "func" binding to the implicit "func" var binding.
+                func = 20 // This sets the local "func" binding to 20.
+            }
+            // typeof func === "function"
+        }
+
+        function foo2() {
+            // func === undefined
+            {
+                // typeof func === "function"
+                func = 20 // This sets the local "func" binding to 20.
+                function func() { } // Executing this statement binds the local "func" binding to the implicit "func" var binding.
+            }
+            // func === 20
+        }
+        ```
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::initializeBlockScopedFunctions):
+        (JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitNodeForLeftHandSide):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FuncDeclNode::emitBytecode):
+        * tests/stress/sloppy-mode-function-hoisting.js:
+        (test.foo):
+        (test):
+        (test.):
+        (test.bar):
+        (test.switch.case.0):
+        (test.capFoo1):
+        (test.switch.capFoo2):
+        (test.outer):
+        (foo):
+
+2016-04-07  Alex Christensen  <achristensen@webkit.org>
+
+        Build fix after r199170
+
+        * CMakeLists.txt:
+
+2016-04-07  Keith Miller  <keith_miller@apple.com>
+
+        We should support the ability to do a non-effectful getById
+        https://bugs.webkit.org/show_bug.cgi?id=156116
+
+        Reviewed by Benjamin Poulain.
+
+        Currently, there is no way in JS to do a non-effectful getById. A non-effectful getById is
+        useful because it enables us to take different code paths based on values that we would
+        otherwise not be able to have knowledge of. This patch adds this new feature called
+        try_get_by_id that will attempt to do as much of a get_by_id as possible without performing
+        an effectful behavior. Thus, try_get_by_id will return the value if the slot is a value, the
+        GetterSetter object if the slot is a normal accessor (not a CustomGetterSetter) and
+        undefined if the slot is unset.  If the slot is proxied or any other cases then the result
+        is null. In theory, if we ever wanted to check for null we could add a sentinal object to
+        the global object that indicates we could not get the result.
+
+        In order to implement this feature we add a new enum GetByIdKind that indicates what to do
+        for accessor properties in PolymorphicAccess. If the GetByIdKind is pure then we treat the
+        get_by_id the same way we would for load and return the value at the appropriate offset.
+        Additionally, in order to make sure the we can properly compare the GetterSetter object
+        with === GetterSetters are now JSObjects. This comes at the cost of eight extra bytes on the
+        GetterSetter object but it vastly simplifies the patch. Additionally, the extra bytes are
+        likely to have little to no impact on memory usage as normal accessors are generally rare.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutableCreator.cpp: Added.
+        (JSC::createBuiltinExecutable):
+        * builtins/BuiltinExecutableCreator.h: Copied from Source/JavaScriptCore/builtins/BuiltinExecutables.h.
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor):
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        (JSC::createBuiltinExecutable):
+        (JSC::BuiltinExecutables::createExecutable):
+        (JSC::createExecutableInternal): Deleted.
+        * builtins/BuiltinExecutables.h:
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::tryGet):
+        (JSC::AccessCase::generate):
+        (WTF::printInternal):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::isGet): Deleted.
+        (JSC::AccessCase::isPut): Deleted.
+        (JSC::AccessCase::isIn): Deleted.
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::reset):
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitTryGetById):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emitSlow_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emitSlow_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess):
+        (JSC::appropriateOptimizingGetByIdFunction):
+        (JSC::appropriateGenericGetByIdFunction):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::resetGetByID):
+        * jit/Repatch.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionGetGetterSetter):
+        (functionCreateBuiltin):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/GetterSetter.cpp:
+        * runtime/GetterSetter.h:
+        * runtime/JSType.h:
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::getPureResult):
+        * runtime/PropertySlot.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        * tests/stress/try-get-by-id.js: Added.
+        (tryGetByIdText):
+        (getCaller.obj.1.throw.new.Error.let.func):
+        (getCaller.obj.1.throw.new.Error):
+        (throw.new.Error.get let):
+        (throw.new.Error.):
+        (throw.new.Error.let.get createBuiltin):
+        (get let):
+        (let.get createBuiltin):
+        (let.func):
+        (get let.func):
+        (get throw):
+
+2016-04-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize the makeSpaceForCCall stuff
+        https://bugs.webkit.org/show_bug.cgi?id=156352
+
+        Reviewed by Mark Lam.
+
+        I want to add more code to PolymorphicAccess that makes C calls, so that I can finally fix
+        https://bugs.webkit.org/show_bug.cgi?id=130914 (allow transition caches to handle indexing
+        headers).
+
+        When trying to understand what it takes to make a C call, I came across code that was making
+        room on the stack for spilled arguments. This logic was guarded with some complicated
+        condition. At first, I tried to just refactor the code so that the same ugly condition
+        wouldn't have to be copy-pasted everywhere that we made C calls. But then I started thinking
+        about the condition, and realized that it was probably wrong: if the outer PolymorphicAccess
+        harness decides to reuse a register for the scratchGPR then the top of the stack will store
+        the old value of scratchGPR, but the condition wouldn't necessarily trigger. So if the call
+        then overwrote something on the stack, we'd have a bad time.
+
+        Making room on the stack for a call is a cheap operation. It's orders of magnitude cheaper
+        than the rest of the call. Therefore, I think that it's best to just unconditionally make
+        room on the stack.
+
+        This patch makes us do just that. I also made the relevant helpers not inline, because I
+        think that we have too many inline methods in our assemblers. Now it's much easier to make
+        C calls from PolymorphicAccess because you just call the AssemblyHelper methods for making
+        space. There are no special conditions or anything like that.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitLoadStructure):
+        (JSC::AssemblyHelpers::makeSpaceOnStackForCCall):
+        (JSC::AssemblyHelpers::reclaimSpaceOnStackForCCall):
+        (JSC::emitRandomThunkImpl):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::makeSpaceOnStackForCCall): Deleted.
+        (JSC::AssemblyHelpers::reclaimSpaceOnStackForCCall): Deleted.
+
+2016-04-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199128 and r199141.
+        https://bugs.webkit.org/show_bug.cgi?id=156348
+
+        Causes crashes on multiple webpages (Requested by keith_mi_ on
+        #webkit).
+
+        Reverted changesets:
+
+        "[ES6] Add support for Symbol.isConcatSpreadable."
+        https://bugs.webkit.org/show_bug.cgi?id=155351
+        http://trac.webkit.org/changeset/199128
+
+        "Unreviewed, uncomment accidentally commented line in test."
+        http://trac.webkit.org/changeset/199141
+
+2016-04-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize the handling of PutById transitions a bit
+        https://bugs.webkit.org/show_bug.cgi?id=156330
+
+        Reviewed by Mark Lam.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate): Get rid of the specialized slow calls. We can just use the failAndIgnore jump target. We just need to make sure that we don't make observable effects until we're done with all of the fast path checks.
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::addAccessCase): MadeNoChanges indicates that we should keep trying to repatch. Currently PutById transitions might trigger the case that addAccessCase() sees null, if the transition involves an indexing header. Doing repatching in that case is probably not good. But, we should just fix this the right way eventually.
+
+2016-04-07  Per Arne Vollan  <peavo@outlook.com>
+
+        [Win] Fix for JSC stress test failures.
+        https://bugs.webkit.org/show_bug.cgi?id=156343
+
+        Reviewed by Filip Pizlo.
+
+        We need to make it clear to MSVC that the method loadPtr(ImplicitAddress address, RegisterID dest)
+        should be used, and not loadPtr(const void* address, RegisterID dest).
+
+        * jit/CCallHelpers.cpp:
+        (JSC::CCallHelpers::setupShadowChickenPacket):
+
+2016-04-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] UInt32ToNumber should be NodeMustGenerate
+        https://bugs.webkit.org/show_bug.cgi?id=156329
+
+        Reviewed by Filip Pizlo.
+
+        It exits on negative numbers on the integer path.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+
+2016-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling out r199016.
+        https://bugs.webkit.org/show_bug.cgi?id=156140
+
+        "Perf bots are down, so I can't re-land this right now."
+
+        Reverted changeset:
+
+        CopiedBlock should be 16kB
+        https://bugs.webkit.org/show_bug.cgi?id=156168
+        http://trac.webkit.org/changeset/199016
+
+2016-04-06  Mark Lam  <mark.lam@apple.com>
+
+        String.prototype.match() should be calling internal function RegExpCreate.
+        https://bugs.webkit.org/show_bug.cgi?id=156318
+
+        Reviewed by Filip Pizlo.
+
+        RegExpCreate is not the same as the RegExp constructor.  The current implementation
+        invokes new @RegExp which calls the constructor.  This results in failures in
+        es6/Proxy_internal_get_calls_String.prototype.match.js, and
+        es6/Proxy_internal_get_calls_String.prototype.search.js due to observable side
+        effects.
+
+        This patch fixes this by factoring out the part of the RegExp constructor that
+        makes the RegExpCreate function, and changing String's match and search to call
+        RegExpCreate instead in accordance with the ES6 spec. 
+
+        * builtins/StringPrototype.js:
+        (match):
+        (search):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::toFlags):
+        (JSC::regExpCreate):
+        (JSC::constructRegExp):
+        (JSC::esSpecRegExpCreate):
+        (JSC::constructWithRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::isRegExp):
+
+2016-04-06  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, uncomment accidentally commented line in test.
+
+        * tests/stress/array-concat-spread-object.js:
+
+2016-04-06  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should have a simple way of gathering IC statistics
+        https://bugs.webkit.org/show_bug.cgi?id=156317
+
+        Reviewed by Benjamin Poulain.
+
+        This adds a cheap, runtime-enabled way of gathering statistics about why we take the slow
+        paths for inline caches. This is complementary to our existing bytecode profiler. Eventually
+        we may want to combine the two things.
+        
+        This is not a slow-down on anything because we only do extra work on IC slow paths and if
+        it's disabled it's just a load-and-branch to skip the stats gathering code.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ICStats.cpp: Added.
+        * jit/ICStats.h: Added.
+        * jit/JITOperations.cpp:
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::inherits):
+        (JSC::JSValue::classInfoOrNull):
+        (JSC::JSValue::toThis):
+        * runtime/Options.h:
+
+2016-04-06  Filip Pizlo  <fpizlo@apple.com>
+
+        32-bit JSC stress/multi-put-by-offset-multiple-transitions.js failing
+        https://bugs.webkit.org/show_bug.cgi?id=156292
+
+        Reviewed by Benjamin Poulain.
+
+        Make sure that we stash the callsite index before calling operationReallocateStorageAndFinishPut.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+
+2016-04-06  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC test stress/arrowfunction-lexical-bind-superproperty.js failing
+        https://bugs.webkit.org/show_bug.cgi?id=156309
+
+        Reviewed by Saam Barati.
+
+        Just be honest about the fact that the ArgumentCount and Callee parts of inline callframe runtime
+        meta-data can be read at any time.
+        
+        We only have to say this for the inline callframe forms of ArgumentCount and Callee because we don't
+        sink any part of the machine prologue. This change just prevents us from sinking the pseudoprologue
+        of inlined varargs or closure calls.
+
+        Shockingly, this is not a regression on anything.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2016-03-29  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add support for Symbol.isConcatSpreadable.
+        https://bugs.webkit.org/show_bug.cgi?id=155351
+
+        Reviewed by Saam Barati.
+
+        This patch adds support for Symbol.isConcatSpreadable. In order to do so it was necessary to move the
+        Array.prototype.concat function to JS. A number of different optimizations were needed to make such the move to
+        a builtin performant. First, four new DFG intrinsics were added.
+
+        1) IsArrayObject (I would have called it IsArray but we use the same name for an IndexingType): an intrinsic of
+           the Array.isArray function.
+        2) IsJSArray: checks the first child is a JSArray object.
+        3) IsArrayConstructor: checks the first child is an instance of ArrayConstructor.
+        4) CallObjectConstructor: an intrinsic of the Object constructor.
+
+        IsActualObject, IsJSArray, and CallObjectConstructor can all be converted into constants in the abstract interpreter if
+        we are able to prove that the first child is an Array or for ToObject an Object.
+
+        In order to further improve the perfomance we also now cover more indexing types in our fast path memcpy
+        code. Before we would only memcpy Arrays if they had the same indexing type and did not have Array storage and
+        were not undecided. Now the memcpy code covers the following additional two cases: One array is undecided and
+        the other is a non-array storage and the case where one array is Int32 and the other is contiguous (we map this
+        into a contiguous array).
+
+        This patch also adds a new fast path for concat with more than one array argument by using memcpy to append
+        values onto the result array. This works roughly the same as the two array fast path using the same methodology
+        to decide if we can memcpy the other butterfly into the result butterfly.
+
+        Two new debugging tools are also added to the jsc cli. One is a version of the print function with a private
+        name so it can be used for debugging builtins. The other is dumpDataLog, which takes a JSValue and runs our
+        dataLog function on it.
+
+        Finally, this patch add a new constructor to JSValueRegsTemporary that allows it to reuse the the registers of a
+        JSValueOperand if the operand's use count is one.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ArrayPrototype.js:
+        (concatSlowPath):
+        (concat):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileIsJSArray):
+        (JSC::DFG::SpeculativeJIT::compileIsArrayObject):
+        (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor):
+        (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::isArray):
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (WTF::RuntimeArray::createStructure):
+        (GlobalObject::finishCreation):
+        (functionDebug):
+        (functionDataLogValue):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        (JSC::isArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoPrivateFuncIsJSArray):
+        (JSC::moveElements):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        (JSC::arrayProtoPrivateFuncAppendMemcpy):
+        (JSC::arrayProtoFuncConcat): Deleted.
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::fastConcatWith): Deleted.
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::JSArray::fastConcatType): Deleted.
+        * runtime/JSArrayInlines.h: Added.
+        (JSC::JSArray::memCopyWithIndexingType):
+        (JSC::JSArray::canFastCopy):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSType.h:
+        * runtime/ObjectConstructor.h:
+        (JSC::constructObject):
+        * tests/es6.yaml:
+        * tests/stress/array-concat-spread-object.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-spread-proxy-exception-check.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-spread-proxy.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-with-slow-indexingtypes.js: Added.
+        (arrayEq):
+        * tests/stress/array-species-config-array-constructor.js:
+
+2016-04-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199070.
+        https://bugs.webkit.org/show_bug.cgi?id=156324
+
+        "It didn't fix the timeout" (Requested by saamyjoon on
+        #webkit).
+
+        Reverted changeset:
+
+        "jsc-layout-tests.yaml/js/script-tests/regress-141098.js
+        failing on Yosemite Debug after r198989"
+        https://bugs.webkit.org/show_bug.cgi?id=156187
+        http://trac.webkit.org/changeset/199070
+
+2016-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling in r199016.
+        https://bugs.webkit.org/show_bug.cgi?id=156140
+
+        It might work this time without regression because 16kB aligned requests
+        now take the allocation fast path.
+
+        Restored changeset:
+
+        CopiedBlock should be 16kB
+        https://bugs.webkit.org/show_bug.cgi?id=156168
+        http://trac.webkit.org/changeset/199016
+
+2016-04-06  Mark Lam  <mark.lam@apple.com>
+
+        Update es6.yaml to expect es6/Proxy_internal_get_calls_RegExp_constructor.js to pass.
+        https://bugs.webkit.org/show_bug.cgi?id=156314
+
+        Reviewed by Saam Barati.
+
+        * tests/es6.yaml:
+
+2016-04-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199104.
+        https://bugs.webkit.org/show_bug.cgi?id=156301
+
+        Still breaks internal builds (Requested by keith_miller on
+        #webkit).
+
+        Reverted changeset:
+
+        "We should support the ability to do a non-effectful getById"
+        https://bugs.webkit.org/show_bug.cgi?id=156116
+        http://trac.webkit.org/changeset/199104
+
+2016-04-06  Keith Miller  <keith_miller@apple.com>
+
+        RegExp constructor should use Symbol.match and other properties
+        https://bugs.webkit.org/show_bug.cgi?id=155873
+
+        Reviewed by Michael Saboff.
+
+        This patch updates the behavior of the RegExp constructor. Now the constructor
+        should get the Symbol.match property and check if it exists to decide if something
+        should be constructed like a regexp object.
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::toFlags):
+        (JSC::constructRegExp):
+        (JSC::constructWithRegExpConstructor):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        * tests/stress/regexp-constructor.js: Added.
+        (assert):
+        (throw.new.Error.get let):
+        (throw.new.Error.):
+        (throw.new.Error.get re):
+
+2016-04-06  Keith Miller  <keith_miller@apple.com>
+
+        We should support the ability to do a non-effectful getById
+        https://bugs.webkit.org/show_bug.cgi?id=156116
+
+        Reviewed by Benjamin Poulain.
+
+        Currently, there is no way in JS to do a non-effectful getById. A non-effectful getById is
+        useful because it enables us to take different code paths based on values that we would
+        otherwise not be able to have knowledge of. This patch adds this new feature called
+        try_get_by_id that will attempt to do as much of a get_by_id as possible without performing
+        an effectful behavior. Thus, try_get_by_id will return the value if the slot is a value, the
+        GetterSetter object if the slot is a normal accessor (not a CustomGetterSetter) and
+        undefined if the slot is unset.  If the slot is proxied or any other cases then the result
+        is null. In theory, if we ever wanted to check for null we could add a sentinal object to
+        the global object that indicates we could not get the result.
+
+        In order to implement this feature we add a new enum GetByIdKind that indicates what to do
+        for accessor properties in PolymorphicAccess. If the GetByIdKind is pure then we treat the
+        get_by_id the same way we would for load and return the value at the appropriate offset.
+        Additionally, in order to make sure the we can properly compare the GetterSetter object
+        with === GetterSetters are now JSObjects. This comes at the cost of eight extra bytes on the
+        GetterSetter object but it vastly simplifies the patch. Additionally, the extra bytes are
+        likely to have little to no impact on memory usage as normal accessors are generally rare.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor):
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        (JSC::createBuiltinExecutable):
+        (JSC::BuiltinExecutables::createExecutable):
+        (JSC::createExecutableInternal): Deleted.
+        * builtins/BuiltinExecutables.h:
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::tryGet):
+        (JSC::AccessCase::generate):
+        (WTF::printInternal):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::isGet): Deleted.
+        (JSC::AccessCase::isPut): Deleted.
+        (JSC::AccessCase::isIn): Deleted.
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::reset):
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitTryGetById):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emitSlow_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emitSlow_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess):
+        (JSC::appropriateOptimizingGetByIdFunction):
+        (JSC::appropriateGenericGetByIdFunction):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::resetGetByID):
+        * jit/Repatch.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionGetGetterSetter):
+        (functionCreateBuiltin):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/GetterSetter.cpp:
+        * runtime/GetterSetter.h:
+        * runtime/JSType.h:
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::getPureResult):
+        * runtime/PropertySlot.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        * tests/stress/try-get-by-id.js: Added.
+        (tryGetByIdText):
+        (getCaller.obj.1.throw.new.Error.let.func):
+        (getCaller.obj.1.throw.new.Error):
+        (throw.new.Error.get let):
+        (throw.new.Error.):
+        (throw.new.Error.let.get createBuiltin):
+        (get let):
+        (let.get createBuiltin):
+        (let.func):
+        (get let.func):
+        (get throw):
+
+2016-04-05  Chris Dumez  <cdumez@apple.com>
+
+        Add support for [EnabledAtRuntime] operations on DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=156272
+
+        Reviewed by Alex Christensen.
+
+        Add identifier for 'fetch' so it can be used from the generated
+        bindings.
+
+        * runtime/CommonIdentifiers.h:
+
+2016-04-05  Alex Christensen  <achristensen@webkit.org>
+
+        Make CMake-generated binaries on Mac able to run
+        https://bugs.webkit.org/show_bug.cgi?id=156268
+
+        Reviewed by Daniel Bates.
+
+        * CMakeLists.txt:
+
+2016-04-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Improve some other cases of context-sensitive inlining
+        https://bugs.webkit.org/show_bug.cgi?id=156277
+
+        Reviewed by Benjamin Poulain.
+        
+        This implements some improvements for inlining:
+
+        - We no longer do guarded inlining when the profiling doesn't come from a stub. Doing so would have
+          been risky, and according to benchmarks, it wasn't common enough to matter. I think it's better to
+          err on the side of not inlining.
+        
+        - The jneq_ptr pattern for variadic calls no longer breaks the basic block. Not breaking the block
+          increases the chances of the parser seeing the callee constant. While inlining doesn't require a
+          callee constant, sometimes it makes a difference. Note that we were previously breaking the block
+          for no reason at all: if the boundary after jneq_ptr is a jump target from some other jump, then
+          the parser will automatically break the block for us. There is no reason to add any block breaking
+          ourselves since we implement jneq_ptr by ignoring the affirmative jump destination and inserting a
+          check and falling through.
+        
+        - get_by_id handling now tries to apply some common sense to its status object. In particular, if
+          the source is a NewObject and there was no interfering operation that could clobber the structure,
+          then we know which case of a polymorphic GetByIdStatus we would take. This arises in some
+          constructor patterns.
+        
+        Long term, we should address all of these cases comprehensively by having a late inliner. The inliner
+        being part of the bytecode parser means that there is a lot of complexity in the parser and it
+        prevents us from inlining upon learning new information from static analysis. But for now, I think
+        it's fine to experiment with one-off hacks, if only to learn what the possibilities are.
+        
+        This is a 14% speed-up on Octane/raytrace.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::dump):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::couldTakeSlowPath):
+        (JSC::CallLinkStatus::setCouldTakeSlowPath):
+        (JSC::CallLinkStatus::variants):
+        (JSC::CallLinkStatus::size):
+        (JSC::CallLinkStatus::at):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::makesCalls):
+        (JSC::GetByIdStatus::filter):
+        (JSC::GetByIdStatus::dump):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::wasSeenInJIT):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::refineStatically):
+        (JSC::DFG::ByteCodeParser::handleVarargsCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * runtime/Options.h:
+
+2016-04-05  Saam barati  <sbarati@apple.com>
+
+        JSC SamplingProfiler: Use a thread + sleep loop instead of WTF::WorkQueue for taking samples
+        https://bugs.webkit.org/show_bug.cgi?id=154017
+
+        Reviewed by Geoffrey Garen.
+
+        By moving to an explicitly created seperate thread + sample-then-sleep
+        loop, we can remove a lot of the crufty code around WorkQueue.
+        We're also getting sample rates that are much closer to what we're
+        asking the OS for. When the sampling handler was built off of WorkQueue,
+        we'd often get sample rates much higher than the 1ms we asked for. On Kraken,
+        we would average about 1.7ms sample rates, even though we'd ask for a 1ms rate.
+        Now, on Kraken, we're getting about 1.2ms rates. Because we're getting
+        higher rates, this patch is a performance regression. It's slower because
+        we're sampling more frequently.
+
+        Before this patch, the sampling profiler had the following overhead:
+        - 10% on Kraken
+        - 12% on octane
+        - 15% on AsmBench
+
+        With this patch, the sampling profiler has the following overhead:
+        - 16% on Kraken
+        - 17% on Octane
+        - 30% on AsmBench
+
+        Comparatively, this new patch has the following overhead over the old sampling profiler:
+        - 5% on Kraken
+        - 3.5% on Octane
+        - 13% slower on AsmBench
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::SamplingProfiler):
+        (JSC::SamplingProfiler::~SamplingProfiler):
+        (JSC::SamplingProfiler::createThreadIfNecessary):
+        (JSC::SamplingProfiler::timerLoop):
+        (JSC::SamplingProfiler::takeSample):
+        (JSC::tryGetBytecodeIndex):
+        (JSC::SamplingProfiler::shutdown):
+        (JSC::SamplingProfiler::start):
+        (JSC::SamplingProfiler::pause):
+        (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
+        (JSC::SamplingProfiler::noticeJSLockAcquisition):
+        (JSC::SamplingProfiler::noticeVMEntry):
+        (JSC::SamplingProfiler::clearData):
+        (JSC::SamplingProfiler::stop): Deleted.
+        (JSC::SamplingProfiler::dispatchIfNecessary): Deleted.
+        (JSC::SamplingProfiler::dispatchFunction): Deleted.
+        * runtime/SamplingProfiler.h:
+        (JSC::SamplingProfiler::setTimingInterval):
+        (JSC::SamplingProfiler::setStopWatch):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+
+2016-04-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r199073.
+        https://bugs.webkit.org/show_bug.cgi?id=156261
+
+        This change broke internal Mac builds (Requested by ryanhaddad
+        on #webkit).
+
+        Reverted changeset:
+
+        "We should support the ability to do a non-effectful getById"
+        https://bugs.webkit.org/show_bug.cgi?id=156116
+        http://trac.webkit.org/changeset/199073
+
+2016-04-05  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Fetch API] Add a runtime flag to fetch API and related constructs
+        https://bugs.webkit.org/show_bug.cgi?id=156113
+ 
+        Reviewed by Alex Christensen.
+
+        Add a fetch API runtime flag based on preferences.
+        Disable fetch API by default.
+ 
+        * runtime/CommonIdentifiers.h:
+
+2016-04-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop some more.
+
+        * runtime/RegExpInlines.h:
+        (JSC::RegExp::hasCodeFor):
+        (JSC::RegExp::hasMatchOnlyCodeFor):
+
+2016-04-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop.
+
+        * jit/CCallHelpers.cpp:
+
+2016-03-18  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC should use a shadow stack version of CHICKEN so that debuggers have the option of retrieving tail-deleted frames
+        https://bugs.webkit.org/show_bug.cgi?id=155598
+
+        Reviewed by Saam Barati.
+        
+        JSC is the first JSVM to have proper tail calls. This means that error.stack and the
+        debugger will appear to "delete" strict mode stack frames, if the call that this frame made
+        was in tail position. This is exactly what functional programmers expect - they don't want
+        the VM to waste resources on tail-deleted frames to ensure that it's legal to loop forever
+        using tail calls. It's also something that non-functional programmers fear. It's not clear
+        that tail-deleted frames would actually degrade the debugging experience, but the fear is
+        real, so it's worthwhile to do something about it.
+
+        It turns out that there is at least one tail call implementation that doesn't suffer from
+        this problem. It implements proper tail calls in the sense that you won't run out of memory
+        by tail-looping. It also has the power to show you tail-deleted frames in a backtrace, so
+        long as you haven't yet run out of memory. It's called CHICKEN Scheme, and it's one of my
+        favorite hacks:
+        
+        http://www.more-magic.net/posts/internals-gc.html
+
+        CHICKEN does many awesome things. The intuition from CHICKEN that we use here is a simple
+        one: what if a tail call still kept the tail-deleted frame, and the GC actually deleted that
+        frame only once we proved that there was insufficient memory to keep it around.
+        
+        CHICKEN does this by reshaping the C stack with longjmp/setjmp. We can't do that because we
+        can have arbitrary native code, and that native code does not have relocatable stack frames.
+        
+        But we can do something almost like CHICKEN on a shadow stack. It's a common trick to have a
+        VM maintain two stacks - the actual execution stack plus a shadow stack that has some extra
+        information. The shadow stack can be reshaped, moved, etc, since the VM tightly controls its
+        layout. The main stack can then continue to obey ABI rules.
+
+        This patch implements a mechanism for being able to display stack traces that include
+        tail-deleted frames. It uses a shadow stack that behaves like a CHICKEN stack: it has all
+        frames all the time, though we will collect the tail-deleted ones if the stack gets too big.
+        This new mechanism is called ShadowChicken, obviously: it's CHICKEN on a shadow stack.
+        
+        ShadowChicken is always on, but individual CodeBlocks may make their own choices about
+        whether to opt into it. They will do that at bytecompile time based on the debugger mode on
+        their global object.
+
+        When no CodeBlock opts in, there is no overhead, since ShadowChicken ends up doing nothing
+        in that case. Well, except when exceptions are thrown. Then it might do some work, but it's
+        minor.
+
+        When all CodeBlocks opt in, there is about 6% overhead. That's too much overhead to enable
+        this all the time, but it's low enough to justify enabling in the Inspector. It's currently
+        enabled on all CodeBlocks only when you use an Option. Otherwise it will auto-enable if the
+        debugger is on.
+
+        Note that ShadowChicken attempts to gracefully handle the presence of stack frames that have
+        no logging. This is essential since we *can* have debugging enabled in one GlobalObject and
+        disabled in another. Also, some frames don't do ShadowChicken because they just haven't been
+        hacked to do it yet. Native frames fall into this category, as do the VM entry frames.
+
+        This doesn't yet wire ShadowChicken into DebuggerCallFrame. That will take more work. It
+        just makes a ShadowChicken stack walk function available to jsc. It's used from the
+        shadow-chicken tests.
+
+        * API/JSContextRef.cpp:
+        (BacktraceFunctor::BacktraceFunctor):
+        (BacktraceFunctor::operator()):
+        (JSContextCreateBacktrace):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::RecursionCheckFunctor::RecursionCheckFunctor):
+        (JSC::RecursionCheckFunctor::operator()):
+        (JSC::CodeBlock::noticeIncomingCall):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEnter):
+        (JSC::BytecodeGenerator::emitCallInTailPosition):
+        (JSC::BytecodeGenerator::emitCallVarargsInTailPosition):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        (JSC::BytecodeGenerator::emitLogShadowChickenPrologueIfNecessary):
+        (JSC::BytecodeGenerator::emitLogShadowChickenTailIfNecessary):
+        (JSC::BytecodeGenerator::emitCallDefineProperty):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::LineAndColumnFunctor::operator()):
+        (JSC::LineAndColumnFunctor::column):
+        (JSC::FindCallerMidStackFunctor::FindCallerMidStackFunctor):
+        (JSC::FindCallerMidStackFunctor::operator()):
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSetRegExpObjectLastIndex):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLogShadowChickenPrologue):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLogShadowChickenTail):
+        (JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::setupShadowChickenPacket):
+        (JSC::FTL::DFG::LowerDFGToB3::boolify):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::visitSamplingProfiler):
+        (JSC::Heap::visitShadowChicken):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        (JSC::Heap::collectImpl):
+        * heap/Heap.h:
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::CreateScriptCallStackFunctor::CreateScriptCallStackFunctor):
+        (Inspector::CreateScriptCallStackFunctor::operator()):
+        (Inspector::createScriptCallStack):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::iterate):
+        * interpreter/Interpreter.cpp:
+        (JSC::DumpRegisterFunctor::DumpRegisterFunctor):
+        (JSC::DumpRegisterFunctor::operator()):
+        (JSC::GetStackTraceFunctor::GetStackTraceFunctor):
+        (JSC::GetStackTraceFunctor::operator()):
+        (JSC::Interpreter::getStackTrace):
+        (JSC::GetCatchHandlerFunctor::handler):
+        (JSC::GetCatchHandlerFunctor::operator()):
+        (JSC::notifyDebuggerOfUnwinding):
+        (JSC::UnwindFunctor::UnwindFunctor):
+        (JSC::UnwindFunctor::operator()):
+        (JSC::UnwindFunctor::copyCalleeSavesToVMCalleeSavesBuffer):
+        * interpreter/ShadowChicken.cpp: Added.
+        (JSC::ShadowChicken::Packet::dump):
+        (JSC::ShadowChicken::Frame::dump):
+        (JSC::ShadowChicken::ShadowChicken):
+        (JSC::ShadowChicken::~ShadowChicken):
+        (JSC::ShadowChicken::log):
+        (JSC::ShadowChicken::update):
+        (JSC::ShadowChicken::visitChildren):
+        (JSC::ShadowChicken::reset):
+        (JSC::ShadowChicken::dump):
+        (JSC::ShadowChicken::functionsOnStack):
+        * interpreter/ShadowChicken.h: Added.
+        (JSC::ShadowChicken::Packet::Packet):
+        (JSC::ShadowChicken::Packet::tailMarker):
+        (JSC::ShadowChicken::Packet::throwMarker):
+        (JSC::ShadowChicken::Packet::prologue):
+        (JSC::ShadowChicken::Packet::tail):
+        (JSC::ShadowChicken::Packet::throwPacket):
+        (JSC::ShadowChicken::Packet::operator bool):
+        (JSC::ShadowChicken::Packet::isPrologue):
+        (JSC::ShadowChicken::Packet::isTail):
+        (JSC::ShadowChicken::Packet::isThrow):
+        (JSC::ShadowChicken::Frame::Frame):
+        (JSC::ShadowChicken::Frame::operator==):
+        (JSC::ShadowChicken::Frame::operator!=):
+        (JSC::ShadowChicken::log):
+        (JSC::ShadowChicken::logSize):
+        (JSC::ShadowChicken::addressOfLogCursor):
+        (JSC::ShadowChicken::logEnd):
+        * interpreter/ShadowChickenInlines.h: Added.
+        (JSC::ShadowChicken::iterate):
+        * interpreter/StackVisitor.h:
+        (JSC::StackVisitor::Frame::callee):
+        (JSC::StackVisitor::Frame::codeBlock):
+        (JSC::StackVisitor::Frame::bytecodeOffset):
+        (JSC::StackVisitor::Frame::inlineCallFrame):
+        (JSC::StackVisitor::Frame::isJSFrame):
+        (JSC::StackVisitor::Frame::isInlinedFrame):
+        (JSC::StackVisitor::visit):
+        * jit/CCallHelpers.cpp: Added.
+        (JSC::CCallHelpers::logShadowChickenProloguePacket):
+        (JSC::CCallHelpers::logShadowChickenTailPacket):
+        (JSC::CCallHelpers::setupShadowChickenPacket):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::prepareForTailCallSlow):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resume):
+        (JSC::JIT::emit_op_log_shadow_chicken_prologue):
+        (JSC::JIT::emit_op_log_shadow_chicken_tail):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (FunctionJSCStackFunctor::FunctionJSCStackFunctor):
+        (FunctionJSCStackFunctor::operator()):
+        (functionClearSamplingFlags):
+        (functionShadowChickenFunctionsOnStack):
+        (functionReadline):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::llint_throw_stack_overflow_error):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * profiler/ProfileGenerator.cpp:
+        (JSC::AddParentForConsoleStartFunctor::foundParent):
+        (JSC::AddParentForConsoleStartFunctor::operator()):
+        * runtime/Error.cpp:
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::FindFirstCallerFrameWithCodeblockFunctor):
+        (JSC::FindFirstCallerFrameWithCodeblockFunctor::operator()):
+        (JSC::addErrorInfoAndGetBytecodeOffset):
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveArgumentsFunctor::result):
+        (JSC::RetrieveArgumentsFunctor::operator()):
+        (JSC::retrieveArguments):
+        (JSC::RetrieveCallerFunctionFunctor::result):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        (JSC::retrieveCallerFunction):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::GlobalFuncProtoGetterFunctor::result):
+        (JSC::GlobalFuncProtoGetterFunctor::operator()):
+        (JSC::globalFuncProtoGetter):
+        (JSC::GlobalFuncProtoSetterFunctor::allowsAccess):
+        (JSC::GlobalFuncProtoSetterFunctor::operator()):
+        * runtime/NullSetterFunction.cpp:
+        (JSC::GetCallerStrictnessFunctor::GetCallerStrictnessFunctor):
+        (JSC::GetCallerStrictnessFunctor::operator()):
+        (JSC::GetCallerStrictnessFunctor::callerIsStrict):
+        (JSC::callerIsStrict):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::result):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+        (JSC::objectConstructorGetPrototypeOf):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::SetEnabledProfilerFunctor::operator()):
+        * runtime/VM.h:
+        (JSC::VM::shouldBuilderPCToCodeOriginMapping):
+        (JSC::VM::bytecodeIntrinsicRegistry):
+        (JSC::VM::shadowChicken):
+        * tests/stress/resources/shadow-chicken-support.js: Added.
+        (describeFunction):
+        (describeArray):
+        (expectStack):
+        (initialize):
+        * tests/stress/shadow-chicken-disabled.js: Added.
+        (test1.foo):
+        (test1.bar):
+        (test1.baz):
+        (test1):
+        (test2.foo):
+        (test2.bar):
+        (test2.baz):
+        (test2):
+        (test3.foo):
+        (test3.bar):
+        (test3.baz):
+        (test3):
+        * tests/stress/shadow-chicken-enabled.js: Added.
+        (test1.foo):
+        (test1.bar):
+        (test1.baz):
+        (test1):
+        (test2.foo):
+        (test2.bar):
+        (test2.baz):
+        (test2):
+        (test3.bob):
+        (test3.thingy):
+        (test3.foo):
+        (test3.bar):
+        (test3.baz):
+        (test3):
+        (test4.bob):
+        (test4.thingy):
+        (test4.foo):
+        (test4.bar):
+        (test4.baz):
+        (test4):
+        (test5.foo):
+        (test5):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::CallerFrameJITTypeFunctor::CallerFrameJITTypeFunctor):
+        (JSC::CallerFrameJITTypeFunctor::operator()):
+        (JSC::CallerFrameJITTypeFunctor::jitType):
+        (JSC::functionLLintTrue):
+        (JSC::CellAddressCheckFunctor::CellAddressCheckFunctor):
+        (JSC::CellAddressCheckFunctor::operator()):
+        (JSC::JSDollarVMPrototype::isValidCell):
+        (JSC::JSDollarVMPrototype::isValidCodeBlock):
+        (JSC::JSDollarVMPrototype::codeBlockForFrame):
+        (JSC::PrintFrameFunctor::PrintFrameFunctor):
+        (JSC::PrintFrameFunctor::operator()):
+        (JSC::printCallFrame):
+
+2016-03-19  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG and FTL should constant-fold RegExpExec, RegExpTest, and StringReplace
+        https://bugs.webkit.org/show_bug.cgi?id=155270
+
+        Reviewed by Saam Barati.
+
+        This enables constant-folding of RegExpExec, RegExpTest, and StringReplace.
+
+        It's now possible to run Yarr on the JIT threads. Since previous work on constant-folding
+        strings gave the DFG an API for reasoning about JSString constants in terms of
+        JIT-thread-local WTF::Strings, it's now super easy to just pass strings to Yarr and build IR
+        based on the results.
+
+        But RegExpExec is hard: the folded version still must allocate a RegExpMatchesArray. We must
+        use the same Structure that the code would have used or else we'll pollute the program's
+        inline caches. Also, RegExpMatchesArray.h|cpp will allocate the array and its named
+        properties in one go - we don't want to lose that optimization. So, this patch enables
+        MaterializeNewObject to allocate objects or arrays with any number of indexed or named
+        properties. Previously it could only handle objects (but not arrays) and named properties
+        (but not indexed ones).
+
+        This also adds a few minor things for setting the RegExpConstructor cached result.
+
+        This is about a 2x speed-up on microbenchmarks when we fold a match success and about a
+        8x speed-up when we fold a match failure. It's a 10% speed-up on Octane/regexp.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGInsertionSet.cpp:
+        (JSC::DFG::InsertionSet::insertSlow):
+        (JSC::DFG::InsertionSet::execute):
+        * dfg/DFGInsertionSet.h:
+        (JSC::DFG::InsertionSet::insertCheck):
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::tryGetString):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.h:
+        (JSC::DFG::StackAccessData::flushedAt):
+        (JSC::DFG::OpInfo::OpInfo): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGObjectMaterializationData.cpp:
+        (JSC::DFG::ObjectMaterializationData::dump):
+        (JSC::DFG::PhantomPropertyValue::dump): Deleted.
+        (JSC::DFG::ObjectMaterializationData::oneWaySimilarityScore): Deleted.
+        (JSC::DFG::ObjectMaterializationData::similarityScore): Deleted.
+        * dfg/DFGObjectMaterializationData.h:
+        (JSC::DFG::PhantomPropertyValue::PhantomPropertyValue): Deleted.
+        (JSC::DFG::PhantomPropertyValue::operator==): Deleted.
+        * dfg/DFGOpInfo.h: Added.
+        (JSC::DFG::OpInfo::OpInfo):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGPromotedHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::~SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+        (JSC::DFG::SpeculativeJIT::emitGetLength):
+        (JSC::DFG::SpeculativeJIT::compileLazyJSConstant):
+        (JSC::DFG::SpeculativeJIT::compileMaterializeNewObject):
+        (JSC::DFG::SpeculativeJIT::compileRecordRegExpCachedResult):
+        (JSC::DFG::SpeculativeJIT::emitAllocateJSArray): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::StrengthReductionPhase):
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        (JSC::DFG::StrengthReductionPhase::handleCommutativity):
+        (JSC::DFG::StrengthReductionPhase::executeInsertionSet):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        (JSC::DFG::Validate::validateCPS):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSetRegExpObjectLastIndex):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRecordRegExpCachedResult):
+        (JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
+        (JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
+        (JSC::FTL::DFG::LowerDFGToB3::initializeArrayElements):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::isNotCellOrMisc):
+        (JSC::FTL::DFG::LowerDFGToB3::unboxDouble):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationPopulateObjectInOSR):
+        (JSC::FTL::operationNewObjectWithButterfly): Deleted.
+        * ftl/FTLOperations.h:
+        * inspector/ContentSearchUtilities.cpp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::createRawObject):
+        (JSC::JSFinalObject::create):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::matchConcurrently):
+        (JSC::RegExp::compileMatchOnly):
+        (JSC::RegExp::deleteCode):
+        * runtime/RegExp.h:
+        * runtime/RegExpCachedResult.h:
+        (JSC::RegExpCachedResult::offsetOfLastRegExp):
+        (JSC::RegExpCachedResult::offsetOfLastInput):
+        (JSC::RegExpCachedResult::offsetOfResult):
+        (JSC::RegExpCachedResult::offsetOfReified):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::offsetOfCachedResult):
+        * runtime/RegExpInlines.h:
+        (JSC::RegExp::hasCodeFor):
+        (JSC::RegExp::compileIfNecessary):
+        (JSC::RegExp::matchInline):
+        (JSC::RegExp::hasMatchOnlyCodeFor):
+        (JSC::RegExp::compileIfNecessaryMatchOnly):
+        * runtime/RegExpObjectInlines.h:
+        (JSC::RegExpObject::execInline):
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+        (JSC::substituteBackreferencesInline):
+        (JSC::substituteBackreferences):
+        (JSC::StringRange::StringRange):
+        * runtime/StringPrototype.h:
+        * runtime/VM.h:
+        * tests/stress/simple-regexp-exec-folding-fail.js: Added.
+        (foo):
+        * tests/stress/simple-regexp-exec-folding.js: Added.
+        (foo):
+        * tests/stress/simple-regexp-test-folding-fail.js: Added.
+        (foo):
+        * tests/stress/simple-regexp-test-folding.js: Added.
+        (foo):
+        * yarr/RegularExpression.cpp:
+        * yarr/Yarr.h:
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::byteCompile):
+        (JSC::Yarr::interpret):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+
+2016-04-05  Keith Miller  <keith_miller@apple.com>
+
+        We should support the ability to do a non-effectful getById
+        https://bugs.webkit.org/show_bug.cgi?id=156116
+
+        Reviewed by Benjamin Poulain.
+
+        Currently, there is no way in JS to do a non-effectful getById. A non-effectful getById is
+        useful because it enables us to take different code paths based on values that we would
+        otherwise not be able to have knowledge of. This patch adds this new feature called
+        try_get_by_id that will attempt to do as much of a get_by_id as possible without performing
+        an effectful behavior. Thus, try_get_by_id will return the value if the slot is a value, the
+        GetterSetter object if the slot is a normal accessor (not a CustomGetterSetter) and
+        undefined if the slot is unset.  If the slot is proxied or any other cases then the result
+        is null. In theory, if we ever wanted to check for null we could add a sentinal object to
+        the global object that indicates we could not get the result.
+
+        In order to implement this feature we add a new enum GetByIdKind that indicates what to do
+        for accessor properties in PolymorphicAccess. If the GetByIdKind is pure then we treat the
+        get_by_id the same way we would for load and return the value at the appropriate offset.
+        Additionally, in order to make sure the we can properly compare the GetterSetter object
+        with === GetterSetters are now JSObjects. This comes at the cost of eight extra bytes on the
+        GetterSetter object but it vastly simplifies the patch. Additionally, the extra bytes are
+        likely to have little to no impact on memory usage as normal accessors are generally rare.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor):
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        (JSC::createBuiltinExecutable):
+        (JSC::BuiltinExecutables::createExecutable):
+        (JSC::createExecutableInternal): Deleted.
+        * builtins/BuiltinExecutables.h:
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::tryGet):
+        (JSC::AccessCase::generate):
+        (WTF::printInternal):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::isGet): Deleted.
+        (JSC::AccessCase::isPut): Deleted.
+        (JSC::AccessCase::isIn): Deleted.
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::reset):
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitTryGetById):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emitSlow_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emitSlow_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess):
+        (JSC::appropriateOptimizingGetByIdFunction):
+        (JSC::appropriateGenericGetByIdFunction):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::resetGetByID):
+        * jit/Repatch.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionGetGetterSetter):
+        (functionCreateBuiltin):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/GetterSetter.cpp:
+        * runtime/GetterSetter.h:
+        * runtime/JSType.h:
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::getPureResult):
+        * runtime/PropertySlot.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        * tests/stress/try-get-by-id.js: Added.
+        (tryGetByIdText):
+        (getCaller.obj.1.throw.new.Error.let.func):
+        (getCaller.obj.1.throw.new.Error):
+        (throw.new.Error.get let):
+        (throw.new.Error.):
+        (throw.new.Error.let.get createBuiltin):
+        (get let):
+        (let.get createBuiltin):
+        (let.func):
+        (get let.func):
+        (get throw):
+
+2016-04-05  Saam barati  <sbarati@apple.com>
+
+        jsc-layout-tests.yaml/js/script-tests/regress-141098.js failing on Yosemite Debug after r198989
+        https://bugs.webkit.org/show_bug.cgi?id=156187
+
+        Reviewed by Filip Pizlo.
+
+        This is a speculative fix. Lets see if the prevents the timeout.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatementListItem):
+
+2016-04-04  Filip Pizlo  <fpizlo@apple.com>
+
+        PolymorphicAccess should have a MegamorphicLoad case
+        https://bugs.webkit.org/show_bug.cgi?id=156182
+
+        Reviewed by Geoffrey Garen and Keith Miller.
+
+        This introduces a new case to PolymorphicAccess called MegamorphicLoad. This inlines the lookup in
+        the PropertyTable. It's cheaper than switching on a huge number of cases and it's cheaper than
+        calling into C++ to do the same job - particularly since inlining the lookup into an access means
+        that we can precompute the hash code.
+
+        When writing the inline code for the hashtable lookup, I found that our hashing algorithm was not
+        optimal. It used a double-hashing method for reducing collision pathologies. This is great for
+        improving the performance of some worst-case scenarios. But this misses the point of a hashtable: we
+        want to optimize the average-case performance. When optimizing for average-case, we can choose to
+        either focus on maximizing the likelihood of the fast case happening, or to minimize the cost of the
+        worst-case, or to minimize the cost of the fast case. Even a very basic hashtable will achieve a high
+        probability of hitting the fast case. So, doing work to reduce the likelihood of a worst-case
+        pathology only makes sense if it also preserves the good performance of the fast case, or reduces the
+        likelihood of the worst-case by so much that it's a win for the average case even with a slow-down in
+        the fast case.
+
+        I don't believe, based on looking at how the double-hashing is implemented, that it's possible that
+        this preserves the good performance of the fast case. It requires at least one more value to be live
+        around the loop, and dramatically increases the register pressure at key points inside the loop. The
+        biggest offender is the doubleHash() method itself. There is no getting around how bad this is: if
+        the compiler live-range-splits that method to death to avoid degrading register pressure elsewhere
+        then we will pay a steep price anytime we take the second iteration around the loop; but if the
+        compiler doesn't split around the call then the hashtable lookup fast path will be full of spills on
+        some architectures (I performed biological register allocation and found that I needed 9 registers
+        for complete lookup, while x86-64 has only 6 callee-saves; OTOH ARM64 has 10 callee-saves so it might
+        be better off).
+
+        Hence, this patch changes the hashtable lookup to use simple linear probing. This was not a slow-down
+        on anything, and it made MegamorphicLoad much more sensible since it is less likely to have to spill.
+
+        There are some other small changes in this patch, like rationalizing the IC's choice between giving
+        up after a repatch (i.e. never trying again) and just pretending that nothing happened (so we can
+        try to repatch again in the future). It looked like the code in Repatch.cpp was set up to be able to
+        choose between those options, but we weren't fully taking advantage of it because the
+        regenerateWithCase() method just returned null for any failure, and didn't say whether it was the
+        sort of failure that renders the inline cache unrepatchable (like memory allocation failure). Now
+        this is all made explicit. I wanted to make sure this change happened in this patch since the
+        MegamorphicLoad code automagically generates a MegamorphicLoad case by coalescing other cases. Since
+        this is intended to avoid blowing out the cache and making it unrepatchable, I wanted to make sure
+        that the rules for giving up were something that made sense to me.
+        
+        This is a big win on microbenchmarks. It's neutral on traditional JS benchmarks. It's a slight
+        speed-up for page loading, because many real websites like to have megamorphic property accesses.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationResult::dump):
+        (JSC::AccessGenerationState::addWatchpoint):
+        (JSC::AccessCase::get):
+        (JSC::AccessCase::megamorphicLoad):
+        (JSC::AccessCase::replace):
+        (JSC::AccessCase::guardedByStructureCheck):
+        (JSC::AccessCase::couldStillSucceed):
+        (JSC::AccessCase::canBeReplacedByMegamorphicLoad):
+        (JSC::AccessCase::canReplace):
+        (JSC::AccessCase::generateWithGuard):
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::PolymorphicAccess):
+        (JSC::PolymorphicAccess::~PolymorphicAccess):
+        (JSC::PolymorphicAccess::regenerateWithCases):
+        (JSC::PolymorphicAccess::regenerateWithCase):
+        (WTF::printInternal):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::isGet):
+        (JSC::AccessCase::isPut):
+        (JSC::AccessCase::isIn):
+        (JSC::AccessGenerationResult::AccessGenerationResult):
+        (JSC::AccessGenerationResult::operator==):
+        (JSC::AccessGenerationResult::operator!=):
+        (JSC::AccessGenerationResult::operator bool):
+        (JSC::AccessGenerationResult::kind):
+        (JSC::AccessGenerationResult::code):
+        (JSC::AccessGenerationResult::madeNoChanges):
+        (JSC::AccessGenerationResult::gaveUp):
+        (JSC::AccessGenerationResult::generatedNewCode):
+        (JSC::PolymorphicAccess::isEmpty):
+        (JSC::AccessGenerationState::AccessGenerationState):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::aboutToDie):
+        (JSC::StructureStubInfo::addAccessCase):
+        * bytecode/StructureStubInfo.h:
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
+        (JSC::AssemblyHelpers::loadProperty):
+        (JSC::emitRandomThunkImpl):
+        (JSC::AssemblyHelpers::emitRandomThunk):
+        (JSC::AssemblyHelpers::emitLoadStructure):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::loadValue):
+        (JSC::AssemblyHelpers::moveValueRegs):
+        (JSC::AssemblyHelpers::argumentsStart):
+        (JSC::AssemblyHelpers::emitStoreStructureWithTypeInfo):
+        (JSC::AssemblyHelpers::emitLoadStructure): Deleted.
+        * jit/GPRInfo.cpp:
+        (JSC::JSValueRegs::dump):
+        * jit/GPRInfo.h:
+        (JSC::JSValueRegs::uses):
+        * jit/Repatch.cpp:
+        (JSC::replaceWithJump):
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        * jit/ThunkGenerators.cpp:
+        (JSC::virtualThunkFor):
+        * runtime/Options.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::begin):
+        (JSC::PropertyTable::find):
+        (JSC::PropertyTable::get):
+        * runtime/Structure.h:
+
+2016-04-05  Antoine Quint  <graouts@apple.com>
+
+        [WebGL2] Turn the ENABLE_WEBGL2 flag on
+        https://bugs.webkit.org/show_bug.cgi?id=156061
+        <rdar://problem/25463193>
+
+        Reviewed by Alex Christensen.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * runtime/CommonIdentifiers.h:
+
+        Define the conditionalized classes WebGL2RenderingContext and WebGLVertexArrayObject. 
+
+2016-04-04  Zan Dobersek  <zdobersek@igalia.com>
+
+        Add missing EABI_32BIT_DUMMY_ARG arguments for some callOperation(J_JITOperation_EGReoJ, ...) overloads
+        https://bugs.webkit.org/show_bug.cgi?id=156161
+
+        Reviewed by Yusuke Suzuki.
+
+        r197641 added a couple of callOperation(J_JITOperation_EGReoJ, ...) overloads
+        that handle arguments split into the tag and the payload. The two were split
+        between the last argument register and the stack on 32-bit ARM EABI systems,
+        causing incorrect behavior.
+
+        Adding EABI_32BIT_DUMMY_ARG pushes the tag and payload together onto the
+        stack, removing the issue.
+
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+
+2016-04-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Avoid copying ModuleLoaderObject.js to resources bundle
+        https://bugs.webkit.org/show_bug.cgi?id=156188
+        <rdar://problem/25534383>
+
+        Reviewed by Alexey Proskuryakov.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2016-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling out r199016.
+        https://bugs.webkit.org/show_bug.cgi?id=156140
+
+        "Regressed Octane and Kraken on the perf bots."
+
+        Reverted changeset:
+
+        CopiedBlock should be 16kB
+        https://bugs.webkit.org/show_bug.cgi?id=156168
+        http://trac.webkit.org/changeset/199016
+
+2016-04-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC][x86] Fix an assertion in MacroAssembler::branch8()
+        https://bugs.webkit.org/show_bug.cgi?id=156181
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::branch8):
+        The test was wrong because valid negative numbers have ones
+        in the top bits.
+
+        I replaced the assertion to be explicit about the valid range.
+
+2016-04-04  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r196145): Crash in getOwnPropertyDescriptor on http://www.history.com/shows/vikings
+        https://bugs.webkit.org/show_bug.cgi?id=156136
+        <rdar://problem/25410767>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a few more identifiers for using in the generated bindings.
+
+        * runtime/CommonIdentifiers.h:
+
+2016-04-04  Geoffrey Garen  <ggaren@apple.com>
+
+        CopiedBlock should be 16kB
+        https://bugs.webkit.org/show_bug.cgi?id=156168
+
+        Reviewed by Mark Lam.
+
+        MarkedBlock is 16kB, and bmalloc's largest fast-path allocation is 16kB,
+        and the largest page size on Apple devices is 16kB -- so this change
+        should improve sharing and recycling and keep us on the fast path more.
+
+        32kB is also super aggro. At 16kB, we support allocations up to 8kB,
+        which covers 99.3% of allocations on facebook.com. The 32kB block size
+        only covered an additional 0.2% of allocations.
+
+        * heap/CopiedBlock.h:
+
+2016-04-04  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        REGRESSION(r198792): [GTK] Inspector crashes in Inspector::Protocol::getEnumConstantValue since r198792
+        https://bugs.webkit.org/show_bug.cgi?id=155745
+        <rdar://problem/25289456>
+
+        Reviewed by Brian Burg.
+
+        The problem is that we are generating the Inspector::Protocol::getEnumConstantValue() method and the
+        enum_constant_values array for every framework that has enum values. So, in case of GTK port we have two
+        implementations, one for the inspector in JavaScriptCore and another one for Web Automation in WebKit2, but when
+        using the inspector in WebKit2 we always end up using the one in WebKit2. Since the enum_constant_values array
+        is smaller in WebKit2 than the one in JavaScriptCore, we crash every time we receive an enum value higher than
+        the array size. We need to disambiguate the getEnumConstantValue() generated and used for every framework, so we
+        can use a specific namespace for the enum conversion methods.
+
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::breakpointActionTypeForString): Use Inspector::Protocol::InspectorHelpers.
+        * inspector/scripts/codegen/cpp_generator.py:
+        (CppGenerator.helpers_namespace): Return the namespace name that should be used for the helper methods.
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator._generate_async_dispatcher_class_for_domain): Use
+        CppGenerator.helpers_namespace() to use the right namespace when using getEnumConstantValue().
+        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command): Ditto.
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event): Ditto.
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
+        (CppProtocolTypesHeaderGenerator.generate_output): Move declaration of getEnumConstantValue to a helper function.
+        (_generate_enum_constant_value_conversion_methods): Do not emit any code if there aren't enums and ensure all
+        conversion methods are declared inside the helpers namespace.
+        (_generate_builder_setter_for_member): Use CppGenerator.helpers_namespace() to use the right namespace when
+        using getEnumConstantValue().
+        (_generate_unchecked_setter_for_member): Ditto.
+        (_generate_declarations_for_enum_conversion_methods): Return a list instead of a string so that we can return an
+        empty list in case of not emitting any code. The caller will use extend() that has no effect when an empty list
+        is passed.
+        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
+        (CppProtocolTypesImplementationGenerator.generate_output): Use the new helper function to generate both the enum
+        mapping and conversion methods inside the helpers namespace.
+        (CppProtocolTypesImplementationGenerator._generate_enum_mapping): Return a list instead of a string so that we
+        can return an empty list in case of not emitting any code.
+        (CppProtocolTypesImplementationGenerator._generate_enum_mapping_and_conversion_methods): Ensure we only emit
+        code when there are enum values, and it's generated inside the helpers namespace.
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-04-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed ARM buildfix after r198981.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::roundTowardZeroDouble):
+
+2016-04-03  Saam barati  <sbarati@apple.com>
+
+        Implement Annex B.3.3 function hoisting rules for function code
+        https://bugs.webkit.org/show_bug.cgi?id=155672
+
+        Reviewed by Geoffrey Garen.
+
+        The spec states that functions declared inside a function
+        inside a block scope are subject to the rules of Annex B.3.3:
+        https://tc39.github.io/ecma262/#sec-block-level-function-declarations-web-legacy-compatibility-semantics
+
+        The rule states that functions declared in such blocks should
+        be local bindings of the block. If declaring the function's name
+        as a "var" in the function would not lead to a syntax error (i.e,
+        if we don't have a let/const/class variable with the same name)
+        and if we don't have a parameter with the same name, then we
+        implictly also declare the funcion name as a "var". When evaluating
+        the block statement we bind the hoisted "var" to be the value
+        of the local function binding.
+
+        There is one more thing we do for web compatibility. We allow
+        function declarations inside if/else statements that aren't
+        blocks. For such statements, we transform the code as if the
+        function were declared inside a block statement. For example:
+        ``` function foo() { if (cond) function baz() { } }```
+        is transformed into:
+        ``` function foo() { if (cond) { function baz() { } } }```
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeBlockScopedFunctions):
+        * bytecompiler/BytecodeGenerator.h:
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ModuleProgramNode::ModuleProgramNode):
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionNode::FunctionNode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::hasCapturedVariables):
+        (JSC::ScopeNode::captures):
+        (JSC::ScopeNode::hasSloppyModeHoistedFunction):
+        (JSC::ScopeNode::varDeclarations):
+        (JSC::ProgramNode::startColumn):
+        (JSC::ProgramNode::endColumn):
+        (JSC::EvalNode::startColumn):
+        (JSC::EvalNode::endColumn):
+        (JSC::ModuleProgramNode::startColumn):
+        (JSC::ModuleProgramNode::endColumn):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::didFinishParsing):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseIfStatement):
+        * parser/Parser.h:
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareFunction):
+        (JSC::Scope::addSloppyModeHoistableFunctionCandidate):
+        (JSC::Scope::appendFunction):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::mergeInnerArrowFunctionFeatures):
+        (JSC::Scope::getSloppyModeHoistedFunctions):
+        (JSC::Scope::getCapturedVars):
+        (JSC::ScopeRef::containingScope):
+        (JSC::ScopeRef::operator==):
+        (JSC::ScopeRef::operator!=):
+        (JSC::Parser::declareFunction):
+        (JSC::Parser::hasDeclaredVariable):
+        (JSC::Parser::isFunctionMetadataNode):
+        (JSC::Parser::DepthManager::DepthManager):
+        (JSC::Parser<LexerType>::parse):
+        * parser/VariableEnvironment.h:
+        (JSC::VariableEnvironmentEntry::isImported):
+        (JSC::VariableEnvironmentEntry::isImportedNamespace):
+        (JSC::VariableEnvironmentEntry::isFunction):
+        (JSC::VariableEnvironmentEntry::isParameter):
+        (JSC::VariableEnvironmentEntry::isSloppyModeHoistingCandidate):
+        (JSC::VariableEnvironmentEntry::setIsCaptured):
+        (JSC::VariableEnvironmentEntry::setIsConst):
+        (JSC::VariableEnvironmentEntry::setIsImported):
+        (JSC::VariableEnvironmentEntry::setIsImportedNamespace):
+        (JSC::VariableEnvironmentEntry::setIsFunction):
+        (JSC::VariableEnvironmentEntry::setIsParameter):
+        (JSC::VariableEnvironmentEntry::setIsSloppyModeHoistingCandidate):
+        (JSC::VariableEnvironmentEntry::clearIsVar):
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeValue::SourceCodeValue):
+        * runtime/JSScope.cpp:
+        * runtime/JSScope.h:
+        * tests/es6.yaml:
+        * tests/stress/sloppy-mode-function-hoisting.js: Added.
+        (assert):
+        (test):
+        (falsey):
+        (truthy):
+        (test.):
+        (test.a):
+        (test.f):
+        (test.let.funcs.f):
+        (test.catch.f):
+        (test.foo):
+        (test.bar):
+        (test.switch.case.0):
+        (test.else.f):
+        (test.b):
+        (test.c):
+        (test.d):
+        (test.e):
+        (test.g):
+        (test.h):
+        (test.i):
+        (test.j):
+        (test.k):
+        (test.l):
+        (test.m):
+        (test.n):
+        (test.o):
+        (test.p):
+        (test.q):
+        (test.r):
+        (test.s):
+        (test.t):
+        (test.u):
+        (test.v):
+        (test.w):
+        (test.x):
+        (test.y):
+        (test.z):
+        (foo):
+        (bar):
+        (falsey.bar):
+        (baz):
+        (falsey.baz):
+
+2016-04-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, turn ES6 for-in loop test success
+        https://bugs.webkit.org/show_bug.cgi?id=155451
+
+        * tests/es6.yaml:
+
+2016-04-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Add truncate operation (rounding to zero)
+        https://bugs.webkit.org/show_bug.cgi?id=156072
+
+        Reviewed by Saam Barati.
+
+        Add TruncIntrinsic for Math.trunc. DFG handles it as ArithTrunc.
+        In DFG, ArithTrunc behaves similar to ArithRound, ArithCeil, and ArithFloor.
+        ArithTrunc rounds the value towards zero.
+
+        And we rewrite @toInteger to use @trunc instead of @abs, @floor, negation and branch.
+        This is completely the same to what we do in JSValue::toInteger.
+
+        Since DFG recognize it, DFG can convert ArithTrunc to Identity if the given argument is Int32.
+        This is useful because almost all the argument is Int32 in @toLength -> @toInteger -> @trunc case.
+        In such cases, we can eliminate trunc() call.
+
+        As a bonus, to speed up Math.trunc operation, we use x86 SSE round and frintz in ARM64 for ArithRound.
+        In DFG, we emit these instructions. In FTL, we use Patchpoint to emit these instructions to avoid adding a new B3 IR.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::roundTowardZeroDouble):
+        (JSC::MacroAssemblerARM64::roundTowardZeroFloat):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::roundTowardZeroDouble):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::roundTowardZeroDouble):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::roundTowardZeroDouble):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::roundTowardZeroDouble):
+        (JSC::MacroAssemblerX86Common::roundTowardZeroFloat):
+        * builtins/GlobalObject.js:
+        (toInteger):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::roundShouldSpeculateInt32):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasArithRoundingMode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithRounding):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithTrunc):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::doubleTrunc):
+        * ftl/FTLOutput.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::truncThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        * runtime/MathObject.h:
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+        * tests/stress/math-rounding-infinity.js:
+        (testTrunc):
+        * tests/stress/math-rounding-nan.js:
+        (testTrunc):
+        * tests/stress/math-rounding-negative-zero.js:
+        (testTrunc):
+        * tests/stress/math-trunc-arith-rounding-mode.js: Added.
+        (firstCareAboutZeroSecondDoesNot):
+        (firstDoNotCareAboutZeroSecondDoes):
+        (warmup):
+        (verifyNegativeZeroIsPreserved):
+        * tests/stress/math-trunc-basics.js: Added.
+        (mathTruncOnIntegers):
+        (mathTruncOnDoubles):
+        (mathTruncOnBooleans):
+        (uselessMathTrunc):
+        (mathTruncWithOverflow):
+        (mathTruncConsumedAsDouble):
+        (mathTruncDoesNotCareAboutMinusZero):
+        (mathTruncNoArguments):
+        (mathTruncTooManyArguments):
+        (testMathTruncOnConstants):
+        (mathTruncStructTransition):
+        (Math.trunc):
+        * tests/stress/math-trunc-should-be-truncate.js: Added.
+        (mathTrunc):
+
+2016-04-03  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Class syntax. Access to new.target inside of the eval should not lead to SyntaxError
+        https://bugs.webkit.org/show_bug.cgi?id=155545
+
+        Reviewed by Saam Barati.
+       
+        Current patch allow to invoke new.target in eval if this eval is executed within function, 
+        otherwise this will lead to Syntax error 
+   
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::getSlow):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::evalContextType):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::evalContextType):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::setEvalContextType):
+        (JSC::Scope::evalContextType):
+        (JSC::parse):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        * runtime/CodeCache.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::evalContextType):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * tests/stress/arrowfunction-lexical-bind-newtarget.js:
+        * tests/stress/new-target.js:
+
+2016-04-02  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r198976.
+        https://bugs.webkit.org/show_bug.cgi?id=156140
+
+        "Causes js/regress/array-nonarray-polymorhpic-access.html to
+        crash." (Requested by ddkilzer on #webkit).
+
+        Reverted changeset:
+
+        "[JSC] Initialize SSA's live values at tail lazily"
+        https://bugs.webkit.org/show_bug.cgi?id=156126
+        http://trac.webkit.org/changeset/198976
+
+2016-04-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Initialize SSA's live values at tail lazily
+        https://bugs.webkit.org/show_bug.cgi?id=156126
+
+        Reviewed by Mark Lam.
+
+        Setting up the clean state early looks harmless but it is
+        actually quite expensive.
+
+        The problem is AbstractValue is gigantic, you really want
+        to minimize how much you touch that memory.
+
+        By removing the initialization, most blocks only
+        get 2 or 3 accesses. Once to setup the value, and a few
+        queries for merging the current block with the successors.
+
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+        (JSC::DFG::setLiveValues): Deleted.
+        (JSC::DFG::InPlaceAbstractState::initialize): Deleted.
+
+2016-04-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add an option to avoid disassembling baseline code for the JSC Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=156127
+
+        Reviewed by Mark Lam.
+
+        The profiler run out of memory on big programs if you dump
+        the baseline disassembly.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * runtime/Options.h:
+
+2016-04-02  Dan Bernstein  <mitz@apple.com>
+
+        jsc binary embedded in relocatable JavaScriptCore.framework links against system JavaScriptCore.framework
+        https://bugs.webkit.org/show_bug.cgi?id=156134
+        <rdar://problem/25443824>
+
+        Reviewed by Mark Lam.
+
+        * Configurations/JSC.xcconfig: Define WK_RELOCATABLE_FRAMEWORKS_LDFLAGS when building
+          relocatable frameworks to include a -dyld_env option setting DYLD_FRAMEWORK_PATH to point
+          to the directory containing JavaScript.framework, and add
+          WK_RELOCATABLE_FRAMEWORKS_LDFLAGS to OTHER_LDFLAGS.
+
+2016-04-01  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC][x86] Add the 3 operands form of floating point substraction
+        https://bugs.webkit.org/show_bug.cgi?id=156095
+
+        Reviewed by Geoffrey Garen.
+
+        Same old, same old. Add the AVX form of subsd and subss.
+
+        Unfortunately, we cannot benefit from the 3 register form
+        in B3 yet because the Air script does not support CPU flags yet.
+        That can be fixed later.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::subDouble):
+        (JSC::MacroAssemblerX86Common::subFloat):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::vsubsd_rr):
+        (JSC::X86Assembler::subsd_mr):
+        (JSC::X86Assembler::vsubsd_mr):
+        (JSC::X86Assembler::vsubss_rr):
+        (JSC::X86Assembler::subss_mr):
+        (JSC::X86Assembler::vsubss_mr):
+        (JSC::X86Assembler::X86InstructionFormatter::SingleInstructionBufferWriter::memoryModRM):
+        * b3/air/AirOpcode.opcodes:
+
+2016-04-01  Alberto Garcia  <berto@igalia.com>
+
+        [JSC] Missing PATH_MAX definition
+        https://bugs.webkit.org/show_bug.cgi?id=156102
+
+        Reviewed by Yusuke Suzuki.
+
+        Not all systems define PATH_MAX, so add a fallback value that is
+        long enough.
+
+        * jsc.cpp:
+
+2016-03-31  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] CFA's valuesAtHead should be a list, not a map
+        https://bugs.webkit.org/show_bug.cgi?id=156087
+
+        Reviewed by Mark Lam.
+
+        One more step toward moving to the Air-style of liveness analysis:
+
+        Make DFG's valuesAtHead a list of Node*-AbstractValue.
+        This patch alone is already a speedup because our many CFAs
+        spend an unreasonable amount of time updating at block boundaries.
+
+        * dfg/DFGBasicBlock.h:
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::performBlockCFA):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
+        (JSC::DFG::setLiveValues):
+        (JSC::DFG::InPlaceAbstractState::merge):
+        * dfg/DFGNode.h:
+        (JSC::DFG::nodeValuePairComparator):
+        (JSC::DFG::nodeValuePairListDump):
+
+2016-03-31  Saam barati  <sbarati@apple.com>
+
+        Revert rewrite const as var workaround
+        https://bugs.webkit.org/show_bug.cgi?id=155393
+
+        Reviewed by Mark Lam.
+
+        * parser/Parser.h:
+        (JSC::Parser::next):
+        (JSC::Parser::nextExpectIdentifier):
+        * runtime/VM.h:
+        (JSC::VM::setShouldRewriteConstAsVar): Deleted.
+        (JSC::VM::shouldRewriteConstAsVar): Deleted.
+
+2016-03-31  Saam barati  <sbarati@apple.com>
+
+        [ES6] Disallow var assignments in for-in loops
+        https://bugs.webkit.org/show_bug.cgi?id=155451
+
+        Reviewed by Mark Lam.
+
+        We're doing this in its own patch instead of the patch for https://bugs.webkit.org/show_bug.cgi?id=155384
+        because last time we made this change it broke some websites. Lets try making
+        it again because it's what the ES6 mandates. If it still breaks things we will
+        roll it out.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseForStatement):
+
+2016-03-31  Saam barati  <sbarati@apple.com>
+
+        parsing arrow function expressions slows down the parser by 8% lets recoup some loss
+        https://bugs.webkit.org/show_bug.cgi?id=155988
+
+        Reviewed by Benjamin Poulain.
+
+        We used to eagerly check if we're parsing an arrow function.
+        We did this inside parseAssignmentExpression(), and it was
+        very costly. The reason it was costly is that arrow functions
+        might start with an identifier. This means anytime we saw an
+        identifier we would have to do a lookahead, and then most likely
+        backtrack because more often than not, we wouldn't see "=>"
+        as the next token.
+
+        In this patch I implement a new approach. We just parse
+        the lhs of an assignment expression eagerly without doing any
+        lookahead. Retroactively, if we see that we might have started
+        with an arrow function, and we don't have a valid lhs or the
+        next token is a "=>", we try to parse as an arrow function.
+
+        Here are a few examples motivating why this is valid:
+
+        `x => x`
+        In this example:
+        - "x" is a valid arrow function starting point.
+        - "x" also happens to be a valid lhs
+        - because we see "=>" as the next token, we parse as an arrow function and succeed.
+
+        `(x) => x`
+        In this example:
+        - "(" is a valid arrow function starting point.
+        - "(x)" also happens to be a valid lhs
+        - because we see "=>" as the next token, we parse as an arrow function and succeed.
+
+        `({x = 30}) => x;`
+        In this example:
+        - "(" is a valid arrow function starting point.
+        - "({x = 30})" is NOT a valid lhs. Because of this, we try to parse it as an arrow function and succeed.
+
+        There is one interesting implementation detail where we might
+        parse something that is both a valid LHS but happens
+        to actually be the arrow function parameters. The valid LHS
+        parsing might declare such variables as "uses" which would cause 
+        weird capture analysis. This patch also introduces a mechanism
+        to backtrack on used variable analysis.
+
+        This is a 3.5%-4.5% octane code load speedup.
+
+        * parser/Lexer.h:
+        (JSC::Lexer::sawError):
+        (JSC::Lexer::setSawError):
+        (JSC::Lexer::getErrorMessage):
+        (JSC::Lexer::setErrorMessage):
+        (JSC::Lexer::sourceURL):
+        (JSC::Lexer::sourceMappingURL):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::startSwitch):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::usedVariablesContains):
+        (JSC::Scope::useVariable):
+        (JSC::Scope::pushUsedVariableSet):
+        (JSC::Scope::currentUsedVariablesSize):
+        (JSC::Scope::revertToPreviousUsedVariables):
+        (JSC::Scope::setNeedsFullActivation):
+        (JSC::Scope::needsFullActivation):
+        (JSC::Scope::isArrowFunctionBoundary):
+        (JSC::Scope::setInnerArrowFunctionUsesEvalAndUseArgumentsIfNeeded):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::fillParametersForSourceProviderCache):
+        (JSC::Scope::restoreFromSourceProviderCache):
+        (JSC::Scope::setIsModule):
+
+2016-03-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Fails to build in Linux / PowerPC due to different ucontext_t definition
+        https://bugs.webkit.org/show_bug.cgi?id=156015
+
+        Reviewed by Michael Catanzaro.
+
+        PPC does not have mcontext_t in ucontext_t::uc_mcontext.
+        So we take the special way to retrieve mcontext_t in PPC.
+
+        * heap/MachineStackMarker.cpp:
+        (pthreadSignalHandlerSuspendResume):
+
+2016-03-31  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC][x86] Add the indexed forms of floating point addition and multiplication
+        https://bugs.webkit.org/show_bug.cgi?id=156058
+
+        Reviewed by Geoffrey Garen.
+
+        B3 supports lowering [base, index] addresses into
+        arbitrary instructions but we were not using that feature.
+
+        This patch adds the missing support for the lowering
+        of Add and Mul.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::addFloat):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::mulFloat):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addsd_mr):
+        (JSC::X86Assembler::vaddsd_mr):
+        (JSC::X86Assembler::addss_mr):
+        (JSC::X86Assembler::vaddss_mr):
+        (JSC::X86Assembler::mulsd_mr):
+        (JSC::X86Assembler::vmulsd_mr):
+        (JSC::X86Assembler::mulss_mr):
+        (JSC::X86Assembler::vmulss_mr):
+        (JSC::X86Assembler::X86InstructionFormatter::SingleInstructionBufferWriter::memoryModRM):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        Unlike the Addr form, we never need to transform a Tmp
+        into an Index for spilling.
+
+        Instead of duplicating all the code in MacroAssembler, I can
+        just have the lowering phase try using addresses for the first
+        argument when possible.
+
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/testair.cpp:
+        (JSC::B3::Air::testX86VMULSDBaseNeedsRex):
+        (JSC::B3::Air::testX86VMULSDIndexNeedsRex):
+        (JSC::B3::Air::testX86VMULSDBaseIndexNeedRex):
+        (JSC::B3::Air::run):
+
+2016-03-31  Saam barati  <sbarati@apple.com>
+
+        DFG JIT bug in typeof constant folding where the input to typeof is an object or function
+        https://bugs.webkit.org/show_bug.cgi?id=156034
+        <rdar://problem/25446785>
+
+        Reviewed by Ryosuke Niwa.
+
+        AI would constant fold TypeOf to the string "object" if it saw that
+        its input type didn't expand past the types contained in the set 
+        "SpecObject - SpecObjectOther". But, SpecObject contains SpecFunction.
+        And typeof of a function should return "function". This patch fixes
+        this bug by making sure we constant fold to object iff the type
+        doesn't expand past the set "SpecObject - SpecObjectOther - SpecFunction".
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * tests/stress/typeof-dfg-function-or-object.js: Added.
+        (assert):
+        (foo.else.o):
+        (foo):
+
+2016-03-31  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: Build and logic fix after r198873.
+        https://bugs.webkit.org/show_bug.cgi?id=156043
+
+        Not reviewed.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::addFloat):
+        - 2 args were meant to be ordered differently in order to call the other addFloat.
+          Instead, there was an infinite recursion bug.  This is now fixed.
+
+2016-03-30  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC][x86] Add the 3 operands forms of floating point addition and multiplication
+        https://bugs.webkit.org/show_bug.cgi?id=156043
+
+        Reviewed by Geoffrey Garen.
+
+        When they are available, VADD and VMUL are better options to lower
+        floating point addition and multiplication.
+
+        In the simple cases when one of the operands is aliased to the destination,
+        those forms have the same size or 1 byte shorter depending on the registers.
+
+        In the more advanced cases, we gain nice advantages with the new forms:
+        -We can get rid of the MoveDouble in front the instruction when we cannot
+         alias.
+        -We can disable aliasing entirely in Air. That is useful for latency
+         since computing coalescing is not exactly cheap.
+
+        * assembler/MacroAssemblerX86Common.cpp:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        The change in B3LowerToAir exposed a bug in the fake 3 operands
+        forms of those instructions. If the address is equal to
+        the destination, we were nuking the address.
+
+        For example,
+            Add32([%r11], %eax, %r11)
+        would generate:
+            move %eax, %r11
+            add32 [%r11], %r11
+        which crashes.
+
+        I updated codegen of those cases to support that case through
+            load32 [%r11], %r11
+            add32 %eax, %r11
+
+        The weird case were all arguments have the same registers
+        is handled too.
+
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::addFloat):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::mulFloat):
+        (JSC::MacroAssemblerX86Common::supportsFloatingPointRounding):
+        (JSC::MacroAssemblerX86Common::supportsAVX):
+        (JSC::MacroAssemblerX86Common::updateEax1EcxFlags):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branchAdd64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::vaddsd_rr):
+        (JSC::X86Assembler::vaddsd_mr):
+        (JSC::X86Assembler::vaddss_rr):
+        (JSC::X86Assembler::vaddss_mr):
+        (JSC::X86Assembler::vmulsd_rr):
+        (JSC::X86Assembler::vmulsd_mr):
+        (JSC::X86Assembler::vmulss_rr):
+        (JSC::X86Assembler::vmulss_mr):
+        (JSC::X86Assembler::X86InstructionFormatter::SingleInstructionBufferWriter::memoryModRM):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        Add the 3 operand forms so that we lower Add and Mul
+        to the best form directly.
+
+        I will change how we lower the fake 3 operands instructions
+        but the codegen should end up the same in most cases.
+        The new codegen is the load32 + op above.
+
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::shouldTryAliasingDef):
+        * b3/air/testair.cpp:
+        (JSC::B3::Air::testX86VMULSD):
+        (JSC::B3::Air::testX86VMULSDDestRex):
+        (JSC::B3::Air::testX86VMULSDOp1DestRex):
+        (JSC::B3::Air::testX86VMULSDOp2DestRex):
+        (JSC::B3::Air::testX86VMULSDOpsDestRex):
+        (JSC::B3::Air::testX86VMULSDAddr):
+        (JSC::B3::Air::testX86VMULSDAddrOpRexAddr):
+        (JSC::B3::Air::testX86VMULSDDestRexAddr):
+        (JSC::B3::Air::testX86VMULSDRegOpDestRexAddr):
+        (JSC::B3::Air::testX86VMULSDAddrOpDestRexAddr):
+        Make sure we have some coverage for AVX encoding of instructions.
+
+2016-03-30  Saam Barati  <sbarati@apple.com>
+
+        Change some release asserts in CodeBlock linking into debug asserts
+        https://bugs.webkit.org/show_bug.cgi?id=155500
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+
+2016-03-30  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unused ScriptProfiler.Samples.totalTime
+        https://bugs.webkit.org/show_bug.cgi?id=156002
+
+        Reviewed by Saam Barati.
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::buildSamples):
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        * inspector/protocol/ScriptProfiler.json:
+        Remove totalTime.
+
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::SamplingProfiler): Deleted.
+        * runtime/SamplingProfiler.h:
+        (JSC::SamplingProfiler::totalTime): Deleted.
+        Remove now unused m_totalTime.
+
+2016-03-30  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Quantified unicode regular expressions do not work for counts greater than 1
+        https://bugs.webkit.org/show_bug.cgi?id=156044
+
+        Reviewed by Mark Lam.
+
+        Fixed incorrect indexing of non-BMP characters in fixed patterns.  The old code
+        was indexing by character units, a single JS character, instead of code points
+        which is 2 JS characters.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchDisjunction):
+
+2016-03-30  Mark Lam  <mark.lam@apple.com>
+
+        Make the $vm debugging tools available to builtins as @$vm.
+        https://bugs.webkit.org/show_bug.cgi?id=156012
+
+        Reviewed by Saam Barati.
+
+        We also need some debugging tools for builtin development.  The $vm object will
+        be made available to builtins as @$vm, which gives us, amongst many goodies,
+        @$vm.print() (which prints the toString() values of its args) and
+        @$vm.printValue() (which dataLogs its arg as a JSValue).  @$vm will only be
+        available if we run with JSC_useDollarVM=true.
+
+        Also changed @$vm.print() to not automatically insert a space between the
+        printing of each of its args.  This makes it clearer as to what will be printed
+        i.e. it will only print what is passed to it.
+
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::BuiltinNames):
+        (JSC::BuiltinNames::dollarVMPublicName):
+        (JSC::BuiltinNames::dollarVMPrivateName):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionPrint):
+
+2016-03-30  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, buildfix.
+
+        * bytecode/BytecodeIntrinsicRegistry.h:
+
+2016-03-30  Keith Miller <keith_miller@apple.com>
+
+        Unreviewed, rollout r198808. The patch causes crashes on 32-bit and appears to be a JSBench regression.
+
+2016-03-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Implement String.prototype.repeat in builtins JS
+        https://bugs.webkit.org/show_bug.cgi?id=155974
+
+        Reviewed by Darin Adler.
+
+        This patch converts C++ String.prototype.repeat implementation into JS builtins.
+        |this| in strict mode is correctly inferred as String[1]. This fact encourages us
+        to write PrimitiveTypes.prototype.XXX methods in builtin JS.
+
+        LayoutTests/js/string-repeat.html already covers the tests for this change.
+
+        Note: String.prototype.repeat functionality is similar to Harmony's
+        String.prototype.{padStart, padEnd}. It's nice to port them to builtin JS in
+        the other patch.
+
+        The existing C++ code has the fast path for singleCharacterString repeating.
+        Since this use is important (e.g. generating N length spaces: ' '.repeat(N)),
+        we keep this fast path as @repeatCharacter().
+
+        The performance results show that, while the performance of the single character fast path
+        is neutral, other string repeating has significant speed up.
+        There are two reasons.
+
+        1. Not resolving string rope.
+
+        We added several tests postfixed "not-resolving". In that tests, we do not touch the content
+        of the generated string. As a result, the generated rope is not resolved.
+
+        2. O(log N) intermediate JSRopeStrings.
+
+        In the existing C++ implementation, we use JSString::RopeBuilder. We iterate N times and append
+        the given string to the builder.
+        In this case, the intermediate rope strings generated in JSString::RopeBuilder is O(N).
+        In JS builtin implementation, we only iterate log N times. As a result, the number of the
+        intermediate rope strings becomes O(log N).
+
+        [1]: http://trac.webkit.org/changeset/195938
+
+        * builtins/StringPrototype.js:
+        (repeatSlowPath):
+        (repeat):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncRepeatCharacter):
+        (JSC::StringPrototype::finishCreation): Deleted.
+        (JSC::stringProtoFuncRepeat): Deleted.
+        * runtime/StringPrototype.h:
+        * tests/stress/string-repeat-edge-cases.js: Added.
+        (shouldBe):
+        (let.object.toString):
+        (valueOf):
+        (shouldThrow):
+
+2016-03-30  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Update udis86
+        https://bugs.webkit.org/show_bug.cgi?id=156005
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * disassembler/udis86/differences.txt:
+        * disassembler/udis86/itab.py: Removed.
+        * disassembler/udis86/optable.xml:
+        * disassembler/udis86/ud_itab.py: Added.
+        * disassembler/udis86/ud_opcode.py:
+        * disassembler/udis86/ud_optable.py: Removed.
+        * disassembler/udis86/udis86.c:
+        * disassembler/udis86/udis86_decode.c:
+        * disassembler/udis86/udis86_decode.h:
+        * disassembler/udis86/udis86_extern.h:
+        * disassembler/udis86/udis86_input.c: Removed.
+        * disassembler/udis86/udis86_input.h: Removed.
+        * disassembler/udis86/udis86_syn-att.c:
+        * disassembler/udis86/udis86_syn.h:
+        * disassembler/udis86/udis86_types.h:
+        * disassembler/udis86/udis86_udint.h:
+
+2016-03-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Get rid of operationInitGlobalConst(), it is useless
+        https://bugs.webkit.org/show_bug.cgi?id=156010
+
+        Reviewed by Geoffrey Garen.
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+
+2016-03-29  Saam barati  <sbarati@apple.com>
+
+        Fix typos in our error messages and remove some trailing periods
+        https://bugs.webkit.org/show_bug.cgi?id=155985
+
+        Reviewed by Mark Lam.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * runtime/ArrayConstructor.h:
+        (JSC::isArray):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::makeRevocableProxy):
+        (JSC::proxyRevocableConstructorThrowError):
+        (JSC::ProxyConstructor::finishCreation):
+        (JSC::constructProxyObject):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::finishCreation):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::performPut):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+        * runtime/Structure.cpp:
+        (JSC::Structure::preventExtensionsTransition):
+        * tests/stress/proxy-basic.js:
+        * tests/stress/proxy-construct.js:
+        (throw.new.Error):
+        (assert):
+        * tests/stress/proxy-define-own-property.js:
+        (assert):
+        (throw.new.Error):
+        (i.catch):
+        (assert.set get catch):
+        * tests/stress/proxy-delete.js:
+        (assert):
+        * tests/stress/proxy-get-own-property.js:
+        (assert):
+        (i.catch):
+        (set get let):
+        * tests/stress/proxy-get-prototype-of.js:
+        (assert):
+        (assert.get let):
+        (assert.get catch):
+        * tests/stress/proxy-has-property.js:
+        (assert):
+        * tests/stress/proxy-is-array.js:
+        (test):
+        * tests/stress/proxy-is-extensible.js:
+        (assert):
+        * tests/stress/proxy-json.js:
+        (assert):
+        (test):
+        * tests/stress/proxy-own-keys.js:
+        (assert):
+        (i.catch):
+        * tests/stress/proxy-prevent-extensions.js:
+        (assert):
+        * tests/stress/proxy-property-descriptor.js:
+        * tests/stress/proxy-revoke.js:
+        (assert):
+        (throw.new.Error.):
+        (throw.new.Error):
+        (shouldThrowNullHandler):
+        * tests/stress/proxy-set-prototype-of.js:
+        (assert.set let):
+        (assert.set catch):
+        (assert):
+        (set catch):
+        * tests/stress/proxy-set.js:
+        (throw.new.Error.let.handler.set 45):
+        (throw.new.Error):
+        * tests/stress/proxy-with-private-symbols.js:
+        (assert):
+        * tests/stress/proxy-with-unbalanced-getter-setter.js:
+        (assert):
+        * tests/stress/reflect-set-proxy-set.js:
+        (throw.new.Error.let.handler.set 45):
+        (throw.new.Error):
+        * tests/stress/reflect-set-receiver-proxy-set.js:
+        (let.handler.set 45):
+        (catch):
+        * tests/stress/string-prototype-methods-endsWith-startsWith-includes-correctness.js:
+        (test):
+        (test.get let):
+
+2016-03-29  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add support for Symbol.isConcatSpreadable.
+        https://bugs.webkit.org/show_bug.cgi?id=155351
+
+        Reviewed by Saam Barati.
+
+        This patch adds support for Symbol.isConcatSpreadable. In order to do so it was necessary to move the
+        Array.prototype.concat function to JS. A number of different optimizations were needed to make such the move to
+        a builtin performant. First, four new DFG intrinsics were added.
+
+        1) IsArrayObject (I would have called it IsArray but we use the same name for an IndexingType): an intrinsic of
+           the Array.isArray function.
+        2) IsJSArray: checks the first child is a JSArray object.
+        3) IsArrayConstructor: checks the first child is an instance of ArrayConstructor.
+        4) CallObjectConstructor: an intrinsic of the Object constructor.
+
+        IsActualObject, IsJSArray, and CallObjectConstructor can all be converted into constants in the abstract interpreter if
+        we are able to prove that the first child is an Array or for ToObject an Object.
+
+        In order to further improve the perfomance we also now cover more indexing types in our fast path memcpy
+        code. Before we would only memcpy Arrays if they had the same indexing type and did not have Array storage and
+        were not undecided. Now the memcpy code covers the following additional two cases: One array is undecided and
+        the other is a non-array storage and the case where one array is Int32 and the other is contiguous (we map this
+        into a contiguous array).
+
+        This patch also adds a new fast path for concat with more than one array argument by using memcpy to append
+        values onto the result array. This works roughly the same as the two array fast path using the same methodology
+        to decide if we can memcpy the other butterfly into the result butterfly.
+
+        Two new debugging tools are also added to the jsc cli. One is a version of the print function with a private
+        name so it can be used for debugging builtins. The other is dumpDataLog, which takes a JSValue and runs our
+        dataLog function on it.
+
+        Finally, this patch add a new constructor to JSValueRegsTemporary that allows it to reuse the the registers of a
+        JSValueOperand if the operand's use count is one.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ArrayPrototype.js:
+        (concatSlowPath):
+        (concat):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        (JSC::DFG::SpeculativeJIT::compileIsJSArray):
+        (JSC::DFG::SpeculativeJIT::compileIsArrayObject):
+        (JSC::DFG::SpeculativeJIT::compileIsArrayConstructor):
+        (JSC::DFG::SpeculativeJIT::compileCallObjectConstructor):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsArrayConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::isArray):
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (WTF::RuntimeArray::createStructure):
+        (GlobalObject::finishCreation):
+        (functionDebug):
+        (functionDataLogValue):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        (JSC::isArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        (JSC::arrayProtoPrivateFuncIsJSArray):
+        (JSC::moveElements):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        (JSC::arrayProtoPrivateFuncAppendMemcpy):
+        (JSC::arrayProtoFuncConcat): Deleted.
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::createStructure):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::fastConcatWith): Deleted.
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::JSArray::fastConcatType): Deleted.
+        * runtime/JSArrayInlines.h: Added.
+        (JSC::JSArray::memCopyWithIndexingType):
+        (JSC::JSArray::canFastCopy):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSType.h:
+        * runtime/ObjectConstructor.h:
+        (JSC::constructObject):
+        * tests/es6.yaml:
+        * tests/stress/array-concat-spread-object.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-spread-proxy-exception-check.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-spread-proxy.js: Added.
+        (arrayEq):
+        * tests/stress/array-concat-with-slow-indexingtypes.js: Added.
+        (arrayEq):
+        * tests/stress/array-species-config-array-constructor.js:
+
+2016-03-29  Saam barati  <sbarati@apple.com>
+
+        We don't properly optimize TDZ checks when we declare a let variable without an initializer
+        https://bugs.webkit.org/show_bug.cgi?id=150453
+
+        Reviewed by Mark Lam.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::EmptyLetExpression::emitBytecode):
+
+2016-03-29  Saam barati  <sbarati@apple.com>
+
+        Allow builtin JS functions to be intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=155960
+
+        Reviewed by Mark Lam.
+
+        Builtin functions can now be recognized as intrinsics inside
+        the DFG. This gives us the flexibility to either lower a builtin
+        as an intrinsic in the DFG or as a normal function call.
+        Because we may decide to not lower it as an intrinsic, the DFG
+        inliner could still inline the function call.
+
+        You can annotate a builtin function like so to make
+        it be recognized as an intrinsic.
+        ```
+        [intrinsic=FooIntrinsic] function foo() { ... }
+        ```
+        where FooIntrinsic is an enum value of the Intrinsic enum.
+
+        So in the future if we write RegExp.prototype.test as a builtin, we would do:
+        ``` RegExpPrototype.js
+        [intrinsic=RegExpTestIntrinsic] function test() { ... }
+        ```
+
+        * Scripts/builtins/builtins_generate_combined_implementation.py:
+        (BuiltinsCombinedImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generate_separate_implementation.py:
+        (BuiltinsSeparateImplementationGenerator.generate_secondary_header_includes):
+        * Scripts/builtins/builtins_generator.py:
+        (BuiltinsGenerator.generate_embedded_code_string_section_for_function):
+        * Scripts/builtins/builtins_model.py:
+        (BuiltinObject.__init__):
+        (BuiltinFunction):
+        (BuiltinFunction.__init__):
+        (BuiltinFunction.fromString):
+        (BuiltinFunction.__str__):
+        * Scripts/builtins/builtins_templates.py:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        (JSC::UnlinkedFunctionExecutable::link):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        * runtime/Executable.cpp:
+        (JSC::ExecutableBase::clearCode):
+        (JSC::NativeExecutable::destroy):
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::ExecutableBase::intrinsic): Deleted.
+        (JSC::NativeExecutable::intrinsic): Deleted.
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::ExecutableBase):
+        (JSC::ExecutableBase::hasJITCodeFor):
+        (JSC::ExecutableBase::intrinsic):
+        (JSC::ExecutableBase::intrinsicFor):
+        (JSC::ScriptExecutable::finishCreation):
+        * runtime/Intrinsic.h:
+
+2016-03-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        JSC::Debugger cleanup after recent changes
+        https://bugs.webkit.org/show_bug.cgi?id=155982
+
+        Reviewed by Mark Lam.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        Initialize with breakpoints disabled. Web Inspector always informs
+        the backend if it should enable or disable breakpoints on startup.
+
+        (JSC::Debugger::setProfilingClient):
+        When using the Sampling profiler we do not need to recompile.
+
+2016-03-29  Saam barati  <sbarati@apple.com>
+
+        "Can not" => "cannot" in String.prototype error messages
+        https://bugs.webkit.org/show_bug.cgi?id=155895
+
+        Reviewed by Mark Lam.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+        * tests/stress/string-prototype-methods-endsWith-startsWith-includes-correctness.js:
+        (test):
+        (test.get let):
+
+2016-03-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: We should have a way to capture heap snapshots programatically.
+        https://bugs.webkit.org/show_bug.cgi?id=154407
+        <rdar://problem/24726292>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/protocol/Console.json:
+        Add a new Console.heapSnapshot event for when a heap snapshot is taken.
+
+        * runtime/ConsolePrototype.cpp:
+        (JSC::ConsolePrototype::finishCreation):
+        (JSC::consoleProtoFuncProfile):
+        (JSC::consoleProtoFuncProfileEnd):
+        (JSC::consoleProtoFuncTakeHeapSnapshot):
+        * runtime/ConsoleClient.h:
+        Add the console.takeHeapSnapshot method and dispatch to the ConsoleClient.
+
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::takeHeapSnapshot):
+        * inspector/JSGlobalObjectConsoleClient.h:
+        Have the InspectorConsoleAgent handle this.
+
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::InspectorConsoleAgent):
+        (Inspector::InspectorConsoleAgent::takeHeapSnapshot):
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/JSGlobalObjectConsoleAgent.cpp:
+        (Inspector::JSGlobalObjectConsoleAgent::JSGlobalObjectConsoleAgent):
+        * inspector/agents/JSGlobalObjectConsoleAgent.h:
+        Give the ConsoleAgent a HeapAgent pointer so that it can have the HeapAgent
+        perform the snapshot building work like it normally does.
+
+2016-03-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION(r192914): 10% regression on Sunspider's date-format-tofte
+        https://bugs.webkit.org/show_bug.cgi?id=155559
+
+        Reviewed by Saam Barati.
+
+        The fast path of the eval function is the super hot path in date-format-tofte.
+        Any performance regression is not allowed here.
+        Before this patch, we allocated SourceCode in the fast path.
+        This allocation incurs 10% performance regression.
+
+        This patch removes this allocation in the fast path.
+        And change the key of the EvalCodeCache to EvalCodeCache::CacheKey.
+        It combines RefPtr<StringImpl> and isArrowFunctionContext.
+        Since EvalCodeCache does not cache any eval code evaluated under the strict mode,
+        it is unnecessary to include several options (ThisTDZMode, and DerivedContextType) in the cache map's key.
+        But isArrowFunctionContext is necessary since the sloppy mode arrow function exists.
+
+        To validate this change, we add a new test that evaluates the same code
+        under the non-arrow function context and the arrow function context.
+
+        After introducing CacheKey, we observed 1% regression compared to the RefPtr<StringImpl> keyed case.
+        This is because HashMap<RefPtr<T>, ...>::get(T*) is specially optimized; this path is inlined while the normal ::get() is not inlined.
+        To avoid this performance regression, we introduce HashMap::fastGet, that aggressively encourages inlining.
+        The relationship between fastGet() and get() is similar to fastAdd() and add().
+        After applying this change, the evaluation shows no performance regression in comparison with the RefPtr<StringImpl> keyed case.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::CacheKey::CacheKey):
+        (JSC::EvalCodeCache::CacheKey::hash):
+        (JSC::EvalCodeCache::CacheKey::isEmptyValue):
+        (JSC::EvalCodeCache::CacheKey::operator==):
+        (JSC::EvalCodeCache::CacheKey::isHashTableDeletedValue):
+        (JSC::EvalCodeCache::CacheKey::Hash::hash):
+        (JSC::EvalCodeCache::CacheKey::Hash::equal):
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        (JSC::EvalCodeCache::isCacheable):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * tests/stress/eval-in-arrow-function.js: Added.
+        (shouldBe):
+        (i):
+
+2016-03-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Audit WebCore builtins for user overridable code
+        https://bugs.webkit.org/show_bug.cgi?id=155923
+
+        Reviewed by Youenn Fablet.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        Expose @Object.@defineProperty to built-ins.
+
+2016-03-28  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] ArithSub should not propagate "UsesAsOther"
+        https://bugs.webkit.org/show_bug.cgi?id=155932
+
+        Reviewed by Mark Lam.
+
+        The node ArithSub was backpropagating UsesAsOther.
+        This causes any GetByVal on a Double Array to have an extra
+        hole check if it flows into an ArithSub.
+
+        The definition of ArithSub (12.8.4.1) has both operands go
+        through ToNumber(). ToNumber() on "undefined" always produces
+        NaN. It is safe to ignore the NaN marker from hole when
+        the DAG flows into ArithSub.
+
+        This patch also adds this change and test coverage to ArithAdd.
+        ArithAdd was not a problem in practice because it is only
+        generated before Fixup if both operands are known to be numerical.
+        The change to ArithAdd is there to protect us of the ArithSub-like
+        problems if we ever improve our support of arithmetic operators.
+
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::BackwardsPropagationPhase::propagate):
+        * tests/stress/arith-add-on-double-array-with-holes.js: Added.
+        (let.testCase.of.testCases.eval.nonObservableHoleOnLhs):
+        (let.testCase.of.testCases.observableHoleOnLhs):
+        (let.testCase.of.testCases.nonObservableHoleOnRhs):
+        (let.testCase.of.testCases.observableHoleOnRhs):
+        * tests/stress/arith-sub-on-double-array-with-holes.js: Added.
+        (let.testCase.of.testCases.eval.nonObservableHoleOnLhs):
+        (let.testCase.of.testCases.observableHoleOnLhs):
+        (let.testCase.of.testCases.nonObservableHoleOnRhs):
+        (let.testCase.of.testCases.observableHoleOnRhs):
+        * tests/stress/value-add-on-double-array-with-holes.js: Added.
+        (let.testCase.of.testCases.eval.nonObservableHoleOnLhs):
+        (let.testCase.of.testCases.observableHoleOnLhs):
+        (let.testCase.of.testCases.nonObservableHoleOnRhs):
+        (let.testCase.of.testCases.observableHoleOnRhs):
+
+2016-03-28  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: protocol generator should generate C++ string-to-enum helper functions
+        https://bugs.webkit.org/show_bug.cgi?id=155691
+        <rdar://problem/25258078>
+
+        Reviewed by Timothy Hatcher.
+
+        There's a lot of code throughout the Inspector agents and automation code
+        that needs to convert a raw string into a typed protocol enum. Generate
+        some helpers that do this conversion so clients can move over to using it.
+
+        These helpers are necessary for when we eventually switch to calling backend
+        dispatcher handlers with typed arguments instead of untyped JSON objects.
+
+        To correctly generate a conversion function for an anonymous enum, the
+        generator needs to be able to get the containing object type's declaration.
+        Since the model's Type object each have only one instance, there is a
+        one-to-one association between type and its declaration.
+
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
+        (CppProtocolTypesHeaderGenerator.generate_output):
+        (CppProtocolTypesHeaderGenerator._generate_forward_declarations):
+        Clean up this method to use methodcaller to sort types by raw name.
+
+        (_generate_declarations_for_enum_conversion_methods):
+        (_generate_declarations_for_enum_conversion_methods.return_type_with_export_macro):
+        (_generate_declarations_for_enum_conversion_methods.type_member_is_anonymous_enum_type):
+        Added. Generates a new section with an unfilled template and specializations of
+        the template for every named and anonymous enum in every domain. Guards for
+        domains wrap the forward declarations. This is added to the end of the header
+        file so that specializations for both types of enums are in the same place.
+
+        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
+        (CppProtocolTypesImplementationGenerator.generate_output):
+        (CppProtocolTypesImplementationGenerator._generate_enum_conversion_methods_for_domain):
+        (CppProtocolTypesImplementationGenerator._generate_enum_conversion_methods_for_domain.type_member_is_anonymous_enum_type):
+        (CppProtocolTypesImplementationGenerator._generate_enum_conversion_methods_for_domain.generate_conversion_method_body):
+        Added. Generate a static array of offsets into the enum constant value array.
+        Then, loop over this array of offsets and do string comparisons against the
+        provided string and enum constant values at the relevant offsets for this enum.
+
+        * inspector/scripts/codegen/generator_templates.py:
+        (GeneratorTemplates): Update copyright year in generated files.
+
+        * inspector/scripts/codegen/models.py:
+        (AliasedType.__init__):
+        (EnumType.__init__):
+        (EnumType.enum_values):
+        (EnumType.declaration):
+        (ArrayType.__init__):
+        (ArrayType.declaration):
+        (ObjectType.__init__):
+        (ObjectType.declaration):
+        (Protocol.resolve_types):
+        (Protocol.lookup_type_reference):
+        Pass the type declaration to Type constructors if available. If not,
+        fill in a placeholder name for the type in the constructor instead of caller.
+
+        Rebaseline all the things, mostly for copyright block changes.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-03-25  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Misc. JavaScriptCore built-ins cleanups
+        https://bugs.webkit.org/show_bug.cgi?id=155920
+
+        Reviewed by Mark Lam.
+
+        * builtins/RegExpPrototype.js:
+        (match):
+        No need for an else after an if that always returns.
+
+        * builtins/TypedArrayConstructor.js:
+        (of):
+        Fix error message to use the correct function name.
+
+        (allocateInt8Array):
+        (allocateInt16Array):
+        (allocateInt32Array):
+        (allocateUint32Array):
+        (allocateUint16Array):
+        (allocateUint8Array):
+        (allocateUint8ClampedArray):
+        (allocateFloat32Array):
+        (allocateFloat64Array):
+        Cleanup style to be like all the other code.
+
+        * tests/stress/typedarray-of.js:
+        Test the exception message.
+
+2016-03-25  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Date.prototype.toLocaleDateString uses overridable Object.create
+        https://bugs.webkit.org/show_bug.cgi?id=155917
+
+        Reviewed by Mark Lam.
+
+        * builtins/DatePrototype.js:
+        (toLocaleString.toDateTimeOptionsAnyAll):
+        (toLocaleDateString.toDateTimeOptionsDateDate):
+        (toLocaleTimeString.toDateTimeOptionsTimeTime):
+        Switch from @Object.create to @Object.@create to guarentee we are
+        using the built-in create method and not user defined code.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        Setup the @create private symbol.
+
+2016-03-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Put the x86 Assembler on a binary diet
+        https://bugs.webkit.org/show_bug.cgi?id=155683
+
+        Reviewed by Darin Adler.
+
+        The MacroAssemblers are heavily inlined. This is unfortunately
+        important for baseline JIT where many branches can be eliminated
+        at compile time.
+
+        This inlining causes a lot of binary bloat. The phases
+        lowering to ASM are massively large.
+
+        This patch improves the situation a bit for x86 through
+        many small improvements:
+
+        -Every instruction starts with ensureSpace(). The slow
+         path realloc the buffer.
+         From that slow path, only fastRealloc() was a function
+         call. What is around does not need to be fast, I moved
+         the whole grow() function out of line for those cases.
+
+        -When testing multiple registers for REX requirements,
+         we had something like this:
+             byteRegRequiresRex(reg) || byteRegRequiresRex(rm)
+             regRequiresRex(index) || regRequiresRex(base)
+         Those were producing multiple test-and-branch. Those branches
+         are effectively random so we don't have to care about individual
+         branches being predictable.
+
+         The new code effectively does:
+             byteRegRequiresRex(reg | rm)
+             regRequiresRex(index | base)
+
+        -Change "ModRmMode" to have the value we can OR directly
+         to the generated ModRm.
+         This is important because some ModRM code is so large
+         that is goes out of line;
+
+        -Finally, a big change on how we write to the AssemblerBuffer.
+
+         Previously, instructions were written byte by byte into
+         the assembler buffer of the MacroAssembler.
+
+         The problem with that is the compiler cannot prove that
+         the buffer pointer and the AssemblerBuffer are not pointing
+         to the same memory.
+
+         Because of that, before any write, all the local register
+         were pushed back to the AssemblerBuffer memory, then everything
+         was read back after the write to compute the next write.
+
+         I attempted to use the "restrict" keyword and wrapper types
+         to help Clang with that but nothing worked.
+
+         The current solution is to keep a local copy of the index
+         and the buffer pointer in the scope of each instruction.
+         That is done by AssemblerBuffer::LocalWriter.
+
+         Since LocalWriter only exists locally, it stays in
+         register and we don't have all the memory churn between
+         each byte writing. This also allows clang to combine
+         obvious cases since there are no longer observable side
+         effects between bytes.
+
+        This patch reduces the binary size by 66k. It is a small
+        speed-up on Sunspider.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::ensureSpace):
+        (JSC::AssemblerBuffer::LocalWriter::LocalWriter):
+        (JSC::AssemblerBuffer::LocalWriter::~LocalWriter):
+        (JSC::AssemblerBuffer::LocalWriter::putByteUnchecked):
+        (JSC::AssemblerBuffer::LocalWriter::putShortUnchecked):
+        (JSC::AssemblerBuffer::LocalWriter::putIntUnchecked):
+        (JSC::AssemblerBuffer::LocalWriter::putInt64Unchecked):
+        (JSC::AssemblerBuffer::LocalWriter::putIntegralUnchecked):
+        (JSC::AssemblerBuffer::putIntegral):
+        (JSC::AssemblerBuffer::outOfLineGrow):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::X86InstructionFormatter::byteRegRequiresRex):
+        (JSC::X86Assembler::X86InstructionFormatter::regRequiresRex):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::LocalBufferWriter):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::emitRex):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::emitRexW):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::emitRexIf):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::emitRexIfNeeded):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::putModRm):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::putModRmSib):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::registerModRM):
+        (JSC::X86Assembler::X86InstructionFormatter::LocalBufferWriter::memoryModRM):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp_disp32): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp_disp8): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::twoByteOp): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::threeByteOp): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64_disp32): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64_disp8): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::twoByteOp64): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp8): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::twoByteOp8): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::emitRex): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::emitRexW): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::emitRexIf): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::emitRexIfNeeded): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::putModRm): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::putModRmSib): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::registerModRM): Deleted.
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM): Deleted.
+
+2016-03-25  Saam barati  <sbarati@apple.com>
+
+        RegExp.prototype.test should be an intrinsic again
+        https://bugs.webkit.org/show_bug.cgi?id=155861
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+
+2016-03-25  Mark Lam  <mark.lam@apple.com>
+
+        ES6's throwing of TypeErrors on access of RegExp.prototype flag properties breaks websites.
+        https://bugs.webkit.org/show_bug.cgi?id=155904
+
+        Reviewed by Geoffrey Garen.
+
+        There exists a JS library XRegExp (see http://xregexp.com) that extends the regexp
+        implementation.  XRegExp does feature testing by comparing RegExp.prototype.sticky
+        to undefined.  See:
+
+        Example 1. https://github.com/slevithan/xregexp/blob/28a2b033c5951477bed8c7c867ddf7e89c431cd4/tests/perf/index.html
+            ...
+            } else if (knownVersion[version]) {
+                // Hack around ES6 incompatibility in XRegExp versions prior to 3.0.0
+                if (parseInt(version, 10) < 3) {
+                    delete RegExp.prototype.sticky;
+            }
+            ...
+
+        Example 2. https://github.com/slevithan/xregexp/blob/d0e665d4068cec4d15919215b098b2373f1f12e9/tests/perf/versions/xregexp-all-v2.0.0.js
+            ...
+            // Check for flag y support (Firefox 3+)
+                hasNativeY = RegExp.prototype.sticky !== undef,
+            ...
+
+        The ES6 spec states that we should throw a TypeError here because RegExp.prototype
+        is not a RegExp object, and the sticky getter is only allowed to be called on
+        RegExp objects.  See https://tc39.github.io/ecma262/2016/#sec-get-regexp.prototype.sticky.
+        As a result, websites that uses XRegExp can break (e.g. some Atlassian tools).
+
+        As a workaround, we'll return undefined instead of throwing on access of these
+        flag properties that may be used for feature testing.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoGetterGlobal):
+        (JSC::regExpProtoGetterIgnoreCase):
+        (JSC::regExpProtoGetterMultiline):
+        (JSC::regExpProtoGetterSticky):
+        (JSC::regExpProtoGetterUnicode):
+
+2016-03-25  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] fix divide-by-zero in String.prototype.padStart/padEnd
+        https://bugs.webkit.org/show_bug.cgi?id=155903
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::padString):
+
+2016-03-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] materialize-past-butterfly-allocation.js time out in debug
+
+        * tests/stress/materialize-past-butterfly-allocation.js:
+        The test times out on the debug bots. We suspect there is nothing
+        wrong, just overkill loops.
+
+2016-03-25  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: protocol generator should prefix C++ filenames with the protocol group
+        https://bugs.webkit.org/show_bug.cgi?id=155859
+        <rdar://problem/25349859>
+
+        Reviewed by Alex Christensen and Joseph Pecoraro.
+
+        Like for generated Objective-C files, we should use the 'protocol group' name
+        as the prefix for generated C++ files so that headers from different protocol
+        groups have unambiguous names.
+
+        * inspector/scripts/codegen/cpp_generator.py:
+        (CppGenerator):
+        (CppGenerator.__init__):
+        (CppGenerator.protocol_name):
+        Make all C++ code generators extend the CppGenerator python class and use the
+        protocol_name() instance method. This matches a recent change to the ObjC generator.
+
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        (CppGeneratorTemplates):
+        Drive-by cleanup to use #pragma once instead of header guards.
+
+        * inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py:
+        (CppAlternateBackendDispatcherHeaderGenerator):
+        (CppAlternateBackendDispatcherHeaderGenerator.__init__):
+        (CppAlternateBackendDispatcherHeaderGenerator.output_filename):
+        (CppAlternateBackendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
+        (CppBackendDispatcherHeaderGenerator):
+        (CppBackendDispatcherHeaderGenerator.__init__):
+        (CppBackendDispatcherHeaderGenerator.output_filename):
+        (CppBackendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator):
+        (CppBackendDispatcherImplementationGenerator.__init__):
+        (CppBackendDispatcherImplementationGenerator.output_filename):
+        (CppBackendDispatcherImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
+        (CppFrontendDispatcherHeaderGenerator):
+        (CppFrontendDispatcherHeaderGenerator.__init__):
+        (CppFrontendDispatcherHeaderGenerator.output_filename):
+        (CppFrontendDispatcherHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator):
+        (CppFrontendDispatcherImplementationGenerator.__init__):
+        (CppFrontendDispatcherImplementationGenerator.output_filename):
+        (CppFrontendDispatcherImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
+        (CppProtocolTypesHeaderGenerator):
+        (CppProtocolTypesHeaderGenerator.__init__):
+        (CppProtocolTypesHeaderGenerator.output_filename):
+        (CppProtocolTypesHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
+        (CppProtocolTypesImplementationGenerator):
+        (CppProtocolTypesImplementationGenerator.__init__):
+        (CppProtocolTypesImplementationGenerator.output_filename):
+        (CppProtocolTypesImplementationGenerator.generate_output):
+        Use the protocol_name() instance method to compute generated protocol file names.
+
+        * inspector/scripts/codegen/models.py:
+        Explicitly set the 'protocol_group' for the Inspector protocol.
+
+        Rebaseline generator test results.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-03-25  Keith Miller  <keith_miller@apple.com>
+
+        putByIndexBeyondVectorLengthWithoutAttributes should not crash if it can't ensureLength
+        https://bugs.webkit.org/show_bug.cgi?id=155730
+
+        Reviewed by Saam Barati.
+
+        This patch makes ensureLength return a boolean indicating if it was able to set the length.
+        ensureLength also no longer sets the butterfly to null if the allocation of the butterfly
+        fails. All of ensureLengths callers including putByIndexBeyondVectorLengthWithoutAttributes
+        have been adapted to throw an out of memory error if ensureLength fails.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::ensureLengthSlow):
+        * runtime/JSObject.h:
+        (JSC::JSObject::ensureLength):
+
+2016-03-25  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] implement String.prototype.padStart() and String.prototype.padEnd() proposal
+        https://bugs.webkit.org/show_bug.cgi?id=155795
+
+        Reviewed by Darin Adler.
+
+        Implements ECMAScript proposal http://tc39.github.io/proposal-string-pad-start-end/
+        Currently at Stage 3.
+
+        * runtime/JSString.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::repeatCharacter):
+        (JSC::repeatStringPattern):
+        (JSC::padString):
+        (JSC::stringProtoFuncPadEnd):
+        (JSC::stringProtoFuncPadStart):
+        * tests/es6.yaml:
+        * tests/es6/String.prototype_methods_String.prototype.padEnd.js: Added.
+        * tests/es6/String.prototype_methods_String.prototype.padStart.js: Added.
+
+2016-03-24  Alex Christensen  <achristensen@webkit.org>
+
+        Fix Mac CMake build.
+
+        * PlatformMac.cmake:
+        Link to Security framework.
+
+2016-03-24  Saam barati  <sbarati@apple.com>
+
+        ES6: Implement IsRegExp function and use where needed in String.prototype.* methods
+        https://bugs.webkit.org/show_bug.cgi?id=155854
+
+        Reviewed by Mark Lam.
+
+        This patch is a straight forward implementation of IsRegExp
+        in the ES6 spec:
+        https://tc39.github.io/ecma262/#sec-isregexp
+        We now use this IsRegExp function inside String.prototype.(startsWith | endsWith | includes)
+        as is dictated by the spec.
+
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::recordMatch):
+        (JSC::isRegExp):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+        * tests/es6.yaml:
+        * tests/es6/well-known_symbols_Symbol.match_String.prototype.endsWith.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.match_String.prototype.includes.js: Added.
+        (test):
+        * tests/es6/well-known_symbols_Symbol.match_String.prototype.startsWith.js: Added.
+        (test):
+        * tests/stress/string-prototype-methods-endsWith-startsWith-includes-correctness.js: Added.
+        (assert):
+        (test):
+        (test.get let):
+        (get let):
+
+2016-03-24  Saam barati  <sbarati@apple.com>
+
+        Web Inspector: Separate Debugger enable state from the debugger breakpoints enabled state
+        https://bugs.webkit.org/show_bug.cgi?id=152193
+        <rdar://problem/23867520>
+
+        Reviewed by Joseph Pecoraro.
+
+        When all breakpoints are disabled, we can recompile all JS
+        code and remove the necessary debugging code that is emitted.
+        This allows for the code that is executing to be almost as fast
+        as it is with the debugger completely disabled. This is in preparation for:
+        https://bugs.webkit.org/show_bug.cgi?id=155809
+        which will introduce a high fidelity profiler. That profiler
+        could be built off the principle that breakpoints are disabled
+        when we're performing a high fidelity profile. Doing so, for example,
+        allows the sampling profiler to better measure the real performance
+        of the JS of a particular application.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::setBreakpointsActivated):
+        (JSC::Debugger::setPauseOnExceptionsState):
+        * debugger/Debugger.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        (Inspector::JSGlobalObjectScriptDebugServer::attachDebugger):
+        (Inspector::JSGlobalObjectScriptDebugServer::detachDebugger):
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::enable):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        (JSC::JSGlobalObject::queueMicrotask):
+        (JSC::JSGlobalObject::hasDebugger):
+        (JSC::JSGlobalObject::hasInteractiveDebugger):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::runtimeFlags):
+        (JSC::JSGlobalObject::hasDebugger): Deleted.
+
+2016-03-24  Michael Saboff  <msaboff@apple.com>
+
+        Create private builtin helper advanceStringIndexUnicode() for use by RegExp builtins
+        https://bugs.webkit.org/show_bug.cgi?id=155855
+
+        Reviewed by Mark Lam.
+
+        Moved advanceStringIndexUnicode() as a separate helper.  Added it as a private builtin
+        to the GlobalObject like other private builtins.
+
+        * builtins/RegExpPrototype.js:
+        (advanceStringIndexUnicode):
+        (match):
+        (match.advanceStringIndexUnicode): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
+2016-03-24  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Add Proxy based tests for RegExp.prototype[@@match]
+        https://bugs.webkit.org/show_bug.cgi?id=155807
+
+        Reviewed by Saam Barati.
+
+        Added new test that uses Proxy to verify RegExp.prototype[@@match] processing
+        conforms to the ES6 standard
+
+        Modified builtin RegExp.prototype[@@match] to be ES6 spec conformant.
+
+        Updated es6.yaml as Proxy_internal_get_calls_RegExp.prototype[Symbol.match].js now passes.
+
+        * builtins/RegExpPrototype.js:
+        (match):
+        * tests/es6.yaml: Updated.
+        * tests/stress/regexp-match-proxy.js: Added.
+        (assert):
+        (let.getProxyNullExec.new.Proxy):
+        (let.getSetProxyNullExec.new.Proxy):
+        (get resetTracking):
+        (let.getSetProxyMatches_s.new.Proxy):
+        (set get getSetProxyNullExec):
+        (let.getSetProxyMatches_tx_Greedy.new.Proxy):
+        (set get getSetProxyMatches_s):
+        (let.getSetProxyMatchesUnicode_digit_nonGreedy.new.Proxy):
+        (set get getSetProxyMatches_tx_Greedy):
+
+2016-03-24  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Greedy unicode RegExp's don't properly backtrack past non BMP characters
+        https://bugs.webkit.org/show_bug.cgi?id=155829
+
+        Reviewed by Saam Barati.
+
+        When we backup when matching part of a unicode pattern, we can't just backup one character.
+        Instead we need to save our start position before trying to match a character and
+        restore the position if the match fails.  This was done in other places, but wasn't
+        done for all greedy types.
+
+        Fixed matchGlobal() to properly handle advancing past non BMP characters.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::matchGlobal):
+        * runtime/RegExpObjectInlines.h:
+        (JSC::RegExpObject::advanceStringUnicode):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+
+2016-03-24  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] In some cases, the integer range optimization phase never converges
+        https://bugs.webkit.org/show_bug.cgi?id=155828
+        rdar://problem/25155460
+
+        Reviewed by Filip Pizlo.
+
+        In certain conditions, the integer range optimization phase continuously
+        changes the representation of the same truth, preventing it from
+        converging to a stable state.
+
+        The bug starts by having the same ground truth incomming into a block
+        in different valid forms. For example, you can have x < 42 coming as:
+            1) x < 42
+            2) x < 41 + 1
+            3) x < 43 - 1
+
+        Having those 3 alone coming from predecessors would be okay, we would
+        just accumulate them. The problem is when you have a combination
+        of rule that filter out the previously obtained truth, then add a new
+        form of the same truth.
+
+        Let's use the test case as an example. We have two incoming blocks:
+            Block #1:
+              -i < 42
+              -i != 41
+            Block #2:
+              -i < 41
+              -i == 42 - 42 (i == 0 refining the rule above).
+
+        Let say that our conditions at head are now [i < 41, i < 42 - 1].
+
+        If we merge block #2:
+              -i < 42 and i < 41      -> i < 42
+              -i < 42 and i < 42 - 1  -> i < 42
+              -i != 41 and i < 41     -> i < 41
+              -i != 41 and i < 42 - 1 -> nothing
+
+        The new head is: [i < 41, i < 42]
+
+        If we merge block #1:
+              -i < 41 and i < 41       -> i < 41
+              -i < 41 and i < 42       -> i < 42
+              -i == 42 - 42 and i < 41 -> (i < 41 and i < 42 - 1)
+              -i == 42 - 42 and i < 42 -> i < 42
+
+        After filter, we are back to [i < 41, i < 42 - 1].
+
+        There are several variations of this idea where the same truth
+        rotate different forms with each merge().
+
+        One possible solution is to make filter() more aggressive
+        to avoid the better form occuring at merge(). I'll probably
+        do that at some point but that seems fragile since the same
+        problem could reappear if merge() is later improved.
+
+        For this patch, I went with a more generic solution after
+        merge(): if the generated form is equivalent to one that
+        previously existed at head, pick the existing form.
+
+        In the previous example, what happens is we only have
+        either [i < 41] or [i < 42 - 1] but never both simultaneously.
+
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * tests/stress/integer-range-optimization-constant-representation-1.js: Added.
+        * tests/stress/integer-range-optimization-constant-representation-2.js: Added.
+        Two variation. One timeout in release because of the additional flags.
+        The other is gets more type of run but only assert in debug.
+
+2016-03-23  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r198582.
+        https://bugs.webkit.org/show_bug.cgi?id=155812
+
+        "It broke debugging in the web inspector" (Requested by
+        saamyjoon on #webkit).
+
+        Reverted changeset:
+
+        "We should not disable inlining when the debugger is enabled"
+        https://bugs.webkit.org/show_bug.cgi?id=155741
+        http://trac.webkit.org/changeset/198582
+
+2016-03-23  Michael Saboff  <msaboff@apple.com>
+
+        JavaScriptCore ArrayPrototype::join shouldn't cache butterfly when it makes effectful calls
+        https://bugs.webkit.org/show_bug.cgi?id=155776
+
+        Reviewed by Saam Barati.
+
+        Array.join ends up calling toString, possibly on some object.  Since these calls
+        could be effectful and could change the array itself, we can't hold the butterfly
+        pointer while making effectful calls.  Changed the code to fall back to the general
+        case when an effectful toString() call might be made.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::join):
+        * runtime/JSStringJoiner.h:
+        (JSC::JSStringJoiner::appendWithoutSideEffects): New helper that doesn't make effectful
+        toString() calls.
+        (JSC::JSStringJoiner::append): Built upon appendWithoutSideEffects.
+
+2016-03-23  Keith Miller  <keith_miller@apple.com>
+
+        Array.prototype native functions' species constructors should work with proxies
+        https://bugs.webkit.org/show_bug.cgi?id=155798
+
+        Reviewed by Mark Lam.
+
+        Before native the species constructors were checking if the this value was a JSArray.
+        Instead they should look check that the this value returns true on Array.isArray.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        * tests/es6.yaml:
+        * tests/stress/proxy-array-prototype-methods.js:
+
+2016-03-23  Saam barati  <sbarati@apple.com>
+
+        We should not disable inlining when the debugger is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=155741
+
+        Reviewed by Oliver Hunt.
+
+        We can enable inlining when the debugger is enabled as long
+        as we make sure we still jettison the proper CodeBlocks when
+        a breakpoint is set. This means that for any optimized CodeBlock,
+        we must ask if any of its inlinees contain the breakpoint that
+        is being set. If any inlinees do contain the breakpoint, we must
+        jettison the machine code block that they are a part of.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::toggleBreakpoint):
+        (JSC::Debugger::applyBreakpoints):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::setLocal):
+        (JSC::DFG::ByteCodeParser::flush):
+        (JSC::DFG::ByteCodeParser::flushForTerminal):
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::~Graph):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::hasDebuggerEnabled): Deleted.
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+
+2016-03-23  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Allow undefined/null for Symbol.search and Symbol.match
+        https://bugs.webkit.org/show_bug.cgi?id=155785
+
+        Reviewed by Saam Barati.
+
+        Undefined and null for Symbol.search and Symbol.match properties of the given RegExp (like) object are allowed.
+        When they are specified, we go to the fallback path; creating the RegExp with the given object and matching.
+
+        * builtins/StringPrototype.js:
+        (match):
+        (search):
+        * tests/stress/string-symbol-customization.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2016-03-22  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] correctly handle indexed properties in Object.getOwnPropertyDescriptors
+        https://bugs.webkit.org/show_bug.cgi?id=155563
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putOwnDataPropertyMayBeIndex):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptors):
+
+2016-03-22  Saam Barati  <sbarati@apple.com>
+
+        We should FTL compile code when the debugger is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=155740
+
+        Reviewed by Oliver Hunt.
+
+        There was no fundamental reason why we didn't support debugging
+        with the FTL. It looks like this was just an oversight. We had
+        a Breakpoint node in the DFG that amounted to a nop. By removing
+        this node, we now support debugging in the FTL. Anytime a breakpoint
+        is set, we will jettison any DFG/FTL CodeBlocks that contain the breakpoint
+        that was set.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-03-22  Keith Miller  <keith_miller@apple.com>
+
+        REGRESSION(r197543): Use-after-free on storage/indexeddb/transaction-abort-private.html
+        https://bugs.webkit.org/show_bug.cgi?id=155067
+
+        Reviewed by Filip Pizlo.
+
+        GCIncommingRefCountedSets need to be finalized before we start
+        destructing members of the Heap object. Previously, we would
+        clear all our ArrayBuffer objects when the GCIncommingRefCountedSet
+        holding them was destroyed. However, ArrayBuffers have a weak
+        reference to their wrappers. When we would attempt to destroy the
+        ArrayBuffer object we would end up accessing the WeakImpl for
+        the weak reference, which had already been freed as we destroyed
+        our weak block. The solution to this is to move the old
+        GCIncommingRefCountedSet destructor functionality to a new
+        function lastChanceToFinalize. This function is called when
+        we finalize our other objects on Heap destruction.
+
+        * heap/GCIncomingRefCountedSet.h:
+        * heap/GCIncomingRefCountedSetInlines.h:
+        (JSC::GCIncomingRefCountedSet<T>::lastChanceToFinalize):
+        (JSC::GCIncomingRefCountedSet<T>::~GCIncomingRefCountedSet): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+
+2016-03-22  Per Arne Vollan  <peavo@outlook.com>
+
+        [Win] [64-bit] Remove MSVC 2013 FMA3 Bug Workaround
+        https://bugs.webkit.org/show_bug.cgi?id=141499
+
+        Reviewed by Brent Fulgham.
+
+        As we have moved on to VS2015, this workaround is no longer needed.
+
+        * API/tests/testapi.c:
+        (main):
+        * JavaScriptCore.vcxproj/jsc/DLLLauncherMain.cpp:
+        (wWinMain):
+        * jsc.cpp:
+        (main):
+        * testRegExp.cpp:
+        (main):
+
+2016-03-22  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Implement RegExp.prototype[@@match]
+        https://bugs.webkit.org/show_bug.cgi?id=155711
+
+        Reviewed by Filip Pizlo.
+
+        Implemented ES6 spec for String.prototype.match and RegExp.prototype[@@match].
+        Implemented both as builtins, with String.prototype.match calling 
+        RegExp.prototype[@@match].
+
+        For performance reasons, RegExp.prototype[@@match] has a C++ fast path when
+        RegExp.prototype.exec has not been overridden.  This fast path,
+        RegExpObject::matchGlobal, was taken from the prior StringPrototype::match.
+        It only handles global matches.
+
+        Added new test, stress/regexp-match.js.
+
+        Updated various tests for changes exception string and now passing ES6 behavior.
+
+        * CMakeLists.txt: 
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added builtins/RegExpPrototype.js and eliminated RegExpPrototype.lut.h.
+
+        * builtins/RegExpPrototype.js: Added.
+        (match.advanceStringIndexUnicode): Helper.
+        (match): Implements RegExp.prototype[@@match].
+        * builtins/StringPrototype.js:
+        (match): Implements String.prototype.match.
+
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * runtime/CommonIdentifiers.h:
+        Added Symbol.match and builtins @match and @exec.
+
+        * runtime/RegExpObject.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpObjectInlines.h:
+        (JSC::RegExpObject::matchGlobal): Added.
+        (JSC::RegExpObject::advanceStringUnicode): Added helper.
+
+        * runtime/RegExpPrototype.cpp:
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::RegExpPrototype::visitChildren):
+        (JSC::regExpProtoFuncMatchPrivate):
+        (JSC::RegExpPrototype::getOwnPropertySlot): Deleted.
+        (JSC::RegExpPrototype::create):
+        Restructured to create properties explicitly due to having two names for native regExpProtoFuncExec.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        Made match a builtin.
+        Removed unused declaration of stringProtoFuncSearch() since it was made a builtin.
+
+        * tests/es6.yaml:
+        * tests/stress/regexp-match.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (errorKey.toString):
+        (primitive.of.primitives.shouldThrow):
+        (testRegExpMatch):
+        (testMatch):
+        (testBoth):
+        (alwaysUnmatch):
+
+2016-03-22  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] allow duplicate property names returned from Proxy ownKeys() trap
+        https://bugs.webkit.org/show_bug.cgi?id=155560
+
+        Reviewed by Darin Adler.
+
+        Specification allows duplicate property names to be reported by the
+        Proxy ownKeys() trap --- and this is observable in any API which
+        operates on the returned list, such as Object.keys(),
+        Object.getOwnPropertyNames(), Object.getOwnPropertySymbols(), or
+        Object.getOwnPropertyDescriptors().
+
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::addUnchecked):
+        (JSC::PropertyNameArray::add):
+        (JSC::PropertyNameArray::addKnownUnique): Deleted.
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getPropertyNamesFromStructure):
+
+2016-03-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Clean up Math.floor thunk and use SSE round instruction
+        https://bugs.webkit.org/show_bug.cgi?id=155705
+
+        Reviewed by Geoffrey Garen.
+
+        SSE now allow us to use round instruction to implement Math.floor.
+        MacroAssembler's floorDouble is now only used in ARM64, but it can be allowed in x86 SSE.
+
+        * jit/ThunkGenerators.cpp:
+        (JSC::floorThunkGenerator):
+
+2016-03-21  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Fixed compilation with GCC 4.8.
+        https://bugs.webkit.org/show_bug.cgi?id=155698
+
+        Reviewed by Alexey Proskuryakov.
+
+        GCC 4.8 does not allow aggregate initialization for type with deleted
+        constructor, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=52707.
+
+        * dfg/DFGCSEPhase.cpp: Added ctor for ImpureDataSlot.
+
+2016-03-21  Joonghun Park  <jh718.park@samsung.com>
+
+        [JSC] Add ArrayBuffer::tryCreate and change the callsites where it is needed
+        https://bugs.webkit.org/show_bug.cgi?id=155328
+
+        Reviewed by Darin Adler.
+
+        * API/JSTypedArray.cpp:
+        (JSObjectMakeTypedArray):
+        (JSObjectMakeArrayBufferWithBytesNoCopy):
+        * runtime/ArrayBuffer.h:
+        (JSC::ArrayBuffer::create):
+        (JSC::ArrayBuffer::tryCreate):
+        (JSC::ArrayBuffer::createUninitialized):
+        (JSC::ArrayBuffer::tryCreateUninitialized):
+        (JSC::ArrayBuffer::createInternal):
+        * runtime/GenericTypedArrayViewInlines.h:
+        (JSC::GenericTypedArrayView<Adaptor>::create):
+        (JSC::GenericTypedArrayView<Adaptor>::createUninitialized):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+
+2016-03-20  Dan Bernstein  <mitz@apple.com>
+
+        [Mac] Determine TARGET_MAC_OS_X_VERSION_MAJOR from MACOSX_DEPLOYMENT_TARGET rather than from MAC_OS_X_VERSION_MAJOR
+        https://bugs.webkit.org/show_bug.cgi?id=155707
+        <rdar://problem/24980691>
+
+        Reviewed by Darin Adler.
+
+        * Configurations/Base.xcconfig: Set TARGET_MAC_OS_X_VERSION_MAJOR based on the last
+          component of MACOSX_DEPLOYMENT_TARGET.
+        * Configurations/DebugRelease.xcconfig: For engineering builds, preserve the behavior of
+          TARGET_MAC_OS_X_VERSION_MAJOR being the host’s OS version.
+
+2016-03-20  Michael Saboff  <msaboff@apple.com>
+
+        Crash in stress/regexp-matches-array-slow-put.js due to stomping on memory when having bad time
+        https://bugs.webkit.org/show_bug.cgi?id=155679
+
+        Reviewed by Saam Barati.
+
+        Allocate out of line storage based on what the structure says it needs
+        in JSArray::tryCreateUninitialized.
+
+        * runtime/JSArray.h:
+        (JSC::JSArray::tryCreateUninitialized):
+
+2016-03-20  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Crash on DFG::WorkList thread in JSC::Heap::isCollecting for destroyed Web Worker
+        https://bugs.webkit.org/show_bug.cgi?id=155678
+        <rdar://problem/25251439>
+
+        Reviewed by Filip Pizlo.
+
+        This fixes a crash that we saw with GuardMalloc. If the Plan was
+        Cancelled it may not be safe to access the VM. If the Plan was
+        cancelled we are just going to bail anyways, so keep the ASSERT but
+        short-circuit if the plan was Cancelled.
+
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::runThread):
+
+2016-03-20  Dan Bernstein  <mitz@apple.com>
+
+        Update build settings
+
+        Rubber-stamped by Andy Estes.
+
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2016-03-19  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Update syntax error text 'super is only valid inside functions' to more suitable
+        https://bugs.webkit.org/show_bug.cgi?id=155491
+
+        Reviewed by Saam Barati.
+
+        Current message 'super is only valid inside of funcitons' is not correct 
+        after patch for https://bugs.webkit.org/show_bug.cgi?id=153864 because 
+        it is allow to use 'super' in eval. Current patch replace old message by
+        'Super is only valid inside functions or 'eval' inside a function' and 
+        fix tests that rely on this message.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * tests/stress/generator-with-super.js:
+        (shouldThrow):
+        * tests/stress/modules-syntax-error.js:
+        * tests/stress/super-in-lexical-scope.js:
+        * tests/stress/tagged-templates-syntax.js:
+
+2016-03-19  Mark Lam  <mark.lam@apple.com>
+
+        ES6 spec requires that ErrorPrototype not be an Error object.
+        https://bugs.webkit.org/show_bug.cgi?id=155680
+
+        Reviewed by Michael Saboff.
+
+        The ES6 spec states that Error.prototype should not be an instance of Error:
+        https://tc39.github.io/ecma262/#sec-properties-of-the-error-prototype-object
+
+        "The Error prototype object is an ordinary object. It is not an Error instance
+        and does not have an [[ErrorData]] internal slot."
+
+        This patch changes ErrorPrototype to conform to the above specification.
+
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::finishCreation):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        (JSC::ErrorPrototype::finishCreation):
+        (JSC::ErrorPrototype::getOwnPropertySlot):
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::finishCreation):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        (JSC::NativeErrorPrototype::finishCreation):
+        * runtime/NativeErrorPrototype.h:
+        (JSC::NativeErrorPrototype::create):
+        - updated to no longer need a JSGlobalObject argument.
+
+        * tests/es6/miscellaneous_built-in_prototypes_are_not_instances.js:
+        - updated to match the kangax version of this test.
+
+2016-03-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Limit DFG's Validate symbols to its compilation unit
+        https://bugs.webkit.org/show_bug.cgi?id=155670
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGValidate.cpp:
+
+2016-03-18  Mark Lam  <mark.lam@apple.com>
+
+        ES6 spec requires that RegExpPrototype not be a RegExp object.
+        https://bugs.webkit.org/show_bug.cgi?id=155654
+
+        Reviewed by Filip Pizlo.
+
+        The ES6 spec states that RegExp.prototype should not be an instance of RegExp:
+        https://tc39.github.io/ecma262/#sec-properties-of-the-regexp-prototype-object
+
+        "The RegExp prototype object is an ordinary object. It is not a RegExp instance
+        and does not have a [[RegExpMatcher]] internal slot or any of the other internal
+        slots of RegExp instance objects."
+
+        This patch changes RegExpPrototype to conform to the above specifications.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpConstructor::finishCreation):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::RegExpPrototype::getOwnPropertySlot):
+        (JSC::RegExpPrototype::visitChildren):
+        (JSC::regExpProtoFuncTest):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::create):
+        (JSC::RegExpPrototype::createStructure):
+        (JSC::RegExpPrototype::emptyRegExp):
+
+        * tests/es6.yaml:
+        - This patch makes the es6/miscellaneous_built-in_prototypes_are_not_instances.js
+          test now pass.  However, the kangax version of this test still fails because
+          it also checks Error objects (which will be fixed in a subsequent patch).
+
+        * tests/mozilla/ecma_2/shell.js:
+        (stringify):
+        (test):
+        (getFailedCases):
+        (err):
+        * tests/stress/static-getter-in-names.js:
+        (shouldBe):
+
+2016-03-18  Keith Miller  <keith_miller@apple.com>
+
+        DataView should use an accessor for its length and buffer properties
+        https://bugs.webkit.org/show_bug.cgi?id=155625
+
+        Reviewed by Michael Saboff.
+
+        The DataView object should use an accessor on DataView.prototype for its
+        byteLength, byteOffset, and buffer properties. This patch also, moves the
+        buffer property off the TypedArray object itself and onto the prototype
+        along with the other accessors. Since the .buffer property is no longer on
+        the object, JSArrayBufferView no longer needs to intercept accesses to
+        properties. Finally, this patch also fixes the length property on all the
+        existing DataView.prototype functions.
+
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::getOwnPropertySlot): Deleted.
+        (JSC::JSArrayBufferView::put): Deleted.
+        (JSC::JSArrayBufferView::defineOwnProperty): Deleted.
+        (JSC::JSArrayBufferView::deleteProperty): Deleted.
+        (JSC::JSArrayBufferView::getOwnNonIndexPropertyNames): Deleted.
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::jsBuffer):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::dataViewProtoGetterBuffer):
+        (JSC::dataViewProtoGetterByteLength):
+        (JSC::dataViewProtoGetterByteOffset):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoGetterFuncBuffer):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewProtoGetterFuncBuffer):
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+
+2016-03-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed speculative cloop buildfix after r198364.
+
+        * bytecode/SuperSampler.cpp:
+
+2016-03-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make CSE's ImpureData faster when dealing with large blocks
+        https://bugs.webkit.org/show_bug.cgi?id=155594
+
+        Reviewed by Filip Pizlo.
+
+        In some tests with large blocks, the time spent in DFG's LocalCSE
+        can be over 10% of the total compile time.
+        In those cases, LocalCSE is completely dominated by handling large
+        blocks.
+
+        This patch addresses the most obvious hot spots ImpureData's handling.
+
+        Initially, most of the time was going into HashTable::rehash().
+        The reason is the buckets are <HeapLocation, LazyNode> gigantic.
+        The hash table would easily get into several kilobytes and the CPU
+        was spending more time dealing with memory than anything.
+
+        To solve that, I moved the pairs lazily to the heap. The table itself
+        just contains the unique_ptr to those values. This makes the table
+        reasonably small and the alloc/dealloc are paid for by the fast rehash().
+
+        Once addImpure() was better, the next big bottleneck was clobber().
+        For each clobber(), we need to go over the entire map and test each value.
+        That loop was where most of the time was going.
+
+        Most calls to clobber() come from two kinds: SideState and Stack.
+
+        SideState is easy: it is never def'ed so we can always skip it.
+
+        Stack is disjoint from Heap too so we can also put it separately.
+
+        Splitting the map into 2 helped reduce the overhead. The maps are:
+        -Stack
+        -Heap
+
+        Having Stack alone was not enough for many blocks. In some cases,
+        you have a ton of SetLocal/GetLocal and having Stack separately
+        makes no difference.
+
+        To solve that, I split Stack in two: a map addressed by AbstractHeap
+        + unique HeapLocation and a fallback map for everything else.
+        Since most Stack are not TOP and are unique per AbstractHeap,
+        I get O(1) clobber in most cases.
+
+        I could achieve the same result with a custom hash structure.
+        I don't think it is worth the effort, in most cases, m_fallbackStackMap
+        has a size of zero or one.
+
+        This patch introduces a lot of coupling between CSE and AbstractHeap.
+        To reduce the risk of bugs, the old map is still maintained in debug
+        and each step checks that the results are the same as the new implementation.
+
+        A new validation step also verify the strong assumptions made by CSE:
+        -SideState and World are never def().
+        -We never write HEAP TOP, we only write specific heap location.
+
+        * dfg/DFGCSEPhase.cpp:
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGLazyNode.h:
+        (JSC::DFG::LazyNode::hash):
+
+2016-03-17  Saam barati  <sbarati@apple.com>
+
+        Implement SmallPtrSet and integrate it into the Parser
+        https://bugs.webkit.org/show_bug.cgi?id=155552
+
+        Reviewed by Filip Pizlo.
+
+        Using SmallPtrSet instead of HashSet really helps speed
+        up the parser. What saves us most is not needing to always
+        malloc/free memory in the HashSet.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::startSwitch):
+        (JSC::Scope::endSwitch):
+        (JSC::Scope::startLoop):
+        (JSC::Scope::hasDeclaredParameter):
+        (JSC::Scope::declareWrite):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::usedVariablesContains):
+        (JSC::Scope::useVariable):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::getCapturedVars):
+        (JSC::Scope::isValidStrictMode):
+        (JSC::Scope::shadowsArguments):
+        (JSC::Scope::copyCapturedVariablesToVector):
+        (JSC::Scope::setIsModule):
+        (JSC::Parser::pushScope):
+        (JSC::Scope::getUsedVariables): Deleted.
+
+2016-03-17  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: protocol generator shouldn't generate enums for parameters with non-anonymous enum types
+        https://bugs.webkit.org/show_bug.cgi?id=155610
+        <rdar://problem/25229878>
+
+        Reviewed by Joseph Pecoraro.
+
+        If a command parameter has an anonymous enum type, the backend dispatcher generator
+        makes a C++ enum for the parameter. However, if the parameter references a named enum
+        type specified in a domain's 'type' section, then there's no need to generate an enum.
+
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
+        (CppBackendDispatcherHeaderGenerator._generate_handler_declaration_for_command):
+        Add a missing check for the is_anonymous flag. Type references to named enums are resolved
+        to the underlying aliased EnumType instead of an AliasedType, so we have to check the flag.
+
+        Rebaseline tests.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+
+2016-03-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Replace all of the various non-working and non-compiling sampling profiler hacks with a single super hack
+        https://bugs.webkit.org/show_bug.cgi?id=155561
+
+        Reviewed by Saam Barati.
+
+        A VM needs some internal profiling hacks in addition to the profiler(s) that the user sees, because
+        you can squeeze out more fidelity if you're willing to make some kind of deal with the devil. Prior
+        to this change JSC had a bunch of these:
+
+        - CodeBlock sampling profiler
+        - Bytecode sampling profiler
+        - Sampling flags
+        - Sampling regions
+        - Some other stuff
+
+        I tried using these recently. They didn't even build. Initially I fixed that, but then I found that
+        these profilers had some serious bugs that made them report bogus results - like underreporting the
+        time spent in regions of code by more than 2x.
+
+        Part of the problem here is that a profiler loses fidelity as it gains power. The more general it
+        tries to be, the more code gets executed on the hot path for the profiler, which increasingly
+        perturbs the results. I believe that's the reason for the underreporting - code ran sufficiently
+        slower, and in a sufficiently different way when profiling, that the results were just wrong.
+
+        This change attacks this problem directly by replacing all of the diverse profiling hacks with just
+        one, which I call the SuperSampler. It consists of exactly one counter. When enabled, the sampler
+        will periodically print (via dataLog()) the percentage of samples that saw a non-zero count. Because
+        it's so simple, it gives better accuracy. This comes about in two ways:
+
+        - It runs at a lower rate. That's fine since it's only checking one flag. You don't need a high rate
+          for just one flag.
+        
+        - The fact that there is only *one* flag means that the user must choose a hypothesis about what is
+          slow. This turns the problem of profiling into a hypothesis testing problem, which is an inherently
+          less flaky kind of experiment to run.
+        
+        The SuperSampler is enabled with a runtime flag rather than a compile-time flag, so it's much less
+        likely to break. That also means that you can enable it without rebuilding the universe. The old
+        samplers all had ENABLE flags in Platform.h, which was rather unfortunate for compile times.
+
+        SuperSampler supports both JIT and C++ users. C++ users should use SuperSamplerScope. The default
+        idiom is to create one and pass "true" to it. You can disable a scope by passing "false" instead.
+        This patch puts a bunch of scopes in places I care about. I think it's probably OK if people check in
+        these deactivated scopes. That makes it convenient to retest things we've tested previously.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SamplingTool.cpp: Removed.
+        * bytecode/SamplingTool.h: Removed.
+        * bytecode/SuperSampler.cpp: Added.
+        (JSC::initializeSuperSampler):
+        (JSC::printSuperSamplerState):
+        * bytecode/SuperSampler.h: Added.
+        (JSC::SuperSamplerScope::SuperSamplerScope):
+        (JSC::SuperSamplerScope::~SuperSamplerScope):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * bytecompiler/NodesCodegen.cpp:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        (JSC::DFG::performArgumentsElimination):
+        * dfg/DFGBackwardsPropagationPhase.cpp:
+        (JSC::DFG::performBackwardsPropagation):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::parse):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::performCFA):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::performCFGSimplification):
+        * dfg/DFGCPSRethreadingPhase.cpp:
+        (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
+        (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlocks):
+        (JSC::DFG::CPSRethreadingPhase::propagatePhis):
+        (JSC::DFG::performCPSRethreading):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::performLocalCSE):
+        (JSC::DFG::performGlobalCSE):
+        * dfg/DFGCleanUpPhase.cpp:
+        (JSC::DFG::performCleanUp):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::performConstantFolding):
+        * dfg/DFGConstantHoistingPhase.cpp:
+        (JSC::DFG::performConstantHoisting):
+        * dfg/DFGCriticalEdgeBreakingPhase.cpp:
+        (JSC::DFG::performCriticalEdgeBreaking):
+        * dfg/DFGDCEPhase.cpp:
+        (JSC::DFG::performDCE):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::performFixup):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dethread):
+        * dfg/DFGIntegerCheckCombiningPhase.cpp:
+        (JSC::DFG::performIntegerCheckCombining):
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        (JSC::DFG::performIntegerRangeOptimization):
+        * dfg/DFGInvalidationPointInjectionPhase.cpp:
+        (JSC::DFG::performInvalidationPointInjection):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGLICMPhase.cpp:
+        (JSC::DFG::performLICM):
+        * dfg/DFGLiveCatchVariablePreservationPhase.cpp:
+        (JSC::DFG::performLiveCatchVariablePreservationPhase):
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::performLivenessAnalysis):
+        * dfg/DFGLoopPreHeaderCreationPhase.cpp:
+        (JSC::DFG::performLoopPreHeaderCreation):
+        * dfg/DFGMaximalFlushInsertionPhase.cpp:
+        (JSC::DFG::performMaximalFlushInsertion):
+        * dfg/DFGMovHintRemovalPhase.cpp:
+        (JSC::DFG::performMovHintRemoval):
+        * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+        (JSC::DFG::performOSRAvailabilityAnalysis):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::performOSREntrypointCreation):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        (JSC::DFG::performObjectAllocationSinking):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhantomInsertionPhase.cpp:
+        (JSC::DFG::performPhantomInsertion):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        * dfg/DFGPredictionInjectionPhase.cpp:
+        (JSC::DFG::performPredictionInjection):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::performPredictionPropagation):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        (JSC::DFG::performPutStackSinking):
+        * dfg/DFGSSAConversionPhase.cpp:
+        (JSC::DFG::performSSAConversion):
+        * dfg/DFGSSALoweringPhase.cpp:
+        (JSC::DFG::performSSALowering):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::performStackLayout):
+        * dfg/DFGStaticExecutionCountEstimationPhase.cpp:
+        (JSC::DFG::performStaticExecutionCountEstimation):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        (JSC::DFG::performFastStoreBarrierInsertion):
+        (JSC::DFG::performGlobalStoreBarrierInsertion):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::performStrengthReduction):
+        * dfg/DFGStructureAbstractValue.cpp:
+        (JSC::DFG::StructureAbstractValue::assertIsRegistered):
+        (JSC::DFG::StructureAbstractValue::clobber):
+        (JSC::DFG::StructureAbstractValue::observeTransition):
+        (JSC::DFG::StructureAbstractValue::observeTransitions):
+        (JSC::DFG::StructureAbstractValue::add):
+        (JSC::DFG::StructureAbstractValue::merge):
+        (JSC::DFG::StructureAbstractValue::mergeSlow):
+        (JSC::DFG::StructureAbstractValue::mergeNotTop):
+        (JSC::DFG::StructureAbstractValue::filter):
+        (JSC::DFG::StructureAbstractValue::filterSlow):
+        (JSC::DFG::StructureAbstractValue::contains):
+        (JSC::DFG::StructureAbstractValue::isSubsetOf):
+        (JSC::DFG::StructureAbstractValue::isSupersetOf):
+        (JSC::DFG::StructureAbstractValue::overlaps):
+        (JSC::DFG::StructureAbstractValue::equalsSlow):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::performStructureRegistration):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::performTierUpCheckInjection):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::performTypeCheckHoisting):
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::performUnification):
+        * dfg/DFGVarargsForwardingPhase.cpp:
+        (JSC::DFG::performVarargsForwarding):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::performVirtualRegisterAllocation):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::performWatchpointCollection):
+        * dynbench.cpp:
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetRegExpObjectLastIndex):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::absolute):
+        (JSC::FTL::Output::incrementSuperSamplerCount):
+        (JSC::FTL::Output::decrementSuperSamplerCount):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::baseIndex):
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::load8ZeroExt32):
+        (JSC::FTL::Output::anchor):
+        (JSC::FTL::Output::absolute): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::collectAndSweep):
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::zombifyDeadObjects):
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::specializedSweep):
+        * interpreter/Interpreter.cpp:
+        (JSC::setupVarargsFrameAndSetThis):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::checkedReturn):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::debug):
+        (JSC::SamplingScope::SamplingScope): Deleted.
+        (JSC::SamplingScope::~SamplingScope): Deleted.
+        (JSC::Interpreter::enableSampler): Deleted.
+        (JSC::Interpreter::dumpSampleData): Deleted.
+        (JSC::Interpreter::startSampling): Deleted.
+        (JSC::Interpreter::stopSampling): Deleted.
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isCallBytecode):
+        (JSC::Interpreter::sampler): Deleted.
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::branchIfNotFastTypedArray):
+        (JSC::AssemblyHelpers::incrementSuperSamplerCount):
+        (JSC::AssemblyHelpers::decrementSuperSamplerCount):
+        (JSC::AssemblyHelpers::purifyNaN):
+        * jit/AssemblyHelpers.h:
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITArithmetic32_64.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITCall32_64.cpp:
+        * jit/JITOperations.cpp:
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITPropertyAccess32_64.cpp:
+        * jsc.cpp:
+        (runWithScripts):
+        (jscmain):
+        * parser/Nodes.cpp:
+        * parser/Parser.h:
+        (JSC::parse):
+        * runtime/Executable.h:
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreading):
+        * runtime/Options.h:
+        * runtime/RegExpCachedResult.h:
+        * runtime/RegExpMatchesArray.h:
+        (JSC::createRegExpMatchesArray):
+        * runtime/StringPrototype.cpp:
+        (JSC::removeUsingRegExpSearch):
+        (JSC::stringProtoFuncSubstring):
+        * runtime/VM.cpp:
+        (JSC::VM::resetDateCache):
+        (JSC::VM::whenIdle):
+        (JSC::VM::deleteAllCode):
+        (JSC::VM::addSourceProviderCache):
+        (JSC::VM::startSampling): Deleted.
+        (JSC::VM::stopSampling): Deleted.
+        (JSC::VM::dumpSampleData): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::regExpCache):
+        * testRegExp.cpp:
+        (runFromFiles):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::interpret):
+
+2016-03-17  Saam barati  <sbarati@apple.com>
+
+        [ES6] Make GetProperty(.) inside ArrayPrototype.cpp spec compatible.
+        https://bugs.webkit.org/show_bug.cgi?id=155575
+
+        Reviewed by Filip Pizlo and Mark Lam.
+
+        This patch makes various Array.prototype.(shift | unshift | splice)
+        spec compliant. Before, they were performing Get and HasProperty as one 
+        operation. Instead, they need to be performed as two distinct operations
+        when it would be observable.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::isCacheableValue):
+        (JSC::PropertySlot::isCacheableGetter):
+        (JSC::PropertySlot::isCacheableCustom):
+        (JSC::PropertySlot::setIsTaintedByProxy):
+        (JSC::PropertySlot::isTaintedByProxy):
+        (JSC::PropertySlot::internalMethodType):
+        (JSC::PropertySlot::getValue):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        * tests/es6.yaml:
+        * tests/stress/proxy-array-prototype-methods.js: Added.
+        (assert):
+        (test):
+        (shallowEq):
+
+2016-03-17  Mark Lam  <mark.lam@apple.com>
+
+        Make FunctionMode an enum class.
+        https://bugs.webkit.org/show_bug.cgi?id=155587
+
+        Reviewed by Saam Barati.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * parser/NodeConstructors.h:
+        (JSC::BaseFuncExprNode::BaseFuncExprNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::ArrowFuncExprNode::ArrowFuncExprNode):
+        (JSC::MethodDefinitionNode::MethodDefinitionNode):
+        * parser/ParserModes.h:
+        (JSC::functionNameIsInScope):
+
+2016-03-17  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Getters and Setters should be prefixed appropriately
+        https://bugs.webkit.org/show_bug.cgi?id=155593
+
+        Reviewed by Mark Lam.
+
+        Changed the putDirectNativeIntrinsicGetter() to prepend "get " to the funtion name.
+
+        Updated places that had their own macro or hand constructed a getter function to use
+        the JSC_NATIVE_GETTER macro which will properly append "get ".
+
+        Prepended "get " and "set " to the __proto__ accessor created on the Object prototype.
+
+        When we create the Symbol.species getter, added an explicit function name of "get [Symbol.species]".
+
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        (Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectNativeIntrinsicGetter):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        (JSC::MapPrototype::getOwnPropertySlot):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        (JSC::SetPrototype::getOwnPropertySlot):
+        * tests/stress/accessors-get-set-prefix.js: Added.
+        (tryGetOwnPropertyDescriptorGetName):
+
+2016-03-16  Mark Lam  <mark.lam@apple.com>
+
+        Method names should not appear in the lexical scope of the method's body.
+        https://bugs.webkit.org/show_bug.cgi?id=155568
+
+        Reviewed by Saam Barati.
+
+        Consider this scenario:
+
+            var f = "foo";
+            var result = ({
+                f() {
+                    return f; // f should be the string "foo", not this method f.
+                }
+            }).f();
+            result === "foo"; // Should be true.
+
+        The reason this is not current working is because the parser does not yet
+        distinguish between FunctionExpressions and MethodDefinitions.  The ES6 spec
+        explicitly distinguishes between the 2, and we should do the same.
+        
+        This patch changes all methods (and getters and setters which are also methods)
+        to have a FunctionMode of MethodDefinition (instead of FunctionExpression).
+        functionNameIsInScope() is responsible for determining whether a function's name
+        should be in its scope or not.  It already returns false for any function
+        whose FunctionMode is not FunctionExpression.  Giving methods the MethodDefinition
+        FunctionMode gets us the correct behavior ES6 expects.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewMethodDefinition):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrowFuncExprNode::emitBytecode):
+        (JSC::MethodDefinitionNode::emitBytecode):
+        (JSC::YieldExprNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createMethodDefinition):
+        (JSC::ASTBuilder::createFunctionMetadata):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createArguments):
+        * parser/NodeConstructors.h:
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::BaseFuncExprNode::BaseFuncExprNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::ArrowFuncExprNode::ArrowFuncExprNode):
+        (JSC::MethodDefinitionNode::MethodDefinitionNode):
+        (JSC::YieldExprNode::YieldExprNode):
+        * parser/Nodes.h:
+        (JSC::BaseFuncExprNode::metadata):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        * parser/ParserModes.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        (JSC::SyntaxChecker::createArrowFunctionExpr):
+        (JSC::SyntaxChecker::createMethodDefinition):
+        (JSC::SyntaxChecker::setFunctionNameStart):
+        (JSC::SyntaxChecker::createArguments):
+        * tests/es6.yaml:
+
+2016-03-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        REGRESSION(r197380): Build fails with new GCC and Clang
+        https://bugs.webkit.org/show_bug.cgi?id=155044
+
+        Reviewed by Michael Catanzaro.
+
+        In C++, std math functions ceil and floor are overloaded for double and float.
+        Without explicit cast or function pointer assignment, compilers cannot
+        determine which function address is used in the given context.
+
+        * b3/B3LowerMacrosAfterOptimizations.cpp:
+
+2016-03-17  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        Invoking super()/super inside of the eval should not lead to SyntaxError
+        https://bugs.webkit.org/show_bug.cgi?id=153864
+
+        Reviewed by Saam Barati.
+
+        Added support of the invoking super/super() inside of the eval within class.
+        Also support cases when eval is invoked in constructor, class method directly 
+        or via arrow function. Access to the new.target in eval is not part of this patch
+        and will be implemented in https://bugs.webkit.org/show_bug.cgi?id=155545
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::isThisUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isNewTargetUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isSuperUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isSuperCallUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::isEvalContext):
+        (JSC::Scope::setIsEvalContext):
+        (JSC::parse):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        * tests/stress/arrowfunction-lexical-bind-supercall-4.js:
+        * tests/stress/arrowfunction-lexical-bind-superproperty.js:
+        * tests/stress/class-syntax-super-in-eval.js: Added.
+        * tests/stress/generator-with-super.js:
+
+2016-03-15  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILED: !edge->isPhantomAllocation() in regress/script-tests/sink-huge-activation.js.ftl-eager in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=153805
+
+        Reviewed by Mark Lam.
+
+        The object allocation sinking phase uses InferredValue::isStillValid() in the opposite
+        way from most clients: it will do an *extra* optimization if it returns false. The
+        phase will first compute sink candidates and then it will compute materialization
+        points. If something is a sink candidate then it is not a materialization point. A
+        NewFunction node may appear as not being a sink candidate during the first pass, so it's
+        not added to the set of things that will turn into PhantomNewFunction. But on the second
+        pass where we add materializations, we check isStillValid() again. Now this may become
+        false, so that second pass thinks that NewFunction is a sink candidate (even though it's
+        not in the sink candidates set) and so is not a materialization point.
+
+        This manifests as the NewFunction referring to a PhantomCreateActivation or whatever.
+
+        The solution is to have the phase cache results of calls to isStillValid(). It's OK if
+        we just remember the result of the first call and assume that it's not a sink candidate.
+        That's the worst that can happen.
+
+        No new tests since this is a super hard race and sink-huge-activation seemed to already
+        be catching it.
+
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
+2016-03-16  Saam Barati  <sbarati@apple.com>
+
+        [ES6] Make Array.prototype.reverse spec compatible.
+        https://bugs.webkit.org/show_bug.cgi?id=155528
+
+        Reviewed by Michael Saboff.
+
+        This patch make Array.prototype.reverse spec compatible.
+        Before, we weren't performing a HasProperty of each index
+        before performing a Get on that index.  We now do that on
+        the slow path.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReverse):
+        * tests/stress/array-reverse-proxy.js: Added.
+        (assert):
+        (test):
+        (shallowCopy):
+        (shallowEqual):
+        (let.handler.get getSet):
+        (test.let.handler.get getSet):
+
+2016-03-16  Chris Dumez  <cdumez@apple.com>
+
+        Unreviewed, rolling out r198235, r198240, r198241, and
+        r198252.
+
+        Causing crashes on ARM
+
+        Reverted changesets:
+
+        "Remove compile time define for SEPARATED_HEAP"
+        https://bugs.webkit.org/show_bug.cgi?id=155508
+        http://trac.webkit.org/changeset/198235
+
+        "Gardening: build fix after r198235."
+        http://trac.webkit.org/changeset/198240
+
+        "Build fix."
+        http://trac.webkit.org/changeset/198241
+
+        "Rename performJITMemcpy to something more inline with our
+        normal webkit function names"
+        https://bugs.webkit.org/show_bug.cgi?id=155525
+        http://trac.webkit.org/changeset/198252
+
+2016-03-16  Brian Burg <bburg@apple.com>
+
+        Unreviewed, rolling out r198257.
+        https://bugs.webkit.org/show_bug.cgi?id=155553
+
+        This change is unnecessary, clients can instead compile the
+        file with ARC enabled (Requested by brrian on #webkit).
+
+        Reverted changeset:
+
+        "REGRESSION(r198077): generated Objective-C protocol object
+        getters leak their wrappers"
+        https://bugs.webkit.org/show_bug.cgi?id=155523
+        http://trac.webkit.org/changeset/198257
+
+2016-03-16  Mark Lam  <mark.lam@apple.com>
+
+        Add support for setting Function.name from computed properties.
+        https://bugs.webkit.org/show_bug.cgi?id=155437
+
+        Reviewed by Filip Pizlo.
+
+        In JS code, we can have initialization of computed properties with function and
+        class objects e.g.
+
+            var o = {
+                [x]: function() {},
+                [y]: class {}
+            }
+
+        The ES6 spec states that the function and class in the example above (being
+        anonymous) should take on the value of x and y respectively as their names:
+
+            o[x].name; // should be the "stringified" value of x.
+            o[y].name; // should be the "stringified" value of y.
+
+        To achieve this, we will now inject an op_set_function_name bytecode at property
+        initialization sites if:
+
+        1. the property assigned value is a function or class, and
+        2. the function and class is anonymous, and
+        3. if property assigned value is a class, it doesn't have a static method
+           that is statically named "name".
+
+        The op_set_function_name will result in JSFunction::setFunctionName() being
+        called on the target function / class before it is assigned to the property.
+        JSFunction::setFunctionName() will take care of:
+
+        1. computing the name to use from the value of the computed property name
+           e.g. x and y in the example above.
+
+           If the computed property name is not a symbol, then the function / class name
+           should be the toString() value of that computed property name.
+
+           If the computed property name is a symbol, then ...
+           a. if the Symbol has a defined description (e.g. Symbol("foo")), then the
+              function / class name should be "[<symbol description>]" e.g. "[foo]".
+           b. if the Symbol has an undefined description (e.g. Symbol()), then the
+              function / class name should be "".
+
+           Note: Symbol("") is not the same as Symbol().  The former has a defined
+           descriptor "", and hence, yields a function / class name of "[]".  The latter
+           yields a function / class name of "".
+
+        2. reifying the lazy name property with this function / class name.
+
+        op_set_function_name is named after the SetFunctionName internal function
+        in the ES6 spec that performs the above operation.
+
+        It is behaviorally correct to use op_set_function_name at every property
+        initialization site with computed property names.  However, we choose to not
+        emit the op_set_function_name bytecode when we already know that it will do
+        nothing i.e. when the target function / class is proven to already have a name or
+        name property.  This is done as an optimization to avoid unnecessary calls to
+        JSFunction::setFunctionName().
+
+        Note: we could further check if the class has a static method with a computed
+        name that is a constant string "name" and elide op_set_function_name there too.
+        However, we don't bother because this should be rare.  JSFunction::setFunctionName()
+        will still do the right thing.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitSetFunctionNameIfNeeded):
+        (JSC::BytecodeGenerator::emitCall):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        (JSC::PropertyListNode::emitPutConstantProperty):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        (JSC::DFG::SpeculativeJIT::compileSetFunctionName):
+        (JSC::DFG::SpeculativeJIT::compileForwardVarargs):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSetFunctionName):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_to_primitive):
+        (JSC::JIT::emit_op_set_function_name):
+        (JSC::JIT::emit_op_strcat):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emitSlow_op_to_primitive):
+        (JSC::JIT::emit_op_set_function_name):
+        (JSC::JIT::emit_op_strcat):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::handleHostCall):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/Nodes.cpp:
+        (JSC::FunctionNode::finishParsing):
+        (JSC::PropertyListNode::hasStaticallyNamedProperty):
+        (JSC::VariableEnvironmentNode::VariableEnvironmentNode):
+        * parser/Nodes.h:
+        * runtime/JSFunction.cpp:
+        (JSC::getCalculatedDisplayName):
+        (JSC::JSFunction::setFunctionName):
+        (JSC::JSFunction::reifyLength):
+        (JSC::JSFunction::reifyName):
+        * runtime/JSFunction.h:
+        * tests/es6.yaml:
+        * tests/stress/computed-function-names.js: Added.
+        (toKeyString):
+        (toFuncName):
+        (shouldBe):
+        (return.propKey):
+
+2016-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Reflect.set with receiver
+        https://bugs.webkit.org/show_bug.cgi?id=155294
+
+        Reviewed by Saam Barati.
+
+        This patch introduces the receiver parameter support for Reflect.set.
+        Reflect.set can alter the receiver with arbitrary values.
+        Each property descriptor uses the receiver in [[Set]].
+
+        1) In the accessor descriptor case, the receiver is used as |this| value for setter calls.
+        2) In the data descriptor case, the actual property will be set onto the receiver objects.
+
+        The current put operation does not support the receiver that is different from the base object.
+        In particular, (2) case is not supported.
+        The naive implementation adds one more [[GetOwnProperty]] for the receiver per [[Set]] (9.1.9.1-4-c [1]), and it is unacceptable.
+        To keep the fast path efficiently, we fall back to the slow but generic implementation (ordinarySetSlow)
+        only when the receiver is altered.
+
+        We need not to change any JIT part, because the JS code cannot alter the receiver without Reflect.set.
+        The property accesses generated by the JIT code always have the receiver that is the same to the base object.
+        ProxyObject can alter the receiver, but this situation has no problem because ProxyObject disables Inline Caching.
+        NOTE: Generating Inline Caching for JSProxy (that is used for the Window proxy) is already disabled before this change.
+
+        [1]: https://tc39.github.io/ecma262/#sec-ordinaryset
+
+        * jsc.cpp:
+        (functionCreateProxy):
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::put):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::put):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::put):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::isThisValueAltered):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::put):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::put):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        * runtime/JSObject.cpp:
+        (JSC::ordinarySetSlow):
+        (JSC::JSObject::putInlineSlow):
+        * runtime/JSObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putInline):
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::createStructure):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        * runtime/PropertySlot.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::put):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::isCacheablePut):
+        (JSC::PutPropertySlot::isCacheableSetter):
+        (JSC::PutPropertySlot::isCacheableCustom):
+        (JSC::PutPropertySlot::isCustomAccessor):
+        (JSC::PutPropertySlot::disableCaching):
+        (JSC::PutPropertySlot::isCacheable):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectSet):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::put):
+        (JSC::reject): Deleted.
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        * tests/es6.yaml:
+        * tests/stress/ordinary-set-exceptions.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (shouldThrow.set get var):
+        * tests/stress/proxy-set.js:
+        * tests/stress/reflect-set-proxy-set.js: Copied from Source/JavaScriptCore/tests/stress/proxy-set.js.
+        (shouldBe):
+        (unreachable):
+        (assert):
+        (throw.new.Error.let.handler.set 45):
+        (throw.new.Error):
+        (let.target.set x):
+        (let.target.get x):
+        (set let):
+        * tests/stress/reflect-set-receiver-proxy-set.js: Added.
+        (shouldBe):
+        (unreachable):
+        (assert):
+        (let.handler.set 45):
+        (catch):
+        (let.target.set x):
+        (let.target.get x):
+        (set let):
+        * tests/stress/reflect-set-with-global-proxy.js: Added.
+        (shouldBe):
+        (unreachable):
+        (get shouldBe):
+        (set shouldBe):
+        (set test1):
+        (set test2):
+        (set test3):
+        * tests/stress/reflect-set.js:
+        (shouldThrow):
+        (unreachable):
+        (get shouldBe):
+        (set shouldBe):
+        (receiverTestIndexed):
+        (set get Uint8Array):
+        (receiverCase): Deleted.
+        (proxyCase): Deleted.
+        (stringObjectCase.set get shouldBe): Deleted.
+        (regExpLastIndex): Deleted.
+
+2016-03-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove hint from SlowCaseEntry
+        https://bugs.webkit.org/show_bug.cgi?id=155530
+
+        Reviewed by Alex Christensen.
+
+        * jit/JIT.h:
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+
+2016-03-15  Brian Burg  <bburg@apple.com>
+
+        REGRESSION(r198077): generated Objective-C protocol object getters leak their wrappers
+        https://bugs.webkit.org/show_bug.cgi?id=155523
+        <rdar://problem/25181764>
+
+        Reviewed by Joseph Pecoraro.
+
+        Since the code may not be compiled with ARC, autorelease the returned wrapper.
+
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator.protocol_to_objc_expression_for_member):
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-03-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Help clang generate better code on arrayProtoFuncToString()
+        https://bugs.webkit.org/show_bug.cgi?id=155512
+
+        Reviewed by Mark Lam.
+
+        3d-raytrace hits Array.toString() hard with small arrays.
+        Half of the time is going into overhead around the StringJoiner.
+        This patch makes the function shorter and the layout better.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        Add "UNLIKELY" on rare cases. Clang pushes that code to the tail.
+
+        Factor the code of jsMakeNontrivialString() so that the operation
+        is not duplicated in the function.
+
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        jsNontrivialString() supports r-value reference.
+        Move the result string into jsNontrivialString(), this removes
+        the deref+destructor from the function.
+
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::~JSStringJoiner):
+        The destructor is pretty large. No point in inlining it.
+
+        (JSC::joinStrings):
+        * runtime/JSStringJoiner.h:
+        (JSC::JSStringJoiner::JSStringJoiner):
+        (JSC::JSStringJoiner::append):
+        The calls were duplicated. That's unnecessary.
+
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        Return a reference in all cases.
+        This removes a deref+destructor.
+
+2016-03-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove stale ArrayPrototype declarations
+        https://bugs.webkit.org/show_bug.cgi?id=155520
+
+        Reviewed by Mark Lam.
+
+        * runtime/ArrayPrototype.cpp:
+        The implementations went away when the methods were moved to builtins
+        but the declarations were left behind.
+
+2016-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Rename performJITMemcpy to something more inline with our normal webkit function names
+        https://bugs.webkit.org/show_bug.cgi?id=155525
+
+        Reviewed by Saam Barati.
+
+        Simple bulk search/replace with a better name.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::fillNops):
+        (JSC::ARM64Assembler::replaceWithJump):
+        (JSC::ARM64Assembler::replaceWithLoad):
+        (JSC::ARM64Assembler::replaceWithAddressComputation):
+        (JSC::ARM64Assembler::setPointer):
+        (JSC::ARM64Assembler::repatchInt32):
+        (JSC::ARM64Assembler::repatchCompact):
+        (JSC::ARM64Assembler::linkJumpOrCall):
+        (JSC::ARM64Assembler::linkCompareAndBranch):
+        (JSC::ARM64Assembler::linkConditionalBranch):
+        (JSC::ARM64Assembler::linkTestAndBranch):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        * jit/ExecutableAllocator.h:
+        (JSC::writeToExecutableRegion):
+        (JSC::performJITMemcpy): Deleted.
+
+2016-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Build fix.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2016-03-15  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: build fix after r198235.
+
+        Not Reviewed.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
+
+2016-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Remove compile time define for SEPARATED_HEAP
+        https://bugs.webkit.org/show_bug.cgi?id=155508
+
+        Reviewed by Mark Lam.
+
+        This removes the compile time define for the SEPARATED_HEAP
+        feature, and moves to a default-off runtime preference.
+
+        This happily also removes the need for world rebuilds while
+        bringing it up on different platforms.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        * jit/ExecutableAllocator.h:
+        (JSC::performJITMemcpy):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
+        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
+        (JSC::FixedVMPoolExecutableAllocator::genericWriteToJITRegion):
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): Deleted.
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2016-03-15  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r198148.
+        https://bugs.webkit.org/show_bug.cgi?id=155518
+
+        "Lets do this patch at a later time" (Requested by saamyjoon
+        on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Disallow var assignments in for-in loops"
+        https://bugs.webkit.org/show_bug.cgi?id=155451
+        http://trac.webkit.org/changeset/198148
+
+2016-03-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION: ASSERTION FAILED: !m_lastActiveBlock on js/function-apply.html
+        https://bugs.webkit.org/show_bug.cgi?id=155411
+        <rdar://problem/25134537>
+
+        Reviewed by Mark Lam.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectImpl):
+        (JSC::Heap::didFinishCollection):
+        During collection allocators are stop/reset. The HeapProfiler tasks
+        were using HeapIterationScope (to satisfy MarkedSpace forEachCell API
+        contracts) which was doing its own stop/resume of allocators. Doing a
+        stop/resume in between the normal stop/reset of collection is unexpected.
+
+        Move this to didFinishCollection, alongside other heap iterations
+        like zombies and immortal objects. Putting this after those tasks
+        also means the heap snapshots will respect the zombies/immortal options
+        when deciding if the cell is alive or not.
+
+2016-03-15  Saam Barati  <sbarati@apple.com>
+
+        We should have different JSTypes for JSGlobalLexicalEnvironment and JSLexicalEnvironment and JSModuleEnvironment
+        https://bugs.webkit.org/show_bug.cgi?id=152406
+
+        Reviewed by Mark Lam.
+
+        This makes testing for a JSGlobalLexicalEnvironment faster
+        because we can just check the Cell's type instead of using
+        jsDynamicCast. I also changed code that does jsDynamicCast<JSGlobalObject*>
+        instead of isGlobalObject().
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
+        * runtime/JSGlobalLexicalEnvironment.h:
+        (JSC::JSGlobalLexicalEnvironment::createStructure):
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::JSLexicalEnvironment::createStructure):
+        (JSC::JSLexicalEnvironment::JSLexicalEnvironment):
+        * runtime/JSModuleEnvironment.h:
+        (JSC::JSModuleEnvironment::createStructure):
+        (JSC::JSModuleEnvironment::offsetOfModuleRecord):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isGlobalObject):
+        (JSC::JSObject::isJSLexicalEnvironment):
+        (JSC::JSObject::isGlobalLexicalEnvironment):
+        (JSC::JSObject::isErrorInstance):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        (JSC::isUnscopable):
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::collectVariablesUnderTDZ):
+        (JSC::JSScope::isVarScope):
+        (JSC::JSScope::isLexicalScope):
+        (JSC::JSScope::isModuleScope):
+        (JSC::JSScope::isCatchScope):
+        (JSC::JSScope::isFunctionNameScopeObject):
+        (JSC::JSScope::isNestedLexicalScope):
+        (JSC::JSScope::constantScopeForCodeBlock):
+        (JSC::isScopeType): Deleted.
+        (JSC::JSScope::isGlobalLexicalEnvironment): Deleted.
+        * runtime/JSScope.h:
+        * runtime/JSType.h:
+
+2016-03-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove the Baker barrier from JSC
+        https://bugs.webkit.org/show_bug.cgi?id=155479
+
+        Reviewed by Saam Barati.
+
+        It's been a while since I added a Baker barrier, but I never followed it up with an actual
+        concurrent GC. While thinking about the GC, I became convinced that the right path forward
+        is to do a non-copying concurrent GC. That is, remove the copied space and just use the
+        marked space. The downside of using marked space cannot be more than the overhead of the
+        Baker barrier, so concurrent non-copying GC is definitely better than copying
+        non-concurrent GC. I also suspect that just plain non-copying non-concurrent GC is going to
+        be fine also, so the path forward will probably be to first just remove CopiedSpace.
+
+        Anyway, for now this patch just removes the Baker barrier. It was a cute implementation but
+        it just cost performance and I don't think we'll ever use it.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGCopyBarrierOptimizationPhase.cpp: Removed.
+        * dfg/DFGCopyBarrierOptimizationPhase.h: Removed.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
+        (JSC::DFG::SpeculativeJIT::compileGetButterfly):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetButterfly):
+        (JSC::FTL::DFG::LowerDFGToB3::compileConstantStoragePointer):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
+        (JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        (JSC::FTL::DFG::LowerDFGToB3::isFastTypedArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetButterflyReadOnly): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::loadButterflyWithBarrier): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::copyBarrier): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::isInToSpace): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::loadButterflyReadOnly): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly): Deleted.
+        (JSC::FTL::DFG::LowerDFGToB3::removeSpaceBits): Deleted.
+        * heap/CopyBarrier.h:
+        (JSC::CopyBarrierBase::CopyBarrierBase):
+        (JSC::CopyBarrierBase::operator bool):
+        (JSC::CopyBarrierBase::get):
+        (JSC::CopyBarrierBase::clear):
+        (JSC::CopyBarrierBase::setWithoutBarrier):
+        (JSC::CopyBarrier::CopyBarrier):
+        (JSC::CopyBarrier::get):
+        (JSC::CopyBarrier::set):
+        (JSC::CopyBarrier::setWithoutBarrier):
+        (JSC::CopyBarrierBase::operator!): Deleted.
+        (JSC::CopyBarrierBase::getWithoutBarrier): Deleted.
+        (JSC::CopyBarrierBase::getPredicated): Deleted.
+        (JSC::CopyBarrierBase::copyState): Deleted.
+        (JSC::CopyBarrierBase::setCopyState): Deleted.
+        (JSC::CopyBarrierBase::weakCASWithoutBarrier): Deleted.
+        (JSC::CopyBarrier::getWithoutBarrier): Deleted.
+        (JSC::CopyBarrier::getPredicated): Deleted.
+        (JSC::CopyBarrier::weakCASWithoutBarrier): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::collectAndSweep):
+        (JSC::Heap::copyBarrier): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrierBuffer):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::branchIfNotFastTypedArray):
+        (JSC::AssemblyHelpers::purifyNaN):
+        (JSC::AssemblyHelpers::loadTypedArrayVector): Deleted.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::branchStructure):
+        (JSC::AssemblyHelpers::addressForByteOffset):
+        (JSC::AssemblyHelpers::branchIfToSpace): Deleted.
+        (JSC::AssemblyHelpers::branchIfNotToSpace): Deleted.
+        (JSC::AssemblyHelpers::removeSpaceBits): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_has_indexed_property):
+        (JSC::JIT::emit_op_get_direct_pname):
+        (JSC::JIT::emitSlow_op_get_direct_pname):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_direct_pname):
+        (JSC::JIT::emitSlow_op_get_direct_pname):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitDoubleLoad):
+        (JSC::JIT::emitContiguousLoad):
+        (JSC::JIT::emitArrayStorageLoad):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::emitGenericContiguousPutByVal):
+        (JSC::JIT::emitArrayStoragePutByVal):
+        (JSC::JIT::emitSlow_op_put_by_val):
+        (JSC::JIT::emit_op_get_from_scope):
+        (JSC::JIT::emitSlow_op_get_from_scope):
+        (JSC::JIT::emit_op_put_to_scope):
+        (JSC::JIT::emitSlow_op_put_to_scope):
+        (JSC::JIT::emitIntTypedArrayGetByVal):
+        (JSC::JIT::emitFloatTypedArrayGetByVal):
+        (JSC::JIT::emitIntTypedArrayPutByVal):
+        (JSC::JIT::emitFloatTypedArrayPutByVal):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/DirectArguments.cpp:
+        (JSC::DirectArguments::visitChildren):
+        (JSC::DirectArguments::copyBackingStore):
+        (JSC::DirectArguments::overrideArgument):
+        (JSC::DirectArguments::copyToArguments):
+        * runtime/DirectArguments.h:
+        (JSC::DirectArguments::canAccessIndexQuickly):
+        (JSC::DirectArguments::canAccessArgumentIndexQuicklyInDFG):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::fastSlice):
+        (JSC::JSArray::fastConcatWith):
+        (JSC::JSArray::shiftCountWithArrayStorage):
+        (JSC::JSArray::shiftCountWithAnyIndexingType):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        (JSC::JSArray::fillArgList):
+        (JSC::JSArray::copyToArguments):
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::finalize):
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::isNeutered):
+        (JSC::JSArrayBufferView::vector):
+        (JSC::JSArrayBufferView::length):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        (JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::copyBackingStore):
+        (JSC::JSObject::heapSnapshot):
+        (JSC::JSObject::getOwnPropertySlotByIndex):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::createInitialIndexedStorage):
+        (JSC::JSObject::createArrayStorage):
+        (JSC::JSObject::convertUndecidedToInt32):
+        (JSC::JSObject::convertUndecidedToDouble):
+        (JSC::JSObject::convertUndecidedToContiguous):
+        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
+        (JSC::JSObject::convertUndecidedToArrayStorage):
+        (JSC::JSObject::convertInt32ToDouble):
+        (JSC::JSObject::convertInt32ToContiguous):
+        (JSC::JSObject::convertInt32ToArrayStorage):
+        (JSC::JSObject::convertDoubleToContiguous):
+        (JSC::JSObject::convertDoubleToArrayStorage):
+        (JSC::JSObject::convertContiguousToArrayStorage):
+        (JSC::JSObject::setIndexQuicklyToUndecided):
+        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+        (JSC::JSObject::deletePropertyByIndex):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putDirectIndexBeyondVectorLength):
+        (JSC::JSObject::getNewVectorLength):
+        (JSC::JSObject::ensureLengthSlow):
+        (JSC::JSObject::reallocateAndShrinkButterfly):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::getBoundSlotBaseFunctionForGetterSetter):
+        (JSC::JSObject::getEnumerableLength):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getArrayLength):
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::canGetIndexQuickly):
+        (JSC::JSObject::getIndexQuickly):
+        (JSC::JSObject::tryGetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuickly):
+        (JSC::JSObject::canSetIndexQuicklyForPutDirect):
+        (JSC::JSObject::setIndexQuickly):
+        (JSC::JSObject::initializeIndex):
+        (JSC::JSObject::hasSparseMap):
+        (JSC::JSObject::inSparseIndexingMode):
+        (JSC::JSObject::inlineStorage):
+        (JSC::JSObject::butterfly):
+        (JSC::JSObject::outOfLineStorage):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::ensureInt32):
+        (JSC::JSObject::ensureDouble):
+        (JSC::JSObject::ensureContiguous):
+        (JSC::JSObject::ensureArrayStorage):
+        (JSC::JSObject::arrayStorage):
+        (JSC::JSObject::arrayStorageOrNull):
+        (JSC::JSObject::ensureLength):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/MapData.h:
+        (JSC::JSIterator>::IteratorData::next):
+        (JSC::JSIterator>::IteratorData::refreshCursor):
+        * runtime/MapDataInlines.h:
+        (JSC::JSIterator>::find):
+        (JSC::JSIterator>::add):
+        (JSC::JSIterator>::remove):
+        (JSC::JSIterator>::replaceAndPackBackingStore):
+        (JSC::JSIterator>::replaceBackingStore):
+        (JSC::JSIterator>::ensureSpaceForAppend):
+        (JSC::JSIterator>::visitChildren):
+        (JSC::JSIterator>::copyBackingStore):
+        * runtime/Options.h:
+
+2016-03-15  Saam barati  <sbarati@apple.com>
+
+        Destructuring parameters are evaluated in the wrong scope
+        https://bugs.webkit.org/show_bug.cgi?id=155454
+
+        Reviewed by Geoffrey Garen.
+
+        This patch makes our engine compatible with how parameter
+        lists are evaluated in ES6. A parameter list that contains
+        a rest parameter, any destructuring patterns, or default parameter values, 
+        is classified as being non-simple. Non-simple parameter lists
+        must get their own scope to live in, and the variables in the
+        scope are under TDZ. This means that functions evaluated in the
+        parameter list don't have access to variables inside the function
+        body. Also, non-simple parameter lists get the strict-mode arguments object.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::~BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        * bytecompiler/BytecodeGenerator.h:
+        * parser/Nodes.h:
+        (JSC::FunctionParameters::size):
+        (JSC::FunctionParameters::at):
+        (JSC::FunctionParameters::append):
+        (JSC::FunctionParameters::hasDefaultParameterValues): Deleted.
+        * tests/es6.yaml:
+        * tests/stress/parameter-scoping.js: Added.
+        (assert):
+        (test):
+        (test.foo):
+        (test.):
+
+2016-03-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Don't reference the properties of @Reflect directly
+        https://bugs.webkit.org/show_bug.cgi?id=155436
+
+        Reviewed by Geoffrey Garen.
+
+        Reflect.ownKeys and Reflect.getOwnPropertyDescriptor can be altered with the user-crafted values.
+        Instead of referencing them directly, let's reference them through private names.
+
+        * builtins/ObjectConstructor.js:
+        (assign):
+        * runtime/CommonIdentifiers.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation): Deleted.
+        * runtime/ReflectObject.cpp:
+        (JSC::ReflectObject::finishCreation):
+        * tests/stress/object-assign-correctness.js:
+        (runTests.):
+        (runTests.get let):
+        (Reflect.ownKeys):
+        (Reflect.getOwnPropertyDescriptor):
+        (test.let.handler.switch.case.string_appeared_here.return.get enumerable): Deleted.
+        (test.let.handler.getOwnPropertyDescriptor): Deleted.
+        (test.let.handler.ownKeys): Deleted.
+        (test.let.handler.get getProps): Deleted.
+        (test.let.handler): Deleted.
+        (test): Deleted.
+
+2016-03-14  Daniel Bates  <dabates@apple.com>
+
+        Web Inspector: Display Content Security Policy hash in details sidebar for script and style elements
+        https://bugs.webkit.org/show_bug.cgi?id=155466
+        <rdar://problem/25152480>
+
+        Reviewed by Joseph Pecoraro and Timothy Hatcher.
+
+        Add property contentSecurityPolicyHash to store the CSP hash for an HTML style element or an
+        applicable HTML script element.
+
+        * inspector/protocol/DOM.json:
+
+2016-03-14  Joonghun Park  <jh718.park@samsung.com>
+
+        Purge PassRefPtr from ArrayBuffer, ArchiveResource, Pasteboard, LegacyWebArchive and DataObjectGtk
+        https://bugs.webkit.org/show_bug.cgi?id=150497
+
+        Reviewed by Darin Adler.
+
+        * runtime/ArrayBuffer.h:
+        (JSC::ArrayBuffer::create):
+        (JSC::ArrayBuffer::createAdopted):
+        (JSC::ArrayBuffer::createFromBytes):
+        (JSC::ArrayBuffer::createUninitialized):
+        (JSC::ArrayBuffer::slice):
+        (JSC::ArrayBuffer::sliceImpl):
+
+2016-03-14  Benjamin Poulain  <bpoulain@apple.com>
+
+        Andy VanWagoner no longer has time to own Intl
+
+        * features.json:
+        Andy is busy with other things.
+
+        Andy, thanks for your amazing work on Intl and your dedication
+        to making things right.
+
+2016-03-14  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Fix unaligned access in LLINT.
+        https://bugs.webkit.org/show_bug.cgi?id=153228
+
+        Address loads used with btbxx opcodes were wrongly converted to lw
+        instruction instead of lbu, leading to unaligned access on mips
+        platforms. This is not a bug as it's silently fixed up by kernel,
+        but it's more efficient to avoid unaligned accesses for mips.
+
+        Reviewed by Geoffrey Garen.
+
+        * offlineasm/mips.rb:
+
+2016-03-14  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r194394): >2x slow-down on CDjs
+        https://bugs.webkit.org/show_bug.cgi?id=155471
+
+        Unreviewed (rollout).
+
+        This revision changes localeCompare() so that it's *much* slower than before. It's
+        understandable that sometimes things will get a tiny bit slower when implementing new
+        language features, but more than 2x regression on a major benchmark is not OK.
+
+        This rolls out that change. We can reland it once we think about how to do it in a
+        performant way.
+
+        * builtins/StringPrototype.js:
+        (search):
+        (localeCompare): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2016-03-14  Mark Lam  <mark.lam@apple.com>
+
+        Need to distinguish between Symbol() and Symbol("").
+        https://bugs.webkit.org/show_bug.cgi?id=155438
+
+        Reviewed by Saam Barati.
+
+        * runtime/PrivateName.h:
+        (JSC::PrivateName::PrivateName):
+
+2016-03-14  Oliver Hunt  <oliver@apple.com>
+
+        Temporarily disable the separated heap.
+        https://bugs.webkit.org/show_bug.cgi?id=155472
+
+        Reviewed by Geoffrey Garen.
+
+        Temporarily disable this.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-03-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Reduce generated JSON HeapSnapshot size
+        https://bugs.webkit.org/show_bug.cgi?id=155460
+
+        Reviewed by Geoffrey Garen.
+
+        Adjust the HeapSnapshot JSON to better reduce its size.
+        Changes include:
+
+          - avoid inner array groups and instead just have a large array for
+            nodes/edges. This removes lots of small array allocations.
+          - eliminate duplicate edges
+          - avoid duplicating edge names by including them in their own table;
+          - now both the nodes and edges lists hold only integers
+
+        * heap/HeapSnapshotBuilder.cpp:
+        (JSC::HeapSnapshotBuilder::json):
+        Add some more documentation for the slightly modified format.
+        While generating, clear data structures as early as possible.
+
+        * heap/HeapSnapshotBuilder.h:
+        (JSC::HeapSnapshotEdge::HeapSnapshotEdge):
+        During JSON building, the edge's cell pointers are converted to the
+        identifier they point to. This avoids having to re-lookup the identifier.
+
+        * tests/heapProfiler/driver/driver.js:
+        (CheapHeapSnapshotEdge):
+        (CheapHeapSnapshot):
+        (CheapHeapSnapshot.prototype.edgeNameFromTableIndex):
+        (HeapSnapshot):
+        Update test driver for slightly different snapshot format.
+
+2016-03-14  Keith Miller  <keith_miller@apple.com>
+
+        We should be able to eliminate cloned arguments objects that use the length property
+        https://bugs.webkit.org/show_bug.cgi?id=155391
+
+        Reviewed by Geoffrey Garen.
+
+        Previously if a programmer tried to use arguments.length in a strict function we would not eliminate the
+        arguments object. We were unable to eliminate the arguments object because the user would get a cloned arguments
+        object, which does not special case the length property. Thus, in order to get arguments elimination for cloned
+        we need to add a special case. There are two things that need to happen for the elimination to succeed.
+
+        First, we need to eliminate the CheckStructure blocking the GetByOffset for the length property. In order to
+        eliminate the check structure we need to prove to the Abstract Interpreter that this structure check is
+        unnesssary. This didn't occur before for two reasons: 1) CreateClonedArguments did not set the structure it
+        produced. 2) Even if CreateClonedArguments provided the global object's cloned arguments structure we would
+        transition the new argements object when we added the length property during construction. To fix the second
+        problem we now pre-assign a slot on clonedArgumentsStructure for the length property. Additionally, in order to
+        prevent future transitions of the structure we need to choose an indexing type for the structure. Since, not
+        eliminating the arguments object is so expensive we choose to have all cloned arguments start with continuous
+        indexing type, this avoids transitioning when otherwise we would not have to. In the future we should be smarter
+        about choosing the indexing type but since its relatively rare to have a arguments object escape we don't worry
+        about this for now.
+
+        Additionally, this patch renames all former references of outOfBandArguments to clonedArguments and adds
+        extra instrumentation to DFGArgumentsEliminationPhase.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/ValueRecovery.h:
+        (JSC::ValueRecovery::clonedArgumentsThatWereNotCreated):
+        (JSC::ValueRecovery::outOfBandArgumentsThatWereNotCreated): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateClonedArguments):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_cloned_arguments):
+        (JSC::JIT::emit_op_create_out_of_band_arguments): Deleted.
+        * llint/LowLevelInterpreter.asm:
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::ClonedArguments):
+        (JSC::ClonedArguments::createEmpty):
+        (JSC::ClonedArguments::createWithInlineFrame):
+        (JSC::ClonedArguments::createByCopyingFrom):
+        (JSC::ClonedArguments::createStructure):
+        * runtime/ClonedArguments.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::clonedArgumentsStructure):
+        (JSC::JSGlobalObject::outOfBandArgumentsStructure): Deleted.
+
+2016-03-14  Saam barati  <sbarati@apple.com>
+
+        [ES6] Make JSON.stringify ES6 compatible
+        https://bugs.webkit.org/show_bug.cgi?id=155448
+
+        Reviewed by Sam Weinig and Mark Lam.
+
+        We weren't following the spec with respect to the "toJSON" property
+        of the thing being stringified. We were perform hasProperty(.)
+        on "toJSON" instead of get(.). This patch changes it our
+        implementation to perform get(value, "toJSON").
+
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isFunction):
+        (JSC::JSValue::isCallable):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::toJSON):
+        (JSC::Stringifier::toJSONImpl):
+        (JSC::Stringifier::appendStringifiedValue):
+        * tests/es6.yaml:
+        * tests/stress/proxy-json.js:
+        (test):
+        (test.let.handler.get assert):
+        (test.let.handler):
+
+2016-03-14  Saam barati  <sbarati@apple.com>
+
+        [ES6] Disallow var assignments in for-in loops
+        https://bugs.webkit.org/show_bug.cgi?id=155451
+
+        Reviewed by Mark Lam.
+
+        We're doing this in its own patch instead of the patch for https://bugs.webkit.org/show_bug.cgi?id=155384
+        because last time we made this change it broke some websites. Lets try making
+        it again because it's what the ES6 mandates. If it still breaks things we will
+        roll it out.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseForStatement):
+
+2016-03-14  Saam barati  <sbarati@apple.com>
+
+        assignments in for-in/for-of header not allowed
+        https://bugs.webkit.org/show_bug.cgi?id=155384
+
+        Reviewed by Darin Adler.
+
+        This patch prevents assignments to the loop variable
+        in for in/of loops in all but one situation. The following
+        syntax is still allowed even though the spec prevents it:
+        ```
+        for (var i = X in blah) ;
+        ```
+        If the loop contains let/const, destructuring, or is a for-of
+        loop, we always throw a syntax error if there is an assignment.
+        We can do this with full backwards compatibility.
+        We only allow the above type of for-in loops because Oliver told
+        me that when he tried to make such programs illegal he ran
+        into real websites breaking.
+
+        This patch also removed the !::CreatesAST compile-time branch when checking
+        assignments to new.target. This was a dangerous thing for me
+        to introduce into our parser. There are times where ::CreatesAST
+        is true but we also want to check for syntax errors. For example,
+        when parsing the top-level AST of a program. Though this check
+        was technically correct, it's dangerous to have. It was correct
+        because we would always be reparsing the new.target assignment
+        because new.target is only allowed inside a function. That made it
+        so that (!::CreatesAST <=> we care about new.target assignment syntax errors).
+        But, (!::CreatesAST <=> we care about syntax error X) is not true in general.
+        I think it's safer to remove such code.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createNewTargetExpr):
+        (JSC::ASTBuilder::isNewTarget):
+        (JSC::ASTBuilder::createResolve):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isBoolean):
+        (JSC::ExpressionNode::isSpreadExpression):
+        (JSC::ExpressionNode::isSuperNode):
+        (JSC::ExpressionNode::isNewTarget):
+        (JSC::ExpressionNode::isBytecodeIntrinsicNode):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseForStatement):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseUnaryExpression):
+
+2016-03-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove ENABLE(ES6_TEMPLATE_LITERAL_SYNTAX) guards
+        https://bugs.webkit.org/show_bug.cgi?id=155417
+
+        Reviewed by Yusuke Suzuki.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parsePrimaryExpression): Deleted.
+        (JSC::Parser<LexerType>::parseMemberExpression): Deleted.
+
+2016-03-13  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Added new port JSCOnly.
+        https://bugs.webkit.org/show_bug.cgi?id=154512
+
+        Reviewed by Michael Catanzaro.
+
+        This port allows to build JavaScriptCore engine with minimal
+        dependencies.
+
+        * PlatformJSCOnly.cmake: Added.
+
+2016-03-12  Mark Lam  <mark.lam@apple.com>
+
+        http://kangax.github.io/compat-table/esnext/ crashes reliably.
+        https://bugs.webkit.org/show_bug.cgi?id=155404
+
+        Reviewed by Yusuke Suzuki.
+
+        constructObjectFromPropertyDescriptor() was incorrectly assuming that either
+        both getter and setter will be set or unset.  It did not consider that only one
+        of the getter or setter may be set.  This patch fixes that.
+
+        * runtime/ObjectConstructor.h:
+        (JSC::constructObjectFromPropertyDescriptor):
+        * tests/stress/proxy-with-unbalanced-getter-setter.js: Added.
+        (assert):
+        (let.handler.defineProperty):
+        (i.):
+        (i.assert):
+        (i.get assert):
+        (set assert):
+
+2016-03-12  Brian Burg  <bburg@apple.com>
+
+        When generating Objective-C protocol types, getters for objects need to synthesize a new object instance
+        https://bugs.webkit.org/show_bug.cgi?id=155389
+        <rdar://problem/25125821>
+
+        Reviewed by Timothy Hatcher.
+
+        Currently, in object property getters for Objective-C protocol types, we use
+        a C-style cast of the member's RWIProtocolJSONObject * to the type of the property.
+        However, at runtime the class of `self` is going to be RWIProtocolJSONObject *,
+        not MemberType *, so any subsequent calls to MemberType properties on the return value
+        will fail as the selectors will not be recognized.
+
+        Instead of doing a C-style pointer cast, we need to create a new MemberType object
+        that's backed by the InspectorObject retrieved from the parent object by key.
+        This requires a new initWithJSONObject initializer for each object protocol type.
+
+        * inspector/scripts/codegen/generate_objc_header.py:
+        (ObjCHeaderGenerator._generate_type_interface): Add new declaration.
+
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator.generate_type_implementation):
+        (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_json_object): Added.
+        Forward through to the super class initializer who assigns the underlying InspectorObject.
+
+        (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
+        Drive-by cleanup to use the more compact [super init] form.
+
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator.protocol_to_objc_expression_for_member):
+        For property getters of objects, use initWithJSONObject: rather than a C-style cast.
+
+        Rebaseline relevant test results.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-03-12  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Removed variable names from default constructor declarations.
+        https://bugs.webkit.org/show_bug.cgi?id=155397
+
+        Reviewed by Mark Lam.
+
+        They carry no information and generate unused variable warning with GCC
+        4.8 in a lot of source files.
+
+        * parser/VariableEnvironment.h:
+
+2016-03-12  Myles C. Maxfield  <mmaxfield@apple.com>
+
+        Delete dead SVG Font code
+        https://bugs.webkit.org/show_bug.cgi?id=154718
+
+        Reviewed by Antti Koivisto.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-03-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove a few jumps from DFG
+        https://bugs.webkit.org/show_bug.cgi?id=155347
+
+        Reviewed by Mark Lam.
+
+        Usually, setting ValueTrue or ValueFalse is set
+        by Compare+Or. There are 3 places in DFG with branches instead.
+
+        This patch changes them to the usual pattern.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+
+2016-03-11  Saam barati  <sbarati@apple.com>
+
+        [ES6] Make Object.assign spec compliant
+        https://bugs.webkit.org/show_bug.cgi?id=155375
+
+        Reviewed by Michael Saboff.
+
+        This is a straight forward implementation of Object.assign
+        in the spec.
+        https://tc39.github.io/ecma262/#sec-object.assign
+        Before, weren't performing all of the specified operations.
+        Now, we are.
+
+        * builtins/ObjectConstructor.js:
+        (assign):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * tests/es6.yaml:
+
+2016-03-11  Mark Lam  <mark.lam@apple.com>
+
+        Implement Function.name and Function#toString for ES6 class.
+        https://bugs.webkit.org/show_bug.cgi?id=155336
+
+        Reviewed by Geoffrey Garen.
+
+        The only thing that the ES6 spec says about toString with regards to class
+        objects is:
+
+        "The string representation must have the syntax of a FunctionDeclaration,
+        FunctionExpression, GeneratorDeclaration, GeneratorExpression, ClassDeclaration,
+        ClassExpression, ArrowFunction, MethodDefinition, or GeneratorMethod depending
+        upon the actual characteristics of the object."
+
+        Previously, invoking toString() on a class object will return the function
+        source string of the class' constructor function.  This does not conform to the
+        spec in that the toString string for a class does not have the syntax of a
+        ClassDeclaration or ClassExpression.
+
+        This is now fixed by doing the following:
+
+        1. Added "m_classSource" to FunctionExecutable (and correspondingly to
+           UnlinkedFunctionExecutable, FunctionMetadataNode, and ClassExprNode).
+           m_classSource is the SourceCode for the code range "class ... { ... }".
+
+           Since the class constructor function is the in memory representation of the
+           class object, only class constructor functions will have its m_classSource
+           set.  m_classSource will be "null" (by default) for all other functions.
+           This is how we know if a FunctionExecutable is for a class.
+
+           Note: FunctionExecutable does not have its own m_classSource.  It always gets
+           it from its UnlinkedFunctionExecutable.  This is ok to do because our CodeCache
+           currently does not cache UnlinkedFunctionExecutables for class constructors.
+
+        2. The ClassExprNode now tracks the SourceCode range for the class expression.
+           This is used to set m_classSource in the UnlinkedFunctionExecutable at
+           bytecode generation time, and the FunctionExecutable later at bytecode
+           linking time.
+
+        3. Function.prototype.toString() now checks if the function is for a class.
+           If so, it returns the string for the class source instead of just the
+           function source for the class constructor.
+
+           Note: the class source is static from the time the class was parsed.  This
+           can introduces some weirdness at runtime.  Consider the following:
+
+               var v1 = class {}
+               v1.toString(); // yields "class {}".
+
+               class c2 extends v1 {}
+
+               c2.__proto__ === v1; // yields true i.e. c2 extends v1.
+               c2.toString(); // yields "class c2 extends v1 {}" which is fine.
+
+               v1 = {}; // point v1 to something else now.
+
+               c2.__proto__ === v1; // now yields false i.e. c2 no longer extends v1.
+                                    // c2 actually extends the class that v1 used to
+                                    // point to, but ...
+               c2.toString(); // still yields "class c2 extends v1 {}" which is no longer true.
+
+           It is unclear how we can best implement toString() to avoid this issue.
+           The above behavior is how Chrome (Version 51.0.2671.0 canary (64-bit))
+           currently implements toString() of a class, and we do the same in this patch.
+           In Firefox (45.0), toString() of a class will yield the function source of it
+           constructor function, which is not better.
+
+        In this patch, we also added ES6 compliance for Function.name on class objects:
+
+        4. The ClassExprNode now has a m_ecmaName string for tracking the inferred
+           name of a class according to the ES6 spec.  The ASTBuilder now mirrors its
+           handling of FuncExprNodes to ClassExprNodes in setting the nodes' m_ecmaName
+           where relevant.
+
+           The m_ecmaName is later used to set the m_ecmaName of the FunctionExecutable
+           of the class constructor, which in turn is used to populate the initial value
+           of the Function.name property.
+
+        5. Also renamed some variable names (/m_metadata/metadata/) to be consistent with
+           webkit naming convention.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewDefaultConstructor):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ClassExprNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createYield):
+        (JSC::ASTBuilder::createClassExpr):
+        (JSC::ASTBuilder::createFunctionExpr):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::makeAssignNode):
+        * parser/NodeConstructors.h:
+        (JSC::FunctionParameters::FunctionParameters):
+        (JSC::BaseFuncExprNode::BaseFuncExprNode):
+        (JSC::FuncExprNode::FuncExprNode):
+        (JSC::FuncDeclNode::FuncDeclNode):
+        (JSC::ArrowFuncExprNode::ArrowFuncExprNode):
+        (JSC::ClassDeclNode::ClassDeclNode):
+        (JSC::ClassExprNode::ClassExprNode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isDestructuringNode):
+        (JSC::ExpressionNode::isFuncExprNode):
+        (JSC::ExpressionNode::isArrowFuncExprNode):
+        (JSC::ExpressionNode::isClassExprNode):
+        (JSC::ExpressionNode::isCommaNode):
+        (JSC::ExpressionNode::isSimpleArray):
+        (JSC::ExpressionNode::isAdd):
+        * parser/Parser.cpp:
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseClass):
+        * parser/ParserFunctionInfo.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createEmptyLetExpression):
+        (JSC::SyntaxChecker::createYield):
+        (JSC::SyntaxChecker::createClassExpr):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        (JSC::SyntaxChecker::createArrowFunctionExpr):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::FunctionExecutable::finishCreation):
+        * runtime/Executable.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * tests/es6.yaml:
+
+2016-03-11  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r197994.
+        https://bugs.webkit.org/show_bug.cgi?id=155368
+
+        Broke several ARM tests (Requested by msaboff on #webkit).
+
+        Reverted changeset:
+
+        "[JSC] Add register reuse for ArithAdd of an Int32 and
+        constant in DFG"
+        https://bugs.webkit.org/show_bug.cgi?id=155164
+        http://trac.webkit.org/changeset/197994
+
+2016-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement Reflect.set without receiver support
+        https://bugs.webkit.org/show_bug.cgi?id=155024
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements Reflect.set.
+        The challenge in this patch is Reflect.set requires boolean result of [[Set]],
+        this is not propagated in the previous JSC put implementation.
+
+        This patch changes the put and putByIndex signature from `void put(...)` and `void putByIndex(...)` to `bool put(...)` and `bool putByIndex(...)`,
+        more consistent style to the ECMA262 spec's [[Set]].
+
+        This patch modifies so many part of WebKit. But almost all the changes are mechanical ones.
+
+        Currently, this patch does not support receiver modification support.
+        This will be supported in the subsequent patch[1].
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=155294
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::put):
+        (JSC::JSCallbackObject<Parent>::putByIndex):
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::put):
+        * debugger/DebuggerScope.h:
+        * jsc.cpp:
+        (WTF::RuntimeArray::put):
+        * runtime/ClassInfo.h:
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::put):
+        * runtime/ClonedArguments.h:
+        * runtime/CustomGetterSetter.cpp:
+        (JSC::callCustomSetter):
+        * runtime/CustomGetterSetter.h:
+        * runtime/GenericArguments.h:
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::put):
+        (JSC::GenericArguments<Type>::putByIndex):
+        * runtime/GetterSetter.cpp:
+        (JSC::callSetter):
+        * runtime/GetterSetter.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::put):
+        (JSC::JSArray::push):
+        * runtime/JSArray.h:
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::put):
+        * runtime/JSArrayBuffer.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::put):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::put):
+        (JSC::JSValue::putInline):
+        (JSC::JSValue::putByIndex):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::putByIndex):
+        * runtime/JSCell.h:
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::put):
+        * runtime/JSDataView.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSFunction.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::put):
+        (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
+        * runtime/JSGlobalLexicalEnvironment.cpp:
+        (JSC::JSGlobalLexicalEnvironment::put):
+        * runtime/JSGlobalLexicalEnvironment.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::put):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::put):
+        * runtime/JSLexicalEnvironment.h:
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::put):
+        * runtime/JSModuleEnvironment.h:
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::put):
+        (JSC::JSModuleNamespaceObject::putByIndex):
+        * runtime/JSModuleNamespaceObject.h:
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::putGetter):
+        (JSC::JSObject::putSetter):
+        (JSC::JSObject::putDirectAccessor):
+        (JSC::JSObject::putDirectCustomAccessor):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putByIndexBeyondVectorLength):
+        (JSC::JSObject::putDirectNativeIntrinsicGetter):
+        (JSC::JSObject::putDirectNativeFunction):
+        (JSC::JSObject::putDirectMayBeIndex):
+        (JSC::validateAndApplyPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putByIndexInline):
+        (JSC::JSObject::putDirect):
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::putInline):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::put):
+        (JSC::JSProxy::putByIndex):
+        * runtime/JSProxy.h:
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutTouchWatchpointSet):
+        (JSC::symbolTablePutInvalidateWatchpointSet):
+        (JSC::symbolTablePutWithAttributesTouchWatchpointSet):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        (JSC::lookupPut):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performPut):
+        (JSC::ProxyObject::put):
+        (JSC::ProxyObject::putByIndexCommon):
+        (JSC::ProxyObject::putByIndex):
+        * runtime/ProxyObject.h:
+        * runtime/PutPropertySlot.h:
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectSet):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::defineOwnProperty):
+        (JSC::regExpObjectSetLastIndexStrict):
+        (JSC::regExpObjectSetLastIndexNonStrict):
+        (JSC::RegExpObject::put):
+        * runtime/RegExpObject.h:
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayEntry::put):
+        * runtime/SparseArrayValueMap.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::StringObject::putByIndex):
+        * runtime/StringObject.h:
+        * tests/es6.yaml:
+        * tests/modules/namespace.js:
+        * tests/stress/reflect-set.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (receiverCase.object2.set Cocoa):
+        (receiverCase):
+        (proxyCase):
+        (objectCase.set get shouldBe):
+        (objectCase.get shouldBe):
+        (arrayCase.set get shouldBe):
+        (arrayCase.get shouldBe):
+        (arrayBufferCase.set get shouldBe):
+        (arrayBufferCase.get shouldBe):
+        (set get shouldBe):
+        (get shouldBe):
+        (argumentCase.test1):
+        (argumentCase.test2):
+        (argumentCase.test3):
+        (argumentCase.test4.set get shouldBe):
+        (argumentCase.test5.get shouldBe):
+        (argumentStrictCase.test1):
+        (argumentStrictCase.test2):
+        (argumentStrictCase.test3):
+        (argumentStrictCase.test4.set get shouldBe):
+        (argumentStrictCase.test5.get shouldBe):
+        (stringObjectCase.set get shouldBe):
+        (stringObjectCase.get shouldBe):
+        (customSetter.test1):
+        (customSetter.test2):
+        (customSetter.test3):
+        (customSetter):
+        (regExpLastIndex):
+        (functionCase.func):
+
+2016-03-10  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: generated initWithPayload: protocol object initializers should recursively decode array and object members
+        https://bugs.webkit.org/show_bug.cgi?id=155337
+        <rdar://problem/25098357>
+
+        Reviewed by Timothy Hatcher.
+
+        In cases where an object member is itself an object or array, we were
+        not calling initWithPayload: on the object member itself. So, this caused
+        a runtime error when constructing the outer object because the generated
+        code casted the NSDictionary/NSArray into the member's protocol object type.
+
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator.payload_to_objc_expression_for_member):
+        Do a straightforward call to initWithPayload: for objects. For arrays,
+        call a templated helper function which does the same thing. The helper
+        is used to make this array decoding fit into a single generated expression.
+
+        Rebaseline relevant test results.
+
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-03-10  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, fix Changelog. git merged poorly.
+
+2016-03-10  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, fix testapi.
+
+        * API/tests/TypedArrayCTest.cpp:
+        (testAccess):
+        (testConstructors):
+        (forEachTypedArrayType):
+        (testTypedArrayCAPI):
+
+2016-03-10  Saam barati  <sbarati@apple.com>
+
+        [ES6] Make RegExp.prototype.toString spec compliant
+        https://bugs.webkit.org/show_bug.cgi?id=155341
+
+        Reviewed by Filip Pizlo.
+
+        Before we were directly calling into the flagsString
+        function. Instead, we must get the "flags" property
+        of the thisObject. This will usually call into the flags
+        getter, but not always. Specifically, you can you a Proxy
+        to observe this behavior.
+
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+        (JSC::regExpProtoGetterGlobal):
+        * tests/es6.yaml:
+        * tests/es6/Proxy_internal_get_calls_RegExp.prototype.toString.js: Added.
+        (test.get var):
+        (test.):
+        * tests/stress/regexp-prototype-tostring.js: Added.
+        (assert):
+        (test):
+        (test.get var):
+        (test.):
+        (let.handler.get switch):
+        (let.handler):
+        (get test):
+        (test.get RegExp):
+
+2016-03-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add register reuse for ArithAdd of an Int32 and constant in DFG
+        https://bugs.webkit.org/show_bug.cgi?id=155164
+
+        Reviewed by Geoffrey Garen.
+
+        Every "inc" in loop was looking like this:
+            move rX, rY
+            inc rY
+            jo 0x230f4a200580
+
+        This patch add register Reuse to that case to remove
+        the extra "move".
+
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::SpeculationRecovery::SpeculationRecovery):
+        (JSC::DFG::SpeculationRecovery::immediate):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithAdd):
+        * tests/stress/arith-add-with-constant-overflow.js: Added.
+        (opaqueAdd):
+
+2016-03-10  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, build fix for r197983, hopefully.
+
+        * API/WebKitAvailability.h:
+
+2016-03-10  Keith Miller  <keith_miller@apple.com>
+
+        Typed Arrays have no public facing API
+        https://bugs.webkit.org/show_bug.cgi?id=120112
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds a new C-API (an Obj-C API will follow in the future) for Typed Arrays. The API has two sets of
+        functions. One for Typed Arrays and another for Array Buffers. This API is intended to reflect the use of Typed
+        Array objects in JS code. There is a method for each of the core TypedArray and Array Buffer methods.
+        Originally, we were planning on using a separate non-JS object as the backing store instead of a JS Array Buffer
+        but we decide to defer that idea since there was no good CF/NS API that met all the constraints we needed
+        (Discussed further below). We also wanted to want until Shared Array Buffers had reached a more finished state
+        to see what impact they might have on an API.
+
+        The API has the following Typed Array construction methods:
+        1) Create with length (the backing buffer is zero initialized). -- JSObjectMakeTypedArray
+        2) Create with an existing pointer and a destructor. -- JSObjectMakeTypedArrayFromBytesNoCopy
+        3) Create with an Array Buffer object. -- JSObjectMakeTypedArrayFromArrayBuffer
+        4) Create with an Array Buffer object with a given offset and length. -- JSObjectMakeTypedArrayFromArrayBufferWithOffset
+
+        The API has the following functions on Typed Array JSObjectRefs:
+        5) Get access to a temporary void* of the backing store's data. -- JSObjectGetTypedArrayBytesPtr
+        6) Get the length of a Typed Array object (returns 0 if it is not a Typed Array object). -- JSObjectGetTypedArrayLength
+        7) Get the byte length of a Typed Array object (returns 0 if it is not a Typed Array object). -- JSObjectGetTypedArrayByteLength
+        8) Get the byte offset of a Typed Array object (returns 0 if it is not a Typed Array object). -- JSObjectGetTypedArrayByteOffset
+        9) Get a Typed Array object's Array Buffer  backing store. -- JSObjectGetTypedArrayBuffer
+
+        The API has the following Array Buffer construction method:
+        10) Create with an existing pointer and a destructor. -- JSObjectMakeArrayBufferWithBytesNoCopy
+
+        The API has the following functions on Array Buffer JSObjectRefs:
+        11) Get access to a temporary void* of the backing store's data. -- JSObjectGetArrayBufferBytesPtr
+        12) Get the byte length of an Array Buffer object (returns 0 if it is not an Array Buffer object). -- JSObjectGetArrayBufferByteLength
+
+        The API adds the following new typedefs and enumerations:
+        13) A typedef representing the function pointer type used to deallocate byte pointers provided to constructors. -- JSTypedArrayByesDeallocator
+        14) An enumeration indicating the Typed Array API type of a JSValueRef. -- JSTypedArrayType
+
+        Finally, The API has the following function to get Typed Array Types:
+        15)  Get the Typed Array type of a JS value. -- JSValueGetTypedArrayType
+
+        There are a couple of things to note about these functions. Calling JSObjectGetTypedArrayBytesPtr (5) or
+        JSObjectGetArrayBufferBytesPtr (12) will pin and lock the ArrayBuffer's data for the remaining lifetime of that
+        ArrayBuffer. This is because, currently, we do not have finalizers for our Array Buffers or Typed Arrays with a
+        backing ArrayBuffer and adding one would likely incur a non-trivial cost to GC. Also, we do not have a direct
+        way to make a Typed Array from a pointer with an offset as we do not expect using offsets to be a common use
+        case of the API.
+
+        While it would have been nice to integrate our backing store with CFData or one of its subclasses, it is not
+        possible to force a CFData/CFMutableData to be both writable and have a fixed size/backing store pointer.
+        NSData is not writable and CFMutableData can have a fixed pointer if it is allocated with a non-zero capacity
+        but there is no way for us to force an existing CFMutableData into this state.
+
+        * API/APIUtils.h: Copied from Source/JavaScriptCore/runtime/ArrayBuffer.cpp.
+        (handleExceptionIfNeeded):
+        (setException):
+        * API/JSBase.h:
+        * API/JSObjectRef.cpp:
+        (handleExceptionIfNeeded): Deleted.
+        * API/JSTypedArray.cpp: Added.
+        (toJSTypedArrayType):
+        (toTypedArrayType):
+        (createTypedArray):
+        (JSValueGetTypedArrayType):
+        (JSObjectMakeTypedArray):
+        (JSObjectMakeTypedArrayWithBytesNoCopy):
+        (JSObjectMakeTypedArrayWithArrayBuffer):
+        (JSObjectMakeTypedArrayWithArrayBufferAndOffset):
+        (JSObjectGetTypedArrayBytesPtr):
+        (JSObjectGetTypedArrayLength):
+        (JSObjectGetTypedArrayByteLength):
+        (JSObjectGetTypedArrayByteOffset):
+        (JSObjectGetTypedArrayBuffer):
+        (JSObjectMakeArrayBufferWithBytesNoCopy):
+        (JSObjectGetArrayBufferBytesPtr):
+        (JSObjectGetArrayBufferByteLength):
+        * API/JSTypedArray.h: Added.
+        * API/JSValueRef.cpp:
+        (handleExceptionIfNeeded): Deleted.
+        * API/JSValueRef.h:
+        * API/JavaScript.h:
+        * API/WebKitAvailability.h:
+        * API/tests/TypedArrayCTest.cpp: Added.
+        (id):
+        (freePtr):
+        (assertEqualsAsNumber):
+        (testAccess):
+        (testConstructors):
+        (forEachTypedArrayType):
+        (testTypedArrayCAPI):
+        * API/tests/TypedArrayCTest.h: Added.
+        * API/tests/testapi.c:
+        (main):
+        * CMakeLists.txt:
+        * ForwardingHeaders/JavaScriptCore/JSTypedArray.h: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * PlatformEfl.cmake:
+        * PlatformGTK.cmake:
+        * runtime/ArrayBuffer.cpp:
+        (JSC::ArrayBuffer::transfer):
+        * runtime/ArrayBuffer.h:
+        (JSC::arrayBufferDestructorNull):
+        (JSC::arrayBufferDestructorDefault):
+        (JSC::ArrayBufferContents::ArrayBufferContents):
+        (JSC::ArrayBufferContents::transfer):
+        (JSC::ArrayBuffer::createAdopted):
+        (JSC::ArrayBuffer::createFromBytes):
+        (JSC::ArrayBuffer::ArrayBuffer):
+        (JSC::ArrayBuffer::pinAndLock):
+        (JSC::ArrayBufferContents::tryAllocate):
+        (JSC::ArrayBufferContents::~ArrayBufferContents):
+        * shell/PlatformWin.cmake:
+
+2016-03-10  Saam barati  <sbarati@apple.com>
+
+        [ES6] Instanceof isn't spec compliant when the RHS is a Proxy with a target that is a function
+        https://bugs.webkit.org/show_bug.cgi?id=155329
+
+        Reviewed by Mark Lam.
+
+        We use type info flags on the structure to dictate whether or not 
+        the RHS of an instanceof is a valid RHS (i.e, a function). The solution
+        to make Proxy a valid RHS when the Proxy's target is callable is to have
+        two different structures for ProxyObject: one for a non-callable target 
+        and one for a callable target.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::moduleRecordStructure):
+        (JSC::JSGlobalObject::moduleNamespaceObjectStructure):
+        (JSC::JSGlobalObject::proxyObjectStructure):
+        (JSC::JSGlobalObject::callableProxyObjectStructure):
+        (JSC::JSGlobalObject::proxyRevokeStructure):
+        (JSC::JSGlobalObject::wasmModuleStructure):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::makeRevocableProxy):
+        (JSC::constructProxyObject):
+        (JSC::ProxyConstructor::getConstructData):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::ProxyObject):
+        (JSC::ProxyObject::structureForTarget):
+        (JSC::ProxyObject::finishCreation):
+        * runtime/ProxyObject.h:
+        (JSC::ProxyObject::create):
+        (JSC::ProxyObject::createStructure):
+        * tests/es6.yaml:
+        * tests/stress/proxy-instanceof.js: Added.
+        (assert):
+        (test):
+        (C):
+        (test.let.handler.get if):
+        (test.let.handler):
+
+2016-03-10  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] RegExp sticky flag should be ignored in String.match when global flag is given
+        https://bugs.webkit.org/show_bug.cgi?id=155332
+
+        Reviewed by Saam Barati.
+
+        Removed logic from stringProtoFuncMatch that handles the case where both global and sticky flags are set.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+
+2016-03-10  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Allow RegExp constructor to take pattern from an existing RegExp with new flags
+        https://bugs.webkit.org/show_bug.cgi?id=155315
+
+        Reviewed by Saam Barati.
+
+        Changed to comply with section 21.2.3.1, step 5.  Eliminated syntax error.
+
+        In the process, change to get the VM at the top of the function.
+
+        Updated tests accordingly.
+
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * tests/es6.yaml: Changed miscellaneous_RegExp_constructor_can_alter_flags.js to normal.
+        * tests/mozilla/mozilla-tests.yaml: Disabled ecma_3/RegExp/15.10.4.1-5-n.js as it checks
+        for the old behavior of throwing a syntax error.
+
+2016-03-10  Saam barati  <sbarati@apple.com>
+
+        [ES6] Make ToPropertyDescriptor spec compliant
+        https://bugs.webkit.org/show_bug.cgi?id=155313
+
+        Reviewed by Mark Lam.
+
+        We were performing HasProperty(.) and Get(.) in the same operation.
+        This isn't valid according to the spec and it's user observable
+        behavior with Proxy. This patch fixes ToPropertyDescriptor to use
+        two distinct operations for HasProperty(.) and Get(.).
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ownEnumerablePropertyKeys):
+        (JSC::toPropertyDescriptor):
+        * tests/es6.yaml:
+        * tests/stress/to-property-key-correctness.js: Added.
+        (assert):
+        (test):
+        (test.let.handler.has):
+        (arrayEq):
+        (let.handler.has):
+        (let.target):
+        (set get let):
+
+2016-03-10  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: report the underlying parser error message when JSON parsing fails
+        https://bugs.webkit.org/show_bug.cgi?id=155303
+        <rdar://problem/25088939>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        (generate_from_specification.load_specification):
+        Stringize the underlying error so we can see what it says.
+
+2016-03-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: JavaScript Heap Allocations Timeline
+        https://bugs.webkit.org/show_bug.cgi?id=155287
+        <rdar://problem/25078088>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype._describe):
+        (InjectedScript.prototype._nodeDescription):
+        Provide the nicer node preview more often.
+
+2016-03-10  Saam barati  <sbarati@apple.com>
+
+        Assignment to new.target should be an early error
+        https://bugs.webkit.org/show_bug.cgi?id=151148
+
+        Reviewed by Mark Lam.
+
+        This patch makes it so that any form of assignment to new.target
+        is an early syntax error.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createNewTargetExpr):
+        (JSC::ASTBuilder::isNewTarget):
+        (JSC::ASTBuilder::createResolve):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseUnaryExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createThisExpr):
+        (JSC::SyntaxChecker::createSuperExpr):
+        (JSC::SyntaxChecker::createNewTargetExpr):
+        (JSC::SyntaxChecker::isNewTarget):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        * tests/es6.yaml:
+        * tests/stress/new-target-syntax-errors.js: Added.
+        (shouldBeSyntaxError):
+        (shouldNotBeSyntaxError):
+        * tests/stress/new-target.js:
+        (Constructor):
+        (doWeirdThings):
+        (noAssign): Deleted.
+        (catch): Deleted.
+
+2016-03-08  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        How we load new.target in arrow functions is broken
+        https://bugs.webkit.org/show_bug.cgi?id=155153
+
+        Reviewed by Saam Barati.
+
+        Fixed not correct approach of caching new.target. In current patch was added code feature
+        flag that shows that current function is using new.target, when generating byte code an arrow 
+        function we are loading new.target value to its register from arrow function lexical environment. 
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::newTarget):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createNewTargetExpr):
+        (JSC::ASTBuilder::usesNewTarget):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::usesNewTarget):
+        * parser/ParserModes.h:
+        * tests/stress/arrowfunction-lexical-bind-newtarget.js:
+
+2016-03-09  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Get a RemoteObject or ObjectPreview from HeapSnapshot Object Identifier
+        https://bugs.webkit.org/show_bug.cgi?id=155264
+        <rdar://problem/25070716>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::functionDetails):
+        (Inspector::InjectedScript::previewValue):
+        New InjectedScript methods for building Debugger.FunctionDetails
+        or Runtime.ObjectPreview protocol objects from a JSValue.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.prototype.previewValue):
+        (InjectedScript.prototype.functionDetails):
+        (InjectedScript.prototype.getFunctionDetails):
+        (InjectedScript.RemoteObject.prototype._isPreviewableObjectInternal):
+        (InjectedScript.RemoteObject.prototype._createObjectPreviewForValue): Deleted.
+        (InjectedScript.RemoteObject.prototype._appendEntryPreviews): Deleted.
+        Share code around creating function details or object preview objects.
+
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::InspectorHeapAgent):
+        (Inspector::InspectorHeapAgent::nodeForHeapObjectIdentifier):
+        (Inspector::InspectorHeapAgent::getPreview):
+        (Inspector::InspectorHeapAgent::getRemoteObject):
+        * inspector/agents/InspectorHeapAgent.h:
+        * inspector/protocol/Heap.json:
+        New protocol methods that go from heap object identifier to a
+        remote object or some kind of preview.
+
+        * inspector/scripts/codegen/generator.py:
+        Allow runtime casts for ObjectPreview.
+
+2016-03-09  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Intl Constructors not web compatible with Object.create usage
+        https://bugs.webkit.org/show_bug.cgi?id=153679
+
+        Reviewed by Darin Adler.
+
+        Add workaround for initializing NumberFormat and DateTimeFormat objects
+        using Object.create followed by constructor.call. This is necessary for
+        backwards compatibility with libraries relying on v1 behavior of Intl
+        constructors.
+
+        Collator does not get the workaround, since polyfills do not include it,
+        and there are not any known instances of v2 incompatible libraries.
+
+        The workaround involves checking for an object that inherits from the
+        *Format constructor, but was not actually initialized with that type. A
+        substitute instance is created and attached to the object using a private
+        name. The prototype functions then check for the private property to use
+        in place of the original object.
+
+        Since this behavior is not part of the v2 spec, it should be removed as
+        soon as the incompatible behavior is no longer in common use.
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::callIntlDateTimeFormat):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::callIntlNumberFormat):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+
+2016-03-09  Saam barati  <sbarati@apple.com>
+
+        Add proper JSON.stringify support for Proxy when the target is an array
+        https://bugs.webkit.org/show_bug.cgi?id=155180
+
+        Reviewed by Darin Adler.
+
+        This patch makes the following type of program true:
+        `JSON.stringify(new Proxy([25], {})) === "[25]"`
+
+        We need to change the JSON stringifier to use the IsArray test
+        in section 7.2.2 of ES6 spec instead of the JSC inherits(JSArray::info())
+        test.
+
+        This patch also adds tests for general JSON.stringify support
+        of Proxy.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::arrayConstructorIsArray):
+        (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        (JSC::isArray):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::object):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::startNewLine):
+        (JSC::Stringifier::Holder::Holder):
+        * tests/es6.yaml:
+        * tests/stress/proxy-json.js: Added.
+        (assert):
+        (test):
+
+2016-03-09  Saam Barati  <sbarati@apple.com>
+
+        ES6: Implement lexical scoping for function definitions in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=152844
+
+        Reviewed by Geoffrey Garen.
+
+        This patch implements block scoping for function definitions
+        in strict mode. The implementation works as follows:
+        
+        - If we're in sloppy mode, function declarations work exactly
+          as they did before this patch. I.e, function declarations are hoisted
+          and declared like "var" variables.
+        
+        - If you're in strict mode and at the top of a function scope or program
+          scope, function declarations still work like they used to. They are defined
+          like "var" variables. This is necessary for backwards compatibility
+          because ES5 strict mode allowed duplicate function declarations at the
+          top-most scope of a program/function.
+        
+        - If you're in strict mode and inside a block statement or a switch statement,
+          function declarations are now block scoped. All function declarations within
+          a block are hoisted to the beginning of the block. They are not hoisted out of the 
+          block like they are in sloppy mode. This allows for the following types of
+          programs:
+          ```
+          function foo() {
+              function bar() { return 20; }
+              {
+                  function bar() { return 30; }
+                  bar(); // 30
+              }
+              bar(); // 20
+          }
+          ```
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::instantiateLexicalVariables):
+        (JSC::BytecodeGenerator::emitPrefillStackTDZVariables):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::initializeBlockScopedFunctions):
+        (JSC::BytecodeGenerator::popLexicalScope):
+        (JSC::BytecodeGenerator::liftTDZCheckIfPossible):
+        (JSC::BytecodeGenerator::pushTDZVariables):
+        (JSC::BytecodeGenerator::getVariablesUnderTDZ):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        (JSC::BytecodeGenerator::emitNewFunctionExpressionCommon):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        * bytecompiler/BytecodeGenerator.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createSourceElements):
+        (JSC::ASTBuilder::features):
+        (JSC::ASTBuilder::numConstants):
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::createClassDeclStatement):
+        (JSC::ASTBuilder::createBlockStatement):
+        (JSC::ASTBuilder::createTryStatement):
+        (JSC::ASTBuilder::createSwitchStatement):
+        (JSC::ASTBuilder::Scope::Scope):
+        (JSC::ASTBuilder::funcDeclarations): Deleted.
+        * parser/NodeConstructors.h:
+        (JSC::CaseBlockNode::CaseBlockNode):
+        (JSC::SwitchNode::SwitchNode):
+        (JSC::BlockNode::BlockNode):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ScopeNode::singleStatement):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ModuleProgramNode::ModuleProgramNode):
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionNode::FunctionNode):
+        (JSC::VariableEnvironmentNode::VariableEnvironmentNode):
+        * parser/Nodes.h:
+        (JSC::VariableEnvironmentNode::VariableEnvironmentNode):
+        (JSC::VariableEnvironmentNode::lexicalVariables):
+        (JSC::VariableEnvironmentNode::functionStack):
+        (JSC::ScopeNode::captures):
+        (JSC::ScopeNode::varDeclarations):
+        (JSC::ScopeNode::neededConstants):
+        (JSC::ProgramNode::startColumn):
+        (JSC::ProgramNode::endColumn):
+        (JSC::EvalNode::startColumn):
+        (JSC::EvalNode::endColumn):
+        (JSC::ModuleProgramNode::startColumn):
+        (JSC::ModuleProgramNode::endColumn):
+        (JSC::ScopeNode::functionStack): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::didFinishParsing):
+        (JSC::Parser<LexerType>::parseStatementListItem):
+        (JSC::Parser<LexerType>::parseSwitchStatement):
+        (JSC::Parser<LexerType>::parseBlockStatement):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::getMetadata):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseExportDeclaration):
+        * parser/Parser.h:
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareFunction):
+        (JSC::Scope::appendFunction):
+        (JSC::Scope::takeFunctionDeclarations):
+        (JSC::Scope::declareLexicalVariable):
+        (JSC::Parser::currentVariableScope):
+        (JSC::Parser::currentLexicalDeclarationScope):
+        (JSC::Parser::currentFunctionScope):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::popScopeInternal):
+        (JSC::Parser::declareVariable):
+        (JSC::Parser::declareFunction):
+        (JSC::Parser::hasDeclaredVariable):
+        (JSC::Parser::isFunctionMetadataNode):
+        (JSC::Parser<LexerType>::parse):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFuncDeclStatement):
+        (JSC::SyntaxChecker::createClassDeclStatement):
+        (JSC::SyntaxChecker::createBlockStatement):
+        (JSC::SyntaxChecker::createExprStatement):
+        (JSC::SyntaxChecker::createIfStatement):
+        (JSC::SyntaxChecker::createContinueStatement):
+        (JSC::SyntaxChecker::createTryStatement):
+        (JSC::SyntaxChecker::createSwitchStatement):
+        (JSC::SyntaxChecker::createWhileStatement):
+        (JSC::SyntaxChecker::createWithStatement):
+        (JSC::SyntaxChecker::createDoWhileStatement):
+        * parser/VariableEnvironment.h:
+        (JSC::VariableEnvironmentEntry::isExported):
+        (JSC::VariableEnvironmentEntry::isImported):
+        (JSC::VariableEnvironmentEntry::isImportedNamespace):
+        (JSC::VariableEnvironmentEntry::isFunction):
+        (JSC::VariableEnvironmentEntry::setIsCaptured):
+        (JSC::VariableEnvironmentEntry::setIsConst):
+        (JSC::VariableEnvironmentEntry::setIsExported):
+        (JSC::VariableEnvironmentEntry::setIsImported):
+        (JSC::VariableEnvironmentEntry::setIsImportedNamespace):
+        (JSC::VariableEnvironmentEntry::setIsFunction):
+        (JSC::VariableEnvironmentEntry::clearIsVar):
+        (JSC::VariableEnvironment::VariableEnvironment):
+        (JSC::VariableEnvironment::begin):
+        (JSC::VariableEnvironment::end):
+        * tests/es6.yaml:
+        * tests/stress/block-scoped-function-declarations.js: Added.
+        (assert):
+        (test):
+        (f.foo.bar):
+        (f.foo.):
+        (f.foo):
+        (f):
+        (assert.foo.):
+        (assert.foo):
+        (assert.foo.foo):
+        (assert.foo.bar):
+        (assert.foo.switch.case.1):
+        (assert.foo.switch.case.2):
+        (assert.foo.switch.foo):
+        (assert.foo.switch.bar):
+
+2016-03-09  Saam barati  <sbarati@apple.com>
+
+        Array.isArray support for Proxy
+        https://bugs.webkit.org/show_bug.cgi?id=155179
+
+        Reviewed by Mark Lam.
+
+        This patch implements Array.isArray to be compliant
+        with the ES6 spec. Specifically, it needs to interface
+        properly with Proxy arguments.
+        https://tc39.github.io/ecma262/#sec-isarray
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getCallData):
+        (JSC::arrayConstructorIsArray):
+        (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::revoke):
+        (JSC::ProxyObject::isRevoked):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        (JSC::ProxyObject::target):
+        (JSC::ProxyObject::handler):
+        * tests/es6.yaml:
+        * tests/stress/proxy-is-array.js: Added.
+        (assert):
+        (test):
+
+2016-03-09  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Fix the ARM64 MacroAssembler after r197816
+        https://bugs.webkit.org/show_bug.cgi?id=155268
+
+        Reviewed by Mark Lam.
+
+        The patch tries to generate instructions that do not exist,
+        causing quite fun stuff at runtime.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::load8):
+        (JSC::MacroAssemblerARM64::store16):
+        (JSC::MacroAssemblerARM64::store8):
+
+2016-03-09  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r197873.
+        https://bugs.webkit.org/show_bug.cgi?id=155262
+
+        "Crashes some JSC tests" (Requested by mlam on #webkit).
+
+        Reverted changeset:
+
+        "Add dumping of function expression names in CodeBlock
+        bytecode dump."
+        https://bugs.webkit.org/show_bug.cgi?id=155248
+        http://trac.webkit.org/changeset/197873
+
+2016-03-09  Oliver Hunt  <oliver@apple.com>
+
+        Fix old iOS
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
+
+2016-03-09  Oliver Hunt  <oliver@apple.com>
+
+        Wincairo buildfix
+        https://bugs.webkit.org/show_bug.cgi?id=155245
+
+        Reviewed by Mark Lam.
+
+        Fix up exports for a few symbols
+
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2016-03-09  Mark Lam  <mark.lam@apple.com>
+
+        Add dumping of function expression names in CodeBlock bytecode dump.
+        https://bugs.webkit.org/show_bug.cgi?id=155248
+
+        Reviewed by Filip Pizlo.
+
+        Because ...
+        [  19] new_func_exp      loc5, loc3, f0:foo
+
+        ... is more informative than
+        [  19] new_func_exp      loc5, loc3, f0
+
+        Anonymous functions will be dumped as <anon>.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpFunctionExpr):
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/CodeBlock.h:
+
+2016-03-09  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Implement RegExp sticky flag and related functionality
+        https://bugs.webkit.org/show_bug.cgi?id=155177
+
+        Reviewed by Saam Barati.
+
+        Implemented the ES6 RegExp sticky functionality.
+
+        There are two main behavior changes when the sticky flag is specified.
+        1) Matching starts at lastIndex and lastIndex is updated after the match.
+        2) The regular expression is only matched from the start position in the string.
+        See ES6 section 21.2.5.2.2 for details.
+
+        Changed both the Yarr interpreter and jit to not loop to the next character for sticky RegExp's.
+        Updated RegExp exec and match, and stringProtoFuncMatch to handle lastIndex changes.
+
+        Restructured the way flags are passed to and through YarrPatterns to use RegExpFlags instead of
+        individual bools.
+
+        Updated tests for 'y' flag and new behavior.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::regexpToSourceString):
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::findMagicComment):
+        * runtime/CommonIdentifiers.h:
+        * runtime/RegExp.cpp:
+        (JSC::regExpFlags):
+        (JSC::RegExpFunctionalTestCollector::outputOneTest):
+        (JSC::RegExp::finishCreation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+        * runtime/RegExp.h:
+        * runtime/RegExpKey.h:
+        * runtime/RegExpObjectInlines.h:
+        (JSC::RegExpObject::execInline):
+        (JSC::RegExpObject::matchInline):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::flagsString):
+        (JSC::regExpProtoGetterMultiline):
+        (JSC::regExpProtoGetterSticky):
+        (JSC::regExpProtoGetterUnicode):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        * tests/es6.yaml:
+        * tests/stress/static-getter-in-names.js:
+        (shouldBe):
+        * yarr/RegularExpression.cpp:
+        (JSC::Yarr::RegularExpression::Private::compile):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionEOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::matchDotStarEnclosure):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        (JSC::Yarr::BytecodePattern::estimatedSizeInBytes):
+        (JSC::Yarr::BytecodePattern::ignoreCase):
+        (JSC::Yarr::BytecodePattern::multiline):
+        (JSC::Yarr::BytecodePattern::sticky):
+        (JSC::Yarr::BytecodePattern::unicode):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::YarrGenerator::generateAssertionBOL):
+        (JSC::Yarr::YarrGenerator::generateAssertionEOL):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generateDotStarEnclosure):
+        (JSC::Yarr::YarrGenerator::backtrack):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::YarrPatternConstructor::optimizeBOL):
+        (JSC::Yarr::YarrPattern::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::YarrPattern::reset):
+        (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
+        (JSC::Yarr::YarrPattern::ignoreCase):
+        (JSC::Yarr::YarrPattern::multiline):
+        (JSC::Yarr::YarrPattern::sticky):
+        (JSC::Yarr::YarrPattern::unicode):
+
+2016-03-09  Mark Lam  <mark.lam@apple.com>
+
+        FunctionExecutable::ecmaName() should not be based on inferredName().
+        https://bugs.webkit.org/show_bug.cgi?id=155203
+
+        Reviewed by Michael Saboff.
+
+        The ES6 rules for how a function name should be inferred closely matches JSC's
+        implementation with one exception:
+            var o = {}
+            o.foo = function() {}
+
+        JSC's inferredName for o.foo would be "foo".
+        ES6 specifies that o.foo.name is "".
+
+        The fix is to add a distinct FunctionExecutable::ecmaName() which applies the ES6
+        rules for inferring the initial value of Function.name.
+
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createGetterOrSetterProperty):
+        (JSC::ASTBuilder::createProperty):
+        (JSC::ASTBuilder::makeAssignNode):
+        * parser/Nodes.h:
+        * runtime/Executable.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::reifyName):
+        * tests/es6.yaml:
+
+2016-03-09  Michael Saboff  <msaboff@apple.com>
+
+        Harden JSC Root element functions from bad values
+        https://bugs.webkit.org/show_bug.cgi?id=155234
+
+        Reviewed by Saam Barati.
+
+        Changed jsCast() to jsDynamicCast() in Root related function to protect against being
+        called with non-Root arguments.
+
+        * jsc.cpp:
+        (functionCreateElement):
+        (functionGetElement):
+        (functionSetElementRoot):
+
+2016-03-09  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Pick how to OSR Enter to FTL at runtime instead of compile time
+        https://bugs.webkit.org/show_bug.cgi?id=155217
+
+        Reviewed by Filip Pizlo.
+
+        This patch addresses 2 types of problems with tiering up to FTL
+        with OSR Entry in a loop:
+        -When there are nested loops, it is generally valuable to enter
+         an outer loop rather than an inner loop.
+        -When tiering up at a point that cannot OSR Enter, we are at
+         the mercy of the outer loop frequency to compile the right
+         entry point.
+
+        The first case is significant in the test "gaussian-blur".
+        That test has 4 nested loops. When we have an OSR Entry,
+        the analysis phases have to be pesimistic where we enter:
+        we do not really know what constraint can be proven from
+        the DFG code that was running.
+
+        In "gaussian-blur", integer-range analysis removes pretty
+        much all overflow checks in the inner loops of where we entered.
+        The more outside we enter, the better code we generate.
+
+        Since we spend the most iterations in the inner loop, we naturally
+        tend to OSR Enter into the 2 most inner loops, making the most
+        pessimistic assumptions.
+
+        To avoid such problems, I changed how we decide where to OSR Enter.
+        Previously, the last CheckTierUpAndOSREnter to cross the threshold
+        was where we take the entry point for FTL.
+
+        What happens now is that the entry point is not decied when
+        compiling the CheckTierUp variants. Instead, all the information
+        we need is gathered during compilation and keept on the JITCode
+        to be used at runtime.
+
+        When we try to tier up and decide to OSR Enter, we use the information
+        we have to pick a good outer loop for OSR Entry.
+
+        Now the problem is outer loop do not CheckTierUpAndOSREnter often,
+        wasting several miliseconds before entering the newly compiled FTL code.
+
+        To solve that, every CheckTierUpAndOSREnter has its own trigger that
+        bypass the counter. When the FTL Code is compiled, the trigger is set
+        and we enter through the right CheckTierUpAndOSREnter immediately.
+
+        ---
+
+        This new mechanism also solves a problem of ai-astar.
+        When we try to tier up in ai-astar, we had nothing to compile until
+        the outer loop is reached.
+
+        To make sure we reached the CheckTierUpAndOSREnter in a reasonable time,
+        we had CheckTierUpWithNestedTriggerAndOSREnter with a special trigger.
+
+        With the new mechanism, we can do much better:
+        -When we keep hitting CheckTierUpInLoop, we now have all the information
+         we need to already start compiling the outer loop.
+         Instead of waiting for the outer loop to be reached a few times, we compile
+         it as soon as the inner loop is hammering CheckTierUpInLoop.
+        -With the new triggers, the very next time we hit the outer loop, we OSR Enter.
+
+        This allow us to compile what we need sooner and enter sooner.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize): Deleted.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC): Deleted.
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Deleted.
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::compileEntryExecutionFlag):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.h:
+        (JSC::DFG::Plan::canTierUpAndOSREnter):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Deleted.
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        (JSC::DFG::TierUpCheckInjectionPhase::buildNaturalLoopToLoopHintMap):
+        (JSC::DFG::TierUpCheckInjectionPhase::findLoopsContainingLoopHintWithoutOSREnter): Deleted.
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp:
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback):
+        (JSC::DFG::Ref<ToFTLForOSREntryDeferredCompilationCallback>ToFTLForOSREntryDeferredCompilationCallback::create):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously):
+        (JSC::DFG::ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete):
+        * dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h:
+
+2016-03-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to constant-fold strings
+        https://bugs.webkit.org/show_bug.cgi?id=155200
+
+        Reviewed by Geoffrey Garen.
+
+        This adds constant-folding of string1 + string2 and string.length. The actual folding
+        rule is easy, but there are some gotchas.
+
+        The problem is that the DFG cannot allocate new JSString objects until we are on the
+        main thread. So, DFG IR must have a node for a JSValue string constant that hasn't been
+        created yet - i.e. it doesn't have any concrete JSValue bits yet.
+
+        We have the ability to speak of such things, using LazyJSValue. But that's a class, not
+        a node type. This patch now adds a node type, LazyJSConstant, which is a Node that holds
+        a LazyJSValue.
+
+        This puts us in a weird situation: AI uses JSValue to represent constants. It would take
+        a lot of work to change it to use LazyJSValue. So, this implements the constant folding
+        in StrengthReductionPhase. I created a bug and put a FIXME about moving these rules into
+        AI.
+
+        OTOH, our experience in B3 shows that constant folding in strength reduction is quite
+        nice. It would totally make sense to have strength reduction have constant folding rules
+        that mirror the rules in AI, or to factor out the AI constant folding rules, the same
+        way that B3 factors out those rules into Value methods.
+
+        Another issue is how to represent the cumulative result of possibly many foldings. I
+        initially considered adding LazyJSValue kinds that represented concatenation. Folding
+        the concatenation to a constant meand that this constant was actually a LazyJSValue that
+        represented the concatenation of two other things. But this would get super messy if we
+        wanted to fold an operation that uses the results of another folded operation.
+
+        So, the JIT thread folds string operations by creating a WTF::String that contains the
+        result. The DFG::Graph holds a +1 on the underlying StringImpl, so we can pass the
+        StringImpl* around without reference counting. The LazyJSValue now has a special kind
+        that means: we created this StringImpl* on the JIT thread, and once the JIT is done, we
+        will relinquish ownership of it. LazyJSValue has some magic to emit code for these
+        to-be-created-JSStrings while also transferring ownership of the StringImpl from the JIT
+        thread to the main thread and registering the JSString with the GC.
+
+        This just implements folding for concatenation and GetArrayLength. It's just a proof of
+        concept for evil things I want to do later.
+
+        This change is a 2.5x speed-up on the string concatenation microbenchmarks I added in
+        this patch.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGFrozenValue.cpp:
+        (JSC::DFG::FrozenValue::emptySingleton):
+        (JSC::DFG::FrozenValue::tryGetString):
+        (JSC::DFG::FrozenValue::dumpInContext):
+        * dfg/DFGFrozenValue.h:
+        (JSC::DFG::FrozenValue::strength):
+        * dfg/DFGGraph.h:
+        * dfg/DFGLazyJSValue.cpp:
+        (JSC::DFG::LazyJSValue::newString):
+        (JSC::DFG::LazyJSValue::getValue):
+        (JSC::DFG::equalToStringImpl):
+        (JSC::DFG::LazyJSValue::tryGetStringImpl):
+        (JSC::DFG::LazyJSValue::tryGetString):
+        (JSC::DFG::LazyJSValue::strictEqual):
+        (JSC::DFG::LazyJSValue::switchLookupValue):
+        (JSC::DFG::LazyJSValue::emit):
+        (JSC::DFG::LazyJSValue::dumpInContext):
+        * dfg/DFGLazyJSValue.h:
+        (JSC::DFG::LazyJSValue::LazyJSValue):
+        (JSC::DFG::LazyJSValue::knownStringImpl):
+        (JSC::DFG::LazyJSValue::kind):
+        (JSC::DFG::LazyJSValue::tryGetValue):
+        (JSC::DFG::LazyJSValue::character):
+        (JSC::DFG::LazyJSValue::stringImpl):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::Node::convertToIdentityOn):
+        (JSC::DFG::Node::convertToLazyJSConstant):
+        (JSC::DFG::Node::convertToPutHint):
+        (JSC::DFG::Node::convertToPutClosureVarHint):
+        (JSC::DFG::Node::tryGetString):
+        (JSC::DFG::Node::promotedLocationDescriptor):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToConstant):
+        (JSC::DFG::Node::convertToConstantStoragePointer):
+        (JSC::DFG::Node::castConstant):
+        (JSC::DFG::Node::hasLazyJSValue):
+        (JSC::DFG::Node::lazyJSValue):
+        (JSC::DFG::Node::initializationValueForActivation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex):
+        (JSC::DFG::SpeculativeJIT::compileLazyJSConstant):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInt52Constant):
+        (JSC::FTL::DFG::LowerDFGToB3::compileLazyJSConstant):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
+
+2016-03-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Memory Timeline should show MemoryPressure events
+        https://bugs.webkit.org/show_bug.cgi?id=155158
+        <rdar://problem/25026610>
+
+        Reviewed by Brian Burg.
+
+        * inspector/protocol/Memory.json:
+
+2016-03-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add Heap domain start/stop tracking commands
+        https://bugs.webkit.org/show_bug.cgi?id=155190
+
+        Reviewed by Brian Burg.
+
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorHeapAgent::startTracking):
+        (Inspector::InspectorHeapAgent::stopTracking):
+        * inspector/agents/InspectorHeapAgent.h:
+        * inspector/protocol/Heap.json:
+
+2016-03-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add a way to create a Heap Snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=155188
+
+        Reviewed by Brian Burg.
+
+        * inspector/agents/InspectorHeapAgent.h:
+        * inspector/protocol/Heap.json:
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::snapshot):
+        Take a heap snapshot and return the JSON string result.
+
+        * inspector/protocol/Debugger.json:
+        Remove unused optional inferredName. Our displayName would be inferred.
+
+2016-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Fix ios bot build.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
+
+2016-03-08  Mark Lam  <mark.lam@apple.com>
+
+        Implement Function.name support for getters/setters and inferring name of function properties.
+        https://bugs.webkit.org/show_bug.cgi?id=154865
+
+        Rubber-stamped by Joseph Pecoraro.
+
+        Follow up to the fix for this bug: adding a few small clean-ups for issues Joe
+        pointed out in the bug.
+
+        * runtime/JSBoundSlotBaseFunction.cpp:
+        (JSC::JSBoundSlotBaseFunction::create):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitiveByIndex):
+
+2016-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Start moving to separated writable and executable mappings in the JIT
+        https://bugs.webkit.org/show_bug.cgi?id=155178
+
+        Reviewed by Fil Pizlo.
+
+        Start moving to a separate writable and executable heap for the various
+        JITs.
+
+        As part of our work to harden the JIT against various attacks, we're
+        moving away from our current RWX heap and on to using separate RW and X
+        mappings. This means that simply leaking the location of the executable
+        mapping is not sufficient to compromise JSC, so we can continue to
+        use direct executable pointers in our GC objects (which we need for
+        performance), but keep the writable pointer in only a single location
+        so that we are less likely to leak the address. To further obscure the
+        address of the writable region we place it in an execute only region
+        of memory so that it is not possible to read the location from 
+        anywhere. That means an attacker must have at least partial control
+        of PC (to call jitMemCopy) before they can start to attack the JIT.
+
+        This work is initially ARM64 only, as we use as the jitMemCopy is
+        currently specific to that platform's calling conventions and layout.
+        We're just landing it in the current form so that we can at least
+        ensure it doesn't regress.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::ldp):
+        (JSC::ARM64Assembler::ldnp):
+        (JSC::ARM64Assembler::fillNops):
+        (JSC::ARM64Assembler::stp):
+        (JSC::ARM64Assembler::stnp):
+        (JSC::ARM64Assembler::replaceWithJump):
+        (JSC::ARM64Assembler::replaceWithLoad):
+        (JSC::ARM64Assembler::replaceWithAddressComputation):
+        (JSC::ARM64Assembler::setPointer):
+        (JSC::ARM64Assembler::repatchInt32):
+        (JSC::ARM64Assembler::repatchCompact):
+        (JSC::ARM64Assembler::linkJumpOrCall):
+        (JSC::ARM64Assembler::linkCompareAndBranch):
+        (JSC::ARM64Assembler::linkConditionalBranch):
+        (JSC::ARM64Assembler::linkTestAndBranch):
+        (JSC::ARM64Assembler::loadStoreRegisterPairOffset):
+        (JSC::ARM64Assembler::loadStoreRegisterPairNonTemporal):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        (JSC::LinkBuffer::allocate):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::sub64):
+        (JSC::MacroAssemblerARM64::load64):
+        (JSC::MacroAssemblerARM64::loadPair64):
+        (JSC::MacroAssemblerARM64::loadPair64WithNonTemporalAccess):
+        (JSC::MacroAssemblerARM64::load8):
+        (JSC::MacroAssemblerARM64::store64):
+        (JSC::MacroAssemblerARM64::storePair64):
+        (JSC::MacroAssemblerARM64::storePair64WithNonTemporalAccess):
+        (JSC::MacroAssemblerARM64::store8):
+        (JSC::MacroAssemblerARM64::branchAdd64):
+        (JSC::MacroAssemblerARM64::branchSub64):
+        * jit/ExecutableAllocator.h:
+        (JSC::performJITMemcpy):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        (JSC::FixedVMPoolExecutableAllocator::initializeSeparatedWXHeaps):
+        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2016-03-08  Mark Lam  <mark.lam@apple.com>
+
+        Implement Function.name support for getters/setters and inferring name of function properties.
+        https://bugs.webkit.org/show_bug.cgi?id=154865
+
+        Reviewed by Geoffrey Garen.
+
+        1. toString() no longer uses the value of Function.name as the name of the
+           function in the returned string, because ...
+
+            i. Function.name is supposed to be configurable.  Hence, it can be made
+               writable and can be set to any JSValue, or deleted.
+           ii. Function.prototype.toString() is supposed to produce a string that can be
+               eval'ed.  Hence, for JS functions, the function name in the produced
+               string must be a legal function name (and not some arbitrary value set in
+               Function.name).  For example, while a number is a legal value for
+               Function.name, it is not legal as the function name in the toString()
+               string.
+
+           Instead, we'll always use the original name from the JS source that the
+           function was parsed from.
+
+        2. JSFunction::name() now always return the original name, not the value of
+           the Function.name property.  As a result, it also no longer needs an
+           ExecState* arg.
+
+           If the original name is an empty string, JSFunction::name() will use the
+           inferred name.
+
+        3. For JS functions, the original name can be attained from their
+           FunctionExecutable object.
+
+           For host/native functions (which do not have a FunctionExecutable), we get the
+           "original" name from its NativeExecutable.
+
+        4. The m_hostFunctionStubMap now keys its NativeExecutable pointers using the
+           original name, in addition to the native function and constructor pointers.
+
+           This is needed because we want a different NativeExecutable for functions with
+           a different name (to satisfy (3) above).
+
+        5. Changed JSBoundFunction to store the name of its bound function in its
+           NativeExecutable.  This will later be used to generate the toString() string.
+           It's Function.name value is eagerly initialized at construction time.
+
+        6. Function.name for getters/setters are now prefixed with "get"/"set".
+           This was done both for the JSBoundSlotBaseFunctions and JS definable get/set
+           functions.
+
+        7. Added InternalFunction::m_originalName so that we can use it to generate the
+           toString() string.  We're storing it as a JSString instead of a WTF::String
+           only because we want InternalFunction to be continue to be trivially
+           destructible.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::functionDetails):
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::finalize):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+        * runtime/Executable.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        (JSC::InternalFunction::visitChildren):
+        (JSC::InternalFunction::name):
+        (JSC::InternalFunction::displayName):
+        * runtime/InternalFunction.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::visitChildren):
+        (JSC::JSBoundFunction::toStringName): Deleted.
+        * runtime/JSBoundFunction.h:
+        (JSC::JSBoundFunction::boundThis):
+        (JSC::JSBoundFunction::boundArgs):
+        (JSC::JSBoundFunction::createStructure):
+        * runtime/JSBoundSlotBaseFunction.cpp:
+        (JSC::boundSlotBaseFunctionCall):
+        (JSC::JSBoundSlotBaseFunction::create):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::initializeRareData):
+        (JSC::JSFunction::name):
+        (JSC::JSFunction::displayName):
+        (JSC::JSFunction::calculatedDisplayName):
+        (JSC::JSFunction::reifyName):
+        * runtime/JSFunction.h:
+        * tests/es6.yaml:
+
+2016-03-08  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r197793 and r197799.
+        https://bugs.webkit.org/show_bug.cgi?id=155195
+
+        something weird happened while landing this and everything
+        broke (Requested by olliej on #webkit).
+
+        Reverted changesets:
+
+        "Start moving to separated writable and executable mappings in
+        the JIT"
+        https://bugs.webkit.org/show_bug.cgi?id=155178
+        http://trac.webkit.org/changeset/197793
+
+        "arm64 build fix after r197793."
+        http://trac.webkit.org/changeset/197799
+
+2016-03-08  Alex Christensen  <achristensen@webkit.org>
+
+        arm64 build fix after r197793.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        (JSC::FixedVMPoolExecutableAllocator::initializeBulletproofJIT):
+        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
+        Use consistent ENABLE macro.  It looks like it was partially renamed.
+
+2016-03-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Regexp matching should incur less call overhead
+        https://bugs.webkit.org/show_bug.cgi?id=155181
+
+        Reviewed by Geoffrey Garen.
+
+        Previously we had DFG/FTL code call into the DFGOperation, which then called in to
+        RegExpObject, which then called into createRegExpMatchesArray, which then called into
+        RegExp, which then called the code generated by Yarr.
+
+        Now we have DFG/FTL code call into the DFGOperation, which does all of the things and calls
+        into code generated by Yarr.
+
+        This is another tiny Octane/regexp speed-up.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOperations.cpp:
+        * runtime/RegExp.cpp:
+        (JSC::regExpFlags):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        (JSC::RegExp::compileMatchOnly):
+        (JSC::RegExp::deleteCode):
+        (JSC::RegExpFunctionalTestCollector::clearRegExp): Deleted.
+        (JSC::RegExp::compileIfNecessary): Deleted.
+        (JSC::RegExp::compileIfNecessaryMatchOnly): Deleted.
+        * runtime/RegExp.h:
+        * runtime/RegExpInlines.h: Added.
+        (JSC::RegExpFunctionalTestCollector::clearRegExp):
+        (JSC::RegExp::compileIfNecessary):
+        (JSC::RegExp::matchInline):
+        (JSC::RegExp::compileIfNecessaryMatchOnly):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::createEmptyRegExpMatchesArray):
+        (JSC::createStructureImpl):
+        (JSC::tryCreateUninitializedRegExpMatchesArray): Deleted.
+        (JSC::createRegExpMatchesArray): Deleted.
+        * runtime/RegExpMatchesArray.h:
+        (JSC::tryCreateUninitializedRegExpMatchesArray):
+        (JSC::createRegExpMatchesArray):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::put):
+        (JSC::RegExpObject::exec):
+        (JSC::RegExpObject::match):
+        (JSC::getLastIndexAsUnsigned): Deleted.
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::getLastIndex):
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::testInline):
+        * runtime/RegExpObjectInlines.h: Added.
+        (JSC::getRegExpObjectLastIndexAsUnsigned):
+        (JSC::RegExpObject::execInline):
+        (JSC::RegExpObject::matchInline):
+
+2016-03-08  Mark Lam  <mark.lam@apple.com>
+
+        synthesizePrototype() and friends need to be followed by exception checks (or equivalent).
+        https://bugs.webkit.org/show_bug.cgi?id=155169
+
+        Reviewed by Geoffrey Garen.
+
+        With the exception checks, we may end up throwing new exceptions over an existing
+        one that has been thrown but not handled yet, thereby obscuring it.  It may also
+        mean that the VM will continue running on potentially unstable state, which may
+        have undesirable consequences.
+
+        I first observed this in some failed assertion while running tests on a patch for
+        https://bugs.webkit.org/show_bug.cgi?id=154865.
+
+        Performance is neutral with this patch (tested on x86_64).
+
+        1. Deleted JSNotAnObject, and removed all uses of it.
+
+        2. Added exception checks, when needed, following calls to synthesizePrototype()
+           and JSValue::toObject().
+
+           The cases that do not need an exception check are the ones that already ensures
+           that JSValue::toObject() is only called on a value that is convertible to an
+           object.  In those cases, I added an assertion that no exception was thrown
+           after the call.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::createScriptCallStackFromException):
+        * interpreter/Interpreter.cpp:
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        (JSC::arrayProtoFuncValues):
+        (JSC::arrayProtoFuncEntries):
+        (JSC::arrayProtoFuncKeys):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::toThisSlowCase):
+        (JSC::JSValue::synthesizePrototype):
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::getPropertySlot):
+        (JSC::JSValue::get):
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoGetter):
+        * runtime/JSNotAnObject.cpp: Removed.
+        * runtime/JSNotAnObject.h: Removed.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncToString):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Start moving to separated writable and executable mappings in the JIT
+        https://bugs.webkit.org/show_bug.cgi?id=155178
+
+        Reviewed by Filip Pizlo.
+
+        Start moving to a separate writable and executable heap for the various
+        JITs.
+
+        As part of our work to harden the JIT against various attacks, we're
+        moving away from our current RWX heap and on to using separate RW and X
+        mappings. This means that simply leaking the location of the executable
+        mapping is not sufficient to compromise JSC, so we can continue to
+        use direct executable pointers in our GC objects (which we need for
+        performance), but keep the writable pointer in only a single location
+        so that we are less likely to leak the address. To further obscure the
+        address of the writable region we place it in an execute only region
+        of memory so that it is not possible to read the location from 
+        anywhere. That means an attacker must have at least partial control
+        of PC (to call jitMemCopy) before they can start to attack the JIT.
+
+        This work is initially ARM64 only, as we use as the jitMemCopy is
+        currently specific to that platform's calling conventions and layout.
+        We're just landing it in the current form so that we can at least
+        ensure it doesn't regress.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::ldp):
+        (JSC::ARM64Assembler::ldnp):
+        (JSC::ARM64Assembler::fillNops):
+        (JSC::ARM64Assembler::stp):
+        (JSC::ARM64Assembler::stnp):
+        (JSC::ARM64Assembler::replaceWithJump):
+        (JSC::ARM64Assembler::replaceWithLoad):
+        (JSC::ARM64Assembler::replaceWithAddressComputation):
+        (JSC::ARM64Assembler::setPointer):
+        (JSC::ARM64Assembler::repatchInt32):
+        (JSC::ARM64Assembler::repatchCompact):
+        (JSC::ARM64Assembler::linkJumpOrCall):
+        (JSC::ARM64Assembler::linkCompareAndBranch):
+        (JSC::ARM64Assembler::linkConditionalBranch):
+        (JSC::ARM64Assembler::linkTestAndBranch):
+        (JSC::ARM64Assembler::loadStoreRegisterPairOffset):
+        (JSC::ARM64Assembler::loadStoreRegisterPairNonTemporal):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::copyCompactAndLinkCode):
+        (JSC::LinkBuffer::allocate):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::sub64):
+        (JSC::MacroAssemblerARM64::load64):
+        (JSC::MacroAssemblerARM64::loadPair64):
+        (JSC::MacroAssemblerARM64::loadPair64WithNonTemporalAccess):
+        (JSC::MacroAssemblerARM64::load8):
+        (JSC::MacroAssemblerARM64::store64):
+        (JSC::MacroAssemblerARM64::storePair64):
+        (JSC::MacroAssemblerARM64::storePair64WithNonTemporalAccess):
+        (JSC::MacroAssemblerARM64::store8):
+        (JSC::MacroAssemblerARM64::branchAdd64):
+        (JSC::MacroAssemblerARM64::branchSub64):
+        * jit/ExecutableAllocator.h:
+        (JSC::performJITMemcpy):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        (JSC::FixedVMPoolExecutableAllocator::initializeBulletproofJIT):
+        (JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2016-03-08  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Regular Expression canonicalization tables for Unicode need to be updated to use Unicode CaseFolding.txt
+        https://bugs.webkit.org/show_bug.cgi?id=155114
+
+        Reviewed by Darin Adler.
+
+        Extracted out the Unicode canonicalization table creation from
+        YarrCanonicalizeUnicode.js into a new Python script, generateYarrCanonicalizeUnicode.
+        That script generates the Unicode tables as the file YarrCanonicalizeUnicode.cpp in
+        DerivedSources/JavaScriptCore.
+
+        Updated the processing of ignore case to make the ASCII short cuts dependent on whether
+        or not we are a Unicode pattern.
+
+        Renamed yarr/YarrCanonicalizeUnicode.{cpp,js} back to their prior names,
+        YarrCanonicalizeUCS2.{cpp,js}.
+        Renamed yarr/YarrCanonicalizeUnicode.h to YarrCanonicalize.h as it declares both the
+        legacy UCS2 and Unicode tables.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * generateYarrCanonicalizeUnicode: Added.
+        * ucd: Added.
+        * ucd/CaseFolding.txt: Added.  The current verion, 8.0, of the Unicode CaseFolding table.
+        * yarr/YarrCanonicalizeUCS2.cpp: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUnicode.cpp.
+        * yarr/YarrCanonicalize.h: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUnicode.h.
+        * yarr/YarrCanonicalizeUCS2.js: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUnicode.js.
+        (printHeader):
+        * yarr/YarrCanonicalizeUnicode.cpp: Removed.
+        * yarr/YarrCanonicalizeUnicode.h: Removed.
+        * yarr/YarrCanonicalizeUnicode.js: Removed.
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        * yarr/YarrJIT.cpp:
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+
+2016-03-08  Andreas Kling  <akling@apple.com>
+
+        WeakBlock::visit() should check for a WeakHandleOwner before consulting mark bits.
+        <https://webkit.org/b/155154>
+
+        Reviewed by Darin Adler.
+
+        Reorder the checks in WeakBlock::visit() so we don't look at the mark bits in MarkedBlock
+        unless the current WeakImpl has a WeakHandleOwner we need to consult.
+
+        I was originally hoping to make an optimization that could skip over entire WeakBlocks
+        if they didn't have a single WeakHandleOwner, but it turns out that scenario is not as
+        common as I suspected.
+
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::visit):
+
+2016-03-07  Saam barati  <sbarati@apple.com>
+
+        [ES6] Implement revocable proxies
+        https://bugs.webkit.org/show_bug.cgi?id=154321
+
+        Reviewed by Mark Lam.
+
+        This patch is a straight forward implementation of Proxy.revocable
+        with respect to section 26.2.2.1 of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy.revocable
+
+        This patch also fixes a bug in Proxy where we
+        were incorrectly caching "in", i.e, `"x" in proxy`.
+        We should never blatantly cache this because caching is observable
+        behavior by users of the language. We could come up with
+        a smarter caching scheme that caches only if the Proxy's
+        handler doesn't have a "has" property, i.e, we don't have
+        to call out to JS code. But for now, it's easiest to disable
+        caching.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::moduleRecordStructure):
+        (JSC::JSGlobalObject::moduleNamespaceObjectStructure):
+        (JSC::JSGlobalObject::proxyObjectStructure):
+        (JSC::JSGlobalObject::proxyRevokeStructure):
+        (JSC::JSGlobalObject::wasmModuleStructure):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::ProxyConstructor::create):
+        (JSC::ProxyConstructor::ProxyConstructor):
+        (JSC::makeRevocableProxy):
+        (JSC::proxyRevocableConstructorThrowError):
+        (JSC::ProxyConstructor::finishCreation):
+        (JSC::constructProxyObject):
+        * runtime/ProxyConstructor.h:
+        (JSC::ProxyConstructor::createStructure):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::finishCreation):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::performPut):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        (JSC::ProxyObject::getPrototype):
+        (JSC::ProxyObject::revoke):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        (JSC::ProxyObject::create):
+        * runtime/ProxyRevoke.cpp: Added.
+        (JSC::ProxyRevoke::create):
+        (JSC::ProxyRevoke::ProxyRevoke):
+        (JSC::ProxyRevoke::finishCreation):
+        (JSC::performProxyRevoke):
+        (JSC::ProxyRevoke::getCallData):
+        (JSC::ProxyRevoke::visitChildren):
+        * runtime/ProxyRevoke.h: Added.
+        (JSC::ProxyRevoke::createStructure):
+        (JSC::ProxyRevoke::proxy):
+        (JSC::ProxyRevoke::setProxyToNull):
+        * tests/stress/proxy-has-property.js:
+        (assert):
+        (assert.let.handler.has):
+        (assert.let.foo):
+        * tests/stress/proxy-revoke.js: Added.
+        (assert):
+        (throw.new.Error.):
+        (throw.new.Error):
+        (callAllHandlers):
+        (shouldThrowNullHandler):
+        (allHandlersShouldThrow):
+        (i.let.trap.of.traps.trap.string_appeared_here.func):
+        (i.let.trap.of.traps.else.func):
+        (i.Proxy.revocable):
+
+2016-03-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the ARM build after r197687
+        https://bugs.webkit.org/show_bug.cgi?id=155128
+
+        Reviewed by Saam Barati.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::moveZeroToDouble):
+
+2016-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Reduce the number of instructions needed to record the last regexp result
+        https://bugs.webkit.org/show_bug.cgi?id=155161
+
+        Reviewed by Sam Weinig.
+
+        This tightens up RegExpCachedResult::record(). My profiling shows that we spend just
+        over 1% of the time in Octane/regexp in this function. This function had two obvious
+        redundancies:
+
+        1) It executed the write barrier on owner twice. It only needs to execute it once. Since
+           the same RegExpConstructor is likely to be used many times, it makes sense to do the
+           barrier without looking at the 'to' objects at all. In steady state, this means that
+           the RegExpConstructor will simply be OldGrey so this one barrier will always skip the
+           slow path.
+
+        2) It cleared some fields that didn't need to be cleared, since we can just use
+           m_reified to indicate that the fields are not meaningful anymore.
+
+        This is meant to be a microscopic regexp speed-up.
+
+        * runtime/RegExpCachedResult.cpp:
+        (JSC::RegExpCachedResult::visitChildren):
+        (JSC::RegExpCachedResult::lastResult):
+        * runtime/RegExpCachedResult.h:
+        (JSC::RegExpCachedResult::record):
+
+2016-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        createRegExpMatchesArray should allocate substrings more quickly
+        https://bugs.webkit.org/show_bug.cgi?id=155160
+
+        Reviewed by Sam Weinig.
+
+        This was calling a version of jsSubstring() that isn't inlineable because it was doing a lot
+        of checks in finishCreation(). In particular, it was checking that the base string is not
+        itself a substring and that it's been resolved. We don't need those checks here, since the
+        string must have been resolved prior to regexp processing.
+
+        This patch is also smart about whether to do checks for the empty and full substrings. In
+        the matches array loop, these checks are super unlikely to be profitable, so we just
+        unconditionally allocate the substring.
+
+        This removes those checks and makes the allocation inlineable. It looks like a 1% speed-up
+        on Octane/regexp.
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring):
+        (JSC::jsSubstringOfResolved):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::createRegExpMatchesArray):
+
+2016-03-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Small clean up of how we use SSA's valuesAtHead
+        https://bugs.webkit.org/show_bug.cgi?id=155152
+
+        Reviewed by Filip Pizlo.
+
+        liveAtHead and valuesAtHead contain the same nodes,
+        we do not need the extra look up.
+
+        This also opens the way to use the same kind of liveness
+        analysis as Air (where live values at head do not use a set).
+
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
+        (JSC::DFG::InPlaceAbstractState::merge):
+
+2016-03-07  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: the protocol generator should generate factory method stubs for protocol types
+        https://bugs.webkit.org/show_bug.cgi?id=155103
+        <rdar://problem/25002772>
+
+        Reviewed by Timothy Hatcher.
+
+        Generate stubs with unique names so that parsing methods can be used
+        reflectively at runtime, based on the protocol version that's loaded.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/scripts/codegen/__init__.py:
+        * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py:
+        Added. For each type in a domain, add a method of the form
+        -[ProtocolTypeConversions _parseXXX:fromPayload]. This is in a category
+        method, and the selector is only ever looked up at runtime.
+
+        (ObjCProtocolTypeConversionsHeaderGenerator.generate_output):
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        (generate_from_specification):
+
+        Rebaseline test results with new generator output.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-03-07  Filip Pizlo  <fpizlo@apple.com>
+
+        RegExp.prototype.exec() should call into Yarr at most once
+        https://bugs.webkit.org/show_bug.cgi?id=155139
+
+        Reviewed by Saam Barati.
+
+        For apparently no good reason, RegExp.prototype.match() was calling into Yarr twice, almost
+        as if it was hoping that the non-matching case was so common that it was best to have the
+        matching case do the work all over again.
+
+        This is a 4% speed-up on Octane/regexp. It's also a matter of common sense: we should not be
+        in the business of presuming whether someone's match will succeed or fail. The increased
+        cost of running Yarr twice is so much larger than whatever savings we were getting from
+        running a match-only regexp that this is just not a good overall deal for the engine.
+
+        Also, it's interesting that we are seeing a 4% speed-up on regexp despite the fact that a
+        majority (almost a supermajority, I think) of calls into RegExp.prototype.match() are failed
+        matches. So, this change is a 4% speed-up despite being a slow down on the common case. That
+        tells you just how bad the old behavior was on the uncommon case.
+
+        * runtime/MatchResult.h:
+        (MatchResult::MatchResult):
+        (MatchResult::failed):
+        (MatchResult::operator bool):
+        * runtime/RegExpCachedResult.cpp:
+        (JSC::RegExpCachedResult::lastResult):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::setMultiline):
+        (JSC::RegExpConstructor::multiline):
+        (JSC::RegExpConstructor::performMatch):
+        (JSC::RegExpConstructor::recordMatch):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::createRegExpMatchesArray):
+        (JSC::createEmptyRegExpMatchesArray):
+        (JSC::createStructureImpl):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::createRegExpMatchesArray):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::put):
+        (JSC::getLastIndexAsUnsigned):
+        (JSC::RegExpObject::exec):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::getLastIndex):
+        (JSC::RegExpObject::test):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+
+2016-03-07  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Heap Snapshot should include different Edge types and data (Property, Index, Variable)
+        https://bugs.webkit.org/show_bug.cgi?id=154937
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendHidden):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::appendHidden):
+        (JSC::SlotVisitor::appendValuesHidden):
+        Add new visit methods to visit a reference without snapshotting the edge.
+
+        * heap/Heap.cpp:
+        (JSC::AddExtraHeapSnapshotEdges::AddExtraHeapSnapshotEdges):
+        (JSC::AddExtraHeapSnapshotEdges::operator()):
+        (JSC::Heap::addHeapSnapshotEdges):
+        (JSC::Heap::removeDeadHeapSnapshotNodes):
+        (JSC::Heap::collectImpl):
+        * heap/Heap.h:
+        After marking, visit the live cells for a chance to record extra
+        heap snapshotting information about the cell.
+
+        * heap/HeapSnapshotBuilder.cpp:
+        (JSC::HeapSnapshotBuilder::appendNode):
+        (JSC::HeapSnapshotBuilder::appendEdge):
+        (JSC::HeapSnapshotBuilder::appendPropertyNameEdge):
+        (JSC::HeapSnapshotBuilder::appendVariableNameEdge):
+        (JSC::HeapSnapshotBuilder::appendIndexEdge):
+        (JSC::HeapSnapshotBuilder::json):
+        * heap/HeapSnapshotBuilder.h:
+        (JSC::HeapSnapshotEdge::HeapSnapshotEdge):
+        Construct edges with extra data.
+
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::heapSnapshot):
+        * runtime/JSCell.h:
+        Add a new method to provide cells with an opportunity to provide
+        extra heap snapshotting information.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+        (JSC::JSObject::visitChildren):
+        (JSC::JSObject::heapSnapshot):
+        (JSC::JSFinalObject::visitChildren):
+        * runtime/JSObject.h:
+        Capture object property names and index names when heap snapshotting.
+        Do not include them as internal edges in normal visitChildren.
+
+        * runtime/JSEnvironmentRecord.cpp:
+        (JSC::JSEnvironmentRecord::visitChildren):
+        (JSC::JSEnvironmentRecord::heapSnapshot):
+        * runtime/JSEnvironmentRecord.h:
+        * runtime/JSSegmentedVariableObject.cpp:
+        (JSC::JSSegmentedVariableObject::visitChildren):
+        (JSC::JSSegmentedVariableObject::heapSnapshot):
+        * runtime/JSSegmentedVariableObject.h:
+        Capture scope variable names when heap snapshotting.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::visitChildren):
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::propertyTable):
+        When performing a heap snapshotting collection, don't clear the
+        property table so that accessing the table during this GC is okay.
+
+        * tests/heapProfiler/driver/driver.js:
+        * tests/heapProfiler/property-edge-types.js: Added.
+        * tests/heapProfiler/variable-edge-types.js: Added.
+        Tests covering the different edge types and data we capture.
+
+2016-03-07  Saam barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[GetPrototypeOf]]
+        https://bugs.webkit.org/show_bug.cgi?id=155099
+
+        Reviewed by Mark Lam.
+
+        This patch is a straight forward implementation of Proxy.[[GetPrototypeOf]]
+        with respect to section 9.5.1 of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-getprototypeof
+
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::setPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        (JSC::ProxyObject::getPrototype):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-get-prototype-of.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.get getPrototypeOf):
+        (throw.new.Error.get let):
+        (throw.new.Error.get catch):
+        (throw.new.Error):
+        (assert.let.handler.getPrototypeOf):
+        (assert.get let):
+        (assert.get catch):
+        (assert.):
+        (let.handler.getPrototypeOf):
+        (get let):
+        (let.handler.has):
+
+2016-03-07  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: rename generated *EnumConversionHelpers.h to *TypeConversions.h
+        https://bugs.webkit.org/show_bug.cgi?id=155121
+        <rdar://problem/25010391>
+
+        Reviewed by Timothy Hatcher.
+
+        Split out this renaming from the work to generate factory method stubs for types.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/scripts/codegen/__init__.py:
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py: Renamed from Source/JavaScriptCore/inspector/scripts/codegen/generate_objc_conversion_helpers.py.
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/objc_generator_templates.py:
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        (generate_from_specification):
+
+        Rebaseline tests after changing generator order.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-03-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Improve and64() and or64() with immediate on x86
+        https://bugs.webkit.org/show_bug.cgi?id=155104
+
+        Reviewed by Geoffrey Garen.
+
+        GetButterflyReadOnly was doing:
+            movq 0x8(%rbx), %r9
+            movq $0xfffffffffffffffc, %r11
+            andq %r11, %r9
+        There is no need for the move to load the immediate,
+        andq sign extend its immediate.
+
+        With this patch, we have:
+            movq 0x8(%rbx), %r9
+            andq $0xfffffffffffffffc, %r9
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::and64):
+        (JSC::MacroAssemblerX86_64::or64):
+
+2016-03-07  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: It should be possible to initialize generated ObjC protocol types from an NSDictionary payload
+        https://bugs.webkit.org/show_bug.cgi?id=155102
+        <rdar://problem/25002015>
+
+        Reviewed by Timothy Hatcher.
+
+        In Objective-C code, we sometimes prefer to parse JSON using Cocoa rather
+        than the InspectorValue classes. Support initializing protocol objects
+        directly from an NSDictionary payload. This delegates validation of values to
+        the setter methods that already exist on the protocol object classes.
+
+        * inspector/scripts/codegen/generate_objc_header.py:
+        (ObjCHeaderGenerator._generate_type_interface):
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator.generate_type_implementation):
+        (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_payload):
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator.payload_to_objc_expression_for_member):
+        Add a new helper method to generate an expression to unpack the value
+        from an NSDictionary. If it's not a primitive, the setter performs
+        validation of the value's kind using -[NSObject isKindOfClass:].
+
+        Rebaseline relevant tests.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-03-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Simplify the overflow check of ArithAbs
+        https://bugs.webkit.org/show_bug.cgi?id=155063
+
+        Reviewed by Geoffrey Garen.
+
+        The only integer that overflow abs(int32) is INT_MIN.
+        For some reason, our code testing for that case
+        was checking the top bit of the result specifically.
+
+        The code required a large immediate on x86 and an extra
+        register on ARM64.
+
+        This patch turns the overflow check into a branch on
+        the sign of the result.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithAbs):
+        * jit/ThunkGenerators.cpp:
+        (JSC::absThunkGenerator):
+        * tests/stress/arith-abs-overflow.js: Added.
+        (opaqueAbs):
+
+2016-03-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve how DFG zero Floating Point registers
+        https://bugs.webkit.org/show_bug.cgi?id=155096
+
+        Reviewed by Geoffrey Garen.
+
+        DFG had a weird way of zeroing a FPR:
+            -zero a GP.
+            -move that to a FP.
+
+        Filip added moveZeroToDouble() for B3. This patch
+        uses that in the lower tiers.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::moveZeroToDouble):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        * jit/ThunkGenerators.cpp:
+        (JSC::floorThunkGenerator):
+        (JSC::roundThunkGenerator):
+
+2016-03-07  Andreas Kling  <akling@apple.com>
+
+        REGRESSION (r197303): Web Inspector crashes web process when inspecting an element on TOT
+        <https://webkit.org/b/154812>
+
+        Reviewed by Geoffrey Garen.
+
+        Guard against null pointer dereference for UnlinkedCodeBlocks that don't have any control flow
+        profiling data.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::hasOpProfileControlFlowBytecodeOffsets):
+
+2016-03-07  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Remove a useless "Move" from baseline-JIT op_mul's fast path
+        https://bugs.webkit.org/show_bug.cgi?id=155071
+
+        Reviewed by Geoffrey Garen.
+
+        We do not need to multiply to a scratch and then move the result
+        to the destination. We can just multiply to the destination.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mul):
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath):
+
+2016-03-07  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] StringObject.{put, defineOwnProperty} should realize indexed properties
+        https://bugs.webkit.org/show_bug.cgi?id=155089
+
+        Reviewed by Geoffrey Garen.
+
+        Through implementing Reflect.set[1], we found StringObject does not obey the spec.
+        StringObject::put should call putByIndex if the given propertyName is index.
+        And StringObject::defineOwnProperty should recognize indexed properties since
+        JSObject::defineOwnIndexedProperty is specialized to JSObject layout.
+        Before calling JSObject::defineOwnProperty,
+        StringObject should handle its special indexed own properties.
+        It is responsibility of StringObject::defineOwnProperty.
+
+        And the logic is cleaned up by using validateAndApplyPropertyDescriptor.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=155024
+
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::StringObject::putByIndex):
+        (JSC::isStringOwnProperty):
+        (JSC::StringObject::defineOwnProperty):
+        (JSC::StringObject::deleteProperty):
+        * tests/stress/string-object-define-own-property.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        * tests/stress/string-object-put-by-index.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (testSloppy):
+        (testStrict):
+
+2016-03-06  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: the protocol generator should have separate prefix options for Objective-C classes and filenames
+        https://bugs.webkit.org/show_bug.cgi?id=155101
+        <rdar://problem/25000053>
+
+        Reviewed by Timothy Hatcher.
+
+        It should be possible to generate Objective-C protocol types without prefixing all class names.
+        The prefixes are only necessary when the generated files are part of a framework, but this isn't
+        how the generated Objective-C frontend files are used.
+
+        Add a separate framework setting and switch over code to use the 'protocol_group' in filenames,
+        and the 'objc_prefix' for Objective-C enum and class prefixes.
+
+        No tests need to be rebaselined because tests always set the protocol_group and objc_prefix
+        to the same value.
+
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
+        (ObjCBackendDispatcherHeaderGenerator.output_filename):
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator.output_filename):
+        (ObjCConfigurationImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_configuration_header.py:
+        (ObjCConfigurationHeaderGenerator.output_filename):
+        (ObjCConfigurationHeaderGenerator.generate_output):
+        (ObjCConfigurationHeaderGenerator._generate_configuration_interface_for_domains):
+        * inspector/scripts/codegen/generate_objc_configuration_implementation.py:
+        (ObjCBackendDispatcherImplementationGenerator.output_filename):
+        (ObjCBackendDispatcherImplementationGenerator.generate_output):
+        (ObjCBackendDispatcherImplementationGenerator._generate_configuration_implementation_for_domains):
+        * inspector/scripts/codegen/generate_objc_conversion_helpers.py:
+        (ObjCConversionHelpersGenerator.output_filename):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator.output_filename):
+        (ObjCFrontendDispatcherImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_header.py:
+        (ObjCHeaderGenerator.output_filename):
+        * inspector/scripts/codegen/generate_objc_internal_header.py:
+        (ObjCInternalHeaderGenerator.output_filename):
+        (ObjCInternalHeaderGenerator.generate_output):
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator.output_filename):
+        (ObjCProtocolTypesImplementationGenerator.generate_output):
+        * inspector/scripts/codegen/models.py:
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator):
+        (ObjCGenerator.protocol_name):
+        (ObjCGenerator.objc_prefix):
+
+2016-03-06  Brian Burg  <bburg@apple.com>
+
+        Unreviewed, rebaseline inspector protocol generator tests after r197563.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+
+2016-03-06  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Improve DFG's Int32 ArithMul if one operand is a constant
+        https://bugs.webkit.org/show_bug.cgi?id=155066
+
+        Reviewed by Filip Pizlo.
+
+        When multiplying an integer by a constant, DFG was doing quite
+        a bit worse than baseline JIT.
+        We were loading the constant into a register, doing the multiply,
+        the checking the result and both operands for negative zero.
+
+        This patch changes:
+        -Use the multiply-by-immediate form on x86.
+        -Do as few checks as possible to detect negative-zero.
+
+        In most cases, this reduce the negative-zero checks
+        to zero or one TEST+JUMP.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::mul32):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+
+2016-03-06  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Remove a superfluous Move in front of every double unboxing
+        https://bugs.webkit.org/show_bug.cgi?id=155064
+
+        Reviewed by Saam Barati.
+
+        Double unboxing was always doing:
+            Move source, scratch
+            Add64 tag, scratch
+            IntToDouble scratch, fp
+
+        We do not need to "Move" to copy the source.
+        Both x86 and ARM64 have an efficient 3 operands Add instruction.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueToInt32):
+        (JSC::DFG::SpeculativeJIT::compileDoubleRep):
+        (JSC::DFG::SpeculativeJIT::speculateRealNumber):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::unboxDouble):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::unboxDoubleWithoutAssertions):
+        (JSC::AssemblyHelpers::unboxDouble):
+        (JSC::AssemblyHelpers::unboxDoubleNonDestructive):
+
+2016-03-06  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Use 3 operands Add in more places
+        https://bugs.webkit.org/show_bug.cgi?id=155082
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::add32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::add32):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithAdd):
+        The case with child1 constant is useless.
+        The canonical form will have the constant as child2.
+
+        Also add register reuse for the fast-add.
+        Registers are a scarce resource on x86.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::prepareForTailCallSlow):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generate):
+
+2016-03-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve codegen of Compare and Test
+        https://bugs.webkit.org/show_bug.cgi?id=155055
+
+        Reviewed by Filip Pizlo.
+
+        This patch introduces a few improvements on how we lower
+        Compare and Test with immediates:
+            -Add certain Immediate forms of ARM64.
+            -Use CBZ/CBNZ when possible on ARM64.
+            -When possible, convert a CMP into a TST
+             On some hardware, we can issue more TST simultaneously.
+
+             On x86, any TST+Jump is candidate for macro-fusion.
+             They are also smaller.
+             (sections 3.4.2.2 and 3.5.1.9)
+            -Do not load the mask immediate of a TST
+             if it only contains ones (mostly useful for ARM64
+             since that would not have been a valid immediate).
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::compare32):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
+        This is somewhat unrelated but I found that out while working
+        on moveDoubleConditionallyTest32:
+            If "thenCase" and "dest" are assigned the same register
+            by the allocator, then the first (f)fcsel would override
+            the "thenCase" and the second fcsel would always be "elseCase".
+
+        This is covered by testb3 but was only uncovered
+        after recent "Move" removals in lowering.
+
+        (JSC::MacroAssemblerARM64::moveConditionally32):
+        (JSC::MacroAssemblerARM64::moveConditionally64):
+        (JSC::MacroAssemblerARM64::moveConditionallyTest32):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionally32):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionally64):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionallyTest32):
+        (JSC::MacroAssemblerARM64::branch32):
+        (JSC::MacroAssemblerARM64::branch64):
+        (JSC::MacroAssemblerARM64::branchTest32):
+        (JSC::MacroAssemblerARM64::test32):
+        The version taking an immediate was guarded by
+        (cond == Zero) || (cond == NonZero). That is overzealous,
+        and only needed for CBZ/CBNZ.
+
+        (JSC::MacroAssemblerARM64::branchTest64):
+        (JSC::MacroAssemblerARM64::compare32):
+        (JSC::MacroAssemblerARM64::compare64):
+        (JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::moveConditionally32):
+        (JSC::MacroAssemblerX86Common::moveConditionallyTest32):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::test32):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::compare32):
+        (JSC::MacroAssemblerX86Common::commuteCompareToZeroIntoTest):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::compare64):
+        (JSC::MacroAssemblerX86_64::branch64):
+        (JSC::MacroAssemblerX86_64::moveConditionally64):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        Unfortunately this cannot be abstracted by the MacroAssembler.
+        Those immediates are not valid, we have to pick the better
+        for right away.
+
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::int64Operands):
+        (JSC::B3::modelCompare):
+        (JSC::B3::testCompareImpl):
+        (JSC::B3::testCompare):
+        (JSC::B3::b3Pow):
+        (JSC::B3::testPowDoubleByIntegerLoop):
+        Some versions of pow(double, int) do not return
+        the exact same bits as our integer loop.
+        Added a new version to have the same behavior
+        as the B3 loop.
+
+        (JSC::B3::run):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32Compare):
+        Comparing to an immediate is super common. Do not waste
+        a register for that!
+
+2016-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build. This was a messed up merge.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
+
+2016-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should know how to speculate StringOrOther
+        https://bugs.webkit.org/show_bug.cgi?id=155094
+
+        Reviewed by Saam Barati.
+
+        Any code that processes the regexp matches array was previously doing a relatively expensive
+        Branch(Untyped:). This introduces a new use kind called StringOrOther, which is perfect for
+        code that loops over the matches array and branches on the entries being non-empty.
+
+        To do this, I needed to introduce code into the FTL that creates new blocks. We still had that
+        awful FTL_NEW_BLOCK idiom since the only way to debug LLVM IR was to ascribe names to basic
+        blocks. B3 IR is inherently more debuggable since unlike LLVM, B3 knows how to always respect
+        code origin, and it knows how to print the code origin nicely in the dumps. So, rather than
+        continue using FTL_NEW_BLOCK(m_out, ("things")), I replaced all of that stuff with
+        m_out.newBlock(). It's much nicer that way.
+
+        This is a tiny speed-up on Octane/regexp at best. I was hoping for more. Oh well.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isStringSpeculation):
+        (JSC::isStringOrOtherSpeculation):
+        (JSC::isSymbolSpeculation):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateString):
+        (JSC::DFG::Node::shouldSpeculateStringOrOther):
+        (JSC::DFG::Node::shouldSpeculateStringObject):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileStringZeroLength):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNotStringOrOther):
+        (JSC::DFG::SpeculativeJIT::emitStringBranch):
+        (JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::compileConstantStoragePointer):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateString):
+        (JSC::DFG::SpeculativeJIT::speculateStringOrOther):
+        (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        (JSC::FTL::DFG::LowerDFGToB3::compileDoubleRep):
+        (JSC::FTL::DFG::LowerDFGToB3::compileBooleanToNumber):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToThis):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithDiv):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithMod):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithMinOrMax):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithPow):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckStructure):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArrayifyToStructure):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetById):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCopyRest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetRestLength):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileToPrimitive):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringFromCharCode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        (JSC::FTL::DFG::LowerDFGToB3::compileForwardVarargs):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSwitch):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsString):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsFunction):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTypeOf):
+        (JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
+        (JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):
+        (JSC::FTL::DFG::LowerDFGToB3::compileHasStructureProperty):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorStructurePname):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetEnumeratorGenericPname):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
+        (JSC::FTL::DFG::LowerDFGToB3::checkStructure):
+        (JSC::FTL::DFG::LowerDFGToB3::numberOrNotCellToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::checkInferredType):
+        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
+        (JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier):
+        (JSC::FTL::DFG::LowerDFGToB3::copyBarrier):
+        (JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly):
+        (JSC::FTL::DFG::LowerDFGToB3::compareEqObjectOrOtherToObject):
+        (JSC::FTL::DFG::LowerDFGToB3::nonSpeculativeCompare):
+        (JSC::FTL::DFG::LowerDFGToB3::stringsEqual):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateCell):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateBasicStorageAndGetEnd):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
+        (JSC::FTL::DFG::LowerDFGToB3::boolify):
+        (JSC::FTL::DFG::LowerDFGToB3::equalNullOrUndefined):
+        (JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
+        (JSC::FTL::DFG::LowerDFGToB3::switchString):
+        (JSC::FTL::DFG::LowerDFGToB3::switchStringRecurse):
+        (JSC::FTL::DFG::LowerDFGToB3::buildTypeOf):
+        (JSC::FTL::DFG::LowerDFGToB3::doubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::sensibleDoubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::strictInt52ToJSValue):
+        (JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
+        (JSC::FTL::DFG::LowerDFGToB3::convertDoubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToB3::speculate):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateObjectOrOther):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateString):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrOther):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateStringIdent):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateStringOrStringObject):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateRealNumber):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateNotStringVar):
+        (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
+        (JSC::FTL::DFG::LowerDFGToB3::callCheck):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::initialize):
+        (JSC::FTL::Output::newBlock):
+        (JSC::FTL::Output::check):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::setFrequency):
+        (JSC::FTL::Output::insertNewBlocksBefore):
+
+2016-03-06  Saam Barati  <sbarati@apple.com>
+
+        [[GetPrototypeOf]] should be a fully virtual method in the method table
+        https://bugs.webkit.org/show_bug.cgi?id=155002
+
+        Reviewed by Filip Pizlo.
+
+        This patch makes us more consistent with how the ES6 specification models the
+        [[GetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable 
+        is a prerequisite for implementing Proxy.[[GetPrototypeOf]]. This patch
+        still allows directly accessing the prototype for situations where this
+        is the desired behavior. This is equivalent to getting the internal
+        [[Prototype]] field as described in the specification. 
+
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (functionCreateProxy):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        * runtime/ClassInfo.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototypeGetterCompare):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::hasInstanceBoundFunction):
+        (JSC::getBoundFunctionStructure):
+        (JSC::JSBoundFunction::create):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::setPrototype):
+        (JSC::JSCell::getPrototype):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::hasLegacyProfiler):
+        (JSC::lastInPrototypeChain):
+        (JSC::JSGlobalObject::objectPrototypeIsSane):
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
+        (JSC::GlobalFuncProtoGetterFunctor::operator()):
+        (JSC::globalFuncProtoGetter):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnPropertySlot):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::getPrototype):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::objectPrivateFuncInstanceOf):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
+        (JSC::JSObject::getGenericPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::getPrototypeDirect):
+        (JSC::JSObject::getPrototype):
+        (JSC::JSObject::getOwnNonIndexPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getNonIndexPropertySlot):
+        (JSC::JSObject::prototype): Deleted.
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::canPerformFastPutInline):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setTarget):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::constructTypedArrayView):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+        (JSC::objectConstructorGetPrototypeOf):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncIsPrototypeOf):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performSetPrototype):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::isValid):
+        * tests/stress/proxy-has-property.js:
+        (assert.let.h1.has):
+        (assert.let.h2.has):
+        (assert):
+
+2016-03-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r197645.
+        https://bugs.webkit.org/show_bug.cgi?id=155097
+
+        "Doesn't build properly when building entire webkit"
+        (Requested by saamyjoon on #webkit).
+
+        Reverted changeset:
+
+        "[[GetPrototypeOf]] should be a fully virtual method in the
+        method table"
+        https://bugs.webkit.org/show_bug.cgi?id=155002
+        http://trac.webkit.org/changeset/197645
+
+2016-03-06  Saam barati  <sbarati@apple.com>
+
+        [[GetPrototypeOf]] should be a fully virtual method in the method table
+        https://bugs.webkit.org/show_bug.cgi?id=155002
+
+        Reviewed by Filip Pizlo.
+
+        This patch makes us more consistent with how the ES6 specification models the
+        [[GetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable 
+        is a prerequisite for implementing Proxy.[[GetPrototypeOf]]. This patch
+        still allows directly accessing the prototype for situations where this
+        is the desired behavior. This is equivalent to getting the internal
+        [[Prototype]] field as described in the specification. 
+
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (functionCreateProxy):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        * runtime/ClassInfo.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototypeGetterCompare):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::hasInstanceBoundFunction):
+        (JSC::getBoundFunctionStructure):
+        (JSC::JSBoundFunction::create):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::setPrototype):
+        (JSC::JSCell::getPrototype):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::hasLegacyProfiler):
+        (JSC::lastInPrototypeChain):
+        (JSC::JSGlobalObject::objectPrototypeIsSane):
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
+        (JSC::GlobalFuncProtoGetterFunctor::operator()):
+        (JSC::globalFuncProtoGetter):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnPropertySlot):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::getPrototype):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::objectPrivateFuncInstanceOf):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
+        (JSC::JSObject::getGenericPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::getPrototypeDirect):
+        (JSC::JSObject::getPrototype):
+        (JSC::JSObject::getOwnNonIndexPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getNonIndexPropertySlot):
+        (JSC::JSObject::prototype): Deleted.
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::canPerformFastPutInline):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setTarget):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::constructTypedArrayView):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+        (JSC::objectConstructorGetPrototypeOf):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncIsPrototypeOf):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performSetPrototype):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::isValid):
+        * tests/stress/proxy-has-property.js:
+        (assert.let.h1.has):
+        (assert.let.h2.has):
+        (assert):
+
+2016-03-06  Filip Pizlo  <fpizlo@apple.com>
+
+        RegExpMatchesArray doesn't know how to have a bad time
+        https://bugs.webkit.org/show_bug.cgi?id=155069
+
+        Reviewed by Yusuke Suzuki.
+
+        In trunk if we are having a bad time, the regexp matches array is still allocated with a
+        non-slow-put indexing shape, which makes it have the wrong behavior on indexed setters on
+        the prototype chain.
+
+        Getting this to work right requires introducing bad time code paths into the regexp matches
+        array. It also requires something more drastic: making this code not play games with the
+        global object. The code that creates the matches array needs to have the actual global
+        object of the regexp native function that it's logically created by.
+
+        This is totally different from how we've handled global objects in the past because it means
+        that the global object is not a constant. Normally we can make it a constant because a
+        script executable will know its global object. But with native functions, it's the function
+        instance that knows the global object - not the native executable. When we inline a native
+        intrinsic, we are guaranteed to know the native executable but we're not guaranteed to know
+        the functon instance. This means that the global object may be a variable that gets computed
+        by looking at the instance at run-time. So, the RegExpExec/RegExpTest nodes in DFG IR now
+        take a global object child. That also meant adding a new node type, GetGlobalObject, which
+        does the thing to the callee that CallFrame::lexicalGlobalObject() would have done.
+        Eventually, we'll probably have to make other native intrinsics also use GetGlobalObject. It
+        turns out that this really isn't so bad because usually it's constant-folded anyway, since
+        although the intrinsic code supports executable-based inlining (which leaves the callee
+        instance as an unknown), it happens rarely for intrinsics. So, conveying the global object
+        via a child isn't any worse than conveying it via meta-data, and it's probably better than
+        telling the inliner not to do executable-based inlining of native intrinsics. That would
+        have been a confusing special-case.
+
+        This is perf-neutral on my machines but it fixes a bug and it unlocks some interesting
+        possibilities. For example, RegExpExec can now make a firm promise about the type of array
+        it's creating.
+
+        This also contains some other changes:
+        
+        - We are now using Structure::addPropertyTransition() in a lot of places even though it was
+          meant to be an internal method with a quirky contract - for example if only works if you
+          know that there is not existing transition. This relaxes this constraint.
+        
+        - Restores the use of "*" for heap references in JSString.h. It's very unusual to have heap
+          references pointed at with "&", since we don't currently do that anywhere. The fact that
+          it was using the wrong reference type also meant that the code couldn't elegantly make use
+          of some our GC pointer helpers like jsCast<>.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleMinMax):
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileSkipScope):
+        (JSC::DFG::SpeculativeJIT::compileGetGlobalObject):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSkipScope):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetGlobalObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetClosureVar):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
+        * jit/JITOperations.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::haveABadTime):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+        * runtime/JSString.h:
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        * runtime/RegExpCachedResult.cpp:
+        (JSC::RegExpCachedResult::lastResult):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::tryCreateUninitializedRegExpMatchesArray):
+        (JSC::createRegExpMatchesArray):
+        (JSC::createStructureImpl):
+        (JSC::createRegExpMatchesArrayStructure):
+        (JSC::createRegExpMatchesArraySlowPutStructure):
+        * runtime/RegExpMatchesArray.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::put):
+        (JSC::RegExpObject::exec):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::getLastIndex):
+        (JSC::RegExpObject::test):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        * runtime/Structure.cpp:
+        (JSC::Structure::suggestedArrayStorageTransition):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::addNewPropertyTransition):
+        * runtime/Structure.h:
+        * tests/stress/regexp-matches-array-bad-time.js: Added.
+        * tests/stress/regexp-matches-array-slow-put.js: Added.
+
+2016-03-06  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] RegExp#lastIndex should handle writable attribute when defining in defineOwnProperty path
+        https://bugs.webkit.org/show_bug.cgi?id=155093
+
+        Reviewed by Filip Pizlo.
+
+        Before this patch, `setLastIndex(ExecState* exec, size_t lastIndex)` always overwrites the existing value
+        regardless of writable attribute.
+        And when defining RegExp#lastIndex in defineOwnProperty, we need to define the value first
+        before making the attribute readonly. After changing the writable attribute, we cannot define the value.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::defineOwnProperty):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        * tests/stress/regexp-last-index-writable.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (regExpLastIndex):
+
+2016-03-05  Filip Pizlo  <fpizlo@apple.com>
+
+        The most aggressive form of RegExpTest/RegExpExec should speculate more aggressively than just cell
+        https://bugs.webkit.org/show_bug.cgi?id=154900
+
+        Reviewed by Saam Barati.
+
+        These old operations used to speculate cell. That's what they did when they were first
+        introduced. That was probably about as good as they could do back then because we didn't have
+        very powerful checks. Now we have powerful checks, so we can do this right.
+
+        The most profitable thing to check is that child1 is a RegExpObject and child2 is a JSString.
+        Sometimes though, we will not know what child2 is even though we know that child1 is a
+        RegExpObject. So, this patch means that RegExpExec/RegExpTest have the following overloads:
+
+            RegExpExec(RegExpObject:, String:)
+            RegExpExec(RegExpObject:, Untyped:)
+            RegExpExec(Untyped:, Untyped:)
+
+        This shaves off some type checks in Octane/regexp. It also cleans up some problems in our
+        modeling of the effectfulness of these operations.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
+        * jit/JITOperations.h:
+
+2016-03-05  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Support Reflect.construct
+        https://bugs.webkit.org/show_bug.cgi?id=147330
+
+        Reviewed by Saam Barati.
+
+        Based on Saam's r196868, this patch adds support for Reflect.construct.
+        This patch implements OrdinaryCreateFromConstructor[1] for fallback cases.
+        This path is rarely taken. For example,
+
+            Reflect.construct(function () { }, [], Map);
+
+        In this case, the `new.target` becomes `Map`.
+        So we should create an object that `__proto__` is `Map.prototype`.
+
+        And to allow forward declaration (and encouraging strong type checking), we change
+        ConstructType, CallType to C++11 enum class.
+
+        [1]: http://ecma-international.org/ecma-262/6.0/#sec-ordinarycreatefromconstructor
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::getConstructData):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::getCallData):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::getConstructData):
+        (JSC::JSCallbackObject<Parent>::getCallData):
+        * API/JSObjectRef.cpp:
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        (JSObjectIsConstructor):
+        (JSObjectCallAsConstructor):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunction::getCallData):
+        (JSC::ObjCCallbackFunction::getConstructData):
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptFunctionCall::call):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::ScriptValue::isFunction):
+        * builtins/ReflectObject.js:
+        * dfg/DFGOperations.cpp:
+        * inspector/InjectedScriptManager.cpp:
+        (Inspector::InjectedScriptManager::createInjectedScript):
+        * interpreter/Interpreter.cpp:
+        (JSC::sizeOfVarargs):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::handleHostCall):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::getConstructData):
+        (JSC::ArrayConstructor::getCallData):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::getLength): Deleted.
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::getConstructData):
+        (JSC::BooleanConstructor::getCallData):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::getConstructData):
+        (JSC::DateConstructor::getCallData):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToJSON):
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::getConstructData):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::getConstructData):
+        (JSC::ErrorConstructor::getCallData):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::getConstructData):
+        (JSC::FunctionConstructor::getCallData):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::getCallData):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncBind):
+        * runtime/GeneratorFunctionConstructor.cpp:
+        (JSC::GeneratorFunctionConstructor::getCallData):
+        (JSC::GeneratorFunctionConstructor::getConstructData):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::getCallData):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::IntlCollatorConstructor::getConstructData):
+        (JSC::IntlCollatorConstructor::getCallData):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::IntlDateTimeFormatConstructor::getConstructData):
+        (JSC::IntlDateTimeFormatConstructor::getCallData):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::IntlNumberFormatConstructor::getConstructData):
+        (JSC::IntlNumberFormatConstructor::getCallData):
+        * runtime/IteratorOperations.cpp:
+        (JSC::iteratorNext):
+        (JSC::iteratorClose):
+        * runtime/JSArray.h:
+        (JSC::getLength):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::getConstructData):
+        (JSC::JSArrayBufferConstructor::getCallData):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::boundFunctionCall):
+        (JSC::boundFunctionConstruct):
+        (JSC::JSBoundFunction::create):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isFunction):
+        (JSC::JSValue::isConstructor):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getCallData):
+        (JSC::JSCell::getConstructData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::getConstructData):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getConstructData):
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):
+        * runtime/JSInternalPromise.cpp:
+        (JSC::JSInternalPromise::then):
+        * runtime/JSInternalPromiseConstructor.cpp:
+        (JSC::JSInternalPromiseConstructor::getConstructData):
+        (JSC::JSInternalPromiseConstructor::getCallData):
+        * runtime/JSJob.cpp:
+        (JSC::JSJobMicrotask::run):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::toJSONImpl):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::JSONProtoFuncParse):
+        * runtime/JSObject.cpp:
+        (JSC::callToPrimitiveFunction):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::getMethod):
+        * runtime/JSObject.h:
+        (JSC::getCallData):
+        (JSC::getConstructData):
+        * runtime/JSPromise.cpp:
+        (JSC::JSPromise::initialize):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getConstructData):
+        (JSC::JSPromiseConstructor::getCallData):
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::newPromiseCapability):
+        (JSC::callFunction):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::constructTypedArrayView):
+        (JSC::JSTypedArrayViewConstructor::getConstructData):
+        (JSC::JSTypedArrayViewConstructor::getCallData):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        (JSC::MapConstructor::getConstructData):
+        (JSC::MapConstructor::getCallData):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::ModuleLoaderObject::provide):
+        (JSC::ModuleLoaderObject::loadAndEvaluateModule):
+        (JSC::ModuleLoaderObject::loadModule):
+        (JSC::ModuleLoaderObject::linkAndEvaluateModule):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::getConstructData):
+        (JSC::NativeErrorConstructor::getCallData):
+        * runtime/NullGetterFunction.cpp:
+        (JSC::NullGetterFunction::getCallData):
+        (JSC::NullGetterFunction::getConstructData):
+        * runtime/NullSetterFunction.cpp:
+        (JSC::NullSetterFunction::getCallData):
+        (JSC::NullSetterFunction::getConstructData):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::getConstructData):
+        (JSC::NumberConstructor::getCallData):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::getConstructData):
+        (JSC::ObjectConstructor::getCallData):
+        (JSC::toPropertyDescriptor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncToLocaleString):
+        * runtime/Operations.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectTypeOrNull):
+        (JSC::jsIsFunctionType):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::ProxyConstructor::getConstructData):
+        (JSC::ProxyConstructor::getCallData):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::finishCreation):
+        (JSC::performProxyCall):
+        (JSC::ProxyObject::getCallData):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::getConstructData):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectConstruct):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getConstructData):
+        (JSC::RegExpConstructor::getCallData):
+        * runtime/RuntimeType.h:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        (JSC::SetConstructor::getConstructData):
+        (JSC::SetConstructor::getCallData):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::getConstructData):
+        (JSC::StringConstructor::getCallData):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
+        (JSC::operationStringProtoFuncReplaceRegExpString):
+        (JSC::replaceUsingStringSearch):
+        * runtime/SymbolConstructor.cpp:
+        (JSC::SymbolConstructor::getConstructData):
+        (JSC::SymbolConstructor::getCallData):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        (JSC::WeakMapConstructor::getConstructData):
+        (JSC::WeakMapConstructor::getCallData):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::constructWeakSet):
+        (JSC::WeakSetConstructor::getConstructData):
+        (JSC::WeakSetConstructor::getCallData):
+        * tests/es6.yaml:
+        * tests/stress/reflect-construct.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (shouldThrow.array.get length):
+        (shouldThrow.array.get 0):
+        (array.get length):
+        (array.get 0):
+        (shouldBe.Reflect.construct):
+        (shouldBe.Reflect.construct.Hello):
+        (3.shouldBe.Reflect.construct.Hello):
+        (3.newTarget):
+        (0.shouldBe.Reflect.construct):
+        (shouldBe.A):
+        (shouldBe.B):
+        (nativeConstructorTest.DerivedMap):
+        (nativeConstructorTest.FailedMap):
+        (set noInline):
+
+2016-03-04  Andreas Kling  <akling@apple.com>
+
+        [iOS] Throw away compiled RegExp code when navigating to a new page.
+        <https://webkit.org/b/155015>
+
+        Reviewed by Anders Carlsson.
+
+        Add a mechanism to have the VM discard all RegExp bytecode and JIT code.
+
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllRegExpCode):
+        * runtime/VM.h:
+
+2016-03-04  David Kilzer  <ddkilzer@apple.com>
+
+        REGRESSION (r197531): JavaScriptCore ASan build fails due to weak external symbol
+        <http://webkit.org/b/155033>
+        <rdar://problem/24979661>
+
+        Reviewed by Alexey Proskuryakov.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::ordinaryToPrimitive): Don't mark this method
+        inline since it's also used in DatePrototype.cpp, and is
+        declared as a public class method.
+        * runtime/JSObject.h:
+        (JSC::JSObject::ordinaryToPrimitive): Don't export this method
+        since it is not used outside of JavaScriptCore.
+
+2016-03-04  Alex Christensen  <achristensen@webkit.org>
+
+        Remove vcxproj build system
+        https://bugs.webkit.org/show_bug.cgi?id=154388
+
+        Rubber-stamped by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.sln: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreCF.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreCFLite.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreDLL.cpp: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreProduction.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props: Removed.
+        * JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props: Removed.
+        * JavaScriptCore.vcxproj/build-generated-files.pl: Removed.
+        * JavaScriptCore.vcxproj/copy-files.cmd: Removed.
+
+2016-03-04  Chris Dumez  <cdumez@apple.com>
+
+        Location.reload should not be writable
+        https://bugs.webkit.org/show_bug.cgi?id=154989
+
+        Reviewed by Gavin Barraclough.
+
+        After r196770, operations marked as [Unforgeable] in the IDL (such as
+        Location.reload) are correctly reported as not writable by
+        Object.getOwnPropertyDescriptor(). Trying to set such property in JS
+        is correctly ignored (or throws in strict mode) if the object has
+        previously been reified. However, due to a bug in putEntry(), it was
+        still possible to override the property if the object was not reified
+        yet. This patch fixes the issue by checking in putEntry() that entries
+        that are functions are not ReadOnly before calling putDirect().
+
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+
+2016-03-04  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Lexical bind "super" inside of the arrow function in generator.
+        https://bugs.webkit.org/show_bug.cgi?id=152575
+
+        Reviewed by Yusuke Suzuki.
+
+        Added support of the 'SuperProperty' in arrow function within of the generator 
+        method of class. Before patch parser  did not recognize that current arrow function 
+        is declated inside of the generator and raise SyntaxError.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::isGeneratorBoundary):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::setIsGenerator):
+        (JSC::Parser::closestParentOrdinaryFunctionNonLexicalScope):
+        * tests/stress/arrowfunction-lexical-bind-superproperty.js:
+
+2016-03-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG/FTL should inline accesses to RegExpObject::m_lastIndex
+        https://bugs.webkit.org/show_bug.cgi?id=155003
+
+        Reviewed by Benjamin Poulain.
+
+        The Octane/regexp benchmark sets RegExps' lastIndex a lot. I could imagine this being
+        something that people want to do. Right now, I'm not convinced that making the RegExp object
+        be more plain-JS would be a good idea considering that pretty much all uses of it will
+        require some special compiler magic. Also, it's good that this patch teaches the compiler
+        how to reason about lastIndex since some of my other plans for regexp involve having the
+        compiler treat more regexp stuff as intrinsic.
+
+        This is a smaller Octane/regexp speed-up than I hoped - maybe around 1%. It's an enormous
+        speed-up on the microbenchmarks attached to this patch.
+
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):
+        (JSC::DFG::SpeculativeJIT::compileGetRegExpObjectLastIndex):
+        (JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
+        (JSC::FTL::DFG::LowerDFGToB3::compileGetRegExpObjectLastIndex):
+        (JSC::FTL::DFG::LowerDFGToB3::compileSetRegExpObjectLastIndex):
+        (JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
+        (JSC::FTL::DFG::LowerDFGToB3::lowObject):
+        (JSC::FTL::DFG::LowerDFGToB3::lowRegExpObject):
+        (JSC::FTL::DFG::LowerDFGToB3::lowString):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        (JSC::RegExpObject::offsetOfLastIndex):
+
+2016-03-03  Chris Dumez  <cdumez@apple.com>
+
+        Regression(r196770): Unable to use HipChat Mac app
+        https://bugs.webkit.org/show_bug.cgi?id=154999
+        <rdar://problem/24931959>
+
+        Reviewed by Darin Adler.
+
+        Add a setter to PutPropertySlot to override the 'isStrictMode' flag.
+
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setStrictMode):
+
+2016-03-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add support for MADD, MSUB and MNEG to Air
+        https://bugs.webkit.org/show_bug.cgi?id=154997
+
+        Reviewed by Filip Pizlo.
+
+        ARM64 can do an Add/Sub in the Multiply units.
+        LLVM was doing so but we lost that when switching to B3.
+
+        This patch adds those instructions in Air.
+
+        There are more ALUs than multiply units, thus we are more
+        likely to successfully schedule a Multiply+Add than 2 Multiply.
+        I am conservative and only emit a multiply-add if the value
+        can be interned. As far as I can tell from what is generated
+        by LLVM, that backend had the same rule.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::multiplyAdd32):
+        (JSC::MacroAssemblerARM64::multiplySub32):
+        (JSC::MacroAssemblerARM64::multiplyNeg32):
+        (JSC::MacroAssemblerARM64::multiplyAdd64):
+        (JSC::MacroAssemblerARM64::multiplySub64):
+        (JSC::MacroAssemblerARM64::multiplyNeg64):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::populateWithInterestingValues):
+        (JSC::B3::floatingPointOperands):
+        (JSC::B3::int64Operands):
+        (JSC::B3::int32Operands):
+        (JSC::B3::testMulAddArgsLeft):
+        (JSC::B3::testMulAddArgsRight):
+        (JSC::B3::testMulAddArgsLeft32):
+        (JSC::B3::testMulAddArgsRight32):
+        (JSC::B3::testMulSubArgsLeft):
+        (JSC::B3::testMulSubArgsRight):
+        (JSC::B3::testMulSubArgsLeft32):
+        (JSC::B3::testMulSubArgsRight32):
+        (JSC::B3::testMulNegArgs):
+        (JSC::B3::testMulNegArgs32):
+        (JSC::B3::run):
+
+2016-03-03  Saam Barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[SetPrototypeOf]]
+        https://bugs.webkit.org/show_bug.cgi?id=154931
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch is a straight forward implementation of Proxy.[[SetPrototypeOf]]
+        with respect to section 9.5.2 of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putInlineSlow):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::put):
+        (JSC::ProxyObject::getGenericPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::setPrototype):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-set-prototype-of.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.get setPrototypeOf):
+        (throw.new.Error.set let):
+        (throw.new.Error.set catch):
+        (throw.new.Error):
+        (assert.let.handler.setPrototypeOf):
+        (assert.set let):
+        (assert.set catch):
+        (let.handler.setPrototypeOf):
+        (set let):
+        (set catch):
+
+2016-03-03  Keith Miller  <keith_miller@apple.com>
+
+        JSArrayBuffers should be collected less aggressively
+        https://bugs.webkit.org/show_bug.cgi?id=154982
+
+        Reviewed by Geoffrey Garen.
+
+        We are currently too aggressive in our collection of ArrayBuffer wrappers.
+        There are three cases where we need to avoid collecting ArrayBuffer wrappers.
+        1. If the wrapper has custom properties.
+        2. If the wrapper is a subclass of ArrayBuffer.
+        3. If the wrapper is in a WeakMap/WeakSet.
+
+        Currently, we only pass the first case in WebCore and none in the jsc CLI.
+        This patch removes some optimizations that cause us to collect when we
+        should not. Namely, always skipping the object unless it has custom
+        properties. Additionally, in the case of subclassing, we also need a way
+        for custom JSArrayBuffer objects to register themselves as the wrapper for
+        an ArrayBuffer class.
+
+        Finally, this patch fixes an issue where views would not mark their ArrayBuffer
+        as an opaque root. This patch also moves an associated ASSERT that the
+        ArrayBuffer held by a view is not null in JSGenericTypedArrayView::visitChildren
+        into JSArrayBufferView::visitChildren, where we add the opaque root.
+
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::finishCreation):
+        (JSC::JSArrayBuffer::create):
+        (JSC::JSArrayBuffer::createWithoutWrapping):
+        * runtime/JSArrayBuffer.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::visitChildren):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren): Deleted.
+        * runtime/SimpleTypedArrayController.cpp:
+        (JSC::SimpleTypedArrayController::toJS):
+        (JSC::SimpleTypedArrayController::registerWrapper):
+        (JSC::SimpleTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots):
+        (JSC::SimpleTypedArrayController::JSArrayBufferOwner::finalize):
+        * runtime/SimpleTypedArrayController.h:
+        * runtime/TypedArrayController.h:
+
+2016-03-03  Filip Pizlo  <fpizlo@apple.com>
+
+        Octane/regexp's Exec function should benefit from array length accessor inlining
+        https://bugs.webkit.org/show_bug.cgi?id=154994
+
+        Reviewed by Benjamin Poulain.
+
+        It does:
+
+            var thingy = blahbitty.blah;
+            if (thingy)
+                foo = thingy.length;
+
+        So, 'thingy' is SpecArray | SpecOther, which prevents the array length accessor inlining from
+        kicking in. Our strategy for this elsewhere in the DFG is to allow a one-time speculation that
+        we won't see SpecOther, since *usually* we see SpecOther mixed with other stuff in cases like
+        this where there is some null check guarding the code.
+
+        This gives another slight speed-up on Octane/regexp.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isCellSpeculation):
+        (JSC::isCellOrOtherSpeculation):
+        (JSC::isNotCellSpeculation):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateCell):
+        (JSC::DFG::Node::shouldSpeculateCellOrOther):
+        (JSC::DFG::Node::shouldSpeculateNotCell):
+
+2016-03-03  Saam Barati  <sbarati@apple.com>
+
+        Add Proxy tests for exceptions that depend on an object being non-extensible and having configurable properties
+        https://bugs.webkit.org/show_bug.cgi?id=154745
+
+        Reviewed by Geoffrey Garen.
+
+        This patch is mostly an implementation of Proxy.[[OwnPropertyKeys]] 
+        with respect to section 9.5.11 of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-ownpropertykeys
+
+        This patch also changes call sites of getOwnPropertyNames and
+        getPropertyNames to expect that an exception can be thrown.
+
+        * dfg/DFGOperations.cpp:
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/IntlObject.cpp:
+        (JSC::supportedLocales):
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getGenericPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::makeIdentifier):
+        (JSC::createListFromArrayLike):
+        * runtime/JSPropertyNameEnumerator.h:
+        (JSC::propertyNameEnumerator):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::defineProperties):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::ownPropertyKeys):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotByIndex):
+        (JSC::ProxyObject::deleteProperty):
+        (JSC::ProxyObject::deletePropertyByIndex):
+        (JSC::ProxyObject::defineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::getOwnPropertyNames):
+        (JSC::ProxyObject::getOwnNonIndexPropertyNames):
+        (JSC::ProxyObject::getStructurePropertyNames):
+        (JSC::ProxyObject::getGenericPropertyNames):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        (JSC::ProxyObject::create):
+        (JSC::ProxyObject::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::add):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        (JSC::Structure::checkConsistency):
+        (JSC::Structure::canCachePropertyNameEnumerator):
+        (JSC::Structure::canAccessPropertiesQuicklyForEnumeration):
+        (JSC::Structure::canAccessPropertiesQuickly): Deleted.
+        * runtime/Structure.h:
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        * tests/es6.yaml:
+        * tests/stress/proxy-own-keys.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.ownKeys):
+        (throw.new.Error):
+        (assert.let.handler.get ownKeys):
+        (assert.let.handler.ownKeys):
+        (let.handler.ownKeys):
+        (i.catch):
+        (shallowEq):
+        (let.handler.getOwnPropertyDescriptor):
+        (i.set assert):
+        (set add):
+        (set assert):
+        (set if):
+
+2016-03-03  Keith Miller  <keith_miller@apple.com>
+
+        Array prototype JS builtins should support Symbol.species
+        https://bugs.webkit.org/show_bug.cgi?id=154710
+
+        Reviewed by Geoffrey Garen.
+
+        Add support for Symbol.species in the Array.prototype JS
+        builtin functions.
+
+        * builtins/ArrayPrototype.js:
+        (filter):
+        (map):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::arrayConstructorPrivateFuncIsArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::create):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * tests/stress/array-species-functions.js:
+        (id):
+
+2016-03-03  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Make Unicode RegExp pattern parsing conform to the spec
+        https://bugs.webkit.org/show_bug.cgi?id=154988
+
+        Reviewed by Benjamin Poulain.
+
+        Updated RegExp pattern processing with 'u' (Unicode) flag to conform to the
+        spec (https://tc39.github.io/ecma262/2016/#sec-patterns).  In the spec, the
+        grammar is annotated with [U] annotations.  Productions that are prefixed with
+        [+U] are only available with the Unicode flags while productions prefixed with
+        [~U] are only available without the Unicode flag.
+        
+        Added flags argument to Yarr::checkSyntax() so we can catch Unicode flag related
+        parsing errors at syntax checking time.  Restricted what escapes are available for
+        non Unicode patterns.  Most of this is defined in the IdentityEscape rule in the
+        pattern grammar.
+
+        Added \- as a CharacterClass only escape in Unicode patterns.
+
+        Updated the tests for these changes.
+
+        Made changes suggested in https://bugs.webkit.org/show_bug.cgi?id=154842#c22 after
+        change set r197426 was landed.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createRegExp):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createRegExp):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::readSurrogatePairChecked):
+        (JSC::Yarr::Interpreter::InputStream::reread):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::testCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::isIdentityEscapeAnError):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parse):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+        (JSC::Yarr::CharacterClassConstructor::addSorted):
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
+        * yarr/YarrSyntaxChecker.cpp:
+        (JSC::Yarr::SyntaxChecker::disjunction):
+        (JSC::Yarr::checkSyntax):
+        * yarr/YarrSyntaxChecker.h:
+
+2016-03-03  Saam barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[DefineOwnProperty]]
+        https://bugs.webkit.org/show_bug.cgi?id=154759
+
+        Reviewed by Geoffrey Garen and Mark Lam.
+
+        This patch is a straight forward implementation of Proxy.[[DefineOwnProperty]]
+        with respect to section 9.5.6 of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-defineownproperty-p-desc
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyDescriptors):
+        * runtime/ObjectConstructor.h:
+        (JSC::constructEmptyObject):
+        (JSC::constructObjectFromPropertyDescriptor):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::isExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::defineOwnProperty):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-define-own-property.js: Added.
+        (assert):
+        (throw.new.Error):
+        (assert.let.handler.get defineProperty):
+        (assert.let.handler.defineProperty):
+        (let.handler.defineProperty):
+        (i.catch):
+        (assert.try.):
+        (assert.set get catch):
+        (assert.let.setter):
+        (assert.let.getter):
+        (assert.set get let.handler.defineProperty):
+        (assert.set get let):
+        (assert.):
+
+2016-03-03  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add support for Symbol.toPrimitive
+        https://bugs.webkit.org/show_bug.cgi?id=154877
+
+        Reviewed by Saam Barati.
+
+        This patch adds suport for Symbol.toPrimitive. Since we don't currently
+        generate snippits for one side of a binary operation we only need to change
+        the JSObject::ToPrimitive function and update some optimizations in the DFG
+        that need to know how conversions to primitive values should work. As of
+        ES6, the date prototype is also no longer special cased in the ToPrimitive
+        operation. Instead, Date.prototype has a Symbol.species function that
+        replicates the old behavior.
+
+        * bytecode/ObjectPropertyConditionSet.cpp:
+        (JSC::generateConditionsForPropertyMissConcurrently):
+        * bytecode/ObjectPropertyConditionSet.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::watchConditions):
+        (JSC::DFG::Graph::canOptimizeStringObjectAccess):
+        * dfg/DFGGraph.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+        (JSC::dateProtoFuncToPrimitiveSymbol):
+        * runtime/Error.cpp:
+        (JSC::throwTypeError):
+        * runtime/Error.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::toPreferredPrimitiveType):
+        * runtime/JSObject.cpp:
+        (JSC::callToPrimitiveFunction):
+        (JSC::JSObject::ordinaryToPrimitive):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::toPrimitive):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::callDefaultValueFunction): Deleted.
+        (JSC::throwTypeError): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::toPrimitive): Deleted.
+        * runtime/SmallStrings.h:
+        * runtime/SymbolPrototype.cpp:
+        (JSC::SymbolPrototype::finishCreation):
+        * runtime/SymbolPrototype.h:
+        (JSC::SymbolPrototype::create):
+        * tests/es6.yaml:
+        * tests/stress/date-symbol-toprimitive.js: Added.
+        * tests/stress/ropes-symbol-toprimitive.js: Added.
+        (ropify):
+        (String.prototype.Symbol.toPrimitive):
+        * tests/stress/symbol-toprimitive.js: Added.
+        (foo.Symbol.toPrimitive):
+        (catch):
+
+2016-03-03  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG should be able to compile StringReplace
+        https://bugs.webkit.org/show_bug.cgi?id=154979
+
+        Reviewed by Benjamin Poulain.
+
+        Adds support for StringReplace to the DFG tier. This is a 3% speed-up on Octane/regexp.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateFinalObject):
+        (JSC::DFG::SpeculativeJIT::speculateRegExpObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOperations.h:
+
+2016-03-03  Saam barati  <sbarati@apple.com>
+
+        [[SetPrototypeOf]] isn't properly implemented everywhere
+        https://bugs.webkit.org/show_bug.cgi?id=154943
+
+        Reviewed by Benjamin Poulain.
+
+        We were copy-pasting implememntation bits that belong in OrdinarySetPrototypeOf 
+        in a few different places that call O.[[SetPrototypeOf]](v)
+        rather than having those bits in OrdinarySetPrototypeOf itself.
+        We need to put those copy-pasted bits into OrdinarySetPrototypeOf
+        and not the call sites of O.[[SetPrototypeOf]](v) because
+        O.[[SetPrototypeOf]](v) won't always call into OrdinarySetPrototypeOf.
+        This is needed for correctness because this behavior is now observable
+        with the ES6 Proxy object.
+
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::isExtensible):
+        (JSC::JSCell::setPrototype):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeDirect):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::allowsAccessFrom):
+        * runtime/JSObject.h:
+        (JSC::JSObject::mayInterceptIndexedAccesses):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectSetPrototypeOf):
+
+2016-03-03  Alex Christensen  <achristensen@webkit.org>
+
+        Fix Windows build after r197489.
+
+        * jsc.cpp:
+
+2016-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        RegExpExec/RegExpTest should not unconditionally speculate cell
+        https://bugs.webkit.org/show_bug.cgi?id=154901
+
+        Reviewed by Benjamin Poulain.
+
+        This is a three part change. It all started with a simple goal: end the rage-recompiles in
+        Octane/regexp by enabling the DFG and FTL to do untyped RegExpExec/RegExpTest. This keeps us
+        in the optimized code when you do a regexp match on a number, for example.
+
+        While implementing this, I realized that DFGOperations.cpp was bad at exception checking. When
+        it did check for exceptions, it used exec->hadException() instead of vm.exception(). So I
+        fixed that. I also made sure that the regexp operations checked for exception after doing
+        toString().
+
+        Unfortunately, the introduction of untyped RegExpExec/RegExpTest caused a regression on
+        Octane/regexp. This was because we were simultaneously scheduling replacement and OSR compiles
+        of some large functions with the FTL JIT. The OSR compiles were not useful. This was a
+        regression from the previous changes to make OSR compiles happen sooner. The problem is that
+        this change also removed the throttling of OSR compiles even in those cases where we suspect
+        that replacement is more likely. This patch reintroduces that throttling, but only in the
+        replacement path.
+
+        This change ends up being neutral overall.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
+        * tests/stress/regexp-exec-effect-after-exception.js: Added.
+
+2016-03-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] JSCell_freeListNext and JSCell_structureID are considered not overlapping
+        https://bugs.webkit.org/show_bug.cgi?id=154947
+
+        Reviewed by Filip Pizlo.
+
+        This bug was discovered while testing https://bugs.webkit.org/show_bug.cgi?id=154894.
+
+        The problem was that JSCell_freeListNext and JSCell_structureID were
+        considered as disjoint. When reordering instructions, the scheduler
+        could move the write of the StructureID first to reduce dependencies.
+        This would erase half of JSCell_freeListNext before we get a chance
+        to load the value.
+
+        This patch changes the hierarchy to make sure nothing is written
+        until JSCell_freeListNext is processed.
+
+        All credits for this patch go to Filip.
+
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+
+2016-03-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve Select of Doubles based on Double condition
+        https://bugs.webkit.org/show_bug.cgi?id=154572
+
+        Reviewed by Filip Pizlo.
+
+        Octane has a bunch of Select on Double based on comparing Doubles.
+        A few nodes generate that: ValueRep, Min, Max, etc.
+
+        On ARM64, we can improve our code a lot. ARM can do a select
+        based on flags with the FCSEL instruction.
+
+        On x86, this patch adds aggressive aliasing for moveDoubleConditionallyXXX.
+        This has obviously a much more limited impact.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::moveDoubleConditionally32): Deleted.
+        (JSC::MacroAssembler::moveDoubleConditionally64): Deleted.
+        (JSC::MacroAssembler::moveDoubleConditionallyTest32): Deleted.
+        (JSC::MacroAssembler::moveDoubleConditionallyTest64): Deleted.
+        (JSC::MacroAssembler::moveDoubleConditionallyDouble): Deleted.
+        (JSC::MacroAssembler::moveDoubleConditionallyFloat): Deleted.
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionallyDouble):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionallyFloat):
+        (JSC::MacroAssemblerARM64::moveConditionally32):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionally32):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionally64):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionallyTest32):
+        (JSC::MacroAssemblerARM64::moveDoubleConditionallyTest64):
+        (JSC::MacroAssemblerARM64::branch64):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::moveConditionally32):
+        (JSC::MacroAssemblerX86Common::moveDoubleConditionally32):
+        (JSC::MacroAssemblerX86Common::moveDoubleConditionallyTest32):
+        (JSC::MacroAssemblerX86Common::moveDoubleConditionallyDouble):
+        (JSC::MacroAssemblerX86Common::moveDoubleConditionallyFloat):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::moveDoubleConditionally64):
+        (JSC::MacroAssemblerX86_64::moveDoubleConditionallyTest64):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::shouldTryAliasingDef):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::populateWithInterestingValues):
+        (JSC::B3::floatingPointOperands):
+        (JSC::B3::int64Operands):
+        (JSC::B3::int32Operands):
+        (JSC::B3::testSelectCompareFloat):
+        (JSC::B3::testSelectCompareFloatToDouble):
+        (JSC::B3::testSelectDoubleCompareDouble):
+        (JSC::B3::testSelectDoubleCompareDoubleWithAliasing):
+        (JSC::B3::testSelectFloatCompareFloat):
+        (JSC::B3::testSelectFloatCompareFloatWithAliasing):
+        (JSC::B3::run):
+
+2016-03-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Add ability to generate a Heap Snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=154847
+
+        Reviewed by Mark Lam.
+
+        This adds HeapSnapshot, HeapSnapshotBuilder, and HeapProfiler.
+
+        HeapProfiler hangs off of the VM and holds the list of snapshots.
+        I expect to add other HeapProfiling features, such as allocation
+        tracking, to the profiler.
+
+        HeapSnapshot contains a collection of live cells and their identifiers.
+        It can point to a previous HeapSnapshot, to ensure that a cell that
+        already received an identifier maintains the same identifier across
+        multiple snapshots. When a snapshotted cell gets garbage collected,
+        the cell will be swept from the HeapSnapshot at the end of collection
+        to ensure the list contains only live cells.
+
+        When building a HeapSnapshot nodes are added in increasing node
+        identifier order. When done building, the list of nodes is complete
+        and the snapshot is finalized. At this point the nodes are sorted
+        by JSCell* address to allow for quick lookup of a JSCell*.
+
+        HeapSnapshotBuilder is where snapshotting begins. The builder
+        will initiate a specialized heap snapshotting garbage collection.
+        During this collection the builder will be notified of all marked
+        (live) cells, and connections between cells, as seen by SlotVisitors.
+        The builder can reference the previous, readonly, HeapSnapshots to
+        avoid creating new nodes for cells that have already been snapshotted.
+        When it is determined that we are visiting a live cell for the first
+        time, we give the cell a unique identifier and add it to the the
+        snapshot we are building.
+
+        Since edge data is costly, and of little long term utility, this
+        data is only held by the builder for serialization, and not stored
+        long term with the HeapSnapshot node data.
+
+        The goals of HeapSnapshotting at this time are:
+        - minimal impact on performance when not profiling the heap
+        - unique identifier for cells, so they may be identified across multiple snapshots
+        - nodes and edges to be able to construct a graph of which nodes reference/retain which other nodes
+        - node data - identifier, type (class name), size
+        - edge data - from cell, to cell, type / data (to come in a follow-up patch)
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        Add new files to the build.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::isHeapSnapshotting):
+        (JSC::RemoveDeadHeapSnapshotNodes::RemoveDeadHeapSnapshotNodes):
+        (JSC::RemoveDeadHeapSnapshotNodes::operator()):
+        (JSC::Heap::removeDeadHeapSnapshotNodes):
+        (JSC::Heap::collectImpl):
+        After every collection, sweep dead cells from in memory snapshots.
+
+        * runtime/VM.cpp:
+        (JSC::VM::ensureHeapProfiler):
+        * runtime/VM.h:
+        (JSC::VM::heapProfiler):
+        * heap/Heap.h:
+        * heap/HeapProfiler.cpp: Added.
+        (JSC::HeapProfiler::HeapProfiler):
+        (JSC::HeapProfiler::~HeapProfiler):
+        (JSC::HeapProfiler::mostRecentSnapshot):
+        (JSC::HeapProfiler::appendSnapshot):
+        (JSC::HeapProfiler::clearSnapshots):
+        (JSC::HeapProfiler::setActiveSnapshotBuilder):
+        * heap/HeapProfiler.h: Added.
+        (JSC::HeapProfiler::vm):
+        (JSC::HeapProfiler::activeSnapshotBuilder):
+        VM and Heap can look at the profiler to determine if we are building a
+        snapshot, or the "head" snapshot to use for sweeping.
+
+        * heap/HeapSnapshot.cpp: Added.
+        (JSC::HeapSnapshot::HeapSnapshot):
+        (JSC::HeapSnapshot::~HeapSnapshot):
+        (JSC::HeapSnapshot::appendNode):
+        Add a node to the unfinalized list of new cells.
+
+        (JSC::HeapSnapshot::sweepCell):
+        (JSC::HeapSnapshot::shrinkToFit):
+        Collect a list of cells for sweeping and then remove them all at once
+        in shrinkToFit. This is done to avoid thrashing of individual removes
+        that could cause many overlapping moves within the Vector.
+
+        (JSC::HeapSnapshot::finalize):
+        Sort the list, and also cache the bounding start/stop identifiers.
+        No other snapshot can contain an identifier in this range, so it will
+        improve lookup of a node from an identifier.
+
+        (JSC::HeapSnapshot::nodeForCell):
+        (JSC::HeapSnapshot::nodeForObjectIdentifier):
+        Search helpers.
+
+        * heap/HeapSnapshotBuilder.h: Added.
+        (JSC::HeapSnapshotNode::HeapSnapshotNode):
+        (JSC::HeapSnapshotEdge::HeapSnapshotEdge):
+        Node and Edge struct types the builder creates.
+
+        * heap/HeapSnapshotBuilder.cpp: Added.
+        (JSC::HeapSnapshotBuilder::getNextObjectIdentifier):
+        (JSC::HeapSnapshotBuilder::HeapSnapshotBuilder):
+        (JSC::HeapSnapshotBuilder::~HeapSnapshotBuilder):
+        (JSC::HeapSnapshotBuilder::buildSnapshot):
+        (JSC::HeapSnapshotBuilder::appendNode):
+        (JSC::HeapSnapshotBuilder::appendEdge):
+        When building the snapshot, generating the next identifier, and
+        appending to any of the lists must be guarded by a lock because
+        SlotVisitors running in parallel may be accessing the builder.
+
+        (JSC::HeapSnapshotBuilder::hasExistingNodeForCell):
+        Looking up if a node already exists in a previous snapshot can be
+        done without a lock because at this point the data is readonly.
+
+        (JSC::edgeTypeToNumber):
+        (JSC::edgeTypeToString):
+        (JSC::HeapSnapshotBuilder::json):
+        JSON serialization of a heap snapshot contains node and edge data.
+
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::didStartMarking):
+        (JSC::SlotVisitor::reset):
+        Set/clear the active snapshot builder to know if this will be a
+        snapshotting GC or not.
+
+        (JSC::SlotVisitor::append):
+        (JSC::SlotVisitor::setMarkedAndAppendToMarkStack):
+        Inform the builder of a new node or edge.
+
+        (JSC::SlotVisitor::visitChildren):
+        Remember the current cell we are visiting so that if we need to
+        inform the builder of edges we know the "from" cell.
+
+        * jsc.cpp:
+        (SimpleObject::SimpleObject):
+        (SimpleObject::create):
+        (SimpleObject::finishCreation):
+        (SimpleObject::visitChildren):
+        (SimpleObject::createStructure):
+        (SimpleObject::hiddenValue):
+        (SimpleObject::setHiddenValue):
+        Create a new class "SimpleObject" that can be used by heap snapshotting
+        tests. It is easy to filter for this new class name and test internal
+        edge relationships created by garbage collection visiting the cell.
+
+        (functionCreateSimpleObject):
+        (functionGetHiddenValue):
+        (functionSetHiddenValue):
+        Expose methods to create and interact with a SimpleObject.
+
+        (functionGenerateHeapSnapshot):
+        Expose methods to create a heap snapshot. This currently automatically
+        turns the serialized string into a JSON object. That may change.
+
+        * tests/heapProfiler.yaml: Added.
+        * tests/heapProfiler/basic-edges.js: Added.
+        (excludeStructure):
+        * tests/heapProfiler/basic-nodes.js: Added.
+        (hasDifferentSizeNodes):
+        (hasAllInternalNodes):
+        Add tests for basic node and edge data.
+
+        * tests/heapProfiler/driver/driver.js: Added.
+        (assert):
+        (CheapHeapSnapshotNode):
+        (CheapHeapSnapshotEdge):
+        (CheapHeapSnapshotEdge.prototype.get from):
+        (CheapHeapSnapshotEdge.prototype.get to):
+        (CheapHeapSnapshot):
+        (CheapHeapSnapshot.prototype.get nodes):
+        (CheapHeapSnapshot.prototype.get edges):
+        (CheapHeapSnapshot.prototype.nodeWithIdentifier):
+        (CheapHeapSnapshot.prototype.nodesWithClassName):
+        (CheapHeapSnapshot.prototype.classNameFromTableIndex):
+        (CheapHeapSnapshot.prototype.edgeTypeFromTableIndex):
+        (createCheapHeapSnapshot):
+        (HeapSnapshotNode):
+        (HeapSnapshotEdge):
+        (HeapSnapshot):
+        (HeapSnapshot.prototype.nodesWithClassName):
+        (createHeapSnapshot):
+        Add two HeapSnapshot representations.
+        CheapHeapSnapshot creates two lists of node and edge data that
+        lazily creates objects as needed.
+        HeapSnapshot creates an object for each node and edge. This
+        is wasteful but easier to use.
+
+2016-03-02  Filip Pizlo  <fpizlo@apple.com>
+
+        RegExpPrototype should check for exceptions after calling toString and doing so should not be expensive
+        https://bugs.webkit.org/show_bug.cgi?id=154927
+
+        Reviewed by Saam Barati.
+
+        While working on regexp optimizations, I found that RegExpPrototype calls toString(), an
+        effectful operation that could do anything, without then checking for hadException().
+
+        So I added a call to hadException().
+
+        But that regressed Octane/regexp by 5%!  That's a lot!  It turns out that
+        exec->hadException() is soooper slow. So, I made it cheaper to check for exceptions from
+        toString(): there is now a variant called toStringFast() that returns null iff it throws an
+        exception.
+
+        This allowed me to add the exception check without regressing perf.
+
+        Note that toString() must retain its old behavior of returning an empty string on exception.
+        There is just too much code that relies on that behavior.
+
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::isValidCallee):
+        (JSC::JSValue::toStringSlowCase):
+        (JSC::JSValue::toWTFStringSlowCase):
+        * runtime/JSCJSValue.h:
+        (JSC::JSValue::asValue):
+        * runtime/JSString.h:
+        (JSC::JSValue::toString):
+        (JSC::JSValue::toStringFast):
+        (JSC::JSValue::toWTFString):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+
+2016-03-02  Saam barati  <sbarati@apple.com>
+
+        clean up JSObject::isExtensibleInline and JSObject::setPrototypeOfInline, and rename setPrototypeOf to setPrototype
+        https://bugs.webkit.org/show_bug.cgi?id=154942
+
+        Reviewed by Benjamin Poulain.
+
+        These don't need to be inlined in the way they are.
+        Doing dynamic dispatch is ok performance wise until
+        we have evidence stating otherwise.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        * runtime/ClassInfo.h:
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::isExtensible):
+        (JSC::JSCell::setPrototype):
+        (JSC::JSCell::setPrototypeOf): Deleted.
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::allowsAccessFrom):
+        (JSC::JSObject::isExtensible):
+        (JSC::JSObject::reifyAllStaticProperties):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::JSObject::setPrototypeOf): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::mayInterceptIndexedAccesses):
+        (JSC::JSObject::indexingShouldBeSparse):
+        (JSC::JSObject::setPrototypeOfInline): Deleted.
+        (JSC::JSObject::isExtensibleInline): Deleted.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectIsExtensible):
+        (JSC::reflectObjectSetPrototypeOf):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+
+2016-03-02  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
+        https://bugs.webkit.org/show_bug.cgi?id=154651
+
+        Reviewed by Alex Christensen.
+
+        * CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.
+
+2016-03-02  Saam barati  <sbarati@apple.com>
+
+        [[SetPrototypeOf]] should be a fully virtual method in ClassInfo::methodTable
+        https://bugs.webkit.org/show_bug.cgi?id=154897
+
+        Reviewed by Filip Pizlo.
+
+        This patch makes us more consistent with how the ES6 specification models the
+        [[SetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable 
+        is a prerequisite for implementing Proxy.[[SetPrototypeOf]]. This patch
+        still allows directly setting the prototype for situations where this
+        is the desired behavior. This is equivalent to setting the internal
+        [[Prototype]] field as described in the specification. 
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        * API/JSWrapperMap.mm:
+        (makeWrapper):
+        * runtime/ClassInfo.h:
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::isExtensible):
+        (JSC::JSCell::setPrototypeOf):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::switchToSlowPutArrayStorage):
+        (JSC::JSObject::setPrototypeDirect):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototypeOf):
+        (JSC::JSObject::allowsAccessFrom):
+        (JSC::JSObject::setPrototype): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSObject::setPrototypeOfInline):
+        (JSC::JSObject::mayInterceptIndexedAccesses):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setTarget):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectSetPrototypeOf):
+
+2016-03-02  Saam barati  <sbarati@apple.com>
+
+        SIGSEGV in Proxy [[Get]] and [[Set]] recursion
+        https://bugs.webkit.org/show_bug.cgi?id=154854
+
+        Reviewed by Yusuke Suzuki.
+
+        We need to be aware of the possibility that the VM
+        may recurse and that we can stack overflow.
+
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performPut):
+        * tests/stress/proxy-get-and-set-recursion-stack-overflow.js: Added.
+        (assert):
+        (testStackOverflowGet):
+        (testStackOverflowIndexedGet):
+        (testStackOverflowSet):
+        (testStackOverflowIndexedSet):
+
+2016-03-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Use a Move without REX byte when possible
+        https://bugs.webkit.org/show_bug.cgi?id=154801
+
+        Reviewed by Alex Christensen.
+
+        Filip wrote an optimization in the register allocator
+        to use 32bit "Move" when we don't care about the top bytes.
+
+        When I moved the commutative ops to the fake 3 operands instruction
+        I largely destroyed this since all the "Moves" became full register.
+
+        In this patch, I switch back to 32bit "Moves" for 32bit operations.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::lshift32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::rshift32):
+        (JSC::MacroAssemblerX86Common::urshift32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        (JSC::MacroAssemblerX86Common::move32IfNeeded):
+
+2016-03-01  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Simplify ArithMod(ArithMod(x, const1), const2) if const2 >= const1
+        https://bugs.webkit.org/show_bug.cgi?id=154904
+
+        Reviewed by Saam Barati.
+
+        The ASM test "ubench" has a "x % 10 % 255".
+        The second modulo should be eliminated.
+
+        This is a 15% improvement on ASMJS' ubench.
+
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        * tests/stress/arith-modulo-twice.js: Added.
+        (opaqueModuloSmaller):
+        (opaqueModuloEqual):
+        (opaqueModuloLarger):
+        (opaqueModuloSmallerNeg):
+        (opaqueModuloEqualNeg):
+        (opaqueModuloLargerNeg):
+        (opaqueExpectedOther):
+
+2016-03-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed. Update the status of Proxy objects to "In Development".
+
+        * features.json:
+
+2016-03-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r197226 and r197256.
+        https://bugs.webkit.org/show_bug.cgi?id=154910
+
+        Caused crashes on Mac 32-bit and on ARM (Requested by ap on
+        #webkit).
+
+        Reverted changesets:
+
+        "Remove the on demand executable allocator"
+        https://bugs.webkit.org/show_bug.cgi?id=154749
+        http://trac.webkit.org/changeset/197226
+
+        "CLoop build fix."
+        http://trac.webkit.org/changeset/197256
+
+2016-03-01  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Simplify some StringBuilder appends
+        https://bugs.webkit.org/show_bug.cgi?id=154902
+
+        Reviewed by Mark Lam.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::notAFunctionSourceAppender):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::stackTracesAsJSON):
+        Use StringBuilder::append(char) instead of append(char*) where possible.
+
+2016-03-01  Keith Miller  <keith_miller@apple.com>
+
+        Promise.prototype.then should use Symbol.species to construct the return Promise
+        https://bugs.webkit.org/show_bug.cgi?id=154862
+
+        Reviewed by Saam Barati.
+
+        * builtins/PromisePrototype.js:
+        * tests/stress/promise-species-functions.js: Added.
+        (Symbol.species):
+        (id):
+        (funcThrows):
+        (makeC):
+        (test.species):
+        (test.speciesThrows):
+        (test):
+
+2016-03-01  Michael Saboff  <msaboff@apple.com>
+
+        [ES6] Add support for Unicode regular expressions
+        https://bugs.webkit.org/show_bug.cgi?id=154842
+
+        Reviewed by Filip Pizlo.
+
+        Added processing of Unicode regular expressions to the Yarr interpreter.
+
+        Changed parsing of regular expression patterns and PatternTerms to process characters as
+        UChar32 in the Yarr code.  The parser converts matched surrogate pairs into the appropriate
+        Unicode character when the expression is parsed.  When matching a unicode expression and
+        reading source characters, we convert proper surrogate pair into a Unicode character and
+        advance the source cursor, "pos", one more position.  The exception to this is when we
+        know when generating a fixed character atom that we need to match a unicode character
+        that doesn't fit in 16 bits.  The code calls this an extendedUnicodeCharacter and has a
+        helper to determine this.
+
+        Added 'u' flag and 'unicode' identifier to regular expression classes.  Added an "isUnicode"
+        parameter to YarrPattern pattern() and internal users of that function.
+
+        Updated the generation of the canonicalization tables to include a new set a tables that
+        follow the ES 6.0, 21.2.2.8.2 Step 2.  Renamed the YarrCanonicalizeUCS2.* files to
+        YarrCanonicalizeUnicode.*. 
+
+        Added a new Layout/js test that tests the added functionality.  Updated other tests that
+        have minor es6 unicode checks and look for valid flags.
+
+        Ran the ChakraCore Unicode regular expression tests as well.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::findMagicComment):
+        * yarr/RegularExpression.cpp:
+        (JSC::Yarr::RegularExpression::Private::compile):
+        Updated use of pattern().
+
+        * runtime/CommonIdentifiers.h:
+        * runtime/RegExp.cpp:
+        (JSC::regExpFlags):
+        (JSC::RegExpFunctionalTestCollector::outputOneTest):
+        (JSC::RegExp::finishCreation):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::compileMatchOnly):
+        * runtime/RegExp.h:
+        * runtime/RegExpKey.h:
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        (JSC::flagsString):
+        (JSC::regExpProtoGetterMultiline):
+        (JSC::regExpProtoGetterUnicode):
+        (JSC::regExpProtoGetterFlags):
+        Updated for new 'y' (unicode) flag.  Add check to use the interpreter for unicode regular expressions.
+
+        * tests/es6.yaml:
+        * tests/stress/static-getter-in-names.js:
+        Updated tests for new flag and for passing the minimal es6 regular expression processing.
+
+        * yarr/Yarr.h: Updated the size of information now kept for backtracking.
+
+        * yarr/YarrCanonicalizeUCS2.cpp: Removed.
+        * yarr/YarrCanonicalizeUCS2.h: Removed.
+        * yarr/YarrCanonicalizeUCS2.js: Removed.
+        * yarr/YarrCanonicalizeUnicode.cpp: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.cpp.
+        * yarr/YarrCanonicalizeUnicode.h: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.h.
+        (JSC::Yarr::canonicalCharacterSetInfo):
+        (JSC::Yarr::canonicalRangeInfoFor):
+        (JSC::Yarr::getCanonicalPair):
+        (JSC::Yarr::isCanonicallyUnique):
+        (JSC::Yarr::areCanonicallyEquivalent):
+        (JSC::Yarr::rangeInfoFor): Deleted.
+        * yarr/YarrCanonicalizeUnicode.js: Copied from Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.js.
+        (printHeader):
+        (printFooter):
+        (hex):
+        (canonicalize):
+        (canonicalizeUnicode):
+        (createUCS2CanonicalGroups):
+        (createUnicodeCanonicalGroups):
+        (cu.in.groupedCanonically.characters.sort): Deleted.
+        (cu.in.groupedCanonically.else): Deleted.
+        Refactored to output two sets of tables, one for UCS2 and one for Unicode.  The UCS2 tables follow
+        the legacy canonicalization rules now specified in ES 6.0, 21.2.2.8.2 Step 3.  The new Unicode
+        tables follow the rules specified in ES 6.0, 21.2.2.8.2 Step 2.  Eliminated the unused Latin1 tables.
+
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::readSurrogatePairChecked):
+        (JSC::Yarr::Interpreter::InputStream::reread):
+        (JSC::Yarr::Interpreter::InputStream::prev):
+        (JSC::Yarr::Interpreter::testCharacterClass):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkSurrogatePair):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::optimizeAlternative):
+        (JSC::Yarr::YarrGenerator::matchCharacterClassRange):
+        (JSC::Yarr::YarrGenerator::matchCharacterClass):
+        (JSC::Yarr::YarrGenerator::notAtEndOfInput):
+        (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
+        * yarr/YarrParser.h:
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::consumePossibleSurrogatePair):
+        (JSC::Yarr::Parser::parseCharacterClass):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        (JSC::Yarr::Parser::atEndOfPattern):
+        (JSC::Yarr::Parser::patternRemaining):
+        (JSC::Yarr::Parser::peek):
+        (JSC::Yarr::parse):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::Yarr::CharacterClassConstructor::append):
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+        (JSC::Yarr::CharacterClassConstructor::putUnicodeIgnoreCase):
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::CharacterClassConstructor::addSorted):
+        (JSC::Yarr::CharacterClassConstructor::addSortedRange):
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::assertionWordBoundary):
+        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassAtom):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassRange):
+        (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::YarrPattern::compile):
+        (JSC::Yarr::YarrPattern::YarrPattern):
+        * yarr/YarrPattern.h:
+        (JSC::Yarr::CharacterRange::CharacterRange):
+        (JSC::Yarr::CharacterClass::CharacterClass):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::YarrPattern::reset):
+        * yarr/YarrSyntaxChecker.cpp:
+        (JSC::Yarr::SyntaxChecker::assertionBOL):
+        (JSC::Yarr::SyntaxChecker::assertionEOL):
+        (JSC::Yarr::SyntaxChecker::assertionWordBoundary):
+        (JSC::Yarr::SyntaxChecker::atomPatternCharacter):
+        (JSC::Yarr::SyntaxChecker::atomBuiltInCharacterClass):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassBegin):
+        (JSC::Yarr::SyntaxChecker::atomCharacterClassAtom):
+        (JSC::Yarr::checkSyntax):
+
+2016-03-01  Saam barati  <sbarati@apple.com>
+
+        Remove FIXMEs and add valid test cases after necessary patch has landed.
+
+        Rubber stamped by Mark Lam.
+
+        * tests/stress/proxy-prevent-extensions.js:
+        (assert.Object.isSealed):
+        (assert):
+
+2016-03-01  Saam barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[IsExtensible]]
+        https://bugs.webkit.org/show_bug.cgi?id=154872
+
+        Reviewed by Oliver Hunt.
+
+        This patch is a direct implementation of Proxy.[[IsExtensible]] with respect to section 9.5.3
+        of the ECMAScript 6 spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::preventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::isExtensible):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-is-extensible.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.get isExtensible):
+        (throw.new.Error):
+        (assert.let.handler.isExtensible):
+        (assert.):
+        (let.handler.isExtensible):
+
+2016-03-01  Saam barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[PreventExtensions]]
+        https://bugs.webkit.org/show_bug.cgi?id=154873
+
+        Reviewed by Oliver Hunt.
+
+        This patch is a direct implementation of Proxy.[[PreventExtensions]] with respect to section 9.5.4
+        of the ECMAScript 6 spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-preventextensions
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::deletePropertyByIndex):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::preventExtensions):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-prevent-extensions.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.get preventExtensions):
+        (throw.new.Error):
+        (assert.let.handler.preventExtensions):
+        (assert.):
+        (let.handler.preventExtensions):
+        (assert.Object.isSealed.let.handler.preventExtensions):
+        (assert.Object.isSealed):
+
+2016-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should simplify StringReplace with an empty replacement string
+        https://bugs.webkit.org/show_bug.cgi?id=154871
+
+        Reviewed by Michael Saboff.
+
+        This is a simple and hugely profitable change. If we do a string.replace(/things/, ""), then
+        this calls directly into StringPrototype's replace-with-empty-string logic instead of going
+        through stuff that does checks before reaching that same conclusion.
+
+        This speeds up Octane/regexp by about 6-10%. It also speeds up the attached microbenchmark by
+        about 7%.
+
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::removeUsingRegExpSearch):
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::operationStringProtoFuncReplaceRegExpEmptyStr):
+        (JSC::operationStringProtoFuncReplaceRegExpString):
+        * runtime/StringPrototype.h:
+
+2016-03-01  Alex Christensen  <achristensen@webkit.org>
+
+        Reduce size of internal windows build output
+        https://bugs.webkit.org/show_bug.cgi?id=154763
+
+        Reviewed by Brent Fulgham.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj:
+
+2016-03-01  Saam barati  <sbarati@apple.com>
+
+        [[IsExtensible]] should be a virtual method in the method table
+        https://bugs.webkit.org/show_bug.cgi?id=154799
+
+        Reviewed by Mark Lam.
+
+        This patch makes us more consistent with how the ES6 specification models the
+        [[IsExtensible]] trap. Moving this method into ClassInfo::methodTable 
+        is a prerequisite for implementing Proxy.[[IsExtensible]].
+
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::preventExtensions):
+        (JSC::JSCell::isExtensible):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::isExtensible):
+        (JSC::JSObject::reifyAllStaticProperties):
+        (JSC::JSObject::defineOwnIndexedProperty):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::isExtensibleImpl):
+        (JSC::JSObject::isStructureExtensible):
+        (JSC::JSObject::isExtensibleInline):
+        (JSC::JSObject::indexingShouldBeSparse):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::isExtensible): Deleted.
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+        (JSC::objectConstructorIs):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectIsExtensible):
+        (JSC::reflectObjectSetPrototypeOf):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayValueMap::putDirect):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/Structure.cpp:
+        (JSC::Structure::isSealed):
+        (JSC::Structure::isFrozen):
+        * runtime/Structure.h:
+
+2016-03-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix CLOOP build.
+
+        * jit/JITOperations.h:
+
+2016-03-01  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function. Some not used byte code is emited
+        https://bugs.webkit.org/show_bug.cgi?id=154639
+
+        Reviewed by Saam Barati.
+
+        Currently bytecode that is generated for arrow function is not optimal. 
+        Current fix removed following unnecessary bytecode:
+        1.create_lexical_environment not emited always for arrow function, only if some of 
+        features(this/super/arguments/eval) is used inside of the arrow function. 
+        2.load 'this' from arrow function scope in constructor is done only if super 
+        contains in arrow function 
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::isSuperCallUsedInInnerArrowFunction):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::doAnyInnerArrowFunctionsUseAnyFeature):
+        * tests/stress/arrowfunction-lexical-bind-supercall-4.js:
+
+2016-02-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Turn String.prototype.replace into an intrinsic
+        https://bugs.webkit.org/show_bug.cgi?id=154835
+
+        Reviewed by Michael Saboff.
+
+        Octane/regexp spends a lot of time in String.prototype.replace(). That function does a lot
+        of checks to see if the parameters are what they are likely to often be (a string, a
+        regexp, and a string). The intuition of this patch is that it's good to remove those checks
+        and it's good to call the native function as directly as possible.
+
+        This yields a 10% speed-up on a replace microbenchmark and a 3% speed-up on Octane/regexp.
+        It also improves Octane/jquery.
+
+        This is only the beginning of what I want to do with replace optimizations. The other
+        optimizations will rely on StringReplace being revealed as a construct in DFG IR.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/SpeculatedType.cpp:
+        (JSC::dumpSpeculation):
+        (JSC::speculationToAbbreviatedString):
+        (JSC::speculationFromClassInfo):
+        * bytecode/SpeculatedType.h:
+        (JSC::isStringOrStringObjectSpeculation):
+        (JSC::isRegExpObjectSpeculation):
+        (JSC::isBoolInt32Speculation):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateStringOrStringObject):
+        (JSC::DFG::Node::shouldSpeculateRegExpObject):
+        (JSC::DFG::Node::shouldSpeculateSymbol):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::SafeToExecuteEdge::operator()):
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::speculateFinalObject):
+        (JSC::DFG::SpeculativeJIT::speculateRegExpObject):
+        (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
+        (JSC::DFG::SpeculativeJIT::speculate):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGUseKind.cpp:
+        (WTF::printInternal):
+        * dfg/DFGUseKind.h:
+        (JSC::DFG::typeFilterFor):
+        (JSC::DFG::isCell):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
+        (JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):
+        (JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
+        (JSC::FTL::DFG::LowerDFGToB3::speculate):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateFinalObject):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateRegExpObject):
+        (JSC::FTL::DFG::LowerDFGToB3::speculateString):
+        * jit/JITOperations.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSType.h:
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::removeUsingRegExpSearch):
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::operationStringProtoFuncReplaceRegExpString):
+        (JSC::replaceUsingStringSearch):
+        (JSC::stringProtoFuncRepeat):
+        (JSC::replace):
+        (JSC::stringProtoFuncReplace):
+        (JSC::operationStringProtoFuncReplaceGeneric):
+        (JSC::stringProtoFuncToString):
+        * runtime/StringPrototype.h:
+
+2016-03-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r197056.
+        https://bugs.webkit.org/show_bug.cgi?id=154870
+
+        broke win ews (Requested by alexchristensen on #webkit).
+
+        Reverted changeset:
+
+        "[cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK."
+        https://bugs.webkit.org/show_bug.cgi?id=154651
+        http://trac.webkit.org/changeset/197056
+
+2016-02-29  Saam barati  <sbarati@apple.com>
+
+        [[PreventExtensions]] should be a virtual method in the method table.
+        https://bugs.webkit.org/show_bug.cgi?id=154800
+
+        Reviewed by Yusuke Suzuki.
+
+        This patch makes us more consistent with how the ES6 specification models the
+        [[PreventExtensions]] trap. Moving this method into ClassInfo::methodTable 
+        is a prerequisite for implementing Proxy.[[PreventExtensions]].
+
+        * runtime/ClassInfo.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getGenericPropertyNames):
+        (JSC::JSCell::preventExtensions):
+        * runtime/JSCell.h:
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::JSModuleNamespaceObject):
+        (JSC::JSModuleNamespaceObject::finishCreation):
+        (JSC::JSModuleNamespaceObject::destroy):
+        * runtime/JSModuleNamespaceObject.h:
+        (JSC::JSModuleNamespaceObject::create):
+        (JSC::JSModuleNamespaceObject::moduleRecord):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        (JSC::JSObject::reifyAllStaticProperties):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isSealed):
+        (JSC::JSObject::isFrozen):
+        (JSC::JSObject::isExtensible):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectPreventExtensions):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::preventExtensionsTransition):
+        * runtime/Structure.h:
+
+2016-02-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Private symbols should not be trapped by proxy handler
+        https://bugs.webkit.org/show_bug.cgi?id=154817
+
+        Reviewed by Mark Lam.
+
+        Since the runtime has some assumptions on the properties associated with the private symbols, ES6 Proxy should not trap these property operations.
+        For example, in ArrayIteratorPrototype.js
+
+            var itemKind = this.@arrayIterationKind;
+            if (itemKind === @undefined)
+                throw new @TypeError("%ArrayIteratorPrototype%.next requires that |this| be an Array Iterator instance");
+
+        Here, we assume that only the array iterator has the @arrayIterationKind property that value is non-undefined.
+        But If we implement Proxy with the get handler, that returns a non-undefined value for every operations, we accidentally assumes that the given value is an array iterator.
+
+        To avoid these situation, we perform the default operations onto property operations with private symbols.
+
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::performPut):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::deleteProperty):
+        (JSC::ProxyObject::deletePropertyByIndex):
+        * tests/stress/proxy-basic.js:
+        * tests/stress/proxy-with-private-symbols.js: Added.
+        (assert):
+        (let.handler.getOwnPropertyDescriptor):
+
+2016-02-29  Filip Pizlo  <fpizlo@apple.com>
+
+        regress/script-tests/double-pollution-putbyoffset.js.ftl-eager timed out because of a lock ordering deadlock involving InferredType and CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=154841
+
+        Reviewed by Benjamin Poulain.
+
+        Here's the deadlock:
+
+        Main thread:
+            1) Change an InferredType.  This acquires InferredType::m_lock.
+            2) Fire watchpoint set.  This triggers CodeBlock invalidation, which acquires
+               CodeBlock::m_lock.
+
+        DFG thread:
+            1) Iterate over the information in a CodeBlock.  This acquires CodeBlock::m_lock.
+            2) Ask an InferredType for its descriptor().  This acquires InferredType::m_lock.
+
+        I think that the DFG thread's ordering should be legal, because the best logic for lock
+        hierarchies is that locks that protect the largest set of stuff should be acquired first.
+
+        This means that the main thread shouldn't be holding the InferredType::m_lock when firing
+        watchpoint sets.  That's what this patch ensures.
+
+        At the time of writing, this test was deadlocking for me on trunk 100% of the time.  With
+        this change I cannot get it to deadlock.
+
+        * runtime/InferredType.cpp:
+        (JSC::InferredType::willStoreValueSlow):
+        (JSC::InferredType::makeTopSlow):
+        (JSC::InferredType::set):
+        (JSC::InferredType::removeStructure):
+        (JSC::InferredType::InferredStructureWatchpoint::fireInternal):
+        * runtime/InferredType.h:
+
+2016-02-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG][FTL][B3] Support floor and ceil
+        https://bugs.webkit.org/show_bug.cgi?id=154683
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements and fixes the following things.
+
+        1. Implement Ceil and Floor in DFG, FTL and B3
+
+        x86 SSE 4.2 and ARM64 have round instructions that can directly perform Ceil or Floor.
+        This patch leverages this functionality. We introduce ArithFloor and ArithCeil.
+        During DFG phase, these nodes attempt to convert itself to Identity (in Fixup phase).
+        As the same to ArithRound, it tracks arith rounding mode.
+        And if these nodes are required to emit machine codes, we emit rounding machine code
+        if it is supported in the current machine. For example, in x86, we emit `round`.
+
+        This `Floor` functionality is nice for @toInteger in builtin.
+        That is used for Array.prototype.{forEach, map, every, some, reduce...}
+        And according to the benchmark results, Kraken audio-oscillator is slightly improved
+        due to its frequent Math.round and Math.floor calls.
+
+        2. Implement Floor in B3 and Air
+
+        As the same to Ceil in B3, we add a new B3 IR and Air opcode, Floor.
+        This Floor is leveraged to implement ArithFloor in DFG.
+
+        3. Fix ArithRound operation
+
+        Currently, we used cvtsd2si (in x86) to convert double value to int32.
+        And we also used this to implement Math.round, like, cvtsd2si(value + 0.5).
+        However, this implementation is not correct. Because cvtsd2si is not floor operation.
+        It is trucate operation. This is OK for positive numbers. But NG for negative numbers.
+        For example, the current implementation accidentally rounds `-0.6` to `-0.0`. This should be `-1.0`.
+        Using Ceil and Floor instructions, we implement correct ArithRound.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPointRounding):
+        (JSC::MacroAssemblerARM::ceilDouble):
+        (JSC::MacroAssemblerARM::floorDouble):
+        (JSC::MacroAssemblerARM::supportsFloatingPointCeil): Deleted.
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::supportsFloatingPointRounding):
+        (JSC::MacroAssemblerARM64::floorFloat):
+        (JSC::MacroAssemblerARM64::supportsFloatingPointCeil): Deleted.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointRounding):
+        (JSC::MacroAssemblerARMv7::ceilDouble):
+        (JSC::MacroAssemblerARMv7::floorDouble):
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointCeil): Deleted.
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::ceilDouble):
+        (JSC::MacroAssemblerMIPS::floorDouble):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointRounding):
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointCeil): Deleted.
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::supportsFloatingPointRounding):
+        (JSC::MacroAssemblerSH4::ceilDouble):
+        (JSC::MacroAssemblerSH4::floorDouble):
+        (JSC::MacroAssemblerSH4::supportsFloatingPointCeil): Deleted.
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::floorDouble):
+        (JSC::MacroAssemblerX86Common::floorFloat):
+        (JSC::MacroAssemblerX86Common::supportsFloatingPointRounding):
+        (JSC::MacroAssemblerX86Common::supportsFloatingPointCeil): Deleted.
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::floorConstant):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ConstFloatValue.cpp:
+        (JSC::B3::ConstFloatValue::floorConstant):
+        * b3/B3ConstFloatValue.h:
+        * b3/B3LowerMacrosAfterOptimizations.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceDoubleToFloat.cpp:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::floorConstant):
+        (JSC::B3::Value::isRounded):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testFloorCeilArg):
+        (JSC::B3::testFloorArg):
+        (JSC::B3::testFloorImm):
+        (JSC::B3::testFloorMem):
+        (JSC::B3::testFloorFloorArg):
+        (JSC::B3::testCeilFloorArg):
+        (JSC::B3::testFloorIToD64):
+        (JSC::B3::testFloorIToD32):
+        (JSC::B3::testFloorArgWithUselessDoubleConversion):
+        (JSC::B3::testFloorArgWithEffectfulDoubleConversion):
+        (JSC::B3::run):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGArithMode.cpp:
+        (WTF::printInternal):
+        * dfg/DFGArithMode.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::roundShouldSpeculateInt32):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::hasHeapPrediction):
+        (JSC::DFG::Node::hasArithRoundingMode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithRounding):
+        (JSC::DFG::SpeculativeJIT::compileArithRound): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithRound):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithFloor):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithCeil):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleFloor):
+        * jit/ThunkGenerators.cpp:
+        (JSC::ceilThunkGenerator):
+        * tests/stress/math-ceil-arith-rounding-mode.js: Added.
+        (firstCareAboutZeroSecondDoesNot):
+        (firstDoNotCareAboutZeroSecondDoes):
+        (warmup):
+        (verifyNegativeZeroIsPreserved):
+        * tests/stress/math-ceil-basics.js: Added.
+        (mathCeilOnIntegers):
+        (mathCeilOnDoubles):
+        (mathCeilOnBooleans):
+        (uselessMathCeil):
+        (mathCeilWithOverflow):
+        (mathCeilConsumedAsDouble):
+        (mathCeilDoesNotCareAboutMinusZero):
+        (mathCeilNoArguments):
+        (mathCeilTooManyArguments):
+        (testMathCeilOnConstants):
+        (mathCeilStructTransition):
+        (Math.ceil):
+        * tests/stress/math-floor-arith-rounding-mode.js: Added.
+        (firstCareAboutZeroSecondDoesNot):
+        (firstDoNotCareAboutZeroSecondDoes):
+        (warmup):
+        (verifyNegativeZeroIsPreserved):
+        * tests/stress/math-floor-basics.js: Added.
+        (mathFloorOnIntegers):
+        (mathFloorOnDoubles):
+        (mathFloorOnBooleans):
+        (uselessMathFloor):
+        (mathFloorWithOverflow):
+        (mathFloorConsumedAsDouble):
+        (mathFloorDoesNotCareAboutMinusZero):
+        (mathFloorNoArguments):
+        (mathFloorTooManyArguments):
+        (testMathFloorOnConstants):
+        (mathFloorStructTransition):
+        (Math.floor):
+        * tests/stress/math-round-should-not-use-truncate.js: Added.
+        (mathRoundDoesNotCareAboutMinusZero):
+        * tests/stress/math-rounding-infinity.js: Added.
+        (shouldBe):
+        (testRound):
+        (testFloor):
+        (testCeil):
+        * tests/stress/math-rounding-nan.js: Added.
+        (shouldBe):
+        (testRound):
+        (testFloor):
+        (testCeil):
+        * tests/stress/math-rounding-negative-zero.js: Added.
+        (shouldBe):
+        (testRound):
+        (testFloor):
+        (testCeil):
+        (testRoundNonNegativeZero):
+        (testRoundNonNegativeZero2):
+
+2016-02-29  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Add new MethodTable method to get an estimated size for a cell
+        https://bugs.webkit.org/show_bug.cgi?id=154838
+
+        Reviewed by Filip Pizlo.
+
+        The new class method estimatedSize(JSCell*) estimates the size for a single cell.
+        As the name implies, this is meant to be an approximation. It is more important
+        that big objects report a large size, then to get perfect size information for
+        all objects in the heap.
+
+            Base implementation (JSCell):
+              - returns the MarkedBlock bucket size for this cell.
+              - This gets us the object size include inline storage. Basically a better sizeof.
+
+            Subclasses with "Extra Memory Cost":
+              - Any class that reports extra memory (reportExtraMemoryVisited) should include that in the estimated size.
+              - E.g. CodeBlock, JSGenericTypedArrayView, WeakMapData, etc.
+
+            Subclasses with "Copied Space" storage:
+              - Any class with data in copied space (copyBackingStore) should include that in the estimated size.
+              - E.g. JSObject, JSGenericTypedArrayView, JSMap, JSSet, DirectArguments, etc.
+
+        Add reportExtraMemoryVisited for UnlinkedCodeBlock's compressed unlinked
+        instructions because this can be larger than 1kb, which is significant.
+
+        This has one special case for RegExp generated bytecode / JIT code, which
+        does not currently fall into the extra memory cost or copied space storage.
+        In practice I haven't seen this grow to a significant cost.
+
+        * runtime/ClassInfo.h:
+        Add the new estimatedSize method to the table.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::visitChildren):
+        (JSC::UnlinkedCodeBlock::estimatedSize):
+        (JSC::UnlinkedCodeBlock::setInstructions):
+        * bytecode/UnlinkedCodeBlock.h:
+        Report an extra memory cost for unlinked code blocks like
+        we do for linked code blocks.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::estimatedSize):
+        * bytecode/CodeBlock.h:
+        * bytecode/UnlinkedInstructionStream.cpp:
+        (JSC::UnlinkedInstructionStream::sizeInBytes):
+        * bytecode/UnlinkedInstructionStream.h:
+        * runtime/DirectArguments.cpp:
+        (JSC::DirectArguments::estimatedSize):
+        * runtime/DirectArguments.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::estimatedSizeInBytes):
+        (JSC::JSCell::estimatedSize):
+        * runtime/JSCell.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::estimatedSize):
+        * runtime/JSMap.cpp:
+        (JSC::JSMap::estimatedSize):
+        * runtime/JSMap.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitButterfly):
+        * runtime/JSObject.h:
+        * runtime/JSSet.cpp:
+        (JSC::JSSet::estimatedSize):
+        * runtime/JSSet.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::estimatedSize):
+        * runtime/JSString.h:
+        * runtime/MapData.h:
+        (JSC::MapDataImpl::capacityInBytes):
+        * runtime/WeakMapData.cpp:
+        (JSC::WeakMapData::estimatedSize):
+        (JSC::WeakMapData::visitChildren):
+        * runtime/WeakMapData.h:
+        Implement estimated size following the pattern of reporting
+        extra visited size, or copy space memory.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::estimatedSize):
+        * runtime/RegExp.h:
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::ByteDisjunction::estimatedSizeInBytes):
+        (JSC::Yarr::BytecodePattern::estimatedSizeInBytes):
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::YarrCodeBlock::size):
+        Include generated bytecode / JITCode to a RegExp's size.
+
+2016-02-29  Filip Pizlo  <fpizlo@apple.com>
+
+        SpeculatedType should be easier to edit
+        https://bugs.webkit.org/show_bug.cgi?id=154840
+
+        Reviewed by Mark Lam.
+
+        We used to specify the bitmasks in SpeculatedType.h using hex codes. This used to work
+        great because we didn't have so many masks and you could use the mask to visually see
+        which ones overlapped. It also made it easy to visualize subset relationships.
+
+        But now we have a lot of masks with a lot of confusing overlaps, and it's no longer
+        possible to just see their relationship by looking at hex codes. Worse, the use of hex
+        codes makes it super annoying to move the bits around. For example, right now we have two
+        bits free, but if we wanted to reclaim them by editing the old hex masks, it would be a
+        nightmare.
+
+        So this patch replaces the hex masks with shift expressions (1u << 15 for example) and it
+        makes any derived masks (i.e. masks that are the bit-or of other masks) be expressed using
+        an or expression (SpecFoo | SpecBar | SpecBaz for example).
+
+        This makes it easier to see the relationships and it makes it easier to take bits for new
+        types.
+
+        * bytecode/SpeculatedType.h:
+
+2016-02-29  Keith Miller  <keith_miller@apple.com>
+
+        OverridesHasInstance constant folding is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=154833
+
+        Reviewed by Filip Pizlo.
+
+        The current implementation of OverridesHasInstance constant folding
+        is incorrect. Since it relies on OSR exit information it has been
+        moved to the StrengthReductionPhase. Normally, such an optimazation would be
+        put in FixupPhase, however, there are a number of cases where we don't
+        determine an edge of OverridesHasInstance is a constant until after fixup.
+        Performing the optimization during StrengthReductionPhase means we can defer
+        our decision until later.
+
+        In the future we should consider creating a version of this optimization
+        that does not depend on OSR exit information and move the optimization back
+        to ConstantFoldingPhase.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+
+2016-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should have global store elimination
+        https://bugs.webkit.org/show_bug.cgi?id=154658
+
+        Reviewed by Benjamin Poulain.
+
+        Implements fairly comprehensive global store elimination:
+
+        1) If you store the result of a load with no interference in between, remove the store.
+
+        2) If you store the same thing you stored previously, remove the store.
+
+        3) If you store something that you either loaded previously or stored previously along
+           arbitrarily many paths, remove the store.
+
+        4) If you store to something that is stored to again in the future with no interference in
+           between, remove the store.
+
+        Rule (4) is super relevant to FTL since the DFG does not eliminate redundant PutStructures.
+        A constructor that produces a large object will have many redundant stores to the same base
+        pointer, offset, and heap range, with no code to observe that heap raneg in between.
+
+        This doesn't have a decisive effect on major benchmarks, but it's an enormous win for
+        microbenchmarks:
+
+        - 30% faster to construct an object with many fields.
+
+        - 5x faster to do many stores to a global variable.
+
+        The compile time cost should be very small. Although the optimization is global, it aborts as
+        soon as it sees anything that would confound store elimination. For rules (1)-(3), we
+        piggy-back the existing load elimination, which gives up on interfering stores. For rule (4),
+        we search forward through the current block and then globally a block at a time (skipping
+        block contents thanks to summary data), which could be expensive. But rule (4) aborts as soon
+        as it sees a read, write, or end block (Return or Oops). Any Check will claim to read TOP. Any
+        Patchpoint that results from an InvalidationPoint will claim to read TOP, as will any
+        Patchpoints for ICs. Those are usually sprinkled all over the program.
+
+        In other words, this optimization rarely kicks in. When it does kick in, it makes programs run
+        faster. When it doesn't kick in, it's usually O(1) because there are reasons for aborting all
+        over a "normal" program so the search will halt almost immediately. This of course raises the
+        question: how much more in compile time do we pay when the optimization does kick in? The
+        optimization kicks in the most for the microbenchmarks I wrote for this patch. Amazingly, the
+        effect of the optimization a wash for compile time: whatever cost we pay doing the O(n^2)
+        searches is balanced by the massive reduction in work in the backend. On one of the two
+        microbenchmarks, overall compile time actually shrank with this optimization even though CSE
+        itself cost more. That's not too surprising - the backend costs much more per instruction, so
+        things that remove instructions before we get to the backend tend to be a good idea.
+
+        We could consider adding a more aggressive version of this in the future, which could sink
+        stores into checks. That could be crazy fun: https://bugs.webkit.org/show_bug.cgi?id=152162#c3
+
+        But mainly, I'm adding this optimization because it was super fun to implement during the
+        WebAssembly CG summit.
+
+        * b3/B3EliminateCommonSubexpressions.cpp:
+        * b3/B3MemoryValue.h:
+        * b3/B3SuccessorCollection.h:
+        (JSC::B3::SuccessorCollection::begin):
+        (JSC::B3::SuccessorCollection::end):
+        (JSC::B3::SuccessorCollection::const_iterator::const_iterator):
+        (JSC::B3::SuccessorCollection::const_iterator::operator*):
+        (JSC::B3::SuccessorCollection::const_iterator::operator++):
+        (JSC::B3::SuccessorCollection::const_iterator::operator==):
+        (JSC::B3::SuccessorCollection::const_iterator::operator!=):
+
+2016-02-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it cheap to #include "JITOperations.h"
+        https://bugs.webkit.org/show_bug.cgi?id=154836
+
+        Reviewed by Mark Lam.
+
+        Prior to this change, this header included the whole world even though it did't have any
+        definitions. This patch turns almost all of the includes into forward declarations. Right
+        now this header is very cheap to include.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGSpeculativeJIT.h:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/Repatch.h:
+        * runtime/CommonSlowPaths.h:
+        (JSC::encodeResult): Deleted.
+        (JSC::decodeResult): Deleted.
+        * runtime/SlowPathReturnType.h: Added.
+        (JSC::encodeResult):
+        (JSC::decodeResult):
+
+2016-02-28  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should be able to run everything in Octane/regexp
+        https://bugs.webkit.org/show_bug.cgi?id=154266
+
+        Reviewed by Saam Barati.
+
+        Adds FTL support for NewRegexp, RegExpTest, and RegExpExec. I couldn't figure out how to
+        make the RegExpExec peephole optimization work in FTL. This optimizations shouldn't be a
+        DFG backend optimization anyway - if we need this optimization then it should be a
+        strength reduction rule over IR. That way, it can be shared by all backends.
+
+        I measured whether removing that optimization had any effect on performance separately
+        from measuring the performance of this patch. Removing that optimization did not change
+        our score on any benchmarks.
+
+        This patch does have an overall negative effect on the Octane/regexp score. This is
+        presumably because tiering up to the FTL has no value to the code in the regexp test. Or
+        maybe it's something else. No matter - the overall effect on the Octane score is not
+        statistically significant and we don't want this kind of coverage blocked by the fact
+        that adding coverage hurts a benchmark.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::setIndexingType):
+        (JSC::DFG::Node::hasRegexpIndex):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNotifyWrite):
+        (JSC::DFG::SpeculativeJIT::compileIsObjectOrNull):
+        (JSC::DFG::SpeculativeJIT::compileRegExpExec): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCheckWatchdogTimer):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpExec):
+        (JSC::FTL::DFG::LowerDFGToB3::compileRegExpTest):
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
+        (JSC::FTL::DFG::LowerDFGToB3::didOverflowStack):
+        * tests/stress/ftl-regexp-exec.js: Added.
+        * tests/stress/ftl-regexp-test.js: Added.
+
+2016-02-28  Andreas Kling  <akling@apple.com>
+
+        Make JSFunction.name allocation fully lazy.
+        <https://webkit.org/b/154806>
+
+        Reviewed by Saam Barati.
+
+        We were reifying the "name" field on functions lazily, but created the string
+        value itself up front. This patch gets rid of the up-front allocation,
+        saving us a JSString allocation per function in most cases.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::visitChildren):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/Executable.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::reifyName):
+
+2016-02-28  Andreas Kling  <akling@apple.com>
+
+        REGRESSION(r197303): 4 jsc tests failing on bots.
+
+        Unreviewed follow-up fix.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset): This function
+        can still get called with !m_rareData, in case the type profiler is active but this
+        particular code block doesn't have type profiler data. Handle it gracefully.
+
+2016-02-28  Andreas Kling  <akling@apple.com>
+
+        Shrink UnlinkedCodeBlock a bit.
+        <https://webkit.org/b/154797>
+
+        Reviewed by Anders Carlsson.
+
+        Move profiler-related members of UnlinkedCodeBlock into its RareData
+        structure, saving 40 bytes, and then reorder the other members of
+        UnlinkedCodeBlock to save another 24 bytes, netting a nice total 64.
+
+        The VM member was removed entirely since UnlinkedCodeBlock is a cell
+        and can retrieve its VM through MarkedBlock header lookup.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::vm):
+        (JSC::UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo):
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::addRegExp):
+        (JSC::UnlinkedCodeBlock::addConstant):
+        (JSC::UnlinkedCodeBlock::addFunctionDecl):
+        (JSC::UnlinkedCodeBlock::addFunctionExpr):
+        (JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset):
+        (JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets):
+        (JSC::UnlinkedCodeBlock::vm): Deleted.
+
+2016-02-27  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should lower its abstract heaps to B3 heap ranges
+        https://bugs.webkit.org/show_bug.cgi?id=154782
+
+        Reviewed by Saam Barati.
+
+        The FTL can describe the abstract heaps (points-to sets) that a memory operation will
+        affect. The abstract heaps are arranged as a hierarchy. We used to transform this into
+        TBAA hierarchies in LLVM, but we never got around to wiring this up to B3's equivalent
+        notion - the HeapRange. That's what this patch fixes.
+
+        B3 has a minimalistic alias analysis. It represents abstract heaps using unsigned 32-bit
+        integers. There are 1<<32 abstract heaps. The B3 client can describe what an operation
+        affects by specifying a heap range: a begin...end pair that says that the operation
+        affects all abstract heaps H such that begin <= H < end.
+
+        This peculiar scheme was a deliberate attempt to distill what the abstract heap
+        hierarchy is all about. We can assign begin...end numbers to abstract heaps so that:
+
+        - A heap's end is greater than its begin.
+        - A heap's begin is greater than or equal to its parent's begin.
+        - A heap's end is less than or equal to its parent's end.
+
+        This is easy to do using a recursive traversal of the abstract heap hierarchy. I almost
+        went for the iterative traversal, which is a splendid algorithm, but it's totally
+        unnecessary here since we tightly control the height of the heap hierarchy.
+
+        Because abstract heaps are produced on-the-fly by FTL lowering, due to the fact that we
+        generate new ones for field names and constant indices we encounter, we can't actually
+        decorate the B3 instructions we create in lowering until all lowering is done. Adding a
+        new abstract heap to the hierarchy after ranges were already computed would require
+        updating the ranges of any heaps "to the right" of that heap in the hierarchy. This
+        patch solves that problem by recording the associations between abstract heaps and their
+        intended roles in the generated IR, and then decorating all of the relevant B3 values
+        after we compute the ranges of the hierarchy after lowering.
+
+        This is perf-neutral. I was hoping for a small speed-up, but I could not detect a
+        speed-up on any benchmark. That's not too surprising. We already have very precise CSE
+        in the DFG, so there aren't many opportunities left for the B3 CSE and it may have
+        already been getting the big ones even without alias analysis.
+
+        Even without a speed-up, this patch is valuable because it makes it easier to implement
+        other optimizations, like store elimination.
+
+        * b3/B3HeapRange.h:
+        (JSC::B3::HeapRange::HeapRange):
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::AbstractHeap::AbstractHeap):
+        (JSC::FTL::AbstractHeap::changeParent):
+        (JSC::FTL::AbstractHeap::compute):
+        (JSC::FTL::AbstractHeap::shallowDump):
+        (JSC::FTL::AbstractHeap::dump):
+        (JSC::FTL::AbstractHeap::deepDump):
+        (JSC::FTL::AbstractHeap::badRangeError):
+        (JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
+        (JSC::FTL::IndexedAbstractHeap::baseIndex):
+        (JSC::FTL::IndexedAbstractHeap::atSlow):
+        (JSC::FTL::IndexedAbstractHeap::initialize):
+        (JSC::FTL::AbstractHeap::decorateInstruction): Deleted.
+        (JSC::FTL::AbstractField::dump): Deleted.
+        * ftl/FTLAbstractHeap.h:
+        (JSC::FTL::AbstractHeap::AbstractHeap):
+        (JSC::FTL::AbstractHeap::isInitialized):
+        (JSC::FTL::AbstractHeap::initialize):
+        (JSC::FTL::AbstractHeap::parent):
+        (JSC::FTL::AbstractHeap::heapName):
+        (JSC::FTL::AbstractHeap::range):
+        (JSC::FTL::AbstractHeap::offset):
+        (JSC::FTL::IndexedAbstractHeap::atAnyIndex):
+        (JSC::FTL::IndexedAbstractHeap::at):
+        (JSC::FTL::IndexedAbstractHeap::operator[]):
+        (JSC::FTL::IndexedAbstractHeap::returnInitialized):
+        (JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::constructDeletedValue):
+        (JSC::FTL::IndexedAbstractHeap::WithoutZeroOrOneHashTraits::isDeletedValue):
+        (JSC::FTL::AbstractHeap::changeParent): Deleted.
+        (JSC::FTL::AbstractField::AbstractField): Deleted.
+        (JSC::FTL::AbstractField::initialize): Deleted.
+        (JSC::FTL::AbstractField::offset): Deleted.
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        (JSC::FTL::AbstractHeapRepository::~AbstractHeapRepository):
+        (JSC::FTL::AbstractHeapRepository::decorateMemory):
+        (JSC::FTL::AbstractHeapRepository::decorateCCallRead):
+        (JSC::FTL::AbstractHeapRepository::decorateCCallWrite):
+        (JSC::FTL::AbstractHeapRepository::decoratePatchpointRead):
+        (JSC::FTL::AbstractHeapRepository::decoratePatchpointWrite):
+        (JSC::FTL::AbstractHeapRepository::computeRangesAndDecorateInstructions):
+        * ftl/FTLAbstractHeapRepository.h:
+        (JSC::FTL::AbstractHeapRepository::forArrayType):
+        (JSC::FTL::AbstractHeapRepository::HeapForValue::HeapForValue):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::lower):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::load8ZeroExt32):
+        (JSC::FTL::Output::load16SignExt32):
+        (JSC::FTL::Output::load16ZeroExt32):
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::store32As8):
+        (JSC::FTL::Output::store32As16):
+        (JSC::FTL::Output::baseIndex):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::address):
+        (JSC::FTL::Output::absolute):
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::load8ZeroExt32):
+        (JSC::FTL::Output::load16SignExt32):
+        (JSC::FTL::Output::load16ZeroExt32):
+        (JSC::FTL::Output::load32):
+        (JSC::FTL::Output::load64):
+        (JSC::FTL::Output::loadPtr):
+        (JSC::FTL::Output::loadDouble):
+        (JSC::FTL::Output::store32):
+        (JSC::FTL::Output::store64):
+        (JSC::FTL::Output::storePtr):
+        (JSC::FTL::Output::storeDouble):
+        (JSC::FTL::Output::ascribeRange):
+        (JSC::FTL::Output::nonNegative32):
+        (JSC::FTL::Output::load32NonNegative):
+        (JSC::FTL::Output::equal):
+        (JSC::FTL::Output::notEqual):
+        * ftl/FTLTypedPointer.h:
+        (JSC::FTL::TypedPointer::operator!):
+        (JSC::FTL::TypedPointer::heap):
+        (JSC::FTL::TypedPointer::value):
+
+2016-02-28  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Emit loading&putting this/super only if they are used in arrow function
+        https://bugs.webkit.org/show_bug.cgi?id=153981
+
+        Reviewed by Saam Barati.
+       
+        In first iteration of implemenation arrow function, we emit load and store variables 'this', 'arguments',
+        'super', 'new.target' in case if arrow function is exist even variables are not used in arrow function. 
+        Current patch added logic that prevent from emiting those varibles if they are not used in arrow function.
+        During syntax analyze parser store information about using variables in arrow function inside of 
+        the ordinary function scope and then put to BytecodeGenerator through UnlinkedCodeBlock
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::isThisUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isArgumentsUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isNewTargetUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isSuperUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createBracketAccess):
+        (JSC::ASTBuilder::createDotAccess):
+        (JSC::ASTBuilder::usesSuperCall):
+        (JSC::ASTBuilder::usesSuperProperty):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ModuleProgramNode::ModuleProgramNode):
+        (JSC::EvalNode::EvalNode):
+        (JSC::FunctionNode::FunctionNode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::innerArrowFunctionCodeFeatures):
+        (JSC::ScopeNode::doAnyInnerArrowFunctionsUseArguments):
+        (JSC::ScopeNode::doAnyInnerArrowFunctionsUseSuperCall):
+        (JSC::ScopeNode::doAnyInnerArrowFunctionsUseSuperProperty):
+        (JSC::ScopeNode::doAnyInnerArrowFunctionsUseEval):
+        (JSC::ScopeNode::doAnyInnerArrowFunctionsUseThis):
+        (JSC::ScopeNode::doAnyInnerArrowFunctionsUseNewTarget):
+        (JSC::ScopeNode::doAnyInnerArrowFunctionUseAnyFeature):
+        (JSC::ScopeNode::usesSuperCall):
+        (JSC::ScopeNode::usesSuperProperty):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::isArrowFunctionBoundary):
+        (JSC::Scope::innerArrowFunctionFeatures):
+        (JSC::Scope::setInnerArrowFunctionUsesSuperCall):
+        (JSC::Scope::setInnerArrowFunctionUsesSuperProperty):
+        (JSC::Scope::setInnerArrowFunctionUsesEval):
+        (JSC::Scope::setInnerArrowFunctionUsesThis):
+        (JSC::Scope::setInnerArrowFunctionUsesNewTarget):
+        (JSC::Scope::setInnerArrowFunctionUsesArguments):
+        (JSC::Scope::setInnerArrowFunctionUsesEvalAndUseArgumentsIfNeeded):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::mergeInnerArrowFunctionFeatures):
+        (JSC::Scope::fillParametersForSourceProviderCache):
+        (JSC::Scope::restoreFromSourceProviderCache):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::setIsArrowFunction):
+        (JSC::Parser::closestParentNonArrowFunctionNonLexicalScope):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::popScopeInternal):
+        (JSC::Parser<LexerType>::parse):
+        * parser/ParserModes.h:
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        * tests/stress/arrowfunction-lexical-bind-arguments-non-strict-1.js:
+        * tests/stress/arrowfunction-lexical-bind-arguments-strict.js:
+        * tests/stress/arrowfunction-lexical-bind-newtarget.js:
+        * tests/stress/arrowfunction-lexical-bind-superproperty.js:
+        * tests/stress/arrowfunction-lexical-bind-this-8.js: Added.
+
+2016-02-28  Saam barati  <sbarati@apple.com>
+
+        ProxyObject.[[GetOwnProperty]] is partially broken because it doesn't propagate information back to the slot
+        https://bugs.webkit.org/show_bug.cgi?id=154768
+
+        Reviewed by Ryosuke Niwa.
+
+        This fixes a big bug with ProxyObject.[[GetOwnProperty]]:
+        http://www.ecma-international.org/ecma-262/6.0/index.html#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p
+        We weren't correctly propagating the result of this operation to the
+        out PropertySlot& parameter. This patch fixes that and adds tests.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        I added a missing exception check after object allocation
+        because I saw that it was missing while reading the code.
+
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setUndefined):
+        (JSC::PropertyDescriptor::slowGetterSetter):
+        (JSC::PropertyDescriptor::getter):
+        * runtime/PropertyDescriptor.h:
+        (JSC::PropertyDescriptor::attributes):
+        (JSC::PropertyDescriptor::value):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        * tests/es6.yaml:
+        * tests/stress/proxy-get-own-property.js:
+        (let.handler.getOwnPropertyDescriptor):
+        (set get let.handler.return):
+        (set get let.handler.getOwnPropertyDescriptor):
+        (set get let):
+        (set get let.a):
+        (let.b):
+        (let.setter):
+        (let.getter):
+
+2016-02-27  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        Intl.Collator uses POSIX locale (detected by js/intl-collator.html on iOS Simulator)
+        https://bugs.webkit.org/show_bug.cgi?id=152448
+
+        Reviewed by Darin Adler.
+
+        Add defaultLanguage to the globalObjectMethodTable and use it for the
+        default locale in Intl object initializations. Fall back to ICU default
+        locale only if the defaultLanguage function is null, or returns an
+        empty string.
+
+        * jsc.cpp:
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::initializeCollator):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        * runtime/IntlObject.cpp:
+        (JSC::defaultLocale):
+        (JSC::lookupMatcher):
+        (JSC::bestFitMatcher):
+        (JSC::resolveLocale):
+        * runtime/IntlObject.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::toLocaleCase):
+
+2016-02-27  Oliver Hunt  <oliver@apple.com>
+
+        CLoop build fix.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+
+2016-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Remove the on demand executable allocator
+        https://bugs.webkit.org/show_bug.cgi?id=154749
+
+        Reviewed by Geoffrey Garen.
+
+        Remove all the DemandExecutable code and executable allocator ifdefs.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.cpp: Removed.
+        (JSC::DemandExecutableAllocator::DemandExecutableAllocator): Deleted.
+        (JSC::DemandExecutableAllocator::~DemandExecutableAllocator): Deleted.
+        (JSC::DemandExecutableAllocator::bytesAllocatedByAllAllocators): Deleted.
+        (JSC::DemandExecutableAllocator::bytesCommittedByAllocactors): Deleted.
+        (JSC::DemandExecutableAllocator::dumpProfileFromAllAllocators): Deleted.
+        (JSC::DemandExecutableAllocator::allocateNewSpace): Deleted.
+        (JSC::DemandExecutableAllocator::notifyNeedPage): Deleted.
+        (JSC::DemandExecutableAllocator::notifyPageIsFree): Deleted.
+        (JSC::DemandExecutableAllocator::allocators): Deleted.
+        (JSC::DemandExecutableAllocator::allocatorsMutex): Deleted.
+        (JSC::ExecutableAllocator::initializeAllocator): Deleted.
+        (JSC::ExecutableAllocator::ExecutableAllocator): Deleted.
+        (JSC::ExecutableAllocator::~ExecutableAllocator): Deleted.
+        (JSC::ExecutableAllocator::isValid): Deleted.
+        (JSC::ExecutableAllocator::underMemoryPressure): Deleted.
+        (JSC::ExecutableAllocator::memoryPressureMultiplier): Deleted.
+        (JSC::ExecutableAllocator::allocate): Deleted.
+        (JSC::ExecutableAllocator::committedByteCount): Deleted.
+        (JSC::ExecutableAllocator::dumpProfile): Deleted.
+        (JSC::ExecutableAllocator::getLock): Deleted.
+        (JSC::ExecutableAllocator::isValidExecutableMemory): Deleted.
+        (JSC::ExecutableAllocator::reprotectRegion): Deleted.
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        * jit/JITStubRoutine.h:
+        (JSC::JITStubRoutine::canPerformRangeFilter): Deleted.
+        (JSC::JITStubRoutine::filteringStartAddress): Deleted.
+        (JSC::JITStubRoutine::filteringExtentSize): Deleted.
+
+2016-02-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Reduce direct callers of Structure::findStructuresAndMapForMaterialization
+        https://bugs.webkit.org/show_bug.cgi?id=154751
+
+        Reviewed by Mark Lam.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::toStructureShape):
+        This property name iteration is identical to Structure::forEachPropertyConcurrently.
+        Share the code and reduce callers to the subtle findStructuresAndMapForMaterialization.
+
+2016-02-26  Mark Lam  <mark.lam@apple.com>
+
+        Function.name and Function.length should be configurable.
+        https://bugs.webkit.org/show_bug.cgi?id=154604
+
+        Reviewed by Saam Barati.
+
+        According to https://tc39.github.io/ecma262/#sec-ecmascript-language-functions-and-classes,
+        "Unless otherwise specified, the name property of a built-in Function object,
+        if it exists, has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+        [[Configurable]]: true }."
+
+        Similarly, "the length property of a built-in Function object has the attributes
+        { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }."
+
+        This patch makes Function.name and Function.length configurable.
+
+        We do this by lazily reifying the JSFunction name and length properties on first
+        access.  We track whether each of these properties have been reified using flags
+        in the FunctionRareData.  On first access, if not already reified, we will put
+        the property into the object with its default value and attributes and set the
+        reified flag.  Thereafter, we rely on the base JSObject to handle access to the
+        property.
+
+        Also, lots of test results have to be re-baselined because the old Function.length
+        has attribute DontDelete, which is in conflict with the ES6 requirement that it
+        is configurable.
+
+        * runtime/FunctionRareData.h:
+        (JSC::FunctionRareData::hasReifiedLength):
+        (JSC::FunctionRareData::setHasReifiedLength):
+        (JSC::FunctionRareData::hasReifiedName):
+        (JSC::FunctionRareData::setHasReifiedName):
+        - Flags for tracking whether each property has been reified.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        (JSC::JSFunction::createBuiltinFunction):
+        - Host and builtin functions currently always reify their name and length
+          properties.  Currently, for builtins, the default names that are used may
+          differ from the executable name.  For now, we'll stay with keeping this
+          alternate approach to getting the name and length properties for host and
+          builtin functions.
+          However, we need their default attribute to be configurable as well.
+
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::defineOwnProperty):
+        (JSC::JSFunction::reifyLength):
+        (JSC::JSFunction::reifyName):
+        (JSC::JSFunction::reifyLazyPropertyIfNeeded):
+        (JSC::JSFunction::lengthGetter): Deleted.
+        (JSC::JSFunction::nameGetter): Deleted.
+        * runtime/JSFunction.h:
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::hasReifiedLength):
+        (JSC::JSFunction::hasReifiedName):
+
+        * tests/es6.yaml:
+        - 4 new passing tests.
+
+        * tests/mozilla/ecma/Array/15.4.4.3-1.js:
+        * tests/mozilla/ecma/Array/15.4.4.4-1.js:
+        * tests/mozilla/ecma/Array/15.4.4.4-2.js:
+        * tests/mozilla/ecma/GlobalObject/15.1.2.1-1.js:
+        * tests/mozilla/ecma/GlobalObject/15.1.2.2-1.js:
+        * tests/mozilla/ecma/GlobalObject/15.1.2.3-1.js:
+        * tests/mozilla/ecma/GlobalObject/15.1.2.4.js:
+        * tests/mozilla/ecma/GlobalObject/15.1.2.5-1.js:
+        * tests/mozilla/ecma/GlobalObject/15.1.2.6.js:
+        * tests/mozilla/ecma/GlobalObject/15.1.2.7.js:
+        * tests/mozilla/ecma/String/15.5.4.10-1.js:
+        * tests/mozilla/ecma/String/15.5.4.11-1.js:
+        * tests/mozilla/ecma/String/15.5.4.11-5.js:
+        * tests/mozilla/ecma/String/15.5.4.12-1.js:
+        * tests/mozilla/ecma/String/15.5.4.6-2.js:
+        * tests/mozilla/ecma/String/15.5.4.7-2.js:
+        * tests/mozilla/ecma/String/15.5.4.8-1.js:
+        * tests/mozilla/ecma/String/15.5.4.9-1.js:
+        - Rebase expected test results.
+
+        * tests/stress/function-configurable-properties.js: Added.
+
+2016-02-26  Keith Miller  <keith_miller@apple.com>
+
+        Folding of OverridesHasInstance DFG nodes shoud happen in constant folding not fixup
+        https://bugs.webkit.org/show_bug.cgi?id=154743
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2016-02-26  Keith Miller  <keith_miller@apple.com>
+
+        Native Typed Array functions should use Symbol.species
+        https://bugs.webkit.org/show_bug.cgi?id=154569
+
+        Reviewed by Michael Saboff.
+
+        This patch adds support for Symbol.species in the native Typed Array prototype
+        functions. Additionally, now that other types of typedarrays are creatable inside
+        the slice we use the JSGenericTypedArrayView::set function, which has been beefed
+        up, to put everything into the correct place.
+
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::set):
+        * runtime/JSDataView.h:
+        * runtime/JSGenericTypedArrayView.h:
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::setWithSpecificType):
+        (JSC::JSGenericTypedArrayView<Adaptor>::set):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewProtoFuncSubarray):
+        * tests/stress/typedarray-slice.js:
+        (subclasses.typedArrays.map):
+        (testSpecies):
+        (forEach):
+        (subclasses.forEach):
+        (testSpeciesRemoveConstructor):
+        (testSpeciesWithSameBuffer):
+        * tests/stress/typedarray-subarray.js: Added.
+        (subclasses.typedArrays.map):
+        (testSpecies):
+        (forEach):
+        (subclasses.forEach):
+        (testSpeciesRemoveConstructor):
+
+2016-02-26  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add32(Imm, Tmp, Tmp) does not ZDef the destination if Imm is zero
+        https://bugs.webkit.org/show_bug.cgi?id=154704
+
+        Reviewed by Geoffrey Garen.
+
+        If the Imm is zero, we should still zero the top bits
+        to match the definition in AirOpcodes.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        * b3/testb3.cpp:
+
+2016-02-26  Oliver Hunt  <oliver@apple.com>
+
+        Make testRegExp not crash when given an invalid regexp
+        https://bugs.webkit.org/show_bug.cgi?id=154732
+
+        Reviewed by Mark Lam.
+
+        * testRegExp.cpp:
+        (parseRegExpLine):
+
+2016-02-26  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Add the test for r197155
+        https://bugs.webkit.org/show_bug.cgi?id=154715
+
+        Reviewed by Mark Lam.
+
+        Silly me. I forgot the test in the latest patch update.
+
+        * tests/stress/class-syntax-tdz-osr-entry-in-loop.js: Added.
+
+2016-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [DFG] Drop unnecessary proved type branch in ToPrimitive
+        https://bugs.webkit.org/show_bug.cgi?id=154716
+
+        Reviewed by Geoffrey Garen.
+
+        This branching based on the proved types is unnecessary because this is already handled in constant folding phase.
+        In fact, the DFGSpeculativeJIT64.cpp case is already removed in r164243.
+        This patch removes the remaining JIT32_64 case.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2016-02-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Be aggressive with OSR Entry to FTL if the DFG function was only used for OSR Entry itself
+        https://bugs.webkit.org/show_bug.cgi?id=154575
+
+        Reviewed by Filip Pizlo.
+
+        I noticed that imaging-gaussian-blur spends most of its
+        samples in DFG code despite executing most of the loop
+        iterations in FTL.
+
+        On this particular test, the main function is only entered
+        once and have a very heavy loop there. What happens is DFG
+        starts by compiling the full function in FTL. That takes about
+        8 to 10 milliseconds during which the DFG code makes very little
+        progress. The calls to triggerOSREntryNow() try to OSR Enter
+        for a while then finally start compiling something. By the time
+        the function is ready, we have wasted a lot of time in DFG code.
+
+        What this patch does is set a flag when a DFG function is entered.
+        If we try to triggerOSREntryNow() and the flag was never set,
+        we start compiling both the full function and the one for OSR Entry.
+
+        * dfg/DFGJITCode.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileEntryExecutionFlag):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan): Deleted.
+        * dfg/DFGPlan.h:
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+
+2016-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Temporal Dead Zone checks on "this" are eliminated when doing OSR Entry to FTL
+        https://bugs.webkit.org/show_bug.cgi?id=154664
+
+        Reviewed by Saam Barati.
+
+        When doing OSR Enter into a constructor, we lose the information
+        that this may have been set to empty by a previously executed block.
+
+        All the code just assumed the type for a FlushedJS value and thus
+        not an empty value. It was then okay to eliminate the TDZ checks.
+
+        In this patch, the values on root entry now assume they may be empty.
+        As a result, the SetArgument() for "this" has "empty" as possible
+        type and the TDZ checks are no longer eliminated.
+
+        * dfg/DFGInPlaceAbstractState.cpp:
+        (JSC::DFG::InPlaceAbstractState::initialize):
+
+2016-02-25  Ada Chan  <adachan@apple.com>
+
+        Update the definition of ENABLE_VIDEO_PRESENTATION_MODE for Mac platform
+        https://bugs.webkit.org/show_bug.cgi?id=154702
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-02-25  Saam barati  <sbarati@apple.com>
+
+        [ES6] for...in iteration doesn't comply with the specification
+        https://bugs.webkit.org/show_bug.cgi?id=154665
+
+        Reviewed by Michael Saboff.
+
+        If you read ForIn/OfHeadEvaluation inside the spec:
+        https://tc39.github.io/ecma262/#sec-runtime-semantics-forin-div-ofheadevaluation-tdznames-expr-iterationkind
+        It calls EnumerateObjectProperties(obj) to get a set of properties
+        to enumerate over (it models this "set" as en ES6 generator function).
+        EnumerateObjectProperties is defined in section 13.7.5.15:
+        https://tc39.github.io/ecma262/#sec-enumerate-object-properties
+        The implementation calls Reflect.getOwnPropertyDescriptor(.) on the
+        properties it sees. We must do the same by modeling the operation as
+        a [[GetOwnProperty]] instead of a [[HasProperty]] internal method call.
+
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasProperty):
+        (JSC::JSObject::hasPropertyGeneric):
+        * runtime/JSObject.h:
+        * tests/stress/proxy-get-own-property.js:
+        (assert):
+        (let.handler.getOwnPropertyDescriptor):
+        (i.set assert):
+
+2016-02-25  Saam barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[Set]]
+        https://bugs.webkit.org/show_bug.cgi?id=154511
+
+        Reviewed by Filip Pizlo.
+
+        This patch is mostly an implementation of
+        Proxy.[[Set]] with respect to section 9.5.9
+        of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver
+
+        This patch also changes JSObject::putInline and JSObject::putByIndex
+        to be aware that a Proxy in the prototype chain will intercept
+        property accesses.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
+        * runtime/JSObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::canPerformFastPutInline):
+        (JSC::JSObject::putInline):
+        * runtime/JSType.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotByIndex):
+        (JSC::ProxyObject::performPut):
+        (JSC::ProxyObject::put):
+        (JSC::ProxyObject::putByIndexCommon):
+        (JSC::ProxyObject::putByIndex):
+        (JSC::performProxyCall):
+        (JSC::ProxyObject::getCallData):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::deletePropertyByIndex):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        (JSC::ProxyObject::create):
+        (JSC::ProxyObject::createStructure):
+        (JSC::ProxyObject::target):
+        (JSC::ProxyObject::handler):
+        * tests/es6.yaml:
+        * tests/stress/proxy-set.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.set 45):
+        (throw.new.Error):
+        (let.target.set x):
+        (let.target.get x):
+        (set let):
+
+2016-02-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove a useless "Move" in the lowering of Select
+        https://bugs.webkit.org/show_bug.cgi?id=154670
+
+        Reviewed by Geoffrey Garen.
+
+        I left the Move instruction when creating the aliasing form
+        of Select.
+
+        On ARM64, that meant a useless move for any case that can't
+        be coalesced.
+
+        On x86, that meant an extra constraint on child2, making it
+        stupidly hard to alias child1.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createSelect): Deleted.
+
+2016-02-24  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Expose Proxy target and handler internal properties to Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=154663
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        Expose the ProxyObject's target and handler.
+
+2016-02-24  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>
+
+        [web-animations] Add AnimationTimeline, DocumentTimeline and add extensions to Document interface
+        https://bugs.webkit.org/show_bug.cgi?id=151688
+
+        Reviewed by Dean Jackson.
+
+        Enables the WEB_ANIMATIONS compiler switch.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-02-24  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
+        https://bugs.webkit.org/show_bug.cgi?id=154651
+
+        Reviewed by Alex Christensen.
+
+        * CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.
+
+2016-02-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r197033.
+        https://bugs.webkit.org/show_bug.cgi?id=154649
+
+        "It broke JSC tests when 'this' was loaded from global scope"
+        (Requested by saamyjoon on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Arrow function syntax. Emit loading&putting this/super
+        only if they are used in arrow function"
+        https://bugs.webkit.org/show_bug.cgi?id=153981
+        http://trac.webkit.org/changeset/197033
+
+2016-02-24  Saam Barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[Delete]]
+        https://bugs.webkit.org/show_bug.cgi?id=154607
+
+        Reviewed by Mark Lam.
+
+        This patch implements Proxy.[[Delete]] with respect to section 9.5.10 of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-delete-p
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getConstructData):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::deleteProperty):
+        (JSC::ProxyObject::deletePropertyByIndex):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-delete.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.get deleteProperty):
+        (throw.new.Error):
+        (assert.let.handler.deleteProperty):
+        (let.handler.deleteProperty):
+
+2016-02-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Stackmaps have problems with double register constraints
+        https://bugs.webkit.org/show_bug.cgi?id=154643
+
+        Reviewed by Geoffrey Garen.
+
+        This is currently a benign bug. I found it while playing.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        * b3/testb3.cpp:
+        (JSC::B3::testURShiftSelf64):
+        (JSC::B3::testPatchpointDoubleRegs):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+
+2016-02-24  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Emit loading&putting this/super only if they are used in arrow function
+        https://bugs.webkit.org/show_bug.cgi?id=153981
+
+        Reviewed by Saam Barati.
+       
+        In first iteration of implemenation arrow function, we emit load and store variables 'this', 'arguments',
+        'super', 'new.target' in case if arrow function is exist even variables are not used in arrow function. 
+        Current patch added logic that prevent from emiting those varibles if they are not used in arrow function.
+        During syntax analyze parser store information about using variables in arrow function inside of 
+        the ordinary function scope and then put to BytecodeGenerator through UnlinkedCodeBlock
+
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::arrowFunctionCodeFeatures):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::arrowFunctionCodeFeatures):
+        (JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseArguments):
+        (JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseSuperCall):
+        (JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseSuperProperty):
+        (JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseEval):
+        (JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseThis):
+        (JSC::UnlinkedCodeBlock::doAnyInnerArrowFunctionsUseNewTarget):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::isThisUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isArgumentsUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isNewTargetUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::isSuperUsedInInnerArrowFunction):
+        (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionMetadata):
+        * parser/Nodes.cpp:
+        (JSC::FunctionMetadataNode::FunctionMetadataNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::isArrowFunctionBoundary):
+        (JSC::Scope::innerArrowFunctionFeatures):
+        (JSC::Scope::setInnerArrowFunctionUseSuperCall):
+        (JSC::Scope::setInnerArrowFunctionUseSuperProperty):
+        (JSC::Scope::setInnerArrowFunctionUseEval):
+        (JSC::Scope::setInnerArrowFunctionUseThis):
+        (JSC::Scope::setInnerArrowFunctionUseNewTarget):
+        (JSC::Scope::setInnerArrowFunctionUseArguments):
+        (JSC::Scope::setInnerArrowFunctionUseEvalAndUseArgumentsIfNeeded):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::mergeInnerArrowFunctionFeatures):
+        (JSC::Scope::fillParametersForSourceProviderCache):
+        (JSC::Scope::restoreFromSourceProviderCache):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::setIsArrowFunction):
+        (JSC::Parser::closestParentNonArrowFunctionNonLexicalScope):
+        (JSC::Parser::pushScope):
+        (JSC::Parser::popScopeInternal):
+        * parser/ParserModes.h:
+        * parser/SourceProviderCacheItem.h:
+        (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        * tests/stress/arrowfunction-lexical-bind-arguments-non-strict-1.js:
+        * tests/stress/arrowfunction-lexical-bind-arguments-strict.js:
+        * tests/stress/arrowfunction-lexical-bind-newtarget.js:
+        * tests/stress/arrowfunction-lexical-bind-superproperty.js:
+        * tests/stress/arrowfunction-lexical-bind-this-8.js: Added.
+
+2016-02-23  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: teach the Objective-C protocol generators about --frontend and --backend directives
+        https://bugs.webkit.org/show_bug.cgi?id=154615
+        <rdar://problem/24804330>
+
+        Reviewed by Timothy Hatcher.
+
+        Some of the generated Objective-C bindings are only relevant to code acting as the
+        protocol backend. Add a per-generator setting mechanism and propagate --frontend and
+        --backend to all generators. Use the setting in a few generators to omit code that's
+        not needed.
+
+        Also fix a few places where the code emits the wrong Objective-C class prefix.
+        There is some common non-generated code that must always have the RWIProtocol prefix.
+
+        Lastly, change includes to use RWIProtocolJSONObjectPrivate.h instead of *Internal.h. The
+        macros defined in the internal header now need to be used outside of the framework.
+
+        * inspector/scripts/codegen/generate_objc_conversion_helpers.py:
+        Use OBJC_STATIC_PREFIX along with the file name and use different include syntax
+        depending on the target framework.
+
+        * inspector/scripts/codegen/generate_objc_header.py:
+        (ObjCHeaderGenerator.generate_output):
+        For now, omit generating command protocol and event dispatchers when generating for --frontend.
+
+        (ObjCHeaderGenerator._generate_type_interface):
+        Use OBJC_STATIC_PREFIX along with the unprefixed file name.
+
+        * inspector/scripts/codegen/generate_objc_internal_header.py:
+        Use RWIProtocolJSONObjectPrivate.h instead.
+
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator.generate_output):
+        Include the Internal header if it's being generated (only for --backend).
+
+        * inspector/scripts/codegen/generator.py:
+        (Generator.__init__):
+        (Generator.set_generator_setting):
+        (Generator):
+        (Generator.get_generator_setting):
+        Crib a simple setting system from the Framework class. Make the names more obnoxious.
+
+        (Generator.string_for_file_include):
+        Inspired by the replay input generator, this is a function that uses the proper syntax
+        for a file include depending on the file's framework and target framework.
+
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCGenerator.and):
+        (ObjCGenerator.and.objc_prefix):
+        (ObjCGenerator):
+        (ObjCGenerator.objc_type_for_raw_name):
+        (ObjCGenerator.objc_class_for_raw_name):
+        Whitelist the 'Automation' domain for the ObjC generators. Revise use of OBJC_STATIC_PREFIX.
+
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        (generate_from_specification):
+        Change the generators to use for the frontend. Propagate --frontend and --backend.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        Rebaseline tests. They now correctly include RWIProtocolJSONObject.h and the like.
+
+2016-02-23  Saam barati  <sbarati@apple.com>
+
+        arrayProtoFuncConcat doesn't check for an exception after allocating an array
+        https://bugs.webkit.org/show_bug.cgi?id=154621
+
+        Reviewed by Michael Saboff.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+
+2016-02-23  Dan Bernstein  <mitz@apple.com>
+
+        [Xcode] Linker errors display mangled names, but no longer should
+        https://bugs.webkit.org/show_bug.cgi?id=154632
+
+        Reviewed by Sam Weinig.
+
+        * Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.
+
+2016-02-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Remove HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define
+        https://bugs.webkit.org/show_bug.cgi?id=112323
+
+        Reviewed by Chris Dumez.
+
+        This feature is controlled by a runtime switch, and defaults off.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-02-23  Keith Miller  <keith_miller@apple.com>
+
+        JSC stress tests' standalone-pre.js should exit on the first failure by default
+        https://bugs.webkit.org/show_bug.cgi?id=154565
+
+        Reviewed by Mark Lam.
+
+        Currently, if a test writer does not call finishJSTest() at the end of
+        any test using stress/resources/standalone-pre.js then the test can fail
+        without actually reporting an error to the harness. By default, we
+        should throw on the first error so, in the event someone does not call
+        finishJSTest() the harness will still notice the error.
+
+        * tests/stress/regress-151324.js:
+        * tests/stress/resources/standalone-pre.js:
+        (testFailed):
+
+2016-02-23  Saam barati  <sbarati@apple.com>
+
+        Make JSObject::getMethod have fewer branches
+        https://bugs.webkit.org/show_bug.cgi?id=154603
+
+        Reviewed by Mark Lam.
+
+        Writing code with fewer branches is almost always better.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getMethod):
+
+2016-02-23  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::Value doesn't self-destruct virtually enough (Causes many leaks in LowerDFGToB3::appendOSRExit)
+        https://bugs.webkit.org/show_bug.cgi?id=154592
+
+        Reviewed by Saam Barati.
+
+        If Foo has a virtual destructor, then:
+
+        foo->Foo::~Foo() does a non-virtual call to Foo's destructor. Even if foo points to a
+        subclass of Foo that overrides the destructor, this syntax will not call that override.
+
+        foo->~Foo() does a virtual call to the destructor, and so if foo points to a subclass, you
+        get the subclass's override.
+
+        In B3, we used this->Value::~Value() thinking that it would call the subclass's override.
+        This caused leaks because this didn't actually call the subclass's override. This fixes the
+        problem by using this->~Value() instead.
+
+        * b3/B3ControlValue.cpp:
+        (JSC::B3::ControlValue::convertToJump):
+        (JSC::B3::ControlValue::convertToOops):
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::replaceWithIdentity):
+        (JSC::B3::Value::replaceWithNop):
+        (JSC::B3::Value::replaceWithPhi):
+
+2016-02-23  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: the protocol generator's Objective-C name prefix should be configurable
+        https://bugs.webkit.org/show_bug.cgi?id=154596
+        <rdar://problem/24794962>
+
+        Reviewed by Timothy Hatcher.
+
+        In order to support different generated protocol sets that don't have conflicting
+        file and type names, allow the Objective-C prefix to be configurable based on the
+        target framework. Each name also has the implicit prefix 'Protocol' appended to the
+        per-target framework prefix.
+
+        For example, the existing protocol for remote inspection has the prefix 'RWI'
+        and is generated as 'RWIProtocol'. The WebKit framework has the 'Automation' prefix
+        and is generated as 'AutomationProtocol'.
+
+        To make this change, convert ObjCGenerator to be a subclass of Generator and use
+        the instance method model() to find the target framework and its setting for
+        'objc_prefix'. Make all ObjC generators subclass ObjCGenerator so they can use
+        these instance methods that used to be static methods. This is a large but
+        mechanical change to use self instead of ObjCGenerator.
+
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
+        (ObjCBackendDispatcherHeaderGenerator):
+        (ObjCBackendDispatcherHeaderGenerator.__init__):
+        (ObjCBackendDispatcherHeaderGenerator.output_filename):
+        (ObjCBackendDispatcherHeaderGenerator._generate_objc_forward_declarations):
+        (ObjCBackendDispatcherHeaderGenerator._generate_objc_handler_declarations_for_domain):
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator):
+        (ObjCConfigurationImplementationGenerator.__init__):
+        (ObjCConfigurationImplementationGenerator.output_filename):
+        (ObjCConfigurationImplementationGenerator.generate_output):
+        (ObjCConfigurationImplementationGenerator._generate_success_block_for_command):
+        (ObjCConfigurationImplementationGenerator._generate_success_block_for_command.and):
+        (ObjCConfigurationImplementationGenerator._generate_conversions_for_command):
+        * inspector/scripts/codegen/generate_objc_configuration_header.py:
+        (ObjCConfigurationHeaderGenerator):
+        (ObjCConfigurationHeaderGenerator.__init__):
+        (ObjCConfigurationHeaderGenerator.output_filename):
+        (ObjCConfigurationHeaderGenerator.generate_output):
+        (ObjCConfigurationHeaderGenerator._generate_configuration_interface_for_domains):
+        (ObjCConfigurationHeaderGenerator._generate_properties_for_domain):
+        * inspector/scripts/codegen/generate_objc_configuration_implementation.py:
+        (ObjCBackendDispatcherImplementationGenerator):
+        (ObjCBackendDispatcherImplementationGenerator.__init__):
+        (ObjCBackendDispatcherImplementationGenerator.output_filename):
+        (ObjCBackendDispatcherImplementationGenerator.generate_output):
+        (ObjCBackendDispatcherImplementationGenerator._generate_configuration_implementation_for_domains):
+        (ObjCBackendDispatcherImplementationGenerator._generate_ivars):
+        (ObjCBackendDispatcherImplementationGenerator._generate_handler_setter_for_domain):
+        (ObjCBackendDispatcherImplementationGenerator._generate_event_dispatcher_getter_for_domain):
+        * inspector/scripts/codegen/generate_objc_conversion_helpers.py:
+        (ObjCConversionHelpersGenerator):
+        (ObjCConversionHelpersGenerator.__init__):
+        (ObjCConversionHelpersGenerator.output_filename):
+        (ObjCConversionHelpersGenerator.generate_output):
+        (ObjCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_declaration):
+        (ObjCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_member):
+        (ObjCConversionHelpersGenerator._generate_anonymous_enum_conversion_for_parameter):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator):
+        (ObjCFrontendDispatcherImplementationGenerator.__init__):
+        (ObjCFrontendDispatcherImplementationGenerator.output_filename):
+        (ObjCFrontendDispatcherImplementationGenerator.generate_output):
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event_dispatcher_implementations):
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event):
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event.and):
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event_signature):
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event_out_parameters):
+        * inspector/scripts/codegen/generate_objc_header.py:
+        (ObjCHeaderGenerator):
+        (ObjCHeaderGenerator.__init__):
+        (ObjCHeaderGenerator.output_filename):
+        (ObjCHeaderGenerator.generate_output):
+        (ObjCHeaderGenerator._generate_forward_declarations):
+        (ObjCHeaderGenerator._generate_anonymous_enum_for_declaration):
+        (ObjCHeaderGenerator._generate_anonymous_enum_for_member):
+        (ObjCHeaderGenerator._generate_anonymous_enum_for_parameter):
+        (ObjCHeaderGenerator._generate_type_interface):
+        (ObjCHeaderGenerator._generate_init_method_for_required_members):
+        (ObjCHeaderGenerator._generate_member_property):
+        (ObjCHeaderGenerator._generate_command_protocols):
+        (ObjCHeaderGenerator._generate_single_command_protocol):
+        (ObjCHeaderGenerator._callback_block_for_command):
+        (ObjCHeaderGenerator._generate_event_interfaces):
+        (ObjCHeaderGenerator._generate_single_event_interface):
+        * inspector/scripts/codegen/generate_objc_internal_header.py:
+        (ObjCInternalHeaderGenerator):
+        (ObjCInternalHeaderGenerator.__init__):
+        (ObjCInternalHeaderGenerator.output_filename):
+        (ObjCInternalHeaderGenerator.generate_output):
+        (ObjCInternalHeaderGenerator._generate_event_dispatcher_private_interfaces):
+        * inspector/scripts/codegen/generate_objc_protocol_types_implementation.py:
+        (ObjCProtocolTypesImplementationGenerator):
+        (ObjCProtocolTypesImplementationGenerator.__init__):
+        (ObjCProtocolTypesImplementationGenerator.output_filename):
+        (ObjCProtocolTypesImplementationGenerator.generate_output):
+        (ObjCProtocolTypesImplementationGenerator.generate_type_implementation):
+        (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members):
+        (ObjCProtocolTypesImplementationGenerator._generate_init_method_for_required_members.and):
+        (ObjCProtocolTypesImplementationGenerator._generate_setter_for_member):
+        (ObjCProtocolTypesImplementationGenerator._generate_setter_for_member.and):
+        (ObjCProtocolTypesImplementationGenerator._generate_getter_for_member):
+        * inspector/scripts/codegen/models.py:
+        * inspector/scripts/codegen/objc_generator.py:
+        (ObjCTypeCategory.category_for_type):
+        (ObjCGenerator):
+        (ObjCGenerator.__init__):
+        (ObjCGenerator.objc_prefix):
+        (ObjCGenerator.objc_name_for_type):
+        (ObjCGenerator.objc_enum_name_for_anonymous_enum_declaration):
+        (ObjCGenerator.objc_enum_name_for_anonymous_enum_member):
+        (ObjCGenerator.objc_enum_name_for_anonymous_enum_parameter):
+        (ObjCGenerator.objc_enum_name_for_non_anonymous_enum):
+        (ObjCGenerator.objc_class_for_type):
+        (ObjCGenerator.objc_class_for_array_type):
+        (ObjCGenerator.objc_accessor_type_for_member):
+        (ObjCGenerator.objc_accessor_type_for_member_internal):
+        (ObjCGenerator.objc_type_for_member):
+        (ObjCGenerator.objc_type_for_member_internal):
+        (ObjCGenerator.objc_type_for_param):
+        (ObjCGenerator.objc_type_for_param_internal):
+        (ObjCGenerator.objc_protocol_export_expression_for_variable):
+        (ObjCGenerator.objc_protocol_import_expression_for_member):
+        (ObjCGenerator.objc_protocol_import_expression_for_parameter):
+        (ObjCGenerator.objc_protocol_import_expression_for_variable):
+        (ObjCGenerator.objc_to_protocol_expression_for_member):
+        (ObjCGenerator.protocol_to_objc_expression_for_member):
+
+        Change the prefix for the 'Test' target framework to be 'Test.' Rebaseline results.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-02-23  Mark Lam  <mark.lam@apple.com>
+
+        Debug assertion failure while loading http://kangax.github.io/compat-table/es6/.
+        https://bugs.webkit.org/show_bug.cgi?id=154542
+
+        Reviewed by Saam Barati.
+
+        According to the spec, the constructors of the following types "are not intended
+        to be called as a function and will throw an exception".  These types are:
+            TypedArrays - https://tc39.github.io/ecma262/#sec-typedarray-constructors
+            Map - https://tc39.github.io/ecma262/#sec-map-constructor
+            Set - https://tc39.github.io/ecma262/#sec-set-constructor
+            WeakMap - https://tc39.github.io/ecma262/#sec-weakmap-constructor
+            WeakSet - https://tc39.github.io/ecma262/#sec-weakset-constructor
+            ArrayBuffer - https://tc39.github.io/ecma262/#sec-arraybuffer-constructor
+            DataView - https://tc39.github.io/ecma262/#sec-dataview-constructor
+            Promise - https://tc39.github.io/ecma262/#sec-promise-constructor
+            Proxy - https://tc39.github.io/ecma262/#sec-proxy-constructor
+
+        This patch does the foillowing:
+        1. Ensures that these constructors can be called but will throw a TypeError
+           when called.
+        2. Makes all these objects use throwConstructorCannotBeCalledAsFunctionTypeError()
+           in their implementation to be consistent.
+        3. Change the error message to "calling XXX constructor without new is invalid".
+           This is clearer because the error is likely due to the user forgetting to use
+           the new operator on these constructors.
+
+        * runtime/Error.h:
+        * runtime/Error.cpp:
+        (JSC::throwConstructorCannotBeCalledAsFunctionTypeError):
+        - Added a convenience function to throw the TypeError.
+
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        (JSC::callArrayBuffer):
+        (JSC::JSArrayBufferConstructor::getCallData):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::callGenericTypedArrayView):
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::getCallData):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::callPromise):
+        * runtime/MapConstructor.cpp:
+        (JSC::callMap):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::callProxy):
+        (JSC::ProxyConstructor::getCallData):
+        * runtime/SetConstructor.cpp:
+        (JSC::callSet):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::callWeakMap):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::callWeakSet):
+
+        * tests/es6.yaml:
+        - The typed_arrays_%TypedArray%[Symbol.species].js test now passes.
+
+        * tests/stress/call-non-calleable-constructors-as-function.js: Added.
+        (test):
+
+        * tests/stress/map-constructor.js:
+        (testCallTypeError):
+        * tests/stress/promise-cannot-be-called.js:
+        (shouldThrow):
+        * tests/stress/proxy-basic.js:
+        * tests/stress/set-constructor.js:
+        * tests/stress/throw-from-ftl-call-ic-slow-path-cells.js:
+        (i.catch):
+        * tests/stress/throw-from-ftl-call-ic-slow-path-undefined.js:
+        (i.catch):
+        * tests/stress/throw-from-ftl-call-ic-slow-path.js:
+        (i.catch):
+        * tests/stress/weak-map-constructor.js:
+        (testCallTypeError):
+        * tests/stress/weak-set-constructor.js:
+        - Updated error message string.
+
+2016-02-23  Alexey Proskuryakov  <ap@apple.com>
+
+        ASan build fix.
+
+        Let's not export a template function that is only used in InspectorBackendDispatcher.cpp.
+
+        * inspector/InspectorBackendDispatcher.h:
+
+2016-02-23  Brian Burg  <bburg@apple.com>
+
+        Connect WebAutomationSession to its backend dispatcher as if it were an agent and add stub implementations
+        https://bugs.webkit.org/show_bug.cgi?id=154518
+        <rdar://problem/24761096>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InspectorBackendDispatcher.h:
+        Export all the classes since they are used by WebKit::WebAutomationSession.
+
+2016-02-22  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: add 'Automation' protocol domain and generate its backend classes separately in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=154509
+        <rdar://problem/24759098>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new 'WebKit' framework, which is used to generate protocol code
+        in WebKit2.
+
+        Add --backend and --frontend flags to the main generator script.
+        These allow a framework to trigger two different sets of generators
+        so they can be separately generated and compiled.
+
+        * inspector/scripts/codegen/models.py:
+        (Framework.fromString):
+        (Frameworks): Add new framework.
+
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        If neither --backend or --frontend is specified, assume both are wanted.
+        This matches the behavior for JavaScriptCore and WebInspector frameworks.
+
+        (generate_from_specification):
+        Generate C++ files for the backend and Objective-C files for the frontend.
+
+2016-02-22  Saam barati  <sbarati@apple.com>
+
+        JSGlobalObject doesn't visit ProxyObjectStructure during GC
+        https://bugs.webkit.org/show_bug.cgi?id=154564
+
+        Rubber stamped by Mark Lam.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::visitChildren):
+
+2016-02-22  Saam barati  <sbarati@apple.com>
+
+        InternalFunction::createSubclassStructure doesn't take into account that get() might throw
+        https://bugs.webkit.org/show_bug.cgi?id=154548
+
+        Reviewed by Mark Lam and Geoffrey Garen and Andreas Kling.
+
+        InternalFunction::createSubclassStructure calls newTarget.get(...) which can throw 
+        an exception. Neither the function nor the call sites of the function took this into
+        account. This patch audits the call sites of the function to make it work in
+        the event that an exception is thrown.
+
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructWithBooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSGlobalObject.h:
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        (JSC::constructArrayNegativeIndexed):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::getRegExpStructure):
+        (JSC::constructRegExp):
+        (JSC::constructWithRegExpConstructor):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        (JSC::StringConstructor::getConstructData):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::constructWeakSet):
+        * tests/stress/create-subclass-structure-might-throw.js: Added.
+        (assert):
+
+2016-02-22  Ting-Wei Lan  <lantw44@gmail.com>
+
+        Fix build and implement functions to retrieve registers on FreeBSD
+        https://bugs.webkit.org/show_bug.cgi?id=152258
+
+        Reviewed by Michael Catanzaro.
+
+        * heap/MachineStackMarker.cpp:
+        (pthreadSignalHandlerSuspendResume):
+        struct ucontext is not specified in POSIX and it is not available on
+        FreeBSD. Replacing it with ucontext_t fixes the build problem.
+        (JSC::MachineThreads::Thread::Registers::stackPointer):
+        (JSC::MachineThreads::Thread::Registers::framePointer):
+        (JSC::MachineThreads::Thread::Registers::instructionPointer):
+        (JSC::MachineThreads::Thread::Registers::llintPC):
+        * heap/MachineStackMarker.h:
+
+2016-02-22  Saam barati  <sbarati@apple.com>
+
+        JSValue::isConstructor and JSValue::isFunction should check getConstructData and getCallData
+        https://bugs.webkit.org/show_bug.cgi?id=154552
+
+        Reviewed by Mark Lam.
+
+        ES6 Proxy breaks our isFunction() and isConstructor() JSValue methods.
+        They return false on a Proxy with internal [[Call]] and [[Construct]]
+        properties. It seems safest, most forward looking, and most adherent
+        to the specification to check getCallData() and getConstructData() to
+        implement these functions.
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::isFunction):
+        (JSC::JSValue::isConstructor):
+
+2016-02-22  Keith Miller  <keith_miller@apple.com>
+
+        Bound functions should use the prototype of the function being bound
+        https://bugs.webkit.org/show_bug.cgi?id=154195
+
+        Reviewed by Geoffrey Garen.
+
+        Per ES6, the result of Function.prototype.bind should have the same
+        prototype as the the function being bound. In order to avoid creating
+        a new structure each time a function is bound we store the new
+        structure in our structure map. However, we cannot currently store
+        structures that have a different GlobalObject than their prototype.
+        In the rare case that the GlobalObject differs or the prototype of
+        the bindee is null we create a new structure each time. To further
+        minimize new structures, as well as making structure lookup faster,
+        we also store the structure in the RareData of the function we
+        are binding.
+
+        * runtime/FunctionRareData.cpp:
+        (JSC::FunctionRareData::visitChildren):
+        * runtime/FunctionRareData.h:
+        (JSC::FunctionRareData::getBoundFunctionStructure):
+        (JSC::FunctionRareData::setBoundFunctionStructure):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::getBoundFunctionStructure):
+        (JSC::JSBoundFunction::create):
+        * tests/es6.yaml:
+        * tests/stress/bound-function-uses-prototype.js: Added.
+        (testChangeProto.foo):
+        (testChangeProto):
+        (testBuiltins):
+        * tests/stress/class-subclassing-function.js:
+
+2016-02-22  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed, fix stress test to not print on success.
+
+        * tests/stress/call-apply-builtin-functions-dont-use-iterators.js:
+        (catch): Deleted.
+
+2016-02-22  Keith Miller  <keith_miller@apple.com>
+
+        Use Symbol.species in the builtin TypedArray.prototype functions
+        https://bugs.webkit.org/show_bug.cgi?id=153384
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds the use of species constructors to the TypedArray.prototype map and filter
+        functions. It also adds a new private function typedArrayGetOriginalConstructor that
+        returns the TypedArray constructor used to originally create a TypedArray instance.
+
+        There are no ES6 tests to update for this patch as species creation for these functions is
+        not tested in the compatibility table.
+
+        * builtins/TypedArrayPrototype.js:
+        (map):
+        (filter):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::typedArrayConstructor):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncGetOriginalConstructor):
+        * runtime/JSTypedArrayViewPrototype.h:
+        * tests/stress/typedarray-filter.js:
+        (subclasses.typedArrays.map):
+        (prototype.accept):
+        (testSpecies):
+        (accept):
+        (forEach):
+        (subclasses.forEach):
+        (testSpeciesRemoveConstructor):
+        * tests/stress/typedarray-map.js:
+        (subclasses.typedArrays.map):
+        (prototype.id):
+        (testSpecies):
+        (id):
+        (forEach):
+        (subclasses.forEach):
+        (testSpeciesRemoveConstructor):
+
+2016-02-22  Keith Miller  <keith_miller@apple.com>
+
+        Builtins that should not rely on iteration do.
+        https://bugs.webkit.org/show_bug.cgi?id=154475
+
+        Reviewed by Geoffrey Garen.
+
+        When changing the behavior of varargs calls to use ES6 iterators the
+        call builtin function's use of a varargs call was overlooked. The use
+        of iterators is observable outside the scope of the the call function,
+        thus it must be reimplemented.
+
+        * builtins/FunctionPrototype.js:
+        (call):
+        * tests/stress/call-apply-builtin-functions-dont-use-iterators.js: Added.
+        (test):
+        (addAll):
+        (catch):
+
+2016-02-22  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [JSC shell] Don't put empty arguments array to VM.
+        https://bugs.webkit.org/show_bug.cgi?id=154516
+
+        Reviewed by Geoffrey Garen.
+
+        This allows arrowfunction-lexical-bind-arguments-top-level test to pass
+        in jsc as well as in browser.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+
+2016-02-22  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [cmake] Moved library setup code to WEBKIT_FRAMEWORK macro.
+        https://bugs.webkit.org/show_bug.cgi?id=154450
+
+        Reviewed by Alex Christensen.
+
+        * CMakeLists.txt:
+
+2016-02-22  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196891.
+        https://bugs.webkit.org/show_bug.cgi?id=154539
+
+        it broke Production builds (Requested by brrian on #webkit).
+
+        Reverted changeset:
+
+        "Web Inspector: add 'Automation' protocol domain and generate
+        its backend classes separately in WebKit2"
+        https://bugs.webkit.org/show_bug.cgi?id=154509
+        http://trac.webkit.org/changeset/196891
+
+2016-02-21  Joseph Pecoraro  <pecoraro@apple.com>
+
+        CodeBlock always visits its unlinked code twice
+        https://bugs.webkit.org/show_bug.cgi?id=154494
+
+        Reviewed by Saam Barati.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::visitChildren):
+        The unlinked code is always visited in stronglyVisitStrongReferences.
+
+2016-02-21  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: add 'Automation' protocol domain and generate its backend classes separately in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=154509
+        <rdar://problem/24759098>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new 'WebKit' framework, which is used to generate protocol code
+        in WebKit2.
+
+        Add --backend and --frontend flags to the main generator script.
+        These allow a framework to trigger two different sets of generators
+        so they can be separately generated and compiled.
+
+        * inspector/scripts/codegen/models.py:
+        (Framework.fromString):
+        (Frameworks): Add new framework.
+
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        If neither --backend or --frontend is specified, assume both are wanted.
+        This matches the behavior for JavaScriptCore and WebInspector frameworks.
+
+        (generate_from_specification):
+        Generate C++ files for the backend and Objective-C files for the frontend.
+
+2016-02-21  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Improvements to Intl code
+        https://bugs.webkit.org/show_bug.cgi?id=154486
+
+        Reviewed by Darin Adler.
+
+        This patch does several things:
+        - Use std::unique_ptr to store ICU objects.
+        - Pass Vector::size() to ICU functions that take a buffer size instead
+          of Vector::capacity().
+        - If U_SUCCESS(status) is true, it means there is no error, but there
+          could be warnings. ICU functions ignore warnings. So, there is no need
+          to reset status to U_ZERO_ERROR.
+        - Remove the initialization of the String instance variables of
+          IntlDateTimeFormat. These values are never read and cause unnecessary
+          memory allocation.
+        - Fix coding style.
+        - Some small optimization.
+
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::UCollatorDeleter::operator()):
+        (JSC::IntlCollator::createCollator):
+        (JSC::IntlCollator::compareStrings):
+        (JSC::IntlCollator::~IntlCollator): Deleted.
+        * runtime/IntlCollator.h:
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::UDateFormatDeleter::operator()):
+        (JSC::defaultTimeZone):
+        (JSC::canonicalizeTimeZoneName):
+        (JSC::toDateTimeOptionsAnyDate):
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        (JSC::IntlDateTimeFormat::weekdayString):
+        (JSC::IntlDateTimeFormat::format):
+        (JSC::IntlDateTimeFormat::~IntlDateTimeFormat): Deleted.
+        (JSC::localeData): Deleted.
+        * runtime/IntlDateTimeFormat.h:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        * runtime/IntlObject.cpp:
+        (JSC::numberingSystemsForLocale):
+
+2016-02-21  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        Remove arrowfunction test cases that rely on arguments variable in jsc
+        https://bugs.webkit.org/show_bug.cgi?id=154517
+
+        Reviewed by Yusuke Suzuki.
+
+        Allow to jsc has the same behavior in javascript as browser has
+
+        * tests/stress/arrowfunction-lexical-bind-arguments-non-strict-1.js:
+        * tests/stress/arrowfunction-lexical-bind-arguments-strict.js:
+
+2016-02-21  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: it should be possible to omit generated code guarded by INSPECTOR_ALTERNATE_DISPATCHERS
+        https://bugs.webkit.org/show_bug.cgi?id=154508
+        <rdar://problem/24759077>
+
+        Reviewed by Timothy Hatcher.
+
+        In preparation for being able to generate protocol files for WebKit2,
+        make it possible to not emit generated code that's guarded by
+        ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS). This code is not needed by
+        backend dispatchers generated outside of JavaScriptCore. We can't just
+        define it to 0 for WebKit2, since it's defined to 1 in <wtf/Platform.h>
+        in the configurations where the code is actually used.
+
+        Add a new opt-in Framework configuration option that turns on generating
+        this code. Adjust how the code is generated so that it can be easily excluded.
+
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        Make a separate template for the declarations that are guarded.
+        Add an initializer expression so the order of initalizers doesn't matter.
+
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
+        (CppBackendDispatcherHeaderGenerator.generate_output): Add a setting check.
+        (CppBackendDispatcherHeaderGenerator._generate_dispatcher_declarations_for_domain):
+        If the declarations are needed, they will be appended to the end of the
+        declarations list.
+
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator.generate_output): Add a setting check.
+        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command): Add a setting check.
+
+        * inspector/scripts/codegen/models.py: Set the 'alternate_dispatchers' setting
+        to True for Framework.JavaScriptCore only. It's not needed elsewhere.
+
+        Rebaseline affected tests.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+
+2016-02-21  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: clean up generator selection in generate-inspector-protocol-bindings.py
+        https://bugs.webkit.org/show_bug.cgi?id=154505
+        <rdar://problem/24758042>
+
+        Reviewed by Timothy Hatcher.
+
+        It should be possible to generate code for a framework using some generators
+        that other frameworks also use. Right now the generator selection code assumes
+        that use of a generator is mutually exclusive among non-test frameworks.
+
+        Make this code explicitly switch on the framework. Reorder generators
+        alpabetically within each case.
+
+        * inspector/scripts/generate-inspector-protocol-bindings.py:
+        (generate_from_specification):
+
+        Rebaseline tests that are affected by generator reorderings.
+
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+
+2016-02-19  Saam Barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[Construct]]
+        https://bugs.webkit.org/show_bug.cgi?id=154440
+
+        Reviewed by Oliver Hunt.
+
+        This patch is mostly an implementation of
+        Proxy.[[Construct]] with respect to section 9.5.13
+        of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-construct-argumentslist-newtarget
+
+        This patch also changes op_create_this to accept new.target's
+        that aren't JSFunctions. This is necessary implementing Proxy.[[Construct]] 
+        because we might construct a JSFunction with a new.target being
+        a Proxy. This will also be needed when we implement Reflect.construct.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_this):
+        (JSC::JIT::emitSlow_op_create_this):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::finishCreation):
+        (JSC::ProxyObject::visitChildren):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::getConstructData):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-construct.js: Added.
+        (assert):
+        (throw.new.Error.let.target):
+        (throw.new.Error):
+        (assert.let.target):
+        (assert.let.handler.get construct):
+        (let.target):
+        (let.handler.construct):
+        (i.catch):
+        (assert.let.handler.construct):
+        (assert.let.construct):
+        (assert.else.assert.let.target):
+        (assert.else.assert.let.construct):
+        (assert.else.assert):
+        (new.proxy.let.target):
+        (new.proxy.let.construct):
+        (new.proxy):
+
+2016-02-19  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        [INTL] Implement Number Format Functions
+        https://bugs.webkit.org/show_bug.cgi?id=147605
+
+        Reviewed by Darin Adler.
+
+        This patch implements Intl.NumberFormat.prototype.format() according
+        to the ECMAScript 2015 Internationalization API spec (ECMA-402 2nd edition.)
+
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::UNumberFormatDeleter::operator()):
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        (JSC::IntlNumberFormat::createNumberFormat):
+        (JSC::IntlNumberFormat::formatNumber):
+        (JSC::IntlNumberFormatFuncFormatNumber): Deleted.
+        * runtime/IntlNumberFormat.h:
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatFuncFormatNumber):
+
+2016-02-18  Gavin Barraclough  <barraclough@apple.com>
+
+        JSObject::getPropertySlot - index-as-propertyname, override on prototype, & shadow
+        https://bugs.webkit.org/show_bug.cgi?id=154416
+
+        Reviewed by Geoff Garen.
+
+        Here's the bug. Suppose you call JSObject::getOwnProperty and -
+          - PropertyName contains an index,
+          - An object on the prototype chain overrides getOwnPropertySlot, and has that index property,
+          - The base of the access (or another object on the prototype chain) shadows that property.
+
+        JSObject::getPropertySlot is written assuming the common case is that propertyName is not an
+        index, and as such walks up the prototype chain looking for non-index properties before it
+        tries calling parseIndex.
+
+        At the point we reach an object on the prototype chain overriding getOwnPropertySlot (which
+        would potentially return the property) we may have already skipped over non-overriding
+        objects that contain the property in index storage.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnNonIndexPropertySlot):
+            - renamed from inlineGetOwnPropertySlot to better describe behaviour;
+              added ASSERT guarding that this method never returns index properties -
+              if it ever does, this is unsafe for getPropertySlot.
+        (JSC::JSObject::getOwnPropertySlot):
+            - inlineGetOwnPropertySlot -> getOwnNonIndexPropertySlot.
+        (JSC::JSObject::getPropertySlot):
+            - In case of object overriding getOwnPropertySlot check if propertyName is an index.
+        (JSC::JSObject::getNonIndexPropertySlot):
+            - called by getPropertySlot if we encounter an object that overrides getOwnPropertySlot,
+              in order to avoid repeated calls to parseIndex.
+        (JSC::JSObject::inlineGetOwnPropertySlot): Deleted.
+            - this was renamed to getOwnNonIndexPropertySlot.
+        (JSC::JSObject::fastGetOwnPropertySlot): Deleted.
+            - this was folded back in to getPropertySlot.
+
+2016-02-19  Saam Barati  <sbarati@apple.com>
+
+        [ES6] Implement Proxy.[[Call]]
+        https://bugs.webkit.org/show_bug.cgi?id=154425
+
+        Reviewed by Mark Lam.
+
+        This patch is a straight forward implementation of
+        Proxy.[[Call]] with respect to section 9.5.12
+        of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-call-thisargument-argumentslist
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::finishCreation):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::getOwnPropertySlotByIndex):
+        (JSC::performProxyCall):
+        (JSC::ProxyObject::getCallData):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        (JSC::ProxyObject::create):
+        * tests/es6.yaml:
+        * tests/stress/proxy-call.js: Added.
+        (assert):
+        (throw.new.Error.let.target):
+        (throw.new.Error.let.handler.apply):
+        (throw.new.Error):
+        (assert.let.target):
+        (assert.let.handler.get apply):
+        (let.target):
+        (let.handler.apply):
+        (i.catch):
+        (assert.let.handler.apply):
+
+2016-02-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Remove more LLVM related dead code after r196729
+        https://bugs.webkit.org/show_bug.cgi?id=154387
+
+        Reviewed by Filip Pizlo.
+
+        * Configurations/CompileRuntimeToLLVMIR.xcconfig: Removed.
+        * Configurations/LLVMForJSC.xcconfig: Removed.
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.props: Removed.
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj: Removed.
+        * JavaScriptCore.vcxproj/libllvmForJSC/libllvmForJSC.vcxproj.filters: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * disassembler/X86Disassembler.cpp:
+
+2016-02-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Add isJSString(JSCell*) variant to avoid Cell->JSValue->Cell conversion
+        https://bugs.webkit.org/show_bug.cgi?id=154442
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSString.h:
+        (JSC::isJSString):
+
+2016-02-19  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remove unused SymbolTable::createNameScopeTable
+        https://bugs.webkit.org/show_bug.cgi?id=154443
+
+        Reviewed by Saam Barati.
+
+        * runtime/SymbolTable.h:
+
+2016-02-18  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve the instruction selection of Select
+        https://bugs.webkit.org/show_bug.cgi?id=154432
+
+        Reviewed by Filip Pizlo.
+
+        Plenty of code but this patch is pretty dumb:
+        -On ARM64: use the 3 operand form of CSEL instead of forcing a source
+         to be alised to the destination. This gives more freedom to the register
+         allocator and it is one less Move to process per Select.
+        -On x86, introduce a fake 3 operands form and use aggressive aliasing
+         to try to alias both sources to the destination.
+
+         If aliasing succeed on the "elseCase", the condition of the Select
+         is reverted in the MacroAssembler.
+
+         If no aliasing is possible and we end up with 3 registers, the missing
+         move instruction is generated by the MacroAssembler.
+
+         The missing move is generated after testing the values because the destination
+         can use the same register as one of the test operand.
+         Experimental testing seems to indicate there is no macro-fusion on CMOV,
+         there is no measurable cost to having the move there.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::isInvertible):
+        (JSC::MacroAssembler::invert):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::moveConditionallyDouble):
+        (JSC::MacroAssemblerARM64::moveConditionallyFloat):
+        (JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
+        (JSC::MacroAssemblerARM64::moveConditionally32):
+        (JSC::MacroAssemblerARM64::moveConditionally64):
+        (JSC::MacroAssemblerARM64::moveConditionallyTest32):
+        (JSC::MacroAssemblerARM64::moveConditionallyTest64):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::moveConditionallyDouble):
+        (JSC::MacroAssemblerX86Common::moveConditionallyFloat):
+        (JSC::MacroAssemblerX86Common::moveConditionally32):
+        (JSC::MacroAssemblerX86Common::moveConditionallyTest32):
+        (JSC::MacroAssemblerX86Common::invert):
+        (JSC::MacroAssemblerX86Common::isInvertible):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::moveConditionally64):
+        (JSC::MacroAssemblerX86_64::moveConditionallyTest64):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createSelect):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::shouldTryAliasingDef):
+        * b3/air/AirOpcode.opcodes:
+
+2016-02-18  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
+
+        [CMake][GTK] Clean up llvm guard in PlatformGTK.cmake
+        https://bugs.webkit.org/show_bug.cgi?id=154430
+
+        Reviewed by Saam Barati.
+
+        llvm isn't used anymore.
+
+        * PlatformGTK.cmake: Remove USE_LLVM_DISASSEMBLER guard.
+
+2016-02-18  Saam Barati  <sbarati@apple.com>
+
+        Implement Proxy.[[HasProperty]]
+        https://bugs.webkit.org/show_bug.cgi?id=154313
+
+        Reviewed by Filip Pizlo.
+
+        This patch is a straight forward implementation of
+        Proxy.[[HasProperty]] with respect to section 9.5.7
+        of the ECMAScript spec.
+        https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-basic.js:
+        (assert):
+        (let.handler.has):
+        * tests/stress/proxy-has-property.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.get has):
+        (throw.new.Error):
+        (assert.let.handler.has):
+        (let.handler.has):
+        (getOwnPropertyDescriptor):
+        (i.catch):
+
+2016-02-18  Saam Barati  <sbarati@apple.com>
+
+        Proxy's don't properly handle Symbols as PropertyKeys.
+        https://bugs.webkit.org/show_bug.cgi?id=154385
+
+        Reviewed by Mark Lam and Yusuke Suzuki.
+
+        We were converting all PropertyKeys to strings, even when
+        the PropertyName was a Symbol. In the spec, PropertyKeys are
+        either a Symbol or a String. We now respect that in Proxy.[[Get]] and
+        Proxy.[[GetOwnProperty]].
+
+        * runtime/Completion.cpp:
+        (JSC::profiledEvaluate):
+        (JSC::createSymbolForEntryPointModule):
+        (JSC::identifierToJSValue): Deleted.
+        * runtime/Identifier.h:
+        (JSC::parseIndex):
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::fromString):
+        (JSC::identifierToJSValue):
+        (JSC::identifierToSafePublicJSValue):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        * tests/es6.yaml:
+        * tests/stress/proxy-basic.js:
+        (let.handler.getOwnPropertyDescriptor):
+
+2016-02-18  Saam Barati  <sbarati@apple.com>
+
+        Follow up fix to Implement Proxy.[[GetOwnProperty]]
+        https://bugs.webkit.org/show_bug.cgi?id=154314
+
+        Reviewed by Filip Pizlo.
+
+        Part of the implementation was broken because
+        of how JSObject::getOwnPropertyDescriptor worked.
+        I've fixed JSObject::getOwnPropertyDescriptor to
+        be able to handle ProxyObject.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        * tests/stress/proxy-get-own-property.js:
+        (assert):
+        (assert.let.handler.get getOwnPropertyDescriptor):
+
+2016-02-18  Saam Barati  <sbarati@apple.com>
+
+        Implement Proxy.[[GetOwnProperty]]
+        https://bugs.webkit.org/show_bug.cgi?id=154314
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements Proxy.[[GetOwnProperty]].
+        It's a straight forward implementation as described
+        in section 9.5.5 of the specification:
+        http://www.ecma-international.org/ecma-262/6.0/index.html#sec-proxy-object-internal-methods-and-internal-slots-getownproperty-p
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/JSObject.cpp:
+        (JSC::validateAndApplyPropertyDescriptor):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        (JSC::JSObject::defineOwnProperty):
+        (JSC::JSObject::getGenericPropertyNames):
+        (JSC::JSObject::getMethod):
+        * runtime/JSObject.h:
+        (JSC::JSObject::butterflyAddress):
+        (JSC::makeIdentifier):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        (JSC::ProxyObject::getOwnPropertySlot):
+        (JSC::ProxyObject::getOwnPropertySlotByIndex):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h:
+        * tests/es6.yaml:
+        * tests/stress/proxy-basic.js:
+        (let.handler.get null):
+        * tests/stress/proxy-get-own-property.js: Added.
+        (assert):
+        (throw.new.Error.let.handler.getOwnPropertyDescriptor):
+        (throw.new.Error):
+        (let.handler.getOwnPropertyDescriptor):
+        (i.catch):
+        (assert.let.handler.getOwnPropertyDescriptor):
+
+2016-02-18  Andreas Kling  <akling@apple.com>
+
+        JSString resolution of substrings should use StringImpl sharing optimization.
+        <https://webkit.org/b/154068>
+        <rdar://problem/24629358>
+
+        Reviewed by Antti Koivisto.
+
+        When resolving a JSString that's actually a substring of another JSString,
+        use the StringImpl sharing optimization to create a new string pointing into
+        the parent one, instead of copying out the bytes of the string.
+
+        This dramatically reduces peak memory usage on Gerrit diff viewer pages.
+
+        Another approach to this would be to induce GC far more frequently due to
+        the added cost of copying out these substrings. It would reduce the risk
+        of prolonging the life of strings only kept alive by substrings.
+
+        This patch chooses to trade that risk for less GC and lower peak memory.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRope):
+
+2016-02-18  Chris Dumez  <cdumez@apple.com>
+
+        Crash on SES selftest page when loading the page while WebInspector is open
+        https://bugs.webkit.org/show_bug.cgi?id=154378
+        <rdar://problem/24713422>
+
+        Reviewed by Mark Lam.
+
+        Do a partial revert of r196676 so that JSObject::getOwnPropertyDescriptor()
+        returns early again if it detects that getOwnPropertySlot() returns a
+        non-own property. This check was removed in r196676 because we assumed that
+        only JSDOMWindow::getOwnPropertySlot() could return non-own properties.
+        However, as it turns out, DebuggerScope::getOwnPropertySlot() does so as
+        well.
+
+        Not having the check would lead to crashes when using the debugger because
+        we would get a slot with the CustomAccessor attribute but getDirect() would
+        then fail to return the property (because it is not an own property). We
+        would then cast the value returned by getDirect() to a CustomGetterSetter*
+        and dereference it.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+
+2016-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix VS build. I didn't know we still did that, but apparently there's a bot
+        for that.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2016-02-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix CMake build. This got messed up when rebasing.
+
+        * CMakeLists.txt:
+
+2016-02-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(DFG_JIT) build after r195865
+        https://bugs.webkit.org/show_bug.cgi?id=154391
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/SamplingProfiler.cpp:
+        (JSC::tryGetBytecodeIndex):
+
+2016-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove remaining references to LLVM, and make sure comments refer to the backend as "B3" not "LLVM"
+        https://bugs.webkit.org/show_bug.cgi?id=154383
+
+        Reviewed by Saam Barati.
+
+        I did a grep -i llvm of all of our code and did one of the following for each occurence:
+
+        - Renamed it to B3. This is appropriate when we were using "LLVM" to mean "the FTL
+          backend".
+
+        - Removed the reference because I found it to be dead. In some cases it was a dead
+          comment: it was telling us things about what LLVM did and that's just not relevant
+          anymore. In other cases it was dead code that I forgot to delete in a previous patch.
+
+        - Edited the comment in some smart way. There were comments talking about what LLVM did
+          that were still of interest. In some cases, I added a FIXME to consider changing the
+          code below the comment on the grounds that it was written in a weird way to placate
+          LLVM and so we can do it better now.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGArgumentsEliminationPhase.cpp:
+        * dfg/DFGOSRAvailabilityAnalysisPhase.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::compileTimeStats):
+        * dfg/DFGPutStackSinkingPhase.cpp:
+        * dfg/DFGSSAConversionPhase.h:
+        * dfg/DFGStaticExecutionCountEstimationPhase.h:
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+        * disassembler/ARM64Disassembler.cpp:
+        (JSC::tryToDisassemble): Deleted.
+        * disassembler/X86Disassembler.cpp:
+        (JSC::tryToDisassemble):
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::IndexedAbstractHeap::initialize):
+        * ftl/FTLAbstractHeap.h:
+        * ftl/FTLFormattedValue.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::restoreInto):
+        * ftl/FTLLowerDFGToB3.cpp: Copied from Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp.
+        (JSC::FTL::DFG::ftlUnreachable):
+        (JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
+        (JSC::FTL::DFG::LowerDFGToB3::compileBlock):
+        (JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
+        (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
+        (JSC::FTL::DFG::LowerDFGToB3::compileOverridesHasInstance):
+        (JSC::FTL::DFG::LowerDFGToB3::isBoolean):
+        (JSC::FTL::DFG::LowerDFGToB3::unboxBoolean):
+        (JSC::FTL::DFG::LowerDFGToB3::emitStoreBarrier):
+        (JSC::FTL::lowerDFGToB3):
+        (JSC::FTL::DFG::LowerDFGToLLVM::LowerDFGToLLVM): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBlock): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithNegate): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMultiGetByOffset): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileOverridesHasInstance): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::isBoolean): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::unboxBoolean): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier): Deleted.
+        (JSC::FTL::lowerDFGToLLVM): Deleted.
+        * ftl/FTLLowerDFGToB3.h: Copied from Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.h.
+        * ftl/FTLLowerDFGToLLVM.cpp: Removed.
+        * ftl/FTLLowerDFGToLLVM.h: Removed.
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        * ftl/FTLWeight.h:
+        (JSC::FTL::Weight::frequencyClass):
+        (JSC::FTL::Weight::inverse):
+        (JSC::FTL::Weight::scaleToTotal): Deleted.
+        * ftl/FTLWeightedTarget.h:
+        (JSC::FTL::rarely):
+        (JSC::FTL::unsure):
+        * jit/CallFrameShuffler64.cpp:
+        (JSC::CallFrameShuffler::emitDisplace):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::ftlCalleeSaveRegisters):
+        * llvm: Removed.
+        * llvm/InitializeLLVMLinux.cpp: Removed.
+        * llvm/InitializeLLVMWin.cpp: Removed.
+        * llvm/library: Removed.
+        * llvm/library/LLVMTrapCallback.h: Removed.
+        * llvm/library/libllvmForJSC.version: Removed.
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+        * wasm/WASMFunctionB3IRGenerator.h: Copied from Source/JavaScriptCore/wasm/WASMFunctionLLVMIRGenerator.h.
+        * wasm/WASMFunctionLLVMIRGenerator.h: Removed.
+        * wasm/WASMFunctionParser.cpp:
+
+2016-02-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Build system cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=154337
+
+        Reviewed by Žan Doberšek.
+
+        * CMakeLists.txt:
+
+2016-02-17  Mark Lam  <mark.lam@apple.com>
+
+        Callers of JSString::value() should check for exceptions thereafter.
+        https://bugs.webkit.org/show_bug.cgi?id=154346
+
+        Reviewed by Geoffrey Garen.
+
+        JSString::value() can throw an exception if the JS string is a rope and value() 
+        needs to resolve the rope but encounters an OutOfMemory error.  If value() is not
+        able to resolve the rope, it will return a null string (in addition to throwing
+        the exception).  If a caller does not check for exceptions after calling
+        JSString::value(), they may eventually use the returned null string and crash the
+        VM.
+
+        The fix is to add all the necessary exception checks, and do the appropriate
+        handling if needed.
+
+        * jsc.cpp:
+        (functionRun):
+        (functionLoad):
+        (functionReadFile):
+        (functionCheckSyntax):
+        (functionLoadWebAssembly):
+        (functionLoadModule):
+        (functionCheckModuleSyntax):
+        * runtime/DateConstructor.cpp:
+        (JSC::dateParse):
+        (JSC::dateNow):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::functionPrint):
+
+2016-02-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] ARM64: Support the immediate format used for bit operations in Air
+        https://bugs.webkit.org/show_bug.cgi?id=154327
+
+        Reviewed by Filip Pizlo.
+
+        ARM64 supports a pretty rich form of immediates for bit operation.
+        There are two formats used to encode repeating patterns and common
+        input in a dense form.
+
+        In this patch, I add 2 new type of Arg: BitImm32 and BitImm64.
+        Those represents the valid immediate forms for bit operation.
+        On x86, any 32bits value is valid. On ARM64, all the encoding
+        form are tried and the immediate is used when possible.
+
+        The arg type Imm64 is renamed to BigImm to better represent what
+        it is: an immediate that does not fit into Imm.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::LogicalImmediate::create32): Deleted.
+        (JSC::LogicalImmediate::create64): Deleted.
+        (JSC::LogicalImmediate::value): Deleted.
+        (JSC::LogicalImmediate::isValid): Deleted.
+        (JSC::LogicalImmediate::is64bit): Deleted.
+        (JSC::LogicalImmediate::LogicalImmediate): Deleted.
+        (JSC::LogicalImmediate::mask): Deleted.
+        (JSC::LogicalImmediate::partialHSB): Deleted.
+        (JSC::LogicalImmediate::highestSetBit): Deleted.
+        (JSC::LogicalImmediate::findBitRange): Deleted.
+        (JSC::LogicalImmediate::encodeLogicalImmediate): Deleted.
+        * assembler/AssemblerCommon.h:
+        (JSC::ARM64LogicalImmediate::create32):
+        (JSC::ARM64LogicalImmediate::create64):
+        (JSC::ARM64LogicalImmediate::value):
+        (JSC::ARM64LogicalImmediate::isValid):
+        (JSC::ARM64LogicalImmediate::is64bit):
+        (JSC::ARM64LogicalImmediate::ARM64LogicalImmediate):
+        (JSC::ARM64LogicalImmediate::mask):
+        (JSC::ARM64LogicalImmediate::partialHSB):
+        (JSC::ARM64LogicalImmediate::highestSetBit):
+        (JSC::ARM64LogicalImmediate::findBitRange):
+        (JSC::ARM64LogicalImmediate::encodeLogicalImmediate):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::and64):
+        (JSC::MacroAssemblerARM64::or64):
+        (JSC::MacroAssemblerARM64::xor64):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::bitImm):
+        (JSC::B3::Air::LowerToAir::bitImm64):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::dump):
+        (WTF::printInternal):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::bitImm):
+        (JSC::B3::Air::Arg::bitImm64):
+        (JSC::B3::Air::Arg::isBitImm):
+        (JSC::B3::Air::Arg::isBitImm64):
+        (JSC::B3::Air::Arg::isSomeImm):
+        (JSC::B3::Air::Arg::value):
+        (JSC::B3::Air::Arg::isGP):
+        (JSC::B3::Air::Arg::isFP):
+        (JSC::B3::Air::Arg::hasType):
+        (JSC::B3::Air::Arg::isValidBitImmForm):
+        (JSC::B3::Air::Arg::isValidBitImm64Form):
+        (JSC::B3::Air::Arg::isValidForm):
+        (JSC::B3::Air::Arg::asTrustedImm32):
+        (JSC::B3::Air::Arg::asTrustedImm64):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/opcode_generator.rb:
+
+2016-02-17  Keith Miller  <keith_miller@apple.com>
+
+        Spread operator should be allowed when not the first argument of parameter list
+        https://bugs.webkit.org/show_bug.cgi?id=152721
+
+        Reviewed by Saam Barati.
+
+        Spread arguments to functions should now be ES6 compliant. Before we
+        would only take a spread operator if it was the sole argument to a
+        function. Additionally, we would not use the Symbol.iterator on the
+        object to generate the arguments. Instead we would do a loop up to the
+        length mapping indexed properties to the corresponding argument. We fix
+        both these issues by doing an AST transformation from foo(...a, b, ...c, d)
+        to foo(...[...a, b, ...c, d]) (where the spread on the rhs uses the
+        old spread semantics). This solution has the downside of requiring the
+        allocation of another object and copying each element twice but avoids a
+        large change to the vm calling convention.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createElementList):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseArguments):
+        (JSC::Parser<LexerType>::parseArgument):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createElementList):
+        * tests/es6.yaml:
+        * tests/stress/spread-calling.js: Added.
+        (testFunction):
+        (testEmpty):
+        (makeObject):
+        (otherIterator.return.next):
+        (otherIterator):
+        (totalIter):
+        (throwingIter.return.next):
+        (throwingIter):
+        (i.catch):
+
+2016-02-17  Brian Burg  <bburg@apple.com>
+
+        Remove a wrong cast in RemoteInspector::receivedSetupMessage
+        https://bugs.webkit.org/show_bug.cgi?id=154361
+        <rdar://problem/24709281>
+
+        Reviewed by Joseph Pecoraro.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        Not only is this cast unnecessary (the constructor accepts the base class),
+        but it is wrong since the target could be an automation target. Remove it.
+
+2016-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Rename FTLB3Blah to FTLBlah
+        https://bugs.webkit.org/show_bug.cgi?id=154365
+
+        Rubber stamped by Geoffrey Garen, Benjamin Poulain, Awesome Kling, and Saam Barati.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * ftl/FTLB3Compile.cpp: Removed.
+        * ftl/FTLB3Output.cpp: Removed.
+        * ftl/FTLB3Output.h: Removed.
+        * ftl/FTLCompile.cpp: Copied from Source/JavaScriptCore/ftl/FTLB3Compile.cpp.
+        * ftl/FTLOutput.cpp: Copied from Source/JavaScriptCore/ftl/FTLB3Output.cpp.
+        * ftl/FTLOutput.h: Copied from Source/JavaScriptCore/ftl/FTLB3Output.h.
+
+2016-02-17  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove LLVM dependencies from WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=154323
+
+        Reviewed by Antti Koivisto and Benjamin Poulain.
+
+        We have switched all ports that use the FTL JIT to using B3 as the backend. This renders all
+        LLVM-related code dead, including the disassembler, which was only reachable when you were on
+        a platform that already had an in-tree disassembler.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGCommon.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        (JSC::DFG::Plan::compileTimeStats):
+        * disassembler/ARM64Disassembler.cpp:
+        (JSC::tryToDisassemble):
+        * disassembler/ARMv7Disassembler.cpp:
+        (JSC::tryToDisassemble):
+        * disassembler/Disassembler.cpp:
+        (JSC::disassemble):
+        (JSC::disassembleAsynchronously):
+        * disassembler/Disassembler.h:
+        (JSC::tryToDisassemble):
+        * disassembler/LLVMDisassembler.cpp: Removed.
+        * disassembler/LLVMDisassembler.h: Removed.
+        * disassembler/UDis86Disassembler.cpp:
+        (JSC::tryToDisassembleWithUDis86):
+        * disassembler/UDis86Disassembler.h:
+        (JSC::tryToDisassembleWithUDis86):
+        * disassembler/X86Disassembler.cpp:
+        (JSC::tryToDisassemble):
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLAbbreviations.h: Removed.
+        * ftl/FTLAbstractHeap.cpp:
+        (JSC::FTL::AbstractHeap::decorateInstruction):
+        (JSC::FTL::AbstractHeap::dump):
+        (JSC::FTL::AbstractField::dump):
+        (JSC::FTL::IndexedAbstractHeap::IndexedAbstractHeap):
+        (JSC::FTL::IndexedAbstractHeap::~IndexedAbstractHeap):
+        (JSC::FTL::IndexedAbstractHeap::baseIndex):
+        (JSC::FTL::IndexedAbstractHeap::dump):
+        (JSC::FTL::NumberedAbstractHeap::NumberedAbstractHeap):
+        (JSC::FTL::NumberedAbstractHeap::dump):
+        (JSC::FTL::AbsoluteAbstractHeap::AbsoluteAbstractHeap):
+        (JSC::FTL::AbstractHeap::tbaaMetadataSlow): Deleted.
+        * ftl/FTLAbstractHeap.h:
+        (JSC::FTL::AbstractHeap::AbstractHeap):
+        (JSC::FTL::AbstractHeap::heapName):
+        (JSC::FTL::IndexedAbstractHeap::atAnyIndex):
+        (JSC::FTL::NumberedAbstractHeap::atAnyNumber):
+        (JSC::FTL::AbsoluteAbstractHeap::atAnyAddress):
+        (JSC::FTL::AbstractHeap::tbaaMetadata): Deleted.
+        * ftl/FTLAbstractHeapRepository.cpp:
+        (JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLB3Compile.cpp:
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::check):
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::store):
+        * ftl/FTLB3Output.h:
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        (JSC::FTL::CommonValues::initializeConstants):
+        * ftl/FTLCommonValues.h:
+        (JSC::FTL::CommonValues::initialize): Deleted.
+        * ftl/FTLCompile.cpp: Removed.
+        * ftl/FTLCompileBinaryOp.cpp: Removed.
+        * ftl/FTLCompileBinaryOp.h: Removed.
+        * ftl/FTLDWARFDebugLineInfo.cpp: Removed.
+        * ftl/FTLDWARFDebugLineInfo.h: Removed.
+        * ftl/FTLDWARFRegister.cpp: Removed.
+        * ftl/FTLDWARFRegister.h: Removed.
+        * ftl/FTLDataSection.cpp: Removed.
+        * ftl/FTLDataSection.h: Removed.
+        * ftl/FTLExceptionHandlerManager.cpp: Removed.
+        * ftl/FTLExceptionHandlerManager.h: Removed.
+        * ftl/FTLExceptionTarget.cpp:
+        * ftl/FTLExceptionTarget.h:
+        * ftl/FTLExitThunkGenerator.cpp: Removed.
+        * ftl/FTLExitThunkGenerator.h: Removed.
+        * ftl/FTLFail.cpp:
+        (JSC::FTL::fail):
+        * ftl/FTLInlineCacheDescriptor.h: Removed.
+        * ftl/FTLInlineCacheSize.cpp: Removed.
+        * ftl/FTLInlineCacheSize.h: Removed.
+        * ftl/FTLIntrinsicRepository.cpp: Removed.
+        * ftl/FTLIntrinsicRepository.h: Removed.
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::~JITCode):
+        (JSC::FTL::JITCode::initializeB3Code):
+        (JSC::FTL::JITCode::initializeB3Byproducts):
+        (JSC::FTL::JITCode::initializeAddressForCall):
+        (JSC::FTL::JITCode::contains):
+        (JSC::FTL::JITCode::ftl):
+        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        (JSC::FTL::JITCode::initializeExitThunks): Deleted.
+        (JSC::FTL::JITCode::addHandle): Deleted.
+        (JSC::FTL::JITCode::addDataSection): Deleted.
+        (JSC::FTL::JITCode::exitThunks): Deleted.
+        * ftl/FTLJITCode.h:
+        (JSC::FTL::JITCode::b3Code):
+        (JSC::FTL::JITCode::handles): Deleted.
+        (JSC::FTL::JITCode::dataSections): Deleted.
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::codeSize):
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLJSCall.cpp: Removed.
+        * ftl/FTLJSCall.h: Removed.
+        * ftl/FTLJSCallBase.cpp: Removed.
+        * ftl/FTLJSCallBase.h: Removed.
+        * ftl/FTLJSCallVarargs.cpp: Removed.
+        * ftl/FTLJSCallVarargs.h: Removed.
+        * ftl/FTLJSTailCall.cpp: Removed.
+        * ftl/FTLJSTailCall.h: Removed.
+        * ftl/FTLLazySlowPath.cpp:
+        (JSC::FTL::LazySlowPath::LazySlowPath):
+        (JSC::FTL::LazySlowPath::generate):
+        * ftl/FTLLazySlowPath.h:
+        (JSC::FTL::LazySlowPath::createGenerator):
+        (JSC::FTL::LazySlowPath::patchableJump):
+        (JSC::FTL::LazySlowPath::done):
+        (JSC::FTL::LazySlowPath::usedRegisters):
+        (JSC::FTL::LazySlowPath::callSiteIndex):
+        (JSC::FTL::LazySlowPath::stub):
+        (JSC::FTL::LazySlowPath::patchpoint): Deleted.
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::forValueRep):
+        (JSC::FTL::Location::dump):
+        (JSC::FTL::Location::forStackmaps): Deleted.
+        * ftl/FTLLocation.h:
+        (JSC::FTL::Location::forRegister):
+        (JSC::FTL::Location::forIndirect):
+        (JSC::FTL::Location::forConstant):
+        (JSC::FTL::Location::kind):
+        (JSC::FTL::Location::hasReg):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::createPhiVariables):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileUpsilon):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePhi):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileDoubleConstant):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStrCat):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithNegate):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitAnd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitOr):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitXor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitRShift):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitLShift):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitURShift):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetButterfly):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileLoadVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIsUndefined):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::loadButterflyWithBarrier):
+        (JSC::FTL::DFG::LowerDFGToLLVM::stringsEqual):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculate):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::preparePatchpointForExceptions):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForAvailability):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::probe):
+        (JSC::FTL::DFG::LowerDFGToLLVM::crash):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileUntypedBinaryOp): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::callStackmap): Deleted.
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
+        (JSC::FTL::OSRExitDescriptor::validateReferences):
+        (JSC::FTL::OSRExitDescriptor::emitOSRExit):
+        (JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::gatherRegistersToSpillForCallIfException): Deleted.
+        (JSC::FTL::OSRExit::spillRegistersToSpillSlot): Deleted.
+        (JSC::FTL::OSRExit::recoverRegistersFromSpillSlot): Deleted.
+        (JSC::FTL::OSRExit::willArriveAtExitFromIndirectExceptionCheck): Deleted.
+        (JSC::FTL::OSRExit::willArriveAtOSRExitFromCallOperation): Deleted.
+        (JSC::FTL::OSRExit::needsRegisterRecoveryOnGenericUnwindOSRExitPath): Deleted.
+        * ftl/FTLOSRExit.h:
+        (JSC::FTL::OSRExit::considerAddingAsFrequentExitSite):
+        (JSC::FTL::OSRExitDescriptorImpl::OSRExitDescriptorImpl): Deleted.
+        * ftl/FTLOSRExitCompilationInfo.h: Removed.
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileRecovery):
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLOSRExitHandle.cpp:
+        * ftl/FTLOSRExitHandle.h:
+        * ftl/FTLOutput.cpp: Removed.
+        * ftl/FTLOutput.h: Removed.
+        * ftl/FTLPatchpointExceptionHandle.cpp:
+        * ftl/FTLPatchpointExceptionHandle.h:
+        * ftl/FTLStackMaps.cpp: Removed.
+        * ftl/FTLStackMaps.h: Removed.
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        (JSC::FTL::State::~State):
+        (JSC::FTL::State::dumpState): Deleted.
+        * ftl/FTLState.h:
+        * ftl/FTLUnwindInfo.cpp: Removed.
+        * ftl/FTLUnwindInfo.h: Removed.
+        * ftl/FTLValueRange.cpp:
+        (JSC::FTL::ValueRange::decorateInstruction):
+        * ftl/FTLValueRange.h:
+        (JSC::FTL::ValueRange::ValueRange):
+        (JSC::FTL::ValueRange::begin):
+        (JSC::FTL::ValueRange::end):
+        * ftl/FTLWeight.h:
+        (JSC::FTL::Weight::value):
+        (JSC::FTL::Weight::frequencyClass):
+        (JSC::FTL::Weight::scaleToTotal):
+        * llvm/InitializeLLVM.cpp: Removed.
+        * llvm/InitializeLLVM.h: Removed.
+        * llvm/InitializeLLVMMac.cpp: Removed.
+        * llvm/InitializeLLVMPOSIX.cpp: Removed.
+        * llvm/InitializeLLVMPOSIX.h: Removed.
+        * llvm/LLVMAPI.cpp: Removed.
+        * llvm/LLVMAPI.h: Removed.
+        * llvm/LLVMAPIFunctions.h: Removed.
+        * llvm/LLVMHeaders.h: Removed.
+        * llvm/library/LLVMAnchor.cpp: Removed.
+        * llvm/library/LLVMExports.cpp: Removed.
+        * llvm/library/LLVMOverrides.cpp: Removed.
+        * llvm/library/config_llvm.h: Removed.
+
+2016-02-17  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove the overflow check on ArithAbs when possible
+        https://bugs.webkit.org/show_bug.cgi?id=154325
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds support for ArithMode for ArithAbs.
+
+        It is useful for kraken tests where Math.abs() is used
+        on values for which the range is known.
+
+        For example, imaging-gaussian-blur has two Math.abs() with
+        integers that are always in a small range around zero.
+        The IntegerRangeOptimizationPhase detects the range correctly
+        so we can just update the ArithMode depending on the input.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToArithNegate):
+        (JSC::DFG::Node::hasArithMode):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAbs):
+        * tests/stress/arith-abs-integer-range-optimization.js: Added.
+        (negativeRange):
+        (negativeRangeIncludingZero):
+        (negativeRangeWithOverflow):
+        (positiveRange):
+        (positiveRangeIncludingZero):
+        (rangeWithoutOverflow):
+        * tests/stress/arith-abs-with-bitwise-or-zero.js: Added.
+        (opaqueAbs):
+
+2016-02-17  Chris Dumez  <cdumez@apple.com>
+
+        SES selftest page crashes on nightly r196694
+        https://bugs.webkit.org/show_bug.cgi?id=154350
+        <rdar://problem/24704334>
+
+        Reviewed by Mark Lam.
+
+        SES selftest page crashes after r196001 / r196145 when calling
+        Object.getOwnPropertyDescriptor(window, "length") after the window
+        has been reified and "length" has been shadowed by a value property.
+
+        It was crashing in JSObject::getOwnPropertyDescriptor() because
+        we are getting a slot that has attribute "CustomAccessor" but
+        the property is not a CustomGetterSetter. In this case, since
+        window.length is [Replaceable] and has been set to a numeric value,
+        it makes that the property is not a CustomGetterSetter. However,
+        the "CustomAccessor" attribute should have been dropped from the
+        slot when window.length was shadowed. Therefore, this code path
+        should not be exercised at all when calling
+        getOwnPropertyDescriptor().
+
+        The issue was that putDirectInternal() was updating the slot
+        attributes only if the "Accessor" flag has changed, but not
+        the "customAccessor" flag. This patch fixes the issue.
+
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirectInternal):
+
+2016-02-17  Saam barati  <sbarati@apple.com>
+
+        Implement Proxy [[Get]]
+        https://bugs.webkit.org/show_bug.cgi?id=154081
+
+        Reviewed by Michael Saboff.
+
+        This patch implements ProxyObject and ProxyConstructor. Their
+        implementations are straight forward and follow the spec.
+        The largest change in this patch is adding a second parameter
+        to PropertySlot's constructor that specifies the internal method type of
+        the getOwnPropertySlot inquiry. We use getOwnPropertySlot to 
+        implement more than one Internal Method in the spec. Because 
+        of this, we need InternalMethodType to give us context about 
+        which Internal Method we're executing. Specifically, Proxy will 
+        call into different handlers based on this information.
+
+        InternalMethodType is an enum with the following values:
+        - Get
+          This corresponds to [[Get]] internal method in the spec.
+        - GetOwnProperty
+          This corresponds to [[GetOwnProperty]] internal method in the spec.
+        - HasProperty
+          This corresponds to [[HasProperty]] internal method in the spec.
+        - VMInquiry
+          This is basically everything else that isn't one of the above
+          types. This value also mandates that getOwnPropertySlot does
+          not perform any user observable effects. I.e, it can't call
+          a JS function.
+
+        The other non-VMInquiry InternalMethodTypes are allowed to perform user
+        observable effects. I.e, in future patches, ProxyObject will implement
+        InternalMethodType::HasProperty and InternalMethodType::GetOwnProperty, which will both be defined
+        to call user defined JS functions, which clearly have the right to perform
+        user observable effects.
+
+        This patch implements getOwnPropertySlot of ProxyObject under
+        InternalMethodType::Get. 
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::put):
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::caughtValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::get):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnNonIndexPropertyNames):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::defineOwnProperty):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure):
+        (JSC::JSGlobalObject::moduleRecordStructure):
+        (JSC::JSGlobalObject::moduleNamespaceObjectStructure):
+        (JSC::JSGlobalObject::proxyObjectStructure):
+        (JSC::JSGlobalObject::wasmModuleStructure):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::getOwnPropertySlot):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::callbackGetter):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::hasProperty):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::hasOwnProperty):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirectIndex):
+        (JSC::JSObject::get):
+        * runtime/JSScope.cpp:
+        (JSC::abstractAccess):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncToString):
+        * runtime/PropertySlot.h:
+        (JSC::attributesForStructure):
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::isCacheableGetter):
+        (JSC::PropertySlot::isCacheableCustom):
+        (JSC::PropertySlot::internalMethodType):
+        (JSC::PropertySlot::disableCaching):
+        (JSC::PropertySlot::getValue):
+        * runtime/ProxyConstructor.cpp: Added.
+        (JSC::ProxyConstructor::create):
+        (JSC::ProxyConstructor::ProxyConstructor):
+        (JSC::ProxyConstructor::finishCreation):
+        (JSC::constructProxyObject):
+        (JSC::ProxyConstructor::getConstructData):
+        (JSC::ProxyConstructor::getCallData):
+        * runtime/ProxyConstructor.h: Added.
+        (JSC::ProxyConstructor::createStructure):
+        * runtime/ProxyObject.cpp: Added.
+        (JSC::ProxyObject::ProxyObject):
+        (JSC::ProxyObject::finishCreation):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        (JSC::ProxyObject::getOwnPropertySlot):
+        (JSC::ProxyObject::getOwnPropertySlotByIndex):
+        (JSC::ProxyObject::visitChildren):
+        * runtime/ProxyObject.h: Added.
+        (JSC::ProxyObject::create):
+        (JSC::ProxyObject::createStructure):
+        (JSC::ProxyObject::target):
+        (JSC::ProxyObject::handler):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectGet):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
+        * tests/es6.yaml:
+        * tests/stress/proxy-basic.js: Added.
+        (assert):
+        (let.handler.get null):
+        (get let):
+        (let.handler.get switch):
+        (let.handler):
+        (let.theTarget.get x):
+        * tests/stress/proxy-in-proto-chain.js: Added.
+        (assert):
+        * tests/stress/proxy-of-a-proxy.js: Added.
+        (assert):
+        (throw.new.Error.):
+        * tests/stress/proxy-property-descriptor.js: Added.
+        (assert):
+        (set Object):
+        * wasm/WASMModuleParser.cpp:
+        (JSC::WASMModuleParser::getImportedValue):
+
+2016-02-17  Mark Lam  <mark.lam@apple.com>
+
+        StringPrototype functions should check for exceptions after calling JSString::value().
+        https://bugs.webkit.org/show_bug.cgi?id=154340
+
+        Reviewed by Filip Pizlo.
+
+        JSString::value() can throw an exception if the JS string is a rope and value()
+        needs to resolve the rope but encounters an OutOfMemory error.  If value() is not
+        able to resolve the rope, it will return a null string (in addition to throwing
+        the exception).  If StringPrototype functions do not check for exceptions after
+        calling JSString::value(), they may eventually use the returned null string and
+        crash the VM.
+
+        The fix is to add all the necessary exception checks, and do the appropriate
+        handling if needed.
+
+        Also in a few place where when an exception is detected, we return JSValue(), I
+        changed it to return jsUndefined() instead to be consistent with the rest of the
+        file.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+
+2016-02-17  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196675.
+        https://bugs.webkit.org/show_bug.cgi?id=154344
+
+         "Causes major slowdowns on deltablue-varargs" (Requested by
+        keith_miller on #webkit).
+
+        Reverted changeset:
+
+        "Spread operator should be allowed when not the first argument
+        of parameter list"
+        https://bugs.webkit.org/show_bug.cgi?id=152721
+        http://trac.webkit.org/changeset/196675
+
+2016-02-17  Gavin Barraclough  <barraclough@apple.com>
+
+        JSDOMWindow::put should not do the same thing twice
+        https://bugs.webkit.org/show_bug.cgi?id=154334
+
+        Reviewed by Chris Dumez.
+
+        It either calls JSGlobalObject::put or Base::put. Hint: these are basically the same thing.
+        In the latter case it might call lookupPut. That's redundant; JSObject::put handles static
+        table entries.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite): Deleted.
+            - no longer needed.
+
+2016-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL_USES_B3 should be unconditionally true
+        https://bugs.webkit.org/show_bug.cgi?id=154324
+
+        Reviewed by Benjamin Poulain.
+
+        * dfg/DFGCommon.h:
+
+2016-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support CompareEq(String:, String:)
+        https://bugs.webkit.org/show_bug.cgi?id=154269
+        rdar://problem/24499921
+
+        Reviewed by Benjamin Poulain.
+
+        Looks like a slight pdfjs slow-down, probably because we're having some recompilations. I
+        think we should land the increased coverage first and fix the issues after, especially since
+        the regression is so small and doesn't have a statistically significant effect on the overall
+        score.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCompareStrictEq):
+        (JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
+        (JSC::FTL::DFG::LowerDFGToLLVM::stringsEqual):
+        * tests/stress/ftl-string-equality.js: Added.
+        * tests/stress/ftl-string-ident-equality.js: Added.
+        * tests/stress/ftl-string-strict-equality.js: Added.
+
+2016-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support NewTypedArray
+        https://bugs.webkit.org/show_bug.cgi?id=154268
+
+        Reviewed by Saam Barati.
+
+        3% speed-up on pdfjs. This was already covered by many different tests.
+
+        Rolling this back in after fixing the butterfly argument.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewTypedArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileAllocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateBasicStorageAndGetEnd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateBasicStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateObject):
+
+2016-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        JSDOMWindow::getOwnPropertySlot should just call getStaticPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=154257
+
+        Reviewed by Chris Dumez.
+
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+        (JSC::getStaticValueSlot):
+            - this could all do with a little more love.
+              But enforce the basic precedence:
+                (1) regular storage properties always win over static table properties.
+                (2) if properties have been reified, don't consult the static tables.
+                (3) only if the property is not present on the object & not reified
+                    should the static hashtable be consulted.
+
+2016-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        JSDOMWindow::getOwnPropertySlot should not search photo chain
+        https://bugs.webkit.org/show_bug.cgi?id=154102
+
+        Reviewed by Chris Dumez.
+
+        Should only return *own* properties.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+            - remove hack/special-case for DOMWindow; we no longer need this.
+
+2016-02-16  Keith Miller  <keith_miller@apple.com>
+
+        Spread operator should be allowed when not the first argument of parameter list
+        https://bugs.webkit.org/show_bug.cgi?id=152721
+
+        Reviewed by Saam Barati.
+
+        Spread arguments to functions should now be ES6 compliant. Before we
+        would only take a spread operator if it was the sole argument to a
+        function. Additionally, we would not use the Symbol.iterator on the
+        object to generate the arguments. Instead we would do a loop up to the
+        length mapping indexed properties to the corresponding argument. We fix
+        both these issues by doing an AST transformation from foo(...a, b, ...c, d)
+        to foo(...[...a, b, ...c, d]) (where the spread on the rhs uses the
+        old spread semantics). This solution has the downside of requiring the
+        allocation of another object and copying each element twice but avoids a
+        large change to the vm calling convention.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::loadVarargs):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createElementList):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseArguments):
+        (JSC::Parser<LexerType>::parseArgument):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        * parser/Parser.h:
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createElementList):
+        * tests/es6.yaml:
+        * tests/stress/spread-calling.js: Added.
+        (testFunction):
+        (testEmpty):
+        (makeObject):
+        (otherIterator.return.next):
+        (otherIterator):
+        (totalIter):
+        (throwingIter.return.next):
+        (throwingIter):
+        (i.catch):
+
+2016-02-16  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Enable B3 on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=154275
+
+        Reviewed by Mark Lam.
+
+        The port passes more tests than LLVM now, let's use it by default.
+
+        * dfg/DFGCommon.h:
+
+2016-02-16  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196652.
+        https://bugs.webkit.org/show_bug.cgi?id=154315
+
+        This change caused LayoutTest crashes (Requested by ryanhaddad
+        on #webkit).
+
+        Reverted changeset:
+
+        "FTL should support NewTypedArray"
+        https://bugs.webkit.org/show_bug.cgi?id=154268
+        http://trac.webkit.org/changeset/196652
+
+2016-02-16  Brian Burg  <bburg@apple.com>
+
+        RemoteInspector should forward new automation session requests to its client
+        https://bugs.webkit.org/show_bug.cgi?id=154260
+        <rdar://problem/24663313>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::xpcConnectionReceivedMessage):
+        (Inspector::RemoteInspector::listingForAutomationTarget):
+        Use the correct key for the session identifier in the listing. The name()
+        override for RemoteAutomationTarget is actually the session identifier.
+
+        (Inspector::RemoteInspector::receivedAutomationSessionRequestMessage):
+        * inspector/remote/RemoteInspectorConstants.h: Add new constants.
+
+2016-02-16  Saam barati  <sbarati@apple.com>
+
+        SamplingProfiler still fails with ASan enabled
+        https://bugs.webkit.org/show_bug.cgi?id=154301
+        <rdar://problem/24679502>
+
+        Reviewed by Filip Pizlo.
+
+        To fix this issue, I've come up with unsafe versions
+        of all operations that load memory from the thread's call
+        frame. All these new unsafe methods are marked with SUPPRESS_ASAN.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::callSiteAsRawBits):
+        (JSC::CallFrame::unsafeCallSiteAsRawBits):
+        (JSC::CallFrame::callSiteIndex):
+        (JSC::CallFrame::unsafeCallSiteIndex):
+        (JSC::CallFrame::stack):
+        (JSC::CallFrame::callerFrame):
+        (JSC::CallFrame::unsafeCallerFrame):
+        (JSC::CallFrame::friendlyFunctionName):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::calleeAsValue):
+        (JSC::ExecState::callee):
+        (JSC::ExecState::unsafeCallee):
+        (JSC::ExecState::codeBlock):
+        (JSC::ExecState::unsafeCodeBlock):
+        (JSC::ExecState::scope):
+        (JSC::ExecState::callerFrame):
+        (JSC::ExecState::callerFrameOrVMEntryFrame):
+        (JSC::ExecState::unsafeCallerFrameOrVMEntryFrame):
+        (JSC::ExecState::callerFrameOffset):
+        (JSC::ExecState::callerFrameAndPC):
+        (JSC::ExecState::unsafeCallerFrameAndPC):
+        * interpreter/Register.h:
+        (JSC::Register::codeBlock):
+        (JSC::Register::asanUnsafeCodeBlock):
+        (JSC::Register::unboxedInt32):
+        (JSC::Register::tag):
+        (JSC::Register::unsafeTag):
+        (JSC::Register::payload):
+        * interpreter/VMEntryRecord.h:
+        (JSC::VMEntryRecord::prevTopCallFrame):
+        (JSC::VMEntryRecord::unsafePrevTopCallFrame):
+        (JSC::VMEntryRecord::prevTopVMEntryFrame):
+        (JSC::VMEntryRecord::unsafePrevTopVMEntryFrame):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::FrameWalker::walk):
+        (JSC::FrameWalker::advanceToParentFrame):
+        (JSC::FrameWalker::isAtTop):
+        (JSC::FrameWalker::resetAtMachineFrame):
+
+2016-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support NewTypedArray
+        https://bugs.webkit.org/show_bug.cgi?id=154268
+
+        Reviewed by Saam Barati.
+
+        3% speed-up on pdfjs. This was already covered by many different tests.
+
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewTypedArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileAllocatePropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateBasicStorageAndGetEnd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateBasicStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateObject):
+
+2016-02-16  Saam barati  <sbarati@apple.com>
+
+        stress/sampling-profiler-deep-stack.js fails on ARM 32bit
+        https://bugs.webkit.org/show_bug.cgi?id=154255
+        <rdar://problem/24662996>
+
+        Reviewed by Mark Lam.
+
+        The bug here wasn't in the implementation of the sampling profiler 
+        itself. Rather, it was a bug in the test. JSC wasn't spending a lot
+        of time in a function that the test assumed a lot of time was spent in.
+        That's because the DFG was doing a good job at optimizing the function
+        at the leaf of the recursion. Because of that, we often wouldn't sample it.
+        I fixed this by making the leaf function do more work.
+
+        * tests/stress/sampling-profiler-deep-stack.js:
+        (platformSupportsSamplingProfiler.foo):
+
+2016-02-16  Chris Dumez  <cdumez@apple.com>
+
+        [Web IDL] Operations should be on the instance for global objects or if [Unforgeable]
+        https://bugs.webkit.org/show_bug.cgi?id=154120
+        <rdar://problem/24613231>
+
+        Reviewed by Gavin Barraclough.
+
+        Have putEntry() take a thisValue parameter in addition to the base,
+        instead of relying on PropertySlot::thisValue() because this did not
+        always do the right thing. In particular, when JSDOMWindow::put() was
+        called to set a function, it would end up setting the new value on the
+        JSDOMWindowShell instead of the actual JSDOMWindow.
+        JSDOMWindow::getOwnPropertySlot() would then not be able to find it.
+        Therefore the following would fail:
+        $ window.open = "test"
+        $ console.log(window.open) // prints the native function instead of "test"
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putInlineSlow):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        (JSC::lookupPut):
+
+2016-02-16  Keith Miller  <keith_miller@apple.com>
+
+        ClonedArguments should not materialize its special properties unless they are being changed or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=154128
+
+        Reviewed by Filip Pizlo.
+
+        Before we would materialize ClonedArguments whenever they were being accessed.
+        However this would cause the IC to miss every time as the structure for
+        the arguments object would change as we went to IC it. Thus on the next
+        function call we would miss the cache since the new arguments object
+        would not have materialized the value.
+
+        * runtime/ClonedArguments.cpp:
+        (JSC::ClonedArguments::getOwnPropertySlot):
+        * tests/stress/cloned-arguments-modification.js: Added.
+        (foo):
+
+2016-02-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL should support StringFromCharCode
+        https://bugs.webkit.org/show_bug.cgi?id=154267
+        rdar://problem/24192536
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode): Fix a bug preventing the UntypedUse from being effective.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStringFromCharCode): Implement the opcode.
+        * tests/stress/string-from-char-code-slow.js: Added.
+
+2016-02-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] BranchAdd can override arguments of its stackmap
+        https://bugs.webkit.org/show_bug.cgi?id=154274
+
+        Reviewed by Filip Pizlo.
+
+        With the 3 operands BranchAdd added in r196513, we can run into
+        a register allocation such that the destination register is also
+        used by a value in the stack map.
+
+        It use to be that BranchAdd was a 2 operand instruction.
+        In that form, the destination is also one of the source and
+        can be recovered through Sub. There is no conflict between
+        destination and the stackmap.
+
+        After r196513, the destination has its own value. It is uncommon
+        on x86 because of the aggressive aliasing but that can happen.
+        On ARM, that's a standard form since there is no need for aliasing.
+
+        Since the arguments of the stackmap are of type EarlyUse,
+        they appeared as not interfering with the destination. When the register
+        allocator gives the same register to the destination and something in
+        the stack map, the result of BranchAdd destroys the value kept alive
+        for the stackmap.
+
+        In this patch, I introduce a concept very similar to ForceLateUse
+        to keep the argument of the stackmap live in CheckAdd. The new
+        role is "ForceLateUseUnlessRecoverable".
+
+        In this mode, anything that is not also an input argument becomes
+        LateUse. As such, it interferes with the destination of CheckAdd.
+        The arguments are recovered by the slow patch of CheckAdd. They
+        remain Early use.
+
+        This new modes ensure that destination can be aliased to the source
+        when that's useful, while making sure it is not aliased with another
+        value that needs to be live on exit.
+
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::forEachArg):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::forEachArg):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        (WTF::printInternal):
+        * b3/B3StackmapSpecial.h:
+        * b3/B3StackmapValue.h:
+
+2016-02-15  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Web Workers have no access to console for debugging
+        https://bugs.webkit.org/show_bug.cgi?id=26237
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/ConsoleMessage.h:
+        Add accessor for MessageLevel.
+
+2016-02-15  Mark Lam  <mark.lam@apple.com>
+
+        [ARMv7] stress/op_rshift.js and stress/op_urshift.js are failing.
+        https://bugs.webkit.org/show_bug.cgi?id=151514
+
+        Reviewed by Filip Pizlo.
+
+        The issue turns out to be trivial: on ARMv7 (and traditional ARM too), arithmetic
+        shift right (ASR) and logical shift right (LSR) takes an immediate shift amount
+        from 1-32.  See http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0204j/Cjacbgca.html.
+        An immediate shift amount of 0 is interpreted as a shift of 32 bits.
+
+        Meanwhile, our macro assembler is expecting the immediate shift value to be
+        between 0-31.  As a result, a shift amount of 0 is being wrongly encoded with 0
+        bits which means shift right by 32 bits.
+
+        The fix is to check if the shift amount is 0, and if so, emit a move.  Else,
+        emit the right shift as usual.
+
+        This issue does not affect left shifts, as the immediate shift amount for left
+        shifts is between 0-31 as our macro assembler expects.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::urshift32):
+        (JSC::MacroAssemblerARM::sub32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::rshift32):
+        (JSC::MacroAssemblerARMv7::urshift32):
+
+        * tests/stress/op_rshift.js:
+        * tests/stress/op_urshift.js:
+        - Un-skip these tests.  They should always pass now.
+
+2016-02-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Parser::parseVariableDeclarationList should null check the node before attempting to create a new CommaExpr
+        https://bugs.webkit.org/show_bug.cgi?id=154244
+        rdar://problem/24290670
+
+        Reviewed by Michael Saboff.
+
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::appendToCommaExpr): Catch the bug sooner in debug.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList): Fix the bug.
+        * tests/stress/for-let-comma.js: Added. This used to crash in debug and release.
+
+2016-02-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve the interface of Inst::shouldTryAliasingDef()
+        https://bugs.webkit.org/show_bug.cgi?id=154227
+
+        Reviewed by Andreas Kling.
+
+        Using Optional<> instead of a bool+reference looks cleaner
+        at the call sites.
+
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::shouldTryAliasingDef):
+        * b3/B3CheckSpecial.h:
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::PatchCustom::shouldTryAliasingDef):
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::shouldTryAliasingDef):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirSpecial.cpp:
+        (JSC::B3::Air::Special::shouldTryAliasingDef):
+        * b3/air/AirSpecial.h:
+
+2016-02-14  Brian Burg  <bburg@apple.com>
+
+        WKAutomationDelegate's requestAutomationSession should take a suggested session identifier
+        https://bugs.webkit.org/show_bug.cgi?id=154012
+        <rdar://problem/24557697>
+
+        Reviewed by Darin Adler.
+
+        Add a string parameter to the client method for requesting a new session.
+
+        * inspector/remote/RemoteInspector.h:
+
+2016-02-13  Timothy Hatcher  <timothy@apple.com>
+
+        Fix WebAssembly bug URL in the feature list.
+
+        * features.json:
+
+2016-02-12  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Change the last RefPtr::get() to release() in String.prototype.normalize
+        https://bugs.webkit.org/show_bug.cgi?id=154211
+
+        Reviewed by Ryosuke Niwa.
+
+        Change the last RefPtr::get() to release() in String.prototype.normalize.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::normalize):
+
+2016-02-12  Saam barati  <sbarati@apple.com>
+
+        [ES6] we have an incorrect syntax error when a callee of a function expression has the same name as a top-level lexical declaration
+        https://bugs.webkit.org/show_bug.cgi?id=154143
+
+        Reviewed by Benjamin Poulain.
+
+        We were raising syntax errors on the following type of programs when
+        we shouldn't have been.
+        ```
+        (function foo() { const foo = 20; });
+        ```
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Scope::computeLexicallyCapturedVariablesAndPurgeCandidates):
+        (JSC::Scope::declareCallee):
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::hasDeclaredVariable):
+        (JSC::Scope::hasLexicallyDeclaredVariable):
+        (JSC::Scope::hasDeclaredParameter):
+        (JSC::Scope::declareWrite):
+        (JSC::Scope::getCapturedVars):
+
+2016-02-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] ZeroExtend and SignExtend use incorrect addressing on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=154208
+
+        Reviewed by Filip Pizlo.
+
+        When lowering:
+            @1 = Load32(@x)
+            @2 = SExt8(@1)
+
+        LowerToAir would see there is a form of SignExtend8To32 (an alias for Load8S)
+        and use that.
+
+        There are two problems with that:
+        1) If we have an Addr, it went through legalizeMemoryOffsets() for a 32bits
+           load. If used on an other kind of load, there is no guarantee the addressing
+           is still valid.
+        2) If we have an Index, it is computed for the 32bits MemoryValue.
+           The computed index is not valid for the 8bits load.
+
+        (2) could be fixed by changing LowerToAir to use the current instruction width
+        instead of the B3ValueWidth but that's a bit tricky. We should just embrace
+        that one of our target is a Load-Store architecture.
+
+        In this patch, I just disabled the faulty forms on ARM64. We still need those operations
+        to be fast, this will be addressed in: https://bugs.webkit.org/show_bug.cgi?id=154207
+
+        I also strengthened the m_allowScratchRegister assertion. The instructions that do not
+        invalidate the temporary did not run the assertion, making this harder to debug.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::load8):
+        (JSC::MacroAssemblerARM64::store64):
+        (JSC::MacroAssemblerARM64::store32):
+        (JSC::MacroAssemblerARM64::loadDouble):
+        (JSC::MacroAssemblerARM64::storeDouble):
+        (JSC::MacroAssemblerARM64::branch32):
+        (JSC::MacroAssemblerARM64::branch64):
+        (JSC::MacroAssemblerARM64::getCachedDataTempRegisterIDAndInvalidate):
+        (JSC::MacroAssemblerARM64::getCachedMemoryTempRegisterIDAndInvalidate):
+        (JSC::MacroAssemblerARM64::dataMemoryTempRegister):
+        (JSC::MacroAssemblerARM64::cachedMemoryTempRegister):
+        (JSC::MacroAssemblerARM64::load):
+        (JSC::MacroAssemblerARM64::store):
+        * b3/air/AirOpcode.opcodes:
+
+2016-02-12  Michael Saboff  <msaboff@apple.com>
+
+        offlineasm: Emit Dwarf2 file and location directives to allow for debugging .asm files
+        https://bugs.webkit.org/show_bug.cgi?id=152703
+
+        Reviewed by Mark Lam.
+
+        Added support to output Dwarf2 .file and .loc assembler directives to provide the debugging
+        information needed to correlate the offline assembler generated code with the source lines 
+        in the .asm files.
+
+        Changed the tracking of file data to include a file index that was provided to the .file
+        directive.  That index is used when emitting the .loc directives.
+
+        * offlineasm/arm.rb:
+        * offlineasm/arm64.rb:
+        * offlineasm/asm.rb:
+        * offlineasm/backends.rb:
+        * offlineasm/config.rb:
+        * offlineasm/parser.rb:
+        * offlineasm/x86.rb:
+
+2016-02-12  Saam barati  <sbarati@apple.com>
+
+        The parser doesn't properly protect against global variable references in builtins
+        https://bugs.webkit.org/show_bug.cgi?id=154144
+
+        Reviewed by Geoffrey Garen.
+
+        This patch fixes our global variable reference detection
+        algorithm that was broken. After fixing the algorithm, I
+        detected many places where we were incorrectly using global
+        variables. I've fixed all those.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * builtins/NumberPrototype.js:
+        (toLocaleString):
+        * builtins/PromiseConstructor.js:
+        (race):
+        (reject):
+        (resolve):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ModuleProgramNode::ModuleProgramNode):
+        (JSC::ProgramNode::setClosedVariables): Deleted.
+        * parser/Nodes.h:
+        (JSC::ScopeNode::setClosedVariables): Deleted.
+        (JSC::ProgramNode::closedVariables): Deleted.
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::didFinishParsing):
+        * parser/Parser.h:
+        (JSC::Scope::setIsLexicalScope):
+        (JSC::Scope::isLexicalScope):
+        (JSC::Scope::closedVariableCandidates):
+        (JSC::Scope::declaredVariables):
+        (JSC::Scope::lexicalVariables):
+        (JSC::Scope::finalizeLexicalEnvironment):
+        (JSC::Parser::positionBeforeLastNewline):
+        (JSC::Parser::locationBeforeLastToken):
+        (JSC::Parser::isFunctionMetadataNode):
+        (JSC::parse):
+        (JSC::Parser::closedVariables): Deleted.
+
+2016-02-12  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject::putByIndexBeyondVectorLengthWithoutAttributes needs to go to the sparse map based on MAX_STORAGE_VECTOR_INDEX
+        https://bugs.webkit.org/show_bug.cgi?id=154201
+        rdar://problem/24291387
+
+        Reviewed by Saam Barati.
+
+        I decided against adding a test for this, because it runs for a very long time.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes): Fix the bug.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncSplit): Fix a related bug: if this code creates an array that would have
+            hit the above bug, then it would probably manifest as a spin or as swapping.
+
+2016-02-12  Jonathan Davis  <jond@apple.com>
+
+        Add WebAssembly to the status page
+        https://bugs.webkit.org/show_bug.cgi?id=154199
+
+        Reviewed by Timothy Hatcher.
+
+        * features.json:
+
+2016-02-12  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: disambiguate the various identifier and connection types in RemoteInspector
+        https://bugs.webkit.org/show_bug.cgi?id=154130
+
+        Reviewed by Joseph Pecoraro.
+
+        There are multiple identifier types:
+            - connection identifier, a string UUID for a remote debugger process.
+            - session identifier, a string UUID for a remote driver/debugger instance.
+            - page/target identifier, a number unique within a single process.
+
+        There are multiple connection types:
+            - RemoteInspectorXPCConnection, a connection from RemoteInspectorXPCConnectionor to a relay.
+            - RemoteConnectionToTarget, a class that bridges to targets' dispatch queues.
+
+        Use consistent variable and getter names so that these don't get confused and
+        so that the code is easier to read. This is especially an improvement when working
+        with multiple target types or connection types within the same function.
+
+        * inspector/remote/RemoteConnectionToTarget.h:
+        * inspector/remote/RemoteConnectionToTarget.mm:
+        Remove the member for m_identifier since we can ask the target for its target identifier
+        or use a default value via WTF::Optional. There's no reason to cache the value.
+
+        (Inspector::RemoteTargetHandleRunSourceWithInfo):
+        (Inspector::RemoteConnectionToTarget::targetIdentifier):
+        (Inspector::RemoteConnectionToTarget::destination):
+        (Inspector::RemoteConnectionToTarget::setup):
+        (Inspector::RemoteConnectionToTarget::sendMessageToFrontend):
+        Bail out if the target pointer was somehow cleared and we can't get a useful target identifier.
+
+        (Inspector::RemoteConnectionToTarget::RemoteConnectionToTarget): Deleted.
+        * inspector/remote/RemoteControllableTarget.h:
+        * inspector/remote/RemoteInspectionTarget.cpp:
+        (Inspector::RemoteInspectionTarget::pauseWaitingForAutomaticInspection):
+        (Inspector::RemoteInspectionTarget::unpauseForInitializedInspector):
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::nextAvailableTargetIdentifier):
+        (Inspector::RemoteInspector::registerTarget):
+        (Inspector::RemoteInspector::unregisterTarget):
+        (Inspector::RemoteInspector::updateTarget):
+        (Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
+        (Inspector::RemoteInspector::sendAutomaticInspectionCandidateMessage):
+        (Inspector::RemoteInspector::sendMessageToRemote):
+        (Inspector::RemoteInspector::setupFailed):
+        (Inspector::RemoteInspector::setupCompleted):
+        (Inspector::RemoteInspector::stopInternal):
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        (Inspector::RemoteInspector::listingForInspectionTarget):
+        (Inspector::RemoteInspector::listingForAutomationTarget):
+        (Inspector::RemoteInspector::pushListingsNow):
+        (Inspector::RemoteInspector::pushListingsSoon):
+        (Inspector::RemoteInspector::updateHasActiveDebugSession):
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        (Inspector::RemoteInspector::receivedDataMessage):
+        (Inspector::RemoteInspector::receivedDidCloseMessage):
+        (Inspector::RemoteInspector::receivedIndicateMessage):
+        (Inspector::RemoteInspector::receivedProxyApplicationSetupMessage):
+        (Inspector::RemoteInspector::receivedConnectionDiedMessage):
+        (Inspector::RemoteInspector::receivedAutomaticInspectionRejectMessage):
+        (Inspector::RemoteInspector::nextAvailableIdentifier): Deleted.
+        * inspector/remote/RemoteInspectorConstants.h:
+
+2016-02-12  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] On x86, improve the selection of which value are selected for the UseDef part of commutative operations
+        https://bugs.webkit.org/show_bug.cgi?id=154151
+
+        Reviewed by Filip Pizlo.
+
+        Previously, when an instruction destroy an argument with
+        a UseDef use, we would try to pick a good target for the UseDef
+        while doing instruction selection.
+
+        For example:
+            @x = Add(@1, @2)
+
+        can be lowered to:
+            Move @1 Tmp3
+            Add @2 Tmp3
+        or
+            Move @2 Tmp3
+            Add @1 Tmp3
+
+        The choice of which value ends up copied is done by preferRightForResult()
+        at lowering time.
+
+        There are two common problems with the code we generate:
+        1) It is based on UseCount. If a value is at its last use,
+           it is a good target for coalescing even with a use-count > 1.
+        2) When both values are at their last use, the best choice
+           depends on the register pressure of each. We don't have that information
+           until we do register allocation.
+
+        This patch implements a simple idea to minimize how many of those Moves are needed.
+        Each commutative operation gets a 3 op variant. The register allocator then attempts
+        to alias *both* of them to the destination.
+        Since our aliasing is conservative, it removes as many copy as possible without causing
+        spilling.
+
+        There was an unexpected cool impovement too. If you have:
+            Move Tmp1, Tmp2
+            BranchAdd32 Tmp3, Tmp2
+        we would previously restore Tmp2 by substracting Tmp3 from the result.
+        We can now just use Tmp1. That removes quite a few Sub from the slow paths.
+
+        The problem is that simple idea uncoverred a bunch of issues that had to be fixed too.
+        I detail them inline below.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::and64):
+        * assembler/MacroAssemblerX86Common.h:
+        Most addition are adding an Address version of the 3 operands opcodes.
+        The reason for this is allow the complex addressing forms of instructions
+        when spilling.
+
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::moveDouble):
+        This was an unexpected discovery: removing tons of Move32 made floating-point heavy
+        code much slower.
+
+        It turns out the MoveDouble we were using has partial register dependencies.
+
+        The x86 optimization manual, Chapter 3, section 3.4.1.13 lists the move instructions executed
+        directly on the frontend. That's what we use now.
+
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::addFloat):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::mulFloat):
+        (JSC::MacroAssemblerX86Common::andDouble):
+        (JSC::MacroAssemblerX86Common::andFloat):
+        (JSC::MacroAssemblerX86Common::xorDouble):
+        (JSC::MacroAssemblerX86Common::xorFloat):
+        If the destination is not aliased, the version taking an address
+        use LoadFloat/LoadDouble instead of direct addressing.
+
+        That is because this:
+            Move Tmp1, Tmp2
+            Op [Tmp3], Tmp2
+        is slower than
+            Move [Tmp3] Tmp2
+            Op Tmp1, Tmp2
+        (sometimes significantly).
+
+        I am not exactly sure why.
+
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::and64):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::and64):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::mul32):
+        (JSC::MacroAssemblerX86Common::or32):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::moveDouble):
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::addFloat):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::mulFloat):
+        (JSC::MacroAssemblerX86Common::andDouble):
+        (JSC::MacroAssemblerX86Common::andFloat):
+        (JSC::MacroAssemblerX86Common::xorDouble):
+        (JSC::MacroAssemblerX86Common::xorFloat):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::and64):
+        (JSC::MacroAssemblerX86_64::mul64):
+        (JSC::MacroAssemblerX86_64::xor64):
+        (JSC::MacroAssemblerX86_64::branchAdd64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movapd_rr):
+        (JSC::X86Assembler::movaps_rr):
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::shouldTryAliasingDef):
+        (JSC::B3::CheckSpecial::generate):
+        * b3/B3CheckSpecial.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::PatchCustom::shouldTryAliasingDef):
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::shouldTryAliasingDef):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        Aliasing the operands is done the same way as any coalescing.
+
+        There were problem with considering all those coalescing
+        as equivalent for the result.
+
+        Moves are mostly generated for Upsilon-Phis. Getting rid of
+        those tends to give better loops.
+
+        Sometimes, blocks have only Phis and a Jump. Coalescing
+        those moves gets rids of the block entirely.
+
+        Where it go interesting was that something like:
+            Move Tmp1, Tmp2
+            Op Tmp3, Tmp2
+        was significantly better than:
+            Op Tmp1, Tmp3
+            Move Tmp1, Tmp4
+        even in the same basic block.
+
+        To get back to the same performance when, I had to prioritize
+        regular Moves operations over argument coalescing.
+
+        Another argument for doing this is that the alias has a shorter
+        life in the hardware because the operation itself gets a new
+        virtual register from the bank.
+
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirSpecial.cpp:
+        (JSC::B3::Air::Special::shouldTryAliasingDef):
+        * b3/air/AirSpecial.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testCheckAddArgumentAliasing64):
+        (JSC::B3::testCheckAddArgumentAliasing32):
+        (JSC::B3::testCheckAddSelfOverflow64):
+        (JSC::B3::testCheckAddSelfOverflow32):
+        (JSC::B3::testCheckMulArgumentAliasing64):
+        (JSC::B3::testCheckMulArgumentAliasing32):
+        (JSC::B3::run):
+
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitSaveOrCopyCalleeSavesFor):
+        This ruined my week.
+
+        When regenerating the frame of an inlined function that
+        was called through a tail call, we were ignoring r13 for some reason.
+
+        Since this patch makes it more likely to increase the degree
+        of each Tmp, the number of register used increased and r13 was more
+        commonly used.
+
+        When getting out of OSRExit, we would have that value trashed :(
+
+        The fix is simply to restore it like the other two Baseline callee saved
+        register.
+
+2016-02-12  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement @@search
+        https://bugs.webkit.org/show_bug.cgi?id=143889
+
+        Reviewed by Darin Adler.
+
+        Implement RegExp.prototype[@@search].
+        In ES6, String.prototype.search delegates the actual matching to it
+        instead of executing RegExp matching inside String.prototype.search method itself.
+        By customizing @@search method, we can change the behavior of String.prototype.search for
+        derived / customized RegExp object.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * builtins/BuiltinNames.h:
+        (JSC::BuiltinNames::BuiltinNames): Deleted.
+        * builtins/BuiltinUtils.h:
+        * builtins/StringPrototype.js:
+        (search):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::finishCreation):
+        (JSC::regExpProtoFuncSearch):
+        * runtime/RegExpPrototype.h:
+        (JSC::RegExpPrototype::create):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::getOwnPropertySlot):
+        (JSC::StringPrototype::finishCreation): Deleted.
+        (JSC::stringProtoFuncSearch): Deleted.
+        * runtime/StringPrototype.h:
+        * tests/es6.yaml:
+        * tests/stress/regexp-search.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (errorKey.toString):
+        (primitive.of.primitives.shouldThrow):
+        (testRegExpSearch):
+        (testSearch):
+        (testBoth):
+        (alwaysUnmatch):
+
+2016-02-12  Keith Miller  <keith_miller@apple.com>
+
+        AdaptiveInferredPropertyValueWatchpoint can trigger a GC that frees its CodeBlock and thus itself
+        https://bugs.webkit.org/show_bug.cgi?id=154146
+
+        Reviewed by Filip Pizlo.
+
+        Consider the following: there is some CodeBlock, C, that is watching some object, O, with a
+        structure, S, for replacements. Also, suppose that C has no references anymore and is due to
+        be GCed. Now, when some new property is added to O, S will create a new structure S' and
+        fire its transition watchpoints. Since C is watching S for replacements it will attempt to
+        have its AdaptiveInferredPropertyValueWatchpoint relocate itself to S'. To do so, it needs
+        it allocate RareData on S'. This allocation may cause a GC, which frees C while still
+        executing its watchpoint handler. The solution to this is to defer GC while running
+        AdaptiveInferredPropertyValueWatchpointBase handlers.
+
+        * bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp:
+        (JSC::AdaptiveInferredPropertyValueWatchpointBase::fire):
+
+2016-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Separate out !allowsAccess path in JSDOMWindowCustom getOwnPropertySlot
+        https://bugs.webkit.org/show_bug.cgi?id=154156
+
+        Reviewed by Chris Dumez.
+
+        * runtime/CommonIdentifiers.h:
+            - added new property names, needed by jsDOMWindowGetOwnPropertySlotDisallowAccess.
+
+2016-02-12  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Update ICU header files to version 52
+        https://bugs.webkit.org/show_bug.cgi?id=154160
+
+        Reviewed by Alex Christensen.
+
+        Update ICU header files to version 52 to allow the use of newer APIs.
+
+        * icu/unicode/localpointer.h:
+        * icu/unicode/platform.h:
+        * icu/unicode/ptypes.h:
+        * icu/unicode/putil.h:
+        * icu/unicode/ucal.h:
+        * icu/unicode/uchar.h:
+        * icu/unicode/ucnv.h:
+        * icu/unicode/ucol.h:
+        * icu/unicode/uconfig.h:
+        * icu/unicode/udat.h:
+        * icu/unicode/udatpg.h:
+        * icu/unicode/udisplaycontext.h: Added.
+        * icu/unicode/uenum.h:
+        * icu/unicode/uformattable.h: Added.
+        * icu/unicode/uiter.h:
+        * icu/unicode/uloc.h:
+        * icu/unicode/umachine.h:
+        * icu/unicode/unorm2.h:
+        * icu/unicode/unum.h:
+        * icu/unicode/urename.h:
+        * icu/unicode/uscript.h:
+        * icu/unicode/uset.h:
+        * icu/unicode/ustring.h:
+        * icu/unicode/utf.h:
+        * icu/unicode/utf16.h:
+        * icu/unicode/utf8.h:
+        * icu/unicode/utf_old.h:
+        * icu/unicode/utypes.h:
+        * icu/unicode/uvernum.h:
+        * icu/unicode/uversion.h:
+
+2016-02-12  Filip Pizlo  <fpizlo@apple.com>
+
+        Fast path in JSObject::defineOwnIndexedProperty() forgets to check for the posibility of a descriptor that doesn't have a value
+        https://bugs.webkit.org/show_bug.cgi?id=154175
+        rdar://problem/24291497
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineOwnIndexedProperty): Fix the bug.
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry): Catch the bug sooner in debug.
+        (JSC::SparseArrayValueMap::putDirect):
+        * tests/stress/sparse-define-empty-descriptor.js: Added. This used to crash in release.
+
+2016-02-11  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: RemoteInspector's listings should include whether an AutomationTarget is paired
+        https://bugs.webkit.org/show_bug.cgi?id=154077
+        <rdar://problem/24589133>
+
+        Reviewed by Joseph Pecoraro.
+
+        Instead of not generating a listing for the target when it is occupied,
+        generate the listing with a 'paired' flag. The old flag was redundant
+        because a _WKAutomationDelegate will not create a session if it doesn't
+        support automation or it already has an active session.
+
+        * inspector/remote/RemoteAutomationTarget.cpp:
+        (Inspector::RemoteAutomationTarget::setIsPaired):
+        (Inspector::RemoteAutomationTarget::setAutomationAllowed): Deleted.
+        * inspector/remote/RemoteAutomationTarget.h:
+        Return false for remoteControlAllowed() if the target is already paired.
+        This function is used by RemoteInspector to deny incoming connections.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::listingForAutomationTarget):
+        * inspector/remote/RemoteInspectorConstants.h:
+
+2016-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ByteCodeParser needs to null check the result of presenceLike()
+        https://bugs.webkit.org/show_bug.cgi?id=154135
+        rdar://problem/24291586
+
+        Reviewed by Geoffrey Garen.
+
+        ByteCodeParser::presenceLike() could return a null object property condition if it detects a
+        contradiction. That could happen due to bogus profiling. It's totally OK - we just need to
+        bail from using a property condition when that happens.
+
+        * bytecode/ObjectPropertyCondition.h:
+        (JSC::ObjectPropertyCondition::equivalence):
+        (JSC::ObjectPropertyCondition::operator bool):
+        (JSC::ObjectPropertyCondition::object):
+        (JSC::ObjectPropertyCondition::condition):
+        (JSC::ObjectPropertyCondition::operator!): Deleted.
+        * bytecode/PropertyCondition.h:
+        (JSC::PropertyCondition::equivalence):
+        (JSC::PropertyCondition::operator bool):
+        (JSC::PropertyCondition::kind):
+        (JSC::PropertyCondition::uid):
+        (JSC::PropertyCondition::operator!): Deleted.
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::check):
+        (JSC::DFG::ByteCodeParser::load):
+
+2016-02-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] SqrtFloat and CeilFloat also suffer from partial register stalls
+        https://bugs.webkit.org/show_bug.cgi?id=154131
+
+        Reviewed by Filip Pizlo.
+
+        Looks like I forgot to update this when adding Float support.
+        Credit to Filip for finding this issue.
+
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+
+2016-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Cannot call initializeIndex() if we didn't create the array using tryCreateUninitialized()
+        https://bugs.webkit.org/show_bug.cgi?id=154126
+
+        Reviewed by Saam Barati.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSplice):
+
+2016-02-11  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        [INTL] Implement Intl.NumberFormat.prototype.resolvedOptions ()
+        https://bugs.webkit.org/show_bug.cgi?id=147602
+
+        Reviewed by Darin Adler.
+
+        This patch implements Intl.NumberFormat.prototype.resolvedOptions() according
+        to the ECMAScript 2015 Internationalization API spec (ECMA-402 2nd edition.)
+
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::localeData):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::localeData):
+        (JSC::computeCurrencySortKey):
+        (JSC::extractCurrencySortKey):
+        (JSC::computeCurrencyDigits):
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        (JSC::IntlNumberFormat::styleString):
+        (JSC::IntlNumberFormat::currencyDisplayString):
+        (JSC::IntlNumberFormat::resolvedOptions):
+        (JSC::IntlNumberFormat::setBoundFormat):
+        * runtime/IntlNumberFormat.h:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        (JSC::callIntlNumberFormat):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObject.cpp:
+        (JSC::intlNumberOption):
+        (JSC::numberingSystemsForLocale):
+        (JSC::getNumberingSystemsForLocale): Deleted.
+        * runtime/IntlObject.h:
+
+2016-02-11  Filip Pizlo  <fpizlo@apple.com>
+
+        MacroAssemblerX86 should be happy with shift(cx, cx)
+        https://bugs.webkit.org/show_bug.cgi?id=154124
+
+        Reviewed by Saam Barati.
+
+        Prior to this change the assembler asserted that shift_amount and dest cannot be the same.
+        That's a good assertion for when shift_amount is not in cx. But if it's in cx already then
+        it's OK for them to be the same. Air will sometimes do shift(cx, cx) if you do "x << x" and
+        the coalescing got particularly clever.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::lshift32):
+        (JSC::MacroAssemblerX86Common::rshift32):
+        (JSC::MacroAssemblerX86Common::urshift32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::lshift64):
+        (JSC::MacroAssemblerX86_64::rshift64):
+        (JSC::MacroAssemblerX86_64::urshift64):
+        * b3/testb3.cpp:
+        (JSC::B3::testLShiftSelf32):
+        (JSC::B3::testRShiftSelf32):
+        (JSC::B3::testURShiftSelf32):
+        (JSC::B3::testLShiftSelf64):
+        (JSC::B3::testRShiftSelf64):
+        (JSC::B3::testURShiftSelf64):
+        (JSC::B3::run):
+
+2016-02-11  Saam barati  <sbarati@apple.com>
+
+        The sampling profiler's stack walker methods should be marked with SUPPRESS_ASAN
+        https://bugs.webkit.org/show_bug.cgi?id=154123
+
+        Reviewed by Mark Lam.
+
+        The entire premise of the sampling profiler is to load from
+        another thread's memory. We should SUPPRESS_ASAN on the
+        methods that do this.
+
+        * runtime/SamplingProfiler.cpp:
+        (JSC::FrameWalker::FrameWalker):
+        (JSC::FrameWalker::walk):
+        (JSC::FrameWalker::advanceToParentFrame):
+        (JSC::FrameWalker::isAtTop):
+        (JSC::FrameWalker::resetAtMachineFrame):
+
+2016-02-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed typo fix after r190063.
+
+        * dfg/DFGSpeculativeJIT.cpp: Removed property svn:executable.
+        * dfg/DFGSpeculativeJIT.h: Removed property svn:executable.
+        * jit/JIT.h: Removed property svn:executable.
+        * jit/JITInlines.h: Removed property svn:executable.
+        * jit/JITOpcodes.cpp: Removed property svn:executable.
+
+2016-02-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed typo fix after r190063.
+
+        * dfg/DFGSpeculativeJIT.cpp: Removed property svn:executable.
+        * dfg/DFGSpeculativeJIT.h: Removed property svn:executable.
+        * jit/JIT.h: Removed property svn:executable.
+        * jit/JITInlines.h: Removed property svn:executable.
+        * jit/JITOpcodes.cpp: Removed property svn:executable.
+
+2016-02-10  Keith Miller  <keith_miller@apple.com>
+
+        Symbol.species accessors on builtin constructors should be configurable
+        https://bugs.webkit.org/show_bug.cgi?id=154097
+
+        Reviewed by Benjamin Poulain.
+
+        We did not have the Symbol.species accessors on our builtin constructors
+        marked as configurable. This does not accurately follow the ES6 spec as
+        the ES6 spec states that all default accessors on builtins should be
+        configurable. This means that we need an additional watchpoint on
+        ArrayConstructor to make sure that no users re-configures Symbol.species.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        (JSC::ArrayPrototype::setConstructor):
+        (JSC::ArrayPrototypeAdaptiveInferredPropertyWatchpoint::handleFire):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::didChangeConstructorOrSpeciesProperties):
+        (JSC::ArrayPrototype::didChangeConstructorProperty): Deleted.
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::finishCreation):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::finishCreation):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::JSTypedArrayViewConstructor::finishCreation):
+        * runtime/MapConstructor.cpp:
+        (JSC::MapConstructor::finishCreation):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::finishCreation):
+        * runtime/SetConstructor.cpp:
+        (JSC::SetConstructor::finishCreation):
+        * tests/stress/array-species-config-array-constructor.js: Added.
+        (A):
+        * tests/stress/symbol-species.js:
+        (testSymbolSpeciesOnConstructor):
+
+2016-02-10  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] The destination of Sqrt should be Def, not UseDef
+        https://bugs.webkit.org/show_bug.cgi?id=154086
+
+        Reviewed by Geoffrey Garen.
+
+        An unfortunate copy-paste: the destination of SqrtDouble and SqrtFloat
+        was defined as UseDef. As a result, the argument would be interfering
+        with everything defined prior.
+
+        * b3/air/AirOpcode.opcodes:
+
+2016-02-10  Chris Dumez  <cdumez@apple.com>
+
+        [Web IDL] interface objects should be Function objects
+        https://bugs.webkit.org/show_bug.cgi?id=154038
+        <rdar://problem/24569358>
+
+        Reviewed by Geoffrey Garen.
+
+        Update functionProtoFuncToString() to handle JSObjects that
+        have the TypeOfShouldCallGetCallData flag and are callable,
+        as these behave like functions and use ClassInfo::className()
+        as function name in this case.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+
+2016-02-10  Chris Dumez  <cdumez@apple.com>
+
+        Attributes on the Window instance should be configurable unless [Unforgeable]
+        https://bugs.webkit.org/show_bug.cgi?id=153920
+        <rdar://problem/24563211>
+
+        Reviewed by Darin Adler.
+
+        Marking the Window instance attributes as configurable but cause
+        getOwnPropertyDescriptor() to report them as configurable, as
+        expected. However, trying to delete them would actually lead to
+        unexpected behavior because:
+        - We did not reify custom accessor properties (most of the Window
+          properties are custom accessors) upon deletion.
+        - For non-reified static properties marked as configurable,
+          JSObject::deleteProperty() would attempt to call the property
+          setter with undefined. As a result, calling delete window.name
+          would cause window.name to become the string "undefined" instead
+          of the undefined value.
+
+        * runtime/JSObject.cpp:
+        (JSC::getClassPropertyNames):
+        Now that we reify ALL properties, we only need to check the property table
+        if we have not reified. As a result, I dropped the 'didReify' parameter for
+        this function and instead only call this function if we have not yet reified.
+
+        (JSC::JSObject::putInlineSlow):
+        Only call putEntry() if we have not reified: Drop the
+        '|| !(entry->attributes() & BuiltinOrFunctionOrAccessor)'
+        check as such properties now get reified as well.
+
+        (JSC::JSObject::deleteProperty):
+        - Call reifyAllStaticProperties() instead of reifyStaticFunctionsForDelete()
+          so that we now reify all properties upon deletion, including the custom
+          accessors. reifyStaticFunctionsForDelete() is now removed and the same
+          reification function is now used by: deletion, getOwnPropertyDescriptor()
+          and eager reification of the prototype objects in the bindings.
+        - Drop code that falls back to calling the static property setter with
+          undefined if we cannot find the property in the property storage. As
+          we now reify ALL properties, the code removing the property from the
+          property storage should succeed, provided that the property actually
+          exists.
+
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        Only call getClassPropertyNames() if we have not reified. We should no longer
+        check the static property table after reifying now that we reify all
+        properties.
+
+        (JSC::JSObject::reifyAllStaticProperties):
+        Merge with reifyStaticFunctionsForDelete(). The only behavior change is the
+        flattening to an uncacheable dictionary, like reifyStaticFunctionsForDelete()
+        used to do.
+
+        * runtime/JSObject.h:
+
+2016-02-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196251.
+        https://bugs.webkit.org/show_bug.cgi?id=154078
+
+        Large regression on Dromaeo needs explanation (Requested by
+        kling on #webkit).
+
+        Reverted changeset:
+
+        "Visiting a WeakBlock should report bytes visited, since we
+        reported them allocated."
+        https://bugs.webkit.org/show_bug.cgi?id=153978
+        http://trac.webkit.org/changeset/196251
+
+2016-02-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r196331): It made ~180 JSC tests crash on ARMv7 Linux
+        https://bugs.webkit.org/show_bug.cgi?id=154064
+
+        Reviewed by Mark Lam.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate): Added EABI_32BIT_DUMMY_ARG where it is necessary.
+        * dfg/DFGSpeculativeJIT.h: Fixed the comment.
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState): Added.
+        * wasm/WASMFunctionCompiler.h: Fixed the comment.
+
+2016-02-09  Keith Miller  <keith_miller@apple.com>
+
+        calling methods off super in a class constructor should check for TDZ
+        https://bugs.webkit.org/show_bug.cgi?id=154060
+
+        Reviewed by Ryosuke Niwa.
+
+        In a class constructor we need to check for TDZ when calling a method
+        off the super class. This is because, for super method calls, we use
+        the derived class's newly constructed object as the super method's
+        this value.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+        * tests/stress/super-method-calls-check-tdz.js: Added.
+        (Base):
+        (Derived):
+        (test):
+
+2016-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't crash if we fail to parse a builtin
+        https://bugs.webkit.org/show_bug.cgi?id=154047
+        rdar://problem/24300617
+
+        Reviewed by Mark Lam.
+
+        Crashing probably seemed like a good idea at the time, but we could get here in case of a
+        near stack overflow, so that the parser bails because of recursion.
+
+        * parser/Parser.h:
+        (JSC::parse):
+
+2016-02-07  Gavin Barraclough  <barraclough@apple.com>
+
+        GetValueFunc/PutValueFunc should not take both slotBase and thisValue
+        https://bugs.webkit.org/show_bug.cgi?id=154009
+
+        Reviewed by Geoff Garen.
+
+        In JavaScript there are two types of properties - regular value properties, and accessor properties.
+        One difference between these is how they are reflected by getOwnPropertyDescriptor, and another is
+        what object they operate on in the case of a prototype access. If you access a value property of a
+        prototype object it return a value pertinent to the prototype, but in the case of a prototype object
+        returning an accessor, then the accessor function is applied to the base object of the access.
+
+        JSC supports special 'custom' properties implemented as a c++ callback, and these custom properties
+        can be used to implement either value- or accessor-like behavior. getOwnPropertyDescriptor behavior
+        is selected via the CustomAccessor attribute. Value- or accessor-like object selection is current
+        supported by passing both the slotBase and the thisValue to the callback,and hoping it uses the
+        right one. This is probably inefficient, bug-prone, and leads to crazy like JSBoundSlotBaseFunction.
+
+        Instead, just pass one thisValue to the callback functions, consistent with CustomAccessor.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Parent>::getStaticValue):
+        (JSC::JSCallbackObject<Parent>::staticFunctionGetter):
+        (JSC::JSCallbackObject<Parent>::callbackGetter):
+            - Merged slotBase & thisValue to custom property callbacks.
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::generate):
+            - Modified the call being JIT generated - GetValueFunc/PutValueFunc now only take 3,
+              rather than 4 arguments. Selects which one to keep/drop based on access type.
+        (WTF::printInternal):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::isGet):
+        (JSC::AccessCase::isPut):
+        (JSC::AccessCase::isIn):
+        (JSC::AccessCase::doesCalls):
+        (JSC::AccessCase::isGetter):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+            - Split the CustomGetter/Setter access types into Value/Accessor variants.
+        * jsc.cpp:
+        (WTF::CustomGetter::getOwnPropertySlot):
+        (WTF::CustomGetter::customGetter):
+        (WTF::RuntimeArray::RuntimeArray):
+        (WTF::RuntimeArray::lengthGetter):
+            - Merged slotBase & thisValue to custom property callbacks.
+        * runtime/CustomGetterSetter.cpp:
+        (JSC::callCustomSetter):
+            - Pass 3 arguments when calling PutValueFunc.
+        * runtime/CustomGetterSetter.h:
+        * runtime/JSBoundSlotBaseFunction.cpp:
+        (JSC::boundSlotBaseFunctionCall):
+        (JSC::JSBoundSlotBaseFunction::JSBoundSlotBaseFunction):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+            - callCustomSetter currently takes a flag to distinguish value/accessor calls.
+        * runtime/JSFunction.cpp:
+        (JSC::retrieveArguments):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::retrieveCallerFunction):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::nameGetter):
+        * runtime/JSFunction.h:
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::visitChildren):
+        (JSC::callbackGetter):
+            - Merged slotBase & thisValue to custom property callbacks.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putInlineSlow):
+            - callCustomSetter currently takes a flag to distinguish value/accessor calls.
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+            - split PutPropertySlot setCustom into Value/Accessor variants.
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        (JSC::PropertySlot::customGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::getValue):
+            - added customGetter helper to call GetValueFunc.
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::setCustomValue):
+        (JSC::PutPropertySlot::setCustomAccessor):
+        (JSC::PutPropertySlot::setThisValue):
+        (JSC::PutPropertySlot::customSetter):
+        (JSC::PutPropertySlot::context):
+        (JSC::PutPropertySlot::isStrictMode):
+        (JSC::PutPropertySlot::isCacheablePut):
+        (JSC::PutPropertySlot::isCacheableSetter):
+        (JSC::PutPropertySlot::isCacheableCustom):
+        (JSC::PutPropertySlot::isCustomAccessor):
+        (JSC::PutPropertySlot::isInitialization):
+        (JSC::PutPropertySlot::cachedOffset):
+        (JSC::PutPropertySlot::setCustomProperty): Deleted.
+            - split PutPropertySlot setCustom into Value/Accessor variants.
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getOwnPropertySlot):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::defineOwnProperty):
+        (JSC::regExpObjectSetLastIndexStrict):
+        (JSC::regExpObjectSetLastIndexNonStrict):
+        (JSC::RegExpObject::put):
+            - Merged slotBase & thisValue to custom property callbacks.
+
+2016-02-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Spread expressions are not fair game for direct binding
+        https://bugs.webkit.org/show_bug.cgi?id=154042
+        rdar://problem/24291413
+
+        Reviewed by Saam Barati.
+
+        Prior to this change we crashed on this:
+
+            var [x] = [...y];
+
+        Because NodesCodegen thinks that this is a direct binding.  It's not, because we cannot
+        directly generate bytecode for "...y".  This is a unique property of spread expressions, so
+        its sufficient to just bail out of direct binding if we see a spread expression. That's what
+        this patch does.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ArrayPatternNode::emitDirectBinding):
+        * tests/stress/spread-in-tail.js: Added.
+        (foo):
+        (catch):
+
+2016-02-09  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196286.
+        https://bugs.webkit.org/show_bug.cgi?id=154026
+
+        Looks like 5% iOS PLT regression (Requested by kling on
+        #webkit).
+
+        Reverted changeset:
+
+        "[iOS] Throw away some unlinked code when navigating to a new
+        page."
+        https://bugs.webkit.org/show_bug.cgi?id=154014
+        http://trac.webkit.org/changeset/196286
+
+2016-02-08  Keith Miller  <keith_miller@apple.com>
+
+        Error construction for inlined operations should not use the inliner's CodeBlock
+        https://bugs.webkit.org/show_bug.cgi?id=154021
+
+        Reviewed by Mark Lam.
+
+        Previously, if one function, A, was inlined into another function, B, in the DFG/FTL
+        we would use B's DFG/FTL CodeBlock to construct source information about the Error.
+        We would correctly compute the bytecodeOffset in A for the an expression but we would
+        not use one of A's CodeBlocks when looking up source. This caused crashes during
+        operationIn as we expected to be able to find the text "in" in the source.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::appendSourceToError):
+        * tests/stress/inlined-error-gets-correct-codeblock-for-bytecodeoffset.js: Added.
+        (map):
+        (n):
+        (one):
+        (catch):
+
+2016-02-08  Saam Barati  <sbarati@apple.com>
+
+        runtimeTypeForValue should protect against seeing TDZ value
+        https://bugs.webkit.org/show_bug.cgi?id=154023
+        rdar://problem/24291413
+
+        Reviewed by Michael Saboff.
+
+        There are a few back traces I've seen from crashes that bottom out
+        inside runtimeTypeForValue. I haven't been able to reproduce
+        any such crash, but it's likely that we're encountering the
+        empty JSValue. It's better to just have this function protect
+        against seeing the empty value instead of dereferencing a null
+        pointer when it thinks the value is a cell.
+
+        * runtime/RuntimeType.cpp:
+        (JSC::runtimeTypeForValue):
+
+2016-02-08  Andreas Kling  <akling@apple.com>
+
+        [iOS] Throw away some unlinked code when navigating to a new page.
+        <https://webkit.org/b/154014>
+
+        Reviewed by Gavin Barraclough.
+
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllCodeExceptCaches):
+        (JSC::VM::deleteAllLinkedCode): Deleted.
+        * runtime/VM.h:
+
+2016-02-08  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::foldPathConstants() needs to execute its insertion set
+        https://bugs.webkit.org/show_bug.cgi?id=154020
+
+        Reviewed by Saam Barati.
+
+        * b3/B3FoldPathConstants.cpp:
+        * b3/testb3.cpp:
+        (JSC::B3::testFoldPathEqual): Added this. It used to crash in validation.
+        (JSC::B3::run):
+
+2016-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Introduce @isObject bytecode intrinsic and use it instead of JS implemented one
+        https://bugs.webkit.org/show_bug.cgi?id=153976
+
+        Reviewed by Darin Adler.
+
+        Use bytecode op_is_object directly.
+
+        * builtins/GlobalObject.js:
+        (isObject): Deleted.
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_toString):
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_isObject):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Deleted.
+
+2016-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        {Map,Set}.prototype.forEach should be visible as own properties
+        https://bugs.webkit.org/show_bug.cgi?id=153974
+
+        Reviewed by Darin Adler.
+
+        Now, Map and Set uses builtin tables. We should inlude it in class info.
+
+        * runtime/MapPrototype.cpp:
+        * runtime/SetPrototype.cpp:
+
+2016-02-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Baseline JIT should not require its input to be constant-propagated
+        https://bugs.webkit.org/show_bug.cgi?id=154011
+        rdar://problem/24290933
+
+        Reviewed by Mark Lam.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBitBinaryOpFastPath):
+        (JSC::JIT::emitRightShiftFastPath):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mul):
+
+2016-02-08  Filip Pizlo  <fpizlo@apple.com>
+
+        CodeCache should give up on evals if there are variables under TDZ
+        https://bugs.webkit.org/show_bug.cgi?id=154002
+        rdar://problem/24300998
+
+        Reviewed by Mark Lam.
+
+        Disable the code cache optimization because our approach to TDZ for scoped variables - using
+        a separate check_tdz opcode when logically it's the get_from_scope's job to do it - makes
+        caching code impossible if there are any variables in TDZ.
+
+        We should do the right thing in the future, and fold the TDZ check into the get_from_scope.
+        This is better not only because it will restore caching, but because our bytecode for heap
+        accesses is usually at the highest practically doable level of abstraction, so that ICs,
+        compilers and caches can see the intended meaning of the bytecode more easily.
+
+        This doesn't appear to slow anything down, but that's just because we don't have enough ES6
+        benchmarks. I've filed: https://bugs.webkit.org/show_bug.cgi?id=154010
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+
+2016-02-08  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Using 'super' in arrow function that declared out of the class should lead to Syntax error
+        https://bugs.webkit.org/show_bug.cgi?id=150893
+
+        Reviewed by Saam Barati.
+
+        'super' and 'super()' inside of the arrow function should lead to syntax error if they are used 
+        out of the class context or they wrapped by ordinary function. Now JSC returns ReferenceError but 
+        should return SyntaxError according to the following specs:
+        http://www.ecma-international.org/ecma-262/6.0/#sec-function-definitions-static-semantics-early-errors
+        and http://www.ecma-international.org/ecma-262/6.0/#sec-arrow-function-definitions-runtime-semantics-evaluation 
+        Curren patch implemented only one case when super/super() are used inside of the arrow function
+        Case when super/super() are used within the eval:
+           class A {} 
+           class B extends A { 
+               costructor() { eval("super()");} 
+           }
+        is not part of this patch and will be implemented in this issue https://bugs.webkit.org/show_bug.cgi?id=153864. 
+        The same for case when eval with super/super() is invoked in arrow function will be 
+        implemented in issue https://bugs.webkit.org/show_bug.cgi?id=153977. 
+ 
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::setExpectedSuperBinding):
+        (JSC::Scope::expectedSuperBinding):
+        (JSC::Scope::setConstructorKind):
+        (JSC::Scope::constructorKind):
+        (JSC::Parser::closestParentNonArrowFunctionNonLexicalScope):
+        * tests/stress/arrowfunction-lexical-bind-supercall-4.js:
+        * tests/stress/arrowfunction-lexical-bind-superproperty.js:
+
+2016-02-08  Filip Pizlo  <fpizlo@apple.com>
+
+        Parser should detect error before calls to parseAssignmentExpression()
+        https://bugs.webkit.org/show_bug.cgi?id=153975
+        rdar://problem/24291231
+
+        Reviewed by Saam Barati.
+
+        Fixes a very hard-to-create situation that an internal test picked up.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseVariableDeclarationList):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+
+2016-02-08  Andreas Kling  <akling@apple.com>
+
+        Visiting a WeakBlock should report bytes visited, since we reported them allocated.
+        <https://webkit.org/b/153978>
+
+        Reviewed by Darin Adler.
+
+        When creating a WeakBlock, we tell Heap that we've allocated 1 KB (WeakBlock::blockSize)
+        of memory. Consequently, when visiting a WeakBlock, we should also report 1 KB of memory
+        visited. Otherwise Heap will think that those 1 KB already went away.
+
+        This was causing us to underestimate heap size, which affects collection scheduling.
+
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::reportMemoryVisited):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::visit):
+
+2016-02-07  Saam barati  <sbarati@apple.com>
+
+        Follow up patch to: [ES6] bound functions .name property should be "bound " + the target function's name 
+        https://bugs.webkit.org/show_bug.cgi?id=153796
+
+        Reviewed by Darin Adler.
+
+        This follow-up patch addresses some comments/suggestions by
+        Ryosuke, Darin, and Joe. It simplifies JSBoundFunction::toStringName
+        and adds some tests for bound names.
+
+        * runtime/JSBoundFunction.cpp:
+        (JSC::hasInstanceBoundFunction):
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::toStringName):
+
+2016-02-07  Filip Pizlo  <fpizlo@apple.com>
+
+        String.match should defend against matches that would crash the VM
+        https://bugs.webkit.org/show_bug.cgi?id=153964
+        rdar://problem/24301119
+
+        Reviewed by Saam Barati.
+
+        This fixes a crash in an internal test case.
+
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::slowAppend): Use best practices to ensure that the size we
+            compute makes sense. Crash if it stops making sense, since most users of this API assume
+            that they are creating something small enough to fit on the stack.
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::size):
+        (JSC::MarkedArgumentBuffer::operator new): Deleted. These were ineffective. According to the
+            debugger, we were still calling system malloc. So, I changed the code to use fastMalloc()
+            directly.
+        (JSC::MarkedArgumentBuffer::operator delete): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch): Explicitly defend against absurd sizes. Of course, it's still
+            possible to crash the VM on OOME. That's sort of always been the philosophy of JSC - we
+            don't guarantee that you'll get a nice-looking error whenever you run out of memory,
+            since in a GC'd environment you can't really guarantee those things. But, if you have a
+            match that obvious won't fit in memory, then reporting an error is useful in case this is
+            a developer experimenting with a buggy regexp.
+
+2016-02-07  Dan Bernstein  <mitz@apple.com>
+
+        [Cocoa] Replace __has_include guards around inclusion of Apple-internal-SDK headers with USE(APPLE_INTERNAL_SDK)
+        https://bugs.webkit.org/show_bug.cgi?id=153963
+
+        Reviewed by Sam Weinig.
+
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+
+2016-02-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL must store the call site index before runtime calls, even if it's the tail call slow path
+        https://bugs.webkit.org/show_bug.cgi?id=153955
+        rdar://problem/24290970
+
+        Reviewed by Saam Barati.
+
+        This is necessary because you could throw an exception in a host call on the tail call's slow
+        path. That'll route us to lookupExceptionHandler(), which unwinds starting with the call site
+        index of our frame. Bad things happen if it's not set. Prior to this patch it was possible
+        for the call site index field to be uninitialized, which meant that the throwing machinery
+        was making a wild guess about where we are.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        * tests/stress/tail-call-host-call-throw.js: Added.
+
+2016-02-06  Darin Adler  <darin@apple.com>
+
+        Finish auditing call sites of upper() and lower(), eliminate many, and rename the functions
+        https://bugs.webkit.org/show_bug.cgi?id=153905
+
+        Reviewed by Sam Weinig.
+
+        * runtime/IntlObject.cpp:
+        (JSC::canonicalLangTag): Use converToASCIIUppercase on the language tag.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncToLowerCase): Tweak style and update for name change.
+        (JSC::stringProtoFuncToUpperCase): Ditto.
+
+2016-02-06  Chris Dumez  <cdumez@apple.com>
+
+        Object.getOwnPropertyDescriptor() does not work on sub-frame's window
+        https://bugs.webkit.org/show_bug.cgi?id=153925
+
+        Reviewed by Darin Adler.
+
+        Calling Object.getOwnPropertyDescriptor() on a sub-frame's window was
+        returning undefined for that window's own properties. The reason was
+        that the check getOwnPropertySlot() is using to make sure the
+        PropertySlot is not for a property coming from the prototype was wrong.
+
+        The check was checking that 'this != slotBase' which works fine unless
+        this is a JSProxy (e.g. JSDOMWindowShell). To handle proxies, the code
+        was also checking that 'slotBase.toThis() != this', attempting to
+        get the slotBase/Window's proxy. However, due to the implementation of
+        toThis(), we were getting the lexical global object's proxy instead of
+        slotBase's proxy. To avoid this issue, the new code explicitly checks
+        if 'this' is a JSProxy and makes sure 'JSProxy::target() != slotBase',
+        instead of using toThis().
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+
+2016-02-06  Andreas Kling  <akling@apple.com>
+
+        [iOS] Throw away linked code when navigating to a new page.
+        <https://webkit.org/b/153851>
+
+        Reviewed by Gavin Barraclough.
+
+        Add a VM API for throwing away linked code only.
+
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllLinkedCode):
+        * runtime/VM.h:
+
+2016-02-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196104.
+        https://bugs.webkit.org/show_bug.cgi?id=153940
+
+        Regressed Speedometer on iOS (Requested by kling on #webkit).
+
+        Reverted changeset:
+
+        "[iOS] Throw away linked code when navigating to a new page."
+        https://bugs.webkit.org/show_bug.cgi?id=153851
+        http://trac.webkit.org/changeset/196104
+
+2016-02-05  Alex Christensen  <achristensen@webkit.org>
+
+        Fix internal Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=153930
+        <rdar://problem/24534864>
+
+        Reviewed by Mark Lam.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj:
+        I made a typo in r196144.
+
+2016-02-05  Saam barati  <sbarati@apple.com>
+
+        Web Inspector: Include SamplingProfiler's expression-level data for stack frames in the protocol
+        https://bugs.webkit.org/show_bug.cgi?id=153455
+        <rdar://problem/24335884>
+
+        Reviewed by Joseph Pecoraro.
+
+        We now send the sampling profiler's expression-level
+        line/column info in the inspector protocol.
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::buildSamples):
+        * inspector/protocol/ScriptProfiler.json:
+        * runtime/SamplingProfiler.h:
+        (JSC::SamplingProfiler::StackFrame::hasExpressionInfo):
+
+2016-02-05  Saam barati  <sbarati@apple.com>
+
+        follow-up to: JSC Sampling Profiler: (host) is confusing in cases where I would expect to see JS name
+        https://bugs.webkit.org/show_bug.cgi?id=153663
+        <rdar://problem/24415092>
+
+        Rubber stamped by Joseph Pecoraro.
+
+        We were performing operations that required us to
+        hold the VM lock even when we might not have been holding it.
+        We now ensure we're holding it.
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+
+2016-02-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Arrayify for a typed array shouldn't create a monster
+        https://bugs.webkit.org/show_bug.cgi?id=153908
+        rdar://problem/24290639
+
+        Reviewed by Mark Lam.
+
+        Previously if you convinced the DFG to emit an Arrayify to ArrayStorage and then gave it a
+        typed array, you'd corrupt the object.
+
+        * runtime/JSArrayBufferView.cpp:
+        (WTF::printInternal):
+        * runtime/JSArrayBufferView.h:
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+        (JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::copyButterfly):
+        (JSC::JSObject::enterDictionaryIndexingMode):
+        (JSC::JSObject::ensureInt32Slow):
+        (JSC::JSObject::ensureDoubleSlow):
+        (JSC::JSObject::ensureContiguousSlow):
+        (JSC::JSObject::ensureArrayStorageSlow):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::getBoundSlotBaseFunctionForGetterSetter):
+        * runtime/Structure.h:
+        * tests/stress/arrayify-array-storage-typed-array.js: Added. This test failed.
+        * tests/stress/arrayify-int32-typed-array.js: Added. This test case already had other protections, but we beefed them up.
+
+2016-02-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: InspectorTimelineAgent doesn't need to recompile functions because it now uses the sampling profiler
+        https://bugs.webkit.org/show_bug.cgi?id=153500
+        <rdar://problem/24352458>
+
+        Reviewed by Timothy Hatcher.
+
+        Be more explicit about enabling legacy profiling.
+
+        * jsc.cpp:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::hasLegacyProfiler):
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        (JSC::JSGlobalObject::hasProfiler): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsLegacyProfiling):
+        (JSC::JSGlobalObject::supportsProfiling): Deleted.
+
+2016-02-04  Keith Miller  <keith_miller@apple.com>
+
+        ArrayPrototype should have a destroy function
+        https://bugs.webkit.org/show_bug.cgi?id=153847
+
+        Reviewed by Filip Pizlo.
+
+        ArrayPrototype should have an destroy function as it now has a unique_ptr member that
+        needs to be freed at the end of the object's life cycle. Also, this patch adds an
+        option, gcAtEnd, that will cause jsc.cpp to do a garbage collection before exiting.
+
+        * jsc.cpp:
+        (runJSC):
+        (jscmain):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::create):
+        (JSC::ArrayPrototype::destroy):
+        * runtime/ArrayPrototype.h:
+        * runtime/Options.h:
+
+2016-02-04  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(192409): Cannot rely on add32() to zero-extend
+        https://bugs.webkit.org/show_bug.cgi?id=153897
+
+        Unreviewed rollout of r192409.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::add32):
+        (JSC::MacroAssemblerARM64::add64):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::add32):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::add32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::add8):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::generateTest32):
+        (JSC::MacroAssemblerX86Common::clz32AfterBsr):
+        (JSC::MacroAssemblerX86Common::add32AndSetFlags): Deleted.
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::add64):
+        (JSC::MacroAssemblerX86_64::branchAdd64):
+        (JSC::MacroAssemblerX86_64::repatchCall):
+        (JSC::MacroAssemblerX86_64::clz64AfterBsr):
+        (JSC::MacroAssemblerX86_64::add64AndSetFlags): Deleted.
+
+2016-02-04  Andreas Kling  <akling@apple.com>
+
+        Remove dead ENABLE(BYTECODE_COMMENTS) cruft.
+        <https://webkit.org/b/153888>
+
+        Reviewed by Antti Koivisto.
+
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
+
+2016-02-04  Saam barati  <sbarati@apple.com>
+
+        JSC Sampling Profiler: (host) is confusing in cases where I would expect to see JS name
+        https://bugs.webkit.org/show_bug.cgi?id=153663
+        <rdar://problem/24415092>
+
+        Reviewed by Geoffrey Garen.
+
+        We now collect the Callee in the processed StackFrame
+        when the Callee is a valid GC object. We later ask
+        the Callee for it's .displayName or .name property.
+        When we don't have a valid callee, we will still
+        use the Executable for this information.
+
+        This helps us come up with good names for frames where 
+        the Callee object is a bound function or an InternalFunction.
+
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::addEvent):
+        (Inspector::buildSamples):
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::reportStats):
+        (JSC::FrameWalker::walk):
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        (JSC::SamplingProfiler::visit):
+        (JSC::SamplingProfiler::shutdown):
+        (JSC::SamplingProfiler::clearData):
+        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
+        (JSC::SamplingProfiler::StackFrame::displayName):
+        (JSC::SamplingProfiler::StackFrame::displayNameForJSONTests):
+        (JSC::SamplingProfiler::stackTracesAsJSON):
+        * runtime/SamplingProfiler.h:
+        (JSC::SamplingProfiler::UnprocessedStackFrame::UnprocessedStackFrame):
+        (JSC::SamplingProfiler::StackFrame::StackFrame):
+        * tests/stress/sampling-profiler-basic.js:
+        (platformSupportsSamplingProfiler.nothing):
+        (platformSupportsSamplingProfiler.top):
+        * tests/stress/sampling-profiler-bound-function-name.js: Added.
+        (platformSupportsSamplingProfiler.foo):
+        (platformSupportsSamplingProfiler.bar):
+        (platformSupportsSamplingProfiler.let.baz):
+        (platformSupportsSamplingProfiler):
+        * tests/stress/sampling-profiler-display-name.js: Added.
+        (platformSupportsSamplingProfiler.foo):
+        (platformSupportsSamplingProfiler.baz):
+        (platformSupportsSamplingProfiler.):
+        (platformSupportsSamplingProfiler.bar):
+        (platformSupportsSamplingProfiler.jaz):
+        (platformSupportsSamplingProfiler.makeFunction.let.result):
+        (platformSupportsSamplingProfiler.makeFunction):
+        * tests/stress/sampling-profiler-internal-function-name.js: Added.
+        (platformSupportsSamplingProfiler.foo):
+        (platformSupportsSamplingProfiler.bar):
+        (platformSupportsSamplingProfiler):
+
+2016-02-04  Chris Dumez  <cdumez@apple.com>
+
+        Object.getOwnPropertyDescriptor() returns incomplete descriptor for instance properties
+        https://bugs.webkit.org/show_bug.cgi?id=153817
+
+        Reviewed by Geoffrey Garen.
+
+        Extend support for Object.getOwnPropertyDescriptor() on native bindings
+        to instance properties (e.g. Unforgeable properties or Global object
+        properties) so that the returned descriptor has getter / setter
+        functions, as expected.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::reifyAllStaticProperties):
+        Add method that reifies all static properties, including the custom
+        accessors. This is similar to what is done eagerly on the prototype
+        objects in the bindings code.
+
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        getOwnPropertyDescriptor() would previously fails for custom accessors
+        that are on the instance because getDirect() does not check the static
+        property table and those custom accessors were not reified (We only
+        reified all properties eagerly - including custom accessors - on
+        prototype objects. To address this issue, we now call
+        reifyAllStaticProperties() if the call to getDirect() fails and then
+        call getDirect() again. This fix is however insufficient for Window
+        properties because |this| is a JSDOMWindowShell / JSProxy in this case
+        and getDirect() / reifyAllStaticProperties() would fail as the proxy
+        does not actually have the properties. This issue was addressed by
+        checking if |this| is a JSProxy and then using JSProxy::target() instead
+        of |this| for the calls to getDirect() and for the reification.
+
+        * runtime/JSObject.h:
+        * runtime/Lookup.h:
+        (JSC::reifyStaticProperty):
+        (JSC::reifyStaticProperties):
+        Move most code in reifyStaticProperties() to a separate function so the
+        code can be shared with JSObject::reifyAllStaticProperties().
+        reifyStaticProperties() is currently called by the bindings on the
+        prototype objects.
+
+2016-02-04  Alex Christensen  <achristensen@webkit.org>
+
+        Fix internal Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=153886
+        <rdar://problem/24499887>
+
+        Reviewed by Mark Lam.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj:
+        In r190253 I changed the directory of the headers from AppleInternal/include/JavaScriptCore 
+        to AppleInternal/include/private/JavaScriptCore.  This is ok for WebCore and WebKit, but not
+        other projects, such as CFNetwork, which expect the public API headers to be in the old location.
+        This used to be done by a combination of copy-files.cmd and the old JavaScriptCore.proj.
+        This change copies all the API headers, which copies everything in copy-files.cmd except APIShims.h
+        which does not exist any more.  It copies additional headers that were not copied before, but
+        I think this is beneficial so we do not forget to add new public headers to a list of public headers
+        to be copied in the internal build.  Having extra public headers in the internal Windows build is
+        not a problem because only internal clients use the internal Windows build.
+
+2016-02-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Make some classes non JSDestructibleObject
+        https://bugs.webkit.org/show_bug.cgi?id=153838
+
+        Reviewed by Geoffrey Garen.
+
+        SymbolPrototype, JSMapIterator and JSSetIterator are trivially destructible.
+        So there is no need to inherit JSDestructibleObject.
+
+        * runtime/JSMapIterator.cpp:
+        (JSC::JSMapIterator::destroy): Deleted.
+        * runtime/JSMapIterator.h:
+        * runtime/JSSetIterator.cpp:
+        (JSC::JSSetIterator::destroy): Deleted.
+        * runtime/JSSetIterator.h:
+        * runtime/MapData.h:
+        * runtime/SymbolPrototype.h:
+
+2016-02-03  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Symbol structure has unnecessary flags
+        https://bugs.webkit.org/show_bug.cgi?id=153840
+
+        Reviewed by Saam Barati.
+
+        * runtime/Symbol.h:
+        * tests/stress/symbol-get-own-property.js: Added.
+        (shouldBe):
+
+2016-02-03  Andreas Kling  <akling@apple.com>
+
+        [iOS] Throw away linked code when navigating to a new page.
+        <https://webkit.org/b/153851>
+
+        Reviewed by Gavin Barraclough.
+
+        Add a VM API for throwing away linked code only.
+
+        * runtime/VM.cpp:
+        (JSC::VM::deleteAllLinkedCode):
+        * runtime/VM.h:
+
+2016-02-03  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        [GTK][EFL] Switch FTL to B3
+        https://bugs.webkit.org/show_bug.cgi?id=153478
+
+        Reviewed by Csaba Osztrogonác.
+
+        Conditionalize code to make it possible to build FTL completely without LLVM.
+
+        * CMakeLists.txt:
+        * dfg/DFGCommon.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * ftl/FTLAbbreviatedTypes.h:
+        * ftl/FTLFail.cpp:
+        (JSC::FTL::fail):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        (JSC::FTL::State::~State):
+
+2016-02-03  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix JavaScriptCore build with B3 enabled.
+
+        Include <limits.h> for UINT_MAX.
+
+        * b3/B3StackSlot.h:
+        * b3/air/AirStackSlot.h:
+
+2016-02-02  Caitlin Potter  <caitp@igalia.com>
+
+        JSSymbolTableObject::deleteProperty() crashes deleting Symbols
+        https://bugs.webkit.org/show_bug.cgi?id=153816
+
+        Reviewed by Darin Adler.
+
+        Changes JSSymbolTableObject::deleteProperty() to check if its
+        symbolTable() contains the property's uid() rather than publicName().
+        This ensures that it will not crash in the case of Symbols.
+
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::deleteProperty):
+        * tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js:
+        (testGlobalProxy):
+        * tests/stress/regress-153816.js: Added.
+        (deleteSymbolFromJSSymbolTableObject):
+
+2016-02-02  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Do not copy FP when lowering FramePointer
+        https://bugs.webkit.org/show_bug.cgi?id=153769
+
+        Reviewed by Michael Saboff.
+
+        That extra move is just wasted time. The fewer Moves we have,
+        the happier IRC is.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tmp):
+        (JSC::B3::Air::LowerToAir::lower):
+
+2016-02-02  Keith Miller  <keith_miller@apple.com>
+
+        DFG, FTL, B3, and Air should all have a unique option for printing their graphs
+        https://bugs.webkit.org/show_bug.cgi?id=153815
+
+        Reviewed by Benjamin Poulain.
+
+        This patch adds a new printing option for each of the DFG/FTL compilation phases.
+
+        * b3/B3Common.cpp:
+        (JSC::B3::shouldDumpIR):
+        (JSC::B3::shouldDumpIRAtEachPhase):
+        * b3/B3Common.h:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3PhaseScope.cpp:
+        (JSC::B3::PhaseScope::PhaseScope):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        * b3/air/AirPhaseScope.cpp:
+        (JSC::B3::Air::PhaseScope::PhaseScope):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::CFAPhase::run):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::shouldDumpGraphAtEachPhase):
+        * dfg/DFGPhase.cpp:
+        (JSC::DFG::Phase::beginPhase):
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2016-02-02  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] make Object.getOwnPropertyDescriptors() work with non-JSObject types
+        https://bugs.webkit.org/show_bug.cgi?id=153814
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptors):
+        * tests/es6/Object_static_methods_Object.getOwnPropertyDescriptors.js:
+        (testGlobalProxy):
+
+2016-02-02  Aakash Jain  <aakash_jain@apple.com>
+
+        Remove references to CallFrameInlines.h
+        https://bugs.webkit.org/show_bug.cgi?id=153810
+
+        Reviewed by Mark Lam.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+
+2016-02-02  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] Implement Object.getOwnPropertyDescriptors() proposal
+        https://bugs.webkit.org/show_bug.cgi?id=153799
+
+        Reviewed by Darin Adler.
+
+        Implements the Object.getOwnPropertyDescriptors() proposal, which
+        reached Stage 3 in the TC39 process in January 2016.
+        https://github.com/tc39/proposal-object-getownpropertydescriptors
+
+        The method extracts a set of property descriptor objects, which can
+        be safely used via `Object.create()`.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetOwnPropertyDescriptors):
+
+2016-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile trivial self-loops
+        https://bugs.webkit.org/show_bug.cgi?id=153802
+        rdar://problem/24465632
+
+        Reviewed by Michael Saboff.
+
+        Tail-duplicating a self-loop would mean doing a kind of loop unrolling. It wouldn't be
+        profitable even if it did work. It turns out that it doesn't work, because we edit the target
+        block before reading the source block, which breaks if the target and source block are the
+        same.
+
+        This disables tail duplication of self-loops, adds a test, and adds better validation for this
+        issue.
+
+        * b3/B3DuplicateTails.cpp:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::resetReachability):
+        * b3/testb3.cpp:
+        (JSC::B3::testComputeDivisionMagic):
+        (JSC::B3::testTrivialInfiniteLoop):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+
+2016-02-02  Saam barati  <sbarati@apple.com>
+
+        [ES6] bound functions .name property should be "bound " + the target function's name
+        https://bugs.webkit.org/show_bug.cgi?id=153796
+
+        Reviewed by Mark Lam.
+
+        See http://tc39.github.io/ecma262/#sec-function.prototype.bind for details.
+        What the spec says:
+        ```
+        function foo() { }
+        foo.bind(null).name === "bound foo"
+
+        (function bar() { }).bind(null).name === "bound bar"
+        ```
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::hasInstanceBoundFunction):
+        (JSC::JSBoundFunction::create):
+        (JSC::JSBoundFunction::visitChildren):
+        (JSC::JSBoundFunction::toStringName):
+        * runtime/JSBoundFunction.h:
+        (JSC::JSBoundFunction::boundThis):
+        (JSC::JSBoundFunction::boundArgs):
+        (JSC::JSBoundFunction::createStructure):
+        * tests/es6.yaml:
+
+2016-02-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Get rid of anonymous stack slots
+        https://bugs.webkit.org/show_bug.cgi?id=151128
+
+        Reviewed by Mark Lam.
+
+        When I first designed stack slots, the idea was that an "anonymous" stack slot was one that
+        behaved exactly like a C variable: if it never escaped, it would not need to get stack space
+        for the entire lifetime of the function - it could get any slab of stack so long as it
+        didn't interfere with other stack slots that would be live at the same time. The reason I
+        called them "anonymous" is that external code could not get its address. This felt like it
+        gave the stack slot anonymity. But it was never a good name for this concept.
+
+        Then I had the register allocator lower temporaries to anonymous stack slots when it spilled
+        them. Spilling became the sole client of anonymous stack slots.
+
+        Then I realized that there was an aspect of how spill slots work that make them want
+        slightly different semantics than a normal C variable. A C variable is a proper memory
+        location - you could do a store to only some bytes in the variable, and it's reasonable to
+        expect that this will not destroy the other bytes in the variable. But that means that to
+        compute their liveness, you have to do something like a per-byte liveness. That's overkill
+        for spill slots. You want any store to the spill slot to kill the whole slot even if it
+        writes to just part of the slot. This matches how temporaries work. So rather than implement
+        per-byte liveness, I decided to change the semantics of anonymous stack slots to make them
+        work like how I wanted spill slots to work. This was quite dirty, and put B3 in the awkward
+        situation that B3's anonymous stack slots behaved like spill slots. But it was OK since
+        nobody used anonymous stack slots in B3.
+
+        Then I added tail duplication, which required having a mechanism for introducing non-SSA
+        variables in B3. I decided to use anonymous stack slots for this purpose. All of a sudden
+        this all felt like it made sense: anonymous stack slots were just like variables! Hooray for
+        the amazing foresight of anonymous stack slots!
+
+        But then I realized that this was all very bad. We want B3 to be able to optimize Store and
+        Load operations by reasoning about how they affect bytes in memory. For example, if you do
+        a Load of a 64-bit value, and then you modify just the low 32 bits of that value, and then
+        you do a 64-bit store back to the same location, then it would be better to transform this
+        into 32-bit operations. We don't do this optimization yet, but it's the kind of thing that
+        we want B3 to be able to do. To do it, we need Store to mean that it only affects N bytes
+        starting at the pointer, where N is the size of the thing being stored. But that's not what
+        Store means for anonymous stack slots. For anonymous slots, storing to any byte in the slot
+        clobbers all bytes in the slot. We were never clear if you need to store directly to an
+        anonymous slot to get this behavior, or if any pointer that points to an anoymous slot must
+        exhibit this behavior when stored to. Neither kinds of semantics make sense to me.
+
+        This change fixes the problem by eradicating anonymous stack slots. In B3, they are replaced
+        with Variables. In Air, they are replaced with a different stack slot kind, called Spill.
+        There is no such thing as stack slot kinds in B3 anymore, all B3 stack slots are locked. In
+        Air, there is still the concept of stack slot kind - Locked or Spill.
+
+        B3 Variables are awesome. They are exactly what they seem to be. They have a type. They are
+        declared at the top level in the Procedure. You can access them with new opcodes, Get and
+        Set. This greatly simplifies demoting SSA values to variables and promoting them back to
+        SSA. I even made the instruction selector do the right things for variables, which means
+        that introducing variables won't hurt instruction selection (there will be extra moves, but
+        IRC will kill them). It's great to have non-SSA variables as an explicit concept in IR
+        because it means that you don't have to do any magic to use them - they Just Work.
+
+        Air spill slots behave almost like anonymous stack slots, with one exception: you cannot
+        escape them. We validate this by making it illegal to UseAddr on a spill slot. This removes
+        the need to answer awkward questions like: does a 32-bit Def on a pointer that may point to
+        a 64-bit spill slot do anything to the 32 bits above the pointer?  Does it write zero to it?
+        Does it write zero to it just when the pointer actually points to a spill slot or always?
+        These are silly questions, and we don't have to answer them because the only way to refer to
+        a spill slot is directly. No escaping means no aliasing.
+
+        This doesn't affect performance. It just makes the compiler more fun to work with by
+        removing some cognitive dissonance.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3ArgumentRegValue.h:
+        * b3/B3CCallValue.h:
+        * b3/B3CheckValue.cpp:
+        (JSC::B3::CheckValue::cloneImpl):
+        (JSC::B3::CheckValue::CheckValue):
+        * b3/B3CheckValue.h:
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ConstFloatValue.h:
+        * b3/B3ConstPtrValue.h:
+        (JSC::B3::ConstPtrValue::ConstPtrValue):
+        * b3/B3ControlValue.cpp:
+        (JSC::B3::ControlValue::convertToJump):
+        (JSC::B3::ControlValue::convertToOops):
+        (JSC::B3::ControlValue::dumpMeta):
+        * b3/B3ControlValue.h:
+        * b3/B3Effects.cpp:
+        (JSC::B3::Effects::interferes):
+        (JSC::B3::Effects::dump):
+        * b3/B3Effects.h:
+        (JSC::B3::Effects::mustExecute):
+        * b3/B3EliminateCommonSubexpressions.cpp:
+        * b3/B3FixSSA.cpp:
+        (JSC::B3::demoteValues):
+        (JSC::B3::fixSSA):
+        * b3/B3FixSSA.h:
+        * b3/B3IndexMap.h:
+        (JSC::B3::IndexMap::resize):
+        (JSC::B3::IndexMap::clear):
+        (JSC::B3::IndexMap::size):
+        (JSC::B3::IndexMap::operator[]):
+        * b3/B3IndexSet.h:
+        (JSC::B3::IndexSet::contains):
+        (JSC::B3::IndexSet::size):
+        (JSC::B3::IndexSet::isEmpty):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3MemoryValue.h:
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3PatchpointValue.cpp:
+        (JSC::B3::PatchpointValue::cloneImpl):
+        (JSC::B3::PatchpointValue::PatchpointValue):
+        * b3/B3PatchpointValue.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::Procedure):
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::addStackSlot):
+        (JSC::B3::Procedure::addVariable):
+        (JSC::B3::Procedure::clone):
+        (JSC::B3::Procedure::addIntConstant):
+        (JSC::B3::Procedure::dump):
+        (JSC::B3::Procedure::deleteStackSlot):
+        (JSC::B3::Procedure::deleteVariable):
+        (JSC::B3::Procedure::deleteValue):
+        (JSC::B3::Procedure::deleteOrphans):
+        (JSC::B3::Procedure::calleeSaveRegisters):
+        (JSC::B3::Procedure::addValueImpl):
+        (JSC::B3::Procedure::setBlockOrderImpl):
+        (JSC::B3::Procedure::addAnonymousStackSlot): Deleted.
+        (JSC::B3::Procedure::addStackSlotIndex): Deleted.
+        (JSC::B3::Procedure::addValueIndex): Deleted.
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::setBlockOrder):
+        (JSC::B3::Procedure::stackSlots):
+        (JSC::B3::Procedure::variables):
+        (JSC::B3::Procedure::values):
+        (JSC::B3::Procedure::StackSlotsCollection::StackSlotsCollection): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::size): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::at): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::operator[]): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::iterator): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator*): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator++): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator==): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator!=): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::findNext): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::begin): Deleted.
+        (JSC::B3::Procedure::StackSlotsCollection::end): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::ValuesCollection): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::iterator::iterator): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator*): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator++): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator==): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::iterator::operator!=): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::iterator::findNext): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::begin): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::end): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::size): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::at): Deleted.
+        (JSC::B3::Procedure::ValuesCollection::operator[]): Deleted.
+        * b3/B3ProcedureInlines.h:
+        (JSC::B3::Procedure::add):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3SlotBaseValue.h:
+        * b3/B3SparseCollection.h: Added.
+        (JSC::B3::SparseCollection::SparseCollection):
+        (JSC::B3::SparseCollection::add):
+        (JSC::B3::SparseCollection::addNew):
+        (JSC::B3::SparseCollection::remove):
+        (JSC::B3::SparseCollection::size):
+        (JSC::B3::SparseCollection::isEmpty):
+        (JSC::B3::SparseCollection::at):
+        (JSC::B3::SparseCollection::operator[]):
+        (JSC::B3::SparseCollection::iterator::iterator):
+        (JSC::B3::SparseCollection::iterator::operator*):
+        (JSC::B3::SparseCollection::iterator::operator++):
+        (JSC::B3::SparseCollection::iterator::operator==):
+        (JSC::B3::SparseCollection::iterator::operator!=):
+        (JSC::B3::SparseCollection::iterator::findNext):
+        (JSC::B3::SparseCollection::begin):
+        (JSC::B3::SparseCollection::end):
+        * b3/B3StackSlot.cpp:
+        (JSC::B3::StackSlot::deepDump):
+        (JSC::B3::StackSlot::StackSlot):
+        * b3/B3StackSlot.h:
+        (JSC::B3::StackSlot::byteSize):
+        (JSC::B3::StackSlot::index):
+        (JSC::B3::StackSlot::setOffsetFromFP):
+        (JSC::B3::StackSlot::kind): Deleted.
+        (JSC::B3::StackSlot::isLocked): Deleted.
+        * b3/B3StackSlotKind.cpp: Removed.
+        * b3/B3StackSlotKind.h: Removed.
+        * b3/B3StackmapValue.cpp:
+        (JSC::B3::StackmapValue::dumpMeta):
+        (JSC::B3::StackmapValue::StackmapValue):
+        * b3/B3StackmapValue.h:
+        * b3/B3SwitchValue.cpp:
+        (JSC::B3::SwitchValue::cloneImpl):
+        (JSC::B3::SwitchValue::SwitchValue):
+        * b3/B3SwitchValue.h:
+        * b3/B3UpsilonValue.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::replaceWithIdentity):
+        (JSC::B3::Value::replaceWithNop):
+        (JSC::B3::Value::replaceWithPhi):
+        (JSC::B3::Value::dump):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::checkOpcode):
+        * b3/B3Value.h:
+        * b3/B3Variable.cpp: Added.
+        (JSC::B3::Variable::~Variable):
+        (JSC::B3::Variable::dump):
+        (JSC::B3::Variable::deepDump):
+        (JSC::B3::Variable::Variable):
+        * b3/B3Variable.h: Added.
+        (JSC::B3::Variable::type):
+        (JSC::B3::Variable::index):
+        (JSC::B3::DeepVariableDump::DeepVariableDump):
+        (JSC::B3::DeepVariableDump::dump):
+        (JSC::B3::deepDump):
+        * b3/B3VariableValue.cpp: Added.
+        (JSC::B3::VariableValue::~VariableValue):
+        (JSC::B3::VariableValue::dumpMeta):
+        (JSC::B3::VariableValue::cloneImpl):
+        (JSC::B3::VariableValue::VariableValue):
+        * b3/B3VariableValue.h: Added.
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::addStackSlot):
+        (JSC::B3::Air::Code::addSpecial):
+        (JSC::B3::Air::Code::cCallSpecial):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::begin):
+        (JSC::B3::Air::Code::end):
+        (JSC::B3::Air::Code::stackSlots):
+        (JSC::B3::Air::Code::specials):
+        (JSC::B3::Air::Code::forAllTmps):
+        (JSC::B3::Air::Code::StackSlotsCollection::StackSlotsCollection): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::size): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::at): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::operator[]): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::iterator): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::operator*): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::operator++): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::operator==): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::iterator::operator!=): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::begin): Deleted.
+        (JSC::B3::Air::Code::StackSlotsCollection::end): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::SpecialsCollection): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::size): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::at): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::operator[]): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::iterator): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::operator*): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::operator++): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::operator==): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::iterator::operator!=): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::begin): Deleted.
+        (JSC::B3::Air::Code::SpecialsCollection::end): Deleted.
+        * b3/air/AirFixObviousSpills.cpp:
+        * b3/air/AirInstInlines.h:
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirLiveness.h:
+        * b3/air/AirLowerAfterRegAlloc.cpp:
+        (JSC::B3::Air::lowerAfterRegAlloc):
+        * b3/air/AirSpecial.cpp:
+        (JSC::B3::Air::Special::Special):
+        * b3/air/AirSpecial.h:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/air/AirStackSlot.cpp:
+        (JSC::B3::Air::StackSlot::dump):
+        (JSC::B3::Air::StackSlot::deepDump):
+        (JSC::B3::Air::StackSlot::StackSlot):
+        * b3/air/AirStackSlot.h:
+        (JSC::B3::Air::StackSlot::byteSize):
+        (JSC::B3::Air::StackSlot::kind):
+        (JSC::B3::Air::StackSlot::isLocked):
+        (JSC::B3::Air::StackSlot::isSpill):
+        (JSC::B3::Air::StackSlot::index):
+        (JSC::B3::Air::StackSlot::ensureSize):
+        * b3/air/AirStackSlotKind.cpp: Copied from Source/JavaScriptCore/b3/B3StackSlotKind.cpp.
+        (WTF::printInternal):
+        * b3/air/AirStackSlotKind.h: Copied from Source/JavaScriptCore/b3/B3StackSlotKind.h.
+        * b3/air/opcode_generator.rb:
+        * b3/air/testair.cpp:
+        (JSC::B3::Air::testShuffleBroadcastAllRegs):
+        (JSC::B3::Air::testShuffleShiftAllRegs):
+        (JSC::B3::Air::testShuffleRotateAllRegs):
+        * b3/testb3.cpp:
+        (JSC::B3::testStackSlot):
+        (JSC::B3::testStoreLoadStackSlot):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::lockedStackSlot):
+        (JSC::FTL::Output::neg):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+
+2016-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Introduce BytecodeIntrinsic constant rep like @undefined
+        https://bugs.webkit.org/show_bug.cgi?id=153737
+
+        Reviewed by Darin Adler.
+
+        This patch enhances existing BytecodeIntrinsic mechanism to accept `@xxx` form,
+        that will be used to represent bytecode intrinsic constants.
+        After this change, we can use 2 forms for bytecode intrinsics. (1) Function form (like, @toString(value))
+        and (2) Constant form (like @undefined).
+
+        Bytecode intrinsic constants allow us to easily expose constant values from C++ world.
+        For example, we can expose ArrayIterationKind flags to JS world without using private global variables.
+        Exposed constant values are loaded from bytecodes directly through constant registers.
+        While previously we expose them through private global variables, bytecode intrinsic constants
+        can be loaded directly from CodeBlock. And later, it will become JSConstant in DFG.
+
+        And by using this mechanism, we implement several constants. @undefined, @arrayIterationKindKeyValue etc.
+
+        * builtins/ArrayConstructor.js:
+        (from):
+        * builtins/ArrayIteratorPrototype.js:
+        (next):
+        * builtins/ArrayPrototype.js:
+        (reduce):
+        (reduceRight):
+        (every):
+        (forEach):
+        (filter):
+        (map):
+        (some):
+        (fill):
+        (find):
+        (findIndex):
+        (includes):
+        (sort.compactSparse):
+        (sort.compactSlow):
+        (sort.compact):
+        (sort):
+        (copyWithin):
+        * builtins/DatePrototype.js:
+        (toLocaleString.toDateTimeOptionsAnyAll):
+        (toLocaleString):
+        (toLocaleDateString.toDateTimeOptionsDateDate):
+        (toLocaleDateString):
+        (toLocaleTimeString.toDateTimeOptionsTimeTime):
+        (toLocaleTimeString):
+        * builtins/GeneratorPrototype.js:
+        (generatorResume):
+        * builtins/GlobalObject.js:
+        (isDictionary):
+        * builtins/InternalPromiseConstructor.js:
+        (internalAll.newResolveElement):
+        (internalAll):
+        * builtins/IteratorPrototype.js:
+        (symbolIteratorGetter):
+        (symbolIterator): Deleted.
+        * builtins/MapPrototype.js:
+        (forEach):
+        * builtins/ModuleLoaderObject.js:
+        (newRegistryEntry):
+        (forceFulfillPromise):
+        (commitInstantiated):
+        (requestFetch):
+        (requestTranslate):
+        (requestInstantiate):
+        (requestLink):
+        (provide):
+        * builtins/PromiseConstructor.js:
+        (all.newResolveElement):
+        (all):
+        (race):
+        (reject):
+        (resolve):
+        * builtins/PromiseOperations.js:
+        (newPromiseCapability.executor):
+        (newPromiseCapability):
+        (rejectPromise):
+        (fulfillPromise):
+        (createResolvingFunctions.resolve):
+        (createResolvingFunctions.reject):
+        (createResolvingFunctions):
+        (promiseReactionJob):
+        (promiseResolveThenableJob):
+        (initializePromise):
+        * builtins/PromisePrototype.js:
+        (catch):
+        (then):
+        * builtins/SetPrototype.js:
+        (forEach):
+        * builtins/StringConstructor.js:
+        (raw):
+        * builtins/StringIteratorPrototype.js:
+        (next):
+        * builtins/StringPrototype.js:
+        (localeCompare):
+        * builtins/TypedArrayConstructor.js:
+        (of):
+        (from):
+        * builtins/TypedArrayPrototype.js:
+        (every):
+        (find):
+        (findIndex):
+        (forEach):
+        (some):
+        (reduce):
+        (reduceRight):
+        (map):
+        (filter):
+        * bytecode/BytecodeIntrinsicRegistry.cpp:
+        (JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):
+        (JSC::BytecodeIntrinsicRegistry::lookup):
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecompiler/NodesCodegen.cpp:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createResolve):
+        (JSC::ASTBuilder::makeFunctionCallNode):
+        * parser/NodeConstructors.h:
+        (JSC::BytecodeIntrinsicNode::BytecodeIntrinsicNode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isBytecodeIntrinsicNode):
+        (JSC::BytecodeIntrinsicNode::type):
+        (JSC::BytecodeIntrinsicNode::emitter):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createResolve):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers): Deleted.
+        * runtime/CommonIdentifiers.h:
+        (JSC::CommonIdentifiers::bytecodeIntrinsicRegistry): Deleted.
+        * runtime/IteratorPrototype.cpp:
+        (JSC::IteratorPrototype::finishCreation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Deleted.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::bytecodeIntrinsicRegistry):
+
+2016-02-02  Per Arne Vollan  <peavo@outlook.com>
+
+        [B3][Win64] Compile fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=153605
+
+        Reviewed by Filip Pizlo.
+
+        Fix remaining compile errors on Win64.
+
+        * CMakeLists.txt:
+        * b3/B3CFG.h:
+        (JSC::B3::CFG::newMap):
+        * ftl/FTLJITCode.h:
+
+2016-02-01  Chris Dumez  <cdumez@apple.com>
+
+        object.__lookupGetter__() / object.__lookupSetter__() does not work for native bindings
+        https://bugs.webkit.org/show_bug.cgi?id=153765
+        <rdar://problem/24439699>
+
+        Reviewed by Oliver Hunt.
+
+        Add support for CustomAccessor slots to objectProtoFuncLookupGetter() and
+        objectProtoFuncLookupSetter() by return getOwnPropertyDescriptor().get / set.
+        getOwnPropertyDescriptor() now correctly deals with CustomAccessors since
+        r196001.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+
+2016-02-01  Chris Dumez  <cdumez@apple.com>
+
+        Native Bindings Descriptors are Incomplete
+        https://bugs.webkit.org/show_bug.cgi?id=140575
+        <rdar://problem/19506502>
+
+        Reviewed by Oliver Hunt.
+
+        This patch is based on initial work by Joe Pecoraro and Matthew Mirman.
+
+        This patch was initially rolled out for breaking chromeexperiments.com,
+        presumably because our IDL attributes were not marked as [configurable]
+        at the time. However, since r190104, our IDL attributes are now
+        configurable. Based on local testing, chromeexperiments.com seems to be
+        working fine now.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptSource.js:
+        (endsWith):
+        (InjectedScript.prototype.processProperties):
+        * runtime/JSBoundSlotBaseFunction.cpp: Added.
+        (JSC::boundSlotBaseFunctionCall):
+        (JSC::JSBoundSlotBaseFunction::JSBoundSlotBaseFunction):
+        (JSC::JSBoundSlotBaseFunction::create):
+        (JSC::JSBoundSlotBaseFunction::visitChildren):
+        (JSC::JSBoundSlotBaseFunction::finishCreation):
+        * runtime/JSBoundSlotBaseFunction.h: Added.
+        (JSC::JSBoundSlotBaseFunction::createStructure):
+        (JSC::JSBoundSlotBaseFunction::boundSlotBase):
+        (JSC::JSBoundSlotBaseFunction::customGetterSetter):
+        (JSC::JSBoundSlotBaseFunction::isSetter):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure):
+        * runtime/JSObject.cpp:
+        (JSC::getBoundSlotBaseFunctionForGetterSetter):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+
+2016-02-01  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: High Level Memory Overview Instrument
+        https://bugs.webkit.org/show_bug.cgi?id=153516
+        <rdar://problem/24356378>
+
+        Reviewed by Brian Burg.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * inspector/protocol/Memory.json: Added.
+        * inspector/scripts/codegen/generator.py:
+        New Memory domain guarded by ENABLE(RESOURCE_USAGE).
+        This feature flag was already used in WebCore.
+
+2016-02-01  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] IRC can coalesce the frame pointer with a Tmp that is modified
+        https://bugs.webkit.org/show_bug.cgi?id=153694
+
+        Reviewed by Filip Pizlo.
+
+        Let's say we have:
+            Move(FP, Tmp1)
+            Add64(#1, Tmp1)
+
+        If we were to coalesce the Move, we would modify the frame pointer.
+        Well, that's exactly what was happening with IRC.
+
+        Since the epilogue is not know to Air before IRC, the liveness analysis
+        never discovers that FP is live when Tmp1 is UseDef by Add64. Adding
+        FP would a be a problem anyway for a bunch of reasons.
+
+        I tried two ways to prevent IRC to override IRC:
+        1) Add an interference edge with FP for all non-duplication Defs.
+        2) Let coalesce() know about FP and constraint any coalescing with a re-Def.
+
+        The two are within margin of error for performance. The second one was considerably
+        more complicated. This patch implements the first one.
+
+        Some extra note:
+        -It is very important to not increment the degree of a Tmp when making it interfere
+         with FP. FP is not a valid color, it is not counted in the "K" colors considered
+         for coloring. Increasing the degree with the edge to FP would make every stage
+         pessimistic since there is an extra degree that can never be removed.
+        -I put "interferenceEdges" and "adjacencyList" in an inconsistent state.
+         This is intentional, "interferenceEdges" is used to test the existence of an edge,
+         "adjacencyList" is used to go over all the edges. In this case, we don't want
+         the edge with FP to be considered when pruning the graph.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        One branch could be transformed into an assertion: TmpLiveness is type specific now.
+        * b3/testb3.cpp:
+        (JSC::B3::testOverrideFramePointer):
+        (JSC::B3::run):
+
+2016-02-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed speculative buildfix.
+
+        * dfg/DFGCommon.h: FTL_USES_B3 should be false if FTL JIT is disabled.
+
+2016-01-31  Dan Bernstein  <mitz@apple.com>
+
+        [Cocoa] Remove unused definition of HAVE_HEADER_DETECTION_H
+        https://bugs.webkit.org/show_bug.cgi?id=153729
+
+        Reviewed by Sam Weinig.
+
+        After r141700, HAVE_HEADER_DETECTION_H is no longer used.
+
+        * Configurations/Base.xcconfig:
+
+2016-01-30  Filip Pizlo  <fpizlo@apple.com>
+
+        B3->Air lowering should use MoveFloat more
+        https://bugs.webkit.org/show_bug.cgi?id=153714
+
+        Reviewed by Sam Weinig.
+
+        This is a very minor and benign bug. It just means that we will use the more canonical
+        MoveFloat instruction when moving floats, rather than using MoveDouble.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::relaxedMoveForType):
+
+2016-01-31  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Should not predict OtherObj for ToThis with primitive types under strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=153544
+
+        Reviewed by Filip Pizlo.
+
+        Currently, ToThis predicates OtherObj for primitive values.
+        But it's not true in strict mode.
+        In strict mode, ToThis does nothing on primitive values.
+
+        In this patch, we
+
+        1. fix prediction. Handles primitive types in strict mode. And we also handles StringObject.
+        2. convert it to Identity if the argument should be predicted as primitive types.
+
+        This optimization is important to implement Primitive.prototype.methods[1].
+        Otherwise, we always got BadType OSR exits.
+
+        [1]: https://bugs.webkit.org/show_bug.cgi?id=143889
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::fixupToThis):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * tests/stress/to-this-boolean.js: Added.
+        (Boolean.prototype.negate):
+        (Boolean.prototype.negate2):
+        * tests/stress/to-this-double.js: Added.
+        (Number.prototype.negate):
+        * tests/stress/to-this-int32.js: Added.
+        (Number.prototype.negate):
+        * tests/stress/to-this-int52.js: Added.
+        (Number.prototype.negate):
+        * tests/stress/to-this-number.js: Added.
+        (Number.prototype.negate):
+        * tests/stress/to-this-string.js: Added.
+        (String.prototype.prefix):
+        (String.prototype.first):
+        (String.prototype.second):
+        * tests/stress/to-this-symbol.js: Added.
+        (Symbol.prototype.identity):
+        (Symbol.prototype.identity2):
+
+2016-01-31  Guillaume Emont  <guijemont@igalia.com>
+
+        [mips] don't save to a callee saved register too early
+        https://bugs.webkit.org/show_bug.cgi?id=153463
+
+        If we save $gp to $s4 in pichdr, then in some cases, we were
+        overwriting $s4 before LLInt's pushCalleeSaves() is called (as pichdr
+        is at the very beginning of a function). Now we save $gp to $s4 at the
+        end of pushCalleeSaves().
+
+        Reviewed by Michael Saboff.
+
+        * offlineasm/mips.rb:
+        * llint/LowLevelInterpreter.asm:
+        Move the saving of $gp to $s4 from pichdr to pushCalleeSaves(). Take
+        the opportunity to only save $s4 as we never use the other callee
+        saved registers.
+
+2016-01-30  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r195799 and r195828.
+        https://bugs.webkit.org/show_bug.cgi?id=153722
+
+        Caused assertion failures, severely affecting EWS (Requested
+        by ap on #webkit).
+
+        Reverted changesets:
+
+        "Web Inspector: InspectorTimelineAgent doesn't need to
+        recompile functions because it now uses the sampling profiler"
+        https://bugs.webkit.org/show_bug.cgi?id=153500
+        http://trac.webkit.org/changeset/195799
+
+        "Attempt to fix the Windows build after r195799"
+        http://trac.webkit.org/changeset/195828
+
+2016-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [B3] JetStream/quicksort.c fails/hangs on Linux with GCC
+        https://bugs.webkit.org/show_bug.cgi?id=153647
+
+        Reviewed by Filip Pizlo.
+
+        In B3ComputeDivisionMagic, we accidentally perform sub, add operation onto signed integer. (In this case, int32_t)
+        But integer overflow is undefined behavior in C![1][2]
+        As a result, in GCC 4.9 release build, computeDivisionMagic(2) returns unexpected value.
+        `divisor = 2`
+        `d = 2`
+        `signedMin = INT32_MIN = -2147483647 (-0x7fffffff)`
+        `t = signedMin`
+        `anc = t - 1 - (t % ad)` Oops, we performed overflow operation!
+
+        So, `anc` value becomes undefined.
+        In this patch, we first cast all the operated values to unsigned one.
+        Reading the code, there are no operations that depends on signedness. (For example, we used aboveEqual like unsigned operations for comparison.)
+
+        [1]: http://blog.llvm.org/2011/05/what-every-c-programmer-should-know.html
+        [2]: http://dl.acm.org/citation.cfm?id=2522728
+
+        * b3/B3ComputeDivisionMagic.h:
+        (JSC::B3::computeDivisionMagic):
+        * b3/testb3.cpp:
+        (JSC::B3::testComputeDivisionMagic):
+        (JSC::B3::run):
+
+2016-01-30  Andreas Kling  <akling@apple.com>
+
+        Shrink Heap::m_executables after cleaning it.
+        <https://webkit.org/b/153682>
+
+        Reviewed by Darin Adler.
+
+        The Heap::m_executables Vector was never shrunk down, despite sometimes
+        getting pretty huge (~500kB in my longest-running WebContent process.)
+
+        After GC has finished pruning unmarked Executables, shrink the Vector.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::clearUnmarkedExecutables):
+
+2016-01-29  Ada Chan  <adachan@apple.com>
+
+        Enable VIDEO_PRESENTATION_MODE only in Debug and Release builds on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=153665
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [B3] REGRESSION(r195882): Should break early after modConstant replaceWithNewValue succeeds
+        https://bugs.webkit.org/show_bug.cgi?id=153711
+
+        Reviewed by Filip Pizlo.
+
+        Should break after modConstant replaceWithNewValue succeeds. m_value is already replaced with Identity
+        if modConstant succeeds. So it does not have any children. m_value->child(1) breaks testb3.
+
+        * b3/B3ReduceStrength.cpp:
+
+2016-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Enable SamplingProfiler on POSIX environment
+        https://bugs.webkit.org/show_bug.cgi?id=153584
+
+        Reviewed by Michael Saboff.
+
+        In this patch, we implement suspend and resume mechanizm for POSIX threads.
+        And with GLIBC, we can retrieve registers from it.
+
+        We take the following strategy.
+
+        Suspend side.
+        1. install sigaction to the threads.
+        2. in the profiler (suspend / resume callers), emit signal with pthread_kill and wait with POSIX semaphore.
+        3. in the signal handler, up the POSIX semaphore. Use sem_post because it is the async-signal-safe function in POSIX.
+        4. in the signal handler, perform sigsuspend to stop the thread until being resumed.
+        5. in the profiler, we can be waken up from the semaphore because (3) ups.
+
+        Resume side.
+        1. in the profiler, emit signal and wait on the semaphore.
+        2. in the signal handler, it is waken up from the sigsuspend.
+        3. in the signal handler, up the semaphore.
+        4. in the profiler, the profiler is waken up from the semaphore. It is ensured that the given thread is resumed by the signal.
+
+        * heap/MachineStackMarker.cpp:
+        (pthreadSignalHandlerSuspendResume):
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::MachineThreads::Thread::~Thread):
+        (JSC::MachineThreads::Thread::suspend):
+        (JSC::MachineThreads::Thread::resume):
+        (JSC::MachineThreads::Thread::getRegisters):
+        (JSC::MachineThreads::Thread::Registers::stackPointer):
+        (JSC::MachineThreads::Thread::Registers::framePointer):
+        (JSC::MachineThreads::Thread::Registers::instructionPointer):
+        (JSC::MachineThreads::Thread::Registers::llintPC):
+        (JSC::MachineThreads::Thread::freeRegisters):
+        * heap/MachineStackMarker.h:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::reportStats):
+        * tests/stress/call-varargs-from-inlined-code-with-odd-number-of-arguments.js:
+        * tests/stress/call-varargs-from-inlined-code.js:
+        * tests/stress/v8-earley-boyer-strict.js:
+
+2016-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should reduce Mod(value, constant) to Div and Mul so that our Div optimizations can do things
+        https://bugs.webkit.org/show_bug.cgi?id=153693
+
+        Reviewed by Saam Barati.
+
+        The most efficient way to handle Mod(value, constant) is to reduce it to
+        Sub(value, Mul(Div(value, constant), constant)) and then let the Div optimizations do their
+        thing.
+
+        In the future we could add special handling of Mod(value, 1 << constant), but it's not
+        obvious that this would produce better code than reducing through Div, if we also make sure
+        that we have great optimizations for Mul and Div.
+
+        * b3/B3ReduceStrength.cpp:
+
+2016-01-29  Keith Miller  <keith_miller@apple.com>
+
+        Array.prototype native functions should use Symbol.species to construct the result
+        https://bugs.webkit.org/show_bug.cgi?id=153660
+
+        Reviewed by Saam Barati.
+
+        This patch adds support for Symbol.species in the Array.prototype native functions.
+        We make an optimization to avoid regressions on some benchmarks by using an
+        adaptive watchpoint to check if Array.prototype.constructor is ever changed.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putLength):
+        (JSC::setLength):
+        (JSC::speciesConstructArray):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::ArrayPrototype::setConstructor):
+        (JSC::ArrayPrototypeAdaptiveInferredPropertyWatchpoint::ArrayPrototypeAdaptiveInferredPropertyWatchpoint):
+        (JSC::ArrayPrototypeAdaptiveInferredPropertyWatchpoint::handleFire):
+        * runtime/ArrayPrototype.h:
+        (JSC::ArrayPrototype::didChangeConstructorProperty):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * tests/es6.yaml:
+        * tests/stress/array-species-functions.js: Added.
+        (Symbol.species):
+        (funcThrows):
+        (test.species):
+        (test):
+
+2016-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        CallLinkStatus should trust BadCell exit sites whenever there is no stub
+        https://bugs.webkit.org/show_bug.cgi?id=153691
+
+        Reviewed by Benjamin Poulain.
+
+        This fixes a regression in our treatment of inlining failure exit sites when deciding if we
+        should inline a call.
+
+        A long time ago, a BadCell exit site would ensure that a CallLinkStatus returned
+        takesSlowPath.
+
+        But then we added closure calls. A BadCell exit site might just mean that we should do
+        closure call inlining. We added a BadExecutable exit site to indicate that even closure call
+        inlining had failed. BadCell would no longer force CallLinkStatus to return takesSlowPath,
+        but BadExecutable would stuff do so.
+
+        But then we unified the IR for checking functions and executables, and the DFG stopped using
+        the BadExecutable exit kind. Probably this change disabled our ability to use exit site
+        counting for deciding when to takesSlowPath. But this isn't necessarily a disaster, since
+        any time you exited in this way, you'd be taken to a baseline call inline cache, and that
+        inline cache would record the slow path.
+
+        But then we introduced polymorphic call inlining. Polymorphic call inlining means that call
+        unlinking, like when one of the callees is optimized, will reset the stub. We also made it
+        so that the stub is like a gate for the slow path count. A clear inline cache must first
+        cause the creation of a stub and then cause it to overflow before the slow path is counted.
+
+        So, if the DFG or FTL exits on a cell check associated with a particular callsite being
+        speculatively inlined, then it's possible that nobody will know about the exit because:
+
+        - The exit kind is BadCell but CallLinkStatus needs BadExecutable to disable inlining.
+
+        - Between when we tiered up to the DFG (or FTL) and when the exit happened, one of the
+          callees was tiered up, causing the baseline CallLinkInfo to be unlinked. Therefore, after
+          the exit, the inline cache is in a reset state and will not count the call as taking slow
+          path.
+
+        The challenge when dealing with this is that often, we will have an super early compilation
+        of a minimorphic call site before we have seen all of its small set of callees. For example
+        we may have seen only one of two possible callees. That early compilation will OSR exit, and
+        in trunk, will be recompiled with bimorphic speculative inlining. That's a pretty good
+        outcome. Basically, we are trusting that if during the time that the function has been
+        running prior to a given compilation, a callsite has only seen a small number of callees,
+        then it's safe to assume that it won't see another one anytime soon.
+
+        So, simply forcing the CallLinkStatus to set takesSlowPath any time there was a BadCell exit
+        would hurt our performance in some cases, because trunk prior to this change would have their
+        final compilation use speculative inlining, and this change would make guarded inlining
+        instead.
+
+        The compromise that I came up with relies on the fact that a CallLinkInfo must be reset quite
+        frequently for it to routinely happen in between tier-up to DFG (or FTL) and an exit. So,
+        most likely, such a CallLinkInfo will also show up as being clear when the CallLinkStatus
+        is built during DFG profiling. The CallLinkStatus will then fall back on the CallLinkInfo's
+        lastSeenCallee field, which is persistent across resets. This change just makes it so that
+        CallLinkStatus sets takesSlowPath if there is a BadCell exit and the status had to be
+        inferred from the lastSeenCallee.
+
+        This change reduces pointless recompilations in gbemu. It's an 11% speed-up on gbemu. It
+        doesn't seem to hurt any benchmarks.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::computeFor):
+        (JSC::CallLinkStatus::computeExitSiteData):
+        (JSC::CallLinkStatus::computeFromCallLinkInfo):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::CallLinkStatus):
+        (JSC::CallLinkStatus::at):
+        (JSC::CallLinkStatus::operator[]):
+        (JSC::CallLinkStatus::isProved):
+        (JSC::CallLinkStatus::isBasedOnStub):
+        (JSC::CallLinkStatus::canOptimize):
+        (JSC::CallLinkStatus::maxNumArguments):
+        (JSC::CallLinkStatus::ExitSiteData::ExitSiteData): Deleted.
+
+2016-01-29  Saam barati  <sbarati@apple.com>
+
+        Pack FunctionExecutable and UnlinkedFunctionExecutable harder
+        https://bugs.webkit.org/show_bug.cgi?id=153687
+
+        Reviewed by Andreas Kling.
+
+        This patch reduces FunctionExecutable from 120 to 104 bytes.
+        This patch reduces UnlinkedFunctionExecutable from 144 to 136 bytes.
+
+        * bytecode/ExecutableInfo.h:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * parser/ParserModes.h:
+        (JSC::functionNameScopeIsDynamic):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::needsActivation):
+        (JSC::ScriptExecutable::isArrowFunctionContext):
+        (JSC::ScriptExecutable::isStrictMode):
+        (JSC::ScriptExecutable::derivedContextType):
+        (JSC::ScriptExecutable::ecmaMode):
+        (JSC::ScriptExecutable::finishCreation):
+
+2016-01-29  Saam barati  <sbarati@apple.com>
+
+        JSC Sampling Profiler: Come up with a (program counter => CodeOrigin) mapping
+        https://bugs.webkit.org/show_bug.cgi?id=152629
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements a mapping from PC to CodeOrigin
+        that lives off of JITed CodeBlocks. We build this mapping
+        while JITing code, and then we compress it and store
+        it on the CodeBlock. We only build the mapping if a debugger
+        has ever been attached to any global object.
+
+        CodeBlock consults this mapping when searching for a CodeOrigin
+        for a given PC, but it also consults other code ranges
+        off the main path that may own the PC. Specifically, it searches
+        through inline caches, OSRExits, and LazySlowPaths.
+
+        To find PC info for the LLInt, we also save the LLInt pc when
+        taking a stack trace where the top frame is in LLInt code.
+
+        This patch also cleans up code inside the SamplingProfier.
+        I realized a bug in the SamplingProfiler's implementation.
+        We used to walk the inline stack while gathering a stack
+        trace. This is wrong. It's super dangerous to do this because
+        we might pause the JSC process while it's modifying its
+        CodeOrigin table. We used to walk the inline stack while
+        taking a stack trace because doing so could save us from
+        having to verify a particular stack trace. This patch changes that.
+        We now have to verify all stack traces taken. This verification step
+        includes walking the inline stack.
+
+        Because we have a PC=>CodeOrigin map, we can now gather more
+        detailed information about the top-frame we pause. This allows
+        us to correctly observe inlining. It also allows us to observe
+        expression-level line/column information for the top frame.
+        The reason we don't consult this mapping for parent frames is 
+        that all parent frames should set the CallSiteIndex on the call
+        frame header, which means we can consult that value to get inlining 
+        and expression-level line/column information.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::Label::operator==):
+        (JSC::AbstractMacroAssembler::Label::isSet):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerLabel::labelAtOffset):
+        (JSC::AssemblerLabel::operator==):
+        * b3/B3Generate.cpp:
+        * b3/B3Origin.h:
+        (JSC::B3::Origin::data):
+        (JSC::B3::Origin::operator==):
+        * b3/B3PCToOriginMap.h: Added.
+        (JSC::B3::PCToOriginMap::PCToOriginMap):
+        (JSC::B3::PCToOriginMap::appendItem):
+        (JSC::B3::PCToOriginMap::ranges):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::pcToOriginMap):
+        (JSC::B3::Procedure::releasePCToOriginMap):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
+        (JSC::CodeBlock::setPCToCodeOriginMap):
+        (JSC::CodeBlock::findPC):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::jitCodeMap):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/CodeOrigin.h:
+        (JSC::CodeOrigin::operator==):
+        (JSC::CodeOriginHash::hash):
+        (JSC::CodeOriginHash::equal):
+        * bytecode/InlineCallFrame.h:
+        (JSC::baselineCodeBlockForOriginAndBaselineCodeBlock):
+        (JSC::CodeOrigin::walkUpInlineStack):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::PolymorphicAccess::containsPC):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::visitWeakReferences):
+        (JSC::StructureStubInfo::containsPC):
+        * bytecode/StructureStubInfo.h:
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::hasExpressionInfo):
+        (JSC::UnlinkedCodeBlock::expressionInfo):
+        (JSC::UnlinkedCodeBlock::setThisRegister):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::attach):
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::validateReferences):
+        (JSC::DFG::JITCode::findPC):
+        * dfg/DFGJITCode.h:
+        (JSC::DFG::JITCode::commonDataOffset):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::JITCompiler):
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        (JSC::DFG::JITCompiler::recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded):
+        (JSC::DFG::JITCompiler::setEndOfMainPath):
+        (JSC::DFG::JITCompiler::setEndOfCode):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::JITCompiler::setStartOfCode):
+        (JSC::DFG::JITCompiler::setForNode):
+        (JSC::DFG::JITCompiler::addCallSite):
+        (JSC::DFG::JITCompiler::pcToCodeOriginMapBuilder):
+        (JSC::DFG::JITCompiler::setEndOfMainPath): Deleted.
+        (JSC::DFG::JITCompiler::setEndOfCode): Deleted.
+        * dfg/DFGSlowPathGenerator.h:
+        (JSC::DFG::SlowPathGenerator::call):
+        (JSC::DFG::SlowPathGenerator::origin):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * dfg/DFGSpeculativeJIT.h:
+        * ftl/FTLB3Compile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        (JSC::FTL::JITCode::findPC):
+        * ftl/FTLJITCode.h:
+        (JSC::FTL::JITCode::b3Code):
+        * heap/MachineStackMarker.cpp:
+        (JSC::MachineThreads::Thread::Registers::instructionPointer):
+        (JSC::MachineThreads::Thread::Registers::llintPC):
+        (JSC::MachineThreads::Thread::freeRegisters):
+        * heap/MachineStackMarker.h:
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::addEvent):
+        (Inspector::buildSamples):
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::findPC):
+        * jit/PCToCodeOriginMap.cpp: Added.
+        (JSC::PCToCodeOriginMapBuilder::PCToCodeOriginMapBuilder):
+        (JSC::PCToCodeOriginMapBuilder::appendItem):
+        (JSC::PCToCodeOriginMap::PCToCodeOriginMap):
+        (JSC::PCToCodeOriginMap::~PCToCodeOriginMap):
+        (JSC::PCToCodeOriginMap::memorySize):
+        (JSC::PCToCodeOriginMap::findPC):
+        * jit/PCToCodeOriginMap.h: Added.
+        (JSC::PCToCodeOriginMapBuilder::defaultCodeOrigin):
+        (JSC::PCToCodeOriginMapBuilder::didBuildMapping):
+        * jsc.cpp:
+        (functionSamplingProfilerStackTraces):
+        * llint/LLIntPCRanges.h:
+        (JSC::LLInt::isLLIntPC):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/Options.h:
+        * runtime/SamplingProfiler.cpp:
+        (JSC::reportStats):
+        (JSC::FrameWalker::FrameWalker):
+        (JSC::FrameWalker::walk):
+        (JSC::FrameWalker::resetAtMachineFrame):
+        (JSC::FrameWalker::isValidFramePointer):
+        (JSC::SamplingProfiler::SamplingProfiler):
+        (JSC::SamplingProfiler::~SamplingProfiler):
+        (JSC::tryGetBytecodeIndex):
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        (JSC::SamplingProfiler::visit):
+        (JSC::SamplingProfiler::noticeVMEntry):
+        (JSC::SamplingProfiler::clearData):
+        (JSC::SamplingProfiler::StackFrame::displayName):
+        (JSC::SamplingProfiler::StackFrame::displayNameForJSONTests):
+        (JSC::SamplingProfiler::StackFrame::functionStartLine):
+        (JSC::SamplingProfiler::StackFrame::functionStartColumn):
+        (JSC::SamplingProfiler::StackFrame::sourceID):
+        (JSC::SamplingProfiler::StackFrame::url):
+        (JSC::SamplingProfiler::releaseStackTraces):
+        (JSC::SamplingProfiler::stackTracesAsJSON):
+        (WTF::printInternal):
+        (JSC::SamplingProfiler::StackFrame::startLine): Deleted.
+        (JSC::SamplingProfiler::StackFrame::startColumn): Deleted.
+        (JSC::SamplingProfiler::stackTraces): Deleted.
+        * runtime/SamplingProfiler.h:
+        (JSC::SamplingProfiler::UnprocessedStackFrame::UnprocessedStackFrame):
+        (JSC::SamplingProfiler::StackFrame::StackFrame):
+        (JSC::SamplingProfiler::StackTrace::StackTrace):
+        (JSC::SamplingProfiler::totalTime):
+        (JSC::SamplingProfiler::setStopWatch):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::setShouldBuildPCToCodeOriginMapping):
+        (JSC::VM::shouldBuilderPCToCodeOriginMapping):
+        * tests/stress/sampling-profiler-basic.js:
+        (platformSupportsSamplingProfiler.top):
+        (platformSupportsSamplingProfiler.jaz):
+        (platformSupportsSamplingProfiler.kaz):
+
+2016-01-29  Saam barati  <sbarati@apple.com>
+
+        Remove our notion of having a single activation register
+        https://bugs.webkit.org/show_bug.cgi?id=153673
+
+        Reviewed by Filip Pizlo.
+
+        We have many functions lurking around where we think a function 
+        might only have one activation register. This is clearly wrong
+        now that ES6 has block scoping. This patch removes this false notion.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::scopeRegister):
+        (JSC::CodeBlock::codeType):
+        (JSC::CodeBlock::setActivationRegister): Deleted.
+        (JSC::CodeBlock::activationRegister): Deleted.
+        (JSC::CodeBlock::uncheckedActivationRegister): Deleted.
+        (JSC::CodeBlock::needsActivation): Deleted.
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::usesEval):
+        (JSC::ExecutableInfo::isStrictMode):
+        (JSC::ExecutableInfo::isConstructor):
+        (JSC::ExecutableInfo::isClassContext):
+        (JSC::ExecutableInfo::needsActivation): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext):
+        (JSC::UnlinkedCodeBlock::isClassContext):
+        (JSC::UnlinkedCodeBlock::setThisRegister):
+        (JSC::UnlinkedCodeBlock::setScopeRegister):
+        (JSC::UnlinkedCodeBlock::usesGlobalObject):
+        (JSC::UnlinkedCodeBlock::setGlobalObjectRegister):
+        (JSC::UnlinkedCodeBlock::thisRegister):
+        (JSC::UnlinkedCodeBlock::scopeRegister):
+        (JSC::UnlinkedCodeBlock::addPropertyAccessInstruction):
+        (JSC::UnlinkedCodeBlock::needsFullScopeChain): Deleted.
+        (JSC::UnlinkedCodeBlock::setActivationRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::activationRegister): Deleted.
+        (JSC::UnlinkedCodeBlock::hasActivationRegister): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeVarLexicalEnvironment):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::destinationForAssignResult):
+        (JSC::BytecodeGenerator::leftHandSideNeedsCopy):
+        (JSC::BytecodeGenerator::emitNodeForLeftHandSide):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::inliningCost):
+        (JSC::DFG::ByteCodeParser::parseCodeBlock):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::hasExitSite):
+        (JSC::DFG::Graph::activationRegister): Deleted.
+        (JSC::DFG::Graph::uncheckedActivationRegister): Deleted.
+        (JSC::DFG::Graph::machineActivationRegister): Deleted.
+        (JSC::DFG::Graph::uncheckedMachineActivationRegister): Deleted.
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::callSiteIndex):
+        (JSC::CallFrame::stack):
+        (JSC::CallFrame::callerFrame):
+        (JSC::CallFrame::friendlyFunctionName):
+        (JSC::CallFrame::hasActivation): Deleted.
+        (JSC::CallFrame::uncheckedActivation): Deleted.
+        (JSC::CallFrame::lexicalEnvironment): Deleted.
+        (JSC::CallFrame::lexicalEnvironmentOrNullptr): Deleted.
+        (JSC::CallFrame::setActivation): Deleted.
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::scope):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::setScope):
+        (JSC::ExecState::init):
+        * interpreter/Register.h:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::usesEval):
+        (JSC::ScriptExecutable::usesArguments):
+        (JSC::ScriptExecutable::isArrowFunctionContext):
+        (JSC::ScriptExecutable::isStrictMode):
+        (JSC::ScriptExecutable::derivedContextType):
+        (JSC::ScriptExecutable::needsActivation): Deleted.
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::asActivation):
+        (JSC::Register::lexicalEnvironment): Deleted.
+
+2016-01-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Air:fixObviousSpills should handle floats and doubles
+        https://bugs.webkit.org/show_bug.cgi?id=153197
+
+        Reviewed by Saam Barati.
+
+        This adds the most obvious handling of float spills, where we just enable load elimination on
+        float spill code.
+
+        * b3/air/AirFixObviousSpills.cpp:
+
+2016-01-29  Andreas Kling  <akling@apple.com>
+
+        Shrink CodeBlock!
+        <https://webkit.org/b/153640>
+
+        Reviewed by Saam Barati.
+
+        Shrink CodeBlock by 112 bytes (from 640 to 528) by employing
+        these sophisticated tricks:
+
+            - Remove members that are not used by anyone.
+            - Don't cache both VM* and Heap* in members.
+            - Reorder members to minimize struct padding.
+            - Use RefCountedArray instead of Vector for arrays that never resize.
+            - Put a not-always-present HashMap in a std::unique_ptr.
+
+        This increases CodeBlock space efficiency by 20%, as we can now
+        fit 30 of them in a MarkedBlock, up from 25.)
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::setNumParameters):
+        (JSC::CodeBlock::jettison):
+        (JSC::CodeBlock::noticeIncomingCall):
+        (JSC::CodeBlock::resultProfileForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::capabilityLevelState):
+        (JSC::CodeBlock::codeType):
+        (JSC::CodeBlock::ensureResultProfile):
+        (JSC::CodeBlock::heap):
+
+2016-01-29  Saam barati  <sbarati@apple.com>
+
+        Exits from exceptions shouldn't jettison code
+        https://bugs.webkit.org/show_bug.cgi?id=153564
+
+        Reviewed by Geoffrey Garen.
+
+        We create two new exit kinds for exception-handling
+        OSRExits:
+        - ExceptionCheck: an exception check after a C call.
+        - GenericUnwind: an OSR exit executes because it's jumped to from genericUnwind machinery.
+
+        Having these two new exit kinds allows us to remove fields from
+        various OSRExit variants that store booleans indicating
+        if the exit is an exception handler, and if so, what kind
+        of exception handler. Most of this patch is just removing
+        those old fields and adding new equivalent functions.
+
+        This patch also implements the policy that we should never consider jettisoning
+        code from exits that happen from an exception check to an op_catch (it might be worth
+        considering a similar policy for 'throw'). We're choosing this policy because
+        it will almost never be more expensive, in total, to execute the OSR exit than
+        to execute the baseline variant of the code. When an exception is thrown, we do
+        really expensive work, like call through to genericUnwind, and also create an error
+        object with a stack trace. The cost of OSR exiting here is small in comparison to
+        those other operations. And penalizing a CodeBlock for OSR exiting from an exception
+        is silly because the basis of our implementation of exception handling in the
+        upper tiers is to OSR exit on a caught exception. So we used to penalize
+        ourselves for having an implementation that is correct w.r.t our design goals.
+
+        I've verified this hypothesis with on v8-raytrace by adding a new 
+        benchmark that throws with very high frequency. Implementing
+        this policy on that benchmark results in about a 4-5% speed up.
+
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        (JSC::exitKindMayJettison):
+        (JSC::exitKindIsCountable): Deleted.
+        * bytecode/ExitKind.h:
+        * dfg/DFGJITCode.cpp:
+        (JSC::DFG::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::noticeOSREntry):
+        (JSC::DFG::JITCompiler::appendExceptionHandlingOSRExit):
+        (JSC::DFG::JITCompiler::exceptionCheck):
+        (JSC::DFG::JITCompiler::recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded):
+        * dfg/DFGJITCompiler.h:
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitBase.h:
+        (JSC::DFG::OSRExitBase::OSRExitBase):
+        (JSC::DFG::OSRExitBase::isExceptionHandler):
+        (JSC::DFG::OSRExitBase::isGenericUnwindHandler):
+        (JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::handleExitCounts):
+        (JSC::DFG::osrWriteBarrier):
+        (JSC::DFG::adjustAndJumpToTarget):
+        * dfg/DFGOSRExitCompilerCommon.h:
+        (JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::emitOSRExit):
+        (JSC::FTL::OSRExitDescriptor::emitOSRExitLater):
+        (JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::spillRegistersToSpillSlot):
+        (JSC::FTL::OSRExit::recoverRegistersFromSpillSlot):
+        (JSC::FTL::OSRExit::willArriveAtExitFromIndirectExceptionCheck):
+        (JSC::FTL::OSRExit::willArriveAtOSRExitFromCallOperation):
+        (JSC::FTL::exceptionTypeWillArriveAtOSRExitFromGenericUnwind): Deleted.
+        (JSC::FTL::OSRExit::willArriveAtOSRExitFromGenericUnwind): Deleted.
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLPatchpointExceptionHandle.cpp:
+        (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreation):
+        (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
+        (JSC::FTL::PatchpointExceptionHandle::PatchpointExceptionHandle):
+        (JSC::FTL::PatchpointExceptionHandle::createHandle):
+        * ftl/FTLPatchpointExceptionHandle.h:
+
+2016-01-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [B3] REGRESSION(r195395): testComplex(64, 128) asserts on Linux with GCC
+        https://bugs.webkit.org/show_bug.cgi?id=153422
+
+        Reviewed by Filip Pizlo.
+
+        Previously proc.values() returns ValuesCollection (Not reference!).
+        values.values takes const ValueCollection&.
+        And later it produces IndexSet<Value>::Iterable<Procedure::ValuesCollection>,
+        it holds const ValueCollection& as its member.
+        But IndexSet<Value>::Iterable<Procedure::ValuesCollection> is just an instance.
+        So after creating this, the lifetime of the ValueCollection const reference finished.
+
+        To fix that, we hold ValuesCollection as a member of Procedure.
+        And change the signature to const ValuesCollection& Procedure::values().
+
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::Procedure):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::values):
+
+2016-01-28  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: InspectorTimelineAgent doesn't need to recompile functions because it now uses the sampling profiler
+        https://bugs.webkit.org/show_bug.cgi?id=153500
+        <rdar://problem/24352458>
+
+        Reviewed by Timothy Hatcher.
+
+        Be more explicit about enabling legacy profiling.
+
+        * jsc.cpp:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::hasLegacyProfiler):
+        (JSC::JSGlobalObject::createProgramCodeBlock):
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        (JSC::JSGlobalObject::hasProfiler): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsLegacyProfiling):
+        (JSC::JSGlobalObject::supportsProfiling): Deleted.
+
+2016-01-28  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Fix the B3 build with GCC 4.9.3
+        https://bugs.webkit.org/show_bug.cgi?id=151624
+
+        Reviewed by Filip Pizlo.
+
+        Due to GCC 4.9's compiler issue[1], method calls inside (2 or so) nested lambdas need to use `this` to avoid internal compiler errors.
+        [1]: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62272
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+
+2016-01-28  Filip Pizlo  <fpizlo@apple.com>
+
+        LowerToAir::preferRightForResult() should resolve use count ties by selecting the child that is closest in an idom walk
+        https://bugs.webkit.org/show_bug.cgi?id=153583
+
+        Reviewed by Benjamin Poulain.
+
+        This undoes the AsmBench/n-body regression in r195654 while preserving that revision's
+        Kraken progression.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::LowerToAir):
+        (JSC::B3::Air::LowerToAir::preferRightForResult):
+
+2016-01-28  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] B3 Tail Call with Varargs do not restore callee saved registers
+        https://bugs.webkit.org/show_bug.cgi?id=153579
+
+        Reviewed by Michael Saboff.
+
+        We were trashing the callee saved registers in Tail Calls.
+
+        I just copied the code from DFG to fix this :)
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+
+2016-01-27  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 IntRange analysis should know more about shifting
+        https://bugs.webkit.org/show_bug.cgi?id=153568
+
+        Reviewed by Benjamin Poulain.
+
+        This teaches the IntRange analysis that the result of a right shift is usually better than
+        the worst-case mask based on the shift amount. In fact, you can reach useful conclusions
+        from looking at the IntRange of the input. This helps because Octane/crypto does something
+        like:
+
+            CheckMul((@x & $268435455) >> 14, @y >> 14, ...)
+
+        If you consider just the shifts, then this may overflow. But if you consider that @x is
+        first masked, then the IntRange coming out of the first shift is tight enough to prove that
+        the CheckMul cannot overflow.
+
+        * b3/B3ReduceStrength.cpp:
+        * b3/testb3.cpp:
+
+2016-01-27  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] adjustFrameAndStackInOSRExitCompilerThunk() can trash values in FTL
+        https://bugs.webkit.org/show_bug.cgi?id=153536
+
+        Reviewed by Saam Barati.
+
+        Workaround to get B3 working on ARM.
+
+        * dfg/DFGOSRExitCompilerCommon.h:
+        (JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):
+        The code was using the scratch registers in a few places.
+
+        I initially tried to make is not use scratch registers anywhere
+        but that looked super fragile.
+
+        Instead, I just preserve the scratch registers. That's easy and
+        it should be relatively cheap compared to everything done on OSR Exits.
+
+2016-01-27  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Use reinterpret_cast_ptr to suppress alignment warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=153424
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::sortFloat):
+
+2016-01-27  Per Arne Vollan  <peavo@outlook.com>
+
+        [FTL][Win64] Compile fix.
+        https://bugs.webkit.org/show_bug.cgi?id=153555
+
+        Reviewed by Alex Christensen.
+
+        MSVC does not accept preprocessor conditionals in macros.
+
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+
+2016-01-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Air::TmpWidth uses a stale pointer into its HashMap after it calls add()
+        https://bugs.webkit.org/show_bug.cgi?id=153546
+
+        Reviewed by Saam Barati.
+
+        * b3/air/AirTmpWidth.cpp:
+        (JSC::B3::Air::TmpWidth::recompute):
+
+2016-01-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Remove ENABLE_CURRENTSRC
+        https://bugs.webkit.org/show_bug.cgi?id=153545
+
+        Reviewed by Simon Fraser.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-01-26  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] When lowering B3 to Air, preferRightForResult() should prefer values from the same block
+        https://bugs.webkit.org/show_bug.cgi?id=153477
+
+        Reviewed by Filip Pizlo.
+
+        In cases like this:
+
+        Block #0
+            @1 = something
+            @2 = Jump #1
+        Block #1
+            @3 = something else
+            @4 = Add(@3, @1)
+            ...
+            @42 = Branch(@x, #1, #2)
+
+        B3LowerToAir would pick @1 for the argument copied
+        for what goes into the UseDef side of Add.
+
+        This created a bunch of moves that could never be coalesced.
+        In Kraken's imaging-desaturate, there were enough Moves to slow
+        down the hot loop.
+
+        Ideally, we should not use UseCount for lowering. We should use
+        the real liveness for preferRightForResult(), and a loop-weighted
+        use-count for effective addresses. The problem is keeping the cost
+        low for those simple helpers.
+
+        In this patch, I went with a simple heuristic: prioritize the value
+        defined in the same block for UseDef.
+
+        There is one other way that would be cheap but a bit invasive:
+        -Get rid of UseDef.
+        -Make every ops, 3 operands.
+        -Tell the register allocator to attempt aliasing of the 2 uses
+         with the def.
+        -If the allocator fails, just add a move as needed.
+
+        For now, the simple heuristic seems okay for the cases have.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::preferRightForResult):
+
+2016-01-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Tail duplication should break critical edges first
+        https://bugs.webkit.org/show_bug.cgi?id=153530
+
+        Reviewed by Benjamin Poulain.
+
+        This speeds up Octane/boyer.
+
+        * b3/B3DuplicateTails.cpp:
+
+2016-01-26  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Generalize ResourceUsageData gathering to be used outside of ResourceUsageOverlay
+        https://bugs.webkit.org/show_bug.cgi?id=153509
+        <rdar://problem/24354291>
+
+        Reviewed by Andreas Kling.
+
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::didAllocateBlock):
+        (JSC::Heap::didFreeBlock):
+        Rename the ENABLE flag.
+
+2016-01-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [B3] Fix control reaches end of non-void function GCC warning after r195139
+        https://bugs.webkit.org/show_bug.cgi?id=153426
+
+        Reviewed by Michael Catanzaro.
+
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::cooled):
+
+2016-01-26  Saam barati  <sbarati@apple.com>
+
+        testb3 and testAir should be compiled under -O0
+        https://bugs.webkit.org/show_bug.cgi?id=153520
+
+        Reviewed by Benjamin Poulain.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2016-01-26  Filip Pizlo  <fpizlo@apple.com>
+
+        B3's integer range analysis should know that Mul'ing two sufficiently small numbers will yield a number that still has a meaningful range
+        https://bugs.webkit.org/show_bug.cgi?id=153518
+
+        Reviewed by Benjamin Poulain.
+
+        Octane/encrypt had an addition overflow check that can be proved away by being sufficiently
+        sneaky about the analysis of adds, multiplies, and shifts.
+
+        I almost added these optimizations to the DFG integer range optimization phase. That phase is
+        very complicated. B3's integer range analysis is trivial. So I added it to B3. Eventually
+        we'll want this same machinery in the DFG also.
+
+        8% speed-up on Octane/encrypt.
+
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::dump): Dumping a constant value's name now dumps its value. This makes a huge difference for reading IR.
+        (JSC::B3::Value::cloneImpl):
+        (JSC::B3::Value::deepDump):
+
+2016-01-26  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to disable FTL for a range like we disable DFG for a range
+        https://bugs.webkit.org/show_bug.cgi?id=153511
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
+        (JSC::DFG::TierUpCheckInjectionPhase::run):
+        * runtime/Options.h:
+
+2016-01-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Shifts by an amount computed using BitAnd with a mask that subsumes the shift's own mask should be rewired around the BitAnd
+        https://bugs.webkit.org/show_bug.cgi?id=153505
+
+        Reviewed by Saam Barati.
+
+        Turn this: Shl(@x, BitAnd(@y, 63))
+        Into this: Shl(@x, @y)
+
+        It matters for Octane/crypto.
+
+        We should also stop FTL from generating such code, but even if we did that, we'd still want
+        this optimization in case user code did the BitAnd.
+
+        Also we can't stop the FTL from generating such code yet, because when targetting LLVM, you
+        must mask your shifts this way.
+
+        * b3/B3ReduceStrength.cpp:
+
+2016-01-26  Filip Pizlo  <fpizlo@apple.com>
+
+        The thing that B3 uses to describe a stack slot should not be a Value
+        https://bugs.webkit.org/show_bug.cgi?id=153491
+        rdar://problem/24349446
+
+        Reviewed by Geoffrey Garen and Saam Barati.
+
+        Prior to this change, B3 represented stack slots by having a StackSlotValue that carried
+        two meanings:
+
+        - It represented a stack slot.
+
+        - It was a kind of Value for getting the base of the stack slot.
+
+        This seems like a good idea until you consider the following issues.
+
+        1) A Value can be killed if it is on an unreachable path, or if it has no effects and
+           nobody refers to it. But the FTL uses StackSlotValue to allocate space on the stack.
+           When it does this, it doesn't want it to be killed. It will dereference the object, so
+           killing it is a bug.
+
+        2) A premise of B3 is that it should be always legal to perform the following
+           transformation on a value:
+
+           value->replaceWithIdentity(insertionSet.insertValue(index, proc.clone(value)));
+
+           This inserts a new value just before the old one. The new value is a clone of the old
+           one. Then the old one is essentially deleted (anything that becomes an identity dies
+           shortly thereafter). Problem (1) prevents this from being legal, which breaks a major
+           premise of B3 IR.
+
+        3) A premise of B3 is that it should be always legal to perform the following
+           transformation on a value:
+
+           Before:
+                   @42 = Thing(...)
+
+           After:
+                   Branch(@doesntMatter, #yes, #no)
+               BB#yes:
+                   @42_one = Thing(...)
+                   Upsilon(@42_one, ^42)
+                   Jump(#done)
+               BB#no:
+                   @42_two = Thing(...)
+                   Upsilon(@42_two, ^42)
+                   Jump(#done)
+               BB#done:
+                   @42 = Phi()
+
+           But prior to this change, such a transformation makes absolutely no sense for
+           StackSlot. It will "work" in the sense that the compiler will proceed undaunted, but
+           it will disable SSA fix-up for the cloned stack slot and we will end up allocating two
+           stack slots instead of one, and then we will assume that they both escape, which will
+           disable efficient stack allocation. Note that the moral equivalent of this
+           transformation could already happen due to tail duplication, and the only reason why
+           it's not a bug right now is that we happen to hoist stack slots to the root block. But
+           the whole point of our stack slots was supposed to be that they do not have to be
+           hoisted.
+
+        This change fixes this issue by splitting StackSlotValue into two things: SlotBaseValue,
+        which is a pure operation for getting the base address of a StackSlot, and StackSlot,
+        which is a representation of the actual stack slot. StackSlot cannot get duplicated and
+        can only be killed if it's anonymous. SlotBaseValue can be killed, moved, cloned,
+        hoisted, etc. Since it has no effects and it has a ValueKey, it's one of the most
+        permissive Values in the IR, just as one would hope (after all, there is actually zero
+        code that needs to execute to evaluate SlotBaseValue).
+
+        This fixes a crash that we saw with GuardMalloc and ASan. It also makes the IR a lot more
+        easy to reason about.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3EliminateCommonSubexpressions.cpp:
+        * b3/B3FixSSA.cpp:
+        (JSC::B3::demoteValues):
+        (JSC::B3::fixSSA):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::setBlockOrderImpl):
+        (JSC::B3::Procedure::addStackSlot):
+        (JSC::B3::Procedure::addAnonymousStackSlot):
+        (JSC::B3::Procedure::clone):
+        (JSC::B3::Procedure::dump):
+        (JSC::B3::Procedure::blocksInPostOrder):
+        (JSC::B3::Procedure::deleteStackSlot):
+        (JSC::B3::Procedure::deleteValue):
+        (JSC::B3::Procedure::calleeSaveRegisters):
+        (JSC::B3::Procedure::addStackSlotIndex):
+        (JSC::B3::Procedure::addValueIndex):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::setBlockOrder):
+        (JSC::B3::Procedure::StackSlotsCollection::StackSlotsCollection):
+        (JSC::B3::Procedure::StackSlotsCollection::size):
+        (JSC::B3::Procedure::StackSlotsCollection::at):
+        (JSC::B3::Procedure::StackSlotsCollection::operator[]):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::iterator):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator*):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator++):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator==):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::operator!=):
+        (JSC::B3::Procedure::StackSlotsCollection::iterator::findNext):
+        (JSC::B3::Procedure::StackSlotsCollection::begin):
+        (JSC::B3::Procedure::StackSlotsCollection::end):
+        (JSC::B3::Procedure::stackSlots):
+        (JSC::B3::Procedure::ValuesCollection::ValuesCollection):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3SlotBaseValue.cpp: Copied from Source/JavaScriptCore/b3/B3StackSlotValue.cpp.
+        (JSC::B3::SlotBaseValue::~SlotBaseValue):
+        (JSC::B3::SlotBaseValue::dumpMeta):
+        (JSC::B3::SlotBaseValue::cloneImpl):
+        (JSC::B3::StackSlotValue::~StackSlotValue): Deleted.
+        (JSC::B3::StackSlotValue::dumpMeta): Deleted.
+        (JSC::B3::StackSlotValue::cloneImpl): Deleted.
+        * b3/B3SlotBaseValue.h: Copied from Source/JavaScriptCore/b3/B3StackSlotValue.h.
+        * b3/B3StackSlot.cpp: Added.
+        (JSC::B3::StackSlot::~StackSlot):
+        (JSC::B3::StackSlot::dump):
+        (JSC::B3::StackSlot::deepDump):
+        (JSC::B3::StackSlot::StackSlot):
+        * b3/B3StackSlot.h: Added.
+        (JSC::B3::StackSlot::byteSize):
+        (JSC::B3::StackSlot::kind):
+        (JSC::B3::StackSlot::isLocked):
+        (JSC::B3::StackSlot::index):
+        (JSC::B3::StackSlot::offsetFromFP):
+        (JSC::B3::StackSlot::setOffsetFromFP):
+        (JSC::B3::DeepStackSlotDump::DeepStackSlotDump):
+        (JSC::B3::DeepStackSlotDump::dump):
+        (JSC::B3::deepDump):
+        * b3/B3StackSlotValue.cpp: Removed.
+        * b3/B3StackSlotValue.h: Removed.
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::checkOpcode):
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::materialize):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::addBlock):
+        (JSC::B3::Air::Code::addStackSlot):
+        (JSC::B3::Air::Code::addSpecial):
+        * b3/air/AirCode.h:
+        * b3/air/AirStackSlot.cpp:
+        (JSC::B3::Air::StackSlot::setOffsetFromFP):
+        (JSC::B3::Air::StackSlot::dump):
+        (JSC::B3::Air::StackSlot::deepDump):
+        (JSC::B3::Air::StackSlot::StackSlot):
+        * b3/air/AirStackSlot.h:
+        (JSC::B3::Air::StackSlot::alignment):
+        (JSC::B3::Air::StackSlot::b3Slot):
+        (JSC::B3::Air::StackSlot::offsetFromFP):
+        (WTF::printInternal):
+        (JSC::B3::Air::StackSlot::value): Deleted.
+        * b3/testb3.cpp:
+        (JSC::B3::testStackSlot):
+        (JSC::B3::testStoreLoadStackSlot):
+        * ftl/FTLB3Compile.cpp:
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::appendTo):
+        (JSC::FTL::Output::lockedStackSlot):
+        (JSC::FTL::Output::neg):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::framePointer):
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::constInt32):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        * ftl/FTLState.h:
+
+2016-01-26  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove a useless #include
+        https://bugs.webkit.org/show_bug.cgi?id=153474
+
+        Reviewed by Alexey Proskuryakov.
+
+        * b3/B3ReduceStrength.cpp:
+
+2016-01-26  Alex Christensen  <achristensen@webkit.org>
+
+        [Win] Fix clean build after r195545.
+        ​https://bugs.webkit.org/show_bug.cgi?id=153434
+
+        * CMakeLists.txt:
+        * PlatformWin.cmake:
+        Derived sources need to be copied after the build, but everything else should be copied before.
+        This should fix ews issues like the one seen in bug 153473.
+
+2016-01-25  Filip Pizlo  <fpizlo@apple.com>
+
+        FTLB3Output should maintain good block order like the LLVM one does
+        https://bugs.webkit.org/show_bug.cgi?id=152222
+
+        Reviewed by Geoffrey Garen.
+
+        This fixes FTLB3Output to emit an ordered B3 IR. This makes inspecting IR *a lot* easier.
+        It will also be a performance win whenever we use range-based data structures for
+        liveness.
+
+        Also two small other changes:
+        - Added some more dumping in integer range optimization phase.
+        - Refined the disassembler's printing of instruction width suffixes so that "jzl" is not
+          a thing. It was using "l" as the suffix because jumps take a 32-bit immediate.
+
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::setBlockOrderImpl):
+        (JSC::B3::Procedure::clone):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::frontendData):
+        (JSC::B3::Procedure::setBlockOrder):
+        * dfg/DFGIntegerRangeOptimizationPhase.cpp:
+        * disassembler/udis86/udis86_syn-att.c:
+        (ud_translate_att):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::initialize):
+        (JSC::FTL::Output::newBlock):
+        (JSC::FTL::Output::applyBlockOrder):
+        (JSC::FTL::Output::appendTo):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::setFrequency):
+        (JSC::FTL::Output::insertNewBlocksBefore):
+        (JSC::FTL::Output::callWithoutSideEffects):
+        (JSC::FTL::Output::newBlock): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+
+2016-01-25  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Arrow function specific features. Lexical bind "arguments"
+        https://bugs.webkit.org/show_bug.cgi?id=145132
+
+        Reviewed by Saam Barati.
+        
+        Added support of ES6 arrow function specific feature, lexical bind of arguments. 
+        http://www.ecma-international.org/ecma-262/6.0/#sec-arrow-function-definitions-runtime-semantics-evaluation
+        'arguments' variable in arrow function must resolve to a binding in a lexically enclosing environment.
+        In srict mode it points to arguments object, and in non-stric mode it points to arguments object or varible 
+        with name 'arguments' if it was declared. 
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::setSourceParseMode):
+        (JSC::Scope::isArrowFunction):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::setIsArrowFunction):
+        * tests/es6.yaml:
+        * tests/stress/arrowfunction-lexical-bind-arguments-non-strict-1.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-arguments-non-strict-2.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-arguments-strict.js: Added.
+
+2016-01-25  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] We should never use x18 on iOS ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=153461
+
+        Reviewed by Filip Pizlo.
+
+        The register x18 is reserved in the iOS variant of the ARM64 ABI.
+
+        The weird thing is: if you use it, its value will change completely
+        randomly. It looks like it is changed by the system on interrupts.
+
+        This patch adds x18 to the reserved register and add assertions
+        to the assembler to prevent similar problems in the future.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::xOrSp):
+        (JSC::ARM64Assembler::xOrZr):
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isIOS): Deleted.
+        * assembler/AssemblerCommon.h:
+        (JSC::isIOS):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::reservedHardwareRegisters):
+
+2016-01-25  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r195550.
+        https://bugs.webkit.org/show_bug.cgi?id=153471
+
+        broke animometer bot (and now we have crash logs!) (Requested
+        by kling on #webkit).
+
+        Reverted changeset:
+
+        "Restore CodeBlock jettison code Geoff accidentally removed"
+        https://bugs.webkit.org/show_bug.cgi?id=151241
+        http://trac.webkit.org/changeset/195550
+
+2016-01-25  Andreas Kling  <akling@apple.com>
+
+        MarkedSpace should have more precise allocators.
+        <https://webkit.org/b/153448>
+        <rdar://problem/23897477>
+
+        Reviewed by Geoffrey Garen.
+
+        The four classes responsible for the bulk of MarkedBlock allocations today are:
+
+            - FunctionCodeBlock (640 bytes)
+            - UnlinkedFunctionCodeBlock (304 bytes)
+            - FunctionExecutable (168 bytes)
+            - UnlinkedFunctionExecutable (144 bytes)
+
+        Due to the size class distribution in MarkedSpace, we've been wasting quite a lot
+        of heap space on these objects. Our "precise" allocators allowed allocation sizes
+        in 16-byte increments up to 128 bytes, but after that point, we'd only allocate
+        in 256-byte size increments.
+
+        Thus each instance of those classes would waste space as follows:
+
+            - FunctionCodeBlock (768-byte cell, 128 bytes wasted)
+            - UnlinkedFunctionCodeBlock (512-byte cell, 208 bytes wasted)
+            - FunctionExecutable(256-byte cell, 88 bytes wasted)
+            - UnlinkedFunctionExecutable(256-byte cell, 112 bytes wasted)
+
+        This patch raises the limit for precise allocations from 128 to 768, allowing us
+        to allocate these objects with far better space efficiency.
+
+        The cost of this is 7kB worth of MarkedAllocators and 70 (~2x) more allocators to
+        iterate whenever we iterate all the allocators.
+
+        * heap/MarkedSpace.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::MarkedSpace):
+        (JSC::MarkedSpace::resetAllocators):
+        (JSC::MarkedSpace::forEachAllocator):
+        (JSC::MarkedSpace::isPagedOut):
+
+2016-01-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix the comment about FTL_USES_B3.
+
+        * dfg/DFGCommon.h:
+
+2016-01-25  Filip Pizlo  <fpizlo@apple.com>
+
+        Switch FTL to B3 on X86_64/Mac
+        https://bugs.webkit.org/show_bug.cgi?id=153445
+
+        Rubber stamped by Geoffrey Garen.
+
+        This finally switches from LLVM to B3 in the FTL on X86_64 on the Mac. We recommend that other
+        X86_64 platforms make the switch as well. We will be focusing our performance work on B3 rather
+        than LLVM in the future. ARM64 support is also coming soon, so we will be able to remove FTL
+        LLVM code once that lands.
+
+        Right now this mostly appears as perf-neutral on the major tests. However, it does have the
+        following immediate benefits:
+
+        - Dramatic reduction in FTL compile times, on the order of 5x-10x. This means huge speed-ups in
+          shorter-running tests like V8Spider (21%) and JSRegress (8%).
+
+        - It makes the FTL simpler and more robust because we don't have to do stackmap section
+          parsing. This makes it easier to add new FTL features. We are already working on features,
+          like the sampling profiler, which will only have a FTL B3 implementation.
+
+        - Speed-ups on some throughput benchmarks like mandreel, richards, imaging-gaussian-blur. It's
+          still a slow down on other throughput benchmarks, though.
+
+        We started writing B3 in October, so it's pretty awesome that the throughput of the code it
+        generates is already on par with LLVM.
+        
+        This does not fundamentally change how the FTL works. FTL was built to lower DFG IR to a C-like
+        SSA IR, and then rely on powerful SSA optimizations and comprehensive instruction selection and
+        register allocation to turn that code into something that runs fast. B3 also has a C-like SSA
+        IR, has an instruction selector that is in some ways more powerful than LLVM's (B3 does global
+        instruction selection rather than block-local like LLVM), and it has a register allocator that
+        is in some ways more powerful also (B3 uses IRC, a mature graph coloring allocator, while LLVM
+        does not do graph coloring). We expect FTL B3's performance to improve a lot after we turn it
+        on and can focus our efforts on tuning it.
+
+        I didn't find any test regressions after running both JSC tests and layout tests. Basic
+        browsing still works. JetStream performance difference is within the margin of error. EWS is
+        happy.
+
+        * dfg/DFGCommon.h:
+
+2016-01-25  Andreas Kling  <akling@apple.com>
+
+        Restore CodeBlock jettison code Geoff accidentally removed
+        https://bugs.webkit.org/show_bug.cgi?id=151241
+
+        Rubber-stamped by Geoffrey Garen.
+
+        Geoff meant to add this back in <http://trac.webkit.org/changeset/190827>
+        but missed.
+
+        Then he added it back in, but it was rolled out due to a crash on Animometer.
+        I can no longer produce a crash on Animometer, either with today's version of
+        the benchmark, or the one that existed at the time of the rollout.
+
+        Given this, let's roll it back in and see how it goes.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::timeToLive):
+        (JSC::CodeBlock::shouldJettisonDueToOldAge):
+
+2016-01-22  Filip Pizlo  <fpizlo@apple.com>
+
+        mandreel should run just as fast in FTL B3 as FTL LLVM
+        https://bugs.webkit.org/show_bug.cgi?id=153394
+
+        Reviewed by Gavin Barraclough.
+
+        This fixes two performance bugs and one disassembler bug.
+
+        - B3 now turns Branches into Jumps when they are dominated by a Check on the same
+          condition. This is like the opposite of foldPathConstants() was doing.
+
+        - Air now supports adding to 8-bit or 16-bit memory locations on x86. B3 now knows how to
+          lower Store8(Add(Load8Z(...))) and various other things to these new instructions.
+
+        - Disassembler now knows to print out the instruction's width, whenever it has one.
+          Previously, we'd print movb, movw, movl, and movq as "mov", which is unhelpful if
+          you're storing an immediate, for example.
+
+        This adds a bunch of tests for the new instruction forms. This is a big speed-up on
+        mandreel. It makes us just as fast as LLVM on that benchmark.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::add8):
+        (JSC::MacroAssemblerX86Common::add16):
+        (JSC::MacroAssemblerX86Common::add32AndSetFlags):
+        (JSC::MacroAssemblerX86Common::clz32AfterBsr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addl_rm):
+        (JSC::X86Assembler::addb_rm):
+        (JSC::X86Assembler::addw_rm):
+        (JSC::X86Assembler::addl_ir):
+        (JSC::X86Assembler::addl_im):
+        (JSC::X86Assembler::addb_im):
+        (JSC::X86Assembler::addw_im):
+        (JSC::X86Assembler::addq_rr):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::addr):
+        (JSC::B3::Air::LowerToAir::loadPromiseAnyOpcode):
+        (JSC::B3::Air::LowerToAir::loadPromise):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3PureCSE.cpp:
+        (JSC::B3::PureCSE::clear):
+        (JSC::B3::PureCSE::findMatch):
+        (JSC::B3::PureCSE::process):
+        * b3/B3PureCSE.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testNegPtr):
+        (JSC::B3::testStoreAddLoad32):
+        (JSC::B3::testStoreAddLoadImm32):
+        (JSC::B3::testStoreAddLoad8):
+        (JSC::B3::testStoreAddLoadImm8):
+        (JSC::B3::testStoreAddLoad16):
+        (JSC::B3::testStoreAddLoadImm16):
+        (JSC::B3::testStoreAddLoad64):
+        (JSC::B3::testStoreAddLoadImm64):
+        (JSC::B3::testStoreAddLoad32Index):
+        (JSC::B3::testStoreAddLoadImm32Index):
+        (JSC::B3::testStoreAddLoad8Index):
+        (JSC::B3::testStoreAddLoadImm8Index):
+        (JSC::B3::testStoreAddLoad16Index):
+        (JSC::B3::testStoreAddLoadImm16Index):
+        (JSC::B3::testStoreAddLoad64Index):
+        (JSC::B3::testStoreAddLoadImm64Index):
+        (JSC::B3::testStoreSubLoad):
+        (JSC::B3::run):
+        (JSC::B3::testStoreAddLoad): Deleted.
+        * disassembler/udis86/udis86_syn-att.c:
+        (ud_translate_att):
+
+2016-01-25  Alex Christensen  <achristensen@webkit.org>
+
+        [Win] Copy forwarding headers before building a project
+        https://bugs.webkit.org/show_bug.cgi?id=153434
+
+        Reviewed by Brent Fulgham.
+
+        * CMakeLists.txt:
+        * PlatformWin.cmake:
+
+2016-01-25  Andreas Kling  <akling@apple.com>
+
+        Reduce number of Structures created at startup.
+        <https://webkit.org/b/153399>
+
+        Reviewed by Darin Adler.
+
+        For *Constructor and *Prototype objects that are only created once per JSGlobalObject,
+        build up the Structures using addPropertyWithoutTransition() helpers to avoid creating
+        tons of transitions that would just end up floating around and never getting used.
+
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/ConsolePrototype.cpp:
+        (JSC::ConsolePrototype::finishCreation):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::finishCreation):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::JSArrayBufferPrototype::finishCreation):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectNativeFunctionWithoutTransition):
+        (JSC::JSObject::putDirectBuiltinFunctionWithoutTransition): Deleted.
+        * runtime/JSObject.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::addOwnInternalSlots):
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::addOwnInternalSlots):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::JSTypedArrayViewConstructor::finishCreation):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::JSTypedArrayViewPrototype::finishCreation):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototype::finishCreation):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::finishCreation):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::finishCreation):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototype::finishCreation):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::WeakMapPrototype::finishCreation):
+        * runtime/WeakSetPrototype.cpp:
+        (JSC::WeakSetPrototype::finishCreation):
+
+2016-01-22  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should strength-reduce division by a constant
+        https://bugs.webkit.org/show_bug.cgi?id=153386
+
+        Reviewed by Benjamin Poulain.
+
+        You can turn a 32-bit division by a constant into a 64-bit multiplication by a constant
+        plus some shifts. A book called "Hacker's Delight" has a bunch of math about this. The
+        hard part is finding the constant by which to multiply, and the amount by which to shift.
+        The book tells you some theroems, but you still have to turn that into code by thinking
+        deep thoughts. Luckily I was able to avoid that because it turns out that LLVM already
+        has code for this. It's called APInt::magic(), where APInt is their class for reasoning
+        about integers.
+
+        The code has a compatible license to ours and we have already in the past taken code from
+        LLVM. So, that's what this patch does. The LLVM code is localized in
+        B3ComputeDivisionMagic.h. Then reduceStrength() uses that to construct the multiply+shift
+        sequence.
+
+        This is an enormous speed-up on AsmBench-0.9/bigfib.cpp.js. It makes us as fast on that
+        test as LLVM. It reduces our deficit on AsmBench to 1.5%. Previously it was 4.5%.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3ComputeDivisionMagic.h: Added.
+        (JSC::B3::computeDivisionMagic):
+        * b3/B3ReduceStrength.cpp:
+
+2016-01-22  Saam barati  <sbarati@apple.com>
+
+        genericUnwind might overflow the instructions() vector when catching an FTL exception
+        https://bugs.webkit.org/show_bug.cgi?id=153383
+
+        Reviewed by Benjamin Poulain.
+
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+
+2016-01-22  Mark Lam  <mark.lam@apple.com>
+
+        We should OSR exit with Int52Overflow when we fail to make an Int52 where we expect one.
+        https://bugs.webkit.org/show_bug.cgi?id=153379
+
+        Reviewed by Filip Pizlo.
+
+        In DFG::Graph::addShouldSpeculateMachineInt(), we check
+        !hasExitSite(add, Int52Overflow) when determining whether it's ok to speculate
+        that an operand is of type Int52 or not.  However, the Int52Rep code that
+        converts a double to Int52 will OSR exit with exit kind BadType instead.
+        This renders the hasExitSite() check in addShouldSpeculateMachineInt() useless.
+        This patch fixes this by changing Int52Rep to OSR exit with exit kind
+        Int52Overflow instead when it fails to convert a double to an Int52.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
+        (JSC::DFG::SpeculativeJIT::typeCheck):
+        (JSC::DFG::SpeculativeJIT::usedRegisters):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::needsTypeCheck):
+        (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::typeCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendTypeCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::doubleToStrictInt52):
+
+2016-01-22  Saam barati  <sbarati@apple.com>
+
+        Current implementation of Parser::createSavePoint is a foot gun
+        https://bugs.webkit.org/show_bug.cgi?id=153293
+
+        Reviewed by Oliver Hunt.
+
+        The previous use of SavePoint (up until this patch)
+        really meant that we're saving the LexerState. This
+        was so poorly named that it was being misused all over
+        our parser. For example, anything that parsed an
+        AssignmentExpression between saving/restoring really
+        wanted to save both Lexer state and Parser state.
+
+        This patch changes SavePoint to mean save all the
+        state. The old SavePoint is renamed to LexerState with
+        corresponding internal<Save/Restore>LexerState functions.
+        The old <save/restore>State() function is renamed to
+        internal<Save/Restore>ParserState().
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        (JSC::Parser<LexerType>::parseSourceElements):
+        (JSC::Parser<LexerType>::declareRestOrNormalParameter):
+        (JSC::Parser<LexerType>::parseAssignmentElement):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseForStatement):
+        (JSC::Parser<LexerType>::parseStatement):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseExpression):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseYieldExpression):
+        (JSC::Parser<LexerType>::parseConditionalExpression):
+        (JSC::Parser<LexerType>::parseBinaryExpression):
+        (JSC::Parser<LexerType>::parseObjectLiteral):
+        (JSC::Parser<LexerType>::parseStrictObjectLiteral):
+        (JSC::Parser<LexerType>::parseArrayLiteral):
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+        (JSC::Parser<LexerType>::parseMemberExpression):
+        (JSC::Parser<LexerType>::parseUnaryExpression):
+        * parser/Parser.h:
+        (JSC::Parser::hasError):
+        (JSC::Parser::internalSaveParserState):
+        (JSC::Parser::restoreParserState):
+        (JSC::Parser::internalSaveLexerState):
+        (JSC::Parser::restoreLexerState):
+        (JSC::Parser::createSavePointForError):
+        (JSC::Parser::createSavePoint):
+        (JSC::Parser::restoreSavePointWithError):
+        (JSC::Parser::restoreSavePoint):
+        (JSC::Parser::saveState): Deleted.
+        (JSC::Parser::restoreState): Deleted.
+
+2016-01-22  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed. fnormal => normal.
+
+        * tests/es6.yaml:
+
+2016-01-22  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed. Forgot to git stash pop some of the changes.
+        This should mark the rest of the es6 tests as passing.
+
+        * tests/es6.yaml:
+
+2016-01-22  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed. Mark es6 tests as passing.
+
+        * tests/es6.yaml:
+
+2016-01-22  Saam barati  <sbarati@apple.com>
+
+        op_profile_type 32-bit LLInt implementation has a bug
+        https://bugs.webkit.org/show_bug.cgi?id=153368
+
+        Reviewed by Michael Saboff.
+
+        r189293 changed which registers were used, specifically
+        using t5 instead of t4. That change forgot to replace
+        t4 with t5 in one specific instance.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
+2016-01-22  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should reduce obvious forms of Shl(SShr)
+        https://bugs.webkit.org/show_bug.cgi?id=153362
+
+        Reviewed by Mark Lam and Saam Barati.
+
+        This is a 40% speed-up in AsmBench-0.9/dry.c.js.
+
+        * b3/B3ReduceStrength.cpp:
+        * b3/testb3.cpp:
+        (JSC::B3::testStore16Load16Z):
+        (JSC::B3::testSShrShl32):
+        (JSC::B3::testSShrShl64):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+
+2016-01-22  Alex Christensen  <achristensen@webkit.org>
+
+        Fix internal Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=153364
+        <rdar://problem/24296328>
+
+        Reviewed by Brent Fulgham.
+
+        * PlatformWin.cmake:
+        The internal build does not build JavaScriptCore with WTF, so it does not automatically link to winmm.lib
+        like it does when everything is built together.
+
+2016-01-22  Keith Miller  <keith_miller@apple.com>
+
+        Equivalence PropertyCondition needs to check the offset it uses to load the value from is not invalidOffset
+        https://bugs.webkit.org/show_bug.cgi?id=152912
+
+        Reviewed by Mark Lam.
+
+        When checking the validity of an Equivalence PropertyCondition we do not check that the offset returned by
+        the structure of the object in the equivalence condition is valid. The offset might be wrong for many reasons.
+        The one we now test for is when the GlobalObject has a property that becomes a variable the property is deleted
+        thus the offset is now invalid.
+
+        * bytecode/PropertyCondition.cpp:
+        (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint):
+        * tests/stress/global-property-into-variable-get-from-scope.js: Added.
+
+2016-01-22  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add Symbol.species properties to the relevant constructors
+        https://bugs.webkit.org/show_bug.cgi?id=153339
+
+        Reviewed by Michael Saboff.
+
+        This patch adds Symbol.species to the RegExp, Array, TypedArray, Map, Set, ArrayBuffer, and
+        Promise constructors.  The functions that use these properties will be added in a later
+        patch.
+
+        * builtins/GlobalObject.js:
+        (speciesGetter):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::create):
+        * runtime/BooleanConstructor.h:
+        (JSC::BooleanConstructor::create):
+        * runtime/CommonIdentifiers.h:
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::create):
+        * runtime/ErrorConstructor.h:
+        (JSC::ErrorConstructor::create):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSArrayBufferConstructor::finishCreation):
+        (JSC::JSArrayBufferConstructor::create):
+        * runtime/JSArrayBufferConstructor.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * runtime/JSInternalPromiseConstructor.cpp:
+        (JSC::JSInternalPromiseConstructor::create):
+        * runtime/JSInternalPromiseConstructor.h:
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::create):
+        (JSC::JSPromiseConstructor::finishCreation):
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::JSTypedArrayViewConstructor::finishCreation):
+        (JSC::JSTypedArrayViewConstructor::create): Deleted.
+        * runtime/JSTypedArrayViewConstructor.h:
+        (JSC::JSTypedArrayViewConstructor::create):
+        * runtime/MapConstructor.cpp:
+        (JSC::MapConstructor::finishCreation):
+        * runtime/MapConstructor.h:
+        (JSC::MapConstructor::create):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::create):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::finishCreation):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::create):
+        * runtime/SetConstructor.cpp:
+        (JSC::SetConstructor::finishCreation):
+        * runtime/SetConstructor.h:
+        (JSC::SetConstructor::create):
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::create):
+        * runtime/SymbolConstructor.h:
+        (JSC::SymbolConstructor::create):
+        * runtime/WeakMapConstructor.h:
+        (JSC::WeakMapConstructor::create):
+        * runtime/WeakSetConstructor.h:
+        (JSC::WeakSetConstructor::create):
+        * tests/stress/symbol-species.js: Added.
+        (testSymbolSpeciesOnConstructor):
+
+2016-01-21  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] The IRC allocator can mess up the degree of Tmps interfering with move-related Tmps
+        https://bugs.webkit.org/show_bug.cgi?id=153340
+
+        Reviewed by Filip Pizlo.
+
+        The JavaScriptCore tests uncovered an interested bug in the iterated register
+        coalescing allocator. When coalescing a move under the right conditions, it is
+        possible to mess-up the graph for the Tmps interfering with the coalesced Tmps.
+
+        Some context first:
+        -When coalescing a move, we alias one Tmp to another. Let say that we had
+             Move X, Y
+         the coalescing may alias Y to X: Y->X.
+        -Since X and Y are equivalent after coalescing, any interference
+         edge with Y is "moved" to X.
+         The way this was done was to add an edge to X for every edge there was with Y.
+         Say we had an edge R--Y, we add an edge R--X.
+         Adding an edge increases the degree of R and Y. The degree of R was then
+         fixed by calling decrementDegree() on it.
+        -decrementDegree() is non trivial. It will move the Tmp to the right list
+         for further processing if the Tmp's degree becomes lower than the number
+         of available registers.
+
+        The bug appear in a particular case. Say we have 3 Tmp, A, B, and C.
+        -A and B are move related, they can be coalesced.
+        -A has an interference edge with C.
+        -B does not have and interfence edge with C.
+        -C's degree is exactly the number of avaialble registers/colors minus one (k - 1).
+         -> This implies C is already in its list.
+
+        We coalesce A and B into B (A->B).
+        -The first step, addEdgeDistinct() adds an edge between B and C. The degrees of
+         B and C are increased by one. The degree of C becomes k.
+        -Next, decrementDegree() is called on C. Its degree decreases to k-1.
+         Because of the change from k to k-1, decrementDegree() adds C to a list again.
+
+        We have two kinds of bugs depending on the test:
+        -A Tmp can be added to the simplifyWorklist several time.
+        -A Tmp can be in both simplifyWorklist and freezeWorklist (because its move-related
+         status changed since the last decrementDegree()).
+        In both cases, the Tmps interfering with the duplicated Tmp will end up with
+        a degree lower than their real value.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+
+2016-01-21  Andreas Kling  <akling@apple.com>
+
+        Add some missing WTF_MAKE_FAST_ALLOCATED in JavaScriptCore.
+        <https://webkit.org/b/153335>
+
+        Reviewed by Alex Christensen.
+
+        Saw these things getting system malloc()'ed in an Instruments trace.
+
+        * inspector/InspectorAgentBase.h:
+        * jit/CallFrameShuffleData.h:
+        * jit/CallFrameShuffler.h:
+        * jit/RegisterAtOffsetList.h:
+        * runtime/GenericOffset.h:
+
+2016-01-21  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Catch parameter should accept BindingPattern
+        https://bugs.webkit.org/show_bug.cgi?id=152385
+
+        Reviewed by Saam Barati.
+
+        This patch implements destructuring in catch parameter.
+        Catch parameter accepts binding pattern and binding identifier.
+        It creates lexical bindings. And "yield" and "let" are specially
+        handled as is the same to function parameters.
+
+        In addition to that, we make destructuring parsing errors more descriptive.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createTryStatement):
+        * parser/NodeConstructors.h:
+        (JSC::TryNode::TryNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::createBindingPattern):
+        (JSC::Parser<LexerType>::tryParseDestructuringPatternExpression):
+        (JSC::Parser<LexerType>::parseBindingOrAssignmentElement):
+        (JSC::destructuringKindToVariableKindName):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        (JSC::Parser<LexerType>::parseTryStatement):
+        (JSC::Parser<LexerType>::parseFormalParameters):
+        (JSC::Parser<LexerType>::parseFunctionParameters):
+        * parser/Parser.h:
+        (JSC::Parser::destructuringKindFromDeclarationType):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createTryStatement):
+        * tests/es6.yaml:
+        * tests/es6/destructuring_in_catch_heads.js: Added.
+        (test):
+        * tests/stress/catch-parameter-destructuring.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (prototype.call):
+        (catch):
+        (shouldThrow.try.throw.get error):
+        (initialize):
+        (array):
+        (generator.gen):
+        (generator):
+        * tests/stress/catch-parameter-syntax.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        * tests/stress/reserved-word-with-escape.js:
+        (testSyntaxError.String.raw.a):
+        (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
+        * tests/stress/yield-named-variable.js:
+
+2016-01-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix build.
+
+        * b3/B3EliminateCommonSubexpressions.cpp:
+
+2016-01-21  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 CSE should be able to match a full redundancy even if none of the matches dominate the value in question
+        https://bugs.webkit.org/show_bug.cgi?id=153321
+
+        Reviewed by Benjamin Poulain.
+
+        I once learned that LLVM's GVN can manufacture Phi functions. I don't know the details
+        but I'm presuming that it involves:
+
+            if (p)
+                tmp1 = *ptr
+            else
+                tmp2 = *ptr
+            tmp3 = *ptr // Replace this with Phi(tmp1, tmp2).
+
+        This adds such an optimization to our CSE. The idea is that we search through basic
+        blocks until we find the value we want, a side effect, or the start of the procedure. If
+        we find a value that matches our search criteria, we record it and ignore the
+        predecessors. If we find a side effect or the start of the procedure, we give up the
+        whole search. This ensures that if we come out of the search without giving up, we'll
+        have a set of matches that are fully redundant.
+
+        CSE could then create a Phi graph by using SSACalculator. But the recent work on FixSSA
+        revealed a much more exciting option: create a stack slot! In case there is more than one
+        match, CSE now creates a stack slot that each match stores to, and replaces the redundant
+        instruction with a loadfrom the stack slot. The stack slot is anonymous, which ensures
+        that FixSSA will turn it into an optimal Phi graph or whatever.
+
+        This is a significant speed-up on Octane/richards.
+
+        * b3/B3DuplicateTails.cpp:
+        * b3/B3EliminateCommonSubexpressions.cpp:
+        * b3/B3FixSSA.cpp:
+        (JSC::B3::fixSSA):
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::setFrontendData):
+        (JSC::B3::Procedure::frontendData):
+        * b3/testb3.cpp:
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+
+2016-01-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Air should know that CeilDouble has the partial register stall issue
+        https://bugs.webkit.org/show_bug.cgi?id=153338
+
+        Rubber stamped by Benjamin Poulain.
+
+        This is a 8% speed-up on Kraken with B3 enabled, mostly because of a 2.4x speed-up on
+        audio-oscillator.
+
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+
+2016-01-21  Andy VanWagoner  <andy@instructure.com>
+
+        [INTL] Implement Array.prototype.toLocaleString in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147614
+
+        Reviewed by Benjamin Poulain.
+
+        The primary changes in the ECMA-402 version, and the existing implementation
+        are passing the arguments on to each element's toLocaleString call, and
+        missing/undefined/null elements become empty string instead of being skipped.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToLocaleString):
+
+2016-01-21  Per Arne Vollan  <peavo@outlook.com>
+
+        [B3][Win64] Compile fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=153312
+
+        Reviewed by Alex Christensen.
+
+        Since MSVC has several overloads of sin, cos, pow, and log, we need to specify
+        which one we want to use.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleSin):
+        (JSC::FTL::Output::doubleCos):
+        (JSC::FTL::Output::doublePow):
+        (JSC::FTL::Output::doubleLog):
+
+2016-01-21  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] foldPathConstants() makes invalid assumptions with Switch
+        https://bugs.webkit.org/show_bug.cgi?id=153324
+
+        Reviewed by Filip Pizlo.
+
+        If a Switch() has two cases pointing to the same basic block, foldPathConstants()
+        was adding two override for that block with two different constants.
+        If the block with the Switch dominates the target, both override were equally valid
+        and we were assuming any of the constants as the value in the target block.
+
+        See testSwitchTargettingSameBlockFoldPathConstant() for an example that breaks.
+
+        This patch adds checks to ignore any block that is reached more than
+        once by the control value.
+
+        * b3/B3FoldPathConstants.cpp:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/testb3.cpp:
+        (JSC::B3::testSwitchTargettingSameBlock):
+        (JSC::B3::testSwitchTargettingSameBlockFoldPathConstant):
+        (JSC::B3::run):
+
+2016-01-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, undo DFGCommon.h change that accidentally enabled the B3 JIT.
+
+        * dfg/DFGCommon.h:
+
+2016-01-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Move32 should have an Imm, Tmp form
+        https://bugs.webkit.org/show_bug.cgi?id=153313
+
+        Reviewed by Mark Lam.
+
+        This enables some useful optimizations, like constant propagation in fixObviousSpills().
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::move):
+        * b3/air/AirOpcode.opcodes:
+
+2016-01-21  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should have load elimination
+        https://bugs.webkit.org/show_bug.cgi?id=153288
+
+        Reviewed by Geoffrey Garen.
+
+        This adds a complete GCSE pass that includes load elimination. It would have been super hard
+        to make this work as part of the reduceStrength() fixpoint, since GCSE needs to analyze
+        control flow and reduceStrength() is messing with control flow. So, I did a compromise: I
+        factored out the pure CSE that reduceStrength() was already doing, and now we have:
+
+        - reduceStrength() still does pure CSE using the new PureCSE helper.
+
+        - eliminateCommonSubexpressions() is a separate phase that does general CSE. It uses the
+          PureCSE helper for pure values and does its own special thing for memory values.
+        
+        Unfortunately, this doesn't help any benchmark right now. It doesn't hurt anything, either,
+        and it's likely to become a bigger pay-off once we implement other features, like mapping
+        FTL's abstract heaps onto B3's heap ranges.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3EliminateCommonSubexpressions.cpp: Added.
+        (JSC::B3::eliminateCommonSubexpressions):
+        * b3/B3EliminateCommonSubexpressions.h: Added.
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3HeapRange.h:
+        (JSC::B3::HeapRange::HeapRange):
+        * b3/B3InsertionSet.h:
+        (JSC::B3::InsertionSet::InsertionSet):
+        (JSC::B3::InsertionSet::isEmpty):
+        (JSC::B3::InsertionSet::code):
+        (JSC::B3::InsertionSet::appendInsertion):
+        * b3/B3MemoryValue.h:
+        * b3/B3PureCSE.cpp: Added.
+        (JSC::B3::PureCSE::PureCSE):
+        (JSC::B3::PureCSE::~PureCSE):
+        (JSC::B3::PureCSE::clear):
+        (JSC::B3::PureCSE::process):
+        * b3/B3PureCSE.h: Added.
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3ReduceStrength.h:
+        * b3/B3Validate.cpp:
+
+2016-01-21  Keith Miller  <keith_miller@apple.com>
+
+        Fix bug in TypedArray.prototype.set and add tests
+        https://bugs.webkit.org/show_bug.cgi?id=153309
+
+        Reviewed by Michael Saboff.
+
+        This patch fixes an issue with TypedArray.prototype.set where we would
+        assign a double to an unsigned without checking that the double was
+        in the range of the unsigned. Additionally, the patch also adds
+        tests for set for cases that were not covered before.
+
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        * tests/stress/typedarray-set.js: Added.
+
+2016-01-19  Ada Chan  <adachan@apple.com>
+
+        Make it possible to enable VIDEO_PRESENTATION_MODE on other Cocoa platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=153218
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-01-21  Per Arne Vollan  <peavo@outlook.com>
+
+        [B3][CMake] Add missing source file.
+        https://bugs.webkit.org/show_bug.cgi?id=153303
+
+        Reviewed by Csaba Osztrogonác.
+
+        * CMakeLists.txt:
+
+2016-01-20  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r195375.
+        https://bugs.webkit.org/show_bug.cgi?id=153300
+
+        Caused crashes on GuardMalloc (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "TypedArray's .buffer does not return the JSArrayBuffer that
+        was passed to it on creation."
+        https://bugs.webkit.org/show_bug.cgi?id=153281
+        http://trac.webkit.org/changeset/195375
+
+2016-01-19  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should have basic path specialization
+        https://bugs.webkit.org/show_bug.cgi?id=153200
+
+        Reviewed by Benjamin Poulain.
+
+        This adds two different kind of path specializations:
+
+        - Check(Select) where the Select results are constants is specialized into a Branch
+          instead of a Select and duplicated paths where the results of the Select are folded.
+
+        - Tail duplication. A jump to a small block causes the block's contents to be copied over
+          the Jump.
+
+        Both optimizations required being able to clone Values. We can now do that using
+        proc.clone(value).
+
+        Check(Select) specialization needed some utilities for walking graphs of Values.
+
+        Tail duplication needed SSA fixup, so I added a way to demote values to anonymous stack
+        slots (B3's equivalent of non-SSA variables) and a way to "fix SSA", i.e. to allocate
+        anonymous stack slots to SSA values along with an optimal Phi graph.
+
+        This is a big speed-up on Octane/deltablue. It's a 2.2% speed-up on Octane overall.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3ArgumentRegValue.cpp:
+        (JSC::B3::ArgumentRegValue::dumpMeta):
+        (JSC::B3::ArgumentRegValue::cloneImpl):
+        * b3/B3ArgumentRegValue.h:
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::append):
+        (JSC::B3::BasicBlock::appendNonTerminal):
+        (JSC::B3::BasicBlock::removeLast):
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::values):
+        * b3/B3BasicBlockInlines.h:
+        (JSC::B3::BasicBlock::appendNew):
+        (JSC::B3::BasicBlock::appendNewNonTerminal):
+        (JSC::B3::BasicBlock::replaceLastWithNew):
+        * b3/B3BlockInsertionSet.h:
+        * b3/B3BreakCriticalEdges.cpp: Added.
+        (JSC::B3::breakCriticalEdges):
+        * b3/B3BreakCriticalEdges.h: Added.
+        * b3/B3CCallValue.cpp:
+        (JSC::B3::CCallValue::~CCallValue):
+        (JSC::B3::CCallValue::cloneImpl):
+        * b3/B3CCallValue.h:
+        * b3/B3CheckValue.cpp:
+        (JSC::B3::CheckValue::convertToAdd):
+        (JSC::B3::CheckValue::cloneImpl):
+        (JSC::B3::CheckValue::CheckValue):
+        * b3/B3CheckValue.h:
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::dumpMeta):
+        (JSC::B3::Const32Value::cloneImpl):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::dumpMeta):
+        (JSC::B3::Const64Value::cloneImpl):
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::dumpMeta):
+        (JSC::B3::ConstDoubleValue::cloneImpl):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ConstFloatValue.cpp:
+        (JSC::B3::ConstFloatValue::dumpMeta):
+        (JSC::B3::ConstFloatValue::cloneImpl):
+        * b3/B3ConstFloatValue.h:
+        * b3/B3ControlValue.cpp:
+        (JSC::B3::ControlValue::dumpMeta):
+        (JSC::B3::ControlValue::cloneImpl):
+        * b3/B3ControlValue.h:
+        * b3/B3DuplicateTails.cpp: Added.
+        (JSC::B3::duplicateTails):
+        * b3/B3DuplicateTails.h: Added.
+        * b3/B3FixSSA.cpp: Added.
+        (JSC::B3::demoteValues):
+        (JSC::B3::fixSSA):
+        * b3/B3FixSSA.h: Added.
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3IndexSet.h:
+        (JSC::B3::IndexSet::Iterable::Iterable):
+        (JSC::B3::IndexSet::values):
+        (JSC::B3::IndexSet::indices):
+        * b3/B3InsertionSet.cpp:
+        (JSC::B3::InsertionSet::insertIntConstant):
+        (JSC::B3::InsertionSet::insertBottom):
+        (JSC::B3::InsertionSet::execute):
+        * b3/B3InsertionSet.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::tmp):
+        * b3/B3MemoryValue.cpp:
+        (JSC::B3::MemoryValue::dumpMeta):
+        (JSC::B3::MemoryValue::cloneImpl):
+        * b3/B3MemoryValue.h:
+        * b3/B3OriginDump.cpp: Added.
+        (JSC::B3::OriginDump::dump):
+        * b3/B3OriginDump.h:
+        (JSC::B3::OriginDump::OriginDump):
+        (JSC::B3::OriginDump::dump): Deleted.
+        * b3/B3PatchpointValue.cpp:
+        (JSC::B3::PatchpointValue::dumpMeta):
+        (JSC::B3::PatchpointValue::cloneImpl):
+        (JSC::B3::PatchpointValue::PatchpointValue):
+        * b3/B3PatchpointValue.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::clone):
+        (JSC::B3::Procedure::addIntConstant):
+        (JSC::B3::Procedure::addBottom):
+        (JSC::B3::Procedure::addBoolConstant):
+        (JSC::B3::Procedure::deleteValue):
+        * b3/B3Procedure.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3SSACalculator.cpp: Added.
+        (JSC::B3::SSACalculator::Variable::dump):
+        (JSC::B3::SSACalculator::Variable::dumpVerbose):
+        (JSC::B3::SSACalculator::Def::dump):
+        (JSC::B3::SSACalculator::SSACalculator):
+        (JSC::B3::SSACalculator::~SSACalculator):
+        (JSC::B3::SSACalculator::reset):
+        (JSC::B3::SSACalculator::newVariable):
+        (JSC::B3::SSACalculator::newDef):
+        (JSC::B3::SSACalculator::nonLocalReachingDef):
+        (JSC::B3::SSACalculator::reachingDefAtTail):
+        (JSC::B3::SSACalculator::dump):
+        * b3/B3SSACalculator.h: Added.
+        (JSC::B3::SSACalculator::Variable::index):
+        (JSC::B3::SSACalculator::Variable::Variable):
+        (JSC::B3::SSACalculator::Def::variable):
+        (JSC::B3::SSACalculator::Def::block):
+        (JSC::B3::SSACalculator::Def::value):
+        (JSC::B3::SSACalculator::Def::Def):
+        (JSC::B3::SSACalculator::variable):
+        (JSC::B3::SSACalculator::computePhis):
+        (JSC::B3::SSACalculator::phisForBlock):
+        (JSC::B3::SSACalculator::reachingDefAtHead):
+        * b3/B3StackSlotKind.h:
+        * b3/B3StackSlotValue.cpp:
+        (JSC::B3::StackSlotValue::dumpMeta):
+        (JSC::B3::StackSlotValue::cloneImpl):
+        * b3/B3StackSlotValue.h:
+        * b3/B3SwitchValue.cpp:
+        (JSC::B3::SwitchValue::dumpMeta):
+        (JSC::B3::SwitchValue::cloneImpl):
+        (JSC::B3::SwitchValue::SwitchValue):
+        * b3/B3SwitchValue.h:
+        * b3/B3UpsilonValue.cpp:
+        (JSC::B3::UpsilonValue::dumpMeta):
+        (JSC::B3::UpsilonValue::cloneImpl):
+        * b3/B3UpsilonValue.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::replaceWithNop):
+        (JSC::B3::Value::replaceWithPhi):
+        (JSC::B3::Value::dump):
+        (JSC::B3::Value::cloneImpl):
+        (JSC::B3::Value::dumpChildren):
+        (JSC::B3::Value::deepDump):
+        * b3/B3Value.h:
+        (JSC::B3::DeepValueDump::DeepValueDump):
+        (JSC::B3::DeepValueDump::dump):
+        (JSC::B3::deepDump):
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::asNumber):
+        (JSC::B3::Value::walk):
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::intConstant):
+        (JSC::B3::ValueKey::dump):
+        * b3/B3ValueKey.h:
+        (JSC::B3::ValueKey::ValueKey):
+        (JSC::B3::ValueKey::opcode):
+        (JSC::B3::ValueKey::type):
+        (JSC::B3::ValueKey::childIndex):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::forAllTmps):
+        (JSC::B3::Air::Code::isFastTmp):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirUseCounts.h:
+        (JSC::B3::Air::UseCounts::UseCounts):
+        (JSC::B3::Air::UseCounts::operator[]):
+        (JSC::B3::Air::UseCounts::dump):
+        * b3/testb3.cpp:
+        (JSC::B3::testSelectInvert):
+        (JSC::B3::testCheckSelect):
+        (JSC::B3::testCheckSelectCheckSelect):
+        (JSC::B3::testPowDoubleByIntegerLoop):
+        (JSC::B3::run):
+        * runtime/Options.h:
+
+2016-01-20  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Fix a typo in the Air definition of CeilDouble/CeilFloat
+        https://bugs.webkit.org/show_bug.cgi?id=153286
+
+        Reviewed by Mark Lam.
+
+        * b3/air/AirOpcode.opcodes:
+        The second argument should a Def. The previous definition was
+        adding useless constraints on the allocation of the second argument.
+
+2016-01-20  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] The register allocator can use a dangling pointer when selecting a spill candidate
+        https://bugs.webkit.org/show_bug.cgi?id=153287
+
+        Reviewed by Mark Lam.
+
+        A tricky bug I discovered while experimenting with live range breaking.
+
+        We have the following initial conditions:
+        -UseCounts is slow, so we only compute it once for all the iterations
+         of the allocator.
+        -The only new Tmps we create are for spills and refills. They are unspillable
+         by definition so it is fine to not update UseCounts accordingly.
+
+        But, in selectSpill(), we go over all the spill candidates and select the best
+        one based on its score. The score() lambda uses useCounts, it cannot be used
+        with a new Tmps created for something we already spilled.
+
+        The first time we use score is correct, we started by skipping all the unspillable
+        Tmps from the candidate. The next use was incorrect: we were checking unspillableTmps
+        *after* calling score().
+
+        The existing tests did not catch this due to back luck. I added an assertion
+        to find similar problems in the future.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirUseCounts.h:
+
+2016-01-20  Saam barati  <sbarati@apple.com>
+
+        Fix CLoop build after bug https://bugs.webkit.org/show_bug.cgi?id=152766
+
+        Unreviewed build fix.
+
+        * inspector/agents/InspectorScriptProfilerAgent.h:
+
+2016-01-20  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement Date.prototype.toLocaleTimeString in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147613
+
+        Reviewed by Darin Adler.
+
+        Implement toLocaleTimeString in builtin JavaScript.
+
+        * builtins/DatePrototype.js:
+        (toLocaleTimeString.toDateTimeOptionsTimeTime):
+        (toLocaleTimeString):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+
+2016-01-20  Saam barati  <sbarati@apple.com>
+
+        Web Inspector: Hook the sampling profiler into the Timelines UI
+        https://bugs.webkit.org/show_bug.cgi?id=152766
+        <rdar://problem/24066360>
+
+        Reviewed by Joseph Pecoraro.
+
+        This patch adds some necessary functions to SamplingProfiler::StackFrame
+        to allow it to give data to the Inspector for the timelines UI. i.e, the
+        sourceID of the executable of a stack frame.
+
+        This patch also swaps in the SamplingProfiler in place of the
+        LegacyProfiler inside InspectorScriptProfilerAgent. It adds
+        the necessary protocol data to allow the SamplingProfiler's
+        data to hook into the timelines UI.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::setProfilingClient):
+        (JSC::Debugger::willEvaluateScript):
+        (JSC::Debugger::didEvaluateScript):
+        (JSC::Debugger::toggleBreakpoint):
+        * debugger/Debugger.h:
+        * debugger/ScriptProfilingScope.h:
+        (JSC::ScriptProfilingScope::ScriptProfilingScope):
+        (JSC::ScriptProfilingScope::~ScriptProfilingScope):
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorScriptProfilerAgent::startTracking):
+        (Inspector::InspectorScriptProfilerAgent::stopTracking):
+        (Inspector::InspectorScriptProfilerAgent::isAlreadyProfiling):
+        (Inspector::InspectorScriptProfilerAgent::willEvaluateScript):
+        (Inspector::InspectorScriptProfilerAgent::didEvaluateScript):
+        (Inspector::InspectorScriptProfilerAgent::addEvent):
+        (Inspector::buildSamples):
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        (Inspector::buildAggregateCallInfoInspectorObject): Deleted.
+        (Inspector::buildInspectorObject): Deleted.
+        (Inspector::buildProfileInspectorObject): Deleted.
+        * inspector/agents/InspectorScriptProfilerAgent.h:
+        * inspector/protocol/ScriptProfiler.json:
+        * jsc.cpp:
+        (functionSamplingProfilerStackTraces):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::start):
+        (JSC::SamplingProfiler::stop):
+        (JSC::SamplingProfiler::clearData):
+        (JSC::SamplingProfiler::StackFrame::displayName):
+        (JSC::SamplingProfiler::StackFrame::displayNameForJSONTests):
+        (JSC::SamplingProfiler::StackFrame::startLine):
+        (JSC::SamplingProfiler::StackFrame::startColumn):
+        (JSC::SamplingProfiler::StackFrame::sourceID):
+        (JSC::SamplingProfiler::StackFrame::url):
+        (JSC::SamplingProfiler::stackTraces):
+        (JSC::SamplingProfiler::stackTracesAsJSON):
+        (JSC::displayName): Deleted.
+        (JSC::SamplingProfiler::stacktracesAsJSON): Deleted.
+        * runtime/SamplingProfiler.h:
+        (JSC::SamplingProfiler::StackFrame::StackFrame):
+        (JSC::SamplingProfiler::getLock):
+        (JSC::SamplingProfiler::setTimingInterval):
+        (JSC::SamplingProfiler::totalTime):
+        (JSC::SamplingProfiler::setStopWatch):
+        (JSC::SamplingProfiler::stackTraces): Deleted.
+        * tests/stress/sampling-profiler-anonymous-function.js:
+        (platformSupportsSamplingProfiler.baz):
+        (platformSupportsSamplingProfiler):
+        * tests/stress/sampling-profiler-basic.js:
+        (platformSupportsSamplingProfiler.nothing):
+        (platformSupportsSamplingProfiler.top):
+        * tests/stress/sampling-profiler/samplingProfiler.js:
+        (doesTreeHaveStackTrace):
+
+2016-01-20  Keith Miller  <keith_miller@apple.com>
+
+        TypedArray's .buffer does not return the JSArrayBuffer that was passed to it on creation.
+        https://bugs.webkit.org/show_bug.cgi?id=153281
+
+        Reviewed by Geoffrey Garen.
+
+        When creating an JSArrayBuffer we should make sure that the backing ArrayBuffer uses the
+        new JSArrayBuffer as its wrapper. This causes issues when we get the buffer of a Typed Array
+        created by passing a JSArrayBuffer as the backing ArrayBuffer does not have a reference to
+        the original JSArrayBuffer and a new object is created.
+
+        * runtime/JSArrayBuffer.cpp:
+        (JSC::JSArrayBuffer::finishCreation):
+        * tests/stress/typedarray-buffer-neutered.js: Added.
+        (arrays.typedArrays.map):
+
+2016-01-20  Andreas Kling  <akling@apple.com>
+
+        Pack RegisterAtOffset harder.
+        <https://webkit.org/b/152501>
+
+        Reviewed by Michael Saboff.
+
+        Pack the register index and the offset into a single pointer-sized word instead of two.
+        This reduces memory consumption by 620 kB on mobile theverge.com.
+
+        The packing doesn't succeed on MSVC for some reason, so I've left out the static
+        assertion about class size in those builds.
+
+        * jit/RegisterAtOffset.cpp:
+        * jit/RegisterAtOffset.h:
+
+2016-01-20  Per Arne Vollan  <peavo@outlook.com>
+
+        [B3][Win64] Compile fix.
+        https://bugs.webkit.org/show_bug.cgi?id=153278
+
+        Reviewed by Filip Pizlo.
+
+        MSVC does not accept that a class declared as exported also have members declared as exported.
+
+        * b3/B3Const32Value.h:
+        * b3/B3ControlValue.h:
+
+2016-01-19  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Fix various issues with TypedArrays.
+        https://bugs.webkit.org/show_bug.cgi?id=153245
+
+        Reviewed by Geoffrey Garen.
+
+        This patch fixes a couple of issues with TypedArrays:
+
+        1) We were not checking if a view had been neutered and throwing an error
+        if it had in the our TypedArray.prototype functions.
+
+        2) The TypedArray.prototype.set function had a couple of minor issues with
+        checking for the offset being negative.
+
+        3) The JSArrayBufferView class did not check if the backing store had
+        been neutered when computing the offset even though the view's vector
+        pointer had been set to NULL. This meant that under some conditions we
+        could, occasionally, return a garbage number as the offset. Now, we only
+        neuter views if the backing ArrayBuffer's view is actually transfered.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionNeuterTypedArray):
+        * runtime/JSArrayBufferView.h:
+        (JSC::JSArrayBufferView::isNeutered):
+        * runtime/JSArrayBufferViewInlines.h:
+        (JSC::JSArrayBufferView::byteOffset):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncEntries):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncFill):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncKeys):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncReverse):
+        (JSC::genericTypedArrayViewPrivateFuncSort):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewProtoFuncSubarray):
+        (JSC::typedArrayViewProtoFuncValues):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncLength):
+        (JSC::typedArrayViewPrivateFuncSort): Deleted.
+        * tests/stress/typedarray-functions-with-neutered.js: Added.
+        (getGetter):
+        (unit):
+        (args.new.Int32Array):
+        (arrays.typedArrays.map):
+        (checkProtoFunc.throwsCorrectError):
+        (checkProtoFunc):
+        (test):
+
+2016-01-19  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement Date.prototype.toLocaleDateString in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147612
+
+        Reviewed by Benjamin Poulain.
+
+        Implement toLocaleDateString in builtin JavaScript. Remove comments with
+        spec steps, and instead link to the new HTML version of the spec.
+
+        Avoids creating an extra empty object in the prototype chain of the options
+        object in ToDateTimeOptions. The version used in toLocaleString was updated
+        to match as well.
+
+        * builtins/DatePrototype.js:
+        (toLocaleString.toDateTimeOptionsAnyAll):
+        (toLocaleString):
+        (toLocaleDateString.toDateTimeOptionsDateDate):
+        (toLocaleDateString):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+
+2016-01-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] fixSpillSlotZDef() crashes on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=153246
+
+        Reviewed by Geoffrey Garen.
+
+        Moving an immediate to memory is not a valid instruction on ARM64.
+        This patch adds a small workaround for this specific case: an instruction
+        to zero a chunk of memory.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::storeZero32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::storeZero32):
+        * b3/air/AirFixSpillSlotZDef.h:
+        (JSC::B3::Air::fixSpillSlotZDef):
+        * b3/air/AirOpcode.opcodes:
+
+2016-01-19  Enrica Casucci  <enrica@apple.com>
+
+        Add support for DataDetectors in WK (iOS).
+        https://bugs.webkit.org/show_bug.cgi?id=152989
+        rdar://problem/22855960
+
+        Reviewed by Tim Horton.
+
+        Adding feature definition for data detection.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-01-19  Per Arne Vollan  <peavo@outlook.com>
+
+        [B3][Win64] Compile and warning fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=153234
+
+        Reviewed by Alex Christensen.
+
+        The size of 'long' is 4 bytes on Win64. We can use 'long long' instead,
+        when we want the size to be 8 bytes.
+
+        * b3/B3LowerMacrosAfterOptimizations.cpp:
+        * b3/B3ReduceStrength.cpp:
+
+2016-01-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Fix the B3 build after r195159
+        https://bugs.webkit.org/show_bug.cgi?id=153232
+
+        Reviewed by Yusuke Suzuki.
+
+        * CMakeLists.txt:
+
+2016-01-19  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r195300.
+        https://bugs.webkit.org/show_bug.cgi?id=153244
+
+        enrica wants more time to fix Windows (Requested by thorton on
+        #webkit).
+
+        Reverted changeset:
+
+        "Add support for DataDetectors in WK (iOS)."
+        https://bugs.webkit.org/show_bug.cgi?id=152989
+        http://trac.webkit.org/changeset/195300
+
+2016-01-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Reconsider B3's constant motion policy
+        https://bugs.webkit.org/show_bug.cgi?id=152202
+
+        Reviewed by Geoffrey Garen.
+
+        This changes moveConstants() to hoist constants. This is a speed-up on things like mandreel.
+        It has a generally positive impact on the Octane score, but it's within margin of error.
+
+        This also changes IRC to make it a bit more likely to spill constants. We don't want it to
+        spill them too much, because we can't rely on fixObviousSpills() to always replace a load of
+        a constant from the stack with the constant itself, especially in case of instructions that
+        need an extra register to materialize the immediate.
+
+        Also fixed DFG graph dumping to print a bit less things. It was trying to print the results of
+        constant property inference, and this sometimes caused crashes when you dumped the graph at an
+        inopportune time.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3MoveConstants.cpp:
+        * b3/air/AirArg.h:
+        * b3/air/AirArgInlines.h: Added.
+        (JSC::B3::Air::ArgThingHelper<Tmp>::is):
+        (JSC::B3::Air::ArgThingHelper<Tmp>::as):
+        (JSC::B3::Air::ArgThingHelper<Tmp>::forEachFast):
+        (JSC::B3::Air::ArgThingHelper<Tmp>::forEach):
+        (JSC::B3::Air::ArgThingHelper<Arg>::is):
+        (JSC::B3::Air::ArgThingHelper<Arg>::as):
+        (JSC::B3::Air::ArgThingHelper<Arg>::forEachFast):
+        (JSC::B3::Air::ArgThingHelper<Arg>::forEach):
+        (JSC::B3::Air::Arg::is):
+        (JSC::B3::Air::Arg::as):
+        (JSC::B3::Air::Arg::forEachFast):
+        (JSC::B3::Air::Arg::forEach):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirUseCounts.h:
+        (JSC::B3::Air::UseCounts::UseCounts):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+
+2016-01-19  Enrica Casucci  <enrica@apple.com>
+
+        Add support for DataDetectors in WK (iOS).
+        https://bugs.webkit.org/show_bug.cgi?id=152989
+        rdar://problem/22855960
+
+        Reviewed by Tim Horton.
+
+        Adding feature definition.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-01-17  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be just as fast as FTL LLVM on Octane/crypto
+        https://bugs.webkit.org/show_bug.cgi?id=153113
+
+        Reviewed by Saam Barati.
+
+        This is the result of a hacking rampage to close the gap between FTL B3 and FTL LLVM on
+        Octane/crypto. It was a very successful rampage.
+
+        The biggest change in this patch is the introduction of a phase called fixObviousSpills()
+        that fixes patterns like:
+
+        Store register to stack slot and then use stack slot:
+            Move %rcx, (stack42)
+            Foo use:(stack42) // replace (stack42) with %rcx here.
+
+        Load stack slot into register and then use stack slot:
+            Move (stack42), %rcx
+            Foo use:(stack42) // replace (stack42) with %rcx here.
+
+        Store constant into stack slot and then use stack slot:
+            Move $42, %rcx
+            Move %rcx, (stack42)
+            Bar def:%rcx // %rcx isn't available anymore, but we still know that (stack42) is $42
+            Foo use:(stack42) // replace (stack42) with $42 here.
+
+        This phases does these fixups by doing a global forward flow that propagates sets of
+        must-aliases.
+
+        Also added a phase to report register pressure. It pretty-prints code alongside the set of
+        in-use registers above each instruction. Using this phase, I found that our register
+        allocator is actually doing a pretty awesome job. I had previously feared that we'd have to
+        make substantial changes to register allocation. I don't have such a fear anymore, at least
+        for Octane/crypto. In the future, we can check how the regalloc is performing just by
+        enabling logAirRegisterPressure.
+
+        Also fixed some FTL codegen pathologies. We were using bitOr where we meant to use a
+        conditional or. LLVM likes to canonicalize boolean expressions this way. B3, on the other
+        hand, doesn't do this canonicalization and doesn't have logic to decompose it into sequences
+        of branches.
+
+        Also added strength reductions for checked arithmetic. It turns out that LLVM learned how to
+        reduce checked multiply to unchecked multiply in some obvious cases that our existing DFG
+        optimizations lacked. Ideally, our DFG integer range optimization phase would cover this. But
+        the cases of interest were dead simple - the incoming values to the CheckMul were obviously
+        too small to cause overflow. I added such reasoning to B3's strength reduction.
+
+        Finally, this fixes some bugs with how we were handling subwidth spill slots. The register
+        allocator was making two mistakes. First, it might cause a Width64 def or use of a 4-byte
+        spill slot. In that case, it would extend the size of the spill slot to ensure that the use
+        or def is safe. Second, it emulates ZDef on Tmp behavior by emitting a Move32 to initialize
+        the high bits of a spill slot. But this is unsound because of the liveness semantics of spill
+        slots. They cannot have more than one def to initialize their value. I fixed that by making
+        allocateStack() be the thing that fixes ZDefs. That's a change to ZDef semantics: now, ZDef
+        on an anonymous stack slot means that the high bits are zero-filled. I wasn't able to
+        construct a test for this. It might be a hypothetical bug, but still, I like how this
+        simplifies the register allocator.
+
+        This is a ~0.7% speed-up on Octane.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::hiddenBranch):
+        (JSC::B3::CheckSpecial::forEachArg):
+        (JSC::B3::CheckSpecial::commitHiddenBranch): Deleted.
+        * b3/B3CheckSpecial.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3StackmapValue.h:
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirAllocateStack.h:
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::callArg):
+        (JSC::B3::Air::Arg::stackAddr):
+        (JSC::B3::Air::Arg::isValidScale):
+        * b3/air/AirBasicBlock.cpp:
+        (JSC::B3::Air::BasicBlock::deepDump):
+        (JSC::B3::Air::BasicBlock::dumpHeader):
+        (JSC::B3::Air::BasicBlock::dumpFooter):
+        * b3/air/AirBasicBlock.h:
+        * b3/air/AirCCallSpecial.cpp:
+        (JSC::B3::Air::CCallSpecial::CCallSpecial):
+        (JSC::B3::Air::CCallSpecial::~CCallSpecial):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::lastPhaseName):
+        (JSC::B3::Air::Code::setEnableRCRS):
+        (JSC::B3::Air::Code::enableRCRS):
+        * b3/air/AirCustom.cpp:
+        (JSC::B3::Air::PatchCustom::isValidForm):
+        (JSC::B3::Air::CCallCustom::isValidForm):
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::PatchCustom::isValidFormStatic):
+        (JSC::B3::Air::PatchCustom::admitsStack):
+        (JSC::B3::Air::PatchCustom::isValidForm): Deleted.
+        * b3/air/AirEmitShuffle.cpp:
+        (JSC::B3::Air::ShufflePair::dump):
+        (JSC::B3::Air::createShuffle):
+        (JSC::B3::Air::emitShuffle):
+        * b3/air/AirEmitShuffle.h:
+        * b3/air/AirFixObviousSpills.cpp: Added.
+        (JSC::B3::Air::fixObviousSpills):
+        * b3/air/AirFixObviousSpills.h: Added.
+        * b3/air/AirFixSpillSlotZDef.h: Removed.
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        (JSC::B3::Air::generate):
+        * b3/air/AirHandleCalleeSaves.cpp:
+        (JSC::B3::Air::handleCalleeSaves):
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::reportUsedRegisters):
+        (JSC::B3::Air::Inst::admitsStack):
+        (JSC::B3::Air::isShiftValid):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
+        (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::begin):
+        (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::end):
+        (JSC::B3::Air::AbstractLiveness::LocalCalc::Iterable::contains):
+        (JSC::B3::Air::AbstractLiveness::LocalCalc::live):
+        (JSC::B3::Air::AbstractLiveness::LocalCalc::isLive):
+        (JSC::B3::Air::AbstractLiveness::LocalCalc::execute):
+        (JSC::B3::Air::AbstractLiveness::rawLiveAtHead):
+        (JSC::B3::Air::AbstractLiveness::Iterable::begin):
+        (JSC::B3::Air::AbstractLiveness::Iterable::end):
+        (JSC::B3::Air::AbstractLiveness::Iterable::contains):
+        (JSC::B3::Air::AbstractLiveness::liveAtTail):
+        (JSC::B3::Air::AbstractLiveness::workset):
+        * b3/air/AirLogRegisterPressure.cpp: Added.
+        (JSC::B3::Air::logRegisterPressure):
+        * b3/air/AirLogRegisterPressure.h: Added.
+        * b3/air/AirOptimizeBlockOrder.cpp:
+        (JSC::B3::Air::blocksInOptimizedOrder):
+        (JSC::B3::Air::optimizeBlockOrder):
+        * b3/air/AirOptimizeBlockOrder.h:
+        * b3/air/AirReportUsedRegisters.cpp:
+        (JSC::B3::Air::reportUsedRegisters):
+        * b3/air/AirReportUsedRegisters.h:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/air/AirStackSlot.h:
+        (JSC::B3::Air::StackSlot::isLocked):
+        (JSC::B3::Air::StackSlot::index):
+        (JSC::B3::Air::StackSlot::ensureSize):
+        (JSC::B3::Air::StackSlot::alignment):
+        * b3/air/AirValidate.cpp:
+        * ftl/FTLB3Compile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithDiv):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMod):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::get):
+        (JSC::RegisterSet::setAll):
+        (JSC::RegisterSet::merge):
+        (JSC::RegisterSet::filter):
+        * runtime/Options.h:
+
+2016-01-19  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, undo unintended commit.
+
+        * dfg/DFGCommon.h:
+
+2016-01-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Fix Air shuffling assertions
+        https://bugs.webkit.org/show_bug.cgi?id=153213
+
+        Reviewed by Saam Barati.
+
+        Fixes some assertions that I was seeing running JSC tests. Adds a new Air test.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::store8):
+        (JSC::MacroAssemblerX86Common::getUnusedRegister):
+        * b3/air/AirEmitShuffle.cpp:
+        (JSC::B3::Air::emitShuffle):
+        * b3/air/AirLowerAfterRegAlloc.cpp:
+        (JSC::B3::Air::lowerAfterRegAlloc):
+        * b3/air/testair.cpp:
+        (JSC::B3::Air::testShuffleRotateWithFringe):
+        (JSC::B3::Air::testShuffleRotateWithFringeInWeirdOrder):
+        (JSC::B3::Air::testShuffleRotateWithLongFringe):
+        (JSC::B3::Air::run):
+
+2016-01-19  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Logical instructions allow immediates in range 0..0xffff, not 0x7fff
+        https://bugs.webkit.org/show_bug.cgi?id=152693
+
+        Reviewed by Michael Saboff.
+
+        * offlineasm/mips.rb:
+
+2016-01-18  Saam barati  <sbarati@apple.com>
+
+        assertions in BytecodeUseDef.h about opcode length are off by one
+        https://bugs.webkit.org/show_bug.cgi?id=153215
+
+        Reviewed by Dan Bernstein.
+
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+
+2016-01-18  Saam barati  <sbarati@apple.com>
+
+        FTL doesn't do proper spilling for exception handling when GetById/Snippets go to slow path
+        https://bugs.webkit.org/show_bug.cgi?id=153186
+
+        Reviewed by Michael Saboff.
+
+        Michael was investigating a bug he found while doing the new JSC calling 
+        convention work and it turns out to be a latent bug in FTL try/catch machinery.
+        After I looked at the code again, I realized that what I had previously
+        written is wrong in a subtle way. The FTL callOperation machinery will remove
+        its result register from the set of registers it needs to spill. This is not
+        correct when we have try/catch. We may want to do value recovery on
+        the value that the result register is prior to the call after the call
+        throws an exception. The case that we were solving before was when the 
+        resultRegister == baseRegister in a GetById, or left/rightRegister == resultRegister in a Snippet.
+        This code is correct in wanting to spill in that case, even though it might spill
+        when we don't need it to (i.e the result is not needed for value recovery). Once I
+        investigated this bug further, I realized that the previous rule is just a
+        partial subset of the rule that says we should spill anytime the result is
+        a register we might do value recovery on. This patch implements the rule that
+        says we always want to spill the result when we will do value recovery on it 
+        if an exception is thrown.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * tests/stress/ftl-try-catch-getter-throw-interesting-value-recovery.js: Added.
+        (assert):
+        (random):
+        (identity):
+        (let.o2.get f):
+        (let.o3.get f):
+        (foo):
+        (i.else):
+
+2016-01-18  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [MIPS] LLInt: fix calculation of Global Offset Table
+        https://bugs.webkit.org/show_bug.cgi?id=150381
+
+        Offlineasm adds a .cpload $t9 when we create a label in MIPS, which
+        computes address of GOT. However, this instruction requires $t9 to
+        contain address of current function. So we need to set $t9 to pcBase,
+        otherwise GOT-related calculations will be invalid.
+
+        Since offlineasm does not allow direct move to $t9 on MIPS, added new
+        instruction setcallreg which does exactly that.
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter.asm:
+        * offlineasm/instructions.rb:
+        * offlineasm/mips.rb:
+
+2016-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r194601): Fix the jsc timeout option of jsc.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=153204
+
+        Reviewed by Michael Catanzaro.
+
+        * jsc.cpp:
+        (main):
+
+2016-01-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Add testair to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=153126
+
+        Reviewed by Michael Catanzaro.
+
+        * shell/CMakeLists.txt:
+
+2016-01-17  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>
+
+        Ensure that CF_AVAILABLE is undefined when building webkit-gtk
+
+        https://bugs.webkit.org/show_bug.cgi?id=152720
+
+        This change ensures that CF_AVAILABLE is correctly a no-op to
+        address build failure that was observed when building on older
+        versions of OSX.  Previously, CF_AVAILABLE may have been unexpectedly
+        re-defined to the system header value based on include-order.
+
+        Reviewed by Michael Catanzaro.
+
+        * API/WebKitAvailability.h:
+
+2016-01-17  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Fix regT2 and regT3 trampling in MacroAssembler
+        https://bugs.webkit.org/show_bug.cgi?id=153131
+
+        Mips $t2 and $t3 registers were used as temporary registers
+        in MacroAssemblerMIPS.h, whereas they are mapped to regT2
+        and regT3 in LLInt and GPRInfo.
+
+        This patch rearranges register mapping for the mips architecture:
+        - use $t0 and $t1 as temp registers in LLInt (as in MacroAssembler)
+        - use $t7 and $t8 as temp registers in MacroAssembler (as in LLInt)
+        - remove $t6 from temp registers list in LLInt
+        - update GPRInfo.h accordingly
+        - add mips macroScratchRegisters() list in RegisterSet.cpp
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerMIPS.h:
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toRegister):
+        (JSC::GPRInfo::toIndex):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::macroScratchRegisters):
+        (JSC::RegisterSet::calleeSaveRegisters):
+        * offlineasm/mips.rb:
+
+2016-01-16  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Arrow function should support the destructuring parameters.
+        https://bugs.webkit.org/show_bug.cgi?id=146934
+
+        Reviewed by Saam Barati.
+        
+        Added support of destructuring parameters, before arrow function expect only simple parameters,
+        e.g. (), (x), (x, y) or x in assigment expressio. To support destructuring parameters added
+        additional check that check for destructuring paramters if check does not pass for simple parameters.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::isArrowFunctionParameters):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        * parser/Parser.h:
+
+2016-01-15  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Legalize Memory Offsets for ARM64 before lowering to Air
+        https://bugs.webkit.org/show_bug.cgi?id=153065
+
+        Reviewed by Mark Lam.
+        Reviewed by Filip Pizlo.
+
+        On ARM64, we cannot use signed 32bits offset for memory addressing.
+        There are two available addressing: signed 9bits and unsigned scaled 12bits.
+        Air already knows about it.
+
+        In this patch, the offsets are changed to something valid for ARM64
+        prior to lowering. When an offset is invalid, it is just computed
+        before the instruction and used as the base for addressing.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3LegalizeMemoryOffsets.cpp: Added.
+        (JSC::B3::legalizeMemoryOffsets):
+        * b3/B3LegalizeMemoryOffsets.h: Added.
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::effectiveAddr): Deleted.
+        * b3/testb3.cpp:
+        (JSC::B3::testLoadWithOffsetImpl):
+        (JSC::B3::testLoadOffsetImm9Max):
+        (JSC::B3::testLoadOffsetImm9MaxPlusOne):
+        (JSC::B3::testLoadOffsetImm9MaxPlusTwo):
+        (JSC::B3::testLoadOffsetImm9Min):
+        (JSC::B3::testLoadOffsetImm9MinMinusOne):
+        (JSC::B3::testLoadOffsetScaledUnsignedImm12Max):
+        (JSC::B3::testLoadOffsetScaledUnsignedOverImm12Max):
+        (JSC::B3::run):
+
+2016-01-15  Alex Christensen  <achristensen@webkit.org>
+
+        Fix internal Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=153142
+
+        Reviewed by Brent Fulgham.
+
+        The internal Windows build builds JavaScriptCore from a directory that is not called JavaScriptCore.
+        Searching for JavaScriptCore/API/APICast.h fails because it is in SomethingElse/API/APICast.h.
+        Since we are including the JavaScriptCore directory, it is not necessary to have JavaScriptCore in
+        the forwarding headers, but removing it allows builds form directories that are not named JavaScriptCore.
+
+        * ForwardingHeaders/JavaScriptCore/APICast.h:
+        * ForwardingHeaders/JavaScriptCore/JSBase.h:
+        * ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h:
+        * ForwardingHeaders/JavaScriptCore/JSContextRef.h:
+        * ForwardingHeaders/JavaScriptCore/JSObjectRef.h:
+        * ForwardingHeaders/JavaScriptCore/JSRetainPtr.h:
+        * ForwardingHeaders/JavaScriptCore/JSStringRef.h:
+        * ForwardingHeaders/JavaScriptCore/JSStringRefCF.h:
+        * ForwardingHeaders/JavaScriptCore/JSValueRef.h:
+        * ForwardingHeaders/JavaScriptCore/JavaScript.h:
+        * ForwardingHeaders/JavaScriptCore/JavaScriptCore.h:
+        * ForwardingHeaders/JavaScriptCore/OpaqueJSString.h:
+        * ForwardingHeaders/JavaScriptCore/WebKitAvailability.h:
+
+2016-01-15  Per Arne Vollan  <peavo@outlook.com>
+
+        [B3][Win64] Compile fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=153127
+
+        Reviewed by Alex Christensen.
+
+        MSVC have several overloads of fmod, pow, and ceil. We need to suggest to MSVC
+        which one we want to use.
+
+        * b3/B3LowerMacros.cpp:
+        * b3/B3LowerMacrosAfterOptimizations.cpp:
+        * b3/B3MathExtras.cpp:
+        (JSC::B3::powDoubleInt32):
+        * b3/B3ReduceStrength.cpp:
+
+2016-01-15  Filip Pizlo  <fpizlo@apple.com>
+
+        Air needs a Shuffle instruction
+        https://bugs.webkit.org/show_bug.cgi?id=152952
+
+        Reviewed by Saam Barati.
+
+        This adds an instruction called Shuffle. Shuffle allows you to simultaneously perform
+        multiple moves to perform arbitrary permutations over registers and memory. We call these
+        rotations. It also allows you to perform "shifts", like (a => b, b => c): after the shift,
+        c will have b's old value, b will have a's old value, and a will be unchanged. Shifts can
+        use immediates as their source.
+
+        Shuffle is added as a custom instruction, since it has a variable number of arguments. It
+        takes any number of triplets of arguments, where each triplet describes one mapping of the
+        shuffle. For example, to represent (a => b, b => c), we might say:
+
+            Shuffle %a, %b, 64, %b, %c, 64
+
+        Note the "64"s, those are width arguments that describe how many bits of the register are
+        being moved. Each triplet is referred to as a "shuffle pair". We call it a pair because the
+        most relevant part of it is the pair of registers or memroy locations (i.e. %a, %b form one
+        of the pairs in the example). For GP arguments, the width follows ZDef semantics.
+
+        In the future, we will be able to use Shuffle for a lot of things. This patch is modest about
+        how to use it:
+
+        - C calling convention argument marshalling. Previously we used move instructions. But that's
+          problematic since it introduces artificial interference between the argument registers and
+          the inputs. Using Shuffle removes that interference. This helps a bit.
+
+        - Cold C calls. This is what really motivated me to write this patch. If we have a C call on
+          a cold path, then we want it to appear to the register allocator like it doesn't clobber
+          any registers. Only after register allocation should we handle the clobbering by simply
+          saving all of the live volatile registers to the stack. If you imagine the saving and the
+          argument marshalling, you can see how before the call, we want to have a Shuffle that does
+          both of those things. This is important. If argument marshalling was separate from the
+          saving, then we'd still appear to clobber argument registers. Doing them together as one
+          Shuffle means that the cold call doesn't appear to even clobber the argument registers.
+
+        Unfortunately, I was wrong about cold C calls being the dominant problem with our register
+        allocator right now. Fixing this revealed other problems in my current tuning benchmark,
+        Octane/encrypt. Nonetheless, this is a small speed-up across the board, and gives us some
+        functionality we will need to implement other optimizations.
+
+        Relanding after fixing production build.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isX86_64):
+        (JSC::isIOS):
+        (JSC::optimizeForARMv7IDIVSupported):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::swap32):
+        (JSC::MacroAssemblerX86Common::moveConditionally32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::swap64):
+        (JSC::MacroAssemblerX86_64::move64ToDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::xchgl_rr):
+        (JSC::X86Assembler::xchgl_rm):
+        (JSC::X86Assembler::xchgq_rr):
+        (JSC::X86Assembler::xchgq_rm):
+        (JSC::X86Assembler::movl_rr):
+        * b3/B3CCallValue.h:
+        * b3/B3Compilation.cpp:
+        (JSC::B3::Compilation::Compilation):
+        (JSC::B3::Compilation::~Compilation):
+        * b3/B3Compilation.h:
+        (JSC::B3::Compilation::code):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::createSelect):
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::marshallCCallArgument): Deleted.
+        * b3/B3OpaqueByproducts.h:
+        (JSC::B3::OpaqueByproducts::count):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::isArgValidForValue):
+        (JSC::B3::StackmapSpecial::isArgValidForRep):
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::isStackMemory):
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::usesTmp):
+        (JSC::B3::Air::Arg::canRepresent):
+        (JSC::B3::Air::Arg::isCompatibleType):
+        (JSC::B3::Air::Arg::dump):
+        (WTF::printInternal):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::forEachType):
+        (JSC::B3::Air::Arg::isWarmUse):
+        (JSC::B3::Air::Arg::cooled):
+        (JSC::B3::Air::Arg::isEarlyUse):
+        (JSC::B3::Air::Arg::imm64):
+        (JSC::B3::Air::Arg::immPtr):
+        (JSC::B3::Air::Arg::addr):
+        (JSC::B3::Air::Arg::special):
+        (JSC::B3::Air::Arg::widthArg):
+        (JSC::B3::Air::Arg::operator==):
+        (JSC::B3::Air::Arg::isImm64):
+        (JSC::B3::Air::Arg::isSomeImm):
+        (JSC::B3::Air::Arg::isAddr):
+        (JSC::B3::Air::Arg::isIndex):
+        (JSC::B3::Air::Arg::isMemory):
+        (JSC::B3::Air::Arg::isRelCond):
+        (JSC::B3::Air::Arg::isSpecial):
+        (JSC::B3::Air::Arg::isWidthArg):
+        (JSC::B3::Air::Arg::isAlive):
+        (JSC::B3::Air::Arg::base):
+        (JSC::B3::Air::Arg::hasOffset):
+        (JSC::B3::Air::Arg::offset):
+        (JSC::B3::Air::Arg::width):
+        (JSC::B3::Air::Arg::isGPTmp):
+        (JSC::B3::Air::Arg::isGP):
+        (JSC::B3::Air::Arg::isFP):
+        (JSC::B3::Air::Arg::isType):
+        (JSC::B3::Air::Arg::isGPR):
+        (JSC::B3::Air::Arg::isValidForm):
+        (JSC::B3::Air::Arg::forEachTmpFast):
+        * b3/air/AirBasicBlock.h:
+        (JSC::B3::Air::BasicBlock::insts):
+        (JSC::B3::Air::BasicBlock::appendInst):
+        (JSC::B3::Air::BasicBlock::append):
+        * b3/air/AirCCallingConvention.cpp: Added.
+        (JSC::B3::Air::computeCCallingConvention):
+        (JSC::B3::Air::cCallResult):
+        (JSC::B3::Air::buildCCall):
+        * b3/air/AirCCallingConvention.h: Added.
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::proc):
+        * b3/air/AirCustom.cpp: Added.
+        (JSC::B3::Air::CCallCustom::isValidForm):
+        (JSC::B3::Air::CCallCustom::generate):
+        (JSC::B3::Air::ShuffleCustom::isValidForm):
+        (JSC::B3::Air::ShuffleCustom::generate):
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::PatchCustom::forEachArg):
+        (JSC::B3::Air::PatchCustom::generate):
+        (JSC::B3::Air::CCallCustom::forEachArg):
+        (JSC::B3::Air::CCallCustom::isValidFormStatic):
+        (JSC::B3::Air::CCallCustom::admitsStack):
+        (JSC::B3::Air::CCallCustom::hasNonArgNonControlEffects):
+        (JSC::B3::Air::ColdCCallCustom::forEachArg):
+        (JSC::B3::Air::ShuffleCustom::forEachArg):
+        (JSC::B3::Air::ShuffleCustom::isValidFormStatic):
+        (JSC::B3::Air::ShuffleCustom::admitsStack):
+        (JSC::B3::Air::ShuffleCustom::hasNonArgNonControlEffects):
+        * b3/air/AirEmitShuffle.cpp: Added.
+        (JSC::B3::Air::ShufflePair::dump):
+        (JSC::B3::Air::emitShuffle):
+        * b3/air/AirEmitShuffle.h: Added.
+        (JSC::B3::Air::ShufflePair::ShufflePair):
+        (JSC::B3::Air::ShufflePair::src):
+        (JSC::B3::Air::ShufflePair::dst):
+        (JSC::B3::Air::ShufflePair::width):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        * b3/air/AirGenerate.h:
+        * b3/air/AirInsertionSet.cpp:
+        (JSC::B3::Air::InsertionSet::insertInsts):
+        (JSC::B3::Air::InsertionSet::execute):
+        * b3/air/AirInsertionSet.h:
+        (JSC::B3::Air::InsertionSet::insertInst):
+        (JSC::B3::Air::InsertionSet::insert):
+        * b3/air/AirInst.h:
+        (JSC::B3::Air::Inst::operator bool):
+        (JSC::B3::Air::Inst::append):
+        * b3/air/AirLowerAfterRegAlloc.cpp: Added.
+        (JSC::B3::Air::lowerAfterRegAlloc):
+        * b3/air/AirLowerAfterRegAlloc.h: Added.
+        * b3/air/AirLowerMacros.cpp: Added.
+        (JSC::B3::Air::lowerMacros):
+        * b3/air/AirLowerMacros.h: Added.
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirRegisterPriority.h:
+        (JSC::B3::Air::regsInPriorityOrder):
+        * b3/air/testair.cpp: Added.
+        (hiddenTruthBecauseNoReturnIsStupid):
+        (usage):
+        (JSC::B3::Air::compile):
+        (JSC::B3::Air::invoke):
+        (JSC::B3::Air::compileAndRun):
+        (JSC::B3::Air::testSimple):
+        (JSC::B3::Air::loadConstantImpl):
+        (JSC::B3::Air::loadConstant):
+        (JSC::B3::Air::loadDoubleConstant):
+        (JSC::B3::Air::testShuffleSimpleSwap):
+        (JSC::B3::Air::testShuffleSimpleShift):
+        (JSC::B3::Air::testShuffleLongShift):
+        (JSC::B3::Air::testShuffleLongShiftBackwards):
+        (JSC::B3::Air::testShuffleSimpleRotate):
+        (JSC::B3::Air::testShuffleSimpleBroadcast):
+        (JSC::B3::Air::testShuffleBroadcastAllRegs):
+        (JSC::B3::Air::testShuffleTreeShift):
+        (JSC::B3::Air::testShuffleTreeShiftBackward):
+        (JSC::B3::Air::testShuffleTreeShiftOtherBackward):
+        (JSC::B3::Air::testShuffleMultipleShifts):
+        (JSC::B3::Air::testShuffleRotateWithFringe):
+        (JSC::B3::Air::testShuffleRotateWithLongFringe):
+        (JSC::B3::Air::testShuffleMultipleRotates):
+        (JSC::B3::Air::testShuffleShiftAndRotate):
+        (JSC::B3::Air::testShuffleShiftAllRegs):
+        (JSC::B3::Air::testShuffleRotateAllRegs):
+        (JSC::B3::Air::testShuffleSimpleSwap64):
+        (JSC::B3::Air::testShuffleSimpleShift64):
+        (JSC::B3::Air::testShuffleSwapMixedWidth):
+        (JSC::B3::Air::testShuffleShiftMixedWidth):
+        (JSC::B3::Air::testShuffleShiftMemory):
+        (JSC::B3::Air::testShuffleShiftMemoryLong):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegs):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegs64):
+        (JSC::B3::Air::combineHiLo):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegsMixedWidth):
+        (JSC::B3::Air::testShuffleRotateMemory):
+        (JSC::B3::Air::testShuffleRotateMemory64):
+        (JSC::B3::Air::testShuffleRotateMemoryMixedWidth):
+        (JSC::B3::Air::testShuffleRotateMemoryAllRegs64):
+        (JSC::B3::Air::testShuffleRotateMemoryAllRegsMixedWidth):
+        (JSC::B3::Air::testShuffleSwapDouble):
+        (JSC::B3::Air::testShuffleShiftDouble):
+        (JSC::B3::Air::run):
+        (run):
+        (main):
+        * b3/testb3.cpp:
+        (JSC::B3::testCallSimple):
+        (JSC::B3::testCallRare):
+        (JSC::B3::testCallRareLive):
+        (JSC::B3::testCallSimplePure):
+        (JSC::B3::run):
+
+2016-01-15  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement Date.prototype.toLocaleString in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147611
+
+        Reviewed by Benjamin Poulain.
+
+        Expose dateProtoFuncGetTime as thisTimeValue for builtins.
+        Remove unused code in DateTimeFormat toDateTimeOptions, and make the
+        function specific to the call in initializeDateTimeFormat. Properly
+        throw when the options parameter is null.
+        Add toLocaleString in builtin JavaScript, with it's own specific branch
+        of toDateTimeOptions.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/DatePrototype.js: Added.
+        (toLocaleString.toDateTimeOptionsAnyAll):
+        (toLocaleString):
+        * runtime/CommonIdentifiers.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+        * runtime/DatePrototype.h:
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::toDateTimeOptionsAnyDate):
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        (JSC::toDateTimeOptions): Deleted.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+
+2016-01-15  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Implemented emitFunctionPrologue/Epilogue
+        https://bugs.webkit.org/show_bug.cgi?id=152947
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::popPair):
+        (JSC::MacroAssemblerMIPS::pushPair):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitFunctionPrologue):
+        (JSC::AssemblyHelpers::emitFunctionEpilogueWithEmptyFrame):
+        (JSC::AssemblyHelpers::emitFunctionEpilogue):
+
+2016-01-15  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r195084.
+        https://bugs.webkit.org/show_bug.cgi?id=153132
+
+        Broke Production build (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        "Air needs a Shuffle instruction"
+        https://bugs.webkit.org/show_bug.cgi?id=152952
+        http://trac.webkit.org/changeset/195084
+
+2016-01-15  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Add countLeadingZeros32 implementation in macro assembler
+        https://bugs.webkit.org/show_bug.cgi?id=152886
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MIPSAssembler.h:
+        (JSC::MIPSAssembler::lui):
+        (JSC::MIPSAssembler::clz):
+        (JSC::MIPSAssembler::addiu):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::countLeadingZeros32):
+        (JSC::MacroAssemblerMIPS::lshift32):
+
+2016-01-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Air needs a Shuffle instruction
+        https://bugs.webkit.org/show_bug.cgi?id=152952
+
+        Reviewed by Saam Barati.
+
+        This adds an instruction called Shuffle. Shuffle allows you to simultaneously perform
+        multiple moves to perform arbitrary permutations over registers and memory. We call these
+        rotations. It also allows you to perform "shifts", like (a => b, b => c): after the shift,
+        c will have b's old value, b will have a's old value, and a will be unchanged. Shifts can
+        use immediates as their source.
+
+        Shuffle is added as a custom instruction, since it has a variable number of arguments. It
+        takes any number of triplets of arguments, where each triplet describes one mapping of the
+        shuffle. For example, to represent (a => b, b => c), we might say:
+
+            Shuffle %a, %b, 64, %b, %c, 64
+
+        Note the "64"s, those are width arguments that describe how many bits of the register are
+        being moved. Each triplet is referred to as a "shuffle pair". We call it a pair because the
+        most relevant part of it is the pair of registers or memroy locations (i.e. %a, %b form one
+        of the pairs in the example). For GP arguments, the width follows ZDef semantics.
+
+        In the future, we will be able to use Shuffle for a lot of things. This patch is modest about
+        how to use it:
+
+        - C calling convention argument marshalling. Previously we used move instructions. But that's
+          problematic since it introduces artificial interference between the argument registers and
+          the inputs. Using Shuffle removes that interference. This helps a bit.
+
+        - Cold C calls. This is what really motivated me to write this patch. If we have a C call on
+          a cold path, then we want it to appear to the register allocator like it doesn't clobber
+          any registers. Only after register allocation should we handle the clobbering by simply
+          saving all of the live volatile registers to the stack. If you imagine the saving and the
+          argument marshalling, you can see how before the call, we want to have a Shuffle that does
+          both of those things. This is important. If argument marshalling was separate from the
+          saving, then we'd still appear to clobber argument registers. Doing them together as one
+          Shuffle means that the cold call doesn't appear to even clobber the argument registers.
+
+        Unfortunately, I was wrong about cold C calls being the dominant problem with our register
+        allocator right now. Fixing this revealed other problems in my current tuning benchmark,
+        Octane/encrypt. Nonetheless, this is a small speed-up across the board, and gives us some
+        functionality we will need to implement other optimizations.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isX86_64):
+        (JSC::isIOS):
+        (JSC::optimizeForARMv7IDIVSupported):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::swap32):
+        (JSC::MacroAssemblerX86Common::moveConditionally32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::swap64):
+        (JSC::MacroAssemblerX86_64::move64ToDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::xchgl_rr):
+        (JSC::X86Assembler::xchgl_rm):
+        (JSC::X86Assembler::xchgq_rr):
+        (JSC::X86Assembler::xchgq_rm):
+        (JSC::X86Assembler::movl_rr):
+        * b3/B3CCallValue.h:
+        * b3/B3Compilation.cpp:
+        (JSC::B3::Compilation::Compilation):
+        (JSC::B3::Compilation::~Compilation):
+        * b3/B3Compilation.h:
+        (JSC::B3::Compilation::code):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::createSelect):
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::marshallCCallArgument): Deleted.
+        * b3/B3OpaqueByproducts.h:
+        (JSC::B3::OpaqueByproducts::count):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::isArgValidForValue):
+        (JSC::B3::StackmapSpecial::isArgValidForRep):
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::isStackMemory):
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        (JSC::B3::Air::Arg::usesTmp):
+        (JSC::B3::Air::Arg::canRepresent):
+        (JSC::B3::Air::Arg::isCompatibleType):
+        (JSC::B3::Air::Arg::dump):
+        (WTF::printInternal):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::forEachType):
+        (JSC::B3::Air::Arg::isWarmUse):
+        (JSC::B3::Air::Arg::cooled):
+        (JSC::B3::Air::Arg::isEarlyUse):
+        (JSC::B3::Air::Arg::imm64):
+        (JSC::B3::Air::Arg::immPtr):
+        (JSC::B3::Air::Arg::addr):
+        (JSC::B3::Air::Arg::special):
+        (JSC::B3::Air::Arg::widthArg):
+        (JSC::B3::Air::Arg::operator==):
+        (JSC::B3::Air::Arg::isImm64):
+        (JSC::B3::Air::Arg::isSomeImm):
+        (JSC::B3::Air::Arg::isAddr):
+        (JSC::B3::Air::Arg::isIndex):
+        (JSC::B3::Air::Arg::isMemory):
+        (JSC::B3::Air::Arg::isRelCond):
+        (JSC::B3::Air::Arg::isSpecial):
+        (JSC::B3::Air::Arg::isWidthArg):
+        (JSC::B3::Air::Arg::isAlive):
+        (JSC::B3::Air::Arg::base):
+        (JSC::B3::Air::Arg::hasOffset):
+        (JSC::B3::Air::Arg::offset):
+        (JSC::B3::Air::Arg::width):
+        (JSC::B3::Air::Arg::isGPTmp):
+        (JSC::B3::Air::Arg::isGP):
+        (JSC::B3::Air::Arg::isFP):
+        (JSC::B3::Air::Arg::isType):
+        (JSC::B3::Air::Arg::isGPR):
+        (JSC::B3::Air::Arg::isValidForm):
+        (JSC::B3::Air::Arg::forEachTmpFast):
+        * b3/air/AirBasicBlock.h:
+        (JSC::B3::Air::BasicBlock::insts):
+        (JSC::B3::Air::BasicBlock::appendInst):
+        (JSC::B3::Air::BasicBlock::append):
+        * b3/air/AirCCallingConvention.cpp: Added.
+        (JSC::B3::Air::computeCCallingConvention):
+        (JSC::B3::Air::cCallResult):
+        (JSC::B3::Air::buildCCall):
+        * b3/air/AirCCallingConvention.h: Added.
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::proc):
+        * b3/air/AirCustom.cpp: Added.
+        (JSC::B3::Air::CCallCustom::isValidForm):
+        (JSC::B3::Air::CCallCustom::generate):
+        (JSC::B3::Air::ShuffleCustom::isValidForm):
+        (JSC::B3::Air::ShuffleCustom::generate):
+        * b3/air/AirCustom.h:
+        (JSC::B3::Air::PatchCustom::forEachArg):
+        (JSC::B3::Air::PatchCustom::generate):
+        (JSC::B3::Air::CCallCustom::forEachArg):
+        (JSC::B3::Air::CCallCustom::isValidFormStatic):
+        (JSC::B3::Air::CCallCustom::admitsStack):
+        (JSC::B3::Air::CCallCustom::hasNonArgNonControlEffects):
+        (JSC::B3::Air::ColdCCallCustom::forEachArg):
+        (JSC::B3::Air::ShuffleCustom::forEachArg):
+        (JSC::B3::Air::ShuffleCustom::isValidFormStatic):
+        (JSC::B3::Air::ShuffleCustom::admitsStack):
+        (JSC::B3::Air::ShuffleCustom::hasNonArgNonControlEffects):
+        * b3/air/AirEmitShuffle.cpp: Added.
+        (JSC::B3::Air::ShufflePair::dump):
+        (JSC::B3::Air::emitShuffle):
+        * b3/air/AirEmitShuffle.h: Added.
+        (JSC::B3::Air::ShufflePair::ShufflePair):
+        (JSC::B3::Air::ShufflePair::src):
+        (JSC::B3::Air::ShufflePair::dst):
+        (JSC::B3::Air::ShufflePair::width):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        * b3/air/AirGenerate.h:
+        * b3/air/AirInsertionSet.cpp:
+        (JSC::B3::Air::InsertionSet::insertInsts):
+        (JSC::B3::Air::InsertionSet::execute):
+        * b3/air/AirInsertionSet.h:
+        (JSC::B3::Air::InsertionSet::insertInst):
+        (JSC::B3::Air::InsertionSet::insert):
+        * b3/air/AirInst.h:
+        (JSC::B3::Air::Inst::operator bool):
+        (JSC::B3::Air::Inst::append):
+        * b3/air/AirLowerAfterRegAlloc.cpp: Added.
+        (JSC::B3::Air::lowerAfterRegAlloc):
+        * b3/air/AirLowerAfterRegAlloc.h: Added.
+        * b3/air/AirLowerMacros.cpp: Added.
+        (JSC::B3::Air::lowerMacros):
+        * b3/air/AirLowerMacros.h: Added.
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirRegisterPriority.h:
+        (JSC::B3::Air::regsInPriorityOrder):
+        * b3/air/testair.cpp: Added.
+        (hiddenTruthBecauseNoReturnIsStupid):
+        (usage):
+        (JSC::B3::Air::compile):
+        (JSC::B3::Air::invoke):
+        (JSC::B3::Air::compileAndRun):
+        (JSC::B3::Air::testSimple):
+        (JSC::B3::Air::loadConstantImpl):
+        (JSC::B3::Air::loadConstant):
+        (JSC::B3::Air::loadDoubleConstant):
+        (JSC::B3::Air::testShuffleSimpleSwap):
+        (JSC::B3::Air::testShuffleSimpleShift):
+        (JSC::B3::Air::testShuffleLongShift):
+        (JSC::B3::Air::testShuffleLongShiftBackwards):
+        (JSC::B3::Air::testShuffleSimpleRotate):
+        (JSC::B3::Air::testShuffleSimpleBroadcast):
+        (JSC::B3::Air::testShuffleBroadcastAllRegs):
+        (JSC::B3::Air::testShuffleTreeShift):
+        (JSC::B3::Air::testShuffleTreeShiftBackward):
+        (JSC::B3::Air::testShuffleTreeShiftOtherBackward):
+        (JSC::B3::Air::testShuffleMultipleShifts):
+        (JSC::B3::Air::testShuffleRotateWithFringe):
+        (JSC::B3::Air::testShuffleRotateWithLongFringe):
+        (JSC::B3::Air::testShuffleMultipleRotates):
+        (JSC::B3::Air::testShuffleShiftAndRotate):
+        (JSC::B3::Air::testShuffleShiftAllRegs):
+        (JSC::B3::Air::testShuffleRotateAllRegs):
+        (JSC::B3::Air::testShuffleSimpleSwap64):
+        (JSC::B3::Air::testShuffleSimpleShift64):
+        (JSC::B3::Air::testShuffleSwapMixedWidth):
+        (JSC::B3::Air::testShuffleShiftMixedWidth):
+        (JSC::B3::Air::testShuffleShiftMemory):
+        (JSC::B3::Air::testShuffleShiftMemoryLong):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegs):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegs64):
+        (JSC::B3::Air::combineHiLo):
+        (JSC::B3::Air::testShuffleShiftMemoryAllRegsMixedWidth):
+        (JSC::B3::Air::testShuffleRotateMemory):
+        (JSC::B3::Air::testShuffleRotateMemory64):
+        (JSC::B3::Air::testShuffleRotateMemoryMixedWidth):
+        (JSC::B3::Air::testShuffleRotateMemoryAllRegs64):
+        (JSC::B3::Air::testShuffleRotateMemoryAllRegsMixedWidth):
+        (JSC::B3::Air::testShuffleSwapDouble):
+        (JSC::B3::Air::testShuffleShiftDouble):
+        (JSC::B3::Air::run):
+        (run):
+        (main):
+        * b3/testb3.cpp:
+        (JSC::B3::testCallSimple):
+        (JSC::B3::testCallRare):
+        (JSC::B3::testCallRareLive):
+        (JSC::B3::testCallSimplePure):
+        (JSC::B3::run):
+
+2016-01-14  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed mark passing es6 tests as no longer failing.
+
+        * tests/es6.yaml:
+
+2016-01-14  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Support subclassing Function.
+        https://bugs.webkit.org/show_bug.cgi?id=153081
+
+        Reviewed by Geoffrey Garen.
+
+        This patch enables subclassing the Function object. It also fixes an existing
+        bug that prevented users from subclassing functions that have a function in
+        the superclass's prototype property.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ClassExprNode::emitBytecode):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructWithFunctionConstructor):
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createImpl):
+        * runtime/JSFunctionInlines.h:
+        (JSC::JSFunction::createWithInvalidatedReallocationWatchpoint):
+        (JSC::JSFunction::JSFunction): Deleted.
+        * tests/stress/class-subclassing-function.js: Added.
+
+2016-01-13  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [CMake] Do not use LLVM static libraries for FTL JIT
+        https://bugs.webkit.org/show_bug.cgi?id=151559
+
+        Reviewed by Michael Catanzaro.
+
+        Allow ports decide whether to prefer linking to llvm static or
+        dynamic libraries. This patch only changes the behavior of the GTK
+        port, other ports can change the default behavior by setting
+        llvmForJSC_LIBRARIES in their platform specific cmake files.
+
+        * CMakeLists.txt: Move llvmForJSC library definition after the
+        WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS, to allow platform specific
+        files to set their own llvmForJSC_LIBRARIES. When not set, it
+        defaults to LLVM_STATIC_LIBRARIES. The command to create
+        WebKitLLVMLibraryToken.h no longer depends on the static
+        libraries, since we are going to make the build fail anyway when
+        not found in case of linking to the static libraries. If platform
+        specific file defined llvmForJSC_INSTALL_DIR llvmForJSC is also
+        installed to the given destination.
+        * PlatformGTK.cmake: Set llvmForJSC_LIBRARIES and
+        llvmForJSC_INSTALL_DIR.
+
+2016-01-13  Saam barati  <sbarati@apple.com>
+
+        NativeExecutable should have a name field
+        https://bugs.webkit.org/show_bug.cgi?id=153083
+
+        Reviewed by Geoffrey Garen.
+
+        This is going to help the SamplingProfiler come up
+        with names for NativeExecutable objects it encounters.
+
+        * jit/JITThunks.cpp:
+        (JSC::JITThunks::finalize):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITThunks.h:
+        * runtime/Executable.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::create):
+        (JSC::JSFunction::lookUpOrCreateNativeExecutable):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createImpl):
+        * runtime/JSNativeStdFunction.cpp:
+        (JSC::JSNativeStdFunction::create):
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+        (JSC::VM::getHostFunction):
+        * runtime/VM.h:
+        (JSC::VM::getCTIStub):
+        (JSC::VM::exceptionOffset):
+
+2016-01-13  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Support subclassing the String builtin object
+        https://bugs.webkit.org/show_bug.cgi?id=153068
+
+        Reviewed by Michael Saboff.
+
+        This patch adds subclassing of strings. Also, this patch fixes a bug where we could have
+        the wrong indexing type for builtins constructed without storage.
+
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
+        * runtime/StringConstructor.cpp:
+        (JSC::constructWithStringConstructor):
+        * tests/stress/class-subclassing-string.js: Added.
+        (test):
+
+2016-01-13  Mark Lam  <mark.lam@apple.com>
+
+        The StringFromCharCode DFG intrinsic should support untyped operands.
+        https://bugs.webkit.org/show_bug.cgi?id=153046
+
+        Reviewed by Geoffrey Garen.
+
+        The current StringFromCharCode DFG intrinsic assumes that its operand charCode
+        must be an Int32.  This results in 26000+ BadType OSR exits in the LongSpider
+        crypto-aes benchmark.  With support for Untyped operands, the number of OSR
+        exits drops to 202.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileFromCharCode):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::toUInt32):
+
+2016-01-13  Mark Lam  <mark.lam@apple.com>
+
+        Use DFG Graph::binary/unaryArithShouldSpeculateInt32/MachineInt() functions consistently.
+        https://bugs.webkit.org/show_bug.cgi?id=153080
+
+        Reviewed by Geoffrey Garen.
+
+        We currently have Graph::mulShouldSpeculateInt32/machineInt() and
+        Graph::negateShouldSpeculateInt32/MachineInt() functions which are only used by
+        the ArithMul and ArithNegate nodes.  However, the same tests need to be done for
+        many other arith nodes in the DFG.  This patch renames these functions as
+        Graph::binaryArithShouldSpeculateInt32/machineInt() and
+        Graph::unaryArithShouldSpeculateInt32/MachineInt(), and uses them consistently
+        in the DFG.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::addShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::binaryArithShouldSpeculateInt32):
+        (JSC::DFG::Graph::binaryArithShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::unaryArithShouldSpeculateInt32):
+        (JSC::DFG::Graph::unaryArithShouldSpeculateMachineInt):
+        (JSC::DFG::Graph::mulShouldSpeculateInt32): Deleted.
+        (JSC::DFG::Graph::mulShouldSpeculateMachineInt): Deleted.
+        (JSC::DFG::Graph::negateShouldSpeculateInt32): Deleted.
+        (JSC::DFG::Graph::negateShouldSpeculateMachineInt): Deleted.
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
+
+2016-01-13  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Inspector should use the last sourceURL / sourceMappingURL directive
+        https://bugs.webkit.org/show_bug.cgi?id=153072
+        <rdar://problem/24168312>
+
+        Reviewed by Timothy Hatcher.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::parseCommentDirective):
+        Just keep overwriting the member variable so we end up with
+        the last directive value.
+
+2016-01-13  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r194969.
+        https://bugs.webkit.org/show_bug.cgi?id=153075
+
+        This change broke the iOS build (Requested by ryanhaddad on
+        #webkit).
+
+        Reverted changeset:
+
+        "[JSC] Legalize Memory Offsets for ARM64 before lowering to
+        Air"
+        https://bugs.webkit.org/show_bug.cgi?id=153065
+        http://trac.webkit.org/changeset/194969
+
+2016-01-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Legalize Memory Offsets for ARM64 before lowering to Air
+        https://bugs.webkit.org/show_bug.cgi?id=153065
+
+        Reviewed by Mark Lam.
+        Reviewed by Filip Pizlo.
+
+        On ARM64, we cannot use signed 32bits offset for memory addressing.
+        There are two available addressing: signed 9bits and unsigned scaled 12bits.
+        Air already knows about it.
+
+        In this patch, the offsets are changed to something valid for ARM64
+        prior to lowering. When an offset is invalid, it is just computed
+        before the instruction and used as the base for addressing.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3LegalizeMemoryOffsets.cpp: Added.
+        (JSC::B3::legalizeMemoryOffsets):
+        * b3/B3LegalizeMemoryOffsets.h: Added.
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::effectiveAddr): Deleted.
+        * b3/testb3.cpp:
+        (JSC::B3::testLoadWithOffsetImpl):
+        (JSC::B3::testLoadOffsetImm9Max):
+        (JSC::B3::testLoadOffsetImm9MaxPlusOne):
+        (JSC::B3::testLoadOffsetImm9MaxPlusTwo):
+        (JSC::B3::testLoadOffsetImm9Min):
+        (JSC::B3::testLoadOffsetImm9MinMinusOne):
+        (JSC::B3::testLoadOffsetScaledUnsignedImm12Max):
+        (JSC::B3::testLoadOffsetScaledUnsignedOverImm12Max):
+        (JSC::B3::run):
+
+2016-01-12  Per Arne Vollan  <peavo@outlook.com>
+
+        [FTL][Win64] Compile error.
+        https://bugs.webkit.org/show_bug.cgi?id=153031
+
+        Reviewed by Brent Fulgham.
+
+        The header file dlfcn.h does not exist on Windows.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+
+2016-01-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Add a build flag for custom element
+        https://bugs.webkit.org/show_bug.cgi?id=153005
+
+        Reviewed by Alex Christensen.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-01-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove some invalid immediate instruction forms from ARM64 Air
+        https://bugs.webkit.org/show_bug.cgi?id=153024
+
+        Reviewed by Michael Saboff.
+
+        * b3/B3BasicBlock.h:
+        Export the symbols for testb3.
+
+        * b3/air/AirOpcode.opcodes:
+        We had 2 invalid opcodes:
+        -Compare with immediate just does not exist.
+        -Test64 with immediate exists but Air does not recognize
+         the valid form of bit-immediates.
+
+        * b3/testb3.cpp:
+        (JSC::B3::genericTestCompare):
+        (JSC::B3::testCompareImpl):
+        Extend the tests to cover what was invalid.
+
+2016-01-12  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] JSC does not build with FTL_USES_B3 on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=153011
+
+        Reviewed by Saam Barati.
+
+        Apparently the static const member can only be used for constexpr.
+        C++ is weird.
+
+        * jit/GPRInfo.cpp:
+        * jit/GPRInfo.h:
+
+2016-01-11  Johan K. Jensen  <jj@johanjensen.dk>
+
+        Web Inspector: console.count() shouldn't show a colon in front of a number
+        https://bugs.webkit.org/show_bug.cgi?id=152038
+
+        Reviewed by Brian Burg.
+
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::count):
+        Do not include title and colon if the title is empty.
+
+2016-01-11  Dan Bernstein  <mitz@apple.com>
+
+        Reverted r194317.
+
+        Reviewed by Joseph Pecoraro.
+
+        r194317 did not contain a change log entry, did not explain the motivation, did not name a
+        reviewer, and does not seem necessary.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2016-01-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        keywords ("super", "delete", etc) should be valid method names
+        https://bugs.webkit.org/show_bug.cgi?id=144281
+
+        Reviewed by Ryosuke Niwa.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseClass):
+        - When parsing "static(" treat it as a method named "static" and not a static method.
+        - When parsing a keyword treat it like a string method name (get and set are not keywords)
+        - When parsing a getter / setter method name identifier, allow lookahead to be a keyword
+
+        (JSC::Parser<LexerType>::parseGetterSetter):
+        - When parsing the getter / setter's name, allow it to be a keyword.
+
+2016-01-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add Div/Mod and fix Mul for B3 ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=152978
+
+        Reviewed by Filip Pizlo.
+
+        Add the 3 operands forms of Mul.
+        Remove the form taking immediate on ARM64, there are no such instruction.
+
+        Add Div with sdiv.
+
+        Unfortunately, I discovered ChillMod's division by zero
+        makes it non-trivial on ARM64. I just made it into a macro like on x86.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::mul32):
+        (JSC::MacroAssemblerARM64::mul64):
+        (JSC::MacroAssemblerARM64::div32):
+        (JSC::MacroAssemblerARM64::div64):
+        * b3/B3LowerMacros.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+
+2016-01-11  Keith Miller  <keith_miller@apple.com>
+
+        Arrays should use the InternalFunctionAllocationProfile when constructing new Arrays
+        https://bugs.webkit.org/show_bug.cgi?id=152949
+
+        Reviewed by Michael Saboff.
+
+        This patch updates Array constructors to use the new InternalFunctionAllocationProfile.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        (JSC::constructWithArrayConstructor):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
+        (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        (JSC::constructArrayNegativeIndexed):
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+
+2016-01-08  Keith Miller  <keith_miller@apple.com>
+
+        Use a profile to store allocation structures for subclasses of InternalFunctions
+        https://bugs.webkit.org/show_bug.cgi?id=152942
+
+        Reviewed by Michael Saboff.
+
+        This patch adds InternalFunctionAllocationProfile to FunctionRareData, which holds
+        a cached structure that can be used to quickly allocate any derived class of an InternalFunction.
+        InternalFunctionAllocationProfile ended up being distinct from ObjectAllocationProfile, due to
+        constraints imposed by Reflect.construct. Reflect.construct allows the user to pass an arbitrary
+        constructor as a new.target to any other constructor. This means that a user can pass some
+        non-derived constructor to an InternalFunction (they can even pass another InternalFunction as the
+        new.target). If we use the same profile for both InternalFunctions and JS allocations then we always
+        need to check in both JS code and C++ code that the profiled structure has the same ClassInfo as the
+        current constructor. By using different profiles, we only need to check the profile in InternalFunctions
+        as all JS constructed objects share the same ClassInfo (JSFinalObject). This comes at the relatively
+        low cost of using slightly more memory on FunctionRareData and being slightly more conceptually complex.
+
+        Additionally, this patch adds subclassing to some omitted classes.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeDate):
+        (JSObjectMakeRegExp):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/InternalFunctionAllocationProfile.h: Added.
+        (JSC::InternalFunctionAllocationProfile::structure):
+        (JSC::InternalFunctionAllocationProfile::clear):
+        (JSC::InternalFunctionAllocationProfile::visitAggregate):
+        (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_this):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_create_this):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructWithBooleanConstructor):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::constructWithDateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/ErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithErrorConstructor):
+        * runtime/FunctionRareData.cpp:
+        (JSC::FunctionRareData::create):
+        (JSC::FunctionRareData::visitChildren):
+        (JSC::FunctionRareData::FunctionRareData):
+        (JSC::FunctionRareData::initializeObjectAllocationProfile):
+        (JSC::FunctionRareData::clear):
+        (JSC::FunctionRareData::finishCreation): Deleted.
+        (JSC::FunctionRareData::initialize): Deleted.
+        * runtime/FunctionRareData.h:
+        (JSC::FunctionRareData::offsetOfObjectAllocationProfile):
+        (JSC::FunctionRareData::objectAllocationProfile):
+        (JSC::FunctionRareData::objectAllocationStructure):
+        (JSC::FunctionRareData::allocationProfileWatchpointSet):
+        (JSC::FunctionRareData::isObjectAllocationProfileInitialized):
+        (JSC::FunctionRareData::internalFunctionAllocationStructure):
+        (JSC::FunctionRareData::createInternalFunctionAllocationStructureFromBase):
+        (JSC::FunctionRareData::offsetOfAllocationProfile): Deleted.
+        (JSC::FunctionRareData::allocationProfile): Deleted.
+        (JSC::FunctionRareData::allocationStructure): Deleted.
+        (JSC::FunctionRareData::isInitialized): Deleted.
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::createSubclassStructure):
+        * runtime/InternalFunction.h:
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::allocateRareData):
+        (JSC::JSFunction::allocateAndInitializeRareData):
+        (JSC::JSFunction::initializeRareData):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::rareData):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayView):
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::typeInfo):
+        (JSC::JSFinalObject::createStructure):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSWeakMap.cpp:
+        * runtime/JSWeakSet.cpp:
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::Interpreter::constructWithNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/PrototypeMap.cpp:
+        (JSC::PrototypeMap::createEmptyStructure):
+        (JSC::PrototypeMap::emptyStructureForPrototypeFromBaseStructure):
+        (JSC::PrototypeMap::emptyObjectStructureForPrototype):
+        (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
+        * runtime/PrototypeMap.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::getRegExpStructure):
+        (JSC::constructRegExp):
+        (JSC::constructWithRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::constructWeakMap):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::constructWeakSet):
+        * tests/stress/class-subclassing-misc.js:
+        (A):
+        (D):
+        (E):
+        (WM):
+        (WS):
+        (test):
+        * tests/stress/class-subclassing-typedarray.js: Added.
+        (test):
+
+2016-01-11  Per Arne Vollan  <peavo@outlook.com>
+
+        [B3][Win64] Compile error.
+        https://bugs.webkit.org/show_bug.cgi?id=152984
+
+        Reviewed by Alex Christensen.
+
+        Windows does not have bzero, use memset instead.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+
+2016-01-11  Konstantin Tokarev  <annulen@yandex.ru>
+
+        Fixed compilation of JavaScriptCore with GCC 4.8 on 32-bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=152923
+
+        Reviewed by Alex Christensen.
+
+        * jit/CallFrameShuffler.h:
+        (JSC::CallFrameShuffler::assumeCalleeIsCell):
+
+2016-01-11  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [B3] Fix control reaches end of non-void function GCC warnings on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=152887
+
+        Reviewed by Mark Lam.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createBranch):
+        (JSC::B3::Air::LowerToAir::createCompare):
+        (JSC::B3::Air::LowerToAir::createSelect):
+        * b3/B3Type.h:
+        (JSC::B3::sizeofType):
+        * b3/air/AirArg.cpp:
+        (JSC::B3::Air::Arg::isRepresentableAs):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isAnyUse):
+        (JSC::B3::Air::Arg::isColdUse):
+        (JSC::B3::Air::Arg::isEarlyUse):
+        (JSC::B3::Air::Arg::isLateUse):
+        (JSC::B3::Air::Arg::isAnyDef):
+        (JSC::B3::Air::Arg::isEarlyDef):
+        (JSC::B3::Air::Arg::isLateDef):
+        (JSC::B3::Air::Arg::isZDef):
+        (JSC::B3::Air::Arg::widthForB3Type):
+        (JSC::B3::Air::Arg::isGP):
+        (JSC::B3::Air::Arg::isFP):
+        (JSC::B3::Air::Arg::isType):
+        (JSC::B3::Air::Arg::isValidForm):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::newTmp):
+        (JSC::B3::Air::Code::numTmps):
+
+2016-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Make it easier to introduce exotic instructions to Air
+        https://bugs.webkit.org/show_bug.cgi?id=152953
+
+        Reviewed by Benjamin Poulain.
+
+        Currently, you can define new "opcodes" in Air using either:
+
+        1) New opcode declared in AirOpcode.opcodes.
+        2) Patch opcode with a new implementation of Air::Special.
+
+        With (1), you are limited to fixed-argument-length instructions. There are other
+        restrictions as well, like that you can only use the roles that the AirOpcode syntax
+        supports.
+
+        With (2), you can do anything you like, but the instruction will be harder to match
+        since it will share the same opcode as any other Patch. Also, the instruction will have
+        the Special argument, which means more busy-work when creating the instruction and
+        validating it.
+
+        This introduces an in-between facility called "custom". This replaces what AirOpcode
+        previously called "special". A custom instruction is one whose behavior is defined by a
+        FooCustom struct with some static methods. Calls to those methods are emitted by
+        opcode_generator.rb.
+
+        The "custom" facility is powerful enough to be used to implement Patch, with the caveat
+        that we now treat the Patch instruction specially in a few places. Those places were
+        already effectively treating it specially by assuming that only Patch instructions have
+        a Special as their first argument.
+
+        This will let me implement the Shuffle instruction (bug 152952), which I think is needed
+        for performance work.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/air/AirCustom.h: Added.
+        (JSC::B3::Air::PatchCustom::forEachArg):
+        (JSC::B3::Air::PatchCustom::isValidFormStatic):
+        (JSC::B3::Air::PatchCustom::isValidForm):
+        (JSC::B3::Air::PatchCustom::admitsStack):
+        (JSC::B3::Air::PatchCustom::hasNonArgNonControlEffects):
+        (JSC::B3::Air::PatchCustom::generate):
+        * b3/air/AirHandleCalleeSaves.cpp:
+        (JSC::B3::Air::handleCalleeSaves):
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::forEach):
+        (JSC::B3::Air::Inst::extraClobberedRegs):
+        (JSC::B3::Air::Inst::extraEarlyClobberedRegs):
+        (JSC::B3::Air::Inst::forEachDefWithExtraClobberedRegs):
+        (JSC::B3::Air::Inst::reportUsedRegisters):
+        (JSC::B3::Air::Inst::hasSpecial): Deleted.
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirReportUsedRegisters.cpp:
+        (JSC::B3::Air::reportUsedRegisters):
+        * b3/air/opcode_generator.rb:
+
+2016-01-11  Filip Pizlo  <fpizlo@apple.com>
+
+        Turn Check(true) into Patchpoint() followed by Oops
+        https://bugs.webkit.org/show_bug.cgi?id=152968
+
+        Reviewed by Benjamin Poulain.
+
+        This is an obvious strength reduction to have, especially since if we discover that the
+        input to the Check is true after some amount of B3 optimization, then stubbing out the rest
+        of the basic block unlocks CFG simplification opportunities.
+
+        It's also a proof-of-concept for the Check->Patchpoint conversion that I'll use once I
+        implement sinking (bug 152162).
+
+        * b3/B3ControlValue.cpp:
+        (JSC::B3::ControlValue::convertToJump):
+        (JSC::B3::ControlValue::convertToOops):
+        (JSC::B3::ControlValue::dumpMeta):
+        * b3/B3ControlValue.h:
+        * b3/B3InsertionSet.h:
+        (JSC::B3::InsertionSet::insertValue):
+        * b3/B3InsertionSetInlines.h:
+        (JSC::B3::InsertionSet::insert):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3StackmapValue.h:
+        * b3/B3Value.h:
+        * tests/stress/ftl-force-osr-exit.js: Added.
+
+2016-01-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] When resolving Stack arguments, use addressing from SP when addressing from FP is invalid
+        https://bugs.webkit.org/show_bug.cgi?id=152840
+
+        Reviewed by Mark Lam.
+
+        ARM64 has two kinds of addressing with immediates:
+        -Signed 9bits direct (really only -256 to 255).
+        -Unsigned 12bits scaled by the load/store size.
+
+        When resolving the stack addresses, we easily run
+        past -256 bytes from FP. Addressing from SP gives us more
+        room to address the stack efficiently because we can
+        use unsigned immediates.
+
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::repForArg):
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+
+2016-01-10  Saam barati  <sbarati@apple.com>
+
+        Implement a sampling profiler
+        https://bugs.webkit.org/show_bug.cgi?id=151713
+
+        Reviewed by Filip Pizlo.
+
+        This patch implements a sampling profiler for JavaScriptCore
+        that will be used in the Inspector UI. The implementation works as follows:
+        We queue the sampling profiler to run a task on a background
+        thread every 1ms. When the queued task executes, the sampling profiler
+        will pause the JSC execution thread and attempt to take a stack trace. 
+        The sampling profiler does everything it can to be very careful
+        while taking this stack trace. Because it's reading arbitrary memory,
+        the sampling profiler must validate every pointer it reads from.
+
+        The sampling profiler tries to get an ExecutableBase for every call frame
+        it reads. It first tries to read the CodeBlock slot. It does this because
+        it can be 100% certain that a pointer is a CodeBlock while it's taking a
+        stack trace. But, not every call frame will have a CodeBlock. So we must read
+        the call frame's callee. For these stack traces where we read the callee, we
+        must verify the callee pointer, and the pointer traversal to an ExecutableBase,
+        on the main JSC execution thread, and not on the thread taking the stack
+        trace. We do this verification either before we run the marking phase in
+        GC, or when somebody asks the SamplingProfiler to materialize its data.
+
+        The SamplingProfiler must also be careful to not grab any locks while the JSC execution
+        thread is paused (this means it can't do anything that mallocs) because
+        that could cause a deadlock. Therefore, the sampling profiler grabs
+        locks for all data structures it consults before it pauses the JSC
+        execution thread.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
+        (JSC::CodeBlockSet::mark):
+        * dfg/DFGNodeType.h:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::promoteYoungCodeBlocks):
+        (JSC::CodeBlockSet::clearMarksForFullCollection):
+        (JSC::CodeBlockSet::lastChanceToFinalize):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        (JSC::CodeBlockSet::contains):
+        (JSC::CodeBlockSet::writeBarrierCurrentlyExecutingCodeBlocks):
+        (JSC::CodeBlockSet::remove): Deleted.
+        * heap/CodeBlockSet.h:
+        (JSC::CodeBlockSet::getLock):
+        (JSC::CodeBlockSet::iterate):
+        The sampling pofiler uses the heap's CodeBlockSet to validate
+        CodeBlock pointers. This data structure must now be under a lock
+        because we must be certain we're not pausing the JSC execution thread
+        while it's manipulating this data structure.
+
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::grow):
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::genericAddSpan):
+        (JSC::ConservativeRoots::add):
+        (JSC::CompositeMarkHook::CompositeMarkHook):
+        (JSC::CompositeMarkHook::mark):
+        * heap/ConservativeRoots.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::visitHandleStack):
+        (JSC::Heap::visitSamplingProfiler):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        (JSC::Heap::snapshotMarkedSpace):
+        * heap/Heap.h:
+        (JSC::Heap::structureIDTable):
+        (JSC::Heap::codeBlockSet):
+        * heap/MachineStackMarker.cpp:
+        (pthreadSignalHandlerSuspendResume):
+        (JSC::getCurrentPlatformThread):
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::Thread::createForCurrentThread):
+        (JSC::MachineThreads::Thread::operator==):
+        (JSC::isThreadInList):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::machineThreadForCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::MachineThreads::Thread::~Thread):
+        (JSC::MachineThreads::Thread::suspend):
+        (JSC::MachineThreads::Thread::resume):
+        (JSC::MachineThreads::Thread::getRegisters):
+        (JSC::MachineThreads::Thread::Registers::stackPointer):
+        (JSC::MachineThreads::Thread::Registers::framePointer):
+        (JSC::MachineThreads::Thread::Registers::instructionPointer):
+        (JSC::MachineThreads::Thread::freeRegisters):
+        (JSC::MachineThreads::tryCopyOtherThreadStacks):
+        (JSC::pthreadSignalHandlerSuspendResume): Deleted.
+        (JSC::MachineThreads::Thread::operator!=): Deleted.
+        * heap/MachineStackMarker.h:
+        (JSC::MachineThreads::Thread::operator!=):
+        (JSC::MachineThreads::getLock):
+        (JSC::MachineThreads::threadsListHead):
+        We can now ask a MachineThreads::Thread for its frame pointer
+        and program counter on darwin and windows platforms. efl
+        and gtk implementations will happen in another patch.
+
+        * heap/MarkedBlockSet.h:
+        (JSC::MarkedBlockSet::getLock):
+        (JSC::MarkedBlockSet::add):
+        (JSC::MarkedBlockSet::remove):
+        (JSC::MarkedBlockSet::recomputeFilter):
+        (JSC::MarkedBlockSet::filter):
+        (JSC::MarkedBlockSet::set):
+        * heap/MarkedSpace.cpp:
+        (JSC::Free::Free):
+        (JSC::Free::operator()):
+        (JSC::FreeOrShrink::FreeOrShrink):
+        (JSC::FreeOrShrink::operator()):
+        (JSC::MarkedSpace::~MarkedSpace):
+        (JSC::MarkedSpace::isPagedOut):
+        (JSC::MarkedSpace::freeBlock):
+        (JSC::MarkedSpace::freeOrShrinkBlock):
+        (JSC::MarkedSpace::shrink):
+        * heap/MarkedSpace.h:
+        (JSC::MarkedSpace::forEachLiveCell):
+        (JSC::MarkedSpace::forEachDeadCell):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::calleeAsValue):
+        (JSC::ExecState::callee):
+        (JSC::ExecState::unsafeCallee):
+        (JSC::ExecState::codeBlock):
+        (JSC::ExecState::scope):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::dumpProfile):
+        (JSC::ExecutableAllocator::getLock):
+        (JSC::ExecutableAllocator::isValidExecutableMemory):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        (JSC::ExecutableAllocator::isValidExecutableMemory):
+        (JSC::ExecutableAllocator::getLock):
+        (JSC::ExecutableAllocator::committedByteCount):
+        The sampling profiler consults the ExecutableAllocator to check
+        if the frame pointer it reads is in executable allocated memory.
+
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionCheckModuleSyntax):
+        (functionStartSamplingProfiler):
+        (functionSamplingProfilerStackTraces):
+        * llint/LLIntPCRanges.h: Added.
+        (JSC::LLInt::isLLIntPC):
+        * offlineasm/asm.rb:
+        I added the ability to test whether the PC is executing
+        LLInt code because this code is not part of the memory
+        our executable allocator allocates.
+
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::isModuleProgramExecutable):
+        (JSC::ExecutableBase::isExecutableType):
+        (JSC::ExecutableBase::isHostFunction):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::didAcquireLock):
+        (JSC::JSLock::unlock):
+        * runtime/Options.h:
+        * runtime/SamplingProfiler.cpp: Added.
+        (JSC::reportStats):
+        (JSC::FrameWalker::FrameWalker):
+        (JSC::FrameWalker::walk):
+        (JSC::FrameWalker::wasValidWalk):
+        (JSC::FrameWalker::advanceToParentFrame):
+        (JSC::FrameWalker::isAtTop):
+        (JSC::FrameWalker::resetAtMachineFrame):
+        (JSC::FrameWalker::isValidFramePointer):
+        (JSC::FrameWalker::isValidCodeBlock):
+        (JSC::FrameWalker::tryToGetExecutableFromCallee):
+        The FrameWalker class is used to walk the stack in a safe
+        manner. It doesn't do anything that would deadlock, and it
+        validates all pointers that it sees.
+
+        (JSC::SamplingProfiler::SamplingProfiler):
+        (JSC::SamplingProfiler::~SamplingProfiler):
+        (JSC::SamplingProfiler::visit):
+        (JSC::SamplingProfiler::shutdown):
+        (JSC::SamplingProfiler::start):
+        (JSC::SamplingProfiler::stop):
+        (JSC::SamplingProfiler::pause):
+        (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
+        (JSC::SamplingProfiler::dispatchIfNecessary):
+        (JSC::SamplingProfiler::dispatchFunction):
+        (JSC::SamplingProfiler::noticeJSLockAcquisition):
+        (JSC::SamplingProfiler::noticeVMEntry):
+        (JSC::SamplingProfiler::observeStackTrace):
+        (JSC::SamplingProfiler::clearData):
+        (JSC::displayName):
+        (JSC::startLine):
+        (JSC::startColumn):
+        (JSC::sourceID):
+        (JSC::url):
+        (JSC::SamplingProfiler::stacktracesAsJSON):
+        * runtime/SamplingProfiler.h: Added.
+        (JSC::SamplingProfiler::getLock):
+        (JSC::SamplingProfiler::setTimingInterval):
+        (JSC::SamplingProfiler::stackTraces):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        (JSC::VM::setLastStackTop):
+        (JSC::VM::createContextGroup):
+        (JSC::VM::ensureWatchdog):
+        (JSC::VM::ensureSamplingProfiler):
+        (JSC::thunkGeneratorForIntrinsic):
+        * runtime/VM.h:
+        (JSC::VM::watchdog):
+        (JSC::VM::isSafeToRecurse):
+        (JSC::VM::lastStackTop):
+        (JSC::VM::scratchBufferForSize):
+        (JSC::VM::samplingProfiler):
+        (JSC::VM::setShouldRewriteConstAsVar):
+        (JSC::VM::setLastStackTop): Deleted.
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        * tests/stress/sampling-profiler: Added.
+        * tests/stress/sampling-profiler-anonymous-function.js: Added.
+        (foo):
+        (baz):
+        * tests/stress/sampling-profiler-basic.js: Added.
+        (bar):
+        (foo):
+        (nothing):
+        (top):
+        (jaz):
+        (kaz):
+        (checkInlining):
+        * tests/stress/sampling-profiler-deep-stack.js: Added.
+        (foo):
+        (hellaDeep):
+        (start):
+        * tests/stress/sampling-profiler-microtasks.js: Added.
+        (testResults):
+        (loop.jaz):
+        (loop):
+        * tests/stress/sampling-profiler/samplingProfiler.js: Added.
+        (assert):
+        (let.nodePrototype.makeChildIfNeeded):
+        (makeNode):
+        (updateCallingContextTree):
+        (doesTreeHaveStackTrace):
+        (makeTree):
+        (runTest):
+        (dumpTree):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::isInObjectSpace):
+        (JSC::JSDollarVMPrototype::isInStorageSpace):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generateEnter):
+        (JSC::Yarr::YarrGenerator::generateReturn):
+        (JSC::Yarr::YarrGenerator::YarrGenerator):
+        (JSC::Yarr::YarrGenerator::compile):
+        (JSC::Yarr::jitCompile):
+        We now have a boolean that's set to true when
+        we're executing a RegExp, and to false otherwise.
+        The boolean lives off of VM.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::clearVisitWeaklyHasBeenCalled):
+        (JSC::CodeBlockSet::mark):
+        * dfg/DFGNodeType.h:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::add):
+        (JSC::CodeBlockSet::promoteYoungCodeBlocks):
+        (JSC::CodeBlockSet::clearMarksForFullCollection):
+        (JSC::CodeBlockSet::lastChanceToFinalize):
+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
+        (JSC::CodeBlockSet::contains):
+        (JSC::CodeBlockSet::writeBarrierCurrentlyExecutingCodeBlocks):
+        (JSC::CodeBlockSet::remove): Deleted.
+        * heap/CodeBlockSet.h:
+        (JSC::CodeBlockSet::getLock):
+        (JSC::CodeBlockSet::iterate):
+        * heap/ConservativeRoots.cpp:
+        (JSC::ConservativeRoots::ConservativeRoots):
+        (JSC::ConservativeRoots::genericAddPointer):
+        (JSC::ConservativeRoots::add):
+        (JSC::CompositeMarkHook::CompositeMarkHook):
+        (JSC::CompositeMarkHook::mark):
+        * heap/ConservativeRoots.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::visitHandleStack):
+        (JSC::Heap::visitSamplingProfiler):
+        (JSC::Heap::traceCodeBlocksAndJITStubRoutines):
+        * heap/Heap.h:
+        (JSC::Heap::structureIDTable):
+        (JSC::Heap::codeBlockSet):
+        * heap/HeapInlines.h:
+        (JSC::Heap::didFreeBlock):
+        (JSC::Heap::isPointerGCObject):
+        (JSC::Heap::isValueGCObject):
+        * heap/MachineStackMarker.cpp:
+        (pthreadSignalHandlerSuspendResume):
+        (JSC::getCurrentPlatformThread):
+        (JSC::MachineThreads::MachineThreads):
+        (JSC::MachineThreads::~MachineThreads):
+        (JSC::MachineThreads::Thread::createForCurrentThread):
+        (JSC::MachineThreads::Thread::operator==):
+        (JSC::isThreadInList):
+        (JSC::MachineThreads::addCurrentThread):
+        (JSC::MachineThreads::machineThreadForCurrentThread):
+        (JSC::MachineThreads::removeThread):
+        (JSC::MachineThreads::gatherFromCurrentThread):
+        (JSC::MachineThreads::Thread::Thread):
+        (JSC::MachineThreads::Thread::~Thread):
+        (JSC::MachineThreads::Thread::suspend):
+        (JSC::MachineThreads::Thread::resume):
+        (JSC::MachineThreads::Thread::getRegisters):
+        (JSC::MachineThreads::Thread::Registers::stackPointer):
+        (JSC::MachineThreads::Thread::Registers::framePointer):
+        (JSC::MachineThreads::Thread::Registers::instructionPointer):
+        (JSC::MachineThreads::Thread::freeRegisters):
+        (JSC::pthreadSignalHandlerSuspendResume): Deleted.
+        (JSC::MachineThreads::Thread::operator!=): Deleted.
+        * heap/MachineStackMarker.h:
+        (JSC::MachineThreads::Thread::operator!=):
+        (JSC::MachineThreads::getLock):
+        (JSC::MachineThreads::threadsListHead):
+        * heap/MarkedBlockSet.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::Free::Free):
+        (JSC::Free::operator()):
+        (JSC::FreeOrShrink::FreeOrShrink):
+        (JSC::FreeOrShrink::operator()):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::calleeAsValue):
+        (JSC::ExecState::callee):
+        (JSC::ExecState::unsafeCallee):
+        (JSC::ExecState::codeBlock):
+        (JSC::ExecState::scope):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::dumpProfile):
+        (JSC::ExecutableAllocator::getLock):
+        (JSC::ExecutableAllocator::isValidExecutableMemory):
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::allocate):
+        (JSC::ExecutableAllocator::isValidExecutableMemory):
+        (JSC::ExecutableAllocator::getLock):
+        (JSC::ExecutableAllocator::committedByteCount):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionCheckModuleSyntax):
+        (functionPlatformSupportsSamplingProfiler):
+        (functionStartSamplingProfiler):
+        (functionSamplingProfilerStackTraces):
+        * llint/LLIntPCRanges.h: Added.
+        (JSC::LLInt::isLLIntPC):
+        * offlineasm/asm.rb:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::isModuleProgramExecutable):
+        (JSC::ExecutableBase::isExecutableType):
+        (JSC::ExecutableBase::isHostFunction):
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::didAcquireLock):
+        (JSC::JSLock::unlock):
+        * runtime/Options.h:
+        * runtime/SamplingProfiler.cpp: Added.
+        (JSC::reportStats):
+        (JSC::FrameWalker::FrameWalker):
+        (JSC::FrameWalker::walk):
+        (JSC::FrameWalker::wasValidWalk):
+        (JSC::FrameWalker::advanceToParentFrame):
+        (JSC::FrameWalker::isAtTop):
+        (JSC::FrameWalker::resetAtMachineFrame):
+        (JSC::FrameWalker::isValidFramePointer):
+        (JSC::FrameWalker::isValidCodeBlock):
+        (JSC::SamplingProfiler::SamplingProfiler):
+        (JSC::SamplingProfiler::~SamplingProfiler):
+        (JSC::SamplingProfiler::processUnverifiedStackTraces):
+        (JSC::SamplingProfiler::visit):
+        (JSC::SamplingProfiler::shutdown):
+        (JSC::SamplingProfiler::start):
+        (JSC::SamplingProfiler::stop):
+        (JSC::SamplingProfiler::pause):
+        (JSC::SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread):
+        (JSC::SamplingProfiler::dispatchIfNecessary):
+        (JSC::SamplingProfiler::dispatchFunction):
+        (JSC::SamplingProfiler::noticeJSLockAcquisition):
+        (JSC::SamplingProfiler::noticeVMEntry):
+        (JSC::SamplingProfiler::clearData):
+        (JSC::displayName):
+        (JSC::SamplingProfiler::stacktracesAsJSON):
+        (WTF::printInternal):
+        * runtime/SamplingProfiler.h: Added.
+        (JSC::SamplingProfiler::StackFrame::StackFrame):
+        (JSC::SamplingProfiler::getLock):
+        (JSC::SamplingProfiler::setTimingInterval):
+        (JSC::SamplingProfiler::stackTraces):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::~VM):
+        (JSC::VM::setLastStackTop):
+        (JSC::VM::createContextGroup):
+        (JSC::VM::ensureWatchdog):
+        (JSC::VM::ensureSamplingProfiler):
+        (JSC::thunkGeneratorForIntrinsic):
+        * runtime/VM.h:
+        (JSC::VM::watchdog):
+        (JSC::VM::samplingProfiler):
+        (JSC::VM::isSafeToRecurse):
+        (JSC::VM::lastStackTop):
+        (JSC::VM::scratchBufferForSize):
+        (JSC::VM::setLastStackTop): Deleted.
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        * tests/stress/sampling-profiler: Added.
+        * tests/stress/sampling-profiler-anonymous-function.js: Added.
+        (platformSupportsSamplingProfiler.foo):
+        (platformSupportsSamplingProfiler.baz):
+        (platformSupportsSamplingProfiler):
+        * tests/stress/sampling-profiler-basic.js: Added.
+        (platformSupportsSamplingProfiler.bar):
+        (platformSupportsSamplingProfiler.foo):
+        (platformSupportsSamplingProfiler.nothing):
+        (platformSupportsSamplingProfiler.top):
+        (platformSupportsSamplingProfiler.jaz):
+        (platformSupportsSamplingProfiler.kaz):
+        (platformSupportsSamplingProfiler.checkInlining):
+        (platformSupportsSamplingProfiler):
+        * tests/stress/sampling-profiler-deep-stack.js: Added.
+        (platformSupportsSamplingProfiler.foo):
+        (platformSupportsSamplingProfiler.let.hellaDeep):
+        (platformSupportsSamplingProfiler.let.start):
+        (platformSupportsSamplingProfiler):
+        * tests/stress/sampling-profiler-microtasks.js: Added.
+        (platformSupportsSamplingProfiler.testResults):
+        (platformSupportsSamplingProfiler):
+        (platformSupportsSamplingProfiler.loop.jaz):
+        (platformSupportsSamplingProfiler.loop):
+        * tests/stress/sampling-profiler/samplingProfiler.js: Added.
+        (assert):
+        (let.nodePrototype.makeChildIfNeeded):
+        (makeNode):
+        (updateCallingContextTree):
+        (doesTreeHaveStackTrace):
+        (makeTree):
+        (runTest):
+        (dumpTree):
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generateEnter):
+        (JSC::Yarr::YarrGenerator::generateReturn):
+        (JSC::Yarr::YarrGenerator::YarrGenerator):
+        (JSC::Yarr::YarrGenerator::compile):
+        (JSC::Yarr::jitCompile):
+
+2016-01-10  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Iterating over a Set/Map is too slow
+        https://bugs.webkit.org/show_bug.cgi?id=152691
+
+        Reviewed by Saam Barati.
+
+        Set#forEach and Set & for-of are very slow. There are 2 reasons.
+
+        1. forEach is implemented in C++. And typically, taking JS callback and calling it from C++.
+
+        C++ to JS transition seems costly. perf result in Linux machine shows this.
+
+            Samples: 23K of event 'cycles', Event count (approx.): 21446074385
+            34.04%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::Interpreter::execute(JSC::CallFrameClosure&)
+            20.48%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] vmEntryToJavaScript
+             9.80%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
+             7.95%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::setProtoFuncForEach(JSC::ExecState*)
+             5.65%  jsc  perf-22854.map                      [.] 0x00007f5d2c204a6f
+
+        Writing forEach in JS eliminates this.
+
+            Samples: 23K of event 'cycles', Event count (approx.): 21255691651
+            62.91%  jsc  perf-22890.map                      [.] 0x00007fd117c0a3b9
+            24.89%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::privateFuncSetIteratorNext(JSC::ExecState*)
+             0.29%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::CodeBlock::updateAllPredictionsAndCountLiveness(unsigned int&, unsigned int&)
+             0.24%  jsc  [vdso]                              [.] 0x00000000000008e8
+             0.22%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::CodeBlock::predictedMachineCodeSize()
+             0.16%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] WTF::MetaAllocator::currentStatistics()
+             0.15%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::Lexer<unsigned char>::lex(JSC::JSToken*, unsigned int, bool)
+
+        2. Iterator result object allocation is costly.
+
+        Iterator result object allocation is costly. Even if the (1) is solved, when executing Set & for-of, perf result shows very slow performance due to (2).
+
+            Samples: 108K of event 'cycles', Event count (approx.): 95529273748
+            18.02%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::createIteratorResultObject(JSC::ExecState*, JSC::JSValue, bool)
+            15.68%  jsc  jsc                                 [.] JSC::JSObject::putDirect(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int)
+            14.18%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::PrototypeMap::emptyObjectStructureForPrototype(JSC::JSObject*, unsigned int)
+            13.40%  jsc  perf-25420.map                      [.] 0x00007fce158006a1
+             6.79%  jsc  libjavascriptcoregtk-4.0.so.18.3.1  [.] JSC::StructureTransitionTable::get(WTF::UniquedStringImpl*, unsigned int) const
+
+        In the long term, we should implement SetIterator#next in JS and make the iterator result object allocation written in JS to encourage object allocation elimination in FTL.
+        But seeing the perf result, we can find the easy to fix bottleneck in the current implementation.
+        Every time createIteratorResultObject creates the empty object and use putDirect to store properties.
+        The pre-baked Structure* with `done` and `value` properties makes this implementation fast.
+
+        After these improvements, the micro benchmark[1] shows the following.
+
+        old:
+            Linked List x 212,776 ops/sec ±0.21% (162 runs sampled)
+            Array x 376,156 ops/sec ±0.20% (162 runs sampled)
+            Array forEach x 17,345 ops/sec ±0.99% (137 runs sampled)
+            Array for-of x 16,518 ops/sec ±0.58% (160 runs sampled)
+            Set forEach x 13,263 ops/sec ±0.20% (162 runs sampled)
+            Set for-of x 4,732 ops/sec ±0.34% (123 runs sampled)
+
+        new:
+            Linked List x 210,833 ops/sec ±0.28% (161 runs sampled)
+            Array x 371,347 ops/sec ±0.36% (162 runs sampled)
+            Array forEach x 17,460 ops/sec ±0.84% (136 runs sampled)
+            Array for-of x 16,188 ops/sec ±1.27% (158 runs sampled)
+            Set forEach x 23,684 ops/sec ±2.46% (139 runs sampled)
+            Set for-of x 12,176 ops/sec ±0.54% (157 runs sampled)
+
+        Set#forEach becomes comparable to Array#forEach. And Set#forEach and Set & for-of are improved (1.79x, and 2.57x).
+        After this optimizations, they are still much slower than linked list and array.
+        This should be optimized in the long term.
+
+        [1]: https://gist.github.com/Constellation/8db5f5b8f12fe7e283d0
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/MapPrototype.js: Copied from Source/JavaScriptCore/runtime/IteratorOperations.h.
+        (forEach):
+        * builtins/SetPrototype.js: Copied from Source/JavaScriptCore/runtime/IteratorOperations.h.
+        (forEach):
+        * runtime/CommonIdentifiers.h:
+        * runtime/IteratorOperations.cpp:
+        (JSC::createIteratorResultObjectStructure):
+        (JSC::createIteratorResultObject):
+        * runtime/IteratorOperations.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::iteratorResultObjectStructure):
+        (JSC::JSGlobalObject::iteratorResultStructure): Deleted.
+        (JSC::JSGlobalObject::iteratorResultStructureOffset): Deleted.
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::getOwnPropertySlot):
+        (JSC::privateFuncIsMap):
+        (JSC::privateFuncMapIterator):
+        (JSC::privateFuncMapIteratorNext):
+        (JSC::MapPrototype::finishCreation): Deleted.
+        (JSC::mapProtoFuncForEach): Deleted.
+        * runtime/MapPrototype.h:
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::getOwnPropertySlot):
+        (JSC::privateFuncIsSet):
+        (JSC::privateFuncSetIterator):
+        (JSC::privateFuncSetIteratorNext):
+        (JSC::SetPrototype::finishCreation): Deleted.
+        (JSC::setProtoFuncForEach): Deleted.
+        * runtime/SetPrototype.h:
+
+2016-01-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix ARM64 build.
+
+        * b3/air/AirOpcode.opcodes:
+
+2016-01-10  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should reduce Trunc(BitOr(value, constant)) where !(constant & 0xffffffff) to Trunc(value)
+        https://bugs.webkit.org/show_bug.cgi?id=152955
+
+        Reviewed by Saam Barati.
+
+        This happens when we box an int32 and then immediately unbox it.
+
+        This makes an enormous difference on AsmBench/FloatMM. It's a 2x speed-up on that
+        benchmark. It's neutral elsewhere.
+
+        * b3/B3ReduceStrength.cpp:
+        * b3/testb3.cpp:
+        (JSC::B3::testPowDoubleByIntegerLoop):
+        (JSC::B3::testTruncOrHigh):
+        (JSC::B3::testTruncOrLow):
+        (JSC::B3::testBitAndOrHigh):
+        (JSC::B3::testBitAndOrLow):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+
+2016-01-10  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Get rid of JSArrowFunction and use standard JSFunction class
+        https://bugs.webkit.org/show_bug.cgi?id=149855
+
+        Reviewed by Saam Barati.
+
+        JSArrowFunction.h/cpp were removed from JavaScriptCore, because now is used new approach for storing 
+        'this', 'arguments' and 'super'
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLAbstractHeapRepository.cpp:
+        * ftl/FTLAbstractHeapRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+        * jit/JITOpcodes.cpp:
+        * jit/JITOpcodes32_64.cpp:
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        * runtime/JSArrowFunction.cpp: Removed.
+        * runtime/JSArrowFunction.h: Removed.
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+
+2016-01-10  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to run liveness over registers without also tracking Tmps
+        https://bugs.webkit.org/show_bug.cgi?id=152963
+
+        Reviewed by Saam Barati.
+
+        This adds a RegLivenessAdapter so that we can run Liveness over registers. This makes it
+        easier to write certain kinds of phases, like ReportUsedRegisters. I anticipate writing more
+        code like that for handling cold function calls. It also makes code like that somewhat more
+        scalable, since we're no longer using HashSets.
+
+        Currently, the way we track sets of registers is with a BitVector. Normally, we use the
+        RegisterSet class, which wraps BitVector, so that we can add()/contains() on Reg's. But in
+        the liveness analysis, everything gets turned into an index. So, we want to use BitVector
+        directly. To do that, I needed to make the BitVector API look a bit more like a set API. I
+        think that this is good, because the lack of set methods (add/remove/contains) has caused
+        bugs in the past. This makes BitVector have methods both for set operations on bits and array
+        operations on bits. I think that's good, since BitVector gets used in both contexts.
+
+        * b3/B3IndexSet.h:
+        (JSC::B3::IndexSet::Iterable::iterator::iterator):
+        (JSC::B3::IndexSet::Iterable::begin):
+        (JSC::B3::IndexSet::dump):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::ForEach<Tmp>::forEach):
+        (JSC::B3::Air::ForEach<Arg>::forEach):
+        (JSC::B3::Air::ForEach<Reg>::forEach):
+        (JSC::B3::Air::Inst::forEach):
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::RegLivenessAdapter::RegLivenessAdapter):
+        (JSC::B3::Air::RegLivenessAdapter::maxIndex):
+        (JSC::B3::Air::RegLivenessAdapter::acceptsType):
+        (JSC::B3::Air::RegLivenessAdapter::valueToIndex):
+        (JSC::B3::Air::RegLivenessAdapter::indexToValue):
+        * b3/air/AirReportUsedRegisters.cpp:
+        (JSC::B3::Air::reportUsedRegisters):
+        * jit/Reg.h:
+        (JSC::Reg::next):
+        (JSC::Reg::index):
+        (JSC::Reg::maxIndex):
+        (JSC::Reg::isSet):
+        (JSC::Reg::operator bool):
+        * jit/RegisterSet.h:
+        (JSC::RegisterSet::forEach):
+
+2016-01-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Make branchMul functional in ARM B3 and minor fixes
+        https://bugs.webkit.org/show_bug.cgi?id=152889
+
+        Reviewed by Mark Lam.
+
+        ARM64 does not have a "S" version of MUL setting the flags.
+        What we do is abstract that in the MacroAssembler. The problem
+        is that form requires scratch registers.
+
+        For simplicity, I just exposed the two scratch registers
+        for Air. Filip already added the concept of Scratch role,
+        all I needed was to expose it for opcodes.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::branchMul32):
+        (JSC::MacroAssemblerARM64::branchMul64):
+        Expose a version with the scratch registers as arguments.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        Add the new form of CheckMul lowering.
+
+        * b3/air/AirOpcode.opcodes:
+        Expose the new BranchMuls.
+        Remove all the Test variants that use immediates
+        since Air can't handle those immediates correctly yet.
+
+        * b3/air/opcode_generator.rb:
+        Expose the Scratch role.
+
+        * b3/testb3.cpp:
+        (JSC::B3::testPatchpointLotsOfLateAnys):
+        Ooops, the scratch registers were not clobbered. We were just lucky
+        on x86.
+
+2016-01-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] B3 is unable to do function calls on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=152895
+
+        Reviewed by Mark Lam.
+
+        Apparently iOS does not follow the ARM64 ABI for function calls.
+        Instead of giving each value a 8 bytes slot, it must be packed
+        while preserving alignment.
+
+        This patch adds a #ifdef to make function calls functional.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::marshallCCallArgument):
+        (JSC::B3::Air::LowerToAir::lower):
+
+2016-01-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Air should support Branch64 with immediates
+        https://bugs.webkit.org/show_bug.cgi?id=152951
+
+        Reviewed by Oliver Hunt.
+
+        This doesn't significantly improve performance on any benchmarks, but it's great to get this
+        obvious omission out of the way.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::branch64):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testPowDoubleByIntegerLoop):
+        (JSC::B3::testBranch64Equal):
+        (JSC::B3::testBranch64EqualImm):
+        (JSC::B3::testBranch64EqualMem):
+        (JSC::B3::testBranch64EqualMemImm):
+        (JSC::B3::zero):
+        (JSC::B3::run):
+
+2016-01-09  Dan Bernstein  <mitz@apple.com>
+
+        [Cocoa] Allow overriding the frameworks directory independently of using a staging install path
+        https://bugs.webkit.org/show_bug.cgi?id=152926
+
+        Reviewed by Tim Horton.
+
+        Introduce a new build setting, WK_OVERRIDE_FRAMEWORKS_DIR. When not empty, it determines
+        where the frameworks are installed. Setting USE_STAGING_INSTALL_PATH to YES sets
+        WK_OVERRIDE_FRAMEWORKS_DIR to $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari.
+
+        Account for the possibility of WK_OVERRIDE_FRAMEWORKS_DIR containing spaces.
+
+        * Configurations/Base.xcconfig:
+        - Replace STAGED_FRAMEWORKS_SEARCH_PATH in FRAMEWORK_SEARCH_PATHS with
+          WK_OVERRIDE_FRAMEWORKS_DIR and add quotes to account for spaces.
+        - Define JAVASCRIPTCORE_FRAMEWORKS_DIR based on WK_OVERRIDE_FRAMEWORKS_DIR.
+        * Configurations/JSC.xcconfig:
+          Add quotes to account for spaces.
+        * Configurations/ToolExecutable.xcconfig:
+          Ditto.
+        * postprocess-headers.sh:
+          Ditto.
+
+2016-01-09  Mark Lam  <mark.lam@apple.com>
+
+        The FTL allocated spill slots for BinaryOps is sometimes inaccurate.
+        https://bugs.webkit.org/show_bug.cgi?id=152918
+
+        Reviewed by Filip Pizlo and Saam Barati.
+
+        * ftl/FTLCompile.cpp:
+        - Updated a comment.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        - The code to compute maxNumberOfCatchSpills was unnecessarily allocating an
+          extra slot for BinaryOps that don't have Untyped operands, and failing to
+          allocate that extra slot for some binary ops.  This is now fixed.
+
+        * tests/stress/ftl-shr-exception.js:
+        * tests/stress/ftl-xor-exception.js:
+        - Un-skipped these tests.  They now pass with this patch.
+
+2016-01-09  Andreas Kling  <akling@apple.com>
+
+        Use NeverDestroyed instead of DEPRECATED_DEFINE_STATIC_LOCAL
+        <https://webkit.org/b/152902>
+
+        Reviewed by Anders Carlsson.
+
+        Mostly mechanical conversion to NeverDestroyed throughout JavaScriptCore.
+
+        * API/JSAPIWrapperObject.mm:
+        (jsAPIWrapperObjectHandleOwner):
+        * API/JSManagedValue.mm:
+        (managedValueHandleOwner):
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::objectGroupForBreakpointAction):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::allocators):
+
+2016-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do varargs tail calls and stack overflows
+        https://bugs.webkit.org/show_bug.cgi?id=152934
+
+        Reviewed by Saam Barati.
+
+        I was trying to get tail-call-varargs-no-stack-overflow.js.ftl-no-cjit-validate to work and
+        at first I hit the stack overflow issue and then I hit the varargs tail call issue. That's
+        why I have two fixes in one change. Now the test passes.
+
+        This reduces the number of failures from 13 to 0.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower): Implement stack overflow handling.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs): Varargs tail calls need to
+        append an Oops (i.e. "unreachable").
+
+2016-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 needs Neg()
+        https://bugs.webkit.org/show_bug.cgi?id=152925
+
+        Reviewed by Mark Lam.
+
+        Previously we said that negation should be represented as Sub(0, x). That's wrong, since
+        for floats, Sub(0, 0) == 0 while Neg(0) == -0.
+
+        One way to solve this would be to say that anyone trying to say Neg(x) where x is a float
+        should instead say BitXor(x, -0). That's actually correct, but I think that it would be odd
+        to use bitops to represent floating point operations. Whatever cuteness this would have
+        bought us would be outweighed by the annoyance of having to write code that matches
+        Sub(0, x) for integer negation and BitXor(x, -0) for double negation. For example, this
+        would mean strictly more code for anyone implementing a Neg(Neg(x))=>x strength reduction.
+        Also, I suspect that the omission of Neg would cause others to make the mistake of using
+        Sub to represent floating point negation.
+
+        So, this introduces a proper Neg() opcode to B3. It's now the canonical way of saying
+        negation for both ints and floats. For ints, we canonicalize Sub(0, x) to Neg(x). For
+        floats, we lower it to BitXor(x, -0) on x86.
+
+        This reduces the number of failures from 13 to 12.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::andFloat):
+        (JSC::MacroAssemblerX86Common::xorDouble):
+        (JSC::MacroAssemblerX86Common::xorFloat):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        * b3/B3LowerMacrosAfterOptimizations.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/air/AirOpcode.opcodes:
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::lockedStackSlot):
+        (JSC::FTL::Output::neg):
+        (JSC::FTL::Output::bitNot):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::chillDiv):
+        (JSC::FTL::Output::mod):
+        (JSC::FTL::Output::chillMod):
+        (JSC::FTL::Output::doubleAdd):
+        (JSC::FTL::Output::doubleSub):
+        (JSC::FTL::Output::doubleMul):
+        (JSC::FTL::Output::doubleDiv):
+        (JSC::FTL::Output::doubleMod):
+        (JSC::FTL::Output::doubleNeg):
+        (JSC::FTL::Output::bitAnd):
+        (JSC::FTL::Output::bitOr):
+        (JSC::FTL::Output::neg): Deleted.
+        * tests/stress/ftl-negate-zero.js: Added. This was already covered by op_negate but since
+        it's such a glaring bug, I thought having a test for it specifically would be good.
+
+2016-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 compile() doesn't clear exception handlers before we add FTL-specific ones
+        https://bugs.webkit.org/show_bug.cgi?id=152922
+
+        Reviewed by Saam Barati.
+
+        FTL B3 was generating a handler table that first contained the old baseline handlers keyed
+        by baseline's bytecode indices and then the FTL handlers keyed by FTL callsite index. That's
+        wrong, since the FTL code block should not contain any baseline handlers. The fix is to
+        clear the handlers before generation, sort of like FTL LLVM does.
+
+        Also added some stuff to make it easier to inspect the handler table.
+
+        This reduces the numbe rof failures from 25 to 13.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::dumpExceptionHandlers):
+        (JSC::CodeBlock::beginDumpProfiling):
+        * bytecode/CodeBlock.h:
+        * ftl/FTLB3Compile.cpp:
+        (JSC::FTL::compile):
+
+2016-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 incorrectly turns NotEqual(bool, 1) into Equal(bool, 1) instead of Equal(bool, 0)
+        https://bugs.webkit.org/show_bug.cgi?id=152916
+
+        Reviewed by Mark Lam.
+
+        This was causing a failure in an ancient DFG layout test. Thanks, ftl-eager-no-cjit!
+
+        This reduces the number of failures from 27 to 25.
+
+        * b3/B3ReduceStrength.cpp:
+
+2016-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 allocateCell() should not crash
+        https://bugs.webkit.org/show_bug.cgi?id=152909
+
+        Reviewed by Mark Lam.
+
+        This code was crashing in some tests that forced GC slow paths because it was stubbed out
+        due to the use of undef. B3 doesn't have undef. In this case, there's no good reason to use
+        undef. We can just use zero. Since the path is dead anyway in that case, we weren't gaining
+        any LLVM optimizations by using undef.
+
+        This reduces the number of failures from 35 to 27.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
+
+2016-01-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 fails to realize that binary snippets might choose to omit their fast path
+        https://bugs.webkit.org/show_bug.cgi?id=152901
+
+        Reviewed by Mark Lam.
+
+        This reduces the number of failures from 99 to 35.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
+
+2016-01-08  Saam barati  <sbarati@apple.com>
+
+        restoreCalleeSavesFromVMCalleeSavesBuffer should use the scratch register
+        https://bugs.webkit.org/show_bug.cgi?id=152879
+
+        Reviewed by Filip Pizlo.
+
+        We were clobbering a register we needed when picking
+        a scratch register inside an FTL OSR Exit.
+
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrEntryThunkGenerator):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitRandomThunk):
+        (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::copyCalleeSavesFromFrameOrRegisterToVMCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::restoreCalleeSavesFromVMCalleeSavesBuffer): Deleted.
+        * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js:
+        (foo):
+
+2016-01-08  Mark Lam  <mark.lam@apple.com>
+
+        Rolling out: Rename StringFromCharCode to StringFromSingleCharCode.
+        https://bugs.webkit.org/show_bug.cgi?id=152897
+
+        Not reviewed.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileFromCharCode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC::stringFromSingleCharCode): Deleted.
+        * runtime/StringConstructor.h:
+
+2016-01-08  Per Arne Vollan  <peavo@outlook.com>
+
+        [JSC] Use std::call_once instead of pthread_once when initializing LLVM.
+        https://bugs.webkit.org/show_bug.cgi?id=152893
+
+        Reviewed by Mark Lam.
+
+        Use std::call_once since pthreads is not present on all platforms.
+
+        * llvm/InitializeLLVM.cpp:
+        (JSC::initializeLLVMImpl):
+        (JSC::initializeLLVM):
+
+2016-01-08  Mark Lam  <mark.lam@apple.com>
+
+        Rename StringFromCharCode to StringFromSingleCharCode.
+        https://bugs.webkit.org/show_bug.cgi?id=152897
+
+        Reviewed by Daniel Bates.
+
+        StringFromSingleCharCode is a better name because the intrinsic it represents
+        only applies when we are converting from a single char code.  This is purely
+        a refactoring patch.  There is no semantic change.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileFromCharCode):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC::stringFromSingleCharCode):
+        * runtime/StringConstructor.h:
+
+2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Fixed unused parameter warnings
+        https://bugs.webkit.org/show_bug.cgi?id=152885
+
+        Reviewed by Mark Lam.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Max value of immediate arg of logical ops is 0xffff
+        https://bugs.webkit.org/show_bug.cgi?id=152884
+
+        Reviewed by Michael Saboff.
+
+        Replaced imm.m_value < 65535 checks with imm.m_value <= 65535
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::and32):
+        (JSC::MacroAssemblerMIPS::or32):
+
+2016-01-08  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Add new or32 implementation after r194613
+        https://bugs.webkit.org/show_bug.cgi?id=152865
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::or32):
+
+2016-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 lazy slow paths should do exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=152853
+
+        Reviewed by Saam Barati.
+
+        This reduces the number of JSC test failures to 97.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        * tests/stress/ftl-new-negative-array-size.js: Added.
+        (foo):
+
+2016-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, skip more tests that fail.
+
+        * tests/stress/ftl-shr-exception.js:
+        (foo):
+        * tests/stress/ftl-xor-exception.js:
+        (foo):
+
+2016-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 binary snippets should do exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=152852
+
+        Reviewed by Saam Barati.
+
+        This reduces the number of JSC test failures to 110.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinaryBitOpSnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
+        * tests/stress/ftl-shr-exception.js: Added.
+        (foo):
+        (result.foo.valueOf):
+        * tests/stress/ftl-sub-exception.js: Added.
+        (foo):
+        (result.foo.valueOf):
+        * tests/stress/ftl-xor-exception.js: Added.
+        (foo):
+        (result.foo.valueOf):
+
+2016-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, skipping this test. Looks like LLVM can't handle this one, either.
+
+        * tests/stress/ftl-call-varargs-bad-args-exception-interesting-live-state.js:
+        (foo):
+
+2016-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, skipping this test. Looks like LLVM can't handle it.
+
+        * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js:
+        (foo):
+
+2016-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 JS calls should do exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=152851
+
+        Reviewed by Geoffrey Garen.
+
+        This reduces the number of JSC test failures with FTL B3 to 111.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        * tests/stress/ftl-call-bad-args-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-call-bad-callee-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-call-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-call-exception-no-catch.js: Added.
+        * tests/stress/ftl-call-exception.js: Added.
+        * tests/stress/ftl-call-varargs-bad-callee-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-call-varargs-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-call-varargs-exception-no-catch.js: Added.
+        * tests/stress/ftl-call-varargs-exception.js: Added.
+
+2016-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 PutById should do exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=152850
+
+        Reviewed by Saam Barati.
+
+        Implemented PutById exception handling by following the idiom used in GetById. Reduces the
+        number of JSC test failures to 128.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        * tests/stress/ftl-put-by-id-setter-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-put-by-id-setter-exception-no-catch.js: Added.
+        * tests/stress/ftl-put-by-id-setter-exception.js: Added.
+        * tests/stress/ftl-put-by-id-slow-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-put-by-id-slow-exception-no-catch.js: Added.
+        * tests/stress/ftl-put-by-id-slow-exception.js: Added.
+
+2016-01-07  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r194714.
+        https://bugs.webkit.org/show_bug.cgi?id=152864
+
+        it broke many JSC tests when FTL B3 is enabled (Requested by
+        pizlo on #webkit).
+
+        Reverted changeset:
+
+        "[JSC] When resolving Stack arguments, use addressing from SP
+        when addressing from FP is invalid"
+        https://bugs.webkit.org/show_bug.cgi?id=152840
+        http://trac.webkit.org/changeset/194714
+
+2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Lower immediates of logical operations.
+        https://bugs.webkit.org/show_bug.cgi?id=152693
+
+        On MIPS immediate operands of andi, ori, and xori are required to be 16-bit
+        non-negative numbers.
+
+        Reviewed by Michael Saboff.
+
+        * offlineasm/mips.rb:
+
+2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Update testCheckSubBadImm() for ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=152846
+
+        Reviewed by Mark Lam.
+
+        * b3/testb3.cpp:
+        (JSC::B3::testCheckSubBadImm):
+        The test was assuming the constant can always be used
+        as immediate. That's obviously not the case on ARM64.
+
+2016-01-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 getById() should do exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=152810
+
+        Reviewed by Saam Barati.
+
+        This adds abstractions for doing exceptions from patchpoints, and uses them to implement
+        exceptions from GetById. This covers all of the following ways that a GetById might throw an
+        exceptions:
+
+        - Throw without try/catch from the vmCall() in a GetById(Untyped:)
+        - Throw with try/catch from the vmCall() in a GetById(Untyped:)
+        - Throw without try/catch from the callOperation() in the patchpoint of a GetById
+        - Throw with try/catch from the callOperation() in the patchpoint of a GetById
+        - Throw without try/catch from the Call IC generated in the patchpoint of a GetById
+        - Throw with try/catch from the Call IC generated in the patchpoint of a GetById
+
+        This requires having a default exception target in FTL-generated code, and ensuring that this
+        target is generated regardless of whether we have branches to the B3 basic block of the
+        default exception target. This also requires adding some extra arguments to a
+        PatchpointValue, and then knowing that the arguments are used for OSR exit and not anything
+        else. This also requires associating the CallSiteIndex of the patchpoint with the register
+        set used for exit and with the OSR exit label for the unwind exit.
+
+        All of the stuff that you have to worry about when wiring a patchpoint to exception handling
+        is covered by the new PatchpointExceptionHandle object. You create one by calling
+        preparePatchpointForExceptions(). This sets up the B3 IR representation of the patchpoint
+        with stackmap arguments for the exceptional exit, and creates a PatchpointExceptionHandle
+        object that can be used to create zero or more actual OSR exits. It can create both OSR exits
+        for operation calls and OSR exits for unwind. You call the
+        PatchpointExceptionHandle::scheduleExitCreationXXX() methods from the generator callback to
+        actually get OSR exits.
+
+        This API makes heavy use of Box<>, late paths, and link tasks. For example, you can use the
+        PatchpointExceptionHandle to get a Box<JumpList> that you can append exception jumps to. When
+        you use this API, it automatically registers a link task that will link the JumpList to the
+        actual OSR exit label.
+
+        This API is very flexible about how you get to the label of the OSR exit. You are encouraged
+        to use the Box<JumpList> approach, but if you really just need the label, you can also get
+        a RefPtr<ExceptionTarget> and rely on the fact that the ExceptionTarget object will be able
+        to vend you the OSR exit label at link-time.
+
+        This reduces the number of JSC test failures with FTL B3 from 186 to 133. It also adds a
+        bunch of new tests specifically for all of the ways you might throw from GetById, and B3
+        passes all of these new tests. Note that I'm not counting the new tests as part of the
+        previous 186 test failures (FTL B3 failed all of the new tests prior to this change).
+
+        After this change, it should be easy to make all of the other patchpoints also handle
+        exceptions by just following the preparePatchpointForExceptions() idiom.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3StackmapValue.h:
+        * b3/B3ValueRep.cpp:
+        (JSC::B3::ValueRep::addUsedRegistersTo):
+        (JSC::B3::ValueRep::usedRegisters):
+        (JSC::B3::ValueRep::dump):
+        * b3/B3ValueRep.h:
+        (JSC::B3::ValueRep::doubleValue):
+        (JSC::B3::ValueRep::withOffset):
+        (JSC::B3::ValueRep::usedRegisters):
+        * ftl/FTLB3Compile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::unreachable):
+        (JSC::FTL::Output::speculate):
+        * ftl/FTLExceptionTarget.cpp: Added.
+        (JSC::FTL::ExceptionTarget::~ExceptionTarget):
+        (JSC::FTL::ExceptionTarget::label):
+        (JSC::FTL::ExceptionTarget::jumps):
+        (JSC::FTL::ExceptionTarget::ExceptionTarget):
+        * ftl/FTLExceptionTarget.h: Added.
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileMakeRope):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinaryBitOpSnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::preparePatchpointForExceptions):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+        * ftl/FTLPatchpointExceptionHandle.cpp: Added.
+        (JSC::FTL::PatchpointExceptionHandle::create):
+        (JSC::FTL::PatchpointExceptionHandle::defaultHandle):
+        (JSC::FTL::PatchpointExceptionHandle::~PatchpointExceptionHandle):
+        (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreation):
+        (JSC::FTL::PatchpointExceptionHandle::scheduleExitCreationForUnwind):
+        (JSC::FTL::PatchpointExceptionHandle::PatchpointExceptionHandle):
+        (JSC::FTL::PatchpointExceptionHandle::createHandle):
+        * ftl/FTLPatchpointExceptionHandle.h: Added.
+        * ftl/FTLState.cpp:
+        * ftl/FTLState.h:
+        (JSC::FTL::verboseCompilationEnabled):
+        * tests/stress/ftl-get-by-id-getter-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-get-by-id-getter-exception-no-catch.js: Added.
+        * tests/stress/ftl-get-by-id-getter-exception.js: Added.
+        * tests/stress/ftl-get-by-id-slow-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-get-by-id-slow-exception-no-catch.js: Added.
+        * tests/stress/ftl-get-by-id-slow-exception.js: Added.
+        * tests/stress/ftl-operation-exception-interesting-live-state.js: Added.
+        * tests/stress/ftl-operation-exception-no-catch.js: Added.
+
+2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Implemented missing branch patching methods.
+        https://bugs.webkit.org/show_bug.cgi?id=152845
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::canJumpReplacePatchableBranch32WithPatch):
+        (JSC::MacroAssemblerMIPS::startOfPatchableBranch32WithPatchOnAddress):
+        (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranch32WithPatch):
+
+2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] When resolving Stack arguments, use addressing from SP when addressing from FP is invalid
+        https://bugs.webkit.org/show_bug.cgi?id=152840
+
+        Reviewed by Mark Lam.
+
+        ARM64 has two kinds of addressing with immediates:
+        -Signed 9bits direct (really only -256 to 255).
+        -Unsigned 12bits scaled by the load/store size.
+
+        When resolving the stack addresses, we easily run
+        past -256 bytes from FP. Addressing from SP gives us more
+        room to address the stack efficiently because we can
+        use unsigned immediates.
+
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::repForArg):
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+
+2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Make repatchCall public to fix compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=152843
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::repatchCall):
+        (JSC::MacroAssemblerMIPS::linkCall): Deleted.
+
+2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] Replaced subi with addi in getHostCallReturnValue
+        https://bugs.webkit.org/show_bug.cgi?id=152841
+
+        Reviewed by Michael Saboff.
+
+        MIPS architecture does not have subi instruction, addi with negative
+        number should be used instead.
+
+        * jit/JITOperations.cpp:
+
+2016-01-07  Mark Lam  <mark.lam@apple.com>
+
+        ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.
+        https://bugs.webkit.org/show_bug.cgi?id=152833
+
+        Reviewed by Michael Saboff.
+
+        Follow-up patch to fix illegal use of memoryTempRegister as the src for ARM64's
+        store32.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::or32):
+        (JSC::MacroAssemblerARM64::store):
+
+2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [mips] GPRInfo::toArgumentRegister missing
+        https://bugs.webkit.org/show_bug.cgi?id=152838
+
+        Reviewed by Michael Saboff.
+
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toArgumentRegister):
+
+2016-01-07  Mark Lam  <mark.lam@apple.com>
+
+        ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.
+        https://bugs.webkit.org/show_bug.cgi?id=152833
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::or32):
+        - Added some assertions to make sure it is safe to use ARMRegisters::S0 as a temp.
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::or32):
+        - Implement an optimization that avoids reloading the memoryTempRegister when
+          the immediate is encodable as an instruction immediate.
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::or32):
+        - Added an assertion to make sure it is safe to use the dataTempRegister as a temp.
+        - Implement an optimization that avoids reloading the memoryTempRegister when
+          the immediate is encodable as an instruction immediate.  In the event that we
+          cannot encode the immediate, we'll use the addressTempRegister as a temp, and
+          reload it later.
+
+2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
+
+        [CMake] JSC shell sources should include JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
+        https://bugs.webkit.org/show_bug.cgi?id=152664
+
+        Reviewed by Alex Christensen.
+
+        * shell/CMakeLists.txt:
+
+2016-01-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: CRASH Attempting to pause on CSP violation not inside of script
+        https://bugs.webkit.org/show_bug.cgi?id=152825
+        <rdar://problem/24021276>
+
+        Reviewed by Timothy Hatcher.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::breakProgram):
+        We cannot pause if we are not evaluating JavaScript, so bail.
+
+2016-01-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Re-enable lea() in Air on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=152832
+
+        Reviewed by Michael Saboff.
+
+        Lea() on the MacroAssembler is not the full x86 Lea (the real one being
+        x86Lea32()). Instead, it is a addPtr() with SP and a constant.
+
+        The instruction is required to implement B3's StackSlot. It is not
+        safe for big offsets but none of the stack operations are at the moment.
+
+        * b3/air/AirOpcode.opcodes:
+
+2016-01-07  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Add two missing abortWithReason implementations
+        https://bugs.webkit.org/show_bug.cgi?id=136753
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::memoryFence):
+        (JSC::MacroAssemblerMIPS::abortWithReason):
+        (JSC::MacroAssemblerMIPS::readCallTarget):
+
+2016-01-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Add new or32 implementation to MacroAssemblerARM after r194613
+        https://bugs.webkit.org/show_bug.cgi?id=152784
+
+        Reviewed by Benjamin Poulain.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::or32):
+
+2016-01-06  Mark Lam  <mark.lam@apple.com>
+
+        REGRESSION(r194613): JITMulGenerator needs a scratch GPR on 32-bit too.
+        https://bugs.webkit.org/show_bug.cgi?id=152805
+
+        Reviewed by Michael Saboff.
+
+        There aren't enough registers on x86 32-bit to allocate the needed scratch GPR.
+        So, we'll continue to use one of the result registers as the scratch, and
+        re-compute the result at the end.
+
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath):
+
+2016-01-06  Anders Carlsson  <andersca@apple.com>
+
+        Add a smart block pointer
+        https://bugs.webkit.org/show_bug.cgi?id=152799
+
+        Reviewed by Tim Horton.
+
+        Get rid of RemoteTargetBlock and replace it with WTF::BlockPtr<void ()>.
+
+        * inspector/remote/RemoteConnectionToTarget.h:
+        (Inspector::RemoteTargetBlock::RemoteTargetBlock): Deleted.
+        (Inspector::RemoteTargetBlock::~RemoteTargetBlock): Deleted.
+        (Inspector::RemoteTargetBlock::operator=): Deleted.
+        (Inspector::RemoteTargetBlock::operator()): Deleted.
+        * inspector/remote/RemoteConnectionToTarget.mm:
+        (Inspector::RemoteTargetQueueTaskOnGlobalQueue):
+        (Inspector::RemoteConnectionToTarget::queueTaskOnPrivateRunLoop):
+
+2016-01-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] More B3 tests passing on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=152787
+
+        Reviewed by Michael Saboff.
+
+        Some more minor bugs.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::urshift64):
+        The offset was being truncated. That code was just copied
+        from the 32bits version of urshift.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        Very few instructions can encode -1 as immediate.
+        TST certainly can't. The fallback works for ARM.
+
+        * b3/air/AirOpcode.opcodes:
+        Bit instructions have very specific immediate encoding.
+        B3 cannot express that properly yet. I disabled those
+        forms for now. Immediates encoding is something we'll really 
+        have to look into at some point for B3 ARM64.
+
+2016-01-06  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        Silence -Wtautological-compare
+        https://bugs.webkit.org/show_bug.cgi?id=152768
+
+        Reviewed by Saam Barati.
+
+        * runtime/Options.cpp:
+        (JSC::Options::setAliasedOption):
+
+2016-01-06  Filip Pizlo  <fpizlo@apple.com>
+
+        Make sure that the basic throw-from-operation mode of throwing makes sense in FTL B3
+        https://bugs.webkit.org/show_bug.cgi?id=152798
+
+        Reviewed by Oliver Hunt.
+
+        This really just contains one change: we inline emitBranchToOSRExitIfWillCatchException()
+        into callCheck(), since that was its only caller. This makes it a bit more clear what is
+        going on.
+
+        It turns out that FTL B3 already handled this case properly. I added a test that I believe
+        illustrates this. Note that although the test uses GetById, which ordinarily throws
+        exceptions from inside a patchpoint, it uses it in such a way that the exception is thrown
+        from the operation call for the non-cell bypass path of a GetById(UntypedUse:).
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBranchToOSRExitIfWillCatchException): Deleted.
+        * tests/stress/ftl-operation-exception.js: Added.
+        (foo):
+
+2016-01-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove duplicate check
+        https://bugs.webkit.org/show_bug.cgi?id=152792
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.RemoteObject.prototype._generatePreview): Deleted.
+        This method is only called from one place, and it does an equivalent
+        check before calling this function. Remove the duplicate check.
+
+2016-01-06  Brian Burg  <bburg@apple.com>
+
+        Add a WebKit SPI for registering an automation controller with RemoteInspector
+        https://bugs.webkit.org/show_bug.cgi?id=151576
+
+        Reviewed by Dan Bernstein and Joseph Pecoraro.
+
+        Given a RemoteInspector endpoint that is instantiated in UIProcess, there
+        should be a way to delegate automation-related functionality and policy to
+        clients of WebKit.
+
+        This class adds a RemoteInspector::Client interface that serves a delegate.
+        This is ultimately delegated via _WKAutomationDelegate, which is an SPI
+        that allows clients to install an Objective-C delegate for automation.
+
+        The setting for whether remote automation is allowed is included in the
+        listing that RemoteInspector sends out. It is updated when RemoteInspector::Client
+        is assigned, or when the client signals that its capabilities have changed.
+
+        * inspector/remote/RemoteInspector.h:
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::setRemoteInspectorClient): Added.
+        (Inspector::RemoteInspector::pushListingsNow):
+
+            In the listing, include whether the application supports remote automation.
+
+        * inspector/remote/RemoteInspectorConstants.h: Add a constant.
+
+2016-01-05  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Boolean, Number, Map, RegExp, and Set should be subclassable
+        https://bugs.webkit.org/show_bug.cgi?id=152765
+
+        Reviewed by Michael Saboff.
+
+        This patch enables subclassing of five more builtins: Boolean, Number, Map, RegExp, and Set.
+
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructWithBooleanConstructor):
+        (JSC::constructBoolean): Deleted.
+        * runtime/BooleanConstructor.h:
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::getRegExpStructure):
+        (JSC::constructRegExp):
+        * runtime/SetConstructor.cpp:
+        (JSC::constructSet):
+        * tests/es6.yaml:
+        * tests/stress/class-subclassing-misc.js: Added.
+        (B):
+        (N):
+        (M):
+        (R):
+        (S):
+        (test):
+
+2016-01-06  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Fix branchTruncateDoubleToUint32 implementation in macro assembler
+        https://bugs.webkit.org/show_bug.cgi?id=152782
+
+        Reviewed by Benjamin Poulain.
+
+        Already covered by LayoutTests/js/dfg-uint32array-overflow-values test.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchTruncateDoubleToUint32):
+
+2016-01-06  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Fix or32 implementation in macro assembler
+        https://bugs.webkit.org/show_bug.cgi?id=152781
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::or32):
+
+2016-01-06  Julien Brianceau  <jbriance@cisco.com>
+
+        [mips] Add missing branchAdd32 implementation in macro assembler
+        https://bugs.webkit.org/show_bug.cgi?id=152785
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::branchAdd32):
+
+2016-01-06  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [ES6] Date.prototype should be a plain object
+        https://bugs.webkit.org/show_bug.cgi?id=152574
+
+        Reviewed by Benjamin Poulain.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        * tests/mozilla/mozilla-tests.yaml: Expect errors from old Date.prototype as Date instance tests.
+
+2016-01-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Get more of testb3 to pass on ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=152737
+
+        Reviewed by Geoffrey Garen.
+
+        A bunch of minor bugs and missing function to make most of testb3
+        run on ARM64.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::canEncodePImmOffset):
+        (JSC::ARM64Assembler::canEncodeSImmOffset):
+        (JSC::isInt9): Deleted.
+        (JSC::isUInt12): Deleted.
+        * assembler/ARMv7Assembler.h:
+        * assembler/AssemblerCommon.h: Added.
+        (JSC::isInt9):
+        (JSC::isUInt12):
+        (JSC::isValidScaledUImm12):
+        (JSC::isValidSignedImm9):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::load16SignedExtendTo32):
+        (JSC::MacroAssemblerARM64::load8SignedExtendTo32):
+        (JSC::MacroAssemblerARM64::store16):
+        (JSC::MacroAssemblerARM64::absFloat):
+        (JSC::MacroAssemblerARM64::loadFloat):
+        (JSC::MacroAssemblerARM64::storeFloat):
+        (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate):
+        (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate):
+        (JSC::MacroAssemblerARM64::tryLoadSignedWithOffset):
+        (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate<8>):
+        (JSC::MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate<16>):
+        (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate<8>):
+        (JSC::MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate<16>):
+        * assembler/X86Assembler.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isValidImmForm):
+        (JSC::B3::Air::Arg::isValidAddrForm):
+        (JSC::B3::Air::Arg::isValidForm):
+        * b3/air/AirOpcode.opcodes:
+
+2016-01-05  Zan Dobersek  <zdobersek@igalia.com>
+
+        [CMake] Remove USE_UDIS86 variable
+        https://bugs.webkit.org/show_bug.cgi?id=152731
+
+        Reviewed by Gyuyoung Kim.
+
+        * CMakeLists.txt: Unconditionally build the Udis86-specific files.
+
+2016-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 fails cdjs-tests.yaml/red_black_tree_test.js.ftl-eager-no-cjit
+        https://bugs.webkit.org/show_bug.cgi?id=152770
+
+        Reviewed by Mark Lam.
+
+        It turns out that liveness didn't know that the return value GPR or FPR is live at the
+        return. Consequently, we can end up with code that clobbers the return value register after
+        the move of the return value into that register. This could happen if we start with
+        something like:
+
+            Move 42(%tmp1), %tmp2
+            Move 50(%tmp1), %tmp3
+            Move %tmp3, 58(%tmp1)
+            Move %tmp2, %rax
+            Ret
+
+        Then we might coalesce %tmp2 with %rax:
+
+            Move 42(%tmp1), %rax
+            Move 50(%tmp1), %tmp3
+            Move %tmp3, 58(%tmp1)
+            Ret
+
+        But now there is no use of %rax after that first instruction, so %rax appears dead at the
+        other two Move's. So, the register allocator could then do this:
+
+            Move 42(%tmp1), %rax
+            Move 50(%tmp1), %rax
+            Move %rax, 58(%tmp1)
+            Ret
+
+        And that's clearly wrong. This patch solves this issue by replacing the old Ret instruction
+        with Ret32, Ret64, RetFloat, and RetDouble. These all take the return value register as an
+        argument. They also tell Air which parts of the return value register the caller will
+        observe. That's great for width analysis.
+
+        This resolves a test failure in the CDjs red_black_tree_test. This reduces the total number
+        of JSC test failures from 217 to 191.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::oops):
+        (JSC::MacroAssembler::ret32):
+        (JSC::MacroAssembler::ret64):
+        (JSC::MacroAssembler::retFloat):
+        (JSC::MacroAssembler::retDouble):
+        (JSC::MacroAssembler::shouldConsiderBlinding):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/air/AirHandleCalleeSaves.cpp:
+        (JSC::B3::Air::handleCalleeSaves):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/opcode_generator.rb:
+
+2016-01-05  Keith Miller  <keith_miller@apple.com>
+
+        Unreviewed build fix. A symbol was being exported that should not have been.
+
+        * runtime/Structure.h:
+
+2016-01-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r194603.
+        https://bugs.webkit.org/show_bug.cgi?id=152762
+
+        This change introduced JSC test failures (Requested by
+        ryanhaddad on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Date.prototype should be a plain object"
+        https://bugs.webkit.org/show_bug.cgi?id=152574
+        http://trac.webkit.org/changeset/194603
+
+2016-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+        stress/v8-crypto-strict.js.ftl-eager-no-cjit in FTL B3 fails with an assertion in the callframe shuffler
+        https://bugs.webkit.org/show_bug.cgi?id=152756
+
+        Reviewed by Saam Barati.
+
+        This fixes a really obvious and dumb tail call bug in FTL B3. I think that tail calls work
+        for real now. I have no idea why I got any tail call tests to pass before this fix.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+
+2016-01-04  Mark Lam  <mark.lam@apple.com>
+
+        Profiling should detect when multiplication overflows but does not create negative zero.
+        https://bugs.webkit.org/show_bug.cgi?id=132470
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::or32):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::or32):
+        - New or32 emitter needed by the mul snippet.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::resultProfileForBytecodeOffset):
+        (JSC::CodeBlock::updateResultProfileForBytecodeOffset): Deleted.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::ensureResultProfile):
+        (JSC::CodeBlock::addResultProfile): Deleted.
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase): Deleted.
+        - Added a m_bytecodeOffsetToResultProfileIndexMap because we can now add result
+          profiles in any order (based on runtime execution), not necessarily in bytecode
+          order at baseline compilation time.
+
+        * bytecode/ValueProfile.cpp:
+        (WTF::printInternal):
+        * bytecode/ValueProfile.h:
+        (JSC::ResultProfile::didObserveInt52Overflow):
+        (JSC::ResultProfile::setObservedInt52Overflow):
+        - Add new Int52Overflow flags.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        - Now with more straightforward mapping of profiling info.
+
+        * dfg/DFGCommon.h:
+        - Fixed a typo in a comment.
+
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::arithNodeFlags):
+        (JSC::DFG::Node::mayHaveNonIntResult):
+        (JSC::DFG::Node::hasConstantBuffer):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::nodeMayOverflowInt52):
+        (JSC::DFG::nodeCanSpeculateInt52):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        - We now have profiling info for whether the result was ever seen to be a non-Int.
+          Use this to make a better prediction.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mul):
+        - Switch to using CodeBlock::ensureResultProfile().  ResultProfiles can now be
+          created at any time (including the slow path), not just in bytecode order
+          during baseline compilation.
+
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath):
+        - Removed the fast path profiling code for NegZero because we'll go to the slow
+          path anyway.  Let the slow path do the profiling for us.
+        - Added profiling for NegZero and potential Int52 overflows in the fast path
+          that does double math.
+
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::updateResultProfileForBinaryArithOp):
+        - Removed the RETURN_WITH_RESULT_PROFILING macro (2 less macros), and just use
+          the RETURN_WITH_PROFILING macro instead with a call to
+          updateResultProfileForBinaryArithOp().  This makes it clear what we're doing
+          to do profiling in each case, and also allows us to do custom profiling for
+          each opcode if needed.  However, so far, we always call
+          updateResultProfileForBinaryArithOp().
+
+2016-01-05  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Arrays should be subclassable.
+        https://bugs.webkit.org/show_bug.cgi?id=152706
+
+        Reviewed by Benjamin Poulain.
+
+        This patch enables full subclassing of Arrays. We do this by fetching the new.target's prototype property
+        in the Array constructor and transitioning the old structure to have the new prototype. This method has
+        two downsides. The first is that we clobber the transition watchpoint on the base structure. The second,
+        which is currently very significant but should be fixed in a future patch, is that we allocate a new
+        structure for each new derived class we allocate.
+
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        (JSC::constructWithArrayConstructor):
+        (JSC::callArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
+        (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        (JSC::constructArrayNegativeIndexed):
+        * runtime/PrototypeMap.h:
+        * runtime/Structure.h:
+        * runtime/StructureInlines.h:
+        (JSC::Structure::createSubclassStructure):
+        * tests/es6.yaml:
+        * tests/stress/class-subclassing-array.js: Added.
+        (A):
+        (B.prototype.get 1):
+        (B):
+        (C):
+        (test):
+
+2016-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+        regress/script-tests/deltablue-varargs.js.ftl-no-cjit-no-put-stack-validate on FTL B3 gets a B3 validation failure
+        https://bugs.webkit.org/show_bug.cgi?id=152754
+
+        Reviewed by Geoffrey Garen and Saam Barati.
+
+        It turns out that the FTL was creating orphans. Rather than making the FTL handle them by
+        itself, I gave B3 the power to eliminate them for you. I also made the dumper print them
+        since otherwise, you wouldn't know anything about the orphan when looking at a validation
+        failure or other kind of procedure dump.
+
+        * b3/B3IndexSet.h:
+        (JSC::B3::IndexSet::add):
+        (JSC::B3::IndexSet::addAll):
+        (JSC::B3::IndexSet::remove):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::dump):
+        (JSC::B3::Procedure::deleteValue):
+        (JSC::B3::Procedure::deleteOrphans):
+        (JSC::B3::Procedure::dominators):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::cfg):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+
+2015-12-24  Mark Lam  <mark.lam@apple.com>
+
+        Re-landing: Add validation of JSC options to catch typos.
+        https://bugs.webkit.org/show_bug.cgi?id=152549
+
+        Reviewed by Benjamin Poulain.
+
+        1. If a JSC_xxx option is found and xxx is not a valid option, we will now log
+           an error message.
+        2. If a --xxx jsc option is specified, but xxx is not a valid option, we will
+           now log an error message.
+        3. Added JSC_validateOptions, which if set to true will cause the VM to crash if
+           an invalid option was seen during options parsing.
+
+        In this version for re-landing, I removed the change where I disallowed -- options
+        after the script name.  Apparently, we have some test harnesses that do append the
+        -- options after the script name.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+
+2016-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do ArithNegate
+        https://bugs.webkit.org/show_bug.cgi?id=152745
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithNegate):
+
+2016-01-05  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [ES6] Date.prototype should be a plain object
+        https://bugs.webkit.org/show_bug.cgi?id=152574
+
+        Reviewed by Benjamin Poulain.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+
+2016-01-05  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r194590.
+        https://bugs.webkit.org/show_bug.cgi?id=152751
+
+        "Causes bot failures" (Requested by mlam on #webkit).
+
+        Reverted changeset:
+
+        "Add validation of JSC options to catch typos."
+        https://bugs.webkit.org/show_bug.cgi?id=152549
+        http://trac.webkit.org/changeset/194590
+
+2016-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do In
+        https://bugs.webkit.org/show_bug.cgi?id=152744
+
+        Reviewed by Michael Saboff.
+
+        This was easy; I just used the same idiom that we already established for ICs in FTL B3.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileIn):
+
+2016-01-05  Filip Pizlo  <fpizlo@apple.com>
+
+        Implement B3 version of FTL::Output::check()
+        https://bugs.webkit.org/show_bug.cgi?id=152743
+
+        Reviewed by Geoffrey Garen.
+
+        Turns out this was just like the LLVM version.
+
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::branch):
+        (JSC::FTL::Output::check):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::switchInstruction):
+        (JSC::FTL::Output::check): Deleted.
+
+2016-01-05  Mark Lam  <mark.lam@apple.com>
+
+        Add support for aliasing JSC Options.
+        https://bugs.webkit.org/show_bug.cgi?id=152551
+
+        Reviewed by Filip Pizlo.
+
+        This allows us to use old options names as well.  This is for the benefit of
+        third party tools which may have been built to rely on those old options.  The
+        old option names will be mapped to the current option names in setOption().
+
+        For some options, the old option name specifies the inverse boolean value of the
+        current option name.  setOption() will take care of inverting the value before
+        applying it to the option.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+        - Switch to dumping only overridden options here.  Verbose dumping is too much
+          for common usage.
+        * runtime/Options.cpp:
+        (JSC::overrideOptionWithHeuristic):
+        (JSC::Options::overrideAliasedOptionWithHeuristic):
+        (JSC::computeNumberOfWorkerThreads):
+        (JSC::Options::initialize):
+        (JSC::Options::setOptionWithoutAlias):
+        (JSC::invertBoolOptionValue):
+        (JSC::Options::setAliasedOption):
+        (JSC::Options::setOption):
+        (JSC::Options::dumpAllOptions):
+        - String.ascii() converts newline characters to '?', and this was messing up the
+          printing of the options.  Switched to using String.utf8() instead.
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+
+2016-01-05  Mark Lam  <mark.lam@apple.com>
+
+        Add validation of JSC options to catch typos.
+        https://bugs.webkit.org/show_bug.cgi?id=152549
+
+        Reviewed by Benjamin Poulain.
+
+        1. If a JSC_xxx option is found and xxx is not a valid option, we will now log
+           an error message.
+        2. The jsc app is commonly used as follows:
+
+               $ jsc [jsc options] [scripts]
+     
+           Previously, we'll continue to parse for [jsc options] after [scripts] is seen.
+           We won't do this anymore.  Any --xxx jsc options must precede the [scripts]
+           arguments.
+
+        3. If a --xxx jsc option is specified, but xxx is not a valid option, we will
+           now log an error message.
+
+        4. Added JSC_validateOptions, which if set to true will cause the VM to crash if
+           an invalid option was seen during options parsing.
+
+        * jsc.cpp:
+        (CommandLine::parseArguments):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+
+2016-01-04  Keith Miller  <keith_miller@apple.com>
+
+        Turn off Internal Function inlining in the DFG for super calls.
+        https://bugs.webkit.org/show_bug.cgi?id=152695
+
+        Reviewed by Geoffrey Garen.
+
+        Currently, we inline several InternalFunctions into an alloctation with a
+        fixed structure in the DFG. This optimization is not valid when the
+        InternalFunction is called via a super call.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::attemptToInlineCall):
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+
+2016-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do binary snippets
+        https://bugs.webkit.org/show_bug.cgi?id=152668
+
+        Reviewed by Mark Lam.
+
+        This finishes all of the rest of the snippets.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitOr):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitXor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitRShift):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitLShift):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitURShift):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinaryBitOpSnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitRightShiftSnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
+        * tests/stress/object-bit-or.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/object-bit-xor.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/object-lshift.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/object-rshift.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/object-urshift.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/untyped-bit-or.js: Added.
+        (foo):
+        (valueOf):
+        * tests/stress/untyped-bit-xor.js: Added.
+        (foo):
+        (valueOf):
+        * tests/stress/untyped-lshift.js: Added.
+        (foo):
+        (valueOf):
+        * tests/stress/untyped-rshift.js: Added.
+        (foo):
+        (valueOf):
+        * tests/stress/untyped-urshift.js: Added.
+        (foo):
+        (valueOf):
+
+2016-01-04  Mark Lam  <mark.lam@apple.com>
+
+        isUntypedSpeculationForArithmetic is wrong.
+        https://bugs.webkit.org/show_bug.cgi?id=152708
+
+        Reviewed by Filip Pizlo.
+
+        The isUntypedSpeculation...() checks should return true is we ever see
+        non-numeric types, regardless of whether numeric types are seen or not.
+        Previously, they only return true if we only see non-numeric types, and false if
+        we ever see numeric types.
+
+        This patch is perf neutral on both x86_64 and x86.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isUntypedSpeculationForArithmetic):
+        (JSC::isUntypedSpeculationForBitOps):
+
+2016-01-04  Tim Horton  <timothy_horton@apple.com>
+
+        Turn on gesture events when building for Yosemite
+        https://bugs.webkit.org/show_bug.cgi?id=152704
+        rdar://problem/24042472
+
+        Reviewed by Anders Carlsson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2016-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do BitAnd binary snippets
+        https://bugs.webkit.org/show_bug.cgi?id=152713
+
+        Reviewed by Mark Lam.
+
+        Getting ready to finish up the binary bitop snippets.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitAnd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinaryBitOpSnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
+        * tests/stress/object-bit-and.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/untyped-bit-and.js: Added.
+        (foo):
+        (valueOf):
+
+2016-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do all of the non-bitop binary snippets
+        https://bugs.webkit.org/show_bug.cgi?id=152709
+
+        Reviewed by Mark Lam.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStrCat):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithDiv):
+        * tests/stress/object-add.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/object-div.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/object-mul.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/untyped-add.js: Added.
+        (foo):
+        (valueOf):
+        * tests/stress/untyped-div.js: Added.
+        (foo):
+        (valueOf):
+        * tests/stress/untyped-mul.js: Added.
+        (foo):
+        (valueOf):
+
+2016-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do the ArithSub binary snippet
+        https://bugs.webkit.org/show_bug.cgi?id=152705
+
+        Reviewed by Saam Barati.
+
+        This implements the ArithSub binary snippet generator in FTL B3.
+
+        While doing this, I discovered that the DFG type inference logic for ArithSub contains a
+        classic mistake: it causes the snippets to kick in when the type set does not contain numbers
+        rather than kicking in when the type set contains non-numbers. So, the original test that I
+        wrote for this doesn't work right (it runs to completion but OSR exits ad infinitum). I wrote
+        a second test that is simpler, and that one shows that the binary snippets "work". That's
+        sort of a joke though, since the only way to trigger binary snippets is to never pass numbers
+        and the only way to actually cause a binary snippet to do meaninful work is to pass numbers.
+        I filed a bug about this mess: https://bugs.webkit.org/show_bug.cgi?id=152708.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileUntypedBinaryOp):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBinarySnippet):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateCell):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
+        * tests/stress/object-sub.js: Added.
+        (foo):
+        (things.valueOf):
+        * tests/stress/untyped-sub.js: Added.
+        (foo):
+        (valueOf):
+
+2016-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, disable FTL B3 for now. I didn't intend to enable it yet.
+
+        * dfg/DFGCommon.h:
+
+2016-01-04  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 patchpoints should allow requesting scratch registers
+        https://bugs.webkit.org/show_bug.cgi?id=152669
+
+        Reviewed by Benjamin Poulain.
+
+        Scratch registers are something that we often need in many patchpoint use cases. In LLVM's
+        patchpoints, we didn't have a good way to request scratch registers. So, our current FTL code
+        often does crazy scratch register allocation madness even when it would be better to just ask
+        the backend for some registers. This patch adds a mechanism for requesting scratch registers
+        in B3, and wires it all the way to all of our register allocation and liveness
+        infrastructure.
+
+        From the standpoint of a patchpoint, a "scratch register" is an instruction argument that
+        only admits Tmp and is defined early (like an early clobber register) and is used late (like
+        what we previously called LateUse, except that this time it's also a warm use). We already
+        had the beginning of support for early def's because of early clobbers, and we already
+        supported late uses albeit cold ones. I really only needed to add one new role: "Scratch",
+        which means both early def and late use in much the same way as "UseDef" means both early
+        use and late def. But, it feels better to complete the set of roles, so I added LateColdUse
+        to differentiate from LateUse (which is now a warm use) and EarlyDef to differentiate from
+        Def (which is, and always has been, a late def). Forcing the code to deal with the full
+        matrix of possibilities resulted in what is probably a progression in how we handle defs in
+        the register and stack allocators. The new Inst::forEachDef(Inst*, Inst*, callback) fully
+        recognizes that a "def" is something that can come from either the preceding instruction or
+        the succeeding one.
+
+        This doesn't add any new functionality to FTL B3 yet, but the new scratch register mechanism
+        is covered by new testb3 tests.
+
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::isValid):
+        (JSC::B3::CheckSpecial::admitsStack):
+        (JSC::B3::CheckSpecial::generate):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::forEachArg):
+        (JSC::B3::PatchpointSpecial::isValid):
+        (JSC::B3::PatchpointSpecial::admitsStack):
+        (JSC::B3::PatchpointSpecial::generate):
+        * b3/B3PatchpointValue.cpp:
+        (JSC::B3::PatchpointValue::dumpMeta):
+        (JSC::B3::PatchpointValue::PatchpointValue):
+        * b3/B3PatchpointValue.h:
+        * b3/B3StackmapGenerationParams.cpp:
+        (JSC::B3::StackmapGenerationParams::unavailableRegisters):
+        * b3/B3StackmapGenerationParams.h:
+        (JSC::B3::StackmapGenerationParams::gpScratch):
+        (JSC::B3::StackmapGenerationParams::fpScratch):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        (JSC::B3::StackmapSpecial::isValidImpl):
+        (JSC::B3::StackmapSpecial::admitsStackImpl):
+        (JSC::B3::StackmapSpecial::repsImpl):
+        (JSC::B3::StackmapSpecial::isArgValidForValue):
+        (JSC::B3::StackmapSpecial::appendRepsImpl): Deleted.
+        * b3/B3StackmapSpecial.h:
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirArg.cpp:
+        (WTF::printInternal):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isAnyUse):
+        (JSC::B3::Air::Arg::isColdUse):
+        (JSC::B3::Air::Arg::isEarlyUse):
+        (JSC::B3::Air::Arg::isLateUse):
+        (JSC::B3::Air::Arg::isAnyDef):
+        (JSC::B3::Air::Arg::isEarlyDef):
+        (JSC::B3::Air::Arg::isLateDef):
+        (JSC::B3::Air::Arg::isZDef):
+        (JSC::B3::Air::Arg::Arg):
+        (JSC::B3::Air::Arg::imm):
+        (JSC::B3::Air::Arg::isDef): Deleted.
+        * b3/air/AirBasicBlock.h:
+        (JSC::B3::Air::BasicBlock::at):
+        (JSC::B3::Air::BasicBlock::get):
+        (JSC::B3::Air::BasicBlock::last):
+        * b3/air/AirEliminateDeadCode.cpp:
+        (JSC::B3::Air::eliminateDeadCode):
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+        (JSC::B3::Air::fixPartialRegisterStalls):
+        * b3/air/AirInst.cpp:
+        (JSC::B3::Air::Inst::hasArgEffects):
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::extraEarlyClobberedRegs):
+        (JSC::B3::Air::Inst::forEachDef):
+        (JSC::B3::Air::Inst::forEachDefWithExtraClobberedRegs):
+        (JSC::B3::Air::Inst::reportUsedRegisters):
+        (JSC::B3::Air::Inst::forEachTmpWithExtraClobberedRegs): Deleted.
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
+        (JSC::B3::Air::AbstractLiveness::LocalCalc::execute):
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/air/AirTmpWidth.cpp:
+        (JSC::B3::Air::TmpWidth::recompute):
+        * b3/air/AirUseCounts.h:
+        (JSC::B3::Air::UseCounts::UseCounts):
+        * b3/testb3.cpp:
+        (JSC::B3::testPatchpointAny):
+        (JSC::B3::testPatchpointGPScratch):
+        (JSC::B3::testPatchpointFPScratch):
+        (JSC::B3::testPatchpointLotsOfLateAnys):
+        (JSC::B3::run):
+
+2016-01-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(INTL) build after r193493
+        https://bugs.webkit.org/show_bug.cgi?id=152689
+
+        Reviewed by Alex Christensen.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::finishCreation):
+
+2016-01-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        JSC generator scripts shouldn't have verbose output
+        https://bugs.webkit.org/show_bug.cgi?id=152382
+
+        Reviewed by Michael Catanzaro.
+
+        * b3/air/opcode_generator.rb:
+        * generate-bytecode-files:
+        * offlineasm/asm.rb:
+        * offlineasm/generate_offset_extractor.rb:
+        * offlineasm/parser.rb:
+
+2016-01-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Build B3 by default on iOS ARM64
+        https://bugs.webkit.org/show_bug.cgi?id=152525
+
+        Reviewed by Filip Pizlo.
+
+        Minor changes required to get testb3 to compile.
+
+        * Configurations/ToolExecutable.xcconfig:
+        We need an entitlement to allocate executable memory.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::scratchRegister):
+        (JSC::MacroAssemblerARM64::getCachedDataTempRegisterIDAndInvalidate):
+        (JSC::MacroAssemblerARM64::getCachedMemoryTempRegisterIDAndInvalidate):
+        Expose one of the scratch registers for ValueRep::emitRestore().
+        Guard the use of scratch registers when not allowed.
+
+        * b3/air/AirOpcode.opcodes:
+        ARM addressing is a bit different. Skip Addr to make things build.
+
+        * b3/testb3.cpp:
+        (JSC::B3::testPatchpointWithStackArgumentResult):
+        Add on memory only exists on x86.
+
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::macroScratchRegisters):
+        Add the two scratch registers, useful for patchpoints.
+
+2016-01-03  Khem Raj  <raj.khem@gmail.com>
+
+        WebKit fails to build with musl libc library
+        https://bugs.webkit.org/show_bug.cgi?id=152625
+
+        Reviewed by Daniel Bates.
+
+        Qualify isnan() calls with std namespace.
+
+        * runtime/Options.cpp:
+        (Option::operator==): Add std namespace qualifier.
+
+2016-01-03  Andreas Kling  <akling@apple.com>
+
+        Remove redundant StringImpl substring creation function.
+        <https://webkit.org/b/152652>
+
+        Reviewed by Daniel Bates.
+
+        Remove jsSubstring8() and make the only call site use jsSubstring().
+
+        * runtime/JSString.h:
+        (JSC::jsSubstring8): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+
+2016-01-02  Khem Raj  <raj.khem@gmail.com>
+
+        Clang's builtin for clear_cache accepts char* and errors out
+        when using void*, using char* work on both gcc and clang
+        since char* is auto-converted to void* in gcc case.
+        https://bugs.webkit.org/show_bug.cgi?id=152654
+
+        Reviewed by Michael Saboff;
+
+        * assembler/ARM64Assembler.h:
+        (linuxPageFlush): Convert arguments to __builtin___clear_cache()
+        to char*.
+
+2015-12-31  Andy Estes  <aestes@apple.com>
+
+        Replace WTF::move with WTFMove
+        https://bugs.webkit.org/show_bug.cgi?id=152601
+
+        Reviewed by Brady Eidson.
+
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunctionImpl::ObjCCallbackFunctionImpl):
+        (JSC::ObjCCallbackFunction::ObjCCallbackFunction):
+        (JSC::ObjCCallbackFunction::create):
+        (objCCallbackFunctionForInvocation):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::releaseAssemblerData):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::linkCode):
+        * b3/B3BlockInsertionSet.cpp:
+        (JSC::B3::BlockInsertionSet::insert):
+        (JSC::B3::BlockInsertionSet::splitForward):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3OpaqueByproducts.cpp:
+        (JSC::B3::OpaqueByproducts::add):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::addDataSection):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::releaseByproducts):
+        * b3/B3ProcedureInlines.h:
+        (JSC::B3::Procedure::add):
+        * b3/B3Value.h:
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::addBlock):
+        (JSC::B3::Air::Code::addStackSlot):
+        (JSC::B3::Air::Code::addSpecial):
+        * b3/air/AirInst.h:
+        (JSC::B3::Air::Inst::Inst):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirSimplifyCFG.cpp:
+        (JSC::B3::Air::simplifyCFG):
+        * bindings/ScriptValue.cpp:
+        (Deprecated::jsToInspectorValue):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::computeBytecodeBasicBlocks):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::setCalleeSaveRegisters):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCodeMap):
+        (JSC::CodeBlock::livenessAnalysis):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::GetByIdVariant):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::PolymorphicAccess::regenerateWithCases):
+        (JSC::PolymorphicAccess::regenerateWithCase):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeForStubInfo):
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::setter):
+        * bytecode/StructureStubClearingWatchpoint.cpp:
+        (JSC::StructureStubClearingWatchpoint::push):
+        * bytecode/StructureStubClearingWatchpoint.h:
+        (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::addAccessCase):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::setInstructions):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/SetForScope.h:
+        (JSC::SetForScope::SetForScope):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::livenessFor):
+        (JSC::DFG::Graph::killsFor):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGJITFinalizer.cpp:
+        (JSC::DFG::JITFinalizer::JITFinalizer):
+        * dfg/DFGLivenessAnalysisPhase.cpp:
+        (JSC::DFG::LivenessAnalysisPhase::process):
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
+        (JSC::DFG::SpeculativeJIT::compileIn):
+        (JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::finishCreation):
+        * disassembler/Disassembler.cpp:
+        (JSC::disassembleAsynchronously):
+        * ftl/FTLB3Compile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::initializeB3Byproducts):
+        * ftl/FTLJITFinalizer.h:
+        (JSC::FTL::OutOfLineCodeInfo::OutOfLineCodeInfo):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        * heap/Heap.cpp:
+        (JSC::Heap::releaseDelayedReleasedObjects):
+        (JSC::Heap::markRoots):
+        (JSC::Heap::setIncrementalSweeper):
+        * heap/HeapInlines.h:
+        (JSC::Heap::releaseSoon):
+        (JSC::Heap::registerWeakGCMap):
+        * heap/WeakInlines.h:
+        * inspector/ConsoleMessage.cpp:
+        (Inspector::ConsoleMessage::addToFrontend):
+        * inspector/ContentSearchUtilities.cpp:
+        (Inspector::ContentSearchUtilities::searchInTextByLines):
+        * inspector/InjectedScript.cpp:
+        (Inspector::InjectedScript::getFunctionDetails):
+        (Inspector::InjectedScript::getProperties):
+        (Inspector::InjectedScript::getDisplayableProperties):
+        (Inspector::InjectedScript::getInternalProperties):
+        (Inspector::InjectedScript::getCollectionEntries):
+        (Inspector::InjectedScript::wrapCallFrames):
+        * inspector/InspectorAgentRegistry.cpp:
+        (Inspector::AgentRegistry::append):
+        (Inspector::AgentRegistry::appendExtraAgent):
+        * inspector/InspectorBackendDispatcher.cpp:
+        (Inspector::BackendDispatcher::CallbackBase::CallbackBase):
+        (Inspector::BackendDispatcher::CallbackBase::sendSuccess):
+        (Inspector::BackendDispatcher::BackendDispatcher):
+        (Inspector::BackendDispatcher::create):
+        (Inspector::BackendDispatcher::sendPendingErrors):
+        * inspector/InspectorProtocolTypes.h:
+        (Inspector::Protocol::Array::addItem):
+        * inspector/InspectorValues.cpp:
+        * inspector/InspectorValues.h:
+        (Inspector::InspectorObjectBase::setValue):
+        (Inspector::InspectorObjectBase::setObject):
+        (Inspector::InspectorObjectBase::setArray):
+        (Inspector::InspectorArrayBase::pushValue):
+        (Inspector::InspectorArrayBase::pushObject):
+        (Inspector::InspectorArrayBase::pushArray):
+        * inspector/JSGlobalObjectConsoleClient.cpp:
+        (Inspector::JSGlobalObjectConsoleClient::messageWithTypeAndLevel):
+        (Inspector::JSGlobalObjectConsoleClient::timeEnd):
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        (Inspector::JSGlobalObjectInspectorController::appendExtraAgent):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::JSInjectedScriptHost):
+        * inspector/JSInjectedScriptHost.h:
+        (Inspector::JSInjectedScriptHost::create):
+        * inspector/agents/InspectorAgent.cpp:
+        (Inspector::InspectorAgent::activateExtraDomain):
+        * inspector/agents/InspectorConsoleAgent.cpp:
+        (Inspector::InspectorConsoleAgent::addMessageToConsole):
+        (Inspector::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/agents/InspectorDebuggerAgent.cpp:
+        (Inspector::InspectorDebuggerAgent::setBreakpointByUrl):
+        (Inspector::InspectorDebuggerAgent::resolveBreakpoint):
+        (Inspector::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (Inspector::InspectorDebuggerAgent::breakpointActionProbe):
+        (Inspector::InspectorDebuggerAgent::breakProgram):
+        * inspector/agents/InspectorHeapAgent.cpp:
+        (Inspector::InspectorHeapAgent::didGarbageCollect):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
+        (Inspector::InspectorRuntimeAgent::getBasicBlocks):
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::InspectorScriptProfilerAgent::addEvent):
+        (Inspector::buildInspectorObject):
+        (Inspector::buildProfileInspectorObject):
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        * inspector/augmentable/AlternateDispatchableAgent.h:
+        * inspector/scripts/codegen/cpp_generator_templates.py:
+        * inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
+        (CppBackendDispatcherImplementationGenerator._generate_small_dispatcher_switch_implementation_for_domain):
+        (CppBackendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_command):
+        * inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
+        (CppFrontendDispatcherImplementationGenerator._generate_dispatcher_implementation_for_event):
+        * inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
+        (_generate_unchecked_setter_for_member):
+        * inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py:
+        (ObjCConfigurationImplementationGenerator._generate_success_block_for_command):
+        * inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py:
+        (ObjCFrontendDispatcherImplementationGenerator._generate_event_out_parameters):
+        * inspector/scripts/codegen/objc_generator_templates.py:
+        * inspector/scripts/tests/expected/commands-with-async-attribute.json-result:
+        * inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result:
+        * inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result:
+        * inspector/scripts/tests/expected/enum-values.json-result:
+        * inspector/scripts/tests/expected/events-with-optional-parameters.json-result:
+        * inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result:
+        * inspector/scripts/tests/expected/same-type-id-different-domain.json-result:
+        * inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result:
+        * inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-array-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-enum-type.json-result:
+        * inspector/scripts/tests/expected/type-declaration-object-type.json-result:
+        * inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result:
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::performSafeWrites):
+        * jit/PolymorphicCallStubRoutine.cpp:
+        (JSC::PolymorphicCallStubRoutine::PolymorphicCallStubRoutine):
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        (JSC::tryCachePutByID):
+        (JSC::tryRepatchIn):
+        (JSC::linkPolymorphicCall):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::setClosedVariables):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/Parser.h:
+        (JSC::Parser::closedVariables):
+        * parser/SourceProviderCache.cpp:
+        (JSC::SourceProviderCache::add):
+        * profiler/ProfileNode.h:
+        (JSC::CalculateProfileSubtreeDataFunctor::returnValue):
+        * replay/EncodedValue.cpp:
+        (JSC::EncodedValue::get<EncodedValue>):
+        * replay/scripts/CodeGeneratorReplayInputs.py:
+        (Generator.generate_member_move_expression):
+        * replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.cpp:
+        (Test::HandleWheelEvent::HandleWheelEvent):
+        (JSC::InputTraits<Test::HandleWheelEvent>::decode):
+        * replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.cpp:
+        (Test::MapInput::MapInput):
+        (JSC::InputTraits<Test::MapInput>::decode):
+        * runtime/ConsoleClient.cpp:
+        (JSC::ConsoleClient::internalMessageWithTypeAndLevel):
+        (JSC::ConsoleClient::logWithLevel):
+        (JSC::ConsoleClient::clear):
+        (JSC::ConsoleClient::dir):
+        (JSC::ConsoleClient::dirXML):
+        (JSC::ConsoleClient::table):
+        (JSC::ConsoleClient::trace):
+        (JSC::ConsoleClient::assertCondition):
+        (JSC::ConsoleClient::group):
+        (JSC::ConsoleClient::groupCollapsed):
+        (JSC::ConsoleClient::groupEnd):
+        * runtime/JSNativeStdFunction.cpp:
+        (JSC::JSNativeStdFunction::create):
+        * runtime/JSString.h:
+        (JSC::jsNontrivialString):
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::join):
+        * runtime/JSStringJoiner.h:
+        (JSC::JSStringJoiner::append):
+        * runtime/NativeStdFunctionCell.cpp:
+        (JSC::NativeStdFunctionCell::create):
+        (JSC::NativeStdFunctionCell::NativeStdFunctionCell):
+        * runtime/ScopedArgumentsTable.cpp:
+        (JSC::ScopedArgumentsTable::setLength):
+        * runtime/StructureIDTable.cpp:
+        (JSC::StructureIDTable::resize):
+        * runtime/TypeSet.cpp:
+        (JSC::StructureShape::inspectorRepresentation):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        * tools/CodeProfile.h:
+        (JSC::CodeProfile::addChild):
+        * yarr/YarrInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
+        * yarr/YarrInterpreter.h:
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        * yarr/YarrPattern.cpp:
+        (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
+        (JSC::Yarr::YarrPatternConstructor::reset):
+        (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::YarrPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::YarrPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::YarrPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::YarrPatternConstructor::copyDisjunction):
+
+2016-01-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix copyright dates. It's super annoying when we forget to update these, and I
+        just forgot to do so in the last commit. Also update the date of the last commit in the
+        ChangeLog.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirTmpWidth.cpp:
+        * b3/air/AirTmpWidth.h:
+        * ftl/FTLB3Output.cpp:
+        * ftl/FTLB3Output.h:
+
+2016-01-01  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be able to run all of the old V8v7 tests
+        https://bugs.webkit.org/show_bug.cgi?id=152579
+
+        Reviewed by Saam Barati.
+
+        Fixes some silly bugs that were preventing us from running all of the old V8v7 tests.
+
+        IRC's analysis of when to turn a Move into a Move32 when spilling is based on the premise
+        that if the dst has a 32-bit def width, then the src must also have a 32-bit def width. But
+        that doesn't happen if the src is an immediate.
+
+        This changes that condition in IRC to use the combined use/def width of both src and dst
+        rather than being clever. This is great because it's the combined width that determines the
+        size of the spill slot.
+
+        Also added some more debug support to TmpWidth.
+
+        This also fixes Air's description of DivDouble; previously it claimed to be a 32-bit
+        operation. Also implements Output::unsignedToDouble(), since we already had everything we
+        needed to implement this optimally.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirTmpWidth.cpp:
+        (JSC::B3::Air::TmpWidth::recompute):
+        (JSC::B3::Air::TmpWidth::Widths::dump):
+        * b3/air/AirTmpWidth.h:
+        (JSC::B3::Air::TmpWidth::Widths::Widths):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::doubleToUInt):
+        (JSC::FTL::Output::unsignedToDouble):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::zeroExtPtr):
+        (JSC::FTL::Output::intToDouble):
+        (JSC::FTL::Output::castToInt32):
+        (JSC::FTL::Output::unsignedToDouble): Deleted.
+
+2016-01-01  Jeff Miller  <jeffm@apple.com>
+
+        Update user-visible copyright strings to include 2016
+        https://bugs.webkit.org/show_bug.cgi?id=152531
+
+        Reviewed by Alexey Proskuryakov.
+
+        * Info.plist:
+
+2015-12-31  Andy Estes  <aestes@apple.com>
+
+        Fix warnings uncovered by migrating to WTF_MOVE
+        https://bugs.webkit.org/show_bug.cgi?id=152601
+
+        Reviewed by Daniel Bates.
+
+        * create_regex_tables: Moving a return value prevented copy elision.
+        * ftl/FTLUnwindInfo.cpp:
+        (JSC::FTL::parseUnwindInfo): Ditto.
+        * replay/EncodedValue.h: Ditto.
+
+2015-12-30  Aleksandr Skachkov  <gskachkov@gmail.com>
+
+        [ES6] Arrow function syntax. Arrow function specific features. Lexical bind "super"
+        https://bugs.webkit.org/show_bug.cgi?id=149615
+
+        Reviewed by Saam Barati.
+
+        Implemented lexical bind "super" property for arrow function. 'super' property can be accessed 
+        inside of the arrow function in case if arrow function is nested in constructor, method, 
+        getter or setter of class. In current patch using 'super' in arrow function, that declared out of the 
+        class, lead to wrong type of error, should be SyntaxError(https://bugs.webkit.org/show_bug.cgi?id=150893) 
+        and this will be fixed in separete patch.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::getSlow):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::derivedContextType):
+        (JSC::ExecutableInfo::isClassContext):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::derivedContextType):
+        (JSC::UnlinkedCodeBlock::isClassContext):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::derivedContextType):
+        (JSC::BytecodeGenerator::isDerivedConstructorContext):
+        (JSC::BytecodeGenerator::isDerivedClassContext):
+        (JSC::BytecodeGenerator::isArrowFunction):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::emitHomeObjectForCallee):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::derivedContextType):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * tests/es6.yaml:
+        * tests/stress/arrowfunction-lexical-bind-superproperty.js: Added.
+
+2015-12-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Unreviewed, relax limitation in operationCreateThis
+        https://bugs.webkit.org/show_bug.cgi?id=152383
+
+        Unreviewed. operationCreateThis now can be called with non constructible function.
+
+        * dfg/DFGOperations.cpp:
+
+2015-12-29  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6][ES7] Drop Constructability of generator function
+        https://bugs.webkit.org/show_bug.cgi?id=152383
+
+        Reviewed by Saam Barati.
+
+        We drop the constructability of generator functions.
+        This functionality is already landed in ES 2016 draft[1].
+        And this simplifies the existing JSC's generator implementation;
+        dropping GeneratorThisMode flag.
+
+        [1]: https://github.com/tc39/ecma262/releases/tag/es2016-draft-20151201
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::generatorThisMode): Deleted.
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock): Deleted.
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::generatorThisMode): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::makeFunction):
+        (JSC::BytecodeGenerator::generatorThisMode): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval): Deleted.
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/Executable.h:
+        * runtime/GeneratorThisMode.h: Removed.
+        * tests/stress/generator-eval-this.js:
+        (shouldThrow):
+        * tests/stress/generator-is-not-constructible.js: Added.
+        (shouldThrow):
+        (A.staticGen):
+        (A.prototype.gen):
+        (A):
+        (TypeError):
+        * tests/stress/generator-this.js:
+        (shouldBe.g.next):
+        * tests/stress/generator-with-new-target.js:
+        (shouldThrow):
+
+2015-12-27  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should know that used registers are not the same thing as used registers. Rename the
+        latter to unavailable registers to avoid future confusion.
+        https://bugs.webkit.org/show_bug.cgi?id=152572
+
+        Reviewed by Saam Barati.
+
+        Prior to this change, we used the term "used registers" in two different senses:
+
+        - The set of registers that are live at some point in the current compilation unit. A
+          register is live at some point if it is read after that point on some path through that
+          point.
+
+        - The set of registers that are not available for scratch register use at some point. A
+          register may not be available if it is live or if it is a callee-save register but it is
+          not being saved by the current compilation.
+
+        In the old FTL LLVM code, we had some translations from the first sense into the second
+        sense. We forgot to do those in FTL B3, and so we get crashes, for example in V8/splay. That
+        benchmark highlighted this issue because it fired some lazy slow paths, and then used an
+        unsaved callee-save for scratch.
+ 
+        Curiously, we could merge these two definitions by observing that, in some sense, an unsaved
+        callee save is live at every point in a compilation in the sense that it may contain a value
+        that will be read when the compilation returns. That's pretty cool, but it feels strange to
+        me. This isn't how we would normally define liveness of registers. It's not how the
+        Air::TmpLiveness analysis would do it for any of its other clients.
+
+        So, this changes B3 to have two different concepts:
+
+        - Used registers. These are the registers that are live.
+
+        - Unavailable registers. These are the registers that are not available for scratch. It's
+          always a superset of used registers.
+
+        This also changes FTLLower to use unavailableRegisters() pretty much everywhere that it
+        previously used usedRegisters().
+
+        This makes it possible to run V8/splay.
+
+        * b3/B3StackmapGenerationParams.cpp:
+        (JSC::B3::StackmapGenerationParams::usedRegisters):
+        (JSC::B3::StackmapGenerationParams::unavailableRegisters):
+        (JSC::B3::StackmapGenerationParams::proc):
+        * b3/B3StackmapGenerationParams.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+
+2015-12-25  Andy Estes  <aestes@apple.com>
+
+        Stop moving local objects in return statements
+        https://bugs.webkit.org/show_bug.cgi?id=152557
+
+        Reviewed by Brady Eidson.
+
+        Calling std::move() on a local object in a return statement prevents the compiler from applying the return value optimization.
+
+        Clang can warn about these mistakes with -Wpessimizing-move, although only when std::move() is called directly.
+        I found these issues by temporarily replacing WTF::move with std::move and recompiling.
+
+        * inspector/ScriptCallStack.cpp:
+        (Inspector::ScriptCallStack::buildInspectorArray):
+        * inspector/agents/InspectorScriptProfilerAgent.cpp:
+        (Inspector::buildInspectorObject):
+        * jit/CallFrameShuffler.h:
+        (JSC::CallFrameShuffler::snapshot):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::allStructureRepresentations):
+        (JSC::StructureShape::inspectorRepresentation):
+
+2015-12-26  Mark Lam  <mark.lam@apple.com>
+
+        Rename NodeMayOverflowInXXX to NodeMayOverflowInt32InXXX.
+        https://bugs.webkit.org/show_bug.cgi?id=152555
+
+        Reviewed by Alex Christensen.
+
+        That's because the NodeMayOverflowInBaseline and NodeMayOverflowInDFG flags only
+        indicates potential overflowing of Int32 values.  We'll be adding overflow
+        profiling for Int52 values later, and we should disambiguate between the 2 types.
+
+        This is purely a renaming patch.  There are no semantic changes.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeSafe):
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGNodeFlags.cpp:
+        (JSC::DFG::dumpNodeFlags):
+        * dfg/DFGNodeFlags.h:
+        (JSC::DFG::nodeMayOverflowInt32):
+        (JSC::DFG::nodeCanSpeculateInt32):
+        (JSC::DFG::nodeMayOverflow): Deleted.
+
+2015-12-23  Andreas Kling  <akling@apple.com>
+
+        jsc CLI tool crashes on EOF.
+        <https://webkit.org/b/152522>
+
+        Reviewed by Benjamin Poulain.
+
+        SourceProvider should treat String() like the empty string for hashing purposes.
+        This was a subtle behavior change in r194017 due to how zero-length strings are
+        treated by StringImpl::createSubstringSharingImpl().
+
+        I made these SourceProviders store a Ref<StringImpl> internally instead of a
+        String, to codify the fact that these strings can't be null strings.
+
+        I couldn't find a way to cause this crash through the API.
+
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::OpaqueJSScript):
+        * parser/SourceProvider.h:
+        (JSC::StringSourceProvider::StringSourceProvider):
+
+2015-12-23  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be able to run crypto-sha1 in eager mode
+        https://bugs.webkit.org/show_bug.cgi?id=152539
+
+        Reviewed by Saam Barati.
+
+        This patch contains one real bug fix and some other fixes that are primarily there for sanity
+        because I don't believe they are symptomatic.
+
+        The real fix is the instruction selector's handling of Phi. It was assuming that the correct
+        lowering of Phi is to do nothing and the correct lowering of Upsilon is to store into the tmp
+        that the Phi uses. But this fails for code patterns like:
+
+            @a = Phi()
+            Upsilon(@x, ^a)
+            use(@a) // this should see the value that @a had at the point that "@a = Phi()" executed.
+
+        This arises when we have a lot of Upsilons in a row and they are trying to perform a
+        shuffling. Prior to this change, "use(@a)" would see the new value of @a, i.e. @x. That's
+        wrong. So, this changes the lowering to make each Phi have a special shadow Tmp, and Upsilon
+        stores to it while Phi loads from it. Most of these assignments get copy-propagated by IRC,
+        so it doesn't really hurt us. I couldn't find any benchmarks that slowed down because of
+        this. In fact, I believe that the only time that this would lead to extra interference or
+        extra assignments is when it's actually needed to be correct.
+
+        This also contains other fixes, which are probably not for real bugs, but they make me feel
+        all warm and fuzzy:
+
+        - spillEverything() works again.  Previously, it didn't have all of IRC's smarts for handling
+          a spill of a ZDef.  I fixed this by creating a helper phase that finds all subwidth ZDefs
+          to spill slots and amends them with zero-fills of the top bits.
+
+        - IRC no longer requires precise TmpWidth analysis.  Previously, if TmpWidth gave pessimistic
+          results, the subwidth ZDef bug would return.  That probably means that it was never fixed
+          to begin with, since it's totally cool for just a single def or use of a tmp to cause it
+          to become pessimistic. But there may still have been some subwidth ZDefs.  The way that I
+          fixed this bug is to have IRC also run the ZDef fixup code that spillEverything() uses.
+          This is abstracted behind the beautifully named Air::fixSpillSlotZDef().
+
+        - B3::validate() does dominance checks!  So, if you shoot yourself in the foot by using
+          something before defining it, validate() will tell you.
+
+        - Air::TmpWidth is now easy to "turn off" - i.e. to make it go fully conservative. It's not
+          an Option; you have to hack code. But that's better than nothing, and it's consistent with
+          what we do for other super-internal compiler options that we use rarely.
+
+        - You can now run spillEverything() without hacking code.  Just use
+          Options::airSpillSeverything().
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::LowerToAir):
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Validate.cpp:
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::specials):
+        (JSC::B3::Air::Code::forAllTmps):
+        (JSC::B3::Air::Code::isFastTmp):
+        * b3/air/AirFixSpillSlotZDef.h: Added.
+        (JSC::B3::Air::fixSpillSlotZDef):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/air/AirTmpWidth.cpp:
+        (JSC::B3::Air::TmpWidth::recompute):
+        * jit/JITOperations.cpp:
+        * runtime/Options.h:
+
+2015-12-23  Filip Pizlo  <fpizlo@apple.com>
+
+        Need a story for platform-specific Args
+        https://bugs.webkit.org/show_bug.cgi?id=152529
+
+        Reviewed by Michael Saboff.
+
+        This teaches Arg that some Arg forms are not valid on some targets. The instruction selector now
+        uses this to avoid immediates and addresses that the target wouldn't like.
+
+        This shouldn't change code generation on X86, but is meant as a step towards ARM64 support.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::crossesInterference):
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+        (JSC::B3::Air::LowerToAir::addr):
+        (JSC::B3::Air::LowerToAir::loadPromise):
+        (JSC::B3::Air::LowerToAir::imm):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::Arg):
+        (JSC::B3::Air::Arg::imm):
+        (JSC::B3::Air::Arg::imm64):
+        (JSC::B3::Air::Arg::callArg):
+        (JSC::B3::Air::Arg::isValidScale):
+        (JSC::B3::Air::Arg::tmpIndex):
+        (JSC::B3::Air::Arg::withOffset):
+        (JSC::B3::Air::Arg::isValidImmForm):
+        (JSC::B3::Air::Arg::isValidAddrForm):
+        (JSC::B3::Air::Arg::isValidIndexForm):
+        (JSC::B3::Air::Arg::isValidForm):
+        (JSC::B3::Air::Arg::forEachTmpFast):
+        * b3/air/opcode_generator.rb:
+
+2015-12-23  Keith Miller  <keith_miller@apple.com>
+
+        [JSC] Bugfix for intrinsic getters with dictionary structures.
+        https://bugs.webkit.org/show_bug.cgi?id=152538
+
+        Reviewed by Mark Lam.
+
+        Intrinsic getters did not check if an object was a dictionary. This meant, if a property on
+        the prototype chain of a dictionary was an intrinsic getter we would IC it. Later, if a
+        property is added to the dictionary the IC would still return the result of the intrinsic.
+        The fix is to no longer IC intrinsic getters if the base object is a dictionary.
+
+        * jit/Repatch.cpp:
+        (JSC::tryCacheGetByID):
+        * tests/stress/typedarray-length-dictionary.js: Added.
+        (len):
+
+2015-12-23  Andy VanWagoner  <andy@instructure.com>
+
+        [INTL] Implement DateTime Format Functions
+        https://bugs.webkit.org/show_bug.cgi?id=147606
+
+        Reviewed by Benjamin Poulain.
+
+        Initialize a UDateFormat from the generated pattern. Use udat_format()
+        to format the value. Make sure that the UDateFormat is cleaned up when
+        the DateTimeFormat is deconstructed.
+
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::~IntlDateTimeFormat):
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        (JSC::IntlDateTimeFormat::format):
+        * runtime/IntlDateTimeFormat.h:
+
+2015-12-23  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement String.prototype.localeCompare in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147607
+
+        Reviewed by Benjamin Poulain.
+
+        Add localeCompare in builtin JavaScript that delegates comparing to Intl.Collator.
+        Keep existing native implementation for use if INTL flag is disabled.
+        For the common case where no locale or options are specified, avoid creating
+        a new collator and just use the prototype which is initialized with the defaults.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/StringPrototype.js: Added.
+        (localeCompare):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2015-12-23  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix x86_64 after r194388
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendShift):
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::lowerX86Div):
+
+2015-12-23  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Get the JavaScriptCore framework to build on ARM64 with B3 enabled
+        https://bugs.webkit.org/show_bug.cgi?id=152503
+
+        Reviewed by Filip Pizlo.
+
+        It is not working but it builds.
+
+        * assembler/ARM64Assembler.h:
+        (JSC::ARM64Assembler::vand):
+        (JSC::ARM64Assembler::vectorDataProcessing2Source):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::add32):
+        (JSC::MacroAssemblerARM64::add64):
+        (JSC::MacroAssemblerARM64::countLeadingZeros64):
+        (JSC::MacroAssemblerARM64::not32):
+        (JSC::MacroAssemblerARM64::not64):
+        (JSC::MacroAssemblerARM64::zeroExtend16To32):
+        (JSC::MacroAssemblerARM64::signExtend16To32):
+        (JSC::MacroAssemblerARM64::zeroExtend8To32):
+        (JSC::MacroAssemblerARM64::signExtend8To32):
+        (JSC::MacroAssemblerARM64::addFloat):
+        (JSC::MacroAssemblerARM64::ceilFloat):
+        (JSC::MacroAssemblerARM64::branchDouble):
+        (JSC::MacroAssemblerARM64::branchFloat):
+        (JSC::MacroAssemblerARM64::divFloat):
+        (JSC::MacroAssemblerARM64::moveZeroToDouble):
+        (JSC::MacroAssemblerARM64::moveFloatTo32):
+        (JSC::MacroAssemblerARM64::move32ToFloat):
+        (JSC::MacroAssemblerARM64::moveConditionallyDouble):
+        (JSC::MacroAssemblerARM64::moveConditionallyFloat):
+        (JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
+        (JSC::MacroAssemblerARM64::mulFloat):
+        (JSC::MacroAssemblerARM64::andDouble):
+        (JSC::MacroAssemblerARM64::andFloat):
+        (JSC::MacroAssemblerARM64::sqrtFloat):
+        (JSC::MacroAssemblerARM64::subFloat):
+        (JSC::MacroAssemblerARM64::signExtend32ToPtr):
+        (JSC::MacroAssemblerARM64::moveConditionally32):
+        (JSC::MacroAssemblerARM64::moveConditionally64):
+        (JSC::MacroAssemblerARM64::moveConditionallyTest32):
+        (JSC::MacroAssemblerARM64::moveConditionallyTest64):
+        (JSC::MacroAssemblerARM64::test32):
+        (JSC::MacroAssemblerARM64::setCarry):
+        (JSC::MacroAssemblerARM64::jumpAfterFloatingPointCompare):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::moveDoubleToInts):
+        (JSC::MacroAssemblerX86::moveIntsToDouble):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move32ToFloat):
+        (JSC::MacroAssemblerX86Common::moveFloatTo32):
+        (JSC::MacroAssemblerX86Common::moveInt32ToPacked): Deleted.
+        (JSC::MacroAssemblerX86Common::movePackedToInt32): Deleted.
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendShift):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::isX86DivHelperValid):
+        * b3/air/AirOpcode.opcodes:
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::emitFunctionEpilogueWithEmptyFrame):
+        (JSC::AssemblyHelpers::emitFunctionEpilogue):
+        * jit/FPRInfo.h:
+        (JSC::FPRInfo::toArgumentRegister):
+
+2015-12-23  Andy VanWagoner  <andy@instructure.com>
+
+        [INTL] Implement Intl.DateTimeFormat.prototype.resolvedOptions ()
+        https://bugs.webkit.org/show_bug.cgi?id=147603
+
+        Reviewed by Benjamin Poulain.
+
+        Implements InitializeDateTimeFormat and related abstract operations
+        using ICU. Lazy initialization is used for DateTimeFormat.prototype.
+        Refactor to align with Collator work.
+
+        * icu/unicode/udatpg.h: Added.
+        * icu/unicode/unumsys.h: Added.
+        * runtime/CommonIdentifiers.h:
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::defaultTimeZone):
+        (JSC::canonicalizeTimeZoneName):
+        (JSC::localeData):
+        (JSC::toDateTimeOptions):
+        (JSC::IntlDateTimeFormat::setFormatsFromPattern):
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        (JSC::IntlDateTimeFormat::weekdayString):
+        (JSC::IntlDateTimeFormat::eraString):
+        (JSC::IntlDateTimeFormat::yearString):
+        (JSC::IntlDateTimeFormat::monthString):
+        (JSC::IntlDateTimeFormat::dayString):
+        (JSC::IntlDateTimeFormat::hourString):
+        (JSC::IntlDateTimeFormat::minuteString):
+        (JSC::IntlDateTimeFormat::secondString):
+        (JSC::IntlDateTimeFormat::timeZoneNameString):
+        (JSC::IntlDateTimeFormat::resolvedOptions):
+        (JSC::IntlDateTimeFormat::format):
+        (JSC::IntlDateTimeFormatFuncFormatDateTime): Deleted.
+        * runtime/IntlDateTimeFormat.h:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        (JSC::callIntlDateTimeFormat):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatFuncFormatDateTime):
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObject.cpp:
+        (JSC::resolveLocale):
+        (JSC::getNumberingSystemsForLocale):
+        * runtime/IntlObject.h:
+
+2015-12-22  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(194382): FTL B3 no longer runs V8/encrypt
+        https://bugs.webkit.org/show_bug.cgi?id=152519
+
+        Reviewed by Saam Barati.
+
+        A "Move Imm, Tmp" instruction should turn into "Move32 Imm, Tmp" if the Tmp is spilled to a
+        32-bit slot. Changing where we check isTmp() achieves this. Since all of the logic is only
+        relevant to when we spill without introducing a Tmp, and since a Move does not have a "Move Addr,
+        Addr" form, this code ensures that the logic only happens for "Tmp, Tmp" and "Imm, Tmp".
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * dfg/DFGOperations.cpp:
+
+2015-12-22  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should use the right type for comparison slow paths
+        https://bugs.webkit.org/show_bug.cgi?id=152521
+
+        Reviewed by Saam Barati.
+
+        Fixes a small goof that was leading to B3 validation failures.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::nonSpeculativeCompare):
+
+2015-12-22  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be able to run richards
+        https://bugs.webkit.org/show_bug.cgi?id=152514
+
+        Reviewed by Michael Saboff.
+
+        This came down to a liveness bug and a register allocation bug.
+
+        The liveness bug was that the code that determined whether we should go around the fixpoint
+        assumed that BitVector::quickSet() would return true if the bit changed state from false to
+        true. That's not how it works. It returns the old value of the bit, so it will return false
+        if the bit changed from false to true. Since there is already a lot of code that relies on
+        this behavior, I fixed Liveness instead of changing BitVector.
+
+        The register allocation bug was that we weren't guarding some checks of tmp()'s with checks
+        that the Arg isTmp().
+
+        The liveness took a long time to track down, and I needed to add a lot of dumping to do it.
+        It's now possible to dump more of the liveness states, including liveAtHead. I found this
+        extremely helpful, so I removed the code that cleared liveAtHead.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
+        (JSC::B3::Air::AbstractLiveness::Iterable::Iterable):
+        (JSC::B3::Air::AbstractLiveness::Iterable::iterator::iterator):
+        (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator*):
+        (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator++):
+        (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator==):
+        (JSC::B3::Air::AbstractLiveness::Iterable::iterator::operator!=):
+        (JSC::B3::Air::AbstractLiveness::Iterable::begin):
+        (JSC::B3::Air::AbstractLiveness::Iterable::end):
+        (JSC::B3::Air::AbstractLiveness::liveAtHead):
+        (JSC::B3::Air::AbstractLiveness::liveAtTail):
+        * b3/air/AirStackSlot.h:
+        (WTF::printInternal):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+
+2015-12-22  Saam barati  <sbarati@apple.com>
+
+        Cloop build fix after https://bugs.webkit.org/show_bug.cgi?id=152511.
+
+        Unreviewed build fix.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2015-12-22  Saam barati  <sbarati@apple.com>
+
+        Work around issue in bug #152510
+        https://bugs.webkit.org/show_bug.cgi?id=152511
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+
+2015-12-22  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 does not logicalNot correctly
+        https://bugs.webkit.org/show_bug.cgi?id=152512
+
+        Reviewed by Saam Barati.
+
+        I'm working on a bug where V8/richards does not run correctly. I noticed that the codegen was
+        doing a log of Not32's followed by branches, which smelled like badness. To debug this, I
+        needed B3's origins to dump as something other than a hexed pointer to a node. The node index
+        would be better. So, I added the notion of an origin printer to Procedure.
+
+        The bug was easy enough to fix. This introduces Output::logicalNot(). In LLVM, it's the same
+        as bitNot(). In B3, it's compiled to Equal(value, 0). We could have also compiled it to
+        BitXor(value, 1), except that B3 will strength-reduce to that anyway whenever it's safe. It's
+        sort of nice that right now, you could use logicalNot() on non-bool values and get C-like
+        behavior.
+
+        Richards still doesn't run, though. There are more bugs!
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3BasicBlock.cpp:
+        (JSC::B3::BasicBlock::dump):
+        (JSC::B3::BasicBlock::deepDump):
+        * b3/B3BasicBlock.h:
+        (JSC::B3::BasicBlock::frequency):
+        (JSC::B3::DeepBasicBlockDump::DeepBasicBlockDump):
+        (JSC::B3::DeepBasicBlockDump::dump):
+        (JSC::B3::deepDump):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Origin.h:
+        (JSC::B3::Origin::data):
+        * b3/B3OriginDump.h: Added.
+        (JSC::B3::OriginDump::OriginDump):
+        (JSC::B3::OriginDump::dump):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::~Procedure):
+        (JSC::B3::Procedure::printOrigin):
+        (JSC::B3::Procedure::addBlock):
+        (JSC::B3::Procedure::dump):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::setOriginPrinter):
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::dumpChildren):
+        (JSC::B3::Value::deepDump):
+        * b3/B3Value.h:
+        (JSC::B3::DeepValueDump::DeepValueDump):
+        (JSC::B3::DeepValueDump::dump):
+        (JSC::B3::deepDump):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::lockedStackSlot):
+        (JSC::FTL::Output::bitNot):
+        (JSC::FTL::Output::logicalNot):
+        (JSC::FTL::Output::load):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::ctlz32):
+        (JSC::FTL::Output::addWithOverflow32):
+        (JSC::FTL::Output::lessThanOrEqual):
+        (JSC::FTL::Output::doubleEqual):
+        (JSC::FTL::Output::doubleEqualOrUnordered):
+        (JSC::FTL::Output::doubleNotEqualOrUnordered):
+        (JSC::FTL::Output::doubleLessThan):
+        (JSC::FTL::Output::doubleLessThanOrEqual):
+        (JSC::FTL::Output::doubleGreaterThan):
+        (JSC::FTL::Output::doubleGreaterThanOrEqual):
+        (JSC::FTL::Output::doubleNotEqualAndOrdered):
+        (JSC::FTL::Output::doubleLessThanOrUnordered):
+        (JSC::FTL::Output::doubleLessThanOrEqualOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrUnordered):
+        (JSC::FTL::Output::doubleGreaterThanOrEqualOrUnordered):
+        (JSC::FTL::Output::isZero32):
+        (JSC::FTL::Output::notZero32):
+        (JSC::FTL::Output::addIncomingToPhi):
+        (JSC::FTL::Output::bitCast):
+        (JSC::FTL::Output::bitNot): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetTypedArrayByteOffset):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileLogicalNot):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInstanceOfCustom):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCountExecution):
+        (JSC::FTL::DFG::LowerDFGToLLVM::boolify):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isMisc):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isNotBoolean):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isBoolean):
+        (JSC::FTL::DFG::LowerDFGToLLVM::unboxBoolean):
+        (JSC::FTL::DFG::LowerDFGToLLVM::isNotType):
+        (JSC::FTL::DFG::LowerDFGToLLVM::speculateObject):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::aShr):
+        (JSC::FTL::Output::lShr):
+        (JSC::FTL::Output::bitNot):
+        (JSC::FTL::Output::logicalNot):
+        (JSC::FTL::Output::insertElement):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+
+2015-12-22  Keith Miller  <keith_miller@apple.com>
+
+        Remove OverridesHasInstance from TypeInfoFlags
+        https://bugs.webkit.org/show_bug.cgi?id=152005
+
+        Reviewed by Saam Barati.
+
+        Currently, we have three TypeInfo flags associated with instanceof behavior,
+        ImplementsHasInstance, ImplementDefaultHasInstance, and OverridesHasInstance. This patch
+        removes the third and moves the first to the out of line flags. In theory, we should only
+        need one flag but removing ImplementsHasInstance is more involved and should be done in a
+        separate patch.
+
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackObject.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_overrides_has_instance):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_overrides_has_instance):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/InternalFunction.h:
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCallee.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::implementsHasInstance):
+        (JSC::TypeInfo::TypeInfo): Deleted.
+        (JSC::TypeInfo::overridesHasInstance): Deleted.
+        * runtime/NumberConstructor.h:
+
+2015-12-22  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do tail calls
+        https://bugs.webkit.org/show_bug.cgi?id=152494
+
+        Reviewed by Michael Saboff.
+
+        OMG this was so easy.
+
+        The only shady part is that I broke a layering rule that we had so far been following: B3 was
+        sitting below the JSC runtime, and did not use JS-specific types. No more, since B3::ValueRep
+        can now turn itself into a ValueRecovery for a JSValue. This small feature makes a huge
+        difference for the readability of tail call code: it makes it plain that the call frame
+        shuffler is basically just directly consuming the stackmap generation params, and insofar as
+        there is any data transformation, it's just because it uses different classes to say the same
+        thing.
+
+        I think we should avoid adding too many JS-specific things to B3. But, so long as it's still
+        possible to use B3 to compile things that aren't JS, I think we'll be fine.
+
+        * b3/B3ValueRep.cpp:
+        (JSC::B3::ValueRep::dump):
+        (JSC::B3::ValueRep::emitRestore):
+        (JSC::B3::ValueRep::recoveryForJSValue):
+        * b3/B3ValueRep.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileTailCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        * test/stress/ftl-tail-call.js: Added.
+
+2015-12-21  Mark Lam  <mark.lam@apple.com>
+
+        Snippefy op_negate for the baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=152447
+
+        Reviewed by Benjamin Poulain.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_unsigned):
+        (JSC::JIT::emit_op_negate):
+        (JSC::JIT::emitSlow_op_negate):
+        (JSC::JIT::emitBitBinaryOpFastPath):
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_compareAndJump):
+        (JSC::JIT::emit_op_negate): Deleted.
+        (JSC::JIT::emitSlow_op_negate): Deleted.
+        * jit/JITNegGenerator.cpp: Added.
+        (JSC::JITNegGenerator::generateFastPath):
+        * jit/JITNegGenerator.h: Added.
+        (JSC::JITNegGenerator::JITNegGenerator):
+        (JSC::JITNegGenerator::didEmitFastPath):
+        (JSC::JITNegGenerator::endJumpList):
+        (JSC::JITNegGenerator::slowPathJumpList):
+
+2015-12-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Address review feedback from Saam.  I should have landed it in r194354.
+
+        * b3/testb3.cpp:
+        (JSC::B3::testStore16Arg):
+
+2015-12-21  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be able to compile Store16
+        https://bugs.webkit.org/show_bug.cgi?id=152493
+
+        Reviewed by Saam Barati.
+
+        This adds comprehensive Store16 support to our assembler, Air, and B3->Air lowering.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::store16):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movb_rm):
+        (JSC::X86Assembler::movw_rm):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testStorePartial8BitRegisterOnX86):
+        (JSC::B3::testStore16Arg):
+        (JSC::B3::testStore16Imm):
+        (JSC::B3::testTrunc):
+        (JSC::B3::run):
+
+2015-12-21  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, remove highBitsAreZero(), it's unused.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        (JSC::B3::Air::LowerToAir::shouldCopyPropagate):
+        (JSC::B3::Air::LowerToAir::highBitsAreZero): Deleted.
+
+2015-12-21  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed, fix the !FTL_USES_B3 build after r194334.
+
+        * ftl/FTLLowerDFGToLLVM.cpp: Mark forwarding unused variable.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+
+2015-12-21  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do doubleToInt32
+        https://bugs.webkit.org/show_bug.cgi?id=152484
+
+        Reviewed by Saam Barati.
+
+        We used to have a DToI32 opcode in B3 that we never implemented. This removes that opcode,
+        since double-to-int conversion has dramatically different semantics on different
+        architectures. We let FTL get the conversion instruction it wants by using a patchpoint.
+
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::materialize):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::appendTo):
+        (JSC::FTL::Output::lockedStackSlot):
+        (JSC::FTL::Output::load):
+        (JSC::FTL::Output::doublePowi):
+        (JSC::FTL::Output::hasSensibleDoubleToInt):
+        (JSC::FTL::Output::doubleToInt):
+        (JSC::FTL::Output::doubleToUInt):
+        (JSC::FTL::Output::load8SignExt32):
+        (JSC::FTL::Output::load8ZeroExt32):
+        (JSC::FTL::Output::load16SignExt32):
+        (JSC::FTL::Output::load16ZeroExt32):
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::store32As8):
+        (JSC::FTL::Output::store32As16):
+        (JSC::FTL::Output::branch):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleLog):
+        (JSC::FTL::Output::signExt32To64):
+        (JSC::FTL::Output::zeroExt):
+        (JSC::FTL::Output::zeroExtPtr):
+        (JSC::FTL::Output::intToDouble):
+        (JSC::FTL::Output::unsignedToDouble):
+        (JSC::FTL::Output::castToInt32):
+        (JSC::FTL::Output::hasSensibleDoubleToInt): Deleted.
+        (JSC::FTL::Output::sensibleDoubleToInt): Deleted.
+        (JSC::FTL::Output::fpToInt32): Deleted.
+        (JSC::FTL::Output::fpToUInt32): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithPow):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileSwitch):
+        (JSC::FTL::DFG::LowerDFGToLLVM::doubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToLLVM::sensibleDoubleToInt32):
+        (JSC::FTL::DFG::LowerDFGToLLVM::convertDoubleToInt32):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::hasSensibleDoubleToInt):
+        (JSC::FTL::Output::doubleToInt):
+        (JSC::FTL::Output::doubleToUInt):
+        (JSC::FTL::Output::signExt32To64):
+        (JSC::FTL::Output::zeroExt):
+
+2015-12-21  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        Unexpected exception assigning to this._property inside arrow function
+        https://bugs.webkit.org/show_bug.cgi?id=152028
+
+        Reviewed by Saam Barati.
+
+        The issue appeared in case if in arrow function created base-level lexical envioronment, and in this case 
+        |this| value was loaded from wrong scope. The problem was that loading of the |this| happened too early when
+        compiling bytecode because the bytecode generators's scope stack wasn't in sync with runtime scope stack.
+        To fix issue loading of |this| was moved after initializeDefaultParameterValuesAndSetupFunctionScopeStack 
+        in BytecodeGenerator.cpp   
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * tests/stress/arrowfunction-lexical-bind-this-2.js:
+
+2015-12-21  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do vararg calls
+        https://bugs.webkit.org/show_bug.cgi?id=152468
+
+        Reviewed by Benjamin Poulain.
+
+        This adds FTL->B3 lowering of all kinds of varargs calls - forwarding or not, tail or not,
+        and construct or not. Like all other such lowerings, all of the code is in one place in
+        FTLLower.
+
+        I removed code for varargs and exception spill slots from the B3 path, since it won't need
+        it. The plan is to rely on B3 doing the spilling for us by using some combination of early
+        clobber and late use.
+
+        This adds ValueRep::emitRestore(), a helpful method for emitting code to restore any ValueRep
+        into any 64-bit Reg (FPR or GPR).
+
+        I wrote new tests for vararg calls, because I wasn't sure which of the existing ones we can
+        run. These are short-running tests, so I'm not worried about bloating our test suite.
+
+        * b3/B3ValueRep.cpp:
+        (JSC::B3::ValueRep::dump):
+        (JSC::B3::ValueRep::emitRestore):
+        * b3/B3ValueRep.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstructVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        * ftl/FTLState.h:
+        * tests/stress/varargs-no-forward.js: Added.
+        * tests/stress/varargs-simple.js: Added.
+        * tests/stress/varargs-two-level.js: Added.
+
+2015-12-18  Mark Lam  <mark.lam@apple.com>
+
+        Add unary operator tests to compare JIT and LLINT results.
+        https://bugs.webkit.org/show_bug.cgi?id=152453
+
+        Reviewed by Benjamin Poulain.
+
+        Also fixed a few things in the binary-op-test.js.
+
+        * tests/stress/op_negate.js: Added.
+        (o1.valueOf):
+        * tests/stress/op_postdec.js: Added.
+        (o1.valueOf):
+        * tests/stress/op_postinc.js: Added.
+        (o1.valueOf):
+        * tests/stress/op_predec.js: Added.
+        (o1.valueOf):
+        * tests/stress/op_preinc.js: Added.
+        (o1.valueOf):
+        * tests/stress/resources/binary-op-test.js:
+        (stringifyIfNeeded):
+        (isIdentical):
+        (run):
+        * tests/stress/resources/unary-op-test.js: Added.
+        (stringifyIfNeeded):
+        (generateBinaryTests):
+        (isIdentical):
+        (runTest):
+        (run):
+
+2015-12-21  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Unreviewed, rolling out r194328.
+
+        This change appears to have caused failures in JSC tests
+
+        Reverted changeset:
+
+        "[INTL] Implement String.prototype.localeCompare in ECMA-402"
+        https://bugs.webkit.org/show_bug.cgi?id=147607
+        http://trac.webkit.org/changeset/194328
+
+2015-12-21  Filip Pizlo  <fpizlo@apple.com>
+
+        B3->Air lowering incorrectly copy-propagates over ZExt32's
+        https://bugs.webkit.org/show_bug.cgi?id=152365
+
+        Reviewed by Benjamin Poulain.
+
+        The instruction selector thinks that Value's that return Int32's are going to always be lowered
+        to instructions that zero-extend the destination. But this isn't actually true. If you have an
+        Add32 with a destination on the stack (i.e. spilled) then it only writes 4 bytes. Then, the
+        filler will load 8 bytes from the stack at the point of use. So, the use of the Add32 will see
+        garbage in the high bits.
+
+        The fact that the spiller chose to use 8 bytes for a Tmp that gets defined by an Add32 is a
+        pretty sad bug, but:
+
+        - It's entirely up to the spiller to decide how many bytes to use for a Tmp, since we do not
+          ascribe a type to Tmps. We could ascribe types to Tmps, but then coalescing would become
+          harder. Our goal is to fix the bug while still enabling coalescing in cases like "a[i]" where
+          "i" is a 32-bit integer that is computed using operations that already do zero-extension.
+
+        - More broadly, it's strange that the instruction selector decides whether a Value will be
+          lowered to something that zero-extends. That's too constraining, since the most optimal
+          instruction selection might involve something that doesn't zero-extend in cases of spilling, so
+          the zero-extension should only happen if it's actually needed. This means that we need to
+          understand which Air instructions cause zero-extensions.
+
+        - If we know which Air instructions cause zero-extensions, then we don't need the instruction
+          selector to copy-propagate ZExt32's. We have copy-propagation in Air thanks to the register
+          allocator.
+
+        In fact, the register allocator is exactly where all of the pieces come together. It's there that
+        we want to know which operations zero-extend and which don't. It also wants to know how many bits
+        of a Tmp each instruction reads. Armed with that information, the register allocator can emit
+        more optimal spill code, use less stack space for spill slots, and coalesce Move32's. As a bonus,
+        on X86, it replaces Move's with Move32's whenever it can. On X86, Move32 is cheaper.
+
+        This fixes a crash bug in V8/encrypt. After fixing this, I only needed two minor fixes to get
+        V8/encrypt to run. We're about 10% behind LLVM on steady state throughput on this test. It
+        appears to be mostly due to excessive spilling caused by CCall slow paths. That's fixable: we
+        could make CCalls on slow paths use a variant of CCallSpecial that promises not to clobber any
+        registers, and then have it emit spill code around the call itself. LLVM probably gets this
+        optimization from its live range splitting.
+
+        I tried writing a regression test. The problem is that you need garbage on the stack for this to
+        work, and I didn't feel like writing a flaky test. It appears that running V8/encrypt will cover
+        this, so we do have coverage.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::isX86):
+        (JSC::isX86_64):
+        (JSC::optimizeForARMv7IDIVSupported):
+        (JSC::optimizeForX86):
+        (JSC::optimizeForX86_64):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::highBitsAreZero):
+        (JSC::B3::Air::LowerToAir::shouldCopyPropagate):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::forEachArg):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        * b3/B3Value.h:
+        * b3/air/AirAllocateStack.cpp:
+        (JSC::B3::Air::allocateStack):
+        * b3/air/AirArg.cpp:
+        (WTF::printInternal):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::pointerWidth):
+        (JSC::B3::Air::Arg::isAnyUse):
+        (JSC::B3::Air::Arg::isColdUse):
+        (JSC::B3::Air::Arg::isEarlyUse):
+        (JSC::B3::Air::Arg::isDef):
+        (JSC::B3::Air::Arg::isZDef):
+        (JSC::B3::Air::Arg::widthForB3Type):
+        (JSC::B3::Air::Arg::conservativeWidth):
+        (JSC::B3::Air::Arg::minimumWidth):
+        (JSC::B3::Air::Arg::bytes):
+        (JSC::B3::Air::Arg::widthForBytes):
+        (JSC::B3::Air::Arg::Arg):
+        (JSC::B3::Air::Arg::forEachTmp):
+        * b3/air/AirCCallSpecial.cpp:
+        (JSC::B3::Air::CCallSpecial::forEachArg):
+        * b3/air/AirEliminateDeadCode.cpp:
+        (JSC::B3::Air::eliminateDeadCode):
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+        (JSC::B3::Air::fixPartialRegisterStalls):
+        * b3/air/AirInst.cpp:
+        (JSC::B3::Air::Inst::hasArgEffects):
+        * b3/air/AirInst.h:
+        (JSC::B3::Air::Inst::forEachTmpFast):
+        (JSC::B3::Air::Inst::forEachTmp):
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::forEachTmpWithExtraClobberedRegs):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirLiveness.h:
+        (JSC::B3::Air::AbstractLiveness::AbstractLiveness):
+        (JSC::B3::Air::AbstractLiveness::LocalCalc::execute):
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/air/AirTmpWidth.cpp: Added.
+        (JSC::B3::Air::TmpWidth::TmpWidth):
+        (JSC::B3::Air::TmpWidth::~TmpWidth):
+        * b3/air/AirTmpWidth.h: Added.
+        (JSC::B3::Air::TmpWidth::width):
+        (JSC::B3::Air::TmpWidth::defWidth):
+        (JSC::B3::Air::TmpWidth::useWidth):
+        (JSC::B3::Air::TmpWidth::Widths::Widths):
+        * b3/air/AirUseCounts.h:
+        (JSC::B3::Air::UseCounts::UseCounts):
+        * b3/air/opcode_generator.rb:
+        * b3/testb3.cpp:
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::testCheckTrickyMegaCombo):
+        (JSC::B3::testCheckTwoMegaCombos):
+        (JSC::B3::run):
+
+2015-12-21  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement String.prototype.localeCompare in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147607
+
+        Reviewed by Darin Adler.
+
+        Add localeCompare in builtin JavaScript that delegates comparing to Intl.Collator.
+        Keep existing native implementation for use if INTL flag is disabled.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/StringPrototype.js: Added.
+        (localeCompare):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+
+2015-12-18  Filip Pizlo  <fpizlo@apple.com>
+
+        Implement compareDouble in B3/Air
+        https://bugs.webkit.org/show_bug.cgi?id=150903
+
+        Reviewed by Benjamin Poulain.
+
+        A hole in our coverage is that we don't fuse a double comparison into a branch, then we will
+        crash in the instruction selector. Obviously, we *really* want to fuse double comparisons,
+        but we can't guarantee that this will always happen.
+
+        This also removes all uses of WTF::Dominators verification, since it's extremely slow even in
+        a release build. This speeds up testb3 with validateGraphAtEachPhase=true by an order of
+        magnitude.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::moveDoubleConditionallyFloat):
+        (JSC::MacroAssembler::compareDouble):
+        (JSC::MacroAssembler::compareFloat):
+        (JSC::MacroAssembler::lea):
+        * b3/B3Dominators.h:
+        (JSC::B3::Dominators::Dominators):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createCompare):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testCompare):
+        (JSC::B3::testEqualDouble):
+        (JSC::B3::simpleFunction):
+        (JSC::B3::run):
+        * dfg/DFGDominators.h:
+        (JSC::DFG::Dominators::Dominators):
+
+2015-12-19  Dan Bernstein  <mitz@apple.com>
+
+        [Mac] WebKit contains dead source code for OS X Mavericks and earlier
+        https://bugs.webkit.org/show_bug.cgi?id=152462
+
+        Reviewed by Alexey Proskuryakov.
+
+        - Removed build setting definitions for OS X 10.9 and earlier, and simplified defintions
+          that became uniform across all OS X versions as a result:
+
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+
+        * API/JSBase.h: Removed check against __MAC_OS_X_VERSION_MIN_REQUIRED that was always true.
+
+2015-12-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Streamline Tmp indexing inside the register allocator
+        https://bugs.webkit.org/show_bug.cgi?id=152420
+
+        Reviewed by Filip Pizlo.
+
+        AirIteratedRegisterCoalescing has been accumulating a bit of mess over time.
+
+        When it started, every map addressed by Tmp was using Tmp hashing.
+        That caused massive performance problems. Everything perf sensitive was moved
+        to direct array addressing by the absolute Tmp index. This left the code
+        with half of the function using Tmp, the other half using indices.
+
+        With this patch, almost everything is moved to absolute indexing.
+        There are a few advantages to this:
+        -No more conversion churn for Floating Point registers.
+        -Most of the functions can now be shared between GP and FP.
+        -A bit of clean up since the core algorithm only deals with integers now.
+
+        This patch also changes the index type to be a template argument.
+        That will allow future specialization of "m_interferenceEdges" based
+        on the expected problem size.
+
+        Finally, the code related to the program modification (register assignment
+        and spilling) was moved to the wrapper "IteratedRegisterCoalescing".
+
+        The current split is:
+        -AbstractColoringAllocator: common core. Share as much as possible between
+         GP and FP.
+        -ColoringAllocator: the remaining parts of the algorithm, everything that
+         is specific to GP, FP.
+        -IteratedRegisterCoalescing: the "iterated" part of the algorithm.
+         Try to allocate and modify the code as needed.
+
+        The long term plan is:
+        -Move selectSpill() and the coloring loop to AbstractColoringAllocator.
+        -Specialize m_interferenceEdges to make it faster.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * b3/air/AirTmpInlines.h:
+        (JSC::B3::Air::AbsoluteTmpMapper<Arg::GP>::lastMachineRegisterIndex):
+        (JSC::B3::Air::AbsoluteTmpMapper<Arg::FP>::lastMachineRegisterIndex):
+
+2015-12-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] FTLB3Output generates some invalid ZExt32
+        https://bugs.webkit.org/show_bug.cgi?id=151905
+
+        Reviewed by Filip Pizlo.
+
+        FTLLowerDFGToLLVM calls zeroExt() to int32 in some cases.
+        We were generating ZExt32 with Int32 as return type :(
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::zeroExt):
+
+2015-12-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add EqualOrUnordered to B3
+        https://bugs.webkit.org/show_bug.cgi?id=152425
+
+        Reviewed by Mark Lam.
+
+        Add EqualOrUnordered to B3 and use it to implements
+        FTL::Output's NotEqualAndOrdered.
+
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::equalOrUnordered):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceDoubleToFloat.cpp:
+        (JSC::B3::reduceDoubleToFloat):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::equalOrUnordered):
+        (JSC::B3::Value::returnsBool):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testBranchEqualOrUnorderedArgs):
+        (JSC::B3::testBranchNotEqualAndOrderedArgs):
+        (JSC::B3::testBranchEqualOrUnorderedDoubleArgImm):
+        (JSC::B3::testBranchEqualOrUnorderedFloatArgImm):
+        (JSC::B3::testBranchEqualOrUnorderedDoubleImms):
+        (JSC::B3::testBranchEqualOrUnorderedFloatImms):
+        (JSC::B3::testBranchEqualOrUnorderedFloatWithUselessDoubleConversion):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleNotEqualAndOrdered):
+        (JSC::FTL::Output::doubleNotEqual): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::boolify):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleNotEqualAndOrdered):
+        (JSC::FTL::Output::doubleNotEqual): Deleted.
+
+2015-12-19  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] B3: Add indexed addressing when lowering BitwiseCast
+        https://bugs.webkit.org/show_bug.cgi?id=152432
+
+        Reviewed by Geoffrey Garen.
+
+        The MacroAssembler supports it, we should use it.
+
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testBitwiseCastOnDoubleInMemoryIndexed):
+        (JSC::B3::testBitwiseCastOnInt64InMemoryIndexed):
+
+2015-12-18  Andreas Kling  <akling@apple.com>
+
+        Make JSString::SafeView less of a footgun.
+        <https://webkit.org/b/152376>
+
+        Reviewed by Darin Adler.
+
+        Remove the "operator StringView()" convenience helper on JSString::SafeString since that
+        made it possible to casually turn the return value from JSString::view() into an unsafe
+        StringView local on the stack with this pattern:
+
+            StringView view = someJSValue.toString(exec)->view(exec);
+
+        The JSString* returned by toString() above will go out of scope by the end of the statement
+        and does not stick around to protect itself from garbage collection.
+
+        It will now look like this instead:
+
+            JSString::SafeView view = someJSValue.toString(exec)->view(exec);
+
+        To be extra clear, the following is not safe:
+
+            StringView view = someJSValue.toString(exec)->view(exec).get();
+
+        By the end of that statement, the JSString::SafeView goes out of scope, and the JSString*
+        is no longer protected from GC.
+
+        I added a couple of forwarding helpers to the SafeView class, and if you need a StringView
+        object from it, you can call .get() just like before.
+
+        Finally I also removed the JSString::SafeView() constructor, since nobody was instantiating
+        empty SafeView objects anyway. This way we don't have to worry about null members.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::decode):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::toNumber):
+        * runtime/JSString.h:
+        (JSC::JSString::SafeView::is8Bit):
+        (JSC::JSString::SafeView::length):
+        (JSC::JSString::SafeView::characters8):
+        (JSC::JSString::SafeView::characters16):
+        (JSC::JSString::SafeView::operator[]):
+        (JSC::JSString::SafeView::SafeView):
+        (JSC::JSString::SafeView::get):
+        (JSC::JSString::SafeView::operator StringView): Deleted.
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncNormalize):
+
+2015-12-18  Saam barati  <sbarati@apple.com>
+
+        BytecodeGenerator::pushLexicalScopeInternal and pushLexicalScope should use enums instead of bools
+        https://bugs.webkit.org/show_bug.cgi?id=152450
+
+        Reviewed by Geoffrey Garen and Joseph Pecoraro.
+
+        This makes comprehending the call sites of these functions
+        easier without looking up the header of the function.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::emitPrefillStackTDZVariables):
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::lastOpcodeID):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BlockNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::ClassExprNode::emitBytecode):
+
+2015-12-18  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        Avoid triggering clang's -Wundefined-bool-conversion
+        https://bugs.webkit.org/show_bug.cgi?id=152408
+
+        Reviewed by Mark Lam.
+
+        Add ASSERT_THIS_GC_OBJECT_LOOKS_VALID and ASSERT_THIS_GC_OBJECT_INHERITS to avoid use of
+        ASSERT(this) by ASSERT_GC_OBJECT_LOOKS_VALID and ASSERT_GC_OBJECT_INHERITS.
+
+        * heap/GCAssertions.h:
+
+2015-12-18  Mark Lam  <mark.lam@apple.com>
+
+        Replace SpecialFastCase profiles with ResultProfiles.
+        https://bugs.webkit.org/show_bug.cgi?id=152433
+
+        Reviewed by Saam Barati.
+
+        This is in preparation for upcoming work to enhance the DFG predictions to deal
+        with untyped operands.
+
+        This patch also enhances some of the arithmetic slow paths (for the LLINT and
+        baseline JIT) to collect result profiling info.  This profiling info is not put
+        to use yet. 
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpRareCaseProfile):
+        (JSC::CodeBlock::dumpResultProfile):
+        (JSC::CodeBlock::printLocationAndOp):
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::dumpValueProfiles):
+        (JSC::CodeBlock::rareCaseProfileCountForBytecodeOffset):
+        (JSC::CodeBlock::resultProfileForBytecodeOffset):
+        (JSC::CodeBlock::updateResultProfileForBytecodeOffset):
+        (JSC::CodeBlock::capabilityLevel):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::addResultProfile):
+        (JSC::CodeBlock::numberOfResultProfiles):
+        (JSC::CodeBlock::specialFastCaseProfileCountForBytecodeOffset):
+        (JSC::CodeBlock::couldTakeSpecialFastCase):
+        (JSC::CodeBlock::addSpecialFastCaseProfile): Deleted.
+        (JSC::CodeBlock::numberOfSpecialFastCaseProfiles): Deleted.
+        (JSC::CodeBlock::specialFastCaseProfile): Deleted.
+        (JSC::CodeBlock::specialFastCaseProfileForBytecodeOffset): Deleted.
+        * bytecode/ValueProfile.cpp: Added.
+        (WTF::printInternal):
+        * bytecode/ValueProfile.h:
+        (JSC::getRareCaseProfileBytecodeOffset):
+        (JSC::ResultProfile::ResultProfile):
+        (JSC::ResultProfile::bytecodeOffset):
+        (JSC::ResultProfile::specialFastPathCount):
+        (JSC::ResultProfile::didObserveNonInt32):
+        (JSC::ResultProfile::didObserveDouble):
+        (JSC::ResultProfile::didObserveNonNegZeroDouble):
+        (JSC::ResultProfile::didObserveNegZeroDouble):
+        (JSC::ResultProfile::didObserveNonNumber):
+        (JSC::ResultProfile::didObserveInt32Overflow):
+        (JSC::ResultProfile::setObservedNonNegZeroDouble):
+        (JSC::ResultProfile::setObservedNegZeroDouble):
+        (JSC::ResultProfile::setObservedNonNumber):
+        (JSC::ResultProfile::setObservedInt32Overflow):
+        (JSC::ResultProfile::addressOfFlags):
+        (JSC::ResultProfile::addressOfSpecialFastPathCount):
+        (JSC::ResultProfile::hasBits):
+        (JSC::ResultProfile::setBit):
+        (JSC::getResultProfileBytecodeOffset):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emit_op_mul):
+        * jit/JITDivGenerator.cpp:
+        (JSC::JITDivGenerator::generateFastPath):
+        * jit/JITDivGenerator.h:
+        (JSC::JITDivGenerator::JITDivGenerator):
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath):
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::JITMulGenerator):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+
+2015-12-18  Keith Miller  <keith_miller@apple.com>
+
+        verboseDFGByteCodeParsing option should show the bytecode it is parsing.
+        https://bugs.webkit.org/show_bug.cgi?id=152434
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
+2015-12-18  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Add the missing setupArgumentsWithExecState functions after r193974
+        https://bugs.webkit.org/show_bug.cgi?id=152214
+
+        Reviewed by Mark Lam.
+
+        Relanding r194007 after r194248.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2015-12-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove "local" scope type from the protocol
+        https://bugs.webkit.org/show_bug.cgi?id=152409
+
+        Reviewed by Timothy Hatcher.
+
+        After r194251 the backend no longer sends this scope type.
+        So remove it from the protocol.
+
+        The concept of a Local Scope should be calculatable by the
+        frontend. In fact the way the backend used to do this could
+        easily be done by the frontend. To be done in a follow-up.
+
+        * inspector/InjectedScriptSource.js:
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/protocol/Debugger.json:
+
+2015-12-17  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        [INTL] Implement Collator Compare Functions
+        https://bugs.webkit.org/show_bug.cgi?id=147604
+
+        Reviewed by Darin Adler.
+
+        This patch implements Intl.Collator.prototype.compare() according
+        to the ECMAScript 2015 Internationalization API spec (ECMA-402 2nd edition.)
+
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::~IntlCollator):
+        (JSC::sortLocaleData):
+        (JSC::searchLocaleData):
+        (JSC::IntlCollator::initializeCollator):
+        (JSC::IntlCollator::createCollator):
+        (JSC::IntlCollator::compareStrings):
+        (JSC::IntlCollator::usageString):
+        (JSC::IntlCollator::sensitivityString):
+        (JSC::IntlCollator::resolvedOptions):
+        (JSC::IntlCollator::setBoundCompare):
+        (JSC::IntlCollatorFuncCompare): Deleted.
+        * runtime/IntlCollator.h:
+        (JSC::IntlCollator::usage): Deleted.
+        (JSC::IntlCollator::setUsage): Deleted.
+        (JSC::IntlCollator::locale): Deleted.
+        (JSC::IntlCollator::setLocale): Deleted.
+        (JSC::IntlCollator::collation): Deleted.
+        (JSC::IntlCollator::setCollation): Deleted.
+        (JSC::IntlCollator::numeric): Deleted.
+        (JSC::IntlCollator::setNumeric): Deleted.
+        (JSC::IntlCollator::sensitivity): Deleted.
+        (JSC::IntlCollator::setSensitivity): Deleted.
+        (JSC::IntlCollator::ignorePunctuation): Deleted.
+        (JSC::IntlCollator::setIgnorePunctuation): Deleted.
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::constructIntlCollator):
+        (JSC::callIntlCollator):
+        (JSC::sortLocaleData): Deleted.
+        (JSC::searchLocaleData): Deleted.
+        (JSC::initializeCollator): Deleted.
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorFuncCompare):
+        (JSC::IntlCollatorPrototypeFuncResolvedOptions):
+        * runtime/IntlObject.cpp:
+        (JSC::defaultLocale):
+        (JSC::convertICULocaleToBCP47LanguageTag):
+        (JSC::intlStringOption):
+        (JSC::resolveLocale):
+        (JSC::supportedLocales):
+        * runtime/IntlObject.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::intlCollatorAvailableLocales):
+        (JSC::JSGlobalObject::intlDateTimeFormatAvailableLocales):
+        (JSC::JSGlobalObject::intlNumberFormatAvailableLocales):
+
+2015-12-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Provide a way to distinguish a nested lexical block from a function's lexical block
+        https://bugs.webkit.org/show_bug.cgi?id=152361
+
+        Reviewed by Saam Barati.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::emitPushFunctionNameScope):
+        (JSC::BytecodeGenerator::emitPushCatchScope):
+        Each of these are specialized scopes. They are not nested lexical scopes.
+        
+        (JSC::BytecodeGenerator::pushLexicalScope):
+        (JSC::BytecodeGenerator::pushLexicalScopeInternal):
+        Include an extra parameter to mark the SymbolTable as a nested lexical or not.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BlockNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitMultiLoopBytecode):
+        (JSC::ForOfNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::ClassExprNode::emitBytecode):
+        Each of these are cases of non-function nested lexical scopes.
+        So mark the SymbolTable as nested.
+
+        * inspector/protocol/Debugger.json:
+        * inspector/InjectedScriptSource.js:
+        Include a new scope type.
+
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::scopeType):
+        Use the new "NestedLexical" scope type for nested, non-function,
+        lexical scopes. The Inspector can use this to better describe
+        this scope in the frontend.
+
+        * debugger/DebuggerScope.cpp:
+        (JSC::DebuggerScope::isNestedLexicalScope):
+        * debugger/DebuggerScope.h:
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::isNestedLexicalScope):
+        * runtime/JSScope.h:
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::cloneScopePart):
+        * runtime/SymbolTable.h:
+        Access the isNestedLexicalScope bit.
+
+2015-12-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed EFL Build Fix after r194247.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::friendlyFunctionName):
+        Handle compilers that don't realize the switch handles all cases.
+
+2015-12-17  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add support for Symbol.hasInstance
+        https://bugs.webkit.org/show_bug.cgi?id=151839
+
+        Reviewed by Saam Barati.
+
+        Fixed version of r193986, r193983, and r193974.
+
+        This patch adds support for Symbol.hasInstance, unfortunately in order to prevent
+        regressions several new bytecodes and DFG IR nodes were necessary. Before, Symbol.hasInstance
+        when executing an instanceof expression we would emit three bytecodes: overrides_has_instance, get_by_id,
+        then instanceof. As the spec has changed, we emit a more complicated set of bytecodes in addition to some
+        new ones. First the role of overrides_has_instance and its corresponding DFG node have changed. Now it returns
+        a js-boolean indicating whether the RHS of the instanceof expression (from here on called the constructor for simplicity)
+        needs non-default behavior for resolving the expression. i.e. The constructor has a Symbol.hasInstance that differs from the one on
+        Function.prototype[Symbol.hasInstance] or is a bound/C-API function. Once we get to the DFG this node is generally eliminated as
+        we can prove the value of Symbol.hasInstance is a constant. The second new bytecode is instanceof_custom. insntanceof_custom, just
+        emits a call to slow path code that computes the result.
+
+        In the DFG, there is also a new node, CheckTypeInfoFlags, which checks the type info flags are consistent with the ones provided and
+        OSR exits if the flags are not. Additionally, we attempt to prove that the result of CheckHasValue will be a constant and transform
+        it into a CheckTypeInfoFlags followed by a JSConstant.
+
+        * API/JSCallbackObject.h:
+        * builtins/FunctionPrototype.js:
+        (symbolHasInstance):
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::isBranch): Deleted.
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::getJumpTargetsForBytecodeOffset): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitOverridesHasInstance):
+        (JSC::BytecodeGenerator::emitInstanceOfCustom):
+        (JSC::BytecodeGenerator::emitCheckHasInstance): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::hasTypeInfoOperand):
+        (JSC::DFG::Node::typeInfoOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfCustom):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileOverridesHasInstance):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckTypeInfoFlags):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInstanceOfCustom):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckHasInstance): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_overrides_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_instanceof_custom):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof_custom):
+        (JSC::JIT::emit_op_check_has_instance): Deleted.
+        (JSC::JIT::emitSlow_op_check_has_instance): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_overrides_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_instanceof_custom):
+        (JSC::JIT::emitSlow_op_instanceof_custom):
+        (JSC::JIT::emit_op_check_has_instance): Deleted.
+        (JSC::JIT::emitSlow_op_check_has_instance): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonIdentifiers.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::invalidParameterInstanceofSourceAppender):
+        (JSC::invalidParameterInstanceofNotFunctionSourceAppender):
+        (JSC::invalidParameterInstanceofhasInstanceValueNotFunctionSourceAppender):
+        (JSC::createInvalidInstanceofParameterErrorNotFunction):
+        (JSC::createInvalidInstanceofParameterErrorhasInstanceValueNotFunction):
+        (JSC::createInvalidInstanceofParameterError): Deleted.
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::isBoundFunction):
+        (JSC::hasInstanceBoundFunction):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::functionProtoHasInstanceSymbolFunction):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        (JSC::objectPrivateFuncInstanceOf):
+        * runtime/JSObject.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::overridesHasInstance):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase<Unknown>::slot):
+        * tests/es6.yaml:
+        * tests/stress/instanceof-custom-hasinstancesymbol.js: Added.
+        (Constructor):
+        (value):
+        (instanceOf):
+        (body):
+        * tests/stress/symbol-hasInstance.js: Added.
+        (Constructor):
+        (value):
+        (ObjectClass.Symbol.hasInstance):
+        (NumberClass.Symbol.hasInstance):
+
+2015-12-17  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Improve names in Debugger Call Stack section when paused
+        https://bugs.webkit.org/show_bug.cgi?id=152398
+
+        Reviewed by Brian Burg.
+
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        Provide a better name from the underlying CallFrame.
+
+        * inspector/InjectedScriptSource.js:
+        (InjectedScript.CallFrameProxy):
+        Just call functionName, it will provide a better
+        than nothing function name.
+
+        * runtime/JSFunction.cpp:
+        (JSC::getCalculatedDisplayName):
+        Use emptyString().
+
+        * interpreter/CallFrame.h:
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::friendlyFunctionName):
+        This is the third similiar implementation of this,
+        but all other cases use other "StackFrame" objects.
+        Use the expected names for program code.
+
+2015-12-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Add JSContext Script Profiling
+        https://bugs.webkit.org/show_bug.cgi?id=151899
+
+        Reviewed by Brian Burg.
+
+        Extend JSC::Debugger to include a profiling client interface
+        that the Inspector can implement to be told about script execution
+        entry and exit points. Add new profiledCall/Evaluate/Construct
+        methods that are entry points that will notify the profiling
+        client if it exists.
+
+        By putting the profiling client on Debugger it avoids having
+        special code paths for a JSGlobalObject being JSContext inspected
+        or a JSGlobalObject in a Page being Web inspected. In either case
+        the JSGlobalObject can go through its debugger() which always
+        reaches the correct inspector instance.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Handle new files.
+
+        * runtime/CallData.cpp:
+        (JSC::profiledCall):
+        * runtime/CallData.h:
+        * runtime/Completion.cpp:
+        (JSC::profiledEvaluate):
+        * runtime/Completion.h:
+        (JSC::profiledEvaluate):
+        * runtime/ConstructData.cpp:
+        (JSC::profiledConstruct):
+        * runtime/ConstructData.h:
+        (JSC::profiledConstruct):
+        Create profiled versions of interpreter entry points. If a profiler client is
+        available, this will automatically inform it of entry/exit. Include a reason
+        why this is being profiled. Currently all reasons in JavaScriptCore are enumerated
+        (API, Microtask) and Other is to be used by WebCore or future clients.
+
+        * debugger/ScriptProfilingScope.h: Added.
+        (JSC::ScriptProfilingScope::ScriptProfilingScope):
+        (JSC::ScriptProfilingScope::~ScriptProfilingScope):
+        (JSC::ScriptProfilingScope::shouldStartProfile):
+        (JSC::ScriptProfilingScope::shouldEndProfile):
+        At profiled entry points inform the profiling client if needed.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * runtime/JSJob.cpp:
+        (JSC::JSJobMicrotask::run):
+        Use the profiled functions for API and Microtask execution entry points.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::hasProfiler):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::hasProfiler):
+        Extend hasProfiler to also check the new Debugger script profiler.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::setProfilingClient):
+        (JSC::Debugger::willEvaluateScript):
+        (JSC::Debugger::didEvaluateScript):
+        * debugger/Debugger.h:
+        Pass through to the profiling client.
+
+        * inspector/protocol/ScriptProfiler.json: Added.
+        * inspector/agents/InspectorScriptProfilerAgent.cpp: Added.
+        (Inspector::InspectorScriptProfilerAgent::InspectorScriptProfilerAgent):
+        (Inspector::InspectorScriptProfilerAgent::~InspectorScriptProfilerAgent):
+        (Inspector::InspectorScriptProfilerAgent::didCreateFrontendAndBackend):
+        (Inspector::InspectorScriptProfilerAgent::willDestroyFrontendAndBackend):
+        (Inspector::InspectorScriptProfilerAgent::startTracking):
+        (Inspector::InspectorScriptProfilerAgent::stopTracking):
+        (Inspector::InspectorScriptProfilerAgent::isAlreadyProfiling):
+        (Inspector::InspectorScriptProfilerAgent::willEvaluateScript):
+        (Inspector::InspectorScriptProfilerAgent::didEvaluateScript):
+        (Inspector::toProtocol):
+        (Inspector::InspectorScriptProfilerAgent::addEvent):
+        (Inspector::buildAggregateCallInfoInspectorObject):
+        (Inspector::buildInspectorObject):
+        (Inspector::buildProfileInspectorObject):
+        (Inspector::InspectorScriptProfilerAgent::trackingComplete):
+        * inspector/agents/InspectorScriptProfilerAgent.h: Added.
+        New ScriptProfiler domain to just turn on / off script profiling.
+        It introduces a start/update/complete event model which we want
+        to include in new domains.
+
+        * inspector/InspectorEnvironment.h:
+        * inspector/InjectedScriptBase.cpp:
+        (Inspector::InjectedScriptBase::callFunctionWithEvalEnabled):
+        Simplify this now that we want it to be the same for all clients.
+
+        * inspector/JSGlobalObjectInspectorController.h:
+        * inspector/JSGlobalObjectInspectorController.cpp:
+        (Inspector::JSGlobalObjectInspectorController::JSGlobalObjectInspectorController):
+        Create the new agent.
+
+        * inspector/InspectorProtocolTypes.h:
+        (Inspector::Protocol::Array::addItem):
+        Allow pushing a double onto a Protocol::Array.
+
+2015-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Handle new_generator_func / new_generator_func_exp in DFG / FTL
+        https://bugs.webkit.org/show_bug.cgi?id=152227
+
+        Reviewed by Saam Barati.
+
+        This patch introduces new_generator_func / new_generator_func_exp into DFG and FTL.
+        We add a new DFG Node, NewGeneratorFunction. It will construct a function with GeneratorFunction's structure.
+        The structure of GeneratorFunction is different from one of Function because GeneratorFunction has the different __proto__.
+
+        Instead of extending NewFunction / PhantomNewFunction, we just added new DFG nodes, NewGeneratorFunction and PhantomNewGeneratorFunction.
+        This is because NewGeneratorFunction will generate an object that has different class info from JSFunction (And if JSGeneratorFunction is extended, its size will become different from JSFunction).
+        So, rather than extending NewFunction with generator flag, just adding new DFG nodes seems cleaner.
+
+        Object allocation sinking phase will change NewGeneratorFunction to PhantomNewGeneratorFunction and defer or eliminate its actual materialization.
+        It is completely the same to NewFunction and PhantomNewFunction.
+        And when OSR exit occurs, we need to execute deferred NewGeneratorFunction since Baseline JIT does not consider it.
+        So in FTL operation, we should create JSGeneratorFunction if we see PhantomNewGeneratorFunction materialization.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp:
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomNewFunction):
+        (JSC::DFG::Node::convertToPhantomNewGeneratorFunction):
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::isFunctionAllocation):
+        (JSC::DFG::Node::isPhantomFunctionAllocation):
+        (JSC::DFG::Node::isPhantomAllocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validateCPS):
+        (JSC::DFG::Validate::validateSSA):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationPopulateObjectInOSR):
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * tests/stress/generator-function-create-optimized.js: Added.
+        (shouldBe):
+        (g):
+        (test.return.gen):
+        (test):
+        (test2.gen):
+        (test2):
+        * tests/stress/generator-function-declaration-sinking-no-double-allocate.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (call):
+        (f):
+        (sink):
+        * tests/stress/generator-function-declaration-sinking-osrexit.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (g):
+        (f):
+        (sink):
+        * tests/stress/generator-function-declaration-sinking-put.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (g):
+        (f):
+        (sink):
+        * tests/stress/generator-function-expression-sinking-no-double-allocate.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (call):
+        (f):
+        (sink):
+        * tests/stress/generator-function-expression-sinking-osrexit.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (g):
+        (sink):
+        * tests/stress/generator-function-expression-sinking-put.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (g):
+        (sink):
+
+2015-12-16  Michael Saboff  <msaboff@apple.com>
+
+        ARM64 MacroAssembler improperly reuses data temp register in test32() and test8() calls
+        https://bugs.webkit.org/show_bug.cgi?id=152370
+
+        Reviewed by Benjamin Poulain.
+
+        Changed the test8/32(Address, Register) flavors to use the memoryTempRegister for loading the value
+        att Address so that it doesn't collide with the subsequent use of dataTempRegister by the
+        test32(Register, Register) function.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::test32):
+        (JSC::MacroAssemblerARM64::test8):
+
+2015-12-16  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should support switches
+        https://bugs.webkit.org/show_bug.cgi?id=152360
+
+        Reviewed by Geoffrey Garen.
+
+        I implemented this because I was hoping it would less us run V8/crypto, but instead it just led
+        me to file a fun bug: https://bugs.webkit.org/show_bug.cgi?id=152365.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::check):
+        (JSC::FTL::Output::switchInstruction):
+        (JSC::FTL::Output::ret):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::ftlUnreachable):
+        (JSC::FTL::DFG::LowerDFGToLLVM::crash):
+
+2015-12-16  Alex Christensen  <achristensen@webkit.org>
+
+        Fix internal Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=152364
+
+        Reviewed by Tim Horton.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.proj:
+
+2015-12-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Improve JSObject::put performance
+        https://bugs.webkit.org/show_bug.cgi?id=152347
+
+        Reviewed by Geoffrey Garen.
+
+        This adds a new benchmark called dynbench, which just uses the C++ API to create, modify, and
+        query objects. This also adds some optimizations to make the JSObject::put code faster by making
+        it inlinable in places that really need the performance, like JITOperations and LLIntSlowPaths.
+        Inlining it is optional because the put() method is large. If you want it inlined, call
+        putInline(). There's a putInline() variant of both JSObject::put() and JSValue::put().
+
+        This is up to a 20% improvement for JSObject::put calls that get inlined all the way (like from
+        JITOperations and the new benchmark) and it's also a speed-up, albeit a smaller one, for
+        JSObject::put calls that don't get inlined (i.e. those from the DOM and the JSC C++ library code).
+        Specific speed-ups are as follows. Note that "dynamic context" means that we told PutPropertySlot
+        that we're not a static put_by_id, which turns off some type inference.
+
+        Get By Id: 2% faster
+        Put By Id Replace: 23% faster
+        Put By Id Transition + object allocation: 11% faster
+        Get By Id w/ dynamic context: 5% faster
+        Put By Id Replace w/ dynamic context: 25% faster
+        Put By Id Transition + object allocation w/ dynamic context: 10% faster
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dynbench.cpp: Added.
+        (JSC::benchmarkImpl):
+        (main):
+        * jit/CallFrameShuffler32_64.cpp:
+        * jit/CallFrameShuffler64.cpp:
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/ClassInfo.h:
+        (JSC::ClassInfo::hasStaticProperties):
+        * runtime/ConsoleClient.cpp:
+        * runtime/CustomGetterSetter.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finishCreation):
+        (JSC::addErrorInfoAndGetBytecodeOffset): Deleted.
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/JSCInlines.h:
+        * runtime/JSCJSValue.h:
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::put):
+        (JSC::JSValue::putInternal):
+        (JSC::JSValue::putByIndex):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putByIndex):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getVectorLength):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::get):
+        (JSC::JSObject::putDirectInternal):
+
+2015-12-16  Filip Pizlo  <fpizlo@apple.com>
+
+        Work around a bug in LLVM by flipping the unification order
+        https://bugs.webkit.org/show_bug.cgi?id=152341
+        rdar://problem/23920749
+
+        Reviewed by Mark Lam.
+
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+
+2015-12-16  Saam barati  <sbarati@apple.com>
+
+        Add "explicit operator bool" to ScratchRegisterAllocator::PreservedState
+        https://bugs.webkit.org/show_bug.cgi?id=152337
+
+        Reviewed by Mark Lam.
+
+        If we have a default constructor, we should also have a way
+        to tell if a PreservedState is invalid.
+
+        * jit/ScratchRegisterAllocator.cpp:
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::PreservedState::PreservedState):
+        (JSC::ScratchRegisterAllocator::PreservedState::operator bool):
+
+2015-12-16  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] fix error message for eval/arguments CoverInitializedName in strict code
+        https://bugs.webkit.org/show_bug.cgi?id=152304
+
+        Reviewed by Darin Adler.
+
+        Because the error was originally classified as indicating a Pattern, the
+        error in AssignmentPattern parsing causes the reported message to revert to
+        the original Expression error message, which in this case is incorrect.
+
+        This change modifies the implementation of the strict code
+        error slightly, and reclassifies the error to prevent the message revert,
+        which improves the clarity of the message overall.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentElement):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        * parser/Parser.h:
+        (JSC::Parser::ExpressionErrorClassifier::reclassifyExpressionError):
+        (JSC::Parser::reclassifyExpressionError):
+        * tests/stress/destructuring-assignment-syntax.js:
+
+2015-12-16  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Builtin source should be minified more
+        https://bugs.webkit.org/show_bug.cgi?id=152290
+
+        Reviewed by Darin Adler.
+
+        * Scripts/builtins/builtins_model.py:
+        (BuiltinFunction.fromString):
+        Remove primarily empty lines that would just introduce clutter.
+        We only do the minification in non-Debug configurations, which
+        is determined by the CONFIGURATION environment variable. You can
+        see how tests would generate differently, like so:
+        shell> CONFIGURATION=Release ./Tools/Scripts/run-builtins-generator-tests
+
+2015-12-16  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r194135.
+        https://bugs.webkit.org/show_bug.cgi?id=152333
+
+        due to missing OSR exit materialization support in FTL
+        (Requested by yusukesuzuki on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Handle new_generator_func / new_generator_func_exp in
+        DFG / FTL"
+        https://bugs.webkit.org/show_bug.cgi?id=152227
+        http://trac.webkit.org/changeset/194135
+
+2015-12-16  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Fetch API] Add fetch API compile time flag
+        https://bugs.webkit.org/show_bug.cgi?id=152254
+
+        Reviewed by Darin Adler.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2015-12-16  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Handle new_generator_func / new_generator_func_exp in DFG / FTL
+        https://bugs.webkit.org/show_bug.cgi?id=152227
+
+        Reviewed by Saam Barati.
+
+        This patch introduces new_generator_func / new_generator_func_exp into DFG and FTL.
+        We add a new DFG Node, NewGeneratorFunction. It will construct a function with GeneratorFunction's structure.
+        The structure of GeneratorFunction is different from one of Function because GeneratorFunction has the different __proto__.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGClobbersExitState.cpp:
+        (JSC::DFG::clobbersExitState):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPhantomNewFunction):
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::isFunctionAllocation):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNewFunction):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStoreBarrierInsertionPhase.cpp:
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
+        * tests/stress/generator-function-create-optimized.js: Added.
+        (shouldBe):
+        (g):
+        (test.return.gen):
+        (test):
+        (test2.gen):
+        (test2):
+        * tests/stress/generator-function-declaration-sinking-no-double-allocate.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (call):
+        (f):
+        (sink):
+        * tests/stress/generator-function-declaration-sinking-osrexit.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (g):
+        (f):
+        (sink):
+        * tests/stress/generator-function-declaration-sinking-put.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (g):
+        (f):
+        (sink):
+        * tests/stress/generator-function-expression-sinking-no-double-allocate.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (call):
+        (f):
+        (sink):
+        * tests/stress/generator-function-expression-sinking-osrexit.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (g):
+        (sink):
+        * tests/stress/generator-function-expression-sinking-put.js: Added.
+        (shouldBe):
+        (GeneratorFunctionPrototype):
+        (g):
+        (sink):
+
+2015-12-15  Mark Lam  <mark.lam@apple.com>
+
+        Gardening: fix broken 32-bit JSC tests.  Just need to assign a scratch register.
+        https://bugs.webkit.org/show_bug.cgi?id=152191 
+
+        Not reviewed.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBitBinaryOpFastPath):
+
+2015-12-15  Mark Lam  <mark.lam@apple.com>
+
+        Introducing ScratchRegisterAllocator::PreservedState.
+        https://bugs.webkit.org/show_bug.cgi?id=152315
+
+        Reviewed by Geoffrey Garen.
+
+        restoreReusedRegistersByPopping() should always be called with 2 values that
+        matches the expectation of preserveReusedRegistersByPushing().  Those 2 values
+        are the number of bytes preserved and the ExtraStackSpace requirement.  By
+        encapsulating them in a ScratchRegisterAllocator::PreservedState, we can make
+        it less error prone when calling restoreReusedRegistersByPopping().  Now, we only
+        need to pass it the appropriate PreservedState that its matching
+        preserveReusedRegistersByPushing() returned.
+
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessGenerationState::restoreScratch):
+        (JSC::AccessCase::generate):
+        (JSC::PolymorphicAccess::regenerate):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessGenerationState::AccessGenerationState):
+        * ftl/FTLCompileBinaryOp.cpp:
+        (JSC::FTL::generateBinaryBitOpFastPath):
+        (JSC::FTL::generateRightShiftFastPath):
+        (JSC::FTL::generateBinaryArithOpFastPath):
+        * ftl/FTLLazySlowPath.cpp:
+        (JSC::FTL::LazySlowPath::generate):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier):
+        * jit/ScratchRegisterAllocator.cpp:
+        (JSC::ScratchRegisterAllocator::allocateScratchGPR):
+        (JSC::ScratchRegisterAllocator::allocateScratchFPR):
+        (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
+        (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
+        * jit/ScratchRegisterAllocator.h:
+        (JSC::ScratchRegisterAllocator::usedRegisters):
+        (JSC::ScratchRegisterAllocator::PreservedState::PreservedState):
+
+2015-12-15  Mark Lam  <mark.lam@apple.com>
+
+        Polymorphic operand types for DFG and FTL bit operators.
+        https://bugs.webkit.org/show_bug.cgi?id=152191
+
+        Reviewed by Saam Barati.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isUntypedSpeculationForBitOps):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::shouldSpeculateUntypedForBitOps):
+        - Added check for types not supported by ValueToInt32, and therefore should be
+          treated as untyped for bitops.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        - Handled untyped operands.
+
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        - Added DFG slow path functions for bitops.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitUntypedBitOp):
+        (JSC::DFG::SpeculativeJIT::compileBitwiseOp):
+        (JSC::DFG::SpeculativeJIT::emitUntypedRightShiftBitOp):
+        (JSC::DFG::SpeculativeJIT::compileShiftOp):
+        * dfg/DFGSpeculativeJIT.h:
+        - Added DFG backend support untyped operands for bitops.
+
+        * dfg/DFGStrengthReductionPhase.cpp:
+        (JSC::DFG::StrengthReductionPhase::handleNode):
+        - Limit bitops strength reduction only to when we don't have untyped operands.
+          This is because values that are not int32s need to be converted to int32.
+          Without untyped operands, the ValueToInt32 node takes care of this.
+          With untyped operands, we cannot use ValueToInt32, and need to do the conversion
+          in the code emitted for the bitop node itself.  For example:
+
+              5.5 | 0; // yields 5 because ValueToInt32 converts the 5.5 to a 5.
+              "abc" | 0; // would yield "abc" instead of the expected 0 if we let
+                         // strength reduction do its thing.
+
+        * ftl/FTLCompileBinaryOp.cpp:
+        (JSC::FTL::generateBinaryBitOpFastPath):
+        (JSC::FTL::generateRightShiftFastPath):
+        (JSC::FTL::generateBinaryOpFastPath):
+
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::BitAndDescriptor::BitAndDescriptor):
+        (JSC::FTL::BitAndDescriptor::icSize):
+        (JSC::FTL::BitAndDescriptor::nodeType):
+        (JSC::FTL::BitAndDescriptor::opName):
+        (JSC::FTL::BitAndDescriptor::slowPathFunction):
+        (JSC::FTL::BitAndDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::BitOrDescriptor::BitOrDescriptor):
+        (JSC::FTL::BitOrDescriptor::icSize):
+        (JSC::FTL::BitOrDescriptor::nodeType):
+        (JSC::FTL::BitOrDescriptor::opName):
+        (JSC::FTL::BitOrDescriptor::slowPathFunction):
+        (JSC::FTL::BitOrDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::BitXorDescriptor::BitXorDescriptor):
+        (JSC::FTL::BitXorDescriptor::icSize):
+        (JSC::FTL::BitXorDescriptor::nodeType):
+        (JSC::FTL::BitXorDescriptor::opName):
+        (JSC::FTL::BitXorDescriptor::slowPathFunction):
+        (JSC::FTL::BitXorDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::BitLShiftDescriptor::BitLShiftDescriptor):
+        (JSC::FTL::BitLShiftDescriptor::icSize):
+        (JSC::FTL::BitLShiftDescriptor::nodeType):
+        (JSC::FTL::BitLShiftDescriptor::opName):
+        (JSC::FTL::BitLShiftDescriptor::slowPathFunction):
+        (JSC::FTL::BitLShiftDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::BitRShiftDescriptor::BitRShiftDescriptor):
+        (JSC::FTL::BitRShiftDescriptor::icSize):
+        (JSC::FTL::BitRShiftDescriptor::nodeType):
+        (JSC::FTL::BitRShiftDescriptor::opName):
+        (JSC::FTL::BitRShiftDescriptor::slowPathFunction):
+        (JSC::FTL::BitRShiftDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::BitURShiftDescriptor::BitURShiftDescriptor):
+        (JSC::FTL::BitURShiftDescriptor::icSize):
+        (JSC::FTL::BitURShiftDescriptor::nodeType):
+        (JSC::FTL::BitURShiftDescriptor::opName):
+        (JSC::FTL::BitURShiftDescriptor::slowPathFunction):
+        (JSC::FTL::BitURShiftDescriptor::nonNumberSlowPathFunction):
+        - Added support for bitop ICs.
+
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfBitAnd):
+        (JSC::FTL::sizeOfBitOr):
+        (JSC::FTL::sizeOfBitXor):
+        (JSC::FTL::sizeOfBitLShift):
+        (JSC::FTL::sizeOfBitRShift):
+        (JSC::FTL::sizeOfBitURShift):
+        * ftl/FTLInlineCacheSize.h:
+        - Added new bitop IC sizes.  These are just estimates for now that work adequately,
+          and are shown to not impact performance on benchmarks.  We will re-tune these
+          sizes values later in another patch once all snippet ICs have been added.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitAnd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitOr):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitXor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitRShift):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitLShift):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBitURShift):
+        - Added support for bitop ICs.
+
+        * jit/JITLeftShiftGenerator.cpp:
+        (JSC::JITLeftShiftGenerator::generateFastPath):
+        * jit/JITLeftShiftGenerator.h:
+        (JSC::JITLeftShiftGenerator::JITLeftShiftGenerator):
+        * jit/JITRightShiftGenerator.cpp:
+        (JSC::JITRightShiftGenerator::generateFastPath):
+        - The shift MASM operatons need to ensure that the shiftAmount is not in the same
+          register as the destination register.  With the baselineJIT and DFG, this is
+          ensured in how we allocate these registers, and hence, the bug does not manifest.
+          With the FTL, these registers are not guaranteed to be unique.  Hence, we need
+          to fix the shift op snippet code to compensate for this. 
+
+2015-12-15  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] SyntaxError if AssignmentElement is `eval` or `arguments` in strict code
+        https://bugs.webkit.org/show_bug.cgi?id=152302
+
+        Reviewed by Mark Lam.
+
+        `eval` and `arguments` must not be assigned to in strict code. This
+        change fixes `language/expressions/assignment/destructuring/obj-id-simple-strict.js`
+        in Test262, as well as a variety of other similar tests.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentElement):
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        * tests/stress/destructuring-assignment-syntax.js:
+
+2015-12-15  Csaba Osztrogonác  <ossy@webkit.org>
+
+        URTBF after 194062.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::supportsFloatingPointCeil): Added.
+        (JSC::MacroAssemblerARM::ceilDouble): Added.
+
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should account for localsOffset
+        https://bugs.webkit.org/show_bug.cgi?id=152288
+
+        Reviewed by Saam Barati.
+
+        The DFG will build up some data structures that expect to know about offsets from FP. Those data
+        structures may slide by some offset when the low-level compiler (either LLVM or B3) does stack
+        allocation. So, the LLVM FTL modifies those data structures based on the real offset that it gets
+        from LLVM's stackmaps. The B3 code needs to do the same.
+
+        I had previously vowed to never put more stuff into FTLB3Compile.cpp, because I didn't want it to
+        look like FTLCompile.cpp. Up until now, I was successful because I used lambdas installed by
+        FTLLower. But in this case, I actually think that having code that just does this explicitly in
+        FTLB3Compile.cpp is least confusing. There is no particular place in FTLLower that would want to
+        care about this, and we need to ensure that we do this fixup before we run any of the stackmap
+        generators. In other words, it needs to happen before we call B3::generate(). The ordering
+        constraints seem like a good reason to have this done explicitly rather than through lambdas.
+
+        I wrote a test. The test was failing in trunk because the B3 meaning of anchor().value() is
+        different from the LLVM meaning. This caused breakage when we used this idiom:
+
+            ValueFromBlock foo = m_out.anchor(things);
+            ...(foo.value()) // we were expecting that foo.value() == things
+
+        I never liked this idiom to begin with, so instead of trying to change B3's anchor(), I changed
+        the idiom to:
+
+            LValue fooValue = things;
+            ValueFromBlock foo = m_out.anchor(fooValue);
+            ...(fooValue)
+
+        This is probably a good idea, since eventually we want B3's anchor() to just return the
+        UpsilonValue*. To get there, we want to eliminate any situations where code assumes that
+        ValueFromBlock is an actual object and not just a typedef for a pointer.
+
+        * ftl/FTLB3Compile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::appendTo):
+        (JSC::FTL::Output::lockedStackSlot):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::framePointer):
+        (JSC::FTL::Output::constBool):
+        (JSC::FTL::Output::constInt32):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCreateDirectArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileStringCharAt):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileForwardVarargs):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileHasIndexedProperty):
+        (JSC::FTL::DFG::LowerDFGToLLVM::allocateJSArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::sensibleDoubleToInt32):
+        * ftl/FTLState.h:
+        (JSC::FTL::verboseCompilationEnabled):
+        * tests/stress/ftl-function-dot-arguments-with-callee-saves.js: Added.
+
+2015-12-14  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Math.random should have an intrinsic thunk and it should be later handled as a DFG Node
+        https://bugs.webkit.org/show_bug.cgi?id=152133
+
+        Reviewed by Geoffrey Garen.
+
+        In this patch, we implement new RandomIntrinsic. It emits a machine code to generate random numbers efficiently.
+        And later it will be recognized by DFG and converted to ArithRandom node.
+        It provides type information SpecDoubleReal since Math.random only generates a number within [0, 1.0).
+
+        Currently, only 64bit version is supported. On 32bit environment, ArithRandom will be converted to callOperation.
+        While it emits a function call, ArithRandom node on 32bit still represents SpecDoubleReal as a result type.
+
+        * dfg/DFGAbstractHeap.h:
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileArithRandom):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::compileArithRandom):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithRandom):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::emitRandomThunkImpl):
+        (JSC::AssemblyHelpers::emitRandomThunk):
+        * jit/AssemblyHelpers.h:
+        * jit/JITOperations.h:
+        * jit/ThunkGenerators.cpp:
+        (JSC::randomThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/Intrinsic.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::weakRandomOffset):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::finishCreation):
+        * runtime/VM.cpp:
+        (JSC::thunkGeneratorForIntrinsic):
+        * tests/stress/random-53bit.js: Added.
+        (test):
+        * tests/stress/random-in-range.js: Added.
+        (test):
+
+2015-12-14  Benjamin Poulain  <benjamin@webkit.org>
+
+        Rename FTL::Output's ceil64() to doubleCeil()
+
+        Rubber-stamped by Filip Pizlo.
+
+        ceil64() was a bad name, that's the name convention we use for integers.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleCeil):
+        (JSC::FTL::Output::ceil64): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithRound):
+
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be able to run n-body.js
+        https://bugs.webkit.org/show_bug.cgi?id=152281
+
+        Reviewed by Benjamin Poulain.
+
+        Fix a bug where m_captured was pointing to the start of the captured vars slot rather than the
+        end, like the rest of the FTL expected.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+
+2015-12-14  Benjamin Poulain  <bpoulain@apple.com>
+
+        Fix bad copy-paste in r194062
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::ceil64):
+
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix cloop build.
+
+        * jit/GPRInfo.cpp:
+
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should do PutById
+        https://bugs.webkit.org/show_bug.cgi?id=152268
+
+        Reviewed by Saam Barati.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare): I realized that we were missing some useful matching rules.
+        * b3/testb3.cpp: Added a bunch of tests.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutById): Do the things.
+        * jit/GPRInfo.cpp: Added. I had to do this yucky thing because clang was having issues compiling references to this from deeply nested lambdas.
+        * jit/GPRInfo.h: Added a comment about how patchpointScratchRegister is bizarre and should probably die.
+
+2015-12-14  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add ceil() support for x86 and expose it to B3
+        https://bugs.webkit.org/show_bug.cgi?id=152231
+
+        Reviewed by Geoffrey Garen.
+
+        Most x86 CPUs we care about support ceil() natively
+        with the round instruction.
+
+        This patch expose that behind a runtime flag, use it
+        in the Math.ceil() thunk and expose it to B3.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::supportsFloatingPointCeil):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointCeil):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::supportsFloatingPointCeil):
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::supportsFloatingPointCeil):
+        * assembler/MacroAssemblerX86Common.cpp:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::ceilDouble):
+        (JSC::MacroAssemblerX86Common::ceilFloat):
+        (JSC::MacroAssemblerX86Common::supportsFloatingPointCeil):
+        (JSC::MacroAssemblerX86Common::supportsLZCNT):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::roundss_rr):
+        (JSC::X86Assembler::roundss_mr):
+        (JSC::X86Assembler::roundsd_rr):
+        (JSC::X86Assembler::roundsd_mr):
+        (JSC::X86Assembler::mfence):
+        (JSC::X86Assembler::X86InstructionFormatter::threeByteOp):
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::ceilConstant):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ConstFloatValue.cpp:
+        (JSC::B3::ConstFloatValue::ceilConstant):
+        * b3/B3ConstFloatValue.h:
+        * b3/B3LowerMacrosAfterOptimizations.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceDoubleToFloat.cpp:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::ceilConstant):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testCeilArg):
+        (JSC::B3::testCeilImm):
+        (JSC::B3::testCeilMem):
+        (JSC::B3::testCeilCeilArg):
+        (JSC::B3::testCeilIToD64):
+        (JSC::B3::testCeilIToD32):
+        (JSC::B3::testCeilArgWithUselessDoubleConversion):
+        (JSC::B3::testCeilArgWithEffectfulDoubleConversion):
+        (JSC::B3::populateWithInterestingValues):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::ceil64):
+        * jit/ThunkGenerators.cpp:
+        (JSC::ceilThunkGenerator):
+
+2015-12-14  Andreas Kling  <akling@apple.com>
+
+        ResourceUsageOverlay should show GC timers.
+        <https://webkit.org/b/152151>
+
+        Reviewed by Darin Adler.
+
+        Expose the next fire time (in WTF timestamp style) of a GCActivityCallback.
+
+        * heap/GCActivityCallback.cpp:
+        (JSC::GCActivityCallback::scheduleTimer):
+        (JSC::GCActivityCallback::cancelTimer):
+        * heap/GCActivityCallback.h:
+
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix merge issue in a test.
+
+        * b3/testb3.cpp:
+        (JSC::B3::testCheckTwoMegaCombos):
+        (JSC::B3::testCheckTwoNonRedundantMegaCombos):
+
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should not give ValueReps for the non-stackmap children of a CheckValue to the generator callback
+        https://bugs.webkit.org/show_bug.cgi?id=152224
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, a stackmap generator for a Check had to know how many children the B3 value for the
+        Check had at the time of code generation. That meant that B3 could not change the kind of Check
+        that it was - for example it cannot turn a Check into a Patchpoint and it cannot turn a CheckAdd
+        into a Check. But just changing the contract so that the stackmap generation params only get the
+        stackmap children of the check means that B3 can transform Checks as it likes.
+
+        This is meant to aid sinking values into checks.
+
+        Also, I found that the effects of a Check did not include HeapRange::top(). I think it's best if
+        exitsSideways does not imply reading top, the way that it does in DFG. In the DFG, that makes
+        sense because the exit analysis is orthogonal, so the clobber analysis tells you about the reads
+        not counting OSR exit - if you need to you can conditionally merge that with World based on a
+        separate exit analysis. But in B3, the Effects object tells you about both exiting and reading,
+        and it's computed by one analysis. Prior to this change, Check was not setting reads to top() so
+        we were effectively saying that Effects::reads is meaningless when exitsSideways is true. It
+        seems more sensible to instead force the analysis to set reads to top() when setting
+        exitsSideways to true, not least because we only have one such analysis and many users. But it
+        also makes sense for another reason: it allows us to bound the set of things that the program
+        will read after it exits. That might not be useful to us now, but it's a nice feature to get for
+        free. I've seen language features that have behave like exitsSideways that don't also read top,
+        like an array bounds check that causes sudden termination without making any promises about how
+        pretty the crash dump will look.
+
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::generate):
+        * b3/B3Opcode.h:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        * b3/testb3.cpp:
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::testCheckLessThan):
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::testCheckAddImm):
+        (JSC::B3::testCheckAddImmCommute):
+        (JSC::B3::testCheckAddImmSomeRegister):
+        (JSC::B3::testCheckAdd):
+        (JSC::B3::testCheckAdd64):
+        (JSC::B3::testCheckSubImm):
+        (JSC::B3::testCheckSubBadImm):
+        (JSC::B3::testCheckSub):
+        (JSC::B3::testCheckSub64):
+        (JSC::B3::testCheckNeg):
+        (JSC::B3::testCheckNeg64):
+        (JSC::B3::testCheckMul):
+        (JSC::B3::testCheckMulMemory):
+        (JSC::B3::testCheckMul2):
+        (JSC::B3::testCheckMul64):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        Air: Support Architecture-specific forms and Opcodes
+        https://bugs.webkit.org/show_bug.cgi?id=151736
+
+        Reviewed by Benjamin Poulain.
+
+        This adds really awesome architecture selection to the AirOpcode.opcodes file. If an opcode or
+        opcode form is unavailable on some architecture, you can still mention its name in C++ code (it'll
+        still be a member of the enum) but isValidForm() and all other reflective queries will tell you
+        that it doesn't exist. This will make the instruction selector steer clear of it, and it will
+        also ensure that the spiller doesn't try to use any unavailable architecture-specific address
+        forms.
+
+        The new capability is documented extensively in a comment in AirOpcode.opcodes.
+
+        * b3/air/AirOpcode.opcodes:
+        * b3/air/opcode_generator.rb:
+
+2015-12-14  Mark Lam  <mark.lam@apple.com>
+
+        Misc. small fixes in snippet related code.
+        https://bugs.webkit.org/show_bug.cgi?id=152259
+
+        Reviewed by Saam Barati.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        - When loading a constant JSValue for a node, use the one that the node already
+          provides instead of reconstructing it.  This is not a bug, but the fix makes
+          the code cleaner.
+
+        * jit/JITBitAndGenerator.cpp:
+        (JSC::JITBitAndGenerator::generateFastPath):
+        - No need to do a bitand with a constant int 0xffffffff operand.
+
+        * jit/JITBitOrGenerator.cpp:
+        (JSC::JITBitOrGenerator::generateFastPath):
+        - Fix comments: bitor is '|', not '&'.
+        - No need to do a bitor with a constant int 0 operand.
+
+        * jit/JITBitXorGenerator.cpp:
+        (JSC::JITBitXorGenerator::generateFastPath):
+        - Fix comments: bitxor is '^', not '&'.
+
+        * jit/JITRightShiftGenerator.cpp:
+        (JSC::JITRightShiftGenerator::generateFastPath):
+        - Renamed a jump target name to be clearer about its purpose.
+
+2015-12-14  Mark Lam  <mark.lam@apple.com>
+
+        We should not employ the snippet code in the DFG if no OSR exit was previously encountered.
+        https://bugs.webkit.org/show_bug.cgi?id=152255
+
+        Reviewed by Saam Barati.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+
+2015-12-14  Filip Pizlo  <fpizlo@apple.com>
+
+        B3->Air compare-branch fusion should fuse even if the result of the comparison is used more than once
+        https://bugs.webkit.org/show_bug.cgi?id=152198
+
+        Reviewed by Benjamin Poulain.
+
+        If we have a comparison operation that is branched on from multiple places, then we were
+        previously executing the comparison to get a boolean result in a register and then we were
+        testing/branching on that register in multiple places. This is actually less efficient than
+        just fusing the compare/branch multiple times, even though this means that the comparison
+        executes multiple times. This would only be bad if the comparison fused loads multiple times,
+        since duplicating loads is both wrong and inefficient. So, this adds the notion of sharing to
+        compare/branch fusion. If a compare is shared by multiple branches, then we refuse to fuse
+        the load.
+
+        To write the test, I needed to zero-extend 8 to 32. In the process of thinking about how to
+        do this, I realized that we needed lowerings for SExt8/SExt16. And I realized that the
+        lowerings for the other extension operations were not fully fleshed out; for example they
+        were incapable of load fusion. This patch fixes this and also adds some smart strength
+        reductions for BitAnd(@x, 0xff/0xffff/0xffffffff) - all of which should be lowered to a zero
+        extension.
+
+        This is a big win on asm.js code. It's not enough to bridge the gap to LLVM, but it's a huge
+        step in that direction.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::load8SignedExtendTo32):
+        (JSC::MacroAssemblerX86Common::zeroExtend8To32):
+        (JSC::MacroAssemblerX86Common::signExtend8To32):
+        (JSC::MacroAssemblerX86Common::load16):
+        (JSC::MacroAssemblerX86Common::load16SignedExtendTo32):
+        (JSC::MacroAssemblerX86Common::zeroExtend16To32):
+        (JSC::MacroAssemblerX86Common::signExtend16To32):
+        (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movzbl_rr):
+        (JSC::X86Assembler::movsbl_rr):
+        (JSC::X86Assembler::movzwl_rr):
+        (JSC::X86Assembler::movswl_rr):
+        (JSC::X86Assembler::cmovl_rr):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3ReduceStrength.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::testCheckTwoMegaCombos):
+        (JSC::B3::testCheckTwoNonRedundantMegaCombos):
+        (JSC::B3::testCheckAddImm):
+        (JSC::B3::testTruncSExt32):
+        (JSC::B3::testSExt8):
+        (JSC::B3::testSExt8Fold):
+        (JSC::B3::testSExt8SExt8):
+        (JSC::B3::testSExt8SExt16):
+        (JSC::B3::testSExt8BitAnd):
+        (JSC::B3::testBitAndSExt8):
+        (JSC::B3::testSExt16):
+        (JSC::B3::testSExt16Fold):
+        (JSC::B3::testSExt16SExt16):
+        (JSC::B3::testSExt16SExt8):
+        (JSC::B3::testSExt16BitAnd):
+        (JSC::B3::testBitAndSExt16):
+        (JSC::B3::testSExt32BitAnd):
+        (JSC::B3::testBitAndSExt32):
+        (JSC::B3::testBasicSelect):
+        (JSC::B3::run):
+
+2015-12-14  Chris Dumez  <cdumez@apple.com>
+
+        Roll out r193974 and follow-up fixes as it caused JSC crashes
+        https://bugs.webkit.org/show_bug.cgi?id=152256
+
+        Unreviewed, Roll out r193974 and follow-up fixes as it caused JSC crashes.
+
+        * API/JSCallbackObject.h:
+        * builtins/FunctionPrototype.js:
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::isBranch):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString): Deleted.
+        * bytecode/ExitKind.h:
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::getJumpTargetsForBytecodeOffset):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCheckHasInstance):
+        (JSC::BytecodeGenerator::emitGetById): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitTypeOf): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        (JSC::LogicalOpNode::emitBytecode): Deleted.
+        (JSC::LogicalOpNode::emitBytecodeInConditionContext): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCellOperand): Deleted.
+        (JSC::DFG::Node::hasTransition): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOf): Deleted.
+        (JSC::DFG::SpeculativeJIT::compileArithAdd): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation): Deleted.
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckHasInstance):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInstanceOf): Deleted.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileHasIndexedProperty): Deleted.
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArguments): Deleted.
+        (JSC::CCallHelpers::setupArgumentsWithExecState): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperationNoExceptionCheck): Deleted.
+        (JSC::JIT::callOperation): Deleted.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emit_op_is_undefined): Deleted.
+        (JSC::JIT::emitSlow_op_to_number): Deleted.
+        (JSC::JIT::emitSlow_op_to_string): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_check_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_check_has_instance):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emit_op_is_undefined): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions): Deleted.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonIdentifiers.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::invalidParameterInstanceofSourceAppender):
+        (JSC::createInvalidInstanceofParameterError):
+        (JSC::createError): Deleted.
+        (JSC::createNotAFunctionError): Deleted.
+        (JSC::createNotAnObjectError): Deleted.
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::JSBoundFunction::create): Deleted.
+        (JSC::JSBoundFunction::customHasInstance): Deleted.
+        * runtime/JSBoundFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren): Deleted.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::throwTypeErrorGetterSetter): Deleted.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::defaultHasInstance): Deleted.
+        (JSC::JSObject::getPropertyNames): Deleted.
+        (JSC::JSObject::getOwnPropertyNames): Deleted.
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::create): Deleted.
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::overridesHasInstance):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase<Unknown>::slot):
+        * tests/es6.yaml:
+        * tests/stress/instanceof-custom-hasinstancesymbol.js: Removed.
+        * tests/stress/symbol-hasInstance.js: Removed.
+
+2015-12-13  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove FTL::Output's doubleEqualOrUnordered()
+        https://bugs.webkit.org/show_bug.cgi?id=152234
+
+        Reviewed by Sam Weinig.
+
+        It is unused, one less thing to worry about.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleEqualOrUnordered): Deleted.
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleEqualOrUnordered): Deleted.
+
+2015-12-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Should not emit get_by_id for indexed property access
+        https://bugs.webkit.org/show_bug.cgi?id=151354
+
+        Reviewed by Darin Adler.
+
+        Before this patch, `a["1"]` is converted to `a.1` get_by_id operation in the bytecode compiler.
+        get_by_id emits IC. IC rely on the fact that Structure transition occur when adding / removing object's properties.
+        However, it's not true for indexed element properties. They are stored in the element storage and Structure transition does not occur.
+
+        For example, in the following case,
+
+             function getOne(a) { return a['1']; }
+
+             for (var i = 0; i < 36; ++i)
+                 getOne({2: true});
+
+             if (!getOne({1: true}))
+                 throw new Error("OUT");
+
+        In this case, `a['1']` creates get_by_id. `getOne({2: true})` calls makes getOne's get_by_id to create IC says that,
+        "when comming this structure chain, there is no property in "1", so we should return `undefined`".
+
+        After that, we call `getOne({1: true})`. But in this case, `{2: true}` and `{1: true}` have the same structure chain,
+        because indexed property addition does not occur structure transition.
+        So previous IC fast path is used and return `undefined`. But the correct answer is returning `true`.
+
+        This patch fixes the above issue. When there is string bracket access, we only emits get_by_id if the given string is not an index.
+        There are bugs in get_by_id, put_by_id, put_by_id (direct). But only get_by_id poses user observable issue.
+        Because in the put_by_id case, the generic path just says "this put is uncacheable".
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitDirectPutById):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::isNonIndexStringElement):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ObjectPatternNode::bindValue):
+        * tests/stress/element-property-get-should-not-handled-with-get-by-id.js: Added.
+        (getOne):
+
+2015-12-13  Andreas Kling  <akling@apple.com>
+
+        CachedScript could have a copy-free path for all-ASCII scripts.
+        <https://webkit.org/b/152203>
+
+        Reviewed by Antti Koivisto.
+
+        Make SourceProvider vend a StringView instead of a String.
+        This relaxes the promises that providers have to make about string lifetimes.
+
+        This means that on the WebCore side, CachedScript is free to cache a String
+        internally, while only ever exposing it as a temporary StringView.
+
+        A few extra copies (CPU, not memory) are introduced, none of them on hot paths.
+
+        * API/JSScriptRef.cpp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::sourceCodeForTools):
+        (JSC::CodeBlock::dumpSource):
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::dispatchDidParseSource):
+        (Inspector::ScriptDebugServer::dispatchFailedToParseSource):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jsc.cpp:
+        (functionFindTypeForExpression):
+        (functionHasBasicBlockExecuted):
+        (functionBasicBlockExecutionCount):
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::setCode):
+        * parser/Lexer.h:
+        (JSC::Lexer<LChar>::setCodeStart):
+        (JSC::Lexer<UChar>::setCodeStart):
+        * parser/Parser.h:
+        (JSC::Parser::getToken):
+        * parser/SourceCode.cpp:
+        (JSC::SourceCode::toUTF8):
+        * parser/SourceCode.h:
+        (JSC::SourceCode::hash):
+        (JSC::SourceCode::view):
+        (JSC::SourceCode::toString): Deleted.
+        * parser/SourceCodeKey.h:
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::string):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::getRange):
+        * runtime/Completion.cpp:
+        (JSC::loadAndEvaluateModule):
+        (JSC::loadModule):
+        * runtime/ErrorInstance.cpp:
+        (JSC::appendSourceToError):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * tools/FunctionOverrides.cpp:
+        (JSC::initializeOverrideInfo):
+        (JSC::FunctionOverrides::initializeOverrideFor):
+
+2015-12-12  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Add lowering for B3's Store8 opcode
+        https://bugs.webkit.org/show_bug.cgi?id=152208
+
+        Reviewed by Geoffrey Garen.
+
+        B3 has an opcode to store 8bit values but it had
+        no lowering.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::createStore):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testStore8Arg):
+        (JSC::B3::testStore8Imm):
+        (JSC::B3::testStorePartial8BitRegisterOnX86):
+        (JSC::B3::run):
+
+2015-12-12  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [ARM] Add the missing setupArgumentsWithExecState functions after r193974
+        https://bugs.webkit.org/show_bug.cgi?id=152214
+
+        Reviewed by Mark Lam.
+
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::setupArgumentsWithExecState):
+
+2015-12-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Too many derefs when RemoteInspectorXPCConnection fails to validate connection
+        https://bugs.webkit.org/show_bug.cgi?id=152213
+
+        Rubber-stamped by Ryosuke Niwa.
+
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (Inspector::RemoteInspectorXPCConnection::handleEvent):
+        We should just close the XPC connection triggering XPC_ERROR_CONNECTION_INVALID
+        which will then graceful teardown the connection as expected.
+
+2015-12-11  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add Floating Point Abs() to B3
+        https://bugs.webkit.org/show_bug.cgi?id=152176
+
+        Reviewed by Geoffrey Garen.
+
+        This patch adds an Abs() operation for floating point.
+
+        On x86, Abs() is implemented by masking the top bit
+        of the floating point value. On ARM64, there is a builtin
+        abs opcode.
+
+        To account for those differences, B3 use "Abs" as
+        the cannonical operation. When we are about to lower
+        to Air, Abs is extended on x86 to get a clean handling
+        of the mask constants.
+
+        This patch has one cool thing related to FTL.
+        If you do:
+           @1 = unboxDouble(@0)
+           @2 = abs(@1)
+           @3 = boxDouble(@2)
+
+        B3ReduceStrength completely eliminate the Double-Integer
+        conversion.
+
+        The strength reduction of Abs is aware that it can do a bit
+        mask over the bitcast used by unboxing.
+        If even works if you use floats by forcing fround: reduceDoubleToFloat()
+        elminiates the useless conversions, followed by ReduceStrength
+        that removes the switch from GP to FP.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::andDouble):
+        (JSC::MacroAssemblerX86Common::andFloat):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::andps_rr):
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::bitAndConstant):
+        (JSC::B3::ConstDoubleValue::absConstant):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ConstFloatValue.cpp:
+        (JSC::B3::ConstFloatValue::bitAndConstant):
+        (JSC::B3::ConstFloatValue::absConstant):
+        * b3/B3ConstFloatValue.h:
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3LowerMacrosAfterOptimizations.cpp: Added.
+        (JSC::B3::lowerMacrosAfterOptimizations):
+        * b3/B3LowerMacrosAfterOptimizations.h: Added.
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceDoubleToFloat.cpp:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::absConstant):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::bitAndDouble):
+        (JSC::B3::testBitAndArgDouble):
+        (JSC::B3::testBitAndArgsDouble):
+        (JSC::B3::testBitAndArgImmDouble):
+        (JSC::B3::testBitAndImmsDouble):
+        (JSC::B3::bitAndFloat):
+        (JSC::B3::testBitAndArgFloat):
+        (JSC::B3::testBitAndArgsFloat):
+        (JSC::B3::testBitAndArgImmFloat):
+        (JSC::B3::testBitAndImmsFloat):
+        (JSC::B3::testBitAndArgsFloatWithUselessDoubleConversion):
+        (JSC::B3::testAbsArg):
+        (JSC::B3::testAbsImm):
+        (JSC::B3::testAbsMem):
+        (JSC::B3::testAbsAbsArg):
+        (JSC::B3::testAbsBitwiseCastArg):
+        (JSC::B3::testBitwiseCastAbsBitwiseCastArg):
+        (JSC::B3::testAbsArgWithUselessDoubleConversion):
+        (JSC::B3::testAbsArgWithEffectfulDoubleConversion):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleAbs):
+
+2015-12-11  Mark Lam  <mark.lam@apple.com>
+
+        Removed some dead code, and simplified some code in the baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=152199
+
+        Reviewed by Benjamin Poulain.
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBitBinaryOpFastPath):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitRightShiftFastPath):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+
+2015-12-11  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::reduceStrength should remove redundant Phi's
+        https://bugs.webkit.org/show_bug.cgi?id=152184
+
+        Reviewed by Benjamin Poulain.
+
+        This adds redundant Phi removal using Aycock and Horspools SSA simplification algorithm. This
+        is needed because even in simple asm.js code, we see a lot of CFG simplification that leaves
+        behind totally useless Phi's.
+
+        * b3/B3PhiChildren.cpp:
+        (JSC::B3::PhiChildren::PhiChildren):
+        * b3/B3PhiChildren.h:
+        (JSC::B3::PhiChildren::at):
+        (JSC::B3::PhiChildren::operator[]):
+        (JSC::B3::PhiChildren::phis):
+        * b3/B3ReduceStrength.cpp:
+
+2015-12-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Add an implementation of pow() taking an integer exponent to B3
+        https://bugs.webkit.org/show_bug.cgi?id=152165
+
+        Reviewed by Mark Lam.
+
+        LLVM has this really neat optimized opcode for
+        raising the power of something by an integer exponent.
+
+        There is no such native instruction so we need to extend
+        the existing FTLOutput API to something efficient.
+
+        DFG has a pretty competitive implementation. In this patch,
+        I added a version of it to B3.
+        I created powDoubleInt32() instead of putting the code directly
+        in FTL for easier testing and optimization.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3MathExtras.cpp: Added.
+        (JSC::B3::powDoubleInt32):
+        * b3/B3MathExtras.h: Added.
+        * b3/B3MemoryValue.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testPowDoubleByIntegerLoop):
+        (JSC::B3::run):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::compileArithPowIntegerFastPath):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::doublePowi):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doublePowi): Deleted.
+
+2015-12-11  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should have CSE
+        https://bugs.webkit.org/show_bug.cgi?id=150961
+
+        Reviewed by Benjamin Poulain.
+
+        This implements a very simple CSE for pure values. I need this as a prerequisite for other
+        optimizations that I'm implementing. For now, this is neutral on imaging-gaussian-blur but a
+        slow-down on asm.js code. I suspect that the asm.js slow-down is because of other things that are
+        still going wrong, and anyway, I need CSE to be able to do even the most basic asm.js strength
+        reductions.
+
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3ReduceStrength.h:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::replaceWithIdentity):
+        (JSC::B3::Value::key):
+
+2015-12-11  Mark Lam  <mark.lam@apple.com>
+
+        Refactoring to reduce potential cut-paste errors with the FTL ICs.
+        https://bugs.webkit.org/show_bug.cgi?id=152185
+
+        Reviewed by Saam Barati.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * ftl/FTLCompile.cpp:
+        - ICs now have their own names.  GetById and PutByID fast path ICs no longer just
+          say "inline cache fast path".
+
+        * ftl/FTLCompileBinaryOp.cpp:
+        (JSC::FTL::generateBinaryArithOpFastPath):
+        - Fixed an indentation.
+
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::InlineCacheDescriptor::InlineCacheDescriptor):
+        (JSC::FTL::InlineCacheDescriptor::name):
+        (JSC::FTL::GetByIdDescriptor::GetByIdDescriptor):
+        (JSC::FTL::PutByIdDescriptor::PutByIdDescriptor):
+        (JSC::FTL::CheckInDescriptor::CheckInDescriptor):
+        (JSC::FTL::BinaryOpDescriptor::nodeType):
+        (JSC::FTL::BinaryOpDescriptor::size):
+        (JSC::FTL::BinaryOpDescriptor::slowPathFunction):
+        (JSC::FTL::BinaryOpDescriptor::leftOperand):
+        (JSC::FTL::BinaryOpDescriptor::BinaryOpDescriptor):
+        (JSC::FTL::ArithDivDescriptor::ArithDivDescriptor):
+        (JSC::FTL::ArithDivDescriptor::icSize):
+        (JSC::FTL::ArithDivDescriptor::nodeType):
+        (JSC::FTL::ArithDivDescriptor::opName):
+        (JSC::FTL::ArithDivDescriptor::slowPathFunction):
+        (JSC::FTL::ArithDivDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::ArithMulDescriptor::ArithMulDescriptor):
+        (JSC::FTL::ArithMulDescriptor::icSize):
+        (JSC::FTL::ArithMulDescriptor::nodeType):
+        (JSC::FTL::ArithMulDescriptor::opName):
+        (JSC::FTL::ArithMulDescriptor::slowPathFunction):
+        (JSC::FTL::ArithMulDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::ArithSubDescriptor::ArithSubDescriptor):
+        (JSC::FTL::ArithSubDescriptor::icSize):
+        (JSC::FTL::ArithSubDescriptor::nodeType):
+        (JSC::FTL::ArithSubDescriptor::opName):
+        (JSC::FTL::ArithSubDescriptor::slowPathFunction):
+        (JSC::FTL::ArithSubDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::ValueAddDescriptor::ValueAddDescriptor):
+        (JSC::FTL::ValueAddDescriptor::icSize):
+        (JSC::FTL::ValueAddDescriptor::nodeType):
+        (JSC::FTL::ValueAddDescriptor::opName):
+        (JSC::FTL::ValueAddDescriptor::slowPathFunction):
+        (JSC::FTL::ValueAddDescriptor::nonNumberSlowPathFunction):
+        (JSC::FTL::LazySlowPathDescriptor::LazySlowPathDescriptor):
+        (JSC::FTL::ProbeDescriptor::ProbeDescriptor):
+        (JSC::FTL::BinaryOpDescriptor::name): Deleted.
+        (JSC::FTL::BinaryOpDescriptor::fastPathICName): Deleted.
+        * ftl/FTLInlineCacheDescriptorInlines.h: Removed.
+        - Consolidate the number of places where we have to fill in a data about new
+          snippet ICs.  It is all done in FTLInlineCacheDescriptor.h now.   
+
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileUntypedBinaryOp):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithDiv):
+        - Introduced a compileUntypedBinaryOp() template and use that at all the FTL
+          places that need to use a snippet.  This reduces the amount of cut and paste
+          code.
+
+        * ftl/FTLState.h:
+        - Removed a bad #include.
+
+2015-12-11  Keith Miller  <keith_miller@apple.com>
+
+        Overrides has instance should not move ValueFalse to a register then immediately to the stack in the LLInt.
+        https://bugs.webkit.org/show_bug.cgi?id=152188
+
+        Reviewed by Mark Lam.
+
+        This fixes a minor issue with the code for the overrides_has_instance in the LLInt. Old code had an extra move,
+        which is both slow and breaks the build on cloop.
+
+        * llint/LowLevelInterpreter64.asm:
+
+2015-12-11  Keith Miller  <keith_miller@apple.com>
+
+        [ES6] Add support for Symbol.hasInstance
+        https://bugs.webkit.org/show_bug.cgi?id=151839
+
+        Reviewed by Saam Barati.
+
+        This patch adds support for Symbol.hasInstance, unfortunately in order to prevent
+        regressions several new bytecodes and DFG IR nodes were necessary. Before, Symbol.hasInstance
+        when executing an instanceof expression we would emit three bytecodes: overrides_has_instance, get_by_id,
+        then instanceof. As the spec has changed, we emit a more complicated set of bytecodes in addition to some
+        new ones. First the role of overrides_has_instance and its corresponding DFG node have changed. Now it returns
+        a js-boolean indicating whether the RHS of the instanceof expression (from here on called the constructor for simplicity)
+        needs non-default behavior for resolving the expression. i.e. The constructor has a Symbol.hasInstance that differs from the one on
+        Function.prototype[Symbol.hasInstance] or is a bound/C-API function. Once we get to the DFG this node is generally eliminated as
+        we can prove the value of Symbol.hasInstance is a constant. The second new bytecode is instanceof_custom. insntanceof_custom, just
+        emits a call to slow path code that computes the result.
+
+        In the DFG, there is also a new node, CheckTypeInfoFlags, which checks the type info flags are consistent with the ones provided and
+        OSR exits if the flags are not. Additionally, we attempt to prove that the result of CheckHasValue will be a constant and transform
+        it into a CheckTypeInfoFlags followed by a JSConstant.
+
+        * API/JSCallbackObject.h:
+        * builtins/FunctionPrototype.js:
+        (symbolHasInstance):
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::isBranch): Deleted.
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/ExitKind.cpp:
+        (JSC::exitKindToString):
+        * bytecode/ExitKind.h:
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::getJumpTargetsForBytecodeOffset): Deleted.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitOverridesHasInstance):
+        (JSC::BytecodeGenerator::emitInstanceOfCustom):
+        (JSC::BytecodeGenerator::emitCheckHasInstance): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasCellOperand):
+        (JSC::DFG::Node::hasTypeInfoOperand):
+        (JSC::DFG::Node::typeInfoOperand):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfCustom):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLIntrinsicRepository.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileOverridesHasInstance):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckTypeInfoFlags):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInstanceOfCustom):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckHasInstance): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_overrides_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_instanceof_custom):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof_custom):
+        (JSC::JIT::emit_op_check_has_instance): Deleted.
+        (JSC::JIT::emitSlow_op_check_has_instance): Deleted.
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_overrides_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_instanceof_custom):
+        (JSC::JIT::emitSlow_op_instanceof_custom):
+        (JSC::JIT::emit_op_check_has_instance): Deleted.
+        (JSC::JIT::emitSlow_op_check_has_instance): Deleted.
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonIdentifiers.h:
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::invalidParameterInstanceofSourceAppender):
+        (JSC::invalidParameterInstanceofNotFunctionSourceAppender):
+        (JSC::invalidParameterInstanceofhasInstanceValueNotFunctionSourceAppender):
+        (JSC::createInvalidInstanceofParameterErrorNotFunction):
+        (JSC::createInvalidInstanceofParameterErrorhasInstanceValueNotFunction):
+        (JSC::createInvalidInstanceofParameterError): Deleted.
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSBoundFunction.cpp:
+        (JSC::isBoundFunction):
+        (JSC::hasInstanceBoundFunction):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::functionProtoHasInstanceSymbolFunction):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        (JSC::objectPrivateFuncInstanceOf):
+        * runtime/JSObject.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::overridesHasInstance):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase<Unknown>::slot):
+        * tests/es6.yaml:
+        * tests/stress/instanceof-custom-hasinstancesymbol.js: Added.
+        (Constructor):
+        (value):
+        (instanceOf):
+        (body):
+        * tests/stress/symbol-hasInstance.js: Added.
+        (Constructor):
+        (value):
+        (ObjectClass.Symbol.hasInstance):
+        (NumberClass.Symbol.hasInstance):
+
+2015-12-11  Joseph Pecoraro  <pecoraro@apple.com>
+
+        check-for-inappropriate-objc-class-names should check all class names, not just externally visible ones
+        https://bugs.webkit.org/show_bug.cgi?id=152156
+
+        Reviewed by Dan Bernstein.
+
+        * llvm/InitializeLLVMMac.cpp:
+        Remove stale comment. The ObjC class this comment referenced
+        has already been removed.
+
+2015-12-11  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Little cleanup of FTLOutput type casts and conversions
+        https://bugs.webkit.org/show_bug.cgi?id=152166
+
+        Reviewed by Geoffrey Garen.
+
+        Clean up:
+        -Change fpCast() to explicit conversion doubleToFloat() and floatToDouble()
+         to match B3's opcodes.
+        -Remove unused conversion functions.
+        -Use the most specific cast function when possible.
+        -Functions that are only used inside FTLOutput are made private.
+         In FTLB3Output, those functions were removed.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleToFloat):
+        (JSC::FTL::Output::floatToDouble):
+        (JSC::FTL::Output::fround):
+        (JSC::FTL::Output::fpToInt): Deleted.
+        (JSC::FTL::Output::fpToUInt): Deleted.
+        (JSC::FTL::Output::intToFP): Deleted.
+        (JSC::FTL::Output::unsignedToFP): Deleted.
+        (JSC::FTL::Output::intCast): Deleted.
+        (JSC::FTL::Output::fpCast): Deleted.
+        (JSC::FTL::Output::intToPtr): Deleted.
+        (JSC::FTL::Output::ptrToInt): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutByVal):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::doubleToFloat):
+        (JSC::FTL::Output::floatToDouble):
+        (JSC::FTL::Output::intCast):
+        (JSC::FTL::Output::fpToInt):
+        (JSC::FTL::Output::fpToUInt):
+        (JSC::FTL::Output::fpCast):
+        (JSC::FTL::Output::intToFP):
+        (JSC::FTL::Output::unsignedToFP):
+
+2015-12-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        Binding and builtin generators should lowercase RTCXX as rtcXX and not rTCXX
+        https://bugs.webkit.org/show_bug.cgi?id=152121
+
+        Reviewed by Darin Adler.
+
+        * Scripts/builtins/builtins_generator.py:
+        (WK_lcfirst): Added RTC special rule.
+
+2015-12-09  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be able to run quicksort asm.js test
+        https://bugs.webkit.org/show_bug.cgi?id=152105
+
+        Reviewed by Geoffrey Garen.
+
+        This covers making all of the changes needed to run quicksort.js from AsmBench.
+
+        - Reintroduced float types to FTLLower since we now have B3::Float.
+
+        - Gave FTL::Output the ability to speak of load types and store types separately from LValue
+          types. This dodges the problem that B3 doesn't have types for Int8 and Int16 but supports loads
+          and stores of that type.
+
+        - Implemented Mod in B3 and wrote tests.
+
+        I also fixed a pre-existing bug in a test that appeared to only manifest in release builds.
+
+        Currently, B3's performance on asm.js tests is not good. It should be easy to fix:
+
+        - B3 should strength-reduce the shifting madness that happens in asm.js memory accesses
+          https://bugs.webkit.org/show_bug.cgi?id=152106
+
+        - B3 constant hoisting should have a story for the asm.js heap constant
+          https://bugs.webkit.org/show_bug.cgi?id=152107
+
+        * b3/B3CCallValue.h:
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::divConstant):
+        (JSC::B3::Const32Value::modConstant):
+        (JSC::B3::Const32Value::bitAndConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::divConstant):
+        (JSC::B3::Const64Value::modConstant):
+        (JSC::B3::Const64Value::bitAndConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::divConstant):
+        (JSC::B3::Value::modConstant):
+        (JSC::B3::Value::bitAndConstant):
+        * b3/B3Value.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testChillDiv64):
+        (JSC::B3::testMod):
+        (JSC::B3::testSwitch):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::load16ZeroExt32):
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::store32As8):
+        (JSC::FTL::Output::store32As16):
+        (JSC::FTL::Output::loadFloatToDouble): Deleted.
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::mul):
+        (JSC::FTL::Output::div):
+        (JSC::FTL::Output::chillDiv):
+        (JSC::FTL::Output::rem):
+        (JSC::FTL::Output::neg):
+        (JSC::FTL::Output::load32):
+        (JSC::FTL::Output::load64):
+        (JSC::FTL::Output::loadPtr):
+        (JSC::FTL::Output::loadFloat):
+        (JSC::FTL::Output::loadDouble):
+        (JSC::FTL::Output::store32):
+        (JSC::FTL::Output::store64):
+        (JSC::FTL::Output::storePtr):
+        (JSC::FTL::Output::storeFloat):
+        (JSC::FTL::Output::storeDouble):
+        (JSC::FTL::Output::addPtr):
+        (JSC::FTL::Output::extractValue):
+        (JSC::FTL::Output::call):
+        (JSC::FTL::Output::operation):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compilePutByVal):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArrayPush):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArrayPop):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::Output):
+        (JSC::FTL::Output::store):
+        (JSC::FTL::Output::check):
+        (JSC::FTL::Output::load):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::load32):
+        (JSC::FTL::Output::load64):
+        (JSC::FTL::Output::loadPtr):
+        (JSC::FTL::Output::loadFloat):
+        (JSC::FTL::Output::loadDouble):
+        (JSC::FTL::Output::store32As8):
+        (JSC::FTL::Output::store32As16):
+        (JSC::FTL::Output::store32):
+        (JSC::FTL::Output::store64):
+        (JSC::FTL::Output::storePtr):
+        (JSC::FTL::Output::storeFloat):
+        (JSC::FTL::Output::storeDouble):
+        (JSC::FTL::Output::addPtr):
+        (JSC::FTL::Output::loadFloatToDouble): Deleted.
+        (JSC::FTL::Output::store16): Deleted.
+
+2015-12-10  Filip Pizlo  <fpizlo@apple.com>
+
+        Consider still matching an address expression even if B3 has already assigned a Tmp to it
+        https://bugs.webkit.org/show_bug.cgi?id=150777
+
+        Reviewed by Geoffrey Garen.
+
+        We need some heuristic for when an address should be computed as a separate instruction. It's
+        usually profitable to sink the address into the memory access. The previous heuristic meant that
+        the address would get separate instructions if it was in a separate block from the memory access.
+        This was messing up codegen of things like PutByVal out-of-bounds, where the address is computed
+        in one block and then used in another. I don't think that which block owns the address
+        computation should factor into any heuristic here, since it's so fragile: the compiler may lower
+        something by splitting blocks and we don't want this to ruin performance.
+
+        So, this replaces that heuristic with a more sensible one: the address computation gets its own
+        instruction if it has a lot of uses. In practice this means that we always sink the address
+        computation into the memory access.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::effectiveAddr):
+
+2015-12-10  Daniel Bates  <dabates@apple.com>
+
+        [CSP] eval() is not blocked for stringified literals
+        https://bugs.webkit.org/show_bug.cgi?id=152158
+        <rdar://problem/15775625>
+
+        Reviewed by Saam Barati.
+
+        Fixes an issue where stringified literals can be eval()ed despite being disallowed by
+        Content Security Policy of the page.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::eval): Throw a JavaScript EvalError exception if eval() is disallowed for the page
+        and return undefined.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval): Ditto.
+
+2015-12-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Fix jsc symlink creation on iOS
+        https://bugs.webkit.org/show_bug.cgi?id=152155
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Switch from INSTALL_PATH_ACTUAL to just INSTALL_PATH.
+        Remove now unnecessary INSTALL_PATH_PREFIX use as well.
+
+2015-12-10  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Remote Inspector: Verify the identity of the other side of XPC connections
+        https://bugs.webkit.org/show_bug.cgi?id=152153
+
+        Reviewed by Brian Burg.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Link with the Security framework.
+
+        * inspector/remote/RemoteInspectorXPCConnection.h:
+        * inspector/remote/RemoteInspectorXPCConnection.mm:
+        (auditTokenHasEntitlement):
+        (Inspector::RemoteInspectorXPCConnection::handleEvent):
+        (Inspector::RemoteInspectorXPCConnection::RemoteInspectorXPCConnection): Deleted.
+        When receiving the first message, verify the XPC connection
+        is connected to who we thought we were connected to and
+        Bail if it isn't.
+
+2015-12-10  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add a Modulo operator to B3, and a chill variant
+        https://bugs.webkit.org/show_bug.cgi?id=152110
+
+        Reviewed by Geoffrey Garen.
+
+        It is basically refactoring the Div and ChillDiv
+        code to be used by both opcodes.
+
+        * b3/B3Common.h:
+        (JSC::B3::chillDiv):
+        (JSC::B3::chillMod):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::modConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3Const64Value.cpp:
+        (JSC::B3::Const64Value::modConstant):
+        * b3/B3Const64Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::modConstant):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3LowerMacros.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        (JSC::B3::Air::LowerToAir::lowerX86Div):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::modConstant):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testModArgDouble):
+        (JSC::B3::testModArgsDouble):
+        (JSC::B3::testModArgImmDouble):
+        (JSC::B3::testModImmArgDouble):
+        (JSC::B3::testModImmsDouble):
+        (JSC::B3::testModArgFloat):
+        (JSC::B3::testModArgsFloat):
+        (JSC::B3::testModArgImmFloat):
+        (JSC::B3::testModImmArgFloat):
+        (JSC::B3::testModImmsFloat):
+        (JSC::B3::testModArg):
+        (JSC::B3::testModArgs):
+        (JSC::B3::testModImms):
+        (JSC::B3::testModArg32):
+        (JSC::B3::testModArgs32):
+        (JSC::B3::testModImms32):
+        (JSC::B3::testChillModArg):
+        (JSC::B3::testChillModArgs):
+        (JSC::B3::testChillModImms):
+        (JSC::B3::testChillModArg32):
+        (JSC::B3::testChillModArgs32):
+        (JSC::B3::testChillModImms32):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::mod):
+        (JSC::FTL::Output::chillMod):
+        (JSC::FTL::Output::doubleMod):
+        (JSC::FTL::Output::rem): Deleted.
+        (JSC::FTL::Output::doubleRem): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMod):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::chillMod):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::mod):
+        (JSC::FTL::Output::doubleMod):
+        (JSC::FTL::Output::rem): Deleted.
+        (JSC::FTL::Output::doubleRem): Deleted.
+
+2015-12-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [B3] Add new files to the cmake build system
+        https://bugs.webkit.org/show_bug.cgi?id=152120
+
+        Reviewed by Filip Pizlo.
+
+        * CMakeLists.txt:
+
+2015-12-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [B3] Use mark pragmas only if it is supported
+        https://bugs.webkit.org/show_bug.cgi?id=152123
+
+        Reviewed by Mark Lam.
+
+        * ftl/FTLB3Output.h:
+
+2015-12-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [B3] Typo fix in testb3.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=152126
+
+        Reviewed by Mark Lam.
+
+        * b3/testb3.cpp:
+        (JSC::B3::populateWithInterestingValues):
+
+2015-12-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [B3] Fix unused-but-set-variable warning
+        https://bugs.webkit.org/show_bug.cgi?id=152122
+
+        Reviewed by Mark Lam.
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+
+2015-12-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [B3] Make GCC ignore warnings in FTLB3Output.h
+        https://bugs.webkit.org/show_bug.cgi?id=152124
+
+        Reviewed by Mark Lam.
+
+        * ftl/FTLB3Output.h:
+
+2015-12-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [EFL] Remove the unused IncrementalSweeper::m_isTimerFrozen member after r193749
+        https://bugs.webkit.org/show_bug.cgi?id=152127
+
+        Reviewed by Mark Lam.
+
+        * heap/IncrementalSweeper.h:
+
+2015-12-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Source/JavaScriptCore/create_hash_table shouldn't be too verbose
+        https://bugs.webkit.org/show_bug.cgi?id=151861
+
+        Reviewed by Darin Adler.
+
+        * create_hash_table:
+
+2015-12-10  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        JSC Builtins should use safe array methods
+        https://bugs.webkit.org/show_bug.cgi?id=151501
+
+        Reviewed by Darin Adler.
+
+        Adding @push and @shift to Array prototype.
+        Using @push in TypedArray built-in.
+
+        Covered by added test in LayoutTests/js/builtins
+
+        * builtins/TypedArray.prototype.js:
+        (filter):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::finishCreation):
+        * runtime/CommonIdentifiers.h:
+
+2015-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should have basic GetById support
+        https://bugs.webkit.org/show_bug.cgi?id=152035
+
+        Reviewed by Saam Barati.
+
+        Adds basic GetById support. This was so easy to do. Unlike the LLVM code for this, the B3 code is
+        entirely self-contained within the getById() method in LowerDFG.
+
+        I discovered that we weren't folding Check(NotEqual(x, 0)) to Check(x). This was preventing us
+        from generating good code for Check(NotEqual(BitAnd(x, tagMask), 0)), since the BitAnd was
+        concealed. This was an easy strength reduction rule to add.
+
+        Finally, I found it easier to say append(value, rep) than append(ConstrainedValue(value, rep)), so
+        I added that API. The old ConstrainedValue form is still super useful in other places, like
+        compileCallOrConstruct(), where the two-argument form would be awkward. It's great to have both
+        APIs to pick from.
+
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3StackmapValue.cpp:
+        (JSC::B3::StackmapValue::~StackmapValue):
+        (JSC::B3::StackmapValue::append):
+        * b3/B3StackmapValue.h:
+        * dfg/DFGCommon.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::getById):
+
+2015-12-09  Saam barati  <sbarati@apple.com>
+
+        Update generators' features.json to indicate that we have a spec compliant implementation
+        https://bugs.webkit.org/show_bug.cgi?id=152085
+
+        Reviewed by Joseph Pecoraro.
+
+        * features.json:
+
+2015-12-09  Saam barati  <sbarati@apple.com>
+
+        Update features.json w.r.t tail calls
+        https://bugs.webkit.org/show_bug.cgi?id=152072
+
+        Reviewed by Michael Saboff.
+
+        * features.json:
+
+2015-12-09  Saam barati  <sbarati@apple.com>
+
+        we should emit op_watchdog after op_enter
+        https://bugs.webkit.org/show_bug.cgi?id=151972
+
+        Reviewed by Mark Lam.
+
+        This also solves the issue of watchdog not being
+        observed when we loop purely through tail calls.
+
+        * API/tests/ExecutionTimeLimitTest.cpp:
+        (testExecutionTimeLimit):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitProfiledOpcode):
+        (JSC::BytecodeGenerator::emitEnter):
+        (JSC::BytecodeGenerator::emitLoopHint):
+        * bytecompiler/BytecodeGenerator.h:
+
+2015-12-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Improve how B3 lowers Add() and Sub() on x86
+        https://bugs.webkit.org/show_bug.cgi?id=152026
+
+        Reviewed by Geoffrey Garen.
+
+        The assembler was missing some important x86 forms of
+        ADD and SUB that were making our lowering
+        unfriendly with register allocation.
+
+        First, we were missing a 3 operand version of Add
+        implement with LEA. As a result, an Add would
+        be lowered as:
+            Move op1->srcDest
+            Add op2, srcDest
+        The problem with such code is that op2 and srcDest
+        interferes. It is impossible to assign them the same
+        machine register.
+
+        With the new Add form, we have:
+            Add op1, op2, dest
+        without interferences between any of those values.
+        The add is implement by a LEA without scaling or displacement.
+
+        This patch also adds missing forms of Add and Sub with
+        direct addressing for arguments. This avoids dealing with Tmps
+        that only exist for those operations.
+
+        Finally, the lowering of adding something to itself was updated accordingly.
+        Such operation is transformed in Shl by 2. The lowering of Shl
+        was adding an explicit Move, preventing the use of LEA when it
+        is useful.
+        Instead of having an explicit move, I changed the direct addressing
+        forms to only be selected if the two operands are different.
+        A Move is then added by appendBinOp() if needed.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32):
+        (JSC::MacroAssemblerX86Common::x86Lea32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add64):
+        (JSC::MacroAssemblerX86_64::x86Lea64):
+        (JSC::MacroAssemblerX86_64::sub64):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addq_rm):
+        (JSC::X86Assembler::subq_mr):
+        (JSC::X86Assembler::subq_rm):
+        (JSC::X86Assembler::subq_im):
+        (JSC::X86Assembler::leal_mr):
+        (JSC::X86Assembler::leaq_mr):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testAddArgMem):
+        (JSC::B3::testAddMemArg):
+        (JSC::B3::testAddImmMem):
+        (JSC::B3::testAddArg32):
+        (JSC::B3::testAddArgMem32):
+        (JSC::B3::testAddMemArg32):
+        (JSC::B3::testAddImmMem32):
+        (JSC::B3::testSubArgMem):
+        (JSC::B3::testSubMemArg):
+        (JSC::B3::testSubImmMem):
+        (JSC::B3::testSubMemImm):
+        (JSC::B3::testSubMemArg32):
+        (JSC::B3::testSubArgMem32):
+        (JSC::B3::testSubImmMem32):
+        (JSC::B3::testSubMemImm32):
+        (JSC::B3::run):
+
+2015-12-08  Mark Lam  <mark.lam@apple.com>
+
+        Factoring out common DFG code for bitwise and shift operators.
+        https://bugs.webkit.org/show_bug.cgi?id=152019
+
+        Reviewed by Michael Saboff.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileBitwiseOp):
+        (JSC::DFG::SpeculativeJIT::compileShiftOp):
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2015-12-08  Mark Lam  <mark.lam@apple.com>
+
+        DFG and FTL should be resilient against cases where both snippet operands are constant.
+        https://bugs.webkit.org/show_bug.cgi?id=152017
+
+        Reviewed by Michael Saboff.
+
+        The DFG front end may not always constant fold cases where both operands are
+        constant.  As a result, the DFG and FTL back ends needs to be resilient against
+        this when using snippet generators since the generators do not support the case
+        where both operands are constant.  The strategy for handling this 2 const operands
+        case is to treat at least one of them as a variable if both are constant. 
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        - Also remove the case for folding 2 constant operands.  It is the front end's
+          job to do so, not the back end here.
+
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+
+2015-12-08  Mark Lam  <mark.lam@apple.com>
+
+        Snippefy shift operators for the baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=151875
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.h:
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBitBinaryOpFastPath):
+        - Don't need GPRInfo:: qualifiers.  Removed them to reduce verbosity.
+        - Also removed the emitStoreInt32() case for storing the result on 32-bit ports.
+          This is because:
+          1. The client should not make assumptions about whether the snippet fast path
+             only include cases where the result tag already contain the IntTag.
+          2. The "(op1 == result || op2 == result)" condition for skipping the IntTag
+             storage, is only valid for the bitand, bitor, and bitxor implementations.
+             It is invalid for the lshift implementation that uses this code now.
+          Instead, we'll always unconditionally store what the result tag that the
+          snippet computed for us.
+
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emitRightShiftFastPath):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_lshift): Deleted.
+        (JSC::JIT::emitSlow_op_lshift): Deleted.
+        (JSC::JIT::emitRightShift): Deleted.
+        (JSC::JIT::emitRightShiftSlowCase): Deleted.
+        (JSC::JIT::emit_op_rshift): Deleted.
+        (JSC::JIT::emitSlow_op_rshift): Deleted.
+        (JSC::JIT::emit_op_urshift): Deleted.
+        (JSC::JIT::emitSlow_op_urshift): Deleted.
+
+        * jit/JITLeftShiftGenerator.cpp: Added.
+        (JSC::JITLeftShiftGenerator::generateFastPath):
+        * jit/JITLeftShiftGenerator.h: Added.
+        (JSC::JITLeftShiftGenerator::JITLeftShiftGenerator):
+        * jit/JITRightShiftGenerator.cpp: Added.
+        (JSC::JITRightShiftGenerator::generateFastPath):
+        * jit/JITRightShiftGenerator.h: Added.
+        (JSC::JITRightShiftGenerator::JITRightShiftGenerator):
+
+        * tests/stress/op_lshift.js:
+        * tests/stress/op_rshift.js:
+        * tests/stress/op_urshift.js:
+        - Fixed some values and added others that are meaningful for testing shifts.
+
+        * tests/stress/resources/binary-op-test.js:
+        (stringifyIfNeeded):
+        (generateBinaryTests):
+        - Fixed the test generator to give unique names to all the generated test
+          functions.  Without this, multiple tests may end up using the same global
+          test function.  As a result, with enough test values to test, the function may
+          get prematurely JITted, and the computed expected result which is supposed to
+          be computed by the LLINT, may end up being computed by a JIT instead.
+
+2015-12-08  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Create a Sandbox SPI header
+        https://bugs.webkit.org/show_bug.cgi?id=151981
+
+        Reviewed by Andy Estes.
+
+        * inspector/remote/RemoteInspector.mm:
+
+2015-12-08  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::UnificationPhase should merge isProfitableToUnbox, since this may have been set in ByteCodeParser
+        https://bugs.webkit.org/show_bug.cgi?id=152011
+        rdar://problem/23777875
+
+        Reviewed by Michael Saboff.
+
+        Previously UnificationPhase did not merge this because we used to only set this in FixupPhase, which runs after unification. But now
+        ByteCodeParser may set isProfitableToUnbox as part of how it handles the ArgumentCount of an inlined varargs call, so UnificationPhase
+        needs to merge it after unifying.
+
+        Also changed the order of unification since this makes the bug more obvious and easier to test.
+
+        * dfg/DFGUnificationPhase.cpp:
+        (JSC::DFG::UnificationPhase::run):
+        * tests/stress/varargs-with-unused-count.js: Added.
+
+2015-12-08  Mark Lam  <mark.lam@apple.com>
+
+        Polymorphic operand types for DFG and FTL div.
+        https://bugs.webkit.org/show_bug.cgi?id=151747
+
+        Reviewed by Geoffrey Garen.
+
+        Perf on benchmarks is neutral.  The new JSRegress ftl-object-div test shows
+        a speed up not from the div operator itself, but from the fact that the
+        polymorphic operand types support now allow the test function to run without OSR
+        exiting, thereby realizing the DFG and FTL's speed up on other work that the test
+        function does.
+
+        This patch has passed the layout tests on x86_64 with a debug build.
+        It passed the JSC tests with x86 and x86_64 debug builds.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+
+        * ftl/FTLCompileBinaryOp.cpp:
+        (JSC::FTL::generateBinaryArithOpFastPath):
+        (JSC::FTL::generateBinaryOpFastPath):
+
+        * ftl/FTLInlineCacheDescriptor.h:
+        * ftl/FTLInlineCacheDescriptorInlines.h:
+        (JSC::FTL::ArithDivDescriptor::ArithDivDescriptor):
+        (JSC::FTL::ArithDivDescriptor::icSize):
+
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfArithDiv):
+        * ftl/FTLInlineCacheSize.h:
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+        - Fixed a cut-paste bug where the op_mul IC was using the op_sub IC size.
+          This bug is benign because the op_sub IC size turns out to be larger
+          than op_mul needs.
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithDiv):
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+        - Fixed a bug where the scratchFPR was not allocated for the 64bit port.
+          This bug is benign because the scratchFPR is only needed if we are
+          using scratchGPR register (used for branchConvertDoubleToInt32()) is
+          >= X86Registers::r8.  Since we're always using regT2 for the scratchT2,
+          the scratchFPR is never needed.   However, we should fix this anyway to
+          be correct.
+
+        * tests/stress/op_div.js:
+        - Fixed some test values.
+
+2015-12-05 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        [ES6] "super" and "this" should be lexically bound inside an arrow function and should live in a JSLexicalEnvironment
+        https://bugs.webkit.org/show_bug.cgi?id=149338
+
+        Reviewed by Saam Barati.
+
+        Implemented new version of the lexically bound 'this' in arrow function. In current version 
+        'this' is stored inside of the lexical environment of the function. To store and load we use
+        op_get_from_scope and op_put_to_scope operations. Also new implementation prevent raising TDZ
+        error for arrow functions that are declared before super() but invoke after.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::getSlow):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::isDerivedConstructorContext):
+        (JSC::ExecutableInfo::isArrowFunctionContext):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::isArrowFunction):
+        (JSC::UnlinkedCodeBlock::isDerivedConstructorContext):
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isDerivedConstructorContext):
+        (JSC::BytecodeGenerator::usesArrowFunction):
+        (JSC::BytecodeGenerator::needsToUpdateArrowFunctionContext):
+        (JSC::BytecodeGenerator::usesEval):
+        (JSC::BytecodeGenerator::usesThis):
+        (JSC::BytecodeGenerator::newTarget):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::SuperNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGClobberize.h:
+        * dfg/DFGDoesGC.cpp:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGPromotedHeapLocation.cpp:
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSafeToExecute.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * ftl/FTLCapabilities.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncExprCommon):
+        * jit/JITOpcodes32_64.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        (JSC::ASTBuilder::usesArrowFunction):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::usesArrowFunction):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/ParserModes.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::isArrowFunctionContext):
+        (JSC::ScriptExecutable::isDerivedConstructorContext):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * tests/es6.yaml:
+        * tests/stress/arrowfunction-activation-sink-osrexit.js:
+        * tests/stress/arrowfunction-activation-sink.js:
+        * tests/stress/arrowfunction-lexical-bind-newtarget.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-1.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-2.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-3.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-4.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-1.js:
+        * tests/stress/arrowfunction-lexical-bind-this-7.js: Added.
+        * tests/stress/arrowfunction-tdz-1.js: Added.
+        * tests/stress/arrowfunction-tdz-2.js: Added.
+        * tests/stress/arrowfunction-tdz-3.js: Added.
+        * tests/stress/arrowfunction-tdz-4.js: Added.
+        * tests/stress/arrowfunction-tdz.js: Removed.
+
+2015-12-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(DFG_JIT) build after r193649
+        https://bugs.webkit.org/show_bug.cgi?id=151985
+
+        Reviewed by Saam Barati.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitSlow_op_loop_hint):
+
+2015-12-08  Alberto Garcia  <berto@igalia.com>
+
+        Unreviewed. Remove unnecessary check for 0 in commitSize().
+
+        Change suggested by Darin Adler in bug #130237.
+
+        * interpreter/JSStack.cpp:
+        (JSC::commitSize):
+
+2015-12-08  Ryuan Choi  <ryuan.choi@navercorp.com>
+
+        [EFL] Remove the flag to check timer state in IncrementalSweeper
+        https://bugs.webkit.org/show_bug.cgi?id=151988
+
+        Reviewed by Gyuyoung Kim.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::scheduleTimer):
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::cancelTimer):
+
+2015-12-08  Philippe Normand  <pnormand@igalia.com>
+
+        [Mac][GTK] Fix JSC FTL build
+        https://bugs.webkit.org/show_bug.cgi?id=151915
+
+        Reviewed by Csaba Osztrogonác.
+
+        * CMakeLists.txt: Don't pass version-script option to ld on Darwin because this platform's linker
+        doesn't support this option.
+
+2015-12-08  Alberto Garcia  <berto@igalia.com>
+
+        Unreviewed. Use pageSize() instead of getpagesize() after r193648
+
+        * interpreter/JSStack.cpp:
+        (JSC::commitSize):
+
+2015-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Small style fixes in B3MoveConstants.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=151980
+
+        Reviewed by Benjamin Poulain.
+
+        * b3/B3MoveConstants.cpp:
+
+2015-12-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] On x86, we should XOR registers instead of moving a zero immediate
+        https://bugs.webkit.org/show_bug.cgi?id=151977
+
+        Reviewed by Filip Pizlo.
+
+        It is smaller and the frontend has special support
+        for xor.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::signExtend32ToPtr):
+
+2015-12-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        Fix a typo from r193683
+
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+
+2015-12-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add Float support to B3
+        https://bugs.webkit.org/show_bug.cgi?id=151974
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds comprehensive float support to B3.
+
+        The new phase reduceDoubleToFloat() gives us a primitive
+        version of what LLVM was giving us on floats.
+        It needs to support conversions accross Phis but that can
+        be added later.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::moveDoubleConditionallyFloat):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::sqrtFloat):
+        (JSC::MacroAssemblerX86Common::loadFloat):
+        (JSC::MacroAssemblerX86Common::storeFloat):
+        (JSC::MacroAssemblerX86Common::convertDoubleToFloat):
+        (JSC::MacroAssemblerX86Common::convertFloatToDouble):
+        (JSC::MacroAssemblerX86Common::addFloat):
+        (JSC::MacroAssemblerX86Common::divFloat):
+        (JSC::MacroAssemblerX86Common::subFloat):
+        (JSC::MacroAssemblerX86Common::mulFloat):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchFloat):
+        (JSC::MacroAssemblerX86Common::moveConditionallyDouble):
+        (JSC::MacroAssemblerX86Common::moveConditionallyFloat):
+        (JSC::MacroAssemblerX86Common::jumpAfterFloatingPointCompare):
+        (JSC::MacroAssemblerX86Common::moveConditionallyAfterFloatingPointCompare):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addss_rr):
+        (JSC::X86Assembler::addss_mr):
+        (JSC::X86Assembler::cvtsd2ss_mr):
+        (JSC::X86Assembler::cvtss2sd_mr):
+        (JSC::X86Assembler::movss_rm):
+        (JSC::X86Assembler::movss_mr):
+        (JSC::X86Assembler::mulss_rr):
+        (JSC::X86Assembler::mulss_mr):
+        (JSC::X86Assembler::subss_rr):
+        (JSC::X86Assembler::subss_mr):
+        (JSC::X86Assembler::ucomiss_rr):
+        (JSC::X86Assembler::ucomiss_mr):
+        (JSC::X86Assembler::divss_rr):
+        (JSC::X86Assembler::divss_mr):
+        (JSC::X86Assembler::sqrtss_rr):
+        (JSC::X86Assembler::sqrtss_mr):
+        * b3/B3Const32Value.cpp:
+        (JSC::B3::Const32Value::bitwiseCastConstant):
+        * b3/B3Const32Value.h:
+        * b3/B3ConstDoubleValue.cpp:
+        (JSC::B3::ConstDoubleValue::doubleToFloatConstant):
+        (JSC::B3::ConstDoubleValue::sqrtConstant):
+        * b3/B3ConstDoubleValue.h:
+        * b3/B3ConstFloatValue.cpp: Added.
+        (JSC::B3::ConstFloatValue::~ConstFloatValue):
+        (JSC::B3::ConstFloatValue::negConstant):
+        (JSC::B3::ConstFloatValue::addConstant):
+        (JSC::B3::ConstFloatValue::subConstant):
+        (JSC::B3::ConstFloatValue::mulConstant):
+        (JSC::B3::ConstFloatValue::bitwiseCastConstant):
+        (JSC::B3::ConstFloatValue::floatToDoubleConstant):
+        (JSC::B3::ConstFloatValue::sqrtConstant):
+        (JSC::B3::ConstFloatValue::divConstant):
+        (JSC::B3::ConstFloatValue::equalConstant):
+        (JSC::B3::ConstFloatValue::notEqualConstant):
+        (JSC::B3::ConstFloatValue::lessThanConstant):
+        (JSC::B3::ConstFloatValue::greaterThanConstant):
+        (JSC::B3::ConstFloatValue::lessEqualConstant):
+        (JSC::B3::ConstFloatValue::greaterEqualConstant):
+        (JSC::B3::ConstFloatValue::dumpMeta):
+        * b3/B3ConstFloatValue.h: Copied from Source/JavaScriptCore/b3/B3ConstDoubleValue.h.
+        * b3/B3Generate.cpp:
+        (JSC::B3::generateToAir):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tryOpcodeForType):
+        (JSC::B3::Air::LowerToAir::opcodeForType):
+        (JSC::B3::Air::LowerToAir::appendUnOp):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::appendShift):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreUnOp):
+        (JSC::B3::Air::LowerToAir::tryAppendStoreBinOp):
+        (JSC::B3::Air::LowerToAir::moveForType):
+        (JSC::B3::Air::LowerToAir::relaxedMoveForType):
+        (JSC::B3::Air::LowerToAir::createGenericCompare):
+        (JSC::B3::Air::LowerToAir::createBranch):
+        (JSC::B3::Air::LowerToAir::createCompare):
+        (JSC::B3::Air::LowerToAir::createSelect):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3MemoryValue.cpp:
+        (JSC::B3::MemoryValue::accessByteSize): Deleted.
+        * b3/B3MemoryValue.h:
+        * b3/B3MoveConstants.cpp:
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addIntConstant):
+        * b3/B3ReduceDoubleToFloat.cpp: Added.
+        (JSC::B3::reduceDoubleToFloat):
+        * b3/B3ReduceDoubleToFloat.h: Copied from Source/JavaScriptCore/b3/B3Type.cpp.
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Type.cpp:
+        (WTF::printInternal):
+        * b3/B3Type.h:
+        (JSC::B3::isFloat):
+        (JSC::B3::sizeofType):
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::doubleToFloatConstant):
+        (JSC::B3::Value::floatToDoubleConstant):
+        (JSC::B3::Value::sqrtConstant):
+        (JSC::B3::Value::asTriState):
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::checkOpcode):
+        (JSC::B3::Value::typeFor):
+        * b3/B3Value.h:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::isConstant):
+        (JSC::B3::Value::hasFloat):
+        (JSC::B3::Value::asFloat):
+        (JSC::B3::Value::hasNumber):
+        (JSC::B3::Value::isNegativeZero):
+        (JSC::B3::Value::representableAs):
+        (JSC::B3::Value::asNumber):
+        * b3/B3ValueKey.cpp:
+        (JSC::B3::ValueKey::materialize):
+        * b3/B3ValueKey.h:
+        (JSC::B3::ValueKey::ValueKey):
+        (JSC::B3::ValueKey::floatValue):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::typeForB3Type):
+        (JSC::B3::Air::Arg::widthForB3Type):
+        * b3/air/AirFixPartialRegisterStalls.cpp:
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testAddArgFloat):
+        (JSC::B3::testAddArgsFloat):
+        (JSC::B3::testAddArgImmFloat):
+        (JSC::B3::testAddImmArgFloat):
+        (JSC::B3::testAddImmsFloat):
+        (JSC::B3::testAddArgFloatWithUselessDoubleConversion):
+        (JSC::B3::testAddArgsFloatWithUselessDoubleConversion):
+        (JSC::B3::testAddArgsFloatWithEffectfulDoubleConversion):
+        (JSC::B3::testMulArgFloat):
+        (JSC::B3::testMulArgsFloat):
+        (JSC::B3::testMulArgImmFloat):
+        (JSC::B3::testMulImmArgFloat):
+        (JSC::B3::testMulImmsFloat):
+        (JSC::B3::testMulArgFloatWithUselessDoubleConversion):
+        (JSC::B3::testMulArgsFloatWithUselessDoubleConversion):
+        (JSC::B3::testMulArgsFloatWithEffectfulDoubleConversion):
+        (JSC::B3::testDivArgFloat):
+        (JSC::B3::testDivArgsFloat):
+        (JSC::B3::testDivArgImmFloat):
+        (JSC::B3::testDivImmArgFloat):
+        (JSC::B3::testDivImmsFloat):
+        (JSC::B3::testDivArgFloatWithUselessDoubleConversion):
+        (JSC::B3::testDivArgsFloatWithUselessDoubleConversion):
+        (JSC::B3::testDivArgsFloatWithEffectfulDoubleConversion):
+        (JSC::B3::testSubArgFloat):
+        (JSC::B3::testSubArgsFloat):
+        (JSC::B3::testSubArgImmFloat):
+        (JSC::B3::testSubImmArgFloat):
+        (JSC::B3::testSubImmsFloat):
+        (JSC::B3::testSubArgFloatWithUselessDoubleConversion):
+        (JSC::B3::testSubArgsFloatWithUselessDoubleConversion):
+        (JSC::B3::testSubArgsFloatWithEffectfulDoubleConversion):
+        (JSC::B3::testClzMem32):
+        (JSC::B3::testSqrtArg):
+        (JSC::B3::testSqrtImm):
+        (JSC::B3::testSqrtMem):
+        (JSC::B3::testSqrtArgWithUselessDoubleConversion):
+        (JSC::B3::testSqrtArgWithEffectfulDoubleConversion):
+        (JSC::B3::testDoubleArgToInt64BitwiseCast):
+        (JSC::B3::testDoubleImmToInt64BitwiseCast):
+        (JSC::B3::testTwoBitwiseCastOnDouble):
+        (JSC::B3::testBitwiseCastOnDoubleInMemory):
+        (JSC::B3::testInt64BArgToDoubleBitwiseCast):
+        (JSC::B3::testInt64BImmToDoubleBitwiseCast):
+        (JSC::B3::testTwoBitwiseCastOnInt64):
+        (JSC::B3::testBitwiseCastOnInt64InMemory):
+        (JSC::B3::testFloatImmToInt32BitwiseCast):
+        (JSC::B3::testBitwiseCastOnFloatInMemory):
+        (JSC::B3::testInt32BArgToFloatBitwiseCast):
+        (JSC::B3::testInt32BImmToFloatBitwiseCast):
+        (JSC::B3::testTwoBitwiseCastOnInt32):
+        (JSC::B3::testBitwiseCastOnInt32InMemory):
+        (JSC::B3::testConvertDoubleToFloatArg):
+        (JSC::B3::testConvertDoubleToFloatImm):
+        (JSC::B3::testConvertDoubleToFloatMem):
+        (JSC::B3::testConvertFloatToDoubleArg):
+        (JSC::B3::testConvertFloatToDoubleImm):
+        (JSC::B3::testConvertFloatToDoubleMem):
+        (JSC::B3::testConvertDoubleToFloatToDoubleToFloat):
+        (JSC::B3::testLoadFloatConvertDoubleConvertFloatStoreFloat):
+        (JSC::B3::testFroundArg):
+        (JSC::B3::testFroundMem):
+        (JSC::B3::testStore32):
+        (JSC::B3::modelLoad):
+        (JSC::B3::float>):
+        (JSC::B3::double>):
+        (JSC::B3::testLoad):
+        (JSC::B3::testStoreFloat):
+        (JSC::B3::testReturnFloat):
+        (JSC::B3::simpleFunctionFloat):
+        (JSC::B3::testCallSimpleFloat):
+        (JSC::B3::functionWithHellaFloatArguments):
+        (JSC::B3::testCallFunctionWithHellaFloatArguments):
+        (JSC::B3::testSelectCompareFloat):
+        (JSC::B3::testSelectCompareFloatToDouble):
+        (JSC::B3::testSelectDoubleCompareFloat):
+        (JSC::B3::testSelectFloatCompareFloat):
+        (JSC::B3::populateWithInterestingValues):
+        (JSC::B3::floatingPointOperands):
+        (JSC::B3::int64Operands):
+        (JSC::B3::run):
+        (JSC::B3::testStore): Deleted.
+        (JSC::B3::posInfinity): Deleted.
+        (JSC::B3::negInfinity): Deleted.
+        (JSC::B3::doubleOperands): Deleted.
+        * ftl/FTLB3Output.cpp:
+        (JSC::FTL::Output::loadFloatToDouble):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::fround):
+        * ftl/FTLCommonValues.cpp:
+        (JSC::FTL::CommonValues::CommonValues):
+        * ftl/FTLCommonValues.h:
+
+2015-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be able to flag the tag constants as being super important so that B3 can hoist them and Air can force them into registers
+        https://bugs.webkit.org/show_bug.cgi?id=151955
+
+        Reviewed by Geoffrey Garen.
+
+        Taught B3 about the concept of "fast constants". A client of B3 can now tell B3 which
+        constants are super important. B3 will not spill the constant in that case and will ensure
+        that the constant is materialized only once: statically once, and dynamically once per
+        procedure execution. The hoistFastConstants() algorithm in B3MoveConstants.cpp achieves this
+        by first picking the lowest common dominator of all uses of each fast constant, and then
+        picking the materialization point by finding the lowest dominator of that dominator that is
+        tied for lowest block frequency. In practice, the second step ensures that this is the lowest
+        point in the program that is not in a loop (i.e. executes no more than once dynamically per
+        procedure invocation).
+
+        Taught Air about the concept of "fast tmps". B3 tells Air that a tmp is fast if it is used to
+        hold the materialization of a fast constant. IRC will use the lowest possible spill score for
+        fast tmps. In practice, this ensures that fast constants are never spilled.
+
+        Added a small snippet of code to FTL::LowerDFGToLLVM that makes both of the tag constants
+        into fast constants.
+
+        My hope is that this very brute-force heuristic is good enough that we don't have to think
+        about constants for a while. Based on my experience with how LLVM's constant hoisting works
+        out, the heuristic in this patch is going to be tough to beat. LLVM's constant hoisting does
+        good things when it hoists the tags, and usually causes nothing but problems when it hoists
+        anything else. This is because there is no way a low-level compiler to really understand how
+        a constant materialization impacts some operation's contribution to the overall execution
+        time of a procedure. But, in the FTL we know that constant materializations for type checks
+        are a bummer because we are super comfortable placing type checks on the hottest of paths. So
+        those are the last paths where extra instructions should be added by the compiler. On the
+        other hand, all other large constant uses are on relatively cold paths, or paths that are
+        already expensive for other reasons. For example, global variable accesses have to
+        materialize a pointer to the global. But that's not really a big deal, since a load from a
+        global involves first the load itself and then type checks on the result - so probably the
+        constant materialization is just not interesting. A store to a global often involves a store
+        barrier, so the constant materialization is really not interesting. This patch codifies this
+        heuristic in a pact between Air, B3, and the FTL: FTL demands that B3 pin the two tags in
+        registers, and B3 relays the demand to Air.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3CFG.h: Added.
+        (JSC::B3::CFG::CFG):
+        (JSC::B3::CFG::root):
+        (JSC::B3::CFG::newMap):
+        (JSC::B3::CFG::successors):
+        (JSC::B3::CFG::predecessors):
+        (JSC::B3::CFG::index):
+        (JSC::B3::CFG::node):
+        (JSC::B3::CFG::numNodes):
+        (JSC::B3::CFG::dump):
+        * b3/B3Dominators.h: Added.
+        (JSC::B3::Dominators::Dominators):
+        * b3/B3IndexMap.h:
+        (JSC::B3::IndexMap::resize):
+        (JSC::B3::IndexMap::size):
+        (JSC::B3::IndexMap::operator[]):
+        * b3/B3LowerMacros.cpp:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::tmp):
+        * b3/B3MoveConstants.cpp:
+        * b3/B3Opcode.h:
+        (JSC::B3::constPtrOpcode):
+        (JSC::B3::isConstant):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::Procedure):
+        (JSC::B3::Procedure::resetReachability):
+        (JSC::B3::Procedure::invalidateCFG):
+        (JSC::B3::Procedure::dump):
+        (JSC::B3::Procedure::deleteValue):
+        (JSC::B3::Procedure::dominators):
+        (JSC::B3::Procedure::addFastConstant):
+        (JSC::B3::Procedure::isFastConstant):
+        (JSC::B3::Procedure::addDataSection):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::size):
+        (JSC::B3::Procedure::cfg):
+        (JSC::B3::Procedure::setLastPhaseName):
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3ValueInlines.h:
+        (JSC::B3::Value::isConstant):
+        (JSC::B3::Value::isInteger):
+        * b3/B3ValueKey.h:
+        (JSC::B3::ValueKey::canMaterialize):
+        (JSC::B3::ValueKey::isConstant):
+        * b3/air/AirCode.cpp:
+        (JSC::B3::Air::Code::findNextBlock):
+        (JSC::B3::Air::Code::addFastTmp):
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::specials):
+        (JSC::B3::Air::Code::isFastTmp):
+        (JSC::B3::Air::Code::setLastPhaseName):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        * dfg/DFGDominators.h:
+        * dfg/DFGSSACalculator.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+
+2015-12-07  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement String.prototype.toLocaleUpperCase in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147609
+
+        Reviewed by Benjamin Poulain.
+
+        Refactor most of toLocaleLowerCase to static function used by both
+        toLocaleUpperCase and toLocaleLowerCase.
+        Add toLocaleUpperCase using icu u_strToUpper.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::toLocaleCase):
+        (JSC::stringProtoFuncToLocaleLowerCase):
+        (JSC::stringProtoFuncToLocaleUpperCase):
+
+2015-12-07  Michael Saboff  <msaboff@apple.com>
+
+        CRASH: CodeBlock::setOptimizationThresholdBasedOnCompilationResult + 567
+        https://bugs.webkit.org/show_bug.cgi?id=151892
+
+        Reviewed by Geoffrey Garen.
+
+        Reverted the change made in change set r193491.
+
+        The updated change is to finish all concurrent compilations and install the resulting
+        code blocks before we make any state changes due to debugger activity.  After all code
+        blocks have been installed, we make the debugger state changes, including jettisoning
+        all optimized code blocks.
+
+        This means that we will discard the optimized code blocks we just installed,
+        but we won't do that while on the install code block path.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult): Reverted r193491.
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::setSteppingMode):
+        (JSC::Debugger::registerCodeBlock):
+        (JSC::Debugger::toggleBreakpoint):
+        (JSC::Debugger::clearBreakpoints):
+        (JSC::Debugger::clearDebuggerRequests):
+        Call Heap::completeAllDFGPlans() before updating code blocks for debugging changes.
+
+        * heap/Heap.h: Made completeAllDFGPlans() public.
+
+2015-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL lowering should tell B3 the right block frequencies
+        https://bugs.webkit.org/show_bug.cgi?id=151531
+
+        Reviewed by Geoffrey Garen.
+
+        This glues together the DFG's view of basic block execution counts and B3's block frequencies.
+        This further improves our performance on imaging-gaussian-blur. It appears to improve the steady
+        state throughput by almost 4%.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::setFrequency):
+        (JSC::FTL::Output::newBlock):
+        (JSC::FTL::Output::insertNewBlocksBefore):
+        (JSC::FTL::Output::callWithoutSideEffects):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileBlock):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::setFrequency):
+        (JSC::FTL::Output::insertNewBlocksBefore):
+
+2015-12-07  Saam barati  <sbarati@apple.com>
+
+        Update JSC feature list for rest parameters and generators
+        https://bugs.webkit.org/show_bug.cgi?id=151740
+
+        Reviewed by Joseph Pecoraro.
+
+        * features.json:
+
+2015-12-07  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG ASSERTION FAILED: m_plan.weakReferences.contains(structure).
+        https://bugs.webkit.org/show_bug.cgi?id=151952
+
+        Reviewed by Mark Lam.
+
+        Fix a bug revealed by the new ftl-has-a-bad-time.js test. It turns out that our handling of
+        structures reachable from the compiler wasn't accounting for having a bad time.
+
+        * dfg/DFGStructureRegistrationPhase.cpp:
+        (JSC::DFG::StructureRegistrationPhase::run):
+
+2015-12-07  Saam barati  <sbarati@apple.com>
+
+        Add op_watchdog opcode that is generated when VM has a watchdog
+        https://bugs.webkit.org/show_bug.cgi?id=151954
+
+        Reviewed by Mark Lam.
+
+        This patch also makes watchdog a private member
+        of VM and adds a getter function.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupClearExecutionTimeLimit):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoopHint):
+        (JSC::BytecodeGenerator::emitWatchdog):
+        (JSC::BytecodeGenerator::retrieveLastBinaryOp):
+        * bytecompiler/BytecodeGenerator.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckWatchdogTimer):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_hint):
+        (JSC::JIT::emitSlow_op_loop_hint):
+        (JSC::JIT::emit_op_watchdog):
+        (JSC::JIT::emitSlow_op_watchdog):
+        (JSC::JIT::emit_op_new_regexp):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/VM.cpp:
+        (JSC::VM::ensureWatchdog):
+        * runtime/VM.h:
+        (JSC::VM::watchdog):
+        * runtime/VMEntryScope.cpp:
+        (JSC::VMEntryScope::VMEntryScope):
+        (JSC::VMEntryScope::~VMEntryScope):
+        * runtime/VMInlines.h:
+        (JSC::VM::shouldTriggerTermination):
+
+2015-12-07  Alberto Garcia  <berto@igalia.com>
+
+        Crashes on PPC64 due to mprotect() on address not aligned to the page size
+        https://bugs.webkit.org/show_bug.cgi?id=130237
+
+        Reviewed by Mark Lam.
+
+        Make sure that commitSize is at least as big as the page size.
+
+        * interpreter/JSStack.cpp:
+        (JSC::commitSize):
+        (JSC::JSStack::JSStack):
+        (JSC::JSStack::growSlowCase):
+        * interpreter/JSStack.h:
+
+2015-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should be able to make JS->JS calls
+        https://bugs.webkit.org/show_bug.cgi?id=151901
+
+        Reviewed by Saam Barati.
+
+        This adds support for the Call and InvalidationPoint opcodes in DFG IR. This required doing some
+        clean-up in the OSR exit code. We don't want the B3 FTL to use a bunch of vectors to hold
+        side-state, so the use of OSRExitDescriptorImpl is not right. It makes sense in the LLVM FTL
+        because that code needs some way of saving some state from LowerDFGToLLVM to compile(), but
+        that's not how B3 FTL works. It turns out that for B3 FTL, there isn't anything in
+        OSRExitDescriptorImpl that the code in LowerDFGToLLVM can't just capture in a lambda.
+
+        This also simplifies some stackmap-related APIs, since I got tired of writing boilerplate.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
+        (JSC::AbstractMacroAssembler::addLinkTask):
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::generate):
+        * b3/B3Effects.h:
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::generate):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addDataSection):
+        (JSC::B3::Procedure::callArgAreaSize):
+        (JSC::B3::Procedure::requestCallArgAreaSize):
+        (JSC::B3::Procedure::frameSize):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::releaseByproducts):
+        (JSC::B3::Procedure::code):
+        * b3/B3StackmapGenerationParams.cpp: Added.
+        (JSC::B3::StackmapGenerationParams::usedRegisters):
+        (JSC::B3::StackmapGenerationParams::proc):
+        (JSC::B3::StackmapGenerationParams::StackmapGenerationParams):
+        * b3/B3StackmapGenerationParams.h: Added.
+        (JSC::B3::StackmapGenerationParams::value):
+        (JSC::B3::StackmapGenerationParams::reps):
+        (JSC::B3::StackmapGenerationParams::size):
+        (JSC::B3::StackmapGenerationParams::at):
+        (JSC::B3::StackmapGenerationParams::operator[]):
+        (JSC::B3::StackmapGenerationParams::begin):
+        (JSC::B3::StackmapGenerationParams::end):
+        (JSC::B3::StackmapGenerationParams::context):
+        (JSC::B3::StackmapGenerationParams::addLatePath):
+        * b3/B3StackmapValue.h:
+        * b3/B3ValueRep.h:
+        (JSC::B3::ValueRep::doubleValue):
+        (JSC::B3::ValueRep::withOffset):
+        * b3/air/AirGenerationContext.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testSimplePatchpoint):
+        (JSC::B3::testSimplePatchpointWithoutOuputClobbersGPArgs):
+        (JSC::B3::testSimplePatchpointWithOuputClobbersGPArgs):
+        (JSC::B3::testSimplePatchpointWithoutOuputClobbersFPArgs):
+        (JSC::B3::testSimplePatchpointWithOuputClobbersFPArgs):
+        (JSC::B3::testPatchpointWithEarlyClobber):
+        (JSC::B3::testPatchpointCallArg):
+        (JSC::B3::testPatchpointFixedRegister):
+        (JSC::B3::testPatchpointAny):
+        (JSC::B3::testPatchpointLotsOfLateAnys):
+        (JSC::B3::testPatchpointAnyImm):
+        (JSC::B3::testPatchpointManyImms):
+        (JSC::B3::testPatchpointWithRegisterResult):
+        (JSC::B3::testPatchpointWithStackArgumentResult):
+        (JSC::B3::testPatchpointWithAnyResult):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::testCheckLessThan):
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::testCheckAddImm):
+        (JSC::B3::testCheckAddImmCommute):
+        (JSC::B3::testCheckAddImmSomeRegister):
+        (JSC::B3::testCheckAdd):
+        (JSC::B3::testCheckAdd64):
+        (JSC::B3::testCheckSubImm):
+        (JSC::B3::testCheckSubBadImm):
+        (JSC::B3::testCheckSub):
+        (JSC::B3::testCheckSub64):
+        (JSC::B3::testCheckNeg):
+        (JSC::B3::testCheckNeg64):
+        (JSC::B3::testCheckMul):
+        (JSC::B3::testCheckMulMemory):
+        (JSC::B3::testCheckMul2):
+        (JSC::B3::testCheckMul64):
+        (JSC::B3::genericTestCompare):
+        * ftl/FTLExceptionHandlerManager.cpp:
+        * ftl/FTLExceptionHandlerManager.h:
+        * ftl/FTLJSCall.cpp:
+        * ftl/FTLJSCall.h:
+        * ftl/FTLJSCallBase.cpp:
+        (JSC::FTL::JSCallBase::emit):
+        * ftl/FTLJSCallBase.h:
+        * ftl/FTLJSCallVarargs.cpp:
+        * ftl/FTLJSCallVarargs.h:
+        * ftl/FTLJSTailCall.cpp:
+        (JSC::FTL::DFG::getRegisterWithAddend):
+        (JSC::FTL::JSTailCall::emit):
+        (JSC::FTL::JSTailCall::JSTailCall): Deleted.
+        * ftl/FTLJSTailCall.h:
+        (JSC::FTL::JSTailCall::stackmapID):
+        (JSC::FTL::JSTailCall::estimatedSize):
+        (JSC::FTL::JSTailCall::operator<):
+        (JSC::FTL::JSTailCall::patchpoint): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCallOrConstruct):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callCheck):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitBranchToOSRExitIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::exitValueForNode):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
+        (JSC::FTL::OSRExitDescriptor::emitOSRExit):
+        (JSC::FTL::OSRExitDescriptor::emitOSRExitLater):
+        (JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::recoverRegistersFromSpillSlot):
+        (JSC::FTL::OSRExit::willArriveAtExitFromIndirectExceptionCheck):
+        (JSC::FTL::OSRExit::needsRegisterRecoveryOnGenericUnwindOSRExitPath):
+        * ftl/FTLOSRExit.h:
+        (JSC::FTL::OSRExitDescriptorImpl::OSRExitDescriptorImpl):
+        (JSC::FTL::OSRExit::considerAddingAsFrequentExitSite):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLState.h:
+
+2015-12-07  Saam barati  <sbarati@apple.com>
+
+        Rename Watchdog::didFire to Watchdog::shouldTerminate because that's what didFire really meant
+        https://bugs.webkit.org/show_bug.cgi?id=151944
+
+        Reviewed by Mark Lam.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * runtime/VMInlines.h:
+        (JSC::VM::shouldTriggerTermination):
+        * runtime/Watchdog.cpp:
+        (JSC::Watchdog::terminateSoon):
+        (JSC::Watchdog::shouldTerminateSlow):
+        (JSC::Watchdog::didFireSlow): Deleted.
+        * runtime/Watchdog.h:
+        (JSC::Watchdog::shouldTerminate):
+        (JSC::Watchdog::didFire): Deleted.
+
+2015-12-07  Mark Lam  <mark.lam@apple.com>
+
+        Rename JITBitwiseBinaryOpGenerator to JITBitBinaryOpGenerator.
+        https://bugs.webkit.org/show_bug.cgi?id=151945
+
+        Reviewed by Saam Barati.
+
+        The lshift operator also need to inherit from JITBitBinaryOpGenerator.  Calling
+        it "BitBinaryOp" makes more sense than "BitwiseBinaryOp" in that case, and still
+        makes sense for the bitand, bitor, and bitxor operators.
+
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBitBinaryOpFastPath):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        (JSC::JIT::emitBitwiseBinaryOpFastPath): Deleted.
+        * jit/JITBitAndGenerator.h:
+        (JSC::JITBitAndGenerator::JITBitAndGenerator):
+        * jit/JITBitBinaryOpGenerator.h: Copied from Source/JavaScriptCore/jit/JITBitwiseBinaryOpGenerator.h.
+        (JSC::JITBitBinaryOpGenerator::JITBitBinaryOpGenerator):
+        (JSC::JITBitwiseBinaryOpGenerator::JITBitwiseBinaryOpGenerator): Deleted.
+        * jit/JITBitOrGenerator.h:
+        (JSC::JITBitOrGenerator::JITBitOrGenerator):
+        * jit/JITBitXorGenerator.h:
+        (JSC::JITBitXorGenerator::JITBitXorGenerator):
+        * jit/JITBitwiseBinaryOpGenerator.h: Removed.
+
+2015-12-07  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [B3] Typo fix after r193386 to fix the build
+        https://bugs.webkit.org/show_bug.cgi?id=151860
+
+        Reviewed by Filip Pizlo.
+
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::isArgValidForValue):
+
+2015-12-07  Gyuyoung Kim  <gyuyoung.kim@webkit.org>
+
+        [EFL] Implement scheduleTimer and cancelTimer in IncrementalSweeper class
+        https://bugs.webkit.org/show_bug.cgi?id=151656
+
+        Reviewed by Csaba Osztrogonác.
+
+        Support IncremntalSweeper using Ecore_Timer.
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::scheduleTimer):
+        (JSC::IncrementalSweeper::cancelTimer):
+        * heap/IncrementalSweeper.h:
+
+2015-12-06  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement String.prototype.toLocaleLowerCase in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147608
+
+        Reviewed by Benjamin Poulain.
+
+        Add toLocaleLowerCase using icu u_strToLower.
+
+        * runtime/IntlObject.cpp:
+        (JSC::defaultLocale): Expose.
+        (JSC::bestAvailableLocale): Expose.
+        (JSC::removeUnicodeLocaleExtension): Expose.
+        * runtime/IntlObject.h:
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::finishCreation):
+        (JSC::stringProtoFuncToLocaleLowerCase): Add.
+
+2015-12-06  David Kilzer  <ddkilzer@apple.com>
+
+        REGRESSION(r193584): Causes heap use-after-free crashes in Web Inspector tests with AddressSanitizer (Requested by ddkilzer on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=151929
+
+        Reverted changeset:
+
+        "[ES6] "super" and "this" should be lexically bound inside an
+        arrow function and should live in a JSLexicalEnvironment"
+        https://bugs.webkit.org/show_bug.cgi?id=149338
+        http://trac.webkit.org/changeset/193584
+
+2015-12-06  Skachkov Oleksandr  <gskachkov@gmail.com>
+
+        [es6] Arrow function syntax. Fix tests after 149338 landing
+        https://bugs.webkit.org/show_bug.cgi?id=151927
+
+        Reviewed by Saam Barati.
+
+        After landing patch for 149338 errors appear in for ES6 Generator. Current fix is removed assert 
+        that was removed by patch with implemenation of ES6 Generator.
+ 
+        * runtime/CommonSlowPaths.cpp:
+
+2015-12-05 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        [ES6] "super" and "this" should be lexically bound inside an arrow function and should live in a JSLexicalEnvironment
+        https://bugs.webkit.org/show_bug.cgi?id=149338
+
+        Reviewed by Saam Barati.
+
+        Implemented new version of the lexically bound 'this' in arrow function. In current version 
+        'this' is stored inside of the lexical environment of the function. To store and load we use
+        op_get_from_scope and op_put_to_scope operations. Also new implementation prevent raising TDZ
+        error for arrow functions that are declared before super() but invoke after.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::getSlow):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::isDerivedConstructorContext):
+        (JSC::ExecutableInfo::isArrowFunctionContext):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::isArrowFunction):
+        (JSC::UnlinkedCodeBlock::isDerivedConstructorContext):
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isDerivedConstructorContext):
+        (JSC::BytecodeGenerator::usesArrowFunction):
+        (JSC::BytecodeGenerator::needsToUpdateArrowFunctionContext):
+        (JSC::BytecodeGenerator::usesEval):
+        (JSC::BytecodeGenerator::usesThis):
+        (JSC::BytecodeGenerator::newTarget):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::SuperNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGClobberize.h:
+        * dfg/DFGDoesGC.cpp:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGPromotedHeapLocation.cpp:
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSafeToExecute.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * ftl/FTLCapabilities.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncExprCommon):
+        * jit/JITOpcodes32_64.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        (JSC::ASTBuilder::usesArrowFunction):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::usesArrowFunction):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/ParserModes.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::isArrowFunctionContext):
+        (JSC::ScriptExecutable::isDerivedConstructorContext):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * tests/es6.yaml:
+        * tests/stress/arrowfunction-activation-sink-osrexit.js:
+        * tests/stress/arrowfunction-activation-sink.js:
+        * tests/stress/arrowfunction-lexical-bind-newtarget.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-1.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-2.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-3.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-4.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-1.js:
+        * tests/stress/arrowfunction-lexical-bind-this-7.js: Added.
+        * tests/stress/arrowfunction-tdz-1.js: Added.
+        * tests/stress/arrowfunction-tdz-2.js: Added.
+        * tests/stress/arrowfunction-tdz-3.js: Added.
+        * tests/stress/arrowfunction-tdz-4.js: Added.
+        * tests/stress/arrowfunction-tdz.js: Removed.
+
+2015-12-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove FTLOutput's fence support
+        https://bugs.webkit.org/show_bug.cgi?id=151909
+
+        Reviewed by Sam Weinig.
+
+        Unused code is unused.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::fence): Deleted.
+        (JSC::FTL::Output::fenceAcqRel): Deleted.
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::fence): Deleted.
+        (JSC::FTL::Output::fenceAcqRel): Deleted.
+
+2015-12-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Some more cleanup of FTLB3Output
+        https://bugs.webkit.org/show_bug.cgi?id=151834
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::trap):
+        (JSC::FTL::Output::stackmapIntrinsic): Deleted.
+        (JSC::FTL::Output::frameAddressIntrinsic): Deleted.
+        (JSC::FTL::Output::patchpointInt64Intrinsic): Deleted.
+        (JSC::FTL::Output::patchpointVoidIntrinsic): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::probe):
+
+2015-12-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Fix Value::returnsBool() after r193436
+        https://bugs.webkit.org/show_bug.cgi?id=151902
+
+        Reviewed by Saam Barati.
+
+        I forgot to carry a test from Branch and Select :(
+
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::returnsBool):
+
+2015-12-04  Andy VanWagoner  <thetalecrafter@gmail.com>
+
+        [INTL] Implement Number.prototype.toLocaleString in ECMA-402
+        https://bugs.webkit.org/show_bug.cgi?id=147610
+
+        Reviewed by Benjamin Poulain.
+
+        Add toLocaleString in builtin JavaScript that delegates formatting to Intl.NumberFormat.
+        Keep exisiting native implementation for use if INTL flag is disabled.
+
+        * CMakeLists.txt: Add NumberPrototype.js.
+        * DerivedSources.make: Add NumberPrototype.js.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/NumberPrototype.js: Added.
+        (toLocaleString):
+        * runtime/CommonIdentifiers.h: Add private names for Intl constructors.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Expose Intl constructors to builtin js.
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::finishCreation): Replace toLocaleString implementation.
+
+2015-12-04  Michael Saboff  <msaboff@apple.com>
+
+        CRASH: CodeBlock::setOptimizationThresholdBasedOnCompilationResult + 567
+        https://bugs.webkit.org/show_bug.cgi?id=151892
+
+        Reviewed by Mark Lam.
+
+        When the debugger is in the process of attaching and it recompiles functions
+        for debugging, there can also be a DFG compilation running concurrently.
+        When we go to update the optimization threshold and find that the replacement
+        is also baseline code, we shouldn't update the threshold.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult):
+
+2015-12-04  Jonathan Davis  <jond@apple.com>
+
+        Update feature status for up-to-date status information.
+        https://bugs.webkit.org/show_bug.cgi?id=151821
+
+        Reviewed by Timothy Hatcher.
+
+        * features.json:
+
+2015-12-04  Saam barati  <sbarati@apple.com>
+
+        OSR exits that are exception handlers should emit less code eagerly in the thunk generator, and instead, should defer as much code generation as possible to be lazily generated in the exit itself
+        https://bugs.webkit.org/show_bug.cgi?id=151406
+
+        Reviewed by Filip Pizlo.
+
+        We no longer emit any extra code eagerly for an OSRExit that
+        is an exception handler. We emit all code lazily in the exit
+        itself. This has one interesting consequence which is that the
+        actual C call to compile the exit goes through an OSR exit generation
+        thunk that must now be aware of resetting the call frame and the stack
+        pointer to their proper values before making the compileOSRExit C
+        call. This has one interesting consequence in the FTL because the
+        FTL will do a pushToSaveImmediateWithoutTouchingRegisters with the
+        OSR exit index. We must take care to preserve this exit index when
+        we reset the stack pointer by re-pushing it onto the stack.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::jitCodeOffset):
+        (JSC::CodeBlock::jitType):
+        * dfg/DFGCommonData.h:
+        (JSC::DFG::CommonData::frameRegisterCountOffset):
+        * dfg/DFGJITCode.h:
+        (JSC::DFG::JITCode::setOSREntryBlock):
+        (JSC::DFG::JITCode::clearOSREntryBlock):
+        (JSC::DFG::JITCode::commonDataOffset):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::linkOSRExits):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompilerCommon.h:
+        (JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::~ExitThunkGenerator):
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        (JSC::FTL::ExitThunkGenerator::emitThunks):
+        * ftl/FTLExitThunkGenerator.h:
+        (JSC::FTL::ExitThunkGenerator::didThings):
+        * ftl/FTLJITCode.h:
+        (JSC::FTL::JITCode::commonDataOffset):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::genericGenerationThunkGenerator):
+        (JSC::FTL::osrExitGenerationThunkGenerator):
+        (JSC::FTL::lazySlowPathGenerationThunkGenerator):
+        (JSC::FTL::registerClobberCheck):
+
+2015-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Having a bad time has a really awful time when it runs at the same time as the JIT
+        https://bugs.webkit.org/show_bug.cgi?id=151882
+        rdar://problem/23547038
+
+        Unreviewed, really adding the test this time.
+
+        * tests/stress/ftl-has-a-bad-time.js: Added.
+        (foo):
+
+2015-12-04  Mark Lam  <mark.lam@apple.com>
+
+        Snippefy bitwise operators for the baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=151680
+
+        Reviewed by Geoffrey Garen.
+
+        This patch has passed the JSC tests on x86 and x86_64.  It has also passed the
+        layout tests on x86_64.
+
+        With the DFG enabled, perf is neutral on x86_64 and x86.
+        With the DFG disabled on x86_64, some AsmBench tests are showing progressions e.g.
+            gcc-loops.cpp           1.0269x faster
+            stepanov_container.cpp  1.0180x faster
+
+        With the DFG disabled on x86, perf is neutral.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::moveValueRegs):
+        (JSC::AssemblyHelpers::branchIfNotInt32):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emitBitwiseBinaryOpFastPath):
+        - Template for the bitwise operations.
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_bitor):
+        (JSC::JIT::emit_op_bitxor):
+        - Specializes emitBitwiseBinaryOpFastPath() with the respective snippet generators.
+        (JSC::JIT::emitSlow_op_bitand):
+        (JSC::JIT::emitSlow_op_bitor):
+        (JSC::JIT::emitSlow_op_bitxor):
+        - Implement respective slow paths.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emit_op_bitand): Deleted.
+        (JSC::JIT::emitSlow_op_bitand): Deleted.
+        (JSC::JIT::emit_op_bitor): Deleted.
+        (JSC::JIT::emitSlow_op_bitor): Deleted.
+        (JSC::JIT::emit_op_bitxor): Deleted.
+        (JSC::JIT::emitSlow_op_bitxor): Deleted.
+        - Now unified with the 64-bit version using snippets. 
+
+        * jit/JITBitAndGenerator.cpp: Added.
+        (JSC::JITBitAndGenerator::generateFastPath):
+        * jit/JITBitAndGenerator.h: Added.
+        (JSC::JITBitAndGenerator::JITBitAndGenerator):
+        * jit/JITBitOrGenerator.cpp: Added.
+        (JSC::JITBitOrGenerator::generateFastPath):
+        * jit/JITBitOrGenerator.h: Added.
+        (JSC::JITBitOrGenerator::JITBitOrGenerator):
+        * jit/JITBitXorGenerator.cpp: Added.
+        (JSC::JITBitXorGenerator::generateFastPath):
+        * jit/JITBitXorGenerator.h: Added.
+        (JSC::JITBitXorGenerator::JITBitXorGenerator):
+        * jit/JITBitwiseBinaryOpGenerator.h: Added.
+        (JSC::JITBitwiseBinaryOpGenerator::JITBitwiseBinaryOpGenerator):
+        (JSC::JITBitwiseBinaryOpGenerator::didEmitFastPath):
+        (JSC::JITBitwiseBinaryOpGenerator::endJumpList):
+        (JSC::JITBitwiseBinaryOpGenerator::slowPathJumpList):
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_bitxor): Deleted.
+        (JSC::JIT::emit_op_bitor): Deleted.
+        (JSC::JIT::emitSlow_op_bitxor): Deleted.
+        (JSC::JIT::emitSlow_op_bitor): Deleted.
+        * jit/SnippetOperand.h:
+        (JSC::SnippetOperand::SnippetOperand):
+
+        * tests/stress/op_bitand.js:
+        * tests/stress/op_bitor.js:
+        * tests/stress/op_bitxor.js:
+        - Fix a test value typo: it's supposed to be 0x7fffffff, not 0x7ffffff.
+
+2015-12-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Having a bad time has a really awful time when it runs at the same time as the JIT
+        https://bugs.webkit.org/show_bug.cgi?id=151882
+        rdar://problem/23547038
+
+        Reviewed by Geoffrey Garen.
+
+        The DFG's use of watchpoints for havingABadTime goes back a long time. We introduced this feature
+        when we first introduced watchpoints. That left it open to a lot of bitrot. On top of that, this
+        code doesn't get tested much because having a bad time is not something that is really supposed to
+        happen.
+
+        Well, now I've got reports that it does happen - or at least, we know that it is because of
+        crashes in an assertion that could only be triggered if a bad time was had. In the meantime, we
+        added two new features without adequately testing havingABadTime: concurrent JIT and FTL.
+        Concurrency means that we have to worry about the havingABadTime watchpoint triggering during
+        compilation. FTL means that we have new code and new optimizations that needs to deal with this
+        feature correctly.
+
+        The bug can arise via race condition or just goofy profiling. As in the newly added test, we could
+        first profile an allocation thinking that it will allocate sane arrays. Then we might have a bad
+        time, and then compile that function with the FTL. The ByteCodeParser will represent the
+        allocation with a NewArray node that has a sane indexingType(). But when we go to lower the Node,
+        we observe that the Structure* that the JSGlobalObject tells us to use has a different indexing
+        type. This is a feature of havingABadTime that the DFG knew about, but the FTL didn't. The FTL
+        didn't know about it because we didn't have adequate tests, and this code rarely gets triggered in
+        the wild. So, the FTL had a silly assertion that the indexing types match. They absolutely don't
+        have to match.
+
+        There is another bug, a race condition, that remains even if we remove the bad assertion. We set
+        the havingABadTime watchpoint late in compilation, and we do it based on whether the watchpoint is
+        still OK. This means that we could parse a function before we have a bad time and then do
+        optimizations (for example in AbstractInterpreter) like proving that the structure set associated
+        with the value returned by the NewArray is the one with a sane indexing type. Then, after those
+        optimizations have already been done, we will go to set the watchpoint. But just as we are doing
+        this, we could haveABadTime on the main thread. Currently this sort of almost works because
+        having a bad time requires doing a GC, and we can't GC until the watchpoint collection phase. But
+        that feels too fragile. So, this phase moves the setting of the watchpoint to the FixupPhase. This
+        is consistent with our long-term goal of removing the WatchpointCollectionPhase. Moving this to
+        FixupPhase means that we set the watchpoint before doing any optimizations. So, if having a bad
+        time happens before the FixupPhase then all optimizations will agree that we're having a bad time
+        and so everything is fine; if we have a bad time after FixupPhase then we will cancel the
+        compilation anyway.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::watchHavingABadTime):
+        (JSC::DFG::FixupPhase::createToString):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasIndexingType):
+        (JSC::DFG::Node::indexingType):
+        * dfg/DFGWatchpointCollectionPhase.cpp:
+        (JSC::DFG::WatchpointCollectionPhase::handle):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArray):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewArrayBuffer):
+        * tests/stress/ftl-has-a-bad-time.js: Added.
+
+2015-12-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Use Div and ChillDiv in FTL(B3)Output
+        https://bugs.webkit.org/show_bug.cgi?id=151844
+
+        Reviewed by Geoffrey Garen.
+
+        I copied part of the code of compileArithDiv()
+        to create a new function FTLOutput::childDiv().
+
+        With childDiv() being a concept of FTLOutput,
+        FTLB3Output was updated accordingly.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::div):
+        (JSC::FTL::Output::chillDiv):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithDiv):
+        * ftl/FTLOutput.cpp:
+        (JSC::FTL::Output::chillDiv):
+        * ftl/FTLOutput.h:
+
+2015-12-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Extend the strength reduction of B3's BitAnd with booleans
+        https://bugs.webkit.org/show_bug.cgi?id=151852
+
+        Reviewed by Saam Barati.
+
+        1) Masking a boolean with any pattern that has the lsb set
+           remains a boolean.
+        2) ReduceStrength on that particular pattern of BitAnd.
+
+        * b3/B3ReduceStrength.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::returnsBool):
+        * b3/testb3.cpp:
+        (JSC::B3::testBitAndWithMaskReturnsBooleans):
+        (JSC::B3::run):
+
+2015-12-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add doubleRem() to FTLB3Output
+        https://bugs.webkit.org/show_bug.cgi?id=151851
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleRem):
+
+2015-12-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add signExt() to FTLB3Output
+        https://bugs.webkit.org/show_bug.cgi?id=151853
+
+        Reviewed by Geoffrey Garen.
+
+        Rename signExt() to signExt32To64(). This is just to separate
+        it explicitly from the remaining signExt() used inside FTLOutput.
+
+        Then use the SExt32 for implementing that in B3.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::signExt32To64):
+        (JSC::FTL::Output::signExt): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInt52Rep):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetDirectPname):
+        (JSC::FTL::DFG::LowerDFGToLLVM::strictInt52ToInt32):
+        (JSC::FTL::DFG::LowerDFGToLLVM::strictInt52ToJSValue):
+        (JSC::FTL::DFG::LowerDFGToLLVM::jsValueToStrictInt52):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::signExt32To64):
+        (JSC::FTL::Output::signExt):
+
+2015-12-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Unskip many inspector/debugger tests
+        https://bugs.webkit.org/show_bug.cgi?id=151843
+
+        Reviewed by Timothy Hatcher.
+
+        * bindings/ScriptFunctionCall.cpp:
+        (Deprecated::ScriptFunctionCall::call):
+        Ignore TerminationExceptions, as those aren't real execution
+        exceptions and may be seen on Workers that have closed.
+
+2015-12-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Remove untested and unused Worker inspection
+        https://bugs.webkit.org/show_bug.cgi?id=151848
+
+        Reviewed by Brian Burg.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::Debugger):
+        (JSC::Debugger::willExecuteProgram):
+        * debugger/Debugger.h:
+        * inspector/JSGlobalObjectScriptDebugServer.cpp:
+        (Inspector::JSGlobalObjectScriptDebugServer::JSGlobalObjectScriptDebugServer):
+        * inspector/ScriptDebugServer.cpp:
+        (Inspector::ScriptDebugServer::ScriptDebugServer):
+        * inspector/ScriptDebugServer.h:
+        * inspector/agents/InspectorConsoleAgent.h:
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::run): Deleted.
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/agents/JSGlobalObjectConsoleAgent.h:
+        * inspector/protocol/Runtime.json:
+        * inspector/protocol/Worker.json: Removed.
+
+2015-12-04  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Web Inspector: Specifically Identify the Global Lexical Environment Scope
+        https://bugs.webkit.org/show_bug.cgi?id=151828
+
+        Reviewed by Brian Burg.
+
+        * inspector/InjectedScriptSource.js:
+        Include the new scope type.
+
+        * inspector/JSJavaScriptCallFrame.h:
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::scopeType):
+        Set the new value for the new scope type.
+
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation): Deleted.
+        (Inspector::jsJavaScriptCallFrameConstantGLOBAL_SCOPE): Deleted.
+        (Inspector::jsJavaScriptCallFrameConstantLOCAL_SCOPE): Deleted.
+        (Inspector::jsJavaScriptCallFrameConstantWITH_SCOPE): Deleted.
+        (Inspector::jsJavaScriptCallFrameConstantCLOSURE_SCOPE): Deleted.
+        (Inspector::jsJavaScriptCallFrameConstantCATCH_SCOPE): Deleted.
+        (Inspector::jsJavaScriptCallFrameConstantFUNCTION_NAME_SCOPE): Deleted.
+        Remove unused constants on the JavaScriptCallFrame object.
+        Currently they are just hardcoded in InjectedScriptSource
+        and they don't make sense on instances anyways.
+
+2015-12-04  Keith Miller  <keith_miller@apple.com>
+
+        Add an option to emit instructions validating exceptions in the DFG rather than always emiting them.
+        https://bugs.webkit.org/show_bug.cgi?id=151841
+
+        Reviewed by Saam Barati.
+
+        Add a new option that validates the DFG execption checking. The default value for the option is
+        true in Debug builds and false in Release builds. Additionally, renamed jitAssertNoException to
+        jitReleaseAssertNoException for consistency with our ASSERT naming convention.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::jitReleaseAssertNoException):
+        (JSC::AssemblyHelpers::jitAssertNoException): Deleted.
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::jitAssertNoException): Deleted.
+        * runtime/Options.cpp:
+        (JSC::recomputeDependentOptions):
+        * runtime/Options.h:
+
+2015-12-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(DFG_JIT) build after r190735
+        https://bugs.webkit.org/show_bug.cgi?id=151617
+
+        Reviewed by Filip Pizlo.
+
+        * jit/GCAwareJITStubRoutine.cpp:
+        (JSC::GCAwareJITStubRoutineWithExceptionHandler::observeZeroRefCount):
+
+2015-12-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Fix the B3 build after r192946
+        https://bugs.webkit.org/show_bug.cgi?id=151857
+
+        Reviewed by Michael Saboff.
+
+        * CMakeLists.txt:
+
+2015-12-04  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [AArch64] Typo fix after r189575
+        https://bugs.webkit.org/show_bug.cgi?id=151855
+
+        Reviewed by Michael Saboff.
+
+        * ftl/FTLUnwindInfo.cpp:
+        (JSC::FTL::parseUnwindInfo):
+
+2015-12-03  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 Patchpoint and Check opcodes should be able to specify WarmAny, ColdAny, and LateColdAny
+        https://bugs.webkit.org/show_bug.cgi?id=151335
+
+        Reviewed by Geoffrey Garen.
+
+        This removes ValueRep::Any and replaces it with ValueRep::WarmAny, ValueRep::ColdAny, and
+        ValueRep::LateColdAny. I think that conceptually the most obvious users of patchpoints are inline
+        caches, which would use WarmAny for their non-OSR inputs. For this reason, I make WarmAny the
+        default.
+
+        However, the StackmapValue optimization that provides a default ValueRep for any that are missing
+        was meant for OSR. So, this optimization now uses ColdAny.
+
+        This patch wires this change through the whole compiler and adds some tests.
+
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::Key::Key):
+        (JSC::B3::CheckSpecial::Key::dump):
+        (JSC::B3::CheckSpecial::CheckSpecial):
+        * b3/B3CheckSpecial.h:
+        (JSC::B3::CheckSpecial::Key::Key):
+        (JSC::B3::CheckSpecial::Key::opcode):
+        (JSC::B3::CheckSpecial::Key::numArgs):
+        (JSC::B3::CheckSpecial::Key::stackmapRole):
+        * b3/B3CheckValue.cpp:
+        (JSC::B3::CheckValue::CheckValue):
+        * b3/B3ConstrainedValue.h:
+        (JSC::B3::ConstrainedValue::ConstrainedValue):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::fillStackmap):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3MoveConstants.cpp:
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::forEachArg):
+        (JSC::B3::PatchpointSpecial::isValid):
+        (JSC::B3::PatchpointSpecial::admitsStack):
+        * b3/B3PatchpointValue.cpp:
+        (JSC::B3::PatchpointValue::PatchpointValue):
+        * b3/B3PatchpointValue.h:
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        (JSC::B3::StackmapSpecial::admitsStackImpl):
+        (JSC::B3::StackmapSpecial::isArgValidForRep):
+        (WTF::printInternal):
+        * b3/B3StackmapSpecial.h:
+        * b3/B3StackmapValue.cpp:
+        (JSC::B3::StackmapValue::append):
+        (JSC::B3::StackmapValue::setConstraint):
+        * b3/B3StackmapValue.h:
+        * b3/B3Validate.cpp:
+        * b3/B3ValueRep.cpp:
+        (JSC::B3::ValueRep::dump):
+        (WTF::printInternal):
+        * b3/B3ValueRep.h:
+        (JSC::B3::ValueRep::ValueRep):
+        (JSC::B3::ValueRep::reg):
+        (JSC::B3::ValueRep::operator!=):
+        (JSC::B3::ValueRep::operator bool):
+        (JSC::B3::ValueRep::isAny):
+        (JSC::B3::ValueRep::isSomeRegister):
+        * b3/testb3.cpp:
+        (JSC::B3::compileAndRun):
+        (JSC::B3::add32):
+        (JSC::B3::test42):
+        (JSC::B3::testSimplePatchpoint):
+        (JSC::B3::testPatchpointWithEarlyClobber):
+        (JSC::B3::testPatchpointFixedRegister):
+        (JSC::B3::testPatchpointAny):
+        (JSC::B3::testPatchpointLotsOfLateAnys):
+        (JSC::B3::testPatchpointAnyImm):
+        (JSC::B3::testPatchpointManyImms):
+        (JSC::B3::testPatchpointWithRegisterResult):
+        (JSC::B3::testPatchpointWithAnyResult):
+        (JSC::B3::run):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+
+2015-12-03  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 patchpoints should allow specifying output constraints
+        https://bugs.webkit.org/show_bug.cgi?id=151809
+
+        Reviewed by Benjamin Poulain.
+
+        JS call patchpoints should put their result into the result register, while most other patchpoints
+        should put their results into some register. I think that it's best if we just allow arbitrary
+        constraints on the result of a patchpoint. And by "arbitrary" I mean allowing the same kinds of
+        constraints as we allow on the stackmap children.
+
+        This also adds a large comment in B3StackmapValue.h that lays out the philosophy of our stackmaps
+        and patchpoints. I found it useful to write down the plan since it's pretty subtle.
+
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::isValid):
+        (JSC::B3::PatchpointSpecial::admitsStack):
+        * b3/B3PatchpointValue.cpp:
+        (JSC::B3::PatchpointValue::~PatchpointValue):
+        (JSC::B3::PatchpointValue::dumpMeta):
+        (JSC::B3::PatchpointValue::PatchpointValue):
+        * b3/B3PatchpointValue.h:
+        (JSC::B3::PatchpointValue::accepts):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::code):
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::isValidImpl):
+        (JSC::B3::StackmapSpecial::appendRepsImpl):
+        (JSC::B3::StackmapSpecial::isArgValidForValue):
+        (JSC::B3::StackmapSpecial::isArgValidForRep):
+        (JSC::B3::StackmapSpecial::repForArg):
+        * b3/B3StackmapSpecial.h:
+        * b3/B3StackmapValue.h:
+        * b3/B3Validate.cpp:
+        * b3/B3ValueRep.h:
+        (JSC::B3::ValueRep::doubleValue):
+        * b3/testb3.cpp:
+        (JSC::B3::testPatchpointManyImms):
+        (JSC::B3::testPatchpointWithRegisterResult):
+        (JSC::B3::testPatchpointWithStackArgumentResult):
+        (JSC::B3::testPatchpointWithAnyResult):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::run):
+        * jit/RegisterSet.h:
+
+2015-12-03  Anders Carlsson  <andersca@apple.com>
+
+        Remove Objective-C GC support
+        https://bugs.webkit.org/show_bug.cgi?id=151819
+        rdar://problem/23746991
+
+        Reviewed by Dan Bernstein.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/ToolExecutable.xcconfig:
+
+2015-12-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        Attempt to fix GTK again after r193125
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::supportsLZCNT):
+
+2015-12-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        Attempt to fix GTK after r193125
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::supportsLZCNT):
+        GCC is unable to handle EBX correctly when clobbered by inline asm.
+
+2015-12-03  Saam barati  <sbarati@apple.com>
+
+        FTL::OSRExitDescriptor should use less memory by having a companion object that dies after compilation
+        https://bugs.webkit.org/show_bug.cgi?id=151795
+
+        Reviewed by Geoffrey Garen.
+
+        There were a few fields on FTL::OSRExitDescriptor that are only
+        needed during compilation. This patch introduces OSRExitDescriptorImpl 
+        which is a struct that we create for each OSRExitDescriptor. The difference is 
+        that OSRExitDescriptorImpl lives off of FTL::State so it dies after we compile.
+        This way no unnecessary fields persist after the compilation.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExceptionHandlerManager.cpp:
+        (JSC::FTL::ExceptionHandlerManager::lazySlowPathExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::getCallOSRExitCommon):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
+        (JSC::FTL::OSRExitDescriptor::validateReferences):
+        (JSC::FTL::OSRExitDescriptor::emitOSRExit):
+        (JSC::FTL::OSRExitDescriptor::emitOSRExitLater):
+        (JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::gatherRegistersToSpillForCallIfException):
+        (JSC::FTL::OSRExit::willArriveAtExitFromIndirectExceptionCheck):
+        (JSC::FTL::exceptionTypeWillArriveAtOSRExitFromGenericUnwind):
+        (JSC::FTL::OSRExit::willArriveAtOSRExitFromGenericUnwind):
+        (JSC::FTL::OSRExit::willArriveAtOSRExitFromCallOperation):
+        (JSC::FTL::OSRExitDescriptor::isExceptionHandler): Deleted.
+        * ftl/FTLOSRExit.h:
+        (JSC::FTL::OSRExitDescriptorImpl::OSRExitDescriptorImpl):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLState.h:
+
+2015-12-03  Alex Christensen  <achristensen@webkit.org>
+
+        Fix 64-bit Windows build after r193125.
+        https://bugs.webkit.org/show_bug.cgi?id=151799
+
+        Reviewed by Michael Saboff.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::supportsLZCNT):
+        Use __cpuid intrinsic instead of inline assembly.
+
+2015-12-02  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL B3 should support OSR exit
+        https://bugs.webkit.org/show_bug.cgi?id=151710
+
+        Reviewed by Saam Barati.
+
+        This adds OSR exit support using the same style that I established with lazy slow paths. All of
+        the work is driven by FTL::LowerDFGToLLVM, and from there any work that needs to be deferred
+        until after B3 finishes is attached to the stackmap generator. In order to make it easy to port
+        all of the different forms of OSR exit - invalidation points, exceptions, etc. - the logic for
+        registering an OSR exit is abstracted behind OSRExitDescriptor and OSRExitHandle.
+
+        An issue that I encountered repeatedly in this patch is OSRExitDescriptor being passed as a
+        reference (&) rather than pointer (*). The new code uses a lot of lambdas that run after the
+        current frame pops, so the capture list cannot be [&]. I believe that always listing all of the
+        captured variables is not scalable considering how sophisticated our use of lambdas is. So, it
+        makes sense to use [=]. But anytime we captured a variable whose type was OSRExitDescriptor&, it
+        would be captured by value, because that's how references work. One has to be mindful of these
+        things whenever using [=]. Note that it's not enough to say that we should have listed the
+        captured variables explicitly - in that case, we still could have made the mistake by forgetting
+        to put & in front of the variant. The pattern that worked for me to reason about whether I'm
+        capturing an object or a pointer to an object is to always use pointer types for pointers: either
+        RefPtr<> when we also want the lambda to prolong the object's life, or * if we are confident that
+        the object will stay alive. For this reason, this patch changes all code that references
+        OSRExitDescriptor to use * instead of &. Consistency makes the code easier to grok, and it made
+        it easier to introduce the required uses of * in places where there were lambdas.
+
+        I tested this by running imaging-gaussian-blur, and running some tests that reqiure OSR exit. I'm
+        not promising that all kinds of exits work, but we have to begin somewhere.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3Compilation.cpp:
+        (JSC::B3::Compilation::Compilation):
+        (JSC::B3::Compilation::~Compilation):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::addDataSection):
+        (JSC::B3::Procedure::frameSize):
+        (JSC::B3::Procedure::calleeSaveRegisters):
+        * b3/B3Procedure.h:
+        (JSC::B3::Procedure::releaseByproducts):
+        (JSC::B3::Procedure::code):
+        (JSC::B3::Procedure::takeByproducts): Deleted.
+        * b3/air/AirCode.h:
+        (JSC::B3::Air::Code::setFrameSize):
+        (JSC::B3::Air::Code::calleeSaveRegisters):
+        * b3/air/AirGenerationContext.h:
+        * ftl/FTLB3Compile.cpp:
+        (JSC::FTL::compile):
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExceptionHandlerManager.cpp:
+        (JSC::FTL::ExceptionHandlerManager::lazySlowPathExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::getCallOSRExitCommon):
+        * ftl/FTLExitThunkGenerator.cpp:
+        * ftl/FTLExitThunkGenerator.h:
+        * ftl/FTLJITCode.cpp:
+        (JSC::FTL::JITCode::JITCode):
+        (JSC::FTL::JITCode::initializeB3Code):
+        (JSC::FTL::JITCode::initializeB3Byproducts):
+        (JSC::FTL::JITCode::initializeExitThunks):
+        (JSC::FTL::JITCode::validateReferences):
+        (JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):
+        * ftl/FTLJITCode.h:
+        * ftl/FTLJITFinalizer.cpp:
+        (JSC::FTL::JITFinalizer::finalizeFunction):
+        * ftl/FTLJITFinalizer.h:
+        * ftl/FTLJSCall.cpp:
+        (JSC::FTL::JSCall::emit):
+        * ftl/FTLJSCallBase.cpp:
+        (JSC::FTL::JSCallBase::emit):
+        * ftl/FTLJSTailCall.cpp:
+        (JSC::FTL::JSTailCall::JSTailCall):
+        (JSC::FTL::JSTailCall::emit):
+        (JSC::FTL::DFG::getRegisterWithAddend): Deleted.
+        (JSC::FTL::m_instructionOffset): Deleted.
+        * ftl/FTLJSTailCall.h:
+        (JSC::FTL::JSTailCall::patchpoint):
+        (JSC::FTL::JSTailCall::stackmapID):
+        (JSC::FTL::JSTailCall::estimatedSize):
+        (JSC::FTL::JSTailCall::operator<):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callStackmap):
+        (JSC::FTL::lowerDFGToLLVM):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
+        (JSC::FTL::OSRExitDescriptor::validateReferences):
+        (JSC::FTL::OSRExitDescriptor::appendOSRExit):
+        (JSC::FTL::OSRExitDescriptor::appendOSRExitLater):
+        (JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::codeLocationForRepatch):
+        (JSC::FTL::OSRExit::gatherRegistersToSpillForCallIfException):
+        (JSC::FTL::OSRExit::spillRegistersToSpillSlot):
+        (JSC::FTL::OSRExit::recoverRegistersFromSpillSlot):
+        (JSC::FTL::OSRExit::willArriveAtExitFromIndirectExceptionCheck):
+        * ftl/FTLOSRExit.h:
+        (JSC::FTL::OSRExit::considerAddingAsFrequentExitSite):
+        * ftl/FTLOSRExitCompilationInfo.h:
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::reboxAccordingToFormat):
+        (JSC::FTL::compileRecovery):
+        (JSC::FTL::compileStub):
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLOSRExitHandle.cpp: Added.
+        (JSC::FTL::OSRExitHandle::emitExitThunk):
+        * ftl/FTLOSRExitHandle.h: Added.
+        (JSC::FTL::OSRExitHandle::OSRExitHandle):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        (JSC::FTL::State::~State):
+
+2015-12-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION:(r192753): Remote Web Inspector: RemoteInspector::sendMessageToRemote with null connection
+        https://bugs.webkit.org/show_bug.cgi?id=151789
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::sendMessageToRemote):
+        Bail if the connection is no longer available. It may have
+        been closed remotely.
+
+2015-12-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION:(r192753): Remote Web Inspector: Window immediately closes after opening
+        https://bugs.webkit.org/show_bug.cgi?id=151788
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::pushListingsNow):
+        The key at the outer level was not a string. Ensure it is a
+        string for backwards compatibility. One day we may use
+        non-numeric page identifiers as listing keys.
+
+2015-12-03  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(r192753): Remote Web Inspector: Enabling Remote Inspection on Auto Inspect candidate Debuggable doesn't show up in debuggers
+        https://bugs.webkit.org/show_bug.cgi?id=151792
+
+        Reviewed by Brian Burg.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
+        When m_debuggablesMap was split into both m_targetMap and m_listingMap
+        this particular case was missed in updating both the target and listing
+        when the target is updated. We should match RemoteInspector::updateTarget
+        and update the listing map as the debuggable may have changed to be
+        allowed to debug.
+
+2015-12-03  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add CLZ support to B3
+        https://bugs.webkit.org/show_bug.cgi?id=151799
+
+        Reviewed by Michael Saboff.
+
+        Previously we were counting on LLVM to select LZCNT
+        when its available.
+        Since we have to do that ourself now, I added feature
+        detection based on the CPUID. The MacroAssembler just
+        pick the best available lowering based on the platform.
+
+        * assembler/MacroAssemblerX86Common.cpp:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::countLeadingZeros32):
+        (JSC::MacroAssemblerX86Common::supportsLZCNT):
+        (JSC::MacroAssemblerX86Common::clz32AfterBsr):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::countLeadingZeros64):
+        (JSC::MacroAssemblerX86_64::clz64AfterBsr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::lzcnt_rr):
+        (JSC::X86Assembler::lzcnt_mr):
+        (JSC::X86Assembler::lzcntq_rr):
+        (JSC::X86Assembler::lzcntq_mr):
+        (JSC::X86Assembler::bsr_mr):
+        (JSC::X86Assembler::bsrq_rr):
+        (JSC::X86Assembler::bsrq_mr):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::countLeadingZero):
+        (JSC::B3::testClzArg64):
+        (JSC::B3::testClzMem64):
+        (JSC::B3::testClzArg32):
+        (JSC::B3::testClzMem32):
+        (JSC::B3::doubleOperands):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::ctlz32):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithClz32):
+        * ftl/FTLOutput.h:
+        (JSC::FTL::Output::ctlz32):
+
+2015-12-02  Mark Lam  <mark.lam@apple.com>
+
+        Polymorphic operand types for DFG and FTL mul.
+        https://bugs.webkit.org/show_bug.cgi?id=151746
+
+        Reviewed by Filip Pizlo.
+
+        Perf on benchmarks is neutral except for the newly added JSRegress ftl-object-mul
+        test which shows a 2.16x speed up on x86_64 FTL, 1.27x speed up on x86_64 DFG,
+        and 1.56x on x86 DFG. 
+
+        The speed up comes not from the mul operator itself, but from the fact that the
+        polymorphic operand types support now allow the test function to run without OSR
+        exiting, thereby realizing the DFG and FTL's speed up on other work that the test
+        function does.
+
+        This patch has passed the layout tests on x86_64 with a debug build.
+        It passed the JSC tests with x86 and x86_64 debug builds.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithMul):
+        * ftl/FTLCompile.cpp:
+        - Changed to call generateBinaryOpFastPath() instead now, and let it dispatch to
+          the appropriate snippet generator.
+
+        * ftl/FTLCompileBinaryOp.cpp:
+        (JSC::FTL::generateBinaryArithOpFastPath):
+        (JSC::FTL::generateBinaryOpFastPath):
+        (JSC::FTL::generateArithSubFastPath): Deleted.
+        (JSC::FTL::generateValueAddFastPath): Deleted.
+        - Refactored these functions to eliminate the need for copy-pasting every time
+          we add support for another binary arithmetic snippet.
+
+        * ftl/FTLCompileBinaryOp.h:
+        * ftl/FTLInlineCacheDescriptor.h:
+        * ftl/FTLInlineCacheDescriptorInlines.h:
+        (JSC::FTL::ArithMulDescriptor::ArithMulDescriptor):
+        (JSC::FTL::ArithMulDescriptor::icSize):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfArithMul):
+        * ftl/FTLInlineCacheSize.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithMul):
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::JITMulGenerator):
+
+        * tests/stress/op_mul.js:
+        - Updated a test value: the interesting value for imminent overflow from an
+          int32 is 0x7fffffff, not 0x7ffffff.
+
+2015-12-02  Joseph Pecoraro  <pecoraro@apple.com>
+
+        REGRESSION(r192753): Remote Web Inspector: Applications and Debuggables not showing up in debuggers
+        https://bugs.webkit.org/show_bug.cgi?id=151787
+
+        Reviewed by Brian Burg.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::receivedIndicateMessage):
+        Removed lock that was unnecessarily added in r192753. It was
+        protecting nothing.
+
+2015-12-02  Saam barati  <sbarati@apple.com>
+
+        Insert a FIXME comment FTLLazySlowPath.h to remind us to remove/refactor the ScratchRegisterAllocator field.
+
+        Rubber-stamped by Filip Pizlo.
+
+        * ftl/FTLLazySlowPath.h:
+
+2015-12-02  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Remove insertElement() from FTLB3Output
+        https://bugs.webkit.org/show_bug.cgi?id=151781
+
+        Reviewed by Sam Weinig.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::insertElement): Deleted.
+        That's a LLVM concept.
+
+2015-12-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Remove stuffs related to alloca from FTLB3Output
+        https://bugs.webkit.org/show_bug.cgi?id=151780
+
+        Reviewed by Mark Lam.
+
+        We can use the Phis directly with B3 :)
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::alloca): Deleted.
+        (JSC::FTL::Output::get): Deleted.
+        (JSC::FTL::Output::set): Deleted.
+
+2015-12-02  Benjamin Poulain  <benjamin@webkit.org>
+
+        [JSC] Add sin(), cos(), pow() and log() to B3
+        https://bugs.webkit.org/show_bug.cgi?id=151778
+
+        Reviewed by Geoffrey Garen.
+
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleSin):
+        (JSC::FTL::Output::doubleCos):
+        (JSC::FTL::Output::doublePow):
+        (JSC::FTL::Output::doubleLog):
+        (JSC::FTL::Output::callWithoutSideEffects):
+
+2015-12-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a few obvious strength-reductions to Air
+        https://bugs.webkit.org/show_bug.cgi?id=151777
+
+        Reviewed by Mark Lam.
+
+        The absence of these optimizations was obnoxious.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::add32): lea 1(reg), reg -> add 1, reg.
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate): Emit simpler prologue/epilogue if !frameSize.
+        * b3/air/AirOpcode.opcodes: We have matching for BranchMul32 with immediate, but we forgot to add the instruction form.
+        * jit/AssemblyHelpers.h: Support for the prologue/epilogue optimizations.
+        (JSC::AssemblyHelpers::emitFunctionPrologue):
+        (JSC::AssemblyHelpers::emitFunctionEpilogueWithEmptyFrame):
+        (JSC::AssemblyHelpers::emitFunctionEpilogue):
+
+2015-12-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Update the interface added in r192967
+
+        * b3/B3CCallValue.h:
+        Filip prefers explicit effects.
+        * b3/testb3.cpp:
+        (JSC::B3::testCallSimplePure):
+
+2015-12-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add a function attribute for Pure functions in B3
+        https://bugs.webkit.org/show_bug.cgi?id=151741
+
+        Reviewed by Geoffrey Garen.
+
+        We have plenty of functions without side effects
+        when lowering DFG.
+        This patch adds the "PureCall" flag to B3's CCall
+        to make sure those functions do not prevent optimizations.
+
+        * b3/B3CCallValue.h:
+        * b3/testb3.cpp:
+        (JSC::B3::testCallSimplePure):
+        (JSC::B3::run):
+
+2015-12-02  Mark Lam  <mark.lam@apple.com>
+
+        Removed unnecessary #if USE(JSVALUE64).
+        https://bugs.webkit.org/show_bug.cgi?id=151733
+
+        Not reviewed.
+
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+
+2015-12-02  Mark Lam  <mark.lam@apple.com>
+
+        Use the JITAddGenerator snippet in the FTL.
+        https://bugs.webkit.org/show_bug.cgi?id=151519
+
+        Reviewed by Geoffrey Garen.
+
+        One detail about how we choosing to handle operands to the binary snippets that
+        may be constant: the slow path call to a C++ function still needs the constant
+        operand loaded in a register.  To simplify things, we're choosing to always tell
+        LLVM to load the operands into registers even if they may be constant.  However,
+        even though a constant operand is preloaded in a register, the snippet generator
+        will not be made aware of it.  It will continue to load the constant as an
+        immediate.
+
+        * ftl/FTLCompile.cpp:
+        * ftl/FTLCompileBinaryOp.cpp:
+        (JSC::FTL::generateArithSubFastPath):
+        (JSC::FTL::generateValueAddFastPath):
+        - generateValueAddFastPath() currently is an exact copy of generateArithSubFastPath()
+          except that it uses JITAddGenerator instead of JITSubGenerator.  When we add
+          support for JITMulGenerator later, the code will start to vary.  We'll refactor
+          these functions then when we have more insight into what needs to vary between
+          the implementations.
+
+        * ftl/FTLCompileBinaryOp.h:
+        * ftl/FTLInlineCacheDescriptor.h:
+        * ftl/FTLInlineCacheDescriptorInlines.h:
+        (JSC::FTL::ValueAddDescriptor::ValueAddDescriptor):
+        (JSC::FTL::ValueAddDescriptor::icSize):
+        * ftl/FTLInlineCacheSize.cpp:
+        (JSC::FTL::sizeOfValueAdd):
+        * ftl/FTLInlineCacheSize.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::lower):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileValueAdd):
+
+2015-12-02  Mark Lam  <mark.lam@apple.com>
+
+        Teach DFG that ArithSub can now clobber the heap (and other things).
+        https://bugs.webkit.org/show_bug.cgi?id=151733
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+
+2015-12-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Handle x86 partial register stalls in Air
+        https://bugs.webkit.org/show_bug.cgi?id=151735
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds a primitive false-dependency breaking
+        algorithm to Air. We look for redefinition of the same
+        variable that is too close to a partial definition.
+
+        There is not explicit dependency tracking going on,
+        but it is pretty fast and the extra xorps added on false-positives
+        are cheap anyway.
+
+        Typically, partial register stalls appear from instructions
+        interfering with themselves in small loops. Something like:
+
+          Label0:
+            cvtsi2sdq %eax, %xmm0
+            ...
+            jmp Label0
+
+        Those are correctly detected by propagating the local distance
+        information from block to block until no unsafe chain is found.
+
+        The test testInt32ToDoublePartialRegisterStall() checks the kind
+        of cases we typically find from JavaScript.
+        The execution time is 20% faster with a register reset (which is
+        astounding since the very next instruction has a real dependency).
+
+        Future tweaks will be needed when we can run more JavaScript:
+        -Handle function calls differently.
+        -Anything with a special can have hidden instructions.
+         We need to take them into account.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::moveZeroToDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::xorps_rr):
+        (JSC::X86Assembler::xorpd_rr):
+        According to the documentation, starting with Sandy Bridge,
+        registers reset can be done in the frontend with xorps.
+
+        * b3/B3IndexSet.h:
+        (JSC::B3::IndexSet::remove):
+        * b3/air/AirFixPartialRegisterStalls.cpp: Added.
+        (JSC::B3::Air::fixPartialRegisterStalls):
+        * b3/air/AirFixPartialRegisterStalls.h: Added.
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::prepareForGeneration):
+        * b3/testb3.cpp:
+        (JSC::B3::testInt32ToDoublePartialRegisterStall):
+        (JSC::B3::run):
+        * jit/FPRInfo.h:
+
+2015-12-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement LLInt/Baseline Support for ES6 Generators and enable this feature
+        https://bugs.webkit.org/show_bug.cgi?id=150792
+
+        Reviewed by Saam Barati.
+
+        This patch implements basic functionality of ES6 Generators in LLInt and Baseline tiers.
+        While the implementation has some inefficient part, the implementation covers edge cases.
+        Later, we will make this efficient.
+
+            https://bugs.webkit.org/show_bug.cgi?id=151545
+            https://bugs.webkit.org/show_bug.cgi?id=151546
+            https://bugs.webkit.org/show_bug.cgi?id=151547
+            https://bugs.webkit.org/show_bug.cgi?id=151552
+            https://bugs.webkit.org/show_bug.cgi?id=151560
+            https://bugs.webkit.org/show_bug.cgi?id=151586
+
+        To encourage DFG / FTL later, we take the following design.
+
+        1. Use switch_imm to jump to the save/resume points.
+
+        Instead of saving / restoring instruction pointer to resume from it, we use switch_imm to jump to the resume point.
+        This limits one entry point to a given generator function. This design makes inlining easy.
+        The generated code becomes the following.
+
+            function @generatorNext(@generator, @generatorState, @generatorValue, @generatorResumeMode)
+            {
+                switch (@generatorState) {
+                case Initial:
+                    ...
+                    initial sequence.
+                    ...
+
+
+                    op_save(Yield_0);  // op_save contains *virtual* jump to Yield_0.
+                                       // CFG shows a jump edge to Yield_0 point, but it won't be actually used.
+                    return ...;
+
+                case Yield_0:
+                    op_resume();
+                    if (@generatorResumeMode == Throw)
+                        ...
+                    else if (@generatorResumeMode == Return)
+                        ...
+                    ...
+                    // sentValue is a value sent from a caller by `generator.next(sentValue)`.
+                    sentValue = @generatorValue;
+                    ...
+                    op_save(Yield_1);
+                    return ...;
+
+                case Yield_1:
+                    op_resume();
+                    if (@generatorResumeMode == Throw)
+                        ...
+                    else if (@generatorResumeMode == Return)
+                        ...
+                    ...
+                    sentValue = @generatorValue;
+                    ...
+
+                ...
+                }
+            }
+
+            Resume sequence should not be emitted per yield.
+            This should be done in https://bugs.webkit.org/show_bug.cgi?id=151552.
+
+        2. Store live frame registers to GeneratorFrame
+
+        To save and resume generator's state, we save all the live registers in GeneratorFrame.
+        And when resuming, we refill registers with saved ones.
+        Since saved register contains scope register, |this| etc., the environment including the scope chain will be recovered automatically.
+        While saving and resuming callee registers, we don't save parameter registers.
+        These registers will be used to control generator's resume behavior.
+
+        We perform BytecodeLivenessAnalysis in CodeBlock to determine actually *def*ined registers at that resume point.
+
+        3. GeneratorFunction will evaluate parameters before generating Generator
+
+        Generator's parameter should be evaluated before entering Generator's body. For example,
+
+            function hello() { ... }
+            function *gen(a, b = hello())
+            {
+                yield b;
+            }
+            let g = gen(20);  // Now, hello should be called.
+
+        To enable this, we evaluate parameters in GeneratorFunction, and after that, we create a Generator and return it.
+        This can be explained by the following pseudo code.
+
+            function *gen(a, b = hello())
+            {
+                // This is generator.
+                return {
+                    @generatorNext: function (@generator, @generatorState, @generatorValue, @generatorResumeMode)
+                    {
+                        ...
+                    }
+                }
+            }
+
+        4. op_save seems similar to conditional jump
+
+        We won't jump to elsewhere from op_save actually. But we add a *virtual* jump edge (flow) from op_save to the point so called *merge point*.
+        We construct the CFG as follows,
+
+            (global generator switch) -> (initial sequence) -> (op_save) ----+-> (merge point) -> (next sequence)*
+                   |                                              |          |
+                   |                                              v          |
+                   |                                           (op_ret)      |
+                   |                                                         |
+                   +------------------------------------------->(op_resume)--+
+
+        By constructing such a graph,
+
+            1. Since we have a flow from (op_save) to (merge point), at merge point, we can *use* locals that are defined before (op_save)
+            2. op_save should claim that it does not define anything. And claim that it *use*s locals that are used in (merge point).
+            3. at op_resume, we see *use*d locals at merge point and define all of them.
+
+        We can do the above things in use-def analysis because use-def analysis is backward analysis.
+        And after analyzing use-def chains, in op_save / op_resume, we only save / resume live registers at the head of merge point.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * builtins/GeneratorPrototype.js: Added.
+        (generatorResume):
+        (next):
+        (return):
+        (throw):
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::isBranch):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::stepOverInstruction):
+        (JSC::computeLocalLivenessForBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
+        (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
+        (JSC::BytecodeLivenessAnalysis::computeKills):
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::validate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numCalleeLocals):
+        (JSC::CodeBlock::liveCalleeLocalsAtYield):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        (JSC::EvalCodeCache::isCacheable):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::generatorThisMode):
+        (JSC::ExecutableInfo::superBinding):
+        (JSC::ExecutableInfo::parseMode):
+        (JSC::ExecutableInfo::isArrowFunction): Deleted.
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::getJumpTargetsForBytecodeOffset):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::parseMode):
+        (JSC::UnlinkedCodeBlock::generatorThisMode):
+        (JSC::UnlinkedCodeBlock::superBinding):
+        (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeParameters):
+        (JSC::BytecodeGenerator::newRegister):
+        (JSC::BytecodeGenerator::reclaimFreeRegisters):
+        (JSC::BytecodeGenerator::createVariable):
+        (JSC::BytecodeGenerator::emitCreateThis):
+        (JSC::BytecodeGenerator::emitNewFunctionExpressionCommon):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitIteratorNextWithValue):
+        (JSC::BytecodeGenerator::emitYieldPoint):
+        (JSC::BytecodeGenerator::emitSave):
+        (JSC::BytecodeGenerator::emitResume):
+        (JSC::BytecodeGenerator::emitYield):
+        (JSC::BytecodeGenerator::emitDelegateYield):
+        (JSC::BytecodeGenerator::emitGeneratorStateChange):
+        (JSC::BytecodeGenerator::emitGeneratorStateLabel):
+        (JSC::BytecodeGenerator::beginGenerator):
+        (JSC::BytecodeGenerator::endGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal): Deleted.
+        (JSC::BytecodeGenerator::emitNewFunctionCommon): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::generatorThisMode):
+        (JSC::BytecodeGenerator::superBinding):
+        (JSC::BytecodeGenerator::generatorRegister):
+        (JSC::BytecodeGenerator::generatorStateRegister):
+        (JSC::BytecodeGenerator::generatorValueRegister):
+        (JSC::BytecodeGenerator::generatorResumeModeRegister):
+        (JSC::BytecodeGenerator::parseMode):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::emitHomeObjectForCallee):
+        (JSC::emitSuperBaseForCallee):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        (JSC::YieldExprNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKilledOperands):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLForOSREntryJITCode.cpp:
+        (JSC::FTL::ForOSREntryJITCode::initializeEntryBuffer):
+        * ftl/FTLForOSREntryJITCode.h:
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isAtom):
+        (JSC::MarkedBlock::isLiveCell):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::Interpreter::dumpRegisters):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::frameRegisterCountFor):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncCommon):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_new_generator_func):
+        (JSC::JIT::emitNewFuncExprCommon):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_new_generator_func_exp):
+        (JSC::JIT::emit_op_save):
+        (JSC::JIT::emit_op_resume):
+        * jit/JITOperations.cpp:
+        (JSC::operationNewFunctionCommon):
+        * jit/JITOperations.h:
+        * llint/LLIntEntrypoint.cpp:
+        (JSC::LLInt::frameRegisterCountFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createYield):
+        (JSC::ASTBuilder::createFunctionMetadata):
+        (JSC::ASTBuilder::propagateArgumentsUse):
+        * parser/Nodes.cpp:
+        (JSC::FunctionMetadataNode::FunctionMetadataNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::createGeneratorParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseYieldExpression):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseFunctionExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::setSourceParseMode):
+        (JSC::Scope::hasArguments):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::setIsGeneratorFunction):
+        (JSC::Scope::setIsGenerator):
+        (JSC::parse):
+        * parser/ParserModes.h:
+        (JSC::isFunctionParseMode):
+        (JSC::isModuleParseMode):
+        (JSC::isProgramParseMode):
+        * parser/SourceCodeKey.h: Added.
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::isHashTableDeletedValue):
+        (JSC::SourceCodeKey::hash):
+        (JSC::SourceCodeKey::length):
+        (JSC::SourceCodeKey::isNull):
+        (JSC::SourceCodeKey::string):
+        (JSC::SourceCodeKey::operator==):
+        (JSC::SourceCodeKeyHash::hash):
+        (JSC::SourceCodeKeyHash::equal):
+        (JSC::SourceCodeKeyHashTraits::isEmptyValue):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createYield):
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::SourceCodeKey): Deleted.
+        (JSC::SourceCodeKey::isHashTableDeletedValue): Deleted.
+        (JSC::SourceCodeKey::hash): Deleted.
+        (JSC::SourceCodeKey::length): Deleted.
+        (JSC::SourceCodeKey::isNull): Deleted.
+        (JSC::SourceCodeKey::string): Deleted.
+        (JSC::SourceCodeKey::operator==): Deleted.
+        (JSC::SourceCodeKeyHash::hash): Deleted.
+        (JSC::SourceCodeKeyHash::equal): Deleted.
+        (JSC::SourceCodeKeyHashTraits::isEmptyValue): Deleted.
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::checkModuleSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/Executable.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+        * runtime/GeneratorFrame.cpp: Added.
+        (JSC::GeneratorFrame::GeneratorFrame):
+        (JSC::GeneratorFrame::finishCreation):
+        (JSC::GeneratorFrame::createStructure):
+        (JSC::GeneratorFrame::create):
+        (JSC::GeneratorFrame::save):
+        (JSC::GeneratorFrame::resume):
+        (JSC::GeneratorFrame::visitChildren):
+        * runtime/GeneratorFrame.h: Added.
+        (JSC::GeneratorFrame::locals):
+        (JSC::GeneratorFrame::localAt):
+        (JSC::GeneratorFrame::offsetOfLocals):
+        (JSC::GeneratorFrame::allocationSizeForLocals):
+        * runtime/GeneratorFunctionConstructor.cpp: Added.
+        (JSC::GeneratorFunctionConstructor::GeneratorFunctionConstructor):
+        (JSC::GeneratorFunctionConstructor::finishCreation):
+        (JSC::callGeneratorFunctionConstructor):
+        (JSC::constructGeneratorFunctionConstructor):
+        (JSC::GeneratorFunctionConstructor::getCallData):
+        (JSC::GeneratorFunctionConstructor::getConstructData):
+        * runtime/GeneratorFunctionConstructor.h: Added.
+        (JSC::GeneratorFunctionConstructor::create):
+        (JSC::GeneratorFunctionConstructor::createStructure):
+        * runtime/GeneratorFunctionPrototype.cpp: Added.
+        (JSC::GeneratorFunctionPrototype::GeneratorFunctionPrototype):
+        (JSC::GeneratorFunctionPrototype::finishCreation):
+        * runtime/GeneratorFunctionPrototype.h: Added.
+        (JSC::GeneratorFunctionPrototype::create):
+        (JSC::GeneratorFunctionPrototype::createStructure):
+        * runtime/GeneratorPrototype.cpp: Copied from Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.cpp.
+        (JSC::GeneratorPrototype::finishCreation):
+        (JSC::GeneratorPrototype::getOwnPropertySlot):
+        * runtime/GeneratorPrototype.h: Copied from Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.cpp.
+        (JSC::GeneratorPrototype::create):
+        (JSC::GeneratorPrototype::createStructure):
+        (JSC::GeneratorPrototype::GeneratorPrototype):
+        * runtime/GeneratorThisMode.h: Added.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGeneratorFunction.cpp: Added.
+        (JSC::JSGeneratorFunction::JSGeneratorFunction):
+        (JSC::JSGeneratorFunction::createImpl):
+        (JSC::JSGeneratorFunction::create):
+        (JSC::JSGeneratorFunction::createWithInvalidatedReallocationWatchpoint):
+        * runtime/JSGeneratorFunction.h: Added.
+        (JSC::JSGeneratorFunction::allocationSize):
+        (JSC::JSGeneratorFunction::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::generatorFunctionPrototype):
+        (JSC::JSGlobalObject::generatorPrototype):
+        (JSC::JSGlobalObject::generatorFunctionStructure):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::moduleLoaderObjectParseModule):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * tests/es6.yaml:
+        * tests/es6/generators_yield_star_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/generators_yield_star_instances_of_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/generators_yield_star_iterator_closing.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/generators_yield_star_iterator_closing_via_throw.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/stress/generator-arguments-from-function.js: Added.
+        (shouldBe):
+        (test):
+        * tests/stress/generator-arguments.js: Added.
+        (shouldBe):
+        (g1):
+        * tests/stress/generator-class-methods-syntax.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntaxError.Cocoa):
+        (testSyntax.Cocoa.prototype.ok):
+        (testSyntax.Cocoa):
+        (testSyntax.Cocoa.ok):
+        * tests/stress/generator-class-methods.js: Added.
+        (shouldBe):
+        (prototype.gen):
+        (staticGen):
+        (shouldBe.g.next):
+        * tests/stress/generator-eval-this.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (B):
+        (A):
+        (C.prototype.generator):
+        (C):
+        (TypeError):
+        * tests/stress/generator-function-constructor.js: Added.
+        (shouldBe):
+        (generatorFunctionConstructor):
+        * tests/stress/generator-function-name.js: Added.
+        (shouldBe):
+        (ok):
+        * tests/stress/generator-methods-with-non-generator.js: Added.
+        (shouldThrow):
+        * tests/stress/generator-relations.js: Added.
+        (shouldBe):
+        (generatorFunction):
+        * tests/stress/generator-return-before-first-call.js: Added.
+        (shouldBe):
+        (shouldBeIteratorResult):
+        * tests/stress/generator-return.js: Added.
+        (shouldBe):
+        (shouldBeIteratorResult):
+        * tests/stress/generator-this.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (gen):
+        (shouldBe.g.next):
+        * tests/stress/generator-throw-before-first-call.js: Added.
+        (unreachable):
+        (gen):
+        (catch):
+        * tests/stress/generator-throw.js: Added.
+        (shouldBe):
+        (shouldBeIteratorResult):
+        * tests/stress/generator-with-new-target.js: Added.
+        (shouldBe):
+        (gen):
+        * tests/stress/generator-with-super.js: Added.
+        (shouldThrow):
+        (test):
+        (B.prototype.gen):
+        (B):
+        (A.prototype.gen):
+        (A):
+        * tests/stress/generator-yield-star.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (prototype.call):
+        (Arrays):
+        (Arrays.prototype.Symbol.iterator):
+        (Iterator.prototype.next):
+        (Iterator.prototype.string_appeared_here):
+        (Iterator.prototype.Symbol.iterator):
+        (Iterator):
+        (gen):
+
+2015-12-01  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r192914.
+        https://bugs.webkit.org/show_bug.cgi?id=151734
+
+        JSC tests for this change are failing on 32 and 64-bit bots
+        (Requested by ryanhaddad on #webkit).
+
+        Reverted changeset:
+
+        "[ES6] Implement LLInt/Baseline Support for ES6 Generators and
+        enable this feature"
+        https://bugs.webkit.org/show_bug.cgi?id=150792
+        http://trac.webkit.org/changeset/192914
+
+2015-12-01  Caitlin Potter  <caitpotter88@gmail.com>
+
+        [JSC] support CoverInitializedName in nested AssignmentPatterns
+        https://bugs.webkit.org/show_bug.cgi?id=151595
+
+        Reviewed by Geoffrey Garen.
+
+        A regression introduced in bug https://bugs.webkit.org/show_bug.cgi?id=151026
+        causes the parser to fail when attempting to parse nested
+        ObjectAssignmentPatterns with CoverInitializedName destructuring targets.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseAssignmentExpressionOrPropagateErrorClass):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseProperty):
+        (JSC::Parser<LexerType>::parseArrayLiteral):
+        * parser/Parser.h:
+        (JSC::Parser::ExpressionErrorClassifier::propagateExpressionErrorClass):
+        * tests/es6.yaml:
+        * tests/es6/destructuring_assignment_nested_cover_initialized_name.js: Added.
+        (test1):
+        (test2):
+
+2015-12-01  Juergen Ributzka  <juergen@apple.com>
+
+        Add new library dependency for LLVMForJavaScriptCore dylib
+        https://bugs.webkit.org/show_bug.cgi?id=151687
+        
+        Changes on open source LLVM added a new dependency to libLLVMInstrumentation.a.
+        Adding this dependency should be backwards compatible, since LLVM has built and
+        shipped this library even before the creation of FTL.
+
+        Reviewed by Geoffrey Garen.
+
+        * Configurations/LLVMForJSC.xcconfig:
+
+2015-12-01  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [ES6] Implement LLInt/Baseline Support for ES6 Generators and enable this feature
+        https://bugs.webkit.org/show_bug.cgi?id=150792
+
+        Reviewed by Saam Barati.
+
+        This patch implements basic functionality of ES6 Generators in LLInt and Baseline tiers.
+        While the implementation has some inefficient part, the implementation covers edge cases.
+        Later, we will make this efficient.
+
+            https://bugs.webkit.org/show_bug.cgi?id=151545
+            https://bugs.webkit.org/show_bug.cgi?id=151546
+            https://bugs.webkit.org/show_bug.cgi?id=151547
+            https://bugs.webkit.org/show_bug.cgi?id=151552
+            https://bugs.webkit.org/show_bug.cgi?id=151560
+            https://bugs.webkit.org/show_bug.cgi?id=151586
+
+        To encourage DFG / FTL later, we take the following design.
+
+        1. Use switch_imm to jump to the save/resume points.
+
+        Instead of saving / restoring instruction pointer to resume from it, we use switch_imm to jump to the resume point.
+        This limits one entry point to a given generator function. This design makes inlining easy.
+        The generated code becomes the following.
+
+            function @generatorNext(@generator, @generatorState, @generatorValue, @generatorResumeMode)
+            {
+                switch (@generatorState) {
+                case Initial:
+                    ...
+                    initial sequence.
+                    ...
+
+
+                    op_save(Yield_0);  // op_save contains *virtual* jump to Yield_0.
+                                       // CFG shows a jump edge to Yield_0 point, but it won't be actually used.
+                    return ...;
+
+                case Yield_0:
+                    op_resume();
+                    if (@generatorResumeMode == Throw)
+                        ...
+                    else if (@generatorResumeMode == Return)
+                        ...
+                    ...
+                    // sentValue is a value sent from a caller by `generator.next(sentValue)`.
+                    sentValue = @generatorValue;
+                    ...
+                    op_save(Yield_1);
+                    return ...;
+
+                case Yield_1:
+                    op_resume();
+                    if (@generatorResumeMode == Throw)
+                        ...
+                    else if (@generatorResumeMode == Return)
+                        ...
+                    ...
+                    sentValue = @generatorValue;
+                    ...
+
+                ...
+                }
+            }
+
+            Resume sequence should not be emitted per yield.
+            This should be done in https://bugs.webkit.org/show_bug.cgi?id=151552.
+
+        2. Store live frame registers to GeneratorFrame
+
+        To save and resume generator's state, we save all the live registers in GeneratorFrame.
+        And when resuming, we refill registers with saved ones.
+        Since saved register contains scope register, |this| etc., the environment including the scope chain will be recovered automatically.
+        While saving and resuming callee registers, we don't save parameter registers.
+        These registers will be used to control generator's resume behavior.
+
+        We perform BytecodeLivenessAnalysis in CodeBlock to determine actually *def*ined registers at that resume point.
+
+        3. GeneratorFunction will evaluate parameters before generating Generator
+
+        Generator's parameter should be evaluated before entering Generator's body. For example,
+
+            function hello() { ... }
+            function *gen(a, b = hello())
+            {
+                yield b;
+            }
+            let g = gen(20);  // Now, hello should be called.
+
+        To enable this, we evaluate parameters in GeneratorFunction, and after that, we create a Generator and return it.
+        This can be explained by the following pseudo code.
+
+            function *gen(a, b = hello())
+            {
+                // This is generator.
+                return {
+                    @generatorNext: function (@generator, @generatorState, @generatorValue, @generatorResumeMode)
+                    {
+                        ...
+                    }
+                }
+            }
+
+        4. op_save seems similar to conditional jump
+
+        We won't jump to elsewhere from op_save actually. But we add a *virtual* jump edge (flow) from op_save to the point so called *merge point*.
+        We construct the CFG as follows,
+
+            (global generator switch) -> (initial sequence) -> (op_save) ----+-> (merge point) -> (next sequence)*
+                   |                                              |          |
+                   |                                              v          |
+                   |                                           (op_ret)      |
+                   |                                                         |
+                   +------------------------------------------->(op_resume)--+
+
+        By constructing such a graph,
+
+            1. Since we have a flow from (op_save) to (merge point), at merge point, we can *use* locals that are defined before (op_save)
+            2. op_save should claim that it does not define anything. And claim that it *use*s locals that are used in (merge point).
+            3. at op_resume, we see *use*d locals at merge point and define all of them.
+
+        We can do the above things in use-def analysis because use-def analysis is backward analysis.
+        And after analyzing use-def chains, in op_save / op_resume, we only save / resume live registers at the head of merge point.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * builtins/GeneratorPrototype.js: Added.
+        (generatorResume):
+        (next):
+        (return):
+        (throw):
+        * bytecode/BytecodeBasicBlock.cpp:
+        (JSC::isBranch):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeLivenessAnalysis.cpp:
+        (JSC::stepOverInstruction):
+        (JSC::computeLocalLivenessForBytecodeOffset):
+        (JSC::BytecodeLivenessAnalysis::runLivenessFixpoint):
+        (JSC::BytecodeLivenessAnalysis::computeFullLiveness):
+        (JSC::BytecodeLivenessAnalysis::computeKills):
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finishCreation):
+        (JSC::CodeBlock::shrinkToFit):
+        (JSC::CodeBlock::validate):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numCalleeLocals):
+        (JSC::CodeBlock::liveCalleeLocalsAtYield):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        (JSC::EvalCodeCache::isCacheable):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::generatorThisMode):
+        (JSC::ExecutableInfo::superBinding):
+        (JSC::ExecutableInfo::parseMode):
+        (JSC::ExecutableInfo::isArrowFunction): Deleted.
+        * bytecode/PreciseJumpTargets.cpp:
+        (JSC::getJumpTargetsForBytecodeOffset):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::parseMode):
+        (JSC::UnlinkedCodeBlock::generatorThisMode):
+        (JSC::UnlinkedCodeBlock::superBinding):
+        (JSC::UnlinkedCodeBlock::isArrowFunction): Deleted.
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeParameters):
+        (JSC::BytecodeGenerator::newRegister):
+        (JSC::BytecodeGenerator::reclaimFreeRegisters):
+        (JSC::BytecodeGenerator::createVariable):
+        (JSC::BytecodeGenerator::emitCreateThis):
+        (JSC::BytecodeGenerator::emitNewFunctionExpressionCommon):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitIteratorNextWithValue):
+        (JSC::BytecodeGenerator::emitYieldPoint):
+        (JSC::BytecodeGenerator::emitSave):
+        (JSC::BytecodeGenerator::emitResume):
+        (JSC::BytecodeGenerator::emitYield):
+        (JSC::BytecodeGenerator::emitDelegateYield):
+        (JSC::BytecodeGenerator::emitGeneratorStateChange):
+        (JSC::BytecodeGenerator::emitGeneratorStateLabel):
+        (JSC::BytecodeGenerator::beginGenerator):
+        (JSC::BytecodeGenerator::endGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal): Deleted.
+        (JSC::BytecodeGenerator::emitNewFunctionCommon): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::generatorThisMode):
+        (JSC::BytecodeGenerator::superBinding):
+        (JSC::BytecodeGenerator::generatorRegister):
+        (JSC::BytecodeGenerator::generatorStateRegister):
+        (JSC::BytecodeGenerator::generatorValueRegister):
+        (JSC::BytecodeGenerator::generatorResumeModeRegister):
+        (JSC::BytecodeGenerator::parseMode):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::emitHomeObjectForCallee):
+        (JSC::emitSuperBaseForCallee):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        (JSC::YieldExprNode::emitBytecode):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::inlineCall):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        * dfg/DFGForAllKills.h:
+        (JSC::DFG::forAllKilledOperands):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::forAllLocalsLiveInBytecode):
+        * dfg/DFGOSREntrypointCreationPhase.cpp:
+        (JSC::DFG::OSREntrypointCreationPhase::run):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLForOSREntryJITCode.cpp:
+        (JSC::FTL::ForOSREntryJITCode::initializeEntryBuffer):
+        * ftl/FTLForOSREntryJITCode.h:
+        * ftl/FTLOSREntry.cpp:
+        (JSC::FTL::prepareOSREntry):
+        * ftl/FTLState.cpp:
+        (JSC::FTL::State::State):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::isAtom):
+        (JSC::MarkedBlock::isLiveCell):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::Interpreter::dumpRegisters):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::frameRegisterCountFor):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncCommon):
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emit_op_new_generator_func):
+        (JSC::JIT::emitNewFuncExprCommon):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emit_op_new_generator_func_exp):
+        (JSC::JIT::emit_op_save):
+        (JSC::JIT::emit_op_resume):
+        * jit/JITOperations.cpp:
+        (JSC::operationNewFunctionCommon):
+        * jit/JITOperations.h:
+        * llint/LLIntEntrypoint.cpp:
+        (JSC::LLInt::frameRegisterCountFor):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::traceFunctionPrologue):
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createYield):
+        (JSC::ASTBuilder::createFunctionMetadata):
+        (JSC::ASTBuilder::propagateArgumentsUse):
+        * parser/Nodes.cpp:
+        (JSC::FunctionMetadataNode::FunctionMetadataNode):
+        * parser/Nodes.h:
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::Parser):
+        (JSC::Parser<LexerType>::parseInner):
+        (JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
+        (JSC::Parser<LexerType>::parseFunctionBody):
+        (JSC::stringForFunctionMode):
+        (JSC::Parser<LexerType>::createGeneratorParameters):
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        (JSC::Parser<LexerType>::parseFunctionDeclaration):
+        (JSC::Parser<LexerType>::parseClass):
+        (JSC::Parser<LexerType>::parseAssignmentExpression):
+        (JSC::Parser<LexerType>::parseYieldExpression):
+        (JSC::Parser<LexerType>::parsePropertyMethod):
+        (JSC::Parser<LexerType>::parseFunctionExpression):
+        * parser/Parser.h:
+        (JSC::Scope::Scope):
+        (JSC::Scope::setSourceParseMode):
+        (JSC::Scope::hasArguments):
+        (JSC::Scope::collectFreeVariables):
+        (JSC::Scope::setIsFunction):
+        (JSC::Scope::setIsGeneratorFunction):
+        (JSC::Scope::setIsGenerator):
+        (JSC::parse):
+        * parser/ParserModes.h:
+        (JSC::isFunctionParseMode):
+        (JSC::isModuleParseMode):
+        (JSC::isProgramParseMode):
+        * parser/SourceCodeKey.h: Added.
+        (JSC::SourceCodeKey::SourceCodeKey):
+        (JSC::SourceCodeKey::isHashTableDeletedValue):
+        (JSC::SourceCodeKey::hash):
+        (JSC::SourceCodeKey::length):
+        (JSC::SourceCodeKey::isNull):
+        (JSC::SourceCodeKey::string):
+        (JSC::SourceCodeKey::operator==):
+        (JSC::SourceCodeKeyHash::hash):
+        (JSC::SourceCodeKeyHash::equal):
+        (JSC::SourceCodeKeyHashTraits::isEmptyValue):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createYield):
+        (JSC::SyntaxChecker::createFunctionMetadata):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        (JSC::SourceCodeKey::SourceCodeKey): Deleted.
+        (JSC::SourceCodeKey::isHashTableDeletedValue): Deleted.
+        (JSC::SourceCodeKey::hash): Deleted.
+        (JSC::SourceCodeKey::length): Deleted.
+        (JSC::SourceCodeKey::isNull): Deleted.
+        (JSC::SourceCodeKey::string): Deleted.
+        (JSC::SourceCodeKey::operator==): Deleted.
+        (JSC::SourceCodeKeyHash::hash): Deleted.
+        (JSC::SourceCodeKeyHash::equal): Deleted.
+        (JSC::SourceCodeKeyHashTraits::isEmptyValue): Deleted.
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::checkModuleSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/Executable.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionConstructor.h:
+        * runtime/GeneratorFrame.cpp: Added.
+        (JSC::GeneratorFrame::GeneratorFrame):
+        (JSC::GeneratorFrame::finishCreation):
+        (JSC::GeneratorFrame::createStructure):
+        (JSC::GeneratorFrame::create):
+        (JSC::GeneratorFrame::save):
+        (JSC::GeneratorFrame::resume):
+        (JSC::GeneratorFrame::visitChildren):
+        * runtime/GeneratorFrame.h: Added.
+        (JSC::GeneratorFrame::locals):
+        (JSC::GeneratorFrame::localAt):
+        (JSC::GeneratorFrame::offsetOfLocals):
+        (JSC::GeneratorFrame::allocationSizeForLocals):
+        * runtime/GeneratorFunctionConstructor.cpp: Added.
+        (JSC::GeneratorFunctionConstructor::GeneratorFunctionConstructor):
+        (JSC::GeneratorFunctionConstructor::finishCreation):
+        (JSC::callGeneratorFunctionConstructor):
+        (JSC::constructGeneratorFunctionConstructor):
+        (JSC::GeneratorFunctionConstructor::getCallData):
+        (JSC::GeneratorFunctionConstructor::getConstructData):
+        * runtime/GeneratorFunctionConstructor.h: Added.
+        (JSC::GeneratorFunctionConstructor::create):
+        (JSC::GeneratorFunctionConstructor::createStructure):
+        * runtime/GeneratorFunctionPrototype.cpp: Added.
+        (JSC::GeneratorFunctionPrototype::GeneratorFunctionPrototype):
+        (JSC::GeneratorFunctionPrototype::finishCreation):
+        * runtime/GeneratorFunctionPrototype.h: Added.
+        (JSC::GeneratorFunctionPrototype::create):
+        (JSC::GeneratorFunctionPrototype::createStructure):
+        * runtime/GeneratorPrototype.cpp: Copied from Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.cpp.
+        (JSC::GeneratorPrototype::finishCreation):
+        (JSC::GeneratorPrototype::getOwnPropertySlot):
+        * runtime/GeneratorPrototype.h: Copied from Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.cpp.
+        (JSC::GeneratorPrototype::create):
+        (JSC::GeneratorPrototype::createStructure):
+        (JSC::GeneratorPrototype::GeneratorPrototype):
+        * runtime/GeneratorThisMode.h: Added.
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGeneratorFunction.cpp: Added.
+        (JSC::JSGeneratorFunction::JSGeneratorFunction):
+        (JSC::JSGeneratorFunction::createImpl):
+        (JSC::JSGeneratorFunction::create):
+        (JSC::JSGeneratorFunction::createWithInvalidatedReallocationWatchpoint):
+        * runtime/JSGeneratorFunction.h: Added.
+        (JSC::JSGeneratorFunction::allocationSize):
+        (JSC::JSGeneratorFunction::createStructure):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::generatorFunctionPrototype):
+        (JSC::JSGlobalObject::generatorPrototype):
+        (JSC::JSGlobalObject::generatorFunctionStructure):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::moduleLoaderObjectParseModule):
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * tests/es6.yaml:
+        * tests/es6/generators_yield_star_generic_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/generators_yield_star_instances_of_iterables.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/generators_yield_star_iterator_closing.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/es6/generators_yield_star_iterator_closing_via_throw.js:
+        (iterator.next):
+        (iterable.Symbol.iterator):
+        (__createIterableObject):
+        * tests/stress/generator-arguments-from-function.js: Added.
+        (shouldBe):
+        (test):
+        * tests/stress/generator-arguments.js: Added.
+        (shouldBe):
+        (g1):
+        * tests/stress/generator-class-methods-syntax.js: Added.
+        (testSyntax):
+        (testSyntaxError):
+        (testSyntaxError.Cocoa):
+        (testSyntax.Cocoa.prototype.ok):
+        (testSyntax.Cocoa):
+        (testSyntax.Cocoa.ok):
+        * tests/stress/generator-class-methods.js: Added.
+        (shouldBe):
+        (prototype.gen):
+        (staticGen):
+        (shouldBe.g.next):
+        * tests/stress/generator-eval-this.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (B):
+        (A):
+        (C.prototype.generator):
+        (C):
+        (TypeError):
+        * tests/stress/generator-function-constructor.js: Added.
+        (shouldBe):
+        (generatorFunctionConstructor):
+        * tests/stress/generator-function-name.js: Added.
+        (shouldBe):
+        (ok):
+        * tests/stress/generator-methods-with-non-generator.js: Added.
+        (shouldThrow):
+        * tests/stress/generator-relations.js: Added.
+        (shouldBe):
+        (generatorFunction):
+        * tests/stress/generator-return-before-first-call.js: Added.
+        (shouldBe):
+        (shouldBeIteratorResult):
+        * tests/stress/generator-return.js: Added.
+        (shouldBe):
+        (shouldBeIteratorResult):
+        * tests/stress/generator-this.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (gen):
+        (shouldBe.g.next):
+        * tests/stress/generator-throw-before-first-call.js: Added.
+        (unreachable):
+        (gen):
+        (catch):
+        * tests/stress/generator-throw.js: Added.
+        (shouldBe):
+        (shouldBeIteratorResult):
+        * tests/stress/generator-with-new-target.js: Added.
+        (shouldBe):
+        (gen):
+        * tests/stress/generator-with-super.js: Added.
+        (shouldThrow):
+        (test):
+        (B.prototype.gen):
+        (B):
+        (A.prototype.gen):
+        (A):
+        * tests/stress/generator-yield-star.js: Added.
+        (shouldBe):
+        (shouldThrow):
+        (prototype.call):
+        (Arrays):
+        (Arrays.prototype.Symbol.iterator):
+        (Iterator.prototype.next):
+        (Iterator.prototype.string_appeared_here):
+        (Iterator.prototype.Symbol.iterator):
+        (Iterator):
+        (gen):
+
+2015-12-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Remove repetitive cruft from FTL OSR exit code in LowerDFGToLLVM
+        https://bugs.webkit.org/show_bug.cgi?id=151718
+
+        Reviewed by Geoffrey Garen.
+
+        * b3/B3StackmapValue.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileInvalidationPoint):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitArgumentsForPatchpointIfWillCatchException):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lowBlock):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExitDescriptor):
+        (JSC::FTL::DFG::LowerDFGToLLVM::appendOSRExit):
+        (JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):
+        (JSC::FTL::DFG::LowerDFGToLLVM::emitOSRExitCall):
+        (JSC::FTL::DFG::LowerDFGToLLVM::buildExitArguments):
+        (JSC::FTL::DFG::LowerDFGToLLVM::callStackmap):
+
+2015-12-01  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] add missing RequireObjectCoercible() step in destructuring
+        https://bugs.webkit.org/show_bug.cgi?id=151596
+
+        Reviewed by Darin Adler.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitRequireObjectCoercible):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ObjectPatternNode::bindValue):
+        * tests/stress/destructuring-assignment-require-object-coercible.js: Added.
+        (testTypeError):
+        (testOK):
+
+2015-12-01  Mark Lam  <mark.lam@apple.com>
+
+        Refactor FTL sub snippet code to support general binary op snippets.
+        https://bugs.webkit.org/show_bug.cgi?id=151706
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * ftl/FTLCompile.cpp:
+        - Moved the BinarySnippetRegisterContext to FTLCompileBinaryOp.cpp verbatim.
+        - Generalize generateArithSubICFastPath() to generateBinaryOpICFastPath().
+          It now uses snippet specific helpers in FTLCompileBinaryOp.cpp to generate
+          the fast paths.
+
+        * ftl/FTLCompileBinaryOp.cpp: Added.
+        (JSC::FTL::BinarySnippetRegisterContext::BinarySnippetRegisterContext):
+        (JSC::FTL::BinarySnippetRegisterContext::initializeRegisters):
+        (JSC::FTL::BinarySnippetRegisterContext::restoreRegisters):
+        - Moved here without changed from FTLCompile.cpp.
+        (JSC::FTL::generateArithSubFastPath):
+        * ftl/FTLCompileBinaryOp.h: Added.
+
+        * ftl/FTLInlineCacheDescriptor.h:
+        (JSC::FTL::BinaryOpDescriptor::nodeType):
+        (JSC::FTL::BinaryOpDescriptor::size):
+        (JSC::FTL::BinaryOpDescriptor::name):
+        (JSC::FTL::BinaryOpDescriptor::fastPathICName):
+        (JSC::FTL::BinaryOpDescriptor::slowPathFunction):
+        (JSC::FTL::BinaryOpDescriptor::leftOperand):
+        (JSC::FTL::BinaryOpDescriptor::rightOperand):
+        (JSC::FTL::BinaryOpDescriptor::BinaryOpDescriptor):
+        (JSC::FTL::ArithSubDescriptor::ArithSubDescriptor): Deleted.
+        (JSC::FTL::ArithSubDescriptor::leftType): Deleted.
+        (JSC::FTL::ArithSubDescriptor::rightType): Deleted.
+        - Refactor ArithSubDescriptor into BinaryOpDescriptor, and re-add a sub-class
+          ArithSubDescriptor as specializations of BinaryOpDescriptor.
+
+        * ftl/FTLInlineCacheDescriptorInlines.h: Added.
+        (JSC::FTL::ArithSubDescriptor::ArithSubDescriptor):
+        (JSC::FTL::ArithSubDescriptor::icSize):
+
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileArithAddOrSub):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExit::willArriveAtExitFromIndirectExceptionCheck):
+        (JSC::FTL::OSRExit::willArriveAtOSRExitFromCallOperation):
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLState.h:
+
+2015-12-01  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed, rolling out r192876.
+
+        It broke a lot of JSC and layout tests for GTK and EFL
+
+        Reverted changeset:
+
+        "[ES6] "super" and "this" should be lexically bound inside an
+        arrow function and should live in a JSLexicalEnvironment"
+        https://bugs.webkit.org/show_bug.cgi?id=149338
+        http://trac.webkit.org/changeset/192876
+
+2015-12-01 Aleksandr Skachkov   <gskachkov@gmail.com>
+
+        [ES6] "super" and "this" should be lexically bound inside an arrow function and should live in a JSLexicalEnvironment
+        https://bugs.webkit.org/show_bug.cgi?id=149338
+
+        Reviewed by Saam Barati.
+
+        Implemented new version of the lexically bound 'this' in arrow function. In current version 
+        'this' is stored inside of the lexical environment of the function. To store and load we use
+        op_get_from_scope and op_put_to_scope operations. Also new implementation prevent raising TDZ
+        error for arrow functions that are declared before super() but invoke after.
+
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::createExecutableInternal):
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::getSlow):
+        * bytecode/ExecutableInfo.h:
+        (JSC::ExecutableInfo::ExecutableInfo):
+        (JSC::ExecutableInfo::isDerivedConstructorContext):
+        (JSC::ExecutableInfo::isArrowFunctionContext):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
+        * bytecode/UnlinkedCodeBlock.h:
+        (JSC::UnlinkedCodeBlock::isDerivedConstructorContext):
+        (JSC::UnlinkedCodeBlock::isArrowFunctionContext):
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::generateUnlinkedFunctionCodeBlock):
+        (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded):
+        (JSC::BytecodeGenerator::variable):
+        (JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment):
+        (JSC::BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope):
+        (JSC::BytecodeGenerator::emitPutThisToArrowFunctionContextScope):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isDerivedConstructorContext):
+        (JSC::BytecodeGenerator::usesArrowFunction):
+        (JSC::BytecodeGenerator::needsToUpdateArrowFunctionContext):
+        (JSC::BytecodeGenerator::usesEval):
+        (JSC::BytecodeGenerator::usesThis):
+        (JSC::BytecodeGenerator::newTarget):
+        (JSC::BytecodeGenerator::makeFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ThisNode::emitBytecode):
+        (JSC::SuperNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionNode::emitBytecode):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        * dfg/DFGClobberize.h:
+        * dfg/DFGDoesGC.cpp:
+        * dfg/DFGFixupPhase.cpp:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGObjectAllocationSinkingPhase.cpp:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGPromotedHeapLocation.cpp:
+        * dfg/DFGPromotedHeapLocation.h:
+        * dfg/DFGSafeToExecute.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        * dfg/DFGSpeculativeJIT64.cpp:
+        * ftl/FTLCapabilities.cpp:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emitNewFuncExprCommon):
+        * jit/JITOpcodes32_64.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createArrowFunctionExpr):
+        (JSC::ASTBuilder::usesArrowFunction):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::usesArrowFunction):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseFunctionInfo):
+        * parser/ParserModes.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getProgramCodeBlock):
+        (JSC::CodeCache::getEvalCodeBlock):
+        (JSC::CodeCache::getModuleProgramCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CodeCache.h:
+        * runtime/CommonIdentifiers.h:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::EvalExecutable::create):
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::ModuleProgramExecutable::ModuleProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::isArrowFunctionContext):
+        (JSC::ScriptExecutable::isDerivedConstructorContext):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * tests/es6.yaml:
+        * tests/stress/arrowfunction-activation-sink-osrexit.js:
+        * tests/stress/arrowfunction-activation-sink.js:
+        * tests/stress/arrowfunction-lexical-bind-newtarget.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-1.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-2.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-3.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-supercall-4.js: Added.
+        * tests/stress/arrowfunction-lexical-bind-this-1.js:
+        * tests/stress/arrowfunction-lexical-bind-this-7.js: Added.
+        * tests/stress/arrowfunction-tdz-1.js: Added.
+        * tests/stress/arrowfunction-tdz-2.js: Added.
+        * tests/stress/arrowfunction-tdz-3.js: Added.
+        * tests/stress/arrowfunction-tdz-4.js: Added.
+        * tests/stress/arrowfunction-tdz.js: Removed.
+
+2015-12-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Streams API] streams should not directly use Number and related methods
+        https://bugs.webkit.org/show_bug.cgi?id=151499
+
+        Reviewed by Darin Adler.
+
+        * runtime/CommonIdentifiers.h: Adding isNaN as private symbol.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Adding @isNaN function.
+
+2015-12-01  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Don't hide the argument name inside for block in AirIteratedRegisterCoalescing.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=151622
+
+        Reviewed by Darin Adler.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addEdges):
+
+2015-12-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>
+
+        [Streams API] Remove use of @catch for exposed promises
+        https://bugs.webkit.org/show_bug.cgi?id=151625
+
+        Reviewed by Darin Adler.
+
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::addOwnInternalSlots): Removing @catch from the prototype as it is not safe.
+
+2015-11-30  Filip Pizlo  <fpizlo@apple.com>
+
+        B3::ValueRep::Any should translate into a Arg::ColdUse role in Air
+        https://bugs.webkit.org/show_bug.cgi?id=151174
+
+        Reviewed by Geoffrey Garen and Benjamin Poulain.
+
+        This teaches the register allocator that it should pick spills based on whichever tmp has the
+        highest score:
+
+            score(tmp) = degree(tmp) / sum(for each use of tmp, block->frequency)
+
+        In other words, the numerator is the number of edges in the inteference graph and the denominator
+        is an estimate of the dynamic number of uses.
+
+        This also extends Arg::Role to know that there is such a thing as ColdUse, i.e. a Use that
+        doesn't count as such for the above formula. Because LateUse is always used in contexts where we
+        want it to be Cold, I've defined LateUse to imply ColdUse.
+
+        This gets rid of all spilling inside the hot loop in Kraken/imaging-gaussian-blur. But more
+        importantly, it makes our register allocator use a well-known heuristic based on reusable
+        building blocks like the new Air::UseCounts. Even if the heuristic is slightly wrong, the right
+        heuristic probably uses the same building blocks.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        * b3/B3ValueRep.h:
+        * b3/air/AirArg.cpp:
+        (WTF::printInternal):
+        * b3/air/AirArg.h:
+        (JSC::B3::Air::Arg::isAnyUse):
+        (JSC::B3::Air::Arg::isColdUse):
+        (JSC::B3::Air::Arg::isWarmUse):
+        (JSC::B3::Air::Arg::isEarlyUse):
+        (JSC::B3::Air::Arg::isDef):
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::IteratedRegisterCoalescingAllocator): Deleted.
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::allocatedReg): Deleted.
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::tmpArraySize): Deleted.
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::initializeDegrees): Deleted.
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::build): Deleted.
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::selectSpill): Deleted.
+        (JSC::B3::Air::isUselessMoveInst): Deleted.
+        (JSC::B3::Air::assignRegisterToTmpInProgram): Deleted.
+        (JSC::B3::Air::addSpillAndFillToProgram): Deleted.
+        (JSC::B3::Air::iteratedRegisterCoalescingOnType): Deleted.
+        * b3/air/AirLiveness.h:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/air/AirUseCounts.h: Added.
+        (JSC::B3::Air::UseCounts::Counts::dump):
+        (JSC::B3::Air::UseCounts::UseCounts):
+        (JSC::B3::Air::UseCounts::operator[]):
+        (JSC::B3::Air::UseCounts::dump):
+        * runtime/Options.h:
+
+2015-11-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the !ENABLE(DFG_JIT) build after r192699
+        https://bugs.webkit.org/show_bug.cgi?id=151616
+
+        Reviewed by Darin Adler.
+
+        * assembler/MacroAssembler.h:
+
+2015-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        Object::{freeze, seal} perform preventExtensionsTransition twice
+        https://bugs.webkit.org/show_bug.cgi?id=151606
+
+        Reviewed by Darin Adler.
+
+        In Structure::{freezeTransition, sealTransition}, we perform preventExtensionsTransition.
+        So it is unnecessary to perform preventExtensionsTransition before executing Structure::{freezeTransition, sealTransition}.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::seal):
+        (JSC::JSObject::freeze):
+        (JSC::JSObject::preventExtensions):
+        * tests/stress/freeze-and-seal-should-prevent-extensions.js: Added.
+        (shouldBe):
+        (shouldThrow):
+
+2015-11-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Add Sqrt to B3
+        https://bugs.webkit.org/show_bug.cgi?id=151692
+
+        Reviewed by Geoffrey Garen.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::sqrtDouble):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::sqrtsd_mr):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3Opcode.cpp:
+        (WTF::printInternal):
+        * b3/B3Opcode.h:
+        * b3/B3Validate.cpp:
+        * b3/B3Value.cpp:
+        (JSC::B3::Value::effects):
+        (JSC::B3::Value::key):
+        (JSC::B3::Value::typeFor):
+        * b3/air/AirOpcode.opcodes:
+        * b3/testb3.cpp:
+        (JSC::B3::testSqrtArg):
+        (JSC::B3::testSqrtImm):
+        (JSC::B3::testSqrtMem):
+        (JSC::B3::run):
+        * ftl/FTLB3Output.h:
+        (JSC::FTL::Output::doubleSqrt):
+
+2015-11-30  Filip Pizlo  <fpizlo@apple.com>
+
+        FTL lazy slow paths should work with B3
+        https://bugs.webkit.org/show_bug.cgi?id=151667
+
+        Reviewed by Geoffrey Garen.
+
+        This adds all of the glue necessary to make FTL::LazySlowPath work with B3. The B3 approach
+        allows us to put all of the code in FTL::LowerDFGToLLVM, instead of having supporting data
+        structures on the side and a bunch of complex code in FTLCompile.cpp.
+
+        * b3/B3CheckSpecial.cpp:
+        (JSC::B3::CheckSpecial::generate):
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::run):
+        * b3/B3PatchpointSpecial.cpp:
+        (JSC::B3::PatchpointSpecial::generate):
+        * b3/B3StackmapValue.h:
+        * ftl/FTLJSTailCall.cpp:
+        (JSC::FTL::DFG::recoveryFor):
+        (JSC::FTL::JSTailCall::emit):
+        * ftl/FTLLazySlowPath.cpp:
+        (JSC::FTL::LazySlowPath::LazySlowPath):
+        (JSC::FTL::LazySlowPath::generate):
+        * ftl/FTLLazySlowPath.h:
+        (JSC::FTL::LazySlowPath::createGenerator):
+        (JSC::FTL::LazySlowPath::patchableJump):
+        (JSC::FTL::LazySlowPath::done):
+        (JSC::FTL::LazySlowPath::patchpoint):
+        (JSC::FTL::LazySlowPath::usedRegisters):
+        (JSC::FTL::LazySlowPath::callSiteIndex):
+        (JSC::FTL::LazySlowPath::stub):
+        * ftl/FTLLocation.cpp:
+        (JSC::FTL::Location::forValueRep):
+        (JSC::FTL::Location::forStackmaps):
+        (JSC::FTL::Location::dump):
+        (JSC::FTL::Location::isGPR):
+        (JSC::FTL::Location::gpr):
+        (JSC::FTL::Location::isFPR):
+        (JSC::FTL::Location::fpr):
+        (JSC::FTL::Location::restoreInto):
+        * ftl/FTLLocation.h:
+        (JSC::FTL::Location::Location):
+        (JSC::FTL::Location::forRegister):
+        (JSC::FTL::Location::forIndirect):
+        (JSC::FTL::Location::forConstant):
+        (JSC::FTL::Location::kind):
+        (JSC::FTL::Location::hasReg):
+        (JSC::FTL::Location::reg):
+        (JSC::FTL::Location::hasOffset):
+        (JSC::FTL::Location::offset):
+        (JSC::FTL::Location::hash):
+        (JSC::FTL::Location::hasDwarfRegNum): Deleted.
+        (JSC::FTL::Location::dwarfRegNum): Deleted.
+        (JSC::FTL::Location::hasDwarfReg): Deleted.
+        (JSC::FTL::Location::dwarfReg): Deleted.
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::LowerDFGToLLVM):
+        (JSC::FTL::DFG::LowerDFGToLLVM::lazySlowPath):
+        * jit/RegisterSet.cpp:
+        (JSC::RegisterSet::stubUnavailableRegisters):
+        (JSC::RegisterSet::macroScratchRegisters):
+        (JSC::RegisterSet::calleeSaveRegisters):
+        * jit/RegisterSet.h:
+
+2015-11-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Use a better RNG for Math.random()
+        https://bugs.webkit.org/show_bug.cgi?id=151641
+
+        Reviewed by Anders Carlsson.
+
+        Updated for interface change.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::setInputCursor):
+
+2015-11-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Speed up Air Liveness Analysis on Tmps
+        https://bugs.webkit.org/show_bug.cgi?id=151556
+
+        Reviewed by Filip Pizlo.
+
+        Liveness Analysis scales poorly on large graphs like the ones
+        generated by testComplex().
+        This patch introduces a faster of Liveness using the continuous indices
+        of values instead of the values themselves.
+
+        There are two main areas of improvements:
+        1) Reduce the cost of doing a LocalCalc over a BasicBlock.
+        2) Reduce how many LocalCalc are needed to converge to a solution.
+
+        Most of the costs of LocalCalc are from HashSet manipulations.
+        The HashSet operations are O(1) but the constant is large enough
+        to be a problem.
+
+        I used a similar trick as the Register Allocator to remove hashing
+        and collision handling: the absolute value of the Tmp is used as an index
+        into a flat array.
+
+        I used Briggs's Sparse Set implementation for the local live information
+        at each instruction. It has great properties for doing the local calculation:
+        -No memory reallocation.
+        -O(1) add() and remove() with a small constant.
+        -Strict O(n) iteration.
+        -O(1) clear().
+
+        The values Live-At-Head are now stored into a Vector. The Sparse Set
+        is used to maintain the Tmp uniqueness.
+
+        When forwarding new liveness at head to the predecessor, I start by removing
+        everything that was already in live-at-head. We can assume that any value
+        in that list has already been added to the predecessors.
+        This leaves us with a small-ish number of Tmps to add to live-at-head
+        and to the predecessors.
+
+        The speed up convergence, I used the same trick as DFG's liveness: keep
+        a set of dirty blocks to process. In practice, all the blocks without
+        back-edges converge quickly, and we only propagate liveness as needed.
+
+        This patch reduces the time taken by "testComplex(64, 384)" by another 5%.
+
+        The remaining things to do for Liveness are:
+        -Skip the first block for the fix point (it is often large and doing a local
+         calc on it is useless).
+        -Find a better Data Structure for live-at-tail (updating the HashSet takes
+         > 50% of the total convergence time).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::build):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::getAlias):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::getAliasWhenSpilling):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::allocatedReg):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::tmpArraySize):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::initializeDegrees):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addEdges):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addEdge):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::makeWorkList):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::simplify):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::forEachAdjacent):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::hasBeenSimplified):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::decrementDegree):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::forEachNodeMoves):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::isMoveRelated):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::enableMovesOnValue):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::precoloredCoalescingHeuristic):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::conservativeHeuristic):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addWorkList):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::combine):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::freezeMoves):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::selectSpill):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::assignColors):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::dumpInterferenceGraphInDot):
+        (JSC::B3::Air::iteratedRegisterCoalescingOnType):
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+        (JSC::B3::Air::AbsoluteTmpHelper<Arg::GP>::absoluteIndex): Deleted.
+        (JSC::B3::Air::AbsoluteTmpHelper<Arg::GP>::tmpFromAbsoluteIndex): Deleted.
+        (JSC::B3::Air::AbsoluteTmpHelper<Arg::FP>::absoluteIndex): Deleted.
+        (JSC::B3::Air::AbsoluteTmpHelper<Arg::FP>::tmpFromAbsoluteIndex): Deleted.
+        * b3/air/AirReportUsedRegisters.cpp:
+        (JSC::B3::Air::reportUsedRegisters):
+        * b3/air/AirTmpInlines.h:
+        (JSC::B3::Air::AbsoluteTmpMapper<Arg::GP>::absoluteIndex):
+        (JSC::B3::Air::AbsoluteTmpMapper<Arg::GP>::tmpFromAbsoluteIndex):
+        (JSC::B3::Air::AbsoluteTmpMapper<Arg::FP>::absoluteIndex):
+        (JSC::B3::Air::AbsoluteTmpMapper<Arg::FP>::tmpFromAbsoluteIndex):
+        * b3/air/AirLiveness.h: Added.
+
+2015-11-30  Saam barati  <sbarati@apple.com>
+
+        FTL OSR Exits that are exception handlers should not have two different entrances. Instead, we should have two discrete OSR exits that do different things.
+        https://bugs.webkit.org/show_bug.cgi?id=151404
+
+        Reviewed by Filip Pizlo.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::mmAllocateDataSection):
+        * ftl/FTLExceptionHandlerManager.cpp:
+        (JSC::FTL::ExceptionHandlerManager::addNewExit):
+        (JSC::FTL::ExceptionHandlerManager::addNewCallOperationExit):
+        (JSC::FTL::ExceptionHandlerManager::callOperationExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::lazySlowPathExceptionTarget):
+        (JSC::FTL::ExceptionHandlerManager::callOperationOSRExit):
+        (JSC::FTL::ExceptionHandlerManager::getByIdOSRExit): Deleted.
+        (JSC::FTL::ExceptionHandlerManager::subOSRExit): Deleted.
+        * ftl/FTLExceptionHandlerManager.h:
+        * ftl/FTLExitThunkGenerator.cpp:
+        (JSC::FTL::ExitThunkGenerator::emitThunk):
+        * ftl/FTLOSRExit.cpp:
+        (JSC::FTL::OSRExitDescriptor::OSRExitDescriptor):
+        (JSC::FTL::OSRExitDescriptor::isExceptionHandler):
+        (JSC::FTL::OSRExit::OSRExit):
+        (JSC::FTL::OSRExit::spillRegistersToSpillSlot):
+        (JSC::FTL::OSRExit::recoverRegistersFromSpillSlot):
+        (JSC::FTL::OSRExit::willArriveAtExitFromIndirectExceptionCheck):
+        (JSC::FTL::OSRExit::willArriveAtOSRExitFromGenericUnwind):
+        (JSC::FTL::OSRExit::willArriveAtOSRExitFromCallOperation):
+        (JSC::FTL::OSRExit::needsRegisterRecoveryOnGenericUnwindOSRExitPath):
+        (JSC::FTL::OSRExitDescriptor::willArriveAtExitFromIndirectExceptionCheck): Deleted.
+        (JSC::FTL::OSRExitDescriptor::mightArriveAtOSRExitFromGenericUnwind): Deleted.
+        (JSC::FTL::OSRExitDescriptor::mightArriveAtOSRExitFromCallOperation): Deleted.
+        (JSC::FTL::OSRExitDescriptor::needsRegisterRecoveryOnGenericUnwindOSRExitPath): Deleted.
+        * ftl/FTLOSRExit.h:
+        * ftl/FTLOSRExitCompilationInfo.h:
+        (JSC::FTL::OSRExitCompilationInfo::OSRExitCompilationInfo):
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+
+2015-11-30  Mark Lam  <mark.lam@apple.com>
+
+        Refactor the op_add, op_sub, and op_mul snippets to use the SnippetOperand class.
+        https://bugs.webkit.org/show_bug.cgi?id=151678
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileValueAdd):
+        (JSC::DFG::SpeculativeJIT::compileArithSub):
+        * ftl/FTLCompile.cpp:
+        * jit/JITAddGenerator.cpp:
+        (JSC::JITAddGenerator::generateFastPath):
+        * jit/JITAddGenerator.h:
+        (JSC::JITAddGenerator::JITAddGenerator):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emit_op_sub):
+        * jit/JITMulGenerator.cpp:
+        (JSC::JITMulGenerator::generateFastPath):
+        * jit/JITMulGenerator.h:
+        (JSC::JITMulGenerator::JITMulGenerator):
+        * jit/JITSubGenerator.cpp:
+        (JSC::JITSubGenerator::generateFastPath):
+        * jit/JITSubGenerator.h:
+        (JSC::JITSubGenerator::JITSubGenerator):
+        * jit/SnippetOperand.h:
+        (JSC::SnippetOperand::isPositiveConstInt32):
+
+2015-11-30  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 stackmaps should support early clobber
+        https://bugs.webkit.org/show_bug.cgi?id=151668
+
+        Reviewed by Geoffrey Garen.
+
+        While starting work on FTL lazy slow paths, I realized that we needed some way to say that r11 is
+        off limits. Not just that it's clobbered, but that it cannot be used for any input values to a
+        stackmap.
+
+        In LLVM we do this by having the AnyRegCC forbid r11.
+
+        In B3, we want something more flexible. In this and other cases, what we really want is an early
+        clobber set. B3 already supported a late clobber set for every stackmap value. Late clobber means
+        that the act of performing the operation will cause garbage to be written into those registers.
+        But here we want: assume that garbage magically appears in those registers in the moment before
+        the operation executes. Any registers in that set will be off-limits to the inputs to the
+        stackmap. This should be great for other things, like the way the we handle exceptions.
+
+        For the simple r11 issue, what we want is to call the StackmapValue::clobber() method, which now
+        means both early and late clobber. It's the weapon of choice whenever you're unsure.
+
+        This adds the early clobber feature, does some minor Inst refactoring to make this less scary,
+        and adds a test. The test is simple but it's very comprehensive - for example it tests the
+        early-clobber-after-Move special case.
+
+        * b3/B3StackmapSpecial.cpp:
+        (JSC::B3::StackmapSpecial::extraClobberedRegs):
+        (JSC::B3::StackmapSpecial::extraEarlyClobberedRegs):
+        (JSC::B3::StackmapSpecial::forEachArgImpl):
+        * b3/B3StackmapSpecial.h:
+        * b3/B3StackmapValue.cpp:
+        (JSC::B3::StackmapValue::dumpMeta):
+        (JSC::B3::StackmapValue::StackmapValue):
+        * b3/B3StackmapValue.h:
+        * b3/air/AirCCallSpecial.cpp:
+        (JSC::B3::Air::CCallSpecial::extraClobberedRegs):
+        (JSC::B3::Air::CCallSpecial::extraEarlyClobberedRegs):
+        (JSC::B3::Air::CCallSpecial::dumpImpl):
+        * b3/air/AirCCallSpecial.h:
+        * b3/air/AirInst.h:
+        * b3/air/AirInstInlines.h:
+        (JSC::B3::Air::Inst::extraClobberedRegs):
+        (JSC::B3::Air::Inst::extraEarlyClobberedRegs):
+        (JSC::B3::Air::Inst::forEachTmpWithExtraClobberedRegs):
+        (JSC::B3::Air::Inst::reportUsedRegisters):
+        (JSC::B3::Air::Inst::forEachDefAndExtraClobberedTmp): Deleted.
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::IteratedRegisterCoalescingAllocator):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::build):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::allocate):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::initializeDegrees):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addEdges):
+        (JSC::B3::Air::IteratedRegisterCoalescingAllocator::addEdge):
+        (JSC::B3::Air::iteratedRegisterCoalescingOnType):
+        (JSC::B3::Air::iteratedRegisterCoalescing):
+        * b3/air/AirSpecial.h:
+        * b3/air/AirSpillEverything.cpp:
+        (JSC::B3::Air::spillEverything):
+        * b3/testb3.cpp:
+        (JSC::B3::testSimplePatchpointWithoutOuputClobbersGPArgs):
+        (JSC::B3::testSimplePatchpointWithOuputClobbersGPArgs):
+        (JSC::B3::testSimplePatchpointWithoutOuputClobbersFPArgs):
+        (JSC::B3::testSimplePatchpointWithOuputClobbersFPArgs):
+        (JSC::B3::testPatchpointWithEarlyClobber):
+        (JSC::B3::testPatchpointCallArg):
+        (JSC::B3::run):
+        * dfg/DFGCommon.h:
+
+2015-11-30  Mark Lam  <mark.lam@apple.com>
+
+        Snippefy op_div for the baseline JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=151607
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_div):
+        (JSC::JIT::emitSlow_op_div):
+        (JSC::JIT::compileBinaryArithOpSlowCase): Deleted.
+
+        * jit/JITArithmetic32_64.cpp:
+        (JSC::JIT::emitBinaryDoubleOp):
+        (JSC::JIT::emit_op_div): Deleted.
+        (JSC::JIT::emitSlow_op_div): Deleted.
+        - Removed the 32-bit specific op_div implementation.  The 64-bit version with the
+          op_div snippet can now service both 32-bit and 64-bit.
+ 
+        * jit/JITDivGenerator.cpp: Added.
+        (JSC::JITDivGenerator::loadOperand):
+        (JSC::JITDivGenerator::generateFastPath):
+        * jit/JITDivGenerator.h: Added.
+        (JSC::JITDivGenerator::JITDivGenerator):
+        (JSC::JITDivGenerator::didEmitFastPath):
+        (JSC::JITDivGenerator::endJumpList):
+        (JSC::JITDivGenerator::slowPathJumpList):
+ 
+        * jit/JITInlines.h:
+        (JSC::JIT::getOperandConstantDouble): Added.
+ 
+        * jit/SnippetOperand.h: Added.
+        (JSC::SnippetOperand::SnippetOperand):
+        (JSC::SnippetOperand::mightBeNumber):
+        (JSC::SnippetOperand::definitelyIsNumber):
+        (JSC::SnippetOperand::isConst):
+        (JSC::SnippetOperand::isConstInt32):
+        (JSC::SnippetOperand::isConstDouble):
+        (JSC::SnippetOperand::asRawBits):
+        (JSC::SnippetOperand::asConstInt32):
+        (JSC::SnippetOperand::asConstDouble):
+        (JSC::SnippetOperand::setConstInt32):
+        (JSC::SnippetOperand::setConstDouble):
+        - The SnippetOperand encapsulates operand constness, const type, and profiling
+          information.  As a result:
+          1. The argument list to the JITDivGenerator constructor is now more concise.
+          2. The logic of the JITDivGenerator is now less verbose and easier to express.
+
+        * parser/ResultType.h:
+        (JSC::ResultType::isInt32):
+        (JSC::ResultType::definitelyIsNumber):
+        (JSC::ResultType::definitelyIsString):
+        (JSC::ResultType::definitelyIsBoolean):
+        (JSC::ResultType::mightBeNumber):
+        (JSC::ResultType::isNotNumber):
+        - Made these functions const because they were always meant to be const.
+          This also allows me to enforce constness in the SnippetOperand.
+
+2015-11-30  Sukolsak Sakshuwong  <sukolsak@gmail.com>
+
+        Fix coding style of Intl code
+        https://bugs.webkit.org/show_bug.cgi?id=151491
+
+        Reviewed by Darin Adler.
+
+        This patch does three things:
+        1. Rename pointers and references to ExecState from "exec" to "state".
+        2. Pass parameters by references instead of pointers if the parameters
+           are required.
+        3. Remove the word "get" from the names of functions that don't return
+           values through out arguments.
+
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollatorFuncCompare):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::initializeCollator):
+        (JSC::constructIntlCollator):
+        (JSC::callIntlCollator):
+        (JSC::IntlCollatorConstructor::getOwnPropertySlot):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormatFuncFormatDateTime):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::constructIntlDateTimeFormat):
+        (JSC::callIntlDateTimeFormat):
+        (JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot):
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormatFuncFormatNumber):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::constructIntlNumberFormat):
+        (JSC::callIntlNumberFormat):
+        (JSC::IntlNumberFormatConstructor::getOwnPropertySlot):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototype::getOwnPropertySlot):
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObject.cpp:
+        (JSC::intlBooleanOption):
+        (JSC::intlStringOption):
+        (JSC::privateUseLangTag):
+        (JSC::canonicalLangTag):
+        (JSC::grandfatheredLangTag):
+        (JSC::canonicalizeLanguageTag):
+        (JSC::canonicalizeLocaleList):
+        (JSC::lookupSupportedLocales):
+        (JSC::bestFitSupportedLocales):
+        (JSC::supportedLocales):
+        (JSC::getIntlBooleanOption): Deleted.
+        (JSC::getIntlStringOption): Deleted.
+        (JSC::getPrivateUseLangTag): Deleted.
+        (JSC::getCanonicalLangTag): Deleted.
+        (JSC::getGrandfatheredLangTag): Deleted.
+        * runtime/IntlObject.h:
+
+2015-11-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Simplify the loop that remove useless Air instructions
+        https://bugs.webkit.org/show_bug.cgi?id=151652
+
+        Reviewed by Andreas Kling.
+
+        * b3/air/AirEliminateDeadCode.cpp:
+        (JSC::B3::Air::eliminateDeadCode):
+        Use Vector's removeAllMatching() instead of custom code.
+
+        It is likely faster too since we remove few values and Vector
+        is good at doing that.
+
+2015-11-30  Filip Pizlo  <fpizlo@apple.com>
+
+        B3 should be be clever about choosing which child to reuse for result in two-operand commutative operations
+        https://bugs.webkit.org/show_bug.cgi?id=151321
+
+        Reviewed by Geoffrey Garen.
+
+        When lowering a commutative operation to a two-operand instruction, you have a choice of which
+        child value to move into the result tmp. For example we might have:
+
+            @x = Add(@y, @z)
+
+        Assuming no three-operand add is available, we could either lower it to this:
+
+            Move %y, %x
+            Add %z, %x
+
+        or to this:
+
+            Move %z, %x
+            Add %y, %x
+
+        Which is better depends on the likelihood of coalescing with %x. If it's more likely that %y will
+        coalesce with %x, then we want to use the first form. Otherwise, we should use the second form.
+
+        This implements two heuristics for selecting the right form, and makes those heuristics reusable
+        within the B3->Air lowering by abstracting it as preferRightForResult(). For non-commutative
+        operations we must use the first form, so the first form is the default. The heuristics are:
+
+        - If the right child has only one user, then use the second form instead. This is profitable because
+          that means that @z dies at the Add, so using the second form means that the Move will be coalesced
+          away.
+
+        - If one of the children is a Phi that this operation (the Add in this case) flows into via some
+          Upsilon - possibly transitively through other Phis - then use the form that cases a Move on that
+          child. This overrides everything else, and is meant to optimize variables that accumulate in a
+          loop.
+
+        This required adding a reusable PhiChildren analysis, so I wrote one. It has an API that is mostly
+        based on iterators, and a higher-level API for looking at transitive children that is based on
+        functors.
+
+        I was originally implementing this for completeness, but when looking at how it interacted with
+        imaging-gaussian-blur, I realized the need for some heuristic for the loop-accumulator case. This
+        helps a lot on that benchmark. This widens the overall lead that B3 has on imaging-gaussian-blur, but
+        steady-state runs that exclude compile latency still show a slight deficit. That will most likely get
+        fixed by https://bugs.webkit.org/show_bug.cgi?id=151174.
+
+        No new tests because the commutativity appears to be covered by existing tests, and anyway, there are
+        no correctness implications to commuting a commutative operation.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * b3/B3LowerToAir.cpp:
+        (JSC::B3::Air::LowerToAir::LowerToAir):
+        (JSC::B3::Air::LowerToAir::canBeInternal):
+        (JSC::B3::Air::LowerToAir::appendUnOp):
+        (JSC::B3::Air::LowerToAir::preferRightForResult):
+        (JSC::B3::Air::LowerToAir::appendBinOp):
+        (JSC::B3::Air::LowerToAir::lower):
+        * b3/B3PhiChildren.cpp: Added.
+        (JSC::B3::PhiChildren::PhiChildren):
+        (JSC::B3::PhiChildren::~PhiChildren):
+        * b3/B3PhiChildren.h: Added.
+        (JSC::B3::PhiChildren::ValueCollection::ValueCollection):
+        (JSC::B3::PhiChildren::ValueCollection::size):
+        (JSC::B3::PhiChildren::ValueCollection::at):
+        (JSC::B3::PhiChildren::ValueCollection::operator[]):
+        (JSC::B3::PhiChildren::ValueCollection::contains):
+        (JSC::B3::PhiChildren::ValueCollection::iterator::iterator):
+        (JSC::B3::PhiChildren::ValueCollection::iterator::operator*):
+        (JSC::B3::PhiChildren::ValueCollection::iterator::operator++):
+        (JSC::B3::PhiChildren::ValueCollection::iterator::operator==):
+        (JSC::B3::PhiChildren::ValueCollection::iterator::operator!=):
+        (JSC::B3::PhiChildren::ValueCollection::begin):
+        (JSC::B3::PhiChildren::ValueCollection::end):
+        (JSC::B3::PhiChildren::UpsilonCollection::UpsilonCollection):
+        (JSC::B3::PhiChildren::UpsilonCollection::size):
+        (JSC::B3::PhiChildren::UpsilonCollection::at):
+        (JSC::B3::PhiChildren::UpsilonCollection::operator[]):
+        (JSC::B3::PhiChildren::UpsilonCollection::contains):
+        (JSC::B3::PhiChildren::UpsilonCollection::begin):
+        (JSC::B3::PhiChildren::UpsilonCollection::end):
+        (JSC::B3::PhiChildren::UpsilonCollection::values):
+        (JSC::B3::PhiChildren::UpsilonCollection::forAllTransitiveIncomingValues):
+        (JSC::B3::PhiChildren::UpsilonCollection::transitivelyUses):
+        (JSC::B3::PhiChildren::at):
+        (JSC::B3::PhiChildren::operator[]):
+        * b3/B3Procedure.cpp:
+        (JSC::B3::Procedure::Procedure):
+        * b3/B3Procedure.h:
+        * b3/B3UseCounts.cpp:
+        (JSC::B3::UseCounts::UseCounts):
+        * b3/B3UseCounts.h:
+        (JSC::B3::UseCounts::numUses):
+        (JSC::B3::UseCounts::numUsingInstructions):
+        (JSC::B3::UseCounts::operator[]): Deleted.
+
+2015-11-30  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r192812): This change seems to have broken the iOS builds (Requested by ryanhaddad on #webkit).
+        https://bugs.webkit.org/show_bug.cgi?id=151669
+
+        Unreviewed, fix build.
+
+        * dfg/DFGCommon.h:
+
+2015-11-30  Saam barati  <sbarati@apple.com>
+
+        implement op_get_rest_length so that we can allocate the rest array with the right size from the start
+        https://bugs.webkit.org/show_bug.cgi?id=151467
+
+        Reviewed by Geoffrey Garen and Mark Lam.
+
+        This patch implements op_get_rest_length which returns the length
+        that the rest parameter array will be. We're implementing this because
+        it might be a constant value in the presence of inlining in the DFG.
+        We will take advantage of this optimization opportunity in a future patch:
+        https://bugs.webkit.org/show_bug.cgi?id=151454
+        to emit better code for op_copy_rest.
+
+        op_get_rest_length has two operands: 
+        1) a destination
+        2) A constant indicating the number of parameters to skip when copying the rest array.
+
+        op_get_rest_length lowers to a JSConstant node when we're inlined
+        and not a varargs call (in this case, we statically know the arguments
+        length). When that condition isn't met, we lower op_get_rest_length to 
+        GetRestArray. GetRestArray produces its result as an int32.
+
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitNewArrayWithSize):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
+        (JSC::BytecodeGenerator::emitRestParameter):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RestParameterNode::emit):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGMayExit.cpp:
+        (JSC::DFG::mayExit):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::numberOfArgumentsToSkip):
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileCopyRest):
+        (JSC::DFG::SpeculativeJIT::compileGetRestLength):
+        (JSC::DFG::SpeculativeJIT::compileNotifyWrite):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileCopyRest):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileGetRestLength):
+        (JSC::FTL::DFG::LowerDFGToLLVM::compileNewObject):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_copy_rest):
+        (JSC::JIT::emit_op_get_rest_length):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+
+2015-11-30  Filip Pizlo  <fpizlo@apple.com>
+
+        MacroAssembler needs an API for disabling scratch registers
+        https://bugs.webkit.org/show_bug.cgi?id=151010
+
+        Reviewed by Saam Barati and Michael Saboff.
+
+        This adds two scope classes, DisallowMacroScratchRegisterUsage and
+        AllowMacroScratchRegisterUsage. The default is that the scratch registers are enabled. Air
+        disables them before generation.
+
+        Henceforth the pattern inside B3 stackmap generator callbacks will be that you can only use
+        AllowMacroScratchRegisterUsage if you've either supplied the scratch register as a clobbered
+        register and arranged for all of the stackmap values to be late uses, or you're writing a test
+        and you're OK with it being fragile with respect to scratch registers. The latter holds in most
+        of testb3.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::optimizeForX86):
+        (JSC::AbstractMacroAssembler::setTempRegisterValid):
+        * assembler/AllowMacroScratchRegisterUsage.h: Added.
+        (JSC::AllowMacroScratchRegisterUsage::AllowMacroScratchRegisterUsage):
+        (JSC::AllowMacroScratchRegisterUsage::~AllowMacroScratchRegisterUsage):
+        * assembler/DisallowMacroScratchRegisterUsage.h: Added.
+        (JSC::DisallowMacroScratchRegisterUsage::DisallowMacroScratchRegisterUsage):
+        (JSC::DisallowMacroScratchRegisterUsage::~DisallowMacroScratchRegisterUsage):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::scratchRegister):
+        (JSC::MacroAssemblerX86Common::loadDouble):
+        (JSC::MacroAssemblerX86Common::branchConvertDoubleToInt32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::and32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::sub32):
+        (JSC::MacroAssemblerX86_64::load8):
+        (JSC::MacroAssemblerX86_64::addDouble):
+        (JSC::MacroAssemblerX86_64::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::store8):
+        (JSC::MacroAssemblerX86_64::callWithSlowPathReturnType):
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::jump):
+        (JSC::MacroAssemblerX86_64::tailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
+        (JSC::MacroAssemblerX86_64::branchAdd32):
+        (JSC::MacroAssemblerX86_64::add64):
+        (JSC::MacroAssemblerX86_64::addPtrNoFlags):
+        (JSC::MacroAssemblerX86_64::and64):
+        (JSC::MacroAssemblerX86_64::lshift64):
+        (JSC::MacroAssemblerX86_64::or64):
+        (JSC::MacroAssemblerX86_64::sub64):
+        (JSC::MacroAssemblerX86_64::store64):
+        (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::branch64):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTest64):
+        (JSC::MacroAssemblerX86_64::test64):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::branch32WithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        (JSC::MacroAssemblerX86_64::branch8):
+        (JSC::MacroAssemblerX86_64::branchTest8):
+        (JSC::MacroAssemblerX86_64::convertInt64ToDouble):
+        (JSC::MacroAssemblerX86_64::readCallTarget):
+        (JSC::MacroAssemblerX86_64::haveScratchRegisterForBlinding):
+        (JSC::MacroAssemblerX86_64::scratchRegisterForBlinding):
+        (JSC::MacroAssemblerX86_64::canJumpReplacePatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::canJumpReplacePatchableBranch32WithPatch):
+        (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranch32WithPatch):
+        (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::repatchCall):
+        (JSC::MacroAssemblerX86_64::add64AndSetFlags):
+        * b3/air/AirGenerate.cpp:
+        (JSC::B3::Air::generate):
+        * b3/testb3.cpp:
+        (JSC::B3::testSimplePatchpoint):
+        (JSC::B3::testSimplePatchpointWithoutOuputClobbersGPArgs):
+        (JSC::B3::testSimplePatchpointWithOuputClobbersGPArgs):
+        (JSC::B3::testSimplePatchpointWithoutOuputClobbersFPArgs):
+        (JSC::B3::testSimplePatchpointWithOuputClobbersFPArgs):
+        (JSC::B3::testPatchpointCallArg):
+        (JSC::B3::testPatchpointFixedRegister):
+        (JSC::B3::testPatchpointAny):
+        (JSC::B3::testPatchpointAnyImm):
+        (JSC::B3::testSimpleCheck):
+        (JSC::B3::testCheckLessThan):
+        (JSC::B3::testCheckMegaCombo):
+        (JSC::B3::testCheckAddImm):
+        (JSC::B3::testCheckAddImmCommute):
+        (JSC::B3::testCheckAddImmSomeRegister):
+        (JSC::B3::testCheckAdd):
+        (JSC::B3::testCheckAdd64):
+        (JSC::B3::testCheckAddFoldFail):
+        (JSC::B3::testCheckSubImm):
+        (JSC::B3::testCheckSubBadImm):
+        (JSC::B3::testCheckSub):
+        (JSC::B3::testCheckSub64):
+        (JSC::B3::testCheckSubFoldFail):
+        (JSC::B3::testCheckNeg):
+        (JSC::B3::testCheckNeg64):
+        (JSC::B3::testCheckMul):
+        (JSC::B3::testCheckMulMemory):
+        (JSC::B3::testCheckMul2):
+        (JSC::B3::testCheckMul64):
+        (JSC::B3::testCheckMulFoldFail):
+        (JSC::B3::genericTestCompare):
+        * dfg/DFGCommon.h:
+        * jit/GPRInfo.h:
+        (JSC::GPRInfo::toRegister):
+        (JSC::GPRInfo::reservedRegisters):
+
+2015-11-26  Mark Lam  <mark.lam@apple.com>
+
+        [ARM64] stress/op_div.js is failing on some divide by 0 cases.
+        https://bugs.webkit.org/show_bug.cgi?id=151515
+
+        Reviewed by Saam Barati.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileArithDiv):
+        - Added a check for the divide by zero case.
+        * tests/stress/op_div.js:
+        - Un-skipped the test.
+
+2015-11-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Add testb3 to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=151619
+
+        Reviewed by Gyuyoung Kim.
+
+        * shell/CMakeLists.txt:
+
+2015-11-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Use mark pragmas only if it is supported
+        https://bugs.webkit.org/show_bug.cgi?id=151621
+
+        Reviewed by Mark Lam.
+
+        * b3/air/AirIteratedRegisterCoalescing.cpp:
+
+2015-11-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Fix the ENABLE(B3_JIT) build with GCC in B3Procedure.h
+        https://bugs.webkit.org/show_bug.cgi?id=151620
+
+        Reviewed by Mark Lam.
+
+        * b3/B3Procedure.h:
+
+2015-11-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [cmake] Add new B3 source files to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=151618
+
+        Reviewed by Gyuyoung Kim.
+
+        * CMakeLists.txt:
+
+2015-11-26  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GLIB] Implement garbage collector timers
+        https://bugs.webkit.org/show_bug.cgi?id=151391
+
+        Reviewed by Žan Doberšek.
+
+        Add GLib implementation using GSource.
+
+        * heap/EdenGCActivityCallback.cpp:
+        * heap/FullGCActivityCallback.cpp:
+        * heap/GCActivityCallback.cpp:
+        (JSC::GCActivityCallback::GCActivityCallback):
+        (JSC::GCActivityCallback::scheduleTimer):
+        (JSC::GCActivityCallback::cancelTimer):
+        * heap/GCActivityCallback.h:
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::HeapTimer):
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::timerDidFire):
+        * heap/HeapTimer.h:
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::scheduleTimer):
+        (JSC::IncrementalSweeper::cancelTimer):
+        * heap/IncrementalSweeper.h:
+
+2015-11-24  Caitlin Potter  <caitp@igalia.com>
+
+        [JSC] support Computed Property Names in destructuring Patterns
+        https://bugs.webkit.org/show_bug.cgi?id=151494
+
+        Reviewed by Saam Barati.
+
+        Add support for computed property names in destructuring BindingPatterns
+        and AssignmentPatterns.
+
+        Productions BindingProperty(1) and AssignmentProperty(2) allow for any valid
+        PropertName(3), including ComputedPropertyName(4)
+
+        1: http://tc39.github.io/ecma262/#prod-BindingProperty
+        2: http://tc39.github.io/ecma262/#prod-AssignmentProperty
+        3: http://tc39.github.io/ecma262/#prod-PropertyName
+        4: http://tc39.github.io/ecma262/#prod-ComputedPropertyName
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ObjectPatternNode::bindValue):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::appendObjectPatternEntry):
+        * parser/Nodes.h:
+        (JSC::ObjectPatternNode::appendEntry):
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseDestructuringPattern):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::operatorStackPop):
+        * tests/es6.yaml:
+        * tests/es6/destructuring_assignment_computed_properties.js: Added.
+        (test):
+        (test.computeName):
+        (test.loadValue):
+        (test.out.get a):
+        (test.out.set a):
+        (test.out.get b):
+        (test.out.set b):
+        (test.out.get c):
+        (test.out.set c):
+        (test.get var):
+
+2015-11-24  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r192536, r192722, and r192743.
+        https://bugs.webkit.org/show_bug.cgi?id=151593
+
+        Still causing trouble. (Requested by kling on #webkit).
+
+        Reverted changesets:
+
+        "[JSC] JSPropertyNameEnumerator could be destructorless."
+        https://bugs.webkit.org/show_bug.cgi?id=151242
+        http://trac.webkit.org/changeset/192536
+
+        "REGRESSION(r192536): Null pointer dereference in
+        JSPropertyNameEnumerator::visitChildren()."
+        https://bugs.webkit.org/show_bug.cgi?id=151495
+        http://trac.webkit.org/changeset/192722
+
+        "REGRESSION(r192536): Null pointer dereference in
+        JSPropertyNameEnumerator::visitChildren()."
+        https://bugs.webkit.org/show_bug.cgi?id=151495
+        http://trac.webkit.org/changeset/192743
+
+2015-11-23  Brian Burg  <bburg@apple.com>
+
+        Unreviewed, fix the Mac CMake build after r192793.
+
+        * PlatformMac.cmake:
+
+2015-11-20  Brian Burg  <bburg@apple.com>
+
+        Web Inspector: RemoteInspector should track targets and connections for remote automation
+        https://bugs.webkit.org/show_bug.cgi?id=151042
+
+        Reviewed by Joseph Pecoraro.
+
+        Refactor RemoteInspector so it can be used to send listings of different target types.
+        First, rename Debuggable to RemoteInspectionTarget, and pull things not specific to
+        remote inspection into the base class RemoteControllableTarget and its Connection class.
+
+        Add a new RemoteControllableTarget called RemoteAutomationTarget, used by UIProcess
+        to support remote UI automation via webinspectord. On the protocol side, this target
+        uses a new WIRTypeKey called WIRTypeAutomation to distiguish the listing from
+        Web and JavaScript listings and avoid inventing a new listing mechanism.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextGetDebuggerRunLoop):
+        (JSGlobalContextSetDebuggerRunLoop):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorFrontendChannel.h:
+        * inspector/remote/RemoteAutomationTarget.cpp: Added.
+        (Inspector::RemoteAutomationTarget::setAutomationAllowed): Added.
+        * inspector/remote/RemoteAutomationTarget.h: Added.
+        * inspector/remote/RemoteConnectionToTarget.h: Renamed from Source/JavaScriptCore/inspector/remote/RemoteInspectorDebuggableConnection.h.
+        (Inspector::RemoteTargetBlock::RemoteTargetBlock):
+        (Inspector::RemoteTargetBlock::~RemoteTargetBlock):
+        (Inspector::RemoteTargetBlock::operator=):
+        (Inspector::RemoteTargetBlock::operator()):
+        * inspector/remote/RemoteConnectionToTarget.mm: Renamed from Source/JavaScriptCore/inspector/remote/RemoteInspectorDebuggableConnection.mm.
+        (Inspector::RemoteTargetHandleRunSourceGlobal):
+        (Inspector::RemoteTargetQueueTaskOnGlobalQueue):
+        (Inspector::RemoteTargetInitializeGlobalQueue):
+        (Inspector::RemoteTargetHandleRunSourceWithInfo):
+        (Inspector::RemoteConnectionToTarget::RemoteConnectionToTarget):
+        (Inspector::RemoteConnectionToTarget::~RemoteConnectionToTarget):
+        (Inspector::RemoteConnectionToTarget::destination):
+        (Inspector::RemoteConnectionToTarget::connectionIdentifier):
+        (Inspector::RemoteConnectionToTarget::dispatchAsyncOnTarget):
+        (Inspector::RemoteConnectionToTarget::setup):
+        (Inspector::RemoteConnectionToTarget::targetClosed):
+        (Inspector::RemoteConnectionToTarget::close):
+        (Inspector::RemoteConnectionToTarget::sendMessageToTarget):
+        (Inspector::RemoteConnectionToTarget::sendMessageToFrontend):
+        (Inspector::RemoteConnectionToTarget::setupRunLoop):
+        (Inspector::RemoteConnectionToTarget::teardownRunLoop):
+        (Inspector::RemoteConnectionToTarget::queueTaskOnPrivateRunLoop):
+        * inspector/remote/RemoteControllableTarget.cpp: Added.
+        (Inspector::RemoteControllableTarget::~RemoteControllableTarget):
+        (Inspector::RemoteControllableTarget::init):
+        (Inspector::RemoteControllableTarget::update):
+        * inspector/remote/RemoteControllableTarget.h: Added.
+        * inspector/remote/RemoteInspectionTarget.cpp: Renamed from Source/JavaScriptCore/inspector/remote/RemoteInspectorDebuggable.cpp.
+        (Inspector::RemoteInspectionTarget::remoteControlAllowed):
+        (Inspector::RemoteInspectionTarget::setRemoteDebuggingAllowed):
+        (Inspector::RemoteInspectionTarget::pauseWaitingForAutomaticInspection):
+        (Inspector::RemoteInspectionTarget::unpauseForInitializedInspector):
+        * inspector/remote/RemoteInspectionTarget.h: Renamed from Source/JavaScriptCore/inspector/remote/RemoteInspectorDebuggable.h.
+        (isType):
+        * inspector/remote/RemoteInspector.h:
+
+            Code to manage Debuggables now works with RemoteControllableTargets and doesn't
+            care whether the target is for Inspection or Automation. Listing data with target-
+            and type-specific information are captured when clients call into RemoteInspector
+            since that's the easiest time to gather this information on the right thread.
+            Use the is<> / downcast<> machinery when we need a concrete Target type.
+
+        * inspector/remote/RemoteInspector.mm:
+        (Inspector::RemoteInspector::nextAvailableIdentifier):
+        (Inspector::RemoteInspector::registerTarget): renamed from registerDebuggable.
+        (Inspector::RemoteInspector::unregisterTarget): renamed from unregisterDebuggable.
+        (Inspector::RemoteInspector::updateTarget): renamed from updateDebuggable.
+        (Inspector::RemoteInspector::updateAutomaticInspectionCandidate):
+        (Inspector::RemoteInspector::sendMessageToRemote):
+        (Inspector::RemoteInspector::setupFailed):
+        (Inspector::RemoteInspector::stopInternal):
+        (Inspector::RemoteInspector::setupXPCConnectionIfNeeded):
+        (Inspector::RemoteInspector::xpcConnectionFailed):
+        (Inspector::RemoteInspector::listingForTarget):
+        (Inspector::RemoteInspector::listingForInspectionTarget):
+        (Inspector::RemoteInspector::listingForAutomationTarget):
+        (Inspector::RemoteInspector::pushListingsNow):
+        (Inspector::RemoteInspector::pushListingsSoon):
+        (Inspector::RemoteInspector::receivedSetupMessage):
+        (Inspector::RemoteInspector::receivedDataMessage):
+        (Inspector::RemoteInspector::receivedDidCloseMessage):
+        (Inspector::RemoteInspector::receivedGetListingMessage):
+        (Inspector::RemoteInspector::receivedIndicateMessage):
+        (Inspector::RemoteInspector::receivedConnectionDiedMessage):
+        (Inspector::RemoteInspector::RemoteInspector): Deleted.
+        (Inspector::RemoteInspector::registerDebuggable): Deleted.
+        (Inspector::RemoteInspector::unregisterDebuggable): Deleted.
+        (Inspector::RemoteInspector::updateDebuggable): Deleted.
+        (Inspector::RemoteInspector::updateDebuggableAutomaticInspectCandidate): Deleted.
+        (Inspector::RemoteInspector::sendMessageToRemoteFrontend): Deleted.
+        (Inspector::RemoteInspector::listingForDebuggable): Deleted.
+        (Inspector::RemoteInspector::pushListingNow): Deleted.
+        (Inspector::RemoteInspector::pushListingSoon): Deleted.
+        * inspector/remote/RemoteInspectorConstants.h:
+        * runtime/JSGlobalObjectDebuggable.cpp:
+        (JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemote):
+        (JSC::JSGlobalObjectDebuggable::pauseWaitingForAutomaticInspection):
+        (JSC::JSGlobalObjectDebuggable::dispatchMessageFromRemoteFrontend): Deleted.
+        * runtime/JSGlobalObjectDebuggable.h:
+
+2015-11-23  Brian Burg  <bburg@apple.com>
+
+        Rename JavaScriptCore builtins files to match exposed object names
+        https://bugs.webkit.org/show_bug.cgi?id=151549
+
+        Reviewed by Youenn Fablet.
+
+        As a subtask of unifying code generation for WebCore and JSC builtins, we need to get rid of
+        differences between builtins filenames (e.g., Promise.prototype.js) and the name of the
+        generated Builtin object (PromisePrototype).
+
+        If we don't do this, then both build systems need special hacks to normalize the object name
+        from the file name. It's easier to just normalize the filename.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/ArrayIteratorPrototype.js: Renamed from Source/JavaScriptCore/builtins/ArrayIterator.prototype.js.
+        * builtins/ArrayPrototype.js: Renamed from Source/JavaScriptCore/builtins/Array.prototype.js.
+        * builtins/FunctionPrototype.js: Renamed from Source/JavaScriptCore/builtins/Function.prototype.js.
+        * builtins/IteratorPrototype.js: Renamed from Source/JavaScriptCore/builtins/Iterator.prototype.js.
+        * builtins/PromiseOperations.js: Renamed from Source/JavaScriptCore/builtins/Operations.Promise.js.
+        * builtins/PromisePrototype.js: Renamed from Source/JavaScriptCore/builtins/Promise.prototype.js.
+        * builtins/StringIteratorPrototype.js: Renamed from Source/JavaScriptCore/builtins/StringIterator.prototype.js.
+        * builtins/TypedArrayPrototype.js: Renamed from Source/JavaScriptCore/builtins/TypedArray.prototype.js.
+
+2015-11-23  Andreas Kling  <akling@apple.com>
+
+        REGRESSION(r192536): Null pointer dereference in JSPropertyNameEnumerator::visitChildren().
+        <https://webkit.org/b/151495>
+
+        Reviewed by Mark Lam
+
+        The test I added when fixing this bug the first time caught another bug when
+        run on 32-bit: jsString() can also cause GC, so we have to make sure that
+        JSPropertyNameEnumerator::m_propertyNames is null until after the array it
+        points to has been populated.
+
+        Test: property-name-enumerator-gc-151495.js
+
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::finishCreation):
+
+== Rolled over to ChangeLog-2015-11-21 ==
diff --git a/Configurations/Base.xcconfig b/Configurations/Base.xcconfig
new file mode 100644
index 0000000..d36109c
--- /dev/null
+++ b/Configurations/Base.xcconfig
@@ -0,0 +1,157 @@
+// Copyright (C) 2009, 2010, 2011, 2013, 2014 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "../../../../Internal/Configurations/HaveInternalSDK.xcconfig"
+
+USE_INTERNAL_SDK = $(USE_INTERNAL_SDK_$(CONFIGURATION));
+USE_INTERNAL_SDK_Production = YES;
+USE_INTERNAL_SDK_Debug = $(HAVE_INTERNAL_SDK);
+USE_INTERNAL_SDK_Release = $(HAVE_INTERNAL_SDK);
+
+CLANG_CXX_LANGUAGE_STANDARD = gnu++14;
+CLANG_CXX_LIBRARY = libc++;
+CLANG_WARN_BOOL_CONVERSION = YES;
+CLANG_WARN_CONSTANT_CONVERSION = YES;
+CLANG_WARN_CXX0X_EXTENSIONS = NO;
+CLANG_WARN_EMPTY_BODY = YES;
+CLANG_WARN_ENUM_CONVERSION = YES;
+CLANG_WARN_INFINITE_RECURSION = YES;
+CLANG_WARN_INT_CONVERSION = YES;
+CLANG_WARN_SUSPICIOUS_MOVE = YES;
+CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+COMBINE_HIDPI_IMAGES = NO;
+DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
+ENABLE_STRICT_OBJC_MSGSEND = YES;
+GCC_C_LANGUAGE_STANDARD = gnu99;
+GCC_DEBUGGING_SYMBOLS = default;
+GCC_DYNAMIC_NO_PIC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS = NO;
+GCC_ENABLE_CPP_RTTI = NO;
+GCC_ENABLE_OBJC_EXCEPTIONS = YES;
+GCC_ENABLE_SYMBOL_SEPARATION = NO;
+GCC_FAST_OBJC_DISPATCH = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS = YES;
+GCC_INLINES_ARE_PRIVATE_EXTERN = YES;
+GCC_NO_COMMON_BLOCKS = YES;
+GCC_OBJC_CALL_CXX_CDTORS = YES;
+GCC_PRECOMPILE_PREFIX_HEADER = YES;
+GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) $(inherited);
+GCC_STRICT_ALIASING = YES;
+GCC_THREADSAFE_STATICS = NO;
+GCC_TREAT_WARNINGS_AS_ERRORS = YES;
+GCC_VERSION = com.apple.compilers.llvm.clang.1_0;
+// FIXME: <http://webkit.org/b/109834> JavaSciptCore should build with -Wshorten-64-to-32
+GCC_WARN_64_TO_32_BIT_CONVERSION = $(GCC_WARN_64_TO_32_BIT_CONVERSION_$(CURRENT_ARCH));
+GCC_WARN_64_TO_32_BIT_CONVERSION_ = YES;
+GCC_WARN_64_TO_32_BIT_CONVERSION_armv7 = YES;
+GCC_WARN_64_TO_32_BIT_CONVERSION_armv7k = YES;
+GCC_WARN_64_TO_32_BIT_CONVERSION_armv7s = YES;
+GCC_WARN_64_TO_32_BIT_CONVERSION_arm64 = NO;
+GCC_WARN_64_TO_32_BIT_CONVERSION_i386 = YES;
+GCC_WARN_64_TO_32_BIT_CONVERSION_x86_64 = NO;
+GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO;
+GCC_WARN_ABOUT_MISSING_NEWLINE = YES;
+GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES;
+GCC_WARN_ABOUT_RETURN_TYPE = YES;
+GCC_WARN_NON_VIRTUAL_DESTRUCTOR = YES;
+GCC_WARN_SIGN_COMPARE = YES;
+GCC_WARN_UNDECLARED_SELECTOR = YES;
+GCC_WARN_UNINITIALIZED_AUTOS = YES;
+GCC_WARN_UNUSED_FUNCTION = YES;
+GCC_WARN_UNUSED_VARIABLE = YES;
+CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+PREBINDING = NO;
+WARNING_CFLAGS = -Wall -Wextra -Wcast-qual -Wchar-subscripts -Wextra-tokens -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wpacked -Wpointer-arith -Wredundant-decls -Wundef -Wwrite-strings -Wexit-time-destructors -Wglobal-constructors -Wtautological-compare -Wimplicit-fallthrough;
+
+LLVM_LOCAL_HEADER_PATH[sdk=macosx*] = "$(BUILT_PRODUCTS_DIR)/usr/local/LLVMForJavaScriptCore/include";
+LLVM_LOCAL_HEADER_PATH[sdk=iphoneos*] = "$(BUILT_PRODUCTS_DIR)/usr/local/include";
+
+LLVM_SYSTEM_HEADER_PATH[sdk=macosx*] = /usr/local/LLVMForJavaScriptCore/include;
+LLVM_SYSTEM_HEADER_PATH[sdk=iphoneos*] = /usr/local/include;
+
+HEADER_SEARCH_PATHS = . $(LLVM_LOCAL_HEADER_PATH) "${BUILT_PRODUCTS_DIR}/ExtraIncludesForLocalLLVMBuild" $(LLVM_SYSTEM_HEADER_PATH) "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
+
+TARGET_MAC_OS_X_VERSION_MAJOR = $(TARGET_MAC_OS_X_VERSION_MAJOR$(MACOSX_DEPLOYMENT_TARGET:suffix:identifier));
+TARGET_MAC_OS_X_VERSION_MAJOR_10 = 101000;
+TARGET_MAC_OS_X_VERSION_MAJOR_11 = 101100;
+TARGET_MAC_OS_X_VERSION_MAJOR_12 = 101200;
+TARGET_MAC_OS_X_VERSION_MAJOR_13 = 101300;
+
+AD_HOC_CODE_SIGNING_ALLOWED = YES;
+CODE_SIGN_IDENTITY = -;
+
+SUPPORTED_PLATFORMS = iphoneos iphonesimulator macosx appletvos appletvsimulator watchos watchsimulator;
+
+WK_XCODE_SUPPORTS_TEXT_BASED_STUBS = $(WK_NOT_$(WK_EMPTY_$(TAPI_VERIFY_MODE)));
+WK_PRIVATE_FRAMEWORK_STUBS_DIR[sdk=iphoneos*] = $(WK_PRIVATE_FRAMEWORK_STUBS_DIR_iphoneos_$(WK_XCODE_SUPPORTS_TEXT_BASED_STUBS)_$(USE_INTERNAL_SDK));
+WK_PRIVATE_FRAMEWORK_STUBS_DIR_iphoneos_YES_ = $(SRCROOT)/../../WebKitLibraries/WebKitPrivateFrameworkStubs/iOS/$(IPHONEOS_DEPLOYMENT_TARGET:base);
+
+FRAMEWORK_SEARCH_PATHS = $(WK_QUOTED_OVERRIDE_FRAMEWORKS_DIR) $(WK_PRIVATE_FRAMEWORK_STUBS_DIR);
+
+NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR = $(SYSTEM_LIBRARY_DIR)/Frameworks;
+
+JAVASCRIPTCORE_FRAMEWORKS_DIR = $(JAVASCRIPTCORE_FRAMEWORKS_DIR_USE_OVERRIDE_FRAMEWORKS_DIR_$(WK_USE_OVERRIDE_FRAMEWORKS_DIR));
+JAVASCRIPTCORE_FRAMEWORKS_DIR_USE_OVERRIDE_FRAMEWORKS_DIR_NO = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR);
+JAVASCRIPTCORE_FRAMEWORKS_DIR_USE_OVERRIDE_FRAMEWORKS_DIR_YES = $(WK_OVERRIDE_FRAMEWORKS_DIR);
+
+JAVASCRIPTCORE_CONTENTS_DIR[sdk=iphone*] = JavaScriptCore.framework;
+JAVASCRIPTCORE_CONTENTS_DIR[sdk=macosx*] = JavaScriptCore.framework/Versions/A;
+
+JAVASCRIPTCORE_RESOURCES_DIR = $(JAVASCRIPTCORE_CONTENTS_DIR)/Resources;
+JAVASCRIPTCORE_LIBRARIES_DIR = $(JAVASCRIPTCORE_CONTENTS_DIR)/Libraries;
+
+// DEBUG_DEFINES, GCC_OPTIMIZATION_LEVEL, STRIP_INSTALLED_PRODUCT and DEAD_CODE_STRIPPING vary between the debug and normal variants.
+// We set up the values for each variant here, and have the Debug configuration in the Xcode project use the _debug variant.
+DEBUG_DEFINES_debug = ;
+DEBUG_DEFINES_normal = NDEBUG;
+DEBUG_DEFINES = $(DEBUG_DEFINES_$(CURRENT_VARIANT));
+
+GCC_OPTIMIZATION_LEVEL = $(GCC_OPTIMIZATION_LEVEL_$(CURRENT_VARIANT));
+GCC_OPTIMIZATION_LEVEL_normal = 3;
+GCC_OPTIMIZATION_LEVEL_debug = 0;
+
+STRIP_INSTALLED_PRODUCT = $(STRIP_INSTALLED_PRODUCT_$(CURRENT_VARIANT));
+STRIP_INSTALLED_PRODUCT_normal = YES;
+STRIP_INSTALLED_PRODUCT_debug = NO;
+
+DEAD_CODE_STRIPPING_debug = NO;
+DEAD_CODE_STRIPPING_normal = YES;
+DEAD_CODE_STRIPPING = $(DEAD_CODE_STRIPPING_$(CURRENT_VARIANT));
+
+SDKROOT = macosx.internal;
+
+OTHER_CFLAGS = $(ASAN_OTHER_CFLAGS) -isystem icu;
+OTHER_CPLUSPLUSFLAGS = $(ASAN_OTHER_CPLUSPLUSFLAGS) -isystem icu;
+OTHER_LDFLAGS = $(ASAN_OTHER_LDFLAGS);
+
+WK_EMPTY_ = YES;
+WK_NOT_ = YES;
+WK_NOT_YES = NO;
+
+WK_USE_OVERRIDE_FRAMEWORKS_DIR = $(WK_NOT_$(WK_EMPTY_$(WK_OVERRIDE_FRAMEWORKS_DIR)));
+
+WK_OVERRIDE_FRAMEWORKS_DIR = $(WK_OVERRIDE_FRAMEWORKS_DIR_USE_STAGING_INSTALL_PATH_$(USE_STAGING_INSTALL_PATH));
+WK_OVERRIDE_FRAMEWORKS_DIR_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
+
+WK_QUOTED_OVERRIDE_FRAMEWORKS_DIR = $(WK_QUOTED_OVERRIDE_FRAMEWORKS_DIR_$(WK_USE_OVERRIDE_FRAMEWORKS_DIR));
+WK_QUOTED_OVERRIDE_FRAMEWORKS_DIR_YES = "$(WK_OVERRIDE_FRAMEWORKS_DIR)";
diff --git a/Configurations/DebugRelease.xcconfig b/Configurations/DebugRelease.xcconfig
new file mode 100644
index 0000000..9c2dfb8
--- /dev/null
+++ b/Configurations/DebugRelease.xcconfig
@@ -0,0 +1,43 @@
+// Copyright (C) 2009, 2010, 2013, 2014 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "Base.xcconfig"
+
+ARCHS = $(ARCHS_STANDARD_32_64_BIT);
+
+ONLY_ACTIVE_ARCH = YES;
+
+TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
+
+MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(PLATFORM_NAME)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+MACOSX_DEPLOYMENT_TARGET_macosx_101000 = 10.10;
+MACOSX_DEPLOYMENT_TARGET_macosx_101100 = 10.11;
+MACOSX_DEPLOYMENT_TARGET_macosx_101200 = 10.12;
+MACOSX_DEPLOYMENT_TARGET_macosx_101300 = 10.13;
+
+GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
+DEBUG_INFORMATION_FORMAT = dwarf;
+
+SDKROOT = $(SDKROOT_$(USE_INTERNAL_SDK));
+SDKROOT_ = macosx;
+SDKROOT_YES = macosx.internal;
diff --git a/Configurations/FeatureDefines.xcconfig b/Configurations/FeatureDefines.xcconfig
new file mode 100644
index 0000000..a88f486
--- /dev/null
+++ b/Configurations/FeatureDefines.xcconfig
@@ -0,0 +1,220 @@
+// Copyright (C) 2009, 2010, 2014, 2015, 2016 Apple Inc. All rights reserved.
+// Copyright (C) 2009 Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// The contents of this file must be kept in sync with FeatureDefines.xcconfig in JavaScriptCore,
+// WebCore, WebKit and WebKit2.  Also the default values of the ENABLE_FEATURE_NAME macros in
+// build-webkit should match the values below, but they do not need to be in the same order.
+
+// Keep this list of features (not enabled/disabled state) in sync with FeatureDefines.vsprops
+// and FeatureDefinesCairo.vsprops in WebKitLibraries/win/tools/vsprops.
+
+// Set any ENABLE_FEATURE_NAME macro to an empty string to disable that feature.
+
+TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000 = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000_101000 = YES;
+TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000_101100 = YES;
+
+ENABLE_3D_TRANSFORMS = ENABLE_3D_TRANSFORMS;
+ENABLE_ACCELERATED_2D_CANVAS = ;
+ENABLE_ACCELERATED_OVERFLOW_SCROLLING[sdk=iphone*] = ENABLE_ACCELERATED_OVERFLOW_SCROLLING;
+
+ENABLE_APPLE_PAY[sdk=embedded*] = $(ENABLE_APPLE_PAY_$(PLATFORM_NAME));
+ENABLE_APPLE_PAY_iphoneos = ENABLE_APPLE_PAY;
+ENABLE_APPLE_PAY_iphonesimulator = ENABLE_APPLE_PAY;
+ENABLE_APPLE_PAY[sdk=iphoneos9*] = ;
+ENABLE_APPLE_PAY[sdk=iphonesimulator9*] = ;
+
+DISABLE_APPLE_PAY_macosx = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000);
+ENABLE_APPLE_PAY[sdk=macosx*] = $(ENABLE_APPLE_PAY_IF_NOT_$(DISABLE_APPLE_PAY_macosx));
+ENABLE_APPLE_PAY_IF_NOT_ = $(ENABLE_APPLE_PAY_IF_NOT_NO);
+ENABLE_APPLE_PAY_IF_NOT_NO = ENABLE_APPLE_PAY;
+ENABLE_APPLE_PAY_IF_NOT_YES = ;
+
+ENABLE_ATTACHMENT_ELEMENT = ENABLE_ATTACHMENT_ELEMENT;
+ENABLE_AVF_CAPTIONS = ENABLE_AVF_CAPTIONS;
+ENABLE_CACHE_PARTITIONING = ENABLE_CACHE_PARTITIONING;
+ENABLE_CANVAS_PATH = ENABLE_CANVAS_PATH;
+ENABLE_CANVAS_PROXY = ;
+ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
+ENABLE_ENCRYPTED_MEDIA = ;
+ENABLE_CONTENT_FILTERING[sdk=appletv*] = ;
+ENABLE_CONTENT_FILTERING[sdk=iphone*] = ENABLE_CONTENT_FILTERING;
+ENABLE_CONTENT_FILTERING[sdk=macosx*] = ENABLE_CONTENT_FILTERING;
+ENABLE_CSP_NEXT = ;
+ENABLE_CSS_ANIMATIONS_LEVEL_2 = ;
+ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
+ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
+ENABLE_CSS_DEVICE_ADAPTATION = ;
+ENABLE_CSS_GRID_LAYOUT = ENABLE_CSS_GRID_LAYOUT;
+ENABLE_CSS_IMAGE_ORIENTATION = ;
+ENABLE_CSS_IMAGE_RESOLUTION = ;
+ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
+ENABLE_CSS_SELECTORS_LEVEL4 = ;
+ENABLE_CSS3_TEXT = ;
+ENABLE_CURSOR_VISIBILITY = ENABLE_CURSOR_VISIBILITY;
+ENABLE_CUSTOM_SCHEME_HANDLER = ;
+ENABLE_DASHBOARD_SUPPORT[sdk=macosx*] = ENABLE_DASHBOARD_SUPPORT;
+ENABLE_DATALIST_ELEMENT = ;
+ENABLE_DATA_TRANSFER_ITEMS = ;
+ENABLE_DETAILS_ELEMENT = ENABLE_DETAILS_ELEMENT;
+ENABLE_DEVICE_ORIENTATION[sdk=iphone*] = ENABLE_DEVICE_ORIENTATION;
+ENABLE_FETCH_API = ENABLE_FETCH_API;
+ENABLE_FILTERS_LEVEL_2 = ENABLE_FILTERS_LEVEL_2;
+ENABLE_FONT_LOAD_EVENTS = ;
+ENABLE_FULLSCREEN_API[sdk=macosx*] = ENABLE_FULLSCREEN_API;
+ENABLE_GAMEPAD = ENABLE_GAMEPAD;
+ENABLE_GAMEPAD[sdk=watch*] = ;
+ENABLE_GAMEPAD_DEPRECATED = ;
+ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
+ENABLE_ICONDATABASE[sdk=macosx*] = ENABLE_ICONDATABASE;
+ENABLE_INTERSECTION_OBSERVER = ;
+ENABLE_SERVICE_CONTROLS[sdk=macosx*] = ENABLE_SERVICE_CONTROLS;
+ENABLE_INDEXED_DATABASE = ENABLE_INDEXED_DATABASE;
+ENABLE_INDEXED_DATABASE_IN_WORKERS = ENABLE_INDEXED_DATABASE_IN_WORKERS;
+ENABLE_INDIE_UI = ;
+ENABLE_INPUT_TYPE_COLOR[sdk=macosx*] = ;
+ENABLE_INPUT_TYPE_COLOR_POPOVER[sdk=macosx*] = ;
+ENABLE_INPUT_TYPE_DATE[sdk=iphone*] = ENABLE_INPUT_TYPE_DATE;
+ENABLE_INPUT_TYPE_DATETIME_INCOMPLETE = ;
+ENABLE_INPUT_TYPE_DATETIMELOCAL[sdk=iphone*] = ENABLE_INPUT_TYPE_DATETIMELOCAL;
+ENABLE_INPUT_TYPE_MONTH[sdk=iphone*] = ENABLE_INPUT_TYPE_MONTH;
+ENABLE_INPUT_TYPE_TIME[sdk=iphone*] = ENABLE_INPUT_TYPE_TIME;
+ENABLE_INPUT_TYPE_WEEK[sdk=iphone*] = ENABLE_INPUT_TYPE_WEEK;
+
+ENABLE_INSPECTOR_ALTERNATE_DISPATCHERS = ENABLE_INSPECTOR_ALTERNATE_DISPATCHERS;
+
+ENABLE_WIRELESS_PLAYBACK_TARGET[sdk=iphone*] = ENABLE_WIRELESS_PLAYBACK_TARGET;
+ENABLE_WIRELESS_PLAYBACK_TARGET[sdk=macosx*] = $(ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR))
+ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_101000 = ;
+ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_101100 = ENABLE_WIRELESS_PLAYBACK_TARGET;
+ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_101200 = ENABLE_WIRELESS_PLAYBACK_TARGET;
+ENABLE_WIRELESS_PLAYBACK_TARGET_macosx_101300 = ENABLE_WIRELESS_PLAYBACK_TARGET;
+
+ENABLE_INTL = ENABLE_INTL;
+
+ENABLE_IOS_GESTURE_EVENTS = ;
+ENABLE_IOS_GESTURE_EVENTS[sdk=iphone*] = $(ENABLE_IOS_GESTURE_EVENTS_ios_WITH_INTERNAL_SDK_$(USE_INTERNAL_SDK));
+ENABLE_IOS_GESTURE_EVENTS_ios_WITH_INTERNAL_SDK_YES = ENABLE_IOS_GESTURE_EVENTS;
+
+ENABLE_MAC_GESTURE_EVENTS = ;
+ENABLE_MAC_GESTURE_EVENTS[sdk=macosx*] = $(ENABLE_MAC_GESTURE_EVENTS_macosx_WITH_INTERNAL_SDK_$(USE_INTERNAL_SDK));
+ENABLE_MAC_GESTURE_EVENTS_macosx_WITH_INTERNAL_SDK_YES = ENABLE_MAC_GESTURE_EVENTS;
+
+ENABLE_TEXT_AUTOSIZING = ENABLE_TEXT_AUTOSIZING;
+ENABLE_DATA_DETECTION = ENABLE_DATA_DETECTION;
+
+ENABLE_IOS_TOUCH_EVENTS[sdk=iphone*] = $(ENABLE_IOS_TOUCH_EVENTS_ios_WITH_INTERNAL_SDK_$(USE_INTERNAL_SDK));
+ENABLE_IOS_TOUCH_EVENTS_ios_WITH_INTERNAL_SDK_YES = ENABLE_IOS_TOUCH_EVENTS;
+
+ENABLE_LEGACY_CSS_VENDOR_PREFIXES = ENABLE_LEGACY_CSS_VENDOR_PREFIXES;
+ENABLE_LEGACY_ENCRYPTED_MEDIA[sdk=macosx*] = ENABLE_LEGACY_ENCRYPTED_MEDIA;
+ENABLE_LEGACY_NOTIFICATIONS[sdk=macosx*] = ENABLE_LEGACY_NOTIFICATIONS;
+ENABLE_LEGACY_VENDOR_PREFIXES = ENABLE_LEGACY_VENDOR_PREFIXES;
+ENABLE_LETTERPRESS[sdk=iphone*] = ENABLE_LETTERPRESS;
+ENABLE_LINK_PREFETCH = ;
+ENABLE_MATHML = ENABLE_MATHML;
+ENABLE_MEDIA_CAPTURE[sdk=iphone*] = ENABLE_MEDIA_CAPTURE;
+ENABLE_MEDIA_CONTROLS_SCRIPT = ENABLE_MEDIA_CONTROLS_SCRIPT;
+ENABLE_MEDIA_SESSION = ;
+
+ENABLE_MEDIA_SOURCE[sdk=macosx*] = ENABLE_MEDIA_SOURCE;
+
+ENABLE_MEDIA_STATISTICS = ;
+ENABLE_MEDIA_STREAM = ;
+ENABLE_METER_ELEMENT = ENABLE_METER_ELEMENT;
+ENABLE_MHTML = ;
+ENABLE_MOUSE_CURSOR_SCALE[sdk=macosx*] = ENABLE_MOUSE_CURSOR_SCALE;
+ENABLE_NAVIGATOR_CONTENT_UTILS = ;
+ENABLE_NAVIGATOR_HWCONCURRENCY = ENABLE_NAVIGATOR_HWCONCURRENCY;
+ENABLE_NOSNIFF = ;
+ENABLE_NOTIFICATIONS[sdk=macosx*] = ENABLE_NOTIFICATIONS;
+ENABLE_PDFKIT_PLUGIN[sdk=macosx*] = ENABLE_PDFKIT_PLUGIN;
+ENABLE_POINTER_LOCK[sdk=macosx*] = ENABLE_POINTER_LOCK;
+ENABLE_PROXIMITY_EVENTS = ;
+ENABLE_PUBLIC_SUFFIX_LIST = ENABLE_PUBLIC_SUFFIX_LIST;
+ENABLE_QUOTA = ;
+ENABLE_READABLE_STREAM_API = ENABLE_READABLE_STREAM_API;
+ENABLE_READABLE_BYTE_STREAM_API = ENABLE_READABLE_BYTE_STREAM_API;
+ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_REQUEST_AUTOCOMPLETE = ;
+ENABLE_REMOTE_INSPECTOR = ENABLE_REMOTE_INSPECTOR;
+ENABLE_RESOLUTION_MEDIA_QUERY = ;
+ENABLE_RESOURCE_USAGE = ENABLE_RESOURCE_USAGE;
+ENABLE_RUBBER_BANDING[sdk=macosx*] = ENABLE_RUBBER_BANDING;
+ENABLE_CSS_SCROLL_SNAP = ENABLE_CSS_SCROLL_SNAP;
+ENABLE_SPEECH_SYNTHESIS = ENABLE_SPEECH_SYNTHESIS;
+ENABLE_SUBTLE_CRYPTO = ENABLE_SUBTLE_CRYPTO;
+ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
+ENABLE_WEB_RTC = ;
+ENABLE_WRITABLE_STREAM_API = ENABLE_WRITABLE_STREAM_API;
+
+ENABLE_TELEPHONE_NUMBER_DETECTION = ENABLE_TELEPHONE_NUMBER_DETECTION;
+
+ENABLE_CSS_TRAILING_WORD = ENABLE_CSS_TRAILING_WORD;
+
+// FIXME: Remove the USE_INTERNAL_SDK condition once we support touch events when building for iOS with
+// the public SDK. We will also need to update FeatureDefines.h.
+ENABLE_TOUCH_EVENTS[sdk=iphone*] = $(ENABLE_TOUCH_EVENTS_ios_WITH_INTERNAL_SDK_$(USE_INTERNAL_SDK));
+ENABLE_TOUCH_EVENTS_ios_WITH_INTERNAL_SDK_YES = ENABLE_TOUCH_EVENTS;
+
+ENABLE_TOUCH_ICON_LOADING = ;
+ENABLE_USERSELECT_ALL = ENABLE_USERSELECT_ALL;
+ENABLE_VIDEO = ENABLE_VIDEO;
+ENABLE_VIDEO_PRESENTATION_MODE[sdk=iphone*] = ENABLE_VIDEO_PRESENTATION_MODE;
+ENABLE_VIDEO_PRESENTATION_MODE[sdk=macosx*] = $(ENABLE_VIDEO_PRESENTATION_MODE_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR))
+ENABLE_VIDEO_PRESENTATION_MODE_macosx_101200 = ENABLE_VIDEO_PRESENTATION_MODE;
+ENABLE_VIDEO_PRESENTATION_MODE_macosx_101300 = ENABLE_VIDEO_PRESENTATION_MODE;
+ENABLE_VIDEO_TRACK = ENABLE_VIDEO_TRACK;
+ENABLE_DATACUE_VALUE = ENABLE_DATACUE_VALUE;
+ENABLE_VIEW_MODE_CSS_MEDIA = ;
+ENABLE_WEBASSEMBLY = ;
+ENABLE_WEBGL = ENABLE_WEBGL;
+ENABLE_WEBGL2 = ENABLE_WEBGL2;
+ENABLE_WEB_ANIMATIONS = ;
+ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
+ENABLE_WEB_REPLAY = $(ENABLE_WEB_REPLAY_$(PLATFORM_NAME)_$(CONFIGURATION));
+ENABLE_WEB_REPLAY_macosx_Debug = ;
+ENABLE_WEB_REPLAY_macosx_Release = ;
+ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
+
+ENABLE_WEB_TIMING = ENABLE_WEB_TIMING;
+
+ENABLE_XSLT = ENABLE_XSLT;
+
+ENABLE_FTL_JIT[sdk=macosx*] = ENABLE_FTL_JIT;
+ENABLE_FTL_JIT[sdk=iphoneos*] = ENABLE_FTL_JIT;
+
+ENABLE_VARIATION_FONTS[sdk=embedded*] = ;
+ENABLE_VARIATION_FONTS_iphoneos = ENABLE_VARIATION_FONTS;
+ENABLE_VARIATION_FONTS_iphonesimulator = ENABLE_VARIATION_FONTS;
+ENABLE_VARIATION_FONTS[sdk=iphoneos9*] = ;
+ENABLE_VARIATION_FONTS[sdk=iphonesimulator9*] = ;
+
+DISABLE_VARIATION_FONTS_macosx = $(TARGET_MAC_OS_X_VERSION_LESS_THAN_1012000);
+ENABLE_VARIATION_FONTS[sdk=macosx*] = ;
+ENABLE_VARIATION_FONTS_IF_NOT_ = $(ENABLE_VARIATION_FONTS_IF_NOT_NO);
+ENABLE_VARIATION_FONTS_IF_NOT_NO = ENABLE_VARIATION_FONTS;
+ENABLE_VARIATION_FONTS_IF_NOT_YES = ;
+
+FEATURE_DEFINES = $(ENABLE_3D_TRANSFORMS) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ACCELERATED_OVERFLOW_SCROLLING) $(ENABLE_APPLE_PAY) $(ENABLE_ATTACHMENT_ELEMENT) $(ENABLE_AVF_CAPTIONS) $(ENABLE_CACHE_PARTITIONING) $(ENABLE_CANVAS_PATH) $(ENABLE_CANVAS_PROXY) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CONTENT_FILTERING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_ANIMATIONS_LEVEL_2) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_DEVICE_ADAPTATION) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SCROLL_SNAP) $(ENABLE_CSS_SELECTORS_LEVEL4) $(ENABLE_CSS_TRAILING_WORD) $(ENABLE_CSS3_TEXT) $(ENABLE_CURSOR_VISIBILITY) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DATACUE_VALUE) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FETCH_API) $(ENABLE_FILTERS_LEVEL_2) $(ENABLE_FONT_LOAD_EVENTS) $(ENABLE_FTL_JIT) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD_DEPRECATED) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE_IN_WORKERS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INDIE_UI) $(ENABLE_INPUT_TYPE_COLOR_POPOVER) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME_INCOMPLETE) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_INTERSECTION_OBSERVER) $(ENABLE_INTL) $(ENABLE_IOS_GESTURE_EVENTS) $(ENABLE_IOS_TOUCH_EVENTS) $(ENABLE_JIT) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_ENCRYPTED_MEDIA) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LETTERPRESS) $(ENABLE_LINK_PREFETCH) $(ENABLE_MAC_GESTURE_EVENTS) $(ENABLE_MATHML) $(ENABLE_MEDIA_CAPTURE) $(ENABLE_MEDIA_CONTROLS_SCRIPT) $(ENABLE_MEDIA_SESSION) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_MEDIA_STREAM) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MOUSE_CURSOR_SCALE) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NAVIGATOR_HWCONCURRENCY) $(ENABLE_NOTIFICATIONS) $(ENABLE_PDFKIT_PLUGIN) $(ENABLE_POINTER_LOCK) $(ENABLE_PROXIMITY_EVENTS) $(ENABLE_PUBLIC_SUFFIX_LIST) $(ENABLE_QUOTA) $(ENABLE_READABLE_STREAM_API) $(ENABLE_READABLE_BYTE_STREAM_API) $(ENABLE_REMOTE_INSPECTOR) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_REQUEST_AUTOCOMPLETE) $(ENABLE_RESOLUTION_MEDIA_QUERY) $(ENABLE_RESOURCE_USAGE) $(ENABLE_RUBBER_BANDING) $(ENABLE_SERVICE_CONTROLS) $(ENABLE_SPEECH_SYNTHESIS) $(ENABLE_SUBTLE_CRYPTO) $(ENABLE_SVG_FONTS) $(ENABLE_TELEPHONE_NUMBER_DETECTION) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TOUCH_EVENTS) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_USERSELECT_ALL) $(ENABLE_VARIATION_FONTS) $(ENABLE_VIDEO_PRESENTATION_MODE) $(ENABLE_VIDEO_TRACK) $(ENABLE_VIDEO) $(ENABLE_VIEW_MODE_CSS_MEDIA) $(ENABLE_WEB_ANIMATIONS) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_REPLAY) $(ENABLE_WEB_RTC) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WEBASSEMBLY) $(ENABLE_WEBGL) $(ENABLE_WEBGL2) $(ENABLE_WIRELESS_PLAYBACK_TARGET) $(ENABLE_WRITABLE_STREAM_API) $(ENABLE_XSLT);
diff --git a/Configurations/JSC.xcconfig b/Configurations/JSC.xcconfig
new file mode 100644
index 0000000..27833ce
--- /dev/null
+++ b/Configurations/JSC.xcconfig
@@ -0,0 +1,37 @@
+// Copyright (C) 2011 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "FeatureDefines.xcconfig"
+#include "Version.xcconfig"
+
+INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR)/$(JAVASCRIPTCORE_RESOURCES_DIR);
+
+OTHER_LDFLAGS = $(inherited) $(WK_RELOCATABLE_FRAMEWORKS_LDFLAGS);
+WK_RELOCATABLE_FRAMEWORKS_LDFLAGS = $(WK_RELOCATABLE_FRAMEWORKS_LDFLAGS_$(WK_RELOCATABLE_FRAMEWORKS));
+WK_RELOCATABLE_FRAMEWORKS_LDFLAGS_YES = -Wl,-dyld_env,DYLD_FRAMEWORK_PATH=@executable_path/../../../..;
+
+PRODUCT_NAME = jsc;
+CODE_SIGN_ENTITLEMENTS[sdk=iphone*] = entitlements.plist;
+
+// Explicitly add the PrivateHeaders directory to the search path so that generated header files can be found in production builds.
+HEADER_SEARCH_PATHS = "$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/PrivateHeaders" $(inherited);
diff --git a/Configurations/JavaScriptCore.xcconfig b/Configurations/JavaScriptCore.xcconfig
new file mode 100644
index 0000000..b432db2
--- /dev/null
+++ b/Configurations/JavaScriptCore.xcconfig
@@ -0,0 +1,58 @@
+// Copyright (C) 2009, 2014 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "FeatureDefines.xcconfig"
+#include "Version.xcconfig"
+
+JSVALUE_MODEL = $(JSVALUE_MODEL_$(CURRENT_ARCH));
+JSVALUE_MODEL_ = UNKNOWN_JSVALUE_MODEL;
+JSVALUE_MODEL_armv7 = 32_64;
+JSVALUE_MODEL_armv7k = 32_64;
+JSVALUE_MODEL_armv7s = 32_64;
+JSVALUE_MODEL_arm64 = 64;
+JSVALUE_MODEL_i386 = 32_64;
+JSVALUE_MODEL_x86_64 = 64;
+
+// Prevent C++ standard library operator new, delete and their related exception types from being exported as weak symbols.
+OTHER_LDFLAGS_HIDE_SYMBOLS = -Wl,-unexported_symbol -Wl,__ZTISt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTISt9exception -Wl,-unexported_symbol -Wl,__ZTSSt9bad_alloc -Wl,-unexported_symbol -Wl,__ZTSSt9exception -Wl,-unexported_symbol -Wl,__ZdlPvS_ -Wl,-unexported_symbol -Wl,__ZnwmPv -Wl,-unexported_symbol -Wl,__ZNKSt3__18functionIFvvEEclEv -Wl,-unexported_symbol -Wl,__ZNSt3__18functionIFvvEEC1EOS2_ -Wl,-unexported_symbol -Wl,__ZNSt3__18functionIFvvEEC2EOS2_ -Wl,-unexported_symbol -Wl,__ZNKSt3__18functionIFvRN3JSC17BytecodeGeneratorEPNS1_10RegisterIDEEEclES3_S5_ -Wl,-unexported_symbol -Wl,__ZNSt3__18functionIFvRN3JSC17BytecodeGeneratorEPNS1_10RegisterIDEEED1Ev -Wl,-unexported_symbol -Wl,__ZNSt3__18functionIFvRN3JSC17BytecodeGeneratorEPNS1_10RegisterIDEEED2Ev -Wl,-unexported_symbol -Wl,__ZNSt3__18functionIFvvEED1Ev -Wl,-unexported_symbol -Wl,__ZNSt3__18functionIFvvEED2Ev -Wl,-unexported_symbol -Wl,__ZTVNSt3__117bad_function_callE -Wl,-all_load;
+
+OTHER_LDFLAGS_BASE = -lobjc -Wl,-Y,3 $(OTHER_LDFLAGS_HIDE_SYMBOLS);
+OTHER_LDFLAGS[sdk=iphone*] = $(inherited) $(OTHER_LDFLAGS_BASE);
+OTHER_LDFLAGS[sdk=macosx*] = $(inherited) $(OTHER_LDFLAGS_BASE) -sub_library libobjc -framework CoreServices;
+
+SECTORDER_FLAGS = $(SECTORDER_FLAGS_$(CONFIGURATION));
+SECTORDER_FLAGS_Production[sdk=iphoneos*] = -Wl,-order_file,$(SDKROOT)/AppleInternal/OrderFiles/JavaScriptCore.order;
+SECTORDER_FLAGS_Production[sdk=macosx*] = -Wl,-order_file,JavaScriptCore.order;
+
+GCC_PREFIX_HEADER = JavaScriptCorePrefix.h;
+GCC_SYMBOLS_PRIVATE_EXTERN = YES;
+HEADER_SEARCH_PATHS = "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore" $(HEADER_SEARCH_PATHS);
+INFOPLIST_FILE = Info.plist;
+INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR);
+DYLIB_INSTALL_NAME_BASE = $(NORMAL_JAVASCRIPTCORE_FRAMEWORKS_DIR);
+PRODUCT_NAME = JavaScriptCore;
+PRODUCT_BUNDLE_IDENTIFIER = com.apple.$(PRODUCT_NAME:rfc1034identifier);
+
+INSTALLHDRS_SCRIPT_PHASE = YES;
+
+EXCLUDED_SOURCE_FILE_NAMES[sdk=iphone*] = framework.sb;
diff --git a/Configurations/ToolExecutable.xcconfig b/Configurations/ToolExecutable.xcconfig
new file mode 100644
index 0000000..a1a90ba
--- /dev/null
+++ b/Configurations/ToolExecutable.xcconfig
@@ -0,0 +1,55 @@
+// Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "FeatureDefines.xcconfig"
+#include "Version.xcconfig"
+
+INSTALL_PATH = $(JAVASCRIPTCORE_FRAMEWORKS_DIR)/$(JAVASCRIPTCORE_RESOURCES_DIR);
+PRODUCT_NAME = $(TARGET_NAME);
+CODE_SIGN_ENTITLEMENTS[sdk=iphone*] = $(CODE_SIGN_ENTITLEMENTS_ios_$(TARGET_NAME));
+CODE_SIGN_ENTITLEMENTS_ios_minidom = entitlements.plist;
+CODE_SIGN_ENTITLEMENTS_ios_testair = entitlements.plist;
+CODE_SIGN_ENTITLEMENTS_ios_testapi = entitlements.plist;
+CODE_SIGN_ENTITLEMENTS_ios_testb3 = entitlements.plist;
+CODE_SIGN_ENTITLEMENTS_ios_testWasm = entitlements.plist;
+CODE_SIGN_ENTITLEMENTS_ios_testRegExp = entitlements.plist;
+
+SKIP_INSTALL = $(SKIP_INSTALL_$(FORCE_TOOL_INSTALL));
+SKIP_INSTALL_ = YES;
+SKIP_INSTALL_NO = YES;
+SKIP_INSTALL_YES = NO;
+
+CLANG_ENABLE_OBJC_ARC = $(CLANG_ENABLE_OBJC_ARC_$(CURRENT_ARCH));
+CLANG_ENABLE_OBJC_ARC_i386[sdk=iphonesimulator*] = YES;
+CLANG_ENABLE_OBJC_ARC_x86_64 = YES;
+CLANG_ENABLE_OBJC_ARC_armv7 = YES;
+CLANG_ENABLE_OBJC_ARC_armv7k = YES;
+CLANG_ENABLE_OBJC_ARC_armv7s = YES;
+CLANG_ENABLE_OBJC_ARC_arm64 = YES;
+
+OTHER_CFLAGS = $(ASAN_OTHER_CFLAGS) -isystem icu;
+OTHER_CPLUSPLUSFLAGS = $(ASAN_OTHER_CPLUSPLUSFLAGS) -isystem icu;
+OTHER_LDFLAGS = $(ASAN_OTHER_LDFLAGS);
+
+// Explicitly add the PrivateHeaders directory to the search path so that generated header files can be found in production builds.
+HEADER_SEARCH_PATHS = "$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/PrivateHeaders" $(inherited);
diff --git a/Configurations/Version.xcconfig b/Configurations/Version.xcconfig
new file mode 100644
index 0000000..df2c6ea
--- /dev/null
+++ b/Configurations/Version.xcconfig
@@ -0,0 +1,60 @@
+// Copyright (C) 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+MAJOR_VERSION = 603;
+MINOR_VERSION = 1;
+TINY_VERSION = 30;
+MICRO_VERSION = 0;
+NANO_VERSION = 34;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
+
+// The bundle version and short version string are set based on the current build configuration, see below.
+BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
+SHORT_VERSION_STRING = $(SHORT_VERSION_STRING_$(CONFIGURATION))
+
+// The system version prefix is based on the current system version.
+SYSTEM_VERSION_PREFIX[sdk=iphone*] = 8;
+SYSTEM_VERSION_PREFIX = $(SYSTEM_VERSION_PREFIX_$(PLATFORM_NAME)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+SYSTEM_VERSION_PREFIX_macosx_101000 = 10;
+SYSTEM_VERSION_PREFIX_macosx_101100 = 11;
+SYSTEM_VERSION_PREFIX_macosx_101200 = 12;
+SYSTEM_VERSION_PREFIX_macosx_101300 = 13;
+
+// The production build always uses the full version with a system version prefix.
+BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);
+BUNDLE_VERSION_ = $(BUNDLE_VERSION_Production);
+
+// The production build always uses the major version with a system version prefix
+SHORT_VERSION_STRING_Production = $(SYSTEM_VERSION_PREFIX)$(MAJOR_VERSION);
+SHORT_VERSION_STRING_ = $(SHORT_VERSION_STRING_Production);
+
+// Local builds are the full version with a plus suffix.
+BUNDLE_VERSION_Release = $(FULL_VERSION)+;
+BUNDLE_VERSION_Debug = $(BUNDLE_VERSION_Release);
+
+// Local builds use the major version with a plus suffix
+SHORT_VERSION_STRING_Release = $(MAJOR_VERSION)+;
+SHORT_VERSION_STRING_Debug = $(SHORT_VERSION_STRING_Release);
+
+DYLIB_COMPATIBILITY_VERSION = 1;
+DYLIB_CURRENT_VERSION = $(FULL_VERSION);
diff --git a/DerivedSources.make b/DerivedSources.make
new file mode 100644
index 0000000..fb92345
--- /dev/null
+++ b/DerivedSources.make
@@ -0,0 +1,317 @@
+# Copyright (C) 2006, 2007, 2008, 2009, 2011, 2013, 2015 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+# 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+#     its contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+VPATH = \
+    $(JavaScriptCore) \
+    $(JavaScriptCore)/parser \
+    $(JavaScriptCore)/runtime \
+    $(JavaScriptCore)/interpreter \
+    $(JavaScriptCore)/jit \
+    $(JavaScriptCore)/builtins \
+    $(JavaScriptCore)/wasm/js \
+#
+
+PYTHON = python
+PERL = perl
+RUBY = ruby
+
+JavaScriptCore_SCRIPTS_DIR = $(JavaScriptCore)/Scripts
+
+ifeq ($(OS),Windows_NT)
+    DELETE = cmd //C del
+else
+    DELETE = rm -f
+endif
+
+# --------
+
+.PHONY : all
+all : \
+    udis86_itab.h \
+    Bytecodes.h \
+    CombinedDomains.json \
+    InitBytecodes.asm \
+    InjectedScriptSource.h \
+    InspectorFrontendDispatchers.h \
+    JSReplayInputs.h \
+    JSCBuiltins.h \
+    Lexer.lut.h \
+    KeywordLookup.h \
+    RegExpJitTables.h \
+    AirOpcode.h \
+    YarrCanonicalizeUnicode.cpp \
+    WasmOps.h \
+    WasmValidateInlines.h \
+    WasmB3IRGeneratorInlines.h \
+#
+
+# JavaScript builtins.
+
+BUILTINS_GENERATOR_SCRIPTS = \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/__init__.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/builtins.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/builtins_generator.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/builtins_model.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/builtins_templates.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/builtins_generate_combined_header.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/builtins_generate_combined_implementation.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/builtins_generate_separate_header.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/builtins/builtins_generate_separate_implementation.py \
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins/builtins_generate_wrapper_header.py \
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins/builtins_generate_wrapper_implementation.py \
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins/builtins_generate_internals_wrapper_header.py \
+    ${JavaScriptCore_SCRIPTS_DIR}/builtins/builtins_generate_internals_wrapper_implementation.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/generate-js-builtins.py \
+    $(JavaScriptCore_SCRIPTS_DIR)/lazywriter.py \
+#
+
+JavaScriptCore_BUILTINS_SOURCES = \
+    $(JavaScriptCore)/builtins/ArrayConstructor.js \
+    $(JavaScriptCore)/builtins/ArrayIteratorPrototype.js \
+    $(JavaScriptCore)/builtins/ArrayPrototype.js \
+    $(JavaScriptCore)/builtins/AsyncFunctionPrototype.js \
+    $(JavaScriptCore)/builtins/DatePrototype.js \
+    $(JavaScriptCore)/builtins/FunctionPrototype.js \
+    $(JavaScriptCore)/builtins/GeneratorPrototype.js \
+    $(JavaScriptCore)/builtins/GlobalObject.js \
+    $(JavaScriptCore)/builtins/GlobalOperations.js \
+    $(JavaScriptCore)/builtins/InspectorInstrumentationObject.js \
+    $(JavaScriptCore)/builtins/InternalPromiseConstructor.js \
+    $(JavaScriptCore)/builtins/IteratorHelpers.js \
+    $(JavaScriptCore)/builtins/IteratorPrototype.js \
+    $(JavaScriptCore)/builtins/MapPrototype.js \
+    $(JavaScriptCore)/builtins/ModuleLoaderPrototype.js \
+    $(JavaScriptCore)/builtins/NumberConstructor.js \
+    $(JavaScriptCore)/builtins/NumberPrototype.js \
+    $(JavaScriptCore)/builtins/ObjectConstructor.js \
+    $(JavaScriptCore)/builtins/PromiseConstructor.js \
+    $(JavaScriptCore)/builtins/PromiseOperations.js \
+    $(JavaScriptCore)/builtins/PromisePrototype.js \
+    $(JavaScriptCore)/builtins/ReflectObject.js \
+    $(JavaScriptCore)/builtins/RegExpPrototype.js \
+    $(JavaScriptCore)/builtins/SetPrototype.js \
+    $(JavaScriptCore)/builtins/StringConstructor.js \
+    $(JavaScriptCore)/builtins/StringIteratorPrototype.js \
+    $(JavaScriptCore)/builtins/StringPrototype.js \
+    $(JavaScriptCore)/builtins/TypedArrayConstructor.js \
+    $(JavaScriptCore)/builtins/TypedArrayPrototype.js \
+#
+
+# The combined output file depends on the contents of builtins and generator scripts, so
+# adding, modifying, or removing builtins or scripts will trigger regeneration of files.
+
+JavaScriptCore_BUILTINS_DEPENDENCIES_LIST : $(JavaScriptCore_SCRIPTS_DIR)/UpdateContents.py DerivedSources.make
+	$(PYTHON) $(JavaScriptCore_SCRIPTS_DIR)/UpdateContents.py '$(JavaScriptCore_BUILTINS_SOURCES) $(BUILTINS_GENERATOR_SCRIPTS)' $@
+
+JSCBuiltins.h: $(BUILTINS_GENERATOR_SCRIPTS) $(JavaScriptCore_BUILTINS_SOURCES) JavaScriptCore_BUILTINS_DEPENDENCIES_LIST
+	$(PYTHON) $(JavaScriptCore_SCRIPTS_DIR)/generate-js-builtins.py --combined --output-directory . --framework JavaScriptCore $(JavaScriptCore_BUILTINS_SOURCES)
+
+# Perfect hash lookup tables for JavaScript classes.
+
+OBJECT_LUT_HEADERS = \
+    ArrayConstructor.lut.h \
+    ArrayIteratorPrototype.lut.h \
+    BooleanPrototype.lut.h \
+    DateConstructor.lut.h \
+    DatePrototype.lut.h \
+    ErrorPrototype.lut.h \
+    GeneratorPrototype.lut.h \
+    InspectorInstrumentationObject.lut.h \
+    IntlCollatorConstructor.lut.h \
+    IntlCollatorPrototype.lut.h \
+    IntlDateTimeFormatConstructor.lut.h \
+    IntlDateTimeFormatPrototype.lut.h \
+    IntlNumberFormatConstructor.lut.h \
+    IntlNumberFormatPrototype.lut.h \
+    JSDataViewPrototype.lut.h \
+    JSGlobalObject.lut.h \
+    JSInternalPromiseConstructor.lut.h \
+    JSONObject.lut.h \
+    JSPromisePrototype.lut.h \
+    JSPromiseConstructor.lut.h \
+    MapPrototype.lut.h \
+    ModuleLoaderPrototype.lut.h \
+    NumberConstructor.lut.h \
+    NumberPrototype.lut.h \
+    ObjectConstructor.lut.h \
+    ReflectObject.lut.h \
+    RegExpConstructor.lut.h \
+    SetPrototype.lut.h \
+    StringConstructor.lut.h \
+    StringIteratorPrototype.lut.h \
+    StringPrototype.lut.h \
+    SymbolConstructor.lut.h \
+    SymbolPrototype.lut.h \
+    WebAssemblyCompileErrorConstructor.lut.h \
+    WebAssemblyCompileErrorPrototype.lut.h \
+    WebAssemblyInstanceConstructor.lut.h \
+    WebAssemblyInstancePrototype.lut.h \
+    WebAssemblyMemoryConstructor.lut.h \
+    WebAssemblyMemoryPrototype.lut.h \
+    WebAssemblyModuleConstructor.lut.h \
+    WebAssemblyModulePrototype.lut.h \
+    WebAssemblyPrototype.lut.h \
+    WebAssemblyRuntimeErrorConstructor.lut.h \
+    WebAssemblyRuntimeErrorPrototype.lut.h \
+    WebAssemblyTableConstructor.lut.h \
+    WebAssemblyTablePrototype.lut.h \
+#
+
+$(OBJECT_LUT_HEADERS): %.lut.h : %.cpp $(JavaScriptCore)/create_hash_table
+	$(PERL) $(JavaScriptCore)/create_hash_table $< > $@
+
+Lexer.lut.h: Keywords.table $(JavaScriptCore)/create_hash_table
+	$(PERL) $(JavaScriptCore)/create_hash_table $< > $@
+
+# character tables for Yarr
+
+RegExpJitTables.h: create_regex_tables
+	$(PYTHON) $^ > $@
+
+KeywordLookup.h: KeywordLookupGenerator.py Keywords.table
+	$(PYTHON) $^ > $@
+
+# udis86 instruction tables
+
+udis86_itab.h: $(JavaScriptCore)/disassembler/udis86/ud_itab.py $(JavaScriptCore)/disassembler/udis86/optable.xml
+	$(PYTHON) $(JavaScriptCore)/disassembler/udis86/ud_itab.py $(JavaScriptCore)/disassembler/udis86/optable.xml .
+
+# Bytecode files
+
+Bytecodes.h: $(JavaScriptCore)/generate-bytecode-files $(JavaScriptCore)/bytecode/BytecodeList.json
+	$(PYTHON) $(JavaScriptCore)/generate-bytecode-files --bytecodes_h Bytecodes.h $(JavaScriptCore)/bytecode/BytecodeList.json
+
+InitBytecodes.asm: $(JavaScriptCore)/generate-bytecode-files $(JavaScriptCore)/bytecode/BytecodeList.json
+	$(PYTHON) $(JavaScriptCore)/generate-bytecode-files --init_bytecodes_asm InitBytecodes.asm $(JavaScriptCore)/bytecode/BytecodeList.json
+
+# Inspector interfaces
+
+INSPECTOR_DOMAINS = \
+    $(JavaScriptCore)/inspector/protocol/ApplicationCache.json \
+    $(JavaScriptCore)/inspector/protocol/CSS.json \
+    $(JavaScriptCore)/inspector/protocol/Console.json \
+    $(JavaScriptCore)/inspector/protocol/DOM.json \
+    $(JavaScriptCore)/inspector/protocol/DOMDebugger.json \
+    $(JavaScriptCore)/inspector/protocol/DOMStorage.json \
+    $(JavaScriptCore)/inspector/protocol/Database.json \
+    $(JavaScriptCore)/inspector/protocol/Debugger.json \
+    $(JavaScriptCore)/inspector/protocol/GenericTypes.json \
+    $(JavaScriptCore)/inspector/protocol/Heap.json \
+    $(JavaScriptCore)/inspector/protocol/Inspector.json \
+    $(JavaScriptCore)/inspector/protocol/LayerTree.json \
+    $(JavaScriptCore)/inspector/protocol/Network.json \
+    $(JavaScriptCore)/inspector/protocol/OverlayTypes.json \
+    $(JavaScriptCore)/inspector/protocol/Page.json \
+    $(JavaScriptCore)/inspector/protocol/Runtime.json \
+    $(JavaScriptCore)/inspector/protocol/ScriptProfiler.json \
+    $(JavaScriptCore)/inspector/protocol/Timeline.json \
+    $(JavaScriptCore)/inspector/protocol/Worker.json \
+#
+
+ifeq ($(findstring ENABLE_INDEXED_DATABASE,$(FEATURE_DEFINES)), ENABLE_INDEXED_DATABASE)
+    INSPECTOR_DOMAINS := $(INSPECTOR_DOMAINS) $(JavaScriptCore)/inspector/protocol/IndexedDB.json
+endif
+
+ifeq ($(findstring ENABLE_RESOURCE_USAGE,$(FEATURE_DEFINES)), ENABLE_RESOURCE_USAGE)
+    INSPECTOR_DOMAINS := $(INSPECTOR_DOMAINS) $(JavaScriptCore)/inspector/protocol/Memory.json
+endif
+
+ifeq ($(findstring ENABLE_WEB_REPLAY,$(FEATURE_DEFINES)), ENABLE_WEB_REPLAY)
+    INSPECTOR_DOMAINS := $(INSPECTOR_DOMAINS) $(JavaScriptCore)/inspector/protocol/Replay.json
+endif
+
+INSPECTOR_GENERATOR_SCRIPTS = \
+	$(JavaScriptCore)/inspector/scripts/codegen/__init__.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/cpp_generator_templates.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/cpp_generator.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generate_cpp_protocol_types_header.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generate_js_backend_commands.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generator_templates.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/generator.py \
+	$(JavaScriptCore)/inspector/scripts/codegen/models.py \
+	$(JavaScriptCore)/inspector/scripts/generate-inspector-protocol-bindings.py \
+	$(JavaScriptCore_SCRIPTS_DIR)/generate-combined-inspector-json.py \
+#
+
+# The combined JSON file depends on the actual set of domains and their file contents, so that
+# adding, modifying, or removing domains will trigger regeneration of inspector files.
+
+.PHONY: force
+EnabledInspectorDomains : $(JavaScriptCore_SCRIPTS_DIR)/UpdateContents.py force
+	$(PYTHON) $(JavaScriptCore_SCRIPTS_DIR)/UpdateContents.py '$(INSPECTOR_DOMAINS)' $@
+
+CombinedDomains.json : $(JavaScriptCore_SCRIPTS_DIR)/generate-combined-inspector-json.py $(INSPECTOR_DOMAINS) EnabledInspectorDomains
+	$(PYTHON) $(JavaScriptCore_SCRIPTS_DIR)/generate-combined-inspector-json.py $(INSPECTOR_DOMAINS) > ./CombinedDomains.json
+
+# Inspector Backend Dispatchers, Frontend Dispatchers, Type Builders
+InspectorFrontendDispatchers.h : CombinedDomains.json $(INSPECTOR_GENERATOR_SCRIPTS)
+	$(PYTHON) $(JavaScriptCore)/inspector/scripts/generate-inspector-protocol-bindings.py --framework JavaScriptCore --outputDir . ./CombinedDomains.json
+
+InjectedScriptSource.h : inspector/InjectedScriptSource.js $(JavaScriptCore_SCRIPTS_DIR)/jsmin.py $(JavaScriptCore_SCRIPTS_DIR)/xxd.pl
+	echo "//# sourceURL=__InjectedScript_InjectedScriptSource.js" > ./InjectedScriptSource.min.js
+	$(PYTHON) $(JavaScriptCore_SCRIPTS_DIR)/jsmin.py < $(JavaScriptCore)/inspector/InjectedScriptSource.js >> ./InjectedScriptSource.min.js
+	$(PERL) $(JavaScriptCore_SCRIPTS_DIR)/xxd.pl InjectedScriptSource_js ./InjectedScriptSource.min.js InjectedScriptSource.h
+	$(DELETE) InjectedScriptSource.min.js
+
+# Web Replay inputs generator
+
+INPUT_GENERATOR_SCRIPTS = \
+    $(JavaScriptCore)/replay/scripts/CodeGeneratorReplayInputs.py \
+    $(JavaScriptCore)/replay/scripts/CodeGeneratorReplayInputsTemplates.py \
+#
+
+INPUT_GENERATOR_SPECIFICATIONS = \
+    $(JavaScriptCore)/replay/JSInputs.json \
+#
+
+JSReplayInputs.h : $(INPUT_GENERATOR_SPECIFICATIONS) $(INPUT_GENERATOR_SCRIPTS)
+	$(PYTHON) $(JavaScriptCore)/replay/scripts/CodeGeneratorReplayInputs.py --outputDir . --framework JavaScriptCore $(INPUT_GENERATOR_SPECIFICATIONS)
+
+AirOpcode.h: $(JavaScriptCore)/b3/air/opcode_generator.rb $(JavaScriptCore)/b3/air/AirOpcode.opcodes
+	$(RUBY) $^
+
+YarrCanonicalizeUnicode.cpp: $(JavaScriptCore)/generateYarrCanonicalizeUnicode $(JavaScriptCore)/ucd/CaseFolding.txt
+	$(PYTHON) $(JavaScriptCore)/generateYarrCanonicalizeUnicode $(JavaScriptCore)/ucd/CaseFolding.txt ./YarrCanonicalizeUnicode.cpp
+
+WasmOps.h: $(JavaScriptCore)/wasm/generateWasmOpsHeader.py $(JavaScriptCore)/wasm/generateWasm.py $(JavaScriptCore)/wasm/wasm.json
+	$(PYTHON) $(JavaScriptCore)/wasm/generateWasmOpsHeader.py $(JavaScriptCore)/wasm/wasm.json ./WasmOps.h
+
+WasmValidateInlines.h: $(JavaScriptCore)/wasm/generateWasmValidateInlinesHeader.py $(JavaScriptCore)/wasm/generateWasm.py $(JavaScriptCore)/wasm/wasm.json
+	$(PYTHON) $(JavaScriptCore)/wasm/generateWasmValidateInlinesHeader.py $(JavaScriptCore)/wasm/wasm.json ./WasmValidateInlines.h
+
+WasmB3IRGeneratorInlines.h: $(JavaScriptCore)/wasm/generateWasmB3IRGeneratorInlinesHeader.py $(JavaScriptCore)/wasm/generateWasm.py $(JavaScriptCore)/wasm/wasm.json
+	$(PYTHON) $(JavaScriptCore)/wasm/generateWasmB3IRGeneratorInlinesHeader.py $(JavaScriptCore)/wasm/wasm.json ./WasmB3IRGeneratorInlines.h
+
+# Dynamically-defined targets are listed below. Static targets belong up top.
+
+all : \
+    $(OBJECT_LUT_HEADERS) \
+#
diff --git a/ForwardingHeaders/JavaScriptCore/APICast.h b/ForwardingHeaders/JavaScriptCore/APICast.h
new file mode 100644
index 0000000..c108c3c
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/APICast.h
@@ -0,0 +1 @@
+#include <API/APICast.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSBase.h b/ForwardingHeaders/JavaScriptCore/JSBase.h
new file mode 100644
index 0000000..3cbe204
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSBase.h
@@ -0,0 +1 @@
+#include <API/JSBase.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h b/ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h
new file mode 100644
index 0000000..e3bdd94
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h
@@ -0,0 +1 @@
+#include <API/JSCTestRunnerUtils.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSContextRef.h b/ForwardingHeaders/JavaScriptCore/JSContextRef.h
new file mode 100644
index 0000000..0c01346
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSContextRef.h
@@ -0,0 +1 @@
+#include <API/JSContextRef.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSObjectRef.h b/ForwardingHeaders/JavaScriptCore/JSObjectRef.h
new file mode 100644
index 0000000..5c3ac44
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSObjectRef.h
@@ -0,0 +1 @@
+#include <API/JSObjectRef.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSObjectRefPrivate.h b/ForwardingHeaders/JavaScriptCore/JSObjectRefPrivate.h
new file mode 100644
index 0000000..92fcbaa
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSObjectRefPrivate.h
@@ -0,0 +1 @@
+#include <API/JSObjectRefPrivate.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h b/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h
new file mode 100644
index 0000000..17299c5
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h
@@ -0,0 +1 @@
+#include <API/JSRetainPtr.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSStringRef.h b/ForwardingHeaders/JavaScriptCore/JSStringRef.h
new file mode 100644
index 0000000..c27c2e2
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSStringRef.h
@@ -0,0 +1 @@
+#include <API/JSStringRef.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h b/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h
new file mode 100644
index 0000000..52b8276
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h
@@ -0,0 +1 @@
+#include <API/JSStringRefCF.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSTypedArray.h b/ForwardingHeaders/JavaScriptCore/JSTypedArray.h
new file mode 100644
index 0000000..18ecccd
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSTypedArray.h
@@ -0,0 +1 @@
+#include <API/JSTypedArray.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JSValueRef.h b/ForwardingHeaders/JavaScriptCore/JSValueRef.h
new file mode 100644
index 0000000..e0839dc
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JSValueRef.h
@@ -0,0 +1 @@
+#include <API/JSValueRef.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JavaScript.h b/ForwardingHeaders/JavaScriptCore/JavaScript.h
new file mode 100644
index 0000000..6c46e2a
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JavaScript.h
@@ -0,0 +1 @@
+#include <API/JavaScript.h>
diff --git a/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h b/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h
new file mode 100644
index 0000000..b24064f
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h
@@ -0,0 +1 @@
+#include <API/JavaScriptCore.h>
diff --git a/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h b/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h
new file mode 100644
index 0000000..18bdb64
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h
@@ -0,0 +1 @@
+#include <API/OpaqueJSString.h>
diff --git a/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h b/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h
new file mode 100644
index 0000000..d79a839
--- /dev/null
+++ b/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h
@@ -0,0 +1 @@
+#include <API/WebKitAvailability.h>
diff --git a/Info.plist b/Info.plist
new file mode 100644
index 0000000..9b4c96a
--- /dev/null
+++ b/Info.plist
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleExecutable</key>
+	<string>${PRODUCT_NAME}</string>
+	<key>CFBundleGetInfoString</key>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2017 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
+	<key>CFBundleIdentifier</key>
+	<string>${PRODUCT_BUNDLE_IDENTIFIER}</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>${PRODUCT_NAME}</string>
+	<key>CFBundlePackageType</key>
+	<string>FMWK</string>
+	<key>CFBundleShortVersionString</key>
+	<string>${SHORT_VERSION_STRING}</string>
+	<key>CFBundleVersion</key>
+	<string>${BUNDLE_VERSION}</string>
+</dict>
+</plist>
diff --git a/JavaScriptCore.gir.in b/JavaScriptCore.gir.in
new file mode 100644
index 0000000..6f8dcc1
--- /dev/null
+++ b/JavaScriptCore.gir.in
@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+<repository version="1.2"
+            xmlns="http://www.gtk.org/introspection/core/1.0"
+            xmlns:c="http://www.gtk.org/introspection/c/1.0">
+  <namespace name="JavaScriptCore" version="@WEBKITGTK_API_VERSION@" 
+             shared-library="javascriptcoregtk-@WEBKITGTK_API_VERSION@"
+             c:identifier-prefixes="JS"
+             c:symbol-prefixes="JS">
+    <record name="GlobalContext" c:type="JSGlobalContextRef" foreign="1"/>
+    <record name="Value" c:type="JSValueRef" foreign="1"/>
+  </namespace>
+</repository>
diff --git a/JavaScriptCore.order b/JavaScriptCore.order
new file mode 100644
index 0000000..984d6e1
--- /dev/null
+++ b/JavaScriptCore.order
@@ -0,0 +1,5081 @@
+__ZN3JSC19initializeThreadingEv
+__ZN3JSCL23initializeThreadingOnceEv
+__ZN3WTF17double_conversion10initializeEv
+__ZN3WTF19initializeThreadingEv
+__ZN3WTF10StringImpl5emptyEv
+__ZN3WTF10fastMallocEm
+__ZN3WTF20TCMalloc_ThreadCache10InitModuleEv
+__ZN3WTFL15InitSizeClassesEv
+__ZN3WTF17PageHeapAllocatorINS_4SpanEE3NewEv
+__Z20TCMalloc_SystemAllocmPmm
+__ZN3WTF17TCMalloc_PageHeap4initEv
+__ZN3WTF20TCMalloc_ThreadCache22CreateCacheIfNecessaryEv
+__ZN3WTF20TCMalloc_ThreadCache7NewHeapEP17_opaque_pthread_tm
+__ZN3WTF17PageHeapAllocatorINS_20TCMalloc_ThreadCacheEE3NewEv
+__ZN3WTF20TCMalloc_ThreadCache14PickNextSampleEm
+__ZN3WTF25TCMalloc_Central_FreeList14FetchFromSpansEv
+__ZN3WTF17TCMalloc_PageHeap3NewEm
+__ZN3WTF17TCMalloc_PageHeap10AllocLargeEm
+__ZN3WTF17TCMalloc_PageHeap8GrowHeapEm
+__ZN3WTFL13MetaDataAllocEm
+__ZN3WTF17TCMalloc_PageHeap6DeleteEPNS_4SpanE
+__ZN3WTF17TCMalloc_PageHeap5CarveEPNS_4SpanEmb
+__ZNK3WTF10StringImpl12hashSlowCaseEv
+__ZN3WTF20ThreadIdentifierData14initializeOnceEv
+__ZN3WTF16fastZeroedMallocEm
+__ZN3WTF13WTFThreadDataC1Ev
+__ZN3WTF11StackBounds10initializeEv
+__ZN3WTF17AtomicStringTable6createERNS_13WTFThreadDataE
+__ZN3WTF15initializeDatesEv
+__ZN3WTF20equivalentYearForDSTEi
+__ZN3WTF11currentTimeEv
+__ZN3JSC12GlobalJSLock10initializeEv
+__ZN3WTF5MutexC1Ev
+__ZN3JSC7Options10initializeEv
+__ZN3WTF22numberOfProcessorCoresEv
+__ZN3JSC19ExecutableAllocator19initializeAllocatorEv
+__ZN3JSC30FixedVMPoolExecutableAllocatorC2Ev
+__ZN3WTF8pageSizeEv
+__ZN3WTF13MetaAllocatorC2Emm
+__ZN3WTF11OSAllocator18reserveUncommittedEmNS0_5UsageEbbb
+__ZN3WTF11OSAllocator16reserveAndCommitEmNS0_5UsageEbbb
+__ZN3WTF13MetaAllocator17addFreshFreeSpaceEPvm
+__ZN3WTF13MetaAllocator12addFreeSpaceEPvm
+__ZN3WTF7HashMapIPvPNS_13MetaAllocator13FreeSpaceNodeENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE4findERKS1_
+__ZN3WTF12RedBlackTreeINS_13MetaAllocator13FreeSpaceNodeEmE6insertEPS2_
+__ZN3WTF9HashTableIPvNS_12KeyValuePairIS1_PNS_13MetaAllocator13FreeSpaceNodeEEENS_24KeyValuePairKeyExtractorIS6_EENS_7PtrHashIS1_EENS_18HashMapValueTraitsINS_10HashTraitsIS1_EENSC_IS5_EEEESD_E16lookupForWritingINS_22IdentityHashTranslatorISA_EES1_EENSt3__14pairIPS6_bEERKT0_
+__ZN3WTF9HashTableIPvNS_12KeyValuePairIS1_PNS_13MetaAllocator13FreeSpaceNodeEEENS_24KeyValuePairKeyExtractorIS6_EENS_7PtrHashIS1_EENS_18HashMapValueTraitsINS_10HashTraitsIS1_EENSC_IS5_EEEESD_E3addINS_17HashMapTranslatorISF_SA_EES1_S5_EENS_18HashTableAddResultINS_17HashTableIteratorIS1_S6_S8_SA_SF_SD_EEEERKT0_RKT1_
+__ZN3WTF8fastFreeEPv
+__ZN3JSC13CodeProfiling15notifyAllocatorEPN3WTF13MetaAllocatorE
+__ZN3JSC7JSStack19initializeThreadingEv
+__ZN3JSC5LLInt10initializeEv
+__ZN3WTF39initializeMainThreadToProcessMainThreadEv
+__ZN3WTFL43initializeMainThreadToProcessMainThreadOnceEv
+__ZN3WTF47initializeMainThreadToProcessMainThreadPlatformEv
+__ZN3WTF19initializeGCThreadsEv
+__ZN3WTF18FunctionDispatcherC2Ev
+__ZN3WTF20initializeMainThreadEv
+__ZN3WTF10StringImpl6createEPKhj
+__ZN3WTF13tryFastMallocEm
+__ZN3WTF10StringImpl7destroyEPS0_
+__ZN3WTF10StringImplD2Ev
+__ZN3WTF20TCMalloc_ThreadCache10DeallocateENS_11HardenedSLLEm
+__ZN3WTF6String6numberEy
+__ZN3WTF5Mutex4lockEv
+__ZN3WTF5Mutex6unlockEv
+__ZN3WTF18fastMallocGoodSizeEm
+__ZNKR3WTF6String12isolatedCopyEv
+__ZNK3WTF10StringImpl12isolatedCopyEv
+__ZN3WTF15ThreadConditionC1Ev
+__ZN3WTF6StringC1EPKc
+__ZN3WTF10StringImpl6createEPKh
+__ZN3WTF12isMainThreadEv
+__ZN3WTF7CStringC1EPKcm
+__ZNK3WTF10StringImpl8endsWithEt
+__ZN3WTF7CString11mutableDataEv
+__ZN3WTF7CString18copyBufferIfNeededEv
+__ZN3WTF10StringImpl11reverseFindEtj
+__ZNK3WTF6String9substringEjj
+__ZN3WTF10StringImpl9substringEjj
+__ZN3WTF12createThreadEPFvPvES0_PKc
+__ZN3WTF20createThreadInternalEPFvPvES0_PKc
+__ZN3WTFL35establishIdentifierForPthreadHandleERKP17_opaque_pthread_t
+__ZN3WTF9HashTableIjNS_12KeyValuePairIjNS_6OwnPtrINS_12PthreadStateEEEEENS_24KeyValuePairKeyExtractorIS5_EENS_7IntHashIjEENS_18HashMapValueTraitsINS_10HashTraitsIjEENSB_IS4_EEEESC_E3addINS_17HashMapTranslatorISE_S9_EEjNS_10PassOwnPtrIS3_EEEENS_18HashTableAddResultINS_17HashTableIteratorIjS5_S7_S9_SE_SC_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIjNS_12KeyValuePairIjNS_6OwnPtrINS_12PthreadStateEEEEENS_24KeyValuePairKeyExtractorIS5_EENS_7IntHashIjEENS_18HashMapValueTraitsINS_10HashTraitsIjEENSB_IS4_EEEESC_E6rehashEi
+__ZN3WTF9HashTableIjNS_12KeyValuePairIjNS_6OwnPtrINS_12PthreadStateEEEEENS_24KeyValuePairKeyExtractorIS5_EENS_7IntHashIjEENS_18HashMapValueTraitsINS_10HashTraitsIjEENSB_IS4_EEEESC_E8reinsertERS5_
+__ZN3WTFL19wtfThreadEntryPointEPv
+__ZN3WTFL16threadEntryPointEPv
+__ZN3WTF31initializeCurrentThreadInternalEPKc
+__ZN3WTF20ThreadIdentifierData10initializeEj
+__ZN3WTF5MutexD1Ev
+__ZN3WTF6String29charactersWithNullTerminationEv
+__ZN3WTF10StringImpl34createWithTerminatingNullCharacterERKS0_
+__ZNK3WTF10StringImpl17getData16SlowCaseEv
+__ZN3WTF15AutodrainedPoolC1Ev
+__ZN3WTF15AutodrainedPoolD1Ev
+__ZN3WTF6StringC1ENS_12ASCIILiteralE
+__ZN3WTF10StringImpl17createFromLiteralEPKc
+__ZN3WTF12equalNonNullEPKNS_10StringImplES2_
+__ZN3WTFL22stringImplContentEqualEPKNS_10StringImplES2_
+__ZN3WTF13currentThreadEv
+__ZN3WTF20ThreadIdentifierData10identifierEv
+__ZNK3WTF6String15stripWhiteSpaceEv
+__ZN3WTF10StringImpl15stripWhiteSpaceEv
+__ZN3WTF10StringImpl22stripMatchedCharactersINS_23SpaceOrNewlinePredicateEEENS_10PassRefPtrIS0_EET_
+__ZN3WTF6StringC1EPKtj
+__ZN3WTF10StringImpl6createEPKtj
+__ZNK3WTF6String4utf8ENS0_14ConversionModeE
+__ZN3WTF7Unicode19convertLatin1ToUTF8EPPKhS2_PPcS4_
+__ZNK3WTF10StringImpl8endsWithEPKcjb
+__ZN3WTF5equalEPKNS_10StringImplES2_
+__ZN3WTF16callOnMainThreadEPFvPvES0_
+__ZN3WTF5DequeINS_19FunctionWithContextELm0EE14expandCapacityEv
+__ZN3WTF37scheduleDispatchFunctionsOnMainThreadEv
+__ZN3WTF15ThreadCondition4waitERNS_5MutexE
+__ZNK3WTF6String6toUIntEPb
+__ZN3WTF10StringImpl6toUIntEPb
+__ZN3WTF16charactersToUIntEPKhmPb
+__ZN3WTFL14toIntegralTypeIjhEET_PKT0_mPbi
+__ZN3WTF7CStringC1EPKc
+__ZN3WTF6String8fromUTF8EPKh
+__ZN3WTF6String8fromUTF8EPKhm
+__ZN3WTF15ThreadCondition6signalEv
+__ZN3WTF12AtomicString3addEPKh
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E6rehashEi
+__ZN3WTF12AtomicString3addEPKtj
+__ZN3WTFL16addToStringTableINS_24HashTranslatorCharBufferItEENS_21UCharBufferTranslatorEEENS_10PassRefPtrINS_10StringImplEEERKT_
+__ZN3WTF21UCharBufferTranslator4hashERKNS_24HashTranslatorCharBufferItEE
+__ZN3WTF5equalEPKNS_10StringImplEPKtj
+__ZN3WTF10StringImpl20create8BitIfPossibleEPKtj
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E4findERKS2_
+__ZN3WTF12AtomicString4initEv
+__ZN3WTF12AtomicString18addFromLiteralDataEPKcj
+__ZN3WTF35CharBufferFromLiteralDataTranslator4hashERKNS_24HashTranslatorCharBufferIcEE
+__ZN3WTF10StringImpl17createFromLiteralEPKcj
+__ZN3WTF5equalEPKNS_10StringImplEPKhj
+__ZN3WTF5equalEPKNS_10StringImplEPKh
+__ZN3WTF36lockAtomicallyInitializedStaticMutexEv
+__ZN3WTF38unlockAtomicallyInitializedStaticMutexEv
+__ZN3WTF12AtomicString11addSlowCaseEPNS_10StringImplE
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E3addINS_22IdentityHashTranslatorIS4_EES2_S2_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF11emptyStringEv
+__ZN3WTF27monotonicallyIncreasingTimeEv
+__ZN3WTF29cryptographicallyRandomValuesEPvm
+__ZN3WTF12_GLOBAL__N_125ARC4RandomNumberGenerator12stirIfNeededEv
+__ZN3WTF35cryptographicallyRandomValuesFromOSEPhm
+__ZNK3WTF6String5lowerEv
+__ZNK3WTF12AtomicString5lowerEv
+__ZN3WTF10StringImpl5lowerEv
+__ZN3WTF17equalIgnoringCaseEPKNS_10StringImplEPKh
+__ZN3WTF6StringC1EPKhj
+__ZN3WTF6StringC1EPKcj
+__ZN3WTF12AtomicString3addEPKhj
+__ZN3WTF21LCharBufferTranslator4hashERKNS_24HashTranslatorCharBufferIhEE
+__ZN3WTF18charactersToDoubleEPKhmPb
+__ZN3WTF17double_conversion23StringToDoubleConverter14StringToDoubleEPKcmPm
+__ZN3WTF17double_conversion6StrtodENS0_15BufferReferenceIKcEEi
+__ZN3WTF11fastReallocEPvm
+__ZN3WTF12SchedulePairC1EP9NSRunLoopPK10__CFString
+__ZN3WTF12SchedulePairC2EP9NSRunLoopPK10__CFString
+__ZN3WTF12AtomicString6removeEPNS_10StringImplE
+__ZN3WTF7HashSetIPNS_10StringImplENS_10StringHashENS_10HashTraitsIS2_EEE6removeERKS2_
+__ZN3WTF7CString16newUninitializedEmRPc
+__ZN3WTF24equalIgnoringCaseNonNullEPKNS_10StringImplES2_
+__ZN3WTF10StringImpl5adoptERNS_12StringBufferItEE
+__ZN3WTF6String6appendERKS0_
+__ZN3WTF18charactersToDoubleEPKtmPb
+__ZN3WTF17equalIgnoringCaseEPKNS_10StringImplES2_
+__ZNK3WTF10StringImpl10startsWithEPKS0_
+__ZN3JSC2VM12createLeakedENS_8HeapTypeE
+__ZN3JSC2VMC2ENS0_6VMTypeENS_8HeapTypeE
+__ZN3JSC6JSLockC1EPNS_2VME
+__ZN3JSC19ExecutableAllocatorC1ERNS_2VME
+__ZN3JSC4HeapC1EPNS_2VMENS_8HeapTypeE
+__ZN3JSC4HeapC2EPNS_2VMENS_8HeapTypeE
+__ZN3WTF7ramSizeEv
+__ZN3JSC11SuperRegionC1Ev
+__ZN3JSC11MarkedSpaceC1EPNS_4HeapE
+__ZN3JSC11MarkedSpaceC2EPNS_4HeapE
+__ZN3JSC11CopiedSpaceC1EPNS_4HeapE
+__ZN3JSC14MachineThreadsC1EPNS_4HeapE
+__ZN3JSC18GCThreadSharedDataC1EPNS_2VME
+__ZN3JSC18GCThreadSharedDataC2EPNS_2VME
+__ZN3WTF15ThreadCondition9timedWaitERNS_5MutexEd
+__ZN3WTF21PageAllocationAligned8allocateEmmNS_11OSAllocator5UsageEb
+__ZN3JSC11SlotVisitorC1ERNS_18GCThreadSharedDataE
+__ZN3JSC11CopyVisitorC1ERNS_18GCThreadSharedDataE
+__ZN3JSC8GCThreadC1ERNS_18GCThreadSharedDataEPNS_11SlotVisitorEPNS_11CopyVisitorE
+__ZN3JSC8GCThread18initializeThreadIDEj
+__ZN3WTF6VectorIPN3JSC8GCThreadELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC8GCThread17gcThreadStartFuncEPv
+__ZN3JSC8GCThread12gcThreadMainEv
+__ZN3WTF16registerGCThreadEv
+__ZN3JSC8GCThread16waitForNextPhaseEv
+__ZN3JSC9HandleSetC1EPNS_2VME
+__ZN3JSC11HandleStackC1Ev
+__ZN3WTF10BlockStackIN3JSC7JSValueEE4growEv
+__ZN3WTF6VectorIPN3JSC7JSValueELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC13DFGCodeBlocksC1Ev
+__ZN3JSC17JITStubRoutineSetC1Ev
+__ZN3JSC25DefaultGCActivityCallbackC1EPNS_4HeapE
+__ZN3JSC9HeapTimerC2EPNS_2VMEP11__CFRunLoop
+__ZN3JSCL13retainAPILockEPKv
+__ZN3JSC18IncrementalSweeper6createEPNS_4HeapE
+__ZN3JSC11CopiedSpace4initEv
+__ZN3JSC11CopiedSpace13allocateBlockEv
+__ZN3WTF9HashTableIPN3JSC11CopiedBlockES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3JSC8WatchdogC1Ev
+__ZN3JSC8Watchdog9initTimerEv
+__ZN3WTF13wtfThreadDataEv
+__ZN3JSC17CommonIdentifiersC1EPNS_2VME
+__ZN3JSC17CommonIdentifiersC2EPNS_2VME
+__ZN3JSC10Identifier3addEPNS_2VMEPKc
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E6expandEv
+__ZN3JSC12SmallStringsC1Ev
+__ZN3JSC11ParserArenaC1Ev
+__ZN3JSC8KeywordsC1EPNS_2VME
+__ZN3JSC11RegExpCacheC1EPNS_2VME
+__ZNK3JSC19ExecutableAllocator7isValidEv
+__ZN3JSC9CodeCacheC1ENS0_13CodeCacheKindE
+__ZN3JSC11InterpreterC1ERNS_2VME
+__ZN3JSC7JSStackC1ERNS_2VMEm
+__ZN3JSC12JSLockHolderC1EPNS_2VME
+__ZN3JSC6JSLock4lockEv
+__ZN3JSC15MarkedAllocator16allocateSlowCaseEm
+__ZN3JSC4Heap11didAllocateEm
+__ZN3JSC25DefaultGCActivityCallback11didAllocateEm
+__ZN3JSC15MarkedAllocator13allocateBlockEm
+__ZN3JSC11MarkedBlock6createEPNS_9DeadBlockEPNS_15MarkedAllocatorEmNS0_14DestructorTypeE
+__ZN3JSC11MarkedBlock5sweepENS0_9SweepModeE
+__ZN3JSC7WeakSet5sweepEv
+__ZN3JSC11MarkedBlock11sweepHelperILNS0_14DestructorTypeE1EEENS0_8FreeListENS0_9SweepModeE
+__ZN3WTF9HashTableIPN3JSC11MarkedBlockES3_NS_17IdentityExtractorENS_15MarkedBlockHashENS_10HashTraitsIS3_EES7_E3addINS_22IdentityHashTranslatorIS5_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S5_S7_S7_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPN3JSC11MarkedBlockES3_NS_17IdentityExtractorENS_15MarkedBlockHashENS_10HashTraitsIS3_EES7_E6rehashEi
+__ZN3JSC9StructureC1ERNS_2VME
+__ZN3JSC9HandleSet12writeBarrierEPNS_7JSValueERKS1_
+__ZN3JSC17StructureRareData15createStructureERNS_2VMEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3JSC9StructureC1ERNS_2VMEPNS_14JSGlobalObjectENS_7JSValueERKNS_8TypeInfoEPKNS_9ClassInfoEhj
+__ZN3JSC19SparseArrayValueMap15createStructureERNS_2VMEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3JSC12SmallStrings23initializeCommonStringsERNS_2VME
+__ZN3JSC8JSString6createERNS_2VMEN3WTF10PassRefPtrINS3_10StringImplEEE
+__ZN3JSC9JITThunksC1Ev
+__ZN3JSC36performPlatformSpecificJITAssertionsEPNS_2VME
+__ZN3JSC11Interpreter10initializeEb
+__ZN3WTF9HashTableIPvNS_12KeyValuePairIS1_N3JSC8OpcodeIDEEENS_24KeyValuePairKeyExtractorIS5_EENS_7PtrHashIS1_EENS_18HashMapValueTraitsINS_10HashTraitsIS1_EENSB_IS4_EEEESC_E16lookupForWritingINS_22IdentityHashTranslatorIS9_EES1_EENSt3__14pairIPS5_bEERKT0_
+__ZN3WTF9HashTableIPvNS_12KeyValuePairIS1_N3JSC8OpcodeIDEEENS_24KeyValuePairKeyExtractorIS5_EENS_7PtrHashIS1_EENS_18HashMapValueTraitsINS_10HashTraitsIS1_EENSB_IS4_EEEESC_E3addINS_17HashMapTranslatorISE_S9_EES1_S4_EENS_18HashTableAddResultINS_17HashTableIteratorIS1_S5_S7_S9_SE_SC_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPvNS_12KeyValuePairIS1_N3JSC8OpcodeIDEEENS_24KeyValuePairKeyExtractorIS5_EENS_7PtrHashIS1_EENS_18HashMapValueTraitsINS_10HashTraitsIS1_EENSB_IS4_EEEESC_E6rehashEi
+_getHostCallReturnValueWithExecState
+__ZN3JSC5LLInt4Data17performAssertionsERNS_2VME
+__ZN3JSC3DFG14LongLivedStateC1Ev
+__ZN3JSC12JSLockHolderD1Ev
+__ZN3JSC12JSLockHolderD2Ev
+__ZN3JSC11MarkedBlock11sweepHelperILNS0_14DestructorTypeE2EEENS0_8FreeListENS0_9SweepModeE
+__ZN3JSC11MarkedBlock11sweepHelperILNS0_14DestructorTypeE0EEENS0_8FreeListENS0_9SweepModeE
+__ZN3JSC14JSGlobalObjectC2ERNS_2VMEPNS_9StructureEPKNS_23GlobalObjectMethodTableE
+__ZN3JSC13WatchpointSetC1ENS_24InitialWatchpointSetModeE
+__ZN3WTF12randomNumberEv
+__ZN3WTF29cryptographicallyRandomNumberEv
+__ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE
+__ZN3JSC14JSGlobalObject5resetENS_7JSValueE
+__ZN3JSC17FunctionPrototypeC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC16InternalFunctionC2EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC17FunctionPrototype14finishCreationEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC16InternalFunction14finishCreationERNS_2VMERKN3WTF6StringE
+__ZN3JSC21getCallableObjectSlowEPNS_6JSCellE
+__ZN3JSC8JSObject17putDirectInternalILNS0_7PutModeE1EEEbRNS_2VMENS_12PropertyNameENS_7JSValueEjRNS_15PutPropertySlotEPNS_6JSCellE
+__ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_NS_12PropertyNameEjPNS_6JSCellERi
+__ZNK3JSC24StructureTransitionTable3getEPN3WTF10StringImplEj
+__ZN3JSC9Structure3getERNS_2VMENS_12PropertyNameERjRPNS_6JSCellE
+__ZN3JSC9Structure21addPropertyTransitionERNS_2VMEPS0_NS_12PropertyNameEjPNS_6JSCellERi
+__ZN3JSC9StructureC2ERNS_2VMEPKS0_
+__ZN3JSC9Structure43materializePropertyMapIfNecessaryForPinningERNS_2VME
+__ZN3JSC9Structure22materializePropertyMapERNS_2VME
+__ZN3JSC9Structure17createPropertyMapERNS_2VMEj
+__ZN3JSC13PropertyTable6createERNS_2VMEj
+__ZN3JSC9Structure16putSpecificValueERNS_2VMENS_12PropertyNameEjPNS_6JSCellE
+__ZN3JSC13PropertyTable3addERKNS_16PropertyMapEntryERiNS0_22EffectOnPropertyOffsetE
+__ZN3JSC24StructureTransitionTable3addERNS_2VMEPNS_9StructureE
+__ZN3JSC7WeakSet13findAllocatorEv
+__ZN3JSC9WeakBlock6createEPNS_9DeadBlockE
+__ZN3JSC8JSObject43setStructureAndReallocateStorageIfNecessaryERNS_2VMEPNS_9StructureE
+__ZN3JSC8JSObject20growOutOfLineStorageERNS_2VMEmm
+__ZN3JSC9Butterfly19growPropertyStorageERNS_2VMEPNS_9StructureEmm
+__ZN3JSC8JSObject26putDirectWithoutTransitionERNS_2VMENS_12PropertyNameENS_7JSValueEj
+__ZN3JSC9Structure27putWillGrowOutOfLineStorageEv
+__ZN3JSC9Structure28addPropertyWithoutTransitionERNS_2VMENS_12PropertyNameEjPNS_6JSCellE
+__ZN3JSC17FunctionPrototype21addFunctionPropertiesEPNS_9ExecStateEPNS_14JSGlobalObjectEPPNS_10JSFunctionES7_
+__ZN3JSC10JSFunction6createEPNS_9ExecStateEPNS_14JSGlobalObjectEiRKN3WTF6StringEPFxS2_ENS_9IntrinsicESA_
+__ZN3JSC2VM15getHostFunctionEPFxPNS_9ExecStateEES4_
+__ZN3JSC9JITThunks16hostFunctionStubEPNS_2VMEPFxPNS_9ExecStateEES6_
+__ZN3JSC3JITC1EPNS_2VMEPNS_9CodeBlockE
+__ZN3JSC3JITC2EPNS_2VMEPNS_9CodeBlockE
+__ZN3JSC3JIT27privateCompileCTINativeCallEPNS_2VMEPFxPNS_9ExecStateEE
+__ZN3JSC9JITThunks7ctiStubEPNS_2VMEPFNS_21MacroAssemblerCodeRefES2_E
+__ZN3WTF9HashTableIPFN3JSC21MacroAssemblerCodeRefEPNS1_2VMEENS_12KeyValuePairIS6_S2_EENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS6_EENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSE_IS2_EEEESF_E16lookupForWritingINS_22IdentityHashTranslatorISC_EES6_EENSt3__14pairIPS8_bEERKT0_
+__ZN3WTF9HashTableIPFN3JSC21MacroAssemblerCodeRefEPNS1_2VMEENS_12KeyValuePairIS6_S2_EENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS6_EENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSE_IS2_EEEESF_E3addINS_17HashMapTranslatorISH_SC_EES6_S2_EENS_18HashTableAddResultINS_17HashTableIteratorIS6_S8_SA_SC_SH_SF_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPFN3JSC21MacroAssemblerCodeRefEPNS1_2VMEENS_12KeyValuePairIS6_S2_EENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS6_EENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSE_IS2_EEEESF_E6rehashEi
+__ZN3JSC19nativeCallGeneratorEPNS_2VME
+__ZN3JSCL18nativeForGeneratorEPNS_2VMENS_22CodeSpecializationKindE
+__ZN3JSC20MacroAssemblerX86_647store64ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm64ENS3_15ImplicitAddressE
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDEi
+__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_12X86Registers10RegisterIDEi
+__ZN3JSC14MacroAssembler8storePtrENS_12X86Registers10RegisterIDEPv
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDEi
+__ZN3JSC20MacroAssemblerX86_6412branchTest64ENS_23MacroAssemblerX86Common15ResultConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32E
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDE
+__ZN3JSC12X86Assembler3jCCENS0_9ConditionE
+__ZN3WTF6VectorIcLm128ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC10LinkBuffer8linkCodeEPvNS_20JITCompilationEffortE
+__ZN3JSC19ExecutableAllocator8allocateERNS_2VMEmPvNS_20JITCompilationEffortE
+__ZN3WTF13MetaAllocator8allocateEmPv
+__ZN3WTF13MetaAllocator22findAndRemoveFreeSpaceEm
+__ZN3WTF12RedBlackTreeINS_13MetaAllocator13FreeSpaceNodeEmE6removeEPS2_
+__ZN3WTF12RedBlackTreeINS_13MetaAllocator13FreeSpaceNodeEmE11removeFixupEPS2_S4_
+__ZN3WTF7HashMapIPvPNS_13MetaAllocator13FreeSpaceNodeENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE6removeENS_24HashTableIteratorAdapterINS_9HashTableIS1_NS_12KeyValuePairIS1_S4_EENS_24KeyValuePairKeyExtractorISE_EES6_NS_18HashMapValueTraitsIS8_S9_EES8_EESE_EE
+__ZN3WTF13MetaAllocator22incrementPageOccupancyEPvm
+__ZN3WTF7HashMapImmNS_7IntHashImEENS_10HashTraitsImEES4_E4findERKm
+__ZN3JSC30FixedVMPoolExecutableAllocator14notifyNeedPageEPv
+__ZN3WTF11OSAllocator6commitEPvmbb
+__ZN3JSC10LinkBuffer30finalizeCodeWithoutDisassemblyEv
+__ZN3JSC3JITD2Ev
+__ZN3JSC24nativeConstructGeneratorEPNS_2VME
+__ZN3JSC16NativeExecutable6createERNS_2VMENS_21MacroAssemblerCodeRefEPFxPNS_9ExecStateEES3_S7_NS_9IntrinsicE
+__ZN3JSC16NativeExecutable14finishCreationERNS_2VMENS_7JITCodeES3_NS_9IntrinsicE
+__ZN3WTF9HashTableINSt3__14pairIPFxPN3JSC9ExecStateEES7_EENS_12KeyValuePairIS8_NS3_4WeakINS3_16NativeExecutableEEEEENS_24KeyValuePairKeyExtractorISD_EENS_8PairHashIS7_S7_EENS_18HashMapValueTraitsINS_10HashTraitsIS8_EENSJ_ISC_EEEESK_E16lookupForWritingINS_22IdentityHashTranslatorISH_EES8_EENS2_IPSD_bEERKT0_
+__ZN3WTF9HashTableINSt3__14pairIPFxPN3JSC9ExecStateEES7_EENS_12KeyValuePairIS8_NS3_4WeakINS3_16NativeExecutableEEEEENS_24KeyValuePairKeyExtractorISD_EENS_8PairHashIS7_S7_EENS_18HashMapValueTraitsINS_10HashTraitsIS8_EENSJ_ISC_EEEESK_E3addINS_17HashMapTranslatorISM_SH_EES8_NS3_8PassWeakISB_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS8_SD_SF_SH_SM_SK_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINSt3__14pairIPFxPN3JSC9ExecStateEES7_EENS_12KeyValuePairIS8_NS3_4WeakINS3_16NativeExecutableEEEEENS_24KeyValuePairKeyExtractorISD_EENS_8PairHashIS7_S7_EENS_18HashMapValueTraitsINS_10HashTraitsIS8_EENSJ_ISC_EEEESK_E6lookupINS_22IdentityHashTranslatorISH_EES8_EEPSD_RKT0_
+__ZN3WTF9HashTableINSt3__14pairIPFxPN3JSC9ExecStateEES7_EENS_12KeyValuePairIS8_NS3_4WeakINS3_16NativeExecutableEEEEENS_24KeyValuePairKeyExtractorISD_EENS_8PairHashIS7_S7_EENS_18HashMapValueTraitsINS_10HashTraitsIS8_EENSJ_ISC_EEEESK_E6rehashEi
+__ZN3JSC10JSFunction14finishCreationEPNS_9ExecStateEPNS_16NativeExecutableEiRKN3WTF6StringE
+__ZN3JSC8jsStringEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC9Structure36suggestedNewOutOfLineStorageCapacityEv
+__ZN3JSC13PropertyTable6rehashEj
+__ZN3JSC15ObjectPrototype6createEPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC15ObjectPrototype14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSC12PrototypeMap12addPrototypeEPNS_8JSObjectE
+__ZN3JSC9WeakGCMapIPNS_8JSObjectES1_N3WTF7PtrHashIS2_EENS3_10HashTraitsIS2_EEE3addERKS2_NS_8PassWeakIS1_EE
+__ZN3WTF9HashTableIPN3JSC8JSObjectENS_12KeyValuePairIS3_NS1_4WeakIS2_EEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E16lookupForWritingINS_22IdentityHashTranslatorISB_EES3_EENSt3__14pairIPS7_bEERKT0_
+__ZN3WTF9HashTableIPN3JSC8JSObjectENS_12KeyValuePairIS3_NS1_4WeakIS2_EEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EES3_NS1_8PassWeakIS2_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPN3JSC8JSObjectENS_12KeyValuePairIS3_NS1_4WeakIS2_EEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E6rehashEi
+__ZN3JSC8JSObject23putDirectNativeFunctionEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_12PropertyNameEjPFxS2_ENS_9IntrinsicEj
+__ZNK3JSC24StructureTransitionTable8containsEPN3WTF10StringImplEj
+__ZN3JSC8JSObject17putDirectAccessorEPNS_9ExecStateENS_12PropertyNameENS_7JSValueEj
+__ZN3JSC12PropertyName7asIndexEv
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE15createStructureERNS_2VMEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3JSC16JSCallbackObjectINS_18JSAPIWrapperObjectEE15createStructureERNS_2VMEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3JSC14ArrayPrototype6createEPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC15StringPrototype6createEPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC12StringObjectC2ERNS_2VMEPNS_9StructureE
+__ZN3JSC15StringPrototype14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_8JSStringE
+__ZN3JSC12StringObject14finishCreationERNS_2VMEPNS_8JSStringE
+__ZN3JSC2VM15getHostFunctionEPFxPNS_9ExecStateEENS_9IntrinsicE
+__ZN3JSC9JITThunks16hostFunctionStubEPNS_2VMEPFxPNS_9ExecStateEEPFNS_21MacroAssemblerCodeRefES2_ENS_9IntrinsicE
+__ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPN3WTF10StringImplE
+__ZN3JSC15IdentifierTable3addEPN3WTF10StringImplE
+__ZN3JSC20charAtThunkGeneratorEPNS_2VME
+__ZN3JSC19SpecializedThunkJITC2Ei
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6appendENS2_4JumpE
+__ZN3JSCL14stringCharLoadERNS_19SpecializedThunkJITEPNS_2VME
+__ZN3JSC14JSInterfaceJIT14emitLoadJSCellEjNS_12X86Registers10RegisterIDE
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm2ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC14JSInterfaceJIT13emitLoadInt32EjNS_12X86Registers10RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_12X86Registers10RegisterIDES4_ii
+__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_12X86Registers10RegisterIDES3_ii
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList4linkEPS2_
+__ZNK3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE4Jump4linkEPS2_
+__ZN3JSCL12charToStringERNS_19SpecializedThunkJITEPNS_2VMENS_12X86Registers10RegisterIDES5_S5_
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDES4_ii
+__ZN3JSC9JITThunks13ctiNativeCallEPNS_2VME
+__ZN3JSC19SpecializedThunkJIT8finalizeERNS_2VMENS_21MacroAssemblerCodePtrEPKc
+__ZN3JSC24charCodeAtThunkGeneratorEPNS_2VME
+__ZN3JSC19SpecializedThunkJIT11returnInt32ENS_12X86Registers10RegisterIDE
+__ZN3JSC19SpecializedThunkJIT16tagReturnAsInt32Ev
+__ZN3JSC16BooleanPrototypeC1EPNS_9ExecStateEPNS_9StructureE
+__ZN3JSC13BooleanObjectC2ERNS_2VMEPNS_9StructureE
+__ZN3JSC16BooleanPrototype14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSC13BooleanObject14finishCreationERNS_2VME
+__ZN3JSC15NumberPrototypeC1EPNS_9ExecStateEPNS_9StructureE
+__ZN3JSC12NumberObjectC2ERNS_2VMEPNS_9StructureE
+__ZN3JSC15NumberPrototype14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSC12NumberObject14finishCreationERNS_2VME
+__ZN3JSC13DatePrototypeC1EPNS_9ExecStateEPNS_9StructureE
+__ZN3JSC12DateInstanceC2EPNS_9ExecStateEPNS_9StructureE
+__ZN3JSC13DatePrototype14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSC12DateInstance14finishCreationERNS_2VME
+__ZN3JSC6RegExp6createERNS_2VMERKN3WTF6StringENS_11RegExpFlagsE
+__ZN3JSC11RegExpCache14lookupOrCreateERKN3WTF6StringENS_11RegExpFlagsE
+__ZN3JSC6RegExp20createWithoutCachingERNS_2VMERKN3WTF6StringENS_11RegExpFlagsE
+__ZN3JSC4Yarr11YarrPatternC1ERKN3WTF6StringEbbPPKc
+__ZN3JSC4Yarr11YarrPattern7compileERKN3WTF6StringE
+__ZN3JSC4Yarr22YarrPatternConstructorC2ERNS0_11YarrPatternE
+__ZN3WTF10PassOwnPtrIN3JSC4Yarr18PatternDisjunctionEED2Ev
+__ZN3JSC4Yarr18PatternDisjunction17addNewAlternativeEv
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC4Yarr18PatternAlternativeEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF6OwnPtrIN3JSC4Yarr18PatternDisjunctionEED2Ev
+__ZN3JSC4Yarr5parseINS0_22YarrPatternConstructorEEEPKcRT_RKN3WTF6StringEj
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEhE11parseTokensEv
+__ZN3JSC4Yarr22YarrPatternConstructor33optimizeDotStarWrappedExpressionsEv
+__ZN3JSC4Yarr22YarrPatternConstructor11optimizeBOLEv
+__ZN3JSC4Yarr22YarrPatternConstructor23setupAlternativeOffsetsEPNS0_18PatternAlternativeEjj
+__ZN3JSC4Yarr11YarrPatternD2Ev
+__ZN3WTF9HashTableIN3JSC9RegExpKeyENS_12KeyValuePairIS2_NS1_4WeakINS1_6RegExpEEEEENS_24KeyValuePairKeyExtractorIS7_EENS2_4HashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E16lookupForWritingINS_22IdentityHashTranslatorISA_EES2_EENSt3__14pairIPS7_bEERKT0_
+__ZN3WTF9HashTableIN3JSC9RegExpKeyENS_12KeyValuePairIS2_NS1_4WeakINS1_6RegExpEEEEENS_24KeyValuePairKeyExtractorIS7_EENS2_4HashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E3addINS_17HashMapTranslatorISF_SA_EES2_NS1_8PassWeakIS5_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIN3JSC9RegExpKeyENS_12KeyValuePairIS2_NS1_4WeakINS1_6RegExpEEEEENS_24KeyValuePairKeyExtractorIS7_EENS2_4HashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6lookupINS_22IdentityHashTranslatorISA_EES2_EEPS7_RKT0_
+__ZN3WTF9HashTableIN3JSC9RegExpKeyENS_12KeyValuePairIS2_NS1_4WeakINS1_6RegExpEEEEENS_24KeyValuePairKeyExtractorIS7_EENS2_4HashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6rehashEi
+__ZN3WTF9HashTableIN3JSC9RegExpKeyENS_12KeyValuePairIS2_NS1_4WeakINS1_6RegExpEEEEENS_24KeyValuePairKeyExtractorIS7_EENS2_4HashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E8reinsertERS7_
+__ZN3JSC15RegExpPrototypeC1EPNS_14JSGlobalObjectEPNS_9StructureEPNS_6RegExpE
+__ZN3JSC12RegExpObjectC2EPNS_14JSGlobalObjectEPNS_9StructureEPNS_6RegExpE
+__ZN3JSC12RegExpObject14finishCreationEPNS_14JSGlobalObjectE
+__ZN3JSC14ErrorPrototypeC1EPNS_9ExecStateEPNS_9StructureE
+__ZN3JSC13ErrorInstanceC2ERNS_2VMEPNS_9StructureE
+__ZN3JSC14ErrorPrototype14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSC17ObjectConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC17ObjectConstructor14finishCreationEPNS_9ExecStateEPNS_15ObjectPrototypeE
+__ZN3JSC10Identifier3addEPNS_9ExecStateEPKc
+__ZN3JSC19FunctionConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC19FunctionConstructor14finishCreationEPNS_9ExecStateEPNS_17FunctionPrototypeE
+__ZN3JSC16ArrayConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC16ArrayConstructor14finishCreationEPNS_9ExecStateEPNS_14ArrayPrototypeE
+__ZN3JSC17StringConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC17StringConstructor14finishCreationEPNS_9ExecStateEPNS_15StringPrototypeE
+__ZN3JSC18BooleanConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC18BooleanConstructor14finishCreationEPNS_9ExecStateEPNS_16BooleanPrototypeE
+__ZN3JSC17NumberConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC17NumberConstructor14finishCreationEPNS_9ExecStateEPNS_15NumberPrototypeE
+__ZN3JSC15DateConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC15DateConstructor14finishCreationEPNS_9ExecStateEPNS_13DatePrototypeE
+__ZN3JSC17RegExpConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureEPNS_15RegExpPrototypeE
+__ZN3JSC17RegExpConstructor14finishCreationEPNS_9ExecStateEPNS_15RegExpPrototypeE
+__ZN3JSC16ErrorConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC16ErrorConstructor14finishCreationEPNS_9ExecStateEPNS_14ErrorPrototypeE
+__ZN3JSC22NativeErrorConstructorC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC22NativeErrorConstructor14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureERKN3WTF6StringE
+__ZN3JSC20NativeErrorPrototypeC1EPNS_9ExecStateEPNS_9StructureE
+__ZN3JSC14ErrorPrototypeC2EPNS_9ExecStateEPNS_9StructureE
+__ZN3JSC20NativeErrorPrototype14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectERKN3WTF6StringEPNS_22NativeErrorConstructorE
+__ZN3WTF9HashTableINSt3__14pairINS_6RefPtrINS_10StringImplEEEjEENS_12KeyValuePairIS6_N3JSC4WeakINS8_9StructureEEEEENS_24KeyValuePairKeyExtractorISC_EENS8_24StructureTransitionTable4HashENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSI_ISB_EEEESJ_E3addINS_17HashMapTranslatorISL_SG_EES6_NS8_8PassWeakISA_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS6_SC_SE_SG_SL_SJ_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINSt3__14pairINS_6RefPtrINS_10StringImplEEEjEENS_12KeyValuePairIS6_N3JSC4WeakINS8_9StructureEEEEENS_24KeyValuePairKeyExtractorISC_EENS8_24StructureTransitionTable4HashENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSI_ISB_EEEESJ_E6rehashEi
+__ZN3WTF9HashTableINSt3__14pairINS_6RefPtrINS_10StringImplEEEjEENS_12KeyValuePairIS6_N3JSC4WeakINS8_9StructureEEEEENS_24KeyValuePairKeyExtractorISC_EENS8_24StructureTransitionTable4HashENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSI_ISB_EEEESJ_E8reinsertERSC_
+__ZN3JSC17weakClearSlowCaseERPNS_8WeakImplE
+__ZN3JSC10JSONObjectC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC10JSONObject14finishCreationEPNS_14JSGlobalObjectE
+__ZN3JSC10MathObjectC1EPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC10MathObject14finishCreationEPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSC12SmallStrings24singleCharacterStringRepEh
+__ZN3JSC19SmallStringsStorageC2Ev
+__ZN3WTF10StringImpl19createUninitializedEjRPh
+__ZN3JSC10Identifier3addEPNS_2VMEPN3WTF10StringImplE
+__ZN3JSC14JSGlobalObject16addStaticGlobalsEPNS0_18GlobalPropertyInfoEi
+__ZN3JSC25JSSegmentedVariableObject12addRegistersEi
+__ZN3WTF15SegmentedVectorIN3JSC12WriteBarrierINS1_7UnknownEEELm16ELm32EE13ensureSegmentEmm
+__ZN3WTF6VectorIPNS0_IN3JSC12WriteBarrierINS1_7UnknownEEELm16ENS_15CrashOnOverflowEEELm0ES5_E14expandCapacityEm
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC16SymbolTableEntryEEENS_24KeyValuePairKeyExtractorIS7_EENS5_17IdentifierRepHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENS5_26SymbolTableIndexHashTraitsEEESD_E3addINS_17HashMapTranslatorISF_SA_EEPS2_S6_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC16SymbolTableEntryEEENS_24KeyValuePairKeyExtractorIS7_EENS5_17IdentifierRepHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENS5_26SymbolTableIndexHashTraitsEEESD_E6rehashEi
+__ZN3JSC8JSObject12setPrototypeERNS_2VMENS_7JSValueE
+__ZN3JSC9Structure25changePrototypeTransitionERNS_2VMEPS0_NS_7JSValueE
+__ZN3JSC13PropertyTable5cloneERNS_2VMEPNS_6JSCellERKS0_
+__ZN3JSC13PropertyTableC2ERNS_2VMEPNS_6JSCellERKS0_
+__ZNK3JSC9Structure43anyObjectInChainMayInterceptIndexedAccessesEv
+__ZN3JSC9WeakGCMapIPNS_8JSObjectES1_N3WTF7PtrHashIS2_EENS3_10HashTraitsIS2_EEE5gcMapEv
+__ZN3WTF13hashTableSwapINS_6RefPtrINS_10StringImplEEEN3JSC16SymbolTableEntryEEEvRNS_12KeyValuePairIT_T0_EESA_
+__ZN3JSC4Heap12addFinalizerEPNS_6JSCellEPFvS2_E
+__ZN3JSC7JSProxy9setTargetERNS_2VMEPNS_14JSGlobalObjectE
+__ZN3JSC9WeakGCMapIPNS_8JSObjectES1_N3WTF7PtrHashIS2_EENS3_10HashTraitsIS2_EEE4findERKS2_
+__ZN3JSC4Heap26reportAbandonedObjectGraphEv
+__ZN3JSC14JSGlobalObject10globalExecEv
+__ZN3JSC4Heap7protectENS_7JSValueE
+__ZN3JSC12JSLockHolderC1EPNS_9ExecStateE
+__ZN3JSC7JSProxy18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC14JSGlobalObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC21getStaticFunctionSlotINS_25JSSegmentedVariableObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC9Structure3getERNS_2VMENS_12PropertyNameE
+__ZN3JSC8JSObject22getOwnPropertySlotSlowEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZNK3JSC9HashTable11createTableEPNS_2VME
+__ZN3JSC14symbolTableGetINS_14JSGlobalObjectEEEbPT_NS_12PropertyNameERNS_12PropertySlotE
+__ZN3WTF12AtomicString4findEPKNS_10StringImplE
+__ZN3JSC15IdentifierTable6removeEPN3WTF10StringImplE
+__ZN3WTF7HashSetIPNS_10StringImplENS_10StringHashENS_10HashTraitsIS2_EEE6removeENS_29HashTableConstIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtractorES3_S5_S5_EES2_EE
+__ZN3WTF16RunLoopTimerBase5startEdd
+__ZN3WTF16RunLoopTimerBase8scheduleERKNS_7HashSetINS_6RefPtrINS_12SchedulePairEEENS_16SchedulePairHashENS_10HashTraitsIS4_EEEE
+__ZN3WTF16RunLoopTimerBase4stopEv
+__ZN3WTF16RunLoopTimerBaseD2Ev
+__ZN3WTF20TCMalloc_ThreadCache21ReleaseToCentralCacheEmi
+__ZN3WTF25TCMalloc_Central_FreeList14MakeCacheSpaceEv
+__ZN3WTF13StringBuilder6appendEPKhj
+__ZN3WTF13StringBuilder23appendUninitializedSlowIhEEPT_j
+__ZN3WTF13StringBuilder11shrinkToFitEv
+__ZN3WTF13StringBuilder16reallocateBufferIhEEvj
+__ZN3WTF10StringImpl10reallocateENS_10PassRefPtrIS0_EEjRPh
+__ZN3WTF13StringBuilder15reserveCapacityEj
+__ZNK3WTF13StringBuilder11reifyStringEv
+__ZN3WTF6String6numberEi
+__ZN3WTF22charactersToUIntStrictEPKtmPbi
+__ZN3WTFL14toIntegralTypeIjtEET_PKT0_mPbi
+__ZN3JSC9HeapTimer12timerDidFireEP16__CFRunLoopTimerPv
+__ZN3JSC4Heap16activityCallbackEv
+__ZN3JSC4Heap7sweeperEv
+__ZN3JSC14MachineThreads16addCurrentThreadEv
+__ZN3JSC18IncrementalSweeper6doWorkEv
+__ZN3JSC18IncrementalSweeper7doSweepEd
+__ZN3JSC12APIEntryShimD2Ev
+__ZN3JSC6JSLock6unlockEv
+__ZN3JSCL14releaseAPILockEPKv
+__ZN3JSC25DefaultGCActivityCallback6doWorkEv
+__ZN3JSC4Heap10isPagedOutEd
+__ZN3JSC11MarkedSpace10isPagedOutEd
+__ZN3JSC15MarkedAllocator10isPagedOutEd
+__ZN3JSC11CopiedSpace10isPagedOutEd
+__ZN3JSC4Heap7collectENS0_11SweepToggleE
+__ZN3JSC25DefaultGCActivityCallback11willCollectEv
+__ZN3JSC11MarkedSpace28canonicalizeCellLivenessDataEv
+__ZN3JSC11MarkedBlock28canonicalizeCellLivenessDataERKNS0_8FreeListE
+__ZN3JSC4Heap9markRootsEv
+__ZN3JSC17ConservativeRootsC1EPKNS_14MarkedBlockSetEPNS_11CopiedSpaceE
+__ZN3JSC17JITStubRoutineSet10clearMarksEv
+__ZN3JSC14MachineThreads23gatherConservativeRootsERNS_17ConservativeRootsEPv
+__ZN3JSC14MachineThreads23gatherFromCurrentThreadERNS_17ConservativeRootsEPv
+__ZN3JSC17ConservativeRoots3addEPvS1_
+__ZN3JSC17ConservativeRoots17genericAddPointerINS_13DummyMarkHookEEEvPvNS_15TinyBloomFilterERT_
+__ZN3JSC11CopiedSpace14pinIfNecessaryEPv
+__ZN3JSC13DFGCodeBlocks10clearMarksEv
+__ZN3JSC7JSStack23gatherConservativeRootsERNS_17ConservativeRootsERNS_17JITStubRoutineSetERNS_13DFGCodeBlocksE
+__ZN3JSC17ConservativeRoots3addEPvS1_RNS_17JITStubRoutineSetERNS_13DFGCodeBlocksE
+__ZN3JSC2VM23gatherConservativeRootsERNS_17ConservativeRootsE
+__ZN3JSC11MarkedSpace12forEachBlockINS_10ClearMarksEEENT_10ReturnTypeERS3_
+__ZN3JSC18GCThreadSharedData15didStartMarkingEv
+__ZN3WTF15ThreadCondition9broadcastEv
+__ZN3JSC11SlotVisitor5setupEv
+__ZN3JSC8GCThread11slotVisitorEv
+__ZN3JSC12SmallStrings21visitStrongReferencesERNS_11SlotVisitorE
+__ZN3JSC11SlotVisitor15drainFromSharedENS0_15SharedDrainModeE
+__ZN3JSC11SlotVisitor6appendERNS_17ConservativeRootsE
+__ZN3JSC11SlotVisitor19donateKnownParallelEv
+__ZN3WTF5Mutex7tryLockEv
+__ZN3JSC11SlotVisitor5drainEv
+__ZN3JSC14MarkStackArray6refillEv
+__ZN3JSC8JSString13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC9Structure13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC4Heap20markProtectedObjectsERNS_15HeapRootVisitorE
+__ZN3JSC7JSProxy13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC8JSObject13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC14JSGlobalObject13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC25JSSegmentedVariableObject13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC19JSSymbolTableObject13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC7JSScope13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC11CopiedBlock15reportLiveBytesEPNS_6JSCellEj
+__ZN3JSC13PropertyTable13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC12RegExpObject13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC6JSCell13visitChildrenEPS0_RNS_11SlotVisitorE
+__ZN3JSC15JSWrapperObject13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC10JSFunction13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC14MarkStackArray17donateSomeCellsToERS0_
+__ZN3JSC12GetterSetter13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC14MarkStackArray18stealSomeCellsFromERS0_m
+__ZN3JSC17RegExpConstructor13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC18RegExpCachedResult13visitChildrenERNS_11SlotVisitorE
+__ZN3JSC22NativeErrorConstructor13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC11SlotVisitor16mergeOpaqueRootsEv
+__ZN3WTF9HashTableIPvS1_NS_17IdentityExtractorENS_7PtrHashIS1_EENS_10HashTraitsIS1_EES6_E3addINS_22IdentityHashTranslatorIS4_EES1_S1_EENS_18HashTableAddResultINS_17HashTableIteratorIS1_S1_S2_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3JSC4Heap19markTempSortVectorsERNS_15HeapRootVisitorE
+__ZN3JSC9HandleSet18visitStrongHandlesERNS_15HeapRootVisitorE
+__ZN3JSC11HandleStack5visitERNS_15HeapRootVisitorE
+__ZN3JSC13DFGCodeBlocks21traceMarkedCodeBlocksERNS_11SlotVisitorE
+__ZN3JSC17JITStubRoutineSet23traceMarkedStubRoutinesERNS_11SlotVisitorE
+__ZN3JSC11MarkedSpace13visitWeakSetsERNS_15HeapRootVisitorE
+__ZN3JSC11MarkedSpace12forEachBlockINS_12VisitWeakSetEEENT_10ReturnTypeERS3_
+__ZN3JSC9WeakBlock5visitERNS_15HeapRootVisitorE
+__ZN3JSC11SlotVisitor21harvestWeakReferencesEv
+__ZN3JSC18GCThreadSharedData16didFinishMarkingEv
+__ZN3JSC11SlotVisitor5resetEv
+__ZN3JSC18GCThreadSharedData13resetChildrenEv
+__ZN3JSC18GCThreadSharedData5resetEv
+__ZN3JSC17ConservativeRootsD1Ev
+__ZN3JSC11MarkedSpace12reapWeakSetsEv
+__ZN3JSC11MarkedSpace12forEachBlockINS_11ReapWeakSetEEENT_10ReturnTypeERS3_
+__ZN3JSC9WeakBlock4reapEv
+__ZN3WTF6VectorIPN3JSC11MarkedBlockELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC11MarkedSpace12forEachBlockINS_26MarkedBlockSnapshotFunctorEEENT_10ReturnTypeERS3_
+__ZN3JSC4Heap17copyBackingStoresEv
+__ZN3JSC11CopiedSpace14startedCopyingEv
+__ZN3JSC11MarkedSpace12forEachBlockINS_8CapacityEEENT_10ReturnTypeERS3_
+__ZN3JSC11CopiedSpace11doneCopyingEv
+__ZN3JSC11SlotVisitor31finalizeUnconditionalFinalizersEv
+__ZN3JSC12SmallStrings20finalizeSmallStringsEv
+__ZN3JSC4Heap26deleteUnmarkedCompiledCodeEv
+__ZN3JSC13DFGCodeBlocks34deleteUnmarkedJettisonedCodeBlocksEv
+__ZN3JSC17JITStubRoutineSet36deleteUnmarkedJettisonedStubRoutinesEv
+__ZN3JSC2VM25clearSourceProviderCachesEv
+__ZN3JSC18IncrementalSweeper13startSweepingERN3WTF6VectorIPNS_11MarkedBlockELm0ENS1_15CrashOnOverflowEEE
+__ZN3WTF6VectorIPN3JSC11MarkedBlockELm0ENS_15CrashOnOverflowEEaSERKS5_
+__ZN3JSC11MarkedSpace15resetAllocatorsEv
+__ZN3JSC11MarkedSpace12forEachBlockINS_4SizeEEENT_10ReturnTypeERS3_
+__ZN3JSC11CopiedSpace4sizeEv
+__ZN3JSC9WeakBlock5sweepEv
+__ZN3JSC11MarkedBlock16specializedSweepILNS0_10BlockStateE3ELNS0_9SweepModeE1ELNS0_14DestructorTypeE2EEENS0_8FreeListEv
+__ZN3JSC11MarkedBlock16specializedSweepILNS0_10BlockStateE3ELNS0_9SweepModeE1ELNS0_14DestructorTypeE1EEENS0_8FreeListEv
+__ZN3JSC9Structure7destroyEPNS_6JSCellE
+__ZN3JSC9StructureD2Ev
+__ZN3JSC7JSProxy3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC14JSGlobalObject3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC14symbolTablePutINS_14JSGlobalObjectEEEbPT_PNS_9ExecStateENS_12PropertyNameENS_7JSValueEb
+__ZN3JSC8JSObject3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JSObject17putDirectInternalILNS0_7PutModeE0EEEbRNS_2VMENS_12PropertyNameENS_7JSValueEjRNS_15PutPropertySlotEPNS_6JSCellE
+__ZN3JSC13PropertyTable7destroyEPNS_6JSCellE
+__ZN3JSC13PropertyTableD2Ev
+__ZN3WTF10StringImpl4findEPS0_j
+__ZN3WTF10StringImpl7replaceEtt
+__ZNK3WTF6String16removeCharactersEPFbtE
+__ZN3WTF10StringImpl16removeCharactersEPFbtE
+__ZN3WTF10StringImpl4findEPFbtEj
+__ZN3WTF10StringImpl23reverseFindIgnoringCaseEPS0_j
+__ZNK3WTF10StringImpl10startsWithEPKcjb
+__ZN3WTF6String23make8BitFrom16BitSourceEPKtm
+__ZN3WTF10StringImpl22containsOnlyWhitespaceEv
+__ZN3WTF17equalIgnoringCaseEPKhS1_j
+__ZN3WTF6String6appendEPKhj
+__ZN3WTF10StringImpl5adoptERNS_12StringBufferIhEE
+__ZNK3WTF6String20substringSharingImplEjj
+__ZN3JSC11MarkedSpace17freeOrShrinkBlockEPNS_11MarkedBlockE
+__ZN3JSC8JSString7destroyEPNS_6JSCellE
+_JSGlobalContextCreate
+__ZN3JSC2VM14sharedInstanceEv
+__ZN3JSC12GlobalJSLockC1Ev
+__ZN3JSC21createIdentifierTableEv
+__ZN3JSC14MachineThreads29makeUsableFromMultipleThreadsEv
+__ZN3JSC12GlobalJSLockD1Ev
+_JSGlobalContextCreateInGroup
+__ZN3JSC14JSGlobalObjectC1ERNS_2VMEPNS_9StructureEPKNS_23GlobalObjectMethodTableE
+_JSGlobalContextRetain
+_JSStringCreateWithCFString
+_JSEvaluateScript
+__ZNK14OpaqueJSString6stringEv
+__ZN3JSC14SourceProviderC2ERKN3WTF6StringERKNS1_12TextPositionE
+__ZN3JSC8evaluateEPNS_9ExecStateERKNS_10SourceCodeENS_7JSValueEPS5_
+__ZN3JSC17ProgramExecutableC1EPNS_9ExecStateERKNS_10SourceCodeE
+__ZN3JSC4Heap15addCompiledCodeEPNS_14ExecutableBaseE
+__ZN3JSC14JSGlobalObject12toThisObjectEPNS_6JSCellEPNS_9ExecStateE
+__ZN3JSC11Interpreter7executeEPNS_17ProgramExecutableEPNS_9ExecStateEPNS_8JSObjectE
+__ZN3JSC19ExecutableAllocator19underMemoryPressureEv
+__ZN3WTF13MetaAllocator17currentStatisticsEv
+__ZN3JSC2VM14resetDateCacheEv
+__ZN3JSC2VM19clearExceptionStackEv
+__ZNK3JSC20StringSourceProvider6sourceEv
+__ZN3JSC14JSGlobalObject22supportsRichSourceInfoEPKS0_
+__ZN3JSC13LiteralParserIhE13tryJSONPParseERN3WTF6VectorINS_9JSONPDataELm0ENS2_15CrashOnOverflowEEEb
+__ZN3JSC13LiteralParserIhE5Lexer3lexILNS_10ParserModeE2EEENS_9TokenTypeERNS_18LiteralParserTokenIhEE
+__ZN3JSC10Identifier3addIhEEN3WTF10PassRefPtrINS2_10StringImplEEEPNS_2VMEPKT_i
+__ZN3WTF6VectorIN3JSC14JSONPPathEntryELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC9JSONPDataELm0ENS_15CrashOnOverflowEE14appendSlowCaseIS2_EEvRKT_
+__ZN3WTF6VectorIN3JSC9JSONPDataELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC14JSONPPathEntryELm0ENS_15CrashOnOverflowEEC2ERKS4_
+__ZN3JSC6StrongINS_7UnknownEEC2ERKS2_
+__ZN3JSC13LiteralParserIhE5parseENS_11ParserStateE
+__ZNK3WTF6String5asciiEv
+__ZN3WTF6String6formatEPKcz
+__ZN3JSC20MarkedArgumentBufferD2Ev
+__ZN3JSC13LiteralParserIhED2Ev
+__ZN3JSC17ProgramExecutable26initializeGlobalPropertiesERNS_2VMEPNS_9ExecStateEPNS_7JSScopeE
+__ZN3JSC14JSGlobalObject22createProgramCodeBlockEPNS_9ExecStateEPNS_17ProgramExecutableEPPNS_8JSObjectE
+__ZN3JSC14JSGlobalObject17supportsProfilingEPKS0_
+__ZN3JSC9CodeCache19getProgramCodeBlockERNS_2VMEPNS_17ProgramExecutableERKNS_10SourceCodeENS_18JSParserStrictnessENS_12DebuggerModeENS_12ProfilerModeERNS_11ParserErrorE
+__ZN3JSC9CodeCache12getCodeBlockINS_24UnlinkedProgramCodeBlockENS_17ProgramExecutableEEEPT_RNS_2VMEPNS_7JSScopeEPT0_RKNS_10SourceCodeENS_18JSParserStrictnessENS_12DebuggerModeENS_12ProfilerModeERNS_11ParserErrorE
+__ZN3JSC13SourceCodeKeyC2ERKNS_10SourceCodeERKN3WTF6StringENS0_8CodeTypeENS_18JSParserStrictnessE
+__ZN3JSC12CodeCacheMap3addERKNS_13SourceCodeKeyERKNS_15SourceCodeValueE
+__ZN3JSC6StrongINS_6JSCellEEC2ERKS2_
+__ZN3WTF17HashMapTranslatorINS_18HashMapValueTraitsIN3JSC23SourceCodeKeyHashTraitsENS_10HashTraitsINS2_15SourceCodeValueEEEEENS2_17SourceCodeKeyHashEE9translateINS_12KeyValuePairINS2_13SourceCodeKeyES5_EESC_S5_EEvRT_RKT0_RKT1_
+__ZN3JSC15SourceCodeValueaSERKS0_
+__ZN3JSC9CodeCache16generateBytecodeINS_24UnlinkedProgramCodeBlockENS_17ProgramExecutableEEEPT_RNS_2VMEPNS_7JSScopeEPT0_RKNS_10SourceCodeENS_18JSParserStrictnessENS_12DebuggerModeENS_12ProfilerModeERNS_11ParserErrorE
+__ZN3JSC5parseINS_11ProgramNodeEEEN3WTF10PassRefPtrIT_EEPNS_2VMERKNS_10SourceCodeEPNS_18FunctionParametersERKNS_10IdentifierENS_18JSParserStrictnessENS_12JSParserModeERNS_11ParserErrorE
+__ZN3JSC6ParserINS_5LexerIhEEEC1EPNS_2VMERKNS_10SourceCodeEPNS_18FunctionParametersERKNS_10IdentifierENS_18JSParserStrictnessENS_12JSParserModeE
+__ZN3JSC6ParserINS_5LexerIhEEEC2EPNS_2VMERKNS_10SourceCodeEPNS_18FunctionParametersERKNS_10IdentifierENS_18JSParserStrictnessENS_12JSParserModeE
+__ZN3JSC5LexerIhEC1EPNS_2VME
+__ZN3JSC5LexerIhE7setCodeERKNS_10SourceCodeEPNS_11ParserArenaE
+__ZN3JSC11ParserArena15identifierArenaEv
+__ZN3WTF15SegmentedVectorIN3JSC10IdentifierELm64ELm32EE17deleteAllSegmentsEv
+__ZN3JSC2VM22addSourceProviderCacheEPNS_14SourceProviderE
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC14SourceProviderEEENS_12KeyValuePairIS4_NS1_INS2_19SourceProviderCacheEEEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS4_EENS_22KeyValuePairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E15deallocateTableEPS8_i
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC14SourceProviderEEENS_12KeyValuePairIS4_NS1_INS2_19SourceProviderCacheEEEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS4_EENS_22KeyValuePairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E16lookupForWritingINS_22IdentityHashTranslatorISC_EES4_EENSt3__14pairIPS8_bEERKT0_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC14SourceProviderEEENS_12KeyValuePairIS4_NS1_INS2_19SourceProviderCacheEEEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS4_EENS_22KeyValuePairHashTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E3addINS_17HashMapTranslatorISH_SC_EEPS3_NS_10PassRefPtrIS6_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EEEERKT0_RKT1_
+__ZN3JSC6ParserINS_5LexerIhEEE9pushScopeEv
+__ZN3JSC5ScopeC2ERKS0_
+__ZN3JSC5ScopeD2Ev
+__ZN3JSC5LexerIhE3lexEPNS_11JSTokenDataEPNS_15JSTokenLocationEjb
+__ZN3WTF15SegmentedVectorIN3JSC10IdentifierELm64ELm32EE6appendIS2_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC6ParserINS_5LexerIhEEE5parseINS_11ProgramNodeEEEN3WTF10PassRefPtrIT_EERNS_11ParserErrorE
+__ZN3JSC6ParserINS_5LexerIhEEE10parseInnerEv
+__ZN3JSC11ParserArena17allocateDeletableEm
+__ZN3JSC11ParserArena20allocateFreeablePoolEv
+__ZN3WTF6VectorIPN3JSC20ParserArenaDeletableELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC6ParserINS_5LexerIhEEE19parseSourceElementsILNS_18SourceElementsModeE0ENS_10ASTBuilderEEENT0_14SourceElementsERS7_
+__ZN3JSC6ParserINS_5LexerIhEEE14parseStatementINS_10ASTBuilderEEENT_9StatementERS6_RPKNS_10IdentifierEPj
+__ZN3JSC6ParserINS_5LexerIhEEE31parseExpressionOrLabelStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC5LexerIhE16nextTokenIsColonEv
+__ZN3JSC6ParserINS_5LexerIhEEE15parseExpressionINS_10ASTBuilderEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE25parseAssignmentExpressionINS_10ASTBuilderEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE21parseMemberExpressionINS_10ASTBuilderEEENT_10ExpressionERS6_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEES3_NS_17IdentityExtractorEN3JSC17IdentifierRepHashENS_10HashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEES3_NS_17IdentityExtractorEN3JSC17IdentifierRepHashENS_10HashTraitsIS3_EES8_E6rehashEi
+__ZN3JSC10ASTBuilder26appendBinaryExpressionInfoERiPNS_14ExpressionNodeEiiijjb
+__ZN3JSC10ASTBuilder21assignmentStackAppendERiPNS_14ExpressionNodeEjjjjiNS_8OperatorE
+__ZN3JSC6ParserINS_5LexerIhEEE17parseFunctionInfoILNS_20FunctionRequirementsE0ELb0ENS_10ASTBuilderEEEbRT1_RPKNS_10IdentifierERNS7_19FormalParameterListERNS7_12FunctionBodyERjSH_RiSH_
+__ZN3JSC16FunctionBodyNode6createEPNS_2VMERKNS_15JSTokenLocationES5_jb
+__ZN3JSC11ParserArena14derefWithArenaEN3WTF10PassRefPtrINS_21ParserArenaRefCountedEEE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC21ParserArenaRefCountedEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC6ParserINS_5LexerIhEEE16popScopeInternalERNS_8ScopeRefEb
+__ZN3JSC5Scope20collectFreeVariablesEPS0_b
+__ZN3JSC10ASTBuilder18createFunctionExprERKNS_15JSTokenLocationEPKNS_10IdentifierEPNS_16FunctionBodyNodeEPNS_13ParameterNodeEjjiij
+__ZN3JSC16FunctionBodyNode13finishParsingERKNS_10SourceCodeEPNS_13ParameterNodeERKNS_10IdentifierENS_27FunctionNameIsInScopeToggleE
+__ZN3JSC16FunctionBodyNode13finishParsingEN3WTF10PassRefPtrINS_18FunctionParametersEEERKNS_10IdentifierENS_27FunctionNameIsInScopeToggleE
+__ZN3JSC13StatementNode6setLocEjjii
+__ZN3JSC10ASTBuilder14makeAssignNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeENS_8OperatorES5_bbiiijj
+__ZNK3JSC11ResolveNode10isLocationEv
+__ZNK3JSC11ResolveNode13isResolveNodeEv
+__ZNK3JSC12FuncExprNode14isFuncExprNodeEv
+__ZN3JSC14SourceElements6appendEPNS_13StatementNodeE
+__ZNK3JSC13StatementNode16isEmptyStatementEv
+__ZN3WTF6VectorIPN3JSC13StatementNodeELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC5LexerIhE19lexExpectIdentifierEPNS_11JSTokenDataEPNS_15JSTokenLocationEjb
+__ZN3JSC5Scope16declareParameterEPKNS_10IdentifierE
+__ZN3JSC6ParserINS_5LexerIhEEE19parseSourceElementsILNS_18SourceElementsModeE0ENS_13SyntaxCheckerEEENT0_14SourceElementsERS7_
+__ZN3JSC6ParserINS_5LexerIhEEE14parseStatementINS_13SyntaxCheckerEEENT_9StatementERS6_RPKNS_10IdentifierEPj
+__ZN3JSC6ParserINS_5LexerIhEEE16parseIfStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE15parseExpressionINS_13SyntaxCheckerEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE25parseAssignmentExpressionINS_13SyntaxCheckerEEENT_10ExpressionERS6_
+__ZN3JSC13SyntaxChecker17BinaryExprContextC2ERS0_
+__ZN3JSC13SyntaxChecker16UnaryExprContextC2ERS0_
+__ZN3JSC6ParserINS_5LexerIhEEE21parseMemberExpressionINS_13SyntaxCheckerEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE20parseReturnStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC5Scope29copyCapturedVariablesToVectorERKN3WTF7HashSetINS1_6RefPtrINS1_10StringImplEEENS_17IdentifierRepHashENS1_10HashTraitsIS5_EEEERNS1_6VectorIS5_Lm0ENS1_15CrashOnOverflowEEE
+__ZN3JSC23SourceProviderCacheItemC2ERKNS_41SourceProviderCacheItemCreationParametersE
+__ZN3JSC41SourceProviderCacheItemCreationParametersD2Ev
+__ZN3JSC19SourceProviderCache3addEiN3WTF10PassOwnPtrINS_23SourceProviderCacheItemEEE
+__ZN3WTF9HashTableIiNS_12KeyValuePairIiNS_6OwnPtrIN3JSC23SourceProviderCacheItemEEEEENS_24KeyValuePairKeyExtractorIS6_EENS_7IntHashIjEENS_18HashMapValueTraitsINS_10HashTraitsIiEENSC_IS5_EEEESD_E3addINS_17HashMapTranslatorISF_SA_EEiNS_10PassOwnPtrIS4_EEEENS_18HashTableAddResultINS_17HashTableIteratorIiS6_S8_SA_SF_SD_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIiNS_12KeyValuePairIiNS_6OwnPtrIN3JSC23SourceProviderCacheItemEEEEENS_24KeyValuePairKeyExtractorIS6_EENS_7IntHashIjEENS_18HashMapValueTraitsINS_10HashTraitsIiEENSC_IS5_EEEESD_E6expandEv
+__ZN3WTF9HashTableIiNS_12KeyValuePairIiNS_6OwnPtrIN3JSC23SourceProviderCacheItemEEEEENS_24KeyValuePairKeyExtractorIS6_EENS_7IntHashIjEENS_18HashMapValueTraitsINS_10HashTraitsIiEENSC_IS5_EEEESD_E8reinsertERS6_
+__ZNK3JSC15DotAccessorNode10isLocationEv
+__ZNK3JSC14ExpressionNode13isResolveNodeEv
+__ZNK3JSC14ExpressionNode21isBracketAccessorNodeEv
+__ZNK3JSC14ExpressionNode14isFuncExprNodeEv
+__ZN3JSC6ParserINS_5LexerIhEEE19parseVarDeclarationINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE15declareVariableEPKNS_10IdentifierE
+__ZN3WTF6VectorINSt3__14pairIPKN3JSC10IdentifierEjEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC10ASTBuilder19createAssignResolveERKNS_15JSTokenLocationERKNS_10IdentifierEPNS_14ExpressionNodeEiiijj
+__ZN3JSC5Scope20getCapturedVariablesERN3WTF7HashSetINS1_6RefPtrINS1_10StringImplEEENS_17IdentifierRepHashENS1_10HashTraitsIS5_EEEE
+__ZN3JSC10ASTBuilderD2Ev
+__ZN3JSC5LexerIhE5clearEv
+__ZN3JSC11ProgramNode6createEPNS_2VMERKNS_15JSTokenLocationES5_jPNS_14SourceElementsEPN3WTF6VectorINSt3__14pairIPKNS_10IdentifierEjEELm0ENS8_15CrashOnOverflowEEEPNS9_IPNS_16FunctionBodyNodeELm0ESG_EERNS8_7HashSetINS8_6RefPtrINS8_10StringImplEEENS_17IdentifierRepHashENS8_10HashTraitsISQ_EEEERKNS_10SourceCodeEji
+__ZN3JSC9ScopeNodeC2EPNS_2VMERKNS_15JSTokenLocationES5_RKNS_10SourceCodeEPNS_14SourceElementsEPN3WTF6VectorINSt3__14pairIPKNS_10IdentifierEjEELm0ENSB_15CrashOnOverflowEEEPNSC_IPNS_16FunctionBodyNodeELm0ESJ_EERNSB_7HashSetINSB_6RefPtrINSB_10StringImplEEENS_17IdentifierRepHashENSB_10HashTraitsIST_EEEEji
+__ZN3JSC11ParserArena10removeLastEv
+__ZN3JSC11ParserArena5resetEv
+__ZN3JSC11ParserArena17deallocateObjectsEv
+__ZN3JSC6ParserINS_5LexerIhEEED1Ev
+__ZN3JSC6ParserINS_5LexerIhEEED2Ev
+__ZN3JSC5LexerIhED1Ev
+__ZN3JSC24UnlinkedProgramCodeBlock6createEPNS_2VMERKNS_14ExecutableInfoE
+__ZN3JSC17UnlinkedCodeBlockC2EPNS_2VMEPNS_9StructureENS_8CodeTypeERKNS_14ExecutableInfoE
+__ZN3JSC17BytecodeGeneratorC1ERNS_2VMEPNS_7JSScopeEPNS_11ProgramNodeEPNS_24UnlinkedProgramCodeBlockENS_12DebuggerModeENS_12ProfilerModeE
+__ZN3JSC17BytecodeGeneratorC2ERNS_2VMEPNS_7JSScopeEPNS_11ProgramNodeEPNS_24UnlinkedProgramCodeBlockENS_12DebuggerModeENS_12ProfilerModeE
+__ZN3WTF6VectorIN3JSC19UnlinkedInstructionELm0ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC24UnlinkedProgramCodeBlock22addVariableDeclarationERKNS_10IdentifierEb
+__ZN3WTF6VectorINSt3__14pairIN3JSC10IdentifierEbEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator8generateEv
+__ZN3JSC11ProgramNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitDebugHookENS_11DebugHookIDEjjjj
+__ZN3JSC17BytecodeGenerator12newTemporaryEv
+__ZN3WTF15SegmentedVectorIN3JSC10RegisterIDELm32ELm32EE6appendImEEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC10RegisterIDELm32ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDENS_7JSValueE
+__ZN3JSC17BytecodeGenerator16addConstantValueENS_7JSValueE
+__ZN3WTF9HashTableIxNS_12KeyValuePairIxjEENS_24KeyValuePairKeyExtractorIS2_EENS_7IntHashIxEENS_18HashMapValueTraitsIN3JSC24EncodedJSValueHashTraitsENS_10HashTraitsIjEEEES9_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EExEENSt3__14pairIPS2_bEERKT0_
+__ZN3WTF9HashTableIxNS_12KeyValuePairIxjEENS_24KeyValuePairKeyExtractorIS2_EENS_7IntHashIxEENS_18HashMapValueTraitsIN3JSC24EncodedJSValueHashTraitsENS_10HashTraitsIjEEEES9_E3addINS_17HashMapTranslatorISC_S6_EExjEENS_18HashTableAddResultINS_17HashTableIteratorIxS2_S4_S6_SC_S9_EEEERKT0_RKT1_
+__ZN3WTF15SegmentedVectorIN3JSC10RegisterIDELm32ELm32EE6appendIiEEvRKT_
+__ZN3JSC17UnlinkedCodeBlock11addConstantENS_7JSValueE
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_7UnknownEEELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator8emitMoveEPNS_10RegisterIDES2_
+__ZN3JSC22StaticPropertyAnalyzer3movEii
+__ZN3JSC22StaticPropertyAnalyzer4killEi
+__ZN3WTF7HashMapIiNS_6RefPtrIN3JSC22StaticPropertyAnalysisEEENS_7IntHashIiEENS_29UnsignedWithZeroKeyHashTraitsIiEENS_10HashTraitsIS4_EEE4findERKi
+__ZN3JSC17ExprStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17AssignResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator7resolveERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator21emitResolveBaseForPutEPNS_10RegisterIDERKNS_13ResolveResultERKNS_10IdentifierERNS_19NonlocalResolveInfoE
+__ZN3JSC17BytecodeGenerator11addConstantERKNS_10IdentifierE
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_iEENS_24KeyValuePairKeyExtractorIS5_EEN3JSC17IdentifierRepHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENS8_28IdentifierMapIndexHashTraitsEEESC_E3addINS_17HashMapTranslatorISE_S9_EEPS2_iEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_iEENS_24KeyValuePairKeyExtractorIS5_EEN3JSC17IdentifierRepHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENS8_28IdentifierMapIndexHashTraitsEEESC_E6rehashEi
+__ZN3JSC17UnlinkedCodeBlock13addIdentifierERKNS_10IdentifierE
+__ZN3WTF6VectorIN3JSC10IdentifierELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator24getResolveBaseOperationsERN3WTF7HashMapIPNS1_10StringImplENS0_17ResolveCacheEntryENS_17IdentifierRepHashENS1_10HashTraitsIS4_EENS7_IS5_EEEERKNS_10IdentifierERj
+__ZN3WTF9HashTableIPNS_10StringImplENS_12KeyValuePairIS2_N3JSC17BytecodeGenerator17ResolveCacheEntryEEENS_24KeyValuePairKeyExtractorIS7_EENS4_17IdentifierRepHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E3addINS_17HashMapTranslatorISF_SA_EES2_S6_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplENS_12KeyValuePairIS2_N3JSC17BytecodeGenerator17ResolveCacheEntryEEENS_24KeyValuePairKeyExtractorIS7_EENS4_17IdentifierRepHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6rehashEi
+__ZN3WTF9HashTableIPNS_10StringImplENS_12KeyValuePairIS2_jEENS_24KeyValuePairKeyExtractorIS4_EEN3JSC17IdentifierRepHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSA_IjEEEESB_E3addINS_17HashMapTranslatorISD_S8_EES2_jEENS_18HashTableAddResultINS_17HashTableIteratorIS2_S4_S6_S8_SD_SB_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplENS_12KeyValuePairIS2_jEENS_24KeyValuePairKeyExtractorIS4_EEN3JSC17IdentifierRepHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSA_IjEEEESB_E6rehashEi
+__ZN3JSC12FuncExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator25emitNewFunctionExpressionEPNS_10RegisterIDEPNS_12FuncExprNodeE
+__ZN3JSC26UnlinkedFunctionExecutableC1EPNS_2VMEPNS_9StructureERKNS_10SourceCodeEPNS_16FunctionBodyNodeE
+__ZN3JSC26UnlinkedFunctionExecutableC2EPNS_2VMEPNS_9StructureERKNS_10SourceCodeEPNS_16FunctionBodyNodeE
+__ZN3JSC26UnlinkedFunctionExecutable14finishCreationERNS_2VME
+__ZN3JSC17UnlinkedCodeBlock15addFunctionExprEPNS_26UnlinkedFunctionExecutableE
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_26UnlinkedFunctionExecutableEEELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator27createActivationIfNecessaryEv
+__ZN3JSC17UnlinkedCodeBlock17addExpressionInfoEjiiijj
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator13emitPutToBaseEPNS_10RegisterIDERKNS_10IdentifierES2_RNS_19NonlocalResolveInfoE
+__ZN3JSC13AssignDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC11ResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11emitResolveEPNS_10RegisterIDERKNS_13ResolveResultERKNS_10IdentifierE
+__ZN3JSC17ObjectLiteralNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16PropertyListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitNewObjectEPNS_10RegisterIDE
+__ZN3JSC22StaticPropertyAnalyzer9newObjectEij
+__ZN3WTF9HashTableIiNS_12KeyValuePairIiNS_6RefPtrIN3JSC22StaticPropertyAnalysisEEEEENS_24KeyValuePairKeyExtractorIS6_EENS_7IntHashIiEENS_18HashMapValueTraitsINS_29UnsignedWithZeroKeyHashTraitsIiEENS_10HashTraitsIS5_EEEESD_E3addINS_17HashMapTranslatorISG_SA_EEiNS_10PassRefPtrIS4_EEEENS_18HashTableAddResultINS_17HashTableIteratorIiS6_S8_SA_SG_SD_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIiNS_12KeyValuePairIiNS_6RefPtrIN3JSC22StaticPropertyAnalysisEEEEENS_24KeyValuePairKeyExtractorIS6_EENS_7IntHashIiEENS_18HashMapValueTraitsINS_29UnsignedWithZeroKeyHashTraitsIiEENS_10HashTraitsIS5_EEEESD_E6rehashEi
+__ZN3WTF9HashTableIiNS_12KeyValuePairIiNS_6RefPtrIN3JSC22StaticPropertyAnalysisEEEEENS_24KeyValuePairKeyExtractorIS6_EENS_7IntHashIiEENS_18HashMapValueTraitsINS_29UnsignedWithZeroKeyHashTraitsIiEENS_10HashTraitsIS5_EEEESD_E8reinsertERS6_
+__ZN3JSC17BytecodeGenerator17emitDirectPutByIdEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorENS_7IntHashIjEENS_29UnsignedWithZeroKeyHashTraitsIjEES5_E3addINS_22IdentityHashTranslatorIS3_EEjjEENS_18HashTableAddResultINS_17HashTableIteratorIjjS1_S3_S5_S5_EEEERKT0_RKT1_
+__ZN3JSC17UnlinkedCodeBlock28addPropertyAccessInstructionEj
+__ZN3WTF6VectorIjLm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator11emitPutByIdEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC16VarStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11NewExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator29expectedFunctionForIdentifierERKNS_10IdentifierE
+__ZN3JSC13CallArgumentsC2ERNS_17BytecodeGeneratorEPNS_13ArgumentsNodeE
+__ZN3JSC17BytecodeGenerator13emitConstructEPNS_10RegisterIDES2_NS_16ExpectedFunctionERNS_13CallArgumentsEjjjjj
+__ZN3JSC17BytecodeGenerator8newLabelEv
+__ZN3WTF15SegmentedVectorIN3JSC5LabelELm32ELm32EE6appendIPNS1_17BytecodeGeneratorEEEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC5LabelELm32ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC17BytecodeGenerator27emitExpectedFunctionSnippetEPNS_10RegisterIDES2_NS_16ExpectedFunctionERNS_13CallArgumentsEPNS_5LabelE
+__ZN3JSC17BytecodeGenerator16emitUnaryNoDstOpENS_8OpcodeIDEPNS_10RegisterIDE
+__ZN3JSC22StaticPropertyAnalyzer4killEv
+__ZN3JSC17UnlinkedCodeBlock11shrinkToFitEv
+__ZN3WTF6VectorIjLm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC10IdentifierELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_7UnknownEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_26UnlinkedFunctionExecutableEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3JSC9ScopeNode11destroyDataEv
+__ZN3JSC15ParserArenaDataIN3WTF6VectorINSt3__14pairIPKNS_10IdentifierEjEELm0ENS1_15CrashOnOverflowEEEED1Ev
+__ZN3JSC15ParserArenaDataIN3WTF6VectorIPNS_16FunctionBodyNodeELm0ENS1_15CrashOnOverflowEEEED1Ev
+__ZN3JSC14SourceElementsD1Ev
+__ZThn24_N3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC16FunctionBodyNodeD2Ev
+__ZN3JSC9ScopeNodeD2Ev
+__ZN3JSC11ParserArenaD1Ev
+__ZN3JSC11ParserArenaD2Ev
+__ZN3JSC17BytecodeGeneratorD1Ev
+__ZN3JSC17BytecodeGeneratorD2Ev
+__ZN3WTF15SegmentedVectorIN3JSC7TryDataELm8ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC5LabelELm32ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC10RegisterIDELm32ELm32EED2Ev
+__ZThn24_N3JSC11ProgramNodeD0Ev
+__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC17ProgramExecutable12addGlobalVarEPNS_14JSGlobalObjectERKNS_10IdentifierENS0_12ConstantModeENS0_12FunctionModeE
+__ZN3JSC17ProgramExecutable15compileInternalEPNS_9ExecStateEPNS_7JSScopeENS_7JITCode7JITTypeEj
+__ZN3JSC9CodeBlockC2EPNS_16ScriptExecutableEPNS_17UnlinkedCodeBlockEPNS_14JSGlobalObjectEjN3WTF10PassRefPtrINS_14SourceProviderEEEjjNS7_10PassOwnPtrIS0_EE
+__ZN3JSC3DFG11ExitProfileC1Ev
+__ZN3JSC39CompressedLazyOperandValueProfileHolderC1Ev
+__ZN3JSC16ExecutionCounterC1Ev
+__ZN3JSC2VM16startedCompilingEPNS_9CodeBlockE
+__ZN3WTF6VectorIPN3JSC9CodeBlockELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC12ValueProfileELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC10IdentifierELm0ENS_15CrashOnOverflowEE6appendIS2_EEvPKT_m
+__ZN3JSC9CodeBlock20setConstantRegistersERKN3WTF6VectorINS_12WriteBarrierINS_7UnknownEEELm0ENS1_15CrashOnOverflowEEE
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_18FunctionExecutableEEELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC18FunctionExecutableC1ERNS_2VMERKNS_10SourceCodeEPNS_26UnlinkedFunctionExecutableEjjj
+__ZN3WTF15SegmentedVectorIN3JSC17LLIntCallLinkInfoELm8ELm32EE13ensureSegmentEmm
+__ZN3WTF6VectorIPNS0_IN3JSC17LLIntCallLinkInfoELm8ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3WTF15SegmentedVectorIN3JSC12ValueProfileELm8ELm32EE13ensureSegmentEmm
+__ZN3WTF6VectorIPNS0_IN3JSC12ValueProfileELm8ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3WTF15SegmentedVectorIN3JSC23ObjectAllocationProfileELm8ELm32EE13ensureSegmentEmm
+__ZN3WTF6VectorIPNS0_IN3JSC23ObjectAllocationProfileELm8ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3WTF6VectorINS0_IN3JSC16ResolveOperationELm0ENS_15CrashOnOverflowEEELm0ES3_E15reserveCapacityEm
+__ZN3JSC12opcodeLengthENS_8OpcodeIDE
+__ZN3JSC23ObjectAllocationProfile28possibleDefaultPropertyCountERNS_2VMEPNS_8JSObjectE
+__ZN3JSC12PrototypeMap32emptyObjectStructureForPrototypeEPNS_8JSObjectEj
+__ZN3JSC9WeakGCMapINSt3__14pairIPNS_8JSObjectEjEENS_9StructureEN3WTF8PairHashIS4_jEENS7_10HashTraitsIS5_EEE3addERKS5_NS_8PassWeakIS6_EE
+__ZN3JSC16ExecutionCounter15setNewThresholdEiPNS_9CodeBlockE
+__ZN3JSC16ExecutionCounter12setThresholdEPNS_9CodeBlockE
+__ZN3JSC9CodeBlock24predictedMachineCodeSizeEv
+__ZN3JSC19ExecutableAllocator24memoryPressureMultiplierEm
+__ZN3JSC9CodeBlock32copyPostParseDataFromAlternativeEv
+__ZN3JSC9CodeBlock21copyPostParseDataFromEPS0_
+__ZN3JSC5LLInt20getProgramEntrypointERNS_2VMERNS_7JITCodeE
+__ZN3JSC5LLInt26programEntryThunkGeneratorEPNS_2VME
+__ZN3JSC5LLIntL23generateThunkWithJumpToEPNS_2VMEPFvvEPKc
+__ZN3JSC9CodeBlock10setJITCodeERKNS_7JITCodeENS_21MacroAssemblerCodePtrE
+__ZN3JSC4Heap29reportExtraMemoryCostSlowCaseEm
+__ZN3JSC8Watchdog7didFireEPNS_9ExecStateE
+__ZN3JSC7JSStack12growSlowCaseEPNS_8RegisterE
+__ZN3JSC8Watchdog5ScopeC1ERS0_
+_ctiTrampoline
+__ZN3JSC9ExecState13setCurrentVPCEPNS_11InstructionE
+__ZN3JSC7JSScope11resolveBaseEPNS_9ExecStateERKNS_10IdentifierEbPN3WTF6VectorINS_16ResolveOperationELm0ENS6_15CrashOnOverflowEEEPNS_18PutToBaseOperationE
+__ZN3JSC7JSScope30resolveContainingScopeInternalILNS0_10LookupModeE0ELNS0_12ReturnValuesE2EEEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotEPN3WTF6VectorINS_16ResolveOperationELm0ENSD_15CrashOnOverflowEEEPNS_18PutToBaseOperationEb
+__ZN3WTF6VectorIN3JSC16ResolveOperationELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC16ResolveOperationELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3JSC7JSScope10resolvePutEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierES3_PNS_18PutToBaseOperationE
+__ZN3JSC7JSScope7resolveEPNS_9ExecStateERKNS_10IdentifierEPN3WTF6VectorINS_16ResolveOperationELm0ENS6_15CrashOnOverflowEEE
+__ZN3JSC7JSScope30resolveContainingScopeInternalILNS0_10LookupModeE0ELNS0_12ReturnValuesE1EEEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotEPN3WTF6VectorINS_16ResolveOperationELm0ENSD_15CrashOnOverflowEEEPNS_18PutToBaseOperationEb
+__ZN3JSC10JSFunction3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC10JSFunction18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC16SymbolTableEntry14couldBeWatchedEv
+__ZN3JSCL24executeResolveOperationsEPNS_9ExecStateEPNS_7JSScopeERKNS_10IdentifierEPNS_16ResolveOperationERNS_12LookupResultE
+__ZN3JSC5LLInt9setUpCallEPNS_9ExecStateEPNS_11InstructionENS_22CodeSpecializationKindENS_7JSValueEPNS_17LLIntCallLinkInfoE
+__ZN3JSC18FunctionExecutable27compileForConstructInternalEPNS_9ExecStateEPNS_7JSScopeENS_7JITCode7JITTypeEj
+__ZN3JSC18FunctionExecutable19produceCodeBlockForEPNS_7JSScopeENS_22CodeSpecializationKindERPNS_8JSObjectE
+__ZN3JSC26UnlinkedFunctionExecutable12codeBlockForERNS_2VMEPNS_7JSScopeERKNS_10SourceCodeENS_22CodeSpecializationKindENS_12DebuggerModeENS_12ProfilerModeERNS_11ParserErrorE
+__ZN3JSC5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_2VMERKNS_10SourceCodeEPNS_18FunctionParametersERKNS_10IdentifierENS_18JSParserStrictnessENS_12JSParserModeERNS_11ParserErrorE
+__ZN3JSC6ParserINS_5LexerIhEEE5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EERNS_11ParserErrorE
+__ZN3JSC16FunctionBodyNode6createEPNS_2VMERKNS_15JSTokenLocationES5_jPNS_14SourceElementsEPN3WTF6VectorINSt3__14pairIPKNS_10IdentifierEjEELm0ENS8_15CrashOnOverflowEEEPNS9_IPS0_Lm0ESG_EERNS8_7HashSetINS8_6RefPtrINS8_10StringImplEEENS_17IdentifierRepHashENS8_10HashTraitsISP_EEEERKNS_10SourceCodeEji
+__ZN3JSC25UnlinkedFunctionCodeBlock6createEPNS_2VMENS_8CodeTypeERKNS_14ExecutableInfoE
+__ZN3JSC17BytecodeGeneratorC1ERNS_2VMEPNS_7JSScopeEPNS_16FunctionBodyNodeEPNS_25UnlinkedFunctionCodeBlockENS_12DebuggerModeENS_12ProfilerModeE
+__ZN3JSC17BytecodeGeneratorC2ERNS_2VMEPNS_7JSScopeEPNS_16FunctionBodyNodeEPNS_25UnlinkedFunctionCodeBlockENS_12DebuggerModeENS_12ProfilerModeE
+__ZN3JSC17BytecodeGenerator13resolveCalleeEPNS_16FunctionBodyNodeE
+__ZN3WTF15SegmentedVectorIN3JSC10RegisterIDELm32ELm32EE13ensureSegmentEmm
+__ZN3JSC17BytecodeGenerator14emitCreateThisEPNS_10RegisterIDE
+__ZN3JSC16FunctionBodyNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9BlockNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC9ScopeNode15singleStatementEv
+__ZNK3JSC9BlockNode7isBlockEv
+__ZN3JSC17BytecodeGenerator10emitReturnEPNS_10RegisterIDE
+__ZN3JSC5LLInt21getFunctionEntrypointERNS_2VMENS_22CodeSpecializationKindERNS_7JITCodeERNS_21MacroAssemblerCodePtrE
+__ZN3WTF5MoverINS_12KeyValuePairIPFN3JSC21MacroAssemblerCodeRefEPNS2_2VMEES3_EELb1EE4moveERS8_SA_
+__ZN3JSC5LLInt39functionForConstructEntryThunkGeneratorEPNS_2VME
+__ZN3JSC5LLInt44functionForConstructArityCheckThunkGeneratorEPNS_2VME
+__ZN3JSC10JSFunction23createAllocationProfileEPNS_9ExecStateEm
+__ZNK3JSC8JSObject3getEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC9Structure29getPropertyNamesFromStructureERNS_2VMERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC17PropertyNameArray14addKnownUniqueEPN3WTF10StringImplE
+__ZN3JSC17PropertyNameArrayD2Ev
+__ZN3JSC8Watchdog5ScopeD1Ev
+_JSContextGetGlobalObject
+_JSStringCreateWithUTF8CString
+__ZN3WTF7Unicode18convertUTF8ToUTF16EPPKcS2_PPtS4_Pbb
+_JSObjectGetProperty
+__ZNK14OpaqueJSString10identifierEPN3JSC2VME
+_JSStringRelease
+_JSValueIsUndefined
+_JSValueToObject
+__ZNK3JSC6JSCell8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
+_JSValueMakeString
+_JSValueMakeBoolean
+_JSObjectIsFunction
+__ZN3JSC10JSFunction11getCallDataEPNS_6JSCellERNS_8CallDataE
+_JSObjectCallAsFunction
+__ZN3JSC8JSObject12toThisObjectEPNS_6JSCellEPNS_9ExecStateE
+__ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
+__ZN3JSC11Interpreter11executeCallEPNS_9ExecStateEPNS_8JSObjectENS_8CallTypeERKNS_8CallDataENS_7JSValueERKNS_7ArgListE
+__ZN3JSC18FunctionExecutable22compileForCallInternalEPNS_9ExecStateEPNS_7JSScopeENS_7JITCode7JITTypeEj
+__ZN3JSC6ParserINS_5LexerIhEEE16parseIfStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC10ASTBuilder19operatorStackAppendERiii
+__ZN3JSC10ASTBuilder21appendBinaryOperationERKNS_15JSTokenLocationERiS4_RKNSt3__14pairIPNS_14ExpressionNodeENS0_12BinaryOpInfoEEESC_
+__ZN3JSC10ASTBuilder14makeBinaryNodeERKNS_15JSTokenLocationEiNSt3__14pairIPNS_14ExpressionNodeENS0_12BinaryOpInfoEEES9_
+__ZN3JSC6ParserINS_5LexerIhEEE20parseReturnStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC17BytecodeGenerator12addParameterERKNS_10IdentifierEi
+__ZN3JSC17BytecodeGenerator11registerForEi
+__ZN3JSC10IfElseNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10IfElseNode23tryFoldBreakAndContinueERNS_17BytecodeGeneratorEPNS_13StatementNodeERPNS_5LabelERNS_15FallThroughModeE
+__ZNK3JSC13StatementNode7isBlockEv
+__ZNK3JSC13StatementNode7isBreakEv
+__ZNK3JSC13StatementNode10isContinueEv
+__ZN3JSC12BinaryOpNode30emitBytecodeInConditionContextERNS_17BytecodeGeneratorEPNS_5LabelES4_NS_15FallThroughModeE
+__ZN3JSC12BinaryOpNode15tryFoldToBranchERNS_17BytecodeGeneratorERN3WTF8TriStateERPNS_14ExpressionNodeE
+__ZNK3JSC14ExpressionNode10isConstantEv
+__ZNK3JSC12ConstantNode10isConstantEv
+__ZNK3JSC10StringNode7jsValueERNS_17BytecodeGeneratorE
+__ZN3JSC17BytecodeGenerator17addStringConstantERKNS_10IdentifierE
+__ZN3WTF9HashTableIPNS_10StringImplENS_12KeyValuePairIS2_PN3JSC8JSStringEEENS_24KeyValuePairKeyExtractorIS7_EENS4_17IdentifierRepHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E3addINS_17HashMapTranslatorISF_SA_EES2_S6_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S7_S9_SA_SF_SD_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplENS_12KeyValuePairIS2_PN3JSC8JSStringEEENS_24KeyValuePairKeyExtractorIS7_EENS4_17IdentifierRepHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSC_IS6_EEEESD_E6rehashEi
+__ZN3JSC15StrictEqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode8isStringEv
+__ZNK3JSC12ConstantNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC17BytecodeGenerator29createLazyRegisterIfNecessaryEPNS_10RegisterIDE
+__ZN3JSC12ConstantNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitEqualityOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_
+__ZN3JSC17BytecodeGenerator15emitJumpIfFalseEPNS_10RegisterIDEPNS_5LabelE
+__ZNK3JSC5Label4bindEii
+__ZN3JSC17BytecodeGenerator9emitLabelEPNS_5LabelE
+__ZN3JSC17UnlinkedCodeBlock13addJumpTargetEj
+__ZN3JSC10ReturnNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9ArrayNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitNewArrayEPNS_10RegisterIDEPNS_11ElementNodeEj
+__ZN3JSC17UnlinkedCodeBlock17addConstantBufferEj
+__ZN3WTF6VectorINS0_IN3JSC7JSValueELm0ENS_15CrashOnOverflowEEELm0ES3_E14appendSlowCaseIS4_EEvRKT_
+__ZN3WTF6VectorINS0_IN3JSC7JSValueELm0ENS_15CrashOnOverflowEEELm0ES3_E15reserveCapacityEm
+__ZN3WTF20VectorTypeOperationsINS_6VectorIN3JSC7JSValueELm0ENS_15CrashOnOverflowEEEE4moveEPKS5_S8_PS5_
+__ZNK3JSC10ReturnNode12isReturnNodeEv
+__ZNK3JSC14SourceElements15singleStatementEv
+__ZN3WTF6VectorIN3JSC19UnlinkedHandlerInfoELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_6RegExpEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorINS0_IN3JSC7JSValueELm0ENS_15CrashOnOverflowEEELm0ES3_E14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC23UnlinkedSimpleJumpTableELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC23UnlinkedStringJumpTableELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfo11FatPositionELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC7JSValueELm0ENS_15CrashOnOverflowEEaSERKS4_
+__ZN3WTF6VectorIN3JSC7JSValueELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF15SegmentedVectorIN3JSC22ArrayAllocationProfileELm8ELm32EE13ensureSegmentEmm
+__ZN3WTF6VectorIPNS0_IN3JSC22ArrayAllocationProfileELm8ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC5LLInt34functionForCallEntryThunkGeneratorEPNS_2VME
+__ZN3JSC5LLInt39functionForCallArityCheckThunkGeneratorEPNS_2VME
+__ZN3JSC7JSStack9pushFrameEPNS_9ExecStateEPNS_9CodeBlockEPNS_7JSScopeEiPNS_8JSObjectE
+__ZN3JSC7JSValue11strictEqualEPNS_9ExecStateES0_S0_
+__ZN3JSC14constructArrayEPNS_9ExecStateEPNS_22ArrayAllocationProfileEPNS_14JSGlobalObjectEPKNS_7JSValueEj
+__ZN3JSC7JSArray22tryCreateUninitializedERNS_2VMEPNS_9StructureEj
+__ZN3JSC8JSObject15initializeIndexERNS_2VMEjNS_7JSValueE
+__ZN3JSC8JSObject26setIndexQuicklyToUndecidedERNS_2VMEjNS_7JSValueE
+__ZN3JSC9Structure21nonPropertyTransitionERNS_2VMEPS0_NS_21NonPropertyTransitionE
+__ZN3JSC8JSObject15setIndexQuicklyERNS_2VMEjNS_7JSValueE
+_JSValueIsNull
+_JSValueIsBoolean
+_JSValueIsNumber
+_JSValueIsString
+_JSValueIsInstanceOfConstructor
+__ZN3JSC8JSObject11hasInstanceEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC16ArrayConstructor18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC21getStaticFunctionSlotINS_16InternalFunctionEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC8JSObject18defaultHasInstanceEPNS_9ExecStateENS_7JSValueES3_
+__ZN3JSC6JSCell9getObjectEv
+__ZN3JSC7JSArray18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+_JSValueToNumber
+_JSObjectGetPropertyAtIndex
+__ZNK3JSC8JSObject3getEPNS_9ExecStateEj
+__ZN3JSC8JSObject25getOwnPropertySlotByIndexEPNS_6JSCellEPNS_9ExecStateEjRNS_12PropertySlotE
+_JSValueToStringCopy
+__ZN14OpaqueJSString6createERKN3WTF6StringE
+_JSStringCopyCFString
+_JSGlobalContextRelease
+__ZN3JSC4Heap9unprotectENS_7JSValueE
+__ZN3WTF7HashMapIPN3JSC6JSCellEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE6removeENS_24HashTableIteratorAdapterINS_9HashTableIS3_NS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorISD_EES5_NS_18HashMapValueTraitsIS7_S8_EES7_EESD_EE
+__ZN3WTF21PageAllocationAligned10deallocateEv
+-[JSWTFMainThreadCaller call]
+__ZN3WTF31dispatchFunctionsFromMainThreadEv
+__ZN3WTF7Unicode18convertUTF16ToUTF8EPPKtS2_PPcS4_b
+__ZN3WTF25TCMalloc_Central_FreeList11ShrinkCacheEib
+__ZN3WTF25TCMalloc_Central_FreeList18ReleaseListToSpansENS_11HardenedSLLE
+__ZN3JSC11CopiedSpace21recycleEvacuatedBlockEPNS_11CopiedBlockE
+__ZN3WTF7HashSetIPN3JSC11CopiedBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE6removeERKS3_
+__ZN3WTF7HashSetIPN3JSC11CopiedBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE6removeENS_29HashTableConstIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorES5_S7_S7_EES3_EE
+__ZN3WTF13StringBuilder6appendEPKtj
+__ZN3JSC24UnlinkedProgramCodeBlock13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC17UnlinkedCodeBlock13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC26UnlinkedFunctionExecutable13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC15WeakHandleOwner26isReachableFromOpaqueRootsENS_6HandleINS_7UnknownEEEPvRNS_11SlotVisitorE
+__ZN3JSC17ProgramExecutable9clearCodeEv
+__ZN3JSC16ProgramCodeBlockD0Ev
+__ZN3JSC9CodeBlockD2Ev
+__ZN3WTF7HashSetIPN3JSC9CodeBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE6removeENS_29HashTableConstIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorES5_S7_S7_EES3_EE
+__ZN3WTF15SegmentedVectorIN3JSC23ObjectAllocationProfileELm8ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC12ArrayProfileELm4ELm0EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC22ArrayAllocationProfileELm8ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC15RareCaseProfileELm8ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC12ValueProfileELm8ELm32EED2Ev
+__ZN3JSC39CompressedLazyOperandValueProfileHolderD1Ev
+__ZN3JSC3DFG11ExitProfileD1Ev
+__ZN3WTF15SegmentedVectorIN3JSC17LLIntCallLinkInfoELm8ELm32EE17deleteAllSegmentsEv
+__ZN3JSC18FunctionExecutable9clearCodeEv
+__ZN3JSC17FunctionCodeBlockD0Ev
+__ZN3JSC9CodeBlock8RareDataD2Ev
+__ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0ENS_15CrashOnOverflowEED1Ev
+__ZN3JSC19SourceProviderCacheD1Ev
+__ZN3JSC19SourceProviderCacheD2Ev
+__ZN3JSC19SourceProviderCache5clearEv
+__ZN3JSC14SourceProviderD2Ev
+_JSContextGetGroup
+_JSContextGetGlobalContext
+_JSWeakObjectMapCreate
+__ZN3JSC14JSGlobalObject15registerWeakMapEP21OpaqueJSWeakObjectMap
+__ZN3WTF9HashTableINS_6RefPtrI21OpaqueJSWeakObjectMapEES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrI21OpaqueJSWeakObjectMapEES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E15deallocateTableEPS3_i
+__ZN3WTF6RefPtrI21OpaqueJSWeakObjectMapEaSERKS2_
+_JSWeakObjectMapGet
+_JSClassCreate
+__ZN13OpaqueJSClass6createEPK17JSClassDefinition
+__ZN13OpaqueJSClassC2EPK17JSClassDefinitionPS_
+__ZN3WTF6OwnPtrINS_7HashMapINS_6RefPtrINS_10StringImplEEENS0_I16StaticValueEntryEENS_10StringHashENS_10HashTraitsIS4_EENS8_IS6_EEEEED2Ev
+__ZN3WTF6OwnPtrINS_7HashMapINS_6RefPtrINS_10StringImplEEENS0_I16StaticValueEntryEENS_10StringHashENS_10HashTraitsIS4_EENS8_IS6_EEEEEaSERKNS_10PassOwnPtrISB_EE
+__ZN3WTF10PassOwnPtrINS_7HashMapINS_6RefPtrINS_10StringImplEEENS_6OwnPtrI16StaticValueEntryEENS_10StringHashENS_10HashTraitsIS4_EENS9_IS7_EEEEED2Ev
+_JSClassRetain
+_JSObjectMake
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE6createEPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureEP13OpaqueJSClassPv
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE4initEPNS_9ExecStateE
+__ZN3JSC6JSLock12DropAllLocksC1EPNS_9ExecStateE
+__ZN3JSC6JSLock12DropAllLocksC2EPNS_9ExecStateE
+_JSObjectGetPrivate
+__ZN3JSC6JSLock12DropAllLocksD1Ev
+__ZN13OpaqueJSClass9prototypeEPN3JSC9ExecStateE
+__ZN13OpaqueJSClass11contextDataEPN3JSC9ExecStateE
+__ZN3WTF9HashTableIP13OpaqueJSClassNS_12KeyValuePairIS2_NS_6OwnPtrI24OpaqueJSClassContextDataEEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSD_IS6_EEEESE_E16lookupForWritingINS_22IdentityHashTranslatorISB_EES2_EENSt3__14pairIPS7_bEERKT0_
+__ZN3WTF9HashTableIP13OpaqueJSClassNS_12KeyValuePairIS2_NS_6OwnPtrI24OpaqueJSClassContextDataEEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSD_IS6_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EES2_NS_10PassOwnPtrIS5_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS2_S7_S9_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIP13OpaqueJSClassNS_12KeyValuePairIS2_NS_6OwnPtrI24OpaqueJSClassContextDataEEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSD_IS6_EEEESE_E6rehashEi
+__ZN24OpaqueJSClassContextDataC2ERN3JSC2VMEP13OpaqueJSClass
+_JSWeakObjectMapSet
+__ZN3WTF9HashTableIPvNS_12KeyValuePairIS1_N3JSC4WeakINS3_8JSObjectEEEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS1_EENS_18HashMapValueTraitsINS_10HashTraitsIS1_EENSD_IS6_EEEESE_E16lookupForWritingINS_22IdentityHashTranslatorISB_EES1_EENSt3__14pairIPS7_bEERKT0_
+__ZN3WTF9HashTableIPvNS_12KeyValuePairIS1_N3JSC4WeakINS3_8JSObjectEEEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS1_EENS_18HashMapValueTraitsINS_10HashTraitsIS1_EENSD_IS6_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EES1_NS3_8PassWeakIS5_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS1_S7_S9_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPvNS_12KeyValuePairIS1_N3JSC4WeakINS3_8JSObjectEEEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS1_EENS_18HashMapValueTraitsINS_10HashTraitsIS1_EENSD_IS6_EEEESE_E6rehashEi
+_JSObjectSetProperty
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN13OpaqueJSClass12staticValuesEPN3JSC9ExecStateE
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI16StaticValueEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EEPS2_NS_10PassOwnPtrIS6_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI16StaticValueEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EES3_NS_10PassOwnPtrIS6_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI16StaticValueEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E6lookupINS_17HashMapTranslatorISG_SB_EEPS2_EEPS8_RKT0_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI16StaticValueEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E6rehashEi
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI16StaticValueEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E8reinsertERS8_
+__ZN13OpaqueJSClass15staticFunctionsEPN3JSC9ExecStateE
+__ZN3JSC8JSObject16putDirectVirtualEPS0_PNS_9ExecStateENS_12PropertyNameENS_7JSValueEj
+__ZN3JSC7JSProxy16putDirectVirtualEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameENS_7JSValueEj
+__ZN3JSC6ParserINS_5LexerIhEEE24parseExpressionStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC10Identifier11addSlowCaseEPNS_2VMEPN3WTF10StringImplE
+__ZN3JSC6ParserINS_5LexerIhEEE24parseFunctionDeclarationINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE17parseFunctionInfoILNS_20FunctionRequirementsE1ELb1ENS_13SyntaxCheckerEEEbRT1_RPKNS_10IdentifierERNS7_19FormalParameterListERNS7_12FunctionBodyERjSH_RiSH_
+__ZN3WTF6VectorINS_6RefPtrINS_10StringImplEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC6ParserINS_5LexerIhEEE19parseVarDeclarationINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE31parseExpressionOrLabelStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE17parseFunctionInfoILNS_20FunctionRequirementsE0ELb0ENS_13SyntaxCheckerEEEbRT1_RPKNS_10IdentifierERNS7_19FormalParameterListERNS7_12FunctionBodyERjSH_RiSH_
+__ZN3JSC6ParserINS_5LexerIhEEE17parseTryStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE17parseForStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE24parseExpressionStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE19parseBreakStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3WTF6VectorIN3JSC15JSTokenLocationELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIiLm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF6VectorINSt3__14pairIiiEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC6ParserINS_5LexerIhEEE19parseWhileStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC5LexerIhE10scanRegExpERPKNS_10IdentifierES5_t
+__ZN3JSC10Identifier20createLCharFromUCharEPNS_2VMEPKti
+__ZN3JSC10Identifier4add8EPNS_2VMEPKti
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterIN3JSC30IdentifierCharBufferTranslatorIhEEEENSA_10CharBufferIhEESF_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterIN3JSC30IdentifierCharBufferTranslatorItEEEENSA_10CharBufferItEESF_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterIN3JSC31IdentifierASCIIStringTranslatorEEEPKhSE_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterIN3JSC34IdentifierLCharFromUCharTranslatorEEENSA_10CharBufferItEESE_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterINS_17CStringTranslatorEEEPKhSD_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterINS_19SubstringTranslatorEEENS_17SubstringLocationESC_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterINS_21LCharBufferTranslatorEEENS_24HashTranslatorCharBufferIhEESD_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterINS_21UCharBufferTranslatorEEENS_24HashTranslatorCharBufferItEESD_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterINS_27HashAndCharactersTranslatorItEEEENS_17HashAndCharactersItEESE_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterINS_31HashAndUTF8CharactersTranslatorEEENS_21HashAndUTF8CharactersESC_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E18addPassingHashCodeINS_24HashSetTranslatorAdapterINS_35CharBufferFromLiteralDataTranslatorEEENS_24HashTranslatorCharBufferIcEESD_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S4_S6_S6_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E20fullLookupForWritingINS_24HashSetTranslatorAdapterIN3JSC30IdentifierCharBufferTranslatorIhEEEENSA_10CharBufferIhEEEENSt3__14pairINSH_IPS2_bEEjEERKT0_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E20fullLookupForWritingINS_24HashSetTranslatorAdapterIN3JSC30IdentifierCharBufferTranslatorItEEEENSA_10CharBufferItEEEENSt3__14pairINSH_IPS2_bEEjEERKT0_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E20fullLookupForWritingINS_24HashSetTranslatorAdapterIN3JSC31IdentifierASCIIStringTranslatorEEEPKhEENSt3__14pairINSG_IPS2_bEEjEERKT0_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E20fullLookupForWritingINS_24HashSetTranslatorAdapterIN3JSC34IdentifierLCharFromUCharTranslatorEEENSA_10CharBufferItEEEENSt3__14pairINSG_IPS2_bEEjEERKT0_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E20fullLookupForWritingINS_24HashSetTranslatorAdapterINS_17CStringTranslatorEEEPKhEENSt3__14pairINSF_IPS2_bEEjEERKT0_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E20fullLookupForWritingINS_24HashSetTranslatorAdapterINS_19SubstringTranslatorEEENS_17SubstringLocationEEENSt3__14pairINSE_IPS2_bEEjEERKT0_
+__ZN3JSC34IdentifierLCharFromUCharTranslator9translateERPN3WTF10StringImplERKNS_10CharBufferItEEj
+__ZN3JSC4Yarr11checkSyntaxERKN3WTF6StringE
+__ZN3JSC4Yarr5parseINS0_13SyntaxCheckerEEEPKcRT_RKN3WTF6StringEj
+__ZN3JSC4Yarr6ParserINS0_13SyntaxCheckerEhE11parseTokensEv
+__ZN3JSC4Yarr6ParserINS0_13SyntaxCheckerEhE11parseEscapeILb0ES2_EEbRT0_
+__ZN3JSC6ParserINS_5LexerIhEEE22parseContinueStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC4Yarr6ParserINS0_13SyntaxCheckerEhE19parseCharacterClassEv
+__ZN3JSC4Yarr6ParserINS0_13SyntaxCheckerEhE11parseEscapeILb1ENS3_28CharacterClassParserDelegateEEEbRT0_
+__ZN3JSC6ParserINS_5LexerIhEEE19parseThrowStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3WTF6VectorIhLm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC6ParserINS_5LexerIhEEE21parseDoWhileStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE20parseSwitchStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE18parseSwitchClausesINS_13SyntaxCheckerEEENT_10ClauseListERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE24parseSwitchDefaultClauseINS_13SyntaxCheckerEEENT_6ClauseERS6_
+__ZN3JSC10Identifier3addItEEN3WTF10PassRefPtrINS2_10StringImplEEEPNS_2VMEPKT_i
+__ZN3JSC10ASTBuilder20makeFunctionCallNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeEPNS_13ArgumentsNodeEijijj
+__ZNK3JSC14ExpressionNode10isLocationEv
+__ZN3JSC21FunctionCallValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitCallEPNS_10RegisterIDES2_NS_16ExpectedFunctionERNS_13CallArgumentsEjjjjj
+__ZN3JSC17BytecodeGenerator8emitCallENS_8OpcodeIDEPNS_10RegisterIDES3_NS_16ExpectedFunctionERNS_13CallArgumentsEjjjjj
+__ZN3JSC16ArgumentListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3WTF15SegmentedVectorIN3JSC12ArrayProfileELm4ELm0EE13ensureSegmentEmm
+__ZN3WTF6VectorIPNS0_IN3JSC12ArrayProfileELm4ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC6ParserINS_5LexerIhEEE24parseFunctionDeclarationINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE17parseFunctionInfoILNS_20FunctionRequirementsE1ELb1ENS_10ASTBuilderEEEbRT1_RPKNS_10IdentifierERNS7_19FormalParameterListERNS7_12FunctionBodyERjSH_RiSH_
+__ZN3JSC5Scope30restoreFromSourceProviderCacheEPKNS_23SourceProviderCacheItemE
+__ZN3JSC10ASTBuilder23createFuncDeclStatementERKNS_15JSTokenLocationEPKNS_10IdentifierEPNS_16FunctionBodyNodeEPNS_13ParameterNodeEjjiij
+__ZN3WTF6VectorIPN3JSC16FunctionBodyNodeELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZNK3JSC14ExpressionNode11isCommaNodeEv
+__ZN3JSC9CommaNodeC2ERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_
+__ZNK3JSC9CommaNode11isCommaNodeEv
+__ZN3JSC9CommaNode6appendEPNS_14ExpressionNodeE
+__ZN3JSC10ASTBuilder11makeAddNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZNK3JSC14ExpressionNode8isNumberEv
+__ZN3JSC10ASTBuilder16appendUnaryTokenERiijjj
+__ZN3JSC10ASTBuilder16createLogicalNotERKNS_15JSTokenLocationEPNS_14ExpressionNodeE
+__ZNK3JSC10NumberNode8isNumberEv
+__ZN3WTF6VectorIPvLm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC14ExpressionNodeELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC6ParserINS_5LexerIhEEE17parseTryStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC17BytecodeGenerator20emitInitLazyRegisterEPNS_10RegisterIDE
+__ZN3WTF6VectorIPN3JSC10RegisterIDELm0ENS_20UnsafeVectorOverflowEE14expandCapacityEm
+__ZN3JSC9ScopeNode8capturesERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator6addVarERKNS_10IdentifierEbRPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitNewFunctionEPNS_10RegisterIDEPNS_16FunctionBodyNodeE
+__ZN3JSC17UnlinkedCodeBlock15addFunctionDeclEPNS_26UnlinkedFunctionExecutableE
+__ZN3JSC17BytecodeGenerator23emitNewFunctionInternalEPNS_10RegisterIDEjb
+__ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_2VMEh
+__ZN3JSC12FuncDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9CommaNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15DotAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11emitGetByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC19FunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10RegExpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11regExpFlagsERKN3WTF6StringE
+__ZN3JSC4Yarr22YarrPatternConstructor12assertionBOLEv
+__ZN3WTF6VectorIN3JSC4Yarr11PatternTermELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEhE21parseParenthesesBeginEv
+__ZN3JSC4Yarr22YarrPatternConstructor30atomParenthesesSubpatternBeginEb
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEhE11parseEscapeILb0ES2_EEbRT0_
+__ZN3JSC4Yarr22YarrPatternConstructor20atomPatternCharacterEt
+__ZN3JSC4Yarr22YarrPatternConstructor25atomBuiltInCharacterClassENS0_23BuiltInCharacterClassIDEb
+__ZN3JSC4Yarr11YarrPattern21newlineCharacterClassEv
+__ZN3JSC4Yarr13newlineCreateEv
+__ZN3WTF6VectorItLm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC4Yarr14CharacterClassEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC4Yarr22YarrPatternConstructor18atomParenthesesEndEv
+__ZN3JSC4Yarr22YarrPatternConstructor12assertionEOLEv
+__ZN3JSC4Yarr22YarrPatternConstructor15copyDisjunctionEPNS0_18PatternDisjunctionEb
+__ZN3JSC4Yarr22YarrPatternConstructor23setupDisjunctionOffsetsEPNS0_18PatternDisjunctionEjj
+__ZN3JSC4Yarr14CharacterClassD2Ev
+__ZN3JSC17BytecodeGenerator13emitNewRegExpEPNS_10RegisterIDEPNS_6RegExpE
+__ZN3JSC17UnlinkedCodeBlock9addRegExpEPNS_6RegExpE
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_6RegExpEEELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEhE19parseCharacterClassEv
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEhE28CharacterClassParserDelegate20atomPatternCharacterEtb
+__ZN3JSC4Yarr25CharacterClassConstructor8putRangeEtt
+__ZN3JSC4Yarr25CharacterClassConstructor14addSortedRangeERN3WTF6VectorINS0_14CharacterRangeELm0ENS2_15CrashOnOverflowEEEtt
+__ZN3WTF6VectorIN3JSC4Yarr14CharacterRangeELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC4Yarr22YarrPatternConstructor21atomCharacterClassEndEv
+__ZNK3JSC10NumberNode7jsValueERNS_17BytecodeGeneratorE
+__ZN3JSC12BinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode5isAddEv
+__ZN3JSC7JSScope13objectAtScopeEPS0_
+__ZN3JSC17BytecodeGenerator12emitBinaryOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_NS_12OperandTypesE
+__ZN3JSC4Yarr11YarrPattern20digitsCharacterClassEv
+__ZNK3JSC11BooleanNode7jsValueERNS_17BytecodeGeneratorE
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEhE11parseEscapeILb1ENS3_28CharacterClassParserDelegateEEEbRT0_
+__ZN3JSC4Yarr25CharacterClassConstructor7putCharEt
+__ZN3JSC4Yarr25CharacterClassConstructor9addSortedERN3WTF6VectorItLm0ENS2_15CrashOnOverflowEEEt
+__ZN3JSC4Yarr11YarrPattern20spacesCharacterClassEv
+__ZN3JSC4Yarr12spacesCreateEv
+__ZN3JSC4Yarr22YarrPatternConstructor12quantifyAtomEjjb
+__ZN3JSC13LogicalOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitJumpIfTrueEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC4Yarr22YarrPatternConstructor21assertionWordBoundaryEb
+__ZN3WTF6OwnPtrIN3JSC4Yarr18PatternDisjunctionEEaSERKNS_10PassOwnPtrIS3_EE
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC4Yarr18PatternAlternativeEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3JSC4Yarr11YarrPattern22wordcharCharacterClassEv
+__ZN3JSC4Yarr14wordcharCreateEv
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEhE28CharacterClassParserDelegate25atomBuiltInCharacterClassENS0_23BuiltInCharacterClassIDEb
+__ZN3JSC4Yarr22YarrPatternConstructor25atomCharacterClassBuiltInENS0_23BuiltInCharacterClassIDEb
+__ZN3JSC4Yarr25CharacterClassConstructor6appendEPKNS0_14CharacterClassE
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC4Yarr18PatternDisjunctionEEELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC15ConditionalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC14ExpressionNode30emitBytecodeInConditionContextERNS_17BytecodeGeneratorEPNS_5LabelES4_NS_15FallThroughModeE
+__ZN3JSC17BytecodeGenerator8emitJumpEPNS_5LabelE
+__ZN3JSC4Yarr22YarrPatternConstructor31atomParentheticalAssertionBeginEb
+__ZNK3JSC7AddNode5isAddEv
+__ZN3JSC12BinaryOpNode10emitStrcatERNS_17BytecodeGeneratorEPNS_10RegisterIDES4_PNS_21ReadModifyResolveNodeE
+__ZNK3JSC10StringNode8isStringEv
+__ZN3JSC17BytecodeGenerator15emitToPrimitiveEPNS_10RegisterIDES2_
+__ZN3JSC17BytecodeGenerator10emitStrcatEPNS_10RegisterIDES2_i
+__ZN3JSC23FunctionCallResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7TryNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator7pushTryEPNS_5LabelE
+__ZN3WTF15SegmentedVectorIN3JSC7TryDataELm8ELm32EE6appendIS2_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC7TryDataELm8ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3WTF6VectorIN3JSC10TryContextELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator18popTryAndEmitCatchEPNS_7TryDataEPNS_10RegisterIDEPNS_5LabelE
+__ZN3WTF6VectorIN3JSC8TryRangeELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator17emitPushNameScopeERKNS_10IdentifierEPNS_10RegisterIDEj
+__ZN3WTF6VectorIN3JSC18ControlFlowContextELm0ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator12emitPopScopeEv
+__ZN3JSC19BracketAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator22willResolveToArgumentsERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator12emitGetByValEPNS_10RegisterIDES2_S2_
+__ZN3WTF6VectorIN3JSC4Yarr14CharacterRangeELm0ENS_15CrashOnOverflowEE6insertIS3_EEvmRKT_
+__ZN3JSC21ThrowableBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC11ResolveNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC9EqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode6isNullEv
+__ZN3JSC17TypeOfResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitResolveBaseEPNS_10RegisterIDERKNS_13ResolveResultERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator11emitUnaryOpENS_8OpcodeIDEPNS_10RegisterIDES3_
+__ZN3JSC17BytecodeGenerator19emitResolveWithThisEPNS_10RegisterIDES2_RKNS_13ResolveResultERKNS_10IdentifierE
+__ZNK3JSC13StatementNode12isReturnNodeEv
+__ZN3JSC17UnlinkedCodeBlock19addExceptionHandlerERKNS_19UnlinkedHandlerInfoE
+__ZN3WTF6VectorIN3JSC19UnlinkedHandlerInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC9CommaNodeD1Ev
+__ZN3WTF6VectorIN3JSC11HandlerInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC9WeakGCMapINSt3__14pairIPNS_8JSObjectEjEENS_9StructureEN3WTF8PairHashIS4_jEENS7_10HashTraitsIS5_EEE5gcMapEv
+__ZN3WTF9HashTableINSt3__14pairIPN3JSC8JSObjectEjEENS_12KeyValuePairIS6_NS3_4WeakINS3_9StructureEEEEENS_24KeyValuePairKeyExtractorISB_EENS_8PairHashIS5_jEENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSH_ISA_EEEESI_E16lookupForWritingINS_22IdentityHashTranslatorISF_EES6_EENS2_IPSB_bEERKT0_
+__ZN3WTF9HashTableINSt3__14pairIPN3JSC8JSObjectEjEENS_12KeyValuePairIS6_NS3_4WeakINS3_9StructureEEEEENS_24KeyValuePairKeyExtractorISB_EENS_8PairHashIS5_jEENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSH_ISA_EEEESI_E3addINS_17HashMapTranslatorISK_SF_EES6_NS3_8PassWeakIS9_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS6_SB_SD_SF_SK_SI_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINSt3__14pairIPN3JSC8JSObjectEjEENS_12KeyValuePairIS6_NS3_4WeakINS3_9StructureEEEEENS_24KeyValuePairKeyExtractorISB_EENS_8PairHashIS5_jEENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSH_ISA_EEEESI_E6lookupINS_22IdentityHashTranslatorISF_EES6_EEPSB_RKT0_
+__ZN3WTF9HashTableINSt3__14pairIPN3JSC8JSObjectEjEENS_12KeyValuePairIS6_NS3_4WeakINS3_9StructureEEEEENS_24KeyValuePairKeyExtractorISB_EENS_8PairHashIS5_jEENS_18HashMapValueTraitsINS_10HashTraitsIS6_EENSH_ISA_EEEESI_E6rehashEi
+__ZNK3JSC7JSValue3getEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZNK3JSC19BracketAccessorNode10isLocationEv
+__ZNK3JSC19BracketAccessorNode21isBracketAccessorNodeEv
+__ZN3JSC17BytecodeGenerator16emitGetStaticVarEPNS_10RegisterIDERKNS_13ResolveResultERKNS_10IdentifierE
+__ZN3JSC4Yarr11YarrPattern25nonwordcharCharacterClassEv
+__ZN3JSC4Yarr17nonwordcharCreateEv
+__ZN3JSC4Yarr22YarrPatternConstructor17atomBackReferenceEj
+__ZNK3JSC7JSScope14isDynamicScopeERb
+__ZN3JSC17AssignBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitPutByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC12RegExpObjectC1EPNS_14JSGlobalObjectEPNS_9StructureEPNS_6RegExpE
+__ZN3JSC17ObjectConstructor18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC21getStaticFunctionSlotINS_8JSObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPS1_NS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC14ArrayPrototype18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC17StringConstructor18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC12StringObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZNK3JSC9Structure14prototypeChainERNS_2VMEPNS_14JSGlobalObjectE
+__ZN3JSC14StructureChainC1ERNS_2VMEPNS_9StructureE
+__ZN3JSC13PropertyTable5cloneERNS_2VMEPNS_6JSCellEjRKS0_
+__ZN3JSC13PropertyTableC2ERNS_2VMEPNS_6JSCellEjRKS0_
+__ZN3JSC6ParserINS_5LexerIhEEE17parseForStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE22parseContinueStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC17BytecodeGenerator29uncheckedRegisterForArgumentsEv
+__ZN3JSC17BytecodeGenerator20emitGetArgumentByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC17BytecodeGenerator22emitGetArgumentsLengthEPNS_10RegisterIDES2_
+__ZN3JSC11UnaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8ThisNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10PrefixNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10PrefixNode11emitResolveERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator7emitDecEPNS_10RegisterIDE
+__ZN3JSC7ForNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13newLabelScopeENS_10LabelScope4TypeEPKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator12emitLoopHintEv
+__ZNK3JSC8NullNode7jsValueERNS_17BytecodeGeneratorE
+__ZNK3JSC8NullNode6isNullEv
+__ZN3JSC9ForInNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator20emitGetPropertyNamesEPNS_10RegisterIDES2_S2_S2_PNS_5LabelE
+__ZN3JSC17BytecodeGenerator18pushOptimisedForInEPNS_10RegisterIDES2_S2_S2_
+__ZN3WTF6VectorIN3JSC12ForInContextELm0ENS_15CrashOnOverflowEE14appendSlowCaseIS2_EEvRKT_
+__ZN3WTF6VectorIN3JSC12ForInContextELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF11VectorMoverILb0EN3JSC12ForInContextEE4moveEPKS2_S5_PS2_
+__ZNK3JSC12ContinueNode10isContinueEv
+__ZN3JSC17BytecodeGenerator14continueTargetERKNS_10IdentifierE
+__ZN3JSC13LogicalOpNode30emitBytecodeInConditionContextERNS_17BytecodeGeneratorEPNS_5LabelES4_NS_15FallThroughModeE
+__ZN3JSC17BytecodeGenerator20emitNextPropertyNameEPNS_10RegisterIDES2_S2_S2_S2_PNS_5LabelE
+__ZN3JSC11PostfixNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11PostfixNode11emitResolveERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator7emitIncEPNS_10RegisterIDE
+__ZN3JSC6JSCell11getCallDataEPS0_RNS_8CallDataE
+__ZN3JSC8JSObject16getPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC8JSObject19getOwnPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC8JSObject27getOwnNonIndexPropertyNamesEPS0_PNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3WTF6VectorIN3JSC10IdentifierELm20ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC13jsOwnedStringEPNS_2VMERKN3WTF6StringE
+__ZN3JSC9Structure16allocateRareDataERNS_2VME
+__ZN3JSC17StructureRareData6createERNS_2VMEPNS_9StructureE
+__ZN3JSC5LLInt8getByValEPNS_9ExecStateENS_7JSValueES3_
+__ZN3JSC8JSString18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSCL20stringProtoFuncSplitEPNS_9ExecStateE
+__ZN3JSC7JSArray6createERNS_2VMEPNS_9StructureEj
+__ZN3JSC11jsSubstringEPNS_2VMERKN3WTF6StringEjj
+__ZN3JSC8JSObject32putDirectIndexBeyondVectorLengthEPNS_9ExecStateEjNS_7JSValueEjNS_18PutDirectIndexModeE
+__ZN3JSC8JSObject45putByIndexBeyondVectorLengthWithoutAttributesILh26EEEvPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC8JSObject16ensureLengthSlowERNS_2VMEj
+__ZN3JSC11CopiedSpace13tryReallocateEPPvmm
+__ZN3JSC6ParserINS_5LexerIhEEE19parseBreakStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3WTF6VectorIPN3JSC14ExpressionNodeELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZNK3JSC9BreakNode7isBreakEv
+__ZN3JSC17BytecodeGenerator11breakTargetERKNS_10IdentifierE
+__ZN3JSC24ApplyFunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode13isSimpleArrayEv
+__ZN3JSC17BytecodeGenerator26emitJumpIfNotFunctionApplyEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC17BytecodeGenerator15emitCallVarargsEPNS_10RegisterIDES2_S2_S2_S2_S2_jjjjj
+__ZN3JSCL16emitPostIncOrDecERNS_17BytecodeGeneratorEPNS_10RegisterIDES3_NS_8OperatorE
+__ZN3JSC23CallFunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator25emitJumpIfNotFunctionCallEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC9CodeBlock20getOrAddArrayProfileEj
+__ZN3WTF15SegmentedVectorIN3JSC12ArrayProfileELm4ELm0EE6appendIS2_EEvRKT_
+__ZNK3JSC14ExpressionNode10isSubtractEv
+__ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSC8JSObject9classNameEPKS0_
+__ZN3WTF13tryMakeStringIPKcNS_6StringES2_EENS_10PassRefPtrINS_10StringImplEEET_T0_T1_
+__ZN3JSCL26stringProtoFuncToLowerCaseEPNS_9ExecStateE
+__ZNK3JSC12JSRopeString11resolveRopeEPNS_9ExecStateE
+__ZN3JSC9CodeBlock32updateAllValueProfilePredictionsENS_19OperationInProgressE
+__ZN3JSC9CodeBlock36updateAllPredictionsAndCountLivenessENS_19OperationInProgressERjS2_
+__ZN3JSC16ValueProfileBaseILj1EE24computeUpdatedPredictionENS_19OperationInProgressE
+__ZN3JSC20speculationFromValueENS_7JSValueE
+__ZN3JSC39CompressedLazyOperandValueProfileHolder25computeUpdatedPredictionsENS_19OperationInProgressE
+__ZN3JSC16ExecutionCounter29checkIfThresholdCrossedAndSetEPNS_9CodeBlockE
+__ZN3JSC17FunctionCodeBlock14jitCompileImplEPNS_9ExecStateE
+__ZN3JSC18FunctionExecutable17jitCompileForCallEPNS_9ExecStateE
+__ZN3JSC31jitCompileFunctionIfAppropriateEPNS_9ExecStateERN3WTF6OwnPtrINS_17FunctionCodeBlockEEERNS_7JITCodeERNS_21MacroAssemblerCodePtrENS7_7JITTypeEjNS_20JITCompilationEffortE
+__ZN3JSC9CodeBlock19unlinkIncomingCallsEv
+__ZN3JSC3JIT14privateCompileEPNS_21MacroAssemblerCodePtrENS_20JITCompilationEffortE
+__ZN3JSC17FunctionCodeBlock25canCompileWithDFGInternalEv
+__ZN3JSC3DFG27mightCompileFunctionForCallEPNS_9CodeBlockE
+__ZN3JSC3DFG17canCompileOpcodesEPNS_9CodeBlockE
+__ZN3JSC3DFG16canHandleOpcodesINS0_15CapabilityLevelEXadL_ZNS0_16canCompileOpcodeENS_8OpcodeIDEPNS_9CodeBlockEPNS_11InstructionEEEEET_S5_S8_
+__ZN3JSC20MacroAssemblerX86_648branch64ENS_23MacroAssemblerX86Common19RelationalConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15AbsoluteAddressENS_12X86Registers10RegisterIDE
+__ZN3JSC20MacroAssemblerX86_648branch64ENS_23MacroAssemblerX86Common19RelationalConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressENS5_12TrustedImm64E
+__ZN3JSC3JIT22privateCompileMainPassEv
+__ZN3JSC3JIT13emit_op_enterEPNS_11InstructionE
+__ZN3JSC3JIT26emitEnterOptimizationCheckEv
+__ZN3JSC20MacroAssemblerX86_6411branchAdd32ENS_23MacroAssemblerX86Common15ResultConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32ENS5_15AbsoluteAddressE
+__ZN3JSC11JITStubCall11addArgumentENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32E
+__ZN3JSC11JITStubCall4callEv
+__ZN3JSC20MacroAssemblerX86_644callEv
+__ZN3JSC20MacroAssemblerX86_6413moveWithPatchENS_22AbstractMacroAssemblerINS_12X86AssemblerEE13TrustedImmPtrENS_12X86Registers10RegisterIDE
+__ZN3JSC12X86Assembler9movq_i64rExNS_12X86Registers10RegisterIDE
+__ZN3WTF6VectorIN3JSC10CallRecordELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT22emit_op_get_scoped_varEPNS_11InstructionE
+__ZN3JSC3JIT22emitValueProfilingSiteEv
+__ZN3WTF16binarySearchImplIN3JSC12ValueProfileEiNS_15SegmentedVectorIS2_Lm8ELm32EEEPFiPS2_ELNS_16BinarySearchModeE0EEEPT_RT1_mT0_RKT2_
+__ZN3JSC29getValueProfileBytecodeOffsetINS_12ValueProfileEEEiPT_
+__ZN3JSC3JIT11emit_op_movEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_to_primitiveEPNS_11InstructionE
+__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT14emit_op_strcatEPNS_11InstructionE
+__ZN3JSC11JITStubCall4callEj
+__ZN3JSC3JIT17emit_op_get_by_idEPNS_11InstructionE
+__ZN3JSC3JIT21compileGetByIdHotPathEiPNS_10IdentifierE
+__ZN3JSC20MacroAssemblerX86_6435load64WithCompactAddressOffsetPatchENS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressENS_12X86Registers10RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter17oneByteOp64_disp8ENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDEi
+__ZN3WTF6VectorIN3JSC27PropertyStubCompilationInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT12emit_op_callEPNS_11InstructionE
+__ZN3JSC3JIT13compileOpCallENS_8OpcodeIDEPNS_11InstructionEj
+__ZN3WTF6VectorIN3JSC28StructureStubCompilationInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT23emit_op_call_put_resultEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_put_by_valEPNS_11InstructionE
+__ZN3JSC3JIT22emitArrayProfilingSiteENS_12X86Registers10RegisterIDES2_PNS_12ArrayProfileE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_12X86Registers10RegisterIDEi
+__ZN3JSC12ArrayProfile24computeUpdatedPredictionEPNS_9CodeBlockENS_19OperationInProgressE
+__ZN3JSC3JIT29emitGenericContiguousPutByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpEh
+__ZN3JSC23MacroAssemblerX86Common8branch32ENS0_19RelationalConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32E
+__ZN3JSC20MacroAssemblerX86_646store8ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32EPv
+__ZN3WTF12VectorBufferIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm2EE4swapERS6_
+__ZN3WTF6VectorIN3JSC20ByValCompilationInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT11emit_op_retEPNS_11InstructionE
+__ZN3JSC3JIT22privateCompileLinkPassEv
+__ZN3JSC3JIT23privateCompileSlowCasesEv
+__ZN3WTF15SegmentedVectorIN3JSC15RareCaseProfileELm8ELm32EE6appendIS2_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC15RareCaseProfileELm8ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC3JIT24emitSlow_op_to_primitiveEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC20MacroAssemblerX86_645add32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32ENS3_15AbsoluteAddressE
+__ZN3JSC3JIT21emitSlow_op_get_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22compileGetByIdSlowCaseEiiPNS_10IdentifierERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT16emitSlow_op_callEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21compileOpCallSlowCaseENS_8OpcodeIDEPNS_11InstructionERPNS_13SlowCaseEntryEj
+__ZN3JSC17linkCallGeneratorEPNS_2VME
+__ZN3JSCL16linkForGeneratorEPNS_2VMENS_11FunctionPtrES2_PKc
+__ZN3JSCL19generateSlowCaseForEPNS_2VMERNS_14JSInterfaceJITE
+__ZN3JSC3JIT22emitSlow_op_put_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC11JITStubCall11addArgumentEjNS_12X86Registers10RegisterIDE
+__ZN3WTF6VectorIN3JSC32CallReturnOffsetToBytecodeOffsetELm0ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF11VectorMoverILb0EN3JSC17StructureStubInfoEE4moveEPKS2_S5_PS2_
+__ZN3WTF6VectorIN3JSC9ByValInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC12CallLinkInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC9CodeBlock11shrinkToFitENS0_10ShrinkModeE
+__ZN3WTF6VectorIPNS0_IN3JSC17LLIntCallLinkInfoELm8ENS_15CrashOnOverflowEEELm0ES3_E14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC12CallLinkInfoELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIPNS0_IN3JSC15RareCaseProfileELm8ENS_15CrashOnOverflowEEELm0ES3_E14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC11HandlerInfoELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC32CallReturnOffsetToBytecodeOffsetELm0ENS_20UnsafeVectorOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIPNS0_IN3JSC15InlineCallFrameELm4ENS_15CrashOnOverflowEEELm0ES3_E14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC28CodeOriginAtCallReturnOffsetELm0ENS_20UnsafeVectorOverflowEE14shrinkCapacityEm
+_cti_op_strcat
+_cti_op_get_by_id
+_cti_vm_lazyLinkCall
+__ZN3JSC11lazyLinkForEPNS_9ExecStateENS_22CodeSpecializationKindE
+_cti_op_put_by_val
+__ZN3JSCL8putByValEPNS_9ExecStateENS_7JSValueES2_S2_
+__ZN3JSC12RegExpObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC18getStaticValueSlotINS_12RegExpObjectENS_8JSObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPT_NS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC15RegExpPrototype18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSCL19regExpProtoFuncExecEPNS_9ExecStateE
+__ZN3JSC12RegExpObject4execEPNS_9ExecStateEPNS_8JSStringE
+__ZN3JSC12RegExpObject5matchEPNS_9ExecStateEPNS_8JSStringE
+__ZN3JSC6RegExp5matchERNS_2VMERKN3WTF6StringEj
+__ZN3JSC6RegExp16compileMatchOnlyEPNS_2VMENS_4Yarr12YarrCharSizeE
+__ZN3JSC11RegExpCache16addToStrongCacheEPNS_6RegExpE
+__ZN3JSC4Yarr10jitCompileERNS0_11YarrPatternENS0_12YarrCharSizeEPNS_2VMERNS0_13YarrCodeBlockENS0_18YarrJITCompileModeE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE7compileEPNS_2VMERNS0_13YarrCodeBlockE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE13generateEnterEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE10checkInputEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE14generateReturnEv
+__ZN3JSC14MacroAssembler6subPtrENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE13opCompileBodyEPNS0_18PatternDisjunctionE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE20opCompileAlternativeEPNS0_18PatternAlternativeE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE19optimizeAlternativeEPNS0_18PatternAlternativeE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE30opCompileParenthesesSubpatternEPNS0_11PatternTermE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE8generateEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE22jumpIfNoAvailableInputEj
+__ZN3JSC14MacroAssembler5add32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE12generateTermEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE28generatePatternCharacterOnceEm
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDES4_ii
+__ZN3JSC14MacroAssembler8branch32ENS_23MacroAssemblerX86Common19RelationalConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32E
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE26generateCharacterClassOnceEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE19matchCharacterClassENS_12X86Registers10RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPKNS0_14CharacterClassE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE24matchCharacterClassRangeENS_12X86Registers10RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListESA_PKNS0_14CharacterRangeEjPjPKtj
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE28generateCharacterClassGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE12atEndOfInputEv
+__ZN3JSC14MacroAssembler6addPtrENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE9backtrackEv
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6appendERKS3_
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE13backtrackTermEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE29backtrackCharacterClassGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE17BacktrackingState4linkEPNS_14MacroAssemblerE
+__ZN3JSC14MacroAssembler5sub32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EED2Ev
+__ZN3JSC18RegExpMatchesArray6createEPNS_9ExecStateEPNS_8JSStringEPNS_6RegExpE11MatchResult
+__ZNK3JSC7JSValue3getEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC18RegExpMatchesArray25getOwnPropertySlotByIndexEPNS_6JSCellEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC18RegExpMatchesArray18reifyAllPropertiesEPNS_9ExecStateE
+__ZN3JSC18RegExpMatchesArray18reifyMatchPropertyEPNS_9ExecStateE
+__ZN3JSC6RegExp5matchERNS_2VMERKN3WTF6StringEjRNS3_6VectorIiLm32ENS3_15CrashOnOverflowEEE
+__ZN3JSC6RegExp7compileEPNS_2VMENS_4Yarr12YarrCharSizeE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE7compileEPNS_2VMERNS0_13YarrCodeBlockE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE13generateEnterEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE10checkInputEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE14generateReturnEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE13opCompileBodyEPNS0_18PatternDisjunctionE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE20opCompileAlternativeEPNS0_18PatternAlternativeE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE19optimizeAlternativeEPNS0_18PatternAlternativeE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE30opCompileParenthesesSubpatternEPNS0_11PatternTermE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE8generateEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE22jumpIfNoAvailableInputEj
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE12generateTermEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE28generatePatternCharacterOnceEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE26generateCharacterClassOnceEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE19matchCharacterClassENS_12X86Registers10RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPKNS0_14CharacterClassE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE24matchCharacterClassRangeENS_12X86Registers10RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListESA_PKNS0_14CharacterRangeEjPjPKtj
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE28generateCharacterClassGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE12atEndOfInputEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE9backtrackEv
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE13backtrackTermEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE29backtrackCharacterClassGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE17BacktrackingState4linkEPNS_14MacroAssemblerE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EED2Ev
+__ZN3JSC7JSArray3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZNK3JSC8JSString9toBooleanEv
+__ZN3JSCL19regExpProtoFuncTestEPNS_9ExecStateE
+__ZNK3JSC18EmptyStatementNode16isEmptyStatementEv
+__ZN3JSC10ASTBuilder11makeSubNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSC14ExpressionNode14stripUnaryPlusEv
+__ZN3JSC14LogicalNotNode30emitBytecodeInConditionContextERNS_17BytecodeGeneratorEPNS_5LabelES4_NS_15FallThroughModeE
+__ZN3JSC14InstanceOfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator20emitCheckHasInstanceEPNS_10RegisterIDES2_S2_PNS_5LabelE
+__ZN3JSC17BytecodeGenerator14emitInstanceOfEPNS_10RegisterIDES2_S2_
+__ZN3JSC8JSObject10putByIndexEPNS_6JSCellEPNS_9ExecStateEjNS_7JSValueEb
+__ZN3JSC8JSObject28putByIndexBeyondVectorLengthEPNS_9ExecStateEjNS_7JSValueEb
+__ZNK3JSC9Structure20needsSlowPutIndexingEv
+__ZN3JSC8JSObject23createInitialContiguousERNS_2VMEj
+__ZN3JSC9Butterfly22createOrGrowArrayRightEPS0_RNS_2VMEPNS_9StructureEmbmm
+__ZN3JSC10ASTBuilder14makeDeleteNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeEiiijj
+__ZN3JSC13DeleteDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitDeleteByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC15TypeOfValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE19jumpIfCharNotEqualsEtiNS_12X86Registers10RegisterIDE
+__ZN3WTF4dtoaEPcdRbRiRj
+__ZN3WTF4dtoaILb1ELb0ELb0ELb1EEEvPcdiRbRiRj
+__ZN3WTFL4multERNS_6BigIntERKS0_
+__ZN3WTF6VectorIjLm16ENS_15CrashOnOverflowEEaSERKS2_
+__ZNK3WTF13DecimalNumber28bufferLengthForStringDecimalEv
+__ZNK3WTF13DecimalNumber15toStringDecimalEPhj
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE20generateAssertionBOLEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE17BacktrackingState6linkToENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5LabelEPNS_14MacroAssemblerE
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6linkToENS2_5LabelEPS2_
+__ZN3JSC8JSObject14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC8JSObject29reifyStaticFunctionsForDeleteEPNS_9ExecStateE
+__ZN3JSC9Structure33toUncacheableDictionaryTransitionERNS_2VMEPS0_
+__ZN3JSC9Structure22toDictionaryTransitionERNS_2VMEPS0_NS0_14DictionaryKindE
+__ZNK3JSC8JSObject21findPropertyHashEntryEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC7JSScope15resolveWithThisEPNS_9ExecStateERKNS_10IdentifierEPNS_8RegisterEPN3WTF6VectorINS_16ResolveOperationELm0ENS8_15CrashOnOverflowEEE
+__ZN3JSC7JSScope30resolveContainingScopeInternalILNS0_10LookupModeE0ELNS0_12ReturnValuesE5EEEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotEPN3WTF6VectorINS_16ResolveOperationELm0ENSD_15CrashOnOverflowEEEPNS_18PutToBaseOperationEb
+__ZN3JSC18globalFuncParseIntEPNS_9ExecStateE
+__ZN3JSC13PropertyTable14findWithStringERKPN3WTF10StringImplE
+__ZN3JSC17BytecodeGenerator16emitPutStaticVarERKNS_13ResolveResultERKNS_10IdentifierEPNS_10RegisterIDE
+__ZN3JSC9WeakGCMapINSt3__14pairIN3WTF6RefPtrINS3_10StringImplEEEjEENS_9StructureENS_24StructureTransitionTable4HashENS3_10HashTraitsIS7_EEE5gcMapEv
+__ZN3JSC17BytecodeGenerator26createArgumentsIfNecessaryEv
+__ZN3JSC9Arguments14finishCreationEPNS_9ExecStateE
+__ZNK3JSC26UnlinkedFunctionExecutable14parameterCountEv
+__ZN3JSC9Arguments7tearOffEPNS_9ExecStateE
+__ZN3JSC9Arguments18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC9Arguments25getOwnPropertySlotByIndexEPNS_6JSCellEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSCL18arrayProtoFuncPushEPNS_9ExecStateE
+__ZN3JSC7JSArray4pushEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC8JSObject24convertUndecidedForValueERNS_2VMENS_7JSValueE
+__ZN3JSC10MathObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSCL19mathProtoFuncRandomEPNS_9ExecStateE
+__ZNK3JSC7JSValue16toStringSlowCaseEPNS_9ExecStateE
+__ZN3WTF6String24numberToStringECMAScriptEd
+__ZN3WTF14numberToStringEdPc
+__ZN3WTF17double_conversion23DoubleToStringConverter19EcmaScriptConverterEv
+__ZNK3WTF17double_conversion23DoubleToStringConverter10ToShortestEdPNS0_13StringBuilderE
+__ZN3WTF17double_conversion8FastDtoaEdNS0_12FastDtoaModeEiNS0_15BufferReferenceIcEEPiS4_
+__ZN3WTF17double_conversion16PowersOfTenCache36GetCachedPowerForBinaryExponentRangeEiiPNS0_5DiyFpEPi
+__ZN3WTF17double_conversion5DiyFp8MultiplyERKS1_
+__ZNK3WTF17double_conversion23DoubleToStringConverter27CreateDecimalRepresentationEPKciiiPNS0_13StringBuilderE
+__ZN3JSCL22stringProtoFuncReplaceEPNS_9ExecStateE
+__ZN3JSCL24replaceUsingRegExpSearchEPNS_9ExecStateEPNS_8JSStringENS_7JSValueE
+__ZN3JSCL23removeUsingRegExpSearchEPNS_9ExecStateEPNS_8JSStringERKN3WTF6StringEPNS_6RegExpE
+__ZN3JSC3JIT21emit_op_init_lazy_regEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_convert_thisEPNS_11InstructionE
+__ZN3JSC3JIT27emit_op_get_argument_by_valEPNS_11InstructionE
+__ZN3JSC14MacroAssembler4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm64ENS_12X86Registers10RegisterIDE
+__ZN3JSC14MacroAssembler11shouldBlindENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm64E
+__ZN3JSC3JIT13emit_op_jtrueEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_648branch64ENS_23MacroAssemblerX86Common19RelationalConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm64E
+__ZN3WTF6VectorIN3JSC9JumpTableELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT18emit_op_new_objectEPNS_11InstructionE
+__ZN3JSC3JIT20emitAllocateJSObjectINS_22AbstractMacroAssemblerINS_12X86AssemblerEE13TrustedImmPtrEEEvNS_12X86Registers10RegisterIDET_S7_S7_
+__ZN3JSC3JIT28emit_op_get_arguments_lengthEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_is_booleanEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_646test64ENS_23MacroAssemblerX86Common15ResultConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32ES4_
+__ZN3JSC12X86Assembler23X86InstructionFormatter10twoByteOp8ENS0_15TwoByteOpcodeIDENS0_13GroupOpcodeIDENS_12X86Registers10RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter10twoByteOp8ENS0_15TwoByteOpcodeIDENS_12X86Registers10RegisterIDES4_
+__ZN3JSC3JIT14emit_op_jfalseEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_notEPNS_11InstructionE
+__ZN3JSC3JIT16emit_op_stricteqEPNS_11InstructionE
+__ZN3JSC3JIT17compileOpStrictEqEPNS_11InstructionENS0_21CompileOpStrictEqTypeE
+__ZN3JSC3JIT11emit_op_decEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_jnlessEPNS_11InstructionE
+__ZN3JSC3JIT19emit_compareAndJumpENS_8OpcodeIDEjjjNS_23MacroAssemblerX86Common19RelationalConditionE
+__ZN3JSC3JIT17emit_op_loop_hintEPNS_11InstructionE
+__ZN3JSC8Watchdog9isEnabledEv
+__ZN3JSC3JIT16emit_op_jeq_nullEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_jmpEPNS_11InstructionE
+__ZN3JSC3JIT22compileGetDirectOffsetENS_12X86Registers10RegisterIDES2_S2_S2_NS0_15FinalObjectModeE
+__ZN3JSC3JIT17emit_op_new_arrayEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_nstricteqEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_incEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_jlessEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_convert_thisEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT31emitSlow_op_get_argument_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC14MacroAssembler7store64ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm64ENS3_7AddressE
+__ZN3JSC11JITStubCall22callWithValueProfilingEj
+__ZN3JSC3JIT17emitSlow_op_jtrueEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22emitSlow_op_new_objectEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT32emitSlow_op_get_arguments_lengthEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT18emitSlow_op_jfalseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_notEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT20emitSlow_op_stricteqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_decEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT18emitSlow_op_jnlessEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT23emit_compareAndJumpSlowEjjjNS_23MacroAssemblerX86Common15DoubleConditionEPFiPPvEbRPNS_13SlowCaseEntryE
+__ZN3JSC12X86Assembler23X86InstructionFormatter11twoByteOp64ENS0_15TwoByteOpcodeIDEiNS_12X86Registers10RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common12branchDoubleENS0_15DoubleConditionENS_12X86Registers13XMMRegisterIDES3_
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_12X86Registers10RegisterIDE
+__ZN3JSC3JIT21emitSlow_op_nstricteqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_incEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT17emitSlow_op_jlessEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3WTF9HashTableImNS_12KeyValuePairImmEENS_24KeyValuePairKeyExtractorIS2_EENS_7IntHashImEENS_18HashMapValueTraitsINS_10HashTraitsImEES9_EES9_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EEmEENSt3__14pairIPS2_bEERKT0_
+__ZN3WTF9HashTableImNS_12KeyValuePairImmEENS_24KeyValuePairKeyExtractorIS2_EENS_7IntHashImEENS_18HashMapValueTraitsINS_10HashTraitsImEES9_EES9_E3addINS_17HashMapTranslatorISA_S6_EEmmEENS_18HashTableAddResultINS_17HashTableIteratorImS2_S4_S6_SA_S9_EEEERKT0_RKT1_
+__ZN3JSC17CompactJITCodeMap7Decoder4readERjS2_
+_cti_op_get_by_val_generic
+__ZN3JSCL8getByValEPNS_9ExecStateENS_7JSValueES2_NS_16ReturnAddressPtrE
+_cti_op_stricteq
+_cti_op_jtrue
+_cti_op_is_object_or_null
+__ZN3JSC8JSString12toThisObjectEPNS_6JSCellEPNS_9ExecStateE
+__ZN3JSC12StringObjectC1ERNS_2VMEPNS_9StructureE
+__ZNK3JSC6JSCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSC8JSObject12defaultValueEPKS0_PNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSC9ExecState19frameExtentInternalEv
+__ZN3JSCL23stringProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE17BacktrackingState6appendERKNS_22AbstractMacroAssemblerINS_12X86AssemblerEE12DataLabelPtrE
+__ZN3JSC3JIT25emit_op_create_activationEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_new_func_expEPNS_11InstructionE
+__ZN3JSC3JIT27emit_op_tear_off_activationEPNS_11InstructionE
+_cti_op_push_activation
+_cti_op_new_func_exp
+_cti_op_tear_off_activation
+__ZN3JSCL15tryCacheGetByIDEPNS_9ExecStateEPNS_9CodeBlockENS_16ReturnAddressPtrENS_7JSValueERKNS_10IdentifierERKNS_12PropertySlotEPNS_17StructureStubInfoE
+__ZN3JSC3JIT16patchGetByIdSelfEPNS_9CodeBlockEPNS_17StructureStubInfoEPNS_9StructureEiNS_16ReturnAddressPtrE
+__ZN3JSC27ctiPatchCallByReturnAddressEPNS_9CodeBlockENS_16ReturnAddressPtrENS_11FunctionPtrE
+__ZN3JSC3JIT26privateCompileGetByIdProtoEPNS_17StructureStubInfoEPNS_9StructureES4_RKNS_10IdentifierERKNS_12PropertySlotEiNS_16ReturnAddressPtrEPNS_9ExecStateE
+__ZN3JSC30WatchpointsOnStructureStubInfo31ensureReferenceAndAddWatchpointERN3WTF6RefPtrIS0_EEPNS_9CodeBlockEPNS_17StructureStubInfoE
+__ZN3JSC19InlineWatchpointSet3addEPNS_10WatchpointE
+__ZN3JSC20createJITStubRoutineERKNS_21MacroAssemblerCodeRefERNS_2VMEPKNS_6JSCellEb
+__ZN3JSC3JIT7linkForEPNS_10JSFunctionEPNS_9CodeBlockES4_NS_21MacroAssemblerCodePtrEPNS_12CallLinkInfoEPNS_2VMENS_22CodeSpecializationKindE
+__ZN3JSC24linkClosureCallGeneratorEPNS_2VME
+_cti_op_get_by_id_self_fail
+__ZN3JSC3JIT29privateCompileGetByIdSelfListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureERKNS_10IdentifierERKNS_12PropertySlotEi
+__ZN3JSC3JIT16emit_op_jneq_ptrEPNS_11InstructionE
+__ZN3JSC16actualPointerForEPNS_9CodeBlockENS_7Special7PointerE
+__ZN3JSC3JIT20emit_op_call_varargsEPNS_11InstructionE
+__ZN3JSC3JIT18compileLoadVarargsEPNS_11InstructionE
+__ZN3JSC14MacroAssembler7store32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS3_7AddressE
+__ZN3JSC3JIT17emit_op_to_numberEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_get_by_valEPNS_11InstructionE
+__ZN3JSC3JIT22emitContiguousGetByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpEh
+__ZN3JSC3JIT24emitSlow_op_call_varargsEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_to_numberEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22emitSlow_op_get_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT27stringGetByValStubGeneratorEPNS_2VME
+__ZN3JSC13jsAddSlowCaseEPNS_9ExecStateENS_7JSValueES2_
+__ZNK3JSC8JSString11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3WTF10StringImpl4findEPS0_
+__ZN3JSCL18arrayProtoFuncSortEPNS_9ExecStateE
+__ZN3JSCL15attemptFastSortEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERNS_8CallDataERNS_8CallTypeE
+__ZN3JSC7JSArray4sortEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3JSC7JSArray10sortVectorILh21EEEvPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3JSC11Interpreter20prepareForRepeatCallEPNS_18FunctionExecutableEPNS_9ExecStateEPNS_10JSFunctionEiPNS_7JSScopeE
+__ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE6insertEi
+__ZN3JSC32AVLTreeAbstractorForArrayCompare15compare_key_keyENS_7JSValueES1_
+__ZN3JSC11Interpreter7executeERNS_16CallFrameClosureE
+__ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE8IteratorppEv
+__ZN3JSC11Interpreter13endRepeatCallERNS_16CallFrameClosureE
+__ZN3JSCL18regExpObjectSourceEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC17RegExpConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL30constructWithRegExpConstructorEPNS_9ExecStateE
+__ZN3JSC15constructRegExpEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_7ArgListEb
+_getHostCallReturnValue
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE19jumpIfCharNotEqualsEtiNS_12X86Registers10RegisterIDE
+__ZN3JSC12jsSubstring8EPNS_2VMERKN3WTF6StringEjj
+__ZNK3JSC7JSValue16toNumberSlowCaseEPNS_9ExecStateE
+__ZNK3JSC6JSCell8toNumberEPNS_9ExecStateE
+__ZNK3JSC8JSString8toNumberEPNS_9ExecStateE
+__ZN3JSC10jsToNumberERKN3WTF6StringE
+__ZN3WTF6String6numberEj
+__ZN3JSCL19arrayProtoFuncSliceEPNS_9ExecStateE
+__ZNK3JSC7JSValue9toIntegerEPNS_9ExecStateE
+__ZN3JSCL11getPropertyEPNS_9ExecStateEPNS_8JSObjectEj
+__ZN3JSC7JSArray9setLengthEPNS_9ExecStateEjb
+__ZN3JSC15DateConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL28constructWithDateConstructorEPNS_9ExecStateE
+__ZN3JSC13constructDateEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_7ArgListE
+__ZN3JSC12DateInstanceC1EPNS_9ExecStateEPNS_9StructureE
+__ZN3JSC12DateInstance14finishCreationERNS_2VMEd
+__ZN3WTF8timeClipEd
+__ZN3JSC13DatePrototype18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSCL20dateProtoFuncGetTimeEPNS_9ExecStateE
+__ZNK3JSC12JSRopeString20resolveRopeSlowCase8EPh
+__ZNK3WTF6String8foldCaseEv
+__ZN3WTF10StringImpl8foldCaseEv
+__ZN3JSC10JSFunction27getOwnNonIndexPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC11Interpreter24addStackTraceIfNecessaryEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC11Interpreter13getStackTraceEPNS_2VMERN3WTF6VectorINS_10StackFrameELm0ENS3_15CrashOnOverflowEEEm
+__ZN3JSC9ExecState13trueCallFrameENS_10AbstractPCE
+__ZN3WTF6VectorIN3JSC10StackFrameELm0ENS_15CrashOnOverflowEE14appendSlowCaseIS2_EEvRKT_
+__ZN3WTF6VectorIN3JSC10StackFrameELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC6StrongINS_8JSObjectEEC2ERKS2_
+__ZN3JSC6StrongINS_14ExecutableBaseEEC2ERKS2_
+__ZN3JSC6StrongINS_17UnlinkedCodeBlockEEC2ERKS2_
+__ZN3JSC10StackFrameD2Ev
+__ZN3JSCL13getCallerInfoEPNS_2VMEPNS_9ExecStateERjRPNS_9CodeBlockE
+__ZN3JSC9ExecState15trueCallerFrameEv
+__ZN3JSC9CodeBlock14bytecodeOffsetEPNS_9ExecStateENS_16ReturnAddressPtrE
+__ZNK3JSC9ExecState10currentVPCEv
+__ZN3WTF15RefCountedArrayIN3JSC10StackFrameEEC2ERKNS_6VectorIS2_Lm0ENS_15CrashOnOverflowEEE
+__ZN3JSC30isTerminatedExecutionExceptionENS_7JSValueE
+__ZN3JSC10StackFrame8toStringEPNS_9ExecStateE
+__ZNK3JSC10StackFrame20friendlyFunctionNameEPNS_9ExecStateE
+__ZN3JSC24getCalculatedDisplayNameEPNS_9ExecStateEPNS_8JSObjectE
+__ZN3JSC10JSFunction21calculatedDisplayNameEPNS_9ExecStateE
+__ZN3JSC10JSFunction11displayNameEPNS_9ExecStateE
+__ZNK3JSC10StackFrame17friendlySourceURLEv
+__ZN3WTF13StringBuilder6appendERKNS_6StringE
+__ZN3JSC10JSFunction10nameGetterEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC17UnlinkedCodeBlock32expressionRangeForBytecodeOffsetEjRiS1_S1_RjS2_
+__ZN3WTF13StringBuilder12appendNumberEj
+__ZN3JSC14ErrorPrototype18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC21getStaticFunctionSlotINS_13ErrorInstanceEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_12PropertySlotE
+_ctiVMThrowTrampoline
+_cti_vm_throw
+__ZN3JSC8jitThrowEPNS_2VMEPNS_9ExecStateENS_7JSValueENS_16ReturnAddressPtrE
+__ZN3JSC11Interpreter14throwExceptionERPNS_9ExecStateERNS_7JSValueEj
+__ZN3JSC9CodeBlock27lineNumberForBytecodeOffsetEj
+__ZN3JSC17UnlinkedCodeBlock27lineNumberForBytecodeOffsetEj
+__ZN3JSC12addErrorInfoEPNS_9ExecStateEPNS_8JSObjectEiRKNS_10SourceCodeE
+__ZN3JSC30isTerminatedExecutionExceptionEPNS_8JSObjectE
+__ZN3JSC9CodeBlock24handlerForBytecodeOffsetEj
+__ZN3JSC7JSScope10localDepthEv
+__ZN3JSC11JSNameScope14finishCreationEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSC11JSNameScope18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC14symbolTableGetINS_11JSNameScopeEEEbPT_NS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC9Structure27despecifyFunctionTransitionERNS_2VMEPS0_NS_12PropertyNameE
+__ZN3JSC9Structure17despecifyFunctionERNS_2VMENS_12PropertyNameE
+__ZN3JSCL20arrayProtoFuncSpliceEPNS_9ExecStateE
+__ZN3JSC7unshiftILNS_7JSArray14ShiftCountModeE1EEEvPNS_9ExecStateEPNS_8JSObjectEjjjj
+__ZN3JSC7JSArray31unshiftCountWithAnyIndexingTypeEPNS_9ExecStateEjj
+_cti_op_call_arityCheck
+__ZN3JSC12CallLinkInfo6unlinkERNS_2VMERNS_13RepatchBufferE
+__ZN3JSC8JSObject55convertInt32ToDoubleOrContiguousWhilePerformingSetIndexERNS_2VMEjNS_7JSValueE
+__ZN3JSC6ParserINS_5LexerIhEEE19parseWhileStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC9WhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+_cti_vm_lazyLinkClosureCall
+__ZN3JSC3JIT12linkSlowCallEPNS_9CodeBlockEPNS_12CallLinkInfoE
+__ZN3JSC20virtualCallGeneratorEPNS_2VME
+__ZN3JSCL19virtualForGeneratorEPNS_2VMENS_11FunctionPtrES2_PKcNS_22CodeSpecializationKindE
+_cti_op_get_by_id_generic
+__ZN3JSC3JIT17emit_op_jneq_nullEPNS_11InstructionE
+__ZN3JSC3JIT25emit_op_resolve_with_thisEPNS_11InstructionE
+__ZN3JSC3JIT23emit_resolve_operationsEPN3WTF6VectorINS_16ResolveOperationELm0ENS1_15CrashOnOverflowEEEPKiS8_
+__ZN3JSC3JIT29emitSlow_op_resolve_with_thisEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT32emitSlow_link_resolve_operationsEPN3WTF6VectorINS_16ResolveOperationELm0ENS1_15CrashOnOverflowEEERPNS_13SlowCaseEntryE
+_cti_op_get_by_val
+__ZN3JSCL22objectProtoFuncValueOfEPNS_9ExecStateE
+__ZN3JSCL22arrayProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSC22StringRecursionChecker12performCheckEv
+__ZN3WTF9HashTableIPN3JSC8JSObjectES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3WTF10StringImpl20createWithoutCopyingEPKhjNS_27HasTerminatingNullCharacterE
+__ZN3JSC14JSStringJoiner6appendERKN3WTF6StringE
+__ZN3JSC14JSStringJoiner4joinEPNS_9ExecStateE
+__ZN3JSC22StringRecursionCheckerD1Ev
+__ZN3WTF7HashSetIPN3JSC8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE6removeENS_29HashTableConstIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorES5_S7_S7_EES3_EE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE12storeToFrameENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32Ej
+__ZN3JSC9Structure27despecifyDictionaryFunctionERNS_2VMENS_12PropertyNameE
+_cti_op_call_jitCompile
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE20generateAssertionBOLEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE12storeToFrameENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32Ej
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE17BacktrackingState6linkToENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5LabelEPNS_14MacroAssemblerE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE20generateAssertionEOLEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE15notAtEndOfInputEv
+__ZN3WTF6VectorIN3JSC4Yarr13YarrGeneratorILNS2_18YarrJITCompileModeE0EE17BacktrackingState19ReturnAddressRecordELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator13emitPopScopesEi
+__ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC8JSString8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSCL23arrayConstructorIsArrayEPNS_9ExecStateE
+__ZN3JSC23FunctionCallBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC22ArrayAllocationProfile18updateIndexingTypeEv
+__ZN3JSC30leastUpperBoundOfIndexingTypesEhh
+__ZN3JSC15CommonSlowPaths4opInEPNS_9ExecStateENS_7JSValueES3_
+__ZN3JSCL29objectProtoFuncHasOwnPropertyEPNS_9ExecStateE
+__ZNK3JSC8JSObject14hasOwnPropertyEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+_cti_stack_check
+__ZN3JSC3JIT13emit_op_catchEPNS_11InstructionE
+__ZN3JSC3JIT23emit_op_push_name_scopeEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_pop_scopeEPNS_11InstructionE
+_cti_op_nstricteq
+_cti_op_get_by_id_proto_list
+__ZN3JSCL37getPolymorphicAccessStructureListSlotERNS_2VMEPNS_16ScriptExecutableEPNS_17StructureStubInfoERi
+__ZN3JSC3JIT30privateCompileGetByIdProtoListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureES6_RKNS_10IdentifierERKNS_12PropertySlotEiPNS_9ExecStateE
+__ZN3JSC11loadVarargsEPNS_9ExecStateEPNS_7JSStackENS_7JSValueES4_i
+__ZN3JSC7JSArray15copyToArgumentsEPNS_9ExecStateES2_j
+__ZN3JSCL20arrayProtoFuncConcatEPNS_9ExecStateE
+_cti_op_convert_this
+__ZN3JSC16jsIsFunctionTypeENS_7JSValueE
+__ZNK3JSC13SourceCodeKeyeqERKS0_
+__ZN3JSCL20stringProtoFuncMatchEPNS_9ExecStateE
+__ZNK3JSC6JSCell18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZNK3JSC8JSString18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSCL19jsStrDecimalLiteralIhEEdRPKT_S3_
+__ZN3JSC7JSScope30resolveContainingScopeInternalILNS0_10LookupModeE1ELNS0_12ReturnValuesE1EEEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotEPN3WTF6VectorINS_16ResolveOperationELm0ENSD_15CrashOnOverflowEEEPNS_18PutToBaseOperationEb
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE14getStaticValueEPNS_9ExecStateENS_12PropertyNameE
+_JSValueIsObjectOfClass
+__ZN3WTF6OwnPtrINS_7HashMapINS_6RefPtrINS_10StringImplEEENS0_I19StaticFunctionEntryEENS_10StringHashENS_10HashTraitsIS4_EENS8_IS6_EEEEED2Ev
+__ZN3WTF6OwnPtrINS_7HashMapINS_6RefPtrINS_10StringImplEEENS0_I19StaticFunctionEntryEENS_10StringHashENS_10HashTraitsIS4_EENS8_IS6_EEEEEaSERKNS_10PassOwnPtrISB_EE
+__ZN3WTF10PassOwnPtrINS_7HashMapINS_6RefPtrINS_10StringImplEEENS_6OwnPtrI19StaticFunctionEntryEENS_10StringHashENS_10HashTraitsIS4_EENS9_IS7_EEEEED2Ev
+_JSObjectMakeArray
+__ZN3WTF9HashTableIjNS_12KeyValuePairIjPN3JSC16FunctionBodyNodeEEENS_24KeyValuePairKeyExtractorIS5_EENS_7IntHashIjEENS_18HashMapValueTraitsINS_29UnsignedWithZeroKeyHashTraitsIjEENS_10HashTraitsIS4_EEEESC_E3addINS_17HashMapTranslatorISF_S9_EEjS4_EENS_18HashTableAddResultINS_17HashTableIteratorIjS5_S7_S9_SF_SC_EEEERKT0_RKT1_
+__ZN3JSC17BytecodeGenerator19emitLazyNewFunctionEPNS_10RegisterIDEPNS_16FunctionBodyNodeE
+__ZN3WTF9HashTableIPN3JSC16FunctionBodyNodeENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E16lookupForWritingINS_22IdentityHashTranslatorIS9_EES3_EENSt3__14pairIPS5_bEERKT0_
+__ZN3WTF9HashTableIPN3JSC16FunctionBodyNodeENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E3addINS_17HashMapTranslatorISE_S9_EES3_jEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EEEERKT0_RKT1_
+__ZN3JSC9WeakGCMapIPvNS_8JSObjectEN3WTF7PtrHashIS1_EENS3_10HashTraitsIS1_EEE5gcMapEv
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI19StaticFunctionEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EEPS2_NS_10PassOwnPtrIS6_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI19StaticFunctionEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EES3_NS_10PassOwnPtrIS6_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI19StaticFunctionEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E6lookupINS_17HashMapTranslatorISG_SB_EEPS2_EEPS8_RKT0_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI19StaticFunctionEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E6rehashEi
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_NS_6OwnPtrI19StaticFunctionEntryEEEENS_24KeyValuePairKeyExtractorIS8_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E8reinsertERS8_
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE20staticFunctionGetterEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC18JSCallbackFunction6createEPNS_9ExecStateEPNS_14JSGlobalObjectEPFPK13OpaqueJSValuePK15OpaqueJSContextPS5_SB_mPKS7_PS7_ERKN3WTF6StringE
+__ZN3JSC18JSCallbackFunction11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSC18JSCallbackFunction4callEPNS_9ExecStateE
+_JSValueToBoolean
+_JSValueProtect
+_JSValueMakeUndefined
+__ZN3JSC9Structure26flattenDictionaryStructureERNS_2VMEPNS_8JSObjectE
+__ZN3WTF13hashTableSwapIN3JSC13SourceCodeKeyENS1_15SourceCodeValueEEEvRNS_12KeyValuePairIT_T0_EES8_
+__ZNK3WTF6String5upperEv
+__ZN3WTF10StringImpl5upperEv
+__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRN3WTF6StringERNS_7JSValueE
+__ZN3JSC14SourceProvider5getIDEv
+__ZN3JSC10JSONObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSCL18JSONProtoFuncParseEPNS_9ExecStateE
+__ZN3JSC13LiteralParserIhE5Lexer4nextEv
+__ZN3JSC13LiteralParserIhE5Lexer3lexILNS_10ParserModeE0EEENS_9TokenTypeERNS_18LiteralParserTokenIhEE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE17BacktrackingState24takeBacktracksToJumpListERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPNS_14MacroAssemblerE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE17BacktrackingState6appendERKNS_22AbstractMacroAssemblerINS_12X86AssemblerEE12DataLabelPtrE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE17BacktrackingState24takeBacktracksToJumpListERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPNS_14MacroAssemblerE
+_JSValueMakeFromJSONString
+__ZN3JSC10ASTBuilder11makeModNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSC10ASTBuilder12makeMultNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSC15DateConstructor18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSCL7dateNowEPNS_9ExecStateE
+__ZN3JSC24UnlinkedProgramCodeBlock22addFunctionDeclarationERNS_2VMERKNS_10IdentifierEPNS_26UnlinkedFunctionExecutableE
+__ZN3WTF6VectorINSt3__14pairIN3JSC10IdentifierENS3_12WriteBarrierINS3_26UnlinkedFunctionExecutableEEEEELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC8JSObject12removeDirectERNS_2VMENS_12PropertyNameE
+__ZN3JSC26UnlinkedFunctionExecutable4linkERNS_2VMERKNS_10SourceCodeEmm
+__ZN3JSC16SymbolTableEntry14attemptToWatchEv
+__ZN3JSC16SymbolTableEntry8copySlowERKS0_
+__ZN3JSC16SymbolTableEntry16freeFatEntrySlowEv
+__ZN3JSC10ASTBuilder13makeBitOrNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSC21globalFuncProtoSetterEPNS_9ExecStateE
+__ZN3JSC8JSObject16allowsAccessFromEPNS_9ExecStateE
+__ZN3JSC8JSObject26setPrototypeWithCycleCheckERNS_2VMENS_7JSValueE
+__ZN3JSC19floorThunkGeneratorEPNS_2VME
+__ZN3JSC14JSInterfaceJIT14emitLoadDoubleEjNS_12X86Registers13XMMRegisterIDENS1_10RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common10loadDoubleEPKvNS_12X86Registers13XMMRegisterIDE
+__ZN3JSC12X86Assembler2jpEv
+__ZN3JSC12X86Assembler2jeEv
+__ZN3JSC23MacroAssemblerX86Common27branchTruncateDoubleToInt32ENS_12X86Registers13XMMRegisterIDENS1_10RegisterIDENS0_18BranchTruncateTypeE
+__ZN3JSC19SpecializedThunkJIT18callDoubleToDoubleENS_11FunctionPtrE
+__ZN3WTF6VectorINSt3__14pairIN3JSC22AbstractMacroAssemblerINS3_12X86AssemblerEE4CallENS3_11FunctionPtrEEELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC23MacroAssemblerX86Common26branchConvertDoubleToInt32ENS_12X86Registers13XMMRegisterIDENS1_10RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListES2_b
+__ZN3JSC12X86Assembler3jneEv
+__ZN3JSC19SpecializedThunkJIT12returnDoubleENS_12X86Registers13XMMRegisterIDE
+__ZN3WTF9HashTableIPN3JSC6JSCellENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E16lookupForWritingINS_22IdentityHashTranslatorIS9_EES3_EENSt3__14pairIPS5_bEERKT0_
+__ZN3WTF9HashTableIPN3JSC6JSCellENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E3addINS_17HashMapTranslatorISE_S9_EES3_jEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EEEERKT0_RKT1_
+_JSValueMakeNull
+__ZN3JSC17DeleteBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitDeleteByValEPNS_10RegisterIDES2_S2_
+__ZN3WTF17double_conversion16PowersOfTenCache32GetCachedPowerForDecimalExponentEiPNS0_5DiyFpEPi
+__ZN3WTF6VectorIPN3JSC9StructureELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSCL22JSONProtoFuncStringifyEPNS_9ExecStateE
+__ZN3JSC11StringifierC2EPNS_9ExecStateERKNS_5LocalINS_7UnknownEEES7_
+__ZN3JSCL20unwrapBoxedPrimitiveEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC11Stringifier9stringifyENS_6HandleINS_7UnknownEEE
+__ZN3JSC11Stringifier22appendStringifiedValueERN3WTF13StringBuilderENS_7JSValueEPNS_8JSObjectERKNS_27PropertyNameForFunctionCallE
+__ZN3JSC11Stringifier6toJSONENS_7JSValueERKNS_27PropertyNameForFunctionCallE
+__ZNK3JSC6JSCell9getStringEPNS_9ExecStateERN3WTF6StringE
+__ZN3JSC11Stringifier6Holder18appendNextPropertyERS0_RN3WTF13StringBuilderE
+__ZN3WTF6RefPtrIN3JSC21PropertyNameArrayDataEEaSERKNS_10PassRefPtrIS2_EE
+__ZN3JSC11Stringifier6indentEv
+__ZN3JSC11Stringifier18appendQuotedStringERN3WTF13StringBuilderERKNS1_6StringE
+__ZN3WTF13StringBuilder6resizeEj
+__ZN3JSC11StringifierD2Ev
+_JSValueCreateJSONString
+__ZN3JSC13JSONStringifyEPNS_9ExecStateENS_7JSValueEj
+__ZNK3JSC6JSCell9getStringEPNS_9ExecStateE
+__ZN3JSCL18arrayProtoFuncJoinEPNS_9ExecStateE
+__ZN3JSC11CopiedSpace21tryReallocateOversizeEPPvmm
+__ZN3JSC11CopiedSpace19tryAllocateOversizeEmPPv
+__ZN3WTF9HashTableIPN3JSC11CopiedBlockES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EES3_EENSt3__14pairIPS3_bEERKT0_
+__ZN3JSC3JIT15emit_op_resolveEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_put_by_idEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_6429store64WithAddressOffsetPatchENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressE
+__ZN3JSC12X86Assembler23X86InstructionFormatter18oneByteOp64_disp32ENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDEi
+__ZN3JSC3JIT17emit_op_constructEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_del_by_idEPNS_11InstructionE
+__ZN3JSC3JIT19emitSlow_op_resolveEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_put_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_constructEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC22linkConstructGeneratorEPNS_2VME
+__ZN3JSC3JIT33privateCompilePatchGetArrayLengthENS_16ReturnAddressPtrE
+_cti_op_get_by_id_array_fail
+__ZN3JSC11CopiedSpace19tryAllocateSlowCaseEmPPv
+_cti_op_del_by_val
+__ZN3JSC9Structure24removePropertyTransitionERNS_2VMEPS0_NS_12PropertyNameERi
+__ZN3JSC9Structure6removeENS_12PropertyNameE
+__ZN3JSC13PropertyTable16addDeletedOffsetEi
+_cti_op_new_array
+_cti_op_put_by_id_direct
+__ZN3JSCL15tryCachePutByIDEPNS_9ExecStateEPNS_9CodeBlockENS_16ReturnAddressPtrENS_7JSValueERKNS_15PutPropertySlotEPNS_17StructureStubInfoEb
+__ZN3JSC3JIT31privateCompilePutByIdTransitionEPNS_17StructureStubInfoEPNS_9StructureES4_iPNS_14StructureChainENS_16ReturnAddressPtrEb
+__ZN3JSC3JIT27addStructureTransitionCheckEPNS_6JSCellEPNS_9StructureEPNS_17StructureStubInfoERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListENS_12X86Registers10RegisterIDE
+__ZN3JSC20MacroAssemblerX86_6417tailRecursiveCallEv
+__ZN3JSC20createJITStubRoutineERKNS_21MacroAssemblerCodeRefERNS_2VMEPKNS_6JSCellEbPS5_
+_cti_has_property
+_cti_op_resolve
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE30generatePatternCharacterGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE31backtrackPatternCharacterGreedyEm
+__ZN3JSC10ASTBuilder18makeBitwiseNotNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeE
+__ZN3JSC6ParserINS_5LexerIhEEE19parseThrowStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC10ASTBuilder14makeBitAndNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSC12ContinueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ReadModifyResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC14BitwiseNotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17ReadModifyDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9ThrowNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC4Yarr11byteCompileERNS0_11YarrPatternEPN3WTF20BumpPointerAllocatorE
+__ZN3JSC4Yarr12ByteCompiler7compileEPN3WTF20BumpPointerAllocatorE
+__ZN3JSC4Yarr12ByteCompiler10regexBeginEjjb
+__ZN3WTF6VectorIN3JSC4Yarr8ByteTermELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC4Yarr12ByteCompiler15emitDisjunctionEPNS0_18PatternDisjunctionEjj
+__ZN3JSC4Yarr12ByteCompiler10checkInputEj
+__ZN3JSC4Yarr12ByteCompiler20atomPatternCharacterEtjjN3WTF7CheckedIjNS2_15CrashOnOverflowEEENS0_14QuantifierTypeE
+__ZN3JSC4Yarr12ByteCompiler18atomCharacterClassEPNS0_14CharacterClassEbjjN3WTF7CheckedIjNS4_15CrashOnOverflowEEENS0_14QuantifierTypeE
+__ZN3JSC4Yarr12ByteCompiler24atomParenthesesOnceBeginEjbjjj
+__ZN3WTF6VectorIN3JSC4Yarr12ByteCompiler21ParenthesesStackEntryELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC4Yarr12ByteCompiler22atomParenthesesOnceEndEijN3WTF7CheckedIjNS2_15CrashOnOverflowEEENS0_14QuantifierTypeE
+__ZN3JSC4Yarr12ByteCompiler16closeAlternativeEi
+__ZN3JSC4Yarr12ByteCompiler30atomParenthesesSubpatternBeginEjbjjj
+__ZN3JSC4Yarr12ByteCompiler28atomParenthesesSubpatternEndEjijN3WTF7CheckedIjNS2_15CrashOnOverflowEEENS0_14QuantifierTypeEj
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC4Yarr15ByteDisjunctionEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC4Yarr12ByteCompiler12assertionEOLEj
+__ZN3JSC4Yarr12ByteCompiler20closeBodyAlternativeEv
+__ZN3WTF6VectorIN3JSC4Yarr8ByteTermELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC4Yarr15ByteDisjunctionEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC4Yarr14CharacterClassEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3JSC4Yarr12ByteCompilerD2Ev
+__ZN3JSC4Yarr9interpretEPNS0_15BytecodePatternERKN3WTF6StringEjPj
+__ZN3JSC4Yarr11InterpreterIhE9interpretEv
+__ZN3JSC4Yarr11InterpreterIhE16matchDisjunctionEPNS0_15ByteDisjunctionEPNS2_18DisjunctionContextEb
+__ZN3JSC4Yarr11InterpreterIhE19matchCharacterClassERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterIhE18testCharacterClassEPNS0_14CharacterClassEi
+__ZN3JSC4Yarr11InterpreterIhE16matchParenthesesERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterIhE34allocParenthesesDisjunctionContextEPNS0_15ByteDisjunctionEPjRNS0_8ByteTermE
+__ZN3JSC4Yarr11InterpreterIhE17matchAssertionEOLERNS0_8ByteTermE
+__ZN3JSCL24stringProtoFuncSubstringEPNS_9ExecStateE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE27generateCharacterClassFixedEm
+__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE30generatePatternCharacterGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE31backtrackPatternCharacterGreedyEm
+__ZN3JSCL28substituteBackreferencesSlowIhEEN3WTF6StringERKS2_S4_PKiPNS_6RegExpEm
+__ZN3WTF6VectorIhLm0ENS_15CrashOnOverflowEE6appendIhEEvPKT_m
+__ZN3WTF6VectorIhLm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE20generateAssertionEOLEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE15notAtEndOfInputEv
+__ZNK3JSC15DotAccessorNode17isDotAccessorNodeEv
+__ZN3JSC10PrefixNode7emitDotERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7JSValue13equalSlowCaseEPNS_9ExecStateES0_S0_
+__ZN3WTF9HashTableIPN3JSC8JSObjectES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EES3_EENSt3__14pairIPS3_bEERKT0_
+__ZN3JSC8JSString8getIndexEPNS_9ExecStateEj
+__ZN3JSC3JIT18emit_op_new_regexpEPNS_11InstructionE
+_cti_op_new_regexp
+__ZN3JSC3JIT24emitArrayStorageGetByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpE
+__ZN3JSC3JIT10emit_op_eqEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_bitxorEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_bitandEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_bitorEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_addEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_throwEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_subEPNS_11InstructionE
+__ZN3JSC3JIT20compileBinaryArithOpENS_8OpcodeIDEjjjNS_12OperandTypesE
+__ZN3JSC3JIT14emitSlow_op_eqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT18emitSlow_op_bitxorEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT18emitSlow_op_bitandEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT17emitSlow_op_bitorEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_addEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_subEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT28compileBinaryArithOpSlowCaseENS_8OpcodeIDERPNS_13SlowCaseEntryEjjjNS_12OperandTypesEbb
+_cti_op_eq
+_cti_op_in
+_cti_op_put_by_id
+__ZN3JSC3JIT19patchPutByIdReplaceEPNS_9CodeBlockEPNS_17StructureStubInfoEPNS_9StructureEiNS_16ReturnAddressPtrEb
+_cti_op_construct_NotJSConstruct
+__ZN3JSC18FunctionExecutable22jitCompileForConstructEPNS_9ExecStateE
+__ZN3JSC3DFG32mightCompileFunctionForConstructEPNS_9CodeBlockE
+__ZN3JSC3JIT18emit_op_get_calleeEPNS_11InstructionE
+__ZN3JSC3JIT19emit_op_create_thisEPNS_11InstructionE
+__ZN3JSC3JIT20emitAllocateJSObjectINS_12X86Registers10RegisterIDEEEvS3_T_S3_S3_
+__ZN3JSC3JIT23emitSlow_op_create_thisEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_loop_hintEPNS_11InstructionERPNS_13SlowCaseEntryE
+_cti_vm_lazyLinkConstruct
+__ZN3WTF16binarySearchImplIN3JSC15RareCaseProfileEiNS_15SegmentedVectorIS2_Lm8ELm32EEEPFiPS2_ELNS_16BinarySearchModeE1EEEPT_RT1_mT0_RKT2_
+__ZN3JSC32getRareCaseProfileBytecodeOffsetEPNS_15RareCaseProfileE
+__ZN3JSC20MacroAssemblerX86_645sub32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32ENS3_15AbsoluteAddressE
+__ZN3JSC25virtualConstructGeneratorEPNS_2VME
+_cti_op_put_by_id_fail
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE31generateCharacterClassNonGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE32backtrackCharacterClassNonGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE31generateCharacterClassNonGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE32backtrackCharacterClassNonGreedyEm
+_cti_op_resolve_with_this
+__ZN3JSC17JITStubRoutineSet3addEPNS_21GCAwareJITStubRoutineE
+__ZN3WTF6VectorIPN3JSC21GCAwareJITStubRoutineELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF9HashTableImNS_12KeyValuePairImPN3JSC21GCAwareJITStubRoutineEEENS_24KeyValuePairKeyExtractorIS5_EENS_7IntHashImEENS_18HashMapValueTraitsINS_10HashTraitsImEENSB_IS4_EEEESC_E16lookupForWritingINS_22IdentityHashTranslatorIS9_EEmEENSt3__14pairIPS5_bEERKT0_
+__ZN3WTF9HashTableImNS_12KeyValuePairImPN3JSC21GCAwareJITStubRoutineEEENS_24KeyValuePairKeyExtractorIS5_EENS_7IntHashImEENS_18HashMapValueTraitsINS_10HashTraitsImEENSB_IS4_EEEESC_E3addINS_17HashMapTranslatorISE_S9_EEmS4_EENS_18HashTableAddResultINS_17HashTableIteratorImS5_S7_S9_SE_SC_EEEERKT0_RKT1_
+_cti_op_get_by_id_custom_stub
+_cti_op_get_by_val_string
+_cti_optimize
+__ZN3JSC9CodeBlock35checkIfOptimizationThresholdReachedEv
+__ZN3JSC17FunctionCodeBlock11replacementEv
+__ZN3JSC9CodeBlock17shouldOptimizeNowEv
+__ZN3JSC9CodeBlock25updateAllArrayPredictionsENS_19OperationInProgressE
+__ZN3JSC17FunctionCodeBlock16compileOptimizedEPNS_9ExecStateEPNS_7JSScopeEj
+__ZN3JSC18FunctionExecutable23compileOptimizedForCallEPNS_9ExecStateEPNS_7JSScopeEj
+__ZN3JSC9CodeBlockC2ENS0_18CopyParsedBlockTagERS0_
+__ZN3WTF6VectorINS0_IN3JSC16ResolveOperationELm0ENS_15CrashOnOverflowEEELm0ES3_EC2ERKS5_
+__ZN3WTF6VectorIN3JSC11HandlerInfoELm0ENS_15CrashOnOverflowEEaSERKS4_
+__ZN3WTF6VectorINS0_IN3JSC7JSValueELm0ENS_15CrashOnOverflowEEELm0ES3_EaSERKS5_
+__ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0ENS_15CrashOnOverflowEEaSERKS4_
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0ENS_15CrashOnOverflowEEaSERKS4_
+__ZN3JSC3DFG18tryCompileFunctionEPNS_9ExecStateEPNS_9CodeBlockERNS_7JITCodeERNS_21MacroAssemblerCodePtrEj
+__ZN3JSC3DFG7compileENS0_11CompileModeEPNS_9ExecStateEPNS_9CodeBlockERNS_7JITCodeEPNS_21MacroAssemblerCodePtrEj
+__ZN3JSC11OptionRange9isInRangeEj
+__ZN3WTF6VectorIN3JSC7JSValueELm8ENS_15CrashOnOverflowEE4fillERKS2_m
+__ZN3WTF6VectorIN3JSC7JSValueELm16ENS_15CrashOnOverflowEE4fillERKS2_m
+__ZN3JSC3DFG5GraphC1ERNS_2VMEPNS_9CodeBlockEjRKNS_8OperandsINS_7JSValueENS_18OperandValueTraitsIS7_EEEE
+__ZN3JSC3DFG10DominatorsC1Ev
+__ZN3JSC8OperandsINS_7JSValueENS_18OperandValueTraitsIS1_EEEC2ERKS4_
+__ZN3JSC3DFG5parseEPNS_9ExecStateERNS0_5GraphE
+__ZN3JSC3DFG14ByteCodeParserC2ERNS0_5GraphE
+__ZN3JSC3DFG14ByteCodeParser5parseEv
+__ZN3JSC3DFG14ByteCodeParser16InlineStackEntryC2EPS1_PNS_9CodeBlockES5_jPNS_10JSFunctionENS_15VirtualRegisterES8_iNS_22CodeSpecializationKindE
+__ZN3JSC3DFG20QueryableExitProfileC1ERKNS0_11ExitProfileE
+__ZN3JSC29LazyOperandValueProfileParserC1ERNS_39CompressedLazyOperandValueProfileHolderE
+__ZN3JSC29LazyOperandValueProfileParserC2ERNS_39CompressedLazyOperandValueProfileHolderE
+__ZN3WTF6VectorIPN3JSC3DFG16ArgumentPositionELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF15SegmentedVectorIN3JSC3DFG16ArgumentPositionELm8ELm32EE6appendIS3_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC3DFG16ArgumentPositionELm8ENS_15CrashOnOverflowEEELm0ES4_E14expandCapacityEm
+__ZNK3JSC3DFG20QueryableExitProfile11hasExitSiteERKNS0_16FrequentExitSiteE
+__ZN3JSC3DFG14ByteCodeParser14parseCodeBlockEv
+__ZN3JSC25computePreciseJumpTargetsEPNS_9CodeBlockERN3WTF6VectorIjLm32ENS2_15CrashOnOverflowEEE
+__ZN3JSC3DFG10BasicBlockC2Ejjj
+__ZN3WTF6VectorIPN3JSC3DFG4NodeELm8ENS_15CrashOnOverflowEE4fillERKS4_m
+__ZN3WTF6VectorIPN3JSC3DFG4NodeELm16ENS_15CrashOnOverflowEE4fillERKS4_m
+__ZN3WTF6VectorIN3JSC3DFG13AbstractValueELm8ENS_15CrashOnOverflowEE4fillERKS3_m
+__ZN3WTF6VectorIN3JSC3DFG13AbstractValueELm16ENS_15CrashOnOverflowEE4fillERKS3_m
+__ZN3WTF6VectorIN3JSC3DFG13UnlinkedBlockELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14ByteCodeParser10parseBlockEj
+__ZN3WTF15SegmentedVectorIN3JSC3DFG18VariableAccessDataELm16ELm32EE6appendIS3_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC3DFG18VariableAccessDataELm16ENS_15CrashOnOverflowEEELm0ES4_E14expandCapacityEm
+__ZN3JSC3DFG14ByteCodeParser10addToGraphENS0_8NodeTypeENS0_6OpInfoEPNS0_4NodeES5_S5_
+__ZnwmRN3JSC3DFG9AllocatorINS0_4NodeEEE
+__ZN3JSC3DFG12defaultFlagsENS0_8NodeTypeE
+__ZN3JSC11Interpreter11getOpcodeIDEPv
+__ZN3JSC3DFG14ByteCodeParser8setLocalEjPNS0_4NodeENS1_7SetModeE
+__ZN3JSC3DFG14ByteCodeParser3getEi
+__ZN3JSC3DFG14ByteCodeParser8getLocalEj
+__ZN3JSC13GetByIdStatus10computeForEPNS_9CodeBlockEjRNS_10IdentifierE
+__ZN3WTF6VectorIPN3JSC9StructureELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC13GetByIdStatus15computeForChainERS0_PNS_9CodeBlockERNS_10IdentifierEPNS_9StructureE
+__ZNK3JSC9Structure18prototypeForLookupEPNS_9CodeBlockE
+__ZN3JSC12StructureSet3addEPNS_9StructureE
+__ZN3WTF12VectorBufferIPN3JSC9StructureELm2EE4swapERS4_
+__ZN3JSC3DFG14ByteCodeParser13handleGetByIdEijPNS0_4NodeEjRKNS_13GetByIdStatusE
+__ZN3WTF15SegmentedVectorIN3JSC12StructureSetELm16ELm32EE6appendIS2_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC12StructureSetELm16ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC3DFG14ByteCodeParser27addStructureTransitionCheckEPNS_6JSCellEPNS_9StructureE
+__ZN3WTF9HashTableIPN3JSC6JSCellENS_12KeyValuePairIS3_PNS1_3DFG4NodeEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E16lookupForWritingINS_22IdentityHashTranslatorISC_EES3_EENSt3__14pairIPS8_bEERKT0_
+__ZN3WTF9HashTableIPN3JSC6JSCellENS_12KeyValuePairIS3_PNS1_3DFG4NodeEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSE_IS7_EEEESF_E3addINS_17HashMapTranslatorISH_SC_EES3_S7_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S8_SA_SC_SH_SF_EEEERKT0_RKT1_
+__ZN3JSC3DFG14ByteCodeParser10addToGraphENS0_8NodeTypeEPNS0_4NodeES4_S4_
+__ZN3WTF6VectorIPN3JSC3DFG4NodeELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14ByteCodeParser11getArgumentEj
+__ZNK3JSC29LazyOperandValueProfileParser10predictionERKNS_26LazyOperandValueProfileKeyE
+__ZNK3JSC29LazyOperandValueProfileParser12getIfPresentERKNS_26LazyOperandValueProfileKeyE
+__ZN3JSC3DFG14ByteCodeParser10handleCallEPNS_11InterpreterEPNS_11InstructionENS0_8NodeTypeENS_22CodeSpecializationKindE
+__ZN3JSC14CallLinkStatusC1ENS_7JSValueE
+__ZNK3JSC14CallLinkStatus16internalFunctionEv
+__ZNK3JSC14CallLinkStatus12intrinsicForENS_22CodeSpecializationKindE
+__ZNK3JSC14ExecutableBase9intrinsicEv
+__ZN3JSC3DFG14ByteCodeParser18emitFunctionChecksERKNS_14CallLinkStatusEPNS0_4NodeEiNS_22CodeSpecializationKindE
+__ZN3JSC3DFG14ByteCodeParser15handleIntrinsicEbiNS_9IntrinsicEiij
+__ZN3JSC3DFG14ByteCodeParser10addToGraphENS0_8NodeTypeENS0_6OpInfoES3_PNS0_4NodeES5_S5_
+__ZN3JSC3DFG14ByteCodeParser5flushEPNS1_16InlineStackEntryE
+__ZN3JSC3DFG14ByteCodeParser11flushDirectEi
+__ZN3JSC3DFG14ByteCodeParser11flushDirectEiPNS0_16ArgumentPositionE
+__ZN3JSC3DFG16ArgumentPosition11addVariableEPNS0_18VariableAccessDataE
+__ZN3JSC3DFG14ByteCodeParser9linkBlockEPNS0_10BasicBlockERN3WTF6VectorIjLm0ENS4_15CrashOnOverflowEEE
+__ZN3JSC3DFG5Graph21determineReachabilityEv
+__ZN3JSC3DFG14ByteCodeParser16InlineStackEntryD2Ev
+__ZN3JSC29LazyOperandValueProfileParserD1Ev
+__ZN3JSC3DFG20QueryableExitProfileD1Ev
+__ZN3JSC3DFG14ByteCodeParserD2Ev
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_18FunctionExecutableEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3JSC3DFG21performCPSRethreadingERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_19CPSRethreadingPhaseEEEbRNS0_5GraphE
+__ZN3JSC3DFG5Phase10beginPhaseEv
+__ZN3JSC3DFG19CPSRethreadingPhase3runEv
+__ZN3JSC3DFG19CPSRethreadingPhase20freeUnnecessaryNodesEv
+__ZN3JSC3DFG19CPSRethreadingPhase25canonicalizeLocalsInBlockEv
+__ZN3JSC3DFG5Graph19performSubstitutionEPNS0_4NodeE
+__ZN3JSC3DFG19CPSRethreadingPhase23canonicalizeGetLocalForILNS_11OperandKindE0EEEvPNS0_4NodeEPNS0_18VariableAccessDataEm
+__ZN3JSC3DFG19CPSRethreadingPhase34canonicalizeFlushOrPhantomLocalForILNS0_8NodeTypeE15ELNS_11OperandKindE0EEEvPNS0_4NodeEPNS0_18VariableAccessDataEm
+__ZN3JSC3DFG19CPSRethreadingPhase13propagatePhisILNS_11OperandKindE1EEEvv
+__ZN3JSC3DFG19CPSRethreadingPhase13propagatePhisILNS_11OperandKindE0EEEvv
+__ZN3JSC3DFG5Phase8endPhaseEv
+__ZN3JSC3DFG18performUnificationERNS0_5GraphE
+__ZN3JSC3DFG16UnificationPhase3runEv
+__ZN3JSC3DFG26performPredictionInjectionERNS0_5GraphE
+__ZN3JSC3DFG24PredictionInjectionPhase3runEv
+__ZN3JSC3DFG27performBackwardsPropagationERNS0_5GraphE
+__ZN3JSC3DFG25BackwardsPropagationPhase9propagateEPNS0_4NodeE
+__ZN3JSC3DFG25BackwardsPropagationPhase17mergeDefaultFlagsEPNS0_4NodeE
+__ZN3JSC3DFG28performPredictionPropagationERNS0_5GraphE
+__ZN3JSC3DFG26PredictionPropagationPhase3runEv
+__ZN3JSC3DFG26PredictionPropagationPhase9propagateEPNS0_4NodeE
+__ZN3JSC3DFG26PredictionPropagationPhase17propagateBackwardEv
+__ZN3JSC3DFG26PredictionPropagationPhase21doRoundOfDoubleVotingEv
+__ZN3JSC3DFG26PredictionPropagationPhase14doDoubleVotingEPNS0_4NodeE
+__ZN3JSC3DFG5Graph12voteChildrenEPNS0_4NodeEj
+__ZN3JSC3DFG18VariableAccessData34tallyVotesForShouldUseDoubleFormatEv
+__ZN3JSC3DFG16ArgumentPosition32mergeArgumentPredictionAwarenessEv
+__ZN3JSC3DFG12performFixupERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_10FixupPhaseEEEbRNS0_5GraphE
+__ZN3JSC3DFG10FixupPhase3runEv
+__ZN3JSC3DFG10FixupPhase9fixupNodeEPNS0_4NodeE
+__ZN3JSC3DFG10FixupPhase20observeUseKindOnNodeEPNS0_4NodeENS0_7UseKindE
+__ZN3JSC3DFG12InsertionSet7executeEPNS0_10BasicBlockE
+__ZN3JSC3DFG10FixupPhase21fixupSetLocalsInBlockEPNS0_10BasicBlockE
+__ZN3JSC3DFG24performTypeCheckHoistingERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_22TypeCheckHoistingPhaseEEEbRNS0_5GraphE
+__ZN3JSC3DFG22TypeCheckHoistingPhase3runEv
+__ZN3WTF7HashMapIPN3JSC3DFG18VariableAccessDataENS2_22TypeCheckHoistingPhase9CheckDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4findERKS4_
+__ZN3JSC3DFG10performCSEERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_8CSEPhaseILNS0_7CSEModeE0EEEEEbRNS0_5GraphE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE15performBlockCSEEPNS0_10BasicBlockE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE14performNodeCSEEPNS0_4NodeE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE25checkStructureEliminationERKNS_12StructureSetEPNS0_4NodeE
+__ZN3JSC3DFG5Graph13clobbersWorldEPNS0_4NodeE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE40structureTransitionWatchpointEliminationEPNS_9StructureEPNS0_4NodeE
+__ZN3JSC3DFG30performArgumentsSimplificationERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_28ArgumentsSimplificationPhaseEEEbRNS0_5GraphE
+__ZN3JSC3DFG28ArgumentsSimplificationPhase3runEv
+__ZN3JSC3DFG10performCFAERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_8CFAPhaseEEEbRNS0_5GraphE
+__ZN3JSC3DFG13AbstractStateC1ERNS0_5GraphE
+__ZN3JSC3DFG13AbstractState10initializeERNS0_5GraphE
+__ZN3JSC3DFG13AbstractState15beginBasicBlockEPNS0_10BasicBlockE
+__ZN3WTF6VectorIN3JSC3DFG13AbstractValueELm8ENS_15CrashOnOverflowEEaSERKS5_
+__ZN3WTF6VectorIN3JSC3DFG13AbstractValueELm16ENS_15CrashOnOverflowEEaSERKS5_
+__ZN3JSC3DFG13AbstractState7executeEj
+__ZN3JSC3DFG13AbstractState12executeEdgesEPNS0_4NodeE
+__ZN3JSC3DFG13AbstractState14executeEffectsEjPNS0_4NodeE
+__ZN3JSC9CodeBlock15globalObjectForENS_10CodeOriginE
+__ZN3JSC24speculationFromStructureEPNS_9StructureE
+__ZN3JSC3DFG13AbstractValue6filterEj
+__ZN3JSC3DFG13AbstractValue6filterERKNS_12StructureSetE
+__ZN3JSC3DFG13AbstractState13endBasicBlockENS1_9MergeModeE
+__ZN3JSC3DFG13AbstractStateD1Ev
+__ZN3JSC3DFG22performConstantFoldingERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_20ConstantFoldingPhaseEEEbRNS0_5GraphE
+__ZN3JSC3DFG20ConstantFoldingPhase20paintUnreachableCodeEj
+__ZN3JSC3DFG13AbstractState5resetEv
+__ZN3JSC3DFG20ConstantFoldingPhase13foldConstantsEj
+__ZN3WTF6VectorIPN3JSC9StructureELm2ENS_15CrashOnOverflowEEaSERKS5_
+__ZN3JSC3DFG24performCFGSimplificationERNS0_5GraphE
+__ZN3JSC3DFG22CFGSimplificationPhase3runEv
+__ZN3JSC3DFG23performStoreEliminationERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_8CSEPhaseILNS0_7CSEModeE1EEEEEbRNS0_5GraphE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE1EE15performBlockCSEEPNS0_10BasicBlockE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE1EE14performNodeCSEEPNS0_4NodeE
+__ZN3JSC3DFG10performDCEERNS0_5GraphE
+__ZN3JSC3DFG8runPhaseINS0_8DCEPhaseEEEbRNS0_5GraphE
+__ZN3JSC3DFG8DCEPhase3runEv
+__ZN3JSC3DFG8DCEPhase17findTypeCheckRootEPNS0_4NodeENS0_4EdgeE
+__ZN3JSC3DFG8DCEPhase9countEdgeEPNS0_4NodeENS0_4EdgeE
+__ZN3JSC3DFG32performVirtualRegisterAllocationERNS0_5GraphE
+__ZN3JSC3DFG30VirtualRegisterAllocationPhase3runEv
+__ZN3JSC3DFG10ScoreBoardC2ERKN3WTF9BitVectorE
+__ZN3WTF6VectorIjLm64ENS_15CrashOnOverflowEE4fillERKjm
+__ZN3WTF6VectorIjLm64ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG10ScoreBoard8allocateEv
+__ZN3JSC3DFG10ScoreBoard3useEPNS0_4NodeE
+__ZN3JSC3DFG11JITCompilerC1ERNS0_5GraphE
+__ZN3JSC3DFG11JITCompilerC2ERNS0_5GraphE
+__ZN3JSC3DFG11JITCompiler15compileFunctionERNS_7JITCodeERNS_21MacroAssemblerCodePtrE
+__ZN3JSC3DFG11JITCompiler12compileEntryEv
+__ZN3JSC3DFG14SpeculativeJITC1ERNS0_11JITCompilerE
+__ZN3JSC3DFG14SpeculativeJITC2ERNS0_11JITCompilerE
+__ZN3JSC3DFG14SpeculativeJIT7compileEv
+__ZN3JSC3DFG14SpeculativeJIT18checkArgumentTypesEv
+__ZN3JSC3DFG14SpeculativeJIT24backwardSpeculationCheckENS_8ExitKindENS0_13JSValueSourceEPNS0_4NodeENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC3DFG14SpeculativeJIT24backwardSpeculationCheckENS_8ExitKindENS0_13JSValueSourceEPNS0_4NodeENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpERKNS0_19SpeculationRecoveryE
+__ZN3JSC3DFG11JITCompiler14appendExitInfoENS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListE
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm2ENS_15CrashOnOverflowEEaSERKS7_
+__ZN3WTF6VectorIN3JSC3DFG22OSRExitCompilationInfoELm0ENS_15CrashOnOverflowEE14appendSlowCaseIS3_EEvRKT_
+__ZN3WTF6VectorIN3JSC3DFG22OSRExitCompilationInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG5Graph31methodOfGettingAValueProfileForEPNS0_4NodeE
+__ZN3JSC3DFG5Graph15valueProfileForEPNS0_4NodeE
+__ZN3JSC3DFG7OSRExitC1ENS_8ExitKindENS0_13JSValueSourceENS_28MethodOfGettingAValueProfileEPNS0_14SpeculativeJITEjj
+__ZN3WTF15SegmentedVectorIN3JSC3DFG7OSRExitELm8ELm32EE6appendIS3_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC3DFG7OSRExitELm8ENS_15CrashOnOverflowEEELm0ES4_E14expandCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT7compileERNS0_10BasicBlockE
+__ZN3JSC3DFG19VariableEventStream12appendAndLogERKNS0_13VariableEventE
+__ZN3WTF6VectorIN3JSC3DFG13VariableEventELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG13AbstractState14startExecutingEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT7compileEPNS0_4NodeE
+__ZN3JSC3DFG13AbstractState14executeEffectsEj
+__ZN3JSC3DFG14SpeculativeJIT14flushRegistersEv
+__ZN3JSC3DFG12GPRTemporaryC2EPNS0_14SpeculativeJITENS_12X86Registers10RegisterIDE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEPvENS_12X86Registers10RegisterIDES4_
+__ZN3JSC3DFG14SpeculativeJIT37appendCallWithExceptionCheckSetResultERKNS_11FunctionPtrENS_12X86Registers10RegisterIDE
+__ZN3JSC3DFG11JITCompiler10appendCallERKNS_11FunctionPtrE
+__ZN3WTF6VectorIN3JSC3DFG14CallLinkRecordELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG11JITCompiler17addExceptionCheckENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4CallENS_10CodeOriginERNS0_14CallBeginTokenE
+__ZN3JSC20MacroAssemblerX86_6412branchTest64ENS_23MacroAssemblerX86Common15ResultConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15AbsoluteAddressENS5_12TrustedImm32E
+__ZN3WTF6VectorIN3JSC3DFG19CallExceptionRecordELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT11useChildrenEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT14compileMovHintEPNS0_4NodeE
+__ZN3JSC3DFG14GenerationInfo14noticeOSRBirthERNS0_19VariableEventStreamEPNS0_4NodeENS_15VirtualRegisterE
+__ZN3JSC3DFG14SpeculativeJIT9speculateEPNS0_4NodeENS0_4EdgeE
+__ZN3JSC3DFG14SpeculativeJIT3useEPNS0_4NodeE
+__ZN3JSC9CodeBlock19appendWeakReferenceEPNS_6JSCellE
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_6JSCellEEELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG12MinifiedNode8fromNodeEPNS0_4NodeE
+__ZN3JSC3DFG13MinifiedGraph6appendERKNS0_12MinifiedNodeE
+__ZN3WTF6VectorIN3JSC3DFG12MinifiedNodeELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT21speculationWatchpointENS_8ExitKindE
+__ZN3JSC3DFG14SpeculativeJIT21speculationWatchpointENS_8ExitKindENS0_13JSValueSourceEPNS0_4NodeE
+__ZN3WTF15SegmentedVectorIN3JSC25JumpReplacementWatchpointELm1ELm0EE6appendIS2_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC25JumpReplacementWatchpointELm1ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC10WatchpointD2Ev
+__ZN3JSC3DFG14SpeculativeJIT13speculateCellENS0_4EdgeE
+__ZN3JSC3DFG12GPRTemporaryC1EPNS0_14SpeculativeJITE
+__ZN3JSC3DFG14SpeculativeJIT17fillSpeculateCellENS0_4EdgeE
+__ZN3JSC3DFG14SpeculativeJIT5spillENS_15VirtualRegisterE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFmPNS_9ExecStateEPNS_6JSCellES5_ENS_12X86Registers10RegisterIDES9_S9_
+__ZN3JSC3DFG12CCallHelpers16setupTwoStubArgsILNS_12X86Registers10RegisterIDE6ELS4_2EEEvS4_S4_
+__ZN3JSC3DFG14SpeculativeJIT11fillJSValueENS0_4EdgeE
+__ZN3JSC3DFG11JITCompiler10notifyCallENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4CallENS_10CodeOriginERNS0_14CallBeginTokenE
+__ZN3JSC3DFG14SpeculativeJIT21runSlowPathGeneratorsEv
+__ZN3JSC3DFG11JITCompiler24compileExceptionHandlersEv
+__ZN3JSC3DFG11JITCompiler12linkOSRExitsEv
+__ZN3JSC20MacroAssemblerX86_647store32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32EPv
+__ZN3JSC3DFG7OSRExit22setPatchableCodeOffsetENS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpE
+__ZN3JSC3DFG14SpeculativeJIT16createOSREntriesEv
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE5LabelELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG11JITCompiler4linkERNS_10LinkBufferE
+__ZN3WTF6VectorIN3JSC28CodeOriginAtCallReturnOffsetELm0ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG31osrExitGenerationThunkGeneratorEPNS_2VME
+__ZN3JSC2VM20scratchBufferForSizeEm
+__ZN3WTF6VectorIPN3JSC13ScratchBufferELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC20MacroAssemblerX86_647store64ENS_12X86Registers10RegisterIDEPv
+__ZN3JSC20MacroAssemblerX86_644jumpENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15AbsoluteAddressE
+__ZNK3JSC3DFG7OSRExit28getPatchableCodeOffsetAsJumpEv
+__ZN3JSC3DFG7OSRExit11correctJumpERNS_10LinkBufferE
+__ZN3JSC25JumpReplacementWatchpoint13correctLabelsERNS_10LinkBufferE
+__ZN3JSC9CodeBlock15saveCompilationEN3WTF10PassRefPtrINS_8Profiler11CompilationEEE
+__ZN3JSC3DFG14SpeculativeJIT14linkOSREntriesERNS_10LinkBufferE
+__ZN3JSC3DFG11JITCompiler14noticeOSREntryERNS0_10BasicBlockENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5LabelERNS_10LinkBufferE
+__ZN3JSC9CodeBlock21appendDFGOSREntryDataEjj
+__ZN3WTF6VectorIN3JSC3DFG12OSREntryDataELm0ENS_15CrashOnOverflowEE14appendSlowCaseIS3_EEvRKT_
+__ZN3WTF6VectorIN3JSC3DFG12OSREntryDataELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC8OperandsINS_3DFG13AbstractValueENS_18OperandValueTraitsIS2_EEEC2ERKS5_
+__ZN3WTF6VectorIN3JSC3DFG12OSREntryDataELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIPNS0_IN3JSC3DFG7OSRExitELm8ENS_15CrashOnOverflowEEELm0ES4_E14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC3DFG19SpeculationRecoveryELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC12WriteBarrierINS1_6JSCellEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC9CodeBlock23WeakReferenceTransitionELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZNSt3__16__sortIRPFbRKN3JSC3DFG12MinifiedNodeES5_EPS3_EEvT0_SA_T_
+__ZN3JSC3DFG12MinifiedNode18compareByNodeIndexERKS1_S3_
+__ZN3WTF6VectorIN3JSC3DFG12MinifiedNodeELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC3DFG13VariableEventELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3JSC3DFG14SpeculativeJITD1Ev
+__ZN3JSC3DFG14SpeculativeJITD2Ev
+__ZN3JSC3DFG11JITCompilerD2Ev
+__ZN3JSC3DFG5GraphD1Ev
+__ZN3JSC3DFG5GraphD2Ev
+__ZN3JSC3DFG10DominatorsD1Ev
+__ZN3WTF15SegmentedVectorIN3JSC3DFG18NewArrayBufferDataELm4ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC3DFG23StructureTransitionDataELm8ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC12StructureSetELm16ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC3DFG16ArgumentPositionELm8ELm32EED2Ev
+__ZN3WTF15SegmentedVectorIN3JSC3DFG18VariableAccessDataELm16ELm32EED2Ev
+__ZN3JSC3DFG10BasicBlockD2Ev
+__ZN3WTF9HashTableIPN3JSC9CodeBlockES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3JSC3DFG15prepareOSREntryEPNS_9ExecStateEPNS_9CodeBlockEj
+__ZN3JSC9CodeBlock12optimizeSoonEv
+_operationNewRegexp
+_operationRegExpTest
+__ZN3JSC9CodeBlock20updateAllPredictionsENS_19OperationInProgressE
+__ZN3JSC3DFG14ByteCodeParser22parseResolveOperationsEjjPN3WTF6VectorINS_16ResolveOperationELm0ENS2_15CrashOnOverflowEEEPNS_18PutToBaseOperationEPPNS0_4NodeESC_
+__ZN3JSC3DFG14ByteCodeParser17handleGetByOffsetEijPNS0_4NodeEji
+__ZN3JSC3DFG14ByteCodeParser17handleGetByOffsetEjPNS0_4NodeEji
+__ZN3WTF6VectorIN3JSC3DFG17StorageAccessDataELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14ByteCodeParser3oneEv
+__ZN3JSC9CodeBlock11addConstantENS_7JSValueE
+__ZN3JSC3DFG14ByteCodeParser8makeSafeEPNS0_4NodeE
+__ZN3JSC13PutByIdStatus10computeForEPNS_9CodeBlockEjRNS_10IdentifierE
+__ZN3WTF15SegmentedVectorIN3JSC3DFG23StructureTransitionDataELm8ELm32EE6appendIS3_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC3DFG23StructureTransitionDataELm8ENS_15CrashOnOverflowEEELm0ES4_E14expandCapacityEm
+__ZN3JSC3DFG5Graph23arithAddSpeculationModeEPNS0_4NodeE
+__ZN3JSC3DFG5Graph34addImmediateShouldSpeculateIntegerEPNS0_4NodeEbS3_
+__ZN3JSC3DFG10FixupPhase23attemptToMakeIntegerAddEPNS0_4NodeE
+__ZN3WTF9HashTableIPN3JSC3DFG18VariableAccessDataENS_12KeyValuePairIS4_NS2_22TypeCheckHoistingPhase9CheckDataEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS4_EENS_18HashMapValueTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E16lookupForWritingINS_22IdentityHashTranslatorISC_EES4_EENSt3__14pairIPS8_bEERKT0_
+__ZN3WTF9HashTableIPN3JSC3DFG18VariableAccessDataENS_12KeyValuePairIS4_NS2_22TypeCheckHoistingPhase9CheckDataEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS4_EENS_18HashMapValueTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E3addINS_17HashMapTranslatorISH_SC_EES4_S7_EENS_18HashTableAddResultINS_17HashTableIteratorIS4_S8_SA_SC_SH_SF_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPN3JSC3DFG18VariableAccessDataENS_12KeyValuePairIS4_NS2_22TypeCheckHoistingPhase9CheckDataEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS4_EENS_18HashMapValueTraitsINS_10HashTraitsIS4_EENSE_IS7_EEEESF_E6rehashEi
+__ZN3JSC3DFG12InsertionSet6insertERKNS0_9InsertionE
+__ZN3JSC3DFG5Graph18substituteGetLocalERNS0_10BasicBlockEjPNS0_18VariableAccessDataEPNS0_4NodeE
+__ZN3JSC3DFG5Graph10substituteIPNS0_4NodeEEEvRNS0_10BasicBlockEjT_S7_
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE33getPropertyStorageLoadEliminationEPNS0_4NodeE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE26getByOffsetLoadEliminationEjPNS0_4NodeE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE7pureCSEEPNS0_4NodeE
+__ZN3JSC3DFG13AbstractState17clobberStructuresEj
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE1EE27putByOffsetStoreEliminationEjPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT16speculationCheckENS_8ExitKindENS0_13JSValueSourceEPNS0_4NodeENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC20MacroAssemblerX86_646load64EPKvNS_12X86Registers10RegisterIDE
+__ZN3JSC3DFG14SpeculativeJIT16speculationCheckENS_8ExitKindENS0_13JSValueSourceENS0_4EdgeENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC3DFG14SpeculativeJIT16speculationCheckENS_8ExitKindENS0_13JSValueSourceENS0_4EdgeENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpERKNS0_19SpeculationRecoveryE
+__ZN3JSC3DFG12GPRTemporaryC1EPNS0_14SpeculativeJITERNS0_20SpeculateCellOperandE
+__ZN3JSC3DFG12GPRTemporaryC2EPNS0_14SpeculativeJITERNS0_20SpeculateCellOperandE
+__ZN3JSC3DFG14SpeculativeJIT11fillStorageENS0_4EdgeE
+__ZN3JSC3DFG12GPRTemporaryC1EPNS0_14SpeculativeJITERNS0_14StorageOperandE
+__ZN3JSC3DFG12GPRTemporaryC2EPNS0_14SpeculativeJITERNS0_14StorageOperandE
+__ZN3JSC3DFG14SpeculativeJIT10compileAddEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT16fillSpeculateIntENS0_4EdgeERNS_10DataFormatE
+__ZN3JSC3DFG14SpeculativeJIT24fillSpeculateIntInternalILb0EEENS_12X86Registers10RegisterIDENS0_4EdgeERNS_10DataFormatE
+__ZN3JSC14MacroAssembler11branchAdd32ENS_23MacroAssemblerX86Common15ResultConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ES4_
+__ZN3JSC9CodeBlock29appendWeakReferenceTransitionEPNS_6JSCellES2_S2_
+__ZN3WTF6VectorIN3JSC9CodeBlock23WeakReferenceTransitionELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZNSt3__17__sort4IRPFbRKN3JSC3DFG12MinifiedNodeES5_EPS3_EEjT0_SA_SA_SA_T_
+__ZN3WTF9HashTableIPN3JSC9CodeBlockES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EES3_EENSt3__14pairIPS3_bEERKT0_
+__ZN3JSC18FunctionExecutable28compileOptimizedForConstructEPNS_9ExecStateEPNS_7JSScopeEj
+__ZN3JSC3DFG14ByteCodeParser11setArgumentEiPNS0_4NodeENS1_7SetModeE
+__ZN3JSC14CallLinkStatus10computeForEPNS_9CodeBlockEj
+__ZN3JSC3DFG14ByteCodeParser14handleInliningEbPNS0_4NodeEiRKNS_14CallLinkStatusEiijNS_22CodeSpecializationKindE
+__ZN3JSC18FunctionExecutable20baselineCodeBlockForENS_22CodeSpecializationKindE
+__ZN3JSC3DFG26mightInlineFunctionForCallEPNS_9CodeBlockE
+__ZN3JSC3DFG16canInlineOpcodesEPNS_9CodeBlockE
+__ZN3JSC3DFG16canHandleOpcodesIbXadL_ZNS0_15canInlineOpcodeENS_8OpcodeIDEPNS_9CodeBlockEPNS_11InstructionEEEEET_S4_S7_
+__ZNK3JSC14CallLinkStatus8functionEv
+__ZN3JSC3DFG10BasicBlock12ensureLocalsEj
+__ZN3JSC8OperandsINS_3DFG13AbstractValueENS_18OperandValueTraitsIS2_EEE12ensureLocalsEm
+__ZN3WTF15SegmentedVectorIN3JSC15InlineCallFrameELm4ELm32EE6appendIS2_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC15InlineCallFrameELm4ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3JSC15InlineCallFrameC2ERKS0_
+__ZN3JSC3DFG14ByteCodeParser27buildOperandMapsIfNecessaryEv
+__ZN3JSC9CodeBlock13addIdentifierERKNS_10IdentifierE
+__ZN3JSC3DFG14ByteCodeParser7addCallEPNS_11InterpreterEPNS_11InstructionENS0_8NodeTypeE
+__ZN3JSC3DFG14ByteCodeParser14addVarArgChildEPNS0_4NodeE
+__ZN3JSC3DFG14ByteCodeParser10addToGraphENS0_4Node9VarArgTagENS0_8NodeTypeENS0_6OpInfoES5_
+__ZN3JSC3DFG5Graph15handleSuccessorERN3WTF6VectorIjLm16ENS2_15CrashOnOverflowEEEjj
+__ZN3WTF6VectorIPN3JSC3DFG4NodeELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC3DFG19CPSRethreadingPhase23canonicalizeGetLocalForILNS_11OperandKindE1EEEvPNS0_4NodeEPNS0_18VariableAccessDataEm
+__ZN3JSC3DFG13AbstractState16mergeStateAtTailERNS0_13AbstractValueES3_PNS0_4NodeE
+__ZN3JSC3DFG13AbstractState17mergeToSuccessorsERNS0_5GraphEPNS0_10BasicBlockE
+__ZN3JSC3DFG13AbstractState5mergeEPNS0_10BasicBlockES3_
+__ZN3JSC3DFG13AbstractValue5mergeERKS1_
+__ZN3JSC3DFG5Graph8dethreadEv
+__ZN3JSC3DFG22CFGSimplificationPhase11mergeBlocksEjjj
+__ZN3JSC3DFG5Graph17resetReachabilityEv
+__ZN3JSC3DFG14SpeculativeJIT20emitAllocateJSObjectINS_22AbstractMacroAssemblerINS_12X86AssemblerEE13TrustedImmPtrES6_EEvNS_12X86Registers10RegisterIDES8_T_T0_S8_RNS5_8JumpListE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDESB_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESF_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG24JumpingSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEEC2ES5_PNS0_14SpeculativeJITE
+__ZN3JSC3DFG14SpeculativeJIT27silentSpillAllRegistersImplIN3WTF6VectorINS0_22SilentRegisterSavePlanELm2ENS3_15CrashOnOverflowEEEEEvbRT_NS_12X86Registers10RegisterIDESB_NSA_13XMMRegisterIDE
+__ZN3JSC3DFG14SpeculativeJIT20addSlowPathGeneratorEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEE
+__ZN3JSC3DFG14SpeculativeJIT22compileMovHintAndCheckEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT27convertLastOSRExitToForwardERKNS_13ValueRecoveryE
+__ZN3JSC3DFG14SpeculativeJIT18compileInlineStartEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT23computeValueRecoveryForERKNS0_11ValueSourceE
+__ZN3JSC3DFG17SlowPathGenerator8generateEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDES7_
+__ZN3JSC3DFG24JumpingSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEE6jumpToEPNS0_14SpeculativeJITE
+__ZNSt3__118__insertion_sort_3IRPFbRKN3JSC3DFG12MinifiedNodeES5_EPS3_EEvT0_SA_T_
+__ZN3JSC3DFG14ByteCodeParser17constantUndefinedEv
+__ZN3JSC3DFG14ByteCodeParser25getArrayModeAndEmitChecksEPNS_12ArrayProfileENS0_5Array6ActionEPNS0_4NodeE
+__ZN3JSC3DFG9ArrayMode12fromObservedEPNS_12ArrayProfileENS0_5Array6ActionEb
+__ZN3JSC3DFG31mightInlineFunctionForConstructEPNS_9CodeBlockE
+__ZN3WTF6VectorIPN3JSC3DFG4NodeELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC3DFG13AbstractValueELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14ByteCodeParser7setPairEiPNS0_4NodeEiS3_
+__ZN3JSC13GetByIdStatus16computeFromLLIntEPNS_9CodeBlockEjRNS_10IdentifierE
+__ZN3JSC13GetByIdStatusC2ENS0_5StateEbRKNS_12StructureSetEiNS_7JSValueEN3WTF6VectorIPNS_9StructureELm0ENS6_15CrashOnOverflowEEE
+__ZN3WTF6VectorIN3JSC3DFG4EdgeELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC3DFG10BasicBlockEEELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIPN3JSC3DFG18VariableAccessDataELm2ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG19CPSRethreadingPhase34canonicalizeFlushOrPhantomLocalForILNS0_8NodeTypeE15ELNS_11OperandKindE1EEEvPNS0_4NodeEPNS0_18VariableAccessDataEm
+__ZNK3JSC3DFG9ArrayMode6refineEjjjj
+__ZN3JSC3DFG10FixupPhase19blessArrayOperationENS0_4EdgeES2_RS2_
+__ZN3JSC9CodeBlock15getArrayProfileEj
+__ZN3JSC3DFG10FixupPhase10checkArrayENS0_9ArrayModeERKNS_10CodeOriginEPNS0_4NodeES7_PFbRKS2_E
+__ZNK3JSC3DFG9ArrayMode22originalArrayStructureERNS0_5GraphERKNS_10CodeOriginE
+__ZN3JSC3DFGL18lengthNeedsStorageERKNS0_9ArrayModeE
+__ZN3JSC3DFGL13canCSEStorageERKNS0_9ArrayModeE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE23getByValLoadEliminationEPNS0_4NodeES5_
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE21checkArrayEliminationEPNS0_4NodeENS0_9ArrayModeE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE40getIndexedPropertyStorageLoadEliminationEPNS0_4NodeENS0_9ArrayModeE
+__ZN3JSC3DFG13AbstractState19clobberCapturedVarsERKNS_10CodeOriginE
+__ZN3JSC3DFG13AbstractState13booleanResultEPNS0_4NodeERNS0_13AbstractValueE
+__ZNK3JSC3DFG9ArrayMode14alreadyCheckedERNS0_5GraphEPNS0_4NodeERNS0_13AbstractValueE
+__ZN3JSC3DFG14SpeculativeJIT8emitCallEPNS0_4NodeE
+__ZN3JSC3DFG11JITCompiler24prepareForExceptionCheckEv
+__ZN3JSC3DFG11JITCompiler9addJSCallENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4CallES5_NS4_12DataLabelPtrENS_12CallLinkInfo8CallTypeENS_12X86Registers10RegisterIDENS_10CodeOriginE
+__ZN3JSC3DFG14SpeculativeJIT30valueSourceReferenceForOperandEi
+__ZN3JSC3DFG14SpeculativeJIT20silentSavePlanForGPRENS_15VirtualRegisterENS_12X86Registers10RegisterIDE
+__ZN3JSC16SymbolTableEntry13addWatchpointEPNS_10WatchpointE
+__ZN3JSC13WatchpointSet3addEPNS_10WatchpointE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFvPNS_9ExecStateExxxENS_12X86Registers10RegisterIDES7_S7_
+__ZN3JSC3DFG12CCallHelpers18setupStubArgumentsENS_12X86Registers10RegisterIDES3_S3_
+__ZN3JSC3DFG12CCallHelpers16setupTwoStubArgsILNS_12X86Registers10RegisterIDE2ELS4_1EEEvS4_S4_
+__ZN3JSC3DFG14SpeculativeJIT7compareEPNS0_4NodeENS_23MacroAssemblerX86Common19RelationalConditionENS4_15DoubleConditionEPFmPNS_9ExecStateExxE
+__ZN3JSC3DFG14SpeculativeJIT21compilePeepHoleBranchEPNS0_4NodeENS_23MacroAssemblerX86Common19RelationalConditionENS4_15DoubleConditionEPFmPNS_9ExecStateExxE
+__ZN3JSC3DFG14SpeculativeJIT20detectPeepHoleBranchEv
+__ZN3JSC3DFG14SpeculativeJIT28nonSpeculativePeepholeBranchEPNS0_4NodeES3_NS_23MacroAssemblerX86Common19RelationalConditionEPFmPNS_9ExecStateExxE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFmPNS_9ExecStateExxENS_12X86Registers10RegisterIDES7_S7_
+__ZN3JSC3DFG14SpeculativeJIT9addBranchERKNS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEj
+__ZN3JSC3DFG14SpeculativeJIT4jumpEjNS1_15FallThroughModeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateExxENS_12X86Registers10RegisterIDES7_S7_
+__ZN3JSC3DFG14SpeculativeJIT15compileStrictEqEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT22nonSpeculativeStrictEqEPNS0_4NodeEb
+__ZN3JSC3DFG14SpeculativeJIT30nonSpeculativePeepholeStrictEqEPNS0_4NodeES3_b
+__ZN3JSC3DFG14SpeculativeJIT27silentSpillAllRegistersImplIN3WTF6VectorINS0_22SilentRegisterSavePlanELm0ENS3_15CrashOnOverflowEEEEEvbRT_NS_12X86Registers10RegisterIDESB_NSA_13XMMRegisterIDE
+__ZN3JSC3DFG14SpeculativeJIT29terminateSpeculativeExecutionENS_8ExitKindENS0_11JSValueRegsEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT19clearGenerationInfoEv
+__ZN3JSC14MacroAssembler4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDE
+__ZN3JSC3DFG14SpeculativeJIT21compileGetArrayLengthEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT28compilePeepHoleIntegerBranchEPNS0_4NodeES3_NS_23MacroAssemblerX86Common19RelationalConditionE
+__ZN3JSC3DFG14SpeculativeJIT24fillSpeculateIntInternalILb1EEENS_12X86Registers10RegisterIDENS0_4EdgeERNS_10DataFormatE
+__ZN3JSC3DFG14SpeculativeJIT32compileGetIndexedPropertyStorageEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT23compileGetByValOnStringEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT22fillSpeculateIntStrictENS0_4EdgeE
+__ZN3JSC3DFG14SpeculativeJIT21compileStringEqualityEPNS0_4NodeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_6JSCellES9_ENS_12X86Registers10RegisterIDESD_SD_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_6JSCellES9_ENS_12X86Registers10RegisterIDESD_SD_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_6JSCellES9_ENS_12X86Registers10RegisterIDESD_SD_EC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_SD_SD_
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_6JSCellES9_ENS_12X86Registers10RegisterIDESD_SD_ED0Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_6JSCellES9_ENS_12X86Registers10RegisterIDESD_SD_ED1Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDESD_SD_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDESD_SD_EC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_SD_SD_
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDESD_SD_ED0Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDESD_SD_ED1Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEiSB_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEiSB_EC2ES5_PNS0_14SpeculativeJITES9_NS0_18SpillRegistersModeESB_iSB_
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEiSB_ED0Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEiSB_ED1Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDESD_S9_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDESD_S9_EC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_SD_S9_
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDESD_S9_ED0Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDESD_S9_ED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_6JSCellES9_ENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_6JSCellES9_ENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_6JSCellES9_ENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG14SpeculativeJIT10emitBranchEPNS0_4NodeE
+__ZN3WTF6VectorIN3JSC3DFG14SpeculativeJIT12BranchRecordELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT11silentSpillERKNS0_22SilentRegisterSavePlanE
+__ZN3JSC3DFG14SpeculativeJIT10silentFillERKNS0_22SilentRegisterSavePlanENS_12X86Registers10RegisterIDE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPN3WTF10StringImplEPNS_9ExecStateEPNS_8JSStringEENS_12X86Registers10RegisterIDESC_
+__ZN3JSC3DFG24JumpingSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEE6jumpToEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEPNS_6JSCellES5_ENS_12X86Registers10RegisterIDES9_S9_
+__ZN3JSC3DFG22linkCallThunkGeneratorEPNS_2VME
+__ZN3JSC3DFGL21linkForThunkGeneratorEPNS_2VMENS_22CodeSpecializationKindE
+__ZN3JSC3DFGL11slowPathForERNS0_12CCallHelpersEPNS_2VMEPFPcPNS_9ExecStateEE
+_operationLinkCall
+_linkFor
+_operationPutByValNonStrict
+_operationCompareEq
+_operationGetByVal
+__ZN3JSC3DFG10dfgLinkForEPNS_9ExecStateERNS_12CallLinkInfoEPNS_9CodeBlockEPNS_10JSFunctionENS_21MacroAssemblerCodePtrENS_22CodeSpecializationKindE
+__ZN3JSC3DFG29linkClosureCallThunkGeneratorEPNS_2VME
+__ZN3JSC13PutByIdStatus16computeFromLLIntEPNS_9CodeBlockEjRNS_10IdentifierE
+__ZN3JSC3DFG14SpeculativeJIT13cachedGetByIdENS_10CodeOriginENS_12X86Registers10RegisterIDES4_jNS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpENS0_18SpillRegistersModeE
+__ZN3WTF6VectorIN3JSC3DFG22SilentRegisterSavePlanELm2ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT13usedRegistersEv
+__ZN3JSC3DFG11JITCompiler17addPropertyAccessERKNS0_20PropertyAccessRecordE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDES9_S5_
+__ZNK3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDEE4callEv
+_operationGetByIdOptimize
+_operationGetByIdOptimizeWithReturnAddress
+__ZN3JSC3DFG17dfgRepatchGetByIDEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_12PropertySlotERNS_17StructureStubInfoE
+_operationGetByIdBuildList
+_operationGetByIdBuildListWithReturnAddress
+__ZN3JSC3DFG19dfgBuildGetByIDListEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_12PropertySlotERNS_17StructureStubInfoE
+_compileOSRExit
+__ZNK3JSC3DFG19VariableEventStream11reconstructEPNS_9CodeBlockENS_10CodeOriginERNS0_13MinifiedGraphEjRNS_8OperandsINS_13ValueRecoveryENS_18OperandValueTraitsIS8_EEEE
+__ZN3WTF6VectorIN3JSC3DFG11ValueSourceELm8ENS_15CrashOnOverflowEE4fillERKS3_m
+__ZN3WTF6VectorIN3JSC3DFG11ValueSourceELm16ENS_15CrashOnOverflowEE4fillERKS3_m
+__ZN3JSC8OperandsINS_3DFG11ValueSourceENS_18OperandValueTraitsIS2_EEE10setOperandEiRKS2_
+__ZN3WTF9HashTableIN3JSC3DFG10MinifiedIDENS_12KeyValuePairIS3_NS2_12_GLOBAL__N_122MinifiedGenerationInfoEEENS_24KeyValuePairKeyExtractorIS7_EENS2_14MinifiedIDHashENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E4findERKS3_
+__ZN3WTF9HashTableIN3JSC3DFG10MinifiedIDENS_12KeyValuePairIS3_NS2_12_GLOBAL__N_122MinifiedGenerationInfoEEENS_24KeyValuePairKeyExtractorIS7_EENS2_14MinifiedIDHashENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E6expandEv
+__ZN3WTF6VectorIN3JSC13ValueRecoveryELm8ENS_15CrashOnOverflowEE4fillERKS2_m
+__ZN3WTF6VectorIN3JSC13ValueRecoveryELm16ENS_15CrashOnOverflowEE4fillERKS2_m
+__ZN3WTF12VectorBufferIN3JSC13ValueRecoveryELm8EE4swapERS3_
+__ZN3WTF12VectorBufferIN3JSC13ValueRecoveryELm16EE4swapERS3_
+__ZNK3WTF7HashMapIN3JSC3DFG10MinifiedIDENS2_12_GLOBAL__N_122MinifiedGenerationInfoENS2_14MinifiedIDHashENS_10HashTraitsIS3_EENS7_IS5_EEE3getERKS3_
+__ZN3JSC3DFG15OSRExitCompiler11compileExitERKNS0_7OSRExitERKNS_8OperandsINS_13ValueRecoveryENS_18OperandValueTraitsIS6_EEEEPNS0_19SpeculationRecoveryE
+__ZN3JSC3DFG15OSRExitCompiler16handleExitCountsERKNS0_7OSRExitE
+__ZN3JSC9CodeBlock35exitCountThresholdForReoptimizationEv
+__ZN3JSC9CodeBlock38counterValueForOptimizeAfterLongWarmUpEv
+__ZN3JSC16ExecutionCounter41applyMemoryUsageHeuristicsAndConvertToIntEiPNS_9CodeBlockE
+__ZN3JSC3DFG15AssemblyHelpers17decodedCodeMapForEPNS_9CodeBlockE
+__ZN3WTF9HashTableIPN3JSC9CodeBlockENS_12KeyValuePairIS3_NS_6VectorINS1_24BytecodeAndMachineOffsetELm0ENS_15CrashOnOverflowEEEEENS_24KeyValuePairKeyExtractorIS9_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSF_IS8_EEEESG_E16lookupForWritingINS_22IdentityHashTranslatorISD_EES3_EENSt3__14pairIPS9_bEERKT0_
+__ZN3WTF9HashTableIPN3JSC9CodeBlockENS_12KeyValuePairIS3_NS_6VectorINS1_24BytecodeAndMachineOffsetELm0ENS_15CrashOnOverflowEEEEENS_24KeyValuePairKeyExtractorIS9_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSF_IS8_EEEESG_E3addINS_17HashMapTranslatorISI_SD_EES3_S8_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S9_SB_SD_SI_SG_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPN3JSC9CodeBlockENS_12KeyValuePairIS3_NS_6VectorINS1_24BytecodeAndMachineOffsetELm0ENS_15CrashOnOverflowEEEEENS_24KeyValuePairKeyExtractorIS9_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSF_IS8_EEEESG_E6rehashEi
+__ZN3WTF6VectorIN3JSC24BytecodeAndMachineOffsetELm0ENS_15CrashOnOverflowEEaSERKS4_
+__ZN3WTF6VectorIN3JSC24BytecodeAndMachineOffsetELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZNK3JSC3DFG7OSRExit22codeLocationForRepatchEPNS_9CodeBlockE
+_triggerReoptimizationNow
+__ZN3JSC9CodeBlock10reoptimizeEv
+__ZN3JSC9CodeBlock8jettisonEv
+__ZN3JSC9CodeBlock22tallyFrequentExitSitesEv
+__ZN3JSC19exitKindIsCountableENS_8ExitKindE
+__ZN3JSC3DFG7OSRExit36considerAddingAsFrequentExitSiteSlowEPNS_9CodeBlockE
+__ZN3JSC3DFG11ExitProfile3addERKNS0_16FrequentExitSiteE
+__ZN3WTF6VectorIN3JSC3DFG16FrequentExitSiteELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17FunctionCodeBlock12jettisonImplEv
+__ZN3JSC18FunctionExecutable28jettisonOptimizedCodeForCallERNS_2VME
+__ZN3JSC4Heap20jettisonDFGCodeBlockEN3WTF10PassOwnPtrINS_9CodeBlockEEE
+__ZN3JSC13DFGCodeBlocks8jettisonEN3WTF10PassOwnPtrINS_9CodeBlockEEE
+_operationNewObject
+__ZN3WTF9HashTableIN3JSC3DFG16FrequentExitSiteES3_NS_17IdentityExtractorENS2_20FrequentExitSiteHashENS_10HashTraitsIS3_EES7_E3addINS_22IdentityHashTranslatorIS5_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S5_S7_S7_EEEERKT0_RKT1_
+_operationGetById
+_cti_op_new_object
+__ZN3JSC4Yarr11InterpreterIhE20backtrackParenthesesERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterIhE23backtrackCharacterClassERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterIhE25backtrackPatternCharacterERNS0_8ByteTermEPNS2_18DisjunctionContextE
+_cti_op_create_this
+__ZN3JSC13PutByIdStatus10computeForERNS_2VMEPNS_14JSGlobalObjectEPNS_9StructureERNS_10IdentifierEb
+__ZN3JSC9Structure33prototypeChainMayInterceptStoreToERNS_2VMENS_12PropertyNameE
+__ZNK3JSC3DFG9ArrayMode14alreadyCheckedERNS0_5GraphEPNS0_4NodeERNS0_13AbstractValueEh
+__ZN3JSC3DFG20ConstantFoldingPhase27addStructureTransitionCheckENS_10CodeOriginEjPNS_6JSCellE
+__ZN3JSC3DFG14SpeculativeJIT15speculateObjectENS0_4EdgeE
+__ZN3JSC12X86Assembler9movl_i32rEiNS_12X86Registers10RegisterIDE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDESD_SD_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEPNS_7JSArrayEiENS_12X86Registers10RegisterIDES9_S9_
+_operationGetByValArrayInt
+__ZN3WTF6VectorIN3JSC11StringRangeELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorINS_6StringELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17ConservativeRoots17genericAddPointerINS_17CompositeMarkHookINS_17JITStubRoutineSetENS_13DFGCodeBlocksEEEEEvPvNS_15TinyBloomFilterERT_
+__ZN3JSC13DFGCodeBlocks4markEPv
+__ZN3JSC17JITStubRoutineSet8markSlowEm
+__ZN3WTF7HashMapImPN3JSC21GCAwareJITStubRoutineENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE4findERKm
+__ZN3JSC13JSFinalObject13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC17StructureRareData13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC14StructureChain13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC14MarkStackArray6expandEv
+__ZN3JSC17ProgramExecutable13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC9CodeBlock14visitAggregateERNS_11SlotVisitorE
+__ZN3JSC18FunctionExecutable13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC9CodeBlock29stronglyVisitStrongReferencesERNS_11SlotVisitorE
+__ZN3JSC13EvalCodeCache14visitAggregateERNS_11SlotVisitorE
+__ZN3JSC9CodeBlock27stronglyVisitWeakReferencesERNS_11SlotVisitorE
+__ZN3JSC9CodeBlock31performTracingFixpointIterationERNS_11SlotVisitorE
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC18RegExpMatchesArray13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3WTF9HashTableIPvS1_NS_17IdentityExtractorENS_7PtrHashIS1_EENS_10HashTraitsIS1_EES6_E16lookupForWritingINS_22IdentityHashTranslatorIS4_EES1_EENSt3__14pairIPS1_bEERKT0_
+__ZThn16_N3JSC9CodeBlock19visitWeakReferencesERNS_11SlotVisitorE
+__ZN3JSC9CodeBlock23finalizeUnconditionallyEv
+__ZN3JSC17StructureStubInfo19visitWeakReferencesEv
+__ZN3JSC30PolymorphicAccessStructureList9visitWeakEi
+__ZN3JSC9CodeBlock17resetStubInternalERNS_13RepatchBufferERNS_17StructureStubInfoE
+__ZN3JSC3JIT17resetPatchGetByIdERNS_13RepatchBufferEPNS_17StructureStubInfoE
+__ZN3JSC17StructureStubInfo5derefEv
+__ZN3JSC30PolymorphicAccessStructureListD2Ev
+__ZN3JSC14JITStubRoutine19observeZeroRefCountEv
+__ZN3JSC14JITStubRoutineD0Ev
+__ZN3WTF19MetaAllocatorHandleD1Ev
+__ZN3WTF19MetaAllocatorHandleD2Ev
+__ZN3JSC30WatchpointsOnStructureStubInfoD1Ev
+__ZN3JSC31StructureStubClearingWatchpointD0Ev
+__ZN3JSC9CodeBlock7DFGDataD2Ev
+__ZN3WTF15SegmentedVectorIN3JSC25JumpReplacementWatchpointELm1ELm0EED2Ev
+__ZN3JSC25JumpReplacementWatchpointD1Ev
+__ZN3WTF15SegmentedVectorIN3JSC3DFG7OSRExitELm8ELm32EE17deleteAllSegmentsEv
+__ZN3WTF6VectorIN3JSC3DFG12OSREntryDataELm0ENS_15CrashOnOverflowEE6shrinkEm
+__ZN3JSC21GCAwareJITStubRoutine19observeZeroRefCountEv
+__ZN3WTF6VectorIN3JSC15InlineCallFrameELm4ENS_15CrashOnOverflowEED2Ev
+__ZN3WTF7HashMapImPN3JSC21GCAwareJITStubRoutineENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE6removeENS_24HashTableIteratorAdapterINS_9HashTableImNS_12KeyValuePairImS3_EENS_24KeyValuePairKeyExtractorISD_EES5_NS_18HashMapValueTraitsIS7_S8_EES7_EESD_EE
+__ZN3JSC21GCAwareJITStubRoutine12deleteFromGCEv
+__ZN3JSC21GCAwareJITStubRoutineD0Ev
+__ZN3JSC14JITStubRoutineD2Ev
+__ZN3JSC18FunctionExecutable7destroyEPNS_6JSCellE
+__ZN3JSC17ProgramExecutable7destroyEPNS_6JSCellE
+__ZN3JSC17SharedSymbolTable7destroyEPNS_6JSCellE
+__ZN3JSC10JSFunction7destroyEPNS_6JSCellE
+__ZN3JSC19ResolveGlobalStatus10computeForEPNS_9CodeBlockEiPNS_16ResolveOperationERNS_10IdentifierE
+__ZN3JSC13GetByIdStatus10computeForERNS_2VMEPNS_9StructureERNS_10IdentifierE
+__ZN3JSC3DFG14SpeculativeJIT23emitObjectOrOtherBranchENS0_4EdgeEjj
+__ZN3JSC3DFG14SpeculativeJIT9typeCheckENS0_13JSValueSourceENS0_4EdgeEjNS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC28MethodOfGettingAValueProfile15fromLazyOperandEPNS_9CodeBlockERKNS_26LazyOperandValueProfileKeyE
+__ZN3JSC3DFG12GPRTemporaryC1EPNS0_14SpeculativeJITERNS0_14JSValueOperandE
+__ZN3JSC3DFG12GPRTemporaryC2EPNS0_14SpeculativeJITERNS0_14JSValueOperandE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDESD_S9_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDEED1Ev
+__ZNK3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateExPNS_10IdentifierEENS_12X86Registers10RegisterIDEE4callEv
+__ZN3JSC3DFG27linkConstructThunkGeneratorEPNS_2VME
+__ZN3JSC3JIT17resetPatchPutByIdERNS_13RepatchBufferEPNS_17StructureStubInfoE
+_operationLinkConstruct
+__ZN3JSC3JIT25privateCompileClosureCallEPNS_12CallLinkInfoEPNS_9CodeBlockEPNS_9StructureEPNS_14ExecutableBaseENS_21MacroAssemblerCodePtrE
+__ZN3JSC22ClosureCallStubRoutineC1ERKNS_21MacroAssemblerCodeRefERNS_2VMEPKNS_6JSCellEPNS_9StructureEPNS_14ExecutableBaseERKNS_10CodeOriginE
+__ZN3JSC21GCAwareJITStubRoutineC2ERKNS_21MacroAssemblerCodeRefERNS_2VMEb
+__ZN3JSC3DFG30virtualConstructThunkGeneratorEPNS_2VME
+__ZN3JSC3DFGL24virtualForThunkGeneratorEPNS_2VMENS_22CodeSpecializationKindE
+__ZN3JSC3DFG14SpeculativeJIT33nonSpeculativeNonPeepholeStrictEqEPNS0_4NodeEb
+__ZN3JSC3DFG37CompareAndBoxBooleanSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEEC2ES5_PNS0_14SpeculativeJITEPFmPNS_9ExecStateExxENS_12X86Registers10RegisterIDESE_SE_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFmPNS_9ExecStateExxENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITES9_NS0_18SpillRegistersModeESB_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFmPNS_9ExecStateExxENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFmPNS_9ExecStateExxENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG14SpeculativeJIT17compileLogicalNotEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT20fillSpeculateBooleanENS0_4EdgeE
+__ZN3JSC3DFG12GPRTemporaryC1EPNS0_14SpeculativeJITERNS0_23SpeculateBooleanOperandE
+__ZN3JSC3DFG12GPRTemporaryC2EPNS0_14SpeculativeJITERNS0_23SpeculateBooleanOperandE
+__ZN3JSC3DFG37CompareAndBoxBooleanSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEE16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG37CompareAndBoxBooleanSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEED0Ev
+__ZN3JSC3DFG14SpeculativeJIT28compileNewFunctionExpressionEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateES3_ENS_12X86Registers10RegisterIDES3_
+_operationNewFunctionExpression
+__ZN3JSC14StructureChain7destroyEPNS_6JSCellE
+__ZN3JSC10Identifier4fromEPNS_9ExecStateEj
+__ZN3JSC17PropertyNameArray3addEPN3WTF10StringImplE
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES7_E3addINS_22IdentityHashTranslatorIS5_EES2_S2_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S2_S3_S5_S7_S7_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES7_E16lookupForWritingINS_22IdentityHashTranslatorIS5_EES2_EENSt3__14pairIPS2_bEERKT0_
+_cti_op_put_by_val_generic
+____ZN3WTF17TCMalloc_PageHeap19initializeScavengerEv_block_invoke
+__ZN3WTF17TCMalloc_PageHeap8scavengeEv
+__ZN3JSC22ClosureCallStubRoutineD0Ev
+__ZN3JSC21GCAwareJITStubRoutineD2Ev
+__ZN3JSC13WatchpointSet15notifyWriteSlowEv
+__ZN3JSC31StructureStubClearingWatchpoint12fireInternalEv
+__ZN3JSC9CodeBlock9resetStubERNS_17StructureStubInfoE
+__ZN3JSCL21arrayProtoFuncForEachEPNS_9ExecStateE
+__ZN3JSC20JSCallbackObjectData8finalizeENS_6HandleINS_7UnknownEEEPv
+_JSObjectSetPrivate
+__ZN3JSC6JSCell7destroyEPS0_
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE7destroyEPNS_6JSCellE
+__ZN3JSC20JSCallbackObjectDataD0Ev
+__ZN3JSC20JSCallbackObjectDataD2Ev
+_JSClassRelease
+__ZN3JSC15WeakHandleOwnerD2Ev
+__ZN3WTF7HashMapIPvN3JSC4WeakINS2_8JSObjectEEENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS8_IS5_EEE6removeERKS1_
+__ZN3JSCL16mathProtoFuncMaxEPNS_9ExecStateE
+_cti_op_call_NotJSFunction
+__ZN3JSC25JumpReplacementWatchpoint12fireInternalEv
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC9BreakNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12JSRopeString11RopeBuilder6expandEv
+__ZNK3WTF6String5toIntEPb
+__ZN3WTF10StringImpl5toIntEPb
+__ZN3WTF15charactersToIntEPKhmPb
+__ZN3WTFL14toIntegralTypeIihEET_PKT0_mPbi
+__ZN3JSCL22stringProtoFuncIndexOfEPNS_9ExecStateE
+__ZN3JSC12DateInstance7destroyEPNS_6JSCellE
+__ZN3JSCL21arrayProtoFuncUnShiftEPNS_9ExecStateE
+__ZN3JSC7unshiftILNS_7JSArray14ShiftCountModeE0EEEvPNS_9ExecStateEPNS_8JSObjectEjjjj
+__ZN3JSC8JSObject22ensureArrayStorageSlowERNS_2VME
+__ZNK3JSC9Structure31suggestedArrayStorageTransitionEv
+__ZN3JSC8JSObject52constructConvertedArrayStorageWithoutCopyingElementsERNS_2VMEj
+__ZN3JSC7JSArray28unshiftCountWithArrayStorageEPNS_9ExecStateEjjPNS_12ArrayStorageE
+__ZN3JSC7JSArray20unshiftCountSlowCaseERNS_2VMEbj
+__ZN3JSC7JSArray25setLengthWithArrayStorageEPNS_9ExecStateEjbPNS_12ArrayStorageE
+__ZN3JSC11PostfixNode7emitDotERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE17customHasInstanceEPNS_8JSObjectEPNS_9ExecStateENS_7JSValueE
+_JSValueUnprotect
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EEN3JSC17IdentifierRepHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E3addINS_17HashMapTranslatorISE_S9_EEPS2_jEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S5_S7_S9_SE_SC_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EEN3JSC17IdentifierRepHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSB_IjEEEESC_E6rehashEi
+__ZNK3WTF6String5splitEtbRNS_6VectorIS0_Lm0ENS_15CrashOnOverflowEEE
+__ZN3WTF6BigInt6appendEj
+__ZN3JSC13LiteralParserItE13tryJSONPParseERN3WTF6VectorINS_9JSONPDataELm0ENS2_15CrashOnOverflowEEEb
+__ZN3JSC13LiteralParserItE5Lexer3lexILNS_10ParserModeE2EEENS_9TokenTypeERNS_18LiteralParserTokenItEE
+__ZN3JSC13LiteralParserItED2Ev
+__ZN3JSC6ParserINS_5LexerItEEEC1EPNS_2VMERKNS_10SourceCodeEPNS_18FunctionParametersERKNS_10IdentifierENS_18JSParserStrictnessENS_12JSParserModeE
+__ZN3JSC6ParserINS_5LexerItEEEC2EPNS_2VMERKNS_10SourceCodeEPNS_18FunctionParametersERKNS_10IdentifierENS_18JSParserStrictnessENS_12JSParserModeE
+__ZN3JSC5LexerItEC1EPNS_2VME
+__ZN3JSC5LexerItE7setCodeERKNS_10SourceCodeEPNS_11ParserArenaE
+__ZN3JSC6ParserINS_5LexerItEEE9pushScopeEv
+__ZN3JSC5LexerItE3lexEPNS_11JSTokenDataEPNS_15JSTokenLocationEjb
+__ZN3JSC6ParserINS_5LexerItEEE5parseINS_11ProgramNodeEEEN3WTF10PassRefPtrIT_EERNS_11ParserErrorE
+__ZN3JSC6ParserINS_5LexerItEEE10parseInnerEv
+__ZN3JSC6ParserINS_5LexerItEEE19parseSourceElementsILNS_18SourceElementsModeE0ENS_10ASTBuilderEEENT0_14SourceElementsERS7_
+__ZN3JSC6ParserINS_5LexerItEEE14parseStatementINS_10ASTBuilderEEENT_9StatementERS6_RPKNS_10IdentifierEPj
+__ZN3JSC6ParserINS_5LexerItEEE24parseExpressionStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE15parseExpressionINS_10ASTBuilderEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerItEEE25parseAssignmentExpressionINS_10ASTBuilderEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerItEEE21parseMemberExpressionINS_10ASTBuilderEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerItEEE19parseVarDeclarationINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE15declareVariableEPKNS_10IdentifierE
+__ZN3JSC5LexerItE19lexExpectIdentifierEPNS_11JSTokenDataEPNS_15JSTokenLocationEjb
+__ZN3JSC5LexerItE19parseStringSlowCaseILb1EEENS1_17StringParseResultEPNS_11JSTokenDataEb
+__ZN3WTF6VectorItLm0ENS_15CrashOnOverflowEE6appendItEEvPKT_m
+__ZN3WTF10StringImpl19createUninitializedEjRPt
+__ZN3JSC6ParserINS_5LexerItEEE17parseFunctionInfoILNS_20FunctionRequirementsE0ELb0ENS_10ASTBuilderEEEbRT1_RPKNS_10IdentifierERNS7_19FormalParameterListERNS7_12FunctionBodyERjSH_RiSH_
+__ZN3JSC6ParserINS_5LexerItEEE19parseSourceElementsILNS_18SourceElementsModeE0ENS_13SyntaxCheckerEEENT0_14SourceElementsERS7_
+__ZN3JSC6ParserINS_5LexerItEEE14parseStatementINS_13SyntaxCheckerEEENT_9StatementERS6_RPKNS_10IdentifierEPj
+__ZN3JSC6ParserINS_5LexerItEEE20parseReturnStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE15parseExpressionINS_13SyntaxCheckerEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerItEEE25parseAssignmentExpressionINS_13SyntaxCheckerEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerItEEE21parseMemberExpressionINS_13SyntaxCheckerEEENT_10ExpressionERS6_
+__ZN3JSC6ParserINS_5LexerItEEE16popScopeInternalERNS_8ScopeRefEb
+__ZN3JSC5LexerItE19parseStringSlowCaseILb0EEENS1_17StringParseResultEPNS_11JSTokenDataEb
+__ZN3JSC6ParserINS_5LexerItEEE24parseFunctionDeclarationINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE17parseFunctionInfoILNS_20FunctionRequirementsE1ELb1ENS_10ASTBuilderEEEbRT1_RPKNS_10IdentifierERNS7_19FormalParameterListERNS7_12FunctionBodyERjSH_RiSH_
+__ZN3JSC6ParserINS_5LexerItEEE16parseIfStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE31parseExpressionOrLabelStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC5LexerItE16nextTokenIsColonEv
+__ZN3JSC6ParserINS_5LexerItEEE17parseForStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE19parseVarDeclarationINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE19parseWhileStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE20parseSwitchStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE18parseSwitchClausesINS_13SyntaxCheckerEEENT_10ClauseListERS6_
+__ZN3JSC6ParserINS_5LexerItEEE24parseSwitchDefaultClauseINS_13SyntaxCheckerEEENT_6ClauseERS6_
+__ZN3JSC5LexerItE5clearEv
+__ZN3JSC6ParserINS_5LexerItEEED1Ev
+__ZN3JSC6ParserINS_5LexerItEEED2Ev
+__ZN3JSC5LexerItED1Ev
+__ZN3JSC17BytecodeGenerator25emitResolveWithBaseForPutEPNS_10RegisterIDES2_RKNS_13ResolveResultERKNS_10IdentifierERNS_19NonlocalResolveInfoE
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE14callbackGetterEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC6ParserINS_5LexerItEEE5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EERNS_11ParserErrorE
+__ZN3JSC6ParserINS_5LexerItEEE16parseIfStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE31parseExpressionOrLabelStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE17parseForStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE19parseWhileStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE20parseReturnStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
+__ZN3WTF9HashTableIPN3JSC20MarkedArgumentBufferES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3WTF7HashSetIPN3JSC20MarkedArgumentBufferENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE6removeENS_29HashTableConstIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorES5_S7_S7_EES3_EE
+__ZN3JSC9Arguments7destroyEPNS_6JSCellE
+__ZN3JSC6ParserINS_5LexerItEEE17parseFunctionInfoILNS_20FunctionRequirementsE0ELb0ENS_13SyntaxCheckerEEEbRT1_RPKNS_10IdentifierERNS7_19FormalParameterListERNS7_12FunctionBodyERjSH_RiSH_
+__ZN3JSC6ParserINS_5LexerItEEE24parseExpressionStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC10StackFrame20computeLineAndColumnERjS1_
+_JSValueMakeNumber
+__ZN3WTF7HashMapINSt3__14pairIPN3JSC8JSObjectEjEENS3_4WeakINS3_9StructureEEENS_8PairHashIS5_jEENS_10HashTraitsIS6_EENSC_IS9_EEE6removeERKS6_
+__ZNK3JSC7JSValue20toThisObjectSlowCaseEPNS_9ExecStateE
+__ZN3JSC6ParserINS_5LexerItEEE24parseFunctionDeclarationINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE17parseFunctionInfoILNS_20FunctionRequirementsE1ELb1ENS_13SyntaxCheckerEEEbRT1_RPKNS_10IdentifierERNS7_19FormalParameterListERNS7_12FunctionBodyERjSH_RiSH_
+__ZN3JSC5LexerItE10scanRegExpERPKNS_10IdentifierES5_t
+__ZN3JSC6ParserINS_5LexerItEEE19parseBreakStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE17parseTryStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE19parseThrowStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE22parseContinueStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE21parseDoWhileStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC15IdentifierArena21makeNumericIdentifierEPNS_2VMEd
+__ZN3JSCL25functionProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSC16InternalFunction4nameEPNS_9ExecStateE
+__ZN3JSC22jsMakeNontrivialStringIPKcN3WTF6StringES2_EENS_7JSValueEPNS_9ExecStateET_T0_T1_
+__ZN3JSC17NumberConstructor18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC18getStaticValueSlotINS_17NumberConstructorENS_16InternalFunctionEEEbPNS_9ExecStateEPKNS_9HashTableEPT_NS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC17RegExpConstructor18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC18getStaticValueSlotINS_17RegExpConstructorENS_16InternalFunctionEEEbPNS_9ExecStateEPKNS_9HashTableEPT_NS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC6ParserINS_5LexerItEEE17parseTryStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3WTF6VectorINS_6RefPtrIN3JSC10RegisterIDEEELm16ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC26fromCharCodeThunkGeneratorEPNS_2VME
+__ZN3JSCL18stringFromCharCodeEPNS_9ExecStateE
+__ZN3JSC23jsSingleCharacterStringEPNS_9ExecStateEt
+__ZN3JSC14MacroAssembler4or32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDE
+__ZN3JSC16ErrorConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL29constructWithErrorConstructorEPNS_9ExecStateE
+__ZN3JSC13ErrorInstance6createEPNS_9ExecStateEPNS_9StructureENS_7JSValueE
+__ZN3JSC13ErrorInstanceC1ERNS_2VMEPNS_9StructureE
+__ZN3JSC15globalFuncIsNaNEPNS_9ExecStateE
+__ZN3WTF6VectorIPN3JSC14ExpressionNodeELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC10RegisterIDEEELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF13StringBuilder12appendNumberEi
+__ZNKO3WTF6String12isolatedCopyEv
+__ZN3WTF6StringC1EPKt
+__ZN3WTF6StringC2EPKt
+__ZN3WTF10StringImpl8endsWithEPS0_b
+__ZN3WTF15charactersToIntEPKtmPb
+__ZN3WTFL14toIntegralTypeIitEET_PKT0_mPbi
+__ZN3WTF13StringBuilder23allocateBufferUpConvertEPKhj
+__ZN3WTF13StringBuilder16reallocateBufferItEEvj
+__ZN3WTF10StringImpl10reallocateENS_10PassRefPtrIS0_EEjRPt
+__ZN3WTF16callOnMainThreadERKNS_8FunctionIFvvEEE
+__ZN3WTFL10timerFiredEP16__CFRunLoopTimerPv
+__ZN3WTFL18callFunctionObjectEPv
+__ZNK3WTF6String8toDoubleEPb
+__ZN3WTF10StringImpl8toDoubleEPb
+__ZN3WTF13StringBuilder23appendUninitializedSlowItEEPT_j
+__ZN3JSC20EvalFunctionCallNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitCallEvalEPNS_10RegisterIDES2_RNS_13CallArgumentsEjjjjj
+__ZN3JSC4evalEPNS_9ExecStateE
+__ZN3JSC13LiteralParserItE5Lexer4nextEv
+__ZN3JSC13LiteralParserItE5Lexer3lexILNS_10ParserModeE1EEENS_9TokenTypeERNS_18LiteralParserTokenItEE
+__ZN3JSC13LiteralParserItE5parseENS_11ParserStateE
+__ZN3JSC17UnlinkedCodeBlock16codeCacheForEvalEv
+__ZN3JSC13EvalCodeCache7getSlowEPNS_9ExecStateEPNS_9CodeCacheEPNS_16ScriptExecutableEbRKN3WTF6StringEPNS_7JSScopeERNS_7JSValueE
+__ZN3JSC14EvalExecutable6createEPNS_9ExecStateEN3WTF10PassRefPtrINS_9CodeCacheEEERKNS_10SourceCodeEb
+__ZN3JSC14EvalExecutableC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9CodeCacheEEERKNS_10SourceCodeEb
+__ZN3JSC14EvalExecutable15compileInternalEPNS_9ExecStateEPNS_7JSScopeENS_7JITCode7JITTypeEj
+__ZN3JSC14JSGlobalObject19createEvalCodeBlockEPNS_9CodeCacheEPNS_9ExecStateEPNS_7JSScopeEPNS_14EvalExecutableEPPNS_8JSObjectE
+__ZN3JSC9CodeCache16getEvalCodeBlockERNS_2VMEPNS_7JSScopeEPNS_14EvalExecutableERKNS_10SourceCodeENS_18JSParserStrictnessENS_12DebuggerModeENS_12ProfilerModeERNS_11ParserErrorE
+__ZN3JSC9CodeCache12getCodeBlockINS_21UnlinkedEvalCodeBlockENS_14EvalExecutableEEEPT_RNS_2VMEPNS_7JSScopeEPT0_RKNS_10SourceCodeENS_18JSParserStrictnessENS_12DebuggerModeENS_12ProfilerModeERNS_11ParserErrorE
+__ZN3JSC9CodeCache16generateBytecodeINS_21UnlinkedEvalCodeBlockENS_14EvalExecutableEEEPT_RNS_2VMEPNS_7JSScopeEPT0_RKNS_10SourceCodeENS_18JSParserStrictnessENS_12DebuggerModeENS_12ProfilerModeERNS_11ParserErrorE
+__ZN3JSC5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_2VMERKNS_10SourceCodeEPNS_18FunctionParametersERKNS_10IdentifierENS_18JSParserStrictnessENS_12JSParserModeERNS_11ParserErrorE
+__ZN3JSC6ParserINS_5LexerItEEE5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EERNS_11ParserErrorE
+__ZN3JSC8EvalNode6createEPNS_2VMERKNS_15JSTokenLocationES5_jPNS_14SourceElementsEPN3WTF6VectorINSt3__14pairIPKNS_10IdentifierEjEELm0ENS8_15CrashOnOverflowEEEPNS9_IPNS_16FunctionBodyNodeELm0ESG_EERNS8_7HashSetINS8_6RefPtrINS8_10StringImplEEENS_17IdentifierRepHashENS8_10HashTraitsISQ_EEEERKNS_10SourceCodeEji
+__ZN3JSC21UnlinkedEvalCodeBlock6createEPNS_2VMERKNS_14ExecutableInfoE
+__ZN3JSC17BytecodeGeneratorC1ERNS_2VMEPNS_7JSScopeEPNS_8EvalNodeEPNS_21UnlinkedEvalCodeBlockENS_12DebuggerModeENS_12ProfilerModeE
+__ZN3JSC17BytecodeGeneratorC2ERNS_2VMEPNS_7JSScopeEPNS_8EvalNodeEPNS_21UnlinkedEvalCodeBlockENS_12DebuggerModeENS_12ProfilerModeE
+__ZN3JSC8EvalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZThn24_N3JSC8EvalNodeD0Ev
+__ZN3JSC5LLInt17getEvalEntrypointERNS_2VMERNS_7JITCodeE
+__ZN3JSC5LLInt23evalEntryThunkGeneratorEPNS_2VME
+__ZN3JSC11Interpreter7executeEPNS_14EvalExecutableEPNS_9ExecStateENS_7JSValueEPNS_7JSScopeE
+__ZN3JSCL21stringProtoFuncSubstrEPNS_9ExecStateE
+__ZN3JSC10ASTBuilder11makeDivNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSC19roundThunkGeneratorEPNS_2VME
+__ZNK3JSC12JSRopeString19resolveRopeSlowCaseEPt
+__ZN3JSC7JSScope30resolveContainingScopeInternalILNS0_10LookupModeE1ELNS0_12ReturnValuesE5EEEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotEPN3WTF6VectorINS_16ResolveOperationELm0ENSD_15CrashOnOverflowEEEPNS_18PutToBaseOperationEb
+__ZN3JSC5LexerIhE19parseStringSlowCaseILb1EEENS1_17StringParseResultEPNS_11JSTokenDataEb
+__ZN3JSC11MarkedSpace9freeBlockEPNS_11MarkedBlockE
+__ZN3JSC15MarkedAllocator11removeBlockEPNS_11MarkedBlockE
+__ZN3WTF7HashSetIPN3JSC11MarkedBlockENS_15MarkedBlockHashENS_10HashTraitsIS3_EEE6removeERKS3_
+__ZN3JSC7WeakSetD1Ev
+__ZN3JSC16NativeExecutable7destroyEPNS_6JSCellE
+__ZN3JSC11RegExpCache8finalizeENS_6HandleINS_7UnknownEEEPv
+__ZN3JSC6RegExp14invalidateCodeEv
+__ZN3JSC6RegExp7destroyEPNS_6JSCellE
+__ZN3JSC4Yarr13YarrCodeBlockD2Ev
+__ZN3JSC17RegExpConstructor7destroyEPNS_6JSCellE
+__ZN3JSC4Heap14FinalizerOwner8finalizeENS_6HandleINS_7UnknownEEEPv
+__ZN3JSC14JSGlobalObject7destroyEPNS_6JSCellE
+__ZN3JSC14JSGlobalObjectD2Ev
+__ZN3JSC13WatchpointSetD1Ev
+__ZN3WTF15SegmentedVectorIN3JSC12WriteBarrierINS1_7UnknownEEELm16ELm32EED2Ev
+__Z22TCMalloc_SystemReleasePvm
+__ZN3JSC9Arguments13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC14EvalExecutable9clearCodeEv
+__ZN3JSC13EvalCodeBlockD0Ev
+__ZN3JSC14EvalExecutable7destroyEPNS_6JSCellE
+__ZN3JSC3JIT22emit_op_put_scoped_varEPNS_11InstructionE
+_cti_op_put_by_id_generic
+__ZN3JSC3JIT26privateCompileGetByIdChainEPNS_17StructureStubInfoEPNS_9StructureEPNS_14StructureChainEmRKNS_10IdentifierERKNS_12PropertySlotEiNS_16ReturnAddressPtrEPNS_9ExecStateE
+__ZN3JSC19InlineWatchpointSet7freeFatEv
+__ZN3JSC3JIT19emit_op_jngreatereqEPNS_11InstructionE
+__ZN3JSC3JIT23emitSlow_op_jngreatereqEPNS_11InstructionERPNS_13SlowCaseEntryE
+_cti_op_add
+__ZN3WTFL24initializeMainThreadOnceEv
+__ZN3WTF28initializeMainThreadPlatformEv
+__ZN3WTF6VectorINS_6StringELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF6String6appendEh
+__ZN3WTF10fastStrDupEPKc
+__ZN3WTF15BinarySemaphoreC1Ev
+__ZN3JSC3DFG14ByteCodeParser8getScopeEbj
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE24scopedVarLoadEliminationEPNS0_4NodeEj
+__ZN3JSC3DFG14ByteCodeParser21getJSConstantForValueENS_7JSValueE
+__ZN3JSC9CodeBlock17addOrFindConstantENS_7JSValueE
+__ZN3WTF6VectorIjLm2ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG5Graph23valueAddSpeculationModeEPNS0_4NodeE
+__ZN3JSC3DFG10FixupPhase26attemptToMakeFastStringAddILNS0_7UseKindE11EEEbPNS0_4NodeERNS0_4EdgeES7_
+__ZN3JSC3DFG10FixupPhase19convertStringAddUseILNS0_7UseKindE11EEEvPNS0_4NodeERNS0_4EdgeE
+__ZN3JSC3DFG19resultOfToPrimitiveEj
+__ZN3JSC3DFG10FixupPhase16fixupToPrimitiveEPNS0_4NodeE
+__ZN3JSC3DFG10FixupPhase13fixupToStringEPNS0_4NodeE
+__ZN3JSC3DFG10FixupPhase13fixupMakeRopeEPNS0_4NodeE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE24setLocalStoreEliminationENS_15VirtualRegisterEPNS0_4NodeE
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE0EE23getLocalLoadEliminationENS_15VirtualRegisterERPNS0_4NodeEb
+__ZN3JSC3DFG19CPSRethreadingPhase34canonicalizeFlushOrPhantomLocalForILNS0_8NodeTypeE16ELNS_11OperandKindE1EEEvPNS0_4NodeEPNS0_18VariableAccessDataEm
+__ZN3JSC3DFG14SpeculativeJIT15compileArithSubEPNS0_4NodeE
+__ZN3JSC14MacroAssembler11branchSub32ENS_23MacroAssemblerX86Common15ResultConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ES4_S4_
+__ZN3JSC3DFG14SpeculativeJIT15speculateStringENS0_4EdgeE
+__ZN3JSC3DFG14SpeculativeJIT14speculateInt32ENS0_4EdgeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateExENS_12X86Registers10RegisterIDES9_
+__ZN3JSC3DFG14SpeculativeJIT15compileMakeRopeEPNS0_4NodeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDESH_SD_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_ENS_12X86Registers10RegisterIDESF_SF_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_SB_ENS_12X86Registers10RegisterIDESF_SF_SF_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_T4_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG14SpeculativeJIT13cachedPutByIdENS_10CodeOriginENS_12X86Registers10RegisterIDES4_NS0_4EdgeES4_jNS_7PutKindENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC3DFG14SpeculativeJIT12writeBarrierENS_12X86Registers10RegisterIDES3_NS0_4EdgeENS_19WriteBarrierUseKindES3_S3_
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringES7_ENS_12X86Registers10RegisterIDESB_SB_
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFvPNS_9ExecStateExPNS_6JSCellEPNS_10IdentifierEENS_12X86Registers10RegisterIDESB_S7_
+__ZNK3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFvPNS_9ExecStateExPNS_6JSCellEPNS_10IdentifierEENS0_11NoResultTagEE4callEv
+_operationToString
+_operationPutByIdNonStrictOptimize
+_operationPutByIdNonStrictOptimizeWithReturnAddress
+__ZN3JSC3DFG17dfgRepatchPutByIDEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_15PutPropertySlotERNS_17StructureStubInfoENS_7PutKindE
+_operationPutByIdNonStrict
+__ZN3WTF20ThreadIdentifierData8destructEPv
+__ZN3WTF13threadDidExitEj
+__ZN3WTF20TCMalloc_ThreadCache18DestroyThreadCacheEPv
+__ZN3WTF20TCMalloc_ThreadCache11DeleteCacheEPS0_
+__ZN3WTF14FastMallocZone4sizeEP14_malloc_zone_tPKv
+__ZN3WTF17equalIgnoringCaseEPKtPKhj
+__ZN3JSC14JSGlobalObject16putDirectVirtualEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameENS_7JSValueEj
+__ZN3JSC28symbolTablePutWithAttributesINS_14JSGlobalObjectEEEbPT_RNS_2VMENS_12PropertyNameENS_7JSValueEj
+__ZN3JSCL21stringProtoFuncSearchEPNS_9ExecStateE
+__ZN3JSC6ParserINS_5LexerItEEE22parseContinueStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE19parseBreakStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3WTF6VectorIPN3JSC8JSObjectELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF15BinarySemaphore4waitEd
+__ZN3WTF15BinarySemaphore6signalEv
+__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateE
+__ZN3JSC5shiftILNS_7JSArray14ShiftCountModeE0EEEvPNS_9ExecStateEPNS_8JSObjectEjjjj
+__ZN3JSC7JSArray26shiftCountWithArrayStorageEjjPNS_12ArrayStorageE
+__ZN3JSCL17arrayProtoFuncPopEPNS_9ExecStateE
+__ZN3JSC7JSArray3popEPNS_9ExecStateE
+__ZN3JSC7JSArray27getOwnNonIndexPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC5LexerItE24parseFourDigitUnicodeHexEv
+_JSObjectGetPrivateProperty
+__ZNK3JSC20JSCallbackObjectData18getPrivatePropertyERKNS_10IdentifierE
+__ZN3JSC8JSObject19putDirectMayBeIndexEPNS_9ExecStateENS_12PropertyNameENS_7JSValueE
+__ZN3WTF6VectorINSt3__14pairINS_6RefPtrINS_10StringImplEEEjEELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+_JSObjectSetPrivateProperty
+__ZN3JSC20JSCallbackObjectData18setPrivatePropertyERNS_2VMEPNS_6JSCellERKNS_10IdentifierENS_7JSValueE
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC12WriteBarrierINS5_7UnknownEEEEENS_24KeyValuePairKeyExtractorIS9_EENS5_17IdentifierRepHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSE_IS8_EEEESF_E3addINS_17HashMapTranslatorISH_SC_EEPS2_S8_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S9_SB_SC_SH_SF_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC12WriteBarrierINS5_7UnknownEEEEENS_24KeyValuePairKeyExtractorIS9_EENS5_17IdentifierRepHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSE_IS8_EEEESF_E6rehashEi
+__ZN3JSCL20arrayProtoFuncFilterEPNS_9ExecStateE
+__ZN3WTF17charactersToFloatEPKhmRm
+__ZN3JSC4Yarr12ByteCompiler12assertionBOLEj
+__ZN3JSC4Yarr12ByteCompiler22alternativeDisjunctionEv
+__ZN3JSC8JSObject48putDirectIndexBeyondVectorLengthWithArrayStorageEPNS_9ExecStateEjNS_7JSValueEjNS_18PutDirectIndexModeEPNS_12ArrayStorageE
+__ZN3JSC8JSObject20increaseVectorLengthERNS_2VMEj
+__ZN3JSC6ParserINS_5LexerIhEEE20parseSwitchStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE18parseSwitchClausesINS_10ASTBuilderEEENT_10ClauseListERS6_
+__ZN3JSC6ParserINS_5LexerIhEEE24parseSwitchDefaultClauseINS_10ASTBuilderEEENT_6ClauseERS6_
+__ZN3JSC10SwitchNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13CaseBlockNode20emitBytecodeForBlockERNS_17BytecodeGeneratorEPNS_10RegisterIDES4_
+__ZN3JSC13CaseBlockNode14tryTableSwitchERN3WTF6VectorIPNS_14ExpressionNodeELm8ENS1_15CrashOnOverflowEEERiS8_
+__ZN3JSCL17processClauseListEPNS_14ClauseListNodeERN3WTF6VectorIPNS_14ExpressionNodeELm8ENS2_15CrashOnOverflowEEERNS_10SwitchKindERbRiSC_
+__ZN3WTF6VectorINS_6RefPtrIN3JSC5LabelEEELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator11beginSwitchEPNS_10RegisterIDENS_10SwitchInfo10SwitchTypeE
+__ZN3WTF6VectorIN3JSC10SwitchInfoELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator9endSwitchEjPN3WTF6RefPtrINS_5LabelEEEPPNS_14ExpressionNodeEPS3_ii
+__ZN3JSC17UnlinkedCodeBlock24addStringSwitchJumpTableEv
+__ZN3WTF6VectorIN3JSC23UnlinkedStringJumpTableELm0ENS_15CrashOnOverflowEE14appendSlowCaseIS2_EEvRKT_
+__ZN3WTF6VectorIN3JSC23UnlinkedStringJumpTableELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF11VectorMoverILb0EN3JSC23UnlinkedStringJumpTableEE4moveEPKS2_S5_PS2_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_iEENS_24KeyValuePairKeyExtractorIS5_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E3addINS_17HashMapTranslatorISD_S8_EEPS2_iEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S5_S7_S8_SD_SB_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_iEENS_24KeyValuePairKeyExtractorIS5_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E3addINS_22IdentityHashTranslatorIS8_EES3_S5_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S5_S7_S8_SD_SB_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_iEENS_24KeyValuePairKeyExtractorIS5_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E6rehashEi
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_iEENS_24KeyValuePairKeyExtractorIS5_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E8reinsertERS5_
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF11VectorMoverILb0EN3JSC15StringJumpTableEE4moveEPKS2_S5_PS2_
+__ZN3JSCL26stringProtoFuncToUpperCaseEPNS_9ExecStateE
+__ZN3JSC3DFG14ByteCodeParser7toInt32EPNS0_4NodeE
+__ZN3JSC3DFG12GPRTemporaryC1EPNS0_14SpeculativeJITERNS0_23SpeculateIntegerOperandES5_
+__ZN3JSC3DFG12GPRTemporaryC2EPNS0_14SpeculativeJITERNS0_23SpeculateIntegerOperandES5_
+__ZN3WTF6VectorIN3JSC3DFG20PropertyAccessRecordELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFGL28generateProtoChainAccessStubEPNS_9ExecStateERNS_17StructureStubInfoEPNS_14StructureChainEmiPNS_9StructureENS_17CodeLocationLabelES9_RN3WTF6RefPtrINS_14JITStubRoutineEEE
+__ZN3JSC3DFGL27addStructureTransitionCheckEPNS_6JSCellEPNS_9StructureEPNS_9CodeBlockERNS_17StructureStubInfoERNS_14MacroAssemblerERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListENS_12X86Registers10RegisterIDE
+_JSObjectHasProperty
+__ZN3JSC8JSObject21deletePropertyByIndexEPNS_6JSCellEPNS_9ExecStateEj
+__Z21TCMalloc_SystemCommitPvm
+__ZN3JSC3JIT24emit_op_new_array_bufferEPNS_11InstructionE
+_cti_op_new_array_buffer
+__ZN3JSC4Yarr11InterpreterItE9interpretEv
+__ZN3JSC4Yarr11InterpreterItE16matchDisjunctionEPNS0_15ByteDisjunctionEPNS2_18DisjunctionContextEb
+__ZN3JSC4Yarr11InterpreterItE19matchCharacterClassERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterItE18testCharacterClassEPNS0_14CharacterClassEi
+__ZN3JSC4Yarr11InterpreterItE23backtrackCharacterClassERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterItE16matchParenthesesERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterItE34allocParenthesesDisjunctionContextEPNS0_15ByteDisjunctionEPjRNS0_8ByteTermE
+__ZN3JSC3JIT17emit_op_jngreaterEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_jgreatereqEPNS_11InstructionE
+__ZN3JSC3JIT21emitSlow_op_jngreaterEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22emitSlow_op_jgreatereqEPNS_11InstructionERPNS_13SlowCaseEntryE
+_JSObjectDeletePrivateProperty
+__ZN3WTF7HashMapINS_6RefPtrINS_10StringImplEEEN3JSC12WriteBarrierINS4_7UnknownEEENS4_17IdentifierRepHashENS_10HashTraitsIS3_EENS9_IS7_EEE6removeEPS2_
+__ZN3JSC6ParserINS_5LexerItEEE21parseDoWhileStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC20JSCallbackObjectData20JSPrivatePropertyMap13visitChildrenERNS_11SlotVisitorE
+__ZN3JSC11DoWhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7toInt32Ed
+__ZN3JSC4Yarr11YarrPattern23nonspacesCharacterClassEv
+__ZN3JSC4Yarr15nonspacesCreateEv
+__ZN3JSC12RegExpObject3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC17RegExpConstructor3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC17ObjectConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL21callObjectConstructorEPNS_9ExecStateE
+__ZN3JSC27constructArrayWithSizeQuirkEPNS_9ExecStateEPNS_22ArrayAllocationProfileEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3JSCL21objectConstructorKeysEPNS_9ExecStateE
+__ZN3JSC12StringObject3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC3JIT11emit_op_neqEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_neqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateEPNS_14JSGlobalObjectE
+__ZN3JSC36constructBooleanFromImmediateBooleanEPNS_9ExecStateEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3JSC13BooleanObjectC1ERNS_2VMEPNS_9StructureE
+__ZN3JSC10JSFunction4nameEPNS_9ExecStateE
+__ZNK3JSC18FunctionExecutable11paramStringEv
+__ZNK3JSC26UnlinkedFunctionExecutable11paramStringEv
+__ZN3JSC22jsMakeNontrivialStringIPKcN3WTF6StringES2_S4_S2_S4_EENS_7JSValueEPNS_9ExecStateET_T0_T1_T2_T3_T4_
+__ZN3WTF13tryMakeStringIPKcNS_6StringES2_S3_S2_S3_EENS_10PassRefPtrINS_10StringImplEEET_T0_T1_T2_T3_T4_
+__ZN3JSC4Yarr12ByteCompiler26alternativeBodyDisjunctionEb
+__ZN3JSC3JIT24emit_op_create_argumentsEPNS_11InstructionE
+__ZN3JSC3JIT16emit_op_new_funcEPNS_11InstructionE
+_cti_op_create_arguments
+__ZN3JSC3JIT27emit_op_new_array_with_sizeEPNS_11InstructionE
+_cti_op_new_array_with_size
+__ZN3JSC3JIT22privateCompilePutByValEPNS_9ByValInfoENS_16ReturnAddressPtrENS_12JITArrayModeE
+__ZN3JSC3JIT24emitArrayStoragePutByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpE
+__ZN3JSC3JIT22privateCompileGetByValEPNS_9ByValInfoENS_16ReturnAddressPtrENS_12JITArrayModeE
+_cti_op_new_func
+__ZN3JSCL20stringProtoFuncSliceEPNS_9ExecStateE
+__ZN3JSC9Structure31removePropertyWithoutTransitionERNS_2VMENS_12PropertyNameE
+__ZN3JSC10JSFunction14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC18FunctionParametersD1Ev
+__ZN3JSC3JIT20emit_op_is_undefinedEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_649compare64ENS_23MacroAssemblerX86Common19RelationalConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32ES4_
+__ZN3JSC3JIT26emit_op_tear_off_argumentsEPNS_11InstructionE
+_cti_op_tear_off_arguments
+__ZN3JSCL19stringProtoFuncTrimEPNS_9ExecStateE
+__ZN3JSCL10trimStringEPNS_9ExecStateENS_7JSValueEi
+__ZN3JSC15isStrWhiteSpaceEt
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE1EE24setLocalStoreEliminationENS_15VirtualRegisterEPNS0_4NodeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFPNS_6JSCellEPNS_9ExecStateEENS_12X86Registers10RegisterIDEEEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEENS_12X86Registers10RegisterIDE
+_operationCreateActivation
+__ZN3JSC17BytecodeGenerator21addConstantEmptyValueEv
+__ZN3JSC7JSProxy9classNameEPKNS_8JSObjectE
+__ZN3JSCL21arrayProtoFuncIndexOfEPNS_9ExecStateE
+__ZN3JSCL21stringProtoFuncCharAtEPNS_9ExecStateE
+__ZN3JSC6ParserINS_5LexerIhEEE18parseWithStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC20jsTypeStringForValueEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC20jsTypeStringForValueERNS_2VMEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3WTF6VectorIPvLm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+_cti_op_del_by_id
+__ZN3JSC3JIT21emit_op_switch_stringEPNS_11InstructionE
+__ZN3WTF6VectorIN3JSC12SwitchRecordELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC14OffsetLocationEEENS_24KeyValuePairKeyExtractorIS7_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E3addINS_17HashMapTranslatorISF_SA_EES3_S6_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC14OffsetLocationEEENS_24KeyValuePairKeyExtractorIS7_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E3addINS_22IdentityHashTranslatorISA_EES3_S7_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC14OffsetLocationEEENS_24KeyValuePairKeyExtractorIS7_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E6lookupINS_17HashMapTranslatorISF_SA_EEPS2_EEPS7_RKT0_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC14OffsetLocationEEENS_24KeyValuePairKeyExtractorIS7_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E6rehashEi
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC14OffsetLocationEEENS_24KeyValuePairKeyExtractorIS7_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E8reinsertERS7_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC14OffsetLocationEEENS_24KeyValuePairKeyExtractorIS7_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_EaSERKSG_
+__ZN3JSC3JIT26emit_op_check_has_instanceEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_instanceofEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_resolve_baseEPNS_11InstructionE
+__ZN3JSC3JIT19emit_op_put_to_baseEPNS_11InstructionE
+__ZN3JSC3JIT30emitSlow_op_check_has_instanceEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22emitSlow_op_instanceofEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT24emitSlow_op_resolve_baseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3WTF6String23make16BitFrom8BitSourceEPKhm
+_cti_op_switch_string
+__ZN3JSC8VoidNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC3JIT17emit_op_is_stringEPNS_11InstructionE
+__ZN3JSC6ParserINS_5LexerItEEE19parseThrowStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSCL23regExpProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSCL18regExpObjectGlobalEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL22regExpObjectIgnoreCaseEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL21regExpObjectMultilineEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC22jsMakeNontrivialStringIPKcN3WTF6StringEPcEENS_7JSValueEPNS_9ExecStateET_T0_T1_
+__ZN3WTF13tryMakeStringIPKcNS_6StringEPcEENS_10PassRefPtrINS_10StringImplEEET_T0_T1_
+__ZN3JSC20globalFuncParseFloatEPNS_9ExecStateE
+_cti_op_is_function
+_cti_op_put_by_id_transition_realloc
+__ZN3JSC3JIT30privateCompileGetByIdChainListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEPNS_14StructureChainEmRKNS_10IdentifierERKNS_12PropertySlotEiPNS_9ExecStateE
+__ZN3JSC7WeakSet15removeAllocatorEPNS_9WeakBlockE
+_cti_op_get_by_id_proto_list_full
+__ZN3JSC31stringLengthTrampolineGeneratorEPNS_2VME
+__ZN3JSC20MacroAssemblerX86_6421makeTailRecursiveCallENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC27ctiPatchCallByReturnAddressEPNS_9CodeBlockENS_16ReturnAddressPtrENS_21MacroAssemblerCodePtrE
+__ZN3WTF6String6removeEji
+__ZN3WTF6VectorIN3JSC4Yarr13YarrGeneratorILNS2_18YarrJITCompileModeE1EE17BacktrackingState19ReturnAddressRecordELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZNK3JSC7JSValue19synthesizePrototypeEPNS_9ExecStateE
+__ZN3JSC16BooleanPrototype18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC21getStaticFunctionSlotINS_13BooleanObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC7JSValue14putToPrimitiveEPNS_9ExecStateENS_12PropertyNameES0_RNS_15PutPropertySlotE
+__ZN3JSC4Yarr22YarrPatternConstructor22containsCapturingTermsEPNS0_18PatternAlternativeEmm
+__ZN3WTF12AtomicString16fromUTF8InternalEPKcS2_
+__ZN3WTF7Unicode51calculateStringHashAndLengthFromUTF8MaskingTop8BitsEPKcS2_RjS3_
+__ZN3WTF31HashAndUTF8CharactersTranslator5equalERKPNS_10StringImplERKNS_21HashAndUTF8CharactersE
+__ZN3WTF31HashAndUTF8CharactersTranslator9translateERPNS_10StringImplERKNS_21HashAndUTF8CharactersEj
+__ZN3WTF16codePointCompareERKNS_6StringES2_
+__ZNK3WTF13StringBuilder9canShrinkEv
+__ZN3JSC37leastUpperBoundOfIndexingTypeAndValueEhNS_7JSValueE
+__ZN3WTF15SegmentedVectorIN3JSC3DFG18NewArrayBufferDataELm4ELm32EE6appendIS3_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC3DFG18NewArrayBufferDataELm4ENS_15CrashOnOverflowEEELm0ES4_E14expandCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT17compileRegExpExecEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT19emitAllocateJSArrayENS_12X86Registers10RegisterIDEPNS_9StructureES3_j
+__ZN3JSC3DFG14SpeculativeJIT24emitAllocateBasicStorageINS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32EEENS5_4JumpET_NS_12X86Registers10RegisterIDE
+__ZN3JSC20MacroAssemblerX86_645add64ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15AbsoluteAddressENS_12X86Registers10RegisterIDE
+__ZN3JSC3DFG35CallArrayAllocatorSlowPathGeneratorC2ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPNS0_14SpeculativeJITEPFPcPNS_9ExecStateEPNS_9StructureEiENS_12X86Registers10RegisterIDESG_SC_m
+__ZN3JSC3DFG35CallArrayAllocatorSlowPathGenerator16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEPNS_9StructureEiENS_12X86Registers10RegisterIDES6_m
+__ZN3JSC3DFG35CallArrayAllocatorSlowPathGeneratorD0Ev
+__ZN3JSC12X86Assembler6push_rENS_12X86Registers10RegisterIDE
+__ZN3JSC20MacroAssemblerX86_644or32ENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15AbsoluteAddressE
+__ZN3JSC12X86Assembler5pop_rENS_12X86Registers10RegisterIDE
+_operationRegExpExec
+__ZN3JSC7JSScope15resolveWithBaseEPNS_9ExecStateERKNS_10IdentifierEPNS_8RegisterEPN3WTF6VectorINS_16ResolveOperationELm0ENS8_15CrashOnOverflowEEEPNS_18PutToBaseOperationE
+__ZN3JSC7JSScope30resolveContainingScopeInternalILNS0_10LookupModeE0ELNS0_12ReturnValuesE3EEEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotEPN3WTF6VectorINS_16ResolveOperationELm0ENSD_15CrashOnOverflowEEEPNS_18PutToBaseOperationEb
+__ZNK3JSC7SubNode10isSubtractEv
+__ZN3JSC7JSArray10sortVectorILh27EEEvPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_SB_ENS_12X86Registers10RegisterIDESF_SF_SF_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_SB_ENS_12X86Registers10RegisterIDESF_SF_SF_EC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESF_SF_SF_SF_
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_SB_ENS_12X86Registers10RegisterIDESF_SF_SF_ED0Ev
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_SB_ENS_12X86Registers10RegisterIDESF_SF_SF_ED1Ev
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringES7_S7_ENS_12X86Registers10RegisterIDESB_SB_SB_
+__ZN3JSC3DFG12CCallHelpers16setupTwoStubArgsILNS_12X86Registers10RegisterIDE6ELS4_1EEEvS4_S4_
+__ZN3JSC4Yarr6ParserINS0_13SyntaxCheckerEtE11parseTokensEv
+__ZN3JSC4Yarr6ParserINS0_13SyntaxCheckerEtE11parseEscapeILb0ES2_EEbRT0_
+__ZN3JSC4Yarr6ParserINS0_13SyntaxCheckerEtE19parseCharacterClassEv
+__ZN3JSC6ParserINS_5LexerItEEE18parseWithStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC4Yarr6ParserINS0_13SyntaxCheckerEtE11parseEscapeILb1ENS3_28CharacterClassParserDelegateEEEbRT0_
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfo11FatPositionELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC16SymbolTableEntry15notifyWriteSlowEv
+__ZN3JSC19FunctionConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL32constructWithFunctionConstructorEPNS_9ExecStateE
+__ZN3JSC17constructFunctionEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_7ArgListE
+__ZN3JSC41constructFunctionSkippingEvalEnabledCheckEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_7ArgListERKNS_10IdentifierERKN3WTF6StringERKNSA_12TextPositionE
+__ZN3JSC18FunctionExecutable14fromGlobalCodeERKNS_10IdentifierEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPPNS_8JSObjectE
+__ZN3JSC26UnlinkedFunctionExecutable14fromGlobalCodeERKNS_10IdentifierEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPPNS_8JSObjectE
+__ZN3JSC9CodeCache35getFunctionExecutableFromGlobalCodeERNS_2VMERKNS_10IdentifierERKNS_10SourceCodeERNS_11ParserErrorE
+__ZN3JSCL26stringProtoFuncLastIndexOfEPNS_9ExecStateE
+__ZNK3JSC7JSValue20toIntegerPreserveNaNEPNS_9ExecStateE
+__ZN3WTF10StringImpl11reverseFindEPS0_j
+__ZN3JSC15NumberPrototype18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC21getStaticFunctionSlotINS_12NumberObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_12PropertySlotE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC10RegisterIDEEELm8ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC16ArrayConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL29constructWithArrayConstructorEPNS_9ExecStateE
+__ZN3JSC28globalFuncEncodeURIComponentEPNS_9ExecStateE
+__ZN3JSCL6encodeEPNS_9ExecStateEPKc
+__ZN3JSC15JSStringBuilder6appendEt
+__ZN3JSC15JSStringBuilder5buildEPNS_9ExecStateE
+__ZN3WTF6VectorIhLm64ENS_20UnsafeVectorOverflowEE14shrinkCapacityEm
+__ZN3JSC28globalFuncDecodeURIComponentEPNS_9ExecStateE
+__ZN3JSCL6decodeEPNS_9ExecStateEPKcb
+__ZN3JSCL20dateProtoFuncSetTimeEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncToGMTStringEPNS_9ExecStateE
+__ZN3JSCL19formateDateInstanceEPNS_9ExecStateENS_14DateTimeFormatEb
+__ZNK3JSC12DateInstance29calculateGregorianDateTimeUTCEPNS_9ExecStateE
+__ZN3JSC17DateInstanceCache3addEd
+__ZN3WTF8msToYearEd
+__ZN3WTF11msToMinutesEd
+__ZN3WTF9msToHoursEd
+__ZN3WTF8msToDaysEd
+__ZN3WTF9dayInYearEdi
+__ZN3WTF10isLeapYearEi
+__ZN3WTF23dayInMonthFromDayInYearEib
+__ZN3WTF18monthFromDayInYearEib
+__ZN3JSC14formatDateTimeERKN3WTF17GregorianDateTimeENS_14DateTimeFormatEb
+__ZN3JSC16SymbolTableEntry18addressOfIsWatchedEv
+__ZN3JSC3JIT16emit_op_jgreaterEPNS_11InstructionE
+__ZN3JSC3JIT20emitSlow_op_jgreaterEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3WTF6VectorIN3JSC3DFG14ByteCodeParser14ConstantRecordELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC3DFG9InsertionELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG22CFGSimplificationPhase13jettisonBlockEjjNS_10CodeOriginE
+__ZN3JSC3DFG22CFGSimplificationPhase16keepOperandAliveEPNS0_10BasicBlockES3_NS_10CodeOriginEi
+__ZN3JSC3DFG10BasicBlock10appendNodeINS0_8NodeTypeENS_10CodeOriginENS0_6OpInfoEEEPNS0_4NodeERNS0_5GraphEjRKT_RKT0_RKT1_
+__ZN3JSC3DFG19CPSRethreadingPhase34canonicalizeFlushOrPhantomLocalForILNS0_8NodeTypeE16ELNS_11OperandKindE0EEEvPNS0_4NodeEPNS0_18VariableAccessDataEm
+__ZN3WTF6VectorIPN3JSC3DFG4NodeELm128ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC3DFG11JITCompiler12JSCallRecordELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFmPNS_9ExecStateExENS_12X86Registers10RegisterIDES7_
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC3DFG17SlowPathGeneratorEEELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT22speculateObjectOrOtherENS0_4EdgeE
+_dfgConvertJSValueToBoolean
+__ZN3WTF10makeStringINS_6StringEPKcS1_EES1_T_T0_T1_
+__ZN3WTF13tryMakeStringINS_6StringEPKcS1_EENS_10PassRefPtrINS_10StringImplEEET_T0_T1_
+__ZN3JSC3DFG15dfgResetGetByIDERNS_13RepatchBufferERNS_17StructureStubInfoE
+__ZN3JSC9HandleSet4growEv
+_cti_op_typeof
+__ZN3JSC12RegExpObject12setLastIndexEPNS_9ExecStateEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE31opCompileParentheticalAssertionEPNS0_11PatternTermE
+__ZN3JSC4Yarr12ByteCompiler31atomParentheticalAssertionBeginEjbjj
+__ZN3JSC4Yarr12ByteCompiler29atomParentheticalAssertionEndEjjN3WTF7CheckedIjNS2_15CrashOnOverflowEEENS0_14QuantifierTypeE
+__ZN3JSC5shiftILNS_7JSArray14ShiftCountModeE1EEEvPNS_9ExecStateEPNS_8JSObjectEjjjj
+__ZN3JSC18RegExpMatchesArray10putByIndexEPNS_6JSCellEPNS_9ExecStateEjNS_7JSValueEb
+__ZN3JSC18RegExpMatchesArray21deletePropertyByIndexEPNS_6JSCellEPNS_9ExecStateEj
+__ZN3JSC18RegExpMatchesArray3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE31opCompileParentheticalAssertionEPNS0_11PatternTermE
+_cti_op_greater
+_cti_op_instanceof
+_cti_op_load_varargs
+__ZNK3JSC9ArrayNode13isSimpleArrayEv
+__ZNK3JSC9ArrayNode14toArgumentListEPNS_2VMEii
+_cti_op_get_by_id_proto_fail
+__ZN3JSC9parseDateEPNS_9ExecStateERKN3WTF6StringE
+__ZN3WTF40parseES5DateFromNullTerminatedCharactersEPKc
+__ZN3WTF37parseDateFromNullTerminatedCharactersEPKcRbRi
+__ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
+__ZN3WTF6VectorIN3JSC10ASTBuilder14AssignmentInfoELm10ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+_floorThunk
+__ZN3JSCL20dateProtoFuncGetYearEPNS_9ExecStateE
+__ZNK3JSC12DateInstance26calculateGregorianDateTimeEPNS_9ExecStateE
+__ZN3JSCL15localTimeOffsetEPNS_9ExecStateEd
+__ZN3WTF24calculateLocalTimeOffsetEd
+__ZN3JSCL20dateProtoFuncGetDateEPNS_9ExecStateE
+__ZN3JSCL21dateProtoFuncGetMonthEPNS_9ExecStateE
+__ZN3JSCL21dateProtoFuncGetHoursEPNS_9ExecStateE
+__ZN3JSCL23dateProtoFuncGetMinutesEPNS_9ExecStateE
+__ZN3JSCL23dateProtoFuncGetSecondsEPNS_9ExecStateE
+__ZN3JSCL19dateProtoFuncGetDayEPNS_9ExecStateE
+__ZN3JSCL30dateProtoFuncGetTimezoneOffsetEPNS_9ExecStateE
+__ZN3JSC28createUndefinedVariableErrorEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3WTF13tryMakeStringIPKcNS_6StringEEENS_10PassRefPtrINS_10StringImplEEET_T0_
+__ZN3JSC20createReferenceErrorEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC13ErrorInstance6createERNS_2VMEPNS_9StructureERKN3WTF6StringE
+__ZN3JSC10throwErrorEPNS_9ExecStateEPNS_8JSObjectE
+__ZN3JSC5LLInt13returnToThrowEPNS_9ExecStateEPNS_11InstructionE
+__ZN3JSC9CodeBlock20adjustPCIfAtCallSiteEPNS_11InstructionE
+__ZN3JSC12genericThrowEPNS_2VMEPNS_9ExecStateENS_7JSValueEj
+__ZN3JSC3JIT11emit_op_modEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_divEPNS_11InstructionE
+__ZN3JSC3JIT21emitLoadInt32ToDoubleEiNS_12X86Registers13XMMRegisterIDE
+__ZN3JSC14MacroAssembler20convertInt32ToDoubleENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers13XMMRegisterIDE
+__ZN3JSC3JIT15emitSlow_op_modEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSCL20dateProtoFuncSetYearEPNS_9ExecStateE
+__ZN3WTF18dateToDaysFrom1970Eiii
+__ZN3JSC10PrefixNode11emitBracketERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16globalFuncEscapeEPNS_9ExecStateE
+__ZN3JSC15JSStringBuilder6appendEPKc
+__ZN3WTF6VectorIhLm64ENS_20UnsafeVectorOverflowEE9tryAppendIhEEbPKT_m
+__ZN3JSC18globalFuncUnescapeEPNS_9ExecStateE
+__ZN3JSC14MacroAssembler22loadXorBlindedConstantENS0_12BlindedImm32ENS_12X86Registers10RegisterIDE
+__ZN3WTF7Unicode18UTF8SequenceLengthEc
+__ZN3WTF7Unicode18decodeUTF8SequenceEPKc
+__ZN3JSCL23numberProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSC21ReadModifyBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7JSArray29shiftCountWithAnyIndexingTypeEPNS_9ExecStateEjj
+__ZN3JSC6Walker4walkENS_7JSValueE
+__ZN3JSC13UnaryPlusNode14stripUnaryPlusEv
+__ZN3JSC3JIT11emit_op_mulEPNS_11InstructionE
+__ZN3JSC14MacroAssembler11branchMul32ENS_23MacroAssemblerX86Common15ResultConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDES8_
+__ZN3JSC3JIT15emitSlow_op_mulEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC9ExecState19arrayPrototypeTableEPS0_
+__ZN3JSC3JIT23emitSlow_op_put_to_baseEPNS_11InstructionERPNS_13SlowCaseEntryE
+_cti_op_put_to_base
+__ZN3JSC3DFG14SpeculativeJIT21compileIntegerCompareEPNS0_4NodeENS_23MacroAssemblerX86Common19RelationalConditionE
+__ZNK3JSC28MethodOfGettingAValueProfile17getSpecFailBucketEj
+__ZN3WTF6VectorIhLm64ENS_20UnsafeVectorOverflowEE17tryExpandCapacityEm
+__ZN3JSC11PostfixNode11emitBracketERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC3JIT15emitSlow_op_divEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3DFG14SpeculativeJIT17compileInstanceOfEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT26compileInstanceOfForObjectEPNS0_4NodeENS_12X86Registers10RegisterIDES5_S5_
+__ZN3JSC3DFG15AssemblyHelpers17branchIfNotObjectENS_12X86Registers10RegisterIDE
+__ZN3WTF9HashTableIPN3JSC3DFG18VariableAccessDataES4_NS_17IdentityExtractorENS_7PtrHashIS4_EENS_10HashTraitsIS4_EES9_E3addINS_22IdentityHashTranslatorIS7_EES4_S4_EENS_18HashTableAddResultINS_17HashTableIteratorIS4_S4_S5_S7_S9_S9_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPN3JSC3DFG18VariableAccessDataES4_NS_17IdentityExtractorENS_7PtrHashIS4_EENS_10HashTraitsIS4_EES9_E16lookupForWritingINS_22IdentityHashTranslatorIS7_EES4_EENSt3__14pairIPS4_bEERKT0_
+__ZN3WTF9HashTableIPN3JSC3DFG18VariableAccessDataENS_12KeyValuePairIS4_NS2_12_GLOBAL__N_121ArgumentsAliasingDataEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS4_EENS_18HashMapValueTraitsINS_18NullableHashTraitsIS4_EENS_10HashTraitsIS7_EEEESF_E4findERKS4_
+__ZN3WTF9HashTableIPN3JSC3DFG18VariableAccessDataENS_12KeyValuePairIS4_NS2_12_GLOBAL__N_121ArgumentsAliasingDataEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS4_EENS_18HashMapValueTraitsINS_18NullableHashTraitsIS4_EENS_10HashTraitsIS7_EEEESF_E6expandEv
+__ZN3JSC3DFG28ArgumentsSimplificationPhase22observeBadArgumentsUseEPNS0_4NodeE
+__ZN3JSC3DFG28ArgumentsSimplificationPhase38removeArgumentsReferencingPhantomChildEPNS0_4NodeEj
+__ZN3JSC9CodeBlock19shouldReoptimizeNowEv
+__ZN3JSC9CodeBlock19optimizeAfterWarmUpEv
+__ZN3JSC3DFG14ByteCodeParser10addToGraphENS0_8NodeTypeENS0_4EdgeES3_S3_
+__ZN3JSC3DFG14SpeculativeJIT25compileGetArgumentsLengthEPNS0_4NodeE
+__ZN3JSC9CodeBlock25appendSpeculationRecoveryERKNS_3DFG19SpeculationRecoveryE
+__ZN3WTF6VectorIN3JSC3DFG19SpeculationRecoveryELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT26compileGetByValOnArgumentsEPNS0_4NodeE
+__ZN3JSC3DFG12GPRTemporaryC1Ev
+__ZN3JSC3DFG14SpeculativeJIT28temporaryRegisterForPutByValERNS0_12GPRTemporaryENS0_9ArrayModeE
+__ZN3JSC3JIT17emit_op_is_numberEPNS_11InstructionE
+_cti_op_not
+__ZN3JSC10ASTBuilder14makeBitXOrNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSC3JIT16emit_op_neq_nullEPNS_11InstructionE
+__ZN3JSC4Yarr12ByteCompiler17atomBackReferenceEjjjN3WTF7CheckedIjNS2_15CrashOnOverflowEEENS0_14QuantifierTypeE
+_cti_op_mul
+__ZN3JSC4Yarr11InterpreterIhE18matchBackReferenceERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterIhE23tryConsumeBackReferenceEiij
+__ZN3WTF6VectorIN3JSC3DFG20ResolveOperationDataELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEPNS_10IdentifierEPN3WTF6VectorINS_16ResolveOperationELm0ENS6_15CrashOnOverflowEEEENS_12X86Registers10RegisterIDES5_SB_
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEPNS_10IdentifierEPN3WTF6VectorINS_16ResolveOperationELm0ENS6_15CrashOnOverflowEEEPNS_18PutToBaseOperationEENS_12X86Registers10RegisterIDES5_SB_SD_
+_operationResolve
+__ZN3JSC36leastUpperBoundOfIndexingTypeAndTypeEhj
+_operationNewArrayWithSize
+__ZN3JSC17StringConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL21callStringConstructorEPNS_9ExecStateE
+__ZN3JSC3DFG14ByteCodeParser12constantNullEv
+__ZN3JSC3DFG14SpeculativeJIT25nonSpeculativeCompareNullEPNS0_4NodeENS0_4EdgeEb
+__ZN3JSC3DFG14SpeculativeJIT32nonSpeculativePeepholeBranchNullENS0_4EdgeEPNS0_4NodeEb
+__ZN3JSC3DFG14SpeculativeJIT11branchTest8INS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressENS5_12TrustedImm32EEEvNS_23MacroAssemblerX86Common15ResultConditionET_T0_j
+_handleHostCall
+__ZNK3WTF6String7toFloatEPb
+__ZN3WTF10StringImpl7toFloatEPb
+__ZN3WTF17charactersToFloatEPKhmPb
+_JSScriptCreateReferencingImmortalASCIIText
+__ZNK14OpaqueJSScript6sourceEv
+__ZN3JSC6ParserINS_5LexerIhEEE21parseConstDeclarationINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC10ASTBuilder28createGetterOrSetterPropertyILb0EEEPNS_12PropertyNodeERKNS_15JSTokenLocationENS2_4TypeEPKNS_10IdentifierEPNS_13ParameterNodeEPNS_16FunctionBodyNodeEjjiij
+__ZN3JSC10ASTBuilder28createGetterOrSetterPropertyILb1EEEPNS_12PropertyNodeERKNS_15JSTokenLocationENS2_4TypeEPKNS_10IdentifierEPNS_13ParameterNodeEPNS_16FunctionBodyNodeEjjiij
+__ZN3JSC6ParserINS_5LexerIhEEE21parseConstDeclarationINS_13SyntaxCheckerEEENT_9StatementERS6_
+_JSScriptEvaluate
+__ZN3JSC18ConstStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13ConstDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13ConstDeclNode14emitCodeSingleERNS_17BytecodeGeneratorE
+__ZN3JSC17BytecodeGenerator16resolveConstDeclERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator19emitInitGlobalConstERKNS_10IdentifierEPNS_10RegisterIDE
+__ZN3WTF9HashTableIPNS_10StringImplENS_12KeyValuePairIS2_NSt3__14pairIPN3JSC12PropertyNodeES8_EEEENS_24KeyValuePairKeyExtractorISA_EENS_10StringHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSF_IS9_EEEESG_E3addINS_17HashMapTranslatorISI_SD_EES2_S9_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_SA_SC_SD_SI_SG_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPNS_10StringImplENS_12KeyValuePairIS2_NSt3__14pairIPN3JSC12PropertyNodeES8_EEEENS_24KeyValuePairKeyExtractorISA_EENS_10StringHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSF_IS9_EEEESG_E8reinsertERSA_
+__ZN3JSC17BytecodeGenerator19emitPutGetterSetterEPNS_10RegisterIDERKNS_10IdentifierES2_S2_
+__ZN3WTF6VectorINSt3__14pairIiiEELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEi
+__ZNK3JSC12PropertySlot14functionGetterEPNS_9ExecStateE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE29generateAssertionWordBoundaryEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE22matchAssertionWordcharEmRNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListES8_
+__ZN3WTF6VectorIN3JSC4Yarr13YarrGeneratorILNS2_18YarrJITCompileModeE0EE6YarrOpELm128ENS_15CrashOnOverflowEE15reserveCapacityEm
+_cti_op_greatereq
+__ZN3JSCL17arrayProtoFuncMapEPNS_9ExecStateE
+_JSObjectCopyPropertyNames
+_JSStringRetain
+_JSPropertyNameArrayGetCount
+_JSPropertyNameArrayGetNameAtIndex
+_JSPropertyNameArrayRelease
+__ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE7balanceEi
+__ZN3WTF21charactersToIntStrictEPKhmPbi
+__ZN3WTF12detachThreadEj
+__ZN3WTF7HashMapIjNS_6OwnPtrINS_12PthreadStateEEENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE6removeERKj
+__ZN3JSC17BytecodeGenerator18pushFinallyContextEPNS_13StatementNodeE
+__ZN3JSC17BytecodeGenerator20emitComplexPopScopesEPNS_18ControlFlowContextES2_
+__ZN3WTF6VectorIN3JSC18ControlFlowContextELm0ENS_15CrashOnOverflowEEaSILm0ENS_20UnsafeVectorOverflowEEERS4_RKNS0_IS2_XT_ET0_EE
+__ZN3WTF6VectorIN3JSC18ControlFlowContextELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC18ControlFlowContextELm0ENS_20UnsafeVectorOverflowEEaSILm0ENS_15CrashOnOverflowEEERS4_RKNS0_IS2_XT_ET0_EE
+__ZN3JSC17BytecodeGenerator17popFinallyContextEv
+__ZN3WTF6VectorIN3JSC4Yarr13YarrGeneratorILNS2_18YarrJITCompileModeE0EE6YarrOpELm128ENS_15CrashOnOverflowEE14appendSlowCaseIS6_EEvRKT_
+_cti_op_less
+__ZN3JSC3DFG14SpeculativeJIT8arrayifyEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT8arrayifyEPNS0_4NodeENS_12X86Registers10RegisterIDES5_
+__ZN3JSC3DFG25ArrayifySlowPathGeneratorC2ERKNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPNS0_14SpeculativeJITEPNS0_4NodeENS_12X86Registers10RegisterIDESD_SD_SD_
+__ZN3JSC3DFG14SpeculativeJIT24backwardSpeculationCheckENS_8ExitKindENS0_13JSValueSourceEPNS0_4NodeE
+__ZN3JSC3DFG25ArrayifySlowPathGenerator16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEPNS_6JSCellEENS_12X86Registers10RegisterIDESA_
+__ZN3JSC3DFG22OSRExitJumpPlaceholder4fillEPNS0_14SpeculativeJITERKNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFvPNS_9ExecStateEPNS_8JSObjectEixENS_12X86Registers10RegisterIDES9_S9_
+__ZN3JSC3DFG25ArrayifySlowPathGeneratorD0Ev
+_operationEnsureContiguous
+__ZN3JSC8JSObject20ensureContiguousSlowERNS_2VME
+__ZN3JSC8JSObject20ensureContiguousSlowERNS_2VMENS0_22DoubleToContiguousModeE
+_operationMakeRope3
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFxPNS_9ExecStateExPNS_7JSArrayEENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_T4_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateExPNS_7JSArrayEENS_12X86Registers10RegisterIDES9_S9_
+_operationArrayPush
+_operationGetByIdProtoBuildList
+_operationGetByIdProtoBuildListWithReturnAddress
+__ZN3JSC3DFG24dfgBuildGetByIDProtoListEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_12PropertySlotERNS_17StructureStubInfoE
+__ZN3JSC3DFG33mightInlineFunctionForClosureCallEPNS_9CodeBlockE
+__ZN3JSC3DFG14SpeculativeJIT30compileObjectOrOtherLogicalNotENS0_4EdgeE
+__ZN3JSC3DFG12GPRTemporary5adoptERS1_
+__ZN3WTF6VectorIPN3JSC9StructureELm2ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT26compileStrictEqForConstantEPNS0_4NodeENS0_4EdgeENS_7JSValueE
+_operationIsFunction
+_operationLinkClosureCall
+_virtualForWithFunction
+__ZN3JSC3DFG14dfgLinkSlowForEPNS_9ExecStateERNS_12CallLinkInfoENS_22CodeSpecializationKindE
+__ZN3JSC3DFGL11linkSlowForERNS_13RepatchBufferEPNS_2VMERNS_12CallLinkInfoENS_22CodeSpecializationKindE
+__ZN3JSC3DFG25virtualCallThunkGeneratorEPNS_2VME
+__ZN3JSC9CodeBlock17addConstantBufferERKN3WTF6VectorINS_7JSValueELm0ENS1_15CrashOnOverflowEEE
+__ZN3WTF9HashTableIN3JSC3DFG17ConstantBufferKeyENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EENS2_21ConstantBufferKeyHashENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSA_IjEEEESB_E16lookupForWritingINS_22IdentityHashTranslatorIS8_EES3_EENSt3__14pairIPS5_bEERKT0_
+__ZN3WTF9HashTableIN3JSC3DFG17ConstantBufferKeyENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EENS2_21ConstantBufferKeyHashENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSA_IjEEEESB_E3addINS_17HashMapTranslatorISD_S8_EES3_jEENS_18HashTableAddResultINS_17HashTableIteratorIS3_S5_S7_S8_SD_SB_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIN3JSC3DFG17ConstantBufferKeyENS_12KeyValuePairIS3_jEENS_24KeyValuePairKeyExtractorIS5_EENS2_21ConstantBufferKeyHashENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSA_IjEEEESB_E6lookupINS_22IdentityHashTranslatorIS8_EES3_EEPS5_RKT0_
+__ZN3WTF9HashTableIPN3JSC15InlineCallFrameES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_18NullableHashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPN3JSC15InlineCallFrameES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_18NullableHashTraitsIS3_EES8_E6rehashEi
+__ZN3JSC3DFG28ArgumentsSimplificationPhase14isOKToOptimizeEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEiENS_12X86Registers10RegisterIDEi
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFvPNS_9ExecStateEPNS_6JSCellES5_ENS_12X86Registers10RegisterIDES9_
+_operationCreateArguments
+_getByVal
+_operationTearOffArguments
+__ZN3JSC9ExecState21isInlineCallFrameSlowEv
+__ZN3JSC3DFG18dfgLinkClosureCallEPNS_9ExecStateERNS_12CallLinkInfoEPNS_9CodeBlockEPNS_9StructureEPNS_14ExecutableBaseENS_21MacroAssemblerCodePtrE
+__ZN3JSC3DFG14SpeculativeJIT30compileAllocatePropertyStorageEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEENS_12X86Registers10RegisterIDE
+__ZNSt3__127__insertion_sort_incompleteIRPFbRKN3JSC3DFG12MinifiedNodeES5_EPS3_EEbT0_SA_T_
+_operationCompareStrictEq
+__ZN3JSC3DFG14SpeculativeJIT32compileReallocatePropertyStorageEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateES3_ENS_12X86Registers10RegisterIDES9_
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEmENS_12X86Registers10RegisterIDEm
+_operationAllocatePropertyStorage
+__ZN3JSCL21arrayProtoFuncReverseEPNS_9ExecStateE
+__ZN3JSC3DFG10FixupPhase13fixDoubleEdgeILNS0_7UseKindE4EEEvRNS0_4EdgeENS0_20SpeculationDirectionE
+__ZN3JSC3DFG14SpeculativeJIT20compileInt32ToDoubleEPNS0_4NodeE
+__ZN3JSC3DFG15AssemblyHelpers11unboxDoubleENS_12X86Registers10RegisterIDENS2_13XMMRegisterIDE
+__ZN3JSC3DFG14SpeculativeJIT20compileDoubleCompareEPNS0_4NodeENS_23MacroAssemblerX86Common15DoubleConditionE
+__ZN3JSC3DFG14SpeculativeJIT19fillSpeculateDoubleENS0_4EdgeE
+_operationMakeRope2
+_operationPutByIdNonStrictBuildList
+_operationPutByIdNonStrictBuildListWithReturnAddress
+__ZN3JSC3DFG19dfgBuildPutByIdListEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_15PutPropertySlotERNS_17StructureStubInfoENS_7PutKindE
+__ZN3JSC22PolymorphicPutByIdList4fromENS_7PutKindERNS_17StructureStubInfoENS_21MacroAssemblerCodePtrE
+__ZN3JSC22PolymorphicPutByIdListC2ENS_7PutKindERNS_17StructureStubInfoENS_21MacroAssemblerCodePtrE
+__ZN3JSC22PolymorphicPutByIdList9addAccessERKNS_13PutByIdAccessE
+__ZN3WTF6VectorIN3JSC13PutByIdAccessELm2ENS_15CrashOnOverflowEE6resizeEm
+__ZNK3JSC22PolymorphicPutByIdList6isFullEv
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateExENS_12X86Registers10RegisterIDES7_
+_operationCompareStringEq
+__ZN3JSCL16mathProtoFuncMinEPNS_9ExecStateE
+_jsRoundThunk
+_jsRound
+__ZN3JSC17absThunkGeneratorEPNS_2VME
+__ZN3JSC23MacroAssemblerX86Common9absDoubleENS_12X86Registers13XMMRegisterIDES2_
+__ZN3JSCL16mathProtoFuncAbsEPNS_9ExecStateE
+_cti_op_get_by_id_getter_stub
+__ZN3JSC22createNotAnObjectErrorEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC15createTypeErrorEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC3DFG22CFGSimplificationPhase15killUnreachableEj
+__ZN3JSC39CompressedLazyOperandValueProfileHolder3addERKNS_26LazyOperandValueProfileKeyE
+__ZN3WTF15SegmentedVectorIN3JSC23LazyOperandValueProfileELm8ELm32EE6appendIS2_EEvRKT_
+__ZN3WTF6VectorIPNS0_IN3JSC23LazyOperandValueProfileELm8ENS_15CrashOnOverflowEEELm0ES3_E14expandCapacityEm
+__ZN3WTF6VectorIN3JSC3DFG11ValueSourceELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC13ValueRecoveryELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE27generateCharacterClassFixedEm
+__ZN3WTF7HashMapImmNS_7IntHashImEENS_10HashTraitsImEES4_E6removeENS_24HashTableIteratorAdapterINS_9HashTableImNS_12KeyValuePairImmEENS_24KeyValuePairKeyExtractorIS9_EES2_NS_18HashMapValueTraitsIS4_S4_EES4_EES9_EE
+__ZN3JSC30FixedVMPoolExecutableAllocator16notifyPageIsFreeEPv
+__ZN3WTF11OSAllocator8decommitEPvm
+__ZN3WTF15SegmentedVectorIN3JSC23LazyOperandValueProfileELm8ELm32EED2Ev
+__ZN3WTF6VectorINS_6OwnPtrIN3JSC9CodeBlockEEELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC22PolymorphicPutByIdListD1Ev
+__ZN3JSC41MarkingGCAwareJITStubRoutineWithOneObjectD0Ev
+__ZN3WTF6OwnPtrI24OpaqueJSClassContextDataED2Ev
+__ZN3JSC5LexerIhE19parseStringSlowCaseILb0EEENS1_17StringParseResultEPNS_11JSTokenDataEb
+__ZN3JSC5LexerIhE24parseFourDigitUnicodeHexEv
+__ZN3JSC4Yarr13YarrCodeBlock5clearEv
+__ZN3JSC3DFG14SpeculativeJIT10checkArrayEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT28jumpSlowForUnwantedArrayModeENS_12X86Registers10RegisterIDENS0_9ArrayModeE
+__ZN3JSC3DFG14SpeculativeJIT24backwardSpeculationCheckENS_8ExitKindENS0_13JSValueSourceEPNS0_4NodeERKNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListE
+__ZN3JSC8OperandsINS_13ValueRecoveryENS_18OperandValueTraitsIS1_EEE8setLocalEmRKS1_
+__ZN3WTF37parseDateFromNullTerminatedCharactersEPKc
+__ZN3JSC20StringSourceProviderD0Ev
+__ZN3JSC3DFG8CSEPhaseILNS0_7CSEModeE1EE25scopedVarStoreEliminationEPNS0_4NodeES5_j
+__ZN3JSC3DFG12FPRTemporaryC1EPNS0_14SpeculativeJITE
+__ZN3JSC20MacroAssemblerX86_647store64ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm64ENS3_9BaseIndexE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDES9_
+__ZNK3JSC22PolymorphicPutByIdList9visitWeakEv
+__ZNK3JSC13PutByIdAccess9visitWeakEv
+__ZN3WTF24numberToFixedWidthStringEdjPc
+__ZNK3WTF17double_conversion23DoubleToStringConverter7ToFixedEdiPNS0_13StringBuilderE
+__ZN3WTF17double_conversion13FastFixedDtoaEdiNS0_15BufferReferenceIcEEPiS3_
+__ZN3WTF17double_conversionL15FillFractionalsEyiiNS0_15BufferReferenceIcEEPiS3_
+__ZN3WTF10StringImpl23defaultWritingDirectionEPb
+__ZN3WTF20fastMallocStatisticsEv
+__ZN3JSC4Heap4sizeEv
+__ZN3JSC4Heap8capacityEv
+__ZN3JSC11CopiedSpace8capacityEv
+__ZN3JSC22globalMemoryStatisticsEv
+__ZN3JSC7JSStack18committedByteCountEv
+__ZN3JSC19ExecutableAllocator18committedByteCountEv
+__ZN3WTF14FastMallocZone10statisticsEP14_malloc_zone_tP19malloc_statistics_t
+__ZN3WTF9BitVector15resizeOutOfLineEm
+__ZN3WTF9BitVector8clearAllEv
+__ZN3JSC6ParserINS_5LexerIhEEE8getLabelEPKNS_10IdentifierE
+__ZN3JSC5Scope9pushLabelEPKNS_10IdentifierEb
+__ZN3JSC9LabelNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7JSScope30resolveContainingScopeInternalILNS0_10LookupModeE1ELNS0_12ReturnValuesE2EEEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotEPN3WTF6VectorINS_16ResolveOperationELm0ENSD_15CrashOnOverflowEEEPNS_18PutToBaseOperationEb
+_cti_op_put_by_id_direct_generic
+__ZN3WTF6String6numberEdjNS_29TrailingZerosTruncatingPolicyE
+__ZN3WTF28numberToFixedPrecisionStringEdjPcb
+__ZNK3WTF17double_conversion23DoubleToStringConverter11ToPrecisionEdiPNS0_13StringBuilderE
+__ZN3JSC17RegExpConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL21callRegExpConstructorEPNS_9ExecStateE
+__ZN3WTF22charactersToUIntStrictEPKhmPbi
+__ZN3JSC13LiteralParserIhE5Lexer3lexILNS_10ParserModeE1EEENS_9TokenTypeERNS_18LiteralParserTokenIhEE
+__ZN3JSC10ASTBuilder19makeURightShiftNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSC16ErrorConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL20callErrorConstructorEPNS_9ExecStateE
+__ZN3JSC9Arguments15copyToArgumentsEPNS_9ExecStateES2_j
+__ZN3JSC6ParserINS_5LexerIhEEE21parseDoWhileStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSCL21functionProtoFuncCallEPNS_9ExecStateE
+__ZNK3JSC7ArgList8getSliceEiRS0_
+__ZN3JSCL21functionProtoFuncBindEPNS_9ExecStateE
+__ZN3JSC10JSFunction12lengthGetterEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC15JSBoundFunction6createEPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_8JSObjectENS_7JSValueES7_iRKN3WTF6StringE
+__ZN3JSC10JSFunction16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSC10JSFunctionC2EPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureE
+__ZN3JSC15JSBoundFunction14finishCreationEPNS_9ExecStateEPNS_16NativeExecutableEiRKN3WTF6StringE
+__ZN3JSC14JSGlobalObject20createThrowTypeErrorEPNS_9ExecStateE
+__ZN3JSC17boundFunctionCallEPNS_9ExecStateE
+_cti_op_lesseq
+__ZN3JSC8JSObject45putByIndexBeyondVectorLengthWithoutAttributesILh20EEEvPNS_9ExecStateEjNS_7JSValueE
+_cti_op_construct_jitCompile
+__ZN3JSC3JIT17emit_op_call_evalEPNS_11InstructionE
+__ZN3JSC3JIT15compileCallEvalEv
+__ZN3JSC3JIT21emitSlow_op_call_evalEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT23compileCallEvalSlowCaseERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT16emit_op_jnlesseqEPNS_11InstructionE
+__ZN3JSC3JIT15emit_op_jlesseqEPNS_11InstructionE
+__ZN3JSC3JIT20emitSlow_op_jnlesseqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT19emitSlow_op_jlesseqEPNS_11InstructionERPNS_13SlowCaseEntryE
+_cti_op_construct_arityCheck
+__ZN3JSC8JSObject44putByIndexBeyondVectorLengthWithArrayStorageEPNS_9ExecStateEjNS_7JSValueEbPNS_12ArrayStorageE
+__ZN3JSC3DFG14SpeculativeJIT36nonSpeculativeNonPeepholeCompareNullENS0_4EdgeEb
+__ZN3JSC17powThunkGeneratorEPNS_2VME
+__ZN3JSC18BooleanConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL22callBooleanConstructorEPNS_9ExecStateE
+__ZNK3JSC7JSValue19toWTFStringSlowCaseEPNS_9ExecStateE
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEtE11parseTokensEv
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEtE19parseCharacterClassEv
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEtE28CharacterClassParserDelegate20atomPatternCharacterEtb
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEtE21parseParenthesesBeginEv
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEtE11parseEscapeILb0ES2_EEbRT0_
+__ZN3JSC6ParserINS_5LexerIhEEE5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EERNS_11ParserErrorE
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC12WriteBarrierINS5_14EvalExecutableEEEEENS_24KeyValuePairKeyExtractorIS9_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSE_IS8_EEEESF_E3addINS_17HashMapTranslatorISH_SC_EEPS2_S8_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S9_SB_SC_SH_SF_EEEERKT0_RKT1_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC12WriteBarrierINS5_14EvalExecutableEEEEENS_24KeyValuePairKeyExtractorIS9_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSE_IS8_EEEESF_E6lookupINS_17HashMapTranslatorISH_SC_EEPS2_EEPS9_RKT0_
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC12WriteBarrierINS5_14EvalExecutableEEEEENS_24KeyValuePairKeyExtractorIS9_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSE_IS8_EEEESF_E6rehashEi
+__ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEENS_12KeyValuePairIS3_N3JSC12WriteBarrierINS5_14EvalExecutableEEEEENS_24KeyValuePairKeyExtractorIS9_EENS_10StringHashENS_22KeyValuePairHashTraitsINS_10HashTraitsIS3_EENSE_IS8_EEEESF_E8reinsertERS9_
+_operationVirtualCall
+__ZN3JSC3DFG14SpeculativeJIT29compilePeepHoleObjectEqualityEPNS0_4NodeES3_
+__ZNK3WTF10StringImpl10startsWithEt
+__ZN3JSCL25numberConstructorMaxValueEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+_JSStringCreateWithCharactersNoCopy
+__ZN3WTF10StringImpl20createWithoutCopyingEPKtjNS_27HasTerminatingNullCharacterE
+__ZN3JSC4Yarr25CharacterClassConstructor20putUnicodeIgnoreCaseEtPNS0_25UCS2CanonicalizationRangeE
+__ZN3JSC8JSString25getOwnPropertySlotByIndexEPNS_6JSCellEPNS_9ExecStateEjRNS_12PropertySlotE
+_operationCompareStrictEqCell
+__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateEj
+__ZN3JSC18globalFuncIsFiniteEPNS_9ExecStateE
+__ZN3JSC11JSWithScope13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC15JSBoundFunction13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC14EvalExecutable13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC15JSBoundFunction7destroyEPNS_6JSCellE
+_cti_op_call_eval
+__ZN3JSC3DFG14SpeculativeJIT21compileBooleanCompareEPNS0_4NodeENS_23MacroAssemblerX86Common19RelationalConditionE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEPNS_6JSCellEENS_12X86Registers10RegisterIDES5_
+_operationNewFunction
+__ZN3JSC3DFG14SpeculativeJIT20emitAllocateJSObjectINS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE13TrustedImmPtrEEEvS4_S4_T_T0_S4_RNS7_8JumpListE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDESF_jEEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDESB_i
+_operationCreateThis
+__ZN3WTF6VectorINSt3__14pairIPN3JSC8JSObjectEjEELm4ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC10ASTBuilder18makeRightShiftNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3JSCL23objectConstructorCreateEPNS_9ExecStateE
+__ZN3JSC19globalFuncDecodeURIEPNS_9ExecStateE
+__ZN3JSC3DFG14ByteCodeParser30handleConstantInternalFunctionEbiPNS_16InternalFunctionEiijNS_22CodeSpecializationKindE
+__ZN3WTF13StringBuilder12appendNumberEm
+__ZN3JSC2VM14discardAllCodeEv
+__ZN3JSC4Heap21deleteAllCompiledCodeEv
+__ZN3JSC18FunctionExecutable23clearCodeIfNotCompilingEv
+__ZN3WTF27releaseFastMallocFreeMemoryEv
+__ZN3WTF17TCMalloc_PageHeap15ReleaseFreeListEPNS_4SpanES2_
+__ZN3JSC26UnlinkedFunctionExecutable7destroyEPNS_6JSCellE
+__ZN3JSC25UnlinkedFunctionCodeBlock7destroyEPNS_6JSCellE
+__ZN3JSC17UnlinkedCodeBlockD2Ev
+__ZN3JSC17UnlinkedCodeBlock8RareDataD2Ev
+__ZN3JSC24UnlinkedProgramCodeBlock7destroyEPNS_6JSCellE
+__ZN3JSC24UnlinkedProgramCodeBlockD2Ev
+__ZN3JSC8JSObject45putByIndexBeyondVectorLengthWithoutAttributesILh22EEEvPNS_9ExecStateEjNS_7JSValueE
+__ZN3WTF10StringImpl16findIgnoringCaseEPS0_j
+__ZN3WTF6String8truncateEj
+__ZN3JSC6ParserINS_5LexerItEEE20parseSwitchStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC6ParserINS_5LexerItEEE18parseSwitchClausesINS_10ASTBuilderEEENT_10ClauseListERS6_
+__ZN3JSC6ParserINS_5LexerItEEE24parseSwitchDefaultClauseINS_10ASTBuilderEEENT_6ClauseERS6_
+__ZN3WTF17double_conversion10BignumDtoaEdNS0_14BignumDtoaModeEiNS0_15BufferReferenceIcEEPiS4_
+__ZN3WTF17double_conversion6BignumC1Ev
+__ZN3WTF17double_conversion6Bignum12AssignUInt64Ey
+__ZN3WTF17double_conversion6Bignum17AssignPowerUInt16Eti
+__ZN3WTF17double_conversion6Bignum9ShiftLeftEi
+__ZN3WTF17double_conversion6Bignum11PlusCompareERKS1_S3_S3_
+__ZN3WTF17double_conversion6Bignum16MultiplyByUInt32Ej
+__ZN3WTF17double_conversion6Bignum7CompareERKS1_S3_
+__ZN3WTF17double_conversion6Bignum12AssignBignumERKS1_
+__ZN3WTF17double_conversionL21GenerateCountedDigitsEiPiPNS0_6BignumES3_NS0_15BufferReferenceIcEES1_
+__ZN3WTF17double_conversion6Bignum21DivideModuloIntBignumERKS1_
+__ZN3WTF17double_conversion6Bignum13SubtractTimesERKS1_i
+__ZN3WTF17double_conversion6Bignum14SubtractBignumERKS1_
+_operationPutByValBeyondArrayBoundsNonStrict
+__ZN3JSC8JSObject16putByIndexInlineEPNS_9ExecStateEjNS_7JSValueEb
+__ZN3JSC3JIT25emit_op_resolve_with_baseEPNS_11InstructionE
+__ZN3JSC3JIT29emitSlow_op_resolve_with_baseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3WTF22cancelCallOnMainThreadEPFvPvES0_
+__ZN3JSC7JSArray4sortEPNS_9ExecStateE
+__ZN3JSC7JSArray17compactForSortingILh27EEEvRjS2_
+__ZN3JSC7JSArray19sortCompactedVectorILh27ENS_12WriteBarrierINS_7UnknownEEEEEvPNS_9ExecStateENS_14ContiguousDataIT0_EEj
+__ZN3JSC4Heap18pushTempSortVectorEPN3WTF6VectorINSt3__14pairINS_7JSValueENS1_6StringEEELm0ENS1_20UnsafeVectorOverflowEEE
+__ZN3WTF6VectorIPNS0_INSt3__14pairIN3JSC7JSValueENS_6StringEEELm0ENS_20UnsafeVectorOverflowEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSCL27compareByStringPairForQSortEPKvS1_
+__ZN3JSC4Heap17popTempSortVectorEPN3WTF6VectorINSt3__14pairINS_7JSValueENS1_6StringEEELm0ENS1_20UnsafeVectorOverflowEEE
+__ZN3JSC8JSObject48convertDoubleToContiguousWhilePerformingSetIndexERNS_2VMEjNS_7JSValueE
+__ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
+__ZN3WTF6String6appendEPKtj
+__ZN3WTF13tryFastCallocEmm
+__ZN3WTF15ArrayBufferViewC2ENS_10PassRefPtrINS_11ArrayBufferEEEj
+__ZN3WTF11ArrayBuffer7addViewEPNS_15ArrayBufferViewE
+__ZN3JSC17NumberConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL21callNumberConstructorEPNS_9ExecStateE
+__ZN3WTF15ArrayBufferViewD2Ev
+__ZN3WTF11ArrayBuffer10removeViewEPNS_15ArrayBufferViewE
+__ZN3JSC17BytecodeGenerator14emitPutByIndexEPNS_10RegisterIDEjS2_
+__ZN3JSC13LiteralParserItE5Lexer3lexILNS_10ParserModeE0EEENS_9TokenTypeERNS_18LiteralParserTokenItEE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE29generateAssertionWordBoundaryEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE22matchAssertionWordcharEmRNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListES8_
+__ZN3JSC8JSObject20convertInt32ForValueERNS_2VMENS_7JSValueE
+__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC9CodeBlock32expressionRangeForBytecodeOffsetEjRiS1_S1_RjS2_
+__ZN3WTF10makeStringINS_6StringEPKcS1_S3_EES1_T_T0_T1_T2_
+__ZN3WTF13tryMakeStringINS_6StringEPKcS1_S3_EENS_10PassRefPtrINS_10StringImplEEET_T0_T1_T2_
+__ZN3JSC11Interpreter15unwindCallFrameERPNS_9ExecStateENS_7JSValueERjRPNS_9CodeBlockE
+_ctiOpThrowNotCaught
+__ZN3JSC11Interpreter17ErrorHandlingModeC1EPNS_9ExecStateE
+__ZN3JSC7JSStack23enableErrorStackReserveEv
+__ZN3JSCL22errorProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSC22jsMakeNontrivialStringIN3WTF6StringEPKcS2_EENS_7JSValueEPNS_9ExecStateET_T0_T1_
+__ZN3JSC11Interpreter17ErrorHandlingModeD1Ev
+__ZN3JSC7JSStack24disableErrorStackReserveEv
+__ZN3JSC12ConstantNode30emitBytecodeInConditionContextERNS_17BytecodeGeneratorEPNS_5LabelES4_NS_15FallThroughModeE
+_cti_op_dec
+_cti_op_bitand
+__ZN3WTF10StringImpl4fillEt
+__ZNK3WTF6String15stripWhiteSpaceEPFbtE
+__ZN3WTF10StringImpl15stripWhiteSpaceEPFbtE
+__ZN3WTF10StringImpl22stripMatchedCharactersINS_14UCharPredicateEEENS_10PassRefPtrIS0_EET_
+__ZNK3WTF6String18simplifyWhiteSpaceEPFbtE
+__ZN3WTF10StringImpl18simplifyWhiteSpaceEPFbtE
+__ZN3WTF10StringImpl32simplifyMatchedCharactersToSpaceIhNS_14UCharPredicateEEENS_10PassRefPtrIS0_EET0_
+_cti_op_to_primitive
+_cti_op_to_number
+_cti_op_jgreatereq
+__ZN3JSCL16mathProtoFuncPowEPNS_9ExecStateE
+_cti_op_jgreater
+__ZN3WTF6VectorIN3JSC4Yarr13YarrGeneratorILNS2_18YarrJITCompileModeE1EE6YarrOpELm128ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT18emitDoubleGetByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpE
+__ZN3WTF9HashTableIN3JSC26LazyOperandValueProfileKeyENS_12KeyValuePairIS2_PNS1_23LazyOperandValueProfileEEENS_24KeyValuePairKeyExtractorIS6_EENS1_30LazyOperandValueProfileKeyHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E16lookupForWritingINS_22IdentityHashTranslatorIS9_EES2_EENSt3__14pairIPS6_bEERKT0_
+__ZN3WTF9HashTableIN3JSC26LazyOperandValueProfileKeyENS_12KeyValuePairIS2_PNS1_23LazyOperandValueProfileEEENS_24KeyValuePairKeyExtractorIS6_EENS1_30LazyOperandValueProfileKeyHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E3addINS_17HashMapTranslatorISE_S9_EES2_S5_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S6_S8_S9_SE_SC_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIN3JSC26LazyOperandValueProfileKeyENS_12KeyValuePairIS2_PNS1_23LazyOperandValueProfileEEENS_24KeyValuePairKeyExtractorIS6_EENS1_30LazyOperandValueProfileKeyHashENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSB_IS5_EEEESC_E6rehashEi
+_cti_op_resolve_base
+__ZN3JSC3DFG14SpeculativeJIT24emitAllocateBasicStorageINS_12X86Registers10RegisterIDEEENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpET_S4_
+__ZN3JSC3DFG14SpeculativeJIT20emitAllocateJSObjectINS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS_12X86Registers10RegisterIDEEEvS8_S8_T_T0_S8_RNS5_8JumpListE
+__ZN3JSC14MacroAssembler8storePtrENS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS3_7AddressE
+__ZN3JSC3DFG51CallArrayAllocatorWithVariableSizeSlowPathGeneratorC2ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPNS0_14SpeculativeJITEPFPcPNS_9ExecStateEPNS_9StructureEiENS_12X86Registers10RegisterIDESC_SC_SG_
+__ZN3JSC3DFG14SpeculativeJIT28jumpSlowForUnwantedArrayModeENS_12X86Registers10RegisterIDENS0_9ArrayModeEh
+__ZN3JSC3DFG51CallArrayAllocatorWithVariableSizeSlowPathGenerator16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEPNS_9StructureEiENS_12X86Registers10RegisterIDESA_SA_
+__ZN3JSC3DFG51CallArrayAllocatorWithVariableSizeSlowPathGeneratorD0Ev
+__ZN3JSC12JSLockHolderC1ERNS_2VME
+__ZN3JSC3JIT26emit_op_ret_object_or_thisEPNS_11InstructionE
+__ZN3JSC10ASTBuilder17makeLeftShiftNodeERKNS_15JSTokenLocationEPNS_14ExpressionNodeES5_b
+__ZN3WTF6VectorIN3JSC4Yarr13YarrGeneratorILNS2_18YarrJITCompileModeE1EE6YarrOpELm128ENS_15CrashOnOverflowEE14appendSlowCaseIS6_EEvRKT_
+__ZN3WTF6VectorIiLm32ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT14emit_op_negateEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_negateEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3DFG14SpeculativeJIT15compileValueAddEPNS0_4NodeE
+_operationValueAdd
+__ZN3JSC17BytecodeGenerator16isArgumentNumberERKNS_10IdentifierEi
+__ZN3JSC17BytecodeGenerator27setIsNumericCompareFunctionEb
+__ZN3JSC7JSArray11sortNumericEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3JSCL31compareNumbersForQSortWithInt32EPKvS1_
+__ZN3JSC17DeleteResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDEb
+__ZN3JSCL24regExpConstructorDollar1EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC18RegExpCachedResult10lastResultEPNS_9ExecStateEPNS_8JSObjectE
+__ZN3JSCL24regExpConstructorDollar2EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+_cti_op_resolve_with_base
+_cti_op_jless
+__ZNK3WTF6String6latin1Ev
+__ZN3WTF6VectorIN3JSC3DFG17ResolveGlobalDataELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT32nonSpeculativeNonPeepholeCompareEPNS0_4NodeENS_23MacroAssemblerX86Common19RelationalConditionEPFmPNS_9ExecStateExxE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEPNS_16ResolveOperationEPNS_14JSGlobalObjectEPNS_10IdentifierEENS_12X86Registers10RegisterIDESD_SD_S9_
+_operationResolveGlobal
+__ZN3JSC7JSScope13resolveGlobalEPNS_9ExecStateERKNS_10IdentifierEPNS_14JSGlobalObjectEPNS_16ResolveOperationE
+__ZN3JSC18sqrtThunkGeneratorEPNS_2VME
+__ZN3JSC3DFG14ByteCodeParser12handleMinMaxEbiNS0_8NodeTypeEii
+__ZN3JSC3DFG12GPRTemporaryC1EPNS0_14SpeculativeJITERNS0_27SpeculateStrictInt32OperandE
+__ZN3JSC3DFG12GPRTemporaryC2EPNS0_14SpeculativeJITERNS0_27SpeculateStrictInt32OperandE
+__ZN3JSC3DFG12FPRTemporaryC1EPNS0_14SpeculativeJITERNS0_22SpeculateDoubleOperandE
+__ZN3JSC3DFG12FPRTemporaryC2EPNS0_14SpeculativeJITERNS0_22SpeculateDoubleOperandE
+__ZN3JSC3DFG15AssemblyHelpers9boxDoubleENS_12X86Registers13XMMRegisterIDENS2_10RegisterIDE
+__ZN3JSC3DFG12GPRTemporaryC1EPNS0_14SpeculativeJITERNS0_23SpeculateIntegerOperandE
+__ZN3JSC3DFG12GPRTemporaryC2EPNS0_14SpeculativeJITERNS0_23SpeculateIntegerOperandE
+__ZN3JSC23MacroAssemblerX86Common9compare32ENS0_19RelationalConditionENS_12X86Registers10RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE12TrustedImm32ES3_
+_cti_op_mod
+__ZN3JSC3DFG14SpeculativeJIT21compileObjectEqualityEPNS0_4NodeE
+__ZN3JSCL24dateProtoFuncToUTCStringEPNS_9ExecStateE
+__ZN3JSC18ceilThunkGeneratorEPNS_2VME
+__ZN3JSC3JIT15emit_op_eq_nullEPNS_11InstructionE
+__ZN3JSC17UnlinkedCodeBlock27addImmediateSwitchJumpTableEv
+__ZN3WTF6VectorIN3JSC23UnlinkedSimpleJumpTableELm0ENS_15CrashOnOverflowEE14appendSlowCaseIS2_EEvRKT_
+__ZN3WTF6VectorIN3JSC23UnlinkedSimpleJumpTableELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF20VectorTypeOperationsIN3JSC23UnlinkedSimpleJumpTableEE4moveEPKS2_S5_PS2_
+__ZN3WTF6VectorIiLm0ENS_15CrashOnOverflowEE4fillERKim
+__ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIiLm0ENS_15CrashOnOverflowEEaSERKS2_
+__ZN3JSC3JIT18emit_op_switch_immEPNS_11InstructionE
+__ZN3WTF6VectorIN3JSC17CodeLocationLabelELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF20VectorTypeOperationsIN3JSC15SimpleJumpTableEE4moveEPKS2_S5_PS2_
+__ZN3JSC15SimpleJumpTableC2ERKS0_
+_cti_op_switch_imm
+__ZN3JSCL9dateParseEPNS_9ExecStateE
+__ZN3JSC3JIT14emit_op_lshiftEPNS_11InstructionE
+__ZN3JSC14MacroAssembler5and64ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDE
+__ZN3JSC3JIT14emit_op_rshiftEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_lshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT18emitSlow_op_rshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3WTF6String26fromUTF8WithLatin1FallbackEPKhm
+_ceilThunk
+__ZN3JSC19SparseArrayValueMap6createERNS_2VME
+__ZN3JSC19SparseArrayValueMap8putEntryEPNS_9ExecStateEPNS_8JSObjectEjNS_7JSValueEb
+__ZN3WTF9HashTableIyNS_12KeyValuePairIyN3JSC16SparseArrayEntryEEENS_24KeyValuePairKeyExtractorIS4_EENS_7IntHashIyEENS_18HashMapValueTraitsINS_29UnsignedWithZeroKeyHashTraitsIyEENS_10HashTraitsIS3_EEEESB_E16lookupForWritingINS_22IdentityHashTranslatorIS8_EEyEENSt3__14pairIPS4_bEERKT0_
+__ZN3WTF9HashTableIyNS_12KeyValuePairIyN3JSC16SparseArrayEntryEEENS_24KeyValuePairKeyExtractorIS4_EENS_7IntHashIyEENS_18HashMapValueTraitsINS_29UnsignedWithZeroKeyHashTraitsIyEENS_10HashTraitsIS3_EEEESB_E3addINS_17HashMapTranslatorISE_S8_EEyS3_EENS_18HashTableAddResultINS_17HashTableIteratorIyS4_S6_S8_SE_SB_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIyNS_12KeyValuePairIyN3JSC16SparseArrayEntryEEENS_24KeyValuePairKeyExtractorIS4_EENS_7IntHashIyEENS_18HashMapValueTraitsINS_29UnsignedWithZeroKeyHashTraitsIyEENS_10HashTraitsIS3_EEEESB_E6rehashEi
+__ZN3JSC16SparseArrayEntry3putEPNS_9ExecStateENS_7JSValueEPNS_19SparseArrayValueMapES3_b
+__ZN3JSC19SparseArrayValueMap4findEj
+__ZNK3JSC16SparseArrayEntry3getERNS_12PropertySlotE
+__ZN3JSC19SparseArrayValueMap7destroyEPNS_6JSCellE
+__ZN3JSC9CodeCacheD1Ev
+__ZN3JSC9CodeCacheD2Ev
+__ZN3JSC21UnlinkedEvalCodeBlock7destroyEPNS_6JSCellE
+__ZN3JSC19FunctionConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL23callFunctionConstructorEPNS_9ExecStateE
+__ZN3JSC4Yarr12ByteCompiler21assertionWordBoundaryEbj
+__ZN3JSC4Yarr11InterpreterIhE26matchAssertionWordBoundaryERNS0_8ByteTermE
+__ZN3JSC4Yarr11InterpreterIhE22backtrackBackReferenceERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3WTF6VectorIiLm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateE
+__ZNK3JSC8JSObject20propertyIsEnumerableEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC8JSObject24getOwnPropertyDescriptorEPS0_PNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC18PropertyDescriptor13setDescriptorENS_7JSValueEj
+__ZNK3JSC18PropertyDescriptor10enumerableEv
+__ZN3JSC10JSFunction24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC4Yarr15BytecodePatternD2Ev
+__ZN3JSC10LocalStackINS_8JSObjectELj16EE4pushEPS1_
+_operationTypeOf
+__ZN3JSC14MacroAssembler5and32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDES6_
+__ZN3JSC3DFG14SpeculativeJIT19compileValueToInt32EPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT13integerResultENS_12X86Registers10RegisterIDEPNS0_4NodeENS_10DataFormatENS1_15UseChildrenModeE
+__ZN3JSCL21dateProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSCL23returnToThrowTrampolineEPNS_2VMENS_16ReturnAddressPtrERS2_
+_cti_op_push_name_scope
+_cti_op_pop_scope
+__ZN3JSC17NumberConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL30constructWithNumberConstructorEPNS_9ExecStateE
+__ZN3JSC12NumberObjectC1ERNS_2VMEPNS_9StructureE
+__ZN3JSCL22numberProtoFuncValueOfEPNS_9ExecStateE
+__ZN3JSC3DFGL21emitPutTransitionStubEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_15PutPropertySlotERNS_17StructureStubInfoENS_7PutKindEPNS_9StructureESE_PNS_14StructureChainENS_17CodeLocationLabelERN3WTF6RefPtrINS_14JITStubRoutineEEE
+__ZN3JSC3DFG24ScratchRegisterAllocator15allocateScratchINS0_7GPRInfoEEENT_12RegisterTypeEv
+__ZN3JSC3DFG24ScratchRegisterAllocator32preserveReusedRegistersByPushingERNS_14MacroAssemblerE
+__ZN3JSC3DFG24ScratchRegisterAllocator31restoreReusedRegistersByPoppingERNS_14MacroAssemblerE
+__ZN3JSC3DFG24ScratchRegisterAllocator36preserveUsedRegistersToScratchBufferERNS_14MacroAssemblerEPNS_13ScratchBufferENS_12X86Registers10RegisterIDE
+__ZN3JSC3DFG12CCallHelpers16setupTwoStubArgsILNS_12X86Registers10RegisterIDE6ELS4_8EEEvS4_S4_
+__ZN3JSC3DFG24ScratchRegisterAllocator37restoreUsedRegistersFromScratchBufferERNS_14MacroAssemblerEPNS_13ScratchBufferENS_12X86Registers10RegisterIDE
+__ZN3JSCL24dateProtoFuncGetFullYearEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncSetFullYearEPNS_9ExecStateE
+__ZN3JSCL23setNewValueFromDateArgsEPNS_9ExecStateEib
+__ZN3JSC9CodeBlock26findClosureCallForReturnPCENS_16ReturnAddressPtrE
+_operationPutByIdDirectNonStrictOptimize
+_operationPutByIdDirectNonStrictOptimizeWithReturnAddress
+_operationPutByIdDirectNonStrict
+__ZN3WTF6VectorIN3JSC13PutByIdAccessELm2ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG15dfgResetPutByIDERNS_13RepatchBufferERNS_17StructureStubInfoE
+__ZN3JSCL18arrayProtoFuncSomeEPNS_9ExecStateE
+__ZN3JSC7JSArray14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
+__ZN3WTF9HashTableIPN3JSC20MarkedArgumentBufferES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EES3_EENSt3__14pairIPS3_bEERKT0_
+__ZN3WTF15ThreadConditionD1Ev
+__ZN3WTF10StringImpl18simplifyWhiteSpaceEv
+__ZN3WTF10StringImpl32simplifyMatchedCharactersToSpaceItNS_23SpaceOrNewlinePredicateEEENS_10PassRefPtrIS0_EET0_
+__ZN3WTF21charactersToIntStrictEPKtmPbi
+_cti_op_bitxor
+__ZN3JSC7JSArray17compactForSortingILh29EEEvRjS2_
+__ZN3JSC7JSArray19sortCompactedVectorILh29ENS_12WriteBarrierINS_7UnknownEEEEEvPNS_9ExecStateENS_14ContiguousDataIT0_EEj
+__ZN3JSC3DFG14SpeculativeJIT21compileToStringOnCellEPNS0_4NodeE
+__ZN3JSCL22numberProtoFuncToFixedEPNS_9ExecStateE
+__ZN3JSC15constructNumberEPNS_9ExecStateEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3JSCL16mathProtoFuncCosEPNS_9ExecStateE
+__ZN3WTF17double_conversion6Bignum16MultiplyByUInt64Ey
+__ZN3WTF17double_conversion6Bignum12AssignUInt16Et
+__ZN3WTF17double_conversionL12BignumStrtodENS0_15BufferReferenceIKcEEid
+__ZN3WTF17double_conversion6Bignum19AssignDecimalStringENS0_15BufferReferenceIKcEE
+__ZN3WTF17double_conversion6Bignum20MultiplyByPowerOfTenEi
+__ZN3WTF17double_conversion6Bignum9AddBignumERKS1_
+__ZN3JSC3DFGL8putByValILb0EEEvPNS_9ExecStateENS_7JSValueEjS4_
+__ZN3JSC9CodeBlock19codeOriginForReturnENS_16ReturnAddressPtrERNS_10CodeOriginE
+__ZN3JSC3DFG14ByteCodeParser11makeDivSafeEPNS0_4NodeE
+__ZN3JSC3DFG25BackwardsPropagationPhase18isWithinPowerOfTwoILi22EEEbPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT15compileArithMulEPNS0_4NodeE
+__ZN3JSC3DFG12FPRTemporaryC2EPNS0_14SpeculativeJITERNS0_22SpeculateDoubleOperandES5_
+__ZN3JSC3DFG14SpeculativeJIT18compileArithNegateEPNS0_4NodeE
+__ZN3JSC23MacroAssemblerX86Common12negateDoubleENS_12X86Registers13XMMRegisterIDES2_
+__ZN3JSC23MacroAssemblerX86Common9divDoubleENS_12X86Registers13XMMRegisterIDES2_S2_
+_cti_op_inc
+__ZN3JSC12StringObject19getOwnPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC14globalFuncEvalEPNS_9ExecStateE
+__ZN3JSC8JSObject18createArrayStorageERNS_2VMEjj
+_operationConvertThis
+_cti_op_sub
+__ZN3JSC23createNotAFunctionErrorEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC5LLInt11callToThrowEPNS_9ExecStateEPNS_11InstructionE
+__ZN3JSC7JSProxy25getOwnPropertySlotByIndexEPNS_6JSCellEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC17StringConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL30constructWithStringConstructorEPNS_9ExecStateE
+__ZN3JSC4Yarr11InterpreterIhE30backtrackPatternCasedCharacterERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSCL15performSlowSortEPNS_9ExecStateEPNS_8JSObjectEjNS_7JSValueERNS_8CallDataERNS_8CallTypeE
+__ZN3JSC9getOrHoleEPNS_8JSObjectEPNS_9ExecStateEj
+__ZN3WTF10StringImpl32simplifyMatchedCharactersToSpaceItNS_14UCharPredicateEEENS_10PassRefPtrIS0_EET0_
+__ZN3JSC25DemandExecutableAllocatorC2Ev
+__ZN3WTF9HashTableIPN3JSC25DemandExecutableAllocatorES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E3addIN
+__ZN3WTF9HashTableIPN3JSC25DemandExecutableAllocatorES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E6rehas
+__ZN3JSC12CodeCacheMap13pruneSlowCaseEv
+__ZN3JSC19SparseArrayValueMap13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC4Yarr11InterpreterIhE22parenthesesDoBacktrackERNS0_8ByteTermEPNS2_24BackTrackInfoParenthesesE
+__ZN3WTF6String6numberEm
+__ZNK3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSC18BooleanConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL31constructWithBooleanConstructorEPNS_9ExecStateE
+__ZN3JSC16constructBooleanEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL31dateProtoFuncGetUTCMillisecondsEPNS_9ExecStateE
+__ZN3JSC6ParserINS_5LexerItEEE8getLabelEPKNS_10IdentifierE
+__ZN3JSC3DFG14SpeculativeJIT15compileArithModEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT17compileSoftModuloEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT19compileFromCharCodeEPNS0_4NodeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDESD_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDESB_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDESB_EC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESF_SB_
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDESB_ED0Ev
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDESB_ED1Ev
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDESD_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDESD_EC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_SD_
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDESD_ED0Ev
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDESD_ED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEiENS_12X86Registers10RegisterIDES9_
+__ZN3JSCL26regExpConstructorLastMatchEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC9Arguments10putByIndexEPNS_6JSCellEPNS_9ExecStateEjNS_7JSValueEb
+__ZN3JSC15WeakHandleOwner8finalizeENS_6HandleINS_7UnknownEEEPv
+__ZN3JSC16parseIntOverflowEPKhii
+__ZN3JSC7JSProxy14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC19JSSymbolTableObject14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC9ExecState17globalObjectTableEPS0_
+__ZN3JSC19globalFuncEncodeURIEPNS_9ExecStateE
+__ZN3JSCL19jsStrDecimalLiteralItEEdRPKT_S3_
+__ZN3JSC17ObjectConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL30constructWithObjectConstructorEPNS_9ExecStateE
+__ZN3JSCL28dateProtoFuncGetMilliSecondsEPNS_9ExecStateE
+__ZN3WTF9BitVector13OutOfLineBits7destroyEPS1_
+__ZN3JSCL25stringProtoFuncCharCodeAtEPNS_9ExecStateE
+__ZN3WTF24codePointCompareLessThanERKNS_6StringES2_
+_cti_op_throw
+__ZN3JSCL24regExpConstructorDollar4EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL20arrayProtoFuncReduceEPNS_9ExecStateE
+_cti_op_get_by_id_string_fail
+_cti_op_lshift
+__ZN3JSC3DFG14SpeculativeJIT20compileGetCharCodeAtEPNS0_4NodeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFidENS_12X86Registers10RegisterIDENS8_13XMMRegisterIDEEEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG14SpeculativeJIT7shiftOpENS0_8NodeTypeENS_12X86Registers10RegisterIDEiS4_
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFidENS_12X86Registers10RegisterIDENS4_13XMMRegisterIDE
+__ZN3WTF9HashTableIN3JSC13SourceCodeKeyENS_12KeyValuePairIS2_NS1_15SourceCodeValueEEENS_24KeyValuePairKeyExtractorIS5_EENS1_17SourceCodeKeyHashENS_18HashMapValueTraitsINS1_23SourceCodeKeyHashTraitsENS_10HashTraitsIS4_EEEESA_E12deleteBucketERS5_
+__ZN3WTF9HashTableIN3JSC13SourceCodeKeyENS_12KeyValuePairIS2_NS1_15SourceCodeValueEEENS_24KeyValuePairKeyExtractorIS5_EENS1_17SourceCodeKeyHashENS_18HashMapValueTraitsINS1_23SourceCodeKeyHashTraitsENS_10HashTraitsIS4_EEEESA_E3addINS_17HashMapTranslatorISD_S8_EES2_S4_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S5_S7_S8_SD_SA_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIN3JSC13SourceCodeKeyENS_12KeyValuePairIS2_NS1_15SourceCodeValueEEENS_24KeyValuePairKeyExtractorIS5_EENS1_17SourceCodeKeyHashENS_18HashMapValueTraitsINS1_23SourceCodeKeyHashTraitsENS_10HashTraitsIS4_EEEESA_E6rehashEi
+__ZN3JSCL24dateProtoFuncToISOStringEPNS_9ExecStateE
+__ZN3JSCL31objectConstructorDefinePropertyEPNS_9ExecStateE
+__ZN3JSCL20toPropertyDescriptorEPNS_9ExecStateENS_7JSValueERNS_18PropertyDescriptorE
+__ZNK3JSC18PropertyDescriptor20isAccessorDescriptorEv
+__ZN3JSC8JSObject17defineOwnPropertyEPS0_PNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3JSC8JSObject25defineOwnNonIndexPropertyEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3JSCL13putDescriptorEPNS_9ExecStateEPNS_8JSObjectENS_12PropertyNameERNS_18PropertyDescriptorEjRKS5_
+__ZNK3JSC18PropertyDescriptor19isGenericDescriptorEv
+__ZN3JSCL23objectConstructorFreezeEPNS_9ExecStateE
+__ZNK3JSC11Interpreter27retrieveArgumentsFromVMCodeEPNS_9ExecStateEPNS_10JSFunctionE
+__ZNK3JSC18PropertyDescriptor16isDataDescriptorEv
+__ZN3JSC18PropertyDescriptor11setWritableEb
+__ZN3JSC18PropertyDescriptor15setConfigurableEb
+__ZN3JSC10JSFunction17defineOwnPropertyEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3JSC9sameValueEPNS_9ExecStateENS_7JSValueES2_
+__ZNK3JSC18PropertyDescriptor12configurableEv
+__ZNK3JSC18PropertyDescriptor8writableEv
+__ZNK3JSC11Interpreter24retrieveCallerFromVMCodeEPNS_9ExecStateEPNS_10JSFunctionE
+__ZNK3JSC18PropertyDescriptor7equalToEPNS_9ExecStateERKS0_
+__ZNK3JSC18PropertyDescriptor15attributesEqualERKS0_
+__ZNK3JSC18PropertyDescriptor27attributesOverridingCurrentERKS0_
+__ZN3JSC8JSObject17preventExtensionsERNS_2VME
+__ZN3JSC8JSObject56enterDictionaryIndexingModeWhenArrayStorageAlreadyExistsERNS_2VMEPNS_12ArrayStorageE
+__ZN3JSC9Butterfly11resizeArrayERNS_2VMEPNS_9StructureEmm
+__ZN3JSC9Structure27preventExtensionsTransitionERNS_2VMEPS0_
+__ZN3JSCL27dateProtoFuncGetUTCFullYearEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncGetUTCMonthEPNS_9ExecStateE
+__ZN3JSCL23dateProtoFuncGetUTCDateEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncGetUTCHoursEPNS_9ExecStateE
+__ZN3JSCL26dateProtoFuncGetUTCMinutesEPNS_9ExecStateE
+__ZN3JSCL26dateProtoFuncGetUTCSecondsEPNS_9ExecStateE
+__ZN3JSC3DFG14SpeculativeJIT36compileObjectToObjectOrOtherEqualityENS0_4EdgeES2_
+__ZN3JSCL20dateProtoFuncSetDateEPNS_9ExecStateE
+_cti_to_object
+__ZN3JSC9ExecState21booleanPrototypeTableEPS0_
+_cti_op_put_by_id_direct_fail
+__ZN3JSC11createErrorEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC13LiteralParserIhE15getErrorMessageEv
+__ZN3JSC17createSyntaxErrorEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC18Uint16WithFractionC2Edt
+__ZN3JSC18Uint16WithFraction17sumGreaterThanOneERKS0_
+__ZN3JSC18Uint16WithFractionmLEt
+__ZN3JSC10BigIntegerC2Ed
+_cti_op_jlesseq
+__ZN3JSCL21stringProtoFuncConcatEPNS_9ExecStateE
+__ZN3JSCL24booleanProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSCL22functionProtoFuncApplyEPNS_9ExecStateE
+__ZN3JSC7JSArray11fillArgListEPNS_9ExecStateERNS_20MarkedArgumentBufferE
+__ZN3JSC9Arguments11fillArgListEPNS_9ExecStateERNS_20MarkedArgumentBufferE
+__ZNK3WTF17double_conversion23DoubleToStringConverter19HandleSpecialValuesEdPNS0_13StringBuilderE
+__ZN3JSC6ParserINS_5LexerIhEEE18parseWithStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC8WithNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator17emitPushWithScopeEPNS_10RegisterIDE
+_operationEnsureArrayStorage
+_cti_op_bitor
+__ZNK3WTF6String12toUIntStrictEPbi
+__ZN3WTF10StringImpl7replaceEPS0_S1_
+__ZN3JSC15JSStringBuilder9upConvertEv
+__ZN3WTF6VectorItLm64ENS_20UnsafeVectorOverflowEE9tryAppendItEEbPKT_m
+__ZN3WTF6VectorItLm64ENS_20UnsafeVectorOverflowEE14shrinkCapacityEm
+__ZN3JSCL16definePropertiesEPNS_9ExecStateEPNS_8JSObjectES3_
+__ZN3WTF6VectorIjLm32ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIjLm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC3DFG19CPSRethreadingPhase13PhiStackEntryELm128ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC4Yarr12ByteCompiler12uncheckInputEj
+__ZN3JSC4Yarr11InterpreterItE25backtrackPatternCharacterERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterItE30backtrackPatternCasedCharacterERNS0_8ByteTermEPNS2_18DisjunctionContextE
+_operationValueAddNotNumber
+__ZN3JSC11JSNameScope13visitChildrenEPNS_6JSCellERNS_11SlotVisitorE
+__ZN3JSC3DFG14SpeculativeJIT25compileNewFunctionNoCheckEPNS0_4NodeE
+_operationNewFunctionNoCheck
+_operationToPrimitive
+__ZN3JSC6JSLock12DropAllLocksC1EPNS_2VME
+__ZN3JSC6JSLock12DropAllLocksC2EPNS_2VME
+__ZNK3WTF17double_conversion23DoubleToStringConverter31CreateExponentialRepresentationEPKciiPNS0_13StringBuilderE
+__ZN3WTFeqERKNS_7CStringEPKc
+__ZN3JSC12StringObject25getOwnPropertySlotByIndexEPNS_6JSCellEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC3JIT15emit_op_urshiftEPNS_11InstructionE
+__ZN3JSC3JIT19emitSlow_op_urshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+_operationPutByValStrict
+__ZN3JSCL7dateUTCEPNS_9ExecStateE
+_operationReallocateStorageAndFinishPut
+__ZN3JSCL26stringFromCharCodeSlowCaseEPNS_9ExecStateE
+__ZN3JSCL22compareNumbersForQSortEPKvS1_
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEPNS_8JSObjectEmENS_12X86Registers10RegisterIDESA_m
+__ZN3JSC14MacroAssembler5xor32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDES6_
+__ZN3JSC14MacroAssembler4or32ENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_12X86Registers10RegisterIDES6_
+__ZN3JSC3DFG10FixupPhase29canOptimizeStringObjectAccessERKNS_10CodeOriginE
+__ZNK3JSC3DFG11ExitProfile11hasExitSiteERKNS0_16FrequentExitSiteE
+__ZN3JSC3DFG14SpeculativeJIT33speculateStringObjectForStructureINS_12X86Registers10RegisterIDEEEvNS0_4EdgeET_
+__ZN3WTF6VectorIN3JSC3DFG22SilentRegisterSavePlanELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEPNS_9StructureEENS_12X86Registers10RegisterIDES6_
+_operationNewEmptyArray
+__ZN3JSC12JSRopeString16getIndexSlowCaseEPNS_9ExecStateEj
+__ZNK3JSC16SparseArrayEntry16getNonSparseModeEv
+__ZN3JSC18FunctionExecutable33jettisonOptimizedCodeForConstructERNS_2VME
+_operationCompareGreater
+_operationResolveRope
+_cti_op_negate
+__ZN3WTF10StringImpl7replaceEjjPS0_
+__ZN3JSC6JSCell16getConstructDataEPS0_RNS_13ConstructDataE
+__ZN3JSC13LiteralParserItE15getErrorMessageEv
+_cti_op_div
+__ZN3JSCL16mathProtoFuncSinEPNS_9ExecStateE
+__ZN3WTF6VectorIN3JSC5ScopeELm10ENS_15CrashOnOverflowEE14appendSlowCaseIS2_EEvRKT_
+__ZN3WTF6VectorIN3JSC5ScopeELm10ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF12base64DecodeERKNS_6StringERNS_6VectorIcLm0ENS_15CrashOnOverflowEEENS_18Base64DecodePolicyE
+__ZN3WTF6VectorIcLm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC10JSFunction12callerGetterEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+_cti_op_urshift
+_cti_op_rshift
+__ZN3WTF6VectorIN3JSC7JSValueELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC3DFG13AbstractValueELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC9CodeBlock27shouldReoptimizeFromLoopNowEv
+__ZN3JSC23MacroAssemblerX86Common9subDoubleENS_12X86Registers13XMMRegisterIDES2_S2_
+__ZN3JSC3DFG14SpeculativeJIT7shiftOpENS0_8NodeTypeENS_12X86Registers10RegisterIDES4_S4_
+__ZN3JSC3DFG14SpeculativeJIT21compileUInt32ToNumberEPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT11fillIntegerENS0_4EdgeERNS_10DataFormatE
+__ZN3JSC13JSNotAnObject25getOwnPropertySlotByIndexEPNS_6JSCellEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3WTF6VectorIN3JSC3DFG11ValueSourceELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC13ValueRecoveryELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6String6insertERKS0_j
+__ZN3WTF6String6insertEPKtjj
+_JSWeakObjectMapRemove
+__ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorENS_10StringHashENS_10HashTraitsIS2_EES6_E16lookupForWritingINS_22IdentityHashTranslatorIS4_EES2_EENSt3__14pairIPS2_bEERKT0_
+_operationCompareLessEq
+__ZN3WTF12base64EncodeEPKcjNS_18Base64EncodePolicyE
+__ZN3WTF12base64EncodeEPKcjRNS_6VectorIcLm0ENS_15CrashOnOverflowEEENS_18Base64EncodePolicyE
++[JSContext(Internal) contextWithJSGlobalContextRef:]
++[JSVirtualMachine(Internal) virtualMachineWithContextGroupRef:]
++[JSVMWrapperCache wrapperForJSContextGroupRef:]
+-[JSVirtualMachine initWithContextGroupRef:]
+_JSContextGroupRetain
++[JSVMWrapperCache addWrapper:forJSContextGroupRef:]
+-[JSVirtualMachine(Internal) contextForGlobalContextRef:]
+-[JSContext .cxx_construct]
+-[JSContext(Internal) initWithGlobalContextRef:]
+-[JSWrapperMap .cxx_construct]
+-[JSWrapperMap initWithContext:]
+-[JSContext setExceptionHandler:]
+-[JSVirtualMachine(Internal) addContext:forGlobalContextRef:]
++[JSValue(Internal) valueWithJSValueRef:inContext:]
+-[JSContext(Internal) wrapperForJSObject:]
+-[JSWrapperMap objcWrapperForJSValueRef:]
+-[JSValue(Internal) initWithValue:inContext:]
+-[JSContext JSGlobalContextRef]
+-[JSValue(Internal) dealloc]
+-[JSContext dealloc]
+-[JSWrapperMap dealloc]
+-[JSWrapperMap .cxx_destruct]
+-[JSContext exceptionHandler]
+-[JSContext .cxx_destruct]
+-[JSVirtualMachine dealloc]
+_JSContextGroupRelease
+__ZNK3WTF6String19characterStartingAtEj
+__ZN3WTF10StringImpl19characterStartingAtEj
+__ZN3JSC7JSScope30resolveContainingScopeInternalILNS0_10LookupModeE1ELNS0_12ReturnValuesE3EEEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotEPN3WTF6VectorINS_16ResolveOperationELm0ENSD_15CrashOnOverflowEEEPNS_18PutToBaseOperationEb
+__ZN3JSC3JIT23emit_op_push_with_scopeEPNS_11InstructionE
+_cti_op_push_with_scope
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEPNS_8JSObjectEENS_12X86Registers10RegisterIDESA_
+_operationReallocateButterflyToHavePropertyStorageWithInitialCapacity
+_operationAllocatePropertyStorageWithInitialCapacity
+__ZN3JSC6JSCell3putEPS0_PNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSCL24stringProtoFuncTrimRightEPNS_9ExecStateE
+-[JSValue JSValueRef]
+-[JSValue toString]
+__Z19tryUnwrapObjcObjectP15OpaqueJSContextPK13OpaqueJSValue
+__ZN3WTF10StringImpl7replaceEtPS0_
+__ZN3WTF10StringImpl7replaceEtPKhj
+__ZN3JSC17FunctionPrototype11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL21callFunctionPrototypeEPNS_9ExecStateE
+__ZN3JSC21globalFuncProtoGetterEPNS_9ExecStateE
+__ZN3JSC9ExecState20numberPrototypeTableEPS0_
+__ZN3JSCL27objectProtoFuncLookupGetterEPNS_9ExecStateE
+__ZN3JSC8JSObject21getPropertyDescriptorEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateE
+__ZN3JSC22NativeErrorConstructor16getConstructDataEPNS_6JSCellERNS_13ConstructDataE
+__ZN3JSCL35constructWithNativeErrorConstructorEPNS_9ExecStateE
+__ZN3JSCL28stringProtoFuncLocaleCompareEPNS_9ExecStateE
+__ZN3WTF8Collator11userDefaultEv
+__ZNK3WTF8Collator7collateEPKtmS2_m
+__ZNK3WTF8Collator14createCollatorEv
+__ZN3WTF8CollatorD1Ev
+__ZN3WTF8Collator15releaseCollatorEv
+__ZN3JSC3DFG28ArgumentsSimplificationPhase25observeProperArgumentsUseEPNS0_4NodeENS0_4EdgeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEiSB_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITES9_NS0_18SpillRegistersModeESB_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEiiENS_12X86Registers10RegisterIDEiS7_
+__ZN3JSC6ParserINS_5LexerIhEEE18updateErrorMessageEv
+__ZN3JSC6ParserINS_5LexerIhEEE12getTokenNameENS_11JSTokenTypeE
+__ZN3JSC17createSyntaxErrorEPNS_14JSGlobalObjectERKN3WTF6StringE
+__ZN3JSCL28substituteBackreferencesSlowItEEN3WTF6StringERKS2_S4_PKiPNS_6RegExpEm
+__ZN3WTF6VectorItLm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3JSC4Yarr11InterpreterItE18matchBackReferenceERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterItE22backtrackBackReferenceERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC4Yarr11InterpreterItE23tryConsumeBackReferenceEiij
+__ZN3JSCL18mathProtoFuncFloorEPNS_9ExecStateE
+__ZN3WTF23waitForThreadCompletionEj
+-[JSValue toBool]
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateEPNS_8JSObjectEixENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_T4_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateEPNS_8JSObjectEixENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateEPNS_8JSObjectEixENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_EC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESC_SE_SE_SE_
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateEPNS_8JSObjectEixENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_ED0Ev
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateEPNS_8JSObjectEixENS0_11NoResultTagENS_12X86Registers10RegisterIDESE_SE_ED1Ev
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateExPNS_6JSCellEPNS_10IdentifierEENS0_11NoResultTagENS_12X86Registers10RegisterIDESG_SB_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateExPNS_6JSCellEPNS_10IdentifierEENS0_11NoResultTagENS_12X86Registers10RegisterIDESG_SB_EC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESE_SG_SG_SB_
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateExPNS_6JSCellEPNS_10IdentifierEENS0_11NoResultTagENS_12X86Registers10RegisterIDESG_SB_ED0Ev
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateExPNS_6JSCellEPNS_10IdentifierEENS0_11NoResultTagENS_12X86Registers10RegisterIDESG_SB_ED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateEPNS_8JSObjectEixENS0_11NoResultTagEEC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESC_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateEPNS_8JSObjectEixENS0_11NoResultTagEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFvPNS_9ExecStateEPNS_8JSObjectEixENS0_11NoResultTagEED1Ev
+__ZN3JSC3DFG14SpeculativeJIT27compilePeepHoleDoubleBranchEPNS0_4NodeES3_NS_23MacroAssemblerX86Common15DoubleConditionE
+__ZN3JSC16InternalFunction21calculatedDisplayNameEPNS_9ExecStateE
+__ZN3JSC16InternalFunction11displayNameEPNS_9ExecStateE
+_operationCompareGreaterEq
+__ZN3JSCL23dateProtoFuncSetSecondsEPNS_9ExecStateE
+__ZN3JSCL23setNewValueFromTimeArgsEPNS_9ExecStateEib
+__ZN3JSCL28dateProtoFuncSetMilliSecondsEPNS_9ExecStateE
+__ZN3JSCL23dateProtoFuncSetMinutesEPNS_9ExecStateE
+__ZN3JSC3DFG14SpeculativeJIT16speculateNotCellENS0_4EdgeE
+__ZN3JSC16ArrayConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL20callArrayConstructorEPNS_9ExecStateE
+__ZN3WTF5DequeINS_19FunctionWithContextELm0EE6removeEm
+__ZN3JSC17BytecodeGenerator20emitLoadGlobalObjectEPNS_10RegisterIDE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE29generatePatternCharacterFixedEm
+__ZN3JSCL21dateProtoFuncSetMonthEPNS_9ExecStateE
+_operationCompareLess
+__ZN3JSCL23dateProtoFuncSetUTCDateEPNS_9ExecStateE
+__ZN3JSC14JSGlobalObject25arrayPrototypeChainIsSaneEv
+__ZN3JSC3DFG10FixupPhase13fixDoubleEdgeILNS0_7UseKindE3EEEvRNS0_4EdgeENS0_20SpeculationDirectionE
+__ZN3JSC3DFG14SpeculativeJIT28compileIntegerArithDivForX86EPNS0_4NodeE
+__ZN3JSC3DFG14SpeculativeJIT21compileDoublePutByValEPNS0_4NodeERNS0_20SpeculateCellOperandERNS0_27SpeculateStrictInt32OperandE
+_operationRageEnsureContiguous
+__ZN3JSC8JSObject24rageEnsureContiguousSlowERNS_2VME
+__ZN3JSC3DFG12CCallHelpers16setupTwoStubArgsILNS_12X86Registers13XMMRegisterIDE0ELS4_1EEEvS4_S4_
+__ZN3JSC3DFG14SpeculativeJIT19appendCallSetResultERKNS_11FunctionPtrENS_12X86Registers13XMMRegisterIDE
+__ZN3JSC16ProgramCodeBlock14jitCompileImplEPNS_9ExecStateE
+__ZN3JSC17ProgramExecutable10jitCompileEPNS_9ExecStateE
+__ZN3JSC23jitCompileIfAppropriateINS_16ProgramCodeBlockEEEbPNS_9ExecStateERN3WTF6OwnPtrIT_EERNS_7JITCodeENS9_7JITTypeEjNS_20JITCompilationEffortE
+__ZN3JSC16ProgramCodeBlock25canCompileWithDFGInternalEv
+__ZN3JSC3DFG19mightCompileProgramEPNS_9CodeBlockE
+__ZN3JSC3JIT11emit_op_endEPNS_11InstructionE
+__ZN3JSC18GCThreadSharedData15didStartCopyingEv
+__ZN3WTF6VectorIPN3JSC11CopiedBlockELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC8GCThread11copyVisitorEv
+__ZN3JSC11CopiedSpace16doneFillingBlockEPNS_11CopiedBlockEPS2_
+__ZN3JSC11CopyVisitor14copyFromSharedEv
+__ZN3JSC8JSObject16copyBackingStoreEPNS_6JSCellERNS_11CopyVisitorE
+__ZN3JSC18GCThreadSharedData16didFinishCopyingEv
+__ZN3JSC9Arguments19getOwnPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC8JSObject6freezeERNS_2VME
+__ZN3JSC9Structure8isFrozenERNS_2VME
+__ZN3JSC9Structure16freezeTransitionERNS_2VMEPS0_
+__ZN3JSC4Yarr11InterpreterItE17matchAssertionEOLERNS0_8ByteTermE
+_operationPutByIdStrictOptimize
+_operationPutByIdStrictOptimizeWithReturnAddress
+_operationPutByIdStrict
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEtE11parseEscapeILb1ENS3_28CharacterClassParserDelegateEEEbRT0_
+__ZN3JSC10JSFunction15argumentsGetterEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL21dateProtoFuncSetHoursEPNS_9ExecStateE
+__ZN3JSC11CopiedSpace20recycleBorrowedBlockEPNS_11CopiedBlockE
+__ZN3JSC23MacroAssemblerX86Common19branchDoubleNonZeroENS_12X86Registers13XMMRegisterIDES2_
+__ZN3JSCL25numberConstructorMinValueEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL28numberConstructorNegInfinityEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEPNS_15InlineCallFrameEENS_12X86Registers10RegisterIDES7_
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFvPNS_9ExecStateEPNS_6JSCellES5_PNS_15InlineCallFrameEENS_12X86Registers10RegisterIDESB_S7_
+_operationCreateInlinedArguments
+__ZN3JSC9Arguments6createERNS_2VMEPNS_9ExecStateEPNS_15InlineCallFrameE
+__ZNK3JSC15InlineCallFrame18calleeForCallFrameEPNS_9ExecStateE
+_operationTearOffInlinedArguments
+__ZN3JSC9Arguments7tearOffEPNS_9ExecStateEPNS_15InlineCallFrameE
+__ZN3JSC9Arguments25tearOffForInlineCallFrameERNS_2VMEPNS_8RegisterEPNS_15InlineCallFrameE
+__ZN3JSC3DFG14SpeculativeJIT28compilePeepHoleBooleanBranchEPNS0_4NodeES3_NS_23MacroAssemblerX86Common19RelationalConditionE
+_operationEnsureInt32
+__ZN3JSC8JSObject15ensureInt32SlowERNS_2VME
+__ZN3JSC10Identifier4fromEPNS_9ExecStateEi
+__ZN3JSC17logThunkGeneratorEPNS_2VME
+__ZN3JSCL16mathProtoFuncTanEPNS_9ExecStateE
+_logThunk
+__ZN3WTF9HashTableIN3JSC3DFG16FrequentExitSiteES3_NS_17IdentityExtractorENS2_20FrequentExitSiteHashENS_10HashTraitsIS3_EES7_E16lookupForWritingINS_22IdentityHashTranslatorIS5_EES3_EENSt3__14pairIPS3_bEERKT0_
+__ZN3JSC17expThunkGeneratorEPNS_2VME
+_expThunk
+__ZN3JSCL17mathProtoFuncATanEPNS_9ExecStateE
+_operationVirtualConstruct
+__ZN3JSC13EvalCodeBlock14jitCompileImplEPNS_9ExecStateE
+__ZN3JSC14EvalExecutable10jitCompileEPNS_9ExecStateE
+__ZN3JSC23jitCompileIfAppropriateINS_13EvalCodeBlockEEEbPNS_9ExecStateERN3WTF6OwnPtrIT_EERNS_7JITCodeENS9_7JITTypeEjNS_20JITCompilationEffortE
+__ZN3JSC13EvalCodeBlock25canCompileWithDFGInternalEv
+__ZN3JSC3DFG16mightCompileEvalEPNS_9CodeBlockE
+__ZN3WTF11OSAllocator18releaseDecommittedEPvm
+__ZN3JSC3DFG14SpeculativeJIT44compilePeepHoleObjectToObjectOrOtherEqualityENS0_4EdgeES2_PNS0_4NodeE
+__ZN3JSCL27dateProtoFuncToLocaleStringEPNS_9ExecStateE
+__ZN3JSCL16formatLocaleDateEPNS_9ExecStateEPNS_12DateInstanceEdNS_20LocaleDateTimeFormatE
+__ZN3WTF20equalIgnoringNullityEPNS_10StringImplES1_
+__ZN3WTF6String6numberEx
+__ZN3JSC4Yarr6ParserINS0_22YarrPatternConstructorEtE28CharacterClassParserDelegate25atomBuiltInCharacterClassENS0_23BuiltInCharacterClassIDEb
+__ZN3JSC12RegExpObject14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC9ExecState11regExpTableEPS0_
+__ZN3JSCL25numberConstructorNaNValueEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC19SparseArrayValueMap9putDirectEPNS_9ExecStateEPNS_8JSObjectEjNS_7JSValueEjNS_18PutDirectIndexModeE
+__ZN3JSC6ParserINS_5LexerItEEE21parseConstDeclarationINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSCL27objectProtoFuncDefineGetterEPNS_9ExecStateE
+__ZN3JSC18PropertyDescriptor9setGetterENS_7JSValueE
+__ZN3JSC18PropertyDescriptor13setEnumerableEb
+__ZNK3JSC18PropertyDescriptor12getterObjectEv
+__ZN3JSCL27objectProtoFuncDefineSetterEPNS_9ExecStateE
+__ZN3JSC18PropertyDescriptor9setSetterENS_7JSValueE
+__ZNK3JSC18PropertyDescriptor12setterObjectEv
+_operationGetArgumentsLength
+_operationGetArgumentByVal
+__ZN3WTF13StringBuilder12appendNumberEl
+__ZN3WTF15BinarySemaphoreD1Ev
+__ZN3JSC23createInvalidParamErrorEPNS_9ExecStateEPKcNS_7JSValueE
+__ZN3WTF13tryMakeStringIPKcNS_6StringES2_S2_S2_EENS_10PassRefPtrINS_10StringImplEEET_T0_T1_T2_T3_
+__ZN3WTF10StringImpl12toUIntStrictEPbi
+__ZN3WTF18FunctionDispatcherD2Ev
+__ZN3WTF8Internal25parseDoubleFromLongStringEPKtmRm
+__ZN3JSCL28objectProtoFuncIsPrototypeOfEPNS_9ExecStateE
+_cti_op_check_has_instance
+__ZN3JSC8JSObject24defineOwnIndexedPropertyEPNS_9ExecStateEjRNS_18PropertyDescriptorEb
+__ZN3JSC8JSObject54ensureArrayStorageExistsAndEnterDictionaryIndexingModeERNS_2VME
+__ZN3JSC19SparseArrayValueMap3addEPNS_8JSObjectEj
+__ZNK3JSC16SparseArrayEntry3getERNS_18PropertyDescriptorE
+__ZN3JSC8JSObject20putIndexedDescriptorEPNS_9ExecStateEPNS_16SparseArrayEntryERNS_18PropertyDescriptorES6_
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE24generateDotStarEnclosureEm
+__ZN3JSCL33objectConstructorDefinePropertiesEPNS_9ExecStateE
+__ZN3JSC7JSProxy17defineOwnPropertyEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3JSC14JSGlobalObject17defineOwnPropertyEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3JSC14JSGlobalObject24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC27getStaticFunctionDescriptorINS_25JSSegmentedVariableObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC14symbolTableGetINS_14JSGlobalObjectEEEbPT_NS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC4Yarr12ByteCompiler28atomParenthesesTerminalBeginEjbjjj
+__ZN3JSC4Yarr12ByteCompiler26atomParenthesesTerminalEndEijN3WTF7CheckedIjNS2_15CrashOnOverflowEEENS0_14QuantifierTypeE
+__ZN3JSC17NumberConstructor3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC12StringObject24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC8JSString27getStringPropertyDescriptorEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC14ArrayPrototype24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC27getStaticFunctionDescriptorINS_7JSArrayEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC7JSArray24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC15NumberPrototype24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC27getStaticFunctionDescriptorINS_12NumberObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC15RegExpPrototype24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC27getStaticFunctionDescriptorINS_12RegExpObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC12RegExpObject24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC24getStaticValueDescriptorINS_12RegExpObjectENS_8JSObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPT_NS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC13DatePrototype24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC27getStaticFunctionDescriptorINS_8JSObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPS1_NS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC22ClosureCallStubRoutine27markRequiredObjectsInternalERNS_11SlotVisitorE
+__ZN3WTF9BitVector7setSlowERKS0_
+__ZN3JSC18RegExpMatchesArray19getOwnPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+_JSValueGetType
+__ZN3JSC13EvalCodeBlock11replacementEv
+__ZN3JSC13EvalCodeBlock16compileOptimizedEPNS_9ExecStateEPNS_7JSScopeEj
+__ZN3JSC14EvalExecutable16compileOptimizedEPNS_9ExecStateEPNS_7JSScopeEj
+__ZN3JSC3DFG10tryCompileEPNS_9ExecStateEPNS_9CodeBlockERNS_7JITCodeEj
+__ZN3JSC3DFG11JITCompiler7compileERNS_7JITCodeE
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDESD_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDESD_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDESD_EC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_SD_
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDESD_ED0Ev
+__ZN3JSC3DFG41CallResultAndOneArgumentSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDESD_ED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEPNS_7JSArrayEENS_12X86Registers10RegisterIDEED1Ev
++[JSValue valueWithObject:inContext:]
+__Z13objectToValueP9JSContextP11objc_object
+__ZL24objectToValueWithoutCopyP9JSContextP11objc_object
+__Z19getJSExportProtocolv
+__ZN22ObjcContainerConvertor3addENS_4TaskE
+__ZN3WTF9HashTableIP11objc_objectNS_12KeyValuePairIS2_PK13OpaqueJSValueEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSD_IS6_EEEESE_E16lookupForWritingINS_22IdentityHashTranslatorISB_EES2_EENSt3__14pairIPS7_bEERKT0_
+__ZN3WTF9HashTableIP11objc_objectNS_12KeyValuePairIS2_PK13OpaqueJSValueEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSD_IS6_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EES2_S6_EENS_18HashTableAddResultINS_17HashTableIteratorIS2_S7_S9_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3WTF6VectorIN22ObjcContainerConvertor4TaskELm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN22ObjcContainerConvertor7convertEP11objc_object
+-[JSContext exception]
+-[JSContext setException:]
+-[JSContext evaluateScript:]
+-[JSValue callWithArguments:]
+-[JSContext(SubscriptSupport) setObject:forKeyedSubscript:]
+-[JSContext globalObject]
+-[JSValue(SubscriptSupport) setObject:forKeyedSubscript:]
+-[JSValue setValue:forProperty:]
+-[JSContext(Internal) wrapperForObjCObject:]
+-[JSWrapperMap jsWrapperForObject:]
+-[JSWrapperMap classInfoForClass:]
+-[JSObjCClassInfo .cxx_construct]
+-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]
+-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]
+-[JSContext(SubscriptSupport) objectForKeyedSubscript:]
+-[JSValue(SubscriptSupport) objectForKeyedSubscript:]
+-[JSValue valueForProperty:]
+__Z18valueInternalValueP7JSValue
+__ZL11makeWrapperPK15OpaqueJSContextP13OpaqueJSClassP11objc_object
+__ZN3JSC16JSCallbackObjectINS_18JSAPIWrapperObjectEE6createEPNS_9ExecStateEPNS_14JSGlobalObjectEPNS_9StructureEP13OpaqueJSClassPv
+__ZN3JSC16JSCallbackObjectINS_18JSAPIWrapperObjectEEC2EPNS_9ExecStateEPNS_9StructureEP13OpaqueJSClassPv
+__ZN3JSC18JSAPIWrapperObjectC2ERNS_2VMEPNS_9StructureE
+__ZN3JSC18JSAPIWrapperObject14finishCreationERNS_2VME
+__ZN3JSC16JSCallbackObjectINS_18JSAPIWrapperObjectEE4initEPNS_9ExecStateE
+__ZN3JSC18JSAPIWrapperObject16setWrappedObjectEPv
+__ZN3JSC12APIEntryShimD1Ev
+__Z16putNonEnumerableP7JSValueP8NSStringS0_
+-[JSValue defineProperty:descriptor:]
+-[JSValue invokeMethod:withArguments:]
+__ZN3JSC16JSCallbackObjectINS_18JSAPIWrapperObjectEE24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC16JSCallbackObjectINS_18JSAPIWrapperObjectEE18getOwnPropertySlotEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameERNS_12PropertySlotE
+__Z35forEachProtocolImplementingProtocolP10objc_classP8ProtocolU13block_pointerFvS2_E
+__ZN3WTF6VectorIP8ProtocolLm0ENS_15CrashOnOverflowEE6appendIS2_EEvPKT_m
+__ZN3WTF6VectorIP8ProtocolLm0ENS_15CrashOnOverflowEE15reserveCapacityEm
+_JSObjectSetPrototype
+-[JSObjCClassInfo wrapperForObject:]
+__Z28objCCallbackFunctionForBlockP9JSContextP11objc_object
+__ZL33objCCallbackFunctionForInvocationP9JSContextP12NSInvocation12CallbackTypeP10objc_classPKc
+__Z13parseObjCTypeI18ResultTypeDelegateENT_10ResultTypeERPKc
+__Z13parseObjCTypeI20ArgumentTypeDelegateENT_10ResultTypeERPKc
+__ZN20ArgumentTypeDelegate11typeOfClassEPKcS1_
+__ZN3JSC12APIEntryShimC1EPNS_9ExecStateEb
+__ZN14WeakContextRefC1EP9JSContext
+__ZN3JSC18JSCallbackFunctionC2EPNS_14JSGlobalObjectEPNS_9StructureEPFPK13OpaqueJSValuePK15OpaqueJSContextPS5_SB_mPKS7_PS7_E
+__ZN3JSC18JSCallbackFunction14finishCreationERNS_2VMERKN3WTF6StringE
+__ZN3WTF9HashTableIP11objc_objectNS_12KeyValuePairIS2_N3JSC4WeakINS4_8JSObjectEEEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSE_IS7_EEEESF_E16lookupForWritingINS_22IdentityHashTranslatorISC_EES2_EENSt3__14pairIPS8_bEERKT0_
+__ZN3WTF9HashTableIP11objc_objectNS_12KeyValuePairIS2_N3JSC4WeakINS4_8JSObjectEEEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSE_IS7_EEEESF_E3addINS_17HashMapTranslatorISH_SC_EES2_NS4_8PassWeakIS6_EEEENS_18HashTableAddResultINS_17HashTableIteratorIS2_S8_SA_SC_SH_SF_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIP11objc_objectNS_12KeyValuePairIS2_N3JSC4WeakINS4_8JSObjectEEEEENS_24KeyValuePairKeyExtractorIS8_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSE_IS7_EEEESF_E6rehashEi
+-[JSObjCClassInfo dealloc]
+__ZN13OpaqueJSClassD1Ev
+-[JSObjCClassInfo .cxx_destruct]
+__ZN29JSAPIWrapperObjectHandleOwner26isReachableFromOpaqueRootsEN3JSC6HandleINS0_7UnknownEEEPvRNS0_11SlotVisitorE
+__ZN29JSAPIWrapperObjectHandleOwner8finalizeEN3JSC6HandleINS0_7UnknownEEEPv
+__ZN3JSC16JSCallbackObjectINS_18JSAPIWrapperObjectEE7destroyEPNS_6JSCellE
+__ZN3JSC20ObjCCallbackFunction7destroyEPNS_6JSCellE
+__ZN3JSC24ObjCCallbackFunctionImplD2Ev
+__ZN18CallbackResultVoidD0Ev
+__ZN24CallbackArgumentNSStringD0Ev
+__ZN14WeakContextRefD1Ev
+__ZN16CallbackResultIdD0Ev
+__ZN24CallbackArgumentNSNumberD0Ev
+__ZN3WTF13tryMakeStringINS_12StringAppendIPKcNS_6StringEEES3_EENS_10PassRefPtrINS_10StringImplEEET_T0_
+__ZN3JSCL29numberProtoFuncToLocaleStringEPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncRoundEPNS_9ExecStateE
+__ZN3WTF12AtomicString3addEPNS_10StringImplEjj
+__ZN3WTF19SubstringTranslator9translateERPNS_10StringImplERKNS_17SubstringLocationEj
+__ZN3JSC3JIT25emitIntTypedArrayGetByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpERKNS_20TypedArrayDescriptorEmNS_20TypedArraySignednessE
+__ZN3JSC20MacroAssemblerX86_649addDoubleENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15AbsoluteAddressENS_12X86Registers13XMMRegisterIDE
+__ZN3JSC17UnlinkedCodeBlock27addCharacterSwitchJumpTableEv
+__ZN3JSC3JIT19emit_op_switch_charEPNS_11InstructionE
+__ZN3JSC3DFG39throwExceptionFromCallSlowPathGeneratorEPNS_2VME
+_lookupExceptionHandler
+__ZN3JSCL28regExpConstructorLeftContextEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC18RegExpMatchesArray11leftContextEPNS_9ExecStateE
+_cti_op_resolve_base_strict_put
+__ZNK3WTF6String5splitERKS0_bRNS_6VectorIS0_Lm0ENS_15CrashOnOverflowEEE
+__ZN3JSCL24dateProtoFuncSetUTCHoursEPNS_9ExecStateE
+__ZN3JSCL26dateProtoFuncSetUTCMinutesEPNS_9ExecStateE
+__ZN3JSCL26dateProtoFuncSetUTCSecondsEPNS_9ExecStateE
+_operationEnsureDouble
+__ZN3JSC8JSObject16ensureDoubleSlowERNS_2VME
+__ZN3JSC4Yarr11InterpreterItE20backtrackParenthesesERNS0_8ByteTermEPNS2_18DisjunctionContextE
+__ZN3JSC7JSProxy16getPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC19JSSymbolTableObject27getOwnNonIndexPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSCL17mathProtoFuncASinEPNS_9ExecStateE
+__ZN3JSC3DFG14SpeculativeJIT14speculateOtherENS0_4EdgeE
+__ZN3JSC6ParserINS_5LexerItEEE18parseWithStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC12StringObject14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC9ExecState20regExpPrototypeTableEPS0_
+__ZN3JSC12RegExpObject16getPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC12RegExpObject27getOwnNonIndexPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC9ExecState9dateTableEPS0_
+__ZN3JSC9ExecState21arrayConstructorTableEPS0_
+__ZN3JSCL19arrayProtoFuncEveryEPNS_9ExecStateE
+__ZN3JSC7JSArray19sortCompactedVectorILh21ENS_12WriteBarrierINS_7UnknownEEEEEvPNS_9ExecStateENS_14ContiguousDataIT0_EEj
+__ZN3JSCL26numberProtoFuncToPrecisionEPNS_9ExecStateE
+__ZN3JSCL19dateProtoFuncToJSONEPNS_9ExecStateE
+__ZN3JSC9Arguments21deletePropertyByIndexEPNS_6JSCellEPNS_9ExecStateEj
+__ZN3JSC9Arguments3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSCL25arrayProtoFuncLastIndexOfEPNS_9ExecStateE
+__ZN3JSC16createRangeErrorEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC9ExecState20dateConstructorTableEPS0_
+__ZN3JSC9ExecState22objectConstructorTableEPS0_
+_operationStringFromCharCode
+__ZN3JSC18stringFromCharCodeEPNS_9ExecStateEi
+__ZN3WTF6VectorItLm64ENS_20UnsafeVectorOverflowEE18tryReserveCapacityEm
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEdPNS_7JSArrayEENS_12X86Registers10RegisterIDENS8_13XMMRegisterIDES9_
+__ZN3JSC15DateConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL8callDateEPNS_9ExecStateE
+__ZN3JSCL31objectConstructorGetPrototypeOfEPNS_9ExecStateE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPcPNS_9ExecStateEPNS_9StructureEPvmENS_12X86Registers10RegisterIDES6_S7_m
+_operationNewArray
+__ZN3JSCL27dateProtoFuncSetUTCFullYearEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncSetUTCMonthEPNS_9ExecStateE
+__ZN3JSCL31dateProtoFuncSetUTCMillisecondsEPNS_9ExecStateE
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE29generatePatternCharacterFixedEm
+__ZN3JSC6ParserINS_5LexerIhEEE22parseDebuggerStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC4Yarr22YarrPatternConstructor5resetEv
+__ZN3JSC4Yarr11YarrPattern5resetEv
+__ZN3JSC4Yarr25CharacterClassConstructor5resetEv
+__ZNK3JSC14ExpressionNode17isDotAccessorNodeEv
+__ZN3JSC17BytecodeGenerator23emitThrowReferenceErrorERKN3WTF6StringE
+__ZN3JSC8JSObject25convertDoubleToContiguousERNS_2VME
+_operationPutByValBeyondArrayBoundsStrict
+__ZN3JSC26createNotAConstructorErrorEPNS_9ExecStateENS_7JSValueE
+__ZN3JSCL22regExpProtoFuncCompileEPNS_9ExecStateE
+__ZN3WTF6VectorIN3JSC14ScopeLabelInfoELm2ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC3JIT25emitIntTypedArrayPutByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpERKNS_20TypedArrayDescriptorEmNS_20TypedArraySignednessENS_18TypedArrayRoundingE
+__ZN3JSC12X86Assembler23X86InstructionFormatter10oneByteOp8ENS0_15OneByteOpcodeIDEiNS_12X86Registers10RegisterIDES4_ii
+__ZN3JSC3DFG14SpeculativeJIT31compilePutByValForIntTypedArrayERKNS_20TypedArrayDescriptorENS_12X86Registers10RegisterIDES6_PNS0_4NodeEmNS_20TypedArraySignednessENS_18TypedArrayRoundingE
+__ZN3JSCL23booleanProtoFuncValueOfEPNS_9ExecStateE
+__ZN3JSCL22dateProtoFuncGetUTCDayEPNS_9ExecStateE
+__ZN3JSC8JSObject18createInitialInt32ERNS_2VMEj
+__ZN3WTF6VectorItLm64ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+_cti_op_switch_char
+__ZN3WTF6VectorIN3JSC7JSValueELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSCL36objectConstructorGetOwnPropertyNamesEPNS_9ExecStateE
+__ZN3JSCL41objectConstructorGetOwnPropertyDescriptorEPNS_9ExecStateE
+__ZN3JSC15DateConstructor24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC27getStaticFunctionDescriptorINS_16InternalFunctionEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC16ArrayConstructor24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZNK3JSC18PropertyDescriptor6getterEv
+__ZNK3JSC18PropertyDescriptor6setterEv
+__ZN3JSC16BooleanPrototype24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC27getStaticFunctionDescriptorINS_13BooleanObjectEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC17NumberConstructor24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC24getStaticValueDescriptorINS_17NumberConstructorENS_16InternalFunctionEEEbPNS_9ExecStateEPKNS_9HashTableEPT_NS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC12StringObject17defineOwnPropertyEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3JSC17StringConstructor24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC7JSArray17defineOwnPropertyEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3JSC12RegExpObject17defineOwnPropertyEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3JSC17RegExpConstructor24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC24getStaticValueDescriptorINS_17RegExpConstructorENS_16InternalFunctionEEEbPNS_9ExecStateEPKNS_9HashTableEPT_NS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSCL28numberConstructorPosInfinityEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC7JSArray17compactForSortingILh23EEEvRjS2_
+__ZN3JSCL32compareNumbersForQSortWithDoubleEPKvS1_
+__ZN3JSC6ParserINS_5LexerIhEEE18updateErrorMessageENS_11JSTokenTypeE
+__ZN3JSC11ParserError13toErrorObjectEPNS_14JSGlobalObjectERKNS_10SourceCodeE
+__ZN3JSCL18mathProtoFuncATan2EPNS_9ExecStateE
+__ZNK3JSC5LexerItE23invalidCharacterMessageEv
+__ZN3JSC6ParserINS_5LexerItEEE18updateErrorMessageEv
+__ZN3JSC6ParserINS_5LexerItEEE12getTokenNameENS_11JSTokenTypeE
+__ZN3WTF13tryMakeStringINS_12StringAppendIPKcNS_6StringEEEcEENS_10PassRefPtrINS_10StringImplEEET_T0_
+__ZN3JSC6ParserINS_5LexerItEEE22parseDebuggerStatementINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC3DFG14SpeculativeJIT22compileNewStringObjectEPNS0_4NodeE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDESF_jE16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDESF_jEC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESF_SF_j
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDESF_jED0Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDESF_jED1Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDESH_SD_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDESH_SD_EC2ES5_PNS0_14SpeculativeJITESF_NS0_18SpillRegistersModeESH_SH_SD_
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDESH_SD_ED0Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDESH_SD_ED1Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_ENS_12X86Registers10RegisterIDESF_SF_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_ENS_12X86Registers10RegisterIDESF_SF_EC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESF_SF_SF_
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_ENS_12X86Registers10RegisterIDESF_SF_ED0Ev
+__ZN3JSC3DFG42CallResultAndTwoArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_ENS_12X86Registers10RegisterIDESF_SF_ED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESF_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSObjectEiENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESF_NS0_18SpillRegistersModeESH_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_ENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESF_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_ENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_ENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_SB_ENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESD_NS0_18SpillRegistersModeESF_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_SB_ENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringESB_SB_ENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JSStringEPNS_9StructureEENS_12X86Registers10RegisterIDESD_S9_
+__ZN3JSCL24regExpConstructorDollar3EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL24regExpConstructorDollar5EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL31dateProtoFuncToLocaleTimeStringEPNS_9ExecStateE
+__ZN3JSC14ErrorPrototype24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC27getStaticFunctionDescriptorINS_13ErrorInstanceEEEbPNS_9ExecStateEPKNS_9HashTableEPNS_8JSObjectENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFvPNS_9ExecStateEPNS_8JSObjectEidENS_12X86Registers10RegisterIDES9_NS8_13XMMRegisterIDE
+__ZN3JSCL25arrayProtoFuncReduceRightEPNS_9ExecStateE
+__ZN3JSC22boundFunctionConstructEPNS_9ExecStateE
+__ZN3JSC9constructEPNS_9ExecStateENS_7JSValueENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
+__ZN3JSC11Interpreter16executeConstructEPNS_9ExecStateEPNS_8JSObjectENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
+__ZN3WTF4SHA1C1Ev
+__ZN3WTF4SHA18addBytesEPKhm
+__ZN3WTF4SHA111computeHashERNS_6VectorIhLm20ENS_15CrashOnOverflowEEE
+__ZN3WTF4SHA18finalizeEv
+__ZN3WTF4SHA112processBlockEv
+__ZN3JSCL31dateProtoFuncToLocaleDateStringEPNS_9ExecStateE
+__ZN3JSCL25dateProtoFuncToTimeStringEPNS_9ExecStateE
+_operationArrayPushDouble
+__ZN3WTF10StringImpl32simplifyMatchedCharactersToSpaceIhNS_23SpaceOrNewlinePredicateEEENS_10PassRefPtrIS0_EET0_
+__ZN3JSC17ObjectConstructor24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC4Yarr11InterpreterItE26matchAssertionWordBoundaryERNS0_8ByteTermE
+__ZN3JSC14throwTypeErrorEPNS_9ExecStateE
+__ZN3JSC4Heap11objectCountEv
+__ZN3JSC11MarkedSpace12forEachBlockINS_9MarkCountEEENT_10ReturnTypeERS3_
+__ZN3JSC4Heap17globalObjectCountEv
+__ZN3JSC4Heap20protectedObjectCountEv
+__ZN3JSC4Heap25protectedObjectTypeCountsEv
+__ZN3WTF9HashTableIPKcNS_12KeyValuePairIS2_jEENS_24KeyValuePairKeyExtractorIS4_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSA_IjEEEESB_E16lookupForWritingINS_22IdentityHashTranslatorIS8_EES2_EENSt3__14pairIPS4_bEERKT0_
+__ZN3WTF9HashTableIPKcNS_12KeyValuePairIS2_jEENS_24KeyValuePairKeyExtractorIS4_EENS_7PtrHashIS2_EENS_18HashMapValueTraitsINS_10HashTraitsIS2_EENSA_IjEEEESB_E3addINS_17HashMapTranslatorISD_S8_EES2_jEENS_18HashTableAddResultINS_17HashTableIteratorIS2_S4_S6_S8_SD_SB_EEEERKT0_RKT1_
+__ZN3JSC4Heap16objectTypeCountsEv
+__ZN3JSCL29regExpConstructorRightContextEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC18RegExpMatchesArray12rightContextEPNS_9ExecStateE
+__ZN3WTF14tryFastReallocEPvm
+__ZN3JSC2VM6createENS_8HeapTypeE
+__ZN3JSC3JIT25emit_op_put_getter_setterEPNS_11InstructionE
+_cti_op_put_getter_setter
+_operationPutByIdStrictBuildList
+_operationPutByIdStrictBuildListWithReturnAddress
+__ZN3WTF7Unicode18equalUTF16WithUTF8EPKtS2_PKcS4_
+__ZN3JSC8Watchdog4fireEv
+__ZN3JSC8DebuggerD2Ev
+__ZN3JSC2VMD1Ev
+__ZN3JSC2VMD2Ev
+__ZN3JSC6JSLock13willDestroyVMEPNS_2VME
+__ZN3JSC4Heap20lastChanceToFinalizeEv
+__ZN3JSC11MarkedSpace20lastChanceToFinalizeEv
+__ZN3JSC11MarkedSpace12forEachBlockINS_20LastChanceToFinalizeEEENT_10ReturnTypeERS3_
+__ZN3JSC9WeakBlock20lastChanceToFinalizeEv
+__ZN3JSC11InterpreterD1Ev
+__ZN3JSC7JSStackD1Ev
+__ZN3JSC7JSStackD2Ev
+__ZNK3JSC9HashTable11deleteTableEv
+__ZN3JSC17CommonIdentifiersD2Ev
+__ZN3JSC2VM10ClientDataD2Ev
+__ZN3JSC11RegExpCacheD0Ev
+__ZN3JSC9JITThunksD1Ev
+__ZN3JSC9JITThunksD2Ev
+__ZN3JSC12PrototypeMapD2Ev
+__ZN3JSC14NumericStringsD2Ev
+__ZN3JSC12SmallStringsD1Ev
+__ZN3JSC8WatchdogD1Ev
+__ZN3JSC8Watchdog12destroyTimerEv
+__ZN3JSC3DFG14LongLivedStateD1Ev
+__ZN3JSC4HeapD1Ev
+__ZN3JSC4HeapD2Ev
+__ZN3JSC18IncrementalSweeperD0Ev
+__ZN3JSC9HeapTimerD2Ev
+__ZN3JSC25DefaultGCActivityCallbackD0Ev
+__ZN3JSC17JITStubRoutineSetD1Ev
+__ZN3JSC17JITStubRoutineSetD2Ev
+__ZN3JSC13DFGCodeBlocksD1Ev
+__ZN3JSC13DFGCodeBlocksD2Ev
+__ZN3JSC9HandleSetD1Ev
+__ZN3JSC11SlotVisitorD1Ev
+__ZN3JSC14MarkStackArrayD1Ev
+__ZN3JSC18GCThreadSharedDataD1Ev
+__ZN3JSC18GCThreadSharedDataD2Ev
+__ZN3JSC8GCThread8threadIDEv
+__ZN3WTF14ThreadSpecificIbE7destroyEPv
+__ZN3JSC14MachineThreadsD1Ev
+__ZN3JSC11CopiedSpaceD1Ev
+__ZN3JSC11CopiedSpaceD2Ev
+__ZN3JSC11MarkedSpaceD1Ev
+__ZN3JSC11MarkedSpace12forEachBlockINS_4FreeEEENT_10ReturnTypeERS3_
+__ZN3JSC11SuperRegionD1Ev
+__ZN3WTF13MetaAllocatorD2Ev
+__ZN3JSC19ExecutableAllocatorD1Ev
+__ZN3WTF14ThreadSpecificINS_13WTFThreadDataEE7destroyEPv
+__ZN3WTF13WTFThreadDataD1Ev
+__ZN3WTF13WTFThreadDataD2Ev
+__ZN3WTF17AtomicStringTable7destroyEPS0_
+__ZN3JSC3DFG10FixupPhase19convertStringAddUseILNS0_7UseKindE14EEEvPNS0_4NodeERNS0_4EdgeE
+__ZN3JSC3JIT20emit_op_put_by_indexEPNS_11InstructionE
+_cti_op_put_by_index
+__ZN3JSC7JSArray10sortVectorILh29EEEvPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3WTF17double_conversionL12FillDigits64EyNS0_15BufferReferenceIcEEPi
+__ZN3WTF6VectorIN3JSC11ParserStateELm16ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC20StrictEvalActivationC1EPNS_9ExecStateE
+__ZN3JSC3DFGL8putByValILb1EEEvPNS_9ExecStateENS_7JSValueEjS4_
+_operationPutByIdDirectStrictOptimize
+_operationPutByIdDirectStrictOptimizeWithReturnAddress
+_operationPutByIdDirectStrict
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE33generatePatternCharacterNonGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE0EE34backtrackPatternCharacterNonGreedyEm
+__ZN3JSC3DFG14SpeculativeJIT30compileGetByValOnIntTypedArrayERKNS_20TypedArrayDescriptorEPNS0_4NodeEmNS_20TypedArraySignednessE
+__ZN3JSC18PropertyDescriptor12setUndefinedEv
+__ZN3JSCL25dateProtoFuncToDateStringEPNS_9ExecStateE
+__ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC6ParserINS_5LexerItEEE18updateErrorMessageENS_11JSTokenTypeE
+__ZN3JSC6ParserINS_5LexerIhEEE22parseDebuggerStatementINS_10ASTBuilderEEENT_9StatementERS6_
+__ZN3JSC21DebuggerStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16ProgramCodeBlock11replacementEv
+__ZN3JSC16ProgramCodeBlock16compileOptimizedEPNS_9ExecStateEPNS_7JSScopeEj
+__ZN3JSC17ProgramExecutable16compileOptimizedEPNS_9ExecStateEPNS_7JSScopeEj
+__ZN3WTF10StringImpl20create8BitIfPossibleEPKt
+__ZN3JSCL21isNonLatin1IdentStartEi
+__ZN3WTF9HashTableIPN3JSC15InlineCallFrameES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_18NullableHashTraitsIS3_EES8_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EES3_EENSt3__14pairIPS3_bEERKT0_
+_operationResolveBase
+__ZN3JSC6ParserINS_5LexerItEEE21parseConstDeclarationINS_13SyntaxCheckerEEENT_9StatementERS6_
+__ZN3JSC14createURIErrorEPNS_9ExecStateERKN3WTF6StringE
+_WTFLogAlways
+_vprintf_stderr_common
+__ZN3WTF10makeStringINS_6StringES1_EES1_T_T0_
+__ZN3WTF13tryMakeStringINS_6StringES1_EENS_10PassRefPtrINS_10StringImplEEET_T0_
+__ZN3JSC10LocalStackINS_7JSArrayELj16EE4pushEPS1_
+__ZN3JSCL17mathProtoFuncCeilEPNS_9ExecStateE
+__ZN3JSC20MacroAssemblerX86_6411branchTest8ENS_23MacroAssemblerX86Common15ResultConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15AbsoluteAddressENS5_12TrustedImm32E
+__ZN3JSC20MacroAssemblerX86_6411branchTest8ENS_23MacroAssemblerX86Common15ResultConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE15ExtendedAddressENS5_12TrustedImm32E
+__ZN3JSCL24regExpConstructorDollar6EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC5LexerIhE23parseIdentifierSlowCaseILb1EEENS_11JSTokenTypeEPNS_11JSTokenDataEjb
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE33generatePatternCharacterNonGreedyEm
+__ZN3JSC4Yarr13YarrGeneratorILNS0_18YarrJITCompileModeE1EE34backtrackPatternCharacterNonGreedyEm
+_JSStringIsEqualToUTF8CString
+_JSStringIsEqual
+__ZN3WTF3MD5C1Ev
+__ZN3WTF3MD58addBytesEPKhm
+__ZN3WTFL12MD5TransformEPjPKj
+__ZN3WTF3MD58checksumERNS_6VectorIhLm16ENS_15CrashOnOverflowEEE
+__ZNK3WTF6String8toUInt64EPb
+__ZN3WTF10StringImpl8toUInt64EPb
+__ZN3WTF18charactersToUInt64EPKtmPb
+__ZN3WTFL14toIntegralTypeIytEET_PKT0_mPbi
+_JSValueIsEqual
+__ZN3WTF6String6numberEl
+__ZN3JSC8Debugger23recompileAllJSFunctionsEPNS_2VME
+__ZN3WTF9HashTableIPN3JSC18FunctionExecutableES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3JSC18FunctionExecutable47clearUnlinkedCodeForRecompilationIfNotCompilingEv
+__ZN3WTF9HashTableIPN3JSC18FunctionExecutableES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EES3_EENSt3__14pairIPS3_bEERKT0_
+__ZN3JSC8Debugger6attachEPNS_14JSGlobalObjectE
+__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E3addINS_22IdentityHashTranslatorIS6_EES3_S3_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S3_S4_S6_S8_S8_EEEERKT0_RKT1_
+__ZN3WTF9HashTableIPN3JSC14SourceProviderENS_12KeyValuePairIS3_PNS1_9ExecStateEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E16lookupForWritingINS_22IdentityHashTranslatorISB_EES3_EENSt3__14pairIPS7_bEERKT0_
+__ZN3WTF9HashTableIPN3JSC14SourceProviderENS_12KeyValuePairIS3_PNS1_9ExecStateEEENS_24KeyValuePairKeyExtractorIS7_EENS_7PtrHashIS3_EENS_18HashMapValueTraitsINS_10HashTraitsIS3_EENSD_IS6_EEEESE_E3addINS_17HashMapTranslatorISG_SB_EES3_S6_EENS_18HashTableAddResultINS_17HashTableIteratorIS3_S7_S9_SB_SG_SE_EEEERKT0_RKT1_
+__ZN3JSC12X86Assembler3jnpEv
+__ZN3JSC23MacroAssemblerX86Common28branchTruncateDoubleToUint32ENS_12X86Registers13XMMRegisterIDENS1_10RegisterIDENS0_18BranchTruncateTypeE
+__ZN3JSC8Debugger6detachEPNS_14JSGlobalObjectE
+__ZN3WTF7HashSetIPN3JSC14JSGlobalObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE6removeENS_29HashTableConstIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorES5_S7_S7_EES3_EE
+__ZN3JSC11Interpreter5debugEPNS_9ExecStateENS_11DebugHookIDEiii
+__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E16lookupForWritingINS_22IdentityHashTranslatorIS6_EES3_EENSt3__14pairIPS3_bEERKT0_
+__ZN3JSC3JIT13emit_op_debugEPNS_11InstructionE
+__ZN3JSC3JIT25emit_op_profile_will_callEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_profile_did_callEPNS_11InstructionE
+_cti_op_debug
+_cti_op_profile_will_call
+_cti_op_profile_did_call
+__ZN3JSC9ExecState19errorPrototypeTableEPS0_
+_JSObjectSetPropertyAtIndex
+__ZN3WTF16charactersToUIntEPKtmPb
+__ZN3JSCL28numberProtoFuncToExponentialEPNS_9ExecStateE
+__ZNK3WTF17double_conversion23DoubleToStringConverter13ToExponentialEdiPNS0_13StringBuilderE
+__ZN3JSC6ParserINS_5LexerIhEEE18updateErrorMessageEPKc
+__ZN3JSC17BytecodeGenerator29emitReadOnlyExceptionIfNeededEv
+__ZN3JSC8JSObject13countElementsEv
+__ZN3JSC4Heap17collectAllGarbageEv
+__ZN3JSC11MarkedSpace5sweepEv
+__ZN3JSC18IncrementalSweeper18willFinishSweepingEv
+__ZN3JSC11MarkedSpace12forEachBlockINS_5SweepEEENT_10ReturnTypeERS3_
+__ZN3JSC11MarkedSpace6shrinkEv
+__ZN3WTF6String24numberToStringFixedWidthEdj
+__ZN3JSC7JSProxy10putByIndexEPNS_6JSCellEPNS_9ExecStateEjNS_7JSValueEb
+__ZN3JSC7JSProxy21deletePropertyByIndexEPNS_6JSCellEPNS_9ExecStateEj
+__ZN3JSC7JSProxy24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC15createEvalErrorEPNS_9ExecStateERKN3WTF6StringE
+__ZN3WTF6String6appendEt
+__ZN3JSC29createNotEnoughArgumentsErrorEPNS_9ExecStateE
+__ZN3JSC14JSGlobalObject16allowsAccessFromEPKS0_PNS_9ExecStateE
+__ZN3JSC33throwTerminatedExecutionExceptionEPNS_9ExecStateE
+_JSStringCreateWithCharacters
+__ZNK3WTF6String18simplifyWhiteSpaceEv
+_WTFCrash
+_WTFPrintBacktrace
+_printf_stderr_common
+__ZN3JSC14throwTypeErrorEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC3JIT27emitFloatTypedArrayGetByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpERKNS_20TypedArrayDescriptorEm
+__ZN3JSC3JIT27emitFloatTypedArrayPutByValEPNS_11InstructionERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE13PatchableJumpERKNS_20TypedArrayDescriptorEm
+__ZN3WTF11ArrayBuffer8transferERNS_19ArrayBufferContentsERNS_6VectorINS_6RefPtrINS_15ArrayBufferViewEEELm0ENS_15CrashOnOverflowEEE
+__ZN3WTF15ArrayBufferView6neuterEv
+__ZN3WTF6VectorINS_6RefPtrINS_15ArrayBufferViewEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC14JSGlobalObject12haveABadTimeERNS_2VME
+__ZN3JSC8JSObject27switchToSlowPutArrayStorageERNS_2VME
+__ZN3JSC16ProgramCodeBlock12jettisonImplEv
+__ZN3JSC17ProgramExecutable21jettisonOptimizedCodeERNS_2VME
+_JSStringGetUTF8CString
+__ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
+__ZN3JSC7JSStack21releaseExcessCapacityEv
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE12defaultValueEPKNS_8JSObjectEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE9classNameEPKNS_8JSObjectE
+__ZN13OpaqueJSClass9classNameEv
+__ZN3JSC12PrototypeMap37clearEmptyObjectStructureForPrototypeEPNS_8JSObjectEj
+__ZN3JSC23throwStackOverflowErrorEPNS_9ExecStateE
+__ZN3JSC15AssignErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3WTF6VectorIN3JSC5LocalINS1_7JSArrayEEELm16ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIjLm16ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC11WalkerStateELm16ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC11HandleStack4growEv
+__ZN3WTF10BlockStackIN3JSC7JSValueEE6shrinkEPS2_
+__ZN3WTF6RefPtrIN3JSC21PropertyNameArrayDataEEaSEPS2_
+__ZN3WTF6VectorIN3JSC11Stringifier6HolderELm16ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC8JSObject27enterDictionaryIndexingModeERNS_2VME
+__ZN3JSC9ExecState22stringConstructorTableEPS0_
+__ZN3JSC9ExecState22numberConstructorTableEPS0_
+__ZN3JSC9ExecState22regExpConstructorTableEPS0_
+__ZN3JSC9ExecState9mathTableEPS0_
+__ZN3JSC9ExecState9jsonTableEPS0_
+__ZN3JSC7JSProxy19getOwnPropertyNamesEPNS_8JSObjectEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
+__ZN3JSC9Arguments24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC9Arguments17defineOwnPropertyEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorEb
+__ZN3WTF7HashMapIyN3JSC16SparseArrayEntryENS_7IntHashIyEENS_29UnsignedWithZeroKeyHashTraitsIyEENS_10HashTraitsIS2_EEE4findERKy
+__ZN3JSCL28arrayProtoFuncToLocaleStringEPNS_9ExecStateE
+__ZN3WTF6VectorIjLm0ENS_20UnsafeVectorOverflowEE14expandCapacityEm
+__ZN3JSC21throwOutOfMemoryErrorEPNS_9ExecStateE
+__ZN3JSC11createErrorEPNS_14JSGlobalObjectERKN3WTF6StringE
+__ZN3JSC22StringRecursionChecker11emptyStringEv
+__ZN3JSC7JSValue21putToPrimitiveByIndexEPNS_9ExecStateEjS0_b
+__ZN3JSC8JSObject46attemptToInterceptPutByIndexOnHoleForPrototypeEPNS_9ExecStateENS_7JSValueEjS3_b
+__ZN3JSC6ParserINS_5LexerIhEEE29updateErrorWithNameAndMessageEPKcN3WTF6StringES5_
+__ZN3WTF13tryMakeStringIPKcS2_NS_6StringES2_S2_EENS_10PassRefPtrINS_10StringImplEEET_T0_T1_T2_T3_
+__ZN3JSC9Arguments33createStrictModeCalleeIfNecessaryEPNS_9ExecStateE
+__ZN3JSC18PropertyDescriptor21setAccessorDescriptorEPNS_12GetterSetterEj
+__ZN3JSC24globalFuncThrowTypeErrorEPNS_9ExecStateE
+__ZN3JSC9Arguments33createStrictModeCallerIfNecessaryEPNS_9ExecStateE
+__ZN3JSC37createErrorForInvalidGlobalAssignmentEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC15DeleteValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC18imulThunkGeneratorEPNS_2VME
+__ZN3JSCL34objectConstructorPreventExtensionsEPNS_9ExecStateE
+__ZN3JSC14MacroAssembler4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS_12X86Registers10RegisterIDE
+_operationArrayPop
+_operationArrayPopAndRecoverLength
+__ZN3JSC8JSObject34attemptToInterceptPutByIndexOnHoleEPNS_9ExecStateEjNS_7JSValueEb
+__ZN3JSC3DFG12slowPathCallINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEiS9_SD_EEN3WTF10PassOwnPtrINS0_17SlowPathGeneratorEEET_PNS0_14SpeculativeJITET0_T1_T2_T3_T4_NS0_18SpillRegistersModeE
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEiS9_SD_E16generateInternalEPNS0_14SpeculativeJITE
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEiS9_SD_EC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_iS9_SD_
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEiS9_SD_ED0Ev
+__ZN3JSC3DFG44CallResultAndThreeArgumentsSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEiS9_SD_ED1Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEEC2ES5_PNS0_14SpeculativeJITESB_NS0_18SpillRegistersModeESD_
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEED0Ev
+__ZN3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEED1Ev
+__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFxPNS_9ExecStateEiPNS_15InlineCallFrameEiENS_12X86Registers10RegisterIDEiS5_S9_
+_lookupExceptionHandlerInStub
+__ZN3JSC3DFG14SpeculativeJIT32compileGetByValOnFloatTypedArrayERKNS_20TypedArrayDescriptorEPNS0_4NodeEm
+__ZN3JSC3DFG14SpeculativeJIT33compilePutByValForFloatTypedArrayERKNS_20TypedArrayDescriptorENS_12X86Registers10RegisterIDES6_PNS0_4NodeEm
+_operationGetInlinedArgumentByVal
+__ZN3JSC13EvalCodeBlock12jettisonImplEv
+__ZN3JSC14EvalExecutable21jettisonOptimizedCodeERNS_2VME
+_operationToStringOnCell
+_operationNewStringObject
+__ZN3JSC3DFG14SpeculativeJIT33speculateStringObjectForStructureINS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressEEEvNS0_4EdgeET_
+__ZN3JSCL25objectConstructorIsFrozenEPNS_9ExecStateE
+__ZN3JSC29callHostFunctionAsConstructorEPNS_9ExecStateE
+__ZN3JSC15JSBoundFunction17customHasInstanceEPNS_8JSObjectEPNS_9ExecStateENS_7JSValueE
+__ZN3JSCL22regExpConstructorInputEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSC10MathObject24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSC18RegExpMatchesArray24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSCL17mathProtoFuncIMulEPNS_9ExecStateE
+__ZN3JSC3DFG14SpeculativeJIT16compileArithIMulEPNS0_4NodeE
+__ZN3WTF17double_conversion6Bignum6SquareEv
+__ZNK3JSC5LexerIhE23invalidCharacterMessageEv
+__ZN3JSC22NativeErrorConstructor11getCallDataEPNS_6JSCellERNS_8CallDataE
+__ZN3JSCL26callNativeErrorConstructorEPNS_9ExecStateE
+__ZN3JSC17BytecodeGenerator35emitThrowExpressionTooDeepExceptionEv
+__ZN3JSC22createOutOfMemoryErrorEPNS_14JSGlobalObjectE
+__ZN3JSCL17mathProtoFuncACosEPNS_9ExecStateE
+__ZN3JSC11JSNameScope3putEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC14symbolTablePutINS_11JSNameScopeEEEbPT_PNS_9ExecStateENS_12PropertyNameENS_7JSValueEb
+__ZN3JSCL20constructPrivateNameEPNS_9ExecStateE
+__ZN3JSCL29objectProtoFuncToLocaleStringEPNS_9ExecStateE
+__ZN3JSC13JSNotAnObject24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZN3JSCL20isNonLatin1IdentPartEi
+__ZN3JSC5LexerIhE23parseIdentifierSlowCaseILb0EEENS_11JSTokenTypeEPNS_11JSTokenDataEjb
+__ZN3JSCL21objectConstructorSealEPNS_9ExecStateE
+__ZN3JSCL25objectConstructorIsSealedEPNS_9ExecStateE
+__ZN3JSC9Structure8isSealedERNS_2VME
+__ZN3JSCL29objectConstructorIsExtensibleEPNS_9ExecStateE
+__ZN3JSC8JSObject4sealERNS_2VME
+__ZN3JSC9Structure14sealTransitionERNS_2VMEPS0_
+__ZN3JSC9Arguments14deletePropertyEPNS_6JSCellEPNS_9ExecStateENS_12PropertyNameE
+__ZN3JSC12StringObject21deletePropertyByIndexEPNS_6JSCellEPNS_9ExecStateEj
+__ZN3JSC6JSCell10putByIndexEPS0_PNS_9ExecStateEjNS_7JSValueEb
+__ZN3JSC10ASTBuilder28createGetterOrSetterPropertyILb0EEEPNS_12PropertyNodeEPNS_2VMERKNS_15JSTokenLocationENS2_4TypeEdPNS_13ParameterNodeEPNS_16FunctionBodyNodeEjjiij
+__ZN3JSC10ASTBuilder28createGetterOrSetterPropertyILb1EEEPNS_12PropertyNodeEPNS_2VMERKNS_15JSTokenLocationENS2_4TypeEdPNS_13ParameterNodeEPNS_16FunctionBodyNodeEjjiij
+__ZN3JSC8putEntryINS_17RegExpConstructorEEEvPNS_9ExecStateEPKNS_9HashEntryENS_12PropertyNameENS_7JSValueEPT_b
+__ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL24regExpConstructorDollar9EPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL25setRegExpConstructorInputEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSC18RegExpCachedResult8setInputEPNS_9ExecStateEPNS_8JSObjectEPNS_8JSStringE
+__ZN3JSCL26regExpConstructorLastParenEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL26regExpConstructorMultilineEPNS_9ExecStateENS_7JSValueENS_12PropertyNameE
+__ZN3JSCL29setRegExpConstructorMultilineEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSC4Yarr11YarrPattern23nondigitsCharacterClassEv
+__ZN3JSC4Yarr15nondigitsCreateEv
+__ZN3JSC5LLInt24interpreterThrowInCallerEPNS_9ExecStateENS_16ReturnAddressPtrE
+__ZNK3JSC15InlineCallFrame17baselineCodeBlockEv
+__ZN3JSC8putEntryINS_17NumberConstructorEEEvPNS_9ExecStateEPKNS_9HashEntryENS_12PropertyNameENS_7JSValueEPT_b
+__ZN3JSCL21stringProtoFuncAnchorEPNS_9ExecStateE
+__ZN3JSC22jsMakeNontrivialStringIPKcN3WTF6StringES2_S4_S2_EENS_7JSValueEPNS_9ExecStateET_T0_T1_T2_T3_
+__ZN3WTF13tryMakeStringIPKcNS_6StringES2_S3_S2_EENS_10PassRefPtrINS_10StringImplEEET_T0_T1_T2_T3_
+__ZN3JSCL24stringProtoFuncFontcolorEPNS_9ExecStateE
+__ZN3JSCL23stringProtoFuncFontsizeEPNS_9ExecStateE
+__ZN3JSCL19stringProtoFuncLinkEPNS_9ExecStateE
+__ZN3JSCL23stringProtoFuncTrimLeftEPNS_9ExecStateE
+__ZN3JSC8putEntryINS_12RegExpObjectEEEvPNS_9ExecStateEPKNS_9HashEntryENS_12PropertyNameENS_7JSValueEPT_b
+__ZN3WTF6VectorIN3JSC10LabelScopeELm8ENS_15CrashOnOverflowEEaSERKS4_
+__ZN3JSC8JSObject24deallocateSparseIndexMapEv
+__ZN3JSC12StringObject10putByIndexEPNS_6JSCellEPNS_9ExecStateEjNS_7JSValueEb
+__ZN3JSC8JSObject22createInitialUndecidedERNS_2VMEj
+__ZN3JSCL19compareKeysForQSortEPKvS1_
+__ZN3JSC3DFG10FixupPhase23truncateConstantToInt32ERNS0_4EdgeE
+__ZN3JSC3DFG10FixupPhase19convertStringAddUseILNS0_7UseKindE13EEEvPNS0_4NodeERNS0_4EdgeE
+__ZN3WTF6VectorIPN3JSC8JSStringELm32ENS_20UnsafeVectorOverflowEE15reserveCapacityEm
+__ZN3JSC14LegacyProfiler8profilerEv
+__ZN3JSC14LegacyProfiler14startProfilingEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC16ProfileGenerator6createEPNS_9ExecStateERKN3WTF6StringEj
+__ZN3JSC16ProfileGeneratorC2EPNS_9ExecStateERKN3WTF6StringEj
+__ZN3JSC7Profile6createERKN3WTF6StringEj
+__ZN3JSC7ProfileC2ERKN3WTF6StringEj
+__ZN3JSC11ProfileNodeC1EPNS_9ExecStateERKNS_14CallIdentifierEPS0_S6_
+__ZN3JSC16ProfileGenerator24addParentForConsoleStartEPNS_9ExecStateE
+__ZN3JSC14LegacyProfiler20createCallIdentifierEPNS_9ExecStateENS_7JSValueERKN3WTF6StringEi
+__ZN3JSC11ProfileNode10insertNodeEN3WTF10PassRefPtrIS0_EE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC11ProfileNodeEEELm0ENS_15CrashOnOverflowEE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC11ProfileNodeEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC16ProfileGeneratorEEELm0ENS_15CrashOnOverflowEE14expandCapacityEm
+__ZN3JSC14LegacyProfiler10didExecuteEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC16ProfileGenerator10didExecuteEPNS_9ExecStateERKNS_14CallIdentifierE
+__ZN3JSC11ProfileNode10didExecuteEv
+__ZN3JSC14LegacyProfiler11willExecuteEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC16ProfileGenerator11willExecuteEPNS_9ExecStateERKNS_14CallIdentifierE
+__ZN3JSC11ProfileNode11willExecuteEPNS_9ExecStateERKNS_14CallIdentifierE
+__ZN3JSC14LegacyProfiler13stopProfilingEPNS_9ExecStateERKN3WTF6StringE
+__ZN3JSC16ProfileGenerator13stopProfilingEv
+__ZN3JSC7Profile7forEachEMNS_11ProfileNodeEFvvE
+__ZNK3JSC11ProfileNode25traverseNextNodePostOrderEv
+__ZN3JSC11ProfileNode13stopProfilingEv
+__ZN3JSC11ProfileNode11removeChildEPS0_
+__ZN3JSC11ProfileNodeD1Ev
+__ZN3JSC11ProfileNode8addChildEN3WTF10PassRefPtrIS0_EE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC16ProfileGeneratorEEELm0ENS_15CrashOnOverflowEE6removeEm
+__ZN3JSC14LegacyProfiler11willExecuteEPNS_9ExecStateERKN3WTF6StringEi
+__ZN3JSC14LegacyProfiler10didExecuteEPNS_9ExecStateERKN3WTF6StringEi
+__ZN3JSC7ProfileD0Ev
+__ZNK3JSC16ProfileGenerator5titleEv
+__ZN3JSC14LegacyProfiler13stopProfilingEPNS_14JSGlobalObjectE
+__ZN3JSC4Yarr11InterpreterItE22parenthesesDoBacktrackERNS0_8ByteTermEPNS2_24BackTrackInfoParenthesesE
+__ZN3WTF8CollatorC1EPKc
+__ZN3WTF8Collator18setOrderLowerFirstEb
+__ZN3JSC10JSONObject24getOwnPropertyDescriptorEPNS_8JSObjectEPNS_9ExecStateENS_12PropertyNameERNS_18PropertyDescriptorE
+__ZNK3WTF6String11toIntStrictEPbi
+__ZN3WTF10StringImpl11toIntStrictEPbi
+_JSStringGetLength
+__ZN3JSC5LexerItE23parseIdentifierSlowCaseILb1EEENS_11JSTokenTypeEPNS_11JSTokenDataEjb
+__ZN3WTF6VectorIN3JSC10LabelScopeELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
+__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE11getCallDataEPNS_6JSCellERNS_8CallDataE
+_operationPutDoubleByValBeyondArrayBoundsNonStrict
+_JSStringGetMaximumUTF8CStringSize
+__ZN3JSC15constructStringEPNS_9ExecStateEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3WTF17charactersToFloatEPKtmRm
+__ZN3JSC7JSArray10sortVectorILh23EEEvPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3JSC24TerminatedExecutionError12defaultValueEPKNS_8JSObjectEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3WTF5yieldEv
+__ZNK3JSC17DebuggerCallFrame4typeEv
+__ZNK3JSC17DebuggerCallFrame22calculatedFunctionNameEv
+__ZNK3JSC17DebuggerCallFrame10thisObjectEv
+__ZN3JSC2VM18createContextGroupENS_8HeapTypeE
+__ZN3JSC21deleteIdentifierTableEPNS_15IdentifierTableE
+__ZN3JSC15IdentifierTableD1Ev
+_WTFReportAssertionFailure
+_llint_entry_osr
+_llint_entry_osr_function_for_call
+_llint_entry_osr_function_for_construct
+_llint_entry_osr_function_for_call_arityCheck
+_llint_entry_osr_function_for_construct_arityCheck
+_llint_loop_osr
+_llint_replace
+_llint_stack_check
+_llint_slow_path_call_arityCheck
+_llint_slow_path_construct_arityCheck
+_llint_slow_path_create_activation
+_llint_slow_path_create_arguments
+_llint_slow_path_create_this
+_llint_slow_path_convert_this
+_llint_slow_path_new_object
+_llint_slow_path_new_array
+_llint_slow_path_new_array_with_size
+_llint_slow_path_new_array_buffer
+_llint_slow_path_new_regexp
+_llint_slow_path_not
+_llint_slow_path_eq
+_llint_slow_path_neq
+_llint_slow_path_stricteq
+_llint_slow_path_nstricteq
+_llint_slow_path_less
+_llint_slow_path_lesseq
+_llint_slow_path_greater
+_llint_slow_path_greatereq
+_llint_slow_path_pre_inc
+_llint_slow_path_pre_dec
+_llint_slow_path_to_number
+_llint_slow_path_negate
+_llint_slow_path_add
+_llint_slow_path_mul
+_llint_slow_path_sub
+_llint_slow_path_div
+_llint_slow_path_mod
+_llint_slow_path_lshift
+_llint_slow_path_rshift
+_llint_slow_path_urshift
+_llint_slow_path_bitand
+_llint_slow_path_bitor
+_llint_slow_path_bitxor
+_llint_slow_path_check_has_instance
+_llint_slow_path_instanceof
+_llint_slow_path_typeof
+_llint_slow_path_is_object_or_null
+_llint_slow_path_is_function
+_llint_slow_path_in
+_llint_slow_path_resolve
+_llint_slow_path_put_to_base
+_llint_slow_path_resolve_base
+_llint_slow_path_resolve_with_base
+_llint_slow_path_resolve_with_this
+_llint_slow_path_init_global_const_check
+_llint_slow_path_get_by_id
+_llint_slow_path_get_arguments_length
+_llint_slow_path_put_by_id
+_llint_slow_path_del_by_id
+_llint_slow_path_get_by_val
+_llint_slow_path_get_argument_by_val
+_llint_slow_path_put_by_val
+_llint_slow_path_del_by_val
+_llint_slow_path_put_by_index
+_llint_slow_path_put_getter_setter
+_llint_slow_path_jtrue
+_llint_slow_path_jfalse
+_llint_slow_path_jless
+_llint_slow_path_jnless
+_llint_slow_path_jgreater
+_llint_slow_path_jngreater
+_llint_slow_path_jlesseq
+_llint_slow_path_jnlesseq
+_llint_slow_path_jgreatereq
+_llint_slow_path_jngreatereq
+_llint_slow_path_switch_imm
+_llint_slow_path_switch_char
+_llint_slow_path_switch_string
+_llint_slow_path_new_func
+_llint_slow_path_new_func_exp
+_llint_slow_path_call
+_llint_slow_path_construct
+_llint_slow_path_call_varargs
+_llint_slow_path_call_eval
+_llint_slow_path_tear_off_activation
+_llint_slow_path_tear_off_arguments
+_llint_slow_path_strcat
+_llint_slow_path_to_primitive
+_llint_slow_path_push_with_scope
+_llint_slow_path_pop_scope
+_llint_slow_path_push_name_scope
+_llint_slow_path_throw
+_llint_slow_path_throw_static_error
+_llint_slow_path_handle_watchdog_timer
+_llint_slow_path_debug
+_llint_slow_path_profile_will_call
+_llint_slow_path_profile_did_call
+_llint_begin
+_llint_program_prologue
+_llint_eval_prologue
+_llint_function_for_call_prologue
+_llint_function_for_construct_prologue
+_llint_function_for_call_arity_check
+_llint_function_for_construct_arity_check
+_llint_op_enter
+_llint_op_create_activation
+_llint_op_init_lazy_reg
+_llint_op_create_arguments
+_llint_op_create_this
+_llint_op_get_callee
+_llint_op_convert_this
+_llint_op_new_object
+_llint_op_mov
+_llint_op_not
+_llint_op_eq
+_llint_op_eq_null
+_llint_op_neq
+_llint_op_neq_null
+_llint_op_stricteq
+_llint_op_nstricteq
+_llint_op_inc
+_llint_op_dec
+_llint_op_to_number
+_llint_op_negate
+_llint_op_add
+_llint_op_mul
+_llint_op_sub
+_llint_op_div
+_llint_op_lshift
+_llint_op_rshift
+_llint_op_urshift
+_llint_op_bitand
+_llint_op_bitxor
+_llint_op_bitor
+_llint_op_check_has_instance
+_llint_op_instanceof
+_llint_op_is_undefined
+_llint_op_is_boolean
+_llint_op_is_number
+_llint_op_is_string
+_llint_op_init_global_const
+_llint_op_init_global_const_check
+_llint_op_get_by_id
+_llint_op_get_by_id_out_of_line
+_llint_op_get_array_length
+_llint_op_get_arguments_length
+_llint_op_put_by_id
+_llint_op_put_by_id_out_of_line
+_llint_op_put_by_id_transition_direct
+_llint_op_put_by_id_transition_direct_out_of_line
+_llint_op_put_by_id_transition_normal
+_llint_op_put_by_id_transition_normal_out_of_line
+_llint_op_get_by_val
+_llint_op_get_argument_by_val
+_llint_op_put_by_val
+_llint_op_jmp
+_llint_op_jeq_null
+_llint_op_jneq_null
+_llint_op_jneq_ptr
+_llint_op_switch_imm
+_llint_op_switch_char
+_llint_op_new_func
+_llint_op_tear_off_activation
+_llint_op_tear_off_arguments
+_llint_op_ret
+_llint_op_call_put_result
+_llint_op_ret_object_or_this
+_llint_op_to_primitive
+_llint_op_catch
+_llint_op_get_scoped_var
+_llint_op_put_scoped_var
+_llint_op_end
+_llint_throw_from_slow_path_trampoline
+_llint_throw_during_call_trampoline
+_llint_op_new_array
+_llint_op_new_array_with_size
+_llint_op_new_array_buffer
+_llint_op_new_regexp
+_llint_op_less
+_llint_op_lesseq
+_llint_op_greater
+_llint_op_greatereq
+_llint_op_mod
+_llint_op_typeof
+_llint_op_is_object_or_null
+_llint_op_is_function
+_llint_op_in
+_llint_op_put_to_base_variable
+_llint_op_put_to_base
+_llint_op_resolve_global_property
+_llint_op_resolve_global_var
+_llint_op_resolve_scoped_var
+_llint_op_resolve_scoped_var_on_top_scope
+_llint_op_resolve_scoped_var_with_top_scope_check
+_llint_op_resolve
+_llint_op_resolve_base_to_global
+_llint_op_resolve_base_to_global_dynamic
+_llint_op_resolve_base_to_scope
+_llint_op_resolve_base_to_scope_with_top_scope_check
+_llint_op_resolve_base
+_llint_op_resolve_with_base
+_llint_op_resolve_with_this
+_llint_op_del_by_id
+_llint_op_del_by_val
+_llint_op_put_by_index
+_llint_op_put_getter_setter
+_llint_op_jtrue
+_llint_op_jfalse
+_llint_op_jless
+_llint_op_jnless
+_llint_op_jgreater
+_llint_op_jngreater
+_llint_op_jlesseq
+_llint_op_jnlesseq
+_llint_op_jgreatereq
+_llint_op_jngreatereq
+_llint_op_loop_hint
+_llint_op_switch_string
+_llint_op_new_func_exp
+_llint_op_call
+_llint_op_construct
+_llint_op_call_varargs
+_llint_op_call_eval
+_llint_generic_return_point
+_llint_op_strcat
+_llint_op_push_with_scope
+_llint_op_pop_scope
+_llint_op_push_name_scope
+_llint_op_throw
+_llint_op_throw_static_error
+_llint_op_profile_will_call
+_llint_op_profile_did_call
+_llint_op_debug
+_llint_native_call_trampoline
+_llint_native_construct_trampoline
+_llint_op_get_by_id_chain
+_llint_op_get_by_id_custom_chain
+_llint_op_get_by_id_custom_proto
+_llint_op_get_by_id_custom_self
+_llint_op_get_by_id_generic
+_llint_op_get_by_id_getter_chain
+_llint_op_get_by_id_getter_proto
+_llint_op_get_by_id_getter_self
+_llint_op_get_by_id_proto
+_llint_op_get_by_id_self
+_llint_op_get_string_length
+_llint_op_put_by_id_generi
+_llint_op_put_by_id_replace
+_llint_op_put_by_id_transition
+_llint_op_init_global_const_nop
+_llint_end
diff --git a/JavaScriptCore.vcxproj/JavaScriptCore.proj b/JavaScriptCore.vcxproj/JavaScriptCore.proj
new file mode 100644
index 0000000..4dfba4e
--- /dev/null
+++ b/JavaScriptCore.vcxproj/JavaScriptCore.proj
@@ -0,0 +1,130 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project InitialTargets="PreBuild" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+
+  <!-- normalize configuration case -->
+  <PropertyGroup Condition="'$(CONFIGURATION)'=='Release'">
+	<CONFIG>Release</CONFIG>
+    <DebugSuffix></DebugSuffix>
+    <DebugSuffixDefinition></DebugSuffixDefinition>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(CONFIGURATION)'=='Debug'">
+	<CONFIG>Debug</CONFIG>
+    <DebugSuffix>_debug</DebugSuffix>
+    <DebugSuffixDefinition>-DDEBUG_SUFFIX=_debug</DebugSuffixDefinition>
+  </PropertyGroup>
+
+  <!-- Wrapper to build JavaScriptCore for both win32 and x64. -->
+  <PropertyGroup>
+    <OFFICIAL_BUILD>1</OFFICIAL_BUILD>
+    <WebKit_Libraries>$(SRCROOT)\AppleInternal</WebKit_Libraries>
+    <AppleInternal>$(DSTROOT)\AppleInternal</AppleInternal>
+    <AppleInternalLib32>$(AppleInternal)\lib32</AppleInternalLib32>
+    <AppleInternalLib64>$(AppleInternal)\lib64</AppleInternalLib64>
+    <AppleInternalBin32>$(AppleInternal)\bin32</AppleInternalBin32>
+    <AppleInternalBin64>$(AppleInternal)\bin64</AppleInternalBin64>
+    <AppleInternal32Symbols>$(AppleInternal)\public32\sym</AppleInternal32Symbols>
+    <AppleInternal64Symbols>$(AppleInternal)\public64\sym</AppleInternal64Symbols>
+    <ProgramFilesAAS32>Program Files (x86)\Common Files\Apple\Apple Application Support</ProgramFilesAAS32>
+    <ProgramFilesAAS64>Program Files\Common Files\Apple\Apple Application Support</ProgramFilesAAS64>
+    <ConfigurationBuildDir>$(OBJROOT)\$(CONFIG)</ConfigurationBuildDir>  
+    <OutputDirectory>$(DSTROOT)</OutputDirectory>
+	<CMakeCommandCommon>cmake $(SRCROOT) -DPORT=AppleWin $(DebugSuffixDefinition) -DWEBKIT_LIBRARIES_DIR=$(WebKit_Libraries.Replace('\','/')) -DCMAKE_MODULE_PATH=$(SRCROOT.Replace('\','/'))/AppleInternal/tools/cmake -DCMAKE_BINARY_DIR=$(OBJROOT.Replace('\','/'))/$(CONFIG) -DCMAKE_BUILD_TYPE=$(CONFIGURATION) -DJAVASCRIPTCORE_DIR=$(SRCROOT.Replace('\','/'))</CMakeCommandCommon>
+  </PropertyGroup>
+ 
+  <!-- Prepare for build -->
+  <Target Name="PreBuild" BeforeTargets="Build">
+    <Error Text="DSTROOT property or environment variable must be defined." Condition="'$(DSTROOT)' == ''" />
+    <Error Text="OBJROOT property or environment variable must be defined." Condition="'$(OBJROOT)' == ''" />
+    <Error Text="Use /p:Configuration=Debug or /p:Configuration=Release" Condition="'$(CONFIG)' == ''" />
+    <Message Text="Copying necessary headers to $(ConfigurationBuildDir)" />
+    <MakeDir Directories="$(DSTROOT);$(OBJROOT);$(OBJROOT)/$(CONFIG);$(ConfigurationBuildDir)\include\private;$(OBJROOT)/$(CONFIG)/build32;$(OBJROOT)/$(CONFIG)/build64" />
+ 
+    <CreateItem Include="$(WebKit_Libraries)\include\private\**\*.*">
+      <Output TaskParameter="Include" ItemName="PrivateIncFiles" />
+    </CreateItem>
+
+    <Copy SourceFiles="@(PrivateIncFiles)" DestinationFiles="@(PrivateIncFiles->'$(ConfigurationBuildDir)\include\private\%(RecursiveDir)%(Filename)%(Extension)')" />
+    <Message Text="Build output -> $(OBJROOT)" />
+    <Message Text="Final output -> $(DSTROOT)" />
+    <MakeDir Directories="$(AppleInternalLib32);$(AppleInternalLib64);$(AppleInternalBin32);$(AppleInternalBin64);$(AppleInternal32Symbols);$(AppleInternal64Symbols);$(AppleInternal)\include;$(DSTROOT)\$(ProgramFilesAAS32);$(DSTROOT)\$(ProgramFilesAAS64)" />
+    <MakeDir Directories="$(DSTROOT)\$(ProgramFilesAAS32)\JavaScriptCore.resources;$(DSTROOT)\$(ProgramFilesAAS64)\JavaScriptCore.resources" />
+  </Target>
+
+  <!-- Build JavaScriptCore Software -->
+  <Target Name="Build" AfterTargets="PreBuild">
+    <Message Text="Building $(CONFIGURATION) Solution" />
+    <Error Text="DSTROOT property or environment variable must be defined." Condition="'$(DSTROOT)' == ''" />
+	<Exec Command="$(CMakeCommandCommon) -DWTF_CPU_X86=1 -G &quot;Visual Studio 14 2015&quot;" WorkingDirectory="$(OBJROOT)/$(CONFIG)/build32"/>
+	<Exec Command="msbuild Project.sln /p:Configuration=$(CONFIG)" WorkingDirectory="$(OBJROOT)/$(CONFIG)/build32"/>
+	<Exec Command="$(CMakeCommandCommon) -DWTF_CPU_X86_64=1 -G &quot;Visual Studio 14 2015 Win64&quot;" WorkingDirectory="$(OBJROOT)/$(CONFIG)/build64"/>
+	<Exec Command="msbuild Project.sln /p:Configuration=$(CONFIG)" WorkingDirectory="$(OBJROOT)/$(CONFIG)/build64"/>
+  </Target>
+
+  <Target Name="PostBuild" AfterTargets="Build">
+    <Error Text="DSTROOT property or environment variable must be defined." Condition="'$(DSTROOT)' == ''" />
+    <Message Text="Moving $(CONFIG) build results to $(DSTROOT)" />
+
+    <!-- Identify the files to copy over -->
+    <CreateItem Include="$(ConfigurationBuildDir)\build32\DerivedSources\ForwardingHeaders\JavaScriptCore\**\*.*">
+      <Output TaskParameter="Include" ItemName="IncFiles" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build32\DerivedSources\JavaScriptCore\inspector\**\*.*">
+      <Output TaskParameter="Include" ItemName="InspectorFiles" />
+    </CreateItem>
+    <CreateItem Include="$(SRCROOT)\API\*.h">
+      <Output TaskParameter="Include" ItemName="APIFiles" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build32\bin32\*">
+      <Output TaskParameter="Include" ItemName="Bin32Files" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build64\bin64\*">
+      <Output TaskParameter="Include" ItemName="Bin64Files" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build32\bin32\JavaScriptCore$(DebugSuffix).pdb">
+      <Output TaskParameter="Include" ItemName="Bin32SymbolFiles" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build64\bin64\JavaScriptCore$(DebugSuffix).pdb">
+      <Output TaskParameter="Include" ItemName="Bin64SymbolFiles" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build32\bin32\JavaScriptCore$(DebugSuffix).dll">
+      <Output TaskParameter="Include" ItemName="Bin32DLLFiles" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build64\bin64\JavaScriptCore$(DebugSuffix).dll">
+      <Output TaskParameter="Include" ItemName="Bin64DLLFiles" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build32\bin32\*.resources">
+      <Output TaskParameter="Include" ItemName="Bin32ResourceFolders" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build64\bin64\*.resources">
+      <Output TaskParameter="Include" ItemName="Bin64ResourceFolders" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build32\bin32\JavaScriptCore.resources\**\*.*">
+      <Output TaskParameter="Include" ItemName="Bin32Resources" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build64\bin64\JavaScriptCore.resources\**\*.*">
+      <Output TaskParameter="Include" ItemName="Bin64Resources" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build32\lib32\*">
+      <Output TaskParameter="Include" ItemName="Lib32Files" />
+    </CreateItem>
+    <CreateItem Include="$(ConfigurationBuildDir)\build64\lib64\*">
+      <Output TaskParameter="Include" ItemName="Lib64Files" />
+    </CreateItem>
+
+    <Copy SourceFiles="@(IncFiles)" DestinationFiles="@(IncFiles->'$(DSTROOT)\AppleInternal\include\private\JavaScriptCore\%(RecursiveDir)%(Filename)%(Extension)')" />
+    <Copy SourceFiles="@(InspectorFiles)" DestinationFiles="@(InspectorFiles->'$(DSTROOT)\AppleInternal\include\private\JavaScriptCore\inspector\%(RecursiveDir)%(Filename)%(Extension)')" />
+    <Copy SourceFiles="@(APIFiles)" DestinationFiles="@(APIFiles->'$(DSTROOT)\AppleInternal\include\JavaScriptCore\%(Filename)%(Extension)')" />
+    <Copy SourceFiles="@(Lib32Files)" DestinationFolder="$(AppleInternalLib32)" />
+    <Copy SourceFiles="@(Lib64Files)" DestinationFolder="$(AppleInternalLib64)" />
+    <Copy SourceFiles="@(Bin32DLLFiles)" DestinationFolder="$(DSTROOT)\$(ProgramFilesAAS32)" />
+    <Copy SourceFiles="@(Bin32ResourceFolders)" DestinationFolder="$(DSTROOT)\$(ProgramFilesAAS32)" />
+    <Copy SourceFiles="@(Bin32SymbolFiles)" DestinationFolder="$(DSTROOT)\$(ProgramFilesAAS32)" />
+    <Copy SourceFiles="@(Bin32Resources)" DestinationFiles="@(Bin32Resources->'$(DSTROOT)\$(ProgramFilesAAS32)\JavaScriptCore.resources\%(RecursiveDir)%(Filename)%(Extension)')" />
+    <Copy SourceFiles="@(Bin64DLLFiles)" DestinationFolder="$(DSTROOT)\$(ProgramFilesAAS64)" />
+    <Copy SourceFiles="@(Bin64ResourceFolders)" DestinationFolder="$(DSTROOT)\$(ProgramFilesAAS64)" />
+    <Copy SourceFiles="@(Bin64SymbolFiles)" DestinationFolder="$(DSTROOT)\$(ProgramFilesAAS64)" />
+    <Copy SourceFiles="@(Bin64Resources)" DestinationFiles="@(Bin64Resources->'$(DSTROOT)\$(ProgramFilesAAS64)\JavaScriptCore.resources\%(RecursiveDir)%(Filename)%(Extension)')" />
+  </Target>
+
+</Project>
+
diff --git a/JavaScriptCore.vcxproj/JavaScriptCore.resources/Info.plist b/JavaScriptCore.vcxproj/JavaScriptCore.resources/Info.plist
new file mode 100644
index 0000000..5d0ef3e
--- /dev/null
+++ b/JavaScriptCore.vcxproj/JavaScriptCore.resources/Info.plist
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleExecutable</key>
+	<string>JavaScriptCore</string>
+	<key>CFBundleGetInfoString</key>
+	<string>530, Copyright 2003-2014 Apple Inc.</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.apple.JavaScriptCore</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>JavaScriptCore</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>530</string>
+	<key>CFBundleVersion</key>
+	<string>530</string>
+</dict>
+</plist>
diff --git a/JavaScriptCore.vcxproj/resource.h b/JavaScriptCore.vcxproj/resource.h
new file mode 100644
index 0000000..e52790d
--- /dev/null
+++ b/JavaScriptCore.vcxproj/resource.h
@@ -0,0 +1,14 @@
+//{{NO_DEPENDENCIES}}
+// Microsoft Visual C++ generated include file.
+// Used by JavaScriptCore.rc
+
+// Next default values for new objects
+// 
+#ifdef APSTUDIO_INVOKED
+#ifndef APSTUDIO_READONLY_SYMBOLS
+#define _APS_NEXT_RESOURCE_VALUE        101
+#define _APS_NEXT_COMMAND_VALUE         40001
+#define _APS_NEXT_CONTROL_VALUE         1001
+#define _APS_NEXT_SYMED_VALUE           101
+#endif
+#endif
diff --git a/JavaScriptCore.xcodeproj/project.pbxproj b/JavaScriptCore.xcodeproj/project.pbxproj
new file mode 100644
index 0000000..3344528
--- /dev/null
+++ b/JavaScriptCore.xcodeproj/project.pbxproj
@@ -0,0 +1,11265 @@
+// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 46;
+	objects = {
+
+/* Begin PBXAggregateTarget section */
+		0F4680A914BA7FD900BFE272 /* LLInt Offsets */ = {
+			isa = PBXAggregateTarget;
+			buildConfigurationList = 0F4680AC14BA7FD900BFE272 /* Build configuration list for PBXAggregateTarget "LLInt Offsets" */;
+			buildPhases = (
+				0F4680AA14BA7FD900BFE272 /* Generate Derived Sources */,
+			);
+			dependencies = (
+				65442D5018EBB744007AF92F /* PBXTargetDependency */,
+			);
+			name = "LLInt Offsets";
+			productName = "Derived Sources";
+		};
+		5D6B2A47152B9E17005231DE /* Test Tools */ = {
+			isa = PBXAggregateTarget;
+			buildConfigurationList = 5D6B2A4C152B9E17005231DE /* Build configuration list for PBXAggregateTarget "Test Tools" */;
+			buildPhases = (
+			);
+			dependencies = (
+				0F6183471C45F67A0072450B /* PBXTargetDependency */,
+				0F93275D1C20BF3A00CF6564 /* PBXTargetDependency */,
+				0FEC85B11BDB5D8F0080FF74 /* PBXTargetDependency */,
+				5D6B2A4F152B9E23005231DE /* PBXTargetDependency */,
+				5D6B2A51152B9E23005231DE /* PBXTargetDependency */,
+				5D6B2A55152B9E23005231DE /* PBXTargetDependency */,
+			);
+			name = "Test Tools";
+			productName = "Test Tools";
+		};
+		65788A9D18B409EB00C189FF /* Offline Assembler */ = {
+			isa = PBXAggregateTarget;
+			buildConfigurationList = 65788AA218B409EB00C189FF /* Build configuration list for PBXAggregateTarget "Offline Assembler" */;
+			buildPhases = (
+				65788AA018B409EB00C189FF /* Offline Assemble */,
+			);
+			dependencies = (
+				65244BD318ECB5000010B708 /* PBXTargetDependency */,
+				65788A9E18B409EB00C189FF /* PBXTargetDependency */,
+			);
+			name = "Offline Assembler";
+			productName = "Offline Assembler";
+		};
+		65FB3F6609D11E9100F49DEB /* Derived Sources */ = {
+			isa = PBXAggregateTarget;
+			buildConfigurationList = 65FB3F7709D11EBD00F49DEB /* Build configuration list for PBXAggregateTarget "Derived Sources" */;
+			buildPhases = (
+				65FB3F6509D11E9100F49DEB /* Generate Derived Sources */,
+			);
+			dependencies = (
+			);
+			name = "Derived Sources";
+			productName = "Derived Sources";
+		};
+		932F5BE30822A1C700736975 /* All */ = {
+			isa = PBXAggregateTarget;
+			buildConfigurationList = 149C276C08902AFE008A9EFC /* Build configuration list for PBXAggregateTarget "All" */;
+			buildPhases = (
+				5DF7E1CC188E6B87003F9A46 /* Copy jsc into JavaScriptCore.framework */,
+			);
+			dependencies = (
+				932F5BE70822A1C700736975 /* PBXTargetDependency */,
+				5D69E912152BE5470028D720 /* PBXTargetDependency */,
+				5D6B2A57152B9E2E005231DE /* PBXTargetDependency */,
+			);
+			name = All;
+			productName = All;
+		};
+/* End PBXAggregateTarget section */
+
+/* Begin PBXBuildFile section */
+		0F0123321944EA1B00843A0C /* DFGValueStrength.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0123301944EA1B00843A0C /* DFGValueStrength.cpp */; };
+		0F0123331944EA1B00843A0C /* DFGValueStrength.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0123311944EA1B00843A0C /* DFGValueStrength.h */; };
+		0F0332C018ADFAE1005F979A /* ExitingJITType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0332BF18ADFAE1005F979A /* ExitingJITType.cpp */; };
+		0F0332C318B01763005F979A /* GetByIdVariant.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0332C118B01763005F979A /* GetByIdVariant.cpp */; };
+		0F0332C418B01763005F979A /* GetByIdVariant.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0332C218B01763005F979A /* GetByIdVariant.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0332C618B53FA9005F979A /* FTLWeight.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0332C518B53FA9005F979A /* FTLWeight.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0332C818B546EC005F979A /* FTLWeightedTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0332C718B546EC005F979A /* FTLWeightedTarget.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F04396D1B03DC0B009598B7 /* DFGCombinedLiveness.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F04396B1B03DC0B009598B7 /* DFGCombinedLiveness.cpp */; };
+		0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */; };
+		0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */; };
+		0F070A471D543A8B006E7232 /* CellContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F070A421D543A89006E7232 /* CellContainer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F070A481D543A90006E7232 /* CellContainerInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F070A431D543A89006E7232 /* CellContainerInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F070A491D543A93006E7232 /* HeapCellInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F070A441D543A89006E7232 /* HeapCellInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F070A4A1D543A95006E7232 /* LargeAllocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F070A451D543A89006E7232 /* LargeAllocation.cpp */; };
+		0F070A4B1D543A98006E7232 /* LargeAllocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F070A461D543A89006E7232 /* LargeAllocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 /* JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0A75221B94BFA900110660 /* InferredType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0A75201B94BFA900110660 /* InferredType.cpp */; };
+		0F0A75231B94BFA900110660 /* InferredType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0A75211B94BFA900110660 /* InferredType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */; };
+		0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B839814BCF45A00885B4F /* LLIntThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0B83A714BCF50700885B4F /* CodeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83A514BCF50400885B4F /* CodeType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83A814BCF55E00885B4F /* HandlerInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0B83B014BCF71600885B4F /* CallLinkInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */; };
+		0F0B83B114BCF71800885B4F /* CallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0CD4C215F1A6070032F1C0 /* PutDirectIndexMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F0CD4C415F6B6BB0032F1C0 /* SparseArrayValueMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */; };
+		0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F10F1A31C420BF0001C07D2 /* AirCustom.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F10F1A21C420BF0001C07D2 /* AirCustom.h */; };
+		0F12DE0F1979D5FD0006FF4E /* ExceptionFuzz.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F12DE0D1979D5FD0006FF4E /* ExceptionFuzz.cpp */; };
+		0F12DE101979D5FD0006FF4E /* ExceptionFuzz.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F12DE0E1979D5FD0006FF4E /* ExceptionFuzz.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F136D4D174AD69E0075B354 /* DeferGC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F136D4B174AD69B0075B354 /* DeferGC.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F13912916771C33009CCB07 /* ProfilerBytecodeSequence.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F13912416771C30009CCB07 /* ProfilerBytecodeSequence.cpp */; };
+		0F13912A16771C36009CCB07 /* ProfilerBytecodeSequence.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F13912516771C30009CCB07 /* ProfilerBytecodeSequence.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F13912B16771C3A009CCB07 /* ProfilerProfiledBytecodes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F13912616771C30009CCB07 /* ProfilerProfiledBytecodes.cpp */; };
+		0F13912C16771C3D009CCB07 /* ProfilerProfiledBytecodes.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F13912716771C30009CCB07 /* ProfilerProfiledBytecodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F13E04E16164A1F00DC8DE7 /* IndexingType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F13E04C16164A1B00DC8DE7 /* IndexingType.cpp */; };
+		0F15CD221BA5F9860031FFD3 /* PutByIdFlags.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F15CD201BA5F9860031FFD3 /* PutByIdFlags.cpp */; };
+		0F15CD231BA5F9860031FFD3 /* PutByIdFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15CD211BA5F9860031FFD3 /* PutByIdFlags.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F1725FF1B48719A00AC3A55 /* DFGMinifiedGraph.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F1725FE1B48719A00AC3A55 /* DFGMinifiedGraph.cpp */; };
+		0F18D3CF1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F18D3CD1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp */; };
+		0F18D3D01B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F18D3CE1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.h */; };
+		0F190CAC189D82F6000AE5F0 /* ProfilerJettisonReason.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F190CAA189D82F6000AE5F0 /* ProfilerJettisonReason.cpp */; };
+		0F190CAD189D82F6000AE5F0 /* ProfilerJettisonReason.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F190CAB189D82F6000AE5F0 /* ProfilerJettisonReason.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F1C3DDA1BBCE09E00E523E4 /* CellState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1C3DD91BBCE09E00E523E4 /* CellState.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F1DD84A18A945BE0026F3FA /* JSCInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1DD84918A945BE0026F3FA /* JSCInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F1E3A461534CBAF000F9456 /* DFGArgumentPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A431534CBAD000F9456 /* DFGArgumentPosition.h */; };
+		0F1E3A471534CBB9000F9456 /* DFGDoubleFormatState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */; };
+		0F1E3A67153A21E2000F9456 /* DFGSilentRegisterSavePlan.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A65153A21DF000F9456 /* DFGSilentRegisterSavePlan.h */; };
+		0F1FB38E1E173A6500A9BE50 /* SynchronousStopTheWorldMutatorScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F1FB38A1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.cpp */; };
+		0F1FB38F1E173A6700A9BE50 /* SynchronousStopTheWorldMutatorScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1FB38B1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.h */; };
+		0F1FB3901E173A6B00A9BE50 /* MutatorScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F1FB38C1E173A6200A9BE50 /* MutatorScheduler.cpp */; };
+		0F1FB3931E177A7200A9BE50 /* VisitingTimeout.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1FB3921E177A6F00A9BE50 /* VisitingTimeout.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F1FB3961E1AF7E100A9BE50 /* DFGPlanInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1FB3941E1AF7DF00A9BE50 /* DFGPlanInlines.h */; };
+		0F1FB3971E1AF7E300A9BE50 /* DFGWorklistInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1FB3951E1AF7DF00A9BE50 /* DFGWorklistInlines.h */; };
+		0F1FB3991E1F65FB00A9BE50 /* MutatorScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1FB3981E1F65F900A9BE50 /* MutatorScheduler.h */; };
+		0F1FE51C1922A3BC006987C5 /* AbortReason.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1FE51B1922A3BC006987C5 /* AbortReason.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F20177F1DCADC3300EA5950 /* DFGFlowIndexing.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F20177D1DCADC3000EA5950 /* DFGFlowIndexing.cpp */; };
+		0F2017801DCADC3500EA5950 /* DFGFlowIndexing.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F20177E1DCADC3000EA5950 /* DFGFlowIndexing.h */; };
+		0F2017821DCADD4200EA5950 /* DFGFlowMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2017811DCADD4000EA5950 /* DFGFlowMap.h */; };
+		0F2017851DCAE14900EA5950 /* DFGNodeFlowProjection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2017841DCAE14700EA5950 /* DFGNodeFlowProjection.h */; };
+		0F2017861DCAE14C00EA5950 /* DFGNodeFlowProjection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2017831DCAE14700EA5950 /* DFGNodeFlowProjection.cpp */; };
+		0F2017891DCB942400EA5950 /* DFGNodeAbstractValuePair.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2017881DCB942200EA5950 /* DFGNodeAbstractValuePair.h */; };
+		0F20178A1DCB942600EA5950 /* DFGNodeAbstractValuePair.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2017871DCB942200EA5950 /* DFGNodeAbstractValuePair.cpp */; };
+		0F208AD71DF0925D007D3269 /* LockDuringMarking.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F208AD61DF0925A007D3269 /* LockDuringMarking.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F20C2591A8013AB00DA3229 /* VirtualRegister.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F20C2581A8013AB00DA3229 /* VirtualRegister.cpp */; };
+		0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F235BD317178E1C00690C7F /* FTLExitArgument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BBD17178E1C00690C7F /* FTLExitArgument.cpp */; };
+		0F235BD417178E1C00690C7F /* FTLExitArgument.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BBE17178E1C00690C7F /* FTLExitArgument.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F235BD517178E1C00690C7F /* FTLExitArgumentForOperand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BBF17178E1C00690C7F /* FTLExitArgumentForOperand.cpp */; };
+		0F235BD617178E1C00690C7F /* FTLExitArgumentForOperand.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC017178E1C00690C7F /* FTLExitArgumentForOperand.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F235BD717178E1C00690C7F /* FTLStackmapArgumentList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC117178E1C00690C7F /* FTLStackmapArgumentList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F235BDA17178E1C00690C7F /* FTLExitValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BC417178E1C00690C7F /* FTLExitValue.cpp */; };
+		0F235BDB17178E1C00690C7F /* FTLExitValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC517178E1C00690C7F /* FTLExitValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F235BDC17178E1C00690C7F /* FTLOSRExit.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BC617178E1C00690C7F /* FTLOSRExit.cpp */; };
+		0F235BDD17178E1C00690C7F /* FTLOSRExit.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BC717178E1C00690C7F /* FTLOSRExit.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F235BDF17178E1C00690C7F /* FTLOSRExitCompiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BC917178E1C00690C7F /* FTLOSRExitCompiler.cpp */; };
+		0F235BE017178E1C00690C7F /* FTLOSRExitCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BCA17178E1C00690C7F /* FTLOSRExitCompiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F235BE117178E1C00690C7F /* FTLThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BCB17178E1C00690C7F /* FTLThunks.cpp */; };
+		0F235BE217178E1C00690C7F /* FTLThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BCC17178E1C00690C7F /* FTLThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F235BEB17178E7300690C7F /* DFGOSRExitBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BE717178E7300690C7F /* DFGOSRExitBase.cpp */; };
+		0F235BEC17178E7300690C7F /* DFGOSRExitBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BE817178E7300690C7F /* DFGOSRExitBase.h */; };
+		0F235BED17178E7300690C7F /* DFGOSRExitPreparation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F235BE917178E7300690C7F /* DFGOSRExitPreparation.cpp */; };
+		0F235BEE17178E7300690C7F /* DFGOSRExitPreparation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F235BEA17178E7300690C7F /* DFGOSRExitPreparation.h */; };
+		0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E54017EA9F5900ABB217 /* AssemblyHelpers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F24E53B17EA9F5900ABB217 /* AssemblyHelpers.cpp */; };
+		0F24E54117EA9F5900ABB217 /* AssemblyHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E53C17EA9F5900ABB217 /* AssemblyHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E54217EA9F5900ABB217 /* CCallHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E53D17EA9F5900ABB217 /* CCallHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E54317EA9F5900ABB217 /* FPRInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E53E17EA9F5900ABB217 /* FPRInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E54417EA9F5900ABB217 /* GPRInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E53F17EA9F5900ABB217 /* GPRInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E54C17EE274900ABB217 /* JITOperations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F24E54517EE274900ABB217 /* JITOperations.cpp */; };
+		0F24E54D17EE274900ABB217 /* JITOperations.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E54617EE274900ABB217 /* JITOperations.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E54F17EE274900ABB217 /* TempRegisterSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E54817EE274900ABB217 /* TempRegisterSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E55017EE274900ABB217 /* Repatch.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F24E54917EE274900ABB217 /* Repatch.cpp */; };
+		0F24E55117EE274900ABB217 /* Repatch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E54A17EE274900ABB217 /* Repatch.h */; };
+		0F24E55217EE274900ABB217 /* ScratchRegisterAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E54B17EE274900ABB217 /* ScratchRegisterAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E55517F0B71C00ABB217 /* InlineCallFrameSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F24E55317F0B71C00ABB217 /* InlineCallFrameSet.cpp */; };
+		0F24E55617F0B71C00ABB217 /* InlineCallFrameSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F24E55417F0B71C00ABB217 /* InlineCallFrameSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F24E55817F74EDB00ABB217 /* ValueRecovery.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F24E55717F74EDB00ABB217 /* ValueRecovery.cpp */; };
+		0F256C361627B0AD007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F256C341627B0AA007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h */; };
+		0F25F1B1181635F300522F39 /* FTLSlowPathCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F25F1AA181635F300522F39 /* FTLSlowPathCall.cpp */; };
+		0F25F1B2181635F300522F39 /* FTLSlowPathCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F25F1AB181635F300522F39 /* FTLSlowPathCall.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F25F1B3181635F300522F39 /* FTLSlowPathCallKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F25F1AC181635F300522F39 /* FTLSlowPathCallKey.cpp */; };
+		0F25F1B4181635F300522F39 /* FTLSlowPathCallKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F25F1AD181635F300522F39 /* FTLSlowPathCallKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66AC17B6B53F00A7AE3F /* GCIncomingRefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66A817B6B53D00A7AE3F /* GCIncomingRefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66AD17B6B54500A7AE3F /* GCIncomingRefCountedInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66A917B6B53D00A7AE3F /* GCIncomingRefCountedInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66AE17B6B54500A7AE3F /* GCIncomingRefCountedSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66AA17B6B53D00A7AE3F /* GCIncomingRefCountedSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66AF17B6B54500A7AE3F /* GCIncomingRefCountedSetInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66AB17B6B53D00A7AE3F /* GCIncomingRefCountedSetInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66DE17B6B5AB00A7AE3F /* DataView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66B017B6B5AB00A7AE3F /* DataView.cpp */; };
+		0F2B66DF17B6B5AB00A7AE3F /* DataView.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66B117B6B5AB00A7AE3F /* DataView.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66E017B6B5AB00A7AE3F /* GenericTypedArrayView.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66B217B6B5AB00A7AE3F /* GenericTypedArrayView.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66E117B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66B317B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66E217B6B5AB00A7AE3F /* JSArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66B417B6B5AB00A7AE3F /* JSArrayBuffer.cpp */; };
+		0F2B66E317B6B5AB00A7AE3F /* JSArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66B517B6B5AB00A7AE3F /* JSArrayBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66E417B6B5AB00A7AE3F /* JSArrayBufferConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66B617B6B5AB00A7AE3F /* JSArrayBufferConstructor.cpp */; };
+		0F2B66E517B6B5AB00A7AE3F /* JSArrayBufferConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66B717B6B5AB00A7AE3F /* JSArrayBufferConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66E617B6B5AB00A7AE3F /* JSArrayBufferPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66B817B6B5AB00A7AE3F /* JSArrayBufferPrototype.cpp */; };
+		0F2B66E717B6B5AB00A7AE3F /* JSArrayBufferPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66B917B6B5AB00A7AE3F /* JSArrayBufferPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66E817B6B5AB00A7AE3F /* JSArrayBufferView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66BA17B6B5AB00A7AE3F /* JSArrayBufferView.cpp */; };
+		0F2B66E917B6B5AB00A7AE3F /* JSArrayBufferView.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66BB17B6B5AB00A7AE3F /* JSArrayBufferView.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66EA17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66BC17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66EB17B6B5AB00A7AE3F /* JSDataView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66BD17B6B5AB00A7AE3F /* JSDataView.cpp */; };
+		0F2B66EC17B6B5AB00A7AE3F /* JSDataView.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66BE17B6B5AB00A7AE3F /* JSDataView.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66ED17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66BF17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp */; };
+		0F2B66EE17B6B5AB00A7AE3F /* JSDataViewPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C017B6B5AB00A7AE3F /* JSDataViewPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66EF17B6B5AB00A7AE3F /* JSFloat32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C117B6B5AB00A7AE3F /* JSFloat32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F017B6B5AB00A7AE3F /* JSFloat64Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C217B6B5AB00A7AE3F /* JSFloat64Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F117B6B5AB00A7AE3F /* JSGenericTypedArrayView.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C317B6B5AB00A7AE3F /* JSGenericTypedArrayView.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F217B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C417B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F317B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructorInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C517B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructorInlines.h */; };
+		0F2B66F417B6B5AB00A7AE3F /* JSGenericTypedArrayViewInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C617B6B5AB00A7AE3F /* JSGenericTypedArrayViewInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F517B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C717B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F617B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C817B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F717B6B5AB00A7AE3F /* JSInt8Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F817B6B5AB00A7AE3F /* JSInt16Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66CA17B6B5AB00A7AE3F /* JSInt16Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66F917B6B5AB00A7AE3F /* JSInt32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66CB17B6B5AB00A7AE3F /* JSInt32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66FA17B6B5AB00A7AE3F /* JSTypedArrayConstructors.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66CC17B6B5AB00A7AE3F /* JSTypedArrayConstructors.cpp */; };
+		0F2B66FB17B6B5AB00A7AE3F /* JSTypedArrayConstructors.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66CD17B6B5AB00A7AE3F /* JSTypedArrayConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66FC17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66CE17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.cpp */; };
+		0F2B66FD17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66CF17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B66FE17B6B5AB00A7AE3F /* JSTypedArrays.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66D017B6B5AB00A7AE3F /* JSTypedArrays.cpp */; };
+		0F2B66FF17B6B5AB00A7AE3F /* JSTypedArrays.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66D117B6B5AB00A7AE3F /* JSTypedArrays.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670017B6B5AB00A7AE3F /* JSUint8Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66D217B6B5AB00A7AE3F /* JSUint8Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670117B6B5AB00A7AE3F /* JSUint8ClampedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66D317B6B5AB00A7AE3F /* JSUint8ClampedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670217B6B5AB00A7AE3F /* JSUint16Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670317B6B5AB00A7AE3F /* JSUint32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670417B6B5AB00A7AE3F /* SimpleTypedArrayController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66D617B6B5AB00A7AE3F /* SimpleTypedArrayController.cpp */; };
+		0F2B670517B6B5AB00A7AE3F /* SimpleTypedArrayController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66D717B6B5AB00A7AE3F /* SimpleTypedArrayController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670617B6B5AB00A7AE3F /* TypedArrayAdaptors.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66D817B6B5AB00A7AE3F /* TypedArrayAdaptors.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670717B6B5AB00A7AE3F /* TypedArrayController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66D917B6B5AB00A7AE3F /* TypedArrayController.cpp */; };
+		0F2B670817B6B5AB00A7AE3F /* TypedArrayController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66DA17B6B5AB00A7AE3F /* TypedArrayController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670917B6B5AB00A7AE3F /* TypedArrays.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66DB17B6B5AB00A7AE3F /* TypedArrays.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B670A17B6B5AB00A7AE3F /* TypedArrayType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */; };
+		0F2B670B17B6B5AB00A7AE3F /* TypedArrayType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B9CE219D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CD619D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp */; };
+		0F2B9CE319D0BA7D00B1D1B5 /* DFGAvailabilityMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CD719D0BA7D00B1D1B5 /* DFGAvailabilityMap.h */; };
+		0F2B9CE619D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CDA19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp */; };
+		0F2B9CE719D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CDB19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h */; };
+		0F2B9CE819D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CDC19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp */; };
+		0F2B9CE919D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CDD19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h */; };
+		0F2B9CEA19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CDE19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp */; };
+		0F2B9CEB19D0BA7D00B1D1B5 /* DFGPhiChildren.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CDF19D0BA7D00B1D1B5 /* DFGPhiChildren.h */; };
+		0F2B9CEC19D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CE019D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp */; };
+		0F2B9CED19D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CE119D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h */; };
+		0F2B9CF419D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CEE19D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp */; };
+		0F2B9CF519D0BAC100B1D1B5 /* FTLExitPropertyValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CEF19D0BAC100B1D1B5 /* FTLExitPropertyValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B9CF619D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CF019D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp */; };
+		0F2B9CF719D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CF119D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2B9CF819D0BAC100B1D1B5 /* FTLOperations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2B9CF219D0BAC100B1D1B5 /* FTLOperations.cpp */; };
+		0F2B9CF919D0BAC100B1D1B5 /* FTLOperations.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2B9CF319D0BAC100B1D1B5 /* FTLOperations.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BBD961C5FF3F50023EF23 /* B3SparseCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BBD911C5FF3F50023EF23 /* B3SparseCollection.h */; };
+		0F2BBD971C5FF3F50023EF23 /* B3Variable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BBD921C5FF3F50023EF23 /* B3Variable.cpp */; };
+		0F2BBD981C5FF3F50023EF23 /* B3Variable.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BBD931C5FF3F50023EF23 /* B3Variable.h */; };
+		0F2BBD991C5FF3F50023EF23 /* B3VariableValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BBD941C5FF3F50023EF23 /* B3VariableValue.cpp */; };
+		0F2BBD9A1C5FF3F50023EF23 /* B3VariableValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BBD951C5FF3F50023EF23 /* B3VariableValue.h */; };
+		0F2BBD9D1C5FF4050023EF23 /* AirStackSlotKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BBD9B1C5FF4050023EF23 /* AirStackSlotKind.cpp */; };
+		0F2BBD9E1C5FF4050023EF23 /* AirStackSlotKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BBD9C1C5FF4050023EF23 /* AirStackSlotKind.h */; };
+		0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */; };
+		0F2BDC16151C5D4F00CD8910 /* DFGFixupPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */; };
+		0F2BDC21151E803B00CD8910 /* DFGInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */; };
+		0F2BDC2C151FDE9100CD8910 /* Operands.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC2B151FDE8B00CD8910 /* Operands.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BDC451522801B00CD8910 /* DFGMinifiedGraph.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC3D1522801700CD8910 /* DFGMinifiedGraph.h */; };
+		0F2BDC461522802000CD8910 /* DFGMinifiedNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC3E1522801700CD8910 /* DFGMinifiedNode.h */; };
+		0F2BDC481522802900CD8910 /* DFGValueSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC401522801700CD8910 /* DFGValueSource.h */; };
+		0F2BDC491522809600CD8910 /* DFGVariableEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC411522801700CD8910 /* DFGVariableEvent.h */; };
+		0F2BDC4A1522809A00CD8910 /* DFGVariableEventStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC421522801700CD8910 /* DFGVariableEventStream.cpp */; };
+		0F2BDC4B1522809D00CD8910 /* DFGVariableEventStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC431522801700CD8910 /* DFGVariableEventStream.h */; };
+		0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */; };
+		0F2BDC4F15228BF300CD8910 /* DFGValueSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */; };
+		0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */; };
+		0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */; };
+		0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */; };
+		0F2D4DE919832DAC007D4B19 /* ToThisStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE719832DAC007D4B19 /* TypeLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2D4DEB19832DC4007D4B19 /* TypeProfilerLog.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDF19832D91007D4B19 /* TypeProfilerLog.cpp */; };
+		0F2D4DEC19832DC4007D4B19 /* TypeProfilerLog.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE019832D91007D4B19 /* TypeProfilerLog.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE319832D91007D4B19 /* TypeSet.cpp */; };
+		0F2D4DF019832DD6007D4B19 /* TypeSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE419832D91007D4B19 /* TypeSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2DD80B1AB3D85800BBB8E8 /* BytecodeKills.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2DD80A1AB3D85800BBB8E8 /* BytecodeKills.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2DD8111AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2DD80C1AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.cpp */; };
+		0F2DD8121AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2DD80D1AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.h */; };
+		0F2DD8131AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2DD80E1AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.cpp */; };
+		0F2DD8141AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2DD80F1AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h */; };
+		0F2DD8151AB3D8BE00BBB8E8 /* DFGForAllKills.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2DD8101AB3D8BE00BBB8E8 /* DFGForAllKills.h */; };
+		0F2E892C16D028AD009E4FD2 /* UnusedPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2F16828A7E003C2F8D /* UnusedPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2EBBAB1DEDF95000990369 /* DirectEvalCodeCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2EBBAA1DEDF94E00990369 /* DirectEvalCodeCache.cpp */; };
+		0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */; };
+		0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */; };
+		0F2FCCF918A60070001A27F8 /* DFGGraphSafepoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */; };
+		0F2FCCFA18A60070001A27F8 /* DFGGraphSafepoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */; };
+		0F2FCCFB18A60070001A27F8 /* DFGSafepoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */; };
+		0F2FCCFC18A60070001A27F8 /* DFGSafepoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */; };
+		0F2FCCFD18A60070001A27F8 /* DFGScannable.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF618A60070001A27F8 /* DFGScannable.h */; };
+		0F2FCCFE18A60070001A27F8 /* DFGThreadData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */; };
+		0F2FCCFF18A60070001A27F8 /* DFGThreadData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF818A60070001A27F8 /* DFGThreadData.h */; };
+		0F300B7818AB051100A6D72E /* DFGNodeOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F300B7718AB051100A6D72E /* DFGNodeOrigin.h */; };
+		0F300B7B18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F300B7918AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.cpp */; };
+		0F300B7C18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F300B7A18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h */; };
+		0F30D7C01D95D6320053089D /* CPU.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F30D7BF1D95D62F0053089D /* CPU.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F30FB611DC2DE99003124F2 /* ArrayBufferSharingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F30FB601DC2DE96003124F2 /* ArrayBufferSharingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F32BD101BB34F190093A57F /* HeapHelperPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F32BD0E1BB34F190093A57F /* HeapHelperPool.cpp */; };
+		0F32BD111BB34F190093A57F /* HeapHelperPool.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F32BD0F1BB34F190093A57F /* HeapHelperPool.h */; };
+		0F338DF11BE93AD10013C88F /* B3StackmapValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338DEF1BE93AD10013C88F /* B3StackmapValue.cpp */; };
+		0F338DF21BE93AD10013C88F /* B3StackmapValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338DF01BE93AD10013C88F /* B3StackmapValue.h */; };
+		0F338DF51BE93D550013C88F /* B3ConstrainedValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338DF31BE93D550013C88F /* B3ConstrainedValue.cpp */; };
+		0F338DF61BE93D550013C88F /* B3ConstrainedValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338DF41BE93D550013C88F /* B3ConstrainedValue.h */; };
+		0F338DF91BE96AA80013C88F /* B3CCallValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338DF71BE96AA80013C88F /* B3CCallValue.cpp */; };
+		0F338DFA1BE96AA80013C88F /* B3CCallValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338DF81BE96AA80013C88F /* B3CCallValue.h */; };
+		0F338DFD1BED51270013C88F /* AirSimplifyCFG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338DFB1BED51270013C88F /* AirSimplifyCFG.cpp */; };
+		0F338DFE1BED51270013C88F /* AirSimplifyCFG.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338DFC1BED51270013C88F /* AirSimplifyCFG.h */; };
+		0F338E0B1BF0276C0013C88F /* B3Compilation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338DFF1BF0276C0013C88F /* B3Compilation.cpp */; };
+		0F338E0C1BF0276C0013C88F /* B3Compilation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E001BF0276C0013C88F /* B3Compilation.h */; };
+		0F338E0D1BF0276C0013C88F /* B3DataSection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338E011BF0276C0013C88F /* B3DataSection.cpp */; };
+		0F338E0E1BF0276C0013C88F /* B3DataSection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E021BF0276C0013C88F /* B3DataSection.h */; };
+		0F338E0F1BF0276C0013C88F /* B3MoveConstants.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338E031BF0276C0013C88F /* B3MoveConstants.cpp */; };
+		0F338E101BF0276C0013C88F /* B3MoveConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E041BF0276C0013C88F /* B3MoveConstants.h */; };
+		0F338E111BF0276C0013C88F /* B3OpaqueByproduct.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E051BF0276C0013C88F /* B3OpaqueByproduct.h */; };
+		0F338E121BF0276C0013C88F /* B3OpaqueByproducts.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338E061BF0276C0013C88F /* B3OpaqueByproducts.cpp */; };
+		0F338E131BF0276C0013C88F /* B3OpaqueByproducts.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E071BF0276C0013C88F /* B3OpaqueByproducts.h */; };
+		0F338E141BF0276C0013C88F /* B3ValueKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338E081BF0276C0013C88F /* B3ValueKey.cpp */; };
+		0F338E151BF0276C0013C88F /* B3ValueKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E091BF0276C0013C88F /* B3ValueKey.h */; };
+		0F338E161BF0276C0013C88F /* B3ValueKeyInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E0A1BF0276C0013C88F /* B3ValueKeyInlines.h */; };
+		0F338E1B1BF286EA0013C88F /* B3BlockInsertionSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338E171BF286EA0013C88F /* B3BlockInsertionSet.cpp */; };
+		0F338E1C1BF286EA0013C88F /* B3BlockInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E181BF286EA0013C88F /* B3BlockInsertionSet.h */; };
+		0F338E1D1BF286EA0013C88F /* B3LowerMacros.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F338E191BF286EA0013C88F /* B3LowerMacros.cpp */; };
+		0F338E1E1BF286EA0013C88F /* B3LowerMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F338E1A1BF286EA0013C88F /* B3LowerMacros.h */; };
+		0F33FCF71C136E2500323F67 /* B3StackmapGenerationParams.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F33FCF51C136E2500323F67 /* B3StackmapGenerationParams.cpp */; };
+		0F33FCF81C136E2500323F67 /* B3StackmapGenerationParams.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F33FCF61C136E2500323F67 /* B3StackmapGenerationParams.h */; };
+		0F33FCFB1C1625BE00323F67 /* B3CFG.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F33FCF91C1625BE00323F67 /* B3CFG.h */; };
+		0F33FCFC1C1625BE00323F67 /* B3Dominators.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F33FCFA1C1625BE00323F67 /* B3Dominators.h */; };
+		0F34B14916D42010001CDA5A /* DFGUseKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F34B14716D4200E001CDA5A /* DFGUseKind.cpp */; };
+		0F34B14A16D42013001CDA5A /* DFGUseKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F34B14816D4200E001CDA5A /* DFGUseKind.h */; };
+		0F37308C1C0BD29100052BFA /* B3PhiChildren.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F37308A1C0BD29100052BFA /* B3PhiChildren.cpp */; };
+		0F37308D1C0BD29100052BFA /* B3PhiChildren.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F37308B1C0BD29100052BFA /* B3PhiChildren.h */; };
+		0F37308F1C0CD68500052BFA /* DisallowMacroScratchRegisterUsage.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F37308E1C0CD68500052BFA /* DisallowMacroScratchRegisterUsage.h */; };
+		0F3730911C0CD70C00052BFA /* AllowMacroScratchRegisterUsage.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3730901C0CD70C00052BFA /* AllowMacroScratchRegisterUsage.h */; };
+		0F3730931C0D67EE00052BFA /* AirUseCounts.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3730921C0D67EE00052BFA /* AirUseCounts.h */; };
+		0F38B01117CF078000B144D3 /* LLIntEntrypoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F38B00F17CF077F00B144D3 /* LLIntEntrypoint.cpp */; };
+		0F38B01217CF078300B144D3 /* LLIntEntrypoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F38B01017CF077F00B144D3 /* LLIntEntrypoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F38B01717CFE75500B144D3 /* DFGCompilationKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F38B01317CFE75500B144D3 /* DFGCompilationKey.cpp */; };
+		0F38B01817CFE75500B144D3 /* DFGCompilationKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F38B01417CFE75500B144D3 /* DFGCompilationKey.h */; };
+		0F38B01917CFE75500B144D3 /* DFGCompilationMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F38B01517CFE75500B144D3 /* DFGCompilationMode.cpp */; };
+		0F38B01A17CFE75500B144D3 /* DFGCompilationMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F38B01617CFE75500B144D3 /* DFGCompilationMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F38D2A21D44196800680499 /* AuxiliaryBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F38D2A01D44196600680499 /* AuxiliaryBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F38D2A31D44196D00680499 /* AuxiliaryBarrierInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F38D2A11D44196600680499 /* AuxiliaryBarrierInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F392C891B46188400844728 /* DFGOSRExitFuzz.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F392C871B46188400844728 /* DFGOSRExitFuzz.cpp */; };
+		0F392C8A1B46188400844728 /* DFGOSRExitFuzz.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F392C881B46188400844728 /* DFGOSRExitFuzz.h */; };
+		0F3A1BF91A9ECB7D000DE01A /* DFGPutStackSinkingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3A1BF71A9ECB7D000DE01A /* DFGPutStackSinkingPhase.cpp */; };
+		0F3A1BFA1A9ECB7D000DE01A /* DFGPutStackSinkingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3A1BF81A9ECB7D000DE01A /* DFGPutStackSinkingPhase.h */; };
+		0F3AC752183EA1040032029F /* StackAlignment.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3AC751183EA1040032029F /* StackAlignment.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F3AC754188E5EC80032029F /* ExitingJITType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3AC753188E5EC80032029F /* ExitingJITType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F3B3A1A153E68F2003ED0FF /* DFGConstantFoldingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3B3A17153E68EF003ED0FF /* DFGConstantFoldingPhase.cpp */; };
+		0F3B3A1B153E68F4003ED0FF /* DFGConstantFoldingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3B3A18153E68EF003ED0FF /* DFGConstantFoldingPhase.h */; };
+		0F3B3A271544C995003ED0FF /* DFGCFGSimplificationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3B3A241544C991003ED0FF /* DFGCFGSimplificationPhase.cpp */; };
+		0F3B3A281544C997003ED0FF /* DFGCFGSimplificationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */; };
+		0F3B3A2B15475000003ED0FF /* DFGValidate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */; };
+		0F3B3A2C15475002003ED0FF /* DFGValidate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */; };
+		0F3B7E2A19A11B8000D9BC56 /* CallVariant.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3B7E2419A11B8000D9BC56 /* CallVariant.cpp */; };
+		0F3B7E2B19A11B8000D9BC56 /* CallVariant.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3B7E2519A11B8000D9BC56 /* CallVariant.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F3BD1B71B896A0700598AA6 /* DFGInsertionSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3BD1B61B896A0700598AA6 /* DFGInsertionSet.cpp */; };
+		0F3C1F1A1B868E7900ABB08B /* DFGClobbersExitState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3C1F181B868E7900ABB08B /* DFGClobbersExitState.cpp */; };
+		0F3C1F1B1B868E7900ABB08B /* DFGClobbersExitState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3C1F191B868E7900ABB08B /* DFGClobbersExitState.h */; };
+		0F3E01AA19D353A500F61B7F /* DFGPrePostNumbering.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3E01A819D353A500F61B7F /* DFGPrePostNumbering.cpp */; };
+		0F3E01AB19D353A500F61B7F /* DFGPrePostNumbering.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3E01A919D353A500F61B7F /* DFGPrePostNumbering.h */; };
+		0F40E4A71C497F7400A577FA /* AirOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6183321C45F35C0072450B /* AirOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F40E4A81C497F7400A577FA /* AirOpcodeGenerated.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6183341C45F3B60072450B /* AirOpcodeGenerated.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F40E4A91C497F7400A577FA /* AirOpcodeUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6183351C45F3B60072450B /* AirOpcodeUtils.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F426A481460CBB300131F8F /* ValueRecovery.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A451460CBAB00131F8F /* ValueRecovery.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A461460CBAB00131F8F /* VirtualRegister.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A4A1460CD6B00131F8F /* DataFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F431738146BAC69007E3890 /* ListableHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F431736146BAC65007E3890 /* ListableHandler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4570381BE44C910062A629 /* AirEliminateDeadCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4570361BE44C910062A629 /* AirEliminateDeadCode.cpp */; };
+		0F4570391BE44C910062A629 /* AirEliminateDeadCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4570371BE44C910062A629 /* AirEliminateDeadCode.h */; };
+		0F45703C1BE45F0A0062A629 /* AirReportUsedRegisters.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F45703A1BE45F0A0062A629 /* AirReportUsedRegisters.cpp */; };
+		0F45703D1BE45F0A0062A629 /* AirReportUsedRegisters.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F45703B1BE45F0A0062A629 /* AirReportUsedRegisters.h */; };
+		0F4570401BE584CA0062A629 /* B3TimingScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F45703E1BE584CA0062A629 /* B3TimingScope.cpp */; };
+		0F4570411BE584CA0062A629 /* B3TimingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F45703F1BE584CA0062A629 /* B3TimingScope.h */; };
+		0F46808214BA572D00BFE272 /* JITExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F46808014BA572700BFE272 /* JITExceptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F46808314BA573100BFE272 /* JITExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46807F14BA572700BFE272 /* JITExceptions.cpp */; };
+		0F4680A314BA7F8D00BFE272 /* LLIntExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680A414BA7F8D00BFE272 /* LLIntSlowPaths.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46809F14BA7F8200BFE272 /* LLIntSlowPaths.cpp */; settings = {COMPILER_FLAGS = "-Wno-unused-parameter"; }; };
+		0F4680A514BA7F8D00BFE272 /* LLIntSlowPaths.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680A014BA7F8200BFE272 /* LLIntSlowPaths.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680A814BA7FAB00BFE272 /* LLIntExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */; };
+		0F4680CA14BBB16C00BFE272 /* LLIntCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C514BBB16900BFE272 /* LLIntCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680CB14BBB17200BFE272 /* LLIntOfflineAsmConfig.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4680CC14BBB17A00BFE272 /* LowLevelInterpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */; };
+		0F4680CD14BBB17D00BFE272 /* LowLevelInterpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */; };
+		0F4680D214BBD16500BFE272 /* LLIntData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */; };
+		0F4680D314BBD16700BFE272 /* LLIntData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680CF14BBB3D100BFE272 /* LLIntData.h */; };
+		0F4680D414BBD24900BFE272 /* HostCallReturnValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */; };
+		0F4680D514BBD24B00BFE272 /* HostCallReturnValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F485321187750560083B687 /* DFGArithMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F48531F187750560083B687 /* DFGArithMode.cpp */; };
+		0F485322187750560083B687 /* DFGArithMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F485320187750560083B687 /* DFGArithMode.h */; };
+		0F485327187DFDEC0083B687 /* FTLAvailableRecovery.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F485323187DFDEC0083B687 /* FTLAvailableRecovery.cpp */; };
+		0F485328187DFDEC0083B687 /* FTLAvailableRecovery.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F485324187DFDEC0083B687 /* FTLAvailableRecovery.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F485329187DFDEC0083B687 /* FTLRecoveryOpcode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F485325187DFDEC0083B687 /* FTLRecoveryOpcode.cpp */; };
+		0F48532A187DFDEC0083B687 /* FTLRecoveryOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F485326187DFDEC0083B687 /* FTLRecoveryOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F493AFA16D0CAD30084508B /* SourceProvider.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F493AF816D0CAD10084508B /* SourceProvider.cpp */; };
+		0F4A38F91C8E13DF00190318 /* SuperSampler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4A38F71C8E13DF00190318 /* SuperSampler.cpp */; };
+		0F4A38FA1C8E13DF00190318 /* SuperSampler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4A38F81C8E13DF00190318 /* SuperSampler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4B94DC17B9F07500DD03A4 /* TypedArrayInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4B94DB17B9F07500DD03A4 /* TypedArrayInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F4C91661C29F4F2004341A6 /* B3OriginDump.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4C91651C29F4F2004341A6 /* B3OriginDump.h */; };
+		0F4DE1CE1C4C1B54004D6C11 /* AirFixObviousSpills.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4DE1CC1C4C1B54004D6C11 /* AirFixObviousSpills.cpp */; };
+		0F4DE1CF1C4C1B54004D6C11 /* AirFixObviousSpills.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4DE1CD1C4C1B54004D6C11 /* AirFixObviousSpills.h */; };
+		0F4DE1D11C4D764B004D6C11 /* B3OriginDump.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4DE1D01C4D764B004D6C11 /* B3OriginDump.cpp */; };
+		0F4F29DF18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */; };
+		0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */; };
+		0F4F828B1E31B9740075184C /* StochasticSpaceTimeMutatorScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4F82891E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.cpp */; };
+		0F4F828C1E31B9760075184C /* StochasticSpaceTimeMutatorScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */; };
+		0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */; };
+		0F5513A61D5A682C00C32BD8 /* FreeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5513A51D5A682A00C32BD8 /* FreeList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F5513A81D5A68CD00C32BD8 /* FreeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5513A71D5A68CB00C32BD8 /* FreeList.cpp */; };
+		0F5541B11613C1FB00CE3E25 /* SpecialPointer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */; };
+		0F5541B21613C1FB00CE3E25 /* SpecialPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F55989817C86C5800A1E543 /* ToNativeFromValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F55989717C86C5600A1E543 /* ToNativeFromValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F55C19417276E4600CEABFD /* DFGAbstractValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F55C19317276E4600CEABFD /* DFGAbstractValue.cpp */; };
+		0F55F0F414D1063900AC7649 /* AbstractPC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F55F0F114D1063600AC7649 /* AbstractPC.cpp */; };
+		0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F55F0F214D1063600AC7649 /* AbstractPC.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F56A1D315000F35002992B1 /* ExecutionCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F56A1D115000F31002992B1 /* ExecutionCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */; };
+		0F572D4F16879FDD00E57FBD /* ThunkGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F572D4D16879FDB00E57FBD /* ThunkGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F5780A218FE1E98001E72D9 /* PureNaN.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5780A118FE1E98001E72D9 /* PureNaN.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F5874ED194FEB1200AAB2C1 /* DFGMayExit.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5874EB194FEB1200AAB2C1 /* DFGMayExit.cpp */; };
+		0F5874EE194FEB1200AAB2C1 /* DFGMayExit.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5874EC194FEB1200AAB2C1 /* DFGMayExit.h */; };
+		0F5A1273192D9FDF008764A3 /* DFGDoesGC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */; };
+		0F5A1274192D9FDF008764A3 /* DFGDoesGC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */; };
+		0F5A6283188C98D40072C9DF /* FTLValueRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5A6281188C98D40072C9DF /* FTLValueRange.cpp */; };
+		0F5A6284188C98D40072C9DF /* FTLValueRange.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5A6282188C98D40072C9DF /* FTLValueRange.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F5AE2C41DF4F2800066EFE1 /* VMInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FE90BB3A1B7CF64E006B3F03 /* VMInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F5B4A331C84F0D600F1B17E /* SlowPathReturnType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5B4A321C84F0D600F1B17E /* SlowPathReturnType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F5D085D1B8CF99D001143B4 /* DFGNodeOrigin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5D085C1B8CF99D001143B4 /* DFGNodeOrigin.cpp */; };
+		0F5EF91E16878F7A003E5C25 /* JITThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5EF91B16878F78003E5C25 /* JITThunks.cpp */; };
+		0F5EF91F16878F7D003E5C25 /* JITThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5EF91C16878F78003E5C25 /* JITThunks.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F5F08CF146C7633000472A9 /* UnconditionalFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F6183291C45BF070072450B /* AirCCallingConvention.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6183201C45BF070072450B /* AirCCallingConvention.cpp */; };
+		0F61832A1C45BF070072450B /* AirCCallingConvention.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6183211C45BF070072450B /* AirCCallingConvention.h */; };
+		0F61832B1C45BF070072450B /* AirCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6183221C45BF070072450B /* AirCustom.cpp */; };
+		0F61832C1C45BF070072450B /* AirEmitShuffle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6183231C45BF070072450B /* AirEmitShuffle.cpp */; };
+		0F61832D1C45BF070072450B /* AirEmitShuffle.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6183241C45BF070072450B /* AirEmitShuffle.h */; };
+		0F61832E1C45BF070072450B /* AirLowerAfterRegAlloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6183251C45BF070072450B /* AirLowerAfterRegAlloc.cpp */; };
+		0F61832F1C45BF070072450B /* AirLowerAfterRegAlloc.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6183261C45BF070072450B /* AirLowerAfterRegAlloc.h */; };
+		0F6183301C45BF070072450B /* AirLowerMacros.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6183271C45BF070072450B /* AirLowerMacros.cpp */; };
+		0F6183311C45BF070072450B /* AirLowerMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6183281C45BF070072450B /* AirLowerMacros.h */; };
+		0F61833C1C45F62A0072450B /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
+		0F61833D1C45F62A0072450B /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		0F6183451C45F6600072450B /* testair.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6183441C45F6600072450B /* testair.cpp */; settings = {COMPILER_FLAGS = "-O0"; }; };
+		0F620174143FCD330068B77C /* DFGVariableAccessData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */; };
+		0F620176143FCD3B0068B77C /* DFGBasicBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F620170143FCD2F0068B77C /* DFGBasicBlock.h */; };
+		0F620177143FCD3F0068B77C /* DFGAbstractValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */; };
+		0F6237971AE45CA700D402EA /* DFGPhantomInsertionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6237951AE45CA700D402EA /* DFGPhantomInsertionPhase.cpp */; };
+		0F6237981AE45CA700D402EA /* DFGPhantomInsertionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6237961AE45CA700D402EA /* DFGPhantomInsertionPhase.h */; };
+		0F63943F15C75F19006A597C /* DFGTypeCheckHoistingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63943D15C75F14006A597C /* DFGTypeCheckHoistingPhase.h */; };
+		0F63944015C75F1D006A597C /* DFGTypeCheckHoistingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63943C15C75F14006A597C /* DFGTypeCheckHoistingPhase.cpp */; };
+		0F63945415D07055006A597C /* ArrayProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63945115D07051006A597C /* ArrayProfile.cpp */; };
+		0F63945515D07057006A597C /* ArrayProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63945215D07051006A597C /* ArrayProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */; };
+		0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63948115E48114006A597C /* DFGArrayMode.cpp */; };
+		0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63948215E48114006A597C /* DFGArrayMode.h */; };
+		0F64B2711A784BAF006E4E66 /* BinarySwitch.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F64B26F1A784BAF006E4E66 /* BinarySwitch.cpp */; };
+		0F64B2721A784BAF006E4E66 /* BinarySwitch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F64B2701A784BAF006E4E66 /* BinarySwitch.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F64B2791A7957B2006E4E66 /* CallEdge.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F64B2771A7957B2006E4E66 /* CallEdge.cpp */; };
+		0F64B27A1A7957B2006E4E66 /* CallEdge.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F64B2781A7957B2006E4E66 /* CallEdge.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F64EAF31C4ECD0600621E9B /* AirArgInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F64EAF21C4ECD0600621E9B /* AirArgInlines.h */; };
+		0F660E371E0517B90031462C /* MarkingConstraint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F660E331E0517B70031462C /* MarkingConstraint.cpp */; };
+		0F660E381E0517BB0031462C /* MarkingConstraint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F660E341E0517B70031462C /* MarkingConstraint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F660E391E0517BF0031462C /* MarkingConstraintSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F660E351E0517B70031462C /* MarkingConstraintSet.cpp */; };
+		0F660E3A1E0517C10031462C /* MarkingConstraintSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F660E361E0517B80031462C /* MarkingConstraintSet.h */; };
+		0F664CE81DA304EF00B00A11 /* CodeBlockSetInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F664CE71DA304ED00B00A11 /* CodeBlockSetInlines.h */; };
+		0F666EC0183566F900D017F1 /* BytecodeLivenessAnalysisInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F666EBE183566F900D017F1 /* BytecodeLivenessAnalysisInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F666EC1183566F900D017F1 /* FullBytecodeLiveness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F666EBF183566F900D017F1 /* FullBytecodeLiveness.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F666EC61835672B00D017F1 /* DFGAvailability.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F666EC21835672B00D017F1 /* DFGAvailability.cpp */; };
+		0F666EC71835672B00D017F1 /* DFGAvailability.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F666EC31835672B00D017F1 /* DFGAvailability.h */; };
+		0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */; };
+		0F66E16C14DF3F1600B7B2E4 /* DFGEdge.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */; };
+		0F682FB219BCB36400FA3BAD /* DFGSSACalculator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F682FB019BCB36400FA3BAD /* DFGSSACalculator.cpp */; };
+		0F682FB319BCB36400FA3BAD /* DFGSSACalculator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F682FB119BCB36400FA3BAD /* DFGSSACalculator.h */; };
+		0F6971EA1D92F42400BA02A5 /* B3FenceValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6971E91D92F42100BA02A5 /* B3FenceValue.h */; };
+		0F6971EB1D92F42D00BA02A5 /* B3FenceValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6971E81D92F42100BA02A5 /* B3FenceValue.cpp */; };
+		0F69CC88193AC60A0045759E /* DFGFrozenValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F69CC86193AC60A0045759E /* DFGFrozenValue.cpp */; };
+		0F69CC89193AC60A0045759E /* DFGFrozenValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F69CC87193AC60A0045759E /* DFGFrozenValue.h */; };
+		0F6B1CB91861244C00845D97 /* ArityCheckMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6B1CB71861244C00845D97 /* ArityCheckMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F6B8AD81C4EDDA200969052 /* B3DuplicateTails.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6B8AD61C4EDDA200969052 /* B3DuplicateTails.cpp */; };
+		0F6B8AD91C4EDDA200969052 /* B3DuplicateTails.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6B8AD71C4EDDA200969052 /* B3DuplicateTails.h */; };
+		0F6B8ADC1C4EFAC300969052 /* B3SSACalculator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6B8ADA1C4EFAC300969052 /* B3SSACalculator.cpp */; };
+		0F6B8ADD1C4EFAC300969052 /* B3SSACalculator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6B8ADB1C4EFAC300969052 /* B3SSACalculator.h */; };
+		0F6B8AE21C4EFE1700969052 /* B3BreakCriticalEdges.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6B8ADE1C4EFE1700969052 /* B3BreakCriticalEdges.cpp */; };
+		0F6B8AE31C4EFE1700969052 /* B3BreakCriticalEdges.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6B8ADF1C4EFE1700969052 /* B3BreakCriticalEdges.h */; };
+		0F6B8AE41C4EFE1700969052 /* B3FixSSA.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6B8AE01C4EFE1700969052 /* B3FixSSA.cpp */; };
+		0F6B8AE51C4EFE1700969052 /* B3FixSSA.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6B8AE11C4EFE1700969052 /* B3FixSSA.h */; };
+		0F6C73501AC9F99F00BE1682 /* VariableWriteFireDetail.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6C734E1AC9F99F00BE1682 /* VariableWriteFireDetail.cpp */; };
+		0F6C73511AC9F99F00BE1682 /* VariableWriteFireDetail.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6C734F1AC9F99F00BE1682 /* VariableWriteFireDetail.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F6DB7E91D6124B500CDBF8E /* StackFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6DB7E81D6124B200CDBF8E /* StackFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F6DB7EA1D6124B800CDBF8E /* StackFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6DB7E71D6124B200CDBF8E /* StackFrame.cpp */; };
+		0F6DB7EC1D617D1100CDBF8E /* MacroAssemblerCodeRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6DB7EB1D617D0F00CDBF8E /* MacroAssemblerCodeRef.cpp */; };
+		0F6E845A19030BEF00562741 /* DFGVariableAccessData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6E845919030BEF00562741 /* DFGVariableAccessData.cpp */; };
+		0F6FC750196110A800E1D02D /* ComplexGetStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F6FC74E196110A800E1D02D /* ComplexGetStatus.cpp */; };
+		0F6FC751196110A800E1D02D /* ComplexGetStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F6FC74F196110A800E1D02D /* ComplexGetStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7025A91714B0FA00382C0E /* DFGOSRExitCompilerCommon.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7025A71714B0F800382C0E /* DFGOSRExitCompilerCommon.cpp */; };
+		0F7025AA1714B0FC00382C0E /* DFGOSRExitCompilerCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7025A81714B0F800382C0E /* DFGOSRExitCompilerCommon.h */; };
+		0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F714CA116EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.cpp */; };
+		0F714CA516EA92F200F3EBEB /* DFGBackwardsPropagationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F714CA216EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.h */; };
+		0F725CA71C503DED00AD943A /* B3EliminateCommonSubexpressions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F725CA31C503DED00AD943A /* B3EliminateCommonSubexpressions.cpp */; };
+		0F725CA81C503DED00AD943A /* B3EliminateCommonSubexpressions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F725CA41C503DED00AD943A /* B3EliminateCommonSubexpressions.h */; };
+		0F725CA91C503DED00AD943A /* B3PureCSE.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F725CA51C503DED00AD943A /* B3PureCSE.cpp */; };
+		0F725CAA1C503DED00AD943A /* B3PureCSE.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F725CA61C503DED00AD943A /* B3PureCSE.h */; };
+		0F725CAF1C506D3B00AD943A /* B3FoldPathConstants.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F725CAD1C506D3B00AD943A /* B3FoldPathConstants.cpp */; };
+		0F725CB01C506D3B00AD943A /* B3FoldPathConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F725CAE1C506D3B00AD943A /* B3FoldPathConstants.h */; };
+		0F743BAA16B88249009F9277 /* ARM64Disassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 652A3A201651C66100A80AFE /* ARM64Disassembler.cpp */; };
+		0F766D2815A8CC1E008F363E /* JITStubRoutine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */; };
+		0F766D2B15A8CC38008F363E /* JITStubRoutineSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D2915A8CC34008F363E /* JITStubRoutineSet.cpp */; };
+		0F766D2C15A8CC3A008F363E /* JITStubRoutineSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F766D2A15A8CC34008F363E /* JITStubRoutineSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F766D2F15A8DCE0008F363E /* GCAwareJITStubRoutine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D2D15A8DCDD008F363E /* GCAwareJITStubRoutine.cpp */; };
+		0F766D3015A8DCE2008F363E /* GCAwareJITStubRoutine.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F766D2E15A8DCDD008F363E /* GCAwareJITStubRoutine.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F766D3115AA8112008F363E /* JITStubRoutine.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F766D1C15A5028D008F363E /* JITStubRoutine.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F766D3815AE4A1C008F363E /* StructureStubClearingWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D3615AE4A1A008F363E /* StructureStubClearingWatchpoint.cpp */; };
+		0F766D3915AE4A1F008F363E /* StructureStubClearingWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7700911402FF280078EB39 /* SamplingCounter.cpp */; };
+		0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */; };
+		0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC0977E1469EBC400CF2442 /* DFGCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7C39FB1C8F629300480151 /* RegExpInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7C39FA1C8F629300480151 /* RegExpInlines.h */; };
+		0F7C39FD1C8F659500480151 /* RegExpObjectInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7C39FC1C8F659500480151 /* RegExpObjectInlines.h */; };
+		0F7C39FF1C90C55B00480151 /* DFGOpInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7C39FE1C90C55B00480151 /* DFGOpInfo.h */; };
+		0F7C5FB81D888A0C0044F5E2 /* MarkedBlockInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7C5FB71D888A010044F5E2 /* MarkedBlockInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7CF94F1DBEEE880098CC12 /* ReleaseHeapAccessScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7CF94E1DBEEE860098CC12 /* ReleaseHeapAccessScope.h */; };
+		0F7CF9521DC027D90098CC12 /* StopIfNecessaryTimer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7CF9511DC027D70098CC12 /* StopIfNecessaryTimer.h */; };
+		0F7CF9531DC027DB0098CC12 /* StopIfNecessaryTimer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7CF9501DC027D70098CC12 /* StopIfNecessaryTimer.cpp */; };
+		0F7CF9561DC1258D0098CC12 /* AtomicsObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7CF9541DC1258B0098CC12 /* AtomicsObject.cpp */; };
+		0F7CF9571DC125900098CC12 /* AtomicsObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7CF9551DC1258B0098CC12 /* AtomicsObject.h */; };
+		0F7DF1341E2970D70095951B /* ConstraintVolatility.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF12F1E2970D50095951B /* ConstraintVolatility.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7DF1351E2970DC0095951B /* MarkedSpaceInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF1301E2970D50095951B /* MarkedSpaceInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7DF1361E2970DF0095951B /* Subspace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7DF1311E2970D50095951B /* Subspace.cpp */; };
+		0F7DF1371E2970E10095951B /* Subspace.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF1321E2970D50095951B /* Subspace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7DF1381E2970E40095951B /* SubspaceInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF1331E2970D50095951B /* SubspaceInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7DF13B1E2971110095951B /* JSDestructibleObjectSubspace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7DF1391E29710E0095951B /* JSDestructibleObjectSubspace.cpp */; };
+		0F7DF13C1E2971130095951B /* JSDestructibleObjectSubspace.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF13A1E29710E0095951B /* JSDestructibleObjectSubspace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7DF13F1E2AFC4D0095951B /* JSStringSubspace.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF13E1E2AFC4B0095951B /* JSStringSubspace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7DF1401E2AFC500095951B /* JSStringSubspace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7DF13D1E2AFC4B0095951B /* JSStringSubspace.cpp */; };
+		0F7DF1461E2BEF6A0095951B /* MarkedAllocatorInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7DF1451E2BEF680095951B /* MarkedAllocatorInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F7F988B1D9596C500F4F12E /* DFGStoreBarrierClusteringPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7F98891D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.cpp */; };
+		0F7F988C1D9596C800F4F12E /* DFGStoreBarrierClusteringPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7F988A1D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.h */; };
+		0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8023E91613832300A0BA45 /* ByValInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F8335B71639C1E6001443B5 /* ArrayAllocationProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */; };
+		0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F8364B7164B0C110053329A /* DFGBranchDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */; };
+		0F86A26F1D6F7B3300CB0C92 /* GCTypeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F86A26E1D6F7B3100CB0C92 /* GCTypeMap.h */; };
+		0F86AE201C5311C5006BE8EC /* B3ComputeDivisionMagic.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F86AE1F1C5311C5006BE8EC /* B3ComputeDivisionMagic.h */; };
+		0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F893BDB1936E23C001211F4 /* DFGStructureAbstractValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F893BDA1936E23C001211F4 /* DFGStructureAbstractValue.cpp */; };
+		0F898F311B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F898F2F1B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.cpp */; };
+		0F898F321B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F898F301B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h */; };
+		0F8F14331ADF090100ED792C /* DFGEpoch.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F142F1ADF090100ED792C /* DFGEpoch.cpp */; };
+		0F8F14341ADF090100ED792C /* DFGEpoch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F14301ADF090100ED792C /* DFGEpoch.h */; };
+		0F8F14351ADF090100ED792C /* DFGMovHintRemovalPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F14311ADF090100ED792C /* DFGMovHintRemovalPhase.cpp */; };
+		0F8F14361ADF090100ED792C /* DFGMovHintRemovalPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F14321ADF090100ED792C /* DFGMovHintRemovalPhase.h */; };
+		0F8F2B95172E04A0007DBDA5 /* FTLLink.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */; };
+		0F8F2B96172E04A3007DBDA5 /* FTLLink.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F2B94172E049E007DBDA5 /* FTLLink.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F8F2B99172F04FF007DBDA5 /* DFGDesiredIdentifiers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */; };
+		0F8F2B9A172F0501007DBDA5 /* DFGDesiredIdentifiers.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F2B98172F04FD007DBDA5 /* DFGDesiredIdentifiers.h */; };
+		0F8F2B9E17306C8D007DBDA5 /* UnlinkedSourceCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B9D17306C8B007DBDA5 /* UnlinkedSourceCode.cpp */; };
+		0F8F943C1667631300D61971 /* CodeSpecializationKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F943A1667631100D61971 /* CodeSpecializationKind.cpp */; };
+		0F8F94401667633000D61971 /* CodeBlockHash.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F943D1667632D00D61971 /* CodeBlockHash.cpp */; };
+		0F8F94411667633200D61971 /* CodeBlockHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F943E1667632D00D61971 /* CodeBlockHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F8F94421667633500D61971 /* CodeType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F943F1667632D00D61971 /* CodeType.cpp */; };
+		0F8F94441667635400D61971 /* JITCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F94431667635200D61971 /* JITCode.cpp */; };
+		0F8F9446166764F100D61971 /* CodeOrigin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F9445166764EE00D61971 /* CodeOrigin.cpp */; };
+		0F919D0C157EE09F004A4E7D /* JSSymbolTableObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F919D09157EE09D004A4E7D /* JSSymbolTableObject.cpp */; };
+		0F919D0D157EE0A2004A4E7D /* JSSymbolTableObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F919D0A157EE09D004A4E7D /* JSSymbolTableObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F919D10157F3329004A4E7D /* JSSegmentedVariableObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */; };
+		0F919D11157F332C004A4E7D /* JSSegmentedVariableObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F919D0F157F3327004A4E7D /* JSSegmentedVariableObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F919D2515853CE0004A4E7D /* Watchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F919D2215853CDE004A4E7D /* Watchpoint.cpp */; };
+		0F919D2615853CE3004A4E7D /* Watchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F919D2315853CDE004A4E7D /* Watchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F919D2815856773004A4E7D /* SymbolTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F919D2715856770004A4E7D /* SymbolTable.cpp */; };
+		0F93274D1C1F66AA00CF6564 /* GPRInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93274C1C1F66AA00CF6564 /* GPRInfo.cpp */; };
+		0F9327521C20BCBA00CF6564 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
+		0F9327531C20BCBA00CF6564 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		0F93275B1C20BCDF00CF6564 /* dynbench.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93275A1C20BCDF00CF6564 /* dynbench.cpp */; };
+		0F93275F1C21EF7F00CF6564 /* JSObjectInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93275E1C21EF7F00CF6564 /* JSObjectInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F93329D14CA7DC30085F3C6 /* CallLinkStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93329314CA7DC10085F3C6 /* CallLinkStatus.cpp */; };
+		0F93329E14CA7DC50085F3C6 /* CallLinkStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F93329F14CA7DCA0085F3C6 /* GetByIdStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */; };
+		0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9332A314CA7DD70085F3C6 /* PutByIdStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */; };
+		0F9332A414CA7DD90085F3C6 /* PutByIdStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9332A514CA7DDD0085F3C6 /* StructureSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93329B14CA7DC10085F3C6 /* StructureSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F93B4A918B92C4D00178A3F /* PutByIdVariant.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F93B4A718B92C4D00178A3F /* PutByIdVariant.cpp */; };
+		0F93B4AA18B92C4D00178A3F /* PutByIdVariant.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F93B4A818B92C4D00178A3F /* PutByIdVariant.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9495871C57F47500413A48 /* B3StackSlot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9495851C57F47500413A48 /* B3StackSlot.cpp */; };
+		0F9495881C57F47500413A48 /* B3StackSlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9495861C57F47500413A48 /* B3StackSlot.h */; };
+		0F952AA11DF7860900E06FBD /* VisitRaceKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F952AA01DF7860700E06FBD /* VisitRaceKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F952AA21DF7860D00E06FBD /* VisitRaceKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F952A9F1DF7860700E06FBD /* VisitRaceKey.cpp */; };
+		0F952ABC1B487A7700C367C5 /* TrackedReferences.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F952ABA1B487A7700C367C5 /* TrackedReferences.cpp */; };
+		0F952ABD1B487A7700C367C5 /* TrackedReferences.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F952ABB1B487A7700C367C5 /* TrackedReferences.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9630391D4192C6005609D9 /* AllocatorAttributes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9630351D4192C3005609D9 /* AllocatorAttributes.cpp */; };
+		0F96303A1D4192C8005609D9 /* AllocatorAttributes.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9630361D4192C3005609D9 /* AllocatorAttributes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F96303B1D4192CB005609D9 /* DestructionMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9630371D4192C3005609D9 /* DestructionMode.cpp */; };
+		0F96303C1D4192CD005609D9 /* DestructionMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9630381D4192C3005609D9 /* DestructionMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F963B3813FC6FE90002D9B2 /* ValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F96EBB316676EF6008BADE3 /* CodeBlockWithJITType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F96EBB116676EF4008BADE3 /* CodeBlockWithJITType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9749711687ADE400A4FF6A /* JSCellInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F97496F1687ADE200A4FF6A /* JSCellInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F978B3B1AAEA71D007C7369 /* ConstantMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F978B3A1AAEA71D007C7369 /* ConstantMode.cpp */; };
+		0F98206016BFE38100240D02 /* PreciseJumpTargets.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F98205D16BFE37F00240D02 /* PreciseJumpTargets.cpp */; };
+		0F98206116BFE38300240D02 /* PreciseJumpTargets.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F98205E16BFE37F00240D02 /* PreciseJumpTargets.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F9B1DB41C0E42A500E5BFD2 /* FTLOutput.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9B1DB31C0E42A500E5BFD2 /* FTLOutput.cpp */; };
+		0F9B1DB71C0E42BD00E5BFD2 /* FTLOSRExitHandle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9B1DB51C0E42BD00E5BFD2 /* FTLOSRExitHandle.cpp */; };
+		0F9B1DB81C0E42BD00E5BFD2 /* FTLOSRExitHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9B1DB61C0E42BD00E5BFD2 /* FTLOSRExitHandle.h */; };
+		0F9CABC81DB54A780008E83B /* AirPadInterference.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9CABC61DB54A760008E83B /* AirPadInterference.cpp */; };
+		0F9CABC91DB54A7A0008E83B /* AirPadInterference.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9CABC71DB54A760008E83B /* AirPadInterference.h */; };
+		0F9D3370165DBB90005AD387 /* Disassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D336E165DBB8D005AD387 /* Disassembler.cpp */; };
+		0F9D339617FFC4E60073C2BC /* DFGFlushedAt.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D339417FFC4E60073C2BC /* DFGFlushedAt.cpp */; };
+		0F9D339717FFC4E60073C2BC /* DFGFlushedAt.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9D339517FFC4E60073C2BC /* DFGFlushedAt.h */; };
+		0F9D36941AE9CC33000D4DFB /* DFGCleanUpPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D36921AE9CC33000D4DFB /* DFGCleanUpPhase.cpp */; };
+		0F9D36951AE9CC33000D4DFB /* DFGCleanUpPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9D36931AE9CC33000D4DFB /* DFGCleanUpPhase.h */; };
+		0F9D4C0C1C3E1C11006CD984 /* FTLExceptionTarget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D4C0A1C3E1C11006CD984 /* FTLExceptionTarget.cpp */; };
+		0F9D4C0D1C3E1C11006CD984 /* FTLExceptionTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9D4C0B1C3E1C11006CD984 /* FTLExceptionTarget.h */; };
+		0F9D4C101C3E2C74006CD984 /* FTLPatchpointExceptionHandle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9D4C0E1C3E2C74006CD984 /* FTLPatchpointExceptionHandle.cpp */; };
+		0F9D4C111C3E2C74006CD984 /* FTLPatchpointExceptionHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9D4C0F1C3E2C74006CD984 /* FTLPatchpointExceptionHandle.h */; };
+		0F9E32631B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9E32611B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.cpp */; };
+		0F9E32641B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9E32621B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h */; };
+		0F9FB4F417FCB91700CB67F8 /* DFGStackLayoutPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F9FB4F217FCB91700CB67F8 /* DFGStackLayoutPhase.cpp */; };
+		0F9FB4F517FCB91700CB67F8 /* DFGStackLayoutPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */; };
+		0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FA131711D8DD72B00EC130A /* PrototypeMapInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA131701D8DD72900EC130A /* PrototypeMapInlines.h */; };
+		0FA2C17B17D7CF84009D015F /* TestRunnerUtils.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA2C17917D7CF84009D015F /* TestRunnerUtils.cpp */; };
+		0FA2C17C17D7CF84009D015F /* TestRunnerUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA2C17A17D7CF84009D015F /* TestRunnerUtils.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FA581BA150E952C00B9A2D9 /* DFGNodeFlags.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA581B7150E952A00B9A2D9 /* DFGNodeFlags.cpp */; };
+		0FA581BB150E953000B9A2D9 /* DFGNodeFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */; };
+		0FA581BC150E953000B9A2D9 /* DFGNodeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */; };
+		0FA762041DB9242600B7A2FD /* CollectionScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA762001DB9242300B7A2FD /* CollectionScope.cpp */; };
+		0FA762051DB9242900B7A2FD /* CollectionScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA762011DB9242300B7A2FD /* CollectionScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FA762061DB9243100B7A2FD /* MutatorState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA762021DB9242300B7A2FD /* MutatorState.cpp */; };
+		0FA762071DB9243300B7A2FD /* MutatorState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA762031DB9242300B7A2FD /* MutatorState.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FA762091DB9283E00B7A2FD /* HelpingGCScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA762081DB9283C00B7A2FD /* HelpingGCScope.h */; };
+		0FA7620B1DB959F900B7A2FD /* AllocatingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA7620A1DB959F600B7A2FD /* AllocatingScope.h */; };
+		0FA7A8EB18B413C80052371D /* Reg.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA7A8E918B413C80052371D /* Reg.cpp */; };
+		0FA7A8EC18B413C80052371D /* Reg.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA7A8EA18B413C80052371D /* Reg.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FA7A8EE18CE4FD80052371D /* ScratchRegisterAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FA7A8ED18CE4FD80052371D /* ScratchRegisterAllocator.cpp */; };
+		0FADE6731D4D23BE00768457 /* HeapUtil.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FADE6721D4D23BC00768457 /* HeapUtil.h */; };
+		0FAF7EFD165BA91B000C8455 /* JITDisassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FAF7EFA165BA919000C8455 /* JITDisassembler.cpp */; };
+		0FAF7EFE165BA91F000C8455 /* JITDisassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FAF7EFB165BA919000C8455 /* JITDisassembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB105821675480C00F8AB6E /* ExitKind.cpp */; };
+		0FB105861675481200F8AB6E /* ExitKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB105831675480C00F8AB6E /* ExitKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB1058B1675483100F8AB6E /* ProfilerOSRExit.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB105871675482E00F8AB6E /* ProfilerOSRExit.cpp */; };
+		0FB1058C1675483300F8AB6E /* ProfilerOSRExit.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB105881675482E00F8AB6E /* ProfilerOSRExit.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB1058D1675483700F8AB6E /* ProfilerOSRExitSite.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB105891675482E00F8AB6E /* ProfilerOSRExitSite.cpp */; };
+		0FB1058E1675483A00F8AB6E /* ProfilerOSRExitSite.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB1058A1675482E00F8AB6E /* ProfilerOSRExitSite.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB14E1E18124ACE009B6B4D /* JITInlineCacheGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB14E1C18124ACE009B6B4D /* JITInlineCacheGenerator.cpp */; };
+		0FB14E1F18124ACE009B6B4D /* JITInlineCacheGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB14E1D18124ACE009B6B4D /* JITInlineCacheGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB14E211812570B009B6B4D /* DFGInlineCacheWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB14E201812570B009B6B4D /* DFGInlineCacheWrapper.h */; };
+		0FB14E2318130955009B6B4D /* DFGInlineCacheWrapperInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB14E2218130955009B6B4D /* DFGInlineCacheWrapperInlines.h */; };
+		0FB17660196B8F9E0091052A /* DFGHeapLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB1765C196B8F9E0091052A /* DFGHeapLocation.cpp */; };
+		0FB17661196B8F9E0091052A /* DFGHeapLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB1765D196B8F9E0091052A /* DFGHeapLocation.h */; };
+		0FB17662196B8F9E0091052A /* DFGPureValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB1765E196B8F9E0091052A /* DFGPureValue.cpp */; };
+		0FB17663196B8F9E0091052A /* DFGPureValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB1765F196B8F9E0091052A /* DFGPureValue.h */; };
+		0FB3878E1BFBC44D00E3AB1E /* AirBlockWorklist.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB3878B1BFBC44D00E3AB1E /* AirBlockWorklist.h */; };
+		0FB3878F1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB3878C1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.cpp */; };
+		0FB387901BFBC44D00E3AB1E /* AirOptimizeBlockOrder.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB3878D1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.h */; };
+		0FB387921BFD31A100E3AB1E /* FTLCompile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB387911BFD31A100E3AB1E /* FTLCompile.cpp */; };
+		0FB415841D78FB4C00DF8D09 /* ArrayConventions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB415831D78F98200DF8D09 /* ArrayConventions.cpp */; };
+		0FB438A319270B1D00E1FBC9 /* StructureSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB438A219270B1D00E1FBC9 /* StructureSet.cpp */; };
+		0FB4767E1D99AEA9008EA6CB /* GCDeferralContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4767C1D99AEA7008EA6CB /* GCDeferralContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB4767F1D99AEAD008EA6CB /* GCDeferralContextInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4767D1D99AEA7008EA6CB /* GCDeferralContextInlines.h */; };
+		0FB4FB731BC843140025CA5A /* FTLLazySlowPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4FB701BC843140025CA5A /* FTLLazySlowPath.cpp */; };
+		0FB4FB741BC843140025CA5A /* FTLLazySlowPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4FB711BC843140025CA5A /* FTLLazySlowPath.h */; };
+		0FB4FB751BC843140025CA5A /* FTLLazySlowPathCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4FB721BC843140025CA5A /* FTLLazySlowPathCall.h */; };
+		0FB5467714F59B5C002C2989 /* LazyOperandValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB5467914F5C46B002C2989 /* LazyOperandValueProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */; };
+		0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB5467D14F5CFD6002C2989 /* MethodOfGettingAValueProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */; };
+		0FB7F39515ED8E4600F167B2 /* ArrayConventions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F38915ED8E3800F167B2 /* ArrayConventions.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39615ED8E4600F167B2 /* ArrayStorage.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F38A15ED8E3800F167B2 /* ArrayStorage.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39715ED8E4600F167B2 /* Butterfly.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F38B15ED8E3800F167B2 /* Butterfly.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39815ED8E4600F167B2 /* ButterflyInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F38C15ED8E3800F167B2 /* ButterflyInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39915ED8E4600F167B2 /* IndexingHeader.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F38D15ED8E3800F167B2 /* IndexingHeader.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39A15ED8E4600F167B2 /* IndexingHeaderInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F38E15ED8E3800F167B2 /* IndexingHeaderInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39B15ED8E4600F167B2 /* IndexingType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F38F15ED8E3800F167B2 /* IndexingType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39C15ED8E4600F167B2 /* PropertyStorage.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F39015ED8E3800F167B2 /* PropertyStorage.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39D15ED8E4600F167B2 /* TypeError.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F39115ED8E3800F167B2 /* TypeError.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FB7F39E15ED8E4600F167B2 /* SparseArrayValueMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB7F39215ED8E3800F167B2 /* SparseArrayValueMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FBB73B81DEF3AAE002C009E /* PreventCollectionScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBB73B61DEF3AAC002C009E /* PreventCollectionScope.h */; };
+		0FBB73BB1DEF8645002C009E /* DeleteAllCodeEffort.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBB73BA1DEF8644002C009E /* DeleteAllCodeEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FBC0AE71496C7C400D4FBDD /* DFGExitProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FBC0AE41496C7C100D4FBDD /* DFGExitProfile.cpp */; };
+		0FBC0AE81496C7C700D4FBDD /* DFGExitProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBC0AE51496C7C100D4FBDD /* DFGExitProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FBD7E691447999600481315 /* CodeOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBD7E671447998F00481315 /* CodeOrigin.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FBDB9AD1AB0FBC6000B57E5 /* DFGCallCreateDirectArgumentsSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBDB9AC1AB0FBC6000B57E5 /* DFGCallCreateDirectArgumentsSlowPathGenerator.h */; };
+		0FBE0F7216C1DB030082C5E8 /* DFGCPSRethreadingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FBE0F6B16C1DB010082C5E8 /* DFGCPSRethreadingPhase.cpp */; };
+		0FBE0F7316C1DB050082C5E8 /* DFGCPSRethreadingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBE0F6C16C1DB010082C5E8 /* DFGCPSRethreadingPhase.h */; };
+		0FBE0F7416C1DB090082C5E8 /* DFGPredictionInjectionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FBE0F6D16C1DB010082C5E8 /* DFGPredictionInjectionPhase.cpp */; };
+		0FBE0F7516C1DB0B0082C5E8 /* DFGPredictionInjectionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBE0F6E16C1DB010082C5E8 /* DFGPredictionInjectionPhase.h */; };
+		0FBE0F7616C1DB0F0082C5E8 /* DFGUnificationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FBE0F6F16C1DB010082C5E8 /* DFGUnificationPhase.cpp */; };
+		0FBE0F7716C1DB120082C5E8 /* DFGUnificationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBE0F7016C1DB010082C5E8 /* DFGUnificationPhase.h */; };
+		0FBF158C19B7A53100695DD0 /* DFGBlockSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FBF158A19B7A53100695DD0 /* DFGBlockSet.cpp */; };
+		0FBF158D19B7A53100695DD0 /* DFGBlockSetInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FBF158B19B7A53100695DD0 /* DFGBlockSetInlines.h */; };
+		0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC097681468A6EF00CF2442 /* DFGOSRExit.h */; };
+		0FC0977114693AF500CF2442 /* DFGOSRExitCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC0976F14693AEF00CF2442 /* DFGOSRExitCompiler.h */; };
+		0FC0977214693AF900CF2442 /* DFGOSRExitCompiler64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC0977014693AEF00CF2442 /* DFGOSRExitCompiler64.cpp */; };
+		0FC09776146943B000CF2442 /* DFGOSRExitCompiler32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC09775146943AD00CF2442 /* DFGOSRExitCompiler32_64.cpp */; };
+		0FC09791146A6F7100CF2442 /* DFGOSRExit.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC0978E146A6F6300CF2442 /* DFGOSRExit.cpp */; };
+		0FC09792146A6F7300CF2442 /* DFGOSRExitCompiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC0978F146A6F6300CF2442 /* DFGOSRExitCompiler.cpp */; };
+		0FC097A1146B28CA00CF2442 /* DFGThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC0979F146B28C700CF2442 /* DFGThunks.cpp */; };
+		0FC097A2146B28CC00CF2442 /* DFGThunks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC097A0146B28C700CF2442 /* DFGThunks.h */; };
+		0FC20CB51852E2C600C9E954 /* DFGStrengthReductionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC20CB31852E2C600C9E954 /* DFGStrengthReductionPhase.cpp */; };
+		0FC20CB61852E2C600C9E954 /* DFGStrengthReductionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC20CB41852E2C600C9E954 /* DFGStrengthReductionPhase.h */; };
+		0FC20CB918556A3500C9E954 /* DFGSSALoweringPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC20CB718556A3500C9E954 /* DFGSSALoweringPhase.cpp */; };
+		0FC20CBA18556A3500C9E954 /* DFGSSALoweringPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC20CB818556A3500C9E954 /* DFGSSALoweringPhase.h */; };
+		0FC314121814559100033232 /* RegisterSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC314101814559100033232 /* RegisterSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FC314131814559100033232 /* TempRegisterSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC314111814559100033232 /* TempRegisterSet.cpp */; };
+		0FC3141518146D7000033232 /* RegisterSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC3141418146D7000033232 /* RegisterSet.cpp */; };
+		0FC3CCFC19ADA410006AC72A /* DFGBlockMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC3CCF519ADA410006AC72A /* DFGBlockMap.h */; };
+		0FC3CCFD19ADA410006AC72A /* DFGBlockMapInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC3CCF619ADA410006AC72A /* DFGBlockMapInlines.h */; };
+		0FC3CCFE19ADA410006AC72A /* DFGBlockSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC3CCF719ADA410006AC72A /* DFGBlockSet.h */; };
+		0FC3CD0019ADA410006AC72A /* DFGBlockWorklist.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC3CCF919ADA410006AC72A /* DFGBlockWorklist.h */; };
+		0FC712DE17CD8779008CC93C /* DeferredCompilationCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC712DC17CD8778008CC93C /* DeferredCompilationCallback.cpp */; };
+		0FC712DF17CD877C008CC93C /* DeferredCompilationCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC712DD17CD8778008CC93C /* DeferredCompilationCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FC712E217CD8791008CC93C /* JITToDFGDeferredCompilationCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC712E017CD878F008CC93C /* JITToDFGDeferredCompilationCallback.cpp */; };
+		0FC712E317CD8793008CC93C /* JITToDFGDeferredCompilationCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC712E117CD878F008CC93C /* JITToDFGDeferredCompilationCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FC8150A14043BF500CFA603 /* WriteBarrierSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC8150914043BD200CFA603 /* WriteBarrierSupport.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FC8150B14043C0E00CFA603 /* WriteBarrierSupport.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC8150814043BCA00CFA603 /* WriteBarrierSupport.cpp */; };
+		0FC841681BA8C3210061837D /* DFGInferredTypeCheck.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC841661BA8C3210061837D /* DFGInferredTypeCheck.cpp */; };
+		0FC841691BA8C3210061837D /* DFGInferredTypeCheck.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC841671BA8C3210061837D /* DFGInferredTypeCheck.h */; };
+		0FC97F33182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC97F2F182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.cpp */; };
+		0FC97F34182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC97F30182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FC97F3D18202119002C9B26 /* DFGInvalidationPointInjectionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC97F3718202119002C9B26 /* DFGInvalidationPointInjectionPhase.cpp */; };
+		0FC97F3E18202119002C9B26 /* DFGInvalidationPointInjectionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC97F3818202119002C9B26 /* DFGInvalidationPointInjectionPhase.h */; };
+		0FC97F3F18202119002C9B26 /* DFGJumpReplacement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC97F3918202119002C9B26 /* DFGJumpReplacement.cpp */; };
+		0FC97F4018202119002C9B26 /* DFGJumpReplacement.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC97F3A18202119002C9B26 /* DFGJumpReplacement.h */; };
+		0FC97F4118202119002C9B26 /* DFGWatchpointCollectionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC97F3B18202119002C9B26 /* DFGWatchpointCollectionPhase.cpp */; };
+		0FC97F4218202119002C9B26 /* DFGWatchpointCollectionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC97F3C18202119002C9B26 /* DFGWatchpointCollectionPhase.h */; };
+		0FCCAE4516D0CF7400D0C65B /* ParserError.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FCCAE4316D0CF6E00D0C65B /* ParserError.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FCEFAAB1804C13E00472CE4 /* FTLSaveRestore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FCEFAA91804C13E00472CE4 /* FTLSaveRestore.cpp */; };
+		0FCEFAAC1804C13E00472CE4 /* FTLSaveRestore.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FCEFAAA1804C13E00472CE4 /* FTLSaveRestore.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FCEFADF180738C000472CE4 /* FTLLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FCEFADD180738C000472CE4 /* FTLLocation.cpp */; };
+		0FCEFAE0180738C000472CE4 /* FTLLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FCEFADE180738C000472CE4 /* FTLLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD2C92316D01EE900C7803F /* StructureInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD3C82614115D4000FD81CB /* DFGDriver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3C82014115CF800FD81CB /* DFGDriver.cpp */; };
+		0FD3C82814115D4F00FD81CB /* DFGDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3C82214115D0E00FD81CB /* DFGDriver.h */; };
+		0FD3E4011B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3E3FF1B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp */; };
+		0FD3E4021B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3E4001B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.h */; };
+		0FD3E4091B618B6600C80E1E /* ObjectPropertyCondition.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3E4031B618B6600C80E1E /* ObjectPropertyCondition.cpp */; };
+		0FD3E40A1B618B6600C80E1E /* ObjectPropertyCondition.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3E4041B618B6600C80E1E /* ObjectPropertyCondition.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD3E40B1B618B6600C80E1E /* ObjectPropertyConditionSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3E4051B618B6600C80E1E /* ObjectPropertyConditionSet.cpp */; };
+		0FD3E40C1B618B6600C80E1E /* ObjectPropertyConditionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3E4061B618B6600C80E1E /* ObjectPropertyConditionSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD3E40D1B618B6600C80E1E /* PropertyCondition.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3E4071B618B6600C80E1E /* PropertyCondition.cpp */; };
+		0FD3E40E1B618B6600C80E1E /* PropertyCondition.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3E4081B618B6600C80E1E /* PropertyCondition.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD81AD3154FB4F000983E72 /* DFGDominators.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD81AD0154FB4EB00983E72 /* DFGDominators.h */; };
+		0FD82E2114172CE300179C94 /* DFGCapabilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */; };
+		0FD82E39141AB14D00179C94 /* CompactJITCodeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E37141AB14200179C94 /* CompactJITCodeMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD82E54141DAEEE00179C94 /* SpeculatedType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E4F141DAEA100179C94 /* SpeculatedType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD82E56141DAF0800179C94 /* DFGOSREntry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E52141DAEDE00179C94 /* DFGOSREntry.cpp */; };
+		0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E53141DAEDE00179C94 /* DFGOSREntry.h */; };
+		0FD82E86141F3FF100179C94 /* SpeculatedType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */; };
+		0FD8A31317D4326C00CA2C40 /* CodeBlockSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD8A31117D4326C00CA2C40 /* CodeBlockSet.cpp */; };
+		0FD8A31417D4326C00CA2C40 /* CodeBlockSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD8A31217D4326C00CA2C40 /* CodeBlockSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD8A31917D51F2200CA2C40 /* FTLForOSREntryJITCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD8A31517D51F2200CA2C40 /* FTLForOSREntryJITCode.cpp */; };
+		0FD8A31A17D51F2200CA2C40 /* FTLForOSREntryJITCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD8A31617D51F2200CA2C40 /* FTLForOSREntryJITCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD8A31B17D51F2200CA2C40 /* FTLOSREntry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD8A31717D51F2200CA2C40 /* FTLOSREntry.cpp */; };
+		0FD8A31C17D51F2200CA2C40 /* FTLOSREntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD8A31817D51F2200CA2C40 /* FTLOSREntry.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FD8A32517D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD8A31D17D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.cpp */; };
+		0FD8A32617D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD8A31E17D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h */; };
+		0FD8A32717D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD8A31F17D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.cpp */; };
+		0FD8A32817D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD8A32017D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.h */; };
+		0FD8A32917D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD8A32117D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.cpp */; };
+		0FD8A32A17D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD8A32217D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.h */; };
+		0FD8A32B17D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD8A32317D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.cpp */; };
+		0FD8A32C17D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD8A32417D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.h */; };
+		0FDB2CC9173DA520007B3C1B /* FTLAbbreviatedTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDB2CC7173DA51E007B3C1B /* FTLAbbreviatedTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FDB2CCA173DA523007B3C1B /* FTLValueFromBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDB2CC8173DA51E007B3C1B /* FTLValueFromBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FDB2CE7174830A2007B3C1B /* DFGWorklist.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FDB2CE5174830A2007B3C1B /* DFGWorklist.cpp */; };
+		0FDB2CE8174830A2007B3C1B /* DFGWorklist.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDB2CE6174830A2007B3C1B /* DFGWorklist.h */; };
+		0FDB2CEA174896C7007B3C1B /* ConcurrentJSLock.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDB2CE9174896C7007B3C1B /* ConcurrentJSLock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FDDBFB51666EED800C55FEF /* DFGVariableAccessDataDump.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FDDBFB21666EED500C55FEF /* DFGVariableAccessDataDump.cpp */; };
+		0FDDBFB61666EEDA00C55FEF /* DFGVariableAccessDataDump.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDDBFB31666EED500C55FEF /* DFGVariableAccessDataDump.h */; };
+		0FDE87F91DFD0C760064C390 /* CellContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FDE87F81DFD0C6D0064C390 /* CellContainer.cpp */; };
+		0FDE87FC1DFE6E510064C390 /* SpaceTimeMutatorScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDE87FB1DFE6E500064C390 /* SpaceTimeMutatorScheduler.h */; };
+		0FDE87FD1DFE6E540064C390 /* SpaceTimeMutatorScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FDE87FA1DFE6E500064C390 /* SpaceTimeMutatorScheduler.cpp */; };
+		0FDF67D21D9C6D27001B9825 /* B3Kind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDF67D11D9C6086001B9825 /* B3Kind.h */; };
+		0FDF67D31D9C6D2A001B9825 /* B3Kind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FDF67D01D9C6086001B9825 /* B3Kind.cpp */; };
+		0FDF67D61D9DC440001B9825 /* AirKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FDF67D41D9DC43E001B9825 /* AirKind.cpp */; };
+		0FDF67D71D9DC442001B9825 /* AirKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDF67D51D9DC43E001B9825 /* AirKind.h */; };
+		0FDF70851D3F2C2200927449 /* AirLowerEntrySwitch.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FDF70831D3F2C1F00927449 /* AirLowerEntrySwitch.cpp */; };
+		0FDF70861D3F2C2500927449 /* AirLowerEntrySwitch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDF70841D3F2C1F00927449 /* AirLowerEntrySwitch.h */; };
+		0FE050141AA9091100D33B33 /* ArgumentsMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE0500C1AA9091100D33B33 /* ArgumentsMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE050151AA9091100D33B33 /* DirectArgumentsOffset.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE0500D1AA9091100D33B33 /* DirectArgumentsOffset.cpp */; };
+		0FE050161AA9091100D33B33 /* DirectArgumentsOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE0500E1AA9091100D33B33 /* DirectArgumentsOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE050171AA9091100D33B33 /* DirectArguments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE0500F1AA9091100D33B33 /* DirectArguments.cpp */; };
+		0FE050181AA9091100D33B33 /* DirectArguments.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE050101AA9091100D33B33 /* DirectArguments.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE050191AA9091100D33B33 /* GenericArguments.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE050111AA9091100D33B33 /* GenericArguments.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE0501A1AA9091100D33B33 /* GenericArgumentsInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE050121AA9091100D33B33 /* GenericArgumentsInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE0501B1AA9091100D33B33 /* GenericOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE050131AA9091100D33B33 /* GenericOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE050251AA9095600D33B33 /* ClonedArguments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE0501C1AA9095600D33B33 /* ClonedArguments.cpp */; };
+		0FE050261AA9095600D33B33 /* ClonedArguments.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE0501D1AA9095600D33B33 /* ClonedArguments.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE050271AA9095600D33B33 /* ScopedArguments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE0501E1AA9095600D33B33 /* ScopedArguments.cpp */; };
+		0FE050281AA9095600D33B33 /* ScopedArguments.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE0501F1AA9095600D33B33 /* ScopedArguments.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE050291AA9095600D33B33 /* ScopedArgumentsTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE050201AA9095600D33B33 /* ScopedArgumentsTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE0502A1AA9095600D33B33 /* ScopeOffset.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE050211AA9095600D33B33 /* ScopeOffset.cpp */; };
+		0FE0502B1AA9095600D33B33 /* ScopeOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE050221AA9095600D33B33 /* ScopeOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE0502C1AA9095600D33B33 /* VarOffset.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE050231AA9095600D33B33 /* VarOffset.cpp */; };
+		0FE0502D1AA9095600D33B33 /* VarOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE050241AA9095600D33B33 /* VarOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE0502F1AAA806900D33B33 /* ScopedArgumentsTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE0502E1AAA806900D33B33 /* ScopedArgumentsTable.cpp */; };
+		0FE0E4AD1C24C94A002E17B6 /* AirTmpWidth.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE0E4AB1C24C94A002E17B6 /* AirTmpWidth.cpp */; };
+		0FE0E4AE1C24C94A002E17B6 /* AirTmpWidth.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE0E4AC1C24C94A002E17B6 /* AirTmpWidth.h */; };
+		0FE228ED1436AB2700196C48 /* Options.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE228EB1436AB2300196C48 /* Options.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE228EE1436AB2C00196C48 /* Options.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE228EA1436AB2300196C48 /* Options.cpp */; };
+		0FE254F61ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE254F41ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.cpp */; };
+		0FE254F71ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE254F51ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.h */; };
+		0FE34C191C4B39AE0003A512 /* AirLogRegisterPressure.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE34C171C4B39AE0003A512 /* AirLogRegisterPressure.cpp */; };
+		0FE34C1A1C4B39AE0003A512 /* AirLogRegisterPressure.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE34C181C4B39AE0003A512 /* AirLogRegisterPressure.h */; };
+		0FE7211D193B9C590031F6ED /* DFGTransition.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE7211B193B9C590031F6ED /* DFGTransition.cpp */; };
+		0FE7211E193B9C590031F6ED /* DFGTransition.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE7211C193B9C590031F6ED /* DFGTransition.h */; };
+		0FE834171A6EF97B00D04847 /* PolymorphicCallStubRoutine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE834151A6EF97B00D04847 /* PolymorphicCallStubRoutine.cpp */; };
+		0FE834181A6EF97B00D04847 /* PolymorphicCallStubRoutine.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE834161A6EF97B00D04847 /* PolymorphicCallStubRoutine.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FE8534B1723CDA500B618F5 /* DFGDesiredWatchpoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */; };
+		0FE8534C1723CDA500B618F5 /* DFGDesiredWatchpoints.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE8534A1723CDA500B618F5 /* DFGDesiredWatchpoints.h */; };
+		0FEA0A09170513DB00BB722C /* FTLCapabilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA09FE170513DB00BB722C /* FTLCapabilities.cpp */; };
+		0FEA0A0A170513DB00BB722C /* FTLCapabilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA09FF170513DB00BB722C /* FTLCapabilities.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A0C170513DB00BB722C /* FTLCompile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A01170513DB00BB722C /* FTLCompile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A0D170513DB00BB722C /* FTLJITCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA0A02170513DB00BB722C /* FTLJITCode.cpp */; };
+		0FEA0A0E170513DB00BB722C /* FTLJITCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A03170513DB00BB722C /* FTLJITCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A0F170513DB00BB722C /* FTLLowerDFGToB3.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA0A04170513DB00BB722C /* FTLLowerDFGToB3.cpp */; };
+		0FEA0A10170513DB00BB722C /* FTLLowerDFGToB3.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A05170513DB00BB722C /* FTLLowerDFGToB3.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A12170513DB00BB722C /* FTLState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A07170513DB00BB722C /* FTLState.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A161706BB9000BB722C /* FTLState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA0A151706BB9000BB722C /* FTLState.cpp */; };
+		0FEA0A1C1708B00700BB722C /* FTLAbstractHeap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA0A171708B00700BB722C /* FTLAbstractHeap.cpp */; };
+		0FEA0A1D1708B00700BB722C /* FTLAbstractHeap.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A181708B00700BB722C /* FTLAbstractHeap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A1E1708B00700BB722C /* FTLAbstractHeapRepository.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA0A191708B00700BB722C /* FTLAbstractHeapRepository.cpp */; };
+		0FEA0A1F1708B00700BB722C /* FTLAbstractHeapRepository.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A1A1708B00700BB722C /* FTLAbstractHeapRepository.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A201708B00700BB722C /* FTLTypedPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A1B1708B00700BB722C /* FTLTypedPointer.h */; };
+		0FEA0A231709606900BB722C /* FTLCommonValues.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A211709606900BB722C /* FTLCommonValues.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A271709623B00BB722C /* FTLCommonValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA0A251709623B00BB722C /* FTLCommonValues.cpp */; };
+		0FEA0A2C170B661900BB722C /* FTLFormattedValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A2B170B661900BB722C /* FTLFormattedValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEA0A31170D40BF00BB722C /* DFGCommonData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA0A2D170D40BF00BB722C /* DFGCommonData.cpp */; };
+		0FEA0A32170D40BF00BB722C /* DFGCommonData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A2E170D40BF00BB722C /* DFGCommonData.h */; };
+		0FEA0A33170D40BF00BB722C /* DFGJITCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEA0A2F170D40BF00BB722C /* DFGJITCode.cpp */; };
+		0FEA0A34170D40BF00BB722C /* DFGJITCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEA0A30170D40BF00BB722C /* DFGJITCode.h */; };
+		0FEB3ECF16237F6C00AB67AD /* MacroAssembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEB3ECE16237F6700AB67AD /* MacroAssembler.cpp */; };
+		0FEC84FE1BDACDAC0080FF74 /* B3ArgumentRegValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84B41BDACDAC0080FF74 /* B3ArgumentRegValue.cpp */; };
+		0FEC84FF1BDACDAC0080FF74 /* B3ArgumentRegValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84B51BDACDAC0080FF74 /* B3ArgumentRegValue.h */; };
+		0FEC85001BDACDAC0080FF74 /* B3BasicBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84B61BDACDAC0080FF74 /* B3BasicBlock.cpp */; };
+		0FEC85011BDACDAC0080FF74 /* B3BasicBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84B71BDACDAC0080FF74 /* B3BasicBlock.h */; };
+		0FEC85021BDACDAC0080FF74 /* B3BasicBlockInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84B81BDACDAC0080FF74 /* B3BasicBlockInlines.h */; };
+		0FEC85031BDACDAC0080FF74 /* B3BasicBlockUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84B91BDACDAC0080FF74 /* B3BasicBlockUtils.h */; };
+		0FEC85041BDACDAC0080FF74 /* B3BlockWorklist.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84BA1BDACDAC0080FF74 /* B3BlockWorklist.h */; };
+		0FEC85051BDACDAC0080FF74 /* B3CheckSpecial.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84BB1BDACDAC0080FF74 /* B3CheckSpecial.cpp */; };
+		0FEC85061BDACDAC0080FF74 /* B3CheckSpecial.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84BC1BDACDAC0080FF74 /* B3CheckSpecial.h */; };
+		0FEC85071BDACDAC0080FF74 /* B3CheckValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84BD1BDACDAC0080FF74 /* B3CheckValue.cpp */; };
+		0FEC85081BDACDAC0080FF74 /* B3CheckValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84BE1BDACDAC0080FF74 /* B3CheckValue.h */; };
+		0FEC85091BDACDAC0080FF74 /* B3Common.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84BF1BDACDAC0080FF74 /* B3Common.cpp */; };
+		0FEC850A1BDACDAC0080FF74 /* B3Common.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84C01BDACDAC0080FF74 /* B3Common.h */; };
+		0FEC850B1BDACDAC0080FF74 /* B3Commutativity.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84C11BDACDAC0080FF74 /* B3Commutativity.cpp */; };
+		0FEC850C1BDACDAC0080FF74 /* B3Commutativity.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84C21BDACDAC0080FF74 /* B3Commutativity.h */; };
+		0FEC850D1BDACDAC0080FF74 /* B3Const32Value.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84C31BDACDAC0080FF74 /* B3Const32Value.cpp */; };
+		0FEC850E1BDACDAC0080FF74 /* B3Const32Value.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84C41BDACDAC0080FF74 /* B3Const32Value.h */; };
+		0FEC850F1BDACDAC0080FF74 /* B3Const64Value.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84C51BDACDAC0080FF74 /* B3Const64Value.cpp */; };
+		0FEC85101BDACDAC0080FF74 /* B3Const64Value.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84C61BDACDAC0080FF74 /* B3Const64Value.h */; };
+		0FEC85111BDACDAC0080FF74 /* B3ConstDoubleValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84C71BDACDAC0080FF74 /* B3ConstDoubleValue.cpp */; };
+		0FEC85121BDACDAC0080FF74 /* B3ConstDoubleValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84C81BDACDAC0080FF74 /* B3ConstDoubleValue.h */; };
+		0FEC85151BDACDAC0080FF74 /* B3FrequencyClass.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84CB1BDACDAC0080FF74 /* B3FrequencyClass.cpp */; };
+		0FEC85161BDACDAC0080FF74 /* B3FrequencyClass.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84CC1BDACDAC0080FF74 /* B3FrequencyClass.h */; };
+		0FEC85171BDACDAC0080FF74 /* B3FrequentedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84CD1BDACDAC0080FF74 /* B3FrequentedBlock.h */; };
+		0FEC85181BDACDAC0080FF74 /* B3Generate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84CE1BDACDAC0080FF74 /* B3Generate.cpp */; };
+		0FEC85191BDACDAC0080FF74 /* B3Generate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84CF1BDACDAC0080FF74 /* B3Generate.h */; };
+		0FEC851A1BDACDAC0080FF74 /* B3GenericFrequentedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84D01BDACDAC0080FF74 /* B3GenericFrequentedBlock.h */; };
+		0FEC851D1BDACDAC0080FF74 /* B3LowerToAir.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84D31BDACDAC0080FF74 /* B3LowerToAir.cpp */; };
+		0FEC851E1BDACDAC0080FF74 /* B3LowerToAir.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84D41BDACDAC0080FF74 /* B3LowerToAir.h */; };
+		0FEC851F1BDACDAC0080FF74 /* B3MemoryValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84D51BDACDAC0080FF74 /* B3MemoryValue.cpp */; };
+		0FEC85201BDACDAC0080FF74 /* B3MemoryValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84D61BDACDAC0080FF74 /* B3MemoryValue.h */; };
+		0FEC85211BDACDAC0080FF74 /* B3Opcode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84D71BDACDAC0080FF74 /* B3Opcode.cpp */; };
+		0FEC85221BDACDAC0080FF74 /* B3Opcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84D81BDACDAC0080FF74 /* B3Opcode.h */; };
+		0FEC85231BDACDAC0080FF74 /* B3Origin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84D91BDACDAC0080FF74 /* B3Origin.cpp */; };
+		0FEC85241BDACDAC0080FF74 /* B3Origin.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84DA1BDACDAC0080FF74 /* B3Origin.h */; };
+		0FEC85251BDACDAC0080FF74 /* B3PatchpointSpecial.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84DB1BDACDAC0080FF74 /* B3PatchpointSpecial.cpp */; };
+		0FEC85261BDACDAC0080FF74 /* B3PatchpointSpecial.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84DC1BDACDAC0080FF74 /* B3PatchpointSpecial.h */; };
+		0FEC85271BDACDAC0080FF74 /* B3PatchpointValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84DD1BDACDAC0080FF74 /* B3PatchpointValue.cpp */; };
+		0FEC85281BDACDAC0080FF74 /* B3PatchpointValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84DE1BDACDAC0080FF74 /* B3PatchpointValue.h */; };
+		0FEC85291BDACDAC0080FF74 /* B3PhaseScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84DF1BDACDAC0080FF74 /* B3PhaseScope.cpp */; };
+		0FEC852A1BDACDAC0080FF74 /* B3PhaseScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84E01BDACDAC0080FF74 /* B3PhaseScope.h */; };
+		0FEC852B1BDACDAC0080FF74 /* B3Procedure.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84E11BDACDAC0080FF74 /* B3Procedure.cpp */; };
+		0FEC852C1BDACDAC0080FF74 /* B3Procedure.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84E21BDACDAC0080FF74 /* B3Procedure.h */; };
+		0FEC852D1BDACDAC0080FF74 /* B3ProcedureInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84E31BDACDAC0080FF74 /* B3ProcedureInlines.h */; };
+		0FEC85301BDACDAC0080FF74 /* B3StackmapSpecial.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84E61BDACDAC0080FF74 /* B3StackmapSpecial.cpp */; };
+		0FEC85311BDACDAC0080FF74 /* B3StackmapSpecial.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84E71BDACDAC0080FF74 /* B3StackmapSpecial.h */; };
+		0FEC85341BDACDAC0080FF74 /* B3SlotBaseValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84EA1BDACDAC0080FF74 /* B3SlotBaseValue.cpp */; };
+		0FEC85351BDACDAC0080FF74 /* B3SlotBaseValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84EB1BDACDAC0080FF74 /* B3SlotBaseValue.h */; };
+		0FEC85361BDACDAC0080FF74 /* B3SuccessorCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84EC1BDACDAC0080FF74 /* B3SuccessorCollection.h */; };
+		0FEC85371BDACDAC0080FF74 /* B3SwitchCase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84ED1BDACDAC0080FF74 /* B3SwitchCase.cpp */; };
+		0FEC85381BDACDAC0080FF74 /* B3SwitchCase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84EE1BDACDAC0080FF74 /* B3SwitchCase.h */; };
+		0FEC85391BDACDAC0080FF74 /* B3SwitchValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84EF1BDACDAC0080FF74 /* B3SwitchValue.cpp */; };
+		0FEC853A1BDACDAC0080FF74 /* B3SwitchValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84F01BDACDAC0080FF74 /* B3SwitchValue.h */; };
+		0FEC853B1BDACDAC0080FF74 /* B3Type.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84F11BDACDAC0080FF74 /* B3Type.cpp */; };
+		0FEC853C1BDACDAC0080FF74 /* B3Type.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84F21BDACDAC0080FF74 /* B3Type.h */; };
+		0FEC853D1BDACDAC0080FF74 /* B3UpsilonValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84F31BDACDAC0080FF74 /* B3UpsilonValue.cpp */; };
+		0FEC853E1BDACDAC0080FF74 /* B3UpsilonValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84F41BDACDAC0080FF74 /* B3UpsilonValue.h */; };
+		0FEC853F1BDACDAC0080FF74 /* B3UseCounts.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84F51BDACDAC0080FF74 /* B3UseCounts.cpp */; };
+		0FEC85401BDACDAC0080FF74 /* B3UseCounts.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84F61BDACDAC0080FF74 /* B3UseCounts.h */; };
+		0FEC85411BDACDAC0080FF74 /* B3Validate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84F71BDACDAC0080FF74 /* B3Validate.cpp */; };
+		0FEC85421BDACDAC0080FF74 /* B3Validate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84F81BDACDAC0080FF74 /* B3Validate.h */; };
+		0FEC85431BDACDAC0080FF74 /* B3Value.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84F91BDACDAC0080FF74 /* B3Value.cpp */; };
+		0FEC85441BDACDAC0080FF74 /* B3Value.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84FA1BDACDAC0080FF74 /* B3Value.h */; };
+		0FEC85451BDACDAC0080FF74 /* B3ValueInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84FB1BDACDAC0080FF74 /* B3ValueInlines.h */; };
+		0FEC85461BDACDAC0080FF74 /* B3ValueRep.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84FC1BDACDAC0080FF74 /* B3ValueRep.cpp */; };
+		0FEC85471BDACDAC0080FF74 /* B3ValueRep.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84FD1BDACDAC0080FF74 /* B3ValueRep.h */; };
+		0FEC856D1BDACDC70080FF74 /* AirAllocateStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85481BDACDC70080FF74 /* AirAllocateStack.cpp */; };
+		0FEC856E1BDACDC70080FF74 /* AirAllocateStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85491BDACDC70080FF74 /* AirAllocateStack.h */; };
+		0FEC856F1BDACDC70080FF74 /* AirArg.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC854A1BDACDC70080FF74 /* AirArg.cpp */; };
+		0FEC85701BDACDC70080FF74 /* AirArg.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC854B1BDACDC70080FF74 /* AirArg.h */; };
+		0FEC85711BDACDC70080FF74 /* AirBasicBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC854C1BDACDC70080FF74 /* AirBasicBlock.cpp */; };
+		0FEC85721BDACDC70080FF74 /* AirBasicBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC854D1BDACDC70080FF74 /* AirBasicBlock.h */; };
+		0FEC85731BDACDC70080FF74 /* AirCCallSpecial.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC854E1BDACDC70080FF74 /* AirCCallSpecial.cpp */; };
+		0FEC85741BDACDC70080FF74 /* AirCCallSpecial.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC854F1BDACDC70080FF74 /* AirCCallSpecial.h */; };
+		0FEC85751BDACDC70080FF74 /* AirCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85501BDACDC70080FF74 /* AirCode.cpp */; };
+		0FEC85761BDACDC70080FF74 /* AirCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85511BDACDC70080FF74 /* AirCode.h */; };
+		0FEC85771BDACDC70080FF74 /* AirFrequentedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85521BDACDC70080FF74 /* AirFrequentedBlock.h */; };
+		0FEC85781BDACDC70080FF74 /* AirGenerate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85531BDACDC70080FF74 /* AirGenerate.cpp */; };
+		0FEC85791BDACDC70080FF74 /* AirGenerate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85541BDACDC70080FF74 /* AirGenerate.h */; };
+		0FEC857A1BDACDC70080FF74 /* AirGenerationContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85551BDACDC70080FF74 /* AirGenerationContext.h */; };
+		0FEC857B1BDACDC70080FF74 /* AirHandleCalleeSaves.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85561BDACDC70080FF74 /* AirHandleCalleeSaves.cpp */; };
+		0FEC857C1BDACDC70080FF74 /* AirHandleCalleeSaves.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85571BDACDC70080FF74 /* AirHandleCalleeSaves.h */; };
+		0FEC857D1BDACDC70080FF74 /* AirInsertionSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85581BDACDC70080FF74 /* AirInsertionSet.cpp */; };
+		0FEC857E1BDACDC70080FF74 /* AirInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85591BDACDC70080FF74 /* AirInsertionSet.h */; };
+		0FEC857F1BDACDC70080FF74 /* AirInst.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC855A1BDACDC70080FF74 /* AirInst.cpp */; };
+		0FEC85801BDACDC70080FF74 /* AirInst.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC855B1BDACDC70080FF74 /* AirInst.h */; };
+		0FEC85811BDACDC70080FF74 /* AirInstInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC855C1BDACDC70080FF74 /* AirInstInlines.h */; };
+		0FEC85831BDACDC70080FF74 /* AirPhaseScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC855E1BDACDC70080FF74 /* AirPhaseScope.cpp */; };
+		0FEC85841BDACDC70080FF74 /* AirPhaseScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC855F1BDACDC70080FF74 /* AirPhaseScope.h */; };
+		0FEC85871BDACDC70080FF74 /* AirSpecial.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85621BDACDC70080FF74 /* AirSpecial.cpp */; };
+		0FEC85881BDACDC70080FF74 /* AirSpecial.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85631BDACDC70080FF74 /* AirSpecial.h */; };
+		0FEC85891BDACDC70080FF74 /* AirSpillEverything.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85641BDACDC70080FF74 /* AirSpillEverything.cpp */; };
+		0FEC858A1BDACDC70080FF74 /* AirSpillEverything.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85651BDACDC70080FF74 /* AirSpillEverything.h */; };
+		0FEC858B1BDACDC70080FF74 /* AirStackSlot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85661BDACDC70080FF74 /* AirStackSlot.cpp */; };
+		0FEC858C1BDACDC70080FF74 /* AirStackSlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85671BDACDC70080FF74 /* AirStackSlot.h */; };
+		0FEC858D1BDACDC70080FF74 /* AirTmp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85681BDACDC70080FF74 /* AirTmp.cpp */; };
+		0FEC858E1BDACDC70080FF74 /* AirTmp.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85691BDACDC70080FF74 /* AirTmp.h */; };
+		0FEC858F1BDACDC70080FF74 /* AirTmpInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC856A1BDACDC70080FF74 /* AirTmpInlines.h */; };
+		0FEC85901BDACDC70080FF74 /* AirValidate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC856B1BDACDC70080FF74 /* AirValidate.cpp */; };
+		0FEC85911BDACDC70080FF74 /* AirValidate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC856C1BDACDC70080FF74 /* AirValidate.h */; };
+		0FEC85931BDB1E100080FF74 /* AirGenerated.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85921BDB1E100080FF74 /* AirGenerated.cpp */; };
+		0FEC85A31BDB5CF10080FF74 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
+		0FEC85A41BDB5CF10080FF74 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		0FEC85AF1BDB5D5E0080FF74 /* testb3.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85AE1BDB5D5E0080FF74 /* testb3.cpp */; settings = {COMPILER_FLAGS = "-O0"; }; };
+		0FEC85B31BDED9570080FF74 /* B3ConstPtrValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85B21BDED9570080FF74 /* B3ConstPtrValue.h */; };
+		0FEC85B91BE1462F0080FF74 /* B3InsertionSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85B41BE1462F0080FF74 /* B3InsertionSet.cpp */; };
+		0FEC85BA1BE1462F0080FF74 /* B3InsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85B51BE1462F0080FF74 /* B3InsertionSet.h */; };
+		0FEC85BB1BE1462F0080FF74 /* B3InsertionSetInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85B61BE1462F0080FF74 /* B3InsertionSetInlines.h */; };
+		0FEC85BC1BE1462F0080FF74 /* B3ReduceStrength.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85B71BE1462F0080FF74 /* B3ReduceStrength.cpp */; };
+		0FEC85BD1BE1462F0080FF74 /* B3ReduceStrength.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85B81BE1462F0080FF74 /* B3ReduceStrength.h */; };
+		0FEC85C11BE167A00080FF74 /* B3Effects.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85BE1BE167A00080FF74 /* B3Effects.h */; };
+		0FEC85C21BE167A00080FF74 /* B3HeapRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85BF1BE167A00080FF74 /* B3HeapRange.cpp */; };
+		0FEC85C31BE167A00080FF74 /* B3HeapRange.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC85C01BE167A00080FF74 /* B3HeapRange.h */; };
+		0FEC85C51BE16F5A0080FF74 /* B3Effects.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC85C41BE16F5A0080FF74 /* B3Effects.cpp */; };
+		0FED67B91B26256D0066CE15 /* DFGConstantHoistingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FED67B71B26256D0066CE15 /* DFGConstantHoistingPhase.cpp */; };
+		0FED67BA1B26256D0066CE15 /* DFGConstantHoistingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FED67B81B26256D0066CE15 /* DFGConstantHoistingPhase.h */; };
+		0FEE98411A8865B700754E93 /* SetupVarargsFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEE98401A8865B600754E93 /* SetupVarargsFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FEE98431A89227500754E93 /* SetupVarargsFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEE98421A89227500754E93 /* SetupVarargsFrame.cpp */; };
+		0FEFC9AA1681A3B300567F53 /* DFGOSRExitJumpPlaceholder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEFC9A71681A3B000567F53 /* DFGOSRExitJumpPlaceholder.cpp */; };
+		0FEFC9AB1681A3B600567F53 /* DFGOSRExitJumpPlaceholder.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEFC9A81681A3B000567F53 /* DFGOSRExitJumpPlaceholder.h */; };
+		0FF054F91AC35B4400E5BE57 /* ExecutableAllocationFuzz.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF054F71AC35B4400E5BE57 /* ExecutableAllocationFuzz.cpp */; };
+		0FF054FA1AC35B4400E5BE57 /* ExecutableAllocationFuzz.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF054F81AC35B4400E5BE57 /* ExecutableAllocationFuzz.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF0F19916B729F6005DF95B /* DFGLongLivedState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B51C16B62772003F696B /* DFGLongLivedState.cpp */; };
+		0FF0F19B16B729FA005DF95B /* DFGLongLivedState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51D16B62772003F696B /* DFGLongLivedState.h */; };
+		0FF0F19C16B72A03005DF95B /* DFGNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B51E16B62772003F696B /* DFGNode.cpp */; };
+		0FF0F19D16B72A08005DF95B /* DFGCommon.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B51A16B62772003F696B /* DFGCommon.cpp */; };
+		0FF0F19E16B72A0B005DF95B /* DFGEdge.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B51B16B62772003F696B /* DFGEdge.cpp */; };
+		0FF0F19F16B72A17005DF95B /* FunctionExecutableDump.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B52116B6278D003F696B /* FunctionExecutableDump.cpp */; };
+		0FF0F1A016B72A1A005DF95B /* FunctionExecutableDump.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B52216B6278D003F696B /* FunctionExecutableDump.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF2CD5B1B61A4F8004955A8 /* DFGMultiGetByOffsetData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF2CD591B61A4F8004955A8 /* DFGMultiGetByOffsetData.cpp */; };
+		0FF2CD5C1B61A4F8004955A8 /* DFGMultiGetByOffsetData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF2CD5A1B61A4F8004955A8 /* DFGMultiGetByOffsetData.h */; };
+		0FF42731158EBD54004CB9FF /* Disassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4272F158EBD44004CB9FF /* Disassembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF42732158EBD58004CB9FF /* UDis86Disassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF42730158EBD44004CB9FF /* UDis86Disassembler.cpp */; };
+		0FF42740158EBE8B004CB9FF /* udis86_decode.c in Sources */ = {isa = PBXBuildFile; fileRef = 0FF42734158EBD94004CB9FF /* udis86_decode.c */; };
+		0FF42741158EBE8D004CB9FF /* udis86_decode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF42735158EBD94004CB9FF /* udis86_decode.h */; };
+		0FF42742158EBE91004CB9FF /* udis86_extern.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF42736158EBD94004CB9FF /* udis86_extern.h */; };
+		0FF42745158EBE91004CB9FF /* udis86_syn-att.c in Sources */ = {isa = PBXBuildFile; fileRef = 0FF42739158EBD94004CB9FF /* udis86_syn-att.c */; };
+		0FF42746158EBE91004CB9FF /* udis86_syn-intel.c in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4273A158EBD94004CB9FF /* udis86_syn-intel.c */; };
+		0FF42747158EBE91004CB9FF /* udis86_syn.c in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4273B158EBD94004CB9FF /* udis86_syn.c */; };
+		0FF42748158EBE91004CB9FF /* udis86_syn.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4273C158EBD94004CB9FF /* udis86_syn.h */; };
+		0FF42749158EBE91004CB9FF /* udis86_types.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4273D158EBD94004CB9FF /* udis86_types.h */; };
+		0FF4274A158EBE91004CB9FF /* udis86.c in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4273E158EBD94004CB9FF /* udis86.c */; };
+		0FF4274B158EBE91004CB9FF /* udis86.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4273F158EBD94004CB9FF /* udis86.h */; };
+		0FF4274D158EBFE6004CB9FF /* udis86_itab_holder.c in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4274C158EBFE1004CB9FF /* udis86_itab_holder.c */; };
+		0FF4275715914A20004CB9FF /* LinkBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4275615914A20004CB9FF /* LinkBuffer.cpp */; };
+		0FF427641591A1CC004CB9FF /* DFGDisassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */; };
+		0FF427651591A1CE004CB9FF /* DFGDisassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF427621591A1C9004CB9FF /* DFGDisassembler.h */; };
+		0FF60AC216740F8300029779 /* ReduceWhitespace.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF60AC016740F8100029779 /* ReduceWhitespace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF60AC316740F8800029779 /* ReduceWhitespace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF60ABF16740F8100029779 /* ReduceWhitespace.cpp */; };
+		0FF7168C15A3B235008F5DAA /* PropertyOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF7168A15A3B231008F5DAA /* PropertyOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729A5166AD351000F5BA3 /* ProfilerBytecode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF72993166AD347000F5BA3 /* ProfilerBytecode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729AD166AD35C000F5BA3 /* ProfilerBytecode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF72992166AD347000F5BA3 /* ProfilerBytecode.cpp */; };
+		0FF729AE166AD35C000F5BA3 /* ProfilerBytecodes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF72994166AD347000F5BA3 /* ProfilerBytecodes.cpp */; };
+		0FF729AF166AD35C000F5BA3 /* ProfilerCompilation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF72996166AD347000F5BA3 /* ProfilerCompilation.cpp */; };
+		0FF729B0166AD35C000F5BA3 /* ProfilerCompilationKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF72998166AD347000F5BA3 /* ProfilerCompilationKind.cpp */; };
+		0FF729B1166AD35C000F5BA3 /* ProfilerCompiledBytecode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF7299A166AD347000F5BA3 /* ProfilerCompiledBytecode.cpp */; };
+		0FF729B2166AD35C000F5BA3 /* ProfilerDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF7299C166AD347000F5BA3 /* ProfilerDatabase.cpp */; };
+		0FF729B3166AD35C000F5BA3 /* ProfilerOrigin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF7299F166AD347000F5BA3 /* ProfilerOrigin.cpp */; };
+		0FF729B4166AD35C000F5BA3 /* ProfilerOriginStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF729A1166AD347000F5BA3 /* ProfilerOriginStack.cpp */; };
+		0FF729B9166AD360000F5BA3 /* ProfilerBytecodes.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF72995166AD347000F5BA3 /* ProfilerBytecodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729BA166AD360000F5BA3 /* ProfilerCompilation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF72997166AD347000F5BA3 /* ProfilerCompilation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729BB166AD360000F5BA3 /* ProfilerCompilationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF72999166AD347000F5BA3 /* ProfilerCompilationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729BC166AD360000F5BA3 /* ProfilerCompiledBytecode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF7299B166AD347000F5BA3 /* ProfilerCompiledBytecode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729BD166AD360000F5BA3 /* ProfilerDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF7299D166AD347000F5BA3 /* ProfilerDatabase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729BE166AD360000F5BA3 /* ProfilerExecutionCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF7299E166AD347000F5BA3 /* ProfilerExecutionCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729BF166AD360000F5BA3 /* ProfilerOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF729A0166AD347000F5BA3 /* ProfilerOrigin.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF729C0166AD360000F5BA3 /* ProfilerOriginStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF729A2166AD347000F5BA3 /* ProfilerOriginStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF8BDEA1AD4CF7100DFE884 /* InferredValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF8BDE81AD4CF7100DFE884 /* InferredValue.cpp */; };
+		0FF8BDEB1AD4CF7100DFE884 /* InferredValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF8BDE91AD4CF7100DFE884 /* InferredValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF922D414F46B410041A24E /* LLIntOffsetsExtractor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */; };
+		0FF9CE731B9CD6D0004EDCA6 /* PolymorphicAccess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF9CE711B9CD6D0004EDCA6 /* PolymorphicAccess.cpp */; };
+		0FF9CE741B9CD6D0004EDCA6 /* PolymorphicAccess.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF9CE721B9CD6D0004EDCA6 /* PolymorphicAccess.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFA549716B8835000B3A982 /* A64DOpcode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 652A3A221651C69700A80AFE /* A64DOpcode.cpp */; };
+		0FFA549816B8835300B3A982 /* A64DOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 652A3A231651C69700A80AFE /* A64DOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFB6C381AF48DDC00DB1BF7 /* TypeofType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */; };
+		0FFB6C391AF48DDC00DB1BF7 /* TypeofType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFB921816D02EB20055A5DB /* DFGAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51916B62772003F696B /* DFGAllocator.h */; };
+		0FFB921A16D02EC50055A5DB /* DFGBasicBlockInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD5652216AB780A00197653 /* DFGBasicBlockInlines.h */; };
+		0FFB921B16D02F010055A5DB /* DFGNodeAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51F16B62772003F696B /* DFGNodeAllocator.h */; };
+		0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2C167FE84B003C2F8D /* DFGOSRExitCompilationInfo.h */; };
+		0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */; };
+		0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers */ = {isa = PBXBuildFile; fileRef = 930DAD030FB1EB1A0082D205 /* NodeConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFC92111B94D4DF0071DD66 /* InferredTypeTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFC920F1B94D4DF0071DD66 /* InferredTypeTable.cpp */; };
+		0FFC92121B94D4DF0071DD66 /* InferredTypeTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC92101B94D4DF0071DD66 /* InferredTypeTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFC92141B94E83E0071DD66 /* DFGDesiredInferredType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC92131B94E83E0071DD66 /* DFGDesiredInferredType.h */; };
+		0FFC92161B94FB3E0071DD66 /* DFGPropertyTypeKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC92151B94FB3E0071DD66 /* DFGPropertyTypeKey.h */; };
+		0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC99D0184EC8AD009C10AB /* ConstantMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFC99D4184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */; };
+		0FFC99D5184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFC99D3184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FFFC95714EF90A000C72532 /* DFGCFAPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */; };
+		0FFFC95814EF90A200C72532 /* DFGCFAPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */; };
+		0FFFC95914EF90A600C72532 /* DFGCSEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94D14EF909500C72532 /* DFGCSEPhase.cpp */; };
+		0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC94E14EF909500C72532 /* DFGCSEPhase.h */; };
+		0FFFC95B14EF90AD00C72532 /* DFGPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94F14EF909500C72532 /* DFGPhase.cpp */; };
+		0FFFC95C14EF90AF00C72532 /* DFGPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95014EF909500C72532 /* DFGPhase.h */; };
+		0FFFC95D14EF90B300C72532 /* DFGPredictionPropagationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */; };
+		0FFFC95E14EF90B700C72532 /* DFGPredictionPropagationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */; };
+		0FFFC95F14EF90BB00C72532 /* DFGVirtualRegisterAllocationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */; };
+		0FFFC96014EF90BD00C72532 /* DFGVirtualRegisterAllocationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */; };
+		13FECE06D3B445FCB6C93461 /* JSModuleLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1879510614C540FFB561C124 /* JSModuleLoader.cpp */; };
+		140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */; };
+		140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85E0255597D01FF60F7 /* JSFunction.cpp */; };
+		140B7D1D0DC69AF7009C42B8 /* JSLexicalEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DA818F0D99FD2000B0A4FB /* JSLexicalEnvironment.cpp */; };
+		140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		141211310A48794D00480255 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		141211340A48795800480255 /* minidom.c in Sources */ = {isa = PBXBuildFile; fileRef = 141211020A48780900480255 /* minidom.c */; };
+		14142E511B796ECE00F4BF4B /* UnlinkedFunctionExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 14142E501B796ECE00F4BF4B /* UnlinkedFunctionExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14142E531B796EDD00F4BF4B /* ExecutableInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 14142E521B796EDD00F4BF4B /* ExecutableInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14142E551B7973C000F4BF4B /* UnlinkedFunctionExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14142E541B7973C000F4BF4B /* UnlinkedFunctionExecutable.cpp */; };
+		141448CB13A176EC00F5BA1A /* MarkedBlockSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 141448CA13A176EC00F5BA1A /* MarkedBlockSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		141448CD13A1783700F5BA1A /* TinyBloomFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = 141448CC13A1783700F5BA1A /* TinyBloomFilter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14150133154BB13F005D8C98 /* WeakSetInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 14150132154BB13F005D8C98 /* WeakSetInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14201D591DECF26A00904BD3 /* SourceCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 14201D581DECF26A00904BD3 /* SourceCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1421359B0A677F4F00A8195E /* JSBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1421359A0A677F4F00A8195E /* JSBase.cpp */; };
+		14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8580255597D01FF60F7 /* Debugger.cpp */; };
+		1428082D107EC0570013E7B2 /* CallData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA62DFE0E2826230004F30D /* CallData.cpp */; };
+		1428082E107EC0570013E7B2 /* ConstructData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA62DFF0E2826310004F30D /* ConstructData.cpp */; };
+		1428083A107EC0750013E7B2 /* CLoopStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D85B0ED218E900B89619 /* CLoopStack.cpp */; };
+		14280841107EC0930013E7B2 /* RegExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A87D0255597D01FF60F7 /* RegExp.cpp */; };
+		14280842107EC0930013E7B2 /* RegExpConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BD0E1706A7002C7E82 /* RegExpConstructor.cpp */; };
+		14280843107EC0930013E7B2 /* RegExpObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A87B0255597D01FF60F7 /* RegExpObject.cpp */; };
+		14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BF0E1706A7002C7E82 /* RegExpPrototype.cpp */; };
+		14280850107EC0D70013E7B2 /* Operations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8770255597D01FF60F7 /* Operations.cpp */; };
+		14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B80E184545000F9297 /* GetterSetter.cpp */; };
+		14280863107EC11A0013E7B2 /* BooleanConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952320E15EB5600A898AB /* BooleanConstructor.cpp */; };
+		14280864107EC11A0013E7B2 /* BooleanObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8500255597D01FF60F7 /* BooleanObject.cpp */; };
+		14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */; };
+		14280870107EC1340013E7B2 /* JSWrapperObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */; };
+		14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65EA4C99092AF9E20093D800 /* JSLock.cpp */; };
+		1429D77C0ED20D7300B89619 /* Interpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 1429D77B0ED20D7300B89619 /* Interpreter.h */; };
+		1429D7D40ED2128200B89619 /* Interpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D7D30ED2128200B89619 /* Interpreter.cpp */; };
+		1429D8780ED21ACD00B89619 /* ExceptionHelpers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D8770ED21ACD00B89619 /* ExceptionHelpers.cpp */; };
+		1429D8DD0ED2205B00B89619 /* CallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D8DB0ED2205B00B89619 /* CallFrame.cpp */; };
+		1429D8DE0ED2205B00B89619 /* CallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 1429D8DC0ED2205B00B89619 /* CallFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1429D92F0ED22D7000B89619 /* JIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D92D0ED22D7000B89619 /* JIT.cpp */; };
+		1429D9300ED22D7000B89619 /* JIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 1429D92E0ED22D7000B89619 /* JIT.h */; };
+		142D3939103E4560007DCB52 /* NumericStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D3938103E4560007DCB52 /* NumericStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F0813539A2800B02E86 /* MarkedBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F0613539A2800B02E86 /* MarkedBlock.cpp */; };
+		142D6F0913539A2800B02E86 /* MarkedBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D6F0713539A2800B02E86 /* MarkedBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142D6F1113539A4100B02E86 /* MarkStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142D6F0E13539A4100B02E86 /* MarkStack.cpp */; };
+		142D6F1213539A4100B02E86 /* MarkStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 142D6F0F13539A4100B02E86 /* MarkStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3134134FF0A600AFADB5 /* Handle.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312B134FF0A600AFADB5 /* Handle.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3135134FF0A600AFADB5 /* HandleSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142E312C134FF0A600AFADB5 /* HandleSet.cpp */; };
+		142E3136134FF0A600AFADB5 /* HandleSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312D134FF0A600AFADB5 /* HandleSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3137134FF0A600AFADB5 /* HandleStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 142E312E134FF0A600AFADB5 /* HandleStack.cpp */; };
+		142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E312F134FF0A600AFADB5 /* HandleStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E3139134FF0A600AFADB5 /* Local.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3130134FF0A600AFADB5 /* Local.h */; };
+		142E313A134FF0A600AFADB5 /* LocalScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3131134FF0A600AFADB5 /* LocalScope.h */; };
+		142E313B134FF0A600AFADB5 /* Strong.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3132134FF0A600AFADB5 /* Strong.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		142E313C134FF0A600AFADB5 /* Weak.h in Headers */ = {isa = PBXBuildFile; fileRef = 142E3133134FF0A600AFADB5 /* Weak.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14386A741DD69895008652C4 /* DirectEvalExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14386A721DD69895008652C4 /* DirectEvalExecutable.cpp */; };
+		14386A751DD69895008652C4 /* DirectEvalExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 14386A731DD69895008652C4 /* DirectEvalExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14386A781DD6989C008652C4 /* IndirectEvalExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14386A761DD6989C008652C4 /* IndirectEvalExecutable.cpp */; };
+		14386A791DD6989C008652C4 /* IndirectEvalExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 14386A771DD6989C008652C4 /* IndirectEvalExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1440057F0A5335640005F061 /* JSNode.c in Sources */ = {isa = PBXBuildFile; fileRef = 1440F6420A4F8B6A0005F061 /* JSNode.c */; };
+		144005CB0A5338D10005F061 /* JSNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 1440F6410A4F8B6A0005F061 /* JSNode.h */; };
+		144005CC0A5338F80005F061 /* Node.h in Headers */ = {isa = PBXBuildFile; fileRef = 1440051F0A531D3B0005F061 /* Node.h */; };
+		1440063F0A53598A0005F061 /* Node.c in Sources */ = {isa = PBXBuildFile; fileRef = 144005200A531D3B0005F061 /* Node.c */; };
+		1440074A0A536CC20005F061 /* NodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 144007480A536CC20005F061 /* NodeList.h */; };
+		1440074B0A536CC20005F061 /* NodeList.c in Sources */ = {isa = PBXBuildFile; fileRef = 144007490A536CC20005F061 /* NodeList.c */; };
+		144007570A5370D20005F061 /* JSNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 144007550A5370D20005F061 /* JSNodeList.h */; };
+		144007580A5370D20005F061 /* JSNodeList.c in Sources */ = {isa = PBXBuildFile; fileRef = 144007560A5370D20005F061 /* JSNodeList.c */; };
+		1440F6100A4F85670005F061 /* testapi.c in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A2D0A3E91F600BAF59C /* testapi.c */; };
+		1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8900A508B100005F061 /* JSCallbackFunction.cpp */; };
+		1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */; };
+		1440FCE40A51E46B0005F061 /* JSClassRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440FCE20A51E46B0005F061 /* JSClassRef.cpp */; };
+		1442566115EDE98D0066A49B /* JSWithScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1442565F15EDE98D0066A49B /* JSWithScope.cpp */; };
+		1442566215EDE98D0066A49B /* JSWithScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 1442566015EDE98D0066A49B /* JSWithScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14469DDE107EC7E700650446 /* Lookup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8680255597D01FF60F7 /* Lookup.cpp */; };
+		14469DDF107EC7E700650446 /* MathObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86A0255597D01FF60F7 /* MathObject.cpp */; };
+		14469DE0107EC7E700650446 /* NativeErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9080E1839DB000F9297 /* NativeErrorConstructor.cpp */; };
+		14469DE1107EC7E700650446 /* NativeErrorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E90A0E1839DB000F9297 /* NativeErrorPrototype.cpp */; };
+		14469DE2107EC7E700650446 /* NumberConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */; };
+		14469DE3107EC7E700650446 /* NumberObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8700255597D01FF60F7 /* NumberObject.cpp */; };
+		14469DE4107EC7E700650446 /* NumberPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C40E16D4E900A06E92 /* NumberPrototype.cpp */; };
+		14469DE5107EC7E700650446 /* ObjectConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C60E16D4E900A06E92 /* ObjectConstructor.cpp */; };
+		14469DE6107EC7E700650446 /* ObjectPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C80E16D4E900A06E92 /* ObjectPrototype.cpp */; };
+		14469DE8107EC7E700650446 /* PropertySlot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65621E6B089E859700760F35 /* PropertySlot.cpp */; };
+		14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */; };
+		14469DEC107EC7E700650446 /* StringObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C20E16EE3300B34460 /* StringObject.cpp */; };
+		14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */; };
+		144836E7132DA7BE005BE785 /* ConservativeRoots.h in Headers */ = {isa = PBXBuildFile; fileRef = 149DAAF212EB559D0083B12B /* ConservativeRoots.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		145722861437E140005FDE26 /* StrongInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 145722851437E140005FDE26 /* StrongInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */; };
+		146B16D812EB5B59001BEC1B /* ConservativeRoots.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */; };
+		146FE51211A710430087AE66 /* JITCall32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146FE51111A710430087AE66 /* JITCall32_64.cpp */; };
+		147341CC1DC02D7200AA29BA /* ExecutableBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 147341CB1DC02D7200AA29BA /* ExecutableBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147341CE1DC02D7900AA29BA /* ScriptExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 147341CD1DC02D7900AA29BA /* ScriptExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147341D01DC02DB400AA29BA /* NativeExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 147341CF1DC02DB400AA29BA /* NativeExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147341D21DC02E2E00AA29BA /* EvalExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 147341D11DC02E2E00AA29BA /* EvalExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147341D41DC02E6D00AA29BA /* ProgramExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 147341D31DC02E6D00AA29BA /* ProgramExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147341D61DC02EB900AA29BA /* ModuleProgramExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 147341D51DC02EB900AA29BA /* ModuleProgramExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147341D81DC02F9900AA29BA /* FunctionExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 147341D71DC02F9900AA29BA /* FunctionExecutable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147341E21DC2CE9600AA29BA /* EvalExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 147341DB1DC2CE9600AA29BA /* EvalExecutable.cpp */; };
+		147341E31DC2CE9600AA29BA /* FunctionExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 147341DC1DC2CE9600AA29BA /* FunctionExecutable.cpp */; };
+		147341E41DC2CE9600AA29BA /* ModuleProgramExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 147341DD1DC2CE9600AA29BA /* ModuleProgramExecutable.cpp */; };
+		147341E51DC2CE9600AA29BA /* NativeExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 147341DE1DC2CE9600AA29BA /* NativeExecutable.cpp */; };
+		147341E61DC2CE9600AA29BA /* ProgramExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 147341DF1DC2CE9600AA29BA /* ProgramExecutable.cpp */; };
+		147341E71DC2CE9600AA29BA /* ScriptExecutable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 147341E01DC2CE9600AA29BA /* ScriptExecutable.cpp */; };
+		147341EA1DC2CF2500AA29BA /* ExecutableBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 147341E91DC2CF2500AA29BA /* ExecutableBase.cpp */; };
+		1474C33B16AA2D950062F01D /* PrototypeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D844A316AA2C7000A65AF0 /* PrototypeMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1474C33C16AA2D9B0062F01D /* PrototypeMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14D844A216AA2C7000A65AF0 /* PrototypeMap.cpp */; };
+		1478297B1379E8A800A7C2A3 /* HandleTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 146FA5A81378F6B0003627A3 /* HandleTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B84620E6DE6B1004775A4 /* PutPropertySlot.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147F39BD107EC37600427A48 /* ArgList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF605110E203EF800B9A64D /* ArgList.cpp */; };
+		147F39BF107EC37600427A48 /* ArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952060E15E8A800A898AB /* ArrayConstructor.cpp */; };
+		147F39C0107EC37600427A48 /* ArrayPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A84D0255597D01FF60F7 /* ArrayPrototype.cpp */; };
+		147F39C1107EC37600427A48 /* CommonIdentifiers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */; };
+		147F39C2107EC37600427A48 /* Completion.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A09220ED1E09C00F1F681 /* Completion.cpp */; };
+		147F39C3107EC37600427A48 /* DateConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD203450E17135E002C7E82 /* DateConstructor.cpp */; };
+		147F39C4107EC37600427A48 /* DateConversion.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D21202280AD4310C00ED79B6 /* DateConversion.cpp */; };
+		147F39C5107EC37600427A48 /* DateInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC1166000E1997B1008066DD /* DateInstance.cpp */; };
+		147F39C6107EC37600427A48 /* DatePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD203470E17135E002C7E82 /* DatePrototype.cpp */; };
+		147F39C7107EC37600427A48 /* Error.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC337BEA0E1B00CB0076918A /* Error.cpp */; };
+		147F39C8107EC37600427A48 /* ErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */; };
+		147F39C9107EC37600427A48 /* ErrorInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E98A0E183E38000F9297 /* ErrorInstance.cpp */; };
+		147F39CA107EC37600427A48 /* ErrorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9060E1839DB000F9297 /* ErrorPrototype.cpp */; };
+		147F39CB107EC37600427A48 /* FunctionConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C00E16D4E900A06E92 /* FunctionConstructor.cpp */; };
+		147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85C0255597D01FF60F7 /* FunctionPrototype.cpp */; };
+		147F39CE107EC37600427A48 /* Identifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 933A349D038AE80F008635CE /* Identifier.cpp */; };
+		147F39CF107EC37600427A48 /* InternalFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */; };
+		147F39D0107EC37600427A48 /* JSArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93ADFCE60CCBD7AC00D30B08 /* JSArray.cpp */; };
+		147F39D1107EC37600427A48 /* JSCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */; };
+		147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */; };
+		147F39D4107EC37600427A48 /* JSObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC22A3980E16E14800AF21C8 /* JSObject.cpp */; };
+		147F39D5107EC37600427A48 /* JSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B60E1842FA000F9297 /* JSString.cpp */; };
+		147F39D6107EC37600427A48 /* JSCJSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8870255597D01FF60F7 /* JSCJSValue.cpp */; };
+		147F39D7107EC37600427A48 /* JSEnvironmentRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC22A39A0E16E14800AF21C8 /* JSEnvironmentRecord.cpp */; };
+		1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B74C0A43032800517CFC /* JSStringRef.cpp */; };
+		1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B7E20A43076000517CFC /* JSObjectRef.cpp */; };
+		14874AE515EBDE4A002E3587 /* JSScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14874AE115EBDE4A002E3587 /* JSScope.cpp */; };
+		14874AE615EBDE4A002E3587 /* JSScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 14874AE215EBDE4A002E3587 /* JSScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		148A7BEF1B82975A002D9157 /* InlineCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 148A7BED1B82975A002D9157 /* InlineCallFrame.cpp */; };
+		148A7BF01B82975A002D9157 /* InlineCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 148A7BEE1B82975A002D9157 /* InlineCallFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		148F21AA107EC53A0042EC2C /* BytecodeGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07200ED1CE3300F1F681 /* BytecodeGenerator.cpp */; };
+		148F21B0107EC5410042EC2C /* Lexer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8650255597D01FF60F7 /* Lexer.cpp */; };
+		148F21B7107EC5470042EC2C /* Nodes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86D0255597D01FF60F7 /* Nodes.cpp */; };
+		148F21BC107EC54D0042EC2C /* Parser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F0B3A909BB4DC00068FCE3 /* Parser.cpp */; };
+		149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */; };
+		14A1563210966365006FA260 /* DateInstanceCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A1563010966365006FA260 /* DateInstanceCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14AB66761DECF40900A56C26 /* UnlinkedSourceCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AB66751DECF40900A56C26 /* UnlinkedSourceCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14ABDF600A437FEF00ECCA01 /* JSCallbackObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14ABDF5E0A437FEF00ECCA01 /* JSCallbackObject.cpp */; };
+		14AD910C1DCA92940014F9FE /* EvalCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD91061DCA92940014F9FE /* EvalCodeBlock.h */; };
+		14AD910D1DCA92940014F9FE /* FunctionCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD91071DCA92940014F9FE /* FunctionCodeBlock.h */; };
+		14AD910E1DCA92940014F9FE /* GlobalCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD91081DCA92940014F9FE /* GlobalCodeBlock.h */; };
+		14AD910F1DCA92940014F9FE /* ModuleProgramCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD91091DCA92940014F9FE /* ModuleProgramCodeBlock.h */; };
+		14AD91101DCA92940014F9FE /* ProgramCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD910A1DCA92940014F9FE /* ProgramCodeBlock.h */; };
+		14AD91171DCA97FD0014F9FE /* EvalCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14AD91121DCA97FD0014F9FE /* EvalCodeBlock.cpp */; };
+		14AD91181DCA97FD0014F9FE /* ModuleProgramCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14AD91131DCA97FD0014F9FE /* ModuleProgramCodeBlock.cpp */; };
+		14AD91191DCA97FD0014F9FE /* ProgramCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14AD91141DCA97FD0014F9FE /* ProgramCodeBlock.cpp */; };
+		14AD911B1DCA97FD0014F9FE /* FunctionCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14AD91161DCA97FD0014F9FE /* FunctionCodeBlock.cpp */; };
+		14AD91221DCA9FA40014F9FE /* UnlinkedGlobalCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD911C1DCA9FA40014F9FE /* UnlinkedGlobalCodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14AD91231DCA9FA40014F9FE /* UnlinkedFunctionCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD911D1DCA9FA40014F9FE /* UnlinkedFunctionCodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14AD91241DCA9FA40014F9FE /* UnlinkedEvalCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD911E1DCA9FA40014F9FE /* UnlinkedEvalCodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14AD91251DCA9FA40014F9FE /* UnlinkedModuleProgramCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD911F1DCA9FA40014F9FE /* UnlinkedModuleProgramCodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14AD91261DCA9FA40014F9FE /* UnlinkedProgramCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD91201DCA9FA40014F9FE /* UnlinkedProgramCodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14AD91271DCA9FA40014F9FE /* UnlinkedFunctionExecutable.h in Headers */ = {isa = PBXBuildFile; fileRef = 14AD91211DCA9FA40014F9FE /* UnlinkedFunctionExecutable.h */; };
+		14AD912C1DCAAAB00014F9FE /* UnlinkedEvalCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14AD91281DCAAAB00014F9FE /* UnlinkedEvalCodeBlock.cpp */; };
+		14AD912D1DCAAAB00014F9FE /* UnlinkedProgramCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14AD91291DCAAAB00014F9FE /* UnlinkedProgramCodeBlock.cpp */; };
+		14AD912E1DCAAAB00014F9FE /* UnlinkedModuleProgramCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14AD912A1DCAAAB00014F9FE /* UnlinkedModuleProgramCodeBlock.cpp */; };
+		14AD912F1DCAAAB00014F9FE /* UnlinkedFunctionCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14AD912B1DCAAAB00014F9FE /* UnlinkedFunctionCodeBlock.cpp */; };
+		14B723B212D7DA46003BD5ED /* MachineStackMarker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */; };
+		14B723B812D7DA6F003BD5ED /* MachineStackMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = 14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14B8EC720A5652090062BE54 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
+		14BA78F113AAB88F005B7C2C /* SlotVisitor.h in Headers */ = {isa = PBXBuildFile; fileRef = 14BA78F013AAB88F005B7C2C /* SlotVisitor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14BA7A9713AADFF8005B7C2C /* Heap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BA7A9513AADFF8005B7C2C /* Heap.cpp */; };
+		14BA7A9813AADFF8005B7C2C /* Heap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14BA7A9613AADFF8005B7C2C /* Heap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14BD59C50A3E8F9F00BAF59C /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		14BD5A300A3E91F600BAF59C /* JSContextRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A290A3E91F600BAF59C /* JSContextRef.cpp */; };
+		14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */; };
+		14BE7D3317135CF400D1807A /* WeakInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 14BE7D3217135CF400D1807A /* WeakInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14BFCE6910CDB1FC00364CCE /* WeakGCMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14CA958B16AB50DE00938A06 /* StaticPropertyAnalyzer.h in Headers */ = {isa = PBXBuildFile; fileRef = 14CA958A16AB50DE00938A06 /* StaticPropertyAnalyzer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14CA958D16AB50FA00938A06 /* ObjectAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 14CA958C16AB50FA00938A06 /* ObjectAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14D2F3DA139F4BE200491031 /* MarkedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14D2F3D8139F4BE200491031 /* MarkedSpace.cpp */; };
+		14D2F3DB139F4BE200491031 /* MarkedSpace.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D2F3D9139F4BE200491031 /* MarkedSpace.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14DF04DA16B3996D0016A513 /* StaticPropertyAnalysis.h in Headers */ = {isa = PBXBuildFile; fileRef = 14DF04D916B3996D0016A513 /* StaticPropertyAnalysis.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14E84F9E14EE1ACC00D6D5D4 /* WeakBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14E84F9914EE1ACC00D6D5D4 /* WeakBlock.cpp */; };
+		14E84F9F14EE1ACC00D6D5D4 /* WeakBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 14E84F9A14EE1ACC00D6D5D4 /* WeakBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14E84FA014EE1ACC00D6D5D4 /* WeakSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14E84F9B14EE1ACC00D6D5D4 /* WeakSet.cpp */; };
+		14E84FA114EE1ACC00D6D5D4 /* WeakSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 14E84F9C14EE1ACC00D6D5D4 /* WeakSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14E84FA214EE1ACC00D6D5D4 /* WeakImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 14E84F9D14EE1ACC00D6D5D4 /* WeakImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */; };
+		14F7256514EE265E00B1652B /* WeakHandleOwner.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14F7256314EE265E00B1652B /* WeakHandleOwner.cpp */; };
+		14F7256614EE265E00B1652B /* WeakHandleOwner.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F7256414EE265E00B1652B /* WeakHandleOwner.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1A28D4A8177B71C80007FA3C /* JSStringRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A28D4A7177B71C80007FA3C /* JSStringRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1A8826B1653C4CD1A642983B /* TemplateRegistryKeyTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8B47F234366C4B72AC852A7E /* TemplateRegistryKeyTable.cpp */; };
+		1ACF7377171CA6FB00C9BB1E /* Weak.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ACF7376171CA6FB00C9BB1E /* Weak.cpp */; };
+		2600B5A6152BAAA70091EE5F /* JSStringJoiner.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2600B5A4152BAAA70091EE5F /* JSStringJoiner.cpp */; };
+		2600B5A7152BAAA70091EE5F /* JSStringJoiner.h in Headers */ = {isa = PBXBuildFile; fileRef = 2600B5A5152BAAA70091EE5F /* JSStringJoiner.h */; };
+		262D85B61C0D650F006ACB61 /* AirFixPartialRegisterStalls.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 262D85B41C0D650F006ACB61 /* AirFixPartialRegisterStalls.cpp */; };
+		262D85B71C0D650F006ACB61 /* AirFixPartialRegisterStalls.h in Headers */ = {isa = PBXBuildFile; fileRef = 262D85B51C0D650F006ACB61 /* AirFixPartialRegisterStalls.h */; };
+		26718BA41BE99F780052017B /* AirIteratedRegisterCoalescing.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 26718BA21BE99F780052017B /* AirIteratedRegisterCoalescing.cpp */; };
+		26718BA51BE99F780052017B /* AirIteratedRegisterCoalescing.h in Headers */ = {isa = PBXBuildFile; fileRef = 26718BA31BE99F780052017B /* AirIteratedRegisterCoalescing.h */; };
+		2684D4381C00161C0081D663 /* AirLiveness.h in Headers */ = {isa = PBXBuildFile; fileRef = 2684D4371C00161C0081D663 /* AirLiveness.h */; };
+		269D636E1BFBE5D100101B1D /* FTLOutput.h in Headers */ = {isa = PBXBuildFile; fileRef = 269D636D1BFBE5D000101B1D /* FTLOutput.h */; };
+		2A05ABD51961DF2400341750 /* JSPropertyNameEnumerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A05ABD31961DF2400341750 /* JSPropertyNameEnumerator.cpp */; };
+		2A05ABD61961DF2400341750 /* JSPropertyNameEnumerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A05ABD41961DF2400341750 /* JSPropertyNameEnumerator.h */; };
+		2A111245192FCE79005EE18D /* CustomGetterSetter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A111243192FCE79005EE18D /* CustomGetterSetter.cpp */; };
+		2A111246192FCE79005EE18D /* CustomGetterSetter.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A111244192FCE79005EE18D /* CustomGetterSetter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2A48D1911772365B00C65A5F /* APICallbackFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = C211B574176A224D000E2A23 /* APICallbackFunction.h */; };
+		2A4BB7F318A41179008A0FCD /* JSManagedValueInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A4BB7F218A41179008A0FCD /* JSManagedValueInternal.h */; };
+		2A7A58EF1808A4C40020BDF7 /* DeferGC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */; };
+		2A83638518D7D0EE0000EBCC /* EdenGCActivityCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */; };
+		2A83638618D7D0EE0000EBCC /* EdenGCActivityCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A83638418D7D0EE0000EBCC /* EdenGCActivityCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2A83638918D7D0FE0000EBCC /* FullGCActivityCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A83638718D7D0FE0000EBCC /* FullGCActivityCallback.cpp */; };
+		2A83638A18D7D0FE0000EBCC /* FullGCActivityCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A83638818D7D0FE0000EBCC /* FullGCActivityCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2AAAA31218BD49D100394CC8 /* StructureIDBlob.h in Headers */ = {isa = PBXBuildFile; fileRef = 2AAAA31018BD49D100394CC8 /* StructureIDBlob.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2AABCDE718EF294200002096 /* GCLogging.h in Headers */ = {isa = PBXBuildFile; fileRef = 2AABCDE618EF294200002096 /* GCLogging.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2AACE63C18CA5A0300ED0191 /* GCActivityCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2AACE63A18CA5A0300ED0191 /* GCActivityCallback.cpp */; };
+		2AACE63D18CA5A0300ED0191 /* GCActivityCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 2AACE63B18CA5A0300ED0191 /* GCActivityCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2AD2EDFB19799E38004D6478 /* EnumerationMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 2AD2EDFA19799E38004D6478 /* EnumerationMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2AD8932B17E3868F00668276 /* HeapIterationScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 2AD8932917E3868F00668276 /* HeapIterationScope.h */; };
+		2ADFA26318EF3540004F9FCC /* GCLogging.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2ADFA26218EF3540004F9FCC /* GCLogging.cpp */; };
+		2AF7382C18BBBF92008A5A37 /* StructureIDTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2AF7382A18BBBF92008A5A37 /* StructureIDTable.cpp */; };
+		2AF7382D18BBBF92008A5A37 /* StructureIDTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 2AF7382B18BBBF92008A5A37 /* StructureIDTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		371D842D17C98B6E00ECF994 /* libz.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 371D842C17C98B6E00ECF994 /* libz.dylib */; };
+		412952771D2CF6BC00E78B89 /* builtins_generate_internals_wrapper_header.py in Headers */ = {isa = PBXBuildFile; fileRef = 412952731D2CF6AC00E78B89 /* builtins_generate_internals_wrapper_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		412952781D2CF6BC00E78B89 /* builtins_generate_internals_wrapper_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = 412952741D2CF6AC00E78B89 /* builtins_generate_internals_wrapper_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		412952791D2CF6BC00E78B89 /* builtins_generate_wrapper_header.py in Headers */ = {isa = PBXBuildFile; fileRef = 412952751D2CF6AC00E78B89 /* builtins_generate_wrapper_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		4129527A1D2CF6BC00E78B89 /* builtins_generate_wrapper_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = 412952761D2CF6AC00E78B89 /* builtins_generate_wrapper_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		41359CF30FDD89AD00206180 /* DateConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = D21202290AD4310C00ED79B6 /* DateConversion.h */; };
+		41DEA1321B9F3163006D65DD /* BuiltinUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 41DEA1311B9F3154006D65DD /* BuiltinUtils.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		4319DA031C1BE40A001D260B /* B3LowerMacrosAfterOptimizations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4319DA011C1BE3C1001D260B /* B3LowerMacrosAfterOptimizations.cpp */; };
+		4319DA041C1BE40D001D260B /* B3LowerMacrosAfterOptimizations.h in Headers */ = {isa = PBXBuildFile; fileRef = 4319DA021C1BE3C1001D260B /* B3LowerMacrosAfterOptimizations.h */; };
+		4340A4841A9051AF00D73CCA /* MathCommon.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4340A4821A9051AF00D73CCA /* MathCommon.cpp */; };
+		4340A4851A9051AF00D73CCA /* MathCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 4340A4831A9051AF00D73CCA /* MathCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		43422A621C158E6A00E2EB98 /* B3ConstFloatValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 43422A601C15871B00E2EB98 /* B3ConstFloatValue.cpp */; };
+		43422A631C158E6D00E2EB98 /* B3ConstFloatValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 43422A611C15871B00E2EB98 /* B3ConstFloatValue.h */; };
+		43422A661C16267500E2EB98 /* B3ReduceDoubleToFloat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 43422A641C16221E00E2EB98 /* B3ReduceDoubleToFloat.cpp */; };
+		43422A671C16267800E2EB98 /* B3ReduceDoubleToFloat.h in Headers */ = {isa = PBXBuildFile; fileRef = 43422A651C16221E00E2EB98 /* B3ReduceDoubleToFloat.h */; };
+		436E54531C468E7400B5AF73 /* B3LegalizeMemoryOffsets.h in Headers */ = {isa = PBXBuildFile; fileRef = 436E54521C468E5F00B5AF73 /* B3LegalizeMemoryOffsets.h */; };
+		436E54541C468E7700B5AF73 /* B3LegalizeMemoryOffsets.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 436E54511C468E5F00B5AF73 /* B3LegalizeMemoryOffsets.cpp */; };
+		43AB26C61C1A535900D82AE6 /* B3MathExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 43AB26C51C1A52F700D82AE6 /* B3MathExtras.h */; };
+		43AB26C71C1A535C00D82AE6 /* B3MathExtras.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 43AB26C41C1A52F700D82AE6 /* B3MathExtras.cpp */; };
+		43C392AB1C3BEB0500241F53 /* AssemblerCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 43C392AA1C3BEB0000241F53 /* AssemblerCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		4443AE3316E188D90076F110 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
+		451539B912DC994500EF7AC4 /* Yarr.h in Headers */ = {isa = PBXBuildFile; fileRef = 451539B812DC994500EF7AC4 /* Yarr.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		473DA4A4764C45FE871B0485 /* DefinePropertyAttributes.h in Headers */ = {isa = PBXBuildFile; fileRef = 169948EDE68D4054B01EF797 /* DefinePropertyAttributes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		52678F8E1A031009006A306D /* BasicBlockLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52678F8C1A031009006A306D /* BasicBlockLocation.cpp */; };
+		52678F8F1A031009006A306D /* BasicBlockLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 52678F8D1A031009006A306D /* BasicBlockLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		52678F911A04177C006A306D /* ControlFlowProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 52678F901A04177C006A306D /* ControlFlowProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		527773DE1AAF83AC00BDE7E8 /* RuntimeType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 527773DD1AAF83AC00BDE7E8 /* RuntimeType.cpp */; };
+		52B310FB1974AE610080857C /* FunctionHasExecutedCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 52B310FA1974AE610080857C /* FunctionHasExecutedCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		52B310FD1974AE870080857C /* FunctionHasExecutedCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52B310FC1974AE870080857C /* FunctionHasExecutedCache.cpp */; };
+		52B310FF1975B4240080857C /* TypeLocationCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52B310FE1975B4240080857C /* TypeLocationCache.cpp */; };
+		52B311011975B4670080857C /* TypeLocationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 52B311001975B4670080857C /* TypeLocationCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		52B717B51A0597E1007AF4F3 /* ControlFlowProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52B717B41A0597E1007AF4F3 /* ControlFlowProfiler.cpp */; };
+		52B74B4A1DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52B74B481DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp */; };
+		52B74B4B1DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 52B74B491DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		52C0611F1AA51E1C00B4ADBA /* RuntimeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 52C0611D1AA51E1B00B4ADBA /* RuntimeType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		52C952B719A289850069B386 /* TypeProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 52C952B619A289850069B386 /* TypeProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		52C952B919A28A1C0069B386 /* TypeProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52C952B819A28A1C0069B386 /* TypeProfiler.cpp */; };
+		531374BD1D5CE67600AF7A0B /* WasmPlan.h in Headers */ = {isa = PBXBuildFile; fileRef = 531374BC1D5CE67600AF7A0B /* WasmPlan.h */; };
+		531374BF1D5CE95000AF7A0B /* WasmPlan.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 531374BE1D5CE95000AF7A0B /* WasmPlan.cpp */; };
+		533B15DF1DC7F463004D500A /* WasmOps.h in Headers */ = {isa = PBXBuildFile; fileRef = 533B15DE1DC7F463004D500A /* WasmOps.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		5341FC701DAC33E500E7E4D7 /* B3WasmBoundsCheckValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5341FC6F1DAC33E500E7E4D7 /* B3WasmBoundsCheckValue.cpp */; };
+		5341FC721DAC343C00E7E4D7 /* B3WasmBoundsCheckValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 5341FC711DAC343C00E7E4D7 /* B3WasmBoundsCheckValue.h */; };
+		53486BB71C1795C300F6F3AF /* JSTypedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 53486BB61C1795C300F6F3AF /* JSTypedArray.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		53486BBB1C18E84500F6F3AF /* JSTypedArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53486BBA1C18E84500F6F3AF /* JSTypedArray.cpp */; };
+		534902851C7276B70012BCB8 /* TypedArrayCTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 534902821C7242C80012BCB8 /* TypedArrayCTest.cpp */; };
+		534C457C1BC72411007476A7 /* JSTypedArrayViewConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 534C457B1BC72411007476A7 /* JSTypedArrayViewConstructor.h */; };
+		534C457E1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 534C457D1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp */; };
+		53529A4C1C457B75000B49C6 /* APIUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 53529A4B1C457B75000B49C6 /* APIUtils.h */; };
+		535557141D9D9EA5006D583B /* WasmMemory.h in Headers */ = {isa = PBXBuildFile; fileRef = 535557131D9D9EA5006D583B /* WasmMemory.h */; };
+		535557161D9DFA32006D583B /* WasmMemory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 535557151D9DFA32006D583B /* WasmMemory.cpp */; };
+		5370B4F51BF26202005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5370B4F31BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.cpp */; };
+		5370B4F61BF26205005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 5370B4F41BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h */; };
+		53917E7B1B7906FA000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */; };
+		539FB8BA1C99DA7C00940FA1 /* JSArrayInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 539FB8B91C99DA7C00940FA1 /* JSArrayInlines.h */; };
+		53D444DC1DAF08AB00B92784 /* B3WasmAddressValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 53D444DB1DAF08AB00B92784 /* B3WasmAddressValue.h */; };
+		53D444DE1DAF09A000B92784 /* B3WasmAddressValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53D444DD1DAF09A000B92784 /* B3WasmAddressValue.cpp */; };
+		53F40E851D58F9770099A1B6 /* WasmSections.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E841D58F9770099A1B6 /* WasmSections.h */; };
+		53F40E8B1D5901BB0099A1B6 /* WasmFunctionParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E8A1D5901BB0099A1B6 /* WasmFunctionParser.h */; };
+		53F40E8D1D5901F20099A1B6 /* WasmParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E8C1D5901F20099A1B6 /* WasmParser.h */; };
+		53F40E8F1D5902820099A1B6 /* WasmB3IRGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53F40E8E1D5902820099A1B6 /* WasmB3IRGenerator.cpp */; };
+		53F40E931D5A4AB30099A1B6 /* WasmB3IRGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E921D5A4AB30099A1B6 /* WasmB3IRGenerator.h */; };
+		53F40E951D5A7AEF0099A1B6 /* WasmModuleParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F40E941D5A7AEF0099A1B6 /* WasmModuleParser.h */; };
+		53F40E971D5A7BEC0099A1B6 /* WasmModuleParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53F40E961D5A7BEC0099A1B6 /* WasmModuleParser.cpp */; };
+		53F6BF6D1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		53FA2AE11CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		53FA2AE31CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */; };
+		53FD04D31D7AB277003287D3 /* WasmCallingConvention.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53FD04D11D7AB187003287D3 /* WasmCallingConvention.cpp */; };
+		53FD04D41D7AB291003287D3 /* WasmCallingConvention.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		53FF7F991DBFCD9000A26CCC /* WasmValidate.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FF7F981DBFCD9000A26CCC /* WasmValidate.h */; };
+		53FF7F9B1DBFD2B900A26CCC /* WasmValidate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53FF7F9A1DBFD2B900A26CCC /* WasmValidate.cpp */; };
+		5B70CFDE1DB69E6600EC23F9 /* JSAsyncFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 5B70CFD81DB69E5C00EC23F9 /* JSAsyncFunction.h */; };
+		5B70CFDF1DB69E6600EC23F9 /* JSAsyncFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5B70CFD91DB69E5C00EC23F9 /* JSAsyncFunction.cpp */; };
+		5B70CFE01DB69E6600EC23F9 /* AsyncFunctionPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 5B70CFDA1DB69E5C00EC23F9 /* AsyncFunctionPrototype.h */; };
+		5B70CFE11DB69E6600EC23F9 /* AsyncFunctionPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5B70CFDB1DB69E5C00EC23F9 /* AsyncFunctionPrototype.cpp */; };
+		5B70CFE21DB69E6600EC23F9 /* AsyncFunctionConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 5B70CFDC1DB69E5C00EC23F9 /* AsyncFunctionConstructor.h */; };
+		5B70CFE31DB69E6600EC23F9 /* AsyncFunctionConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5B70CFDD1DB69E5C00EC23F9 /* AsyncFunctionConstructor.cpp */; };
+		5C4E8E961DBEBE620036F1FC /* JSONParseTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5C4E8E941DBEBDA20036F1FC /* JSONParseTest.cpp */; };
+		5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
+		5DBB151B131D0B310056AD36 /* testapi.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = 14D857740A4696C80032146C /* testapi.js */; };
+		5DBB1525131D0BD70056AD36 /* minidom.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = 1412110D0A48788700480255 /* minidom.js */; };
+		5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */ = {isa = PBXBuildFile; fileRef = F692A8540255597D01FF60F7 /* create_hash_table */; settings = {ATTRIBUTES = (); }; };
+		623A37EC1B87A7C000754209 /* RegisterMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 623A37EB1B87A7BD00754209 /* RegisterMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		627673231B680C1E00FD9F2E /* CallMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 627673211B680C1E00FD9F2E /* CallMode.cpp */; };
+		627673241B680C1E00FD9F2E /* CallMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 627673221B680C1E00FD9F2E /* CallMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		62D2D38F1ADF103F000206C1 /* FunctionRareData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 62D2D38D1ADF103F000206C1 /* FunctionRareData.cpp */; };
+		62D2D3901ADF103F000206C1 /* FunctionRareData.h in Headers */ = {isa = PBXBuildFile; fileRef = 62D2D38E1ADF103F000206C1 /* FunctionRareData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		62D755D41B84FB3D001801FA /* CallFrameShuffler64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 62D755D31B84FB39001801FA /* CallFrameShuffler64.cpp */; };
+		62D755D51B84FB40001801FA /* CallFrameShuffler32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 62D755D21B84FB39001801FA /* CallFrameShuffler32_64.cpp */; };
+		62D755D61B84FB46001801FA /* CallFrameShuffler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 62D755D01B84FB39001801FA /* CallFrameShuffler.cpp */; };
+		62D755D71B84FB4A001801FA /* CallFrameShuffler.h in Headers */ = {isa = PBXBuildFile; fileRef = 62D755D11B84FB39001801FA /* CallFrameShuffler.h */; };
+		62E3D5F01B8D0B7300B868BB /* DataFormat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 62E3D5EF1B8D0B7300B868BB /* DataFormat.cpp */; };
+		62EC9BB61B7EB07C00303AD1 /* CallFrameShuffleData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 62EC9BB41B7EB07C00303AD1 /* CallFrameShuffleData.cpp */; };
+		62EC9BB71B7EB07C00303AD1 /* CallFrameShuffleData.h in Headers */ = {isa = PBXBuildFile; fileRef = 62EC9BB51B7EB07C00303AD1 /* CallFrameShuffleData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		62F2AA371B0BEDE300610C7A /* DFGLazyNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 62A9A29E1B0BED4800BD54CA /* DFGLazyNode.cpp */; };
+		62F2AA381B0BEDE300610C7A /* DFGLazyNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 62A9A29F1B0BED4800BD54CA /* DFGLazyNode.h */; };
+		6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		651122FD14046A4C002B101D /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		651122FE14046A4C002B101D /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
+		6511230714046B0A002B101D /* testRegExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 651122E5140469BA002B101D /* testRegExp.cpp */; };
+		6514F21918B3E1670098FF8B /* Bytecodes.h in Headers */ = {isa = PBXBuildFile; fileRef = 6514F21718B3E1670098FF8B /* Bytecodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		65303D641447B9E100D3F904 /* ParserTokens.h in Headers */ = {isa = PBXBuildFile; fileRef = 65303D631447B9E100D3F904 /* ParserTokens.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		6540C7A01B82E1C3000F6B79 /* RegisterAtOffset.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6540C79E1B82D9CE000F6B79 /* RegisterAtOffset.cpp */; };
+		6540C7A11B82E1C3000F6B79 /* RegisterAtOffsetList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6540C79C1B82D99D000F6B79 /* RegisterAtOffsetList.cpp */; };
+		6546F5211A32B313006F07D5 /* NullGetterFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */; };
+		65525FC51A6DD801007B5495 /* NullSetterFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65525FC31A6DD3B3007B5495 /* NullSetterFunction.cpp */; };
+		6553A33117A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */; };
+		6553A33217A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */; };
+		65570F5A1AA4C3EA009B3C23 /* Regress141275.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65570F591AA4C00A009B3C23 /* Regress141275.mm */; };
+		655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 655EB29A10CE2581001A990E /* NodesCodegen.cpp */; };
+		657CF45819BF6662004ACBF2 /* JSCallee.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 657CF45619BF6662004ACBF2 /* JSCallee.cpp */; };
+		657CF45919BF6662004ACBF2 /* JSCallee.h in Headers */ = {isa = PBXBuildFile; fileRef = 657CF45719BF6662004ACBF2 /* JSCallee.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		658D3A5619638268003C45D6 /* VMEntryRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 658D3A5519638268003C45D6 /* VMEntryRecord.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		65B8392E1BACAD360044E824 /* CachedRecovery.h in Headers */ = {isa = PBXBuildFile; fileRef = 65B8392C1BACA92A0044E824 /* CachedRecovery.h */; };
+		65B8392F1BACAD6A0044E824 /* CachedRecovery.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65B8392D1BACA9D30044E824 /* CachedRecovery.cpp */; };
+		65C02850171795E200351E35 /* ARMv7Disassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65C0284F171795E200351E35 /* ARMv7Disassembler.cpp */; };
+		65C0285C1717966800351E35 /* ARMv7DOpcode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65C0285A1717966800351E35 /* ARMv7DOpcode.cpp */; };
+		65C0285D1717966800351E35 /* ARMv7DOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 65C0285B1717966800351E35 /* ARMv7DOpcode.h */; };
+		65FB5117184EEE7000C12B70 /* ProtoCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65FB5116184EE9BC00C12B70 /* ProtoCallFrame.cpp */; };
+		65FB63A41C8EA09C0020719B /* YarrCanonicalizeUnicode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65A946141C8E9F6F00A7209A /* YarrCanonicalizeUnicode.cpp */; };
+		6A38CFA91E32B5AB0060206F /* AsyncStackTrace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6A38CFA71E32B58B0060206F /* AsyncStackTrace.cpp */; };
+		6A38CFAA1E32B5AB0060206F /* AsyncStackTrace.h in Headers */ = {isa = PBXBuildFile; fileRef = 6A38CFA81E32B58B0060206F /* AsyncStackTrace.h */; };
+		6AD2CB4D19B9140100065719 /* DebuggerEvalEnabler.h in Headers */ = {isa = PBXBuildFile; fileRef = 6AD2CB4C19B9140100065719 /* DebuggerEvalEnabler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70113D4B1A8DB093003848C4 /* IteratorOperations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70113D491A8DB093003848C4 /* IteratorOperations.cpp */; };
+		70113D4C1A8DB093003848C4 /* IteratorOperations.h in Headers */ = {isa = PBXBuildFile; fileRef = 70113D4A1A8DB093003848C4 /* IteratorOperations.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7013CA8B1B491A9400CAE613 /* JSJob.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7013CA891B491A9400CAE613 /* JSJob.cpp */; };
+		7013CA8C1B491A9400CAE613 /* JSJob.h in Headers */ = {isa = PBXBuildFile; fileRef = 7013CA8A1B491A9400CAE613 /* JSJob.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		705B41AB1A6E501E00716757 /* Symbol.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 705B41A31A6E501E00716757 /* Symbol.cpp */; };
+		705B41AC1A6E501E00716757 /* Symbol.h in Headers */ = {isa = PBXBuildFile; fileRef = 705B41A41A6E501E00716757 /* Symbol.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		705B41AD1A6E501E00716757 /* SymbolConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 705B41A51A6E501E00716757 /* SymbolConstructor.cpp */; };
+		705B41AE1A6E501E00716757 /* SymbolConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 705B41A61A6E501E00716757 /* SymbolConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		705B41AF1A6E501E00716757 /* SymbolObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 705B41A71A6E501E00716757 /* SymbolObject.cpp */; };
+		705B41B01A6E501E00716757 /* SymbolObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 705B41A81A6E501E00716757 /* SymbolObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		705B41B11A6E501E00716757 /* SymbolPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 705B41A91A6E501E00716757 /* SymbolPrototype.cpp */; };
+		705B41B21A6E501E00716757 /* SymbolPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 705B41AA1A6E501E00716757 /* SymbolPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		708EBE241CE8F35800453146 /* IntlObjectInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 708EBE231CE8F35000453146 /* IntlObjectInlines.h */; };
+		7094C4DE1AE439530041A2EE /* BytecodeIntrinsicRegistry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7094C4DC1AE439530041A2EE /* BytecodeIntrinsicRegistry.cpp */; };
+		7094C4DF1AE439530041A2EE /* BytecodeIntrinsicRegistry.h in Headers */ = {isa = PBXBuildFile; fileRef = 7094C4DD1AE439530041A2EE /* BytecodeIntrinsicRegistry.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		709FB8671AE335C60039D069 /* JSWeakSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 709FB8611AE335C60039D069 /* JSWeakSet.cpp */; };
+		709FB8681AE335C60039D069 /* JSWeakSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 709FB8621AE335C60039D069 /* JSWeakSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		709FB8691AE335C60039D069 /* WeakSetConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 709FB8631AE335C60039D069 /* WeakSetConstructor.cpp */; };
+		709FB86A1AE335C60039D069 /* WeakSetConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 709FB8641AE335C60039D069 /* WeakSetConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		709FB86B1AE335C60039D069 /* WeakSetPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 709FB8651AE335C60039D069 /* WeakSetPrototype.cpp */; };
+		709FB86C1AE335C60039D069 /* WeakSetPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 709FB8661AE335C60039D069 /* WeakSetPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70B0A9D11A9B66460001306A /* RuntimeFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 70B0A9D01A9B66200001306A /* RuntimeFlags.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70B791911C024A13002481E2 /* SourceCodeKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 70B7918E1C0244C9002481E2 /* SourceCodeKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70B791941C024A28002481E2 /* GeneratorFunctionConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70B791851C024432002481E2 /* GeneratorFunctionConstructor.cpp */; };
+		70B791951C024A28002481E2 /* GeneratorFunctionConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 70B791861C024432002481E2 /* GeneratorFunctionConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70B791961C024A28002481E2 /* GeneratorFunctionPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70B791871C024432002481E2 /* GeneratorFunctionPrototype.cpp */; };
+		70B791971C024A29002481E2 /* GeneratorFunctionPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 70B791881C024432002481E2 /* GeneratorFunctionPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70B791981C024A29002481E2 /* GeneratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70B791891C024432002481E2 /* GeneratorPrototype.cpp */; };
+		70B791991C024A29002481E2 /* GeneratorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 70B7918A1C024432002481E2 /* GeneratorPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70B7919B1C024A46002481E2 /* JSGeneratorFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70B7918C1C024462002481E2 /* JSGeneratorFunction.cpp */; };
+		70B7919C1C024A49002481E2 /* JSGeneratorFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 70B7918D1C024462002481E2 /* JSGeneratorFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70B7919D1C024A56002481E2 /* GeneratorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 70B791901C0246CE002481E2 /* GeneratorPrototype.lut.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70DC3E091B2DF2C700054299 /* IteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70DC3E071B2DF2C700054299 /* IteratorPrototype.cpp */; };
+		70DC3E0A1B2DF2C700054299 /* IteratorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 70DC3E081B2DF2C700054299 /* IteratorPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70DE9A091BE7D69E005D89D9 /* LLIntAssembly.h in Headers */ = {isa = PBXBuildFile; fileRef = 70DE9A081BE7D670005D89D9 /* LLIntAssembly.h */; };
+		70EC0EC21AA0D7DA00B6AAFA /* JSStringIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70EC0EBC1AA0D7DA00B6AAFA /* JSStringIterator.cpp */; };
+		70EC0EC31AA0D7DA00B6AAFA /* JSStringIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 70EC0EBD1AA0D7DA00B6AAFA /* JSStringIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70EC0EC61AA0D7DA00B6AAFA /* StringIteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70EC0EC01AA0D7DA00B6AAFA /* StringIteratorPrototype.cpp */; };
+		70EC0EC71AA0D7DA00B6AAFA /* StringIteratorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 70EC0EC11AA0D7DA00B6AAFA /* StringIteratorPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70ECA6051AFDBEA200449739 /* JSTemplateRegistryKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70ECA6001AFDBEA200449739 /* JSTemplateRegistryKey.cpp */; };
+		70ECA6061AFDBEA200449739 /* JSTemplateRegistryKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 70ECA6011AFDBEA200449739 /* JSTemplateRegistryKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70ECA6071AFDBEA200449739 /* TemplateRegistry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 70ECA6021AFDBEA200449739 /* TemplateRegistry.cpp */; };
+		70ECA6081AFDBEA200449739 /* TemplateRegistry.h in Headers */ = {isa = PBXBuildFile; fileRef = 70ECA6031AFDBEA200449739 /* TemplateRegistry.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		70ECA6091AFDBEA200449739 /* TemplateRegistryKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 70ECA6041AFDBEA200449739 /* TemplateRegistryKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		72AAF7CD1D0D31B3005E60BE /* JSCustomGetterSetterFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 72AAF7CB1D0D318B005E60BE /* JSCustomGetterSetterFunction.cpp */; };
+		72AAF7CE1D0D31B3005E60BE /* JSCustomGetterSetterFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 72AAF7CC1D0D318B005E60BE /* JSCustomGetterSetterFunction.h */; };
+		78274D8E4C4D4FCD9A1DC6E6 /* TemplateRegistryKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BDB4B5E099CD4C1BB3C1CF05 /* TemplateRegistryKey.cpp */; };
+		7905BB681D12050E0019FE57 /* InlineAccess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7905BB661D12050E0019FE57 /* InlineAccess.cpp */; };
+		7905BB691D12050E0019FE57 /* InlineAccess.h in Headers */ = {isa = PBXBuildFile; fileRef = 7905BB671D12050E0019FE57 /* InlineAccess.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79160DBD1C8E3EC8008C085A /* ProxyRevoke.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79160DBB1C8E3EC8008C085A /* ProxyRevoke.cpp */; };
+		79160DBE1C8E3EC8008C085A /* ProxyRevoke.h in Headers */ = {isa = PBXBuildFile; fileRef = 79160DBC1C8E3EC8008C085A /* ProxyRevoke.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7919B7801E03559C005BEED8 /* B3Compile.h in Headers */ = {isa = PBXBuildFile; fileRef = 7919B77F1E03559C005BEED8 /* B3Compile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79233C2B1D34715700C5A834 /* JITMathIC.h in Headers */ = {isa = PBXBuildFile; fileRef = 79233C291D34715700C5A834 /* JITMathIC.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		792CB3491C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 792CB3471C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp */; };
+		792CB34A1C4EED5C00D13AF3 /* PCToCodeOriginMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 792CB3481C4EED5C00D13AF3 /* PCToCodeOriginMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		795B19971D78BE3500262FA0 /* MapBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 795B19951D78BE3500262FA0 /* MapBase.cpp */; };
+		795B19981D78BE3500262FA0 /* MapBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 795B19961D78BE3500262FA0 /* MapBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		795F099D1E03600500BBE37F /* B3Compile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 795F099C1E03600500BBE37F /* B3Compile.cpp */; };
+		7964656A1B952FF0003059EE /* GetPutInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 796465681B952FF0003059EE /* GetPutInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		796FB43A1DFF8C3F0039C95D /* JSWebAssemblyHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = 796FB4391DFF8C3F0039C95D /* JSWebAssemblyHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		797E07A91B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */; };
+		797E07AA1B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7980C16C1E3A940E00B71615 /* DFGRegisteredStructureSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7980C16A1E3A940E00B71615 /* DFGRegisteredStructureSet.cpp */; };
+		7980C16D1E3A940E00B71615 /* DFGRegisteredStructureSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 7980C16B1E3A940E00B71615 /* DFGRegisteredStructureSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		798937781DCAB57300F8D4FB /* JSFixedArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 798937761DCAB57300F8D4FB /* JSFixedArray.cpp */; };
+		798937791DCAB57300F8D4FB /* JSFixedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 798937771DCAB57300F8D4FB /* JSFixedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		799EF7C41C56ED96002B0534 /* B3PCToOriginMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79A0907F1D768465008B889B /* HashMapImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79A0907D1D768465008B889B /* HashMapImpl.cpp */; };
+		79A090801D768465008B889B /* HashMapImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A0907E1D768465008B889B /* HashMapImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79A228351D35D71E00D8E067 /* ArithProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79A228331D35D71E00D8E067 /* ArithProfile.cpp */; };
+		79A228361D35D71F00D8E067 /* ArithProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A228341D35D71E00D8E067 /* ArithProfile.h */; };
+		79AF0BE41D3EFD4C00E95FA5 /* JITMathICInlineResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 79AF0BE31D3EFD4C00E95FA5 /* JITMathICInlineResult.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79B00CBC1C6AB07E0088C65D /* ProxyConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79B00CB81C6AB07E0088C65D /* ProxyConstructor.cpp */; };
+		79B00CBD1C6AB07E0088C65D /* ProxyConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B00CB91C6AB07E0088C65D /* ProxyConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79B00CBE1C6AB07E0088C65D /* ProxyObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79B00CBA1C6AB07E0088C65D /* ProxyObject.cpp */; settings = {COMPILER_FLAGS = "-fno-optimize-sibling-calls"; }; };
+		79B00CBF1C6AB07E0088C65D /* ProxyObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B00CBB1C6AB07E0088C65D /* ProxyObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79B1788E1D399B8000B1A567 /* JITMathICForwards.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A899FE1D38612E00D18C73 /* JITMathICForwards.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79B759741DFA4C600052174C /* WasmMemoryInformation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79B759711DFA4C600052174C /* WasmMemoryInformation.cpp */; };
+		79B759751DFA4C600052174C /* WasmMemoryInformation.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B759721DFA4C600052174C /* WasmMemoryInformation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79B759761DFA4C600052174C /* WasmPageCount.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B759731DFA4C600052174C /* WasmPageCount.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79B819931DD25CF500DDC714 /* JSGlobalObjectInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B819921DD25CF500DDC714 /* JSGlobalObjectInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79C4B15D1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79C4B15B1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp */; };
+		79C4B15E1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 79C4B15C1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79CFC6F01C33B10000C768EA /* LLIntPCRanges.h in Headers */ = {isa = PBXBuildFile; fileRef = 79CFC6EF1C33B10000C768EA /* LLIntPCRanges.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79D5CD5A1C1106A900CECA07 /* SamplingProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79D5CD581C1106A900CECA07 /* SamplingProfiler.cpp */; };
+		79D5CD5B1C1106A900CECA07 /* SamplingProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 79D5CD591C1106A900CECA07 /* SamplingProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79DAE27A1E03C82200B526AA /* WasmExceptionType.h in Headers */ = {isa = PBXBuildFile; fileRef = 79DAE2791E03C82200B526AA /* WasmExceptionType.h */; };
+		79DFCBDB1D88C59600527D03 /* HasOwnPropertyCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 79DFCBDA1D88C59600527D03 /* HasOwnPropertyCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79E423E21DEE65320078D355 /* JSWebAssemblyCallee.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79E423E01DEE65320078D355 /* JSWebAssemblyCallee.cpp */; };
+		79E423E31DEE65320078D355 /* JSWebAssemblyCallee.h in Headers */ = {isa = PBXBuildFile; fileRef = 79E423E11DEE65320078D355 /* JSWebAssemblyCallee.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79EE0BFF1B4AFB85000385C9 /* VariableEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79EE0BFD1B4AFB85000385C9 /* VariableEnvironment.cpp */; };
+		79EE0C001B4AFB85000385C9 /* VariableEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 79EE0BFE1B4AFB85000385C9 /* VariableEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		79F8FC1E1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79F8FC1C1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp */; };
+		79F8FC1F1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */; };
+		79FC8A081E32E9F000D88F0E /* DFGRegisteredStructure.h in Headers */ = {isa = PBXBuildFile; fileRef = 79FC8A071E32E9F000D88F0E /* DFGRegisteredStructure.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7BC547D31B6959A100959B58 /* WasmFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 7BC547D21B69599B00959B58 /* WasmFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7C008CDA187124BB00955C24 /* JSPromiseDeferred.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C008CD8187124BB00955C24 /* JSPromiseDeferred.cpp */; };
+		7C008CDB187124BB00955C24 /* JSPromiseDeferred.h in Headers */ = {isa = PBXBuildFile; fileRef = 7C008CD9187124BB00955C24 /* JSPromiseDeferred.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7C008CE7187631B600955C24 /* Microtask.h in Headers */ = {isa = PBXBuildFile; fileRef = 7C008CE5187631B600955C24 /* Microtask.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7C184E1A17BEDBD3007CB63A /* JSPromise.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C184E1817BEDBD3007CB63A /* JSPromise.cpp */; };
+		7C184E1B17BEDBD3007CB63A /* JSPromise.h in Headers */ = {isa = PBXBuildFile; fileRef = 7C184E1917BEDBD3007CB63A /* JSPromise.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7C184E1E17BEE22E007CB63A /* JSPromisePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C184E1C17BEE22E007CB63A /* JSPromisePrototype.cpp */; };
+		7C184E1F17BEE22E007CB63A /* JSPromisePrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 7C184E1D17BEE22E007CB63A /* JSPromisePrototype.h */; };
+		7C184E2217BEE240007CB63A /* JSPromiseConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7C184E2017BEE240007CB63A /* JSPromiseConstructor.cpp */; };
+		7C184E2317BEE240007CB63A /* JSPromiseConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 7C184E2117BEE240007CB63A /* JSPromiseConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E4EE7080EBB7963005934AA /* StructureChain.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */; };
+		840480131021A1D9008E7F01 /* JSAPIValueWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = BC0894D60FAFBA2D00001865 /* JSAPIValueWrapper.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		860161E30F3A83C100F84710 /* AbstractMacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161DF0F3A83C100F84710 /* AbstractMacroAssembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		860161E40F3A83C100F84710 /* MacroAssemblerX86.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E00F3A83C100F84710 /* MacroAssemblerX86.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E10F3A83C100F84710 /* MacroAssemblerX86_64.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E20F3A83C100F84710 /* MacroAssemblerX86Common.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		8606DDEA18DA44AB00A383D0 /* IdentifierInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 8606DDE918DA44AB00A383D0 /* IdentifierInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		860BD801148EA6F200112B2F /* Intrinsic.h in Headers */ = {isa = PBXBuildFile; fileRef = 86BF642A148DB2B5004DE36A /* Intrinsic.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		8612E4CD152389EC00C836BE /* MatchResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 8612E4CB1522918400C836BE /* MatchResult.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86158AB3155C8B4000B45C9C /* PropertyName.h in Headers */ = {isa = PBXBuildFile; fileRef = 86158AB2155C8B3F00B45C9C /* PropertyName.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		862553D116136DA9009F17D0 /* JSProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 862553CE16136AA5009F17D0 /* JSProxy.cpp */; };
+		862553D216136E1A009F17D0 /* JSProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 862553CF16136AA5009F17D0 /* JSProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		863C6D9C1521111A00585E4E /* YarrCanonicalizeUCS2.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 863C6D981521111200585E4E /* YarrCanonicalizeUCS2.cpp */; };
+		8642C510151C06A90046D4EF /* RegExpCachedResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86F75EFB151C062F007C9BA3 /* RegExpCachedResult.cpp */; };
+		8642C512151C083D0046D4EF /* RegExpMatchesArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86F75EFD151C062F007C9BA3 /* RegExpMatchesArray.cpp */; };
+		865A30F1135007E100CDB49E /* JSCJSValueInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 865A30F0135007E100CDB49E /* JSCJSValueInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		866739D213BFDE710023D87C /* BigInteger.h in Headers */ = {isa = PBXBuildFile; fileRef = 866739D013BFDE710023D87C /* BigInteger.h */; };
+		866739D313BFDE710023D87C /* Uint16WithFraction.h in Headers */ = {isa = PBXBuildFile; fileRef = 866739D113BFDE710023D87C /* Uint16WithFraction.h */; };
+		86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */; };
+		86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B4112DB8A8100A9FE7B /* YarrSyntaxChecker.h */; };
+		86704B8412DBA33700A9FE7B /* YarrInterpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B7D12DBA33700A9FE7B /* YarrInterpreter.cpp */; };
+		86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B7E12DBA33700A9FE7B /* YarrInterpreter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B7F12DBA33700A9FE7B /* YarrJIT.cpp */; };
+		86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8012DBA33700A9FE7B /* YarrJIT.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8112DBA33700A9FE7B /* YarrParser.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86704B8212DBA33700A9FE7B /* YarrPattern.cpp */; };
+		86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8312DBA33700A9FE7B /* YarrPattern.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86880F1F14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86880F1B14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp */; };
+		86880F4D14353B2100B08D42 /* DFGSpeculativeJIT64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86880F4C14353B2100B08D42 /* DFGSpeculativeJIT64.cpp */; };
+		868916B0155F286300CB2B9A /* PrivateName.h in Headers */ = {isa = PBXBuildFile; fileRef = 868916A9155F285400CB2B9A /* PrivateName.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */ = {isa = PBXBuildFile; fileRef = 869EBCB60E8C6D4A008722CC /* ResultType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86A90ED00EE7D51F00AB350D /* JITArithmetic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */; };
+		86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86AE64A9135E5E1C00963012 /* MacroAssemblerSH4.h in Headers */ = {isa = PBXBuildFile; fileRef = 86AE64A6135E5E1C00963012 /* MacroAssemblerSH4.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86AE64AA135E5E1C00963012 /* SH4Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86AE64A7135E5E1C00963012 /* SH4Assembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86B5826714D2796C00A9C306 /* CodeProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86B5822E14D2373B00A9C306 /* CodeProfile.cpp */; };
+		86B5826914D2797000A9C306 /* CodeProfiling.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8603CEF214C7546400AE59E3 /* CodeProfiling.cpp */; };
+		86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86C568E011A213EE0007F7F0 /* MacroAssemblerARM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86C568DD11A213EE0007F7F0 /* MacroAssemblerARM.cpp */; };
+		86C568E111A213EE0007F7F0 /* MacroAssemblerMIPS.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C568DE11A213EE0007F7F0 /* MacroAssemblerMIPS.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86C568DF11A213EE0007F7F0 /* MIPSAssembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86CC85A10EE79A4700288682 /* JITInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 86CC85A00EE79A4700288682 /* JITInlines.h */; };
+		86CC85A30EE79B7400288682 /* JITCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86CC85A20EE79B7400288682 /* JITCall.cpp */; };
+		86CC85C40EE7A89400288682 /* JITPropertyAccess.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */; };
+		86CCEFDE0F413F8900FD7F9E /* JITCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 86CCEFDD0F413F8900FD7F9E /* JITCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86D2221A167EF9440024C804 /* testapi.mm in Sources */ = {isa = PBXBuildFile; fileRef = 86D22219167EF9440024C804 /* testapi.mm */; };
+		86D3B2C310156BDE002865E7 /* ARMAssembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86D3B2BF10156BDE002865E7 /* ARMAssembler.cpp */; };
+		86D3B2C410156BDE002865E7 /* ARMAssembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D3B2C010156BDE002865E7 /* ARMAssembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86D3B2C510156BDE002865E7 /* AssemblerBufferWithConstantPool.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D3B2C110156BDE002865E7 /* AssemblerBufferWithConstantPool.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86D3B2C610156BDE002865E7 /* MacroAssemblerARM.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D3B2C210156BDE002865E7 /* MacroAssemblerARM.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86D3B3C310159D7F002865E7 /* LinkBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D3B3C110159D7F002865E7 /* LinkBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */; };
+		86E116B10FE75AC800B512BC /* CodeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E116B00FE75AC800B512BC /* CodeLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86E3C612167BABD7006D760A /* JSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E3C606167BAB87006D760A /* JSValue.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		86E3C613167BABD7006D760A /* JSContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E3C607167BAB87006D760A /* JSContext.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		86E3C614167BABD7006D760A /* JSExport.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E3C60A167BAB87006D760A /* JSExport.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		86E3C615167BABD7006D760A /* JSVirtualMachine.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E3C60F167BAB87006D760A /* JSVirtualMachine.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		86E3C616167BABEE006D760A /* JSContext.mm in Sources */ = {isa = PBXBuildFile; fileRef = 86E3C608167BAB87006D760A /* JSContext.mm */; };
+		86E3C617167BABEE006D760A /* JSContextInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E3C609167BAB87006D760A /* JSContextInternal.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86E3C618167BABEE006D760A /* JSWrapperMap.mm in Sources */ = {isa = PBXBuildFile; fileRef = 86E3C60B167BAB87006D760A /* JSWrapperMap.mm */; };
+		86E3C619167BABEE006D760A /* JSWrapperMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E3C60C167BAB87006D760A /* JSWrapperMap.h */; };
+		86E3C61A167BABEE006D760A /* JSValue.mm in Sources */ = {isa = PBXBuildFile; fileRef = 86E3C60D167BAB87006D760A /* JSValue.mm */; };
+		86E3C61B167BABEE006D760A /* JSValueInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E3C60E167BAB87006D760A /* JSValueInternal.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86E3C61C167BABEE006D760A /* JSVirtualMachine.mm in Sources */ = {isa = PBXBuildFile; fileRef = 86E3C610167BAB87006D760A /* JSVirtualMachine.mm */; };
+		86E3C61D167BABEE006D760A /* JSVirtualMachineInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E3C611167BAB87006D760A /* JSVirtualMachineInternal.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86E85539111B9968001AF51E /* JSStringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 86E85538111B9968001AF51E /* JSStringBuilder.h */; };
+		86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */; };
+		86EC9DC51328DF82002B2AD7 /* DFGByteCodeParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */; };
+		86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */; };
+		86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */; };
+		86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DB81328DF82002B2AD7 /* DFGGraph.h */; };
+		86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */; };
+		86EC9DCC1328DF82002B2AD7 /* DFGJITCompiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */; };
+		86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */; };
+		86EC9DD01328DF82002B2AD7 /* DFGOperations.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC01328DF82002B2AD7 /* DFGOperations.h */; };
+		86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */; };
+		86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */; };
+		86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */; };
+		86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */; };
+		86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */; };
+		86F3EEBD168CDE930077B92A /* ObjCCallbackFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 86F3EEB9168CCF750077B92A /* ObjCCallbackFunction.h */; };
+		86F3EEBE168CDE930077B92A /* ObjCCallbackFunction.mm in Sources */ = {isa = PBXBuildFile; fileRef = 86F3EEBA168CCF750077B92A /* ObjCCallbackFunction.mm */; };
+		86F3EEBF168CDE930077B92A /* ObjcRuntimeExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 86F3EEB616855A5B0077B92A /* ObjcRuntimeExtras.h */; };
+		86FA9E91142BBB2E001773B7 /* JSBoundFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */; };
+		86FA9E92142BBB2E001773B7 /* JSBoundFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */; };
+		8B9F6D561D5912FA001C739F /* IterationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 8B9F6D551D5912FA001C739F /* IterationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */; };
+		90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */ = {isa = PBXBuildFile; fileRef = 90213E3C123A40C200D422F3 /* MemoryStatistics.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93052C320FB792190048FDC3 /* ParserArena.cpp */; };
+		93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
+		932F5BD60822A1C700736975 /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */; };
+		932F5BD70822A1C700736975 /* libicucore.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 9322A00306C341D3009067BB /* libicucore.dylib */; };
+		932F5BDD0822A1C700736975 /* jsc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 45E12D8806A49B0F00E9DF84 /* jsc.cpp */; };
+		932F5BEA0822A1C700736975 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
+		933040040E6A749400786E6A /* SmallStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 93303FEA0E6A72C000786E6A /* SmallStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93303FE80E6A72B500786E6A /* SmallStrings.cpp */; };
+		9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93345A8712D838C400302BE3 /* StringRecursionChecker.cpp */; };
+		95D4261AF4C84CE2ACBAC981 /* TemplateRegistryKeyTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 08FC2F37AB76483A9966688F /* TemplateRegistryKeyTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		960097A60EBABB58007A7297 /* LabelScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 960097A50EBABB58007A7297 /* LabelScope.h */; };
+		9688CB150ED12B4E001D649F /* AssemblerBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 9688CB130ED12B4E001D649F /* AssemblerBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 9688CB140ED12B4E001D649F /* X86Assembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		969A07230ED1CE3300F1F681 /* BytecodeGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07210ED1CE3300F1F681 /* BytecodeGenerator.h */; };
+		969A072A0ED1CE6900F1F681 /* Label.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07270ED1CE6900F1F681 /* Label.h */; };
+		969A072B0ED1CE6900F1F681 /* RegisterID.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07280ED1CE6900F1F681 /* RegisterID.h */; };
+		969A07960ED1D3AE00F1F681 /* CodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07900ED1D3AE00F1F681 /* CodeBlock.cpp */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
+		969A07970ED1D3AE00F1F681 /* CodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07910ED1D3AE00F1F681 /* CodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		969A07980ED1D3AE00F1F681 /* DirectEvalCodeCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07920ED1D3AE00F1F681 /* DirectEvalCodeCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		969A07990ED1D3AE00F1F681 /* Instruction.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07930ED1D3AE00F1F681 /* Instruction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		969A079A0ED1D3AE00F1F681 /* Opcode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07940ED1D3AE00F1F681 /* Opcode.cpp */; };
+		969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 969A07950ED1D3AE00F1F681 /* Opcode.h */; };
+		978801401471AD920041B016 /* JSDateMath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9788FC221471AD0C0068CE2D /* JSDateMath.cpp */; };
+		978801411471AD920041B016 /* JSDateMath.h in Headers */ = {isa = PBXBuildFile; fileRef = 9788FC231471AD0C0068CE2D /* JSDateMath.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		990DA67F1C8E316A00295159 /* generate_objc_protocol_type_conversions_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = 990DA67E1C8E311D00295159 /* generate_objc_protocol_type_conversions_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		9928FF3B18AC4AEC00B8CF12 /* JSReplayInputs.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9928FF3918AC4AEC00B8CF12 /* JSReplayInputs.cpp */; };
+		9928FF3C18AC4AEC00B8CF12 /* JSReplayInputs.h in Headers */ = {isa = PBXBuildFile; fileRef = 9928FF3A18AC4AEC00B8CF12 /* JSReplayInputs.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		992ABCF91BEA9BD2006403A0 /* RemoteAutomationTarget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 992ABCF51BEA94CA006403A0 /* RemoteAutomationTarget.cpp */; };
+		9959E92B1BD17FA4001AA413 /* cssmin.py in Headers */ = {isa = PBXBuildFile; fileRef = 9959E9271BD17FA0001AA413 /* cssmin.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		9959E92D1BD17FA4001AA413 /* jsmin.py in Headers */ = {isa = PBXBuildFile; fileRef = 9959E9291BD17FA0001AA413 /* jsmin.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		9959E92E1BD17FA4001AA413 /* xxd.pl in Headers */ = {isa = PBXBuildFile; fileRef = 9959E92A1BD17FA0001AA413 /* xxd.pl */; settings = {ATTRIBUTES = (Private, ); }; };
+		9959E9311BD18272001AA413 /* generate-combined-inspector-json.py in Headers */ = {isa = PBXBuildFile; fileRef = 9959E92F1BD181F6001AA413 /* generate-combined-inspector-json.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		9959E9321BD18279001AA413 /* inline-and-minify-stylesheets-and-scripts.py in Headers */ = {isa = PBXBuildFile; fileRef = 9959E9301BD181F6001AA413 /* inline-and-minify-stylesheets-and-scripts.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		996231E918D1804200C03FDA /* InspectorBackendCommands.js in Headers */ = {isa = PBXBuildFile; fileRef = A53243961856A475002ED692 /* InspectorBackendCommands.js */; settings = {ATTRIBUTES = (Private, ); }; };
+		996B73171BDA067F00331B84 /* ArrayConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73151BDA05AA00331B84 /* ArrayConstructor.lut.h */; };
+		996B73181BDA068000331B84 /* ArrayIteratorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73161BDA05AA00331B84 /* ArrayIteratorPrototype.lut.h */; };
+		996B73191BDA068000331B84 /* BooleanPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73071BD9FA2C00331B84 /* BooleanPrototype.lut.h */; };
+		996B731A1BDA08D100331B84 /* DateConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73081BD9FA2C00331B84 /* DateConstructor.lut.h */; };
+		996B731B1BDA08D100331B84 /* ErrorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73091BD9FA2C00331B84 /* ErrorPrototype.lut.h */; };
+		996B731C1BDA08DD00331B84 /* JSDataViewPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B730A1BD9FA2C00331B84 /* JSDataViewPrototype.lut.h */; };
+		996B731D1BDA08EF00331B84 /* JSGlobalObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B730B1BD9FA2C00331B84 /* JSGlobalObject.lut.h */; };
+		996B731E1BDA08EF00331B84 /* JSPromiseConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 7C184E2417BFFA36007CB63A /* JSPromiseConstructor.lut.h */; };
+		996B731F1BDA08EF00331B84 /* JSPromisePrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 7C184E2517BFFA36007CB63A /* JSPromisePrototype.lut.h */; };
+		996B73201BDA08EF00331B84 /* ModuleLoaderPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B730C1BD9FA2C00331B84 /* ModuleLoaderPrototype.lut.h */; };
+		996B73211BDA08EF00331B84 /* NumberPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B730D1BD9FA2C00331B84 /* NumberPrototype.lut.h */; };
+		996B73221BDA08EF00331B84 /* ObjectConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B730E1BD9FA2C00331B84 /* ObjectConstructor.lut.h */; };
+		996B73231BDA08EF00331B84 /* ReflectObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B730F1BD9FA2C00331B84 /* ReflectObject.lut.h */; };
+		996B73251BDA08EF00331B84 /* StringConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73111BD9FA2C00331B84 /* StringConstructor.lut.h */; };
+		996B73261BDA08EF00331B84 /* StringIteratorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73121BD9FA2C00331B84 /* StringIteratorPrototype.lut.h */; };
+		996B73271BDA08EF00331B84 /* SymbolConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73131BD9FA2C00331B84 /* SymbolConstructor.lut.h */; };
+		996B73281BDA08EF00331B84 /* SymbolPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = 996B73141BD9FA2C00331B84 /* SymbolPrototype.lut.h */; };
+		998ED6741BED70AC00DD8017 /* RemoteControllableTarget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 998ED6721BED659A00DD8017 /* RemoteControllableTarget.cpp */; };
+		998ED6751BED768C00DD8017 /* RemoteControllableTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = 998ED6731BED659A00DD8017 /* RemoteControllableTarget.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		99CC0B6218BE9946006CEBCC /* CodeGeneratorReplayInputsTemplates.py in Headers */ = {isa = PBXBuildFile; fileRef = 99E45A1E18A1B1E70026D88F /* CodeGeneratorReplayInputsTemplates.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99CC0B6318BE9950006CEBCC /* CodeGeneratorReplayInputs.py in Headers */ = {isa = PBXBuildFile; fileRef = 99E45A1D18A1B1E70026D88F /* CodeGeneratorReplayInputs.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99D6A1161BEAD34D00E25C37 /* RemoteAutomationTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = 992ABCF61BEA94CA006403A0 /* RemoteAutomationTarget.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00A31BD5993100F4575C /* builtins_generator.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA009A1BD5992700F4575C /* builtins_generator.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00A41BD5993100F4575C /* builtins_model.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA009B1BD5992700F4575C /* builtins_model.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00A51BD5993100F4575C /* builtins_templates.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA009C1BD5992700F4575C /* builtins_templates.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00A61BD5993100F4575C /* builtins.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA009D1BD5992700F4575C /* builtins.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00A71BD5993100F4575C /* builtins_generate_combined_header.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA009E1BD5992700F4575C /* builtins_generate_combined_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00A81BD5993100F4575C /* builtins_generate_combined_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA009F1BD5992700F4575C /* builtins_generate_combined_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00A91BD5993100F4575C /* builtins_generate_separate_header.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA00A01BD5992700F4575C /* builtins_generate_separate_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00AA1BD5993100F4575C /* builtins_generate_separate_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA00A11BD5992700F4575C /* builtins_generate_separate_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00AF1BD5994E00F4575C /* generate-js-builtins.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA00AC1BD5993E00F4575C /* generate-js-builtins.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00B01BD5994E00F4575C /* lazywriter.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA00AD1BD5993E00F4575C /* lazywriter.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99DA00B11BD5994E00F4575C /* UpdateContents.py in Headers */ = {isa = PBXBuildFile; fileRef = 99DA00AE1BD5993E00F4575C /* UpdateContents.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		99E45A2418A1B2590026D88F /* EmptyInputCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 99E45A1F18A1B2590026D88F /* EmptyInputCursor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		99E45A2518A1B2590026D88F /* EncodedValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 99E45A2018A1B2590026D88F /* EncodedValue.cpp */; };
+		99E45A2618A1B2590026D88F /* EncodedValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 99E45A2118A1B2590026D88F /* EncodedValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		99E45A2718A1B2590026D88F /* InputCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 99E45A2218A1B2590026D88F /* InputCursor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		99E45A2818A1B2590026D88F /* NondeterministicInput.h in Headers */ = {isa = PBXBuildFile; fileRef = 99E45A2318A1B2590026D88F /* NondeterministicInput.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		99F1A6FE1B8E6D9400463B26 /* InspectorFrontendRouter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 99F1A6FC1B8E6D9400463B26 /* InspectorFrontendRouter.cpp */; };
+		99F1A7011B98FBEC00463B26 /* InspectorFrontendRouter.h in Headers */ = {isa = PBXBuildFile; fileRef = 99F1A7001B98FBEC00463B26 /* InspectorFrontendRouter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9E729407190F01A5001A91B5 /* InitializeThreading.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */; };
+		9E72940B190F0514001A91B5 /* BundlePath.h in Headers */ = {isa = PBXBuildFile; fileRef = 9E72940A190F0514001A91B5 /* BundlePath.h */; };
+		9EA5C7A1190F084200508EBE /* BundlePath.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9E729409190F0306001A91B5 /* BundlePath.mm */; };
+		A125846E1B45A36000CC7F6C /* IntlNumberFormatConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = A125846C1B45A36000CC7F6C /* IntlNumberFormatConstructor.lut.h */; };
+		A125846F1B45A36000CC7F6C /* IntlNumberFormatPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = A125846D1B45A36000CC7F6C /* IntlNumberFormatPrototype.lut.h */; };
+		A12BBFF21B044A8B00664B69 /* IntlObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A12BBFF11B044A8B00664B69 /* IntlObject.h */; };
+		A12BBFF41B044A9800664B69 /* IntlObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A12BBFF31B044A9800664B69 /* IntlObject.cpp */; };
+		A1587D6D1B4DC14100D69849 /* IntlDateTimeFormat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1587D671B4DC14100D69849 /* IntlDateTimeFormat.cpp */; };
+		A1587D6E1B4DC14100D69849 /* IntlDateTimeFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = A1587D681B4DC14100D69849 /* IntlDateTimeFormat.h */; };
+		A1587D6F1B4DC14100D69849 /* IntlDateTimeFormatConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1587D691B4DC14100D69849 /* IntlDateTimeFormatConstructor.cpp */; };
+		A1587D701B4DC14100D69849 /* IntlDateTimeFormatConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = A1587D6A1B4DC14100D69849 /* IntlDateTimeFormatConstructor.h */; };
+		A1587D711B4DC14100D69849 /* IntlDateTimeFormatPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1587D6B1B4DC14100D69849 /* IntlDateTimeFormatPrototype.cpp */; };
+		A1587D721B4DC14100D69849 /* IntlDateTimeFormatPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A1587D6C1B4DC14100D69849 /* IntlDateTimeFormatPrototype.h */; };
+		A1587D751B4DC1C600D69849 /* IntlDateTimeFormatConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = A1587D731B4DC1C600D69849 /* IntlDateTimeFormatConstructor.lut.h */; };
+		A1587D761B4DC1C600D69849 /* IntlDateTimeFormatPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = A1587D741B4DC1C600D69849 /* IntlDateTimeFormatPrototype.lut.h */; };
+		A1712B3B11C7B212007A5315 /* RegExpCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1712B3A11C7B212007A5315 /* RegExpCache.cpp */; };
+		A1712B3F11C7B228007A5315 /* RegExpCache.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B3E11C7B228007A5315 /* RegExpCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A1712B4111C7B235007A5315 /* RegExpKey.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B4011C7B235007A5315 /* RegExpKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A18193E31B4E0CDB00FC1029 /* IntlCollatorConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = A18193E11B4E0CDB00FC1029 /* IntlCollatorConstructor.lut.h */; };
+		A18193E41B4E0CDB00FC1029 /* IntlCollatorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = A18193E21B4E0CDB00FC1029 /* IntlCollatorPrototype.lut.h */; };
+		A1A009C01831A22D00CF8711 /* MacroAssemblerARM64.h in Headers */ = {isa = PBXBuildFile; fileRef = 8640923C156EED3B00566CB2 /* MacroAssemblerARM64.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A1A009C11831A26E00CF8711 /* ARM64Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 8640923B156EED3B00566CB2 /* ARM64Assembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A1B9E2391B4E0D6700BC7FED /* IntlCollator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1B9E2331B4E0D6700BC7FED /* IntlCollator.cpp */; };
+		A1B9E23A1B4E0D6700BC7FED /* IntlCollator.h in Headers */ = {isa = PBXBuildFile; fileRef = A1B9E2341B4E0D6700BC7FED /* IntlCollator.h */; };
+		A1B9E23B1B4E0D6700BC7FED /* IntlCollatorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1B9E2351B4E0D6700BC7FED /* IntlCollatorConstructor.cpp */; };
+		A1B9E23C1B4E0D6700BC7FED /* IntlCollatorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = A1B9E2361B4E0D6700BC7FED /* IntlCollatorConstructor.h */; };
+		A1B9E23D1B4E0D6700BC7FED /* IntlCollatorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1B9E2371B4E0D6700BC7FED /* IntlCollatorPrototype.cpp */; };
+		A1B9E23E1B4E0D6700BC7FED /* IntlCollatorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A1B9E2381B4E0D6700BC7FED /* IntlCollatorPrototype.h */; };
+		A1D792FC1B43864B004516F5 /* IntlNumberFormat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1D792F61B43864B004516F5 /* IntlNumberFormat.cpp */; };
+		A1D792FD1B43864B004516F5 /* IntlNumberFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = A1D792F71B43864B004516F5 /* IntlNumberFormat.h */; };
+		A1D792FE1B43864B004516F5 /* IntlNumberFormatConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1D792F81B43864B004516F5 /* IntlNumberFormatConstructor.cpp */; };
+		A1D792FF1B43864B004516F5 /* IntlNumberFormatConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = A1D792F91B43864B004516F5 /* IntlNumberFormatConstructor.h */; };
+		A1D793001B43864B004516F5 /* IntlNumberFormatPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1D792FA1B43864B004516F5 /* IntlNumberFormatPrototype.cpp */; };
+		A1D793011B43864B004516F5 /* IntlNumberFormatPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A1D792FB1B43864B004516F5 /* IntlNumberFormatPrototype.h */; };
+		A503FA19188E0FB000110F14 /* JavaScriptCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A503FA13188E0FAF00110F14 /* JavaScriptCallFrame.cpp */; };
+		A503FA1A188E0FB000110F14 /* JavaScriptCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = A503FA14188E0FAF00110F14 /* JavaScriptCallFrame.h */; };
+		A503FA1B188E0FB000110F14 /* JSJavaScriptCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A503FA15188E0FB000110F14 /* JSJavaScriptCallFrame.cpp */; };
+		A503FA1D188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A503FA17188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp */; };
+		A503FA1E188E0FB000110F14 /* JSJavaScriptCallFramePrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A503FA18188E0FB000110F14 /* JSJavaScriptCallFramePrototype.h */; };
+		A503FA21188EFF6800110F14 /* ScriptBreakpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = A503FA1F188EFF6800110F14 /* ScriptBreakpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A503FA22188EFF6800110F14 /* ScriptDebugListener.h in Headers */ = {isa = PBXBuildFile; fileRef = A503FA20188EFF6800110F14 /* ScriptDebugListener.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A503FA25188EFFFD00110F14 /* ScriptDebugServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A503FA23188EFFFD00110F14 /* ScriptDebugServer.cpp */; };
+		A503FA26188EFFFD00110F14 /* ScriptDebugServer.h in Headers */ = {isa = PBXBuildFile; fileRef = A503FA24188EFFFD00110F14 /* ScriptDebugServer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A503FA29188F105900110F14 /* JSGlobalObjectScriptDebugServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A503FA27188F105900110F14 /* JSGlobalObjectScriptDebugServer.cpp */; };
+		A503FA2A188F105900110F14 /* JSGlobalObjectScriptDebugServer.h in Headers */ = {isa = PBXBuildFile; fileRef = A503FA28188F105900110F14 /* JSGlobalObjectScriptDebugServer.h */; };
+		A5098B041C16AA0200087797 /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = A5098B031C16AA0200087797 /* Security.framework */; };
+		A50E4B6118809DD50068A46D /* InspectorRuntimeAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A50E4B5D18809DD50068A46D /* InspectorRuntimeAgent.cpp */; };
+		A50E4B6218809DD50068A46D /* InspectorRuntimeAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A50E4B5E18809DD50068A46D /* InspectorRuntimeAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A50E4B6318809DD50068A46D /* JSGlobalObjectRuntimeAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A50E4B5F18809DD50068A46D /* JSGlobalObjectRuntimeAgent.cpp */; };
+		A50E4B6418809DD50068A46D /* JSGlobalObjectRuntimeAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A50E4B6018809DD50068A46D /* JSGlobalObjectRuntimeAgent.h */; };
+		A51007C0187CC3C600B38879 /* JSGlobalObjectInspectorController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A51007BE187CC3C600B38879 /* JSGlobalObjectInspectorController.cpp */; };
+		A51007C1187CC3C600B38879 /* JSGlobalObjectInspectorController.h in Headers */ = {isa = PBXBuildFile; fileRef = A51007BF187CC3C600B38879 /* JSGlobalObjectInspectorController.h */; };
+		A513E5B7185B8BD3007E95AD /* InjectedScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A513E5B5185B8BD3007E95AD /* InjectedScript.cpp */; };
+		A513E5B8185B8BD3007E95AD /* InjectedScript.h in Headers */ = {isa = PBXBuildFile; fileRef = A513E5B6185B8BD3007E95AD /* InjectedScript.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A513E5BE185BFACC007E95AD /* InjectedScriptHost.h in Headers */ = {isa = PBXBuildFile; fileRef = A513E5B9185BFACC007E95AD /* InjectedScriptHost.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A513E5BF185BFACC007E95AD /* JSInjectedScriptHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A513E5BA185BFACC007E95AD /* JSInjectedScriptHost.cpp */; };
+		A513E5C0185BFACC007E95AD /* JSInjectedScriptHost.h in Headers */ = {isa = PBXBuildFile; fileRef = A513E5BB185BFACC007E95AD /* JSInjectedScriptHost.h */; };
+		A513E5C1185BFACC007E95AD /* JSInjectedScriptHostPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A513E5BC185BFACC007E95AD /* JSInjectedScriptHostPrototype.cpp */; };
+		A513E5C2185BFACC007E95AD /* JSInjectedScriptHostPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A513E5BD185BFACC007E95AD /* JSInjectedScriptHostPrototype.h */; };
+		A513E5C7185F9446007E95AD /* InjectedScriptSource.h in Headers */ = {isa = PBXBuildFile; fileRef = A513E5C6185F9436007E95AD /* InjectedScriptSource.h */; };
+		A513E5CA185F9624007E95AD /* InjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A513E5C8185F9624007E95AD /* InjectedScriptManager.cpp */; };
+		A513E5CB185F9624007E95AD /* InjectedScriptManager.h in Headers */ = {isa = PBXBuildFile; fileRef = A513E5C9185F9624007E95AD /* InjectedScriptManager.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A514B2C2185A684400F3C7CB /* InjectedScriptBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A514B2C0185A684400F3C7CB /* InjectedScriptBase.cpp */; };
+		A514B2C3185A684400F3C7CB /* InjectedScriptBase.h in Headers */ = {isa = PBXBuildFile; fileRef = A514B2C1185A684400F3C7CB /* InjectedScriptBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5311C361C77CEC500E6B1B6 /* HeapSnapshotBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = A5311C351C77CEAC00E6B1B6 /* HeapSnapshotBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5311C371C77CECA00E6B1B6 /* HeapSnapshotBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5311C341C77CEAC00E6B1B6 /* HeapSnapshotBuilder.cpp */; };
+		A532438718568335002ED692 /* InspectorBackendDispatchers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A532438118568317002ED692 /* InspectorBackendDispatchers.cpp */; };
+		A532438818568335002ED692 /* InspectorBackendDispatchers.h in Headers */ = {isa = PBXBuildFile; fileRef = A532438218568317002ED692 /* InspectorBackendDispatchers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A532438918568335002ED692 /* InspectorFrontendDispatchers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A532438318568317002ED692 /* InspectorFrontendDispatchers.cpp */; };
+		A532438A18568335002ED692 /* InspectorFrontendDispatchers.h in Headers */ = {isa = PBXBuildFile; fileRef = A532438418568317002ED692 /* InspectorFrontendDispatchers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A532438B18568335002ED692 /* InspectorProtocolObjects.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A532438518568317002ED692 /* InspectorProtocolObjects.cpp */; };
+		A532438C18568335002ED692 /* InspectorProtocolObjects.h in Headers */ = {isa = PBXBuildFile; fileRef = A532438618568317002ED692 /* InspectorProtocolObjects.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A53243981856A489002ED692 /* CombinedDomains.json in Headers */ = {isa = PBXBuildFile; fileRef = A53243951856A475002ED692 /* CombinedDomains.json */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5339EC61BB399A60054F005 /* InspectorHeapAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5339EC51BB399900054F005 /* InspectorHeapAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5339EC71BB399A90054F005 /* InspectorHeapAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5339EC41BB399900054F005 /* InspectorHeapAgent.cpp */; };
+		A5339EC91BB4B4600054F005 /* HeapObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = A5339EC81BB4B4510054F005 /* HeapObserver.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5398FAB1C750DA40060A963 /* HeapProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = A5398FAA1C750D950060A963 /* HeapProfiler.h */; };
+		A5398FAC1C750DA60060A963 /* HeapProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5398FA91C750D950060A963 /* HeapProfiler.cpp */; };
+		A53CE08A18BC21C300BEDF76 /* ConsoleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = A53CE08918BC21C300BEDF76 /* ConsoleClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A53F1AC018C90F8F0072EB6D /* framework.sb in Resources */ = {isa = PBXBuildFile; fileRef = A53F1ABE18C90EC70072EB6D /* framework.sb */; };
+		A54982031891D0B00081E5B8 /* EventLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A54982011891D0B00081E5B8 /* EventLoop.cpp */; };
+		A54982041891D0B00081E5B8 /* EventLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = A54982021891D0B00081E5B8 /* EventLoop.h */; };
+		A54C2AB01C6544EE00A18D78 /* HeapSnapshot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A54C2AAE1C6544D100A18D78 /* HeapSnapshot.cpp */; };
+		A54C2AB11C6544F200A18D78 /* HeapSnapshot.h in Headers */ = {isa = PBXBuildFile; fileRef = A54C2AAF1C6544D100A18D78 /* HeapSnapshot.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A54CF2F5184EAB2400237F19 /* ScriptValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A54CF2F2184EAB2400237F19 /* ScriptValue.cpp */; };
+		A54CF2F6184EAB2400237F19 /* ScriptValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A54CF2F3184EAB2400237F19 /* ScriptValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A54CF2F9184EAEDA00237F19 /* ScriptObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A54CF2F7184EAEDA00237F19 /* ScriptObject.cpp */; };
+		A54CF2FA184EAEDA00237F19 /* ScriptObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A54CF2F8184EAEDA00237F19 /* ScriptObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A54E8EB018BFFBBB00556D28 /* GCSegmentedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A343F7418A1748B0039B085 /* GCSegmentedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A54E8EB118BFFBBE00556D28 /* GCSegmentedArrayInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A343F7718A1749D0039B085 /* GCSegmentedArrayInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A55165D21BDF0B98003B75C1 /* InspectorScriptProfilerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A55165D01BDEFDBD003B75C1 /* InspectorScriptProfilerAgent.cpp */; };
+		A55165D31BDF0B9E003B75C1 /* InspectorScriptProfilerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A55165D11BDEFDBD003B75C1 /* InspectorScriptProfilerAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A55165D51BDF135A003B75C1 /* ScriptProfilingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = A55165D41BDF134D003B75C1 /* ScriptProfilingScope.h */; };
+		A552C37F1ADDB8FE00139726 /* JSRemoteInspector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A552C37D1ADDB8FE00139726 /* JSRemoteInspector.cpp */; };
+		A552C3801ADDB8FE00139726 /* JSRemoteInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = A552C37E1ADDB8FE00139726 /* JSRemoteInspector.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A55714BE1CD8049F0004D2C6 /* ConsoleObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A55714BD1CD8048E0004D2C6 /* ConsoleObject.h */; };
+		A55714BF1CD804A40004D2C6 /* ConsoleObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A55714BC1CD8048E0004D2C6 /* ConsoleObject.cpp */; };
+		A55D93A5185012A800400DED /* ScriptFunctionCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A55D93A3185012A800400DED /* ScriptFunctionCall.cpp */; };
+		A55D93A6185012A800400DED /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = A55D93A4185012A800400DED /* ScriptFunctionCall.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A55D93AC18514F7900400DED /* InspectorProtocolTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = A55D93AB18514F7900400DED /* InspectorProtocolTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A57D23E51890CEBF0031C7FA /* InspectorDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A57D23E31890CEBF0031C7FA /* InspectorDebuggerAgent.cpp */; };
+		A57D23E61890CEBF0031C7FA /* InspectorDebuggerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A57D23E41890CEBF0031C7FA /* InspectorDebuggerAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A57D23E91891B0770031C7FA /* JSGlobalObjectDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A57D23E71891B0770031C7FA /* JSGlobalObjectDebuggerAgent.cpp */; };
+		A57D23EA1891B0770031C7FA /* JSGlobalObjectDebuggerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A57D23E81891B0770031C7FA /* JSGlobalObjectDebuggerAgent.h */; };
+		A57D23ED1891B5540031C7FA /* RegularExpression.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A57D23EB1891B5540031C7FA /* RegularExpression.cpp */; };
+		A57D23EE1891B5540031C7FA /* RegularExpression.h in Headers */ = {isa = PBXBuildFile; fileRef = A57D23EC1891B5540031C7FA /* RegularExpression.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A57D23F11891B5B40031C7FA /* ContentSearchUtilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A57D23EF1891B5B40031C7FA /* ContentSearchUtilities.cpp */; };
+		A57D23F21891B5B40031C7FA /* ContentSearchUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = A57D23F01891B5B40031C7FA /* ContentSearchUtilities.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A584032018BFFBE1005A0811 /* InspectorAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5CEEE13187F3BAD00E55C99 /* InspectorAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5840E20187B7B8600843B10 /* InjectedScriptModule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5840E1E187B7B8600843B10 /* InjectedScriptModule.cpp */; };
+		A5840E21187B7B8600843B10 /* InjectedScriptModule.h in Headers */ = {isa = PBXBuildFile; fileRef = A5840E1F187B7B8600843B10 /* InjectedScriptModule.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A58C024218E4A41A00032BC5 /* JSContextPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A58C024118E4A41A00032BC5 /* JSContextPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A58E35911860DECF001F24FE /* InjectedScriptHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A58E35901860DEC7001F24FE /* InjectedScriptHost.cpp */; };
+		A593CF7C1840360300BFCE27 /* InspectorBackendDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A593CF7A1840360300BFCE27 /* InspectorBackendDispatcher.cpp */; };
+		A593CF7D1840360300BFCE27 /* InspectorBackendDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = A593CF7B1840360300BFCE27 /* InspectorBackendDispatcher.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A593CF7F1840362C00BFCE27 /* InspectorAgentBase.h in Headers */ = {isa = PBXBuildFile; fileRef = A593CF7E1840362C00BFCE27 /* InspectorAgentBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A593CF821840377100BFCE27 /* InspectorValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A593CF801840377100BFCE27 /* InspectorValues.cpp */; };
+		A593CF831840377100BFCE27 /* InspectorValues.h in Headers */ = {isa = PBXBuildFile; fileRef = A593CF811840377100BFCE27 /* InspectorValues.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A593CF86184038CA00BFCE27 /* InspectorAgentRegistry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A593CF84184038CA00BFCE27 /* InspectorAgentRegistry.cpp */; };
+		A593CF87184038CA00BFCE27 /* InspectorAgentRegistry.h in Headers */ = {isa = PBXBuildFile; fileRef = A593CF85184038CA00BFCE27 /* InspectorAgentRegistry.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A594558F18245EFD00CC3843 /* RemoteInspectionTarget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A594558E18245EDE00CC3843 /* RemoteInspectionTarget.cpp */; };
+		A59455921824744700CC3843 /* JSGlobalObjectDebuggable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A59455901824744700CC3843 /* JSGlobalObjectDebuggable.cpp */; };
+		A59455931824744700CC3843 /* JSGlobalObjectDebuggable.h in Headers */ = {isa = PBXBuildFile; fileRef = A59455911824744700CC3843 /* JSGlobalObjectDebuggable.h */; };
+		A5945595182479EB00CC3843 /* InspectorFrontendChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = A5945594182479EB00CC3843 /* InspectorFrontendChannel.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5A1A0941D8CB33E004C2EB8 /* DebuggerParseData.h in Headers */ = {isa = PBXBuildFile; fileRef = A5A1A0921D8CB12F004C2EB8 /* DebuggerParseData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5A1A0951D8CB341004C2EB8 /* DebuggerParseData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5A1A0931D8CB337004C2EB8 /* DebuggerParseData.cpp */; };
+		A5AB49DC1BEC8082007020FB /* PerGlobalObjectWrapperWorld.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5AB49DA1BEC8079007020FB /* PerGlobalObjectWrapperWorld.cpp */; };
+		A5AB49DD1BEC8086007020FB /* PerGlobalObjectWrapperWorld.h in Headers */ = {isa = PBXBuildFile; fileRef = A5AB49DB1BEC8079007020FB /* PerGlobalObjectWrapperWorld.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5B6A74D18C6DBA600F11E91 /* ConsoleClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5B6A74C18C6DBA600F11E91 /* ConsoleClient.cpp */; };
+		A5BA15E8182340B300A82E69 /* RemoteInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = A5BA15E1182340B300A82E69 /* RemoteInspector.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5BA15E9182340B300A82E69 /* RemoteInspector.mm in Sources */ = {isa = PBXBuildFile; fileRef = A5BA15E2182340B300A82E69 /* RemoteInspector.mm */; };
+		A5BA15EA182340B400A82E69 /* RemoteInspectorConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = A5BA15E3182340B300A82E69 /* RemoteInspectorConstants.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5BA15EB182340B400A82E69 /* RemoteConnectionToTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = A5BA15E4182340B300A82E69 /* RemoteConnectionToTarget.h */; };
+		A5BA15EC182340B400A82E69 /* RemoteConnectionToTarget.mm in Sources */ = {isa = PBXBuildFile; fileRef = A5BA15E5182340B300A82E69 /* RemoteConnectionToTarget.mm */; };
+		A5BA15ED182340B400A82E69 /* RemoteInspectorXPCConnection.h in Headers */ = {isa = PBXBuildFile; fileRef = A5BA15E6182340B300A82E69 /* RemoteInspectorXPCConnection.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5BA15EE182340B400A82E69 /* RemoteInspectorXPCConnection.mm in Sources */ = {isa = PBXBuildFile; fileRef = A5BA15E7182340B300A82E69 /* RemoteInspectorXPCConnection.mm */; };
+		A5BA15F0182345AF00A82E69 /* RemoteInspectionTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = A5BA15EF182345AF00A82E69 /* RemoteInspectionTarget.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5C3A1A518C0490200C9593A /* JSGlobalObjectConsoleClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5C3A1A318C0490200C9593A /* JSGlobalObjectConsoleClient.cpp */; };
+		A5C3A1A618C0490200C9593A /* JSGlobalObjectConsoleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = A5C3A1A418C0490200C9593A /* JSGlobalObjectConsoleClient.h */; };
+		A5CEEE14187F3BAD00E55C99 /* InspectorAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5CEEE12187F3BAD00E55C99 /* InspectorAgent.cpp */; };
+		A5D0A1BB1862301B00C7B496 /* InspectorEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = A5D0A1BA1862301B00C7B496 /* InspectorEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5D2E665195E174000A518E7 /* JSContextRefInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = A5D2E664195E173800A518E7 /* JSContextRefInternal.h */; };
+		A5EA70E719F5B1010098F5EC /* AugmentableInspectorController.h in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70E419F5B1010098F5EC /* AugmentableInspectorController.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA70E819F5B1010098F5EC /* AugmentableInspectorControllerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70E519F5B1010098F5EC /* AugmentableInspectorControllerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA70E919F5B1010098F5EC /* AlternateDispatchableAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70E619F5B1010098F5EC /* AlternateDispatchableAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA70EC19F5B3EA0098F5EC /* generate_cpp_alternate_backend_dispatcher_header.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70EA19F5B3D50098F5EC /* generate_cpp_alternate_backend_dispatcher_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA70EE19F5B5C40098F5EC /* JSContextRefInspectorSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70ED19F5B5C40098F5EC /* JSContextRefInspectorSupport.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710319F6DE6F0098F5EC /* generate_objc_backend_dispatcher_header.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70EF19F6DE5A0098F5EC /* generate_objc_backend_dispatcher_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710419F6DE720098F5EC /* generate_objc_backend_dispatcher_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70F019F6DE5A0098F5EC /* generate_objc_backend_dispatcher_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710519F6DE740098F5EC /* generate_objc_configuration_header.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70F119F6DE5A0098F5EC /* generate_objc_configuration_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710619F6DE760098F5EC /* generate_objc_configuration_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70F219F6DE5A0098F5EC /* generate_objc_configuration_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710719F6DE780098F5EC /* generate_objc_protocol_type_conversions_header.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70F319F6DE5A0098F5EC /* generate_objc_protocol_type_conversions_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710819F6DE7A0098F5EC /* generate_objc_frontend_dispatcher_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70F419F6DE5A0098F5EC /* generate_objc_frontend_dispatcher_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710919F6DE7C0098F5EC /* generate_objc_header.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70F519F6DE5A0098F5EC /* generate_objc_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710A19F6DE7E0098F5EC /* generate_objc_internal_header.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70F619F6DE5A0098F5EC /* generate_objc_internal_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710C19F6DE820098F5EC /* objc_generator.py in Headers */ = {isa = PBXBuildFile; fileRef = A5EA70F819F6DE5A0098F5EC /* objc_generator.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EA710E19F6DF810098F5EC /* InspectorAlternateBackendDispatchers.h in Headers */ = {isa = PBXBuildFile; fileRef = A5EA710D19F6DF810098F5EC /* InspectorAlternateBackendDispatchers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EF9B141A1D43F600702E90 /* generate_cpp_backend_dispatcher_header.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D11A05C76F005CAB76 /* generate_cpp_backend_dispatcher_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EF9B151A1D43FA00702E90 /* generate_cpp_backend_dispatcher_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D21A05C76F005CAB76 /* generate_cpp_backend_dispatcher_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EF9B161A1D440000702E90 /* generate_cpp_frontend_dispatcher_header.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D31A05C76F005CAB76 /* generate_cpp_frontend_dispatcher_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EF9B171A1D440300702E90 /* generate_cpp_frontend_dispatcher_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D41A05C76F005CAB76 /* generate_cpp_frontend_dispatcher_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EF9B181A1D440600702E90 /* generate_cpp_protocol_types_header.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D51A05C76F005CAB76 /* generate_cpp_protocol_types_header.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5EF9B191A1D440700702E90 /* generate_cpp_protocol_types_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D61A05C76F005CAB76 /* generate_cpp_protocol_types_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FC84B21D1DDAD6006B5C46 /* DebuggerLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FC84B11D1DDAC8006B5C46 /* DebuggerLocation.h */; };
+		A5FC84B31D1DDAD9006B5C46 /* DebuggerLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FC84B01D1DDAC8006B5C46 /* DebuggerLocation.cpp */; };
+		A5FD0067189AFE9C00633231 /* ScriptArguments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD0065189AFE9C00633231 /* ScriptArguments.cpp */; };
+		A5FD0068189AFE9C00633231 /* ScriptArguments.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0066189AFE9C00633231 /* ScriptArguments.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FD006D189B00AA00633231 /* ScriptCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD0069189B00A900633231 /* ScriptCallFrame.cpp */; };
+		A5FD006E189B00AA00633231 /* ScriptCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD006A189B00A900633231 /* ScriptCallFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FD006F189B00AA00633231 /* ScriptCallStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD006B189B00A900633231 /* ScriptCallStack.cpp */; };
+		A5FD0070189B00AA00633231 /* ScriptCallStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD006C189B00AA00633231 /* ScriptCallStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FD0074189B038C00633231 /* ConsoleTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0071189B038C00633231 /* ConsoleTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FD0075189B038C00633231 /* IdentifiersFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD0072189B038C00633231 /* IdentifiersFactory.cpp */; };
+		A5FD0076189B038C00633231 /* IdentifiersFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0073189B038C00633231 /* IdentifiersFactory.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FD0079189B051000633231 /* ConsoleMessage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD0077189B051000633231 /* ConsoleMessage.cpp */; };
+		A5FD007A189B051000633231 /* ConsoleMessage.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0078189B051000633231 /* ConsoleMessage.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FD007D189B0B4C00633231 /* ScriptCallStackFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD007B189B0B4C00633231 /* ScriptCallStackFactory.cpp */; };
+		A5FD007E189B0B4C00633231 /* ScriptCallStackFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD007C189B0B4C00633231 /* ScriptCallStackFactory.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FD0081189B191A00633231 /* InspectorConsoleAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD007F189B191A00633231 /* InspectorConsoleAgent.cpp */; };
+		A5FD0082189B191A00633231 /* InspectorConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0080189B191A00633231 /* InspectorConsoleAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A5FD0085189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD0083189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp */; };
+		A5FD0086189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0084189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h */; };
+		A700873917CBE85300C3E643 /* MapConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873717CBE85300C3E643 /* MapConstructor.cpp */; };
+		A700873A17CBE85300C3E643 /* MapConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = A700873817CBE85300C3E643 /* MapConstructor.h */; };
+		A700873D17CBE8D300C3E643 /* MapPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873B17CBE8D300C3E643 /* MapPrototype.cpp */; };
+		A700873E17CBE8D300C3E643 /* MapPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A700873C17CBE8D300C3E643 /* MapPrototype.h */; };
+		A700874117CBE8EB00C3E643 /* JSMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873F17CBE8EB00C3E643 /* JSMap.cpp */; };
+		A700874217CBE8EB00C3E643 /* JSMap.h in Headers */ = {isa = PBXBuildFile; fileRef = A700874017CBE8EB00C3E643 /* JSMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A70447EA17A0BD4600F5898E /* OperandsInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = A70447E917A0BD4600F5898E /* OperandsInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A70447ED17A0BD7000F5898E /* DumpContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A70447EB17A0BD7000F5898E /* DumpContext.cpp */; };
+		A70447EE17A0BD7000F5898E /* DumpContext.h in Headers */ = {isa = PBXBuildFile; fileRef = A70447EC17A0BD7000F5898E /* DumpContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A704D90317A0BAA8006BA554 /* DFGAbstractInterpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = A704D8FE17A0BAA8006BA554 /* DFGAbstractInterpreter.h */; };
+		A704D90417A0BAA8006BA554 /* DFGAbstractInterpreterInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = A704D8FF17A0BAA8006BA554 /* DFGAbstractInterpreterInlines.h */; };
+		A704D90517A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A704D90017A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp */; };
+		A704D90617A0BAA8006BA554 /* DFGInPlaceAbstractState.h in Headers */ = {isa = PBXBuildFile; fileRef = A704D90117A0BAA8006BA554 /* DFGInPlaceAbstractState.h */; };
+		A709F2F017A0AC0400512E98 /* SlowPathCall.h in Headers */ = {isa = PBXBuildFile; fileRef = A709F2EF17A0AC0400512E98 /* SlowPathCall.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A709F2F217A0AC2A00512E98 /* CommonSlowPaths.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A709F2F117A0AC2A00512E98 /* CommonSlowPaths.cpp */; };
+		A71236E51195F33C00BD2174 /* JITOpcodes32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */; };
+		A72028B61797601E0098028C /* JSCTestRunnerUtils.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A72028B41797601E0098028C /* JSCTestRunnerUtils.cpp */; };
+		A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = A72028B51797601E0098028C /* JSCTestRunnerUtils.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A72028BA1797603D0098028C /* JSFunctionInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = A72028B91797603D0098028C /* JSFunctionInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; };
+		A7280A2811557E3000D56957 /* JSObjectRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A79EDB0811531CD60019E912 /* JSObjectRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A729009C17976C6000317298 /* MacroAssemblerARMv7.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A729009B17976C6000317298 /* MacroAssemblerARMv7.cpp */; };
+		A7299D9D17D12837005F5FF9 /* JSSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7299D9B17D12837005F5FF9 /* JSSet.cpp */; };
+		A7299D9E17D12837005F5FF9 /* JSSet.h in Headers */ = {isa = PBXBuildFile; fileRef = A7299D9C17D12837005F5FF9 /* JSSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7299DA117D12848005F5FF9 /* SetPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7299D9F17D12848005F5FF9 /* SetPrototype.cpp */; };
+		A7299DA217D12848005F5FF9 /* SetPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A7299DA017D12848005F5FF9 /* SetPrototype.h */; };
+		A7299DA517D12858005F5FF9 /* SetConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7299DA317D12858005F5FF9 /* SetConstructor.cpp */; };
+		A7299DA617D12858005F5FF9 /* SetConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = A7299DA417D12858005F5FF9 /* SetConstructor.h */; };
+		A72FFD64139985A800E5365A /* KeywordLookup.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C225CD1399849C00FF1662 /* KeywordLookup.h */; };
+		A730B6121250068F009D25B1 /* StrictEvalActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = A730B6101250068F009D25B1 /* StrictEvalActivation.h */; };
+		A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A730B6111250068F009D25B1 /* StrictEvalActivation.cpp */; };
+		A731B25A130093880040A7FA /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 51F0EB6105C86C6B00E6DF1B /* Foundation.framework */; };
+		A737810D1799EA2E00817533 /* DFGNaturalLoops.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A737810A1799EA2E00817533 /* DFGNaturalLoops.cpp */; };
+		A737810E1799EA2E00817533 /* DFGNaturalLoops.h in Headers */ = {isa = PBXBuildFile; fileRef = A737810B1799EA2E00817533 /* DFGNaturalLoops.h */; };
+		A7386554118697B400540279 /* SpecializedThunkJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = A7386551118697B400540279 /* SpecializedThunkJIT.h */; };
+		A7386555118697B400540279 /* ThunkGenerators.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7386552118697B400540279 /* ThunkGenerators.cpp */; };
+		A7386556118697B400540279 /* ThunkGenerators.h in Headers */ = {isa = PBXBuildFile; fileRef = A7386553118697B400540279 /* ThunkGenerators.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A73A535A1799CD5D00170C19 /* DFGLazyJSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73A53581799CD5D00170C19 /* DFGLazyJSValue.cpp */; };
+		A73A535B1799CD5D00170C19 /* DFGLazyJSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A73A53591799CD5D00170C19 /* DFGLazyJSValue.h */; };
+		A741017F179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */; };
+		A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */; };
+		A7482E93116A7CAD003B0712 /* JSWeakObjectMapRefInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482E37116A697B003B0712 /* JSWeakObjectMapRefInternal.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A74DEF93182D991400522C22 /* MapIteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A74DEF8D182D991400522C22 /* MapIteratorPrototype.cpp */; };
+		A74DEF94182D991400522C22 /* MapIteratorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A74DEF8E182D991400522C22 /* MapIteratorPrototype.h */; };
+		A74DEF95182D991400522C22 /* JSMapIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A74DEF8F182D991400522C22 /* JSMapIterator.cpp */; };
+		A74DEF96182D991400522C22 /* JSMapIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = A74DEF90182D991400522C22 /* JSMapIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A75706DE118A2BCF0057F88F /* JITArithmetic32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */; };
+		A75EE9B218AAB7E200AAD043 /* BuiltinNames.h in Headers */ = {isa = PBXBuildFile; fileRef = A75EE9B018AAB7E200AAD043 /* BuiltinNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A766B44F0EE8DCD1009518CA /* ExecutableAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A767B5B517A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A767B5B317A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp */; };
+		A767B5B617A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = A767B5B417A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h */; };
+		A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = A76C51741182748D00715B05 /* JSInterfaceJIT.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A76F279415F13C9600517D67 /* UnlinkedCodeBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */; };
+		A77A423D17A0BBFD00A8DB81 /* DFGAbstractHeap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A77A423617A0BBFD00A8DB81 /* DFGAbstractHeap.cpp */; };
+		A77A423E17A0BBFD00A8DB81 /* DFGAbstractHeap.h in Headers */ = {isa = PBXBuildFile; fileRef = A77A423717A0BBFD00A8DB81 /* DFGAbstractHeap.h */; };
+		A77A423F17A0BBFD00A8DB81 /* DFGClobberize.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A77A423817A0BBFD00A8DB81 /* DFGClobberize.cpp */; };
+		A77A424017A0BBFD00A8DB81 /* DFGClobberize.h in Headers */ = {isa = PBXBuildFile; fileRef = A77A423917A0BBFD00A8DB81 /* DFGClobberize.h */; };
+		A77A424117A0BBFD00A8DB81 /* DFGClobberSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A77A423A17A0BBFD00A8DB81 /* DFGClobberSet.cpp */; };
+		A77A424217A0BBFD00A8DB81 /* DFGClobberSet.h in Headers */ = {isa = PBXBuildFile; fileRef = A77A423B17A0BBFD00A8DB81 /* DFGClobberSet.h */; };
+		A77A424317A0BBFD00A8DB81 /* DFGSafeToExecute.h in Headers */ = {isa = PBXBuildFile; fileRef = A77A423C17A0BBFD00A8DB81 /* DFGSafeToExecute.h */; };
+		A77F1821164088B200640A47 /* CodeCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A77F181F164088B200640A47 /* CodeCache.cpp */; };
+		A77F1822164088B200640A47 /* CodeCache.h in Headers */ = {isa = PBXBuildFile; fileRef = A77F1820164088B200640A47 /* CodeCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A77F1825164192C700640A47 /* ParserModes.h in Headers */ = {isa = PBXBuildFile; fileRef = A77F18241641925400640A47 /* ParserModes.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A784A26111D16622005776AC /* ASTBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */; };
+		A784A26411D16622005776AC /* SyntaxChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A785F6BC18C553FE00F10626 /* SpillRegistersMode.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FF647A18C52E8500B55307 /* SpillRegistersMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A78A9774179738B8009DF744 /* DFGFailedFinalizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78A976C179738B8009DF744 /* DFGFailedFinalizer.cpp */; };
+		A78A9775179738B8009DF744 /* DFGFailedFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = A78A976D179738B8009DF744 /* DFGFailedFinalizer.h */; };
+		A78A9776179738B8009DF744 /* DFGFinalizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78A976E179738B8009DF744 /* DFGFinalizer.cpp */; };
+		A78A9777179738B8009DF744 /* DFGFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = A78A976F179738B8009DF744 /* DFGFinalizer.h */; };
+		A78A9778179738B8009DF744 /* DFGJITFinalizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78A9770179738B8009DF744 /* DFGJITFinalizer.cpp */; };
+		A78A9779179738B8009DF744 /* DFGJITFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = A78A9771179738B8009DF744 /* DFGJITFinalizer.h */; };
+		A78A977A179738B8009DF744 /* DFGPlan.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78A9772179738B8009DF744 /* DFGPlan.cpp */; };
+		A78A977B179738B8009DF744 /* DFGPlan.h in Headers */ = {isa = PBXBuildFile; fileRef = A78A9773179738B8009DF744 /* DFGPlan.h */; };
+		A78A977F179738D5009DF744 /* FTLGeneratedFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = A78A977C179738D5009DF744 /* FTLGeneratedFunction.h */; };
+		A78A9780179738D5009DF744 /* FTLJITFinalizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78A977D179738D5009DF744 /* FTLJITFinalizer.cpp */; };
+		A78A9781179738D5009DF744 /* FTLJITFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = A78A977E179738D5009DF744 /* FTLJITFinalizer.h */; };
+		A790DD6D182F499700588807 /* SetIteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A790DD67182F499700588807 /* SetIteratorPrototype.cpp */; };
+		A790DD6E182F499700588807 /* SetIteratorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A790DD68182F499700588807 /* SetIteratorPrototype.h */; };
+		A790DD6F182F499700588807 /* JSSetIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A790DD69182F499700588807 /* JSSetIterator.cpp */; };
+		A790DD70182F499700588807 /* JSSetIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = A790DD6A182F499700588807 /* JSSetIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7986D5717A0BB1E00A95DD0 /* DFGEdgeUsesStructure.h in Headers */ = {isa = PBXBuildFile; fileRef = A7986D5617A0BB1E00A95DD0 /* DFGEdgeUsesStructure.h */; };
+		A79D3ED9C5064DD0A8466A3A /* ModuleScopeData.h in Headers */ = {isa = PBXBuildFile; fileRef = 000BEAF0DF604481AF6AB68C /* ModuleScopeData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A4AE0817973B26005612B1 /* MacroAssemblerX86Common.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7A4AE0717973B26005612B1 /* MacroAssemblerX86Common.cpp */; };
+		A7A8AF3417ADB5F3005AB174 /* ArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7A8AF2517ADB5F2005AB174 /* ArrayBuffer.cpp */; };
+		A7A8AF3517ADB5F3005AB174 /* ArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF2617ADB5F3005AB174 /* ArrayBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF3617ADB5F3005AB174 /* ArrayBufferView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7A8AF2717ADB5F3005AB174 /* ArrayBufferView.cpp */; };
+		A7A8AF3717ADB5F3005AB174 /* ArrayBufferView.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF2817ADB5F3005AB174 /* ArrayBufferView.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF3817ADB5F3005AB174 /* Float32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF2917ADB5F3005AB174 /* Float32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF3917ADB5F3005AB174 /* Float64Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF2A17ADB5F3005AB174 /* Float64Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF3A17ADB5F3005AB174 /* Int8Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF3B17ADB5F3005AB174 /* Int16Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF2C17ADB5F3005AB174 /* Int16Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF3C17ADB5F3005AB174 /* Int32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF2D17ADB5F3005AB174 /* Int32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF3F17ADB5F3005AB174 /* Uint8Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF4017ADB5F3005AB174 /* Uint8ClampedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF4117ADB5F3005AB174 /* Uint16Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF3217ADB5F3005AB174 /* Uint16Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7A8AF4217ADB5F3005AB174 /* Uint32Array.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A8AF3317ADB5F3005AB174 /* Uint32Array.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */; };
+		A7B4ACAF1484C9CE00B38A36 /* JSExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7B601821639FD2A00372BA3 /* UnlinkedCodeBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7BDAEC817F4EA1400F6140C /* ArrayIteratorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7BDAEC217F4EA1400F6140C /* ArrayIteratorPrototype.cpp */; };
+		A7BDAEC917F4EA1400F6140C /* ArrayIteratorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A7BDAEC317F4EA1400F6140C /* ArrayIteratorPrototype.h */; };
+		A7BFF3C0179868940002F462 /* DFGFiltrationResult.h in Headers */ = {isa = PBXBuildFile; fileRef = A7BFF3BF179868940002F462 /* DFGFiltrationResult.h */; };
+		A7C0C4AC168103020017011D /* JSScriptRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C0C4AB167C08CD0017011D /* JSScriptRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7C0C4AD1681067E0017011D /* JSScriptRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C0C4AA167C08CD0017011D /* JSScriptRef.cpp */; };
+		A7C1E8E4112E72EF00A37F98 /* JITPropertyAccess32_64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */; };
+		A7C1EAF017987AB600299DB2 /* CLoopStackInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C1EAEB17987AB600299DB2 /* CLoopStackInlines.h */; };
+		A7C1EAF117987AB600299DB2 /* StackVisitor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7C1EAEC17987AB600299DB2 /* StackVisitor.cpp */; };
+		A7C1EAF217987AB600299DB2 /* StackVisitor.h in Headers */ = {isa = PBXBuildFile; fileRef = A7C1EAED17987AB600299DB2 /* StackVisitor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7CA3AE317DA41AE006538AF /* WeakMapConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7CA3ADD17DA41AE006538AF /* WeakMapConstructor.cpp */; };
+		A7CA3AE417DA41AE006538AF /* WeakMapConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CA3ADE17DA41AE006538AF /* WeakMapConstructor.h */; };
+		A7CA3AE517DA41AE006538AF /* WeakMapPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7CA3ADF17DA41AE006538AF /* WeakMapPrototype.cpp */; };
+		A7CA3AE617DA41AE006538AF /* WeakMapPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CA3AE017DA41AE006538AF /* WeakMapPrototype.h */; };
+		A7CA3AE717DA41AE006538AF /* JSWeakMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7CA3AE117DA41AE006538AF /* JSWeakMap.cpp */; };
+		A7CA3AE817DA41AE006538AF /* JSWeakMap.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CA3AE217DA41AE006538AF /* JSWeakMap.h */; };
+		A7CA3AEB17DA5168006538AF /* WeakMapData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7CA3AE917DA5168006538AF /* WeakMapData.cpp */; };
+		A7CA3AEC17DA5168006538AF /* WeakMapData.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CA3AEA17DA5168006538AF /* WeakMapData.h */; };
+		A7D801A41880D66E0026C39B /* BuiltinExecutables.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D801A11880D66E0026C39B /* BuiltinExecutables.cpp */; };
+		A7D801A51880D66E0026C39B /* BuiltinExecutables.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D801A21880D66E0026C39B /* BuiltinExecutables.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7D801A81880D6A80026C39B /* JSCBuiltins.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D801A61880D6A80026C39B /* JSCBuiltins.cpp */; };
+		A7D801A91880D6A80026C39B /* JSCBuiltins.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D801A71880D6A80026C39B /* JSCBuiltins.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7D89CF217A0B8CC00773AD8 /* DFGBasicBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D89CE317A0B8CC00773AD8 /* DFGBasicBlock.cpp */; };
+		A7D89CF317A0B8CC00773AD8 /* DFGBlockInsertionSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D89CE417A0B8CC00773AD8 /* DFGBlockInsertionSet.cpp */; };
+		A7D89CF417A0B8CC00773AD8 /* DFGBlockInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D89CE517A0B8CC00773AD8 /* DFGBlockInsertionSet.h */; };
+		A7D89CF517A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D89CE617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp */; };
+		A7D89CF617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D89CE717A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.h */; };
+		A7D89CF717A0B8CC00773AD8 /* DFGFlushFormat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D89CE817A0B8CC00773AD8 /* DFGFlushFormat.cpp */; };
+		A7D89CF817A0B8CC00773AD8 /* DFGFlushFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D89CE917A0B8CC00773AD8 /* DFGFlushFormat.h */; };
+		A7D89CFB17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D89CEC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.cpp */; };
+		A7D89CFC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D89CED17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h */; };
+		A7D89CFD17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D89CEE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.cpp */; };
+		A7D89CFE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D89CEF17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h */; };
+		A7D89CFF17A0B8CC00773AD8 /* DFGSSAConversionPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D89CF017A0B8CC00773AD8 /* DFGSSAConversionPhase.cpp */; };
+		A7D89D0017A0B8CC00773AD8 /* DFGSSAConversionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D89CF117A0B8CC00773AD8 /* DFGSSAConversionPhase.h */; };
+		A7D89D0217A0B90400773AD8 /* FTLLoweredNodeValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D89D0117A0B90400773AD8 /* FTLLoweredNodeValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7D9A29417A0BC7400EE2618 /* DFGAtTailAbstractState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D9A28F17A0BC7400EE2618 /* DFGAtTailAbstractState.cpp */; };
+		A7D9A29517A0BC7400EE2618 /* DFGAtTailAbstractState.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D9A29017A0BC7400EE2618 /* DFGAtTailAbstractState.h */; };
+		A7D9A29617A0BC7400EE2618 /* DFGEdgeDominates.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D9A29117A0BC7400EE2618 /* DFGEdgeDominates.h */; };
+		A7D9A29717A0BC7400EE2618 /* DFGLICMPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D9A29217A0BC7400EE2618 /* DFGLICMPhase.cpp */; };
+		A7D9A29817A0BC7400EE2618 /* DFGLICMPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D9A29317A0BC7400EE2618 /* DFGLICMPhase.h */; };
+		A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = A7DCB77912E3D90500911940 /* WriteBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
+		A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */; };
+		A7E5A3A71797432D00E893C0 /* CompilationResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E5A3A51797432D00E893C0 /* CompilationResult.cpp */; };
+		A7E5A3A81797432D00E893C0 /* CompilationResult.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E5A3A61797432D00E893C0 /* CompilationResult.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7E5AB391799E4B200D2833D /* UDis86Disassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E5AB351799E4B200D2833D /* UDis86Disassembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7E5AB3A1799E4B200D2833D /* X86Disassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E5AB361799E4B200D2833D /* X86Disassembler.cpp */; };
+		A7F2996B17A0BB670010417A /* FTLFail.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F2996917A0BB670010417A /* FTLFail.cpp */; };
+		A7F2996C17A0BB670010417A /* FTLFail.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F2996A17A0BB670010417A /* FTLFail.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7F9935F0FD7325100A0B2D0 /* JSONObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F9935D0FD7325100A0B2D0 /* JSONObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */; };
+		A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */; };
+		A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A7FCC26D17A0B6AA00786D1A /* FTLSwitchCase.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FCC26C17A0B6AA00786D1A /* FTLSwitchCase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A8A4748E151A8306004123FF /* libWTF.a in Frameworks */ = {isa = PBXBuildFile; fileRef = A8A4748D151A8306004123FF /* libWTF.a */; };
+		AD2FCBE21DB58DAD00B3E736 /* JSWebAssemblyCompileError.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBA61DB58DA400B3E736 /* JSWebAssemblyCompileError.cpp */; };
+		AD2FCBE31DB58DAD00B3E736 /* JSWebAssemblyCompileError.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBA71DB58DA400B3E736 /* JSWebAssemblyCompileError.h */; };
+		AD2FCBE41DB58DAD00B3E736 /* JSWebAssemblyInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBA81DB58DA400B3E736 /* JSWebAssemblyInstance.cpp */; };
+		AD2FCBE51DB58DAD00B3E736 /* JSWebAssemblyInstance.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBA91DB58DA400B3E736 /* JSWebAssemblyInstance.h */; };
+		AD2FCBE61DB58DAD00B3E736 /* JSWebAssemblyMemory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBAA1DB58DA400B3E736 /* JSWebAssemblyMemory.cpp */; };
+		AD2FCBE71DB58DAD00B3E736 /* JSWebAssemblyMemory.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBAB1DB58DA400B3E736 /* JSWebAssemblyMemory.h */; };
+		AD2FCBE81DB58DAD00B3E736 /* JSWebAssemblyRuntimeError.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBAC1DB58DA400B3E736 /* JSWebAssemblyRuntimeError.cpp */; };
+		AD2FCBE91DB58DAD00B3E736 /* JSWebAssemblyRuntimeError.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBAD1DB58DA400B3E736 /* JSWebAssemblyRuntimeError.h */; };
+		AD2FCBEA1DB58DAD00B3E736 /* JSWebAssemblyTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBAE1DB58DA400B3E736 /* JSWebAssemblyTable.cpp */; };
+		AD2FCBEB1DB58DAD00B3E736 /* JSWebAssemblyTable.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBAF1DB58DA400B3E736 /* JSWebAssemblyTable.h */; };
+		AD2FCBEC1DB58DAD00B3E736 /* WebAssemblyCompileErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBB01DB58DA400B3E736 /* WebAssemblyCompileErrorConstructor.cpp */; };
+		AD2FCBED1DB58DAD00B3E736 /* WebAssemblyCompileErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBB11DB58DA400B3E736 /* WebAssemblyCompileErrorConstructor.h */; };
+		AD2FCBEE1DB58DAD00B3E736 /* WebAssemblyCompileErrorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBB21DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.cpp */; };
+		AD2FCBEF1DB58DAD00B3E736 /* WebAssemblyCompileErrorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBB31DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.h */; };
+		AD2FCBF01DB58DAD00B3E736 /* WebAssemblyInstanceConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBB41DB58DA400B3E736 /* WebAssemblyInstanceConstructor.cpp */; };
+		AD2FCBF11DB58DAD00B3E736 /* WebAssemblyInstanceConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBB51DB58DA400B3E736 /* WebAssemblyInstanceConstructor.h */; };
+		AD2FCBF21DB58DAD00B3E736 /* WebAssemblyInstancePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBB61DB58DA400B3E736 /* WebAssemblyInstancePrototype.cpp */; };
+		AD2FCBF31DB58DAD00B3E736 /* WebAssemblyInstancePrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBB71DB58DA400B3E736 /* WebAssemblyInstancePrototype.h */; };
+		AD2FCBF41DB58DAD00B3E736 /* WebAssemblyMemoryConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBB81DB58DA400B3E736 /* WebAssemblyMemoryConstructor.cpp */; };
+		AD2FCBF51DB58DAD00B3E736 /* WebAssemblyMemoryConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBB91DB58DA400B3E736 /* WebAssemblyMemoryConstructor.h */; };
+		AD2FCBF61DB58DAD00B3E736 /* WebAssemblyMemoryPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBBA1DB58DA400B3E736 /* WebAssemblyMemoryPrototype.cpp */; };
+		AD2FCBF71DB58DAD00B3E736 /* WebAssemblyMemoryPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBBB1DB58DA400B3E736 /* WebAssemblyMemoryPrototype.h */; };
+		AD2FCBF81DB58DAD00B3E736 /* WebAssemblyRuntimeErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBBC1DB58DA400B3E736 /* WebAssemblyRuntimeErrorConstructor.cpp */; };
+		AD2FCBF91DB58DAD00B3E736 /* WebAssemblyRuntimeErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBBD1DB58DA400B3E736 /* WebAssemblyRuntimeErrorConstructor.h */; };
+		AD2FCBFA1DB58DAD00B3E736 /* WebAssemblyRuntimeErrorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBBE1DB58DA400B3E736 /* WebAssemblyRuntimeErrorPrototype.cpp */; };
+		AD2FCBFB1DB58DAD00B3E736 /* WebAssemblyRuntimeErrorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBBF1DB58DA400B3E736 /* WebAssemblyRuntimeErrorPrototype.h */; };
+		AD2FCBFC1DB58DAD00B3E736 /* WebAssemblyTableConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBC01DB58DA400B3E736 /* WebAssemblyTableConstructor.cpp */; };
+		AD2FCBFD1DB58DAD00B3E736 /* WebAssemblyTableConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBC11DB58DA400B3E736 /* WebAssemblyTableConstructor.h */; };
+		AD2FCBFE1DB58DAD00B3E736 /* WebAssemblyTablePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCBC21DB58DA400B3E736 /* WebAssemblyTablePrototype.cpp */; };
+		AD2FCBFF1DB58DAD00B3E736 /* WebAssemblyTablePrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCBC31DB58DA400B3E736 /* WebAssemblyTablePrototype.h */; };
+		AD2FCC001DB58DAD00B3E736 /* WebAssemblyModuleConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCB981DB585A600B3E736 /* WebAssemblyModuleConstructor.cpp */; };
+		AD2FCC011DB58DAD00B3E736 /* WebAssemblyModuleConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCB991DB585A600B3E736 /* WebAssemblyModuleConstructor.h */; };
+		AD2FCC021DB58DAD00B3E736 /* WebAssemblyModulePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCB9A1DB585A600B3E736 /* WebAssemblyModulePrototype.cpp */; };
+		AD2FCC031DB58DAD00B3E736 /* WebAssemblyModulePrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCB9B1DB585A600B3E736 /* WebAssemblyModulePrototype.h */; };
+		AD2FCC041DB58DAD00B3E736 /* JSWebAssemblyModule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCB8C1DB5844000B3E736 /* JSWebAssemblyModule.cpp */; };
+		AD2FCC051DB58DAD00B3E736 /* JSWebAssemblyModule.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCB8D1DB5844000B3E736 /* JSWebAssemblyModule.h */; };
+		AD2FCC161DB59CB200B3E736 /* WebAssemblyCompileErrorConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC0A1DB59C5900B3E736 /* WebAssemblyCompileErrorConstructor.lut.h */; };
+		AD2FCC171DB59CB200B3E736 /* WebAssemblyCompileErrorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC0B1DB59C5900B3E736 /* WebAssemblyCompileErrorPrototype.lut.h */; };
+		AD2FCC181DB59CB200B3E736 /* WebAssemblyInstanceConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC0C1DB59C5900B3E736 /* WebAssemblyInstanceConstructor.lut.h */; };
+		AD2FCC191DB59CB200B3E736 /* WebAssemblyInstancePrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC0D1DB59C5900B3E736 /* WebAssemblyInstancePrototype.lut.h */; };
+		AD2FCC1A1DB59CB200B3E736 /* WebAssemblyMemoryConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC0E1DB59C5900B3E736 /* WebAssemblyMemoryConstructor.lut.h */; };
+		AD2FCC1B1DB59CB200B3E736 /* WebAssemblyMemoryPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC0F1DB59C5900B3E736 /* WebAssemblyMemoryPrototype.lut.h */; };
+		AD2FCC1C1DB59CB200B3E736 /* WebAssemblyModuleConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC101DB59C5900B3E736 /* WebAssemblyModuleConstructor.lut.h */; };
+		AD2FCC1D1DB59CB200B3E736 /* WebAssemblyModulePrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC111DB59C5900B3E736 /* WebAssemblyModulePrototype.lut.h */; };
+		AD2FCC1E1DB59CB200B3E736 /* WebAssemblyRuntimeErrorConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC121DB59C5900B3E736 /* WebAssemblyRuntimeErrorConstructor.lut.h */; };
+		AD2FCC1F1DB59CB200B3E736 /* WebAssemblyRuntimeErrorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC131DB59C5900B3E736 /* WebAssemblyRuntimeErrorPrototype.lut.h */; };
+		AD2FCC201DB59CB200B3E736 /* WebAssemblyTableConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC141DB59C5900B3E736 /* WebAssemblyTableConstructor.lut.h */; };
+		AD2FCC211DB59CB200B3E736 /* WebAssemblyTablePrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC151DB59C5900B3E736 /* WebAssemblyTablePrototype.lut.h */; };
+		AD2FCC2C1DB838FD00B3E736 /* WebAssemblyPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCC261DB838C400B3E736 /* WebAssemblyPrototype.cpp */; };
+		AD2FCC2D1DB838FD00B3E736 /* WebAssemblyPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC271DB838C400B3E736 /* WebAssemblyPrototype.h */; };
+		AD2FCC301DB83D4900B3E736 /* JSWebAssembly.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCC2E1DB839F700B3E736 /* JSWebAssembly.cpp */; };
+		AD2FCC311DB83D4900B3E736 /* JSWebAssembly.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC2F1DB839F700B3E736 /* JSWebAssembly.h */; };
+		AD2FCC331DC4045400B3E736 /* WasmFormat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCC321DC4045300B3E736 /* WasmFormat.cpp */; };
+		AD4937C31DDBE6140077C807 /* AbstractModuleRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD4937C11DDBE60A0077C807 /* AbstractModuleRecord.cpp */; };
+		AD4937C41DDBE6140077C807 /* AbstractModuleRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = AD4937C21DDBE60A0077C807 /* AbstractModuleRecord.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		AD4937C71DDD0AAE0077C807 /* WebAssemblyModuleRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD4937C51DDCDCF00077C807 /* WebAssemblyModuleRecord.cpp */; };
+		AD4937C81DDD0AAE0077C807 /* WebAssemblyModuleRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = AD4937C61DDCDCF00077C807 /* WebAssemblyModuleRecord.h */; };
+		AD4937D31DDD27DE0077C807 /* WebAssemblyFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */; };
+		AD4937D41DDD27DE0077C807 /* WebAssemblyFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */; };
+		AD4B1DF91DF244E20071AE32 /* WasmBinding.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD4B1DF71DF244D70071AE32 /* WasmBinding.cpp */; };
+		AD4B1DFA1DF244E20071AE32 /* WasmBinding.h in Headers */ = {isa = PBXBuildFile; fileRef = AD4B1DF81DF244D70071AE32 /* WasmBinding.h */; };
+		AD86A93E1AA4D88D002FE77F /* WeakGCMapInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = AD86A93D1AA4D87C002FE77F /* WeakGCMapInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		ADBC54D41DF8EA2B005BF738 /* WebAssemblyToJSCallee.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ADBC54D21DF8EA00005BF738 /* WebAssemblyToJSCallee.cpp */; };
+		ADBC54D51DF8EA2B005BF738 /* WebAssemblyToJSCallee.h in Headers */ = {isa = PBXBuildFile; fileRef = ADBC54D31DF8EA00005BF738 /* WebAssemblyToJSCallee.h */; };
+		ADDB1F6318D77DBE009B58A8 /* OpaqueRootSet.h in Headers */ = {isa = PBXBuildFile; fileRef = ADDB1F6218D77DB7009B58A8 /* OpaqueRootSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		ADE39FFF16DD144B0003CD4A /* PropertyTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD1CF06816DCAB2D00B97123 /* PropertyTable.cpp */; };
+		B59F89391891F29F00D5CCDC /* UnlinkedInstructionStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */; };
+		BC02E90D0E1839DB000F9297 /* ErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9050E1839DB000F9297 /* ErrorConstructor.h */; };
+		BC02E90F0E1839DB000F9297 /* ErrorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9070E1839DB000F9297 /* ErrorPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC02E9110E1839DB000F9297 /* NativeErrorConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */; };
+		BC02E9130E1839DB000F9297 /* NativeErrorPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E90B0E1839DB000F9297 /* NativeErrorPrototype.h */; };
+		BC02E98D0E183E38000F9297 /* ErrorInstance.h in Headers */ = {isa = PBXBuildFile; fileRef = BC02E98B0E183E38000F9297 /* ErrorInstance.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC1166020E1997B4008066DD /* DateInstance.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1166010E1997B1008066DD /* DateInstance.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC11667B0E199C05008066DD /* InternalFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC11667A0E199C05008066DD /* InternalFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC1167DA0E19BCC9008066DD /* JSCell.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1167D80E19BCC9008066DD /* JSCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3E50E16F5CD00B34460 /* APICast.h in Headers */ = {isa = PBXBuildFile; fileRef = 1482B78A0A4305AB00517CFC /* APICast.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3E60E16F5CD00B34460 /* ArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7952070E15E8A800A898AB /* ArrayConstructor.h */; };
+		BC18C3E70E16F5CD00B34460 /* ArrayPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A84E0255597D01FF60F7 /* ArrayPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 704FD35305697E6D003DBED9 /* BooleanObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3ED0E16F5CD00B34460 /* CallData.h in Headers */ = {isa = PBXBuildFile; fileRef = 145C507F0D9DF63B0088F6B9 /* CallData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3F30E16F5CD00B34460 /* CommonIdentifiers.h in Headers */ = {isa = PBXBuildFile; fileRef = 65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */ = {isa = PBXBuildFile; fileRef = F5BB2BC5030F772101FCFE1D /* Completion.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3F50E16F5CD00B34460 /* config.h in Headers */ = {isa = PBXBuildFile; fileRef = F68EBB8C0255D4C601FF60F7 /* config.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8590255597D01FF60F7 /* Debugger.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4000E16F5CD00B34460 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4040E16F5CD00B34460 /* FunctionConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C10E16D4E900A06E92 /* FunctionConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4050E16F5CD00B34460 /* FunctionPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A85D0255597D01FF60F7 /* FunctionPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C40F0E16F5CD00B34460 /* Identifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 933A349A038AE7C6008635CE /* Identifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */ = {isa = PBXBuildFile; fileRef = E178633F0D9BEC0000D74E75 /* InitializeThreading.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4130E16F5CD00B34460 /* JavaScript.h in Headers */ = {isa = PBXBuildFile; fileRef = 1CAA8B4A0D32C39A0041BCFF /* JavaScript.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C4140E16F5CD00B34460 /* JavaScriptCore.h in Headers */ = {isa = PBXBuildFile; fileRef = 1CAA8B4B0D32C39A0041BCFF /* JavaScriptCore.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C4150E16F5CD00B34460 /* JavaScriptCorePrefix.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */; };
+		BC18C4160E16F5CD00B34460 /* JSLexicalEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 14DA818E0D99FD2000B0A4FB /* JSLexicalEnvironment.h */; settings = {ATTRIBUTES = (); }; };
+		BC18C4170E16F5CD00B34460 /* JSArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 938772E5038BFE19008635CE /* JSArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4180E16F5CD00B34460 /* JSBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 142711380A460BBB0080EEEA /* JSBase.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C4190E16F5CD00B34460 /* JSCallbackConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 1440F8AC0A508D200005F061 /* JSCallbackConstructor.h */; };
+		BC18C41A0E16F5CD00B34460 /* JSCallbackFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 1440F88F0A508B100005F061 /* JSCallbackFunction.h */; };
+		BC18C41B0E16F5CD00B34460 /* JSCallbackObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 14ABDF5D0A437FEF00ECCA01 /* JSCallbackObject.h */; };
+		BC18C41C0E16F5CD00B34460 /* JSCallbackObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = A8E894310CD0602400367179 /* JSCallbackObjectFunctions.h */; };
+		BC18C41D0E16F5CD00B34460 /* JSClassRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 1440FCE10A51E46B0005F061 /* JSClassRef.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C41E0E16F5CD00B34460 /* JSContextRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 14BD5A2A0A3E91F600BAF59C /* JSContextRef.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C41F0E16F5CD00B34460 /* JSFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A85F0255597D01FF60F7 /* JSFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4200E16F5CD00B34460 /* VM.h in Headers */ = {isa = PBXBuildFile; fileRef = E18E3A560DF9278C00D90B34 /* VM.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A8E894330CD0603F00367179 /* JSGlobalObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4230E16F5CD00B34460 /* JSLock.h in Headers */ = {isa = PBXBuildFile; fileRef = 65EA4C9A092AF9E20093D800 /* JSLock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */ = {isa = PBXBuildFile; fileRef = BC22A3990E16E14800AF21C8 /* JSObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 1482B7E10A43076000517CFC /* JSObjectRef.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C4260E16F5CD00B34460 /* JSRetainPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 95C18D3E0C90E7EF00E72F73 /* JSRetainPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4270E16F5CD00B34460 /* JSString.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8620255597D01FF60F7 /* JSString.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4280E16F5CD00B34460 /* JSStringRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 1482B74B0A43032800517CFC /* JSStringRef.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C4290E16F5CD00B34460 /* JSStringRefCF.h in Headers */ = {isa = PBXBuildFile; fileRef = 146AAB2A0B66A84900E55F16 /* JSStringRefCF.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C42A0E16F5CD00B34460 /* JSType.h in Headers */ = {isa = PBXBuildFile; fileRef = 14ABB454099C2A0F00E2A24F /* JSType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C42B0E16F5CD00B34460 /* JSCJSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 14ABB36E099C076400E2A24F /* JSCJSValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C42C0E16F5CD00B34460 /* JSValueRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 1482B6EA0A4300B300517CFC /* JSValueRef.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C42D0E16F5CD00B34460 /* JSEnvironmentRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F252560D08DD8D004ECFFF /* JSEnvironmentRecord.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C42E0E16F5CD00B34460 /* JSWrapperObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 65C7A1720A8EAACB00FA37EA /* JSWrapperObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4310E16F5CD00B34460 /* Lexer.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8660255597D01FF60F7 /* Lexer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4370E16F5CD00B34460 /* Lookup.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8690255597D01FF60F7 /* Lookup.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A86B0255597D01FF60F7 /* MathObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C43F0E16F5CD00B34460 /* Nodes.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A86E0255597D01FF60F7 /* Nodes.h */; };
+		BC18C4410E16F5CD00B34460 /* NumberConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C30E16D4E900A06E92 /* NumberConstructor.h */; };
+		BC18C4420E16F5CD00B34460 /* NumberConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */; };
+		BC18C4430E16F5CD00B34460 /* NumberObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8710255597D01FF60F7 /* NumberObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4440E16F5CD00B34460 /* NumberPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C50E16D4E900A06E92 /* NumberPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4450E16F5CD00B34460 /* ObjectConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C70E16D4E900A06E92 /* ObjectConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4460E16F5CD00B34460 /* ObjectPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4480E16F5CD00B34460 /* Operations.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8780255597D01FF60F7 /* Operations.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F0B3AA09BB4DC00068FCE3 /* Parser.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4540E16F5CD00B34460 /* PropertyNameArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 65400C100A69BAF200509887 /* PropertyNameArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4550E16F5CD00B34460 /* PropertySlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 65621E6C089E859700760F35 /* PropertySlot.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4560E16F5CD00B34460 /* Protect.h in Headers */ = {isa = PBXBuildFile; fileRef = 65C02FBB0637462A003E7EE6 /* Protect.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C45A0E16F5CD00B34460 /* RegExp.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A87E0255597D01FF60F7 /* RegExp.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C45B0E16F5CD00B34460 /* RegExpObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A87C0255597D01FF60F7 /* RegExpObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C45D0E16F5CD00B34460 /* Register.h in Headers */ = {isa = PBXBuildFile; fileRef = 149B24FF0D8AF6D1009CB8C7 /* Register.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C45E0E16F5CD00B34460 /* CLoopStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D792640DAA03FB001A9F05 /* CLoopStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4630E16F5CD00B34460 /* SourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E866ED0DD59AFA00A2B2A1 /* SourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C4660E16F5CD00B34460 /* StringConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C10E16EE3300B34460 /* StringConstructor.h */; };
+		BC18C4680E16F5CD00B34460 /* StringObject.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C30E16EE3300B34460 /* StringObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C46A0E16F5CD00B34460 /* StringPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C60E16EE3300B34460 /* StringPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C46B0E16F5CD00B34460 /* SymbolTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A396A60CD2933100B5B4FF /* SymbolTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DE3D0F40DD8DDFB00468714 /* WebKitAvailability.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52D0E16FCE100B34460 /* Lexer.lut.h */; };
+		BC3046070E1F497F003232CF /* Error.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3046060E1F497F003232CF /* Error.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
+		BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
+		BC9041480EB9250900FE26FA /* StructureTransitionTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9041470EB9250900FE26FA /* StructureTransitionTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC95437D0EBA70FD0072B6D3 /* PropertyMapHashTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BCBE2CAE14E985AA000593AD /* GCAssertions.h in Headers */ = {isa = PBXBuildFile; fileRef = BCBE2CAD14E985AA000593AD /* GCAssertions.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BCCF0D080EF0AAB900413C8F /* StructureStubInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BCCF0D0C0EF0B8A500413C8F /* StructureStubInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */; };
+		BCD202C20E1706A7002C7E82 /* RegExpConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD202BE0E1706A7002C7E82 /* RegExpConstructor.h */; };
+		BCD202C40E1706A7002C7E82 /* RegExpPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD202C00E1706A7002C7E82 /* RegExpPrototype.h */; };
+		BCD202D60E170708002C7E82 /* RegExpConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD202D50E170708002C7E82 /* RegExpConstructor.lut.h */; };
+		BCD2034A0E17135E002C7E82 /* DateConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD203460E17135E002C7E82 /* DateConstructor.h */; };
+		BCD2034C0E17135E002C7E82 /* DatePrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD203480E17135E002C7E82 /* DatePrototype.h */; };
+		BCD203E80E1718F4002C7E82 /* DatePrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */; };
+		BCDD51EB0FB8DF74004A8BDC /* JITOpcodes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCDD51E90FB8DF74004A8BDC /* JITOpcodes.cpp */; };
+		BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */ = {isa = PBXBuildFile; fileRef = BCDE3AB10E6C82CF001453A7 /* Structure.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCDE3AB00E6C82CF001453A7 /* Structure.cpp */; };
+		BCF605140E203EF800B9A64D /* ArgList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF605120E203EF800B9A64D /* ArgList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFD8C900EEB2EE700283848 /* JumpTable.cpp */; };
+		BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFD8C910EEB2EE700283848 /* JumpTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C20328201981979D0088B499 /* CustomGlobalObjectClassTest.c in Sources */ = {isa = PBXBuildFile; fileRef = C203281E1981979D0088B499 /* CustomGlobalObjectClassTest.c */; };
+		C20BA92D16BB1C1500B3AEA2 /* StructureRareDataInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C20BA92C16BB1C1500B3AEA2 /* StructureRareDataInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2160FE715F7E95E00942DFC /* SlotVisitorInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FCB408515C0A3C30048932B /* SlotVisitorInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2181FC218A948FB0025A235 /* JSExportTests.mm in Sources */ = {isa = PBXBuildFile; fileRef = C2181FC118A948FB0025A235 /* JSExportTests.mm */; };
+		C225494315F7DBAA0065E898 /* SlotVisitor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C225494215F7DBAA0065E898 /* SlotVisitor.cpp */; };
+		C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F77008E1402FDD60078EB39 /* SamplingCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C24D31E2161CD695002AA4DB /* HeapStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C24D31E0161CD695002AA4DB /* HeapStatistics.cpp */; };
+		C24D31E3161CD695002AA4DB /* HeapStatistics.h in Headers */ = {isa = PBXBuildFile; fileRef = C24D31E1161CD695002AA4DB /* HeapStatistics.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C25D709B16DE99F400FCA6BC /* JSManagedValue.mm in Sources */ = {isa = PBXBuildFile; fileRef = C25D709916DE99F400FCA6BC /* JSManagedValue.mm */; };
+		C25D709C16DE99F400FCA6BC /* JSManagedValue.h in Headers */ = {isa = PBXBuildFile; fileRef = C25D709A16DE99F400FCA6BC /* JSManagedValue.h */; settings = {ATTRIBUTES = (Public, ); }; };
+		C25F8BCD157544A900245B71 /* IncrementalSweeper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */; };
+		C25F8BCE157544A900245B71 /* IncrementalSweeper.h in Headers */ = {isa = PBXBuildFile; fileRef = C25F8BCC157544A900245B71 /* IncrementalSweeper.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C283190016FE4B7D00157BFD /* HandleBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = C28318FF16FE4B7D00157BFD /* HandleBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C283190216FE533E00157BFD /* HandleBlockInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C283190116FE533E00157BFD /* HandleBlockInlines.h */; };
+		C288B2DE18A54D3E007BE40B /* DateTests.mm in Sources */ = {isa = PBXBuildFile; fileRef = C288B2DD18A54D3E007BE40B /* DateTests.mm */; };
+		C2981FD817BAEE4B00A3BC98 /* DFGDesiredWeakReferences.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2981FD617BAEE4B00A3BC98 /* DFGDesiredWeakReferences.cpp */; };
+		C2981FD917BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h in Headers */ = {isa = PBXBuildFile; fileRef = C2981FD717BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h */; };
+		C29ECB031804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm in Sources */ = {isa = PBXBuildFile; fileRef = C29ECB011804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm */; };
+		C2A7F688160432D400F76B98 /* JSDestructibleObject.h in Headers */ = {isa = PBXBuildFile; fileRef = C2A7F687160432D400F76B98 /* JSDestructibleObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2B6D75318A33793004A9301 /* WriteBarrierInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2B916C514DA040C00CBAC86 /* MarkedAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */; };
+		C2C0F7CD17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */; };
+		C2C0F7CE17BBFC5B00464FE4 /* DFGDesiredTransitions.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C0F7CC17BBFC5B00464FE4 /* DFGDesiredTransitions.h */; };
+		C2CF39C116E15A8100DD69BE /* JSAPIWrapperObject.mm in Sources */ = {isa = PBXBuildFile; fileRef = C2CF39BF16E15A8100DD69BE /* JSAPIWrapperObject.mm */; };
+		C2CF39C216E15A8100DD69BE /* JSAPIWrapperObject.h in Headers */ = {isa = PBXBuildFile; fileRef = C2CF39C016E15A8100DD69BE /* JSAPIWrapperObject.h */; };
+		C2DA778318E259990066FCB6 /* HeapInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C2DA778218E259990066FCB6 /* HeapInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2E526BD1590EF000054E48D /* HeapTimer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2E526BB1590EF000054E48D /* HeapTimer.cpp */; };
+		C2E526BE1590EF000054E48D /* HeapTimer.h in Headers */ = {isa = PBXBuildFile; fileRef = C2E526BC1590EF000054E48D /* HeapTimer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2F0F2D116BAEEE900187C19 /* StructureRareData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2F0F2D016BAEEE900187C19 /* StructureRareData.cpp */; };
+		C2FCAE1017A9C24E0034C735 /* BytecodeBasicBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2FCAE0C17A9C24E0034C735 /* BytecodeBasicBlock.cpp */; };
+		C2FCAE1117A9C24E0034C735 /* BytecodeBasicBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = C2FCAE0D17A9C24E0034C735 /* BytecodeBasicBlock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2FCAE1217A9C24E0034C735 /* BytecodeLivenessAnalysis.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2FCAE0E17A9C24E0034C735 /* BytecodeLivenessAnalysis.cpp */; };
+		C2FCAE1317A9C24E0034C735 /* BytecodeLivenessAnalysis.h in Headers */ = {isa = PBXBuildFile; fileRef = C2FCAE0F17A9C24E0034C735 /* BytecodeLivenessAnalysis.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C2FE18A416BAEC4000AF3061 /* StructureRareData.h in Headers */ = {isa = PBXBuildFile; fileRef = C2FE18A316BAEC4000AF3061 /* StructureRareData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C442CB251A6CDB8C005D3D7C /* JSInputs.json in Headers */ = {isa = PBXBuildFile; fileRef = 9928FF3D18AC4B1C00B8CF12 /* JSInputs.json */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4703CC0192844960013FBEA /* generate-inspector-protocol-bindings.py in Headers */ = {isa = PBXBuildFile; fileRef = C4703CBF192844960013FBEA /* generate-inspector-protocol-bindings.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4703CCE192844CC0013FBEA /* generate_js_backend_commands.py in Headers */ = {isa = PBXBuildFile; fileRef = C4703CC3192844CC0013FBEA /* generate_js_backend_commands.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4703CD5192844CC0013FBEA /* generator_templates.py in Headers */ = {isa = PBXBuildFile; fileRef = C4703CCA192844CC0013FBEA /* generator_templates.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4703CD6192844CC0013FBEA /* generator.py in Headers */ = {isa = PBXBuildFile; fileRef = C4703CCB192844CC0013FBEA /* generator.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4703CD7192844CC0013FBEA /* models.py in Headers */ = {isa = PBXBuildFile; fileRef = C4703CCC192844CC0013FBEA /* models.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4F4B6F31A05C944005CAB76 /* cpp_generator_templates.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6CF1A05C76F005CAB76 /* cpp_generator_templates.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4F4B6F41A05C944005CAB76 /* cpp_generator.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D01A05C76F005CAB76 /* cpp_generator.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4F4B6F51A05C984005CAB76 /* generate_objc_protocol_types_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D71A05C76F005CAB76 /* generate_objc_protocol_types_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		C4F4B6F61A05C984005CAB76 /* objc_generator_templates.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D81A05C76F005CAB76 /* objc_generator_templates.py */; settings = {ATTRIBUTES = (Private, ); }; };
+		D9722752DC54459B9125B539 /* JSModuleLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 77B25CB2C3094A92A38E1DB3 /* JSModuleLoader.h */; };
+		DC00039319D8BE6F00023EB0 /* DFGPreciseLocalClobberize.h in Headers */ = {isa = PBXBuildFile; fileRef = DC00039019D8BE6F00023EB0 /* DFGPreciseLocalClobberize.h */; };
+		DC0184191D10C1890057B053 /* JITWorklist.h in Headers */ = {isa = PBXBuildFile; fileRef = DC0184181D10C1870057B053 /* JITWorklist.h */; };
+		DC01841A1D10C18C0057B053 /* JITWorklist.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC0184171D10C1870057B053 /* JITWorklist.cpp */; };
+		DC17E8171C9C91D6008A6AB3 /* ShadowChicken.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC17E8131C9C7FD4008A6AB3 /* ShadowChicken.cpp */; };
+		DC17E8181C9C91D9008A6AB3 /* ShadowChicken.h in Headers */ = {isa = PBXBuildFile; fileRef = DC17E8141C9C7FD4008A6AB3 /* ShadowChicken.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		DC17E8191C9C91DB008A6AB3 /* ShadowChickenInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = DC17E8151C9C7FD4008A6AB3 /* ShadowChickenInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		DC17E81A1C9C91E9008A6AB3 /* CCallHelpers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC17E8161C9C802B008A6AB3 /* CCallHelpers.cpp */; };
+		DC2143071CA32E55000A8869 /* ICStats.h in Headers */ = {isa = PBXBuildFile; fileRef = DC2143061CA32E52000A8869 /* ICStats.h */; };
+		DC2143081CA32E58000A8869 /* ICStats.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC2143051CA32E52000A8869 /* ICStats.cpp */; };
+		DC3D2B0A1D34316200BA918C /* HeapCell.h in Headers */ = {isa = PBXBuildFile; fileRef = DC3D2B091D34316100BA918C /* HeapCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		DC3D2B0C1D34377000BA918C /* HeapCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC3D2B0B1D34376E00BA918C /* HeapCell.cpp */; };
+		DC454B8C1D00E822004C18AF /* AirDumpAsJS.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC454B8A1D00E81F004C18AF /* AirDumpAsJS.cpp */; };
+		DC454B8D1D00E824004C18AF /* AirDumpAsJS.h in Headers */ = {isa = PBXBuildFile; fileRef = DC454B8B1D00E81F004C18AF /* AirDumpAsJS.h */; };
+		DC605B5D1CE26EA000593718 /* ProfilerEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC605B591CE26E9800593718 /* ProfilerEvent.cpp */; };
+		DC605B5E1CE26EA200593718 /* ProfilerEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = DC605B5A1CE26E9800593718 /* ProfilerEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		DC605B5F1CE26EA500593718 /* ProfilerUID.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC605B5B1CE26E9800593718 /* ProfilerUID.cpp */; };
+		DC605B601CE26EA700593718 /* ProfilerUID.h in Headers */ = {isa = PBXBuildFile; fileRef = DC605B5C1CE26E9800593718 /* ProfilerUID.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		DC69AA661CF7A1F200C6272F /* MatchResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC69AA651CF7A1EF00C6272F /* MatchResult.cpp */; };
+		DC69B99C1D15F912002E3C00 /* B3InferSwitches.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC69B99A1D15F90F002E3C00 /* B3InferSwitches.cpp */; };
+		DC69B99D1D15F914002E3C00 /* B3InferSwitches.h in Headers */ = {isa = PBXBuildFile; fileRef = DC69B99B1D15F90F002E3C00 /* B3InferSwitches.h */; };
+		DC7997831CDE9FA0004D4A09 /* TagRegistersMode.h in Headers */ = {isa = PBXBuildFile; fileRef = DC7997821CDE9F9E004D4A09 /* TagRegistersMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		DC7997841CDE9FA2004D4A09 /* TagRegistersMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC7997811CDE9F9E004D4A09 /* TagRegistersMode.cpp */; };
+		DC9A0C1F1D2D9CB10085124E /* B3CaseCollectionInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = DC9A0C1E1D2D94EF0085124E /* B3CaseCollectionInlines.h */; };
+		DC9A0C201D2D9CB30085124E /* B3CaseCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = DC9A0C1D1D2D94EF0085124E /* B3CaseCollection.h */; };
+		DC9A0C211D2D9CB40085124E /* B3CaseCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC9A0C1C1D2D94EF0085124E /* B3CaseCollection.cpp */; };
+		DCEE22091CEB9895000C2396 /* DFGBackwardsCFG.h in Headers */ = {isa = PBXBuildFile; fileRef = DCEE22061CEB9890000C2396 /* DFGBackwardsCFG.h */; };
+		DCEE220A1CEB9895000C2396 /* DFGBackwardsDominators.h in Headers */ = {isa = PBXBuildFile; fileRef = DCEE22071CEB9890000C2396 /* DFGBackwardsDominators.h */; };
+		DCEE220B1CEB9895000C2396 /* DFGControlEquivalenceAnalysis.h in Headers */ = {isa = PBXBuildFile; fileRef = DCEE22081CEB9890000C2396 /* DFGControlEquivalenceAnalysis.h */; };
+		DCEE220D1CEBAF75000C2396 /* DFGNullAbstractState.h in Headers */ = {isa = PBXBuildFile; fileRef = DCEE220C1CEBAF73000C2396 /* DFGNullAbstractState.h */; };
+		DCF3D5691CD2946D003D5C65 /* LazyClassStructure.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DCF3D5641CD29468003D5C65 /* LazyClassStructure.cpp */; };
+		DCF3D56A1CD29470003D5C65 /* LazyClassStructure.h in Headers */ = {isa = PBXBuildFile; fileRef = DCF3D5651CD29468003D5C65 /* LazyClassStructure.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		DCF3D56B1CD29472003D5C65 /* LazyClassStructureInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = DCF3D5661CD29468003D5C65 /* LazyClassStructureInlines.h */; };
+		DCF3D56C1CD29475003D5C65 /* LazyProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = DCF3D5671CD29468003D5C65 /* LazyProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		DCF3D56D1CD29476003D5C65 /* LazyPropertyInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = DCF3D5681CD29468003D5C65 /* LazyPropertyInlines.h */; };
+		DCFDFBD91D1F5D9B00FE3D72 /* B3BottomProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = DCFDFBD71D1F5D9800FE3D72 /* B3BottomProvider.h */; };
+		DCFDFBDA1D1F5D9E00FE3D72 /* B3TypeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = DCFDFBD81D1F5D9800FE3D72 /* B3TypeMap.h */; };
+		DE26E9031CB5DD0500D2BE82 /* BuiltinExecutableCreator.h in Headers */ = {isa = PBXBuildFile; fileRef = DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */; };
+		DE26E9071CB5DEFB00D2BE82 /* BuiltinExecutableCreator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DE26E9061CB5DD9600D2BE82 /* BuiltinExecutableCreator.cpp */; };
+		DE5A0A001BA3AC3E003D4424 /* IntrinsicEmitter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DE5A09FF1BA3AC3E003D4424 /* IntrinsicEmitter.cpp */; };
+		DEA7E2441BBC677200D78440 /* JSTypedArrayViewPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53F256E11B87E28000B4B768 /* JSTypedArrayViewPrototype.cpp */; };
+		DEA7E2451BBC677F00D78440 /* JSTypedArrayViewPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7C1B791106000EBD33 /* JSTypedArrayViewPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E124A8F70E555775003091F1 /* OpaqueJSString.h in Headers */ = {isa = PBXBuildFile; fileRef = E124A8F50E555775003091F1 /* OpaqueJSString.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E124A8F80E555775003091F1 /* OpaqueJSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E124A8F60E555775003091F1 /* OpaqueJSString.cpp */; };
+		E18E3A590DF9278C00D90B34 /* VM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18E3A570DF9278C00D90B34 /* VM.cpp */; };
+		E318CBC01B8AEF5100A2929D /* JSModuleNamespaceObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E318CBBE1B8AEF5100A2929D /* JSModuleNamespaceObject.cpp */; };
+		E318CBC11B8AEF5100A2929D /* JSModuleNamespaceObject.h in Headers */ = {isa = PBXBuildFile; fileRef = E318CBBF1B8AEF5100A2929D /* JSModuleNamespaceObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E322E5A21DA64439006E7709 /* DFGDOMJITPatchpointParams.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E322E5A01DA64435006E7709 /* DFGDOMJITPatchpointParams.cpp */; };
+		E322E5A31DA64439006E7709 /* DFGDOMJITPatchpointParams.h in Headers */ = {isa = PBXBuildFile; fileRef = E322E5A11DA64435006E7709 /* DFGDOMJITPatchpointParams.h */; };
+		E322E5A61DA644A8006E7709 /* FTLDOMJITPatchpointParams.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E322E5A41DA644A4006E7709 /* FTLDOMJITPatchpointParams.cpp */; };
+		E322E5A71DA644A8006E7709 /* FTLDOMJITPatchpointParams.h in Headers */ = {isa = PBXBuildFile; fileRef = E322E5A51DA644A4006E7709 /* FTLDOMJITPatchpointParams.h */; };
+		E328C6C71DA4304500D255FD /* MaxFrameExtentForSlowPathCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 65860177185A8F5E00030EEE /* MaxFrameExtentForSlowPathCall.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E328C6C81DA4306100D255FD /* RegisterAtOffsetList.h in Headers */ = {isa = PBXBuildFile; fileRef = 6540C79D1B82D99D000F6B79 /* RegisterAtOffsetList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E328C6C91DA432F900D255FD /* RegisterAtOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 6540C79F1B82D9CE000F6B79 /* RegisterAtOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E328DAE71D38D004001A2529 /* BytecodeGeneratorification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3D264261D38C042000BE174 /* BytecodeGeneratorification.cpp */; };
+		E328DAE81D38D005001A2529 /* BytecodeGeneratorification.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D264271D38C042000BE174 /* BytecodeGeneratorification.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E328DAE91D38D005001A2529 /* BytecodeGraph.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D264281D38C042000BE174 /* BytecodeGraph.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E328DAEA1D38D005001A2529 /* BytecodeRewriter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3D264291D38C042000BE174 /* BytecodeRewriter.cpp */; };
+		E328DAEB1D38D005001A2529 /* BytecodeRewriter.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D2642A1D38C042000BE174 /* BytecodeRewriter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E32AB2441DCD75F400D7533A /* MacroAssemblerHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = E380A76B1DCD7195000F89E6 /* MacroAssemblerHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E32FF1EA1DA7571C00A8BF21 /* DOMJITSlowPathCalls.h in Headers */ = {isa = PBXBuildFile; fileRef = E3CB1E241DA7540A00FA1E56 /* DOMJITSlowPathCalls.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E33637A51B63220200EE0840 /* ReflectObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E33637A31B63220200EE0840 /* ReflectObject.cpp */; };
+		E33637A61B63220200EE0840 /* ReflectObject.h in Headers */ = {isa = PBXBuildFile; fileRef = E33637A41B63220200EE0840 /* ReflectObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E33B3E261B7ABD750048DB2E /* InspectorInstrumentationObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = E33B3E251B7ABD750048DB2E /* InspectorInstrumentationObject.lut.h */; };
+		E33E8D1C1B9013C300346B52 /* JSNativeStdFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E33E8D1A1B9013C300346B52 /* JSNativeStdFunction.cpp */; };
+		E33E8D1D1B9013C300346B52 /* JSNativeStdFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = E33E8D1B1B9013C300346B52 /* JSNativeStdFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E33E8D201B9013DE00346B52 /* NativeStdFunctionCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E33E8D1E1B9013DE00346B52 /* NativeStdFunctionCell.cpp */; };
+		E33E8D211B9013DE00346B52 /* NativeStdFunctionCell.h in Headers */ = {isa = PBXBuildFile; fileRef = E33E8D1F1B9013DE00346B52 /* NativeStdFunctionCell.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E33F50741B8421C000413856 /* JSInternalPromisePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E33F50721B8421C000413856 /* JSInternalPromisePrototype.cpp */; };
+		E33F50751B8421C000413856 /* JSInternalPromisePrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = E33F50731B8421C000413856 /* JSInternalPromisePrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E33F50781B84225700413856 /* JSInternalPromiseConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E33F50761B84225700413856 /* JSInternalPromiseConstructor.cpp */; };
+		E33F50791B84225700413856 /* JSInternalPromiseConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = E33F50771B84225700413856 /* JSInternalPromiseConstructor.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E33F50801B8429A400413856 /* JSInternalPromise.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E33F507E1B8429A400413856 /* JSInternalPromise.cpp */; };
+		E33F50811B8429A400413856 /* JSInternalPromise.h in Headers */ = {isa = PBXBuildFile; fileRef = E33F507F1B8429A400413856 /* JSInternalPromise.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E33F50841B8437A000413856 /* JSInternalPromiseDeferred.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E33F50821B8437A000413856 /* JSInternalPromiseDeferred.cpp */; };
+		E33F50851B8437A000413856 /* JSInternalPromiseDeferred.h in Headers */ = {isa = PBXBuildFile; fileRef = E33F50831B8437A000413856 /* JSInternalPromiseDeferred.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E33F50871B8449EF00413856 /* JSInternalPromiseConstructor.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = E33F50861B8449EF00413856 /* JSInternalPromiseConstructor.lut.h */; };
+		E34EDBF71DB5FFC900DC87A5 /* FrameTracers.h in Headers */ = {isa = PBXBuildFile; fileRef = E34EDBF61DB5FFC100DC87A5 /* FrameTracers.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E350708A1DC49BBF0089BCD6 /* DOMJITSignature.h in Headers */ = {isa = PBXBuildFile; fileRef = E35070891DC49BB60089BCD6 /* DOMJITSignature.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E354622B1B6065D100545386 /* ConstructAbility.h in Headers */ = {isa = PBXBuildFile; fileRef = E354622A1B6065D100545386 /* ConstructAbility.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3555B8A1DAE03A500F36921 /* DOMJITCallDOMGetterPatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = E3555B891DAE03A200F36921 /* DOMJITCallDOMGetterPatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E355F3521B7DC85300C50DC5 /* ModuleLoaderPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E355F3501B7DC85300C50DC5 /* ModuleLoaderPrototype.cpp */; };
+		E355F3531B7DC85300C50DC5 /* ModuleLoaderPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = E355F3511B7DC85300C50DC5 /* ModuleLoaderPrototype.h */; };
+		E35CA1531DBC3A5C00F83516 /* DOMJITHeapRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E35CA1511DBC3A5600F83516 /* DOMJITHeapRange.cpp */; };
+		E35CA1541DBC3A5C00F83516 /* DOMJITHeapRange.h in Headers */ = {isa = PBXBuildFile; fileRef = E35CA1521DBC3A5600F83516 /* DOMJITHeapRange.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E35CA1551DBC3A5F00F83516 /* DOMJITAbstractHeap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E35CA14F1DBC3A5600F83516 /* DOMJITAbstractHeap.cpp */; };
+		E35CA1561DBC3A5F00F83516 /* DOMJITAbstractHeap.h in Headers */ = {isa = PBXBuildFile; fileRef = E35CA1501DBC3A5600F83516 /* DOMJITAbstractHeap.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E35E035F1B7AB43E0073AD2A /* InspectorInstrumentationObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E35E035D1B7AB43E0073AD2A /* InspectorInstrumentationObject.cpp */; };
+		E35E03601B7AB43E0073AD2A /* InspectorInstrumentationObject.h in Headers */ = {isa = PBXBuildFile; fileRef = E35E035E1B7AB43E0073AD2A /* InspectorInstrumentationObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3794E751B77EB97005543AE /* ModuleAnalyzer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3794E731B77EB97005543AE /* ModuleAnalyzer.cpp */; };
+		E3794E761B77EB97005543AE /* ModuleAnalyzer.h in Headers */ = {isa = PBXBuildFile; fileRef = E3794E741B77EB97005543AE /* ModuleAnalyzer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E37AD83C1DA4928600F3D412 /* DOMJITPatchpointParams.h in Headers */ = {isa = PBXBuildFile; fileRef = E37AD83A1DA4928000F3D412 /* DOMJITPatchpointParams.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E37AD83D1DA4928600F3D412 /* DOMJITReg.h in Headers */ = {isa = PBXBuildFile; fileRef = E37AD83B1DA4928000F3D412 /* DOMJITReg.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3963CEE1B73F75000EB4CE5 /* NodesAnalyzeModule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3963CEC1B73F75000EB4CE5 /* NodesAnalyzeModule.cpp */; };
+		E39D45F51D39005600B3B377 /* InterpreterInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = E39D9D841D39000600667282 /* InterpreterInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E39DA4A61B7E8B7C0084F33A /* JSModuleRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E39DA4A41B7E8B7C0084F33A /* JSModuleRecord.cpp */; };
+		E39DA4A71B7E8B7C0084F33A /* JSModuleRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = E39DA4A51B7E8B7C0084F33A /* JSModuleRecord.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3A421431D6F58930007C617 /* PreciseJumpTargetsInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = E3A421421D6F588F0007C617 /* PreciseJumpTargetsInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3BFD0BB1DAF80870065DEA2 /* DOMJITAccessCasePatchpointParams.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3BFD0B91DAF807C0065DEA2 /* DOMJITAccessCasePatchpointParams.cpp */; };
+		E3BFD0BC1DAF808E0065DEA2 /* DOMJITAccessCasePatchpointParams.h in Headers */ = {isa = PBXBuildFile; fileRef = E3BFD0BA1DAF807C0065DEA2 /* DOMJITAccessCasePatchpointParams.h */; };
+		E3C08E3C1DA41B810039478F /* DOMJITPatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C08E3B1DA41B7B0039478F /* DOMJITPatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3C79CAB1DB9A4DC00D1ECA4 /* DOMJITEffect.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C79CAA1DB9A4D600D1ECA4 /* DOMJITEffect.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3D239C81B829C1C00BBEF67 /* JSModuleEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3D239C61B829C1C00BBEF67 /* JSModuleEnvironment.cpp */; };
+		E3D239C91B829C1C00BBEF67 /* JSModuleEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D239C71B829C1C00BBEF67 /* JSModuleEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3EF88741B66DF23003F26CB /* JSPropertyNameIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3EF88721B66DF23003F26CB /* JSPropertyNameIterator.cpp */; };
+		E3EF88751B66DF23003F26CB /* JSPropertyNameIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = E3EF88731B66DF23003F26CB /* JSPropertyNameIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3FF75331D9CEA1800C7E16D /* DOMJITGetterSetter.h in Headers */ = {isa = PBXBuildFile; fileRef = E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E3FFC8531DAD7D1500DEA53E /* DOMJITValue.h in Headers */ = {isa = PBXBuildFile; fileRef = E3FFC8521DAD7D1000DEA53E /* DOMJITValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E49DC15512EF277200184A1F /* SourceProviderCache.cpp */; };
+		E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC15112EF272200184A1F /* SourceProviderCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE0D4A061AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE0D4A041AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp */; };
+		FE0D4A091ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */; };
+		FE1220271BE7F58C0039E6F2 /* JITAddGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1220261BE7F5640039E6F2 /* JITAddGenerator.h */; };
+		FE1220281BE7F5910039E6F2 /* JITAddGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1220251BE7F5640039E6F2 /* JITAddGenerator.cpp */; };
+		FE187A011BFBE55E0038BBCA /* JITMulGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */; };
+		FE187A021BFBE5610038BBCA /* JITMulGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */; };
+		FE187A0D1C030D5C0038BBCA /* JITDivGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE187A0B1C0229230038BBCA /* JITDivGenerator.h */; };
+		FE187A0E1C030D640038BBCA /* JITDivGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE187A0A1C0229230038BBCA /* JITDivGenerator.cpp */; };
+		FE187A0F1C030D6C0038BBCA /* SnippetOperand.h in Headers */ = {isa = PBXBuildFile; fileRef = FE187A0C1C02EBA70038BBCA /* SnippetOperand.h */; };
+		FE1C0FFD1B193E9800B53FCA /* Exception.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1C0FFC1B193E9800B53FCA /* Exception.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE1C0FFF1B194FD100B53FCA /* Exception.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1C0FFE1B194FD100B53FCA /* Exception.cpp */; };
+		FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */; };
+		FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE2E6A7B1D6EA62C0060F896 /* ThrowScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE2E6A7A1D6EA5FE0060F896 /* ThrowScope.cpp */; };
+		FE3022D21E3D73A500BAC493 /* SigillCrashAnalyzer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE3022D01E3D739600BAC493 /* SigillCrashAnalyzer.cpp */; };
+		FE3022D31E3D73A500BAC493 /* SigillCrashAnalyzer.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3022D11E3D739600BAC493 /* SigillCrashAnalyzer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE3022D61E42857300BAC493 /* VMInspector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE3022D41E42856700BAC493 /* VMInspector.cpp */; };
+		FE3022D71E42857300BAC493 /* VMInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3022D51E42856700BAC493 /* VMInspector.h */; };
+		FE3022D91E43C93400BAC493 /* JSVirtualMachinePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3022D81E43C85500BAC493 /* JSVirtualMachinePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE318FDF1CAC982700DFCC54 /* ECMAScriptSpecInternalFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */; };
+		FE318FE01CAC982F00DFCC54 /* ECMAScriptSpecInternalFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */; };
+		FE3422121D6B81C30032BE88 /* ThrowScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3422111D6B818C0032BE88 /* ThrowScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE384EE51ADDB7AD0055DE2C /* JSDollarVM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */; };
+		FE384EE61ADDB7AD0055DE2C /* JSDollarVM.h in Headers */ = {isa = PBXBuildFile; fileRef = FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE384EE71ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */; };
+		FE384EE81ADDB7AD0055DE2C /* JSDollarVMPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = FE384EE41ADDB7AD0055DE2C /* JSDollarVMPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE3913541B794F6E00EDAF71 /* LiveObjectList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE3913521B794AC900EDAF71 /* LiveObjectList.cpp */; };
+		FE3913551B794F8A00EDAF71 /* LiveObjectData.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3913511B794AC900EDAF71 /* LiveObjectData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE3913561B794F8F00EDAF71 /* LiveObjectList.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3913531B794AC900EDAF71 /* LiveObjectList.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE3A06A61C10B72D00390FDD /* JITBitOrGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3A06A41C10B70800390FDD /* JITBitOrGenerator.h */; };
+		FE3A06A81C10BC8100390FDD /* JITBitBinaryOpGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3A06A71C10BC7400390FDD /* JITBitBinaryOpGenerator.h */; };
+		FE3A06AC1C10C39E00390FDD /* JITBitOrGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE3A06A31C10B70800390FDD /* JITBitOrGenerator.cpp */; };
+		FE3A06B11C10CB8400390FDD /* JITBitAndGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE3A06AD1C10CB6F00390FDD /* JITBitAndGenerator.cpp */; };
+		FE3A06B21C10CB8900390FDD /* JITBitAndGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3A06AE1C10CB6F00390FDD /* JITBitAndGenerator.h */; };
+		FE3A06B31C10CB8E00390FDD /* JITBitXorGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE3A06AF1C10CB6F00390FDD /* JITBitXorGenerator.cpp */; };
+		FE3A06B41C10CB9300390FDD /* JITBitXorGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3A06B01C10CB6F00390FDD /* JITBitXorGenerator.h */; };
+		FE3A06BD1C11040D00390FDD /* JITLeftShiftGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE3A06B61C1103D900390FDD /* JITLeftShiftGenerator.cpp */; };
+		FE3A06BE1C11041200390FDD /* JITLeftShiftGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3A06B71C1103D900390FDD /* JITLeftShiftGenerator.h */; };
+		FE3A06BF1C11041600390FDD /* JITRightShiftGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE3A06B81C1103D900390FDD /* JITRightShiftGenerator.cpp */; };
+		FE3A06C01C11041A00390FDD /* JITRightShiftGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3A06B91C1103D900390FDD /* JITRightShiftGenerator.h */; };
+		FE4238901BE18C3C00514737 /* JITSubGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE42388F1BE18C1200514737 /* JITSubGenerator.cpp */; };
+		FE4BFF2B1AD476E700088F87 /* FunctionOverrides.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE4BFF291AD476E700088F87 /* FunctionOverrides.cpp */; };
+		FE4BFF2C1AD476E700088F87 /* FunctionOverrides.h in Headers */ = {isa = PBXBuildFile; fileRef = FE4BFF2A1AD476E700088F87 /* FunctionOverrides.h */; };
+		FE4D55B81AE716CA0052E459 /* IterationStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = FE4D55B71AE716CA0052E459 /* IterationStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE5068651AE246390009DAB7 /* DeferredSourceDump.h in Headers */ = {isa = PBXBuildFile; fileRef = FE5068641AE246390009DAB7 /* DeferredSourceDump.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE5068671AE25E280009DAB7 /* DeferredSourceDump.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE5068661AE25E280009DAB7 /* DeferredSourceDump.cpp */; };
+		FE5932A7183C5A2600A1ECCC /* VMEntryScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE5932A5183C5A2600A1ECCC /* VMEntryScope.cpp */; };
+		FE5932A8183C5A2600A1ECCC /* VMEntryScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FE5932A6183C5A2600A1ECCC /* VMEntryScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE6029D91D6E1E4F0030204D /* ExceptionEventLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6029D81D6E1E330030204D /* ExceptionEventLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE6491371D78F01D00A694D4 /* ExceptionScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6491361D78F01300A694D4 /* ExceptionScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE6491391D78F3AF00A694D4 /* ExceptionScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE6491381D78F3A300A694D4 /* ExceptionScope.cpp */; };
+		FE68C6371B90DE040042BCB3 /* MacroAssemblerPrinter.h in Headers */ = {isa = PBXBuildFile; fileRef = FE68C6361B90DDD90042BCB3 /* MacroAssemblerPrinter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE68C6381B90DE0B0042BCB3 /* MacroAssemblerPrinter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE68C6351B90DDD90042BCB3 /* MacroAssemblerPrinter.cpp */; };
+		FE7BA60F1A1A7CEC00F1F7B4 /* HeapVerifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE7BA60D1A1A7CEC00F1F7B4 /* HeapVerifier.cpp */; };
+		FE7BA6101A1A7CEC00F1F7B4 /* HeapVerifier.h in Headers */ = {isa = PBXBuildFile; fileRef = FE7BA60E1A1A7CEC00F1F7B4 /* HeapVerifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE7C41961B97FC4B00F4D598 /* PingPongStackOverflowTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FEDA50D41B97F442009A3B4F /* PingPongStackOverflowTest.cpp */; };
+		FE80C1971D775CDD008510C0 /* CatchScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80C1961D775B27008510C0 /* CatchScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE80C1991D775FBE008510C0 /* CatchScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80C1981D775FB4008510C0 /* CatchScope.cpp */; };
+		FE80C19B1D776A98008510C0 /* ExceptionEventLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80C19A1D7768FD008510C0 /* ExceptionEventLocation.cpp */; };
+		FE99B2491C24C3D300C82159 /* JITNegGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE99B2481C24B6D300C82159 /* JITNegGenerator.h */; };
+		FE99B24A1C24C3D700C82159 /* JITNegGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE99B2471C24B6D300C82159 /* JITNegGenerator.cpp */; };
+		FEA08620182B7A0400F6D851 /* Breakpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0861E182B7A0400F6D851 /* Breakpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FEA08621182B7A0400F6D851 /* DebuggerPrimitives.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FEA0C4021CDD7D1D00481991 /* FunctionWhitelist.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FEA0C4001CDD7D0E00481991 /* FunctionWhitelist.cpp */; };
+		FEA0C4031CDD7D1D00481991 /* FunctionWhitelist.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0C4011CDD7D0E00481991 /* FunctionWhitelist.h */; };
+		FEB137571BB11EF900CD5100 /* MacroAssemblerARM64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FEB137561BB11EEE00CD5100 /* MacroAssemblerARM64.cpp */; };
+		FEB51F6C1A97B688001F921C /* Regress141809.mm in Sources */ = {isa = PBXBuildFile; fileRef = FEB51F6B1A97B688001F921C /* Regress141809.mm */; };
+		FEB58C14187B8B160098EF0B /* ErrorHandlingScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FEB58C12187B8B160098EF0B /* ErrorHandlingScope.cpp */; };
+		FEB58C15187B8B160098EF0B /* ErrorHandlingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FEB58C13187B8B160098EF0B /* ErrorHandlingScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FECB8B271D25BB85006F2463 /* FunctionOverridesTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FECB8B251D25BB6E006F2463 /* FunctionOverridesTest.cpp */; };
+		FECB8B2A1D25CB5A006F2463 /* testapi-function-overrides.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = FECB8B291D25CABB006F2463 /* testapi-function-overrides.js */; };
+		FED287B215EC9A5700DA8161 /* LLIntOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = FED287B115EC9A5700DA8161 /* LLIntOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FED94F2E171E3E2300BE77A4 /* Watchdog.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FED94F2B171E3E2300BE77A4 /* Watchdog.cpp */; };
+		FED94F2F171E3E2300BE77A4 /* Watchdog.h in Headers */ = {isa = PBXBuildFile; fileRef = FED94F2C171E3E2300BE77A4 /* Watchdog.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FEF040511AAE662D00BD28B0 /* CompareAndSwapTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FEF040501AAE662D00BD28B0 /* CompareAndSwapTest.cpp */; };
+		FEFD6FC61D5E7992008F2F0B /* JSStringInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FEFD6FC51D5E7970008F2F0B /* JSStringInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
+/* End PBXBuildFile section */
+
+/* Begin PBXContainerItemProxy section */
+		0F6183461C45F67A0072450B /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 0F6183381C45F62A0072450B;
+			remoteInfo = testair;
+		};
+		0F93275C1C20BF3A00CF6564 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 0F93274E1C20BCBA00CF6564;
+			remoteInfo = dynbench;
+		};
+		0FEC85B01BDB5D8F0080FF74 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 0FEC85941BDB5CF10080FF74;
+			remoteInfo = testb3;
+		};
+		0FF922D214F46B2F0041A24E /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 0F4680A914BA7FD900BFE272;
+			remoteInfo = "LLInt Offsets";
+		};
+		5D69E911152BE5470028D720 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 932F5BDA0822A1C700736975;
+			remoteInfo = jsc;
+		};
+		5D6B2A4E152B9E23005231DE /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 1412111F0A48793C00480255;
+			remoteInfo = minidom;
+		};
+		5D6B2A50152B9E23005231DE /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 14BD59BE0A3E8F9000BAF59C;
+			remoteInfo = testapi;
+		};
+		5D6B2A54152B9E23005231DE /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 651122F714046A4C002B101D;
+			remoteInfo = testRegExp;
+		};
+		5D6B2A56152B9E2E005231DE /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 5D6B2A47152B9E17005231DE;
+			remoteInfo = "Test Tools";
+		};
+		65244BD218ECB5000010B708 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 65FB3F6609D11E9100F49DEB;
+			remoteInfo = "Derived Sources";
+		};
+		65442D4F18EBB744007AF92F /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 65FB3F6609D11E9100F49DEB;
+			remoteInfo = "Derived Sources";
+		};
+		65788A9F18B409EB00C189FF /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 0FF922C314F46B130041A24E;
+			remoteInfo = JSCLLIntOffsetsExtractor;
+		};
+		65788AAA18B40A3B00C189FF /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 65FB3F6609D11E9100F49DEB;
+			remoteInfo = "Derived Sources";
+		};
+		65788AAC18B40A7B00C189FF /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 65788A9D18B409EB00C189FF;
+			remoteInfo = "Offline Assembler";
+		};
+		65FB3F7D09D11EF300F49DEB /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 65FB3F6609D11E9100F49DEB;
+			remoteInfo = "Generate Derived Sources";
+		};
+		932F5BE60822A1C700736975 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 0867D690FE84028FC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 932F5B3E0822A1C700736975;
+			remoteInfo = "JavaScriptCore (Upgraded)";
+		};
+/* End PBXContainerItemProxy section */
+
+/* Begin PBXCopyFilesBuildPhase section */
+		5DBB1511131D0B130056AD36 /* Copy Support Script */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 12;
+			dstPath = "";
+			dstSubfolderSpec = 16;
+			files = (
+				FECB8B2A1D25CB5A006F2463 /* testapi-function-overrides.js in Copy Support Script */,
+				5DBB151B131D0B310056AD36 /* testapi.js in Copy Support Script */,
+			);
+			name = "Copy Support Script";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		5DBB1524131D0BA10056AD36 /* Copy Support Script */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "";
+			dstSubfolderSpec = 16;
+			files = (
+				5DBB1525131D0BD70056AD36 /* minidom.js in Copy Support Script */,
+			);
+			name = "Copy Support Script";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXCopyFilesBuildPhase section */
+
+/* Begin PBXFileReference section */
+		000BEAF0DF604481AF6AB68C /* ModuleScopeData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModuleScopeData.h; sourceTree = "<group>"; };
+		08FC2F37AB76483A9966688F /* TemplateRegistryKeyTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemplateRegistryKeyTable.h; sourceTree = "<group>"; };
+		0F0123301944EA1B00843A0C /* DFGValueStrength.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValueStrength.cpp; path = dfg/DFGValueStrength.cpp; sourceTree = "<group>"; };
+		0F0123311944EA1B00843A0C /* DFGValueStrength.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGValueStrength.h; path = dfg/DFGValueStrength.h; sourceTree = "<group>"; };
+		0F0332BF18ADFAE1005F979A /* ExitingJITType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExitingJITType.cpp; sourceTree = "<group>"; };
+		0F0332C118B01763005F979A /* GetByIdVariant.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetByIdVariant.cpp; sourceTree = "<group>"; };
+		0F0332C218B01763005F979A /* GetByIdVariant.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetByIdVariant.h; sourceTree = "<group>"; };
+		0F0332C518B53FA9005F979A /* FTLWeight.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLWeight.h; path = ftl/FTLWeight.h; sourceTree = "<group>"; };
+		0F0332C718B546EC005F979A /* FTLWeightedTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLWeightedTarget.h; path = ftl/FTLWeightedTarget.h; sourceTree = "<group>"; };
+		0F04396B1B03DC0B009598B7 /* DFGCombinedLiveness.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCombinedLiveness.cpp; path = dfg/DFGCombinedLiveness.cpp; sourceTree = "<group>"; };
+		0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCombinedLiveness.h; path = dfg/DFGCombinedLiveness.h; sourceTree = "<group>"; };
+		0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayifySlowPathGenerator.h; path = dfg/DFGArrayifySlowPathGenerator.h; sourceTree = "<group>"; };
+		0F070A421D543A89006E7232 /* CellContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CellContainer.h; sourceTree = "<group>"; };
+		0F070A431D543A89006E7232 /* CellContainerInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CellContainerInlines.h; sourceTree = "<group>"; };
+		0F070A441D543A89006E7232 /* HeapCellInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapCellInlines.h; sourceTree = "<group>"; };
+		0F070A451D543A89006E7232 /* LargeAllocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LargeAllocation.cpp; sourceTree = "<group>"; };
+		0F070A461D543A89006E7232 /* LargeAllocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LargeAllocation.h; sourceTree = "<group>"; };
+		0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
+		0F0A75201B94BFA900110660 /* InferredType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredType.cpp; sourceTree = "<group>"; };
+		0F0A75211B94BFA900110660 /* InferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredType.h; sourceTree = "<group>"; };
+		0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
+		0F0B839814BCF45A00885B4F /* LLIntThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntThunks.h; path = llint/LLIntThunks.h; sourceTree = "<group>"; };
+		0F0B83A514BCF50400885B4F /* CodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeType.h; sourceTree = "<group>"; };
+		0F0B83A814BCF55E00885B4F /* HandlerInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandlerInfo.h; sourceTree = "<group>"; };
+		0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExpressionRangeInfo.h; sourceTree = "<group>"; };
+		0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallLinkInfo.cpp; sourceTree = "<group>"; };
+		0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallLinkInfo.h; sourceTree = "<group>"; };
+		0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallReturnOffsetToBytecodeOffset.h; sourceTree = "<group>"; };
+		0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutDirectIndexMode.h; sourceTree = "<group>"; };
+		0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SparseArrayValueMap.cpp; sourceTree = "<group>"; };
+		0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntCallLinkInfo.h; sourceTree = "<group>"; };
+		0F10F1A21C420BF0001C07D2 /* AirCustom.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirCustom.h; path = b3/air/AirCustom.h; sourceTree = "<group>"; };
+		0F12DE0D1979D5FD0006FF4E /* ExceptionFuzz.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionFuzz.cpp; sourceTree = "<group>"; };
+		0F12DE0E1979D5FD0006FF4E /* ExceptionFuzz.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionFuzz.h; sourceTree = "<group>"; };
+		0F136D4B174AD69B0075B354 /* DeferGC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeferGC.h; sourceTree = "<group>"; };
+		0F13912416771C30009CCB07 /* ProfilerBytecodeSequence.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerBytecodeSequence.cpp; path = profiler/ProfilerBytecodeSequence.cpp; sourceTree = "<group>"; };
+		0F13912516771C30009CCB07 /* ProfilerBytecodeSequence.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerBytecodeSequence.h; path = profiler/ProfilerBytecodeSequence.h; sourceTree = "<group>"; };
+		0F13912616771C30009CCB07 /* ProfilerProfiledBytecodes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerProfiledBytecodes.cpp; path = profiler/ProfilerProfiledBytecodes.cpp; sourceTree = "<group>"; };
+		0F13912716771C30009CCB07 /* ProfilerProfiledBytecodes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerProfiledBytecodes.h; path = profiler/ProfilerProfiledBytecodes.h; sourceTree = "<group>"; };
+		0F13E04C16164A1B00DC8DE7 /* IndexingType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IndexingType.cpp; sourceTree = "<group>"; };
+		0F15CD201BA5F9860031FFD3 /* PutByIdFlags.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PutByIdFlags.cpp; sourceTree = "<group>"; };
+		0F15CD211BA5F9860031FFD3 /* PutByIdFlags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutByIdFlags.h; sourceTree = "<group>"; };
+		0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPaths.h; sourceTree = "<group>"; };
+		0F1725FE1B48719A00AC3A55 /* DFGMinifiedGraph.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMinifiedGraph.cpp; path = dfg/DFGMinifiedGraph.cpp; sourceTree = "<group>"; };
+		0F18D3CD1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAdaptiveStructureWatchpoint.cpp; path = dfg/DFGAdaptiveStructureWatchpoint.cpp; sourceTree = "<group>"; };
+		0F18D3CE1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAdaptiveStructureWatchpoint.h; path = dfg/DFGAdaptiveStructureWatchpoint.h; sourceTree = "<group>"; };
+		0F190CAA189D82F6000AE5F0 /* ProfilerJettisonReason.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerJettisonReason.cpp; path = profiler/ProfilerJettisonReason.cpp; sourceTree = "<group>"; };
+		0F190CAB189D82F6000AE5F0 /* ProfilerJettisonReason.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerJettisonReason.h; path = profiler/ProfilerJettisonReason.h; sourceTree = "<group>"; };
+		0F1C3DD91BBCE09E00E523E4 /* CellState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CellState.h; sourceTree = "<group>"; };
+		0F1DD84918A945BE0026F3FA /* JSCInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCInlines.h; sourceTree = "<group>"; };
+		0F1E3A431534CBAD000F9456 /* DFGArgumentPosition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArgumentPosition.h; path = dfg/DFGArgumentPosition.h; sourceTree = "<group>"; };
+		0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDoubleFormatState.h; path = dfg/DFGDoubleFormatState.h; sourceTree = "<group>"; };
+		0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSlowPathGenerator.h; path = dfg/DFGSlowPathGenerator.h; sourceTree = "<group>"; };
+		0F1E3A65153A21DF000F9456 /* DFGSilentRegisterSavePlan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSilentRegisterSavePlan.h; path = dfg/DFGSilentRegisterSavePlan.h; sourceTree = "<group>"; };
+		0F1FB38A1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SynchronousStopTheWorldMutatorScheduler.cpp; sourceTree = "<group>"; };
+		0F1FB38B1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SynchronousStopTheWorldMutatorScheduler.h; sourceTree = "<group>"; };
+		0F1FB38C1E173A6200A9BE50 /* MutatorScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutatorScheduler.cpp; sourceTree = "<group>"; };
+		0F1FB3921E177A6F00A9BE50 /* VisitingTimeout.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VisitingTimeout.h; sourceTree = "<group>"; };
+		0F1FB3941E1AF7DF00A9BE50 /* DFGPlanInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPlanInlines.h; path = dfg/DFGPlanInlines.h; sourceTree = "<group>"; };
+		0F1FB3951E1AF7DF00A9BE50 /* DFGWorklistInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGWorklistInlines.h; path = dfg/DFGWorklistInlines.h; sourceTree = "<group>"; };
+		0F1FB3981E1F65F900A9BE50 /* MutatorScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MutatorScheduler.h; sourceTree = "<group>"; };
+		0F1FE51B1922A3BC006987C5 /* AbortReason.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbortReason.h; sourceTree = "<group>"; };
+		0F20177D1DCADC3000EA5950 /* DFGFlowIndexing.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFlowIndexing.cpp; path = dfg/DFGFlowIndexing.cpp; sourceTree = "<group>"; };
+		0F20177E1DCADC3000EA5950 /* DFGFlowIndexing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFlowIndexing.h; path = dfg/DFGFlowIndexing.h; sourceTree = "<group>"; };
+		0F2017811DCADD4000EA5950 /* DFGFlowMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFlowMap.h; path = dfg/DFGFlowMap.h; sourceTree = "<group>"; };
+		0F2017831DCAE14700EA5950 /* DFGNodeFlowProjection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNodeFlowProjection.cpp; path = dfg/DFGNodeFlowProjection.cpp; sourceTree = "<group>"; };
+		0F2017841DCAE14700EA5950 /* DFGNodeFlowProjection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeFlowProjection.h; path = dfg/DFGNodeFlowProjection.h; sourceTree = "<group>"; };
+		0F2017871DCB942200EA5950 /* DFGNodeAbstractValuePair.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNodeAbstractValuePair.cpp; path = dfg/DFGNodeAbstractValuePair.cpp; sourceTree = "<group>"; };
+		0F2017881DCB942200EA5950 /* DFGNodeAbstractValuePair.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeAbstractValuePair.h; path = dfg/DFGNodeAbstractValuePair.h; sourceTree = "<group>"; };
+		0F208AD61DF0925A007D3269 /* LockDuringMarking.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LockDuringMarking.h; sourceTree = "<group>"; };
+		0F20C2581A8013AB00DA3229 /* VirtualRegister.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VirtualRegister.cpp; sourceTree = "<group>"; };
+		0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeSpecializationKind.h; sourceTree = "<group>"; };
+		0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeConventions.h; sourceTree = "<group>"; };
+		0F235BBD17178E1C00690C7F /* FTLExitArgument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitArgument.cpp; path = ftl/FTLExitArgument.cpp; sourceTree = "<group>"; };
+		0F235BBE17178E1C00690C7F /* FTLExitArgument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitArgument.h; path = ftl/FTLExitArgument.h; sourceTree = "<group>"; };
+		0F235BBF17178E1C00690C7F /* FTLExitArgumentForOperand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitArgumentForOperand.cpp; path = ftl/FTLExitArgumentForOperand.cpp; sourceTree = "<group>"; };
+		0F235BC017178E1C00690C7F /* FTLExitArgumentForOperand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitArgumentForOperand.h; path = ftl/FTLExitArgumentForOperand.h; sourceTree = "<group>"; };
+		0F235BC117178E1C00690C7F /* FTLStackmapArgumentList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLStackmapArgumentList.h; path = ftl/FTLStackmapArgumentList.h; sourceTree = "<group>"; };
+		0F235BC417178E1C00690C7F /* FTLExitValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitValue.cpp; path = ftl/FTLExitValue.cpp; sourceTree = "<group>"; };
+		0F235BC517178E1C00690C7F /* FTLExitValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitValue.h; path = ftl/FTLExitValue.h; sourceTree = "<group>"; };
+		0F235BC617178E1C00690C7F /* FTLOSRExit.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOSRExit.cpp; path = ftl/FTLOSRExit.cpp; sourceTree = "<group>"; };
+		0F235BC717178E1C00690C7F /* FTLOSRExit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOSRExit.h; path = ftl/FTLOSRExit.h; sourceTree = "<group>"; };
+		0F235BC917178E1C00690C7F /* FTLOSRExitCompiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOSRExitCompiler.cpp; path = ftl/FTLOSRExitCompiler.cpp; sourceTree = "<group>"; };
+		0F235BCA17178E1C00690C7F /* FTLOSRExitCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOSRExitCompiler.h; path = ftl/FTLOSRExitCompiler.h; sourceTree = "<group>"; };
+		0F235BCB17178E1C00690C7F /* FTLThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLThunks.cpp; path = ftl/FTLThunks.cpp; sourceTree = "<group>"; };
+		0F235BCC17178E1C00690C7F /* FTLThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLThunks.h; path = ftl/FTLThunks.h; sourceTree = "<group>"; };
+		0F235BE717178E7300690C7F /* DFGOSRExitBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitBase.cpp; path = dfg/DFGOSRExitBase.cpp; sourceTree = "<group>"; };
+		0F235BE817178E7300690C7F /* DFGOSRExitBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitBase.h; path = dfg/DFGOSRExitBase.h; sourceTree = "<group>"; };
+		0F235BE917178E7300690C7F /* DFGOSRExitPreparation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitPreparation.cpp; path = dfg/DFGOSRExitPreparation.cpp; sourceTree = "<group>"; };
+		0F235BEA17178E7300690C7F /* DFGOSRExitPreparation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitPreparation.h; path = dfg/DFGOSRExitPreparation.h; sourceTree = "<group>"; };
+		0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakReferenceHarvester.h; sourceTree = "<group>"; };
+		0F24E53B17EA9F5900ABB217 /* AssemblyHelpers.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AssemblyHelpers.cpp; sourceTree = "<group>"; };
+		0F24E53C17EA9F5900ABB217 /* AssemblyHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AssemblyHelpers.h; sourceTree = "<group>"; };
+		0F24E53D17EA9F5900ABB217 /* CCallHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CCallHelpers.h; sourceTree = "<group>"; };
+		0F24E53E17EA9F5900ABB217 /* FPRInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FPRInfo.h; sourceTree = "<group>"; };
+		0F24E53F17EA9F5900ABB217 /* GPRInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GPRInfo.h; sourceTree = "<group>"; };
+		0F24E54517EE274900ABB217 /* JITOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITOperations.cpp; sourceTree = "<group>"; };
+		0F24E54617EE274900ABB217 /* JITOperations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITOperations.h; sourceTree = "<group>"; };
+		0F24E54817EE274900ABB217 /* TempRegisterSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TempRegisterSet.h; sourceTree = "<group>"; };
+		0F24E54917EE274900ABB217 /* Repatch.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Repatch.cpp; sourceTree = "<group>"; };
+		0F24E54A17EE274900ABB217 /* Repatch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Repatch.h; sourceTree = "<group>"; };
+		0F24E54B17EE274900ABB217 /* ScratchRegisterAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScratchRegisterAllocator.h; sourceTree = "<group>"; };
+		0F24E55317F0B71C00ABB217 /* InlineCallFrameSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InlineCallFrameSet.cpp; sourceTree = "<group>"; };
+		0F24E55417F0B71C00ABB217 /* InlineCallFrameSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InlineCallFrameSet.h; sourceTree = "<group>"; };
+		0F24E55717F74EDB00ABB217 /* ValueRecovery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ValueRecovery.cpp; sourceTree = "<group>"; };
+		0F256C341627B0AA007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCallArrayAllocatorSlowPathGenerator.h; path = dfg/DFGCallArrayAllocatorSlowPathGenerator.h; sourceTree = "<group>"; };
+		0F25F1AA181635F300522F39 /* FTLSlowPathCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLSlowPathCall.cpp; path = ftl/FTLSlowPathCall.cpp; sourceTree = "<group>"; };
+		0F25F1AB181635F300522F39 /* FTLSlowPathCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLSlowPathCall.h; path = ftl/FTLSlowPathCall.h; sourceTree = "<group>"; };
+		0F25F1AC181635F300522F39 /* FTLSlowPathCallKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLSlowPathCallKey.cpp; path = ftl/FTLSlowPathCallKey.cpp; sourceTree = "<group>"; };
+		0F25F1AD181635F300522F39 /* FTLSlowPathCallKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLSlowPathCallKey.h; path = ftl/FTLSlowPathCallKey.h; sourceTree = "<group>"; };
+		0F2B66A817B6B53D00A7AE3F /* GCIncomingRefCounted.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GCIncomingRefCounted.h; sourceTree = "<group>"; };
+		0F2B66A917B6B53D00A7AE3F /* GCIncomingRefCountedInlines.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GCIncomingRefCountedInlines.h; sourceTree = "<group>"; };
+		0F2B66AA17B6B53D00A7AE3F /* GCIncomingRefCountedSet.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GCIncomingRefCountedSet.h; sourceTree = "<group>"; };
+		0F2B66AB17B6B53D00A7AE3F /* GCIncomingRefCountedSetInlines.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GCIncomingRefCountedSetInlines.h; sourceTree = "<group>"; };
+		0F2B66B017B6B5AB00A7AE3F /* DataView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DataView.cpp; sourceTree = "<group>"; };
+		0F2B66B117B6B5AB00A7AE3F /* DataView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataView.h; sourceTree = "<group>"; };
+		0F2B66B217B6B5AB00A7AE3F /* GenericTypedArrayView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GenericTypedArrayView.h; sourceTree = "<group>"; };
+		0F2B66B317B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GenericTypedArrayViewInlines.h; sourceTree = "<group>"; };
+		0F2B66B417B6B5AB00A7AE3F /* JSArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArrayBuffer.cpp; sourceTree = "<group>"; };
+		0F2B66B517B6B5AB00A7AE3F /* JSArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBuffer.h; sourceTree = "<group>"; };
+		0F2B66B617B6B5AB00A7AE3F /* JSArrayBufferConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArrayBufferConstructor.cpp; sourceTree = "<group>"; };
+		0F2B66B717B6B5AB00A7AE3F /* JSArrayBufferConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferConstructor.h; sourceTree = "<group>"; };
+		0F2B66B817B6B5AB00A7AE3F /* JSArrayBufferPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArrayBufferPrototype.cpp; sourceTree = "<group>"; };
+		0F2B66B917B6B5AB00A7AE3F /* JSArrayBufferPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferPrototype.h; sourceTree = "<group>"; };
+		0F2B66BA17B6B5AB00A7AE3F /* JSArrayBufferView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArrayBufferView.cpp; sourceTree = "<group>"; };
+		0F2B66BB17B6B5AB00A7AE3F /* JSArrayBufferView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferView.h; sourceTree = "<group>"; };
+		0F2B66BC17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferViewInlines.h; sourceTree = "<group>"; };
+		0F2B66BD17B6B5AB00A7AE3F /* JSDataView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDataView.cpp; sourceTree = "<group>"; };
+		0F2B66BE17B6B5AB00A7AE3F /* JSDataView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDataView.h; sourceTree = "<group>"; };
+		0F2B66BF17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDataViewPrototype.cpp; sourceTree = "<group>"; };
+		0F2B66C017B6B5AB00A7AE3F /* JSDataViewPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDataViewPrototype.h; sourceTree = "<group>"; };
+		0F2B66C117B6B5AB00A7AE3F /* JSFloat32Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFloat32Array.h; sourceTree = "<group>"; };
+		0F2B66C217B6B5AB00A7AE3F /* JSFloat64Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFloat64Array.h; sourceTree = "<group>"; };
+		0F2B66C317B6B5AB00A7AE3F /* JSGenericTypedArrayView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayView.h; sourceTree = "<group>"; };
+		0F2B66C417B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayViewConstructor.h; sourceTree = "<group>"; };
+		0F2B66C517B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructorInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayViewConstructorInlines.h; sourceTree = "<group>"; };
+		0F2B66C617B6B5AB00A7AE3F /* JSGenericTypedArrayViewInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayViewInlines.h; sourceTree = "<group>"; };
+		0F2B66C717B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayViewPrototype.h; sourceTree = "<group>"; };
+		0F2B66C817B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayViewPrototypeInlines.h; sourceTree = "<group>"; };
+		0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInt8Array.h; sourceTree = "<group>"; };
+		0F2B66CA17B6B5AB00A7AE3F /* JSInt16Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInt16Array.h; sourceTree = "<group>"; };
+		0F2B66CB17B6B5AB00A7AE3F /* JSInt32Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInt32Array.h; sourceTree = "<group>"; };
+		0F2B66CC17B6B5AB00A7AE3F /* JSTypedArrayConstructors.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArrayConstructors.cpp; sourceTree = "<group>"; };
+		0F2B66CD17B6B5AB00A7AE3F /* JSTypedArrayConstructors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrayConstructors.h; sourceTree = "<group>"; };
+		0F2B66CE17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArrayPrototypes.cpp; sourceTree = "<group>"; };
+		0F2B66CF17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrayPrototypes.h; sourceTree = "<group>"; };
+		0F2B66D017B6B5AB00A7AE3F /* JSTypedArrays.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArrays.cpp; sourceTree = "<group>"; };
+		0F2B66D117B6B5AB00A7AE3F /* JSTypedArrays.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrays.h; sourceTree = "<group>"; };
+		0F2B66D217B6B5AB00A7AE3F /* JSUint8Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSUint8Array.h; sourceTree = "<group>"; };
+		0F2B66D317B6B5AB00A7AE3F /* JSUint8ClampedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSUint8ClampedArray.h; sourceTree = "<group>"; };
+		0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSUint16Array.h; sourceTree = "<group>"; };
+		0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSUint32Array.h; sourceTree = "<group>"; };
+		0F2B66D617B6B5AB00A7AE3F /* SimpleTypedArrayController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SimpleTypedArrayController.cpp; sourceTree = "<group>"; };
+		0F2B66D717B6B5AB00A7AE3F /* SimpleTypedArrayController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SimpleTypedArrayController.h; sourceTree = "<group>"; };
+		0F2B66D817B6B5AB00A7AE3F /* TypedArrayAdaptors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrayAdaptors.h; sourceTree = "<group>"; };
+		0F2B66D917B6B5AB00A7AE3F /* TypedArrayController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypedArrayController.cpp; sourceTree = "<group>"; };
+		0F2B66DA17B6B5AB00A7AE3F /* TypedArrayController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrayController.h; sourceTree = "<group>"; };
+		0F2B66DB17B6B5AB00A7AE3F /* TypedArrays.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrays.h; sourceTree = "<group>"; };
+		0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypedArrayType.cpp; sourceTree = "<group>"; };
+		0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrayType.h; sourceTree = "<group>"; };
+		0F2B9CD619D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAvailabilityMap.cpp; path = dfg/DFGAvailabilityMap.cpp; sourceTree = "<group>"; };
+		0F2B9CD719D0BA7D00B1D1B5 /* DFGAvailabilityMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAvailabilityMap.h; path = dfg/DFGAvailabilityMap.h; sourceTree = "<group>"; };
+		0F2B9CDA19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGObjectAllocationSinkingPhase.cpp; path = dfg/DFGObjectAllocationSinkingPhase.cpp; sourceTree = "<group>"; };
+		0F2B9CDB19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGObjectAllocationSinkingPhase.h; path = dfg/DFGObjectAllocationSinkingPhase.h; sourceTree = "<group>"; };
+		0F2B9CDC19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGObjectMaterializationData.cpp; path = dfg/DFGObjectMaterializationData.cpp; sourceTree = "<group>"; };
+		0F2B9CDD19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGObjectMaterializationData.h; path = dfg/DFGObjectMaterializationData.h; sourceTree = "<group>"; };
+		0F2B9CDE19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPhiChildren.cpp; path = dfg/DFGPhiChildren.cpp; sourceTree = "<group>"; };
+		0F2B9CDF19D0BA7D00B1D1B5 /* DFGPhiChildren.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPhiChildren.h; path = dfg/DFGPhiChildren.h; sourceTree = "<group>"; };
+		0F2B9CE019D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPromotedHeapLocation.cpp; path = dfg/DFGPromotedHeapLocation.cpp; sourceTree = "<group>"; };
+		0F2B9CE119D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPromotedHeapLocation.h; path = dfg/DFGPromotedHeapLocation.h; sourceTree = "<group>"; };
+		0F2B9CEE19D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitPropertyValue.cpp; path = ftl/FTLExitPropertyValue.cpp; sourceTree = "<group>"; };
+		0F2B9CEF19D0BAC100B1D1B5 /* FTLExitPropertyValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitPropertyValue.h; path = ftl/FTLExitPropertyValue.h; sourceTree = "<group>"; };
+		0F2B9CF019D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExitTimeObjectMaterialization.cpp; path = ftl/FTLExitTimeObjectMaterialization.cpp; sourceTree = "<group>"; };
+		0F2B9CF119D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExitTimeObjectMaterialization.h; path = ftl/FTLExitTimeObjectMaterialization.h; sourceTree = "<group>"; };
+		0F2B9CF219D0BAC100B1D1B5 /* FTLOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOperations.cpp; path = ftl/FTLOperations.cpp; sourceTree = "<group>"; };
+		0F2B9CF319D0BAC100B1D1B5 /* FTLOperations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOperations.h; path = ftl/FTLOperations.h; sourceTree = "<group>"; };
+		0F2BBD911C5FF3F50023EF23 /* B3SparseCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SparseCollection.h; path = b3/B3SparseCollection.h; sourceTree = "<group>"; };
+		0F2BBD921C5FF3F50023EF23 /* B3Variable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Variable.cpp; path = b3/B3Variable.cpp; sourceTree = "<group>"; };
+		0F2BBD931C5FF3F50023EF23 /* B3Variable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Variable.h; path = b3/B3Variable.h; sourceTree = "<group>"; };
+		0F2BBD941C5FF3F50023EF23 /* B3VariableValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3VariableValue.cpp; path = b3/B3VariableValue.cpp; sourceTree = "<group>"; };
+		0F2BBD951C5FF3F50023EF23 /* B3VariableValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3VariableValue.h; path = b3/B3VariableValue.h; sourceTree = "<group>"; };
+		0F2BBD9B1C5FF4050023EF23 /* AirStackSlotKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirStackSlotKind.cpp; path = b3/air/AirStackSlotKind.cpp; sourceTree = "<group>"; };
+		0F2BBD9C1C5FF4050023EF23 /* AirStackSlotKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirStackSlotKind.h; path = b3/air/AirStackSlotKind.h; sourceTree = "<group>"; };
+		0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFixupPhase.cpp; path = dfg/DFGFixupPhase.cpp; sourceTree = "<group>"; };
+		0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFixupPhase.h; path = dfg/DFGFixupPhase.h; sourceTree = "<group>"; };
+		0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInsertionSet.h; path = dfg/DFGInsertionSet.h; sourceTree = "<group>"; };
+		0F2BDC2B151FDE8B00CD8910 /* Operands.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Operands.h; sourceTree = "<group>"; };
+		0F2BDC3D1522801700CD8910 /* DFGMinifiedGraph.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMinifiedGraph.h; path = dfg/DFGMinifiedGraph.h; sourceTree = "<group>"; };
+		0F2BDC3E1522801700CD8910 /* DFGMinifiedNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMinifiedNode.h; path = dfg/DFGMinifiedNode.h; sourceTree = "<group>"; };
+		0F2BDC401522801700CD8910 /* DFGValueSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGValueSource.h; path = dfg/DFGValueSource.h; sourceTree = "<group>"; };
+		0F2BDC411522801700CD8910 /* DFGVariableEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableEvent.h; path = dfg/DFGVariableEvent.h; sourceTree = "<group>"; };
+		0F2BDC421522801700CD8910 /* DFGVariableEventStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEventStream.cpp; path = dfg/DFGVariableEventStream.cpp; sourceTree = "<group>"; };
+		0F2BDC431522801700CD8910 /* DFGVariableEventStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableEventStream.h; path = dfg/DFGVariableEventStream.h; sourceTree = "<group>"; };
+		0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMinifiedNode.cpp; path = dfg/DFGMinifiedNode.cpp; sourceTree = "<group>"; };
+		0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValueSource.cpp; path = dfg/DFGValueSource.cpp; sourceTree = "<group>"; };
+		0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEvent.cpp; path = dfg/DFGVariableEvent.cpp; sourceTree = "<group>"; };
+		0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerScope.cpp; sourceTree = "<group>"; };
+		0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerScope.h; sourceTree = "<group>"; };
+		0F2D4DDF19832D91007D4B19 /* TypeProfilerLog.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeProfilerLog.cpp; sourceTree = "<group>"; };
+		0F2D4DE019832D91007D4B19 /* TypeProfilerLog.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeProfilerLog.h; sourceTree = "<group>"; };
+		0F2D4DE319832D91007D4B19 /* TypeSet.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeSet.cpp; sourceTree = "<group>"; };
+		0F2D4DE419832D91007D4B19 /* TypeSet.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeSet.h; sourceTree = "<group>"; };
+		0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ToThisStatus.cpp; sourceTree = "<group>"; };
+		0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ToThisStatus.h; sourceTree = "<group>"; };
+		0F2D4DE719832DAC007D4B19 /* TypeLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeLocation.h; sourceTree = "<group>"; };
+		0F2DD80A1AB3D85800BBB8E8 /* BytecodeKills.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeKills.h; sourceTree = "<group>"; };
+		0F2DD80C1AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGArgumentsEliminationPhase.cpp; path = dfg/DFGArgumentsEliminationPhase.cpp; sourceTree = "<group>"; };
+		0F2DD80D1AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArgumentsEliminationPhase.h; path = dfg/DFGArgumentsEliminationPhase.h; sourceTree = "<group>"; };
+		0F2DD80E1AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGArgumentsUtilities.cpp; path = dfg/DFGArgumentsUtilities.cpp; sourceTree = "<group>"; };
+		0F2DD80F1AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArgumentsUtilities.h; path = dfg/DFGArgumentsUtilities.h; sourceTree = "<group>"; };
+		0F2DD8101AB3D8BE00BBB8E8 /* DFGForAllKills.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGForAllKills.h; path = dfg/DFGForAllKills.h; sourceTree = "<group>"; };
+		0F2EBBAA1DEDF94E00990369 /* DirectEvalCodeCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DirectEvalCodeCache.cpp; sourceTree = "<group>"; };
+		0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDCEPhase.cpp; path = dfg/DFGDCEPhase.cpp; sourceTree = "<group>"; };
+		0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDCEPhase.h; path = dfg/DFGDCEPhase.h; sourceTree = "<group>"; };
+		0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraphSafepoint.cpp; path = dfg/DFGGraphSafepoint.cpp; sourceTree = "<group>"; };
+		0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGraphSafepoint.h; path = dfg/DFGGraphSafepoint.h; sourceTree = "<group>"; };
+		0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSafepoint.cpp; path = dfg/DFGSafepoint.cpp; sourceTree = "<group>"; };
+		0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSafepoint.h; path = dfg/DFGSafepoint.h; sourceTree = "<group>"; };
+		0F2FCCF618A60070001A27F8 /* DFGScannable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGScannable.h; path = dfg/DFGScannable.h; sourceTree = "<group>"; };
+		0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGThreadData.cpp; path = dfg/DFGThreadData.cpp; sourceTree = "<group>"; };
+		0F2FCCF818A60070001A27F8 /* DFGThreadData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGThreadData.h; path = dfg/DFGThreadData.h; sourceTree = "<group>"; };
+		0F300B7718AB051100A6D72E /* DFGNodeOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeOrigin.h; path = dfg/DFGNodeOrigin.h; sourceTree = "<group>"; };
+		0F300B7918AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGIntegerCheckCombiningPhase.cpp; path = dfg/DFGIntegerCheckCombiningPhase.cpp; sourceTree = "<group>"; };
+		0F300B7A18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGIntegerCheckCombiningPhase.h; path = dfg/DFGIntegerCheckCombiningPhase.h; sourceTree = "<group>"; };
+		0F30D7BF1D95D62F0053089D /* CPU.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CPU.h; sourceTree = "<group>"; };
+		0F30FB601DC2DE96003124F2 /* ArrayBufferSharingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayBufferSharingMode.h; sourceTree = "<group>"; };
+		0F32BD0E1BB34F190093A57F /* HeapHelperPool.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapHelperPool.cpp; sourceTree = "<group>"; };
+		0F32BD0F1BB34F190093A57F /* HeapHelperPool.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapHelperPool.h; sourceTree = "<group>"; };
+		0F338DEF1BE93AD10013C88F /* B3StackmapValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3StackmapValue.cpp; path = b3/B3StackmapValue.cpp; sourceTree = "<group>"; };
+		0F338DF01BE93AD10013C88F /* B3StackmapValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3StackmapValue.h; path = b3/B3StackmapValue.h; sourceTree = "<group>"; };
+		0F338DF31BE93D550013C88F /* B3ConstrainedValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ConstrainedValue.cpp; path = b3/B3ConstrainedValue.cpp; sourceTree = "<group>"; };
+		0F338DF41BE93D550013C88F /* B3ConstrainedValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ConstrainedValue.h; path = b3/B3ConstrainedValue.h; sourceTree = "<group>"; };
+		0F338DF71BE96AA80013C88F /* B3CCallValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3CCallValue.cpp; path = b3/B3CCallValue.cpp; sourceTree = "<group>"; };
+		0F338DF81BE96AA80013C88F /* B3CCallValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3CCallValue.h; path = b3/B3CCallValue.h; sourceTree = "<group>"; };
+		0F338DFB1BED51270013C88F /* AirSimplifyCFG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirSimplifyCFG.cpp; path = b3/air/AirSimplifyCFG.cpp; sourceTree = "<group>"; };
+		0F338DFC1BED51270013C88F /* AirSimplifyCFG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirSimplifyCFG.h; path = b3/air/AirSimplifyCFG.h; sourceTree = "<group>"; };
+		0F338DFF1BF0276C0013C88F /* B3Compilation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Compilation.cpp; path = b3/B3Compilation.cpp; sourceTree = "<group>"; };
+		0F338E001BF0276C0013C88F /* B3Compilation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Compilation.h; path = b3/B3Compilation.h; sourceTree = "<group>"; };
+		0F338E011BF0276C0013C88F /* B3DataSection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3DataSection.cpp; path = b3/B3DataSection.cpp; sourceTree = "<group>"; };
+		0F338E021BF0276C0013C88F /* B3DataSection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3DataSection.h; path = b3/B3DataSection.h; sourceTree = "<group>"; };
+		0F338E031BF0276C0013C88F /* B3MoveConstants.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3MoveConstants.cpp; path = b3/B3MoveConstants.cpp; sourceTree = "<group>"; };
+		0F338E041BF0276C0013C88F /* B3MoveConstants.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3MoveConstants.h; path = b3/B3MoveConstants.h; sourceTree = "<group>"; };
+		0F338E051BF0276C0013C88F /* B3OpaqueByproduct.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3OpaqueByproduct.h; path = b3/B3OpaqueByproduct.h; sourceTree = "<group>"; };
+		0F338E061BF0276C0013C88F /* B3OpaqueByproducts.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3OpaqueByproducts.cpp; path = b3/B3OpaqueByproducts.cpp; sourceTree = "<group>"; };
+		0F338E071BF0276C0013C88F /* B3OpaqueByproducts.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3OpaqueByproducts.h; path = b3/B3OpaqueByproducts.h; sourceTree = "<group>"; };
+		0F338E081BF0276C0013C88F /* B3ValueKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ValueKey.cpp; path = b3/B3ValueKey.cpp; sourceTree = "<group>"; };
+		0F338E091BF0276C0013C88F /* B3ValueKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ValueKey.h; path = b3/B3ValueKey.h; sourceTree = "<group>"; };
+		0F338E0A1BF0276C0013C88F /* B3ValueKeyInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ValueKeyInlines.h; path = b3/B3ValueKeyInlines.h; sourceTree = "<group>"; };
+		0F338E171BF286EA0013C88F /* B3BlockInsertionSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3BlockInsertionSet.cpp; path = b3/B3BlockInsertionSet.cpp; sourceTree = "<group>"; };
+		0F338E181BF286EA0013C88F /* B3BlockInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3BlockInsertionSet.h; path = b3/B3BlockInsertionSet.h; sourceTree = "<group>"; };
+		0F338E191BF286EA0013C88F /* B3LowerMacros.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3LowerMacros.cpp; path = b3/B3LowerMacros.cpp; sourceTree = "<group>"; };
+		0F338E1A1BF286EA0013C88F /* B3LowerMacros.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3LowerMacros.h; path = b3/B3LowerMacros.h; sourceTree = "<group>"; };
+		0F33FCF51C136E2500323F67 /* B3StackmapGenerationParams.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3StackmapGenerationParams.cpp; path = b3/B3StackmapGenerationParams.cpp; sourceTree = "<group>"; };
+		0F33FCF61C136E2500323F67 /* B3StackmapGenerationParams.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3StackmapGenerationParams.h; path = b3/B3StackmapGenerationParams.h; sourceTree = "<group>"; };
+		0F33FCF91C1625BE00323F67 /* B3CFG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3CFG.h; path = b3/B3CFG.h; sourceTree = "<group>"; };
+		0F33FCFA1C1625BE00323F67 /* B3Dominators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Dominators.h; path = b3/B3Dominators.h; sourceTree = "<group>"; };
+		0F34B14716D4200E001CDA5A /* DFGUseKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGUseKind.cpp; path = dfg/DFGUseKind.cpp; sourceTree = "<group>"; };
+		0F34B14816D4200E001CDA5A /* DFGUseKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGUseKind.h; path = dfg/DFGUseKind.h; sourceTree = "<group>"; };
+		0F37308A1C0BD29100052BFA /* B3PhiChildren.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3PhiChildren.cpp; path = b3/B3PhiChildren.cpp; sourceTree = "<group>"; };
+		0F37308B1C0BD29100052BFA /* B3PhiChildren.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PhiChildren.h; path = b3/B3PhiChildren.h; sourceTree = "<group>"; };
+		0F37308E1C0CD68500052BFA /* DisallowMacroScratchRegisterUsage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DisallowMacroScratchRegisterUsage.h; sourceTree = "<group>"; };
+		0F3730901C0CD70C00052BFA /* AllowMacroScratchRegisterUsage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AllowMacroScratchRegisterUsage.h; sourceTree = "<group>"; };
+		0F3730921C0D67EE00052BFA /* AirUseCounts.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirUseCounts.h; path = b3/air/AirUseCounts.h; sourceTree = "<group>"; };
+		0F38B00F17CF077F00B144D3 /* LLIntEntrypoint.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntEntrypoint.cpp; path = llint/LLIntEntrypoint.cpp; sourceTree = "<group>"; };
+		0F38B01017CF077F00B144D3 /* LLIntEntrypoint.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = LLIntEntrypoint.h; path = llint/LLIntEntrypoint.h; sourceTree = "<group>"; };
+		0F38B01317CFE75500B144D3 /* DFGCompilationKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCompilationKey.cpp; path = dfg/DFGCompilationKey.cpp; sourceTree = "<group>"; };
+		0F38B01417CFE75500B144D3 /* DFGCompilationKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCompilationKey.h; path = dfg/DFGCompilationKey.h; sourceTree = "<group>"; };
+		0F38B01517CFE75500B144D3 /* DFGCompilationMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCompilationMode.cpp; path = dfg/DFGCompilationMode.cpp; sourceTree = "<group>"; };
+		0F38B01617CFE75500B144D3 /* DFGCompilationMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCompilationMode.h; path = dfg/DFGCompilationMode.h; sourceTree = "<group>"; };
+		0F38D2A01D44196600680499 /* AuxiliaryBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AuxiliaryBarrier.h; sourceTree = "<group>"; };
+		0F38D2A11D44196600680499 /* AuxiliaryBarrierInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AuxiliaryBarrierInlines.h; sourceTree = "<group>"; };
+		0F392C871B46188400844728 /* DFGOSRExitFuzz.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitFuzz.cpp; path = dfg/DFGOSRExitFuzz.cpp; sourceTree = "<group>"; };
+		0F392C881B46188400844728 /* DFGOSRExitFuzz.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitFuzz.h; path = dfg/DFGOSRExitFuzz.h; sourceTree = "<group>"; };
+		0F3A1BF71A9ECB7D000DE01A /* DFGPutStackSinkingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPutStackSinkingPhase.cpp; path = dfg/DFGPutStackSinkingPhase.cpp; sourceTree = "<group>"; };
+		0F3A1BF81A9ECB7D000DE01A /* DFGPutStackSinkingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPutStackSinkingPhase.h; path = dfg/DFGPutStackSinkingPhase.h; sourceTree = "<group>"; };
+		0F3AC751183EA1040032029F /* StackAlignment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StackAlignment.h; sourceTree = "<group>"; };
+		0F3AC753188E5EC80032029F /* ExitingJITType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExitingJITType.h; sourceTree = "<group>"; };
+		0F3B3A17153E68EF003ED0FF /* DFGConstantFoldingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGConstantFoldingPhase.cpp; path = dfg/DFGConstantFoldingPhase.cpp; sourceTree = "<group>"; };
+		0F3B3A18153E68EF003ED0FF /* DFGConstantFoldingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGConstantFoldingPhase.h; path = dfg/DFGConstantFoldingPhase.h; sourceTree = "<group>"; };
+		0F3B3A241544C991003ED0FF /* DFGCFGSimplificationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCFGSimplificationPhase.cpp; path = dfg/DFGCFGSimplificationPhase.cpp; sourceTree = "<group>"; };
+		0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFGSimplificationPhase.h; path = dfg/DFGCFGSimplificationPhase.h; sourceTree = "<group>"; };
+		0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValidate.cpp; path = dfg/DFGValidate.cpp; sourceTree = "<group>"; };
+		0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGValidate.h; path = dfg/DFGValidate.h; sourceTree = "<group>"; };
+		0F3B7E2419A11B8000D9BC56 /* CallVariant.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallVariant.cpp; sourceTree = "<group>"; };
+		0F3B7E2519A11B8000D9BC56 /* CallVariant.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallVariant.h; sourceTree = "<group>"; };
+		0F3BD1B61B896A0700598AA6 /* DFGInsertionSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGInsertionSet.cpp; path = dfg/DFGInsertionSet.cpp; sourceTree = "<group>"; };
+		0F3C1F181B868E7900ABB08B /* DFGClobbersExitState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGClobbersExitState.cpp; path = dfg/DFGClobbersExitState.cpp; sourceTree = "<group>"; };
+		0F3C1F191B868E7900ABB08B /* DFGClobbersExitState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGClobbersExitState.h; path = dfg/DFGClobbersExitState.h; sourceTree = "<group>"; };
+		0F3E01A819D353A500F61B7F /* DFGPrePostNumbering.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPrePostNumbering.cpp; path = dfg/DFGPrePostNumbering.cpp; sourceTree = "<group>"; };
+		0F3E01A919D353A500F61B7F /* DFGPrePostNumbering.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPrePostNumbering.h; path = dfg/DFGPrePostNumbering.h; sourceTree = "<group>"; };
+		0F426A451460CBAB00131F8F /* ValueRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueRecovery.h; sourceTree = "<group>"; };
+		0F426A461460CBAB00131F8F /* VirtualRegister.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VirtualRegister.h; sourceTree = "<group>"; };
+		0F426A4A1460CD6B00131F8F /* DataFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataFormat.h; sourceTree = "<group>"; };
+		0F431736146BAC65007E3890 /* ListableHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ListableHandler.h; sourceTree = "<group>"; };
+		0F4570361BE44C910062A629 /* AirEliminateDeadCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirEliminateDeadCode.cpp; path = b3/air/AirEliminateDeadCode.cpp; sourceTree = "<group>"; };
+		0F4570371BE44C910062A629 /* AirEliminateDeadCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirEliminateDeadCode.h; path = b3/air/AirEliminateDeadCode.h; sourceTree = "<group>"; };
+		0F45703A1BE45F0A0062A629 /* AirReportUsedRegisters.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirReportUsedRegisters.cpp; path = b3/air/AirReportUsedRegisters.cpp; sourceTree = "<group>"; };
+		0F45703B1BE45F0A0062A629 /* AirReportUsedRegisters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirReportUsedRegisters.h; path = b3/air/AirReportUsedRegisters.h; sourceTree = "<group>"; };
+		0F45703E1BE584CA0062A629 /* B3TimingScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3TimingScope.cpp; path = b3/B3TimingScope.cpp; sourceTree = "<group>"; };
+		0F45703F1BE584CA0062A629 /* B3TimingScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3TimingScope.h; path = b3/B3TimingScope.h; sourceTree = "<group>"; };
+		0F46807F14BA572700BFE272 /* JITExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITExceptions.cpp; sourceTree = "<group>"; };
+		0F46808014BA572700BFE272 /* JITExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITExceptions.h; sourceTree = "<group>"; };
+		0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntExceptions.cpp; path = llint/LLIntExceptions.cpp; sourceTree = "<group>"; };
+		0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntExceptions.h; path = llint/LLIntExceptions.h; sourceTree = "<group>"; };
+		0F46809F14BA7F8200BFE272 /* LLIntSlowPaths.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntSlowPaths.cpp; path = llint/LLIntSlowPaths.cpp; sourceTree = "<group>"; };
+		0F4680A014BA7F8200BFE272 /* LLIntSlowPaths.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntSlowPaths.h; path = llint/LLIntSlowPaths.h; sourceTree = "<group>"; };
+		0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntOffsetsExtractor.cpp; path = llint/LLIntOffsetsExtractor.cpp; sourceTree = "<group>"; };
+		0F4680C514BBB16900BFE272 /* LLIntCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntCommon.h; path = llint/LLIntCommon.h; sourceTree = "<group>"; };
+		0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntOfflineAsmConfig.h; path = llint/LLIntOfflineAsmConfig.h; sourceTree = "<group>"; };
+		0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LowLevelInterpreter.cpp; path = llint/LowLevelInterpreter.cpp; sourceTree = "<group>"; };
+		0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LowLevelInterpreter.h; path = llint/LowLevelInterpreter.h; sourceTree = "<group>"; };
+		0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntData.cpp; path = llint/LLIntData.cpp; sourceTree = "<group>"; };
+		0F4680CF14BBB3D100BFE272 /* LLIntData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntData.h; path = llint/LLIntData.h; sourceTree = "<group>"; };
+		0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HostCallReturnValue.cpp; sourceTree = "<group>"; };
+		0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HostCallReturnValue.h; sourceTree = "<group>"; };
+		0F48531F187750560083B687 /* DFGArithMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGArithMode.cpp; path = dfg/DFGArithMode.cpp; sourceTree = "<group>"; };
+		0F485320187750560083B687 /* DFGArithMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArithMode.h; path = dfg/DFGArithMode.h; sourceTree = "<group>"; };
+		0F485323187DFDEC0083B687 /* FTLAvailableRecovery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLAvailableRecovery.cpp; path = ftl/FTLAvailableRecovery.cpp; sourceTree = "<group>"; };
+		0F485324187DFDEC0083B687 /* FTLAvailableRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLAvailableRecovery.h; path = ftl/FTLAvailableRecovery.h; sourceTree = "<group>"; };
+		0F485325187DFDEC0083B687 /* FTLRecoveryOpcode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLRecoveryOpcode.cpp; path = ftl/FTLRecoveryOpcode.cpp; sourceTree = "<group>"; };
+		0F485326187DFDEC0083B687 /* FTLRecoveryOpcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLRecoveryOpcode.h; path = ftl/FTLRecoveryOpcode.h; sourceTree = "<group>"; };
+		0F493AF816D0CAD10084508B /* SourceProvider.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SourceProvider.cpp; sourceTree = "<group>"; };
+		0F4A38F71C8E13DF00190318 /* SuperSampler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SuperSampler.cpp; sourceTree = "<group>"; };
+		0F4A38F81C8E13DF00190318 /* SuperSampler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SuperSampler.h; sourceTree = "<group>"; };
+		0F4B94DB17B9F07500DD03A4 /* TypedArrayInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrayInlines.h; sourceTree = "<group>"; };
+		0F4C91651C29F4F2004341A6 /* B3OriginDump.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3OriginDump.h; path = b3/B3OriginDump.h; sourceTree = "<group>"; };
+		0F4DE1CC1C4C1B54004D6C11 /* AirFixObviousSpills.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirFixObviousSpills.cpp; path = b3/air/AirFixObviousSpills.cpp; sourceTree = "<group>"; };
+		0F4DE1CD1C4C1B54004D6C11 /* AirFixObviousSpills.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirFixObviousSpills.h; path = b3/air/AirFixObviousSpills.h; sourceTree = "<group>"; };
+		0F4DE1D01C4D764B004D6C11 /* B3OriginDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3OriginDump.cpp; path = b3/B3OriginDump.cpp; sourceTree = "<group>"; };
+		0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStaticExecutionCountEstimationPhase.cpp; path = dfg/DFGStaticExecutionCountEstimationPhase.cpp; sourceTree = "<group>"; };
+		0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStaticExecutionCountEstimationPhase.h; path = dfg/DFGStaticExecutionCountEstimationPhase.h; sourceTree = "<group>"; };
+		0F4F82891E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StochasticSpaceTimeMutatorScheduler.cpp; sourceTree = "<group>"; };
+		0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StochasticSpaceTimeMutatorScheduler.h; sourceTree = "<group>"; };
+		0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureClobberState.h; path = dfg/DFGStructureClobberState.h; sourceTree = "<group>"; };
+		0F5513A51D5A682A00C32BD8 /* FreeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FreeList.h; sourceTree = "<group>"; };
+		0F5513A71D5A68CB00C32BD8 /* FreeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FreeList.cpp; sourceTree = "<group>"; };
+		0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpecialPointer.cpp; sourceTree = "<group>"; };
+		0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpecialPointer.h; sourceTree = "<group>"; };
+		0F55989717C86C5600A1E543 /* ToNativeFromValue.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ToNativeFromValue.h; sourceTree = "<group>"; };
+		0F55C19317276E4600CEABFD /* DFGAbstractValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAbstractValue.cpp; path = dfg/DFGAbstractValue.cpp; sourceTree = "<group>"; };
+		0F55F0F114D1063600AC7649 /* AbstractPC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractPC.cpp; sourceTree = "<group>"; };
+		0F55F0F214D1063600AC7649 /* AbstractPC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractPC.h; sourceTree = "<group>"; };
+		0F56A1D115000F31002992B1 /* ExecutionCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutionCounter.h; sourceTree = "<group>"; };
+		0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutionCounter.cpp; sourceTree = "<group>"; };
+		0F572D4D16879FDB00E57FBD /* ThunkGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThunkGenerator.h; sourceTree = "<group>"; };
+		0F5780A118FE1E98001E72D9 /* PureNaN.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PureNaN.h; sourceTree = "<group>"; };
+		0F5874EB194FEB1200AAB2C1 /* DFGMayExit.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMayExit.cpp; path = dfg/DFGMayExit.cpp; sourceTree = "<group>"; };
+		0F5874EC194FEB1200AAB2C1 /* DFGMayExit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMayExit.h; path = dfg/DFGMayExit.h; sourceTree = "<group>"; };
+		0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDoesGC.cpp; path = dfg/DFGDoesGC.cpp; sourceTree = "<group>"; };
+		0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDoesGC.h; path = dfg/DFGDoesGC.h; sourceTree = "<group>"; };
+		0F5A6281188C98D40072C9DF /* FTLValueRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLValueRange.cpp; path = ftl/FTLValueRange.cpp; sourceTree = "<group>"; };
+		0F5A6282188C98D40072C9DF /* FTLValueRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLValueRange.h; path = ftl/FTLValueRange.h; sourceTree = "<group>"; };
+		0F5B4A321C84F0D600F1B17E /* SlowPathReturnType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SlowPathReturnType.h; sourceTree = "<group>"; };
+		0F5D085C1B8CF99D001143B4 /* DFGNodeOrigin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNodeOrigin.cpp; path = dfg/DFGNodeOrigin.cpp; sourceTree = "<group>"; };
+		0F5EF91B16878F78003E5C25 /* JITThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITThunks.cpp; sourceTree = "<group>"; };
+		0F5EF91C16878F78003E5C25 /* JITThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITThunks.h; sourceTree = "<group>"; };
+		0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnconditionalFinalizer.h; sourceTree = "<group>"; };
+		0F6183201C45BF070072450B /* AirCCallingConvention.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirCCallingConvention.cpp; path = b3/air/AirCCallingConvention.cpp; sourceTree = "<group>"; };
+		0F6183211C45BF070072450B /* AirCCallingConvention.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirCCallingConvention.h; path = b3/air/AirCCallingConvention.h; sourceTree = "<group>"; };
+		0F6183221C45BF070072450B /* AirCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirCustom.cpp; path = b3/air/AirCustom.cpp; sourceTree = "<group>"; };
+		0F6183231C45BF070072450B /* AirEmitShuffle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirEmitShuffle.cpp; path = b3/air/AirEmitShuffle.cpp; sourceTree = "<group>"; };
+		0F6183241C45BF070072450B /* AirEmitShuffle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirEmitShuffle.h; path = b3/air/AirEmitShuffle.h; sourceTree = "<group>"; };
+		0F6183251C45BF070072450B /* AirLowerAfterRegAlloc.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirLowerAfterRegAlloc.cpp; path = b3/air/AirLowerAfterRegAlloc.cpp; sourceTree = "<group>"; };
+		0F6183261C45BF070072450B /* AirLowerAfterRegAlloc.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirLowerAfterRegAlloc.h; path = b3/air/AirLowerAfterRegAlloc.h; sourceTree = "<group>"; };
+		0F6183271C45BF070072450B /* AirLowerMacros.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirLowerMacros.cpp; path = b3/air/AirLowerMacros.cpp; sourceTree = "<group>"; };
+		0F6183281C45BF070072450B /* AirLowerMacros.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirLowerMacros.h; path = b3/air/AirLowerMacros.h; sourceTree = "<group>"; };
+		0F6183321C45F35C0072450B /* AirOpcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AirOpcode.h; sourceTree = "<group>"; };
+		0F6183341C45F3B60072450B /* AirOpcodeGenerated.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AirOpcodeGenerated.h; sourceTree = "<group>"; };
+		0F6183351C45F3B60072450B /* AirOpcodeUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AirOpcodeUtils.h; sourceTree = "<group>"; };
+		0F6183431C45F62A0072450B /* testair */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = testair; sourceTree = BUILT_PRODUCTS_DIR; };
+		0F6183441C45F6600072450B /* testair.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = testair.cpp; path = b3/air/testair.cpp; sourceTree = "<group>"; };
+		0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAbstractValue.h; path = dfg/DFGAbstractValue.h; sourceTree = "<group>"; };
+		0F620170143FCD2F0068B77C /* DFGBasicBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBasicBlock.h; path = dfg/DFGBasicBlock.h; sourceTree = "<group>"; };
+		0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableAccessData.h; path = dfg/DFGVariableAccessData.h; sourceTree = "<group>"; };
+		0F6237951AE45CA700D402EA /* DFGPhantomInsertionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPhantomInsertionPhase.cpp; path = dfg/DFGPhantomInsertionPhase.cpp; sourceTree = "<group>"; };
+		0F6237961AE45CA700D402EA /* DFGPhantomInsertionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPhantomInsertionPhase.h; path = dfg/DFGPhantomInsertionPhase.h; sourceTree = "<group>"; };
+		0F63943C15C75F14006A597C /* DFGTypeCheckHoistingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGTypeCheckHoistingPhase.cpp; path = dfg/DFGTypeCheckHoistingPhase.cpp; sourceTree = "<group>"; };
+		0F63943D15C75F14006A597C /* DFGTypeCheckHoistingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGTypeCheckHoistingPhase.h; path = dfg/DFGTypeCheckHoistingPhase.h; sourceTree = "<group>"; };
+		0F63945115D07051006A597C /* ArrayProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayProfile.cpp; sourceTree = "<group>"; };
+		0F63945215D07051006A597C /* ArrayProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayProfile.h; sourceTree = "<group>"; };
+		0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureAbstractValue.h; path = dfg/DFGStructureAbstractValue.h; sourceTree = "<group>"; };
+		0F63948115E48114006A597C /* DFGArrayMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGArrayMode.cpp; path = dfg/DFGArrayMode.cpp; sourceTree = "<group>"; };
+		0F63948215E48114006A597C /* DFGArrayMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayMode.h; path = dfg/DFGArrayMode.h; sourceTree = "<group>"; };
+		0F64B26F1A784BAF006E4E66 /* BinarySwitch.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BinarySwitch.cpp; sourceTree = "<group>"; };
+		0F64B2701A784BAF006E4E66 /* BinarySwitch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BinarySwitch.h; sourceTree = "<group>"; };
+		0F64B2771A7957B2006E4E66 /* CallEdge.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallEdge.cpp; sourceTree = "<group>"; };
+		0F64B2781A7957B2006E4E66 /* CallEdge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallEdge.h; sourceTree = "<group>"; };
+		0F64EAF21C4ECD0600621E9B /* AirArgInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirArgInlines.h; path = b3/air/AirArgInlines.h; sourceTree = "<group>"; };
+		0F660E331E0517B70031462C /* MarkingConstraint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkingConstraint.cpp; sourceTree = "<group>"; };
+		0F660E341E0517B70031462C /* MarkingConstraint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkingConstraint.h; sourceTree = "<group>"; };
+		0F660E351E0517B70031462C /* MarkingConstraintSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkingConstraintSet.cpp; sourceTree = "<group>"; };
+		0F660E361E0517B80031462C /* MarkingConstraintSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkingConstraintSet.h; sourceTree = "<group>"; };
+		0F664CE71DA304ED00B00A11 /* CodeBlockSetInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeBlockSetInlines.h; sourceTree = "<group>"; };
+		0F666EBE183566F900D017F1 /* BytecodeLivenessAnalysisInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeLivenessAnalysisInlines.h; sourceTree = "<group>"; };
+		0F666EBF183566F900D017F1 /* FullBytecodeLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FullBytecodeLiveness.h; sourceTree = "<group>"; };
+		0F666EC21835672B00D017F1 /* DFGAvailability.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAvailability.cpp; path = dfg/DFGAvailability.cpp; sourceTree = "<group>"; };
+		0F666EC31835672B00D017F1 /* DFGAvailability.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAvailability.h; path = dfg/DFGAvailability.h; sourceTree = "<group>"; };
+		0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAdjacencyList.h; path = dfg/DFGAdjacencyList.h; sourceTree = "<group>"; };
+		0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEdge.h; path = dfg/DFGEdge.h; sourceTree = "<group>"; };
+		0F682FB019BCB36400FA3BAD /* DFGSSACalculator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSSACalculator.cpp; path = dfg/DFGSSACalculator.cpp; sourceTree = "<group>"; };
+		0F682FB119BCB36400FA3BAD /* DFGSSACalculator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSSACalculator.h; path = dfg/DFGSSACalculator.h; sourceTree = "<group>"; };
+		0F6971E81D92F42100BA02A5 /* B3FenceValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3FenceValue.cpp; path = b3/B3FenceValue.cpp; sourceTree = "<group>"; };
+		0F6971E91D92F42100BA02A5 /* B3FenceValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3FenceValue.h; path = b3/B3FenceValue.h; sourceTree = "<group>"; };
+		0F69CC86193AC60A0045759E /* DFGFrozenValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFrozenValue.cpp; path = dfg/DFGFrozenValue.cpp; sourceTree = "<group>"; };
+		0F69CC87193AC60A0045759E /* DFGFrozenValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFrozenValue.h; path = dfg/DFGFrozenValue.h; sourceTree = "<group>"; };
+		0F6B1CB71861244C00845D97 /* ArityCheckMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArityCheckMode.h; sourceTree = "<group>"; };
+		0F6B8AD61C4EDDA200969052 /* B3DuplicateTails.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3DuplicateTails.cpp; path = b3/B3DuplicateTails.cpp; sourceTree = "<group>"; };
+		0F6B8AD71C4EDDA200969052 /* B3DuplicateTails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3DuplicateTails.h; path = b3/B3DuplicateTails.h; sourceTree = "<group>"; };
+		0F6B8ADA1C4EFAC300969052 /* B3SSACalculator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3SSACalculator.cpp; path = b3/B3SSACalculator.cpp; sourceTree = "<group>"; };
+		0F6B8ADB1C4EFAC300969052 /* B3SSACalculator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SSACalculator.h; path = b3/B3SSACalculator.h; sourceTree = "<group>"; };
+		0F6B8ADE1C4EFE1700969052 /* B3BreakCriticalEdges.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3BreakCriticalEdges.cpp; path = b3/B3BreakCriticalEdges.cpp; sourceTree = "<group>"; };
+		0F6B8ADF1C4EFE1700969052 /* B3BreakCriticalEdges.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3BreakCriticalEdges.h; path = b3/B3BreakCriticalEdges.h; sourceTree = "<group>"; };
+		0F6B8AE01C4EFE1700969052 /* B3FixSSA.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3FixSSA.cpp; path = b3/B3FixSSA.cpp; sourceTree = "<group>"; };
+		0F6B8AE11C4EFE1700969052 /* B3FixSSA.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3FixSSA.h; path = b3/B3FixSSA.h; sourceTree = "<group>"; };
+		0F6C734E1AC9F99F00BE1682 /* VariableWriteFireDetail.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VariableWriteFireDetail.cpp; sourceTree = "<group>"; };
+		0F6C734F1AC9F99F00BE1682 /* VariableWriteFireDetail.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VariableWriteFireDetail.h; sourceTree = "<group>"; };
+		0F6DB7E71D6124B200CDBF8E /* StackFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StackFrame.cpp; sourceTree = "<group>"; };
+		0F6DB7E81D6124B200CDBF8E /* StackFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StackFrame.h; sourceTree = "<group>"; };
+		0F6DB7EB1D617D0F00CDBF8E /* MacroAssemblerCodeRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerCodeRef.cpp; sourceTree = "<group>"; };
+		0F6E845919030BEF00562741 /* DFGVariableAccessData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableAccessData.cpp; path = dfg/DFGVariableAccessData.cpp; sourceTree = "<group>"; };
+		0F6FC74E196110A800E1D02D /* ComplexGetStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ComplexGetStatus.cpp; sourceTree = "<group>"; };
+		0F6FC74F196110A800E1D02D /* ComplexGetStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ComplexGetStatus.h; sourceTree = "<group>"; };
+		0F7025A71714B0F800382C0E /* DFGOSRExitCompilerCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitCompilerCommon.cpp; path = dfg/DFGOSRExitCompilerCommon.cpp; sourceTree = "<group>"; };
+		0F7025A81714B0F800382C0E /* DFGOSRExitCompilerCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitCompilerCommon.h; path = dfg/DFGOSRExitCompilerCommon.h; sourceTree = "<group>"; };
+		0F714CA116EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBackwardsPropagationPhase.cpp; path = dfg/DFGBackwardsPropagationPhase.cpp; sourceTree = "<group>"; };
+		0F714CA216EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBackwardsPropagationPhase.h; path = dfg/DFGBackwardsPropagationPhase.h; sourceTree = "<group>"; };
+		0F725CA31C503DED00AD943A /* B3EliminateCommonSubexpressions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3EliminateCommonSubexpressions.cpp; path = b3/B3EliminateCommonSubexpressions.cpp; sourceTree = "<group>"; };
+		0F725CA41C503DED00AD943A /* B3EliminateCommonSubexpressions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3EliminateCommonSubexpressions.h; path = b3/B3EliminateCommonSubexpressions.h; sourceTree = "<group>"; };
+		0F725CA51C503DED00AD943A /* B3PureCSE.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3PureCSE.cpp; path = b3/B3PureCSE.cpp; sourceTree = "<group>"; };
+		0F725CA61C503DED00AD943A /* B3PureCSE.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PureCSE.h; path = b3/B3PureCSE.h; sourceTree = "<group>"; };
+		0F725CAD1C506D3B00AD943A /* B3FoldPathConstants.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3FoldPathConstants.cpp; path = b3/B3FoldPathConstants.cpp; sourceTree = "<group>"; };
+		0F725CAE1C506D3B00AD943A /* B3FoldPathConstants.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3FoldPathConstants.h; path = b3/B3FoldPathConstants.h; sourceTree = "<group>"; };
+		0F766D1C15A5028D008F363E /* JITStubRoutine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITStubRoutine.h; sourceTree = "<group>"; };
+		0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITStubRoutine.cpp; sourceTree = "<group>"; };
+		0F766D2915A8CC34008F363E /* JITStubRoutineSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITStubRoutineSet.cpp; sourceTree = "<group>"; };
+		0F766D2A15A8CC34008F363E /* JITStubRoutineSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITStubRoutineSet.h; sourceTree = "<group>"; };
+		0F766D2D15A8DCDD008F363E /* GCAwareJITStubRoutine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCAwareJITStubRoutine.cpp; sourceTree = "<group>"; };
+		0F766D2E15A8DCDD008F363E /* GCAwareJITStubRoutine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCAwareJITStubRoutine.h; sourceTree = "<group>"; };
+		0F766D3615AE4A1A008F363E /* StructureStubClearingWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureStubClearingWatchpoint.cpp; sourceTree = "<group>"; };
+		0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureStubClearingWatchpoint.h; sourceTree = "<group>"; };
+		0F77008E1402FDD60078EB39 /* SamplingCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SamplingCounter.h; sourceTree = "<group>"; };
+		0F7700911402FF280078EB39 /* SamplingCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingCounter.cpp; sourceTree = "<group>"; };
+		0F7C39FA1C8F629300480151 /* RegExpInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpInlines.h; sourceTree = "<group>"; };
+		0F7C39FC1C8F659500480151 /* RegExpObjectInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpObjectInlines.h; sourceTree = "<group>"; };
+		0F7C39FE1C90C55B00480151 /* DFGOpInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOpInfo.h; path = dfg/DFGOpInfo.h; sourceTree = "<group>"; };
+		0F7C5FB71D888A010044F5E2 /* MarkedBlockInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedBlockInlines.h; sourceTree = "<group>"; };
+		0F7CF94E1DBEEE860098CC12 /* ReleaseHeapAccessScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReleaseHeapAccessScope.h; sourceTree = "<group>"; };
+		0F7CF9501DC027D70098CC12 /* StopIfNecessaryTimer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StopIfNecessaryTimer.cpp; sourceTree = "<group>"; };
+		0F7CF9511DC027D70098CC12 /* StopIfNecessaryTimer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StopIfNecessaryTimer.h; sourceTree = "<group>"; };
+		0F7CF9541DC1258B0098CC12 /* AtomicsObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AtomicsObject.cpp; sourceTree = "<group>"; };
+		0F7CF9551DC1258B0098CC12 /* AtomicsObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AtomicsObject.h; sourceTree = "<group>"; };
+		0F7DF12F1E2970D50095951B /* ConstraintVolatility.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstraintVolatility.h; sourceTree = "<group>"; };
+		0F7DF1301E2970D50095951B /* MarkedSpaceInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedSpaceInlines.h; sourceTree = "<group>"; };
+		0F7DF1311E2970D50095951B /* Subspace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Subspace.cpp; sourceTree = "<group>"; };
+		0F7DF1321E2970D50095951B /* Subspace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Subspace.h; sourceTree = "<group>"; };
+		0F7DF1331E2970D50095951B /* SubspaceInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SubspaceInlines.h; sourceTree = "<group>"; };
+		0F7DF1391E29710E0095951B /* JSDestructibleObjectSubspace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDestructibleObjectSubspace.cpp; sourceTree = "<group>"; };
+		0F7DF13A1E29710E0095951B /* JSDestructibleObjectSubspace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDestructibleObjectSubspace.h; sourceTree = "<group>"; };
+		0F7DF13D1E2AFC4B0095951B /* JSStringSubspace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringSubspace.cpp; sourceTree = "<group>"; };
+		0F7DF13E1E2AFC4B0095951B /* JSStringSubspace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringSubspace.h; sourceTree = "<group>"; };
+		0F7DF1451E2BEF680095951B /* MarkedAllocatorInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedAllocatorInlines.h; sourceTree = "<group>"; };
+		0F7F98891D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStoreBarrierClusteringPhase.cpp; path = dfg/DFGStoreBarrierClusteringPhase.cpp; sourceTree = "<group>"; };
+		0F7F988A1D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStoreBarrierClusteringPhase.h; path = dfg/DFGStoreBarrierClusteringPhase.h; sourceTree = "<group>"; };
+		0F8023E91613832300A0BA45 /* ByValInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByValInfo.h; sourceTree = "<group>"; };
+		0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayAllocationProfile.cpp; sourceTree = "<group>"; };
+		0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; };
+		0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBranchDirection.h; path = dfg/DFGBranchDirection.h; sourceTree = "<group>"; };
+		0F86A26E1D6F7B3100CB0C92 /* GCTypeMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCTypeMap.h; sourceTree = "<group>"; };
+		0F86AE1F1C5311C5006BE8EC /* B3ComputeDivisionMagic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ComputeDivisionMagic.h; path = b3/B3ComputeDivisionMagic.h; sourceTree = "<group>"; };
+		0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeUseDef.h; sourceTree = "<group>"; };
+		0F893BDA1936E23C001211F4 /* DFGStructureAbstractValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStructureAbstractValue.cpp; path = dfg/DFGStructureAbstractValue.cpp; sourceTree = "<group>"; };
+		0F898F2F1B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGIntegerRangeOptimizationPhase.cpp; path = dfg/DFGIntegerRangeOptimizationPhase.cpp; sourceTree = "<group>"; };
+		0F898F301B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGIntegerRangeOptimizationPhase.h; path = dfg/DFGIntegerRangeOptimizationPhase.h; sourceTree = "<group>"; };
+		0F8F142F1ADF090100ED792C /* DFGEpoch.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGEpoch.cpp; path = dfg/DFGEpoch.cpp; sourceTree = "<group>"; };
+		0F8F14301ADF090100ED792C /* DFGEpoch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEpoch.h; path = dfg/DFGEpoch.h; sourceTree = "<group>"; };
+		0F8F14311ADF090100ED792C /* DFGMovHintRemovalPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMovHintRemovalPhase.cpp; path = dfg/DFGMovHintRemovalPhase.cpp; sourceTree = "<group>"; };
+		0F8F14321ADF090100ED792C /* DFGMovHintRemovalPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMovHintRemovalPhase.h; path = dfg/DFGMovHintRemovalPhase.h; sourceTree = "<group>"; };
+		0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLink.cpp; path = ftl/FTLLink.cpp; sourceTree = "<group>"; };
+		0F8F2B94172E049E007DBDA5 /* FTLLink.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = FTLLink.h; path = ftl/FTLLink.h; sourceTree = "<group>"; };
+		0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredIdentifiers.cpp; path = dfg/DFGDesiredIdentifiers.cpp; sourceTree = "<group>"; };
+		0F8F2B98172F04FD007DBDA5 /* DFGDesiredIdentifiers.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = DFGDesiredIdentifiers.h; path = dfg/DFGDesiredIdentifiers.h; sourceTree = "<group>"; };
+		0F8F2B9D17306C8B007DBDA5 /* UnlinkedSourceCode.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedSourceCode.cpp; sourceTree = "<group>"; };
+		0F8F943A1667631100D61971 /* CodeSpecializationKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeSpecializationKind.cpp; sourceTree = "<group>"; };
+		0F8F943D1667632D00D61971 /* CodeBlockHash.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeBlockHash.cpp; sourceTree = "<group>"; };
+		0F8F943E1667632D00D61971 /* CodeBlockHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeBlockHash.h; sourceTree = "<group>"; };
+		0F8F943F1667632D00D61971 /* CodeType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeType.cpp; sourceTree = "<group>"; };
+		0F8F94431667635200D61971 /* JITCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITCode.cpp; sourceTree = "<group>"; };
+		0F8F9445166764EE00D61971 /* CodeOrigin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeOrigin.cpp; sourceTree = "<group>"; };
+		0F919D09157EE09D004A4E7D /* JSSymbolTableObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSymbolTableObject.cpp; sourceTree = "<group>"; };
+		0F919D0A157EE09D004A4E7D /* JSSymbolTableObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSymbolTableObject.h; sourceTree = "<group>"; };
+		0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSegmentedVariableObject.cpp; sourceTree = "<group>"; };
+		0F919D0F157F3327004A4E7D /* JSSegmentedVariableObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSegmentedVariableObject.h; sourceTree = "<group>"; };
+		0F919D2215853CDE004A4E7D /* Watchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Watchpoint.cpp; sourceTree = "<group>"; };
+		0F919D2315853CDE004A4E7D /* Watchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Watchpoint.h; sourceTree = "<group>"; };
+		0F919D2715856770004A4E7D /* SymbolTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SymbolTable.cpp; sourceTree = "<group>"; };
+		0F93274C1C1F66AA00CF6564 /* GPRInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GPRInfo.cpp; sourceTree = "<group>"; };
+		0F9327591C20BCBA00CF6564 /* dynbench */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = dynbench; sourceTree = BUILT_PRODUCTS_DIR; };
+		0F93275A1C20BCDF00CF6564 /* dynbench.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = dynbench.cpp; sourceTree = "<group>"; };
+		0F93275E1C21EF7F00CF6564 /* JSObjectInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectInlines.h; sourceTree = "<group>"; };
+		0F93329314CA7DC10085F3C6 /* CallLinkStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallLinkStatus.cpp; sourceTree = "<group>"; };
+		0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallLinkStatus.h; sourceTree = "<group>"; };
+		0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetByIdStatus.cpp; sourceTree = "<group>"; };
+		0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetByIdStatus.h; sourceTree = "<group>"; };
+		0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PutByIdStatus.cpp; sourceTree = "<group>"; };
+		0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutByIdStatus.h; sourceTree = "<group>"; };
+		0F93329B14CA7DC10085F3C6 /* StructureSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureSet.h; sourceTree = "<group>"; };
+		0F93B4A718B92C4D00178A3F /* PutByIdVariant.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PutByIdVariant.cpp; sourceTree = "<group>"; };
+		0F93B4A818B92C4D00178A3F /* PutByIdVariant.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutByIdVariant.h; sourceTree = "<group>"; };
+		0F9495851C57F47500413A48 /* B3StackSlot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3StackSlot.cpp; path = b3/B3StackSlot.cpp; sourceTree = "<group>"; };
+		0F9495861C57F47500413A48 /* B3StackSlot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3StackSlot.h; path = b3/B3StackSlot.h; sourceTree = "<group>"; };
+		0F952A9F1DF7860700E06FBD /* VisitRaceKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VisitRaceKey.cpp; sourceTree = "<group>"; };
+		0F952AA01DF7860700E06FBD /* VisitRaceKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VisitRaceKey.h; sourceTree = "<group>"; };
+		0F952ABA1B487A7700C367C5 /* TrackedReferences.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TrackedReferences.cpp; sourceTree = "<group>"; };
+		0F952ABB1B487A7700C367C5 /* TrackedReferences.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TrackedReferences.h; sourceTree = "<group>"; };
+		0F9630351D4192C3005609D9 /* AllocatorAttributes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AllocatorAttributes.cpp; sourceTree = "<group>"; };
+		0F9630361D4192C3005609D9 /* AllocatorAttributes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AllocatorAttributes.h; sourceTree = "<group>"; };
+		0F9630371D4192C3005609D9 /* DestructionMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DestructionMode.cpp; sourceTree = "<group>"; };
+		0F9630381D4192C3005609D9 /* DestructionMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DestructionMode.h; sourceTree = "<group>"; };
+		0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueProfile.h; sourceTree = "<group>"; };
+		0F96EBB116676EF4008BADE3 /* CodeBlockWithJITType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeBlockWithJITType.h; sourceTree = "<group>"; };
+		0F97496F1687ADE200A4FF6A /* JSCellInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCellInlines.h; sourceTree = "<group>"; };
+		0F978B3A1AAEA71D007C7369 /* ConstantMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConstantMode.cpp; sourceTree = "<group>"; };
+		0F98205D16BFE37F00240D02 /* PreciseJumpTargets.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PreciseJumpTargets.cpp; sourceTree = "<group>"; };
+		0F98205E16BFE37F00240D02 /* PreciseJumpTargets.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PreciseJumpTargets.h; sourceTree = "<group>"; };
+		0F9B1DB31C0E42A500E5BFD2 /* FTLOutput.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOutput.cpp; path = ftl/FTLOutput.cpp; sourceTree = "<group>"; };
+		0F9B1DB51C0E42BD00E5BFD2 /* FTLOSRExitHandle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOSRExitHandle.cpp; path = ftl/FTLOSRExitHandle.cpp; sourceTree = "<group>"; };
+		0F9B1DB61C0E42BD00E5BFD2 /* FTLOSRExitHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOSRExitHandle.h; path = ftl/FTLOSRExitHandle.h; sourceTree = "<group>"; };
+		0F9CABC61DB54A760008E83B /* AirPadInterference.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirPadInterference.cpp; path = b3/air/AirPadInterference.cpp; sourceTree = "<group>"; };
+		0F9CABC71DB54A760008E83B /* AirPadInterference.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirPadInterference.h; path = b3/air/AirPadInterference.h; sourceTree = "<group>"; };
+		0F9D336E165DBB8D005AD387 /* Disassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Disassembler.cpp; path = disassembler/Disassembler.cpp; sourceTree = "<group>"; };
+		0F9D339417FFC4E60073C2BC /* DFGFlushedAt.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFlushedAt.cpp; path = dfg/DFGFlushedAt.cpp; sourceTree = "<group>"; };
+		0F9D339517FFC4E60073C2BC /* DFGFlushedAt.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFlushedAt.h; path = dfg/DFGFlushedAt.h; sourceTree = "<group>"; };
+		0F9D36921AE9CC33000D4DFB /* DFGCleanUpPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCleanUpPhase.cpp; path = dfg/DFGCleanUpPhase.cpp; sourceTree = "<group>"; };
+		0F9D36931AE9CC33000D4DFB /* DFGCleanUpPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCleanUpPhase.h; path = dfg/DFGCleanUpPhase.h; sourceTree = "<group>"; };
+		0F9D4C0A1C3E1C11006CD984 /* FTLExceptionTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLExceptionTarget.cpp; path = ftl/FTLExceptionTarget.cpp; sourceTree = "<group>"; };
+		0F9D4C0B1C3E1C11006CD984 /* FTLExceptionTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLExceptionTarget.h; path = ftl/FTLExceptionTarget.h; sourceTree = "<group>"; };
+		0F9D4C0E1C3E2C74006CD984 /* FTLPatchpointExceptionHandle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLPatchpointExceptionHandle.cpp; path = ftl/FTLPatchpointExceptionHandle.cpp; sourceTree = "<group>"; };
+		0F9D4C0F1C3E2C74006CD984 /* FTLPatchpointExceptionHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLPatchpointExceptionHandle.h; path = ftl/FTLPatchpointExceptionHandle.h; sourceTree = "<group>"; };
+		0F9E32611B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStoreBarrierInsertionPhase.cpp; path = dfg/DFGStoreBarrierInsertionPhase.cpp; sourceTree = "<group>"; };
+		0F9E32621B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStoreBarrierInsertionPhase.h; path = dfg/DFGStoreBarrierInsertionPhase.h; sourceTree = "<group>"; };
+		0F9FB4F217FCB91700CB67F8 /* DFGStackLayoutPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStackLayoutPhase.cpp; path = dfg/DFGStackLayoutPhase.cpp; sourceTree = "<group>"; };
+		0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStackLayoutPhase.h; path = dfg/DFGStackLayoutPhase.h; sourceTree = "<group>"; };
+		0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutKind.h; sourceTree = "<group>"; };
+		0FA131701D8DD72900EC130A /* PrototypeMapInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrototypeMapInlines.h; sourceTree = "<group>"; };
+		0FA2C17917D7CF84009D015F /* TestRunnerUtils.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TestRunnerUtils.cpp; sourceTree = "<group>"; };
+		0FA2C17A17D7CF84009D015F /* TestRunnerUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TestRunnerUtils.h; sourceTree = "<group>"; };
+		0FA581B7150E952A00B9A2D9 /* DFGNodeFlags.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNodeFlags.cpp; path = dfg/DFGNodeFlags.cpp; sourceTree = "<group>"; };
+		0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeFlags.h; path = dfg/DFGNodeFlags.h; sourceTree = "<group>"; };
+		0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeType.h; path = dfg/DFGNodeType.h; sourceTree = "<group>"; };
+		0FA762001DB9242300B7A2FD /* CollectionScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CollectionScope.cpp; sourceTree = "<group>"; };
+		0FA762011DB9242300B7A2FD /* CollectionScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CollectionScope.h; sourceTree = "<group>"; };
+		0FA762021DB9242300B7A2FD /* MutatorState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutatorState.cpp; sourceTree = "<group>"; };
+		0FA762031DB9242300B7A2FD /* MutatorState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MutatorState.h; sourceTree = "<group>"; };
+		0FA762081DB9283C00B7A2FD /* HelpingGCScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HelpingGCScope.h; sourceTree = "<group>"; };
+		0FA7620A1DB959F600B7A2FD /* AllocatingScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AllocatingScope.h; sourceTree = "<group>"; };
+		0FA7A8E918B413C80052371D /* Reg.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Reg.cpp; sourceTree = "<group>"; };
+		0FA7A8EA18B413C80052371D /* Reg.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Reg.h; sourceTree = "<group>"; };
+		0FA7A8ED18CE4FD80052371D /* ScratchRegisterAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScratchRegisterAllocator.cpp; sourceTree = "<group>"; };
+		0FADE6721D4D23BC00768457 /* HeapUtil.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapUtil.h; sourceTree = "<group>"; };
+		0FAF7EFA165BA919000C8455 /* JITDisassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITDisassembler.cpp; sourceTree = "<group>"; };
+		0FAF7EFB165BA919000C8455 /* JITDisassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITDisassembler.h; sourceTree = "<group>"; };
+		0FB105821675480C00F8AB6E /* ExitKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExitKind.cpp; sourceTree = "<group>"; };
+		0FB105831675480C00F8AB6E /* ExitKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExitKind.h; sourceTree = "<group>"; };
+		0FB105871675482E00F8AB6E /* ProfilerOSRExit.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerOSRExit.cpp; path = profiler/ProfilerOSRExit.cpp; sourceTree = "<group>"; };
+		0FB105881675482E00F8AB6E /* ProfilerOSRExit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerOSRExit.h; path = profiler/ProfilerOSRExit.h; sourceTree = "<group>"; };
+		0FB105891675482E00F8AB6E /* ProfilerOSRExitSite.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerOSRExitSite.cpp; path = profiler/ProfilerOSRExitSite.cpp; sourceTree = "<group>"; };
+		0FB1058A1675482E00F8AB6E /* ProfilerOSRExitSite.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerOSRExitSite.h; path = profiler/ProfilerOSRExitSite.h; sourceTree = "<group>"; };
+		0FB14E1C18124ACE009B6B4D /* JITInlineCacheGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITInlineCacheGenerator.cpp; sourceTree = "<group>"; };
+		0FB14E1D18124ACE009B6B4D /* JITInlineCacheGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITInlineCacheGenerator.h; sourceTree = "<group>"; };
+		0FB14E201812570B009B6B4D /* DFGInlineCacheWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInlineCacheWrapper.h; path = dfg/DFGInlineCacheWrapper.h; sourceTree = "<group>"; };
+		0FB14E2218130955009B6B4D /* DFGInlineCacheWrapperInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInlineCacheWrapperInlines.h; path = dfg/DFGInlineCacheWrapperInlines.h; sourceTree = "<group>"; };
+		0FB1765C196B8F9E0091052A /* DFGHeapLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGHeapLocation.cpp; path = dfg/DFGHeapLocation.cpp; sourceTree = "<group>"; };
+		0FB1765D196B8F9E0091052A /* DFGHeapLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGHeapLocation.h; path = dfg/DFGHeapLocation.h; sourceTree = "<group>"; };
+		0FB1765E196B8F9E0091052A /* DFGPureValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPureValue.cpp; path = dfg/DFGPureValue.cpp; sourceTree = "<group>"; };
+		0FB1765F196B8F9E0091052A /* DFGPureValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPureValue.h; path = dfg/DFGPureValue.h; sourceTree = "<group>"; };
+		0FB3878B1BFBC44D00E3AB1E /* AirBlockWorklist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirBlockWorklist.h; path = b3/air/AirBlockWorklist.h; sourceTree = "<group>"; };
+		0FB3878C1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirOptimizeBlockOrder.cpp; path = b3/air/AirOptimizeBlockOrder.cpp; sourceTree = "<group>"; };
+		0FB3878D1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirOptimizeBlockOrder.h; path = b3/air/AirOptimizeBlockOrder.h; sourceTree = "<group>"; };
+		0FB387911BFD31A100E3AB1E /* FTLCompile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLCompile.cpp; path = ftl/FTLCompile.cpp; sourceTree = "<group>"; };
+		0FB415831D78F98200DF8D09 /* ArrayConventions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayConventions.cpp; sourceTree = "<group>"; };
+		0FB438A219270B1D00E1FBC9 /* StructureSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureSet.cpp; sourceTree = "<group>"; };
+		0FB4767C1D99AEA7008EA6CB /* GCDeferralContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCDeferralContext.h; sourceTree = "<group>"; };
+		0FB4767D1D99AEA7008EA6CB /* GCDeferralContextInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCDeferralContextInlines.h; sourceTree = "<group>"; };
+		0FB4B51016B3A964003F696B /* DFGMinifiedID.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMinifiedID.h; path = dfg/DFGMinifiedID.h; sourceTree = "<group>"; };
+		0FB4B51916B62772003F696B /* DFGAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAllocator.h; path = dfg/DFGAllocator.h; sourceTree = "<group>"; };
+		0FB4B51A16B62772003F696B /* DFGCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCommon.cpp; path = dfg/DFGCommon.cpp; sourceTree = "<group>"; };
+		0FB4B51B16B62772003F696B /* DFGEdge.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGEdge.cpp; path = dfg/DFGEdge.cpp; sourceTree = "<group>"; };
+		0FB4B51C16B62772003F696B /* DFGLongLivedState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLongLivedState.cpp; path = dfg/DFGLongLivedState.cpp; sourceTree = "<group>"; };
+		0FB4B51D16B62772003F696B /* DFGLongLivedState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLongLivedState.h; path = dfg/DFGLongLivedState.h; sourceTree = "<group>"; };
+		0FB4B51E16B62772003F696B /* DFGNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNode.cpp; path = dfg/DFGNode.cpp; sourceTree = "<group>"; };
+		0FB4B51F16B62772003F696B /* DFGNodeAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeAllocator.h; path = dfg/DFGNodeAllocator.h; sourceTree = "<group>"; };
+		0FB4B52116B6278D003F696B /* FunctionExecutableDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionExecutableDump.cpp; sourceTree = "<group>"; };
+		0FB4B52216B6278D003F696B /* FunctionExecutableDump.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionExecutableDump.h; sourceTree = "<group>"; };
+		0FB4FB701BC843140025CA5A /* FTLLazySlowPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLazySlowPath.cpp; path = ftl/FTLLazySlowPath.cpp; sourceTree = "<group>"; };
+		0FB4FB711BC843140025CA5A /* FTLLazySlowPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLLazySlowPath.h; path = ftl/FTLLazySlowPath.h; sourceTree = "<group>"; };
+		0FB4FB721BC843140025CA5A /* FTLLazySlowPathCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLLazySlowPathCall.h; path = ftl/FTLLazySlowPathCall.h; sourceTree = "<group>"; };
+		0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyOperandValueProfile.h; sourceTree = "<group>"; };
+		0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LazyOperandValueProfile.cpp; sourceTree = "<group>"; };
+		0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MethodOfGettingAValueProfile.h; sourceTree = "<group>"; };
+		0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MethodOfGettingAValueProfile.cpp; sourceTree = "<group>"; };
+		0FB7F38915ED8E3800F167B2 /* ArrayConventions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayConventions.h; sourceTree = "<group>"; };
+		0FB7F38A15ED8E3800F167B2 /* ArrayStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayStorage.h; sourceTree = "<group>"; };
+		0FB7F38B15ED8E3800F167B2 /* Butterfly.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Butterfly.h; sourceTree = "<group>"; };
+		0FB7F38C15ED8E3800F167B2 /* ButterflyInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ButterflyInlines.h; sourceTree = "<group>"; };
+		0FB7F38D15ED8E3800F167B2 /* IndexingHeader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IndexingHeader.h; sourceTree = "<group>"; };
+		0FB7F38E15ED8E3800F167B2 /* IndexingHeaderInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IndexingHeaderInlines.h; sourceTree = "<group>"; };
+		0FB7F38F15ED8E3800F167B2 /* IndexingType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IndexingType.h; sourceTree = "<group>"; };
+		0FB7F39015ED8E3800F167B2 /* PropertyStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyStorage.h; sourceTree = "<group>"; };
+		0FB7F39115ED8E3800F167B2 /* TypeError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeError.h; sourceTree = "<group>"; };
+		0FB7F39215ED8E3800F167B2 /* SparseArrayValueMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SparseArrayValueMap.h; sourceTree = "<group>"; };
+		0FBB73B61DEF3AAC002C009E /* PreventCollectionScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PreventCollectionScope.h; sourceTree = "<group>"; };
+		0FBB73BA1DEF8644002C009E /* DeleteAllCodeEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeleteAllCodeEffort.h; sourceTree = "<group>"; };
+		0FBC0AE41496C7C100D4FBDD /* DFGExitProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DFGExitProfile.cpp; sourceTree = "<group>"; };
+		0FBC0AE51496C7C100D4FBDD /* DFGExitProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DFGExitProfile.h; sourceTree = "<group>"; };
+		0FBD7E671447998F00481315 /* CodeOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeOrigin.h; sourceTree = "<group>"; };
+		0FBDB9AC1AB0FBC6000B57E5 /* DFGCallCreateDirectArgumentsSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCallCreateDirectArgumentsSlowPathGenerator.h; path = dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h; sourceTree = "<group>"; };
+		0FBE0F6B16C1DB010082C5E8 /* DFGCPSRethreadingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCPSRethreadingPhase.cpp; path = dfg/DFGCPSRethreadingPhase.cpp; sourceTree = "<group>"; };
+		0FBE0F6C16C1DB010082C5E8 /* DFGCPSRethreadingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCPSRethreadingPhase.h; path = dfg/DFGCPSRethreadingPhase.h; sourceTree = "<group>"; };
+		0FBE0F6D16C1DB010082C5E8 /* DFGPredictionInjectionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPredictionInjectionPhase.cpp; path = dfg/DFGPredictionInjectionPhase.cpp; sourceTree = "<group>"; };
+		0FBE0F6E16C1DB010082C5E8 /* DFGPredictionInjectionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPredictionInjectionPhase.h; path = dfg/DFGPredictionInjectionPhase.h; sourceTree = "<group>"; };
+		0FBE0F6F16C1DB010082C5E8 /* DFGUnificationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGUnificationPhase.cpp; path = dfg/DFGUnificationPhase.cpp; sourceTree = "<group>"; };
+		0FBE0F7016C1DB010082C5E8 /* DFGUnificationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGUnificationPhase.h; path = dfg/DFGUnificationPhase.h; sourceTree = "<group>"; };
+		0FBF158A19B7A53100695DD0 /* DFGBlockSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBlockSet.cpp; path = dfg/DFGBlockSet.cpp; sourceTree = "<group>"; };
+		0FBF158B19B7A53100695DD0 /* DFGBlockSetInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBlockSetInlines.h; path = dfg/DFGBlockSetInlines.h; sourceTree = "<group>"; };
+		0FC097681468A6EF00CF2442 /* DFGOSRExit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExit.h; path = dfg/DFGOSRExit.h; sourceTree = "<group>"; };
+		0FC0976F14693AEF00CF2442 /* DFGOSRExitCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitCompiler.h; path = dfg/DFGOSRExitCompiler.h; sourceTree = "<group>"; };
+		0FC0977014693AEF00CF2442 /* DFGOSRExitCompiler64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitCompiler64.cpp; path = dfg/DFGOSRExitCompiler64.cpp; sourceTree = "<group>"; };
+		0FC09775146943AD00CF2442 /* DFGOSRExitCompiler32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitCompiler32_64.cpp; path = dfg/DFGOSRExitCompiler32_64.cpp; sourceTree = "<group>"; };
+		0FC0977E1469EBC400CF2442 /* DFGCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCommon.h; path = dfg/DFGCommon.h; sourceTree = "<group>"; };
+		0FC0978E146A6F6300CF2442 /* DFGOSRExit.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExit.cpp; path = dfg/DFGOSRExit.cpp; sourceTree = "<group>"; };
+		0FC0978F146A6F6300CF2442 /* DFGOSRExitCompiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitCompiler.cpp; path = dfg/DFGOSRExitCompiler.cpp; sourceTree = "<group>"; };
+		0FC0979F146B28C700CF2442 /* DFGThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGThunks.cpp; path = dfg/DFGThunks.cpp; sourceTree = "<group>"; };
+		0FC097A0146B28C700CF2442 /* DFGThunks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGThunks.h; path = dfg/DFGThunks.h; sourceTree = "<group>"; };
+		0FC20CB31852E2C600C9E954 /* DFGStrengthReductionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStrengthReductionPhase.cpp; path = dfg/DFGStrengthReductionPhase.cpp; sourceTree = "<group>"; };
+		0FC20CB41852E2C600C9E954 /* DFGStrengthReductionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStrengthReductionPhase.h; path = dfg/DFGStrengthReductionPhase.h; sourceTree = "<group>"; };
+		0FC20CB718556A3500C9E954 /* DFGSSALoweringPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSSALoweringPhase.cpp; path = dfg/DFGSSALoweringPhase.cpp; sourceTree = "<group>"; };
+		0FC20CB818556A3500C9E954 /* DFGSSALoweringPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSSALoweringPhase.h; path = dfg/DFGSSALoweringPhase.h; sourceTree = "<group>"; };
+		0FC314101814559100033232 /* RegisterSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterSet.h; sourceTree = "<group>"; };
+		0FC314111814559100033232 /* TempRegisterSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TempRegisterSet.cpp; sourceTree = "<group>"; };
+		0FC3141418146D7000033232 /* RegisterSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegisterSet.cpp; sourceTree = "<group>"; };
+		0FC3CCF519ADA410006AC72A /* DFGBlockMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBlockMap.h; path = dfg/DFGBlockMap.h; sourceTree = "<group>"; };
+		0FC3CCF619ADA410006AC72A /* DFGBlockMapInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBlockMapInlines.h; path = dfg/DFGBlockMapInlines.h; sourceTree = "<group>"; };
+		0FC3CCF719ADA410006AC72A /* DFGBlockSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBlockSet.h; path = dfg/DFGBlockSet.h; sourceTree = "<group>"; };
+		0FC3CCF919ADA410006AC72A /* DFGBlockWorklist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBlockWorklist.h; path = dfg/DFGBlockWorklist.h; sourceTree = "<group>"; };
+		0FC712DC17CD8778008CC93C /* DeferredCompilationCallback.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = DeferredCompilationCallback.cpp; sourceTree = "<group>"; };
+		0FC712DD17CD8778008CC93C /* DeferredCompilationCallback.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = DeferredCompilationCallback.h; sourceTree = "<group>"; };
+		0FC712E017CD878F008CC93C /* JITToDFGDeferredCompilationCallback.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JITToDFGDeferredCompilationCallback.cpp; sourceTree = "<group>"; };
+		0FC712E117CD878F008CC93C /* JITToDFGDeferredCompilationCallback.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JITToDFGDeferredCompilationCallback.h; sourceTree = "<group>"; };
+		0FC8150814043BCA00CFA603 /* WriteBarrierSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WriteBarrierSupport.cpp; sourceTree = "<group>"; };
+		0FC8150914043BD200CFA603 /* WriteBarrierSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrierSupport.h; sourceTree = "<group>"; };
+		0FC841661BA8C3210061837D /* DFGInferredTypeCheck.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGInferredTypeCheck.cpp; path = dfg/DFGInferredTypeCheck.cpp; sourceTree = "<group>"; };
+		0FC841671BA8C3210061837D /* DFGInferredTypeCheck.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInferredTypeCheck.h; path = dfg/DFGInferredTypeCheck.h; sourceTree = "<group>"; };
+		0FC97F2F182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeBlockJettisoningWatchpoint.cpp; sourceTree = "<group>"; };
+		0FC97F30182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeBlockJettisoningWatchpoint.h; sourceTree = "<group>"; };
+		0FC97F3718202119002C9B26 /* DFGInvalidationPointInjectionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGInvalidationPointInjectionPhase.cpp; path = dfg/DFGInvalidationPointInjectionPhase.cpp; sourceTree = "<group>"; };
+		0FC97F3818202119002C9B26 /* DFGInvalidationPointInjectionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInvalidationPointInjectionPhase.h; path = dfg/DFGInvalidationPointInjectionPhase.h; sourceTree = "<group>"; };
+		0FC97F3918202119002C9B26 /* DFGJumpReplacement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGJumpReplacement.cpp; path = dfg/DFGJumpReplacement.cpp; sourceTree = "<group>"; };
+		0FC97F3A18202119002C9B26 /* DFGJumpReplacement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGJumpReplacement.h; path = dfg/DFGJumpReplacement.h; sourceTree = "<group>"; };
+		0FC97F3B18202119002C9B26 /* DFGWatchpointCollectionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGWatchpointCollectionPhase.cpp; path = dfg/DFGWatchpointCollectionPhase.cpp; sourceTree = "<group>"; };
+		0FC97F3C18202119002C9B26 /* DFGWatchpointCollectionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGWatchpointCollectionPhase.h; path = dfg/DFGWatchpointCollectionPhase.h; sourceTree = "<group>"; };
+		0FCB408515C0A3C30048932B /* SlotVisitorInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SlotVisitorInlines.h; sourceTree = "<group>"; };
+		0FCCAE4316D0CF6E00D0C65B /* ParserError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserError.h; sourceTree = "<group>"; };
+		0FCEFAA91804C13E00472CE4 /* FTLSaveRestore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLSaveRestore.cpp; path = ftl/FTLSaveRestore.cpp; sourceTree = "<group>"; };
+		0FCEFAAA1804C13E00472CE4 /* FTLSaveRestore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLSaveRestore.h; path = ftl/FTLSaveRestore.h; sourceTree = "<group>"; };
+		0FCEFADD180738C000472CE4 /* FTLLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLocation.cpp; path = ftl/FTLLocation.cpp; sourceTree = "<group>"; };
+		0FCEFADE180738C000472CE4 /* FTLLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLLocation.h; path = ftl/FTLLocation.h; sourceTree = "<group>"; };
+		0FD2C92316D01EE900C7803F /* StructureInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureInlines.h; sourceTree = "<group>"; };
+		0FD3C82014115CF800FD81CB /* DFGDriver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDriver.cpp; path = dfg/DFGDriver.cpp; sourceTree = "<group>"; };
+		0FD3C82214115D0E00FD81CB /* DFGDriver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDriver.h; path = dfg/DFGDriver.h; sourceTree = "<group>"; };
+		0FD3E3FF1B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAdaptiveInferredPropertyValueWatchpoint.cpp; path = dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp; sourceTree = "<group>"; };
+		0FD3E4001B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAdaptiveInferredPropertyValueWatchpoint.h; path = dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h; sourceTree = "<group>"; };
+		0FD3E4031B618B6600C80E1E /* ObjectPropertyCondition.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ObjectPropertyCondition.cpp; sourceTree = "<group>"; };
+		0FD3E4041B618B6600C80E1E /* ObjectPropertyCondition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectPropertyCondition.h; sourceTree = "<group>"; };
+		0FD3E4051B618B6600C80E1E /* ObjectPropertyConditionSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ObjectPropertyConditionSet.cpp; sourceTree = "<group>"; };
+		0FD3E4061B618B6600C80E1E /* ObjectPropertyConditionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectPropertyConditionSet.h; sourceTree = "<group>"; };
+		0FD3E4071B618B6600C80E1E /* PropertyCondition.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertyCondition.cpp; sourceTree = "<group>"; };
+		0FD3E4081B618B6600C80E1E /* PropertyCondition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyCondition.h; sourceTree = "<group>"; };
+		0FD5652216AB780A00197653 /* DFGBasicBlockInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBasicBlockInlines.h; path = dfg/DFGBasicBlockInlines.h; sourceTree = "<group>"; };
+		0FD81AD0154FB4EB00983E72 /* DFGDominators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDominators.h; path = dfg/DFGDominators.h; sourceTree = "<group>"; };
+		0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCapabilities.cpp; path = dfg/DFGCapabilities.cpp; sourceTree = "<group>"; };
+		0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCapabilities.h; path = dfg/DFGCapabilities.h; sourceTree = "<group>"; };
+		0FD82E37141AB14200179C94 /* CompactJITCodeMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CompactJITCodeMap.h; sourceTree = "<group>"; };
+		0FD82E4F141DAEA100179C94 /* SpeculatedType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpeculatedType.h; sourceTree = "<group>"; };
+		0FD82E52141DAEDE00179C94 /* DFGOSREntry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSREntry.cpp; path = dfg/DFGOSREntry.cpp; sourceTree = "<group>"; };
+		0FD82E53141DAEDE00179C94 /* DFGOSREntry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSREntry.h; path = dfg/DFGOSREntry.h; sourceTree = "<group>"; };
+		0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpeculatedType.cpp; sourceTree = "<group>"; };
+		0FD8A31117D4326C00CA2C40 /* CodeBlockSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeBlockSet.cpp; sourceTree = "<group>"; };
+		0FD8A31217D4326C00CA2C40 /* CodeBlockSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeBlockSet.h; sourceTree = "<group>"; };
+		0FD8A31517D51F2200CA2C40 /* FTLForOSREntryJITCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLForOSREntryJITCode.cpp; path = ftl/FTLForOSREntryJITCode.cpp; sourceTree = "<group>"; };
+		0FD8A31617D51F2200CA2C40 /* FTLForOSREntryJITCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLForOSREntryJITCode.h; path = ftl/FTLForOSREntryJITCode.h; sourceTree = "<group>"; };
+		0FD8A31717D51F2200CA2C40 /* FTLOSREntry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLOSREntry.cpp; path = ftl/FTLOSREntry.cpp; sourceTree = "<group>"; };
+		0FD8A31817D51F2200CA2C40 /* FTLOSREntry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOSREntry.h; path = ftl/FTLOSREntry.h; sourceTree = "<group>"; };
+		0FD8A31D17D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSREntrypointCreationPhase.cpp; path = dfg/DFGOSREntrypointCreationPhase.cpp; sourceTree = "<group>"; };
+		0FD8A31E17D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSREntrypointCreationPhase.h; path = dfg/DFGOSREntrypointCreationPhase.h; sourceTree = "<group>"; };
+		0FD8A31F17D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGTierUpCheckInjectionPhase.cpp; path = dfg/DFGTierUpCheckInjectionPhase.cpp; sourceTree = "<group>"; };
+		0FD8A32017D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGTierUpCheckInjectionPhase.h; path = dfg/DFGTierUpCheckInjectionPhase.h; sourceTree = "<group>"; };
+		0FD8A32117D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGToFTLDeferredCompilationCallback.cpp; path = dfg/DFGToFTLDeferredCompilationCallback.cpp; sourceTree = "<group>"; };
+		0FD8A32217D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGToFTLDeferredCompilationCallback.h; path = dfg/DFGToFTLDeferredCompilationCallback.h; sourceTree = "<group>"; };
+		0FD8A32317D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGToFTLForOSREntryDeferredCompilationCallback.cpp; path = dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp; sourceTree = "<group>"; };
+		0FD8A32417D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGToFTLForOSREntryDeferredCompilationCallback.h; path = dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h; sourceTree = "<group>"; };
+		0FDB2CC7173DA51E007B3C1B /* FTLAbbreviatedTypes.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = FTLAbbreviatedTypes.h; path = ftl/FTLAbbreviatedTypes.h; sourceTree = "<group>"; };
+		0FDB2CC8173DA51E007B3C1B /* FTLValueFromBlock.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = FTLValueFromBlock.h; path = ftl/FTLValueFromBlock.h; sourceTree = "<group>"; };
+		0FDB2CE5174830A2007B3C1B /* DFGWorklist.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGWorklist.cpp; path = dfg/DFGWorklist.cpp; sourceTree = "<group>"; };
+		0FDB2CE6174830A2007B3C1B /* DFGWorklist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGWorklist.h; path = dfg/DFGWorklist.h; sourceTree = "<group>"; };
+		0FDB2CE9174896C7007B3C1B /* ConcurrentJSLock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConcurrentJSLock.h; sourceTree = "<group>"; };
+		0FDDBFB21666EED500C55FEF /* DFGVariableAccessDataDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableAccessDataDump.cpp; path = dfg/DFGVariableAccessDataDump.cpp; sourceTree = "<group>"; };
+		0FDDBFB31666EED500C55FEF /* DFGVariableAccessDataDump.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableAccessDataDump.h; path = dfg/DFGVariableAccessDataDump.h; sourceTree = "<group>"; };
+		0FDE87F81DFD0C6D0064C390 /* CellContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CellContainer.cpp; sourceTree = "<group>"; };
+		0FDE87FA1DFE6E500064C390 /* SpaceTimeMutatorScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpaceTimeMutatorScheduler.cpp; sourceTree = "<group>"; };
+		0FDE87FB1DFE6E500064C390 /* SpaceTimeMutatorScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpaceTimeMutatorScheduler.h; sourceTree = "<group>"; };
+		0FDF67D01D9C6086001B9825 /* B3Kind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Kind.cpp; path = b3/B3Kind.cpp; sourceTree = "<group>"; };
+		0FDF67D11D9C6086001B9825 /* B3Kind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Kind.h; path = b3/B3Kind.h; sourceTree = "<group>"; };
+		0FDF67D41D9DC43E001B9825 /* AirKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirKind.cpp; path = b3/air/AirKind.cpp; sourceTree = "<group>"; };
+		0FDF67D51D9DC43E001B9825 /* AirKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirKind.h; path = b3/air/AirKind.h; sourceTree = "<group>"; };
+		0FDF70831D3F2C1F00927449 /* AirLowerEntrySwitch.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirLowerEntrySwitch.cpp; path = b3/air/AirLowerEntrySwitch.cpp; sourceTree = "<group>"; };
+		0FDF70841D3F2C1F00927449 /* AirLowerEntrySwitch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirLowerEntrySwitch.h; path = b3/air/AirLowerEntrySwitch.h; sourceTree = "<group>"; };
+		0FE0500C1AA9091100D33B33 /* ArgumentsMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArgumentsMode.h; sourceTree = "<group>"; };
+		0FE0500D1AA9091100D33B33 /* DirectArgumentsOffset.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DirectArgumentsOffset.cpp; sourceTree = "<group>"; };
+		0FE0500E1AA9091100D33B33 /* DirectArgumentsOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DirectArgumentsOffset.h; sourceTree = "<group>"; };
+		0FE0500F1AA9091100D33B33 /* DirectArguments.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DirectArguments.cpp; sourceTree = "<group>"; };
+		0FE050101AA9091100D33B33 /* DirectArguments.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DirectArguments.h; sourceTree = "<group>"; };
+		0FE050111AA9091100D33B33 /* GenericArguments.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GenericArguments.h; sourceTree = "<group>"; };
+		0FE050121AA9091100D33B33 /* GenericArgumentsInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GenericArgumentsInlines.h; sourceTree = "<group>"; };
+		0FE050131AA9091100D33B33 /* GenericOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GenericOffset.h; sourceTree = "<group>"; };
+		0FE0501C1AA9095600D33B33 /* ClonedArguments.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ClonedArguments.cpp; sourceTree = "<group>"; };
+		0FE0501D1AA9095600D33B33 /* ClonedArguments.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClonedArguments.h; sourceTree = "<group>"; };
+		0FE0501E1AA9095600D33B33 /* ScopedArguments.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScopedArguments.cpp; sourceTree = "<group>"; };
+		0FE0501F1AA9095600D33B33 /* ScopedArguments.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScopedArguments.h; sourceTree = "<group>"; };
+		0FE050201AA9095600D33B33 /* ScopedArgumentsTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScopedArgumentsTable.h; sourceTree = "<group>"; };
+		0FE050211AA9095600D33B33 /* ScopeOffset.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScopeOffset.cpp; sourceTree = "<group>"; };
+		0FE050221AA9095600D33B33 /* ScopeOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScopeOffset.h; sourceTree = "<group>"; };
+		0FE050231AA9095600D33B33 /* VarOffset.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VarOffset.cpp; sourceTree = "<group>"; };
+		0FE050241AA9095600D33B33 /* VarOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VarOffset.h; sourceTree = "<group>"; };
+		0FE0502E1AAA806900D33B33 /* ScopedArgumentsTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScopedArgumentsTable.cpp; sourceTree = "<group>"; };
+		0FE0E4AB1C24C94A002E17B6 /* AirTmpWidth.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirTmpWidth.cpp; path = b3/air/AirTmpWidth.cpp; sourceTree = "<group>"; };
+		0FE0E4AC1C24C94A002E17B6 /* AirTmpWidth.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirTmpWidth.h; path = b3/air/AirTmpWidth.h; sourceTree = "<group>"; };
+		0FE228EA1436AB2300196C48 /* Options.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Options.cpp; sourceTree = "<group>"; };
+		0FE228EB1436AB2300196C48 /* Options.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Options.h; sourceTree = "<group>"; };
+		0FE254F41ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVarargsForwardingPhase.cpp; path = dfg/DFGVarargsForwardingPhase.cpp; sourceTree = "<group>"; };
+		0FE254F51ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVarargsForwardingPhase.h; path = dfg/DFGVarargsForwardingPhase.h; sourceTree = "<group>"; };
+		0FE34C171C4B39AE0003A512 /* AirLogRegisterPressure.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirLogRegisterPressure.cpp; path = b3/air/AirLogRegisterPressure.cpp; sourceTree = "<group>"; };
+		0FE34C181C4B39AE0003A512 /* AirLogRegisterPressure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirLogRegisterPressure.h; path = b3/air/AirLogRegisterPressure.h; sourceTree = "<group>"; };
+		0FE7211B193B9C590031F6ED /* DFGTransition.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGTransition.cpp; path = dfg/DFGTransition.cpp; sourceTree = "<group>"; };
+		0FE7211C193B9C590031F6ED /* DFGTransition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGTransition.h; path = dfg/DFGTransition.h; sourceTree = "<group>"; };
+		0FE834151A6EF97B00D04847 /* PolymorphicCallStubRoutine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolymorphicCallStubRoutine.cpp; sourceTree = "<group>"; };
+		0FE834161A6EF97B00D04847 /* PolymorphicCallStubRoutine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolymorphicCallStubRoutine.h; sourceTree = "<group>"; };
+		0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredWatchpoints.cpp; path = dfg/DFGDesiredWatchpoints.cpp; sourceTree = "<group>"; };
+		0FE8534A1723CDA500B618F5 /* DFGDesiredWatchpoints.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredWatchpoints.h; path = dfg/DFGDesiredWatchpoints.h; sourceTree = "<group>"; };
+		0FEA09FE170513DB00BB722C /* FTLCapabilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLCapabilities.cpp; path = ftl/FTLCapabilities.cpp; sourceTree = "<group>"; };
+		0FEA09FF170513DB00BB722C /* FTLCapabilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLCapabilities.h; path = ftl/FTLCapabilities.h; sourceTree = "<group>"; };
+		0FEA0A01170513DB00BB722C /* FTLCompile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLCompile.h; path = ftl/FTLCompile.h; sourceTree = "<group>"; };
+		0FEA0A02170513DB00BB722C /* FTLJITCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLJITCode.cpp; path = ftl/FTLJITCode.cpp; sourceTree = "<group>"; };
+		0FEA0A03170513DB00BB722C /* FTLJITCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLJITCode.h; path = ftl/FTLJITCode.h; sourceTree = "<group>"; };
+		0FEA0A04170513DB00BB722C /* FTLLowerDFGToB3.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLowerDFGToB3.cpp; path = ftl/FTLLowerDFGToB3.cpp; sourceTree = "<group>"; };
+		0FEA0A05170513DB00BB722C /* FTLLowerDFGToB3.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLLowerDFGToB3.h; path = ftl/FTLLowerDFGToB3.h; sourceTree = "<group>"; };
+		0FEA0A07170513DB00BB722C /* FTLState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLState.h; path = ftl/FTLState.h; sourceTree = "<group>"; };
+		0FEA0A151706BB9000BB722C /* FTLState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLState.cpp; path = ftl/FTLState.cpp; sourceTree = "<group>"; };
+		0FEA0A171708B00700BB722C /* FTLAbstractHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLAbstractHeap.cpp; path = ftl/FTLAbstractHeap.cpp; sourceTree = "<group>"; };
+		0FEA0A181708B00700BB722C /* FTLAbstractHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLAbstractHeap.h; path = ftl/FTLAbstractHeap.h; sourceTree = "<group>"; };
+		0FEA0A191708B00700BB722C /* FTLAbstractHeapRepository.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLAbstractHeapRepository.cpp; path = ftl/FTLAbstractHeapRepository.cpp; sourceTree = "<group>"; };
+		0FEA0A1A1708B00700BB722C /* FTLAbstractHeapRepository.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLAbstractHeapRepository.h; path = ftl/FTLAbstractHeapRepository.h; sourceTree = "<group>"; };
+		0FEA0A1B1708B00700BB722C /* FTLTypedPointer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLTypedPointer.h; path = ftl/FTLTypedPointer.h; sourceTree = "<group>"; };
+		0FEA0A211709606900BB722C /* FTLCommonValues.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLCommonValues.h; path = ftl/FTLCommonValues.h; sourceTree = "<group>"; };
+		0FEA0A251709623B00BB722C /* FTLCommonValues.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLCommonValues.cpp; path = ftl/FTLCommonValues.cpp; sourceTree = "<group>"; };
+		0FEA0A2B170B661900BB722C /* FTLFormattedValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLFormattedValue.h; path = ftl/FTLFormattedValue.h; sourceTree = "<group>"; };
+		0FEA0A2D170D40BF00BB722C /* DFGCommonData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCommonData.cpp; path = dfg/DFGCommonData.cpp; sourceTree = "<group>"; };
+		0FEA0A2E170D40BF00BB722C /* DFGCommonData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCommonData.h; path = dfg/DFGCommonData.h; sourceTree = "<group>"; };
+		0FEA0A2F170D40BF00BB722C /* DFGJITCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGJITCode.cpp; path = dfg/DFGJITCode.cpp; sourceTree = "<group>"; };
+		0FEA0A30170D40BF00BB722C /* DFGJITCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGJITCode.h; path = dfg/DFGJITCode.h; sourceTree = "<group>"; };
+		0FEB3ECE16237F6700AB67AD /* MacroAssembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssembler.cpp; sourceTree = "<group>"; };
+		0FEC84B41BDACDAC0080FF74 /* B3ArgumentRegValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ArgumentRegValue.cpp; path = b3/B3ArgumentRegValue.cpp; sourceTree = "<group>"; };
+		0FEC84B51BDACDAC0080FF74 /* B3ArgumentRegValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ArgumentRegValue.h; path = b3/B3ArgumentRegValue.h; sourceTree = "<group>"; };
+		0FEC84B61BDACDAC0080FF74 /* B3BasicBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3BasicBlock.cpp; path = b3/B3BasicBlock.cpp; sourceTree = "<group>"; };
+		0FEC84B71BDACDAC0080FF74 /* B3BasicBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3BasicBlock.h; path = b3/B3BasicBlock.h; sourceTree = "<group>"; };
+		0FEC84B81BDACDAC0080FF74 /* B3BasicBlockInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3BasicBlockInlines.h; path = b3/B3BasicBlockInlines.h; sourceTree = "<group>"; };
+		0FEC84B91BDACDAC0080FF74 /* B3BasicBlockUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3BasicBlockUtils.h; path = b3/B3BasicBlockUtils.h; sourceTree = "<group>"; };
+		0FEC84BA1BDACDAC0080FF74 /* B3BlockWorklist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3BlockWorklist.h; path = b3/B3BlockWorklist.h; sourceTree = "<group>"; };
+		0FEC84BB1BDACDAC0080FF74 /* B3CheckSpecial.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3CheckSpecial.cpp; path = b3/B3CheckSpecial.cpp; sourceTree = "<group>"; };
+		0FEC84BC1BDACDAC0080FF74 /* B3CheckSpecial.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3CheckSpecial.h; path = b3/B3CheckSpecial.h; sourceTree = "<group>"; };
+		0FEC84BD1BDACDAC0080FF74 /* B3CheckValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3CheckValue.cpp; path = b3/B3CheckValue.cpp; sourceTree = "<group>"; };
+		0FEC84BE1BDACDAC0080FF74 /* B3CheckValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3CheckValue.h; path = b3/B3CheckValue.h; sourceTree = "<group>"; };
+		0FEC84BF1BDACDAC0080FF74 /* B3Common.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Common.cpp; path = b3/B3Common.cpp; sourceTree = "<group>"; };
+		0FEC84C01BDACDAC0080FF74 /* B3Common.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Common.h; path = b3/B3Common.h; sourceTree = "<group>"; };
+		0FEC84C11BDACDAC0080FF74 /* B3Commutativity.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Commutativity.cpp; path = b3/B3Commutativity.cpp; sourceTree = "<group>"; };
+		0FEC84C21BDACDAC0080FF74 /* B3Commutativity.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Commutativity.h; path = b3/B3Commutativity.h; sourceTree = "<group>"; };
+		0FEC84C31BDACDAC0080FF74 /* B3Const32Value.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Const32Value.cpp; path = b3/B3Const32Value.cpp; sourceTree = "<group>"; };
+		0FEC84C41BDACDAC0080FF74 /* B3Const32Value.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Const32Value.h; path = b3/B3Const32Value.h; sourceTree = "<group>"; };
+		0FEC84C51BDACDAC0080FF74 /* B3Const64Value.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Const64Value.cpp; path = b3/B3Const64Value.cpp; sourceTree = "<group>"; };
+		0FEC84C61BDACDAC0080FF74 /* B3Const64Value.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Const64Value.h; path = b3/B3Const64Value.h; sourceTree = "<group>"; };
+		0FEC84C71BDACDAC0080FF74 /* B3ConstDoubleValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ConstDoubleValue.cpp; path = b3/B3ConstDoubleValue.cpp; sourceTree = "<group>"; };
+		0FEC84C81BDACDAC0080FF74 /* B3ConstDoubleValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ConstDoubleValue.h; path = b3/B3ConstDoubleValue.h; sourceTree = "<group>"; };
+		0FEC84CB1BDACDAC0080FF74 /* B3FrequencyClass.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3FrequencyClass.cpp; path = b3/B3FrequencyClass.cpp; sourceTree = "<group>"; };
+		0FEC84CC1BDACDAC0080FF74 /* B3FrequencyClass.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3FrequencyClass.h; path = b3/B3FrequencyClass.h; sourceTree = "<group>"; };
+		0FEC84CD1BDACDAC0080FF74 /* B3FrequentedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3FrequentedBlock.h; path = b3/B3FrequentedBlock.h; sourceTree = "<group>"; };
+		0FEC84CE1BDACDAC0080FF74 /* B3Generate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Generate.cpp; path = b3/B3Generate.cpp; sourceTree = "<group>"; };
+		0FEC84CF1BDACDAC0080FF74 /* B3Generate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Generate.h; path = b3/B3Generate.h; sourceTree = "<group>"; };
+		0FEC84D01BDACDAC0080FF74 /* B3GenericFrequentedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3GenericFrequentedBlock.h; path = b3/B3GenericFrequentedBlock.h; sourceTree = "<group>"; };
+		0FEC84D31BDACDAC0080FF74 /* B3LowerToAir.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3LowerToAir.cpp; path = b3/B3LowerToAir.cpp; sourceTree = "<group>"; };
+		0FEC84D41BDACDAC0080FF74 /* B3LowerToAir.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3LowerToAir.h; path = b3/B3LowerToAir.h; sourceTree = "<group>"; };
+		0FEC84D51BDACDAC0080FF74 /* B3MemoryValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3MemoryValue.cpp; path = b3/B3MemoryValue.cpp; sourceTree = "<group>"; };
+		0FEC84D61BDACDAC0080FF74 /* B3MemoryValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3MemoryValue.h; path = b3/B3MemoryValue.h; sourceTree = "<group>"; };
+		0FEC84D71BDACDAC0080FF74 /* B3Opcode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Opcode.cpp; path = b3/B3Opcode.cpp; sourceTree = "<group>"; };
+		0FEC84D81BDACDAC0080FF74 /* B3Opcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Opcode.h; path = b3/B3Opcode.h; sourceTree = "<group>"; };
+		0FEC84D91BDACDAC0080FF74 /* B3Origin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Origin.cpp; path = b3/B3Origin.cpp; sourceTree = "<group>"; };
+		0FEC84DA1BDACDAC0080FF74 /* B3Origin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Origin.h; path = b3/B3Origin.h; sourceTree = "<group>"; };
+		0FEC84DB1BDACDAC0080FF74 /* B3PatchpointSpecial.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3PatchpointSpecial.cpp; path = b3/B3PatchpointSpecial.cpp; sourceTree = "<group>"; };
+		0FEC84DC1BDACDAC0080FF74 /* B3PatchpointSpecial.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PatchpointSpecial.h; path = b3/B3PatchpointSpecial.h; sourceTree = "<group>"; };
+		0FEC84DD1BDACDAC0080FF74 /* B3PatchpointValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3PatchpointValue.cpp; path = b3/B3PatchpointValue.cpp; sourceTree = "<group>"; };
+		0FEC84DE1BDACDAC0080FF74 /* B3PatchpointValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PatchpointValue.h; path = b3/B3PatchpointValue.h; sourceTree = "<group>"; };
+		0FEC84DF1BDACDAC0080FF74 /* B3PhaseScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3PhaseScope.cpp; path = b3/B3PhaseScope.cpp; sourceTree = "<group>"; };
+		0FEC84E01BDACDAC0080FF74 /* B3PhaseScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PhaseScope.h; path = b3/B3PhaseScope.h; sourceTree = "<group>"; };
+		0FEC84E11BDACDAC0080FF74 /* B3Procedure.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Procedure.cpp; path = b3/B3Procedure.cpp; sourceTree = "<group>"; };
+		0FEC84E21BDACDAC0080FF74 /* B3Procedure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Procedure.h; path = b3/B3Procedure.h; sourceTree = "<group>"; };
+		0FEC84E31BDACDAC0080FF74 /* B3ProcedureInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ProcedureInlines.h; path = b3/B3ProcedureInlines.h; sourceTree = "<group>"; };
+		0FEC84E61BDACDAC0080FF74 /* B3StackmapSpecial.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3StackmapSpecial.cpp; path = b3/B3StackmapSpecial.cpp; sourceTree = "<group>"; };
+		0FEC84E71BDACDAC0080FF74 /* B3StackmapSpecial.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3StackmapSpecial.h; path = b3/B3StackmapSpecial.h; sourceTree = "<group>"; };
+		0FEC84EA1BDACDAC0080FF74 /* B3SlotBaseValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3SlotBaseValue.cpp; path = b3/B3SlotBaseValue.cpp; sourceTree = "<group>"; };
+		0FEC84EB1BDACDAC0080FF74 /* B3SlotBaseValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SlotBaseValue.h; path = b3/B3SlotBaseValue.h; sourceTree = "<group>"; };
+		0FEC84EC1BDACDAC0080FF74 /* B3SuccessorCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SuccessorCollection.h; path = b3/B3SuccessorCollection.h; sourceTree = "<group>"; };
+		0FEC84ED1BDACDAC0080FF74 /* B3SwitchCase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3SwitchCase.cpp; path = b3/B3SwitchCase.cpp; sourceTree = "<group>"; };
+		0FEC84EE1BDACDAC0080FF74 /* B3SwitchCase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SwitchCase.h; path = b3/B3SwitchCase.h; sourceTree = "<group>"; };
+		0FEC84EF1BDACDAC0080FF74 /* B3SwitchValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3SwitchValue.cpp; path = b3/B3SwitchValue.cpp; sourceTree = "<group>"; };
+		0FEC84F01BDACDAC0080FF74 /* B3SwitchValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3SwitchValue.h; path = b3/B3SwitchValue.h; sourceTree = "<group>"; };
+		0FEC84F11BDACDAC0080FF74 /* B3Type.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Type.cpp; path = b3/B3Type.cpp; sourceTree = "<group>"; };
+		0FEC84F21BDACDAC0080FF74 /* B3Type.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Type.h; path = b3/B3Type.h; sourceTree = "<group>"; };
+		0FEC84F31BDACDAC0080FF74 /* B3UpsilonValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3UpsilonValue.cpp; path = b3/B3UpsilonValue.cpp; sourceTree = "<group>"; };
+		0FEC84F41BDACDAC0080FF74 /* B3UpsilonValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3UpsilonValue.h; path = b3/B3UpsilonValue.h; sourceTree = "<group>"; };
+		0FEC84F51BDACDAC0080FF74 /* B3UseCounts.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3UseCounts.cpp; path = b3/B3UseCounts.cpp; sourceTree = "<group>"; };
+		0FEC84F61BDACDAC0080FF74 /* B3UseCounts.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3UseCounts.h; path = b3/B3UseCounts.h; sourceTree = "<group>"; };
+		0FEC84F71BDACDAC0080FF74 /* B3Validate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Validate.cpp; path = b3/B3Validate.cpp; sourceTree = "<group>"; };
+		0FEC84F81BDACDAC0080FF74 /* B3Validate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Validate.h; path = b3/B3Validate.h; sourceTree = "<group>"; };
+		0FEC84F91BDACDAC0080FF74 /* B3Value.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Value.cpp; path = b3/B3Value.cpp; sourceTree = "<group>"; };
+		0FEC84FA1BDACDAC0080FF74 /* B3Value.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Value.h; path = b3/B3Value.h; sourceTree = "<group>"; };
+		0FEC84FB1BDACDAC0080FF74 /* B3ValueInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ValueInlines.h; path = b3/B3ValueInlines.h; sourceTree = "<group>"; };
+		0FEC84FC1BDACDAC0080FF74 /* B3ValueRep.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ValueRep.cpp; path = b3/B3ValueRep.cpp; sourceTree = "<group>"; };
+		0FEC84FD1BDACDAC0080FF74 /* B3ValueRep.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ValueRep.h; path = b3/B3ValueRep.h; sourceTree = "<group>"; };
+		0FEC85481BDACDC70080FF74 /* AirAllocateStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirAllocateStack.cpp; path = b3/air/AirAllocateStack.cpp; sourceTree = "<group>"; };
+		0FEC85491BDACDC70080FF74 /* AirAllocateStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirAllocateStack.h; path = b3/air/AirAllocateStack.h; sourceTree = "<group>"; };
+		0FEC854A1BDACDC70080FF74 /* AirArg.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirArg.cpp; path = b3/air/AirArg.cpp; sourceTree = "<group>"; };
+		0FEC854B1BDACDC70080FF74 /* AirArg.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirArg.h; path = b3/air/AirArg.h; sourceTree = "<group>"; };
+		0FEC854C1BDACDC70080FF74 /* AirBasicBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirBasicBlock.cpp; path = b3/air/AirBasicBlock.cpp; sourceTree = "<group>"; };
+		0FEC854D1BDACDC70080FF74 /* AirBasicBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirBasicBlock.h; path = b3/air/AirBasicBlock.h; sourceTree = "<group>"; };
+		0FEC854E1BDACDC70080FF74 /* AirCCallSpecial.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirCCallSpecial.cpp; path = b3/air/AirCCallSpecial.cpp; sourceTree = "<group>"; };
+		0FEC854F1BDACDC70080FF74 /* AirCCallSpecial.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirCCallSpecial.h; path = b3/air/AirCCallSpecial.h; sourceTree = "<group>"; };
+		0FEC85501BDACDC70080FF74 /* AirCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirCode.cpp; path = b3/air/AirCode.cpp; sourceTree = "<group>"; };
+		0FEC85511BDACDC70080FF74 /* AirCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirCode.h; path = b3/air/AirCode.h; sourceTree = "<group>"; };
+		0FEC85521BDACDC70080FF74 /* AirFrequentedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirFrequentedBlock.h; path = b3/air/AirFrequentedBlock.h; sourceTree = "<group>"; };
+		0FEC85531BDACDC70080FF74 /* AirGenerate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirGenerate.cpp; path = b3/air/AirGenerate.cpp; sourceTree = "<group>"; };
+		0FEC85541BDACDC70080FF74 /* AirGenerate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirGenerate.h; path = b3/air/AirGenerate.h; sourceTree = "<group>"; };
+		0FEC85551BDACDC70080FF74 /* AirGenerationContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirGenerationContext.h; path = b3/air/AirGenerationContext.h; sourceTree = "<group>"; };
+		0FEC85561BDACDC70080FF74 /* AirHandleCalleeSaves.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirHandleCalleeSaves.cpp; path = b3/air/AirHandleCalleeSaves.cpp; sourceTree = "<group>"; };
+		0FEC85571BDACDC70080FF74 /* AirHandleCalleeSaves.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirHandleCalleeSaves.h; path = b3/air/AirHandleCalleeSaves.h; sourceTree = "<group>"; };
+		0FEC85581BDACDC70080FF74 /* AirInsertionSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirInsertionSet.cpp; path = b3/air/AirInsertionSet.cpp; sourceTree = "<group>"; };
+		0FEC85591BDACDC70080FF74 /* AirInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirInsertionSet.h; path = b3/air/AirInsertionSet.h; sourceTree = "<group>"; };
+		0FEC855A1BDACDC70080FF74 /* AirInst.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirInst.cpp; path = b3/air/AirInst.cpp; sourceTree = "<group>"; };
+		0FEC855B1BDACDC70080FF74 /* AirInst.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirInst.h; path = b3/air/AirInst.h; sourceTree = "<group>"; };
+		0FEC855C1BDACDC70080FF74 /* AirInstInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirInstInlines.h; path = b3/air/AirInstInlines.h; sourceTree = "<group>"; };
+		0FEC855E1BDACDC70080FF74 /* AirPhaseScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirPhaseScope.cpp; path = b3/air/AirPhaseScope.cpp; sourceTree = "<group>"; };
+		0FEC855F1BDACDC70080FF74 /* AirPhaseScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirPhaseScope.h; path = b3/air/AirPhaseScope.h; sourceTree = "<group>"; };
+		0FEC85621BDACDC70080FF74 /* AirSpecial.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirSpecial.cpp; path = b3/air/AirSpecial.cpp; sourceTree = "<group>"; };
+		0FEC85631BDACDC70080FF74 /* AirSpecial.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirSpecial.h; path = b3/air/AirSpecial.h; sourceTree = "<group>"; };
+		0FEC85641BDACDC70080FF74 /* AirSpillEverything.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirSpillEverything.cpp; path = b3/air/AirSpillEverything.cpp; sourceTree = "<group>"; };
+		0FEC85651BDACDC70080FF74 /* AirSpillEverything.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirSpillEverything.h; path = b3/air/AirSpillEverything.h; sourceTree = "<group>"; };
+		0FEC85661BDACDC70080FF74 /* AirStackSlot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirStackSlot.cpp; path = b3/air/AirStackSlot.cpp; sourceTree = "<group>"; };
+		0FEC85671BDACDC70080FF74 /* AirStackSlot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirStackSlot.h; path = b3/air/AirStackSlot.h; sourceTree = "<group>"; };
+		0FEC85681BDACDC70080FF74 /* AirTmp.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirTmp.cpp; path = b3/air/AirTmp.cpp; sourceTree = "<group>"; };
+		0FEC85691BDACDC70080FF74 /* AirTmp.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirTmp.h; path = b3/air/AirTmp.h; sourceTree = "<group>"; };
+		0FEC856A1BDACDC70080FF74 /* AirTmpInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirTmpInlines.h; path = b3/air/AirTmpInlines.h; sourceTree = "<group>"; };
+		0FEC856B1BDACDC70080FF74 /* AirValidate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirValidate.cpp; path = b3/air/AirValidate.cpp; sourceTree = "<group>"; };
+		0FEC856C1BDACDC70080FF74 /* AirValidate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirValidate.h; path = b3/air/AirValidate.h; sourceTree = "<group>"; };
+		0FEC85921BDB1E100080FF74 /* AirGenerated.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirGenerated.cpp; path = b3/air/AirGenerated.cpp; sourceTree = "<group>"; };
+		0FEC85AD1BDB5CF10080FF74 /* testb3 */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = testb3; sourceTree = BUILT_PRODUCTS_DIR; };
+		0FEC85AE1BDB5D5E0080FF74 /* testb3.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = testb3.cpp; path = b3/testb3.cpp; sourceTree = "<group>"; };
+		0FEC85B21BDED9570080FF74 /* B3ConstPtrValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ConstPtrValue.h; path = b3/B3ConstPtrValue.h; sourceTree = "<group>"; };
+		0FEC85B41BE1462F0080FF74 /* B3InsertionSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3InsertionSet.cpp; path = b3/B3InsertionSet.cpp; sourceTree = "<group>"; };
+		0FEC85B51BE1462F0080FF74 /* B3InsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3InsertionSet.h; path = b3/B3InsertionSet.h; sourceTree = "<group>"; };
+		0FEC85B61BE1462F0080FF74 /* B3InsertionSetInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3InsertionSetInlines.h; path = b3/B3InsertionSetInlines.h; sourceTree = "<group>"; };
+		0FEC85B71BE1462F0080FF74 /* B3ReduceStrength.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ReduceStrength.cpp; path = b3/B3ReduceStrength.cpp; sourceTree = "<group>"; };
+		0FEC85B81BE1462F0080FF74 /* B3ReduceStrength.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ReduceStrength.h; path = b3/B3ReduceStrength.h; sourceTree = "<group>"; };
+		0FEC85BE1BE167A00080FF74 /* B3Effects.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Effects.h; path = b3/B3Effects.h; sourceTree = "<group>"; };
+		0FEC85BF1BE167A00080FF74 /* B3HeapRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3HeapRange.cpp; path = b3/B3HeapRange.cpp; sourceTree = "<group>"; };
+		0FEC85C01BE167A00080FF74 /* B3HeapRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3HeapRange.h; path = b3/B3HeapRange.h; sourceTree = "<group>"; };
+		0FEC85C41BE16F5A0080FF74 /* B3Effects.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Effects.cpp; path = b3/B3Effects.cpp; sourceTree = "<group>"; };
+		0FED67B71B26256D0066CE15 /* DFGConstantHoistingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGConstantHoistingPhase.cpp; path = dfg/DFGConstantHoistingPhase.cpp; sourceTree = "<group>"; };
+		0FED67B81B26256D0066CE15 /* DFGConstantHoistingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGConstantHoistingPhase.h; path = dfg/DFGConstantHoistingPhase.h; sourceTree = "<group>"; };
+		0FEE98401A8865B600754E93 /* SetupVarargsFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SetupVarargsFrame.h; sourceTree = "<group>"; };
+		0FEE98421A89227500754E93 /* SetupVarargsFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SetupVarargsFrame.cpp; sourceTree = "<group>"; };
+		0FEFC9A71681A3B000567F53 /* DFGOSRExitJumpPlaceholder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRExitJumpPlaceholder.cpp; path = dfg/DFGOSRExitJumpPlaceholder.cpp; sourceTree = "<group>"; };
+		0FEFC9A81681A3B000567F53 /* DFGOSRExitJumpPlaceholder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitJumpPlaceholder.h; path = dfg/DFGOSRExitJumpPlaceholder.h; sourceTree = "<group>"; };
+		0FF054F71AC35B4400E5BE57 /* ExecutableAllocationFuzz.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocationFuzz.cpp; sourceTree = "<group>"; };
+		0FF054F81AC35B4400E5BE57 /* ExecutableAllocationFuzz.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableAllocationFuzz.h; sourceTree = "<group>"; };
+		0FF2CD591B61A4F8004955A8 /* DFGMultiGetByOffsetData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMultiGetByOffsetData.cpp; path = dfg/DFGMultiGetByOffsetData.cpp; sourceTree = "<group>"; };
+		0FF2CD5A1B61A4F8004955A8 /* DFGMultiGetByOffsetData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMultiGetByOffsetData.h; path = dfg/DFGMultiGetByOffsetData.h; sourceTree = "<group>"; };
+		0FF4272F158EBD44004CB9FF /* Disassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Disassembler.h; path = disassembler/Disassembler.h; sourceTree = "<group>"; };
+		0FF42730158EBD44004CB9FF /* UDis86Disassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = UDis86Disassembler.cpp; path = disassembler/UDis86Disassembler.cpp; sourceTree = "<group>"; };
+		0FF42734158EBD94004CB9FF /* udis86_decode.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = udis86_decode.c; path = disassembler/udis86/udis86_decode.c; sourceTree = "<group>"; };
+		0FF42735158EBD94004CB9FF /* udis86_decode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = udis86_decode.h; path = disassembler/udis86/udis86_decode.h; sourceTree = "<group>"; };
+		0FF42736158EBD94004CB9FF /* udis86_extern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = udis86_extern.h; path = disassembler/udis86/udis86_extern.h; sourceTree = "<group>"; };
+		0FF42739158EBD94004CB9FF /* udis86_syn-att.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = "udis86_syn-att.c"; path = "disassembler/udis86/udis86_syn-att.c"; sourceTree = "<group>"; };
+		0FF4273A158EBD94004CB9FF /* udis86_syn-intel.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = "udis86_syn-intel.c"; path = "disassembler/udis86/udis86_syn-intel.c"; sourceTree = "<group>"; };
+		0FF4273B158EBD94004CB9FF /* udis86_syn.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = udis86_syn.c; path = disassembler/udis86/udis86_syn.c; sourceTree = "<group>"; };
+		0FF4273C158EBD94004CB9FF /* udis86_syn.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = udis86_syn.h; path = disassembler/udis86/udis86_syn.h; sourceTree = "<group>"; };
+		0FF4273D158EBD94004CB9FF /* udis86_types.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = udis86_types.h; path = disassembler/udis86/udis86_types.h; sourceTree = "<group>"; };
+		0FF4273E158EBD94004CB9FF /* udis86.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = udis86.c; path = disassembler/udis86/udis86.c; sourceTree = "<group>"; };
+		0FF4273F158EBD94004CB9FF /* udis86.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = udis86.h; path = disassembler/udis86/udis86.h; sourceTree = "<group>"; };
+		0FF4274C158EBFE1004CB9FF /* udis86_itab_holder.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = udis86_itab_holder.c; path = disassembler/udis86/udis86_itab_holder.c; sourceTree = "<group>"; };
+		0FF4275615914A20004CB9FF /* LinkBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LinkBuffer.cpp; sourceTree = "<group>"; };
+		0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDisassembler.cpp; path = dfg/DFGDisassembler.cpp; sourceTree = "<group>"; };
+		0FF427621591A1C9004CB9FF /* DFGDisassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDisassembler.h; path = dfg/DFGDisassembler.h; sourceTree = "<group>"; };
+		0FF60ABF16740F8100029779 /* ReduceWhitespace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReduceWhitespace.cpp; sourceTree = "<group>"; };
+		0FF60AC016740F8100029779 /* ReduceWhitespace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReduceWhitespace.h; sourceTree = "<group>"; };
+		0FF7168A15A3B231008F5DAA /* PropertyOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyOffset.h; sourceTree = "<group>"; };
+		0FF72992166AD347000F5BA3 /* ProfilerBytecode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerBytecode.cpp; path = profiler/ProfilerBytecode.cpp; sourceTree = "<group>"; };
+		0FF72993166AD347000F5BA3 /* ProfilerBytecode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerBytecode.h; path = profiler/ProfilerBytecode.h; sourceTree = "<group>"; };
+		0FF72994166AD347000F5BA3 /* ProfilerBytecodes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerBytecodes.cpp; path = profiler/ProfilerBytecodes.cpp; sourceTree = "<group>"; };
+		0FF72995166AD347000F5BA3 /* ProfilerBytecodes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerBytecodes.h; path = profiler/ProfilerBytecodes.h; sourceTree = "<group>"; };
+		0FF72996166AD347000F5BA3 /* ProfilerCompilation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerCompilation.cpp; path = profiler/ProfilerCompilation.cpp; sourceTree = "<group>"; };
+		0FF72997166AD347000F5BA3 /* ProfilerCompilation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerCompilation.h; path = profiler/ProfilerCompilation.h; sourceTree = "<group>"; };
+		0FF72998166AD347000F5BA3 /* ProfilerCompilationKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerCompilationKind.cpp; path = profiler/ProfilerCompilationKind.cpp; sourceTree = "<group>"; };
+		0FF72999166AD347000F5BA3 /* ProfilerCompilationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerCompilationKind.h; path = profiler/ProfilerCompilationKind.h; sourceTree = "<group>"; };
+		0FF7299A166AD347000F5BA3 /* ProfilerCompiledBytecode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerCompiledBytecode.cpp; path = profiler/ProfilerCompiledBytecode.cpp; sourceTree = "<group>"; };
+		0FF7299B166AD347000F5BA3 /* ProfilerCompiledBytecode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerCompiledBytecode.h; path = profiler/ProfilerCompiledBytecode.h; sourceTree = "<group>"; };
+		0FF7299C166AD347000F5BA3 /* ProfilerDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerDatabase.cpp; path = profiler/ProfilerDatabase.cpp; sourceTree = "<group>"; };
+		0FF7299D166AD347000F5BA3 /* ProfilerDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerDatabase.h; path = profiler/ProfilerDatabase.h; sourceTree = "<group>"; };
+		0FF7299E166AD347000F5BA3 /* ProfilerExecutionCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerExecutionCounter.h; path = profiler/ProfilerExecutionCounter.h; sourceTree = "<group>"; };
+		0FF7299F166AD347000F5BA3 /* ProfilerOrigin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerOrigin.cpp; path = profiler/ProfilerOrigin.cpp; sourceTree = "<group>"; };
+		0FF729A0166AD347000F5BA3 /* ProfilerOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerOrigin.h; path = profiler/ProfilerOrigin.h; sourceTree = "<group>"; };
+		0FF729A1166AD347000F5BA3 /* ProfilerOriginStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerOriginStack.cpp; path = profiler/ProfilerOriginStack.cpp; sourceTree = "<group>"; };
+		0FF729A2166AD347000F5BA3 /* ProfilerOriginStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerOriginStack.h; path = profiler/ProfilerOriginStack.h; sourceTree = "<group>"; };
+		0FF8BDE81AD4CF7100DFE884 /* InferredValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredValue.cpp; sourceTree = "<group>"; };
+		0FF8BDE91AD4CF7100DFE884 /* InferredValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredValue.h; sourceTree = "<group>"; };
+		0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };
+		0FF9CE711B9CD6D0004EDCA6 /* PolymorphicAccess.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolymorphicAccess.cpp; sourceTree = "<group>"; };
+		0FF9CE721B9CD6D0004EDCA6 /* PolymorphicAccess.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolymorphicAccess.h; sourceTree = "<group>"; };
+		0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeofType.cpp; sourceTree = "<group>"; };
+		0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeofType.h; sourceTree = "<group>"; };
+		0FFC920F1B94D4DF0071DD66 /* InferredTypeTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredTypeTable.cpp; sourceTree = "<group>"; };
+		0FFC92101B94D4DF0071DD66 /* InferredTypeTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredTypeTable.h; sourceTree = "<group>"; };
+		0FFC92131B94E83E0071DD66 /* DFGDesiredInferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredInferredType.h; path = dfg/DFGDesiredInferredType.h; sourceTree = "<group>"; };
+		0FFC92151B94FB3E0071DD66 /* DFGPropertyTypeKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPropertyTypeKey.h; path = dfg/DFGPropertyTypeKey.h; sourceTree = "<group>"; };
+		0FFC99D0184EC8AD009C10AB /* ConstantMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantMode.h; sourceTree = "<group>"; };
+		0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayBufferNeuteringWatchpoint.cpp; sourceTree = "<group>"; };
+		0FFC99D3184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayBufferNeuteringWatchpoint.h; sourceTree = "<group>"; };
+		0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCFAPhase.cpp; path = dfg/DFGCFAPhase.cpp; sourceTree = "<group>"; };
+		0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFAPhase.h; path = dfg/DFGCFAPhase.h; sourceTree = "<group>"; };
+		0FFFC94D14EF909500C72532 /* DFGCSEPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCSEPhase.cpp; path = dfg/DFGCSEPhase.cpp; sourceTree = "<group>"; };
+		0FFFC94E14EF909500C72532 /* DFGCSEPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCSEPhase.h; path = dfg/DFGCSEPhase.h; sourceTree = "<group>"; };
+		0FFFC94F14EF909500C72532 /* DFGPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPhase.cpp; path = dfg/DFGPhase.cpp; sourceTree = "<group>"; };
+		0FFFC95014EF909500C72532 /* DFGPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPhase.h; path = dfg/DFGPhase.h; sourceTree = "<group>"; };
+		0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPredictionPropagationPhase.cpp; path = dfg/DFGPredictionPropagationPhase.cpp; sourceTree = "<group>"; };
+		0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPredictionPropagationPhase.h; path = dfg/DFGPredictionPropagationPhase.h; sourceTree = "<group>"; };
+		0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVirtualRegisterAllocationPhase.cpp; path = dfg/DFGVirtualRegisterAllocationPhase.cpp; sourceTree = "<group>"; };
+		0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVirtualRegisterAllocationPhase.h; path = dfg/DFGVirtualRegisterAllocationPhase.h; sourceTree = "<group>"; };
+		140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBasePrivate.h; sourceTree = "<group>"; };
+		141211020A48780900480255 /* minidom.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = minidom.c; path = tests/minidom.c; sourceTree = "<group>"; };
+		1412110D0A48788700480255 /* minidom.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = minidom.js; path = tests/minidom.js; sourceTree = "<group>"; };
+		141211200A48793C00480255 /* minidom */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = minidom; sourceTree = BUILT_PRODUCTS_DIR; };
+		14142E501B796ECE00F4BF4B /* UnlinkedFunctionExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedFunctionExecutable.h; sourceTree = "<group>"; };
+		14142E521B796EDD00F4BF4B /* ExecutableInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableInfo.h; sourceTree = "<group>"; };
+		14142E541B7973C000F4BF4B /* UnlinkedFunctionExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedFunctionExecutable.cpp; sourceTree = "<group>"; };
+		141448CA13A176EC00F5BA1A /* MarkedBlockSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedBlockSet.h; sourceTree = "<group>"; };
+		141448CC13A1783700F5BA1A /* TinyBloomFilter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TinyBloomFilter.h; sourceTree = "<group>"; };
+		14150132154BB13F005D8C98 /* WeakSetInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakSetInlines.h; sourceTree = "<group>"; };
+		14201D581DECF26A00904BD3 /* SourceCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceCode.h; sourceTree = "<group>"; };
+		1421359A0A677F4F00A8195E /* JSBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBase.cpp; sourceTree = "<group>"; };
+		142711380A460BBB0080EEEA /* JSBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBase.h; sourceTree = "<group>"; };
+		1429D77B0ED20D7300B89619 /* Interpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Interpreter.h; sourceTree = "<group>"; };
+		1429D7D30ED2128200B89619 /* Interpreter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Interpreter.cpp; sourceTree = "<group>"; };
+		1429D85B0ED218E900B89619 /* CLoopStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CLoopStack.cpp; sourceTree = "<group>"; };
+		1429D8770ED21ACD00B89619 /* ExceptionHelpers.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionHelpers.cpp; sourceTree = "<group>"; };
+		1429D8DB0ED2205B00B89619 /* CallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallFrame.cpp; sourceTree = "<group>"; };
+		1429D8DC0ED2205B00B89619 /* CallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; path = CallFrame.h; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
+		1429D92D0ED22D7000B89619 /* JIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JIT.cpp; sourceTree = "<group>"; };
+		1429D92E0ED22D7000B89619 /* JIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JIT.h; sourceTree = "<group>"; };
+		142D3938103E4560007DCB52 /* NumericStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumericStrings.h; sourceTree = "<group>"; };
+		142D6F0613539A2800B02E86 /* MarkedBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedBlock.cpp; sourceTree = "<group>"; };
+		142D6F0713539A2800B02E86 /* MarkedBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedBlock.h; sourceTree = "<group>"; };
+		142D6F0E13539A4100B02E86 /* MarkStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkStack.cpp; sourceTree = "<group>"; };
+		142D6F0F13539A4100B02E86 /* MarkStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkStack.h; sourceTree = "<group>"; };
+		142E312B134FF0A600AFADB5 /* Handle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Handle.h; sourceTree = "<group>"; };
+		142E312C134FF0A600AFADB5 /* HandleSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HandleSet.cpp; sourceTree = "<group>"; };
+		142E312D134FF0A600AFADB5 /* HandleSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleSet.h; sourceTree = "<group>"; };
+		142E312E134FF0A600AFADB5 /* HandleStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HandleStack.cpp; sourceTree = "<group>"; };
+		142E312F134FF0A600AFADB5 /* HandleStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleStack.h; sourceTree = "<group>"; };
+		142E3130134FF0A600AFADB5 /* Local.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Local.h; sourceTree = "<group>"; };
+		142E3131134FF0A600AFADB5 /* LocalScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalScope.h; sourceTree = "<group>"; };
+		142E3132134FF0A600AFADB5 /* Strong.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Strong.h; sourceTree = "<group>"; };
+		142E3133134FF0A600AFADB5 /* Weak.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Weak.h; sourceTree = "<group>"; };
+		14386A721DD69895008652C4 /* DirectEvalExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DirectEvalExecutable.cpp; sourceTree = "<group>"; };
+		14386A731DD69895008652C4 /* DirectEvalExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DirectEvalExecutable.h; sourceTree = "<group>"; };
+		14386A761DD6989C008652C4 /* IndirectEvalExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IndirectEvalExecutable.cpp; sourceTree = "<group>"; };
+		14386A771DD6989C008652C4 /* IndirectEvalExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IndirectEvalExecutable.h; sourceTree = "<group>"; };
+		1440051F0A531D3B0005F061 /* Node.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Node.h; path = tests/Node.h; sourceTree = "<group>"; };
+		144005200A531D3B0005F061 /* Node.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = Node.c; path = tests/Node.c; sourceTree = "<group>"; };
+		144007480A536CC20005F061 /* NodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NodeList.h; path = tests/NodeList.h; sourceTree = "<group>"; };
+		144007490A536CC20005F061 /* NodeList.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = NodeList.c; path = tests/NodeList.c; sourceTree = "<group>"; };
+		144007550A5370D20005F061 /* JSNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSNodeList.h; path = tests/JSNodeList.h; sourceTree = "<group>"; };
+		144007560A5370D20005F061 /* JSNodeList.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = JSNodeList.c; path = tests/JSNodeList.c; sourceTree = "<group>"; };
+		1440F6410A4F8B6A0005F061 /* JSNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSNode.h; path = tests/JSNode.h; sourceTree = "<group>"; };
+		1440F6420A4F8B6A0005F061 /* JSNode.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = JSNode.c; path = tests/JSNode.c; sourceTree = "<group>"; };
+		1440F88F0A508B100005F061 /* JSCallbackFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackFunction.h; sourceTree = "<group>"; };
+		1440F8900A508B100005F061 /* JSCallbackFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackFunction.cpp; sourceTree = "<group>"; };
+		1440F8AC0A508D200005F061 /* JSCallbackConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackConstructor.h; sourceTree = "<group>"; };
+		1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackConstructor.cpp; sourceTree = "<group>"; };
+		1440FCE10A51E46B0005F061 /* JSClassRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClassRef.h; sourceTree = "<group>"; };
+		1440FCE20A51E46B0005F061 /* JSClassRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSClassRef.cpp; sourceTree = "<group>"; };
+		1442565F15EDE98D0066A49B /* JSWithScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWithScope.cpp; sourceTree = "<group>"; };
+		1442566015EDE98D0066A49B /* JSWithScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWithScope.h; sourceTree = "<group>"; };
+		145722851437E140005FDE26 /* StrongInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StrongInlines.h; sourceTree = "<group>"; };
+		145C507F0D9DF63B0088F6B9 /* CallData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallData.h; sourceTree = "<group>"; };
+		146AAB2A0B66A84900E55F16 /* JSStringRefCF.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSStringRefCF.h; sourceTree = "<group>"; };
+		146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringRefCF.cpp; sourceTree = "<group>"; };
+		146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConservativeRoots.cpp; sourceTree = "<group>"; };
+		146FA5A81378F6B0003627A3 /* HandleTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleTypes.h; sourceTree = "<group>"; };
+		146FE51111A710430087AE66 /* JITCall32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITCall32_64.cpp; sourceTree = "<group>"; };
+		147341CB1DC02D7200AA29BA /* ExecutableBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableBase.h; sourceTree = "<group>"; };
+		147341CD1DC02D7900AA29BA /* ScriptExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptExecutable.h; sourceTree = "<group>"; };
+		147341CF1DC02DB400AA29BA /* NativeExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NativeExecutable.h; sourceTree = "<group>"; };
+		147341D11DC02E2E00AA29BA /* EvalExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EvalExecutable.h; sourceTree = "<group>"; };
+		147341D31DC02E6D00AA29BA /* ProgramExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProgramExecutable.h; sourceTree = "<group>"; };
+		147341D51DC02EB900AA29BA /* ModuleProgramExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModuleProgramExecutable.h; sourceTree = "<group>"; };
+		147341D71DC02F9900AA29BA /* FunctionExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionExecutable.h; sourceTree = "<group>"; };
+		147341DB1DC2CE9600AA29BA /* EvalExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EvalExecutable.cpp; sourceTree = "<group>"; };
+		147341DC1DC2CE9600AA29BA /* FunctionExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionExecutable.cpp; sourceTree = "<group>"; };
+		147341DD1DC2CE9600AA29BA /* ModuleProgramExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModuleProgramExecutable.cpp; sourceTree = "<group>"; };
+		147341DE1DC2CE9600AA29BA /* NativeExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NativeExecutable.cpp; sourceTree = "<group>"; };
+		147341DF1DC2CE9600AA29BA /* ProgramExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProgramExecutable.cpp; sourceTree = "<group>"; };
+		147341E01DC2CE9600AA29BA /* ScriptExecutable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptExecutable.cpp; sourceTree = "<group>"; };
+		147341E91DC2CF2500AA29BA /* ExecutableBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableBase.cpp; sourceTree = "<group>"; };
+		147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BatchedTransitionOptimizer.h; sourceTree = "<group>"; };
+		147B84620E6DE6B1004775A4 /* PutPropertySlot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutPropertySlot.h; sourceTree = "<group>"; };
+		1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerCallFrame.h; sourceTree = "<group>"; };
+		1482B6EA0A4300B300517CFC /* JSValueRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSValueRef.h; sourceTree = "<group>"; };
+		1482B74B0A43032800517CFC /* JSStringRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringRef.h; sourceTree = "<group>"; };
+		1482B74C0A43032800517CFC /* JSStringRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringRef.cpp; sourceTree = "<group>"; };
+		1482B78A0A4305AB00517CFC /* APICast.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APICast.h; sourceTree = "<group>"; };
+		1482B7E10A43076000517CFC /* JSObjectRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectRef.h; sourceTree = "<group>"; };
+		1482B7E20A43076000517CFC /* JSObjectRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSObjectRef.cpp; sourceTree = "<group>"; };
+		14874AE115EBDE4A002E3587 /* JSScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSScope.cpp; sourceTree = "<group>"; };
+		14874AE215EBDE4A002E3587 /* JSScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSScope.h; sourceTree = "<group>"; };
+		148A7BED1B82975A002D9157 /* InlineCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InlineCallFrame.cpp; sourceTree = "<group>"; };
+		148A7BEE1B82975A002D9157 /* InlineCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InlineCallFrame.h; sourceTree = "<group>"; };
+		148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextRefPrivate.h; sourceTree = "<group>"; };
+		149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerCallFrame.cpp; sourceTree = "<group>"; };
+		149B24FF0D8AF6D1009CB8C7 /* Register.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Register.h; sourceTree = "<group>"; };
+		149DAAF212EB559D0083B12B /* ConservativeRoots.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConservativeRoots.h; sourceTree = "<group>"; };
+		14A1563010966365006FA260 /* DateInstanceCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateInstanceCache.h; sourceTree = "<group>"; };
+		14A396A60CD2933100B5B4FF /* SymbolTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolTable.h; sourceTree = "<group>"; };
+		14AB66751DECF40900A56C26 /* UnlinkedSourceCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedSourceCode.h; sourceTree = "<group>"; };
+		14ABB36E099C076400E2A24F /* JSCJSValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCJSValue.h; sourceTree = "<group>"; };
+		14ABB454099C2A0F00E2A24F /* JSType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSType.h; sourceTree = "<group>"; };
+		14ABDF5D0A437FEF00ECCA01 /* JSCallbackObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackObject.h; sourceTree = "<group>"; };
+		14ABDF5E0A437FEF00ECCA01 /* JSCallbackObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackObject.cpp; sourceTree = "<group>"; };
+		14AD91061DCA92940014F9FE /* EvalCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EvalCodeBlock.h; sourceTree = "<group>"; };
+		14AD91071DCA92940014F9FE /* FunctionCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionCodeBlock.h; sourceTree = "<group>"; };
+		14AD91081DCA92940014F9FE /* GlobalCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GlobalCodeBlock.h; sourceTree = "<group>"; };
+		14AD91091DCA92940014F9FE /* ModuleProgramCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModuleProgramCodeBlock.h; sourceTree = "<group>"; };
+		14AD910A1DCA92940014F9FE /* ProgramCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProgramCodeBlock.h; sourceTree = "<group>"; };
+		14AD91121DCA97FD0014F9FE /* EvalCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EvalCodeBlock.cpp; sourceTree = "<group>"; };
+		14AD91131DCA97FD0014F9FE /* ModuleProgramCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModuleProgramCodeBlock.cpp; sourceTree = "<group>"; };
+		14AD91141DCA97FD0014F9FE /* ProgramCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProgramCodeBlock.cpp; sourceTree = "<group>"; };
+		14AD91161DCA97FD0014F9FE /* FunctionCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionCodeBlock.cpp; sourceTree = "<group>"; };
+		14AD911C1DCA9FA40014F9FE /* UnlinkedGlobalCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedGlobalCodeBlock.h; sourceTree = "<group>"; };
+		14AD911D1DCA9FA40014F9FE /* UnlinkedFunctionCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedFunctionCodeBlock.h; sourceTree = "<group>"; };
+		14AD911E1DCA9FA40014F9FE /* UnlinkedEvalCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedEvalCodeBlock.h; sourceTree = "<group>"; };
+		14AD911F1DCA9FA40014F9FE /* UnlinkedModuleProgramCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedModuleProgramCodeBlock.h; sourceTree = "<group>"; };
+		14AD91201DCA9FA40014F9FE /* UnlinkedProgramCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedProgramCodeBlock.h; sourceTree = "<group>"; };
+		14AD91211DCA9FA40014F9FE /* UnlinkedFunctionExecutable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedFunctionExecutable.h; sourceTree = "<group>"; };
+		14AD91281DCAAAB00014F9FE /* UnlinkedEvalCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedEvalCodeBlock.cpp; sourceTree = "<group>"; };
+		14AD91291DCAAAB00014F9FE /* UnlinkedProgramCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedProgramCodeBlock.cpp; sourceTree = "<group>"; };
+		14AD912A1DCAAAB00014F9FE /* UnlinkedModuleProgramCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedModuleProgramCodeBlock.cpp; sourceTree = "<group>"; };
+		14AD912B1DCAAAB00014F9FE /* UnlinkedFunctionCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedFunctionCodeBlock.cpp; sourceTree = "<group>"; };
+		14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MachineStackMarker.cpp; sourceTree = "<group>"; };
+		14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MachineStackMarker.h; sourceTree = "<group>"; };
+		14BA78F013AAB88F005B7C2C /* SlotVisitor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SlotVisitor.h; sourceTree = "<group>"; };
+		14BA7A9513AADFF8005B7C2C /* Heap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Heap.cpp; sourceTree = "<group>"; };
+		14BA7A9613AADFF8005B7C2C /* Heap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Heap.h; sourceTree = "<group>"; };
+		14BD59BF0A3E8F9000BAF59C /* testapi */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = testapi; sourceTree = BUILT_PRODUCTS_DIR; };
+		14BD5A290A3E91F600BAF59C /* JSContextRef.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSContextRef.cpp; sourceTree = "<group>"; };
+		14BD5A2A0A3E91F600BAF59C /* JSContextRef.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSContextRef.h; sourceTree = "<group>"; };
+		14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSValueRef.cpp; sourceTree = "<group>"; };
+		14BD5A2D0A3E91F600BAF59C /* testapi.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = testapi.c; path = API/tests/testapi.c; sourceTree = "<group>"; };
+		14BE7D3217135CF400D1807A /* WeakInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakInlines.h; sourceTree = "<group>"; };
+		14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCMap.h; sourceTree = "<group>"; };
+		14CA958A16AB50DE00938A06 /* StaticPropertyAnalyzer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StaticPropertyAnalyzer.h; sourceTree = "<group>"; };
+		14CA958C16AB50FA00938A06 /* ObjectAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectAllocationProfile.h; sourceTree = "<group>"; };
+		14D2F3D8139F4BE200491031 /* MarkedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedSpace.cpp; sourceTree = "<group>"; };
+		14D2F3D9139F4BE200491031 /* MarkedSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedSpace.h; sourceTree = "<group>"; };
+		14D792640DAA03FB001A9F05 /* CLoopStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CLoopStack.h; sourceTree = "<group>"; };
+		14D844A216AA2C7000A65AF0 /* PrototypeMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PrototypeMap.cpp; sourceTree = "<group>"; };
+		14D844A316AA2C7000A65AF0 /* PrototypeMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrototypeMap.h; sourceTree = "<group>"; };
+		14D857740A4696C80032146C /* testapi.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = testapi.js; path = API/tests/testapi.js; sourceTree = "<group>"; };
+		14DA818E0D99FD2000B0A4FB /* JSLexicalEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSLexicalEnvironment.h; sourceTree = "<group>"; };
+		14DA818F0D99FD2000B0A4FB /* JSLexicalEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSLexicalEnvironment.cpp; sourceTree = "<group>"; };
+		14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = JSGlobalObject.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+		14DF04D916B3996D0016A513 /* StaticPropertyAnalysis.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StaticPropertyAnalysis.h; sourceTree = "<group>"; };
+		14E84F9914EE1ACC00D6D5D4 /* WeakBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WeakBlock.cpp; sourceTree = "<group>"; };
+		14E84F9A14EE1ACC00D6D5D4 /* WeakBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakBlock.h; sourceTree = "<group>"; };
+		14E84F9B14EE1ACC00D6D5D4 /* WeakSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WeakSet.cpp; sourceTree = "<group>"; };
+		14E84F9C14EE1ACC00D6D5D4 /* WeakSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakSet.h; sourceTree = "<group>"; };
+		14E84F9D14EE1ACC00D6D5D4 /* WeakImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakImpl.h; sourceTree = "<group>"; };
+		14F252560D08DD8D004ECFFF /* JSEnvironmentRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEnvironmentRecord.h; sourceTree = "<group>"; };
+		14F7256314EE265E00B1652B /* WeakHandleOwner.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WeakHandleOwner.cpp; sourceTree = "<group>"; };
+		14F7256414EE265E00B1652B /* WeakHandleOwner.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakHandleOwner.h; sourceTree = "<group>"; };
+		169948EDE68D4054B01EF797 /* DefinePropertyAttributes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DefinePropertyAttributes.h; sourceTree = "<group>"; };
+		1879510614C540FFB561C124 /* JSModuleLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSModuleLoader.cpp; sourceTree = "<group>"; };
+		1A28D4A7177B71C80007FA3C /* JSStringRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringRefPrivate.h; sourceTree = "<group>"; };
+		1ACF7376171CA6FB00C9BB1E /* Weak.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Weak.cpp; sourceTree = "<group>"; };
+		1C9051420BA9E8A70081E9D0 /* Version.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Version.xcconfig; sourceTree = "<group>"; };
+		1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = JavaScriptCore.xcconfig; sourceTree = "<group>"; };
+		1C9051440BA9E8A70081E9D0 /* DebugRelease.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = DebugRelease.xcconfig; sourceTree = "<group>"; };
+		1C9051450BA9E8A70081E9D0 /* Base.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Base.xcconfig; sourceTree = "<group>"; };
+		1CAA8B4A0D32C39A0041BCFF /* JavaScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScript.h; sourceTree = "<group>"; };
+		1CAA8B4B0D32C39A0041BCFF /* JavaScriptCore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptCore.h; sourceTree = "<group>"; };
+		2600B5A4152BAAA70091EE5F /* JSStringJoiner.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringJoiner.cpp; sourceTree = "<group>"; };
+		2600B5A5152BAAA70091EE5F /* JSStringJoiner.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringJoiner.h; sourceTree = "<group>"; };
+		262D85B41C0D650F006ACB61 /* AirFixPartialRegisterStalls.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirFixPartialRegisterStalls.cpp; path = b3/air/AirFixPartialRegisterStalls.cpp; sourceTree = "<group>"; };
+		262D85B51C0D650F006ACB61 /* AirFixPartialRegisterStalls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirFixPartialRegisterStalls.h; path = b3/air/AirFixPartialRegisterStalls.h; sourceTree = "<group>"; };
+		264091FA1BE2FD4100684DB2 /* AirOpcode.opcodes */ = {isa = PBXFileReference; lastKnownFileType = text; name = AirOpcode.opcodes; path = b3/air/AirOpcode.opcodes; sourceTree = "<group>"; };
+		26718BA21BE99F780052017B /* AirIteratedRegisterCoalescing.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirIteratedRegisterCoalescing.cpp; path = b3/air/AirIteratedRegisterCoalescing.cpp; sourceTree = "<group>"; };
+		26718BA31BE99F780052017B /* AirIteratedRegisterCoalescing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirIteratedRegisterCoalescing.h; path = b3/air/AirIteratedRegisterCoalescing.h; sourceTree = "<group>"; };
+		2684D4371C00161C0081D663 /* AirLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirLiveness.h; path = b3/air/AirLiveness.h; sourceTree = "<group>"; };
+		269D636D1BFBE5D000101B1D /* FTLOutput.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLOutput.h; path = ftl/FTLOutput.h; sourceTree = "<group>"; };
+		2A05ABD31961DF2400341750 /* JSPropertyNameEnumerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPropertyNameEnumerator.cpp; sourceTree = "<group>"; };
+		2A05ABD41961DF2400341750 /* JSPropertyNameEnumerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPropertyNameEnumerator.h; sourceTree = "<group>"; };
+		2A111243192FCE79005EE18D /* CustomGetterSetter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CustomGetterSetter.cpp; sourceTree = "<group>"; };
+		2A111244192FCE79005EE18D /* CustomGetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CustomGetterSetter.h; sourceTree = "<group>"; };
+		2A343F7418A1748B0039B085 /* GCSegmentedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCSegmentedArray.h; sourceTree = "<group>"; };
+		2A343F7718A1749D0039B085 /* GCSegmentedArrayInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCSegmentedArrayInlines.h; sourceTree = "<group>"; };
+		2A4BB7F218A41179008A0FCD /* JSManagedValueInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSManagedValueInternal.h; sourceTree = "<group>"; };
+		2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeferGC.cpp; sourceTree = "<group>"; };
+		2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EdenGCActivityCallback.cpp; sourceTree = "<group>"; };
+		2A83638418D7D0EE0000EBCC /* EdenGCActivityCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EdenGCActivityCallback.h; sourceTree = "<group>"; };
+		2A83638718D7D0FE0000EBCC /* FullGCActivityCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FullGCActivityCallback.cpp; sourceTree = "<group>"; };
+		2A83638818D7D0FE0000EBCC /* FullGCActivityCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FullGCActivityCallback.h; sourceTree = "<group>"; };
+		2AAAA31018BD49D100394CC8 /* StructureIDBlob.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureIDBlob.h; sourceTree = "<group>"; };
+		2AABCDE618EF294200002096 /* GCLogging.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCLogging.h; sourceTree = "<group>"; };
+		2AACE63A18CA5A0300ED0191 /* GCActivityCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCActivityCallback.cpp; sourceTree = "<group>"; };
+		2AACE63B18CA5A0300ED0191 /* GCActivityCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCActivityCallback.h; sourceTree = "<group>"; };
+		2AD2EDFA19799E38004D6478 /* EnumerationMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EnumerationMode.h; sourceTree = "<group>"; };
+		2AD8932917E3868F00668276 /* HeapIterationScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapIterationScope.h; sourceTree = "<group>"; };
+		2ADFA26218EF3540004F9FCC /* GCLogging.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCLogging.cpp; sourceTree = "<group>"; };
+		2AF7382A18BBBF92008A5A37 /* StructureIDTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureIDTable.cpp; sourceTree = "<group>"; };
+		2AF7382B18BBBF92008A5A37 /* StructureIDTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureIDTable.h; sourceTree = "<group>"; };
+		371D842C17C98B6E00ECF994 /* libz.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libz.dylib; path = usr/lib/libz.dylib; sourceTree = SDKROOT; };
+		412952731D2CF6AC00E78B89 /* builtins_generate_internals_wrapper_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_internals_wrapper_header.py; sourceTree = "<group>"; };
+		412952741D2CF6AC00E78B89 /* builtins_generate_internals_wrapper_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_internals_wrapper_implementation.py; sourceTree = "<group>"; };
+		412952751D2CF6AC00E78B89 /* builtins_generate_wrapper_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_wrapper_header.py; sourceTree = "<group>"; };
+		412952761D2CF6AC00E78B89 /* builtins_generate_wrapper_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_wrapper_implementation.py; sourceTree = "<group>"; };
+		41DEA1311B9F3154006D65DD /* BuiltinUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BuiltinUtils.h; sourceTree = "<group>"; };
+		4319DA011C1BE3C1001D260B /* B3LowerMacrosAfterOptimizations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3LowerMacrosAfterOptimizations.cpp; path = b3/B3LowerMacrosAfterOptimizations.cpp; sourceTree = "<group>"; };
+		4319DA021C1BE3C1001D260B /* B3LowerMacrosAfterOptimizations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3LowerMacrosAfterOptimizations.h; path = b3/B3LowerMacrosAfterOptimizations.h; sourceTree = "<group>"; };
+		4340A4821A9051AF00D73CCA /* MathCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathCommon.cpp; sourceTree = "<group>"; };
+		4340A4831A9051AF00D73CCA /* MathCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathCommon.h; sourceTree = "<group>"; };
+		43422A601C15871B00E2EB98 /* B3ConstFloatValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ConstFloatValue.cpp; path = b3/B3ConstFloatValue.cpp; sourceTree = "<group>"; };
+		43422A611C15871B00E2EB98 /* B3ConstFloatValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ConstFloatValue.h; path = b3/B3ConstFloatValue.h; sourceTree = "<group>"; };
+		43422A641C16221E00E2EB98 /* B3ReduceDoubleToFloat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ReduceDoubleToFloat.cpp; path = b3/B3ReduceDoubleToFloat.cpp; sourceTree = "<group>"; };
+		43422A651C16221E00E2EB98 /* B3ReduceDoubleToFloat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ReduceDoubleToFloat.h; path = b3/B3ReduceDoubleToFloat.h; sourceTree = "<group>"; };
+		436E54511C468E5F00B5AF73 /* B3LegalizeMemoryOffsets.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3LegalizeMemoryOffsets.cpp; path = b3/B3LegalizeMemoryOffsets.cpp; sourceTree = "<group>"; };
+		436E54521C468E5F00B5AF73 /* B3LegalizeMemoryOffsets.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3LegalizeMemoryOffsets.h; path = b3/B3LegalizeMemoryOffsets.h; sourceTree = "<group>"; };
+		43AB26C41C1A52F700D82AE6 /* B3MathExtras.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3MathExtras.cpp; path = b3/B3MathExtras.cpp; sourceTree = "<group>"; };
+		43AB26C51C1A52F700D82AE6 /* B3MathExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3MathExtras.h; path = b3/B3MathExtras.h; sourceTree = "<group>"; };
+		43C392AA1C3BEB0000241F53 /* AssemblerCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AssemblerCommon.h; sourceTree = "<group>"; };
+		43CBA1601CAB67BA00328A5C /* udis86_udint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = udis86_udint.h; path = disassembler/udis86/udis86_udint.h; sourceTree = "<group>"; };
+		449097EE0F8F81B50076A327 /* FeatureDefines.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = FeatureDefines.xcconfig; sourceTree = "<group>"; };
+		451539B812DC994500EF7AC4 /* Yarr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Yarr.h; path = yarr/Yarr.h; sourceTree = "<group>"; };
+		45E12D8806A49B0F00E9DF84 /* jsc.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = jsc.cpp; sourceTree = "<group>"; tabWidth = 4; };
+		51F0EB6105C86C6B00E6DF1B /* Foundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Foundation.framework; path = /System/Library/Frameworks/Foundation.framework; sourceTree = "<absolute>"; };
+		51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libobjc.dylib; path = /usr/lib/libobjc.dylib; sourceTree = "<absolute>"; };
+		52678F8C1A031009006A306D /* BasicBlockLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BasicBlockLocation.cpp; sourceTree = "<group>"; };
+		52678F8D1A031009006A306D /* BasicBlockLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BasicBlockLocation.h; sourceTree = "<group>"; };
+		52678F901A04177C006A306D /* ControlFlowProfiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ControlFlowProfiler.h; sourceTree = "<group>"; };
+		527773DD1AAF83AC00BDE7E8 /* RuntimeType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RuntimeType.cpp; sourceTree = "<group>"; };
+		52B310FA1974AE610080857C /* FunctionHasExecutedCache.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = FunctionHasExecutedCache.h; sourceTree = "<group>"; };
+		52B310FC1974AE870080857C /* FunctionHasExecutedCache.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionHasExecutedCache.cpp; sourceTree = "<group>"; };
+		52B310FE1975B4240080857C /* TypeLocationCache.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeLocationCache.cpp; sourceTree = "<group>"; };
+		52B311001975B4670080857C /* TypeLocationCache.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeLocationCache.h; sourceTree = "<group>"; };
+		52B717B41A0597E1007AF4F3 /* ControlFlowProfiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ControlFlowProfiler.cpp; sourceTree = "<group>"; };
+		52B74B481DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayIteratorAdaptiveWatchpoint.cpp; sourceTree = "<group>"; };
+		52B74B491DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayIteratorAdaptiveWatchpoint.h; sourceTree = "<group>"; };
+		52C0611D1AA51E1B00B4ADBA /* RuntimeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeType.h; sourceTree = "<group>"; };
+		52C952B619A289850069B386 /* TypeProfiler.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeProfiler.h; sourceTree = "<group>"; };
+		52C952B819A28A1C0069B386 /* TypeProfiler.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeProfiler.cpp; sourceTree = "<group>"; };
+		531374BC1D5CE67600AF7A0B /* WasmPlan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmPlan.h; sourceTree = "<group>"; };
+		531374BE1D5CE95000AF7A0B /* WasmPlan.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmPlan.cpp; sourceTree = "<group>"; };
+		533B15DE1DC7F463004D500A /* WasmOps.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmOps.h; sourceTree = "<group>"; };
+		5341FC6F1DAC33E500E7E4D7 /* B3WasmBoundsCheckValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3WasmBoundsCheckValue.cpp; path = b3/B3WasmBoundsCheckValue.cpp; sourceTree = "<group>"; };
+		5341FC711DAC343C00E7E4D7 /* B3WasmBoundsCheckValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3WasmBoundsCheckValue.h; path = b3/B3WasmBoundsCheckValue.h; sourceTree = "<group>"; };
+		53486BB61C1795C300F6F3AF /* JSTypedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArray.h; sourceTree = "<group>"; };
+		53486BBA1C18E84500F6F3AF /* JSTypedArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArray.cpp; sourceTree = "<group>"; };
+		534902821C7242C80012BCB8 /* TypedArrayCTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TypedArrayCTest.cpp; path = API/tests/TypedArrayCTest.cpp; sourceTree = "<group>"; };
+		534902831C7242C80012BCB8 /* TypedArrayCTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TypedArrayCTest.h; path = API/tests/TypedArrayCTest.h; sourceTree = "<group>"; };
+		534C457A1BC703DC007476A7 /* TypedArrayConstructor.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = TypedArrayConstructor.js; sourceTree = "<group>"; };
+		534C457B1BC72411007476A7 /* JSTypedArrayViewConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrayViewConstructor.h; sourceTree = "<group>"; };
+		534C457D1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArrayViewConstructor.cpp; sourceTree = "<group>"; };
+		53529A4B1C457B75000B49C6 /* APIUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APIUtils.h; sourceTree = "<group>"; };
+		535557131D9D9EA5006D583B /* WasmMemory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmMemory.h; sourceTree = "<group>"; };
+		535557151D9DFA32006D583B /* WasmMemory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmMemory.cpp; sourceTree = "<group>"; };
+		5370B4F31BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AdaptiveInferredPropertyValueWatchpointBase.cpp; sourceTree = "<group>"; };
+		5370B4F41BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AdaptiveInferredPropertyValueWatchpointBase.h; sourceTree = "<group>"; };
+		53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayViewPrototypeFunctions.h; sourceTree = "<group>"; };
+		53917E7C1B791106000EBD33 /* JSTypedArrayViewPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrayViewPrototype.h; sourceTree = "<group>"; };
+		53917E831B791CB8000EBD33 /* TypedArrayPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = TypedArrayPrototype.js; path = builtins/TypedArrayPrototype.js; sourceTree = SOURCE_ROOT; };
+		539EB0711D553DF800C82EF7 /* testWasm.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = testWasm.cpp; sourceTree = "<group>"; };
+		539FB8B91C99DA7C00940FA1 /* JSArrayInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayInlines.h; sourceTree = "<group>"; };
+		53D444DB1DAF08AB00B92784 /* B3WasmAddressValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3WasmAddressValue.h; path = b3/B3WasmAddressValue.h; sourceTree = "<group>"; };
+		53D444DD1DAF09A000B92784 /* B3WasmAddressValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3WasmAddressValue.cpp; path = b3/B3WasmAddressValue.cpp; sourceTree = "<group>"; };
+		53F256E11B87E28000B4B768 /* JSTypedArrayViewPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArrayViewPrototype.cpp; sourceTree = "<group>"; };
+		53F40E841D58F9770099A1B6 /* WasmSections.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmSections.h; sourceTree = "<group>"; };
+		53F40E8A1D5901BB0099A1B6 /* WasmFunctionParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmFunctionParser.h; sourceTree = "<group>"; };
+		53F40E8C1D5901F20099A1B6 /* WasmParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmParser.h; sourceTree = "<group>"; };
+		53F40E8E1D5902820099A1B6 /* WasmB3IRGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmB3IRGenerator.cpp; sourceTree = "<group>"; };
+		53F40E921D5A4AB30099A1B6 /* WasmB3IRGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmB3IRGenerator.h; sourceTree = "<group>"; };
+		53F40E941D5A7AEF0099A1B6 /* WasmModuleParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmModuleParser.h; sourceTree = "<group>"; };
+		53F40E961D5A7BEC0099A1B6 /* WasmModuleParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmModuleParser.cpp; sourceTree = "<group>"; };
+		53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InternalFunctionAllocationProfile.h; sourceTree = "<group>"; };
+		53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.h; sourceTree = "<group>"; };
+		53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp; sourceTree = "<group>"; };
+		53FD04D11D7AB187003287D3 /* WasmCallingConvention.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmCallingConvention.cpp; sourceTree = "<group>"; };
+		53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmCallingConvention.h; sourceTree = "<group>"; };
+		53FF7F981DBFCD9000A26CCC /* WasmValidate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmValidate.h; sourceTree = "<group>"; };
+		53FF7F9A1DBFD2B900A26CCC /* WasmValidate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmValidate.cpp; sourceTree = "<group>"; };
+		5B70CFD81DB69E5C00EC23F9 /* JSAsyncFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSAsyncFunction.h; sourceTree = "<group>"; };
+		5B70CFD91DB69E5C00EC23F9 /* JSAsyncFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAsyncFunction.cpp; sourceTree = "<group>"; };
+		5B70CFDA1DB69E5C00EC23F9 /* AsyncFunctionPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncFunctionPrototype.h; sourceTree = "<group>"; };
+		5B70CFDB1DB69E5C00EC23F9 /* AsyncFunctionPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncFunctionPrototype.cpp; sourceTree = "<group>"; };
+		5B70CFDC1DB69E5C00EC23F9 /* AsyncFunctionConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncFunctionConstructor.h; sourceTree = "<group>"; };
+		5B70CFDD1DB69E5C00EC23F9 /* AsyncFunctionConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncFunctionConstructor.cpp; sourceTree = "<group>"; };
+		5B8243041DB7AA4900EA6384 /* AsyncFunctionPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = AsyncFunctionPrototype.js; sourceTree = "<group>"; };
+		5C4E8E941DBEBDA20036F1FC /* JSONParseTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSONParseTest.cpp; path = API/tests/JSONParseTest.cpp; sourceTree = "<group>"; };
+		5C4E8E951DBEBDA20036F1FC /* JSONParseTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSONParseTest.h; path = API/tests/JSONParseTest.h; sourceTree = "<group>"; };
+		5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libedit.dylib; path = /usr/lib/libedit.dylib; sourceTree = "<absolute>"; };
+		5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = JSC.xcconfig; sourceTree = "<group>"; };
+		5DDDF44614FEE72200B4FB4D /* LLIntDesiredOffsets.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntDesiredOffsets.h; path = LLIntOffsets/LLIntDesiredOffsets.h; sourceTree = BUILT_PRODUCTS_DIR; };
+		5DE3D0F40DD8DDFB00468714 /* WebKitAvailability.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAvailability.h; sourceTree = "<group>"; };
+		623A37EB1B87A7BD00754209 /* RegisterMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterMap.h; sourceTree = "<group>"; };
+		627673211B680C1E00FD9F2E /* CallMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallMode.cpp; sourceTree = "<group>"; };
+		627673221B680C1E00FD9F2E /* CallMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallMode.h; sourceTree = "<group>"; };
+		62A9A29E1B0BED4800BD54CA /* DFGLazyNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLazyNode.cpp; path = dfg/DFGLazyNode.cpp; sourceTree = "<group>"; };
+		62A9A29F1B0BED4800BD54CA /* DFGLazyNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLazyNode.h; path = dfg/DFGLazyNode.h; sourceTree = "<group>"; };
+		62D2D38D1ADF103F000206C1 /* FunctionRareData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionRareData.cpp; sourceTree = "<group>"; };
+		62D2D38E1ADF103F000206C1 /* FunctionRareData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionRareData.h; sourceTree = "<group>"; };
+		62D755D01B84FB39001801FA /* CallFrameShuffler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallFrameShuffler.cpp; sourceTree = "<group>"; };
+		62D755D11B84FB39001801FA /* CallFrameShuffler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameShuffler.h; sourceTree = "<group>"; };
+		62D755D21B84FB39001801FA /* CallFrameShuffler32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallFrameShuffler32_64.cpp; sourceTree = "<group>"; };
+		62D755D31B84FB39001801FA /* CallFrameShuffler64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallFrameShuffler64.cpp; sourceTree = "<group>"; };
+		62E3D5EF1B8D0B7300B868BB /* DataFormat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DataFormat.cpp; sourceTree = "<group>"; };
+		62EC9BB41B7EB07C00303AD1 /* CallFrameShuffleData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallFrameShuffleData.cpp; sourceTree = "<group>"; };
+		62EC9BB51B7EB07C00303AD1 /* CallFrameShuffleData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameShuffleData.h; sourceTree = "<group>"; };
+		6507D2970E871E4A00D7D896 /* JSTypeInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypeInfo.h; sourceTree = "<group>"; };
+		651122E5140469BA002B101D /* testRegExp.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = testRegExp.cpp; sourceTree = "<group>"; };
+		6511230514046A4C002B101D /* testRegExp */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = testRegExp; sourceTree = BUILT_PRODUCTS_DIR; };
+		6514F21718B3E1670098FF8B /* Bytecodes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Bytecodes.h; sourceTree = "<group>"; };
+		6514F21818B3E1670098FF8B /* InitBytecodes.asm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.asm.asm; path = InitBytecodes.asm; sourceTree = "<group>"; };
+		6529FB3018B2D63900C61102 /* generate-bytecode-files */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = "generate-bytecode-files"; sourceTree = "<group>"; };
+		6529FB3118B2D99900C61102 /* BytecodeList.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = BytecodeList.json; sourceTree = "<group>"; };
+		652A3A201651C66100A80AFE /* ARM64Disassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ARM64Disassembler.cpp; path = disassembler/ARM64Disassembler.cpp; sourceTree = "<group>"; };
+		652A3A221651C69700A80AFE /* A64DOpcode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = A64DOpcode.cpp; path = disassembler/ARM64/A64DOpcode.cpp; sourceTree = "<group>"; };
+		652A3A231651C69700A80AFE /* A64DOpcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = A64DOpcode.h; path = disassembler/ARM64/A64DOpcode.h; sourceTree = "<group>"; };
+		65303D631447B9E100D3F904 /* ParserTokens.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserTokens.h; sourceTree = "<group>"; };
+		65400C100A69BAF200509887 /* PropertyNameArray.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PropertyNameArray.h; sourceTree = "<group>"; };
+		6540C79C1B82D99D000F6B79 /* RegisterAtOffsetList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegisterAtOffsetList.cpp; sourceTree = "<group>"; };
+		6540C79D1B82D99D000F6B79 /* RegisterAtOffsetList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterAtOffsetList.h; sourceTree = "<group>"; };
+		6540C79E1B82D9CE000F6B79 /* RegisterAtOffset.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegisterAtOffset.cpp; sourceTree = "<group>"; };
+		6540C79F1B82D9CE000F6B79 /* RegisterAtOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterAtOffset.h; sourceTree = "<group>"; };
+		6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = NullGetterFunction.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+		6546F5201A32A59C006F07D5 /* NullGetterFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NullGetterFunction.h; sourceTree = "<group>"; };
+		654788421C937D2C000781A0 /* RegExpPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = RegExpPrototype.js; sourceTree = "<group>"; };
+		65525FC31A6DD3B3007B5495 /* NullSetterFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NullSetterFunction.cpp; sourceTree = "<group>"; };
+		65525FC41A6DD3B3007B5495 /* NullSetterFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NullSetterFunction.h; sourceTree = "<group>"; };
+		6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CommonSlowPathsExceptions.cpp; sourceTree = "<group>"; };
+		6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPathsExceptions.h; sourceTree = "<group>"; };
+		65570F581AA4C00A009B3C23 /* Regress141275.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Regress141275.h; path = API/tests/Regress141275.h; sourceTree = "<group>"; };
+		65570F591AA4C00A009B3C23 /* Regress141275.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = Regress141275.mm; path = API/tests/Regress141275.mm; sourceTree = "<group>"; };
+		655EB29A10CE2581001A990E /* NodesCodegen.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodesCodegen.cpp; sourceTree = "<group>"; };
+		6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreFoundation.framework; path = /System/Library/Frameworks/CoreFoundation.framework; sourceTree = "<absolute>"; };
+		65621E6B089E859700760F35 /* PropertySlot.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertySlot.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		65621E6C089E859700760F35 /* PropertySlot.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = PropertySlot.h; sourceTree = "<group>"; tabWidth = 8; };
+		657CF45619BF6662004ACBF2 /* JSCallee.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallee.cpp; sourceTree = "<group>"; };
+		657CF45719BF6662004ACBF2 /* JSCallee.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallee.h; sourceTree = "<group>"; };
+		65860177185A8F5E00030EEE /* MaxFrameExtentForSlowPathCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MaxFrameExtentForSlowPathCall.h; sourceTree = "<group>"; };
+		658D3A5519638268003C45D6 /* VMEntryRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; path = VMEntryRecord.h; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
+		65987F2C167FE84B003C2F8D /* DFGOSRExitCompilationInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRExitCompilationInfo.h; path = dfg/DFGOSRExitCompilationInfo.h; sourceTree = "<group>"; };
+		65987F2F16828A7E003C2F8D /* UnusedPointer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnusedPointer.h; sourceTree = "<group>"; };
+		65A946131C8E9F2000A7209A /* generateYarrCanonicalizeUnicode */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generateYarrCanonicalizeUnicode; sourceTree = "<group>"; };
+		65A946141C8E9F6F00A7209A /* YarrCanonicalizeUnicode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = YarrCanonicalizeUnicode.cpp; sourceTree = "<group>"; };
+		65B8392C1BACA92A0044E824 /* CachedRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedRecovery.h; sourceTree = "<group>"; };
+		65B8392D1BACA9D30044E824 /* CachedRecovery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedRecovery.cpp; sourceTree = "<group>"; };
+		65C0284F171795E200351E35 /* ARMv7Disassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ARMv7Disassembler.cpp; path = disassembler/ARMv7Disassembler.cpp; sourceTree = "<group>"; };
+		65C0285A1717966800351E35 /* ARMv7DOpcode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ARMv7DOpcode.cpp; sourceTree = "<group>"; };
+		65C0285B1717966800351E35 /* ARMv7DOpcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ARMv7DOpcode.h; sourceTree = "<group>"; };
+		65C02FBB0637462A003E7EE6 /* Protect.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Protect.h; sourceTree = "<group>"; tabWidth = 8; };
+		65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSWrapperObject.cpp; sourceTree = "<group>"; };
+		65C7A1720A8EAACB00FA37EA /* JSWrapperObject.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSWrapperObject.h; sourceTree = "<group>"; };
+		65E866ED0DD59AFA00A2B2A1 /* SourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProvider.h; sourceTree = "<group>"; };
+		65EA4C99092AF9E20093D800 /* JSLock.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSLock.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		65EA4C9A092AF9E20093D800 /* JSLock.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JSLock.h; sourceTree = "<group>"; tabWidth = 8; };
+		65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CommonIdentifiers.cpp; sourceTree = "<group>"; };
+		65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CommonIdentifiers.h; sourceTree = "<group>"; };
+		65FB5115184EE8F800C12B70 /* ProtoCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProtoCallFrame.h; sourceTree = "<group>"; };
+		65FB5116184EE9BC00C12B70 /* ProtoCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProtoCallFrame.cpp; sourceTree = "<group>"; };
+		6A38CFA71E32B58B0060206F /* AsyncStackTrace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncStackTrace.cpp; sourceTree = "<group>"; };
+		6A38CFA81E32B58B0060206F /* AsyncStackTrace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncStackTrace.h; sourceTree = "<group>"; };
+		6AD2CB4C19B9140100065719 /* DebuggerEvalEnabler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerEvalEnabler.h; sourceTree = "<group>"; };
+		70113D491A8DB093003848C4 /* IteratorOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IteratorOperations.cpp; sourceTree = "<group>"; };
+		70113D4A1A8DB093003848C4 /* IteratorOperations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IteratorOperations.h; sourceTree = "<group>"; };
+		7013CA891B491A9400CAE613 /* JSJob.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSJob.cpp; sourceTree = "<group>"; };
+		7013CA8A1B491A9400CAE613 /* JSJob.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSJob.h; sourceTree = "<group>"; };
+		7035587C1C418419004BD7BF /* MapPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = MapPrototype.js; sourceTree = "<group>"; };
+		7035587D1C418419004BD7BF /* SetPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = SetPrototype.js; sourceTree = "<group>"; };
+		7035587E1C418458004BD7BF /* MapPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapPrototype.lut.h; sourceTree = "<group>"; };
+		7035587F1C418458004BD7BF /* SetPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SetPrototype.lut.h; sourceTree = "<group>"; };
+		704FD35305697E6D003DBED9 /* BooleanObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = BooleanObject.h; sourceTree = "<group>"; tabWidth = 8; };
+		705B41A31A6E501E00716757 /* Symbol.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Symbol.cpp; sourceTree = "<group>"; };
+		705B41A41A6E501E00716757 /* Symbol.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Symbol.h; sourceTree = "<group>"; };
+		705B41A51A6E501E00716757 /* SymbolConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SymbolConstructor.cpp; sourceTree = "<group>"; };
+		705B41A61A6E501E00716757 /* SymbolConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolConstructor.h; sourceTree = "<group>"; };
+		705B41A71A6E501E00716757 /* SymbolObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SymbolObject.cpp; sourceTree = "<group>"; };
+		705B41A81A6E501E00716757 /* SymbolObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolObject.h; sourceTree = "<group>"; };
+		705B41A91A6E501E00716757 /* SymbolPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SymbolPrototype.cpp; sourceTree = "<group>"; };
+		705B41AA1A6E501E00716757 /* SymbolPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolPrototype.h; sourceTree = "<group>"; };
+		708EBE231CE8F35000453146 /* IntlObjectInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlObjectInlines.h; sourceTree = "<group>"; };
+		7094C4DC1AE439530041A2EE /* BytecodeIntrinsicRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BytecodeIntrinsicRegistry.cpp; sourceTree = "<group>"; };
+		7094C4DD1AE439530041A2EE /* BytecodeIntrinsicRegistry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeIntrinsicRegistry.h; sourceTree = "<group>"; };
+		709FB8611AE335C60039D069 /* JSWeakSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakSet.cpp; sourceTree = "<group>"; };
+		709FB8621AE335C60039D069 /* JSWeakSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakSet.h; sourceTree = "<group>"; };
+		709FB8631AE335C60039D069 /* WeakSetConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WeakSetConstructor.cpp; sourceTree = "<group>"; };
+		709FB8641AE335C60039D069 /* WeakSetConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakSetConstructor.h; sourceTree = "<group>"; };
+		709FB8651AE335C60039D069 /* WeakSetPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WeakSetPrototype.cpp; sourceTree = "<group>"; };
+		709FB8661AE335C60039D069 /* WeakSetPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakSetPrototype.h; sourceTree = "<group>"; };
+		70B0A9D01A9B66200001306A /* RuntimeFlags.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeFlags.h; sourceTree = "<group>"; };
+		70B791851C024432002481E2 /* GeneratorFunctionConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeneratorFunctionConstructor.cpp; sourceTree = "<group>"; };
+		70B791861C024432002481E2 /* GeneratorFunctionConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeneratorFunctionConstructor.h; sourceTree = "<group>"; };
+		70B791871C024432002481E2 /* GeneratorFunctionPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeneratorFunctionPrototype.cpp; sourceTree = "<group>"; };
+		70B791881C024432002481E2 /* GeneratorFunctionPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeneratorFunctionPrototype.h; sourceTree = "<group>"; };
+		70B791891C024432002481E2 /* GeneratorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeneratorPrototype.cpp; sourceTree = "<group>"; };
+		70B7918A1C024432002481E2 /* GeneratorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeneratorPrototype.h; sourceTree = "<group>"; };
+		70B7918C1C024462002481E2 /* JSGeneratorFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGeneratorFunction.cpp; sourceTree = "<group>"; };
+		70B7918D1C024462002481E2 /* JSGeneratorFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGeneratorFunction.h; sourceTree = "<group>"; };
+		70B7918E1C0244C9002481E2 /* SourceCodeKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceCodeKey.h; sourceTree = "<group>"; };
+		70B7918F1C0244EC002481E2 /* GeneratorPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = GeneratorPrototype.js; sourceTree = "<group>"; };
+		70B791901C0246CE002481E2 /* GeneratorPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeneratorPrototype.lut.h; sourceTree = "<group>"; };
+		70DC3E071B2DF2C700054299 /* IteratorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IteratorPrototype.cpp; sourceTree = "<group>"; };
+		70DC3E081B2DF2C700054299 /* IteratorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IteratorPrototype.h; sourceTree = "<group>"; };
+		70DE9A081BE7D670005D89D9 /* LLIntAssembly.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntAssembly.h; sourceTree = "<group>"; };
+		70EC0EBC1AA0D7DA00B6AAFA /* JSStringIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStringIterator.cpp; sourceTree = "<group>"; };
+		70EC0EBD1AA0D7DA00B6AAFA /* JSStringIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringIterator.h; sourceTree = "<group>"; };
+		70EC0EC01AA0D7DA00B6AAFA /* StringIteratorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringIteratorPrototype.cpp; sourceTree = "<group>"; };
+		70EC0EC11AA0D7DA00B6AAFA /* StringIteratorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringIteratorPrototype.h; sourceTree = "<group>"; };
+		70ECA6001AFDBEA200449739 /* JSTemplateRegistryKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTemplateRegistryKey.cpp; sourceTree = "<group>"; };
+		70ECA6011AFDBEA200449739 /* JSTemplateRegistryKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTemplateRegistryKey.h; sourceTree = "<group>"; };
+		70ECA6021AFDBEA200449739 /* TemplateRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TemplateRegistry.cpp; sourceTree = "<group>"; };
+		70ECA6031AFDBEA200449739 /* TemplateRegistry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemplateRegistry.h; sourceTree = "<group>"; };
+		70ECA6041AFDBEA200449739 /* TemplateRegistryKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TemplateRegistryKey.h; sourceTree = "<group>"; };
+		72AAF7CB1D0D318B005E60BE /* JSCustomGetterSetterFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCustomGetterSetterFunction.cpp; sourceTree = "<group>"; };
+		72AAF7CC1D0D318B005E60BE /* JSCustomGetterSetterFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCustomGetterSetterFunction.h; sourceTree = "<group>"; };
+		77B25CB2C3094A92A38E1DB3 /* JSModuleLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSModuleLoader.h; sourceTree = "<group>"; };
+		7905BB661D12050E0019FE57 /* InlineAccess.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InlineAccess.cpp; sourceTree = "<group>"; };
+		7905BB671D12050E0019FE57 /* InlineAccess.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InlineAccess.h; sourceTree = "<group>"; };
+		79160DBB1C8E3EC8008C085A /* ProxyRevoke.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyRevoke.cpp; sourceTree = "<group>"; };
+		79160DBC1C8E3EC8008C085A /* ProxyRevoke.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyRevoke.h; sourceTree = "<group>"; };
+		7919B77F1E03559C005BEED8 /* B3Compile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3Compile.h; path = b3/B3Compile.h; sourceTree = "<group>"; };
+		79233C291D34715700C5A834 /* JITMathIC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITMathIC.h; sourceTree = "<group>"; };
+		792CB3471C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PCToCodeOriginMap.cpp; sourceTree = "<group>"; };
+		792CB3481C4EED5C00D13AF3 /* PCToCodeOriginMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PCToCodeOriginMap.h; sourceTree = "<group>"; };
+		795B19951D78BE3500262FA0 /* MapBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapBase.cpp; sourceTree = "<group>"; };
+		795B19961D78BE3500262FA0 /* MapBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapBase.h; sourceTree = "<group>"; };
+		795F099C1E03600500BBE37F /* B3Compile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3Compile.cpp; path = b3/B3Compile.cpp; sourceTree = "<group>"; };
+		796465681B952FF0003059EE /* GetPutInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetPutInfo.h; sourceTree = "<group>"; };
+		796FB4391DFF8C3F0039C95D /* JSWebAssemblyHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyHelpers.h; path = js/JSWebAssemblyHelpers.h; sourceTree = "<group>"; };
+		797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalLexicalEnvironment.cpp; sourceTree = "<group>"; };
+		797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalLexicalEnvironment.h; sourceTree = "<group>"; };
+		7980C16A1E3A940E00B71615 /* DFGRegisteredStructureSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGRegisteredStructureSet.cpp; path = dfg/DFGRegisteredStructureSet.cpp; sourceTree = "<group>"; };
+		7980C16B1E3A940E00B71615 /* DFGRegisteredStructureSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRegisteredStructureSet.h; path = dfg/DFGRegisteredStructureSet.h; sourceTree = "<group>"; };
+		798937761DCAB57300F8D4FB /* JSFixedArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFixedArray.cpp; sourceTree = "<group>"; };
+		798937771DCAB57300F8D4FB /* JSFixedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFixedArray.h; sourceTree = "<group>"; };
+		799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PCToOriginMap.h; path = b3/B3PCToOriginMap.h; sourceTree = "<group>"; };
+		79A0907D1D768465008B889B /* HashMapImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HashMapImpl.cpp; sourceTree = "<group>"; };
+		79A0907E1D768465008B889B /* HashMapImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashMapImpl.h; sourceTree = "<group>"; };
+		79A228331D35D71E00D8E067 /* ArithProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArithProfile.cpp; sourceTree = "<group>"; };
+		79A228341D35D71E00D8E067 /* ArithProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArithProfile.h; sourceTree = "<group>"; };
+		79A899FE1D38612E00D18C73 /* JITMathICForwards.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITMathICForwards.h; sourceTree = "<group>"; };
+		79AF0BE31D3EFD4C00E95FA5 /* JITMathICInlineResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITMathICInlineResult.h; sourceTree = "<group>"; };
+		79B00CB81C6AB07E0088C65D /* ProxyConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyConstructor.cpp; sourceTree = "<group>"; };
+		79B00CB91C6AB07E0088C65D /* ProxyConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyConstructor.h; sourceTree = "<group>"; };
+		79B00CBA1C6AB07E0088C65D /* ProxyObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyObject.cpp; sourceTree = "<group>"; };
+		79B00CBB1C6AB07E0088C65D /* ProxyObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyObject.h; sourceTree = "<group>"; };
+		79B759711DFA4C600052174C /* WasmMemoryInformation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmMemoryInformation.cpp; sourceTree = "<group>"; };
+		79B759721DFA4C600052174C /* WasmMemoryInformation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmMemoryInformation.h; sourceTree = "<group>"; };
+		79B759731DFA4C600052174C /* WasmPageCount.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmPageCount.h; sourceTree = "<group>"; };
+		79B819921DD25CF500DDC714 /* JSGlobalObjectInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectInlines.h; sourceTree = "<group>"; };
+		79C4B15B1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLiveCatchVariablePreservationPhase.cpp; path = dfg/DFGLiveCatchVariablePreservationPhase.cpp; sourceTree = "<group>"; };
+		79C4B15C1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLiveCatchVariablePreservationPhase.h; path = dfg/DFGLiveCatchVariablePreservationPhase.h; sourceTree = "<group>"; };
+		79CFC6EF1C33B10000C768EA /* LLIntPCRanges.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntPCRanges.h; path = llint/LLIntPCRanges.h; sourceTree = "<group>"; };
+		79D5CD581C1106A900CECA07 /* SamplingProfiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingProfiler.cpp; sourceTree = "<group>"; };
+		79D5CD591C1106A900CECA07 /* SamplingProfiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SamplingProfiler.h; sourceTree = "<group>"; };
+		79DAE2791E03C82200B526AA /* WasmExceptionType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmExceptionType.h; sourceTree = "<group>"; };
+		79DFCBDA1D88C59600527D03 /* HasOwnPropertyCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HasOwnPropertyCache.h; sourceTree = "<group>"; };
+		79E423E01DEE65320078D355 /* JSWebAssemblyCallee.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyCallee.cpp; path = js/JSWebAssemblyCallee.cpp; sourceTree = "<group>"; };
+		79E423E11DEE65320078D355 /* JSWebAssemblyCallee.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyCallee.h; path = js/JSWebAssemblyCallee.h; sourceTree = "<group>"; };
+		79EE0BFD1B4AFB85000385C9 /* VariableEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VariableEnvironment.cpp; sourceTree = "<group>"; };
+		79EE0BFE1B4AFB85000385C9 /* VariableEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VariableEnvironment.h; sourceTree = "<group>"; };
+		79F8FC1C1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMaximalFlushInsertionPhase.cpp; path = dfg/DFGMaximalFlushInsertionPhase.cpp; sourceTree = "<group>"; };
+		79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMaximalFlushInsertionPhase.h; path = dfg/DFGMaximalFlushInsertionPhase.h; sourceTree = "<group>"; };
+		79FC8A071E32E9F000D88F0E /* DFGRegisteredStructure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRegisteredStructure.h; path = dfg/DFGRegisteredStructure.h; sourceTree = "<group>"; };
+		7BC547D21B69599B00959B58 /* WasmFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmFormat.h; sourceTree = "<group>"; };
+		7C008CD8187124BB00955C24 /* JSPromiseDeferred.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPromiseDeferred.cpp; sourceTree = "<group>"; };
+		7C008CD9187124BB00955C24 /* JSPromiseDeferred.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPromiseDeferred.h; sourceTree = "<group>"; };
+		7C008CE5187631B600955C24 /* Microtask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Microtask.h; sourceTree = "<group>"; };
+		7C184E1817BEDBD3007CB63A /* JSPromise.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPromise.cpp; sourceTree = "<group>"; };
+		7C184E1917BEDBD3007CB63A /* JSPromise.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPromise.h; sourceTree = "<group>"; };
+		7C184E1C17BEE22E007CB63A /* JSPromisePrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = JSPromisePrototype.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+		7C184E1D17BEE22E007CB63A /* JSPromisePrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPromisePrototype.h; sourceTree = "<group>"; };
+		7C184E2017BEE240007CB63A /* JSPromiseConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = JSPromiseConstructor.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+		7C184E2117BEE240007CB63A /* JSPromiseConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPromiseConstructor.h; sourceTree = "<group>"; };
+		7C184E2417BFFA36007CB63A /* JSPromiseConstructor.lut.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSPromiseConstructor.lut.h; sourceTree = "<group>"; };
+		7C184E2517BFFA36007CB63A /* JSPromisePrototype.lut.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSPromisePrototype.lut.h; sourceTree = "<group>"; };
+		7CF9BC581B65D9A3009DB1EF /* ArrayConstructor.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = ArrayConstructor.js; sourceTree = "<group>"; };
+		7CF9BC591B65D9A3009DB1EF /* ArrayIteratorPrototype.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = ArrayIteratorPrototype.js; sourceTree = "<group>"; };
+		7CF9BC5A1B65D9A3009DB1EF /* GlobalObject.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = GlobalObject.js; sourceTree = "<group>"; };
+		7CF9BC5B1B65D9A3009DB1EF /* IteratorPrototype.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = IteratorPrototype.js; sourceTree = "<group>"; };
+		7CF9BC5C1B65D9B1009DB1EF /* ObjectConstructor.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = ObjectConstructor.js; sourceTree = "<group>"; };
+		7CF9BC5D1B65D9B1009DB1EF /* PromiseOperations.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = PromiseOperations.js; sourceTree = "<group>"; };
+		7CF9BC5E1B65D9B1009DB1EF /* PromiseConstructor.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = PromiseConstructor.js; sourceTree = "<group>"; };
+		7CF9BC5F1B65D9B1009DB1EF /* ReflectObject.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = ReflectObject.js; sourceTree = "<group>"; };
+		7CF9BC601B65D9B1009DB1EF /* StringConstructor.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = StringConstructor.js; sourceTree = "<group>"; };
+		7CF9BC611B65D9B1009DB1EF /* StringIteratorPrototype.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = StringIteratorPrototype.js; sourceTree = "<group>"; };
+		7CFBAC1C18B535E500D00750 /* PromisePrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = PromisePrototype.js; sourceTree = "<group>"; };
+		7E4EE7080EBB7963005934AA /* StructureChain.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureChain.h; sourceTree = "<group>"; };
+		7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureChain.cpp; sourceTree = "<group>"; };
+		860161DF0F3A83C100F84710 /* AbstractMacroAssembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractMacroAssembler.h; sourceTree = "<group>"; };
+		860161E00F3A83C100F84710 /* MacroAssemblerX86.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerX86.h; sourceTree = "<group>"; };
+		860161E10F3A83C100F84710 /* MacroAssemblerX86_64.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerX86_64.h; sourceTree = "<group>"; };
+		860161E20F3A83C100F84710 /* MacroAssemblerX86Common.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerX86Common.h; sourceTree = "<group>"; };
+		8603CEF214C7546400AE59E3 /* CodeProfiling.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeProfiling.cpp; sourceTree = "<group>"; };
+		8603CEF314C7546400AE59E3 /* CodeProfiling.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeProfiling.h; sourceTree = "<group>"; };
+		8604F4F2143A6C4400B295F5 /* ChangeLog */ = {isa = PBXFileReference; lastKnownFileType = text; lineEnding = 0; path = ChangeLog; sourceTree = "<group>"; };
+		8606DDE918DA44AB00A383D0 /* IdentifierInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IdentifierInlines.h; sourceTree = "<group>"; };
+		8612E4CB1522918400C836BE /* MatchResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MatchResult.h; sourceTree = "<group>"; };
+		86158AB2155C8B3F00B45C9C /* PropertyName.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyName.h; sourceTree = "<group>"; };
+		862553CE16136AA5009F17D0 /* JSProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSProxy.cpp; sourceTree = "<group>"; };
+		862553CF16136AA5009F17D0 /* JSProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSProxy.h; sourceTree = "<group>"; };
+		863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerCodeRef.h; sourceTree = "<group>"; };
+		863C6D981521111200585E4E /* YarrCanonicalizeUCS2.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrCanonicalizeUCS2.cpp; path = yarr/YarrCanonicalizeUCS2.cpp; sourceTree = "<group>"; };
+		863C6D991521111200585E4E /* YarrCanonicalize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrCanonicalize.h; path = yarr/YarrCanonicalize.h; sourceTree = "<group>"; };
+		863C6D9A1521111200585E4E /* YarrCanonicalizeUCS2.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = YarrCanonicalizeUCS2.js; path = yarr/YarrCanonicalizeUCS2.js; sourceTree = "<group>"; };
+		8640923B156EED3B00566CB2 /* ARM64Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ARM64Assembler.h; sourceTree = "<group>"; };
+		8640923C156EED3B00566CB2 /* MacroAssemblerARM64.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerARM64.h; sourceTree = "<group>"; };
+		865A30F0135007E100CDB49E /* JSCJSValueInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCJSValueInlines.h; sourceTree = "<group>"; };
+		866739D013BFDE710023D87C /* BigInteger.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BigInteger.h; sourceTree = "<group>"; };
+		866739D113BFDE710023D87C /* Uint16WithFraction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Uint16WithFraction.h; sourceTree = "<group>"; };
+		86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrSyntaxChecker.cpp; path = yarr/YarrSyntaxChecker.cpp; sourceTree = "<group>"; };
+		86704B4112DB8A8100A9FE7B /* YarrSyntaxChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrSyntaxChecker.h; path = yarr/YarrSyntaxChecker.h; sourceTree = "<group>"; };
+		86704B7D12DBA33700A9FE7B /* YarrInterpreter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrInterpreter.cpp; path = yarr/YarrInterpreter.cpp; sourceTree = "<group>"; };
+		86704B7E12DBA33700A9FE7B /* YarrInterpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrInterpreter.h; path = yarr/YarrInterpreter.h; sourceTree = "<group>"; };
+		86704B7F12DBA33700A9FE7B /* YarrJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrJIT.cpp; path = yarr/YarrJIT.cpp; sourceTree = "<group>"; };
+		86704B8012DBA33700A9FE7B /* YarrJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrJIT.h; path = yarr/YarrJIT.h; sourceTree = "<group>"; };
+		86704B8112DBA33700A9FE7B /* YarrParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrParser.h; path = yarr/YarrParser.h; sourceTree = "<group>"; };
+		86704B8212DBA33700A9FE7B /* YarrPattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrPattern.cpp; path = yarr/YarrPattern.cpp; sourceTree = "<group>"; };
+		86704B8312DBA33700A9FE7B /* YarrPattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrPattern.h; path = yarr/YarrPattern.h; sourceTree = "<group>"; };
+		86880F1B14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSpeculativeJIT32_64.cpp; path = dfg/DFGSpeculativeJIT32_64.cpp; sourceTree = "<group>"; };
+		86880F4C14353B2100B08D42 /* DFGSpeculativeJIT64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSpeculativeJIT64.cpp; path = dfg/DFGSpeculativeJIT64.cpp; sourceTree = "<group>"; };
+		868916A9155F285400CB2B9A /* PrivateName.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrivateName.h; sourceTree = "<group>"; };
+		869EBCB60E8C6D4A008722CC /* ResultType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResultType.h; sourceTree = "<group>"; };
+		86A054461556451B00445157 /* LowLevelInterpreter.asm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.asm.asm; name = LowLevelInterpreter.asm; path = llint/LowLevelInterpreter.asm; sourceTree = "<group>"; };
+		86A054471556451B00445157 /* LowLevelInterpreter32_64.asm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.asm.asm; lineEnding = 0; name = LowLevelInterpreter32_64.asm; path = llint/LowLevelInterpreter32_64.asm; sourceTree = "<group>"; };
+		86A054481556451B00445157 /* LowLevelInterpreter64.asm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.asm.asm; lineEnding = 0; name = LowLevelInterpreter64.asm; path = llint/LowLevelInterpreter64.asm; sourceTree = "<group>"; };
+		86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic.cpp; sourceTree = "<group>"; };
+		86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ARMv7Assembler.h; sourceTree = "<group>"; };
+		86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerARMv7.h; sourceTree = "<group>"; };
+		86AE64A6135E5E1C00963012 /* MacroAssemblerSH4.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerSH4.h; sourceTree = "<group>"; };
+		86AE64A7135E5E1C00963012 /* SH4Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SH4Assembler.h; sourceTree = "<group>"; };
+		86B5822C14D22F5F00A9C306 /* ProfileTreeNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProfileTreeNode.h; sourceTree = "<group>"; };
+		86B5822E14D2373B00A9C306 /* CodeProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeProfile.cpp; sourceTree = "<group>"; };
+		86B5822F14D2373B00A9C306 /* CodeProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeProfile.h; sourceTree = "<group>"; };
+		86B5826A14D35D5100A9C306 /* TieredMMapArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TieredMMapArray.h; sourceTree = "<group>"; };
+		86BF642A148DB2B5004DE36A /* Intrinsic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Intrinsic.h; sourceTree = "<group>"; };
+		86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssembler.h; sourceTree = "<group>"; };
+		86C568DD11A213EE0007F7F0 /* MacroAssemblerARM.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerARM.cpp; sourceTree = "<group>"; };
+		86C568DE11A213EE0007F7F0 /* MacroAssemblerMIPS.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerMIPS.h; sourceTree = "<group>"; };
+		86C568DF11A213EE0007F7F0 /* MIPSAssembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MIPSAssembler.h; sourceTree = "<group>"; };
+		86CC85A00EE79A4700288682 /* JITInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITInlines.h; sourceTree = "<group>"; };
+		86CC85A20EE79B7400288682 /* JITCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITCall.cpp; sourceTree = "<group>"; };
+		86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITPropertyAccess.cpp; sourceTree = "<group>"; };
+		86CCEFDD0F413F8900FD7F9E /* JITCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCode.h; sourceTree = "<group>"; };
+		86D22219167EF9440024C804 /* testapi.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; name = testapi.mm; path = API/tests/testapi.mm; sourceTree = "<group>"; };
+		86D3B2BF10156BDE002865E7 /* ARMAssembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ARMAssembler.cpp; sourceTree = "<group>"; };
+		86D3B2C010156BDE002865E7 /* ARMAssembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ARMAssembler.h; sourceTree = "<group>"; };
+		86D3B2C110156BDE002865E7 /* AssemblerBufferWithConstantPool.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AssemblerBufferWithConstantPool.h; sourceTree = "<group>"; };
+		86D3B2C210156BDE002865E7 /* MacroAssemblerARM.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerARM.h; sourceTree = "<group>"; };
+		86D3B3C110159D7F002865E7 /* LinkBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LinkBuffer.h; sourceTree = "<group>"; };
+		86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocatorFixedVMPool.cpp; sourceTree = "<group>"; };
+		86E116B00FE75AC800B512BC /* CodeLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeLocation.h; sourceTree = "<group>"; };
+		86E3C606167BAB87006D760A /* JSValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSValue.h; sourceTree = "<group>"; };
+		86E3C607167BAB87006D760A /* JSContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContext.h; sourceTree = "<group>"; };
+		86E3C608167BAB87006D760A /* JSContext.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = JSContext.mm; sourceTree = "<group>"; };
+		86E3C609167BAB87006D760A /* JSContextInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextInternal.h; sourceTree = "<group>"; };
+		86E3C60A167BAB87006D760A /* JSExport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSExport.h; sourceTree = "<group>"; };
+		86E3C60B167BAB87006D760A /* JSWrapperMap.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = JSWrapperMap.mm; sourceTree = "<group>"; };
+		86E3C60C167BAB87006D760A /* JSWrapperMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWrapperMap.h; sourceTree = "<group>"; };
+		86E3C60D167BAB87006D760A /* JSValue.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = JSValue.mm; sourceTree = "<group>"; };
+		86E3C60E167BAB87006D760A /* JSValueInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSValueInternal.h; sourceTree = "<group>"; };
+		86E3C60F167BAB87006D760A /* JSVirtualMachine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSVirtualMachine.h; sourceTree = "<group>"; };
+		86E3C610167BAB87006D760A /* JSVirtualMachine.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = JSVirtualMachine.mm; sourceTree = "<group>"; };
+		86E3C611167BAB87006D760A /* JSVirtualMachineInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSVirtualMachineInternal.h; sourceTree = "<group>"; };
+		86E85538111B9968001AF51E /* JSStringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringBuilder.h; sourceTree = "<group>"; };
+		86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGByteCodeParser.cpp; path = dfg/DFGByteCodeParser.cpp; sourceTree = "<group>"; };
+		86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGByteCodeParser.h; path = dfg/DFGByteCodeParser.h; sourceTree = "<group>"; };
+		86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGenerationInfo.h; path = dfg/DFGGenerationInfo.h; sourceTree = "<group>"; };
+		86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraph.cpp; path = dfg/DFGGraph.cpp; sourceTree = "<group>"; };
+		86EC9DB81328DF82002B2AD7 /* DFGGraph.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGraph.h; path = dfg/DFGGraph.h; sourceTree = "<group>"; };
+		86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGJITCompiler.cpp; path = dfg/DFGJITCompiler.cpp; sourceTree = "<group>"; };
+		86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGJITCompiler.h; path = dfg/DFGJITCompiler.h; sourceTree = "<group>"; };
+		86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOperations.cpp; path = dfg/DFGOperations.cpp; sourceTree = "<group>"; };
+		86EC9DC01328DF82002B2AD7 /* DFGOperations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOperations.h; path = dfg/DFGOperations.h; sourceTree = "<group>"; };
+		86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRegisterBank.h; path = dfg/DFGRegisterBank.h; sourceTree = "<group>"; };
+		86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSpeculativeJIT.cpp; path = dfg/DFGSpeculativeJIT.cpp; sourceTree = "<group>"; };
+		86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSpeculativeJIT.h; path = dfg/DFGSpeculativeJIT.h; sourceTree = "<group>"; };
+		86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNode.h; path = dfg/DFGNode.h; sourceTree = "<group>"; };
+		86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGScoreBoard.h; path = dfg/DFGScoreBoard.h; sourceTree = "<group>"; };
+		86F3EEB616855A5B0077B92A /* ObjcRuntimeExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjcRuntimeExtras.h; sourceTree = "<group>"; };
+		86F3EEB9168CCF750077B92A /* ObjCCallbackFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjCCallbackFunction.h; sourceTree = "<group>"; };
+		86F3EEBA168CCF750077B92A /* ObjCCallbackFunction.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ObjCCallbackFunction.mm; sourceTree = "<group>"; };
+		86F75EFB151C062F007C9BA3 /* RegExpCachedResult.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpCachedResult.cpp; sourceTree = "<group>"; };
+		86F75EFC151C062F007C9BA3 /* RegExpCachedResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpCachedResult.h; sourceTree = "<group>"; };
+		86F75EFD151C062F007C9BA3 /* RegExpMatchesArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpMatchesArray.cpp; sourceTree = "<group>"; };
+		86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBoundFunction.cpp; sourceTree = "<group>"; };
+		86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBoundFunction.h; sourceTree = "<group>"; };
+		8B47F234366C4B72AC852A7E /* TemplateRegistryKeyTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TemplateRegistryKeyTable.cpp; sourceTree = "<group>"; };
+		8B9F6D551D5912FA001C739F /* IterationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IterationKind.h; sourceTree = "<group>"; };
+		90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryStatistics.cpp; sourceTree = "<group>"; };
+		90213E3C123A40C200D422F3 /* MemoryStatistics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryStatistics.h; sourceTree = "<group>"; };
+		93052C320FB792190048FDC3 /* ParserArena.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ParserArena.cpp; sourceTree = "<group>"; };
+		93052C330FB792190048FDC3 /* ParserArena.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserArena.h; sourceTree = "<group>"; };
+		930DAD030FB1EB1A0082D205 /* NodeConstructors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeConstructors.h; sourceTree = "<group>"; };
+		9322A00306C341D3009067BB /* libicucore.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libicucore.dylib; path = /usr/lib/libicucore.dylib; sourceTree = "<absolute>"; };
+		932F5BD80822A1C700736975 /* Info.plist */ = {isa = PBXFileReference; indentWidth = 4; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; tabWidth = 8; usesTabs = 1; };
+		932F5BD90822A1C700736975 /* JavaScriptCore.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
+		932F5BE10822A1C700736975 /* jsc */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = jsc; sourceTree = BUILT_PRODUCTS_DIR; };
+		93303FE80E6A72B500786E6A /* SmallStrings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SmallStrings.cpp; sourceTree = "<group>"; };
+		93303FEA0E6A72C000786E6A /* SmallStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SmallStrings.h; sourceTree = "<group>"; };
+		93345A8712D838C400302BE3 /* StringRecursionChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringRecursionChecker.cpp; sourceTree = "<group>"; };
+		93345A8812D838C400302BE3 /* StringRecursionChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringRecursionChecker.h; sourceTree = "<group>"; };
+		933A349A038AE7C6008635CE /* Identifier.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Identifier.h; sourceTree = "<group>"; tabWidth = 8; };
+		933A349D038AE80F008635CE /* Identifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Identifier.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		937B63CC09E766D200A671DD /* DerivedSources.make */ = {isa = PBXFileReference; explicitFileType = sourcecode.make; fileEncoding = 4; path = DerivedSources.make; sourceTree = "<group>"; usesTabs = 1; };
+		938772E5038BFE19008635CE /* JSArray.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JSArray.h; sourceTree = "<group>"; tabWidth = 8; };
+		93ADFCE60CCBD7AC00D30B08 /* JSArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArray.cpp; sourceTree = "<group>"; };
+		93CEDDFB0EA91EE600258EBE /* RegExpMatchesArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpMatchesArray.h; sourceTree = "<group>"; };
+		93F0B3A909BB4DC00068FCE3 /* Parser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Parser.cpp; sourceTree = "<group>"; };
+		93F0B3AA09BB4DC00068FCE3 /* Parser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Parser.h; sourceTree = "<group>"; };
+		93F1981A08245AAE001E9ABC /* Keywords.table */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = text; path = Keywords.table; sourceTree = "<group>"; tabWidth = 8; };
+		95C18D3E0C90E7EF00E72F73 /* JSRetainPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSRetainPtr.h; sourceTree = "<group>"; };
+		960097A50EBABB58007A7297 /* LabelScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LabelScope.h; sourceTree = "<group>"; };
+		9688CB130ED12B4E001D649F /* AssemblerBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AssemblerBuffer.h; sourceTree = "<group>"; };
+		9688CB140ED12B4E001D649F /* X86Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = X86Assembler.h; sourceTree = "<group>"; };
+		969A07200ED1CE3300F1F681 /* BytecodeGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BytecodeGenerator.cpp; sourceTree = "<group>"; };
+		969A07210ED1CE3300F1F681 /* BytecodeGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeGenerator.h; sourceTree = "<group>"; };
+		969A07270ED1CE6900F1F681 /* Label.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Label.h; sourceTree = "<group>"; };
+		969A07280ED1CE6900F1F681 /* RegisterID.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterID.h; sourceTree = "<group>"; };
+		969A07900ED1D3AE00F1F681 /* CodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeBlock.cpp; sourceTree = "<group>"; };
+		969A07910ED1D3AE00F1F681 /* CodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeBlock.h; sourceTree = "<group>"; };
+		969A07920ED1D3AE00F1F681 /* DirectEvalCodeCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DirectEvalCodeCache.h; sourceTree = "<group>"; };
+		969A07930ED1D3AE00F1F681 /* Instruction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Instruction.h; sourceTree = "<group>"; };
+		969A07940ED1D3AE00F1F681 /* Opcode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Opcode.cpp; sourceTree = "<group>"; };
+		969A07950ED1D3AE00F1F681 /* Opcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Opcode.h; sourceTree = "<group>"; };
+		969A09220ED1E09C00F1F681 /* Completion.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Completion.cpp; sourceTree = "<group>"; };
+		9788FC221471AD0C0068CE2D /* JSDateMath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDateMath.cpp; sourceTree = "<group>"; };
+		9788FC231471AD0C0068CE2D /* JSDateMath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDateMath.h; sourceTree = "<group>"; };
+		990DA67E1C8E311D00295159 /* generate_objc_protocol_type_conversions_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_protocol_type_conversions_implementation.py; sourceTree = "<group>"; };
+		9928FF3918AC4AEC00B8CF12 /* JSReplayInputs.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSReplayInputs.cpp; sourceTree = "<group>"; };
+		9928FF3A18AC4AEC00B8CF12 /* JSReplayInputs.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSReplayInputs.h; sourceTree = "<group>"; };
+		9928FF3D18AC4B1C00B8CF12 /* JSInputs.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = JSInputs.json; sourceTree = "<group>"; };
+		992ABCF51BEA94CA006403A0 /* RemoteAutomationTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RemoteAutomationTarget.cpp; sourceTree = "<group>"; };
+		992ABCF61BEA94CA006403A0 /* RemoteAutomationTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteAutomationTarget.h; sourceTree = "<group>"; };
+		9959E9271BD17FA0001AA413 /* cssmin.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = cssmin.py; sourceTree = "<group>"; };
+		9959E9291BD17FA0001AA413 /* jsmin.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = jsmin.py; sourceTree = "<group>"; };
+		9959E92A1BD17FA0001AA413 /* xxd.pl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.perl; path = xxd.pl; sourceTree = "<group>"; };
+		9959E92F1BD181F6001AA413 /* generate-combined-inspector-json.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = "generate-combined-inspector-json.py"; sourceTree = "<group>"; };
+		9959E9301BD181F6001AA413 /* inline-and-minify-stylesheets-and-scripts.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = "inline-and-minify-stylesheets-and-scripts.py"; sourceTree = "<group>"; };
+		996B73071BD9FA2C00331B84 /* BooleanPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanPrototype.lut.h; sourceTree = "<group>"; };
+		996B73081BD9FA2C00331B84 /* DateConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateConstructor.lut.h; sourceTree = "<group>"; };
+		996B73091BD9FA2C00331B84 /* ErrorPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorPrototype.lut.h; sourceTree = "<group>"; };
+		996B730A1BD9FA2C00331B84 /* JSDataViewPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDataViewPrototype.lut.h; sourceTree = "<group>"; };
+		996B730B1BD9FA2C00331B84 /* JSGlobalObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObject.lut.h; sourceTree = "<group>"; };
+		996B730C1BD9FA2C00331B84 /* ModuleLoaderPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModuleLoaderPrototype.lut.h; sourceTree = "<group>"; };
+		996B730D1BD9FA2C00331B84 /* NumberPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberPrototype.lut.h; sourceTree = "<group>"; };
+		996B730E1BD9FA2C00331B84 /* ObjectConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectConstructor.lut.h; sourceTree = "<group>"; };
+		996B730F1BD9FA2C00331B84 /* ReflectObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReflectObject.lut.h; sourceTree = "<group>"; };
+		996B73111BD9FA2C00331B84 /* StringConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringConstructor.lut.h; sourceTree = "<group>"; };
+		996B73121BD9FA2C00331B84 /* StringIteratorPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringIteratorPrototype.lut.h; sourceTree = "<group>"; };
+		996B73131BD9FA2C00331B84 /* SymbolConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolConstructor.lut.h; sourceTree = "<group>"; };
+		996B73141BD9FA2C00331B84 /* SymbolPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolPrototype.lut.h; sourceTree = "<group>"; };
+		996B73151BDA05AA00331B84 /* ArrayConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayConstructor.lut.h; sourceTree = "<group>"; };
+		996B73161BDA05AA00331B84 /* ArrayIteratorPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayIteratorPrototype.lut.h; sourceTree = "<group>"; };
+		998ED6721BED659A00DD8017 /* RemoteControllableTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RemoteControllableTarget.cpp; sourceTree = "<group>"; };
+		998ED6731BED659A00DD8017 /* RemoteControllableTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteControllableTarget.h; sourceTree = "<group>"; };
+		99DA00991BD5992700F4575C /* __init__.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = __init__.py; sourceTree = "<group>"; };
+		99DA009A1BD5992700F4575C /* builtins_generator.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generator.py; sourceTree = "<group>"; };
+		99DA009B1BD5992700F4575C /* builtins_model.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_model.py; sourceTree = "<group>"; };
+		99DA009C1BD5992700F4575C /* builtins_templates.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_templates.py; sourceTree = "<group>"; };
+		99DA009D1BD5992700F4575C /* builtins.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins.py; sourceTree = "<group>"; };
+		99DA009E1BD5992700F4575C /* builtins_generate_combined_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_combined_header.py; sourceTree = "<group>"; };
+		99DA009F1BD5992700F4575C /* builtins_generate_combined_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_combined_implementation.py; sourceTree = "<group>"; };
+		99DA00A01BD5992700F4575C /* builtins_generate_separate_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_separate_header.py; sourceTree = "<group>"; };
+		99DA00A11BD5992700F4575C /* builtins_generate_separate_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_separate_implementation.py; sourceTree = "<group>"; };
+		99DA00AC1BD5993E00F4575C /* generate-js-builtins.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = "generate-js-builtins.py"; sourceTree = "<group>"; };
+		99DA00AD1BD5993E00F4575C /* lazywriter.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = lazywriter.py; sourceTree = "<group>"; };
+		99DA00AE1BD5993E00F4575C /* UpdateContents.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = UpdateContents.py; sourceTree = "<group>"; };
+		99E45A1D18A1B1E70026D88F /* CodeGeneratorReplayInputs.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = CodeGeneratorReplayInputs.py; sourceTree = "<group>"; };
+		99E45A1E18A1B1E70026D88F /* CodeGeneratorReplayInputsTemplates.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = CodeGeneratorReplayInputsTemplates.py; sourceTree = "<group>"; };
+		99E45A1F18A1B2590026D88F /* EmptyInputCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EmptyInputCursor.h; sourceTree = "<group>"; };
+		99E45A2018A1B2590026D88F /* EncodedValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EncodedValue.cpp; sourceTree = "<group>"; };
+		99E45A2118A1B2590026D88F /* EncodedValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EncodedValue.h; sourceTree = "<group>"; };
+		99E45A2218A1B2590026D88F /* InputCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InputCursor.h; sourceTree = "<group>"; };
+		99E45A2318A1B2590026D88F /* NondeterministicInput.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NondeterministicInput.h; sourceTree = "<group>"; };
+		99F1A6FC1B8E6D9400463B26 /* InspectorFrontendRouter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontendRouter.cpp; sourceTree = "<group>"; };
+		99F1A7001B98FBEC00463B26 /* InspectorFrontendRouter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendRouter.h; sourceTree = "<group>"; };
+		9B4954E81A6640DB002815A6 /* ParserFunctionInfo.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ParserFunctionInfo.h; sourceTree = "<group>"; };
+		9E729409190F0306001A91B5 /* BundlePath.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BundlePath.mm; sourceTree = "<group>"; };
+		9E72940A190F0514001A91B5 /* BundlePath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BundlePath.h; sourceTree = "<group>"; };
+		A125846C1B45A36000CC7F6C /* IntlNumberFormatConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlNumberFormatConstructor.lut.h; sourceTree = "<group>"; };
+		A125846D1B45A36000CC7F6C /* IntlNumberFormatPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlNumberFormatPrototype.lut.h; sourceTree = "<group>"; };
+		A12BBFF11B044A8B00664B69 /* IntlObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlObject.h; sourceTree = "<group>"; };
+		A12BBFF31B044A9800664B69 /* IntlObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlObject.cpp; sourceTree = "<group>"; };
+		A1587D671B4DC14100D69849 /* IntlDateTimeFormat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlDateTimeFormat.cpp; sourceTree = "<group>"; };
+		A1587D681B4DC14100D69849 /* IntlDateTimeFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlDateTimeFormat.h; sourceTree = "<group>"; };
+		A1587D691B4DC14100D69849 /* IntlDateTimeFormatConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlDateTimeFormatConstructor.cpp; sourceTree = "<group>"; };
+		A1587D6A1B4DC14100D69849 /* IntlDateTimeFormatConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlDateTimeFormatConstructor.h; sourceTree = "<group>"; };
+		A1587D6B1B4DC14100D69849 /* IntlDateTimeFormatPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlDateTimeFormatPrototype.cpp; sourceTree = "<group>"; };
+		A1587D6C1B4DC14100D69849 /* IntlDateTimeFormatPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlDateTimeFormatPrototype.h; sourceTree = "<group>"; };
+		A1587D731B4DC1C600D69849 /* IntlDateTimeFormatConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlDateTimeFormatConstructor.lut.h; sourceTree = "<group>"; };
+		A1587D741B4DC1C600D69849 /* IntlDateTimeFormatPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlDateTimeFormatPrototype.lut.h; sourceTree = "<group>"; };
+		A15DE5C51C0FBF8D0089133D /* NumberPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = NumberPrototype.js; sourceTree = "<group>"; };
+		A1712B3A11C7B212007A5315 /* RegExpCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpCache.cpp; sourceTree = "<group>"; };
+		A1712B3E11C7B228007A5315 /* RegExpCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpCache.h; sourceTree = "<group>"; };
+		A1712B4011C7B235007A5315 /* RegExpKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpKey.h; sourceTree = "<group>"; };
+		A18193E11B4E0CDB00FC1029 /* IntlCollatorConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlCollatorConstructor.lut.h; sourceTree = "<group>"; };
+		A18193E21B4E0CDB00FC1029 /* IntlCollatorPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlCollatorPrototype.lut.h; sourceTree = "<group>"; };
+		A1B9E2331B4E0D6700BC7FED /* IntlCollator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlCollator.cpp; sourceTree = "<group>"; };
+		A1B9E2341B4E0D6700BC7FED /* IntlCollator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlCollator.h; sourceTree = "<group>"; };
+		A1B9E2351B4E0D6700BC7FED /* IntlCollatorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlCollatorConstructor.cpp; sourceTree = "<group>"; };
+		A1B9E2361B4E0D6700BC7FED /* IntlCollatorConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlCollatorConstructor.h; sourceTree = "<group>"; };
+		A1B9E2371B4E0D6700BC7FED /* IntlCollatorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlCollatorPrototype.cpp; sourceTree = "<group>"; };
+		A1B9E2381B4E0D6700BC7FED /* IntlCollatorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlCollatorPrototype.h; sourceTree = "<group>"; };
+		A1D792F61B43864B004516F5 /* IntlNumberFormat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlNumberFormat.cpp; sourceTree = "<group>"; };
+		A1D792F71B43864B004516F5 /* IntlNumberFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlNumberFormat.h; sourceTree = "<group>"; };
+		A1D792F81B43864B004516F5 /* IntlNumberFormatConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlNumberFormatConstructor.cpp; sourceTree = "<group>"; };
+		A1D792F91B43864B004516F5 /* IntlNumberFormatConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlNumberFormatConstructor.h; sourceTree = "<group>"; };
+		A1D792FA1B43864B004516F5 /* IntlNumberFormatPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntlNumberFormatPrototype.cpp; sourceTree = "<group>"; };
+		A1D792FB1B43864B004516F5 /* IntlNumberFormatPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntlNumberFormatPrototype.h; sourceTree = "<group>"; };
+		A1E0451B1C25B4B100BB663C /* StringPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = StringPrototype.js; sourceTree = "<group>"; };
+		A1FE1EB01C2C537E00A289FF /* DatePrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = DatePrototype.js; sourceTree = "<group>"; };
+		A503FA13188E0FAF00110F14 /* JavaScriptCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JavaScriptCallFrame.cpp; sourceTree = "<group>"; };
+		A503FA14188E0FAF00110F14 /* JavaScriptCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptCallFrame.h; sourceTree = "<group>"; };
+		A503FA15188E0FB000110F14 /* JSJavaScriptCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSJavaScriptCallFrame.cpp; sourceTree = "<group>"; };
+		A503FA16188E0FB000110F14 /* JSJavaScriptCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSJavaScriptCallFrame.h; sourceTree = "<group>"; };
+		A503FA17188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSJavaScriptCallFramePrototype.cpp; sourceTree = "<group>"; };
+		A503FA18188E0FB000110F14 /* JSJavaScriptCallFramePrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSJavaScriptCallFramePrototype.h; sourceTree = "<group>"; };
+		A503FA1F188EFF6800110F14 /* ScriptBreakpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptBreakpoint.h; sourceTree = "<group>"; };
+		A503FA20188EFF6800110F14 /* ScriptDebugListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptDebugListener.h; sourceTree = "<group>"; };
+		A503FA23188EFFFD00110F14 /* ScriptDebugServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptDebugServer.cpp; sourceTree = "<group>"; };
+		A503FA24188EFFFD00110F14 /* ScriptDebugServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptDebugServer.h; sourceTree = "<group>"; };
+		A503FA27188F105900110F14 /* JSGlobalObjectScriptDebugServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectScriptDebugServer.cpp; sourceTree = "<group>"; };
+		A503FA28188F105900110F14 /* JSGlobalObjectScriptDebugServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectScriptDebugServer.h; sourceTree = "<group>"; };
+		A5098B031C16AA0200087797 /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.11.sdk/System/Library/Frameworks/Security.framework; sourceTree = DEVELOPER_DIR; };
+		A50E4B5D18809DD50068A46D /* InspectorRuntimeAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorRuntimeAgent.cpp; sourceTree = "<group>"; };
+		A50E4B5E18809DD50068A46D /* InspectorRuntimeAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorRuntimeAgent.h; sourceTree = "<group>"; };
+		A50E4B5F18809DD50068A46D /* JSGlobalObjectRuntimeAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectRuntimeAgent.cpp; sourceTree = "<group>"; };
+		A50E4B6018809DD50068A46D /* JSGlobalObjectRuntimeAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectRuntimeAgent.h; sourceTree = "<group>"; };
+		A51007BE187CC3C600B38879 /* JSGlobalObjectInspectorController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectInspectorController.cpp; sourceTree = "<group>"; };
+		A51007BF187CC3C600B38879 /* JSGlobalObjectInspectorController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectInspectorController.h; sourceTree = "<group>"; };
+		A513E5B5185B8BD3007E95AD /* InjectedScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScript.cpp; sourceTree = "<group>"; };
+		A513E5B6185B8BD3007E95AD /* InjectedScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScript.h; sourceTree = "<group>"; };
+		A513E5B9185BFACC007E95AD /* InjectedScriptHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptHost.h; sourceTree = "<group>"; };
+		A513E5BA185BFACC007E95AD /* JSInjectedScriptHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptHost.cpp; sourceTree = "<group>"; };
+		A513E5BB185BFACC007E95AD /* JSInjectedScriptHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInjectedScriptHost.h; sourceTree = "<group>"; };
+		A513E5BC185BFACC007E95AD /* JSInjectedScriptHostPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptHostPrototype.cpp; sourceTree = "<group>"; };
+		A513E5BD185BFACC007E95AD /* JSInjectedScriptHostPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInjectedScriptHostPrototype.h; sourceTree = "<group>"; };
+		A513E5C3185F92C9007E95AD /* InjectedScriptSource.js */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.javascript; path = InjectedScriptSource.js; sourceTree = "<group>"; };
+		A513E5C6185F9436007E95AD /* InjectedScriptSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptSource.h; sourceTree = "<group>"; };
+		A513E5C8185F9624007E95AD /* InjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptManager.cpp; sourceTree = "<group>"; };
+		A513E5C9185F9624007E95AD /* InjectedScriptManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptManager.h; sourceTree = "<group>"; };
+		A514B2C0185A684400F3C7CB /* InjectedScriptBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptBase.cpp; sourceTree = "<group>"; };
+		A514B2C1185A684400F3C7CB /* InjectedScriptBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptBase.h; sourceTree = "<group>"; };
+		A52704851D027C8800354C37 /* GlobalOperations.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = GlobalOperations.js; sourceTree = "<group>"; };
+		A52704861D027C8800354C37 /* NumberConstructor.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = NumberConstructor.js; sourceTree = "<group>"; };
+		A5311C341C77CEAC00E6B1B6 /* HeapSnapshotBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapSnapshotBuilder.cpp; sourceTree = "<group>"; };
+		A5311C351C77CEAC00E6B1B6 /* HeapSnapshotBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapSnapshotBuilder.h; sourceTree = "<group>"; };
+		A532438118568317002ED692 /* InspectorBackendDispatchers.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackendDispatchers.cpp; sourceTree = "<group>"; };
+		A532438218568317002ED692 /* InspectorBackendDispatchers.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = InspectorBackendDispatchers.h; sourceTree = "<group>"; };
+		A532438318568317002ED692 /* InspectorFrontendDispatchers.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontendDispatchers.cpp; sourceTree = "<group>"; };
+		A532438418568317002ED692 /* InspectorFrontendDispatchers.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendDispatchers.h; sourceTree = "<group>"; };
+		A532438518568317002ED692 /* InspectorProtocolObjects.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorProtocolObjects.cpp; sourceTree = "<group>"; };
+		A532438618568317002ED692 /* InspectorProtocolObjects.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = InspectorProtocolObjects.h; sourceTree = "<group>"; };
+		A532438D185696CA002ED692 /* protocol */ = {isa = PBXFileReference; lastKnownFileType = folder; path = protocol; sourceTree = "<group>"; };
+		A53243951856A475002ED692 /* CombinedDomains.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = CombinedDomains.json; sourceTree = "<group>"; };
+		A53243961856A475002ED692 /* InspectorBackendCommands.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = InspectorBackendCommands.js; sourceTree = "<group>"; };
+		A5339EC41BB399900054F005 /* InspectorHeapAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorHeapAgent.cpp; sourceTree = "<group>"; };
+		A5339EC51BB399900054F005 /* InspectorHeapAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorHeapAgent.h; sourceTree = "<group>"; };
+		A5339EC81BB4B4510054F005 /* HeapObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapObserver.h; sourceTree = "<group>"; };
+		A5398FA91C750D950060A963 /* HeapProfiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapProfiler.cpp; sourceTree = "<group>"; };
+		A5398FAA1C750D950060A963 /* HeapProfiler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapProfiler.h; sourceTree = "<group>"; };
+		A53CE08918BC21C300BEDF76 /* ConsoleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConsoleClient.h; sourceTree = "<group>"; };
+		A53F1ABE18C90EC70072EB6D /* framework.sb */ = {isa = PBXFileReference; lastKnownFileType = text; path = framework.sb; sourceTree = "<group>"; };
+		A54982011891D0B00081E5B8 /* EventLoop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventLoop.cpp; sourceTree = "<group>"; };
+		A54982021891D0B00081E5B8 /* EventLoop.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventLoop.h; sourceTree = "<group>"; };
+		A54C2AAE1C6544D100A18D78 /* HeapSnapshot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapSnapshot.cpp; sourceTree = "<group>"; };
+		A54C2AAF1C6544D100A18D78 /* HeapSnapshot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapSnapshot.h; sourceTree = "<group>"; };
+		A54CF2F2184EAB2400237F19 /* ScriptValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptValue.cpp; sourceTree = "<group>"; };
+		A54CF2F3184EAB2400237F19 /* ScriptValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptValue.h; sourceTree = "<group>"; };
+		A54CF2F7184EAEDA00237F19 /* ScriptObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptObject.cpp; sourceTree = "<group>"; };
+		A54CF2F8184EAEDA00237F19 /* ScriptObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptObject.h; sourceTree = "<group>"; };
+		A55165D01BDEFDBD003B75C1 /* InspectorScriptProfilerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorScriptProfilerAgent.cpp; sourceTree = "<group>"; };
+		A55165D11BDEFDBD003B75C1 /* InspectorScriptProfilerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorScriptProfilerAgent.h; sourceTree = "<group>"; };
+		A55165D41BDF134D003B75C1 /* ScriptProfilingScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptProfilingScope.h; sourceTree = "<group>"; };
+		A552C37D1ADDB8FE00139726 /* JSRemoteInspector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSRemoteInspector.cpp; sourceTree = "<group>"; };
+		A552C37E1ADDB8FE00139726 /* JSRemoteInspector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSRemoteInspector.h; sourceTree = "<group>"; };
+		A55714BC1CD8048E0004D2C6 /* ConsoleObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConsoleObject.cpp; sourceTree = "<group>"; };
+		A55714BD1CD8048E0004D2C6 /* ConsoleObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConsoleObject.h; sourceTree = "<group>"; };
+		A55D93A3185012A800400DED /* ScriptFunctionCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptFunctionCall.cpp; sourceTree = "<group>"; };
+		A55D93A4185012A800400DED /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
+		A55D93AB18514F7900400DED /* InspectorProtocolTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorProtocolTypes.h; sourceTree = "<group>"; };
+		A57D23E31890CEBF0031C7FA /* InspectorDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDebuggerAgent.cpp; sourceTree = "<group>"; };
+		A57D23E41890CEBF0031C7FA /* InspectorDebuggerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorDebuggerAgent.h; sourceTree = "<group>"; };
+		A57D23E71891B0770031C7FA /* JSGlobalObjectDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectDebuggerAgent.cpp; sourceTree = "<group>"; };
+		A57D23E81891B0770031C7FA /* JSGlobalObjectDebuggerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectDebuggerAgent.h; sourceTree = "<group>"; };
+		A57D23EB1891B5540031C7FA /* RegularExpression.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RegularExpression.cpp; path = yarr/RegularExpression.cpp; sourceTree = "<group>"; };
+		A57D23EC1891B5540031C7FA /* RegularExpression.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RegularExpression.h; path = yarr/RegularExpression.h; sourceTree = "<group>"; };
+		A57D23EF1891B5B40031C7FA /* ContentSearchUtilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSearchUtilities.cpp; sourceTree = "<group>"; };
+		A57D23F01891B5B40031C7FA /* ContentSearchUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSearchUtilities.h; sourceTree = "<group>"; };
+		A5840E1E187B7B8600843B10 /* InjectedScriptModule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptModule.cpp; sourceTree = "<group>"; };
+		A5840E1F187B7B8600843B10 /* InjectedScriptModule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptModule.h; sourceTree = "<group>"; };
+		A58C024118E4A41A00032BC5 /* JSContextPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextPrivate.h; sourceTree = "<group>"; };
+		A58E35901860DEC7001F24FE /* InjectedScriptHost.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptHost.cpp; sourceTree = "<group>"; };
+		A593CF7A1840360300BFCE27 /* InspectorBackendDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackendDispatcher.cpp; sourceTree = "<group>"; };
+		A593CF7B1840360300BFCE27 /* InspectorBackendDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorBackendDispatcher.h; sourceTree = "<group>"; };
+		A593CF7E1840362C00BFCE27 /* InspectorAgentBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgentBase.h; sourceTree = "<group>"; };
+		A593CF801840377100BFCE27 /* InspectorValues.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorValues.cpp; sourceTree = "<group>"; };
+		A593CF811840377100BFCE27 /* InspectorValues.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorValues.h; sourceTree = "<group>"; };
+		A593CF84184038CA00BFCE27 /* InspectorAgentRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorAgentRegistry.cpp; sourceTree = "<group>"; };
+		A593CF85184038CA00BFCE27 /* InspectorAgentRegistry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgentRegistry.h; sourceTree = "<group>"; };
+		A594558E18245EDE00CC3843 /* RemoteInspectionTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RemoteInspectionTarget.cpp; sourceTree = "<group>"; };
+		A59455901824744700CC3843 /* JSGlobalObjectDebuggable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectDebuggable.cpp; sourceTree = "<group>"; };
+		A59455911824744700CC3843 /* JSGlobalObjectDebuggable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectDebuggable.h; sourceTree = "<group>"; };
+		A5945594182479EB00CC3843 /* InspectorFrontendChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendChannel.h; sourceTree = "<group>"; };
+		A5A1A0921D8CB12F004C2EB8 /* DebuggerParseData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerParseData.h; sourceTree = "<group>"; };
+		A5A1A0931D8CB337004C2EB8 /* DebuggerParseData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerParseData.cpp; sourceTree = "<group>"; };
+		A5AB49DA1BEC8079007020FB /* PerGlobalObjectWrapperWorld.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PerGlobalObjectWrapperWorld.cpp; sourceTree = "<group>"; };
+		A5AB49DB1BEC8079007020FB /* PerGlobalObjectWrapperWorld.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PerGlobalObjectWrapperWorld.h; sourceTree = "<group>"; };
+		A5B6A74C18C6DBA600F11E91 /* ConsoleClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConsoleClient.cpp; sourceTree = "<group>"; };
+		A5BA15E1182340B300A82E69 /* RemoteInspector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteInspector.h; sourceTree = "<group>"; };
+		A5BA15E2182340B300A82E69 /* RemoteInspector.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RemoteInspector.mm; sourceTree = "<group>"; };
+		A5BA15E3182340B300A82E69 /* RemoteInspectorConstants.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteInspectorConstants.h; sourceTree = "<group>"; };
+		A5BA15E4182340B300A82E69 /* RemoteConnectionToTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteConnectionToTarget.h; sourceTree = "<group>"; };
+		A5BA15E5182340B300A82E69 /* RemoteConnectionToTarget.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RemoteConnectionToTarget.mm; sourceTree = "<group>"; };
+		A5BA15E6182340B300A82E69 /* RemoteInspectorXPCConnection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteInspectorXPCConnection.h; sourceTree = "<group>"; };
+		A5BA15E7182340B300A82E69 /* RemoteInspectorXPCConnection.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RemoteInspectorXPCConnection.mm; sourceTree = "<group>"; };
+		A5BA15EF182345AF00A82E69 /* RemoteInspectionTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RemoteInspectionTarget.h; sourceTree = "<group>"; };
+		A5C3A1A318C0490200C9593A /* JSGlobalObjectConsoleClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectConsoleClient.cpp; sourceTree = "<group>"; };
+		A5C3A1A418C0490200C9593A /* JSGlobalObjectConsoleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectConsoleClient.h; sourceTree = "<group>"; };
+		A5CEEE12187F3BAD00E55C99 /* InspectorAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorAgent.cpp; sourceTree = "<group>"; };
+		A5CEEE13187F3BAD00E55C99 /* InspectorAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgent.h; sourceTree = "<group>"; };
+		A5D0A1BA1862301B00C7B496 /* InspectorEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorEnvironment.h; sourceTree = "<group>"; };
+		A5D2E664195E173800A518E7 /* JSContextRefInternal.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSContextRefInternal.h; sourceTree = "<group>"; };
+		A5EA70E419F5B1010098F5EC /* AugmentableInspectorController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AugmentableInspectorController.h; sourceTree = "<group>"; };
+		A5EA70E519F5B1010098F5EC /* AugmentableInspectorControllerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AugmentableInspectorControllerClient.h; sourceTree = "<group>"; };
+		A5EA70E619F5B1010098F5EC /* AlternateDispatchableAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AlternateDispatchableAgent.h; sourceTree = "<group>"; };
+		A5EA70EA19F5B3D50098F5EC /* generate_cpp_alternate_backend_dispatcher_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_cpp_alternate_backend_dispatcher_header.py; sourceTree = "<group>"; };
+		A5EA70ED19F5B5C40098F5EC /* JSContextRefInspectorSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextRefInspectorSupport.h; sourceTree = "<group>"; };
+		A5EA70EF19F6DE5A0098F5EC /* generate_objc_backend_dispatcher_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_backend_dispatcher_header.py; sourceTree = "<group>"; };
+		A5EA70F019F6DE5A0098F5EC /* generate_objc_backend_dispatcher_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_backend_dispatcher_implementation.py; sourceTree = "<group>"; };
+		A5EA70F119F6DE5A0098F5EC /* generate_objc_configuration_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_configuration_header.py; sourceTree = "<group>"; };
+		A5EA70F219F6DE5A0098F5EC /* generate_objc_configuration_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_configuration_implementation.py; sourceTree = "<group>"; };
+		A5EA70F319F6DE5A0098F5EC /* generate_objc_protocol_type_conversions_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_protocol_type_conversions_header.py; sourceTree = "<group>"; };
+		A5EA70F419F6DE5A0098F5EC /* generate_objc_frontend_dispatcher_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_frontend_dispatcher_implementation.py; sourceTree = "<group>"; };
+		A5EA70F519F6DE5A0098F5EC /* generate_objc_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_header.py; sourceTree = "<group>"; };
+		A5EA70F619F6DE5A0098F5EC /* generate_objc_internal_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_internal_header.py; sourceTree = "<group>"; };
+		A5EA70F819F6DE5A0098F5EC /* objc_generator.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = objc_generator.py; sourceTree = "<group>"; };
+		A5EA710D19F6DF810098F5EC /* InspectorAlternateBackendDispatchers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAlternateBackendDispatchers.h; sourceTree = "<group>"; };
+		A5FC84B01D1DDAC8006B5C46 /* DebuggerLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerLocation.cpp; sourceTree = "<group>"; };
+		A5FC84B11D1DDAC8006B5C46 /* DebuggerLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerLocation.h; sourceTree = "<group>"; };
+		A5FD0065189AFE9C00633231 /* ScriptArguments.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptArguments.cpp; sourceTree = "<group>"; };
+		A5FD0066189AFE9C00633231 /* ScriptArguments.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptArguments.h; sourceTree = "<group>"; };
+		A5FD0069189B00A900633231 /* ScriptCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallFrame.cpp; sourceTree = "<group>"; };
+		A5FD006A189B00A900633231 /* ScriptCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallFrame.h; sourceTree = "<group>"; };
+		A5FD006B189B00A900633231 /* ScriptCallStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallStack.cpp; sourceTree = "<group>"; };
+		A5FD006C189B00AA00633231 /* ScriptCallStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallStack.h; sourceTree = "<group>"; };
+		A5FD0071189B038C00633231 /* ConsoleTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConsoleTypes.h; sourceTree = "<group>"; };
+		A5FD0072189B038C00633231 /* IdentifiersFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IdentifiersFactory.cpp; sourceTree = "<group>"; };
+		A5FD0073189B038C00633231 /* IdentifiersFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IdentifiersFactory.h; sourceTree = "<group>"; };
+		A5FD0077189B051000633231 /* ConsoleMessage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConsoleMessage.cpp; sourceTree = "<group>"; };
+		A5FD0078189B051000633231 /* ConsoleMessage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConsoleMessage.h; sourceTree = "<group>"; };
+		A5FD007B189B0B4C00633231 /* ScriptCallStackFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallStackFactory.cpp; sourceTree = "<group>"; };
+		A5FD007C189B0B4C00633231 /* ScriptCallStackFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallStackFactory.h; sourceTree = "<group>"; };
+		A5FD007F189B191A00633231 /* InspectorConsoleAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorConsoleAgent.cpp; sourceTree = "<group>"; };
+		A5FD0080189B191A00633231 /* InspectorConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorConsoleAgent.h; sourceTree = "<group>"; };
+		A5FD0083189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectConsoleAgent.cpp; sourceTree = "<group>"; };
+		A5FD0084189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectConsoleAgent.h; sourceTree = "<group>"; };
+		A700873717CBE85300C3E643 /* MapConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapConstructor.cpp; sourceTree = "<group>"; };
+		A700873817CBE85300C3E643 /* MapConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapConstructor.h; sourceTree = "<group>"; };
+		A700873B17CBE8D300C3E643 /* MapPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapPrototype.cpp; sourceTree = "<group>"; };
+		A700873C17CBE8D300C3E643 /* MapPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapPrototype.h; sourceTree = "<group>"; };
+		A700873F17CBE8EB00C3E643 /* JSMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMap.cpp; sourceTree = "<group>"; };
+		A700874017CBE8EB00C3E643 /* JSMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMap.h; sourceTree = "<group>"; };
+		A70447E917A0BD4600F5898E /* OperandsInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OperandsInlines.h; sourceTree = "<group>"; };
+		A70447EB17A0BD7000F5898E /* DumpContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DumpContext.cpp; sourceTree = "<group>"; };
+		A70447EC17A0BD7000F5898E /* DumpContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DumpContext.h; sourceTree = "<group>"; };
+		A704D8FE17A0BAA8006BA554 /* DFGAbstractInterpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAbstractInterpreter.h; path = dfg/DFGAbstractInterpreter.h; sourceTree = "<group>"; };
+		A704D8FF17A0BAA8006BA554 /* DFGAbstractInterpreterInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAbstractInterpreterInlines.h; path = dfg/DFGAbstractInterpreterInlines.h; sourceTree = "<group>"; };
+		A704D90017A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGInPlaceAbstractState.cpp; path = dfg/DFGInPlaceAbstractState.cpp; sourceTree = "<group>"; };
+		A704D90117A0BAA8006BA554 /* DFGInPlaceAbstractState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInPlaceAbstractState.h; path = dfg/DFGInPlaceAbstractState.h; sourceTree = "<group>"; };
+		A709F2EF17A0AC0400512E98 /* SlowPathCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SlowPathCall.h; sourceTree = "<group>"; };
+		A709F2F117A0AC2A00512E98 /* CommonSlowPaths.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CommonSlowPaths.cpp; sourceTree = "<group>"; };
+		A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITOpcodes32_64.cpp; sourceTree = "<group>"; };
+		A718F61A11754A21002465A7 /* RegExpJitTables.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpJitTables.h; sourceTree = "<group>"; };
+		A718F8211178EB4B002465A7 /* create_regex_tables */ = {isa = PBXFileReference; explicitFileType = text.script.python; fileEncoding = 4; path = create_regex_tables; sourceTree = "<group>"; };
+		A72028B41797601E0098028C /* JSCTestRunnerUtils.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCTestRunnerUtils.cpp; sourceTree = "<group>"; };
+		A72028B51797601E0098028C /* JSCTestRunnerUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCTestRunnerUtils.h; sourceTree = "<group>"; };
+		A72028B91797603D0098028C /* JSFunctionInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFunctionInlines.h; sourceTree = "<group>"; };
+		A72701B30DADE94900E548D7 /* ExceptionHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionHelpers.h; sourceTree = "<group>"; };
+		A729009B17976C6000317298 /* MacroAssemblerARMv7.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerARMv7.cpp; sourceTree = "<group>"; };
+		A7299D9B17D12837005F5FF9 /* JSSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSet.cpp; sourceTree = "<group>"; };
+		A7299D9C17D12837005F5FF9 /* JSSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSet.h; sourceTree = "<group>"; };
+		A7299D9F17D12848005F5FF9 /* SetPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SetPrototype.cpp; sourceTree = "<group>"; };
+		A7299DA017D12848005F5FF9 /* SetPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SetPrototype.h; sourceTree = "<group>"; };
+		A7299DA317D12858005F5FF9 /* SetConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SetConstructor.cpp; sourceTree = "<group>"; };
+		A7299DA417D12858005F5FF9 /* SetConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SetConstructor.h; sourceTree = "<group>"; };
+		A730B6101250068F009D25B1 /* StrictEvalActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StrictEvalActivation.h; sourceTree = "<group>"; };
+		A730B6111250068F009D25B1 /* StrictEvalActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StrictEvalActivation.cpp; sourceTree = "<group>"; };
+		A737810A1799EA2E00817533 /* DFGNaturalLoops.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNaturalLoops.cpp; path = dfg/DFGNaturalLoops.cpp; sourceTree = "<group>"; };
+		A737810B1799EA2E00817533 /* DFGNaturalLoops.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNaturalLoops.h; path = dfg/DFGNaturalLoops.h; sourceTree = "<group>"; };
+		A7386551118697B400540279 /* SpecializedThunkJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpecializedThunkJIT.h; sourceTree = "<group>"; };
+		A7386552118697B400540279 /* ThunkGenerators.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThunkGenerators.cpp; sourceTree = "<group>"; };
+		A7386553118697B400540279 /* ThunkGenerators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThunkGenerators.h; sourceTree = "<group>"; };
+		A73A53581799CD5D00170C19 /* DFGLazyJSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLazyJSValue.cpp; path = dfg/DFGLazyJSValue.cpp; sourceTree = "<group>"; };
+		A73A53591799CD5D00170C19 /* DFGLazyJSValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLazyJSValue.h; path = dfg/DFGLazyJSValue.h; sourceTree = "<group>"; };
+		A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSaneStringGetByValSlowPathGenerator.h; path = dfg/DFGSaneStringGetByValSlowPathGenerator.h; sourceTree = "<group>"; };
+		A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefPrivate.h; sourceTree = "<group>"; };
+		A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakObjectMapRefPrivate.cpp; sourceTree = "<group>"; };
+		A7482E37116A697B003B0712 /* JSWeakObjectMapRefInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefInternal.h; sourceTree = "<group>"; };
+		A74DEF8D182D991400522C22 /* MapIteratorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapIteratorPrototype.cpp; sourceTree = "<group>"; };
+		A74DEF8E182D991400522C22 /* MapIteratorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapIteratorPrototype.h; sourceTree = "<group>"; };
+		A74DEF8F182D991400522C22 /* JSMapIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMapIterator.cpp; sourceTree = "<group>"; };
+		A74DEF90182D991400522C22 /* JSMapIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMapIterator.h; sourceTree = "<group>"; };
+		A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic32_64.cpp; sourceTree = "<group>"; };
+		A75EE9B018AAB7E200AAD043 /* BuiltinNames.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BuiltinNames.h; sourceTree = "<group>"; };
+		A767B5B317A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLoopPreHeaderCreationPhase.cpp; path = dfg/DFGLoopPreHeaderCreationPhase.cpp; sourceTree = "<group>"; };
+		A767B5B417A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLoopPreHeaderCreationPhase.h; path = dfg/DFGLoopPreHeaderCreationPhase.h; sourceTree = "<group>"; };
+		A76C51741182748D00715B05 /* JSInterfaceJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInterfaceJIT.h; sourceTree = "<group>"; };
+		A77A423617A0BBFD00A8DB81 /* DFGAbstractHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAbstractHeap.cpp; path = dfg/DFGAbstractHeap.cpp; sourceTree = "<group>"; };
+		A77A423717A0BBFD00A8DB81 /* DFGAbstractHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAbstractHeap.h; path = dfg/DFGAbstractHeap.h; sourceTree = "<group>"; };
+		A77A423817A0BBFD00A8DB81 /* DFGClobberize.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGClobberize.cpp; path = dfg/DFGClobberize.cpp; sourceTree = "<group>"; };
+		A77A423917A0BBFD00A8DB81 /* DFGClobberize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGClobberize.h; path = dfg/DFGClobberize.h; sourceTree = "<group>"; };
+		A77A423A17A0BBFD00A8DB81 /* DFGClobberSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGClobberSet.cpp; path = dfg/DFGClobberSet.cpp; sourceTree = "<group>"; };
+		A77A423B17A0BBFD00A8DB81 /* DFGClobberSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGClobberSet.h; path = dfg/DFGClobberSet.h; sourceTree = "<group>"; };
+		A77A423C17A0BBFD00A8DB81 /* DFGSafeToExecute.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSafeToExecute.h; path = dfg/DFGSafeToExecute.h; sourceTree = "<group>"; };
+		A77F181F164088B200640A47 /* CodeCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeCache.cpp; sourceTree = "<group>"; };
+		A77F1820164088B200640A47 /* CodeCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeCache.h; sourceTree = "<group>"; };
+		A77F18241641925400640A47 /* ParserModes.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ParserModes.h; sourceTree = "<group>"; };
+		A78A976C179738B8009DF744 /* DFGFailedFinalizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFailedFinalizer.cpp; path = dfg/DFGFailedFinalizer.cpp; sourceTree = "<group>"; };
+		A78A976D179738B8009DF744 /* DFGFailedFinalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFailedFinalizer.h; path = dfg/DFGFailedFinalizer.h; sourceTree = "<group>"; };
+		A78A976E179738B8009DF744 /* DFGFinalizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFinalizer.cpp; path = dfg/DFGFinalizer.cpp; sourceTree = "<group>"; };
+		A78A976F179738B8009DF744 /* DFGFinalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFinalizer.h; path = dfg/DFGFinalizer.h; sourceTree = "<group>"; };
+		A78A9770179738B8009DF744 /* DFGJITFinalizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGJITFinalizer.cpp; path = dfg/DFGJITFinalizer.cpp; sourceTree = "<group>"; };
+		A78A9771179738B8009DF744 /* DFGJITFinalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGJITFinalizer.h; path = dfg/DFGJITFinalizer.h; sourceTree = "<group>"; };
+		A78A9772179738B8009DF744 /* DFGPlan.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGPlan.cpp; path = dfg/DFGPlan.cpp; sourceTree = "<group>"; };
+		A78A9773179738B8009DF744 /* DFGPlan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPlan.h; path = dfg/DFGPlan.h; sourceTree = "<group>"; };
+		A78A977C179738D5009DF744 /* FTLGeneratedFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLGeneratedFunction.h; path = ftl/FTLGeneratedFunction.h; sourceTree = "<group>"; };
+		A78A977D179738D5009DF744 /* FTLJITFinalizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLJITFinalizer.cpp; path = ftl/FTLJITFinalizer.cpp; sourceTree = "<group>"; };
+		A78A977E179738D5009DF744 /* FTLJITFinalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLJITFinalizer.h; path = ftl/FTLJITFinalizer.h; sourceTree = "<group>"; };
+		A790DD67182F499700588807 /* SetIteratorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SetIteratorPrototype.cpp; sourceTree = "<group>"; };
+		A790DD68182F499700588807 /* SetIteratorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SetIteratorPrototype.h; sourceTree = "<group>"; };
+		A790DD69182F499700588807 /* JSSetIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSetIterator.cpp; sourceTree = "<group>"; };
+		A790DD6A182F499700588807 /* JSSetIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSetIterator.h; sourceTree = "<group>"; };
+		A7986D5617A0BB1E00A95DD0 /* DFGEdgeUsesStructure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEdgeUsesStructure.h; path = dfg/DFGEdgeUsesStructure.h; sourceTree = "<group>"; };
+		A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedCodeBlock.cpp; sourceTree = "<group>"; };
+		A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedCodeBlock.h; sourceTree = "<group>"; };
+		A79EDB0811531CD60019E912 /* JSObjectRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectRefPrivate.h; sourceTree = "<group>"; };
+		A7A4AE0717973B26005612B1 /* MacroAssemblerX86Common.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerX86Common.cpp; sourceTree = "<group>"; };
+		A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ASTBuilder.h; sourceTree = "<group>"; };
+		A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SyntaxChecker.h; sourceTree = "<group>"; };
+		A7A8AF2517ADB5F2005AB174 /* ArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayBuffer.cpp; sourceTree = "<group>"; };
+		A7A8AF2617ADB5F3005AB174 /* ArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayBuffer.h; sourceTree = "<group>"; };
+		A7A8AF2717ADB5F3005AB174 /* ArrayBufferView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayBufferView.cpp; sourceTree = "<group>"; };
+		A7A8AF2817ADB5F3005AB174 /* ArrayBufferView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayBufferView.h; sourceTree = "<group>"; };
+		A7A8AF2917ADB5F3005AB174 /* Float32Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Float32Array.h; sourceTree = "<group>"; };
+		A7A8AF2A17ADB5F3005AB174 /* Float64Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Float64Array.h; sourceTree = "<group>"; };
+		A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Int8Array.h; sourceTree = "<group>"; };
+		A7A8AF2C17ADB5F3005AB174 /* Int16Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Int16Array.h; sourceTree = "<group>"; };
+		A7A8AF2D17ADB5F3005AB174 /* Int32Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Int32Array.h; sourceTree = "<group>"; };
+		A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Uint8Array.h; sourceTree = "<group>"; };
+		A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Uint8ClampedArray.h; sourceTree = "<group>"; };
+		A7A8AF3217ADB5F3005AB174 /* Uint16Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Uint16Array.h; sourceTree = "<group>"; };
+		A7A8AF3317ADB5F3005AB174 /* Uint32Array.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Uint32Array.h; sourceTree = "<group>"; };
+		A7A979C418BE8D9E002C3733 /* FunctionPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = FunctionPrototype.js; sourceTree = "<group>"; };
+		A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutableAllocator.h; sourceTree = "<group>"; };
+		A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutableAllocator.cpp; sourceTree = "<group>"; };
+		A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSExportMacros.h; sourceTree = "<group>"; };
+		A7BDAEC217F4EA1400F6140C /* ArrayIteratorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = ArrayIteratorPrototype.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+		A7BDAEC317F4EA1400F6140C /* ArrayIteratorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayIteratorPrototype.h; sourceTree = "<group>"; };
+		A7BFF3BF179868940002F462 /* DFGFiltrationResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFiltrationResult.h; path = dfg/DFGFiltrationResult.h; sourceTree = "<group>"; };
+		A7C0C4AA167C08CD0017011D /* JSScriptRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSScriptRef.cpp; sourceTree = "<group>"; };
+		A7C0C4AB167C08CD0017011D /* JSScriptRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSScriptRefPrivate.h; sourceTree = "<group>"; };
+		A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITPropertyAccess32_64.cpp; sourceTree = "<group>"; };
+		A7C1EAEB17987AB600299DB2 /* CLoopStackInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CLoopStackInlines.h; sourceTree = "<group>"; };
+		A7C1EAEC17987AB600299DB2 /* StackVisitor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = StackVisitor.cpp; sourceTree = "<group>"; };
+		A7C1EAED17987AB600299DB2 /* StackVisitor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StackVisitor.h; sourceTree = "<group>"; };
+		A7C225CC139981F100FF1662 /* KeywordLookupGenerator.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = KeywordLookupGenerator.py; sourceTree = "<group>"; };
+		A7C225CD1399849C00FF1662 /* KeywordLookup.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = KeywordLookup.h; sourceTree = "<group>"; };
+		A7CA3ADD17DA41AE006538AF /* WeakMapConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WeakMapConstructor.cpp; sourceTree = "<group>"; };
+		A7CA3ADE17DA41AE006538AF /* WeakMapConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakMapConstructor.h; sourceTree = "<group>"; };
+		A7CA3ADF17DA41AE006538AF /* WeakMapPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WeakMapPrototype.cpp; sourceTree = "<group>"; };
+		A7CA3AE017DA41AE006538AF /* WeakMapPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakMapPrototype.h; sourceTree = "<group>"; };
+		A7CA3AE117DA41AE006538AF /* JSWeakMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakMap.cpp; sourceTree = "<group>"; };
+		A7CA3AE217DA41AE006538AF /* JSWeakMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakMap.h; sourceTree = "<group>"; };
+		A7CA3AE917DA5168006538AF /* WeakMapData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WeakMapData.cpp; sourceTree = "<group>"; };
+		A7CA3AEA17DA5168006538AF /* WeakMapData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakMapData.h; sourceTree = "<group>"; };
+		A7D801A01880D66E0026C39B /* ArrayPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = ArrayPrototype.js; sourceTree = "<group>"; };
+		A7D801A11880D66E0026C39B /* BuiltinExecutables.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BuiltinExecutables.cpp; sourceTree = "<group>"; };
+		A7D801A21880D66E0026C39B /* BuiltinExecutables.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BuiltinExecutables.h; sourceTree = "<group>"; };
+		A7D801A61880D6A80026C39B /* JSCBuiltins.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCBuiltins.cpp; sourceTree = "<group>"; };
+		A7D801A71880D6A80026C39B /* JSCBuiltins.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCBuiltins.h; sourceTree = "<group>"; };
+		A7D89CE317A0B8CC00773AD8 /* DFGBasicBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBasicBlock.cpp; path = dfg/DFGBasicBlock.cpp; sourceTree = "<group>"; };
+		A7D89CE417A0B8CC00773AD8 /* DFGBlockInsertionSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGBlockInsertionSet.cpp; path = dfg/DFGBlockInsertionSet.cpp; sourceTree = "<group>"; };
+		A7D89CE517A0B8CC00773AD8 /* DFGBlockInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBlockInsertionSet.h; path = dfg/DFGBlockInsertionSet.h; sourceTree = "<group>"; };
+		A7D89CE617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCriticalEdgeBreakingPhase.cpp; path = dfg/DFGCriticalEdgeBreakingPhase.cpp; sourceTree = "<group>"; };
+		A7D89CE717A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCriticalEdgeBreakingPhase.h; path = dfg/DFGCriticalEdgeBreakingPhase.h; sourceTree = "<group>"; };
+		A7D89CE817A0B8CC00773AD8 /* DFGFlushFormat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFlushFormat.cpp; path = dfg/DFGFlushFormat.cpp; sourceTree = "<group>"; };
+		A7D89CE917A0B8CC00773AD8 /* DFGFlushFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFlushFormat.h; path = dfg/DFGFlushFormat.h; sourceTree = "<group>"; };
+		A7D89CEC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLivenessAnalysisPhase.cpp; path = dfg/DFGLivenessAnalysisPhase.cpp; sourceTree = "<group>"; };
+		A7D89CED17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLivenessAnalysisPhase.h; path = dfg/DFGLivenessAnalysisPhase.h; sourceTree = "<group>"; };
+		A7D89CEE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGOSRAvailabilityAnalysisPhase.cpp; path = dfg/DFGOSRAvailabilityAnalysisPhase.cpp; sourceTree = "<group>"; };
+		A7D89CEF17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGOSRAvailabilityAnalysisPhase.h; path = dfg/DFGOSRAvailabilityAnalysisPhase.h; sourceTree = "<group>"; };
+		A7D89CF017A0B8CC00773AD8 /* DFGSSAConversionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSSAConversionPhase.cpp; path = dfg/DFGSSAConversionPhase.cpp; sourceTree = "<group>"; };
+		A7D89CF117A0B8CC00773AD8 /* DFGSSAConversionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSSAConversionPhase.h; path = dfg/DFGSSAConversionPhase.h; sourceTree = "<group>"; };
+		A7D89D0117A0B90400773AD8 /* FTLLoweredNodeValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLLoweredNodeValue.h; path = ftl/FTLLoweredNodeValue.h; sourceTree = "<group>"; };
+		A7D9A28F17A0BC7400EE2618 /* DFGAtTailAbstractState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAtTailAbstractState.cpp; path = dfg/DFGAtTailAbstractState.cpp; sourceTree = "<group>"; };
+		A7D9A29017A0BC7400EE2618 /* DFGAtTailAbstractState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAtTailAbstractState.h; path = dfg/DFGAtTailAbstractState.h; sourceTree = "<group>"; };
+		A7D9A29117A0BC7400EE2618 /* DFGEdgeDominates.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEdgeDominates.h; path = dfg/DFGEdgeDominates.h; sourceTree = "<group>"; };
+		A7D9A29217A0BC7400EE2618 /* DFGLICMPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLICMPhase.cpp; path = dfg/DFGLICMPhase.cpp; sourceTree = "<group>"; };
+		A7D9A29317A0BC7400EE2618 /* DFGLICMPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLICMPhase.h; path = dfg/DFGLICMPhase.h; sourceTree = "<group>"; };
+		A7DCB77912E3D90500911940 /* WriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrier.h; sourceTree = "<group>"; };
+		A7E2EA690FB460CF00601F06 /* LiteralParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiteralParser.h; sourceTree = "<group>"; };
+		A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LiteralParser.cpp; sourceTree = "<group>"; };
+		A7E5A3A51797432D00E893C0 /* CompilationResult.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CompilationResult.cpp; sourceTree = "<group>"; };
+		A7E5A3A61797432D00E893C0 /* CompilationResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CompilationResult.h; sourceTree = "<group>"; };
+		A7E5AB351799E4B200D2833D /* UDis86Disassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = UDis86Disassembler.h; path = disassembler/UDis86Disassembler.h; sourceTree = "<group>"; };
+		A7E5AB361799E4B200D2833D /* X86Disassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = X86Disassembler.cpp; path = disassembler/X86Disassembler.cpp; sourceTree = "<group>"; };
+		A7F2996917A0BB670010417A /* FTLFail.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLFail.cpp; path = ftl/FTLFail.cpp; sourceTree = "<group>"; };
+		A7F2996A17A0BB670010417A /* FTLFail.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLFail.h; path = ftl/FTLFail.h; sourceTree = "<group>"; };
+		A7F8690E0F9584A100558697 /* CachedCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedCall.h; sourceTree = "<group>"; };
+		A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameClosure.h; sourceTree = "<group>"; };
+		A7F9935D0FD7325100A0B2D0 /* JSONObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.h; sourceTree = "<group>"; };
+		A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSONObject.cpp; sourceTree = "<group>"; };
+		A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyDescriptor.h; sourceTree = "<group>"; };
+		A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertyDescriptor.cpp; sourceTree = "<group>"; };
+		A7FCC26C17A0B6AA00786D1A /* FTLSwitchCase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLSwitchCase.h; path = ftl/FTLSwitchCase.h; sourceTree = "<group>"; };
+		A7FF647A18C52E8500B55307 /* SpillRegistersMode.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = SpillRegistersMode.h; sourceTree = "<group>"; };
+		A8A4748D151A8306004123FF /* libWTF.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libWTF.a; sourceTree = BUILT_PRODUCTS_DIR; };
+		A8E894310CD0602400367179 /* JSCallbackObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackObjectFunctions.h; sourceTree = "<group>"; };
+		A8E894330CD0603F00367179 /* JSGlobalObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObject.h; sourceTree = "<group>"; };
+		AD1CF06816DCAB2D00B97123 /* PropertyTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertyTable.cpp; sourceTree = "<group>"; };
+		AD2FCB8C1DB5844000B3E736 /* JSWebAssemblyModule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyModule.cpp; path = js/JSWebAssemblyModule.cpp; sourceTree = "<group>"; };
+		AD2FCB8D1DB5844000B3E736 /* JSWebAssemblyModule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyModule.h; path = js/JSWebAssemblyModule.h; sourceTree = "<group>"; };
+		AD2FCB981DB585A600B3E736 /* WebAssemblyModuleConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyModuleConstructor.cpp; path = js/WebAssemblyModuleConstructor.cpp; sourceTree = "<group>"; };
+		AD2FCB991DB585A600B3E736 /* WebAssemblyModuleConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyModuleConstructor.h; path = js/WebAssemblyModuleConstructor.h; sourceTree = "<group>"; };
+		AD2FCB9A1DB585A600B3E736 /* WebAssemblyModulePrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyModulePrototype.cpp; path = js/WebAssemblyModulePrototype.cpp; sourceTree = "<group>"; };
+		AD2FCB9B1DB585A600B3E736 /* WebAssemblyModulePrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyModulePrototype.h; path = js/WebAssemblyModulePrototype.h; sourceTree = "<group>"; };
+		AD2FCBA61DB58DA400B3E736 /* JSWebAssemblyCompileError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyCompileError.cpp; path = js/JSWebAssemblyCompileError.cpp; sourceTree = "<group>"; };
+		AD2FCBA71DB58DA400B3E736 /* JSWebAssemblyCompileError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyCompileError.h; path = js/JSWebAssemblyCompileError.h; sourceTree = "<group>"; };
+		AD2FCBA81DB58DA400B3E736 /* JSWebAssemblyInstance.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyInstance.cpp; path = js/JSWebAssemblyInstance.cpp; sourceTree = "<group>"; };
+		AD2FCBA91DB58DA400B3E736 /* JSWebAssemblyInstance.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyInstance.h; path = js/JSWebAssemblyInstance.h; sourceTree = "<group>"; };
+		AD2FCBAA1DB58DA400B3E736 /* JSWebAssemblyMemory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyMemory.cpp; path = js/JSWebAssemblyMemory.cpp; sourceTree = "<group>"; };
+		AD2FCBAB1DB58DA400B3E736 /* JSWebAssemblyMemory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyMemory.h; path = js/JSWebAssemblyMemory.h; sourceTree = "<group>"; };
+		AD2FCBAC1DB58DA400B3E736 /* JSWebAssemblyRuntimeError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyRuntimeError.cpp; path = js/JSWebAssemblyRuntimeError.cpp; sourceTree = "<group>"; };
+		AD2FCBAD1DB58DA400B3E736 /* JSWebAssemblyRuntimeError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyRuntimeError.h; path = js/JSWebAssemblyRuntimeError.h; sourceTree = "<group>"; };
+		AD2FCBAE1DB58DA400B3E736 /* JSWebAssemblyTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyTable.cpp; path = js/JSWebAssemblyTable.cpp; sourceTree = "<group>"; };
+		AD2FCBAF1DB58DA400B3E736 /* JSWebAssemblyTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyTable.h; path = js/JSWebAssemblyTable.h; sourceTree = "<group>"; };
+		AD2FCBB01DB58DA400B3E736 /* WebAssemblyCompileErrorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyCompileErrorConstructor.cpp; path = js/WebAssemblyCompileErrorConstructor.cpp; sourceTree = "<group>"; };
+		AD2FCBB11DB58DA400B3E736 /* WebAssemblyCompileErrorConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyCompileErrorConstructor.h; path = js/WebAssemblyCompileErrorConstructor.h; sourceTree = "<group>"; };
+		AD2FCBB21DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyCompileErrorPrototype.cpp; path = js/WebAssemblyCompileErrorPrototype.cpp; sourceTree = "<group>"; };
+		AD2FCBB31DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyCompileErrorPrototype.h; path = js/WebAssemblyCompileErrorPrototype.h; sourceTree = "<group>"; };
+		AD2FCBB41DB58DA400B3E736 /* WebAssemblyInstanceConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyInstanceConstructor.cpp; path = js/WebAssemblyInstanceConstructor.cpp; sourceTree = "<group>"; };
+		AD2FCBB51DB58DA400B3E736 /* WebAssemblyInstanceConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyInstanceConstructor.h; path = js/WebAssemblyInstanceConstructor.h; sourceTree = "<group>"; };
+		AD2FCBB61DB58DA400B3E736 /* WebAssemblyInstancePrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyInstancePrototype.cpp; path = js/WebAssemblyInstancePrototype.cpp; sourceTree = "<group>"; };
+		AD2FCBB71DB58DA400B3E736 /* WebAssemblyInstancePrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyInstancePrototype.h; path = js/WebAssemblyInstancePrototype.h; sourceTree = "<group>"; };
+		AD2FCBB81DB58DA400B3E736 /* WebAssemblyMemoryConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyMemoryConstructor.cpp; path = js/WebAssemblyMemoryConstructor.cpp; sourceTree = "<group>"; };
+		AD2FCBB91DB58DA400B3E736 /* WebAssemblyMemoryConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyMemoryConstructor.h; path = js/WebAssemblyMemoryConstructor.h; sourceTree = "<group>"; };
+		AD2FCBBA1DB58DA400B3E736 /* WebAssemblyMemoryPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyMemoryPrototype.cpp; path = js/WebAssemblyMemoryPrototype.cpp; sourceTree = "<group>"; };
+		AD2FCBBB1DB58DA400B3E736 /* WebAssemblyMemoryPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyMemoryPrototype.h; path = js/WebAssemblyMemoryPrototype.h; sourceTree = "<group>"; };
+		AD2FCBBC1DB58DA400B3E736 /* WebAssemblyRuntimeErrorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyRuntimeErrorConstructor.cpp; path = js/WebAssemblyRuntimeErrorConstructor.cpp; sourceTree = "<group>"; };
+		AD2FCBBD1DB58DA400B3E736 /* WebAssemblyRuntimeErrorConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyRuntimeErrorConstructor.h; path = js/WebAssemblyRuntimeErrorConstructor.h; sourceTree = "<group>"; };
+		AD2FCBBE1DB58DA400B3E736 /* WebAssemblyRuntimeErrorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyRuntimeErrorPrototype.cpp; path = js/WebAssemblyRuntimeErrorPrototype.cpp; sourceTree = "<group>"; };
+		AD2FCBBF1DB58DA400B3E736 /* WebAssemblyRuntimeErrorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyRuntimeErrorPrototype.h; path = js/WebAssemblyRuntimeErrorPrototype.h; sourceTree = "<group>"; };
+		AD2FCBC01DB58DA400B3E736 /* WebAssemblyTableConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyTableConstructor.cpp; path = js/WebAssemblyTableConstructor.cpp; sourceTree = "<group>"; };
+		AD2FCBC11DB58DA400B3E736 /* WebAssemblyTableConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyTableConstructor.h; path = js/WebAssemblyTableConstructor.h; sourceTree = "<group>"; };
+		AD2FCBC21DB58DA400B3E736 /* WebAssemblyTablePrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyTablePrototype.cpp; path = js/WebAssemblyTablePrototype.cpp; sourceTree = "<group>"; };
+		AD2FCBC31DB58DA400B3E736 /* WebAssemblyTablePrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyTablePrototype.h; path = js/WebAssemblyTablePrototype.h; sourceTree = "<group>"; };
+		AD2FCC0A1DB59C5900B3E736 /* WebAssemblyCompileErrorConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyCompileErrorConstructor.lut.h; sourceTree = SOURCE_ROOT; };
+		AD2FCC0B1DB59C5900B3E736 /* WebAssemblyCompileErrorPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyCompileErrorPrototype.lut.h; sourceTree = "<group>"; };
+		AD2FCC0C1DB59C5900B3E736 /* WebAssemblyInstanceConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyInstanceConstructor.lut.h; sourceTree = "<group>"; };
+		AD2FCC0D1DB59C5900B3E736 /* WebAssemblyInstancePrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyInstancePrototype.lut.h; sourceTree = "<group>"; };
+		AD2FCC0E1DB59C5900B3E736 /* WebAssemblyMemoryConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyMemoryConstructor.lut.h; sourceTree = "<group>"; };
+		AD2FCC0F1DB59C5900B3E736 /* WebAssemblyMemoryPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyMemoryPrototype.lut.h; sourceTree = "<group>"; };
+		AD2FCC101DB59C5900B3E736 /* WebAssemblyModuleConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyModuleConstructor.lut.h; sourceTree = "<group>"; };
+		AD2FCC111DB59C5900B3E736 /* WebAssemblyModulePrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyModulePrototype.lut.h; sourceTree = "<group>"; };
+		AD2FCC121DB59C5900B3E736 /* WebAssemblyRuntimeErrorConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyRuntimeErrorConstructor.lut.h; sourceTree = "<group>"; };
+		AD2FCC131DB59C5900B3E736 /* WebAssemblyRuntimeErrorPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyRuntimeErrorPrototype.lut.h; sourceTree = "<group>"; };
+		AD2FCC141DB59C5900B3E736 /* WebAssemblyTableConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyTableConstructor.lut.h; sourceTree = "<group>"; };
+		AD2FCC151DB59C5900B3E736 /* WebAssemblyTablePrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebAssemblyTablePrototype.lut.h; sourceTree = "<group>"; };
+		AD2FCC261DB838C400B3E736 /* WebAssemblyPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyPrototype.cpp; path = js/WebAssemblyPrototype.cpp; sourceTree = "<group>"; };
+		AD2FCC271DB838C400B3E736 /* WebAssemblyPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyPrototype.h; path = js/WebAssemblyPrototype.h; sourceTree = "<group>"; };
+		AD2FCC2E1DB839F700B3E736 /* JSWebAssembly.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebAssembly.cpp; sourceTree = "<group>"; };
+		AD2FCC2F1DB839F700B3E736 /* JSWebAssembly.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebAssembly.h; sourceTree = "<group>"; };
+		AD2FCC321DC4045300B3E736 /* WasmFormat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmFormat.cpp; sourceTree = "<group>"; };
+		AD4937C11DDBE60A0077C807 /* AbstractModuleRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractModuleRecord.cpp; sourceTree = "<group>"; };
+		AD4937C21DDBE60A0077C807 /* AbstractModuleRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractModuleRecord.h; sourceTree = "<group>"; };
+		AD4937C51DDCDCF00077C807 /* WebAssemblyModuleRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyModuleRecord.cpp; path = js/WebAssemblyModuleRecord.cpp; sourceTree = "<group>"; };
+		AD4937C61DDCDCF00077C807 /* WebAssemblyModuleRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyModuleRecord.h; path = js/WebAssemblyModuleRecord.h; sourceTree = "<group>"; };
+		AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyFunction.cpp; path = js/WebAssemblyFunction.cpp; sourceTree = "<group>"; };
+		AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyFunction.h; path = js/WebAssemblyFunction.h; sourceTree = "<group>"; };
+		AD4B1DF71DF244D70071AE32 /* WasmBinding.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmBinding.cpp; sourceTree = "<group>"; };
+		AD4B1DF81DF244D70071AE32 /* WasmBinding.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmBinding.h; sourceTree = "<group>"; };
+		AD86A93D1AA4D87C002FE77F /* WeakGCMapInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCMapInlines.h; sourceTree = "<group>"; };
+		ADBC54D21DF8EA00005BF738 /* WebAssemblyToJSCallee.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebAssemblyToJSCallee.cpp; path = js/WebAssemblyToJSCallee.cpp; sourceTree = "<group>"; };
+		ADBC54D31DF8EA00005BF738 /* WebAssemblyToJSCallee.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebAssemblyToJSCallee.h; path = js/WebAssemblyToJSCallee.h; sourceTree = "<group>"; };
+		ADDB1F6218D77DB7009B58A8 /* OpaqueRootSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OpaqueRootSet.h; sourceTree = "<group>"; };
+		B59F89371891AD3300D5CCDC /* UnlinkedInstructionStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnlinkedInstructionStream.h; sourceTree = "<group>"; };
+		B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UnlinkedInstructionStream.cpp; sourceTree = "<group>"; };
+		BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = ToolExecutable.xcconfig; sourceTree = "<group>"; };
+		BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorConstructor.cpp; sourceTree = "<group>"; };
+		BC02E9050E1839DB000F9297 /* ErrorConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorConstructor.h; sourceTree = "<group>"; };
+		BC02E9060E1839DB000F9297 /* ErrorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorPrototype.cpp; sourceTree = "<group>"; };
+		BC02E9070E1839DB000F9297 /* ErrorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorPrototype.h; sourceTree = "<group>"; };
+		BC02E9080E1839DB000F9297 /* NativeErrorConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NativeErrorConstructor.cpp; sourceTree = "<group>"; };
+		BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NativeErrorConstructor.h; sourceTree = "<group>"; };
+		BC02E90A0E1839DB000F9297 /* NativeErrorPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NativeErrorPrototype.cpp; sourceTree = "<group>"; };
+		BC02E90B0E1839DB000F9297 /* NativeErrorPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NativeErrorPrototype.h; sourceTree = "<group>"; };
+		BC02E98A0E183E38000F9297 /* ErrorInstance.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorInstance.cpp; sourceTree = "<group>"; };
+		BC02E98B0E183E38000F9297 /* ErrorInstance.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorInstance.h; sourceTree = "<group>"; };
+		BC02E9B60E1842FA000F9297 /* JSString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSString.cpp; sourceTree = "<group>"; };
+		BC02E9B80E184545000F9297 /* GetterSetter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetterSetter.cpp; sourceTree = "<group>"; };
+		BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSAPIValueWrapper.cpp; path = ../runtime/JSAPIValueWrapper.cpp; sourceTree = "<group>"; };
+		BC0894D60FAFBA2D00001865 /* JSAPIValueWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSAPIValueWrapper.h; path = ../runtime/JSAPIValueWrapper.h; sourceTree = "<group>"; };
+		BC1166000E1997B1008066DD /* DateInstance.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DateInstance.cpp; sourceTree = "<group>"; };
+		BC1166010E1997B1008066DD /* DateInstance.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateInstance.h; sourceTree = "<group>"; };
+		BC11667A0E199C05008066DD /* InternalFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InternalFunction.h; sourceTree = "<group>"; };
+		BC1167D80E19BCC9008066DD /* JSCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCell.h; sourceTree = "<group>"; };
+		BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringConstructor.cpp; sourceTree = "<group>"; };
+		BC18C3C10E16EE3300B34460 /* StringConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringConstructor.h; sourceTree = "<group>"; };
+		BC18C3C20E16EE3300B34460 /* StringObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringObject.cpp; sourceTree = "<group>"; };
+		BC18C3C30E16EE3300B34460 /* StringObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringObject.h; sourceTree = "<group>"; };
+		BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringPrototype.cpp; sourceTree = "<group>"; };
+		BC18C3C60E16EE3300B34460 /* StringPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringPrototype.h; sourceTree = "<group>"; };
+		BC18C52D0E16FCE100B34460 /* Lexer.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Lexer.lut.h; sourceTree = "<group>"; };
+		BC22A3980E16E14800AF21C8 /* JSObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSObject.cpp; sourceTree = "<group>"; };
+		BC22A3990E16E14800AF21C8 /* JSObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObject.h; sourceTree = "<group>"; };
+		BC22A39A0E16E14800AF21C8 /* JSEnvironmentRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEnvironmentRecord.cpp; sourceTree = "<group>"; };
+		BC2680C00E16D4E900A06E92 /* FunctionConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionConstructor.cpp; sourceTree = "<group>"; };
+		BC2680C10E16D4E900A06E92 /* FunctionConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionConstructor.h; sourceTree = "<group>"; };
+		BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NumberConstructor.cpp; sourceTree = "<group>"; };
+		BC2680C30E16D4E900A06E92 /* NumberConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberConstructor.h; sourceTree = "<group>"; };
+		BC2680C40E16D4E900A06E92 /* NumberPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NumberPrototype.cpp; sourceTree = "<group>"; };
+		BC2680C50E16D4E900A06E92 /* NumberPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberPrototype.h; sourceTree = "<group>"; };
+		BC2680C60E16D4E900A06E92 /* ObjectConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ObjectConstructor.cpp; sourceTree = "<group>"; };
+		BC2680C70E16D4E900A06E92 /* ObjectConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectConstructor.h; sourceTree = "<group>"; };
+		BC2680C80E16D4E900A06E92 /* ObjectPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ObjectPrototype.cpp; sourceTree = "<group>"; };
+		BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectPrototype.h; sourceTree = "<group>"; };
+		BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberConstructor.lut.h; sourceTree = "<group>"; };
+		BC3046060E1F497F003232CF /* Error.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Error.h; sourceTree = "<group>"; };
+		BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; path = GetterSetter.h; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
+		BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = "<group>"; };
+		BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = "<group>"; };
+		BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectFunctions.cpp; sourceTree = "<group>"; };
+		BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectFunctions.h; sourceTree = "<group>"; };
+		BC7952060E15E8A800A898AB /* ArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayConstructor.cpp; sourceTree = "<group>"; };
+		BC7952070E15E8A800A898AB /* ArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayConstructor.h; sourceTree = "<group>"; };
+		BC7952320E15EB5600A898AB /* BooleanConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BooleanConstructor.cpp; sourceTree = "<group>"; };
+		BC7952330E15EB5600A898AB /* BooleanConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanConstructor.h; sourceTree = "<group>"; };
+		BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BooleanPrototype.cpp; sourceTree = "<group>"; };
+		BC7952350E15EB5600A898AB /* BooleanPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BooleanPrototype.h; sourceTree = "<group>"; };
+		BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCell.cpp; sourceTree = "<group>"; };
+		BC87CDB810712ACA000614CF /* JSONObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.lut.h; sourceTree = "<group>"; };
+		BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstructData.h; sourceTree = "<group>"; };
+		BC9041470EB9250900FE26FA /* StructureTransitionTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureTransitionTable.h; sourceTree = "<group>"; };
+		BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyMapHashTable.h; sourceTree = "<group>"; };
+		BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InternalFunction.cpp; sourceTree = "<group>"; };
+		BCA62DFE0E2826230004F30D /* CallData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CallData.cpp; sourceTree = "<group>"; };
+		BCA62DFF0E2826310004F30D /* ConstructData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConstructData.cpp; sourceTree = "<group>"; };
+		BCBE2CAD14E985AA000593AD /* GCAssertions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCAssertions.h; sourceTree = "<group>"; };
+		BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureStubInfo.h; sourceTree = "<group>"; };
+		BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureStubInfo.cpp; sourceTree = "<group>"; };
+		BCD202BD0E1706A7002C7E82 /* RegExpConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpConstructor.cpp; sourceTree = "<group>"; };
+		BCD202BE0E1706A7002C7E82 /* RegExpConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpConstructor.h; sourceTree = "<group>"; };
+		BCD202BF0E1706A7002C7E82 /* RegExpPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpPrototype.cpp; sourceTree = "<group>"; };
+		BCD202C00E1706A7002C7E82 /* RegExpPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpPrototype.h; sourceTree = "<group>"; };
+		BCD202D50E170708002C7E82 /* RegExpConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpConstructor.lut.h; sourceTree = "<group>"; };
+		BCD203450E17135E002C7E82 /* DateConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DateConstructor.cpp; sourceTree = "<group>"; };
+		BCD203460E17135E002C7E82 /* DateConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateConstructor.h; sourceTree = "<group>"; };
+		BCD203470E17135E002C7E82 /* DatePrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatePrototype.cpp; sourceTree = "<group>"; };
+		BCD203480E17135E002C7E82 /* DatePrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatePrototype.h; sourceTree = "<group>"; };
+		BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatePrototype.lut.h; sourceTree = "<group>"; };
+		BCDD51E90FB8DF74004A8BDC /* JITOpcodes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITOpcodes.cpp; sourceTree = "<group>"; };
+		BCDE3AB00E6C82CF001453A7 /* Structure.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Structure.cpp; sourceTree = "<group>"; };
+		BCDE3AB10E6C82CF001453A7 /* Structure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Structure.h; sourceTree = "<group>"; };
+		BCF605110E203EF800B9A64D /* ArgList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArgList.cpp; sourceTree = "<group>"; };
+		BCF605120E203EF800B9A64D /* ArgList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArgList.h; sourceTree = "<group>"; };
+		BCFD8C900EEB2EE700283848 /* JumpTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JumpTable.cpp; sourceTree = "<group>"; };
+		BCFD8C910EEB2EE700283848 /* JumpTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JumpTable.h; sourceTree = "<group>"; };
+		BDB4B5E099CD4C1BB3C1CF05 /* TemplateRegistryKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TemplateRegistryKey.cpp; sourceTree = "<group>"; };
+		C203281E1981979D0088B499 /* CustomGlobalObjectClassTest.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = CustomGlobalObjectClassTest.c; path = API/tests/CustomGlobalObjectClassTest.c; sourceTree = "<group>"; };
+		C203281F1981979D0088B499 /* CustomGlobalObjectClassTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CustomGlobalObjectClassTest.h; path = API/tests/CustomGlobalObjectClassTest.h; sourceTree = "<group>"; };
+		C20BA92C16BB1C1500B3AEA2 /* StructureRareDataInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureRareDataInlines.h; sourceTree = "<group>"; };
+		C211B574176A224D000E2A23 /* APICallbackFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APICallbackFunction.h; sourceTree = "<group>"; };
+		C2181FC018A948FB0025A235 /* JSExportTests.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSExportTests.h; path = API/tests/JSExportTests.h; sourceTree = "<group>"; };
+		C2181FC118A948FB0025A235 /* JSExportTests.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = JSExportTests.mm; path = API/tests/JSExportTests.mm; sourceTree = "<group>"; };
+		C225494215F7DBAA0065E898 /* SlotVisitor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SlotVisitor.cpp; sourceTree = "<group>"; };
+		C24D31E0161CD695002AA4DB /* HeapStatistics.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapStatistics.cpp; sourceTree = "<group>"; };
+		C24D31E1161CD695002AA4DB /* HeapStatistics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapStatistics.h; sourceTree = "<group>"; };
+		C25D709916DE99F400FCA6BC /* JSManagedValue.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = JSManagedValue.mm; sourceTree = "<group>"; };
+		C25D709A16DE99F400FCA6BC /* JSManagedValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSManagedValue.h; sourceTree = "<group>"; };
+		C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IncrementalSweeper.cpp; sourceTree = "<group>"; };
+		C25F8BCC157544A900245B71 /* IncrementalSweeper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IncrementalSweeper.h; sourceTree = "<group>"; };
+		C28318FF16FE4B7D00157BFD /* HandleBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleBlock.h; sourceTree = "<group>"; };
+		C283190116FE533E00157BFD /* HandleBlockInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HandleBlockInlines.h; sourceTree = "<group>"; };
+		C288B2DC18A54D3E007BE40B /* DateTests.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DateTests.h; path = API/tests/DateTests.h; sourceTree = "<group>"; };
+		C288B2DD18A54D3E007BE40B /* DateTests.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = DateTests.mm; path = API/tests/DateTests.mm; sourceTree = "<group>"; };
+		C2981FD617BAEE4B00A3BC98 /* DFGDesiredWeakReferences.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredWeakReferences.cpp; path = dfg/DFGDesiredWeakReferences.cpp; sourceTree = "<group>"; };
+		C2981FD717BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredWeakReferences.h; path = dfg/DFGDesiredWeakReferences.h; sourceTree = "<group>"; };
+		C29ECB011804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = CurrentThisInsideBlockGetterTest.mm; path = API/tests/CurrentThisInsideBlockGetterTest.mm; sourceTree = "<group>"; };
+		C29ECB021804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CurrentThisInsideBlockGetterTest.h; path = API/tests/CurrentThisInsideBlockGetterTest.h; sourceTree = "<group>"; };
+		C2A7F687160432D400F76B98 /* JSDestructibleObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDestructibleObject.h; sourceTree = "<group>"; };
+		C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrierInlines.h; sourceTree = "<group>"; };
+		C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedAllocator.h; sourceTree = "<group>"; };
+		C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedAllocator.cpp; sourceTree = "<group>"; };
+		C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredTransitions.cpp; path = dfg/DFGDesiredTransitions.cpp; sourceTree = "<group>"; };
+		C2C0F7CC17BBFC5B00464FE4 /* DFGDesiredTransitions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredTransitions.h; path = dfg/DFGDesiredTransitions.h; sourceTree = "<group>"; };
+		C2CF39BF16E15A8100DD69BE /* JSAPIWrapperObject.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = JSAPIWrapperObject.mm; sourceTree = "<group>"; };
+		C2CF39C016E15A8100DD69BE /* JSAPIWrapperObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSAPIWrapperObject.h; sourceTree = "<group>"; };
+		C2DA778218E259990066FCB6 /* HeapInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapInlines.h; sourceTree = "<group>"; };
+		C2E526BB1590EF000054E48D /* HeapTimer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapTimer.cpp; sourceTree = "<group>"; };
+		C2E526BC1590EF000054E48D /* HeapTimer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapTimer.h; sourceTree = "<group>"; };
+		C2F0F2D016BAEEE900187C19 /* StructureRareData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureRareData.cpp; sourceTree = "<group>"; };
+		C2FCAE0C17A9C24E0034C735 /* BytecodeBasicBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BytecodeBasicBlock.cpp; sourceTree = "<group>"; };
+		C2FCAE0D17A9C24E0034C735 /* BytecodeBasicBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeBasicBlock.h; sourceTree = "<group>"; };
+		C2FCAE0E17A9C24E0034C735 /* BytecodeLivenessAnalysis.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BytecodeLivenessAnalysis.cpp; sourceTree = "<group>"; };
+		C2FCAE0F17A9C24E0034C735 /* BytecodeLivenessAnalysis.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeLivenessAnalysis.h; sourceTree = "<group>"; };
+		C2FE18A316BAEC4000AF3061 /* StructureRareData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureRareData.h; sourceTree = "<group>"; };
+		C4703CBF192844960013FBEA /* generate-inspector-protocol-bindings.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = "generate-inspector-protocol-bindings.py"; sourceTree = "<group>"; };
+		C4703CC2192844CC0013FBEA /* __init__.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = __init__.py; sourceTree = "<group>"; };
+		C4703CC3192844CC0013FBEA /* generate_js_backend_commands.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_js_backend_commands.py; sourceTree = "<group>"; };
+		C4703CCA192844CC0013FBEA /* generator_templates.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generator_templates.py; sourceTree = "<group>"; };
+		C4703CCB192844CC0013FBEA /* generator.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generator.py; sourceTree = "<group>"; };
+		C4703CCC192844CC0013FBEA /* models.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = models.py; sourceTree = "<group>"; };
+		C4F4B6CF1A05C76F005CAB76 /* cpp_generator_templates.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = cpp_generator_templates.py; sourceTree = "<group>"; };
+		C4F4B6D01A05C76F005CAB76 /* cpp_generator.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = cpp_generator.py; sourceTree = "<group>"; };
+		C4F4B6D11A05C76F005CAB76 /* generate_cpp_backend_dispatcher_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_cpp_backend_dispatcher_header.py; sourceTree = "<group>"; };
+		C4F4B6D21A05C76F005CAB76 /* generate_cpp_backend_dispatcher_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_cpp_backend_dispatcher_implementation.py; sourceTree = "<group>"; };
+		C4F4B6D31A05C76F005CAB76 /* generate_cpp_frontend_dispatcher_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_cpp_frontend_dispatcher_header.py; sourceTree = "<group>"; };
+		C4F4B6D41A05C76F005CAB76 /* generate_cpp_frontend_dispatcher_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_cpp_frontend_dispatcher_implementation.py; sourceTree = "<group>"; };
+		C4F4B6D51A05C76F005CAB76 /* generate_cpp_protocol_types_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_cpp_protocol_types_header.py; sourceTree = "<group>"; };
+		C4F4B6D61A05C76F005CAB76 /* generate_cpp_protocol_types_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_cpp_protocol_types_implementation.py; sourceTree = "<group>"; };
+		C4F4B6D71A05C76F005CAB76 /* generate_objc_protocol_types_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = generate_objc_protocol_types_implementation.py; sourceTree = "<group>"; };
+		C4F4B6D81A05C76F005CAB76 /* objc_generator_templates.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = objc_generator_templates.py; sourceTree = "<group>"; };
+		D21202280AD4310C00ED79B6 /* DateConversion.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = DateConversion.cpp; sourceTree = "<group>"; };
+		D21202290AD4310C00ED79B6 /* DateConversion.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DateConversion.h; sourceTree = "<group>"; };
+		DC00039019D8BE6F00023EB0 /* DFGPreciseLocalClobberize.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPreciseLocalClobberize.h; path = dfg/DFGPreciseLocalClobberize.h; sourceTree = "<group>"; };
+		DC0184171D10C1870057B053 /* JITWorklist.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITWorklist.cpp; sourceTree = "<group>"; };
+		DC0184181D10C1870057B053 /* JITWorklist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITWorklist.h; sourceTree = "<group>"; };
+		DC17E8131C9C7FD4008A6AB3 /* ShadowChicken.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowChicken.cpp; sourceTree = "<group>"; };
+		DC17E8141C9C7FD4008A6AB3 /* ShadowChicken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowChicken.h; sourceTree = "<group>"; };
+		DC17E8151C9C7FD4008A6AB3 /* ShadowChickenInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowChickenInlines.h; sourceTree = "<group>"; };
+		DC17E8161C9C802B008A6AB3 /* CCallHelpers.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CCallHelpers.cpp; sourceTree = "<group>"; };
+		DC2143051CA32E52000A8869 /* ICStats.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ICStats.cpp; sourceTree = "<group>"; };
+		DC2143061CA32E52000A8869 /* ICStats.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ICStats.h; sourceTree = "<group>"; };
+		DC3D2B091D34316100BA918C /* HeapCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapCell.h; sourceTree = "<group>"; };
+		DC3D2B0B1D34376E00BA918C /* HeapCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapCell.cpp; sourceTree = "<group>"; };
+		DC454B8A1D00E81F004C18AF /* AirDumpAsJS.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AirDumpAsJS.cpp; path = b3/air/AirDumpAsJS.cpp; sourceTree = "<group>"; };
+		DC454B8B1D00E81F004C18AF /* AirDumpAsJS.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AirDumpAsJS.h; path = b3/air/AirDumpAsJS.h; sourceTree = "<group>"; };
+		DC605B591CE26E9800593718 /* ProfilerEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerEvent.cpp; path = profiler/ProfilerEvent.cpp; sourceTree = "<group>"; };
+		DC605B5A1CE26E9800593718 /* ProfilerEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerEvent.h; path = profiler/ProfilerEvent.h; sourceTree = "<group>"; };
+		DC605B5B1CE26E9800593718 /* ProfilerUID.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ProfilerUID.cpp; path = profiler/ProfilerUID.cpp; sourceTree = "<group>"; };
+		DC605B5C1CE26E9800593718 /* ProfilerUID.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ProfilerUID.h; path = profiler/ProfilerUID.h; sourceTree = "<group>"; };
+		DC69AA651CF7A1EF00C6272F /* MatchResult.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MatchResult.cpp; sourceTree = "<group>"; };
+		DC69B99A1D15F90F002E3C00 /* B3InferSwitches.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3InferSwitches.cpp; path = b3/B3InferSwitches.cpp; sourceTree = "<group>"; };
+		DC69B99B1D15F90F002E3C00 /* B3InferSwitches.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3InferSwitches.h; path = b3/B3InferSwitches.h; sourceTree = "<group>"; };
+		DC7997811CDE9F9E004D4A09 /* TagRegistersMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TagRegistersMode.cpp; sourceTree = "<group>"; };
+		DC7997821CDE9F9E004D4A09 /* TagRegistersMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TagRegistersMode.h; sourceTree = "<group>"; };
+		DC9A0C1C1D2D94EF0085124E /* B3CaseCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3CaseCollection.cpp; path = b3/B3CaseCollection.cpp; sourceTree = "<group>"; };
+		DC9A0C1D1D2D94EF0085124E /* B3CaseCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3CaseCollection.h; path = b3/B3CaseCollection.h; sourceTree = "<group>"; };
+		DC9A0C1E1D2D94EF0085124E /* B3CaseCollectionInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3CaseCollectionInlines.h; path = b3/B3CaseCollectionInlines.h; sourceTree = "<group>"; };
+		DCEE22061CEB9890000C2396 /* DFGBackwardsCFG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBackwardsCFG.h; path = dfg/DFGBackwardsCFG.h; sourceTree = "<group>"; };
+		DCEE22071CEB9890000C2396 /* DFGBackwardsDominators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBackwardsDominators.h; path = dfg/DFGBackwardsDominators.h; sourceTree = "<group>"; };
+		DCEE22081CEB9890000C2396 /* DFGControlEquivalenceAnalysis.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGControlEquivalenceAnalysis.h; path = dfg/DFGControlEquivalenceAnalysis.h; sourceTree = "<group>"; };
+		DCEE220C1CEBAF73000C2396 /* DFGNullAbstractState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNullAbstractState.h; path = dfg/DFGNullAbstractState.h; sourceTree = "<group>"; };
+		DCF3D5641CD29468003D5C65 /* LazyClassStructure.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LazyClassStructure.cpp; sourceTree = "<group>"; };
+		DCF3D5651CD29468003D5C65 /* LazyClassStructure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyClassStructure.h; sourceTree = "<group>"; };
+		DCF3D5661CD29468003D5C65 /* LazyClassStructureInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyClassStructureInlines.h; sourceTree = "<group>"; };
+		DCF3D5671CD29468003D5C65 /* LazyProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyProperty.h; sourceTree = "<group>"; };
+		DCF3D5681CD29468003D5C65 /* LazyPropertyInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyPropertyInlines.h; sourceTree = "<group>"; };
+		DCFDFBD71D1F5D9800FE3D72 /* B3BottomProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3BottomProvider.h; path = b3/B3BottomProvider.h; sourceTree = "<group>"; };
+		DCFDFBD81D1F5D9800FE3D72 /* B3TypeMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3TypeMap.h; path = b3/B3TypeMap.h; sourceTree = "<group>"; };
+		DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BuiltinExecutableCreator.h; sourceTree = "<group>"; };
+		DE26E9061CB5DD9600D2BE82 /* BuiltinExecutableCreator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BuiltinExecutableCreator.cpp; sourceTree = "<group>"; };
+		DE5A09FF1BA3AC3E003D4424 /* IntrinsicEmitter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntrinsicEmitter.cpp; sourceTree = "<group>"; };
+		E124A8F50E555775003091F1 /* OpaqueJSString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OpaqueJSString.h; sourceTree = "<group>"; };
+		E124A8F60E555775003091F1 /* OpaqueJSString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OpaqueJSString.cpp; sourceTree = "<group>"; };
+		E178633F0D9BEC0000D74E75 /* InitializeThreading.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InitializeThreading.h; sourceTree = "<group>"; };
+		E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InitializeThreading.cpp; sourceTree = "<group>"; };
+		E18E3A560DF9278C00D90B34 /* VM.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; path = VM.h; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
+		E18E3A570DF9278C00D90B34 /* VM.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = VM.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+		E30677971B8BC6F5003F87F0 /* ModuleLoaderPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = ModuleLoaderPrototype.js; sourceTree = "<group>"; };
+		E318CBBE1B8AEF5100A2929D /* JSModuleNamespaceObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSModuleNamespaceObject.cpp; sourceTree = "<group>"; };
+		E318CBBF1B8AEF5100A2929D /* JSModuleNamespaceObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSModuleNamespaceObject.h; sourceTree = "<group>"; };
+		E322E5A01DA64435006E7709 /* DFGDOMJITPatchpointParams.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDOMJITPatchpointParams.cpp; path = dfg/DFGDOMJITPatchpointParams.cpp; sourceTree = "<group>"; };
+		E322E5A11DA64435006E7709 /* DFGDOMJITPatchpointParams.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDOMJITPatchpointParams.h; path = dfg/DFGDOMJITPatchpointParams.h; sourceTree = "<group>"; };
+		E322E5A41DA644A4006E7709 /* FTLDOMJITPatchpointParams.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLDOMJITPatchpointParams.cpp; path = ftl/FTLDOMJITPatchpointParams.cpp; sourceTree = "<group>"; };
+		E322E5A51DA644A4006E7709 /* FTLDOMJITPatchpointParams.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLDOMJITPatchpointParams.h; path = ftl/FTLDOMJITPatchpointParams.h; sourceTree = "<group>"; };
+		E33637A31B63220200EE0840 /* ReflectObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReflectObject.cpp; sourceTree = "<group>"; };
+		E33637A41B63220200EE0840 /* ReflectObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReflectObject.h; sourceTree = "<group>"; };
+		E33B3E251B7ABD750048DB2E /* InspectorInstrumentationObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorInstrumentationObject.lut.h; sourceTree = "<group>"; };
+		E33E8D1A1B9013C300346B52 /* JSNativeStdFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNativeStdFunction.cpp; sourceTree = "<group>"; };
+		E33E8D1B1B9013C300346B52 /* JSNativeStdFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNativeStdFunction.h; sourceTree = "<group>"; };
+		E33E8D1E1B9013DE00346B52 /* NativeStdFunctionCell.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NativeStdFunctionCell.cpp; sourceTree = "<group>"; };
+		E33E8D1F1B9013DE00346B52 /* NativeStdFunctionCell.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NativeStdFunctionCell.h; sourceTree = "<group>"; };
+		E33F50721B8421C000413856 /* JSInternalPromisePrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInternalPromisePrototype.cpp; sourceTree = "<group>"; };
+		E33F50731B8421C000413856 /* JSInternalPromisePrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInternalPromisePrototype.h; sourceTree = "<group>"; };
+		E33F50761B84225700413856 /* JSInternalPromiseConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInternalPromiseConstructor.cpp; sourceTree = "<group>"; };
+		E33F50771B84225700413856 /* JSInternalPromiseConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInternalPromiseConstructor.h; sourceTree = "<group>"; };
+		E33F507E1B8429A400413856 /* JSInternalPromise.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInternalPromise.cpp; sourceTree = "<group>"; };
+		E33F507F1B8429A400413856 /* JSInternalPromise.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInternalPromise.h; sourceTree = "<group>"; };
+		E33F50821B8437A000413856 /* JSInternalPromiseDeferred.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInternalPromiseDeferred.cpp; sourceTree = "<group>"; };
+		E33F50831B8437A000413856 /* JSInternalPromiseDeferred.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInternalPromiseDeferred.h; sourceTree = "<group>"; };
+		E33F50861B8449EF00413856 /* JSInternalPromiseConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInternalPromiseConstructor.lut.h; sourceTree = "<group>"; };
+		E33F50881B844A1A00413856 /* InternalPromiseConstructor.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = InternalPromiseConstructor.js; sourceTree = "<group>"; };
+		E34EDBF61DB5FFC100DC87A5 /* FrameTracers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FrameTracers.h; sourceTree = "<group>"; };
+		E35070891DC49BB60089BCD6 /* DOMJITSignature.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITSignature.h; sourceTree = "<group>"; };
+		E354622A1B6065D100545386 /* ConstructAbility.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstructAbility.h; sourceTree = "<group>"; };
+		E3555B891DAE03A200F36921 /* DOMJITCallDOMGetterPatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITCallDOMGetterPatchpoint.h; sourceTree = "<group>"; };
+		E355F3501B7DC85300C50DC5 /* ModuleLoaderPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModuleLoaderPrototype.cpp; sourceTree = "<group>"; };
+		E355F3511B7DC85300C50DC5 /* ModuleLoaderPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModuleLoaderPrototype.h; sourceTree = "<group>"; };
+		E35CA14F1DBC3A5600F83516 /* DOMJITAbstractHeap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMJITAbstractHeap.cpp; sourceTree = "<group>"; };
+		E35CA1501DBC3A5600F83516 /* DOMJITAbstractHeap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITAbstractHeap.h; sourceTree = "<group>"; };
+		E35CA1511DBC3A5600F83516 /* DOMJITHeapRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMJITHeapRange.cpp; sourceTree = "<group>"; };
+		E35CA1521DBC3A5600F83516 /* DOMJITHeapRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITHeapRange.h; sourceTree = "<group>"; };
+		E35E035D1B7AB43E0073AD2A /* InspectorInstrumentationObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorInstrumentationObject.cpp; sourceTree = "<group>"; };
+		E35E035E1B7AB43E0073AD2A /* InspectorInstrumentationObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorInstrumentationObject.h; sourceTree = "<group>"; };
+		E35E03611B7AB4850073AD2A /* InspectorInstrumentationObject.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = InspectorInstrumentationObject.js; sourceTree = "<group>"; };
+		E3794E731B77EB97005543AE /* ModuleAnalyzer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModuleAnalyzer.cpp; sourceTree = "<group>"; };
+		E3794E741B77EB97005543AE /* ModuleAnalyzer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModuleAnalyzer.h; sourceTree = "<group>"; };
+		E37AD83A1DA4928000F3D412 /* DOMJITPatchpointParams.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITPatchpointParams.h; sourceTree = "<group>"; };
+		E37AD83B1DA4928000F3D412 /* DOMJITReg.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITReg.h; sourceTree = "<group>"; };
+		E380A76B1DCD7195000F89E6 /* MacroAssemblerHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerHelpers.h; sourceTree = "<group>"; };
+		E3963CEC1B73F75000EB4CE5 /* NodesAnalyzeModule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodesAnalyzeModule.cpp; sourceTree = "<group>"; };
+		E39D9D841D39000600667282 /* InterpreterInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InterpreterInlines.h; sourceTree = "<group>"; };
+		E39DA4A41B7E8B7C0084F33A /* JSModuleRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSModuleRecord.cpp; sourceTree = "<group>"; };
+		E39DA4A51B7E8B7C0084F33A /* JSModuleRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSModuleRecord.h; sourceTree = "<group>"; };
+		E3A421421D6F588F0007C617 /* PreciseJumpTargetsInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PreciseJumpTargetsInlines.h; sourceTree = "<group>"; };
+		E3BFD0B91DAF807C0065DEA2 /* DOMJITAccessCasePatchpointParams.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMJITAccessCasePatchpointParams.cpp; sourceTree = "<group>"; };
+		E3BFD0BA1DAF807C0065DEA2 /* DOMJITAccessCasePatchpointParams.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITAccessCasePatchpointParams.h; sourceTree = "<group>"; };
+		E3C08E3B1DA41B7B0039478F /* DOMJITPatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITPatchpoint.h; sourceTree = "<group>"; };
+		E3C79CAA1DB9A4D600D1ECA4 /* DOMJITEffect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITEffect.h; sourceTree = "<group>"; };
+		E3CB1E241DA7540A00FA1E56 /* DOMJITSlowPathCalls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITSlowPathCalls.h; sourceTree = "<group>"; };
+		E3D239C61B829C1C00BBEF67 /* JSModuleEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSModuleEnvironment.cpp; sourceTree = "<group>"; };
+		E3D239C71B829C1C00BBEF67 /* JSModuleEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSModuleEnvironment.h; sourceTree = "<group>"; };
+		E3D264261D38C042000BE174 /* BytecodeGeneratorification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BytecodeGeneratorification.cpp; sourceTree = "<group>"; };
+		E3D264271D38C042000BE174 /* BytecodeGeneratorification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeGeneratorification.h; sourceTree = "<group>"; };
+		E3D264281D38C042000BE174 /* BytecodeGraph.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeGraph.h; sourceTree = "<group>"; };
+		E3D264291D38C042000BE174 /* BytecodeRewriter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BytecodeRewriter.cpp; sourceTree = "<group>"; };
+		E3D2642A1D38C042000BE174 /* BytecodeRewriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeRewriter.h; sourceTree = "<group>"; };
+		E3EF88721B66DF23003F26CB /* JSPropertyNameIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPropertyNameIterator.cpp; sourceTree = "<group>"; };
+		E3EF88731B66DF23003F26CB /* JSPropertyNameIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPropertyNameIterator.h; sourceTree = "<group>"; };
+		E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITGetterSetter.h; sourceTree = "<group>"; };
+		E3FFC8521DAD7D1000DEA53E /* DOMJITValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITValue.h; sourceTree = "<group>"; };
+		E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCacheItem.h; sourceTree = "<group>"; };
+		E49DC15112EF272200184A1F /* SourceProviderCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCache.h; sourceTree = "<group>"; };
+		E49DC15512EF277200184A1F /* SourceProviderCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SourceProviderCache.cpp; sourceTree = "<group>"; };
+		F5BB2BC5030F772101FCFE1D /* Completion.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Completion.h; sourceTree = "<group>"; tabWidth = 8; };
+		F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JavaScriptCorePrefix.h; sourceTree = "<group>"; tabWidth = 8; };
+		F68EBB8C0255D4C601FF60F7 /* config.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = config.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A84D0255597D01FF60F7 /* ArrayPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = ArrayPrototype.cpp; sourceTree = "<group>"; tabWidth = 8; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+		F692A84E0255597D01FF60F7 /* ArrayPrototype.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = ArrayPrototype.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8500255597D01FF60F7 /* BooleanObject.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BooleanObject.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8540255597D01FF60F7 /* create_hash_table */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = text.script.perl; path = create_hash_table; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8580255597D01FF60F7 /* Debugger.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Debugger.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8590255597D01FF60F7 /* Debugger.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Debugger.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A85C0255597D01FF60F7 /* FunctionPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionPrototype.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A85D0255597D01FF60F7 /* FunctionPrototype.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = FunctionPrototype.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A85E0255597D01FF60F7 /* JSFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFunction.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A85F0255597D01FF60F7 /* JSFunction.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JSFunction.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8620255597D01FF60F7 /* JSString.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JSString.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8650255597D01FF60F7 /* Lexer.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Lexer.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8660255597D01FF60F7 /* Lexer.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Lexer.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8680255597D01FF60F7 /* Lookup.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Lookup.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8690255597D01FF60F7 /* Lookup.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Lookup.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A86A0255597D01FF60F7 /* MathObject.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathObject.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A86B0255597D01FF60F7 /* MathObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = MathObject.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A86D0255597D01FF60F7 /* Nodes.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Nodes.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A86E0255597D01FF60F7 /* Nodes.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Nodes.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8700255597D01FF60F7 /* NumberObject.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NumberObject.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8710255597D01FF60F7 /* NumberObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = NumberObject.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8770255597D01FF60F7 /* Operations.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Operations.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8780255597D01FF60F7 /* Operations.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Operations.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A87B0255597D01FF60F7 /* RegExpObject.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpObject.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A87C0255597D01FF60F7 /* RegExpObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = RegExpObject.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A87D0255597D01FF60F7 /* RegExp.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExp.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		F692A87E0255597D01FF60F7 /* RegExp.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = RegExp.h; sourceTree = "<group>"; tabWidth = 8; };
+		F692A8870255597D01FF60F7 /* JSCJSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCJSValue.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		FE0D4A041AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ExecutionTimeLimitTest.cpp; path = API/tests/ExecutionTimeLimitTest.cpp; sourceTree = "<group>"; };
+		FE0D4A051AB8DD0A002F54BF /* ExecutionTimeLimitTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ExecutionTimeLimitTest.h; path = API/tests/ExecutionTimeLimitTest.h; sourceTree = "<group>"; };
+		FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = GlobalContextWithFinalizerTest.cpp; path = API/tests/GlobalContextWithFinalizerTest.cpp; sourceTree = "<group>"; };
+		FE0D4A081ABA2437002F54BF /* GlobalContextWithFinalizerTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GlobalContextWithFinalizerTest.h; path = API/tests/GlobalContextWithFinalizerTest.h; sourceTree = "<group>"; };
+		FE1220251BE7F5640039E6F2 /* JITAddGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITAddGenerator.cpp; sourceTree = "<group>"; };
+		FE1220261BE7F5640039E6F2 /* JITAddGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITAddGenerator.h; sourceTree = "<group>"; };
+		FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITMulGenerator.cpp; sourceTree = "<group>"; };
+		FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITMulGenerator.h; sourceTree = "<group>"; };
+		FE187A0A1C0229230038BBCA /* JITDivGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITDivGenerator.cpp; sourceTree = "<group>"; };
+		FE187A0B1C0229230038BBCA /* JITDivGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITDivGenerator.h; sourceTree = "<group>"; };
+		FE187A0C1C02EBA70038BBCA /* SnippetOperand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetOperand.h; sourceTree = "<group>"; };
+		FE1C0FFC1B193E9800B53FCA /* Exception.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Exception.h; sourceTree = "<group>"; };
+		FE1C0FFE1B194FD100B53FCA /* Exception.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Exception.cpp; sourceTree = "<group>"; };
+		FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntCLoop.cpp; path = llint/LLIntCLoop.cpp; sourceTree = "<group>"; };
+		FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntCLoop.h; path = llint/LLIntCLoop.h; sourceTree = "<group>"; };
+		FE2E6A7A1D6EA5FE0060F896 /* ThrowScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThrowScope.cpp; sourceTree = "<group>"; };
+		FE3022D01E3D739600BAC493 /* SigillCrashAnalyzer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SigillCrashAnalyzer.cpp; sourceTree = "<group>"; };
+		FE3022D11E3D739600BAC493 /* SigillCrashAnalyzer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SigillCrashAnalyzer.h; sourceTree = "<group>"; };
+		FE3022D41E42856700BAC493 /* VMInspector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VMInspector.cpp; sourceTree = "<group>"; };
+		FE3022D51E42856700BAC493 /* VMInspector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VMInspector.h; sourceTree = "<group>"; };
+		FE3022D81E43C85500BAC493 /* JSVirtualMachinePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSVirtualMachinePrivate.h; sourceTree = "<group>"; };
+		FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ECMAScriptSpecInternalFunctions.cpp; sourceTree = "<group>"; };
+		FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ECMAScriptSpecInternalFunctions.h; sourceTree = "<group>"; };
+		FE3422111D6B818C0032BE88 /* ThrowScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThrowScope.h; sourceTree = "<group>"; };
+		FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDollarVM.cpp; sourceTree = "<group>"; };
+		FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDollarVM.h; sourceTree = "<group>"; };
+		FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDollarVMPrototype.cpp; sourceTree = "<group>"; };
+		FE384EE41ADDB7AD0055DE2C /* JSDollarVMPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDollarVMPrototype.h; sourceTree = "<group>"; };
+		FE3913511B794AC900EDAF71 /* LiveObjectData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiveObjectData.h; sourceTree = "<group>"; };
+		FE3913521B794AC900EDAF71 /* LiveObjectList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LiveObjectList.cpp; sourceTree = "<group>"; };
+		FE3913531B794AC900EDAF71 /* LiveObjectList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiveObjectList.h; sourceTree = "<group>"; };
+		FE3A06A31C10B70800390FDD /* JITBitOrGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITBitOrGenerator.cpp; sourceTree = "<group>"; };
+		FE3A06A41C10B70800390FDD /* JITBitOrGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITBitOrGenerator.h; sourceTree = "<group>"; };
+		FE3A06A71C10BC7400390FDD /* JITBitBinaryOpGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITBitBinaryOpGenerator.h; sourceTree = "<group>"; };
+		FE3A06AD1C10CB6F00390FDD /* JITBitAndGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITBitAndGenerator.cpp; sourceTree = "<group>"; };
+		FE3A06AE1C10CB6F00390FDD /* JITBitAndGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITBitAndGenerator.h; sourceTree = "<group>"; };
+		FE3A06AF1C10CB6F00390FDD /* JITBitXorGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITBitXorGenerator.cpp; sourceTree = "<group>"; };
+		FE3A06B01C10CB6F00390FDD /* JITBitXorGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITBitXorGenerator.h; sourceTree = "<group>"; };
+		FE3A06B61C1103D900390FDD /* JITLeftShiftGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITLeftShiftGenerator.cpp; sourceTree = "<group>"; };
+		FE3A06B71C1103D900390FDD /* JITLeftShiftGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITLeftShiftGenerator.h; sourceTree = "<group>"; };
+		FE3A06B81C1103D900390FDD /* JITRightShiftGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITRightShiftGenerator.cpp; sourceTree = "<group>"; };
+		FE3A06B91C1103D900390FDD /* JITRightShiftGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITRightShiftGenerator.h; sourceTree = "<group>"; };
+		FE42388F1BE18C1200514737 /* JITSubGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITSubGenerator.cpp; sourceTree = "<group>"; };
+		FE4BFF291AD476E700088F87 /* FunctionOverrides.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionOverrides.cpp; sourceTree = "<group>"; };
+		FE4BFF2A1AD476E700088F87 /* FunctionOverrides.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionOverrides.h; sourceTree = "<group>"; };
+		FE4D55B71AE716CA0052E459 /* IterationStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IterationStatus.h; sourceTree = "<group>"; };
+		FE5068641AE246390009DAB7 /* DeferredSourceDump.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeferredSourceDump.h; sourceTree = "<group>"; };
+		FE5068661AE25E280009DAB7 /* DeferredSourceDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeferredSourceDump.cpp; sourceTree = "<group>"; };
+		FE5932A5183C5A2600A1ECCC /* VMEntryScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VMEntryScope.cpp; sourceTree = "<group>"; };
+		FE5932A6183C5A2600A1ECCC /* VMEntryScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VMEntryScope.h; sourceTree = "<group>"; };
+		FE6029D81D6E1E330030204D /* ExceptionEventLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionEventLocation.h; sourceTree = "<group>"; };
+		FE6491361D78F01300A694D4 /* ExceptionScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionScope.h; sourceTree = "<group>"; };
+		FE6491381D78F3A300A694D4 /* ExceptionScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionScope.cpp; sourceTree = "<group>"; };
+		FE68C6351B90DDD90042BCB3 /* MacroAssemblerPrinter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerPrinter.cpp; sourceTree = "<group>"; };
+		FE68C6361B90DDD90042BCB3 /* MacroAssemblerPrinter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerPrinter.h; sourceTree = "<group>"; };
+		FE7BA60D1A1A7CEC00F1F7B4 /* HeapVerifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapVerifier.cpp; sourceTree = "<group>"; };
+		FE7BA60E1A1A7CEC00F1F7B4 /* HeapVerifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapVerifier.h; sourceTree = "<group>"; };
+		FE80C1961D775B27008510C0 /* CatchScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CatchScope.h; sourceTree = "<group>"; };
+		FE80C1981D775FB4008510C0 /* CatchScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CatchScope.cpp; sourceTree = "<group>"; };
+		FE80C19A1D7768FD008510C0 /* ExceptionEventLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionEventLocation.cpp; sourceTree = "<group>"; };
+		FE90BB3A1B7CF64E006B3F03 /* VMInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VMInlines.h; sourceTree = "<group>"; };
+		FE98B5B61BB9AE110073E7A6 /* JITSubGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITSubGenerator.h; sourceTree = "<group>"; };
+		FE99B2471C24B6D300C82159 /* JITNegGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITNegGenerator.cpp; sourceTree = "<group>"; };
+		FE99B2481C24B6D300C82159 /* JITNegGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITNegGenerator.h; sourceTree = "<group>"; };
+		FEA0861E182B7A0400F6D851 /* Breakpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Breakpoint.h; sourceTree = "<group>"; };
+		FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerPrimitives.h; sourceTree = "<group>"; };
+		FEA0C4001CDD7D0E00481991 /* FunctionWhitelist.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionWhitelist.cpp; sourceTree = "<group>"; };
+		FEA0C4011CDD7D0E00481991 /* FunctionWhitelist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionWhitelist.h; sourceTree = "<group>"; };
+		FEB137561BB11EEE00CD5100 /* MacroAssemblerARM64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerARM64.cpp; sourceTree = "<group>"; };
+		FEB51F6A1A97B688001F921C /* Regress141809.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Regress141809.h; path = API/tests/Regress141809.h; sourceTree = "<group>"; };
+		FEB51F6B1A97B688001F921C /* Regress141809.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = Regress141809.mm; path = API/tests/Regress141809.mm; sourceTree = "<group>"; };
+		FEB58C12187B8B160098EF0B /* ErrorHandlingScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ErrorHandlingScope.cpp; sourceTree = "<group>"; };
+		FEB58C13187B8B160098EF0B /* ErrorHandlingScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ErrorHandlingScope.h; sourceTree = "<group>"; };
+		FECB8B251D25BB6E006F2463 /* FunctionOverridesTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FunctionOverridesTest.cpp; path = API/tests/FunctionOverridesTest.cpp; sourceTree = "<group>"; };
+		FECB8B261D25BB6E006F2463 /* FunctionOverridesTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FunctionOverridesTest.h; path = API/tests/FunctionOverridesTest.h; sourceTree = "<group>"; };
+		FECB8B291D25CABB006F2463 /* testapi-function-overrides.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = "testapi-function-overrides.js"; path = "API/tests/testapi-function-overrides.js"; sourceTree = "<group>"; };
+		FED287B115EC9A5700DA8161 /* LLIntOpcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntOpcode.h; path = llint/LLIntOpcode.h; sourceTree = "<group>"; };
+		FED94F2B171E3E2300BE77A4 /* Watchdog.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Watchdog.cpp; sourceTree = "<group>"; };
+		FED94F2C171E3E2300BE77A4 /* Watchdog.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Watchdog.h; sourceTree = "<group>"; };
+		FEDA50D41B97F442009A3B4F /* PingPongStackOverflowTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PingPongStackOverflowTest.cpp; path = API/tests/PingPongStackOverflowTest.cpp; sourceTree = "<group>"; };
+		FEDA50D51B97F4D9009A3B4F /* PingPongStackOverflowTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PingPongStackOverflowTest.h; path = API/tests/PingPongStackOverflowTest.h; sourceTree = "<group>"; };
+		FEF040501AAE662D00BD28B0 /* CompareAndSwapTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CompareAndSwapTest.cpp; path = API/tests/CompareAndSwapTest.cpp; sourceTree = "<group>"; };
+		FEF040521AAEC4ED00BD28B0 /* CompareAndSwapTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CompareAndSwapTest.h; path = API/tests/CompareAndSwapTest.h; sourceTree = "<group>"; };
+		FEFD6FC51D5E7970008F2F0B /* JSStringInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringInlines.h; sourceTree = "<group>"; };
+/* End PBXFileReference section */
+
+/* Begin PBXFrameworksBuildPhase section */
+		0F61833B1C45F62A0072450B /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0F61833C1C45F62A0072450B /* Foundation.framework in Frameworks */,
+				0F61833D1C45F62A0072450B /* JavaScriptCore.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		0F9327511C20BCBA00CF6564 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0F9327521C20BCBA00CF6564 /* Foundation.framework in Frameworks */,
+				0F9327531C20BCBA00CF6564 /* JavaScriptCore.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		0FEC85A21BDB5CF10080FF74 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0FEC85A31BDB5CF10080FF74 /* Foundation.framework in Frameworks */,
+				0FEC85A41BDB5CF10080FF74 /* JavaScriptCore.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		0FF922C614F46B130041A24E /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		1412111E0A48793C00480255 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				14B8EC720A5652090062BE54 /* CoreFoundation.framework in Frameworks */,
+				141211310A48794D00480255 /* JavaScriptCore.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		14BD59BD0A3E8F9000BAF59C /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				4443AE3316E188D90076F110 /* Foundation.framework in Frameworks */,
+				14BD59C50A3E8F9F00BAF59C /* JavaScriptCore.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		651122FC14046A4C002B101D /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				651122FD14046A4C002B101D /* JavaScriptCore.framework in Frameworks */,
+				651122FE14046A4C002B101D /* libedit.dylib in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		932F5BD20822A1C700736975 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */,
+				A731B25A130093880040A7FA /* Foundation.framework in Frameworks */,
+				932F5BD70822A1C700736975 /* libicucore.dylib in Frameworks */,
+				932F5BD60822A1C700736975 /* libobjc.dylib in Frameworks */,
+				A8A4748E151A8306004123FF /* libWTF.a in Frameworks */,
+				371D842D17C98B6E00ECF994 /* libz.dylib in Frameworks */,
+				A5098B041C16AA0200087797 /* Security.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		932F5BDE0822A1C700736975 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				932F5BEA0822A1C700736975 /* JavaScriptCore.framework in Frameworks */,
+				5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXFrameworksBuildPhase section */
+
+/* Begin PBXGroup section */
+		034768DFFF38A50411DB9C8B /* Products */ = {
+			isa = PBXGroup;
+			children = (
+				0F9327591C20BCBA00CF6564 /* dynbench */,
+				0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */,
+				141211200A48793C00480255 /* minidom */,
+				0F6183431C45F62A0072450B /* testair */,
+				14BD59BF0A3E8F9000BAF59C /* testapi */,
+				0FEC85AD1BDB5CF10080FF74 /* testb3 */,
+				6511230514046A4C002B101D /* testRegExp */,
+				932F5BD90822A1C700736975 /* JavaScriptCore.framework */,
+				932F5BE10822A1C700736975 /* jsc */,
+			);
+			name = Products;
+			sourceTree = "<group>";
+			tabWidth = 4;
+			usesTabs = 0;
+		};
+		0867D691FE84028FC02AAC07 /* JavaScriptCore */ = {
+			isa = PBXGroup;
+			children = (
+				65A946131C8E9F2000A7209A /* generateYarrCanonicalizeUnicode */,
+				8604F4F2143A6C4400B295F5 /* ChangeLog */,
+				F68EBB8C0255D4C601FF60F7 /* config.h */,
+				F692A8540255597D01FF60F7 /* create_hash_table */,
+				A718F8211178EB4B002465A7 /* create_regex_tables */,
+				937B63CC09E766D200A671DD /* DerivedSources.make */,
+				0F93275A1C20BCDF00CF6564 /* dynbench.cpp */,
+				6529FB3018B2D63900C61102 /* generate-bytecode-files */,
+				F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */,
+				45E12D8806A49B0F00E9DF84 /* jsc.cpp */,
+				A7C225CC139981F100FF1662 /* KeywordLookupGenerator.py */,
+				1432EBD70A34CAD400717B9F /* API */,
+				9688CB120ED12B4E001D649F /* assembler */,
+				0FEC84B21BDACD5E0080FF74 /* b3 */,
+				A54CF2EA184EA73900237F19 /* bindings */,
+				A7D8019F1880D66E0026C39B /* builtins */,
+				969A078F0ED1D3AE00F1F681 /* bytecode */,
+				7E39D81D0EC38EFA003AF11A /* bytecompiler */,
+				1C90513E0BA9E8830081E9D0 /* Configurations */,
+				1480DB9A0DDC2231003CFDF2 /* debugger */,
+				650FDF8D09D0FCA700769E54 /* Derived Sources */,
+				86EC9DB31328DF44002B2AD7 /* dfg */,
+				0FF4272E158EBCCE004CB9FF /* disassembler */,
+				E3FF752D1D9CE9EA00C7E16D /* domjit */,
+				0867D69AFE84028FC02AAC07 /* Frameworks */,
+				0FEA09FC1705137F00BB722C /* ftl */,
+				142E312A134FF0A600AFADB5 /* heap */,
+				A5BA15DF1823409200A82E69 /* inspector */,
+				1429D77A0ED20D7300B89619 /* interpreter */,
+				1429D92C0ED22D7000B89619 /* jit */,
+				0F46809C14BA7F4D00BFE272 /* llint */,
+				7E39D8370EC3A388003AF11A /* parser */,
+				034768DFFF38A50411DB9C8B /* Products */,
+				95AB831A0DA42C6900BC83F3 /* profiler */,
+				99E45A0C18A01E930026D88F /* replay */,
+				932FC3C20824BB70005B3C75 /* Resources */,
+				7EF6E0BB0EB7A1EC0079AFAF /* runtime */,
+				9959E9251BD17F1E001AA413 /* Scripts */,
+				141211000A48772600480255 /* tests */,
+				8603CEF014C753EF00AE59E3 /* tools */,
+				7B98D1331B60CD1E0023B1A4 /* wasm */,
+				86EAC48C0F93E8B9008EC948 /* yarr */,
+			);
+			name = JavaScriptCore;
+			sourceTree = "<group>";
+		};
+		0867D69AFE84028FC02AAC07 /* Frameworks */ = {
+			isa = PBXGroup;
+			children = (
+				6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */,
+				51F0EB6105C86C6B00E6DF1B /* Foundation.framework */,
+				5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */,
+				9322A00306C341D3009067BB /* libicucore.dylib */,
+				51F0EC0705C86C9A00E6DF1B /* libobjc.dylib */,
+				A8A4748D151A8306004123FF /* libWTF.a */,
+				371D842C17C98B6E00ECF994 /* libz.dylib */,
+				A5098B031C16AA0200087797 /* Security.framework */,
+			);
+			name = Frameworks;
+			sourceTree = "<group>";
+			tabWidth = 4;
+			usesTabs = 0;
+		};
+		0F46809C14BA7F4D00BFE272 /* llint */ = {
+			isa = PBXGroup;
+			children = (
+				FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */,
+				FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */,
+				0F4680C514BBB16900BFE272 /* LLIntCommon.h */,
+				0F4680CE14BBB3D100BFE272 /* LLIntData.cpp */,
+				0F4680CF14BBB3D100BFE272 /* LLIntData.h */,
+				5DDDF44614FEE72200B4FB4D /* LLIntDesiredOffsets.h */,
+				0F38B00F17CF077F00B144D3 /* LLIntEntrypoint.cpp */,
+				0F38B01017CF077F00B144D3 /* LLIntEntrypoint.h */,
+				0F46809D14BA7F8200BFE272 /* LLIntExceptions.cpp */,
+				0F46809E14BA7F8200BFE272 /* LLIntExceptions.h */,
+				0F4680C614BBB16900BFE272 /* LLIntOfflineAsmConfig.h */,
+				0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */,
+				FED287B115EC9A5700DA8161 /* LLIntOpcode.h */,
+				79CFC6EF1C33B10000C768EA /* LLIntPCRanges.h */,
+				0F46809F14BA7F8200BFE272 /* LLIntSlowPaths.cpp */,
+				0F4680A014BA7F8200BFE272 /* LLIntSlowPaths.h */,
+				0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */,
+				0F0B839814BCF45A00885B4F /* LLIntThunks.h */,
+				86A054461556451B00445157 /* LowLevelInterpreter.asm */,
+				0F4680C714BBB16900BFE272 /* LowLevelInterpreter.cpp */,
+				0F4680C814BBB16900BFE272 /* LowLevelInterpreter.h */,
+				86A054471556451B00445157 /* LowLevelInterpreter32_64.asm */,
+				86A054481556451B00445157 /* LowLevelInterpreter64.asm */,
+			);
+			name = llint;
+			sourceTree = "<group>";
+		};
+		0FEA09FC1705137F00BB722C /* ftl */ = {
+			isa = PBXGroup;
+			children = (
+				0FDB2CC7173DA51E007B3C1B /* FTLAbbreviatedTypes.h */,
+				0FEA0A171708B00700BB722C /* FTLAbstractHeap.cpp */,
+				0FEA0A181708B00700BB722C /* FTLAbstractHeap.h */,
+				0FEA0A191708B00700BB722C /* FTLAbstractHeapRepository.cpp */,
+				0FEA0A1A1708B00700BB722C /* FTLAbstractHeapRepository.h */,
+				0F485323187DFDEC0083B687 /* FTLAvailableRecovery.cpp */,
+				0F485324187DFDEC0083B687 /* FTLAvailableRecovery.h */,
+				0FEA09FE170513DB00BB722C /* FTLCapabilities.cpp */,
+				0FEA09FF170513DB00BB722C /* FTLCapabilities.h */,
+				0FEA0A251709623B00BB722C /* FTLCommonValues.cpp */,
+				0FEA0A211709606900BB722C /* FTLCommonValues.h */,
+				0FB387911BFD31A100E3AB1E /* FTLCompile.cpp */,
+				0FEA0A01170513DB00BB722C /* FTLCompile.h */,
+				E322E5A41DA644A4006E7709 /* FTLDOMJITPatchpointParams.cpp */,
+				E322E5A51DA644A4006E7709 /* FTLDOMJITPatchpointParams.h */,
+				0F9D4C0A1C3E1C11006CD984 /* FTLExceptionTarget.cpp */,
+				0F9D4C0B1C3E1C11006CD984 /* FTLExceptionTarget.h */,
+				0F235BBD17178E1C00690C7F /* FTLExitArgument.cpp */,
+				0F235BBE17178E1C00690C7F /* FTLExitArgument.h */,
+				0F235BBF17178E1C00690C7F /* FTLExitArgumentForOperand.cpp */,
+				0F235BC017178E1C00690C7F /* FTLExitArgumentForOperand.h */,
+				0F2B9CEE19D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp */,
+				0F2B9CEF19D0BAC100B1D1B5 /* FTLExitPropertyValue.h */,
+				0F2B9CF019D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp */,
+				0F2B9CF119D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h */,
+				0F235BC417178E1C00690C7F /* FTLExitValue.cpp */,
+				0F235BC517178E1C00690C7F /* FTLExitValue.h */,
+				A7F2996917A0BB670010417A /* FTLFail.cpp */,
+				A7F2996A17A0BB670010417A /* FTLFail.h */,
+				0FEA0A2B170B661900BB722C /* FTLFormattedValue.h */,
+				0FD8A31517D51F2200CA2C40 /* FTLForOSREntryJITCode.cpp */,
+				0FD8A31617D51F2200CA2C40 /* FTLForOSREntryJITCode.h */,
+				A78A977C179738D5009DF744 /* FTLGeneratedFunction.h */,
+				0FEA0A02170513DB00BB722C /* FTLJITCode.cpp */,
+				0FEA0A03170513DB00BB722C /* FTLJITCode.h */,
+				A78A977D179738D5009DF744 /* FTLJITFinalizer.cpp */,
+				A78A977E179738D5009DF744 /* FTLJITFinalizer.h */,
+				0FB4FB701BC843140025CA5A /* FTLLazySlowPath.cpp */,
+				0FB4FB711BC843140025CA5A /* FTLLazySlowPath.h */,
+				0FB4FB721BC843140025CA5A /* FTLLazySlowPathCall.h */,
+				0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */,
+				0F8F2B94172E049E007DBDA5 /* FTLLink.h */,
+				0FCEFADD180738C000472CE4 /* FTLLocation.cpp */,
+				0FCEFADE180738C000472CE4 /* FTLLocation.h */,
+				0FEA0A04170513DB00BB722C /* FTLLowerDFGToB3.cpp */,
+				0FEA0A05170513DB00BB722C /* FTLLowerDFGToB3.h */,
+				A7D89D0117A0B90400773AD8 /* FTLLoweredNodeValue.h */,
+				0F2B9CF219D0BAC100B1D1B5 /* FTLOperations.cpp */,
+				0F2B9CF319D0BAC100B1D1B5 /* FTLOperations.h */,
+				0FD8A31717D51F2200CA2C40 /* FTLOSREntry.cpp */,
+				0FD8A31817D51F2200CA2C40 /* FTLOSREntry.h */,
+				0F235BC617178E1C00690C7F /* FTLOSRExit.cpp */,
+				0F235BC717178E1C00690C7F /* FTLOSRExit.h */,
+				0F235BC917178E1C00690C7F /* FTLOSRExitCompiler.cpp */,
+				0F235BCA17178E1C00690C7F /* FTLOSRExitCompiler.h */,
+				0F9B1DB51C0E42BD00E5BFD2 /* FTLOSRExitHandle.cpp */,
+				0F9B1DB61C0E42BD00E5BFD2 /* FTLOSRExitHandle.h */,
+				0F9B1DB31C0E42A500E5BFD2 /* FTLOutput.cpp */,
+				269D636D1BFBE5D000101B1D /* FTLOutput.h */,
+				0F9D4C0E1C3E2C74006CD984 /* FTLPatchpointExceptionHandle.cpp */,
+				0F9D4C0F1C3E2C74006CD984 /* FTLPatchpointExceptionHandle.h */,
+				0F485325187DFDEC0083B687 /* FTLRecoveryOpcode.cpp */,
+				0F485326187DFDEC0083B687 /* FTLRecoveryOpcode.h */,
+				0FCEFAA91804C13E00472CE4 /* FTLSaveRestore.cpp */,
+				0FCEFAAA1804C13E00472CE4 /* FTLSaveRestore.h */,
+				0F25F1AA181635F300522F39 /* FTLSlowPathCall.cpp */,
+				0F25F1AB181635F300522F39 /* FTLSlowPathCall.h */,
+				0F25F1AC181635F300522F39 /* FTLSlowPathCallKey.cpp */,
+				0F25F1AD181635F300522F39 /* FTLSlowPathCallKey.h */,
+				0F235BC117178E1C00690C7F /* FTLStackmapArgumentList.h */,
+				0FEA0A151706BB9000BB722C /* FTLState.cpp */,
+				0FEA0A07170513DB00BB722C /* FTLState.h */,
+				A7FCC26C17A0B6AA00786D1A /* FTLSwitchCase.h */,
+				0F235BCB17178E1C00690C7F /* FTLThunks.cpp */,
+				0F235BCC17178E1C00690C7F /* FTLThunks.h */,
+				0FEA0A1B1708B00700BB722C /* FTLTypedPointer.h */,
+				0FDB2CC8173DA51E007B3C1B /* FTLValueFromBlock.h */,
+				0F5A6281188C98D40072C9DF /* FTLValueRange.cpp */,
+				0F5A6282188C98D40072C9DF /* FTLValueRange.h */,
+				0F0332C518B53FA9005F979A /* FTLWeight.h */,
+				0F0332C718B546EC005F979A /* FTLWeightedTarget.h */,
+			);
+			name = ftl;
+			sourceTree = "<group>";
+		};
+		0FEC84B21BDACD5E0080FF74 /* b3 */ = {
+			isa = PBXGroup;
+			children = (
+				0FEC84B31BDACD880080FF74 /* air */,
+				0FEC84B41BDACDAC0080FF74 /* B3ArgumentRegValue.cpp */,
+				0FEC84B51BDACDAC0080FF74 /* B3ArgumentRegValue.h */,
+				0FEC84B61BDACDAC0080FF74 /* B3BasicBlock.cpp */,
+				0FEC84B71BDACDAC0080FF74 /* B3BasicBlock.h */,
+				0FEC84B81BDACDAC0080FF74 /* B3BasicBlockInlines.h */,
+				0FEC84B91BDACDAC0080FF74 /* B3BasicBlockUtils.h */,
+				0F338E171BF286EA0013C88F /* B3BlockInsertionSet.cpp */,
+				0F338E181BF286EA0013C88F /* B3BlockInsertionSet.h */,
+				0FEC84BA1BDACDAC0080FF74 /* B3BlockWorklist.h */,
+				DCFDFBD71D1F5D9800FE3D72 /* B3BottomProvider.h */,
+				0F6B8ADE1C4EFE1700969052 /* B3BreakCriticalEdges.cpp */,
+				0F6B8ADF1C4EFE1700969052 /* B3BreakCriticalEdges.h */,
+				DC9A0C1C1D2D94EF0085124E /* B3CaseCollection.cpp */,
+				DC9A0C1D1D2D94EF0085124E /* B3CaseCollection.h */,
+				DC9A0C1E1D2D94EF0085124E /* B3CaseCollectionInlines.h */,
+				0F338DF71BE96AA80013C88F /* B3CCallValue.cpp */,
+				0F338DF81BE96AA80013C88F /* B3CCallValue.h */,
+				0F33FCF91C1625BE00323F67 /* B3CFG.h */,
+				0FEC84BB1BDACDAC0080FF74 /* B3CheckSpecial.cpp */,
+				0FEC84BC1BDACDAC0080FF74 /* B3CheckSpecial.h */,
+				0FEC84BD1BDACDAC0080FF74 /* B3CheckValue.cpp */,
+				0FEC84BE1BDACDAC0080FF74 /* B3CheckValue.h */,
+				0FEC84BF1BDACDAC0080FF74 /* B3Common.cpp */,
+				0FEC84C01BDACDAC0080FF74 /* B3Common.h */,
+				0FEC84C11BDACDAC0080FF74 /* B3Commutativity.cpp */,
+				0FEC84C21BDACDAC0080FF74 /* B3Commutativity.h */,
+				0F338DFF1BF0276C0013C88F /* B3Compilation.cpp */,
+				0F338E001BF0276C0013C88F /* B3Compilation.h */,
+				795F099C1E03600500BBE37F /* B3Compile.cpp */,
+				7919B77F1E03559C005BEED8 /* B3Compile.h */,
+				0F86AE1F1C5311C5006BE8EC /* B3ComputeDivisionMagic.h */,
+				0FEC84C31BDACDAC0080FF74 /* B3Const32Value.cpp */,
+				0FEC84C41BDACDAC0080FF74 /* B3Const32Value.h */,
+				0FEC84C51BDACDAC0080FF74 /* B3Const64Value.cpp */,
+				0FEC84C61BDACDAC0080FF74 /* B3Const64Value.h */,
+				0FEC84C71BDACDAC0080FF74 /* B3ConstDoubleValue.cpp */,
+				0FEC84C81BDACDAC0080FF74 /* B3ConstDoubleValue.h */,
+				43422A601C15871B00E2EB98 /* B3ConstFloatValue.cpp */,
+				43422A611C15871B00E2EB98 /* B3ConstFloatValue.h */,
+				0FEC85B21BDED9570080FF74 /* B3ConstPtrValue.h */,
+				0F338DF31BE93D550013C88F /* B3ConstrainedValue.cpp */,
+				0F338DF41BE93D550013C88F /* B3ConstrainedValue.h */,
+				0F338E011BF0276C0013C88F /* B3DataSection.cpp */,
+				0F338E021BF0276C0013C88F /* B3DataSection.h */,
+				0F33FCFA1C1625BE00323F67 /* B3Dominators.h */,
+				0F6B8AD61C4EDDA200969052 /* B3DuplicateTails.cpp */,
+				0F6B8AD71C4EDDA200969052 /* B3DuplicateTails.h */,
+				0FEC85C41BE16F5A0080FF74 /* B3Effects.cpp */,
+				0FEC85BE1BE167A00080FF74 /* B3Effects.h */,
+				0F725CA31C503DED00AD943A /* B3EliminateCommonSubexpressions.cpp */,
+				0F725CA41C503DED00AD943A /* B3EliminateCommonSubexpressions.h */,
+				0F6971E81D92F42100BA02A5 /* B3FenceValue.cpp */,
+				0F6971E91D92F42100BA02A5 /* B3FenceValue.h */,
+				0F6B8AE01C4EFE1700969052 /* B3FixSSA.cpp */,
+				0F6B8AE11C4EFE1700969052 /* B3FixSSA.h */,
+				0F725CAD1C506D3B00AD943A /* B3FoldPathConstants.cpp */,
+				0F725CAE1C506D3B00AD943A /* B3FoldPathConstants.h */,
+				0FEC84CB1BDACDAC0080FF74 /* B3FrequencyClass.cpp */,
+				0FEC84CC1BDACDAC0080FF74 /* B3FrequencyClass.h */,
+				0FEC84CD1BDACDAC0080FF74 /* B3FrequentedBlock.h */,
+				0FEC84CE1BDACDAC0080FF74 /* B3Generate.cpp */,
+				0FEC84CF1BDACDAC0080FF74 /* B3Generate.h */,
+				0FEC84D01BDACDAC0080FF74 /* B3GenericFrequentedBlock.h */,
+				0FEC85BF1BE167A00080FF74 /* B3HeapRange.cpp */,
+				0FEC85C01BE167A00080FF74 /* B3HeapRange.h */,
+				DC69B99A1D15F90F002E3C00 /* B3InferSwitches.cpp */,
+				DC69B99B1D15F90F002E3C00 /* B3InferSwitches.h */,
+				0FEC85B41BE1462F0080FF74 /* B3InsertionSet.cpp */,
+				0FEC85B51BE1462F0080FF74 /* B3InsertionSet.h */,
+				0FEC85B61BE1462F0080FF74 /* B3InsertionSetInlines.h */,
+				0FDF67D01D9C6086001B9825 /* B3Kind.cpp */,
+				0FDF67D11D9C6086001B9825 /* B3Kind.h */,
+				436E54511C468E5F00B5AF73 /* B3LegalizeMemoryOffsets.cpp */,
+				436E54521C468E5F00B5AF73 /* B3LegalizeMemoryOffsets.h */,
+				0F338E191BF286EA0013C88F /* B3LowerMacros.cpp */,
+				0F338E1A1BF286EA0013C88F /* B3LowerMacros.h */,
+				4319DA011C1BE3C1001D260B /* B3LowerMacrosAfterOptimizations.cpp */,
+				4319DA021C1BE3C1001D260B /* B3LowerMacrosAfterOptimizations.h */,
+				0FEC84D31BDACDAC0080FF74 /* B3LowerToAir.cpp */,
+				0FEC84D41BDACDAC0080FF74 /* B3LowerToAir.h */,
+				43AB26C41C1A52F700D82AE6 /* B3MathExtras.cpp */,
+				43AB26C51C1A52F700D82AE6 /* B3MathExtras.h */,
+				0FEC84D51BDACDAC0080FF74 /* B3MemoryValue.cpp */,
+				0FEC84D61BDACDAC0080FF74 /* B3MemoryValue.h */,
+				0F338E031BF0276C0013C88F /* B3MoveConstants.cpp */,
+				0F338E041BF0276C0013C88F /* B3MoveConstants.h */,
+				0F338E051BF0276C0013C88F /* B3OpaqueByproduct.h */,
+				0F338E061BF0276C0013C88F /* B3OpaqueByproducts.cpp */,
+				0F338E071BF0276C0013C88F /* B3OpaqueByproducts.h */,
+				0FEC84D71BDACDAC0080FF74 /* B3Opcode.cpp */,
+				0FEC84D81BDACDAC0080FF74 /* B3Opcode.h */,
+				0FEC84D91BDACDAC0080FF74 /* B3Origin.cpp */,
+				0FEC84DA1BDACDAC0080FF74 /* B3Origin.h */,
+				0F4DE1D01C4D764B004D6C11 /* B3OriginDump.cpp */,
+				0F4C91651C29F4F2004341A6 /* B3OriginDump.h */,
+				0FEC84DB1BDACDAC0080FF74 /* B3PatchpointSpecial.cpp */,
+				0FEC84DC1BDACDAC0080FF74 /* B3PatchpointSpecial.h */,
+				0FEC84DD1BDACDAC0080FF74 /* B3PatchpointValue.cpp */,
+				0FEC84DE1BDACDAC0080FF74 /* B3PatchpointValue.h */,
+				799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */,
+				0FEC84DF1BDACDAC0080FF74 /* B3PhaseScope.cpp */,
+				0FEC84E01BDACDAC0080FF74 /* B3PhaseScope.h */,
+				0F37308A1C0BD29100052BFA /* B3PhiChildren.cpp */,
+				0F37308B1C0BD29100052BFA /* B3PhiChildren.h */,
+				0FEC84E11BDACDAC0080FF74 /* B3Procedure.cpp */,
+				0FEC84E21BDACDAC0080FF74 /* B3Procedure.h */,
+				0FEC84E31BDACDAC0080FF74 /* B3ProcedureInlines.h */,
+				0F725CA51C503DED00AD943A /* B3PureCSE.cpp */,
+				0F725CA61C503DED00AD943A /* B3PureCSE.h */,
+				43422A641C16221E00E2EB98 /* B3ReduceDoubleToFloat.cpp */,
+				43422A651C16221E00E2EB98 /* B3ReduceDoubleToFloat.h */,
+				0FEC85B71BE1462F0080FF74 /* B3ReduceStrength.cpp */,
+				0FEC85B81BE1462F0080FF74 /* B3ReduceStrength.h */,
+				0FEC84EA1BDACDAC0080FF74 /* B3SlotBaseValue.cpp */,
+				0FEC84EB1BDACDAC0080FF74 /* B3SlotBaseValue.h */,
+				0F2BBD911C5FF3F50023EF23 /* B3SparseCollection.h */,
+				0F6B8ADA1C4EFAC300969052 /* B3SSACalculator.cpp */,
+				0F6B8ADB1C4EFAC300969052 /* B3SSACalculator.h */,
+				0F33FCF51C136E2500323F67 /* B3StackmapGenerationParams.cpp */,
+				0F33FCF61C136E2500323F67 /* B3StackmapGenerationParams.h */,
+				0FEC84E61BDACDAC0080FF74 /* B3StackmapSpecial.cpp */,
+				0FEC84E71BDACDAC0080FF74 /* B3StackmapSpecial.h */,
+				0F338DEF1BE93AD10013C88F /* B3StackmapValue.cpp */,
+				0F338DF01BE93AD10013C88F /* B3StackmapValue.h */,
+				0F9495851C57F47500413A48 /* B3StackSlot.cpp */,
+				0F9495861C57F47500413A48 /* B3StackSlot.h */,
+				0FEC84EC1BDACDAC0080FF74 /* B3SuccessorCollection.h */,
+				0FEC84ED1BDACDAC0080FF74 /* B3SwitchCase.cpp */,
+				0FEC84EE1BDACDAC0080FF74 /* B3SwitchCase.h */,
+				0FEC84EF1BDACDAC0080FF74 /* B3SwitchValue.cpp */,
+				0FEC84F01BDACDAC0080FF74 /* B3SwitchValue.h */,
+				0F45703E1BE584CA0062A629 /* B3TimingScope.cpp */,
+				0F45703F1BE584CA0062A629 /* B3TimingScope.h */,
+				0FEC84F11BDACDAC0080FF74 /* B3Type.cpp */,
+				0FEC84F21BDACDAC0080FF74 /* B3Type.h */,
+				DCFDFBD81D1F5D9800FE3D72 /* B3TypeMap.h */,
+				0FEC84F31BDACDAC0080FF74 /* B3UpsilonValue.cpp */,
+				0FEC84F41BDACDAC0080FF74 /* B3UpsilonValue.h */,
+				0FEC84F51BDACDAC0080FF74 /* B3UseCounts.cpp */,
+				0FEC84F61BDACDAC0080FF74 /* B3UseCounts.h */,
+				0FEC84F71BDACDAC0080FF74 /* B3Validate.cpp */,
+				0FEC84F81BDACDAC0080FF74 /* B3Validate.h */,
+				0FEC84F91BDACDAC0080FF74 /* B3Value.cpp */,
+				0FEC84FA1BDACDAC0080FF74 /* B3Value.h */,
+				0FEC84FB1BDACDAC0080FF74 /* B3ValueInlines.h */,
+				0F338E081BF0276C0013C88F /* B3ValueKey.cpp */,
+				0F338E091BF0276C0013C88F /* B3ValueKey.h */,
+				0F338E0A1BF0276C0013C88F /* B3ValueKeyInlines.h */,
+				0FEC84FC1BDACDAC0080FF74 /* B3ValueRep.cpp */,
+				0FEC84FD1BDACDAC0080FF74 /* B3ValueRep.h */,
+				0F2BBD921C5FF3F50023EF23 /* B3Variable.cpp */,
+				0F2BBD931C5FF3F50023EF23 /* B3Variable.h */,
+				0F2BBD941C5FF3F50023EF23 /* B3VariableValue.cpp */,
+				0F2BBD951C5FF3F50023EF23 /* B3VariableValue.h */,
+				53D444DD1DAF09A000B92784 /* B3WasmAddressValue.cpp */,
+				53D444DB1DAF08AB00B92784 /* B3WasmAddressValue.h */,
+				5341FC6F1DAC33E500E7E4D7 /* B3WasmBoundsCheckValue.cpp */,
+				5341FC711DAC343C00E7E4D7 /* B3WasmBoundsCheckValue.h */,
+				0FEC85AE1BDB5D5E0080FF74 /* testb3.cpp */,
+			);
+			name = b3;
+			sourceTree = "<group>";
+		};
+		0FEC84B31BDACD880080FF74 /* air */ = {
+			isa = PBXGroup;
+			children = (
+				0FEC85481BDACDC70080FF74 /* AirAllocateStack.cpp */,
+				0FEC85491BDACDC70080FF74 /* AirAllocateStack.h */,
+				0FEC854A1BDACDC70080FF74 /* AirArg.cpp */,
+				0FEC854B1BDACDC70080FF74 /* AirArg.h */,
+				0F64EAF21C4ECD0600621E9B /* AirArgInlines.h */,
+				0FEC854C1BDACDC70080FF74 /* AirBasicBlock.cpp */,
+				0FEC854D1BDACDC70080FF74 /* AirBasicBlock.h */,
+				0FB3878B1BFBC44D00E3AB1E /* AirBlockWorklist.h */,
+				0F6183201C45BF070072450B /* AirCCallingConvention.cpp */,
+				0F6183211C45BF070072450B /* AirCCallingConvention.h */,
+				0FEC854E1BDACDC70080FF74 /* AirCCallSpecial.cpp */,
+				0FEC854F1BDACDC70080FF74 /* AirCCallSpecial.h */,
+				0FEC85501BDACDC70080FF74 /* AirCode.cpp */,
+				0FEC85511BDACDC70080FF74 /* AirCode.h */,
+				0F6183221C45BF070072450B /* AirCustom.cpp */,
+				0F10F1A21C420BF0001C07D2 /* AirCustom.h */,
+				DC454B8A1D00E81F004C18AF /* AirDumpAsJS.cpp */,
+				DC454B8B1D00E81F004C18AF /* AirDumpAsJS.h */,
+				0F4570361BE44C910062A629 /* AirEliminateDeadCode.cpp */,
+				0F4570371BE44C910062A629 /* AirEliminateDeadCode.h */,
+				0F6183231C45BF070072450B /* AirEmitShuffle.cpp */,
+				0F6183241C45BF070072450B /* AirEmitShuffle.h */,
+				0F4DE1CC1C4C1B54004D6C11 /* AirFixObviousSpills.cpp */,
+				0F4DE1CD1C4C1B54004D6C11 /* AirFixObviousSpills.h */,
+				262D85B41C0D650F006ACB61 /* AirFixPartialRegisterStalls.cpp */,
+				262D85B51C0D650F006ACB61 /* AirFixPartialRegisterStalls.h */,
+				0FEC85521BDACDC70080FF74 /* AirFrequentedBlock.h */,
+				0FEC85531BDACDC70080FF74 /* AirGenerate.cpp */,
+				0FEC85541BDACDC70080FF74 /* AirGenerate.h */,
+				0FEC85921BDB1E100080FF74 /* AirGenerated.cpp */,
+				0FEC85551BDACDC70080FF74 /* AirGenerationContext.h */,
+				0FEC85561BDACDC70080FF74 /* AirHandleCalleeSaves.cpp */,
+				0FEC85571BDACDC70080FF74 /* AirHandleCalleeSaves.h */,
+				0FEC85581BDACDC70080FF74 /* AirInsertionSet.cpp */,
+				0FEC85591BDACDC70080FF74 /* AirInsertionSet.h */,
+				0FEC855A1BDACDC70080FF74 /* AirInst.cpp */,
+				0FEC855B1BDACDC70080FF74 /* AirInst.h */,
+				0FEC855C1BDACDC70080FF74 /* AirInstInlines.h */,
+				26718BA21BE99F780052017B /* AirIteratedRegisterCoalescing.cpp */,
+				26718BA31BE99F780052017B /* AirIteratedRegisterCoalescing.h */,
+				0FDF67D41D9DC43E001B9825 /* AirKind.cpp */,
+				0FDF67D51D9DC43E001B9825 /* AirKind.h */,
+				2684D4371C00161C0081D663 /* AirLiveness.h */,
+				0FE34C171C4B39AE0003A512 /* AirLogRegisterPressure.cpp */,
+				0FE34C181C4B39AE0003A512 /* AirLogRegisterPressure.h */,
+				0F6183251C45BF070072450B /* AirLowerAfterRegAlloc.cpp */,
+				0F6183261C45BF070072450B /* AirLowerAfterRegAlloc.h */,
+				0FDF70831D3F2C1F00927449 /* AirLowerEntrySwitch.cpp */,
+				0FDF70841D3F2C1F00927449 /* AirLowerEntrySwitch.h */,
+				0F6183271C45BF070072450B /* AirLowerMacros.cpp */,
+				0F6183281C45BF070072450B /* AirLowerMacros.h */,
+				264091FA1BE2FD4100684DB2 /* AirOpcode.opcodes */,
+				0FB3878C1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.cpp */,
+				0FB3878D1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.h */,
+				0F9CABC61DB54A760008E83B /* AirPadInterference.cpp */,
+				0F9CABC71DB54A760008E83B /* AirPadInterference.h */,
+				0FEC855E1BDACDC70080FF74 /* AirPhaseScope.cpp */,
+				0FEC855F1BDACDC70080FF74 /* AirPhaseScope.h */,
+				0F45703A1BE45F0A0062A629 /* AirReportUsedRegisters.cpp */,
+				0F45703B1BE45F0A0062A629 /* AirReportUsedRegisters.h */,
+				0F338DFB1BED51270013C88F /* AirSimplifyCFG.cpp */,
+				0F338DFC1BED51270013C88F /* AirSimplifyCFG.h */,
+				0FEC85621BDACDC70080FF74 /* AirSpecial.cpp */,
+				0FEC85631BDACDC70080FF74 /* AirSpecial.h */,
+				0FEC85641BDACDC70080FF74 /* AirSpillEverything.cpp */,
+				0FEC85651BDACDC70080FF74 /* AirSpillEverything.h */,
+				0FEC85661BDACDC70080FF74 /* AirStackSlot.cpp */,
+				0FEC85671BDACDC70080FF74 /* AirStackSlot.h */,
+				0F2BBD9B1C5FF4050023EF23 /* AirStackSlotKind.cpp */,
+				0F2BBD9C1C5FF4050023EF23 /* AirStackSlotKind.h */,
+				0FEC85681BDACDC70080FF74 /* AirTmp.cpp */,
+				0FEC85691BDACDC70080FF74 /* AirTmp.h */,
+				0FEC856A1BDACDC70080FF74 /* AirTmpInlines.h */,
+				0FE0E4AB1C24C94A002E17B6 /* AirTmpWidth.cpp */,
+				0FE0E4AC1C24C94A002E17B6 /* AirTmpWidth.h */,
+				0F3730921C0D67EE00052BFA /* AirUseCounts.h */,
+				0FEC856B1BDACDC70080FF74 /* AirValidate.cpp */,
+				0FEC856C1BDACDC70080FF74 /* AirValidate.h */,
+				0F6183441C45F6600072450B /* testair.cpp */,
+			);
+			name = air;
+			sourceTree = "<group>";
+		};
+		0FF4272E158EBCCE004CB9FF /* disassembler */ = {
+			isa = PBXGroup;
+			children = (
+				652A3A1A1651A92400A80AFE /* ARM64 */,
+				65C028591717966800351E35 /* ARMv7 */,
+				0FF42733158EBD64004CB9FF /* udis86 */,
+				652A3A201651C66100A80AFE /* ARM64Disassembler.cpp */,
+				65C0284F171795E200351E35 /* ARMv7Disassembler.cpp */,
+				0F9D336E165DBB8D005AD387 /* Disassembler.cpp */,
+				0FF4272F158EBD44004CB9FF /* Disassembler.h */,
+				0FF42730158EBD44004CB9FF /* UDis86Disassembler.cpp */,
+				A7E5AB351799E4B200D2833D /* UDis86Disassembler.h */,
+				A7E5AB361799E4B200D2833D /* X86Disassembler.cpp */,
+			);
+			name = disassembler;
+			sourceTree = "<group>";
+		};
+		0FF42733158EBD64004CB9FF /* udis86 */ = {
+			isa = PBXGroup;
+			children = (
+				0FF4273E158EBD94004CB9FF /* udis86.c */,
+				0FF4273F158EBD94004CB9FF /* udis86.h */,
+				0FF42734158EBD94004CB9FF /* udis86_decode.c */,
+				0FF42735158EBD94004CB9FF /* udis86_decode.h */,
+				0FF42736158EBD94004CB9FF /* udis86_extern.h */,
+				0FF4274C158EBFE1004CB9FF /* udis86_itab_holder.c */,
+				0FF42739158EBD94004CB9FF /* udis86_syn-att.c */,
+				0FF4273A158EBD94004CB9FF /* udis86_syn-intel.c */,
+				0FF4273B158EBD94004CB9FF /* udis86_syn.c */,
+				0FF4273C158EBD94004CB9FF /* udis86_syn.h */,
+				0FF4273D158EBD94004CB9FF /* udis86_types.h */,
+				43CBA1601CAB67BA00328A5C /* udis86_udint.h */,
+			);
+			name = udis86;
+			sourceTree = "<group>";
+		};
+		141211000A48772600480255 /* tests */ = {
+			isa = PBXGroup;
+			children = (
+				FEF040501AAE662D00BD28B0 /* CompareAndSwapTest.cpp */,
+				FEF040521AAEC4ED00BD28B0 /* CompareAndSwapTest.h */,
+				C29ECB021804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.h */,
+				C29ECB011804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm */,
+				C203281E1981979D0088B499 /* CustomGlobalObjectClassTest.c */,
+				C203281F1981979D0088B499 /* CustomGlobalObjectClassTest.h */,
+				C288B2DC18A54D3E007BE40B /* DateTests.h */,
+				C288B2DD18A54D3E007BE40B /* DateTests.mm */,
+				FE0D4A041AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp */,
+				FE0D4A051AB8DD0A002F54BF /* ExecutionTimeLimitTest.h */,
+				FECB8B251D25BB6E006F2463 /* FunctionOverridesTest.cpp */,
+				FECB8B261D25BB6E006F2463 /* FunctionOverridesTest.h */,
+				FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */,
+				FE0D4A081ABA2437002F54BF /* GlobalContextWithFinalizerTest.h */,
+				C2181FC018A948FB0025A235 /* JSExportTests.h */,
+				C2181FC118A948FB0025A235 /* JSExportTests.mm */,
+				5C4E8E941DBEBDA20036F1FC /* JSONParseTest.cpp */,
+				5C4E8E951DBEBDA20036F1FC /* JSONParseTest.h */,
+				144005170A531CB50005F061 /* minidom */,
+				FEDA50D41B97F442009A3B4F /* PingPongStackOverflowTest.cpp */,
+				FEDA50D51B97F4D9009A3B4F /* PingPongStackOverflowTest.h */,
+				65570F581AA4C00A009B3C23 /* Regress141275.h */,
+				65570F591AA4C00A009B3C23 /* Regress141275.mm */,
+				FEB51F6A1A97B688001F921C /* Regress141809.h */,
+				FEB51F6B1A97B688001F921C /* Regress141809.mm */,
+				FECB8B291D25CABB006F2463 /* testapi-function-overrides.js */,
+				14BD5A2D0A3E91F600BAF59C /* testapi.c */,
+				14D857740A4696C80032146C /* testapi.js */,
+				86D22219167EF9440024C804 /* testapi.mm */,
+				651122E5140469BA002B101D /* testRegExp.cpp */,
+				539EB0711D553DF800C82EF7 /* testWasm.cpp */,
+				534902821C7242C80012BCB8 /* TypedArrayCTest.cpp */,
+				534902831C7242C80012BCB8 /* TypedArrayCTest.h */,
+			);
+			name = tests;
+			sourceTree = "<group>";
+			tabWidth = 4;
+			usesTabs = 0;
+		};
+		1429D77A0ED20D7300B89619 /* interpreter */ = {
+			isa = PBXGroup;
+			children = (
+				0F55F0F114D1063600AC7649 /* AbstractPC.cpp */,
+				0F55F0F214D1063600AC7649 /* AbstractPC.h */,
+				A7F8690E0F9584A100558697 /* CachedCall.h */,
+				1429D8DB0ED2205B00B89619 /* CallFrame.cpp */,
+				1429D8DC0ED2205B00B89619 /* CallFrame.h */,
+				A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */,
+				1429D85B0ED218E900B89619 /* CLoopStack.cpp */,
+				14D792640DAA03FB001A9F05 /* CLoopStack.h */,
+				A7C1EAEB17987AB600299DB2 /* CLoopStackInlines.h */,
+				E34EDBF61DB5FFC100DC87A5 /* FrameTracers.h */,
+				1429D7D30ED2128200B89619 /* Interpreter.cpp */,
+				1429D77B0ED20D7300B89619 /* Interpreter.h */,
+				E39D9D841D39000600667282 /* InterpreterInlines.h */,
+				65FB5116184EE9BC00C12B70 /* ProtoCallFrame.cpp */,
+				65FB5115184EE8F800C12B70 /* ProtoCallFrame.h */,
+				149B24FF0D8AF6D1009CB8C7 /* Register.h */,
+				DC17E8131C9C7FD4008A6AB3 /* ShadowChicken.cpp */,
+				DC17E8141C9C7FD4008A6AB3 /* ShadowChicken.h */,
+				DC17E8151C9C7FD4008A6AB3 /* ShadowChickenInlines.h */,
+				A7C1EAEC17987AB600299DB2 /* StackVisitor.cpp */,
+				A7C1EAED17987AB600299DB2 /* StackVisitor.h */,
+				658D3A5519638268003C45D6 /* VMEntryRecord.h */,
+			);
+			path = interpreter;
+			sourceTree = "<group>";
+		};
+		1429D92C0ED22D7000B89619 /* jit */ = {
+			isa = PBXGroup;
+			children = (
+				0F24E53B17EA9F5900ABB217 /* AssemblyHelpers.cpp */,
+				0F24E53C17EA9F5900ABB217 /* AssemblyHelpers.h */,
+				0F64B26F1A784BAF006E4E66 /* BinarySwitch.cpp */,
+				0F64B2701A784BAF006E4E66 /* BinarySwitch.h */,
+				65B8392D1BACA9D30044E824 /* CachedRecovery.cpp */,
+				65B8392C1BACA92A0044E824 /* CachedRecovery.h */,
+				62EC9BB41B7EB07C00303AD1 /* CallFrameShuffleData.cpp */,
+				62EC9BB51B7EB07C00303AD1 /* CallFrameShuffleData.h */,
+				62D755D01B84FB39001801FA /* CallFrameShuffler.cpp */,
+				62D755D11B84FB39001801FA /* CallFrameShuffler.h */,
+				62D755D21B84FB39001801FA /* CallFrameShuffler32_64.cpp */,
+				62D755D31B84FB39001801FA /* CallFrameShuffler64.cpp */,
+				DC17E8161C9C802B008A6AB3 /* CCallHelpers.cpp */,
+				0F24E53D17EA9F5900ABB217 /* CCallHelpers.h */,
+				0FD82E37141AB14200179C94 /* CompactJITCodeMap.h */,
+				0FF054F71AC35B4400E5BE57 /* ExecutableAllocationFuzz.cpp */,
+				0FF054F81AC35B4400E5BE57 /* ExecutableAllocationFuzz.h */,
+				A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */,
+				A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */,
+				86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */,
+				0F24E53E17EA9F5900ABB217 /* FPRInfo.h */,
+				0F766D2D15A8DCDD008F363E /* GCAwareJITStubRoutine.cpp */,
+				0F766D2E15A8DCDD008F363E /* GCAwareJITStubRoutine.h */,
+				0F93274C1C1F66AA00CF6564 /* GPRInfo.cpp */,
+				0F24E53F17EA9F5900ABB217 /* GPRInfo.h */,
+				0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */,
+				0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */,
+				DC2143051CA32E52000A8869 /* ICStats.cpp */,
+				DC2143061CA32E52000A8869 /* ICStats.h */,
+				DE5A09FF1BA3AC3E003D4424 /* IntrinsicEmitter.cpp */,
+				1429D92D0ED22D7000B89619 /* JIT.cpp */,
+				1429D92E0ED22D7000B89619 /* JIT.h */,
+				FE1220251BE7F5640039E6F2 /* JITAddGenerator.cpp */,
+				FE1220261BE7F5640039E6F2 /* JITAddGenerator.h */,
+				86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */,
+				A75706DD118A2BCF0057F88F /* JITArithmetic32_64.cpp */,
+				FE3A06AD1C10CB6F00390FDD /* JITBitAndGenerator.cpp */,
+				FE3A06AE1C10CB6F00390FDD /* JITBitAndGenerator.h */,
+				FE3A06A71C10BC7400390FDD /* JITBitBinaryOpGenerator.h */,
+				FE3A06A31C10B70800390FDD /* JITBitOrGenerator.cpp */,
+				FE3A06A41C10B70800390FDD /* JITBitOrGenerator.h */,
+				FE3A06AF1C10CB6F00390FDD /* JITBitXorGenerator.cpp */,
+				FE3A06B01C10CB6F00390FDD /* JITBitXorGenerator.h */,
+				86CC85A20EE79B7400288682 /* JITCall.cpp */,
+				146FE51111A710430087AE66 /* JITCall32_64.cpp */,
+				0F8F94431667635200D61971 /* JITCode.cpp */,
+				86CCEFDD0F413F8900FD7F9E /* JITCode.h */,
+				0F0776BD14FF002800102332 /* JITCompilationEffort.h */,
+				0FAF7EFA165BA919000C8455 /* JITDisassembler.cpp */,
+				0FAF7EFB165BA919000C8455 /* JITDisassembler.h */,
+				FE187A0A1C0229230038BBCA /* JITDivGenerator.cpp */,
+				FE187A0B1C0229230038BBCA /* JITDivGenerator.h */,
+				0F46807F14BA572700BFE272 /* JITExceptions.cpp */,
+				0F46808014BA572700BFE272 /* JITExceptions.h */,
+				0FB14E1C18124ACE009B6B4D /* JITInlineCacheGenerator.cpp */,
+				0FB14E1D18124ACE009B6B4D /* JITInlineCacheGenerator.h */,
+				86CC85A00EE79A4700288682 /* JITInlines.h */,
+				FE3A06B61C1103D900390FDD /* JITLeftShiftGenerator.cpp */,
+				FE3A06B71C1103D900390FDD /* JITLeftShiftGenerator.h */,
+				79233C291D34715700C5A834 /* JITMathIC.h */,
+				79A899FE1D38612E00D18C73 /* JITMathICForwards.h */,
+				79AF0BE31D3EFD4C00E95FA5 /* JITMathICInlineResult.h */,
+				FE1879FF1BFBC73C0038BBCA /* JITMulGenerator.cpp */,
+				FE187A001BFBC73C0038BBCA /* JITMulGenerator.h */,
+				FE99B2471C24B6D300C82159 /* JITNegGenerator.cpp */,
+				FE99B2481C24B6D300C82159 /* JITNegGenerator.h */,
+				BCDD51E90FB8DF74004A8BDC /* JITOpcodes.cpp */,
+				A71236E41195F33C00BD2174 /* JITOpcodes32_64.cpp */,
+				0F24E54517EE274900ABB217 /* JITOperations.cpp */,
+				0F24E54617EE274900ABB217 /* JITOperations.h */,
+				86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */,
+				A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */,
+				FE3A06B81C1103D900390FDD /* JITRightShiftGenerator.cpp */,
+				FE3A06B91C1103D900390FDD /* JITRightShiftGenerator.h */,
+				0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */,
+				0F766D1C15A5028D008F363E /* JITStubRoutine.h */,
+				FE42388F1BE18C1200514737 /* JITSubGenerator.cpp */,
+				FE98B5B61BB9AE110073E7A6 /* JITSubGenerator.h */,
+				0F5EF91B16878F78003E5C25 /* JITThunks.cpp */,
+				0F5EF91C16878F78003E5C25 /* JITThunks.h */,
+				0FC712E017CD878F008CC93C /* JITToDFGDeferredCompilationCallback.cpp */,
+				0FC712E117CD878F008CC93C /* JITToDFGDeferredCompilationCallback.h */,
+				DC0184171D10C1870057B053 /* JITWorklist.cpp */,
+				DC0184181D10C1870057B053 /* JITWorklist.h */,
+				A76C51741182748D00715B05 /* JSInterfaceJIT.h */,
+				792CB3471C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp */,
+				792CB3481C4EED5C00D13AF3 /* PCToCodeOriginMap.h */,
+				0FE834151A6EF97B00D04847 /* PolymorphicCallStubRoutine.cpp */,
+				0FE834161A6EF97B00D04847 /* PolymorphicCallStubRoutine.h */,
+				0FA7A8E918B413C80052371D /* Reg.cpp */,
+				0FA7A8EA18B413C80052371D /* Reg.h */,
+				6540C79E1B82D9CE000F6B79 /* RegisterAtOffset.cpp */,
+				6540C79F1B82D9CE000F6B79 /* RegisterAtOffset.h */,
+				6540C79C1B82D99D000F6B79 /* RegisterAtOffsetList.cpp */,
+				6540C79D1B82D99D000F6B79 /* RegisterAtOffsetList.h */,
+				623A37EB1B87A7BD00754209 /* RegisterMap.h */,
+				0FC3141418146D7000033232 /* RegisterSet.cpp */,
+				0FC314101814559100033232 /* RegisterSet.h */,
+				0F24E54917EE274900ABB217 /* Repatch.cpp */,
+				0F24E54A17EE274900ABB217 /* Repatch.h */,
+				0FA7A8ED18CE4FD80052371D /* ScratchRegisterAllocator.cpp */,
+				0F24E54B17EE274900ABB217 /* ScratchRegisterAllocator.h */,
+				0FEE98421A89227500754E93 /* SetupVarargsFrame.cpp */,
+				0FEE98401A8865B600754E93 /* SetupVarargsFrame.h */,
+				A709F2EF17A0AC0400512E98 /* SlowPathCall.h */,
+				FE187A0C1C02EBA70038BBCA /* SnippetOperand.h */,
+				A7386551118697B400540279 /* SpecializedThunkJIT.h */,
+				A7FF647A18C52E8500B55307 /* SpillRegistersMode.h */,
+				DC7997811CDE9F9E004D4A09 /* TagRegistersMode.cpp */,
+				DC7997821CDE9F9E004D4A09 /* TagRegistersMode.h */,
+				0FC314111814559100033232 /* TempRegisterSet.cpp */,
+				0F24E54817EE274900ABB217 /* TempRegisterSet.h */,
+				0F572D4D16879FDB00E57FBD /* ThunkGenerator.h */,
+				A7386552118697B400540279 /* ThunkGenerators.cpp */,
+				A7386553118697B400540279 /* ThunkGenerators.h */,
+				65987F2F16828A7E003C2F8D /* UnusedPointer.h */,
+			);
+			path = jit;
+			sourceTree = "<group>";
+		};
+		142E312A134FF0A600AFADB5 /* heap */ = {
+			isa = PBXGroup;
+			children = (
+				0FA7620A1DB959F600B7A2FD /* AllocatingScope.h */,
+				0F9630351D4192C3005609D9 /* AllocatorAttributes.cpp */,
+				0F9630361D4192C3005609D9 /* AllocatorAttributes.h */,
+				0FDE87F81DFD0C6D0064C390 /* CellContainer.cpp */,
+				0F070A421D543A89006E7232 /* CellContainer.h */,
+				0F070A431D543A89006E7232 /* CellContainerInlines.h */,
+				0F1C3DD91BBCE09E00E523E4 /* CellState.h */,
+				0FD8A31117D4326C00CA2C40 /* CodeBlockSet.cpp */,
+				0FD8A31217D4326C00CA2C40 /* CodeBlockSet.h */,
+				0F664CE71DA304ED00B00A11 /* CodeBlockSetInlines.h */,
+				0FA762001DB9242300B7A2FD /* CollectionScope.cpp */,
+				0FA762011DB9242300B7A2FD /* CollectionScope.h */,
+				146B14DB12EB5B12001BEC1B /* ConservativeRoots.cpp */,
+				149DAAF212EB559D0083B12B /* ConservativeRoots.h */,
+				0F7DF12F1E2970D50095951B /* ConstraintVolatility.h */,
+				2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */,
+				0F136D4B174AD69B0075B354 /* DeferGC.h */,
+				0FBB73BA1DEF8644002C009E /* DeleteAllCodeEffort.h */,
+				0F9630371D4192C3005609D9 /* DestructionMode.cpp */,
+				0F9630381D4192C3005609D9 /* DestructionMode.h */,
+				2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */,
+				2A83638418D7D0EE0000EBCC /* EdenGCActivityCallback.h */,
+				0F5513A71D5A68CB00C32BD8 /* FreeList.cpp */,
+				0F5513A51D5A682A00C32BD8 /* FreeList.h */,
+				2A83638718D7D0FE0000EBCC /* FullGCActivityCallback.cpp */,
+				2A83638818D7D0FE0000EBCC /* FullGCActivityCallback.h */,
+				2AACE63A18CA5A0300ED0191 /* GCActivityCallback.cpp */,
+				2AACE63B18CA5A0300ED0191 /* GCActivityCallback.h */,
+				BCBE2CAD14E985AA000593AD /* GCAssertions.h */,
+				0FB4767C1D99AEA7008EA6CB /* GCDeferralContext.h */,
+				0FB4767D1D99AEA7008EA6CB /* GCDeferralContextInlines.h */,
+				0F2B66A817B6B53D00A7AE3F /* GCIncomingRefCounted.h */,
+				0F2B66A917B6B53D00A7AE3F /* GCIncomingRefCountedInlines.h */,
+				0F2B66AA17B6B53D00A7AE3F /* GCIncomingRefCountedSet.h */,
+				0F2B66AB17B6B53D00A7AE3F /* GCIncomingRefCountedSetInlines.h */,
+				2ADFA26218EF3540004F9FCC /* GCLogging.cpp */,
+				2AABCDE618EF294200002096 /* GCLogging.h */,
+				2A343F7418A1748B0039B085 /* GCSegmentedArray.h */,
+				2A343F7718A1749D0039B085 /* GCSegmentedArrayInlines.h */,
+				0F86A26E1D6F7B3100CB0C92 /* GCTypeMap.h */,
+				142E312B134FF0A600AFADB5 /* Handle.h */,
+				C28318FF16FE4B7D00157BFD /* HandleBlock.h */,
+				C283190116FE533E00157BFD /* HandleBlockInlines.h */,
+				142E312C134FF0A600AFADB5 /* HandleSet.cpp */,
+				142E312D134FF0A600AFADB5 /* HandleSet.h */,
+				142E312E134FF0A600AFADB5 /* HandleStack.cpp */,
+				142E312F134FF0A600AFADB5 /* HandleStack.h */,
+				146FA5A81378F6B0003627A3 /* HandleTypes.h */,
+				14BA7A9513AADFF8005B7C2C /* Heap.cpp */,
+				14BA7A9613AADFF8005B7C2C /* Heap.h */,
+				DC3D2B0B1D34376E00BA918C /* HeapCell.cpp */,
+				DC3D2B091D34316100BA918C /* HeapCell.h */,
+				0F070A441D543A89006E7232 /* HeapCellInlines.h */,
+				0F32BD0E1BB34F190093A57F /* HeapHelperPool.cpp */,
+				0F32BD0F1BB34F190093A57F /* HeapHelperPool.h */,
+				C2DA778218E259990066FCB6 /* HeapInlines.h */,
+				2AD8932917E3868F00668276 /* HeapIterationScope.h */,
+				A5339EC81BB4B4510054F005 /* HeapObserver.h */,
+				A5398FA91C750D950060A963 /* HeapProfiler.cpp */,
+				A5398FAA1C750D950060A963 /* HeapProfiler.h */,
+				A54C2AAE1C6544D100A18D78 /* HeapSnapshot.cpp */,
+				A54C2AAF1C6544D100A18D78 /* HeapSnapshot.h */,
+				A5311C341C77CEAC00E6B1B6 /* HeapSnapshotBuilder.cpp */,
+				A5311C351C77CEAC00E6B1B6 /* HeapSnapshotBuilder.h */,
+				C24D31E0161CD695002AA4DB /* HeapStatistics.cpp */,
+				C24D31E1161CD695002AA4DB /* HeapStatistics.h */,
+				C2E526BB1590EF000054E48D /* HeapTimer.cpp */,
+				C2E526BC1590EF000054E48D /* HeapTimer.h */,
+				0FADE6721D4D23BC00768457 /* HeapUtil.h */,
+				FE7BA60D1A1A7CEC00F1F7B4 /* HeapVerifier.cpp */,
+				FE7BA60E1A1A7CEC00F1F7B4 /* HeapVerifier.h */,
+				0FA762081DB9283C00B7A2FD /* HelpingGCScope.h */,
+				C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */,
+				C25F8BCC157544A900245B71 /* IncrementalSweeper.h */,
+				0F766D2915A8CC34008F363E /* JITStubRoutineSet.cpp */,
+				0F766D2A15A8CC34008F363E /* JITStubRoutineSet.h */,
+				0F070A451D543A89006E7232 /* LargeAllocation.cpp */,
+				0F070A461D543A89006E7232 /* LargeAllocation.h */,
+				0F431736146BAC65007E3890 /* ListableHandler.h */,
+				FE3913511B794AC900EDAF71 /* LiveObjectData.h */,
+				FE3913521B794AC900EDAF71 /* LiveObjectList.cpp */,
+				FE3913531B794AC900EDAF71 /* LiveObjectList.h */,
+				142E3130134FF0A600AFADB5 /* Local.h */,
+				142E3131134FF0A600AFADB5 /* LocalScope.h */,
+				0F208AD61DF0925A007D3269 /* LockDuringMarking.h */,
+				14B7233F12D7D0DA003BD5ED /* MachineStackMarker.cpp */,
+				14B7234012D7D0DA003BD5ED /* MachineStackMarker.h */,
+				C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */,
+				C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */,
+				0F7DF1451E2BEF680095951B /* MarkedAllocatorInlines.h */,
+				142D6F0613539A2800B02E86 /* MarkedBlock.cpp */,
+				142D6F0713539A2800B02E86 /* MarkedBlock.h */,
+				0F7C5FB71D888A010044F5E2 /* MarkedBlockInlines.h */,
+				141448CA13A176EC00F5BA1A /* MarkedBlockSet.h */,
+				14D2F3D8139F4BE200491031 /* MarkedSpace.cpp */,
+				14D2F3D9139F4BE200491031 /* MarkedSpace.h */,
+				0F7DF1301E2970D50095951B /* MarkedSpaceInlines.h */,
+				0F660E331E0517B70031462C /* MarkingConstraint.cpp */,
+				0F660E341E0517B70031462C /* MarkingConstraint.h */,
+				0F660E351E0517B70031462C /* MarkingConstraintSet.cpp */,
+				0F660E361E0517B80031462C /* MarkingConstraintSet.h */,
+				142D6F0E13539A4100B02E86 /* MarkStack.cpp */,
+				142D6F0F13539A4100B02E86 /* MarkStack.h */,
+				0F1FB38C1E173A6200A9BE50 /* MutatorScheduler.cpp */,
+				0F1FB3981E1F65F900A9BE50 /* MutatorScheduler.h */,
+				0FA762021DB9242300B7A2FD /* MutatorState.cpp */,
+				0FA762031DB9242300B7A2FD /* MutatorState.h */,
+				ADDB1F6218D77DB7009B58A8 /* OpaqueRootSet.h */,
+				0FBB73B61DEF3AAC002C009E /* PreventCollectionScope.h */,
+				0F7CF94E1DBEEE860098CC12 /* ReleaseHeapAccessScope.h */,
+				C225494215F7DBAA0065E898 /* SlotVisitor.cpp */,
+				14BA78F013AAB88F005B7C2C /* SlotVisitor.h */,
+				0FCB408515C0A3C30048932B /* SlotVisitorInlines.h */,
+				0FDE87FA1DFE6E500064C390 /* SpaceTimeMutatorScheduler.cpp */,
+				0FDE87FB1DFE6E500064C390 /* SpaceTimeMutatorScheduler.h */,
+				0F4F82891E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.cpp */,
+				0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */,
+				0F7CF9501DC027D70098CC12 /* StopIfNecessaryTimer.cpp */,
+				0F7CF9511DC027D70098CC12 /* StopIfNecessaryTimer.h */,
+				142E3132134FF0A600AFADB5 /* Strong.h */,
+				145722851437E140005FDE26 /* StrongInlines.h */,
+				0F7DF1311E2970D50095951B /* Subspace.cpp */,
+				0F7DF1321E2970D50095951B /* Subspace.h */,
+				0F7DF1331E2970D50095951B /* SubspaceInlines.h */,
+				0F1FB38A1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.cpp */,
+				0F1FB38B1E173A6200A9BE50 /* SynchronousStopTheWorldMutatorScheduler.h */,
+				141448CC13A1783700F5BA1A /* TinyBloomFilter.h */,
+				0F5F08CE146C762F000472A9 /* UnconditionalFinalizer.h */,
+				0F1FB3921E177A6F00A9BE50 /* VisitingTimeout.h */,
+				0F952A9F1DF7860700E06FBD /* VisitRaceKey.cpp */,
+				0F952AA01DF7860700E06FBD /* VisitRaceKey.h */,
+				1ACF7376171CA6FB00C9BB1E /* Weak.cpp */,
+				142E3133134FF0A600AFADB5 /* Weak.h */,
+				14E84F9914EE1ACC00D6D5D4 /* WeakBlock.cpp */,
+				14E84F9A14EE1ACC00D6D5D4 /* WeakBlock.h */,
+				14F7256314EE265E00B1652B /* WeakHandleOwner.cpp */,
+				14F7256414EE265E00B1652B /* WeakHandleOwner.h */,
+				14E84F9D14EE1ACC00D6D5D4 /* WeakImpl.h */,
+				14BE7D3217135CF400D1807A /* WeakInlines.h */,
+				0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */,
+				14E84F9B14EE1ACC00D6D5D4 /* WeakSet.cpp */,
+				14E84F9C14EE1ACC00D6D5D4 /* WeakSet.h */,
+				14150132154BB13F005D8C98 /* WeakSetInlines.h */,
+				0FC8150814043BCA00CFA603 /* WriteBarrierSupport.cpp */,
+				0FC8150914043BD200CFA603 /* WriteBarrierSupport.h */,
+			);
+			path = heap;
+			sourceTree = "<group>";
+		};
+		1432EBD70A34CAD400717B9F /* API */ = {
+			isa = PBXGroup;
+			children = (
+				C211B574176A224D000E2A23 /* APICallbackFunction.h */,
+				1482B78A0A4305AB00517CFC /* APICast.h */,
+				53529A4B1C457B75000B49C6 /* APIUtils.h */,
+				1CAA8B4A0D32C39A0041BCFF /* JavaScript.h */,
+				1CAA8B4B0D32C39A0041BCFF /* JavaScriptCore.h */,
+				BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */,
+				BC0894D60FAFBA2D00001865 /* JSAPIValueWrapper.h */,
+				C2CF39C016E15A8100DD69BE /* JSAPIWrapperObject.h */,
+				C2CF39BF16E15A8100DD69BE /* JSAPIWrapperObject.mm */,
+				1421359A0A677F4F00A8195E /* JSBase.cpp */,
+				142711380A460BBB0080EEEA /* JSBase.h */,
+				140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */,
+				1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */,
+				1440F8AC0A508D200005F061 /* JSCallbackConstructor.h */,
+				1440F8900A508B100005F061 /* JSCallbackFunction.cpp */,
+				1440F88F0A508B100005F061 /* JSCallbackFunction.h */,
+				14ABDF5E0A437FEF00ECCA01 /* JSCallbackObject.cpp */,
+				14ABDF5D0A437FEF00ECCA01 /* JSCallbackObject.h */,
+				A8E894310CD0602400367179 /* JSCallbackObjectFunctions.h */,
+				1440FCE20A51E46B0005F061 /* JSClassRef.cpp */,
+				1440FCE10A51E46B0005F061 /* JSClassRef.h */,
+				86E3C607167BAB87006D760A /* JSContext.h */,
+				86E3C608167BAB87006D760A /* JSContext.mm */,
+				86E3C609167BAB87006D760A /* JSContextInternal.h */,
+				A58C024118E4A41A00032BC5 /* JSContextPrivate.h */,
+				14BD5A290A3E91F600BAF59C /* JSContextRef.cpp */,
+				14BD5A2A0A3E91F600BAF59C /* JSContextRef.h */,
+				A5EA70ED19F5B5C40098F5EC /* JSContextRefInspectorSupport.h */,
+				A5D2E664195E173800A518E7 /* JSContextRefInternal.h */,
+				148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */,
+				A72028B41797601E0098028C /* JSCTestRunnerUtils.cpp */,
+				A72028B51797601E0098028C /* JSCTestRunnerUtils.h */,
+				86E3C60A167BAB87006D760A /* JSExport.h */,
+				C25D709A16DE99F400FCA6BC /* JSManagedValue.h */,
+				C25D709916DE99F400FCA6BC /* JSManagedValue.mm */,
+				2A4BB7F218A41179008A0FCD /* JSManagedValueInternal.h */,
+				1482B7E20A43076000517CFC /* JSObjectRef.cpp */,
+				1482B7E10A43076000517CFC /* JSObjectRef.h */,
+				A79EDB0811531CD60019E912 /* JSObjectRefPrivate.h */,
+				A552C37D1ADDB8FE00139726 /* JSRemoteInspector.cpp */,
+				A552C37E1ADDB8FE00139726 /* JSRemoteInspector.h */,
+				95C18D3E0C90E7EF00E72F73 /* JSRetainPtr.h */,
+				A7C0C4AA167C08CD0017011D /* JSScriptRef.cpp */,
+				A7C0C4AB167C08CD0017011D /* JSScriptRefPrivate.h */,
+				1482B74C0A43032800517CFC /* JSStringRef.cpp */,
+				1482B74B0A43032800517CFC /* JSStringRef.h */,
+				146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */,
+				146AAB2A0B66A84900E55F16 /* JSStringRefCF.h */,
+				1A28D4A7177B71C80007FA3C /* JSStringRefPrivate.h */,
+				53486BBA1C18E84500F6F3AF /* JSTypedArray.cpp */,
+				53486BB61C1795C300F6F3AF /* JSTypedArray.h */,
+				86E3C606167BAB87006D760A /* JSValue.h */,
+				86E3C60D167BAB87006D760A /* JSValue.mm */,
+				86E3C60E167BAB87006D760A /* JSValueInternal.h */,
+				14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */,
+				1482B6EA0A4300B300517CFC /* JSValueRef.h */,
+				86E3C60F167BAB87006D760A /* JSVirtualMachine.h */,
+				86E3C610167BAB87006D760A /* JSVirtualMachine.mm */,
+				86E3C611167BAB87006D760A /* JSVirtualMachineInternal.h */,
+				FE3022D81E43C85500BAC493 /* JSVirtualMachinePrivate.h */,
+				A7482E37116A697B003B0712 /* JSWeakObjectMapRefInternal.h */,
+				A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */,
+				A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */,
+				86E3C60C167BAB87006D760A /* JSWrapperMap.h */,
+				86E3C60B167BAB87006D760A /* JSWrapperMap.mm */,
+				86F3EEB9168CCF750077B92A /* ObjCCallbackFunction.h */,
+				86F3EEBA168CCF750077B92A /* ObjCCallbackFunction.mm */,
+				86F3EEB616855A5B0077B92A /* ObjcRuntimeExtras.h */,
+				E124A8F60E555775003091F1 /* OpaqueJSString.cpp */,
+				E124A8F50E555775003091F1 /* OpaqueJSString.h */,
+				5DE3D0F40DD8DDFB00468714 /* WebKitAvailability.h */,
+			);
+			path = API;
+			sourceTree = "<group>";
+			tabWidth = 4;
+			usesTabs = 0;
+		};
+		144005170A531CB50005F061 /* minidom */ = {
+			isa = PBXGroup;
+			children = (
+				1440F6420A4F8B6A0005F061 /* JSNode.c */,
+				1440F6410A4F8B6A0005F061 /* JSNode.h */,
+				144007560A5370D20005F061 /* JSNodeList.c */,
+				144007550A5370D20005F061 /* JSNodeList.h */,
+				141211020A48780900480255 /* minidom.c */,
+				1412110D0A48788700480255 /* minidom.js */,
+				144005200A531D3B0005F061 /* Node.c */,
+				1440051F0A531D3B0005F061 /* Node.h */,
+				144007490A536CC20005F061 /* NodeList.c */,
+				144007480A536CC20005F061 /* NodeList.h */,
+			);
+			name = minidom;
+			path = API;
+			sourceTree = "<group>";
+		};
+		1480DB9A0DDC2231003CFDF2 /* debugger */ = {
+			isa = PBXGroup;
+			children = (
+				FEA0861E182B7A0400F6D851 /* Breakpoint.h */,
+				F692A8580255597D01FF60F7 /* Debugger.cpp */,
+				F692A8590255597D01FF60F7 /* Debugger.h */,
+				149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */,
+				1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */,
+				6AD2CB4C19B9140100065719 /* DebuggerEvalEnabler.h */,
+				A5FC84B01D1DDAC8006B5C46 /* DebuggerLocation.cpp */,
+				A5FC84B11D1DDAC8006B5C46 /* DebuggerLocation.h */,
+				A5A1A0931D8CB337004C2EB8 /* DebuggerParseData.cpp */,
+				A5A1A0921D8CB12F004C2EB8 /* DebuggerParseData.h */,
+				FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */,
+				0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */,
+				0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */,
+				A55165D41BDF134D003B75C1 /* ScriptProfilingScope.h */,
+			);
+			path = debugger;
+			sourceTree = "<group>";
+		};
+		1C90513E0BA9E8830081E9D0 /* Configurations */ = {
+			isa = PBXGroup;
+			children = (
+				1C9051450BA9E8A70081E9D0 /* Base.xcconfig */,
+				1C9051440BA9E8A70081E9D0 /* DebugRelease.xcconfig */,
+				449097EE0F8F81B50076A327 /* FeatureDefines.xcconfig */,
+				1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */,
+				5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */,
+				BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */,
+				1C9051420BA9E8A70081E9D0 /* Version.xcconfig */,
+			);
+			path = Configurations;
+			sourceTree = "<group>";
+			tabWidth = 4;
+			usesTabs = 0;
+		};
+		650FDF8D09D0FCA700769E54 /* Derived Sources */ = {
+			isa = PBXGroup;
+			children = (
+				0F6183321C45F35C0072450B /* AirOpcode.h */,
+				0F6183341C45F3B60072450B /* AirOpcodeGenerated.h */,
+				0F6183351C45F3B60072450B /* AirOpcodeUtils.h */,
+				996B73151BDA05AA00331B84 /* ArrayConstructor.lut.h */,
+				996B73161BDA05AA00331B84 /* ArrayIteratorPrototype.lut.h */,
+				996B73071BD9FA2C00331B84 /* BooleanPrototype.lut.h */,
+				6514F21718B3E1670098FF8B /* Bytecodes.h */,
+				A53243951856A475002ED692 /* CombinedDomains.json */,
+				996B73081BD9FA2C00331B84 /* DateConstructor.lut.h */,
+				BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */,
+				996B73091BD9FA2C00331B84 /* ErrorPrototype.lut.h */,
+				70B791901C0246CE002481E2 /* GeneratorPrototype.lut.h */,
+				6514F21818B3E1670098FF8B /* InitBytecodes.asm */,
+				A513E5C6185F9436007E95AD /* InjectedScriptSource.h */,
+				A5EA710D19F6DF810098F5EC /* InspectorAlternateBackendDispatchers.h */,
+				A53243961856A475002ED692 /* InspectorBackendCommands.js */,
+				A532438118568317002ED692 /* InspectorBackendDispatchers.cpp */,
+				A532438218568317002ED692 /* InspectorBackendDispatchers.h */,
+				A532438318568317002ED692 /* InspectorFrontendDispatchers.cpp */,
+				A532438418568317002ED692 /* InspectorFrontendDispatchers.h */,
+				E33B3E251B7ABD750048DB2E /* InspectorInstrumentationObject.lut.h */,
+				A532438518568317002ED692 /* InspectorProtocolObjects.cpp */,
+				A532438618568317002ED692 /* InspectorProtocolObjects.h */,
+				A18193E11B4E0CDB00FC1029 /* IntlCollatorConstructor.lut.h */,
+				A18193E21B4E0CDB00FC1029 /* IntlCollatorPrototype.lut.h */,
+				A1587D731B4DC1C600D69849 /* IntlDateTimeFormatConstructor.lut.h */,
+				A1587D741B4DC1C600D69849 /* IntlDateTimeFormatPrototype.lut.h */,
+				A125846C1B45A36000CC7F6C /* IntlNumberFormatConstructor.lut.h */,
+				A125846D1B45A36000CC7F6C /* IntlNumberFormatPrototype.lut.h */,
+				A7D801A61880D6A80026C39B /* JSCBuiltins.cpp */,
+				A7D801A71880D6A80026C39B /* JSCBuiltins.h */,
+				996B730A1BD9FA2C00331B84 /* JSDataViewPrototype.lut.h */,
+				996B730B1BD9FA2C00331B84 /* JSGlobalObject.lut.h */,
+				E33F50861B8449EF00413856 /* JSInternalPromiseConstructor.lut.h */,
+				BC87CDB810712ACA000614CF /* JSONObject.lut.h */,
+				7C184E2417BFFA36007CB63A /* JSPromiseConstructor.lut.h */,
+				7C184E2517BFFA36007CB63A /* JSPromisePrototype.lut.h */,
+				9928FF3918AC4AEC00B8CF12 /* JSReplayInputs.cpp */,
+				9928FF3A18AC4AEC00B8CF12 /* JSReplayInputs.h */,
+				A7C225CD1399849C00FF1662 /* KeywordLookup.h */,
+				BC18C52D0E16FCE100B34460 /* Lexer.lut.h */,
+				70DE9A081BE7D670005D89D9 /* LLIntAssembly.h */,
+				7035587E1C418458004BD7BF /* MapPrototype.lut.h */,
+				996B730C1BD9FA2C00331B84 /* ModuleLoaderPrototype.lut.h */,
+				BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */,
+				996B730D1BD9FA2C00331B84 /* NumberPrototype.lut.h */,
+				996B730E1BD9FA2C00331B84 /* ObjectConstructor.lut.h */,
+				996B730F1BD9FA2C00331B84 /* ReflectObject.lut.h */,
+				BCD202D50E170708002C7E82 /* RegExpConstructor.lut.h */,
+				A718F61A11754A21002465A7 /* RegExpJitTables.h */,
+				7035587F1C418458004BD7BF /* SetPrototype.lut.h */,
+				996B73111BD9FA2C00331B84 /* StringConstructor.lut.h */,
+				996B73121BD9FA2C00331B84 /* StringIteratorPrototype.lut.h */,
+				996B73131BD9FA2C00331B84 /* SymbolConstructor.lut.h */,
+				996B73141BD9FA2C00331B84 /* SymbolPrototype.lut.h */,
+				533B15DE1DC7F463004D500A /* WasmOps.h */,
+				AD2FCC0A1DB59C5900B3E736 /* WebAssemblyCompileErrorConstructor.lut.h */,
+				AD2FCC0B1DB59C5900B3E736 /* WebAssemblyCompileErrorPrototype.lut.h */,
+				AD2FCC0C1DB59C5900B3E736 /* WebAssemblyInstanceConstructor.lut.h */,
+				AD2FCC0D1DB59C5900B3E736 /* WebAssemblyInstancePrototype.lut.h */,
+				AD2FCC0E1DB59C5900B3E736 /* WebAssemblyMemoryConstructor.lut.h */,
+				AD2FCC0F1DB59C5900B3E736 /* WebAssemblyMemoryPrototype.lut.h */,
+				AD2FCC101DB59C5900B3E736 /* WebAssemblyModuleConstructor.lut.h */,
+				AD2FCC111DB59C5900B3E736 /* WebAssemblyModulePrototype.lut.h */,
+				AD2FCC121DB59C5900B3E736 /* WebAssemblyRuntimeErrorConstructor.lut.h */,
+				AD2FCC131DB59C5900B3E736 /* WebAssemblyRuntimeErrorPrototype.lut.h */,
+				AD2FCC141DB59C5900B3E736 /* WebAssemblyTableConstructor.lut.h */,
+				AD2FCC151DB59C5900B3E736 /* WebAssemblyTablePrototype.lut.h */,
+				65A946141C8E9F6F00A7209A /* YarrCanonicalizeUnicode.cpp */,
+			);
+			name = "Derived Sources";
+			path = DerivedSources/JavaScriptCore;
+			sourceTree = BUILT_PRODUCTS_DIR;
+			tabWidth = 4;
+			usesTabs = 0;
+		};
+		652A3A1A1651A92400A80AFE /* ARM64 */ = {
+			isa = PBXGroup;
+			children = (
+				652A3A221651C69700A80AFE /* A64DOpcode.cpp */,
+				652A3A231651C69700A80AFE /* A64DOpcode.h */,
+			);
+			name = ARM64;
+			sourceTree = "<group>";
+		};
+		65C028591717966800351E35 /* ARMv7 */ = {
+			isa = PBXGroup;
+			children = (
+				65C0285A1717966800351E35 /* ARMv7DOpcode.cpp */,
+				65C0285B1717966800351E35 /* ARMv7DOpcode.h */,
+			);
+			name = ARMv7;
+			path = disassembler/ARMv7;
+			sourceTree = "<group>";
+		};
+		7B98D1331B60CD1E0023B1A4 /* wasm */ = {
+			isa = PBXGroup;
+			children = (
+				AD2FCB8A1DB5840000B3E736 /* js */,
+				AD2FCC2E1DB839F700B3E736 /* JSWebAssembly.cpp */,
+				AD2FCC2F1DB839F700B3E736 /* JSWebAssembly.h */,
+				53F40E8E1D5902820099A1B6 /* WasmB3IRGenerator.cpp */,
+				53F40E921D5A4AB30099A1B6 /* WasmB3IRGenerator.h */,
+				AD4B1DF71DF244D70071AE32 /* WasmBinding.cpp */,
+				AD4B1DF81DF244D70071AE32 /* WasmBinding.h */,
+				53FD04D11D7AB187003287D3 /* WasmCallingConvention.cpp */,
+				53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */,
+				79DAE2791E03C82200B526AA /* WasmExceptionType.h */,
+				AD2FCC321DC4045300B3E736 /* WasmFormat.cpp */,
+				7BC547D21B69599B00959B58 /* WasmFormat.h */,
+				53F40E8A1D5901BB0099A1B6 /* WasmFunctionParser.h */,
+				535557151D9DFA32006D583B /* WasmMemory.cpp */,
+				535557131D9D9EA5006D583B /* WasmMemory.h */,
+				79B759711DFA4C600052174C /* WasmMemoryInformation.cpp */,
+				79B759721DFA4C600052174C /* WasmMemoryInformation.h */,
+				53F40E961D5A7BEC0099A1B6 /* WasmModuleParser.cpp */,
+				53F40E941D5A7AEF0099A1B6 /* WasmModuleParser.h */,
+				79B759731DFA4C600052174C /* WasmPageCount.h */,
+				53F40E8C1D5901F20099A1B6 /* WasmParser.h */,
+				531374BE1D5CE95000AF7A0B /* WasmPlan.cpp */,
+				531374BC1D5CE67600AF7A0B /* WasmPlan.h */,
+				53F40E841D58F9770099A1B6 /* WasmSections.h */,
+				53FF7F9A1DBFD2B900A26CCC /* WasmValidate.cpp */,
+				53FF7F981DBFCD9000A26CCC /* WasmValidate.h */,
+			);
+			path = wasm;
+			sourceTree = "<group>";
+		};
+		7E39D81D0EC38EFA003AF11A /* bytecompiler */ = {
+			isa = PBXGroup;
+			children = (
+				969A07200ED1CE3300F1F681 /* BytecodeGenerator.cpp */,
+				969A07210ED1CE3300F1F681 /* BytecodeGenerator.h */,
+				969A07270ED1CE6900F1F681 /* Label.h */,
+				960097A50EBABB58007A7297 /* LabelScope.h */,
+				655EB29A10CE2581001A990E /* NodesCodegen.cpp */,
+				969A07280ED1CE6900F1F681 /* RegisterID.h */,
+				14DF04D916B3996D0016A513 /* StaticPropertyAnalysis.h */,
+				14CA958A16AB50DE00938A06 /* StaticPropertyAnalyzer.h */,
+			);
+			path = bytecompiler;
+			sourceTree = "<group>";
+		};
+		7E39D8370EC3A388003AF11A /* parser */ = {
+			isa = PBXGroup;
+			children = (
+				A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */,
+				93F1981A08245AAE001E9ABC /* Keywords.table */,
+				F692A8650255597D01FF60F7 /* Lexer.cpp */,
+				F692A8660255597D01FF60F7 /* Lexer.h */,
+				E3794E731B77EB97005543AE /* ModuleAnalyzer.cpp */,
+				E3794E741B77EB97005543AE /* ModuleAnalyzer.h */,
+				000BEAF0DF604481AF6AB68C /* ModuleScopeData.h */,
+				930DAD030FB1EB1A0082D205 /* NodeConstructors.h */,
+				F692A86D0255597D01FF60F7 /* Nodes.cpp */,
+				F692A86E0255597D01FF60F7 /* Nodes.h */,
+				E3963CEC1B73F75000EB4CE5 /* NodesAnalyzeModule.cpp */,
+				93F0B3A909BB4DC00068FCE3 /* Parser.cpp */,
+				93F0B3AA09BB4DC00068FCE3 /* Parser.h */,
+				93052C320FB792190048FDC3 /* ParserArena.cpp */,
+				93052C330FB792190048FDC3 /* ParserArena.h */,
+				0FCCAE4316D0CF6E00D0C65B /* ParserError.h */,
+				9B4954E81A6640DB002815A6 /* ParserFunctionInfo.h */,
+				A77F18241641925400640A47 /* ParserModes.h */,
+				65303D631447B9E100D3F904 /* ParserTokens.h */,
+				869EBCB60E8C6D4A008722CC /* ResultType.h */,
+				14201D581DECF26A00904BD3 /* SourceCode.h */,
+				70B7918E1C0244C9002481E2 /* SourceCodeKey.h */,
+				0F493AF816D0CAD10084508B /* SourceProvider.cpp */,
+				65E866ED0DD59AFA00A2B2A1 /* SourceProvider.h */,
+				E49DC15512EF277200184A1F /* SourceProviderCache.cpp */,
+				E49DC15112EF272200184A1F /* SourceProviderCache.h */,
+				E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */,
+				A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */,
+				0F8F2B9D17306C8B007DBDA5 /* UnlinkedSourceCode.cpp */,
+				14AB66751DECF40900A56C26 /* UnlinkedSourceCode.h */,
+				79EE0BFD1B4AFB85000385C9 /* VariableEnvironment.cpp */,
+				79EE0BFE1B4AFB85000385C9 /* VariableEnvironment.h */,
+			);
+			path = parser;
+			sourceTree = "<group>";
+		};
+		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
+			isa = PBXGroup;
+			children = (
+				AD4937C11DDBE60A0077C807 /* AbstractModuleRecord.cpp */,
+				AD4937C21DDBE60A0077C807 /* AbstractModuleRecord.h */,
+				BCF605110E203EF800B9A64D /* ArgList.cpp */,
+				BCF605120E203EF800B9A64D /* ArgList.h */,
+				0FE0500C1AA9091100D33B33 /* ArgumentsMode.h */,
+				0F6B1CB71861244C00845D97 /* ArityCheckMode.h */,
+				A7A8AF2517ADB5F2005AB174 /* ArrayBuffer.cpp */,
+				A7A8AF2617ADB5F3005AB174 /* ArrayBuffer.h */,
+				0FFC99D2184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp */,
+				0FFC99D3184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h */,
+				0F30FB601DC2DE96003124F2 /* ArrayBufferSharingMode.h */,
+				A7A8AF2717ADB5F3005AB174 /* ArrayBufferView.cpp */,
+				A7A8AF2817ADB5F3005AB174 /* ArrayBufferView.h */,
+				BC7952060E15E8A800A898AB /* ArrayConstructor.cpp */,
+				BC7952070E15E8A800A898AB /* ArrayConstructor.h */,
+				0FB415831D78F98200DF8D09 /* ArrayConventions.cpp */,
+				0FB7F38915ED8E3800F167B2 /* ArrayConventions.h */,
+				52B74B481DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp */,
+				52B74B491DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h */,
+				A7BDAEC217F4EA1400F6140C /* ArrayIteratorPrototype.cpp */,
+				A7BDAEC317F4EA1400F6140C /* ArrayIteratorPrototype.h */,
+				F692A84D0255597D01FF60F7 /* ArrayPrototype.cpp */,
+				F692A84E0255597D01FF60F7 /* ArrayPrototype.h */,
+				0FB7F38A15ED8E3800F167B2 /* ArrayStorage.h */,
+				5B70CFDD1DB69E5C00EC23F9 /* AsyncFunctionConstructor.cpp */,
+				5B70CFDC1DB69E5C00EC23F9 /* AsyncFunctionConstructor.h */,
+				5B70CFDB1DB69E5C00EC23F9 /* AsyncFunctionPrototype.cpp */,
+				5B70CFDA1DB69E5C00EC23F9 /* AsyncFunctionPrototype.h */,
+				0F7CF9541DC1258B0098CC12 /* AtomicsObject.cpp */,
+				0F7CF9551DC1258B0098CC12 /* AtomicsObject.h */,
+				0F38D2A01D44196600680499 /* AuxiliaryBarrier.h */,
+				0F38D2A11D44196600680499 /* AuxiliaryBarrierInlines.h */,
+				52678F8C1A031009006A306D /* BasicBlockLocation.cpp */,
+				52678F8D1A031009006A306D /* BasicBlockLocation.h */,
+				147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */,
+				866739D013BFDE710023D87C /* BigInteger.h */,
+				BC7952320E15EB5600A898AB /* BooleanConstructor.cpp */,
+				BC7952330E15EB5600A898AB /* BooleanConstructor.h */,
+				F692A8500255597D01FF60F7 /* BooleanObject.cpp */,
+				704FD35305697E6D003DBED9 /* BooleanObject.h */,
+				BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */,
+				BC7952350E15EB5600A898AB /* BooleanPrototype.h */,
+				9E72940A190F0514001A91B5 /* BundlePath.h */,
+				9E729409190F0306001A91B5 /* BundlePath.mm */,
+				0FB7F38B15ED8E3800F167B2 /* Butterfly.h */,
+				0FB7F38C15ED8E3800F167B2 /* ButterflyInlines.h */,
+				BCA62DFE0E2826230004F30D /* CallData.cpp */,
+				145C507F0D9DF63B0088F6B9 /* CallData.h */,
+				FE80C1981D775FB4008510C0 /* CatchScope.cpp */,
+				FE80C1961D775B27008510C0 /* CatchScope.h */,
+				BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */,
+				0FE0501C1AA9095600D33B33 /* ClonedArguments.cpp */,
+				0FE0501D1AA9095600D33B33 /* ClonedArguments.h */,
+				A77F181F164088B200640A47 /* CodeCache.cpp */,
+				A77F1820164088B200640A47 /* CodeCache.h */,
+				0F8F943A1667631100D61971 /* CodeSpecializationKind.cpp */,
+				0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */,
+				65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */,
+				65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */,
+				A709F2F117A0AC2A00512E98 /* CommonSlowPaths.cpp */,
+				0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */,
+				6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */,
+				6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */,
+				A7E5A3A51797432D00E893C0 /* CompilationResult.cpp */,
+				A7E5A3A61797432D00E893C0 /* CompilationResult.h */,
+				969A09220ED1E09C00F1F681 /* Completion.cpp */,
+				F5BB2BC5030F772101FCFE1D /* Completion.h */,
+				0FDB2CE9174896C7007B3C1B /* ConcurrentJSLock.h */,
+				A5B6A74C18C6DBA600F11E91 /* ConsoleClient.cpp */,
+				A53CE08918BC21C300BEDF76 /* ConsoleClient.h */,
+				A55714BC1CD8048E0004D2C6 /* ConsoleObject.cpp */,
+				A55714BD1CD8048E0004D2C6 /* ConsoleObject.h */,
+				A5FD0071189B038C00633231 /* ConsoleTypes.h */,
+				0F978B3A1AAEA71D007C7369 /* ConstantMode.cpp */,
+				0FFC99D0184EC8AD009C10AB /* ConstantMode.h */,
+				E354622A1B6065D100545386 /* ConstructAbility.h */,
+				BCA62DFF0E2826310004F30D /* ConstructData.cpp */,
+				BC8F3CCF0DAF17BA00577A80 /* ConstructData.h */,
+				52B717B41A0597E1007AF4F3 /* ControlFlowProfiler.cpp */,
+				52678F901A04177C006A306D /* ControlFlowProfiler.h */,
+				2A111243192FCE79005EE18D /* CustomGetterSetter.cpp */,
+				2A111244192FCE79005EE18D /* CustomGetterSetter.h */,
+				0F2B66B017B6B5AB00A7AE3F /* DataView.cpp */,
+				0F2B66B117B6B5AB00A7AE3F /* DataView.h */,
+				BCD203450E17135E002C7E82 /* DateConstructor.cpp */,
+				BCD203460E17135E002C7E82 /* DateConstructor.h */,
+				D21202280AD4310C00ED79B6 /* DateConversion.cpp */,
+				D21202290AD4310C00ED79B6 /* DateConversion.h */,
+				BC1166000E1997B1008066DD /* DateInstance.cpp */,
+				BC1166010E1997B1008066DD /* DateInstance.h */,
+				14A1563010966365006FA260 /* DateInstanceCache.h */,
+				BCD203470E17135E002C7E82 /* DatePrototype.cpp */,
+				BCD203480E17135E002C7E82 /* DatePrototype.h */,
+				169948EDE68D4054B01EF797 /* DefinePropertyAttributes.h */,
+				0FE0500F1AA9091100D33B33 /* DirectArguments.cpp */,
+				0FE050101AA9091100D33B33 /* DirectArguments.h */,
+				0FE0500D1AA9091100D33B33 /* DirectArgumentsOffset.cpp */,
+				0FE0500E1AA9091100D33B33 /* DirectArgumentsOffset.h */,
+				14386A721DD69895008652C4 /* DirectEvalExecutable.cpp */,
+				14386A731DD69895008652C4 /* DirectEvalExecutable.h */,
+				A70447EB17A0BD7000F5898E /* DumpContext.cpp */,
+				A70447EC17A0BD7000F5898E /* DumpContext.h */,
+				FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */,
+				FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */,
+				2AD2EDFA19799E38004D6478 /* EnumerationMode.h */,
+				BC337BEA0E1B00CB0076918A /* Error.cpp */,
+				BC3046060E1F497F003232CF /* Error.h */,
+				BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */,
+				BC02E9050E1839DB000F9297 /* ErrorConstructor.h */,
+				FEB58C12187B8B160098EF0B /* ErrorHandlingScope.cpp */,
+				FEB58C13187B8B160098EF0B /* ErrorHandlingScope.h */,
+				BC02E98A0E183E38000F9297 /* ErrorInstance.cpp */,
+				BC02E98B0E183E38000F9297 /* ErrorInstance.h */,
+				BC02E9060E1839DB000F9297 /* ErrorPrototype.cpp */,
+				BC02E9070E1839DB000F9297 /* ErrorPrototype.h */,
+				147341DB1DC2CE9600AA29BA /* EvalExecutable.cpp */,
+				147341D11DC02E2E00AA29BA /* EvalExecutable.h */,
+				FE1C0FFE1B194FD100B53FCA /* Exception.cpp */,
+				FE1C0FFC1B193E9800B53FCA /* Exception.h */,
+				FE80C19A1D7768FD008510C0 /* ExceptionEventLocation.cpp */,
+				FE6029D81D6E1E330030204D /* ExceptionEventLocation.h */,
+				0F12DE0D1979D5FD0006FF4E /* ExceptionFuzz.cpp */,
+				0F12DE0E1979D5FD0006FF4E /* ExceptionFuzz.h */,
+				1429D8770ED21ACD00B89619 /* ExceptionHelpers.cpp */,
+				A72701B30DADE94900E548D7 /* ExceptionHelpers.h */,
+				FE6491381D78F3A300A694D4 /* ExceptionScope.cpp */,
+				FE6491361D78F01300A694D4 /* ExceptionScope.h */,
+				147341E91DC2CF2500AA29BA /* ExecutableBase.cpp */,
+				147341CB1DC02D7200AA29BA /* ExecutableBase.h */,
+				A7A8AF2917ADB5F3005AB174 /* Float32Array.h */,
+				A7A8AF2A17ADB5F3005AB174 /* Float64Array.h */,
+				BC2680C00E16D4E900A06E92 /* FunctionConstructor.cpp */,
+				BC2680C10E16D4E900A06E92 /* FunctionConstructor.h */,
+				147341DC1DC2CE9600AA29BA /* FunctionExecutable.cpp */,
+				147341D71DC02F9900AA29BA /* FunctionExecutable.h */,
+				0FB4B52116B6278D003F696B /* FunctionExecutableDump.cpp */,
+				0FB4B52216B6278D003F696B /* FunctionExecutableDump.h */,
+				52B310FC1974AE870080857C /* FunctionHasExecutedCache.cpp */,
+				52B310FA1974AE610080857C /* FunctionHasExecutedCache.h */,
+				F692A85C0255597D01FF60F7 /* FunctionPrototype.cpp */,
+				F692A85D0255597D01FF60F7 /* FunctionPrototype.h */,
+				62D2D38D1ADF103F000206C1 /* FunctionRareData.cpp */,
+				62D2D38E1ADF103F000206C1 /* FunctionRareData.h */,
+				70B791851C024432002481E2 /* GeneratorFunctionConstructor.cpp */,
+				70B791861C024432002481E2 /* GeneratorFunctionConstructor.h */,
+				70B791871C024432002481E2 /* GeneratorFunctionPrototype.cpp */,
+				70B791881C024432002481E2 /* GeneratorFunctionPrototype.h */,
+				70B791891C024432002481E2 /* GeneratorPrototype.cpp */,
+				70B7918A1C024432002481E2 /* GeneratorPrototype.h */,
+				0FE050111AA9091100D33B33 /* GenericArguments.h */,
+				0FE050121AA9091100D33B33 /* GenericArgumentsInlines.h */,
+				0FE050131AA9091100D33B33 /* GenericOffset.h */,
+				0F2B66B217B6B5AB00A7AE3F /* GenericTypedArrayView.h */,
+				0F2B66B317B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h */,
+				796465681B952FF0003059EE /* GetPutInfo.h */,
+				BC02E9B80E184545000F9297 /* GetterSetter.cpp */,
+				BC337BDE0E1AF0B80076918A /* GetterSetter.h */,
+				79A0907D1D768465008B889B /* HashMapImpl.cpp */,
+				79A0907E1D768465008B889B /* HashMapImpl.h */,
+				79DFCBDA1D88C59600527D03 /* HasOwnPropertyCache.h */,
+				933A349D038AE80F008635CE /* Identifier.cpp */,
+				933A349A038AE7C6008635CE /* Identifier.h */,
+				8606DDE918DA44AB00A383D0 /* IdentifierInlines.h */,
+				0FB7F38D15ED8E3800F167B2 /* IndexingHeader.h */,
+				0FB7F38E15ED8E3800F167B2 /* IndexingHeaderInlines.h */,
+				0F13E04C16164A1B00DC8DE7 /* IndexingType.cpp */,
+				0FB7F38F15ED8E3800F167B2 /* IndexingType.h */,
+				14386A761DD6989C008652C4 /* IndirectEvalExecutable.cpp */,
+				14386A771DD6989C008652C4 /* IndirectEvalExecutable.h */,
+				0F0A75201B94BFA900110660 /* InferredType.cpp */,
+				0F0A75211B94BFA900110660 /* InferredType.h */,
+				0FFC920F1B94D4DF0071DD66 /* InferredTypeTable.cpp */,
+				0FFC92101B94D4DF0071DD66 /* InferredTypeTable.h */,
+				0FF8BDE81AD4CF7100DFE884 /* InferredValue.cpp */,
+				0FF8BDE91AD4CF7100DFE884 /* InferredValue.h */,
+				E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */,
+				E178633F0D9BEC0000D74E75 /* InitializeThreading.h */,
+				E35E035D1B7AB43E0073AD2A /* InspectorInstrumentationObject.cpp */,
+				E35E035E1B7AB43E0073AD2A /* InspectorInstrumentationObject.h */,
+				A7A8AF2C17ADB5F3005AB174 /* Int16Array.h */,
+				A7A8AF2D17ADB5F3005AB174 /* Int32Array.h */,
+				A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */,
+				BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */,
+				BC11667A0E199C05008066DD /* InternalFunction.h */,
+				A1B9E2331B4E0D6700BC7FED /* IntlCollator.cpp */,
+				A1B9E2341B4E0D6700BC7FED /* IntlCollator.h */,
+				A1B9E2351B4E0D6700BC7FED /* IntlCollatorConstructor.cpp */,
+				A1B9E2361B4E0D6700BC7FED /* IntlCollatorConstructor.h */,
+				A1B9E2371B4E0D6700BC7FED /* IntlCollatorPrototype.cpp */,
+				A1B9E2381B4E0D6700BC7FED /* IntlCollatorPrototype.h */,
+				A1587D671B4DC14100D69849 /* IntlDateTimeFormat.cpp */,
+				A1587D681B4DC14100D69849 /* IntlDateTimeFormat.h */,
+				A1587D691B4DC14100D69849 /* IntlDateTimeFormatConstructor.cpp */,
+				A1587D6A1B4DC14100D69849 /* IntlDateTimeFormatConstructor.h */,
+				A1587D6B1B4DC14100D69849 /* IntlDateTimeFormatPrototype.cpp */,
+				A1587D6C1B4DC14100D69849 /* IntlDateTimeFormatPrototype.h */,
+				A1D792F61B43864B004516F5 /* IntlNumberFormat.cpp */,
+				A1D792F71B43864B004516F5 /* IntlNumberFormat.h */,
+				A1D792F81B43864B004516F5 /* IntlNumberFormatConstructor.cpp */,
+				A1D792F91B43864B004516F5 /* IntlNumberFormatConstructor.h */,
+				A1D792FA1B43864B004516F5 /* IntlNumberFormatPrototype.cpp */,
+				A1D792FB1B43864B004516F5 /* IntlNumberFormatPrototype.h */,
+				A12BBFF31B044A9800664B69 /* IntlObject.cpp */,
+				A12BBFF11B044A8B00664B69 /* IntlObject.h */,
+				708EBE231CE8F35000453146 /* IntlObjectInlines.h */,
+				86BF642A148DB2B5004DE36A /* Intrinsic.h */,
+				8B9F6D551D5912FA001C739F /* IterationKind.h */,
+				FE4D55B71AE716CA0052E459 /* IterationStatus.h */,
+				70113D491A8DB093003848C4 /* IteratorOperations.cpp */,
+				70113D4A1A8DB093003848C4 /* IteratorOperations.h */,
+				70DC3E071B2DF2C700054299 /* IteratorPrototype.cpp */,
+				70DC3E081B2DF2C700054299 /* IteratorPrototype.h */,
+				93ADFCE60CCBD7AC00D30B08 /* JSArray.cpp */,
+				938772E5038BFE19008635CE /* JSArray.h */,
+				0F2B66B417B6B5AB00A7AE3F /* JSArrayBuffer.cpp */,
+				0F2B66B517B6B5AB00A7AE3F /* JSArrayBuffer.h */,
+				0F2B66B617B6B5AB00A7AE3F /* JSArrayBufferConstructor.cpp */,
+				0F2B66B717B6B5AB00A7AE3F /* JSArrayBufferConstructor.h */,
+				0F2B66B817B6B5AB00A7AE3F /* JSArrayBufferPrototype.cpp */,
+				0F2B66B917B6B5AB00A7AE3F /* JSArrayBufferPrototype.h */,
+				0F2B66BA17B6B5AB00A7AE3F /* JSArrayBufferView.cpp */,
+				0F2B66BB17B6B5AB00A7AE3F /* JSArrayBufferView.h */,
+				0F2B66BC17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h */,
+				539FB8B91C99DA7C00940FA1 /* JSArrayInlines.h */,
+				5B70CFD91DB69E5C00EC23F9 /* JSAsyncFunction.cpp */,
+				5B70CFD81DB69E5C00EC23F9 /* JSAsyncFunction.h */,
+				86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */,
+				86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */,
+				657CF45619BF6662004ACBF2 /* JSCallee.cpp */,
+				657CF45719BF6662004ACBF2 /* JSCallee.h */,
+				BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */,
+				BC1167D80E19BCC9008066DD /* JSCell.h */,
+				0F97496F1687ADE200A4FF6A /* JSCellInlines.h */,
+				0F1DD84918A945BE0026F3FA /* JSCInlines.h */,
+				F692A8870255597D01FF60F7 /* JSCJSValue.cpp */,
+				14ABB36E099C076400E2A24F /* JSCJSValue.h */,
+				865A30F0135007E100CDB49E /* JSCJSValueInlines.h */,
+				72AAF7CB1D0D318B005E60BE /* JSCustomGetterSetterFunction.cpp */,
+				72AAF7CC1D0D318B005E60BE /* JSCustomGetterSetterFunction.h */,
+				0F2B66BD17B6B5AB00A7AE3F /* JSDataView.cpp */,
+				0F2B66BE17B6B5AB00A7AE3F /* JSDataView.h */,
+				0F2B66BF17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp */,
+				0F2B66C017B6B5AB00A7AE3F /* JSDataViewPrototype.h */,
+				9788FC221471AD0C0068CE2D /* JSDateMath.cpp */,
+				9788FC231471AD0C0068CE2D /* JSDateMath.h */,
+				C2A7F687160432D400F76B98 /* JSDestructibleObject.h */,
+				0F7DF1391E29710E0095951B /* JSDestructibleObjectSubspace.cpp */,
+				0F7DF13A1E29710E0095951B /* JSDestructibleObjectSubspace.h */,
+				BC22A39A0E16E14800AF21C8 /* JSEnvironmentRecord.cpp */,
+				14F252560D08DD8D004ECFFF /* JSEnvironmentRecord.h */,
+				A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */,
+				798937761DCAB57300F8D4FB /* JSFixedArray.cpp */,
+				798937771DCAB57300F8D4FB /* JSFixedArray.h */,
+				0F2B66C117B6B5AB00A7AE3F /* JSFloat32Array.h */,
+				0F2B66C217B6B5AB00A7AE3F /* JSFloat64Array.h */,
+				F692A85E0255597D01FF60F7 /* JSFunction.cpp */,
+				F692A85F0255597D01FF60F7 /* JSFunction.h */,
+				A72028B91797603D0098028C /* JSFunctionInlines.h */,
+				70B7918C1C024462002481E2 /* JSGeneratorFunction.cpp */,
+				70B7918D1C024462002481E2 /* JSGeneratorFunction.h */,
+				0F2B66C317B6B5AB00A7AE3F /* JSGenericTypedArrayView.h */,
+				0F2B66C417B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructor.h */,
+				0F2B66C517B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructorInlines.h */,
+				0F2B66C617B6B5AB00A7AE3F /* JSGenericTypedArrayViewInlines.h */,
+				0F2B66C717B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h */,
+				53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */,
+				0F2B66C817B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h */,
+				797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */,
+				797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */,
+				14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */,
+				A8E894330CD0603F00367179 /* JSGlobalObject.h */,
+				A59455901824744700CC3843 /* JSGlobalObjectDebuggable.cpp */,
+				A59455911824744700CC3843 /* JSGlobalObjectDebuggable.h */,
+				BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */,
+				BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */,
+				79B819921DD25CF500DDC714 /* JSGlobalObjectInlines.h */,
+				0F2B66CA17B6B5AB00A7AE3F /* JSInt16Array.h */,
+				0F2B66CB17B6B5AB00A7AE3F /* JSInt32Array.h */,
+				0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */,
+				E33F507E1B8429A400413856 /* JSInternalPromise.cpp */,
+				E33F507F1B8429A400413856 /* JSInternalPromise.h */,
+				E33F50761B84225700413856 /* JSInternalPromiseConstructor.cpp */,
+				E33F50771B84225700413856 /* JSInternalPromiseConstructor.h */,
+				E33F50821B8437A000413856 /* JSInternalPromiseDeferred.cpp */,
+				E33F50831B8437A000413856 /* JSInternalPromiseDeferred.h */,
+				E33F50721B8421C000413856 /* JSInternalPromisePrototype.cpp */,
+				E33F50731B8421C000413856 /* JSInternalPromisePrototype.h */,
+				7013CA891B491A9400CAE613 /* JSJob.cpp */,
+				7013CA8A1B491A9400CAE613 /* JSJob.h */,
+				14DA818F0D99FD2000B0A4FB /* JSLexicalEnvironment.cpp */,
+				14DA818E0D99FD2000B0A4FB /* JSLexicalEnvironment.h */,
+				65EA4C99092AF9E20093D800 /* JSLock.cpp */,
+				65EA4C9A092AF9E20093D800 /* JSLock.h */,
+				A700873F17CBE8EB00C3E643 /* JSMap.cpp */,
+				A700874017CBE8EB00C3E643 /* JSMap.h */,
+				A74DEF8F182D991400522C22 /* JSMapIterator.cpp */,
+				A74DEF90182D991400522C22 /* JSMapIterator.h */,
+				E3D239C61B829C1C00BBEF67 /* JSModuleEnvironment.cpp */,
+				E3D239C71B829C1C00BBEF67 /* JSModuleEnvironment.h */,
+				1879510614C540FFB561C124 /* JSModuleLoader.cpp */,
+				77B25CB2C3094A92A38E1DB3 /* JSModuleLoader.h */,
+				E318CBBE1B8AEF5100A2929D /* JSModuleNamespaceObject.cpp */,
+				E318CBBF1B8AEF5100A2929D /* JSModuleNamespaceObject.h */,
+				E39DA4A41B7E8B7C0084F33A /* JSModuleRecord.cpp */,
+				E39DA4A51B7E8B7C0084F33A /* JSModuleRecord.h */,
+				E33E8D1A1B9013C300346B52 /* JSNativeStdFunction.cpp */,
+				E33E8D1B1B9013C300346B52 /* JSNativeStdFunction.h */,
+				BC22A3980E16E14800AF21C8 /* JSObject.cpp */,
+				BC22A3990E16E14800AF21C8 /* JSObject.h */,
+				0F93275E1C21EF7F00CF6564 /* JSObjectInlines.h */,
+				A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */,
+				A7F9935D0FD7325100A0B2D0 /* JSONObject.h */,
+				7C184E1817BEDBD3007CB63A /* JSPromise.cpp */,
+				7C184E1917BEDBD3007CB63A /* JSPromise.h */,
+				7C184E2017BEE240007CB63A /* JSPromiseConstructor.cpp */,
+				7C184E2117BEE240007CB63A /* JSPromiseConstructor.h */,
+				7C008CD8187124BB00955C24 /* JSPromiseDeferred.cpp */,
+				7C008CD9187124BB00955C24 /* JSPromiseDeferred.h */,
+				7C184E1C17BEE22E007CB63A /* JSPromisePrototype.cpp */,
+				7C184E1D17BEE22E007CB63A /* JSPromisePrototype.h */,
+				2A05ABD31961DF2400341750 /* JSPropertyNameEnumerator.cpp */,
+				2A05ABD41961DF2400341750 /* JSPropertyNameEnumerator.h */,
+				E3EF88721B66DF23003F26CB /* JSPropertyNameIterator.cpp */,
+				E3EF88731B66DF23003F26CB /* JSPropertyNameIterator.h */,
+				862553CE16136AA5009F17D0 /* JSProxy.cpp */,
+				862553CF16136AA5009F17D0 /* JSProxy.h */,
+				14874AE115EBDE4A002E3587 /* JSScope.cpp */,
+				14874AE215EBDE4A002E3587 /* JSScope.h */,
+				0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */,
+				0F919D0F157F3327004A4E7D /* JSSegmentedVariableObject.h */,
+				A7299D9B17D12837005F5FF9 /* JSSet.cpp */,
+				A7299D9C17D12837005F5FF9 /* JSSet.h */,
+				A790DD69182F499700588807 /* JSSetIterator.cpp */,
+				A790DD6A182F499700588807 /* JSSetIterator.h */,
+				BC02E9B60E1842FA000F9297 /* JSString.cpp */,
+				F692A8620255597D01FF60F7 /* JSString.h */,
+				86E85538111B9968001AF51E /* JSStringBuilder.h */,
+				FEFD6FC51D5E7970008F2F0B /* JSStringInlines.h */,
+				70EC0EBC1AA0D7DA00B6AAFA /* JSStringIterator.cpp */,
+				70EC0EBD1AA0D7DA00B6AAFA /* JSStringIterator.h */,
+				2600B5A4152BAAA70091EE5F /* JSStringJoiner.cpp */,
+				2600B5A5152BAAA70091EE5F /* JSStringJoiner.h */,
+				0F7DF13D1E2AFC4B0095951B /* JSStringSubspace.cpp */,
+				0F7DF13E1E2AFC4B0095951B /* JSStringSubspace.h */,
+				0F919D09157EE09D004A4E7D /* JSSymbolTableObject.cpp */,
+				0F919D0A157EE09D004A4E7D /* JSSymbolTableObject.h */,
+				70ECA6001AFDBEA200449739 /* JSTemplateRegistryKey.cpp */,
+				70ECA6011AFDBEA200449739 /* JSTemplateRegistryKey.h */,
+				14ABB454099C2A0F00E2A24F /* JSType.h */,
+				0F2B66CC17B6B5AB00A7AE3F /* JSTypedArrayConstructors.cpp */,
+				0F2B66CD17B6B5AB00A7AE3F /* JSTypedArrayConstructors.h */,
+				0F2B66CE17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.cpp */,
+				0F2B66CF17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.h */,
+				0F2B66D017B6B5AB00A7AE3F /* JSTypedArrays.cpp */,
+				0F2B66D117B6B5AB00A7AE3F /* JSTypedArrays.h */,
+				534C457D1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp */,
+				534C457B1BC72411007476A7 /* JSTypedArrayViewConstructor.h */,
+				53F256E11B87E28000B4B768 /* JSTypedArrayViewPrototype.cpp */,
+				53917E7C1B791106000EBD33 /* JSTypedArrayViewPrototype.h */,
+				6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
+				0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */,
+				0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */,
+				0F2B66D217B6B5AB00A7AE3F /* JSUint8Array.h */,
+				0F2B66D317B6B5AB00A7AE3F /* JSUint8ClampedArray.h */,
+				A7CA3AE117DA41AE006538AF /* JSWeakMap.cpp */,
+				A7CA3AE217DA41AE006538AF /* JSWeakMap.h */,
+				709FB8611AE335C60039D069 /* JSWeakSet.cpp */,
+				709FB8621AE335C60039D069 /* JSWeakSet.h */,
+				1442565F15EDE98D0066A49B /* JSWithScope.cpp */,
+				1442566015EDE98D0066A49B /* JSWithScope.h */,
+				65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */,
+				65C7A1720A8EAACB00FA37EA /* JSWrapperObject.h */,
+				DCF3D5641CD29468003D5C65 /* LazyClassStructure.cpp */,
+				DCF3D5651CD29468003D5C65 /* LazyClassStructure.h */,
+				DCF3D5661CD29468003D5C65 /* LazyClassStructureInlines.h */,
+				DCF3D5671CD29468003D5C65 /* LazyProperty.h */,
+				DCF3D5681CD29468003D5C65 /* LazyPropertyInlines.h */,
+				A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */,
+				A7E2EA690FB460CF00601F06 /* LiteralParser.h */,
+				F692A8680255597D01FF60F7 /* Lookup.cpp */,
+				F692A8690255597D01FF60F7 /* Lookup.h */,
+				795B19951D78BE3500262FA0 /* MapBase.cpp */,
+				795B19961D78BE3500262FA0 /* MapBase.h */,
+				A700873717CBE85300C3E643 /* MapConstructor.cpp */,
+				A700873817CBE85300C3E643 /* MapConstructor.h */,
+				A74DEF8D182D991400522C22 /* MapIteratorPrototype.cpp */,
+				A74DEF8E182D991400522C22 /* MapIteratorPrototype.h */,
+				A700873B17CBE8D300C3E643 /* MapPrototype.cpp */,
+				A700873C17CBE8D300C3E643 /* MapPrototype.h */,
+				DC69AA651CF7A1EF00C6272F /* MatchResult.cpp */,
+				8612E4CB1522918400C836BE /* MatchResult.h */,
+				4340A4821A9051AF00D73CCA /* MathCommon.cpp */,
+				4340A4831A9051AF00D73CCA /* MathCommon.h */,
+				F692A86A0255597D01FF60F7 /* MathObject.cpp */,
+				F692A86B0255597D01FF60F7 /* MathObject.h */,
+				90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */,
+				90213E3C123A40C200D422F3 /* MemoryStatistics.h */,
+				7C008CE5187631B600955C24 /* Microtask.h */,
+				E355F3501B7DC85300C50DC5 /* ModuleLoaderPrototype.cpp */,
+				E355F3511B7DC85300C50DC5 /* ModuleLoaderPrototype.h */,
+				147341DD1DC2CE9600AA29BA /* ModuleProgramExecutable.cpp */,
+				147341D51DC02EB900AA29BA /* ModuleProgramExecutable.h */,
+				BC02E9080E1839DB000F9297 /* NativeErrorConstructor.cpp */,
+				BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */,
+				BC02E90A0E1839DB000F9297 /* NativeErrorPrototype.cpp */,
+				BC02E90B0E1839DB000F9297 /* NativeErrorPrototype.h */,
+				147341DE1DC2CE9600AA29BA /* NativeExecutable.cpp */,
+				147341CF1DC02DB400AA29BA /* NativeExecutable.h */,
+				E33E8D1E1B9013DE00346B52 /* NativeStdFunctionCell.cpp */,
+				E33E8D1F1B9013DE00346B52 /* NativeStdFunctionCell.h */,
+				6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */,
+				6546F5201A32A59C006F07D5 /* NullGetterFunction.h */,
+				65525FC31A6DD3B3007B5495 /* NullSetterFunction.cpp */,
+				65525FC41A6DD3B3007B5495 /* NullSetterFunction.h */,
+				BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */,
+				BC2680C30E16D4E900A06E92 /* NumberConstructor.h */,
+				F692A8700255597D01FF60F7 /* NumberObject.cpp */,
+				F692A8710255597D01FF60F7 /* NumberObject.h */,
+				BC2680C40E16D4E900A06E92 /* NumberPrototype.cpp */,
+				BC2680C50E16D4E900A06E92 /* NumberPrototype.h */,
+				142D3938103E4560007DCB52 /* NumericStrings.h */,
+				BC2680C60E16D4E900A06E92 /* ObjectConstructor.cpp */,
+				BC2680C70E16D4E900A06E92 /* ObjectConstructor.h */,
+				BC2680C80E16D4E900A06E92 /* ObjectPrototype.cpp */,
+				BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */,
+				F692A8770255597D01FF60F7 /* Operations.cpp */,
+				F692A8780255597D01FF60F7 /* Operations.h */,
+				0FE228EA1436AB2300196C48 /* Options.cpp */,
+				0FE228EB1436AB2300196C48 /* Options.h */,
+				868916A9155F285400CB2B9A /* PrivateName.h */,
+				147341DF1DC2CE9600AA29BA /* ProgramExecutable.cpp */,
+				147341D31DC02E6D00AA29BA /* ProgramExecutable.h */,
+				A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */,
+				A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */,
+				BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */,
+				86158AB2155C8B3F00B45C9C /* PropertyName.h */,
+				65400C100A69BAF200509887 /* PropertyNameArray.h */,
+				0FF7168A15A3B231008F5DAA /* PropertyOffset.h */,
+				65621E6B089E859700760F35 /* PropertySlot.cpp */,
+				65621E6C089E859700760F35 /* PropertySlot.h */,
+				0FB7F39015ED8E3800F167B2 /* PropertyStorage.h */,
+				AD1CF06816DCAB2D00B97123 /* PropertyTable.cpp */,
+				65C02FBB0637462A003E7EE6 /* Protect.h */,
+				14D844A216AA2C7000A65AF0 /* PrototypeMap.cpp */,
+				14D844A316AA2C7000A65AF0 /* PrototypeMap.h */,
+				0FA131701D8DD72900EC130A /* PrototypeMapInlines.h */,
+				79B00CB81C6AB07E0088C65D /* ProxyConstructor.cpp */,
+				79B00CB91C6AB07E0088C65D /* ProxyConstructor.h */,
+				79B00CBA1C6AB07E0088C65D /* ProxyObject.cpp */,
+				79B00CBB1C6AB07E0088C65D /* ProxyObject.h */,
+				79160DBB1C8E3EC8008C085A /* ProxyRevoke.cpp */,
+				79160DBC1C8E3EC8008C085A /* ProxyRevoke.h */,
+				0F5780A118FE1E98001E72D9 /* PureNaN.h */,
+				0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */,
+				147B84620E6DE6B1004775A4 /* PutPropertySlot.h */,
+				E33637A31B63220200EE0840 /* ReflectObject.cpp */,
+				E33637A41B63220200EE0840 /* ReflectObject.h */,
+				F692A87D0255597D01FF60F7 /* RegExp.cpp */,
+				F692A87E0255597D01FF60F7 /* RegExp.h */,
+				A1712B3A11C7B212007A5315 /* RegExpCache.cpp */,
+				A1712B3E11C7B228007A5315 /* RegExpCache.h */,
+				86F75EFB151C062F007C9BA3 /* RegExpCachedResult.cpp */,
+				86F75EFC151C062F007C9BA3 /* RegExpCachedResult.h */,
+				BCD202BD0E1706A7002C7E82 /* RegExpConstructor.cpp */,
+				BCD202BE0E1706A7002C7E82 /* RegExpConstructor.h */,
+				0F7C39FA1C8F629300480151 /* RegExpInlines.h */,
+				A1712B4011C7B235007A5315 /* RegExpKey.h */,
+				86F75EFD151C062F007C9BA3 /* RegExpMatchesArray.cpp */,
+				93CEDDFB0EA91EE600258EBE /* RegExpMatchesArray.h */,
+				F692A87B0255597D01FF60F7 /* RegExpObject.cpp */,
+				F692A87C0255597D01FF60F7 /* RegExpObject.h */,
+				0F7C39FC1C8F659500480151 /* RegExpObjectInlines.h */,
+				BCD202BF0E1706A7002C7E82 /* RegExpPrototype.cpp */,
+				BCD202C00E1706A7002C7E82 /* RegExpPrototype.h */,
+				70B0A9D01A9B66200001306A /* RuntimeFlags.h */,
+				527773DD1AAF83AC00BDE7E8 /* RuntimeType.cpp */,
+				52C0611D1AA51E1B00B4ADBA /* RuntimeType.h */,
+				0F7700911402FF280078EB39 /* SamplingCounter.cpp */,
+				0F77008E1402FDD60078EB39 /* SamplingCounter.h */,
+				79D5CD581C1106A900CECA07 /* SamplingProfiler.cpp */,
+				79D5CD591C1106A900CECA07 /* SamplingProfiler.h */,
+				0FE0501E1AA9095600D33B33 /* ScopedArguments.cpp */,
+				0FE0501F1AA9095600D33B33 /* ScopedArguments.h */,
+				0FE0502E1AAA806900D33B33 /* ScopedArgumentsTable.cpp */,
+				0FE050201AA9095600D33B33 /* ScopedArgumentsTable.h */,
+				0FE050211AA9095600D33B33 /* ScopeOffset.cpp */,
+				0FE050221AA9095600D33B33 /* ScopeOffset.h */,
+				147341E01DC2CE9600AA29BA /* ScriptExecutable.cpp */,
+				147341CD1DC02D7900AA29BA /* ScriptExecutable.h */,
+				A7299DA317D12858005F5FF9 /* SetConstructor.cpp */,
+				A7299DA417D12858005F5FF9 /* SetConstructor.h */,
+				A790DD67182F499700588807 /* SetIteratorPrototype.cpp */,
+				A790DD68182F499700588807 /* SetIteratorPrototype.h */,
+				A7299D9F17D12848005F5FF9 /* SetPrototype.cpp */,
+				A7299DA017D12848005F5FF9 /* SetPrototype.h */,
+				0F2B66D617B6B5AB00A7AE3F /* SimpleTypedArrayController.cpp */,
+				0F2B66D717B6B5AB00A7AE3F /* SimpleTypedArrayController.h */,
+				0F5B4A321C84F0D600F1B17E /* SlowPathReturnType.h */,
+				93303FE80E6A72B500786E6A /* SmallStrings.cpp */,
+				93303FEA0E6A72C000786E6A /* SmallStrings.h */,
+				425BA1337E4344E1B269A671 /* SourceOrigin.h */,
+				0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */,
+				0FB7F39215ED8E3800F167B2 /* SparseArrayValueMap.h */,
+				0F3AC751183EA1040032029F /* StackAlignment.h */,
+				0F6DB7E71D6124B200CDBF8E /* StackFrame.cpp */,
+				0F6DB7E81D6124B200CDBF8E /* StackFrame.h */,
+				A730B6111250068F009D25B1 /* StrictEvalActivation.cpp */,
+				A730B6101250068F009D25B1 /* StrictEvalActivation.h */,
+				BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */,
+				BC18C3C10E16EE3300B34460 /* StringConstructor.h */,
+				70EC0EC01AA0D7DA00B6AAFA /* StringIteratorPrototype.cpp */,
+				70EC0EC11AA0D7DA00B6AAFA /* StringIteratorPrototype.h */,
+				BC18C3C20E16EE3300B34460 /* StringObject.cpp */,
+				BC18C3C30E16EE3300B34460 /* StringObject.h */,
+				BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */,
+				BC18C3C60E16EE3300B34460 /* StringPrototype.h */,
+				93345A8712D838C400302BE3 /* StringRecursionChecker.cpp */,
+				93345A8812D838C400302BE3 /* StringRecursionChecker.h */,
+				BCDE3AB00E6C82CF001453A7 /* Structure.cpp */,
+				BCDE3AB10E6C82CF001453A7 /* Structure.h */,
+				7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */,
+				7E4EE7080EBB7963005934AA /* StructureChain.h */,
+				2AAAA31018BD49D100394CC8 /* StructureIDBlob.h */,
+				2AF7382A18BBBF92008A5A37 /* StructureIDTable.cpp */,
+				2AF7382B18BBBF92008A5A37 /* StructureIDTable.h */,
+				0FD2C92316D01EE900C7803F /* StructureInlines.h */,
+				C2F0F2D016BAEEE900187C19 /* StructureRareData.cpp */,
+				C2FE18A316BAEC4000AF3061 /* StructureRareData.h */,
+				C20BA92C16BB1C1500B3AEA2 /* StructureRareDataInlines.h */,
+				BC9041470EB9250900FE26FA /* StructureTransitionTable.h */,
+				705B41A31A6E501E00716757 /* Symbol.cpp */,
+				705B41A41A6E501E00716757 /* Symbol.h */,
+				705B41A51A6E501E00716757 /* SymbolConstructor.cpp */,
+				705B41A61A6E501E00716757 /* SymbolConstructor.h */,
+				705B41A71A6E501E00716757 /* SymbolObject.cpp */,
+				705B41A81A6E501E00716757 /* SymbolObject.h */,
+				705B41A91A6E501E00716757 /* SymbolPrototype.cpp */,
+				705B41AA1A6E501E00716757 /* SymbolPrototype.h */,
+				0F919D2715856770004A4E7D /* SymbolTable.cpp */,
+				14A396A60CD2933100B5B4FF /* SymbolTable.h */,
+				70ECA6021AFDBEA200449739 /* TemplateRegistry.cpp */,
+				70ECA6031AFDBEA200449739 /* TemplateRegistry.h */,
+				BDB4B5E099CD4C1BB3C1CF05 /* TemplateRegistryKey.cpp */,
+				70ECA6041AFDBEA200449739 /* TemplateRegistryKey.h */,
+				8B47F234366C4B72AC852A7E /* TemplateRegistryKeyTable.cpp */,
+				08FC2F37AB76483A9966688F /* TemplateRegistryKeyTable.h */,
+				0FA2C17917D7CF84009D015F /* TestRunnerUtils.cpp */,
+				0FA2C17A17D7CF84009D015F /* TestRunnerUtils.h */,
+				FE2E6A7A1D6EA5FE0060F896 /* ThrowScope.cpp */,
+				FE3422111D6B818C0032BE88 /* ThrowScope.h */,
+				0F55989717C86C5600A1E543 /* ToNativeFromValue.h */,
+				0F2B66D817B6B5AB00A7AE3F /* TypedArrayAdaptors.h */,
+				0F2B66D917B6B5AB00A7AE3F /* TypedArrayController.cpp */,
+				0F2B66DA17B6B5AB00A7AE3F /* TypedArrayController.h */,
+				0F4B94DB17B9F07500DD03A4 /* TypedArrayInlines.h */,
+				0F2B66DB17B6B5AB00A7AE3F /* TypedArrays.h */,
+				0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */,
+				0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */,
+				0FB7F39115ED8E3800F167B2 /* TypeError.h */,
+				52B310FE1975B4240080857C /* TypeLocationCache.cpp */,
+				52B311001975B4670080857C /* TypeLocationCache.h */,
+				0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */,
+				0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */,
+				52C952B819A28A1C0069B386 /* TypeProfiler.cpp */,
+				52C952B619A289850069B386 /* TypeProfiler.h */,
+				0F2D4DDF19832D91007D4B19 /* TypeProfilerLog.cpp */,
+				0F2D4DE019832D91007D4B19 /* TypeProfilerLog.h */,
+				0F2D4DE319832D91007D4B19 /* TypeSet.cpp */,
+				0F2D4DE419832D91007D4B19 /* TypeSet.h */,
+				A7A8AF3217ADB5F3005AB174 /* Uint16Array.h */,
+				866739D113BFDE710023D87C /* Uint16WithFraction.h */,
+				A7A8AF3317ADB5F3005AB174 /* Uint32Array.h */,
+				A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */,
+				A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */,
+				0FE050231AA9095600D33B33 /* VarOffset.cpp */,
+				0FE050241AA9095600D33B33 /* VarOffset.h */,
+				E18E3A570DF9278C00D90B34 /* VM.cpp */,
+				E18E3A560DF9278C00D90B34 /* VM.h */,
+				FE5932A5183C5A2600A1ECCC /* VMEntryScope.cpp */,
+				FE5932A6183C5A2600A1ECCC /* VMEntryScope.h */,
+				FE90BB3A1B7CF64E006B3F03 /* VMInlines.h */,
+				FED94F2B171E3E2300BE77A4 /* Watchdog.cpp */,
+				FED94F2C171E3E2300BE77A4 /* Watchdog.h */,
+				14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */,
+				AD86A93D1AA4D87C002FE77F /* WeakGCMapInlines.h */,
+				A7CA3ADD17DA41AE006538AF /* WeakMapConstructor.cpp */,
+				A7CA3ADE17DA41AE006538AF /* WeakMapConstructor.h */,
+				A7CA3AE917DA5168006538AF /* WeakMapData.cpp */,
+				A7CA3AEA17DA5168006538AF /* WeakMapData.h */,
+				A7CA3ADF17DA41AE006538AF /* WeakMapPrototype.cpp */,
+				A7CA3AE017DA41AE006538AF /* WeakMapPrototype.h */,
+				709FB8631AE335C60039D069 /* WeakSetConstructor.cpp */,
+				709FB8641AE335C60039D069 /* WeakSetConstructor.h */,
+				709FB8651AE335C60039D069 /* WeakSetPrototype.cpp */,
+				709FB8661AE335C60039D069 /* WeakSetPrototype.h */,
+				A7DCB77912E3D90500911940 /* WriteBarrier.h */,
+				C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */,
+			);
+			path = runtime;
+			sourceTree = "<group>";
+		};
+		8603CEF014C753EF00AE59E3 /* tools */ = {
+			isa = PBXGroup;
+			children = (
+				86B5822E14D2373B00A9C306 /* CodeProfile.cpp */,
+				86B5822F14D2373B00A9C306 /* CodeProfile.h */,
+				8603CEF214C7546400AE59E3 /* CodeProfiling.cpp */,
+				8603CEF314C7546400AE59E3 /* CodeProfiling.h */,
+				FE4BFF291AD476E700088F87 /* FunctionOverrides.cpp */,
+				FE4BFF2A1AD476E700088F87 /* FunctionOverrides.h */,
+				FEA0C4001CDD7D0E00481991 /* FunctionWhitelist.cpp */,
+				FEA0C4011CDD7D0E00481991 /* FunctionWhitelist.h */,
+				FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */,
+				FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */,
+				FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */,
+				FE384EE41ADDB7AD0055DE2C /* JSDollarVMPrototype.h */,
+				FE3022D01E3D739600BAC493 /* SigillCrashAnalyzer.cpp */,
+				FE3022D11E3D739600BAC493 /* SigillCrashAnalyzer.h */,
+				86B5822C14D22F5F00A9C306 /* ProfileTreeNode.h */,
+				86B5826A14D35D5100A9C306 /* TieredMMapArray.h */,
+				FE3022D41E42856700BAC493 /* VMInspector.cpp */,
+				FE3022D51E42856700BAC493 /* VMInspector.h */,
+			);
+			path = tools;
+			sourceTree = "<group>";
+		};
+		86EAC48C0F93E8B9008EC948 /* yarr */ = {
+			isa = PBXGroup;
+			children = (
+				A57D23EB1891B5540031C7FA /* RegularExpression.cpp */,
+				A57D23EC1891B5540031C7FA /* RegularExpression.h */,
+				451539B812DC994500EF7AC4 /* Yarr.h */,
+				863C6D991521111200585E4E /* YarrCanonicalize.h */,
+				863C6D981521111200585E4E /* YarrCanonicalizeUCS2.cpp */,
+				863C6D9A1521111200585E4E /* YarrCanonicalizeUCS2.js */,
+				86704B7D12DBA33700A9FE7B /* YarrInterpreter.cpp */,
+				86704B7E12DBA33700A9FE7B /* YarrInterpreter.h */,
+				86704B7F12DBA33700A9FE7B /* YarrJIT.cpp */,
+				86704B8012DBA33700A9FE7B /* YarrJIT.h */,
+				86704B8112DBA33700A9FE7B /* YarrParser.h */,
+				86704B8212DBA33700A9FE7B /* YarrPattern.cpp */,
+				86704B8312DBA33700A9FE7B /* YarrPattern.h */,
+				86704B4012DB8A8100A9FE7B /* YarrSyntaxChecker.cpp */,
+				86704B4112DB8A8100A9FE7B /* YarrSyntaxChecker.h */,
+			);
+			name = yarr;
+			sourceTree = "<group>";
+		};
+		86EC9DB31328DF44002B2AD7 /* dfg */ = {
+			isa = PBXGroup;
+			children = (
+				A77A423617A0BBFD00A8DB81 /* DFGAbstractHeap.cpp */,
+				A77A423717A0BBFD00A8DB81 /* DFGAbstractHeap.h */,
+				A704D8FE17A0BAA8006BA554 /* DFGAbstractInterpreter.h */,
+				A704D8FF17A0BAA8006BA554 /* DFGAbstractInterpreterInlines.h */,
+				0F55C19317276E4600CEABFD /* DFGAbstractValue.cpp */,
+				0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */,
+				0FD3E3FF1B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp */,
+				0FD3E4001B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.h */,
+				0F18D3CD1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp */,
+				0F18D3CE1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.h */,
+				0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */,
+				0FB4B51916B62772003F696B /* DFGAllocator.h */,
+				0F1E3A431534CBAD000F9456 /* DFGArgumentPosition.h */,
+				0F2DD80C1AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.cpp */,
+				0F2DD80D1AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.h */,
+				0F2DD80E1AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.cpp */,
+				0F2DD80F1AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h */,
+				0F48531F187750560083B687 /* DFGArithMode.cpp */,
+				0F485320187750560083B687 /* DFGArithMode.h */,
+				0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */,
+				0F63948115E48114006A597C /* DFGArrayMode.cpp */,
+				0F63948215E48114006A597C /* DFGArrayMode.h */,
+				A7D9A28F17A0BC7400EE2618 /* DFGAtTailAbstractState.cpp */,
+				A7D9A29017A0BC7400EE2618 /* DFGAtTailAbstractState.h */,
+				0F666EC21835672B00D017F1 /* DFGAvailability.cpp */,
+				0F666EC31835672B00D017F1 /* DFGAvailability.h */,
+				0F2B9CD619D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp */,
+				0F2B9CD719D0BA7D00B1D1B5 /* DFGAvailabilityMap.h */,
+				DCEE22061CEB9890000C2396 /* DFGBackwardsCFG.h */,
+				DCEE22071CEB9890000C2396 /* DFGBackwardsDominators.h */,
+				0F714CA116EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.cpp */,
+				0F714CA216EA92ED00F3EBEB /* DFGBackwardsPropagationPhase.h */,
+				A7D89CE317A0B8CC00773AD8 /* DFGBasicBlock.cpp */,
+				0F620170143FCD2F0068B77C /* DFGBasicBlock.h */,
+				0FD5652216AB780A00197653 /* DFGBasicBlockInlines.h */,
+				A7D89CE417A0B8CC00773AD8 /* DFGBlockInsertionSet.cpp */,
+				A7D89CE517A0B8CC00773AD8 /* DFGBlockInsertionSet.h */,
+				0FC3CCF519ADA410006AC72A /* DFGBlockMap.h */,
+				0FC3CCF619ADA410006AC72A /* DFGBlockMapInlines.h */,
+				0FBF158A19B7A53100695DD0 /* DFGBlockSet.cpp */,
+				0FC3CCF719ADA410006AC72A /* DFGBlockSet.h */,
+				0FBF158B19B7A53100695DD0 /* DFGBlockSetInlines.h */,
+				0FC3CCF919ADA410006AC72A /* DFGBlockWorklist.h */,
+				0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */,
+				86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */,
+				86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */,
+				0F256C341627B0AA007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h */,
+				0FBDB9AC1AB0FBC6000B57E5 /* DFGCallCreateDirectArgumentsSlowPathGenerator.h */,
+				0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */,
+				0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */,
+				0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */,
+				0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */,
+				0F3B3A241544C991003ED0FF /* DFGCFGSimplificationPhase.cpp */,
+				0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */,
+				0F9D36921AE9CC33000D4DFB /* DFGCleanUpPhase.cpp */,
+				0F9D36931AE9CC33000D4DFB /* DFGCleanUpPhase.h */,
+				A77A423817A0BBFD00A8DB81 /* DFGClobberize.cpp */,
+				A77A423917A0BBFD00A8DB81 /* DFGClobberize.h */,
+				A77A423A17A0BBFD00A8DB81 /* DFGClobberSet.cpp */,
+				A77A423B17A0BBFD00A8DB81 /* DFGClobberSet.h */,
+				0F3C1F181B868E7900ABB08B /* DFGClobbersExitState.cpp */,
+				0F3C1F191B868E7900ABB08B /* DFGClobbersExitState.h */,
+				0F04396B1B03DC0B009598B7 /* DFGCombinedLiveness.cpp */,
+				0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */,
+				0FB4B51A16B62772003F696B /* DFGCommon.cpp */,
+				0FC0977E1469EBC400CF2442 /* DFGCommon.h */,
+				0FEA0A2D170D40BF00BB722C /* DFGCommonData.cpp */,
+				0FEA0A2E170D40BF00BB722C /* DFGCommonData.h */,
+				0F38B01317CFE75500B144D3 /* DFGCompilationKey.cpp */,
+				0F38B01417CFE75500B144D3 /* DFGCompilationKey.h */,
+				0F38B01517CFE75500B144D3 /* DFGCompilationMode.cpp */,
+				0F38B01617CFE75500B144D3 /* DFGCompilationMode.h */,
+				0F3B3A17153E68EF003ED0FF /* DFGConstantFoldingPhase.cpp */,
+				0F3B3A18153E68EF003ED0FF /* DFGConstantFoldingPhase.h */,
+				0FED67B71B26256D0066CE15 /* DFGConstantHoistingPhase.cpp */,
+				0FED67B81B26256D0066CE15 /* DFGConstantHoistingPhase.h */,
+				DCEE22081CEB9890000C2396 /* DFGControlEquivalenceAnalysis.h */,
+				0FBE0F6B16C1DB010082C5E8 /* DFGCPSRethreadingPhase.cpp */,
+				0FBE0F6C16C1DB010082C5E8 /* DFGCPSRethreadingPhase.h */,
+				A7D89CE617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp */,
+				A7D89CE717A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.h */,
+				0FFFC94D14EF909500C72532 /* DFGCSEPhase.cpp */,
+				0FFFC94E14EF909500C72532 /* DFGCSEPhase.h */,
+				0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */,
+				0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */,
+				0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */,
+				0F8F2B98172F04FD007DBDA5 /* DFGDesiredIdentifiers.h */,
+				0FFC92131B94E83E0071DD66 /* DFGDesiredInferredType.h */,
+				C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */,
+				C2C0F7CC17BBFC5B00464FE4 /* DFGDesiredTransitions.h */,
+				0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */,
+				0FE8534A1723CDA500B618F5 /* DFGDesiredWatchpoints.h */,
+				C2981FD617BAEE4B00A3BC98 /* DFGDesiredWeakReferences.cpp */,
+				C2981FD717BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h */,
+				0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */,
+				0FF427621591A1C9004CB9FF /* DFGDisassembler.h */,
+				0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */,
+				0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */,
+				0FD81AD0154FB4EB00983E72 /* DFGDominators.h */,
+				E322E5A01DA64435006E7709 /* DFGDOMJITPatchpointParams.cpp */,
+				E322E5A11DA64435006E7709 /* DFGDOMJITPatchpointParams.h */,
+				0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */,
+				0FD3C82014115CF800FD81CB /* DFGDriver.cpp */,
+				0FD3C82214115D0E00FD81CB /* DFGDriver.h */,
+				0FB4B51B16B62772003F696B /* DFGEdge.cpp */,
+				0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */,
+				A7D9A29117A0BC7400EE2618 /* DFGEdgeDominates.h */,
+				A7986D5617A0BB1E00A95DD0 /* DFGEdgeUsesStructure.h */,
+				0F8F142F1ADF090100ED792C /* DFGEpoch.cpp */,
+				0F8F14301ADF090100ED792C /* DFGEpoch.h */,
+				A78A976C179738B8009DF744 /* DFGFailedFinalizer.cpp */,
+				A78A976D179738B8009DF744 /* DFGFailedFinalizer.h */,
+				A7BFF3BF179868940002F462 /* DFGFiltrationResult.h */,
+				A78A976E179738B8009DF744 /* DFGFinalizer.cpp */,
+				A78A976F179738B8009DF744 /* DFGFinalizer.h */,
+				0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */,
+				0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */,
+				0F20177D1DCADC3000EA5950 /* DFGFlowIndexing.cpp */,
+				0F20177E1DCADC3000EA5950 /* DFGFlowIndexing.h */,
+				0F2017811DCADD4000EA5950 /* DFGFlowMap.h */,
+				0F9D339417FFC4E60073C2BC /* DFGFlushedAt.cpp */,
+				0F9D339517FFC4E60073C2BC /* DFGFlushedAt.h */,
+				A7D89CE817A0B8CC00773AD8 /* DFGFlushFormat.cpp */,
+				A7D89CE917A0B8CC00773AD8 /* DFGFlushFormat.h */,
+				0F2DD8101AB3D8BE00BBB8E8 /* DFGForAllKills.h */,
+				0F69CC86193AC60A0045759E /* DFGFrozenValue.cpp */,
+				0F69CC87193AC60A0045759E /* DFGFrozenValue.h */,
+				86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */,
+				86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */,
+				86EC9DB81328DF82002B2AD7 /* DFGGraph.h */,
+				0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */,
+				0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */,
+				0FB1765C196B8F9E0091052A /* DFGHeapLocation.cpp */,
+				0FB1765D196B8F9E0091052A /* DFGHeapLocation.h */,
+				0FC841661BA8C3210061837D /* DFGInferredTypeCheck.cpp */,
+				0FC841671BA8C3210061837D /* DFGInferredTypeCheck.h */,
+				0FB14E201812570B009B6B4D /* DFGInlineCacheWrapper.h */,
+				0FB14E2218130955009B6B4D /* DFGInlineCacheWrapperInlines.h */,
+				A704D90017A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp */,
+				A704D90117A0BAA8006BA554 /* DFGInPlaceAbstractState.h */,
+				0F3BD1B61B896A0700598AA6 /* DFGInsertionSet.cpp */,
+				0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */,
+				0F300B7918AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.cpp */,
+				0F300B7A18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h */,
+				0F898F2F1B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.cpp */,
+				0F898F301B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h */,
+				0FC97F3718202119002C9B26 /* DFGInvalidationPointInjectionPhase.cpp */,
+				0FC97F3818202119002C9B26 /* DFGInvalidationPointInjectionPhase.h */,
+				0FEA0A2F170D40BF00BB722C /* DFGJITCode.cpp */,
+				0FEA0A30170D40BF00BB722C /* DFGJITCode.h */,
+				86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */,
+				86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */,
+				A78A9770179738B8009DF744 /* DFGJITFinalizer.cpp */,
+				A78A9771179738B8009DF744 /* DFGJITFinalizer.h */,
+				0FC97F3918202119002C9B26 /* DFGJumpReplacement.cpp */,
+				0FC97F3A18202119002C9B26 /* DFGJumpReplacement.h */,
+				A73A53581799CD5D00170C19 /* DFGLazyJSValue.cpp */,
+				A73A53591799CD5D00170C19 /* DFGLazyJSValue.h */,
+				62A9A29E1B0BED4800BD54CA /* DFGLazyNode.cpp */,
+				62A9A29F1B0BED4800BD54CA /* DFGLazyNode.h */,
+				A7D9A29217A0BC7400EE2618 /* DFGLICMPhase.cpp */,
+				A7D9A29317A0BC7400EE2618 /* DFGLICMPhase.h */,
+				79C4B15B1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp */,
+				79C4B15C1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h */,
+				A7D89CEC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.cpp */,
+				A7D89CED17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h */,
+				0FB4B51C16B62772003F696B /* DFGLongLivedState.cpp */,
+				0FB4B51D16B62772003F696B /* DFGLongLivedState.h */,
+				A767B5B317A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp */,
+				A767B5B417A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h */,
+				79F8FC1C1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp */,
+				79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */,
+				0F5874EB194FEB1200AAB2C1 /* DFGMayExit.cpp */,
+				0F5874EC194FEB1200AAB2C1 /* DFGMayExit.h */,
+				0F1725FE1B48719A00AC3A55 /* DFGMinifiedGraph.cpp */,
+				0F2BDC3D1522801700CD8910 /* DFGMinifiedGraph.h */,
+				0FB4B51016B3A964003F696B /* DFGMinifiedID.h */,
+				0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */,
+				0F2BDC3E1522801700CD8910 /* DFGMinifiedNode.h */,
+				0F8F14311ADF090100ED792C /* DFGMovHintRemovalPhase.cpp */,
+				0F8F14321ADF090100ED792C /* DFGMovHintRemovalPhase.h */,
+				0FF2CD591B61A4F8004955A8 /* DFGMultiGetByOffsetData.cpp */,
+				0FF2CD5A1B61A4F8004955A8 /* DFGMultiGetByOffsetData.h */,
+				A737810A1799EA2E00817533 /* DFGNaturalLoops.cpp */,
+				A737810B1799EA2E00817533 /* DFGNaturalLoops.h */,
+				0FB4B51E16B62772003F696B /* DFGNode.cpp */,
+				86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */,
+				0F2017871DCB942200EA5950 /* DFGNodeAbstractValuePair.cpp */,
+				0F2017881DCB942200EA5950 /* DFGNodeAbstractValuePair.h */,
+				0FB4B51F16B62772003F696B /* DFGNodeAllocator.h */,
+				0FA581B7150E952A00B9A2D9 /* DFGNodeFlags.cpp */,
+				0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */,
+				0F2017831DCAE14700EA5950 /* DFGNodeFlowProjection.cpp */,
+				0F2017841DCAE14700EA5950 /* DFGNodeFlowProjection.h */,
+				0F5D085C1B8CF99D001143B4 /* DFGNodeOrigin.cpp */,
+				0F300B7718AB051100A6D72E /* DFGNodeOrigin.h */,
+				0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */,
+				DCEE220C1CEBAF73000C2396 /* DFGNullAbstractState.h */,
+				0F2B9CDA19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp */,
+				0F2B9CDB19D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h */,
+				0F2B9CDC19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp */,
+				0F2B9CDD19D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h */,
+				86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */,
+				86EC9DC01328DF82002B2AD7 /* DFGOperations.h */,
+				0F7C39FE1C90C55B00480151 /* DFGOpInfo.h */,
+				A7D89CEE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.cpp */,
+				A7D89CEF17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h */,
+				0FD82E52141DAEDE00179C94 /* DFGOSREntry.cpp */,
+				0FD82E53141DAEDE00179C94 /* DFGOSREntry.h */,
+				0FD8A31D17D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.cpp */,
+				0FD8A31E17D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h */,
+				0FC0978E146A6F6300CF2442 /* DFGOSRExit.cpp */,
+				0FC097681468A6EF00CF2442 /* DFGOSRExit.h */,
+				0F235BE717178E7300690C7F /* DFGOSRExitBase.cpp */,
+				0F235BE817178E7300690C7F /* DFGOSRExitBase.h */,
+				65987F2C167FE84B003C2F8D /* DFGOSRExitCompilationInfo.h */,
+				0FC0978F146A6F6300CF2442 /* DFGOSRExitCompiler.cpp */,
+				0FC0976F14693AEF00CF2442 /* DFGOSRExitCompiler.h */,
+				0FC09775146943AD00CF2442 /* DFGOSRExitCompiler32_64.cpp */,
+				0FC0977014693AEF00CF2442 /* DFGOSRExitCompiler64.cpp */,
+				0F7025A71714B0F800382C0E /* DFGOSRExitCompilerCommon.cpp */,
+				0F7025A81714B0F800382C0E /* DFGOSRExitCompilerCommon.h */,
+				0F392C871B46188400844728 /* DFGOSRExitFuzz.cpp */,
+				0F392C881B46188400844728 /* DFGOSRExitFuzz.h */,
+				0FEFC9A71681A3B000567F53 /* DFGOSRExitJumpPlaceholder.cpp */,
+				0FEFC9A81681A3B000567F53 /* DFGOSRExitJumpPlaceholder.h */,
+				0F235BE917178E7300690C7F /* DFGOSRExitPreparation.cpp */,
+				0F235BEA17178E7300690C7F /* DFGOSRExitPreparation.h */,
+				0F6237951AE45CA700D402EA /* DFGPhantomInsertionPhase.cpp */,
+				0F6237961AE45CA700D402EA /* DFGPhantomInsertionPhase.h */,
+				0FFFC94F14EF909500C72532 /* DFGPhase.cpp */,
+				0FFFC95014EF909500C72532 /* DFGPhase.h */,
+				0F2B9CDE19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp */,
+				0F2B9CDF19D0BA7D00B1D1B5 /* DFGPhiChildren.h */,
+				A78A9772179738B8009DF744 /* DFGPlan.cpp */,
+				A78A9773179738B8009DF744 /* DFGPlan.h */,
+				0F1FB3941E1AF7DF00A9BE50 /* DFGPlanInlines.h */,
+				DC00039019D8BE6F00023EB0 /* DFGPreciseLocalClobberize.h */,
+				0FBE0F6D16C1DB010082C5E8 /* DFGPredictionInjectionPhase.cpp */,
+				0FBE0F6E16C1DB010082C5E8 /* DFGPredictionInjectionPhase.h */,
+				0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */,
+				0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */,
+				0F3E01A819D353A500F61B7F /* DFGPrePostNumbering.cpp */,
+				0F3E01A919D353A500F61B7F /* DFGPrePostNumbering.h */,
+				0F2B9CE019D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp */,
+				0F2B9CE119D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h */,
+				0FFC92151B94FB3E0071DD66 /* DFGPropertyTypeKey.h */,
+				0FB1765E196B8F9E0091052A /* DFGPureValue.cpp */,
+				0FB1765F196B8F9E0091052A /* DFGPureValue.h */,
+				0F3A1BF71A9ECB7D000DE01A /* DFGPutStackSinkingPhase.cpp */,
+				0F3A1BF81A9ECB7D000DE01A /* DFGPutStackSinkingPhase.h */,
+				79FC8A071E32E9F000D88F0E /* DFGRegisteredStructure.h */,
+				7980C16A1E3A940E00B71615 /* DFGRegisteredStructureSet.cpp */,
+				7980C16B1E3A940E00B71615 /* DFGRegisteredStructureSet.h */,
+				86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
+				0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */,
+				0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */,
+				A77A423C17A0BBFD00A8DB81 /* DFGSafeToExecute.h */,
+				A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */,
+				0F2FCCF618A60070001A27F8 /* DFGScannable.h */,
+				86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */,
+				0F1E3A65153A21DF000F9456 /* DFGSilentRegisterSavePlan.h */,
+				0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */,
+				86EC9DC21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp */,
+				86EC9DC31328DF82002B2AD7 /* DFGSpeculativeJIT.h */,
+				86880F1B14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp */,
+				86880F4C14353B2100B08D42 /* DFGSpeculativeJIT64.cpp */,
+				0F682FB019BCB36400FA3BAD /* DFGSSACalculator.cpp */,
+				0F682FB119BCB36400FA3BAD /* DFGSSACalculator.h */,
+				A7D89CF017A0B8CC00773AD8 /* DFGSSAConversionPhase.cpp */,
+				A7D89CF117A0B8CC00773AD8 /* DFGSSAConversionPhase.h */,
+				0FC20CB718556A3500C9E954 /* DFGSSALoweringPhase.cpp */,
+				0FC20CB818556A3500C9E954 /* DFGSSALoweringPhase.h */,
+				0F9FB4F217FCB91700CB67F8 /* DFGStackLayoutPhase.cpp */,
+				0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */,
+				0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */,
+				0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */,
+				0F7F98891D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.cpp */,
+				0F7F988A1D9596C300F4F12E /* DFGStoreBarrierClusteringPhase.h */,
+				0F9E32611B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.cpp */,
+				0F9E32621B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h */,
+				0FC20CB31852E2C600C9E954 /* DFGStrengthReductionPhase.cpp */,
+				0FC20CB41852E2C600C9E954 /* DFGStrengthReductionPhase.h */,
+				0F893BDA1936E23C001211F4 /* DFGStructureAbstractValue.cpp */,
+				0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */,
+				0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */,
+				0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */,
+				0F2FCCF818A60070001A27F8 /* DFGThreadData.h */,
+				0FC0979F146B28C700CF2442 /* DFGThunks.cpp */,
+				0FC097A0146B28C700CF2442 /* DFGThunks.h */,
+				0FD8A31F17D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.cpp */,
+				0FD8A32017D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.h */,
+				0FD8A32117D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.cpp */,
+				0FD8A32217D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.h */,
+				0FD8A32317D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.cpp */,
+				0FD8A32417D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.h */,
+				0FE7211B193B9C590031F6ED /* DFGTransition.cpp */,
+				0FE7211C193B9C590031F6ED /* DFGTransition.h */,
+				0F63943C15C75F14006A597C /* DFGTypeCheckHoistingPhase.cpp */,
+				0F63943D15C75F14006A597C /* DFGTypeCheckHoistingPhase.h */,
+				0FBE0F6F16C1DB010082C5E8 /* DFGUnificationPhase.cpp */,
+				0FBE0F7016C1DB010082C5E8 /* DFGUnificationPhase.h */,
+				0F34B14716D4200E001CDA5A /* DFGUseKind.cpp */,
+				0F34B14816D4200E001CDA5A /* DFGUseKind.h */,
+				0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */,
+				0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */,
+				0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */,
+				0F2BDC401522801700CD8910 /* DFGValueSource.h */,
+				0F0123301944EA1B00843A0C /* DFGValueStrength.cpp */,
+				0F0123311944EA1B00843A0C /* DFGValueStrength.h */,
+				0FE254F41ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.cpp */,
+				0FE254F51ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.h */,
+				0F6E845919030BEF00562741 /* DFGVariableAccessData.cpp */,
+				0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */,
+				0FDDBFB21666EED500C55FEF /* DFGVariableAccessDataDump.cpp */,
+				0FDDBFB31666EED500C55FEF /* DFGVariableAccessDataDump.h */,
+				0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */,
+				0F2BDC411522801700CD8910 /* DFGVariableEvent.h */,
+				0F2BDC421522801700CD8910 /* DFGVariableEventStream.cpp */,
+				0F2BDC431522801700CD8910 /* DFGVariableEventStream.h */,
+				0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */,
+				0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */,
+				0FC97F3B18202119002C9B26 /* DFGWatchpointCollectionPhase.cpp */,
+				0FC97F3C18202119002C9B26 /* DFGWatchpointCollectionPhase.h */,
+				0FDB2CE5174830A2007B3C1B /* DFGWorklist.cpp */,
+				0FDB2CE6174830A2007B3C1B /* DFGWorklist.h */,
+				0F1FB3951E1AF7DF00A9BE50 /* DFGWorklistInlines.h */,
+			);
+			name = dfg;
+			sourceTree = "<group>";
+		};
+		932FC3C20824BB70005B3C75 /* Resources */ = {
+			isa = PBXGroup;
+			children = (
+				A53F1ABE18C90EC70072EB6D /* framework.sb */,
+				932F5BD80822A1C700736975 /* Info.plist */,
+			);
+			name = Resources;
+			sourceTree = "<group>";
+			tabWidth = 4;
+			usesTabs = 0;
+		};
+		95AB831A0DA42C6900BC83F3 /* profiler */ = {
+			isa = PBXGroup;
+			children = (
+				0FF72992166AD347000F5BA3 /* ProfilerBytecode.cpp */,
+				0FF72993166AD347000F5BA3 /* ProfilerBytecode.h */,
+				0FF72994166AD347000F5BA3 /* ProfilerBytecodes.cpp */,
+				0FF72995166AD347000F5BA3 /* ProfilerBytecodes.h */,
+				0F13912416771C30009CCB07 /* ProfilerBytecodeSequence.cpp */,
+				0F13912516771C30009CCB07 /* ProfilerBytecodeSequence.h */,
+				0FF72996166AD347000F5BA3 /* ProfilerCompilation.cpp */,
+				0FF72997166AD347000F5BA3 /* ProfilerCompilation.h */,
+				0FF72998166AD347000F5BA3 /* ProfilerCompilationKind.cpp */,
+				0FF72999166AD347000F5BA3 /* ProfilerCompilationKind.h */,
+				0FF7299A166AD347000F5BA3 /* ProfilerCompiledBytecode.cpp */,
+				0FF7299B166AD347000F5BA3 /* ProfilerCompiledBytecode.h */,
+				0FF7299C166AD347000F5BA3 /* ProfilerDatabase.cpp */,
+				0FF7299D166AD347000F5BA3 /* ProfilerDatabase.h */,
+				DC605B591CE26E9800593718 /* ProfilerEvent.cpp */,
+				DC605B5A1CE26E9800593718 /* ProfilerEvent.h */,
+				0FF7299E166AD347000F5BA3 /* ProfilerExecutionCounter.h */,
+				0F190CAA189D82F6000AE5F0 /* ProfilerJettisonReason.cpp */,
+				0F190CAB189D82F6000AE5F0 /* ProfilerJettisonReason.h */,
+				0FF7299F166AD347000F5BA3 /* ProfilerOrigin.cpp */,
+				0FF729A0166AD347000F5BA3 /* ProfilerOrigin.h */,
+				0FF729A1166AD347000F5BA3 /* ProfilerOriginStack.cpp */,
+				0FF729A2166AD347000F5BA3 /* ProfilerOriginStack.h */,
+				0FB105871675482E00F8AB6E /* ProfilerOSRExit.cpp */,
+				0FB105881675482E00F8AB6E /* ProfilerOSRExit.h */,
+				0FB105891675482E00F8AB6E /* ProfilerOSRExitSite.cpp */,
+				0FB1058A1675482E00F8AB6E /* ProfilerOSRExitSite.h */,
+				0F13912616771C30009CCB07 /* ProfilerProfiledBytecodes.cpp */,
+				0F13912716771C30009CCB07 /* ProfilerProfiledBytecodes.h */,
+				DC605B5B1CE26E9800593718 /* ProfilerUID.cpp */,
+				DC605B5C1CE26E9800593718 /* ProfilerUID.h */,
+			);
+			name = profiler;
+			sourceTree = "<group>";
+			usesTabs = 0;
+		};
+		9688CB120ED12B4E001D649F /* assembler */ = {
+			isa = PBXGroup;
+			children = (
+				0F1FE51B1922A3BC006987C5 /* AbortReason.h */,
+				860161DF0F3A83C100F84710 /* AbstractMacroAssembler.h */,
+				0F3730901C0CD70C00052BFA /* AllowMacroScratchRegisterUsage.h */,
+				8640923B156EED3B00566CB2 /* ARM64Assembler.h */,
+				86D3B2BF10156BDE002865E7 /* ARMAssembler.cpp */,
+				86D3B2C010156BDE002865E7 /* ARMAssembler.h */,
+				86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */,
+				9688CB130ED12B4E001D649F /* AssemblerBuffer.h */,
+				86D3B2C110156BDE002865E7 /* AssemblerBufferWithConstantPool.h */,
+				43C392AA1C3BEB0000241F53 /* AssemblerCommon.h */,
+				86E116B00FE75AC800B512BC /* CodeLocation.h */,
+				0F30D7BF1D95D62F0053089D /* CPU.h */,
+				0F37308E1C0CD68500052BFA /* DisallowMacroScratchRegisterUsage.h */,
+				0FF4275615914A20004CB9FF /* LinkBuffer.cpp */,
+				86D3B3C110159D7F002865E7 /* LinkBuffer.h */,
+				0FEB3ECE16237F6700AB67AD /* MacroAssembler.cpp */,
+				86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */,
+				86C568DD11A213EE0007F7F0 /* MacroAssemblerARM.cpp */,
+				86D3B2C210156BDE002865E7 /* MacroAssemblerARM.h */,
+				FEB137561BB11EEE00CD5100 /* MacroAssemblerARM64.cpp */,
+				8640923C156EED3B00566CB2 /* MacroAssemblerARM64.h */,
+				A729009B17976C6000317298 /* MacroAssemblerARMv7.cpp */,
+				86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */,
+				0F6DB7EB1D617D0F00CDBF8E /* MacroAssemblerCodeRef.cpp */,
+				863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */,
+				E380A76B1DCD7195000F89E6 /* MacroAssemblerHelpers.h */,
+				86C568DE11A213EE0007F7F0 /* MacroAssemblerMIPS.h */,
+				FE68C6351B90DDD90042BCB3 /* MacroAssemblerPrinter.cpp */,
+				FE68C6361B90DDD90042BCB3 /* MacroAssemblerPrinter.h */,
+				86AE64A6135E5E1C00963012 /* MacroAssemblerSH4.h */,
+				860161E00F3A83C100F84710 /* MacroAssemblerX86.h */,
+				860161E10F3A83C100F84710 /* MacroAssemblerX86_64.h */,
+				A7A4AE0717973B26005612B1 /* MacroAssemblerX86Common.cpp */,
+				860161E20F3A83C100F84710 /* MacroAssemblerX86Common.h */,
+				65860177185A8F5E00030EEE /* MaxFrameExtentForSlowPathCall.h */,
+				86C568DF11A213EE0007F7F0 /* MIPSAssembler.h */,
+				86AE64A7135E5E1C00963012 /* SH4Assembler.h */,
+				9688CB140ED12B4E001D649F /* X86Assembler.h */,
+			);
+			path = assembler;
+			sourceTree = "<group>";
+		};
+		969A078F0ED1D3AE00F1F681 /* bytecode */ = {
+			isa = PBXGroup;
+			children = (
+				5370B4F31BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.cpp */,
+				5370B4F41BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h */,
+				79A228331D35D71E00D8E067 /* ArithProfile.cpp */,
+				79A228341D35D71E00D8E067 /* ArithProfile.h */,
+				0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */,
+				0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */,
+				0F63945115D07051006A597C /* ArrayProfile.cpp */,
+				0F63945215D07051006A597C /* ArrayProfile.h */,
+				C2FCAE0C17A9C24E0034C735 /* BytecodeBasicBlock.cpp */,
+				C2FCAE0D17A9C24E0034C735 /* BytecodeBasicBlock.h */,
+				0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */,
+				E3D264261D38C042000BE174 /* BytecodeGeneratorification.cpp */,
+				E3D264271D38C042000BE174 /* BytecodeGeneratorification.h */,
+				E3D264281D38C042000BE174 /* BytecodeGraph.h */,
+				7094C4DC1AE439530041A2EE /* BytecodeIntrinsicRegistry.cpp */,
+				7094C4DD1AE439530041A2EE /* BytecodeIntrinsicRegistry.h */,
+				0F2DD80A1AB3D85800BBB8E8 /* BytecodeKills.h */,
+				6529FB3118B2D99900C61102 /* BytecodeList.json */,
+				C2FCAE0E17A9C24E0034C735 /* BytecodeLivenessAnalysis.cpp */,
+				C2FCAE0F17A9C24E0034C735 /* BytecodeLivenessAnalysis.h */,
+				0F666EBE183566F900D017F1 /* BytecodeLivenessAnalysisInlines.h */,
+				E3D264291D38C042000BE174 /* BytecodeRewriter.cpp */,
+				E3D2642A1D38C042000BE174 /* BytecodeRewriter.h */,
+				0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */,
+				0F8023E91613832300A0BA45 /* ByValInfo.h */,
+				0F64B2771A7957B2006E4E66 /* CallEdge.cpp */,
+				0F64B2781A7957B2006E4E66 /* CallEdge.h */,
+				0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */,
+				0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */,
+				0F93329314CA7DC10085F3C6 /* CallLinkStatus.cpp */,
+				0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */,
+				627673211B680C1E00FD9F2E /* CallMode.cpp */,
+				627673221B680C1E00FD9F2E /* CallMode.h */,
+				0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */,
+				0F3B7E2419A11B8000D9BC56 /* CallVariant.cpp */,
+				0F3B7E2519A11B8000D9BC56 /* CallVariant.h */,
+				969A07900ED1D3AE00F1F681 /* CodeBlock.cpp */,
+				969A07910ED1D3AE00F1F681 /* CodeBlock.h */,
+				0F8F943D1667632D00D61971 /* CodeBlockHash.cpp */,
+				0F8F943E1667632D00D61971 /* CodeBlockHash.h */,
+				0FC97F2F182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.cpp */,
+				0FC97F30182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.h */,
+				0F96EBB116676EF4008BADE3 /* CodeBlockWithJITType.h */,
+				0F8F9445166764EE00D61971 /* CodeOrigin.cpp */,
+				0FBD7E671447998F00481315 /* CodeOrigin.h */,
+				0F8F943F1667632D00D61971 /* CodeType.cpp */,
+				0F0B83A514BCF50400885B4F /* CodeType.h */,
+				0F6FC74E196110A800E1D02D /* ComplexGetStatus.cpp */,
+				0F6FC74F196110A800E1D02D /* ComplexGetStatus.h */,
+				62E3D5EF1B8D0B7300B868BB /* DataFormat.cpp */,
+				0F426A4A1460CD6B00131F8F /* DataFormat.h */,
+				0FC712DC17CD8778008CC93C /* DeferredCompilationCallback.cpp */,
+				0FC712DD17CD8778008CC93C /* DeferredCompilationCallback.h */,
+				FE5068661AE25E280009DAB7 /* DeferredSourceDump.cpp */,
+				FE5068641AE246390009DAB7 /* DeferredSourceDump.h */,
+				0FBC0AE41496C7C100D4FBDD /* DFGExitProfile.cpp */,
+				0FBC0AE51496C7C100D4FBDD /* DFGExitProfile.h */,
+				0F2EBBAA1DEDF94E00990369 /* DirectEvalCodeCache.cpp */,
+				969A07920ED1D3AE00F1F681 /* DirectEvalCodeCache.h */,
+				E3BFD0B91DAF807C0065DEA2 /* DOMJITAccessCasePatchpointParams.cpp */,
+				E3BFD0BA1DAF807C0065DEA2 /* DOMJITAccessCasePatchpointParams.h */,
+				14AD91121DCA97FD0014F9FE /* EvalCodeBlock.cpp */,
+				14AD91061DCA92940014F9FE /* EvalCodeBlock.h */,
+				14142E521B796EDD00F4BF4B /* ExecutableInfo.h */,
+				0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */,
+				0F56A1D115000F31002992B1 /* ExecutionCounter.h */,
+				0F0332BF18ADFAE1005F979A /* ExitingJITType.cpp */,
+				0F3AC753188E5EC80032029F /* ExitingJITType.h */,
+				0FB105821675480C00F8AB6E /* ExitKind.cpp */,
+				0FB105831675480C00F8AB6E /* ExitKind.h */,
+				0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */,
+				0F666EBF183566F900D017F1 /* FullBytecodeLiveness.h */,
+				14AD91161DCA97FD0014F9FE /* FunctionCodeBlock.cpp */,
+				14AD91071DCA92940014F9FE /* FunctionCodeBlock.h */,
+				0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */,
+				0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */,
+				0F0332C118B01763005F979A /* GetByIdVariant.cpp */,
+				0F0332C218B01763005F979A /* GetByIdVariant.h */,
+				14AD91081DCA92940014F9FE /* GlobalCodeBlock.h */,
+				0F0B83A814BCF55E00885B4F /* HandlerInfo.h */,
+				7905BB661D12050E0019FE57 /* InlineAccess.cpp */,
+				7905BB671D12050E0019FE57 /* InlineAccess.h */,
+				148A7BED1B82975A002D9157 /* InlineCallFrame.cpp */,
+				148A7BEE1B82975A002D9157 /* InlineCallFrame.h */,
+				0F24E55317F0B71C00ABB217 /* InlineCallFrameSet.cpp */,
+				0F24E55417F0B71C00ABB217 /* InlineCallFrameSet.h */,
+				969A07930ED1D3AE00F1F681 /* Instruction.h */,
+				53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */,
+				BCFD8C900EEB2EE700283848 /* JumpTable.cpp */,
+				BCFD8C910EEB2EE700283848 /* JumpTable.h */,
+				0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */,
+				0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */,
+				0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */,
+				53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */,
+				53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */,
+				0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */,
+				0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */,
+				14AD91131DCA97FD0014F9FE /* ModuleProgramCodeBlock.cpp */,
+				14AD91091DCA92940014F9FE /* ModuleProgramCodeBlock.h */,
+				14CA958C16AB50FA00938A06 /* ObjectAllocationProfile.h */,
+				0FD3E4031B618B6600C80E1E /* ObjectPropertyCondition.cpp */,
+				0FD3E4041B618B6600C80E1E /* ObjectPropertyCondition.h */,
+				0FD3E4051B618B6600C80E1E /* ObjectPropertyConditionSet.cpp */,
+				0FD3E4061B618B6600C80E1E /* ObjectPropertyConditionSet.h */,
+				969A07940ED1D3AE00F1F681 /* Opcode.cpp */,
+				969A07950ED1D3AE00F1F681 /* Opcode.h */,
+				0F2BDC2B151FDE8B00CD8910 /* Operands.h */,
+				A70447E917A0BD4600F5898E /* OperandsInlines.h */,
+				0FF9CE711B9CD6D0004EDCA6 /* PolymorphicAccess.cpp */,
+				0FF9CE721B9CD6D0004EDCA6 /* PolymorphicAccess.h */,
+				0F98205D16BFE37F00240D02 /* PreciseJumpTargets.cpp */,
+				0F98205E16BFE37F00240D02 /* PreciseJumpTargets.h */,
+				E3A421421D6F588F0007C617 /* PreciseJumpTargetsInlines.h */,
+				14AD91141DCA97FD0014F9FE /* ProgramCodeBlock.cpp */,
+				14AD910A1DCA92940014F9FE /* ProgramCodeBlock.h */,
+				0FD3E4071B618B6600C80E1E /* PropertyCondition.cpp */,
+				0FD3E4081B618B6600C80E1E /* PropertyCondition.h */,
+				0F15CD201BA5F9860031FFD3 /* PutByIdFlags.cpp */,
+				0F15CD211BA5F9860031FFD3 /* PutByIdFlags.h */,
+				0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */,
+				0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */,
+				0F93B4A718B92C4D00178A3F /* PutByIdVariant.cpp */,
+				0F93B4A818B92C4D00178A3F /* PutByIdVariant.h */,
+				0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */,
+				0FF60ABF16740F8100029779 /* ReduceWhitespace.cpp */,
+				0FF60AC016740F8100029779 /* ReduceWhitespace.h */,
+				0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */,
+				0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */,
+				0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */,
+				0FD82E4F141DAEA100179C94 /* SpeculatedType.h */,
+				0FB438A219270B1D00E1FBC9 /* StructureSet.cpp */,
+				0F93329B14CA7DC10085F3C6 /* StructureSet.h */,
+				0F766D3615AE4A1A008F363E /* StructureStubClearingWatchpoint.cpp */,
+				0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */,
+				BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */,
+				BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */,
+				0F4A38F71C8E13DF00190318 /* SuperSampler.cpp */,
+				0F4A38F81C8E13DF00190318 /* SuperSampler.h */,
+				0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */,
+				0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */,
+				0F952ABA1B487A7700C367C5 /* TrackedReferences.cpp */,
+				0F952ABB1B487A7700C367C5 /* TrackedReferences.h */,
+				0F2D4DE719832DAC007D4B19 /* TypeLocation.h */,
+				A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */,
+				A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */,
+				14AD91281DCAAAB00014F9FE /* UnlinkedEvalCodeBlock.cpp */,
+				14AD911E1DCA9FA40014F9FE /* UnlinkedEvalCodeBlock.h */,
+				14AD912B1DCAAAB00014F9FE /* UnlinkedFunctionCodeBlock.cpp */,
+				14AD911D1DCA9FA40014F9FE /* UnlinkedFunctionCodeBlock.h */,
+				14142E541B7973C000F4BF4B /* UnlinkedFunctionExecutable.cpp */,
+				14AD91211DCA9FA40014F9FE /* UnlinkedFunctionExecutable.h */,
+				14142E501B796ECE00F4BF4B /* UnlinkedFunctionExecutable.h */,
+				14AD911C1DCA9FA40014F9FE /* UnlinkedGlobalCodeBlock.h */,
+				B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */,
+				B59F89371891AD3300D5CCDC /* UnlinkedInstructionStream.h */,
+				14AD912A1DCAAAB00014F9FE /* UnlinkedModuleProgramCodeBlock.cpp */,
+				14AD911F1DCA9FA40014F9FE /* UnlinkedModuleProgramCodeBlock.h */,
+				14AD91291DCAAAB00014F9FE /* UnlinkedProgramCodeBlock.cpp */,
+				14AD91201DCA9FA40014F9FE /* UnlinkedProgramCodeBlock.h */,
+				0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */,
+				0F24E55717F74EDB00ABB217 /* ValueRecovery.cpp */,
+				0F426A451460CBAB00131F8F /* ValueRecovery.h */,
+				0F6C734E1AC9F99F00BE1682 /* VariableWriteFireDetail.cpp */,
+				0F6C734F1AC9F99F00BE1682 /* VariableWriteFireDetail.h */,
+				0F20C2581A8013AB00DA3229 /* VirtualRegister.cpp */,
+				0F426A461460CBAB00131F8F /* VirtualRegister.h */,
+				0F919D2215853CDE004A4E7D /* Watchpoint.cpp */,
+				0F919D2315853CDE004A4E7D /* Watchpoint.h */,
+			);
+			path = bytecode;
+			sourceTree = "<group>";
+		};
+		9959E9251BD17F1E001AA413 /* Scripts */ = {
+			isa = PBXGroup;
+			children = (
+				99DA00971BD598E000F4575C /* builtins */,
+				9959E9271BD17FA0001AA413 /* cssmin.py */,
+				9959E92F1BD181F6001AA413 /* generate-combined-inspector-json.py */,
+				99DA00AC1BD5993E00F4575C /* generate-js-builtins.py */,
+				9959E9301BD181F6001AA413 /* inline-and-minify-stylesheets-and-scripts.py */,
+				9959E9291BD17FA0001AA413 /* jsmin.py */,
+				99DA00AD1BD5993E00F4575C /* lazywriter.py */,
+				99DA00AE1BD5993E00F4575C /* UpdateContents.py */,
+				9959E92A1BD17FA0001AA413 /* xxd.pl */,
+			);
+			path = Scripts;
+			sourceTree = "<group>";
+		};
+		99DA00971BD598E000F4575C /* builtins */ = {
+			isa = PBXGroup;
+			children = (
+				99DA00991BD5992700F4575C /* __init__.py */,
+				99DA009D1BD5992700F4575C /* builtins.py */,
+				99DA009E1BD5992700F4575C /* builtins_generate_combined_header.py */,
+				99DA009F1BD5992700F4575C /* builtins_generate_combined_implementation.py */,
+				412952731D2CF6AC00E78B89 /* builtins_generate_internals_wrapper_header.py */,
+				412952741D2CF6AC00E78B89 /* builtins_generate_internals_wrapper_implementation.py */,
+				99DA00A01BD5992700F4575C /* builtins_generate_separate_header.py */,
+				99DA00A11BD5992700F4575C /* builtins_generate_separate_implementation.py */,
+				412952751D2CF6AC00E78B89 /* builtins_generate_wrapper_header.py */,
+				412952761D2CF6AC00E78B89 /* builtins_generate_wrapper_implementation.py */,
+				99DA009A1BD5992700F4575C /* builtins_generator.py */,
+				99DA009B1BD5992700F4575C /* builtins_model.py */,
+				99DA009C1BD5992700F4575C /* builtins_templates.py */,
+			);
+			path = builtins;
+			sourceTree = "<group>";
+		};
+		99E45A0C18A01E930026D88F /* replay */ = {
+			isa = PBXGroup;
+			children = (
+				99E45A1C18A1B1B80026D88F /* scripts */,
+				99E45A1F18A1B2590026D88F /* EmptyInputCursor.h */,
+				99E45A2018A1B2590026D88F /* EncodedValue.cpp */,
+				99E45A2118A1B2590026D88F /* EncodedValue.h */,
+				99E45A2218A1B2590026D88F /* InputCursor.h */,
+				9928FF3D18AC4B1C00B8CF12 /* JSInputs.json */,
+				99E45A2318A1B2590026D88F /* NondeterministicInput.h */,
+			);
+			path = replay;
+			sourceTree = "<group>";
+		};
+		99E45A1C18A1B1B80026D88F /* scripts */ = {
+			isa = PBXGroup;
+			children = (
+				99E45A1D18A1B1E70026D88F /* CodeGeneratorReplayInputs.py */,
+				99E45A1E18A1B1E70026D88F /* CodeGeneratorReplayInputsTemplates.py */,
+			);
+			path = scripts;
+			sourceTree = "<group>";
+		};
+		A513E5CC185FB992007E95AD /* agents */ = {
+			isa = PBXGroup;
+			children = (
+				A5CEEE12187F3BAD00E55C99 /* InspectorAgent.cpp */,
+				A5CEEE13187F3BAD00E55C99 /* InspectorAgent.h */,
+				A5FD007F189B191A00633231 /* InspectorConsoleAgent.cpp */,
+				A5FD0080189B191A00633231 /* InspectorConsoleAgent.h */,
+				A57D23E31890CEBF0031C7FA /* InspectorDebuggerAgent.cpp */,
+				A57D23E41890CEBF0031C7FA /* InspectorDebuggerAgent.h */,
+				A5339EC41BB399900054F005 /* InspectorHeapAgent.cpp */,
+				A5339EC51BB399900054F005 /* InspectorHeapAgent.h */,
+				A50E4B5D18809DD50068A46D /* InspectorRuntimeAgent.cpp */,
+				A50E4B5E18809DD50068A46D /* InspectorRuntimeAgent.h */,
+				A55165D01BDEFDBD003B75C1 /* InspectorScriptProfilerAgent.cpp */,
+				A55165D11BDEFDBD003B75C1 /* InspectorScriptProfilerAgent.h */,
+				A5FD0083189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp */,
+				A5FD0084189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h */,
+				A57D23E71891B0770031C7FA /* JSGlobalObjectDebuggerAgent.cpp */,
+				A57D23E81891B0770031C7FA /* JSGlobalObjectDebuggerAgent.h */,
+				A50E4B5F18809DD50068A46D /* JSGlobalObjectRuntimeAgent.cpp */,
+				A50E4B6018809DD50068A46D /* JSGlobalObjectRuntimeAgent.h */,
+			);
+			path = agents;
+			sourceTree = "<group>";
+		};
+		A532438E185696CE002ED692 /* scripts */ = {
+			isa = PBXGroup;
+			children = (
+				C4703CC1192844A40013FBEA /* codegen */,
+				C4703CBF192844960013FBEA /* generate-inspector-protocol-bindings.py */,
+			);
+			path = scripts;
+			sourceTree = "<group>";
+		};
+		A54CF2EA184EA73900237F19 /* bindings */ = {
+			isa = PBXGroup;
+			children = (
+				A55D93A3185012A800400DED /* ScriptFunctionCall.cpp */,
+				A55D93A4185012A800400DED /* ScriptFunctionCall.h */,
+				A54CF2F7184EAEDA00237F19 /* ScriptObject.cpp */,
+				A54CF2F8184EAEDA00237F19 /* ScriptObject.h */,
+				A54CF2F2184EAB2400237F19 /* ScriptValue.cpp */,
+				A54CF2F3184EAB2400237F19 /* ScriptValue.h */,
+			);
+			path = bindings;
+			sourceTree = "<group>";
+		};
+		A5BA15DF1823409200A82E69 /* inspector */ = {
+			isa = PBXGroup;
+			children = (
+				A513E5CC185FB992007E95AD /* agents */,
+				A5EA70E319F5B0E20098F5EC /* augmentable */,
+				A532438D185696CA002ED692 /* protocol */,
+				A5BA15E01823409D00A82E69 /* remote */,
+				A532438E185696CE002ED692 /* scripts */,
+				6A38CFA71E32B58B0060206F /* AsyncStackTrace.cpp */,
+				6A38CFA81E32B58B0060206F /* AsyncStackTrace.h */,
+				A5FD0077189B051000633231 /* ConsoleMessage.cpp */,
+				A5FD0078189B051000633231 /* ConsoleMessage.h */,
+				A57D23EF1891B5B40031C7FA /* ContentSearchUtilities.cpp */,
+				A57D23F01891B5B40031C7FA /* ContentSearchUtilities.h */,
+				A54982011891D0B00081E5B8 /* EventLoop.cpp */,
+				A54982021891D0B00081E5B8 /* EventLoop.h */,
+				A5FD0072189B038C00633231 /* IdentifiersFactory.cpp */,
+				A5FD0073189B038C00633231 /* IdentifiersFactory.h */,
+				A513E5B5185B8BD3007E95AD /* InjectedScript.cpp */,
+				A513E5B6185B8BD3007E95AD /* InjectedScript.h */,
+				A514B2C0185A684400F3C7CB /* InjectedScriptBase.cpp */,
+				A514B2C1185A684400F3C7CB /* InjectedScriptBase.h */,
+				A58E35901860DEC7001F24FE /* InjectedScriptHost.cpp */,
+				A513E5B9185BFACC007E95AD /* InjectedScriptHost.h */,
+				A513E5C8185F9624007E95AD /* InjectedScriptManager.cpp */,
+				A513E5C9185F9624007E95AD /* InjectedScriptManager.h */,
+				A5840E1E187B7B8600843B10 /* InjectedScriptModule.cpp */,
+				A5840E1F187B7B8600843B10 /* InjectedScriptModule.h */,
+				A513E5C3185F92C9007E95AD /* InjectedScriptSource.js */,
+				A593CF7E1840362C00BFCE27 /* InspectorAgentBase.h */,
+				A593CF84184038CA00BFCE27 /* InspectorAgentRegistry.cpp */,
+				A593CF85184038CA00BFCE27 /* InspectorAgentRegistry.h */,
+				A593CF7A1840360300BFCE27 /* InspectorBackendDispatcher.cpp */,
+				A593CF7B1840360300BFCE27 /* InspectorBackendDispatcher.h */,
+				A5D0A1BA1862301B00C7B496 /* InspectorEnvironment.h */,
+				A5945594182479EB00CC3843 /* InspectorFrontendChannel.h */,
+				99F1A6FC1B8E6D9400463B26 /* InspectorFrontendRouter.cpp */,
+				99F1A7001B98FBEC00463B26 /* InspectorFrontendRouter.h */,
+				A55D93AB18514F7900400DED /* InspectorProtocolTypes.h */,
+				A593CF801840377100BFCE27 /* InspectorValues.cpp */,
+				A593CF811840377100BFCE27 /* InspectorValues.h */,
+				A503FA13188E0FAF00110F14 /* JavaScriptCallFrame.cpp */,
+				A503FA14188E0FAF00110F14 /* JavaScriptCallFrame.h */,
+				A5C3A1A318C0490200C9593A /* JSGlobalObjectConsoleClient.cpp */,
+				A5C3A1A418C0490200C9593A /* JSGlobalObjectConsoleClient.h */,
+				A51007BE187CC3C600B38879 /* JSGlobalObjectInspectorController.cpp */,
+				A51007BF187CC3C600B38879 /* JSGlobalObjectInspectorController.h */,
+				A503FA27188F105900110F14 /* JSGlobalObjectScriptDebugServer.cpp */,
+				A503FA28188F105900110F14 /* JSGlobalObjectScriptDebugServer.h */,
+				A513E5BA185BFACC007E95AD /* JSInjectedScriptHost.cpp */,
+				A513E5BB185BFACC007E95AD /* JSInjectedScriptHost.h */,
+				A513E5BC185BFACC007E95AD /* JSInjectedScriptHostPrototype.cpp */,
+				A513E5BD185BFACC007E95AD /* JSInjectedScriptHostPrototype.h */,
+				A503FA15188E0FB000110F14 /* JSJavaScriptCallFrame.cpp */,
+				A503FA16188E0FB000110F14 /* JSJavaScriptCallFrame.h */,
+				A503FA17188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp */,
+				A503FA18188E0FB000110F14 /* JSJavaScriptCallFramePrototype.h */,
+				A5AB49DA1BEC8079007020FB /* PerGlobalObjectWrapperWorld.cpp */,
+				A5AB49DB1BEC8079007020FB /* PerGlobalObjectWrapperWorld.h */,
+				A5FD0065189AFE9C00633231 /* ScriptArguments.cpp */,
+				A5FD0066189AFE9C00633231 /* ScriptArguments.h */,
+				A503FA1F188EFF6800110F14 /* ScriptBreakpoint.h */,
+				A5FD0069189B00A900633231 /* ScriptCallFrame.cpp */,
+				A5FD006A189B00A900633231 /* ScriptCallFrame.h */,
+				A5FD006B189B00A900633231 /* ScriptCallStack.cpp */,
+				A5FD006C189B00AA00633231 /* ScriptCallStack.h */,
+				A5FD007B189B0B4C00633231 /* ScriptCallStackFactory.cpp */,
+				A5FD007C189B0B4C00633231 /* ScriptCallStackFactory.h */,
+				A503FA20188EFF6800110F14 /* ScriptDebugListener.h */,
+				A503FA23188EFFFD00110F14 /* ScriptDebugServer.cpp */,
+				A503FA24188EFFFD00110F14 /* ScriptDebugServer.h */,
+			);
+			path = inspector;
+			sourceTree = "<group>";
+		};
+		A5BA15E01823409D00A82E69 /* remote */ = {
+			isa = PBXGroup;
+			children = (
+				992ABCF51BEA94CA006403A0 /* RemoteAutomationTarget.cpp */,
+				992ABCF61BEA94CA006403A0 /* RemoteAutomationTarget.h */,
+				A5BA15E4182340B300A82E69 /* RemoteConnectionToTarget.h */,
+				A5BA15E5182340B300A82E69 /* RemoteConnectionToTarget.mm */,
+				998ED6721BED659A00DD8017 /* RemoteControllableTarget.cpp */,
+				998ED6731BED659A00DD8017 /* RemoteControllableTarget.h */,
+				A594558E18245EDE00CC3843 /* RemoteInspectionTarget.cpp */,
+				A5BA15EF182345AF00A82E69 /* RemoteInspectionTarget.h */,
+				A5BA15E1182340B300A82E69 /* RemoteInspector.h */,
+				A5BA15E2182340B300A82E69 /* RemoteInspector.mm */,
+				A5BA15E3182340B300A82E69 /* RemoteInspectorConstants.h */,
+				A5BA15E6182340B300A82E69 /* RemoteInspectorXPCConnection.h */,
+				A5BA15E7182340B300A82E69 /* RemoteInspectorXPCConnection.mm */,
+			);
+			path = remote;
+			sourceTree = "<group>";
+		};
+		A5EA70E319F5B0E20098F5EC /* augmentable */ = {
+			isa = PBXGroup;
+			children = (
+				A5EA70E619F5B1010098F5EC /* AlternateDispatchableAgent.h */,
+				A5EA70E419F5B1010098F5EC /* AugmentableInspectorController.h */,
+				A5EA70E519F5B1010098F5EC /* AugmentableInspectorControllerClient.h */,
+			);
+			path = augmentable;
+			sourceTree = "<group>";
+		};
+		A7D8019F1880D66E0026C39B /* builtins */ = {
+			isa = PBXGroup;
+			children = (
+				7CF9BC581B65D9A3009DB1EF /* ArrayConstructor.js */,
+				7CF9BC591B65D9A3009DB1EF /* ArrayIteratorPrototype.js */,
+				A7D801A01880D66E0026C39B /* ArrayPrototype.js */,
+				5B8243041DB7AA4900EA6384 /* AsyncFunctionPrototype.js */,
+				DE26E9061CB5DD9600D2BE82 /* BuiltinExecutableCreator.cpp */,
+				DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */,
+				A7D801A11880D66E0026C39B /* BuiltinExecutables.cpp */,
+				A7D801A21880D66E0026C39B /* BuiltinExecutables.h */,
+				A75EE9B018AAB7E200AAD043 /* BuiltinNames.h */,
+				41DEA1311B9F3154006D65DD /* BuiltinUtils.h */,
+				A1FE1EB01C2C537E00A289FF /* DatePrototype.js */,
+				A7A979C418BE8D9E002C3733 /* FunctionPrototype.js */,
+				70B7918F1C0244EC002481E2 /* GeneratorPrototype.js */,
+				7CF9BC5A1B65D9A3009DB1EF /* GlobalObject.js */,
+				A52704851D027C8800354C37 /* GlobalOperations.js */,
+				E35E03611B7AB4850073AD2A /* InspectorInstrumentationObject.js */,
+				E33F50881B844A1A00413856 /* InternalPromiseConstructor.js */,
+				7CF9BC5B1B65D9A3009DB1EF /* IteratorPrototype.js */,
+				7035587C1C418419004BD7BF /* MapPrototype.js */,
+				E30677971B8BC6F5003F87F0 /* ModuleLoaderPrototype.js */,
+				A52704861D027C8800354C37 /* NumberConstructor.js */,
+				A15DE5C51C0FBF8D0089133D /* NumberPrototype.js */,
+				7CF9BC5C1B65D9B1009DB1EF /* ObjectConstructor.js */,
+				7CF9BC5E1B65D9B1009DB1EF /* PromiseConstructor.js */,
+				7CF9BC5D1B65D9B1009DB1EF /* PromiseOperations.js */,
+				7CFBAC1C18B535E500D00750 /* PromisePrototype.js */,
+				7CF9BC5F1B65D9B1009DB1EF /* ReflectObject.js */,
+				654788421C937D2C000781A0 /* RegExpPrototype.js */,
+				7035587D1C418419004BD7BF /* SetPrototype.js */,
+				7CF9BC601B65D9B1009DB1EF /* StringConstructor.js */,
+				7CF9BC611B65D9B1009DB1EF /* StringIteratorPrototype.js */,
+				A1E0451B1C25B4B100BB663C /* StringPrototype.js */,
+				534C457A1BC703DC007476A7 /* TypedArrayConstructor.js */,
+				53917E831B791CB8000EBD33 /* TypedArrayPrototype.js */,
+			);
+			path = builtins;
+			sourceTree = "<group>";
+		};
+		AD2FCB8A1DB5840000B3E736 /* js */ = {
+			isa = PBXGroup;
+			children = (
+				79E423E01DEE65320078D355 /* JSWebAssemblyCallee.cpp */,
+				79E423E11DEE65320078D355 /* JSWebAssemblyCallee.h */,
+				AD2FCBA61DB58DA400B3E736 /* JSWebAssemblyCompileError.cpp */,
+				AD2FCBA71DB58DA400B3E736 /* JSWebAssemblyCompileError.h */,
+				796FB4391DFF8C3F0039C95D /* JSWebAssemblyHelpers.h */,
+				AD2FCBA81DB58DA400B3E736 /* JSWebAssemblyInstance.cpp */,
+				AD2FCBA91DB58DA400B3E736 /* JSWebAssemblyInstance.h */,
+				AD2FCBAA1DB58DA400B3E736 /* JSWebAssemblyMemory.cpp */,
+				AD2FCBAB1DB58DA400B3E736 /* JSWebAssemblyMemory.h */,
+				AD2FCB8C1DB5844000B3E736 /* JSWebAssemblyModule.cpp */,
+				AD2FCB8D1DB5844000B3E736 /* JSWebAssemblyModule.h */,
+				AD2FCBAC1DB58DA400B3E736 /* JSWebAssemblyRuntimeError.cpp */,
+				AD2FCBAD1DB58DA400B3E736 /* JSWebAssemblyRuntimeError.h */,
+				AD2FCBAE1DB58DA400B3E736 /* JSWebAssemblyTable.cpp */,
+				AD2FCBAF1DB58DA400B3E736 /* JSWebAssemblyTable.h */,
+				AD2FCBB01DB58DA400B3E736 /* WebAssemblyCompileErrorConstructor.cpp */,
+				AD2FCBB11DB58DA400B3E736 /* WebAssemblyCompileErrorConstructor.h */,
+				AD2FCBB21DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.cpp */,
+				AD2FCBB31DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.h */,
+				AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */,
+				AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */,
+				AD2FCBB41DB58DA400B3E736 /* WebAssemblyInstanceConstructor.cpp */,
+				AD2FCBB51DB58DA400B3E736 /* WebAssemblyInstanceConstructor.h */,
+				AD2FCBB61DB58DA400B3E736 /* WebAssemblyInstancePrototype.cpp */,
+				AD2FCBB71DB58DA400B3E736 /* WebAssemblyInstancePrototype.h */,
+				AD2FCBB81DB58DA400B3E736 /* WebAssemblyMemoryConstructor.cpp */,
+				AD2FCBB91DB58DA400B3E736 /* WebAssemblyMemoryConstructor.h */,
+				AD2FCBBA1DB58DA400B3E736 /* WebAssemblyMemoryPrototype.cpp */,
+				AD2FCBBB1DB58DA400B3E736 /* WebAssemblyMemoryPrototype.h */,
+				AD2FCB981DB585A600B3E736 /* WebAssemblyModuleConstructor.cpp */,
+				AD2FCB991DB585A600B3E736 /* WebAssemblyModuleConstructor.h */,
+				AD2FCB9A1DB585A600B3E736 /* WebAssemblyModulePrototype.cpp */,
+				AD2FCB9B1DB585A600B3E736 /* WebAssemblyModulePrototype.h */,
+				AD4937C51DDCDCF00077C807 /* WebAssemblyModuleRecord.cpp */,
+				AD4937C61DDCDCF00077C807 /* WebAssemblyModuleRecord.h */,
+				AD2FCC261DB838C400B3E736 /* WebAssemblyPrototype.cpp */,
+				AD2FCC271DB838C400B3E736 /* WebAssemblyPrototype.h */,
+				AD2FCBBC1DB58DA400B3E736 /* WebAssemblyRuntimeErrorConstructor.cpp */,
+				AD2FCBBD1DB58DA400B3E736 /* WebAssemblyRuntimeErrorConstructor.h */,
+				AD2FCBBE1DB58DA400B3E736 /* WebAssemblyRuntimeErrorPrototype.cpp */,
+				AD2FCBBF1DB58DA400B3E736 /* WebAssemblyRuntimeErrorPrototype.h */,
+				AD2FCBC01DB58DA400B3E736 /* WebAssemblyTableConstructor.cpp */,
+				AD2FCBC11DB58DA400B3E736 /* WebAssemblyTableConstructor.h */,
+				AD2FCBC21DB58DA400B3E736 /* WebAssemblyTablePrototype.cpp */,
+				AD2FCBC31DB58DA400B3E736 /* WebAssemblyTablePrototype.h */,
+				ADBC54D21DF8EA00005BF738 /* WebAssemblyToJSCallee.cpp */,
+				ADBC54D31DF8EA00005BF738 /* WebAssemblyToJSCallee.h */,
+			);
+			name = js;
+			sourceTree = "<group>";
+		};
+		C4703CC1192844A40013FBEA /* codegen */ = {
+			isa = PBXGroup;
+			children = (
+				C4703CC2192844CC0013FBEA /* __init__.py */,
+				C4F4B6D01A05C76F005CAB76 /* cpp_generator.py */,
+				C4F4B6CF1A05C76F005CAB76 /* cpp_generator_templates.py */,
+				A5EA70EA19F5B3D50098F5EC /* generate_cpp_alternate_backend_dispatcher_header.py */,
+				C4F4B6D11A05C76F005CAB76 /* generate_cpp_backend_dispatcher_header.py */,
+				C4F4B6D21A05C76F005CAB76 /* generate_cpp_backend_dispatcher_implementation.py */,
+				C4F4B6D31A05C76F005CAB76 /* generate_cpp_frontend_dispatcher_header.py */,
+				C4F4B6D41A05C76F005CAB76 /* generate_cpp_frontend_dispatcher_implementation.py */,
+				C4F4B6D51A05C76F005CAB76 /* generate_cpp_protocol_types_header.py */,
+				C4F4B6D61A05C76F005CAB76 /* generate_cpp_protocol_types_implementation.py */,
+				C4703CC3192844CC0013FBEA /* generate_js_backend_commands.py */,
+				A5EA70EF19F6DE5A0098F5EC /* generate_objc_backend_dispatcher_header.py */,
+				A5EA70F019F6DE5A0098F5EC /* generate_objc_backend_dispatcher_implementation.py */,
+				A5EA70F119F6DE5A0098F5EC /* generate_objc_configuration_header.py */,
+				A5EA70F219F6DE5A0098F5EC /* generate_objc_configuration_implementation.py */,
+				A5EA70F419F6DE5A0098F5EC /* generate_objc_frontend_dispatcher_implementation.py */,
+				A5EA70F519F6DE5A0098F5EC /* generate_objc_header.py */,
+				A5EA70F619F6DE5A0098F5EC /* generate_objc_internal_header.py */,
+				A5EA70F319F6DE5A0098F5EC /* generate_objc_protocol_type_conversions_header.py */,
+				990DA67E1C8E311D00295159 /* generate_objc_protocol_type_conversions_implementation.py */,
+				C4F4B6D71A05C76F005CAB76 /* generate_objc_protocol_types_implementation.py */,
+				C4703CCB192844CC0013FBEA /* generator.py */,
+				C4703CCA192844CC0013FBEA /* generator_templates.py */,
+				C4703CCC192844CC0013FBEA /* models.py */,
+				A5EA70F819F6DE5A0098F5EC /* objc_generator.py */,
+				C4F4B6D81A05C76F005CAB76 /* objc_generator_templates.py */,
+			);
+			path = codegen;
+			sourceTree = "<group>";
+		};
+		E3FF752D1D9CE9EA00C7E16D /* domjit */ = {
+			isa = PBXGroup;
+			children = (
+				E35CA14F1DBC3A5600F83516 /* DOMJITAbstractHeap.cpp */,
+				E35CA1501DBC3A5600F83516 /* DOMJITAbstractHeap.h */,
+				E3555B891DAE03A200F36921 /* DOMJITCallDOMGetterPatchpoint.h */,
+				E3C79CAA1DB9A4D600D1ECA4 /* DOMJITEffect.h */,
+				E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */,
+				E35CA1511DBC3A5600F83516 /* DOMJITHeapRange.cpp */,
+				E35CA1521DBC3A5600F83516 /* DOMJITHeapRange.h */,
+				E3C08E3B1DA41B7B0039478F /* DOMJITPatchpoint.h */,
+				E37AD83A1DA4928000F3D412 /* DOMJITPatchpointParams.h */,
+				E37AD83B1DA4928000F3D412 /* DOMJITReg.h */,
+				E35070891DC49BB60089BCD6 /* DOMJITSignature.h */,
+				E3CB1E241DA7540A00FA1E56 /* DOMJITSlowPathCalls.h */,
+				E3FFC8521DAD7D1000DEA53E /* DOMJITValue.h */,
+			);
+			path = domjit;
+			sourceTree = "<group>";
+		};
+/* End PBXGroup section */
+
+/* Begin PBXHeadersBuildPhase section */
+		144005C70A5338C60005F061 /* Headers */ = {
+			isa = PBXHeadersBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */,
+				144005CB0A5338D10005F061 /* JSNode.h in Headers */,
+				144007570A5370D20005F061 /* JSNodeList.h in Headers */,
+				144005CC0A5338F80005F061 /* Node.h in Headers */,
+				1440074A0A536CC20005F061 /* NodeList.h in Headers */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		932F5B3F0822A1C700736975 /* Headers */ = {
+			isa = PBXHeadersBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0FFA549816B8835300B3A982 /* A64DOpcode.h in Headers */,
+				0F1FE51C1922A3BC006987C5 /* AbortReason.h in Headers */,
+				860161E30F3A83C100F84710 /* AbstractMacroAssembler.h in Headers */,
+				AD4937C41DDBE6140077C807 /* AbstractModuleRecord.h in Headers */,
+				0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */,
+				5370B4F61BF26205005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h in Headers */,
+				0FEC856E1BDACDC70080FF74 /* AirAllocateStack.h in Headers */,
+				0FEC85701BDACDC70080FF74 /* AirArg.h in Headers */,
+				0F64EAF31C4ECD0600621E9B /* AirArgInlines.h in Headers */,
+				0FEC85721BDACDC70080FF74 /* AirBasicBlock.h in Headers */,
+				0FB3878E1BFBC44D00E3AB1E /* AirBlockWorklist.h in Headers */,
+				0F61832A1C45BF070072450B /* AirCCallingConvention.h in Headers */,
+				0FEC85741BDACDC70080FF74 /* AirCCallSpecial.h in Headers */,
+				0FEC85761BDACDC70080FF74 /* AirCode.h in Headers */,
+				0F10F1A31C420BF0001C07D2 /* AirCustom.h in Headers */,
+				DC454B8D1D00E824004C18AF /* AirDumpAsJS.h in Headers */,
+				0F4570391BE44C910062A629 /* AirEliminateDeadCode.h in Headers */,
+				0F61832D1C45BF070072450B /* AirEmitShuffle.h in Headers */,
+				0F4DE1CF1C4C1B54004D6C11 /* AirFixObviousSpills.h in Headers */,
+				262D85B71C0D650F006ACB61 /* AirFixPartialRegisterStalls.h in Headers */,
+				0FEC85771BDACDC70080FF74 /* AirFrequentedBlock.h in Headers */,
+				0FEC85791BDACDC70080FF74 /* AirGenerate.h in Headers */,
+				0FEC857A1BDACDC70080FF74 /* AirGenerationContext.h in Headers */,
+				0FEC857C1BDACDC70080FF74 /* AirHandleCalleeSaves.h in Headers */,
+				0FEC857E1BDACDC70080FF74 /* AirInsertionSet.h in Headers */,
+				0FEC85801BDACDC70080FF74 /* AirInst.h in Headers */,
+				0FEC85811BDACDC70080FF74 /* AirInstInlines.h in Headers */,
+				26718BA51BE99F780052017B /* AirIteratedRegisterCoalescing.h in Headers */,
+				0FDF67D71D9DC442001B9825 /* AirKind.h in Headers */,
+				2684D4381C00161C0081D663 /* AirLiveness.h in Headers */,
+				0FE34C1A1C4B39AE0003A512 /* AirLogRegisterPressure.h in Headers */,
+				0F61832F1C45BF070072450B /* AirLowerAfterRegAlloc.h in Headers */,
+				0FDF70861D3F2C2500927449 /* AirLowerEntrySwitch.h in Headers */,
+				0F6183311C45BF070072450B /* AirLowerMacros.h in Headers */,
+				0F40E4A71C497F7400A577FA /* AirOpcode.h in Headers */,
+				0F40E4A81C497F7400A577FA /* AirOpcodeGenerated.h in Headers */,
+				0F40E4A91C497F7400A577FA /* AirOpcodeUtils.h in Headers */,
+				0FB387901BFBC44D00E3AB1E /* AirOptimizeBlockOrder.h in Headers */,
+				0F9CABC91DB54A7A0008E83B /* AirPadInterference.h in Headers */,
+				0FEC85841BDACDC70080FF74 /* AirPhaseScope.h in Headers */,
+				0F45703D1BE45F0A0062A629 /* AirReportUsedRegisters.h in Headers */,
+				0F338DFE1BED51270013C88F /* AirSimplifyCFG.h in Headers */,
+				0FEC85881BDACDC70080FF74 /* AirSpecial.h in Headers */,
+				0FEC858A1BDACDC70080FF74 /* AirSpillEverything.h in Headers */,
+				0FEC858C1BDACDC70080FF74 /* AirStackSlot.h in Headers */,
+				0F2BBD9E1C5FF4050023EF23 /* AirStackSlotKind.h in Headers */,
+				0FEC858E1BDACDC70080FF74 /* AirTmp.h in Headers */,
+				0FEC858F1BDACDC70080FF74 /* AirTmpInlines.h in Headers */,
+				0FE0E4AE1C24C94A002E17B6 /* AirTmpWidth.h in Headers */,
+				0F3730931C0D67EE00052BFA /* AirUseCounts.h in Headers */,
+				0FEC85911BDACDC70080FF74 /* AirValidate.h in Headers */,
+				0FA7620B1DB959F900B7A2FD /* AllocatingScope.h in Headers */,
+				0F96303A1D4192C8005609D9 /* AllocatorAttributes.h in Headers */,
+				0F3730911C0CD70C00052BFA /* AllowMacroScratchRegisterUsage.h in Headers */,
+				A5EA70E919F5B1010098F5EC /* AlternateDispatchableAgent.h in Headers */,
+				2A48D1911772365B00C65A5F /* APICallbackFunction.h in Headers */,
+				BC18C3E50E16F5CD00B34460 /* APICast.h in Headers */,
+				53529A4C1C457B75000B49C6 /* APIUtils.h in Headers */,
+				BCF605140E203EF800B9A64D /* ArgList.h in Headers */,
+				0FE050141AA9091100D33B33 /* ArgumentsMode.h in Headers */,
+				79A228361D35D71F00D8E067 /* ArithProfile.h in Headers */,
+				0F6B1CB91861244C00845D97 /* ArityCheckMode.h in Headers */,
+				A1A009C11831A26E00CF8711 /* ARM64Assembler.h in Headers */,
+				86D3B2C410156BDE002865E7 /* ARMAssembler.h in Headers */,
+				86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
+				65C0285D1717966800351E35 /* ARMv7DOpcode.h in Headers */,
+				0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */,
+				A7A8AF3517ADB5F3005AB174 /* ArrayBuffer.h in Headers */,
+				0FFC99D5184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.h in Headers */,
+				0F30FB611DC2DE99003124F2 /* ArrayBufferSharingMode.h in Headers */,
+				A7A8AF3717ADB5F3005AB174 /* ArrayBufferView.h in Headers */,
+				BC18C3E60E16F5CD00B34460 /* ArrayConstructor.h in Headers */,
+				996B73171BDA067F00331B84 /* ArrayConstructor.lut.h in Headers */,
+				0FB7F39515ED8E4600F167B2 /* ArrayConventions.h in Headers */,
+				52B74B4B1DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h in Headers */,
+				A7BDAEC917F4EA1400F6140C /* ArrayIteratorPrototype.h in Headers */,
+				996B73181BDA068000331B84 /* ArrayIteratorPrototype.lut.h in Headers */,
+				0F63945515D07057006A597C /* ArrayProfile.h in Headers */,
+				BC18C3E70E16F5CD00B34460 /* ArrayPrototype.h in Headers */,
+				0FB7F39615ED8E4600F167B2 /* ArrayStorage.h in Headers */,
+				9688CB150ED12B4E001D649F /* AssemblerBuffer.h in Headers */,
+				86D3B2C510156BDE002865E7 /* AssemblerBufferWithConstantPool.h in Headers */,
+				43C392AB1C3BEB0500241F53 /* AssemblerCommon.h in Headers */,
+				0F24E54117EA9F5900ABB217 /* AssemblyHelpers.h in Headers */,
+				A784A26111D16622005776AC /* ASTBuilder.h in Headers */,
+				5B70CFE21DB69E6600EC23F9 /* AsyncFunctionConstructor.h in Headers */,
+				5B70CFE01DB69E6600EC23F9 /* AsyncFunctionPrototype.h in Headers */,
+				6A38CFAA1E32B5AB0060206F /* AsyncStackTrace.h in Headers */,
+				0F7CF9571DC125900098CC12 /* AtomicsObject.h in Headers */,
+				A5EA70E719F5B1010098F5EC /* AugmentableInspectorController.h in Headers */,
+				A5EA70E819F5B1010098F5EC /* AugmentableInspectorControllerClient.h in Headers */,
+				0F38D2A21D44196800680499 /* AuxiliaryBarrier.h in Headers */,
+				0F38D2A31D44196D00680499 /* AuxiliaryBarrierInlines.h in Headers */,
+				0FEC84FF1BDACDAC0080FF74 /* B3ArgumentRegValue.h in Headers */,
+				0FEC85011BDACDAC0080FF74 /* B3BasicBlock.h in Headers */,
+				0FEC85021BDACDAC0080FF74 /* B3BasicBlockInlines.h in Headers */,
+				0FEC85031BDACDAC0080FF74 /* B3BasicBlockUtils.h in Headers */,
+				0F338E1C1BF286EA0013C88F /* B3BlockInsertionSet.h in Headers */,
+				0FEC85041BDACDAC0080FF74 /* B3BlockWorklist.h in Headers */,
+				DCFDFBD91D1F5D9B00FE3D72 /* B3BottomProvider.h in Headers */,
+				0F6B8AE31C4EFE1700969052 /* B3BreakCriticalEdges.h in Headers */,
+				DC9A0C201D2D9CB30085124E /* B3CaseCollection.h in Headers */,
+				DC9A0C1F1D2D9CB10085124E /* B3CaseCollectionInlines.h in Headers */,
+				0F338DFA1BE96AA80013C88F /* B3CCallValue.h in Headers */,
+				0F33FCFB1C1625BE00323F67 /* B3CFG.h in Headers */,
+				0FEC85061BDACDAC0080FF74 /* B3CheckSpecial.h in Headers */,
+				0FEC85081BDACDAC0080FF74 /* B3CheckValue.h in Headers */,
+				0FEC850A1BDACDAC0080FF74 /* B3Common.h in Headers */,
+				0FEC850C1BDACDAC0080FF74 /* B3Commutativity.h in Headers */,
+				0F338E0C1BF0276C0013C88F /* B3Compilation.h in Headers */,
+				7919B7801E03559C005BEED8 /* B3Compile.h in Headers */,
+				0F86AE201C5311C5006BE8EC /* B3ComputeDivisionMagic.h in Headers */,
+				0FEC850E1BDACDAC0080FF74 /* B3Const32Value.h in Headers */,
+				0FEC85101BDACDAC0080FF74 /* B3Const64Value.h in Headers */,
+				0FEC85121BDACDAC0080FF74 /* B3ConstDoubleValue.h in Headers */,
+				43422A631C158E6D00E2EB98 /* B3ConstFloatValue.h in Headers */,
+				0FEC85B31BDED9570080FF74 /* B3ConstPtrValue.h in Headers */,
+				0F338DF61BE93D550013C88F /* B3ConstrainedValue.h in Headers */,
+				0F338E0E1BF0276C0013C88F /* B3DataSection.h in Headers */,
+				0F33FCFC1C1625BE00323F67 /* B3Dominators.h in Headers */,
+				0F6B8AD91C4EDDA200969052 /* B3DuplicateTails.h in Headers */,
+				0FEC85C11BE167A00080FF74 /* B3Effects.h in Headers */,
+				0F725CA81C503DED00AD943A /* B3EliminateCommonSubexpressions.h in Headers */,
+				0F6971EA1D92F42400BA02A5 /* B3FenceValue.h in Headers */,
+				0F6B8AE51C4EFE1700969052 /* B3FixSSA.h in Headers */,
+				0F725CB01C506D3B00AD943A /* B3FoldPathConstants.h in Headers */,
+				0FEC85161BDACDAC0080FF74 /* B3FrequencyClass.h in Headers */,
+				0FEC85171BDACDAC0080FF74 /* B3FrequentedBlock.h in Headers */,
+				0FEC85191BDACDAC0080FF74 /* B3Generate.h in Headers */,
+				0FEC851A1BDACDAC0080FF74 /* B3GenericFrequentedBlock.h in Headers */,
+				0FEC85C31BE167A00080FF74 /* B3HeapRange.h in Headers */,
+				DC69B99D1D15F914002E3C00 /* B3InferSwitches.h in Headers */,
+				0FEC85BA1BE1462F0080FF74 /* B3InsertionSet.h in Headers */,
+				0FEC85BB1BE1462F0080FF74 /* B3InsertionSetInlines.h in Headers */,
+				0FDF67D21D9C6D27001B9825 /* B3Kind.h in Headers */,
+				436E54531C468E7400B5AF73 /* B3LegalizeMemoryOffsets.h in Headers */,
+				0F338E1E1BF286EA0013C88F /* B3LowerMacros.h in Headers */,
+				4319DA041C1BE40D001D260B /* B3LowerMacrosAfterOptimizations.h in Headers */,
+				0FEC851E1BDACDAC0080FF74 /* B3LowerToAir.h in Headers */,
+				43AB26C61C1A535900D82AE6 /* B3MathExtras.h in Headers */,
+				0FEC85201BDACDAC0080FF74 /* B3MemoryValue.h in Headers */,
+				0F338E101BF0276C0013C88F /* B3MoveConstants.h in Headers */,
+				0F338E111BF0276C0013C88F /* B3OpaqueByproduct.h in Headers */,
+				0F338E131BF0276C0013C88F /* B3OpaqueByproducts.h in Headers */,
+				0FEC85221BDACDAC0080FF74 /* B3Opcode.h in Headers */,
+				0FEC85241BDACDAC0080FF74 /* B3Origin.h in Headers */,
+				0F4C91661C29F4F2004341A6 /* B3OriginDump.h in Headers */,
+				0FEC85261BDACDAC0080FF74 /* B3PatchpointSpecial.h in Headers */,
+				0FEC85281BDACDAC0080FF74 /* B3PatchpointValue.h in Headers */,
+				799EF7C41C56ED96002B0534 /* B3PCToOriginMap.h in Headers */,
+				0FEC852A1BDACDAC0080FF74 /* B3PhaseScope.h in Headers */,
+				0F37308D1C0BD29100052BFA /* B3PhiChildren.h in Headers */,
+				0FEC852C1BDACDAC0080FF74 /* B3Procedure.h in Headers */,
+				0FEC852D1BDACDAC0080FF74 /* B3ProcedureInlines.h in Headers */,
+				0F725CAA1C503DED00AD943A /* B3PureCSE.h in Headers */,
+				43422A671C16267800E2EB98 /* B3ReduceDoubleToFloat.h in Headers */,
+				0FEC85BD1BE1462F0080FF74 /* B3ReduceStrength.h in Headers */,
+				0FEC85351BDACDAC0080FF74 /* B3SlotBaseValue.h in Headers */,
+				0F2BBD961C5FF3F50023EF23 /* B3SparseCollection.h in Headers */,
+				0F6B8ADD1C4EFAC300969052 /* B3SSACalculator.h in Headers */,
+				0F33FCF81C136E2500323F67 /* B3StackmapGenerationParams.h in Headers */,
+				0FEC85311BDACDAC0080FF74 /* B3StackmapSpecial.h in Headers */,
+				0F338DF21BE93AD10013C88F /* B3StackmapValue.h in Headers */,
+				0F9495881C57F47500413A48 /* B3StackSlot.h in Headers */,
+				0FEC85361BDACDAC0080FF74 /* B3SuccessorCollection.h in Headers */,
+				0FEC85381BDACDAC0080FF74 /* B3SwitchCase.h in Headers */,
+				0FEC853A1BDACDAC0080FF74 /* B3SwitchValue.h in Headers */,
+				0F4570411BE584CA0062A629 /* B3TimingScope.h in Headers */,
+				0FEC853C1BDACDAC0080FF74 /* B3Type.h in Headers */,
+				DCFDFBDA1D1F5D9E00FE3D72 /* B3TypeMap.h in Headers */,
+				0FEC853E1BDACDAC0080FF74 /* B3UpsilonValue.h in Headers */,
+				0FEC85401BDACDAC0080FF74 /* B3UseCounts.h in Headers */,
+				0FEC85421BDACDAC0080FF74 /* B3Validate.h in Headers */,
+				0FEC85441BDACDAC0080FF74 /* B3Value.h in Headers */,
+				0FEC85451BDACDAC0080FF74 /* B3ValueInlines.h in Headers */,
+				0F338E151BF0276C0013C88F /* B3ValueKey.h in Headers */,
+				0F338E161BF0276C0013C88F /* B3ValueKeyInlines.h in Headers */,
+				0FEC85471BDACDAC0080FF74 /* B3ValueRep.h in Headers */,
+				0F2BBD981C5FF3F50023EF23 /* B3Variable.h in Headers */,
+				0F2BBD9A1C5FF3F50023EF23 /* B3VariableValue.h in Headers */,
+				53D444DC1DAF08AB00B92784 /* B3WasmAddressValue.h in Headers */,
+				5341FC721DAC343C00E7E4D7 /* B3WasmBoundsCheckValue.h in Headers */,
+				52678F8F1A031009006A306D /* BasicBlockLocation.h in Headers */,
+				147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */,
+				866739D213BFDE710023D87C /* BigInteger.h in Headers */,
+				0F64B2721A784BAF006E4E66 /* BinarySwitch.h in Headers */,
+				BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */,
+				996B73191BDA068000331B84 /* BooleanPrototype.lut.h in Headers */,
+				FEA08620182B7A0400F6D851 /* Breakpoint.h in Headers */,
+				DE26E9031CB5DD0500D2BE82 /* BuiltinExecutableCreator.h in Headers */,
+				A7D801A51880D66E0026C39B /* BuiltinExecutables.h in Headers */,
+				A75EE9B218AAB7E200AAD043 /* BuiltinNames.h in Headers */,
+				99DA00A61BD5993100F4575C /* builtins.py in Headers */,
+				99DA00A71BD5993100F4575C /* builtins_generate_combined_header.py in Headers */,
+				99DA00A81BD5993100F4575C /* builtins_generate_combined_implementation.py in Headers */,
+				412952771D2CF6BC00E78B89 /* builtins_generate_internals_wrapper_header.py in Headers */,
+				412952781D2CF6BC00E78B89 /* builtins_generate_internals_wrapper_implementation.py in Headers */,
+				99DA00A91BD5993100F4575C /* builtins_generate_separate_header.py in Headers */,
+				99DA00AA1BD5993100F4575C /* builtins_generate_separate_implementation.py in Headers */,
+				412952791D2CF6BC00E78B89 /* builtins_generate_wrapper_header.py in Headers */,
+				4129527A1D2CF6BC00E78B89 /* builtins_generate_wrapper_implementation.py in Headers */,
+				99DA00A31BD5993100F4575C /* builtins_generator.py in Headers */,
+				99DA00A41BD5993100F4575C /* builtins_model.py in Headers */,
+				99DA00A51BD5993100F4575C /* builtins_templates.py in Headers */,
+				41DEA1321B9F3163006D65DD /* BuiltinUtils.h in Headers */,
+				9E72940B190F0514001A91B5 /* BundlePath.h in Headers */,
+				0FB7F39715ED8E4600F167B2 /* Butterfly.h in Headers */,
+				0FB7F39815ED8E4600F167B2 /* ButterflyInlines.h in Headers */,
+				C2FCAE1117A9C24E0034C735 /* BytecodeBasicBlock.h in Headers */,
+				0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */,
+				969A07230ED1CE3300F1F681 /* BytecodeGenerator.h in Headers */,
+				E328DAE81D38D005001A2529 /* BytecodeGeneratorification.h in Headers */,
+				E328DAE91D38D005001A2529 /* BytecodeGraph.h in Headers */,
+				7094C4DF1AE439530041A2EE /* BytecodeIntrinsicRegistry.h in Headers */,
+				0F2DD80B1AB3D85800BBB8E8 /* BytecodeKills.h in Headers */,
+				C2FCAE1317A9C24E0034C735 /* BytecodeLivenessAnalysis.h in Headers */,
+				0F666EC0183566F900D017F1 /* BytecodeLivenessAnalysisInlines.h in Headers */,
+				E328DAEB1D38D005001A2529 /* BytecodeRewriter.h in Headers */,
+				6514F21918B3E1670098FF8B /* Bytecodes.h in Headers */,
+				0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */,
+				0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */,
+				65B8392E1BACAD360044E824 /* CachedRecovery.h in Headers */,
+				BC18C3ED0E16F5CD00B34460 /* CallData.h in Headers */,
+				0F64B27A1A7957B2006E4E66 /* CallEdge.h in Headers */,
+				1429D8DE0ED2205B00B89619 /* CallFrame.h in Headers */,
+				62EC9BB71B7EB07C00303AD1 /* CallFrameShuffleData.h in Headers */,
+				62D755D71B84FB4A001801FA /* CallFrameShuffler.h in Headers */,
+				0F0B83B114BCF71800885B4F /* CallLinkInfo.h in Headers */,
+				0F93329E14CA7DC50085F3C6 /* CallLinkStatus.h in Headers */,
+				627673241B680C1E00FD9F2E /* CallMode.h in Headers */,
+				0F0B83B914BCF95F00885B4F /* CallReturnOffsetToBytecodeOffset.h in Headers */,
+				0F3B7E2B19A11B8000D9BC56 /* CallVariant.h in Headers */,
+				FE80C1971D775CDD008510C0 /* CatchScope.h in Headers */,
+				0F24E54217EA9F5900ABB217 /* CCallHelpers.h in Headers */,
+				0F070A471D543A8B006E7232 /* CellContainer.h in Headers */,
+				0F070A481D543A90006E7232 /* CellContainerInlines.h in Headers */,
+				0F1C3DDA1BBCE09E00E523E4 /* CellState.h in Headers */,
+				BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */,
+				0FE050261AA9095600D33B33 /* ClonedArguments.h in Headers */,
+				BC18C45E0E16F5CD00B34460 /* CLoopStack.h in Headers */,
+				A7C1EAF017987AB600299DB2 /* CLoopStackInlines.h in Headers */,
+				969A07970ED1D3AE00F1F681 /* CodeBlock.h in Headers */,
+				0F8F94411667633200D61971 /* CodeBlockHash.h in Headers */,
+				0FC97F34182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.h in Headers */,
+				0FD8A31417D4326C00CA2C40 /* CodeBlockSet.h in Headers */,
+				0F664CE81DA304EF00B00A11 /* CodeBlockSetInlines.h in Headers */,
+				0F96EBB316676EF6008BADE3 /* CodeBlockWithJITType.h in Headers */,
+				A77F1822164088B200640A47 /* CodeCache.h in Headers */,
+				99CC0B6318BE9950006CEBCC /* CodeGeneratorReplayInputs.py in Headers */,
+				99CC0B6218BE9946006CEBCC /* CodeGeneratorReplayInputsTemplates.py in Headers */,
+				86E116B10FE75AC800B512BC /* CodeLocation.h in Headers */,
+				0FBD7E691447999600481315 /* CodeOrigin.h in Headers */,
+				0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */,
+				0F0B83A714BCF50700885B4F /* CodeType.h in Headers */,
+				0FA762051DB9242900B7A2FD /* CollectionScope.h in Headers */,
+				79FC8A081E32E9F000D88F0E /* DFGRegisteredStructure.h in Headers */,
+				A53243981856A489002ED692 /* CombinedDomains.json in Headers */,
+				BC18C3F30E16F5CD00B34460 /* CommonIdentifiers.h in Headers */,
+				0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */,
+				6553A33217A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h in Headers */,
+				0FD82E39141AB14D00179C94 /* CompactJITCodeMap.h in Headers */,
+				A7E5A3A81797432D00E893C0 /* CompilationResult.h in Headers */,
+				BC18C3F40E16F5CD00B34460 /* Completion.h in Headers */,
+				0F6FC751196110A800E1D02D /* ComplexGetStatus.h in Headers */,
+				0FDB2CEA174896C7007B3C1B /* ConcurrentJSLock.h in Headers */,
+				BC18C3F50E16F5CD00B34460 /* config.h in Headers */,
+				144836E7132DA7BE005BE785 /* ConservativeRoots.h in Headers */,
+				A53CE08A18BC21C300BEDF76 /* ConsoleClient.h in Headers */,
+				A5FD007A189B051000633231 /* ConsoleMessage.h in Headers */,
+				A55714BE1CD8049F0004D2C6 /* ConsoleObject.h in Headers */,
+				A5FD0074189B038C00633231 /* ConsoleTypes.h in Headers */,
+				0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers */,
+				0F7DF1341E2970D70095951B /* ConstraintVolatility.h in Headers */,
+				E354622B1B6065D100545386 /* ConstructAbility.h in Headers */,
+				BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */,
+				A57D23F21891B5B40031C7FA /* ContentSearchUtilities.h in Headers */,
+				52678F911A04177C006A306D /* ControlFlowProfiler.h in Headers */,
+				C4F4B6F41A05C944005CAB76 /* cpp_generator.py in Headers */,
+				C4F4B6F31A05C944005CAB76 /* cpp_generator_templates.py in Headers */,
+				0F30D7C01D95D6320053089D /* CPU.h in Headers */,
+				5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */,
+				9959E92B1BD17FA4001AA413 /* cssmin.py in Headers */,
+				2A111246192FCE79005EE18D /* CustomGetterSetter.h in Headers */,
+				0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */,
+				0F2B66DF17B6B5AB00A7AE3F /* DataView.h in Headers */,
+				BCD2034A0E17135E002C7E82 /* DateConstructor.h in Headers */,
+				996B731A1BDA08D100331B84 /* DateConstructor.lut.h in Headers */,
+				41359CF30FDD89AD00206180 /* DateConversion.h in Headers */,
+				BC1166020E1997B4008066DD /* DateInstance.h in Headers */,
+				14A1563210966365006FA260 /* DateInstanceCache.h in Headers */,
+				BCD2034C0E17135E002C7E82 /* DatePrototype.h in Headers */,
+				BCD203E80E1718F4002C7E82 /* DatePrototype.lut.h in Headers */,
+				BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */,
+				BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */,
+				6AD2CB4D19B9140100065719 /* DebuggerEvalEnabler.h in Headers */,
+				A5FC84B21D1DDAD6006B5C46 /* DebuggerLocation.h in Headers */,
+				A5A1A0941D8CB33E004C2EB8 /* DebuggerParseData.h in Headers */,
+				FEA08621182B7A0400F6D851 /* DebuggerPrimitives.h in Headers */,
+				0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */,
+				0F136D4D174AD69E0075B354 /* DeferGC.h in Headers */,
+				0FC712DF17CD877C008CC93C /* DeferredCompilationCallback.h in Headers */,
+				FE5068651AE246390009DAB7 /* DeferredSourceDump.h in Headers */,
+				473DA4A4764C45FE871B0485 /* DefinePropertyAttributes.h in Headers */,
+				0FBB73BB1DEF8645002C009E /* DeleteAllCodeEffort.h in Headers */,
+				0F96303C1D4192CD005609D9 /* DestructionMode.h in Headers */,
+				A77A423E17A0BBFD00A8DB81 /* DFGAbstractHeap.h in Headers */,
+				A704D90317A0BAA8006BA554 /* DFGAbstractInterpreter.h in Headers */,
+				A704D90417A0BAA8006BA554 /* DFGAbstractInterpreterInlines.h in Headers */,
+				0F620177143FCD3F0068B77C /* DFGAbstractValue.h in Headers */,
+				0FD3E4021B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.h in Headers */,
+				0F18D3D01B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.h in Headers */,
+				0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */,
+				0FFB921816D02EB20055A5DB /* DFGAllocator.h in Headers */,
+				0F1E3A461534CBAF000F9456 /* DFGArgumentPosition.h in Headers */,
+				0F2DD8121AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.h in Headers */,
+				0F2DD8141AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h in Headers */,
+				0F485322187750560083B687 /* DFGArithMode.h in Headers */,
+				0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers */,
+				0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */,
+				A7D9A29517A0BC7400EE2618 /* DFGAtTailAbstractState.h in Headers */,
+				0F666EC71835672B00D017F1 /* DFGAvailability.h in Headers */,
+				0F2B9CE319D0BA7D00B1D1B5 /* DFGAvailabilityMap.h in Headers */,
+				DCEE22091CEB9895000C2396 /* DFGBackwardsCFG.h in Headers */,
+				DCEE220A1CEB9895000C2396 /* DFGBackwardsDominators.h in Headers */,
+				0F714CA516EA92F200F3EBEB /* DFGBackwardsPropagationPhase.h in Headers */,
+				0F620176143FCD3B0068B77C /* DFGBasicBlock.h in Headers */,
+				0FFB921A16D02EC50055A5DB /* DFGBasicBlockInlines.h in Headers */,
+				A7D89CF417A0B8CC00773AD8 /* DFGBlockInsertionSet.h in Headers */,
+				0FC3CCFC19ADA410006AC72A /* DFGBlockMap.h in Headers */,
+				0FC3CCFD19ADA410006AC72A /* DFGBlockMapInlines.h in Headers */,
+				0FC3CCFE19ADA410006AC72A /* DFGBlockSet.h in Headers */,
+				0FBF158D19B7A53100695DD0 /* DFGBlockSetInlines.h in Headers */,
+				0FC3CD0019ADA410006AC72A /* DFGBlockWorklist.h in Headers */,
+				0F8364B7164B0C110053329A /* DFGBranchDirection.h in Headers */,
+				86EC9DC51328DF82002B2AD7 /* DFGByteCodeParser.h in Headers */,
+				0F256C361627B0AD007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h in Headers */,
+				0FBDB9AD1AB0FBC6000B57E5 /* DFGCallCreateDirectArgumentsSlowPathGenerator.h in Headers */,
+				0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */,
+				0FFFC95814EF90A200C72532 /* DFGCFAPhase.h in Headers */,
+				0F3B3A281544C997003ED0FF /* DFGCFGSimplificationPhase.h in Headers */,
+				0F9D36951AE9CC33000D4DFB /* DFGCleanUpPhase.h in Headers */,
+				A77A424017A0BBFD00A8DB81 /* DFGClobberize.h in Headers */,
+				A77A424217A0BBFD00A8DB81 /* DFGClobberSet.h in Headers */,
+				0F3C1F1B1B868E7900ABB08B /* DFGClobbersExitState.h in Headers */,
+				0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers */,
+				0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */,
+				0FEA0A32170D40BF00BB722C /* DFGCommonData.h in Headers */,
+				0F38B01817CFE75500B144D3 /* DFGCompilationKey.h in Headers */,
+				0F38B01A17CFE75500B144D3 /* DFGCompilationMode.h in Headers */,
+				0F3B3A1B153E68F4003ED0FF /* DFGConstantFoldingPhase.h in Headers */,
+				0FED67BA1B26256D0066CE15 /* DFGConstantHoistingPhase.h in Headers */,
+				DCEE220B1CEB9895000C2396 /* DFGControlEquivalenceAnalysis.h in Headers */,
+				0FBE0F7316C1DB050082C5E8 /* DFGCPSRethreadingPhase.h in Headers */,
+				A7D89CF617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.h in Headers */,
+				0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */,
+				0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */,
+				0F8F2B9A172F0501007DBDA5 /* DFGDesiredIdentifiers.h in Headers */,
+				0FFC92141B94E83E0071DD66 /* DFGDesiredInferredType.h in Headers */,
+				C2C0F7CE17BBFC5B00464FE4 /* DFGDesiredTransitions.h in Headers */,
+				0FE8534C1723CDA500B618F5 /* DFGDesiredWatchpoints.h in Headers */,
+				C2981FD917BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h in Headers */,
+				0FF427651591A1CE004CB9FF /* DFGDisassembler.h in Headers */,
+				0F5A1274192D9FDF008764A3 /* DFGDoesGC.h in Headers */,
+				0FD81AD3154FB4F000983E72 /* DFGDominators.h in Headers */,
+				E322E5A31DA64439006E7709 /* DFGDOMJITPatchpointParams.h in Headers */,
+				0F1E3A471534CBB9000F9456 /* DFGDoubleFormatState.h in Headers */,
+				0FD3C82814115D4F00FD81CB /* DFGDriver.h in Headers */,
+				0F66E16C14DF3F1600B7B2E4 /* DFGEdge.h in Headers */,
+				A7D9A29617A0BC7400EE2618 /* DFGEdgeDominates.h in Headers */,
+				A7986D5717A0BB1E00A95DD0 /* DFGEdgeUsesStructure.h in Headers */,
+				0F8F14341ADF090100ED792C /* DFGEpoch.h in Headers */,
+				0FBC0AE81496C7C700D4FBDD /* DFGExitProfile.h in Headers */,
+				A78A9775179738B8009DF744 /* DFGFailedFinalizer.h in Headers */,
+				A7BFF3C0179868940002F462 /* DFGFiltrationResult.h in Headers */,
+				A78A9777179738B8009DF744 /* DFGFinalizer.h in Headers */,
+				0F2BDC16151C5D4F00CD8910 /* DFGFixupPhase.h in Headers */,
+				0F2017801DCADC3500EA5950 /* DFGFlowIndexing.h in Headers */,
+				0F2017821DCADD4200EA5950 /* DFGFlowMap.h in Headers */,
+				0F9D339717FFC4E60073C2BC /* DFGFlushedAt.h in Headers */,
+				A7D89CF817A0B8CC00773AD8 /* DFGFlushFormat.h in Headers */,
+				0F2DD8151AB3D8BE00BBB8E8 /* DFGForAllKills.h in Headers */,
+				0F69CC89193AC60A0045759E /* DFGFrozenValue.h in Headers */,
+				86EC9DC61328DF82002B2AD7 /* DFGGenerationInfo.h in Headers */,
+				86EC9DC81328DF82002B2AD7 /* DFGGraph.h in Headers */,
+				0F2FCCFA18A60070001A27F8 /* DFGGraphSafepoint.h in Headers */,
+				0FB17661196B8F9E0091052A /* DFGHeapLocation.h in Headers */,
+				0FC841691BA8C3210061837D /* DFGInferredTypeCheck.h in Headers */,
+				0FB14E211812570B009B6B4D /* DFGInlineCacheWrapper.h in Headers */,
+				0FB14E2318130955009B6B4D /* DFGInlineCacheWrapperInlines.h in Headers */,
+				A704D90617A0BAA8006BA554 /* DFGInPlaceAbstractState.h in Headers */,
+				0F2BDC21151E803B00CD8910 /* DFGInsertionSet.h in Headers */,
+				0F300B7C18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h in Headers */,
+				0F898F321B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h in Headers */,
+				0FC97F3E18202119002C9B26 /* DFGInvalidationPointInjectionPhase.h in Headers */,
+				0FEA0A34170D40BF00BB722C /* DFGJITCode.h in Headers */,
+				86EC9DCC1328DF82002B2AD7 /* DFGJITCompiler.h in Headers */,
+				A78A9779179738B8009DF744 /* DFGJITFinalizer.h in Headers */,
+				0FC97F4018202119002C9B26 /* DFGJumpReplacement.h in Headers */,
+				A73A535B1799CD5D00170C19 /* DFGLazyJSValue.h in Headers */,
+				62F2AA381B0BEDE300610C7A /* DFGLazyNode.h in Headers */,
+				A7D9A29817A0BC7400EE2618 /* DFGLICMPhase.h in Headers */,
+				79C4B15E1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h in Headers */,
+				A7D89CFC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h in Headers */,
+				0FF0F19B16B729FA005DF95B /* DFGLongLivedState.h in Headers */,
+				A767B5B617A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h in Headers */,
+				79F8FC1F1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h in Headers */,
+				0F5874EE194FEB1200AAB2C1 /* DFGMayExit.h in Headers */,
+				0F2BDC451522801B00CD8910 /* DFGMinifiedGraph.h in Headers */,
+				0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */,
+				0F2BDC461522802000CD8910 /* DFGMinifiedNode.h in Headers */,
+				0F8F14361ADF090100ED792C /* DFGMovHintRemovalPhase.h in Headers */,
+				0FF2CD5C1B61A4F8004955A8 /* DFGMultiGetByOffsetData.h in Headers */,
+				A737810E1799EA2E00817533 /* DFGNaturalLoops.h in Headers */,
+				86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */,
+				0F2017891DCB942400EA5950 /* DFGNodeAbstractValuePair.h in Headers */,
+				0FFB921B16D02F010055A5DB /* DFGNodeAllocator.h in Headers */,
+				0FA581BB150E953000B9A2D9 /* DFGNodeFlags.h in Headers */,
+				0F2017851DCAE14900EA5950 /* DFGNodeFlowProjection.h in Headers */,
+				0F300B7818AB051100A6D72E /* DFGNodeOrigin.h in Headers */,
+				0FA581BC150E953000B9A2D9 /* DFGNodeType.h in Headers */,
+				DCEE220D1CEBAF75000C2396 /* DFGNullAbstractState.h in Headers */,
+				0F2B9CE719D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.h in Headers */,
+				0F2B9CE919D0BA7D00B1D1B5 /* DFGObjectMaterializationData.h in Headers */,
+				86EC9DD01328DF82002B2AD7 /* DFGOperations.h in Headers */,
+				0F7C39FF1C90C55B00480151 /* DFGOpInfo.h in Headers */,
+				A7D89CFE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h in Headers */,
+				0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */,
+				0FD8A32617D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h in Headers */,
+				0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */,
+				0F235BEC17178E7300690C7F /* DFGOSRExitBase.h in Headers */,
+				0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers */,
+				0FC0977114693AF500CF2442 /* DFGOSRExitCompiler.h in Headers */,
+				0F7025AA1714B0FC00382C0E /* DFGOSRExitCompilerCommon.h in Headers */,
+				0F392C8A1B46188400844728 /* DFGOSRExitFuzz.h in Headers */,
+				0FEFC9AB1681A3B600567F53 /* DFGOSRExitJumpPlaceholder.h in Headers */,
+				0F235BEE17178E7300690C7F /* DFGOSRExitPreparation.h in Headers */,
+				0F6237981AE45CA700D402EA /* DFGPhantomInsertionPhase.h in Headers */,
+				0FFFC95C14EF90AF00C72532 /* DFGPhase.h in Headers */,
+				0F2B9CEB19D0BA7D00B1D1B5 /* DFGPhiChildren.h in Headers */,
+				A78A977B179738B8009DF744 /* DFGPlan.h in Headers */,
+				0F1FB3961E1AF7E100A9BE50 /* DFGPlanInlines.h in Headers */,
+				DC00039319D8BE6F00023EB0 /* DFGPreciseLocalClobberize.h in Headers */,
+				0FBE0F7516C1DB0B0082C5E8 /* DFGPredictionInjectionPhase.h in Headers */,
+				0FFFC95E14EF90B700C72532 /* DFGPredictionPropagationPhase.h in Headers */,
+				0F3E01AB19D353A500F61B7F /* DFGPrePostNumbering.h in Headers */,
+				0F2B9CED19D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.h in Headers */,
+				0FFC92161B94FB3E0071DD66 /* DFGPropertyTypeKey.h in Headers */,
+				0FB17663196B8F9E0091052A /* DFGPureValue.h in Headers */,
+				0F3A1BFA1A9ECB7D000DE01A /* DFGPutStackSinkingPhase.h in Headers */,
+				86EC9DD11328DF82002B2AD7 /* DFGRegisterBank.h in Headers */,
+				0F2FCCFC18A60070001A27F8 /* DFGSafepoint.h in Headers */,
+				A77A424317A0BBFD00A8DB81 /* DFGSafeToExecute.h in Headers */,
+				A741017F179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h in Headers */,
+				0F2FCCFD18A60070001A27F8 /* DFGScannable.h in Headers */,
+				86ECA3FA132DF25A002B2AD7 /* DFGScoreBoard.h in Headers */,
+				0F1E3A67153A21E2000F9456 /* DFGSilentRegisterSavePlan.h in Headers */,
+				0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers */,
+				86EC9DD31328DF82002B2AD7 /* DFGSpeculativeJIT.h in Headers */,
+				0F682FB319BCB36400FA3BAD /* DFGSSACalculator.h in Headers */,
+				A7D89D0017A0B8CC00773AD8 /* DFGSSAConversionPhase.h in Headers */,
+				0FC20CBA18556A3500C9E954 /* DFGSSALoweringPhase.h in Headers */,
+				0F9FB4F517FCB91700CB67F8 /* DFGStackLayoutPhase.h in Headers */,
+				0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */,
+				0F7F988C1D9596C800F4F12E /* DFGStoreBarrierClusteringPhase.h in Headers */,
+				0F9E32641B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h in Headers */,
+				0FC20CB61852E2C600C9E954 /* DFGStrengthReductionPhase.h in Headers */,
+				0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */,
+				0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */,
+				0F2FCCFF18A60070001A27F8 /* DFGThreadData.h in Headers */,
+				0FC097A2146B28CC00CF2442 /* DFGThunks.h in Headers */,
+				0FD8A32817D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.h in Headers */,
+				0FD8A32A17D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.h in Headers */,
+				0FD8A32C17D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.h in Headers */,
+				0FE7211E193B9C590031F6ED /* DFGTransition.h in Headers */,
+				0F63943F15C75F19006A597C /* DFGTypeCheckHoistingPhase.h in Headers */,
+				0FBE0F7716C1DB120082C5E8 /* DFGUnificationPhase.h in Headers */,
+				0F34B14A16D42013001CDA5A /* DFGUseKind.h in Headers */,
+				0F3B3A2C15475002003ED0FF /* DFGValidate.h in Headers */,
+				0F2BDC481522802900CD8910 /* DFGValueSource.h in Headers */,
+				0F0123331944EA1B00843A0C /* DFGValueStrength.h in Headers */,
+				0FE254F71ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.h in Headers */,
+				0F620174143FCD330068B77C /* DFGVariableAccessData.h in Headers */,
+				0FDDBFB61666EEDA00C55FEF /* DFGVariableAccessDataDump.h in Headers */,
+				0F2BDC491522809600CD8910 /* DFGVariableEvent.h in Headers */,
+				0F2BDC4B1522809D00CD8910 /* DFGVariableEventStream.h in Headers */,
+				0FFFC96014EF90BD00C72532 /* DFGVirtualRegisterAllocationPhase.h in Headers */,
+				0FC97F4218202119002C9B26 /* DFGWatchpointCollectionPhase.h in Headers */,
+				0FDB2CE8174830A2007B3C1B /* DFGWorklist.h in Headers */,
+				0F1FB3971E1AF7E300A9BE50 /* DFGWorklistInlines.h in Headers */,
+				0FE050181AA9091100D33B33 /* DirectArguments.h in Headers */,
+				0FE050161AA9091100D33B33 /* DirectArgumentsOffset.h in Headers */,
+				969A07980ED1D3AE00F1F681 /* DirectEvalCodeCache.h in Headers */,
+				14386A751DD69895008652C4 /* DirectEvalExecutable.h in Headers */,
+				0F37308F1C0CD68500052BFA /* DisallowMacroScratchRegisterUsage.h in Headers */,
+				0FF42731158EBD54004CB9FF /* Disassembler.h in Headers */,
+				E35CA1561DBC3A5F00F83516 /* DOMJITAbstractHeap.h in Headers */,
+				E3BFD0BC1DAF808E0065DEA2 /* DOMJITAccessCasePatchpointParams.h in Headers */,
+				E3555B8A1DAE03A500F36921 /* DOMJITCallDOMGetterPatchpoint.h in Headers */,
+				E3C79CAB1DB9A4DC00D1ECA4 /* DOMJITEffect.h in Headers */,
+				E3FF75331D9CEA1800C7E16D /* DOMJITGetterSetter.h in Headers */,
+				E35CA1541DBC3A5C00F83516 /* DOMJITHeapRange.h in Headers */,
+				E3C08E3C1DA41B810039478F /* DOMJITPatchpoint.h in Headers */,
+				E37AD83C1DA4928600F3D412 /* DOMJITPatchpointParams.h in Headers */,
+				E37AD83D1DA4928600F3D412 /* DOMJITReg.h in Headers */,
+				E350708A1DC49BBF0089BCD6 /* DOMJITSignature.h in Headers */,
+				E32FF1EA1DA7571C00A8BF21 /* DOMJITSlowPathCalls.h in Headers */,
+				E3FFC8531DAD7D1500DEA53E /* DOMJITValue.h in Headers */,
+				A70447EE17A0BD7000F5898E /* DumpContext.h in Headers */,
+				FE318FE01CAC982F00DFCC54 /* ECMAScriptSpecInternalFunctions.h in Headers */,
+				2A83638618D7D0EE0000EBCC /* EdenGCActivityCallback.h in Headers */,
+				99E45A2418A1B2590026D88F /* EmptyInputCursor.h in Headers */,
+				99E45A2618A1B2590026D88F /* EncodedValue.h in Headers */,
+				2AD2EDFB19799E38004D6478 /* EnumerationMode.h in Headers */,
+				BC3046070E1F497F003232CF /* Error.h in Headers */,
+				BC02E90D0E1839DB000F9297 /* ErrorConstructor.h in Headers */,
+				FEB58C15187B8B160098EF0B /* ErrorHandlingScope.h in Headers */,
+				BC02E98D0E183E38000F9297 /* ErrorInstance.h in Headers */,
+				BC02E90F0E1839DB000F9297 /* ErrorPrototype.h in Headers */,
+				996B731B1BDA08D100331B84 /* ErrorPrototype.lut.h in Headers */,
+				14AD910C1DCA92940014F9FE /* EvalCodeBlock.h in Headers */,
+				147341D21DC02E2E00AA29BA /* EvalExecutable.h in Headers */,
+				A54982041891D0B00081E5B8 /* EventLoop.h in Headers */,
+				FE1C0FFD1B193E9800B53FCA /* Exception.h in Headers */,
+				FE6029D91D6E1E4F0030204D /* ExceptionEventLocation.h in Headers */,
+				0F12DE101979D5FD0006FF4E /* ExceptionFuzz.h in Headers */,
+				BC18C4000E16F5CD00B34460 /* ExceptionHelpers.h in Headers */,
+				FE6491371D78F01D00A694D4 /* ExceptionScope.h in Headers */,
+				0FF054FA1AC35B4400E5BE57 /* ExecutableAllocationFuzz.h in Headers */,
+				A766B44F0EE8DCD1009518CA /* ExecutableAllocator.h in Headers */,
+				147341CC1DC02D7200AA29BA /* ExecutableBase.h in Headers */,
+				14142E531B796EDD00F4BF4B /* ExecutableInfo.h in Headers */,
+				0F56A1D315000F35002992B1 /* ExecutionCounter.h in Headers */,
+				0F3AC754188E5EC80032029F /* ExitingJITType.h in Headers */,
+				0FB105861675481200F8AB6E /* ExitKind.h in Headers */,
+				0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */,
+				A7A8AF3817ADB5F3005AB174 /* Float32Array.h in Headers */,
+				A7A8AF3917ADB5F3005AB174 /* Float64Array.h in Headers */,
+				0F24E54317EA9F5900ABB217 /* FPRInfo.h in Headers */,
+				E34EDBF71DB5FFC900DC87A5 /* FrameTracers.h in Headers */,
+				0F5513A61D5A682C00C32BD8 /* FreeList.h in Headers */,
+				0FDB2CC9173DA520007B3C1B /* FTLAbbreviatedTypes.h in Headers */,
+				0FEA0A1D1708B00700BB722C /* FTLAbstractHeap.h in Headers */,
+				0FEA0A1F1708B00700BB722C /* FTLAbstractHeapRepository.h in Headers */,
+				0F485328187DFDEC0083B687 /* FTLAvailableRecovery.h in Headers */,
+				0FEA0A0A170513DB00BB722C /* FTLCapabilities.h in Headers */,
+				0FEA0A231709606900BB722C /* FTLCommonValues.h in Headers */,
+				0FEA0A0C170513DB00BB722C /* FTLCompile.h in Headers */,
+				E322E5A71DA644A8006E7709 /* FTLDOMJITPatchpointParams.h in Headers */,
+				0F9D4C0D1C3E1C11006CD984 /* FTLExceptionTarget.h in Headers */,
+				0F235BD417178E1C00690C7F /* FTLExitArgument.h in Headers */,
+				0F235BD617178E1C00690C7F /* FTLExitArgumentForOperand.h in Headers */,
+				0F2B9CF519D0BAC100B1D1B5 /* FTLExitPropertyValue.h in Headers */,
+				0F2B9CF719D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.h in Headers */,
+				0F235BDB17178E1C00690C7F /* FTLExitValue.h in Headers */,
+				A7F2996C17A0BB670010417A /* FTLFail.h in Headers */,
+				0FEA0A2C170B661900BB722C /* FTLFormattedValue.h in Headers */,
+				0FD8A31A17D51F2200CA2C40 /* FTLForOSREntryJITCode.h in Headers */,
+				A78A977F179738D5009DF744 /* FTLGeneratedFunction.h in Headers */,
+				0FEA0A0E170513DB00BB722C /* FTLJITCode.h in Headers */,
+				A78A9781179738D5009DF744 /* FTLJITFinalizer.h in Headers */,
+				0FB4FB741BC843140025CA5A /* FTLLazySlowPath.h in Headers */,
+				0FB4FB751BC843140025CA5A /* FTLLazySlowPathCall.h in Headers */,
+				0F8F2B96172E04A3007DBDA5 /* FTLLink.h in Headers */,
+				0FCEFAE0180738C000472CE4 /* FTLLocation.h in Headers */,
+				0FEA0A10170513DB00BB722C /* FTLLowerDFGToB3.h in Headers */,
+				A7D89D0217A0B90400773AD8 /* FTLLoweredNodeValue.h in Headers */,
+				0F2B9CF919D0BAC100B1D1B5 /* FTLOperations.h in Headers */,
+				0FD8A31C17D51F2200CA2C40 /* FTLOSREntry.h in Headers */,
+				0F235BDD17178E1C00690C7F /* FTLOSRExit.h in Headers */,
+				0F235BE017178E1C00690C7F /* FTLOSRExitCompiler.h in Headers */,
+				0F9B1DB81C0E42BD00E5BFD2 /* FTLOSRExitHandle.h in Headers */,
+				269D636E1BFBE5D100101B1D /* FTLOutput.h in Headers */,
+				0F9D4C111C3E2C74006CD984 /* FTLPatchpointExceptionHandle.h in Headers */,
+				0F48532A187DFDEC0083B687 /* FTLRecoveryOpcode.h in Headers */,
+				0FCEFAAC1804C13E00472CE4 /* FTLSaveRestore.h in Headers */,
+				0F25F1B2181635F300522F39 /* FTLSlowPathCall.h in Headers */,
+				0F25F1B4181635F300522F39 /* FTLSlowPathCallKey.h in Headers */,
+				0F235BD717178E1C00690C7F /* FTLStackmapArgumentList.h in Headers */,
+				0FEA0A12170513DB00BB722C /* FTLState.h in Headers */,
+				A7FCC26D17A0B6AA00786D1A /* FTLSwitchCase.h in Headers */,
+				0F235BE217178E1C00690C7F /* FTLThunks.h in Headers */,
+				0FEA0A201708B00700BB722C /* FTLTypedPointer.h in Headers */,
+				0FDB2CCA173DA523007B3C1B /* FTLValueFromBlock.h in Headers */,
+				0F5A6284188C98D40072C9DF /* FTLValueRange.h in Headers */,
+				0F0332C618B53FA9005F979A /* FTLWeight.h in Headers */,
+				0F0332C818B546EC005F979A /* FTLWeightedTarget.h in Headers */,
+				0F666EC1183566F900D017F1 /* FullBytecodeLiveness.h in Headers */,
+				2A83638A18D7D0FE0000EBCC /* FullGCActivityCallback.h in Headers */,
+				14AD910D1DCA92940014F9FE /* FunctionCodeBlock.h in Headers */,
+				BC18C4040E16F5CD00B34460 /* FunctionConstructor.h in Headers */,
+				147341D81DC02F9900AA29BA /* FunctionExecutable.h in Headers */,
+				0FF0F1A016B72A1A005DF95B /* FunctionExecutableDump.h in Headers */,
+				52B310FB1974AE610080857C /* FunctionHasExecutedCache.h in Headers */,
+				FE4BFF2C1AD476E700088F87 /* FunctionOverrides.h in Headers */,
+				BC18C4050E16F5CD00B34460 /* FunctionPrototype.h in Headers */,
+				62D2D3901ADF103F000206C1 /* FunctionRareData.h in Headers */,
+				FEA0C4031CDD7D1D00481991 /* FunctionWhitelist.h in Headers */,
+				2AACE63D18CA5A0300ED0191 /* GCActivityCallback.h in Headers */,
+				BCBE2CAE14E985AA000593AD /* GCAssertions.h in Headers */,
+				0F766D3015A8DCE2008F363E /* GCAwareJITStubRoutine.h in Headers */,
+				0FB4767E1D99AEA9008EA6CB /* GCDeferralContext.h in Headers */,
+				0FB4767F1D99AEAD008EA6CB /* GCDeferralContextInlines.h in Headers */,
+				0F2B66AC17B6B53F00A7AE3F /* GCIncomingRefCounted.h in Headers */,
+				0F2B66AD17B6B54500A7AE3F /* GCIncomingRefCountedInlines.h in Headers */,
+				0F2B66AE17B6B54500A7AE3F /* GCIncomingRefCountedSet.h in Headers */,
+				0F2B66AF17B6B54500A7AE3F /* GCIncomingRefCountedSetInlines.h in Headers */,
+				2AABCDE718EF294200002096 /* GCLogging.h in Headers */,
+				A54E8EB018BFFBBB00556D28 /* GCSegmentedArray.h in Headers */,
+				A54E8EB118BFFBBE00556D28 /* GCSegmentedArrayInlines.h in Headers */,
+				0F86A26F1D6F7B3300CB0C92 /* GCTypeMap.h in Headers */,
+				9959E9311BD18272001AA413 /* generate-combined-inspector-json.py in Headers */,
+				C4703CC0192844960013FBEA /* generate-inspector-protocol-bindings.py in Headers */,
+				FE3022D91E43C93400BAC493 /* JSVirtualMachinePrivate.h in Headers */,
+				99DA00AF1BD5994E00F4575C /* generate-js-builtins.py in Headers */,
+				A5EA70EC19F5B3EA0098F5EC /* generate_cpp_alternate_backend_dispatcher_header.py in Headers */,
+				A5EF9B141A1D43F600702E90 /* generate_cpp_backend_dispatcher_header.py in Headers */,
+				A5EF9B151A1D43FA00702E90 /* generate_cpp_backend_dispatcher_implementation.py in Headers */,
+				A5EF9B161A1D440000702E90 /* generate_cpp_frontend_dispatcher_header.py in Headers */,
+				A5EF9B171A1D440300702E90 /* generate_cpp_frontend_dispatcher_implementation.py in Headers */,
+				A5EF9B181A1D440600702E90 /* generate_cpp_protocol_types_header.py in Headers */,
+				A5EF9B191A1D440700702E90 /* generate_cpp_protocol_types_implementation.py in Headers */,
+				C4703CCE192844CC0013FBEA /* generate_js_backend_commands.py in Headers */,
+				A5EA710319F6DE6F0098F5EC /* generate_objc_backend_dispatcher_header.py in Headers */,
+				A5EA710419F6DE720098F5EC /* generate_objc_backend_dispatcher_implementation.py in Headers */,
+				A5EA710519F6DE740098F5EC /* generate_objc_configuration_header.py in Headers */,
+				A5EA710619F6DE760098F5EC /* generate_objc_configuration_implementation.py in Headers */,
+				A5EA710819F6DE7A0098F5EC /* generate_objc_frontend_dispatcher_implementation.py in Headers */,
+				A5EA710919F6DE7C0098F5EC /* generate_objc_header.py in Headers */,
+				A5EA710A19F6DE7E0098F5EC /* generate_objc_internal_header.py in Headers */,
+				A5EA710719F6DE780098F5EC /* generate_objc_protocol_type_conversions_header.py in Headers */,
+				990DA67F1C8E316A00295159 /* generate_objc_protocol_type_conversions_implementation.py in Headers */,
+				C4F4B6F51A05C984005CAB76 /* generate_objc_protocol_types_implementation.py in Headers */,
+				C4703CD6192844CC0013FBEA /* generator.py in Headers */,
+				C4703CD5192844CC0013FBEA /* generator_templates.py in Headers */,
+				70B791951C024A28002481E2 /* GeneratorFunctionConstructor.h in Headers */,
+				70B791971C024A29002481E2 /* GeneratorFunctionPrototype.h in Headers */,
+				70B791991C024A29002481E2 /* GeneratorPrototype.h in Headers */,
+				70B7919D1C024A56002481E2 /* GeneratorPrototype.lut.h in Headers */,
+				0FE050191AA9091100D33B33 /* GenericArguments.h in Headers */,
+				0FE0501A1AA9091100D33B33 /* GenericArgumentsInlines.h in Headers */,
+				0FE0501B1AA9091100D33B33 /* GenericOffset.h in Headers */,
+				0F2B66E017B6B5AB00A7AE3F /* GenericTypedArrayView.h in Headers */,
+				0F2B66E117B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h in Headers */,
+				0F9332A014CA7DCD0085F3C6 /* GetByIdStatus.h in Headers */,
+				0F0332C418B01763005F979A /* GetByIdVariant.h in Headers */,
+				7964656A1B952FF0003059EE /* GetPutInfo.h in Headers */,
+				14AD910E1DCA92940014F9FE /* GlobalCodeBlock.h in Headers */,
+				0F24E54417EA9F5900ABB217 /* GPRInfo.h in Headers */,
+				142E3134134FF0A600AFADB5 /* Handle.h in Headers */,
+				C283190016FE4B7D00157BFD /* HandleBlock.h in Headers */,
+				C283190216FE533E00157BFD /* HandleBlockInlines.h in Headers */,
+				0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */,
+				142E3136134FF0A600AFADB5 /* HandleSet.h in Headers */,
+				142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */,
+				1478297B1379E8A800A7C2A3 /* HandleTypes.h in Headers */,
+				79A090801D768465008B889B /* HashMapImpl.h in Headers */,
+				79DFCBDB1D88C59600527D03 /* HasOwnPropertyCache.h in Headers */,
+				14BA7A9813AADFF8005B7C2C /* Heap.h in Headers */,
+				DC3D2B0A1D34316200BA918C /* HeapCell.h in Headers */,
+				0F070A491D543A93006E7232 /* HeapCellInlines.h in Headers */,
+				0F32BD111BB34F190093A57F /* HeapHelperPool.h in Headers */,
+				C2DA778318E259990066FCB6 /* HeapInlines.h in Headers */,
+				2AD8932B17E3868F00668276 /* HeapIterationScope.h in Headers */,
+				A5339EC91BB4B4600054F005 /* HeapObserver.h in Headers */,
+				A5398FAB1C750DA40060A963 /* HeapProfiler.h in Headers */,
+				A54C2AB11C6544F200A18D78 /* HeapSnapshot.h in Headers */,
+				A5311C361C77CEC500E6B1B6 /* HeapSnapshotBuilder.h in Headers */,
+				C24D31E3161CD695002AA4DB /* HeapStatistics.h in Headers */,
+				C2E526BE1590EF000054E48D /* HeapTimer.h in Headers */,
+				0FADE6731D4D23BE00768457 /* HeapUtil.h in Headers */,
+				FE7BA6101A1A7CEC00F1F7B4 /* HeapVerifier.h in Headers */,
+				0FA762091DB9283E00B7A2FD /* HelpingGCScope.h in Headers */,
+				0F4680D514BBD24B00BFE272 /* HostCallReturnValue.h in Headers */,
+				DC2143071CA32E55000A8869 /* ICStats.h in Headers */,
+				BC18C40F0E16F5CD00B34460 /* Identifier.h in Headers */,
+				8606DDEA18DA44AB00A383D0 /* IdentifierInlines.h in Headers */,
+				A5FD0076189B038C00633231 /* IdentifiersFactory.h in Headers */,
+				C25F8BCE157544A900245B71 /* IncrementalSweeper.h in Headers */,
+				0FB7F39915ED8E4600F167B2 /* IndexingHeader.h in Headers */,
+				0FB7F39A15ED8E4600F167B2 /* IndexingHeaderInlines.h in Headers */,
+				0FB7F39B15ED8E4600F167B2 /* IndexingType.h in Headers */,
+				14386A791DD6989C008652C4 /* IndirectEvalExecutable.h in Headers */,
+				0F0A75231B94BFA900110660 /* InferredType.h in Headers */,
+				0FFC92121B94D4DF0071DD66 /* InferredTypeTable.h in Headers */,
+				0FF8BDEB1AD4CF7100DFE884 /* InferredValue.h in Headers */,
+				BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */,
+				A513E5B8185B8BD3007E95AD /* InjectedScript.h in Headers */,
+				A514B2C3185A684400F3C7CB /* InjectedScriptBase.h in Headers */,
+				A513E5BE185BFACC007E95AD /* InjectedScriptHost.h in Headers */,
+				A513E5CB185F9624007E95AD /* InjectedScriptManager.h in Headers */,
+				A5840E21187B7B8600843B10 /* InjectedScriptModule.h in Headers */,
+				A513E5C7185F9446007E95AD /* InjectedScriptSource.h in Headers */,
+				9959E9321BD18279001AA413 /* inline-and-minify-stylesheets-and-scripts.py in Headers */,
+				7905BB691D12050E0019FE57 /* InlineAccess.h in Headers */,
+				148A7BF01B82975A002D9157 /* InlineCallFrame.h in Headers */,
+				0F24E55617F0B71C00ABB217 /* InlineCallFrameSet.h in Headers */,
+				99E45A2718A1B2590026D88F /* InputCursor.h in Headers */,
+				A584032018BFFBE1005A0811 /* InspectorAgent.h in Headers */,
+				A593CF7F1840362C00BFCE27 /* InspectorAgentBase.h in Headers */,
+				A593CF87184038CA00BFCE27 /* InspectorAgentRegistry.h in Headers */,
+				A5EA710E19F6DF810098F5EC /* InspectorAlternateBackendDispatchers.h in Headers */,
+				996231E918D1804200C03FDA /* InspectorBackendCommands.js in Headers */,
+				A593CF7D1840360300BFCE27 /* InspectorBackendDispatcher.h in Headers */,
+				A532438818568335002ED692 /* InspectorBackendDispatchers.h in Headers */,
+				A5FD0082189B191A00633231 /* InspectorConsoleAgent.h in Headers */,
+				A57D23E61890CEBF0031C7FA /* InspectorDebuggerAgent.h in Headers */,
+				A5D0A1BB1862301B00C7B496 /* InspectorEnvironment.h in Headers */,
+				A5945595182479EB00CC3843 /* InspectorFrontendChannel.h in Headers */,
+				A532438A18568335002ED692 /* InspectorFrontendDispatchers.h in Headers */,
+				99F1A7011B98FBEC00463B26 /* InspectorFrontendRouter.h in Headers */,
+				A5339EC61BB399A60054F005 /* InspectorHeapAgent.h in Headers */,
+				E35E03601B7AB43E0073AD2A /* InspectorInstrumentationObject.h in Headers */,
+				E33B3E261B7ABD750048DB2E /* InspectorInstrumentationObject.lut.h in Headers */,
+				A532438C18568335002ED692 /* InspectorProtocolObjects.h in Headers */,
+				A55D93AC18514F7900400DED /* InspectorProtocolTypes.h in Headers */,
+				A50E4B6218809DD50068A46D /* InspectorRuntimeAgent.h in Headers */,
+				A55165D31BDF0B9E003B75C1 /* InspectorScriptProfilerAgent.h in Headers */,
+				A593CF831840377100BFCE27 /* InspectorValues.h in Headers */,
+				969A07990ED1D3AE00F1F681 /* Instruction.h in Headers */,
+				A7A8AF3B17ADB5F3005AB174 /* Int16Array.h in Headers */,
+				A7A8AF3C17ADB5F3005AB174 /* Int32Array.h in Headers */,
+				A7A8AF3A17ADB5F3005AB174 /* Int8Array.h in Headers */,
+				BC11667B0E199C05008066DD /* InternalFunction.h in Headers */,
+				53F6BF6D1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h in Headers */,
+				1429D77C0ED20D7300B89619 /* Interpreter.h in Headers */,
+				E39D45F51D39005600B3B377 /* InterpreterInlines.h in Headers */,
+				A1B9E23A1B4E0D6700BC7FED /* IntlCollator.h in Headers */,
+				A1B9E23C1B4E0D6700BC7FED /* IntlCollatorConstructor.h in Headers */,
+				A18193E31B4E0CDB00FC1029 /* IntlCollatorConstructor.lut.h in Headers */,
+				A1B9E23E1B4E0D6700BC7FED /* IntlCollatorPrototype.h in Headers */,
+				A18193E41B4E0CDB00FC1029 /* IntlCollatorPrototype.lut.h in Headers */,
+				A1587D6E1B4DC14100D69849 /* IntlDateTimeFormat.h in Headers */,
+				A1587D701B4DC14100D69849 /* IntlDateTimeFormatConstructor.h in Headers */,
+				A1587D751B4DC1C600D69849 /* IntlDateTimeFormatConstructor.lut.h in Headers */,
+				A1587D721B4DC14100D69849 /* IntlDateTimeFormatPrototype.h in Headers */,
+				A1587D761B4DC1C600D69849 /* IntlDateTimeFormatPrototype.lut.h in Headers */,
+				A1D792FD1B43864B004516F5 /* IntlNumberFormat.h in Headers */,
+				A1D792FF1B43864B004516F5 /* IntlNumberFormatConstructor.h in Headers */,
+				A125846E1B45A36000CC7F6C /* IntlNumberFormatConstructor.lut.h in Headers */,
+				A1D793011B43864B004516F5 /* IntlNumberFormatPrototype.h in Headers */,
+				A125846F1B45A36000CC7F6C /* IntlNumberFormatPrototype.lut.h in Headers */,
+				A12BBFF21B044A8B00664B69 /* IntlObject.h in Headers */,
+				708EBE241CE8F35800453146 /* IntlObjectInlines.h in Headers */,
+				860BD801148EA6F200112B2F /* Intrinsic.h in Headers */,
+				8B9F6D561D5912FA001C739F /* IterationKind.h in Headers */,
+				FE4D55B81AE716CA0052E459 /* IterationStatus.h in Headers */,
+				70113D4C1A8DB093003848C4 /* IteratorOperations.h in Headers */,
+				70DC3E0A1B2DF2C700054299 /* IteratorPrototype.h in Headers */,
+				BC18C4130E16F5CD00B34460 /* JavaScript.h in Headers */,
+				A503FA1A188E0FB000110F14 /* JavaScriptCallFrame.h in Headers */,
+				BC18C4140E16F5CD00B34460 /* JavaScriptCore.h in Headers */,
+				BC18C4150E16F5CD00B34460 /* JavaScriptCorePrefix.h in Headers */,
+				1429D9300ED22D7000B89619 /* JIT.h in Headers */,
+				FE1220271BE7F58C0039E6F2 /* JITAddGenerator.h in Headers */,
+				FE3A06B21C10CB8900390FDD /* JITBitAndGenerator.h in Headers */,
+				FE3A06A81C10BC8100390FDD /* JITBitBinaryOpGenerator.h in Headers */,
+				FE3A06A61C10B72D00390FDD /* JITBitOrGenerator.h in Headers */,
+				FE3A06B41C10CB9300390FDD /* JITBitXorGenerator.h in Headers */,
+				86CCEFDE0F413F8900FD7F9E /* JITCode.h in Headers */,
+				0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */,
+				0FAF7EFE165BA91F000C8455 /* JITDisassembler.h in Headers */,
+				FE187A0D1C030D5C0038BBCA /* JITDivGenerator.h in Headers */,
+				0F46808214BA572D00BFE272 /* JITExceptions.h in Headers */,
+				0FB14E1F18124ACE009B6B4D /* JITInlineCacheGenerator.h in Headers */,
+				86CC85A10EE79A4700288682 /* JITInlines.h in Headers */,
+				FE3A06BE1C11041200390FDD /* JITLeftShiftGenerator.h in Headers */,
+				79233C2B1D34715700C5A834 /* JITMathIC.h in Headers */,
+				79B1788E1D399B8000B1A567 /* JITMathICForwards.h in Headers */,
+				79AF0BE41D3EFD4C00E95FA5 /* JITMathICInlineResult.h in Headers */,
+				FE187A021BFBE5610038BBCA /* JITMulGenerator.h in Headers */,
+				FE99B2491C24C3D300C82159 /* JITNegGenerator.h in Headers */,
+				0F24E54D17EE274900ABB217 /* JITOperations.h in Headers */,
+				FE3A06C01C11041A00390FDD /* JITRightShiftGenerator.h in Headers */,
+				0F766D3115AA8112008F363E /* JITStubRoutine.h in Headers */,
+				0F766D2C15A8CC3A008F363E /* JITStubRoutineSet.h in Headers */,
+				0F5EF91F16878F7D003E5C25 /* JITThunks.h in Headers */,
+				0FC712E317CD8793008CC93C /* JITToDFGDeferredCompilationCallback.h in Headers */,
+				DC0184191D10C1890057B053 /* JITWorklist.h in Headers */,
+				840480131021A1D9008E7F01 /* JSAPIValueWrapper.h in Headers */,
+				C2CF39C216E15A8100DD69BE /* JSAPIWrapperObject.h in Headers */,
+				BC18C4170E16F5CD00B34460 /* JSArray.h in Headers */,
+				0F2B66E317B6B5AB00A7AE3F /* JSArrayBuffer.h in Headers */,
+				0F2B66E517B6B5AB00A7AE3F /* JSArrayBufferConstructor.h in Headers */,
+				0F2B66E717B6B5AB00A7AE3F /* JSArrayBufferPrototype.h in Headers */,
+				0F2B66E917B6B5AB00A7AE3F /* JSArrayBufferView.h in Headers */,
+				0F2B66EA17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h in Headers */,
+				539FB8BA1C99DA7C00940FA1 /* JSArrayInlines.h in Headers */,
+				5B70CFDE1DB69E6600EC23F9 /* JSAsyncFunction.h in Headers */,
+				BC18C4180E16F5CD00B34460 /* JSBase.h in Headers */,
+				140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */,
+				86FA9E92142BBB2E001773B7 /* JSBoundFunction.h in Headers */,
+				BC18C4190E16F5CD00B34460 /* JSCallbackConstructor.h in Headers */,
+				BC18C41A0E16F5CD00B34460 /* JSCallbackFunction.h in Headers */,
+				BC18C41B0E16F5CD00B34460 /* JSCallbackObject.h in Headers */,
+				BC18C41C0E16F5CD00B34460 /* JSCallbackObjectFunctions.h in Headers */,
+				657CF45919BF6662004ACBF2 /* JSCallee.h in Headers */,
+				A7D801A91880D6A80026C39B /* JSCBuiltins.h in Headers */,
+				BC1167DA0E19BCC9008066DD /* JSCell.h in Headers */,
+				0F9749711687ADE400A4FF6A /* JSCellInlines.h in Headers */,
+				0F1DD84A18A945BE0026F3FA /* JSCInlines.h in Headers */,
+				BC18C42B0E16F5CD00B34460 /* JSCJSValue.h in Headers */,
+				865A30F1135007E100CDB49E /* JSCJSValueInlines.h in Headers */,
+				BC18C41D0E16F5CD00B34460 /* JSClassRef.h in Headers */,
+				86E3C613167BABD7006D760A /* JSContext.h in Headers */,
+				86E3C617167BABEE006D760A /* JSContextInternal.h in Headers */,
+				A58C024218E4A41A00032BC5 /* JSContextPrivate.h in Headers */,
+				BC18C41E0E16F5CD00B34460 /* JSContextRef.h in Headers */,
+				A5EA70EE19F5B5C40098F5EC /* JSContextRefInspectorSupport.h in Headers */,
+				A5D2E665195E174000A518E7 /* JSContextRefInternal.h in Headers */,
+				148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */,
+				A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */,
+				72AAF7CE1D0D31B3005E60BE /* JSCustomGetterSetterFunction.h in Headers */,
+				0F2B66EC17B6B5AB00A7AE3F /* JSDataView.h in Headers */,
+				0F2B66EE17B6B5AB00A7AE3F /* JSDataViewPrototype.h in Headers */,
+				996B731C1BDA08DD00331B84 /* JSDataViewPrototype.lut.h in Headers */,
+				978801411471AD920041B016 /* JSDateMath.h in Headers */,
+				C2A7F688160432D400F76B98 /* JSDestructibleObject.h in Headers */,
+				0F7DF13C1E2971130095951B /* JSDestructibleObjectSubspace.h in Headers */,
+				FE384EE61ADDB7AD0055DE2C /* JSDollarVM.h in Headers */,
+				FE384EE81ADDB7AD0055DE2C /* JSDollarVMPrototype.h in Headers */,
+				BC18C42D0E16F5CD00B34460 /* JSEnvironmentRecord.h in Headers */,
+				86E3C614167BABD7006D760A /* JSExport.h in Headers */,
+				A7B4ACAF1484C9CE00B38A36 /* JSExportMacros.h in Headers */,
+				798937791DCAB57300F8D4FB /* JSFixedArray.h in Headers */,
+				0F2B66EF17B6B5AB00A7AE3F /* JSFloat32Array.h in Headers */,
+				0F2B66F017B6B5AB00A7AE3F /* JSFloat64Array.h in Headers */,
+				BC18C41F0E16F5CD00B34460 /* JSFunction.h in Headers */,
+				A72028BA1797603D0098028C /* JSFunctionInlines.h in Headers */,
+				70B7919C1C024A49002481E2 /* JSGeneratorFunction.h in Headers */,
+				0F2B66F117B6B5AB00A7AE3F /* JSGenericTypedArrayView.h in Headers */,
+				0F2B66F217B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructor.h in Headers */,
+				0F2B66F317B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructorInlines.h in Headers */,
+				0F2B66F417B6B5AB00A7AE3F /* JSGenericTypedArrayViewInlines.h in Headers */,
+				0F2B66F517B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h in Headers */,
+				53917E7B1B7906FA000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h in Headers */,
+				0F2B66F617B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h in Headers */,
+				797E07AA1B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h in Headers */,
+				BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */,
+				996B731D1BDA08EF00331B84 /* JSGlobalObject.lut.h in Headers */,
+				A5FD0086189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h in Headers */,
+				A5C3A1A618C0490200C9593A /* JSGlobalObjectConsoleClient.h in Headers */,
+				A59455931824744700CC3843 /* JSGlobalObjectDebuggable.h in Headers */,
+				A57D23EA1891B0770031C7FA /* JSGlobalObjectDebuggerAgent.h in Headers */,
+				BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */,
+				79B819931DD25CF500DDC714 /* JSGlobalObjectInlines.h in Headers */,
+				A51007C1187CC3C600B38879 /* JSGlobalObjectInspectorController.h in Headers */,
+				A50E4B6418809DD50068A46D /* JSGlobalObjectRuntimeAgent.h in Headers */,
+				A503FA2A188F105900110F14 /* JSGlobalObjectScriptDebugServer.h in Headers */,
+				A513E5C0185BFACC007E95AD /* JSInjectedScriptHost.h in Headers */,
+				7980C16D1E3A940E00B71615 /* DFGRegisteredStructureSet.h in Headers */,
+				A513E5C2185BFACC007E95AD /* JSInjectedScriptHostPrototype.h in Headers */,
+				C442CB251A6CDB8C005D3D7C /* JSInputs.json in Headers */,
+				0F2B66F817B6B5AB00A7AE3F /* JSInt16Array.h in Headers */,
+				0F2B66F917B6B5AB00A7AE3F /* JSInt32Array.h in Headers */,
+				0F2B66F717B6B5AB00A7AE3F /* JSInt8Array.h in Headers */,
+				A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */,
+				E33F50811B8429A400413856 /* JSInternalPromise.h in Headers */,
+				E33F50791B84225700413856 /* JSInternalPromiseConstructor.h in Headers */,
+				E33F50871B8449EF00413856 /* JSInternalPromiseConstructor.lut.h in Headers */,
+				E33F50851B8437A000413856 /* JSInternalPromiseDeferred.h in Headers */,
+				E33F50751B8421C000413856 /* JSInternalPromisePrototype.h in Headers */,
+				A503FA1E188E0FB000110F14 /* JSJavaScriptCallFramePrototype.h in Headers */,
+				7013CA8C1B491A9400CAE613 /* JSJob.h in Headers */,
+				BC18C4160E16F5CD00B34460 /* JSLexicalEnvironment.h in Headers */,
+				BC18C4230E16F5CD00B34460 /* JSLock.h in Headers */,
+				C25D709C16DE99F400FCA6BC /* JSManagedValue.h in Headers */,
+				2A4BB7F318A41179008A0FCD /* JSManagedValueInternal.h in Headers */,
+				A700874217CBE8EB00C3E643 /* JSMap.h in Headers */,
+				A74DEF96182D991400522C22 /* JSMapIterator.h in Headers */,
+				9959E92D1BD17FA4001AA413 /* jsmin.py in Headers */,
+				E3D239C91B829C1C00BBEF67 /* JSModuleEnvironment.h in Headers */,
+				D9722752DC54459B9125B539 /* JSModuleLoader.h in Headers */,
+				E318CBC11B8AEF5100A2929D /* JSModuleNamespaceObject.h in Headers */,
+				E39DA4A71B7E8B7C0084F33A /* JSModuleRecord.h in Headers */,
+				E33E8D1D1B9013C300346B52 /* JSNativeStdFunction.h in Headers */,
+				BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */,
+				0F93275F1C21EF7F00CF6564 /* JSObjectInlines.h in Headers */,
+				BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */,
+				A7280A2811557E3000D56957 /* JSObjectRefPrivate.h in Headers */,
+				A7F9935F0FD7325100A0B2D0 /* JSONObject.h in Headers */,
+				BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */,
+				7C184E1B17BEDBD3007CB63A /* JSPromise.h in Headers */,
+				7C184E2317BEE240007CB63A /* JSPromiseConstructor.h in Headers */,
+				996B731E1BDA08EF00331B84 /* JSPromiseConstructor.lut.h in Headers */,
+				7C008CDB187124BB00955C24 /* JSPromiseDeferred.h in Headers */,
+				7C184E1F17BEE22E007CB63A /* JSPromisePrototype.h in Headers */,
+				996B731F1BDA08EF00331B84 /* JSPromisePrototype.lut.h in Headers */,
+				2A05ABD61961DF2400341750 /* JSPropertyNameEnumerator.h in Headers */,
+				E3EF88751B66DF23003F26CB /* JSPropertyNameIterator.h in Headers */,
+				862553D216136E1A009F17D0 /* JSProxy.h in Headers */,
+				A552C3801ADDB8FE00139726 /* JSRemoteInspector.h in Headers */,
+				9928FF3C18AC4AEC00B8CF12 /* JSReplayInputs.h in Headers */,
+				BC18C4260E16F5CD00B34460 /* JSRetainPtr.h in Headers */,
+				14874AE615EBDE4A002E3587 /* JSScope.h in Headers */,
+				9064337DD4B0402BAF34A592 /* JSScriptFetcher.h in Headers */,
+				A7C0C4AC168103020017011D /* JSScriptRefPrivate.h in Headers */,
+				0F919D11157F332C004A4E7D /* JSSegmentedVariableObject.h in Headers */,
+				0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectSubspace.h in Headers */,
+				A7299D9E17D12837005F5FF9 /* JSSet.h in Headers */,
+				A790DD70182F499700588807 /* JSSetIterator.h in Headers */,
+				BDFCB2BBE90F41349E1B0BED /* JSSourceCode.h in Headers */,
+				BC18C4270E16F5CD00B34460 /* JSString.h in Headers */,
+				86E85539111B9968001AF51E /* JSStringBuilder.h in Headers */,
+				FEFD6FC61D5E7992008F2F0B /* JSStringInlines.h in Headers */,
+				70EC0EC31AA0D7DA00B6AAFA /* JSStringIterator.h in Headers */,
+				2600B5A7152BAAA70091EE5F /* JSStringJoiner.h in Headers */,
+				BC18C4280E16F5CD00B34460 /* JSStringRef.h in Headers */,
+				BC18C4290E16F5CD00B34460 /* JSStringRefCF.h in Headers */,
+				1A28D4A8177B71C80007FA3C /* JSStringRefPrivate.h in Headers */,
+				0F7DF13F1E2AFC4D0095951B /* JSStringSubspace.h in Headers */,
+				0F919D0D157EE0A2004A4E7D /* JSSymbolTableObject.h in Headers */,
+				70ECA6061AFDBEA200449739 /* JSTemplateRegistryKey.h in Headers */,
+				BC18C42A0E16F5CD00B34460 /* JSType.h in Headers */,
+				53486BB71C1795C300F6F3AF /* JSTypedArray.h in Headers */,
+				0F2B66FB17B6B5AB00A7AE3F /* JSTypedArrayConstructors.h in Headers */,
+				0F2B66FD17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.h in Headers */,
+				0F2B66FF17B6B5AB00A7AE3F /* JSTypedArrays.h in Headers */,
+				534C457C1BC72411007476A7 /* JSTypedArrayViewConstructor.h in Headers */,
+				DEA7E2451BBC677F00D78440 /* JSTypedArrayViewPrototype.h in Headers */,
+				6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */,
+				0F2B670217B6B5AB00A7AE3F /* JSUint16Array.h in Headers */,
+				0F2B670317B6B5AB00A7AE3F /* JSUint32Array.h in Headers */,
+				0F2B670017B6B5AB00A7AE3F /* JSUint8Array.h in Headers */,
+				0F2B670117B6B5AB00A7AE3F /* JSUint8ClampedArray.h in Headers */,
+				86E3C612167BABD7006D760A /* JSValue.h in Headers */,
+				86E3C61B167BABEE006D760A /* JSValueInternal.h in Headers */,
+				BC18C42C0E16F5CD00B34460 /* JSValueRef.h in Headers */,
+				86E3C615167BABD7006D760A /* JSVirtualMachine.h in Headers */,
+				86E3C61D167BABEE006D760A /* JSVirtualMachineInternal.h in Headers */,
+				A7CA3AE817DA41AE006538AF /* JSWeakMap.h in Headers */,
+				A7482E93116A7CAD003B0712 /* JSWeakObjectMapRefInternal.h in Headers */,
+				A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */,
+				709FB8681AE335C60039D069 /* JSWeakSet.h in Headers */,
+				AD2FCC311DB83D4900B3E736 /* JSWebAssembly.h in Headers */,
+				79E423E31DEE65320078D355 /* JSWebAssemblyCallee.h in Headers */,
+				AD2FCBE31DB58DAD00B3E736 /* JSWebAssemblyCompileError.h in Headers */,
+				796FB43A1DFF8C3F0039C95D /* JSWebAssemblyHelpers.h in Headers */,
+				AD2FCBE51DB58DAD00B3E736 /* JSWebAssemblyInstance.h in Headers */,
+				ADE802991E08F1DE0058DE78 /* JSWebAssemblyLinkError.h in Headers */,
+				AD2FCBE71DB58DAD00B3E736 /* JSWebAssemblyMemory.h in Headers */,
+				AD2FCC051DB58DAD00B3E736 /* JSWebAssemblyModule.h in Headers */,
+				AD2FCBE91DB58DAD00B3E736 /* JSWebAssemblyRuntimeError.h in Headers */,
+				AD2FCBEB1DB58DAD00B3E736 /* JSWebAssemblyTable.h in Headers */,
+				1442566215EDE98D0066A49B /* JSWithScope.h in Headers */,
+				86E3C619167BABEE006D760A /* JSWrapperMap.h in Headers */,
+				BC18C42E0E16F5CD00B34460 /* JSWrapperObject.h in Headers */,
+				BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */,
+				A72FFD64139985A800E5365A /* KeywordLookup.h in Headers */,
+				969A072A0ED1CE6900F1F681 /* Label.h in Headers */,
+				960097A60EBABB58007A7297 /* LabelScope.h in Headers */,
+				0F070A4B1D543A98006E7232 /* LargeAllocation.h in Headers */,
+				DCF3D56A1CD29470003D5C65 /* LazyClassStructure.h in Headers */,
+				DCF3D56B1CD29472003D5C65 /* LazyClassStructureInlines.h in Headers */,
+				0FB5467714F59B5C002C2989 /* LazyOperandValueProfile.h in Headers */,
+				DCF3D56C1CD29475003D5C65 /* LazyProperty.h in Headers */,
+				DCF3D56D1CD29476003D5C65 /* LazyPropertyInlines.h in Headers */,
+				99DA00B01BD5994E00F4575C /* lazywriter.py in Headers */,
+				BC18C4310E16F5CD00B34460 /* Lexer.h in Headers */,
+				BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */,
+				86D3B3C310159D7F002865E7 /* LinkBuffer.h in Headers */,
+				0F431738146BAC69007E3890 /* ListableHandler.h in Headers */,
+				A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */,
+				FE3913551B794F8A00EDAF71 /* LiveObjectData.h in Headers */,
+				FE3913561B794F8F00EDAF71 /* LiveObjectList.h in Headers */,
+				70DE9A091BE7D69E005D89D9 /* LLIntAssembly.h in Headers */,
+				0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */,
+				FE3022D31E3D73A500BAC493 /* SigillCrashAnalyzer.h in Headers */,
+				FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */,
+				0F4680CA14BBB16C00BFE272 /* LLIntCommon.h in Headers */,
+				0F4680D314BBD16700BFE272 /* LLIntData.h in Headers */,
+				0F38B01217CF078300B144D3 /* LLIntEntrypoint.h in Headers */,
+				0F4680A314BA7F8D00BFE272 /* LLIntExceptions.h in Headers */,
+				0F4680CB14BBB17200BFE272 /* LLIntOfflineAsmConfig.h in Headers */,
+				FED287B215EC9A5700DA8161 /* LLIntOpcode.h in Headers */,
+				79CFC6F01C33B10000C768EA /* LLIntPCRanges.h in Headers */,
+				53FA2AE11CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h in Headers */,
+				0F4680A514BA7F8D00BFE272 /* LLIntSlowPaths.h in Headers */,
+				0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */,
+				142E3139134FF0A600AFADB5 /* Local.h in Headers */,
+				142E313A134FF0A600AFADB5 /* LocalScope.h in Headers */,
+				0F208AD71DF0925D007D3269 /* LockDuringMarking.h in Headers */,
+				BC18C4370E16F5CD00B34460 /* Lookup.h in Headers */,
+				0F4680CD14BBB17D00BFE272 /* LowLevelInterpreter.h in Headers */,
+				14B723B812D7DA6F003BD5ED /* MachineStackMarker.h in Headers */,
+				86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */,
+				86D3B2C610156BDE002865E7 /* MacroAssemblerARM.h in Headers */,
+				A1A009C01831A22D00CF8711 /* MacroAssemblerARM64.h in Headers */,
+				86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */,
+				863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */,
+				E32AB2441DCD75F400D7533A /* MacroAssemblerHelpers.h in Headers */,
+				86C568E111A213EE0007F7F0 /* MacroAssemblerMIPS.h in Headers */,
+				FE68C6371B90DE040042BCB3 /* MacroAssemblerPrinter.h in Headers */,
+				86AE64A9135E5E1C00963012 /* MacroAssemblerSH4.h in Headers */,
+				860161E40F3A83C100F84710 /* MacroAssemblerX86.h in Headers */,
+				860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */,
+				860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
+				795B19981D78BE3500262FA0 /* MapBase.h in Headers */,
+				A700873A17CBE85300C3E643 /* MapConstructor.h in Headers */,
+				A74DEF94182D991400522C22 /* MapIteratorPrototype.h in Headers */,
+				A700873E17CBE8D300C3E643 /* MapPrototype.h in Headers */,
+				C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */,
+				0F7DF1461E2BEF6A0095951B /* MarkedAllocatorInlines.h in Headers */,
+				142D6F0913539A2800B02E86 /* MarkedBlock.h in Headers */,
+				0F7C5FB81D888A0C0044F5E2 /* MarkedBlockInlines.h in Headers */,
+				141448CB13A176EC00F5BA1A /* MarkedBlockSet.h in Headers */,
+				14D2F3DB139F4BE200491031 /* MarkedSpace.h in Headers */,
+				0F7DF1351E2970DC0095951B /* MarkedSpaceInlines.h in Headers */,
+				0F660E381E0517BB0031462C /* MarkingConstraint.h in Headers */,
+				0F660E3A1E0517C10031462C /* MarkingConstraintSet.h in Headers */,
+				142D6F1213539A4100B02E86 /* MarkStack.h in Headers */,
+				8612E4CD152389EC00C836BE /* MatchResult.h in Headers */,
+				4340A4851A9051AF00D73CCA /* MathCommon.h in Headers */,
+				BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */,
+				E328C6C71DA4304500D255FD /* MaxFrameExtentForSlowPathCall.h in Headers */,
+				90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */,
+				0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */,
+				7C008CE7187631B600955C24 /* Microtask.h in Headers */,
+				86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */,
+				C4703CD7192844CC0013FBEA /* models.py in Headers */,
+				E3794E761B77EB97005543AE /* ModuleAnalyzer.h in Headers */,
+				E355F3531B7DC85300C50DC5 /* ModuleLoaderPrototype.h in Headers */,
+				996B73201BDA08EF00331B84 /* ModuleLoaderPrototype.lut.h in Headers */,
+				14AD910F1DCA92940014F9FE /* ModuleProgramCodeBlock.h in Headers */,
+				147341D61DC02EB900AA29BA /* ModuleProgramExecutable.h in Headers */,
+				A79D3ED9C5064DD0A8466A3A /* ModuleScopeData.h in Headers */,
+				0F1FB3991E1F65FB00A9BE50 /* MutatorScheduler.h in Headers */,
+				0FA762071DB9243300B7A2FD /* MutatorState.h in Headers */,
+				FE3022D71E42857300BAC493 /* VMInspector.h in Headers */,
+				BC02E9110E1839DB000F9297 /* NativeErrorConstructor.h in Headers */,
+				BC02E9130E1839DB000F9297 /* NativeErrorPrototype.h in Headers */,
+				147341D01DC02DB400AA29BA /* NativeExecutable.h in Headers */,
+				E33E8D211B9013DE00346B52 /* NativeStdFunctionCell.h in Headers */,
+				0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers */,
+				BC18C43F0E16F5CD00B34460 /* Nodes.h in Headers */,
+				99E45A2818A1B2590026D88F /* NondeterministicInput.h in Headers */,
+				BC18C4410E16F5CD00B34460 /* NumberConstructor.h in Headers */,
+				BC18C4420E16F5CD00B34460 /* NumberConstructor.lut.h in Headers */,
+				BC18C4430E16F5CD00B34460 /* NumberObject.h in Headers */,
+				BC18C4440E16F5CD00B34460 /* NumberPrototype.h in Headers */,
+				996B73211BDA08EF00331B84 /* NumberPrototype.lut.h in Headers */,
+				142D3939103E4560007DCB52 /* NumericStrings.h in Headers */,
+				A5EA710C19F6DE820098F5EC /* objc_generator.py in Headers */,
+				C4F4B6F61A05C984005CAB76 /* objc_generator_templates.py in Headers */,
+				86F3EEBD168CDE930077B92A /* ObjCCallbackFunction.h in Headers */,
+				86F3EEBF168CDE930077B92A /* ObjcRuntimeExtras.h in Headers */,
+				14CA958D16AB50FA00938A06 /* ObjectAllocationProfile.h in Headers */,
+				BC18C4450E16F5CD00B34460 /* ObjectConstructor.h in Headers */,
+				996B73221BDA08EF00331B84 /* ObjectConstructor.lut.h in Headers */,
+				0FD3E40A1B618B6600C80E1E /* ObjectPropertyCondition.h in Headers */,
+				0FD3E40C1B618B6600C80E1E /* ObjectPropertyConditionSet.h in Headers */,
+				BC18C4460E16F5CD00B34460 /* ObjectPrototype.h in Headers */,
+				E124A8F70E555775003091F1 /* OpaqueJSString.h in Headers */,
+				ADDB1F6318D77DBE009B58A8 /* OpaqueRootSet.h in Headers */,
+				969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */,
+				0F2BDC2C151FDE9100CD8910 /* Operands.h in Headers */,
+				A70447EA17A0BD4600F5898E /* OperandsInlines.h in Headers */,
+				BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
+				0FE228ED1436AB2700196C48 /* Options.h in Headers */,
+				BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */,
+				93052C350FB792190048FDC3 /* ParserArena.h in Headers */,
+				0FCCAE4516D0CF7400D0C65B /* ParserError.h in Headers */,
+				A77F1825164192C700640A47 /* ParserModes.h in Headers */,
+				65303D641447B9E100D3F904 /* ParserTokens.h in Headers */,
+				792CB34A1C4EED5C00D13AF3 /* PCToCodeOriginMap.h in Headers */,
+				A5AB49DD1BEC8086007020FB /* PerGlobalObjectWrapperWorld.h in Headers */,
+				0FF9CE741B9CD6D0004EDCA6 /* PolymorphicAccess.h in Headers */,
+				0FE834181A6EF97B00D04847 /* PolymorphicCallStubRoutine.h in Headers */,
+				0F98206116BFE38300240D02 /* PreciseJumpTargets.h in Headers */,
+				E3A421431D6F58930007C617 /* PreciseJumpTargetsInlines.h in Headers */,
+				0FBB73B81DEF3AAE002C009E /* PreventCollectionScope.h in Headers */,
+				868916B0155F286300CB2B9A /* PrivateName.h in Headers */,
+				0FF729A5166AD351000F5BA3 /* ProfilerBytecode.h in Headers */,
+				0FF729B9166AD360000F5BA3 /* ProfilerBytecodes.h in Headers */,
+				0F13912A16771C36009CCB07 /* ProfilerBytecodeSequence.h in Headers */,
+				0FF729BA166AD360000F5BA3 /* ProfilerCompilation.h in Headers */,
+				0FF729BB166AD360000F5BA3 /* ProfilerCompilationKind.h in Headers */,
+				0FF729BC166AD360000F5BA3 /* ProfilerCompiledBytecode.h in Headers */,
+				0FF729BD166AD360000F5BA3 /* ProfilerDatabase.h in Headers */,
+				DC605B5E1CE26EA200593718 /* ProfilerEvent.h in Headers */,
+				0FF729BE166AD360000F5BA3 /* ProfilerExecutionCounter.h in Headers */,
+				0F190CAD189D82F6000AE5F0 /* ProfilerJettisonReason.h in Headers */,
+				0FF729BF166AD360000F5BA3 /* ProfilerOrigin.h in Headers */,
+				0FF729C0166AD360000F5BA3 /* ProfilerOriginStack.h in Headers */,
+				0FB1058C1675483300F8AB6E /* ProfilerOSRExit.h in Headers */,
+				0FB1058E1675483A00F8AB6E /* ProfilerOSRExitSite.h in Headers */,
+				0F13912C16771C3D009CCB07 /* ProfilerProfiledBytecodes.h in Headers */,
+				DC605B601CE26EA700593718 /* ProfilerUID.h in Headers */,
+				14AD91101DCA92940014F9FE /* ProgramCodeBlock.h in Headers */,
+				147341D41DC02E6D00AA29BA /* ProgramExecutable.h in Headers */,
+				0FD3E40E1B618B6600C80E1E /* PropertyCondition.h in Headers */,
+				A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */,
+				BC95437D0EBA70FD0072B6D3 /* PropertyMapHashTable.h in Headers */,
+				86158AB3155C8B4000B45C9C /* PropertyName.h in Headers */,
+				BC18C4540E16F5CD00B34460 /* PropertyNameArray.h in Headers */,
+				0FF7168C15A3B235008F5DAA /* PropertyOffset.h in Headers */,
+				BC18C4550E16F5CD00B34460 /* PropertySlot.h in Headers */,
+				0FB7F39C15ED8E4600F167B2 /* PropertyStorage.h in Headers */,
+				BC18C4560E16F5CD00B34460 /* Protect.h in Headers */,
+				1474C33B16AA2D950062F01D /* PrototypeMap.h in Headers */,
+				0FA131711D8DD72B00EC130A /* PrototypeMapInlines.h in Headers */,
+				79B00CBD1C6AB07E0088C65D /* ProxyConstructor.h in Headers */,
+				79B00CBF1C6AB07E0088C65D /* ProxyObject.h in Headers */,
+				79160DBE1C8E3EC8008C085A /* ProxyRevoke.h in Headers */,
+				0F5780A218FE1E98001E72D9 /* PureNaN.h in Headers */,
+				0F15CD231BA5F9860031FFD3 /* PutByIdFlags.h in Headers */,
+				0F9332A414CA7DD90085F3C6 /* PutByIdStatus.h in Headers */,
+				0F93B4AA18B92C4D00178A3F /* PutByIdVariant.h in Headers */,
+				0F0CD4C215F1A6070032F1C0 /* PutDirectIndexMode.h in Headers */,
+				0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */,
+				147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */,
+				0FF60AC216740F8300029779 /* ReduceWhitespace.h in Headers */,
+				E33637A61B63220200EE0840 /* ReflectObject.h in Headers */,
+				996B73231BDA08EF00331B84 /* ReflectObject.lut.h in Headers */,
+				0FA7A8EC18B413C80052371D /* Reg.h in Headers */,
+				BC18C45A0E16F5CD00B34460 /* RegExp.h in Headers */,
+				A1712B3F11C7B228007A5315 /* RegExpCache.h in Headers */,
+				BCD202C20E1706A7002C7E82 /* RegExpConstructor.h in Headers */,
+				BCD202D60E170708002C7E82 /* RegExpConstructor.lut.h in Headers */,
+				0F7C39FB1C8F629300480151 /* RegExpInlines.h in Headers */,
+				A1712B4111C7B235007A5315 /* RegExpKey.h in Headers */,
+				BC18C45B0E16F5CD00B34460 /* RegExpObject.h in Headers */,
+				0F7C39FD1C8F659500480151 /* RegExpObjectInlines.h in Headers */,
+				BCD202C40E1706A7002C7E82 /* RegExpPrototype.h in Headers */,
+				BC18C45D0E16F5CD00B34460 /* Register.h in Headers */,
+				E328C6C91DA432F900D255FD /* RegisterAtOffset.h in Headers */,
+				E328C6C81DA4306100D255FD /* RegisterAtOffsetList.h in Headers */,
+				969A072B0ED1CE6900F1F681 /* RegisterID.h in Headers */,
+				623A37EC1B87A7C000754209 /* RegisterMap.h in Headers */,
+				0FC314121814559100033232 /* RegisterSet.h in Headers */,
+				A57D23EE1891B5540031C7FA /* RegularExpression.h in Headers */,
+				0F7CF94F1DBEEE880098CC12 /* ReleaseHeapAccessScope.h in Headers */,
+				99D6A1161BEAD34D00E25C37 /* RemoteAutomationTarget.h in Headers */,
+				A5BA15EB182340B400A82E69 /* RemoteConnectionToTarget.h in Headers */,
+				998ED6751BED768C00DD8017 /* RemoteControllableTarget.h in Headers */,
+				A5BA15F0182345AF00A82E69 /* RemoteInspectionTarget.h in Headers */,
+				A5BA15E8182340B300A82E69 /* RemoteInspector.h in Headers */,
+				A5BA15EA182340B400A82E69 /* RemoteInspectorConstants.h in Headers */,
+				A5BA15ED182340B400A82E69 /* RemoteInspectorXPCConnection.h in Headers */,
+				0F24E55117EE274900ABB217 /* Repatch.h in Headers */,
+				869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */,
+				70B0A9D11A9B66460001306A /* RuntimeFlags.h in Headers */,
+				52C0611F1AA51E1C00B4ADBA /* RuntimeType.h in Headers */,
+				C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */,
+				79D5CD5B1C1106A900CECA07 /* SamplingProfiler.h in Headers */,
+				0FE050281AA9095600D33B33 /* ScopedArguments.h in Headers */,
+				0FE050291AA9095600D33B33 /* ScopedArgumentsTable.h in Headers */,
+				0FE0502B1AA9095600D33B33 /* ScopeOffset.h in Headers */,
+				0F24E55217EE274900ABB217 /* ScratchRegisterAllocator.h in Headers */,
+				A5FD0068189AFE9C00633231 /* ScriptArguments.h in Headers */,
+				A503FA21188EFF6800110F14 /* ScriptBreakpoint.h in Headers */,
+				A5FD006E189B00AA00633231 /* ScriptCallFrame.h in Headers */,
+				A5FD0070189B00AA00633231 /* ScriptCallStack.h in Headers */,
+				A5FD007E189B0B4C00633231 /* ScriptCallStackFactory.h in Headers */,
+				A503FA22188EFF6800110F14 /* ScriptDebugListener.h in Headers */,
+				A503FA26188EFFFD00110F14 /* ScriptDebugServer.h in Headers */,
+				147341CE1DC02D7900AA29BA /* ScriptExecutable.h in Headers */,
+				CEAE7D7B889B477BA93ABA6C /* ScriptFetcher.h in Headers */,
+				A55D93A6185012A800400DED /* ScriptFunctionCall.h in Headers */,
+				A54CF2FA184EAEDA00237F19 /* ScriptObject.h in Headers */,
+				A55165D51BDF135A003B75C1 /* ScriptProfilingScope.h in Headers */,
+				A54CF2F6184EAB2400237F19 /* ScriptValue.h in Headers */,
+				A7299DA617D12858005F5FF9 /* SetConstructor.h in Headers */,
+				A790DD6E182F499700588807 /* SetIteratorPrototype.h in Headers */,
+				A7299DA217D12848005F5FF9 /* SetPrototype.h in Headers */,
+				0FEE98411A8865B700754E93 /* SetupVarargsFrame.h in Headers */,
+				86AE64AA135E5E1C00963012 /* SH4Assembler.h in Headers */,
+				DC17E8181C9C91D9008A6AB3 /* ShadowChicken.h in Headers */,
+				DC17E8191C9C91DB008A6AB3 /* ShadowChickenInlines.h in Headers */,
+				0F2B670517B6B5AB00A7AE3F /* SimpleTypedArrayController.h in Headers */,
+				14BA78F113AAB88F005B7C2C /* SlotVisitor.h in Headers */,
+				C2160FE715F7E95E00942DFC /* SlotVisitorInlines.h in Headers */,
+				A709F2F017A0AC0400512E98 /* SlowPathCall.h in Headers */,
+				0F5B4A331C84F0D600F1B17E /* SlowPathReturnType.h in Headers */,
+				933040040E6A749400786E6A /* SmallStrings.h in Headers */,
+				FE187A0F1C030D6C0038BBCA /* SnippetOperand.h in Headers */,
+				14201D591DECF26A00904BD3 /* SourceCode.h in Headers */,
+				70B791911C024A13002481E2 /* SourceCodeKey.h in Headers */,
+				2D342F36F7244096804ADB24 /* SourceOrigin.h in Headers */,
+				BC18C4630E16F5CD00B34460 /* SourceProvider.h in Headers */,
+				E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */,
+				E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */,
+				0FDE87FC1DFE6E510064C390 /* SpaceTimeMutatorScheduler.h in Headers */,
+				0FB7F39E15ED8E4600F167B2 /* SparseArrayValueMap.h in Headers */,
+				A7386554118697B400540279 /* SpecializedThunkJIT.h in Headers */,
+				0F5541B21613C1FB00CE3E25 /* SpecialPointer.h in Headers */,
+				0FD82E54141DAEEE00179C94 /* SpeculatedType.h in Headers */,
+				A785F6BC18C553FE00F10626 /* SpillRegistersMode.h in Headers */,
+				0F3AC752183EA1040032029F /* StackAlignment.h in Headers */,
+				0F6DB7E91D6124B500CDBF8E /* StackFrame.h in Headers */,
+				A7C1EAF217987AB600299DB2 /* StackVisitor.h in Headers */,
+				14DF04DA16B3996D0016A513 /* StaticPropertyAnalysis.h in Headers */,
+				14CA958B16AB50DE00938A06 /* StaticPropertyAnalyzer.h in Headers */,
+				0F4F828C1E31B9760075184C /* StochasticSpaceTimeMutatorScheduler.h in Headers */,
+				0F7CF9521DC027D90098CC12 /* StopIfNecessaryTimer.h in Headers */,
+				A730B6121250068F009D25B1 /* StrictEvalActivation.h in Headers */,
+				BC18C4660E16F5CD00B34460 /* StringConstructor.h in Headers */,
+				996B73251BDA08EF00331B84 /* StringConstructor.lut.h in Headers */,
+				70EC0EC71AA0D7DA00B6AAFA /* StringIteratorPrototype.h in Headers */,
+				996B73261BDA08EF00331B84 /* StringIteratorPrototype.lut.h in Headers */,
+				BC18C4680E16F5CD00B34460 /* StringObject.h in Headers */,
+				BC18C46A0E16F5CD00B34460 /* StringPrototype.h in Headers */,
+				142E313B134FF0A600AFADB5 /* Strong.h in Headers */,
+				145722861437E140005FDE26 /* StrongInlines.h in Headers */,
+				BCDE3AB80E6C82F5001453A7 /* Structure.h in Headers */,
+				7E4EE7090EBB7963005934AA /* StructureChain.h in Headers */,
+				2AAAA31218BD49D100394CC8 /* StructureIDBlob.h in Headers */,
+				2AF7382D18BBBF92008A5A37 /* StructureIDTable.h in Headers */,
+				0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */,
+				C2FE18A416BAEC4000AF3061 /* StructureRareData.h in Headers */,
+				C20BA92D16BB1C1500B3AEA2 /* StructureRareDataInlines.h in Headers */,
+				0F9332A514CA7DDD0085F3C6 /* StructureSet.h in Headers */,
+				0F766D3915AE4A1F008F363E /* StructureStubClearingWatchpoint.h in Headers */,
+				BCCF0D080EF0AAB900413C8F /* StructureStubInfo.h in Headers */,
+				BC9041480EB9250900FE26FA /* StructureTransitionTable.h in Headers */,
+				0F7DF1371E2970E10095951B /* Subspace.h in Headers */,
+				0F7DF1381E2970E40095951B /* SubspaceInlines.h in Headers */,
+				0F4A38FA1C8E13DF00190318 /* SuperSampler.h in Headers */,
+				705B41AC1A6E501E00716757 /* Symbol.h in Headers */,
+				705B41AE1A6E501E00716757 /* SymbolConstructor.h in Headers */,
+				996B73271BDA08EF00331B84 /* SymbolConstructor.lut.h in Headers */,
+				705B41B01A6E501E00716757 /* SymbolObject.h in Headers */,
+				705B41B21A6E501E00716757 /* SymbolPrototype.h in Headers */,
+				996B73281BDA08EF00331B84 /* SymbolPrototype.lut.h in Headers */,
+				BC18C46B0E16F5CD00B34460 /* SymbolTable.h in Headers */,
+				0F1FB38F1E173A6700A9BE50 /* SynchronousStopTheWorldMutatorScheduler.h in Headers */,
+				A784A26411D16622005776AC /* SyntaxChecker.h in Headers */,
+				DC7997831CDE9FA0004D4A09 /* TagRegistersMode.h in Headers */,
+				70ECA6081AFDBEA200449739 /* TemplateRegistry.h in Headers */,
+				70ECA6091AFDBEA200449739 /* TemplateRegistryKey.h in Headers */,
+				95D4261AF4C84CE2ACBAC981 /* TemplateRegistryKeyTable.h in Headers */,
+				0F24E54F17EE274900ABB217 /* TempRegisterSet.h in Headers */,
+				0FA2C17C17D7CF84009D015F /* TestRunnerUtils.h in Headers */,
+				FE3422121D6B81C30032BE88 /* ThrowScope.h in Headers */,
+				0F572D4F16879FDD00E57FBD /* ThunkGenerator.h in Headers */,
+				A7386556118697B400540279 /* ThunkGenerators.h in Headers */,
+				141448CD13A1783700F5BA1A /* TinyBloomFilter.h in Headers */,
+				0F55989817C86C5800A1E543 /* ToNativeFromValue.h in Headers */,
+				0F2D4DE919832DAC007D4B19 /* ToThisStatus.h in Headers */,
+				0F952ABD1B487A7700C367C5 /* TrackedReferences.h in Headers */,
+				0F2B670617B6B5AB00A7AE3F /* TypedArrayAdaptors.h in Headers */,
+				0F2B670817B6B5AB00A7AE3F /* TypedArrayController.h in Headers */,
+				0F4B94DC17B9F07500DD03A4 /* TypedArrayInlines.h in Headers */,
+				0F2B670917B6B5AB00A7AE3F /* TypedArrays.h in Headers */,
+				0F2B670B17B6B5AB00A7AE3F /* TypedArrayType.h in Headers */,
+				0FB7F39D15ED8E4600F167B2 /* TypeError.h in Headers */,
+				0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */,
+				52B311011975B4670080857C /* TypeLocationCache.h in Headers */,
+				0FFB6C391AF48DDC00DB1BF7 /* TypeofType.h in Headers */,
+				52C952B719A289850069B386 /* TypeProfiler.h in Headers */,
+				0F2D4DEC19832DC4007D4B19 /* TypeProfilerLog.h in Headers */,
+				0F2D4DF019832DD6007D4B19 /* TypeSet.h in Headers */,
+				0FF4274B158EBE91004CB9FF /* udis86.h in Headers */,
+				0FF42741158EBE8D004CB9FF /* udis86_decode.h in Headers */,
+				0FF42742158EBE91004CB9FF /* udis86_extern.h in Headers */,
+				0FF42748158EBE91004CB9FF /* udis86_syn.h in Headers */,
+				0FF42749158EBE91004CB9FF /* udis86_types.h in Headers */,
+				A7E5AB391799E4B200D2833D /* UDis86Disassembler.h in Headers */,
+				A7A8AF4117ADB5F3005AB174 /* Uint16Array.h in Headers */,
+				866739D313BFDE710023D87C /* Uint16WithFraction.h in Headers */,
+				A7A8AF4217ADB5F3005AB174 /* Uint32Array.h in Headers */,
+				A7A8AF3F17ADB5F3005AB174 /* Uint8Array.h in Headers */,
+				A7A8AF4017ADB5F3005AB174 /* Uint8ClampedArray.h in Headers */,
+				0F5F08CF146C7633000472A9 /* UnconditionalFinalizer.h in Headers */,
+				A7B601821639FD2A00372BA3 /* UnlinkedCodeBlock.h in Headers */,
+				14AD91241DCA9FA40014F9FE /* UnlinkedEvalCodeBlock.h in Headers */,
+				14AD91231DCA9FA40014F9FE /* UnlinkedFunctionCodeBlock.h in Headers */,
+				14AD91271DCA9FA40014F9FE /* UnlinkedFunctionExecutable.h in Headers */,
+				14142E511B796ECE00F4BF4B /* UnlinkedFunctionExecutable.h in Headers */,
+				14AD91221DCA9FA40014F9FE /* UnlinkedGlobalCodeBlock.h in Headers */,
+				14AD91251DCA9FA40014F9FE /* UnlinkedModuleProgramCodeBlock.h in Headers */,
+				14AD91261DCA9FA40014F9FE /* UnlinkedProgramCodeBlock.h in Headers */,
+				14AB66761DECF40900A56C26 /* UnlinkedSourceCode.h in Headers */,
+				0F2E892C16D028AD009E4FD2 /* UnusedPointer.h in Headers */,
+				99DA00B11BD5994E00F4575C /* UpdateContents.py in Headers */,
+				0F963B3813FC6FE90002D9B2 /* ValueProfile.h in Headers */,
+				0F426A481460CBB300131F8F /* ValueRecovery.h in Headers */,
+				79EE0C001B4AFB85000385C9 /* VariableEnvironment.h in Headers */,
+				0F6C73511AC9F99F00BE1682 /* VariableWriteFireDetail.h in Headers */,
+				0FE0502D1AA9095600D33B33 /* VarOffset.h in Headers */,
+				0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */,
+				0F1FB3931E177A7200A9BE50 /* VisitingTimeout.h in Headers */,
+				0F952AA11DF7860900E06FBD /* VisitRaceKey.h in Headers */,
+				BC18C4200E16F5CD00B34460 /* VM.h in Headers */,
+				658D3A5619638268003C45D6 /* VMEntryRecord.h in Headers */,
+				FE5932A8183C5A2600A1ECCC /* VMEntryScope.h in Headers */,
+				0F5AE2C41DF4F2800066EFE1 /* VMInlines.h in Headers */,
+				53F40E931D5A4AB30099A1B6 /* WasmB3IRGenerator.h in Headers */,
+				AD4B1DFA1DF244E20071AE32 /* WasmBinding.h in Headers */,
+				53FD04D41D7AB291003287D3 /* WasmCallingConvention.h in Headers */,
+				79DAE27A1E03C82200B526AA /* WasmExceptionType.h in Headers */,
+				7BC547D31B6959A100959B58 /* WasmFormat.h in Headers */,
+				53F40E8B1D5901BB0099A1B6 /* WasmFunctionParser.h in Headers */,
+				535557141D9D9EA5006D583B /* WasmMemory.h in Headers */,
+				79B759751DFA4C600052174C /* WasmMemoryInformation.h in Headers */,
+				53F40E951D5A7AEF0099A1B6 /* WasmModuleParser.h in Headers */,
+				533B15DF1DC7F463004D500A /* WasmOps.h in Headers */,
+				79B759761DFA4C600052174C /* WasmPageCount.h in Headers */,
+				53F40E8D1D5901F20099A1B6 /* WasmParser.h in Headers */,
+				531374BD1D5CE67600AF7A0B /* WasmPlan.h in Headers */,
+				53F40E851D58F9770099A1B6 /* WasmSections.h in Headers */,
+				AD7438C01E0457A400FD0C2A /* WasmSignature.h in Headers */,
+				53FF7F991DBFCD9000A26CCC /* WasmValidate.h in Headers */,
+				FED94F2F171E3E2300BE77A4 /* Watchdog.h in Headers */,
+				0F919D2615853CE3004A4E7D /* Watchpoint.h in Headers */,
+				142E313C134FF0A600AFADB5 /* Weak.h in Headers */,
+				14E84F9F14EE1ACC00D6D5D4 /* WeakBlock.h in Headers */,
+				14BFCE6910CDB1FC00364CCE /* WeakGCMap.h in Headers */,
+				AD86A93E1AA4D88D002FE77F /* WeakGCMapInlines.h in Headers */,
+				14F7256614EE265E00B1652B /* WeakHandleOwner.h in Headers */,
+				14E84FA214EE1ACC00D6D5D4 /* WeakImpl.h in Headers */,
+				14BE7D3317135CF400D1807A /* WeakInlines.h in Headers */,
+				A7CA3AE417DA41AE006538AF /* WeakMapConstructor.h in Headers */,
+				A7CA3AEC17DA5168006538AF /* WeakMapData.h in Headers */,
+				A7CA3AE617DA41AE006538AF /* WeakMapPrototype.h in Headers */,
+				0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */,
+				14E84FA114EE1ACC00D6D5D4 /* WeakSet.h in Headers */,
+				709FB86A1AE335C60039D069 /* WeakSetConstructor.h in Headers */,
+				14150133154BB13F005D8C98 /* WeakSetInlines.h in Headers */,
+				709FB86C1AE335C60039D069 /* WeakSetPrototype.h in Headers */,
+				AD2FCBED1DB58DAD00B3E736 /* WebAssemblyCompileErrorConstructor.h in Headers */,
+				AD2FCC161DB59CB200B3E736 /* WebAssemblyCompileErrorConstructor.lut.h in Headers */,
+				AD2FCBEF1DB58DAD00B3E736 /* WebAssemblyCompileErrorPrototype.h in Headers */,
+				AD2FCC171DB59CB200B3E736 /* WebAssemblyCompileErrorPrototype.lut.h in Headers */,
+				AD4937D41DDD27DE0077C807 /* WebAssemblyFunction.h in Headers */,
+				AD2FCBF11DB58DAD00B3E736 /* WebAssemblyInstanceConstructor.h in Headers */,
+				AD2FCC181DB59CB200B3E736 /* WebAssemblyInstanceConstructor.lut.h in Headers */,
+				AD2FCBF31DB58DAD00B3E736 /* WebAssemblyInstancePrototype.h in Headers */,
+				AD2FCC191DB59CB200B3E736 /* WebAssemblyInstancePrototype.lut.h in Headers */,
+				ADE8029A1E08F1DE0058DE78 /* WebAssemblyLinkErrorConstructor.h in Headers */,
+				ADE8029C1E08F1DE0058DE78 /* WebAssemblyLinkErrorPrototype.h in Headers */,
+				AD2FCBF51DB58DAD00B3E736 /* WebAssemblyMemoryConstructor.h in Headers */,
+				AD2FCC1A1DB59CB200B3E736 /* WebAssemblyMemoryConstructor.lut.h in Headers */,
+				AD2FCBF71DB58DAD00B3E736 /* WebAssemblyMemoryPrototype.h in Headers */,
+				AD2FCC1B1DB59CB200B3E736 /* WebAssemblyMemoryPrototype.lut.h in Headers */,
+				AD2FCC011DB58DAD00B3E736 /* WebAssemblyModuleConstructor.h in Headers */,
+				AD2FCC1C1DB59CB200B3E736 /* WebAssemblyModuleConstructor.lut.h in Headers */,
+				AD2FCC031DB58DAD00B3E736 /* WebAssemblyModulePrototype.h in Headers */,
+				AD2FCC1D1DB59CB200B3E736 /* WebAssemblyModulePrototype.lut.h in Headers */,
+				AD4937C81DDD0AAE0077C807 /* WebAssemblyModuleRecord.h in Headers */,
+				AD2FCC2D1DB838FD00B3E736 /* WebAssemblyPrototype.h in Headers */,
+				AD2FCBF91DB58DAD00B3E736 /* WebAssemblyRuntimeErrorConstructor.h in Headers */,
+				AD2FCC1E1DB59CB200B3E736 /* WebAssemblyRuntimeErrorConstructor.lut.h in Headers */,
+				AD2FCBFB1DB58DAD00B3E736 /* WebAssemblyRuntimeErrorPrototype.h in Headers */,
+				AD2FCC1F1DB59CB200B3E736 /* WebAssemblyRuntimeErrorPrototype.lut.h in Headers */,
+				AD2FCBFD1DB58DAD00B3E736 /* WebAssemblyTableConstructor.h in Headers */,
+				AD2FCC201DB59CB200B3E736 /* WebAssemblyTableConstructor.lut.h in Headers */,
+				AD2FCBFF1DB58DAD00B3E736 /* WebAssemblyTablePrototype.h in Headers */,
+				AD2FCC211DB59CB200B3E736 /* WebAssemblyTablePrototype.lut.h in Headers */,
+				ADBC54D51DF8EA2B005BF738 /* WebAssemblyToJSCallee.h in Headers */,
+				BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */,
+				A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
+				C2B6D75318A33793004A9301 /* WriteBarrierInlines.h in Headers */,
+				0FC8150A14043BF500CFA603 /* WriteBarrierSupport.h in Headers */,
+				9688CB160ED12B4E001D649F /* X86Assembler.h in Headers */,
+				9959E92E1BD17FA4001AA413 /* xxd.pl in Headers */,
+				451539B912DC994500EF7AC4 /* Yarr.h in Headers */,
+				86704B8512DBA33700A9FE7B /* YarrInterpreter.h in Headers */,
+				86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */,
+				86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */,
+				86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */,
+				86704B4312DB8A8100A9FE7B /* YarrSyntaxChecker.h in Headers */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXHeadersBuildPhase section */
+
+/* Begin PBXNativeTarget section */
+		0F6183381C45F62A0072450B /* testair */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 0F61833E1C45F62A0072450B /* Build configuration list for PBXNativeTarget "testair" */;
+			buildPhases = (
+				0F6183391C45F62A0072450B /* Sources */,
+				0F61833B1C45F62A0072450B /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = testair;
+			productName = testapi;
+			productReference = 0F6183431C45F62A0072450B /* testair */;
+			productType = "com.apple.product-type.tool";
+		};
+		0F93274E1C20BCBA00CF6564 /* dynbench */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 0F9327541C20BCBA00CF6564 /* Build configuration list for PBXNativeTarget "dynbench" */;
+			buildPhases = (
+				0F93274F1C20BCBA00CF6564 /* Sources */,
+				0F9327511C20BCBA00CF6564 /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = dynbench;
+			productName = testapi;
+			productReference = 0F9327591C20BCBA00CF6564 /* dynbench */;
+			productType = "com.apple.product-type.tool";
+		};
+		0FEC85941BDB5CF10080FF74 /* testb3 */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 0FEC85A81BDB5CF10080FF74 /* Build configuration list for PBXNativeTarget "testb3" */;
+			buildPhases = (
+				0FEC85951BDB5CF10080FF74 /* Sources */,
+				0FEC85A21BDB5CF10080FF74 /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = testb3;
+			productName = testapi;
+			productReference = 0FEC85AD1BDB5CF10080FF74 /* testb3 */;
+			productType = "com.apple.product-type.tool";
+		};
+		0FF922C314F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 0FF922CA14F46B130041A24E /* Build configuration list for PBXNativeTarget "JSCLLIntOffsetsExtractor" */;
+			buildPhases = (
+				0FF922C414F46B130041A24E /* Sources */,
+				0FF922C614F46B130041A24E /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				65788AAB18B40A3B00C189FF /* PBXTargetDependency */,
+				0FF922D314F46B2F0041A24E /* PBXTargetDependency */,
+			);
+			name = JSCLLIntOffsetsExtractor;
+			productInstallPath = /usr/local/bin;
+			productName = jsc;
+			productReference = 0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */;
+			productType = "com.apple.product-type.tool";
+		};
+		1412111F0A48793C00480255 /* minidom */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 141211390A48798400480255 /* Build configuration list for PBXNativeTarget "minidom" */;
+			buildPhases = (
+				1412111D0A48793C00480255 /* Sources */,
+				1412111E0A48793C00480255 /* Frameworks */,
+				144005C70A5338C60005F061 /* Headers */,
+				5DBB1524131D0BA10056AD36 /* Copy Support Script */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = minidom;
+			productName = minidom;
+			productReference = 141211200A48793C00480255 /* minidom */;
+			productType = "com.apple.product-type.tool";
+		};
+		14BD59BE0A3E8F9000BAF59C /* testapi */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 14BD59D60A3E8FC900BAF59C /* Build configuration list for PBXNativeTarget "testapi" */;
+			buildPhases = (
+				14BD59BC0A3E8F9000BAF59C /* Sources */,
+				14BD59BD0A3E8F9000BAF59C /* Frameworks */,
+				5DBB1511131D0B130056AD36 /* Copy Support Script */,
+				5DAFD6CD146B6B6E00FBEFB4 /* Install Support Script */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = testapi;
+			productName = testapi;
+			productReference = 14BD59BF0A3E8F9000BAF59C /* testapi */;
+			productType = "com.apple.product-type.tool";
+		};
+		651122F714046A4C002B101D /* testRegExp */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 6511230014046A4C002B101D /* Build configuration list for PBXNativeTarget "testRegExp" */;
+			buildPhases = (
+				651122FA14046A4C002B101D /* Sources */,
+				651122FC14046A4C002B101D /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = testRegExp;
+			productInstallPath = /usr/local/bin;
+			productName = testRegExp;
+			productReference = 6511230514046A4C002B101D /* testRegExp */;
+			productType = "com.apple.product-type.tool";
+		};
+		932F5B3E0822A1C700736975 /* JavaScriptCore */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 149C275D08902AFE008A9EFC /* Build configuration list for PBXNativeTarget "JavaScriptCore" */;
+			buildPhases = (
+				5D2F7CF90C6875BB00B5B72B /* Update Info.plist with version information */,
+				A53F1ABF18C90F8B0072EB6D /* Resources */,
+				932F5B3F0822A1C700736975 /* Headers */,
+				3732811A17FCD235004AD519 /* Postprocess Headers */,
+				932F5B910822A1C700736975 /* Sources */,
+				932F5BD20822A1C700736975 /* Frameworks */,
+				5D29D8BE0E9860B400C3D2D0 /* Check For Weak VTables and Externals */,
+				3713F014142905240036387F /* Check For Inappropriate Objective-C Class Names */,
+				A55DEAA416703DF7003DB841 /* Check For Inappropriate Macros in External Headers */,
+				1A02D9A81B34A882000D1522 /* Add Symlink in /System/Library/PrivateFrameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				65788AAD18B40A7B00C189FF /* PBXTargetDependency */,
+				65FB3F7E09D11EF300F49DEB /* PBXTargetDependency */,
+			);
+			name = JavaScriptCore;
+			productInstallPath = "${SYSTEM_LIBRARY_DIR}/Frameworks/WebKit.framework/Versions/A/Frameworks";
+			productName = JavaScriptCore;
+			productReference = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */;
+			productType = "com.apple.product-type.framework";
+		};
+		932F5BDA0822A1C700736975 /* jsc */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 149C276708902AFE008A9EFC /* Build configuration list for PBXNativeTarget "jsc" */;
+			buildPhases = (
+				932F5BDC0822A1C700736975 /* Sources */,
+				932F5BDE0822A1C700736975 /* Frameworks */,
+				5D5D8ABF0E0D0B0300F9C692 /* Create /usr/local/bin/jsc symlink */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = jsc;
+			productInstallPath = /usr/local/bin;
+			productName = jsc;
+			productReference = 932F5BE10822A1C700736975 /* jsc */;
+			productType = "com.apple.product-type.tool";
+		};
+/* End PBXNativeTarget section */
+
+/* Begin PBXProject section */
+		0867D690FE84028FC02AAC07 /* Project object */ = {
+			isa = PBXProject;
+			attributes = {
+				BuildIndependentTargetsInParallel = YES;
+				LastSwiftUpdateCheck = 0700;
+				LastUpgradeCheck = 0700;
+			};
+			buildConfigurationList = 149C277108902AFE008A9EFC /* Build configuration list for PBXProject "JavaScriptCore" */;
+			compatibilityVersion = "Xcode 3.2";
+			developmentRegion = English;
+			hasScannedForEncodings = 1;
+			knownRegions = (
+				English,
+				Japanese,
+				French,
+				German,
+			);
+			mainGroup = 0867D691FE84028FC02AAC07 /* JavaScriptCore */;
+			productRefGroup = 034768DFFF38A50411DB9C8B /* Products */;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (
+				932F5BE30822A1C700736975 /* All */,
+				932F5B3E0822A1C700736975 /* JavaScriptCore */,
+				0F4680A914BA7FD900BFE272 /* LLInt Offsets */,
+				65FB3F6609D11E9100F49DEB /* Derived Sources */,
+				0FF922C314F46B130041A24E /* JSCLLIntOffsetsExtractor */,
+				65788A9D18B409EB00C189FF /* Offline Assembler */,
+				1412111F0A48793C00480255 /* minidom */,
+				14BD59BE0A3E8F9000BAF59C /* testapi */,
+				932F5BDA0822A1C700736975 /* jsc */,
+				651122F714046A4C002B101D /* testRegExp */,
+				0FEC85941BDB5CF10080FF74 /* testb3 */,
+				5D6B2A47152B9E17005231DE /* Test Tools */,
+				0F93274E1C20BCBA00CF6564 /* dynbench */,
+				0F6183381C45F62A0072450B /* testair */,
+			);
+		};
+/* End PBXProject section */
+
+/* Begin PBXResourcesBuildPhase section */
+		A53F1ABF18C90F8B0072EB6D /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				A53F1AC018C90F8F0072EB6D /* framework.sb in Resources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXShellScriptBuildPhase section */
+		0F4680AA14BA7FD900BFE272 /* Generate Derived Sources */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "Generate Derived Sources";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "set -e\n\nmkdir -p \"${BUILT_PRODUCTS_DIR}/LLIntOffsets/\"\n\n/usr/bin/env ruby \"${SRCROOT}/offlineasm/generate_offset_extractor.rb\" \"-I${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\" \"${SRCROOT}/llint/LowLevelInterpreter.asm\" \"${BUILT_PRODUCTS_DIR}/LLIntOffsets/LLIntDesiredOffsets.h\" \"X86,X86_64,ARMv7,ARMv7s,ARM64,C_LOOP\"\n";
+		};
+		1A02D9A81B34A882000D1522 /* Add Symlink in /System/Library/PrivateFrameworks */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 8;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "Add Symlink in /System/Library/PrivateFrameworks";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 1;
+			shellPath = /bin/sh;
+			shellScript = "if [[ ${PLATFORM_NAME} != \"iphoneos\" ]]; then\n    exit 0\nfi\n\nif [[ ! -d \"${INSTALL_ROOT}/${SYSTEM_LIBRARY_DIR}/PrivateFrameworks\" ]]; then\n    mkdir -p \"${INSTALL_ROOT}/${SYSTEM_LIBRARY_DIR}/PrivateFrameworks\"\nfi\n\nln -s -h -f ../Frameworks/JavaScriptCore.framework \"${INSTALL_ROOT}/${SYSTEM_LIBRARY_DIR}/PrivateFrameworks/JavaScriptCore.framework\"";
+		};
+		3713F014142905240036387F /* Check For Inappropriate Objective-C Class Names */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
+			);
+			name = "Check For Inappropriate Objective-C Class Names";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "set -e\n\nif [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-inappropriate-objc-class-names ]; then\n    ../../Tools/Scripts/check-for-inappropriate-objc-class-names JS WTF\nfi";
+		};
+		3732811A17FCD235004AD519 /* Postprocess Headers */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(TARGET_BUILD_DIR)/$(PUBLIC_HEADERS_FOLDER_PATH)/JSBase.h",
+				"$(TARGET_BUILD_DIR)/$(PUBLIC_HEADERS_FOLDER_PATH)/JSContext.h",
+				"$(TARGET_BUILD_DIR)/$(PUBLIC_HEADERS_FOLDER_PATH)/JSManagedValue.h",
+				"$(TARGET_BUILD_DIR)/$(PUBLIC_HEADERS_FOLDER_PATH)/JSValue.h",
+				"$(TARGET_BUILD_DIR)/$(PUBLIC_HEADERS_FOLDER_PATH)/JSVirtualMachine.h",
+				"$(TARGET_BUILD_DIR)/$(PUBLIC_HEADERS_FOLDER_PATH)/WebKitAvailability.h",
+			);
+			name = "Postprocess Headers";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "exec ${SRCROOT}/postprocess-headers.sh";
+		};
+		5D29D8BE0E9860B400C3D2D0 /* Check For Weak VTables and Externals */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
+			);
+			name = "Check For Weak VTables and Externals";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "set -e\n\nif [ -f ../../Tools/Scripts/check-for-weak-vtables-and-externals ]; then\n    ../../Tools/Scripts/check-for-weak-vtables-and-externals\nfi";
+		};
+		5D2F7CF90C6875BB00B5B72B /* Update Info.plist with version information */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(SRCROOT)/Configurations/Version.xcconfig",
+			);
+			name = "Update Info.plist with version information";
+			outputPaths = (
+				"$(SRCROOT)/Info.plist",
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "# Touch Info.plist to let Xcode know it needs to copy it into the built product\nif [[ \"${CONFIGURATION}\" != \"Production\" ]]; then\n    touch \"$SRCROOT/Info.plist\";\nfi;\n";
+		};
+		5D5D8ABF0E0D0B0300F9C692 /* Create /usr/local/bin/jsc symlink */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(DSTROOT)$(INSTALL_PATH)/jsc",
+			);
+			name = "Create /usr/local/bin/jsc symlink";
+			outputPaths = (
+				"$(DSTROOT)/usr/local/bin/jsc",
+			);
+			runOnlyForDeploymentPostprocessing = 1;
+			shellPath = /bin/sh;
+			shellScript = "if [[ \"${SKIP_INSTALL}\" == \"NO\" ]]; then\n    mkdir -p \"${DSTROOT}/usr/local/bin\"\n    cd \"${DSTROOT}/usr/local/bin\"\n    if [ -L jsc ]; then\n        rm -f jsc\n    fi\n    ln -s \"../../..${INSTALL_PATH}/jsc\" jsc\n    exit\nfi\n";
+		};
+		5DAFD6CD146B6B6E00FBEFB4 /* Install Support Script */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 8;
+			files = (
+			);
+			inputPaths = (
+				"$(SRCROOT)/API/tests/testapi.js",
+			);
+			name = "Install Support Script";
+			outputPaths = (
+				"$(DSTROOT)$(INSTALL_PATH)/testapi.js",
+			);
+			runOnlyForDeploymentPostprocessing = 1;
+			shellPath = /bin/sh;
+			shellScript = "if [[ \"${SKIP_INSTALL}\" == \"NO\" ]]; then\n    cp \"${SRCROOT}/API/tests/testapi.js\" \"${DSTROOT}${INSTALL_PATH}/testapi.js\"\nfi\n";
+		};
+		5DF7E1CC188E6B87003F9A46 /* Copy jsc into JavaScriptCore.framework */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(BUILT_PRODUCTS_DIR)/jsc",
+			);
+			name = "Copy jsc into JavaScriptCore.framework";
+			outputPaths = (
+				"$(BUILT_PRODUCTS_DIR)/$(JAVASCRIPTCORE_RESOURCES_DIR)/jsc",
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "set -e\n\n# Skip for Production builds.\nif [[ ${CONFIGURATION:=Debug} == \"Production\" ]]; then\n    exit\nfi\n\n# Copy and update the jsc binary to refer to JavaScriptCore.framework relative to its location.\nditto \"${BUILT_PRODUCTS_DIR}/jsc\" \"${BUILT_PRODUCTS_DIR}/${JAVASCRIPTCORE_RESOURCES_DIR}/jsc\"\ninstall_name_tool -change \"${JAVASCRIPTCORE_FRAMEWORKS_DIR}/JavaScriptCore.framework/Versions/A/JavaScriptCore\" \"@loader_path/../JavaScriptCore\" \"${BUILT_PRODUCTS_DIR}/${JAVASCRIPTCORE_RESOURCES_DIR}/jsc\"\n";
+		};
+		65788AA018B409EB00C189FF /* Offline Assemble */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "Offline Assemble";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "if [[ \"${ACTION}\" == \"installhdrs\" ]]; then\n    exit 0\nfi\n\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\n/usr/bin/env ruby JavaScriptCore/offlineasm/asm.rb \"-I${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\" JavaScriptCore/llint/LowLevelInterpreter.asm \"${BUILT_PRODUCTS_DIR}/JSCLLIntOffsetsExtractor\" LLIntAssembly.h || exit 1";
+		};
+		65FB3F6509D11E9100F49DEB /* Generate Derived Sources */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "Generate Derived Sources";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "set -e\n\nmkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" JavaScriptCore\nexport JavaScriptCore=\"JavaScriptCore\"\nexport BUILT_PRODUCTS_DIR=\"../..\"\n\nmake --no-builtin-rules -f \"JavaScriptCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.ncpu`\n";
+		};
+		A55DEAA416703DF7003DB841 /* Check For Inappropriate Macros in External Headers */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+				"$(TARGET_BUILD_DIR)/$(EXECUTABLE_PATH)",
+			);
+			name = "Check For Inappropriate Macros in External Headers";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "set -e\n\nif [ \"${ACTION}\" = \"installhdrs\" ]; then\n    exit 0;\nfi\n\nif [ -f ../../Tools/Scripts/check-for-inappropriate-macros-in-external-headers ]; then\n    ../../Tools/Scripts/check-for-inappropriate-macros-in-external-headers Headers PrivateHeaders/JSBasePrivate.h\nfi";
+		};
+/* End PBXShellScriptBuildPhase section */
+
+/* Begin PBXSourcesBuildPhase section */
+		0F6183391C45F62A0072450B /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0F6183451C45F6600072450B /* testair.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		0F93274F1C20BCBA00CF6564 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0F93275B1C20BCDF00CF6564 /* dynbench.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		0FEC85951BDB5CF10080FF74 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0FEC85AF1BDB5D5E0080FF74 /* testb3.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		0FF922C414F46B130041A24E /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0FF922D414F46B410041A24E /* LLIntOffsetsExtractor.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		1412111D0A48793C00480255 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				1440057F0A5335640005F061 /* JSNode.c in Sources */,
+				144007580A5370D20005F061 /* JSNodeList.c in Sources */,
+				141211340A48795800480255 /* minidom.c in Sources */,
+				1440063F0A53598A0005F061 /* Node.c in Sources */,
+				1440074B0A536CC20005F061 /* NodeList.c in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		14BD59BC0A3E8F9000BAF59C /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				FEF040511AAE662D00BD28B0 /* CompareAndSwapTest.cpp in Sources */,
+				C29ECB031804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm in Sources */,
+				C20328201981979D0088B499 /* CustomGlobalObjectClassTest.c in Sources */,
+				C288B2DE18A54D3E007BE40B /* DateTests.mm in Sources */,
+				FE0D4A061AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp in Sources */,
+				FECB8B271D25BB85006F2463 /* FunctionOverridesTest.cpp in Sources */,
+				FE0D4A091ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp in Sources */,
+				C2181FC218A948FB0025A235 /* JSExportTests.mm in Sources */,
+				5C4E8E961DBEBE620036F1FC /* JSONParseTest.cpp in Sources */,
+				FE7C41961B97FC4B00F4D598 /* PingPongStackOverflowTest.cpp in Sources */,
+				65570F5A1AA4C3EA009B3C23 /* Regress141275.mm in Sources */,
+				FEB51F6C1A97B688001F921C /* Regress141809.mm in Sources */,
+				1440F6100A4F85670005F061 /* testapi.c in Sources */,
+				86D2221A167EF9440024C804 /* testapi.mm in Sources */,
+				534902851C7276B70012BCB8 /* TypedArrayCTest.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		651122FA14046A4C002B101D /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				6511230714046B0A002B101D /* testRegExp.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		932F5B910822A1C700736975 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				0FFA549716B8835000B3A982 /* A64DOpcode.cpp in Sources */,
+				AD4937C31DDBE6140077C807 /* AbstractModuleRecord.cpp in Sources */,
+				0F55F0F414D1063900AC7649 /* AbstractPC.cpp in Sources */,
+				5370B4F51BF26202005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.cpp in Sources */,
+				0FEC856D1BDACDC70080FF74 /* AirAllocateStack.cpp in Sources */,
+				0FEC856F1BDACDC70080FF74 /* AirArg.cpp in Sources */,
+				0FEC85711BDACDC70080FF74 /* AirBasicBlock.cpp in Sources */,
+				0F6183291C45BF070072450B /* AirCCallingConvention.cpp in Sources */,
+				0FEC85731BDACDC70080FF74 /* AirCCallSpecial.cpp in Sources */,
+				0FEC85751BDACDC70080FF74 /* AirCode.cpp in Sources */,
+				0F61832B1C45BF070072450B /* AirCustom.cpp in Sources */,
+				DC454B8C1D00E822004C18AF /* AirDumpAsJS.cpp in Sources */,
+				0F4570381BE44C910062A629 /* AirEliminateDeadCode.cpp in Sources */,
+				0F61832C1C45BF070072450B /* AirEmitShuffle.cpp in Sources */,
+				0F4DE1CE1C4C1B54004D6C11 /* AirFixObviousSpills.cpp in Sources */,
+				262D85B61C0D650F006ACB61 /* AirFixPartialRegisterStalls.cpp in Sources */,
+				0FEC85781BDACDC70080FF74 /* AirGenerate.cpp in Sources */,
+				0FEC85931BDB1E100080FF74 /* AirGenerated.cpp in Sources */,
+				0FEC857B1BDACDC70080FF74 /* AirHandleCalleeSaves.cpp in Sources */,
+				0FEC857D1BDACDC70080FF74 /* AirInsertionSet.cpp in Sources */,
+				0FEC857F1BDACDC70080FF74 /* AirInst.cpp in Sources */,
+				26718BA41BE99F780052017B /* AirIteratedRegisterCoalescing.cpp in Sources */,
+				0FDF67D61D9DC440001B9825 /* AirKind.cpp in Sources */,
+				0FE34C191C4B39AE0003A512 /* AirLogRegisterPressure.cpp in Sources */,
+				0F61832E1C45BF070072450B /* AirLowerAfterRegAlloc.cpp in Sources */,
+				0FDF70851D3F2C2200927449 /* AirLowerEntrySwitch.cpp in Sources */,
+				0F6183301C45BF070072450B /* AirLowerMacros.cpp in Sources */,
+				0FB3878F1BFBC44D00E3AB1E /* AirOptimizeBlockOrder.cpp in Sources */,
+				0F9CABC81DB54A780008E83B /* AirPadInterference.cpp in Sources */,
+				0FEC85831BDACDC70080FF74 /* AirPhaseScope.cpp in Sources */,
+				0F45703C1BE45F0A0062A629 /* AirReportUsedRegisters.cpp in Sources */,
+				0F338DFD1BED51270013C88F /* AirSimplifyCFG.cpp in Sources */,
+				0FEC85871BDACDC70080FF74 /* AirSpecial.cpp in Sources */,
+				0FEC85891BDACDC70080FF74 /* AirSpillEverything.cpp in Sources */,
+				0FEC858B1BDACDC70080FF74 /* AirStackSlot.cpp in Sources */,
+				0F2BBD9D1C5FF4050023EF23 /* AirStackSlotKind.cpp in Sources */,
+				0FEC858D1BDACDC70080FF74 /* AirTmp.cpp in Sources */,
+				0FE0E4AD1C24C94A002E17B6 /* AirTmpWidth.cpp in Sources */,
+				0FEC85901BDACDC70080FF74 /* AirValidate.cpp in Sources */,
+				0F9630391D4192C6005609D9 /* AllocatorAttributes.cpp in Sources */,
+				147F39BD107EC37600427A48 /* ArgList.cpp in Sources */,
+				79A228351D35D71E00D8E067 /* ArithProfile.cpp in Sources */,
+				FE3022D61E42857300BAC493 /* VMInspector.cpp in Sources */,
+				0F743BAA16B88249009F9277 /* ARM64Disassembler.cpp in Sources */,
+				86D3B2C310156BDE002865E7 /* ARMAssembler.cpp in Sources */,
+				65C02850171795E200351E35 /* ARMv7Disassembler.cpp in Sources */,
+				65C0285C1717966800351E35 /* ARMv7DOpcode.cpp in Sources */,
+				0F8335B71639C1E6001443B5 /* ArrayAllocationProfile.cpp in Sources */,
+				A7A8AF3417ADB5F3005AB174 /* ArrayBuffer.cpp in Sources */,
+				0FFC99D4184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp in Sources */,
+				A7A8AF3617ADB5F3005AB174 /* ArrayBufferView.cpp in Sources */,
+				147F39BF107EC37600427A48 /* ArrayConstructor.cpp in Sources */,
+				0FB415841D78FB4C00DF8D09 /* ArrayConventions.cpp in Sources */,
+				52B74B4A1DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp in Sources */,
+				A7BDAEC817F4EA1400F6140C /* ArrayIteratorPrototype.cpp in Sources */,
+				0F63945415D07055006A597C /* ArrayProfile.cpp in Sources */,
+				147F39C0107EC37600427A48 /* ArrayPrototype.cpp in Sources */,
+				0F24E54017EA9F5900ABB217 /* AssemblyHelpers.cpp in Sources */,
+				5B70CFE31DB69E6600EC23F9 /* AsyncFunctionConstructor.cpp in Sources */,
+				5B70CFE11DB69E6600EC23F9 /* AsyncFunctionPrototype.cpp in Sources */,
+				6A38CFA91E32B5AB0060206F /* AsyncStackTrace.cpp in Sources */,
+				0F7CF9561DC1258D0098CC12 /* AtomicsObject.cpp in Sources */,
+				0FEC84FE1BDACDAC0080FF74 /* B3ArgumentRegValue.cpp in Sources */,
+				0FEC85001BDACDAC0080FF74 /* B3BasicBlock.cpp in Sources */,
+				0F338E1B1BF286EA0013C88F /* B3BlockInsertionSet.cpp in Sources */,
+				0F6B8AE21C4EFE1700969052 /* B3BreakCriticalEdges.cpp in Sources */,
+				DC9A0C211D2D9CB40085124E /* B3CaseCollection.cpp in Sources */,
+				0F338DF91BE96AA80013C88F /* B3CCallValue.cpp in Sources */,
+				0FEC85051BDACDAC0080FF74 /* B3CheckSpecial.cpp in Sources */,
+				0FEC85071BDACDAC0080FF74 /* B3CheckValue.cpp in Sources */,
+				0FEC85091BDACDAC0080FF74 /* B3Common.cpp in Sources */,
+				0FEC850B1BDACDAC0080FF74 /* B3Commutativity.cpp in Sources */,
+				0F338E0B1BF0276C0013C88F /* B3Compilation.cpp in Sources */,
+				795F099D1E03600500BBE37F /* B3Compile.cpp in Sources */,
+				0FEC850D1BDACDAC0080FF74 /* B3Const32Value.cpp in Sources */,
+				0FEC850F1BDACDAC0080FF74 /* B3Const64Value.cpp in Sources */,
+				0FEC85111BDACDAC0080FF74 /* B3ConstDoubleValue.cpp in Sources */,
+				43422A621C158E6A00E2EB98 /* B3ConstFloatValue.cpp in Sources */,
+				0F338DF51BE93D550013C88F /* B3ConstrainedValue.cpp in Sources */,
+				0F338E0D1BF0276C0013C88F /* B3DataSection.cpp in Sources */,
+				0F6B8AD81C4EDDA200969052 /* B3DuplicateTails.cpp in Sources */,
+				0FEC85C51BE16F5A0080FF74 /* B3Effects.cpp in Sources */,
+				0F725CA71C503DED00AD943A /* B3EliminateCommonSubexpressions.cpp in Sources */,
+				0F6971EB1D92F42D00BA02A5 /* B3FenceValue.cpp in Sources */,
+				0F6B8AE41C4EFE1700969052 /* B3FixSSA.cpp in Sources */,
+				0F725CAF1C506D3B00AD943A /* B3FoldPathConstants.cpp in Sources */,
+				0FEC85151BDACDAC0080FF74 /* B3FrequencyClass.cpp in Sources */,
+				0FEC85181BDACDAC0080FF74 /* B3Generate.cpp in Sources */,
+				0FEC85C21BE167A00080FF74 /* B3HeapRange.cpp in Sources */,
+				DC69B99C1D15F912002E3C00 /* B3InferSwitches.cpp in Sources */,
+				0FEC85B91BE1462F0080FF74 /* B3InsertionSet.cpp in Sources */,
+				0FDF67D31D9C6D2A001B9825 /* B3Kind.cpp in Sources */,
+				436E54541C468E7700B5AF73 /* B3LegalizeMemoryOffsets.cpp in Sources */,
+				0F338E1D1BF286EA0013C88F /* B3LowerMacros.cpp in Sources */,
+				4319DA031C1BE40A001D260B /* B3LowerMacrosAfterOptimizations.cpp in Sources */,
+				0FEC851D1BDACDAC0080FF74 /* B3LowerToAir.cpp in Sources */,
+				43AB26C71C1A535C00D82AE6 /* B3MathExtras.cpp in Sources */,
+				0FEC851F1BDACDAC0080FF74 /* B3MemoryValue.cpp in Sources */,
+				0F338E0F1BF0276C0013C88F /* B3MoveConstants.cpp in Sources */,
+				0F338E121BF0276C0013C88F /* B3OpaqueByproducts.cpp in Sources */,
+				0FEC85211BDACDAC0080FF74 /* B3Opcode.cpp in Sources */,
+				0FEC85231BDACDAC0080FF74 /* B3Origin.cpp in Sources */,
+				0F4DE1D11C4D764B004D6C11 /* B3OriginDump.cpp in Sources */,
+				0FEC85251BDACDAC0080FF74 /* B3PatchpointSpecial.cpp in Sources */,
+				0FEC85271BDACDAC0080FF74 /* B3PatchpointValue.cpp in Sources */,
+				0FEC85291BDACDAC0080FF74 /* B3PhaseScope.cpp in Sources */,
+				0F37308C1C0BD29100052BFA /* B3PhiChildren.cpp in Sources */,
+				0FEC852B1BDACDAC0080FF74 /* B3Procedure.cpp in Sources */,
+				0F725CA91C503DED00AD943A /* B3PureCSE.cpp in Sources */,
+				43422A661C16267500E2EB98 /* B3ReduceDoubleToFloat.cpp in Sources */,
+				0FEC85BC1BE1462F0080FF74 /* B3ReduceStrength.cpp in Sources */,
+				0FEC85341BDACDAC0080FF74 /* B3SlotBaseValue.cpp in Sources */,
+				0F6B8ADC1C4EFAC300969052 /* B3SSACalculator.cpp in Sources */,
+				0F33FCF71C136E2500323F67 /* B3StackmapGenerationParams.cpp in Sources */,
+				0FEC85301BDACDAC0080FF74 /* B3StackmapSpecial.cpp in Sources */,
+				0F338DF11BE93AD10013C88F /* B3StackmapValue.cpp in Sources */,
+				0F9495871C57F47500413A48 /* B3StackSlot.cpp in Sources */,
+				0FEC85371BDACDAC0080FF74 /* B3SwitchCase.cpp in Sources */,
+				0FEC85391BDACDAC0080FF74 /* B3SwitchValue.cpp in Sources */,
+				0F4570401BE584CA0062A629 /* B3TimingScope.cpp in Sources */,
+				0FEC853B1BDACDAC0080FF74 /* B3Type.cpp in Sources */,
+				0FEC853D1BDACDAC0080FF74 /* B3UpsilonValue.cpp in Sources */,
+				0FEC853F1BDACDAC0080FF74 /* B3UseCounts.cpp in Sources */,
+				0FEC85411BDACDAC0080FF74 /* B3Validate.cpp in Sources */,
+				0FEC85431BDACDAC0080FF74 /* B3Value.cpp in Sources */,
+				0F338E141BF0276C0013C88F /* B3ValueKey.cpp in Sources */,
+				0FEC85461BDACDAC0080FF74 /* B3ValueRep.cpp in Sources */,
+				0F2BBD971C5FF3F50023EF23 /* B3Variable.cpp in Sources */,
+				0F2BBD991C5FF3F50023EF23 /* B3VariableValue.cpp in Sources */,
+				53D444DE1DAF09A000B92784 /* B3WasmAddressValue.cpp in Sources */,
+				5341FC701DAC33E500E7E4D7 /* B3WasmBoundsCheckValue.cpp in Sources */,
+				52678F8E1A031009006A306D /* BasicBlockLocation.cpp in Sources */,
+				0F64B2711A784BAF006E4E66 /* BinarySwitch.cpp in Sources */,
+				14280863107EC11A0013E7B2 /* BooleanConstructor.cpp in Sources */,
+				14280864107EC11A0013E7B2 /* BooleanObject.cpp in Sources */,
+				14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */,
+				DE26E9071CB5DEFB00D2BE82 /* BuiltinExecutableCreator.cpp in Sources */,
+				A7D801A41880D66E0026C39B /* BuiltinExecutables.cpp in Sources */,
+				9EA5C7A1190F084200508EBE /* BundlePath.mm in Sources */,
+				C2FCAE1017A9C24E0034C735 /* BytecodeBasicBlock.cpp in Sources */,
+				148F21AA107EC53A0042EC2C /* BytecodeGenerator.cpp in Sources */,
+				E328DAE71D38D004001A2529 /* BytecodeGeneratorification.cpp in Sources */,
+				7094C4DE1AE439530041A2EE /* BytecodeIntrinsicRegistry.cpp in Sources */,
+				C2FCAE1217A9C24E0034C735 /* BytecodeLivenessAnalysis.cpp in Sources */,
+				E328DAEA1D38D005001A2529 /* BytecodeRewriter.cpp in Sources */,
+				65B8392F1BACAD6A0044E824 /* CachedRecovery.cpp in Sources */,
+				1428082D107EC0570013E7B2 /* CallData.cpp in Sources */,
+				0F64B2791A7957B2006E4E66 /* CallEdge.cpp in Sources */,
+				1429D8DD0ED2205B00B89619 /* CallFrame.cpp in Sources */,
+				62EC9BB61B7EB07C00303AD1 /* CallFrameShuffleData.cpp in Sources */,
+				62D755D61B84FB46001801FA /* CallFrameShuffler.cpp in Sources */,
+				62D755D51B84FB40001801FA /* CallFrameShuffler32_64.cpp in Sources */,
+				62D755D41B84FB3D001801FA /* CallFrameShuffler64.cpp in Sources */,
+				0F0B83B014BCF71600885B4F /* CallLinkInfo.cpp in Sources */,
+				0F93329D14CA7DC30085F3C6 /* CallLinkStatus.cpp in Sources */,
+				627673231B680C1E00FD9F2E /* CallMode.cpp in Sources */,
+				0F3B7E2A19A11B8000D9BC56 /* CallVariant.cpp in Sources */,
+				FE80C1991D775FBE008510C0 /* CatchScope.cpp in Sources */,
+				DC17E81A1C9C91E9008A6AB3 /* CCallHelpers.cpp in Sources */,
+				0FDE87F91DFD0C760064C390 /* CellContainer.cpp in Sources */,
+				0FE050251AA9095600D33B33 /* ClonedArguments.cpp in Sources */,
+				1428083A107EC0750013E7B2 /* CLoopStack.cpp in Sources */,
+				969A07960ED1D3AE00F1F681 /* CodeBlock.cpp in Sources */,
+				0F8F94401667633000D61971 /* CodeBlockHash.cpp in Sources */,
+				0FC97F33182020D7002C9B26 /* CodeBlockJettisoningWatchpoint.cpp in Sources */,
+				0FD8A31317D4326C00CA2C40 /* CodeBlockSet.cpp in Sources */,
+				A77F1821164088B200640A47 /* CodeCache.cpp in Sources */,
+				0F8F9446166764F100D61971 /* CodeOrigin.cpp in Sources */,
+				86B5826714D2796C00A9C306 /* CodeProfile.cpp in Sources */,
+				86B5826914D2797000A9C306 /* CodeProfiling.cpp in Sources */,
+				0F8F943C1667631300D61971 /* CodeSpecializationKind.cpp in Sources */,
+				0F8F94421667633500D61971 /* CodeType.cpp in Sources */,
+				0FA762041DB9242600B7A2FD /* CollectionScope.cpp in Sources */,
+				147F39C1107EC37600427A48 /* CommonIdentifiers.cpp in Sources */,
+				A709F2F217A0AC2A00512E98 /* CommonSlowPaths.cpp in Sources */,
+				6553A33117A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp in Sources */,
+				A7E5A3A71797432D00E893C0 /* CompilationResult.cpp in Sources */,
+				147F39C2107EC37600427A48 /* Completion.cpp in Sources */,
+				0F6FC750196110A800E1D02D /* ComplexGetStatus.cpp in Sources */,
+				146B16D812EB5B59001BEC1B /* ConservativeRoots.cpp in Sources */,
+				A5B6A74D18C6DBA600F11E91 /* ConsoleClient.cpp in Sources */,
+				A5FD0079189B051000633231 /* ConsoleMessage.cpp in Sources */,
+				A55714BF1CD804A40004D2C6 /* ConsoleObject.cpp in Sources */,
+				0F978B3B1AAEA71D007C7369 /* ConstantMode.cpp in Sources */,
+				1428082E107EC0570013E7B2 /* ConstructData.cpp in Sources */,
+				A57D23F11891B5B40031C7FA /* ContentSearchUtilities.cpp in Sources */,
+				52B717B51A0597E1007AF4F3 /* ControlFlowProfiler.cpp in Sources */,
+				2A111245192FCE79005EE18D /* CustomGetterSetter.cpp in Sources */,
+				62E3D5F01B8D0B7300B868BB /* DataFormat.cpp in Sources */,
+				0F2B66DE17B6B5AB00A7AE3F /* DataView.cpp in Sources */,
+				147F39C3107EC37600427A48 /* DateConstructor.cpp in Sources */,
+				147F39C4107EC37600427A48 /* DateConversion.cpp in Sources */,
+				147F39C5107EC37600427A48 /* DateInstance.cpp in Sources */,
+				147F39C6107EC37600427A48 /* DatePrototype.cpp in Sources */,
+				14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */,
+				149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */,
+				A5FC84B31D1DDAD9006B5C46 /* DebuggerLocation.cpp in Sources */,
+				A5A1A0951D8CB341004C2EB8 /* DebuggerParseData.cpp in Sources */,
+				0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */,
+				2A7A58EF1808A4C40020BDF7 /* DeferGC.cpp in Sources */,
+				0FC712DE17CD8779008CC93C /* DeferredCompilationCallback.cpp in Sources */,
+				FE5068671AE25E280009DAB7 /* DeferredSourceDump.cpp in Sources */,
+				0F96303B1D4192CB005609D9 /* DestructionMode.cpp in Sources */,
+				A77A423D17A0BBFD00A8DB81 /* DFGAbstractHeap.cpp in Sources */,
+				0F55C19417276E4600CEABFD /* DFGAbstractValue.cpp in Sources */,
+				0FD3E4011B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp in Sources */,
+				0F18D3CF1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp in Sources */,
+				0F2DD8111AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.cpp in Sources */,
+				0F2DD8131AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.cpp in Sources */,
+				0F485321187750560083B687 /* DFGArithMode.cpp in Sources */,
+				0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */,
+				A7D9A29417A0BC7400EE2618 /* DFGAtTailAbstractState.cpp in Sources */,
+				0F666EC61835672B00D017F1 /* DFGAvailability.cpp in Sources */,
+				0F2B9CE219D0BA7D00B1D1B5 /* DFGAvailabilityMap.cpp in Sources */,
+				0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources */,
+				A7D89CF217A0B8CC00773AD8 /* DFGBasicBlock.cpp in Sources */,
+				A7D89CF317A0B8CC00773AD8 /* DFGBlockInsertionSet.cpp in Sources */,
+				0FBF158C19B7A53100695DD0 /* DFGBlockSet.cpp in Sources */,
+				86EC9DC41328DF82002B2AD7 /* DFGByteCodeParser.cpp in Sources */,
+				0FD82E2114172CE300179C94 /* DFGCapabilities.cpp in Sources */,
+				0FFFC95714EF90A000C72532 /* DFGCFAPhase.cpp in Sources */,
+				0F3B3A271544C995003ED0FF /* DFGCFGSimplificationPhase.cpp in Sources */,
+				0F9D36941AE9CC33000D4DFB /* DFGCleanUpPhase.cpp in Sources */,
+				A77A423F17A0BBFD00A8DB81 /* DFGClobberize.cpp in Sources */,
+				A77A424117A0BBFD00A8DB81 /* DFGClobberSet.cpp in Sources */,
+				0F3C1F1A1B868E7900ABB08B /* DFGClobbersExitState.cpp in Sources */,
+				0F04396D1B03DC0B009598B7 /* DFGCombinedLiveness.cpp in Sources */,
+				0FF0F19D16B72A08005DF95B /* DFGCommon.cpp in Sources */,
+				0FEA0A31170D40BF00BB722C /* DFGCommonData.cpp in Sources */,
+				0F38B01717CFE75500B144D3 /* DFGCompilationKey.cpp in Sources */,
+				0F38B01917CFE75500B144D3 /* DFGCompilationMode.cpp in Sources */,
+				0F3B3A1A153E68F2003ED0FF /* DFGConstantFoldingPhase.cpp in Sources */,
+				0FED67B91B26256D0066CE15 /* DFGConstantHoistingPhase.cpp in Sources */,
+				0FBE0F7216C1DB030082C5E8 /* DFGCPSRethreadingPhase.cpp in Sources */,
+				A7D89CF517A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp in Sources */,
+				0FFFC95914EF90A600C72532 /* DFGCSEPhase.cpp in Sources */,
+				0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */,
+				0F8F2B99172F04FF007DBDA5 /* DFGDesiredIdentifiers.cpp in Sources */,
+				C2C0F7CD17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp in Sources */,
+				0FE8534B1723CDA500B618F5 /* DFGDesiredWatchpoints.cpp in Sources */,
+				C2981FD817BAEE4B00A3BC98 /* DFGDesiredWeakReferences.cpp in Sources */,
+				0FF427641591A1CC004CB9FF /* DFGDisassembler.cpp in Sources */,
+				0F5A1273192D9FDF008764A3 /* DFGDoesGC.cpp in Sources */,
+				E322E5A21DA64439006E7709 /* DFGDOMJITPatchpointParams.cpp in Sources */,
+				0FD3C82614115D4000FD81CB /* DFGDriver.cpp in Sources */,
+				0FF0F19E16B72A0B005DF95B /* DFGEdge.cpp in Sources */,
+				0F8F14331ADF090100ED792C /* DFGEpoch.cpp in Sources */,
+				0FBC0AE71496C7C400D4FBDD /* DFGExitProfile.cpp in Sources */,
+				A78A9774179738B8009DF744 /* DFGFailedFinalizer.cpp in Sources */,
+				A78A9776179738B8009DF744 /* DFGFinalizer.cpp in Sources */,
+				0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */,
+				0F20177F1DCADC3300EA5950 /* DFGFlowIndexing.cpp in Sources */,
+				0F9D339617FFC4E60073C2BC /* DFGFlushedAt.cpp in Sources */,
+				A7D89CF717A0B8CC00773AD8 /* DFGFlushFormat.cpp in Sources */,
+				0F69CC88193AC60A0045759E /* DFGFrozenValue.cpp in Sources */,
+				86EC9DC71328DF82002B2AD7 /* DFGGraph.cpp in Sources */,
+				0F2FCCF918A60070001A27F8 /* DFGGraphSafepoint.cpp in Sources */,
+				0FB17660196B8F9E0091052A /* DFGHeapLocation.cpp in Sources */,
+				0FC841681BA8C3210061837D /* DFGInferredTypeCheck.cpp in Sources */,
+				A704D90517A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp in Sources */,
+				0F3BD1B71B896A0700598AA6 /* DFGInsertionSet.cpp in Sources */,
+				0F300B7B18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.cpp in Sources */,
+				0F898F311B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.cpp in Sources */,
+				0FC97F3D18202119002C9B26 /* DFGInvalidationPointInjectionPhase.cpp in Sources */,
+				0FEA0A33170D40BF00BB722C /* DFGJITCode.cpp in Sources */,
+				86EC9DCB1328DF82002B2AD7 /* DFGJITCompiler.cpp in Sources */,
+				A78A9778179738B8009DF744 /* DFGJITFinalizer.cpp in Sources */,
+				0FC97F3F18202119002C9B26 /* DFGJumpReplacement.cpp in Sources */,
+				A73A535A1799CD5D00170C19 /* DFGLazyJSValue.cpp in Sources */,
+				62F2AA371B0BEDE300610C7A /* DFGLazyNode.cpp in Sources */,
+				A7D9A29717A0BC7400EE2618 /* DFGLICMPhase.cpp in Sources */,
+				79C4B15D1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp in Sources */,
+				A7D89CFB17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.cpp in Sources */,
+				0FF0F19916B729F6005DF95B /* DFGLongLivedState.cpp in Sources */,
+				A767B5B517A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp in Sources */,
+				79F8FC1E1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp in Sources */,
+				0F5874ED194FEB1200AAB2C1 /* DFGMayExit.cpp in Sources */,
+				0F1725FF1B48719A00AC3A55 /* DFGMinifiedGraph.cpp in Sources */,
+				0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */,
+				0F8F14351ADF090100ED792C /* DFGMovHintRemovalPhase.cpp in Sources */,
+				0FF2CD5B1B61A4F8004955A8 /* DFGMultiGetByOffsetData.cpp in Sources */,
+				A737810D1799EA2E00817533 /* DFGNaturalLoops.cpp in Sources */,
+				0FF0F19C16B72A03005DF95B /* DFGNode.cpp in Sources */,
+				0F20178A1DCB942600EA5950 /* DFGNodeAbstractValuePair.cpp in Sources */,
+				0FA581BA150E952C00B9A2D9 /* DFGNodeFlags.cpp in Sources */,
+				0F2017861DCAE14C00EA5950 /* DFGNodeFlowProjection.cpp in Sources */,
+				0F5D085D1B8CF99D001143B4 /* DFGNodeOrigin.cpp in Sources */,
+				0F2B9CE619D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp in Sources */,
+				0F2B9CE819D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp in Sources */,
+				86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */,
+				A7D89CFD17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.cpp in Sources */,
+				0FD82E56141DAF0800179C94 /* DFGOSREntry.cpp in Sources */,
+				0FD8A32517D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.cpp in Sources */,
+				0FC09791146A6F7100CF2442 /* DFGOSRExit.cpp in Sources */,
+				0F235BEB17178E7300690C7F /* DFGOSRExitBase.cpp in Sources */,
+				0FC09792146A6F7300CF2442 /* DFGOSRExitCompiler.cpp in Sources */,
+				0FC09776146943B000CF2442 /* DFGOSRExitCompiler32_64.cpp in Sources */,
+				0FC0977214693AF900CF2442 /* DFGOSRExitCompiler64.cpp in Sources */,
+				0F7025A91714B0FA00382C0E /* DFGOSRExitCompilerCommon.cpp in Sources */,
+				0F392C891B46188400844728 /* DFGOSRExitFuzz.cpp in Sources */,
+				0FEFC9AA1681A3B300567F53 /* DFGOSRExitJumpPlaceholder.cpp in Sources */,
+				0F235BED17178E7300690C7F /* DFGOSRExitPreparation.cpp in Sources */,
+				0F6237971AE45CA700D402EA /* DFGPhantomInsertionPhase.cpp in Sources */,
+				0FFFC95B14EF90AD00C72532 /* DFGPhase.cpp in Sources */,
+				0F2B9CEA19D0BA7D00B1D1B5 /* DFGPhiChildren.cpp in Sources */,
+				A78A977A179738B8009DF744 /* DFGPlan.cpp in Sources */,
+				0FBE0F7416C1DB090082C5E8 /* DFGPredictionInjectionPhase.cpp in Sources */,
+				0FFFC95D14EF90B300C72532 /* DFGPredictionPropagationPhase.cpp in Sources */,
+				0F3E01AA19D353A500F61B7F /* DFGPrePostNumbering.cpp in Sources */,
+				0F2B9CEC19D0BA7D00B1D1B5 /* DFGPromotedHeapLocation.cpp in Sources */,
+				0FB17662196B8F9E0091052A /* DFGPureValue.cpp in Sources */,
+				0F3A1BF91A9ECB7D000DE01A /* DFGPutStackSinkingPhase.cpp in Sources */,
+				0F2FCCFB18A60070001A27F8 /* DFGSafepoint.cpp in Sources */,
+				86EC9DD21328DF82002B2AD7 /* DFGSpeculativeJIT.cpp in Sources */,
+				86880F1F14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp in Sources */,
+				86880F4D14353B2100B08D42 /* DFGSpeculativeJIT64.cpp in Sources */,
+				0F682FB219BCB36400FA3BAD /* DFGSSACalculator.cpp in Sources */,
+				A7D89CFF17A0B8CC00773AD8 /* DFGSSAConversionPhase.cpp in Sources */,
+				0FC20CB918556A3500C9E954 /* DFGSSALoweringPhase.cpp in Sources */,
+				0F9FB4F417FCB91700CB67F8 /* DFGStackLayoutPhase.cpp in Sources */,
+				0F4F29DF18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp in Sources */,
+				0F7F988B1D9596C500F4F12E /* DFGStoreBarrierClusteringPhase.cpp in Sources */,
+				0F9E32631B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.cpp in Sources */,
+				0FC20CB51852E2C600C9E954 /* DFGStrengthReductionPhase.cpp in Sources */,
+				0F893BDB1936E23C001211F4 /* DFGStructureAbstractValue.cpp in Sources */,
+				0F2FCCFE18A60070001A27F8 /* DFGThreadData.cpp in Sources */,
+				0FC097A1146B28CA00CF2442 /* DFGThunks.cpp in Sources */,
+				0FD8A32717D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.cpp in Sources */,
+				0FD8A32917D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.cpp in Sources */,
+				0FD8A32B17D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.cpp in Sources */,
+				0FE7211D193B9C590031F6ED /* DFGTransition.cpp in Sources */,
+				0F63944015C75F1D006A597C /* DFGTypeCheckHoistingPhase.cpp in Sources */,
+				0FBE0F7616C1DB0F0082C5E8 /* DFGUnificationPhase.cpp in Sources */,
+				0F34B14916D42010001CDA5A /* DFGUseKind.cpp in Sources */,
+				0F3B3A2B15475000003ED0FF /* DFGValidate.cpp in Sources */,
+				0F2BDC4F15228BF300CD8910 /* DFGValueSource.cpp in Sources */,
+				0F0123321944EA1B00843A0C /* DFGValueStrength.cpp in Sources */,
+				0FE254F61ABDDD2200A7C6D2 /* DFGVarargsForwardingPhase.cpp in Sources */,
+				0F6E845A19030BEF00562741 /* DFGVariableAccessData.cpp in Sources */,
+				0FDDBFB51666EED800C55FEF /* DFGVariableAccessDataDump.cpp in Sources */,
+				0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */,
+				0F2BDC4A1522809A00CD8910 /* DFGVariableEventStream.cpp in Sources */,
+				0FFFC95F14EF90BB00C72532 /* DFGVirtualRegisterAllocationPhase.cpp in Sources */,
+				0FC97F4118202119002C9B26 /* DFGWatchpointCollectionPhase.cpp in Sources */,
+				0FDB2CE7174830A2007B3C1B /* DFGWorklist.cpp in Sources */,
+				0FE050171AA9091100D33B33 /* DirectArguments.cpp in Sources */,
+				0FE050151AA9091100D33B33 /* DirectArgumentsOffset.cpp in Sources */,
+				0F2EBBAB1DEDF95000990369 /* DirectEvalCodeCache.cpp in Sources */,
+				14386A741DD69895008652C4 /* DirectEvalExecutable.cpp in Sources */,
+				0F9D3370165DBB90005AD387 /* Disassembler.cpp in Sources */,
+				E35CA1551DBC3A5F00F83516 /* DOMJITAbstractHeap.cpp in Sources */,
+				E3BFD0BB1DAF80870065DEA2 /* DOMJITAccessCasePatchpointParams.cpp in Sources */,
+				E35CA1531DBC3A5C00F83516 /* DOMJITHeapRange.cpp in Sources */,
+				A70447ED17A0BD7000F5898E /* DumpContext.cpp in Sources */,
+				FE318FDF1CAC982700DFCC54 /* ECMAScriptSpecInternalFunctions.cpp in Sources */,
+				2A83638518D7D0EE0000EBCC /* EdenGCActivityCallback.cpp in Sources */,
+				99E45A2518A1B2590026D88F /* EncodedValue.cpp in Sources */,
+				147F39C7107EC37600427A48 /* Error.cpp in Sources */,
+				147F39C8107EC37600427A48 /* ErrorConstructor.cpp in Sources */,
+				FEB58C14187B8B160098EF0B /* ErrorHandlingScope.cpp in Sources */,
+				147F39C9107EC37600427A48 /* ErrorInstance.cpp in Sources */,
+				147F39CA107EC37600427A48 /* ErrorPrototype.cpp in Sources */,
+				14AD91171DCA97FD0014F9FE /* EvalCodeBlock.cpp in Sources */,
+				147341E21DC2CE9600AA29BA /* EvalExecutable.cpp in Sources */,
+				A54982031891D0B00081E5B8 /* EventLoop.cpp in Sources */,
+				7980C16C1E3A940E00B71615 /* DFGRegisteredStructureSet.cpp in Sources */,
+				FE1C0FFF1B194FD100B53FCA /* Exception.cpp in Sources */,
+				FE80C19B1D776A98008510C0 /* ExceptionEventLocation.cpp in Sources */,
+				0F12DE0F1979D5FD0006FF4E /* ExceptionFuzz.cpp in Sources */,
+				1429D8780ED21ACD00B89619 /* ExceptionHelpers.cpp in Sources */,
+				FE6491391D78F3AF00A694D4 /* ExceptionScope.cpp in Sources */,
+				0FF054F91AC35B4400E5BE57 /* ExecutableAllocationFuzz.cpp in Sources */,
+				A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */,
+				86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */,
+				147341EA1DC2CF2500AA29BA /* ExecutableBase.cpp in Sources */,
+				0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */,
+				0F0332C018ADFAE1005F979A /* ExitingJITType.cpp in Sources */,
+				0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */,
+				0F5513A81D5A68CD00C32BD8 /* FreeList.cpp in Sources */,
+				0FEA0A1C1708B00700BB722C /* FTLAbstractHeap.cpp in Sources */,
+				0FEA0A1E1708B00700BB722C /* FTLAbstractHeapRepository.cpp in Sources */,
+				0F485327187DFDEC0083B687 /* FTLAvailableRecovery.cpp in Sources */,
+				0FEA0A09170513DB00BB722C /* FTLCapabilities.cpp in Sources */,
+				0FEA0A271709623B00BB722C /* FTLCommonValues.cpp in Sources */,
+				0FB387921BFD31A100E3AB1E /* FTLCompile.cpp in Sources */,
+				E322E5A61DA644A8006E7709 /* FTLDOMJITPatchpointParams.cpp in Sources */,
+				0F9D4C0C1C3E1C11006CD984 /* FTLExceptionTarget.cpp in Sources */,
+				0F235BD317178E1C00690C7F /* FTLExitArgument.cpp in Sources */,
+				0F235BD517178E1C00690C7F /* FTLExitArgumentForOperand.cpp in Sources */,
+				0F2B9CF419D0BAC100B1D1B5 /* FTLExitPropertyValue.cpp in Sources */,
+				0F2B9CF619D0BAC100B1D1B5 /* FTLExitTimeObjectMaterialization.cpp in Sources */,
+				0F235BDA17178E1C00690C7F /* FTLExitValue.cpp in Sources */,
+				A7F2996B17A0BB670010417A /* FTLFail.cpp in Sources */,
+				0FD8A31917D51F2200CA2C40 /* FTLForOSREntryJITCode.cpp in Sources */,
+				0FEA0A0D170513DB00BB722C /* FTLJITCode.cpp in Sources */,
+				A78A9780179738D5009DF744 /* FTLJITFinalizer.cpp in Sources */,
+				0FB4FB731BC843140025CA5A /* FTLLazySlowPath.cpp in Sources */,
+				0F8F2B95172E04A0007DBDA5 /* FTLLink.cpp in Sources */,
+				0FCEFADF180738C000472CE4 /* FTLLocation.cpp in Sources */,
+				0FEA0A0F170513DB00BB722C /* FTLLowerDFGToB3.cpp in Sources */,
+				0F2B9CF819D0BAC100B1D1B5 /* FTLOperations.cpp in Sources */,
+				0FD8A31B17D51F2200CA2C40 /* FTLOSREntry.cpp in Sources */,
+				0F235BDC17178E1C00690C7F /* FTLOSRExit.cpp in Sources */,
+				0F235BDF17178E1C00690C7F /* FTLOSRExitCompiler.cpp in Sources */,
+				0F9B1DB71C0E42BD00E5BFD2 /* FTLOSRExitHandle.cpp in Sources */,
+				0F9B1DB41C0E42A500E5BFD2 /* FTLOutput.cpp in Sources */,
+				0F9D4C101C3E2C74006CD984 /* FTLPatchpointExceptionHandle.cpp in Sources */,
+				0F485329187DFDEC0083B687 /* FTLRecoveryOpcode.cpp in Sources */,
+				0FCEFAAB1804C13E00472CE4 /* FTLSaveRestore.cpp in Sources */,
+				0F25F1B1181635F300522F39 /* FTLSlowPathCall.cpp in Sources */,
+				0F25F1B3181635F300522F39 /* FTLSlowPathCallKey.cpp in Sources */,
+				0FEA0A161706BB9000BB722C /* FTLState.cpp in Sources */,
+				0F235BE117178E1C00690C7F /* FTLThunks.cpp in Sources */,
+				0F5A6283188C98D40072C9DF /* FTLValueRange.cpp in Sources */,
+				2A83638918D7D0FE0000EBCC /* FullGCActivityCallback.cpp in Sources */,
+				14AD911B1DCA97FD0014F9FE /* FunctionCodeBlock.cpp in Sources */,
+				147F39CB107EC37600427A48 /* FunctionConstructor.cpp in Sources */,
+				147341E31DC2CE9600AA29BA /* FunctionExecutable.cpp in Sources */,
+				0FF0F19F16B72A17005DF95B /* FunctionExecutableDump.cpp in Sources */,
+				52B310FD1974AE870080857C /* FunctionHasExecutedCache.cpp in Sources */,
+				FE4BFF2B1AD476E700088F87 /* FunctionOverrides.cpp in Sources */,
+				147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */,
+				62D2D38F1ADF103F000206C1 /* FunctionRareData.cpp in Sources */,
+				FEA0C4021CDD7D1D00481991 /* FunctionWhitelist.cpp in Sources */,
+				2AACE63C18CA5A0300ED0191 /* GCActivityCallback.cpp in Sources */,
+				0F766D2F15A8DCE0008F363E /* GCAwareJITStubRoutine.cpp in Sources */,
+				2ADFA26318EF3540004F9FCC /* GCLogging.cpp in Sources */,
+				70B791941C024A28002481E2 /* GeneratorFunctionConstructor.cpp in Sources */,
+				70B791961C024A28002481E2 /* GeneratorFunctionPrototype.cpp in Sources */,
+				70B791981C024A29002481E2 /* GeneratorPrototype.cpp in Sources */,
+				0F93329F14CA7DCA0085F3C6 /* GetByIdStatus.cpp in Sources */,
+				0F0332C318B01763005F979A /* GetByIdVariant.cpp in Sources */,
+				14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */,
+				0F93274D1C1F66AA00CF6564 /* GPRInfo.cpp in Sources */,
+				142E3135134FF0A600AFADB5 /* HandleSet.cpp in Sources */,
+				142E3137134FF0A600AFADB5 /* HandleStack.cpp in Sources */,
+				79A0907F1D768465008B889B /* HashMapImpl.cpp in Sources */,
+				14BA7A9713AADFF8005B7C2C /* Heap.cpp in Sources */,
+				DC3D2B0C1D34377000BA918C /* HeapCell.cpp in Sources */,
+				0F32BD101BB34F190093A57F /* HeapHelperPool.cpp in Sources */,
+				A5398FAC1C750DA60060A963 /* HeapProfiler.cpp in Sources */,
+				A54C2AB01C6544EE00A18D78 /* HeapSnapshot.cpp in Sources */,
+				A5311C371C77CECA00E6B1B6 /* HeapSnapshotBuilder.cpp in Sources */,
+				C24D31E2161CD695002AA4DB /* HeapStatistics.cpp in Sources */,
+				C2E526BD1590EF000054E48D /* HeapTimer.cpp in Sources */,
+				FE7BA60F1A1A7CEC00F1F7B4 /* HeapVerifier.cpp in Sources */,
+				0F4680D414BBD24900BFE272 /* HostCallReturnValue.cpp in Sources */,
+				DC2143081CA32E58000A8869 /* ICStats.cpp in Sources */,
+				147F39CE107EC37600427A48 /* Identifier.cpp in Sources */,
+				A5FD0075189B038C00633231 /* IdentifiersFactory.cpp in Sources */,
+				C25F8BCD157544A900245B71 /* IncrementalSweeper.cpp in Sources */,
+				0F13E04E16164A1F00DC8DE7 /* IndexingType.cpp in Sources */,
+				14386A781DD6989C008652C4 /* IndirectEvalExecutable.cpp in Sources */,
+				0F0A75221B94BFA900110660 /* InferredType.cpp in Sources */,
+				0FFC92111B94D4DF0071DD66 /* InferredTypeTable.cpp in Sources */,
+				0FF8BDEA1AD4CF7100DFE884 /* InferredValue.cpp in Sources */,
+				9E729407190F01A5001A91B5 /* InitializeThreading.cpp in Sources */,
+				A513E5B7185B8BD3007E95AD /* InjectedScript.cpp in Sources */,
+				A514B2C2185A684400F3C7CB /* InjectedScriptBase.cpp in Sources */,
+				A58E35911860DECF001F24FE /* InjectedScriptHost.cpp in Sources */,
+				A513E5CA185F9624007E95AD /* InjectedScriptManager.cpp in Sources */,
+				A5840E20187B7B8600843B10 /* InjectedScriptModule.cpp in Sources */,
+				7905BB681D12050E0019FE57 /* InlineAccess.cpp in Sources */,
+				148A7BEF1B82975A002D9157 /* InlineCallFrame.cpp in Sources */,
+				0F24E55517F0B71C00ABB217 /* InlineCallFrameSet.cpp in Sources */,
+				A5CEEE14187F3BAD00E55C99 /* InspectorAgent.cpp in Sources */,
+				A593CF86184038CA00BFCE27 /* InspectorAgentRegistry.cpp in Sources */,
+				A593CF7C1840360300BFCE27 /* InspectorBackendDispatcher.cpp in Sources */,
+				A532438718568335002ED692 /* InspectorBackendDispatchers.cpp in Sources */,
+				A5FD0081189B191A00633231 /* InspectorConsoleAgent.cpp in Sources */,
+				A57D23E51890CEBF0031C7FA /* InspectorDebuggerAgent.cpp in Sources */,
+				A532438918568335002ED692 /* InspectorFrontendDispatchers.cpp in Sources */,
+				99F1A6FE1B8E6D9400463B26 /* InspectorFrontendRouter.cpp in Sources */,
+				A5339EC71BB399A90054F005 /* InspectorHeapAgent.cpp in Sources */,
+				E35E035F1B7AB43E0073AD2A /* InspectorInstrumentationObject.cpp in Sources */,
+				A532438B18568335002ED692 /* InspectorProtocolObjects.cpp in Sources */,
+				A50E4B6118809DD50068A46D /* InspectorRuntimeAgent.cpp in Sources */,
+				A55165D21BDF0B98003B75C1 /* InspectorScriptProfilerAgent.cpp in Sources */,
+				A593CF821840377100BFCE27 /* InspectorValues.cpp in Sources */,
+				147F39CF107EC37600427A48 /* InternalFunction.cpp in Sources */,
+				1429D7D40ED2128200B89619 /* Interpreter.cpp in Sources */,
+				A1B9E2391B4E0D6700BC7FED /* IntlCollator.cpp in Sources */,
+				A1B9E23B1B4E0D6700BC7FED /* IntlCollatorConstructor.cpp in Sources */,
+				A1B9E23D1B4E0D6700BC7FED /* IntlCollatorPrototype.cpp in Sources */,
+				A1587D6D1B4DC14100D69849 /* IntlDateTimeFormat.cpp in Sources */,
+				A1587D6F1B4DC14100D69849 /* IntlDateTimeFormatConstructor.cpp in Sources */,
+				A1587D711B4DC14100D69849 /* IntlDateTimeFormatPrototype.cpp in Sources */,
+				A1D792FC1B43864B004516F5 /* IntlNumberFormat.cpp in Sources */,
+				A1D792FE1B43864B004516F5 /* IntlNumberFormatConstructor.cpp in Sources */,
+				A1D793001B43864B004516F5 /* IntlNumberFormatPrototype.cpp in Sources */,
+				A12BBFF41B044A9800664B69 /* IntlObject.cpp in Sources */,
+				DE5A0A001BA3AC3E003D4424 /* IntrinsicEmitter.cpp in Sources */,
+				70113D4B1A8DB093003848C4 /* IteratorOperations.cpp in Sources */,
+				70DC3E091B2DF2C700054299 /* IteratorPrototype.cpp in Sources */,
+				A503FA19188E0FB000110F14 /* JavaScriptCallFrame.cpp in Sources */,
+				1429D92F0ED22D7000B89619 /* JIT.cpp in Sources */,
+				FE1220281BE7F5910039E6F2 /* JITAddGenerator.cpp in Sources */,
+				86A90ED00EE7D51F00AB350D /* JITArithmetic.cpp in Sources */,
+				A75706DE118A2BCF0057F88F /* JITArithmetic32_64.cpp in Sources */,
+				FE3A06B11C10CB8400390FDD /* JITBitAndGenerator.cpp in Sources */,
+				FE3A06AC1C10C39E00390FDD /* JITBitOrGenerator.cpp in Sources */,
+				FE3A06B31C10CB8E00390FDD /* JITBitXorGenerator.cpp in Sources */,
+				86CC85A30EE79B7400288682 /* JITCall.cpp in Sources */,
+				146FE51211A710430087AE66 /* JITCall32_64.cpp in Sources */,
+				0F8F94441667635400D61971 /* JITCode.cpp in Sources */,
+				0FAF7EFD165BA91B000C8455 /* JITDisassembler.cpp in Sources */,
+				FE187A0E1C030D640038BBCA /* JITDivGenerator.cpp in Sources */,
+				0F46808314BA573100BFE272 /* JITExceptions.cpp in Sources */,
+				0FB14E1E18124ACE009B6B4D /* JITInlineCacheGenerator.cpp in Sources */,
+				FE3A06BD1C11040D00390FDD /* JITLeftShiftGenerator.cpp in Sources */,
+				FE187A011BFBE55E0038BBCA /* JITMulGenerator.cpp in Sources */,
+				FE99B24A1C24C3D700C82159 /* JITNegGenerator.cpp in Sources */,
+				BCDD51EB0FB8DF74004A8BDC /* JITOpcodes.cpp in Sources */,
+				A71236E51195F33C00BD2174 /* JITOpcodes32_64.cpp in Sources */,
+				0F24E54C17EE274900ABB217 /* JITOperations.cpp in Sources */,
+				86CC85C40EE7A89400288682 /* JITPropertyAccess.cpp in Sources */,
+				A7C1E8E4112E72EF00A37F98 /* JITPropertyAccess32_64.cpp in Sources */,
+				FE3A06BF1C11041600390FDD /* JITRightShiftGenerator.cpp in Sources */,
+				0F766D2815A8CC1E008F363E /* JITStubRoutine.cpp in Sources */,
+				0F766D2B15A8CC38008F363E /* JITStubRoutineSet.cpp in Sources */,
+				FE4238901BE18C3C00514737 /* JITSubGenerator.cpp in Sources */,
+				0F5EF91E16878F7A003E5C25 /* JITThunks.cpp in Sources */,
+				0FC712E217CD8791008CC93C /* JITToDFGDeferredCompilationCallback.cpp in Sources */,
+				DC01841A1D10C18C0057B053 /* JITWorklist.cpp in Sources */,
+				140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */,
+				C2CF39C116E15A8100DD69BE /* JSAPIWrapperObject.mm in Sources */,
+				147F39D0107EC37600427A48 /* JSArray.cpp in Sources */,
+				0F2B66E217B6B5AB00A7AE3F /* JSArrayBuffer.cpp in Sources */,
+				0F2B66E417B6B5AB00A7AE3F /* JSArrayBufferConstructor.cpp in Sources */,
+				0F2B66E617B6B5AB00A7AE3F /* JSArrayBufferPrototype.cpp in Sources */,
+				0F2B66E817B6B5AB00A7AE3F /* JSArrayBufferView.cpp in Sources */,
+				5B70CFDF1DB69E6600EC23F9 /* JSAsyncFunction.cpp in Sources */,
+				1421359B0A677F4F00A8195E /* JSBase.cpp in Sources */,
+				86FA9E91142BBB2E001773B7 /* JSBoundFunction.cpp in Sources */,
+				1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */,
+				1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */,
+				14ABDF600A437FEF00ECCA01 /* JSCallbackObject.cpp in Sources */,
+				657CF45819BF6662004ACBF2 /* JSCallee.cpp in Sources */,
+				A7D801A81880D6A80026C39B /* JSCBuiltins.cpp in Sources */,
+				147F39D1107EC37600427A48 /* JSCell.cpp in Sources */,
+				147F39D6107EC37600427A48 /* JSCJSValue.cpp in Sources */,
+				1440FCE40A51E46B0005F061 /* JSClassRef.cpp in Sources */,
+				86E3C616167BABEE006D760A /* JSContext.mm in Sources */,
+				14BD5A300A3E91F600BAF59C /* JSContextRef.cpp in Sources */,
+				A72028B61797601E0098028C /* JSCTestRunnerUtils.cpp in Sources */,
+				72AAF7CD1D0D31B3005E60BE /* JSCustomGetterSetterFunction.cpp in Sources */,
+				0F2B66EB17B6B5AB00A7AE3F /* JSDataView.cpp in Sources */,
+				0F2B66ED17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp in Sources */,
+				978801401471AD920041B016 /* JSDateMath.cpp in Sources */,
+				0F7DF13B1E2971110095951B /* JSDestructibleObjectSubspace.cpp in Sources */,
+				FE384EE51ADDB7AD0055DE2C /* JSDollarVM.cpp in Sources */,
+				FE384EE71ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp in Sources */,
+				147F39D7107EC37600427A48 /* JSEnvironmentRecord.cpp in Sources */,
+				798937781DCAB57300F8D4FB /* JSFixedArray.cpp in Sources */,
+				140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */,
+				70B7919B1C024A46002481E2 /* JSGeneratorFunction.cpp in Sources */,
+				797E07A91B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp in Sources */,
+				147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */,
+				A5FD0085189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp in Sources */,
+				A5C3A1A518C0490200C9593A /* JSGlobalObjectConsoleClient.cpp in Sources */,
+				A59455921824744700CC3843 /* JSGlobalObjectDebuggable.cpp in Sources */,
+				A57D23E91891B0770031C7FA /* JSGlobalObjectDebuggerAgent.cpp in Sources */,
+				14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */,
+				A51007C0187CC3C600B38879 /* JSGlobalObjectInspectorController.cpp in Sources */,
+				A50E4B6318809DD50068A46D /* JSGlobalObjectRuntimeAgent.cpp in Sources */,
+				A503FA29188F105900110F14 /* JSGlobalObjectScriptDebugServer.cpp in Sources */,
+				A513E5BF185BFACC007E95AD /* JSInjectedScriptHost.cpp in Sources */,
+				A513E5C1185BFACC007E95AD /* JSInjectedScriptHostPrototype.cpp in Sources */,
+				E33F50801B8429A400413856 /* JSInternalPromise.cpp in Sources */,
+				E33F50781B84225700413856 /* JSInternalPromiseConstructor.cpp in Sources */,
+				E33F50841B8437A000413856 /* JSInternalPromiseDeferred.cpp in Sources */,
+				E33F50741B8421C000413856 /* JSInternalPromisePrototype.cpp in Sources */,
+				A503FA1B188E0FB000110F14 /* JSJavaScriptCallFrame.cpp in Sources */,
+				A503FA1D188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp in Sources */,
+				7013CA8B1B491A9400CAE613 /* JSJob.cpp in Sources */,
+				140B7D1D0DC69AF7009C42B8 /* JSLexicalEnvironment.cpp in Sources */,
+				14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,
+				C25D709B16DE99F400FCA6BC /* JSManagedValue.mm in Sources */,
+				A700874117CBE8EB00C3E643 /* JSMap.cpp in Sources */,
+				A74DEF95182D991400522C22 /* JSMapIterator.cpp in Sources */,
+				E3D239C81B829C1C00BBEF67 /* JSModuleEnvironment.cpp in Sources */,
+				13FECE06D3B445FCB6C93461 /* JSModuleLoader.cpp in Sources */,
+				E318CBC01B8AEF5100A2929D /* JSModuleNamespaceObject.cpp in Sources */,
+				E39DA4A61B7E8B7C0084F33A /* JSModuleRecord.cpp in Sources */,
+				E33E8D1C1B9013C300346B52 /* JSNativeStdFunction.cpp in Sources */,
+				147F39D4107EC37600427A48 /* JSObject.cpp in Sources */,
+				1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */,
+				A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */,
+				7C184E1A17BEDBD3007CB63A /* JSPromise.cpp in Sources */,
+				7C184E2217BEE240007CB63A /* JSPromiseConstructor.cpp in Sources */,
+				7C008CDA187124BB00955C24 /* JSPromiseDeferred.cpp in Sources */,
+				7C184E1E17BEE22E007CB63A /* JSPromisePrototype.cpp in Sources */,
+				2A05ABD51961DF2400341750 /* JSPropertyNameEnumerator.cpp in Sources */,
+				E3EF88741B66DF23003F26CB /* JSPropertyNameIterator.cpp in Sources */,
+				862553D116136DA9009F17D0 /* JSProxy.cpp in Sources */,
+				A552C37F1ADDB8FE00139726 /* JSRemoteInspector.cpp in Sources */,
+				9928FF3B18AC4AEC00B8CF12 /* JSReplayInputs.cpp in Sources */,
+				14874AE515EBDE4A002E3587 /* JSScope.cpp in Sources */,
+				14815F5F991C46BEB98D0016 /* JSScriptFetcher.cpp in Sources */,
+				A7C0C4AD1681067E0017011D /* JSScriptRef.cpp in Sources */,
+				0F919D10157F3329004A4E7D /* JSSegmentedVariableObject.cpp in Sources */,
+				0F4F82871E2FFDDD0075184C /* JSSegmentedVariableObjectSubspace.cpp in Sources */,
+				A7299D9D17D12837005F5FF9 /* JSSet.cpp in Sources */,
+				A790DD6F182F499700588807 /* JSSetIterator.cpp in Sources */,
+				FA3AB211C8494524AB390267 /* JSSourceCode.cpp in Sources */,
+				147F39D5107EC37600427A48 /* JSString.cpp in Sources */,
+				70EC0EC21AA0D7DA00B6AAFA /* JSStringIterator.cpp in Sources */,
+				2600B5A6152BAAA70091EE5F /* JSStringJoiner.cpp in Sources */,
+				1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */,
+				146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */,
+				0F7DF1401E2AFC500095951B /* JSStringSubspace.cpp in Sources */,
+				0F919D0C157EE09F004A4E7D /* JSSymbolTableObject.cpp in Sources */,
+				70ECA6051AFDBEA200449739 /* JSTemplateRegistryKey.cpp in Sources */,
+				53486BBB1C18E84500F6F3AF /* JSTypedArray.cpp in Sources */,
+				0F2B66FA17B6B5AB00A7AE3F /* JSTypedArrayConstructors.cpp in Sources */,
+				0F2B66FC17B6B5AB00A7AE3F /* JSTypedArrayPrototypes.cpp in Sources */,
+				0F2B66FE17B6B5AB00A7AE3F /* JSTypedArrays.cpp in Sources */,
+				534C457E1BC72549007476A7 /* JSTypedArrayViewConstructor.cpp in Sources */,
+				DEA7E2441BBC677200D78440 /* JSTypedArrayViewPrototype.cpp in Sources */,
+				86E3C61A167BABEE006D760A /* JSValue.mm in Sources */,
+				14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */,
+				86E3C61C167BABEE006D760A /* JSVirtualMachine.mm in Sources */,
+				A7CA3AE717DA41AE006538AF /* JSWeakMap.cpp in Sources */,
+				A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources */,
+				709FB8671AE335C60039D069 /* JSWeakSet.cpp in Sources */,
+				AD2FCC301DB83D4900B3E736 /* JSWebAssembly.cpp in Sources */,
+				79E423E21DEE65320078D355 /* JSWebAssemblyCallee.cpp in Sources */,
+				AD2FCBE21DB58DAD00B3E736 /* JSWebAssemblyCompileError.cpp in Sources */,
+				AD2FCBE41DB58DAD00B3E736 /* JSWebAssemblyInstance.cpp in Sources */,
+				AD2FCBE61DB58DAD00B3E736 /* JSWebAssemblyMemory.cpp in Sources */,
+				AD2FCC041DB58DAD00B3E736 /* JSWebAssemblyModule.cpp in Sources */,
+				AD2FCBE81DB58DAD00B3E736 /* JSWebAssemblyRuntimeError.cpp in Sources */,
+				AD2FCBEA1DB58DAD00B3E736 /* JSWebAssemblyTable.cpp in Sources */,
+				1442566115EDE98D0066A49B /* JSWithScope.cpp in Sources */,
+				86E3C618167BABEE006D760A /* JSWrapperMap.mm in Sources */,
+				14280870107EC1340013E7B2 /* JSWrapperObject.cpp in Sources */,
+				BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */,
+				0F070A4A1D543A95006E7232 /* LargeAllocation.cpp in Sources */,
+				DCF3D5691CD2946D003D5C65 /* LazyClassStructure.cpp in Sources */,
+				0FB5467914F5C46B002C2989 /* LazyOperandValueProfile.cpp in Sources */,
+				148F21B0107EC5410042EC2C /* Lexer.cpp in Sources */,
+				0FF4275715914A20004CB9FF /* LinkBuffer.cpp in Sources */,
+				A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */,
+				FE3913541B794F6E00EDAF71 /* LiveObjectList.cpp in Sources */,
+				FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */,
+				0F4680D214BBD16500BFE272 /* LLIntData.cpp in Sources */,
+				0F38B01117CF078000B144D3 /* LLIntEntrypoint.cpp in Sources */,
+				0F4680A814BA7FAB00BFE272 /* LLIntExceptions.cpp in Sources */,
+				53FA2AE31CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp in Sources */,
+				0F4680A414BA7F8D00BFE272 /* LLIntSlowPaths.cpp in Sources */,
+				0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */,
+				14469DDE107EC7E700650446 /* Lookup.cpp in Sources */,
+				0F4680CC14BBB17A00BFE272 /* LowLevelInterpreter.cpp in Sources */,
+				14B723B212D7DA46003BD5ED /* MachineStackMarker.cpp in Sources */,
+				0FEB3ECF16237F6C00AB67AD /* MacroAssembler.cpp in Sources */,
+				86C568E011A213EE0007F7F0 /* MacroAssemblerARM.cpp in Sources */,
+				FEB137571BB11EF900CD5100 /* MacroAssemblerARM64.cpp in Sources */,
+				A729009C17976C6000317298 /* MacroAssemblerARMv7.cpp in Sources */,
+				0F6DB7EC1D617D1100CDBF8E /* MacroAssemblerCodeRef.cpp in Sources */,
+				FE68C6381B90DE0B0042BCB3 /* MacroAssemblerPrinter.cpp in Sources */,
+				A7A4AE0817973B26005612B1 /* MacroAssemblerX86Common.cpp in Sources */,
+				795B19971D78BE3500262FA0 /* MapBase.cpp in Sources */,
+				A700873917CBE85300C3E643 /* MapConstructor.cpp in Sources */,
+				A74DEF93182D991400522C22 /* MapIteratorPrototype.cpp in Sources */,
+				A700873D17CBE8D300C3E643 /* MapPrototype.cpp in Sources */,
+				C2B916C514DA040C00CBAC86 /* MarkedAllocator.cpp in Sources */,
+				142D6F0813539A2800B02E86 /* MarkedBlock.cpp in Sources */,
+				14D2F3DA139F4BE200491031 /* MarkedSpace.cpp in Sources */,
+				0F660E371E0517B90031462C /* MarkingConstraint.cpp in Sources */,
+				0F660E391E0517BF0031462C /* MarkingConstraintSet.cpp in Sources */,
+				142D6F1113539A4100B02E86 /* MarkStack.cpp in Sources */,
+				DC69AA661CF7A1F200C6272F /* MatchResult.cpp in Sources */,
+				4340A4841A9051AF00D73CCA /* MathCommon.cpp in Sources */,
+				14469DDF107EC7E700650446 /* MathObject.cpp in Sources */,
+				90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */,
+				0FB5467D14F5CFD6002C2989 /* MethodOfGettingAValueProfile.cpp in Sources */,
+				E3794E751B77EB97005543AE /* ModuleAnalyzer.cpp in Sources */,
+				E355F3521B7DC85300C50DC5 /* ModuleLoaderPrototype.cpp in Sources */,
+				14AD91181DCA97FD0014F9FE /* ModuleProgramCodeBlock.cpp in Sources */,
+				147341E41DC2CE9600AA29BA /* ModuleProgramExecutable.cpp in Sources */,
+				0F1FB3901E173A6B00A9BE50 /* MutatorScheduler.cpp in Sources */,
+				0FA762061DB9243100B7A2FD /* MutatorState.cpp in Sources */,
+				14469DE0107EC7E700650446 /* NativeErrorConstructor.cpp in Sources */,
+				14469DE1107EC7E700650446 /* NativeErrorPrototype.cpp in Sources */,
+				147341E51DC2CE9600AA29BA /* NativeExecutable.cpp in Sources */,
+				E33E8D201B9013DE00346B52 /* NativeStdFunctionCell.cpp in Sources */,
+				148F21B7107EC5470042EC2C /* Nodes.cpp in Sources */,
+				E3963CEE1B73F75000EB4CE5 /* NodesAnalyzeModule.cpp in Sources */,
+				655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */,
+				6546F5211A32B313006F07D5 /* NullGetterFunction.cpp in Sources */,
+				65525FC51A6DD801007B5495 /* NullSetterFunction.cpp in Sources */,
+				14469DE2107EC7E700650446 /* NumberConstructor.cpp in Sources */,
+				14469DE3107EC7E700650446 /* NumberObject.cpp in Sources */,
+				14469DE4107EC7E700650446 /* NumberPrototype.cpp in Sources */,
+				86F3EEBE168CDE930077B92A /* ObjCCallbackFunction.mm in Sources */,
+				14469DE5107EC7E700650446 /* ObjectConstructor.cpp in Sources */,
+				0FD3E4091B618B6600C80E1E /* ObjectPropertyCondition.cpp in Sources */,
+				0FD3E40B1B618B6600C80E1E /* ObjectPropertyConditionSet.cpp in Sources */,
+				14469DE6107EC7E700650446 /* ObjectPrototype.cpp in Sources */,
+				E124A8F80E555775003091F1 /* OpaqueJSString.cpp in Sources */,
+				969A079A0ED1D3AE00F1F681 /* Opcode.cpp in Sources */,
+				14280850107EC0D70013E7B2 /* Operations.cpp in Sources */,
+				0FE228EE1436AB2C00196C48 /* Options.cpp in Sources */,
+				148F21BC107EC54D0042EC2C /* Parser.cpp in Sources */,
+				93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */,
+				792CB3491C4EED5C00D13AF3 /* PCToCodeOriginMap.cpp in Sources */,
+				A5AB49DC1BEC8082007020FB /* PerGlobalObjectWrapperWorld.cpp in Sources */,
+				0FF9CE731B9CD6D0004EDCA6 /* PolymorphicAccess.cpp in Sources */,
+				0FE834171A6EF97B00D04847 /* PolymorphicCallStubRoutine.cpp in Sources */,
+				0F98206016BFE38100240D02 /* PreciseJumpTargets.cpp in Sources */,
+				0FF729AD166AD35C000F5BA3 /* ProfilerBytecode.cpp in Sources */,
+				0FF729AE166AD35C000F5BA3 /* ProfilerBytecodes.cpp in Sources */,
+				0F13912916771C33009CCB07 /* ProfilerBytecodeSequence.cpp in Sources */,
+				0FF729AF166AD35C000F5BA3 /* ProfilerCompilation.cpp in Sources */,
+				0FF729B0166AD35C000F5BA3 /* ProfilerCompilationKind.cpp in Sources */,
+				0FF729B1166AD35C000F5BA3 /* ProfilerCompiledBytecode.cpp in Sources */,
+				0FF729B2166AD35C000F5BA3 /* ProfilerDatabase.cpp in Sources */,
+				DC605B5D1CE26EA000593718 /* ProfilerEvent.cpp in Sources */,
+				0F190CAC189D82F6000AE5F0 /* ProfilerJettisonReason.cpp in Sources */,
+				0FF729B3166AD35C000F5BA3 /* ProfilerOrigin.cpp in Sources */,
+				0FF729B4166AD35C000F5BA3 /* ProfilerOriginStack.cpp in Sources */,
+				0FB1058B1675483100F8AB6E /* ProfilerOSRExit.cpp in Sources */,
+				0FB1058D1675483700F8AB6E /* ProfilerOSRExitSite.cpp in Sources */,
+				0F13912B16771C3A009CCB07 /* ProfilerProfiledBytecodes.cpp in Sources */,
+				DC605B5F1CE26EA500593718 /* ProfilerUID.cpp in Sources */,
+				14AD91191DCA97FD0014F9FE /* ProgramCodeBlock.cpp in Sources */,
+				147341E61DC2CE9600AA29BA /* ProgramExecutable.cpp in Sources */,
+				0FD3E40D1B618B6600C80E1E /* PropertyCondition.cpp in Sources */,
+				A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */,
+				14469DE8107EC7E700650446 /* PropertySlot.cpp in Sources */,
+				ADE39FFF16DD144B0003CD4A /* PropertyTable.cpp in Sources */,
+				65FB5117184EEE7000C12B70 /* ProtoCallFrame.cpp in Sources */,
+				1474C33C16AA2D9B0062F01D /* PrototypeMap.cpp in Sources */,
+				79B00CBC1C6AB07E0088C65D /* ProxyConstructor.cpp in Sources */,
+				79B00CBE1C6AB07E0088C65D /* ProxyObject.cpp in Sources */,
+				79160DBD1C8E3EC8008C085A /* ProxyRevoke.cpp in Sources */,
+				0F15CD221BA5F9860031FFD3 /* PutByIdFlags.cpp in Sources */,
+				FE3022D21E3D73A500BAC493 /* SigillCrashAnalyzer.cpp in Sources */,
+				0F9332A314CA7DD70085F3C6 /* PutByIdStatus.cpp in Sources */,
+				0F93B4A918B92C4D00178A3F /* PutByIdVariant.cpp in Sources */,
+				0FF60AC316740F8800029779 /* ReduceWhitespace.cpp in Sources */,
+				E33637A51B63220200EE0840 /* ReflectObject.cpp in Sources */,
+				0FA7A8EB18B413C80052371D /* Reg.cpp in Sources */,
+				14280841107EC0930013E7B2 /* RegExp.cpp in Sources */,
+				A1712B3B11C7B212007A5315 /* RegExpCache.cpp in Sources */,
+				8642C510151C06A90046D4EF /* RegExpCachedResult.cpp in Sources */,
+				14280842107EC0930013E7B2 /* RegExpConstructor.cpp in Sources */,
+				8642C512151C083D0046D4EF /* RegExpMatchesArray.cpp in Sources */,
+				14280843107EC0930013E7B2 /* RegExpObject.cpp in Sources */,
+				14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */,
+				6540C7A01B82E1C3000F6B79 /* RegisterAtOffset.cpp in Sources */,
+				6540C7A11B82E1C3000F6B79 /* RegisterAtOffsetList.cpp in Sources */,
+				0FC3141518146D7000033232 /* RegisterSet.cpp in Sources */,
+				A57D23ED1891B5540031C7FA /* RegularExpression.cpp in Sources */,
+				992ABCF91BEA9BD2006403A0 /* RemoteAutomationTarget.cpp in Sources */,
+				A5BA15EC182340B400A82E69 /* RemoteConnectionToTarget.mm in Sources */,
+				998ED6741BED70AC00DD8017 /* RemoteControllableTarget.cpp in Sources */,
+				A594558F18245EFD00CC3843 /* RemoteInspectionTarget.cpp in Sources */,
+				A5BA15E9182340B300A82E69 /* RemoteInspector.mm in Sources */,
+				A5BA15EE182340B400A82E69 /* RemoteInspectorXPCConnection.mm in Sources */,
+				0F24E55017EE274900ABB217 /* Repatch.cpp in Sources */,
+				527773DE1AAF83AC00BDE7E8 /* RuntimeType.cpp in Sources */,
+				0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */,
+				79D5CD5A1C1106A900CECA07 /* SamplingProfiler.cpp in Sources */,
+				0FE050271AA9095600D33B33 /* ScopedArguments.cpp in Sources */,
+				0FE0502F1AAA806900D33B33 /* ScopedArgumentsTable.cpp in Sources */,
+				0FE0502A1AA9095600D33B33 /* ScopeOffset.cpp in Sources */,
+				0FA7A8EE18CE4FD80052371D /* ScratchRegisterAllocator.cpp in Sources */,
+				A5FD0067189AFE9C00633231 /* ScriptArguments.cpp in Sources */,
+				A5FD006D189B00AA00633231 /* ScriptCallFrame.cpp in Sources */,
+				A5FD006F189B00AA00633231 /* ScriptCallStack.cpp in Sources */,
+				A5FD007D189B0B4C00633231 /* ScriptCallStackFactory.cpp in Sources */,
+				A503FA25188EFFFD00110F14 /* ScriptDebugServer.cpp in Sources */,
+				147341E71DC2CE9600AA29BA /* ScriptExecutable.cpp in Sources */,
+				A55D93A5185012A800400DED /* ScriptFunctionCall.cpp in Sources */,
+				A54CF2F9184EAEDA00237F19 /* ScriptObject.cpp in Sources */,
+				A54CF2F5184EAB2400237F19 /* ScriptValue.cpp in Sources */,
+				A7299DA517D12858005F5FF9 /* SetConstructor.cpp in Sources */,
+				A790DD6D182F499700588807 /* SetIteratorPrototype.cpp in Sources */,
+				A7299DA117D12848005F5FF9 /* SetPrototype.cpp in Sources */,
+				0FEE98431A89227500754E93 /* SetupVarargsFrame.cpp in Sources */,
+				DC17E8171C9C91D6008A6AB3 /* ShadowChicken.cpp in Sources */,
+				0F2B670417B6B5AB00A7AE3F /* SimpleTypedArrayController.cpp in Sources */,
+				C225494315F7DBAA0065E898 /* SlotVisitor.cpp in Sources */,
+				9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */,
+				0F493AFA16D0CAD30084508B /* SourceProvider.cpp in Sources */,
+				E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
+				0FDE87FD1DFE6E540064C390 /* SpaceTimeMutatorScheduler.cpp in Sources */,
+				0F0CD4C415F6B6BB0032F1C0 /* SparseArrayValueMap.cpp in Sources */,
+				0F5541B11613C1FB00CE3E25 /* SpecialPointer.cpp in Sources */,
+				0FD82E86141F3FF100179C94 /* SpeculatedType.cpp in Sources */,
+				0F6DB7EA1D6124B800CDBF8E /* StackFrame.cpp in Sources */,
+				A7C1EAF117987AB600299DB2 /* StackVisitor.cpp in Sources */,
+				0F4F828B1E31B9740075184C /* StochasticSpaceTimeMutatorScheduler.cpp in Sources */,
+				0F7CF9531DC027DB0098CC12 /* StopIfNecessaryTimer.cpp in Sources */,
+				A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */,
+				14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */,
+				70EC0EC61AA0D7DA00B6AAFA /* StringIteratorPrototype.cpp in Sources */,
+				14469DEC107EC7E700650446 /* StringObject.cpp in Sources */,
+				14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */,
+				9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */,
+				BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */,
+				7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */,
+				2AF7382C18BBBF92008A5A37 /* StructureIDTable.cpp in Sources */,
+				C2F0F2D116BAEEE900187C19 /* StructureRareData.cpp in Sources */,
+				0FB438A319270B1D00E1FBC9 /* StructureSet.cpp in Sources */,
+				0F766D3815AE4A1C008F363E /* StructureStubClearingWatchpoint.cpp in Sources */,
+				BCCF0D0C0EF0B8A500413C8F /* StructureStubInfo.cpp in Sources */,
+				0F7DF1361E2970DF0095951B /* Subspace.cpp in Sources */,
+				0F4A38F91C8E13DF00190318 /* SuperSampler.cpp in Sources */,
+				705B41AB1A6E501E00716757 /* Symbol.cpp in Sources */,
+				705B41AD1A6E501E00716757 /* SymbolConstructor.cpp in Sources */,
+				705B41AF1A6E501E00716757 /* SymbolObject.cpp in Sources */,
+				705B41B11A6E501E00716757 /* SymbolPrototype.cpp in Sources */,
+				0F919D2815856773004A4E7D /* SymbolTable.cpp in Sources */,
+				0F1FB38E1E173A6500A9BE50 /* SynchronousStopTheWorldMutatorScheduler.cpp in Sources */,
+				DC7997841CDE9FA2004D4A09 /* TagRegistersMode.cpp in Sources */,
+				70ECA6071AFDBEA200449739 /* TemplateRegistry.cpp in Sources */,
+				78274D8E4C4D4FCD9A1DC6E6 /* TemplateRegistryKey.cpp in Sources */,
+				1A8826B1653C4CD1A642983B /* TemplateRegistryKeyTable.cpp in Sources */,
+				0FC314131814559100033232 /* TempRegisterSet.cpp in Sources */,
+				0FA2C17B17D7CF84009D015F /* TestRunnerUtils.cpp in Sources */,
+				FE2E6A7B1D6EA62C0060F896 /* ThrowScope.cpp in Sources */,
+				A7386555118697B400540279 /* ThunkGenerators.cpp in Sources */,
+				0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */,
+				0F952ABC1B487A7700C367C5 /* TrackedReferences.cpp in Sources */,
+				0F2B670717B6B5AB00A7AE3F /* TypedArrayController.cpp in Sources */,
+				0F2B670A17B6B5AB00A7AE3F /* TypedArrayType.cpp in Sources */,
+				52B310FF1975B4240080857C /* TypeLocationCache.cpp in Sources */,
+				0FFB6C381AF48DDC00DB1BF7 /* TypeofType.cpp in Sources */,
+				52C952B919A28A1C0069B386 /* TypeProfiler.cpp in Sources */,
+				0F2D4DEB19832DC4007D4B19 /* TypeProfilerLog.cpp in Sources */,
+				0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */,
+				0FF4274A158EBE91004CB9FF /* udis86.c in Sources */,
+				0FF42740158EBE8B004CB9FF /* udis86_decode.c in Sources */,
+				0FF4274D158EBFE6004CB9FF /* udis86_itab_holder.c in Sources */,
+				0FF42745158EBE91004CB9FF /* udis86_syn-att.c in Sources */,
+				0FF42746158EBE91004CB9FF /* udis86_syn-intel.c in Sources */,
+				0FF42747158EBE91004CB9FF /* udis86_syn.c in Sources */,
+				0FF42732158EBD58004CB9FF /* UDis86Disassembler.cpp in Sources */,
+				A76F279415F13C9600517D67 /* UnlinkedCodeBlock.cpp in Sources */,
+				14AD912C1DCAAAB00014F9FE /* UnlinkedEvalCodeBlock.cpp in Sources */,
+				14AD912F1DCAAAB00014F9FE /* UnlinkedFunctionCodeBlock.cpp in Sources */,
+				14142E551B7973C000F4BF4B /* UnlinkedFunctionExecutable.cpp in Sources */,
+				B59F89391891F29F00D5CCDC /* UnlinkedInstructionStream.cpp in Sources */,
+				14AD912E1DCAAAB00014F9FE /* UnlinkedModuleProgramCodeBlock.cpp in Sources */,
+				14AD912D1DCAAAB00014F9FE /* UnlinkedProgramCodeBlock.cpp in Sources */,
+				0F8F2B9E17306C8D007DBDA5 /* UnlinkedSourceCode.cpp in Sources */,
+				0F24E55817F74EDB00ABB217 /* ValueRecovery.cpp in Sources */,
+				79EE0BFF1B4AFB85000385C9 /* VariableEnvironment.cpp in Sources */,
+				0F6C73501AC9F99F00BE1682 /* VariableWriteFireDetail.cpp in Sources */,
+				0FE0502C1AA9095600D33B33 /* VarOffset.cpp in Sources */,
+				0F20C2591A8013AB00DA3229 /* VirtualRegister.cpp in Sources */,
+				0F952AA21DF7860D00E06FBD /* VisitRaceKey.cpp in Sources */,
+				E18E3A590DF9278C00D90B34 /* VM.cpp in Sources */,
+				FE5932A7183C5A2600A1ECCC /* VMEntryScope.cpp in Sources */,
+				53F40E8F1D5902820099A1B6 /* WasmB3IRGenerator.cpp in Sources */,
+				AD4B1DF91DF244E20071AE32 /* WasmBinding.cpp in Sources */,
+				53FD04D31D7AB277003287D3 /* WasmCallingConvention.cpp in Sources */,
+				AD2FCC331DC4045400B3E736 /* WasmFormat.cpp in Sources */,
+				535557161D9DFA32006D583B /* WasmMemory.cpp in Sources */,
+				79B759741DFA4C600052174C /* WasmMemoryInformation.cpp in Sources */,
+				53F40E971D5A7BEC0099A1B6 /* WasmModuleParser.cpp in Sources */,
+				ADB6F67D1E15D7600082F384 /* WasmPageCount.cpp in Sources */,
+				531374BF1D5CE95000AF7A0B /* WasmPlan.cpp in Sources */,
+				AD7438C11E0457AA00FD0C2A /* WasmSignature.cpp in Sources */,
+				53FF7F9B1DBFD2B900A26CCC /* WasmValidate.cpp in Sources */,
+				FED94F2E171E3E2300BE77A4 /* Watchdog.cpp in Sources */,
+				0F919D2515853CE0004A4E7D /* Watchpoint.cpp in Sources */,
+				1ACF7377171CA6FB00C9BB1E /* Weak.cpp in Sources */,
+				14E84F9E14EE1ACC00D6D5D4 /* WeakBlock.cpp in Sources */,
+				14F7256514EE265E00B1652B /* WeakHandleOwner.cpp in Sources */,
+				A7CA3AE317DA41AE006538AF /* WeakMapConstructor.cpp in Sources */,
+				A7CA3AEB17DA5168006538AF /* WeakMapData.cpp in Sources */,
+				A7CA3AE517DA41AE006538AF /* WeakMapPrototype.cpp in Sources */,
+				14E84FA014EE1ACC00D6D5D4 /* WeakSet.cpp in Sources */,
+				709FB8691AE335C60039D069 /* WeakSetConstructor.cpp in Sources */,
+				709FB86B1AE335C60039D069 /* WeakSetPrototype.cpp in Sources */,
+				AD2FCBEC1DB58DAD00B3E736 /* WebAssemblyCompileErrorConstructor.cpp in Sources */,
+				AD2FCBEE1DB58DAD00B3E736 /* WebAssemblyCompileErrorPrototype.cpp in Sources */,
+				AD4937D31DDD27DE0077C807 /* WebAssemblyFunction.cpp in Sources */,
+				AD2FCBF01DB58DAD00B3E736 /* WebAssemblyInstanceConstructor.cpp in Sources */,
+				AD2FCBF21DB58DAD00B3E736 /* WebAssemblyInstancePrototype.cpp in Sources */,
+				ADE8029E1E08F2280058DE78 /* WebAssemblyLinkErrorConstructor.cpp in Sources */,
+				ADE8029B1E08F1DE0058DE78 /* WebAssemblyLinkErrorPrototype.cpp in Sources */,
+				AD2FCBF41DB58DAD00B3E736 /* WebAssemblyMemoryConstructor.cpp in Sources */,
+				AD2FCBF61DB58DAD00B3E736 /* WebAssemblyMemoryPrototype.cpp in Sources */,
+				AD2FCC001DB58DAD00B3E736 /* WebAssemblyModuleConstructor.cpp in Sources */,
+				AD2FCC021DB58DAD00B3E736 /* WebAssemblyModulePrototype.cpp in Sources */,
+				AD4937C71DDD0AAE0077C807 /* WebAssemblyModuleRecord.cpp in Sources */,
+				AD2FCC2C1DB838FD00B3E736 /* WebAssemblyPrototype.cpp in Sources */,
+				AD2FCBF81DB58DAD00B3E736 /* WebAssemblyRuntimeErrorConstructor.cpp in Sources */,
+				AD2FCBFA1DB58DAD00B3E736 /* WebAssemblyRuntimeErrorPrototype.cpp in Sources */,
+				AD2FCBFC1DB58DAD00B3E736 /* WebAssemblyTableConstructor.cpp in Sources */,
+				AD2FCBFE1DB58DAD00B3E736 /* WebAssemblyTablePrototype.cpp in Sources */,
+				ADBC54D41DF8EA2B005BF738 /* WebAssemblyToJSCallee.cpp in Sources */,
+				0FC8150B14043C0E00CFA603 /* WriteBarrierSupport.cpp in Sources */,
+				A7E5AB3A1799E4B200D2833D /* X86Disassembler.cpp in Sources */,
+				863C6D9C1521111A00585E4E /* YarrCanonicalizeUCS2.cpp in Sources */,
+				65FB63A41C8EA09C0020719B /* YarrCanonicalizeUnicode.cpp in Sources */,
+				86704B8412DBA33700A9FE7B /* YarrInterpreter.cpp in Sources */,
+				86704B8612DBA33700A9FE7B /* YarrJIT.cpp in Sources */,
+				86704B8912DBA33700A9FE7B /* YarrPattern.cpp in Sources */,
+				86704B4212DB8A8100A9FE7B /* YarrSyntaxChecker.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		932F5BDC0822A1C700736975 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				932F5BDD0822A1C700736975 /* jsc.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXSourcesBuildPhase section */
+
+/* Begin PBXTargetDependency section */
+		0F6183471C45F67A0072450B /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 0F6183381C45F62A0072450B /* testair */;
+			targetProxy = 0F6183461C45F67A0072450B /* PBXContainerItemProxy */;
+		};
+		0F93275D1C20BF3A00CF6564 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 0F93274E1C20BCBA00CF6564 /* dynbench */;
+			targetProxy = 0F93275C1C20BF3A00CF6564 /* PBXContainerItemProxy */;
+		};
+		0FEC85B11BDB5D8F0080FF74 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 0FEC85941BDB5CF10080FF74 /* testb3 */;
+			targetProxy = 0FEC85B01BDB5D8F0080FF74 /* PBXContainerItemProxy */;
+		};
+		0FF922D314F46B2F0041A24E /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 0F4680A914BA7FD900BFE272 /* LLInt Offsets */;
+			targetProxy = 0FF922D214F46B2F0041A24E /* PBXContainerItemProxy */;
+		};
+		5D69E912152BE5470028D720 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 932F5BDA0822A1C700736975 /* jsc */;
+			targetProxy = 5D69E911152BE5470028D720 /* PBXContainerItemProxy */;
+		};
+		5D6B2A4F152B9E23005231DE /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 1412111F0A48793C00480255 /* minidom */;
+			targetProxy = 5D6B2A4E152B9E23005231DE /* PBXContainerItemProxy */;
+		};
+		5D6B2A51152B9E23005231DE /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 14BD59BE0A3E8F9000BAF59C /* testapi */;
+			targetProxy = 5D6B2A50152B9E23005231DE /* PBXContainerItemProxy */;
+		};
+		5D6B2A55152B9E23005231DE /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 651122F714046A4C002B101D /* testRegExp */;
+			targetProxy = 5D6B2A54152B9E23005231DE /* PBXContainerItemProxy */;
+		};
+		5D6B2A57152B9E2E005231DE /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 5D6B2A47152B9E17005231DE /* Test Tools */;
+			targetProxy = 5D6B2A56152B9E2E005231DE /* PBXContainerItemProxy */;
+		};
+		65244BD318ECB5000010B708 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
+			targetProxy = 65244BD218ECB5000010B708 /* PBXContainerItemProxy */;
+		};
+		65442D5018EBB744007AF92F /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
+			targetProxy = 65442D4F18EBB744007AF92F /* PBXContainerItemProxy */;
+		};
+		65788A9E18B409EB00C189FF /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 0FF922C314F46B130041A24E /* JSCLLIntOffsetsExtractor */;
+			targetProxy = 65788A9F18B409EB00C189FF /* PBXContainerItemProxy */;
+		};
+		65788AAB18B40A3B00C189FF /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
+			targetProxy = 65788AAA18B40A3B00C189FF /* PBXContainerItemProxy */;
+		};
+		65788AAD18B40A7B00C189FF /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 65788A9D18B409EB00C189FF /* Offline Assembler */;
+			targetProxy = 65788AAC18B40A7B00C189FF /* PBXContainerItemProxy */;
+		};
+		65FB3F7E09D11EF300F49DEB /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 65FB3F6609D11E9100F49DEB /* Derived Sources */;
+			targetProxy = 65FB3F7D09D11EF300F49DEB /* PBXContainerItemProxy */;
+		};
+		932F5BE70822A1C700736975 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 932F5B3E0822A1C700736975 /* JavaScriptCore */;
+			targetProxy = 932F5BE60822A1C700736975 /* PBXContainerItemProxy */;
+		};
+/* End PBXTargetDependency section */
+
+/* Begin XCBuildConfiguration section */
+		0F4680AD14BA7FD900BFE272 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Debug;
+		};
+		0F4680AE14BA7FD900BFE272 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Release;
+		};
+		0F4680AF14BA7FD900BFE272 /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Profiling;
+		};
+		0F4680B014BA7FD900BFE272 /* Production */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Production;
+		};
+		0F61833F1C45F62A0072450B /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		0F6183401C45F62A0072450B /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		0F6183411C45F62A0072450B /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		0F6183421C45F62A0072450B /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		0F9327551C20BCBA00CF6564 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		0F9327561C20BCBA00CF6564 /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		0F9327571C20BCBA00CF6564 /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		0F9327581C20BCBA00CF6564 /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		0FEC85A91BDB5CF10080FF74 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		0FEC85AA1BDB5CF10080FF74 /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		0FEC85AB1BDB5CF10080FF74 /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		0FEC85AC1BDB5CF10080FF74 /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		0FF922CB14F46B130041A24E /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		0FF922CC14F46B130041A24E /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		0FF922CD14F46B130041A24E /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		0FF922CE14F46B130041A24E /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		1412113A0A48798400480255 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		1412113B0A48798400480255 /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		1412113C0A48798400480255 /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		149C275E08902AFE008A9EFC /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		149C275F08902AFE008A9EFC /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		149C276108902AFE008A9EFC /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				BUILD_VARIANTS = normal;
+			};
+			name = Production;
+		};
+		149C276808902AFE008A9EFC /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		149C276908902AFE008A9EFC /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		149C276B08902AFE008A9EFC /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		149C276D08902AFE008A9EFC /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = All;
+			};
+			name = Debug;
+		};
+		149C276E08902AFE008A9EFC /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = All;
+			};
+			name = Release;
+		};
+		149C277008902AFE008A9EFC /* Production */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = All;
+			};
+			name = Production;
+		};
+		149C277208902AFE008A9EFC /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051440BA9E8A70081E9D0 /* DebugRelease.xcconfig */;
+			buildSettings = {
+				DEAD_CODE_STRIPPING = "$(DEAD_CODE_STRIPPING_debug)";
+				DEBUG_DEFINES = "$(DEBUG_DEFINES_debug)";
+				GCC_OPTIMIZATION_LEVEL = "$(GCC_OPTIMIZATION_LEVEL_debug)";
+				STRIP_INSTALLED_PRODUCT = "$(STRIP_INSTALLED_PRODUCT_debug)";
+			};
+			name = Debug;
+		};
+		149C277308902AFE008A9EFC /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051440BA9E8A70081E9D0 /* DebugRelease.xcconfig */;
+			buildSettings = {
+				STRIP_INSTALLED_PRODUCT = NO;
+			};
+			name = Release;
+		};
+		149C277508902AFE008A9EFC /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051450BA9E8A70081E9D0 /* Base.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		14BD59D70A3E8FC900BAF59C /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		14BD59D80A3E8FC900BAF59C /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		14BD59D90A3E8FC900BAF59C /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		5D6B2A48152B9E17005231DE /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Debug;
+		};
+		5D6B2A49152B9E17005231DE /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Release;
+		};
+		5D6B2A4A152B9E17005231DE /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Profiling;
+		};
+		5D6B2A4B152B9E17005231DE /* Production */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+			name = Production;
+		};
+		6511230114046A4C002B101D /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		6511230214046A4C002B101D /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		6511230314046A4C002B101D /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		6511230414046A4C002B101D /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Production;
+		};
+		65788AA318B409EB00C189FF /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				INFOPLIST_FILE = "Derived Sources copy-Info.plist";
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Debug;
+		};
+		65788AA418B409EB00C189FF /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				INFOPLIST_FILE = "Derived Sources copy-Info.plist";
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Release;
+		};
+		65788AA518B409EB00C189FF /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				INFOPLIST_FILE = "Derived Sources copy-Info.plist";
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Profiling;
+		};
+		65788AA618B409EB00C189FF /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				INFOPLIST_FILE = "Derived Sources copy-Info.plist";
+				PRODUCT_NAME = "Derived Sources copy";
+			};
+			name = Production;
+		};
+		65FB3F7809D11EBD00F49DEB /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = "Generate Derived Sources";
+			};
+			name = Debug;
+		};
+		65FB3F7909D11EBD00F49DEB /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = "Generate Derived Sources";
+			};
+			name = Release;
+		};
+		65FB3F7A09D11EBD00F49DEB /* Production */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = "Generate Derived Sources";
+			};
+			name = Production;
+		};
+		A761483D0E6402F700E357FA /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051440BA9E8A70081E9D0 /* DebugRelease.xcconfig */;
+			buildSettings = {
+				STRIP_INSTALLED_PRODUCT = NO;
+			};
+			name = Profiling;
+		};
+		A761483E0E6402F700E357FA /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				PRODUCT_NAME = All;
+			};
+			name = Profiling;
+		};
+		A761483F0E6402F700E357FA /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		A76148400E6402F700E357FA /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 1C9051430BA9E8A70081E9D0 /* JavaScriptCore.xcconfig */;
+			buildSettings = {
+				PRODUCT_NAME = "Generate Derived Sources";
+			};
+			name = Profiling;
+		};
+		A76148410E6402F700E357FA /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		A76148420E6402F700E357FA /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+		A76148430E6402F700E357FA /* Profiling */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */;
+			buildSettings = {
+			};
+			name = Profiling;
+		};
+/* End XCBuildConfiguration section */
+
+/* Begin XCConfigurationList section */
+		0F4680AC14BA7FD900BFE272 /* Build configuration list for PBXAggregateTarget "LLInt Offsets" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0F4680AD14BA7FD900BFE272 /* Debug */,
+				0F4680AE14BA7FD900BFE272 /* Release */,
+				0F4680AF14BA7FD900BFE272 /* Profiling */,
+				0F4680B014BA7FD900BFE272 /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		0F61833E1C45F62A0072450B /* Build configuration list for PBXNativeTarget "testair" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0F61833F1C45F62A0072450B /* Debug */,
+				0F6183401C45F62A0072450B /* Release */,
+				0F6183411C45F62A0072450B /* Profiling */,
+				0F6183421C45F62A0072450B /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		0F9327541C20BCBA00CF6564 /* Build configuration list for PBXNativeTarget "dynbench" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0F9327551C20BCBA00CF6564 /* Debug */,
+				0F9327561C20BCBA00CF6564 /* Release */,
+				0F9327571C20BCBA00CF6564 /* Profiling */,
+				0F9327581C20BCBA00CF6564 /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		0FEC85A81BDB5CF10080FF74 /* Build configuration list for PBXNativeTarget "testb3" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0FEC85A91BDB5CF10080FF74 /* Debug */,
+				0FEC85AA1BDB5CF10080FF74 /* Release */,
+				0FEC85AB1BDB5CF10080FF74 /* Profiling */,
+				0FEC85AC1BDB5CF10080FF74 /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		0FF922CA14F46B130041A24E /* Build configuration list for PBXNativeTarget "JSCLLIntOffsetsExtractor" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				0FF922CB14F46B130041A24E /* Debug */,
+				0FF922CC14F46B130041A24E /* Release */,
+				0FF922CD14F46B130041A24E /* Profiling */,
+				0FF922CE14F46B130041A24E /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		141211390A48798400480255 /* Build configuration list for PBXNativeTarget "minidom" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				1412113A0A48798400480255 /* Debug */,
+				1412113B0A48798400480255 /* Release */,
+				A76148410E6402F700E357FA /* Profiling */,
+				1412113C0A48798400480255 /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		149C275D08902AFE008A9EFC /* Build configuration list for PBXNativeTarget "JavaScriptCore" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				149C275E08902AFE008A9EFC /* Debug */,
+				149C275F08902AFE008A9EFC /* Release */,
+				A761483F0E6402F700E357FA /* Profiling */,
+				149C276108902AFE008A9EFC /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		149C276708902AFE008A9EFC /* Build configuration list for PBXNativeTarget "jsc" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				149C276808902AFE008A9EFC /* Debug */,
+				149C276908902AFE008A9EFC /* Release */,
+				A76148430E6402F700E357FA /* Profiling */,
+				149C276B08902AFE008A9EFC /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		149C276C08902AFE008A9EFC /* Build configuration list for PBXAggregateTarget "All" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				149C276D08902AFE008A9EFC /* Debug */,
+				149C276E08902AFE008A9EFC /* Release */,
+				A761483E0E6402F700E357FA /* Profiling */,
+				149C277008902AFE008A9EFC /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		149C277108902AFE008A9EFC /* Build configuration list for PBXProject "JavaScriptCore" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				149C277208902AFE008A9EFC /* Debug */,
+				149C277308902AFE008A9EFC /* Release */,
+				A761483D0E6402F700E357FA /* Profiling */,
+				149C277508902AFE008A9EFC /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		14BD59D60A3E8FC900BAF59C /* Build configuration list for PBXNativeTarget "testapi" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				14BD59D70A3E8FC900BAF59C /* Debug */,
+				14BD59D80A3E8FC900BAF59C /* Release */,
+				A76148420E6402F700E357FA /* Profiling */,
+				14BD59D90A3E8FC900BAF59C /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		5D6B2A4C152B9E17005231DE /* Build configuration list for PBXAggregateTarget "Test Tools" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				5D6B2A48152B9E17005231DE /* Debug */,
+				5D6B2A49152B9E17005231DE /* Release */,
+				5D6B2A4A152B9E17005231DE /* Profiling */,
+				5D6B2A4B152B9E17005231DE /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		6511230014046A4C002B101D /* Build configuration list for PBXNativeTarget "testRegExp" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				6511230114046A4C002B101D /* Debug */,
+				6511230214046A4C002B101D /* Release */,
+				6511230314046A4C002B101D /* Profiling */,
+				6511230414046A4C002B101D /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		65788AA218B409EB00C189FF /* Build configuration list for PBXAggregateTarget "Offline Assembler" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				65788AA318B409EB00C189FF /* Debug */,
+				65788AA418B409EB00C189FF /* Release */,
+				65788AA518B409EB00C189FF /* Profiling */,
+				65788AA618B409EB00C189FF /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+		65FB3F7709D11EBD00F49DEB /* Build configuration list for PBXAggregateTarget "Derived Sources" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				65FB3F7809D11EBD00F49DEB /* Debug */,
+				65FB3F7909D11EBD00F49DEB /* Release */,
+				A76148400E6402F700E357FA /* Profiling */,
+				65FB3F7A09D11EBD00F49DEB /* Production */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Production;
+		};
+/* End XCConfigurationList section */
+	};
+	rootObject = 0867D690FE84028FC02AAC07 /* Project object */;
+}
diff --git a/JavaScriptCorePrefix.h b/JavaScriptCorePrefix.h
new file mode 100644
index 0000000..21d6204
--- /dev/null
+++ b/JavaScriptCorePrefix.h
@@ -0,0 +1,36 @@
+#ifdef __cplusplus
+#define NULL __null
+#else
+#define NULL ((void *)0)
+#endif
+
+#include <ctype.h>
+#include <float.h>
+#include <locale.h>
+#include <math.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <time.h>
+#include <sys/param.h>
+#include <sys/time.h>
+#include <sys/timeb.h>
+#include <sys/types.h>
+
+#ifdef __cplusplus
+
+#include <list>
+#include <typeinfo>
+
+#endif
+
+#ifdef __cplusplus
+#define new ("if you use new/delete make sure to include config.h at the top of the file"()) 
+#define delete ("if you use new/delete make sure to include config.h at the top of the file"()) 
+#endif
+
+/* Work around bug with C++ library that screws up Objective-C++ when exception support is disabled. */
+#undef try
+#undef catch
+
diff --git a/KeywordLookupGenerator.py b/KeywordLookupGenerator.py
new file mode 100644
index 0000000..d13daba
--- /dev/null
+++ b/KeywordLookupGenerator.py
@@ -0,0 +1,310 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+# Copyright (C) 2012 Sony Network Entertainment. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import sys
+import string
+import operator
+
+keywordsText = open(sys.argv[1]).read()
+
+# A second argument signifies that the output
+# should be redirected to a file
+redirect_to_file = len(sys.argv) > 2
+
+# Change stdout to point to the file if requested
+if redirect_to_file:
+    file_output = open(sys.argv[-1], "w")
+    sys.stdout = file_output
+
+# Observed weights of the most common keywords, rounded to 2.s.d
+keyWordWeights = {
+    "catch": 0.01,
+    "try": 0.01,
+    "while": 0.01,
+    "case": 0.01,
+    "break": 0.01,
+    "new": 0.01,
+    "in": 0.01,
+    "typeof": 0.02,
+    "true": 0.02,
+    "false": 0.02,
+    "for": 0.03,
+    "null": 0.03,
+    "else": 0.03,
+    "return": 0.13,
+    "var": 0.13,
+    "if": 0.16,
+    "function": 0.18,
+    "this": 0.18,
+}
+
+
+def allWhitespace(str):
+    for c in str:
+        if not(c in string.whitespace):
+            return False
+    return True
+
+
+def parseKeywords(keywordsText):
+
+    if sys.platform == "cygwin":
+        keywordsText = keywordsText.replace("\r\n", "\n")
+
+    lines = keywordsText.split("\n")
+    lines = [line.split("#")[0] for line in lines]
+    lines = [line for line in lines if (not allWhitespace(line))]
+    name = lines[0].split()
+    terminator = lines[-1]
+
+    if not name[0] == "@begin":
+        raise Exception("expected description beginning with @begin")
+    if not terminator == "@end":
+        raise Exception("expected description ending with @end")
+
+    lines = lines[1:-1]  # trim off the old heading
+    return [line.split() for line in lines]
+
+
+def makePadding(size):
+    str = ""
+    for i in range(size):
+        str = str + " "
+    return str
+
+
+class Trie:
+    def __init__(self, prefix):
+        self.prefix = prefix
+        self.keys = {}
+        self.value = None
+
+    def insert(self, key, value):
+        if len(key) == 0:
+            self.value = value
+            return
+        if not (key[0] in self.keys):
+            self.keys[key[0]] = Trie(key[0])
+        self.keys[key[0]].insert(key[1:], value)
+
+    def coalesce(self):
+        keys = {}
+        for k, v in self.keys.items():
+            t = v.coalesce()
+            keys[t.prefix] = t
+        self.keys = keys
+        if self.value != None:
+            return self
+        if len(self.keys) != 1:
+            return self
+        # Python 3: for() loop for compatibility. Use next() when Python 2.6 is the baseline.
+        for (prefix, suffix) in self.keys.items():
+            res = Trie(self.prefix + prefix)
+            res.value = suffix.value
+            res.keys = suffix.keys
+            return res
+
+    def fillOut(self, prefix=""):
+        self.fullPrefix = prefix + self.prefix
+        weight = 0
+        if self.fullPrefix in keyWordWeights:
+            weight = weight + keyWordWeights[self.fullPrefix]
+        self.selfWeight = weight
+        for trie in self.keys.values():
+            trie.fillOut(self.fullPrefix)
+            weight = weight + trie.weight
+        self.keys = [(trie.prefix, trie) for trie in sorted(self.keys.values(), key=operator.attrgetter('weight'), reverse=True)]
+        self.weight = weight
+
+    def printSubTreeAsC(self, typeName, indent):
+        str = makePadding(indent)
+
+        if self.value != None:
+            print(str + "if (!isIdentPartIncludingEscape(code+%d, m_codeEnd)) {" % (len(self.fullPrefix)))
+            print(str + "    internalShift<%d>();" % len(self.fullPrefix))
+            print(str + "    if (shouldCreateIdentifier)")
+            print(str + ("        data->ident = &m_vm->propertyNames->%sKeyword;" % self.fullPrefix))
+            print(str + "    return " + self.value + ";")
+            print(str + "}")
+        rootIndex = len(self.fullPrefix)
+        itemCount = 0
+        for k, trie in self.keys:
+            baseIndex = rootIndex
+            if (baseIndex > 0) and (len(k) == 3):
+                baseIndex = baseIndex - 1
+                k = trie.fullPrefix[baseIndex] + k
+            test = [("'%s'" % c) for c in k]
+            if len(test) == 1:
+                comparison = "code[%d] == %s" % (baseIndex, test[0])
+            else:
+                base = "code"
+                if baseIndex > 0:
+                    base = "code + %d" % baseIndex
+                comparison = ("COMPARE_%d%sS(%s, " % (len(test), typeName, base)) + ", ".join(test) + ")"
+            if itemCount == 0:
+                print(str + "if (" + comparison + ") {")
+            else:
+                print(str + "} else if (" + comparison + ") {")
+
+            trie.printSubTreeAsC(typeName, indent + 4)
+            itemCount = itemCount + 1
+
+            if itemCount == len(self.keys):
+                print(str + "}")
+
+    def maxLength(self):
+        max = len(self.fullPrefix)
+        for (_, trie) in self.keys:
+            l = trie.maxLength()
+            if l > max:
+                max = l
+        return max
+
+    def printAsC(self):
+        print("namespace JSC {")
+        print("")
+        print("static ALWAYS_INLINE bool isIdentPartIncludingEscape(const LChar* code, const LChar* codeEnd);")
+        print("static ALWAYS_INLINE bool isIdentPartIncludingEscape(const UChar* code, const UChar* codeEnd);")
+        # max length + 1 so we don't need to do any bounds checking at all
+        print("static const int maxTokenLength = %d;" % (self.maxLength() + 1))
+        print("")
+        print("template <>")
+        print("template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<UChar>::parseKeyword(JSTokenData* data)")
+        print("{")
+        print("    ASSERT(m_codeEnd - m_code >= maxTokenLength);")
+        print("")
+        print("    const UChar* code = m_code;")
+        self.printSubTreeAsC("UCHAR", 4)
+        print("    return IDENT;")
+        print("}")
+        print("")
+        print("template <>")
+        print("template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<LChar>::parseKeyword(JSTokenData* data)")
+        print("{")
+        print("    ASSERT(m_codeEnd - m_code >= maxTokenLength);")
+        print("")
+        print("    const LChar* code = m_code;")
+        self.printSubTreeAsC("CHAR", 4)
+        print("    return IDENT;")
+        print("}")
+        print("")
+        print("} // namespace JSC")
+
+keywords = parseKeywords(keywordsText)
+trie = Trie("")
+for k, v in keywords:
+    trie.insert(k, v)
+trie.coalesce()
+trie.fillOut()
+print("// This file was generated by KeywordLookupGenerator.py.  Do not edit.")
+print("""
+#if CPU(NEEDS_ALIGNED_ACCESS)
+
+#define COMPARE_2CHARS(address, char1, char2) \\
+    (((address)[0] == char1) && ((address)[1] == char2))
+#define COMPARE_4CHARS(address, char1, char2, char3, char4) \\
+    (COMPARE_2CHARS(address, char1, char2) && COMPARE_2CHARS((address) + 2, char3, char4))
+#define COMPARE_2UCHARS(address, char1, char2) \\
+    (((address)[0] == char1) && ((address)[1] == char2))
+#define COMPARE_4UCHARS(address, char1, char2, char3, char4) \\
+    (COMPARE_2UCHARS(address, char1, char2) && COMPARE_2UCHARS((address) + 2, char3, char4))
+
+#else // CPU(NEEDS_ALIGNED_ACCESS)
+
+#if CPU(BIG_ENDIAN)
+
+#define CHARPAIR_TOUINT16(a, b) \\
+    ((((uint16_t)(a)) << 8) + (uint16_t)(b))
+#define CHARQUAD_TOUINT32(a, b, c, d) \\
+    ((((uint32_t)(CHARPAIR_TOUINT16(a, b))) << 16) + CHARPAIR_TOUINT16(c, d))
+#define UCHARPAIR_TOUINT32(a, b) \\
+    ((((uint32_t)(a)) << 16) + (uint32_t)(b))
+#define UCHARQUAD_TOUINT64(a, b, c, d) \\
+    ((((uint64_t)(UCHARQUAD_TOUINT64(a, b))) << 32) + UCHARPAIR_TOUINT32(c, d))
+
+#else // CPU(BIG_ENDIAN)
+
+#define CHARPAIR_TOUINT16(a, b) \\
+    ((((uint16_t)(b)) << 8) + (uint16_t)(a))
+#define CHARQUAD_TOUINT32(a, b, c, d) \\
+    ((((uint32_t)(CHARPAIR_TOUINT16(c, d))) << 16) + CHARPAIR_TOUINT16(a, b))
+#define UCHARPAIR_TOUINT32(a, b) \\
+    ((((uint32_t)(b)) << 16) + (uint32_t)(a))
+#define UCHARQUAD_TOUINT64(a, b, c, d) \\
+    ((((uint64_t)(UCHARPAIR_TOUINT32(c, d))) << 32) + UCHARPAIR_TOUINT32(a, b))
+
+#endif // CPU(BIG_ENDIAN)
+
+
+#define COMPARE_2CHARS(address, char1, char2) \\
+    ((reinterpret_cast<const uint16_t*>(address))[0] == CHARPAIR_TOUINT16(char1, char2))
+#define COMPARE_2UCHARS(address, char1, char2) \\
+    ((reinterpret_cast<const uint32_t*>(address))[0] == UCHARPAIR_TOUINT32(char1, char2))
+
+#if CPU(X86_64)
+
+#define COMPARE_4CHARS(address, char1, char2, char3, char4) \\
+    ((reinterpret_cast<const uint32_t*>(address))[0] == CHARQUAD_TOUINT32(char1, char2, char3, char4))
+#define COMPARE_4UCHARS(address, char1, char2, char3, char4) \\
+    ((reinterpret_cast<const uint64_t*>(address))[0] == UCHARQUAD_TOUINT64(char1, char2, char3, char4))
+
+#else // CPU(X86_64)
+
+#define COMPARE_4CHARS(address, char1, char2, char3, char4) \\
+    (COMPARE_2CHARS(address, char1, char2) && COMPARE_2CHARS((address) + 2, char3, char4))
+#define COMPARE_4UCHARS(address, char1, char2, char3, char4) \\
+    (COMPARE_2UCHARS(address, char1, char2) && COMPARE_2UCHARS((address) + 2, char3, char4))
+
+#endif // CPU(X86_64)
+
+#endif // CPU(NEEDS_ALIGNED_ACCESS)
+
+#define COMPARE_3CHARS(address, char1, char2, char3) \\
+    (COMPARE_2CHARS(address, char1, char2) && ((address)[2] == (char3)))
+#define COMPARE_3UCHARS(address, char1, char2, char3) \\
+    (COMPARE_2UCHARS(address, char1, char2) && ((address)[2] == (char3)))
+#define COMPARE_5CHARS(address, char1, char2, char3, char4, char5) \\
+    (COMPARE_4CHARS(address, char1, char2, char3, char4) && ((address)[4] == (char5)))
+#define COMPARE_5UCHARS(address, char1, char2, char3, char4, char5) \\
+    (COMPARE_4UCHARS(address, char1, char2, char3, char4) && ((address)[4] == (char5)))
+#define COMPARE_6CHARS(address, char1, char2, char3, char4, char5, char6) \\
+    (COMPARE_4CHARS(address, char1, char2, char3, char4) && COMPARE_2CHARS(address + 4, char5, char6))
+#define COMPARE_6UCHARS(address, char1, char2, char3, char4, char5, char6) \\
+    (COMPARE_4UCHARS(address, char1, char2, char3, char4) && COMPARE_2UCHARS(address + 4, char5, char6))
+#define COMPARE_7CHARS(address, char1, char2, char3, char4, char5, char6, char7) \\
+    (COMPARE_4CHARS(address, char1, char2, char3, char4) && COMPARE_4CHARS(address + 3, char4, char5, char6, char7))
+#define COMPARE_7UCHARS(address, char1, char2, char3, char4, char5, char6, char7) \\
+    (COMPARE_4UCHARS(address, char1, char2, char3, char4) && COMPARE_4UCHARS(address + 3, char4, char5, char6, char7))
+#define COMPARE_8CHARS(address, char1, char2, char3, char4, char5, char6, char7, char8) \\
+    (COMPARE_4CHARS(address, char1, char2, char3, char4) && COMPARE_4CHARS(address + 4, char5, char6, char7, char8))
+#define COMPARE_8UCHARS(address, char1, char2, char3, char4, char5, char6, char7, char8) \\
+    (COMPARE_4UCHARS(address, char1, char2, char3, char4) && COMPARE_4UCHARS(address + 4, char5, char6, char7, char8))
+""")
+
+trie.printAsC()
+
+# Close the redirected file if requested
+if (redirect_to_file):
+    file_output.close()
+    sys.stdout = sys.__stdout__
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..cb4c11a
--- /dev/null
+++ b/Makefile
@@ -0,0 +1 @@
+include ../Makefile.shared
diff --git a/PlatformEfl.cmake b/PlatformEfl.cmake
new file mode 100644
index 0000000..40ee4dd
--- /dev/null
+++ b/PlatformEfl.cmake
@@ -0,0 +1,20 @@
+list(APPEND JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
+    ${ECORE_EVAS_INCLUDE_DIRS}
+    ${ECORE_IMF_INCLUDE_DIRS}
+    ${ECORE_INCLUDE_DIRS}
+    ${EINA_INCLUDE_DIRS}
+    ${EO_INCLUDE_DIRS}
+)
+
+add_definitions(-DSTATICALLY_LINKED_WITH_WTF)
+
+install(FILES API/JavaScript.h
+              API/JSBase.h
+              API/JSContextRef.h
+              API/JSObjectRef.h
+              API/JSStringRef.h
+              API/JSValueRef.h
+              API/JSTypedArray.h
+              API/WebKitAvailability.h
+        DESTINATION "${HEADER_INSTALL_DIR}/JavaScriptCore"
+)
diff --git a/PlatformGTK.cmake b/PlatformGTK.cmake
new file mode 100644
index 0000000..2c62eb0
--- /dev/null
+++ b/PlatformGTK.cmake
@@ -0,0 +1,46 @@
+set(JavaScriptCore_OUTPUT_NAME javascriptcoregtk-${WEBKITGTK_API_VERSION})
+
+configure_file(javascriptcoregtk.pc.in ${CMAKE_BINARY_DIR}/Source/JavaScriptCore/javascriptcoregtk-${WEBKITGTK_API_VERSION}.pc @ONLY)
+configure_file(JavaScriptCore.gir.in ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.gir @ONLY)
+
+add_custom_command(
+    OUTPUT ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.typelib
+    DEPENDS ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.gir
+    COMMAND ${INTROSPECTION_COMPILER} ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.gir -o ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.typelib
+)
+
+ADD_TYPELIB(${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.typelib)
+
+install(FILES "${CMAKE_BINARY_DIR}/Source/JavaScriptCore/javascriptcoregtk-${WEBKITGTK_API_VERSION}.pc"
+        DESTINATION "${LIB_INSTALL_DIR}/pkgconfig"
+)
+
+install(FILES API/JavaScript.h
+              API/JSBase.h
+              API/JSContextRef.h
+              API/JSObjectRef.h
+              API/JSStringRef.h
+              API/JSTypedArray.h
+              API/JSValueRef.h
+              API/WebKitAvailability.h
+        DESTINATION "${WEBKITGTK_HEADER_INSTALL_DIR}/JavaScriptCore"
+)
+
+if (ENABLE_INTROSPECTION)
+    install(FILES ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.gir
+            DESTINATION ${INTROSPECTION_INSTALL_GIRDIR}
+    )
+    install(FILES ${CMAKE_BINARY_DIR}/JavaScriptCore-${WEBKITGTK_API_VERSION}.typelib
+            DESTINATION ${INTROSPECTION_INSTALL_TYPELIBDIR}
+    )
+endif ()
+
+add_definitions(-DSTATICALLY_LINKED_WITH_WTF)
+add_definitions(-DLIBDIR="${LIB_INSTALL_DIR}")
+
+list(APPEND JavaScriptCore_LIBRARIES
+    ${GLIB_LIBRARIES}
+)
+list(APPEND JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
+    ${GLIB_INCLUDE_DIRS}
+)
diff --git a/PlatformJSCOnly.cmake b/PlatformJSCOnly.cmake
new file mode 100644
index 0000000..7b1e732
--- /dev/null
+++ b/PlatformJSCOnly.cmake
@@ -0,0 +1,10 @@
+add_definitions(-DSTATICALLY_LINKED_WITH_WTF)
+
+if (USE_GLIB)
+    list(APPEND JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES
+        ${GLIB_INCLUDE_DIRS}
+    )
+    list(APPEND JavaScriptCore_LIBRARIES
+        ${GLIB_LIBRARIES}
+    )
+endif ()
diff --git a/PlatformMac.cmake b/PlatformMac.cmake
new file mode 100644
index 0000000..2e6b15b
--- /dev/null
+++ b/PlatformMac.cmake
@@ -0,0 +1,42 @@
+list(APPEND JavaScriptCore_SOURCES
+    API/JSAPIWrapperObject.mm
+    API/JSContext.mm
+    API/JSManagedValue.mm
+    API/JSRemoteInspector.cpp
+    API/JSStringRefCF.cpp
+    API/JSValue.mm
+    API/JSVirtualMachine.mm
+    API/JSWrapperMap.mm
+    API/ObjCCallbackFunction.mm
+
+    inspector/remote/RemoteAutomationTarget.cpp
+    inspector/remote/RemoteConnectionToTarget.mm
+    inspector/remote/RemoteControllableTarget.cpp
+    inspector/remote/RemoteInspectionTarget.cpp
+    inspector/remote/RemoteInspector.mm
+    inspector/remote/RemoteInspectorXPCConnection.mm
+)
+add_definitions(-DSTATICALLY_LINKED_WITH_WTF -D__STDC_WANT_LIB_EXT1__)
+
+find_library(SECURITY_LIBRARY Security)
+list(APPEND JavaScriptCore_LIBRARIES
+    ${SECURITY_LIBRARY}
+)
+
+list(APPEND JavaScriptCore_INCLUDE_DIRECTORIES
+    ${JAVASCRIPTCORE_DIR}/disassembler/udis86
+    ${JAVASCRIPTCORE_DIR}/icu
+)
+
+set(CMAKE_SHARED_LINKER_FLAGS ${CMAKE_SHARED_LINKER_FLAGS} "-compatibility_version 1 -current_version ${WEBKIT_MAC_VERSION}")
+
+# FIXME: Make including these files consistent in the source so these forwarding headers are not needed.
+if (NOT EXISTS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InspectorBackendDispatchers.h)
+    file(WRITE ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InspectorBackendDispatchers.h "#include \"inspector/InspectorBackendDispatchers.h\"")
+endif ()
+if (NOT EXISTS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InspectorFrontendDispatchers.h)
+    file(WRITE ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InspectorFrontendDispatchers.h "#include \"inspector/InspectorFrontendDispatchers.h\"")
+endif ()
+if (NOT EXISTS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InspectorProtocolObjects.h)
+    file(WRITE ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InspectorProtocolObjects.h "#include \"inspector/InspectorProtocolObjects.h\"")
+endif ()
diff --git a/PlatformWin.cmake b/PlatformWin.cmake
new file mode 100644
index 0000000..1305c34
--- /dev/null
+++ b/PlatformWin.cmake
@@ -0,0 +1,44 @@
+list(APPEND JavaScriptCore_SOURCES
+    API/JSStringRefBSTR.cpp
+    API/JSStringRefCF.cpp
+)
+
+list(APPEND JavaScriptCore_INCLUDE_DIRECTORIES
+    ${CMAKE_BINARY_DIR}/../include/private
+)
+
+if (WTF_PLATFORM_WIN_CAIRO)
+    list(APPEND JavaScriptCore_LIBRARIES
+        CFLite
+    )
+else ()
+    list(APPEND JavaScriptCore_LIBRARIES
+        CoreFoundation${DEBUG_SUFFIX}
+        ${ICU_LIBRARIES}
+        winmm
+    )
+endif ()
+
+list(REMOVE_ITEM JavaScriptCore_SOURCES
+    inspector/JSGlobalObjectInspectorController.cpp
+)
+
+file(COPY
+    "${JAVASCRIPTCORE_DIR}/JavaScriptCore.vcxproj/JavaScriptCore.resources"
+    DESTINATION
+    ${CMAKE_RUNTIME_OUTPUT_DIRECTORY}
+)
+
+file(MAKE_DIRECTORY ${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore)
+
+set(JavaScriptCore_PRE_BUILD_COMMAND "${CMAKE_BINARY_DIR}/DerivedSources/JavaScriptCore/preBuild.cmd")
+file(REMOVE "${JavaScriptCore_PRE_BUILD_COMMAND}")
+foreach (_directory ${JavaScriptCore_FORWARDING_HEADERS_DIRECTORIES})
+    file(APPEND "${JavaScriptCore_PRE_BUILD_COMMAND}" "@xcopy /y /d /f \"${JAVASCRIPTCORE_DIR}/${_directory}/*.h\" \"${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore\" >nul 2>nul\n")
+endforeach ()
+
+set(JavaScriptCore_POST_BUILD_COMMAND "${CMAKE_BINARY_DIR}/DerivedSources/JavaScriptCore/postBuild.cmd")
+file(WRITE "${JavaScriptCore_POST_BUILD_COMMAND}" "@xcopy /y /d /f \"${DERIVED_SOURCES_DIR}/JavaScriptCore/*.h\" \"${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore\" >nul 2>nul\n")
+file(APPEND "${JavaScriptCore_POST_BUILD_COMMAND}" "@xcopy /y /d /f \"${DERIVED_SOURCES_DIR}/JavaScriptCore/inspector/*.h\" \"${DERIVED_SOURCES_DIR}/ForwardingHeaders/JavaScriptCore\" >nul 2>nul\n")
+
+set(JavaScriptCore_OUTPUT_NAME JavaScriptCore${DEBUG_SUFFIX})
diff --git a/Scripts/UpdateContents.py b/Scripts/UpdateContents.py
new file mode 100644
index 0000000..776d46f
--- /dev/null
+++ b/Scripts/UpdateContents.py
@@ -0,0 +1,48 @@
+#!/usr/bin/python
+
+# Copyright (C) 2015 Apple Inc.  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+# 3.  Neither the name of Apple, Inc. ("Apple") nor the names of
+#     its contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import sys
+import os
+
+assert(len(sys.argv) == 3)
+
+comp = sys.argv[1]
+filename = sys.argv[2]
+
+t = False
+
+if os.path.isfile(filename):
+    f = open(filename, 'r')
+    comparator = f.read()
+    f.close()
+    t = True
+
+if (not t or comp != comparator):
+    f = open(filename, 'w')
+    f.write(comp)
+    f.close()
diff --git a/Scripts/builtins/__init__.py b/Scripts/builtins/__init__.py
new file mode 100644
index 0000000..fdfcba9
--- /dev/null
+++ b/Scripts/builtins/__init__.py
@@ -0,0 +1,3 @@
+# Required for Python to search this directory for module files
+
+from builtins import *
diff --git a/Scripts/builtins/builtins.py b/Scripts/builtins/builtins.py
new file mode 100644
index 0000000..a9aff2b
--- /dev/null
+++ b/Scripts/builtins/builtins.py
@@ -0,0 +1,15 @@
+# This file is used to simulate the builtins/ directory when generate-js-builtins.py
+# is run from JavaScriptCore framework's private headers directory, which is flattened.
+
+from builtins_model import *
+from builtins_templates import *
+
+from builtins_generator import *
+from builtins_generate_combined_header import *
+from builtins_generate_combined_implementation import *
+from builtins_generate_separate_header import *
+from builtins_generate_separate_implementation import *
+from builtins_generate_wrapper_header import *
+from builtins_generate_wrapper_implementation import *
+from builtins_generate_internals_wrapper_header import *
+from builtins_generate_internals_wrapper_implementation import *
diff --git a/Scripts/builtins/builtins_generate_combined_header.py b/Scripts/builtins/builtins_generate_combined_header.py
new file mode 100755
index 0000000..42334ff
--- /dev/null
+++ b/Scripts/builtins/builtins_generate_combined_header.py
@@ -0,0 +1,170 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014-2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import re
+import string
+from string import Template
+
+from builtins_generator import BuiltinsGenerator
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+
+class BuiltinsCombinedHeaderGenerator(BuiltinsGenerator):
+    def __init__(self, model):
+        BuiltinsGenerator.__init__(self, model)
+
+    def output_filename(self):
+        return "%sBuiltins.h" % self.model().framework.setting('namespace')
+
+    def generate_output(self):
+        args = {
+            'namespace': self.model().framework.setting('namespace'),
+            'macroPrefix': self.model().framework.setting('macro_prefix'),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(Templates.DoNotEditWarning).substitute(args))
+        sections.append(Template(Templates.HeaderIncludeGuard).substitute(args))
+        sections.append(self.generate_forward_declarations())
+        sections.append(Template(Templates.NamespaceTop).substitute(args))
+        for object in self.model().objects:
+            sections.append(self.generate_section_for_object(object))
+        sections.append(self.generate_section_for_code_table_macro())
+        sections.append(self.generate_section_for_code_name_macro())
+        sections.append(self.generate_section_for_global_private_code_name_macro())
+        sections.append(Template(Templates.CombinedHeaderStaticMacros).substitute(args))
+        sections.append(Template(Templates.NamespaceBottom).substitute(args))
+
+        return "\n\n".join(sections)
+
+    def generate_forward_declarations(self):
+        return """namespace JSC {
+class FunctionExecutable;
+class VM;
+
+enum class ConstructAbility : unsigned;
+}"""
+
+    def generate_section_for_object(self, object):
+        lines = []
+        lines.append('/* %s */' % object.object_name)
+        lines.extend(self.generate_externs_for_object(object))
+        lines.append("")
+        lines.extend(self.generate_macros_for_object(object))
+        return '\n'.join(lines)
+
+    def generate_externs_for_object(self, object):
+        lines = []
+
+        for function in object.functions:
+            function_args = {
+                'codeName': BuiltinsGenerator.mangledNameForFunction(function) + 'Code',
+            }
+
+            lines.append("""extern const char* s_%(codeName)s;
+extern const int s_%(codeName)sLength;
+extern const JSC::ConstructAbility s_%(codeName)sConstructAbility;""" % function_args)
+
+        return lines
+
+    def generate_macros_for_object(self, object):
+        args = {
+            'macroPrefix': self.model().framework.setting('macro_prefix'),
+            'objectMacro': object.object_name.replace('.', '').upper(),
+        }
+
+        lines = []
+        lines.append("#define %(macroPrefix)s_FOREACH_%(objectMacro)s_BUILTIN_DATA(macro) \\" % args)
+        for function in object.functions:
+            function_args = {
+                'funcName': function.function_name,
+                'mangledName': BuiltinsGenerator.mangledNameForFunction(function),
+                'paramCount': len(function.parameters),
+            }
+
+            lines.append("    macro(%(funcName)s, %(mangledName)s, %(paramCount)d) \\" % function_args)
+        return lines
+
+    def generate_section_for_code_table_macro(self):
+        args = {
+            'macroPrefix': self.model().framework.setting('macro_prefix'),
+        }
+
+        lines = []
+        lines.append("#define %(macroPrefix)s_FOREACH_BUILTIN_CODE(macro) \\" % args)
+        for function in self.model().all_functions():
+            function_args = {
+                'funcName': function.function_name,
+                'codeName': BuiltinsGenerator.mangledNameForFunction(function) + 'Code',
+            }
+
+            lines.append("    macro(%(codeName)s, %(funcName)s, s_%(codeName)sLength) \\" % function_args)
+        return '\n'.join(lines)
+
+    def generate_section_for_code_name_macro(self):
+        args = {
+            'macroPrefix': self.model().framework.setting('macro_prefix'),
+        }
+
+        internal_function_names = [function.function_name for function in self.model().all_internal_functions()]
+        if len(internal_function_names) != len(set(internal_function_names)):
+            log.error("There are several internal functions with the same name. Private identifiers may clash.")
+
+        lines = []
+        lines.append("#define %(macroPrefix)s_FOREACH_BUILTIN_FUNCTION_NAME(macro) \\" % args)
+        unique_names = list(set([function.function_name for function in self.model().all_functions()]))
+        unique_names.sort()
+        for function_name in unique_names:
+            function_args = {
+                'funcName': function_name,
+            }
+
+            lines.append("    macro(%(funcName)s) \\" % function_args)
+        return '\n'.join(lines)
+
+    def generate_section_for_global_private_code_name_macro(self):
+        args = {
+            'macroPrefix': self.model().framework.setting('macro_prefix'),
+        }
+
+        lines = []
+        lines.append("#define %(macroPrefix)s_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(macro) \\" % args)
+        functions = filter(lambda function: function.is_global_private, self.model().all_functions())
+        functions.sort(key=lambda x: x.function_name)
+        for function in functions:
+            function_args = {
+                'funcName': function.function_name,
+                'codeName': BuiltinsGenerator.mangledNameForFunction(function),
+            }
+
+            lines.append("    macro(%(funcName)s, %(codeName)s) \\" % function_args)
+
+        return '\n'.join(lines)
diff --git a/Scripts/builtins/builtins_generate_combined_implementation.py b/Scripts/builtins/builtins_generate_combined_implementation.py
new file mode 100644
index 0000000..728beba
--- /dev/null
+++ b/Scripts/builtins/builtins_generate_combined_implementation.py
@@ -0,0 +1,97 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2015 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import re
+import string
+from string import Template
+
+from builtins_generator import BuiltinsGenerator
+from builtins_model import Framework, Frameworks
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+
+class BuiltinsCombinedImplementationGenerator(BuiltinsGenerator):
+    def __init__(self, model):
+        BuiltinsGenerator.__init__(self, model)
+
+    def output_filename(self):
+        return "%sBuiltins.cpp" % self.model().framework.setting('namespace')
+
+    def generate_output(self):
+        args = {
+            'namespace': self.model().framework.setting('namespace'),
+            'macroPrefix': self.model().framework.setting('macro_prefix'),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(Templates.DoNotEditWarning).substitute(args))
+        sections.append(self.generate_primary_header_includes())
+        sections.append(self.generate_secondary_header_includes())
+        sections.append(Template(Templates.NamespaceTop).substitute(args))
+        for function in self.model().all_functions():
+            sections.append(self.generate_embedded_code_string_section_for_function(function))
+        if self.model().framework is Frameworks.JavaScriptCore:
+            sections.append(Template(Templates.CombinedJSCImplementationStaticMacros).substitute(args))
+        elif self.model().framework is Frameworks.WebCore:
+            sections.append(Template(Templates.CombinedWebCoreImplementationStaticMacros).substitute(args))
+        sections.append(Template(Templates.NamespaceBottom).substitute(args))
+
+        return "\n\n".join(sections)
+
+    def generate_secondary_header_includes(self):
+        header_includes = [
+            (["JavaScriptCore"],
+                ("JavaScriptCore", "builtins/BuiltinExecutables.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "heap/HeapInlines.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "runtime/UnlinkedFunctionExecutable.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "runtime/JSCellInlines.h"),
+            ),
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/StructureInlines.h"),
+            ),
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/JSCJSValueInlines.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "runtime/VM.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "runtime/Intrinsic.h"),
+            ),
+        ]
+
+        return '\n'.join(self.generate_includes_from_entries(header_includes))
diff --git a/Scripts/builtins/builtins_generate_internals_wrapper_header.py b/Scripts/builtins/builtins_generate_internals_wrapper_header.py
new file mode 100755
index 0000000..dbcd5b5
--- /dev/null
+++ b/Scripts/builtins/builtins_generate_internals_wrapper_header.py
@@ -0,0 +1,114 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+from string import Template
+
+from builtins_generator import BuiltinsGenerator, WK_lcfirst, WK_ucfirst
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+
+class BuiltinsInternalsWrapperHeaderGenerator(BuiltinsGenerator):
+    def __init__(self, model):
+        BuiltinsGenerator.__init__(self, model)
+        self.internals = filter(lambda object: 'internal' in object.annotations, model.objects)
+
+    def output_filename(self):
+        return "%sJSBuiltinInternals.h" % self.model().framework.setting('namespace')
+
+    def generate_output(self):
+        args = {
+            'namespace': self.model().framework.setting('namespace'),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(Templates.DoNotEditWarning).substitute(args))
+        sections.append(Template(Templates.HeaderIncludeGuard).substitute(args))
+        sections.append(self.generate_secondary_header_includes())
+
+        sections.append(Template(Templates.NamespaceTop).substitute(args))
+        sections.append(self.generate_section_for_object())
+        sections.append(Template(Templates.NamespaceBottom).substitute(args))
+
+        return "\n\n".join(sections)
+
+    def generate_secondary_header_includes(self):
+        header_includes = [
+            (["WebCore"], ("JavaScriptCore", "heap/WeakInlines.h")),
+            (["WebCore"], ("JavaScriptCore", "runtime/VM.h"))
+        ]
+        for object in self.internals:
+            header_includes.append((["WebCore"], ("WebCore", object.object_name + "Builtins.h")))
+
+        return '\n'.join(self.generate_includes_from_entries(header_includes))
+
+    def generate_section_for_object(self):
+        lines = ["class JSDOMGlobalObject;",
+                 "",
+                 "class JSBuiltinInternalFunctions {",
+                 "public:"]
+
+        lines.append("    explicit JSBuiltinInternalFunctions(JSC::VM&);")
+        lines.append(self.generate_methods())
+        lines.append(self.generate_accessors())
+        lines.append("private:")
+        lines.append(self.generate_members())
+        lines.append("};")
+        return '\n'.join(lines)
+
+    def accessor_name(self, object):
+        return WK_lcfirst(object.object_name)
+
+    def member_name(self, object):
+        return "m_" + self.accessor_name(object)
+
+    def member_type(self, object):
+        return WK_ucfirst(object.object_name) + "BuiltinFunctions"
+
+    def generate_methods(self):
+        return """
+    void visit(JSC::SlotVisitor&);
+    void initialize(JSDOMGlobalObject&);
+"""
+
+    def generate_accessors(self):
+        lines = []
+        for object in self.internals:
+            accessor = "    %s& %s() { return %s; }" % (self.member_type(object), self.accessor_name(object), self.member_name(object))
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), accessor))
+        lines.append("")
+        return '\n'.join(lines)
+
+    def generate_members(self):
+        guards = set([object.annotations.get('conditional') for object in self.internals if 'conditional' in object.annotations])
+        lines = [BuiltinsGenerator.wrap_with_guard(" || ".join(guards), "    JSC::VM& m_vm;")]
+        for object in self.internals:
+            member = "    %s %s;" % (self.member_type(object), self.member_name(object))
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), member))
+        return '\n'.join(lines)
diff --git a/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py b/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py
new file mode 100755
index 0000000..d2d09c5
--- /dev/null
+++ b/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py
@@ -0,0 +1,156 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+from string import Template
+
+from builtins_generator import BuiltinsGenerator, WK_lcfirst, WK_ucfirst
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+
+class BuiltinsInternalsWrapperImplementationGenerator(BuiltinsGenerator):
+    def __init__(self, model):
+        BuiltinsGenerator.__init__(self, model)
+        self.internals = filter(lambda object: 'internal' in object.annotations, model.objects)
+
+    def output_filename(self):
+        return "%sJSBuiltinInternals.cpp" % self.model().framework.setting('namespace')
+
+    def generate_output(self):
+        args = {
+            'namespace': self.model().framework.setting('namespace'),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(Templates.DoNotEditWarning).substitute(args))
+        sections.append(self.generate_primary_header_includes())
+        sections.append(self.generate_secondary_header_includes())
+
+        sections.append(Template(Templates.NamespaceTop).substitute(args))
+        sections.append(self.generate_section_for_object())
+        sections.append(Template(Templates.NamespaceBottom).substitute(args))
+
+        return "\n\n".join(sections)
+
+    def generate_secondary_header_includes(self):
+        header_includes = [
+            (["WebCore"],
+                ("WebCore", "JSDOMGlobalObject.h"),
+            ),
+            (["WebCore"],
+                ("WebCore", "WebCoreJSClientData.h"),
+            ),
+            (["WebCore"],
+                ("JavaScriptCore", "heap/HeapInlines.h"),
+            ),
+            (["WebCore"],
+                ("JavaScriptCore", "heap/SlotVisitorInlines.h"),
+            ),
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/JSCJSValueInlines.h"),
+            ),
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/StructureInlines.h"),
+            ),
+        ]
+        return '\n'.join(self.generate_includes_from_entries(header_includes))
+
+    def generate_section_for_object(self):
+        lines = []
+
+        lines.append(self.generate_constructor())
+        lines.append(self.generate_visit_method())
+        lines.append(self.generate_initialize_method())
+        return '\n'.join(lines)
+
+    def accessor_name(self, object):
+        return WK_lcfirst(object.object_name)
+
+    def member_name(self, object):
+        return "m_" + self.accessor_name(object)
+
+    def member_type(self, object):
+        return WK_ucfirst(object.object_name) + "BuiltinFunctions"
+
+    def generate_constructor(self):
+        guards = set([object.annotations.get('conditional') for object in self.internals if 'conditional' in object.annotations])
+        lines = ["JSBuiltinInternalFunctions::JSBuiltinInternalFunctions(JSC::VM& vm)",
+                 BuiltinsGenerator.wrap_with_guard(" || ".join(guards), "    : m_vm(vm)")]
+        for object in self.internals:
+            initializer = "    , %s(m_vm)" % self.member_name(object)
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), initializer))
+        lines.append("{")
+        lines.append("    UNUSED_PARAM(vm);")
+        lines.append("}\n")
+        return '\n'.join(lines)
+
+    def property_macro(self, object):
+        lines = []
+        lines.append("#define DECLARE_GLOBAL_STATIC(name) \\")
+        lines.append("    JSDOMGlobalObject::GlobalPropertyInfo( \\")
+        lines.append("        clientData.builtinFunctions().%sBuiltins().name##PrivateName(), %s().m_##name##Function.get() , JSC::DontDelete | JSC::ReadOnly)," % (self.accessor_name(object), self.accessor_name(object)))
+        lines.append("    WEBCORE_FOREACH_%s_BUILTIN_FUNCTION_NAME(DECLARE_GLOBAL_STATIC)" % object.object_name.upper())
+        lines.append("#undef DECLARE_GLOBAL_STATIC")
+        return '\n'.join(lines)
+
+    def generate_visit_method(self):
+        lines = ["void JSBuiltinInternalFunctions::visit(JSC::SlotVisitor& visitor)",
+                 "{"]
+        for object in self.internals:
+            visit = "    %s.visit(visitor);" % self.member_name(object)
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), visit))
+        lines.append("    UNUSED_PARAM(visitor);")
+        lines.append("}\n")
+        return '\n'.join(lines)
+
+    def _generate_initialize_static_globals(self):
+        lines = ["    JSVMClientData& clientData = *static_cast<JSVMClientData*>(m_vm.clientData);",
+                 "    JSDOMGlobalObject::GlobalPropertyInfo staticGlobals[] = {"]
+        for object in self.internals:
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), self.property_macro(object)))
+        lines.append("    };")
+        lines.append("    globalObject.addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));")
+        lines.append("    UNUSED_PARAM(clientData);")
+        return '\n'.join(lines)
+
+    def generate_initialize_method(self):
+        lines = ["void JSBuiltinInternalFunctions::initialize(JSDOMGlobalObject& globalObject)",
+                "{",
+                "    UNUSED_PARAM(globalObject);"]
+
+        for object in self.internals:
+            init = "    %s.init(globalObject);" % self.member_name(object)
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), init))
+        lines.append("")
+
+        guards = set([object.annotations.get('conditional') for object in self.internals if 'conditional' in object.annotations])
+        lines.append(BuiltinsGenerator.wrap_with_guard(" || ".join(guards), self._generate_initialize_static_globals()))
+
+        lines.append("}")
+        return '\n'.join(lines)
diff --git a/Scripts/builtins/builtins_generate_separate_header.py b/Scripts/builtins/builtins_generate_separate_header.py
new file mode 100755
index 0000000..9058367
--- /dev/null
+++ b/Scripts/builtins/builtins_generate_separate_header.py
@@ -0,0 +1,197 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2015 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import re
+import string
+from string import Template
+
+from builtins_generator import BuiltinsGenerator
+from builtins_model import Frameworks
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+
+class BuiltinsSeparateHeaderGenerator(BuiltinsGenerator):
+    def __init__(self, model, object):
+        BuiltinsGenerator.__init__(self, model)
+        self.object = object
+
+    def output_filename(self):
+        return "%sBuiltins.h" % BuiltinsGenerator.mangledNameForObject(self.object)
+
+    def macro_prefix(self):
+        return self.model().framework.setting('macro_prefix')
+
+    def generate_output(self):
+        args = {
+            'namespace': self.model().framework.setting('namespace'),
+            'macroPrefix': self.macro_prefix(),
+            'objectName': self.object.object_name,
+            'objectMacro': self.object.object_name.upper(),
+        }
+
+        conditional_guard = self.object.annotations.get('conditional')
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(Templates.DoNotEditWarning).substitute(args))
+        sections.append(Template(Templates.HeaderIncludeGuard).substitute(args))
+        if conditional_guard is not None:
+            sections.append("#if %s" % conditional_guard)
+        sections.append(self.generate_secondary_header_includes())
+        sections.append(self.generate_forward_declarations())
+        sections.append(Template(Templates.NamespaceTop).substitute(args))
+        sections.append(self.generate_section_for_object(self.object))
+        sections.append(self.generate_section_for_code_table_macro())
+        sections.append(self.generate_section_for_code_name_macro())
+        sections.append(Template(Templates.SeparateHeaderStaticMacros).substitute(args))
+        if self.model().framework is Frameworks.WebCore:
+            sections.append(Template(Templates.SeparateHeaderWrapperBoilerplate).substitute(args))
+            if self.object.annotations.get('internal'):
+                sections.append(Template(Templates.SeparateHeaderInternalFunctionsBoilerplate).substitute(args))
+        sections.append(Template(Templates.NamespaceBottom).substitute(args))
+        if conditional_guard is not None:
+            sections.append("#endif // %s" % conditional_guard)
+
+        return "\n\n".join(sections)
+
+    def generate_forward_declarations(self):
+        return """namespace JSC {
+class FunctionExecutable;
+}"""
+
+    def generate_secondary_header_includes(self):
+        header_includes = [
+            (["WebCore"],
+                ("JavaScriptCore", "bytecode/UnlinkedFunctionExecutable.h"),
+            ),
+
+            (["WebCore"],
+                ("JavaScriptCore", "builtins/BuiltinUtils.h"),
+            ),
+
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/Identifier.h"),
+            ),
+
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/JSFunction.h"),
+            ),
+        ]
+
+        return '\n'.join(self.generate_includes_from_entries(header_includes))
+
+    def generate_section_for_object(self, object):
+        lines = []
+        lines.append('/* %s */' % object.object_name)
+        lines.extend(self.generate_externs_for_object(object))
+        lines.append("")
+        lines.extend(self.generate_macros_for_object(object))
+        lines.append("")
+        lines.extend(self.generate_defines_for_object(object))
+        return '\n'.join(lines)
+
+    def generate_externs_for_object(self, object):
+        lines = []
+
+        for function in object.functions:
+            function_args = {
+                'codeName': BuiltinsGenerator.mangledNameForFunction(function) + 'Code',
+            }
+
+            lines.append("""extern const char* s_%(codeName)s;
+extern const int s_%(codeName)sLength;
+extern const JSC::ConstructAbility s_%(codeName)sConstructAbility;""" % function_args)
+
+        return lines
+
+    def generate_macros_for_object(self, object):
+        args = {
+            'macroPrefix': self.macro_prefix(),
+            'objectMacro': object.object_name.replace('.', '_').upper(),
+        }
+
+        lines = []
+        lines.append("#define %(macroPrefix)s_FOREACH_%(objectMacro)s_BUILTIN_DATA(macro) \\" % args)
+        for function in object.functions:
+            function_args = {
+                'funcName': function.function_name,
+                'mangledName': BuiltinsGenerator.mangledNameForFunction(function),
+                'paramCount': len(function.parameters),
+            }
+
+            lines.append("    macro(%(funcName)s, %(mangledName)s, %(paramCount)d) \\" % function_args)
+        return lines
+
+    def generate_defines_for_object(self, object):
+        lines = []
+        for function in object.functions:
+            args = {
+                'macroPrefix': self.macro_prefix(),
+                'objectMacro': object.object_name.replace('.', '_').upper(),
+                'functionMacro': function.function_name.upper(),
+            }
+            lines.append("#define %(macroPrefix)s_BUILTIN_%(objectMacro)s_%(functionMacro)s 1" % args)
+
+        return lines
+
+    def generate_section_for_code_table_macro(self):
+        args = {
+            'macroPrefix': self.model().framework.setting('macro_prefix'),
+            'objectMacro': self.object.object_name.upper(),
+        }
+
+        lines = []
+        lines.append("#define %(macroPrefix)s_FOREACH_%(objectMacro)s_BUILTIN_CODE(macro) \\" % args)
+        for function in self.object.functions:
+            function_args = {
+                'funcName': function.function_name,
+                'codeName': BuiltinsGenerator.mangledNameForFunction(function) + 'Code',
+            }
+
+            lines.append("    macro(%(codeName)s, %(funcName)s, s_%(codeName)sLength) \\" % function_args)
+        return '\n'.join(lines)
+
+    def generate_section_for_code_name_macro(self):
+        args = {
+            'macroPrefix': self.macro_prefix(),
+            'objectMacro': self.object.object_name.upper(),
+        }
+
+        lines = []
+        lines.append("#define %(macroPrefix)s_FOREACH_%(objectMacro)s_BUILTIN_FUNCTION_NAME(macro) \\" % args)
+        unique_names = list(set([function.function_name for function in self.object.functions]))
+        unique_names.sort()
+        for function_name in unique_names:
+            function_args = {
+                'funcName': function_name,
+            }
+
+            lines.append("    macro(%(funcName)s) \\" % function_args)
+        return '\n'.join(lines)
diff --git a/Scripts/builtins/builtins_generate_separate_implementation.py b/Scripts/builtins/builtins_generate_separate_implementation.py
new file mode 100644
index 0000000..d5362bd
--- /dev/null
+++ b/Scripts/builtins/builtins_generate_separate_implementation.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2015 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import re
+import string
+from string import Template
+
+from builtins_generator import BuiltinsGenerator, WK_lcfirst
+from builtins_model import Framework, Frameworks
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+
+class BuiltinsSeparateImplementationGenerator(BuiltinsGenerator):
+    def __init__(self, model, object):
+        BuiltinsGenerator.__init__(self, model)
+        self.object = object
+
+    def output_filename(self):
+        return "%sBuiltins.cpp" % BuiltinsGenerator.mangledNameForObject(self.object)
+
+    def macro_prefix(self):
+        return self.model().framework.setting('macro_prefix')
+
+    def generate_output(self):
+        args = {
+            'namespace': self.model().framework.setting('namespace'),
+            'macroPrefix': self.macro_prefix(),
+            'objectMacro': self.object.object_name.upper(),
+            'objectNameLC': WK_lcfirst(self.object.object_name),
+        }
+
+        conditional_guard = self.object.annotations.get('conditional')
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(Templates.DoNotEditWarning).substitute(args))
+        sections.append(self.generate_primary_header_includes())
+        if conditional_guard is not None:
+            sections.append("#if %s" % conditional_guard)
+        sections.append(self.generate_secondary_header_includes())
+        sections.append(Template(Templates.NamespaceTop).substitute(args))
+        for function in self.object.functions:
+            sections.append(self.generate_embedded_code_string_section_for_function(function))
+        if self.model().framework is Frameworks.JavaScriptCore:
+            sections.append(Template(Templates.SeparateJSCImplementationStaticMacros).substitute(args))
+        elif self.model().framework is Frameworks.WebCore:
+            sections.append(Template(Templates.SeparateWebCoreImplementationStaticMacros).substitute(args))
+        sections.append(Template(Templates.NamespaceBottom).substitute(args))
+        if conditional_guard is not None:
+            sections.append("#endif // %s\n" % conditional_guard)
+
+        return "\n\n".join(sections)
+
+    def generate_secondary_header_includes(self):
+        header_includes = [
+            (["JavaScriptCore"],
+                ("JavaScriptCore", "builtins/BuiltinExecutables.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "heap/HeapInlines.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "runtime/JSCellInlines.h"),
+            ),
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/StructureInlines.h"),
+            ),
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/JSCJSValueInlines.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "runtime/VM.h"),
+            ),
+            (["WebCore"],
+                ("WebCore", "bindings/js/WebCoreJSClientData.h"),
+            ),
+            (["JavaScriptCore", "WebCore"],
+                ("JavaScriptCore", "runtime/Intrinsic.h"),
+            ),
+        ]
+
+        return '\n'.join(self.generate_includes_from_entries(header_includes))
diff --git a/Scripts/builtins/builtins_generate_wrapper_header.py b/Scripts/builtins/builtins_generate_wrapper_header.py
new file mode 100755
index 0000000..04abe56
--- /dev/null
+++ b/Scripts/builtins/builtins_generate_wrapper_header.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+from string import Template
+
+from builtins_generator import BuiltinsGenerator, WK_lcfirst, WK_ucfirst
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+
+class BuiltinsWrapperHeaderGenerator(BuiltinsGenerator):
+    def __init__(self, model):
+        BuiltinsGenerator.__init__(self, model)
+
+    def output_filename(self):
+        return "%sJSBuiltins.h" % self.model().framework.setting('namespace')
+
+    def generate_output(self):
+        args = {
+            'namespace': self.model().framework.setting('namespace'),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(Templates.DoNotEditWarning).substitute(args))
+        sections.append(Template(Templates.HeaderIncludeGuard).substitute(args))
+        sections.append(self.generate_secondary_header_includes())
+
+        sections.append(Template(Templates.NamespaceTop).substitute(args))
+        sections.append(self.generate_section_for_object())
+        sections.append(Template(Templates.NamespaceBottom).substitute(args))
+
+        return "\n\n".join(sections)
+
+    def generate_secondary_header_includes(self):
+        header_includes = [
+            (["WebCore"],
+                ("JavaScriptCore", "runtime/VM.h"),
+            ),
+        ]
+        for object in self.model().objects:
+            header_includes.append((["WebCore"], ("WebCore", object.object_name + "Builtins.h")))
+
+        return '\n'.join(self.generate_includes_from_entries(header_includes))
+
+    def generate_section_for_object(self):
+        lines = ["class JSBuiltinFunctions {",
+                 "public:"]
+
+        lines.append(self.generate_constructor())
+        lines.append(self.generate_accessors())
+        lines.append("private:")
+        lines.append(self.generate_members())
+        lines.append("};")
+        return '\n'.join(lines)
+
+    def accessor_name(self, object):
+        return WK_lcfirst(object.object_name) + "Builtins"
+
+    def member_name(self, object):
+        return "m_" + self.accessor_name(object)
+
+    def member_type(self, object):
+        return WK_ucfirst(object.object_name) + "BuiltinsWrapper"
+
+    def generate_constructor(self):
+        lines = ["    explicit JSBuiltinFunctions(JSC::VM& vm)",
+                 "        : m_vm(vm)"]
+        for object in self.model().objects:
+            member_init = "        , %s(&m_vm)" % self.member_name(object)
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), member_init))
+        lines.append("    {")
+        for object in self.model().objects:
+            if not 'internal' in object.annotations:
+                continue
+            internal_export_names = "        %s.exportNames();" % self.member_name(object)
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), internal_export_names))
+        lines.append("    }\n")
+        return '\n'.join(lines)
+
+    def generate_accessors(self):
+        lines = []
+        for object in self.model().objects:
+            accessor = "    %s& %s() { return %s; }" % (self.member_type(object), self.accessor_name(object), self.member_name(object))
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), accessor))
+        lines.append("")
+        return '\n'.join(lines)
+
+    def generate_members(self):
+        lines = ["    JSC::VM& m_vm;"]
+        for object in self.model().objects:
+            member = "    %s %s;" % (self.member_type(object), self.member_name(object))
+            lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), member))
+        return '\n'.join(lines)
diff --git a/Scripts/builtins/builtins_generate_wrapper_implementation.py b/Scripts/builtins/builtins_generate_wrapper_implementation.py
new file mode 100755
index 0000000..0055917
--- /dev/null
+++ b/Scripts/builtins/builtins_generate_wrapper_implementation.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+from string import Template
+
+from builtins_generator import BuiltinsGenerator
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+
+class BuiltinsWrapperImplementationGenerator(BuiltinsGenerator):
+    def __init__(self, model):
+        BuiltinsGenerator.__init__(self, model)
+
+    def output_filename(self):
+        return "%sJSBuiltins.cpp" % self.model().framework.setting('namespace')
+
+    def generate_output(self):
+        args = {
+            'namespace': self.model().framework.setting('namespace'),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(Templates.DoNotEditWarning).substitute(args))
+
+        sections.append(self.generate_section_for_object())
+
+        return "\n\n".join(sections)
+
+    def generate_section_for_object(self):
+        header_includes = []
+        for object in self.model().objects:
+            header_includes.append((["WebCore"], ("WebCore", object.object_name + "Builtins.cpp")))
+
+        return '\n'.join(self.generate_includes_from_entries(header_includes))
diff --git a/Scripts/builtins/builtins_generator.py b/Scripts/builtins/builtins_generator.py
new file mode 100644
index 0000000..4950113
--- /dev/null
+++ b/Scripts/builtins/builtins_generator.py
@@ -0,0 +1,181 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2015 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+import logging
+import os.path
+import re
+from string import Template
+import json
+
+from builtins_model import BuiltinFunction, BuiltinObject
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+# These match WK_lcfirst and WK_ucfirst defined in CodeGenerator.pm.
+def WK_lcfirst(str):
+    str = str[:1].lower() + str[1:]
+    str = str.replace('dOM', 'dom')
+    str = str.replace('uRL', 'url')
+    str = str.replace('jS', 'js')
+    str = str.replace('xML', 'xml')
+    str = str.replace('xSLT', 'xslt')
+    str = str.replace('cSS', 'css')
+    str = str.replace('rTC', 'rtc')
+    return str
+
+def WK_ucfirst(str):
+    str = str[:1].upper() + str[1:]
+    str = str.replace('Xml', 'XML')
+    str = str.replace('Svg', 'SVG')
+    return str
+
+class BuiltinsGenerator:
+    def __init__(self, model):
+        self._model = model
+
+    def model(self):
+        return self._model
+
+    # These methods are overridden by subclasses.
+
+    def generate_output(self):
+        pass
+
+    def output_filename(self):
+        pass
+
+
+    # Shared code generation methods.
+    def generate_license(self):
+        raw_license = Template(Templates.LicenseText).substitute(None)
+        copyrights = self._model.copyrights()
+        copyrights.sort()
+
+        license_block = []
+        license_block.append("/*")
+        for copyright in copyrights:
+            license_block.append(" * Copyright (c) %s" % copyright)
+        if len(copyrights) > 0:
+            license_block.append(" * ")
+
+        for line in raw_license.split('\n'):
+            license_block.append(" * " + line)
+
+        license_block.append(" */")
+
+        return '\n'.join(license_block)
+
+    def generate_includes_from_entries(self, entries):
+        includes = set()
+        for entry in entries:
+            (allowed_framework_names, data) = entry
+            (framework_name, header_path) = data
+
+            if self.model().framework.name not in allowed_framework_names:
+                continue
+            if self.model().framework.name != framework_name:
+                includes.add("#include <%s>" % header_path)
+            else:
+                includes.add("#include \"%s\"" % os.path.basename(header_path))
+
+        return sorted(list(includes))
+
+    def generate_primary_header_includes(self):
+        name, _ = os.path.splitext(self.output_filename())
+        return '\n'.join([
+            "#include \"config.h\"",
+            "#include \"%s.h\"" % name,
+        ])
+
+    def generate_embedded_code_string_section_for_function(self, function):
+        text = function.function_source
+        # Wrap it in parens to avoid adding to global scope.
+        text = "(function " + text[text.index("("):] + ")"
+        embeddedSourceLength = len(text) + 1  # For extra \n.
+        # Lazy way to escape quotes, I think?
+        textLines = json.dumps(text)[1:-1].split("\\n")
+        # This looks scary because we need the JS source itself to have newlines.
+        embeddedSource = '\n'.join(['    "%s\\n" \\' % line for line in textLines])
+
+        constructAbility = "CannotConstruct"
+        if function.is_constructor:
+            constructAbility = "CanConstruct"
+
+        args = {
+            'codeName': BuiltinsGenerator.mangledNameForFunction(function) + 'Code',
+            'embeddedSource': embeddedSource,
+            'embeddedSourceLength': embeddedSourceLength,
+            'canConstruct': constructAbility,
+            'intrinsic': function.intrinsic
+        }
+
+        lines = []
+        lines.append("const JSC::ConstructAbility s_%(codeName)sConstructAbility = JSC::ConstructAbility::%(canConstruct)s;" % args);
+        lines.append("const int s_%(codeName)sLength = %(embeddedSourceLength)d;" % args);
+        lines.append("static const JSC::Intrinsic s_%(codeName)sIntrinsic = JSC::%(intrinsic)s;" % args);
+        lines.append("const char* s_%(codeName)s =\n%(embeddedSource)s\n;" % args);
+        return '\n'.join(lines)
+
+    # Helper methods.
+
+    @staticmethod
+    def wrap_with_guard(guard, text):
+        if not guard:
+            return text
+        return '\n'.join([
+            '#if %s' % guard,
+            text,
+            '#endif // %s' % guard,
+        ])
+
+    @staticmethod
+    def mangledNameForObject(object):
+        if not isinstance(object, BuiltinObject):
+            raise Exception("Invalid argument passed to mangledNameForObject()")
+
+        def toCamel(match):
+            str = match.group(0)
+            return str[1].upper()
+        return re.sub(r'\.[a-z]', toCamel, object.object_name, flags=re.IGNORECASE)
+
+
+    @staticmethod
+    def mangledNameForFunction(function):
+        if not isinstance(function, BuiltinFunction):
+            raise Exception("Invalid argument passed to mangledNameForFunction()")
+
+        function_name = WK_ucfirst(function.function_name)
+
+        def toCamel(match):
+            str = match.group(0)
+            return str[1].upper()
+        function_name = re.sub(r'\.[a-z]', toCamel, function_name, flags=re.IGNORECASE)
+        if function.is_constructor:
+            function_name = function_name + "Constructor"
+
+        object_name = BuiltinsGenerator.mangledNameForObject(function.object)
+        return WK_lcfirst(object_name + function_name)
diff --git a/Scripts/builtins/builtins_model.py b/Scripts/builtins/builtins_model.py
new file mode 100755
index 0000000..c35bd3e
--- /dev/null
+++ b/Scripts/builtins/builtins_model.py
@@ -0,0 +1,288 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2015-2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+import logging
+import re
+import os
+
+from builtins_templates import BuiltinsGeneratorTemplates as Templates
+
+log = logging.getLogger('global')
+
+_FRAMEWORK_CONFIG_MAP = {
+    "JavaScriptCore": {
+        "macro_prefix": "JSC",
+        "namespace": "JSC",
+    },
+    "WebCore": {
+        "macro_prefix": "WEBCORE",
+        "namespace": "WebCore",
+    },
+}
+
+functionHeadRegExp = re.compile(r"(?:@[\w|=]+\s*\n)*function\s+\w+\s*\(.*?\)", re.MULTILINE | re.DOTALL)
+functionGlobalPrivateRegExp = re.compile(r".*^@globalPrivate", re.MULTILINE | re.DOTALL)
+functionIntrinsicRegExp = re.compile(r".*^@intrinsic=(\w+)", re.MULTILINE | re.DOTALL)
+functionIsConstructorRegExp = re.compile(r".*^@constructor", re.MULTILINE | re.DOTALL)
+functionNameRegExp = re.compile(r"function\s+(\w+)\s*\(", re.MULTILINE | re.DOTALL)
+functionParameterFinder = re.compile(r"^function\s+(?:\w+)\s*\(((?:\s*\w+)?\s*(?:\s*,\s*\w+)*)?\s*\)", re.MULTILINE | re.DOTALL)
+
+multilineCommentRegExp = re.compile(r"\/\*.*?\*\/", re.MULTILINE | re.DOTALL)
+singleLineCommentRegExp = re.compile(r"\/\/.*?\n", re.MULTILINE | re.DOTALL)
+keyValueAnnotationCommentRegExp = re.compile(r"^\/\/ @(\w+)=([^=]+?)\n", re.MULTILINE | re.DOTALL)
+flagAnnotationCommentRegExp = re.compile(r"^\/\/ @(\w+)[^=]*?\n", re.MULTILINE | re.DOTALL)
+lineWithOnlySingleLineCommentRegExp = re.compile(r"^\s*\/\/\n", re.MULTILINE | re.DOTALL)
+lineWithTrailingSingleLineCommentRegExp = re.compile(r"\s*\/\/\n", re.MULTILINE | re.DOTALL)
+multipleEmptyLinesRegExp = re.compile(r"\n{2,}", re.MULTILINE | re.DOTALL)
+
+class ParseException(Exception):
+    pass
+
+
+class Framework:
+    def __init__(self, name):
+        self._settings = _FRAMEWORK_CONFIG_MAP[name]
+        self.name = name
+
+    def setting(self, key, default=''):
+        return self._settings.get(key, default)
+
+    @staticmethod
+    def fromString(frameworkString):
+        if frameworkString == "JavaScriptCore":
+            return Frameworks.JavaScriptCore
+
+        if frameworkString == "WebCore":
+            return Frameworks.WebCore
+
+        raise ParseException("Unknown framework: %s" % frameworkString)
+
+
+class Frameworks:
+    JavaScriptCore = Framework("JavaScriptCore")
+    WebCore = Framework("WebCore")
+
+
+class BuiltinObject:
+    def __init__(self, object_name, annotations, functions):
+        self.object_name = object_name
+        self.annotations = annotations
+        self.functions = functions
+        self.collection = None  # Set by the owning BuiltinsCollection
+
+        for function in self.functions:
+            function.object = self
+
+
+class BuiltinFunction:
+    def __init__(self, function_name, function_source, parameters, is_constructor, is_global_private, intrinsic):
+        self.function_name = function_name
+        self.function_source = function_source
+        self.parameters = parameters
+        self.is_constructor = is_constructor
+        self.is_global_private = is_global_private
+        self.intrinsic = intrinsic
+        self.object = None  # Set by the owning BuiltinObject
+
+    @staticmethod
+    def fromString(function_string):
+        function_source = multilineCommentRegExp.sub("", function_string)
+
+        intrinsic = "NoIntrinsic"
+        intrinsicMatch = functionIntrinsicRegExp.search(function_source)
+        if intrinsicMatch:
+            intrinsic = intrinsicMatch.group(1)
+            function_source = functionIntrinsicRegExp.sub("", function_source)
+
+        if os.getenv("CONFIGURATION", "Debug").startswith("Debug"):
+            function_source = lineWithOnlySingleLineCommentRegExp.sub("", function_source)
+            function_source = lineWithTrailingSingleLineCommentRegExp.sub("\n", function_source)
+            function_source = multipleEmptyLinesRegExp.sub("\n", function_source)
+
+        function_name = functionNameRegExp.findall(function_source)[0]
+        is_constructor = functionIsConstructorRegExp.match(function_source) != None
+        is_global_private = functionGlobalPrivateRegExp.match(function_source) != None
+        parameters = [s.strip() for s in functionParameterFinder.findall(function_source)[0].split(',')]
+        if len(parameters[0]) == 0:
+            parameters = []
+
+        return BuiltinFunction(function_name, function_source, parameters, is_constructor, is_global_private, intrinsic)
+
+    def __str__(self):
+        interface = "%s(%s)" % (self.function_name, ', '.join(self.parameters))
+        if self.is_constructor:
+            interface = interface + " [Constructor]"
+
+        return interface
+
+
+class BuiltinsCollection:
+    def __init__(self, framework_name):
+        self._copyright_lines = set()
+        self.objects = []
+        self.framework = Framework.fromString(framework_name)
+        log.debug("Created new Builtins collection.")
+
+    def parse_builtins_file(self, filename, text):
+        log.debug("Parsing builtins file: %s" % filename)
+
+        parsed_copyrights = set(self._parse_copyright_lines(text))
+        self._copyright_lines = self._copyright_lines.union(parsed_copyrights)
+
+        log.debug("Found copyright lines:")
+        for line in self._copyright_lines:
+            log.debug(line)
+        log.debug("")
+
+        object_annotations = self._parse_annotations(text)
+
+        object_name, ext = os.path.splitext(os.path.basename(filename))
+        log.debug("Parsing object: %s" % object_name)
+
+        parsed_functions = self._parse_functions(text)
+        for function in parsed_functions:
+            function.object = object_name
+
+        log.debug("Parsed functions:")
+        for func in parsed_functions:
+            log.debug(func)
+        log.debug("")
+
+        new_object = BuiltinObject(object_name, object_annotations, parsed_functions)
+        new_object.collection = self
+        self.objects.append(new_object)
+
+    def copyrights(self):
+        owner_to_years = dict()
+        copyrightYearRegExp = re.compile(r"(\d{4})[, ]{0,2}")
+        ownerStartRegExp = re.compile(r"[^\d, ]")
+
+        # Returns deduplicated copyrights keyed on the owner.
+        for line in self._copyright_lines:
+            years = set(copyrightYearRegExp.findall(line))
+            ownerIndex = ownerStartRegExp.search(line).start()
+            owner = line[ownerIndex:]
+            log.debug("Found years: %s and owner: %s" % (years, owner))
+            if owner not in owner_to_years:
+                owner_to_years[owner] = set()
+
+            owner_to_years[owner] = owner_to_years[owner].union(years)
+
+        result = []
+
+        for owner, years in owner_to_years.items():
+            sorted_years = list(years)
+            sorted_years.sort()
+            result.append("%s %s" % (', '.join(sorted_years), owner))
+
+        return result
+
+    def all_functions(self):
+        result = []
+        for object in self.objects:
+            result.extend(object.functions)
+
+        result.sort()
+        return result
+
+    def all_internal_functions(self):
+        result = []
+        for object in [o for o in self.objects if 'internal' in o.annotations]:
+            result.extend(object.functions)
+
+        result.sort()
+        return result
+
+    # Private methods.
+
+    def _parse_copyright_lines(self, text):
+        licenseBlock = multilineCommentRegExp.findall(text)[0]
+        licenseBlock = licenseBlock[:licenseBlock.index("Redistribution")]
+
+        copyrightLines = [Templates.DefaultCopyright]
+        for line in licenseBlock.split("\n"):
+            line = line.replace("/*", "")
+            line = line.replace("*/", "")
+            line = line.replace("*", "")
+            line = line.replace("Copyright", "")
+            line = line.replace("copyright", "")
+            line = line.replace("(C)", "")
+            line = line.replace("(c)", "")
+            line = line.strip()
+
+            if len(line) == 0:
+                continue
+
+            copyrightLines.append(line)
+
+        return copyrightLines
+
+    def _parse_annotations(self, text):
+        annotations = {}
+
+        for match in keyValueAnnotationCommentRegExp.finditer(text):
+            (key, value) = match.group(1, 2)
+            log.debug("Found annotation: '%s' => '%s'" % (key, value))
+            if key in annotations:
+                raise ParseException("Duplicate annotation found: %s" % key)
+
+            annotations[key] = value
+
+        for match in flagAnnotationCommentRegExp.finditer(text):
+            key = match.group(1)
+            log.debug("Found annotation: '%s' => 'TRUE'" % key)
+            if key in annotations:
+                raise ParseException("Duplicate annotation found: %s" % key)
+
+            annotations[key] = True
+
+        return annotations
+
+    def _parse_functions(self, text):
+        text = multilineCommentRegExp.sub("/**/", singleLineCommentRegExp.sub("//\n", text))
+
+        matches = [func for func in functionHeadRegExp.finditer(text)]
+        functionBounds = []
+        start = 0
+        end = 0
+        for match in matches:
+            start = match.start()
+            if start < end:
+                continue
+            end = match.end()
+            while text[end] != '{':
+                end = end + 1
+            depth = 1
+            end = end + 1
+            while depth > 0:
+                if text[end] == '{':
+                    depth = depth + 1
+                elif text[end] == '}':
+                    depth = depth - 1
+                end = end + 1
+            functionBounds.append((start, end))
+
+        functionStrings = [text[start:end].strip() for (start, end) in functionBounds]
+        return map(BuiltinFunction.fromString, functionStrings)
diff --git a/Scripts/builtins/builtins_templates.py b/Scripts/builtins/builtins_templates.py
new file mode 100644
index 0000000..7d5a04d
--- /dev/null
+++ b/Scripts/builtins/builtins_templates.py
@@ -0,0 +1,212 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014-2016 Apple Inc. All rights reserved.
+# Copyright (C) 2015 Canon Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Builtins generator templates, which can be filled with string.Template.
+
+
+class BuiltinsGeneratorTemplates:
+
+    DefaultCopyright = "2016 Apple Inc. All rights reserved."
+    LicenseText = (
+    """Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+THE POSSIBILITY OF SUCH DAMAGE.
+""")
+
+    DoNotEditWarning = (
+    """// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py""")
+
+    HeaderIncludeGuard = (
+    """#pragma once""")
+
+    NamespaceTop = (
+    """namespace ${namespace} {""")
+
+    NamespaceBottom = (
+    """} // namespace ${namespace}""")
+
+    CombinedHeaderStaticMacros = (
+    """#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \\
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+${macroPrefix}_FOREACH_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR""")
+
+    SeparateHeaderStaticMacros = (
+    """#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \\
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR""")
+
+    CombinedJSCImplementationStaticMacros = (
+    """
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \\
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \\
+{\\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \
+}
+${macroPrefix}_FOREACH_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+""")
+
+    SeparateJSCImplementationStaticMacros = (
+    """
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \\
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \\
+{\\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \
+}
+${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+""")
+
+    CombinedWebCoreImplementationStaticMacros = (
+        """
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \\
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \\
+{\\
+    JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData); \\
+    return clientData->builtinFunctions().${objectNameLC}Builtins().codeName##Executable()->link(vm, clientData->builtinFunctions().${objectNameLC}Builtins().codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \\
+}
+${macroPrefix}_FOREACH_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+""")
+
+    SeparateWebCoreImplementationStaticMacros = (
+        """
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \\
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \\
+{\\
+    JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData); \\
+    return clientData->builtinFunctions().${objectNameLC}Builtins().codeName##Executable()->link(vm, clientData->builtinFunctions().${objectNameLC}Builtins().codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \\
+}
+${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+""")
+
+    SeparateHeaderWrapperBoilerplate = (
+    """class ${objectName}BuiltinsWrapper : private JSC::WeakHandleOwner {
+public:
+    explicit ${objectName}BuiltinsWrapper(JSC::VM* vm)
+        : m_vm(*vm)
+        ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+        ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
+#undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
+    {
+    }
+
+#define EXPOSE_BUILTIN_EXECUTABLES(name, functionName, length) \\
+    JSC::UnlinkedFunctionExecutable* name##Executable(); \\
+    const JSC::SourceCode& name##Source() const { return m_##name##Source; }
+    ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(EXPOSE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_EXECUTABLES
+
+    ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+
+    void exportNames();
+
+private:
+    JSC::VM& m_vm;
+
+    ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_NAMES)
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) \\
+    JSC::SourceCode m_##name##Source;\\
+    JSC::Weak<JSC::UnlinkedFunctionExecutable> m_##name##Executable;
+    ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+
+};
+
+#define DEFINE_BUILTIN_EXECUTABLES(name, functionName, length) \\
+inline JSC::UnlinkedFunctionExecutable* ${objectName}BuiltinsWrapper::name##Executable() \\
+{\\
+    if (!m_##name##Executable)\\
+        m_##name##Executable = JSC::Weak<JSC::UnlinkedFunctionExecutable>(JSC::createBuiltinExecutable(m_vm, m_##name##Source, functionName##PublicName(), s_##name##ConstructAbility), this, &m_##name##Executable);\\
+    return m_##name##Executable.get();\\
+}
+${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(DEFINE_BUILTIN_EXECUTABLES)
+#undef DEFINE_BUILTIN_EXECUTABLES
+
+inline void ${objectName}BuiltinsWrapper::exportNames()
+{
+#define EXPORT_FUNCTION_NAME(name) m_vm.propertyNames->appendExternalName(name##PublicName(), name##PrivateName());
+    ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_FUNCTION_NAME(EXPORT_FUNCTION_NAME)
+#undef EXPORT_FUNCTION_NAME
+}""")
+
+    SeparateHeaderInternalFunctionsBoilerplate = (
+    """class ${objectName}BuiltinFunctions {
+public:
+    explicit ${objectName}BuiltinFunctions(JSC::VM& vm) : m_vm(vm) { }
+
+    void init(JSC::JSGlobalObject&);
+    void visit(JSC::SlotVisitor&);
+
+public:
+    JSC::VM& m_vm;
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(functionName) \\
+    JSC::WriteBarrier<JSC::JSFunction> m_##functionName##Function;
+    ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+};
+
+inline void ${objectName}BuiltinFunctions::init(JSC::JSGlobalObject& globalObject)
+{
+#define EXPORT_FUNCTION(codeName, functionName, length)\\
+    m_##functionName##Function.set(m_vm, &globalObject, JSC::JSFunction::createBuiltinFunction(m_vm, codeName##Generator(m_vm), &globalObject));
+    ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_CODE(EXPORT_FUNCTION)
+#undef EXPORT_FUNCTION
+}
+
+inline void ${objectName}BuiltinFunctions::visit(JSC::SlotVisitor& visitor)
+{
+#define VISIT_FUNCTION(name) visitor.append(m_##name##Function);
+    ${macroPrefix}_FOREACH_${objectMacro}_BUILTIN_FUNCTION_NAME(VISIT_FUNCTION)
+#undef VISIT_FUNCTION
+}
+""")
diff --git a/Scripts/cssmin.py b/Scripts/cssmin.py
new file mode 100644
index 0000000..186327a
--- /dev/null
+++ b/Scripts/cssmin.py
@@ -0,0 +1,49 @@
+#!/usr/bin/python
+
+# Copyright (C) 2013 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+import re
+
+def cssminify(css):
+    rules = (
+        (r"\/\*.*?\*\/", ""),          # delete comments
+        (r"\n", ""),                   # delete new lines
+        (r"\s+", " "),                 # change multiple spaces to one space
+        (r"\s?([;{},~>!])\s?", r"\1"), # delete space where it is not needed
+        (r":\s", ":"),                 # delete spaces after colons, but not before. E.g. do not break selectors "a :focus", "b :matches(...)", "c :not(...)" where the leading space is significant
+        (r"\s?([-+])(?:\s(?![0-9(])(?!var))", r"\1"), # delete whitespace around + and - when not followed by a number, paren, or var(). E.g. strip for selector "a + b" but not "calc(a + b)" which requires spaces.
+        (r";}", "}")                   # change ';}' to '}' because the semicolon is not needed
+    )
+
+    css = css.replace("\r\n", "\n")
+    for rule in rules:
+        css = re.compile(rule[0], re.MULTILINE | re.UNICODE | re.DOTALL).sub(rule[1], css)
+    return css
+
+if __name__ == "__main__":
+    import sys
+    if sys.version_info[0] == 3 and sys.stdin.encoding != 'UTF-8':
+        import io
+        sys.stdin = io.TextIOWrapper(sys.stdin.buffer, encoding='UTF-8')
+    sys.stdout.write(cssminify(sys.stdin.read()))
diff --git a/Scripts/generate-combined-inspector-json.py b/Scripts/generate-combined-inspector-json.py
new file mode 100755
index 0000000..5366031
--- /dev/null
+++ b/Scripts/generate-combined-inspector-json.py
@@ -0,0 +1,69 @@
+#!/usr/bin/python
+
+# Copyright (C) 2013 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+import glob
+import json
+import os
+import sys
+
+if len(sys.argv) < 2:
+    print("usage: %s [json files or directory of json files ...]" % os.path.basename(sys.argv[0]))
+    sys.exit(1)
+
+files = []
+for arg in sys.argv[1:]:
+    if not os.access(arg, os.F_OK):
+        raise Exception("File \"%s\" not found" % arg)
+    elif os.path.isdir(arg):
+        files.extend(glob.glob(os.path.join(arg, "*.json")))
+    else:
+        files.append(arg)
+files.sort()
+
+# To keep as close to the original JSON formatting as possible, just
+# dump each JSON input file unmodified into an array of "domains".
+# Validate each file is valid JSON and that there is a "domain" key.
+
+first = True
+print("{\"domains\":[")
+for file in files:
+    if first:
+        first = False
+    else:
+        print(",")
+
+    string = open(file).read()
+
+    try:
+        dictionary = json.loads(string)
+        if not "domain" in dictionary:
+            raise Exception("File \"%s\" does not contains a \"domain\" key." % file)
+    except ValueError:
+        sys.stderr.write("File \"%s\" does not contain valid JSON:\n" % file)
+        raise
+
+    print(string.rstrip())
+print("]}")
+
diff --git a/Scripts/generate-js-builtins.py b/Scripts/generate-js-builtins.py
new file mode 100644
index 0000000..c3e498a
--- /dev/null
+++ b/Scripts/generate-js-builtins.py
@@ -0,0 +1,176 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2015 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# This script generates C++ bindings for JavaScript builtins.
+# Generators for individual files are located in the builtins/ directory.
+
+import fnmatch
+import logging
+import optparse
+import os
+
+logging.basicConfig(format='%(levelname)s: %(message)s', level=logging.ERROR)
+log = logging.getLogger('global')
+
+from lazywriter import LazyFileWriter
+
+from builtins import *
+
+
+def concatenated_output_filename(builtins_files, framework_name, generate_only_wrapper_files):
+    if generate_only_wrapper_files:
+        return framework_name + 'JSBuiltins.h-result'
+    return os.path.basename(builtins_files[0]) + '-result'
+
+
+def generate_bindings_for_builtins_files(builtins_files=[],
+                                         output_path=None,
+                                         concatenate_output=False,
+                                         combined_output=False,
+                                         generate_only_wrapper_files=False,
+                                         framework_name="",
+                                         force_output=False):
+
+    generators = []
+
+    model = BuiltinsCollection(framework_name=framework_name)
+
+    for filepath in builtins_files:
+        with open(filepath, "r") as file:
+            file_text = file.read()
+            file_name = os.path.basename(filepath)
+
+            # If this is a test file, then rewrite the filename to remove the
+            # test running options encoded into the filename.
+            if file_name.startswith(framework_name):
+                (_, object_name, _) = file_name.split('-')
+                file_name = object_name + '.js'
+            model.parse_builtins_file(file_name, file_text)
+
+    if combined_output:
+        log.debug("Using generator style: combined files for all builtins.")
+        generators.append(BuiltinsCombinedHeaderGenerator(model))
+        generators.append(BuiltinsCombinedImplementationGenerator(model))
+    else:
+        log.debug("Using generator style: single files for each builtin.")
+        if generate_only_wrapper_files:
+            generators.append(BuiltinsWrapperHeaderGenerator(model))
+            generators.append(BuiltinsWrapperImplementationGenerator(model))
+
+            generators.append(BuiltinsInternalsWrapperHeaderGenerator(model))
+            generators.append(BuiltinsInternalsWrapperImplementationGenerator(model))
+        else:
+            for object in model.objects:
+                generators.append(BuiltinsSeparateHeaderGenerator(model, object))
+                generators.append(BuiltinsSeparateImplementationGenerator(model, object))
+
+    log.debug("")
+    log.debug("Generating bindings for builtins.")
+
+    test_result_file_contents = []
+
+    for generator in generators:
+        output_filepath = os.path.join(output_path, generator.output_filename())
+        log.debug("Generating output file: %s" % generator.output_filename())
+        output = generator.generate_output()
+
+        log.debug("---")
+        log.debug("\n" + output)
+        log.debug("---")
+        if concatenate_output:
+            test_result_file_contents.append('### Begin File: %s' % generator.output_filename())
+            test_result_file_contents.append(output)
+            test_result_file_contents.append('### End File: %s' % generator.output_filename())
+            test_result_file_contents.append('')
+        else:
+            log.debug("Writing file: %s" % output_filepath)
+            output_file = LazyFileWriter(output_filepath, force_output)
+            output_file.write(output)
+            output_file.close()
+
+    if concatenate_output:
+        filename = concatenated_output_filename(builtins_files, framework_name, generate_only_wrapper_files)
+        output_filepath = os.path.join(output_path, filename)
+        log.debug("Writing file: %s" % output_filepath)
+        output_file = LazyFileWriter(output_filepath, force_output)
+        output_file.write('\n'.join(test_result_file_contents))
+        output_file.close()
+
+if __name__ == '__main__':
+    allowed_framework_names = ['JavaScriptCore', 'WebCore']
+    cli_parser = optparse.OptionParser(usage="usage: %prog [options] Builtin1.js [, Builtin2.js, ...]")
+    cli_parser.add_option("-i", "--input-directory", help="If specified, generates builtins from all JavaScript files in the specified directory in addition to specific files passed as arguments.")
+    cli_parser.add_option("-o", "--output-directory", help="Directory where generated files should be written.")
+    cli_parser.add_option("--framework", type="choice", choices=allowed_framework_names, help="Destination framework for generated files.")
+    cli_parser.add_option("--force", action="store_true", help="Force output of generated scripts, even if nothing changed.")
+    cli_parser.add_option("--combined", action="store_true", help="Produce one .h/.cpp file instead of producing one per builtin object.")
+    cli_parser.add_option("--wrappers-only", action="store_true", help="Produce .h/.cpp wrapper files to ease integration of the builtins.")
+    cli_parser.add_option("-v", "--debug", action="store_true", help="Log extra output for debugging the generator itself.")
+    cli_parser.add_option("-t", "--test", action="store_true", help="Enable test mode.")
+
+    arg_options, arg_values = cli_parser.parse_args()
+    if len(arg_values) is 0 and not arg_options.input_directory:
+        raise ParseException("At least one input file or directory expected.")
+
+    if not arg_options.output_directory:
+        raise ParseException("Missing output directory.")
+
+    if arg_options.debug:
+        log.setLevel(logging.DEBUG)
+
+    input_filepaths = arg_values[:]
+    if arg_options.input_directory:
+        for filepath in os.listdir(arg_options.input_directory):
+            input_filepaths.append(os.path.join(arg_options.input_directory, filepath))
+
+    input_filepaths = sorted(filter(lambda name: fnmatch.fnmatch(name, '*.js'), input_filepaths))
+
+    options = {
+        'output_path': arg_options.output_directory,
+        'framework_name': arg_options.framework,
+        'combined_output': arg_options.combined,
+        'generate_only_wrapper_files': arg_options.wrappers_only,
+        'force_output': arg_options.force,
+        'concatenate_output': arg_options.test,
+    }
+
+    log.debug("Generating code for builtins.")
+    log.debug("Parsed options:")
+    for option, value in options.items():
+        log.debug("    %s: %s" % (option, value))
+    log.debug("")
+    log.debug("Input files:")
+    for filepath in input_filepaths:
+        log.debug("    %s" % filepath)
+    log.debug("")
+
+    try:
+        generate_bindings_for_builtins_files(builtins_files=input_filepaths, **options)
+    except ParseException as e:
+        if arg_options.test:
+            log.error(e.message)
+        else:
+            raise  # Force the build to fail.
diff --git a/Scripts/inline-and-minify-stylesheets-and-scripts.py b/Scripts/inline-and-minify-stylesheets-and-scripts.py
new file mode 100755
index 0000000..89200c8
--- /dev/null
+++ b/Scripts/inline-and-minify-stylesheets-and-scripts.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2013 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# This script inlines and minifies external stylesheets and scripts.
+#  - <link href="..." rel="stylesheet"> => <style>...</style>
+#  - <script src="...">                 => <script>...</script>
+
+import cssmin
+import jsmin
+import os.path
+import re
+import sys
+
+
+def main(argv):
+
+    if len(argv) < 2:
+        print('usage: %s inputFile outputFile' % argv[0])
+        return 1
+
+    inputFileName = argv[1]
+    outputFileName = argv[2]
+    importsDir = os.path.dirname(inputFileName)
+
+    inputFile = open(inputFileName, 'r')
+    inputContent = inputFile.read()
+    inputFile.close()
+
+    def inline(match, minifier, prefix, postfix):
+        importFileName = match.group(1)
+        fullPath = os.path.join(importsDir, importFileName)
+        if not os.access(fullPath, os.F_OK):
+            raise Exception('File %s referenced in %s not found' % (importFileName, inputFileName))
+        importFile = open(fullPath, 'r')
+        importContent = minifier(importFile.read())
+        importFile.close()
+        return '%s%s%s' % (prefix, importContent, postfix)
+
+    def inlineStylesheet(match):
+        return inline(match, cssmin.cssminify, "<style>", "</style>")
+
+    def inlineScript(match):
+        return inline(match, jsmin.jsmin, "<script>", "</script>")
+
+    outputContent = re.sub(r'<link rel="stylesheet" href=[\'"]([^\'"]+)[\'"]>', inlineStylesheet, inputContent)
+    outputContent = re.sub(r'<script src=[\'"]([^\'"]+)[\'"]></script>', inlineScript, outputContent)
+
+    outputFile = open(outputFileName, 'w')
+    outputFile.write(outputContent)
+    outputFile.close()
+
+    # Touch output file directory to make sure that Xcode will copy
+    # modified resource files.
+    if sys.platform == 'darwin':
+        outputDirName = os.path.dirname(outputFileName)
+        os.utime(outputDirName, None)
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv))
diff --git a/Scripts/jsmin.py b/Scripts/jsmin.py
new file mode 100644
index 0000000..372418b
--- /dev/null
+++ b/Scripts/jsmin.py
@@ -0,0 +1,238 @@
+# This code is original from jsmin by Douglas Crockford, it was translated to
+# Python by Baruch Even. It was rewritten by Dave St.Germain for speed.
+#
+# The MIT License (MIT)
+#
+# Copyright (c) 2013 Dave St.Germain
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+
+import sys
+is_3 = sys.version_info >= (3, 0)
+if is_3:
+    import io
+else:
+    import StringIO
+    try:
+        import cStringIO
+    except ImportError:
+        cStringIO = None
+
+
+__all__ = ['jsmin', 'JavascriptMinify']
+__version__ = '2.0.9'
+
+
+def jsmin(js):
+    """
+    returns a minified version of the javascript string
+    """
+    if not is_3:
+        if cStringIO and not isinstance(js, unicode):
+            # strings can use cStringIO for a 3x performance
+            # improvement, but unicode (in python2) cannot
+            klass = cStringIO.StringIO
+        else:
+            klass = StringIO.StringIO
+    else:
+        klass = io.StringIO
+    ins = klass(js)
+    outs = klass()
+    JavascriptMinify(ins, outs).minify()
+    return outs.getvalue()
+
+
+class JavascriptMinify(object):
+    """
+    Minify an input stream of javascript, writing
+    to an output stream
+    """
+
+    def __init__(self, instream=None, outstream=None):
+        self.ins = instream
+        self.outs = outstream
+
+    def minify(self, instream=None, outstream=None):
+        if instream and outstream:
+            self.ins, self.outs = instream, outstream
+
+        self.is_return = False
+        self.return_buf = ''
+
+        def write(char):
+            # all of this is to support literal regular expressions.
+            # sigh
+            if char in 'return':
+                self.return_buf += char
+                self.is_return = self.return_buf == 'return'
+            self.outs.write(char)
+            if self.is_return:
+                self.return_buf = ''
+
+        read = self.ins.read
+
+        space_strings = "abcdefghijklmnopqrstuvwxyz"\
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$\\"
+        starters, enders = '{[(+-', '}])+-"\''
+        newlinestart_strings = starters + space_strings
+        newlineend_strings = enders + space_strings
+        do_newline = False
+        do_space = False
+        escape_slash_count = 0
+        doing_single_comment = False
+        previous_before_comment = ''
+        doing_multi_comment = False
+        in_re = False
+        in_quote = ''
+        quote_buf = []
+
+        previous = read(1)
+        if previous == '\\':
+            escape_slash_count += 1
+        next1 = read(1)
+        if previous == '/':
+            if next1 == '/':
+                doing_single_comment = True
+            elif next1 == '*':
+                doing_multi_comment = True
+                previous = next1
+                next1 = read(1)
+            else:
+                write(previous)
+        elif not previous:
+            return
+        elif previous >= '!':
+            if previous in "'\"":
+                in_quote = previous
+            write(previous)
+            previous_non_space = previous
+        else:
+            previous_non_space = ' '
+        if not next1:
+            return
+
+        while 1:
+            next2 = read(1)
+            if not next2:
+                last = next1.strip()
+                if not (doing_single_comment or doing_multi_comment)\
+                    and last not in ('', '/'):
+                    if in_quote:
+                        write(''.join(quote_buf))
+                    write(last)
+                break
+            if doing_multi_comment:
+                if next1 == '*' and next2 == '/':
+                    doing_multi_comment = False
+                    next2 = read(1)
+            elif doing_single_comment:
+                if next1 in '\r\n':
+                    doing_single_comment = False
+                    while next2 in '\r\n':
+                        next2 = read(1)
+                        if not next2:
+                            break
+                    if previous_before_comment in ')}]':
+                        do_newline = True
+                    elif previous_before_comment in space_strings:
+                        write('\n')
+            elif in_quote:
+                quote_buf.append(next1)
+
+                if next1 == in_quote:
+                    numslashes = 0
+                    for c in reversed(quote_buf[:-1]):
+                        if c != '\\':
+                            break
+                        else:
+                            numslashes += 1
+                    if numslashes % 2 == 0:
+                        in_quote = ''
+                        write(''.join(quote_buf))
+            elif next1 in '\r\n':
+                if previous_non_space in newlineend_strings \
+                    or previous_non_space > '~':
+                    while 1:
+                        if next2 < '!':
+                            next2 = read(1)
+                            if not next2:
+                                break
+                        else:
+                            if next2 in newlinestart_strings \
+                                or next2 > '~' or next2 == '/':
+                                do_newline = True
+                            break
+            elif next1 < '!' and not in_re:
+                if (previous_non_space in space_strings \
+                    or previous_non_space > '~') \
+                    and (next2 in space_strings or next2 > '~'):
+                    do_space = True
+                elif previous_non_space in '-+' and next2 == previous_non_space:
+                    # protect against + ++ or - -- sequences
+                    do_space = True
+                elif self.is_return and next2 == '/':
+                    # returning a regex...
+                    write(' ')
+            elif next1 == '/':
+                if do_space:
+                    write(' ')
+                if in_re:
+                    if previous != '\\' or (not escape_slash_count % 2) or next2 in 'gimy':
+                        in_re = False
+                    write('/')
+                elif next2 == '/':
+                    doing_single_comment = True
+                    previous_before_comment = previous_non_space
+                elif next2 == '*':
+                    doing_multi_comment = True
+                    previous = next1
+                    next1 = next2
+                    next2 = read(1)
+                else:
+                    in_re = previous_non_space in '(,=:[?!&|' or self.is_return  # literal regular expression
+                    write('/')
+            else:
+                if do_space:
+                    do_space = False
+                    write(' ')
+                if do_newline:
+                    write('\n')
+                    do_newline = False
+
+                write(next1)
+                if not in_re and next1 in "'\"`":
+                    in_quote = next1
+                    quote_buf = []
+
+            previous = next1
+            next1 = next2
+
+            if previous >= '!':
+                previous_non_space = previous
+
+            if previous == '\\':
+                escape_slash_count += 1
+            else:
+                escape_slash_count = 0
+
+if __name__ == '__main__':
+    minifier = JavascriptMinify(sys.stdin, sys.stdout)
+    minifier.minify()
+    sys.stdout.write('\n')
diff --git a/Scripts/lazywriter.py b/Scripts/lazywriter.py
new file mode 100644
index 0000000..f93a2c6
--- /dev/null
+++ b/Scripts/lazywriter.py
@@ -0,0 +1,58 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2015 Apple Inc. All rights reserved.
+# Copyright (c) 2009 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# A writer that only updates file if it actually changed.
+
+
+class LazyFileWriter:
+    def __init__(self, filepath, force_output):
+        self._filepath = filepath
+        self._output = ""
+        self.force_output = force_output
+
+    def write(self, text):
+        self._output += text
+
+    def close(self):
+        text_changed = True
+        self._output = self._output.rstrip() + "\n"
+
+        try:
+            if self.force_output:
+                raise
+
+            read_file = open(self._filepath, "r")
+            old_text = read_file.read()
+            read_file.close()
+            text_changed = old_text != self._output
+        except:
+            # Ignore, just overwrite by default
+            pass
+
+        if text_changed or self.force_output:
+            out_file = open(self._filepath, "w")
+            out_file.write(self._output)
+            out_file.close()
diff --git a/Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Combined.js b/Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Combined.js
new file mode 100644
index 0000000..b45d81c
--- /dev/null
+++ b/Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Combined.js
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function rejectPromise(promise, reason)
+{
+    "use strict";
+
+    var reactions = promise.@promiseRejectReactions;
+    promise.@promiseResult = reason;
+    promise.@promiseFulfillReactions = undefined;
+    promise.@promiseRejectReactions = undefined;
+    promise.@promiseState = @promiseRejected;
+
+    @InspectorInstrumentation.promiseRejected(promise, reason, reactions);
+
+    @triggerPromiseReactions(reactions, reason);
+}
+
+function fulfillPromise(promise, value)
+{
+    "use strict";
+
+    var reactions = promise.@promiseFulfillReactions;
+    promise.@promiseResult = value;
+    promise.@promiseFulfillReactions = undefined;
+    promise.@promiseRejectReactions = undefined;
+    promise.@promiseState = @promiseFulfilled;
+
+    @InspectorInstrumentation.promiseFulfilled(promise, value, reactions);
+
+    @triggerPromiseReactions(reactions, value);
+}
diff --git a/Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Separate.js b/Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Separate.js
new file mode 100644
index 0000000..b45d81c
--- /dev/null
+++ b/Scripts/tests/builtins/JavaScriptCore-Builtin.Promise-Separate.js
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function rejectPromise(promise, reason)
+{
+    "use strict";
+
+    var reactions = promise.@promiseRejectReactions;
+    promise.@promiseResult = reason;
+    promise.@promiseFulfillReactions = undefined;
+    promise.@promiseRejectReactions = undefined;
+    promise.@promiseState = @promiseRejected;
+
+    @InspectorInstrumentation.promiseRejected(promise, reason, reactions);
+
+    @triggerPromiseReactions(reactions, reason);
+}
+
+function fulfillPromise(promise, value)
+{
+    "use strict";
+
+    var reactions = promise.@promiseFulfillReactions;
+    promise.@promiseResult = value;
+    promise.@promiseFulfillReactions = undefined;
+    promise.@promiseRejectReactions = undefined;
+    promise.@promiseState = @promiseFulfilled;
+
+    @InspectorInstrumentation.promiseFulfilled(promise, value, reactions);
+
+    @triggerPromiseReactions(reactions, value);
+}
diff --git a/Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Combined.js b/Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Combined.js
new file mode 100644
index 0000000..5448b98
--- /dev/null
+++ b/Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Combined.js
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+function every(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this === null)
+        throw new @TypeError("Array.prototype.every requires that |this| not be null");
+    
+    if (this === undefined)
+        throw new @TypeError("Array.prototype.every requires that |this| not be undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        throw new @TypeError("Array.prototype.every callback must be a function");
+    
+    var thisArg = arguments.length > 1 ? arguments[1] : undefined;
+    
+    for (var i = 0; i < length; i++) {
+        if (!(i in array))
+            continue;
+        if (!callback.@call(thisArg, array[i], i, array))
+            return false;
+    }
+    
+    return true;
+}
+
+function forEach(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this === null)
+        throw new @TypeError("Array.prototype.forEach requires that |this| not be null");
+    
+    if (this === undefined)
+        throw new @TypeError("Array.prototype.forEach requires that |this| not be undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        throw new @TypeError("Array.prototype.forEach callback must be a function");
+    
+    var thisArg = arguments.length > 1 ? arguments[1] : undefined;
+    
+    for (var i = 0; i < length; i++) {
+        if (i in array)
+            callback.@call(thisArg, array[i], i, array);
+    }
+}
diff --git a/Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Separate.js b/Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Separate.js
new file mode 100644
index 0000000..5448b98
--- /dev/null
+++ b/Scripts/tests/builtins/JavaScriptCore-Builtin.prototype-Separate.js
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+function every(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this === null)
+        throw new @TypeError("Array.prototype.every requires that |this| not be null");
+    
+    if (this === undefined)
+        throw new @TypeError("Array.prototype.every requires that |this| not be undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        throw new @TypeError("Array.prototype.every callback must be a function");
+    
+    var thisArg = arguments.length > 1 ? arguments[1] : undefined;
+    
+    for (var i = 0; i < length; i++) {
+        if (!(i in array))
+            continue;
+        if (!callback.@call(thisArg, array[i], i, array))
+            return false;
+    }
+    
+    return true;
+}
+
+function forEach(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this === null)
+        throw new @TypeError("Array.prototype.forEach requires that |this| not be null");
+    
+    if (this === undefined)
+        throw new @TypeError("Array.prototype.forEach requires that |this| not be undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        throw new @TypeError("Array.prototype.forEach callback must be a function");
+    
+    var thisArg = arguments.length > 1 ? arguments[1] : undefined;
+    
+    for (var i = 0; i < length; i++) {
+        if (i in array)
+            callback.@call(thisArg, array[i], i, array);
+    }
+}
diff --git a/Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Combined.js b/Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Combined.js
new file mode 100644
index 0000000..9e8c1b4
--- /dev/null
+++ b/Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Combined.js
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function of(/* items... */)
+{
+    "use strict";
+
+    var length = arguments.length;
+    // TODO: Need isConstructor(this) instead of typeof "function" check.
+    var array = typeof this === 'function' ? new this(length) : new @Array(length);
+    for (var k = 0; k < length; ++k)
+        @putByValDirect(array, k, arguments[k]);
+    array.length = length;
+    return array;
+}
+
+function from(items /*, mapFn, thisArg */)
+{
+    "use strict";
+
+    var thisObj = this;
+
+    var mapFn = arguments.length > 1 ? arguments[1] : undefined;
+
+    var thisArg;
+
+    if (mapFn !== undefined) {
+        if (typeof mapFn !== "function")
+            throw new @TypeError("Array.from requires that the second argument, when provided, be a function");
+
+        if (arguments.length > 2)
+            thisArg = arguments[2];
+    }
+
+    if (items == null)
+        throw new @TypeError("Array.from requires an array-like object - not null or undefined");
+
+    var iteratorMethod = items[@symbolIterator];
+    if (iteratorMethod != null) {
+        if (typeof iteratorMethod !== "function")
+            throw new @TypeError("Array.from requires that the property of the first argument, items[Symbol.iterator], when exists, be a function");
+
+        // TODO: Need isConstructor(thisObj) instead of typeof "function" check.
+        var result = (typeof thisObj === "function") ? @Object(new thisObj()) : [];
+
+        var k = 0;
+        var iterator = iteratorMethod.@call(items);
+
+        // Since for-of loop once more looks up the @@iterator property of a given iterable,
+        // it could be observable if the user defines a getter for @@iterator.
+        // To avoid this situation, we define a wrapper object that @@iterator just returns a given iterator.
+        var wrapper = {
+            [@symbolIterator]() {
+                return iterator;
+            }
+        };
+
+        for (var value of wrapper) {
+            if (mapFn)
+                @putByValDirect(result, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));
+            else
+                @putByValDirect(result, k, value);
+            k += 1;
+        }
+
+        result.length = k;
+        return result;
+    }
+
+    var arrayLike = @Object(items);
+    var arrayLikeLength = @toLength(arrayLike.length);
+
+    // TODO: Need isConstructor(thisObj) instead of typeof "function" check.
+    var result = (typeof thisObj === "function") ? @Object(new thisObj(arrayLikeLength)) : new @Array(arrayLikeLength);
+
+    var k = 0;
+    while (k < arrayLikeLength) {
+        var value = arrayLike[k];
+        if (mapFn)
+            @putByValDirect(result, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));
+        else
+            @putByValDirect(result, k, value);
+        k += 1;
+    }
+
+    result.length = arrayLikeLength;
+    return result;
+}
diff --git a/Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Separate.js b/Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Separate.js
new file mode 100644
index 0000000..9e8c1b4
--- /dev/null
+++ b/Scripts/tests/builtins/JavaScriptCore-BuiltinConstructor-Separate.js
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function of(/* items... */)
+{
+    "use strict";
+
+    var length = arguments.length;
+    // TODO: Need isConstructor(this) instead of typeof "function" check.
+    var array = typeof this === 'function' ? new this(length) : new @Array(length);
+    for (var k = 0; k < length; ++k)
+        @putByValDirect(array, k, arguments[k]);
+    array.length = length;
+    return array;
+}
+
+function from(items /*, mapFn, thisArg */)
+{
+    "use strict";
+
+    var thisObj = this;
+
+    var mapFn = arguments.length > 1 ? arguments[1] : undefined;
+
+    var thisArg;
+
+    if (mapFn !== undefined) {
+        if (typeof mapFn !== "function")
+            throw new @TypeError("Array.from requires that the second argument, when provided, be a function");
+
+        if (arguments.length > 2)
+            thisArg = arguments[2];
+    }
+
+    if (items == null)
+        throw new @TypeError("Array.from requires an array-like object - not null or undefined");
+
+    var iteratorMethod = items[@symbolIterator];
+    if (iteratorMethod != null) {
+        if (typeof iteratorMethod !== "function")
+            throw new @TypeError("Array.from requires that the property of the first argument, items[Symbol.iterator], when exists, be a function");
+
+        // TODO: Need isConstructor(thisObj) instead of typeof "function" check.
+        var result = (typeof thisObj === "function") ? @Object(new thisObj()) : [];
+
+        var k = 0;
+        var iterator = iteratorMethod.@call(items);
+
+        // Since for-of loop once more looks up the @@iterator property of a given iterable,
+        // it could be observable if the user defines a getter for @@iterator.
+        // To avoid this situation, we define a wrapper object that @@iterator just returns a given iterator.
+        var wrapper = {
+            [@symbolIterator]() {
+                return iterator;
+            }
+        };
+
+        for (var value of wrapper) {
+            if (mapFn)
+                @putByValDirect(result, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));
+            else
+                @putByValDirect(result, k, value);
+            k += 1;
+        }
+
+        result.length = k;
+        return result;
+    }
+
+    var arrayLike = @Object(items);
+    var arrayLikeLength = @toLength(arrayLike.length);
+
+    // TODO: Need isConstructor(thisObj) instead of typeof "function" check.
+    var result = (typeof thisObj === "function") ? @Object(new thisObj(arrayLikeLength)) : new @Array(arrayLikeLength);
+
+    var k = 0;
+    while (k < arrayLikeLength) {
+        var value = arrayLike[k];
+        if (mapFn)
+            @putByValDirect(result, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));
+        else
+            @putByValDirect(result, k, value);
+        k += 1;
+    }
+
+    result.length = arrayLikeLength;
+    return result;
+}
diff --git a/Scripts/tests/builtins/JavaScriptCore-InternalClashingNames-Combined.js b/Scripts/tests/builtins/JavaScriptCore-InternalClashingNames-Combined.js
new file mode 100644
index 0000000..0a436cf
--- /dev/null
+++ b/Scripts/tests/builtins/JavaScriptCore-InternalClashingNames-Combined.js
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY CANON INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL CANON INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @internal
+
+function isReadableStreamLocked(stream)
+{
+   "use strict";
+
+    return !!stream.@reader;
+}
+
+// Testing clashing names (emulating function with same names in different files)
+function isReadableStreamLocked(stream)
+{
+   "use strict";
+
+    return !!stream.@reader;
+}
diff --git a/Scripts/tests/builtins/WebCore-AnotherGuardedInternalBuiltin-Separate.js b/Scripts/tests/builtins/WebCore-AnotherGuardedInternalBuiltin-Separate.js
new file mode 100644
index 0000000..c5fae3f
--- /dev/null
+++ b/Scripts/tests/builtins/WebCore-AnotherGuardedInternalBuiltin-Separate.js
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @conditional=ENABLE(FETCH_API)
+// @internal
+
+function letsFetch()
+{
+   "use strict";
+
+    return @fetchRequest(new @Request("yes"));
+}
diff --git a/Scripts/tests/builtins/WebCore-ArbitraryConditionalGuard-Separate.js b/Scripts/tests/builtins/WebCore-ArbitraryConditionalGuard-Separate.js
new file mode 100644
index 0000000..c808b3c
--- /dev/null
+++ b/Scripts/tests/builtins/WebCore-ArbitraryConditionalGuard-Separate.js
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @conditional=ENABLE(STREAMS_API) || USE(CF)
+
+function isReadableStreamLocked(stream)
+{
+   "use strict";
+
+    return !!stream.@reader;
+}
diff --git a/Scripts/tests/builtins/WebCore-DuplicateFlagAnnotation-Separate.js b/Scripts/tests/builtins/WebCore-DuplicateFlagAnnotation-Separate.js
new file mode 100644
index 0000000..73e7c71
--- /dev/null
+++ b/Scripts/tests/builtins/WebCore-DuplicateFlagAnnotation-Separate.js
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @internal
+// @internal
diff --git a/Scripts/tests/builtins/WebCore-DuplicateKeyValueAnnotation-Separate.js b/Scripts/tests/builtins/WebCore-DuplicateKeyValueAnnotation-Separate.js
new file mode 100644
index 0000000..6d6fe60
--- /dev/null
+++ b/Scripts/tests/builtins/WebCore-DuplicateKeyValueAnnotation-Separate.js
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @conditional=ENABLE(STREAMS_API)
+// @conditional=USE(CF)
+
+function isReadableStreamLocked(stream)
+{
+   "use strict";
+
+    return !!stream.@reader;
+}
diff --git a/Scripts/tests/builtins/WebCore-GuardedBuiltin-Separate.js b/Scripts/tests/builtins/WebCore-GuardedBuiltin-Separate.js
new file mode 100644
index 0000000..2acec58
--- /dev/null
+++ b/Scripts/tests/builtins/WebCore-GuardedBuiltin-Separate.js
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @conditional=ENABLE(STREAMS_API)
+
+function isReadableStreamLocked(stream)
+{
+   "use strict";
+
+    return !!stream.@reader;
+}
diff --git a/Scripts/tests/builtins/WebCore-GuardedInternalBuiltin-Separate.js b/Scripts/tests/builtins/WebCore-GuardedInternalBuiltin-Separate.js
new file mode 100644
index 0000000..e95e0c2
--- /dev/null
+++ b/Scripts/tests/builtins/WebCore-GuardedInternalBuiltin-Separate.js
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @conditional=ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+// @internal
+
+function isReadableStreamLocked(stream)
+{
+   "use strict";
+
+    return !!stream.@reader;
+}
diff --git a/Scripts/tests/builtins/WebCore-UnguardedBuiltin-Separate.js b/Scripts/tests/builtins/WebCore-UnguardedBuiltin-Separate.js
new file mode 100644
index 0000000..9647f2b
--- /dev/null
+++ b/Scripts/tests/builtins/WebCore-UnguardedBuiltin-Separate.js
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function isReadableStreamLocked(stream)
+{
+   "use strict";
+
+    return !!stream.@reader;
+}
diff --git a/Scripts/tests/builtins/WebCore-xmlCasingTest-Separate.js b/Scripts/tests/builtins/WebCore-xmlCasingTest-Separate.js
new file mode 100644
index 0000000..550c89e
--- /dev/null
+++ b/Scripts/tests/builtins/WebCore-xmlCasingTest-Separate.js
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @conditional=ENABLE(STREAMS_API)
+// @internal
+
+function xmlCasingTest(stream)
+{
+   "use strict";
+
+    return !!stream.@reader;
+}
+
+
+function cssCasingTest(stream, reason)
+{
+    "use strict";
+
+    if (stream.@state === @readableStreamClosed)
+        return Promise.resolve();
+    if (stream.@state === @readableStreamErrored)
+        return Promise.reject(stream.@storedError);
+    stream.@queue = [];
+    @finishClosingReadableStream(stream);
+    return @promiseInvokeOrNoop(stream.@underlyingSource, "cancel", [reason]).then(function() { });
+}
+
+
+function urlCasingTest(object, key, args)
+{
+    "use strict";
+
+    try {
+        var method = object[key];
+        if (typeof method === "undefined")
+            return Promise.resolve();
+        var result = method.@apply(object, args);
+        return Promise.resolve(result);
+    }
+    catch(error) {
+        return Promise.reject(error);
+    }
+}
diff --git a/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result b/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result
new file mode 100644
index 0000000..9bb21d6
--- /dev/null
+++ b/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result
@@ -0,0 +1,161 @@
+### Begin File: JSCBuiltins.h
+/*
+ * Copyright (c) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+namespace JSC {
+class FunctionExecutable;
+class VM;
+
+enum class ConstructAbility : unsigned;
+}
+
+namespace JSC {
+
+/* Builtin.Promise */
+extern const char* s_builtinPromiseRejectPromiseCode;
+extern const int s_builtinPromiseRejectPromiseCodeLength;
+extern const JSC::ConstructAbility s_builtinPromiseRejectPromiseCodeConstructAbility;
+extern const char* s_builtinPromiseFulfillPromiseCode;
+extern const int s_builtinPromiseFulfillPromiseCodeLength;
+extern const JSC::ConstructAbility s_builtinPromiseFulfillPromiseCodeConstructAbility;
+
+#define JSC_FOREACH_BUILTINPROMISE_BUILTIN_DATA(macro) \
+    macro(rejectPromise, builtinPromiseRejectPromise, 2) \
+    macro(fulfillPromise, builtinPromiseFulfillPromise, 2) \
+
+#define JSC_FOREACH_BUILTIN_CODE(macro) \
+    macro(builtinPromiseRejectPromiseCode, rejectPromise, s_builtinPromiseRejectPromiseCodeLength) \
+    macro(builtinPromiseFulfillPromiseCode, fulfillPromise, s_builtinPromiseFulfillPromiseCodeLength) \
+
+#define JSC_FOREACH_BUILTIN_FUNCTION_NAME(macro) \
+    macro(fulfillPromise) \
+    macro(rejectPromise) \
+
+#define JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(macro) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+JSC_FOREACH_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+} // namespace JSC
+### End File: JSCBuiltins.h
+
+### Begin File: JSCBuiltins.cpp
+/*
+ * Copyright (c) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "JSCBuiltins.h"
+
+#include "BuiltinExecutables.h"
+#include "HeapInlines.h"
+#include "Intrinsic.h"
+#include "JSCellInlines.h"
+#include "UnlinkedFunctionExecutable.h"
+#include "VM.h"
+
+namespace JSC {
+
+const JSC::ConstructAbility s_builtinPromiseRejectPromiseCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinPromiseRejectPromiseCodeLength = 410;
+static const JSC::Intrinsic s_builtinPromiseRejectPromiseCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinPromiseRejectPromiseCode =
+    "(function (promise, reason)\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    var reactions = promise.@promiseRejectReactions;\n" \
+    "    promise.@promiseResult = reason;\n" \
+    "    promise.@promiseFulfillReactions = undefined;\n" \
+    "    promise.@promiseRejectReactions = undefined;\n" \
+    "    promise.@promiseState = @promiseRejected;\n" \
+    "    @InspectorInstrumentation.promiseRejected(promise, reason, reactions);\n" \
+    "    @triggerPromiseReactions(reactions, reason);\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_builtinPromiseFulfillPromiseCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinPromiseFulfillPromiseCodeLength = 409;
+static const JSC::Intrinsic s_builtinPromiseFulfillPromiseCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinPromiseFulfillPromiseCode =
+    "(function (promise, value)\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    var reactions = promise.@promiseFulfillReactions;\n" \
+    "    promise.@promiseResult = value;\n" \
+    "    promise.@promiseFulfillReactions = undefined;\n" \
+    "    promise.@promiseRejectReactions = undefined;\n" \
+    "    promise.@promiseState = @promiseFulfilled;\n" \
+    "    @InspectorInstrumentation.promiseFulfilled(promise, value, reactions);\n" \
+    "    @triggerPromiseReactions(reactions, value);\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); }
+JSC_FOREACH_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace JSC
+### End File: JSCBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result b/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result
new file mode 100644
index 0000000..87fdaee
--- /dev/null
+++ b/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result
@@ -0,0 +1,160 @@
+### Begin File: BuiltinPromiseBuiltins.h
+/*
+ * Copyright (c) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace JSC {
+
+/* Builtin.Promise */
+extern const char* s_builtinPromiseRejectPromiseCode;
+extern const int s_builtinPromiseRejectPromiseCodeLength;
+extern const JSC::ConstructAbility s_builtinPromiseRejectPromiseCodeConstructAbility;
+extern const char* s_builtinPromiseFulfillPromiseCode;
+extern const int s_builtinPromiseFulfillPromiseCodeLength;
+extern const JSC::ConstructAbility s_builtinPromiseFulfillPromiseCodeConstructAbility;
+
+#define JSC_FOREACH_BUILTIN_PROMISE_BUILTIN_DATA(macro) \
+    macro(rejectPromise, builtinPromiseRejectPromise, 2) \
+    macro(fulfillPromise, builtinPromiseFulfillPromise, 2) \
+
+#define JSC_BUILTIN_BUILTIN_PROMISE_REJECTPROMISE 1
+#define JSC_BUILTIN_BUILTIN_PROMISE_FULFILLPROMISE 1
+
+#define JSC_FOREACH_BUILTIN.PROMISE_BUILTIN_CODE(macro) \
+    macro(builtinPromiseRejectPromiseCode, rejectPromise, s_builtinPromiseRejectPromiseCodeLength) \
+    macro(builtinPromiseFulfillPromiseCode, fulfillPromise, s_builtinPromiseFulfillPromiseCodeLength) \
+
+#define JSC_FOREACH_BUILTIN.PROMISE_BUILTIN_FUNCTION_NAME(macro) \
+    macro(fulfillPromise) \
+    macro(rejectPromise) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+JSC_FOREACH_BUILTIN.PROMISE_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+} // namespace JSC
+### End File: BuiltinPromiseBuiltins.h
+
+### Begin File: BuiltinPromiseBuiltins.cpp
+/*
+ * Copyright (c) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "BuiltinPromiseBuiltins.h"
+
+#include "BuiltinExecutables.h"
+#include "HeapInlines.h"
+#include "Intrinsic.h"
+#include "JSCellInlines.h"
+#include "VM.h"
+
+namespace JSC {
+
+const JSC::ConstructAbility s_builtinPromiseRejectPromiseCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinPromiseRejectPromiseCodeLength = 410;
+static const JSC::Intrinsic s_builtinPromiseRejectPromiseCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinPromiseRejectPromiseCode =
+    "(function (promise, reason)\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    var reactions = promise.@promiseRejectReactions;\n" \
+    "    promise.@promiseResult = reason;\n" \
+    "    promise.@promiseFulfillReactions = undefined;\n" \
+    "    promise.@promiseRejectReactions = undefined;\n" \
+    "    promise.@promiseState = @promiseRejected;\n" \
+    "    @InspectorInstrumentation.promiseRejected(promise, reason, reactions);\n" \
+    "    @triggerPromiseReactions(reactions, reason);\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_builtinPromiseFulfillPromiseCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinPromiseFulfillPromiseCodeLength = 409;
+static const JSC::Intrinsic s_builtinPromiseFulfillPromiseCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinPromiseFulfillPromiseCode =
+    "(function (promise, value)\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    var reactions = promise.@promiseFulfillReactions;\n" \
+    "    promise.@promiseResult = value;\n" \
+    "    promise.@promiseFulfillReactions = undefined;\n" \
+    "    promise.@promiseRejectReactions = undefined;\n" \
+    "    promise.@promiseState = @promiseFulfilled;\n" \
+    "    @InspectorInstrumentation.promiseFulfilled(promise, value, reactions);\n" \
+    "    @triggerPromiseReactions(reactions, value);\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); }
+JSC_FOREACH_BUILTIN.PROMISE_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace JSC
+### End File: BuiltinPromiseBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result b/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result
new file mode 100644
index 0000000..6bf696f
--- /dev/null
+++ b/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result
@@ -0,0 +1,185 @@
+### Begin File: JSCBuiltins.h
+/*
+ * Copyright (c) 2014, 2015, 2016 Apple Inc. All rights reserved.
+ * Copyright (c) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+namespace JSC {
+class FunctionExecutable;
+class VM;
+
+enum class ConstructAbility : unsigned;
+}
+
+namespace JSC {
+
+/* Builtin.prototype */
+extern const char* s_builtinPrototypeEveryCode;
+extern const int s_builtinPrototypeEveryCodeLength;
+extern const JSC::ConstructAbility s_builtinPrototypeEveryCodeConstructAbility;
+extern const char* s_builtinPrototypeForEachCode;
+extern const int s_builtinPrototypeForEachCodeLength;
+extern const JSC::ConstructAbility s_builtinPrototypeForEachCodeConstructAbility;
+
+#define JSC_FOREACH_BUILTINPROTOTYPE_BUILTIN_DATA(macro) \
+    macro(every, builtinPrototypeEvery, 1) \
+    macro(forEach, builtinPrototypeForEach, 1) \
+
+#define JSC_FOREACH_BUILTIN_CODE(macro) \
+    macro(builtinPrototypeEveryCode, every, s_builtinPrototypeEveryCodeLength) \
+    macro(builtinPrototypeForEachCode, forEach, s_builtinPrototypeForEachCodeLength) \
+
+#define JSC_FOREACH_BUILTIN_FUNCTION_NAME(macro) \
+    macro(every) \
+    macro(forEach) \
+
+#define JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(macro) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+JSC_FOREACH_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+} // namespace JSC
+### End File: JSCBuiltins.h
+
+### Begin File: JSCBuiltins.cpp
+/*
+ * Copyright (c) 2014, 2015, 2016 Apple Inc. All rights reserved.
+ * Copyright (c) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "JSCBuiltins.h"
+
+#include "BuiltinExecutables.h"
+#include "HeapInlines.h"
+#include "Intrinsic.h"
+#include "JSCellInlines.h"
+#include "UnlinkedFunctionExecutable.h"
+#include "VM.h"
+
+namespace JSC {
+
+const JSC::ConstructAbility s_builtinPrototypeEveryCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinPrototypeEveryCodeLength = 760;
+static const JSC::Intrinsic s_builtinPrototypeEveryCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinPrototypeEveryCode =
+    "(function (callback )\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    if (this === null)\n" \
+    "        throw new @TypeError(\"Array.prototype.every requires that |this| not be null\");\n" \
+    "    \n" \
+    "    if (this === undefined)\n" \
+    "        throw new @TypeError(\"Array.prototype.every requires that |this| not be undefined\");\n" \
+    "    \n" \
+    "    var array = @Object(this);\n" \
+    "    var length = @toLength(array.length);\n" \
+    "    if (typeof callback !== \"function\")\n" \
+    "        throw new @TypeError(\"Array.prototype.every callback must be a function\");\n" \
+    "    \n" \
+    "    var thisArg = arguments.length > 1 ? arguments[1] : undefined;\n" \
+    "    \n" \
+    "    for (var i = 0; i < length; i++) {\n" \
+    "        if (!(i in array))\n" \
+    "            continue;\n" \
+    "        if (!callback.@call(thisArg, array[i], i, array))\n" \
+    "            return false;\n" \
+    "    }\n" \
+    "    \n" \
+    "    return true;\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_builtinPrototypeForEachCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinPrototypeForEachCodeLength = 692;
+static const JSC::Intrinsic s_builtinPrototypeForEachCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinPrototypeForEachCode =
+    "(function (callback )\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    if (this === null)\n" \
+    "        throw new @TypeError(\"Array.prototype.forEach requires that |this| not be null\");\n" \
+    "    \n" \
+    "    if (this === undefined)\n" \
+    "        throw new @TypeError(\"Array.prototype.forEach requires that |this| not be undefined\");\n" \
+    "    \n" \
+    "    var array = @Object(this);\n" \
+    "    var length = @toLength(array.length);\n" \
+    "    if (typeof callback !== \"function\")\n" \
+    "        throw new @TypeError(\"Array.prototype.forEach callback must be a function\");\n" \
+    "    \n" \
+    "    var thisArg = arguments.length > 1 ? arguments[1] : undefined;\n" \
+    "    \n" \
+    "    for (var i = 0; i < length; i++) {\n" \
+    "        if (i in array)\n" \
+    "            callback.@call(thisArg, array[i], i, array);\n" \
+    "    }\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); }
+JSC_FOREACH_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace JSC
+### End File: JSCBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result b/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result
new file mode 100644
index 0000000..d0c8f26
--- /dev/null
+++ b/Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result
@@ -0,0 +1,184 @@
+### Begin File: BuiltinPrototypeBuiltins.h
+/*
+ * Copyright (c) 2014, 2015, 2016 Apple Inc. All rights reserved.
+ * Copyright (c) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace JSC {
+
+/* Builtin.prototype */
+extern const char* s_builtinPrototypeEveryCode;
+extern const int s_builtinPrototypeEveryCodeLength;
+extern const JSC::ConstructAbility s_builtinPrototypeEveryCodeConstructAbility;
+extern const char* s_builtinPrototypeForEachCode;
+extern const int s_builtinPrototypeForEachCodeLength;
+extern const JSC::ConstructAbility s_builtinPrototypeForEachCodeConstructAbility;
+
+#define JSC_FOREACH_BUILTIN_PROTOTYPE_BUILTIN_DATA(macro) \
+    macro(every, builtinPrototypeEvery, 1) \
+    macro(forEach, builtinPrototypeForEach, 1) \
+
+#define JSC_BUILTIN_BUILTIN_PROTOTYPE_EVERY 1
+#define JSC_BUILTIN_BUILTIN_PROTOTYPE_FOREACH 1
+
+#define JSC_FOREACH_BUILTIN.PROTOTYPE_BUILTIN_CODE(macro) \
+    macro(builtinPrototypeEveryCode, every, s_builtinPrototypeEveryCodeLength) \
+    macro(builtinPrototypeForEachCode, forEach, s_builtinPrototypeForEachCodeLength) \
+
+#define JSC_FOREACH_BUILTIN.PROTOTYPE_BUILTIN_FUNCTION_NAME(macro) \
+    macro(every) \
+    macro(forEach) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+JSC_FOREACH_BUILTIN.PROTOTYPE_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+} // namespace JSC
+### End File: BuiltinPrototypeBuiltins.h
+
+### Begin File: BuiltinPrototypeBuiltins.cpp
+/*
+ * Copyright (c) 2014, 2015, 2016 Apple Inc. All rights reserved.
+ * Copyright (c) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "BuiltinPrototypeBuiltins.h"
+
+#include "BuiltinExecutables.h"
+#include "HeapInlines.h"
+#include "Intrinsic.h"
+#include "JSCellInlines.h"
+#include "VM.h"
+
+namespace JSC {
+
+const JSC::ConstructAbility s_builtinPrototypeEveryCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinPrototypeEveryCodeLength = 760;
+static const JSC::Intrinsic s_builtinPrototypeEveryCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinPrototypeEveryCode =
+    "(function (callback )\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    if (this === null)\n" \
+    "        throw new @TypeError(\"Array.prototype.every requires that |this| not be null\");\n" \
+    "    \n" \
+    "    if (this === undefined)\n" \
+    "        throw new @TypeError(\"Array.prototype.every requires that |this| not be undefined\");\n" \
+    "    \n" \
+    "    var array = @Object(this);\n" \
+    "    var length = @toLength(array.length);\n" \
+    "    if (typeof callback !== \"function\")\n" \
+    "        throw new @TypeError(\"Array.prototype.every callback must be a function\");\n" \
+    "    \n" \
+    "    var thisArg = arguments.length > 1 ? arguments[1] : undefined;\n" \
+    "    \n" \
+    "    for (var i = 0; i < length; i++) {\n" \
+    "        if (!(i in array))\n" \
+    "            continue;\n" \
+    "        if (!callback.@call(thisArg, array[i], i, array))\n" \
+    "            return false;\n" \
+    "    }\n" \
+    "    \n" \
+    "    return true;\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_builtinPrototypeForEachCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinPrototypeForEachCodeLength = 692;
+static const JSC::Intrinsic s_builtinPrototypeForEachCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinPrototypeForEachCode =
+    "(function (callback )\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    if (this === null)\n" \
+    "        throw new @TypeError(\"Array.prototype.forEach requires that |this| not be null\");\n" \
+    "    \n" \
+    "    if (this === undefined)\n" \
+    "        throw new @TypeError(\"Array.prototype.forEach requires that |this| not be undefined\");\n" \
+    "    \n" \
+    "    var array = @Object(this);\n" \
+    "    var length = @toLength(array.length);\n" \
+    "    if (typeof callback !== \"function\")\n" \
+    "        throw new @TypeError(\"Array.prototype.forEach callback must be a function\");\n" \
+    "    \n" \
+    "    var thisArg = arguments.length > 1 ? arguments[1] : undefined;\n" \
+    "    \n" \
+    "    for (var i = 0; i < length; i++) {\n" \
+    "        if (i in array)\n" \
+    "            callback.@call(thisArg, array[i], i, array);\n" \
+    "    }\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); }
+JSC_FOREACH_BUILTIN.PROTOTYPE_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace JSC
+### End File: BuiltinPrototypeBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result b/Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result
new file mode 100644
index 0000000..023a829
--- /dev/null
+++ b/Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result
@@ -0,0 +1,198 @@
+### Begin File: JSCBuiltins.h
+/*
+ * Copyright (c) 2015, 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+namespace JSC {
+class FunctionExecutable;
+class VM;
+
+enum class ConstructAbility : unsigned;
+}
+
+namespace JSC {
+
+/* BuiltinConstructor */
+extern const char* s_builtinConstructorOfCode;
+extern const int s_builtinConstructorOfCodeLength;
+extern const JSC::ConstructAbility s_builtinConstructorOfCodeConstructAbility;
+extern const char* s_builtinConstructorFromCode;
+extern const int s_builtinConstructorFromCodeLength;
+extern const JSC::ConstructAbility s_builtinConstructorFromCodeConstructAbility;
+
+#define JSC_FOREACH_BUILTINCONSTRUCTOR_BUILTIN_DATA(macro) \
+    macro(of, builtinConstructorOf, 0) \
+    macro(from, builtinConstructorFrom, 1) \
+
+#define JSC_FOREACH_BUILTIN_CODE(macro) \
+    macro(builtinConstructorOfCode, of, s_builtinConstructorOfCodeLength) \
+    macro(builtinConstructorFromCode, from, s_builtinConstructorFromCodeLength) \
+
+#define JSC_FOREACH_BUILTIN_FUNCTION_NAME(macro) \
+    macro(from) \
+    macro(of) \
+
+#define JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(macro) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+JSC_FOREACH_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+} // namespace JSC
+### End File: JSCBuiltins.h
+
+### Begin File: JSCBuiltins.cpp
+/*
+ * Copyright (c) 2015, 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "JSCBuiltins.h"
+
+#include "BuiltinExecutables.h"
+#include "HeapInlines.h"
+#include "Intrinsic.h"
+#include "JSCellInlines.h"
+#include "UnlinkedFunctionExecutable.h"
+#include "VM.h"
+
+namespace JSC {
+
+const JSC::ConstructAbility s_builtinConstructorOfCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinConstructorOfCodeLength = 286;
+static const JSC::Intrinsic s_builtinConstructorOfCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinConstructorOfCode =
+    "(function ()\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    var length = arguments.length;\n" \
+    "    var array = typeof this === 'function' ? new this(length) : new @Array(length);\n" \
+    "    for (var k = 0; k < length; ++k)\n" \
+    "        @putByValDirect(array, k, arguments[k]);\n" \
+    "    array.length = length;\n" \
+    "    return array;\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_builtinConstructorFromCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinConstructorFromCodeLength = 1979;
+static const JSC::Intrinsic s_builtinConstructorFromCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinConstructorFromCode =
+    "(function (items )\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    var thisObj = this;\n" \
+    "    var mapFn = arguments.length > 1 ? arguments[1] : undefined;\n" \
+    "    var thisArg;\n" \
+    "    if (mapFn !== undefined) {\n" \
+    "        if (typeof mapFn !== \"function\")\n" \
+    "            throw new @TypeError(\"Array.from requires that the second argument, when provided, be a function\");\n" \
+    "        if (arguments.length > 2)\n" \
+    "            thisArg = arguments[2];\n" \
+    "    }\n" \
+    "    if (items == null)\n" \
+    "        throw new @TypeError(\"Array.from requires an array-like object - not null or undefined\");\n" \
+    "    var iteratorMethod = items[@symbolIterator];\n" \
+    "    if (iteratorMethod != null) {\n" \
+    "        if (typeof iteratorMethod !== \"function\")\n" \
+    "            throw new @TypeError(\"Array.from requires that the property of the first argument, items[Symbol.iterator], when exists, be a function\");\n" \
+    "        var result = (typeof thisObj === \"function\") ? @Object(new thisObj()) : [];\n" \
+    "        var k = 0;\n" \
+    "        var iterator = iteratorMethod.@call(items);\n" \
+    "        var wrapper = {\n" \
+    "            [@symbolIterator]() {\n" \
+    "                return iterator;\n" \
+    "            }\n" \
+    "        };\n" \
+    "        for (var value of wrapper) {\n" \
+    "            if (mapFn)\n" \
+    "                @putByValDirect(result, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));\n" \
+    "            else\n" \
+    "                @putByValDirect(result, k, value);\n" \
+    "            k += 1;\n" \
+    "        }\n" \
+    "        result.length = k;\n" \
+    "        return result;\n" \
+    "    }\n" \
+    "    var arrayLike = @Object(items);\n" \
+    "    var arrayLikeLength = @toLength(arrayLike.length);\n" \
+    "    var result = (typeof thisObj === \"function\") ? @Object(new thisObj(arrayLikeLength)) : new @Array(arrayLikeLength);\n" \
+    "    var k = 0;\n" \
+    "    while (k < arrayLikeLength) {\n" \
+    "        var value = arrayLike[k];\n" \
+    "        if (mapFn)\n" \
+    "            @putByValDirect(result, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));\n" \
+    "        else\n" \
+    "            @putByValDirect(result, k, value);\n" \
+    "        k += 1;\n" \
+    "    }\n" \
+    "    result.length = arrayLikeLength;\n" \
+    "    return result;\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); }
+JSC_FOREACH_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace JSC
+### End File: JSCBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result b/Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result
new file mode 100644
index 0000000..8000b69
--- /dev/null
+++ b/Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result
@@ -0,0 +1,197 @@
+### Begin File: BuiltinConstructorBuiltins.h
+/*
+ * Copyright (c) 2015, 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace JSC {
+
+/* BuiltinConstructor */
+extern const char* s_builtinConstructorOfCode;
+extern const int s_builtinConstructorOfCodeLength;
+extern const JSC::ConstructAbility s_builtinConstructorOfCodeConstructAbility;
+extern const char* s_builtinConstructorFromCode;
+extern const int s_builtinConstructorFromCodeLength;
+extern const JSC::ConstructAbility s_builtinConstructorFromCodeConstructAbility;
+
+#define JSC_FOREACH_BUILTINCONSTRUCTOR_BUILTIN_DATA(macro) \
+    macro(of, builtinConstructorOf, 0) \
+    macro(from, builtinConstructorFrom, 1) \
+
+#define JSC_BUILTIN_BUILTINCONSTRUCTOR_OF 1
+#define JSC_BUILTIN_BUILTINCONSTRUCTOR_FROM 1
+
+#define JSC_FOREACH_BUILTINCONSTRUCTOR_BUILTIN_CODE(macro) \
+    macro(builtinConstructorOfCode, of, s_builtinConstructorOfCodeLength) \
+    macro(builtinConstructorFromCode, from, s_builtinConstructorFromCodeLength) \
+
+#define JSC_FOREACH_BUILTINCONSTRUCTOR_BUILTIN_FUNCTION_NAME(macro) \
+    macro(from) \
+    macro(of) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+JSC_FOREACH_BUILTINCONSTRUCTOR_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+} // namespace JSC
+### End File: BuiltinConstructorBuiltins.h
+
+### Begin File: BuiltinConstructorBuiltins.cpp
+/*
+ * Copyright (c) 2015, 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "BuiltinConstructorBuiltins.h"
+
+#include "BuiltinExecutables.h"
+#include "HeapInlines.h"
+#include "Intrinsic.h"
+#include "JSCellInlines.h"
+#include "VM.h"
+
+namespace JSC {
+
+const JSC::ConstructAbility s_builtinConstructorOfCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinConstructorOfCodeLength = 286;
+static const JSC::Intrinsic s_builtinConstructorOfCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinConstructorOfCode =
+    "(function ()\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    var length = arguments.length;\n" \
+    "    var array = typeof this === 'function' ? new this(length) : new @Array(length);\n" \
+    "    for (var k = 0; k < length; ++k)\n" \
+    "        @putByValDirect(array, k, arguments[k]);\n" \
+    "    array.length = length;\n" \
+    "    return array;\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_builtinConstructorFromCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_builtinConstructorFromCodeLength = 1979;
+static const JSC::Intrinsic s_builtinConstructorFromCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_builtinConstructorFromCode =
+    "(function (items )\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    var thisObj = this;\n" \
+    "    var mapFn = arguments.length > 1 ? arguments[1] : undefined;\n" \
+    "    var thisArg;\n" \
+    "    if (mapFn !== undefined) {\n" \
+    "        if (typeof mapFn !== \"function\")\n" \
+    "            throw new @TypeError(\"Array.from requires that the second argument, when provided, be a function\");\n" \
+    "        if (arguments.length > 2)\n" \
+    "            thisArg = arguments[2];\n" \
+    "    }\n" \
+    "    if (items == null)\n" \
+    "        throw new @TypeError(\"Array.from requires an array-like object - not null or undefined\");\n" \
+    "    var iteratorMethod = items[@symbolIterator];\n" \
+    "    if (iteratorMethod != null) {\n" \
+    "        if (typeof iteratorMethod !== \"function\")\n" \
+    "            throw new @TypeError(\"Array.from requires that the property of the first argument, items[Symbol.iterator], when exists, be a function\");\n" \
+    "        var result = (typeof thisObj === \"function\") ? @Object(new thisObj()) : [];\n" \
+    "        var k = 0;\n" \
+    "        var iterator = iteratorMethod.@call(items);\n" \
+    "        var wrapper = {\n" \
+    "            [@symbolIterator]() {\n" \
+    "                return iterator;\n" \
+    "            }\n" \
+    "        };\n" \
+    "        for (var value of wrapper) {\n" \
+    "            if (mapFn)\n" \
+    "                @putByValDirect(result, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));\n" \
+    "            else\n" \
+    "                @putByValDirect(result, k, value);\n" \
+    "            k += 1;\n" \
+    "        }\n" \
+    "        result.length = k;\n" \
+    "        return result;\n" \
+    "    }\n" \
+    "    var arrayLike = @Object(items);\n" \
+    "    var arrayLikeLength = @toLength(arrayLike.length);\n" \
+    "    var result = (typeof thisObj === \"function\") ? @Object(new thisObj(arrayLikeLength)) : new @Array(arrayLikeLength);\n" \
+    "    var k = 0;\n" \
+    "    while (k < arrayLikeLength) {\n" \
+    "        var value = arrayLike[k];\n" \
+    "        if (mapFn)\n" \
+    "            @putByValDirect(result, k, thisArg === undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));\n" \
+    "        else\n" \
+    "            @putByValDirect(result, k, value);\n" \
+    "        k += 1;\n" \
+    "    }\n" \
+    "    result.length = arrayLikeLength;\n" \
+    "    return result;\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); }
+JSC_FOREACH_BUILTINCONSTRUCTOR_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace JSC
+### End File: BuiltinConstructorBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-error b/Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-error
new file mode 100644
index 0000000..eb147c4
--- /dev/null
+++ b/Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-error
@@ -0,0 +1 @@
+ERROR: There are several internal functions with the same name. Private identifiers may clash.
diff --git a/Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result b/Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result
new file mode 100644
index 0000000..8cbb539
--- /dev/null
+++ b/Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result
@@ -0,0 +1,148 @@
+### Begin File: JSCBuiltins.h
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+namespace JSC {
+class FunctionExecutable;
+class VM;
+
+enum class ConstructAbility : unsigned;
+}
+
+namespace JSC {
+
+/* InternalClashingNames */
+extern const char* s_internalClashingNamesIsReadableStreamLockedCode;
+extern const int s_internalClashingNamesIsReadableStreamLockedCodeLength;
+extern const JSC::ConstructAbility s_internalClashingNamesIsReadableStreamLockedCodeConstructAbility;
+extern const char* s_internalClashingNamesIsReadableStreamLockedCode;
+extern const int s_internalClashingNamesIsReadableStreamLockedCodeLength;
+extern const JSC::ConstructAbility s_internalClashingNamesIsReadableStreamLockedCodeConstructAbility;
+
+#define JSC_FOREACH_INTERNALCLASHINGNAMES_BUILTIN_DATA(macro) \
+    macro(isReadableStreamLocked, internalClashingNamesIsReadableStreamLocked, 1) \
+    macro(isReadableStreamLocked, internalClashingNamesIsReadableStreamLocked, 1) \
+
+#define JSC_FOREACH_BUILTIN_CODE(macro) \
+    macro(internalClashingNamesIsReadableStreamLockedCode, isReadableStreamLocked, s_internalClashingNamesIsReadableStreamLockedCodeLength) \
+    macro(internalClashingNamesIsReadableStreamLockedCode, isReadableStreamLocked, s_internalClashingNamesIsReadableStreamLockedCodeLength) \
+
+#define JSC_FOREACH_BUILTIN_FUNCTION_NAME(macro) \
+    macro(isReadableStreamLocked) \
+
+#define JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(macro) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+JSC_FOREACH_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+} // namespace JSC
+### End File: JSCBuiltins.h
+
+### Begin File: JSCBuiltins.cpp
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "JSCBuiltins.h"
+
+#include "BuiltinExecutables.h"
+#include "HeapInlines.h"
+#include "Intrinsic.h"
+#include "JSCellInlines.h"
+#include "UnlinkedFunctionExecutable.h"
+#include "VM.h"
+
+namespace JSC {
+
+const JSC::ConstructAbility s_internalClashingNamesIsReadableStreamLockedCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_internalClashingNamesIsReadableStreamLockedCodeLength = 70;
+static const JSC::Intrinsic s_internalClashingNamesIsReadableStreamLockedCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_internalClashingNamesIsReadableStreamLockedCode =
+    "(function (stream)\n" \
+    "{\n" \
+    "   \"use strict\";\n" \
+    "    return !!stream.@reader;\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_internalClashingNamesIsReadableStreamLockedCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_internalClashingNamesIsReadableStreamLockedCodeLength = 70;
+static const JSC::Intrinsic s_internalClashingNamesIsReadableStreamLockedCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_internalClashingNamesIsReadableStreamLockedCode =
+    "(function (stream)\n" \
+    "{\n" \
+    "   \"use strict\";\n" \
+    "    return !!stream.@reader;\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    return vm.builtinExecutables()->codeName##Executable()->link(vm, vm.builtinExecutables()->codeName##Source(), std::nullopt, s_##codeName##Intrinsic); }
+JSC_FOREACH_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace JSC
+### End File: JSCBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result b/Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result
new file mode 100644
index 0000000..9eae1be
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCore-AnotherGuardedInternalBuiltin-Separate.js-result
@@ -0,0 +1,227 @@
+### Begin File: AnotherGuardedInternalBuiltinBuiltins.h
+/*
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+#if ENABLE(FETCH_API)
+
+#include <builtins/BuiltinUtils.h>
+#include <bytecode/UnlinkedFunctionExecutable.h>
+#include <runtime/Identifier.h>
+#include <runtime/JSFunction.h>
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace WebCore {
+
+/* AnotherGuardedInternalBuiltin */
+extern const char* s_anotherGuardedInternalBuiltinLetsFetchCode;
+extern const int s_anotherGuardedInternalBuiltinLetsFetchCodeLength;
+extern const JSC::ConstructAbility s_anotherGuardedInternalBuiltinLetsFetchCodeConstructAbility;
+
+#define WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_DATA(macro) \
+    macro(letsFetch, anotherGuardedInternalBuiltinLetsFetch, 0) \
+
+#define WEBCORE_BUILTIN_ANOTHERGUARDEDINTERNALBUILTIN_LETSFETCH 1
+
+#define WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(macro) \
+    macro(anotherGuardedInternalBuiltinLetsFetchCode, letsFetch, s_anotherGuardedInternalBuiltinLetsFetchCodeLength) \
+
+#define WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(macro) \
+    macro(letsFetch) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+class AnotherGuardedInternalBuiltinBuiltinsWrapper : private JSC::WeakHandleOwner {
+public:
+    explicit AnotherGuardedInternalBuiltinBuiltinsWrapper(JSC::VM* vm)
+        : m_vm(*vm)
+        WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+        WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
+#undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
+    {
+    }
+
+#define EXPOSE_BUILTIN_EXECUTABLES(name, functionName, length) \
+    JSC::UnlinkedFunctionExecutable* name##Executable(); \
+    const JSC::SourceCode& name##Source() const { return m_##name##Source; }
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(EXPOSE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_EXECUTABLES
+
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+
+    void exportNames();
+
+private:
+    JSC::VM& m_vm;
+
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_NAMES)
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) \
+    JSC::SourceCode m_##name##Source;\
+    JSC::Weak<JSC::UnlinkedFunctionExecutable> m_##name##Executable;
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+
+};
+
+#define DEFINE_BUILTIN_EXECUTABLES(name, functionName, length) \
+inline JSC::UnlinkedFunctionExecutable* AnotherGuardedInternalBuiltinBuiltinsWrapper::name##Executable() \
+{\
+    if (!m_##name##Executable)\
+        m_##name##Executable = JSC::Weak<JSC::UnlinkedFunctionExecutable>(JSC::createBuiltinExecutable(m_vm, m_##name##Source, functionName##PublicName(), s_##name##ConstructAbility), this, &m_##name##Executable);\
+    return m_##name##Executable.get();\
+}
+WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(DEFINE_BUILTIN_EXECUTABLES)
+#undef DEFINE_BUILTIN_EXECUTABLES
+
+inline void AnotherGuardedInternalBuiltinBuiltinsWrapper::exportNames()
+{
+#define EXPORT_FUNCTION_NAME(name) m_vm.propertyNames->appendExternalName(name##PublicName(), name##PrivateName());
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(EXPORT_FUNCTION_NAME)
+#undef EXPORT_FUNCTION_NAME
+}
+
+class AnotherGuardedInternalBuiltinBuiltinFunctions {
+public:
+    explicit AnotherGuardedInternalBuiltinBuiltinFunctions(JSC::VM& vm) : m_vm(vm) { }
+
+    void init(JSC::JSGlobalObject&);
+    void visit(JSC::SlotVisitor&);
+
+public:
+    JSC::VM& m_vm;
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(functionName) \
+    JSC::WriteBarrier<JSC::JSFunction> m_##functionName##Function;
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+};
+
+inline void AnotherGuardedInternalBuiltinBuiltinFunctions::init(JSC::JSGlobalObject& globalObject)
+{
+#define EXPORT_FUNCTION(codeName, functionName, length)\
+    m_##functionName##Function.set(m_vm, &globalObject, JSC::JSFunction::createBuiltinFunction(m_vm, codeName##Generator(m_vm), &globalObject));
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(EXPORT_FUNCTION)
+#undef EXPORT_FUNCTION
+}
+
+inline void AnotherGuardedInternalBuiltinBuiltinFunctions::visit(JSC::SlotVisitor& visitor)
+{
+#define VISIT_FUNCTION(name) visitor.append(m_##name##Function);
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(VISIT_FUNCTION)
+#undef VISIT_FUNCTION
+}
+
+
+} // namespace WebCore
+
+#endif // ENABLE(FETCH_API)
+### End File: AnotherGuardedInternalBuiltinBuiltins.h
+
+### Begin File: AnotherGuardedInternalBuiltinBuiltins.cpp
+/*
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "AnotherGuardedInternalBuiltinBuiltins.h"
+
+#if ENABLE(FETCH_API)
+
+#include "WebCoreJSClientData.h"
+#include <heap/HeapInlines.h>
+#include <runtime/Intrinsic.h>
+#include <runtime/JSCJSValueInlines.h>
+#include <runtime/JSCellInlines.h>
+#include <runtime/StructureInlines.h>
+#include <runtime/VM.h>
+
+namespace WebCore {
+
+const JSC::ConstructAbility s_anotherGuardedInternalBuiltinLetsFetchCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_anotherGuardedInternalBuiltinLetsFetchCodeLength = 82;
+static const JSC::Intrinsic s_anotherGuardedInternalBuiltinLetsFetchCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_anotherGuardedInternalBuiltinLetsFetchCode =
+    "(function ()\n" \
+    "{\n" \
+    "   \"use strict\";\n" \
+    "    return @fetchRequest(new @Request(\"yes\"));\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData); \
+    return clientData->builtinFunctions().anotherGuardedInternalBuiltinBuiltins().codeName##Executable()->link(vm, clientData->builtinFunctions().anotherGuardedInternalBuiltinBuiltins().codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \
+}
+WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace WebCore
+
+#endif // ENABLE(FETCH_API)
+
+### End File: AnotherGuardedInternalBuiltinBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result b/Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result
new file mode 100644
index 0000000..f91b6d9
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result
@@ -0,0 +1,197 @@
+### Begin File: ArbitraryConditionalGuardBuiltins.h
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+#if ENABLE(STREAMS_API) || USE(CF)
+
+#include <builtins/BuiltinUtils.h>
+#include <bytecode/UnlinkedFunctionExecutable.h>
+#include <runtime/Identifier.h>
+#include <runtime/JSFunction.h>
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace WebCore {
+
+/* ArbitraryConditionalGuard */
+extern const char* s_arbitraryConditionalGuardIsReadableStreamLockedCode;
+extern const int s_arbitraryConditionalGuardIsReadableStreamLockedCodeLength;
+extern const JSC::ConstructAbility s_arbitraryConditionalGuardIsReadableStreamLockedCodeConstructAbility;
+
+#define WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_DATA(macro) \
+    macro(isReadableStreamLocked, arbitraryConditionalGuardIsReadableStreamLocked, 1) \
+
+#define WEBCORE_BUILTIN_ARBITRARYCONDITIONALGUARD_ISREADABLESTREAMLOCKED 1
+
+#define WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_CODE(macro) \
+    macro(arbitraryConditionalGuardIsReadableStreamLockedCode, isReadableStreamLocked, s_arbitraryConditionalGuardIsReadableStreamLockedCodeLength) \
+
+#define WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_FUNCTION_NAME(macro) \
+    macro(isReadableStreamLocked) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+class ArbitraryConditionalGuardBuiltinsWrapper : private JSC::WeakHandleOwner {
+public:
+    explicit ArbitraryConditionalGuardBuiltinsWrapper(JSC::VM* vm)
+        : m_vm(*vm)
+        WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+        WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
+#undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
+    {
+    }
+
+#define EXPOSE_BUILTIN_EXECUTABLES(name, functionName, length) \
+    JSC::UnlinkedFunctionExecutable* name##Executable(); \
+    const JSC::SourceCode& name##Source() const { return m_##name##Source; }
+    WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_CODE(EXPOSE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_EXECUTABLES
+
+    WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+
+    void exportNames();
+
+private:
+    JSC::VM& m_vm;
+
+    WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_NAMES)
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) \
+    JSC::SourceCode m_##name##Source;\
+    JSC::Weak<JSC::UnlinkedFunctionExecutable> m_##name##Executable;
+    WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_CODE(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+
+};
+
+#define DEFINE_BUILTIN_EXECUTABLES(name, functionName, length) \
+inline JSC::UnlinkedFunctionExecutable* ArbitraryConditionalGuardBuiltinsWrapper::name##Executable() \
+{\
+    if (!m_##name##Executable)\
+        m_##name##Executable = JSC::Weak<JSC::UnlinkedFunctionExecutable>(JSC::createBuiltinExecutable(m_vm, m_##name##Source, functionName##PublicName(), s_##name##ConstructAbility), this, &m_##name##Executable);\
+    return m_##name##Executable.get();\
+}
+WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_CODE(DEFINE_BUILTIN_EXECUTABLES)
+#undef DEFINE_BUILTIN_EXECUTABLES
+
+inline void ArbitraryConditionalGuardBuiltinsWrapper::exportNames()
+{
+#define EXPORT_FUNCTION_NAME(name) m_vm.propertyNames->appendExternalName(name##PublicName(), name##PrivateName());
+    WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_FUNCTION_NAME(EXPORT_FUNCTION_NAME)
+#undef EXPORT_FUNCTION_NAME
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(STREAMS_API) || USE(CF)
+### End File: ArbitraryConditionalGuardBuiltins.h
+
+### Begin File: ArbitraryConditionalGuardBuiltins.cpp
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "ArbitraryConditionalGuardBuiltins.h"
+
+#if ENABLE(STREAMS_API) || USE(CF)
+
+#include "WebCoreJSClientData.h"
+#include <heap/HeapInlines.h>
+#include <runtime/Intrinsic.h>
+#include <runtime/JSCJSValueInlines.h>
+#include <runtime/JSCellInlines.h>
+#include <runtime/StructureInlines.h>
+#include <runtime/VM.h>
+
+namespace WebCore {
+
+const JSC::ConstructAbility s_arbitraryConditionalGuardIsReadableStreamLockedCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_arbitraryConditionalGuardIsReadableStreamLockedCodeLength = 70;
+static const JSC::Intrinsic s_arbitraryConditionalGuardIsReadableStreamLockedCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_arbitraryConditionalGuardIsReadableStreamLockedCode =
+    "(function (stream)\n" \
+    "{\n" \
+    "   \"use strict\";\n" \
+    "    return !!stream.@reader;\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData); \
+    return clientData->builtinFunctions().arbitraryConditionalGuardBuiltins().codeName##Executable()->link(vm, clientData->builtinFunctions().arbitraryConditionalGuardBuiltins().codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \
+}
+WEBCORE_FOREACH_ARBITRARYCONDITIONALGUARD_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace WebCore
+
+#endif // ENABLE(STREAMS_API) || USE(CF)
+
+### End File: ArbitraryConditionalGuardBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/WebCore-DuplicateFlagAnnotation-Separate.js-error b/Scripts/tests/builtins/expected/WebCore-DuplicateFlagAnnotation-Separate.js-error
new file mode 100644
index 0000000..b15152e
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCore-DuplicateFlagAnnotation-Separate.js-error
@@ -0,0 +1 @@
+ERROR: Duplicate annotation found: internal
diff --git a/Scripts/tests/builtins/expected/WebCore-DuplicateKeyValueAnnotation-Separate.js-error b/Scripts/tests/builtins/expected/WebCore-DuplicateKeyValueAnnotation-Separate.js-error
new file mode 100644
index 0000000..f1b429e
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCore-DuplicateKeyValueAnnotation-Separate.js-error
@@ -0,0 +1 @@
+ERROR: Duplicate annotation found: conditional
diff --git a/Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result b/Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result
new file mode 100644
index 0000000..e971755
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result
@@ -0,0 +1,197 @@
+### Begin File: GuardedBuiltinBuiltins.h
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+#if ENABLE(STREAMS_API)
+
+#include <builtins/BuiltinUtils.h>
+#include <bytecode/UnlinkedFunctionExecutable.h>
+#include <runtime/Identifier.h>
+#include <runtime/JSFunction.h>
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace WebCore {
+
+/* GuardedBuiltin */
+extern const char* s_guardedBuiltinIsReadableStreamLockedCode;
+extern const int s_guardedBuiltinIsReadableStreamLockedCodeLength;
+extern const JSC::ConstructAbility s_guardedBuiltinIsReadableStreamLockedCodeConstructAbility;
+
+#define WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_DATA(macro) \
+    macro(isReadableStreamLocked, guardedBuiltinIsReadableStreamLocked, 1) \
+
+#define WEBCORE_BUILTIN_GUARDEDBUILTIN_ISREADABLESTREAMLOCKED 1
+
+#define WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_CODE(macro) \
+    macro(guardedBuiltinIsReadableStreamLockedCode, isReadableStreamLocked, s_guardedBuiltinIsReadableStreamLockedCodeLength) \
+
+#define WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(macro) \
+    macro(isReadableStreamLocked) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+class GuardedBuiltinBuiltinsWrapper : private JSC::WeakHandleOwner {
+public:
+    explicit GuardedBuiltinBuiltinsWrapper(JSC::VM* vm)
+        : m_vm(*vm)
+        WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+        WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
+#undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
+    {
+    }
+
+#define EXPOSE_BUILTIN_EXECUTABLES(name, functionName, length) \
+    JSC::UnlinkedFunctionExecutable* name##Executable(); \
+    const JSC::SourceCode& name##Source() const { return m_##name##Source; }
+    WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_CODE(EXPOSE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_EXECUTABLES
+
+    WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+
+    void exportNames();
+
+private:
+    JSC::VM& m_vm;
+
+    WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_NAMES)
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) \
+    JSC::SourceCode m_##name##Source;\
+    JSC::Weak<JSC::UnlinkedFunctionExecutable> m_##name##Executable;
+    WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_CODE(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+
+};
+
+#define DEFINE_BUILTIN_EXECUTABLES(name, functionName, length) \
+inline JSC::UnlinkedFunctionExecutable* GuardedBuiltinBuiltinsWrapper::name##Executable() \
+{\
+    if (!m_##name##Executable)\
+        m_##name##Executable = JSC::Weak<JSC::UnlinkedFunctionExecutable>(JSC::createBuiltinExecutable(m_vm, m_##name##Source, functionName##PublicName(), s_##name##ConstructAbility), this, &m_##name##Executable);\
+    return m_##name##Executable.get();\
+}
+WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_CODE(DEFINE_BUILTIN_EXECUTABLES)
+#undef DEFINE_BUILTIN_EXECUTABLES
+
+inline void GuardedBuiltinBuiltinsWrapper::exportNames()
+{
+#define EXPORT_FUNCTION_NAME(name) m_vm.propertyNames->appendExternalName(name##PublicName(), name##PrivateName());
+    WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(EXPORT_FUNCTION_NAME)
+#undef EXPORT_FUNCTION_NAME
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(STREAMS_API)
+### End File: GuardedBuiltinBuiltins.h
+
+### Begin File: GuardedBuiltinBuiltins.cpp
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "GuardedBuiltinBuiltins.h"
+
+#if ENABLE(STREAMS_API)
+
+#include "WebCoreJSClientData.h"
+#include <heap/HeapInlines.h>
+#include <runtime/Intrinsic.h>
+#include <runtime/JSCJSValueInlines.h>
+#include <runtime/JSCellInlines.h>
+#include <runtime/StructureInlines.h>
+#include <runtime/VM.h>
+
+namespace WebCore {
+
+const JSC::ConstructAbility s_guardedBuiltinIsReadableStreamLockedCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_guardedBuiltinIsReadableStreamLockedCodeLength = 70;
+static const JSC::Intrinsic s_guardedBuiltinIsReadableStreamLockedCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_guardedBuiltinIsReadableStreamLockedCode =
+    "(function (stream)\n" \
+    "{\n" \
+    "   \"use strict\";\n" \
+    "    return !!stream.@reader;\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData); \
+    return clientData->builtinFunctions().guardedBuiltinBuiltins().codeName##Executable()->link(vm, clientData->builtinFunctions().guardedBuiltinBuiltins().codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \
+}
+WEBCORE_FOREACH_GUARDEDBUILTIN_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace WebCore
+
+#endif // ENABLE(STREAMS_API)
+
+### End File: GuardedBuiltinBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result b/Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result
new file mode 100644
index 0000000..7bc645a
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result
@@ -0,0 +1,229 @@
+### Begin File: GuardedInternalBuiltinBuiltins.h
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+
+#include <builtins/BuiltinUtils.h>
+#include <bytecode/UnlinkedFunctionExecutable.h>
+#include <runtime/Identifier.h>
+#include <runtime/JSFunction.h>
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace WebCore {
+
+/* GuardedInternalBuiltin */
+extern const char* s_guardedInternalBuiltinIsReadableStreamLockedCode;
+extern const int s_guardedInternalBuiltinIsReadableStreamLockedCodeLength;
+extern const JSC::ConstructAbility s_guardedInternalBuiltinIsReadableStreamLockedCodeConstructAbility;
+
+#define WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_DATA(macro) \
+    macro(isReadableStreamLocked, guardedInternalBuiltinIsReadableStreamLocked, 1) \
+
+#define WEBCORE_BUILTIN_GUARDEDINTERNALBUILTIN_ISREADABLESTREAMLOCKED 1
+
+#define WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(macro) \
+    macro(guardedInternalBuiltinIsReadableStreamLockedCode, isReadableStreamLocked, s_guardedInternalBuiltinIsReadableStreamLockedCodeLength) \
+
+#define WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(macro) \
+    macro(isReadableStreamLocked) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+class GuardedInternalBuiltinBuiltinsWrapper : private JSC::WeakHandleOwner {
+public:
+    explicit GuardedInternalBuiltinBuiltinsWrapper(JSC::VM* vm)
+        : m_vm(*vm)
+        WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+        WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
+#undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
+    {
+    }
+
+#define EXPOSE_BUILTIN_EXECUTABLES(name, functionName, length) \
+    JSC::UnlinkedFunctionExecutable* name##Executable(); \
+    const JSC::SourceCode& name##Source() const { return m_##name##Source; }
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(EXPOSE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_EXECUTABLES
+
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+
+    void exportNames();
+
+private:
+    JSC::VM& m_vm;
+
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_NAMES)
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) \
+    JSC::SourceCode m_##name##Source;\
+    JSC::Weak<JSC::UnlinkedFunctionExecutable> m_##name##Executable;
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+
+};
+
+#define DEFINE_BUILTIN_EXECUTABLES(name, functionName, length) \
+inline JSC::UnlinkedFunctionExecutable* GuardedInternalBuiltinBuiltinsWrapper::name##Executable() \
+{\
+    if (!m_##name##Executable)\
+        m_##name##Executable = JSC::Weak<JSC::UnlinkedFunctionExecutable>(JSC::createBuiltinExecutable(m_vm, m_##name##Source, functionName##PublicName(), s_##name##ConstructAbility), this, &m_##name##Executable);\
+    return m_##name##Executable.get();\
+}
+WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(DEFINE_BUILTIN_EXECUTABLES)
+#undef DEFINE_BUILTIN_EXECUTABLES
+
+inline void GuardedInternalBuiltinBuiltinsWrapper::exportNames()
+{
+#define EXPORT_FUNCTION_NAME(name) m_vm.propertyNames->appendExternalName(name##PublicName(), name##PrivateName());
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(EXPORT_FUNCTION_NAME)
+#undef EXPORT_FUNCTION_NAME
+}
+
+class GuardedInternalBuiltinBuiltinFunctions {
+public:
+    explicit GuardedInternalBuiltinBuiltinFunctions(JSC::VM& vm) : m_vm(vm) { }
+
+    void init(JSC::JSGlobalObject&);
+    void visit(JSC::SlotVisitor&);
+
+public:
+    JSC::VM& m_vm;
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(functionName) \
+    JSC::WriteBarrier<JSC::JSFunction> m_##functionName##Function;
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+};
+
+inline void GuardedInternalBuiltinBuiltinFunctions::init(JSC::JSGlobalObject& globalObject)
+{
+#define EXPORT_FUNCTION(codeName, functionName, length)\
+    m_##functionName##Function.set(m_vm, &globalObject, JSC::JSFunction::createBuiltinFunction(m_vm, codeName##Generator(m_vm), &globalObject));
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(EXPORT_FUNCTION)
+#undef EXPORT_FUNCTION
+}
+
+inline void GuardedInternalBuiltinBuiltinFunctions::visit(JSC::SlotVisitor& visitor)
+{
+#define VISIT_FUNCTION(name) visitor.append(m_##name##Function);
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(VISIT_FUNCTION)
+#undef VISIT_FUNCTION
+}
+
+
+} // namespace WebCore
+
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+### End File: GuardedInternalBuiltinBuiltins.h
+
+### Begin File: GuardedInternalBuiltinBuiltins.cpp
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "GuardedInternalBuiltinBuiltins.h"
+
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+
+#include "WebCoreJSClientData.h"
+#include <heap/HeapInlines.h>
+#include <runtime/Intrinsic.h>
+#include <runtime/JSCJSValueInlines.h>
+#include <runtime/JSCellInlines.h>
+#include <runtime/StructureInlines.h>
+#include <runtime/VM.h>
+
+namespace WebCore {
+
+const JSC::ConstructAbility s_guardedInternalBuiltinIsReadableStreamLockedCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_guardedInternalBuiltinIsReadableStreamLockedCodeLength = 70;
+static const JSC::Intrinsic s_guardedInternalBuiltinIsReadableStreamLockedCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_guardedInternalBuiltinIsReadableStreamLockedCode =
+    "(function (stream)\n" \
+    "{\n" \
+    "   \"use strict\";\n" \
+    "    return !!stream.@reader;\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData); \
+    return clientData->builtinFunctions().guardedInternalBuiltinBuiltins().codeName##Executable()->link(vm, clientData->builtinFunctions().guardedInternalBuiltinBuiltins().codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \
+}
+WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace WebCore
+
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+
+### End File: GuardedInternalBuiltinBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result b/Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result
new file mode 100644
index 0000000..f1dcace
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result
@@ -0,0 +1,188 @@
+### Begin File: UnguardedBuiltinBuiltins.h
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+#include <builtins/BuiltinUtils.h>
+#include <bytecode/UnlinkedFunctionExecutable.h>
+#include <runtime/Identifier.h>
+#include <runtime/JSFunction.h>
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace WebCore {
+
+/* UnguardedBuiltin */
+extern const char* s_unguardedBuiltinIsReadableStreamLockedCode;
+extern const int s_unguardedBuiltinIsReadableStreamLockedCodeLength;
+extern const JSC::ConstructAbility s_unguardedBuiltinIsReadableStreamLockedCodeConstructAbility;
+
+#define WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_DATA(macro) \
+    macro(isReadableStreamLocked, unguardedBuiltinIsReadableStreamLocked, 1) \
+
+#define WEBCORE_BUILTIN_UNGUARDEDBUILTIN_ISREADABLESTREAMLOCKED 1
+
+#define WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_CODE(macro) \
+    macro(unguardedBuiltinIsReadableStreamLockedCode, isReadableStreamLocked, s_unguardedBuiltinIsReadableStreamLockedCodeLength) \
+
+#define WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(macro) \
+    macro(isReadableStreamLocked) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+class UnguardedBuiltinBuiltinsWrapper : private JSC::WeakHandleOwner {
+public:
+    explicit UnguardedBuiltinBuiltinsWrapper(JSC::VM* vm)
+        : m_vm(*vm)
+        WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+        WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
+#undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
+    {
+    }
+
+#define EXPOSE_BUILTIN_EXECUTABLES(name, functionName, length) \
+    JSC::UnlinkedFunctionExecutable* name##Executable(); \
+    const JSC::SourceCode& name##Source() const { return m_##name##Source; }
+    WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_CODE(EXPOSE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_EXECUTABLES
+
+    WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+
+    void exportNames();
+
+private:
+    JSC::VM& m_vm;
+
+    WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_NAMES)
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) \
+    JSC::SourceCode m_##name##Source;\
+    JSC::Weak<JSC::UnlinkedFunctionExecutable> m_##name##Executable;
+    WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_CODE(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+
+};
+
+#define DEFINE_BUILTIN_EXECUTABLES(name, functionName, length) \
+inline JSC::UnlinkedFunctionExecutable* UnguardedBuiltinBuiltinsWrapper::name##Executable() \
+{\
+    if (!m_##name##Executable)\
+        m_##name##Executable = JSC::Weak<JSC::UnlinkedFunctionExecutable>(JSC::createBuiltinExecutable(m_vm, m_##name##Source, functionName##PublicName(), s_##name##ConstructAbility), this, &m_##name##Executable);\
+    return m_##name##Executable.get();\
+}
+WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_CODE(DEFINE_BUILTIN_EXECUTABLES)
+#undef DEFINE_BUILTIN_EXECUTABLES
+
+inline void UnguardedBuiltinBuiltinsWrapper::exportNames()
+{
+#define EXPORT_FUNCTION_NAME(name) m_vm.propertyNames->appendExternalName(name##PublicName(), name##PrivateName());
+    WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_FUNCTION_NAME(EXPORT_FUNCTION_NAME)
+#undef EXPORT_FUNCTION_NAME
+}
+
+} // namespace WebCore
+### End File: UnguardedBuiltinBuiltins.h
+
+### Begin File: UnguardedBuiltinBuiltins.cpp
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "UnguardedBuiltinBuiltins.h"
+
+#include "WebCoreJSClientData.h"
+#include <heap/HeapInlines.h>
+#include <runtime/Intrinsic.h>
+#include <runtime/JSCJSValueInlines.h>
+#include <runtime/JSCellInlines.h>
+#include <runtime/StructureInlines.h>
+#include <runtime/VM.h>
+
+namespace WebCore {
+
+const JSC::ConstructAbility s_unguardedBuiltinIsReadableStreamLockedCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_unguardedBuiltinIsReadableStreamLockedCodeLength = 70;
+static const JSC::Intrinsic s_unguardedBuiltinIsReadableStreamLockedCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_unguardedBuiltinIsReadableStreamLockedCode =
+    "(function (stream)\n" \
+    "{\n" \
+    "   \"use strict\";\n" \
+    "    return !!stream.@reader;\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData); \
+    return clientData->builtinFunctions().unguardedBuiltinBuiltins().codeName##Executable()->link(vm, clientData->builtinFunctions().unguardedBuiltinBuiltins().codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \
+}
+WEBCORE_FOREACH_UNGUARDEDBUILTIN_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace WebCore
+### End File: UnguardedBuiltinBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result b/Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result
new file mode 100644
index 0000000..4af18ac
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result
@@ -0,0 +1,280 @@
+### Begin File: xmlCasingTestBuiltins.h
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+#if ENABLE(STREAMS_API)
+
+#include <builtins/BuiltinUtils.h>
+#include <bytecode/UnlinkedFunctionExecutable.h>
+#include <runtime/Identifier.h>
+#include <runtime/JSFunction.h>
+
+namespace JSC {
+class FunctionExecutable;
+}
+
+namespace WebCore {
+
+/* xmlCasingTest */
+extern const char* s_xmlCasingTestXMLCasingTestCode;
+extern const int s_xmlCasingTestXMLCasingTestCodeLength;
+extern const JSC::ConstructAbility s_xmlCasingTestXMLCasingTestCodeConstructAbility;
+extern const char* s_xmlCasingTestCssCasingTestCode;
+extern const int s_xmlCasingTestCssCasingTestCodeLength;
+extern const JSC::ConstructAbility s_xmlCasingTestCssCasingTestCodeConstructAbility;
+extern const char* s_xmlCasingTestUrlCasingTestCode;
+extern const int s_xmlCasingTestUrlCasingTestCodeLength;
+extern const JSC::ConstructAbility s_xmlCasingTestUrlCasingTestCodeConstructAbility;
+
+#define WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_DATA(macro) \
+    macro(xmlCasingTest, xmlCasingTestXMLCasingTest, 1) \
+    macro(cssCasingTest, xmlCasingTestCssCasingTest, 2) \
+    macro(urlCasingTest, xmlCasingTestUrlCasingTest, 3) \
+
+#define WEBCORE_BUILTIN_XMLCASINGTEST_XMLCASINGTEST 1
+#define WEBCORE_BUILTIN_XMLCASINGTEST_CSSCASINGTEST 1
+#define WEBCORE_BUILTIN_XMLCASINGTEST_URLCASINGTEST 1
+
+#define WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(macro) \
+    macro(xmlCasingTestXMLCasingTestCode, xmlCasingTest, s_xmlCasingTestXMLCasingTestCodeLength) \
+    macro(xmlCasingTestCssCasingTestCode, cssCasingTest, s_xmlCasingTestCssCasingTestCodeLength) \
+    macro(xmlCasingTestUrlCasingTestCode, urlCasingTest, s_xmlCasingTestUrlCasingTestCodeLength) \
+
+#define WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(macro) \
+    macro(cssCasingTest) \
+    macro(urlCasingTest) \
+    macro(xmlCasingTest) \
+
+#define DECLARE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+    JSC::FunctionExecutable* codeName##Generator(JSC::VM&);
+
+WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(DECLARE_BUILTIN_GENERATOR)
+#undef DECLARE_BUILTIN_GENERATOR
+
+class xmlCasingTestBuiltinsWrapper : private JSC::WeakHandleOwner {
+public:
+    explicit xmlCasingTestBuiltinsWrapper(JSC::VM* vm)
+        : m_vm(*vm)
+        WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(JSC::makeSource(StringImpl::createFromLiteral(s_##name, length)))
+        WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
+#undef INITIALIZE_BUILTIN_SOURCE_MEMBERS
+    {
+    }
+
+#define EXPOSE_BUILTIN_EXECUTABLES(name, functionName, length) \
+    JSC::UnlinkedFunctionExecutable* name##Executable(); \
+    const JSC::SourceCode& name##Source() const { return m_##name##Source; }
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(EXPOSE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_EXECUTABLES
+
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+
+    void exportNames();
+
+private:
+    JSC::VM& m_vm;
+
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_NAMES)
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) \
+    JSC::SourceCode m_##name##Source;\
+    JSC::Weak<JSC::UnlinkedFunctionExecutable> m_##name##Executable;
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+
+};
+
+#define DEFINE_BUILTIN_EXECUTABLES(name, functionName, length) \
+inline JSC::UnlinkedFunctionExecutable* xmlCasingTestBuiltinsWrapper::name##Executable() \
+{\
+    if (!m_##name##Executable)\
+        m_##name##Executable = JSC::Weak<JSC::UnlinkedFunctionExecutable>(JSC::createBuiltinExecutable(m_vm, m_##name##Source, functionName##PublicName(), s_##name##ConstructAbility), this, &m_##name##Executable);\
+    return m_##name##Executable.get();\
+}
+WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(DEFINE_BUILTIN_EXECUTABLES)
+#undef DEFINE_BUILTIN_EXECUTABLES
+
+inline void xmlCasingTestBuiltinsWrapper::exportNames()
+{
+#define EXPORT_FUNCTION_NAME(name) m_vm.propertyNames->appendExternalName(name##PublicName(), name##PrivateName());
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(EXPORT_FUNCTION_NAME)
+#undef EXPORT_FUNCTION_NAME
+}
+
+class xmlCasingTestBuiltinFunctions {
+public:
+    explicit xmlCasingTestBuiltinFunctions(JSC::VM& vm) : m_vm(vm) { }
+
+    void init(JSC::JSGlobalObject&);
+    void visit(JSC::SlotVisitor&);
+
+public:
+    JSC::VM& m_vm;
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(functionName) \
+    JSC::WriteBarrier<JSC::JSFunction> m_##functionName##Function;
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+};
+
+inline void xmlCasingTestBuiltinFunctions::init(JSC::JSGlobalObject& globalObject)
+{
+#define EXPORT_FUNCTION(codeName, functionName, length)\
+    m_##functionName##Function.set(m_vm, &globalObject, JSC::JSFunction::createBuiltinFunction(m_vm, codeName##Generator(m_vm), &globalObject));
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(EXPORT_FUNCTION)
+#undef EXPORT_FUNCTION
+}
+
+inline void xmlCasingTestBuiltinFunctions::visit(JSC::SlotVisitor& visitor)
+{
+#define VISIT_FUNCTION(name) visitor.append(m_##name##Function);
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(VISIT_FUNCTION)
+#undef VISIT_FUNCTION
+}
+
+
+} // namespace WebCore
+
+#endif // ENABLE(STREAMS_API)
+### End File: xmlCasingTestBuiltins.h
+
+### Begin File: xmlCasingTestBuiltins.cpp
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "xmlCasingTestBuiltins.h"
+
+#if ENABLE(STREAMS_API)
+
+#include "WebCoreJSClientData.h"
+#include <heap/HeapInlines.h>
+#include <runtime/Intrinsic.h>
+#include <runtime/JSCJSValueInlines.h>
+#include <runtime/JSCellInlines.h>
+#include <runtime/StructureInlines.h>
+#include <runtime/VM.h>
+
+namespace WebCore {
+
+const JSC::ConstructAbility s_xmlCasingTestXMLCasingTestCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_xmlCasingTestXMLCasingTestCodeLength = 70;
+static const JSC::Intrinsic s_xmlCasingTestXMLCasingTestCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_xmlCasingTestXMLCasingTestCode =
+    "(function (stream)\n" \
+    "{\n" \
+    "   \"use strict\";\n" \
+    "    return !!stream.@reader;\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_xmlCasingTestCssCasingTestCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_xmlCasingTestCssCasingTestCodeLength = 401;
+static const JSC::Intrinsic s_xmlCasingTestCssCasingTestCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_xmlCasingTestCssCasingTestCode =
+    "(function (stream, reason)\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    if (stream.@state === @readableStreamClosed)\n" \
+    "        return Promise.resolve();\n" \
+    "    if (stream.@state === @readableStreamErrored)\n" \
+    "        return Promise.reject(stream.@storedError);\n" \
+    "    stream.@queue = [];\n" \
+    "    @finishClosingReadableStream(stream);\n" \
+    "    return @promiseInvokeOrNoop(stream.@underlyingSource, \"cancel\", [reason]).then(function() { });\n" \
+    "})\n" \
+;
+
+const JSC::ConstructAbility s_xmlCasingTestUrlCasingTestCodeConstructAbility = JSC::ConstructAbility::CannotConstruct;
+const int s_xmlCasingTestUrlCasingTestCodeLength = 337;
+static const JSC::Intrinsic s_xmlCasingTestUrlCasingTestCodeIntrinsic = JSC::NoIntrinsic;
+const char* s_xmlCasingTestUrlCasingTestCode =
+    "(function (object, key, args)\n" \
+    "{\n" \
+    "    \"use strict\";\n" \
+    "    try {\n" \
+    "        var method = object[key];\n" \
+    "        if (typeof method === \"undefined\")\n" \
+    "            return Promise.resolve();\n" \
+    "        var result = method.@apply(object, args);\n" \
+    "        return Promise.resolve(result);\n" \
+    "    }\n" \
+    "    catch(error) {\n" \
+    "        return Promise.reject(error);\n" \
+    "    }\n" \
+    "})\n" \
+;
+
+
+#define DEFINE_BUILTIN_GENERATOR(codeName, functionName, argumentCount) \
+JSC::FunctionExecutable* codeName##Generator(JSC::VM& vm) \
+{\
+    JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData); \
+    return clientData->builtinFunctions().xmlCasingTestBuiltins().codeName##Executable()->link(vm, clientData->builtinFunctions().xmlCasingTestBuiltins().codeName##Source(), std::nullopt, s_##codeName##Intrinsic); \
+}
+WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_CODE(DEFINE_BUILTIN_GENERATOR)
+#undef DEFINE_BUILTIN_GENERATOR
+
+
+} // namespace WebCore
+
+#endif // ENABLE(STREAMS_API)
+
+### End File: xmlCasingTestBuiltins.cpp
diff --git a/Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result b/Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result
new file mode 100644
index 0000000..dab4244
--- /dev/null
+++ b/Scripts/tests/builtins/expected/WebCoreJSBuiltins.h-result
@@ -0,0 +1,351 @@
+### Begin File: WebCoreJSBuiltins.h
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+#include "AnotherGuardedInternalBuiltinBuiltins.h"
+#include "ArbitraryConditionalGuardBuiltins.h"
+#include "GuardedBuiltinBuiltins.h"
+#include "GuardedInternalBuiltinBuiltins.h"
+#include "UnguardedBuiltinBuiltins.h"
+#include "xmlCasingTestBuiltins.h"
+#include <runtime/VM.h>
+
+namespace WebCore {
+
+class JSBuiltinFunctions {
+public:
+    explicit JSBuiltinFunctions(JSC::VM& vm)
+        : m_vm(vm)
+#if ENABLE(FETCH_API)
+        , m_anotherGuardedInternalBuiltinBuiltins(&m_vm)
+#endif // ENABLE(FETCH_API)
+#if ENABLE(STREAMS_API) || USE(CF)
+        , m_arbitraryConditionalGuardBuiltins(&m_vm)
+#endif // ENABLE(STREAMS_API) || USE(CF)
+#if ENABLE(STREAMS_API)
+        , m_guardedBuiltinBuiltins(&m_vm)
+#endif // ENABLE(STREAMS_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+        , m_guardedInternalBuiltinBuiltins(&m_vm)
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+        , m_unguardedBuiltinBuiltins(&m_vm)
+#if ENABLE(STREAMS_API)
+        , m_xmlCasingTestBuiltins(&m_vm)
+#endif // ENABLE(STREAMS_API)
+    {
+#if ENABLE(FETCH_API)
+        m_anotherGuardedInternalBuiltinBuiltins.exportNames();
+#endif // ENABLE(FETCH_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+        m_guardedInternalBuiltinBuiltins.exportNames();
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+#if ENABLE(STREAMS_API)
+        m_xmlCasingTestBuiltins.exportNames();
+#endif // ENABLE(STREAMS_API)
+    }
+
+#if ENABLE(FETCH_API)
+    AnotherGuardedInternalBuiltinBuiltinsWrapper& anotherGuardedInternalBuiltinBuiltins() { return m_anotherGuardedInternalBuiltinBuiltins; }
+#endif // ENABLE(FETCH_API)
+#if ENABLE(STREAMS_API) || USE(CF)
+    ArbitraryConditionalGuardBuiltinsWrapper& arbitraryConditionalGuardBuiltins() { return m_arbitraryConditionalGuardBuiltins; }
+#endif // ENABLE(STREAMS_API) || USE(CF)
+#if ENABLE(STREAMS_API)
+    GuardedBuiltinBuiltinsWrapper& guardedBuiltinBuiltins() { return m_guardedBuiltinBuiltins; }
+#endif // ENABLE(STREAMS_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    GuardedInternalBuiltinBuiltinsWrapper& guardedInternalBuiltinBuiltins() { return m_guardedInternalBuiltinBuiltins; }
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    UnguardedBuiltinBuiltinsWrapper& unguardedBuiltinBuiltins() { return m_unguardedBuiltinBuiltins; }
+#if ENABLE(STREAMS_API)
+    XMLCasingTestBuiltinsWrapper& xmlCasingTestBuiltins() { return m_xmlCasingTestBuiltins; }
+#endif // ENABLE(STREAMS_API)
+
+private:
+    JSC::VM& m_vm;
+#if ENABLE(FETCH_API)
+    AnotherGuardedInternalBuiltinBuiltinsWrapper m_anotherGuardedInternalBuiltinBuiltins;
+#endif // ENABLE(FETCH_API)
+#if ENABLE(STREAMS_API) || USE(CF)
+    ArbitraryConditionalGuardBuiltinsWrapper m_arbitraryConditionalGuardBuiltins;
+#endif // ENABLE(STREAMS_API) || USE(CF)
+#if ENABLE(STREAMS_API)
+    GuardedBuiltinBuiltinsWrapper m_guardedBuiltinBuiltins;
+#endif // ENABLE(STREAMS_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    GuardedInternalBuiltinBuiltinsWrapper m_guardedInternalBuiltinBuiltins;
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    UnguardedBuiltinBuiltinsWrapper m_unguardedBuiltinBuiltins;
+#if ENABLE(STREAMS_API)
+    XMLCasingTestBuiltinsWrapper m_xmlCasingTestBuiltins;
+#endif // ENABLE(STREAMS_API)
+};
+
+} // namespace WebCore
+### End File: WebCoreJSBuiltins.h
+
+### Begin File: WebCoreJSBuiltins.cpp
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "AnotherGuardedInternalBuiltinBuiltins.cpp"
+#include "ArbitraryConditionalGuardBuiltins.cpp"
+#include "GuardedBuiltinBuiltins.cpp"
+#include "GuardedInternalBuiltinBuiltins.cpp"
+#include "UnguardedBuiltinBuiltins.cpp"
+#include "xmlCasingTestBuiltins.cpp"
+### End File: WebCoreJSBuiltins.cpp
+
+### Begin File: WebCoreJSBuiltinInternals.h
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#pragma once
+
+#include "AnotherGuardedInternalBuiltinBuiltins.h"
+#include "GuardedInternalBuiltinBuiltins.h"
+#include "xmlCasingTestBuiltins.h"
+#include <heap/WeakInlines.h>
+#include <runtime/VM.h>
+
+namespace WebCore {
+
+class JSDOMGlobalObject;
+
+class JSBuiltinInternalFunctions {
+public:
+    explicit JSBuiltinInternalFunctions(JSC::VM&);
+
+    void visit(JSC::SlotVisitor&);
+    void initialize(JSDOMGlobalObject&);
+
+#if ENABLE(FETCH_API)
+    AnotherGuardedInternalBuiltinBuiltinFunctions& anotherGuardedInternalBuiltin() { return m_anotherGuardedInternalBuiltin; }
+#endif // ENABLE(FETCH_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    GuardedInternalBuiltinBuiltinFunctions& guardedInternalBuiltin() { return m_guardedInternalBuiltin; }
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+#if ENABLE(STREAMS_API)
+    XMLCasingTestBuiltinFunctions& xmlCasingTest() { return m_xmlCasingTest; }
+#endif // ENABLE(STREAMS_API)
+
+private:
+#if ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
+    JSC::VM& m_vm;
+#endif // ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
+#if ENABLE(FETCH_API)
+    AnotherGuardedInternalBuiltinBuiltinFunctions m_anotherGuardedInternalBuiltin;
+#endif // ENABLE(FETCH_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    GuardedInternalBuiltinBuiltinFunctions m_guardedInternalBuiltin;
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+#if ENABLE(STREAMS_API)
+    XMLCasingTestBuiltinFunctions m_xmlCasingTest;
+#endif // ENABLE(STREAMS_API)
+};
+
+} // namespace WebCore
+### End File: WebCoreJSBuiltinInternals.h
+
+### Begin File: WebCoreJSBuiltinInternals.cpp
+/*
+ * Copyright (c) 2015 Canon Inc. All rights reserved.
+ * Copyright (c) 2016 Apple Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ * 
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from JavaScript files for
+// builtins by the script: Source/JavaScriptCore/Scripts/generate-js-builtins.py
+
+#include "config.h"
+#include "WebCoreJSBuiltinInternals.h"
+
+#include "JSDOMGlobalObject.h"
+#include "WebCoreJSClientData.h"
+#include <heap/HeapInlines.h>
+#include <heap/SlotVisitorInlines.h>
+#include <runtime/JSCJSValueInlines.h>
+#include <runtime/StructureInlines.h>
+
+namespace WebCore {
+
+JSBuiltinInternalFunctions::JSBuiltinInternalFunctions(JSC::VM& vm)
+#if ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
+    : m_vm(vm)
+#endif // ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
+#if ENABLE(FETCH_API)
+    , m_anotherGuardedInternalBuiltin(m_vm)
+#endif // ENABLE(FETCH_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    , m_guardedInternalBuiltin(m_vm)
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+#if ENABLE(STREAMS_API)
+    , m_xmlCasingTest(m_vm)
+#endif // ENABLE(STREAMS_API)
+{
+    UNUSED_PARAM(vm);
+}
+
+void JSBuiltinInternalFunctions::visit(JSC::SlotVisitor& visitor)
+{
+#if ENABLE(FETCH_API)
+    m_anotherGuardedInternalBuiltin.visit(visitor);
+#endif // ENABLE(FETCH_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    m_guardedInternalBuiltin.visit(visitor);
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+#if ENABLE(STREAMS_API)
+    m_xmlCasingTest.visit(visitor);
+#endif // ENABLE(STREAMS_API)
+    UNUSED_PARAM(visitor);
+}
+
+void JSBuiltinInternalFunctions::initialize(JSDOMGlobalObject& globalObject)
+{
+    UNUSED_PARAM(globalObject);
+#if ENABLE(FETCH_API)
+    m_anotherGuardedInternalBuiltin.init(globalObject);
+#endif // ENABLE(FETCH_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+    m_guardedInternalBuiltin.init(globalObject);
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+#if ENABLE(STREAMS_API)
+    m_xmlCasingTest.init(globalObject);
+#endif // ENABLE(STREAMS_API)
+
+#if ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
+    JSVMClientData& clientData = *static_cast<JSVMClientData*>(m_vm.clientData);
+    JSDOMGlobalObject::GlobalPropertyInfo staticGlobals[] = {
+#if ENABLE(FETCH_API)
+#define DECLARE_GLOBAL_STATIC(name) \
+    JSDOMGlobalObject::GlobalPropertyInfo( \
+        clientData.builtinFunctions().anotherGuardedInternalBuiltinBuiltins().name##PrivateName(), anotherGuardedInternalBuiltin().m_##name##Function.get() , JSC::DontDelete | JSC::ReadOnly),
+    WEBCORE_FOREACH_ANOTHERGUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_GLOBAL_STATIC)
+#undef DECLARE_GLOBAL_STATIC
+#endif // ENABLE(FETCH_API)
+#if ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+#define DECLARE_GLOBAL_STATIC(name) \
+    JSDOMGlobalObject::GlobalPropertyInfo( \
+        clientData.builtinFunctions().guardedInternalBuiltinBuiltins().name##PrivateName(), guardedInternalBuiltin().m_##name##Function.get() , JSC::DontDelete | JSC::ReadOnly),
+    WEBCORE_FOREACH_GUARDEDINTERNALBUILTIN_BUILTIN_FUNCTION_NAME(DECLARE_GLOBAL_STATIC)
+#undef DECLARE_GLOBAL_STATIC
+#endif // ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API)
+#if ENABLE(STREAMS_API)
+#define DECLARE_GLOBAL_STATIC(name) \
+    JSDOMGlobalObject::GlobalPropertyInfo( \
+        clientData.builtinFunctions().xmlCasingTestBuiltins().name##PrivateName(), xmlCasingTest().m_##name##Function.get() , JSC::DontDelete | JSC::ReadOnly),
+    WEBCORE_FOREACH_XMLCASINGTEST_BUILTIN_FUNCTION_NAME(DECLARE_GLOBAL_STATIC)
+#undef DECLARE_GLOBAL_STATIC
+#endif // ENABLE(STREAMS_API)
+    };
+    globalObject.addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
+    UNUSED_PARAM(clientData);
+#endif // ENABLE(FETCH_API) || ENABLE(READABLE_STREAM_API) || ENABLE(WRITABLE_STREAM_API) || ENABLE(STREAMS_API)
+}
+
+} // namespace WebCore
+### End File: WebCoreJSBuiltinInternals.cpp
diff --git a/Scripts/xxd.pl b/Scripts/xxd.pl
new file mode 100644
index 0000000..5ee08a5
--- /dev/null
+++ b/Scripts/xxd.pl
@@ -0,0 +1,45 @@
+#! /usr/bin/perl
+
+# Copyright (C) 2010-2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    # Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    # Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    # Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+$varname = shift;
+$fname = shift;
+$output = shift;
+
+open($input, '<', $fname) or die "Can't open file for read: $fname $!";
+$/ = undef;
+$text = <$input>;
+close($input);
+
+$text = join(', ', map('0x' . unpack("H*", $_), split(undef, $text)));
+
+open($output, '>', $output) or die "Can't open file for write: $output $!";
+print $output "const unsigned char $varname\[\] = {\n$text\n};\n";
+close($output);
diff --git a/THANKS b/THANKS
new file mode 100644
index 0000000..b9a9649
--- /dev/null
+++ b/THANKS
@@ -0,0 +1,8 @@
+
+I would like to thank the following people for their help:
+
+Richard Moore <rich@kde.org> - for filling the Math object with some life
+Daegeun Lee <realking@mizi.com> - for pointing out some bugs and providing
+                                  much code for the String and Date object.
+Marco Pinelli <pinmc@libero.it> - for his patches
+Christian Kirsch <ck@held.mind.de> - for his contribution to the Date object
diff --git a/assembler/ARM64Assembler.h b/assembler/ARM64Assembler.h
new file mode 100644
index 0000000..29d5bce
--- /dev/null
+++ b/assembler/ARM64Assembler.h
@@ -0,0 +1,3626 @@
+/*
+ * Copyright (C) 2012, 2014, 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(ARM64)
+
+#include "AssemblerBuffer.h"
+#include "AssemblerCommon.h"
+#include <limits.h>
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+#include <stdint.h>
+
+#define CHECK_DATASIZE_OF(datasize) ASSERT(datasize == 32 || datasize == 64)
+#define DATASIZE_OF(datasize) ((datasize == 64) ? Datasize_64 : Datasize_32)
+#define MEMOPSIZE_OF(datasize) ((datasize == 8 || datasize == 128) ? MemOpSize_8_or_128 : (datasize == 16) ? MemOpSize_16 : (datasize == 32) ? MemOpSize_32 : MemOpSize_64)
+#define CHECK_DATASIZE() CHECK_DATASIZE_OF(datasize)
+#define CHECK_VECTOR_DATASIZE() ASSERT(datasize == 64 || datasize == 128)
+#define DATASIZE DATASIZE_OF(datasize)
+#define MEMOPSIZE MEMOPSIZE_OF(datasize)
+#define CHECK_FP_MEMOP_DATASIZE() ASSERT(datasize == 8 || datasize == 16 || datasize == 32 || datasize == 64 || datasize == 128)
+#define MEMPAIROPSIZE_INT(datasize) ((datasize == 64) ? MemPairOp_64 : MemPairOp_32)
+#define MEMPAIROPSIZE_FP(datasize) ((datasize == 128) ? MemPairOp_V128 : (datasize == 64) ? MemPairOp_V64 : MemPairOp_32)
+
+namespace JSC {
+
+ALWAYS_INLINE bool isInt7(int32_t value)
+{
+    return value == ((value << 25) >> 25);
+}
+
+ALWAYS_INLINE bool isInt11(int32_t value)
+{
+    return value == ((value << 21) >> 21);
+}
+
+ALWAYS_INLINE bool isUInt5(int32_t value)
+{
+    return !(value & ~0x1f);
+}
+
+class UInt5 {
+public:
+    explicit UInt5(int value)
+        : m_value(value)
+    {
+        ASSERT(isUInt5(value));
+    }
+
+    operator int() { return m_value; }
+
+private:
+    int m_value;
+};
+
+class UInt12 {
+public:
+    explicit UInt12(int value)
+        : m_value(value)
+    {
+        ASSERT(isUInt12(value));
+    }
+
+    operator int() { return m_value; }
+
+private:
+    int m_value;
+};
+
+class PostIndex {
+public:
+    explicit PostIndex(int value)
+        : m_value(value)
+    {
+        ASSERT(isInt9(value));
+    }
+
+    operator int() { return m_value; }
+
+private:
+    int m_value;
+};
+
+class PreIndex {
+public:
+    explicit PreIndex(int value)
+        : m_value(value)
+    {
+        ASSERT(isInt9(value));
+    }
+
+    operator int() { return m_value; }
+
+private:
+    int m_value;
+};
+
+class PairPostIndex {
+public:
+    explicit PairPostIndex(int value)
+        : m_value(value)
+    {
+        ASSERT(isInt11(value));
+    }
+
+    operator int() { return m_value; }
+
+private:
+    int m_value;
+};
+
+class PairPreIndex {
+public:
+    explicit PairPreIndex(int value)
+        : m_value(value)
+    {
+        ASSERT(isInt11(value));
+    }
+
+    operator int() { return m_value; }
+
+private:
+    int m_value;
+};
+
+typedef ARM64LogicalImmediate LogicalImmediate;
+
+inline uint16_t getHalfword(uint64_t value, int which)
+{
+    return value >> (which << 4);
+}
+
+namespace ARM64Registers {
+
+#define FOR_EACH_CPU_REGISTER(V) \
+    FOR_EACH_CPU_GPREGISTER(V) \
+    FOR_EACH_CPU_SPECIAL_REGISTER(V) \
+    FOR_EACH_CPU_FPREGISTER(V)
+
+// The following are defined as pairs of the following value:
+// 1. type of the storage needed to save the register value by the JIT probe.
+// 2. name of the register.
+#define FOR_EACH_CPU_GPREGISTER(V) \
+    /* Parameter/result registers */ \
+    V(void*, x0) \
+    V(void*, x1) \
+    V(void*, x2) \
+    V(void*, x3) \
+    V(void*, x4) \
+    V(void*, x5) \
+    V(void*, x6) \
+    V(void*, x7) \
+    /* Indirect result location register */ \
+    V(void*, x8) \
+    /* Temporary registers */ \
+    V(void*, x9) \
+    V(void*, x10) \
+    V(void*, x11) \
+    V(void*, x12) \
+    V(void*, x13) \
+    V(void*, x14) \
+    V(void*, x15) \
+    /* Intra-procedure-call scratch registers (temporary) */ \
+    V(void*, x16) \
+    V(void*, x17) \
+    /* Platform Register (temporary) */ \
+    V(void*, x18) \
+    /* Callee-saved */ \
+    V(void*, x19) \
+    V(void*, x20) \
+    V(void*, x21) \
+    V(void*, x22) \
+    V(void*, x23) \
+    V(void*, x24) \
+    V(void*, x25) \
+    V(void*, x26) \
+    V(void*, x27) \
+    V(void*, x28) \
+    /* Special */ \
+    V(void*, fp) \
+    V(void*, lr) \
+    V(void*, sp)
+
+#define FOR_EACH_CPU_SPECIAL_REGISTER(V) \
+    V(void*, pc) \
+    V(void*, nzcv) \
+    V(void*, fpsr) \
+
+// ARM64 always has 32 FPU registers 128-bits each. See http://llvm.org/devmtg/2012-11/Northover-AArch64.pdf
+// and Section 5.1.2 in http://infocenter.arm.com/help/topic/com.arm.doc.ihi0055b/IHI0055B_aapcs64.pdf.
+// However, we only use them for 64-bit doubles.
+#define FOR_EACH_CPU_FPREGISTER(V) \
+    /* Parameter/result registers */ \
+    V(double, q0) \
+    V(double, q1) \
+    V(double, q2) \
+    V(double, q3) \
+    V(double, q4) \
+    V(double, q5) \
+    V(double, q6) \
+    V(double, q7) \
+    /* Callee-saved (up to 64-bits only!) */ \
+    V(double, q8) \
+    V(double, q9) \
+    V(double, q10) \
+    V(double, q11) \
+    V(double, q12) \
+    V(double, q13) \
+    V(double, q14) \
+    V(double, q15) \
+    /* Temporary registers */ \
+    V(double, q16) \
+    V(double, q17) \
+    V(double, q18) \
+    V(double, q19) \
+    V(double, q20) \
+    V(double, q21) \
+    V(double, q22) \
+    V(double, q23) \
+    V(double, q24) \
+    V(double, q25) \
+    V(double, q26) \
+    V(double, q27) \
+    V(double, q28) \
+    V(double, q29) \
+    V(double, q30) \
+    V(double, q31)
+
+typedef enum {
+    #define DECLARE_REGISTER(_type, _regName) _regName,
+    FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
+    #undef DECLARE_REGISTER
+
+    ip0 = x16,
+    ip1 = x17,
+    x29 = fp,
+    x30 = lr,
+    zr = 0x3f,
+} RegisterID;
+
+typedef enum {
+    #define DECLARE_REGISTER(_type, _regName) _regName,
+    FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
+    #undef DECLARE_REGISTER
+} FPRegisterID;
+
+static constexpr bool isSp(RegisterID reg) { return reg == sp; }
+static constexpr bool isZr(RegisterID reg) { return reg == zr; }
+
+} // namespace ARM64Registers
+
+class ARM64Assembler {
+public:
+    typedef ARM64Registers::RegisterID RegisterID;
+    typedef ARM64Registers::FPRegisterID FPRegisterID;
+    
+    static constexpr RegisterID firstRegister() { return ARM64Registers::x0; }
+    static constexpr RegisterID lastRegister() { return ARM64Registers::sp; }
+    
+    static constexpr FPRegisterID firstFPRegister() { return ARM64Registers::q0; }
+    static constexpr FPRegisterID lastFPRegister() { return ARM64Registers::q31; }
+
+private:
+    static constexpr bool isSp(RegisterID reg) { return ARM64Registers::isSp(reg); }
+    static constexpr bool isZr(RegisterID reg) { return ARM64Registers::isZr(reg); }
+
+public:
+    ARM64Assembler()
+        : m_indexOfLastWatchpoint(INT_MIN)
+        , m_indexOfTailOfLastWatchpoint(INT_MIN)
+    {
+    }
+    
+    AssemblerBuffer& buffer() { return m_buffer; }
+
+    // (HS, LO, HI, LS) -> (AE, B, A, BE)
+    // (VS, VC) -> (O, NO)
+    typedef enum {
+        ConditionEQ,
+        ConditionNE,
+        ConditionHS, ConditionCS = ConditionHS,
+        ConditionLO, ConditionCC = ConditionLO,
+        ConditionMI,
+        ConditionPL,
+        ConditionVS,
+        ConditionVC,
+        ConditionHI,
+        ConditionLS,
+        ConditionGE,
+        ConditionLT,
+        ConditionGT,
+        ConditionLE,
+        ConditionAL,
+        ConditionInvalid
+    } Condition;
+
+    static Condition invert(Condition cond)
+    {
+        return static_cast<Condition>(cond ^ 1);
+    }
+
+    typedef enum {
+        LSL,
+        LSR,
+        ASR,
+        ROR
+    } ShiftType;
+
+    typedef enum {
+        UXTB,
+        UXTH,
+        UXTW,
+        UXTX,
+        SXTB,
+        SXTH,
+        SXTW,
+        SXTX
+    } ExtendType;
+
+    enum SetFlags {
+        DontSetFlags,
+        S
+    };
+
+#define JUMP_ENUM_WITH_SIZE(index, value) (((value) << 4) | (index))
+#define JUMP_ENUM_SIZE(jump) ((jump) >> 4)
+    enum JumpType { JumpFixed = JUMP_ENUM_WITH_SIZE(0, 0),
+        JumpNoCondition = JUMP_ENUM_WITH_SIZE(1, 1 * sizeof(uint32_t)),
+        JumpCondition = JUMP_ENUM_WITH_SIZE(2, 2 * sizeof(uint32_t)),
+        JumpCompareAndBranch = JUMP_ENUM_WITH_SIZE(3, 2 * sizeof(uint32_t)),
+        JumpTestBit = JUMP_ENUM_WITH_SIZE(4, 2 * sizeof(uint32_t)),
+        JumpNoConditionFixedSize = JUMP_ENUM_WITH_SIZE(5, 1 * sizeof(uint32_t)),
+        JumpConditionFixedSize = JUMP_ENUM_WITH_SIZE(6, 2 * sizeof(uint32_t)),
+        JumpCompareAndBranchFixedSize = JUMP_ENUM_WITH_SIZE(7, 2 * sizeof(uint32_t)),
+        JumpTestBitFixedSize = JUMP_ENUM_WITH_SIZE(8, 2 * sizeof(uint32_t)),
+    };
+    enum JumpLinkType {
+        LinkInvalid = JUMP_ENUM_WITH_SIZE(0, 0),
+        LinkJumpNoCondition = JUMP_ENUM_WITH_SIZE(1, 1 * sizeof(uint32_t)),
+        LinkJumpConditionDirect = JUMP_ENUM_WITH_SIZE(2, 1 * sizeof(uint32_t)),
+        LinkJumpCondition = JUMP_ENUM_WITH_SIZE(3, 2 * sizeof(uint32_t)),
+        LinkJumpCompareAndBranch = JUMP_ENUM_WITH_SIZE(4, 2 * sizeof(uint32_t)),
+        LinkJumpCompareAndBranchDirect = JUMP_ENUM_WITH_SIZE(5, 1 * sizeof(uint32_t)),
+        LinkJumpTestBit = JUMP_ENUM_WITH_SIZE(6, 2 * sizeof(uint32_t)),
+        LinkJumpTestBitDirect = JUMP_ENUM_WITH_SIZE(7, 1 * sizeof(uint32_t)),
+    };
+
+    class LinkRecord {
+    public:
+        LinkRecord(intptr_t from, intptr_t to, JumpType type, Condition condition)
+        {
+            data.realTypes.m_from = from;
+            data.realTypes.m_to = to;
+            data.realTypes.m_type = type;
+            data.realTypes.m_linkType = LinkInvalid;
+            data.realTypes.m_condition = condition;
+        }
+        LinkRecord(intptr_t from, intptr_t to, JumpType type, Condition condition, bool is64Bit, RegisterID compareRegister)
+        {
+            data.realTypes.m_from = from;
+            data.realTypes.m_to = to;
+            data.realTypes.m_type = type;
+            data.realTypes.m_linkType = LinkInvalid;
+            data.realTypes.m_condition = condition;
+            data.realTypes.m_is64Bit = is64Bit;
+            data.realTypes.m_compareRegister = compareRegister;
+        }
+        LinkRecord(intptr_t from, intptr_t to, JumpType type, Condition condition, unsigned bitNumber, RegisterID compareRegister)
+        {
+            data.realTypes.m_from = from;
+            data.realTypes.m_to = to;
+            data.realTypes.m_type = type;
+            data.realTypes.m_linkType = LinkInvalid;
+            data.realTypes.m_condition = condition;
+            data.realTypes.m_bitNumber = bitNumber;
+            data.realTypes.m_compareRegister = compareRegister;
+        }
+        void operator=(const LinkRecord& other)
+        {
+            data.copyTypes.content[0] = other.data.copyTypes.content[0];
+            data.copyTypes.content[1] = other.data.copyTypes.content[1];
+            data.copyTypes.content[2] = other.data.copyTypes.content[2];
+        }
+        intptr_t from() const { return data.realTypes.m_from; }
+        void setFrom(intptr_t from) { data.realTypes.m_from = from; }
+        intptr_t to() const { return data.realTypes.m_to; }
+        JumpType type() const { return data.realTypes.m_type; }
+        JumpLinkType linkType() const { return data.realTypes.m_linkType; }
+        void setLinkType(JumpLinkType linkType) { ASSERT(data.realTypes.m_linkType == LinkInvalid); data.realTypes.m_linkType = linkType; }
+        Condition condition() const { return data.realTypes.m_condition; }
+        bool is64Bit() const { return data.realTypes.m_is64Bit; }
+        unsigned bitNumber() const { return data.realTypes.m_bitNumber; }
+        RegisterID compareRegister() const { return data.realTypes.m_compareRegister; }
+
+    private:
+        union {
+            struct RealTypes {
+                intptr_t m_from : 48;
+                intptr_t m_to : 48;
+                JumpType m_type : 8;
+                JumpLinkType m_linkType : 8;
+                Condition m_condition : 4;
+                unsigned m_bitNumber : 6;
+                RegisterID m_compareRegister : 6;
+                bool m_is64Bit : 1;
+            } realTypes;
+            struct CopyTypes {
+                uint64_t content[3];
+            } copyTypes;
+            COMPILE_ASSERT(sizeof(RealTypes) == sizeof(CopyTypes), LinkRecordCopyStructSizeEqualsRealStruct);
+        } data;
+    };
+
+    // bits(N) VFPExpandImm(bits(8) imm8);
+    //
+    // Encoding of floating point immediates is a litte complicated. Here's a
+    // high level description:
+    //     +/-m*2-n where m and n are integers, 16 <= m <= 31, 0 <= n <= 7
+    // and the algirithm for expanding to a single precision float:
+    //     return imm8<7>:NOT(imm8<6>):Replicate(imm8<6>,5):imm8<5:0>:Zeros(19);
+    //
+    // The trickiest bit is how the exponent is handled. The following table
+    // may help clarify things a little:
+    //     654
+    //     100 01111100 124 -3 1020 01111111100
+    //     101 01111101 125 -2 1021 01111111101
+    //     110 01111110 126 -1 1022 01111111110
+    //     111 01111111 127  0 1023 01111111111
+    //     000 10000000 128  1 1024 10000000000
+    //     001 10000001 129  2 1025 10000000001
+    //     010 10000010 130  3 1026 10000000010
+    //     011 10000011 131  4 1027 10000000011
+    // The first column shows the bit pattern stored in bits 6-4 of the arm
+    // encoded immediate. The second column shows the 8-bit IEEE 754 single
+    // -precision exponent in binary, the third column shows the raw decimal
+    // value. IEEE 754 single-precision numbers are stored with a bias of 127
+    // to the exponent, so the fourth column shows the resulting exponent.
+    // From this was can see that the exponent can be in the range -3..4,
+    // which agrees with the high level description given above. The fifth
+    // and sixth columns shows the value stored in a IEEE 754 double-precision
+    // number to represent these exponents in decimal and binary, given the
+    // bias of 1023.
+    //
+    // Ultimately, detecting doubles that can be encoded as immediates on arm
+    // and encoding doubles is actually not too bad. A floating point value can
+    // be encoded by retaining the sign bit, the low three bits of the exponent
+    // and the high 4 bits of the mantissa. To validly be able to encode an
+    // immediate the remainder of the mantissa must be zero, and the high part
+    // of the exponent must match the top bit retained, bar the highest bit
+    // which must be its inverse.
+    static bool canEncodeFPImm(double d)
+    {
+        // Discard the sign bit, the low two bits of the exponent & the highest
+        // four bits of the mantissa.
+        uint64_t masked = bitwise_cast<uint64_t>(d) & 0x7fc0ffffffffffffull;
+        return (masked == 0x3fc0000000000000ull) || (masked == 0x4000000000000000ull);
+    }
+
+    template<int datasize>
+    static bool canEncodePImmOffset(int32_t offset)
+    {
+        return isValidScaledUImm12<datasize>(offset);
+    }
+
+    static bool canEncodeSImmOffset(int32_t offset)
+    {
+        return isValidSignedImm9(offset);
+    }
+
+private:
+    int encodeFPImm(double d)
+    {
+        ASSERT(canEncodeFPImm(d));
+        uint64_t u64 = bitwise_cast<uint64_t>(d);
+        return (static_cast<int>(u64 >> 56) & 0x80) | (static_cast<int>(u64 >> 48) & 0x7f);
+    }
+
+    template<int datasize>
+    int encodeShiftAmount(int amount)
+    {
+        ASSERT(!amount || datasize == (8 << amount));
+        return amount;
+    }
+
+    template<int datasize>
+    static int encodePositiveImmediate(unsigned pimm)
+    {
+        ASSERT(!(pimm & ((datasize / 8) - 1)));
+        return pimm / (datasize / 8);
+    }
+
+    enum Datasize {
+        Datasize_32,
+        Datasize_64,
+        Datasize_64_top,
+        Datasize_16
+    };
+
+    enum MemOpSize {
+        MemOpSize_8_or_128,
+        MemOpSize_16,
+        MemOpSize_32,
+        MemOpSize_64,
+    };
+
+    enum BranchType {
+        BranchType_JMP,
+        BranchType_CALL,
+        BranchType_RET
+    };
+
+    enum AddOp {
+        AddOp_ADD,
+        AddOp_SUB
+    };
+
+    enum BitfieldOp {
+        BitfieldOp_SBFM,
+        BitfieldOp_BFM,
+        BitfieldOp_UBFM
+    };
+
+    enum DataOp1Source {
+        DataOp_RBIT,
+        DataOp_REV16,
+        DataOp_REV32,
+        DataOp_REV64,
+        DataOp_CLZ,
+        DataOp_CLS
+    };
+
+    enum DataOp2Source {
+        DataOp_UDIV = 2,
+        DataOp_SDIV = 3,
+        DataOp_LSLV = 8,
+        DataOp_LSRV = 9,
+        DataOp_ASRV = 10,
+        DataOp_RORV = 11
+    };
+
+    enum DataOp3Source {
+        DataOp_MADD = 0,
+        DataOp_MSUB = 1,
+        DataOp_SMADDL = 2,
+        DataOp_SMSUBL = 3,
+        DataOp_SMULH = 4,
+        DataOp_UMADDL = 10,
+        DataOp_UMSUBL = 11,
+        DataOp_UMULH = 12
+    };
+
+    enum ExcepnOp {
+        ExcepnOp_EXCEPTION = 0,
+        ExcepnOp_BREAKPOINT = 1,
+        ExcepnOp_HALT = 2,
+        ExcepnOp_DCPS = 5
+    };
+
+    enum FPCmpOp {
+        FPCmpOp_FCMP = 0x00,
+        FPCmpOp_FCMP0 = 0x08,
+        FPCmpOp_FCMPE = 0x10,
+        FPCmpOp_FCMPE0 = 0x18
+    };
+
+    enum FPCondCmpOp {
+        FPCondCmpOp_FCMP,
+        FPCondCmpOp_FCMPE
+    };
+
+    enum FPDataOp1Source {
+        FPDataOp_FMOV = 0,
+        FPDataOp_FABS = 1,
+        FPDataOp_FNEG = 2,
+        FPDataOp_FSQRT = 3,
+        FPDataOp_FCVT_toSingle = 4,
+        FPDataOp_FCVT_toDouble = 5,
+        FPDataOp_FCVT_toHalf = 7,
+        FPDataOp_FRINTN = 8,
+        FPDataOp_FRINTP = 9,
+        FPDataOp_FRINTM = 10,
+        FPDataOp_FRINTZ = 11,
+        FPDataOp_FRINTA = 12,
+        FPDataOp_FRINTX = 14,
+        FPDataOp_FRINTI = 15
+    };
+
+    enum FPDataOp2Source {
+        FPDataOp_FMUL,
+        FPDataOp_FDIV,
+        FPDataOp_FADD,
+        FPDataOp_FSUB,
+        FPDataOp_FMAX,
+        FPDataOp_FMIN,
+        FPDataOp_FMAXNM,
+        FPDataOp_FMINNM,
+        FPDataOp_FNMUL
+    };
+
+    enum SIMD3Same {
+        SIMD_LogicalOp_AND = 0x03
+    };
+
+    enum FPIntConvOp {
+        FPIntConvOp_FCVTNS = 0x00,
+        FPIntConvOp_FCVTNU = 0x01,
+        FPIntConvOp_SCVTF = 0x02,
+        FPIntConvOp_UCVTF = 0x03,
+        FPIntConvOp_FCVTAS = 0x04,
+        FPIntConvOp_FCVTAU = 0x05,
+        FPIntConvOp_FMOV_QtoX = 0x06,
+        FPIntConvOp_FMOV_XtoQ = 0x07,
+        FPIntConvOp_FCVTPS = 0x08,
+        FPIntConvOp_FCVTPU = 0x09,
+        FPIntConvOp_FMOV_QtoX_top = 0x0e,
+        FPIntConvOp_FMOV_XtoQ_top = 0x0f,
+        FPIntConvOp_FCVTMS = 0x10,
+        FPIntConvOp_FCVTMU = 0x11,
+        FPIntConvOp_FCVTZS = 0x18,
+        FPIntConvOp_FCVTZU = 0x19,
+    };
+
+    enum LogicalOp {
+        LogicalOp_AND,
+        LogicalOp_ORR,
+        LogicalOp_EOR,
+        LogicalOp_ANDS
+    };
+
+    enum MemOp {
+        MemOp_STORE,
+        MemOp_LOAD,
+        MemOp_STORE_V128, 
+        MemOp_LOAD_V128,
+        MemOp_PREFETCH = 2, // size must be 3
+        MemOp_LOAD_signed64 = 2, // size may be 0, 1 or 2
+        MemOp_LOAD_signed32 = 3 // size may be 0 or 1
+    };
+
+    enum MemPairOpSize {
+        MemPairOp_32 = 0,
+        MemPairOp_LoadSigned_32 = 1,
+        MemPairOp_64 = 2,
+
+        MemPairOp_V32 = MemPairOp_32,
+        MemPairOp_V64 = 1,
+        MemPairOp_V128 = 2
+    };
+
+    enum MoveWideOp {
+        MoveWideOp_N = 0,
+        MoveWideOp_Z = 2,
+        MoveWideOp_K = 3 
+    };
+
+    enum LdrLiteralOp {
+        LdrLiteralOp_32BIT = 0,
+        LdrLiteralOp_64BIT = 1,
+        LdrLiteralOp_LDRSW = 2,
+        LdrLiteralOp_128BIT = 2
+    };
+
+    static unsigned memPairOffsetShift(bool V, MemPairOpSize size)
+    {
+        // return the log2 of the size in bytes, e.g. 64 bit size returns 3
+        if (V)
+            return size + 2;
+        return (size >> 1) + 2;
+    }
+
+public:
+    // Integer Instructions:
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void adc(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        insn(addSubtractWithCarry(DATASIZE, AddOp_ADD, setFlags, rm, rn, rd));
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void add(RegisterID rd, RegisterID rn, UInt12 imm12, int shift = 0)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!shift || shift == 12);
+        insn(addSubtractImmediate(DATASIZE, AddOp_ADD, setFlags, shift == 12, imm12, rn, rd));
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void add(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        add<datasize, setFlags>(rd, rn, rm, LSL, 0);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void add(RegisterID rd, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(addSubtractExtendedRegister(DATASIZE, AddOp_ADD, setFlags, rm, extend, amount, rn, rd));
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void add(RegisterID rd, RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        CHECK_DATASIZE();
+        if (isSp(rd) || isSp(rn)) {
+            ASSERT(shift == LSL);
+            ASSERT(!isSp(rm));
+            add<datasize, setFlags>(rd, rn, rm, UXTX, amount);
+        } else
+            insn(addSubtractShiftedRegister(DATASIZE, AddOp_ADD, setFlags, shift, rm, amount, rn, rd));
+    }
+
+    ALWAYS_INLINE void adr(RegisterID rd, int offset)
+    {
+        insn(pcRelative(false, offset, rd));
+    }
+
+    ALWAYS_INLINE void adrp(RegisterID rd, int offset)
+    {
+        ASSERT(!(offset & 0xfff));
+        insn(pcRelative(true, offset >> 12, rd));
+        nopCortexA53Fix843419();
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void and_(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        and_<datasize, setFlags>(rd, rn, rm, LSL, 0);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void and_(RegisterID rd, RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(logicalShiftedRegister(DATASIZE, setFlags ? LogicalOp_ANDS : LogicalOp_AND, shift, false, rm, amount, rn, rd));
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void and_(RegisterID rd, RegisterID rn, LogicalImmediate imm)
+    {
+        CHECK_DATASIZE();
+        insn(logicalImmediate(DATASIZE, setFlags ? LogicalOp_ANDS : LogicalOp_AND, imm.value(), rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void asr(RegisterID rd, RegisterID rn, int shift)
+    {
+        ASSERT(shift < datasize);
+        sbfm<datasize>(rd, rn, shift, datasize - 1);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void asr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        asrv<datasize>(rd, rn, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void asrv(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing2Source(DATASIZE, rm, DataOp_ASRV, rn, rd));
+    }
+
+    ALWAYS_INLINE void b(int32_t offset = 0)
+    {
+        ASSERT(!(offset & 3));
+        offset >>= 2;
+        ASSERT(offset == (offset << 6) >> 6);
+        insn(unconditionalBranchImmediate(false, offset));
+    }
+
+    ALWAYS_INLINE void b_cond(Condition cond, int32_t offset = 0)
+    {
+        ASSERT(!(offset & 3));
+        offset >>= 2;
+        ASSERT(offset == (offset << 13) >> 13);
+        insn(conditionalBranchImmediate(offset, cond));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void bfi(RegisterID rd, RegisterID rn, int lsb, int width)
+    {
+        bfm<datasize>(rd, rn, (datasize - lsb) & (datasize - 1), width - 1);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void bfm(RegisterID rd, RegisterID rn, int immr, int imms)
+    {
+        CHECK_DATASIZE();
+        insn(bitfield(DATASIZE, BitfieldOp_BFM, immr, imms, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void bfxil(RegisterID rd, RegisterID rn, int lsb, int width)
+    {
+        bfm<datasize>(rd, rn, lsb, lsb + width - 1);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void bic(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        bic<datasize, setFlags>(rd, rn, rm, LSL, 0);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void bic(RegisterID rd, RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(logicalShiftedRegister(DATASIZE, setFlags ? LogicalOp_ANDS : LogicalOp_AND, shift, true, rm, amount, rn, rd));
+    }
+
+    ALWAYS_INLINE void bl(int32_t offset = 0)
+    {
+        ASSERT(!(offset & 3));
+        offset >>= 2;
+        insn(unconditionalBranchImmediate(true, offset));
+    }
+
+    ALWAYS_INLINE void blr(RegisterID rn)
+    {
+        insn(unconditionalBranchRegister(BranchType_CALL, rn));
+    }
+
+    ALWAYS_INLINE void br(RegisterID rn)
+    {
+        insn(unconditionalBranchRegister(BranchType_JMP, rn));
+    }
+
+    ALWAYS_INLINE void brk(uint16_t imm)
+    {
+        insn(excepnGeneration(ExcepnOp_BREAKPOINT, imm, 0));
+    }
+    
+    template<int datasize>
+    ALWAYS_INLINE void cbnz(RegisterID rt, int32_t offset = 0)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!(offset & 3));
+        offset >>= 2;
+        insn(compareAndBranchImmediate(DATASIZE, true, offset, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cbz(RegisterID rt, int32_t offset = 0)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!(offset & 3));
+        offset >>= 2;
+        insn(compareAndBranchImmediate(DATASIZE, false, offset, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ccmn(RegisterID rn, RegisterID rm, int nzcv, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(conditionalCompareRegister(DATASIZE, AddOp_ADD, rm, cond, rn, nzcv));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ccmn(RegisterID rn, UInt5 imm, int nzcv, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(conditionalCompareImmediate(DATASIZE, AddOp_ADD, imm, cond, rn, nzcv));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ccmp(RegisterID rn, RegisterID rm, int nzcv, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(conditionalCompareRegister(DATASIZE, AddOp_SUB, rm, cond, rn, nzcv));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ccmp(RegisterID rn, UInt5 imm, int nzcv, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(conditionalCompareImmediate(DATASIZE, AddOp_SUB, imm, cond, rn, nzcv));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cinc(RegisterID rd, RegisterID rn, Condition cond)
+    {
+        csinc<datasize>(rd, rn, rn, invert(cond));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cinv(RegisterID rd, RegisterID rn, Condition cond)
+    {
+        csinv<datasize>(rd, rn, rn, invert(cond));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cls(RegisterID rd, RegisterID rn)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing1Source(DATASIZE, DataOp_CLS, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void clz(RegisterID rd, RegisterID rn)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing1Source(DATASIZE, DataOp_CLZ, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cmn(RegisterID rn, UInt12 imm12, int shift = 0)
+    {
+        add<datasize, S>(ARM64Registers::zr, rn, imm12, shift);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cmn(RegisterID rn, RegisterID rm)
+    {
+        add<datasize, S>(ARM64Registers::zr, rn, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cmn(RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        add<datasize, S>(ARM64Registers::zr, rn, rm, extend, amount);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cmn(RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        add<datasize, S>(ARM64Registers::zr, rn, rm, shift, amount);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cmp(RegisterID rn, UInt12 imm12, int shift = 0)
+    {
+        sub<datasize, S>(ARM64Registers::zr, rn, imm12, shift);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cmp(RegisterID rn, RegisterID rm)
+    {
+        sub<datasize, S>(ARM64Registers::zr, rn, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cmp(RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        sub<datasize, S>(ARM64Registers::zr, rn, rm, extend, amount);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cmp(RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        sub<datasize, S>(ARM64Registers::zr, rn, rm, shift, amount);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cneg(RegisterID rd, RegisterID rn, Condition cond)
+    {
+        csneg<datasize>(rd, rn, rn, invert(cond));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void csel(RegisterID rd, RegisterID rn, RegisterID rm, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(conditionalSelect(DATASIZE, false, rm, cond, false, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void cset(RegisterID rd, Condition cond)
+    {
+        csinc<datasize>(rd, ARM64Registers::zr, ARM64Registers::zr, invert(cond));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void csetm(RegisterID rd, Condition cond)
+    {
+        csinv<datasize>(rd, ARM64Registers::zr, ARM64Registers::zr, invert(cond));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void csinc(RegisterID rd, RegisterID rn, RegisterID rm, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(conditionalSelect(DATASIZE, false, rm, cond, true, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void csinv(RegisterID rd, RegisterID rn, RegisterID rm, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(conditionalSelect(DATASIZE, true, rm, cond, false, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void csneg(RegisterID rd, RegisterID rn, RegisterID rm, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(conditionalSelect(DATASIZE, true, rm, cond, true, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void eon(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        eon<datasize>(rd, rn, rm, LSL, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void eon(RegisterID rd, RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(logicalShiftedRegister(DATASIZE, LogicalOp_EOR, shift, true, rm, amount, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void eor(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        eor<datasize>(rd, rn, rm, LSL, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void eor(RegisterID rd, RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(logicalShiftedRegister(DATASIZE, LogicalOp_EOR, shift, false, rm, amount, rn, rd));
+    }
+    
+    template<int datasize>
+    ALWAYS_INLINE void eor(RegisterID rd, RegisterID rn, LogicalImmediate imm)
+    {
+        CHECK_DATASIZE();
+        insn(logicalImmediate(DATASIZE, LogicalOp_EOR, imm.value(), rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void extr(RegisterID rd, RegisterID rn, RegisterID rm, int lsb)
+    {
+        CHECK_DATASIZE();
+        insn(extract(DATASIZE, rm, lsb, rn, rd));
+    }
+
+    ALWAYS_INLINE void hint(int imm)
+    {
+        insn(hintPseudo(imm));
+    }
+
+    ALWAYS_INLINE void hlt(uint16_t imm)
+    {
+        insn(excepnGeneration(ExcepnOp_HALT, imm, 0));
+    }
+
+    // Only used for testing purposes.
+    void illegalInstruction()
+    {
+        insn(0x0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldp(RegisterID rt, RegisterID rt2, RegisterID rn, PairPostIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPairPostIndex(MEMPAIROPSIZE_INT(datasize), false, MemOp_LOAD, simm, rn, rt, rt2));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldp(RegisterID rt, RegisterID rt2, RegisterID rn, PairPreIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPairPreIndex(MEMPAIROPSIZE_INT(datasize), false, MemOp_LOAD, simm, rn, rt, rt2));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldp(RegisterID rt, RegisterID rt2, RegisterID rn, unsigned pimm = 0)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPairOffset(MEMPAIROPSIZE_INT(datasize), false, MemOp_LOAD, pimm, rn, rt, rt2));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldnp(RegisterID rt, RegisterID rt2, RegisterID rn, unsigned pimm = 0)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPairNonTemporal(MEMPAIROPSIZE_INT(datasize), false, MemOp_LOAD, pimm, rn, rt, rt2));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        ldr<datasize>(rt, rn, rm, UXTX, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterRegisterOffset(MEMOPSIZE, false, MemOp_LOAD, rm, extend, encodeShiftAmount<datasize>(amount), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnsignedImmediate(MEMOPSIZE, false, MemOp_LOAD, encodePositiveImmediate<datasize>(pimm), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPostIndex(MEMOPSIZE, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPreIndex(MEMOPSIZE, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr_literal(RegisterID rt, int offset = 0)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!(offset & 3));
+        insn(loadRegisterLiteral(datasize == 64 ? LdrLiteralOp_64BIT : LdrLiteralOp_32BIT, false, offset >> 2, rt));
+    }
+
+    ALWAYS_INLINE void ldrb(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        // Not calling the 5 argument form of ldrb, since is amount is ommitted S is false.
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_8_or_128, false, MemOp_LOAD, rm, UXTX, false, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrb(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        ASSERT_UNUSED(amount, !amount);
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_8_or_128, false, MemOp_LOAD, rm, extend, true, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrb(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        insn(loadStoreRegisterUnsignedImmediate(MemOpSize_8_or_128, false, MemOp_LOAD, encodePositiveImmediate<8>(pimm), rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrb(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        insn(loadStoreRegisterPostIndex(MemOpSize_8_or_128, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrb(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        insn(loadStoreRegisterPreIndex(MemOpSize_8_or_128, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrh(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        ldrh(rt, rn, rm, UXTX, 0);
+    }
+
+    ALWAYS_INLINE void ldrh(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        ASSERT(!amount || amount == 1);
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_16, false, MemOp_LOAD, rm, extend, amount == 1, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrh(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        insn(loadStoreRegisterUnsignedImmediate(MemOpSize_16, false, MemOp_LOAD, encodePositiveImmediate<16>(pimm), rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrh(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        insn(loadStoreRegisterPostIndex(MemOpSize_16, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrh(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        insn(loadStoreRegisterPreIndex(MemOpSize_16, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsb(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        // Not calling the 5 argument form of ldrsb, since is amount is ommitted S is false.
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_8_or_128, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, rm, UXTX, false, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsb(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        CHECK_DATASIZE();
+        ASSERT_UNUSED(amount, !amount);
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_8_or_128, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, rm, extend, true, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsb(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnsignedImmediate(MemOpSize_8_or_128, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, encodePositiveImmediate<8>(pimm), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsb(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPostIndex(MemOpSize_8_or_128, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsb(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPreIndex(MemOpSize_8_or_128, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsh(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        ldrsh<datasize>(rt, rn, rm, UXTX, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsh(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!amount || amount == 1);
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_16, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, rm, extend, amount == 1, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsh(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnsignedImmediate(MemOpSize_16, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, encodePositiveImmediate<16>(pimm), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsh(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPostIndex(MemOpSize_16, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldrsh(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPreIndex(MemOpSize_16, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrsw(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        ldrsw(rt, rn, rm, UXTX, 0);
+    }
+
+    ALWAYS_INLINE void ldrsw(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        ASSERT(!amount || amount == 2);
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_32, false, MemOp_LOAD_signed64, rm, extend, amount == 2, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrsw(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        insn(loadStoreRegisterUnsignedImmediate(MemOpSize_32, false, MemOp_LOAD_signed64, encodePositiveImmediate<32>(pimm), rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrsw(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        insn(loadStoreRegisterPostIndex(MemOpSize_32, false, MemOp_LOAD_signed64, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrsw(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        insn(loadStoreRegisterPreIndex(MemOpSize_32, false, MemOp_LOAD_signed64, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldrsw_literal(RegisterID rt, int offset = 0)
+    {
+        ASSERT(!(offset & 3));
+        insn(loadRegisterLiteral(LdrLiteralOp_LDRSW, false, offset >> 2, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldur(RegisterID rt, RegisterID rn, int simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnscaledImmediate(MEMOPSIZE, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldurb(RegisterID rt, RegisterID rn, int simm)
+    {
+        insn(loadStoreRegisterUnscaledImmediate(MemOpSize_8_or_128, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldurh(RegisterID rt, RegisterID rn, int simm)
+    {
+        insn(loadStoreRegisterUnscaledImmediate(MemOpSize_16, false, MemOp_LOAD, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldursb(RegisterID rt, RegisterID rn, int simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnscaledImmediate(MemOpSize_8_or_128, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldursh(RegisterID rt, RegisterID rn, int simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnscaledImmediate(MemOpSize_16, false, (datasize == 64) ? MemOp_LOAD_signed64 : MemOp_LOAD_signed32, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void ldursw(RegisterID rt, RegisterID rn, int simm)
+    {
+        insn(loadStoreRegisterUnscaledImmediate(MemOpSize_32, false, MemOp_LOAD_signed64, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void lsl(RegisterID rd, RegisterID rn, int shift)
+    {
+        ASSERT(shift < datasize);
+        ubfm<datasize>(rd, rn, (datasize - shift) & (datasize - 1), datasize - 1 - shift);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void lsl(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        lslv<datasize>(rd, rn, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void lslv(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing2Source(DATASIZE, rm, DataOp_LSLV, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void lsr(RegisterID rd, RegisterID rn, int shift)
+    {
+        ASSERT(shift < datasize);
+        ubfm<datasize>(rd, rn, shift, datasize - 1);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void lsr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        lsrv<datasize>(rd, rn, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void lsrv(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing2Source(DATASIZE, rm, DataOp_LSRV, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void madd(RegisterID rd, RegisterID rn, RegisterID rm, RegisterID ra)
+    {
+        CHECK_DATASIZE();
+        nopCortexA53Fix835769<datasize>();
+        insn(dataProcessing3Source(DATASIZE, DataOp_MADD, rm, ra, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void mneg(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        msub<datasize>(rd, rn, rm, ARM64Registers::zr);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void mov(RegisterID rd, RegisterID rm)
+    {
+        if (isSp(rd) || isSp(rm))
+            add<datasize>(rd, rm, UInt12(0));
+        else
+            orr<datasize>(rd, ARM64Registers::zr, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void movi(RegisterID rd, LogicalImmediate imm)
+    {
+        orr<datasize>(rd, ARM64Registers::zr, imm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void movk(RegisterID rd, uint16_t value, int shift = 0)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!(shift & 0xf));
+        insn(moveWideImediate(DATASIZE, MoveWideOp_K, shift >> 4, value, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void movn(RegisterID rd, uint16_t value, int shift = 0)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!(shift & 0xf));
+        insn(moveWideImediate(DATASIZE, MoveWideOp_N, shift >> 4, value, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void movz(RegisterID rd, uint16_t value, int shift = 0)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!(shift & 0xf));
+        insn(moveWideImediate(DATASIZE, MoveWideOp_Z, shift >> 4, value, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void msub(RegisterID rd, RegisterID rn, RegisterID rm, RegisterID ra)
+    {
+        CHECK_DATASIZE();
+        nopCortexA53Fix835769<datasize>();
+        insn(dataProcessing3Source(DATASIZE, DataOp_MSUB, rm, ra, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void mul(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        madd<datasize>(rd, rn, rm, ARM64Registers::zr);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void mvn(RegisterID rd, RegisterID rm)
+    {
+        orn<datasize>(rd, ARM64Registers::zr, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void mvn(RegisterID rd, RegisterID rm, ShiftType shift, int amount)
+    {
+        orn<datasize>(rd, ARM64Registers::zr, rm, shift, amount);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void neg(RegisterID rd, RegisterID rm)
+    {
+        sub<datasize, setFlags>(rd, ARM64Registers::zr, rm);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void neg(RegisterID rd, RegisterID rm, ShiftType shift, int amount)
+    {
+        sub<datasize, setFlags>(rd, ARM64Registers::zr, rm, shift, amount);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void ngc(RegisterID rd, RegisterID rm)
+    {
+        sbc<datasize, setFlags>(rd, ARM64Registers::zr, rm);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void ngc(RegisterID rd, RegisterID rm, ShiftType shift, int amount)
+    {
+        sbc<datasize, setFlags>(rd, ARM64Registers::zr, rm, shift, amount);
+    }
+
+    ALWAYS_INLINE void nop()
+    {
+        insn(nopPseudo());
+    }
+    
+    static void fillNops(void* base, size_t size, bool isCopyingToExecutableMemory)
+    {
+        RELEASE_ASSERT(!(size % sizeof(int32_t)));
+        size_t n = size / sizeof(int32_t);
+        for (int32_t* ptr = static_cast<int32_t*>(base); n--;) {
+            int insn = nopPseudo();
+            if (isCopyingToExecutableMemory)
+                performJITMemcpy(ptr++, &insn, sizeof(int));
+            else
+                memcpy(ptr++, &insn, sizeof(int));
+        }
+    }
+    
+    ALWAYS_INLINE void dmbISH()
+    {
+        insn(0xd5033bbf);
+    }
+
+    ALWAYS_INLINE void dmbISHST()
+    {
+        insn(0xd5033abf);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void orn(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        orn<datasize>(rd, rn, rm, LSL, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void orn(RegisterID rd, RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(logicalShiftedRegister(DATASIZE, LogicalOp_ORR, shift, true, rm, amount, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void orr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        orr<datasize>(rd, rn, rm, LSL, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void orr(RegisterID rd, RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(logicalShiftedRegister(DATASIZE, LogicalOp_ORR, shift, false, rm, amount, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void orr(RegisterID rd, RegisterID rn, LogicalImmediate imm)
+    {
+        CHECK_DATASIZE();
+        insn(logicalImmediate(DATASIZE, LogicalOp_ORR, imm.value(), rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void rbit(RegisterID rd, RegisterID rn)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing1Source(DATASIZE, DataOp_RBIT, rn, rd));
+    }
+
+    ALWAYS_INLINE void ret(RegisterID rn = ARM64Registers::lr)
+    {
+        insn(unconditionalBranchRegister(BranchType_RET, rn));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void rev(RegisterID rd, RegisterID rn)
+    {
+        CHECK_DATASIZE();
+        if (datasize == 32) // 'rev' mnemonic means REV32 or REV64 depending on the operand width.
+            insn(dataProcessing1Source(Datasize_32, DataOp_REV32, rn, rd));
+        else
+            insn(dataProcessing1Source(Datasize_64, DataOp_REV64, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void rev16(RegisterID rd, RegisterID rn)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing1Source(DATASIZE, DataOp_REV16, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void rev32(RegisterID rd, RegisterID rn)
+    {
+        ASSERT(datasize == 64); // 'rev32' only valid with 64-bit operands.
+        insn(dataProcessing1Source(Datasize_64, DataOp_REV32, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ror(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        rorv<datasize>(rd, rn, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ror(RegisterID rd, RegisterID rs, int shift)
+    {
+        extr<datasize>(rd, rs, rs, shift);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void rorv(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing2Source(DATASIZE, rm, DataOp_RORV, rn, rd));
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void sbc(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        insn(addSubtractWithCarry(DATASIZE, AddOp_SUB, setFlags, rm, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void sbfiz(RegisterID rd, RegisterID rn, int lsb, int width)
+    {
+        sbfm<datasize>(rd, rn, (datasize - lsb) & (datasize - 1), width - 1);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void sbfm(RegisterID rd, RegisterID rn, int immr, int imms)
+    {
+        CHECK_DATASIZE();
+        insn(bitfield(DATASIZE, BitfieldOp_SBFM, immr, imms, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void sbfx(RegisterID rd, RegisterID rn, int lsb, int width)
+    {
+        sbfm<datasize>(rd, rn, lsb, lsb + width - 1);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void sdiv(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing2Source(DATASIZE, rm, DataOp_SDIV, rn, rd));
+    }
+
+    ALWAYS_INLINE void smaddl(RegisterID rd, RegisterID rn, RegisterID rm, RegisterID ra)
+    {
+        nopCortexA53Fix835769<64>();
+        insn(dataProcessing3Source(Datasize_64, DataOp_SMADDL, rm, ra, rn, rd));
+    }
+
+    ALWAYS_INLINE void smnegl(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        smsubl(rd, rn, rm, ARM64Registers::zr);
+    }
+
+    ALWAYS_INLINE void smsubl(RegisterID rd, RegisterID rn, RegisterID rm, RegisterID ra)
+    {
+        nopCortexA53Fix835769<64>();
+        insn(dataProcessing3Source(Datasize_64, DataOp_SMSUBL, rm, ra, rn, rd));
+    }
+
+    ALWAYS_INLINE void smulh(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        insn(dataProcessing3Source(Datasize_64, DataOp_SMULH, rm, ARM64Registers::zr, rn, rd));
+    }
+
+    ALWAYS_INLINE void smull(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        smaddl(rd, rn, rm, ARM64Registers::zr);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void stp(RegisterID rt, RegisterID rt2, RegisterID rn, PairPostIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPairPostIndex(MEMPAIROPSIZE_INT(datasize), false, MemOp_STORE, simm, rn, rt, rt2));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void stp(RegisterID rt, RegisterID rt2, RegisterID rn, PairPreIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPairPreIndex(MEMPAIROPSIZE_INT(datasize), false, MemOp_STORE, simm, rn, rt, rt2));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void stp(RegisterID rt, RegisterID rt2, RegisterID rn, unsigned pimm = 0)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPairOffset(MEMPAIROPSIZE_INT(datasize), false, MemOp_STORE, pimm, rn, rt, rt2));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void stnp(RegisterID rt, RegisterID rt2, RegisterID rn, unsigned pimm = 0)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPairNonTemporal(MEMPAIROPSIZE_INT(datasize), false, MemOp_STORE, pimm, rn, rt, rt2));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        str<datasize>(rt, rn, rm, UXTX, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterRegisterOffset(MEMOPSIZE, false, MemOp_STORE, rm, extend, encodeShiftAmount<datasize>(amount), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnsignedImmediate(MEMOPSIZE, false, MemOp_STORE, encodePositiveImmediate<datasize>(pimm), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPostIndex(MEMOPSIZE, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterPreIndex(MEMOPSIZE, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void strb(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        // Not calling the 5 argument form of strb, since is amount is ommitted S is false.
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_8_or_128, false, MemOp_STORE, rm, UXTX, false, rn, rt));
+    }
+
+    ALWAYS_INLINE void strb(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        ASSERT_UNUSED(amount, !amount);
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_8_or_128, false, MemOp_STORE, rm, extend, true, rn, rt));
+    }
+
+    ALWAYS_INLINE void strb(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        insn(loadStoreRegisterUnsignedImmediate(MemOpSize_8_or_128, false, MemOp_STORE, encodePositiveImmediate<8>(pimm), rn, rt));
+    }
+
+    ALWAYS_INLINE void strb(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        insn(loadStoreRegisterPostIndex(MemOpSize_8_or_128, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void strb(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        insn(loadStoreRegisterPreIndex(MemOpSize_8_or_128, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void strh(RegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        strh(rt, rn, rm, UXTX, 0);
+    }
+
+    ALWAYS_INLINE void strh(RegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        ASSERT(!amount || amount == 1);
+        insn(loadStoreRegisterRegisterOffset(MemOpSize_16, false, MemOp_STORE, rm, extend, amount == 1, rn, rt));
+    }
+
+    ALWAYS_INLINE void strh(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        insn(loadStoreRegisterUnsignedImmediate(MemOpSize_16, false, MemOp_STORE, encodePositiveImmediate<16>(pimm), rn, rt));
+    }
+
+    ALWAYS_INLINE void strh(RegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        insn(loadStoreRegisterPostIndex(MemOpSize_16, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void strh(RegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        insn(loadStoreRegisterPreIndex(MemOpSize_16, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void stur(RegisterID rt, RegisterID rn, int simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnscaledImmediate(MEMOPSIZE, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void sturb(RegisterID rt, RegisterID rn, int simm)
+    {
+        insn(loadStoreRegisterUnscaledImmediate(MemOpSize_8_or_128, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    ALWAYS_INLINE void sturh(RegisterID rt, RegisterID rn, int simm)
+    {
+        insn(loadStoreRegisterUnscaledImmediate(MemOpSize_16, false, MemOp_STORE, simm, rn, rt));
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void sub(RegisterID rd, RegisterID rn, UInt12 imm12, int shift = 0)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!shift || shift == 12);
+        insn(addSubtractImmediate(DATASIZE, AddOp_SUB, setFlags, shift == 12, imm12, rn, rd));
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void sub(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT_WITH_MESSAGE(!isSp(rd) || setFlags == DontSetFlags, "SUBS with shifted register does not support SP for Xd, it uses XZR for the register 31. SUBS with extended register support SP for Xd, but only if SetFlag is not used, otherwise register 31 is Xd.");
+        ASSERT_WITH_MESSAGE(!isSp(rm), "No encoding of SUBS supports SP for the third operand.");
+
+        if (isSp(rd) || isSp(rn))
+            sub<datasize, setFlags>(rd, rn, rm, UXTX, 0);
+        else
+            sub<datasize, setFlags>(rd, rn, rm, LSL, 0);
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void sub(RegisterID rd, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        CHECK_DATASIZE();
+        insn(addSubtractExtendedRegister(DATASIZE, AddOp_SUB, setFlags, rm, extend, amount, rn, rd));
+    }
+
+    template<int datasize, SetFlags setFlags = DontSetFlags>
+    ALWAYS_INLINE void sub(RegisterID rd, RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        CHECK_DATASIZE();
+        ASSERT(!isSp(rd) && !isSp(rn) && !isSp(rm));
+        insn(addSubtractShiftedRegister(DATASIZE, AddOp_SUB, setFlags, shift, rm, amount, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void sxtb(RegisterID rd, RegisterID rn)
+    {
+        sbfm<datasize>(rd, rn, 0, 7);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void sxth(RegisterID rd, RegisterID rn)
+    {
+        sbfm<datasize>(rd, rn, 0, 15);
+    }
+
+    ALWAYS_INLINE void sxtw(RegisterID rd, RegisterID rn)
+    {
+        sbfm<64>(rd, rn, 0, 31);
+    }
+
+    ALWAYS_INLINE void tbz(RegisterID rt, int imm, int offset = 0)
+    {
+        ASSERT(!(offset & 3));
+        offset >>= 2;
+        insn(testAndBranchImmediate(false, imm, offset, rt));
+    }
+
+    ALWAYS_INLINE void tbnz(RegisterID rt, int imm, int offset = 0)
+    {
+        ASSERT(!(offset & 3));
+        offset >>= 2;
+        insn(testAndBranchImmediate(true, imm, offset, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void tst(RegisterID rn, RegisterID rm)
+    {
+        and_<datasize, S>(ARM64Registers::zr, rn, rm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void tst(RegisterID rn, RegisterID rm, ShiftType shift, int amount)
+    {
+        and_<datasize, S>(ARM64Registers::zr, rn, rm, shift, amount);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void tst(RegisterID rn, LogicalImmediate imm)
+    {
+        and_<datasize, S>(ARM64Registers::zr, rn, imm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ubfiz(RegisterID rd, RegisterID rn, int lsb, int width)
+    {
+        ubfm<datasize>(rd, rn, (datasize - lsb) & (datasize - 1), width - 1);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ubfm(RegisterID rd, RegisterID rn, int immr, int imms)
+    {
+        CHECK_DATASIZE();
+        insn(bitfield(DATASIZE, BitfieldOp_UBFM, immr, imms, rn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ubfx(RegisterID rd, RegisterID rn, int lsb, int width)
+    {
+        ubfm<datasize>(rd, rn, lsb, lsb + width - 1);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void udiv(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        CHECK_DATASIZE();
+        insn(dataProcessing2Source(DATASIZE, rm, DataOp_UDIV, rn, rd));
+    }
+
+    ALWAYS_INLINE void umaddl(RegisterID rd, RegisterID rn, RegisterID rm, RegisterID ra)
+    {
+        nopCortexA53Fix835769<64>();
+        insn(dataProcessing3Source(Datasize_64, DataOp_UMADDL, rm, ra, rn, rd));
+    }
+
+    ALWAYS_INLINE void umnegl(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        umsubl(rd, rn, rm, ARM64Registers::zr);
+    }
+
+    ALWAYS_INLINE void umsubl(RegisterID rd, RegisterID rn, RegisterID rm, RegisterID ra)
+    {
+        nopCortexA53Fix835769<64>();
+        insn(dataProcessing3Source(Datasize_64, DataOp_UMSUBL, rm, ra, rn, rd));
+    }
+
+    ALWAYS_INLINE void umulh(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        insn(dataProcessing3Source(Datasize_64, DataOp_UMULH, rm, ARM64Registers::zr, rn, rd));
+    }
+
+    ALWAYS_INLINE void umull(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        umaddl(rd, rn, rm, ARM64Registers::zr);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void uxtb(RegisterID rd, RegisterID rn)
+    {
+        ubfm<datasize>(rd, rn, 0, 7);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void uxth(RegisterID rd, RegisterID rn)
+    {
+        ubfm<datasize>(rd, rn, 0, 15);
+    }
+
+    ALWAYS_INLINE void uxtw(RegisterID rd, RegisterID rn)
+    {
+        ubfm<64>(rd, rn, 0, 31);
+    }
+
+    // Floating Point Instructions:
+
+    template<int datasize>
+    ALWAYS_INLINE void fabs(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FABS, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fadd(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FADD, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fccmp(FPRegisterID vn, FPRegisterID vm, int nzcv, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointConditionalCompare(DATASIZE, vm, cond, vn, FPCondCmpOp_FCMP, nzcv));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fccmpe(FPRegisterID vn, FPRegisterID vm, int nzcv, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointConditionalCompare(DATASIZE, vm, cond, vn, FPCondCmpOp_FCMPE, nzcv));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fcmp(FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointCompare(DATASIZE, vm, vn, FPCmpOp_FCMP));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fcmp_0(FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointCompare(DATASIZE, static_cast<FPRegisterID>(0), vn, FPCmpOp_FCMP0));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fcmpe(FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointCompare(DATASIZE, vm, vn, FPCmpOp_FCMPE));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fcmpe_0(FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointCompare(DATASIZE, static_cast<FPRegisterID>(0), vn, FPCmpOp_FCMPE0));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fcsel(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm, Condition cond)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointConditionalSelect(DATASIZE, vm, cond, vn, vd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvt(FPRegisterID vd, FPRegisterID vn)
+    {
+        ASSERT(dstsize == 16 || dstsize == 32 || dstsize == 64);
+        ASSERT(srcsize == 16 || srcsize == 32 || srcsize == 64);
+        ASSERT(dstsize != srcsize);
+        Datasize type = (srcsize == 64) ? Datasize_64 : (srcsize == 32) ? Datasize_32 : Datasize_16;
+        FPDataOp1Source opcode = (dstsize == 64) ? FPDataOp_FCVT_toDouble : (dstsize == 32) ? FPDataOp_FCVT_toSingle : FPDataOp_FCVT_toHalf;
+        insn(floatingPointDataProcessing1Source(type, opcode, vn, vd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtas(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTAS, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtau(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTAU, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtms(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTMS, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtmu(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTMU, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtns(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTNS, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtnu(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTNU, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtps(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTPS, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtpu(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTPU, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtzs(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTZS, vn, rd));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void fcvtzu(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(dstsize), DATASIZE_OF(srcsize), FPIntConvOp_FCVTZU, vn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fdiv(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FDIV, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmadd(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm, FPRegisterID va)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing3Source(DATASIZE, false, vm, AddOp_ADD, va, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmax(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FMAX, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmaxnm(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FMAXNM, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmin(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FMIN, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fminnm(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FMINNM, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmov(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FMOV, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmov(FPRegisterID vd, RegisterID rn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointIntegerConversions(DATASIZE, DATASIZE, FPIntConvOp_FMOV_XtoQ, rn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmov(RegisterID rd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointIntegerConversions(DATASIZE, DATASIZE, FPIntConvOp_FMOV_QtoX, vn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmov(FPRegisterID vd, double imm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointImmediate(DATASIZE, encodeFPImm(imm), vd));
+    }
+
+    ALWAYS_INLINE void fmov_top(FPRegisterID vd, RegisterID rn)
+    {
+        insn(floatingPointIntegerConversions(Datasize_64, Datasize_64, FPIntConvOp_FMOV_XtoQ_top, rn, vd));
+    }
+
+    ALWAYS_INLINE void fmov_top(RegisterID rd, FPRegisterID vn)
+    {
+        insn(floatingPointIntegerConversions(Datasize_64, Datasize_64, FPIntConvOp_FMOV_QtoX_top, vn, rd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmsub(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm, FPRegisterID va)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing3Source(DATASIZE, false, vm, AddOp_SUB, va, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fmul(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FMUL, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fneg(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FNEG, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fnmadd(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm, FPRegisterID va)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing3Source(DATASIZE, true, vm, AddOp_ADD, va, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fnmsub(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm, FPRegisterID va)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing3Source(DATASIZE, true, vm, AddOp_SUB, va, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fnmul(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FNMUL, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void vand(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_VECTOR_DATASIZE();
+        insn(vectorDataProcessing2Source(SIMD_LogicalOp_AND, vm, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void frinta(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FRINTA, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void frinti(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FRINTI, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void frintm(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FRINTM, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void frintn(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FRINTN, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void frintp(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FRINTP, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void frintx(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FRINTX, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void frintz(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FRINTZ, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fsqrt(FPRegisterID vd, FPRegisterID vn)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing1Source(DATASIZE, FPDataOp_FSQRT, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void fsub(FPRegisterID vd, FPRegisterID vn, FPRegisterID vm)
+    {
+        CHECK_DATASIZE();
+        insn(floatingPointDataProcessing2Source(DATASIZE, vm, FPDataOp_FSUB, vn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(FPRegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        ldr<datasize>(rt, rn, rm, UXTX, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(FPRegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterRegisterOffset(MEMOPSIZE, true, datasize == 128 ? MemOp_LOAD_V128 : MemOp_LOAD, rm, extend, encodeShiftAmount<datasize>(amount), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(FPRegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterUnsignedImmediate(MEMOPSIZE, true, datasize == 128 ? MemOp_LOAD_V128 : MemOp_LOAD, encodePositiveImmediate<datasize>(pimm), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(FPRegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterPostIndex(MEMOPSIZE, true, datasize == 128 ? MemOp_LOAD_V128 : MemOp_LOAD, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr(FPRegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterPreIndex(MEMOPSIZE, true, datasize == 128 ? MemOp_LOAD_V128 : MemOp_LOAD, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldr_literal(FPRegisterID rt, int offset = 0)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        ASSERT(datasize >= 32);
+        ASSERT(!(offset & 3));
+        insn(loadRegisterLiteral(datasize == 128 ? LdrLiteralOp_128BIT : datasize == 64 ? LdrLiteralOp_64BIT : LdrLiteralOp_32BIT, true, offset >> 2, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void ldur(FPRegisterID rt, RegisterID rn, int simm)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterUnscaledImmediate(MEMOPSIZE, true, datasize == 128 ? MemOp_LOAD_V128 : MemOp_LOAD, simm, rn, rt));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void scvtf(FPRegisterID vd, RegisterID rn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(srcsize), DATASIZE_OF(dstsize), FPIntConvOp_SCVTF, rn, vd));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(FPRegisterID rt, RegisterID rn, RegisterID rm)
+    {
+        str<datasize>(rt, rn, rm, UXTX, 0);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(FPRegisterID rt, RegisterID rn, RegisterID rm, ExtendType extend, int amount)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterRegisterOffset(MEMOPSIZE, true, datasize == 128 ? MemOp_STORE_V128 : MemOp_STORE, rm, extend, encodeShiftAmount<datasize>(amount), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(FPRegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterUnsignedImmediate(MEMOPSIZE, true, datasize == 128 ? MemOp_STORE_V128 : MemOp_STORE, encodePositiveImmediate<datasize>(pimm), rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(FPRegisterID rt, RegisterID rn, PostIndex simm)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterPostIndex(MEMOPSIZE, true, datasize == 128 ? MemOp_STORE_V128 : MemOp_STORE, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void str(FPRegisterID rt, RegisterID rn, PreIndex simm)
+    {
+        CHECK_FP_MEMOP_DATASIZE();
+        insn(loadStoreRegisterPreIndex(MEMOPSIZE, true, datasize == 128 ? MemOp_STORE_V128 : MemOp_STORE, simm, rn, rt));
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void stur(FPRegisterID rt, RegisterID rn, int simm)
+    {
+        CHECK_DATASIZE();
+        insn(loadStoreRegisterUnscaledImmediate(MEMOPSIZE, true, datasize == 128 ? MemOp_STORE_V128 : MemOp_STORE, simm, rn, rt));
+    }
+
+    template<int dstsize, int srcsize>
+    ALWAYS_INLINE void ucvtf(FPRegisterID vd, RegisterID rn)
+    {
+        CHECK_DATASIZE_OF(dstsize);
+        CHECK_DATASIZE_OF(srcsize);
+        insn(floatingPointIntegerConversions(DATASIZE_OF(srcsize), DATASIZE_OF(dstsize), FPIntConvOp_UCVTF, rn, vd));
+    }
+
+    // Admin methods:
+
+    AssemblerLabel labelIgnoringWatchpoints()
+    {
+        return m_buffer.label();
+    }
+
+    AssemblerLabel labelForWatchpoint()
+    {
+        AssemblerLabel result = m_buffer.label();
+        if (static_cast<int>(result.m_offset) != m_indexOfLastWatchpoint)
+            result = label();
+        m_indexOfLastWatchpoint = result.m_offset;
+        m_indexOfTailOfLastWatchpoint = result.m_offset + maxJumpReplacementSize();
+        return result;
+    }
+
+    AssemblerLabel label()
+    {
+        AssemblerLabel result = m_buffer.label();
+        while (UNLIKELY(static_cast<int>(result.m_offset) < m_indexOfTailOfLastWatchpoint)) {
+            nop();
+            result = m_buffer.label();
+        }
+        return result;
+    }
+
+    AssemblerLabel align(int alignment)
+    {
+        ASSERT(!(alignment & 3));
+        while (!m_buffer.isAligned(alignment))
+            brk(0);
+        return label();
+    }
+    
+    static void* getRelocatedAddress(void* code, AssemblerLabel label)
+    {
+        ASSERT(label.isSet());
+        return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + label.m_offset);
+    }
+    
+    static int getDifferenceBetweenLabels(AssemblerLabel a, AssemblerLabel b)
+    {
+        return b.m_offset - a.m_offset;
+    }
+
+    void* unlinkedCode() { return m_buffer.data(); }
+    size_t codeSize() const { return m_buffer.codeSize(); }
+
+    static unsigned getCallReturnOffset(AssemblerLabel call)
+    {
+        ASSERT(call.isSet());
+        return call.m_offset;
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer. Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    void linkJump(AssemblerLabel from, AssemblerLabel to, JumpType type, Condition condition)
+    {
+        ASSERT(to.isSet());
+        ASSERT(from.isSet());
+        m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset, type, condition));
+    }
+
+    void linkJump(AssemblerLabel from, AssemblerLabel to, JumpType type, Condition condition, bool is64Bit, RegisterID compareRegister)
+    {
+        ASSERT(to.isSet());
+        ASSERT(from.isSet());
+        m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset, type, condition, is64Bit, compareRegister));
+    }
+
+    void linkJump(AssemblerLabel from, AssemblerLabel to, JumpType type, Condition condition, unsigned bitNumber, RegisterID compareRegister)
+    {
+        ASSERT(to.isSet());
+        ASSERT(from.isSet());
+        m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset, type, condition, bitNumber, compareRegister));
+    }
+
+    void linkJump(AssemblerLabel from, void* executableCode, AssemblerLabel to)
+    {
+        ASSERT(from.isSet());
+        ASSERT(to.isSet());
+        relinkJumpOrCall<false>(addressOf(from), addressOf(executableCode, from), addressOf(to));
+    }
+    
+    static void linkJump(void* code, AssemblerLabel from, void* to)
+    {
+        ASSERT(from.isSet());
+        relinkJumpOrCall<false>(addressOf(code, from), addressOf(code, from), to);
+    }
+
+    static void linkCall(void* code, AssemblerLabel from, void* to)
+    {
+        ASSERT(from.isSet());
+        linkJumpOrCall<true>(addressOf(code, from) - 1, addressOf(code, from) - 1, to);
+    }
+
+    static void linkPointer(void* code, AssemblerLabel where, void* valuePtr)
+    {
+        linkPointer(addressOf(code, where), valuePtr);
+    }
+
+    static void replaceWithJump(void* where, void* to)
+    {
+        intptr_t offset = (reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(where)) >> 2;
+        ASSERT(static_cast<int>(offset) == offset);
+        int insn = unconditionalBranchImmediate(false, static_cast<int>(offset));
+        performJITMemcpy(where, &insn, sizeof(int));
+        cacheFlush(where, sizeof(int));
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return 4;
+    }
+
+    static constexpr ptrdiff_t patchableJumpSize()
+    {
+        return 4;
+    }
+    
+    static void replaceWithLoad(void* where)
+    {
+        Datasize sf;
+        AddOp op;
+        SetFlags S;
+        int shift;
+        int imm12;
+        RegisterID rn;
+        RegisterID rd;
+        if (disassembleAddSubtractImmediate(where, sf, op, S, shift, imm12, rn, rd)) {
+            ASSERT(sf == Datasize_64);
+            ASSERT(op == AddOp_ADD);
+            ASSERT(!S);
+            ASSERT(!shift);
+            ASSERT(!(imm12 & ~0xff8));
+            int insn = loadStoreRegisterUnsignedImmediate(MemOpSize_64, false, MemOp_LOAD, encodePositiveImmediate<64>(imm12), rn, rd);
+            performJITMemcpy(where, &insn, sizeof(int));
+            cacheFlush(where, sizeof(int));
+        }
+#if !ASSERT_DISABLED
+        else {
+            MemOpSize size;
+            bool V;
+            MemOp opc;
+            int imm12;
+            RegisterID rn;
+            RegisterID rt;
+            ASSERT(disassembleLoadStoreRegisterUnsignedImmediate(where, size, V, opc, imm12, rn, rt));
+            ASSERT(size == MemOpSize_64);
+            ASSERT(!V);
+            ASSERT(opc == MemOp_LOAD);
+            ASSERT(!(imm12 & ~0x1ff));
+        }
+#endif
+    }
+
+    static void replaceWithAddressComputation(void* where)
+    {
+        MemOpSize size;
+        bool V;
+        MemOp opc;
+        int imm12;
+        RegisterID rn;
+        RegisterID rt;
+        if (disassembleLoadStoreRegisterUnsignedImmediate(where, size, V, opc, imm12, rn, rt)) {
+            ASSERT(size == MemOpSize_64);
+            ASSERT(!V);
+            ASSERT(opc == MemOp_LOAD);
+            ASSERT(!(imm12 & ~0x1ff));
+            int insn = addSubtractImmediate(Datasize_64, AddOp_ADD, DontSetFlags, 0, imm12 * sizeof(void*), rn, rt);
+            performJITMemcpy(where, &insn, sizeof(int));
+            cacheFlush(where, sizeof(int));
+        }
+#if !ASSERT_DISABLED
+        else {
+            Datasize sf;
+            AddOp op;
+            SetFlags S;
+            int shift;
+            int imm12;
+            RegisterID rn;
+            RegisterID rd;
+            ASSERT(disassembleAddSubtractImmediate(where, sf, op, S, shift, imm12, rn, rd));
+            ASSERT(sf == Datasize_64);
+            ASSERT(op == AddOp_ADD);
+            ASSERT(!S);
+            ASSERT(!shift);
+            ASSERT(!(imm12 & ~0xff8));
+        }
+#endif
+    }
+
+    static void repatchPointer(void* where, void* valuePtr)
+    {
+        linkPointer(static_cast<int*>(where), valuePtr, true);
+    }
+
+    static void setPointer(int* address, void* valuePtr, RegisterID rd, bool flush)
+    {
+        uintptr_t value = reinterpret_cast<uintptr_t>(valuePtr);
+        int buffer[3];
+        buffer[0] = moveWideImediate(Datasize_64, MoveWideOp_Z, 0, getHalfword(value, 0), rd);
+        buffer[1] = moveWideImediate(Datasize_64, MoveWideOp_K, 1, getHalfword(value, 1), rd);
+        buffer[2] = moveWideImediate(Datasize_64, MoveWideOp_K, 2, getHalfword(value, 2), rd);
+        performJITMemcpy(address, buffer, sizeof(int) * 3);
+
+        if (flush)
+            cacheFlush(address, sizeof(int) * 3);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        int* address = static_cast<int*>(where);
+
+        Datasize sf;
+        MoveWideOp opc;
+        int hw;
+        uint16_t imm16;
+        RegisterID rd;
+        bool expected = disassembleMoveWideImediate(address, sf, opc, hw, imm16, rd);
+        ASSERT_UNUSED(expected, expected && !sf && (opc == MoveWideOp_Z || opc == MoveWideOp_N) && !hw);
+        ASSERT(checkMovk<Datasize_32>(address[1], 1, rd));
+
+        int buffer[2];
+        if (value >= 0) {
+            buffer[0] = moveWideImediate(Datasize_32, MoveWideOp_Z, 0, getHalfword(value, 0), rd);
+            buffer[1] = moveWideImediate(Datasize_32, MoveWideOp_K, 1, getHalfword(value, 1), rd);
+        } else {
+            buffer[0] = moveWideImediate(Datasize_32, MoveWideOp_N, 0, ~getHalfword(value, 0), rd);
+            buffer[1] = moveWideImediate(Datasize_32, MoveWideOp_K, 1, getHalfword(value, 1), rd);
+        }
+        performJITMemcpy(where, &buffer, sizeof(int) * 2);
+
+        cacheFlush(where, sizeof(int) * 2);
+    }
+
+    static void* readPointer(void* where)
+    {
+        int* address = static_cast<int*>(where);
+
+        Datasize sf;
+        MoveWideOp opc;
+        int hw;
+        uint16_t imm16;
+        RegisterID rdFirst, rd;
+
+        bool expected = disassembleMoveWideImediate(address, sf, opc, hw, imm16, rdFirst);
+        ASSERT_UNUSED(expected, expected && sf && opc == MoveWideOp_Z && !hw);
+        uintptr_t result = imm16;
+
+        expected = disassembleMoveWideImediate(address + 1, sf, opc, hw, imm16, rd);
+        ASSERT_UNUSED(expected, expected && sf && opc == MoveWideOp_K && hw == 1 && rd == rdFirst);
+        result |= static_cast<uintptr_t>(imm16) << 16;
+
+        expected = disassembleMoveWideImediate(address + 2, sf, opc, hw, imm16, rd);
+        ASSERT_UNUSED(expected, expected && sf && opc == MoveWideOp_K && hw == 2 && rd == rdFirst);
+        result |= static_cast<uintptr_t>(imm16) << 32;
+
+        return reinterpret_cast<void*>(result);
+    }
+
+    static void* readCallTarget(void* from)
+    {
+        return readPointer(reinterpret_cast<int*>(from) - 4);
+    }
+
+    // The static relink, repatch, and replace methods can use can
+    // use |from| for both the write and executable address for call
+    // and jump patching as they're modifying existing (linked) code,
+    // so the address being provided is correct for relative address
+    // computation.
+    static void relinkJump(void* from, void* to)
+    {
+        relinkJumpOrCall<false>(reinterpret_cast<int*>(from), reinterpret_cast<const int*>(from), to);
+        cacheFlush(from, sizeof(int));
+    }
+    
+    static void relinkJumpToNop(void* from)
+    {
+        relinkJump(from, static_cast<char*>(from) + 4);
+    }
+    
+    static void relinkCall(void* from, void* to)
+    {
+        relinkJumpOrCall<true>(reinterpret_cast<int*>(from) - 1, reinterpret_cast<const int*>(from) - 1, to);
+        cacheFlush(reinterpret_cast<int*>(from) - 1, sizeof(int));
+    }
+    
+    static void repatchCompact(void* where, int32_t value)
+    {
+        ASSERT(!(value & ~0x3ff8));
+
+        MemOpSize size;
+        bool V;
+        MemOp opc;
+        int imm12;
+        RegisterID rn;
+        RegisterID rt;
+        bool expected = disassembleLoadStoreRegisterUnsignedImmediate(where, size, V, opc, imm12, rn, rt);
+        ASSERT_UNUSED(expected, expected && size >= MemOpSize_32 && !V && opc == MemOp_LOAD); // expect 32/64 bit load to GPR.
+
+        if (size == MemOpSize_32)
+            imm12 = encodePositiveImmediate<32>(value);
+        else
+            imm12 = encodePositiveImmediate<64>(value);
+        int insn = loadStoreRegisterUnsignedImmediate(size, V, opc, imm12, rn, rt);
+        performJITMemcpy(where, &insn, sizeof(int));
+
+        cacheFlush(where, sizeof(int));
+    }
+
+    unsigned debugOffset() { return m_buffer.debugOffset(); }
+
+#if OS(LINUX) && COMPILER(GCC_OR_CLANG)
+    static inline void linuxPageFlush(uintptr_t begin, uintptr_t end)
+    {
+        __builtin___clear_cache(reinterpret_cast<char*>(begin), reinterpret_cast<char*>(end));
+    }
+#endif
+
+    static void cacheFlush(void* code, size_t size)
+    {
+#if OS(IOS)
+        sys_cache_control(kCacheFunctionPrepareForExecution, code, size);
+#elif OS(LINUX)
+        size_t page = pageSize();
+        uintptr_t current = reinterpret_cast<uintptr_t>(code);
+        uintptr_t end = current + size;
+        uintptr_t firstPageEnd = (current & ~(page - 1)) + page;
+
+        if (end <= firstPageEnd) {
+            linuxPageFlush(current, end);
+            return;
+        }
+
+        linuxPageFlush(current, firstPageEnd);
+
+        for (current = firstPageEnd; current + page < end; current += page)
+            linuxPageFlush(current, current + page);
+
+        linuxPageFlush(current, end);
+#else
+#error "The cacheFlush support is missing on this platform."
+#endif
+    }
+
+    // Assembler admin methods:
+
+    static int jumpSizeDelta(JumpType jumpType, JumpLinkType jumpLinkType) { return JUMP_ENUM_SIZE(jumpType) - JUMP_ENUM_SIZE(jumpLinkType); }
+
+    static ALWAYS_INLINE bool linkRecordSourceComparator(const LinkRecord& a, const LinkRecord& b)
+    {
+        return a.from() < b.from();
+    }
+
+    static bool canCompact(JumpType jumpType)
+    {
+        // Fixed jumps cannot be compacted
+        return (jumpType == JumpNoCondition) || (jumpType == JumpCondition) || (jumpType == JumpCompareAndBranch) || (jumpType == JumpTestBit);
+    }
+
+    static JumpLinkType computeJumpType(JumpType jumpType, const uint8_t* from, const uint8_t* to)
+    {
+        switch (jumpType) {
+        case JumpFixed:
+            return LinkInvalid;
+        case JumpNoConditionFixedSize:
+            return LinkJumpNoCondition;
+        case JumpConditionFixedSize:
+            return LinkJumpCondition;
+        case JumpCompareAndBranchFixedSize:
+            return LinkJumpCompareAndBranch;
+        case JumpTestBitFixedSize:
+            return LinkJumpTestBit;
+        case JumpNoCondition:
+            return LinkJumpNoCondition;
+        case JumpCondition: {
+            ASSERT(!(reinterpret_cast<intptr_t>(from) & 0x3));
+            ASSERT(!(reinterpret_cast<intptr_t>(to) & 0x3));
+            intptr_t relative = reinterpret_cast<intptr_t>(to) - (reinterpret_cast<intptr_t>(from));
+
+            if (((relative << 43) >> 43) == relative)
+                return LinkJumpConditionDirect;
+
+            return LinkJumpCondition;
+            }
+        case JumpCompareAndBranch:  {
+            ASSERT(!(reinterpret_cast<intptr_t>(from) & 0x3));
+            ASSERT(!(reinterpret_cast<intptr_t>(to) & 0x3));
+            intptr_t relative = reinterpret_cast<intptr_t>(to) - (reinterpret_cast<intptr_t>(from));
+
+            if (((relative << 43) >> 43) == relative)
+                return LinkJumpCompareAndBranchDirect;
+
+            return LinkJumpCompareAndBranch;
+        }
+        case JumpTestBit:   {
+            ASSERT(!(reinterpret_cast<intptr_t>(from) & 0x3));
+            ASSERT(!(reinterpret_cast<intptr_t>(to) & 0x3));
+            intptr_t relative = reinterpret_cast<intptr_t>(to) - (reinterpret_cast<intptr_t>(from));
+
+            if (((relative << 50) >> 50) == relative)
+                return LinkJumpTestBitDirect;
+
+            return LinkJumpTestBit;
+        }
+        default:
+            ASSERT_NOT_REACHED();
+        }
+
+        return LinkJumpNoCondition;
+    }
+
+    static JumpLinkType computeJumpType(LinkRecord& record, const uint8_t* from, const uint8_t* to)
+    {
+        JumpLinkType linkType = computeJumpType(record.type(), from, to);
+        record.setLinkType(linkType);
+        return linkType;
+    }
+
+    Vector<LinkRecord, 0, UnsafeVectorOverflow>& jumpsToLink()
+    {
+        std::sort(m_jumpsToLink.begin(), m_jumpsToLink.end(), linkRecordSourceComparator);
+        return m_jumpsToLink;
+    }
+
+    static void ALWAYS_INLINE link(LinkRecord& record, uint8_t* from, const uint8_t* fromInstruction8, uint8_t* to)
+    {
+        const int* fromInstruction = reinterpret_cast<const int*>(fromInstruction8);
+        switch (record.linkType()) {
+        case LinkJumpNoCondition:
+            linkJumpOrCall<false>(reinterpret_cast<int*>(from), fromInstruction, to);
+            break;
+        case LinkJumpConditionDirect:
+            linkConditionalBranch<true>(record.condition(), reinterpret_cast<int*>(from), fromInstruction, to);
+            break;
+        case LinkJumpCondition:
+            linkConditionalBranch<false>(record.condition(), reinterpret_cast<int*>(from) - 1, fromInstruction - 1, to);
+            break;
+        case LinkJumpCompareAndBranchDirect:
+            linkCompareAndBranch<true>(record.condition(), record.is64Bit(), record.compareRegister(), reinterpret_cast<int*>(from), fromInstruction, to);
+            break;
+        case LinkJumpCompareAndBranch:
+            linkCompareAndBranch<false>(record.condition(), record.is64Bit(), record.compareRegister(), reinterpret_cast<int*>(from) - 1, fromInstruction - 1, to);
+            break;
+        case LinkJumpTestBitDirect:
+            linkTestAndBranch<true>(record.condition(), record.bitNumber(), record.compareRegister(), reinterpret_cast<int*>(from), fromInstruction, to);
+            break;
+        case LinkJumpTestBit:
+            linkTestAndBranch<false>(record.condition(), record.bitNumber(), record.compareRegister(), reinterpret_cast<int*>(from) - 1, fromInstruction - 1, to);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+
+private:
+    template<Datasize size>
+    static bool checkMovk(int insn, int _hw, RegisterID _rd)
+    {
+        Datasize sf;
+        MoveWideOp opc;
+        int hw;
+        uint16_t imm16;
+        RegisterID rd;
+        bool expected = disassembleMoveWideImediate(&insn, sf, opc, hw, imm16, rd);
+
+        return expected
+            && sf == size
+            && opc == MoveWideOp_K
+            && hw == _hw
+            && rd == _rd;
+    }
+
+    static void linkPointer(int* address, void* valuePtr, bool flush = false)
+    {
+        Datasize sf;
+        MoveWideOp opc;
+        int hw;
+        uint16_t imm16;
+        RegisterID rd;
+        bool expected = disassembleMoveWideImediate(address, sf, opc, hw, imm16, rd);
+        ASSERT_UNUSED(expected, expected && sf && opc == MoveWideOp_Z && !hw);
+        ASSERT(checkMovk<Datasize_64>(address[1], 1, rd));
+        ASSERT(checkMovk<Datasize_64>(address[2], 2, rd));
+
+        setPointer(address, valuePtr, rd, flush);
+    }
+
+    template<bool isCall>
+    static void linkJumpOrCall(int* from, const int* fromInstruction, void* to)
+    {
+        bool link;
+        int imm26;
+        bool isUnconditionalBranchImmediateOrNop = disassembleUnconditionalBranchImmediate(from, link, imm26) || disassembleNop(from);
+
+        ASSERT_UNUSED(isUnconditionalBranchImmediateOrNop, isUnconditionalBranchImmediateOrNop);
+        ASSERT_UNUSED(isCall, (link == isCall) || disassembleNop(from));
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 3));
+        ASSERT(!(reinterpret_cast<intptr_t>(to) & 3));
+        intptr_t offset = (reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(fromInstruction)) >> 2;
+        ASSERT(static_cast<int>(offset) == offset);
+
+        int insn = unconditionalBranchImmediate(isCall, static_cast<int>(offset));
+        performJITMemcpy(from, &insn, sizeof(int));
+    }
+
+    template<bool isDirect>
+    static void linkCompareAndBranch(Condition condition, bool is64Bit, RegisterID rt, int* from, const int* fromInstruction, void* to)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 3));
+        ASSERT(!(reinterpret_cast<intptr_t>(to) & 3));
+        intptr_t offset = (reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(fromInstruction)) >> 2;
+        ASSERT(((offset << 38) >> 38) == offset);
+
+        bool useDirect = ((offset << 45) >> 45) == offset; // Fits in 19 bits
+        ASSERT(!isDirect || useDirect);
+
+        if (useDirect || isDirect) {
+            int insn = compareAndBranchImmediate(is64Bit ? Datasize_64 : Datasize_32, condition == ConditionNE, static_cast<int>(offset), rt);
+            performJITMemcpy(from, &insn, sizeof(int));
+            if (!isDirect) {
+                insn = nopPseudo();
+                performJITMemcpy(from + 1, &insn, sizeof(int));
+            }
+        } else {
+            int insn = compareAndBranchImmediate(is64Bit ? Datasize_64 : Datasize_32, invert(condition) == ConditionNE, 2, rt);
+            performJITMemcpy(from, &insn, sizeof(int));
+            linkJumpOrCall<false>(from + 1, fromInstruction + 1, to);
+        }
+    }
+
+    template<bool isDirect>
+    static void linkConditionalBranch(Condition condition, int* from, const int* fromInstruction, void* to)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 3));
+        ASSERT(!(reinterpret_cast<intptr_t>(to) & 3));
+        intptr_t offset = (reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(fromInstruction)) >> 2;
+        ASSERT(((offset << 38) >> 38) == offset);
+
+        bool useDirect = ((offset << 45) >> 45) == offset; // Fits in 19 bits
+        ASSERT(!isDirect || useDirect);
+
+        if (useDirect || isDirect) {
+            int insn = conditionalBranchImmediate(static_cast<int>(offset), condition);
+            performJITMemcpy(from, &insn, sizeof(int));
+            if (!isDirect) {
+                insn = nopPseudo();
+                performJITMemcpy(from + 1, &insn, sizeof(int));
+            }
+        } else {
+            int insn = conditionalBranchImmediate(2, invert(condition));
+            performJITMemcpy(from, &insn, sizeof(int));
+            linkJumpOrCall<false>(from + 1, fromInstruction + 1, to);
+        }
+    }
+
+    template<bool isDirect>
+    static void linkTestAndBranch(Condition condition, unsigned bitNumber, RegisterID rt, int* from, const int* fromInstruction, void* to)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 3));
+        ASSERT(!(reinterpret_cast<intptr_t>(to) & 3));
+        intptr_t offset = (reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(fromInstruction)) >> 2;
+        ASSERT(static_cast<int>(offset) == offset);
+        ASSERT(((offset << 38) >> 38) == offset);
+
+        bool useDirect = ((offset << 50) >> 50) == offset; // Fits in 14 bits
+        ASSERT(!isDirect || useDirect);
+
+        if (useDirect || isDirect) {
+            int insn = testAndBranchImmediate(condition == ConditionNE, static_cast<int>(bitNumber), static_cast<int>(offset), rt);
+            performJITMemcpy(from, &insn, sizeof(int));
+            if (!isDirect) {
+                insn = nopPseudo();
+                performJITMemcpy(from + 1, &insn, sizeof(int));
+            }
+        } else {
+            int insn = testAndBranchImmediate(invert(condition) == ConditionNE, static_cast<int>(bitNumber), 2, rt);
+            performJITMemcpy(from, &insn, sizeof(int));
+            linkJumpOrCall<false>(from + 1, fromInstruction + 1, to);
+        }
+    }
+
+    template<bool isCall>
+    static void relinkJumpOrCall(int* from, const int* fromInstruction, void* to)
+    {
+        if (!isCall && disassembleNop(from)) {
+            unsigned op01;
+            int imm19;
+            Condition condition;
+            bool isConditionalBranchImmediate = disassembleConditionalBranchImmediate(from - 1, op01, imm19, condition);
+
+            if (isConditionalBranchImmediate) {
+                ASSERT_UNUSED(op01, !op01);
+                ASSERT_UNUSED(isCall, !isCall);
+
+                if (imm19 == 8)
+                    condition = invert(condition);
+
+                linkConditionalBranch<false>(condition, from - 1, fromInstruction - 1, to);
+                return;
+            }
+
+            Datasize opSize;
+            bool op;
+            RegisterID rt;
+            bool isCompareAndBranchImmediate = disassembleCompareAndBranchImmediate(from - 1, opSize, op, imm19, rt);
+
+            if (isCompareAndBranchImmediate) {
+                if (imm19 == 8)
+                    op = !op;
+
+                linkCompareAndBranch<false>(op ? ConditionNE : ConditionEQ, opSize == Datasize_64, rt, from - 1, fromInstruction - 1, to);
+                return;
+            }
+
+            int imm14;
+            unsigned bitNumber;
+            bool isTestAndBranchImmediate = disassembleTestAndBranchImmediate(from - 1, op, bitNumber, imm14, rt);
+
+            if (isTestAndBranchImmediate) {
+                if (imm14 == 8)
+                    op = !op;
+
+                linkTestAndBranch<false>(op ? ConditionNE : ConditionEQ, bitNumber, rt, from - 1, fromInstruction - 1, to);
+                return;
+            }
+        }
+
+        linkJumpOrCall<isCall>(from, fromInstruction, to);
+    }
+
+    static int* addressOf(void* code, AssemblerLabel label)
+    {
+        return reinterpret_cast<int*>(static_cast<char*>(code) + label.m_offset);
+    }
+
+    int* addressOf(AssemblerLabel label)
+    {
+        return addressOf(m_buffer.data(), label);
+    }
+
+    static RegisterID disassembleXOrSp(int reg) { return reg == 31 ? ARM64Registers::sp : static_cast<RegisterID>(reg); }
+    static RegisterID disassembleXOrZr(int reg) { return reg == 31 ? ARM64Registers::zr : static_cast<RegisterID>(reg); }
+    static RegisterID disassembleXOrZrOrSp(bool useZr, int reg) { return reg == 31 ? (useZr ? ARM64Registers::zr : ARM64Registers::sp) : static_cast<RegisterID>(reg); }
+
+    static bool disassembleAddSubtractImmediate(void* address, Datasize& sf, AddOp& op, SetFlags& S, int& shift, int& imm12, RegisterID& rn, RegisterID& rd)
+    {
+        int insn = *static_cast<int*>(address);
+        sf = static_cast<Datasize>((insn >> 31) & 1);
+        op = static_cast<AddOp>((insn >> 30) & 1);
+        S = static_cast<SetFlags>((insn >> 29) & 1);
+        shift = (insn >> 22) & 3;
+        imm12 = (insn >> 10) & 0x3ff;
+        rn = disassembleXOrSp((insn >> 5) & 0x1f);
+        rd = disassembleXOrZrOrSp(S, insn & 0x1f);
+        return (insn & 0x1f000000) == 0x11000000;
+    }
+
+    static bool disassembleLoadStoreRegisterUnsignedImmediate(void* address, MemOpSize& size, bool& V, MemOp& opc, int& imm12, RegisterID& rn, RegisterID& rt)
+    {
+        int insn = *static_cast<int*>(address);
+        size = static_cast<MemOpSize>((insn >> 30) & 3);
+        V = (insn >> 26) & 1;
+        opc = static_cast<MemOp>((insn >> 22) & 3);
+        imm12 = (insn >> 10) & 0xfff;
+        rn = disassembleXOrSp((insn >> 5) & 0x1f);
+        rt = disassembleXOrZr(insn & 0x1f);
+        return (insn & 0x3b000000) == 0x39000000;
+    }
+
+    static bool disassembleMoveWideImediate(void* address, Datasize& sf, MoveWideOp& opc, int& hw, uint16_t& imm16, RegisterID& rd)
+    {
+        int insn = *static_cast<int*>(address);
+        sf = static_cast<Datasize>((insn >> 31) & 1);
+        opc = static_cast<MoveWideOp>((insn >> 29) & 3);
+        hw = (insn >> 21) & 3;
+        imm16 = insn >> 5;
+        rd = disassembleXOrZr(insn & 0x1f);
+        return (insn & 0x1f800000) == 0x12800000;
+    }
+
+    static bool disassembleNop(void* address)
+    {
+        unsigned insn = *static_cast<unsigned*>(address);
+        return insn == 0xd503201f;
+    }
+
+    static bool disassembleCompareAndBranchImmediate(void* address, Datasize& sf, bool& op, int& imm19, RegisterID& rt)
+    {
+        int insn = *static_cast<int*>(address);
+        sf = static_cast<Datasize>((insn >> 31) & 1);
+        op = (insn >> 24) & 0x1;
+        imm19 = (insn << 8) >> 13;
+        rt = static_cast<RegisterID>(insn & 0x1f);
+        return (insn & 0x7e000000) == 0x34000000;
+        
+    }
+
+    static bool disassembleConditionalBranchImmediate(void* address, unsigned& op01, int& imm19, Condition &condition)
+    {
+        int insn = *static_cast<int*>(address);
+        op01 = ((insn >> 23) & 0x2) | ((insn >> 4) & 0x1);
+        imm19 = (insn << 8) >> 13;
+        condition = static_cast<Condition>(insn & 0xf);
+        return (insn & 0xfe000000) == 0x54000000;
+    }
+
+    static bool disassembleTestAndBranchImmediate(void* address, bool& op, unsigned& bitNumber, int& imm14, RegisterID& rt)
+    {
+        int insn = *static_cast<int*>(address);
+        op = (insn >> 24) & 0x1;
+        imm14 = (insn << 13) >> 18;
+        bitNumber = static_cast<unsigned>((((insn >> 26) & 0x20)) | ((insn >> 19) & 0x1f));
+        rt = static_cast<RegisterID>(insn & 0x1f);
+        return (insn & 0x7e000000) == 0x36000000;
+        
+    }
+
+    static bool disassembleUnconditionalBranchImmediate(void* address, bool& op, int& imm26)
+    {
+        int insn = *static_cast<int*>(address);
+        op = (insn >> 31) & 1;
+        imm26 = (insn << 6) >> 6;
+        return (insn & 0x7c000000) == 0x14000000;
+    }
+
+    static int xOrSp(RegisterID reg)
+    {
+        ASSERT(!isZr(reg));
+        ASSERT(!isIOS() || reg != ARM64Registers::x18);
+        return reg;
+    }
+    static int xOrZr(RegisterID reg)
+    {
+        ASSERT(!isSp(reg));
+        ASSERT(!isIOS() || reg != ARM64Registers::x18);
+        return reg & 31;
+    }
+    static FPRegisterID xOrZrAsFPR(RegisterID reg) { return static_cast<FPRegisterID>(xOrZr(reg)); }
+    static int xOrZrOrSp(bool useZr, RegisterID reg) { return useZr ? xOrZr(reg) : xOrSp(reg); }
+
+    ALWAYS_INLINE void insn(int instruction)
+    {
+        m_buffer.putInt(instruction);
+    }
+
+    ALWAYS_INLINE static int addSubtractExtendedRegister(Datasize sf, AddOp op, SetFlags S, RegisterID rm, ExtendType option, int imm3, RegisterID rn, RegisterID rd)
+    {
+        ASSERT(imm3 < 5);
+        // The only allocated values for opt is 0.
+        const int opt = 0;
+        return (0x0b200000 | sf << 31 | op << 30 | S << 29 | opt << 22 | xOrZr(rm) << 16 | option << 13 | (imm3 & 0x7) << 10 | xOrSp(rn) << 5 | xOrZrOrSp(S, rd));
+    }
+
+    ALWAYS_INLINE static int addSubtractImmediate(Datasize sf, AddOp op, SetFlags S, int shift, int imm12, RegisterID rn, RegisterID rd)
+    {
+        ASSERT(shift < 2);
+        ASSERT(isUInt12(imm12));
+        return (0x11000000 | sf << 31 | op << 30 | S << 29 | shift << 22 | (imm12 & 0xfff) << 10 | xOrSp(rn) << 5 | xOrZrOrSp(S, rd));
+    }
+
+    ALWAYS_INLINE static int addSubtractShiftedRegister(Datasize sf, AddOp op, SetFlags S, ShiftType shift, RegisterID rm, int imm6, RegisterID rn, RegisterID rd)
+    {
+        ASSERT(shift < 3);
+        ASSERT(!(imm6 & (sf ? ~63 : ~31)));
+        return (0x0b000000 | sf << 31 | op << 30 | S << 29 | shift << 22 | xOrZr(rm) << 16 | (imm6 & 0x3f) << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int addSubtractWithCarry(Datasize sf, AddOp op, SetFlags S, RegisterID rm, RegisterID rn, RegisterID rd)
+    {
+        const int opcode2 = 0;
+        return (0x1a000000 | sf << 31 | op << 30 | S << 29 | xOrZr(rm) << 16 | opcode2 << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int bitfield(Datasize sf, BitfieldOp opc, int immr, int imms, RegisterID rn, RegisterID rd)
+    {
+        ASSERT(immr < (sf ? 64 : 32));
+        ASSERT(imms < (sf ? 64 : 32));
+        const int N = sf;
+        return (0x13000000 | sf << 31 | opc << 29 | N << 22 | immr << 16 | imms << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    // 'op' means negate
+    ALWAYS_INLINE static int compareAndBranchImmediate(Datasize sf, bool op, int32_t imm19, RegisterID rt)
+    {
+        ASSERT(imm19 == (imm19 << 13) >> 13);
+        return (0x34000000 | sf << 31 | op << 24 | (imm19 & 0x7ffff) << 5 | xOrZr(rt));
+    }
+
+    ALWAYS_INLINE static int conditionalBranchImmediate(int32_t imm19, Condition cond)
+    {
+        ASSERT(imm19 == (imm19 << 13) >> 13);
+        ASSERT(!(cond & ~15));
+        // The only allocated values for o1 & o0 are 0.
+        const int o1 = 0;
+        const int o0 = 0;
+        return (0x54000000 | o1 << 24 | (imm19 & 0x7ffff) << 5 | o0 << 4 | cond);
+    }
+
+    ALWAYS_INLINE static int conditionalCompareImmediate(Datasize sf, AddOp op, int imm5, Condition cond, RegisterID rn, int nzcv)
+    {
+        ASSERT(!(imm5 & ~0x1f));
+        ASSERT(nzcv < 16);
+        const int S = 1;
+        const int o2 = 0;
+        const int o3 = 0;
+        return (0x1a400800 | sf << 31 | op << 30 | S << 29 | (imm5 & 0x1f) << 16 | cond << 12 | o2 << 10 | xOrZr(rn) << 5 | o3 << 4 | nzcv);
+    }
+
+    ALWAYS_INLINE static int conditionalCompareRegister(Datasize sf, AddOp op, RegisterID rm, Condition cond, RegisterID rn, int nzcv)
+    {
+        ASSERT(nzcv < 16);
+        const int S = 1;
+        const int o2 = 0;
+        const int o3 = 0;
+        return (0x1a400000 | sf << 31 | op << 30 | S << 29 | xOrZr(rm) << 16 | cond << 12 | o2 << 10 | xOrZr(rn) << 5 | o3 << 4 | nzcv);
+    }
+
+    // 'op' means negate
+    // 'op2' means increment
+    ALWAYS_INLINE static int conditionalSelect(Datasize sf, bool op, RegisterID rm, Condition cond, bool op2, RegisterID rn, RegisterID rd)
+    {
+        const int S = 0;
+        return (0x1a800000 | sf << 31 | op << 30 | S << 29 | xOrZr(rm) << 16 | cond << 12 | op2 << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int dataProcessing1Source(Datasize sf, DataOp1Source opcode, RegisterID rn, RegisterID rd)
+    {
+        const int S = 0;
+        const int opcode2 = 0;
+        return (0x5ac00000 | sf << 31 | S << 29 | opcode2 << 16 | opcode << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int dataProcessing2Source(Datasize sf, RegisterID rm, DataOp2Source opcode, RegisterID rn, RegisterID rd)
+    {
+        const int S = 0;
+        return (0x1ac00000 | sf << 31 | S << 29 | xOrZr(rm) << 16 | opcode << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int dataProcessing3Source(Datasize sf, DataOp3Source opcode, RegisterID rm, RegisterID ra, RegisterID rn, RegisterID rd)
+    {
+        int op54 = opcode >> 4;
+        int op31 = (opcode >> 1) & 7;
+        int op0 = opcode & 1;
+        return (0x1b000000 | sf << 31 | op54 << 29 | op31 << 21 | xOrZr(rm) << 16 | op0 << 15 | xOrZr(ra) << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int excepnGeneration(ExcepnOp opc, uint16_t imm16, int LL)
+    {
+        ASSERT((opc == ExcepnOp_BREAKPOINT || opc == ExcepnOp_HALT) ? !LL : (LL && (LL < 4)));
+        const int op2 = 0;
+        return (0xd4000000 | opc << 21 | imm16 << 5 | op2 << 2 | LL);
+    }
+
+    ALWAYS_INLINE static int extract(Datasize sf, RegisterID rm, int imms, RegisterID rn, RegisterID rd)
+    {
+        ASSERT(imms < (sf ? 64 : 32));
+        const int op21 = 0;
+        const int N = sf;
+        const int o0 = 0;
+        return (0x13800000 | sf << 31 | op21 << 29 | N << 22 | o0 << 21 | xOrZr(rm) << 16 | imms << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int floatingPointCompare(Datasize type, FPRegisterID rm, FPRegisterID rn, FPCmpOp opcode2)
+    {
+        const int M = 0;
+        const int S = 0;
+        const int op = 0;
+        return (0x1e202000 | M << 31 | S << 29 | type << 22 | rm << 16 | op << 14 | rn << 5 | opcode2);
+    }
+
+    ALWAYS_INLINE static int floatingPointConditionalCompare(Datasize type, FPRegisterID rm, Condition cond, FPRegisterID rn, FPCondCmpOp op, int nzcv)
+    {
+        ASSERT(nzcv < 16);
+        const int M = 0;
+        const int S = 0;
+        return (0x1e200400 | M << 31 | S << 29 | type << 22 | rm << 16 | cond << 12 | rn << 5 | op << 4 | nzcv);
+    }
+
+    ALWAYS_INLINE static int floatingPointConditionalSelect(Datasize type, FPRegisterID rm, Condition cond, FPRegisterID rn, FPRegisterID rd)
+    {
+        const int M = 0;
+        const int S = 0;
+        return (0x1e200c00 | M << 31 | S << 29 | type << 22 | rm << 16 | cond << 12 | rn << 5 | rd);
+    }
+
+    ALWAYS_INLINE static int floatingPointImmediate(Datasize type, int imm8, FPRegisterID rd)
+    {
+        const int M = 0;
+        const int S = 0;
+        const int imm5 = 0;
+        return (0x1e201000 | M << 31 | S << 29 | type << 22 | (imm8 & 0xff) << 13 | imm5 << 5 | rd);
+    }
+
+    ALWAYS_INLINE static int floatingPointIntegerConversions(Datasize sf, Datasize type, FPIntConvOp rmodeOpcode, FPRegisterID rn, FPRegisterID rd)
+    {
+        const int S = 0;
+        return (0x1e200000 | sf << 31 | S << 29 | type << 22 | rmodeOpcode << 16 | rn << 5 | rd);
+    }
+
+    ALWAYS_INLINE static int floatingPointIntegerConversions(Datasize sf, Datasize type, FPIntConvOp rmodeOpcode, FPRegisterID rn, RegisterID rd)
+    {
+        return floatingPointIntegerConversions(sf, type, rmodeOpcode, rn, xOrZrAsFPR(rd));
+    }
+
+    ALWAYS_INLINE static int floatingPointIntegerConversions(Datasize sf, Datasize type, FPIntConvOp rmodeOpcode, RegisterID rn, FPRegisterID rd)
+    {
+        return floatingPointIntegerConversions(sf, type, rmodeOpcode, xOrZrAsFPR(rn), rd);
+    }
+
+    ALWAYS_INLINE static int floatingPointDataProcessing1Source(Datasize type, FPDataOp1Source opcode, FPRegisterID rn, FPRegisterID rd)
+    {
+        const int M = 0;
+        const int S = 0;
+        return (0x1e204000 | M << 31 | S << 29 | type << 22 | opcode << 15 | rn << 5 | rd);
+    }
+
+    ALWAYS_INLINE static int floatingPointDataProcessing2Source(Datasize type, FPRegisterID rm, FPDataOp2Source opcode, FPRegisterID rn, FPRegisterID rd)
+    {
+        const int M = 0;
+        const int S = 0;
+        return (0x1e200800 | M << 31 | S << 29 | type << 22 | rm << 16 | opcode << 12 | rn << 5 | rd);
+    }
+
+    ALWAYS_INLINE static int vectorDataProcessing2Source(SIMD3Same opcode, unsigned size, FPRegisterID vm, FPRegisterID vn, FPRegisterID vd)
+    {
+        const int Q = 0;
+        return (0xe201c00 | Q << 30 | size << 22 | vm << 16 | opcode << 11 | vn << 5 | vd);
+    }
+
+    ALWAYS_INLINE static int vectorDataProcessing2Source(SIMD3Same opcode, FPRegisterID vm, FPRegisterID vn, FPRegisterID vd)
+    {
+        return vectorDataProcessing2Source(opcode, 0, vm, vn, vd);
+    }
+
+
+    // 'o1' means negate
+    ALWAYS_INLINE static int floatingPointDataProcessing3Source(Datasize type, bool o1, FPRegisterID rm, AddOp o2, FPRegisterID ra, FPRegisterID rn, FPRegisterID rd)
+    {
+        const int M = 0;
+        const int S = 0;
+        return (0x1f000000 | M << 31 | S << 29 | type << 22 | o1 << 21 | rm << 16 | o2 << 15 | ra << 10 | rn << 5 | rd);
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadRegisterLiteral(LdrLiteralOp opc, bool V, int imm19, FPRegisterID rt)
+    {
+        ASSERT(((imm19 << 13) >> 13) == imm19);
+        return (0x18000000 | opc << 30 | V << 26 | (imm19 & 0x7ffff) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadRegisterLiteral(LdrLiteralOp opc, bool V, int imm19, RegisterID rt)
+    {
+        return loadRegisterLiteral(opc, V, imm19, xOrZrAsFPR(rt));
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadStoreRegisterPostIndex(MemOpSize size, bool V, MemOp opc, int imm9, RegisterID rn, FPRegisterID rt)
+    {
+        ASSERT(!(size && V && (opc & 2))); // Maximum vector size is 128 bits.
+        ASSERT(!((size & 2) && !V && (opc == 3))); // signed 32-bit load must be extending from 8/16 bits.
+        ASSERT(isInt9(imm9));
+        return (0x38000400 | size << 30 | V << 26 | opc << 22 | (imm9 & 0x1ff) << 12 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterPostIndex(MemOpSize size, bool V, MemOp opc, int imm9, RegisterID rn, RegisterID rt)
+    {
+        return loadStoreRegisterPostIndex(size, V, opc, imm9, rn, xOrZrAsFPR(rt));
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadStoreRegisterPairPostIndex(MemPairOpSize size, bool V, MemOp opc, int immediate, RegisterID rn, FPRegisterID rt, FPRegisterID rt2)
+    {
+        ASSERT(size < 3);
+        ASSERT(opc == (opc & 1)); // Only load or store, load signed 64 is handled via size.
+        ASSERT(V || (size != MemPairOp_LoadSigned_32) || (opc == MemOp_LOAD)); // There isn't an integer store signed.
+        unsigned immedShiftAmount = memPairOffsetShift(V, size);
+        int imm7 = immediate >> immedShiftAmount;
+        ASSERT((imm7 << immedShiftAmount) == immediate && isInt7(imm7));
+        return (0x28800000 | size << 30 | V << 26 | opc << 22 | (imm7 & 0x7f) << 15 | rt2 << 10 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterPairPostIndex(MemPairOpSize size, bool V, MemOp opc, int immediate, RegisterID rn, RegisterID rt, RegisterID rt2)
+    {
+        return loadStoreRegisterPairPostIndex(size, V, opc, immediate, rn, xOrZrAsFPR(rt), xOrZrAsFPR(rt2));
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadStoreRegisterPreIndex(MemOpSize size, bool V, MemOp opc, int imm9, RegisterID rn, FPRegisterID rt)
+    {
+        ASSERT(!(size && V && (opc & 2))); // Maximum vector size is 128 bits.
+        ASSERT(!((size & 2) && !V && (opc == 3))); // signed 32-bit load must be extending from 8/16 bits.
+        ASSERT(isInt9(imm9));
+        return (0x38000c00 | size << 30 | V << 26 | opc << 22 | (imm9 & 0x1ff) << 12 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterPreIndex(MemOpSize size, bool V, MemOp opc, int imm9, RegisterID rn, RegisterID rt)
+    {
+        return loadStoreRegisterPreIndex(size, V, opc, imm9, rn, xOrZrAsFPR(rt));
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadStoreRegisterPairPreIndex(MemPairOpSize size, bool V, MemOp opc, int immediate, RegisterID rn, FPRegisterID rt, FPRegisterID rt2)
+    {
+        ASSERT(size < 3);
+        ASSERT(opc == (opc & 1)); // Only load or store, load signed 64 is handled via size.
+        ASSERT(V || (size != MemPairOp_LoadSigned_32) || (opc == MemOp_LOAD)); // There isn't an integer store signed.
+        unsigned immedShiftAmount = memPairOffsetShift(V, size);
+        int imm7 = immediate >> immedShiftAmount;
+        ASSERT((imm7 << immedShiftAmount) == immediate && isInt7(imm7));
+        return (0x29800000 | size << 30 | V << 26 | opc << 22 | (imm7 & 0x7f) << 15 | rt2 << 10 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterPairPreIndex(MemPairOpSize size, bool V, MemOp opc, int immediate, RegisterID rn, RegisterID rt, RegisterID rt2)
+    {
+        return loadStoreRegisterPairPreIndex(size, V, opc, immediate, rn, xOrZrAsFPR(rt), xOrZrAsFPR(rt2));
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadStoreRegisterPairOffset(MemPairOpSize size, bool V, MemOp opc, int immediate, RegisterID rn, FPRegisterID rt, FPRegisterID rt2)
+    {
+        ASSERT(size < 3);
+        ASSERT(opc == (opc & 1)); // Only load or store, load signed 64 is handled via size.
+        ASSERT(V || (size != MemPairOp_LoadSigned_32) || (opc == MemOp_LOAD)); // There isn't an integer store signed.
+        unsigned immedShiftAmount = memPairOffsetShift(V, size);
+        int imm7 = immediate >> immedShiftAmount;
+        ASSERT((imm7 << immedShiftAmount) == immediate && isInt7(imm7));
+        return (0x29000000 | size << 30 | V << 26 | opc << 22 | (imm7 & 0x7f) << 15 | rt2 << 10 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterPairOffset(MemPairOpSize size, bool V, MemOp opc, int immediate, RegisterID rn, RegisterID rt, RegisterID rt2)
+    {
+        return loadStoreRegisterPairOffset(size, V, opc, immediate, rn, xOrZrAsFPR(rt), xOrZrAsFPR(rt2));
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadStoreRegisterPairNonTemporal(MemPairOpSize size, bool V, MemOp opc, int immediate, RegisterID rn, FPRegisterID rt, FPRegisterID rt2)
+    {
+        ASSERT(size < 3);
+        ASSERT(opc == (opc & 1)); // Only load or store, load signed 64 is handled via size.
+        ASSERT(V || (size != MemPairOp_LoadSigned_32) || (opc == MemOp_LOAD)); // There isn't an integer store signed.
+        unsigned immedShiftAmount = memPairOffsetShift(V, size);
+        int imm7 = immediate >> immedShiftAmount;
+        ASSERT((imm7 << immedShiftAmount) == immediate && isInt7(imm7));
+        return (0x28000000 | size << 30 | V << 26 | opc << 22 | (imm7 & 0x7f) << 15 | rt2 << 10 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterPairNonTemporal(MemPairOpSize size, bool V, MemOp opc, int immediate, RegisterID rn, RegisterID rt, RegisterID rt2)
+    {
+        return loadStoreRegisterPairNonTemporal(size, V, opc, immediate, rn, xOrZrAsFPR(rt), xOrZrAsFPR(rt2));
+    }
+
+    // 'V' means vector
+    // 'S' means shift rm
+    ALWAYS_INLINE static int loadStoreRegisterRegisterOffset(MemOpSize size, bool V, MemOp opc, RegisterID rm, ExtendType option, bool S, RegisterID rn, FPRegisterID rt)
+    {
+        ASSERT(!(size && V && (opc & 2))); // Maximum vector size is 128 bits.
+        ASSERT(!((size & 2) && !V && (opc == 3))); // signed 32-bit load must be extending from 8/16 bits.
+        ASSERT(option & 2); // The ExtendType for the address must be 32/64 bit, signed or unsigned - not 8/16bit.
+        return (0x38200800 | size << 30 | V << 26 | opc << 22 | xOrZr(rm) << 16 | option << 13 | S << 12 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterRegisterOffset(MemOpSize size, bool V, MemOp opc, RegisterID rm, ExtendType option, bool S, RegisterID rn, RegisterID rt)
+    {
+        return loadStoreRegisterRegisterOffset(size, V, opc, rm, option, S, rn, xOrZrAsFPR(rt));
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadStoreRegisterUnscaledImmediate(MemOpSize size, bool V, MemOp opc, int imm9, RegisterID rn, FPRegisterID rt)
+    {
+        ASSERT(!(size && V && (opc & 2))); // Maximum vector size is 128 bits.
+        ASSERT(!((size & 2) && !V && (opc == 3))); // signed 32-bit load must be extending from 8/16 bits.
+        ASSERT(isInt9(imm9));
+        return (0x38000000 | size << 30 | V << 26 | opc << 22 | (imm9 & 0x1ff) << 12 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterUnscaledImmediate(MemOpSize size, bool V, MemOp opc, int imm9, RegisterID rn, RegisterID rt)
+    {
+        ASSERT(isInt9(imm9));
+        return loadStoreRegisterUnscaledImmediate(size, V, opc, imm9, rn, xOrZrAsFPR(rt));
+    }
+
+    // 'V' means vector
+    ALWAYS_INLINE static int loadStoreRegisterUnsignedImmediate(MemOpSize size, bool V, MemOp opc, int imm12, RegisterID rn, FPRegisterID rt)
+    {
+        ASSERT(!(size && V && (opc & 2))); // Maximum vector size is 128 bits.
+        ASSERT(!((size & 2) && !V && (opc == 3))); // signed 32-bit load must be extending from 8/16 bits.
+        ASSERT(isUInt12(imm12));
+        return (0x39000000 | size << 30 | V << 26 | opc << 22 | (imm12 & 0xfff) << 10 | xOrSp(rn) << 5 | rt);
+    }
+
+    ALWAYS_INLINE static int loadStoreRegisterUnsignedImmediate(MemOpSize size, bool V, MemOp opc, int imm12, RegisterID rn, RegisterID rt)
+    {
+        return loadStoreRegisterUnsignedImmediate(size, V, opc, imm12, rn, xOrZrAsFPR(rt));
+    }
+
+    ALWAYS_INLINE static int logicalImmediate(Datasize sf, LogicalOp opc, int N_immr_imms, RegisterID rn, RegisterID rd)
+    {
+        ASSERT(!(N_immr_imms & (sf ? ~0x1fff : ~0xfff)));
+        return (0x12000000 | sf << 31 | opc << 29 | N_immr_imms << 10 | xOrZr(rn) << 5 | xOrZrOrSp(opc == LogicalOp_ANDS, rd));
+    }
+
+    // 'N' means negate rm
+    ALWAYS_INLINE static int logicalShiftedRegister(Datasize sf, LogicalOp opc, ShiftType shift, bool N, RegisterID rm, int imm6, RegisterID rn, RegisterID rd)
+    {
+        ASSERT(!(imm6 & (sf ? ~63 : ~31)));
+        return (0x0a000000 | sf << 31 | opc << 29 | shift << 22 | N << 21 | xOrZr(rm) << 16 | (imm6 & 0x3f) << 10 | xOrZr(rn) << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int moveWideImediate(Datasize sf, MoveWideOp opc, int hw, uint16_t imm16, RegisterID rd)
+    {
+        ASSERT(hw < (sf ? 4 : 2));
+        return (0x12800000 | sf << 31 | opc << 29 | hw << 21 | (int)imm16 << 5 | xOrZr(rd));
+    }
+
+    // 'op' means link
+    ALWAYS_INLINE static int unconditionalBranchImmediate(bool op, int32_t imm26)
+    {
+        ASSERT(imm26 == (imm26 << 6) >> 6);
+        return (0x14000000 | op << 31 | (imm26 & 0x3ffffff));
+    }
+
+    // 'op' means page
+    ALWAYS_INLINE static int pcRelative(bool op, int32_t imm21, RegisterID rd)
+    {
+        ASSERT(imm21 == (imm21 << 11) >> 11);
+        int32_t immlo = imm21 & 3;
+        int32_t immhi = (imm21 >> 2) & 0x7ffff;
+        return (0x10000000 | op << 31 | immlo << 29 | immhi << 5 | xOrZr(rd));
+    }
+
+    ALWAYS_INLINE static int system(bool L, int op0, int op1, int crn, int crm, int op2, RegisterID rt)
+    {
+        return (0xd5000000 | L << 21 | op0 << 19 | op1 << 16 | crn << 12 | crm << 8 | op2 << 5 | xOrZr(rt));
+    }
+
+    ALWAYS_INLINE static int hintPseudo(int imm)
+    {
+        ASSERT(!(imm & ~0x7f));
+        return system(0, 0, 3, 2, (imm >> 3) & 0xf, imm & 0x7, ARM64Registers::zr);
+    }
+
+    ALWAYS_INLINE static int nopPseudo()
+    {
+        return hintPseudo(0);
+    }
+    
+    // 'op' means negate
+    ALWAYS_INLINE static int testAndBranchImmediate(bool op, int b50, int imm14, RegisterID rt)
+    {
+        ASSERT(!(b50 & ~0x3f));
+        ASSERT(imm14 == (imm14 << 18) >> 18);
+        int b5 = b50 >> 5;
+        int b40 = b50 & 0x1f;
+        return (0x36000000 | b5 << 31 | op << 24 | b40 << 19 | (imm14 & 0x3fff) << 5 | xOrZr(rt));
+    }
+
+    ALWAYS_INLINE static int unconditionalBranchRegister(BranchType opc, RegisterID rn)
+    {
+        // The only allocated values for op2 is 0x1f, for op3 & op4 are 0.
+        const int op2 = 0x1f;
+        const int op3 = 0;
+        const int op4 = 0;
+        return (0xd6000000 | opc << 21 | op2 << 16 | op3 << 10 | xOrZr(rn) << 5 | op4);
+    }
+
+    // Workaround for Cortex-A53 erratum (835769). Emit an extra nop if the
+    // last instruction in the buffer is a load, store or prefetch. Needed
+    // before 64-bit multiply-accumulate instructions.
+    template<int datasize>
+    ALWAYS_INLINE void nopCortexA53Fix835769()
+    {
+#if CPU(ARM64_CORTEXA53)
+        CHECK_DATASIZE();
+        if (datasize == 64) {
+            if (LIKELY(m_buffer.codeSize() >= sizeof(int32_t))) {
+                // From ARMv8 Reference Manual, Section C4.1: the encoding of the
+                // instructions in the Loads and stores instruction group is:
+                // ---- 1-0- ---- ---- ---- ---- ---- ----
+                if (UNLIKELY((*reinterpret_cast_ptr<int32_t*>(reinterpret_cast_ptr<char*>(m_buffer.data()) + m_buffer.codeSize() - sizeof(int32_t)) & 0x0a000000) == 0x08000000))
+                    nop();
+            }
+        }
+#endif
+    }
+
+    // Workaround for Cortex-A53 erratum (843419). Emit extra nops to avoid
+    // wrong address access after ADRP instruction.
+    ALWAYS_INLINE void nopCortexA53Fix843419()
+    {
+#if CPU(ARM64_CORTEXA53)
+        nop();
+        nop();
+        nop();
+#endif
+    }
+
+    AssemblerBuffer m_buffer;
+    Vector<LinkRecord, 0, UnsafeVectorOverflow> m_jumpsToLink;
+    int m_indexOfLastWatchpoint;
+    int m_indexOfTailOfLastWatchpoint;
+};
+
+} // namespace JSC
+
+#undef CHECK_DATASIZE_OF
+#undef DATASIZE_OF
+#undef MEMOPSIZE_OF
+#undef CHECK_DATASIZE
+#undef DATASIZE
+#undef MEMOPSIZE
+#undef CHECK_FP_MEMOP_DATASIZE
+
+#endif // ENABLE(ASSEMBLER) && CPU(ARM64)
diff --git a/assembler/ARMAssembler.cpp b/assembler/ARMAssembler.cpp
new file mode 100644
index 0000000..552f37f
--- /dev/null
+++ b/assembler/ARMAssembler.cpp
@@ -0,0 +1,423 @@
+/*
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
+
+#include "ARMAssembler.h"
+
+namespace JSC {
+
+// Patching helpers
+
+void ARMAssembler::patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
+{
+    ARMWord *ldr = reinterpret_cast<ARMWord*>(loadAddr);
+    ARMWord diff = reinterpret_cast<ARMWord*>(constPoolAddr) - ldr;
+    ARMWord index = (*ldr & 0xfff) >> 1;
+
+    ASSERT(diff >= 1);
+    if (diff >= 2 || index > 0) {
+        diff = (diff + index - 2) * sizeof(ARMWord);
+        ASSERT(diff <= 0xfff);
+        *ldr = (*ldr & ~0xfff) | diff;
+    } else
+        *ldr = (*ldr & ~(0xfff | ARMAssembler::DataTransferUp)) | sizeof(ARMWord);
+}
+
+// Handle immediates
+
+ARMWord ARMAssembler::getOp2(ARMWord imm)
+{
+    int rol;
+
+    if (imm <= 0xff)
+        return Op2Immediate | imm;
+
+    if ((imm & 0xff000000) == 0) {
+        imm <<= 8;
+        rol = 8;
+    }
+    else {
+        imm = (imm << 24) | (imm >> 8);
+        rol = 0;
+    }
+
+    if ((imm & 0xff000000) == 0) {
+        imm <<= 8;
+        rol += 4;
+    }
+
+    if ((imm & 0xf0000000) == 0) {
+        imm <<= 4;
+        rol += 2;
+    }
+
+    if ((imm & 0xc0000000) == 0) {
+        imm <<= 2;
+        rol += 1;
+    }
+
+    if ((imm & 0x00ffffff) == 0)
+        return Op2Immediate | (imm >> 24) | (rol << 8);
+
+    return InvalidImmediate;
+}
+
+int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
+{
+    // Step1: Search a non-immediate part
+    ARMWord mask;
+    ARMWord imm1;
+    ARMWord imm2;
+    int rol;
+
+    mask = 0xff000000;
+    rol = 8;
+    while(1) {
+        if ((imm & mask) == 0) {
+            imm = (imm << rol) | (imm >> (32 - rol));
+            rol = 4 + (rol >> 1);
+            break;
+        }
+        rol += 2;
+        mask >>= 2;
+        if (mask & 0x3) {
+            // rol 8
+            imm = (imm << 8) | (imm >> 24);
+            mask = 0xff00;
+            rol = 24;
+            while (1) {
+                if ((imm & mask) == 0) {
+                    imm = (imm << rol) | (imm >> (32 - rol));
+                    rol = (rol >> 1) - 8;
+                    break;
+                }
+                rol += 2;
+                mask >>= 2;
+                if (mask & 0x3)
+                    return 0;
+            }
+            break;
+        }
+    }
+
+    ASSERT((imm & 0xff) == 0);
+
+    if ((imm & 0xff000000) == 0) {
+        imm1 = Op2Immediate | ((imm >> 16) & 0xff) | (((rol + 4) & 0xf) << 8);
+        imm2 = Op2Immediate | ((imm >> 8) & 0xff) | (((rol + 8) & 0xf) << 8);
+    } else if (imm & 0xc0000000) {
+        imm1 = Op2Immediate | ((imm >> 24) & 0xff) | ((rol & 0xf) << 8);
+        imm <<= 8;
+        rol += 4;
+
+        if ((imm & 0xff000000) == 0) {
+            imm <<= 8;
+            rol += 4;
+        }
+
+        if ((imm & 0xf0000000) == 0) {
+            imm <<= 4;
+            rol += 2;
+        }
+
+        if ((imm & 0xc0000000) == 0) {
+            imm <<= 2;
+            rol += 1;
+        }
+
+        if ((imm & 0x00ffffff) == 0)
+            imm2 = Op2Immediate | (imm >> 24) | ((rol & 0xf) << 8);
+        else
+            return 0;
+    } else {
+        if ((imm & 0xf0000000) == 0) {
+            imm <<= 4;
+            rol += 2;
+        }
+
+        if ((imm & 0xc0000000) == 0) {
+            imm <<= 2;
+            rol += 1;
+        }
+
+        imm1 = Op2Immediate | ((imm >> 24) & 0xff) | ((rol & 0xf) << 8);
+        imm <<= 8;
+        rol += 4;
+
+        if ((imm & 0xf0000000) == 0) {
+            imm <<= 4;
+            rol += 2;
+        }
+
+        if ((imm & 0xc0000000) == 0) {
+            imm <<= 2;
+            rol += 1;
+        }
+
+        if ((imm & 0x00ffffff) == 0)
+            imm2 = Op2Immediate | (imm >> 24) | ((rol & 0xf) << 8);
+        else
+            return 0;
+    }
+
+    if (positive) {
+        mov(reg, imm1);
+        orr(reg, reg, imm2);
+    } else {
+        mvn(reg, imm1);
+        bic(reg, reg, imm2);
+    }
+
+    return 1;
+}
+
+ARMWord ARMAssembler::getImm(ARMWord imm, int tmpReg, bool invert)
+{
+    ARMWord tmp;
+
+    // Do it by 1 instruction
+    tmp = getOp2(imm);
+    if (tmp != InvalidImmediate)
+        return tmp;
+
+    tmp = getOp2(~imm);
+    if (tmp != InvalidImmediate) {
+        if (invert)
+            return tmp | Op2InvertedImmediate;
+        mvn(tmpReg, tmp);
+        return tmpReg;
+    }
+
+    return encodeComplexImm(imm, tmpReg);
+}
+
+void ARMAssembler::moveImm(ARMWord imm, int dest)
+{
+    ARMWord tmp;
+
+    // Do it by 1 instruction
+    tmp = getOp2(imm);
+    if (tmp != InvalidImmediate) {
+        mov(dest, tmp);
+        return;
+    }
+
+    tmp = getOp2(~imm);
+    if (tmp != InvalidImmediate) {
+        mvn(dest, tmp);
+        return;
+    }
+
+    encodeComplexImm(imm, dest);
+}
+
+ARMWord ARMAssembler::encodeComplexImm(ARMWord imm, int dest)
+{
+#if WTF_ARM_ARCH_AT_LEAST(7)
+    ARMWord tmp = getImm16Op2(imm);
+    if (tmp != InvalidImmediate) {
+        movw(dest, tmp);
+        return dest;
+    }
+    movw(dest, getImm16Op2(imm & 0xffff));
+    movt(dest, getImm16Op2(imm >> 16));
+    return dest;
+#else
+    // Do it by 2 instruction
+    if (genInt(dest, imm, true))
+        return dest;
+    if (genInt(dest, ~imm, false))
+        return dest;
+
+    ldrImmediate(dest, imm);
+    return dest;
+#endif
+}
+
+// Memory load/store helpers
+
+void ARMAssembler::dataTransfer32(DataTransferTypeA transferType, RegisterID srcDst, RegisterID base, int32_t offset)
+{
+    if (offset >= 0) {
+        if (offset <= 0xfff)
+            dtrUp(transferType, srcDst, base, offset);
+        else if (offset <= 0xfffff) {
+            add(ARMRegisters::S0, base, Op2Immediate | (offset >> 12) | (10 << 8));
+            dtrUp(transferType, srcDst, ARMRegisters::S0, (offset & 0xfff));
+        } else {
+            moveImm(offset, ARMRegisters::S0);
+            dtrUpRegister(transferType, srcDst, base, ARMRegisters::S0);
+        }
+    } else {
+        if (offset >= -0xfff)
+            dtrDown(transferType, srcDst, base, -offset);
+        else if (offset >= -0xfffff) {
+            sub(ARMRegisters::S0, base, Op2Immediate | (-offset >> 12) | (10 << 8));
+            dtrDown(transferType, srcDst, ARMRegisters::S0, (-offset & 0xfff));
+        } else {
+            moveImm(offset, ARMRegisters::S0);
+            dtrUpRegister(transferType, srcDst, base, ARMRegisters::S0);
+        }
+    }
+}
+
+void ARMAssembler::baseIndexTransfer32(DataTransferTypeA transferType, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset)
+{
+    ASSERT(scale >= 0 && scale <= 3);
+    ARMWord op2 = lsl(index, scale);
+
+    if (!offset) {
+        dtrUpRegister(transferType, srcDst, base, op2);
+        return;
+    }
+
+    if (offset <= 0xfffff && offset >= -0xfffff) {
+        add(ARMRegisters::S0, base, op2);
+        dataTransfer32(transferType, srcDst, ARMRegisters::S0, offset);
+        return;
+    }
+
+    moveImm(offset, ARMRegisters::S0);
+    add(ARMRegisters::S0, ARMRegisters::S0, op2);
+    dtrUpRegister(transferType, srcDst, base, ARMRegisters::S0);
+}
+
+void ARMAssembler::dataTransfer16(DataTransferTypeB transferType, RegisterID srcDst, RegisterID base, int32_t offset)
+{
+    if (offset >= 0) {
+        if (offset <= 0xff)
+            halfDtrUp(transferType, srcDst, base, getOp2Half(offset));
+        else if (offset <= 0xffff) {
+            add(ARMRegisters::S0, base, Op2Immediate | (offset >> 8) | (12 << 8));
+            halfDtrUp(transferType, srcDst, ARMRegisters::S0, getOp2Half(offset & 0xff));
+        } else {
+            moveImm(offset, ARMRegisters::S0);
+            halfDtrUpRegister(transferType, srcDst, base, ARMRegisters::S0);
+        }
+    } else {
+        if (offset >= -0xff)
+            halfDtrDown(transferType, srcDst, base, getOp2Half(-offset));
+        else if (offset >= -0xffff) {
+            sub(ARMRegisters::S0, base, Op2Immediate | (-offset >> 8) | (12 << 8));
+            halfDtrDown(transferType, srcDst, ARMRegisters::S0, getOp2Half(-offset & 0xff));
+        } else {
+            moveImm(offset, ARMRegisters::S0);
+            halfDtrUpRegister(transferType, srcDst, base, ARMRegisters::S0);
+        }
+    }
+}
+
+void ARMAssembler::baseIndexTransfer16(DataTransferTypeB transferType, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset)
+{
+    if (!scale && !offset) {
+        halfDtrUpRegister(transferType, srcDst, base, index);
+        return;
+    }
+
+    ARMWord op2 = lsl(index, scale);
+
+    if (offset <= 0xffff && offset >= -0xffff) {
+        add(ARMRegisters::S0, base, op2);
+        dataTransfer16(transferType, srcDst, ARMRegisters::S0, offset);
+        return;
+    }
+
+    moveImm(offset, ARMRegisters::S0);
+    add(ARMRegisters::S0, ARMRegisters::S0, op2);
+    halfDtrUpRegister(transferType, srcDst, base, ARMRegisters::S0);
+}
+
+void ARMAssembler::dataTransferFloat(DataTransferTypeFloat transferType, FPRegisterID srcDst, RegisterID base, int32_t offset)
+{
+    // VFP cannot directly access memory that is not four-byte-aligned
+    if (!(offset & 0x3)) {
+        if (offset <= 0x3ff && offset >= 0) {
+            doubleDtrUp(transferType, srcDst, base, offset >> 2);
+            return;
+        }
+        if (offset <= 0x3ffff && offset >= 0) {
+            add(ARMRegisters::S0, base, Op2Immediate | (offset >> 10) | (11 << 8));
+            doubleDtrUp(transferType, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
+            return;
+        }
+        offset = -offset;
+
+        if (offset <= 0x3ff && offset >= 0) {
+            doubleDtrDown(transferType, srcDst, base, offset >> 2);
+            return;
+        }
+        if (offset <= 0x3ffff && offset >= 0) {
+            sub(ARMRegisters::S0, base, Op2Immediate | (offset >> 10) | (11 << 8));
+            doubleDtrDown(transferType, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
+            return;
+        }
+        offset = -offset;
+    }
+
+    moveImm(offset, ARMRegisters::S0);
+    add(ARMRegisters::S0, ARMRegisters::S0, base);
+    doubleDtrUp(transferType, srcDst, ARMRegisters::S0, 0);
+}
+
+void ARMAssembler::baseIndexTransferFloat(DataTransferTypeFloat transferType, FPRegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset)
+{
+    add(ARMRegisters::S1, base, lsl(index, scale));
+    dataTransferFloat(transferType, srcDst, ARMRegisters::S1, offset);
+}
+
+void ARMAssembler::prepareExecutableCopy(void* to)
+{
+    // 64-bit alignment is required for next constant pool and JIT code as well
+    m_buffer.flushWithoutBarrier(true);
+
+    char* data = reinterpret_cast<char*>(m_buffer.data());
+    ptrdiff_t delta = reinterpret_cast<char*>(to) - data;
+
+    for (Jumps::Iterator iter = m_jumps.begin(); iter != m_jumps.end(); ++iter) {
+        // The last bit is set if the constant must be placed on constant pool.
+        int pos = (iter->m_offset) & (~0x1);
+        ARMWord* ldrAddr = reinterpret_cast_ptr<ARMWord*>(data + pos);
+        ARMWord* addr = getLdrImmAddress(ldrAddr);
+        if (*addr != InvalidBranchTarget) {
+            if (!(iter->m_offset & 1)) {
+                intptr_t difference = reinterpret_cast_ptr<ARMWord*>(data + *addr) - (ldrAddr + DefaultPrefetchOffset);
+
+                if ((difference <= MaximumBranchOffsetDistance && difference >= MinimumBranchOffsetDistance)) {
+                    *ldrAddr = B | getConditionalField(*ldrAddr) | (difference & BranchOffsetMask);
+                    continue;
+                }
+            }
+            *addr = reinterpret_cast<ARMWord>(data + delta + *addr);
+        }
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/assembler/ARMAssembler.h b/assembler/ARMAssembler.h
new file mode 100644
index 0000000..6fba9ed
--- /dev/null
+++ b/assembler/ARMAssembler.h
@@ -0,0 +1,1212 @@
+/*
+ * Copyright (C) 2009, 2010 University of Szeged
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
+
+#include "AssemblerBufferWithConstantPool.h"
+#include "JITCompilationEffort.h"
+#include <wtf/Assertions.h>
+namespace JSC {
+
+    typedef uint32_t ARMWord;
+
+    #define FOR_EACH_CPU_REGISTER(V) \
+        FOR_EACH_CPU_GPREGISTER(V) \
+        FOR_EACH_CPU_SPECIAL_REGISTER(V) \
+        FOR_EACH_CPU_FPREGISTER(V)
+
+    #define FOR_EACH_CPU_GPREGISTER(V) \
+        V(void*, r0) \
+        V(void*, r1) \
+        V(void*, r2) \
+        V(void*, r3) \
+        V(void*, r4) \
+        V(void*, r5) \
+        V(void*, r6) \
+        V(void*, r7) \
+        V(void*, r8) \
+        V(void*, r9) \
+        V(void*, r10) \
+        V(void*, fp) \
+        V(void*, ip) \
+        V(void*, sp) \
+        V(void*, lr) \
+        V(void*, pc) \
+
+    #define FOR_EACH_CPU_SPECIAL_REGISTER(V) \
+        V(void*, apsr) \
+        V(void*, fpscr) \
+
+    #define FOR_EACH_CPU_FPREGISTER(V) \
+        V(double, d0) \
+        V(double, d1) \
+        V(double, d2) \
+        V(double, d3) \
+        V(double, d4) \
+        V(double, d5) \
+        V(double, d6) \
+        V(double, d7) \
+        V(double, d8) \
+        V(double, d9) \
+        V(double, d10) \
+        V(double, d11) \
+        V(double, d12) \
+        V(double, d13) \
+        V(double, d14) \
+        V(double, d15) \
+        V(double, d16) \
+        V(double, d17) \
+        V(double, d18) \
+        V(double, d19) \
+        V(double, d20) \
+        V(double, d21) \
+        V(double, d22) \
+        V(double, d23) \
+        V(double, d24) \
+        V(double, d25) \
+        V(double, d26) \
+        V(double, d27) \
+        V(double, d28) \
+        V(double, d29) \
+        V(double, d30) \
+        V(double, d31) \
+
+    namespace ARMRegisters {
+
+        typedef enum {
+            #define DECLARE_REGISTER(_type, _regName) _regName,
+            FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
+            #undef DECLARE_REGISTER
+
+            // Pseudonyms for some of the registers.
+            S0 = r6,
+            r11 = fp, // frame pointer
+            r12 = ip, S1 = ip,
+            r13 = sp,
+            r14 = lr,
+            r15 = pc
+        } RegisterID;
+
+        typedef enum {
+            #define DECLARE_REGISTER(_type, _regName) _regName,
+            FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
+            #undef DECLARE_REGISTER
+
+            // Pseudonyms for some of the registers.
+            SD0 = d7, /* Same as thumb assembler. */
+        } FPRegisterID;
+
+    } // namespace ARMRegisters
+
+    class ARMAssembler {
+    public:
+        typedef ARMRegisters::RegisterID RegisterID;
+        typedef ARMRegisters::FPRegisterID FPRegisterID;
+        typedef AssemblerBufferWithConstantPool<2048, 4, 4, ARMAssembler> ARMBuffer;
+        typedef SegmentedVector<AssemblerLabel, 64> Jumps;
+
+        ARMAssembler()
+            : m_indexOfTailOfLastWatchpoint(1)
+        {
+        }
+
+        ARMBuffer& buffer() { return m_buffer; }
+
+        static constexpr RegisterID firstRegister() { return ARMRegisters::r0; }
+        static constexpr RegisterID lastRegister() { return ARMRegisters::r15; }
+
+        static constexpr FPRegisterID firstFPRegister() { return ARMRegisters::d0; }
+        static constexpr FPRegisterID lastFPRegister() { return ARMRegisters::d31; }
+
+        // ARM conditional constants
+        typedef enum {
+            EQ = 0x00000000, // Zero / Equal.
+            NE = 0x10000000, // Non-zero / Not equal.
+            CS = 0x20000000, // Unsigned higher or same.
+            CC = 0x30000000, // Unsigned lower.
+            MI = 0x40000000, // Negative.
+            PL = 0x50000000, // Positive or zero.
+            VS = 0x60000000, // Overflowed.
+            VC = 0x70000000, // Not overflowed.
+            HI = 0x80000000, // Unsigned higher.
+            LS = 0x90000000, // Unsigned lower or same.
+            GE = 0xa0000000, // Signed greater than or equal.
+            LT = 0xb0000000, // Signed less than.
+            GT = 0xc0000000, // Signed greater than.
+            LE = 0xd0000000, // Signed less than or equal.
+            AL = 0xe0000000  // Unconditional / Always execute.
+        } Condition;
+
+        // ARM instruction constants
+        enum {
+            AND = (0x0 << 21),
+            EOR = (0x1 << 21),
+            SUB = (0x2 << 21),
+            RSB = (0x3 << 21),
+            ADD = (0x4 << 21),
+            ADC = (0x5 << 21),
+            SBC = (0x6 << 21),
+            RSC = (0x7 << 21),
+            TST = (0x8 << 21),
+            TEQ = (0x9 << 21),
+            CMP = (0xa << 21),
+            CMN = (0xb << 21),
+            ORR = (0xc << 21),
+            MOV = (0xd << 21),
+            BIC = (0xe << 21),
+            MVN = (0xf << 21),
+            MUL = 0x00000090,
+            MULL = 0x00c00090,
+            VMOV_F64 = 0x0eb00b40,
+            VADD_F64 = 0x0e300b00,
+            VDIV_F64 = 0x0e800b00,
+            VSUB_F64 = 0x0e300b40,
+            VMUL_F64 = 0x0e200b00,
+            VCMP_F64 = 0x0eb40b40,
+            VSQRT_F64 = 0x0eb10bc0,
+            VABS_F64 = 0x0eb00bc0,
+            VNEG_F64 = 0x0eb10b40,
+            STMDB = 0x09200000,
+            LDMIA = 0x08b00000,
+            B = 0x0a000000,
+            BL = 0x0b000000,
+            BX = 0x012fff10,
+            VMOV_VFP64 = 0x0c400a10,
+            VMOV_ARM64 = 0x0c500a10,
+            VMOV_VFP32 = 0x0e000a10,
+            VMOV_ARM32 = 0x0e100a10,
+            VCVT_F64_S32 = 0x0eb80bc0,
+            VCVT_S32_F64 = 0x0ebd0bc0,
+            VCVT_U32_F64 = 0x0ebc0bc0,
+            VCVT_F32_F64 = 0x0eb70bc0,
+            VCVT_F64_F32 = 0x0eb70ac0,
+            VMRS_APSR = 0x0ef1fa10,
+            CLZ = 0x016f0f10,
+            BKPT = 0xe1200070,
+            BLX = 0x012fff30,
+#if WTF_ARM_ARCH_AT_LEAST(7)
+            MOVW = 0x03000000,
+            MOVT = 0x03400000,
+#endif
+            NOP = 0xe1a00000,
+            DMB_SY = 0xf57ff05f,
+            DMB_ISHST = 0xf57ff05a,
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+            SDIV = 0x0710f010,
+            UDIV = 0x0730f010,
+#endif
+        };
+
+        enum {
+            Op2Immediate = (1 << 25),
+            ImmediateForHalfWordTransfer = (1 << 22),
+            Op2InvertedImmediate = (1 << 26),
+            SetConditionalCodes = (1 << 20),
+            Op2IsRegisterArgument = (1 << 25),
+            // Data transfer flags.
+            DataTransferUp = (1 << 23),
+            DataTransferWriteBack = (1 << 21),
+            DataTransferPostUpdate = (1 << 24),
+            DataTransferLoad = (1 << 20),
+            ByteDataTransfer = (1 << 22),
+        };
+
+        enum DataTransferTypeA {
+            LoadUint32 = 0x05000000 | DataTransferLoad,
+            LoadUint8 = 0x05400000 | DataTransferLoad,
+            StoreUint32 = 0x05000000,
+            StoreUint8 = 0x05400000,
+        };
+
+        enum DataTransferTypeB {
+            LoadUint16 = 0x010000b0 | DataTransferLoad,
+            LoadInt16 = 0x010000f0 | DataTransferLoad,
+            LoadInt8 = 0x010000d0 | DataTransferLoad,
+            StoreUint16 = 0x010000b0,
+        };
+
+        enum DataTransferTypeFloat {
+            LoadFloat = 0x0d000a00 | DataTransferLoad,
+            LoadDouble = 0x0d000b00 | DataTransferLoad,
+            StoreFloat = 0x0d000a00,
+            StoreDouble = 0x0d000b00,
+        };
+
+        // Masks of ARM instructions
+        enum {
+            BranchOffsetMask = 0x00ffffff,
+            ConditionalFieldMask = 0xf0000000,
+            DataTransferOffsetMask = 0xfff,
+        };
+
+        enum {
+            MinimumBranchOffsetDistance = -0x00800000,
+            MaximumBranchOffsetDistance = 0x007fffff,
+        };
+
+        enum {
+            padForAlign8  = 0x00,
+            padForAlign16 = 0x0000,
+            padForAlign32 = 0xe12fff7f // 'bkpt 0xffff' instruction.
+        };
+
+        static const ARMWord InvalidImmediate = 0xf0000000;
+        static const ARMWord InvalidBranchTarget = 0xffffffff;
+        static const int DefaultPrefetchOffset = 2;
+
+        static const ARMWord BlxInstructionMask = 0x012fff30;
+        static const ARMWord LdrOrAddInstructionMask = 0x0ff00000;
+        static const ARMWord LdrPcImmediateInstructionMask = 0x0f7f0000;
+
+        static const ARMWord AddImmediateInstruction = 0x02800000;
+        static const ARMWord BlxInstruction = 0x012fff30;
+        static const ARMWord LdrImmediateInstruction = 0x05900000;
+        static const ARMWord LdrPcImmediateInstruction = 0x051f0000;
+
+        // Instruction formating
+
+        void emitInstruction(ARMWord op, int rd, int rn, ARMWord op2)
+        {
+            ASSERT(((op2 & ~Op2Immediate) <= 0xfff) || (((op2 & ~ImmediateForHalfWordTransfer) <= 0xfff)));
+            m_buffer.putInt(op | RN(rn) | RD(rd) | op2);
+        }
+
+        void emitDoublePrecisionInstruction(ARMWord op, int dd, int dn, int dm)
+        {
+            ASSERT((dd >= 0 && dd <= 31) && (dn >= 0 && dn <= 31) && (dm >= 0 && dm <= 31));
+            m_buffer.putInt(op | ((dd & 0xf) << 12) | ((dd & 0x10) << (22 - 4))
+                               | ((dn & 0xf) << 16) | ((dn & 0x10) << (7 - 4))
+                               | (dm & 0xf) | ((dm & 0x10) << (5 - 4)));
+        }
+
+        void emitSinglePrecisionInstruction(ARMWord op, int sd, int sn, int sm)
+        {
+            ASSERT((sd >= 0 && sd <= 31) && (sn >= 0 && sn <= 31) && (sm >= 0 && sm <= 31));
+            m_buffer.putInt(op | ((sd >> 1) << 12) | ((sd & 0x1) << 22)
+                               | ((sn >> 1) << 16) | ((sn & 0x1) << 7)
+                               | (sm >> 1) | ((sm & 0x1) << 5));
+        }
+
+        void bitAnd(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | AND, rd, rn, op2);
+        }
+
+        void bitAnds(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | AND | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void eor(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | EOR, rd, rn, op2);
+        }
+
+        void eors(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | EOR | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void sub(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | SUB, rd, rn, op2);
+        }
+
+        void subs(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | SUB | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void rsb(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | RSB, rd, rn, op2);
+        }
+
+        void rsbs(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | RSB | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void add(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | ADD, rd, rn, op2);
+        }
+
+        void adds(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | ADD | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void adc(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | ADC, rd, rn, op2);
+        }
+
+        void adcs(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | ADC | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void sbc(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | SBC, rd, rn, op2);
+        }
+
+        void sbcs(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | SBC | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void rsc(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | RSC, rd, rn, op2);
+        }
+
+        void rscs(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | RSC | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void tst(int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | TST | SetConditionalCodes, 0, rn, op2);
+        }
+
+        void teq(int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | TEQ | SetConditionalCodes, 0, rn, op2);
+        }
+
+        void cmp(int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | CMP | SetConditionalCodes, 0, rn, op2);
+        }
+
+        void cmn(int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | CMN | SetConditionalCodes, 0, rn, op2);
+        }
+
+        void orr(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | ORR, rd, rn, op2);
+        }
+
+        void orrs(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | ORR | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void mov(int rd, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | MOV, rd, ARMRegisters::r0, op2);
+        }
+
+#if WTF_ARM_ARCH_AT_LEAST(7)
+        void movw(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(toARMWord(cc) | MOVW | RD(rd) | op2);
+        }
+
+        void movt(int rd, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT((op2 | 0xf0fff) == 0xf0fff);
+            m_buffer.putInt(toARMWord(cc) | MOVT | RD(rd) | op2);
+        }
+#endif
+
+        void movs(int rd, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | MOV | SetConditionalCodes, rd, ARMRegisters::r0, op2);
+        }
+
+        void bic(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | BIC, rd, rn, op2);
+        }
+
+        void bics(int rd, int rn, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | BIC | SetConditionalCodes, rd, rn, op2);
+        }
+
+        void mvn(int rd, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | MVN, rd, ARMRegisters::r0, op2);
+        }
+
+        void mvns(int rd, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | MVN | SetConditionalCodes, rd, ARMRegisters::r0, op2);
+        }
+
+        void mul(int rd, int rn, int rm, Condition cc = AL)
+        {
+            m_buffer.putInt(toARMWord(cc) | MUL | RN(rd) | RS(rn) | RM(rm));
+        }
+
+        void muls(int rd, int rn, int rm, Condition cc = AL)
+        {
+            m_buffer.putInt(toARMWord(cc) | MUL | SetConditionalCodes | RN(rd) | RS(rn) | RM(rm));
+        }
+
+        void mull(int rdhi, int rdlo, int rn, int rm, Condition cc = AL)
+        {
+            m_buffer.putInt(toARMWord(cc) | MULL | RN(rdhi) | RD(rdlo) | RS(rn) | RM(rm));
+        }
+
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+        template<int datasize>
+        void sdiv(int rd, int rn, int rm, Condition cc = AL)
+        {
+            static_assert(datasize == 32, "sdiv datasize must be 32 for armv7s");
+            ASSERT(rd != ARMRegisters::pc);
+            ASSERT(rn != ARMRegisters::pc);
+            ASSERT(rm != ARMRegisters::pc);
+            m_buffer.putInt(toARMWord(cc) | SDIV | RN(rd) | RM(rn) | RS(rm));
+        }
+
+        void udiv(int rd, int rn, int rm, Condition cc = AL)
+        {
+            ASSERT(rd != ARMRegisters::pc);
+            ASSERT(rn != ARMRegisters::pc);
+            ASSERT(rm != ARMRegisters::pc);
+            m_buffer.putInt(toARMWord(cc) | UDIV | RN(rd) | RM(rn) | RS(rm));
+        }
+#endif
+
+        void vmov_f64(int dd, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VMOV_F64, dd, 0, dm);
+        }
+
+        void vadd_f64(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VADD_F64, dd, dn, dm);
+        }
+
+        void vdiv_f64(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VDIV_F64, dd, dn, dm);
+        }
+
+        void vsub_f64(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VSUB_F64, dd, dn, dm);
+        }
+
+        void vmul_f64(int dd, int dn, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VMUL_F64, dd, dn, dm);
+        }
+
+        void vcmp_f64(int dd, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCMP_F64, dd, 0, dm);
+        }
+
+        void vsqrt_f64(int dd, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VSQRT_F64, dd, 0, dm);
+        }
+
+        void vabs_f64(int dd, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VABS_F64, dd, 0, dm);
+        }
+
+        void vneg_f64(int dd, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInstruction(toARMWord(cc) | VNEG_F64, dd, 0, dm);
+        }
+
+        void ldrImmediate(int rd, ARMWord imm, Condition cc = AL)
+        {
+            m_buffer.putIntWithConstantInt(toARMWord(cc) | LoadUint32 | DataTransferUp | RN(ARMRegisters::pc) | RD(rd), imm, true);
+        }
+
+        void ldrUniqueImmediate(int rd, ARMWord imm, Condition cc = AL)
+        {
+            m_buffer.putIntWithConstantInt(toARMWord(cc) | LoadUint32 | DataTransferUp | RN(ARMRegisters::pc) | RD(rd), imm);
+        }
+
+        void dtrUp(DataTransferTypeA transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | transferType | DataTransferUp, rd, rb, op2);
+        }
+
+        void dtrUpRegister(DataTransferTypeA transferType, int rd, int rb, int rm, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | transferType | DataTransferUp | Op2IsRegisterArgument, rd, rb, rm);
+        }
+
+        void dtrDown(DataTransferTypeA transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | transferType, rd, rb, op2);
+        }
+
+        void dtrDownRegister(DataTransferTypeA transferType, int rd, int rb, int rm, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | transferType | Op2IsRegisterArgument, rd, rb, rm);
+        }
+
+        void halfDtrUp(DataTransferTypeB transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | transferType | DataTransferUp, rd, rb, op2);
+        }
+
+        void halfDtrUpRegister(DataTransferTypeB transferType, int rd, int rn, int rm, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | transferType | DataTransferUp, rd, rn, rm);
+        }
+
+        void halfDtrDown(DataTransferTypeB transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | transferType, rd, rb, op2);
+        }
+
+        void halfDtrDownRegister(DataTransferTypeB transferType, int rd, int rn, int rm, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | transferType, rd, rn, rm);
+        }
+
+        void doubleDtrUp(DataTransferTypeFloat type, int rd, int rb, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT(op2 <= 0xff && rd <= 15);
+            /* Only d0-d15 and s0, s2, s4 ... s30 are supported. */
+            m_buffer.putInt(toARMWord(cc) | DataTransferUp | type | (rd << 12) | RN(rb) | op2);
+        }
+
+        void doubleDtrDown(DataTransferTypeFloat type, int rd, int rb, ARMWord op2, Condition cc = AL)
+        {
+            ASSERT(op2 <= 0xff && rd <= 15);
+            /* Only d0-d15 and s0, s2, s4 ... s30 are supported. */
+            m_buffer.putInt(toARMWord(cc) | type | (rd << 12) | RN(rb) | op2);
+        }
+
+        void push(int reg, Condition cc = AL)
+        {
+            ASSERT(ARMWord(reg) <= 0xf);
+            m_buffer.putInt(toARMWord(cc) | StoreUint32 | DataTransferWriteBack | RN(ARMRegisters::sp) | RD(reg) | 0x4);
+        }
+
+        void pop(int reg, Condition cc = AL)
+        {
+            ASSERT(ARMWord(reg) <= 0xf);
+            m_buffer.putInt(toARMWord(cc) | (LoadUint32 ^ DataTransferPostUpdate) | DataTransferUp | RN(ARMRegisters::sp) | RD(reg) | 0x4);
+        }
+
+        inline void poke(int reg, Condition cc = AL)
+        {
+            dtrDown(StoreUint32, ARMRegisters::sp, 0, reg, cc);
+        }
+
+        inline void peek(int reg, Condition cc = AL)
+        {
+            dtrUp(LoadUint32, reg, ARMRegisters::sp, 0, cc);
+        }
+
+        void vmov_vfp64(int sm, int rt, int rt2, Condition cc = AL)
+        {
+            ASSERT(rt != rt2);
+            m_buffer.putInt(toARMWord(cc) | VMOV_VFP64 | RN(rt2) | RD(rt) | (sm & 0xf) | ((sm & 0x10) << (5 - 4)));
+        }
+
+        void vmov_arm64(int rt, int rt2, int sm, Condition cc = AL)
+        {
+            ASSERT(rt != rt2);
+            m_buffer.putInt(toARMWord(cc) | VMOV_ARM64 | RN(rt2) | RD(rt) | (sm & 0xf) | ((sm & 0x10) << (5 - 4)));
+        }
+
+        void vmov_vfp32(int sn, int rt, Condition cc = AL)
+        {
+            ASSERT(rt <= 15);
+            emitSinglePrecisionInstruction(toARMWord(cc) | VMOV_VFP32, rt << 1, sn, 0);
+        }
+
+        void vmov_arm32(int rt, int sn, Condition cc = AL)
+        {
+            ASSERT(rt <= 15);
+            emitSinglePrecisionInstruction(toARMWord(cc) | VMOV_ARM32, rt << 1, sn, 0);
+        }
+
+        void vcvt_f64_s32(int dd, int sm, Condition cc = AL)
+        {
+            ASSERT(!(sm & 0x1)); // sm must be divisible by 2
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_F64_S32, dd, 0, (sm >> 1));
+        }
+
+        void vcvt_s32_f64(int sd, int dm, Condition cc = AL)
+        {
+            ASSERT(!(sd & 0x1)); // sd must be divisible by 2
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_S32_F64, (sd >> 1), 0, dm);
+        }
+
+        void vcvt_u32_f64(int sd, int dm, Condition cc = AL)
+        {
+            ASSERT(!(sd & 0x1)); // sd must be divisible by 2
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_U32_F64, (sd >> 1), 0, dm);
+        }
+
+        void vcvt_f64_f32(int dd, int sm, Condition cc = AL)
+        {
+            ASSERT(dd <= 15 && sm <= 15);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_F64_F32, dd, 0, sm);
+        }
+
+        void vcvt_f32_f64(int dd, int sm, Condition cc = AL)
+        {
+            ASSERT(dd <= 15 && sm <= 15);
+            emitDoublePrecisionInstruction(toARMWord(cc) | VCVT_F32_F64, dd, 0, sm);
+        }
+
+        void vmrs_apsr(Condition cc = AL)
+        {
+            m_buffer.putInt(toARMWord(cc) | VMRS_APSR);
+        }
+
+        void clz(int rd, int rm, Condition cc = AL)
+        {
+            m_buffer.putInt(toARMWord(cc) | CLZ | RD(rd) | RM(rm));
+        }
+
+        void bkpt(ARMWord value)
+        {
+            m_buffer.putInt(BKPT | ((value & 0xff0) << 4) | (value & 0xf));
+        }
+
+        void nop()
+        {
+            m_buffer.putInt(NOP);
+        }
+
+        static void fillNops(void* base, size_t size, bool isCopyingToExecutableMemory)
+        {
+            UNUSED_PARAM(isCopyingToExecutableMemory);
+            RELEASE_ASSERT(!(size % sizeof(int32_t)));
+
+            int32_t* ptr = static_cast<int32_t*>(base);
+            const size_t num32s = size / sizeof(int32_t);
+            const int32_t insn = NOP;
+            for (size_t i = 0; i < num32s; i++)
+                *ptr++ = insn;
+        }
+
+        void dmbSY()
+        {
+            m_buffer.putInt(DMB_SY);
+        }
+
+        void dmbISHST()
+        {
+            m_buffer.putInt(DMB_ISHST);
+        }
+
+        void bx(int rm, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | BX, 0, 0, RM(rm));
+        }
+
+        AssemblerLabel blx(int rm, Condition cc = AL)
+        {
+            emitInstruction(toARMWord(cc) | BLX, 0, 0, RM(rm));
+            return m_buffer.label();
+        }
+
+        static ARMWord lsl(int reg, ARMWord value)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(value <= 0x1f);
+            return reg | (value << 7) | 0x00;
+        }
+
+        static ARMWord lsr(int reg, ARMWord value)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(value <= 0x1f);
+            return reg | (value << 7) | 0x20;
+        }
+
+        static ARMWord asr(int reg, ARMWord value)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(value <= 0x1f);
+            return reg | (value << 7) | 0x40;
+        }
+
+        static ARMWord lslRegister(int reg, int shiftReg)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
+            return reg | (shiftReg << 8) | 0x10;
+        }
+
+        static ARMWord lsrRegister(int reg, int shiftReg)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
+            return reg | (shiftReg << 8) | 0x30;
+        }
+
+        static ARMWord asrRegister(int reg, int shiftReg)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            ASSERT(shiftReg <= ARMRegisters::pc);
+            return reg | (shiftReg << 8) | 0x50;
+        }
+
+        // General helpers
+
+        size_t codeSize() const
+        {
+            return m_buffer.codeSize();
+        }
+
+        void ensureSpace(int insnSpace, int constSpace)
+        {
+            m_buffer.ensureSpace(insnSpace, constSpace);
+        }
+
+        int sizeOfConstantPool()
+        {
+            return m_buffer.sizeOfConstantPool();
+        }
+
+        AssemblerLabel labelIgnoringWatchpoints()
+        {
+            m_buffer.ensureSpaceForAnyInstruction();
+            return m_buffer.label();
+        }
+
+        AssemblerLabel labelForWatchpoint()
+        {
+            m_buffer.ensureSpaceForAnyInstruction(maxJumpReplacementSize() / sizeof(ARMWord));
+            AssemblerLabel result = m_buffer.label();
+            if (result.m_offset != (m_indexOfTailOfLastWatchpoint - maxJumpReplacementSize()))
+                result = label();
+            m_indexOfTailOfLastWatchpoint = result.m_offset + maxJumpReplacementSize();
+            return label();
+        }
+
+        AssemblerLabel label()
+        {
+            AssemblerLabel result = labelIgnoringWatchpoints();
+            while (result.m_offset + 1 < m_indexOfTailOfLastWatchpoint) {
+                nop();
+                // The available number of instructions are ensured by labelForWatchpoint.
+                result = m_buffer.label();
+            }
+            return result;
+        }
+
+        AssemblerLabel align(int alignment)
+        {
+            while (!m_buffer.isAligned(alignment))
+                mov(ARMRegisters::r0, ARMRegisters::r0);
+
+            return label();
+        }
+
+        AssemblerLabel loadBranchTarget(int rd, Condition cc = AL, int useConstantPool = 0)
+        {
+            ensureSpace(sizeof(ARMWord), sizeof(ARMWord));
+            m_jumps.append(m_buffer.codeSize() | (useConstantPool & 0x1));
+            ldrUniqueImmediate(rd, InvalidBranchTarget, cc);
+            return m_buffer.label();
+        }
+
+        AssemblerLabel jmp(Condition cc = AL, int useConstantPool = 0)
+        {
+            return loadBranchTarget(ARMRegisters::pc, cc, useConstantPool);
+        }
+
+        void prepareExecutableCopy(void* to);
+
+        unsigned debugOffset() { return m_buffer.debugOffset(); }
+
+        // DFG assembly helpers for moving data between fp and registers.
+        void vmov(RegisterID rd1, RegisterID rd2, FPRegisterID rn)
+        {
+            vmov_arm64(rd1, rd2, rn);
+        }
+
+        void vmov(FPRegisterID rd, RegisterID rn1, RegisterID rn2)
+        {
+            vmov_vfp64(rd, rn1, rn2);
+        }
+
+        // Patching helpers
+
+        static ARMWord* getLdrImmAddress(ARMWord* insn)
+        {
+            // Check for call
+            if ((*insn & LdrPcImmediateInstructionMask) != LdrPcImmediateInstruction) {
+                // Must be BLX
+                ASSERT((*insn & BlxInstructionMask) == BlxInstruction);
+                insn--;
+            }
+
+            // Must be an ldr ..., [pc +/- imm]
+            ASSERT((*insn & LdrPcImmediateInstructionMask) == LdrPcImmediateInstruction);
+
+            ARMWord addr = reinterpret_cast<ARMWord>(insn) + DefaultPrefetchOffset * sizeof(ARMWord);
+            if (*insn & DataTransferUp)
+                return reinterpret_cast<ARMWord*>(addr + (*insn & DataTransferOffsetMask));
+            return reinterpret_cast<ARMWord*>(addr - (*insn & DataTransferOffsetMask));
+        }
+
+        static ARMWord* getLdrImmAddressOnPool(ARMWord* insn, uint32_t* constPool)
+        {
+            // Must be an ldr ..., [pc +/- imm]
+            ASSERT((*insn & LdrPcImmediateInstructionMask) == LdrPcImmediateInstruction);
+
+            if (*insn & 0x1)
+                return reinterpret_cast<ARMWord*>(constPool + ((*insn & DataTransferOffsetMask) >> 1));
+            return getLdrImmAddress(insn);
+        }
+
+        static void patchPointerInternal(intptr_t from, void* to)
+        {
+            ARMWord* insn = reinterpret_cast<ARMWord*>(from);
+            ARMWord* addr = getLdrImmAddress(insn);
+            *addr = reinterpret_cast<ARMWord>(to);
+        }
+
+        static ARMWord patchConstantPoolLoad(ARMWord load, ARMWord value)
+        {
+            value = (value << 1) + 1;
+            ASSERT(!(value & ~DataTransferOffsetMask));
+            return (load & ~DataTransferOffsetMask) | value;
+        }
+
+        static void patchConstantPoolLoad(void* loadAddr, void* constPoolAddr);
+
+        // Read pointers
+        static void* readPointer(void* from)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(from);
+            ARMWord* address = getLdrImmAddress(instruction);
+            return *reinterpret_cast<void**>(address);
+        }
+
+        // Patch pointers
+
+        static void linkPointer(void* code, AssemblerLabel from, void* to)
+        {
+            patchPointerInternal(reinterpret_cast<intptr_t>(code) + from.m_offset, to);
+        }
+
+        static void repatchInt32(void* where, int32_t to)
+        {
+            patchPointerInternal(reinterpret_cast<intptr_t>(where), reinterpret_cast<void*>(to));
+        }
+
+        static void repatchCompact(void* where, int32_t value)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(where);
+            ASSERT((*instruction & 0x0f700000) == LoadUint32);
+            if (value >= 0)
+                *instruction = (*instruction & 0xff7ff000) | DataTransferUp | value;
+            else
+                *instruction = (*instruction & 0xff7ff000) | -value;
+            cacheFlush(instruction, sizeof(ARMWord));
+        }
+
+        static void repatchPointer(void* from, void* to)
+        {
+            patchPointerInternal(reinterpret_cast<intptr_t>(from), to);
+        }
+
+        // Linkers
+        static intptr_t getAbsoluteJumpAddress(void* base, int offset = 0)
+        {
+            return reinterpret_cast<intptr_t>(base) + offset - sizeof(ARMWord);
+        }
+
+        void linkJump(AssemblerLabel from, AssemblerLabel to)
+        {
+            ARMWord* insn = reinterpret_cast<ARMWord*>(getAbsoluteJumpAddress(m_buffer.data(), from.m_offset));
+            ARMWord* addr = getLdrImmAddressOnPool(insn, m_buffer.poolAddress());
+            *addr = toARMWord(to.m_offset);
+        }
+
+        static void linkJump(void* code, AssemblerLabel from, void* to)
+        {
+            patchPointerInternal(getAbsoluteJumpAddress(code, from.m_offset), to);
+        }
+
+        static void relinkJump(void* from, void* to)
+        {
+            patchPointerInternal(getAbsoluteJumpAddress(from), to);
+        }
+
+        static void relinkJumpToNop(void* from)
+        {
+            relinkJump(from, from);
+        }
+
+        static void linkCall(void* code, AssemblerLabel from, void* to)
+        {
+            patchPointerInternal(getAbsoluteJumpAddress(code, from.m_offset), to);
+        }
+
+        static void relinkCall(void* from, void* to)
+        {
+            patchPointerInternal(getAbsoluteJumpAddress(from), to);
+        }
+
+        static void* readCallTarget(void* from)
+        {
+            return reinterpret_cast<void*>(readPointer(reinterpret_cast<void*>(getAbsoluteJumpAddress(from))));
+        }
+
+        static void replaceWithJump(void* instructionStart, void* to)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart);
+            intptr_t difference = reinterpret_cast<intptr_t>(to) - (reinterpret_cast<intptr_t>(instruction) + DefaultPrefetchOffset * sizeof(ARMWord));
+
+            if (!(difference & 1)) {
+                difference >>= 2;
+                if ((difference <= MaximumBranchOffsetDistance && difference >= MinimumBranchOffsetDistance)) {
+                     // Direct branch.
+                     instruction[0] = B | AL | (difference & BranchOffsetMask);
+                     cacheFlush(instruction, sizeof(ARMWord));
+                     return;
+                }
+            }
+
+            // Load target.
+            instruction[0] = LoadUint32 | AL | RN(ARMRegisters::pc) | RD(ARMRegisters::pc) | 4;
+            instruction[1] = reinterpret_cast<ARMWord>(to);
+            cacheFlush(instruction, sizeof(ARMWord) * 2);
+        }
+
+        static ptrdiff_t maxJumpReplacementSize()
+        {
+            return sizeof(ARMWord) * 2;
+        }
+
+        static constexpr ptrdiff_t patchableJumpSize()
+        {
+            return sizeof(ARMWord) * 3;
+        }
+
+        static void replaceWithLoad(void* instructionStart)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart);
+            cacheFlush(instruction, sizeof(ARMWord));
+
+            ASSERT((*instruction & LdrOrAddInstructionMask) == AddImmediateInstruction || (*instruction & LdrOrAddInstructionMask) == LdrImmediateInstruction);
+            if ((*instruction & LdrOrAddInstructionMask) == AddImmediateInstruction) {
+                 *instruction = (*instruction & ~LdrOrAddInstructionMask) | LdrImmediateInstruction;
+                 cacheFlush(instruction, sizeof(ARMWord));
+            }
+        }
+
+        static void replaceWithAddressComputation(void* instructionStart)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart);
+            cacheFlush(instruction, sizeof(ARMWord));
+
+            ASSERT((*instruction & LdrOrAddInstructionMask) == AddImmediateInstruction || (*instruction & LdrOrAddInstructionMask) == LdrImmediateInstruction);
+            if ((*instruction & LdrOrAddInstructionMask) == LdrImmediateInstruction) {
+                 *instruction = (*instruction & ~LdrOrAddInstructionMask) | AddImmediateInstruction;
+                 cacheFlush(instruction, sizeof(ARMWord));
+            }
+        }
+
+        static void revertBranchPtrWithPatch(void* instructionStart, RegisterID rn, ARMWord imm)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart);
+
+            ASSERT((instruction[2] & LdrPcImmediateInstructionMask) == LdrPcImmediateInstruction);
+            instruction[0] = toARMWord(AL) | ((instruction[2] & 0x0fff0fff) + sizeof(ARMWord)) | RD(ARMRegisters::S1);
+            *getLdrImmAddress(instruction) = imm;
+            instruction[1] = toARMWord(AL) | CMP | SetConditionalCodes | RN(rn) | RM(ARMRegisters::S1);
+            cacheFlush(instruction, 2 * sizeof(ARMWord));
+        }
+
+        // Address operations
+
+        static void* getRelocatedAddress(void* code, AssemblerLabel label)
+        {
+            return reinterpret_cast<void*>(reinterpret_cast<char*>(code) + label.m_offset);
+        }
+
+        // Address differences
+
+        static int getDifferenceBetweenLabels(AssemblerLabel a, AssemblerLabel b)
+        {
+            return b.m_offset - a.m_offset;
+        }
+
+        static unsigned getCallReturnOffset(AssemblerLabel call)
+        {
+            return call.m_offset;
+        }
+
+        // Handle immediates
+
+        static ARMWord getOp2(ARMWord imm);
+
+        // Fast case if imm is known to be between 0 and 0xff
+        static ARMWord getOp2Byte(ARMWord imm)
+        {
+            ASSERT(imm <= 0xff);
+            return Op2Immediate | imm;
+        }
+
+        static ARMWord getOp2Half(ARMWord imm)
+        {
+            ASSERT(imm <= 0xff);
+            return ImmediateForHalfWordTransfer | (imm & 0x0f) | ((imm & 0xf0) << 4);
+        }
+
+#if WTF_ARM_ARCH_AT_LEAST(7)
+        static ARMWord getImm16Op2(ARMWord imm)
+        {
+            if (imm <= 0xffff)
+                return (imm & 0xf000) << 4 | (imm & 0xfff);
+            return InvalidImmediate;
+        }
+#endif
+        ARMWord getImm(ARMWord imm, int tmpReg, bool invert = false);
+        void moveImm(ARMWord imm, int dest);
+        ARMWord encodeComplexImm(ARMWord imm, int dest);
+
+        // Memory load/store helpers
+
+        void dataTransfer32(DataTransferTypeA, RegisterID srcDst, RegisterID base, int32_t offset);
+        void baseIndexTransfer32(DataTransferTypeA, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
+        void dataTransfer16(DataTransferTypeB, RegisterID srcDst, RegisterID base, int32_t offset);
+        void baseIndexTransfer16(DataTransferTypeB, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
+        void dataTransferFloat(DataTransferTypeFloat, FPRegisterID srcDst, RegisterID base, int32_t offset);
+        void baseIndexTransferFloat(DataTransferTypeFloat, FPRegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
+
+        // Constant pool hnadlers
+
+        static ARMWord placeConstantPoolBarrier(int offset)
+        {
+            offset = (offset - sizeof(ARMWord)) >> 2;
+            ASSERT((offset <= MaximumBranchOffsetDistance && offset >= MinimumBranchOffsetDistance));
+            return AL | B | (offset & BranchOffsetMask);
+        }
+
+#if OS(LINUX) && COMPILER(GCC_OR_CLANG)
+        static inline void linuxPageFlush(uintptr_t begin, uintptr_t end)
+        {
+            asm volatile(
+                "push    {r7}\n"
+                "mov     r0, %0\n"
+                "mov     r1, %1\n"
+                "mov     r7, #0xf0000\n"
+                "add     r7, r7, #0x2\n"
+                "mov     r2, #0x0\n"
+                "svc     0x0\n"
+                "pop     {r7}\n"
+                :
+                : "r" (begin), "r" (end)
+                : "r0", "r1", "r2");
+        }
+#endif
+
+        static void cacheFlush(void* code, size_t size)
+        {
+#if OS(LINUX) && COMPILER(GCC_OR_CLANG)
+            size_t page = pageSize();
+            uintptr_t current = reinterpret_cast<uintptr_t>(code);
+            uintptr_t end = current + size;
+            uintptr_t firstPageEnd = (current & ~(page - 1)) + page;
+
+            if (end <= firstPageEnd) {
+                linuxPageFlush(current, end);
+                return;
+            }
+
+            linuxPageFlush(current, firstPageEnd);
+
+            for (current = firstPageEnd; current + page < end; current += page)
+                linuxPageFlush(current, current + page);
+
+            linuxPageFlush(current, end);
+#else
+#error "The cacheFlush support is missing on this platform."
+#endif
+        }
+
+    private:
+        static ARMWord RM(int reg)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            return reg;
+        }
+
+        static ARMWord RS(int reg)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            return reg << 8;
+        }
+
+        static ARMWord RD(int reg)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            return reg << 12;
+        }
+
+        static ARMWord RN(int reg)
+        {
+            ASSERT(reg <= ARMRegisters::pc);
+            return reg << 16;
+        }
+
+        static ARMWord getConditionalField(ARMWord i)
+        {
+            return i & ConditionalFieldMask;
+        }
+
+        static ARMWord toARMWord(Condition cc)
+        {
+            return static_cast<ARMWord>(cc);
+        }
+
+        static ARMWord toARMWord(uint32_t u)
+        {
+            return static_cast<ARMWord>(u);
+        }
+
+        int genInt(int reg, ARMWord imm, bool positive);
+
+        ARMBuffer m_buffer;
+        Jumps m_jumps;
+        uint32_t m_indexOfTailOfLastWatchpoint;
+    };
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/assembler/ARMv7Assembler.h b/assembler/ARMv7Assembler.h
new file mode 100644
index 0000000..86218ea
--- /dev/null
+++ b/assembler/ARMv7Assembler.h
@@ -0,0 +1,2962 @@
+/*
+ * Copyright (C) 2009, 2010, 2012, 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
+
+#include "AssemblerBuffer.h"
+#include "AssemblerCommon.h"
+#include <limits.h>
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+#include <stdint.h>
+
+namespace JSC {
+
+namespace ARMRegisters {
+
+    #define FOR_EACH_CPU_REGISTER(V) \
+        FOR_EACH_CPU_GPREGISTER(V) \
+        FOR_EACH_CPU_SPECIAL_REGISTER(V) \
+        FOR_EACH_CPU_FPREGISTER(V)
+
+    // The following are defined as pairs of the following value:
+    // 1. type of the storage needed to save the register value by the JIT probe.
+    // 2. name of the register.
+    #define FOR_EACH_CPU_GPREGISTER(V) \
+        V(void*, r0) \
+        V(void*, r1) \
+        V(void*, r2) \
+        V(void*, r3) \
+        V(void*, r4) \
+        V(void*, r5) \
+        V(void*, r6) \
+        V(void*, r7) \
+        V(void*, r8) \
+        V(void*, r9) \
+        V(void*, r10) \
+        V(void*, r11) \
+        V(void*, ip) \
+        V(void*, sp) \
+        V(void*, lr) \
+        V(void*, pc)
+
+    #define FOR_EACH_CPU_SPECIAL_REGISTER(V) \
+        V(void*, apsr) \
+        V(void*, fpscr) \
+
+    #define FOR_EACH_CPU_FPREGISTER(V) \
+        V(double, d0) \
+        V(double, d1) \
+        V(double, d2) \
+        V(double, d3) \
+        V(double, d4) \
+        V(double, d5) \
+        V(double, d6) \
+        V(double, d7) \
+        V(double, d8) \
+        V(double, d9) \
+        V(double, d10) \
+        V(double, d11) \
+        V(double, d12) \
+        V(double, d13) \
+        V(double, d14) \
+        V(double, d15) \
+        V(double, d16) \
+        V(double, d17) \
+        V(double, d18) \
+        V(double, d19) \
+        V(double, d20) \
+        V(double, d21) \
+        V(double, d22) \
+        V(double, d23) \
+        V(double, d24) \
+        V(double, d25) \
+        V(double, d26) \
+        V(double, d27) \
+        V(double, d28) \
+        V(double, d29) \
+        V(double, d30) \
+        V(double, d31)
+
+    typedef enum {
+        #define DECLARE_REGISTER(_type, _regName) _regName,
+        FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
+        #undef DECLARE_REGISTER
+
+        fp = r7,   // frame pointer
+        sb = r9,   // static base
+        sl = r10,  // stack limit
+        r12 = ip,
+        r13 = sp,
+        r14 = lr,
+        r15 = pc
+    } RegisterID;
+
+    typedef enum {
+        s0,
+        s1,
+        s2,
+        s3,
+        s4,
+        s5,
+        s6,
+        s7,
+        s8,
+        s9,
+        s10,
+        s11,
+        s12,
+        s13,
+        s14,
+        s15,
+        s16,
+        s17,
+        s18,
+        s19,
+        s20,
+        s21,
+        s22,
+        s23,
+        s24,
+        s25,
+        s26,
+        s27,
+        s28,
+        s29,
+        s30,
+        s31,
+    } FPSingleRegisterID;
+
+    typedef enum {
+        #define DECLARE_REGISTER(_type, _regName) _regName,
+        FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
+        #undef DECLARE_REGISTER
+    } FPDoubleRegisterID;
+
+    typedef enum {
+        q0,
+        q1,
+        q2,
+        q3,
+        q4,
+        q5,
+        q6,
+        q7,
+        q8,
+        q9,
+        q10,
+        q11,
+        q12,
+        q13,
+        q14,
+        q15,
+        q16,
+        q17,
+        q18,
+        q19,
+        q20,
+        q21,
+        q22,
+        q23,
+        q24,
+        q25,
+        q26,
+        q27,
+        q28,
+        q29,
+        q30,
+        q31,
+    } FPQuadRegisterID;
+
+    inline FPSingleRegisterID asSingle(FPDoubleRegisterID reg)
+    {
+        ASSERT(reg < d16);
+        return (FPSingleRegisterID)(reg << 1);
+    }
+
+    inline FPDoubleRegisterID asDouble(FPSingleRegisterID reg)
+    {
+        ASSERT(!(reg & 1));
+        return (FPDoubleRegisterID)(reg >> 1);
+    }
+
+} // namespace ARMRegisters
+
+class ARMv7Assembler;
+class ARMThumbImmediate {
+    friend class ARMv7Assembler;
+
+    typedef uint8_t ThumbImmediateType;
+    static const ThumbImmediateType TypeInvalid = 0;
+    static const ThumbImmediateType TypeEncoded = 1;
+    static const ThumbImmediateType TypeUInt16 = 2;
+
+    typedef union {
+        int16_t asInt;
+        struct {
+            unsigned imm8 : 8;
+            unsigned imm3 : 3;
+            unsigned i    : 1;
+            unsigned imm4 : 4;
+        };
+        // If this is an encoded immediate, then it may describe a shift, or a pattern.
+        struct {
+            unsigned shiftValue7 : 7;
+            unsigned shiftAmount : 5;
+        };
+        struct {
+            unsigned immediate   : 8;
+            unsigned pattern     : 4;
+        };
+    } ThumbImmediateValue;
+
+    // byte0 contains least significant bit; not using an array to make client code endian agnostic.
+    typedef union {
+        int32_t asInt;
+        struct {
+            uint8_t byte0;
+            uint8_t byte1;
+            uint8_t byte2;
+            uint8_t byte3;
+        };
+    } PatternBytes;
+
+    ALWAYS_INLINE static void countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
+    {
+        if (value & ~((1 << N) - 1)) /* check for any of the top N bits (of 2N bits) are set */
+            value >>= N;             /* if any were set, lose the bottom N */
+        else                         /* if none of the top N bits are set, */
+            zeros += N;              /* then we have identified N leading zeros */
+    }
+
+    static int32_t countLeadingZeros(uint32_t value)
+    {
+        if (!value)
+            return 32;
+
+        int32_t zeros = 0;
+        countLeadingZerosPartial(value, zeros, 16);
+        countLeadingZerosPartial(value, zeros, 8);
+        countLeadingZerosPartial(value, zeros, 4);
+        countLeadingZerosPartial(value, zeros, 2);
+        countLeadingZerosPartial(value, zeros, 1);
+        return zeros;
+    }
+
+    ARMThumbImmediate()
+        : m_type(TypeInvalid)
+    {
+        m_value.asInt = 0;
+    }
+        
+    ARMThumbImmediate(ThumbImmediateType type, ThumbImmediateValue value)
+        : m_type(type)
+        , m_value(value)
+    {
+    }
+
+    ARMThumbImmediate(ThumbImmediateType type, uint16_t value)
+        : m_type(TypeUInt16)
+    {
+        // Make sure this constructor is only reached with type TypeUInt16;
+        // this extra parameter makes the code a little clearer by making it
+        // explicit at call sites which type is being constructed
+        ASSERT_UNUSED(type, type == TypeUInt16);
+
+        m_value.asInt = value;
+    }
+
+public:
+    static ARMThumbImmediate makeEncodedImm(uint32_t value)
+    {
+        ThumbImmediateValue encoding;
+        encoding.asInt = 0;
+
+        // okay, these are easy.
+        if (value < 256) {
+            encoding.immediate = value;
+            encoding.pattern = 0;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        int32_t leadingZeros = countLeadingZeros(value);
+        // if there were 24 or more leading zeros, then we'd have hit the (value < 256) case.
+        ASSERT(leadingZeros < 24);
+
+        // Given a number with bit fields Z:B:C, where count(Z)+count(B)+count(C) == 32,
+        // Z are the bits known zero, B is the 8-bit immediate, C are the bits to check for
+        // zero.  count(B) == 8, so the count of bits to be checked is 24 - count(Z).
+        int32_t rightShiftAmount = 24 - leadingZeros;
+        if (value == ((value >> rightShiftAmount) << rightShiftAmount)) {
+            // Shift the value down to the low byte position.  The assign to 
+            // shiftValue7 drops the implicit top bit.
+            encoding.shiftValue7 = value >> rightShiftAmount;
+            // The endoded shift amount is the magnitude of a right rotate.
+            encoding.shiftAmount = 8 + leadingZeros;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+        
+        PatternBytes bytes;
+        bytes.asInt = value;
+
+        if ((bytes.byte0 == bytes.byte1) && (bytes.byte0 == bytes.byte2) && (bytes.byte0 == bytes.byte3)) {
+            encoding.immediate = bytes.byte0;
+            encoding.pattern = 3;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        if ((bytes.byte0 == bytes.byte2) && !(bytes.byte1 | bytes.byte3)) {
+            encoding.immediate = bytes.byte0;
+            encoding.pattern = 1;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        if ((bytes.byte1 == bytes.byte3) && !(bytes.byte0 | bytes.byte2)) {
+            encoding.immediate = bytes.byte1;
+            encoding.pattern = 2;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        return ARMThumbImmediate();
+    }
+
+    static ARMThumbImmediate makeUInt12(int32_t value)
+    {
+        return (!(value & 0xfffff000))
+            ? ARMThumbImmediate(TypeUInt16, (uint16_t)value)
+            : ARMThumbImmediate();
+    }
+
+    static ARMThumbImmediate makeUInt12OrEncodedImm(int32_t value)
+    {
+        // If this is not a 12-bit unsigned it, try making an encoded immediate.
+        return (!(value & 0xfffff000))
+            ? ARMThumbImmediate(TypeUInt16, (uint16_t)value)
+            : makeEncodedImm(value);
+    }
+
+    // The 'make' methods, above, return a !isValid() value if the argument
+    // cannot be represented as the requested type.  This methods  is called
+    // 'get' since the argument can always be represented.
+    static ARMThumbImmediate makeUInt16(uint16_t value)
+    {
+        return ARMThumbImmediate(TypeUInt16, value);
+    }
+    
+    bool isValid()
+    {
+        return m_type != TypeInvalid;
+    }
+
+    uint16_t asUInt16() const { return m_value.asInt; }
+
+    // These methods rely on the format of encoded byte values.
+    bool isUInt3() { return !(m_value.asInt & 0xfff8); }
+    bool isUInt4() { return !(m_value.asInt & 0xfff0); }
+    bool isUInt5() { return !(m_value.asInt & 0xffe0); }
+    bool isUInt6() { return !(m_value.asInt & 0xffc0); }
+    bool isUInt7() { return !(m_value.asInt & 0xff80); }
+    bool isUInt8() { return !(m_value.asInt & 0xff00); }
+    bool isUInt9() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xfe00); }
+    bool isUInt10() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xfc00); }
+    bool isUInt12() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xf000); }
+    bool isUInt16() { return m_type == TypeUInt16; }
+    uint8_t getUInt3() { ASSERT(isUInt3()); return m_value.asInt; }
+    uint8_t getUInt4() { ASSERT(isUInt4()); return m_value.asInt; }
+    uint8_t getUInt5() { ASSERT(isUInt5()); return m_value.asInt; }
+    uint8_t getUInt6() { ASSERT(isUInt6()); return m_value.asInt; }
+    uint8_t getUInt7() { ASSERT(isUInt7()); return m_value.asInt; }
+    uint8_t getUInt8() { ASSERT(isUInt8()); return m_value.asInt; }
+    uint16_t getUInt9() { ASSERT(isUInt9()); return m_value.asInt; }
+    uint16_t getUInt10() { ASSERT(isUInt10()); return m_value.asInt; }
+    uint16_t getUInt12() { ASSERT(isUInt12()); return m_value.asInt; }
+    uint16_t getUInt16() { ASSERT(isUInt16()); return m_value.asInt; }
+
+    bool isEncodedImm() { return m_type == TypeEncoded; }
+
+private:
+    ThumbImmediateType m_type;
+    ThumbImmediateValue m_value;
+};
+
+typedef enum {
+    SRType_LSL,
+    SRType_LSR,
+    SRType_ASR,
+    SRType_ROR,
+
+    SRType_RRX = SRType_ROR
+} ARMShiftType;
+
+class ShiftTypeAndAmount {
+    friend class ARMv7Assembler;
+
+public:
+    ShiftTypeAndAmount()
+    {
+        m_u.type = (ARMShiftType)0;
+        m_u.amount = 0;
+    }
+    
+    ShiftTypeAndAmount(ARMShiftType type, unsigned amount)
+    {
+        m_u.type = type;
+        m_u.amount = amount & 31;
+    }
+    
+    unsigned lo4() { return m_u.lo4; }
+    unsigned hi4() { return m_u.hi4; }
+    
+private:
+    union {
+        struct {
+            unsigned lo4 : 4;
+            unsigned hi4 : 4;
+        };
+        struct {
+            unsigned type   : 2;
+            unsigned amount : 6;
+        };
+    } m_u;
+};
+
+class ARMv7Assembler {
+public:
+    typedef ARMRegisters::RegisterID RegisterID;
+    typedef ARMRegisters::FPSingleRegisterID FPSingleRegisterID;
+    typedef ARMRegisters::FPDoubleRegisterID FPDoubleRegisterID;
+    typedef ARMRegisters::FPQuadRegisterID FPQuadRegisterID;
+    typedef FPDoubleRegisterID FPRegisterID;
+    
+    static constexpr RegisterID firstRegister() { return ARMRegisters::r0; }
+    static constexpr RegisterID lastRegister() { return ARMRegisters::r13; }
+
+    static constexpr FPRegisterID firstFPRegister() { return ARMRegisters::d0; }
+    static constexpr FPRegisterID lastFPRegister() { return ARMRegisters::d31; }
+
+    // (HS, LO, HI, LS) -> (AE, B, A, BE)
+    // (VS, VC) -> (O, NO)
+    typedef enum {
+        ConditionEQ, // Zero / Equal.
+        ConditionNE, // Non-zero / Not equal.
+        ConditionHS, ConditionCS = ConditionHS, // Unsigned higher or same.
+        ConditionLO, ConditionCC = ConditionLO, // Unsigned lower.
+        ConditionMI, // Negative.
+        ConditionPL, // Positive or zero.
+        ConditionVS, // Overflowed.
+        ConditionVC, // Not overflowed.
+        ConditionHI, // Unsigned higher.
+        ConditionLS, // Unsigned lower or same.
+        ConditionGE, // Signed greater than or equal.
+        ConditionLT, // Signed less than.
+        ConditionGT, // Signed greater than.
+        ConditionLE, // Signed less than or equal.
+        ConditionAL, // Unconditional / Always execute.
+        ConditionInvalid
+    } Condition;
+
+#define JUMP_ENUM_WITH_SIZE(index, value) (((value) << 3) | (index))
+#define JUMP_ENUM_SIZE(jump) ((jump) >> 3) 
+    enum JumpType { JumpFixed = JUMP_ENUM_WITH_SIZE(0, 0), 
+                    JumpNoCondition = JUMP_ENUM_WITH_SIZE(1, 5 * sizeof(uint16_t)),
+                    JumpCondition = JUMP_ENUM_WITH_SIZE(2, 6 * sizeof(uint16_t)),
+                    JumpNoConditionFixedSize = JUMP_ENUM_WITH_SIZE(3, 5 * sizeof(uint16_t)),
+                    JumpConditionFixedSize = JUMP_ENUM_WITH_SIZE(4, 6 * sizeof(uint16_t))
+    };
+    enum JumpLinkType { 
+        LinkInvalid = JUMP_ENUM_WITH_SIZE(0, 0),
+        LinkJumpT1 = JUMP_ENUM_WITH_SIZE(1, sizeof(uint16_t)),
+        LinkJumpT2 = JUMP_ENUM_WITH_SIZE(2, sizeof(uint16_t)),
+        LinkJumpT3 = JUMP_ENUM_WITH_SIZE(3, 2 * sizeof(uint16_t)),
+        LinkJumpT4 = JUMP_ENUM_WITH_SIZE(4, 2 * sizeof(uint16_t)),
+        LinkConditionalJumpT4 = JUMP_ENUM_WITH_SIZE(5, 3 * sizeof(uint16_t)),
+        LinkBX = JUMP_ENUM_WITH_SIZE(6, 5 * sizeof(uint16_t)),
+        LinkConditionalBX = JUMP_ENUM_WITH_SIZE(7, 6 * sizeof(uint16_t))
+    };
+
+    class LinkRecord {
+    public:
+        LinkRecord(intptr_t from, intptr_t to, JumpType type, Condition condition)
+        {
+            data.realTypes.m_from = from;
+            data.realTypes.m_to = to;
+            data.realTypes.m_type = type;
+            data.realTypes.m_linkType = LinkInvalid;
+            data.realTypes.m_condition = condition;
+        }
+        void operator=(const LinkRecord& other)
+        {
+            data.copyTypes.content[0] = other.data.copyTypes.content[0];
+            data.copyTypes.content[1] = other.data.copyTypes.content[1];
+            data.copyTypes.content[2] = other.data.copyTypes.content[2];
+        }
+        intptr_t from() const { return data.realTypes.m_from; }
+        void setFrom(intptr_t from) { data.realTypes.m_from = from; }
+        intptr_t to() const { return data.realTypes.m_to; }
+        JumpType type() const { return data.realTypes.m_type; }
+        JumpLinkType linkType() const { return data.realTypes.m_linkType; }
+        void setLinkType(JumpLinkType linkType) { ASSERT(data.realTypes.m_linkType == LinkInvalid); data.realTypes.m_linkType = linkType; }
+        Condition condition() const { return data.realTypes.m_condition; }
+    private:
+        union {
+            struct RealTypes {
+                intptr_t m_from : 31;
+                intptr_t m_to : 31;
+                JumpType m_type : 8;
+                JumpLinkType m_linkType : 8;
+                Condition m_condition : 16;
+            } realTypes;
+            struct CopyTypes {
+                uint32_t content[3];
+            } copyTypes;
+            COMPILE_ASSERT(sizeof(RealTypes) == sizeof(CopyTypes), LinkRecordCopyStructSizeEqualsRealStruct);
+        } data;
+    };
+
+    ARMv7Assembler()
+        : m_indexOfLastWatchpoint(INT_MIN)
+        , m_indexOfTailOfLastWatchpoint(INT_MIN)
+    {
+    }
+
+    AssemblerBuffer& buffer() { return m_formatter.m_buffer; }
+
+private:
+
+    // ARMv7, Appx-A.6.3
+    static bool BadReg(RegisterID reg)
+    {
+        return (reg == ARMRegisters::sp) || (reg == ARMRegisters::pc);
+    }
+
+    uint32_t singleRegisterMask(FPSingleRegisterID rdNum, int highBitsShift, int lowBitShift)
+    {
+        uint32_t rdMask = (rdNum >> 1) << highBitsShift;
+        if (rdNum & 1)
+            rdMask |= 1 << lowBitShift;
+        return rdMask;
+    }
+
+    uint32_t doubleRegisterMask(FPDoubleRegisterID rdNum, int highBitShift, int lowBitsShift)
+    {
+        uint32_t rdMask = (rdNum & 0xf) << lowBitsShift;
+        if (rdNum & 16)
+            rdMask |= 1 << highBitShift;
+        return rdMask;
+    }
+
+    typedef enum {
+        OP_ADD_reg_T1       = 0x1800,
+        OP_SUB_reg_T1       = 0x1A00,
+        OP_ADD_imm_T1       = 0x1C00,
+        OP_SUB_imm_T1       = 0x1E00,
+        OP_MOV_imm_T1       = 0x2000,
+        OP_CMP_imm_T1       = 0x2800,
+        OP_ADD_imm_T2       = 0x3000,
+        OP_SUB_imm_T2       = 0x3800,
+        OP_AND_reg_T1       = 0x4000,
+        OP_EOR_reg_T1       = 0x4040,
+        OP_TST_reg_T1       = 0x4200,
+        OP_RSB_imm_T1       = 0x4240,
+        OP_CMP_reg_T1       = 0x4280,
+        OP_ORR_reg_T1       = 0x4300,
+        OP_MVN_reg_T1       = 0x43C0,
+        OP_ADD_reg_T2       = 0x4400,
+        OP_MOV_reg_T1       = 0x4600,
+        OP_BLX              = 0x4700,
+        OP_BX               = 0x4700,
+        OP_STR_reg_T1       = 0x5000,
+        OP_STRH_reg_T1      = 0x5200,
+        OP_STRB_reg_T1      = 0x5400,
+        OP_LDRSB_reg_T1     = 0x5600,
+        OP_LDR_reg_T1       = 0x5800,
+        OP_LDRH_reg_T1      = 0x5A00,
+        OP_LDRB_reg_T1      = 0x5C00,
+        OP_LDRSH_reg_T1     = 0x5E00,
+        OP_STR_imm_T1       = 0x6000,
+        OP_LDR_imm_T1       = 0x6800,
+        OP_STRB_imm_T1      = 0x7000,
+        OP_LDRB_imm_T1      = 0x7800,
+        OP_STRH_imm_T1      = 0x8000,
+        OP_LDRH_imm_T1      = 0x8800,
+        OP_STR_imm_T2       = 0x9000,
+        OP_LDR_imm_T2       = 0x9800,
+        OP_ADD_SP_imm_T1    = 0xA800,
+        OP_ADD_SP_imm_T2    = 0xB000,
+        OP_SUB_SP_imm_T1    = 0xB080,
+        OP_PUSH_T1          = 0xB400,
+        OP_POP_T1           = 0xBC00,
+        OP_BKPT             = 0xBE00,
+        OP_IT               = 0xBF00,
+        OP_NOP_T1           = 0xBF00,
+    } OpcodeID;
+
+    typedef enum {
+        OP_B_T1         = 0xD000,
+        OP_B_T2         = 0xE000,
+        OP_POP_T2       = 0xE8BD,
+        OP_PUSH_T2      = 0xE92D,
+        OP_AND_reg_T2   = 0xEA00,
+        OP_TST_reg_T2   = 0xEA10,
+        OP_ORR_reg_T2   = 0xEA40,
+        OP_ORR_S_reg_T2 = 0xEA50,
+        OP_ASR_imm_T1   = 0xEA4F,
+        OP_LSL_imm_T1   = 0xEA4F,
+        OP_LSR_imm_T1   = 0xEA4F,
+        OP_ROR_imm_T1   = 0xEA4F,
+        OP_MVN_reg_T2   = 0xEA6F,
+        OP_EOR_reg_T2   = 0xEA80,
+        OP_ADD_reg_T3   = 0xEB00,
+        OP_ADD_S_reg_T3 = 0xEB10,
+        OP_SUB_reg_T2   = 0xEBA0,
+        OP_SUB_S_reg_T2 = 0xEBB0,
+        OP_CMP_reg_T2   = 0xEBB0,
+        OP_VMOV_CtoD    = 0xEC00,
+        OP_VMOV_DtoC    = 0xEC10,
+        OP_FSTS         = 0xED00,
+        OP_VSTR         = 0xED00,
+        OP_FLDS         = 0xED10,
+        OP_VLDR         = 0xED10,
+        OP_VMOV_CtoS    = 0xEE00,
+        OP_VMOV_StoC    = 0xEE10,
+        OP_VMUL_T2      = 0xEE20,
+        OP_VADD_T2      = 0xEE30,
+        OP_VSUB_T2      = 0xEE30,
+        OP_VDIV         = 0xEE80,
+        OP_VABS_T2      = 0xEEB0,
+        OP_VCMP         = 0xEEB0,
+        OP_VCVT_FPIVFP  = 0xEEB0,
+        OP_VMOV_T2      = 0xEEB0,
+        OP_VMOV_IMM_T2  = 0xEEB0,
+        OP_VMRS         = 0xEEB0,
+        OP_VNEG_T2      = 0xEEB0,
+        OP_VSQRT_T1     = 0xEEB0,
+        OP_VCVTSD_T1    = 0xEEB0,
+        OP_VCVTDS_T1    = 0xEEB0,
+        OP_B_T3a        = 0xF000,
+        OP_B_T4a        = 0xF000,
+        OP_AND_imm_T1   = 0xF000,
+        OP_TST_imm      = 0xF010,
+        OP_ORR_imm_T1   = 0xF040,
+        OP_MOV_imm_T2   = 0xF040,
+        OP_MVN_imm      = 0xF060,
+        OP_EOR_imm_T1   = 0xF080,
+        OP_ADD_imm_T3   = 0xF100,
+        OP_ADD_S_imm_T3 = 0xF110,
+        OP_CMN_imm      = 0xF110,
+        OP_ADC_imm      = 0xF140,
+        OP_SUB_imm_T3   = 0xF1A0,
+        OP_SUB_S_imm_T3 = 0xF1B0,
+        OP_CMP_imm_T2   = 0xF1B0,
+        OP_RSB_imm_T2   = 0xF1C0,
+        OP_RSB_S_imm_T2 = 0xF1D0,
+        OP_ADD_imm_T4   = 0xF200,
+        OP_MOV_imm_T3   = 0xF240,
+        OP_SUB_imm_T4   = 0xF2A0,
+        OP_MOVT         = 0xF2C0,
+        OP_UBFX_T1      = 0xF3C0,
+        OP_NOP_T2a      = 0xF3AF,
+        OP_DMB_T1a      = 0xF3BF,
+        OP_STRB_imm_T3  = 0xF800,
+        OP_STRB_reg_T2  = 0xF800,
+        OP_LDRB_imm_T3  = 0xF810,
+        OP_LDRB_reg_T2  = 0xF810,
+        OP_STRH_imm_T3  = 0xF820,
+        OP_STRH_reg_T2  = 0xF820,
+        OP_LDRH_reg_T2  = 0xF830,
+        OP_LDRH_imm_T3  = 0xF830,
+        OP_STR_imm_T4   = 0xF840,
+        OP_STR_reg_T2   = 0xF840,
+        OP_LDR_imm_T4   = 0xF850,
+        OP_LDR_reg_T2   = 0xF850,
+        OP_STRB_imm_T2  = 0xF880,
+        OP_LDRB_imm_T2  = 0xF890,
+        OP_STRH_imm_T2  = 0xF8A0,
+        OP_LDRH_imm_T2  = 0xF8B0,
+        OP_STR_imm_T3   = 0xF8C0,
+        OP_LDR_imm_T3   = 0xF8D0,
+        OP_LDRSB_reg_T2 = 0xF910,
+        OP_LDRSH_reg_T2 = 0xF930,
+        OP_LSL_reg_T2   = 0xFA00,
+        OP_LSR_reg_T2   = 0xFA20,
+        OP_ASR_reg_T2   = 0xFA40,
+        OP_ROR_reg_T2   = 0xFA60,
+        OP_CLZ          = 0xFAB0,
+        OP_SMULL_T1     = 0xFB80,
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+        OP_SDIV_T1      = 0xFB90,
+        OP_UDIV_T1      = 0xFBB0,
+#endif
+    } OpcodeID1;
+
+    typedef enum {
+        OP_VADD_T2b      = 0x0A00,
+        OP_VDIVb         = 0x0A00,
+        OP_FLDSb         = 0x0A00,
+        OP_VLDRb         = 0x0A00,
+        OP_VMOV_IMM_T2b  = 0x0A00,
+        OP_VMOV_T2b      = 0x0A40,
+        OP_VMUL_T2b      = 0x0A00,
+        OP_FSTSb         = 0x0A00,
+        OP_VSTRb         = 0x0A00,
+        OP_VMOV_StoCb    = 0x0A10,
+        OP_VMOV_CtoSb    = 0x0A10,
+        OP_VMOV_DtoCb    = 0x0A10,
+        OP_VMOV_CtoDb    = 0x0A10,
+        OP_VMRSb         = 0x0A10,
+        OP_VABS_T2b      = 0x0A40,
+        OP_VCMPb         = 0x0A40,
+        OP_VCVT_FPIVFPb  = 0x0A40,
+        OP_VNEG_T2b      = 0x0A40,
+        OP_VSUB_T2b      = 0x0A40,
+        OP_VSQRT_T1b     = 0x0A40,
+        OP_VCVTSD_T1b    = 0x0A40,
+        OP_VCVTDS_T1b    = 0x0A40,
+        OP_NOP_T2b       = 0x8000,
+        OP_DMB_SY_T1b    = 0x8F5F,
+        OP_DMB_ISHST_T1b = 0x8F5A,
+        OP_B_T3b         = 0x8000,
+        OP_B_T4b         = 0x9000,
+    } OpcodeID2;
+
+    struct FourFours {
+        FourFours(unsigned f3, unsigned f2, unsigned f1, unsigned f0)
+        {
+            m_u.f0 = f0;
+            m_u.f1 = f1;
+            m_u.f2 = f2;
+            m_u.f3 = f3;
+        }
+
+        union {
+            unsigned value;
+            struct {
+                unsigned f0 : 4;
+                unsigned f1 : 4;
+                unsigned f2 : 4;
+                unsigned f3 : 4;
+            };
+        } m_u;
+    };
+
+    class ARMInstructionFormatter;
+
+    // false means else!
+    static bool ifThenElseConditionBit(Condition condition, bool isIf)
+    {
+        return isIf ? (condition & 1) : !(condition & 1);
+    }
+    static uint8_t ifThenElse(Condition condition, bool inst2if, bool inst3if, bool inst4if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | (ifThenElseConditionBit(condition, inst3if) << 2)
+            | (ifThenElseConditionBit(condition, inst4if) << 1)
+            | 1;
+        ASSERT((condition != ConditionAL) || !(mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+    static uint8_t ifThenElse(Condition condition, bool inst2if, bool inst3if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | (ifThenElseConditionBit(condition, inst3if) << 2)
+            | 2;
+        ASSERT((condition != ConditionAL) || !(mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+    static uint8_t ifThenElse(Condition condition, bool inst2if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | 4;
+        ASSERT((condition != ConditionAL) || !(mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+
+    static uint8_t ifThenElse(Condition condition)
+    {
+        int mask = 8;
+        return (condition << 4) | mask;
+    }
+
+public:
+    
+    void adc(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isEncodedImm());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADC_imm, rn, rd, imm);
+    }
+
+    void add(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isValid());
+
+        if (rn == ARMRegisters::sp && imm.isUInt16()) {
+            ASSERT(!(imm.getUInt16() & 3));
+            if (!(rd & 8) && imm.isUInt10()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_SP_imm_T1, rd, static_cast<uint8_t>(imm.getUInt10() >> 2));
+                return;
+            } else if ((rd == ARMRegisters::sp) && imm.isUInt9()) {
+                m_formatter.oneWordOp9Imm7(OP_ADD_SP_imm_T2, static_cast<uint8_t>(imm.getUInt9() >> 2));
+                return;
+            }
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_imm_T3, rn, rd, imm);
+        else {
+            ASSERT(imm.isUInt12());
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_imm_T4, rn, rd, imm);
+        }
+    }
+
+    ALWAYS_INLINE void add(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ADD_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // NOTE: In an IT block, add doesn't modify the flags register.
+    ALWAYS_INLINE void add(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (rd == ARMRegisters::sp) {
+            mov(rd, rn);
+            rn = rd;
+        }
+
+        if (rd == rn)
+            m_formatter.oneWordOp8RegReg143(OP_ADD_reg_T2, rm, rd);
+        else if (rd == rm)
+            m_formatter.oneWordOp8RegReg143(OP_ADD_reg_T2, rn, rd);
+        else if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_reg_T1, rm, rn, rd);
+        else
+            add(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    // Not allowed in an IT (if then) block.
+    ALWAYS_INLINE void add_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isEncodedImm());
+
+        if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_S_imm_T3, rn, rd, imm);
+    }
+
+    // Not allowed in an IT (if then) block?
+    ALWAYS_INLINE void add_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ADD_S_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // Not allowed in an IT (if then) block.
+    ALWAYS_INLINE void add_S(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_reg_T1, rm, rn, rd);
+        else
+            add_S(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    ALWAYS_INLINE void ARM_and(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_AND_imm_T1, rn, rd, imm);
+    }
+
+    ALWAYS_INLINE void ARM_and(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_AND_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    ALWAYS_INLINE void ARM_and(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_AND_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_AND_reg_T1, rn, rd);
+        else
+            ARM_and(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    ALWAYS_INLINE void asr(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_ASR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_ASR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    ALWAYS_INLINE void asr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ASR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+    
+    // Only allowed in IT (if then) block if last instruction.
+    ALWAYS_INLINE AssemblerLabel b()
+    {
+        m_formatter.twoWordOp16Op16(OP_B_T4a, OP_B_T4b);
+        return m_formatter.label();
+    }
+    
+    // Only allowed in IT (if then) block if last instruction.
+    ALWAYS_INLINE AssemblerLabel blx(RegisterID rm)
+    {
+        ASSERT(rm != ARMRegisters::pc);
+        m_formatter.oneWordOp8RegReg143(OP_BLX, rm, (RegisterID)8);
+        return m_formatter.label();
+    }
+
+    // Only allowed in IT (if then) block if last instruction.
+    ALWAYS_INLINE AssemblerLabel bx(RegisterID rm)
+    {
+        m_formatter.oneWordOp8RegReg143(OP_BX, rm, (RegisterID)0);
+        return m_formatter.label();
+    }
+
+    void bkpt(uint8_t imm = 0)
+    {
+        m_formatter.oneWordOp8Imm8(OP_BKPT, imm);
+    }
+
+    ALWAYS_INLINE void clz(RegisterID rd, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_CLZ, rm, FourFours(0xf, rd, 8, rm));
+    }
+
+    ALWAYS_INLINE void cmn(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isEncodedImm());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_CMN_imm, rn, (RegisterID)0xf, imm);
+    }
+
+    ALWAYS_INLINE void cmp(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isEncodedImm());
+
+        if (!(rn & 8) && imm.isUInt8())
+            m_formatter.oneWordOp5Reg3Imm8(OP_CMP_imm_T1, rn, imm.getUInt8());
+        else
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_CMP_imm_T2, rn, (RegisterID)0xf, imm);
+    }
+
+    ALWAYS_INLINE void cmp(RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_CMP_reg_T2, rn, FourFours(shift.hi4(), 0xf, shift.lo4(), rm));
+    }
+
+    ALWAYS_INLINE void cmp(RegisterID rn, RegisterID rm)
+    {
+        if ((rn | rm) & 8)
+            cmp(rn, rm, ShiftTypeAndAmount());
+        else
+            m_formatter.oneWordOp10Reg3Reg3(OP_CMP_reg_T1, rm, rn);
+    }
+
+    // xor is not spelled with an 'e'. :-(
+    ALWAYS_INLINE void eor(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_EOR_imm_T1, rn, rd, imm);
+    }
+
+    // xor is not spelled with an 'e'. :-(
+    ALWAYS_INLINE void eor(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_EOR_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // xor is not spelled with an 'e'. :-(
+    void eor(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_EOR_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_EOR_reg_T1, rn, rd);
+        else
+            eor(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    ALWAYS_INLINE void it(Condition cond)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond));
+    }
+
+    ALWAYS_INLINE void it(Condition cond, bool inst2if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if));
+    }
+
+    ALWAYS_INLINE void it(Condition cond, bool inst2if, bool inst3if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if, inst3if));
+    }
+
+    ALWAYS_INLINE void it(Condition cond, bool inst2if, bool inst3if, bool inst4if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if, inst3if, inst4if));
+    }
+
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void ldr(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt7())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDR_imm_T1, imm.getUInt7() >> 2, rn, rt);
+        else if ((rn == ARMRegisters::sp) && !(rt & 8) && imm.isUInt10())
+            m_formatter.oneWordOp5Reg3Imm8(OP_LDR_imm_T2, rt, static_cast<uint8_t>(imm.getUInt10() >> 2));
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T3, rn, rt, imm.getUInt12());
+    }
+    
+    ALWAYS_INLINE void ldrWide8BitImmediate(RegisterID rt, RegisterID rn, uint8_t immediate)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T3, rn, rt, immediate);
+    }
+
+    ALWAYS_INLINE void ldrCompact(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(imm.isUInt7());
+        ASSERT(!((rt | rn) & 8));
+        m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDR_imm_T1, imm.getUInt7() >> 2, rn, rt);
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed load;
+    // if index is not set then is is a post-index load.
+    //
+    // If wback is set rn is updated - this is a pre or post index load,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    ALWAYS_INLINE void ldr(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T4, rn, rt, offset);
+    }
+
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void ldr(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDR_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDR_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void ldrh(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+        ASSERT(!(imm.getUInt12() & 1));
+
+        if (!((rt | rn) & 8) && imm.isUInt6())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDRH_imm_T1, imm.getUInt6() >> 1, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRH_imm_T2, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed load;
+    // if index is not set then is is a post-index load.
+    //
+    // If wback is set rn is updated - this is a pre or post index load,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    ALWAYS_INLINE void ldrh(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRH_imm_T3, rn, rt, offset);
+    }
+
+    ALWAYS_INLINE void ldrh(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(!BadReg(rt));   // Memory hint
+        ASSERT(rn != ARMRegisters::pc); // LDRH (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRH_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRH_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    void ldrb(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt5())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDRB_imm_T1, imm.getUInt5(), rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRB_imm_T2, rn, rt, imm.getUInt12());
+    }
+
+    void ldrb(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+
+        ASSERT(!(offset & ~0xff));
+
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRB_imm_T3, rn, rt, offset);
+    }
+
+    ALWAYS_INLINE void ldrb(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc); // LDR (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRB_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRB_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+    
+    void ldrsb(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+        
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRSB_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRSB_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    void ldrsh(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+        
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRSH_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRSH_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    void lsl(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_LSL, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_LSL_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    ALWAYS_INLINE void lsl(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_LSL_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    ALWAYS_INLINE void lsr(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_LSR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_LSR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    ALWAYS_INLINE void lsr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_LSR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    ALWAYS_INLINE void movT3(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isValid());
+        ASSERT(!imm.isEncodedImm());
+        ASSERT(!BadReg(rd));
+        
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOV_imm_T3, imm.m_value.imm4, rd, imm);
+    }
+    
+#if OS(LINUX)
+    static void revertJumpTo_movT3movtcmpT2(void* instructionStart, RegisterID left, RegisterID right, uintptr_t imm)
+    {
+        uint16_t* address = static_cast<uint16_t*>(instructionStart);
+        ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(imm));
+        ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(imm >> 16));
+        uint16_t instruction[] = {
+            twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16),
+            twoWordOp5i6Imm4Reg4EncodedImmSecond(right, lo16),
+            twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16),
+            twoWordOp5i6Imm4Reg4EncodedImmSecond(right, hi16),
+            static_cast<uint16_t>(OP_CMP_reg_T2 | left)
+        };
+        performJITMemcpy(address, instruction, sizeof(uint16_t) * 5);
+        cacheFlush(address, sizeof(uint16_t) * 5);
+    }
+#else
+    static void revertJumpTo_movT3(void* instructionStart, RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isValid());
+        ASSERT(!imm.isEncodedImm());
+        ASSERT(!BadReg(rd));
+        
+        uint16_t* address = static_cast<uint16_t*>(instructionStart);
+        uint16_t instruction[] = {
+            twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, imm),
+            twoWordOp5i6Imm4Reg4EncodedImmSecond(rd, imm)
+        };
+        performJITMemcpy(address, instruction, sizeof(uint16_t) * 2);
+        cacheFlush(address, sizeof(uint16_t) * 2);
+    }
+#endif
+
+    ALWAYS_INLINE void mov(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isValid());
+        ASSERT(!BadReg(rd));
+        
+        if ((rd < 8) && imm.isUInt8())
+            m_formatter.oneWordOp5Reg3Imm8(OP_MOV_imm_T1, rd, imm.getUInt8());
+        else if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOV_imm_T2, 0xf, rd, imm);
+        else
+            movT3(rd, imm);
+    }
+
+    ALWAYS_INLINE void mov(RegisterID rd, RegisterID rm)
+    {
+        m_formatter.oneWordOp8RegReg143(OP_MOV_reg_T1, rm, rd);
+    }
+
+    ALWAYS_INLINE void movt(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isUInt16());
+        ASSERT(!BadReg(rd));
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOVT, imm.m_value.imm4, rd, imm);
+    }
+
+    ALWAYS_INLINE void mvn(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isEncodedImm());
+        ASSERT(!BadReg(rd));
+        
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MVN_imm, 0xf, rd, imm);
+    }
+
+    ALWAYS_INLINE void mvn(RegisterID rd, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp16FourFours(OP_MVN_reg_T2, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    ALWAYS_INLINE void mvn(RegisterID rd, RegisterID rm)
+    {
+        if (!((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_MVN_reg_T1, rm, rd);
+        else
+            mvn(rd, rm, ShiftTypeAndAmount());
+    }
+
+    ALWAYS_INLINE void neg(RegisterID rd, RegisterID rm)
+    {
+        ARMThumbImmediate zero = ARMThumbImmediate::makeUInt12(0);
+        sub(rd, zero, rm);
+    }
+
+    ALWAYS_INLINE void orr(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ORR_imm_T1, rn, rd, imm);
+    }
+
+    ALWAYS_INLINE void orr(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ORR_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void orr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rn, rd);
+        else
+            orr(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    ALWAYS_INLINE void orr_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ORR_S_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void orr_S(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rn, rd);
+        else
+            orr_S(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    ALWAYS_INLINE void ror(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_ROR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_ROR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    ALWAYS_INLINE void ror(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ROR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    ALWAYS_INLINE void pop(RegisterID dest)
+    {
+        if (dest < ARMRegisters::r8)
+            m_formatter.oneWordOp7Imm9(OP_POP_T1, 1 << dest);
+        else {
+            // Load postindexed with writeback.
+            ldr(dest, ARMRegisters::sp, sizeof(void*), false, true);
+        }
+    }
+
+    ALWAYS_INLINE void pop(uint32_t registerList)
+    {
+        ASSERT(WTF::bitCount(registerList) > 1);
+        ASSERT(!((1 << ARMRegisters::pc) & registerList) || !((1 << ARMRegisters::lr) & registerList));
+        ASSERT(!((1 << ARMRegisters::sp) & registerList));
+        m_formatter.twoWordOp16Imm16(OP_POP_T2, registerList);
+    }
+
+    ALWAYS_INLINE void push(RegisterID src)
+    {
+        if (src < ARMRegisters::r8)
+            m_formatter.oneWordOp7Imm9(OP_PUSH_T1, 1 << src);
+        else if (src == ARMRegisters::lr)
+            m_formatter.oneWordOp7Imm9(OP_PUSH_T1, 0x100);
+        else {
+            // Store preindexed with writeback.
+            str(src, ARMRegisters::sp, -sizeof(void*), true, true);
+        }
+    }
+
+    ALWAYS_INLINE void push(uint32_t registerList)
+    {
+        ASSERT(WTF::bitCount(registerList) > 1);
+        ASSERT(!((1 << ARMRegisters::pc) & registerList));
+        ASSERT(!((1 << ARMRegisters::sp) & registerList));
+        m_formatter.twoWordOp16Imm16(OP_PUSH_T2, registerList);
+    }
+
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+    template<int datasize>
+    ALWAYS_INLINE void sdiv(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        static_assert(datasize == 32, "sdiv datasize must be 32 for armv7s");        
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_SDIV_T1, rn, FourFours(0xf, rd, 0xf, rm));
+    }
+#endif
+
+    ALWAYS_INLINE void smull(RegisterID rdLo, RegisterID rdHi, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rdLo));
+        ASSERT(!BadReg(rdHi));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        ASSERT(rdLo != rdHi);
+        m_formatter.twoWordOp12Reg4FourFours(OP_SMULL_T1, rn, FourFours(rdLo, rdHi, 0, rm));
+    }
+
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void str(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt7())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_STR_imm_T1, imm.getUInt7() >> 2, rn, rt);
+        else if ((rn == ARMRegisters::sp) && !(rt & 8) && imm.isUInt10())
+            m_formatter.oneWordOp5Reg3Imm8(OP_STR_imm_T2, rt, static_cast<uint8_t>(imm.getUInt10() >> 2));
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T3, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed store;
+    // if index is not set then is is a post-index store.
+    //
+    // If wback is set rn is updated - this is a pre or post index store,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    ALWAYS_INLINE void str(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T4, rn, rt, offset);
+    }
+
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void str(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_STR_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_STR_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void strb(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt7())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_STRB_imm_T1, imm.getUInt7() >> 2, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STRB_imm_T2, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed store;
+    // if index is not set then is is a post-index store.
+    //
+    // If wback is set rn is updated - this is a pre or post index store,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    ALWAYS_INLINE void strb(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STRB_imm_T3, rn, rt, offset);
+    }
+
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void strb(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_STRB_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_STRB_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+    
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void strh(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isUInt12());
+        
+        if (!((rt | rn) & 8) && imm.isUInt6())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_STRH_imm_T1, imm.getUInt6() >> 1, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STRH_imm_T2, rn, rt, imm.getUInt12());
+    }
+    
+    // If index is set, this is a regular offset or a pre-indexed store;
+    // if index is not set then is is a post-index store.
+    //
+    // If wback is set rn is updated - this is a pre or post index store,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    ALWAYS_INLINE void strh(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+        
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT(!(offset & ~0xff));
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STRH_imm_T3, rn, rt, offset);
+    }
+    
+    // rt == ARMRegisters::pc only allowed if last instruction in IT (if then) block.
+    ALWAYS_INLINE void strh(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift = 0)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+        
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_STRH_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_STRH_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    ALWAYS_INLINE void sub(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isValid());
+
+        if ((rn == ARMRegisters::sp) && (rd == ARMRegisters::sp) && imm.isUInt9()) {
+            ASSERT(!(imm.getUInt16() & 3));
+            m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, static_cast<uint8_t>(imm.getUInt9() >> 2));
+            return;
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_SUB_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_imm_T3, rn, rd, imm);
+        else {
+            ASSERT(imm.isUInt12());
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_imm_T4, rn, rd, imm);
+        }
+    }
+
+    ALWAYS_INLINE void sub(RegisterID rd, ARMThumbImmediate imm, RegisterID rn)
+    {
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isValid());
+        ASSERT(imm.isUInt12());
+
+        if (!((rd | rn) & 8) && !imm.getUInt12())
+            m_formatter.oneWordOp10Reg3Reg3(OP_RSB_imm_T1, rn, rd);
+        else
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_RSB_imm_T2, rn, rd, imm);
+    }
+
+    ALWAYS_INLINE void sub(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_SUB_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // NOTE: In an IT block, add doesn't modify the flags register.
+    ALWAYS_INLINE void sub(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_reg_T1, rm, rn, rd);
+        else
+            sub(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    // Not allowed in an IT (if then) block.
+    void sub_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isValid());
+
+        if ((rn == ARMRegisters::sp) && (rd == ARMRegisters::sp) && imm.isUInt9()) {
+            ASSERT(!(imm.getUInt16() & 3));
+            m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, static_cast<uint8_t>(imm.getUInt9() >> 2));
+            return;
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_SUB_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_S_imm_T3, rn, rd, imm);
+    }
+
+    ALWAYS_INLINE void sub_S(RegisterID rd, ARMThumbImmediate imm, RegisterID rn)
+    {
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isValid());
+        ASSERT(imm.isUInt12());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_RSB_S_imm_T2, rn, rd, imm);
+    }
+
+    // Not allowed in an IT (if then) block?
+    ALWAYS_INLINE void sub_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_SUB_S_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // Not allowed in an IT (if then) block.
+    ALWAYS_INLINE void sub_S(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_reg_T1, rm, rn, rd);
+        else
+            sub_S(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    ALWAYS_INLINE void tst(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_TST_imm, rn, (RegisterID)0xf, imm);
+    }
+
+    ALWAYS_INLINE void tst(RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_TST_reg_T2, rn, FourFours(shift.hi4(), 0xf, shift.lo4(), rm));
+    }
+
+    ALWAYS_INLINE void tst(RegisterID rn, RegisterID rm)
+    {
+        if ((rn | rm) & 8)
+            tst(rn, rm, ShiftTypeAndAmount());
+        else
+            m_formatter.oneWordOp10Reg3Reg3(OP_TST_reg_T1, rm, rn);
+    }
+
+    ALWAYS_INLINE void ubfx(RegisterID rd, RegisterID rn, unsigned lsb, unsigned width)
+    {
+        ASSERT(lsb < 32);
+        ASSERT((width >= 1) && (width <= 32));
+        ASSERT((lsb + width) <= 32);
+        m_formatter.twoWordOp12Reg40Imm3Reg4Imm20Imm5(OP_UBFX_T1, rd, rn, (lsb & 0x1c) << 10, (lsb & 0x3) << 6, (width - 1) & 0x1f);
+    }
+
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+    ALWAYS_INLINE void udiv(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_UDIV_T1, rn, FourFours(0xf, rd, 0xf, rm));
+    }
+#endif
+
+    void vadd(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VADD_T2, OP_VADD_T2b, true, rn, rd, rm);
+    }
+
+    void vcmp(FPDoubleRegisterID rd, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VCMP, OP_VCMPb, true, VFPOperand(4), rd, rm);
+    }
+
+    void vcmpz(FPDoubleRegisterID rd)
+    {
+        m_formatter.vfpOp(OP_VCMP, OP_VCMPb, true, VFPOperand(5), rd, VFPOperand(0));
+    }
+
+    void vcvt_signedToFloatingPoint(FPDoubleRegisterID rd, FPSingleRegisterID rm)
+    {
+        // boolean values are 64bit (toInt, unsigned, roundZero)
+        m_formatter.vfpOp(OP_VCVT_FPIVFP, OP_VCVT_FPIVFPb, true, vcvtOp(false, false, false), rd, rm);
+    }
+
+    void vcvt_floatingPointToSigned(FPSingleRegisterID rd, FPDoubleRegisterID rm)
+    {
+        // boolean values are 64bit (toInt, unsigned, roundZero)
+        m_formatter.vfpOp(OP_VCVT_FPIVFP, OP_VCVT_FPIVFPb, true, vcvtOp(true, false, true), rd, rm);
+    }
+    
+    void vcvt_floatingPointToUnsigned(FPSingleRegisterID rd, FPDoubleRegisterID rm)
+    {
+        // boolean values are 64bit (toInt, unsigned, roundZero)
+        m_formatter.vfpOp(OP_VCVT_FPIVFP, OP_VCVT_FPIVFPb, true, vcvtOp(true, true, true), rd, rm);
+    }
+
+    void vdiv(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VDIV, OP_VDIVb, true, rn, rd, rm);
+    }
+
+    void vldr(FPDoubleRegisterID rd, RegisterID rn, int32_t imm)
+    {
+        m_formatter.vfpMemOp(OP_VLDR, OP_VLDRb, true, rn, rd, imm);
+    }
+    
+    void flds(FPSingleRegisterID rd, RegisterID rn, int32_t imm)
+    {
+        m_formatter.vfpMemOp(OP_FLDS, OP_FLDSb, false, rn, rd, imm);
+    }
+
+    void vmov(RegisterID rd, FPSingleRegisterID rn)
+    {
+        ASSERT(!BadReg(rd));
+        m_formatter.vfpOp(OP_VMOV_StoC, OP_VMOV_StoCb, false, rn, rd, VFPOperand(0));
+    }
+
+    void vmov(FPSingleRegisterID rd, RegisterID rn)
+    {
+        ASSERT(!BadReg(rn));
+        m_formatter.vfpOp(OP_VMOV_CtoS, OP_VMOV_CtoSb, false, rd, rn, VFPOperand(0));
+    }
+
+    void vmov(RegisterID rd1, RegisterID rd2, FPDoubleRegisterID rn)
+    {
+        ASSERT(!BadReg(rd1));
+        ASSERT(!BadReg(rd2));
+        m_formatter.vfpOp(OP_VMOV_DtoC, OP_VMOV_DtoCb, true, rd2, VFPOperand(rd1 | 16), rn);
+    }
+
+    void vmov(FPDoubleRegisterID rd, RegisterID rn1, RegisterID rn2)
+    {
+        ASSERT(!BadReg(rn1));
+        ASSERT(!BadReg(rn2));
+        m_formatter.vfpOp(OP_VMOV_CtoD, OP_VMOV_CtoDb, true, rn2, VFPOperand(rn1 | 16), rd);
+    }
+
+    void vmov(FPDoubleRegisterID rd, FPDoubleRegisterID rn)
+    {
+        m_formatter.vfpOp(OP_VMOV_T2, OP_VMOV_T2b, true, VFPOperand(0), rd, rn);
+    }
+
+    void vmrs(RegisterID reg = ARMRegisters::pc)
+    {
+        ASSERT(reg != ARMRegisters::sp);
+        m_formatter.vfpOp(OP_VMRS, OP_VMRSb, false, VFPOperand(1), VFPOperand(0x10 | reg), VFPOperand(0));
+    }
+
+    void vmul(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VMUL_T2, OP_VMUL_T2b, true, rn, rd, rm);
+    }
+
+    void vstr(FPDoubleRegisterID rd, RegisterID rn, int32_t imm)
+    {
+        m_formatter.vfpMemOp(OP_VSTR, OP_VSTRb, true, rn, rd, imm);
+    }
+
+    void fsts(FPSingleRegisterID rd, RegisterID rn, int32_t imm)
+    {
+        m_formatter.vfpMemOp(OP_FSTS, OP_FSTSb, false, rn, rd, imm);
+    }
+
+    void vsub(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VSUB_T2, OP_VSUB_T2b, true, rn, rd, rm);
+    }
+
+    void vabs(FPDoubleRegisterID rd, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VABS_T2, OP_VABS_T2b, true, VFPOperand(16), rd, rm);
+    }
+
+    void vneg(FPDoubleRegisterID rd, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VNEG_T2, OP_VNEG_T2b, true, VFPOperand(1), rd, rm);
+    }
+
+    void vsqrt(FPDoubleRegisterID rd, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VSQRT_T1, OP_VSQRT_T1b, true, VFPOperand(17), rd, rm);
+    }
+    
+    void vcvtds(FPDoubleRegisterID rd, FPSingleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VCVTDS_T1, OP_VCVTDS_T1b, false, VFPOperand(23), rd, rm);
+    }
+
+    void vcvtsd(FPSingleRegisterID rd, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VCVTSD_T1, OP_VCVTSD_T1b, true, VFPOperand(23), rd, rm);
+    }
+
+    void nop()
+    {
+        m_formatter.oneWordOp8Imm8(OP_NOP_T1, 0);
+    }
+
+    void nopw()
+    {
+        m_formatter.twoWordOp16Op16(OP_NOP_T2a, OP_NOP_T2b);
+    }
+    
+    static constexpr int16_t nopPseudo16()
+    {
+        return OP_NOP_T1;
+    }
+
+    static constexpr int32_t nopPseudo32()
+    {
+        return OP_NOP_T2a | (OP_NOP_T2b << 16);
+    }
+
+    static void fillNops(void* base, size_t size, bool isCopyingToExecutableMemory)
+    {
+        RELEASE_ASSERT(!(size % sizeof(int16_t)));
+
+        char* ptr = static_cast<char*>(base);
+        const size_t num32s = size / sizeof(int32_t);
+        for (size_t i = 0; i < num32s; i++) {
+            const int32_t insn = nopPseudo32();
+            if (isCopyingToExecutableMemory)
+                performJITMemcpy(ptr, &insn, sizeof(int32_t));
+            else
+                memcpy(ptr, &insn, sizeof(int32_t));
+            ptr += sizeof(int32_t);
+        }
+
+        const size_t num16s = (size % sizeof(int32_t)) / sizeof(int16_t);
+        ASSERT(num16s == 0 || num16s == 1);
+        ASSERT(num16s * sizeof(int16_t) + num32s * sizeof(int32_t) == size);
+        if (num16s) {
+            const int16_t insn = nopPseudo16();
+            if (isCopyingToExecutableMemory)
+                performJITMemcpy(ptr, &insn, sizeof(int16_t));
+            else
+                memcpy(ptr, &insn, sizeof(int16_t));
+        }
+    }
+
+    void dmbSY()
+    {
+        m_formatter.twoWordOp16Op16(OP_DMB_T1a, OP_DMB_SY_T1b);
+    }
+
+    void dmbISHST()
+    {
+        m_formatter.twoWordOp16Op16(OP_DMB_T1a, OP_DMB_ISHST_T1b);
+    }
+
+    AssemblerLabel labelIgnoringWatchpoints()
+    {
+        return m_formatter.label();
+    }
+
+    AssemblerLabel labelForWatchpoint()
+    {
+        AssemblerLabel result = m_formatter.label();
+        if (static_cast<int>(result.m_offset) != m_indexOfLastWatchpoint)
+            result = label();
+        m_indexOfLastWatchpoint = result.m_offset;
+        m_indexOfTailOfLastWatchpoint = result.m_offset + maxJumpReplacementSize();
+        return result;
+    }
+
+    AssemblerLabel label()
+    {
+        AssemblerLabel result = m_formatter.label();
+        while (UNLIKELY(static_cast<int>(result.m_offset) < m_indexOfTailOfLastWatchpoint)) {
+            if (UNLIKELY(static_cast<int>(result.m_offset) + 4 <= m_indexOfTailOfLastWatchpoint))
+                nopw();
+            else
+                nop();
+            result = m_formatter.label();
+        }
+        return result;
+    }
+    
+    AssemblerLabel align(int alignment)
+    {
+        while (!m_formatter.isAligned(alignment))
+            bkpt();
+
+        return label();
+    }
+    
+    static void* getRelocatedAddress(void* code, AssemblerLabel label)
+    {
+        ASSERT(label.isSet());
+        return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + label.m_offset);
+    }
+    
+    static int getDifferenceBetweenLabels(AssemblerLabel a, AssemblerLabel b)
+    {
+        return b.m_offset - a.m_offset;
+    }
+
+    static int jumpSizeDelta(JumpType jumpType, JumpLinkType jumpLinkType) { return JUMP_ENUM_SIZE(jumpType) - JUMP_ENUM_SIZE(jumpLinkType); }
+    
+    // Assembler admin methods:
+
+    static ALWAYS_INLINE bool linkRecordSourceComparator(const LinkRecord& a, const LinkRecord& b)
+    {
+        return a.from() < b.from();
+    }
+
+    static bool canCompact(JumpType jumpType)
+    {
+        // The following cannot be compacted:
+        //   JumpFixed: represents custom jump sequence
+        //   JumpNoConditionFixedSize: represents unconditional jump that must remain a fixed size
+        //   JumpConditionFixedSize: represents conditional jump that must remain a fixed size
+        return (jumpType == JumpNoCondition) || (jumpType == JumpCondition);
+    }
+    
+    static JumpLinkType computeJumpType(JumpType jumpType, const uint8_t* from, const uint8_t* to)
+    {
+        if (jumpType == JumpFixed)
+            return LinkInvalid;
+        
+        // for patchable jump we must leave space for the longest code sequence
+        if (jumpType == JumpNoConditionFixedSize)
+            return LinkBX;
+        if (jumpType == JumpConditionFixedSize)
+            return LinkConditionalBX;
+        
+        const int paddingSize = JUMP_ENUM_SIZE(jumpType);
+        
+        if (jumpType == JumpCondition) {
+            // 2-byte conditional T1
+            const uint16_t* jumpT1Location = reinterpret_cast_ptr<const uint16_t*>(from - (paddingSize - JUMP_ENUM_SIZE(LinkJumpT1)));
+            if (canBeJumpT1(jumpT1Location, to))
+                return LinkJumpT1;
+            // 4-byte conditional T3
+            const uint16_t* jumpT3Location = reinterpret_cast_ptr<const uint16_t*>(from - (paddingSize - JUMP_ENUM_SIZE(LinkJumpT3)));
+            if (canBeJumpT3(jumpT3Location, to))
+                return LinkJumpT3;
+            // 4-byte conditional T4 with IT
+            const uint16_t* conditionalJumpT4Location = 
+            reinterpret_cast_ptr<const uint16_t*>(from - (paddingSize - JUMP_ENUM_SIZE(LinkConditionalJumpT4)));
+            if (canBeJumpT4(conditionalJumpT4Location, to))
+                return LinkConditionalJumpT4;
+        } else {
+            // 2-byte unconditional T2
+            const uint16_t* jumpT2Location = reinterpret_cast_ptr<const uint16_t*>(from - (paddingSize - JUMP_ENUM_SIZE(LinkJumpT2)));
+            if (canBeJumpT2(jumpT2Location, to))
+                return LinkJumpT2;
+            // 4-byte unconditional T4
+            const uint16_t* jumpT4Location = reinterpret_cast_ptr<const uint16_t*>(from - (paddingSize - JUMP_ENUM_SIZE(LinkJumpT4)));
+            if (canBeJumpT4(jumpT4Location, to))
+                return LinkJumpT4;
+            // use long jump sequence
+            return LinkBX;
+        }
+        
+        ASSERT(jumpType == JumpCondition);
+        return LinkConditionalBX;
+    }
+    
+    static JumpLinkType computeJumpType(LinkRecord& record, const uint8_t* from, const uint8_t* to)
+    {
+        JumpLinkType linkType = computeJumpType(record.type(), from, to);
+        record.setLinkType(linkType);
+        return linkType;
+    }
+    
+    Vector<LinkRecord, 0, UnsafeVectorOverflow>& jumpsToLink()
+    {
+        std::sort(m_jumpsToLink.begin(), m_jumpsToLink.end(), linkRecordSourceComparator);
+        return m_jumpsToLink;
+    }
+
+    static void ALWAYS_INLINE link(LinkRecord& record, uint8_t* from, const uint8_t* fromInstruction8, uint8_t* to)
+    {
+        const uint16_t* fromInstruction = reinterpret_cast_ptr<const uint16_t*>(fromInstruction8);
+        switch (record.linkType()) {
+        case LinkJumpT1:
+            linkJumpT1(record.condition(), reinterpret_cast_ptr<uint16_t*>(from), fromInstruction, to);
+            break;
+        case LinkJumpT2:
+            linkJumpT2(reinterpret_cast_ptr<uint16_t*>(from), fromInstruction, to);
+            break;
+        case LinkJumpT3:
+            linkJumpT3(record.condition(), reinterpret_cast_ptr<uint16_t*>(from), fromInstruction, to);
+            break;
+        case LinkJumpT4:
+            linkJumpT4(reinterpret_cast_ptr<uint16_t*>(from), fromInstruction, to);
+            break;
+        case LinkConditionalJumpT4:
+            linkConditionalJumpT4(record.condition(), reinterpret_cast_ptr<uint16_t*>(from), fromInstruction, to);
+            break;
+        case LinkConditionalBX:
+            linkConditionalBX(record.condition(), reinterpret_cast_ptr<uint16_t*>(from), fromInstruction, to);
+            break;
+        case LinkBX:
+            linkBX(reinterpret_cast_ptr<uint16_t*>(from), fromInstruction, to);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+
+    void* unlinkedCode() { return m_formatter.data(); }
+    size_t codeSize() const { return m_formatter.codeSize(); }
+
+    static unsigned getCallReturnOffset(AssemblerLabel call)
+    {
+        ASSERT(call.isSet());
+        return call.m_offset;
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    void linkJump(AssemblerLabel from, AssemblerLabel to, JumpType type, Condition condition)
+    {
+        ASSERT(to.isSet());
+        ASSERT(from.isSet());
+        m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset, type, condition));
+    }
+
+    static void linkJump(void* code, AssemblerLabel from, void* to)
+    {
+        ASSERT(from.isSet());
+        
+        uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        linkJumpAbsolute(location, location, to);
+    }
+
+    static void linkCall(void* code, AssemblerLabel from, void* to)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(code) & 1));
+        ASSERT(from.isSet());
+
+        setPointer(reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(code) + from.m_offset) - 1, to, false);
+    }
+
+    static void linkPointer(void* code, AssemblerLabel where, void* value)
+    {
+        setPointer(reinterpret_cast<char*>(code) + where.m_offset, value, false);
+    }
+
+    // The static relink and replace methods can use can use |from| for both
+    // the write and executable address for call and jump patching
+    // as they're modifying existing (linked) code, so the address being
+    // provided is correct for relative address computation.
+    static void relinkJump(void* from, void* to)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(to) & 1));
+
+        linkJumpAbsolute(reinterpret_cast<uint16_t*>(from), reinterpret_cast<uint16_t*>(from), to);
+
+        cacheFlush(reinterpret_cast<uint16_t*>(from) - 5, 5 * sizeof(uint16_t));
+    }
+
+    static void relinkJumpToNop(void* from)
+    {
+        relinkJump(from, from);
+    }
+    
+    static void relinkCall(void* from, void* to)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 1));
+
+        setPointer(reinterpret_cast<uint16_t*>(from) - 1, to, true);
+    }
+    
+    static void* readCallTarget(void* from)
+    {
+        return readPointer(reinterpret_cast<uint16_t*>(from) - 1);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
+        
+        setInt32(where, value, true);
+    }
+    
+    static void repatchCompact(void* where, int32_t offset)
+    {
+        ASSERT(offset >= -255 && offset <= 255);
+
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        
+        offset |= (add << 9);
+        offset |= (1 << 10);
+        offset |= (1 << 11);
+
+        uint16_t* location = reinterpret_cast<uint16_t*>(where);
+        uint16_t instruction = location[1] & ~((1 << 12) - 1);
+        instruction |= offset;
+        performJITMemcpy(location + 1, &instruction, sizeof(uint16_t));
+        cacheFlush(location, sizeof(uint16_t) * 2);
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
+        
+        setPointer(where, value, true);
+    }
+
+    static void* readPointer(void* where)
+    {
+        return reinterpret_cast<void*>(readInt32(where));
+    }
+    
+    static void replaceWithJump(void* instructionStart, void* to)
+    {
+        ASSERT(!(bitwise_cast<uintptr_t>(instructionStart) & 1));
+        ASSERT(!(bitwise_cast<uintptr_t>(to) & 1));
+
+#if OS(LINUX)
+        if (canBeJumpT4(reinterpret_cast<uint16_t*>(instructionStart), to)) {
+            uint16_t* ptr = reinterpret_cast<uint16_t*>(instructionStart) + 2;
+            linkJumpT4(ptr, ptr, to);
+            cacheFlush(ptr - 2, sizeof(uint16_t) * 2);
+        } else {
+            uint16_t* ptr = reinterpret_cast<uint16_t*>(instructionStart) + 5;
+            linkBX(ptr, ptr, to);
+            cacheFlush(ptr - 5, sizeof(uint16_t) * 5);
+        }
+#else
+        uint16_t* ptr = reinterpret_cast<uint16_t*>(instructionStart) + 2;
+        linkJumpT4(ptr, ptr, to);
+        cacheFlush(ptr - 2, sizeof(uint16_t) * 2);
+#endif
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+#if OS(LINUX)
+        return 10;
+#else
+        return 4;
+#endif
+    }
+
+    static constexpr ptrdiff_t patchableJumpSize()
+    {
+        return 10;
+    }
+    
+    static void replaceWithLoad(void* instructionStart)
+    {
+        ASSERT(!(bitwise_cast<uintptr_t>(instructionStart) & 1));
+        uint16_t* ptr = reinterpret_cast<uint16_t*>(instructionStart);
+        switch (ptr[0] & 0xFFF0) {
+        case OP_LDR_imm_T3:
+            break;
+        case OP_ADD_imm_T3: {
+            ASSERT(!(ptr[1] & 0xF000));
+            uint16_t instructions[2];
+            instructions[0] = ptr[0] & 0x000F;
+            instructions[0] |= OP_LDR_imm_T3;
+            instructions[1] = ptr[1] | (ptr[1] & 0x0F00) << 4;
+            instructions[1] &= 0xF0FF;
+            performJITMemcpy(ptr, instructions, sizeof(uint16_t) * 2);
+            cacheFlush(ptr, sizeof(uint16_t) * 2);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    static void replaceWithAddressComputation(void* instructionStart)
+    {
+        ASSERT(!(bitwise_cast<uintptr_t>(instructionStart) & 1));
+        uint16_t* ptr = reinterpret_cast<uint16_t*>(instructionStart);
+        switch (ptr[0] & 0xFFF0) {
+        case OP_LDR_imm_T3: {
+            ASSERT(!(ptr[1] & 0x0F00));
+            uint16_t instructions[2];
+            instructions[0] = ptr[0] & 0x000F;
+            instructions[0] |= OP_ADD_imm_T3;
+            instructions[1] = ptr[1] | (ptr[1] & 0xF000) >> 4;
+            instructions[1] &= 0x0FFF;
+            performJITMemcpy(ptr, instructions, sizeof(uint16_t) * 2);
+            cacheFlush(ptr, sizeof(uint16_t) * 2);
+            break;
+        }
+        case OP_ADD_imm_T3:
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    unsigned debugOffset() { return m_formatter.debugOffset(); }
+
+#if OS(LINUX)
+    static inline void linuxPageFlush(uintptr_t begin, uintptr_t end)
+    {
+        asm volatile(
+            "push    {r7}\n"
+            "mov     r0, %0\n"
+            "mov     r1, %1\n"
+            "movw    r7, #0x2\n"
+            "movt    r7, #0xf\n"
+            "movs    r2, #0x0\n"
+            "svc     0x0\n"
+            "pop     {r7}\n"
+            :
+            : "r" (begin), "r" (end)
+            : "r0", "r1", "r2");
+    }
+#endif
+
+    static void cacheFlush(void* code, size_t size)
+    {
+#if OS(IOS)
+        sys_cache_control(kCacheFunctionPrepareForExecution, code, size);
+#elif OS(LINUX)
+        size_t page = pageSize();
+        uintptr_t current = reinterpret_cast<uintptr_t>(code);
+        uintptr_t end = current + size;
+        uintptr_t firstPageEnd = (current & ~(page - 1)) + page;
+
+        if (end <= firstPageEnd) {
+            linuxPageFlush(current, end);
+            return;
+        }
+
+        linuxPageFlush(current, firstPageEnd);
+
+        for (current = firstPageEnd; current + page < end; current += page)
+            linuxPageFlush(current, current + page);
+
+        linuxPageFlush(current, end);
+#else
+#error "The cacheFlush support is missing on this platform."
+#endif
+    }
+
+private:
+    // VFP operations commonly take one or more 5-bit operands, typically representing a
+    // floating point register number.  This will commonly be encoded in the instruction
+    // in two parts, with one single bit field, and one 4-bit field.  In the case of
+    // double precision operands the high bit of the register number will be encoded
+    // separately, and for single precision operands the high bit of the register number
+    // will be encoded individually.
+    // VFPOperand encapsulates a 5-bit VFP operand, with bits 0..3 containing the 4-bit
+    // field to be encoded together in the instruction (the low 4-bits of a double
+    // register number, or the high 4-bits of a single register number), and bit 4
+    // contains the bit value to be encoded individually.
+    struct VFPOperand {
+        explicit VFPOperand(uint32_t value)
+            : m_value(value)
+        {
+            ASSERT(!(m_value & ~0x1f));
+        }
+
+        VFPOperand(FPDoubleRegisterID reg)
+            : m_value(reg)
+        {
+        }
+
+        VFPOperand(RegisterID reg)
+            : m_value(reg)
+        {
+        }
+
+        VFPOperand(FPSingleRegisterID reg)
+            : m_value(((reg & 1) << 4) | (reg >> 1)) // rotate the lowest bit of 'reg' to the top.
+        {
+        }
+
+        uint32_t bits1()
+        {
+            return m_value >> 4;
+        }
+
+        uint32_t bits4()
+        {
+            return m_value & 0xf;
+        }
+
+        uint32_t m_value;
+    };
+
+    VFPOperand vcvtOp(bool toInteger, bool isUnsigned, bool isRoundZero)
+    {
+        // Cannot specify rounding when converting to float.
+        ASSERT(toInteger || !isRoundZero);
+
+        uint32_t op = 0x8;
+        if (toInteger) {
+            // opc2 indicates both toInteger & isUnsigned.
+            op |= isUnsigned ? 0x4 : 0x5;
+            // 'op' field in instruction is isRoundZero
+            if (isRoundZero)
+                op |= 0x10;
+        } else {
+            ASSERT(!isRoundZero);
+            // 'op' field in instruction is isUnsigned
+            if (!isUnsigned)
+                op |= 0x10;
+        }
+        return VFPOperand(op);
+    }
+
+    static void setInt32(void* code, uint32_t value, bool flush)
+    {
+        uint16_t* location = reinterpret_cast<uint16_t*>(code);
+        ASSERT(isMOV_imm_T3(location - 4) && isMOVT(location - 2));
+
+        ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(value));
+        ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(value >> 16));
+        uint16_t instructions[4];
+        instructions[0] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16);
+        instructions[1] = twoWordOp5i6Imm4Reg4EncodedImmSecond((location[-3] >> 8) & 0xf, lo16);
+        instructions[2] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16);
+        instructions[3] = twoWordOp5i6Imm4Reg4EncodedImmSecond((location[-1] >> 8) & 0xf, hi16);
+
+        performJITMemcpy(location - 4, instructions, 4 * sizeof(uint16_t));
+        if (flush)
+            cacheFlush(location - 4, 4 * sizeof(uint16_t));
+    }
+    
+    static int32_t readInt32(void* code)
+    {
+        uint16_t* location = reinterpret_cast<uint16_t*>(code);
+        ASSERT(isMOV_imm_T3(location - 4) && isMOVT(location - 2));
+        
+        ARMThumbImmediate lo16;
+        ARMThumbImmediate hi16;
+        decodeTwoWordOp5i6Imm4Reg4EncodedImmFirst(lo16, location[-4]);
+        decodeTwoWordOp5i6Imm4Reg4EncodedImmSecond(lo16, location[-3]);
+        decodeTwoWordOp5i6Imm4Reg4EncodedImmFirst(hi16, location[-2]);
+        decodeTwoWordOp5i6Imm4Reg4EncodedImmSecond(hi16, location[-1]);
+        uint32_t result = hi16.asUInt16();
+        result <<= 16;
+        result |= lo16.asUInt16();
+        return static_cast<int32_t>(result);
+    }
+
+    static void setUInt7ForLoad(void* code, ARMThumbImmediate imm)
+    {
+        // Requires us to have planted a LDR_imm_T1
+        ASSERT(imm.isValid());
+        ASSERT(imm.isUInt7());
+        uint16_t* location = reinterpret_cast<uint16_t*>(code);
+        uint16_t instruction;
+        instruction = location[0] & ~((static_cast<uint16_t>(0x7f) >> 2) << 6);
+        instruction |= (imm.getUInt7() >> 2) << 6;
+        performJITMemcpy(location, &instruction, sizeof(uint16_t));
+        cacheFlush(location, sizeof(uint16_t));
+    }
+
+    static void setPointer(void* code, void* value, bool flush)
+    {
+        setInt32(code, reinterpret_cast<uint32_t>(value), flush);
+    }
+
+    static bool isB(const void* address)
+    {
+        const uint16_t* instruction = static_cast<const uint16_t*>(address);
+        return ((instruction[0] & 0xf800) == OP_B_T4a) && ((instruction[1] & 0xd000) == OP_B_T4b);
+    }
+
+    static bool isBX(const void* address)
+    {
+        const uint16_t* instruction = static_cast<const uint16_t*>(address);
+        return (instruction[0] & 0xff87) == OP_BX;
+    }
+
+    static bool isMOV_imm_T3(const void* address)
+    {
+        const uint16_t* instruction = static_cast<const uint16_t*>(address);
+        return ((instruction[0] & 0xFBF0) == OP_MOV_imm_T3) && ((instruction[1] & 0x8000) == 0);
+    }
+
+    static bool isMOVT(const void* address)
+    {
+        const uint16_t* instruction = static_cast<const uint16_t*>(address);
+        return ((instruction[0] & 0xFBF0) == OP_MOVT) && ((instruction[1] & 0x8000) == 0);
+    }
+
+    static bool isNOP_T1(const void* address)
+    {
+        const uint16_t* instruction = static_cast<const uint16_t*>(address);
+        return instruction[0] == OP_NOP_T1;
+    }
+
+    static bool isNOP_T2(const void* address)
+    {
+        const uint16_t* instruction = static_cast<const uint16_t*>(address);
+        return (instruction[0] == OP_NOP_T2a) && (instruction[1] == OP_NOP_T2b);
+    }
+
+    static bool canBeJumpT1(const uint16_t* instruction, const void* target)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // It does not appear to be documented in the ARM ARM (big surprise), but
+        // for OP_B_T1 the branch displacement encoded in the instruction is 2 
+        // less than the actual displacement.
+        relative -= 2;
+        return ((relative << 23) >> 23) == relative;
+    }
+    
+    static bool canBeJumpT2(const uint16_t* instruction, const void* target)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // It does not appear to be documented in the ARM ARM (big surprise), but
+        // for OP_B_T2 the branch displacement encoded in the instruction is 2 
+        // less than the actual displacement.
+        relative -= 2;
+        return ((relative << 20) >> 20) == relative;
+    }
+    
+    static bool canBeJumpT3(const uint16_t* instruction, const void* target)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        return ((relative << 11) >> 11) == relative;
+    }
+    
+    static bool canBeJumpT4(const uint16_t* instruction, const void* target)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        return ((relative << 7) >> 7) == relative;
+    }
+    
+    static void linkJumpT1(Condition cond, uint16_t* writeTarget, const uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        ASSERT(canBeJumpT1(instruction, target));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // It does not appear to be documented in the ARM ARM (big surprise), but
+        // for OP_B_T1 the branch displacement encoded in the instruction is 2 
+        // less than the actual displacement.
+        relative -= 2;
+        
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+        uint16_t newInstruction = OP_B_T1 | ((cond & 0xf) << 8) | ((relative & 0x1fe) >> 1);
+        performJITMemcpy(writeTarget - 1, &newInstruction, sizeof(uint16_t));
+    }
+    
+    static void linkJumpT2(uint16_t* writeTarget, const uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        ASSERT(canBeJumpT2(instruction, target));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // It does not appear to be documented in the ARM ARM (big surprise), but
+        // for OP_B_T2 the branch displacement encoded in the instruction is 2 
+        // less than the actual displacement.
+        relative -= 2;
+        
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+        uint16_t newInstruction = OP_B_T2 | ((relative & 0xffe) >> 1);
+        performJITMemcpy(writeTarget - 1, &newInstruction, sizeof(uint16_t));
+    }
+    
+    static void linkJumpT3(Condition cond, uint16_t* writeTarget, const uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        ASSERT(canBeJumpT3(instruction, target));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+        uint16_t instructions[2];
+        instructions[0] = OP_B_T3a | ((relative & 0x100000) >> 10) | ((cond & 0xf) << 6) | ((relative & 0x3f000) >> 12);
+        instructions[1] = OP_B_T3b | ((relative & 0x80000) >> 8) | ((relative & 0x40000) >> 5) | ((relative & 0xffe) >> 1);
+        performJITMemcpy(writeTarget - 2, instructions, 2 * sizeof(uint16_t));
+    }
+    
+    static void linkJumpT4(uint16_t* writeTarget, const uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        ASSERT(canBeJumpT4(instruction, target));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // ARM encoding for the top two bits below the sign bit is 'peculiar'.
+        if (relative >= 0)
+            relative ^= 0xC00000;
+        
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+        uint16_t instructions[2];
+        instructions[0] = OP_B_T4a | ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
+        instructions[1] = OP_B_T4b | ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
+        performJITMemcpy(writeTarget - 2, instructions, 2 * sizeof(uint16_t));
+    }
+    
+    static void linkConditionalJumpT4(Condition cond, uint16_t* writeTarget, const uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        uint16_t newInstruction = ifThenElse(cond) | OP_IT;
+        performJITMemcpy(writeTarget - 3, &newInstruction, sizeof(uint16_t));
+        linkJumpT4(writeTarget, instruction, target);
+    }
+    
+    static void linkBX(uint16_t* writeTarget, const uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(
+        ASSERT_UNUSED(instruction, !(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(writeTarget) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        const uint16_t JUMP_TEMPORARY_REGISTER = ARMRegisters::ip;
+        ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) + 1));
+        ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) >> 16));
+        uint16_t instructions[5];
+        instructions[0] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16);
+        instructions[1] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, lo16);
+        instructions[2] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16);
+        instructions[3] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, hi16);
+        instructions[4] = OP_BX | (JUMP_TEMPORARY_REGISTER << 3);
+
+        performJITMemcpy(writeTarget - 5, instructions, 5 * sizeof(uint16_t));
+    }
+    
+    static void linkConditionalBX(Condition cond, uint16_t* writeTarget, const uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        linkBX(writeTarget, instruction, target);
+        uint16_t newInstruction = ifThenElse(cond, true, true) | OP_IT;
+        performJITMemcpy(writeTarget - 6, &newInstruction, sizeof(uint16_t));
+    }
+    
+    static void linkJumpAbsolute(uint16_t* writeTarget, const uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        ASSERT((isMOV_imm_T3(instruction - 5) && isMOVT(instruction - 3) && isBX(instruction - 1))
+               || (isNOP_T1(instruction - 5) && isNOP_T2(instruction - 4) && isB(instruction - 2)));
+
+        if (canBeJumpT4(instruction, target)) {
+            // There may be a better way to fix this, but right now put the NOPs first, since in the
+            // case of an conditional branch this will be coming after an ITTT predicating *three*
+            // instructions!  Looking backwards to modify the ITTT to an IT is not easy, due to
+            // variable wdith encoding - the previous instruction might *look* like an ITTT but
+            // actually be the second half of a 2-word op.
+            uint16_t instructions[3];
+            instructions[0] = OP_NOP_T1;
+            instructions[1] = OP_NOP_T2a;
+            instructions[2] = OP_NOP_T2b;
+            performJITMemcpy(writeTarget - 5, instructions, 3 * sizeof(uint16_t));
+            linkJumpT4(writeTarget, instruction, target);
+        } else {
+            const uint16_t JUMP_TEMPORARY_REGISTER = ARMRegisters::ip;
+            ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) + 1));
+            ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) >> 16));
+
+            uint16_t instructions[5];
+            instructions[0] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16);
+            instructions[1] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, lo16);
+            instructions[2] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16);
+            instructions[3] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, hi16);
+            instructions[4] = OP_BX | (JUMP_TEMPORARY_REGISTER << 3);
+            performJITMemcpy(writeTarget - 5, instructions, 5 * sizeof(uint16_t));
+        }
+    }
+    
+    static uint16_t twoWordOp5i6Imm4Reg4EncodedImmFirst(uint16_t op, ARMThumbImmediate imm)
+    {
+        return op | (imm.m_value.i << 10) | imm.m_value.imm4;
+    }
+
+    static void decodeTwoWordOp5i6Imm4Reg4EncodedImmFirst(ARMThumbImmediate& result, uint16_t value)
+    {
+        result.m_value.i = (value >> 10) & 1;
+        result.m_value.imm4 = value & 15;
+    }
+
+    static uint16_t twoWordOp5i6Imm4Reg4EncodedImmSecond(uint16_t rd, ARMThumbImmediate imm)
+    {
+        return (imm.m_value.imm3 << 12) | (rd << 8) | imm.m_value.imm8;
+    }
+
+    static void decodeTwoWordOp5i6Imm4Reg4EncodedImmSecond(ARMThumbImmediate& result, uint16_t value)
+    {
+        result.m_value.imm3 = (value >> 12) & 7;
+        result.m_value.imm8 = value & 255;
+    }
+
+    class ARMInstructionFormatter {
+    public:
+        ALWAYS_INLINE void oneWordOp5Reg3Imm8(OpcodeID op, RegisterID rd, uint8_t imm)
+        {
+            m_buffer.putShort(op | (rd << 8) | imm);
+        }
+        
+        ALWAYS_INLINE void oneWordOp5Imm5Reg3Reg3(OpcodeID op, uint8_t imm, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | (imm << 6) | (reg1 << 3) | reg2);
+        }
+
+        ALWAYS_INLINE void oneWordOp7Reg3Reg3Reg3(OpcodeID op, RegisterID reg1, RegisterID reg2, RegisterID reg3)
+        {
+            m_buffer.putShort(op | (reg1 << 6) | (reg2 << 3) | reg3);
+        }
+
+        ALWAYS_INLINE void oneWordOp7Imm9(OpcodeID op, uint16_t imm)
+        {
+            m_buffer.putShort(op | imm);
+        }
+
+        ALWAYS_INLINE void oneWordOp8Imm8(OpcodeID op, uint8_t imm)
+        {
+            m_buffer.putShort(op | imm);
+        }
+
+        ALWAYS_INLINE void oneWordOp8RegReg143(OpcodeID op, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | ((reg2 & 8) << 4) | (reg1 << 3) | (reg2 & 7));
+        }
+
+        ALWAYS_INLINE void oneWordOp9Imm7(OpcodeID op, uint8_t imm)
+        {
+            m_buffer.putShort(op | imm);
+        }
+
+        ALWAYS_INLINE void oneWordOp10Reg3Reg3(OpcodeID op, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | (reg1 << 3) | reg2);
+        }
+
+        ALWAYS_INLINE void twoWordOp12Reg4FourFours(OpcodeID1 op, RegisterID reg, FourFours ff)
+        {
+            m_buffer.putShort(op | reg);
+            m_buffer.putShort(ff.m_u.value);
+        }
+        
+        ALWAYS_INLINE void twoWordOp16FourFours(OpcodeID1 op, FourFours ff)
+        {
+            m_buffer.putShort(op);
+            m_buffer.putShort(ff.m_u.value);
+        }
+        
+        ALWAYS_INLINE void twoWordOp16Op16(OpcodeID1 op1, OpcodeID2 op2)
+        {
+            m_buffer.putShort(op1);
+            m_buffer.putShort(op2);
+        }
+
+        ALWAYS_INLINE void twoWordOp16Imm16(OpcodeID1 op1, uint16_t imm)
+        {
+            m_buffer.putShort(op1);
+            m_buffer.putShort(imm);
+        }
+        
+        ALWAYS_INLINE void twoWordOp5i6Imm4Reg4EncodedImm(OpcodeID1 op, int imm4, RegisterID rd, ARMThumbImmediate imm)
+        {
+            ARMThumbImmediate newImm = imm;
+            newImm.m_value.imm4 = imm4;
+
+            m_buffer.putShort(ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmFirst(op, newImm));
+            m_buffer.putShort(ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmSecond(rd, newImm));
+        }
+
+        ALWAYS_INLINE void twoWordOp12Reg4Reg4Imm12(OpcodeID1 op, RegisterID reg1, RegisterID reg2, uint16_t imm)
+        {
+            m_buffer.putShort(op | reg1);
+            m_buffer.putShort((reg2 << 12) | imm);
+        }
+
+        ALWAYS_INLINE void twoWordOp12Reg40Imm3Reg4Imm20Imm5(OpcodeID1 op, RegisterID reg1, RegisterID reg2, uint16_t imm1, uint16_t imm2, uint16_t imm3)
+        {
+            m_buffer.putShort(op | reg1);
+            m_buffer.putShort((imm1 << 12) | (reg2 << 8) | (imm2 << 6) | imm3);
+        }
+
+        // Formats up instructions of the pattern:
+        //    111111111B11aaaa:bbbb222SA2C2cccc
+        // Where 1s in the pattern come from op1, 2s in the pattern come from op2, S is the provided size bit.
+        // Operands provide 5 bit values of the form Aaaaa, Bbbbb, Ccccc.
+        ALWAYS_INLINE void vfpOp(OpcodeID1 op1, OpcodeID2 op2, bool size, VFPOperand a, VFPOperand b, VFPOperand c)
+        {
+            ASSERT(!(op1 & 0x004f));
+            ASSERT(!(op2 & 0xf1af));
+            m_buffer.putShort(op1 | b.bits1() << 6 | a.bits4());
+            m_buffer.putShort(op2 | b.bits4() << 12 | size << 8 | a.bits1() << 7 | c.bits1() << 5 | c.bits4());
+        }
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        // (i.e. +/-(0..255) 32-bit words)
+        ALWAYS_INLINE void vfpMemOp(OpcodeID1 op1, OpcodeID2 op2, bool size, RegisterID rn, VFPOperand rd, int32_t imm)
+        {
+            bool up = true;
+            if (imm < 0) {
+                imm = -imm;
+                up = false;
+            }
+            
+            uint32_t offset = imm;
+            ASSERT(!(offset & ~0x3fc));
+            offset >>= 2;
+
+            m_buffer.putShort(op1 | (up << 7) | rd.bits1() << 6 | rn);
+            m_buffer.putShort(op2 | rd.bits4() << 12 | size << 8 | offset);
+        }
+
+        // Administrative methods:
+
+        size_t codeSize() const { return m_buffer.codeSize(); }
+        AssemblerLabel label() const { return m_buffer.label(); }
+        bool isAligned(int alignment) const { return m_buffer.isAligned(alignment); }
+        void* data() const { return m_buffer.data(); }
+
+        unsigned debugOffset() { return m_buffer.debugOffset(); }
+
+        AssemblerBuffer m_buffer;
+    } m_formatter;
+
+    Vector<LinkRecord, 0, UnsafeVectorOverflow> m_jumpsToLink;
+    int m_indexOfLastWatchpoint;
+    int m_indexOfTailOfLastWatchpoint;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
diff --git a/assembler/AbortReason.h b/assembler/AbortReason.h
new file mode 100644
index 0000000..32ae086
--- /dev/null
+++ b/assembler/AbortReason.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+// It's important to not change the values of existing abort reasons unless we really
+// have to. For this reason there is a BASIC-style numbering that should allow us to
+// sneak new reasons in without changing the numbering of existing reasons - at least
+// for a while.
+enum AbortReason {
+    AHCallFrameMisaligned                             =  10,
+    AHIndexingTypeIsValid                             =  20,
+    AHInsaneArgumentCount                             =  30,
+    AHIsNotCell                                       =  40,
+    AHIsNotInt32                                      =  50,
+    AHIsNotJSDouble                                   =  60,
+    AHIsNotJSInt32                                    =  70,
+    AHIsNotJSNumber                                   =  80,
+    AHIsNotNull                                       =  90,
+    AHStackPointerMisaligned                          = 100,
+    AHStructureIDIsValid                              = 110,
+    AHTagMaskNotInPlace                               = 120,
+    AHTagTypeNumberNotInPlace                         = 130,
+    AHTypeInfoInlineTypeFlagsAreValid                 = 140,
+    AHTypeInfoIsValid                                 = 150,
+    B3Oops                                            = 155,
+    DFGBailedAtTopOfBlock                             = 161,
+    DFGBailedAtEndOfNode                              = 162,
+    DFGBasicStorageAllocatorZeroSize                  = 170,
+    DFGIsNotCell                                      = 180,
+    DFGIneffectiveWatchpoint                          = 190,
+    DFGNegativeStringLength                           = 200,
+    DFGSlowPathGeneratorFellThrough                   = 210,
+    DFGUnreachableBasicBlock                          = 220,
+    DFGUnreachableNode                                = 225,
+    DFGUnreasonableOSREntryJumpDestination            = 230,
+    DFGVarargsThrowingPathDidNotThrow                 = 235,
+    FTLCrash                                          = 236,
+    JITDidReturnFromTailCall                          = 237,
+    JITDivOperandsAreNotNumbers                       = 240,
+    JITGetByValResultIsNotEmpty                       = 250,
+    JITNotSupported                                   = 260,
+    JITOffsetIsNotOutOfLine                           = 270,
+    JITUncoughtExceptionAfterCall                     = 275,
+    JITUnexpectedCallFrameSize                        = 277,
+    JITUnreasonableLoopHintJumpTarget                 = 280,
+    RPWUnreasonableJumpTarget                         = 290,
+    RepatchIneffectiveWatchpoint                      = 300,
+    RepatchInsaneArgumentCount                        = 310,
+    TGInvalidPointer                                  = 320,
+    TGNotSupported                                    = 330,
+    YARRNoInputConsumed                               = 340,
+};
+
+} // namespace JSC
diff --git a/assembler/AbstractMacroAssembler.h b/assembler/AbstractMacroAssembler.h
new file mode 100644
index 0000000..37b21d8
--- /dev/null
+++ b/assembler/AbstractMacroAssembler.h
@@ -0,0 +1,1121 @@
+/*
+ * Copyright (C) 2008, 2012, 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "AbortReason.h"
+#include "AssemblerBuffer.h"
+#include "AssemblerCommon.h"
+#include "CPU.h"
+#include "CodeLocation.h"
+#include "MacroAssemblerCodeRef.h"
+#include "MacroAssemblerHelpers.h"
+#include "Options.h"
+#include <wtf/CryptographicallyRandomNumber.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/SharedTask.h>
+#include <wtf/WeakRandom.h>
+
+namespace JSC {
+
+#if ENABLE(ASSEMBLER)
+
+class AllowMacroScratchRegisterUsage;
+class DisallowMacroScratchRegisterUsage;
+class LinkBuffer;
+class Watchpoint;
+namespace DFG {
+struct OSRExit;
+}
+
+template <class AssemblerType, class MacroAssemblerType>
+class AbstractMacroAssembler {
+public:
+    typedef AbstractMacroAssembler<AssemblerType, MacroAssemblerType> AbstractMacroAssemblerType;
+    typedef AssemblerType AssemblerType_T;
+
+    typedef MacroAssemblerCodePtr CodePtr;
+    typedef MacroAssemblerCodeRef CodeRef;
+
+    class Jump;
+
+    typedef typename AssemblerType::RegisterID RegisterID;
+    typedef typename AssemblerType::FPRegisterID FPRegisterID;
+    
+    static constexpr RegisterID firstRegister() { return AssemblerType::firstRegister(); }
+    static constexpr RegisterID lastRegister() { return AssemblerType::lastRegister(); }
+
+    static constexpr FPRegisterID firstFPRegister() { return AssemblerType::firstFPRegister(); }
+    static constexpr FPRegisterID lastFPRegister() { return AssemblerType::lastFPRegister(); }
+
+    // Section 1: MacroAssembler operand types
+    //
+    // The following types are used as operands to MacroAssembler operations,
+    // describing immediate  and memory operands to the instructions to be planted.
+
+    enum Scale {
+        TimesOne,
+        TimesTwo,
+        TimesFour,
+        TimesEight,
+    };
+    
+    static Scale timesPtr()
+    {
+        if (sizeof(void*) == 4)
+            return TimesFour;
+        return TimesEight;
+    }
+    
+    struct BaseIndex;
+    
+    // Address:
+    //
+    // Describes a simple base-offset address.
+    struct Address {
+        explicit Address(RegisterID base, int32_t offset = 0)
+            : base(base)
+            , offset(offset)
+        {
+        }
+        
+        Address withOffset(int32_t additionalOffset)
+        {
+            return Address(base, offset + additionalOffset);
+        }
+        
+        BaseIndex indexedBy(RegisterID index, Scale) const;
+        
+        RegisterID base;
+        int32_t offset;
+    };
+
+    struct ExtendedAddress {
+        explicit ExtendedAddress(RegisterID base, intptr_t offset = 0)
+            : base(base)
+            , offset(offset)
+        {
+        }
+        
+        RegisterID base;
+        intptr_t offset;
+    };
+
+    // ImplicitAddress:
+    //
+    // This class is used for explicit 'load' and 'store' operations
+    // (as opposed to situations in which a memory operand is provided
+    // to a generic operation, such as an integer arithmetic instruction).
+    //
+    // In the case of a load (or store) operation we want to permit
+    // addresses to be implicitly constructed, e.g. the two calls:
+    //
+    //     load32(Address(addrReg), destReg);
+    //     load32(addrReg, destReg);
+    //
+    // Are equivalent, and the explicit wrapping of the Address in the former
+    // is unnecessary.
+    struct ImplicitAddress {
+        ImplicitAddress(RegisterID base)
+            : base(base)
+            , offset(0)
+        {
+        }
+
+        ImplicitAddress(Address address)
+            : base(address.base)
+            , offset(address.offset)
+        {
+        }
+
+        RegisterID base;
+        int32_t offset;
+    };
+
+    // BaseIndex:
+    //
+    // Describes a complex addressing mode.
+    struct BaseIndex {
+        BaseIndex(RegisterID base, RegisterID index, Scale scale, int32_t offset = 0)
+            : base(base)
+            , index(index)
+            , scale(scale)
+            , offset(offset)
+        {
+        }
+        
+        RegisterID base;
+        RegisterID index;
+        Scale scale;
+        int32_t offset;
+        
+        BaseIndex withOffset(int32_t additionalOffset)
+        {
+            return BaseIndex(base, index, scale, offset + additionalOffset);
+        }
+    };
+
+    // AbsoluteAddress:
+    //
+    // Describes an memory operand given by a pointer.  For regular load & store
+    // operations an unwrapped void* will be used, rather than using this.
+    struct AbsoluteAddress {
+        explicit AbsoluteAddress(const void* ptr)
+            : m_ptr(ptr)
+        {
+        }
+
+        const void* m_ptr;
+    };
+
+    // TrustedImmPtr:
+    //
+    // A pointer sized immediate operand to an instruction - this is wrapped
+    // in a class requiring explicit construction in order to differentiate
+    // from pointers used as absolute addresses to memory operations
+    struct TrustedImmPtr {
+        TrustedImmPtr() { }
+        
+        explicit TrustedImmPtr(const void* value)
+            : m_value(value)
+        {
+        }
+        
+        // This is only here so that TrustedImmPtr(0) does not confuse the C++
+        // overload handling rules.
+        explicit TrustedImmPtr(int value)
+            : m_value(0)
+        {
+            ASSERT_UNUSED(value, !value);
+        }
+
+        explicit TrustedImmPtr(size_t value)
+            : m_value(reinterpret_cast<void*>(value))
+        {
+        }
+
+        intptr_t asIntptr()
+        {
+            return reinterpret_cast<intptr_t>(m_value);
+        }
+
+        const void* m_value;
+    };
+
+    struct ImmPtr : private TrustedImmPtr
+    {
+        explicit ImmPtr(const void* value)
+            : TrustedImmPtr(value)
+        {
+        }
+
+        TrustedImmPtr asTrustedImmPtr() { return *this; }
+    };
+
+    // TrustedImm32:
+    //
+    // A 32bit immediate operand to an instruction - this is wrapped in a
+    // class requiring explicit construction in order to prevent RegisterIDs
+    // (which are implemented as an enum) from accidentally being passed as
+    // immediate values.
+    struct TrustedImm32 {
+        TrustedImm32() { }
+        
+        explicit TrustedImm32(int32_t value)
+            : m_value(value)
+        {
+        }
+
+#if !CPU(X86_64)
+        explicit TrustedImm32(TrustedImmPtr ptr)
+            : m_value(ptr.asIntptr())
+        {
+        }
+#endif
+
+        int32_t m_value;
+    };
+
+
+    struct Imm32 : private TrustedImm32 {
+        explicit Imm32(int32_t value)
+            : TrustedImm32(value)
+        {
+        }
+#if !CPU(X86_64)
+        explicit Imm32(TrustedImmPtr ptr)
+            : TrustedImm32(ptr)
+        {
+        }
+#endif
+        const TrustedImm32& asTrustedImm32() const { return *this; }
+
+    };
+    
+    // TrustedImm64:
+    //
+    // A 64bit immediate operand to an instruction - this is wrapped in a
+    // class requiring explicit construction in order to prevent RegisterIDs
+    // (which are implemented as an enum) from accidentally being passed as
+    // immediate values.
+    struct TrustedImm64 {
+        TrustedImm64() { }
+        
+        explicit TrustedImm64(int64_t value)
+            : m_value(value)
+        {
+        }
+
+#if CPU(X86_64) || CPU(ARM64)
+        explicit TrustedImm64(TrustedImmPtr ptr)
+            : m_value(ptr.asIntptr())
+        {
+        }
+#endif
+
+        int64_t m_value;
+    };
+
+    struct Imm64 : private TrustedImm64
+    {
+        explicit Imm64(int64_t value)
+            : TrustedImm64(value)
+        {
+        }
+#if CPU(X86_64) || CPU(ARM64)
+        explicit Imm64(TrustedImmPtr ptr)
+            : TrustedImm64(ptr)
+        {
+        }
+#endif
+        const TrustedImm64& asTrustedImm64() const { return *this; }
+    };
+    
+    // Section 2: MacroAssembler code buffer handles
+    //
+    // The following types are used to reference items in the code buffer
+    // during JIT code generation.  For example, the type Jump is used to
+    // track the location of a jump instruction so that it may later be
+    // linked to a label marking its destination.
+
+
+    // Label:
+    //
+    // A Label records a point in the generated instruction stream, typically such that
+    // it may be used as a destination for a jump.
+    class Label {
+        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend struct DFG::OSRExit;
+        friend class Jump;
+        friend class MacroAssemblerCodeRef;
+        friend class LinkBuffer;
+        friend class Watchpoint;
+
+    public:
+        Label()
+        {
+        }
+
+        Label(AbstractMacroAssemblerType* masm)
+            : m_label(masm->m_assembler.label())
+        {
+            masm->invalidateAllTempRegisters();
+        }
+
+        bool operator==(const Label& other) const { return m_label == other.m_label; }
+
+        bool isSet() const { return m_label.isSet(); }
+    private:
+        AssemblerLabel m_label;
+    };
+    
+    // ConvertibleLoadLabel:
+    //
+    // A ConvertibleLoadLabel records a loadPtr instruction that can be patched to an addPtr
+    // so that:
+    //
+    // loadPtr(Address(a, i), b)
+    //
+    // becomes:
+    //
+    // addPtr(TrustedImmPtr(i), a, b)
+    class ConvertibleLoadLabel {
+        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class LinkBuffer;
+        
+    public:
+        ConvertibleLoadLabel()
+        {
+        }
+        
+        ConvertibleLoadLabel(AbstractMacroAssemblerType* masm)
+            : m_label(masm->m_assembler.labelIgnoringWatchpoints())
+        {
+        }
+        
+        bool isSet() const { return m_label.isSet(); }
+    private:
+        AssemblerLabel m_label;
+    };
+
+    // DataLabelPtr:
+    //
+    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
+    // patched after the code has been generated.
+    class DataLabelPtr {
+        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class LinkBuffer;
+    public:
+        DataLabelPtr()
+        {
+        }
+
+        DataLabelPtr(AbstractMacroAssemblerType* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+
+        bool isSet() const { return m_label.isSet(); }
+        
+    private:
+        AssemblerLabel m_label;
+    };
+
+    // DataLabel32:
+    //
+    // A DataLabel32 is used to refer to a location in the code containing a 32-bit constant to be
+    // patched after the code has been generated.
+    class DataLabel32 {
+        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class LinkBuffer;
+    public:
+        DataLabel32()
+        {
+        }
+
+        DataLabel32(AbstractMacroAssemblerType* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+
+        AssemblerLabel label() const { return m_label; }
+
+    private:
+        AssemblerLabel m_label;
+    };
+
+    // DataLabelCompact:
+    //
+    // A DataLabelCompact is used to refer to a location in the code containing a
+    // compact immediate to be patched after the code has been generated.
+    class DataLabelCompact {
+        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class LinkBuffer;
+    public:
+        DataLabelCompact()
+        {
+        }
+        
+        DataLabelCompact(AbstractMacroAssemblerType* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+
+        DataLabelCompact(AssemblerLabel label)
+            : m_label(label)
+        {
+        }
+
+        AssemblerLabel label() const { return m_label; }
+
+    private:
+        AssemblerLabel m_label;
+    };
+
+    // Call:
+    //
+    // A Call object is a reference to a call instruction that has been planted
+    // into the code buffer - it is typically used to link the call, setting the
+    // relative offset such that when executed it will call to the desired
+    // destination.
+    class Call {
+        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
+        friend class AbstractMacroAssembler;
+
+    public:
+        enum Flags {
+            None = 0x0,
+            Linkable = 0x1,
+            Near = 0x2,
+            Tail = 0x4,
+            LinkableNear = 0x3,
+            LinkableNearTail = 0x7,
+        };
+
+        Call()
+            : m_flags(None)
+        {
+        }
+        
+        Call(AssemblerLabel jmp, Flags flags)
+            : m_label(jmp)
+            , m_flags(flags)
+        {
+        }
+
+        bool isFlagSet(Flags flag)
+        {
+            return m_flags & flag;
+        }
+
+        static Call fromTailJump(Jump jump)
+        {
+            return Call(jump.m_label, Linkable);
+        }
+
+        AssemblerLabel m_label;
+    private:
+        Flags m_flags;
+    };
+
+    // Jump:
+    //
+    // A jump object is a reference to a jump instruction that has been planted
+    // into the code buffer - it is typically used to link the jump, setting the
+    // relative offset such that when executed it will jump to the desired
+    // destination.
+    class Jump {
+        template<class TemplateAssemblerType, class TemplateMacroAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class Call;
+        friend struct DFG::OSRExit;
+        friend class LinkBuffer;
+    public:
+        Jump()
+        {
+        }
+        
+#if CPU(ARM_THUMB2)
+        // Fixme: this information should be stored in the instruction stream, not in the Jump object.
+        Jump(AssemblerLabel jmp, ARMv7Assembler::JumpType type = ARMv7Assembler::JumpNoCondition, ARMv7Assembler::Condition condition = ARMv7Assembler::ConditionInvalid)
+            : m_label(jmp)
+            , m_type(type)
+            , m_condition(condition)
+        {
+        }
+#elif CPU(ARM64)
+        Jump(AssemblerLabel jmp, ARM64Assembler::JumpType type = ARM64Assembler::JumpNoCondition, ARM64Assembler::Condition condition = ARM64Assembler::ConditionInvalid)
+            : m_label(jmp)
+            , m_type(type)
+            , m_condition(condition)
+        {
+        }
+
+        Jump(AssemblerLabel jmp, ARM64Assembler::JumpType type, ARM64Assembler::Condition condition, bool is64Bit, ARM64Assembler::RegisterID compareRegister)
+            : m_label(jmp)
+            , m_type(type)
+            , m_condition(condition)
+            , m_is64Bit(is64Bit)
+            , m_compareRegister(compareRegister)
+        {
+            ASSERT((type == ARM64Assembler::JumpCompareAndBranch) || (type == ARM64Assembler::JumpCompareAndBranchFixedSize));
+        }
+
+        Jump(AssemblerLabel jmp, ARM64Assembler::JumpType type, ARM64Assembler::Condition condition, unsigned bitNumber, ARM64Assembler::RegisterID compareRegister)
+            : m_label(jmp)
+            , m_type(type)
+            , m_condition(condition)
+            , m_bitNumber(bitNumber)
+            , m_compareRegister(compareRegister)
+        {
+            ASSERT((type == ARM64Assembler::JumpTestBit) || (type == ARM64Assembler::JumpTestBitFixedSize));
+        }
+#elif CPU(SH4)
+        Jump(AssemblerLabel jmp, SH4Assembler::JumpType type = SH4Assembler::JumpFar)
+            : m_label(jmp)
+            , m_type(type)
+        {
+        }
+#else
+        Jump(AssemblerLabel jmp)    
+            : m_label(jmp)
+        {
+        }
+#endif
+        
+        Label label() const
+        {
+            Label result;
+            result.m_label = m_label;
+            return result;
+        }
+
+        void link(AbstractMacroAssemblerType* masm) const
+        {
+            masm->invalidateAllTempRegisters();
+
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+            masm->checkRegisterAllocationAgainstBranchRange(m_label.m_offset, masm->debugOffset());
+#endif
+
+#if CPU(ARM_THUMB2)
+            masm->m_assembler.linkJump(m_label, masm->m_assembler.label(), m_type, m_condition);
+#elif CPU(ARM64)
+            if ((m_type == ARM64Assembler::JumpCompareAndBranch) || (m_type == ARM64Assembler::JumpCompareAndBranchFixedSize))
+                masm->m_assembler.linkJump(m_label, masm->m_assembler.label(), m_type, m_condition, m_is64Bit, m_compareRegister);
+            else if ((m_type == ARM64Assembler::JumpTestBit) || (m_type == ARM64Assembler::JumpTestBitFixedSize))
+                masm->m_assembler.linkJump(m_label, masm->m_assembler.label(), m_type, m_condition, m_bitNumber, m_compareRegister);
+            else
+                masm->m_assembler.linkJump(m_label, masm->m_assembler.label(), m_type, m_condition);
+#elif CPU(SH4)
+            masm->m_assembler.linkJump(m_label, masm->m_assembler.label(), m_type);
+#else
+            masm->m_assembler.linkJump(m_label, masm->m_assembler.label());
+#endif
+        }
+        
+        void linkTo(Label label, AbstractMacroAssemblerType* masm) const
+        {
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+            masm->checkRegisterAllocationAgainstBranchRange(label.m_label.m_offset, m_label.m_offset);
+#endif
+
+#if CPU(ARM_THUMB2)
+            masm->m_assembler.linkJump(m_label, label.m_label, m_type, m_condition);
+#elif CPU(ARM64)
+            if ((m_type == ARM64Assembler::JumpCompareAndBranch) || (m_type == ARM64Assembler::JumpCompareAndBranchFixedSize))
+                masm->m_assembler.linkJump(m_label, label.m_label, m_type, m_condition, m_is64Bit, m_compareRegister);
+            else if ((m_type == ARM64Assembler::JumpTestBit) || (m_type == ARM64Assembler::JumpTestBitFixedSize))
+                masm->m_assembler.linkJump(m_label, label.m_label, m_type, m_condition, m_bitNumber, m_compareRegister);
+            else
+                masm->m_assembler.linkJump(m_label, label.m_label, m_type, m_condition);
+#else
+            masm->m_assembler.linkJump(m_label, label.m_label);
+#endif
+        }
+
+        bool isSet() const { return m_label.isSet(); }
+
+    private:
+        AssemblerLabel m_label;
+#if CPU(ARM_THUMB2)
+        ARMv7Assembler::JumpType m_type;
+        ARMv7Assembler::Condition m_condition;
+#elif CPU(ARM64)
+        ARM64Assembler::JumpType m_type;
+        ARM64Assembler::Condition m_condition;
+        bool m_is64Bit;
+        unsigned m_bitNumber;
+        ARM64Assembler::RegisterID m_compareRegister;
+#endif
+#if CPU(SH4)
+        SH4Assembler::JumpType m_type;
+#endif
+    };
+
+    struct PatchableJump {
+        PatchableJump()
+        {
+        }
+
+        explicit PatchableJump(Jump jump)
+            : m_jump(jump)
+        {
+        }
+
+        operator Jump&() { return m_jump; }
+
+        Jump m_jump;
+    };
+
+    // JumpList:
+    //
+    // A JumpList is a set of Jump objects.
+    // All jumps in the set will be linked to the same destination.
+    class JumpList {
+    public:
+        typedef Vector<Jump, 2> JumpVector;
+        
+        JumpList() { }
+        
+        JumpList(Jump jump)
+        {
+            if (jump.isSet())
+                append(jump);
+        }
+
+        void link(AbstractMacroAssemblerType* masm) const
+        {
+            size_t size = m_jumps.size();
+            for (size_t i = 0; i < size; ++i)
+                m_jumps[i].link(masm);
+        }
+        
+        void linkTo(Label label, AbstractMacroAssemblerType* masm) const
+        {
+            size_t size = m_jumps.size();
+            for (size_t i = 0; i < size; ++i)
+                m_jumps[i].linkTo(label, masm);
+        }
+        
+        void append(Jump jump)
+        {
+            m_jumps.append(jump);
+        }
+        
+        void append(const JumpList& other)
+        {
+            m_jumps.append(other.m_jumps.begin(), other.m_jumps.size());
+        }
+
+        bool empty()
+        {
+            return !m_jumps.size();
+        }
+        
+        void clear()
+        {
+            m_jumps.clear();
+        }
+        
+        const JumpVector& jumps() const { return m_jumps; }
+
+    private:
+        JumpVector m_jumps;
+    };
+
+
+    // Section 3: Misc admin methods
+#if ENABLE(DFG_JIT)
+    Label labelIgnoringWatchpoints()
+    {
+        Label result;
+        result.m_label = m_assembler.labelIgnoringWatchpoints();
+        return result;
+    }
+#else
+    Label labelIgnoringWatchpoints()
+    {
+        return label();
+    }
+#endif
+    
+    Label label()
+    {
+        return Label(this);
+    }
+    
+    void padBeforePatch()
+    {
+        // Rely on the fact that asking for a label already does the padding.
+        (void)label();
+    }
+    
+    Label watchpointLabel()
+    {
+        Label result;
+        result.m_label = m_assembler.labelForWatchpoint();
+        return result;
+    }
+    
+    Label align()
+    {
+        m_assembler.align(16);
+        return Label(this);
+    }
+
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+    class RegisterAllocationOffset {
+    public:
+        RegisterAllocationOffset(unsigned offset)
+            : m_offset(offset)
+        {
+        }
+
+        void checkOffsets(unsigned low, unsigned high)
+        {
+            RELEASE_ASSERT_WITH_MESSAGE(!(low <= m_offset && m_offset <= high), "Unsafe branch over register allocation at instruction offset %u in jump offset range %u..%u", m_offset, low, high);
+        }
+
+    private:
+        unsigned m_offset;
+    };
+
+    void addRegisterAllocationAtOffset(unsigned offset)
+    {
+        m_registerAllocationForOffsets.append(RegisterAllocationOffset(offset));
+    }
+
+    void clearRegisterAllocationOffsets()
+    {
+        m_registerAllocationForOffsets.clear();
+    }
+
+    void checkRegisterAllocationAgainstBranchRange(unsigned offset1, unsigned offset2)
+    {
+        if (offset1 > offset2)
+            std::swap(offset1, offset2);
+
+        size_t size = m_registerAllocationForOffsets.size();
+        for (size_t i = 0; i < size; ++i)
+            m_registerAllocationForOffsets[i].checkOffsets(offset1, offset2);
+    }
+#endif
+
+    template<typename T, typename U>
+    static ptrdiff_t differenceBetween(T from, U to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    static ptrdiff_t differenceBetweenCodePtr(const MacroAssemblerCodePtr& a, const MacroAssemblerCodePtr& b)
+    {
+        return reinterpret_cast<ptrdiff_t>(b.executableAddress()) - reinterpret_cast<ptrdiff_t>(a.executableAddress());
+    }
+
+    unsigned debugOffset() { return m_assembler.debugOffset(); }
+
+    ALWAYS_INLINE static void cacheFlush(void* code, size_t size)
+    {
+        AssemblerType::cacheFlush(code, size);
+    }
+
+#if ENABLE(MASM_PROBE)
+
+    struct CPUState {
+        #define DECLARE_REGISTER(_type, _regName) \
+            _type _regName;
+        FOR_EACH_CPU_REGISTER(DECLARE_REGISTER)
+        #undef DECLARE_REGISTER
+
+        static const char* gprName(RegisterID regID)
+        {
+            switch (regID) {
+                #define DECLARE_REGISTER(_type, _regName) \
+                case RegisterID::_regName: \
+                    return #_regName;
+                FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
+                #undef DECLARE_REGISTER
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+
+        static const char* fprName(FPRegisterID regID)
+        {
+            switch (regID) {
+                #define DECLARE_REGISTER(_type, _regName) \
+                case FPRegisterID::_regName: \
+                    return #_regName;
+                FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
+                #undef DECLARE_REGISTER
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+
+        void*& gpr(RegisterID regID)
+        {
+            switch (regID) {
+                #define DECLARE_REGISTER(_type, _regName) \
+                case RegisterID::_regName: \
+                    return _regName;
+                FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
+                #undef DECLARE_REGISTER
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+
+        double& fpr(FPRegisterID regID)
+        {
+            switch (regID) {
+                #define DECLARE_REGISTER(_type, _regName) \
+                case FPRegisterID::_regName: \
+                    return _regName;
+                FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
+                #undef DECLARE_REGISTER
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+    };
+
+    struct ProbeContext;
+    typedef void (*ProbeFunction)(struct ProbeContext*);
+
+    struct ProbeContext {
+        ProbeFunction probeFunction;
+        void* arg1;
+        void* arg2;
+        CPUState cpu;
+
+        // Convenience methods:
+        void*& gpr(RegisterID regID) { return cpu.gpr(regID); }
+        double& fpr(FPRegisterID regID) { return cpu.fpr(regID); }
+        const char* gprName(RegisterID regID) { return cpu.gprName(regID); }
+        const char* fprName(FPRegisterID regID) { return cpu.fprName(regID); }
+    };
+
+    // This function emits code to preserve the CPUState (e.g. registers),
+    // call a user supplied probe function, and restore the CPUState before
+    // continuing with other JIT generated code.
+    //
+    // The user supplied probe function will be called with a single pointer to
+    // a ProbeContext struct (defined above) which contains, among other things,
+    // the preserved CPUState. This allows the user probe function to inspect
+    // the CPUState at that point in the JIT generated code.
+    //
+    // If the user probe function alters the register values in the ProbeContext,
+    // the altered values will be loaded into the CPU registers when the probe
+    // returns.
+    //
+    // The ProbeContext is stack allocated and is only valid for the duration
+    // of the call to the user probe function.
+    //
+    // Note: probe() should be implemented by the target specific MacroAssembler.
+    // This prototype is only provided here to document the interface.
+
+    void probe(ProbeFunction, void* arg1, void* arg2);
+
+#endif // ENABLE(MASM_PROBE)
+
+    AssemblerType m_assembler;
+    
+    static void linkJump(void* code, Jump jump, CodeLocationLabel target)
+    {
+        AssemblerType::linkJump(code, jump.m_label, target.dataLocation());
+    }
+
+    static void linkPointer(void* code, AssemblerLabel label, void* value)
+    {
+        AssemblerType::linkPointer(code, label, value);
+    }
+
+    static void* getLinkerAddress(void* code, AssemblerLabel label)
+    {
+        return AssemblerType::getRelocatedAddress(code, label);
+    }
+
+    static unsigned getLinkerCallReturnOffset(Call call)
+    {
+        return AssemblerType::getCallReturnOffset(call.m_label);
+    }
+
+    static void repatchJump(CodeLocationJump jump, CodeLocationLabel destination)
+    {
+        AssemblerType::relinkJump(jump.dataLocation(), destination.dataLocation());
+    }
+    
+    static void repatchJumpToNop(CodeLocationJump jump)
+    {
+        AssemblerType::relinkJumpToNop(jump.dataLocation());
+    }
+
+    static void repatchNearCall(CodeLocationNearCall nearCall, CodeLocationLabel destination)
+    {
+        switch (nearCall.callMode()) {
+        case NearCallMode::Tail:
+            AssemblerType::relinkJump(nearCall.dataLocation(), destination.dataLocation());
+            return;
+        case NearCallMode::Regular:
+            AssemblerType::relinkCall(nearCall.dataLocation(), destination.executableAddress());
+            return;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    static void repatchCompact(CodeLocationDataLabelCompact dataLabelCompact, int32_t value)
+    {
+        AssemblerType::repatchCompact(dataLabelCompact.dataLocation(), value);
+    }
+    
+    static void repatchInt32(CodeLocationDataLabel32 dataLabel32, int32_t value)
+    {
+        AssemblerType::repatchInt32(dataLabel32.dataLocation(), value);
+    }
+
+    static void repatchPointer(CodeLocationDataLabelPtr dataLabelPtr, void* value)
+    {
+        AssemblerType::repatchPointer(dataLabelPtr.dataLocation(), value);
+    }
+    
+    static void* readPointer(CodeLocationDataLabelPtr dataLabelPtr)
+    {
+        return AssemblerType::readPointer(dataLabelPtr.dataLocation());
+    }
+    
+    static void replaceWithLoad(CodeLocationConvertibleLoad label)
+    {
+        AssemblerType::replaceWithLoad(label.dataLocation());
+    }
+    
+    static void replaceWithAddressComputation(CodeLocationConvertibleLoad label)
+    {
+        AssemblerType::replaceWithAddressComputation(label.dataLocation());
+    }
+
+    template<typename Functor>
+    void addLinkTask(const Functor& functor)
+    {
+        m_linkTasks.append(createSharedTask<void(LinkBuffer&)>(functor));
+    }
+
+    void emitNops(size_t memoryToFillWithNopsInBytes)
+    {
+        AssemblerBuffer& buffer = m_assembler.buffer();
+        size_t startCodeSize = buffer.codeSize();
+        size_t targetCodeSize = startCodeSize + memoryToFillWithNopsInBytes;
+        buffer.ensureSpace(memoryToFillWithNopsInBytes);
+        bool isCopyingToExecutableMemory = false;
+        AssemblerType::fillNops(static_cast<char*>(buffer.data()) + startCodeSize, memoryToFillWithNopsInBytes, isCopyingToExecutableMemory);
+        buffer.setCodeSize(targetCodeSize);
+    }
+
+protected:
+    AbstractMacroAssembler()
+        : m_randomSource(0)
+    {
+        invalidateAllTempRegisters();
+    }
+
+    uint32_t random()
+    {
+        if (!m_randomSourceIsInitialized) {
+            m_randomSourceIsInitialized = true;
+            m_randomSource.setSeed(cryptographicallyRandomNumber());
+        }
+        return m_randomSource.getUint32();
+    }
+
+    bool m_randomSourceIsInitialized { false };
+    WeakRandom m_randomSource;
+
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+    Vector<RegisterAllocationOffset, 10> m_registerAllocationForOffsets;
+#endif
+
+    static bool haveScratchRegisterForBlinding()
+    {
+        return false;
+    }
+    static RegisterID scratchRegisterForBlinding()
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return firstRegister();
+    }
+    static bool canBlind() { return false; }
+    static bool shouldBlindForSpecificArch(uint32_t) { return false; }
+    static bool shouldBlindForSpecificArch(uint64_t) { return false; }
+
+    class CachedTempRegister {
+        friend class DataLabelPtr;
+        friend class DataLabel32;
+        friend class DataLabelCompact;
+        friend class Jump;
+        friend class Label;
+
+    public:
+        CachedTempRegister(AbstractMacroAssemblerType* masm, RegisterID registerID)
+            : m_masm(masm)
+            , m_registerID(registerID)
+            , m_value(0)
+            , m_validBit(1 << static_cast<unsigned>(registerID))
+        {
+            ASSERT(static_cast<unsigned>(registerID) < (sizeof(unsigned) * 8));
+        }
+
+        ALWAYS_INLINE RegisterID registerIDInvalidate() { invalidate(); return m_registerID; }
+
+        ALWAYS_INLINE RegisterID registerIDNoInvalidate() { return m_registerID; }
+
+        bool value(intptr_t& value)
+        {
+            value = m_value;
+            return m_masm->isTempRegisterValid(m_validBit);
+        }
+
+        void setValue(intptr_t value)
+        {
+            m_value = value;
+            m_masm->setTempRegisterValid(m_validBit);
+        }
+
+        ALWAYS_INLINE void invalidate() { m_masm->clearTempRegisterValid(m_validBit); }
+
+    private:
+        AbstractMacroAssemblerType* m_masm;
+        RegisterID m_registerID;
+        intptr_t m_value;
+        unsigned m_validBit;
+    };
+
+    ALWAYS_INLINE void invalidateAllTempRegisters()
+    {
+        m_tempRegistersValidBits = 0;
+    }
+
+    ALWAYS_INLINE bool isTempRegisterValid(unsigned registerMask)
+    {
+        return (m_tempRegistersValidBits & registerMask);
+    }
+
+    ALWAYS_INLINE void clearTempRegisterValid(unsigned registerMask)
+    {
+        m_tempRegistersValidBits &=  ~registerMask;
+    }
+
+    ALWAYS_INLINE void setTempRegisterValid(unsigned registerMask)
+    {
+        m_tempRegistersValidBits |= registerMask;
+    }
+
+    friend class AllowMacroScratchRegisterUsage;
+    friend class DisallowMacroScratchRegisterUsage;
+    unsigned m_tempRegistersValidBits;
+    bool m_allowScratchRegister { true };
+
+    Vector<RefPtr<SharedTask<void(LinkBuffer&)>>> m_linkTasks;
+
+    friend class LinkBuffer;
+}; // class AbstractMacroAssembler
+
+template <class AssemblerType, class MacroAssemblerType>
+inline typename AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::BaseIndex
+AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::Address::indexedBy(
+    typename AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::RegisterID index,
+    typename AbstractMacroAssembler<AssemblerType, MacroAssemblerType>::Scale scale) const
+{
+    return BaseIndex(base, index, scale, offset);
+}
+
+#endif // ENABLE(ASSEMBLER)
+
+} // namespace JSC
diff --git a/assembler/AllowMacroScratchRegisterUsage.h b/assembler/AllowMacroScratchRegisterUsage.h
new file mode 100644
index 0000000..ed7806c
--- /dev/null
+++ b/assembler/AllowMacroScratchRegisterUsage.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "MacroAssembler.h"
+
+namespace JSC {
+
+class AllowMacroScratchRegisterUsage {
+public:
+    AllowMacroScratchRegisterUsage(MacroAssembler& masm)
+        : m_masm(masm)
+        , m_oldValueOfAllowScratchRegister(masm.m_allowScratchRegister)
+    {
+        masm.m_allowScratchRegister = true;
+    }
+
+    ~AllowMacroScratchRegisterUsage()
+    {
+        m_masm.m_allowScratchRegister = m_oldValueOfAllowScratchRegister;
+    }
+
+private:
+    MacroAssembler& m_masm;
+    bool m_oldValueOfAllowScratchRegister;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/AssemblerBuffer.h b/assembler/AssemblerBuffer.h
new file mode 100644
index 0000000..7340952
--- /dev/null
+++ b/assembler/AssemblerBuffer.h
@@ -0,0 +1,302 @@
+/*
+ * Copyright (C) 2008, 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "ExecutableAllocator.h"
+#include "JITCompilationEffort.h"
+#include "stdint.h"
+#include <string.h>
+#include <wtf/Assertions.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+    struct AssemblerLabel {
+        AssemblerLabel()
+            : m_offset(std::numeric_limits<uint32_t>::max())
+        {
+        }
+
+        explicit AssemblerLabel(uint32_t offset)
+            : m_offset(offset)
+        {
+        }
+
+        bool isSet() const { return (m_offset != std::numeric_limits<uint32_t>::max()); }
+
+        AssemblerLabel labelAtOffset(int offset) const
+        {
+            return AssemblerLabel(m_offset + offset);
+        }
+
+        bool operator==(const AssemblerLabel& other) const { return m_offset == other.m_offset; }
+
+        uint32_t m_offset;
+    };
+
+    class AssemblerData {
+        WTF_MAKE_NONCOPYABLE(AssemblerData);
+        static const size_t InlineCapacity = 128;
+    public:
+        AssemblerData()
+            : m_buffer(m_inlineBuffer)
+            , m_capacity(InlineCapacity)
+        {
+        }
+
+        AssemblerData(size_t initialCapacity)
+        {
+            if (initialCapacity <= InlineCapacity) {
+                m_capacity = InlineCapacity;
+                m_buffer = m_inlineBuffer;
+            } else {
+                m_capacity = initialCapacity;
+                m_buffer = static_cast<char*>(fastMalloc(m_capacity));
+            }
+        }
+
+        AssemblerData(AssemblerData&& other)
+        {
+            if (other.isInlineBuffer()) {
+                ASSERT(other.m_capacity == InlineCapacity);
+                memcpy(m_inlineBuffer, other.m_inlineBuffer, InlineCapacity);
+                m_buffer = m_inlineBuffer;
+            } else
+                m_buffer = other.m_buffer;
+            m_capacity = other.m_capacity;
+
+            other.m_buffer = nullptr;
+            other.m_capacity = 0;
+        }
+
+        AssemblerData& operator=(AssemblerData&& other)
+        {
+            if (m_buffer && !isInlineBuffer())
+                fastFree(m_buffer);
+
+            if (other.isInlineBuffer()) {
+                ASSERT(other.m_capacity == InlineCapacity);
+                memcpy(m_inlineBuffer, other.m_inlineBuffer, InlineCapacity);
+                m_buffer = m_inlineBuffer;
+            } else
+                m_buffer = other.m_buffer;
+            m_capacity = other.m_capacity;
+
+            other.m_buffer = nullptr;
+            other.m_capacity = 0;
+            return *this;
+        }
+
+        ~AssemblerData()
+        {
+            if (m_buffer && !isInlineBuffer())
+                fastFree(m_buffer);
+        }
+
+        char* buffer() const { return m_buffer; }
+
+        unsigned capacity() const { return m_capacity; }
+
+        void grow(unsigned extraCapacity = 0)
+        {
+            m_capacity = m_capacity + m_capacity / 2 + extraCapacity;
+            if (isInlineBuffer()) {
+                m_buffer = static_cast<char*>(fastMalloc(m_capacity));
+                memcpy(m_buffer, m_inlineBuffer, InlineCapacity);
+            } else
+                m_buffer = static_cast<char*>(fastRealloc(m_buffer, m_capacity));
+        }
+
+    private:
+        bool isInlineBuffer() const { return m_buffer == m_inlineBuffer; }
+        char* m_buffer;
+        char m_inlineBuffer[InlineCapacity];
+        unsigned m_capacity;
+    };
+
+    class AssemblerBuffer {
+    public:
+        AssemblerBuffer()
+            : m_storage()
+            , m_index(0)
+        {
+        }
+
+        bool isAvailable(unsigned space)
+        {
+            return m_index + space <= m_storage.capacity();
+        }
+
+        void ensureSpace(unsigned space)
+        {
+            while (!isAvailable(space))
+                outOfLineGrow();
+        }
+
+        bool isAligned(int alignment) const
+        {
+            return !(m_index & (alignment - 1));
+        }
+
+        void putByteUnchecked(int8_t value) { putIntegralUnchecked(value); }
+        void putByte(int8_t value) { putIntegral(value); }
+        void putShortUnchecked(int16_t value) { putIntegralUnchecked(value); }
+        void putShort(int16_t value) { putIntegral(value); }
+        void putIntUnchecked(int32_t value) { putIntegralUnchecked(value); }
+        void putInt(int32_t value) { putIntegral(value); }
+        void putInt64Unchecked(int64_t value) { putIntegralUnchecked(value); }
+        void putInt64(int64_t value) { putIntegral(value); }
+
+        void* data() const
+        {
+            return m_storage.buffer();
+        }
+
+        size_t codeSize() const
+        {
+            return m_index;
+        }
+
+        void setCodeSize(size_t index)
+        {
+            // Warning: Only use this if you know exactly what you are doing.
+            // For example, say you want 40 bytes of nops, it's ok to grow
+            // and then fill 40 bytes of nops using bigger instructions.
+            m_index = index;
+            ASSERT(m_index <= m_storage.capacity());
+        }
+
+        AssemblerLabel label() const
+        {
+            return AssemblerLabel(m_index);
+        }
+
+        unsigned debugOffset() { return m_index; }
+
+        AssemblerData&& releaseAssemblerData() { return WTFMove(m_storage); }
+
+        // LocalWriter is a trick to keep the storage buffer and the index
+        // in memory while issuing multiple Stores.
+        // It is created in a block scope and its attribute can stay live
+        // between writes.
+        //
+        // LocalWriter *CANNOT* be mixed with other types of access to AssemblerBuffer.
+        // AssemblerBuffer cannot be used until its LocalWriter goes out of scope.
+        class LocalWriter {
+        public:
+            LocalWriter(AssemblerBuffer& buffer, unsigned requiredSpace)
+                : m_buffer(buffer)
+            {
+                buffer.ensureSpace(requiredSpace);
+                m_storageBuffer = buffer.m_storage.buffer();
+                m_index = buffer.m_index;
+#if !defined(NDEBUG)
+                m_initialIndex = m_index;
+                m_requiredSpace = requiredSpace;
+#endif
+            }
+
+            ~LocalWriter()
+            {
+                ASSERT(m_index - m_initialIndex <= m_requiredSpace);
+                ASSERT(m_buffer.m_index == m_initialIndex);
+                ASSERT(m_storageBuffer == m_buffer.m_storage.buffer());
+                m_buffer.m_index = m_index;
+            }
+
+            void putByteUnchecked(int8_t value) { putIntegralUnchecked(value); }
+            void putShortUnchecked(int16_t value) { putIntegralUnchecked(value); }
+            void putIntUnchecked(int32_t value) { putIntegralUnchecked(value); }
+            void putInt64Unchecked(int64_t value) { putIntegralUnchecked(value); }
+        private:
+            template<typename IntegralType>
+            void putIntegralUnchecked(IntegralType value)
+            {
+                ASSERT(m_index + sizeof(IntegralType) <= m_buffer.m_storage.capacity());
+                *reinterpret_cast_ptr<IntegralType*>(m_storageBuffer + m_index) = value;
+                m_index += sizeof(IntegralType);
+            }
+            AssemblerBuffer& m_buffer;
+            char* m_storageBuffer;
+            unsigned m_index;
+#if !defined(NDEBUG)
+            unsigned m_initialIndex;
+            unsigned m_requiredSpace;
+#endif
+        };
+
+    protected:
+        template<typename IntegralType>
+        void putIntegral(IntegralType value)
+        {
+            unsigned nextIndex = m_index + sizeof(IntegralType);
+            if (UNLIKELY(nextIndex > m_storage.capacity()))
+                outOfLineGrow();
+            ASSERT(isAvailable(sizeof(IntegralType)));
+            *reinterpret_cast_ptr<IntegralType*>(m_storage.buffer() + m_index) = value;
+            m_index = nextIndex;
+        }
+
+        template<typename IntegralType>
+        void putIntegralUnchecked(IntegralType value)
+        {
+            ASSERT(isAvailable(sizeof(IntegralType)));
+            *reinterpret_cast_ptr<IntegralType*>(m_storage.buffer() + m_index) = value;
+            m_index += sizeof(IntegralType);
+        }
+
+        void append(const char* data, int size)
+        {
+            if (!isAvailable(size))
+                grow(size);
+
+            memcpy(m_storage.buffer() + m_index, data, size);
+            m_index += size;
+        }
+
+        void grow(int extraCapacity = 0)
+        {
+            m_storage.grow(extraCapacity);
+        }
+
+    private:
+        NEVER_INLINE void outOfLineGrow()
+        {
+            m_storage.grow();
+        }
+
+        friend LocalWriter;
+
+        AssemblerData m_storage;
+        unsigned m_index;
+    };
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/AssemblerBufferWithConstantPool.h b/assembler/AssemblerBufferWithConstantPool.h
new file mode 100644
index 0000000..3b63288
--- /dev/null
+++ b/assembler/AssemblerBufferWithConstantPool.h
@@ -0,0 +1,333 @@
+/*
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "AssemblerBuffer.h"
+#include <wtf/SegmentedVector.h>
+
+#define ASSEMBLER_HAS_CONSTANT_POOL 1
+
+namespace JSC {
+
+/*
+    On a constant pool 4 or 8 bytes data can be stored. The values can be
+    constants or addresses. The addresses should be 32 or 64 bits. The constants
+    should be double-precisions float or integer numbers which are hard to be
+    encoded as few machine instructions.
+
+    TODO: The pool is desinged to handle both 32 and 64 bits values, but
+    currently only the 4 bytes constants are implemented and tested.
+
+    The AssemblerBuffer can contain multiple constant pools. Each pool is inserted
+    into the instruction stream - protected by a jump instruction from the
+    execution flow.
+
+    The flush mechanism is called when no space remain to insert the next instruction
+    into the pool. Three values are used to determine when the constant pool itself
+    have to be inserted into the instruction stream (Assembler Buffer):
+
+    - maxPoolSize: size of the constant pool in bytes, this value cannot be
+        larger than the maximum offset of a PC relative memory load
+
+    - barrierSize: size of jump instruction in bytes which protects the
+        constant pool from execution
+
+    - maxInstructionSize: maximum length of a machine instruction in bytes
+
+    There are some callbacks which solve the target architecture specific
+    address handling:
+
+    - TYPE patchConstantPoolLoad(TYPE load, int value):
+        patch the 'load' instruction with the index of the constant in the
+        constant pool and return the patched instruction.
+
+    - void patchConstantPoolLoad(void* loadAddr, void* constPoolAddr):
+        patch the a PC relative load instruction at 'loadAddr' address with the
+        final relative offset. The offset can be computed with help of
+        'constPoolAddr' (the address of the constant pool) and index of the
+        constant (which is stored previously in the load instruction itself).
+
+    - TYPE placeConstantPoolBarrier(int size):
+        return with a constant pool barrier instruction which jumps over the
+        constant pool.
+
+    The 'put*WithConstant*' functions should be used to place a data into the
+    constant pool.
+*/
+
+template <int maxPoolSize, int barrierSize, int maxInstructionSize, class AssemblerType>
+class AssemblerBufferWithConstantPool : public AssemblerBuffer {
+    typedef SegmentedVector<uint32_t, 512> LoadOffsets;
+    using AssemblerBuffer::putIntegral;
+    using AssemblerBuffer::putIntegralUnchecked;
+public:
+    typedef struct {
+        short high;
+        short low;
+    } TwoShorts;
+
+    enum {
+        UniqueConst,
+        ReusableConst,
+        UnusedEntry,
+    };
+
+    AssemblerBufferWithConstantPool()
+        : AssemblerBuffer()
+        , m_numConsts(0)
+        , m_maxDistance(maxPoolSize)
+        , m_lastConstDelta(0)
+    {
+        m_pool = static_cast<uint32_t*>(fastMalloc(maxPoolSize));
+        m_mask = static_cast<char*>(fastMalloc(maxPoolSize / sizeof(uint32_t)));
+    }
+
+    ~AssemblerBufferWithConstantPool()
+    {
+        fastFree(m_mask);
+        fastFree(m_pool);
+    }
+
+    void ensureSpace(int space)
+    {
+        flushIfNoSpaceFor(space);
+        AssemblerBuffer::ensureSpace(space);
+    }
+
+    void ensureSpace(int insnSpace, int constSpace)
+    {
+        flushIfNoSpaceFor(insnSpace, constSpace);
+        AssemblerBuffer::ensureSpace(insnSpace);
+    }
+
+    void ensureSpaceForAnyInstruction(int amount = 1)
+    {
+        flushIfNoSpaceFor(amount * maxInstructionSize, amount * sizeof(uint64_t));
+    }
+
+    bool isAligned(int alignment)
+    {
+        flushIfNoSpaceFor(alignment);
+        return AssemblerBuffer::isAligned(alignment);
+    }
+
+    void putByteUnchecked(int value)
+    {
+        AssemblerBuffer::putByteUnchecked(value);
+        correctDeltas(1);
+    }
+
+    void putByte(int value)
+    {
+        flushIfNoSpaceFor(1);
+        AssemblerBuffer::putByte(value);
+        correctDeltas(1);
+    }
+
+    void putShortUnchecked(int value)
+    {
+        AssemblerBuffer::putShortUnchecked(value);
+        correctDeltas(2);
+    }
+
+    void putShort(int value)
+    {
+        flushIfNoSpaceFor(2);
+        AssemblerBuffer::putShort(value);
+        correctDeltas(2);
+    }
+
+    void putIntUnchecked(int value)
+    {
+        AssemblerBuffer::putIntUnchecked(value);
+        correctDeltas(4);
+    }
+
+    void putInt(int value)
+    {
+        flushIfNoSpaceFor(4);
+        AssemblerBuffer::putInt(value);
+        correctDeltas(4);
+    }
+
+    void putInt64Unchecked(int64_t value)
+    {
+        AssemblerBuffer::putInt64Unchecked(value);
+        correctDeltas(8);
+    }
+
+    void putIntegral(TwoShorts value)
+    {
+        putIntegral(value.high);
+        putIntegral(value.low);
+    }
+
+    void putIntegralUnchecked(TwoShorts value)
+    {
+        putIntegralUnchecked(value.high);
+        putIntegralUnchecked(value.low);
+    }
+
+    void putShortWithConstantInt(uint16_t insn, uint32_t constant, bool isReusable = false)
+    {
+        putIntegralWithConstantInt(insn, constant, isReusable);
+    }
+
+    void putIntWithConstantInt(uint32_t insn, uint32_t constant, bool isReusable = false)
+    {
+        putIntegralWithConstantInt(insn, constant, isReusable);
+    }
+
+    // This flushing mechanism can be called after any unconditional jumps.
+    void flushWithoutBarrier(bool isForced = false)
+    {
+        // Flush if constant pool is more than 60% full to avoid overuse of this function.
+        if (isForced || 5 * static_cast<uint32_t>(m_numConsts) > 3 * maxPoolSize / sizeof(uint32_t))
+            flushConstantPool(false);
+    }
+
+    uint32_t* poolAddress()
+    {
+        return m_pool;
+    }
+
+    int sizeOfConstantPool()
+    {
+        return m_numConsts;
+    }
+
+    void flushConstantPool(bool useBarrier = true)
+    {
+        if (!m_numConsts)
+            return;
+        int alignPool = (codeSize() + (useBarrier ? barrierSize : 0)) & (sizeof(uint64_t) - 1);
+
+        if (alignPool)
+            alignPool = sizeof(uint64_t) - alignPool;
+
+        // Callback to protect the constant pool from execution
+        if (useBarrier)
+            putIntegral(AssemblerType::placeConstantPoolBarrier(m_numConsts * sizeof(uint32_t) + alignPool));
+
+        if (alignPool) {
+            if (alignPool & 1)
+                AssemblerBuffer::putByte(AssemblerType::padForAlign8);
+            if (alignPool & 2)
+                AssemblerBuffer::putShort(AssemblerType::padForAlign16);
+            if (alignPool & 4)
+                AssemblerBuffer::putInt(AssemblerType::padForAlign32);
+        }
+
+        int constPoolOffset = codeSize();
+        append(reinterpret_cast<char*>(m_pool), m_numConsts * sizeof(uint32_t));
+
+        // Patch each PC relative load
+        for (LoadOffsets::Iterator iter = m_loadOffsets.begin(); iter != m_loadOffsets.end(); ++iter) {
+            void* loadAddr = reinterpret_cast<char*>(data()) + *iter;
+            AssemblerType::patchConstantPoolLoad(loadAddr, reinterpret_cast<char*>(data()) + constPoolOffset);
+        }
+
+        m_loadOffsets.clear();
+        m_numConsts = 0;
+    }
+
+private:
+    void correctDeltas(int insnSize)
+    {
+        m_maxDistance -= insnSize;
+        m_lastConstDelta -= insnSize;
+        if (m_lastConstDelta < 0)
+            m_lastConstDelta = 0;
+    }
+
+    void correctDeltas(int insnSize, int constSize)
+    {
+        correctDeltas(insnSize);
+
+        m_maxDistance -= m_lastConstDelta;
+        m_lastConstDelta = constSize;
+    }
+
+    template<typename IntegralType>
+    void putIntegralWithConstantInt(IntegralType insn, uint32_t constant, bool isReusable)
+    {
+        if (!m_numConsts)
+            m_maxDistance = maxPoolSize;
+        flushIfNoSpaceFor(sizeof(IntegralType), 4);
+
+        m_loadOffsets.append(codeSize());
+        if (isReusable) {
+            for (int i = 0; i < m_numConsts; ++i) {
+                if (m_mask[i] == ReusableConst && m_pool[i] == constant) {
+                    putIntegral(static_cast<IntegralType>(AssemblerType::patchConstantPoolLoad(insn, i)));
+                    correctDeltas(sizeof(IntegralType));
+                    return;
+                }
+            }
+        }
+
+        m_pool[m_numConsts] = constant;
+        m_mask[m_numConsts] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
+
+        putIntegral(static_cast<IntegralType>(AssemblerType::patchConstantPoolLoad(insn, m_numConsts)));
+        ++m_numConsts;
+
+        correctDeltas(sizeof(IntegralType), 4);
+    }
+
+    void flushIfNoSpaceFor(int nextInsnSize)
+    {
+        if (m_numConsts == 0)
+            return;
+        int lastConstDelta = m_lastConstDelta > nextInsnSize ? m_lastConstDelta - nextInsnSize : 0;
+        if ((m_maxDistance < nextInsnSize + lastConstDelta + barrierSize + (int)sizeof(uint32_t)))
+            flushConstantPool();
+    }
+
+    void flushIfNoSpaceFor(int nextInsnSize, int nextConstSize)
+    {
+        if (m_numConsts == 0)
+            return;
+        if ((m_maxDistance < nextInsnSize + m_lastConstDelta + nextConstSize + barrierSize + (int)sizeof(uint32_t)) ||
+            (m_numConsts * sizeof(uint32_t) + nextConstSize >= maxPoolSize))
+            flushConstantPool();
+    }
+
+    uint32_t* m_pool;
+    char* m_mask;
+    LoadOffsets m_loadOffsets;
+
+    int m_numConsts;
+    int m_maxDistance;
+    int m_lastConstDelta;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/AssemblerCommon.h b/assembler/AssemblerCommon.h
new file mode 100644
index 0000000..2c6cb35
--- /dev/null
+++ b/assembler/AssemblerCommon.h
@@ -0,0 +1,290 @@
+/*
+ * Copyright (C) 2012, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+ALWAYS_INLINE bool isIOS()
+{
+#if PLATFORM(IOS)
+    return true;
+#else
+    return false;
+#endif
+}
+
+ALWAYS_INLINE bool isInt9(int32_t value)
+{
+    return value == ((value << 23) >> 23);
+}
+
+template<typename Type>
+ALWAYS_INLINE bool isUInt12(Type value)
+{
+    return !(value & ~static_cast<Type>(0xfff));
+}
+
+template<int datasize>
+ALWAYS_INLINE bool isValidScaledUImm12(int32_t offset)
+{
+    int32_t maxPImm = 4095 * (datasize / 8);
+    if (offset < 0)
+        return false;
+    if (offset > maxPImm)
+        return false;
+    if (offset & ((datasize / 8) - 1))
+        return false;
+    return true;
+}
+
+ALWAYS_INLINE bool isValidSignedImm9(int32_t value)
+{
+    return isInt9(value);
+}
+
+class ARM64LogicalImmediate {
+public:
+    static ARM64LogicalImmediate create32(uint32_t value)
+    {
+        // Check for 0, -1 - these cannot be encoded.
+        if (!value || !~value)
+            return InvalidLogicalImmediate;
+
+        // First look for a 32-bit pattern, then for repeating 16-bit
+        // patterns, 8-bit, 4-bit, and finally 2-bit.
+
+        unsigned hsb, lsb;
+        bool inverted;
+        if (findBitRange<32>(value, hsb, lsb, inverted))
+            return encodeLogicalImmediate<32>(hsb, lsb, inverted);
+
+        if ((value & 0xffff) != (value >> 16))
+            return InvalidLogicalImmediate;
+        value &= 0xffff;
+
+        if (findBitRange<16>(value, hsb, lsb, inverted))
+            return encodeLogicalImmediate<16>(hsb, lsb, inverted);
+
+        if ((value & 0xff) != (value >> 8))
+            return InvalidLogicalImmediate;
+        value &= 0xff;
+
+        if (findBitRange<8>(value, hsb, lsb, inverted))
+            return encodeLogicalImmediate<8>(hsb, lsb, inverted);
+
+        if ((value & 0xf) != (value >> 4))
+            return InvalidLogicalImmediate;
+        value &= 0xf;
+
+        if (findBitRange<4>(value, hsb, lsb, inverted))
+            return encodeLogicalImmediate<4>(hsb, lsb, inverted);
+
+        if ((value & 0x3) != (value >> 2))
+            return InvalidLogicalImmediate;
+        value &= 0x3;
+
+        if (findBitRange<2>(value, hsb, lsb, inverted))
+            return encodeLogicalImmediate<2>(hsb, lsb, inverted);
+
+        return InvalidLogicalImmediate;
+    }
+
+    static ARM64LogicalImmediate create64(uint64_t value)
+    {
+        // Check for 0, -1 - these cannot be encoded.
+        if (!value || !~value)
+            return InvalidLogicalImmediate;
+
+        // Look for a contiguous bit range.
+        unsigned hsb, lsb;
+        bool inverted;
+        if (findBitRange<64>(value, hsb, lsb, inverted))
+            return encodeLogicalImmediate<64>(hsb, lsb, inverted);
+
+        // If the high & low 32 bits are equal, we can try for a 32-bit (or narrower) pattern.
+        if (static_cast<uint32_t>(value) == static_cast<uint32_t>(value >> 32))
+            return create32(static_cast<uint32_t>(value));
+        return InvalidLogicalImmediate;
+    }
+
+    int value() const
+    {
+        ASSERT(isValid());
+        return m_value;
+    }
+
+    bool isValid() const
+    {
+        return m_value != InvalidLogicalImmediate;
+    }
+
+    bool is64bit() const
+    {
+        return m_value & (1 << 12);
+    }
+
+private:
+    ARM64LogicalImmediate(int value)
+        : m_value(value)
+    {
+    }
+
+    // Generate a mask with bits in the range hsb..0 set, for example:
+    //   hsb:63 = 0xffffffffffffffff
+    //   hsb:42 = 0x000007ffffffffff
+    //   hsb: 0 = 0x0000000000000001
+    static uint64_t mask(unsigned hsb)
+    {
+        ASSERT(hsb < 64);
+        return 0xffffffffffffffffull >> (63 - hsb);
+    }
+
+    template<unsigned N>
+    static void partialHSB(uint64_t& value, unsigned&result)
+    {
+        if (value & (0xffffffffffffffffull << N)) {
+            result += N;
+            value >>= N;
+        }
+    }
+
+    // Find the bit number of the highest bit set in a non-zero value, for example:
+    //   0x8080808080808080 = hsb:63
+    //   0x0000000000000001 = hsb: 0
+    //   0x000007ffffe00000 = hsb:42
+    static unsigned highestSetBit(uint64_t value)
+    {
+        ASSERT(value);
+        unsigned hsb = 0;
+        partialHSB<32>(value, hsb);
+        partialHSB<16>(value, hsb);
+        partialHSB<8>(value, hsb);
+        partialHSB<4>(value, hsb);
+        partialHSB<2>(value, hsb);
+        partialHSB<1>(value, hsb);
+        return hsb;
+    }
+
+    // This function takes a value and a bit width, where value obeys the following constraints:
+    //   * bits outside of the width of the value must be zero.
+    //   * bits within the width of value must neither be all clear or all set.
+    // The input is inspected to detect values that consist of either two or three contiguous
+    // ranges of bits. The output range hsb..lsb will describe the second range of the value.
+    // if the range is set, inverted will be false, and if the range is clear, inverted will
+    // be true. For example (with width 8):
+    //   00001111 = hsb:3, lsb:0, inverted:false
+    //   11110000 = hsb:3, lsb:0, inverted:true
+    //   00111100 = hsb:5, lsb:2, inverted:false
+    //   11000011 = hsb:5, lsb:2, inverted:true
+    template<unsigned width>
+    static bool findBitRange(uint64_t value, unsigned& hsb, unsigned& lsb, bool& inverted)
+    {
+        ASSERT(value & mask(width - 1));
+        ASSERT(value != mask(width - 1));
+        ASSERT(!(value & ~mask(width - 1)));
+
+        // Detect cases where the top bit is set; if so, flip all the bits & set invert.
+        // This halves the number of patterns we need to look for.
+        const uint64_t msb = 1ull << (width - 1);
+        if ((inverted = (value & msb)))
+            value ^= mask(width - 1);
+
+        // Find the highest set bit in value, generate a corresponding mask & flip all
+        // bits under it.
+        hsb = highestSetBit(value);
+        value ^= mask(hsb);
+        if (!value) {
+            // If this cleared the value, then the range hsb..0 was all set.
+            lsb = 0;
+            return true;
+        }
+
+        // Try making one more mask, and flipping the bits!
+        lsb = highestSetBit(value);
+        value ^= mask(lsb);
+        if (!value) {
+            // Success - but lsb actually points to the hsb of a third range - add one
+            // to get to the lsb of the mid range.
+            ++lsb;
+            return true;
+        }
+
+        return false;
+    }
+
+    // Encodes the set of immN:immr:imms fields found in a logical immediate.
+    template<unsigned width>
+    static int encodeLogicalImmediate(unsigned hsb, unsigned lsb, bool inverted)
+    {
+        // Check width is a power of 2!
+        ASSERT(!(width & (width -1)));
+        ASSERT(width <= 64 && width >= 2);
+        ASSERT(hsb >= lsb);
+        ASSERT(hsb < width);
+
+        int immN = 0;
+        int imms = 0;
+        int immr = 0;
+
+        // For 64-bit values this is easy - just set immN to true, and imms just
+        // contains the bit number of the highest set bit of the set range. For
+        // values with narrower widths, these are encoded by a leading set of
+        // one bits, followed by a zero bit, followed by the remaining set of bits
+        // being the high bit of the range. For a 32-bit immediate there are no
+        // leading one bits, just a zero followed by a five bit number. For a
+        // 16-bit immediate there is one one bit, a zero bit, and then a four bit
+        // bit-position, etc.
+        if (width == 64)
+            immN = 1;
+        else
+            imms = 63 & ~(width + width - 1);
+
+        if (inverted) {
+            // if width is 64 & hsb is 62, then we have a value something like:
+            //   0x80000000ffffffff (in this case with lsb 32).
+            // The ror should be by 1, imms (effectively set width minus 1) is
+            // 32. Set width is full width minus cleared width.
+            immr = (width - 1) - hsb;
+            imms |= (width - ((hsb - lsb) + 1)) - 1;
+        } else {
+            // if width is 64 & hsb is 62, then we have a value something like:
+            //   0x7fffffff00000000 (in this case with lsb 32).
+            // The value is effectively rol'ed by lsb, which is equivalent to
+            // a ror by width - lsb (or 0, in the case where lsb is 0). imms
+            // is hsb - lsb.
+            immr = (width - lsb) & (width - 1);
+            imms |= hsb - lsb;
+        }
+
+        return immN << 12 | immr << 6 | imms;
+    }
+
+    static const int InvalidLogicalImmediate = -1;
+
+    int m_value;
+};
+
+} // namespace JSC.
diff --git a/assembler/CPU.h b/assembler/CPU.h
new file mode 100644
index 0000000..2d2b486
--- /dev/null
+++ b/assembler/CPU.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2008, 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Options.h"
+
+namespace JSC {
+
+inline bool isARMv7IDIVSupported()
+{
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+    return true;
+#else
+    return false;
+#endif
+}
+
+inline bool isARM64()
+{
+#if CPU(ARM64)
+    return true;
+#else
+    return false;
+#endif
+}
+
+inline bool isX86()
+{
+#if CPU(X86_64) || CPU(X86)
+    return true;
+#else
+    return false;
+#endif
+}
+
+inline bool isX86_64()
+{
+#if CPU(X86_64)
+    return true;
+#else
+    return false;
+#endif
+}
+
+inline bool optimizeForARMv7IDIVSupported()
+{
+    return isARMv7IDIVSupported() && Options::useArchitectureSpecificOptimizations();
+}
+
+inline bool optimizeForARM64()
+{
+    return isARM64() && Options::useArchitectureSpecificOptimizations();
+}
+
+inline bool optimizeForX86()
+{
+    return isX86() && Options::useArchitectureSpecificOptimizations();
+}
+
+inline bool optimizeForX86_64()
+{
+    return isX86_64() && Options::useArchitectureSpecificOptimizations();
+}
+
+} // namespace JSC
+
diff --git a/assembler/CodeLocation.h b/assembler/CodeLocation.h
new file mode 100644
index 0000000..a115ec3
--- /dev/null
+++ b/assembler/CodeLocation.h
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MacroAssemblerCodeRef.h"
+
+#if ENABLE(ASSEMBLER)
+
+namespace JSC {
+
+enum NearCallMode { Regular, Tail };
+
+class CodeLocationInstruction;
+class CodeLocationLabel;
+class CodeLocationJump;
+class CodeLocationCall;
+class CodeLocationNearCall;
+class CodeLocationDataLabelCompact;
+class CodeLocationDataLabel32;
+class CodeLocationDataLabelPtr;
+class CodeLocationConvertibleLoad;
+
+// The CodeLocation* types are all pretty much do-nothing wrappers around
+// CodePtr (or MacroAssemblerCodePtr, to give it its full name).  These
+// classes only exist to provide type-safety when linking and patching code.
+//
+// The one new piece of functionallity introduced by these classes is the
+// ability to create (or put another way, to re-discover) another CodeLocation
+// at an offset from one you already know.  When patching code to optimize it
+// we often want to patch a number of instructions that are short, fixed
+// offsets apart.  To reduce memory overhead we will only retain a pointer to
+// one of the instructions, and we will use the *AtOffset methods provided by
+// CodeLocationCommon to find the other points in the code to modify.
+class CodeLocationCommon : public MacroAssemblerCodePtr {
+public:
+    CodeLocationInstruction instructionAtOffset(int offset);
+    CodeLocationLabel labelAtOffset(int offset);
+    CodeLocationJump jumpAtOffset(int offset);
+    CodeLocationCall callAtOffset(int offset);
+    CodeLocationNearCall nearCallAtOffset(int offset, NearCallMode);
+    CodeLocationDataLabelPtr dataLabelPtrAtOffset(int offset);
+    CodeLocationDataLabel32 dataLabel32AtOffset(int offset);
+    CodeLocationDataLabelCompact dataLabelCompactAtOffset(int offset);
+    CodeLocationConvertibleLoad convertibleLoadAtOffset(int offset);
+
+protected:
+    CodeLocationCommon()
+    {
+    }
+
+    CodeLocationCommon(MacroAssemblerCodePtr location)
+        : MacroAssemblerCodePtr(location)
+    {
+    }
+};
+
+class CodeLocationInstruction : public CodeLocationCommon {
+public:
+    CodeLocationInstruction() {}
+    explicit CodeLocationInstruction(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationInstruction(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationLabel : public CodeLocationCommon {
+public:
+    CodeLocationLabel() {}
+    explicit CodeLocationLabel(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationLabel(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationJump : public CodeLocationCommon {
+public:
+    CodeLocationJump() {}
+    explicit CodeLocationJump(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationJump(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationCall : public CodeLocationCommon {
+public:
+    CodeLocationCall() {}
+    explicit CodeLocationCall(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationCall(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationNearCall : public CodeLocationCommon {
+public:
+    CodeLocationNearCall() {}
+    explicit CodeLocationNearCall(MacroAssemblerCodePtr location, NearCallMode callMode)
+        : CodeLocationCommon(location), m_callMode(callMode) { }
+    explicit CodeLocationNearCall(void* location, NearCallMode callMode)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)), m_callMode(callMode) { }
+    NearCallMode callMode() { return m_callMode; }
+private:
+    NearCallMode m_callMode = NearCallMode::Regular;
+};
+
+class CodeLocationDataLabel32 : public CodeLocationCommon {
+public:
+    CodeLocationDataLabel32() {}
+    explicit CodeLocationDataLabel32(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationDataLabel32(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationDataLabelCompact : public CodeLocationCommon {
+public:
+    CodeLocationDataLabelCompact() { }
+    explicit CodeLocationDataLabelCompact(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) { }
+    explicit CodeLocationDataLabelCompact(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) { }
+};
+
+class CodeLocationDataLabelPtr : public CodeLocationCommon {
+public:
+    CodeLocationDataLabelPtr() {}
+    explicit CodeLocationDataLabelPtr(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationDataLabelPtr(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationConvertibleLoad : public CodeLocationCommon {
+public:
+    CodeLocationConvertibleLoad() { }
+    explicit CodeLocationConvertibleLoad(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) { }
+    explicit CodeLocationConvertibleLoad(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) { }
+};
+
+inline CodeLocationInstruction CodeLocationCommon::instructionAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationInstruction(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationLabel CodeLocationCommon::labelAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationLabel(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationJump CodeLocationCommon::jumpAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationJump(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationCall CodeLocationCommon::callAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationCall(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationNearCall CodeLocationCommon::nearCallAtOffset(int offset, NearCallMode callMode)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationNearCall(reinterpret_cast<char*>(dataLocation()) + offset, callMode);
+}
+
+inline CodeLocationDataLabelPtr CodeLocationCommon::dataLabelPtrAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationDataLabelPtr(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationDataLabel32 CodeLocationCommon::dataLabel32AtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationDataLabel32(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationDataLabelCompact CodeLocationCommon::dataLabelCompactAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationDataLabelCompact(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationConvertibleLoad CodeLocationCommon::convertibleLoadAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationConvertibleLoad(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/DisallowMacroScratchRegisterUsage.h b/assembler/DisallowMacroScratchRegisterUsage.h
new file mode 100644
index 0000000..91f0389
--- /dev/null
+++ b/assembler/DisallowMacroScratchRegisterUsage.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "MacroAssembler.h"
+
+namespace JSC {
+
+class DisallowMacroScratchRegisterUsage {
+public:
+    DisallowMacroScratchRegisterUsage(MacroAssembler& masm)
+        : m_masm(masm)
+        , m_oldValueOfAllowScratchRegister(masm.m_allowScratchRegister)
+    {
+        masm.m_allowScratchRegister = false;
+    }
+
+    ~DisallowMacroScratchRegisterUsage()
+    {
+        m_masm.m_allowScratchRegister = m_oldValueOfAllowScratchRegister;
+    }
+
+private:
+    MacroAssembler& m_masm;
+    bool m_oldValueOfAllowScratchRegister;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/LinkBuffer.cpp b/assembler/LinkBuffer.cpp
new file mode 100644
index 0000000..9010967
--- /dev/null
+++ b/assembler/LinkBuffer.cpp
@@ -0,0 +1,329 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LinkBuffer.h"
+
+#if ENABLE(ASSEMBLER)
+
+#include "CodeBlock.h"
+#include "JITCode.h"
+#include "JSCInlines.h"
+#include "Options.h"
+#include "VM.h"
+#include <wtf/CompilationThread.h>
+
+namespace JSC {
+
+bool shouldDumpDisassemblyFor(CodeBlock* codeBlock)
+{
+    if (codeBlock && JITCode::isOptimizingJIT(codeBlock->jitType()) && Options::dumpDFGDisassembly())
+        return true;
+    return Options::dumpDisassembly();
+}
+
+LinkBuffer::CodeRef LinkBuffer::finalizeCodeWithoutDisassembly()
+{
+    performFinalization();
+    
+    ASSERT(m_didAllocate);
+    if (m_executableMemory)
+        return CodeRef(m_executableMemory);
+    
+    return CodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr(m_code));
+}
+
+LinkBuffer::CodeRef LinkBuffer::finalizeCodeWithDisassembly(const char* format, ...)
+{
+    CodeRef result = finalizeCodeWithoutDisassembly();
+
+    if (m_alreadyDisassembled)
+        return result;
+    
+    StringPrintStream out;
+    out.printf("Generated JIT code for ");
+    va_list argList;
+    va_start(argList, format);
+    out.vprintf(format, argList);
+    va_end(argList);
+    out.printf(":\n");
+
+    out.printf("    Code at [%p, %p):\n", result.code().executableAddress(), static_cast<char*>(result.code().executableAddress()) + result.size());
+    
+    CString header = out.toCString();
+    
+    if (Options::asyncDisassembly()) {
+        disassembleAsynchronously(header, result, m_size, "    ");
+        return result;
+    }
+    
+    dataLog(header);
+    disassemble(result.code(), m_size, "    ", WTF::dataFile());
+    
+    return result;
+}
+
+#if ENABLE(BRANCH_COMPACTION)
+static ALWAYS_INLINE void recordLinkOffsets(AssemblerData& assemblerData, int32_t regionStart, int32_t regionEnd, int32_t offset)
+{
+    int32_t ptr = regionStart / sizeof(int32_t);
+    const int32_t end = regionEnd / sizeof(int32_t);
+    int32_t* offsets = reinterpret_cast_ptr<int32_t*>(assemblerData.buffer());
+    while (ptr < end)
+        offsets[ptr++] = offset;
+}
+
+template <typename InstructionType>
+void LinkBuffer::copyCompactAndLinkCode(MacroAssembler& macroAssembler, void* ownerUID, JITCompilationEffort effort)
+{
+    allocate(macroAssembler, ownerUID, effort);
+    const size_t initialSize = macroAssembler.m_assembler.codeSize();
+    if (didFailToAllocate())
+        return;
+
+    Vector<LinkRecord, 0, UnsafeVectorOverflow>& jumpsToLink = macroAssembler.jumpsToLink();
+    m_assemblerStorage = macroAssembler.m_assembler.buffer().releaseAssemblerData();
+    uint8_t* inData = reinterpret_cast<uint8_t*>(m_assemblerStorage.buffer());
+
+    AssemblerData outBuffer(m_size);
+
+    uint8_t* outData = reinterpret_cast<uint8_t*>(outBuffer.buffer());
+    uint8_t* codeOutData = reinterpret_cast<uint8_t*>(m_code);
+
+    int readPtr = 0;
+    int writePtr = 0;
+    unsigned jumpCount = jumpsToLink.size();
+    if (m_shouldPerformBranchCompaction) {
+        for (unsigned i = 0; i < jumpCount; ++i) {
+            int offset = readPtr - writePtr;
+            ASSERT(!(offset & 1));
+                
+            // Copy the instructions from the last jump to the current one.
+            size_t regionSize = jumpsToLink[i].from() - readPtr;
+            InstructionType* copySource = reinterpret_cast_ptr<InstructionType*>(inData + readPtr);
+            InstructionType* copyEnd = reinterpret_cast_ptr<InstructionType*>(inData + readPtr + regionSize);
+            InstructionType* copyDst = reinterpret_cast_ptr<InstructionType*>(outData + writePtr);
+            ASSERT(!(regionSize % 2));
+            ASSERT(!(readPtr % 2));
+            ASSERT(!(writePtr % 2));
+            while (copySource != copyEnd)
+                *copyDst++ = *copySource++;
+            recordLinkOffsets(m_assemblerStorage, readPtr, jumpsToLink[i].from(), offset);
+            readPtr += regionSize;
+            writePtr += regionSize;
+                
+            // Calculate absolute address of the jump target, in the case of backwards
+            // branches we need to be precise, forward branches we are pessimistic
+            const uint8_t* target;
+            if (jumpsToLink[i].to() >= jumpsToLink[i].from())
+                target = codeOutData + jumpsToLink[i].to() - offset; // Compensate for what we have collapsed so far
+            else
+                target = codeOutData + jumpsToLink[i].to() - executableOffsetFor(jumpsToLink[i].to());
+                
+            JumpLinkType jumpLinkType = MacroAssembler::computeJumpType(jumpsToLink[i], codeOutData + writePtr, target);
+            // Compact branch if we can...
+            if (MacroAssembler::canCompact(jumpsToLink[i].type())) {
+                // Step back in the write stream
+                int32_t delta = MacroAssembler::jumpSizeDelta(jumpsToLink[i].type(), jumpLinkType);
+                if (delta) {
+                    writePtr -= delta;
+                    recordLinkOffsets(m_assemblerStorage, jumpsToLink[i].from() - delta, readPtr, readPtr - writePtr);
+                }
+            }
+            jumpsToLink[i].setFrom(writePtr);
+        }
+    } else {
+        if (!ASSERT_DISABLED) {
+            for (unsigned i = 0; i < jumpCount; ++i)
+                ASSERT(!MacroAssembler::canCompact(jumpsToLink[i].type()));
+        }
+    }
+    // Copy everything after the last jump
+    memcpy(outData + writePtr, inData + readPtr, initialSize - readPtr);
+    recordLinkOffsets(m_assemblerStorage, readPtr, initialSize, readPtr - writePtr);
+        
+    for (unsigned i = 0; i < jumpCount; ++i) {
+        uint8_t* location = codeOutData + jumpsToLink[i].from();
+        uint8_t* target = codeOutData + jumpsToLink[i].to() - executableOffsetFor(jumpsToLink[i].to());
+        MacroAssembler::link(jumpsToLink[i], outData + jumpsToLink[i].from(), location, target);
+    }
+
+    jumpsToLink.clear();
+
+    size_t compactSize = writePtr + initialSize - readPtr;
+    if (m_executableMemory) {
+        m_size = compactSize;
+        m_executableMemory->shrink(m_size);
+    } else {
+        size_t nopSizeInBytes = initialSize - compactSize;
+        bool isCopyingToExecutableMemory = false;
+        MacroAssembler::AssemblerType_T::fillNops(outData + compactSize, nopSizeInBytes, isCopyingToExecutableMemory);
+    }
+
+    performJITMemcpy(m_code, outData, m_size);
+
+#if DUMP_LINK_STATISTICS
+    dumpLinkStatistics(m_code, initialSize, m_size);
+#endif
+#if DUMP_CODE
+    dumpCode(m_code, m_size);
+#endif
+}
+#endif
+
+
+void LinkBuffer::linkCode(MacroAssembler& macroAssembler, void* ownerUID, JITCompilationEffort effort)
+{
+#if !ENABLE(BRANCH_COMPACTION)
+#if defined(ASSEMBLER_HAS_CONSTANT_POOL) && ASSEMBLER_HAS_CONSTANT_POOL
+    macroAssembler.m_assembler.buffer().flushConstantPool(false);
+#endif
+    allocate(macroAssembler, ownerUID, effort);
+    if (!m_didAllocate)
+        return;
+    ASSERT(m_code);
+    AssemblerBuffer& buffer = macroAssembler.m_assembler.buffer();
+#if CPU(ARM_TRADITIONAL)
+    macroAssembler.m_assembler.prepareExecutableCopy(m_code);
+#endif
+    performJITMemcpy(m_code, buffer.data(), buffer.codeSize());
+#if CPU(MIPS)
+    macroAssembler.m_assembler.relocateJumps(buffer.data(), m_code);
+#endif
+#elif CPU(ARM_THUMB2)
+    copyCompactAndLinkCode<uint16_t>(macroAssembler, ownerUID, effort);
+#elif CPU(ARM64)
+    copyCompactAndLinkCode<uint32_t>(macroAssembler, ownerUID, effort);
+#endif // !ENABLE(BRANCH_COMPACTION)
+
+    m_linkTasks = WTFMove(macroAssembler.m_linkTasks);
+}
+
+void LinkBuffer::allocate(MacroAssembler& macroAssembler, void* ownerUID, JITCompilationEffort effort)
+{
+    size_t initialSize = macroAssembler.m_assembler.codeSize();
+    if (m_code) {
+        if (initialSize > m_size)
+            return;
+        
+        size_t nopsToFillInBytes = m_size - initialSize;
+        macroAssembler.emitNops(nopsToFillInBytes);
+        m_didAllocate = true;
+        return;
+    }
+    
+    ASSERT(m_vm != nullptr);
+    m_executableMemory = m_vm->executableAllocator.allocate(*m_vm, initialSize, ownerUID, effort);
+    if (!m_executableMemory)
+        return;
+    m_code = m_executableMemory->start();
+    m_size = initialSize;
+    m_didAllocate = true;
+}
+
+void LinkBuffer::performFinalization()
+{
+    for (auto& task : m_linkTasks)
+        task->run(*this);
+
+#ifndef NDEBUG
+    ASSERT(!isCompilationThread());
+    ASSERT(!m_completed);
+    ASSERT(isValid());
+    m_completed = true;
+#endif
+    
+    MacroAssembler::cacheFlush(code(), m_size);
+}
+
+#if DUMP_LINK_STATISTICS
+void LinkBuffer::dumpLinkStatistics(void* code, size_t initializeSize, size_t finalSize)
+{
+    static unsigned linkCount = 0;
+    static unsigned totalInitialSize = 0;
+    static unsigned totalFinalSize = 0;
+    linkCount++;
+    totalInitialSize += initialSize;
+    totalFinalSize += finalSize;
+    dataLogF("link %p: orig %u, compact %u (delta %u, %.2f%%)\n", 
+            code, static_cast<unsigned>(initialSize), static_cast<unsigned>(finalSize),
+            static_cast<unsigned>(initialSize - finalSize),
+            100.0 * (initialSize - finalSize) / initialSize);
+    dataLogF("\ttotal %u: orig %u, compact %u (delta %u, %.2f%%)\n", 
+            linkCount, totalInitialSize, totalFinalSize, totalInitialSize - totalFinalSize,
+            100.0 * (totalInitialSize - totalFinalSize) / totalInitialSize);
+}
+#endif
+
+#if DUMP_CODE
+void LinkBuffer::dumpCode(void* code, size_t size)
+{
+#if CPU(ARM_THUMB2)
+    // Dump the generated code in an asm file format that can be assembled and then disassembled
+    // for debugging purposes. For example, save this output as jit.s:
+    //   gcc -arch armv7 -c jit.s
+    //   otool -tv jit.o
+    static unsigned codeCount = 0;
+    unsigned short* tcode = static_cast<unsigned short*>(code);
+    size_t tsize = size / sizeof(short);
+    char nameBuf[128];
+    snprintf(nameBuf, sizeof(nameBuf), "_jsc_jit%u", codeCount++);
+    dataLogF("\t.syntax unified\n"
+            "\t.section\t__TEXT,__text,regular,pure_instructions\n"
+            "\t.globl\t%s\n"
+            "\t.align 2\n"
+            "\t.code 16\n"
+            "\t.thumb_func\t%s\n"
+            "# %p\n"
+            "%s:\n", nameBuf, nameBuf, code, nameBuf);
+        
+    for (unsigned i = 0; i < tsize; i++)
+        dataLogF("\t.short\t0x%x\n", tcode[i]);
+#elif CPU(ARM_TRADITIONAL)
+    //   gcc -c jit.s
+    //   objdump -D jit.o
+    static unsigned codeCount = 0;
+    unsigned int* tcode = static_cast<unsigned int*>(code);
+    size_t tsize = size / sizeof(unsigned int);
+    char nameBuf[128];
+    snprintf(nameBuf, sizeof(nameBuf), "_jsc_jit%u", codeCount++);
+    dataLogF("\t.globl\t%s\n"
+            "\t.align 4\n"
+            "\t.code 32\n"
+            "\t.text\n"
+            "# %p\n"
+            "%s:\n", nameBuf, code, nameBuf);
+
+    for (unsigned i = 0; i < tsize; i++)
+        dataLogF("\t.long\t0x%x\n", tcode[i]);
+#endif
+}
+#endif
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+
diff --git a/assembler/LinkBuffer.h b/assembler/LinkBuffer.h
new file mode 100644
index 0000000..efb26f9
--- /dev/null
+++ b/assembler/LinkBuffer.h
@@ -0,0 +1,350 @@
+/*
+ * Copyright (C) 2009, 2010, 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#define DUMP_LINK_STATISTICS 0
+#define DUMP_CODE 0
+
+#define GLOBAL_THUNK_ID reinterpret_cast<void*>(static_cast<intptr_t>(-1))
+#define REGEXP_CODE_ID reinterpret_cast<void*>(static_cast<intptr_t>(-2))
+#define CSS_CODE_ID reinterpret_cast<void*>(static_cast<intptr_t>(-3))
+
+#include "JITCompilationEffort.h"
+#include "MacroAssembler.h"
+#include <wtf/DataLog.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class CodeBlock;
+class VM;
+
+// LinkBuffer:
+//
+// This class assists in linking code generated by the macro assembler, once code generation
+// has been completed, and the code has been copied to is final location in memory.  At this
+// time pointers to labels within the code may be resolved, and relative offsets to external
+// addresses may be fixed.
+//
+// Specifically:
+//   * Jump objects may be linked to external targets,
+//   * The address of Jump objects may taken, such that it can later be relinked.
+//   * The return address of a Call may be acquired.
+//   * The address of a Label pointing into the code may be resolved.
+//   * The value referenced by a DataLabel may be set.
+//
+class LinkBuffer {
+    WTF_MAKE_NONCOPYABLE(LinkBuffer); WTF_MAKE_FAST_ALLOCATED;
+    
+    typedef MacroAssemblerCodeRef CodeRef;
+    typedef MacroAssemblerCodePtr CodePtr;
+    typedef MacroAssembler::Label Label;
+    typedef MacroAssembler::Jump Jump;
+    typedef MacroAssembler::PatchableJump PatchableJump;
+    typedef MacroAssembler::JumpList JumpList;
+    typedef MacroAssembler::Call Call;
+    typedef MacroAssembler::DataLabelCompact DataLabelCompact;
+    typedef MacroAssembler::DataLabel32 DataLabel32;
+    typedef MacroAssembler::DataLabelPtr DataLabelPtr;
+    typedef MacroAssembler::ConvertibleLoadLabel ConvertibleLoadLabel;
+#if ENABLE(BRANCH_COMPACTION)
+    typedef MacroAssembler::LinkRecord LinkRecord;
+    typedef MacroAssembler::JumpLinkType JumpLinkType;
+#endif
+
+public:
+    LinkBuffer(VM& vm, MacroAssembler& macroAssembler, void* ownerUID, JITCompilationEffort effort = JITCompilationMustSucceed)
+        : m_size(0)
+        , m_didAllocate(false)
+        , m_code(0)
+        , m_vm(&vm)
+#ifndef NDEBUG
+        , m_completed(false)
+#endif
+    {
+        linkCode(macroAssembler, ownerUID, effort);
+    }
+
+    LinkBuffer(MacroAssembler& macroAssembler, void* code, size_t size, JITCompilationEffort effort = JITCompilationMustSucceed, bool shouldPerformBranchCompaction = true)
+        : m_size(size)
+        , m_didAllocate(false)
+        , m_code(code)
+        , m_vm(0)
+#ifndef NDEBUG
+        , m_completed(false)
+#endif
+    {
+#if ENABLE(BRANCH_COMPACTION)
+        m_shouldPerformBranchCompaction = shouldPerformBranchCompaction;
+#else
+        UNUSED_PARAM(shouldPerformBranchCompaction);
+#endif
+        linkCode(macroAssembler, 0, effort);
+    }
+
+    ~LinkBuffer()
+    {
+    }
+    
+    bool didFailToAllocate() const
+    {
+        return !m_didAllocate;
+    }
+
+    bool isValid() const
+    {
+        return !didFailToAllocate();
+    }
+    
+    // These methods are used to link or set values at code generation time.
+
+    void link(Call call, FunctionPtr function)
+    {
+        ASSERT(call.isFlagSet(Call::Linkable));
+        call.m_label = applyOffset(call.m_label);
+        MacroAssembler::linkCall(code(), call, function);
+    }
+    
+    void link(Call call, CodeLocationLabel label)
+    {
+        link(call, FunctionPtr(label.executableAddress()));
+    }
+    
+    void link(Jump jump, CodeLocationLabel label)
+    {
+        jump.m_label = applyOffset(jump.m_label);
+        MacroAssembler::linkJump(code(), jump, label);
+    }
+
+    void link(const JumpList& list, CodeLocationLabel label)
+    {
+        for (const Jump& jump : list.jumps())
+            link(jump, label);
+    }
+
+    void patch(DataLabelPtr label, void* value)
+    {
+        AssemblerLabel target = applyOffset(label.m_label);
+        MacroAssembler::linkPointer(code(), target, value);
+    }
+
+    void patch(DataLabelPtr label, CodeLocationLabel value)
+    {
+        AssemblerLabel target = applyOffset(label.m_label);
+        MacroAssembler::linkPointer(code(), target, value.executableAddress());
+    }
+
+    // These methods are used to obtain handles to allow the code to be relinked / repatched later.
+    
+    CodeLocationLabel entrypoint()
+    {
+        return CodeLocationLabel(code());
+    }
+
+    CodeLocationCall locationOf(Call call)
+    {
+        ASSERT(call.isFlagSet(Call::Linkable));
+        ASSERT(!call.isFlagSet(Call::Near));
+        return CodeLocationCall(MacroAssembler::getLinkerAddress(code(), applyOffset(call.m_label)));
+    }
+
+    CodeLocationNearCall locationOfNearCall(Call call)
+    {
+        ASSERT(call.isFlagSet(Call::Linkable));
+        ASSERT(call.isFlagSet(Call::Near));
+        return CodeLocationNearCall(MacroAssembler::getLinkerAddress(code(), applyOffset(call.m_label)),
+            call.isFlagSet(Call::Tail) ? NearCallMode::Tail : NearCallMode::Regular);
+    }
+
+    CodeLocationLabel locationOf(PatchableJump jump)
+    {
+        return CodeLocationLabel(MacroAssembler::getLinkerAddress(code(), applyOffset(jump.m_jump.m_label)));
+    }
+
+    CodeLocationLabel locationOf(Label label)
+    {
+        return CodeLocationLabel(MacroAssembler::getLinkerAddress(code(), applyOffset(label.m_label)));
+    }
+
+    CodeLocationDataLabelPtr locationOf(DataLabelPtr label)
+    {
+        return CodeLocationDataLabelPtr(MacroAssembler::getLinkerAddress(code(), applyOffset(label.m_label)));
+    }
+
+    CodeLocationDataLabel32 locationOf(DataLabel32 label)
+    {
+        return CodeLocationDataLabel32(MacroAssembler::getLinkerAddress(code(), applyOffset(label.m_label)));
+    }
+    
+    CodeLocationDataLabelCompact locationOf(DataLabelCompact label)
+    {
+        return CodeLocationDataLabelCompact(MacroAssembler::getLinkerAddress(code(), applyOffset(label.m_label)));
+    }
+
+    CodeLocationConvertibleLoad locationOf(ConvertibleLoadLabel label)
+    {
+        return CodeLocationConvertibleLoad(MacroAssembler::getLinkerAddress(code(), applyOffset(label.m_label)));
+    }
+
+    // This method obtains the return address of the call, given as an offset from
+    // the start of the code.
+    unsigned returnAddressOffset(Call call)
+    {
+        call.m_label = applyOffset(call.m_label);
+        return MacroAssembler::getLinkerCallReturnOffset(call);
+    }
+
+    uint32_t offsetOf(Label label)
+    {
+        return applyOffset(label.m_label).m_offset;
+    }
+
+    unsigned offsetOf(PatchableJump jump)
+    {
+        return applyOffset(jump.m_jump.m_label).m_offset;
+    }
+
+    // Upon completion of all patching 'FINALIZE_CODE()' should be called once to
+    // complete generation of the code. Alternatively, call
+    // finalizeCodeWithoutDisassembly() directly if you have your own way of
+    // displaying disassembly.
+    
+    JS_EXPORT_PRIVATE CodeRef finalizeCodeWithoutDisassembly();
+    JS_EXPORT_PRIVATE CodeRef finalizeCodeWithDisassembly(const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
+
+    CodePtr trampolineAt(Label label)
+    {
+        return CodePtr(MacroAssembler::AssemblerType_T::getRelocatedAddress(code(), applyOffset(label.m_label)));
+    }
+
+    void* debugAddress()
+    {
+        return m_code;
+    }
+
+    size_t size() const { return m_size; }
+    
+    bool wasAlreadyDisassembled() const { return m_alreadyDisassembled; }
+    void didAlreadyDisassemble() { m_alreadyDisassembled = true; }
+
+    VM& vm() { return *m_vm; }
+
+private:
+#if ENABLE(BRANCH_COMPACTION)
+    int executableOffsetFor(int location)
+    {
+        if (!location)
+            return 0;
+        return bitwise_cast<int32_t*>(m_assemblerStorage.buffer())[location / sizeof(int32_t) - 1];
+    }
+#endif
+    
+    template <typename T> T applyOffset(T src)
+    {
+#if ENABLE(BRANCH_COMPACTION)
+        src.m_offset -= executableOffsetFor(src.m_offset);
+#endif
+        return src;
+    }
+
+    // Keep this private! - the underlying code should only be obtained externally via finalizeCode().
+    void* code()
+    {
+        return m_code;
+    }
+    
+    void allocate(MacroAssembler&, void* ownerUID, JITCompilationEffort);
+
+    JS_EXPORT_PRIVATE void linkCode(MacroAssembler&, void* ownerUID, JITCompilationEffort);
+#if ENABLE(BRANCH_COMPACTION)
+    template <typename InstructionType>
+    void copyCompactAndLinkCode(MacroAssembler&, void* ownerUID, JITCompilationEffort);
+#endif
+
+    void performFinalization();
+
+#if DUMP_LINK_STATISTICS
+    static void dumpLinkStatistics(void* code, size_t initialSize, size_t finalSize);
+#endif
+    
+#if DUMP_CODE
+    static void dumpCode(void* code, size_t);
+#endif
+    
+    RefPtr<ExecutableMemoryHandle> m_executableMemory;
+    size_t m_size;
+#if ENABLE(BRANCH_COMPACTION)
+    AssemblerData m_assemblerStorage;
+    bool m_shouldPerformBranchCompaction { true };
+#endif
+    bool m_didAllocate;
+    void* m_code;
+    VM* m_vm;
+#ifndef NDEBUG
+    bool m_completed;
+#endif
+    bool m_alreadyDisassembled { false };
+    Vector<RefPtr<SharedTask<void(LinkBuffer&)>>> m_linkTasks;
+};
+
+#define FINALIZE_CODE_IF(condition, linkBufferReference, dataLogFArgumentsForHeading)  \
+    (UNLIKELY((condition))                                              \
+     ? ((linkBufferReference).finalizeCodeWithDisassembly dataLogFArgumentsForHeading) \
+     : (linkBufferReference).finalizeCodeWithoutDisassembly())
+
+bool shouldDumpDisassemblyFor(CodeBlock*);
+
+#define FINALIZE_CODE_FOR(codeBlock, linkBufferReference, dataLogFArgumentsForHeading)  \
+    FINALIZE_CODE_IF(shouldDumpDisassemblyFor(codeBlock) || Options::asyncDisassembly(), linkBufferReference, dataLogFArgumentsForHeading)
+
+// Use this to finalize code, like so:
+//
+// CodeRef code = FINALIZE_CODE(linkBuffer, ("my super thingy number %d", number));
+//
+// Which, in disassembly mode, will print:
+//
+// Generated JIT code for my super thingy number 42:
+//     Code at [0x123456, 0x234567]:
+//         0x123456: mov $0, 0
+//         0x12345a: ret
+//
+// ... and so on.
+//
+// Note that the dataLogFArgumentsForHeading are only evaluated when dumpDisassembly
+// is true, so you can hide expensive disassembly-only computations inside there.
+
+#define FINALIZE_CODE(linkBufferReference, dataLogFArgumentsForHeading)  \
+    FINALIZE_CODE_IF(JSC::Options::asyncDisassembly() || JSC::Options::dumpDisassembly(), linkBufferReference, dataLogFArgumentsForHeading)
+
+#define FINALIZE_DFG_CODE(linkBufferReference, dataLogFArgumentsForHeading)  \
+    FINALIZE_CODE_IF(JSC::Options::asyncDisassembly() || JSC::Options::dumpDisassembly() || Options::dumpDFGDisassembly(), linkBufferReference, dataLogFArgumentsForHeading)
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/MIPSAssembler.h b/assembler/MIPSAssembler.h
new file mode 100644
index 0000000..b1c4232
--- /dev/null
+++ b/assembler/MIPSAssembler.h
@@ -0,0 +1,1097 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#include "AssemblerBuffer.h"
+#include "JITCompilationEffort.h"
+#include <wtf/Assertions.h>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+typedef uint32_t MIPSWord;
+
+namespace MIPSRegisters {
+typedef enum {
+    r0 = 0,
+    r1,
+    r2,
+    r3,
+    r4,
+    r5,
+    r6,
+    r7,
+    r8,
+    r9,
+    r10,
+    r11,
+    r12,
+    r13,
+    r14,
+    r15,
+    r16,
+    r17,
+    r18,
+    r19,
+    r20,
+    r21,
+    r22,
+    r23,
+    r24,
+    r25,
+    r26,
+    r27,
+    r28,
+    r29,
+    r30,
+    r31,
+    zero = r0,
+    at = r1,
+    v0 = r2,
+    v1 = r3,
+    a0 = r4,
+    a1 = r5,
+    a2 = r6,
+    a3 = r7,
+    t0 = r8,
+    t1 = r9,
+    t2 = r10,
+    t3 = r11,
+    t4 = r12,
+    t5 = r13,
+    t6 = r14,
+    t7 = r15,
+    s0 = r16,
+    s1 = r17,
+    s2 = r18,
+    s3 = r19,
+    s4 = r20,
+    s5 = r21,
+    s6 = r22,
+    s7 = r23,
+    t8 = r24,
+    t9 = r25,
+    k0 = r26,
+    k1 = r27,
+    gp = r28,
+    sp = r29,
+    fp = r30,
+    ra = r31
+} RegisterID;
+
+typedef enum {
+    f0,
+    f1,
+    f2,
+    f3,
+    f4,
+    f5,
+    f6,
+    f7,
+    f8,
+    f9,
+    f10,
+    f11,
+    f12,
+    f13,
+    f14,
+    f15,
+    f16,
+    f17,
+    f18,
+    f19,
+    f20,
+    f21,
+    f22,
+    f23,
+    f24,
+    f25,
+    f26,
+    f27,
+    f28,
+    f29,
+    f30,
+    f31
+} FPRegisterID;
+
+} // namespace MIPSRegisters
+
+class MIPSAssembler {
+public:
+    typedef MIPSRegisters::RegisterID RegisterID;
+    typedef MIPSRegisters::FPRegisterID FPRegisterID;
+    typedef SegmentedVector<AssemblerLabel, 64> Jumps;
+
+    static constexpr RegisterID firstRegister() { return MIPSRegisters::r0; }
+    static constexpr RegisterID lastRegister() { return MIPSRegisters::r31; }
+
+    static constexpr FPRegisterID firstFPRegister() { return MIPSRegisters::f0; }
+    static constexpr FPRegisterID lastFPRegister() { return MIPSRegisters::f31; }
+
+    MIPSAssembler()
+        : m_indexOfLastWatchpoint(INT_MIN)
+        , m_indexOfTailOfLastWatchpoint(INT_MIN)
+    {
+    }
+
+    AssemblerBuffer& buffer() { return m_buffer; }
+
+    // MIPS instruction opcode field position
+    enum {
+        OP_SH_RD = 11,
+        OP_SH_RT = 16,
+        OP_SH_RS = 21,
+        OP_SH_SHAMT = 6,
+        OP_SH_CODE = 16,
+        OP_SH_FD = 6,
+        OP_SH_FS = 11,
+        OP_SH_FT = 16
+    };
+
+    void emitInst(MIPSWord op)
+    {
+        void* oldBase = m_buffer.data();
+
+        m_buffer.putInt(op);
+
+        void* newBase = m_buffer.data();
+        if (oldBase != newBase)
+            relocateJumps(oldBase, newBase);
+    }
+
+    void nop()
+    {
+        emitInst(0x00000000);
+    }
+
+    void sync()
+    {
+        emitInst(0x0000000f);
+    }
+
+    /* Need to insert one load data delay nop for mips1.  */
+    void loadDelayNop()
+    {
+#if WTF_MIPS_ISA(1)
+        nop();
+#endif
+    }
+
+    /* Need to insert one coprocessor access delay nop for mips1.  */
+    void copDelayNop()
+    {
+#if WTF_MIPS_ISA(1)
+        nop();
+#endif
+    }
+
+    void move(RegisterID rd, RegisterID rs)
+    {
+        /* addu */
+        emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS));
+    }
+
+    /* Set an immediate value to a register.  This may generate 1 or 2
+       instructions.  */
+    void li(RegisterID dest, int imm)
+    {
+        if (imm >= -32768 && imm <= 32767)
+            addiu(dest, MIPSRegisters::zero, imm);
+        else if (imm >= 0 && imm < 65536)
+            ori(dest, MIPSRegisters::zero, imm);
+        else {
+            lui(dest, imm >> 16);
+            if (imm & 0xffff)
+                ori(dest, dest, imm);
+        }
+    }
+
+    void lui(RegisterID rt, int imm)
+    {
+        emitInst(0x3c000000 | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void clz(RegisterID rd, RegisterID rs)
+    {
+        emitInst(0x70000020 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rd << OP_SH_RT));
+    }
+
+    void addiu(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x24000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void addu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void subu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000023 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void mult(RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000018 | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void div(RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000001a | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void mfhi(RegisterID rd)
+    {
+        emitInst(0x00000010 | (rd << OP_SH_RD));
+    }
+
+    void mflo(RegisterID rd)
+    {
+        emitInst(0x00000012 | (rd << OP_SH_RD));
+    }
+
+    void mul(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+#if WTF_MIPS_ISA_AT_LEAST(32) 
+        emitInst(0x70000002 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+#else
+        mult(rs, rt);
+        mflo(rd);
+#endif
+    }
+
+    void andInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000024 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void andi(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x30000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void nor(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000027 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void orInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000025 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void ori(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x34000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void xorInsn(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x00000026 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void xori(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x38000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void slt(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000002a | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void sltu(RegisterID rd, RegisterID rs, RegisterID rt)
+    {
+        emitInst(0x0000002b | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT));
+    }
+
+    void sltiu(RegisterID rt, RegisterID rs, int imm)
+    {
+        emitInst(0x2c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void sll(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000000 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void sllv(RegisterID rd, RegisterID rt, RegisterID rs)
+    {
+        emitInst(0x00000004 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | (rs << OP_SH_RS));
+    }
+
+    void sra(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000003 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void srav(RegisterID rd, RegisterID rt, RegisterID rs)
+    {
+        emitInst(0x00000007 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | (rs << OP_SH_RS));
+    }
+
+    void srl(RegisterID rd, RegisterID rt, int shamt)
+    {
+        emitInst(0x00000002 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | ((shamt & 0x1f) << OP_SH_SHAMT));
+    }
+
+    void srlv(RegisterID rd, RegisterID rt, RegisterID rs)
+    {
+        emitInst(0x00000006 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | (rs << OP_SH_RS));
+    }
+
+    void lb(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x80000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lbu(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x90000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lw(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x8c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lwl(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x88000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lwr(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x98000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lh(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x84000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void lhu(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0x94000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+        loadDelayNop();
+    }
+
+    void sb(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0xa0000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+    }
+
+    void sh(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0xa4000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+    }
+
+    void sw(RegisterID rt, RegisterID rs, int offset)
+    {
+        emitInst(0xac000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff));
+    }
+
+    void jr(RegisterID rs)
+    {
+        emitInst(0x00000008 | (rs << OP_SH_RS));
+    }
+
+    void jalr(RegisterID rs)
+    {
+        emitInst(0x0000f809 | (rs << OP_SH_RS));
+    }
+
+    void jal()
+    {
+        emitInst(0x0c000000);
+    }
+
+    void bkpt()
+    {
+        int value = 512; /* BRK_BUG */
+        emitInst(0x0000000d | ((value & 0x3ff) << OP_SH_CODE));
+    }
+
+    void bgez(RegisterID rs, int imm)
+    {
+        emitInst(0x04010000 | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void bltz(RegisterID rs, int imm)
+    {
+        emitInst(0x04000000 | (rs << OP_SH_RS) | (imm & 0xffff));
+    }
+
+    void beq(RegisterID rs, RegisterID rt, int imm)
+    {
+        emitInst(0x10000000 | (rs << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void bne(RegisterID rs, RegisterID rt, int imm)
+    {
+        emitInst(0x14000000 | (rs << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff));
+    }
+
+    void bc1t()
+    {
+        emitInst(0x45010000);
+    }
+
+    void bc1f()
+    {
+        emitInst(0x45000000);
+    }
+
+    void appendJump()
+    {
+        m_jumps.append(m_buffer.label());
+    }
+
+    void addd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200000 | (fd << OP_SH_FD) | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+    }
+
+    void subd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200001 | (fd << OP_SH_FD) | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+    }
+
+    void muld(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200002 | (fd << OP_SH_FD) | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+    }
+
+    void divd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200003 | (fd << OP_SH_FD) | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+    }
+
+    void lwc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xc4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) | (offset & 0xffff));
+        copDelayNop();
+    }
+
+    void ldc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xd4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) | (offset & 0xffff));
+    }
+
+    void swc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xe4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) | (offset & 0xffff));
+    }
+
+    void sdc1(FPRegisterID ft, RegisterID rs, int offset)
+    {
+        emitInst(0xf4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) | (offset & 0xffff));
+    }
+
+    void mtc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44800000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void mthc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44e00000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void mfc1(RegisterID rt, FPRegisterID fs)
+    {
+        emitInst(0x44000000 | (fs << OP_SH_FS) | (rt << OP_SH_RT));
+        copDelayNop();
+    }
+
+    void sqrtd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46200004 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void absd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46200005 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void movd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46200006 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void negd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46200007 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void truncwd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x4620000d | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void cvtdw(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46800021 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void cvtds(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46000021 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void cvtwd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46200024 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void cvtsd(FPRegisterID fd, FPRegisterID fs)
+    {
+        emitInst(0x46200020 | (fd << OP_SH_FD) | (fs << OP_SH_FS));
+    }
+
+    void ceqd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200032 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cngtd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003f | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cnged(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003d | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cltd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003c | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cled(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x4620003e | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cueqd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200033 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void coled(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200036 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void coltd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200034 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void culed(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200037 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    void cultd(FPRegisterID fs, FPRegisterID ft)
+    {
+        emitInst(0x46200035 | (fs << OP_SH_FS) | (ft << OP_SH_FT));
+        copDelayNop();
+    }
+
+    // General helpers
+
+    AssemblerLabel labelIgnoringWatchpoints()
+    {
+        return m_buffer.label();
+    }
+
+    AssemblerLabel labelForWatchpoint()
+    {
+        AssemblerLabel result = m_buffer.label();
+        if (static_cast<int>(result.m_offset) != m_indexOfLastWatchpoint)
+            result = label();
+        m_indexOfLastWatchpoint = result.m_offset;
+        m_indexOfTailOfLastWatchpoint = result.m_offset + maxJumpReplacementSize();
+        return result;
+    }
+
+    AssemblerLabel label()
+    {
+        AssemblerLabel result = m_buffer.label();
+        while (UNLIKELY(static_cast<int>(result.m_offset) < m_indexOfTailOfLastWatchpoint)) {
+            nop();
+            result = m_buffer.label();
+        }
+        return result;
+    }
+
+    AssemblerLabel align(int alignment)
+    {
+        while (!m_buffer.isAligned(alignment))
+            bkpt();
+
+        return label();
+    }
+
+    static void* getRelocatedAddress(void* code, AssemblerLabel label)
+    {
+        return reinterpret_cast<void*>(reinterpret_cast<char*>(code) + label.m_offset);
+    }
+
+    static int getDifferenceBetweenLabels(AssemblerLabel a, AssemblerLabel b)
+    {
+        return b.m_offset - a.m_offset;
+    }
+
+    // Assembler admin methods:
+
+    size_t codeSize() const
+    {
+        return m_buffer.codeSize();
+    }
+
+    unsigned debugOffset() { return m_buffer.debugOffset(); }
+
+    // Assembly helpers for moving data between fp and registers.
+    void vmov(RegisterID rd1, RegisterID rd2, FPRegisterID rn)
+    {
+#if WTF_MIPS_ISA_REV(2) && WTF_MIPS_FP64
+        mfc1(rd1, rn);
+        mfhc1(rd2, rn);
+#else
+        mfc1(rd1, rn);
+        mfc1(rd2, FPRegisterID(rn + 1));
+#endif
+    }
+
+    void vmov(FPRegisterID rd, RegisterID rn1, RegisterID rn2)
+    {
+#if WTF_MIPS_ISA_REV(2) && WTF_MIPS_FP64
+        mtc1(rn1, rd);
+        mthc1(rn2, rd);
+#else
+        mtc1(rn1, rd);
+        mtc1(rn2, FPRegisterID(rd + 1));
+#endif
+    }
+
+    static unsigned getCallReturnOffset(AssemblerLabel call)
+    {
+        // The return address is after a call and a delay slot instruction
+        return call.m_offset;
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer. Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    static size_t linkDirectJump(void* code, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code));
+        size_t ops = 0;
+        int32_t slotAddr = reinterpret_cast<int>(insn) + 4;
+        int32_t toAddr = reinterpret_cast<int>(to);
+
+        if ((slotAddr & 0xf0000000) != (toAddr & 0xf0000000)) {
+            // lui
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((toAddr >> 16) & 0xffff);
+            ++insn;
+            // ori
+            *insn = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (toAddr & 0xffff);
+            ++insn;
+            // jr
+            *insn = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+            ++insn;
+            ops = 4 * sizeof(MIPSWord);
+        } else {
+            // j
+            *insn = 0x08000000 | ((toAddr & 0x0fffffff) >> 2);
+            ++insn;
+            ops = 2 * sizeof(MIPSWord);
+        }
+        // nop
+        *insn = 0x00000000;
+        return ops;
+    }
+
+    void linkJump(AssemblerLabel from, AssemblerLabel to)
+    {
+        ASSERT(to.isSet());
+        ASSERT(from.isSet());
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(m_buffer.data()) + from.m_offset);
+        MIPSWord* toPos = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(m_buffer.data()) + to.m_offset);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 2)) && !(*(insn - 3)) && !(*(insn - 5)));
+        insn = insn - 6;
+        linkWithOffset(insn, toPos);
+    }
+
+    static void linkJump(void* code, AssemblerLabel from, void* to)
+    {
+        ASSERT(from.isSet());
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 2)) && !(*(insn - 3)) && !(*(insn - 5)));
+        insn = insn - 6;
+        linkWithOffset(insn, to);
+    }
+
+    static void linkCall(void* code, AssemblerLabel from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        linkCallInternal(insn, to);
+    }
+
+    static void linkPointer(void* code, AssemblerLabel from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        *insn = (*insn & 0xffff0000) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        *insn = (*insn & 0xffff0000) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+
+        ASSERT(!(*(insn - 1)) && !(*(insn - 5)));
+        insn = insn - 6;
+        int flushSize = linkWithOffset(insn, to);
+
+        cacheFlush(insn, flushSize);
+    }
+
+    static void relinkCall(void* from, void* to)
+    {
+        void* start;
+        int size = linkCallInternal(from, to);
+        if (size == sizeof(MIPSWord))
+            start = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(from) - 2 * sizeof(MIPSWord));
+        else
+            start = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(from) - 4 * sizeof(MIPSWord));
+
+        cacheFlush(start, size);
+    }
+
+    static void repatchInt32(void* from, int32_t to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        *insn = (*insn & 0xffff0000) | ((to >> 16) & 0xffff);
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        *insn = (*insn & 0xffff0000) | (to & 0xffff);
+        insn--;
+        cacheFlush(insn, 2 * sizeof(MIPSWord));
+    }
+
+    static int32_t readInt32(void* from)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        int32_t result = (*insn & 0x0000ffff) << 16;
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        result |= *insn & 0x0000ffff;
+        return result;
+    }
+    
+    static void repatchCompact(void* where, int32_t value)
+    {
+        repatchInt32(where, value);
+    }
+
+    static void repatchPointer(void* from, void* to)
+    {
+        repatchInt32(from, reinterpret_cast<int32_t>(to));
+    }
+
+    static void* readPointer(void* from)
+    {
+        return reinterpret_cast<void*>(readInt32(from));
+    }
+
+    static void* readCallTarget(void* from)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        insn -= 4;
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        int32_t result = (*insn & 0x0000ffff) << 16;
+        insn++;
+        ASSERT((*insn & 0xfc000000) == 0x34000000); // ori
+        result |= *insn & 0x0000ffff;
+        return reinterpret_cast<void*>(result);
+    }
+
+    static void cacheFlush(void* code, size_t size)
+    {
+        intptr_t end = reinterpret_cast<intptr_t>(code) + size;
+        __builtin___clear_cache(reinterpret_cast<char*>(code), reinterpret_cast<char*>(end));
+    }
+
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return sizeof(MIPSWord) * 4;
+    }
+
+    static void revertJumpToMove(void* instructionStart, RegisterID rt, int imm)
+    {
+        MIPSWord* insn = static_cast<MIPSWord*>(instructionStart);
+        size_t codeSize = 2 * sizeof(MIPSWord);
+
+        // lui
+        *insn = 0x3c000000 | (rt << OP_SH_RT) | ((imm >> 16) & 0xffff);
+        ++insn;
+        // ori
+        *insn = 0x34000000 | (rt << OP_SH_RS) | (rt << OP_SH_RT) | (imm & 0xffff);
+        ++insn;
+        // if jr $t9
+        if (*insn == 0x03200008) {
+            *insn = 0x00000000;
+            codeSize += sizeof(MIPSWord);
+        }
+        cacheFlush(insn, codeSize);
+    }
+
+    static void replaceWithJump(void* instructionStart, void* to)
+    {
+        ASSERT(!(bitwise_cast<uintptr_t>(instructionStart) & 3));
+        ASSERT(!(bitwise_cast<uintptr_t>(to) & 3));
+        size_t ops = linkDirectJump(instructionStart, to);
+        cacheFlush(instructionStart, ops);
+    }
+
+    static void replaceWithLoad(void* instructionStart)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(instructionStart);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        insn++;
+        ASSERT((*insn & 0xfc0007ff) == 0x00000021); // addu
+        insn++;
+        *insn = 0x8c000000 | ((*insn) & 0x3ffffff); // lw
+        cacheFlush(insn, 4);
+    }
+
+    static void replaceWithAddressComputation(void* instructionStart)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(instructionStart);
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        insn++;
+        ASSERT((*insn & 0xfc0007ff) == 0x00000021); // addu
+        insn++;
+        *insn = 0x24000000 | ((*insn) & 0x3ffffff); // addiu
+        cacheFlush(insn, 4);
+    }
+
+    /* Update each jump in the buffer of newBase.  */
+    void relocateJumps(void* oldBase, void* newBase)
+    {
+        // Check each jump
+        for (Jumps::Iterator iter = m_jumps.begin(); iter != m_jumps.end(); ++iter) {
+            int pos = iter->m_offset;
+            MIPSWord* insn = reinterpret_cast<MIPSWord*>(reinterpret_cast<intptr_t>(newBase) + pos);
+            insn = insn + 2;
+            // Need to make sure we have 5 valid instructions after pos
+            if ((unsigned)pos >= m_buffer.codeSize() - 5 * sizeof(MIPSWord))
+                continue;
+
+            if ((*insn & 0xfc000000) == 0x08000000) { // j
+                int offset = *insn & 0x03ffffff;
+                int oldInsnAddress = (int)insn - (int)newBase + (int)oldBase;
+                int topFourBits = (oldInsnAddress + 4) >> 28;
+                int oldTargetAddress = (topFourBits << 28) | (offset << 2);
+                int newTargetAddress = oldTargetAddress - (int)oldBase + (int)newBase;
+                int newInsnAddress = (int)insn;
+                if (((newInsnAddress + 4) >> 28) == (newTargetAddress >> 28))
+                    *insn = 0x08000000 | ((newTargetAddress >> 2) & 0x3ffffff);
+                else {
+                    /* lui */
+                    *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+                    /* ori */
+                    *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+                    /* jr */
+                    *(insn + 2) = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+                }
+            } else if ((*insn & 0xffe00000) == 0x3c000000) { // lui
+                int high = (*insn & 0xffff) << 16;
+                int low = *(insn + 1) & 0xffff;
+                int oldTargetAddress = high | low;
+                int newTargetAddress = oldTargetAddress - (int)oldBase + (int)newBase;
+                /* lui */
+                *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+                /* ori */
+                *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+            }
+        }
+    }
+
+private:
+    static int linkWithOffset(MIPSWord* insn, void* to)
+    {
+        ASSERT((*insn & 0xfc000000) == 0x10000000 // beq
+            || (*insn & 0xfc000000) == 0x14000000 // bne
+            || (*insn & 0xffff0000) == 0x45010000 // bc1t
+            || (*insn & 0xffff0000) == 0x45000000); // bc1f
+        intptr_t diff = (reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(insn) - 4) >> 2;
+
+        if (diff < -32768 || diff > 32767 || *(insn + 2) != 0x10000003) {
+            /*
+                Convert the sequence:
+                  beq $2, $3, target
+                  nop
+                  b 1f
+                  nop
+                  nop
+                  nop
+                1:
+
+                to the new sequence if possible:
+                  bne $2, $3, 1f
+                  nop
+                  j    target
+                  nop
+                  nop
+                  nop
+                1:
+
+                OR to the new sequence:
+                  bne $2, $3, 1f
+                  nop
+                  lui $25, target >> 16
+                  ori $25, $25, target & 0xffff
+                  jr $25
+                  nop
+                1:
+
+                Note: beq/bne/bc1t/bc1f are converted to bne/beq/bc1f/bc1t.
+            */
+
+            if (*(insn + 2) == 0x10000003) {
+                if ((*insn & 0xfc000000) == 0x10000000) // beq
+                    *insn = (*insn & 0x03ff0000) | 0x14000005; // bne
+                else if ((*insn & 0xfc000000) == 0x14000000) // bne
+                    *insn = (*insn & 0x03ff0000) | 0x10000005; // beq
+                else if ((*insn & 0xffff0000) == 0x45010000) // bc1t
+                    *insn = 0x45000005; // bc1f
+                else if ((*insn & 0xffff0000) == 0x45000000) // bc1f
+                    *insn = 0x45010005; // bc1t
+                else
+                    ASSERT(0);
+            }
+
+            insn = insn + 2;
+            if ((reinterpret_cast<intptr_t>(insn) + 4) >> 28
+                == reinterpret_cast<intptr_t>(to) >> 28) {
+                *insn = 0x08000000 | ((reinterpret_cast<intptr_t>(to) >> 2) & 0x3ffffff);
+                *(insn + 1) = 0;
+                return 4 * sizeof(MIPSWord);
+            }
+
+            intptr_t newTargetAddress = reinterpret_cast<intptr_t>(to);
+            /* lui */
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((newTargetAddress >> 16) & 0xffff);
+            /* ori */
+            *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (newTargetAddress & 0xffff);
+            /* jr */
+            *(insn + 2) = 0x00000008 | (MIPSRegisters::t9 << OP_SH_RS);
+            return 5 * sizeof(MIPSWord);
+        }
+
+        *insn = (*insn & 0xffff0000) | (diff & 0xffff);
+        return sizeof(MIPSWord);
+    }
+
+    static int linkCallInternal(void* from, void* to)
+    {
+        MIPSWord* insn = reinterpret_cast<MIPSWord*>(from);
+        insn = insn - 4;
+
+        if ((*(insn + 2) & 0xfc000000) == 0x0c000000) { // jal
+            if ((reinterpret_cast<intptr_t>(from) - 4) >> 28
+                == reinterpret_cast<intptr_t>(to) >> 28) {
+                *(insn + 2) = 0x0c000000 | ((reinterpret_cast<intptr_t>(to) >> 2) & 0x3ffffff);
+                return sizeof(MIPSWord);
+            }
+
+            /* lui $25, (to >> 16) & 0xffff */
+            *insn = 0x3c000000 | (MIPSRegisters::t9 << OP_SH_RT) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+            /* ori $25, $25, to & 0xffff */
+            *(insn + 1) = 0x34000000 | (MIPSRegisters::t9 << OP_SH_RT) | (MIPSRegisters::t9 << OP_SH_RS) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+            /* jalr $25 */
+            *(insn + 2) = 0x0000f809 | (MIPSRegisters::t9 << OP_SH_RS);
+            return 3 * sizeof(MIPSWord);
+        }
+
+        ASSERT((*insn & 0xffe00000) == 0x3c000000); // lui
+        ASSERT((*(insn + 1) & 0xfc000000) == 0x34000000); // ori
+
+        /* lui */
+        *insn = (*insn & 0xffff0000) | ((reinterpret_cast<intptr_t>(to) >> 16) & 0xffff);
+        /* ori */
+        *(insn + 1) = (*(insn + 1) & 0xffff0000) | (reinterpret_cast<intptr_t>(to) & 0xffff);
+        return 2 * sizeof(MIPSWord);
+    }
+
+    AssemblerBuffer m_buffer;
+    Jumps m_jumps;
+    int m_indexOfLastWatchpoint;
+    int m_indexOfTailOfLastWatchpoint;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(MIPS)
diff --git a/assembler/MacroAssembler.cpp b/assembler/MacroAssembler.cpp
new file mode 100644
index 0000000..0cd5bcf
--- /dev/null
+++ b/assembler/MacroAssembler.cpp
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MacroAssembler.h"
+
+#if ENABLE(ASSEMBLER)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+const double MacroAssembler::twoToThe32 = (double)0x100000000ull;
+
+#if ENABLE(MASM_PROBE)
+static void stdFunctionCallback(MacroAssembler::ProbeContext* context)
+{
+    auto func = static_cast<const std::function<void (MacroAssembler::ProbeContext*)>*>(context->arg1);
+    (*func)(context);
+}
+    
+void MacroAssembler::probe(std::function<void (MacroAssembler::ProbeContext*)> func)
+{
+    probe(stdFunctionCallback, new std::function<void (MacroAssembler::ProbeContext*)>(func), 0);
+}
+#endif // ENABLE(MASM_PROBE)
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, MacroAssembler::RelationalCondition cond)
+{
+    switch (cond) {
+    case MacroAssembler::Equal:
+        out.print("Equal");
+        return;
+    case MacroAssembler::NotEqual:
+        out.print("NotEqual");
+        return;
+    case MacroAssembler::Above:
+        out.print("Above");
+        return;
+    case MacroAssembler::AboveOrEqual:
+        out.print("AboveOrEqual");
+        return;
+    case MacroAssembler::Below:
+        out.print("Below");
+        return;
+    case MacroAssembler::BelowOrEqual:
+        out.print("BelowOrEqual");
+        return;
+    case MacroAssembler::GreaterThan:
+        out.print("GreaterThan");
+        return;
+    case MacroAssembler::GreaterThanOrEqual:
+        out.print("GreaterThanOrEqual");
+        return;
+    case MacroAssembler::LessThan:
+        out.print("LessThan");
+        return;
+    case MacroAssembler::LessThanOrEqual:
+        out.print("LessThanOrEqual");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, MacroAssembler::ResultCondition cond)
+{
+    switch (cond) {
+    case MacroAssembler::Overflow:
+        out.print("Overflow");
+        return;
+    case MacroAssembler::Signed:
+        out.print("Signed");
+        return;
+    case MacroAssembler::PositiveOrZero:
+        out.print("PositiveOrZero");
+        return;
+    case MacroAssembler::Zero:
+        out.print("Zero");
+        return;
+    case MacroAssembler::NonZero:
+        out.print("NonZero");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, MacroAssembler::DoubleCondition cond)
+{
+    switch (cond) {
+    case MacroAssembler::DoubleEqual:
+        out.print("DoubleEqual");
+        return;
+    case MacroAssembler::DoubleNotEqual:
+        out.print("DoubleNotEqual");
+        return;
+    case MacroAssembler::DoubleGreaterThan:
+        out.print("DoubleGreaterThan");
+        return;
+    case MacroAssembler::DoubleGreaterThanOrEqual:
+        out.print("DoubleGreaterThanOrEqual");
+        return;
+    case MacroAssembler::DoubleLessThan:
+        out.print("DoubleLessThan");
+        return;
+    case MacroAssembler::DoubleLessThanOrEqual:
+        out.print("DoubleLessThanOrEqual");
+        return;
+    case MacroAssembler::DoubleEqualOrUnordered:
+        out.print("DoubleEqualOrUnordered");
+        return;
+    case MacroAssembler::DoubleNotEqualOrUnordered:
+        out.print("DoubleNotEqualOrUnordered");
+        return;
+    case MacroAssembler::DoubleGreaterThanOrUnordered:
+        out.print("DoubleGreaterThanOrUnordered");
+        return;
+    case MacroAssembler::DoubleGreaterThanOrEqualOrUnordered:
+        out.print("DoubleGreaterThanOrEqualOrUnordered");
+        return;
+    case MacroAssembler::DoubleLessThanOrUnordered:
+        out.print("DoubleLessThanOrUnordered");
+        return;
+    case MacroAssembler::DoubleLessThanOrEqualOrUnordered:
+        out.print("DoubleLessThanOrEqualOrUnordered");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(ASSEMBLER)
+
diff --git a/assembler/MacroAssembler.h b/assembler/MacroAssembler.h
new file mode 100644
index 0000000..526cc82
--- /dev/null
+++ b/assembler/MacroAssembler.h
@@ -0,0 +1,1813 @@
+/*
+ * Copyright (C) 2008, 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "JSCJSValue.h"
+
+#if CPU(ARM_THUMB2)
+#include "MacroAssemblerARMv7.h"
+namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; };
+
+#elif CPU(ARM64)
+#include "MacroAssemblerARM64.h"
+namespace JSC { typedef MacroAssemblerARM64 MacroAssemblerBase; };
+
+#elif CPU(ARM_TRADITIONAL)
+#include "MacroAssemblerARM.h"
+namespace JSC { typedef MacroAssemblerARM MacroAssemblerBase; };
+
+#elif CPU(MIPS)
+#include "MacroAssemblerMIPS.h"
+namespace JSC {
+typedef MacroAssemblerMIPS MacroAssemblerBase;
+};
+
+#elif CPU(X86)
+#include "MacroAssemblerX86.h"
+namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
+
+#elif CPU(X86_64)
+#include "MacroAssemblerX86_64.h"
+namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
+
+#elif CPU(SH4)
+#include "MacroAssemblerSH4.h"
+namespace JSC {
+typedef MacroAssemblerSH4 MacroAssemblerBase;
+};
+
+#else
+#error "The MacroAssembler is not supported on this platform."
+#endif
+
+#include "MacroAssemblerHelpers.h"
+
+namespace JSC {
+
+class MacroAssembler : public MacroAssemblerBase {
+public:
+
+    static constexpr RegisterID nextRegister(RegisterID reg)
+    {
+        return static_cast<RegisterID>(reg + 1);
+    }
+    
+    static constexpr FPRegisterID nextFPRegister(FPRegisterID reg)
+    {
+        return static_cast<FPRegisterID>(reg + 1);
+    }
+    
+    static constexpr unsigned numberOfRegisters()
+    {
+        return lastRegister() - firstRegister() + 1;
+    }
+    
+    static constexpr unsigned registerIndex(RegisterID reg)
+    {
+        return reg - firstRegister();
+    }
+    
+    static constexpr unsigned numberOfFPRegisters()
+    {
+        return lastFPRegister() - firstFPRegister() + 1;
+    }
+    
+    static constexpr unsigned fpRegisterIndex(FPRegisterID reg)
+    {
+        return reg - firstFPRegister();
+    }
+    
+    static constexpr unsigned registerIndex(FPRegisterID reg)
+    {
+        return fpRegisterIndex(reg) + numberOfRegisters();
+    }
+    
+    static constexpr unsigned totalNumberOfRegisters()
+    {
+        return numberOfRegisters() + numberOfFPRegisters();
+    }
+
+    using MacroAssemblerBase::pop;
+    using MacroAssemblerBase::jump;
+    using MacroAssemblerBase::branch32;
+    using MacroAssemblerBase::compare32;
+    using MacroAssemblerBase::move;
+    using MacroAssemblerBase::add32;
+    using MacroAssemblerBase::mul32;
+    using MacroAssemblerBase::and32;
+    using MacroAssemblerBase::branchAdd32;
+    using MacroAssemblerBase::branchMul32;
+#if CPU(ARM64) || CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL) || CPU(X86_64)
+    using MacroAssemblerBase::branchPtr;
+#endif
+    using MacroAssemblerBase::branchSub32;
+    using MacroAssemblerBase::lshift32;
+    using MacroAssemblerBase::or32;
+    using MacroAssemblerBase::rshift32;
+    using MacroAssemblerBase::store32;
+    using MacroAssemblerBase::sub32;
+    using MacroAssemblerBase::urshift32;
+    using MacroAssemblerBase::xor32;
+
+    static bool isPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return value == static_cast<int32_t>(value);
+    }
+
+    static const double twoToThe32; // This is super useful for some double code.
+
+    // Utilities used by the DFG JIT.
+    using MacroAssemblerBase::invert;
+    
+    static DoubleCondition invert(DoubleCondition cond)
+    {
+        switch (cond) {
+        case DoubleEqual:
+            return DoubleNotEqualOrUnordered;
+        case DoubleNotEqual:
+            return DoubleEqualOrUnordered;
+        case DoubleGreaterThan:
+            return DoubleLessThanOrEqualOrUnordered;
+        case DoubleGreaterThanOrEqual:
+            return DoubleLessThanOrUnordered;
+        case DoubleLessThan:
+            return DoubleGreaterThanOrEqualOrUnordered;
+        case DoubleLessThanOrEqual:
+            return DoubleGreaterThanOrUnordered;
+        case DoubleEqualOrUnordered:
+            return DoubleNotEqual;
+        case DoubleNotEqualOrUnordered:
+            return DoubleEqual;
+        case DoubleGreaterThanOrUnordered:
+            return DoubleLessThanOrEqual;
+        case DoubleGreaterThanOrEqualOrUnordered:
+            return DoubleLessThan;
+        case DoubleLessThanOrUnordered:
+            return DoubleGreaterThanOrEqual;
+        case DoubleLessThanOrEqualOrUnordered:
+            return DoubleGreaterThan;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return DoubleEqual; // make compiler happy
+    }
+    
+    static bool isInvertible(ResultCondition cond)
+    {
+        switch (cond) {
+        case Zero:
+        case NonZero:
+        case Signed:
+        case PositiveOrZero:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    static ResultCondition invert(ResultCondition cond)
+    {
+        switch (cond) {
+        case Zero:
+            return NonZero;
+        case NonZero:
+            return Zero;
+        case Signed:
+            return PositiveOrZero;
+        case PositiveOrZero:
+            return Signed;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return Zero; // Make compiler happy for release builds.
+        }
+    }
+
+    static RelationalCondition flip(RelationalCondition cond)
+    {
+        switch (cond) {
+        case Equal:
+        case NotEqual:
+            return cond;
+        case Above:
+            return Below;
+        case AboveOrEqual:
+            return BelowOrEqual;
+        case Below:
+            return Above;
+        case BelowOrEqual:
+            return AboveOrEqual;
+        case GreaterThan:
+            return LessThan;
+        case GreaterThanOrEqual:
+            return LessThanOrEqual;
+        case LessThan:
+            return GreaterThan;
+        case LessThanOrEqual:
+            return GreaterThanOrEqual;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return Equal;
+    }
+
+    static bool isSigned(RelationalCondition cond)
+    {
+        return MacroAssemblerHelpers::isSigned<MacroAssembler>(cond);
+    }
+
+    static bool isUnsigned(RelationalCondition cond)
+    {
+        return MacroAssemblerHelpers::isUnsigned<MacroAssembler>(cond);
+    }
+
+    static bool isSigned(ResultCondition cond)
+    {
+        return MacroAssemblerHelpers::isSigned<MacroAssembler>(cond);
+    }
+
+    static bool isUnsigned(ResultCondition cond)
+    {
+        return MacroAssemblerHelpers::isUnsigned<MacroAssembler>(cond);
+    }
+
+    // Platform agnostic convenience functions,
+    // described in terms of other macro assembly methods.
+    void pop()
+    {
+        addPtr(TrustedImm32(sizeof(void*)), stackPointerRegister);
+    }
+    
+    void peek(RegisterID dest, int index = 0)
+    {
+        loadPtr(Address(stackPointerRegister, (index * sizeof(void*))), dest);
+    }
+
+    Address addressForPoke(int index)
+    {
+        return Address(stackPointerRegister, (index * sizeof(void*)));
+    }
+    
+    void poke(RegisterID src, int index = 0)
+    {
+        storePtr(src, addressForPoke(index));
+    }
+
+    void poke(TrustedImm32 value, int index = 0)
+    {
+        store32(value, addressForPoke(index));
+    }
+
+    void poke(TrustedImmPtr imm, int index = 0)
+    {
+        storePtr(imm, addressForPoke(index));
+    }
+
+#if !CPU(ARM64)
+    void pushToSave(RegisterID src)
+    {
+        push(src);
+    }
+    void pushToSaveImmediateWithoutTouchingRegisters(TrustedImm32 imm)
+    {
+        push(imm);
+    }
+    void popToRestore(RegisterID dest)
+    {
+        pop(dest);
+    }
+    void pushToSave(FPRegisterID src)
+    {
+        subPtr(TrustedImm32(sizeof(double)), stackPointerRegister);
+        storeDouble(src, stackPointerRegister);
+    }
+    void popToRestore(FPRegisterID dest)
+    {
+        loadDouble(stackPointerRegister, dest);
+        addPtr(TrustedImm32(sizeof(double)), stackPointerRegister);
+    }
+    
+    static ptrdiff_t pushToSaveByteOffset() { return sizeof(void*); }
+#endif // !CPU(ARM64)
+
+#if CPU(X86_64) || CPU(ARM64)
+    void peek64(RegisterID dest, int index = 0)
+    {
+        load64(Address(stackPointerRegister, (index * sizeof(void*))), dest);
+    }
+
+    void poke(TrustedImm64 value, int index = 0)
+    {
+        store64(value, addressForPoke(index));
+    }
+
+    void poke64(RegisterID src, int index = 0)
+    {
+        store64(src, addressForPoke(index));
+    }
+#endif
+    
+#if CPU(MIPS)
+    void poke(FPRegisterID src, int index = 0)
+    {
+        ASSERT(!(index & 1));
+        storeDouble(src, addressForPoke(index));
+    }
+#endif
+
+    // Immediate shifts only have 5 controllable bits
+    // so we'll consider them safe for now.
+    TrustedImm32 trustedImm32ForShift(Imm32 imm)
+    {
+        return TrustedImm32(imm.asTrustedImm32().m_value & 31);
+    }
+
+    // Backwards banches, these are currently all implemented using existing forwards branch mechanisms.
+    void branchPtr(RelationalCondition cond, RegisterID op1, TrustedImmPtr imm, Label target)
+    {
+        branchPtr(cond, op1, imm).linkTo(target, this);
+    }
+    void branchPtr(RelationalCondition cond, RegisterID op1, ImmPtr imm, Label target)
+    {
+        branchPtr(cond, op1, imm).linkTo(target, this);
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, AbsoluteAddress right)
+    {
+        return branch32(flip(cond), right, left);
+    }
+
+    void branch32(RelationalCondition cond, RegisterID op1, RegisterID op2, Label target)
+    {
+        branch32(cond, op1, op2).linkTo(target, this);
+    }
+
+    void branch32(RelationalCondition cond, RegisterID op1, TrustedImm32 imm, Label target)
+    {
+        branch32(cond, op1, imm).linkTo(target, this);
+    }
+    
+    void branch32(RelationalCondition cond, RegisterID op1, Imm32 imm, Label target)
+    {
+        branch32(cond, op1, imm).linkTo(target, this);
+    }
+
+    void branch32(RelationalCondition cond, RegisterID left, Address right, Label target)
+    {
+        branch32(cond, left, right).linkTo(target, this);
+    }
+
+    Jump branch32(RelationalCondition cond, TrustedImm32 left, RegisterID right)
+    {
+        return branch32(commute(cond), right, left);
+    }
+
+    Jump branch32(RelationalCondition cond, Imm32 left, RegisterID right)
+    {
+        return branch32(commute(cond), right, left);
+    }
+
+    void compare32(RelationalCondition cond, Imm32 left, RegisterID right, RegisterID dest)
+    {
+        compare32(commute(cond), right, left, dest);
+    }
+
+    void branchTestPtr(ResultCondition cond, RegisterID reg, Label target)
+    {
+        branchTestPtr(cond, reg).linkTo(target, this);
+    }
+
+#if !CPU(ARM_THUMB2) && !CPU(ARM64)
+    PatchableJump patchableBranchPtr(RelationalCondition cond, Address left, TrustedImmPtr right = TrustedImmPtr(0))
+    {
+        return PatchableJump(branchPtr(cond, left, right));
+    }
+    
+    PatchableJump patchableBranchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        return PatchableJump(branchPtrWithPatch(cond, left, dataLabel, initialRightValue));
+    }
+
+    PatchableJump patchableBranch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        return PatchableJump(branch32WithPatch(cond, left, dataLabel, initialRightValue));
+    }
+
+#if !CPU(ARM_TRADITIONAL)
+    PatchableJump patchableJump()
+    {
+        return PatchableJump(jump());
+    }
+
+    PatchableJump patchableBranchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return PatchableJump(branchTest32(cond, reg, mask));
+    }
+
+    PatchableJump patchableBranch32(RelationalCondition cond, RegisterID reg, TrustedImm32 imm)
+    {
+        return PatchableJump(branch32(cond, reg, imm));
+    }
+
+    PatchableJump patchableBranch32(RelationalCondition cond, Address address, TrustedImm32 imm)
+    {
+        return PatchableJump(branch32(cond, address, imm));
+    }
+#endif
+#endif
+
+    void jump(Label target)
+    {
+        jump().linkTo(target, this);
+    }
+
+    // Commute a relational condition, returns a new condition that will produce
+    // the same results given the same inputs but with their positions exchanged.
+    static RelationalCondition commute(RelationalCondition condition)
+    {
+        switch (condition) {
+        case Above:
+            return Below;
+        case AboveOrEqual:
+            return BelowOrEqual;
+        case Below:
+            return Above;
+        case BelowOrEqual:
+            return AboveOrEqual;
+        case GreaterThan:
+            return LessThan;
+        case GreaterThanOrEqual:
+            return LessThanOrEqual;
+        case LessThan:
+            return GreaterThan;
+        case LessThanOrEqual:
+            return GreaterThanOrEqual;
+        default:
+            break;
+        }
+
+        ASSERT(condition == Equal || condition == NotEqual);
+        return condition;
+    }
+
+    void oops()
+    {
+        abortWithReason(B3Oops);
+    }
+
+    // B3 has additional pseudo-opcodes for returning, when it wants to signal that the return
+    // consumes some register in some way.
+    void retVoid() { ret(); }
+    void ret32(RegisterID) { ret(); }
+    void ret64(RegisterID) { ret(); }
+    void retFloat(FPRegisterID) { ret(); }
+    void retDouble(FPRegisterID) { ret(); }
+
+    static const unsigned BlindingModulus = 64;
+    bool shouldConsiderBlinding()
+    {
+        return !(random() & (BlindingModulus - 1));
+    }
+
+    // Ptr methods
+    // On 32-bit platforms (i.e. x86), these methods directly map onto their 32-bit equivalents.
+    // FIXME: should this use a test for 32-bitness instead of this specific exception?
+#if !CPU(X86_64) && !CPU(ARM64)
+    void addPtr(Address src, RegisterID dest)
+    {
+        add32(src, dest);
+    }
+
+    void addPtr(AbsoluteAddress src, RegisterID dest)
+    {
+        add32(src, dest);
+    }
+
+    void addPtr(RegisterID src, RegisterID dest)
+    {
+        add32(src, dest);
+    }
+
+    void addPtr(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        add32(left, right, dest);
+    }
+
+    void addPtr(TrustedImm32 imm, RegisterID srcDest)
+    {
+        add32(imm, srcDest);
+    }
+
+    void addPtr(TrustedImmPtr imm, RegisterID dest)
+    {
+        add32(TrustedImm32(imm), dest);
+    }
+
+    void addPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        add32(imm, src, dest);
+    }
+
+    void addPtr(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        add32(imm, address);
+    }
+    
+    void andPtr(RegisterID src, RegisterID dest)
+    {
+        and32(src, dest);
+    }
+
+    void andPtr(TrustedImm32 imm, RegisterID srcDest)
+    {
+        and32(imm, srcDest);
+    }
+
+    void andPtr(TrustedImmPtr imm, RegisterID srcDest)
+    {
+        and32(TrustedImm32(imm), srcDest);
+    }
+
+    void lshiftPtr(Imm32 imm, RegisterID srcDest)
+    {
+        lshift32(trustedImm32ForShift(imm), srcDest);
+    }
+    
+    void rshiftPtr(Imm32 imm, RegisterID srcDest)
+    {
+        rshift32(trustedImm32ForShift(imm), srcDest);
+    }
+
+    void urshiftPtr(Imm32 imm, RegisterID srcDest)
+    {
+        urshift32(trustedImm32ForShift(imm), srcDest);
+    }
+
+    void negPtr(RegisterID dest)
+    {
+        neg32(dest);
+    }
+
+    void orPtr(RegisterID src, RegisterID dest)
+    {
+        or32(src, dest);
+    }
+
+    void orPtr(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        or32(op1, op2, dest);
+    }
+
+    void orPtr(TrustedImmPtr imm, RegisterID dest)
+    {
+        or32(TrustedImm32(imm), dest);
+    }
+
+    void orPtr(TrustedImm32 imm, RegisterID dest)
+    {
+        or32(imm, dest);
+    }
+
+    void subPtr(RegisterID src, RegisterID dest)
+    {
+        sub32(src, dest);
+    }
+    
+    void subPtr(TrustedImm32 imm, RegisterID dest)
+    {
+        sub32(imm, dest);
+    }
+    
+    void subPtr(TrustedImmPtr imm, RegisterID dest)
+    {
+        sub32(TrustedImm32(imm), dest);
+    }
+
+    void xorPtr(RegisterID src, RegisterID dest)
+    {
+        xor32(src, dest);
+    }
+
+    void xorPtr(TrustedImm32 imm, RegisterID srcDest)
+    {
+        xor32(imm, srcDest);
+    }
+
+
+    void loadPtr(ImplicitAddress address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+
+    void loadPtr(BaseIndex address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+
+    void loadPtr(const void* address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+
+    DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        return load32WithAddressOffsetPatch(address, dest);
+    }
+    
+    DataLabelCompact loadPtrWithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        return load32WithCompactAddressOffsetPatch(address, dest);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        move(Imm32(imm.asTrustedImmPtr()), dest);
+    }
+
+    void comparePtr(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        compare32(cond, left, right, dest);
+    }
+
+    void comparePtr(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        compare32(cond, left, right, dest);
+    }
+    
+    void storePtr(RegisterID src, ImplicitAddress address)
+    {
+        store32(src, address);
+    }
+
+    void storePtr(RegisterID src, BaseIndex address)
+    {
+        store32(src, address);
+    }
+
+    void storePtr(RegisterID src, void* address)
+    {
+        store32(src, address);
+    }
+
+    void storePtr(TrustedImmPtr imm, ImplicitAddress address)
+    {
+        store32(TrustedImm32(imm), address);
+    }
+    
+    void storePtr(ImmPtr imm, Address address)
+    {
+        store32(Imm32(imm.asTrustedImmPtr()), address);
+    }
+
+    void storePtr(TrustedImmPtr imm, void* address)
+    {
+        store32(TrustedImm32(imm), address);
+    }
+
+    void storePtr(TrustedImm32 imm, ImplicitAddress address)
+    {
+        store32(imm, address);
+    }
+
+    void storePtr(TrustedImmPtr imm, BaseIndex address)
+    {
+        store32(TrustedImm32(imm), address);
+    }
+
+    DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        return store32WithAddressOffsetPatch(src, address);
+    }
+
+    Jump branchPtr(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        return branch32(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, RegisterID left, TrustedImmPtr right)
+    {
+        return branch32(cond, left, TrustedImm32(right));
+    }
+    
+    Jump branchPtr(RelationalCondition cond, RegisterID left, ImmPtr right)
+    {
+        return branch32(cond, left, Imm32(right.asTrustedImmPtr()));
+    }
+
+    Jump branchPtr(RelationalCondition cond, RegisterID left, Address right)
+    {
+        return branch32(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, Address left, RegisterID right)
+    {
+        return branch32(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        return branch32(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, Address left, TrustedImmPtr right)
+    {
+        return branch32(cond, left, TrustedImm32(right));
+    }
+    
+    Jump branchPtr(RelationalCondition cond, AbsoluteAddress left, TrustedImmPtr right)
+    {
+        return branch32(cond, left, TrustedImm32(right));
+    }
+
+    Jump branchSubPtr(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchSub32(cond, src, dest);
+    }
+
+    Jump branchTestPtr(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        return branchTest32(cond, reg, mask);
+    }
+
+    Jump branchTestPtr(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return branchTest32(cond, reg, mask);
+    }
+
+    Jump branchTestPtr(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return branchTest32(cond, address, mask);
+    }
+
+    Jump branchTestPtr(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return branchTest32(cond, address, mask);
+    }
+
+    Jump branchAddPtr(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchAdd32(cond, src, dest);
+    }
+
+    Jump branchSubPtr(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchSub32(cond, imm, dest);
+    }
+    using MacroAssemblerBase::branchTest8;
+    Jump branchTest8(ResultCondition cond, ExtendedAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return MacroAssemblerBase::branchTest8(cond, Address(address.base, address.offset), mask);
+    }
+
+#else // !CPU(X86_64)
+
+    void addPtr(RegisterID src, RegisterID dest)
+    {
+        add64(src, dest);
+    }
+
+    void addPtr(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        add64(left, right, dest);
+    }
+    
+    void addPtr(Address src, RegisterID dest)
+    {
+        add64(src, dest);
+    }
+
+    void addPtr(TrustedImm32 imm, RegisterID srcDest)
+    {
+        add64(imm, srcDest);
+    }
+
+    void addPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        add64(imm, src, dest);
+    }
+
+    void addPtr(TrustedImm32 imm, Address address)
+    {
+        add64(imm, address);
+    }
+
+    void addPtr(AbsoluteAddress src, RegisterID dest)
+    {
+        add64(src, dest);
+    }
+
+    void addPtr(TrustedImmPtr imm, RegisterID dest)
+    {
+        add64(TrustedImm64(imm), dest);
+    }
+
+    void addPtr(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        add64(imm, address);
+    }
+
+    void andPtr(RegisterID src, RegisterID dest)
+    {
+        and64(src, dest);
+    }
+
+    void andPtr(TrustedImm32 imm, RegisterID srcDest)
+    {
+        and64(imm, srcDest);
+    }
+    
+    void andPtr(TrustedImmPtr imm, RegisterID srcDest)
+    {
+        and64(imm, srcDest);
+    }
+    
+    void lshiftPtr(Imm32 imm, RegisterID srcDest)
+    {
+        lshift64(trustedImm32ForShift(imm), srcDest);
+    }
+
+    void rshiftPtr(Imm32 imm, RegisterID srcDest)
+    {
+        rshift64(trustedImm32ForShift(imm), srcDest);
+    }
+
+    void urshiftPtr(Imm32 imm, RegisterID srcDest)
+    {
+        urshift64(trustedImm32ForShift(imm), srcDest);
+    }
+
+    void negPtr(RegisterID dest)
+    {
+        neg64(dest);
+    }
+
+    void orPtr(RegisterID src, RegisterID dest)
+    {
+        or64(src, dest);
+    }
+
+    void orPtr(TrustedImm32 imm, RegisterID dest)
+    {
+        or64(imm, dest);
+    }
+
+    void orPtr(TrustedImmPtr imm, RegisterID dest)
+    {
+        or64(TrustedImm64(imm), dest);
+    }
+
+    void orPtr(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        or64(op1, op2, dest);
+    }
+
+    void orPtr(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        or64(imm, src, dest);
+    }
+    
+    void rotateRightPtr(TrustedImm32 imm, RegisterID srcDst)
+    {
+        rotateRight64(imm, srcDst);
+    }
+
+    void subPtr(RegisterID src, RegisterID dest)
+    {
+        sub64(src, dest);
+    }
+    
+    void subPtr(TrustedImm32 imm, RegisterID dest)
+    {
+        sub64(imm, dest);
+    }
+    
+    void subPtr(TrustedImmPtr imm, RegisterID dest)
+    {
+        sub64(TrustedImm64(imm), dest);
+    }
+
+    void xorPtr(RegisterID src, RegisterID dest)
+    {
+        xor64(src, dest);
+    }
+    
+    void xorPtr(RegisterID src, Address dest)
+    {
+        xor64(src, dest);
+    }
+
+    void xorPtr(TrustedImm32 imm, RegisterID srcDest)
+    {
+        xor64(imm, srcDest);
+    }
+
+    void loadPtr(ImplicitAddress address, RegisterID dest)
+    {
+        load64(address, dest);
+    }
+
+    void loadPtr(BaseIndex address, RegisterID dest)
+    {
+        load64(address, dest);
+    }
+
+    void loadPtr(const void* address, RegisterID dest)
+    {
+        load64(address, dest);
+    }
+
+    DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        return load64WithAddressOffsetPatch(address, dest);
+    }
+    
+    DataLabelCompact loadPtrWithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        return load64WithCompactAddressOffsetPatch(address, dest);
+    }
+
+    void storePtr(RegisterID src, ImplicitAddress address)
+    {
+        store64(src, address);
+    }
+
+    void storePtr(RegisterID src, BaseIndex address)
+    {
+        store64(src, address);
+    }
+    
+    void storePtr(RegisterID src, void* address)
+    {
+        store64(src, address);
+    }
+
+    void storePtr(TrustedImmPtr imm, ImplicitAddress address)
+    {
+        store64(TrustedImm64(imm), address);
+    }
+
+    void storePtr(TrustedImm32 imm, ImplicitAddress address)
+    {
+        store64(imm, address);
+    }
+
+    void storePtr(TrustedImmPtr imm, BaseIndex address)
+    {
+        store64(TrustedImm64(imm), address);
+    }
+
+    DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        return store64WithAddressOffsetPatch(src, address);
+    }
+
+    void comparePtr(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        compare64(cond, left, right, dest);
+    }
+    
+    void comparePtr(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        compare64(cond, left, right, dest);
+    }
+    
+    void testPtr(ResultCondition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest)
+    {
+        test64(cond, reg, mask, dest);
+    }
+
+    void testPtr(ResultCondition cond, RegisterID reg, RegisterID mask, RegisterID dest)
+    {
+        test64(cond, reg, mask, dest);
+    }
+
+    Jump branchPtr(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        return branch64(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, RegisterID left, TrustedImmPtr right)
+    {
+        return branch64(cond, left, TrustedImm64(right));
+    }
+    
+    Jump branchPtr(RelationalCondition cond, RegisterID left, Address right)
+    {
+        return branch64(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, Address left, RegisterID right)
+    {
+        return branch64(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        return branch64(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, Address left, TrustedImmPtr right)
+    {
+        return branch64(cond, left, TrustedImm64(right));
+    }
+
+    Jump branchTestPtr(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        return branchTest64(cond, reg, mask);
+    }
+    
+    Jump branchTestPtr(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return branchTest64(cond, reg, mask);
+    }
+
+    Jump branchTestPtr(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return branchTest64(cond, address, mask);
+    }
+
+    Jump branchTestPtr(ResultCondition cond, Address address, RegisterID reg)
+    {
+        return branchTest64(cond, address, reg);
+    }
+
+    Jump branchTestPtr(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return branchTest64(cond, address, mask);
+    }
+
+    Jump branchTestPtr(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        return branchTest64(cond, address, mask);
+    }
+
+    Jump branchAddPtr(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchAdd64(cond, imm, dest);
+    }
+
+    Jump branchAddPtr(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchAdd64(cond, src, dest);
+    }
+
+    Jump branchSubPtr(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchSub64(cond, imm, dest);
+    }
+
+    Jump branchSubPtr(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchSub64(cond, src, dest);
+    }
+
+    Jump branchSubPtr(ResultCondition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest)
+    {
+        return branchSub64(cond, src1, src2, dest);
+    }
+
+    using MacroAssemblerBase::and64;
+    using MacroAssemblerBase::convertInt32ToDouble;
+    using MacroAssemblerBase::store64;
+    bool shouldBlindDouble(double value)
+    {
+        // Don't trust NaN or +/-Infinity
+        if (!std::isfinite(value))
+            return shouldConsiderBlinding();
+
+        // Try to force normalisation, and check that there's no change
+        // in the bit pattern
+        if (bitwise_cast<uint64_t>(value * 1.0) != bitwise_cast<uint64_t>(value))
+            return shouldConsiderBlinding();
+
+        value = fabs(value);
+        // Only allow a limited set of fractional components
+        double scaledValue = value * 8;
+        if (scaledValue / 8 != value)
+            return shouldConsiderBlinding();
+        double frac = scaledValue - floor(scaledValue);
+        if (frac != 0.0)
+            return shouldConsiderBlinding();
+
+        return value > 0xff;
+    }
+    
+    bool shouldBlindPointerForSpecificArch(uintptr_t value)
+    {
+        if (sizeof(void*) == 4)
+            return shouldBlindForSpecificArch(static_cast<uint32_t>(value));
+        return shouldBlindForSpecificArch(static_cast<uint64_t>(value));
+    }
+    
+    bool shouldBlind(ImmPtr imm)
+    {
+        if (!canBlind())
+            return false;
+        
+#if ENABLE(FORCED_JIT_BLINDING)
+        UNUSED_PARAM(imm);
+        // Debug always blind all constants, if only so we know
+        // if we've broken blinding during patch development.
+        return true;
+#endif
+
+        // First off we'll special case common, "safe" values to avoid hurting
+        // performance too much
+        uintptr_t value = imm.asTrustedImmPtr().asIntptr();
+        switch (value) {
+        case 0xffff:
+        case 0xffffff:
+        case 0xffffffffL:
+        case 0xffffffffffL:
+        case 0xffffffffffffL:
+        case 0xffffffffffffffL:
+        case 0xffffffffffffffffL:
+            return false;
+        default: {
+            if (value <= 0xff)
+                return false;
+            if (~value <= 0xff)
+                return false;
+        }
+        }
+
+        if (!shouldConsiderBlinding())
+            return false;
+
+        return shouldBlindPointerForSpecificArch(value);
+    }
+    
+    struct RotatedImmPtr {
+        RotatedImmPtr(uintptr_t v1, uint8_t v2)
+            : value(v1)
+            , rotation(v2)
+        {
+        }
+        TrustedImmPtr value;
+        TrustedImm32 rotation;
+    };
+    
+    RotatedImmPtr rotationBlindConstant(ImmPtr imm)
+    {
+        uint8_t rotation = random() % (sizeof(void*) * 8);
+        uintptr_t value = imm.asTrustedImmPtr().asIntptr();
+        value = (value << rotation) | (value >> (sizeof(void*) * 8 - rotation));
+        return RotatedImmPtr(value, rotation);
+    }
+    
+    void loadRotationBlindedConstant(RotatedImmPtr constant, RegisterID dest)
+    {
+        move(constant.value, dest);
+        rotateRightPtr(constant.rotation, dest);
+    }
+
+    bool shouldBlind(Imm64 imm)
+    {
+#if ENABLE(FORCED_JIT_BLINDING)
+        UNUSED_PARAM(imm);
+        // Debug always blind all constants, if only so we know
+        // if we've broken blinding during patch development.
+        return true;        
+#endif
+
+        // First off we'll special case common, "safe" values to avoid hurting
+        // performance too much
+        uint64_t value = imm.asTrustedImm64().m_value;
+        switch (value) {
+        case 0xffff:
+        case 0xffffff:
+        case 0xffffffffL:
+        case 0xffffffffffL:
+        case 0xffffffffffffL:
+        case 0xffffffffffffffL:
+        case 0xffffffffffffffffL:
+            return false;
+        default: {
+            if (value <= 0xff)
+                return false;
+            if (~value <= 0xff)
+                return false;
+
+            JSValue jsValue = JSValue::decode(value);
+            if (jsValue.isInt32())
+                return shouldBlind(Imm32(jsValue.asInt32()));
+            if (jsValue.isDouble() && !shouldBlindDouble(jsValue.asDouble()))
+                return false;
+
+            if (!shouldBlindDouble(bitwise_cast<double>(value)))
+                return false;
+        }
+        }
+
+        if (!shouldConsiderBlinding())
+            return false;
+
+        return shouldBlindForSpecificArch(value);
+    }
+    
+    struct RotatedImm64 {
+        RotatedImm64(uint64_t v1, uint8_t v2)
+            : value(v1)
+            , rotation(v2)
+        {
+        }
+        TrustedImm64 value;
+        TrustedImm32 rotation;
+    };
+    
+    RotatedImm64 rotationBlindConstant(Imm64 imm)
+    {
+        uint8_t rotation = random() % (sizeof(int64_t) * 8);
+        uint64_t value = imm.asTrustedImm64().m_value;
+        value = (value << rotation) | (value >> (sizeof(int64_t) * 8 - rotation));
+        return RotatedImm64(value, rotation);
+    }
+    
+    void loadRotationBlindedConstant(RotatedImm64 constant, RegisterID dest)
+    {
+        move(constant.value, dest);
+        rotateRight64(constant.rotation, dest);
+    }
+
+    void convertInt32ToDouble(Imm32 imm, FPRegisterID dest)
+    {
+        if (shouldBlind(imm) && haveScratchRegisterForBlinding()) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadXorBlindedConstant(xorBlindConstant(imm), scratchRegister);
+            convertInt32ToDouble(scratchRegister, dest);
+        } else
+            convertInt32ToDouble(imm.asTrustedImm32(), dest);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        if (shouldBlind(imm))
+            loadRotationBlindedConstant(rotationBlindConstant(imm), dest);
+        else
+            move(imm.asTrustedImmPtr(), dest);
+    }
+
+    void move(Imm64 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm))
+            loadRotationBlindedConstant(rotationBlindConstant(imm), dest);
+        else
+            move(imm.asTrustedImm64(), dest);
+    }
+
+    void and64(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = andBlindedConstant(imm);
+            and64(key.value1, dest);
+            and64(key.value2, dest);
+        } else
+            and64(imm.asTrustedImm32(), dest);
+    }
+
+    Jump branchPtr(RelationalCondition cond, RegisterID left, ImmPtr right)
+    {
+        if (shouldBlind(right) && haveScratchRegisterForBlinding()) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadRotationBlindedConstant(rotationBlindConstant(right), scratchRegister);
+            return branchPtr(cond, left, scratchRegister);
+        }
+        return branchPtr(cond, left, right.asTrustedImmPtr());
+    }
+    
+    void storePtr(ImmPtr imm, Address dest)
+    {
+        if (shouldBlind(imm) && haveScratchRegisterForBlinding()) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadRotationBlindedConstant(rotationBlindConstant(imm), scratchRegister);
+            storePtr(scratchRegister, dest);
+        } else
+            storePtr(imm.asTrustedImmPtr(), dest);
+    }
+
+    void store64(Imm64 imm, Address dest)
+    {
+        if (shouldBlind(imm) && haveScratchRegisterForBlinding()) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadRotationBlindedConstant(rotationBlindConstant(imm), scratchRegister);
+            store64(scratchRegister, dest);
+        } else
+            store64(imm.asTrustedImm64(), dest);
+    }
+
+#endif // !CPU(X86_64)
+
+#if ENABLE(B3_JIT)
+    // We should implement this the right way eventually, but for now, it's fine because it arises so
+    // infrequently.
+    void compareDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID dest)
+    {
+        move(TrustedImm32(0), dest);
+        Jump falseCase = branchDouble(invert(cond), left, right);
+        move(TrustedImm32(1), dest);
+        falseCase.link(this);
+    }
+    void compareFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID dest)
+    {
+        move(TrustedImm32(0), dest);
+        Jump falseCase = branchFloat(invert(cond), left, right);
+        move(TrustedImm32(1), dest);
+        falseCase.link(this);
+    }
+#endif
+
+    void lea32(Address address, RegisterID dest)
+    {
+        add32(TrustedImm32(address.offset), address.base, dest);
+    }
+
+#if CPU(X86_64) || CPU(ARM64)
+    void lea64(Address address, RegisterID dest)
+    {
+        add64(TrustedImm32(address.offset), address.base, dest);
+    }
+#endif // CPU(X86_64) || CPU(ARM64)
+
+    bool shouldBlind(Imm32 imm)
+    {
+#if ENABLE(FORCED_JIT_BLINDING)
+        UNUSED_PARAM(imm);
+        // Debug always blind all constants, if only so we know
+        // if we've broken blinding during patch development.
+        return true;
+#else // ENABLE(FORCED_JIT_BLINDING)
+
+        // First off we'll special case common, "safe" values to avoid hurting
+        // performance too much
+        uint32_t value = imm.asTrustedImm32().m_value;
+        switch (value) {
+        case 0xffff:
+        case 0xffffff:
+        case 0xffffffff:
+            return false;
+        default:
+            if (value <= 0xff)
+                return false;
+            if (~value <= 0xff)
+                return false;
+        }
+
+        if (!shouldConsiderBlinding())
+            return false;
+
+        return shouldBlindForSpecificArch(value);
+#endif // ENABLE(FORCED_JIT_BLINDING)
+    }
+
+    struct BlindedImm32 {
+        BlindedImm32(int32_t v1, int32_t v2)
+            : value1(v1)
+            , value2(v2)
+        {
+        }
+        TrustedImm32 value1;
+        TrustedImm32 value2;
+    };
+
+    uint32_t keyForConstant(uint32_t value, uint32_t& mask)
+    {
+        uint32_t key = random();
+        if (value <= 0xff)
+            mask = 0xff;
+        else if (value <= 0xffff)
+            mask = 0xffff;
+        else if (value <= 0xffffff)
+            mask = 0xffffff;
+        else
+            mask = 0xffffffff;
+        return key & mask;
+    }
+
+    uint32_t keyForConstant(uint32_t value)
+    {
+        uint32_t mask = 0;
+        return keyForConstant(value, mask);
+    }
+
+    BlindedImm32 xorBlindConstant(Imm32 imm)
+    {
+        uint32_t baseValue = imm.asTrustedImm32().m_value;
+        uint32_t key = keyForConstant(baseValue);
+        return BlindedImm32(baseValue ^ key, key);
+    }
+
+    BlindedImm32 additionBlindedConstant(Imm32 imm)
+    {
+        // The addition immediate may be used as a pointer offset. Keep aligned based on "imm".
+        static uint32_t maskTable[4] = { 0xfffffffc, 0xffffffff, 0xfffffffe, 0xffffffff };
+
+        uint32_t baseValue = imm.asTrustedImm32().m_value;
+        uint32_t key = keyForConstant(baseValue) & maskTable[baseValue & 3];
+        if (key > baseValue)
+            key = key - baseValue;
+        return BlindedImm32(baseValue - key, key);
+    }
+    
+    BlindedImm32 andBlindedConstant(Imm32 imm)
+    {
+        uint32_t baseValue = imm.asTrustedImm32().m_value;
+        uint32_t mask = 0;
+        uint32_t key = keyForConstant(baseValue, mask);
+        ASSERT((baseValue & mask) == baseValue);
+        return BlindedImm32(((baseValue & key) | ~key) & mask, ((baseValue & ~key) | key) & mask);
+    }
+    
+    BlindedImm32 orBlindedConstant(Imm32 imm)
+    {
+        uint32_t baseValue = imm.asTrustedImm32().m_value;
+        uint32_t mask = 0;
+        uint32_t key = keyForConstant(baseValue, mask);
+        ASSERT((baseValue & mask) == baseValue);
+        return BlindedImm32((baseValue & key) & mask, (baseValue & ~key) & mask);
+    }
+    
+    void loadXorBlindedConstant(BlindedImm32 constant, RegisterID dest)
+    {
+        move(constant.value1, dest);
+        xor32(constant.value2, dest);
+    }
+    
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            add32(key.value1, dest);
+            add32(key.value2, dest);
+        } else
+            add32(imm.asTrustedImm32(), dest);
+    }
+
+    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            add32(key.value1, src, dest);
+            add32(key.value2, dest);
+        } else
+            add32(imm.asTrustedImm32(), src, dest);
+    }
+    
+    void addPtr(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            addPtr(key.value1, dest);
+            addPtr(key.value2, dest);
+        } else
+            addPtr(imm.asTrustedImm32(), dest);
+    }
+
+    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            if (src != dest || haveScratchRegisterForBlinding()) {
+                if (src == dest) {
+                    move(src, scratchRegisterForBlinding());
+                    src = scratchRegisterForBlinding();
+                }
+                loadXorBlindedConstant(xorBlindConstant(imm), dest);
+                mul32(src, dest);
+                return;
+            }
+            // If we don't have a scratch register available for use, we'll just
+            // place a random number of nops.
+            uint32_t nopCount = random() & 3;
+            while (nopCount--)
+                nop();
+        }
+        mul32(imm.asTrustedImm32(), src, dest);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = andBlindedConstant(imm);
+            and32(key.value1, dest);
+            and32(key.value2, dest);
+        } else
+            and32(imm.asTrustedImm32(), dest);
+    }
+
+    void andPtr(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = andBlindedConstant(imm);
+            andPtr(key.value1, dest);
+            andPtr(key.value2, dest);
+        } else
+            andPtr(imm.asTrustedImm32(), dest);
+    }
+    
+    void and32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            if (src == dest)
+                return and32(imm.asTrustedImm32(), dest);
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+            and32(src, dest);
+        } else
+            and32(imm.asTrustedImm32(), src, dest);
+    }
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm))
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+        else
+            move(imm.asTrustedImm32(), dest);
+    }
+    
+    void or32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            if (src == dest)
+                return or32(imm, dest);
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+            or32(src, dest);
+        } else
+            or32(imm.asTrustedImm32(), src, dest);
+    }
+    
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = orBlindedConstant(imm);
+            or32(key.value1, dest);
+            or32(key.value2, dest);
+        } else
+            or32(imm.asTrustedImm32(), dest);
+    }
+    
+    void poke(Imm32 value, int index = 0)
+    {
+        store32(value, addressForPoke(index));
+    }
+    
+    void poke(ImmPtr value, int index = 0)
+    {
+        storePtr(value, addressForPoke(index));
+    }
+    
+#if CPU(X86_64) || CPU(ARM64)
+    void poke(Imm64 value, int index = 0)
+    {
+        store64(value, addressForPoke(index));
+    }
+#endif // CPU(X86_64)
+    
+    void store32(Imm32 imm, Address dest)
+    {
+        if (shouldBlind(imm)) {
+#if CPU(X86) || CPU(X86_64)
+            BlindedImm32 blind = xorBlindConstant(imm);
+            store32(blind.value1, dest);
+            xor32(blind.value2, dest);
+#else // CPU(X86) || CPU(X86_64)
+            if (haveScratchRegisterForBlinding()) {
+                loadXorBlindedConstant(xorBlindConstant(imm), scratchRegisterForBlinding());
+                store32(scratchRegisterForBlinding(), dest);
+            } else {
+                // If we don't have a scratch register available for use, we'll just 
+                // place a random number of nops.
+                uint32_t nopCount = random() & 3;
+                while (nopCount--)
+                    nop();
+                store32(imm.asTrustedImm32(), dest);
+            }
+#endif // CPU(X86) || CPU(X86_64)
+        } else
+            store32(imm.asTrustedImm32(), dest);
+    }
+    
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            sub32(key.value1, dest);
+            sub32(key.value2, dest);
+        } else
+            sub32(imm.asTrustedImm32(), dest);
+    }
+    
+    void subPtr(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 key = additionBlindedConstant(imm);
+            subPtr(key.value1, dest);
+            subPtr(key.value2, dest);
+        } else
+            subPtr(imm.asTrustedImm32(), dest);
+    }
+    
+    void xor32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 blind = xorBlindConstant(imm);
+            xor32(blind.value1, src, dest);
+            xor32(blind.value2, dest);
+        } else
+            xor32(imm.asTrustedImm32(), src, dest);
+    }
+    
+    void xor32(Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            BlindedImm32 blind = xorBlindConstant(imm);
+            xor32(blind.value1, dest);
+            xor32(blind.value2, dest);
+        } else
+            xor32(imm.asTrustedImm32(), dest);
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, Imm32 right)
+    {
+        if (shouldBlind(right)) {
+            if (haveScratchRegisterForBlinding()) {
+                loadXorBlindedConstant(xorBlindConstant(right), scratchRegisterForBlinding());
+                return branch32(cond, left, scratchRegisterForBlinding());
+            }
+            // If we don't have a scratch register available for use, we'll just 
+            // place a random number of nops.
+            uint32_t nopCount = random() & 3;
+            while (nopCount--)
+                nop();
+            return branch32(cond, left, right.asTrustedImm32());
+        }
+        
+        return branch32(cond, left, right.asTrustedImm32());
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        if (shouldBlind(right)) {
+            if (left != dest || haveScratchRegisterForBlinding()) {
+                RegisterID blindedConstantReg = dest;
+                if (left == dest)
+                    blindedConstantReg = scratchRegisterForBlinding();
+                loadXorBlindedConstant(xorBlindConstant(right), blindedConstantReg);
+                compare32(cond, left, blindedConstantReg, dest);
+                return;
+            }
+            // If we don't have a scratch register available for use, we'll just
+            // place a random number of nops.
+            uint32_t nopCount = random() & 3;
+            while (nopCount--)
+                nop();
+            compare32(cond, left, right.asTrustedImm32(), dest);
+            return;
+        }
+
+        compare32(cond, left, right.asTrustedImm32(), dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, Imm32 imm, RegisterID dest)
+    {
+        if (shouldBlind(imm)) {
+            if (src != dest || haveScratchRegisterForBlinding()) {
+                if (src == dest) {
+                    move(src, scratchRegisterForBlinding());
+                    src = scratchRegisterForBlinding();
+                }
+                loadXorBlindedConstant(xorBlindConstant(imm), dest);
+                return branchAdd32(cond, src, dest);
+            }
+            // If we don't have a scratch register available for use, we'll just
+            // place a random number of nops.
+            uint32_t nopCount = random() & 3;
+            while (nopCount--)
+                nop();
+        }
+        return branchAdd32(cond, src, imm.asTrustedImm32(), dest);            
+    }
+    
+    Jump branchMul32(ResultCondition cond, RegisterID src, Imm32 imm, RegisterID dest)
+    {
+        if (src == dest)
+            ASSERT(haveScratchRegisterForBlinding());
+
+        if (shouldBlind(imm)) {
+            if (src == dest) {
+                move(src, scratchRegisterForBlinding());
+                src = scratchRegisterForBlinding();
+            }
+            loadXorBlindedConstant(xorBlindConstant(imm), dest);
+            return branchMul32(cond, src, dest);  
+        }
+        return branchMul32(cond, src, imm.asTrustedImm32(), dest);
+    }
+
+    // branchSub32 takes a scratch register as 32 bit platforms make use of this,
+    // with src == dst, and on x86-32 we don't have a platform scratch register.
+    Jump branchSub32(ResultCondition cond, RegisterID src, Imm32 imm, RegisterID dest, RegisterID scratch)
+    {
+        if (shouldBlind(imm)) {
+            ASSERT(scratch != dest);
+            ASSERT(scratch != src);
+            loadXorBlindedConstant(xorBlindConstant(imm), scratch);
+            return branchSub32(cond, src, scratch, dest);
+        }
+        return branchSub32(cond, src, imm.asTrustedImm32(), dest);            
+    }
+    
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        lshift32(trustedImm32ForShift(imm), dest);
+    }
+    
+    void lshift32(RegisterID src, Imm32 amount, RegisterID dest)
+    {
+        lshift32(src, trustedImm32ForShift(amount), dest);
+    }
+    
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        rshift32(trustedImm32ForShift(imm), dest);
+    }
+    
+    void rshift32(RegisterID src, Imm32 amount, RegisterID dest)
+    {
+        rshift32(src, trustedImm32ForShift(amount), dest);
+    }
+    
+    void urshift32(Imm32 imm, RegisterID dest)
+    {
+        urshift32(trustedImm32ForShift(imm), dest);
+    }
+    
+    void urshift32(RegisterID src, Imm32 amount, RegisterID dest)
+    {
+        urshift32(src, trustedImm32ForShift(amount), dest);
+    }
+
+#if ENABLE(MASM_PROBE)
+    using MacroAssemblerBase::probe;
+
+    // Let's you print from your JIT generated code.
+    // See comments in MacroAssemblerPrinter.h for examples of how to use this.
+    template<typename... Arguments>
+    void print(Arguments... args);
+
+    void probe(std::function<void (ProbeContext*)>);
+#endif
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::MacroAssembler::RelationalCondition);
+void printInternal(PrintStream&, JSC::MacroAssembler::ResultCondition);
+void printInternal(PrintStream&, JSC::MacroAssembler::DoubleCondition);
+
+} // namespace WTF
+
+#else // ENABLE(ASSEMBLER)
+
+namespace JSC {
+
+// If there is no assembler for this platform, at least allow code to make references to
+// some of the things it would otherwise define, albeit without giving that code any way
+// of doing anything useful.
+class MacroAssembler {
+private:
+    MacroAssembler() { }
+    
+public:
+    
+    enum RegisterID { NoRegister };
+    enum FPRegisterID { NoFPRegister };
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/MacroAssemblerARM.cpp b/assembler/MacroAssemblerARM.cpp
new file mode 100644
index 0000000..9b1440f
--- /dev/null
+++ b/assembler/MacroAssemblerARM.cpp
@@ -0,0 +1,370 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc.
+ * Copyright (C) 2009 University of Szeged
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
+
+#include "MacroAssemblerARM.h"
+
+#include <wtf/InlineASM.h>
+
+#if OS(LINUX)
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <elf.h>
+#include <asm/hwcap.h>
+#endif
+
+namespace JSC {
+
+static bool isVFPPresent()
+{
+#if OS(LINUX)
+    int fd = open("/proc/self/auxv", O_RDONLY);
+    if (fd != -1) {
+        Elf32_auxv_t aux;
+        while (read(fd, &aux, sizeof(Elf32_auxv_t))) {
+            if (aux.a_type == AT_HWCAP) {
+                close(fd);
+                return aux.a_un.a_val & HWCAP_VFP;
+            }
+        }
+        close(fd);
+    }
+#endif // OS(LINUX)
+
+#if (COMPILER(GCC_OR_CLANG) && defined(__VFP_FP__))
+    return true;
+#else
+    return false;
+#endif
+}
+
+const bool MacroAssemblerARM::s_isVFPPresent = isVFPPresent();
+
+#if CPU(ARMV5_OR_LOWER)
+/* On ARMv5 and below, natural alignment is required. */
+void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+{
+    ARMWord op2;
+
+    ASSERT(address.scale >= 0 && address.scale <= 3);
+    op2 = m_assembler.lsl(address.index, static_cast<int>(address.scale));
+
+    if (address.offset >= 0 && address.offset + 0x2 <= 0xff) {
+        m_assembler.add(ARMRegisters::S0, address.base, op2);
+        m_assembler.halfDtrUp(ARMAssembler::LoadUint16, dest, ARMRegisters::S0, ARMAssembler::getOp2Half(address.offset));
+        m_assembler.halfDtrUp(ARMAssembler::LoadUint16, ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Half(address.offset + 0x2));
+    } else if (address.offset < 0 && address.offset >= -0xff) {
+        m_assembler.add(ARMRegisters::S0, address.base, op2);
+        m_assembler.halfDtrDown(ARMAssembler::LoadUint16, dest, ARMRegisters::S0, ARMAssembler::getOp2Half(-address.offset));
+        m_assembler.halfDtrDown(ARMAssembler::LoadUint16, ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Half(-address.offset - 0x2));
+    } else {
+        m_assembler.moveImm(address.offset, ARMRegisters::S0);
+        m_assembler.add(ARMRegisters::S0, ARMRegisters::S0, op2);
+        m_assembler.halfDtrUpRegister(ARMAssembler::LoadUint16, dest, address.base, ARMRegisters::S0);
+        m_assembler.add(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::Op2Immediate | 0x2);
+        m_assembler.halfDtrUpRegister(ARMAssembler::LoadUint16, ARMRegisters::S0, address.base, ARMRegisters::S0);
+    }
+    m_assembler.orr(dest, dest, m_assembler.lsl(ARMRegisters::S0, 16));
+}
+#endif // CPU(ARMV5_OR_LOWER)
+
+#if ENABLE(MASM_PROBE)
+
+extern "C" void ctiMasmProbeTrampoline();
+
+#if COMPILER(GCC_OR_CLANG)
+    
+// The following are offsets for MacroAssemblerARM::ProbeContext fields accessed
+// by the ctiMasmProbeTrampoline stub.
+
+#define PTR_SIZE 4
+#define PROBE_PROBE_FUNCTION_OFFSET (0 * PTR_SIZE)
+#define PROBE_ARG1_OFFSET (1 * PTR_SIZE)
+#define PROBE_ARG2_OFFSET (2 * PTR_SIZE)
+
+#define PROBE_FIRST_GPREG_OFFSET (4 * PTR_SIZE)
+
+#define GPREG_SIZE 4
+#define PROBE_CPU_R0_OFFSET (PROBE_FIRST_GPREG_OFFSET + (0 * GPREG_SIZE))
+#define PROBE_CPU_R1_OFFSET (PROBE_FIRST_GPREG_OFFSET + (1 * GPREG_SIZE))
+#define PROBE_CPU_R2_OFFSET (PROBE_FIRST_GPREG_OFFSET + (2 * GPREG_SIZE))
+#define PROBE_CPU_R3_OFFSET (PROBE_FIRST_GPREG_OFFSET + (3 * GPREG_SIZE))
+#define PROBE_CPU_R4_OFFSET (PROBE_FIRST_GPREG_OFFSET + (4 * GPREG_SIZE))
+#define PROBE_CPU_R5_OFFSET (PROBE_FIRST_GPREG_OFFSET + (5 * GPREG_SIZE))
+#define PROBE_CPU_R6_OFFSET (PROBE_FIRST_GPREG_OFFSET + (6 * GPREG_SIZE))
+#define PROBE_CPU_R7_OFFSET (PROBE_FIRST_GPREG_OFFSET + (7 * GPREG_SIZE))
+#define PROBE_CPU_R8_OFFSET (PROBE_FIRST_GPREG_OFFSET + (8 * GPREG_SIZE))
+#define PROBE_CPU_R9_OFFSET (PROBE_FIRST_GPREG_OFFSET + (9 * GPREG_SIZE))
+#define PROBE_CPU_R10_OFFSET (PROBE_FIRST_GPREG_OFFSET + (10 * GPREG_SIZE))
+#define PROBE_CPU_R11_OFFSET (PROBE_FIRST_GPREG_OFFSET + (11 * GPREG_SIZE))
+#define PROBE_CPU_IP_OFFSET (PROBE_FIRST_GPREG_OFFSET + (12 * GPREG_SIZE))
+#define PROBE_CPU_SP_OFFSET (PROBE_FIRST_GPREG_OFFSET + (13 * GPREG_SIZE))
+#define PROBE_CPU_LR_OFFSET (PROBE_FIRST_GPREG_OFFSET + (14 * GPREG_SIZE))
+#define PROBE_CPU_PC_OFFSET (PROBE_FIRST_GPREG_OFFSET + (15 * GPREG_SIZE))
+
+#define PROBE_CPU_APSR_OFFSET (PROBE_FIRST_GPREG_OFFSET + (16 * GPREG_SIZE))
+#define PROBE_CPU_FPSCR_OFFSET (PROBE_FIRST_GPREG_OFFSET + (17 * GPREG_SIZE))
+
+#define PROBE_FIRST_FPREG_OFFSET (PROBE_FIRST_GPREG_OFFSET + (18 * GPREG_SIZE))
+
+#define FPREG_SIZE 8
+#define PROBE_CPU_D0_OFFSET (PROBE_FIRST_FPREG_OFFSET + (0 * FPREG_SIZE))
+#define PROBE_CPU_D1_OFFSET (PROBE_FIRST_FPREG_OFFSET + (1 * FPREG_SIZE))
+#define PROBE_CPU_D2_OFFSET (PROBE_FIRST_FPREG_OFFSET + (2 * FPREG_SIZE))
+#define PROBE_CPU_D3_OFFSET (PROBE_FIRST_FPREG_OFFSET + (3 * FPREG_SIZE))
+#define PROBE_CPU_D4_OFFSET (PROBE_FIRST_FPREG_OFFSET + (4 * FPREG_SIZE))
+#define PROBE_CPU_D5_OFFSET (PROBE_FIRST_FPREG_OFFSET + (5 * FPREG_SIZE))
+#define PROBE_CPU_D6_OFFSET (PROBE_FIRST_FPREG_OFFSET + (6 * FPREG_SIZE))
+#define PROBE_CPU_D7_OFFSET (PROBE_FIRST_FPREG_OFFSET + (7 * FPREG_SIZE))
+#define PROBE_CPU_D8_OFFSET (PROBE_FIRST_FPREG_OFFSET + (8 * FPREG_SIZE))
+#define PROBE_CPU_D9_OFFSET (PROBE_FIRST_FPREG_OFFSET + (9 * FPREG_SIZE))
+#define PROBE_CPU_D10_OFFSET (PROBE_FIRST_FPREG_OFFSET + (10 * FPREG_SIZE))
+#define PROBE_CPU_D11_OFFSET (PROBE_FIRST_FPREG_OFFSET + (11 * FPREG_SIZE))
+#define PROBE_CPU_D12_OFFSET (PROBE_FIRST_FPREG_OFFSET + (12 * FPREG_SIZE))
+#define PROBE_CPU_D13_OFFSET (PROBE_FIRST_FPREG_OFFSET + (13 * FPREG_SIZE))
+#define PROBE_CPU_D14_OFFSET (PROBE_FIRST_FPREG_OFFSET + (14 * FPREG_SIZE))
+#define PROBE_CPU_D15_OFFSET (PROBE_FIRST_FPREG_OFFSET + (15 * FPREG_SIZE))
+
+#define PROBE_SIZE (PROBE_FIRST_FPREG_OFFSET + (16 * FPREG_SIZE))
+
+// These ASSERTs remind you that if you change the layout of ProbeContext,
+// you need to change ctiMasmProbeTrampoline offsets above to match.
+#define PROBE_OFFSETOF(x) offsetof(struct MacroAssemblerARM::ProbeContext, x)
+COMPILE_ASSERT(PROBE_OFFSETOF(probeFunction) == PROBE_PROBE_FUNCTION_OFFSET, ProbeContext_probeFunction_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg1) == PROBE_ARG1_OFFSET, ProbeContext_arg1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg2) == PROBE_ARG2_OFFSET, ProbeContext_arg2_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r0) == PROBE_CPU_R0_OFFSET, ProbeContext_cpu_r0_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r1) == PROBE_CPU_R1_OFFSET, ProbeContext_cpu_r1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r2) == PROBE_CPU_R2_OFFSET, ProbeContext_cpu_r2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r3) == PROBE_CPU_R3_OFFSET, ProbeContext_cpu_r3_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r4) == PROBE_CPU_R4_OFFSET, ProbeContext_cpu_r4_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r5) == PROBE_CPU_R5_OFFSET, ProbeContext_cpu_r5_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r6) == PROBE_CPU_R6_OFFSET, ProbeContext_cpu_r6_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r7) == PROBE_CPU_R7_OFFSET, ProbeContext_cpu_r7_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r8) == PROBE_CPU_R8_OFFSET, ProbeContext_cpu_r8_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r9) == PROBE_CPU_R9_OFFSET, ProbeContext_cpu_r9_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r10) == PROBE_CPU_R10_OFFSET, ProbeContext_cpu_r10_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r11) == PROBE_CPU_R11_OFFSET, ProbeContext_cpu_r11_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.ip) == PROBE_CPU_IP_OFFSET, ProbeContext_cpu_ip_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.sp) == PROBE_CPU_SP_OFFSET, ProbeContext_cpu_sp_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.lr) == PROBE_CPU_LR_OFFSET, ProbeContext_cpu_lr_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.pc) == PROBE_CPU_PC_OFFSET, ProbeContext_cpu_pc_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.apsr) == PROBE_CPU_APSR_OFFSET, ProbeContext_cpu_apsr_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.fpscr) == PROBE_CPU_FPSCR_OFFSET, ProbeContext_cpu_fpscr_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d0) == PROBE_CPU_D0_OFFSET, ProbeContext_cpu_d0_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d1) == PROBE_CPU_D1_OFFSET, ProbeContext_cpu_d1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d2) == PROBE_CPU_D2_OFFSET, ProbeContext_cpu_d2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d3) == PROBE_CPU_D3_OFFSET, ProbeContext_cpu_d3_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d4) == PROBE_CPU_D4_OFFSET, ProbeContext_cpu_d4_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d5) == PROBE_CPU_D5_OFFSET, ProbeContext_cpu_d5_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d6) == PROBE_CPU_D6_OFFSET, ProbeContext_cpu_d6_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d7) == PROBE_CPU_D7_OFFSET, ProbeContext_cpu_d7_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d8) == PROBE_CPU_D8_OFFSET, ProbeContext_cpu_d8_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d9) == PROBE_CPU_D9_OFFSET, ProbeContext_cpu_d9_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d10) == PROBE_CPU_D10_OFFSET, ProbeContext_cpu_d10_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d11) == PROBE_CPU_D11_OFFSET, ProbeContext_cpu_d11_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d12) == PROBE_CPU_D12_OFFSET, ProbeContext_cpu_d12_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d13) == PROBE_CPU_D13_OFFSET, ProbeContext_cpu_d13_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d14) == PROBE_CPU_D14_OFFSET, ProbeContext_cpu_d14_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d15) == PROBE_CPU_D15_OFFSET, ProbeContext_cpu_d15_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(sizeof(MacroAssemblerARM::ProbeContext) == PROBE_SIZE, ProbeContext_size_matches_ctiMasmProbeTrampoline);
+#undef PROBE_OFFSETOF
+
+asm (
+    ".text" "\n"
+    ".globl " SYMBOL_STRING(ctiMasmProbeTrampoline) "\n"
+    HIDE_SYMBOL(ctiMasmProbeTrampoline) "\n"
+    INLINE_ARM_FUNCTION(ctiMasmProbeTrampoline) "\n"
+    SYMBOL_STRING(ctiMasmProbeTrampoline) ":" "\n"
+
+    // MacroAssemblerARM::probe() has already generated code to store some values.
+    // The top of stack now looks like this:
+    //     esp[0 * ptrSize]: probeFunction
+    //     esp[1 * ptrSize]: arg1
+    //     esp[2 * ptrSize]: arg2
+    //     esp[3 * ptrSize]: saved r3 / S0
+    //     esp[4 * ptrSize]: saved ip
+    //     esp[5 * ptrSize]: saved lr
+    //     esp[6 * ptrSize]: saved sp
+
+    "mov       ip, sp" "\n"
+    "mov       r3, sp" "\n"
+    "sub       r3, r3, #" STRINGIZE_VALUE_OF(PROBE_SIZE) "\n"
+
+    // The ARM EABI specifies that the stack needs to be 16 byte aligned.
+    "bic       r3, r3, #0xf" "\n"
+    "mov       sp, r3" "\n"
+
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+    "add       lr, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_R0_OFFSET) "\n"
+    "stmia     lr, { r0-r11 }" "\n"
+    "mrs       lr, APSR" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "]" "\n"
+    "vmrs      lr, FPSCR" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FPSCR_OFFSET) "]" "\n"
+
+    "ldr       lr, [ip, #0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG1_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG2_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_R3_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+
+    "ldr       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+
+    "add       ip, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_D0_OFFSET) "\n"
+    "vstmia.64 ip, { d0-d15 }" "\n"
+
+    "mov       fp, sp" "\n" // Save the ProbeContext*.
+
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "]" "\n"
+    "mov       r0, sp" "\n" // the ProbeContext* arg.
+    "blx       ip" "\n"
+
+    "mov       sp, fp" "\n"
+
+    // To enable probes to modify register state, we copy all registers
+    // out of the ProbeContext before returning.
+
+    "add       ip, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_D15_OFFSET + FPREG_SIZE) "\n"
+    "vldmdb.64 ip!, { d0-d15 }" "\n"
+    "add       ip, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_R11_OFFSET + GPREG_SIZE) "\n"
+    "ldmdb     ip, { r0-r11 }" "\n"
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FPSCR_OFFSET) "]" "\n"
+    "vmsr      FPSCR, ip" "\n"
+
+    // There are 5 more registers left to restore: ip, sp, lr, pc, and apsr.
+    // There are 2 issues that complicate the restoration of these last few
+    // registers:
+    //
+    // 1. Normal ARM calling convention relies on moving lr to pc to return to
+    //    the caller. In our case, the address to return to is specified by
+    //    ProbeContext.cpu.pc. And at that moment, we won't have any available
+    //    scratch registers to hold the return address (lr needs to hold
+    //    ProbeContext.cpu.lr, not the return address).
+    //
+    //    The solution is to store the return address on the stack and load the
+    //     pc from there.
+    //
+    // 2. Issue 1 means we will need to write to the stack location at
+    //    ProbeContext.cpu.sp - 4. But if the user probe function had  modified
+    //    the value of ProbeContext.cpu.sp to point in the range between
+    //    &ProbeContext.cpu.ip thru &ProbeContext.cpu.aspr, then the action for
+    //    Issue 1 may trash the values to be restored before we can restore
+    //    them.
+    //
+    //    The solution is to check if ProbeContext.cpu.sp contains a value in
+    //    the undesirable range. If so, we copy the remaining ProbeContext
+    //    register data to a safe range (at memory lower than where
+    //    ProbeContext.cpu.sp points) first, and restore the remaining register
+    //    from this new range.
+
+    "add       ip, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "\n"
+    "ldr       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+    "cmp       lr, ip" "\n"
+    "bgt     " SYMBOL_STRING(ctiMasmProbeTrampolineEnd) "\n"
+
+    // We get here because the new expected stack pointer location is lower
+    // than where it's supposed to be. This means the safe range of stack
+    // memory where we'll be copying the remaining register restore values to
+    // might be in a region of memory below the sp i.e. unallocated stack
+    // memory. This in turn makes it vulnerable to interrupts potentially
+    // trashing the copied values. To prevent that, we must first allocate the
+    // needed stack memory by adjusting the sp before the copying.
+
+    "sub       lr, lr, #(6 * " STRINGIZE_VALUE_OF(PTR_SIZE)
+    " + " STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) ")" "\n"
+
+    "mov       ip, sp" "\n"
+    "mov       sp, lr" "\n"
+    "mov       lr, ip" "\n"
+
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "]" "\n"
+
+    SYMBOL_STRING(ctiMasmProbeTrampolineEnd) ":" "\n"
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+    "ldr       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+    "sub       lr, lr, #" STRINGIZE_VALUE_OF(PTR_SIZE) "\n"
+    "str       ip, [lr]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "]" "\n"
+    "msr       APSR, ip" "\n"
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "mov       lr, ip" "\n"
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
+    "ldr       sp, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+
+    "pop       { pc }" "\n"
+);
+#endif // COMPILER(GCC_OR_CLANG)
+
+void MacroAssemblerARM::probe(MacroAssemblerARM::ProbeFunction function, void* arg1, void* arg2)
+{
+    push(RegisterID::sp);
+    push(RegisterID::lr);
+    push(RegisterID::ip);
+    push(RegisterID::S0);
+    // The following uses RegisterID::S0. So, they must come after we push S0 above.
+    push(trustedImm32FromPtr(arg2));
+    push(trustedImm32FromPtr(arg1));
+    push(trustedImm32FromPtr(function));
+
+    move(trustedImm32FromPtr(ctiMasmProbeTrampoline), RegisterID::S0);
+    m_assembler.blx(RegisterID::S0);
+
+}
+#endif // ENABLE(MASM_PROBE)
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/assembler/MacroAssemblerARM.h b/assembler/MacroAssemblerARM.h
new file mode 100644
index 0000000..7d36034
--- /dev/null
+++ b/assembler/MacroAssemblerARM.h
@@ -0,0 +1,1627 @@
+/*
+ * Copyright (C) 2008, 2013-2016 Apple Inc.
+ * Copyright (C) 2009, 2010 University of Szeged
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
+
+#include "ARMAssembler.h"
+#include "AbstractMacroAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerARM : public AbstractMacroAssembler<ARMAssembler, MacroAssemblerARM> {
+    static const int DoubleConditionMask = 0x0f;
+    static const int DoubleConditionBitSpecial = 0x10;
+    COMPILE_ASSERT(!(DoubleConditionBitSpecial & DoubleConditionMask), DoubleConditionBitSpecial_should_not_interfere_with_ARMAssembler_Condition_codes);
+public:
+    static const unsigned numGPRs = 16;
+    static const unsigned numFPRs = 16;
+    
+    typedef ARMRegisters::FPRegisterID FPRegisterID;
+
+    enum RelationalCondition {
+        Equal = ARMAssembler::EQ,
+        NotEqual = ARMAssembler::NE,
+        Above = ARMAssembler::HI,
+        AboveOrEqual = ARMAssembler::CS,
+        Below = ARMAssembler::CC,
+        BelowOrEqual = ARMAssembler::LS,
+        GreaterThan = ARMAssembler::GT,
+        GreaterThanOrEqual = ARMAssembler::GE,
+        LessThan = ARMAssembler::LT,
+        LessThanOrEqual = ARMAssembler::LE
+    };
+
+    enum ResultCondition {
+        Overflow = ARMAssembler::VS,
+        Signed = ARMAssembler::MI,
+        PositiveOrZero = ARMAssembler::PL,
+        Zero = ARMAssembler::EQ,
+        NonZero = ARMAssembler::NE
+    };
+
+    enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = ARMAssembler::EQ,
+        DoubleNotEqual = ARMAssembler::NE | DoubleConditionBitSpecial,
+        DoubleGreaterThan = ARMAssembler::GT,
+        DoubleGreaterThanOrEqual = ARMAssembler::GE,
+        DoubleLessThan = ARMAssembler::CC,
+        DoubleLessThanOrEqual = ARMAssembler::LS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMAssembler::EQ | DoubleConditionBitSpecial,
+        DoubleNotEqualOrUnordered = ARMAssembler::NE,
+        DoubleGreaterThanOrUnordered = ARMAssembler::HI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMAssembler::CS,
+        DoubleLessThanOrUnordered = ARMAssembler::LT,
+        DoubleLessThanOrEqualOrUnordered = ARMAssembler::LE,
+    };
+
+    static const RegisterID stackPointerRegister = ARMRegisters::sp;
+    static const RegisterID framePointerRegister = ARMRegisters::fp;
+    static const RegisterID linkRegister = ARMRegisters::lr;
+
+    static const Scale ScalePtr = TimesFour;
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.adds(dest, dest, src);
+    }
+
+    void add32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.adds(dest, op1, op2);
+    }
+
+    void add32(TrustedImm32 imm, Address address)
+    {
+        load32(address, ARMRegisters::S1);
+        add32(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.adds(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void add32(AbsoluteAddress src, RegisterID dest)
+    {
+        move(TrustedImmPtr(src.m_ptr), ARMRegisters::S1);
+        m_assembler.dtrUp(ARMAssembler::LoadUint32, ARMRegisters::S1, ARMRegisters::S1, 0);
+        add32(ARMRegisters::S1, dest);
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, ARMRegisters::S1);
+        add32(ARMRegisters::S1, dest);
+    }
+
+    void add32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.adds(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.bitAnds(dest, dest, src);
+    }
+
+    void and32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.bitAnds(dest, op1, op2);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID dest)
+    {
+        ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
+        if (w & ARMAssembler::Op2InvertedImmediate)
+            m_assembler.bics(dest, dest, w & ~ARMAssembler::Op2InvertedImmediate);
+        else
+            m_assembler.bitAnds(dest, dest, w);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
+        if (w & ARMAssembler::Op2InvertedImmediate)
+            m_assembler.bics(dest, src, w & ~ARMAssembler::Op2InvertedImmediate);
+        else
+            m_assembler.bitAnds(dest, src, w);
+    }
+
+    void and32(Address src, RegisterID dest)
+    {
+        load32(src, ARMRegisters::S1);
+        and32(ARMRegisters::S1, dest);
+    }
+
+    void lshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        lshift32(dest, shiftAmount, dest);
+    }
+
+    void lshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        ARMWord w = ARMAssembler::getOp2Byte(0x1f);
+        m_assembler.bitAnd(ARMRegisters::S0, shiftAmount, w);
+
+        m_assembler.movs(dest, m_assembler.lslRegister(src, ARMRegisters::S0));
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.movs(dest, m_assembler.lsl(dest, imm.m_value & 0x1f));
+    }
+
+    void lshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.movs(dest, m_assembler.lsl(src, imm.m_value & 0x1f));
+    }
+
+    void mul32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest) {
+            if (op1 == dest) {
+                move(op2, ARMRegisters::S0);
+                op2 = ARMRegisters::S0;
+            } else {
+                // Swap the operands.
+                RegisterID tmp = op1;
+                op1 = op2;
+                op2 = tmp;
+            }
+        }
+        m_assembler.muls(dest, op1, op2);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        mul32(src, dest, dest);
+    }
+
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(imm, ARMRegisters::S0);
+        m_assembler.muls(dest, src, ARMRegisters::S0);
+    }
+
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.rsbs(srcDest, srcDest, ARMAssembler::getOp2Byte(0));
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orrs(dest, dest, src);
+    }
+
+    void or32(RegisterID src, AbsoluteAddress dest)
+    {
+        move(TrustedImmPtr(dest.m_ptr), ARMRegisters::S0);
+        load32(Address(ARMRegisters::S0), ARMRegisters::S1);
+        or32(src, ARMRegisters::S1);
+        store32(ARMRegisters::S1, ARMRegisters::S0);
+    }
+
+    void or32(TrustedImm32 imm, AbsoluteAddress dest)
+    {
+        move(TrustedImmPtr(dest.m_ptr), ARMRegisters::S0);
+        load32(Address(ARMRegisters::S0), ARMRegisters::S1);
+        or32(imm, ARMRegisters::S1); // It uses S0 as temporary register, we need to reload the address.
+        move(TrustedImmPtr(dest.m_ptr), ARMRegisters::S0);
+        store32(ARMRegisters::S1, ARMRegisters::S0);
+    }
+
+    void or32(TrustedImm32 imm, Address address)
+    {
+        load32(address, ARMRegisters::S0);
+        or32(imm, ARMRegisters::S0, ARMRegisters::S0);
+        store32(ARMRegisters::S0, address);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT(dest != ARMRegisters::S0);
+        m_assembler.orrs(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        ASSERT(src != ARMRegisters::S0);
+        m_assembler.orrs(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void or32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.orrs(dest, op1, op2);
+    }
+
+    void rshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        rshift32(dest, shiftAmount, dest);
+    }
+
+    void rshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        ARMWord w = ARMAssembler::getOp2Byte(0x1f);
+        m_assembler.bitAnd(ARMRegisters::S0, shiftAmount, w);
+
+        m_assembler.movs(dest, m_assembler.asrRegister(src, ARMRegisters::S0));
+    }
+
+    void rshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        rshift32(dest, imm, dest);
+    }
+
+    void rshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            move(src, dest);
+        else
+            m_assembler.movs(dest, m_assembler.asr(src, imm.m_value & 0x1f));
+    }
+
+    void urshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        urshift32(dest, shiftAmount, dest);
+    }
+
+    void urshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        ARMWord w = ARMAssembler::getOp2Byte(0x1f);
+        m_assembler.bitAnd(ARMRegisters::S0, shiftAmount, w);
+
+        m_assembler.movs(dest, m_assembler.lsrRegister(src, ARMRegisters::S0));
+    }
+
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.movs(dest, m_assembler.lsr(dest, imm.m_value & 0x1f));
+    }
+    
+    void urshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            move(src, dest);
+        else
+            m_assembler.movs(dest, m_assembler.lsr(src, imm.m_value & 0x1f));
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subs(dest, dest, src);
+    }
+
+    void sub32(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.subs(dest, left, right);
+    }
+
+    void sub32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.subs(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void sub32(TrustedImm32 imm, Address address)
+    {
+        load32(address, ARMRegisters::S1);
+        sub32(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, ARMRegisters::S1);
+        sub32(ARMRegisters::S1, dest);
+    }
+
+    void sub32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.subs(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.eors(dest, dest, src);
+    }
+
+    void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.eors(dest, op1, op2);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value == -1)
+            m_assembler.mvns(dest, dest);
+        else
+            m_assembler.eors(dest, dest, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (imm.m_value == -1)
+            m_assembler.mvns(dest, src);
+        else    
+            m_assembler.eors(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void countLeadingZeros32(RegisterID src, RegisterID dest)
+    {
+#if WTF_ARM_ARCH_AT_LEAST(5)
+        m_assembler.clz(dest, src);
+#else
+        UNUSED_PARAM(src);
+        UNUSED_PARAM(dest);
+        RELEASE_ASSERT_NOT_REACHED();
+#endif
+    }
+
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.dataTransfer32(ARMAssembler::LoadUint8, dest, address.base, address.offset);
+    }
+
+    void load8(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.baseIndexTransfer32(ARMAssembler::LoadUint8, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void load8(const void* address, RegisterID dest)
+    {
+        move(TrustedImmPtr(address), ARMRegisters::S0);
+        m_assembler.dataTransfer32(ARMAssembler::LoadUint8, dest, ARMRegisters::S0, 0);
+    }
+
+    void load8SignedExtendTo32(Address address, RegisterID dest)
+    {
+        m_assembler.dataTransfer16(ARMAssembler::LoadInt8, dest, address.base, address.offset);
+    }
+
+    void load8SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.baseIndexTransfer16(ARMAssembler::LoadInt8, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void load16(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.dataTransfer16(ARMAssembler::LoadUint16, dest, address.base, address.offset);
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.baseIndexTransfer16(ARMAssembler::LoadUint16, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void load16SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.baseIndexTransfer16(ARMAssembler::LoadInt16, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.dataTransfer32(ARMAssembler::LoadUint32, dest, address.base, address.offset);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.baseIndexTransfer32(ARMAssembler::LoadUint32, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+#if CPU(ARMV5_OR_LOWER)
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest);
+#else
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+#endif
+
+    void load16Unaligned(BaseIndex address, RegisterID dest)
+    {
+        load16(address, dest);
+    }
+
+    void abortWithReason(AbortReason reason)
+    {
+        move(TrustedImm32(reason), ARMRegisters::S0);
+        breakpoint();
+    }
+
+    void abortWithReason(AbortReason reason, intptr_t misc)
+    {
+        move(TrustedImm32(misc), ARMRegisters::S1);
+        abortWithReason(reason);
+    }
+
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result(this);
+        ASSERT(address.offset >= 0 && address.offset <= 255);
+        m_assembler.dtrUp(ARMAssembler::LoadUint32, dest, address.base, address.offset);
+        return result;
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabel32 dataLabel(this);
+        m_assembler.ldrUniqueImmediate(ARMRegisters::S0, 0);
+        m_assembler.dtrUpRegister(ARMAssembler::LoadUint32, dest, address.base, ARMRegisters::S0);
+        return dataLabel;
+    }
+
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return value >= -4095 && value <= 4095;
+    }
+
+    DataLabelCompact load32WithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabelCompact dataLabel(this);
+        ASSERT(isCompactPtrAlignedAddressOffset(address.offset));
+        if (address.offset >= 0)
+            m_assembler.dtrUp(ARMAssembler::LoadUint32, dest, address.base, address.offset);
+        else
+            m_assembler.dtrDown(ARMAssembler::LoadUint32, dest, address.base, address.offset);
+        return dataLabel;
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        DataLabel32 dataLabel(this);
+        m_assembler.ldrUniqueImmediate(ARMRegisters::S0, 0);
+        m_assembler.dtrUpRegister(ARMAssembler::StoreUint32, src, address.base, ARMRegisters::S0);
+        return dataLabel;
+    }
+
+    void store8(RegisterID src, BaseIndex address)
+    {
+        m_assembler.baseIndexTransfer32(ARMAssembler::StoreUint8, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void store8(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.dtrUp(ARMAssembler::StoreUint8, src, address.base, address.offset);
+    }
+
+    void store8(RegisterID src, const void* address)
+    {
+        move(TrustedImmPtr(address), ARMRegisters::S0);
+        m_assembler.dtrUp(ARMAssembler::StoreUint8, src, ARMRegisters::S0, 0);
+    }
+
+    void store8(TrustedImm32 imm, ImplicitAddress address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        move(imm8, ARMRegisters::S1);
+        store8(ARMRegisters::S1, address);
+    }
+
+    void store8(TrustedImm32 imm, const void* address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        move(TrustedImm32(reinterpret_cast<ARMWord>(address)), ARMRegisters::S0);
+        move(imm8, ARMRegisters::S1);
+        m_assembler.dtrUp(ARMAssembler::StoreUint8, ARMRegisters::S1, ARMRegisters::S0, 0);
+    }
+
+    void store16(RegisterID src, BaseIndex address)
+    {
+        m_assembler.baseIndexTransfer16(ARMAssembler::StoreUint16, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.dataTransfer32(ARMAssembler::StoreUint32, src, address.base, address.offset);
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        m_assembler.baseIndexTransfer32(ARMAssembler::StoreUint32, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void store32(TrustedImm32 imm, ImplicitAddress address)
+    {
+        move(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
+    }
+
+    void store32(TrustedImm32 imm, BaseIndex address)
+    {
+        move(imm, ARMRegisters::S1);
+        m_assembler.baseIndexTransfer32(ARMAssembler::StoreUint32, ARMRegisters::S1, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void store32(RegisterID src, const void* address)
+    {
+        m_assembler.ldrUniqueImmediate(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
+        m_assembler.dtrUp(ARMAssembler::StoreUint32, src, ARMRegisters::S0, 0);
+    }
+
+    void store32(TrustedImm32 imm, const void* address)
+    {
+        m_assembler.ldrUniqueImmediate(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
+        m_assembler.moveImm(imm.m_value, ARMRegisters::S1);
+        m_assembler.dtrUp(ARMAssembler::StoreUint32, ARMRegisters::S1, ARMRegisters::S0, 0);
+    }
+
+    void pop(RegisterID dest)
+    {
+        m_assembler.pop(dest);
+    }
+
+    void popPair(RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.pop(dest1);
+        m_assembler.pop(dest2);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.push(src);
+    }
+
+    void push(Address address)
+    {
+        load32(address, ARMRegisters::S1);
+        push(ARMRegisters::S1);
+    }
+
+    void push(TrustedImm32 imm)
+    {
+        move(imm, ARMRegisters::S0);
+        push(ARMRegisters::S0);
+    }
+
+    void pushPair(RegisterID src1, RegisterID src2)
+    {
+        m_assembler.push(src2);
+        m_assembler.push(src1);
+    }
+
+    void move(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.moveImm(imm.m_value, dest);
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.mov(dest, src);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        move(TrustedImm32(imm), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        xor32(reg1, reg2);
+        xor32(reg2, reg1);
+        xor32(reg1, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+    }
+
+    Jump branch8(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right8);
+    }
+
+    Jump branch8(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right8);
+    }
+
+    Jump branch8(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        move(TrustedImmPtr(left.m_ptr), ARMRegisters::S1);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, Address(ARMRegisters::S1), ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right8);
+    }
+
+    Jump branchPtr(RelationalCondition cond, BaseIndex left, RegisterID right)
+    {
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, RegisterID right, int useConstantPool = 0)
+    {
+        m_assembler.cmp(left, right);
+        return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, TrustedImm32 right, int useConstantPool = 0)
+    {
+        internalCompare32(left, right);
+        return Jump(m_assembler.jmp(ARMCondition(cond), useConstantPool));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, Address right)
+    {
+        load32(right, ARMRegisters::S1);
+        return branch32(cond, left, ARMRegisters::S1);
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, RegisterID right)
+    {
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
+    Jump branch32(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        load32(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
+    Jump branch32WithUnalignedHalfWords(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        load32WithUnalignedHalfWords(left, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
+    Jump branchTest8(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        move(TrustedImmPtr(address.m_ptr), ARMRegisters::S1);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, Address(ARMRegisters::S1), ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask8);
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT(cond == Zero || cond == NonZero || cond == Signed || cond == PositiveOrZero);
+        m_assembler.tst(reg, mask);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT(cond == Zero || cond == NonZero || cond == Signed || cond == PositiveOrZero);
+        ARMWord w = m_assembler.getImm(mask.m_value, ARMRegisters::S0, true);
+        if (w & ARMAssembler::Op2InvertedImmediate)
+            m_assembler.bics(ARMRegisters::S0, reg, w & ~ARMAssembler::Op2InvertedImmediate);
+        else
+            m_assembler.tst(reg, w);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchTest32(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load32(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
+    }
+
+    Jump branchTest32(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load32(address, ARMRegisters::S1);
+        return branchTest32(cond, ARMRegisters::S1, mask);
+    }
+
+    Jump jump()
+    {
+        return Jump(m_assembler.jmp());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.bx(target);
+    }
+
+    void jump(Address address)
+    {
+        load32(address, ARMRegisters::pc);
+    }
+
+    void jump(AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), ARMRegisters::S0);
+        load32(Address(ARMRegisters::S0, 0), ARMRegisters::pc);
+    }
+
+    void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.vmov(dest1, dest2, src);
+    }
+
+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID)
+    {
+        m_assembler.vmov(dest, src1, src2);
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero)
+            || (cond == NonZero) || (cond == PositiveOrZero));
+        add32(src, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero)
+            || (cond == NonZero) || (cond == PositiveOrZero));
+        add32(op1, op2, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero)
+            || (cond == NonZero) || (cond == PositiveOrZero));
+        add32(imm, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero)
+            || (cond == NonZero) || (cond == PositiveOrZero));
+        add32(src, imm, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero)
+            || (cond == NonZero) || (cond == PositiveOrZero));
+        add32(imm, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, Address src, RegisterID dest)
+    {
+        load32(src, ARMRegisters::S0);
+        return branchAdd32(cond, dest, ARMRegisters::S0, dest);
+    }
+    void mull32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest) {
+            if (op1 == dest) {
+                move(op2, ARMRegisters::S0);
+                op2 = ARMRegisters::S0;
+            } else {
+                // Swap the operands.
+                RegisterID tmp = op1;
+                op1 = op2;
+                op2 = tmp;
+            }
+        }
+        m_assembler.mull(ARMRegisters::S1, dest, op1, op2);
+        m_assembler.cmp(ARMRegisters::S1, m_assembler.asr(dest, 31));
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            mull32(src1, src2, dest);
+            cond = NonZero;
+        }
+        else
+            mul32(src1, src2, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchMul32(cond, src, dest, dest);
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            move(imm, ARMRegisters::S0);
+            mull32(ARMRegisters::S0, src, dest);
+            cond = NonZero;
+        }
+        else
+            mul32(imm, src, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        sub32(src, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        sub32(imm, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        sub32(src, imm, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        m_assembler.subs(dest, op1, op2);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchNeg32(ResultCondition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        neg32(srcDest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+        or32(src, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    PatchableJump patchableJump()
+    {
+        return PatchableJump(m_assembler.jmp(ARMAssembler::AL, 1));
+    }
+
+    PatchableJump patchableBranch32(RelationalCondition cond, RegisterID reg, TrustedImm32 imm)
+    {
+        internalCompare32(reg, imm);
+        Jump jump(m_assembler.loadBranchTarget(ARMRegisters::S1, ARMCondition(cond), true));
+        m_assembler.bx(ARMRegisters::S1, ARMCondition(cond));
+        return PatchableJump(jump);
+    }
+
+    PatchableJump patchableBranch32(RelationalCondition cond, Address address, TrustedImm32 imm)
+    {
+        internalCompare32(address, imm);
+        Jump jump(m_assembler.loadBranchTarget(ARMRegisters::S1, ARMCondition(cond), false));
+        m_assembler.bx(ARMRegisters::S1, ARMCondition(cond));
+        return PatchableJump(jump);
+    }
+
+    void breakpoint()
+    {
+        m_assembler.bkpt(0);
+    }
+
+    Call nearCall()
+    {
+        m_assembler.loadBranchTarget(ARMRegisters::S1, ARMAssembler::AL, true);
+        return Call(m_assembler.blx(ARMRegisters::S1), Call::LinkableNear);
+    }
+
+    Call nearTailCall()
+    {
+        return Call(m_assembler.jmp(), Call::LinkableNearTail);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.blx(target), Call::None);
+    }
+
+    void call(Address address)
+    {
+        call32(address.base, address.offset);
+    }
+
+    void ret()
+    {
+        m_assembler.bx(linkRegister);
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmp(left, right);
+        m_assembler.mov(dest, ARMAssembler::getOp2Byte(0));
+        m_assembler.mov(dest, ARMAssembler::getOp2Byte(1), ARMCondition(cond));
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        m_assembler.cmp(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+        m_assembler.mov(dest, ARMAssembler::getOp2Byte(0));
+        m_assembler.mov(dest, ARMAssembler::getOp2Byte(1), ARMCondition(cond));
+    }
+
+    void compare8(RelationalCondition cond, Address left, TrustedImm32 right, RegisterID dest)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, ARMRegisters::S1);
+        compare32(cond, ARMRegisters::S1, right8, dest);
+    }
+
+    void test32(ResultCondition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest)
+    {
+        if (mask.m_value == -1)
+            m_assembler.tst(reg, reg);
+        else
+            m_assembler.tst(reg, m_assembler.getImm(mask.m_value, ARMRegisters::S0));
+        m_assembler.mov(dest, ARMAssembler::getOp2Byte(0));
+        m_assembler.mov(dest, ARMAssembler::getOp2Byte(1), ARMCondition(cond));
+    }
+
+    void test32(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        load32(address, ARMRegisters::S1);
+        test32(cond, ARMRegisters::S1, mask, dest);
+    }
+
+    void test8(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, ARMRegisters::S1);
+        test32(cond, ARMRegisters::S1, mask8, dest);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.add(dest, src, m_assembler.getImm(imm.m_value, ARMRegisters::S0));
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, ARMRegisters::S1);
+        add32(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address.m_ptr);
+    }
+
+    void add64(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        ARMWord tmp;
+
+        move(TrustedImmPtr(address.m_ptr), ARMRegisters::S1);
+        m_assembler.dtrUp(ARMAssembler::LoadUint32, ARMRegisters::S0, ARMRegisters::S1, 0);
+
+        if ((tmp = ARMAssembler::getOp2(imm.m_value)) != ARMAssembler::InvalidImmediate)
+            m_assembler.adds(ARMRegisters::S0, ARMRegisters::S0, tmp);
+        else if ((tmp = ARMAssembler::getOp2(-imm.m_value)) != ARMAssembler::InvalidImmediate)
+            m_assembler.subs(ARMRegisters::S0, ARMRegisters::S0, tmp);
+        else {
+            m_assembler.adds(ARMRegisters::S0, ARMRegisters::S0, m_assembler.getImm(imm.m_value, ARMRegisters::S1));
+            move(TrustedImmPtr(address.m_ptr), ARMRegisters::S1);
+        }
+        m_assembler.dtrUp(ARMAssembler::StoreUint32, ARMRegisters::S0, ARMRegisters::S1, 0);
+
+        m_assembler.dtrUp(ARMAssembler::LoadUint32, ARMRegisters::S0, ARMRegisters::S1, sizeof(ARMWord));
+        if (imm.m_value >= 0)
+            m_assembler.adc(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(0));
+        else
+            m_assembler.sbc(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(0));
+        m_assembler.dtrUp(ARMAssembler::StoreUint32, ARMRegisters::S0, ARMRegisters::S1, sizeof(ARMWord));
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, ARMRegisters::S1);
+        sub32(imm, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address.m_ptr);
+    }
+
+    void load32(const void* address, RegisterID dest)
+    {
+        m_assembler.ldrUniqueImmediate(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
+        m_assembler.dtrUp(ARMAssembler::LoadUint32, dest, ARMRegisters::S0, 0);
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        load32(left.m_ptr, ARMRegisters::S1);
+        return branch32(cond, ARMRegisters::S1, right);
+    }
+
+    void relativeTableJump(RegisterID index, int scale)
+    {
+        ASSERT(scale >= 0 && scale <= 31);
+        m_assembler.add(ARMRegisters::pc, ARMRegisters::pc, m_assembler.lsl(index, scale));
+
+        // NOP the default prefetching
+        m_assembler.mov(ARMRegisters::r0, ARMRegisters::r0);
+    }
+
+    Call call()
+    {
+        ensureSpace(2 * sizeof(ARMWord), sizeof(ARMWord));
+        m_assembler.loadBranchTarget(ARMRegisters::S1, ARMAssembler::AL, true);
+        return Call(m_assembler.blx(ARMRegisters::S1), Call::Linkable);
+    }
+
+    Call tailRecursiveCall()
+    {
+        return Call::fromTailJump(jump());
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        return Call::fromTailJump(oldJump);
+    }
+
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
+    {
+        DataLabelPtr dataLabel(this);
+        m_assembler.ldrUniqueImmediate(dest, reinterpret_cast<ARMWord>(initialValue.m_value));
+        return dataLabel;
+    }
+
+    DataLabel32 moveWithPatch(TrustedImm32 initialValue, RegisterID dest)
+    {
+        DataLabel32 dataLabel(this);
+        m_assembler.ldrUniqueImmediate(dest, static_cast<ARMWord>(initialValue.m_value));
+        return dataLabel;
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        ensureSpace(3 * sizeof(ARMWord), 2 * sizeof(ARMWord));
+        dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S1);
+        Jump jump = branch32(cond, left, ARMRegisters::S1, true);
+        return jump;
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        load32(left, ARMRegisters::S1);
+        ensureSpace(3 * sizeof(ARMWord), 2 * sizeof(ARMWord));
+        dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S0);
+        Jump jump = branch32(cond, ARMRegisters::S0, ARMRegisters::S1, true);
+        return jump;
+    }
+
+    Jump branch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        load32(left, ARMRegisters::S1);
+        ensureSpace(3 * sizeof(ARMWord), 2 * sizeof(ARMWord));
+        dataLabel = moveWithPatch(initialRightValue, ARMRegisters::S0);
+        Jump jump = branch32(cond, ARMRegisters::S0, ARMRegisters::S1, true);
+        return jump;
+    }
+
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        DataLabelPtr dataLabel = moveWithPatch(initialValue, ARMRegisters::S1);
+        store32(ARMRegisters::S1, address);
+        return dataLabel;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address)
+    {
+        return storePtrWithPatch(TrustedImmPtr(0), address);
+    }
+
+    // Floating point operators
+    static bool supportsFloatingPoint()
+    {
+        return s_isVFPPresent;
+    }
+
+    static bool supportsFloatingPointTruncate()
+    {
+        return false;
+    }
+
+    static bool supportsFloatingPointSqrt()
+    {
+        return s_isVFPPresent;
+    }
+    static bool supportsFloatingPointAbs() { return false; }
+    static bool supportsFloatingPointRounding() { return false; }
+
+    void loadFloat(BaseIndex address, FPRegisterID dest)
+    {
+        m_assembler.baseIndexTransferFloat(ARMAssembler::LoadFloat, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        m_assembler.dataTransferFloat(ARMAssembler::LoadDouble, dest, address.base, address.offset);
+    }
+
+    void loadDouble(BaseIndex address, FPRegisterID dest)
+    {
+        m_assembler.baseIndexTransferFloat(ARMAssembler::LoadDouble, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
+    {
+        move(TrustedImm32(reinterpret_cast<ARMWord>(address.m_value)), ARMRegisters::S0);
+        m_assembler.doubleDtrUp(ARMAssembler::LoadDouble, dest, ARMRegisters::S0, 0);
+    }
+
+    NO_RETURN_DUE_TO_CRASH void ceilDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    NO_RETURN_DUE_TO_CRASH void floorDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    NO_RETURN_DUE_TO_CRASH void roundTowardZeroDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    void storeFloat(FPRegisterID src, BaseIndex address)
+    {
+        m_assembler.baseIndexTransferFloat(ARMAssembler::StoreFloat, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        m_assembler.dataTransferFloat(ARMAssembler::StoreDouble, src, address.base, address.offset);
+    }
+
+    void storeDouble(FPRegisterID src, BaseIndex address)
+    {
+        m_assembler.baseIndexTransferFloat(ARMAssembler::StoreDouble, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void storeDouble(FPRegisterID src, TrustedImmPtr address)
+    {
+        move(TrustedImm32(reinterpret_cast<ARMWord>(address.m_value)), ARMRegisters::S0);
+        m_assembler.dataTransferFloat(ARMAssembler::StoreDouble, src, ARMRegisters::S0, 0);
+    }
+
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.vmov_f64(dest, src);
+    }
+
+    void moveZeroToDouble(FPRegisterID reg)
+    {
+        static double zeroConstant = 0.;
+        loadDouble(TrustedImmPtr(&zeroConstant), reg);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vadd_f64(dest, dest, src);
+    }
+
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vadd_f64(dest, op1, op2);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, ARMRegisters::SD0);
+        addDouble(ARMRegisters::SD0, dest);
+    }
+
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        loadDouble(TrustedImmPtr(address.m_ptr), ARMRegisters::SD0);
+        addDouble(ARMRegisters::SD0, dest);
+    }
+
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vdiv_f64(dest, dest, src);
+    }
+
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vdiv_f64(dest, op1, op2);
+    }
+
+    void divDouble(Address src, FPRegisterID dest)
+    {
+        RELEASE_ASSERT_NOT_REACHED(); // Untested
+        loadDouble(src, ARMRegisters::SD0);
+        divDouble(ARMRegisters::SD0, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vsub_f64(dest, dest, src);
+    }
+
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vsub_f64(dest, op1, op2);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, ARMRegisters::SD0);
+        subDouble(ARMRegisters::SD0, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vmul_f64(dest, dest, src);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, ARMRegisters::SD0);
+        mulDouble(ARMRegisters::SD0, dest);
+    }
+
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vmul_f64(dest, op1, op2);
+    }
+
+    void sqrtDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vsqrt_f64(dest, src);
+    }
+    
+    void absDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vabs_f64(dest, src);
+    }
+
+    void negateDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vneg_f64(dest, src);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vmov_vfp32(dest << 1, src);
+        m_assembler.vcvt_f64_s32(dest, dest << 1);
+    }
+
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        load32(src, ARMRegisters::S1);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        move(TrustedImmPtr(src.m_ptr), ARMRegisters::S1);
+        load32(Address(ARMRegisters::S1), ARMRegisters::S1);
+        convertInt32ToDouble(ARMRegisters::S1, dest);
+    }
+
+    void convertFloatToDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.vcvt_f64_f32(dst, src);
+    }
+
+    void convertDoubleToFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.vcvt_f32_f64(dst, src);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        m_assembler.vcmp_f64(left, right);
+        m_assembler.vmrs_apsr();
+        if (cond & DoubleConditionBitSpecial)
+            m_assembler.cmp(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::VS);
+        return Jump(m_assembler.jmp(static_cast<ARMAssembler::Condition>(cond & ~DoubleConditionMask)));
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MIN).
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        truncateDoubleToInt32(src, dest);
+
+        m_assembler.add(ARMRegisters::S0, dest, ARMAssembler::getOp2Byte(1));
+        m_assembler.bic(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(1));
+
+        ARMWord w = ARMAssembler::getOp2(0x80000000);
+        ASSERT(w != ARMAssembler::InvalidImmediate);
+        m_assembler.cmp(ARMRegisters::S0, w);
+        return Jump(m_assembler.jmp(branchType == BranchIfTruncateFailed ? ARMAssembler::EQ : ARMAssembler::NE));
+    }
+
+    Jump branchTruncateDoubleToUint32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        truncateDoubleToUint32(src, dest);
+
+        m_assembler.add(ARMRegisters::S0, dest, ARMAssembler::getOp2Byte(1));
+        m_assembler.bic(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(1));
+
+        m_assembler.cmp(ARMRegisters::S0, ARMAssembler::getOp2Byte(0));
+        return Jump(m_assembler.jmp(branchType == BranchIfTruncateFailed ? ARMAssembler::EQ : ARMAssembler::NE));
+    }
+
+    // Result is undefined if the value is outside of the integer range.
+    void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.vcvt_s32_f64(ARMRegisters::SD0 << 1, src);
+        m_assembler.vmov_arm32(dest, ARMRegisters::SD0 << 1);
+    }
+
+    void truncateDoubleToUint32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.vcvt_u32_f64(ARMRegisters::SD0 << 1, src);
+        m_assembler.vmov_arm32(dest, ARMRegisters::SD0 << 1);
+    }
+
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID, bool negZeroCheck = true)
+    {
+        m_assembler.vcvt_s32_f64(ARMRegisters::SD0 << 1, src);
+        m_assembler.vmov_arm32(dest, ARMRegisters::SD0 << 1);
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        m_assembler.vcvt_f64_s32(ARMRegisters::SD0, ARMRegisters::SD0 << 1);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, ARMRegisters::SD0));
+
+        // If the result is zero, it might have been -0.0, and 0.0 equals to -0.0
+        if (negZeroCheck)
+            failureCases.append(branchTest32(Zero, dest));
+    }
+
+    Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.mov(ARMRegisters::S0, ARMAssembler::getOp2Byte(0));
+        convertInt32ToDouble(ARMRegisters::S0, scratch);
+        return branchDouble(DoubleNotEqual, reg, scratch);
+    }
+
+    Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.mov(ARMRegisters::S0, ARMAssembler::getOp2Byte(0));
+        convertInt32ToDouble(ARMRegisters::S0, scratch);
+        return branchDouble(DoubleEqualOrUnordered, reg, scratch);
+    }
+
+    // Invert a relational condition, e.g. == becomes !=, < becomes >=, etc.
+    static RelationalCondition invert(RelationalCondition cond)
+    {
+        ASSERT((static_cast<uint32_t>(cond & 0x0fffffff)) == 0 && static_cast<uint32_t>(cond) < static_cast<uint32_t>(ARMAssembler::AL));
+        return static_cast<RelationalCondition>(cond ^ 0x10000000);
+    }
+
+    void nop()
+    {
+        m_assembler.nop();
+    }
+
+    void memoryFence()
+    {
+        m_assembler.dmbSY();
+    }
+
+    void storeFence()
+    {
+        m_assembler.dmbISHST();
+    }
+
+    static FunctionPtr readCallTarget(CodeLocationCall call)
+    {
+        return FunctionPtr(reinterpret_cast<void(*)()>(ARMAssembler::readCallTarget(call.dataLocation())));
+    }
+
+    static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)
+    {
+        ARMAssembler::replaceWithJump(instructionStart.dataLocation(), destination.dataLocation());
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return ARMAssembler::maxJumpReplacementSize();
+    }
+
+    static ptrdiff_t patchableJumpSize()
+    {
+        return ARMAssembler::patchableJumpSize();
+    }
+
+    static bool canJumpReplacePatchableBranchPtrWithPatch() { return false; }
+    static bool canJumpReplacePatchableBranch32WithPatch() { return false; }
+
+    static CodeLocationLabel startOfPatchableBranch32WithPatchOnAddress(CodeLocationDataLabel32)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+
+    static CodeLocationLabel startOfPatchableBranchPtrWithPatchOnAddress(CodeLocationDataLabelPtr)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+
+    static CodeLocationLabel startOfBranchPtrWithPatchOnRegister(CodeLocationDataLabelPtr label)
+    {
+        return label.labelAtOffset(0);
+    }
+
+    static void revertJumpReplacementToBranchPtrWithPatch(CodeLocationLabel instructionStart, RegisterID reg, void* initialValue)
+    {
+        ARMAssembler::revertBranchPtrWithPatch(instructionStart.dataLocation(), reg, reinterpret_cast<uintptr_t>(initialValue) & 0xffff);
+    }
+
+    static void revertJumpReplacementToPatchableBranch32WithPatch(CodeLocationLabel, Address, int32_t)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void revertJumpReplacementToPatchableBranchPtrWithPatch(CodeLocationLabel, Address, void*)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        ARMAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        ARMAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+#if ENABLE(MASM_PROBE)
+    void probe(ProbeFunction, void* arg1, void* arg2);
+#endif // ENABLE(MASM_PROBE)
+
+protected:
+    ARMAssembler::Condition ARMCondition(RelationalCondition cond)
+    {
+        return static_cast<ARMAssembler::Condition>(cond);
+    }
+
+    ARMAssembler::Condition ARMCondition(ResultCondition cond)
+    {
+        return static_cast<ARMAssembler::Condition>(cond);
+    }
+
+    void ensureSpace(int insnSpace, int constSpace)
+    {
+        m_assembler.ensureSpace(insnSpace, constSpace);
+    }
+
+    int sizeOfConstantPool()
+    {
+        return m_assembler.sizeOfConstantPool();
+    }
+
+    void call32(RegisterID base, int32_t offset)
+    {
+        load32(Address(base, offset), ARMRegisters::S1);
+        m_assembler.blx(ARMRegisters::S1);
+    }
+
+private:
+    friend class LinkBuffer;
+
+    void internalCompare32(RegisterID left, TrustedImm32 right)
+    {
+        ARMWord tmp = (static_cast<unsigned>(right.m_value) == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
+        if (tmp != ARMAssembler::InvalidImmediate)
+            m_assembler.cmn(left, tmp);
+        else
+            m_assembler.cmp(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+    }
+
+    void internalCompare32(Address left, TrustedImm32 right)
+    {
+        ARMWord tmp = (static_cast<unsigned>(right.m_value) == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
+        load32(left, ARMRegisters::S1);
+        if (tmp != ARMAssembler::InvalidImmediate)
+            m_assembler.cmn(ARMRegisters::S1, tmp);
+        else
+            m_assembler.cmp(ARMRegisters::S1, m_assembler.getImm(right.m_value, ARMRegisters::S0));
+    }
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        if (call.isFlagSet(Call::Tail))
+            ARMAssembler::linkJump(code, call.m_label, function.value());
+        else
+            ARMAssembler::linkCall(code, call.m_label, function.value());
+    }
+
+
+#if ENABLE(MASM_PROBE)
+    inline TrustedImm32 trustedImm32FromPtr(void* ptr)
+    {
+        return TrustedImm32(TrustedImmPtr(ptr));
+    }
+
+    inline TrustedImm32 trustedImm32FromPtr(ProbeFunction function)
+    {
+        return TrustedImm32(TrustedImmPtr(reinterpret_cast<void*>(function)));
+    }
+
+    inline TrustedImm32 trustedImm32FromPtr(void (*function)())
+    {
+        return TrustedImm32(TrustedImmPtr(reinterpret_cast<void*>(function)));
+    }
+#endif
+
+    static const bool s_isVFPPresent;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
diff --git a/assembler/MacroAssemblerARM64.cpp b/assembler/MacroAssemblerARM64.cpp
new file mode 100644
index 0000000..8e7b51b
--- /dev/null
+++ b/assembler/MacroAssemblerARM64.cpp
@@ -0,0 +1,507 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && CPU(ARM64)
+#include "MacroAssemblerARM64.h"
+
+#include <wtf/InlineASM.h>
+
+namespace JSC {
+
+#if ENABLE(MASM_PROBE)
+
+extern "C" void ctiMasmProbeTrampoline();
+
+using namespace ARM64Registers;
+
+#if COMPILER(GCC_OR_CLANG)
+
+// The following are offsets for MacroAssemblerARM64::ProbeContext fields accessed
+// by the ctiMasmProbeTrampoline stub.
+#define PTR_SIZE 8
+#define PROBE_PROBE_FUNCTION_OFFSET (0 * PTR_SIZE)
+#define PROBE_ARG1_OFFSET (1 * PTR_SIZE)
+#define PROBE_ARG2_OFFSET (2 * PTR_SIZE)
+
+#define PROBE_FIRST_GPREG_OFFSET (3 * PTR_SIZE)
+
+#define GPREG_SIZE 8
+#define PROBE_CPU_X0_OFFSET (PROBE_FIRST_GPREG_OFFSET + (0 * GPREG_SIZE))
+#define PROBE_CPU_X1_OFFSET (PROBE_FIRST_GPREG_OFFSET + (1 * GPREG_SIZE))
+#define PROBE_CPU_X2_OFFSET (PROBE_FIRST_GPREG_OFFSET + (2 * GPREG_SIZE))
+#define PROBE_CPU_X3_OFFSET (PROBE_FIRST_GPREG_OFFSET + (3 * GPREG_SIZE))
+#define PROBE_CPU_X4_OFFSET (PROBE_FIRST_GPREG_OFFSET + (4 * GPREG_SIZE))
+#define PROBE_CPU_X5_OFFSET (PROBE_FIRST_GPREG_OFFSET + (5 * GPREG_SIZE))
+#define PROBE_CPU_X6_OFFSET (PROBE_FIRST_GPREG_OFFSET + (6 * GPREG_SIZE))
+#define PROBE_CPU_X7_OFFSET (PROBE_FIRST_GPREG_OFFSET + (7 * GPREG_SIZE))
+#define PROBE_CPU_X8_OFFSET (PROBE_FIRST_GPREG_OFFSET + (8 * GPREG_SIZE))
+#define PROBE_CPU_X9_OFFSET (PROBE_FIRST_GPREG_OFFSET + (9 * GPREG_SIZE))
+#define PROBE_CPU_X10_OFFSET (PROBE_FIRST_GPREG_OFFSET + (10 * GPREG_SIZE))
+#define PROBE_CPU_X11_OFFSET (PROBE_FIRST_GPREG_OFFSET + (11 * GPREG_SIZE))
+#define PROBE_CPU_X12_OFFSET (PROBE_FIRST_GPREG_OFFSET + (12 * GPREG_SIZE))
+#define PROBE_CPU_X13_OFFSET (PROBE_FIRST_GPREG_OFFSET + (13 * GPREG_SIZE))
+#define PROBE_CPU_X14_OFFSET (PROBE_FIRST_GPREG_OFFSET + (14 * GPREG_SIZE))
+#define PROBE_CPU_X15_OFFSET (PROBE_FIRST_GPREG_OFFSET + (15 * GPREG_SIZE))
+#define PROBE_CPU_X16_OFFSET (PROBE_FIRST_GPREG_OFFSET + (16 * GPREG_SIZE))
+#define PROBE_CPU_X17_OFFSET (PROBE_FIRST_GPREG_OFFSET + (17 * GPREG_SIZE))
+#define PROBE_CPU_X18_OFFSET (PROBE_FIRST_GPREG_OFFSET + (18 * GPREG_SIZE))
+#define PROBE_CPU_X19_OFFSET (PROBE_FIRST_GPREG_OFFSET + (19 * GPREG_SIZE))
+#define PROBE_CPU_X20_OFFSET (PROBE_FIRST_GPREG_OFFSET + (20 * GPREG_SIZE))
+#define PROBE_CPU_X21_OFFSET (PROBE_FIRST_GPREG_OFFSET + (21 * GPREG_SIZE))
+#define PROBE_CPU_X22_OFFSET (PROBE_FIRST_GPREG_OFFSET + (22 * GPREG_SIZE))
+#define PROBE_CPU_X23_OFFSET (PROBE_FIRST_GPREG_OFFSET + (23 * GPREG_SIZE))
+#define PROBE_CPU_X24_OFFSET (PROBE_FIRST_GPREG_OFFSET + (24 * GPREG_SIZE))
+#define PROBE_CPU_X25_OFFSET (PROBE_FIRST_GPREG_OFFSET + (25 * GPREG_SIZE))
+#define PROBE_CPU_X26_OFFSET (PROBE_FIRST_GPREG_OFFSET + (26 * GPREG_SIZE))
+#define PROBE_CPU_X27_OFFSET (PROBE_FIRST_GPREG_OFFSET + (27 * GPREG_SIZE))
+#define PROBE_CPU_X28_OFFSET (PROBE_FIRST_GPREG_OFFSET + (28 * GPREG_SIZE))
+#define PROBE_CPU_FP_OFFSET (PROBE_FIRST_GPREG_OFFSET + (29 * GPREG_SIZE))
+#define PROBE_CPU_LR_OFFSET (PROBE_FIRST_GPREG_OFFSET + (30 * GPREG_SIZE))
+#define PROBE_CPU_SP_OFFSET (PROBE_FIRST_GPREG_OFFSET + (31 * GPREG_SIZE))
+
+#define PROBE_CPU_PC_OFFSET (PROBE_FIRST_GPREG_OFFSET + (32 * GPREG_SIZE))
+#define PROBE_CPU_NZCV_OFFSET (PROBE_FIRST_GPREG_OFFSET + (33 * GPREG_SIZE))
+#define PROBE_CPU_FPSR_OFFSET (PROBE_FIRST_GPREG_OFFSET + (34 * GPREG_SIZE))
+
+#define PROBE_FIRST_FPREG_OFFSET (PROBE_FIRST_GPREG_OFFSET + (35 * GPREG_SIZE))
+
+#define FPREG_SIZE 8
+#define PROBE_CPU_Q0_OFFSET (PROBE_FIRST_FPREG_OFFSET + (0 * FPREG_SIZE))
+#define PROBE_CPU_Q1_OFFSET (PROBE_FIRST_FPREG_OFFSET + (1 * FPREG_SIZE))
+#define PROBE_CPU_Q2_OFFSET (PROBE_FIRST_FPREG_OFFSET + (2 * FPREG_SIZE))
+#define PROBE_CPU_Q3_OFFSET (PROBE_FIRST_FPREG_OFFSET + (3 * FPREG_SIZE))
+#define PROBE_CPU_Q4_OFFSET (PROBE_FIRST_FPREG_OFFSET + (4 * FPREG_SIZE))
+#define PROBE_CPU_Q5_OFFSET (PROBE_FIRST_FPREG_OFFSET + (5 * FPREG_SIZE))
+#define PROBE_CPU_Q6_OFFSET (PROBE_FIRST_FPREG_OFFSET + (6 * FPREG_SIZE))
+#define PROBE_CPU_Q7_OFFSET (PROBE_FIRST_FPREG_OFFSET + (7 * FPREG_SIZE))
+#define PROBE_CPU_Q8_OFFSET (PROBE_FIRST_FPREG_OFFSET + (8 * FPREG_SIZE))
+#define PROBE_CPU_Q9_OFFSET (PROBE_FIRST_FPREG_OFFSET + (9 * FPREG_SIZE))
+#define PROBE_CPU_Q10_OFFSET (PROBE_FIRST_FPREG_OFFSET + (10 * FPREG_SIZE))
+#define PROBE_CPU_Q11_OFFSET (PROBE_FIRST_FPREG_OFFSET + (11 * FPREG_SIZE))
+#define PROBE_CPU_Q12_OFFSET (PROBE_FIRST_FPREG_OFFSET + (12 * FPREG_SIZE))
+#define PROBE_CPU_Q13_OFFSET (PROBE_FIRST_FPREG_OFFSET + (13 * FPREG_SIZE))
+#define PROBE_CPU_Q14_OFFSET (PROBE_FIRST_FPREG_OFFSET + (14 * FPREG_SIZE))
+#define PROBE_CPU_Q15_OFFSET (PROBE_FIRST_FPREG_OFFSET + (15 * FPREG_SIZE))
+#define PROBE_CPU_Q16_OFFSET (PROBE_FIRST_FPREG_OFFSET + (16 * FPREG_SIZE))
+#define PROBE_CPU_Q17_OFFSET (PROBE_FIRST_FPREG_OFFSET + (17 * FPREG_SIZE))
+#define PROBE_CPU_Q18_OFFSET (PROBE_FIRST_FPREG_OFFSET + (18 * FPREG_SIZE))
+#define PROBE_CPU_Q19_OFFSET (PROBE_FIRST_FPREG_OFFSET + (19 * FPREG_SIZE))
+#define PROBE_CPU_Q20_OFFSET (PROBE_FIRST_FPREG_OFFSET + (20 * FPREG_SIZE))
+#define PROBE_CPU_Q21_OFFSET (PROBE_FIRST_FPREG_OFFSET + (21 * FPREG_SIZE))
+#define PROBE_CPU_Q22_OFFSET (PROBE_FIRST_FPREG_OFFSET + (22 * FPREG_SIZE))
+#define PROBE_CPU_Q23_OFFSET (PROBE_FIRST_FPREG_OFFSET + (23 * FPREG_SIZE))
+#define PROBE_CPU_Q24_OFFSET (PROBE_FIRST_FPREG_OFFSET + (24 * FPREG_SIZE))
+#define PROBE_CPU_Q25_OFFSET (PROBE_FIRST_FPREG_OFFSET + (25 * FPREG_SIZE))
+#define PROBE_CPU_Q26_OFFSET (PROBE_FIRST_FPREG_OFFSET + (26 * FPREG_SIZE))
+#define PROBE_CPU_Q27_OFFSET (PROBE_FIRST_FPREG_OFFSET + (27 * FPREG_SIZE))
+#define PROBE_CPU_Q28_OFFSET (PROBE_FIRST_FPREG_OFFSET + (28 * FPREG_SIZE))
+#define PROBE_CPU_Q29_OFFSET (PROBE_FIRST_FPREG_OFFSET + (29 * FPREG_SIZE))
+#define PROBE_CPU_Q30_OFFSET (PROBE_FIRST_FPREG_OFFSET + (30 * FPREG_SIZE))
+#define PROBE_CPU_Q31_OFFSET (PROBE_FIRST_FPREG_OFFSET + (31 * FPREG_SIZE))
+#define PROBE_SIZE (PROBE_FIRST_FPREG_OFFSET + (32 * FPREG_SIZE))
+#define SAVED_CALLER_SP PROBE_SIZE
+#define PROBE_SIZE_PLUS_SAVED_CALLER_SP (SAVED_CALLER_SP + PTR_SIZE)
+
+// These ASSERTs remind you that if you change the layout of ProbeContext,
+// you need to change ctiMasmProbeTrampoline offsets above to match.
+#define PROBE_OFFSETOF(x) offsetof(struct MacroAssemblerARM64::ProbeContext, x)
+COMPILE_ASSERT(PROBE_OFFSETOF(probeFunction) == PROBE_PROBE_FUNCTION_OFFSET, ProbeContext_probeFunction_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg1) == PROBE_ARG1_OFFSET, ProbeContext_arg1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg2) == PROBE_ARG2_OFFSET, ProbeContext_arg2_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x0) == PROBE_CPU_X0_OFFSET, ProbeContext_cpu_x0_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x1) == PROBE_CPU_X1_OFFSET, ProbeContext_cpu_x1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x2) == PROBE_CPU_X2_OFFSET, ProbeContext_cpu_x2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x3) == PROBE_CPU_X3_OFFSET, ProbeContext_cpu_x3_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x4) == PROBE_CPU_X4_OFFSET, ProbeContext_cpu_x4_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x5) == PROBE_CPU_X5_OFFSET, ProbeContext_cpu_x5_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x6) == PROBE_CPU_X6_OFFSET, ProbeContext_cpu_x6_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x7) == PROBE_CPU_X7_OFFSET, ProbeContext_cpu_x7_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x8) == PROBE_CPU_X8_OFFSET, ProbeContext_cpu_x8_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x9) == PROBE_CPU_X9_OFFSET, ProbeContext_cpu_x9_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x10) == PROBE_CPU_X10_OFFSET, ProbeContext_cpu_x10_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x11) == PROBE_CPU_X11_OFFSET, ProbeContext_cpu_x11_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x12) == PROBE_CPU_X12_OFFSET, ProbeContext_cpu_x12_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x13) == PROBE_CPU_X13_OFFSET, ProbeContext_cpu_x13_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x14) == PROBE_CPU_X14_OFFSET, ProbeContext_cpu_x14_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x15) == PROBE_CPU_X15_OFFSET, ProbeContext_cpu_x15_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x16) == PROBE_CPU_X16_OFFSET, ProbeContext_cpu_x16_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x17) == PROBE_CPU_X17_OFFSET, ProbeContext_cpu_x17_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x18) == PROBE_CPU_X18_OFFSET, ProbeContext_cpu_x18_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x19) == PROBE_CPU_X19_OFFSET, ProbeContext_cpu_x19_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x20) == PROBE_CPU_X20_OFFSET, ProbeContext_cpu_x20_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x21) == PROBE_CPU_X21_OFFSET, ProbeContext_cpu_x21_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x22) == PROBE_CPU_X22_OFFSET, ProbeContext_cpu_x22_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x23) == PROBE_CPU_X23_OFFSET, ProbeContext_cpu_x23_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x24) == PROBE_CPU_X24_OFFSET, ProbeContext_cpu_x24_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x25) == PROBE_CPU_X25_OFFSET, ProbeContext_cpu_x25_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x26) == PROBE_CPU_X26_OFFSET, ProbeContext_cpu_x26_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x27) == PROBE_CPU_X27_OFFSET, ProbeContext_cpu_x27_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.x28) == PROBE_CPU_X28_OFFSET, ProbeContext_cpu_x28_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.fp) == PROBE_CPU_FP_OFFSET, ProbeContext_cpu_fp_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.lr) == PROBE_CPU_LR_OFFSET, ProbeContext_cpu_lr_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.sp) == PROBE_CPU_SP_OFFSET, ProbeContext_cpu_sp_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.pc) == PROBE_CPU_PC_OFFSET, ProbeContext_cpu_pc_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.nzcv) == PROBE_CPU_NZCV_OFFSET, ProbeContext_cpu_nzcv_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.fpsr) == PROBE_CPU_FPSR_OFFSET, ProbeContext_cpu_fpsr_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q0) == PROBE_CPU_Q0_OFFSET, ProbeContext_cpu_q0_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q1) == PROBE_CPU_Q1_OFFSET, ProbeContext_cpu_q1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q2) == PROBE_CPU_Q2_OFFSET, ProbeContext_cpu_q2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q3) == PROBE_CPU_Q3_OFFSET, ProbeContext_cpu_q3_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q4) == PROBE_CPU_Q4_OFFSET, ProbeContext_cpu_q4_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q5) == PROBE_CPU_Q5_OFFSET, ProbeContext_cpu_q5_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q6) == PROBE_CPU_Q6_OFFSET, ProbeContext_cpu_q6_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q7) == PROBE_CPU_Q7_OFFSET, ProbeContext_cpu_q7_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q8) == PROBE_CPU_Q8_OFFSET, ProbeContext_cpu_q8_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q9) == PROBE_CPU_Q9_OFFSET, ProbeContext_cpu_q9_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q10) == PROBE_CPU_Q10_OFFSET, ProbeContext_cpu_q10_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q11) == PROBE_CPU_Q11_OFFSET, ProbeContext_cpu_q11_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q12) == PROBE_CPU_Q12_OFFSET, ProbeContext_cpu_q12_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q13) == PROBE_CPU_Q13_OFFSET, ProbeContext_cpu_q13_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q14) == PROBE_CPU_Q14_OFFSET, ProbeContext_cpu_q14_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q15) == PROBE_CPU_Q15_OFFSET, ProbeContext_cpu_q15_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q16) == PROBE_CPU_Q16_OFFSET, ProbeContext_cpu_q16_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q17) == PROBE_CPU_Q17_OFFSET, ProbeContext_cpu_q17_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q18) == PROBE_CPU_Q18_OFFSET, ProbeContext_cpu_q18_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q19) == PROBE_CPU_Q19_OFFSET, ProbeContext_cpu_q19_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q20) == PROBE_CPU_Q20_OFFSET, ProbeContext_cpu_q20_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q21) == PROBE_CPU_Q21_OFFSET, ProbeContext_cpu_q21_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q22) == PROBE_CPU_Q22_OFFSET, ProbeContext_cpu_q22_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q23) == PROBE_CPU_Q23_OFFSET, ProbeContext_cpu_q23_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q24) == PROBE_CPU_Q24_OFFSET, ProbeContext_cpu_q24_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q25) == PROBE_CPU_Q25_OFFSET, ProbeContext_cpu_q25_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q26) == PROBE_CPU_Q26_OFFSET, ProbeContext_cpu_q26_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q27) == PROBE_CPU_Q27_OFFSET, ProbeContext_cpu_q27_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q28) == PROBE_CPU_Q28_OFFSET, ProbeContext_cpu_q28_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q29) == PROBE_CPU_Q29_OFFSET, ProbeContext_cpu_q29_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q30) == PROBE_CPU_Q30_OFFSET, ProbeContext_cpu_q30_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.q31) == PROBE_CPU_Q31_OFFSET, ProbeContext_cpu_q31_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(sizeof(MacroAssemblerARM64::ProbeContext) == PROBE_SIZE, ProbeContext_size_matches_ctiMasmProbeTrampoline);
+
+#undef PROBE_OFFSETOF
+
+asm (
+    ".text" "\n"
+    ".align 2" "\n"
+    ".globl " SYMBOL_STRING(ctiMasmProbeTrampoline) "\n"
+    HIDE_SYMBOL(ctiMasmProbeTrampoline) "\n"
+    SYMBOL_STRING(ctiMasmProbeTrampoline) ":" "\n"
+
+    // MacroAssemblerARM64::probe() has already generated code to store some values.
+    // The top of stack (the caller save buffer) now looks like this:
+    //     sp[0 * ptrSize]: probeFunction
+    //     sp[1 * ptrSize]: arg1
+    //     sp[2 * ptrSize]: arg2
+    //     sp[3 * ptrSize]: address of arm64ProbeTrampoline()
+    //     sp[4 * ptrSize]: saved x27
+    //     sp[5 * ptrSize]: saved x28
+    //     sp[6 * ptrSize]: saved lr
+    //     sp[7 * ptrSize]: saved sp
+
+    "mov       x27, sp" "\n"
+    "mov       x28, sp" "\n"
+
+    "sub       x28, x28, #" STRINGIZE_VALUE_OF(PROBE_SIZE_PLUS_SAVED_CALLER_SP) "\n"
+
+    // The ARM EABI specifies that the stack needs to be 16 byte aligned.
+    "bic       x28, x28, #0xf" "\n"
+    "mov       sp, x28" "\n"
+
+    "str       x27, [sp, #" STRINGIZE_VALUE_OF(SAVED_CALLER_SP) "]" "\n"
+
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X0_OFFSET) "]" "\n"
+    "str       x1, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X1_OFFSET) "]" "\n"
+    "str       x2, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X2_OFFSET) "]" "\n"
+    "str       x3, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X3_OFFSET) "]" "\n"
+    "str       x4, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X4_OFFSET) "]" "\n"
+    "str       x5, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X5_OFFSET) "]" "\n"
+    "str       x6, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X6_OFFSET) "]" "\n"
+    "str       x7, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X7_OFFSET) "]" "\n"
+    "str       x8, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X8_OFFSET) "]" "\n"
+    "str       x9, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X9_OFFSET) "]" "\n"
+    "str       x10, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X10_OFFSET) "]" "\n"
+    "str       x11, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X11_OFFSET) "]" "\n"
+    "str       x12, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X12_OFFSET) "]" "\n"
+    "str       x13, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X13_OFFSET) "]" "\n"
+    "str       x14, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X14_OFFSET) "]" "\n"
+    "str       x15, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X15_OFFSET) "]" "\n"
+    "str       x16, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X16_OFFSET) "]" "\n"
+    "str       x17, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X17_OFFSET) "]" "\n"
+    "str       x18, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X18_OFFSET) "]" "\n"
+    "str       x19, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X19_OFFSET) "]" "\n"
+    "str       x20, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X20_OFFSET) "]" "\n"
+    "str       x21, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X21_OFFSET) "]" "\n"
+    "str       x22, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X22_OFFSET) "]" "\n"
+    "str       x23, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X23_OFFSET) "]" "\n"
+    "str       x24, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X24_OFFSET) "]" "\n"
+    "str       x25, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X25_OFFSET) "]" "\n"
+    "str       x26, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X26_OFFSET) "]" "\n"
+
+    "ldr       x0, [x27, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X27_OFFSET) "]" "\n"
+    "ldr       x0, [x27, #5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X28_OFFSET) "]" "\n"
+
+    "str       fp, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FP_OFFSET) "]" "\n"
+
+    "ldr       x0, [x27, #6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "ldr       x0, [x27, #7 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+
+    "mrs       x0, nzcv" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_NZCV_OFFSET) "]" "\n"
+    "mrs       x0, fpsr" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FPSR_OFFSET) "]" "\n"
+
+    "ldr       x0, [x27, #0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "]" "\n"
+    "ldr       x0, [x27, #1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG1_OFFSET) "]" "\n"
+    "ldr       x0, [x27, #2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG2_OFFSET) "]" "\n"
+
+    "str       d0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q0_OFFSET) "]" "\n"
+    "str       d1, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q1_OFFSET) "]" "\n"
+    "str       d2, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q2_OFFSET) "]" "\n"
+    "str       d3, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q3_OFFSET) "]" "\n"
+    "str       d4, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q4_OFFSET) "]" "\n"
+    "str       d5, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q5_OFFSET) "]" "\n"
+    "str       d6, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q6_OFFSET) "]" "\n"
+    "str       d7, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q7_OFFSET) "]" "\n"
+    "str       d8, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q8_OFFSET) "]" "\n"
+    "str       d9, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q9_OFFSET) "]" "\n"
+    "str       d10, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q10_OFFSET) "]" "\n"
+    "str       d11, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q11_OFFSET) "]" "\n"
+    "str       d12, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q12_OFFSET) "]" "\n"
+    "str       d13, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q13_OFFSET) "]" "\n"
+    "str       d14, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q14_OFFSET) "]" "\n"
+    "str       d15, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q15_OFFSET) "]" "\n"
+    "str       d16, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q16_OFFSET) "]" "\n"
+    "str       d17, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q17_OFFSET) "]" "\n"
+    "str       d18, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q18_OFFSET) "]" "\n"
+    "str       d19, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q19_OFFSET) "]" "\n"
+    "str       d20, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q20_OFFSET) "]" "\n"
+    "str       d21, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q21_OFFSET) "]" "\n"
+    "str       d22, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q22_OFFSET) "]" "\n"
+    "str       d23, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q23_OFFSET) "]" "\n"
+    "str       d24, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q24_OFFSET) "]" "\n"
+    "str       d25, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q25_OFFSET) "]" "\n"
+    "str       d26, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q26_OFFSET) "]" "\n"
+    "str       d27, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q27_OFFSET) "]" "\n"
+    "str       d28, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q28_OFFSET) "]" "\n"
+    "str       d29, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q29_OFFSET) "]" "\n"
+    "str       d30, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q30_OFFSET) "]" "\n"
+    "str       d31, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q31_OFFSET) "]" "\n"
+
+    "mov       x28, sp" "\n" // Save the ProbeContext*.
+
+    "mov       x0, sp" "\n" // the ProbeContext* arg.
+    "ldr       x27, [x27, #3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "blr       x27" "\n"
+
+    "mov       sp, x28" "\n"
+
+    // To enable probes to modify register state, we copy all registers
+    // out of the ProbeContext before returning. That is except for x18, pc and sp.
+
+    // x18 is "reserved for the platform. Conforming software should not make use of it."
+    // Hence, the JITs would not be using it, and the probe should also not be modifying it.
+    // See https://developer.apple.com/library/ios/documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARM64FunctionCallingConventions.html.
+
+    // We can't modify the pc, because the only way to set its value on ARM64 is via
+    // an indirect branch or a ret, which means we'll need a free register to do so.
+    // The probe mechanism is required to not perturb any registers that the caller
+    // may use. Hence, we don't have this free register available.
+
+    // In order to return to the caller, we need to ret via lr. The probe mechanism will
+    // restore lr's value after returning to the caller by loading the restore value
+    // from the caller save buffer. The caller expects to access the caller save buffer via
+    // sp. Hence, we cannot allow sp to be modified by the probe.
+
+    "ldr       d0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q0_OFFSET) "]" "\n"
+    "ldr       d1, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q1_OFFSET) "]" "\n"
+    "ldr       d2, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q2_OFFSET) "]" "\n"
+    "ldr       d3, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q3_OFFSET) "]" "\n"
+    "ldr       d4, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q4_OFFSET) "]" "\n"
+    "ldr       d5, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q5_OFFSET) "]" "\n"
+    "ldr       d6, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q6_OFFSET) "]" "\n"
+    "ldr       d7, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q7_OFFSET) "]" "\n"
+    "ldr       d8, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q8_OFFSET) "]" "\n"
+    "ldr       d9, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q9_OFFSET) "]" "\n"
+    "ldr       d10, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q10_OFFSET) "]" "\n"
+    "ldr       d11, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q11_OFFSET) "]" "\n"
+    "ldr       d12, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q12_OFFSET) "]" "\n"
+    "ldr       d13, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q13_OFFSET) "]" "\n"
+    "ldr       d14, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q14_OFFSET) "]" "\n"
+    "ldr       d15, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q15_OFFSET) "]" "\n"
+    "ldr       d16, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q16_OFFSET) "]" "\n"
+    "ldr       d17, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q17_OFFSET) "]" "\n"
+    "ldr       d18, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q18_OFFSET) "]" "\n"
+    "ldr       d19, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q19_OFFSET) "]" "\n"
+    "ldr       d20, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q20_OFFSET) "]" "\n"
+    "ldr       d21, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q21_OFFSET) "]" "\n"
+    "ldr       d22, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q22_OFFSET) "]" "\n"
+    "ldr       d23, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q23_OFFSET) "]" "\n"
+    "ldr       d24, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q24_OFFSET) "]" "\n"
+    "ldr       d25, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q25_OFFSET) "]" "\n"
+    "ldr       d26, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q26_OFFSET) "]" "\n"
+    "ldr       d27, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q27_OFFSET) "]" "\n"
+    "ldr       d28, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q28_OFFSET) "]" "\n"
+    "ldr       d29, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q29_OFFSET) "]" "\n"
+    "ldr       d30, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q30_OFFSET) "]" "\n"
+    "ldr       d31, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_Q31_OFFSET) "]" "\n"
+
+    "ldr       x0, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X0_OFFSET) "]" "\n"
+    "ldr       x1, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X1_OFFSET) "]" "\n"
+    "ldr       x2, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X2_OFFSET) "]" "\n"
+    "ldr       x3, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X3_OFFSET) "]" "\n"
+    "ldr       x4, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X4_OFFSET) "]" "\n"
+    "ldr       x5, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X5_OFFSET) "]" "\n"
+    "ldr       x6, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X6_OFFSET) "]" "\n"
+    "ldr       x7, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X7_OFFSET) "]" "\n"
+    "ldr       x8, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X8_OFFSET) "]" "\n"
+    "ldr       x9, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X9_OFFSET) "]" "\n"
+    "ldr       x10, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X10_OFFSET) "]" "\n"
+    "ldr       x11, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X11_OFFSET) "]" "\n"
+    "ldr       x12, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X12_OFFSET) "]" "\n"
+    "ldr       x13, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X13_OFFSET) "]" "\n"
+    "ldr       x14, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X14_OFFSET) "]" "\n"
+    "ldr       x15, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X15_OFFSET) "]" "\n"
+    "ldr       x16, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X16_OFFSET) "]" "\n"
+    "ldr       x17, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X17_OFFSET) "]" "\n"
+    // x18 should not be modified by the probe. See comment above for details.
+    "ldr       x19, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X19_OFFSET) "]" "\n"
+    "ldr       x20, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X20_OFFSET) "]" "\n"
+    "ldr       x21, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X21_OFFSET) "]" "\n"
+    "ldr       x22, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X22_OFFSET) "]" "\n"
+    "ldr       x23, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X23_OFFSET) "]" "\n"
+    "ldr       x24, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X24_OFFSET) "]" "\n"
+    "ldr       x25, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X25_OFFSET) "]" "\n"
+    "ldr       x26, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X26_OFFSET) "]" "\n"
+
+    "ldr       x27, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FPSR_OFFSET) "]" "\n"
+    "msr       fpsr, x27" "\n"
+
+    "ldr       x27, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_NZCV_OFFSET) "]" "\n"
+    "msr       nzcv, x27" "\n"
+    "ldr       fp, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FP_OFFSET) "]" "\n"
+
+    "ldr       x27, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X27_OFFSET) "]" "\n"
+    "ldr       x28, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X28_OFFSET) "]" "\n"
+
+    // There are 4 more registers left to restore: x27, x28, lr, sp, and pc.
+    // The JIT code's lr and sp will be restored by the caller.
+
+    // Restore pc by loading it into lr. The ret below will put in the pc.
+    "ldr       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+
+    // We need x27 as a scratch register to help with popping the ProbeContext.
+    // Hence, before we pop the ProbeContext, we need to copy the restore value
+    // for x27 from the ProbeContext to the caller save buffer.
+    "ldr       x28, [sp, #" STRINGIZE_VALUE_OF(SAVED_CALLER_SP) "]" "\n"
+    "ldr       x27, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X27_OFFSET) "]" "\n"
+    "str       x27, [x28, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+
+    // Since lr is also restored by the caller, we need to copy its restore
+    // value to the caller save buffer too.
+    "ldr       x27, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "str       x27, [x28, #6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+
+    // We're now done with x28, and can restore its value.
+    "ldr       x28, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_X28_OFFSET) "]" "\n"
+
+    // We're now done with the ProbeContext, and can pop it to restore sp so that
+    // it points to the caller save buffer.
+    "ldr       x27, [sp, #" STRINGIZE_VALUE_OF(SAVED_CALLER_SP) "]" "\n"
+    "mov       sp, x27" "\n"
+
+    // We're now done with x27, and can restore it.
+    "ldr       x27, [sp, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+
+    "ret" "\n"
+);
+#endif // COMPILER(GCC_OR_CLANG)
+
+static void arm64ProbeTrampoline(MacroAssemblerARM64::ProbeContext* context)
+{
+    void* origSP = context->cpu.sp;
+    void* origPC = context->cpu.pc;
+    
+    context->probeFunction(context);
+    
+    if (context->cpu.sp != origSP) {
+        dataLog("MacroAssembler probe ERROR: ARM64 does not support the probe changing the SP. The change will be ignored\n");
+        context->cpu.sp = origSP;
+    }
+    if (context->cpu.pc != origPC) {
+        dataLog("MacroAssembler probe ERROR: ARM64 does not support the probe changing the PC. The change will be ignored\n");
+        context->cpu.pc = origPC;
+    }
+}
+
+void MacroAssemblerARM64::probe(MacroAssemblerARM64::ProbeFunction function, void* arg1, void* arg2)
+{
+    sub64(TrustedImm32(8 * 8), sp);
+
+    store64(x27, Address(sp, 4 * 8));
+    store64(x28, Address(sp, 5 * 8));
+    store64(lr, Address(sp, 6 * 8));
+
+    add64(TrustedImm32(8 * 8), sp, x28);
+    store64(x28, Address(sp, 7 * 8)); // Save original sp value.
+
+    move(TrustedImmPtr(reinterpret_cast<void*>(function)), x28);
+    store64(x28, Address(sp));
+    move(TrustedImmPtr(arg1), x28);
+    store64(x28, Address(sp, 1 * 8));
+    move(TrustedImmPtr(arg2), x28);
+    store64(x28, Address(sp, 2 * 8));
+    move(TrustedImmPtr(reinterpret_cast<void*>(arm64ProbeTrampoline)), x28);
+    store64(x28, Address(sp, 3 * 8));
+
+    move(TrustedImmPtr(reinterpret_cast<void*>(ctiMasmProbeTrampoline)), x28);
+    m_assembler.blr(x28);
+
+    // ctiMasmProbeTrampoline should have restored every register except for
+    // lr and the sp.
+    load64(Address(sp, 6 * 8), lr);
+    add64(TrustedImm32(8 * 8), sp);
+}
+#endif // ENABLE(MASM_PROBE)
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(ARM64)
+
diff --git a/assembler/MacroAssemblerARM64.h b/assembler/MacroAssemblerARM64.h
new file mode 100644
index 0000000..0ab235f
--- /dev/null
+++ b/assembler/MacroAssemblerARM64.h
@@ -0,0 +1,3982 @@
+/*
+ * Copyright (C) 2012, 2014-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "ARM64Assembler.h"
+#include "AbstractMacroAssembler.h"
+#include <wtf/MathExtras.h>
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+class MacroAssemblerARM64 : public AbstractMacroAssembler<ARM64Assembler, MacroAssemblerARM64> {
+public:
+    static const unsigned numGPRs = 32;
+    static const unsigned numFPRs = 32;
+    
+    static const RegisterID dataTempRegister = ARM64Registers::ip0;
+    static const RegisterID memoryTempRegister = ARM64Registers::ip1;
+
+    RegisterID scratchRegister()
+    {
+        RELEASE_ASSERT(m_allowScratchRegister);
+        return getCachedDataTempRegisterIDAndInvalidate();
+    }
+
+private:
+    static const ARM64Registers::FPRegisterID fpTempRegister = ARM64Registers::q31;
+    static const ARM64Assembler::SetFlags S = ARM64Assembler::S;
+    static const intptr_t maskHalfWord0 = 0xffffl;
+    static const intptr_t maskHalfWord1 = 0xffff0000l;
+    static const intptr_t maskUpperWord = 0xffffffff00000000l;
+
+    // 4 instructions - 3 to load the function pointer, + blr.
+    static const ptrdiff_t REPATCH_OFFSET_CALL_TO_POINTER = -16;
+    
+public:
+    MacroAssemblerARM64()
+        : m_dataMemoryTempRegister(this, dataTempRegister)
+        , m_cachedMemoryTempRegister(this, memoryTempRegister)
+        , m_makeJumpPatchable(false)
+    {
+    }
+
+    typedef ARM64Assembler::LinkRecord LinkRecord;
+    typedef ARM64Assembler::JumpType JumpType;
+    typedef ARM64Assembler::JumpLinkType JumpLinkType;
+    typedef ARM64Assembler::Condition Condition;
+
+    static const ARM64Assembler::Condition DefaultCondition = ARM64Assembler::ConditionInvalid;
+    static const ARM64Assembler::JumpType DefaultJump = ARM64Assembler::JumpNoConditionFixedSize;
+
+    Vector<LinkRecord, 0, UnsafeVectorOverflow>& jumpsToLink() { return m_assembler.jumpsToLink(); }
+    void* unlinkedCode() { return m_assembler.unlinkedCode(); }
+    static bool canCompact(JumpType jumpType) { return ARM64Assembler::canCompact(jumpType); }
+    static JumpLinkType computeJumpType(JumpType jumpType, const uint8_t* from, const uint8_t* to) { return ARM64Assembler::computeJumpType(jumpType, from, to); }
+    static JumpLinkType computeJumpType(LinkRecord& record, const uint8_t* from, const uint8_t* to) { return ARM64Assembler::computeJumpType(record, from, to); }
+    static int jumpSizeDelta(JumpType jumpType, JumpLinkType jumpLinkType) { return ARM64Assembler::jumpSizeDelta(jumpType, jumpLinkType); }
+    static void link(LinkRecord& record, uint8_t* from, const uint8_t* fromInstruction, uint8_t* to) { return ARM64Assembler::link(record, from, fromInstruction, to); }
+
+    static const Scale ScalePtr = TimesEight;
+
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        // This is the largest 32-bit access allowed, aligned to 64-bit boundary.
+        return !(value & ~0x3ff8);
+    }
+
+    enum RelationalCondition {
+        Equal = ARM64Assembler::ConditionEQ,
+        NotEqual = ARM64Assembler::ConditionNE,
+        Above = ARM64Assembler::ConditionHI,
+        AboveOrEqual = ARM64Assembler::ConditionHS,
+        Below = ARM64Assembler::ConditionLO,
+        BelowOrEqual = ARM64Assembler::ConditionLS,
+        GreaterThan = ARM64Assembler::ConditionGT,
+        GreaterThanOrEqual = ARM64Assembler::ConditionGE,
+        LessThan = ARM64Assembler::ConditionLT,
+        LessThanOrEqual = ARM64Assembler::ConditionLE
+    };
+
+    enum ResultCondition {
+        Overflow = ARM64Assembler::ConditionVS,
+        Signed = ARM64Assembler::ConditionMI,
+        PositiveOrZero = ARM64Assembler::ConditionPL,
+        Zero = ARM64Assembler::ConditionEQ,
+        NonZero = ARM64Assembler::ConditionNE
+    };
+
+    enum ZeroCondition {
+        IsZero = ARM64Assembler::ConditionEQ,
+        IsNonZero = ARM64Assembler::ConditionNE
+    };
+
+    enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = ARM64Assembler::ConditionEQ,
+        DoubleNotEqual = ARM64Assembler::ConditionVC, // Not the right flag! check for this & handle differently.
+        DoubleGreaterThan = ARM64Assembler::ConditionGT,
+        DoubleGreaterThanOrEqual = ARM64Assembler::ConditionGE,
+        DoubleLessThan = ARM64Assembler::ConditionLO,
+        DoubleLessThanOrEqual = ARM64Assembler::ConditionLS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARM64Assembler::ConditionVS, // Not the right flag! check for this & handle differently.
+        DoubleNotEqualOrUnordered = ARM64Assembler::ConditionNE,
+        DoubleGreaterThanOrUnordered = ARM64Assembler::ConditionHI,
+        DoubleGreaterThanOrEqualOrUnordered = ARM64Assembler::ConditionHS,
+        DoubleLessThanOrUnordered = ARM64Assembler::ConditionLT,
+        DoubleLessThanOrEqualOrUnordered = ARM64Assembler::ConditionLE,
+    };
+
+    static const RegisterID stackPointerRegister = ARM64Registers::sp;
+    static const RegisterID framePointerRegister = ARM64Registers::fp;
+    static const RegisterID linkRegister = ARM64Registers::lr;
+
+    // FIXME: Get reasonable implementations for these
+    static bool shouldBlindForSpecificArch(uint32_t value) { return value >= 0x00ffffff; }
+    static bool shouldBlindForSpecificArch(uint64_t value) { return value >= 0x00ffffff; }
+
+    // Integer operations:
+
+    void add32(RegisterID a, RegisterID b, RegisterID dest)
+    {
+        ASSERT(a != ARM64Registers::sp && b != ARM64Registers::sp);
+        m_assembler.add<32>(dest, a, b);
+    }
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.add<32>(dest, dest, src);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID dest)
+    {
+        add32(imm, dest, dest);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value))
+            m_assembler.add<32>(dest, src, UInt12(imm.m_value));
+        else if (isUInt12(-imm.m_value))
+            m_assembler.sub<32>(dest, src, UInt12(-imm.m_value));
+        else if (src != dest) {
+            move(imm, dest);
+            add32(src, dest);
+        } else {
+            move(imm, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.add<32>(dest, src, dataTempRegister);
+        }
+    }
+
+    void add32(TrustedImm32 imm, Address address)
+    {
+        load32(address, getCachedDataTempRegisterIDAndInvalidate());
+
+        if (isUInt12(imm.m_value))
+            m_assembler.add<32>(dataTempRegister, dataTempRegister, UInt12(imm.m_value));
+        else if (isUInt12(-imm.m_value))
+            m_assembler.sub<32>(dataTempRegister, dataTempRegister, UInt12(-imm.m_value));
+        else {
+            move(imm, getCachedMemoryTempRegisterIDAndInvalidate());
+            m_assembler.add<32>(dataTempRegister, dataTempRegister, memoryTempRegister);
+        }
+
+        store32(dataTempRegister, address);
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+
+        if (isUInt12(imm.m_value)) {
+            m_assembler.add<32>(dataTempRegister, dataTempRegister, UInt12(imm.m_value));
+            store32(dataTempRegister, address.m_ptr);
+            return;
+        }
+
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.sub<32>(dataTempRegister, dataTempRegister, UInt12(-imm.m_value));
+            store32(dataTempRegister, address.m_ptr);
+            return;
+        }
+
+        move(imm, getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<32>(dataTempRegister, dataTempRegister, memoryTempRegister);
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, getCachedDataTempRegisterIDAndInvalidate());
+        add32(dataTempRegister, dest);
+    }
+
+    void add64(RegisterID a, RegisterID b, RegisterID dest)
+    {
+        ASSERT(a != ARM64Registers::sp || b != ARM64Registers::sp);
+        if (b == ARM64Registers::sp)
+            std::swap(a, b);
+        m_assembler.add<64>(dest, a, b);
+    }
+
+    void add64(RegisterID src, RegisterID dest)
+    {
+        if (src == ARM64Registers::sp)
+            m_assembler.add<64>(dest, src, dest);
+        else
+            m_assembler.add<64>(dest, dest, src);
+    }
+
+    void add64(TrustedImm32 imm, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value)) {
+            m_assembler.add<64>(dest, dest, UInt12(imm.m_value));
+            return;
+        }
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.sub<64>(dest, dest, UInt12(-imm.m_value));
+            return;
+        }
+
+        signExtend32ToPtr(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(dest, dest, dataTempRegister);
+    }
+
+    void add64(TrustedImm64 imm, RegisterID dest)
+    {
+        intptr_t immediate = imm.m_value;
+
+        if (isUInt12(immediate)) {
+            m_assembler.add<64>(dest, dest, UInt12(static_cast<int32_t>(immediate)));
+            return;
+        }
+        if (isUInt12(-immediate)) {
+            m_assembler.sub<64>(dest, dest, UInt12(static_cast<int32_t>(-immediate)));
+            return;
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(dest, dest, dataTempRegister);
+    }
+
+    void add64(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value)) {
+            m_assembler.add<64>(dest, src, UInt12(imm.m_value));
+            return;
+        }
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.sub<64>(dest, src, UInt12(-imm.m_value));
+            return;
+        }
+
+        signExtend32ToPtr(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(dest, src, dataTempRegister);
+    }
+
+    void add64(TrustedImm32 imm, Address address)
+    {
+        load64(address, getCachedDataTempRegisterIDAndInvalidate());
+
+        if (isUInt12(imm.m_value))
+            m_assembler.add<64>(dataTempRegister, dataTempRegister, UInt12(imm.m_value));
+        else if (isUInt12(-imm.m_value))
+            m_assembler.sub<64>(dataTempRegister, dataTempRegister, UInt12(-imm.m_value));
+        else {
+            signExtend32ToPtr(imm, getCachedMemoryTempRegisterIDAndInvalidate());
+            m_assembler.add<64>(dataTempRegister, dataTempRegister, memoryTempRegister);
+        }
+
+        store64(dataTempRegister, address);
+    }
+
+    void add64(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        load64(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+
+        if (isUInt12(imm.m_value)) {
+            m_assembler.add<64>(dataTempRegister, dataTempRegister, UInt12(imm.m_value));
+            store64(dataTempRegister, address.m_ptr);
+            return;
+        }
+
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.sub<64>(dataTempRegister, dataTempRegister, UInt12(-imm.m_value));
+            store64(dataTempRegister, address.m_ptr);
+            return;
+        }
+
+        signExtend32ToPtr(imm, getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(dataTempRegister, dataTempRegister, memoryTempRegister);
+        store64(dataTempRegister, address.m_ptr);
+    }
+
+    void addPtrNoFlags(TrustedImm32 imm, RegisterID srcDest)
+    {
+        add64(imm, srcDest);
+    }
+
+    void add64(Address src, RegisterID dest)
+    {
+        load64(src, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(dest, dest, dataTempRegister);
+    }
+
+    void add64(AbsoluteAddress src, RegisterID dest)
+    {
+        load64(src.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(dest, dest, dataTempRegister);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        and32(dest, src, dest);
+    }
+
+    void and32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.and_<32>(dest, op1, op2);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID dest)
+    {
+        and32(imm, dest, dest);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create32(imm.m_value);
+
+        if (logicalImm.isValid()) {
+            m_assembler.and_<32>(dest, src, logicalImm);
+            return;
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.and_<32>(dest, src, dataTempRegister);
+    }
+
+    void and32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        and32(dataTempRegister, dest);
+    }
+
+    void and64(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        m_assembler.and_<64>(dest, src1, src2);
+    }
+
+    void and64(TrustedImm64 imm, RegisterID src, RegisterID dest)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create64(imm.m_value);
+
+        if (logicalImm.isValid()) {
+            m_assembler.and_<64>(dest, src, logicalImm);
+            return;
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.and_<64>(dest, src, dataTempRegister);
+    }
+
+    void and64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.and_<64>(dest, dest, src);
+    }
+
+    void and64(TrustedImm32 imm, RegisterID dest)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create64(static_cast<intptr_t>(static_cast<int64_t>(imm.m_value)));
+
+        if (logicalImm.isValid()) {
+            m_assembler.and_<64>(dest, dest, logicalImm);
+            return;
+        }
+
+        signExtend32ToPtr(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.and_<64>(dest, dest, dataTempRegister);
+    }
+
+    void and64(TrustedImmPtr imm, RegisterID dest)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create64(reinterpret_cast<uint64_t>(imm.m_value));
+
+        if (logicalImm.isValid()) {
+            m_assembler.and_<64>(dest, dest, logicalImm);
+            return;
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.and_<64>(dest, dest, dataTempRegister);
+    }
+    
+    void countLeadingZeros32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.clz<32>(dest, src);
+    }
+
+    void countLeadingZeros64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.clz<64>(dest, src);
+    }
+
+    void countTrailingZeros32(RegisterID src, RegisterID dest)
+    {
+        // Arm does not have a count trailing zeros only a count leading zeros.
+        m_assembler.rbit<32>(dest, src);
+        m_assembler.clz<32>(dest, dest);
+    }
+
+    void countTrailingZeros64(RegisterID src, RegisterID dest)
+    {
+        // Arm does not have a count trailing zeros only a count leading zeros.
+        m_assembler.rbit<64>(dest, src);
+        m_assembler.clz<64>(dest, dest);
+    }
+
+    // Only used for testing purposes.
+    void illegalInstruction()
+    {
+        m_assembler.illegalInstruction();
+    }
+
+    void lshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.lsl<32>(dest, src, shiftAmount);
+    }
+
+    void lshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.lsl<32>(dest, src, imm.m_value & 0x1f);
+    }
+
+    void lshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        lshift32(dest, shiftAmount, dest);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        lshift32(dest, imm, dest);
+    }
+
+    void lshift64(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.lsl<64>(dest, src, shiftAmount);
+    }
+
+    void lshift64(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.lsl<64>(dest, src, imm.m_value & 0x3f);
+    }
+
+    void lshift64(RegisterID shiftAmount, RegisterID dest)
+    {
+        lshift64(dest, shiftAmount, dest);
+    }
+
+    void lshift64(TrustedImm32 imm, RegisterID dest)
+    {
+        lshift64(dest, imm, dest);
+    }
+
+    void mul32(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.mul<32>(dest, left, right);
+    }
+    
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mul<32>(dest, dest, src);
+    }
+
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.mul<32>(dest, src, dataTempRegister);
+    }
+
+    void mul64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mul<64>(dest, dest, src);
+    }
+
+    void mul64(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.mul<64>(dest, left, right);
+    }
+
+    void multiplyAdd32(RegisterID mulLeft, RegisterID mulRight, RegisterID summand, RegisterID dest)
+    {
+        m_assembler.madd<32>(dest, mulLeft, mulRight, summand);
+    }
+
+    void multiplySub32(RegisterID mulLeft, RegisterID mulRight, RegisterID minuend, RegisterID dest)
+    {
+        m_assembler.msub<32>(dest, mulLeft, mulRight, minuend);
+    }
+
+    void multiplyNeg32(RegisterID mulLeft, RegisterID mulRight, RegisterID dest)
+    {
+        m_assembler.msub<32>(dest, mulLeft, mulRight, ARM64Registers::zr);
+    }
+
+    void multiplyAdd64(RegisterID mulLeft, RegisterID mulRight, RegisterID summand, RegisterID dest)
+    {
+        m_assembler.madd<64>(dest, mulLeft, mulRight, summand);
+    }
+
+    void multiplySub64(RegisterID mulLeft, RegisterID mulRight, RegisterID minuend, RegisterID dest)
+    {
+        m_assembler.msub<64>(dest, mulLeft, mulRight, minuend);
+    }
+
+    void multiplyNeg64(RegisterID mulLeft, RegisterID mulRight, RegisterID dest)
+    {
+        m_assembler.msub<64>(dest, mulLeft, mulRight, ARM64Registers::zr);
+    }
+
+    void div32(RegisterID dividend, RegisterID divisor, RegisterID dest)
+    {
+        m_assembler.sdiv<32>(dest, dividend, divisor);
+    }
+
+    void div64(RegisterID dividend, RegisterID divisor, RegisterID dest)
+    {
+        m_assembler.sdiv<64>(dest, dividend, divisor);
+    }
+
+    void uDiv32(RegisterID dividend, RegisterID divisor, RegisterID dest)
+    {
+        m_assembler.udiv<32>(dest, dividend, divisor);
+    }
+
+    void uDiv64(RegisterID dividend, RegisterID divisor, RegisterID dest)
+    {
+        m_assembler.udiv<64>(dest, dividend, divisor);
+    }
+
+    void neg32(RegisterID dest)
+    {
+        m_assembler.neg<32>(dest, dest);
+    }
+
+    void neg64(RegisterID dest)
+    {
+        m_assembler.neg<64>(dest, dest);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        or32(dest, src, dest);
+    }
+
+    void or32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.orr<32>(dest, op1, op2);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID dest)
+    {
+        or32(imm, dest, dest);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create32(imm.m_value);
+
+        if (logicalImm.isValid()) {
+            m_assembler.orr<32>(dest, src, logicalImm);
+            return;
+        }
+
+        ASSERT(src != dataTempRegister);
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.orr<32>(dest, src, dataTempRegister);
+    }
+
+    void or32(RegisterID src, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.orr<32>(dataTempRegister, dataTempRegister, src);
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void or32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create32(imm.m_value);
+        if (logicalImm.isValid()) {
+            load32(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.orr<32>(dataTempRegister, dataTempRegister, logicalImm);
+            store32(dataTempRegister, address.m_ptr);
+        } else {
+            load32(address.m_ptr, getCachedMemoryTempRegisterIDAndInvalidate());
+            or32(imm, memoryTempRegister, getCachedDataTempRegisterIDAndInvalidate());
+            store32(dataTempRegister, address.m_ptr);
+        }
+    }
+
+    void or32(TrustedImm32 imm, Address address)
+    {
+        load32(address, getCachedDataTempRegisterIDAndInvalidate());
+        or32(imm, dataTempRegister, dataTempRegister);
+        store32(dataTempRegister, address);
+    }
+
+    void or64(RegisterID src, RegisterID dest)
+    {
+        or64(dest, src, dest);
+    }
+
+    void or64(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.orr<64>(dest, op1, op2);
+    }
+
+    void or64(TrustedImm32 imm, RegisterID dest)
+    {
+        or64(imm, dest, dest);
+    }
+
+    void or64(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create64(static_cast<intptr_t>(static_cast<int64_t>(imm.m_value)));
+
+        if (logicalImm.isValid()) {
+            m_assembler.orr<64>(dest, src, logicalImm);
+            return;
+        }
+
+        signExtend32ToPtr(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.orr<64>(dest, src, dataTempRegister);
+    }
+
+    void or64(TrustedImm64 imm, RegisterID src, RegisterID dest)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create64(imm.m_value);
+
+        if (logicalImm.isValid()) {
+            m_assembler.orr<64>(dest, src, logicalImm);
+            return;
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.orr<64>(dest, src, dataTempRegister);
+    }
+
+    void or64(TrustedImm64 imm, RegisterID dest)
+    {
+        LogicalImmediate logicalImm = LogicalImmediate::create64(static_cast<intptr_t>(static_cast<int64_t>(imm.m_value)));
+
+        if (logicalImm.isValid()) {
+            m_assembler.orr<64>(dest, dest, logicalImm);
+            return;
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.orr<64>(dest, dest, dataTempRegister);
+    }
+
+    void rotateRight32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.ror<32>(dest, src, imm.m_value & 31);
+    }
+
+    void rotateRight32(TrustedImm32 imm, RegisterID srcDst)
+    {
+        rotateRight32(srcDst, imm, srcDst);
+    }
+
+    void rotateRight32(RegisterID src, RegisterID shiftAmmount, RegisterID dest)
+    {
+        m_assembler.ror<32>(dest, src, shiftAmmount);
+    }
+
+    void rotateRight64(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.ror<64>(dest, src, imm.m_value & 63);
+    }
+
+    void rotateRight64(TrustedImm32 imm, RegisterID srcDst)
+    {
+        rotateRight64(srcDst, imm, srcDst);
+    }
+
+    void rotateRight64(RegisterID src, RegisterID shiftAmmount, RegisterID dest)
+    {
+        m_assembler.ror<64>(dest, src, shiftAmmount);
+    }
+
+    void rshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.asr<32>(dest, src, shiftAmount);
+    }
+
+    void rshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.asr<32>(dest, src, imm.m_value & 0x1f);
+    }
+
+    void rshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        rshift32(dest, shiftAmount, dest);
+    }
+    
+    void rshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        rshift32(dest, imm, dest);
+    }
+    
+    void rshift64(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.asr<64>(dest, src, shiftAmount);
+    }
+    
+    void rshift64(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.asr<64>(dest, src, imm.m_value & 0x3f);
+    }
+    
+    void rshift64(RegisterID shiftAmount, RegisterID dest)
+    {
+        rshift64(dest, shiftAmount, dest);
+    }
+    
+    void rshift64(TrustedImm32 imm, RegisterID dest)
+    {
+        rshift64(dest, imm, dest);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sub<32>(dest, dest, src);
+    }
+
+    void sub32(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.sub<32>(dest, left, right);
+    }
+
+    void sub32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value)) {
+            m_assembler.sub<32>(dest, dest, UInt12(imm.m_value));
+            return;
+        }
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.add<32>(dest, dest, UInt12(-imm.m_value));
+            return;
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.sub<32>(dest, dest, dataTempRegister);
+    }
+
+    void sub32(TrustedImm32 imm, Address address)
+    {
+        load32(address, getCachedDataTempRegisterIDAndInvalidate());
+
+        if (isUInt12(imm.m_value))
+            m_assembler.sub<32>(dataTempRegister, dataTempRegister, UInt12(imm.m_value));
+        else if (isUInt12(-imm.m_value))
+            m_assembler.add<32>(dataTempRegister, dataTempRegister, UInt12(-imm.m_value));
+        else {
+            move(imm, getCachedMemoryTempRegisterIDAndInvalidate());
+            m_assembler.sub<32>(dataTempRegister, dataTempRegister, memoryTempRegister);
+        }
+
+        store32(dataTempRegister, address);
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+
+        if (isUInt12(imm.m_value)) {
+            m_assembler.sub<32>(dataTempRegister, dataTempRegister, UInt12(imm.m_value));
+            store32(dataTempRegister, address.m_ptr);
+            return;
+        }
+
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.add<32>(dataTempRegister, dataTempRegister, UInt12(-imm.m_value));
+            store32(dataTempRegister, address.m_ptr);
+            return;
+        }
+
+        move(imm, getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.sub<32>(dataTempRegister, dataTempRegister, memoryTempRegister);
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, getCachedDataTempRegisterIDAndInvalidate());
+        sub32(dataTempRegister, dest);
+    }
+
+    void sub64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sub<64>(dest, dest, src);
+    }
+
+    void sub64(RegisterID a, RegisterID b, RegisterID dest)
+    {
+        m_assembler.sub<64>(dest, a, b);
+    }
+    
+    void sub64(TrustedImm32 imm, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value)) {
+            m_assembler.sub<64>(dest, dest, UInt12(imm.m_value));
+            return;
+        }
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.add<64>(dest, dest, UInt12(-imm.m_value));
+            return;
+        }
+
+        signExtend32ToPtr(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.sub<64>(dest, dest, dataTempRegister);
+    }
+    
+    void sub64(TrustedImm64 imm, RegisterID dest)
+    {
+        intptr_t immediate = imm.m_value;
+
+        if (isUInt12(immediate)) {
+            m_assembler.sub<64>(dest, dest, UInt12(static_cast<int32_t>(immediate)));
+            return;
+        }
+        if (isUInt12(-immediate)) {
+            m_assembler.add<64>(dest, dest, UInt12(static_cast<int32_t>(-immediate)));
+            return;
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.sub<64>(dest, dest, dataTempRegister);
+    }
+
+    void urshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.lsr<32>(dest, src, shiftAmount);
+    }
+    
+    void urshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.lsr<32>(dest, src, imm.m_value & 0x1f);
+    }
+
+    void urshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        urshift32(dest, shiftAmount, dest);
+    }
+    
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        urshift32(dest, imm, dest);
+    }
+
+    void urshift64(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.lsr<64>(dest, src, shiftAmount);
+    }
+    
+    void urshift64(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.lsr<64>(dest, src, imm.m_value & 0x3f);
+    }
+
+    void urshift64(RegisterID shiftAmount, RegisterID dest)
+    {
+        urshift64(dest, shiftAmount, dest);
+    }
+    
+    void urshift64(TrustedImm32 imm, RegisterID dest)
+    {
+        urshift64(dest, imm, dest);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        xor32(dest, src, dest);
+    }
+
+    void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.eor<32>(dest, op1, op2);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID dest)
+    {
+        xor32(imm, dest, dest);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (imm.m_value == -1)
+            m_assembler.mvn<32>(dest, src);
+        else {
+            LogicalImmediate logicalImm = LogicalImmediate::create32(imm.m_value);
+
+            if (logicalImm.isValid()) {
+                m_assembler.eor<32>(dest, src, logicalImm);
+                return;
+            }
+
+            move(imm, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.eor<32>(dest, src, dataTempRegister);
+        }
+    }
+
+    void xor64(RegisterID src, Address address)
+    {
+        load64(address, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.eor<64>(dataTempRegister, dataTempRegister, src);
+        store64(dataTempRegister, address);
+    }
+
+    void xor64(RegisterID src, RegisterID dest)
+    {
+        xor64(dest, src, dest);
+    }
+
+    void xor64(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.eor<64>(dest, op1, op2);
+    }
+
+    void xor64(TrustedImm32 imm, RegisterID dest)
+    {
+        xor64(imm, dest, dest);
+    }
+
+    void xor64(TrustedImm64 imm, RegisterID src, RegisterID dest)
+    {
+        if (imm.m_value == -1)
+            m_assembler.mvn<64>(dest, src);
+        else {
+            LogicalImmediate logicalImm = LogicalImmediate::create64(imm.m_value);
+
+            if (logicalImm.isValid()) {
+                m_assembler.eor<64>(dest, src, logicalImm);
+                return;
+            }
+
+            move(imm, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.eor<64>(dest, src, dataTempRegister);
+        }
+    }
+
+    void xor64(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (imm.m_value == -1)
+            m_assembler.mvn<64>(dest, src);
+        else {
+            LogicalImmediate logicalImm = LogicalImmediate::create64(static_cast<intptr_t>(static_cast<int64_t>(imm.m_value)));
+
+            if (logicalImm.isValid()) {
+                m_assembler.eor<64>(dest, src, logicalImm);
+                return;
+            }
+
+            signExtend32ToPtr(imm, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.eor<64>(dest, src, dataTempRegister);
+        }
+    }
+
+    void not32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mvn<32>(dest, src);
+    }
+
+    void not64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mvn<64>(dest, src);
+    }
+
+    void not64(RegisterID srcDst)
+    {
+        m_assembler.mvn<64>(srcDst, srcDst);
+    }
+
+    // Memory access operations:
+
+    void load64(ImplicitAddress address, RegisterID dest)
+    {
+        if (tryLoadWithOffset<64>(dest, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldr<64>(dest, address.base, memoryTempRegister);
+    }
+
+    void load64(BaseIndex address, RegisterID dest)
+    {
+        if (!address.offset && (!address.scale || address.scale == 3)) {
+            m_assembler.ldr<64>(dest, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.ldr<64>(dest, address.base, memoryTempRegister);
+    }
+
+    void load64(const void* address, RegisterID dest)
+    {
+        load<64>(address, dest);
+    }
+
+    void load64(RegisterID src, PostIndex simm, RegisterID dest)
+    {
+        m_assembler.ldr<64>(dest, src, simm);
+    }
+
+    DataLabel32 load64WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabel32 label(this);
+        signExtend32ToPtrWithFixedWidth(address.offset, getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldr<64>(dest, address.base, memoryTempRegister, ARM64Assembler::SXTW, 0);
+        return label;
+    }
+    
+    DataLabelCompact load64WithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        ASSERT(isCompactPtrAlignedAddressOffset(address.offset));
+        DataLabelCompact label(this);
+        m_assembler.ldr<64>(dest, address.base, address.offset);
+        return label;
+    }
+
+    void loadPair64(RegisterID src, RegisterID dest1, RegisterID dest2)
+    {
+        loadPair64(src, TrustedImm32(0), dest1, dest2);
+    }
+
+    void loadPair64(RegisterID src, TrustedImm32 offset, RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.ldp<64>(dest1, dest2, src, offset.m_value);
+    }
+
+    void loadPair64WithNonTemporalAccess(RegisterID src, RegisterID dest1, RegisterID dest2)
+    {
+        loadPair64WithNonTemporalAccess(src, TrustedImm32(0), dest1, dest2);
+    }
+
+    void loadPair64WithNonTemporalAccess(RegisterID src, TrustedImm32 offset, RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.ldnp<64>(dest1, dest2, src, offset.m_value);
+    }
+
+    void abortWithReason(AbortReason reason)
+    {
+        move(TrustedImm32(reason), dataTempRegister);
+        breakpoint();
+    }
+
+    void abortWithReason(AbortReason reason, intptr_t misc)
+    {
+        move(TrustedImm64(misc), memoryTempRegister);
+        abortWithReason(reason);
+    }
+
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result(this);
+        ASSERT(!(address.offset & ~0xff8));
+        m_assembler.ldr<64>(dest, address.base, address.offset);
+        return result;
+    }
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        if (tryLoadWithOffset<32>(dest, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldr<32>(dest, address.base, memoryTempRegister);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        if (!address.offset && (!address.scale || address.scale == 2)) {
+            m_assembler.ldr<32>(dest, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.ldr<32>(dest, address.base, memoryTempRegister);
+    }
+
+    void load32(const void* address, RegisterID dest)
+    {
+        load<32>(address, dest);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabel32 label(this);
+        signExtend32ToPtrWithFixedWidth(address.offset, getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldr<32>(dest, address.base, memoryTempRegister, ARM64Assembler::SXTW, 0);
+        return label;
+    }
+    
+    DataLabelCompact load32WithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        ASSERT(isCompactPtrAlignedAddressOffset(address.offset));
+        DataLabelCompact label(this);
+        m_assembler.ldr<32>(dest, address.base, address.offset);
+        return label;
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+
+    void load16(ImplicitAddress address, RegisterID dest)
+    {
+        if (tryLoadWithOffset<16>(dest, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldrh(dest, address.base, memoryTempRegister);
+    }
+    
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        if (!address.offset && (!address.scale || address.scale == 1)) {
+            m_assembler.ldrh(dest, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.ldrh(dest, address.base, memoryTempRegister);
+    }
+    
+    void load16Unaligned(BaseIndex address, RegisterID dest)
+    {
+        load16(address, dest);
+    }
+
+    void load16SignedExtendTo32(ImplicitAddress address, RegisterID dest)
+    {
+        if (tryLoadSignedWithOffset<16>(dest, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldrsh<32>(dest, address.base, memoryTempRegister);
+    }
+
+    void load16SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        if (!address.offset && (!address.scale || address.scale == 1)) {
+            m_assembler.ldrsh<32>(dest, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.ldrsh<32>(dest, address.base, memoryTempRegister);
+    }
+
+    void zeroExtend16To32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.uxth<32>(dest, src);
+    }
+
+    void signExtend16To32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sxth<32>(dest, src);
+    }
+
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        if (tryLoadWithOffset<8>(dest, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldrb(dest, address.base, memoryTempRegister);
+    }
+
+    void load8(BaseIndex address, RegisterID dest)
+    {
+        if (!address.offset && !address.scale) {
+            m_assembler.ldrb(dest, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.ldrb(dest, address.base, memoryTempRegister);
+    }
+    
+    void load8(const void* address, RegisterID dest)
+    {
+        moveToCachedReg(TrustedImmPtr(address), cachedMemoryTempRegister());
+        m_assembler.ldrb(dest, memoryTempRegister, ARM64Registers::zr);
+        if (dest == memoryTempRegister)
+            cachedMemoryTempRegister().invalidate();
+    }
+
+    void load8(RegisterID src, PostIndex simm, RegisterID dest)
+    {
+        m_assembler.ldrb(dest, src, simm);
+    }
+
+    void load8SignedExtendTo32(ImplicitAddress address, RegisterID dest)
+    {
+        if (tryLoadSignedWithOffset<8>(dest, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldrsb<32>(dest, address.base, memoryTempRegister);
+    }
+
+    void load8SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        if (!address.offset && !address.scale) {
+            m_assembler.ldrsb<32>(dest, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.ldrsb<32>(dest, address.base, memoryTempRegister);
+    }
+
+    void load8SignedExtendTo32(const void* address, RegisterID dest)
+    {
+        moveToCachedReg(TrustedImmPtr(address), cachedMemoryTempRegister());
+        m_assembler.ldrsb<32>(dest, memoryTempRegister, ARM64Registers::zr);
+        if (dest == memoryTempRegister)
+            cachedMemoryTempRegister().invalidate();
+    }
+
+    void zeroExtend8To32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.uxtb<32>(dest, src);
+    }
+
+    void signExtend8To32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sxtb<32>(dest, src);
+    }
+
+    void store64(RegisterID src, ImplicitAddress address)
+    {
+        if (tryStoreWithOffset<64>(src, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.str<64>(src, address.base, memoryTempRegister);
+    }
+
+    void store64(RegisterID src, BaseIndex address)
+    {
+        if (!address.offset && (!address.scale || address.scale == 3)) {
+            m_assembler.str<64>(src, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.str<64>(src, address.base, memoryTempRegister);
+    }
+    
+    void store64(RegisterID src, const void* address)
+    {
+        store<64>(src, address);
+    }
+
+    void store64(TrustedImm32 imm, ImplicitAddress address)
+    {
+        store64(TrustedImm64(imm.m_value), address);
+    }
+
+    void store64(TrustedImm64 imm, ImplicitAddress address)
+    {
+        if (!imm.m_value) {
+            store64(ARM64Registers::zr, address);
+            return;
+        }
+
+        moveToCachedReg(imm, dataMemoryTempRegister());
+        store64(dataTempRegister, address);
+    }
+
+    void store64(TrustedImm64 imm, BaseIndex address)
+    {
+        if (!imm.m_value) {
+            store64(ARM64Registers::zr, address);
+            return;
+        }
+
+        moveToCachedReg(imm, dataMemoryTempRegister());
+        store64(dataTempRegister, address);
+    }
+
+    void store64(RegisterID src, RegisterID dest, PostIndex simm)
+    {
+        m_assembler.str<64>(src, dest, simm);
+    }
+    
+    DataLabel32 store64WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        DataLabel32 label(this);
+        signExtend32ToPtrWithFixedWidth(address.offset, getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.str<64>(src, address.base, memoryTempRegister, ARM64Assembler::SXTW, 0);
+        return label;
+    }
+
+    void storePair64(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        storePair64(src1, src2, dest, TrustedImm32(0));
+    }
+
+    void storePair64(RegisterID src1, RegisterID src2, RegisterID dest, TrustedImm32 offset)
+    {
+        m_assembler.stp<64>(src1, src2, dest, offset.m_value);
+    }
+
+    void storePair64WithNonTemporalAccess(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        storePair64WithNonTemporalAccess(src1, src2, dest, TrustedImm32(0));
+    }
+
+    void storePair64WithNonTemporalAccess(RegisterID src1, RegisterID src2, RegisterID dest, TrustedImm32 offset)
+    {
+        m_assembler.stnp<64>(src1, src2, dest, offset.m_value);
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        if (tryStoreWithOffset<32>(src, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.str<32>(src, address.base, memoryTempRegister);
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        if (!address.offset && (!address.scale || address.scale == 2)) {
+            m_assembler.str<32>(src, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.str<32>(src, address.base, memoryTempRegister);
+    }
+
+    void store32(RegisterID src, const void* address)
+    {
+        store<32>(src, address);
+    }
+
+    void store32(TrustedImm32 imm, ImplicitAddress address)
+    {
+        if (!imm.m_value) {
+            store32(ARM64Registers::zr, address);
+            return;
+        }
+
+        moveToCachedReg(imm, dataMemoryTempRegister());
+        store32(dataTempRegister, address);
+    }
+
+    void store32(TrustedImm32 imm, BaseIndex address)
+    {
+        if (!imm.m_value) {
+            store32(ARM64Registers::zr, address);
+            return;
+        }
+
+        moveToCachedReg(imm, dataMemoryTempRegister());
+        store32(dataTempRegister, address);
+    }
+
+    void store32(TrustedImm32 imm, const void* address)
+    {
+        if (!imm.m_value) {
+            store32(ARM64Registers::zr, address);
+            return;
+        }
+
+        moveToCachedReg(imm, dataMemoryTempRegister());
+        store32(dataTempRegister, address);
+    }
+
+    void storeZero32(ImplicitAddress address)
+    {
+        store32(ARM64Registers::zr, address);
+    }
+
+    void storeZero32(BaseIndex address)
+    {
+        store32(ARM64Registers::zr, address);
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        DataLabel32 label(this);
+        signExtend32ToPtrWithFixedWidth(address.offset, getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.str<32>(src, address.base, memoryTempRegister, ARM64Assembler::SXTW, 0);
+        return label;
+    }
+
+    void store16(RegisterID src, ImplicitAddress address)
+    {
+        if (tryStoreWithOffset<16>(src, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.strh(src, address.base, memoryTempRegister);
+    }
+
+    void store16(RegisterID src, BaseIndex address)
+    {
+        if (!address.offset && (!address.scale || address.scale == 1)) {
+            m_assembler.strh(src, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.strh(src, address.base, memoryTempRegister);
+    }
+
+    void store8(RegisterID src, BaseIndex address)
+    {
+        if (!address.offset && !address.scale) {
+            m_assembler.strb(src, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.strb(src, address.base, memoryTempRegister);
+    }
+
+    void store8(RegisterID src, void* address)
+    {
+        move(TrustedImmPtr(address), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.strb(src, memoryTempRegister, 0);
+    }
+
+    void store8(RegisterID src, ImplicitAddress address)
+    {
+        if (tryStoreWithOffset<8>(src, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.strb(src, address.base, memoryTempRegister);
+    }
+
+    void store8(TrustedImm32 imm, void* address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        if (!imm8.m_value) {
+            store8(ARM64Registers::zr, address);
+            return;
+        }
+
+        move(imm8, getCachedDataTempRegisterIDAndInvalidate());
+        store8(dataTempRegister, address);
+    }
+
+    void store8(TrustedImm32 imm, ImplicitAddress address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        if (!imm8.m_value) {
+            store8(ARM64Registers::zr, address);
+            return;
+        }
+
+        move(imm8, getCachedDataTempRegisterIDAndInvalidate());
+        store8(dataTempRegister, address);
+    }
+
+    void store8(RegisterID src, RegisterID dest, PostIndex simm)
+    {
+        m_assembler.strb(src, dest, simm);
+    }
+
+    // Floating-point operations:
+
+    static bool supportsFloatingPoint() { return true; }
+    static bool supportsFloatingPointTruncate() { return true; }
+    static bool supportsFloatingPointSqrt() { return true; }
+    static bool supportsFloatingPointAbs() { return true; }
+    static bool supportsFloatingPointRounding() { return true; }
+
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+
+    void absDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fabs<64>(dest, src);
+    }
+
+    void absFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fabs<32>(dest, src);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        addDouble(dest, src, dest);
+    }
+
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.fadd<64>(dest, op1, op2);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        addDouble(fpTempRegister, dest);
+    }
+
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        loadDouble(TrustedImmPtr(address.m_ptr), fpTempRegister);
+        addDouble(fpTempRegister, dest);
+    }
+
+    void addFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.fadd<32>(dest, op1, op2);
+    }
+
+    void ceilDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.frintp<64>(dest, src);
+    }
+
+    void ceilFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.frintp<32>(dest, src);
+    }
+
+    void floorDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.frintm<64>(dest, src);
+    }
+
+    void floorFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.frintm<32>(dest, src);
+    }
+
+    void roundTowardNearestIntDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.frintn<64>(dest, src);
+    }
+
+    void roundTowardNearestIntFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.frintn<32>(dest, src);
+    }
+
+    void roundTowardZeroDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.frintz<64>(dest, src);
+    }
+
+    void roundTowardZeroFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.frintz<32>(dest, src);
+    }
+
+
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID, bool negZeroCheck = true)
+    {
+        m_assembler.fcvtns<32, 64>(dest, src);
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        m_assembler.scvtf<64, 32>(fpTempRegister, dest);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, fpTempRegister));
+
+        // Test for negative zero.
+        if (negZeroCheck) {
+            Jump valueIsNonZero = branchTest32(NonZero, dest);
+            RegisterID scratch = getCachedMemoryTempRegisterIDAndInvalidate();
+            m_assembler.fmov<64>(scratch, src);
+            failureCases.append(makeTestBitAndBranch(scratch, 63, IsNonZero));
+            valueIsNonZero.link(this);
+        }
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        m_assembler.fcmp<64>(left, right);
+        return jumpAfterFloatingPointCompare(cond);
+    }
+
+    Jump branchFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        m_assembler.fcmp<32>(left, right);
+        return jumpAfterFloatingPointCompare(cond);
+    }
+
+    Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID)
+    {
+        m_assembler.fcmp_0<64>(reg);
+        Jump unordered = makeBranch(ARM64Assembler::ConditionVS);
+        Jump result = makeBranch(ARM64Assembler::ConditionNE);
+        unordered.link(this);
+        return result;
+    }
+
+    Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID)
+    {
+        m_assembler.fcmp_0<64>(reg);
+        Jump unordered = makeBranch(ARM64Assembler::ConditionVS);
+        Jump notEqual = makeBranch(ARM64Assembler::ConditionNE);
+        unordered.link(this);
+        // We get here if either unordered or equal.
+        Jump result = jump();
+        notEqual.link(this);
+        return result;
+    }
+
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        // Truncate to a 64-bit integer in dataTempRegister, copy the low 32-bit to dest.
+        m_assembler.fcvtzs<64, 64>(getCachedDataTempRegisterIDAndInvalidate(), src);
+        zeroExtend32ToPtr(dataTempRegister, dest);
+        // Check the low 32-bits sign extend to be equal to the full value.
+        m_assembler.cmp<64>(dataTempRegister, dataTempRegister, ARM64Assembler::SXTW, 0);
+        return Jump(makeBranch(branchType == BranchIfTruncateSuccessful ? Equal : NotEqual));
+    }
+
+    void convertDoubleToFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fcvt<32, 64>(dest, src);
+    }
+
+    void convertFloatToDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fcvt<64, 32>(dest, src);
+    }
+    
+    void convertInt32ToDouble(TrustedImm32 imm, FPRegisterID dest)
+    {
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        convertInt32ToDouble(dataTempRegister, dest);
+    }
+    
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.scvtf<64, 32>(dest, src);
+    }
+
+    void convertInt32ToDouble(Address address, FPRegisterID dest)
+    {
+        load32(address, getCachedDataTempRegisterIDAndInvalidate());
+        convertInt32ToDouble(dataTempRegister, dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        load32(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+        convertInt32ToDouble(dataTempRegister, dest);
+    }
+
+    void convertInt32ToFloat(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.scvtf<32, 32>(dest, src);
+    }
+    
+    void convertInt64ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.scvtf<64, 64>(dest, src);
+    }
+
+    void convertInt64ToFloat(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.scvtf<32, 64>(dest, src);
+    }
+
+    void convertUInt64ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.ucvtf<64, 64>(dest, src);
+    }
+
+    void convertUInt64ToFloat(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.ucvtf<32, 64>(dest, src);
+    }
+
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        divDouble(dest, src, dest);
+    }
+
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.fdiv<64>(dest, op1, op2);
+    }
+
+    void divFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.fdiv<32>(dest, op1, op2);
+    }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        if (tryLoadWithOffset<64>(dest, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldr<64>(dest, address.base, memoryTempRegister);
+    }
+
+    void loadDouble(BaseIndex address, FPRegisterID dest)
+    {
+        if (!address.offset && (!address.scale || address.scale == 3)) {
+            m_assembler.ldr<64>(dest, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.ldr<64>(dest, address.base, memoryTempRegister);
+    }
+    
+    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
+    {
+        moveToCachedReg(address, cachedMemoryTempRegister());
+        m_assembler.ldr<64>(dest, memoryTempRegister, ARM64Registers::zr);
+    }
+
+    void loadFloat(ImplicitAddress address, FPRegisterID dest)
+    {
+        if (tryLoadWithOffset<32>(dest, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.ldr<32>(dest, address.base, memoryTempRegister);
+    }
+
+    void loadFloat(BaseIndex address, FPRegisterID dest)
+    {
+        if (!address.offset && (!address.scale || address.scale == 2)) {
+            m_assembler.ldr<32>(dest, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.ldr<32>(dest, address.base, memoryTempRegister);
+    }
+
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fmov<64>(dest, src);
+    }
+
+    void moveZeroToDouble(FPRegisterID reg)
+    {
+        m_assembler.fmov<64>(reg, ARM64Registers::zr);
+    }
+
+    void moveDoubleTo64(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fmov<64>(dest, src);
+    }
+
+    void moveFloatTo32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fmov<32>(dest, src);
+    }
+
+    void move64ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fmov<64>(dest, src);
+    }
+
+    void move32ToFloat(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fmov<32>(dest, src);
+    }
+
+    void moveConditionallyDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID src, RegisterID dest)
+    {
+        m_assembler.fcmp<64>(left, right);
+        moveConditionallyAfterFloatingPointCompare<64>(cond, src, dest);
+    }
+
+    void moveConditionallyDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        m_assembler.fcmp<64>(left, right);
+        moveConditionallyAfterFloatingPointCompare<64>(cond, thenCase, elseCase, dest);
+    }
+
+    void moveConditionallyFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID src, RegisterID dest)
+    {
+        m_assembler.fcmp<32>(left, right);
+        moveConditionallyAfterFloatingPointCompare<64>(cond, src, dest);
+    }
+
+    void moveConditionallyFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        m_assembler.fcmp<32>(left, right);
+        moveConditionallyAfterFloatingPointCompare<64>(cond, thenCase, elseCase, dest);
+    }
+
+    template<int datasize>
+    void moveConditionallyAfterFloatingPointCompare(DoubleCondition cond, RegisterID src, RegisterID dest)
+    {
+        if (cond == DoubleNotEqual) {
+            Jump unordered = makeBranch(ARM64Assembler::ConditionVS);
+            m_assembler.csel<datasize>(dest, src, dest, ARM64Assembler::ConditionNE);
+            unordered.link(this);
+            return;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            // If the compare is unordered, src is copied to dest and the
+            // next csel has all arguments equal to src.
+            // If the compare is ordered, dest is unchanged and EQ decides
+            // what value to set.
+            m_assembler.csel<datasize>(dest, src, dest, ARM64Assembler::ConditionVS);
+            m_assembler.csel<datasize>(dest, src, dest, ARM64Assembler::ConditionEQ);
+            return;
+        }
+        m_assembler.csel<datasize>(dest, src, dest, ARM64Condition(cond));
+    }
+
+    template<int datasize>
+    void moveConditionallyAfterFloatingPointCompare(DoubleCondition cond, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        if (cond == DoubleNotEqual) {
+            Jump unordered = makeBranch(ARM64Assembler::ConditionVS);
+            m_assembler.csel<datasize>(dest, thenCase, elseCase, ARM64Assembler::ConditionNE);
+            unordered.link(this);
+            return;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            // If the compare is unordered, thenCase is copied to elseCase and the
+            // next csel has all arguments equal to thenCase.
+            // If the compare is ordered, dest is unchanged and EQ decides
+            // what value to set.
+            m_assembler.csel<datasize>(elseCase, thenCase, elseCase, ARM64Assembler::ConditionVS);
+            m_assembler.csel<datasize>(dest, thenCase, elseCase, ARM64Assembler::ConditionEQ);
+            return;
+        }
+        m_assembler.csel<datasize>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    template<int datasize>
+    void moveDoubleConditionallyAfterFloatingPointCompare(DoubleCondition cond, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        if (cond == DoubleNotEqual) {
+            Jump unordered = makeBranch(ARM64Assembler::ConditionVS);
+            m_assembler.fcsel<datasize>(dest, thenCase, elseCase, ARM64Assembler::ConditionNE);
+            unordered.link(this);
+            return;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            // If the compare is unordered, thenCase is copied to elseCase and the
+            // next csel has all arguments equal to thenCase.
+            // If the compare is ordered, dest is unchanged and EQ decides
+            // what value to set.
+            m_assembler.fcsel<datasize>(elseCase, thenCase, elseCase, ARM64Assembler::ConditionVS);
+            m_assembler.fcsel<datasize>(dest, thenCase, elseCase, ARM64Assembler::ConditionEQ);
+            return;
+        }
+        m_assembler.fcsel<datasize>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveDoubleConditionallyDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        m_assembler.fcmp<64>(left, right);
+        moveDoubleConditionallyAfterFloatingPointCompare<64>(cond, thenCase, elseCase, dest);
+    }
+
+    void moveDoubleConditionallyFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        m_assembler.fcmp<32>(left, right);
+        moveDoubleConditionallyAfterFloatingPointCompare<64>(cond, thenCase, elseCase, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        mulDouble(dest, src, dest);
+    }
+
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.fmul<64>(dest, op1, op2);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        mulDouble(fpTempRegister, dest);
+    }
+
+    void mulFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.fmul<32>(dest, op1, op2);
+    }
+
+    void andDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vand<64>(dest, op1, op2);
+    }
+
+    void andFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        andDouble(op1, op2, dest);
+    }
+
+    void negateDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fneg<64>(dest, src);
+    }
+
+    void negateFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fneg<32>(dest, src);
+    }
+
+    void sqrtDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fsqrt<64>(dest, src);
+    }
+
+    void sqrtFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.fsqrt<32>(dest, src);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        if (tryStoreWithOffset<64>(src, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.str<64>(src, address.base, memoryTempRegister);
+    }
+
+    void storeDouble(FPRegisterID src, TrustedImmPtr address)
+    {
+        moveToCachedReg(address, cachedMemoryTempRegister());
+        m_assembler.str<64>(src, memoryTempRegister, ARM64Registers::zr);
+    }
+
+    void storeDouble(FPRegisterID src, BaseIndex address)
+    {
+        if (!address.offset && (!address.scale || address.scale == 3)) {
+            m_assembler.str<64>(src, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.str<64>(src, address.base, memoryTempRegister);
+    }
+
+    void storeFloat(FPRegisterID src, ImplicitAddress address)
+    {
+        if (tryStoreWithOffset<32>(src, address.base, address.offset))
+            return;
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.str<32>(src, address.base, memoryTempRegister);
+    }
+    
+    void storeFloat(FPRegisterID src, BaseIndex address)
+    {
+        if (!address.offset && (!address.scale || address.scale == 2)) {
+            m_assembler.str<32>(src, address.base, address.index, ARM64Assembler::UXTX, address.scale);
+            return;
+        }
+
+        signExtend32ToPtr(TrustedImm32(address.offset), getCachedMemoryTempRegisterIDAndInvalidate());
+        m_assembler.add<64>(memoryTempRegister, memoryTempRegister, address.index, ARM64Assembler::UXTX, address.scale);
+        m_assembler.str<32>(src, address.base, memoryTempRegister);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        subDouble(dest, src, dest);
+    }
+
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.fsub<64>(dest, op1, op2);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        subDouble(fpTempRegister, dest);
+    }
+
+    void subFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.fsub<32>(dest, op1, op2);
+    }
+
+    // Result is undefined if the value is outside of the integer range.
+    void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fcvtzs<32, 64>(dest, src);
+    }
+
+    void truncateDoubleToUint32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fcvtzu<32, 64>(dest, src);
+    }
+
+    void truncateDoubleToInt64(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fcvtzs<64, 64>(dest, src);
+    }
+
+    void truncateDoubleToUint64(FPRegisterID src, RegisterID dest, FPRegisterID, FPRegisterID)
+    {
+        truncateDoubleToUint64(src, dest);
+    }
+
+    void truncateDoubleToUint64(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fcvtzu<64, 64>(dest, src);
+    }
+
+    void truncateFloatToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fcvtzs<32, 32>(dest, src);
+    }
+
+    void truncateFloatToUint32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fcvtzu<32, 32>(dest, src);
+    }
+
+    void truncateFloatToInt64(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fcvtzs<64, 32>(dest, src);
+    }
+
+    void truncateFloatToUint64(FPRegisterID src, RegisterID dest, FPRegisterID, FPRegisterID)
+    {
+        truncateFloatToUint64(src, dest);
+    }
+
+    void truncateFloatToUint64(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.fcvtzu<64, 32>(dest, src);
+    }
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data. Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack. These operations are not supported on
+    // ARM64. Peek and poke operations read or write values on the
+    // stack, without moving the current stack position. Additionally,
+    // there are popToRestore and pushToSave operations, which are
+    // designed just for quick-and-dirty saving and restoring of
+    // temporary values. These operations don't claim to have any
+    // ABI compatibility.
+    
+    void pop(RegisterID) NO_RETURN_DUE_TO_CRASH
+    {
+        CRASH();
+    }
+
+    void push(RegisterID) NO_RETURN_DUE_TO_CRASH
+    {
+        CRASH();
+    }
+
+    void push(Address) NO_RETURN_DUE_TO_CRASH
+    {
+        CRASH();
+    }
+
+    void push(TrustedImm32) NO_RETURN_DUE_TO_CRASH
+    {
+        CRASH();
+    }
+
+    void popPair(RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.ldp<64>(dest1, dest2, ARM64Registers::sp, PairPostIndex(16));
+    }
+
+    void pushPair(RegisterID src1, RegisterID src2)
+    {
+        m_assembler.stp<64>(src1, src2, ARM64Registers::sp, PairPreIndex(-16));
+    }
+
+    void popToRestore(RegisterID dest)
+    {
+        m_assembler.ldr<64>(dest, ARM64Registers::sp, PostIndex(16));
+    }
+
+    void pushToSave(RegisterID src)
+    {
+        m_assembler.str<64>(src, ARM64Registers::sp, PreIndex(-16));
+    }
+    
+    void pushToSaveImmediateWithoutTouchingRegisters(TrustedImm32 imm)
+    {
+        RegisterID reg = dataTempRegister;
+        pushPair(reg, reg);
+        move(imm, reg);
+        store64(reg, stackPointerRegister);
+        load64(Address(stackPointerRegister, 8), reg);
+    }
+
+    void pushToSave(Address address)
+    {
+        load32(address, getCachedDataTempRegisterIDAndInvalidate());
+        pushToSave(dataTempRegister);
+    }
+
+    void pushToSave(TrustedImm32 imm)
+    {
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        pushToSave(dataTempRegister);
+    }
+    
+    void popToRestore(FPRegisterID dest)
+    {
+        loadDouble(stackPointerRegister, dest);
+        add64(TrustedImm32(16), stackPointerRegister);
+    }
+    
+    void pushToSave(FPRegisterID src)
+    {
+        sub64(TrustedImm32(16), stackPointerRegister);
+        storeDouble(src, stackPointerRegister);
+    }
+
+    static ptrdiff_t pushToSaveByteOffset() { return 16; }
+
+    // Register move operations:
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.mov<64>(dest, src);
+    }
+
+    void move(TrustedImm32 imm, RegisterID dest)
+    {
+        moveInternal<TrustedImm32, int32_t>(imm, dest);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        moveInternal<TrustedImmPtr, intptr_t>(imm, dest);
+    }
+
+    void move(TrustedImm64 imm, RegisterID dest)
+    {
+        moveInternal<TrustedImm64, int64_t>(imm, dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        move(reg1, getCachedDataTempRegisterIDAndInvalidate());
+        move(reg2, reg1);
+        move(dataTempRegister, reg2);
+    }
+
+    void signExtend32ToPtr(TrustedImm32 imm, RegisterID dest)
+    {
+        move(TrustedImmPtr(reinterpret_cast<void*>(static_cast<intptr_t>(imm.m_value))), dest);
+    }
+    
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sxtw(dest, src);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.uxtw(dest, src);
+    }
+
+    void moveConditionally32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID src, RegisterID dest)
+    {
+        m_assembler.cmp<32>(left, right);
+        m_assembler.csel<32>(dest, src, dest, ARM64Condition(cond));
+    }
+
+    void moveConditionally32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        m_assembler.cmp<32>(left, right);
+        m_assembler.csel<32>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveConditionally32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                moveConditionallyTest32(*resultCondition, left, left, thenCase, elseCase, dest);
+                return;
+            }
+        }
+
+        if (isUInt12(right.m_value))
+            m_assembler.cmp<32>(left, UInt12(right.m_value));
+        else if (isUInt12(-right.m_value))
+            m_assembler.cmn<32>(left, UInt12(-right.m_value));
+        else {
+            moveToCachedReg(right, dataMemoryTempRegister());
+            m_assembler.cmp<32>(left, dataTempRegister);
+        }
+        m_assembler.csel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveConditionally64(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID src, RegisterID dest)
+    {
+        m_assembler.cmp<64>(left, right);
+        m_assembler.csel<64>(dest, src, dest, ARM64Condition(cond));
+    }
+
+    void moveConditionally64(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        m_assembler.cmp<64>(left, right);
+        m_assembler.csel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveConditionally64(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                moveConditionallyTest64(*resultCondition, left, left, thenCase, elseCase, dest);
+                return;
+            }
+        }
+
+        if (isUInt12(right.m_value))
+            m_assembler.cmp<64>(left, UInt12(right.m_value));
+        else if (isUInt12(-right.m_value))
+            m_assembler.cmn<64>(left, UInt12(-right.m_value));
+        else {
+            moveToCachedReg(right, dataMemoryTempRegister());
+            m_assembler.cmp<64>(left, dataTempRegister);
+        }
+        m_assembler.csel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveConditionallyTest32(ResultCondition cond, RegisterID testReg, RegisterID mask, RegisterID src, RegisterID dest)
+    {
+        m_assembler.tst<32>(testReg, mask);
+        m_assembler.csel<32>(dest, src, dest, ARM64Condition(cond));
+    }
+
+    void moveConditionallyTest32(ResultCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        m_assembler.tst<32>(left, right);
+        m_assembler.csel<32>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveConditionallyTest32(ResultCondition cond, RegisterID left, TrustedImm32 right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        test32(left, right);
+        m_assembler.csel<32>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveConditionallyTest64(ResultCondition cond, RegisterID testReg, RegisterID mask, RegisterID src, RegisterID dest)
+    {
+        m_assembler.tst<64>(testReg, mask);
+        m_assembler.csel<64>(dest, src, dest, ARM64Condition(cond));
+    }
+
+    void moveConditionallyTest64(ResultCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        m_assembler.tst<64>(left, right);
+        m_assembler.csel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveDoubleConditionally32(RelationalCondition cond, RegisterID left, RegisterID right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        m_assembler.cmp<32>(left, right);
+        m_assembler.fcsel<32>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveDoubleConditionally32(RelationalCondition cond, RegisterID left, TrustedImm32 right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                moveDoubleConditionallyTest32(*resultCondition, left, left, thenCase, elseCase, dest);
+                return;
+            }
+        }
+
+        if (isUInt12(right.m_value))
+            m_assembler.cmp<32>(left, UInt12(right.m_value));
+        else if (isUInt12(-right.m_value))
+            m_assembler.cmn<32>(left, UInt12(-right.m_value));
+        else {
+            moveToCachedReg(right, dataMemoryTempRegister());
+            m_assembler.cmp<32>(left, dataTempRegister);
+        }
+        m_assembler.fcsel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveDoubleConditionally64(RelationalCondition cond, RegisterID left, RegisterID right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        m_assembler.cmp<64>(left, right);
+        m_assembler.fcsel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveDoubleConditionally64(RelationalCondition cond, RegisterID left, TrustedImm32 right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                moveDoubleConditionallyTest64(*resultCondition, left, left, thenCase, elseCase, dest);
+                return;
+            }
+        }
+
+        if (isUInt12(right.m_value))
+            m_assembler.cmp<64>(left, UInt12(right.m_value));
+        else if (isUInt12(-right.m_value))
+            m_assembler.cmn<64>(left, UInt12(-right.m_value));
+        else {
+            moveToCachedReg(right, dataMemoryTempRegister());
+            m_assembler.cmp<64>(left, dataTempRegister);
+        }
+        m_assembler.fcsel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveDoubleConditionallyTest32(ResultCondition cond, RegisterID left, RegisterID right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        m_assembler.tst<32>(left, right);
+        m_assembler.fcsel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveDoubleConditionallyTest32(ResultCondition cond, RegisterID left, TrustedImm32 right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        test32(left, right);
+        m_assembler.fcsel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    void moveDoubleConditionallyTest64(ResultCondition cond, RegisterID left, RegisterID right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        m_assembler.tst<64>(left, right);
+        m_assembler.fcsel<64>(dest, thenCase, elseCase, ARM64Condition(cond));
+    }
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+
+    Jump branch32(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmp<32>(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, TrustedImm32 right)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond))
+                return branchTest32(*resultCondition, left, left);
+        }
+
+        if (isUInt12(right.m_value))
+            m_assembler.cmp<32>(left, UInt12(right.m_value));
+        else if (isUInt12(-right.m_value))
+            m_assembler.cmn<32>(left, UInt12(-right.m_value));
+        else {
+            moveToCachedReg(right, dataMemoryTempRegister());
+            m_assembler.cmp<32>(left, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, Address right)
+    {
+        load32(right, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch32(cond, left, memoryTempRegister);
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, RegisterID right)
+    {
+        load32(left, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch32(cond, memoryTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        load32(left, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch32(cond, memoryTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        load32(left, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch32(cond, memoryTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        load32(left.m_ptr, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch32(cond, memoryTempRegister, right);
+    }
+
+    Jump branch64(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        if (right == ARM64Registers::sp) {
+            if (cond == Equal && left != ARM64Registers::sp) {
+                // CMP can only use SP for the left argument, since we are testing for equality, the order
+                // does not matter here.
+                std::swap(left, right);
+            } else {
+                move(right, getCachedDataTempRegisterIDAndInvalidate());
+                right = dataTempRegister;
+            }
+        }
+        m_assembler.cmp<64>(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch64(RelationalCondition cond, RegisterID left, TrustedImm32 right)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond))
+                return branchTest64(*resultCondition, left, left);
+        }
+
+        if (isUInt12(right.m_value))
+            m_assembler.cmp<64>(left, UInt12(right.m_value));
+        else if (isUInt12(-right.m_value))
+            m_assembler.cmn<64>(left, UInt12(-right.m_value));
+        else {
+            moveToCachedReg(right, dataMemoryTempRegister());
+            m_assembler.cmp<64>(left, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch64(RelationalCondition cond, RegisterID left, TrustedImm64 right)
+    {
+        intptr_t immediate = right.m_value;
+        if (!immediate) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond))
+                return branchTest64(*resultCondition, left, left);
+        }
+
+        if (isUInt12(immediate))
+            m_assembler.cmp<64>(left, UInt12(static_cast<int32_t>(immediate)));
+        else if (isUInt12(-immediate))
+            m_assembler.cmn<64>(left, UInt12(static_cast<int32_t>(-immediate)));
+        else {
+            moveToCachedReg(right, dataMemoryTempRegister());
+            m_assembler.cmp<64>(left, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch64(RelationalCondition cond, RegisterID left, Address right)
+    {
+        load64(right, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch64(cond, left, memoryTempRegister);
+    }
+
+    Jump branch64(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load64(left.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+        return branch64(cond, dataTempRegister, right);
+    }
+
+    Jump branch64(RelationalCondition cond, Address left, RegisterID right)
+    {
+        load64(left, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch64(cond, memoryTempRegister, right);
+    }
+
+    Jump branch64(RelationalCondition cond, Address left, TrustedImm64 right)
+    {
+        load64(left, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch64(cond, memoryTempRegister, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, BaseIndex left, RegisterID right)
+    {
+        load64(left, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch64(cond, memoryTempRegister, right);
+    }
+
+    Jump branch8(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch32(cond, memoryTempRegister, right8);
+    }
+
+    Jump branch8(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch32(cond, memoryTempRegister, right8);
+    }
+    
+    Jump branch8(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left.m_ptr, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branch32(cond, memoryTempRegister, right8);
+    }
+    
+    Jump branchTest32(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        if (reg == mask && (cond == Zero || cond == NonZero))
+            return Jump(makeCompareAndBranch<32>(static_cast<ZeroCondition>(cond), reg));
+        m_assembler.tst<32>(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    void test32(RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.tst<32>(reg, reg);
+        else {
+            LogicalImmediate logicalImm = LogicalImmediate::create32(mask.m_value);
+
+            if (logicalImm.isValid())
+                m_assembler.tst<32>(reg, logicalImm);
+            else {
+                move(mask, getCachedDataTempRegisterIDAndInvalidate());
+                m_assembler.tst<32>(reg, dataTempRegister);
+            }
+        }
+    }
+
+    Jump branch(ResultCondition cond)
+    {
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        if (mask.m_value == -1) {
+            if ((cond == Zero) || (cond == NonZero))
+                return Jump(makeCompareAndBranch<32>(static_cast<ZeroCondition>(cond), reg));
+            m_assembler.tst<32>(reg, reg);
+        } else if (hasOneBitSet(mask.m_value) && ((cond == Zero) || (cond == NonZero)))
+            return Jump(makeTestBitAndBranch(reg, getLSBSet(mask.m_value), static_cast<ZeroCondition>(cond)));
+        else {
+            LogicalImmediate logicalImm = LogicalImmediate::create32(mask.m_value);
+            if (logicalImm.isValid()) {
+                m_assembler.tst<32>(reg, logicalImm);
+                return Jump(makeBranch(cond));
+            }
+
+            move(mask, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.tst<32>(reg, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest32(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load32(address, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branchTest32(cond, memoryTempRegister, mask);
+    }
+
+    Jump branchTest32(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load32(address, getCachedMemoryTempRegisterIDAndInvalidate());
+        return branchTest32(cond, memoryTempRegister, mask);
+    }
+
+    Jump branchTest64(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        if (reg == mask && (cond == Zero || cond == NonZero))
+            return Jump(makeCompareAndBranch<64>(static_cast<ZeroCondition>(cond), reg));
+        m_assembler.tst<64>(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest64(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        if (mask.m_value == -1) {
+            if ((cond == Zero) || (cond == NonZero))
+                return Jump(makeCompareAndBranch<64>(static_cast<ZeroCondition>(cond), reg));
+            m_assembler.tst<64>(reg, reg);
+        } else if (hasOneBitSet(mask.m_value) && ((cond == Zero) || (cond == NonZero)))
+            return Jump(makeTestBitAndBranch(reg, getLSBSet(mask.m_value), static_cast<ZeroCondition>(cond)));
+        else {
+            LogicalImmediate logicalImm = LogicalImmediate::create64(mask.m_value);
+
+            if (logicalImm.isValid()) {
+                m_assembler.tst<64>(reg, logicalImm);
+                return Jump(makeBranch(cond));
+            }
+
+            signExtend32ToPtr(mask, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.tst<64>(reg, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest64(ResultCondition cond, RegisterID reg, TrustedImm64 mask)
+    {
+        if (mask.m_value == -1) {
+            if ((cond == Zero) || (cond == NonZero))
+                return Jump(makeCompareAndBranch<64>(static_cast<ZeroCondition>(cond), reg));
+            m_assembler.tst<64>(reg, reg);
+        } else if (hasOneBitSet(mask.m_value) && ((cond == Zero) || (cond == NonZero)))
+            return Jump(makeTestBitAndBranch(reg, getLSBSet(mask.m_value), static_cast<ZeroCondition>(cond)));
+        else {
+            LogicalImmediate logicalImm = LogicalImmediate::create64(mask.m_value);
+
+            if (logicalImm.isValid()) {
+                m_assembler.tst<64>(reg, logicalImm);
+                return Jump(makeBranch(cond));
+            }
+
+            move(mask, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.tst<64>(reg, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest64(ResultCondition cond, Address address, RegisterID mask)
+    {
+        load64(address, getCachedDataTempRegisterIDAndInvalidate());
+        return branchTest64(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest64(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load64(address, getCachedDataTempRegisterIDAndInvalidate());
+        return branchTest64(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest64(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load64(address, getCachedDataTempRegisterIDAndInvalidate());
+        return branchTest64(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest64(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load64(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+        return branchTest64(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest8(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, getCachedDataTempRegisterIDAndInvalidate());
+        return branchTest32(cond, dataTempRegister, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+        return branchTest32(cond, dataTempRegister, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, ExtendedAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        move(TrustedImmPtr(reinterpret_cast<void*>(address.offset)), getCachedDataTempRegisterIDAndInvalidate());
+
+        if (MacroAssemblerHelpers::isUnsigned<MacroAssemblerARM64>(cond))
+            m_assembler.ldrb(dataTempRegister, address.base, dataTempRegister);
+        else
+            m_assembler.ldrsb<32>(dataTempRegister, address.base, dataTempRegister);
+
+        return branchTest32(cond, dataTempRegister, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, getCachedDataTempRegisterIDAndInvalidate());
+        return branchTest32(cond, dataTempRegister, mask8);
+    }
+
+    Jump branch32WithUnalignedHalfWords(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        return branch32(cond, left, right);
+    }
+
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation. The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+    
+    Jump branchAdd32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.add<32, S>(dest, op1, op2);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID op1, TrustedImm32 imm, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value)) {
+            m_assembler.add<32, S>(dest, op1, UInt12(imm.m_value));
+            return Jump(makeBranch(cond));
+        }
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.sub<32, S>(dest, op1, UInt12(-imm.m_value));
+            return Jump(makeBranch(cond));
+        }
+
+        signExtend32ToPtr(imm, getCachedDataTempRegisterIDAndInvalidate());
+        return branchAdd32(cond, op1, dataTempRegister, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, Address src, RegisterID dest)
+    {
+        load32(src, getCachedDataTempRegisterIDAndInvalidate());
+        return branchAdd32(cond, dest, dataTempRegister, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchAdd32(cond, dest, src, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchAdd32(cond, dest, imm, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, getCachedDataTempRegisterIDAndInvalidate());
+
+        if (isUInt12(imm.m_value)) {
+            m_assembler.add<32, S>(dataTempRegister, dataTempRegister, UInt12(imm.m_value));
+            store32(dataTempRegister, address.m_ptr);
+        } else if (isUInt12(-imm.m_value)) {
+            m_assembler.sub<32, S>(dataTempRegister, dataTempRegister, UInt12(-imm.m_value));
+            store32(dataTempRegister, address.m_ptr);
+        } else {
+            move(imm, getCachedMemoryTempRegisterIDAndInvalidate());
+            m_assembler.add<32, S>(dataTempRegister, dataTempRegister, memoryTempRegister);
+            store32(dataTempRegister, address.m_ptr);
+        }
+
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchAdd64(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.add<64, S>(dest, op1, op2);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchAdd64(ResultCondition cond, RegisterID op1, TrustedImm32 imm, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value)) {
+            m_assembler.add<64, S>(dest, op1, UInt12(imm.m_value));
+            return Jump(makeBranch(cond));
+        }
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.sub<64, S>(dest, op1, UInt12(-imm.m_value));
+            return Jump(makeBranch(cond));
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        return branchAdd64(cond, op1, dataTempRegister, dest);
+    }
+
+    Jump branchAdd64(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchAdd64(cond, dest, src, dest);
+    }
+
+    Jump branchAdd64(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchAdd64(cond, dest, imm, dest);
+    }
+
+    Jump branchAdd64(RelationalCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT(isUInt12(imm.m_value));
+        m_assembler.add<64, S>(dest, dest, UInt12(imm.m_value));
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID scratch1, RegisterID scratch2, RegisterID dest)
+    {
+        ASSERT(cond != Signed);
+
+        if (cond != Overflow) {
+            m_assembler.mul<32>(dest, src1, src2);
+            return branchTest32(cond, dest);
+        }
+
+        // This is a signed multiple of two 32-bit values, producing a 64-bit result.
+        m_assembler.smull(dest, src1, src2);
+        // Copy bits 63..32 of the result to bits 31..0 of scratch1.
+        m_assembler.asr<64>(scratch1, dest, 32);
+        // Splat bit 31 of the result to bits 31..0 of scratch2.
+        m_assembler.asr<32>(scratch2, dest, 31);
+        // After a mul32 the top 32 bits of the register should be clear.
+        zeroExtend32ToPtr(dest, dest);
+        // Check that bits 31..63 of the original result were all equal.
+        return branch32(NotEqual, scratch2, scratch1);
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        return branchMul32(cond, src1, src2, getCachedDataTempRegisterIDAndInvalidate(), getCachedMemoryTempRegisterIDAndInvalidate(), dest);
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchMul32(cond, dest, src, dest);
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        return branchMul32(cond, dataTempRegister, src, dest);
+    }
+
+    Jump branchMul64(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID scratch1, RegisterID scratch2, RegisterID dest)
+    {
+        ASSERT(cond != Signed);
+
+        // This is a signed multiple of two 64-bit values, producing a 64-bit result.
+        m_assembler.mul<64>(dest, src1, src2);
+
+        if (cond != Overflow)
+            return branchTest64(cond, dest);
+
+        // Compute bits 127..64 of the result into scratch1.
+        m_assembler.smulh(scratch1, src1, src2);
+        // Splat bit 63 of the result to bits 63..0 of scratch2.
+        m_assembler.asr<64>(scratch2, dest, 63);
+        // Check that bits 31..63 of the original result were all equal.
+        return branch64(NotEqual, scratch2, scratch1);
+    }
+
+    Jump branchMul64(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        return branchMul64(cond, src1, src2, getCachedDataTempRegisterIDAndInvalidate(), getCachedMemoryTempRegisterIDAndInvalidate(), dest);
+    }
+
+    Jump branchMul64(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchMul64(cond, dest, src, dest);
+    }
+
+    Jump branchNeg32(ResultCondition cond, RegisterID dest)
+    {
+        m_assembler.neg<32, S>(dest, dest);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchNeg64(ResultCondition cond, RegisterID srcDest)
+    {
+        m_assembler.neg<64, S>(srcDest, srcDest);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID dest)
+    {
+        m_assembler.neg<32, S>(dest, dest);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.sub<32, S>(dest, op1, op2);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID op1, TrustedImm32 imm, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value)) {
+            m_assembler.sub<32, S>(dest, op1, UInt12(imm.m_value));
+            return Jump(makeBranch(cond));
+        }
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.add<32, S>(dest, op1, UInt12(-imm.m_value));
+            return Jump(makeBranch(cond));
+        }
+
+        signExtend32ToPtr(imm, getCachedDataTempRegisterIDAndInvalidate());
+        return branchSub32(cond, op1, dataTempRegister, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchSub32(cond, dest, src, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchSub32(cond, dest, imm, dest);
+    }
+
+    Jump branchSub64(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.sub<64, S>(dest, op1, op2);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchSub64(ResultCondition cond, RegisterID op1, TrustedImm32 imm, RegisterID dest)
+    {
+        if (isUInt12(imm.m_value)) {
+            m_assembler.sub<64, S>(dest, op1, UInt12(imm.m_value));
+            return Jump(makeBranch(cond));
+        }
+        if (isUInt12(-imm.m_value)) {
+            m_assembler.add<64, S>(dest, op1, UInt12(-imm.m_value));
+            return Jump(makeBranch(cond));
+        }
+
+        move(imm, getCachedDataTempRegisterIDAndInvalidate());
+        return branchSub64(cond, op1, dataTempRegister, dest);
+    }
+
+    Jump branchSub64(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchSub64(cond, dest, src, dest);
+    }
+
+    Jump branchSub64(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchSub64(cond, dest, imm, dest);
+    }
+
+    Jump branchSub64(RelationalCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT(isUInt12(imm.m_value));
+        m_assembler.sub<64, S>(dest, dest, UInt12(imm.m_value));
+        return Jump(makeBranch(cond));
+    }
+
+
+    // Jumps, calls, returns
+
+    ALWAYS_INLINE Call call()
+    {
+        AssemblerLabel pointerLabel = m_assembler.label();
+        moveWithFixedWidth(TrustedImmPtr(0), getCachedDataTempRegisterIDAndInvalidate());
+        invalidateAllTempRegisters();
+        m_assembler.blr(dataTempRegister);
+        AssemblerLabel callLabel = m_assembler.label();
+        ASSERT_UNUSED(pointerLabel, ARM64Assembler::getDifferenceBetweenLabels(callLabel, pointerLabel) == REPATCH_OFFSET_CALL_TO_POINTER);
+        return Call(callLabel, Call::Linkable);
+    }
+
+    ALWAYS_INLINE Call call(RegisterID target)
+    {
+        invalidateAllTempRegisters();
+        m_assembler.blr(target);
+        return Call(m_assembler.label(), Call::None);
+    }
+
+    ALWAYS_INLINE Call call(Address address)
+    {
+        load64(address, getCachedDataTempRegisterIDAndInvalidate());
+        return call(dataTempRegister);
+    }
+
+    ALWAYS_INLINE Jump jump()
+    {
+        AssemblerLabel label = m_assembler.label();
+        m_assembler.b();
+        return Jump(label, m_makeJumpPatchable ? ARM64Assembler::JumpNoConditionFixedSize : ARM64Assembler::JumpNoCondition);
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.br(target);
+    }
+
+    void jump(Address address)
+    {
+        load64(address, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.br(dataTempRegister);
+    }
+    
+    void jump(BaseIndex address)
+    {
+        load64(address, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.br(dataTempRegister);
+    }
+
+    void jump(AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), getCachedDataTempRegisterIDAndInvalidate());
+        load64(Address(dataTempRegister), dataTempRegister);
+        m_assembler.br(dataTempRegister);
+    }
+
+    ALWAYS_INLINE Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+    ALWAYS_INLINE Call nearCall()
+    {
+        m_assembler.bl();
+        return Call(m_assembler.label(), Call::LinkableNear);
+    }
+
+    ALWAYS_INLINE Call nearTailCall()
+    {
+        AssemblerLabel label = m_assembler.label();
+        m_assembler.b();
+        return Call(label, Call::LinkableNearTail);
+    }
+
+    ALWAYS_INLINE void ret()
+    {
+        m_assembler.ret();
+    }
+
+    ALWAYS_INLINE Call tailRecursiveCall()
+    {
+        // Like a normal call, but don't link.
+        AssemblerLabel pointerLabel = m_assembler.label();
+        moveWithFixedWidth(TrustedImmPtr(0), getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.br(dataTempRegister);
+        AssemblerLabel callLabel = m_assembler.label();
+        ASSERT_UNUSED(pointerLabel, ARM64Assembler::getDifferenceBetweenLabels(callLabel, pointerLabel) == REPATCH_OFFSET_CALL_TO_POINTER);
+        return Call(callLabel, Call::Linkable);
+    }
+
+
+    // Comparisons operations
+
+    void compare32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmp<32>(left, right);
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+
+    void compare32(RelationalCondition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        load32(left, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.cmp<32>(dataTempRegister, right);
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                test32(*resultCondition, left, left, dest);
+                return;
+            }
+        }
+
+        if (isUInt12(right.m_value))
+            m_assembler.cmp<32>(left, UInt12(right.m_value));
+        else if (isUInt12(-right.m_value))
+            m_assembler.cmn<32>(left, UInt12(-right.m_value));
+        else {
+            move(right, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.cmp<32>(left, dataTempRegister);
+        }
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+
+    void compare64(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmp<64>(left, right);
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+    
+    void compare64(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                test64(*resultCondition, left, left, dest);
+                return;
+            }
+        }
+
+        signExtend32ToPtr(right, getCachedDataTempRegisterIDAndInvalidate());
+        m_assembler.cmp<64>(left, dataTempRegister);
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+
+    void compare8(RelationalCondition cond, Address left, TrustedImm32 right, RegisterID dest)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, getCachedMemoryTempRegisterIDAndInvalidate());
+        move(right8, getCachedDataTempRegisterIDAndInvalidate());
+        compare32(cond, memoryTempRegister, dataTempRegister, dest);
+    }
+
+    void test32(ResultCondition cond, RegisterID src, RegisterID mask, RegisterID dest)
+    {
+        m_assembler.tst<32>(src, mask);
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+
+    void test32(ResultCondition cond, RegisterID src, TrustedImm32 mask, RegisterID dest)
+    {
+        test32(src, mask);
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+
+    void test32(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        load32(address, getCachedMemoryTempRegisterIDAndInvalidate());
+        test32(cond, memoryTempRegister, mask, dest);
+    }
+
+    void test8(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, getCachedMemoryTempRegisterIDAndInvalidate());
+        test32(cond, memoryTempRegister, mask8, dest);
+    }
+
+    void test64(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.tst<64>(op1, op2);
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+
+    void test64(ResultCondition cond, RegisterID src, TrustedImm32 mask, RegisterID dest)
+    {
+        if (mask.m_value == -1)
+            m_assembler.tst<64>(src, src);
+        else {
+            signExtend32ToPtr(mask, getCachedDataTempRegisterIDAndInvalidate());
+            m_assembler.tst<64>(src, dataTempRegister);
+        }
+        m_assembler.cset<32>(dest, ARM64Condition(cond));
+    }
+
+    void setCarry(RegisterID dest)
+    {
+        m_assembler.cset<32>(dest, ARM64Assembler::ConditionCS);
+    }
+
+    // Patchable operations
+
+    ALWAYS_INLINE DataLabel32 moveWithPatch(TrustedImm32 imm, RegisterID dest)
+    {
+        DataLabel32 label(this);
+        moveWithFixedWidth(imm, dest);
+        return label;
+    }
+
+    ALWAYS_INLINE DataLabelPtr moveWithPatch(TrustedImmPtr imm, RegisterID dest)
+    {
+        DataLabelPtr label(this);
+        moveWithFixedWidth(imm, dest);
+        return label;
+    }
+
+    ALWAYS_INLINE Jump branchPtrWithPatch(RelationalCondition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        dataLabel = DataLabelPtr(this);
+        moveWithPatch(initialRightValue, getCachedDataTempRegisterIDAndInvalidate());
+        return branch64(cond, left, dataTempRegister);
+    }
+
+    ALWAYS_INLINE Jump branchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        dataLabel = DataLabelPtr(this);
+        moveWithPatch(initialRightValue, getCachedDataTempRegisterIDAndInvalidate());
+        return branch64(cond, left, dataTempRegister);
+    }
+
+    ALWAYS_INLINE Jump branch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        dataLabel = DataLabel32(this);
+        moveWithPatch(initialRightValue, getCachedDataTempRegisterIDAndInvalidate());
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    PatchableJump patchableBranchPtr(RelationalCondition cond, Address left, TrustedImmPtr right)
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch64(cond, left, TrustedImm64(right));
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branchTest32(cond, reg, mask);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranch32(RelationalCondition cond, RegisterID reg, TrustedImm32 imm)
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch32(cond, reg, imm);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranch32(RelationalCondition cond, Address left, TrustedImm32 imm)
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch32(cond, left, imm);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranch64(RelationalCondition cond, RegisterID reg, TrustedImm64 imm)
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch64(cond, reg, imm);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranch64(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch64(cond, left, right);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branchPtrWithPatch(cond, left, dataLabel, initialRightValue);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch32WithPatch(cond, left, dataLabel, initialRightValue);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableJump()
+    {
+        m_makeJumpPatchable = true;
+        Jump result = jump();
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    ALWAYS_INLINE DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        DataLabelPtr label(this);
+        moveWithFixedWidth(initialValue, getCachedDataTempRegisterIDAndInvalidate());
+        store64(dataTempRegister, address);
+        return label;
+    }
+
+    ALWAYS_INLINE DataLabelPtr storePtrWithPatch(ImplicitAddress address)
+    {
+        return storePtrWithPatch(TrustedImmPtr(0), address);
+    }
+
+    static void reemitInitialMoveWithPatch(void* address, void* value)
+    {
+        ARM64Assembler::setPointer(static_cast<int*>(address), value, dataTempRegister, true);
+    }
+
+    // Miscellaneous operations:
+
+    void breakpoint(uint16_t imm = 0)
+    {
+        m_assembler.brk(imm);
+    }
+
+    void nop()
+    {
+        m_assembler.nop();
+    }
+    
+    // We take memoryFence to mean acqrel. This has acqrel semantics on ARM64.
+    void memoryFence()
+    {
+        m_assembler.dmbISH();
+    }
+
+    // We take this to mean that it prevents motion of normal stores. That's a store fence on ARM64 (hence the "ST").
+    void storeFence()
+    {
+        m_assembler.dmbISHST();
+    }
+
+    // We take this to mean that it prevents motion of normal loads. Ideally we'd have expressed this
+    // using dependencies or half fences, but there are cases where this is as good as it gets. The only
+    // way to get a standalone load fence instruction on ARM is to use the ISH fence, which is just like
+    // the memoryFence().
+    void loadFence()
+    {
+        m_assembler.dmbISH();
+    }
+
+    // Misc helper functions.
+
+    // Invert a relational condition, e.g. == becomes !=, < becomes >=, etc.
+    static RelationalCondition invert(RelationalCondition cond)
+    {
+        return static_cast<RelationalCondition>(ARM64Assembler::invert(static_cast<ARM64Assembler::Condition>(cond)));
+    }
+
+    static std::optional<ResultCondition> commuteCompareToZeroIntoTest(RelationalCondition cond)
+    {
+        switch (cond) {
+        case Equal:
+            return Zero;
+        case NotEqual:
+            return NonZero;
+        case LessThan:
+            return Signed;
+        case GreaterThanOrEqual:
+            return PositiveOrZero;
+            break;
+        default:
+            return std::nullopt;
+        }
+    }
+
+    static FunctionPtr readCallTarget(CodeLocationCall call)
+    {
+        return FunctionPtr(reinterpret_cast<void(*)()>(ARM64Assembler::readCallTarget(call.dataLocation())));
+    }
+
+    static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)
+    {
+        ARM64Assembler::replaceWithJump(instructionStart.dataLocation(), destination.dataLocation());
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return ARM64Assembler::maxJumpReplacementSize();
+    }
+
+    static ptrdiff_t patchableJumpSize()
+    {
+        return ARM64Assembler::patchableJumpSize();
+    }
+
+    RegisterID scratchRegisterForBlinding()
+    {
+        // We *do not* have a scratch register for blinding.
+        RELEASE_ASSERT_NOT_REACHED();
+        return getCachedDataTempRegisterIDAndInvalidate();
+    }
+
+    static bool canJumpReplacePatchableBranchPtrWithPatch() { return false; }
+    static bool canJumpReplacePatchableBranch32WithPatch() { return false; }
+    
+    static CodeLocationLabel startOfBranchPtrWithPatchOnRegister(CodeLocationDataLabelPtr label)
+    {
+        return label.labelAtOffset(0);
+    }
+    
+    static CodeLocationLabel startOfPatchableBranchPtrWithPatchOnAddress(CodeLocationDataLabelPtr)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+    
+    static CodeLocationLabel startOfPatchableBranch32WithPatchOnAddress(CodeLocationDataLabel32)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+    
+    static void revertJumpReplacementToBranchPtrWithPatch(CodeLocationLabel instructionStart, RegisterID, void* initialValue)
+    {
+        reemitInitialMoveWithPatch(instructionStart.dataLocation(), initialValue);
+    }
+    
+    static void revertJumpReplacementToPatchableBranchPtrWithPatch(CodeLocationLabel, Address, void*)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void revertJumpReplacementToPatchableBranch32WithPatch(CodeLocationLabel, Address, int32_t)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        ARM64Assembler::repatchPointer(call.dataLabelPtrAtOffset(REPATCH_OFFSET_CALL_TO_POINTER).dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        ARM64Assembler::repatchPointer(call.dataLabelPtrAtOffset(REPATCH_OFFSET_CALL_TO_POINTER).dataLocation(), destination.executableAddress());
+    }
+
+#if ENABLE(MASM_PROBE)
+    void probe(ProbeFunction, void* arg1, void* arg2);
+#endif // ENABLE(MASM_PROBE)
+
+protected:
+    ALWAYS_INLINE Jump makeBranch(ARM64Assembler::Condition cond)
+    {
+        m_assembler.b_cond(cond);
+        AssemblerLabel label = m_assembler.label();
+        m_assembler.nop();
+        return Jump(label, m_makeJumpPatchable ? ARM64Assembler::JumpConditionFixedSize : ARM64Assembler::JumpCondition, cond);
+    }
+    ALWAYS_INLINE Jump makeBranch(RelationalCondition cond) { return makeBranch(ARM64Condition(cond)); }
+    ALWAYS_INLINE Jump makeBranch(ResultCondition cond) { return makeBranch(ARM64Condition(cond)); }
+    ALWAYS_INLINE Jump makeBranch(DoubleCondition cond) { return makeBranch(ARM64Condition(cond)); }
+
+    template <int dataSize>
+    ALWAYS_INLINE Jump makeCompareAndBranch(ZeroCondition cond, RegisterID reg)
+    {
+        if (cond == IsZero)
+            m_assembler.cbz<dataSize>(reg);
+        else
+            m_assembler.cbnz<dataSize>(reg);
+        AssemblerLabel label = m_assembler.label();
+        m_assembler.nop();
+        return Jump(label, m_makeJumpPatchable ? ARM64Assembler::JumpCompareAndBranchFixedSize : ARM64Assembler::JumpCompareAndBranch, static_cast<ARM64Assembler::Condition>(cond), dataSize == 64, reg);
+    }
+
+    ALWAYS_INLINE Jump makeTestBitAndBranch(RegisterID reg, unsigned bit, ZeroCondition cond)
+    {
+        ASSERT(bit < 64);
+        bit &= 0x3f;
+        if (cond == IsZero)
+            m_assembler.tbz(reg, bit);
+        else
+            m_assembler.tbnz(reg, bit);
+        AssemblerLabel label = m_assembler.label();
+        m_assembler.nop();
+        return Jump(label, m_makeJumpPatchable ? ARM64Assembler::JumpTestBitFixedSize : ARM64Assembler::JumpTestBit, static_cast<ARM64Assembler::Condition>(cond), bit, reg);
+    }
+
+    ARM64Assembler::Condition ARM64Condition(RelationalCondition cond)
+    {
+        return static_cast<ARM64Assembler::Condition>(cond);
+    }
+
+    ARM64Assembler::Condition ARM64Condition(ResultCondition cond)
+    {
+        return static_cast<ARM64Assembler::Condition>(cond);
+    }
+
+    ARM64Assembler::Condition ARM64Condition(DoubleCondition cond)
+    {
+        return static_cast<ARM64Assembler::Condition>(cond);
+    }
+    
+private:
+    ALWAYS_INLINE RegisterID getCachedDataTempRegisterIDAndInvalidate()
+    {
+        RELEASE_ASSERT(m_allowScratchRegister);
+        return dataMemoryTempRegister().registerIDInvalidate();
+    }
+    ALWAYS_INLINE RegisterID getCachedMemoryTempRegisterIDAndInvalidate()
+    {
+        RELEASE_ASSERT(m_allowScratchRegister);
+        return cachedMemoryTempRegister().registerIDInvalidate();
+    }
+    ALWAYS_INLINE CachedTempRegister& dataMemoryTempRegister()
+    {
+        RELEASE_ASSERT(m_allowScratchRegister);
+        return m_dataMemoryTempRegister;
+    }
+    ALWAYS_INLINE CachedTempRegister& cachedMemoryTempRegister()
+    {
+        RELEASE_ASSERT(m_allowScratchRegister);
+        return m_cachedMemoryTempRegister;
+    }
+
+    ALWAYS_INLINE bool isInIntRange(intptr_t value)
+    {
+        return value == ((value << 32) >> 32);
+    }
+
+    template<typename ImmediateType, typename rawType>
+    void moveInternal(ImmediateType imm, RegisterID dest)
+    {
+        const int dataSize = sizeof(rawType) * 8;
+        const int numberHalfWords = dataSize / 16;
+        rawType value = bitwise_cast<rawType>(imm.m_value);
+        uint16_t halfword[numberHalfWords];
+
+        // Handle 0 and ~0 here to simplify code below
+        if (!value) {
+            m_assembler.movz<dataSize>(dest, 0);
+            return;
+        }
+        if (!~value) {
+            m_assembler.movn<dataSize>(dest, 0);
+            return;
+        }
+
+        LogicalImmediate logicalImm = dataSize == 64 ? LogicalImmediate::create64(static_cast<uint64_t>(value)) : LogicalImmediate::create32(static_cast<uint32_t>(value));
+
+        if (logicalImm.isValid()) {
+            m_assembler.movi<dataSize>(dest, logicalImm);
+            return;
+        }
+
+        // Figure out how many halfwords are 0 or FFFF, then choose movz or movn accordingly.
+        int zeroOrNegateVote = 0;
+        for (int i = 0; i < numberHalfWords; ++i) {
+            halfword[i] = getHalfword(value, i);
+            if (!halfword[i])
+                zeroOrNegateVote++;
+            else if (halfword[i] == 0xffff)
+                zeroOrNegateVote--;
+        }
+
+        bool needToClearRegister = true;
+        if (zeroOrNegateVote >= 0) {
+            for (int i = 0; i < numberHalfWords; i++) {
+                if (halfword[i]) {
+                    if (needToClearRegister) {
+                        m_assembler.movz<dataSize>(dest, halfword[i], 16*i);
+                        needToClearRegister = false;
+                    } else
+                        m_assembler.movk<dataSize>(dest, halfword[i], 16*i);
+                }
+            }
+        } else {
+            for (int i = 0; i < numberHalfWords; i++) {
+                if (halfword[i] != 0xffff) {
+                    if (needToClearRegister) {
+                        m_assembler.movn<dataSize>(dest, ~halfword[i], 16*i);
+                        needToClearRegister = false;
+                    } else
+                        m_assembler.movk<dataSize>(dest, halfword[i], 16*i);
+                }
+            }
+        }
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void loadUnsignedImmediate(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        m_assembler.ldr<datasize>(rt, rn, pimm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void loadUnscaledImmediate(RegisterID rt, RegisterID rn, int simm)
+    {
+        m_assembler.ldur<datasize>(rt, rn, simm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void loadSignedAddressedByUnsignedImmediate(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        loadUnsignedImmediate<datasize>(rt, rn, pimm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void loadSignedAddressedByUnscaledImmediate(RegisterID rt, RegisterID rn, int simm)
+    {
+        loadUnscaledImmediate<datasize>(rt, rn, simm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void storeUnsignedImmediate(RegisterID rt, RegisterID rn, unsigned pimm)
+    {
+        m_assembler.str<datasize>(rt, rn, pimm);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void storeUnscaledImmediate(RegisterID rt, RegisterID rn, int simm)
+    {
+        m_assembler.stur<datasize>(rt, rn, simm);
+    }
+
+    void moveWithFixedWidth(TrustedImm32 imm, RegisterID dest)
+    {
+        int32_t value = imm.m_value;
+        m_assembler.movz<32>(dest, getHalfword(value, 0));
+        m_assembler.movk<32>(dest, getHalfword(value, 1), 16);
+    }
+
+    void moveWithFixedWidth(TrustedImmPtr imm, RegisterID dest)
+    {
+        intptr_t value = reinterpret_cast<intptr_t>(imm.m_value);
+        m_assembler.movz<64>(dest, getHalfword(value, 0));
+        m_assembler.movk<64>(dest, getHalfword(value, 1), 16);
+        m_assembler.movk<64>(dest, getHalfword(value, 2), 32);
+    }
+
+    void signExtend32ToPtrWithFixedWidth(int32_t value, RegisterID dest)
+    {
+        if (value >= 0) {
+            m_assembler.movz<32>(dest, getHalfword(value, 0));
+            m_assembler.movk<32>(dest, getHalfword(value, 1), 16);
+        } else {
+            m_assembler.movn<32>(dest, ~getHalfword(value, 0));
+            m_assembler.movk<32>(dest, getHalfword(value, 1), 16);
+        }
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void load(const void* address, RegisterID dest)
+    {
+        intptr_t currentRegisterContents;
+        if (cachedMemoryTempRegister().value(currentRegisterContents)) {
+            intptr_t addressAsInt = reinterpret_cast<intptr_t>(address);
+            intptr_t addressDelta = addressAsInt - currentRegisterContents;
+
+            if (dest == memoryTempRegister)
+                cachedMemoryTempRegister().invalidate();
+
+            if (isInIntRange(addressDelta)) {
+                if (ARM64Assembler::canEncodeSImmOffset(addressDelta)) {
+                    m_assembler.ldur<datasize>(dest,  memoryTempRegister, addressDelta);
+                    return;
+                }
+
+                if (ARM64Assembler::canEncodePImmOffset<datasize>(addressDelta)) {
+                    m_assembler.ldr<datasize>(dest,  memoryTempRegister, addressDelta);
+                    return;
+                }
+            }
+
+            if ((addressAsInt & (~maskHalfWord0)) == (currentRegisterContents & (~maskHalfWord0))) {
+                m_assembler.movk<64>(memoryTempRegister, addressAsInt & maskHalfWord0, 0);
+                cachedMemoryTempRegister().setValue(reinterpret_cast<intptr_t>(address));
+                m_assembler.ldr<datasize>(dest, memoryTempRegister, ARM64Registers::zr);
+                return;
+            }
+        }
+
+        move(TrustedImmPtr(address), memoryTempRegister);
+        if (dest == memoryTempRegister)
+            cachedMemoryTempRegister().invalidate();
+        else
+            cachedMemoryTempRegister().setValue(reinterpret_cast<intptr_t>(address));
+        m_assembler.ldr<datasize>(dest, memoryTempRegister, ARM64Registers::zr);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE void store(RegisterID src, const void* address)
+    {
+        ASSERT(src != memoryTempRegister);
+        intptr_t currentRegisterContents;
+        if (cachedMemoryTempRegister().value(currentRegisterContents)) {
+            intptr_t addressAsInt = reinterpret_cast<intptr_t>(address);
+            intptr_t addressDelta = addressAsInt - currentRegisterContents;
+
+            if (isInIntRange(addressDelta)) {
+                if (ARM64Assembler::canEncodeSImmOffset(addressDelta)) {
+                    m_assembler.stur<datasize>(src, memoryTempRegister, addressDelta);
+                    return;
+                }
+
+                if (ARM64Assembler::canEncodePImmOffset<datasize>(addressDelta)) {
+                    m_assembler.str<datasize>(src, memoryTempRegister, addressDelta);
+                    return;
+                }
+            }
+
+            if ((addressAsInt & (~maskHalfWord0)) == (currentRegisterContents & (~maskHalfWord0))) {
+                m_assembler.movk<64>(memoryTempRegister, addressAsInt & maskHalfWord0, 0);
+                cachedMemoryTempRegister().setValue(reinterpret_cast<intptr_t>(address));
+                m_assembler.str<datasize>(src, memoryTempRegister, ARM64Registers::zr);
+                return;
+            }
+        }
+
+        move(TrustedImmPtr(address), memoryTempRegister);
+        cachedMemoryTempRegister().setValue(reinterpret_cast<intptr_t>(address));
+        m_assembler.str<datasize>(src, memoryTempRegister, ARM64Registers::zr);
+    }
+
+    template <int dataSize>
+    ALWAYS_INLINE bool tryMoveUsingCacheRegisterContents(intptr_t immediate, CachedTempRegister& dest)
+    {
+        intptr_t currentRegisterContents;
+        if (dest.value(currentRegisterContents)) {
+            if (currentRegisterContents == immediate)
+                return true;
+
+            LogicalImmediate logicalImm = dataSize == 64 ? LogicalImmediate::create64(static_cast<uint64_t>(immediate)) : LogicalImmediate::create32(static_cast<uint32_t>(immediate));
+
+            if (logicalImm.isValid()) {
+                m_assembler.movi<dataSize>(dest.registerIDNoInvalidate(), logicalImm);
+                dest.setValue(immediate);
+                return true;
+            }
+
+            if ((immediate & maskUpperWord) == (currentRegisterContents & maskUpperWord)) {
+                if ((immediate & maskHalfWord1) != (currentRegisterContents & maskHalfWord1))
+                    m_assembler.movk<dataSize>(dest.registerIDNoInvalidate(), (immediate & maskHalfWord1) >> 16, 16);
+
+                if ((immediate & maskHalfWord0) != (currentRegisterContents & maskHalfWord0))
+                    m_assembler.movk<dataSize>(dest.registerIDNoInvalidate(), immediate & maskHalfWord0, 0);
+
+                dest.setValue(immediate);
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    void moveToCachedReg(TrustedImm32 imm, CachedTempRegister& dest)
+    {
+        if (tryMoveUsingCacheRegisterContents<32>(static_cast<intptr_t>(imm.m_value), dest))
+            return;
+
+        moveInternal<TrustedImm32, int32_t>(imm, dest.registerIDNoInvalidate());
+        dest.setValue(imm.m_value);
+    }
+
+    void moveToCachedReg(TrustedImmPtr imm, CachedTempRegister& dest)
+    {
+        if (tryMoveUsingCacheRegisterContents<64>(imm.asIntptr(), dest))
+            return;
+
+        moveInternal<TrustedImmPtr, intptr_t>(imm, dest.registerIDNoInvalidate());
+        dest.setValue(imm.asIntptr());
+    }
+
+    void moveToCachedReg(TrustedImm64 imm, CachedTempRegister& dest)
+    {
+        if (tryMoveUsingCacheRegisterContents<64>(static_cast<intptr_t>(imm.m_value), dest))
+            return;
+
+        moveInternal<TrustedImm64, int64_t>(imm, dest.registerIDNoInvalidate());
+        dest.setValue(imm.m_value);
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE bool tryLoadWithOffset(RegisterID rt, RegisterID rn, int32_t offset)
+    {
+        if (ARM64Assembler::canEncodeSImmOffset(offset)) {
+            loadUnscaledImmediate<datasize>(rt, rn, offset);
+            return true;
+        }
+        if (ARM64Assembler::canEncodePImmOffset<datasize>(offset)) {
+            loadUnsignedImmediate<datasize>(rt, rn, static_cast<unsigned>(offset));
+            return true;
+        }
+        return false;
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE bool tryLoadSignedWithOffset(RegisterID rt, RegisterID rn, int32_t offset)
+    {
+        if (ARM64Assembler::canEncodeSImmOffset(offset)) {
+            loadSignedAddressedByUnscaledImmediate<datasize>(rt, rn, offset);
+            return true;
+        }
+        if (ARM64Assembler::canEncodePImmOffset<datasize>(offset)) {
+            loadSignedAddressedByUnsignedImmediate<datasize>(rt, rn, static_cast<unsigned>(offset));
+            return true;
+        }
+        return false;
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE bool tryLoadWithOffset(FPRegisterID rt, RegisterID rn, int32_t offset)
+    {
+        if (ARM64Assembler::canEncodeSImmOffset(offset)) {
+            m_assembler.ldur<datasize>(rt, rn, offset);
+            return true;
+        }
+        if (ARM64Assembler::canEncodePImmOffset<datasize>(offset)) {
+            m_assembler.ldr<datasize>(rt, rn, static_cast<unsigned>(offset));
+            return true;
+        }
+        return false;
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE bool tryStoreWithOffset(RegisterID rt, RegisterID rn, int32_t offset)
+    {
+        if (ARM64Assembler::canEncodeSImmOffset(offset)) {
+            storeUnscaledImmediate<datasize>(rt, rn, offset);
+            return true;
+        }
+        if (ARM64Assembler::canEncodePImmOffset<datasize>(offset)) {
+            storeUnsignedImmediate<datasize>(rt, rn, static_cast<unsigned>(offset));
+            return true;
+        }
+        return false;
+    }
+
+    template<int datasize>
+    ALWAYS_INLINE bool tryStoreWithOffset(FPRegisterID rt, RegisterID rn, int32_t offset)
+    {
+        if (ARM64Assembler::canEncodeSImmOffset(offset)) {
+            m_assembler.stur<datasize>(rt, rn, offset);
+            return true;
+        }
+        if (ARM64Assembler::canEncodePImmOffset<datasize>(offset)) {
+            m_assembler.str<datasize>(rt, rn, static_cast<unsigned>(offset));
+            return true;
+        }
+        return false;
+    }
+
+    Jump jumpAfterFloatingPointCompare(DoubleCondition cond)
+    {
+        if (cond == DoubleNotEqual) {
+            // ConditionNE jumps if NotEqual *or* unordered - force the unordered cases not to jump.
+            Jump unordered = makeBranch(ARM64Assembler::ConditionVS);
+            Jump result = makeBranch(ARM64Assembler::ConditionNE);
+            unordered.link(this);
+            return result;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            Jump unordered = makeBranch(ARM64Assembler::ConditionVS);
+            Jump notEqual = makeBranch(ARM64Assembler::ConditionNE);
+            unordered.link(this);
+            // We get here if either unordered or equal.
+            Jump result = jump();
+            notEqual.link(this);
+            return result;
+        }
+        return makeBranch(cond);
+    }
+
+    friend class LinkBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        if (!call.isFlagSet(Call::Near))
+            ARM64Assembler::linkPointer(code, call.m_label.labelAtOffset(REPATCH_OFFSET_CALL_TO_POINTER), function.value());
+        else if (call.isFlagSet(Call::Tail))
+            ARM64Assembler::linkJump(code, call.m_label, function.value());
+        else
+            ARM64Assembler::linkCall(code, call.m_label, function.value());
+    }
+
+    CachedTempRegister m_dataMemoryTempRegister;
+    CachedTempRegister m_cachedMemoryTempRegister;
+    bool m_makeJumpPatchable;
+};
+
+// Extend the {load,store}{Unsigned,Unscaled}Immediate templated general register methods to cover all load/store sizes
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::loadUnsignedImmediate<8>(RegisterID rt, RegisterID rn, unsigned pimm)
+{
+    m_assembler.ldrb(rt, rn, pimm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::loadUnsignedImmediate<16>(RegisterID rt, RegisterID rn, unsigned pimm)
+{
+    m_assembler.ldrh(rt, rn, pimm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate<8>(RegisterID rt, RegisterID rn, unsigned pimm)
+{
+    m_assembler.ldrsb<64>(rt, rn, pimm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::loadSignedAddressedByUnsignedImmediate<16>(RegisterID rt, RegisterID rn, unsigned pimm)
+{
+    m_assembler.ldrsh<64>(rt, rn, pimm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::loadUnscaledImmediate<8>(RegisterID rt, RegisterID rn, int simm)
+{
+    m_assembler.ldurb(rt, rn, simm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::loadUnscaledImmediate<16>(RegisterID rt, RegisterID rn, int simm)
+{
+    m_assembler.ldurh(rt, rn, simm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate<8>(RegisterID rt, RegisterID rn, int simm)
+{
+    m_assembler.ldursb<64>(rt, rn, simm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::loadSignedAddressedByUnscaledImmediate<16>(RegisterID rt, RegisterID rn, int simm)
+{
+    m_assembler.ldursh<64>(rt, rn, simm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::storeUnsignedImmediate<8>(RegisterID rt, RegisterID rn, unsigned pimm)
+{
+    m_assembler.strb(rt, rn, pimm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::storeUnsignedImmediate<16>(RegisterID rt, RegisterID rn, unsigned pimm)
+{
+    m_assembler.strh(rt, rn, pimm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::storeUnscaledImmediate<8>(RegisterID rt, RegisterID rn, int simm)
+{
+    m_assembler.sturb(rt, rn, simm);
+}
+
+template<>
+ALWAYS_INLINE void MacroAssemblerARM64::storeUnscaledImmediate<16>(RegisterID rt, RegisterID rn, int simm)
+{
+    m_assembler.sturh(rt, rn, simm);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/MacroAssemblerARMv7.cpp b/assembler/MacroAssemblerARMv7.cpp
new file mode 100644
index 0000000..7119697
--- /dev/null
+++ b/assembler/MacroAssemblerARMv7.cpp
@@ -0,0 +1,348 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
+#include "MacroAssemblerARMv7.h"
+
+#include <wtf/InlineASM.h>
+
+namespace JSC {
+
+#if ENABLE(MASM_PROBE)
+
+extern "C" void ctiMasmProbeTrampoline();
+
+#if COMPILER(GCC_OR_CLANG)
+
+// The following are offsets for MacroAssemblerARMv7::ProbeContext fields accessed
+// by the ctiMasmProbeTrampoline stub.
+
+#define PTR_SIZE 4
+#define PROBE_PROBE_FUNCTION_OFFSET (0 * PTR_SIZE)
+#define PROBE_ARG1_OFFSET (1 * PTR_SIZE)
+#define PROBE_ARG2_OFFSET (2 * PTR_SIZE)
+
+#define PROBE_FIRST_GPREG_OFFSET (3 * PTR_SIZE)
+
+#define GPREG_SIZE 4
+#define PROBE_CPU_R0_OFFSET (PROBE_FIRST_GPREG_OFFSET + (0 * GPREG_SIZE))
+#define PROBE_CPU_R1_OFFSET (PROBE_FIRST_GPREG_OFFSET + (1 * GPREG_SIZE))
+#define PROBE_CPU_R2_OFFSET (PROBE_FIRST_GPREG_OFFSET + (2 * GPREG_SIZE))
+#define PROBE_CPU_R3_OFFSET (PROBE_FIRST_GPREG_OFFSET + (3 * GPREG_SIZE))
+#define PROBE_CPU_R4_OFFSET (PROBE_FIRST_GPREG_OFFSET + (4 * GPREG_SIZE))
+#define PROBE_CPU_R5_OFFSET (PROBE_FIRST_GPREG_OFFSET + (5 * GPREG_SIZE))
+#define PROBE_CPU_R6_OFFSET (PROBE_FIRST_GPREG_OFFSET + (6 * GPREG_SIZE))
+#define PROBE_CPU_R7_OFFSET (PROBE_FIRST_GPREG_OFFSET + (7 * GPREG_SIZE))
+#define PROBE_CPU_R8_OFFSET (PROBE_FIRST_GPREG_OFFSET + (8 * GPREG_SIZE))
+#define PROBE_CPU_R9_OFFSET (PROBE_FIRST_GPREG_OFFSET + (9 * GPREG_SIZE))
+#define PROBE_CPU_R10_OFFSET (PROBE_FIRST_GPREG_OFFSET + (10 * GPREG_SIZE))
+#define PROBE_CPU_R11_OFFSET (PROBE_FIRST_GPREG_OFFSET + (11 * GPREG_SIZE))
+#define PROBE_CPU_IP_OFFSET (PROBE_FIRST_GPREG_OFFSET + (12 * GPREG_SIZE))
+#define PROBE_CPU_SP_OFFSET (PROBE_FIRST_GPREG_OFFSET + (13 * GPREG_SIZE))
+#define PROBE_CPU_LR_OFFSET (PROBE_FIRST_GPREG_OFFSET + (14 * GPREG_SIZE))
+#define PROBE_CPU_PC_OFFSET (PROBE_FIRST_GPREG_OFFSET + (15 * GPREG_SIZE))
+
+#define PROBE_CPU_APSR_OFFSET (PROBE_FIRST_GPREG_OFFSET + (16 * GPREG_SIZE))
+#define PROBE_CPU_FPSCR_OFFSET (PROBE_FIRST_GPREG_OFFSET + (17 * GPREG_SIZE))
+
+#define PROBE_FIRST_FPREG_OFFSET (PROBE_FIRST_GPREG_OFFSET + (18 * GPREG_SIZE))
+
+#define FPREG_SIZE 8
+#define PROBE_CPU_D0_OFFSET (PROBE_FIRST_FPREG_OFFSET + (0 * FPREG_SIZE))
+#define PROBE_CPU_D1_OFFSET (PROBE_FIRST_FPREG_OFFSET + (1 * FPREG_SIZE))
+#define PROBE_CPU_D2_OFFSET (PROBE_FIRST_FPREG_OFFSET + (2 * FPREG_SIZE))
+#define PROBE_CPU_D3_OFFSET (PROBE_FIRST_FPREG_OFFSET + (3 * FPREG_SIZE))
+#define PROBE_CPU_D4_OFFSET (PROBE_FIRST_FPREG_OFFSET + (4 * FPREG_SIZE))
+#define PROBE_CPU_D5_OFFSET (PROBE_FIRST_FPREG_OFFSET + (5 * FPREG_SIZE))
+#define PROBE_CPU_D6_OFFSET (PROBE_FIRST_FPREG_OFFSET + (6 * FPREG_SIZE))
+#define PROBE_CPU_D7_OFFSET (PROBE_FIRST_FPREG_OFFSET + (7 * FPREG_SIZE))
+#define PROBE_CPU_D8_OFFSET (PROBE_FIRST_FPREG_OFFSET + (8 * FPREG_SIZE))
+#define PROBE_CPU_D9_OFFSET (PROBE_FIRST_FPREG_OFFSET + (9 * FPREG_SIZE))
+#define PROBE_CPU_D10_OFFSET (PROBE_FIRST_FPREG_OFFSET + (10 * FPREG_SIZE))
+#define PROBE_CPU_D11_OFFSET (PROBE_FIRST_FPREG_OFFSET + (11 * FPREG_SIZE))
+#define PROBE_CPU_D12_OFFSET (PROBE_FIRST_FPREG_OFFSET + (12 * FPREG_SIZE))
+#define PROBE_CPU_D13_OFFSET (PROBE_FIRST_FPREG_OFFSET + (13 * FPREG_SIZE))
+#define PROBE_CPU_D14_OFFSET (PROBE_FIRST_FPREG_OFFSET + (14 * FPREG_SIZE))
+#define PROBE_CPU_D15_OFFSET (PROBE_FIRST_FPREG_OFFSET + (15 * FPREG_SIZE))
+#define PROBE_CPU_D16_OFFSET (PROBE_FIRST_FPREG_OFFSET + (16 * FPREG_SIZE))
+#define PROBE_CPU_D17_OFFSET (PROBE_FIRST_FPREG_OFFSET + (17 * FPREG_SIZE))
+#define PROBE_CPU_D18_OFFSET (PROBE_FIRST_FPREG_OFFSET + (18 * FPREG_SIZE))
+#define PROBE_CPU_D19_OFFSET (PROBE_FIRST_FPREG_OFFSET + (19 * FPREG_SIZE))
+#define PROBE_CPU_D20_OFFSET (PROBE_FIRST_FPREG_OFFSET + (20 * FPREG_SIZE))
+#define PROBE_CPU_D21_OFFSET (PROBE_FIRST_FPREG_OFFSET + (21 * FPREG_SIZE))
+#define PROBE_CPU_D22_OFFSET (PROBE_FIRST_FPREG_OFFSET + (22 * FPREG_SIZE))
+#define PROBE_CPU_D23_OFFSET (PROBE_FIRST_FPREG_OFFSET + (23 * FPREG_SIZE))
+#define PROBE_CPU_D24_OFFSET (PROBE_FIRST_FPREG_OFFSET + (24 * FPREG_SIZE))
+#define PROBE_CPU_D25_OFFSET (PROBE_FIRST_FPREG_OFFSET + (25 * FPREG_SIZE))
+#define PROBE_CPU_D26_OFFSET (PROBE_FIRST_FPREG_OFFSET + (26 * FPREG_SIZE))
+#define PROBE_CPU_D27_OFFSET (PROBE_FIRST_FPREG_OFFSET + (27 * FPREG_SIZE))
+#define PROBE_CPU_D28_OFFSET (PROBE_FIRST_FPREG_OFFSET + (28 * FPREG_SIZE))
+#define PROBE_CPU_D29_OFFSET (PROBE_FIRST_FPREG_OFFSET + (29 * FPREG_SIZE))
+#define PROBE_CPU_D30_OFFSET (PROBE_FIRST_FPREG_OFFSET + (30 * FPREG_SIZE))
+#define PROBE_CPU_D31_OFFSET (PROBE_FIRST_FPREG_OFFSET + (31 * FPREG_SIZE))
+#define PROBE_SIZE (PROBE_FIRST_FPREG_OFFSET + (32 * FPREG_SIZE))
+
+// These ASSERTs remind you that if you change the layout of ProbeContext,
+// you need to change ctiMasmProbeTrampoline offsets above to match.
+#define PROBE_OFFSETOF(x) offsetof(struct MacroAssemblerARMv7::ProbeContext, x)
+COMPILE_ASSERT(PROBE_OFFSETOF(probeFunction) == PROBE_PROBE_FUNCTION_OFFSET, ProbeContext_probeFunction_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg1) == PROBE_ARG1_OFFSET, ProbeContext_arg1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg2) == PROBE_ARG2_OFFSET, ProbeContext_arg2_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r0) == PROBE_CPU_R0_OFFSET, ProbeContext_cpu_r0_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r1) == PROBE_CPU_R1_OFFSET, ProbeContext_cpu_r1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r2) == PROBE_CPU_R2_OFFSET, ProbeContext_cpu_r2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r3) == PROBE_CPU_R3_OFFSET, ProbeContext_cpu_r3_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r4) == PROBE_CPU_R4_OFFSET, ProbeContext_cpu_r4_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r5) == PROBE_CPU_R5_OFFSET, ProbeContext_cpu_r5_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r6) == PROBE_CPU_R6_OFFSET, ProbeContext_cpu_r6_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r7) == PROBE_CPU_R7_OFFSET, ProbeContext_cpu_r7_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r8) == PROBE_CPU_R8_OFFSET, ProbeContext_cpu_r8_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r9) == PROBE_CPU_R9_OFFSET, ProbeContext_cpu_r9_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r10) == PROBE_CPU_R10_OFFSET, ProbeContext_cpu_r10_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r11) == PROBE_CPU_R11_OFFSET, ProbeContext_cpu_r11_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.ip) == PROBE_CPU_IP_OFFSET, ProbeContext_cpu_ip_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.sp) == PROBE_CPU_SP_OFFSET, ProbeContext_cpu_sp_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.lr) == PROBE_CPU_LR_OFFSET, ProbeContext_cpu_lr_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.pc) == PROBE_CPU_PC_OFFSET, ProbeContext_cpu_pc_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.apsr) == PROBE_CPU_APSR_OFFSET, ProbeContext_cpu_apsr_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.fpscr) == PROBE_CPU_FPSCR_OFFSET, ProbeContext_cpu_fpscr_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d0) == PROBE_CPU_D0_OFFSET, ProbeContext_cpu_d0_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d1) == PROBE_CPU_D1_OFFSET, ProbeContext_cpu_d1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d2) == PROBE_CPU_D2_OFFSET, ProbeContext_cpu_d2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d3) == PROBE_CPU_D3_OFFSET, ProbeContext_cpu_d3_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d4) == PROBE_CPU_D4_OFFSET, ProbeContext_cpu_d4_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d5) == PROBE_CPU_D5_OFFSET, ProbeContext_cpu_d5_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d6) == PROBE_CPU_D6_OFFSET, ProbeContext_cpu_d6_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d7) == PROBE_CPU_D7_OFFSET, ProbeContext_cpu_d7_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d8) == PROBE_CPU_D8_OFFSET, ProbeContext_cpu_d8_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d9) == PROBE_CPU_D9_OFFSET, ProbeContext_cpu_d9_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d10) == PROBE_CPU_D10_OFFSET, ProbeContext_cpu_d10_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d11) == PROBE_CPU_D11_OFFSET, ProbeContext_cpu_d11_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d12) == PROBE_CPU_D12_OFFSET, ProbeContext_cpu_d12_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d13) == PROBE_CPU_D13_OFFSET, ProbeContext_cpu_d13_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d14) == PROBE_CPU_D14_OFFSET, ProbeContext_cpu_d14_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d15) == PROBE_CPU_D15_OFFSET, ProbeContext_cpu_d15_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d16) == PROBE_CPU_D16_OFFSET, ProbeContext_cpu_d16_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d17) == PROBE_CPU_D17_OFFSET, ProbeContext_cpu_d17_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d18) == PROBE_CPU_D18_OFFSET, ProbeContext_cpu_d18_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d19) == PROBE_CPU_D19_OFFSET, ProbeContext_cpu_d19_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d20) == PROBE_CPU_D20_OFFSET, ProbeContext_cpu_d20_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d21) == PROBE_CPU_D21_OFFSET, ProbeContext_cpu_d21_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d22) == PROBE_CPU_D22_OFFSET, ProbeContext_cpu_d22_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d23) == PROBE_CPU_D23_OFFSET, ProbeContext_cpu_d23_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d24) == PROBE_CPU_D24_OFFSET, ProbeContext_cpu_d24_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d25) == PROBE_CPU_D25_OFFSET, ProbeContext_cpu_d25_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d26) == PROBE_CPU_D26_OFFSET, ProbeContext_cpu_d26_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d27) == PROBE_CPU_D27_OFFSET, ProbeContext_cpu_d27_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d28) == PROBE_CPU_D28_OFFSET, ProbeContext_cpu_d28_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d29) == PROBE_CPU_D29_OFFSET, ProbeContext_cpu_d29_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d30) == PROBE_CPU_D30_OFFSET, ProbeContext_cpu_d30_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.d31) == PROBE_CPU_D31_OFFSET, ProbeContext_cpu_d31_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(sizeof(MacroAssemblerARMv7::ProbeContext) == PROBE_SIZE, ProbeContext_size_matches_ctiMasmProbeTrampoline);
+
+#undef PROBE_OFFSETOF
+    
+asm (
+    ".text" "\n"
+    ".align 2" "\n"
+    ".globl " SYMBOL_STRING(ctiMasmProbeTrampoline) "\n"
+    HIDE_SYMBOL(ctiMasmProbeTrampoline) "\n"
+    ".thumb" "\n"
+    ".thumb_func " THUMB_FUNC_PARAM(ctiMasmProbeTrampoline) "\n"
+    SYMBOL_STRING(ctiMasmProbeTrampoline) ":" "\n"
+
+    // MacroAssemblerARMv7::probe() has already generated code to store some values.
+    // The top of stack now looks like this:
+    //     esp[0 * ptrSize]: probeFunction
+    //     esp[1 * ptrSize]: arg1
+    //     esp[2 * ptrSize]: arg2
+    //     esp[3 * ptrSize]: saved r0
+    //     esp[4 * ptrSize]: saved ip
+    //     esp[5 * ptrSize]: saved lr
+    //     esp[6 * ptrSize]: saved sp
+
+    "mov       ip, sp" "\n"
+    "mov       r0, sp" "\n"
+    "sub       r0, r0, #" STRINGIZE_VALUE_OF(PROBE_SIZE) "\n"
+
+    // The ARM EABI specifies that the stack needs to be 16 byte aligned.
+    "bic       r0, r0, #0xf" "\n"
+    "mov       sp, r0" "\n"
+
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+    "add       lr, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_R1_OFFSET) "\n"
+    "stmia     lr, { r1-r11 }" "\n"
+    "mrs       lr, APSR" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "]" "\n"
+    "vmrs      lr, FPSCR" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FPSCR_OFFSET) "]" "\n"
+
+    "ldr       lr, [ip, #0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG1_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_ARG2_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_R0_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "ldr       lr, [ip, #6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+
+    "ldr       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+
+    "add       ip, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_D0_OFFSET) "\n"
+    "vstmia.64 ip!, { d0-d15 }" "\n"
+    "vstmia.64 ip!, { d16-d31 }" "\n"
+
+    "mov       fp, sp" "\n" // Save the ProbeContext*.
+
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "]" "\n"
+    "mov       r0, sp" "\n" // the ProbeContext* arg.
+    "blx       ip" "\n"
+
+    "mov       sp, fp" "\n"
+
+    // To enable probes to modify register state, we copy all registers
+    // out of the ProbeContext before returning.
+
+    "add       ip, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_D31_OFFSET + FPREG_SIZE) "\n"
+    "vldmdb.64 ip!, { d16-d31 }" "\n"
+    "vldmdb.64 ip!, { d0-d15 }" "\n"
+
+    "add       ip, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_R11_OFFSET + GPREG_SIZE) "\n"
+    "ldmdb     ip, { r0-r11 }" "\n"
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_FPSCR_OFFSET) "]" "\n"
+    "vmsr      FPSCR, ip" "\n"
+
+    // There are 5 more registers left to restore: ip, sp, lr, pc, and apsr.
+    // There are 2 issues that complicate the restoration of these last few
+    // registers:
+    //
+    // 1. Normal ARM calling convention relies on moving lr to pc to return to
+    //    the caller. In our case, the address to return to is specified by
+    //    ProbeContext.cpu.pc. And at that moment, we won't have any available
+    //    scratch registers to hold the return address (lr needs to hold
+    //    ProbeContext.cpu.lr, not the return address).
+    //
+    //    The solution is to store the return address on the stack and load the
+    //    pc from there.
+    //
+    // 2. Issue 1 means we will need to write to the stack location at
+    //    ProbeContext.cpu.sp - 4. But if the user probe function had modified
+    //    the value of ProbeContext.cpu.sp to point in the range between
+    //    &ProbeContext.cpu.ip thru &ProbeContext.cpu.aspr, then the action for
+    //    Issue 1 may trash the values to be restored before we can restore
+    //    them.
+    //
+    //    The solution is to check if ProbeContext.cpu.sp contains a value in
+    //    the undesirable range. If so, we copy the remaining ProbeContext
+    //    register data to a safe range (at memory lower than where
+    //    ProbeContext.cpu.sp points) first, and restore the remaining register
+    //    from this new range.
+
+    "add       ip, sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "\n"
+    "ldr       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+    "cmp       lr, ip" "\n"
+    "it        gt" "\n"
+    "bgt     " SYMBOL_STRING(ctiMasmProbeTrampolineEnd) "\n"
+
+    // We get here because the new expected stack pointer location is lower
+    // than where it's supposed to be. This means the safe range of stack
+    // memory where we'll be copying the remaining register restore values to
+    // might be in a region of memory below the sp i.e. unallocated stack
+    // memory. This, in turn, makes it vulnerable to interrupts potentially
+    // trashing the copied values. To prevent that, we must first allocate the
+    // needed stack memory by adjusting the sp before the copying.
+
+    "sub       lr, lr, #(6 * " STRINGIZE_VALUE_OF(PTR_SIZE)
+    " + " STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) ")" "\n"
+
+    "mov       ip, sp" "\n"
+    "mov       sp, lr" "\n"
+    "mov       lr, ip" "\n"
+
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+    "ldr       ip, [lr, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "]" "\n"
+    "str       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "]" "\n"
+
+    ".thumb_func " THUMB_FUNC_PARAM(ctiMasmProbeTrampolineEnd) "\n"
+    SYMBOL_STRING(ctiMasmProbeTrampolineEnd) ":" "\n"
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_PC_OFFSET) "]" "\n"
+    "ldr       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+    "sub       lr, lr, #" STRINGIZE_VALUE_OF(PTR_SIZE) "\n"
+    "str       ip, [lr]" "\n"
+    "str       lr, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_APSR_OFFSET) "]" "\n"
+    "msr       APSR, ip" "\n"
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_LR_OFFSET) "]" "\n"
+    "mov       lr, ip" "\n"
+    "ldr       ip, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_IP_OFFSET) "]" "\n"
+    "ldr       sp, [sp, #" STRINGIZE_VALUE_OF(PROBE_CPU_SP_OFFSET) "]" "\n"
+
+    "pop       { pc }" "\n"
+);
+#endif // COMPILER(GCC_OR_CLANG)
+
+void MacroAssemblerARMv7::probe(MacroAssemblerARMv7::ProbeFunction function, void* arg1, void* arg2)
+{
+    push(RegisterID::lr);
+    push(RegisterID::lr);
+    add32(TrustedImm32(8), RegisterID::sp, RegisterID::lr);
+    store32(RegisterID::lr, ArmAddress(RegisterID::sp, 4));
+    push(RegisterID::ip);
+    push(RegisterID::r0);
+    // The following uses RegisterID::ip. So, they must come after we push ip above.
+    push(trustedImm32FromPtr(arg2));
+    push(trustedImm32FromPtr(arg1));
+    push(trustedImm32FromPtr(function));
+
+    move(trustedImm32FromPtr(ctiMasmProbeTrampoline), RegisterID::ip);
+    m_assembler.blx(RegisterID::ip);
+}
+#endif // ENABLE(MASM_PROBE)
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
diff --git a/assembler/MacroAssemblerARMv7.h b/assembler/MacroAssemblerARMv7.h
new file mode 100644
index 0000000..3c95f28
--- /dev/null
+++ b/assembler/MacroAssemblerARMv7.h
@@ -0,0 +1,2139 @@
+/*
+ * Copyright (C) 2009-2010, 2014-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "ARMv7Assembler.h"
+#include "AbstractMacroAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler, MacroAssemblerARMv7> {
+    static const RegisterID dataTempRegister = ARMRegisters::ip;
+    static const RegisterID addressTempRegister = ARMRegisters::r6;
+
+    static const ARMRegisters::FPDoubleRegisterID fpTempRegister = ARMRegisters::d7;
+    inline ARMRegisters::FPSingleRegisterID fpTempRegisterAsSingle() { return ARMRegisters::asSingle(fpTempRegister); }
+
+public:
+    static const unsigned numGPRs = 16;
+    static const unsigned numFPRs = 16;
+    
+    MacroAssemblerARMv7()
+        : m_makeJumpPatchable(false)
+    {
+    }
+
+    typedef ARMv7Assembler::LinkRecord LinkRecord;
+    typedef ARMv7Assembler::JumpType JumpType;
+    typedef ARMv7Assembler::JumpLinkType JumpLinkType;
+    typedef ARMv7Assembler::Condition Condition;
+
+    static const ARMv7Assembler::Condition DefaultCondition = ARMv7Assembler::ConditionInvalid;
+    static const ARMv7Assembler::JumpType DefaultJump = ARMv7Assembler::JumpNoConditionFixedSize;
+
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return value >= -255 && value <= 255;
+    }
+
+    Vector<LinkRecord, 0, UnsafeVectorOverflow>& jumpsToLink() { return m_assembler.jumpsToLink(); }
+    void* unlinkedCode() { return m_assembler.unlinkedCode(); }
+    static bool canCompact(JumpType jumpType) { return ARMv7Assembler::canCompact(jumpType); }
+    static JumpLinkType computeJumpType(JumpType jumpType, const uint8_t* from, const uint8_t* to) { return ARMv7Assembler::computeJumpType(jumpType, from, to); }
+    static JumpLinkType computeJumpType(LinkRecord& record, const uint8_t* from, const uint8_t* to) { return ARMv7Assembler::computeJumpType(record, from, to); }
+    static int jumpSizeDelta(JumpType jumpType, JumpLinkType jumpLinkType) { return ARMv7Assembler::jumpSizeDelta(jumpType, jumpLinkType); }
+    static void link(LinkRecord& record, uint8_t* from, const uint8_t* fromInstruction, uint8_t* to) { return ARMv7Assembler::link(record, from, fromInstruction, to); }
+
+    struct ArmAddress {
+        enum AddressType {
+            HasOffset,
+            HasIndex,
+        } type;
+        RegisterID base;
+        union {
+            int32_t offset;
+            struct {
+                RegisterID index;
+                Scale scale;
+            };
+        } u;
+        
+        explicit ArmAddress(RegisterID base, int32_t offset = 0)
+            : type(HasOffset)
+            , base(base)
+        {
+            u.offset = offset;
+        }
+        
+        explicit ArmAddress(RegisterID base, RegisterID index, Scale scale = TimesOne)
+            : type(HasIndex)
+            , base(base)
+        {
+            u.index = index;
+            u.scale = scale;
+        }
+    };
+    
+public:
+    static const Scale ScalePtr = TimesFour;
+
+    enum RelationalCondition {
+        Equal = ARMv7Assembler::ConditionEQ,
+        NotEqual = ARMv7Assembler::ConditionNE,
+        Above = ARMv7Assembler::ConditionHI,
+        AboveOrEqual = ARMv7Assembler::ConditionHS,
+        Below = ARMv7Assembler::ConditionLO,
+        BelowOrEqual = ARMv7Assembler::ConditionLS,
+        GreaterThan = ARMv7Assembler::ConditionGT,
+        GreaterThanOrEqual = ARMv7Assembler::ConditionGE,
+        LessThan = ARMv7Assembler::ConditionLT,
+        LessThanOrEqual = ARMv7Assembler::ConditionLE
+    };
+
+    enum ResultCondition {
+        Overflow = ARMv7Assembler::ConditionVS,
+        Signed = ARMv7Assembler::ConditionMI,
+        PositiveOrZero = ARMv7Assembler::ConditionPL,
+        Zero = ARMv7Assembler::ConditionEQ,
+        NonZero = ARMv7Assembler::ConditionNE
+    };
+
+    enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = ARMv7Assembler::ConditionEQ,
+        DoubleNotEqual = ARMv7Assembler::ConditionVC, // Not the right flag! check for this & handle differently.
+        DoubleGreaterThan = ARMv7Assembler::ConditionGT,
+        DoubleGreaterThanOrEqual = ARMv7Assembler::ConditionGE,
+        DoubleLessThan = ARMv7Assembler::ConditionLO,
+        DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = ARMv7Assembler::ConditionVS, // Not the right flag! check for this & handle differently.
+        DoubleNotEqualOrUnordered = ARMv7Assembler::ConditionNE,
+        DoubleGreaterThanOrUnordered = ARMv7Assembler::ConditionHI,
+        DoubleGreaterThanOrEqualOrUnordered = ARMv7Assembler::ConditionHS,
+        DoubleLessThanOrUnordered = ARMv7Assembler::ConditionLT,
+        DoubleLessThanOrEqualOrUnordered = ARMv7Assembler::ConditionLE,
+    };
+
+    static const RegisterID stackPointerRegister = ARMRegisters::sp;
+    static const RegisterID framePointerRegister = ARMRegisters::fp;
+    static const RegisterID linkRegister = ARMRegisters::lr;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an TrustedImm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.add(dest, dest, src);
+    }
+
+    void add32(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.add(dest, left, right);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID dest)
+    {
+        add32(imm, dest, dest);
+    }
+    
+    void add32(AbsoluteAddress src, RegisterID dest)
+    {
+        load32(src.m_ptr, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+
+        // For adds with stack pointer destination, moving the src first to sp is
+        // needed to avoid unpredictable instruction
+        if (dest == ARMRegisters::sp && src != dest) {
+            move(src, ARMRegisters::sp);
+            src = ARMRegisters::sp;
+        }
+
+        if (armImm.isValid())
+            m_assembler.add(dest, src, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.add(dest, src, dataTempRegister);
+        }
+    }
+
+    void add32(TrustedImm32 imm, Address address)
+    {
+        load32(address, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.add(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address);
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.add(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void addPtrNoFlags(TrustedImm32 imm, RegisterID srcDest)
+    {
+        add32(imm, srcDest);
+    }
+    
+    void add64(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), addressTempRegister);
+
+        m_assembler.ldr(dataTempRegister, addressTempRegister, ARMThumbImmediate::makeUInt12(0));
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add_S(dataTempRegister, dataTempRegister, armImm);
+        else {
+            move(imm, addressTempRegister);
+            m_assembler.add_S(dataTempRegister, dataTempRegister, addressTempRegister);
+            move(TrustedImmPtr(address.m_ptr), addressTempRegister);
+        }
+        m_assembler.str(dataTempRegister, addressTempRegister, ARMThumbImmediate::makeUInt12(0));
+
+        m_assembler.ldr(dataTempRegister, addressTempRegister, ARMThumbImmediate::makeUInt12(4));
+        m_assembler.adc(dataTempRegister, dataTempRegister, ARMThumbImmediate::makeEncodedImm(imm.m_value >> 31));
+        m_assembler.str(dataTempRegister, addressTempRegister, ARMThumbImmediate::makeUInt12(4));
+    }
+
+    void and32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.ARM_and(dest, op1, op2);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.ARM_and(dest, src, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.ARM_and(dest, src, dataTempRegister);
+        }
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        and32(dest, src, dest);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID dest)
+    {
+        and32(imm, dest, dest);
+    }
+
+    void and32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        and32(dataTempRegister, dest);
+    }
+
+    void countLeadingZeros32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.clz(dest, src);
+    }
+
+    void lshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shiftAmount, armImm);
+
+        m_assembler.lsl(dest, src, dataTempRegister);
+    }
+
+    void lshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.lsl(dest, src, imm.m_value & 0x1f);
+    }
+
+    void lshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        lshift32(dest, shiftAmount, dest);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        lshift32(dest, imm, dest);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.smull(dest, dataTempRegister, dest, src);
+    }
+
+    void mul32(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.smull(dest, dataTempRegister, left, right);
+    }
+
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(imm, dataTempRegister);
+        m_assembler.smull(dest, dataTempRegister, src, dataTempRegister);
+    }
+
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.neg(srcDest, srcDest);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orr(dest, dest, src);
+    }
+    
+    void or32(RegisterID src, AbsoluteAddress dest)
+    {
+        move(TrustedImmPtr(dest.m_ptr), addressTempRegister);
+        load32(addressTempRegister, dataTempRegister);
+        or32(src, dataTempRegister);
+        store32(dataTempRegister, addressTempRegister);
+    }
+
+    void or32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid()) {
+            move(TrustedImmPtr(address.m_ptr), addressTempRegister);
+            load32(addressTempRegister, dataTempRegister);
+            m_assembler.orr(dataTempRegister, dataTempRegister, armImm);
+            store32(dataTempRegister, addressTempRegister);
+        } else {
+            move(TrustedImmPtr(address.m_ptr), addressTempRegister);
+            load32(addressTempRegister, dataTempRegister);
+            move(imm, addressTempRegister);
+            m_assembler.orr(dataTempRegister, dataTempRegister, addressTempRegister);
+            move(TrustedImmPtr(address.m_ptr), addressTempRegister);
+            store32(dataTempRegister, addressTempRegister);
+        }
+    }
+
+    void or32(TrustedImm32 imm, Address address)
+    {
+        load32(address, dataTempRegister);
+        or32(imm, dataTempRegister, dataTempRegister);
+        store32(dataTempRegister, address);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID dest)
+    {
+        or32(imm, dest, dest);
+    }
+
+    void or32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.orr(dest, op1, op2);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.orr(dest, src, armImm);
+        else {
+            ASSERT(src != dataTempRegister);
+            move(imm, dataTempRegister);
+            m_assembler.orr(dest, src, dataTempRegister);
+        }
+    }
+
+    void rshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shiftAmount, armImm);
+
+        m_assembler.asr(dest, src, dataTempRegister);
+    }
+
+    void rshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            move(src, dest);
+        else
+            m_assembler.asr(dest, src, imm.m_value & 0x1f);
+    }
+
+    void rshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        rshift32(dest, shiftAmount, dest);
+    }
+    
+    void rshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        rshift32(dest, imm, dest);
+    }
+
+    void urshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        // Clamp the shift to the range 0..31
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(0x1f);
+        ASSERT(armImm.isValid());
+        m_assembler.ARM_and(dataTempRegister, shiftAmount, armImm);
+        
+        m_assembler.lsr(dest, src, dataTempRegister);
+    }
+    
+    void urshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            move(src, dest);
+        else
+            m_assembler.lsr(dest, src, imm.m_value & 0x1f);
+    }
+
+    void urshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        urshift32(dest, shiftAmount, dest);
+    }
+    
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        urshift32(dest, imm, dest);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sub(dest, dest, src);
+    }
+
+    void sub32(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.sub(dest, left, right);
+    }
+
+    void sub32(TrustedImm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.sub(dest, dest, dataTempRegister);
+        }
+    }
+
+    void sub32(TrustedImm32 imm, Address address)
+    {
+        load32(address, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.sub(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        sub32(dataTempRegister, dest);
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.sub(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.eor(dest, op1, op2);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (imm.m_value == -1) {
+            m_assembler.mvn(dest, src);
+            return;
+        }
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.eor(dest, src, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.eor(dest, src, dataTempRegister);
+        }
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        xor32(dest, src, dest);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value == -1)
+            m_assembler.mvn(dest, dest);
+        else
+            xor32(imm, dest, dest);
+    }
+    
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an TrustedImm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+private:
+    void load32(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldr(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldr(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldr(dest, address.base, address.u.offset, true, false);
+        }
+    }
+
+    void load16(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldrh(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldrh(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldrh(dest, address.base, address.u.offset, true, false);
+        }
+    }
+    
+    void load16SignedExtendTo32(ArmAddress address, RegisterID dest)
+    {
+        ASSERT(address.type == ArmAddress::HasIndex);
+        m_assembler.ldrsh(dest, address.base, address.u.index, address.u.scale);
+    }
+
+    void load8(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldrb(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldrb(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldrb(dest, address.base, address.u.offset, true, false);
+        }
+    }
+    
+    void load8SignedExtendTo32(ArmAddress address, RegisterID dest)
+    {
+        ASSERT(address.type == ArmAddress::HasIndex);
+        m_assembler.ldrsb(dest, address.base, address.u.index, address.u.scale);
+    }
+
+protected:
+    void store32(RegisterID src, ArmAddress address)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.str(src, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.str(src, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.str(src, address.base, address.u.offset, true, false);
+        }
+    }
+
+private:
+    void store8(RegisterID src, ArmAddress address)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.strb(src, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.strb(src, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.strb(src, address.base, address.u.offset, true, false);
+        }
+    }
+    
+    void store16(RegisterID src, ArmAddress address)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.strh(src, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.strh(src, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.strh(src, address.base, address.u.offset, true, false);
+        }
+    }
+
+public:
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
+    void load16Unaligned(BaseIndex address, RegisterID dest)
+    {
+        load16(setupArmAddress(address), dest);
+    }
+
+    void load32(const void* address, RegisterID dest)
+    {
+        move(TrustedImmPtr(address), addressTempRegister);
+        m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
+    }
+    
+    void abortWithReason(AbortReason reason)
+    {
+        move(TrustedImm32(reason), dataTempRegister);
+        breakpoint();
+    }
+
+    void abortWithReason(AbortReason reason, intptr_t misc)
+    {
+        move(TrustedImm32(misc), addressTempRegister);
+        abortWithReason(reason);
+    }
+
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result(this);
+        ASSERT(address.offset >= 0 && address.offset <= 255);
+        m_assembler.ldrWide8BitImmediate(dest, address.base, address.offset);
+        return result;
+    }
+
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        load8(setupArmAddress(address), dest);
+    }
+
+    void load8SignedExtendTo32(ImplicitAddress, RegisterID)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    void load8(BaseIndex address, RegisterID dest)
+    {
+        load8(setupArmAddress(address), dest);
+    }
+    
+    void load8SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        load8SignedExtendTo32(setupArmAddress(address), dest);
+    }
+
+    void load8(const void* address, RegisterID dest)
+    {
+        move(TrustedImmPtr(address), dest);
+        load8(dest, dest);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabel32 label = moveWithPatch(TrustedImm32(address.offset), dataTempRegister);
+        load32(ArmAddress(address.base, dataTempRegister), dest);
+        return label;
+    }
+    
+    DataLabelCompact load32WithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        padBeforePatch();
+
+        RegisterID base = address.base;
+        
+        DataLabelCompact label(this);
+        ASSERT(isCompactPtrAlignedAddressOffset(address.offset));
+
+        m_assembler.ldr(dest, base, address.offset, true, false);
+        return label;
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.ldrh(dest, makeBaseIndexBase(address), address.index, address.scale);
+    }
+    
+    void load16SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        load16SignedExtendTo32(setupArmAddress(address), dest);
+    }
+    
+    void load16(ImplicitAddress address, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.offset);
+        if (armImm.isValid())
+            m_assembler.ldrh(dest, address.base, armImm);
+        else {
+            move(TrustedImm32(address.offset), dataTempRegister);
+            m_assembler.ldrh(dest, address.base, dataTempRegister);
+        }
+    }
+    
+    void load16SignedExtendTo32(ImplicitAddress, RegisterID)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        DataLabel32 label = moveWithPatch(TrustedImm32(address.offset), dataTempRegister);
+        store32(src, ArmAddress(address.base, dataTempRegister));
+        return label;
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        store32(src, setupArmAddress(address));
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        store32(src, setupArmAddress(address));
+    }
+
+    void store32(TrustedImm32 imm, ImplicitAddress address)
+    {
+        move(imm, dataTempRegister);
+        store32(dataTempRegister, setupArmAddress(address));
+    }
+
+    void store32(TrustedImm32 imm, BaseIndex address)
+    {
+        move(imm, dataTempRegister);
+        store32(dataTempRegister, setupArmAddress(address));
+    }
+
+    void store32(RegisterID src, const void* address)
+    {
+        move(TrustedImmPtr(address), addressTempRegister);
+        m_assembler.str(src, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    void store32(TrustedImm32 imm, const void* address)
+    {
+        move(imm, dataTempRegister);
+        store32(dataTempRegister, address);
+    }
+
+    void store8(RegisterID src, Address address)
+    {
+        store8(src, setupArmAddress(address));
+    }
+    
+    void store8(RegisterID src, BaseIndex address)
+    {
+        store8(src, setupArmAddress(address));
+    }
+    
+    void store8(RegisterID src, void* address)
+    {
+        move(TrustedImmPtr(address), addressTempRegister);
+        store8(src, ArmAddress(addressTempRegister, 0));
+    }
+    
+    void store8(TrustedImm32 imm, void* address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        move(imm8, dataTempRegister);
+        store8(dataTempRegister, address);
+    }
+    
+    void store8(TrustedImm32 imm, Address address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        move(imm8, dataTempRegister);
+        store8(dataTempRegister, address);
+    }
+    
+    void store16(RegisterID src, BaseIndex address)
+    {
+        store16(src, setupArmAddress(address));
+    }
+
+    // Possibly clobbers src, but not on this architecture.
+    void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.vmov(dest1, dest2, src);
+    }
+    
+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch)
+    {
+        UNUSED_PARAM(scratch);
+        m_assembler.vmov(dest, src1, src2);
+    }
+
+    static bool shouldBlindForSpecificArch(uint32_t value)
+    {
+        ARMThumbImmediate immediate = ARMThumbImmediate::makeEncodedImm(value);
+
+        // Couldn't be encoded as an immediate, so assume it's untrusted.
+        if (!immediate.isValid())
+            return true;
+        
+        // If we can encode the immediate, we have less than 16 attacker
+        // controlled bits.
+        if (immediate.isEncodedImm())
+            return false;
+
+        // Don't let any more than 12 bits of an instruction word
+        // be controlled by an attacker.
+        return !immediate.isUInt12();
+    }
+
+    // Floating-point operations:
+
+    static bool supportsFloatingPoint() { return true; }
+    static bool supportsFloatingPointTruncate() { return true; }
+    static bool supportsFloatingPointSqrt() { return true; }
+    static bool supportsFloatingPointAbs() { return true; }
+    static bool supportsFloatingPointRounding() { return false; }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        RegisterID base = address.base;
+        int32_t offset = address.offset;
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
+            add32(TrustedImm32(offset), base, addressTempRegister);
+            base = addressTempRegister;
+            offset = 0;
+        }
+        
+        m_assembler.vldr(dest, base, offset);
+    }
+
+    void loadFloat(ImplicitAddress address, FPRegisterID dest)
+    {
+        RegisterID base = address.base;
+        int32_t offset = address.offset;
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
+            add32(TrustedImm32(offset), base, addressTempRegister);
+            base = addressTempRegister;
+            offset = 0;
+        }
+        
+        m_assembler.flds(ARMRegisters::asSingle(dest), base, offset);
+    }
+
+    void loadDouble(BaseIndex address, FPRegisterID dest)
+    {
+        move(address.index, addressTempRegister);
+        lshift32(TrustedImm32(address.scale), addressTempRegister);
+        add32(address.base, addressTempRegister);
+        loadDouble(Address(addressTempRegister, address.offset), dest);
+    }
+    
+    void loadFloat(BaseIndex address, FPRegisterID dest)
+    {
+        move(address.index, addressTempRegister);
+        lshift32(TrustedImm32(address.scale), addressTempRegister);
+        add32(address.base, addressTempRegister);
+        loadFloat(Address(addressTempRegister, address.offset), dest);
+    }
+
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.vmov(dest, src);
+    }
+
+    void moveZeroToDouble(FPRegisterID reg)
+    {
+        static double zeroConstant = 0.;
+        loadDouble(TrustedImmPtr(&zeroConstant), reg);
+    }
+
+    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
+    {
+        move(address, addressTempRegister);
+        m_assembler.vldr(dest, addressTempRegister, 0);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        RegisterID base = address.base;
+        int32_t offset = address.offset;
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
+            add32(TrustedImm32(offset), base, addressTempRegister);
+            base = addressTempRegister;
+            offset = 0;
+        }
+        
+        m_assembler.vstr(src, base, offset);
+    }
+
+    void storeFloat(FPRegisterID src, ImplicitAddress address)
+    {
+        RegisterID base = address.base;
+        int32_t offset = address.offset;
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
+            add32(TrustedImm32(offset), base, addressTempRegister);
+            base = addressTempRegister;
+            offset = 0;
+        }
+        
+        m_assembler.fsts(ARMRegisters::asSingle(src), base, offset);
+    }
+
+    void storeDouble(FPRegisterID src, TrustedImmPtr address)
+    {
+        move(address, addressTempRegister);
+        storeDouble(src, addressTempRegister);
+    }
+
+    void storeDouble(FPRegisterID src, BaseIndex address)
+    {
+        move(address.index, addressTempRegister);
+        lshift32(TrustedImm32(address.scale), addressTempRegister);
+        add32(address.base, addressTempRegister);
+        storeDouble(src, Address(addressTempRegister, address.offset));
+    }
+    
+    void storeFloat(FPRegisterID src, BaseIndex address)
+    {
+        move(address.index, addressTempRegister);
+        lshift32(TrustedImm32(address.scale), addressTempRegister);
+        add32(address.base, addressTempRegister);
+        storeFloat(src, Address(addressTempRegister, address.offset));
+    }
+    
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vadd(dest, dest, src);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        addDouble(fpTempRegister, dest);
+    }
+
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vadd(dest, op1, op2);
+    }
+
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        loadDouble(TrustedImmPtr(address.m_ptr), fpTempRegister);
+        m_assembler.vadd(dest, dest, fpTempRegister);
+    }
+
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vdiv(dest, dest, src);
+    }
+
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vdiv(dest, op1, op2);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vsub(dest, dest, src);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        subDouble(fpTempRegister, dest);
+    }
+
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vsub(dest, op1, op2);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vmul(dest, dest, src);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        mulDouble(fpTempRegister, dest);
+    }
+
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vmul(dest, op1, op2);
+    }
+
+    void sqrtDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vsqrt(dest, src);
+    }
+    
+    void absDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vabs(dest, src);
+    }
+
+    void negateDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vneg(dest, src);
+    }
+
+    NO_RETURN_DUE_TO_CRASH void ceilDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    NO_RETURN_DUE_TO_CRASH void floorDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    NO_RETURN_DUE_TO_CRASH void roundTowardZeroDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vmov(fpTempRegister, src, src);
+        m_assembler.vcvt_signedToFloatingPoint(dest, fpTempRegisterAsSingle());
+    }
+
+    void convertInt32ToDouble(Address address, FPRegisterID dest)
+    {
+        // Fixme: load directly into the fpr!
+        load32(address, dataTempRegister);
+        m_assembler.vmov(fpTempRegister, dataTempRegister, dataTempRegister);
+        m_assembler.vcvt_signedToFloatingPoint(dest, fpTempRegisterAsSingle());
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        // Fixme: load directly into the fpr!
+        load32(address.m_ptr, dataTempRegister);
+        m_assembler.vmov(fpTempRegister, dataTempRegister, dataTempRegister);
+        m_assembler.vcvt_signedToFloatingPoint(dest, fpTempRegisterAsSingle());
+    }
+    
+    void convertFloatToDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.vcvtds(dst, ARMRegisters::asSingle(src));
+    }
+    
+    void convertDoubleToFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.vcvtsd(ARMRegisters::asSingle(dst), src);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        m_assembler.vcmp(left, right);
+        m_assembler.vmrs();
+
+        if (cond == DoubleNotEqual) {
+            // ConditionNE jumps if NotEqual *or* unordered - force the unordered cases not to jump.
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump result = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            return result;
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+            Jump notEqual = makeBranch(ARMv7Assembler::ConditionNE);
+            unordered.link(this);
+            // We get here if either unordered or equal.
+            Jump result = jump();
+            notEqual.link(this);
+            return result;
+        }
+        return makeBranch(cond);
+    }
+
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        // Convert into dest.
+        m_assembler.vcvt_floatingPointToSigned(fpTempRegisterAsSingle(), src);
+        m_assembler.vmov(dest, fpTempRegisterAsSingle());
+
+        // Calculate 2x dest.  If the value potentially underflowed, it will have
+        // clamped to 0x80000000, so 2x dest is zero in this case. In the case of
+        // overflow the result will be equal to -2.
+        Jump underflow = branchAdd32(Zero, dest, dest, dataTempRegister);
+        Jump noOverflow = branch32(NotEqual, dataTempRegister, TrustedImm32(-2));
+
+        // For BranchIfTruncateSuccessful, we branch if 'noOverflow' jumps.
+        underflow.link(this);
+        if (branchType == BranchIfTruncateSuccessful)
+            return noOverflow;
+
+        // We'll reach the current point in the code on failure, so plant a
+        // jump here & link the success case.
+        Jump failure = jump();
+        noOverflow.link(this);
+        return failure;
+    }
+
+    // Result is undefined if the value is outside of the integer range.
+    void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.vcvt_floatingPointToSigned(fpTempRegisterAsSingle(), src);
+        m_assembler.vmov(dest, fpTempRegisterAsSingle());
+    }
+
+    void truncateDoubleToUint32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.vcvt_floatingPointToUnsigned(fpTempRegisterAsSingle(), src);
+        m_assembler.vmov(dest, fpTempRegisterAsSingle());
+    }
+    
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID, bool negZeroCheck = true)
+    {
+        m_assembler.vcvt_floatingPointToSigned(fpTempRegisterAsSingle(), src);
+        m_assembler.vmov(dest, fpTempRegisterAsSingle());
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        m_assembler.vcvt_signedToFloatingPoint(fpTempRegister, fpTempRegisterAsSingle());
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, fpTempRegister));
+
+        // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
+        if (negZeroCheck)
+            failureCases.append(branchTest32(Zero, dest));
+    }
+
+    Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID)
+    {
+        m_assembler.vcmpz(reg);
+        m_assembler.vmrs();
+        Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+        Jump result = makeBranch(ARMv7Assembler::ConditionNE);
+        unordered.link(this);
+        return result;
+    }
+
+    Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID)
+    {
+        m_assembler.vcmpz(reg);
+        m_assembler.vmrs();
+        Jump unordered = makeBranch(ARMv7Assembler::ConditionVS);
+        Jump notEqual = makeBranch(ARMv7Assembler::ConditionNE);
+        unordered.link(this);
+        // We get here if either unordered or equal.
+        Jump result = jump();
+        notEqual.link(this);
+        return result;
+    }
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+    
+    void pop(RegisterID dest)
+    {
+        m_assembler.pop(dest);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.push(src);
+    }
+
+    void push(Address address)
+    {
+        load32(address, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    void push(TrustedImm32 imm)
+    {
+        move(imm, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    void popPair(RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.pop(1 << dest1 | 1 << dest2);
+    }
+    
+    void pushPair(RegisterID src1, RegisterID src2)
+    {
+        m_assembler.push(1 << src1 | 1 << src2);
+    }
+    
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(TrustedImm32 imm, RegisterID dest)
+    {
+        uint32_t value = imm.m_value;
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(value);
+
+        if (armImm.isValid())
+            m_assembler.mov(dest, armImm);
+        else if ((armImm = ARMThumbImmediate::makeEncodedImm(~value)).isValid())
+            m_assembler.mvn(dest, armImm);
+        else {
+            m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(value));
+            if (value & 0xffff0000)
+                m_assembler.movt(dest, ARMThumbImmediate::makeUInt16(value >> 16));
+        }
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.mov(dest, src);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        move(TrustedImm32(imm), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        move(reg1, dataTempRegister);
+        move(reg2, reg1);
+        move(dataTempRegister, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+
+    // Invert a relational condition, e.g. == becomes !=, < becomes >=, etc.
+    static RelationalCondition invert(RelationalCondition cond)
+    {
+        return static_cast<RelationalCondition>(cond ^ 1);
+    }
+
+    void nop()
+    {
+        m_assembler.nop();
+    }
+    
+    void memoryFence()
+    {
+        m_assembler.dmbSY();
+    }
+    
+    void storeFence()
+    {
+        m_assembler.dmbISHST();
+    }
+    
+    static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)
+    {
+        ARMv7Assembler::replaceWithJump(instructionStart.dataLocation(), destination.dataLocation());
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return ARMv7Assembler::maxJumpReplacementSize();
+    }
+
+    static ptrdiff_t patchableJumpSize()
+    {
+        return ARMv7Assembler::patchableJumpSize();
+    }
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+private:
+
+    // Should we be using TEQ for equal/not-equal?
+    void compare32AndSetFlags(RegisterID left, TrustedImm32 right)
+    {
+        int32_t imm = right.m_value;
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm);
+        if (armImm.isValid())
+            m_assembler.cmp(left, armImm);
+        else if ((armImm = ARMThumbImmediate::makeEncodedImm(-imm)).isValid())
+            m_assembler.cmn(left, armImm);
+        else {
+            move(TrustedImm32(imm), dataTempRegister);
+            m_assembler.cmp(left, dataTempRegister);
+        }
+    }
+
+public:
+    void test32(RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        int32_t imm = mask.m_value;
+
+        if (imm == -1)
+            m_assembler.tst(reg, reg);
+        else {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm);
+            if (armImm.isValid()) {
+                if (reg == ARMRegisters::sp) {
+                    move(reg, addressTempRegister);
+                    m_assembler.tst(addressTempRegister, armImm);
+                } else
+                    m_assembler.tst(reg, armImm);
+            } else {
+                move(mask, dataTempRegister);
+                if (reg == ARMRegisters::sp) {
+                    move(reg, addressTempRegister);
+                    m_assembler.tst(addressTempRegister, dataTempRegister);
+                } else
+                    m_assembler.tst(reg, dataTempRegister);
+            }
+        }
+    }
+    
+    Jump branch(ResultCondition cond)
+    {
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmp(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, TrustedImm32 right)
+    {
+        compare32AndSetFlags(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, Address right)
+    {
+        load32(right, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, RegisterID right)
+    {
+        load32(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch32WithUnalignedHalfWords(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32WithUnalignedHalfWords(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left.m_ptr, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, BaseIndex left, RegisterID right)
+    {
+        load32(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch8(RelationalCondition cond, RegisterID left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        compare32AndSetFlags(left, right8);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch8(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        // use addressTempRegister incase the branch8 we call uses dataTempRegister. :-/
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, addressTempRegister);
+        return branch8(cond, addressTempRegister, right8);
+    }
+
+    Jump branch8(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right8);
+    }
+    
+    Jump branch8(RelationalCondition cond, AbsoluteAddress address, TrustedImm32 right)
+    {
+        // Use addressTempRegister instead of dataTempRegister, since branch32 uses dataTempRegister.
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        move(TrustedImmPtr(address.m_ptr), addressTempRegister);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, Address(addressTempRegister), addressTempRegister);
+        return branch32(cond, addressTempRegister, right8);
+    }
+    
+    Jump branchTest32(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT(cond == Zero || cond == NonZero || cond == Signed || cond == PositiveOrZero);
+        m_assembler.tst(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT(cond == Zero || cond == NonZero || cond == Signed || cond == PositiveOrZero);
+        test32(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest32(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
+        load32(address, addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask);
+    }
+
+    Jump branchTest32(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
+        load32(address, addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask);
+    }
+
+    Jump branchTest8(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        // use addressTempRegister incase the branchTest8 we call uses dataTempRegister. :-/
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        // use addressTempRegister incase the branchTest8 we call uses dataTempRegister. :-/
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        // use addressTempRegister incase the branchTest8 we call uses dataTempRegister. :-/
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        move(TrustedImmPtr(address.m_ptr), addressTempRegister);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, Address(addressTempRegister), addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask8);
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.bx(target);
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(Address address)
+    {
+        load32(address, dataTempRegister);
+        m_assembler.bx(dataTempRegister);
+    }
+    
+    void jump(AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), dataTempRegister);
+        load32(Address(dataTempRegister), dataTempRegister);
+        m_assembler.bx(dataTempRegister);
+    }
+
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+    
+    Jump branchAdd32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.add_S(dest, op1, op2);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID op1, TrustedImm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add_S(dest, op1, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.add_S(dest, op1, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchAdd32(cond, dest, src, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        return branchAdd32(cond, dest, dataTempRegister, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchAdd32(cond, dest, imm, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress dest)
+    {
+        // Move the high bits of the address into addressTempRegister,
+        // and load the value into dataTempRegister.
+        move(TrustedImmPtr(dest.m_ptr), addressTempRegister);
+        m_assembler.ldr(dataTempRegister, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
+
+        // Do the add.
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add_S(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // If the operand does not fit into an immediate then load it temporarily
+            // into addressTempRegister; since we're overwriting addressTempRegister
+            // we'll need to reload it with the high bits of the address afterwards.
+            move(imm, addressTempRegister);
+            m_assembler.add_S(dataTempRegister, dataTempRegister, addressTempRegister);
+            move(TrustedImmPtr(dest.m_ptr), addressTempRegister);
+        }
+
+        // Store the result.
+        m_assembler.str(dataTempRegister, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
+
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        m_assembler.smull(dest, dataTempRegister, src1, src2);
+
+        if (cond == Overflow) {
+            m_assembler.asr(addressTempRegister, dest, 31);
+            return branch32(NotEqual, addressTempRegister, dataTempRegister);
+        }
+
+        return branchTest32(cond, dest);
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchMul32(cond, src, dest, dest);
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, dataTempRegister);
+        return branchMul32(cond, dataTempRegister, src, dest);
+    }
+
+    Jump branchNeg32(ResultCondition cond, RegisterID srcDest)
+    {
+        ARMThumbImmediate zero = ARMThumbImmediate::makeUInt12(0);
+        m_assembler.sub_S(srcDest, zero, srcDest);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        m_assembler.orr_S(dest, dest, src);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.sub_S(dest, op1, op2);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID op1, TrustedImm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub_S(dest, op1, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.sub_S(dest, op1, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+    
+    Jump branchSub32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchSub32(cond, dest, src, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        return branchSub32(cond, dest, imm, dest);
+    }
+    
+    void relativeTableJump(RegisterID index, int scale)
+    {
+        ASSERT(scale >= 0 && scale <= 31);
+
+        // dataTempRegister will point after the jump if index register contains zero
+        move(ARMRegisters::pc, dataTempRegister);
+        m_assembler.add(dataTempRegister, dataTempRegister, ARMThumbImmediate::makeEncodedImm(9));
+
+        ShiftTypeAndAmount shift(SRType_LSL, scale);
+        m_assembler.add(dataTempRegister, dataTempRegister, index, shift);
+        jump(dataTempRegister);
+    }
+
+    // Miscellaneous operations:
+
+    void breakpoint(uint8_t imm = 0)
+    {
+        m_assembler.bkpt(imm);
+    }
+
+    ALWAYS_INLINE Call nearCall()
+    {
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::LinkableNear);
+    }
+
+    ALWAYS_INLINE Call nearTailCall()
+    {
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
+        return Call(m_assembler.bx(dataTempRegister), Call::LinkableNearTail);
+    }
+
+    ALWAYS_INLINE Call call()
+    {
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::Linkable);
+    }
+
+    ALWAYS_INLINE Call call(RegisterID target)
+    {
+        return Call(m_assembler.blx(target), Call::None);
+    }
+
+    ALWAYS_INLINE Call call(Address address)
+    {
+        load32(address, dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::None);
+    }
+
+    ALWAYS_INLINE void ret()
+    {
+        m_assembler.bx(linkRegister);
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmp(left, right);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    void compare32(RelationalCondition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        load32(left, dataTempRegister);
+        compare32(cond, dataTempRegister, right, dest);
+    }
+
+    void compare8(RelationalCondition cond, Address left, TrustedImm32 right, RegisterID dest)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, addressTempRegister);
+        compare32(cond, addressTempRegister, right8, dest);
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        compare32AndSetFlags(left, right);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    // FIXME:
+    // The mask should be optional... paerhaps the argument order should be
+    // dest-src, operations always have a dest? ... possibly not true, considering
+    // asm ops like test, or pseudo ops like pop().
+    void test32(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        load32(address, dataTempRegister);
+        test32(dataTempRegister, mask);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    void test8(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, dataTempRegister);
+        test32(dataTempRegister, mask8);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    ALWAYS_INLINE DataLabel32 moveWithPatch(TrustedImm32 imm, RegisterID dst)
+    {
+        padBeforePatch();
+        moveFixedWidthEncoding(imm, dst);
+        return DataLabel32(this);
+    }
+
+    ALWAYS_INLINE DataLabelPtr moveWithPatch(TrustedImmPtr imm, RegisterID dst)
+    {
+        padBeforePatch();
+        moveFixedWidthEncoding(TrustedImm32(imm), dst);
+        return DataLabelPtr(this);
+    }
+
+    ALWAYS_INLINE Jump branchPtrWithPatch(RelationalCondition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    ALWAYS_INLINE Jump branchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        load32(left, addressTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        return branch32(cond, addressTempRegister, dataTempRegister);
+    }
+    
+    ALWAYS_INLINE Jump branch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        load32(left, addressTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        return branch32(cond, addressTempRegister, dataTempRegister);
+    }
+    
+    PatchableJump patchableBranchPtr(RelationalCondition cond, Address left, TrustedImmPtr right = TrustedImmPtr(0))
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch32(cond, left, TrustedImm32(right));
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+    
+    PatchableJump patchableBranchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branchTest32(cond, reg, mask);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranch32(RelationalCondition cond, RegisterID reg, TrustedImm32 imm)
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch32(cond, reg, imm);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranch32(RelationalCondition cond, Address left, TrustedImm32 imm)
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch32(cond, left, imm);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branchPtrWithPatch(cond, left, dataLabel, initialRightValue);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableBranch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        m_makeJumpPatchable = true;
+        Jump result = branch32WithPatch(cond, left, dataLabel, initialRightValue);
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    PatchableJump patchableJump()
+    {
+        padBeforePatch();
+        m_makeJumpPatchable = true;
+        Jump result = jump();
+        m_makeJumpPatchable = false;
+        return PatchableJump(result);
+    }
+
+    ALWAYS_INLINE DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        DataLabelPtr label = moveWithPatch(initialValue, dataTempRegister);
+        store32(dataTempRegister, address);
+        return label;
+    }
+    ALWAYS_INLINE DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(TrustedImmPtr(0), address); }
+
+
+    ALWAYS_INLINE Call tailRecursiveCall()
+    {
+        // Like a normal call, but don't link.
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
+        return Call(m_assembler.bx(dataTempRegister), Call::Linkable);
+    }
+
+    ALWAYS_INLINE Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+    
+    static FunctionPtr readCallTarget(CodeLocationCall call)
+    {
+        return FunctionPtr(reinterpret_cast<void(*)()>(ARMv7Assembler::readCallTarget(call.dataLocation())));
+    }
+    
+    static bool canJumpReplacePatchableBranchPtrWithPatch() { return false; }
+    static bool canJumpReplacePatchableBranch32WithPatch() { return false; }
+    
+    static CodeLocationLabel startOfBranchPtrWithPatchOnRegister(CodeLocationDataLabelPtr label)
+    {
+        const unsigned twoWordOpSize = 4;
+        return label.labelAtOffset(-twoWordOpSize * 2);
+    }
+    
+    static void revertJumpReplacementToBranchPtrWithPatch(CodeLocationLabel instructionStart, RegisterID rd, void* initialValue)
+    {
+#if OS(LINUX)
+        ARMv7Assembler::revertJumpTo_movT3movtcmpT2(instructionStart.dataLocation(), rd, dataTempRegister, reinterpret_cast<uintptr_t>(initialValue));
+#else
+        UNUSED_PARAM(rd);
+        ARMv7Assembler::revertJumpTo_movT3(instructionStart.dataLocation(), dataTempRegister, ARMThumbImmediate::makeUInt16(reinterpret_cast<uintptr_t>(initialValue) & 0xffff));
+#endif
+    }
+    
+    static CodeLocationLabel startOfPatchableBranchPtrWithPatchOnAddress(CodeLocationDataLabelPtr)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+    
+    static CodeLocationLabel startOfPatchableBranch32WithPatchOnAddress(CodeLocationDataLabel32)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+    
+    static void revertJumpReplacementToPatchableBranchPtrWithPatch(CodeLocationLabel, Address, void*)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void revertJumpReplacementToPatchableBranch32WithPatch(CodeLocationLabel, Address, int32_t)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        ARMv7Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        ARMv7Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+#if ENABLE(MASM_PROBE)
+    void probe(ProbeFunction, void* arg1, void* arg2);
+#endif // ENABLE(MASM_PROBE)
+
+protected:
+    ALWAYS_INLINE Jump jump()
+    {
+        m_assembler.label(); // Force nop-padding if we're in the middle of a watchpoint.
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
+        return Jump(m_assembler.bx(dataTempRegister), m_makeJumpPatchable ? ARMv7Assembler::JumpNoConditionFixedSize : ARMv7Assembler::JumpNoCondition);
+    }
+
+    ALWAYS_INLINE Jump makeBranch(ARMv7Assembler::Condition cond)
+    {
+        m_assembler.label(); // Force nop-padding if we're in the middle of a watchpoint.
+        m_assembler.it(cond, true, true);
+        moveFixedWidthEncoding(TrustedImm32(0), dataTempRegister);
+        return Jump(m_assembler.bx(dataTempRegister), m_makeJumpPatchable ? ARMv7Assembler::JumpConditionFixedSize : ARMv7Assembler::JumpCondition, cond);
+    }
+    ALWAYS_INLINE Jump makeBranch(RelationalCondition cond) { return makeBranch(armV7Condition(cond)); }
+    ALWAYS_INLINE Jump makeBranch(ResultCondition cond) { return makeBranch(armV7Condition(cond)); }
+    ALWAYS_INLINE Jump makeBranch(DoubleCondition cond) { return makeBranch(armV7Condition(cond)); }
+
+    ArmAddress setupArmAddress(BaseIndex address)
+    {
+        if (address.offset) {
+            ARMThumbImmediate imm = ARMThumbImmediate::makeUInt12OrEncodedImm(address.offset);
+            if (imm.isValid())
+                m_assembler.add(addressTempRegister, address.base, imm);
+            else {
+                move(TrustedImm32(address.offset), addressTempRegister);
+                m_assembler.add(addressTempRegister, addressTempRegister, address.base);
+            }
+
+            return ArmAddress(addressTempRegister, address.index, address.scale);
+        } else
+            return ArmAddress(address.base, address.index, address.scale);
+    }
+
+    ArmAddress setupArmAddress(Address address)
+    {
+        if ((address.offset >= -0xff) && (address.offset <= 0xfff))
+            return ArmAddress(address.base, address.offset);
+
+        move(TrustedImm32(address.offset), addressTempRegister);
+        return ArmAddress(address.base, addressTempRegister);
+    }
+
+    ArmAddress setupArmAddress(ImplicitAddress address)
+    {
+        if ((address.offset >= -0xff) && (address.offset <= 0xfff))
+            return ArmAddress(address.base, address.offset);
+
+        move(TrustedImm32(address.offset), addressTempRegister);
+        return ArmAddress(address.base, addressTempRegister);
+    }
+
+    RegisterID makeBaseIndexBase(BaseIndex address)
+    {
+        if (!address.offset)
+            return address.base;
+
+        ARMThumbImmediate imm = ARMThumbImmediate::makeUInt12OrEncodedImm(address.offset);
+        if (imm.isValid())
+            m_assembler.add(addressTempRegister, address.base, imm);
+        else {
+            move(TrustedImm32(address.offset), addressTempRegister);
+            m_assembler.add(addressTempRegister, addressTempRegister, address.base);
+        }
+
+        return addressTempRegister;
+    }
+
+    void moveFixedWidthEncoding(TrustedImm32 imm, RegisterID dst)
+    {
+        uint32_t value = imm.m_value;
+        m_assembler.movT3(dst, ARMThumbImmediate::makeUInt16(value & 0xffff));
+        m_assembler.movt(dst, ARMThumbImmediate::makeUInt16(value >> 16));
+    }
+
+    ARMv7Assembler::Condition armV7Condition(RelationalCondition cond)
+    {
+        return static_cast<ARMv7Assembler::Condition>(cond);
+    }
+
+    ARMv7Assembler::Condition armV7Condition(ResultCondition cond)
+    {
+        return static_cast<ARMv7Assembler::Condition>(cond);
+    }
+
+    ARMv7Assembler::Condition armV7Condition(DoubleCondition cond)
+    {
+        return static_cast<ARMv7Assembler::Condition>(cond);
+    }
+    
+private:
+    friend class LinkBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        if (call.isFlagSet(Call::Tail))
+            ARMv7Assembler::linkJump(code, call.m_label, function.value());
+        else
+            ARMv7Assembler::linkCall(code, call.m_label, function.value());
+    }
+
+#if ENABLE(MASM_PROBE)
+    inline TrustedImm32 trustedImm32FromPtr(void* ptr)
+    {
+        return TrustedImm32(TrustedImmPtr(ptr));
+    }
+
+    inline TrustedImm32 trustedImm32FromPtr(ProbeFunction function)
+    {
+        return TrustedImm32(TrustedImmPtr(reinterpret_cast<void*>(function)));
+    }
+
+    inline TrustedImm32 trustedImm32FromPtr(void (*function)())
+    {
+        return TrustedImm32(TrustedImmPtr(reinterpret_cast<void*>(function)));
+    }
+#endif
+
+    bool m_makeJumpPatchable;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/MacroAssemblerCodeRef.cpp b/assembler/MacroAssemblerCodeRef.cpp
new file mode 100644
index 0000000..06460c9
--- /dev/null
+++ b/assembler/MacroAssemblerCodeRef.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MacroAssemblerCodeRef.h"
+
+#include "JSCInlines.h"
+#include "LLIntData.h"
+
+namespace JSC {
+
+MacroAssemblerCodePtr MacroAssemblerCodePtr::createLLIntCodePtr(OpcodeID codeId)
+{
+    return createFromExecutableAddress(LLInt::getCodePtr(codeId));
+}
+
+void MacroAssemblerCodePtr::dumpWithName(const char* name, PrintStream& out) const
+{
+    if (!m_value) {
+        out.print(name, "(null)");
+        return;
+    }
+    if (executableAddress() == dataLocation()) {
+        out.print(name, "(", RawPointer(executableAddress()), ")");
+        return;
+    }
+    out.print(name, "(executable = ", RawPointer(executableAddress()), ", dataLocation = ", RawPointer(dataLocation()), ")");
+}
+
+void MacroAssemblerCodePtr::dump(PrintStream& out) const
+{
+    dumpWithName("CodePtr", out);
+}
+
+MacroAssemblerCodeRef MacroAssemblerCodeRef::createLLIntCodeRef(OpcodeID codeId)
+{
+    return createSelfManagedCodeRef(MacroAssemblerCodePtr::createFromExecutableAddress(LLInt::getCodePtr(codeId)));
+}
+
+bool MacroAssemblerCodeRef::tryToDisassemble(PrintStream& out, const char* prefix) const
+{
+    return JSC::tryToDisassemble(m_codePtr, size(), prefix, out);
+}
+
+bool MacroAssemblerCodeRef::tryToDisassemble(const char* prefix) const
+{
+    return tryToDisassemble(WTF::dataFile(), prefix);
+}
+
+CString MacroAssemblerCodeRef::disassembly() const
+{
+    StringPrintStream out;
+    if (!tryToDisassemble(out, ""))
+        return CString();
+    return out.toCString();
+}
+
+void MacroAssemblerCodeRef::dump(PrintStream& out) const
+{
+    m_codePtr.dumpWithName("CodeRef", out);
+}
+
+} // namespace JSC
+
diff --git a/assembler/MacroAssemblerCodeRef.h b/assembler/MacroAssemblerCodeRef.h
new file mode 100644
index 0000000..a71a486
--- /dev/null
+++ b/assembler/MacroAssemblerCodeRef.h
@@ -0,0 +1,421 @@
+/*
+ * Copyright (C) 2009, 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ExecutableAllocator.h"
+#include <wtf/DataLog.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/PrintStream.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/CString.h>
+
+// ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
+// instruction address on the platform (for example, check any alignment requirements).
+#if CPU(ARM_THUMB2) && ENABLE(JIT)
+// ARM instructions must be 16-bit aligned. Thumb2 code pointers to be loaded into
+// into the processor are decorated with the bottom bit set, while traditional ARM has
+// the lower bit clear. Since we don't know what kind of pointer, we check for both
+// decorated and undecorated null.
+#define ASSERT_VALID_CODE_POINTER(ptr) \
+    ASSERT(reinterpret_cast<intptr_t>(ptr) & ~1)
+#define ASSERT_VALID_CODE_OFFSET(offset) \
+    ASSERT(!(offset & 1)) // Must be multiple of 2.
+#else
+#define ASSERT_VALID_CODE_POINTER(ptr) \
+    ASSERT(ptr)
+#define ASSERT_VALID_CODE_OFFSET(offset) // Anything goes!
+#endif
+
+namespace JSC {
+
+enum OpcodeID : unsigned;
+
+// FunctionPtr:
+//
+// FunctionPtr should be used to wrap pointers to C/C++ functions in JSC
+// (particularly, the stub functions).
+class FunctionPtr {
+public:
+    FunctionPtr()
+        : m_value(0)
+    {
+    }
+
+    template<typename returnType>
+    FunctionPtr(returnType(*value)())
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1>
+    FunctionPtr(returnType(*value)(argType1))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2>
+    FunctionPtr(returnType(*value)(argType1, argType2))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3>
+    FunctionPtr(returnType(*value)(argType1, argType2, argType3))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3, typename argType4>
+    FunctionPtr(returnType(*value)(argType1, argType2, argType3, argType4))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3, typename argType4, typename argType5>
+    FunctionPtr(returnType(*value)(argType1, argType2, argType3, argType4, argType5))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3, typename argType4, typename argType5, typename argType6>
+    FunctionPtr(returnType(*value)(argType1, argType2, argType3, argType4, argType5, argType6))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+// MSVC doesn't seem to treat functions with different calling conventions as
+// different types; these methods already defined for fastcall, below.
+#if CALLING_CONVENTION_IS_STDCALL && !OS(WINDOWS)
+
+    template<typename returnType>
+    FunctionPtr(returnType (CDECL *value)())
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1>
+    FunctionPtr(returnType (CDECL *value)(argType1))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2>
+    FunctionPtr(returnType (CDECL *value)(argType1, argType2))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3>
+    FunctionPtr(returnType (CDECL *value)(argType1, argType2, argType3))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3, typename argType4>
+    FunctionPtr(returnType (CDECL *value)(argType1, argType2, argType3, argType4))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+#endif
+
+#if COMPILER_SUPPORTS(FASTCALL_CALLING_CONVENTION)
+
+    template<typename returnType>
+    FunctionPtr(returnType (FASTCALL *value)())
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1>
+    FunctionPtr(returnType (FASTCALL *value)(argType1))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2>
+    FunctionPtr(returnType (FASTCALL *value)(argType1, argType2))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3>
+    FunctionPtr(returnType (FASTCALL *value)(argType1, argType2, argType3))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    template<typename returnType, typename argType1, typename argType2, typename argType3, typename argType4>
+    FunctionPtr(returnType (FASTCALL *value)(argType1, argType2, argType3, argType4))
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+#endif
+
+    template<typename FunctionType>
+    explicit FunctionPtr(FunctionType* value)
+        // Using a C-ctyle cast here to avoid compiler error on RVTC:
+        // Error:  #694: reinterpret_cast cannot cast away const or other type qualifiers
+        // (I guess on RVTC function pointers have a different constness to GCC/MSVC?)
+        : m_value((void*)value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* value() const { return m_value; }
+    void* executableAddress() const { return m_value; }
+
+
+private:
+    void* m_value;
+};
+
+// ReturnAddressPtr:
+//
+// ReturnAddressPtr should be used to wrap return addresses generated by processor
+// 'call' instructions exectued in JIT code.  We use return addresses to look up
+// exception and optimization information, and to repatch the call instruction
+// that is the source of the return address.
+class ReturnAddressPtr {
+public:
+    ReturnAddressPtr()
+        : m_value(0)
+    {
+    }
+
+    explicit ReturnAddressPtr(void* value)
+        : m_value(value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    explicit ReturnAddressPtr(FunctionPtr function)
+        : m_value(function.value())
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* value() const { return m_value; }
+    
+    void dump(PrintStream& out) const
+    {
+        out.print(RawPointer(m_value));
+    }
+
+private:
+    void* m_value;
+};
+
+// MacroAssemblerCodePtr:
+//
+// MacroAssemblerCodePtr should be used to wrap pointers to JIT generated code.
+class MacroAssemblerCodePtr {
+public:
+    MacroAssemblerCodePtr()
+        : m_value(0)
+    {
+    }
+
+    explicit MacroAssemblerCodePtr(void* value)
+#if CPU(ARM_THUMB2)
+        // Decorate the pointer as a thumb code pointer.
+        : m_value(reinterpret_cast<char*>(value) + 1)
+#else
+        : m_value(value)
+#endif
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+    
+    static MacroAssemblerCodePtr createFromExecutableAddress(void* value)
+    {
+        ASSERT_VALID_CODE_POINTER(value);
+        MacroAssemblerCodePtr result;
+        result.m_value = value;
+        return result;
+    }
+
+    static MacroAssemblerCodePtr createLLIntCodePtr(OpcodeID codeId);
+
+    explicit MacroAssemblerCodePtr(ReturnAddressPtr ra)
+        : m_value(ra.value())
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* executableAddress() const { return m_value; }
+#if CPU(ARM_THUMB2)
+    // To use this pointer as a data address remove the decoration.
+    void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return reinterpret_cast<char*>(m_value) - 1; }
+#else
+    void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return m_value; }
+#endif
+
+    explicit operator bool() const { return m_value; }
+    
+    bool operator==(const MacroAssemblerCodePtr& other) const
+    {
+        return m_value == other.m_value;
+    }
+
+    void dumpWithName(const char* name, PrintStream& out) const;
+    
+    void dump(PrintStream& out) const;
+    
+    enum EmptyValueTag { EmptyValue };
+    enum DeletedValueTag { DeletedValue };
+    
+    MacroAssemblerCodePtr(EmptyValueTag)
+        : m_value(emptyValue())
+    {
+    }
+    
+    MacroAssemblerCodePtr(DeletedValueTag)
+        : m_value(deletedValue())
+    {
+    }
+    
+    bool isEmptyValue() const { return m_value == emptyValue(); }
+    bool isDeletedValue() const { return m_value == deletedValue(); }
+    
+    unsigned hash() const { return PtrHash<void*>::hash(m_value); }
+
+private:
+    static void* emptyValue() { return bitwise_cast<void*>(static_cast<intptr_t>(1)); }
+    static void* deletedValue() { return bitwise_cast<void*>(static_cast<intptr_t>(2)); }
+    
+    void* m_value;
+};
+
+struct MacroAssemblerCodePtrHash {
+    static unsigned hash(const MacroAssemblerCodePtr& ptr) { return ptr.hash(); }
+    static bool equal(const MacroAssemblerCodePtr& a, const MacroAssemblerCodePtr& b)
+    {
+        return a == b;
+    }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+// MacroAssemblerCodeRef:
+//
+// A reference to a section of JIT generated code.  A CodeRef consists of a
+// pointer to the code, and a ref pointer to the pool from within which it
+// was allocated.
+class MacroAssemblerCodeRef {
+private:
+    // This is private because it's dangerous enough that we want uses of it
+    // to be easy to find - hence the static create method below.
+    explicit MacroAssemblerCodeRef(MacroAssemblerCodePtr codePtr)
+        : m_codePtr(codePtr)
+    {
+        ASSERT(m_codePtr);
+    }
+
+public:
+    MacroAssemblerCodeRef()
+    {
+    }
+
+    MacroAssemblerCodeRef(PassRefPtr<ExecutableMemoryHandle> executableMemory)
+        : m_codePtr(executableMemory->start())
+        , m_executableMemory(executableMemory)
+    {
+        ASSERT(m_executableMemory->isManaged());
+        ASSERT(m_executableMemory->start());
+        ASSERT(m_codePtr);
+    }
+    
+    // Use this only when you know that the codePtr refers to code that is
+    // already being kept alive through some other means. Typically this means
+    // that codePtr is immortal.
+    static MacroAssemblerCodeRef createSelfManagedCodeRef(MacroAssemblerCodePtr codePtr)
+    {
+        return MacroAssemblerCodeRef(codePtr);
+    }
+    
+    // Helper for creating self-managed code refs from LLInt.
+    static MacroAssemblerCodeRef createLLIntCodeRef(OpcodeID codeId);
+
+    ExecutableMemoryHandle* executableMemory() const
+    {
+        return m_executableMemory.get();
+    }
+    
+    MacroAssemblerCodePtr code() const
+    {
+        return m_codePtr;
+    }
+    
+    size_t size() const
+    {
+        if (!m_executableMemory)
+            return 0;
+        return m_executableMemory->sizeInBytes();
+    }
+
+    bool tryToDisassemble(PrintStream& out, const char* prefix = "") const;
+    
+    bool tryToDisassemble(const char* prefix = "") const;
+    
+    JS_EXPORT_PRIVATE CString disassembly() const;
+    
+    explicit operator bool() const { return !!m_codePtr; }
+    
+    void dump(PrintStream& out) const;
+
+private:
+    MacroAssemblerCodePtr m_codePtr;
+    RefPtr<ExecutableMemoryHandle> m_executableMemory;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::MacroAssemblerCodePtr> {
+    typedef JSC::MacroAssemblerCodePtrHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::MacroAssemblerCodePtr> : public CustomHashTraits<JSC::MacroAssemblerCodePtr> { };
+
+} // namespace WTF
diff --git a/assembler/MacroAssemblerHelpers.h b/assembler/MacroAssemblerHelpers.h
new file mode 100644
index 0000000..047e94c
--- /dev/null
+++ b/assembler/MacroAssemblerHelpers.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+namespace MacroAssemblerHelpers {
+
+// True if this:
+//     branch8(cond, value, value)
+// Is the same as this:
+//     branch32(cond, signExt8(value), signExt8(value))
+template<typename MacroAssemblerType>
+inline bool isSigned(typename MacroAssemblerType::RelationalCondition cond)
+{
+    switch (cond) {
+    case MacroAssemblerType::Equal:
+    case MacroAssemblerType::NotEqual:
+    case MacroAssemblerType::GreaterThan:
+    case MacroAssemblerType::GreaterThanOrEqual:
+    case MacroAssemblerType::LessThan:
+    case MacroAssemblerType::LessThanOrEqual:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// True if this:
+//     branch8(cond, value, value)
+// Is the same as this:
+//     branch32(cond, zeroExt8(value), zeroExt8(value))
+template<typename MacroAssemblerType>
+inline bool isUnsigned(typename MacroAssemblerType::RelationalCondition cond)
+{
+    switch (cond) {
+    case MacroAssemblerType::Equal:
+    case MacroAssemblerType::NotEqual:
+    case MacroAssemblerType::Above:
+    case MacroAssemblerType::AboveOrEqual:
+    case MacroAssemblerType::Below:
+    case MacroAssemblerType::BelowOrEqual:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// True if this:
+//     test8(cond, value, value)
+// Is the same as this:
+//     test32(cond, signExt8(value), signExt8(value))
+template<typename MacroAssemblerType>
+inline bool isSigned(typename MacroAssemblerType::ResultCondition cond)
+{
+    switch (cond) {
+    case MacroAssemblerType::Signed:
+    case MacroAssemblerType::PositiveOrZero:
+    case MacroAssemblerType::Zero:
+    case MacroAssemblerType::NonZero:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// True if this:
+//     test8(cond, value, value)
+// Is the same as this:
+//     test32(cond, zeroExt8(value), zeroExt8(value))
+template<typename MacroAssemblerType>
+inline bool isUnsigned(typename MacroAssemblerType::ResultCondition cond)
+{
+    switch (cond) {
+    case MacroAssemblerType::Zero:
+    case MacroAssemblerType::NonZero:
+        return true;
+    default:
+        return false;
+    }
+}
+
+template<typename MacroAssemblerType>
+inline typename MacroAssemblerType::TrustedImm32 mask8OnCondition(MacroAssemblerType&, typename MacroAssemblerType::RelationalCondition cond, typename MacroAssemblerType::TrustedImm32 value)
+{
+    if (isUnsigned<MacroAssemblerType>(cond))
+        return typename MacroAssemblerType::TrustedImm32(static_cast<uint8_t>(value.m_value));
+    return typename MacroAssemblerType::TrustedImm32(static_cast<int8_t>(value.m_value));
+}
+
+template<typename MacroAssemblerType>
+inline typename MacroAssemblerType::TrustedImm32 mask8OnCondition(MacroAssemblerType&, typename MacroAssemblerType::ResultCondition cond, typename MacroAssemblerType::TrustedImm32 value)
+{
+    if (isUnsigned<MacroAssemblerType>(cond))
+        return typename MacroAssemblerType::TrustedImm32(static_cast<uint8_t>(value.m_value));
+    ASSERT_WITH_MESSAGE(cond != MacroAssemblerType::Overflow, "Overflow is not used for 8bit test operations.");
+    ASSERT(isSigned<MacroAssemblerType>(cond));
+    return typename MacroAssemblerType::TrustedImm32(static_cast<int8_t>(value.m_value));
+}
+
+template<typename MacroAssemblerType, typename Condition, typename ...Args>
+void load8OnCondition(MacroAssemblerType& jit, Condition cond, Args... args)
+{
+    if (isUnsigned<MacroAssemblerType>(cond))
+        return jit.load8(std::forward<Args>(args)...);
+    return jit.load8SignedExtendTo32(std::forward<Args>(args)...);
+}
+
+} } // namespace JSC
diff --git a/assembler/MacroAssemblerMIPS.h b/assembler/MacroAssemblerMIPS.h
new file mode 100644
index 0000000..a688e98
--- /dev/null
+++ b/assembler/MacroAssemblerMIPS.h
@@ -0,0 +1,3021 @@
+/*
+ * Copyright (C) 2008, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 MIPS Technologies, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(MIPS)
+
+#include "AbstractMacroAssembler.h"
+#include "MIPSAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerMIPS : public AbstractMacroAssembler<MIPSAssembler, MacroAssemblerMIPS> {
+public:
+    typedef MIPSRegisters::FPRegisterID FPRegisterID;
+
+    MacroAssemblerMIPS()
+        : m_fixedWidth(false)
+    {
+    }
+
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return value >= -2147483647 - 1 && value <= 2147483647;
+    }
+
+    static const Scale ScalePtr = TimesFour;
+
+    // For storing immediate number
+    static const RegisterID immTempRegister = MIPSRegisters::t0;
+    // For storing data loaded from the memory
+    static const RegisterID dataTempRegister = MIPSRegisters::t1;
+    // For storing address base
+    static const RegisterID addrTempRegister = MIPSRegisters::t7;
+    // For storing compare result
+    static const RegisterID cmpTempRegister = MIPSRegisters::t8;
+
+    // FP temp register
+    static const FPRegisterID fpTempRegister = MIPSRegisters::f16;
+
+    static const int MaximumCompactPtrAlignedAddressOffset = 0x7FFFFFFF;
+
+    enum RelationalCondition {
+        Equal,
+        NotEqual,
+        Above,
+        AboveOrEqual,
+        Below,
+        BelowOrEqual,
+        GreaterThan,
+        GreaterThanOrEqual,
+        LessThan,
+        LessThanOrEqual
+    };
+
+    enum ResultCondition {
+        Overflow,
+        Signed,
+        PositiveOrZero,
+        Zero,
+        NonZero
+    };
+
+    enum DoubleCondition {
+        DoubleEqual,
+        DoubleNotEqual,
+        DoubleGreaterThan,
+        DoubleGreaterThanOrEqual,
+        DoubleLessThan,
+        DoubleLessThanOrEqual,
+        DoubleEqualOrUnordered,
+        DoubleNotEqualOrUnordered,
+        DoubleGreaterThanOrUnordered,
+        DoubleGreaterThanOrEqualOrUnordered,
+        DoubleLessThanOrUnordered,
+        DoubleLessThanOrEqualOrUnordered
+    };
+
+    static const RegisterID stackPointerRegister = MIPSRegisters::sp;
+    static const RegisterID framePointerRegister = MIPSRegisters::fp;
+    static const RegisterID returnAddressRegister = MIPSRegisters::ra;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an TrustedImm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addu(dest, dest, src);
+    }
+
+    void add32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.addu(dest, op1, op2);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID dest)
+    {
+        add32(imm, dest, dest);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (imm.m_value >= -32768 && imm.m_value <= 32767
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, src, imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              addu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.addu(dest, src, immTempRegister);
+        }
+    }
+
+    void add32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        add32(imm, src, dest);
+    }
+
+    void add32(TrustedImm32 imm, Address address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              li        immTemp, imm
+              addu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, address.base, address.offset);
+            if (imm.m_value >= -32768 && imm.m_value <= 32767
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister, imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.addu(dataTempRegister, dataTempRegister, immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, address.base, address.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              li        immtemp, imm
+              addu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, address.offset);
+
+            if (imm.m_value >= -32768 && imm.m_value <= 32767 && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister, imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.addu(dataTempRegister, dataTempRegister, immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, addrTempRegister, address.offset);
+        }
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(AbsoluteAddress src, RegisterID dest)
+    {
+        load32(src.m_ptr, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(RegisterID src, Address dest)
+    {
+        if (dest.offset >= -32768 && dest.offset <= 32767 && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              addu      dataTemp, dataTemp, src
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, dest.base, dest.offset);
+            m_assembler.addu(dataTempRegister, dataTempRegister, src);
+            m_assembler.sw(dataTempRegister, dest.base, dest.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              addu      dataTemp, dataTemp, src
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (dest.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, dest.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, dest.offset);
+            m_assembler.addu(dataTempRegister, dataTempRegister, src);
+            m_assembler.sw(dataTempRegister, addrTempRegister, dest.offset);
+        }
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        /*
+           li   addrTemp, address
+           li   immTemp, imm
+           lw   cmpTemp, 0(addrTemp)
+           addu dataTemp, cmpTemp, immTemp
+           sw   dataTemp, 0(addrTemp)
+        */
+        move(TrustedImmPtr(address.m_ptr), addrTempRegister);
+        m_assembler.lw(cmpTempRegister, addrTempRegister, 0);
+        if (imm.m_value >= -32768 && imm.m_value <= 32767 && !m_fixedWidth)
+            m_assembler.addiu(dataTempRegister, cmpTempRegister, imm.m_value);
+        else {
+            move(imm, immTempRegister);
+            m_assembler.addu(dataTempRegister, cmpTempRegister, immTempRegister);
+        }
+        m_assembler.sw(dataTempRegister, addrTempRegister, 0);
+    }
+
+    void add64(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        /*
+            add32(imm, address)
+            sltu  immTemp, dataTemp, cmpTemp    # set carry-in bit
+            lw    dataTemp, 4(addrTemp)
+            addiu dataTemp, imm.m_value >> 31 ? -1 : 0
+            addu  dataTemp, dataTemp, immTemp
+            sw    dataTemp, 4(addrTemp)
+        */
+        add32(imm, address);
+        m_assembler.sltu(immTempRegister, dataTempRegister, cmpTempRegister);
+        m_assembler.lw(dataTempRegister, addrTempRegister, 4);
+        if (imm.m_value >> 31)
+            m_assembler.addiu(dataTempRegister, dataTempRegister, -1);
+        m_assembler.addu(dataTempRegister, dataTempRegister, immTempRegister);
+        m_assembler.sw(dataTempRegister, addrTempRegister, 4);
+    }
+
+    void and32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        and32(dataTempRegister, dest);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andInsn(dest, dest, src);
+    }
+
+    void and32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.andInsn(dest, op1, op2);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (imm.m_value > 0 && imm.m_value <= 65535 && !m_fixedWidth)
+            m_assembler.andi(dest, dest, imm.m_value);
+        else {
+            /*
+              li        immTemp, imm
+              and       dest, dest, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.andInsn(dest, dest, immTempRegister);
+        }
+    }
+
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (imm.m_value > 0 && imm.m_value <= 65535 && !m_fixedWidth)
+            m_assembler.andi(dest, src, imm.m_value);
+        else {
+            move(imm, immTempRegister);
+            m_assembler.andInsn(dest, src, immTempRegister);
+        }
+    }
+
+    void countLeadingZeros32(RegisterID src, RegisterID dest)
+    {
+#if WTF_MIPS_ISA_AT_LEAST(32)
+        m_assembler.clz(dest, src);
+#else
+        static_assert(false, "CLZ opcode is not available for this ISA");
+#endif
+    }
+
+    void lshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.sllv(dest, dest, shiftAmount);
+    }
+
+    void lshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.sllv(dest, src, shiftAmount);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        m_assembler.sllv(dest, dest, immTempRegister);
+    }
+
+    void lshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        m_assembler.sllv(dest, src, immTempRegister);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mul(dest, dest, src);
+    }
+
+    void mul32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.mul(dest, op1, op2);
+    }
+
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (imm.m_value == 1 && !m_fixedWidth)
+            move(src, dest);
+        else {
+            /*
+                li      dataTemp, imm
+                mul     dest, src, dataTemp
+            */
+            move(imm, dataTempRegister);
+            m_assembler.mul(dest, src, dataTempRegister);
+        }
+    }
+
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.subu(srcDest, MIPSRegisters::zero, srcDest);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orInsn(dest, dest, src);
+    }
+
+    void or32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.orInsn(dest, op1, op2);
+    }
+
+    void or32(TrustedImm32 imm, AbsoluteAddress dest)
+    {
+        if (!imm.m_value && !m_fixedWidth)
+            return;
+
+        // TODO: Swap dataTempRegister and immTempRegister usage
+        load32(dest.m_ptr, immTempRegister);
+        or32(imm, immTempRegister);
+        store32(immTempRegister, dest.m_ptr);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value && !m_fixedWidth)
+            return;
+
+        if (imm.m_value > 0 && imm.m_value <= 65535
+            && !m_fixedWidth) {
+            m_assembler.ori(dest, dest, imm.m_value);
+            return;
+        }
+
+        /*
+            li      dataTemp, imm
+            or      dest, dest, dataTemp
+        */
+        move(imm, dataTempRegister);
+        m_assembler.orInsn(dest, dest, dataTempRegister);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_value && !m_fixedWidth) {
+            move(src, dest);
+            return;
+        }
+
+        if (imm.m_value > 0 && imm.m_value <= 65535 && !m_fixedWidth) {
+            m_assembler.ori(dest, src, imm.m_value);
+            return;
+        }
+
+        /*
+            li      dataTemp, imm
+            or      dest, src, dataTemp
+        */
+        move(imm, dataTempRegister);
+        m_assembler.orInsn(dest, src, dataTempRegister);
+    }
+
+    void or32(RegisterID src, AbsoluteAddress dest)
+    {
+        load32(dest.m_ptr, dataTempRegister);
+        m_assembler.orInsn(dataTempRegister, dataTempRegister, src);
+        store32(dataTempRegister, dest.m_ptr);
+    }
+
+    void rshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.srav(dest, dest, shiftAmount);
+    }
+
+    void rshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.srav(dest, src, shiftAmount);
+    }
+
+    void rshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.sra(dest, dest, imm.m_value);
+    }
+
+    void rshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.sra(dest, src, imm.m_value);
+    }
+
+    void urshift32(RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.srlv(dest, dest, shiftAmount);
+    }
+
+    void urshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        m_assembler.srlv(dest, src, shiftAmount);
+    }
+
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.srl(dest, dest, imm.m_value);
+    }
+
+    void urshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.srl(dest, src, imm.m_value);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subu(dest, dest, src);
+    }
+
+    void sub32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.subu(dest, op1, op2);
+    }
+
+    void sub32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, dest, -imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              subu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.subu(dest, dest, immTempRegister);
+        }
+    }
+
+    void sub32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value >= -32767 && imm.m_value <= 32768
+            && !m_fixedWidth) {
+            /*
+              addiu     dest, src, imm
+            */
+            m_assembler.addiu(dest, src, -imm.m_value);
+        } else {
+            /*
+              li        immTemp, imm
+              subu      dest, src, immTemp
+            */
+            move(imm, immTempRegister);
+            m_assembler.subu(dest, src, immTempRegister);
+        }
+    }
+
+    void sub32(TrustedImm32 imm, Address address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+              lw        dataTemp, offset(base)
+              li        immTemp, imm
+              subu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, offset(base)
+            */
+            m_assembler.lw(dataTempRegister, address.base, address.offset);
+            if (imm.m_value >= -32767 && imm.m_value <= 32768 && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister, -imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, address.base, address.offset);
+        } else {
+            /*
+              lui       addrTemp, (offset + 0x8000) >> 16
+              addu      addrTemp, addrTemp, base
+              lw        dataTemp, (offset & 0xffff)(addrTemp)
+              li        immtemp, imm
+              subu      dataTemp, dataTemp, immTemp
+              sw        dataTemp, (offset & 0xffff)(addrTemp)
+            */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dataTempRegister, addrTempRegister, address.offset);
+
+            if (imm.m_value >= -32767 && imm.m_value <= 32768
+                && !m_fixedWidth)
+                m_assembler.addiu(dataTempRegister, dataTempRegister, -imm.m_value);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister);
+            }
+            m_assembler.sw(dataTempRegister, addrTempRegister, address.offset);
+        }
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        sub32(dataTempRegister, dest);
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        /*
+           li   addrTemp, address
+           li   immTemp, imm
+           lw   dataTemp, 0(addrTemp)
+           subu dataTemp, dataTemp, immTemp
+           sw   dataTemp, 0(addrTemp)
+        */
+        move(TrustedImmPtr(address.m_ptr), addrTempRegister);
+        m_assembler.lw(dataTempRegister, addrTempRegister, 0);
+
+        if (imm.m_value >= -32767 && imm.m_value <= 32768 && !m_fixedWidth)
+            m_assembler.addiu(dataTempRegister, dataTempRegister, -imm.m_value);
+        else {
+            move(imm, immTempRegister);
+            m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister);
+        }
+        m_assembler.sw(dataTempRegister, addrTempRegister, 0);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorInsn(dest, dest, src);
+    }
+
+    void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.xorInsn(dest, op1, op2);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value == -1) {
+            m_assembler.nor(dest, dest, MIPSRegisters::zero);
+            return;
+        }
+
+        /*
+            li  immTemp, imm
+            xor dest, dest, immTemp
+        */
+        move(imm, immTempRegister);
+        m_assembler.xorInsn(dest, dest, immTempRegister);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (imm.m_value == -1) {
+            m_assembler.nor(dest, src, MIPSRegisters::zero);
+            return;
+        }
+
+        /*
+            li  immTemp, imm
+            xor dest, dest, immTemp
+        */
+        move(imm, immTempRegister);
+        m_assembler.xorInsn(dest, src, immTempRegister);
+    }
+
+    void sqrtDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.sqrtd(dst, src);
+    }
+
+    void absDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.absd(dst, src);
+    }
+
+    NO_RETURN_DUE_TO_CRASH void ceilDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    NO_RETURN_DUE_TO_CRASH void floorDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    NO_RETURN_DUE_TO_CRASH void roundTowardZeroDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result(this);
+        /*
+            lui     addrTemp, (offset + 0x8000) >> 16
+            addu    addrTemp, addrTemp, base
+            lw      dest, (offset & 0xffff)(addrTemp)
+        */
+        m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lw(dest, addrTempRegister, address.offset);
+        return result;
+    }
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address). The source for a store may be an TrustedImm32. Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+    /* Need to use zero-extened load byte for load8.  */
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.lbu(dest, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                lbu     dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lbu(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load8(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+             sll     addrTemp, address.index, address.scale
+             addu    addrTemp, addrTemp, address.base
+             lbu     dest, address.offset(addrTemp)
+             */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lbu(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+             sll     addrTemp, address.index, address.scale
+             addu    addrTemp, addrTemp, address.base
+             lui     immTemp, (address.offset + 0x8000) >> 16
+             addu    addrTemp, addrTemp, immTemp
+             lbu     dest, (address.offset & 0xffff)(at)
+             */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.lbu(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    ALWAYS_INLINE void load8(AbsoluteAddress address, RegisterID dest)
+    {
+        load8(address.m_ptr, dest);
+    }
+
+    void load8(const void* address, RegisterID dest)
+    {
+        /*
+            li  addrTemp, address
+            lbu dest, 0(addrTemp)
+        */
+        move(TrustedImmPtr(address), addrTempRegister);
+        m_assembler.lbu(dest, addrTempRegister, 0);
+    }
+
+    void load8SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lb      dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lb(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lb     dest, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.lb(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.lw(dest, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                lw      dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lw      dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lw      dest, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.lw(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load16Unaligned(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767 && !m_fixedWidth) {
+            /*
+                sll     addrtemp, address.index, address.scale
+                addu    addrtemp, addrtemp, address.base
+                lbu     immTemp, address.offset+x(addrtemp) (x=0 for LE, x=1 for BE)
+                lbu     dest, address.offset+x(addrtemp)    (x=1 for LE, x=0 for BE)
+                sll     dest, dest, 8
+                or      dest, dest, immTemp
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lbu(immTempRegister, addrTempRegister, address.offset + 1);
+            m_assembler.lbu(dest, addrTempRegister, address.offset);
+#else
+            m_assembler.lbu(immTempRegister, addrTempRegister, address.offset);
+            m_assembler.lbu(dest, addrTempRegister, address.offset + 1);
+#endif
+            m_assembler.sll(dest, dest, 8);
+            m_assembler.orInsn(dest, dest, immTempRegister);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, address.offset >> 16
+                ori     immTemp, immTemp, address.offset & 0xffff
+                addu    addrTemp, addrTemp, immTemp
+                lbu     immTemp, x(addrtemp) (x=0 for LE, x=1 for BE)
+                lbu     dest, x(addrtemp)    (x=1 for LE, x=0 for BE)
+                sll     dest, dest, 8
+                or      dest, dest, immTemp
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, address.offset >> 16);
+            m_assembler.ori(immTempRegister, immTempRegister, address.offset);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lbu(immTempRegister, addrTempRegister, 1);
+            m_assembler.lbu(dest, addrTempRegister, 0);
+#else
+            m_assembler.lbu(immTempRegister, addrTempRegister, 0);
+            m_assembler.lbu(dest, addrTempRegister, 1);
+#endif
+            m_assembler.sll(dest, dest, 8);
+            m_assembler.orInsn(dest, dest, immTempRegister);
+        }
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32764
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                (Big-Endian)
+                lwl     dest, address.offset(addrTemp)
+                lwr     dest, address.offset+3(addrTemp)
+                (Little-Endian)
+                lwl     dest, address.offset+3(addrTemp)
+                lwr     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lwl(dest, addrTempRegister, address.offset);
+            m_assembler.lwr(dest, addrTempRegister, address.offset + 3);
+#else
+            m_assembler.lwl(dest, addrTempRegister, address.offset + 3);
+            m_assembler.lwr(dest, addrTempRegister, address.offset);
+
+#endif
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, address.offset >> 16
+                ori     immTemp, immTemp, address.offset & 0xffff
+                addu    addrTemp, addrTemp, immTemp
+                (Big-Endian)
+                lw      dest, 0(at)
+                lw      dest, 3(at)
+                (Little-Endian)
+                lw      dest, 3(at)
+                lw      dest, 0(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, address.offset >> 16);
+            m_assembler.ori(immTempRegister, immTempRegister, address.offset);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+#if CPU(BIG_ENDIAN)
+            m_assembler.lwl(dest, addrTempRegister, 0);
+            m_assembler.lwr(dest, addrTempRegister, 3);
+#else
+            m_assembler.lwl(dest, addrTempRegister, 3);
+            m_assembler.lwr(dest, addrTempRegister, 0);
+#endif
+        }
+    }
+
+    void load32(const void* address, RegisterID dest)
+    {
+        /*
+            li  addrTemp, address
+            lw  dest, 0(addrTemp)
+        */
+        move(TrustedImmPtr(address), addrTempRegister);
+        m_assembler.lw(dest, addrTempRegister, 0);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        /*
+            lui addrTemp, address.offset >> 16
+            ori addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            lw  dest, 0(addrTemp)
+        */
+        DataLabel32 dataLabel(this);
+        move(TrustedImm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lw(dest, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+    
+    DataLabelCompact load32WithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabelCompact dataLabel(this);
+        load32WithAddressOffsetPatch(address, dest);
+        return dataLabel;
+    }
+
+    /* Need to use zero-extened load half-word for load16.  */
+    void load16(ImplicitAddress address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.lhu(dest, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                lhu     dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    /* Need to use zero-extened load half-word for load16.  */
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lhu     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lhu     dest, (address.offset & 0xffff)(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.lhu(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void load16SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lh     dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lh(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lh     dest, (address.offset & 0xffff)(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.lh(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        m_fixedWidth = true;
+        /*
+            lui addrTemp, address.offset >> 16
+            ori addrTemp, addrTemp, address.offset & 0xffff
+            addu        addrTemp, addrTemp, address.base
+            sw  src, 0(addrTemp)
+        */
+        DataLabel32 dataLabel(this);
+        move(TrustedImm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.sw(src, addrTempRegister, 0);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    void store8(RegisterID src, BaseIndex address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                sb      src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sb(src, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                sb      src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.sb(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store8(RegisterID src, void* address)
+    {
+        move(TrustedImmPtr(address), addrTempRegister);
+        m_assembler.sb(src, addrTempRegister, 0);
+    }
+
+    void store8(TrustedImm32 imm, void* address)
+    {
+        /*
+            li  immTemp, imm
+            li  addrTemp, address
+            sb  src, 0(addrTemp)
+        */
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        if (!imm8.m_value && !m_fixedWidth) {
+            move(TrustedImmPtr(address), addrTempRegister);
+            m_assembler.sb(MIPSRegisters::zero, addrTempRegister, 0);
+        } else {
+            move(imm8, immTempRegister);
+            move(TrustedImmPtr(address), addrTempRegister);
+            m_assembler.sb(immTempRegister, addrTempRegister, 0);
+        }
+    }
+
+    void store8(TrustedImm32 imm, ImplicitAddress address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            if (!imm8.m_value)
+                m_assembler.sb(MIPSRegisters::zero, address.base, address.offset);
+            else {
+                move(imm8, immTempRegister);
+                m_assembler.sb(immTempRegister, address.base, address.offset);
+            }
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sb      immTemp, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            if (!imm8.m_value && !m_fixedWidth)
+                m_assembler.sb(MIPSRegisters::zero, addrTempRegister, address.offset);
+            else {
+                move(imm8, immTempRegister);
+                m_assembler.sb(immTempRegister, addrTempRegister, address.offset);
+            }
+        }
+    }
+
+    void store16(RegisterID src, BaseIndex address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                sh      src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sh(src, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                sh      src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.sh(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.sw(src, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sw      src, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                sw      src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                sw      src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.sw(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void store32(TrustedImm32 imm, ImplicitAddress address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            if (!imm.m_value)
+                m_assembler.sw(MIPSRegisters::zero, address.base, address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, address.base, address.offset);
+            }
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sw      immTemp, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            if (!imm.m_value && !m_fixedWidth)
+                m_assembler.sw(MIPSRegisters::zero, addrTempRegister, address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, addrTempRegister, address.offset);
+            }
+        }
+    }
+
+    void store32(TrustedImm32 imm, BaseIndex address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767 && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                sw      src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            if (!imm.m_value)
+                m_assembler.sw(MIPSRegisters::zero, addrTempRegister, address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, addrTempRegister, address.offset);
+            }
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                sw      src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            if (!imm.m_value && !m_fixedWidth)
+                m_assembler.sw(MIPSRegisters::zero, addrTempRegister, address.offset);
+            else {
+                move(imm, immTempRegister);
+                m_assembler.sw(immTempRegister, addrTempRegister, address.offset);
+            }
+        }
+    }
+
+
+    void store32(RegisterID src, const void* address)
+    {
+        /*
+            li  addrTemp, address
+            sw  src, 0(addrTemp)
+        */
+        move(TrustedImmPtr(address), addrTempRegister);
+        m_assembler.sw(src, addrTempRegister, 0);
+    }
+
+    void store32(TrustedImm32 imm, const void* address)
+    {
+        /*
+            li  immTemp, imm
+            li  addrTemp, address
+            sw  src, 0(addrTemp)
+        */
+        if (!imm.m_value && !m_fixedWidth) {
+            move(TrustedImmPtr(address), addrTempRegister);
+            m_assembler.sw(MIPSRegisters::zero, addrTempRegister, 0);
+        } else {
+            move(imm, immTempRegister);
+            move(TrustedImmPtr(address), addrTempRegister);
+            m_assembler.sw(immTempRegister, addrTempRegister, 0);
+        }
+    }
+
+    // Floating-point operations:
+
+    static bool supportsFloatingPoint()
+    {
+#if WTF_MIPS_DOUBLE_FLOAT
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    static bool supportsFloatingPointTruncate()
+    {
+#if WTF_MIPS_DOUBLE_FLOAT && WTF_MIPS_ISA_AT_LEAST(2)
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    static bool supportsFloatingPointSqrt()
+    {
+#if WTF_MIPS_DOUBLE_FLOAT && WTF_MIPS_ISA_AT_LEAST(2)
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    static bool supportsFloatingPointAbs()
+    {
+#if WTF_MIPS_DOUBLE_FLOAT && WTF_MIPS_ISA_AT_LEAST(2)
+        return true;
+#else
+        return false;
+#endif
+    }
+
+    static bool supportsFloatingPointRounding() { return false; }
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data. Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack. Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+
+    void pop(RegisterID dest)
+    {
+        m_assembler.lw(dest, MIPSRegisters::sp, 0);
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, 4);
+    }
+
+    void popPair(RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.lw(dest1, MIPSRegisters::sp, 0);
+        m_assembler.lw(dest2, MIPSRegisters::sp, 4);
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, 8);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, -4);
+        m_assembler.sw(src, MIPSRegisters::sp, 0);
+    }
+
+    void push(Address address)
+    {
+        load32(address, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    void push(TrustedImm32 imm)
+    {
+        move(imm, immTempRegister);
+        push(immTempRegister);
+    }
+
+    void pushPair(RegisterID src1, RegisterID src2)
+    {
+        m_assembler.addiu(MIPSRegisters::sp, MIPSRegisters::sp, -8);
+        m_assembler.sw(src2, MIPSRegisters::sp, 4);
+        m_assembler.sw(src1, MIPSRegisters::sp, 0);
+    }
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value && !m_fixedWidth)
+            move(MIPSRegisters::zero, dest);
+        else if (m_fixedWidth) {
+            m_assembler.lui(dest, imm.m_value >> 16);
+            m_assembler.ori(dest, dest, imm.m_value);
+        } else
+            m_assembler.li(dest, imm.m_value);
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            m_assembler.move(dest, src);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        move(TrustedImm32(imm), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        move(reg1, immTempRegister);
+        move(reg2, reg1);
+        move(immTempRegister, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            move(src, dest);
+    }
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+
+    Jump branch8(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, dataTempRegister);
+        move(right8, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch8(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, dataTempRegister);
+        move(right8, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    void compare8(RelationalCondition cond, Address left, TrustedImm32 right, RegisterID dest)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, dataTempRegister);
+        move(right8, immTempRegister);
+        compare32(cond, dataTempRegister, immTempRegister, dest);
+    }
+
+    Jump branch8(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, dataTempRegister);
+        // Be careful that the previous load8() uses immTempRegister.
+        // So, we need to put move() after load8().
+        move(right8, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        if (cond == Equal)
+            return branchEqual(left, right);
+        if (cond == NotEqual)
+            return branchNotEqual(left, right);
+        if (cond == Above) {
+            m_assembler.sltu(cmpTempRegister, right, left);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == AboveOrEqual) {
+            m_assembler.sltu(cmpTempRegister, left, right);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Below) {
+            m_assembler.sltu(cmpTempRegister, left, right);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == BelowOrEqual) {
+            m_assembler.sltu(cmpTempRegister, right, left);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == GreaterThan) {
+            m_assembler.slt(cmpTempRegister, right, left);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == GreaterThanOrEqual) {
+            m_assembler.slt(cmpTempRegister, left, right);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == LessThan) {
+            m_assembler.slt(cmpTempRegister, left, right);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == LessThanOrEqual) {
+            m_assembler.slt(cmpTempRegister, right, left);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+
+        return Jump();
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, TrustedImm32 right)
+    {
+        move(right, immTempRegister);
+        return branch32(cond, left, immTempRegister);
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, Address right)
+    {
+        load32(right, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, RegisterID right)
+    {
+        load32(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        load32(left, dataTempRegister);
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        load32(left, dataTempRegister);
+        // Be careful that the previous load32() uses immTempRegister.
+        // So, we need to put move() after load32().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32WithUnalignedHalfWords(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        load32WithUnalignedHalfWords(left, dataTempRegister);
+        // Be careful that the previous load32WithUnalignedHalfWords()
+        // uses immTempRegister.
+        // So, we need to put move() after load32WithUnalignedHalfWords().
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        move(right, immTempRegister);
+        return branch32(cond, dataTempRegister, immTempRegister);
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
+        m_assembler.andInsn(cmpTempRegister, reg, mask);
+        switch (cond) {
+        case Zero:
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        case NonZero:
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        case Signed:
+            m_assembler.slt(cmpTempRegister, cmpTempRegister, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero) || (cond == Signed));
+        if (mask.m_value == -1 && !m_fixedWidth) {
+            switch (cond) {
+            case Zero:
+                return branchEqual(reg, MIPSRegisters::zero);
+            case NonZero:
+                return branchNotEqual(reg, MIPSRegisters::zero);
+            case Signed:
+                m_assembler.slt(cmpTempRegister, reg, MIPSRegisters::zero);
+                return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+        move(mask, immTempRegister);
+        return branchTest32(cond, reg, immTempRegister);
+    }
+
+    Jump branchTest32(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load32(address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest32(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load32(address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask);
+    }
+
+    Jump branchTest8(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask8);
+    }
+
+    Jump branchTest8(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        move(TrustedImmPtr(address.m_ptr), dataTempRegister);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, Address(dataTempRegister), dataTempRegister);
+        return branchTest32(cond, dataTempRegister, mask8);
+    }
+
+    Jump jump()
+    {
+        return branchEqual(MIPSRegisters::zero, MIPSRegisters::zero);
+    }
+
+    void jump(RegisterID target)
+    {
+        move(target, MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+    }
+
+    void jump(Address address)
+    {
+        m_fixedWidth = true;
+        load32(address, MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+    }
+
+    void jump(AbsoluteAddress address)
+    {
+        m_fixedWidth = true;
+        load32(address.m_ptr, MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+    }
+
+    void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.vmov(dest1, dest2, src);
+    }
+
+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch)
+    {
+        UNUSED_PARAM(scratch);
+        m_assembler.vmov(dest, src1, src2);
+    }
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation. The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dest, dataTemp
+                xor     cmpTemp, dataTemp, src
+                bltz    cmpTemp, No_overflow    # diff sign bit -> no overflow
+                addu    dest, dataTemp, src
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign big -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(dest, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, src);
+            m_assembler.bltz(cmpTempRegister, 10);
+            m_assembler.addu(dest, dataTempRegister, src);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            add32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == PositiveOrZero) {
+            add32(src, dest);
+            // Check if dest is not negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            add32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            add32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dataTemp, op1
+                xor     cmpTemp, dataTemp, op2
+                bltz    cmpTemp, No_overflow    # diff sign bit -> no overflow
+                addu    dest, dataTemp, op2
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign big -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(op1, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, op2);
+            m_assembler.bltz(cmpTempRegister, 10);
+            m_assembler.addu(dest, dataTempRegister, op2);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            add32(op1, op2, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == PositiveOrZero) {
+            add32(op1, op2, dest);
+            // Check if dest is not negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            add32(op1, op2, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            add32(op1, op2, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchAdd32(cond, immTempRegister, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, Address address, RegisterID dest)
+    {
+        load32(address, immTempRegister);
+        return branchAdd32(cond, immTempRegister, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        move(src, dest);
+        return branchAdd32(cond, immTempRegister, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dataTemp, dest
+                xori    cmpTemp, dataTemp, imm
+                bltz    cmpTemp, No_overflow    # diff sign bit -> no overflow
+                addiu   dataTemp, dataTemp, imm
+                move    dest, dataTemp
+                xori    cmpTemp, dataTemp, imm
+                bgez    cmpTemp, No_overflow    # same sign big -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            if (imm.m_value >= -32768 && imm.m_value  <= 32767 && !m_fixedWidth) {
+                load32(dest.m_ptr, dataTempRegister);
+                m_assembler.xori(cmpTempRegister, dataTempRegister, imm.m_value);
+                m_assembler.bltz(cmpTempRegister, 10);
+                m_assembler.addiu(dataTempRegister, dataTempRegister, imm.m_value);
+                store32(dataTempRegister, dest.m_ptr);
+                m_assembler.xori(cmpTempRegister, dataTempRegister, imm.m_value);
+                m_assembler.bgez(cmpTempRegister, 7);
+                m_assembler.nop();
+            } else {
+                load32(dest.m_ptr, dataTempRegister);
+                move(imm, immTempRegister);
+                m_assembler.xorInsn(cmpTempRegister, dataTempRegister, immTempRegister);
+                m_assembler.bltz(cmpTempRegister, 10);
+                m_assembler.addiu(dataTempRegister, dataTempRegister, immTempRegister);
+                store32(dataTempRegister, dest.m_ptr);
+                m_assembler.xori(cmpTempRegister, dataTempRegister, immTempRegister);
+                m_assembler.bgez(cmpTempRegister, 7);
+                m_assembler.nop();
+            }
+            return jump();
+        }
+        move(imm, immTempRegister);
+        load32(dest.m_ptr, dataTempRegister);
+        add32(immTempRegister, dataTempRegister);
+        store32(dataTempRegister, dest.m_ptr);
+        if (cond == Signed) {
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dataTempRegister, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == PositiveOrZero) {
+            // Check if dest is not negative.
+            m_assembler.slt(cmpTempRegister, dataTempRegister, MIPSRegisters::zero);
+            return branchEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero)
+            return branchEqual(dataTempRegister, MIPSRegisters::zero);
+        if (cond == NonZero)
+            return branchNotEqual(dataTempRegister, MIPSRegisters::zero);
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                mult    src, dest
+                mfhi    dataTemp
+                mflo    dest
+                sra     addrTemp, dest, 31
+                beq     dataTemp, addrTemp, No_overflow # all sign bits (bit 63 to bit 31) are the same -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            m_assembler.mult(src1, src2);
+            m_assembler.mfhi(dataTempRegister);
+            m_assembler.mflo(dest);
+            m_assembler.sra(addrTempRegister, dest, 31);
+            m_assembler.beq(dataTempRegister, addrTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            mul32(src1, src2, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            mul32(src1, src2, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            mul32(src1, src2, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                mult    src, dest
+                mfhi    dataTemp
+                mflo    dest
+                sra     addrTemp, dest, 31
+                beq     dataTemp, addrTemp, No_overflow # all sign bits (bit 63 to bit 31) are the same -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            m_assembler.mult(src, dest);
+            m_assembler.mfhi(dataTempRegister);
+            m_assembler.mflo(dest);
+            m_assembler.sra(addrTempRegister, dest, 31);
+            m_assembler.beq(dataTempRegister, addrTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            mul32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            mul32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            mul32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchMul32(cond, immTempRegister, src, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dest, dataTemp
+                xor     cmpTemp, dataTemp, src
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                subu    dest, dataTemp, src
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(dest, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, src);
+            m_assembler.bgez(cmpTempRegister, 10);
+            m_assembler.subu(dest, dataTempRegister, src);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            sub32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            sub32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            sub32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchSub32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchSub32(cond, immTempRegister, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(imm, immTempRegister);
+        return branchSub32(cond, src, immTempRegister, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Overflow) {
+            /*
+                move    dataTemp, op1
+                xor     cmpTemp, dataTemp, op2
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                subu    dest, dataTemp, op2
+                xor     cmpTemp, dest, dataTemp
+                bgez    cmpTemp, No_overflow    # same sign bit -> no overflow
+                nop
+                b       Overflow
+                nop
+                nop
+                nop
+                nop
+                nop
+            No_overflow:
+            */
+            move(op1, dataTempRegister);
+            m_assembler.xorInsn(cmpTempRegister, dataTempRegister, op2);
+            m_assembler.bgez(cmpTempRegister, 10);
+            m_assembler.subu(dest, dataTempRegister, op2);
+            m_assembler.xorInsn(cmpTempRegister, dest, dataTempRegister);
+            m_assembler.bgez(cmpTempRegister, 7);
+            m_assembler.nop();
+            return jump();
+        }
+        if (cond == Signed) {
+            sub32(op1, op2, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            sub32(op1, op2, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            sub32(op1, op2, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    Jump branchNeg32(ResultCondition cond, RegisterID srcDest)
+    {
+        m_assembler.li(dataTempRegister, -1);
+        return branchMul32(cond, dataTempRegister, srcDest);
+    }
+
+    Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+        if (cond == Signed) {
+            or32(src, dest);
+            // Check if dest is negative.
+            m_assembler.slt(cmpTempRegister, dest, MIPSRegisters::zero);
+            return branchNotEqual(cmpTempRegister, MIPSRegisters::zero);
+        }
+        if (cond == Zero) {
+            or32(src, dest);
+            return branchEqual(dest, MIPSRegisters::zero);
+        }
+        if (cond == NonZero) {
+            or32(src, dest);
+            return branchNotEqual(dest, MIPSRegisters::zero);
+        }
+        ASSERT(0);
+        return Jump();
+    }
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.bkpt();
+    }
+
+    Call nearCall()
+    {
+        /* We need two words for relaxation. */
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.jal();
+        m_assembler.nop();
+        return Call(m_assembler.label(), Call::LinkableNear);
+    }
+
+    Call nearTailCall()
+    {
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.beq(MIPSRegisters::zero, MIPSRegisters::zero, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Call(m_assembler.label(), Call::LinkableNearTail);
+    }
+
+    Call call()
+    {
+        m_assembler.lui(MIPSRegisters::t9, 0);
+        m_assembler.ori(MIPSRegisters::t9, MIPSRegisters::t9, 0);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        return Call(m_assembler.label(), Call::Linkable);
+    }
+
+    Call call(RegisterID target)
+    {
+        move(target, MIPSRegisters::t9);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        return Call(m_assembler.label(), Call::None);
+    }
+
+    Call call(Address address)
+    {
+        m_fixedWidth = true;
+        load32(address, MIPSRegisters::t9);
+        m_assembler.jalr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+        return Call(m_assembler.label(), Call::None);
+    }
+
+    void ret()
+    {
+        m_assembler.jr(MIPSRegisters::ra);
+        m_assembler.nop();
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        if (cond == Equal) {
+            m_assembler.xorInsn(dest, left, right);
+            m_assembler.sltiu(dest, dest, 1);
+        } else if (cond == NotEqual) {
+            m_assembler.xorInsn(dest, left, right);
+            m_assembler.sltu(dest, MIPSRegisters::zero, dest);
+        } else if (cond == Above)
+            m_assembler.sltu(dest, right, left);
+        else if (cond == AboveOrEqual) {
+            m_assembler.sltu(dest, left, right);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == Below)
+            m_assembler.sltu(dest, left, right);
+        else if (cond == BelowOrEqual) {
+            m_assembler.sltu(dest, right, left);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == GreaterThan)
+            m_assembler.slt(dest, right, left);
+        else if (cond == GreaterThanOrEqual) {
+            m_assembler.slt(dest, left, right);
+            m_assembler.xori(dest, dest, 1);
+        } else if (cond == LessThan)
+            m_assembler.slt(dest, left, right);
+        else if (cond == LessThanOrEqual) {
+            m_assembler.slt(dest, right, left);
+            m_assembler.xori(dest, dest, 1);
+        }
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        move(right, immTempRegister);
+        compare32(cond, left, immTempRegister, dest);
+    }
+
+    void test8(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, dataTempRegister);
+        if ((mask8.m_value & 0xff) == 0xff && !m_fixedWidth) {
+            if (cond == Zero)
+                m_assembler.sltiu(dest, dataTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, dataTempRegister);
+        } else {
+            move(mask8, immTempRegister);
+            m_assembler.andInsn(cmpTempRegister, dataTempRegister, immTempRegister);
+            if (cond == Zero)
+                m_assembler.sltiu(dest, cmpTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, cmpTempRegister);
+        }
+    }
+
+    void test32(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        load32(address, dataTempRegister);
+        if (mask.m_value == -1 && !m_fixedWidth) {
+            if (cond == Zero)
+                m_assembler.sltiu(dest, dataTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, dataTempRegister);
+        } else {
+            move(mask, immTempRegister);
+            m_assembler.andInsn(cmpTempRegister, dataTempRegister, immTempRegister);
+            if (cond == Zero)
+                m_assembler.sltiu(dest, cmpTempRegister, 1);
+            else
+                m_assembler.sltu(dest, MIPSRegisters::zero, cmpTempRegister);
+        }
+    }
+
+    DataLabel32 moveWithPatch(TrustedImm32 imm, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        DataLabel32 label(this);
+        move(imm, dest);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
+    {
+        m_fixedWidth = true;
+        DataLabelPtr label(this);
+        move(initialValue, dest);
+        m_fixedWidth = false;
+        return label;
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        m_fixedWidth = true;
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, left, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        m_fixedWidth = true;
+        load32(left, dataTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, dataTempRegister, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    Jump branch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        m_fixedWidth = true;
+        load32(left, dataTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, immTempRegister);
+        Jump temp = branch32(cond, dataTempRegister, immTempRegister);
+        m_fixedWidth = false;
+        return temp;
+    }
+
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        m_fixedWidth = true;
+        DataLabelPtr dataLabel = moveWithPatch(initialValue, dataTempRegister);
+        store32(dataTempRegister, address);
+        m_fixedWidth = false;
+        return dataLabel;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address)
+    {
+        return storePtrWithPatch(TrustedImmPtr(0), address);
+    }
+
+    Call tailRecursiveCall()
+    {
+        // Like a normal call, but don't update the returned address register
+        m_fixedWidth = true;
+        move(TrustedImm32(0), MIPSRegisters::t9);
+        m_assembler.jr(MIPSRegisters::t9);
+        m_assembler.nop();
+        m_fixedWidth = false;
+        return Call(m_assembler.label(), Call::Linkable);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+    void loadFloat(BaseIndex address, FPRegisterID dest)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lwc1    dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lwc1(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lwc1    dest, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.lwc1(dest, addrTempRegister, address.offset);
+        }
+    }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address.offset
+            addu        addrTemp, addrTemp, base
+            lwc1        dest, 0(addrTemp)
+            lwc1        dest+1, 4(addrTemp)
+         */
+        move(TrustedImm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.lwc1(dest, addrTempRegister, 0);
+        m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            m_assembler.ldc1(dest, address.base, address.offset);
+        } else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                ldc1    dest, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.ldc1(dest, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void loadDouble(BaseIndex address, FPRegisterID dest)
+    {
+#if WTF_MIPS_ISA(1)
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lwc1    dest, address.offset(addrTemp)
+                lwc1    dest+1, (address.offset+4)(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lwc1(dest, addrTempRegister, address.offset);
+            m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, address.offset + 4);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                lwc1    dest, (address.offset & 0xffff)(at)
+                lwc1    dest+1, (address.offset & 0xffff + 4)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.lwc1(dest, addrTempRegister, address.offset);
+            m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, address.offset + 4);
+        }
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                ldc1    dest, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.ldc1(dest, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                ldc1    dest, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.ldc1(dest, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address
+            lwc1        dest, 0(addrTemp)
+            lwc1        dest+1, 4(addrTemp)
+         */
+        move(address, addrTempRegister);
+        m_assembler.lwc1(dest, addrTempRegister, 0);
+        m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, 4);
+#else
+        /*
+            li          addrTemp, address
+            ldc1        dest, 0(addrTemp)
+        */
+        move(address, addrTempRegister);
+        m_assembler.ldc1(dest, addrTempRegister, 0);
+#endif
+    }
+
+    void storeFloat(FPRegisterID src, BaseIndex address)
+    {
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                swc1    src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.swc1(src, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                swc1    src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.swc1(src, addrTempRegister, address.offset);
+        }
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+#if WTF_MIPS_ISA(1)
+        /*
+            li          addrTemp, address.offset
+            addu        addrTemp, addrTemp, base
+            swc1        dest, 0(addrTemp)
+            swc1        dest+1, 4(addrTemp)
+         */
+        move(TrustedImm32(address.offset), addrTempRegister);
+        m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+        m_assembler.swc1(src, addrTempRegister, 0);
+        m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4);
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth)
+            m_assembler.sdc1(src, address.base, address.offset);
+        else {
+            /*
+                lui     addrTemp, (offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, base
+                sdc1    src, (offset & 0xffff)(addrTemp)
+              */
+            m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sdc1(src, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void storeDouble(FPRegisterID src, BaseIndex address)
+    {
+#if WTF_MIPS_ISA(1)
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                swc1    src, address.offset(addrTemp)
+                swc1    src+1, (address.offset + 4)(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.swc1(src, addrTempRegister, address.offset);
+            m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, address.offset + 4);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                swc1    src, (address.offset & 0xffff)(at)
+                swc1    src+1, (address.offset & 0xffff + 4)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.swc1(src, addrTempRegister, address.offset);
+            m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, address.offset + 4);
+        }
+#else
+        if (address.offset >= -32768 && address.offset <= 32767
+            && !m_fixedWidth) {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                sdc1    src, address.offset(addrTemp)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.sdc1(src, addrTempRegister, address.offset);
+        } else {
+            /*
+                sll     addrTemp, address.index, address.scale
+                addu    addrTemp, addrTemp, address.base
+                lui     immTemp, (address.offset + 0x8000) >> 16
+                addu    addrTemp, addrTemp, immTemp
+                sdc1    src, (address.offset & 0xffff)(at)
+            */
+            m_assembler.sll(addrTempRegister, address.index, address.scale);
+            m_assembler.addu(addrTempRegister, addrTempRegister, address.base);
+            m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16);
+            m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister);
+            m_assembler.sdc1(src, addrTempRegister, address.offset);
+        }
+#endif
+    }
+
+    void storeDouble(FPRegisterID src, TrustedImmPtr address)
+    {
+#if WTF_MIPS_ISA(1)
+        move(address, addrTempRegister);
+        m_assembler.swc1(src, addrTempRegister, 0);
+        m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4);
+#else
+        move(address, addrTempRegister);
+        m_assembler.sdc1(src, addrTempRegister, 0);
+#endif
+    }
+
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        if (src != dest || m_fixedWidth)
+            m_assembler.movd(dest, src);
+    }
+
+    void moveZeroToDouble(FPRegisterID reg)
+    {
+        convertInt32ToDouble(MIPSRegisters::zero, reg);
+    }
+
+    void swapDouble(FPRegisterID fr1, FPRegisterID fr2)
+    {
+        moveDouble(fr1, fpTempRegister);
+        moveDouble(fr2, fr1);
+        moveDouble(fpTempRegister, fr2);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.addd(dest, dest, src);
+    }
+
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.addd(dest, op1, op2);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.addd(dest, dest, fpTempRegister);
+    }
+
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        loadDouble(TrustedImmPtr(address.m_ptr), fpTempRegister);
+        m_assembler.addd(dest, dest, fpTempRegister);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.subd(dest, dest, src);
+    }
+
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.subd(dest, op1, op2);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.subd(dest, dest, fpTempRegister);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.muld(dest, dest, src);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.muld(dest, dest, fpTempRegister);
+    }
+
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.muld(dest, op1, op2);
+    }
+
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.divd(dest, dest, src);
+    }
+
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.divd(dest, op1, op2);
+    }
+
+    void divDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        m_assembler.divd(dest, dest, fpTempRegister);
+    }
+
+    void negateDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.negd(dest, src);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.mtc1(src, fpTempRegister);
+        m_assembler.cvtdw(dest, fpTempRegister);
+    }
+
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        m_assembler.mtc1(dataTempRegister, fpTempRegister);
+        m_assembler.cvtdw(dest, fpTempRegister);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        load32(src.m_ptr, dataTempRegister);
+        m_assembler.mtc1(dataTempRegister, fpTempRegister);
+        m_assembler.cvtdw(dest, fpTempRegister);
+    }
+
+    void convertFloatToDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.cvtds(dst, src);
+    }
+
+    void convertDoubleToFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.cvtsd(dst, src);
+    }
+
+    void insertRelaxationWords()
+    {
+        /* We need four words for relaxation. */
+        m_assembler.beq(MIPSRegisters::zero, MIPSRegisters::zero, 3); // Jump over nops;
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.nop();
+    }
+
+    Jump branchTrue()
+    {
+        m_assembler.appendJump();
+        m_assembler.bc1t();
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.label());
+    }
+
+    Jump branchFalse()
+    {
+        m_assembler.appendJump();
+        m_assembler.bc1f();
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.label());
+    }
+
+    Jump branchEqual(RegisterID rs, RegisterID rt)
+    {
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.appendJump();
+        m_assembler.beq(rs, rt, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.label());
+    }
+
+    Jump branchNotEqual(RegisterID rs, RegisterID rt)
+    {
+        m_assembler.nop();
+        m_assembler.nop();
+        m_assembler.appendJump();
+        m_assembler.bne(rs, rt, 0);
+        m_assembler.nop();
+        insertRelaxationWords();
+        return Jump(m_assembler.label());
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        if (cond == DoubleEqual) {
+            m_assembler.ceqd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleNotEqual) {
+            m_assembler.cueqd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThan) {
+            m_assembler.cngtd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrEqual) {
+            m_assembler.cnged(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleLessThan) {
+            m_assembler.cltd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleLessThanOrEqual) {
+            m_assembler.cled(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleEqualOrUnordered) {
+            m_assembler.cueqd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleNotEqualOrUnordered) {
+            m_assembler.ceqd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrUnordered) {
+            m_assembler.coled(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleGreaterThanOrEqualOrUnordered) {
+            m_assembler.coltd(left, right);
+            return branchFalse(); // false
+        }
+        if (cond == DoubleLessThanOrUnordered) {
+            m_assembler.cultd(left, right);
+            return branchTrue();
+        }
+        if (cond == DoubleLessThanOrEqualOrUnordered) {
+            m_assembler.culed(left, right);
+            return branchTrue();
+        }
+        ASSERT(0);
+
+        return Jump();
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MAX 0x7fffffff).
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        m_assembler.truncwd(fpTempRegister, src);
+        m_assembler.mfc1(dest, fpTempRegister);
+        return branch32(branchType == BranchIfTruncateFailed ? Equal : NotEqual, dest, TrustedImm32(0x7fffffff));
+    }
+
+    Jump branchTruncateDoubleToUint32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        m_assembler.truncwd(fpTempRegister, src);
+        m_assembler.mfc1(dest, fpTempRegister);
+        return branch32(branchType == BranchIfTruncateFailed ? Equal : NotEqual, dest, TrustedImm32(0x7fffffff));
+    }
+
+    // Result is undefined if the value is outside of the integer range.
+    void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.truncwd(fpTempRegister, src);
+        m_assembler.mfc1(dest, fpTempRegister);
+    }
+
+    // Result is undefined if src > 2^31
+    void truncateDoubleToUint32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.truncwd(fpTempRegister, src);
+        m_assembler.mfc1(dest, fpTempRegister);
+    }
+
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp, bool negZeroCheck = true)
+    {
+        m_assembler.cvtwd(fpTempRegister, src);
+        m_assembler.mfc1(dest, fpTempRegister);
+
+        // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
+        if (negZeroCheck)
+            failureCases.append(branch32(Equal, dest, MIPSRegisters::zero));
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        convertInt32ToDouble(dest, fpTemp);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, fpTemp, src));
+    }
+
+    Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.vmov(scratch, MIPSRegisters::zero, MIPSRegisters::zero);
+        return branchDouble(DoubleNotEqual, reg, scratch);
+    }
+
+    Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.vmov(scratch, MIPSRegisters::zero, MIPSRegisters::zero);
+        return branchDouble(DoubleEqualOrUnordered, reg, scratch);
+    }
+
+    // Invert a relational condition, e.g. == becomes !=, < becomes >=, etc.
+    static RelationalCondition invert(RelationalCondition cond)
+    {
+        RelationalCondition r;
+        if (cond == Equal)
+            r = NotEqual;
+        else if (cond == NotEqual)
+            r = Equal;
+        else if (cond == Above)
+            r = BelowOrEqual;
+        else if (cond == AboveOrEqual)
+            r = Below;
+        else if (cond == Below)
+            r = AboveOrEqual;
+        else if (cond == BelowOrEqual)
+            r = Above;
+        else if (cond == GreaterThan)
+            r = LessThanOrEqual;
+        else if (cond == GreaterThanOrEqual)
+            r = LessThan;
+        else if (cond == LessThan)
+            r = GreaterThanOrEqual;
+        else if (cond == LessThanOrEqual)
+            r = GreaterThan;
+        return r;
+    }
+
+    void nop()
+    {
+        m_assembler.nop();
+    }
+
+    void memoryFence()
+    {
+        m_assembler.sync();
+    }
+
+    void abortWithReason(AbortReason reason)
+    {
+        move(TrustedImm32(reason), dataTempRegister);
+        breakpoint();
+    }
+
+    void abortWithReason(AbortReason reason, intptr_t misc)
+    {
+        move(TrustedImm32(misc), immTempRegister);
+        abortWithReason(reason);
+    }
+
+    static FunctionPtr readCallTarget(CodeLocationCall call)
+    {
+        return FunctionPtr(reinterpret_cast<void(*)()>(MIPSAssembler::readCallTarget(call.dataLocation())));
+    }
+
+    static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)
+    {
+        MIPSAssembler::replaceWithJump(instructionStart.dataLocation(), destination.dataLocation());
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        MIPSAssembler::maxJumpReplacementSize();
+        return 0;
+    }
+
+    static bool canJumpReplacePatchableBranchPtrWithPatch() { return false; }
+    static bool canJumpReplacePatchableBranch32WithPatch() { return false; }
+
+    static CodeLocationLabel startOfPatchableBranch32WithPatchOnAddress(CodeLocationDataLabel32)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+
+    static CodeLocationLabel startOfBranchPtrWithPatchOnRegister(CodeLocationDataLabelPtr label)
+    {
+        return label.labelAtOffset(0);
+    }
+
+    static void revertJumpReplacementToBranchPtrWithPatch(CodeLocationLabel instructionStart, RegisterID, void* initialValue)
+    {
+        MIPSAssembler::revertJumpToMove(instructionStart.dataLocation(), immTempRegister, reinterpret_cast<int>(initialValue) & 0xffff);
+    }
+
+    static CodeLocationLabel startOfPatchableBranchPtrWithPatchOnAddress(CodeLocationDataLabelPtr)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+
+    static void revertJumpReplacementToPatchableBranch32WithPatch(CodeLocationLabel, Address, int32_t)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void revertJumpReplacementToPatchableBranchPtrWithPatch(CodeLocationLabel, Address, void*)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        MIPSAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        MIPSAssembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+private:
+    // If m_fixedWidth is true, we will generate a fixed number of instructions.
+    // Otherwise, we can emit any number of instructions.
+    bool m_fixedWidth;
+
+    friend class LinkBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        if (call.isFlagSet(Call::Tail))
+            MIPSAssembler::linkJump(code, call.m_label, function.value());
+        else
+            MIPSAssembler::linkCall(code, call.m_label, function.value());
+    }
+
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(MIPS)
diff --git a/assembler/MacroAssemblerPrinter.cpp b/assembler/MacroAssemblerPrinter.cpp
new file mode 100644
index 0000000..c6c1757
--- /dev/null
+++ b/assembler/MacroAssemblerPrinter.cpp
@@ -0,0 +1,216 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MacroAssemblerPrinter.h"
+
+#if ENABLE(MASM_PROBE)
+
+#include "MacroAssembler.h"
+
+namespace JSC {
+
+using CPUState = MacroAssembler::CPUState;
+using ProbeContext = MacroAssembler::ProbeContext;
+using RegisterID = MacroAssembler::RegisterID;
+using FPRegisterID = MacroAssembler::FPRegisterID;
+
+static void printIndent(int indentation)
+{
+    for (; indentation > 0; indentation--)
+        dataLog("    ");
+}
+
+#define INDENT printIndent(indentation)
+    
+void printCPU(CPUState& cpu, int indentation)
+{
+    INDENT, dataLog("cpu: {\n");
+    printCPURegisters(cpu, indentation + 1);
+    INDENT, dataLog("}\n");
+}
+
+void printCPURegisters(CPUState& cpu, int indentation)
+{
+#if USE(JSVALUE32_64)
+    #define INTPTR_HEX_VALUE_FORMAT "0x%08lx"
+#else
+    #define INTPTR_HEX_VALUE_FORMAT "0x%016lx"
+#endif
+
+    #define PRINT_GPREGISTER(_type, _regName) { \
+        intptr_t value = reinterpret_cast<intptr_t>(cpu._regName); \
+        INDENT, dataLogF("%6s: " INTPTR_HEX_VALUE_FORMAT "  %ld\n", #_regName, value, value) ; \
+    }
+    FOR_EACH_CPU_GPREGISTER(PRINT_GPREGISTER)
+    FOR_EACH_CPU_SPECIAL_REGISTER(PRINT_GPREGISTER)
+    #undef PRINT_GPREGISTER
+    #undef INTPTR_HEX_VALUE_FORMAT
+    
+    #define PRINT_FPREGISTER(_type, _regName) { \
+        uint64_t* u = reinterpret_cast<uint64_t*>(&cpu._regName); \
+        double* d = reinterpret_cast<double*>(&cpu._regName); \
+        INDENT, dataLogF("%6s: 0x%016llx  %.13g\n", #_regName, *u, *d); \
+    }
+    FOR_EACH_CPU_FPREGISTER(PRINT_FPREGISTER)
+    #undef PRINT_FPREGISTER
+}
+
+static void printPC(CPUState& cpu)
+{
+    union {
+        void* voidPtr;
+        intptr_t intptrValue;
+    } u;
+#if CPU(X86) || CPU(X86_64)
+    u.voidPtr = cpu.eip;
+#elif CPU(ARM_TRADITIONAL) || CPU(ARM_THUMB2) || CPU(ARM64)
+    u.voidPtr = cpu.pc;
+#else
+#error "Unsupported CPU"
+#endif
+    dataLogF("pc:<%p %ld>", u.voidPtr, u.intptrValue);
+}
+
+void printRegister(CPUState& cpu, RegisterID regID)
+{
+    const char* name = CPUState::gprName(regID);
+    union {
+        void* voidPtr;
+        intptr_t intptrValue;
+    } u;
+    u.voidPtr = cpu.gpr(regID);
+    dataLogF("%s:<%p %ld>", name, u.voidPtr, u.intptrValue);
+}
+
+void printRegister(CPUState& cpu, FPRegisterID regID)
+{
+    const char* name = CPUState::fprName(regID);
+    union {
+        double doubleValue;
+        uint64_t uint64Value;
+    } u;
+    u.doubleValue = cpu.fpr(regID);
+    dataLogF("%s:<0x%016llx %.13g>", name, u.uint64Value, u.doubleValue);
+}
+
+void printMemory(CPUState& cpu, const Memory& memory)
+{
+    uint8_t* ptr = nullptr;
+    switch (memory.addressType) {
+    case Memory::AddressType::Address: {
+        ptr = reinterpret_cast<uint8_t*>(cpu.gpr(memory.u.address.base));
+        ptr += memory.u.address.offset;
+        break;
+    }
+    case Memory::AddressType::AbsoluteAddress: {
+        ptr = reinterpret_cast<uint8_t*>(const_cast<void*>(memory.u.absoluteAddress.m_ptr));
+        break;
+    }
+    }
+
+    if (memory.dumpStyle == Memory::SingleWordDump) {
+        if (memory.numBytes == sizeof(int8_t)) {
+            auto p = reinterpret_cast<int8_t*>(ptr);
+            dataLogF("%p:<0x%02x %d>", p, *p, *p);
+            return;
+        }
+        if (memory.numBytes == sizeof(int16_t)) {
+            auto p = reinterpret_cast<int16_t*>(ptr);
+            dataLogF("%p:<0x%04x %d>", p, *p, *p);
+            return;
+        }
+        if (memory.numBytes == sizeof(int32_t)) {
+            auto p = reinterpret_cast<int32_t*>(ptr);
+            dataLogF("%p:<0x%08x %d>", p, *p, *p);
+            return;
+        }
+        if (memory.numBytes == sizeof(int64_t)) {
+            auto p = reinterpret_cast<int64_t*>(ptr);
+            dataLogF("%p:<0x%016llx %lld>", p, *p, *p);
+            return;
+        }
+        // Else, unknown word size. Fall thru and dump in the generic way.
+    }
+
+    // Generic dump: dump rows of 16 bytes in 4 byte groupings.
+    size_t numBytes = memory.numBytes;
+    for (size_t i = 0; i < numBytes; i++) {
+        if (!(i % 16))
+            dataLogF("%p: ", &ptr[i]);
+        else if (!(i % 4))
+            dataLog(" ");
+
+        dataLogF("%02x", ptr[i]);
+
+        if (i % 16 == 15)
+            dataLog("\n");
+    }
+    if (numBytes % 16 < 15)
+        dataLog("\n");
+}
+
+void MacroAssemblerPrinter::printCallback(ProbeContext* context)
+{
+    typedef PrintArg Arg;
+    PrintArgsList& argsList =
+    *reinterpret_cast<PrintArgsList*>(context->arg1);
+    for (size_t i = 0; i < argsList.size(); i++) {
+        auto& arg = argsList[i];
+        switch (arg.type) {
+        case Arg::Type::AllRegisters:
+            printCPU(context->cpu, 1);
+            break;
+        case Arg::Type::PCRegister:
+            printPC(context->cpu);
+            break;
+        case Arg::Type::RegisterID:
+            printRegister(context->cpu, arg.u.gpRegisterID);
+            break;
+        case Arg::Type::FPRegisterID:
+            printRegister(context->cpu, arg.u.fpRegisterID);
+            break;
+        case Arg::Type::Memory:
+            printMemory(context->cpu, arg.u.memory);
+            break;
+        case Arg::Type::ConstCharPtr:
+            dataLog(arg.u.constCharPtr);
+            break;
+        case Arg::Type::ConstVoidPtr:
+            dataLogF("%p", arg.u.constVoidPtr);
+            break;
+        case Arg::Type::IntptrValue:
+            dataLog(arg.u.intptrValue);
+            break;
+        case Arg::Type::UintptrValue:
+            dataLog(arg.u.uintptrValue);
+            break;
+        }
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(MASM_PROBE)
diff --git a/assembler/MacroAssemblerPrinter.h b/assembler/MacroAssemblerPrinter.h
new file mode 100644
index 0000000..bbce7ee
--- /dev/null
+++ b/assembler/MacroAssemblerPrinter.h
@@ -0,0 +1,302 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(MASM_PROBE)
+
+#include "MacroAssembler.h"
+
+namespace JSC {
+
+// What is MacroAssembler::print()?
+// ===============================
+// The MacroAsssembler::print() makes it easy to add print logging
+// from JIT compiled code, and can be used to print all types of values
+// at runtime e.g. CPU register values being operated on by the compiled
+// code.
+//
+// print() is built on top of MacroAsssembler::probe(), and hence
+// inserting logging in JIT compiled code will not perturb register values.
+// The only register value that is perturbed is the PC (program counter)
+// since there is now more compiled code to do the printing.
+//
+// How to use the MacroAssembler print()?
+// =====================================
+// 1. #include "MacroAssemblerPrinter.h" in the JIT file where you want to use print().
+//
+// 2. Add print() calls like these in your JIT code:
+//
+//      jit.print("Hello world\n"); // Emits code to print the string.
+//
+//      CodeBlock* cb = ...;
+//      jit.print(cb, "\n");        // Emits code to print the pointer value.
+//
+//      RegisterID regID = ...;
+//      jit.print(regID, "\n");     // Emits code to print the register value (not the id).
+//
+//      // Emits code to print all registers. Unlike other items, this prints
+//      // multiple lines as follows:
+//      //      cpu {
+//      //          eax: 0x123456789
+//      //          ebx: 0x000000abc
+//      //          ...
+//      //      }
+//      jit.print(AllRegisters());
+//
+//      jit.print(MemWord<uint8_t>(regID), "\n");   // Emits code to print a byte pointed to by the register.
+//      jit.print(MemWord<uint32_t>(regID), "\n");  // Emits code to print a 32-bit word pointed to by the register.
+//
+//      jit.print(MemWord<uint8_t>(Address(regID, 23), "\n");     // Emits code to print a byte at the address.
+//      jit.print(MemWord<intptr_t>(AbsoluteAddress(&cb), "\n");  // Emits code to print an intptr_t sized word at the address.
+//
+//      jit.print(Memory(reg, 100), "\n");              // Emits code to print a 100 bytes at the address pointed by the register.
+//      jit.print(Memory(Address(reg, 4), 100), "\n");  // Emits code to print a 100 bytes at the address.
+//
+//      // Print multiple things at once. This incurs the probe overhead only once
+//      // to print all the items.
+//      jit.print("cb:", cb, " regID:", regID, " cpu:\n", AllRegisters());
+//
+//   The type of values that can be printed is encapsulated in the PrintArg struct below.
+//
+//   Note: print() does not automatically insert a '\n' at the end of the line.
+//   If you want a '\n', you'll have to add it explicitly (as in the examples above).
+
+
+// This is a marker type only used with MacroAssemblerPrinter::print().
+// See MacroAssemblerPrinter::print() below for details.
+struct AllRegisters { };
+struct PCRegister { };
+
+struct Memory {
+    using Address = MacroAssembler::Address;
+    using AbsoluteAddress = MacroAssembler::AbsoluteAddress;
+    using RegisterID = MacroAssembler::RegisterID;
+
+    enum class AddressType {
+        Address,
+        AbsoluteAddress,
+    };
+
+    enum DumpStyle {
+        SingleWordDump,
+        GenericDump,
+    };
+
+    Memory(RegisterID& reg, size_t bytes, DumpStyle style = GenericDump)
+        : addressType(AddressType::Address)
+        , dumpStyle(style)
+        , numBytes(bytes)
+    {
+        u.address = Address(reg, 0);
+    }
+
+    Memory(const Address& address, size_t bytes, DumpStyle style = GenericDump)
+        : addressType(AddressType::Address)
+        , dumpStyle(style)
+        , numBytes(bytes)
+    {
+        u.address = address;
+    }
+
+    Memory(const AbsoluteAddress& address, size_t bytes, DumpStyle style = GenericDump)
+        : addressType(AddressType::AbsoluteAddress)
+        , dumpStyle(style)
+        , numBytes(bytes)
+    {
+        u.absoluteAddress = address;
+    }
+
+    AddressType addressType;
+    DumpStyle dumpStyle;
+    size_t numBytes;
+    union UnionedAddress {
+        UnionedAddress() { }
+
+        Address address;
+        AbsoluteAddress absoluteAddress;
+    } u;
+};
+
+template <typename IntType>
+struct MemWord : public Memory {
+    MemWord(RegisterID& reg)
+        : Memory(reg, sizeof(IntType), Memory::SingleWordDump)
+    { }
+
+    MemWord(const Address& address)
+        : Memory(address, sizeof(IntType), Memory::SingleWordDump)
+    { }
+
+    MemWord(const AbsoluteAddress& address)
+        : Memory(address, sizeof(IntType), Memory::SingleWordDump)
+    { }
+};
+
+
+class MacroAssemblerPrinter {
+    using CPUState = MacroAssembler::CPUState;
+    using ProbeContext = MacroAssembler::ProbeContext;
+    using RegisterID = MacroAssembler::RegisterID;
+    using FPRegisterID = MacroAssembler::FPRegisterID;
+    
+public:
+    template<typename... Arguments>
+    static void print(MacroAssembler* masm, Arguments... args)
+    {
+        auto argsList = std::make_unique<PrintArgsList>();
+        appendPrintArg(argsList.get(), args...);
+        masm->probe(printCallback, argsList.release(), 0);
+    }
+    
+private:
+    struct PrintArg {
+
+        enum class Type {
+            AllRegisters,
+            PCRegister,
+            RegisterID,
+            FPRegisterID,
+            Memory,
+            ConstCharPtr,
+            ConstVoidPtr,
+            IntptrValue,
+            UintptrValue,
+        };
+        
+        PrintArg(AllRegisters&)
+            : type(Type::AllRegisters)
+        {
+        }
+        
+        PrintArg(PCRegister&)
+            : type(Type::PCRegister)
+        {
+        }
+        
+        PrintArg(RegisterID regID)
+            : type(Type::RegisterID)
+        {
+            u.gpRegisterID = regID;
+        }
+        
+        PrintArg(FPRegisterID regID)
+            : type(Type::FPRegisterID)
+        {
+            u.fpRegisterID = regID;
+        }
+
+        PrintArg(const Memory& memory)
+            : type(Type::Memory)
+        {
+            u.memory = memory;
+        }
+
+        PrintArg(const char* ptr)
+            : type(Type::ConstCharPtr)
+        {
+            u.constCharPtr = ptr;
+        }
+        
+        PrintArg(const void* ptr)
+            : type(Type::ConstVoidPtr)
+        {
+            u.constVoidPtr = ptr;
+        }
+        
+        PrintArg(int value)
+            : type(Type::IntptrValue)
+        {
+            u.intptrValue = value;
+        }
+        
+        PrintArg(unsigned value)
+            : type(Type::UintptrValue)
+        {
+            u.intptrValue = value;
+        }
+        
+        PrintArg(intptr_t value)
+            : type(Type::IntptrValue)
+        {
+            u.intptrValue = value;
+        }
+        
+        PrintArg(uintptr_t value)
+            : type(Type::UintptrValue)
+        {
+            u.uintptrValue = value;
+        }
+        
+        Type type;
+        union Value {
+            Value() { }
+
+            RegisterID gpRegisterID;
+            FPRegisterID fpRegisterID;
+            Memory memory;
+            const char* constCharPtr;
+            const void* constVoidPtr;
+            intptr_t intptrValue;
+            uintptr_t uintptrValue;
+        } u;
+    };
+
+    typedef Vector<PrintArg> PrintArgsList;
+    
+    template<typename FirstArg, typename... Arguments>
+    static void appendPrintArg(PrintArgsList* argsList, FirstArg& firstArg, Arguments... otherArgs)
+    {
+        argsList->append(PrintArg(firstArg));
+        appendPrintArg(argsList, otherArgs...);
+    }
+    
+    static void appendPrintArg(PrintArgsList*) { }
+
+private:
+    static void printCallback(ProbeContext*);
+};
+
+template<typename... Arguments>
+void MacroAssembler::print(Arguments... args)
+{
+    MacroAssemblerPrinter::print(this, args...);
+}
+
+
+// These printers will print a block of information. That block may be
+// indented with the specified indentation.
+void printCPU(MacroAssembler::CPUState&, int indentation = 0);
+void printCPURegisters(MacroAssembler::CPUState&, int indentation = 0);
+
+// These printers will print the specified information in line in the
+// print stream. Hence, no indentation will be applied.
+void printRegister(MacroAssembler::CPUState&, MacroAssembler::RegisterID);
+void printRegister(MacroAssembler::CPUState&, MacroAssembler::FPRegisterID);
+void printMemory(MacroAssembler::CPUState&, const Memory&);
+
+} // namespace JSC
+
+#endif // ENABLE(MASM_PROBE)
diff --git a/assembler/MacroAssemblerSH4.h b/assembler/MacroAssemblerSH4.h
new file mode 100644
index 0000000..c492a40
--- /dev/null
+++ b/assembler/MacroAssemblerSH4.h
@@ -0,0 +1,2671 @@
+/*
+ * Copyright (C) 2013 Cisco Systems, Inc. All rights reserved.
+ * Copyright (C) 2009-2011 STMicroelectronics. All rights reserved.
+ * Copyright (C) 2008, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(SH4)
+
+#include "SH4Assembler.h"
+#include "AbstractMacroAssembler.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+class MacroAssemblerSH4 : public AbstractMacroAssembler<SH4Assembler, MacroAssemblerSH4> {
+public:
+    typedef SH4Assembler::FPRegisterID FPRegisterID;
+
+    static const Scale ScalePtr = TimesFour;
+    static const FPRegisterID fscratch = SH4Registers::dr10;
+    static const RegisterID stackPointerRegister = SH4Registers::sp;
+    static const RegisterID framePointerRegister = SH4Registers::fp;
+    static const RegisterID linkRegister = SH4Registers::pr;
+    static const RegisterID scratchReg3 = SH4Registers::r13;
+
+    static const int MaximumCompactPtrAlignedAddressOffset = 60;
+
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return (value >= 0) && (value <= MaximumCompactPtrAlignedAddressOffset) && (!(value & 3));
+    }
+
+    enum RelationalCondition {
+        Equal = SH4Assembler::EQ,
+        NotEqual = SH4Assembler::NE,
+        Above = SH4Assembler::HI,
+        AboveOrEqual = SH4Assembler::HS,
+        Below = SH4Assembler::LI,
+        BelowOrEqual = SH4Assembler::LS,
+        GreaterThan = SH4Assembler::GT,
+        GreaterThanOrEqual = SH4Assembler::GE,
+        LessThan = SH4Assembler::LT,
+        LessThanOrEqual = SH4Assembler::LE
+    };
+
+    enum ResultCondition {
+        Overflow = SH4Assembler::OF,
+        Signed = SH4Assembler::SI,
+        PositiveOrZero = SH4Assembler::NS,
+        Zero = SH4Assembler::EQ,
+        NonZero = SH4Assembler::NE
+    };
+
+    enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = SH4Assembler::EQ,
+        DoubleNotEqual = SH4Assembler::NE,
+        DoubleGreaterThan = SH4Assembler::GT,
+        DoubleGreaterThanOrEqual = SH4Assembler::GE,
+        DoubleLessThan = SH4Assembler::LT,
+        DoubleLessThanOrEqual = SH4Assembler::LE,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = SH4Assembler::EQU,
+        DoubleNotEqualOrUnordered = SH4Assembler::NEU,
+        DoubleGreaterThanOrUnordered = SH4Assembler::GTU,
+        DoubleGreaterThanOrEqualOrUnordered = SH4Assembler::GEU,
+        DoubleLessThanOrUnordered = SH4Assembler::LTU,
+        DoubleLessThanOrEqualOrUnordered = SH4Assembler::LEU,
+    };
+
+    RegisterID claimScratch()
+    {
+        return m_assembler.claimScratch();
+    }
+
+    void releaseScratch(RegisterID reg)
+    {
+        m_assembler.releaseScratch(reg);
+    }
+
+    static RelationalCondition invert(RelationalCondition cond)
+    {
+        switch (cond) {
+        case Equal:
+            return NotEqual;
+        case NotEqual:
+            return Equal;
+        case Above:
+            return BelowOrEqual;
+        case AboveOrEqual:
+            return Below;
+        case Below:
+            return AboveOrEqual;
+        case BelowOrEqual:
+            return Above;
+        case GreaterThan:
+            return LessThanOrEqual;
+        case GreaterThanOrEqual:
+            return LessThan;
+        case LessThan:
+            return GreaterThanOrEqual;
+        case LessThanOrEqual:
+            return GreaterThan;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    // Integer arithmetic operations
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addlRegReg(src, dest);
+    }
+
+    void add32(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            add32(src2, dest);
+        else {
+            move(src2, dest);
+            add32(src1, dest);
+        }
+    }
+
+    void add32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            return;
+
+        if (m_assembler.isImmediate(imm.m_value)) {
+            m_assembler.addlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.addlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        add32(imm, dest);
+    }
+
+    void add32(TrustedImm32 imm, Address address)
+    {
+        if (!imm.m_value)
+            return;
+
+        RegisterID scr = claimScratch();
+        load32(address, scr);
+        add32(imm, scr);
+        store32(scr, address);
+        releaseScratch(scr);
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        m_assembler.addlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void add32(AbsoluteAddress src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src.m_ptr, scr);
+        m_assembler.addlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andlRegReg(src, dest);
+    }
+
+    void and32(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            and32(src2, dest);
+        else {
+            move(src2, dest);
+            and32(src1, dest);
+        }
+    }
+
+    void and32(Address src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        and32(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value) {
+            m_assembler.movImm8(0, dest);
+            return;
+        }
+
+        if ((imm.m_value <= 255) && (imm.m_value >= 0) && (dest == SH4Registers::r0)) {
+            m_assembler.andlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.andlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (src != dest) {
+            move(imm, dest);
+            and32(src, dest);
+            return;
+        }
+
+        and32(imm, dest);
+    }
+
+    void lshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        RegisterID shiftTmp = claimScratch();
+        m_assembler.loadConstant(0x1f, shiftTmp);
+        m_assembler.andlRegReg(shiftamount, shiftTmp);
+        m_assembler.shldRegReg(dest, shiftTmp);
+        releaseScratch(shiftTmp);
+    }
+
+    void lshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        move(src, dest);
+        lshift32(shiftAmount, dest);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        int immMasked = imm.m_value & 0x1f;
+        if (!immMasked)
+            return;
+
+        if ((immMasked == 1) || (immMasked == 2) || (immMasked == 8) || (immMasked == 16)) {
+            m_assembler.shllImm8r(immMasked, dest);
+            return;
+        }
+
+        RegisterID shiftTmp = claimScratch();
+        m_assembler.loadConstant(immMasked, shiftTmp);
+        m_assembler.shldRegReg(dest, shiftTmp);
+        releaseScratch(shiftTmp);
+    }
+
+    void lshift32(RegisterID src, TrustedImm32 shiftamount, RegisterID dest)
+    {
+        move(src, dest);
+        lshift32(shiftamount, dest);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        mul32(src, dest, dest);    
+    }
+
+    void mul32(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        m_assembler.imullRegReg(src1, src2);
+        m_assembler.stsmacl(dest);
+    }
+
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (src == dest) {
+            RegisterID immval = claimScratch();
+            move(imm, immval);
+            mul32(immval, dest);
+            releaseScratch(immval);
+        } else {
+            move(imm, dest);
+            mul32(src, dest);
+        }
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orlRegReg(src, dest);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID dest)
+    {
+        if ((imm.m_value <= 255) && (imm.m_value >= 0) && (dest == SH4Registers::r0)) {
+            m_assembler.orlImm8r(imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.orlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void or32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            move(op1, dest);
+        else if (op1 == dest)
+            or32(op2, dest);
+        else {
+            move(op2, dest);
+            or32(op1, dest);
+        }
+    }
+
+    void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (src != dest) {
+            move(imm, dest);
+            or32(src, dest);
+            return;
+        }
+
+        or32(imm, dest);
+    }
+
+    void or32(RegisterID src, AbsoluteAddress address)
+    {
+        RegisterID destptr = claimScratch();
+        move(TrustedImmPtr(address.m_ptr), destptr);
+        RegisterID destval = claimScratch();
+        m_assembler.movlMemReg(destptr, destval);
+        m_assembler.orlRegReg(src, destval);
+        m_assembler.movlRegMem(destval, destptr);
+        releaseScratch(destval);
+        releaseScratch(destptr);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (src != dest) {
+            move(imm, dest);
+            xor32(src, dest);
+            return;
+        }
+
+        xor32(imm, dest);
+    }
+
+    void rshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        RegisterID shiftTmp = claimScratch();
+        m_assembler.loadConstant(0x1f, shiftTmp);
+        m_assembler.andlRegReg(shiftamount, shiftTmp);
+        m_assembler.neg(shiftTmp, shiftTmp);
+        m_assembler.shadRegReg(dest, shiftTmp);
+        releaseScratch(shiftTmp);
+    }
+
+    void rshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        move(src, dest);
+        rshift32(shiftAmount, dest);
+    }
+
+    void rshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        int immMasked = imm.m_value & 0x1f;
+        if (!immMasked)
+            return;
+
+        if (immMasked == 1) {
+            m_assembler.sharImm8r(immMasked, dest);
+            return;
+        }
+
+        RegisterID shiftTmp = claimScratch();
+        m_assembler.loadConstant(-immMasked, shiftTmp);
+        m_assembler.shadRegReg(dest, shiftTmp);
+        releaseScratch(shiftTmp);
+    }
+
+    void rshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move(src, dest);
+        rshift32(imm, dest);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sublRegReg(src, dest);
+    }
+
+    void sub32(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        if (dest == right) {
+            neg32(dest);
+            add32(left, dest);
+            return;
+        }
+        move(left, dest);
+        sub32(right, dest);
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        if (!imm.m_value)
+            return;
+
+        RegisterID result = claimScratch();
+        RegisterID scratchReg = claimScratch();
+
+        move(TrustedImmPtr(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(-imm.m_value))
+            m_assembler.addlImm8r(-imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.sublRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+        releaseScratch(scratchReg);
+    }
+
+    void sub32(TrustedImm32 imm, Address address)
+    {
+        add32(TrustedImm32(-imm.m_value), address);
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        if (!imm.m_value)
+            return;
+
+        RegisterID result = claimScratch();
+        RegisterID scratchReg = claimScratch();
+
+        move(TrustedImmPtr(address.m_ptr), scratchReg);
+        m_assembler.movlMemReg(scratchReg, result);
+
+        if (m_assembler.isImmediate(imm.m_value))
+            m_assembler.addlImm8r(imm.m_value, result);
+        else {
+            m_assembler.loadConstant(imm.m_value, scratchReg3);
+            m_assembler.addlRegReg(scratchReg3, result);
+        }
+
+        store32(result, scratchReg);
+        releaseScratch(result);
+        releaseScratch(scratchReg);
+    }
+
+    void add64(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        RegisterID scr1 = claimScratch();
+        RegisterID scr2 = claimScratch();
+
+        // Add 32-bit LSB first.
+        move(TrustedImmPtr(address.m_ptr), scratchReg3);
+        m_assembler.movlMemReg(scratchReg3, scr1); // scr1 = 32-bit LSB of int64 @ address
+        m_assembler.loadConstant(imm.m_value, scr2);
+        m_assembler.clrt();
+        m_assembler.addclRegReg(scr1, scr2);
+        m_assembler.movlRegMem(scr2, scratchReg3); // Update address with 32-bit LSB result.
+
+        // Then add 32-bit MSB.
+        m_assembler.addlImm8r(4, scratchReg3);
+        m_assembler.movlMemReg(scratchReg3, scr1); // scr1 = 32-bit MSB of int64 @ address
+        m_assembler.movt(scr2);
+        if (imm.m_value < 0)
+            m_assembler.addlImm8r(-1, scr2); // Sign extend imm value if needed.
+        m_assembler.addvlRegReg(scr2, scr1);
+        m_assembler.movlRegMem(scr1, scratchReg3); // Update (address + 4) with 32-bit MSB result.
+
+        releaseScratch(scr2);
+        releaseScratch(scr1);
+    }
+
+    void sub32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            return;
+
+        if (m_assembler.isImmediate(-imm.m_value)) {
+            m_assembler.addlImm8r(-imm.m_value, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        m_assembler.sublRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        m_assembler.sublRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorlRegReg(src, dest);
+    }
+
+    void xor32(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            xor32(src2, dest);
+        else {
+            move(src2, dest);
+            xor32(src1, dest);
+        }
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID srcDest)
+    {
+        if (imm.m_value == -1) {
+            m_assembler.notlReg(srcDest, srcDest);
+            return;
+        }
+
+        if ((srcDest != SH4Registers::r0) || (imm.m_value > 255) || (imm.m_value < 0)) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(imm.m_value, scr);
+            m_assembler.xorlRegReg(scr, srcDest);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.xorlImm8r(imm.m_value, srcDest);
+    }
+
+    void compare32(int imm, RegisterID dst, RelationalCondition cond)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && (dst == SH4Registers::r0) && m_assembler.isImmediate(imm)) {
+            m_assembler.cmpEqImmR0(imm, dst);
+            return;
+        }
+
+        if (((cond == Equal) || (cond == NotEqual)) && !imm) {
+            m_assembler.testlRegReg(dst, dst);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm, scr);
+        m_assembler.cmplRegReg(scr, dst, SH4Condition(cond));
+        releaseScratch(scr);
+    }
+
+    void compare32(int offset, RegisterID base, RegisterID left, RelationalCondition cond)
+    {
+        RegisterID scr = claimScratch();
+        if (!offset) {
+            m_assembler.movlMemReg(base, scr);
+            m_assembler.cmplRegReg(scr, left, SH4Condition(cond));
+            releaseScratch(scr);
+            return;
+        }
+
+        if ((offset < 0) || (offset >= 64)) {
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+            m_assembler.cmplRegReg(scr, left, SH4Condition(cond));
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.movlMemReg(offset >> 2, base, scr);
+        m_assembler.cmplRegReg(scr, left, SH4Condition(cond));
+        releaseScratch(scr);
+    }
+
+    void testImm(int imm, int offset, RegisterID base)
+    {
+        RegisterID scr = claimScratch();
+        load32(base, offset, scr);
+
+        RegisterID scr1 = claimScratch();
+        move(TrustedImm32(imm), scr1);
+
+        m_assembler.testlRegReg(scr, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void testlImm(int imm, RegisterID dst)
+    {
+        if ((dst == SH4Registers::r0) && (imm <= 255) && (imm >= 0)) {
+            m_assembler.testlImm8r(imm, dst);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm, scr);
+        m_assembler.testlRegReg(scr, dst);
+        releaseScratch(scr);
+    }
+
+    void compare32(RegisterID right, int offset, RegisterID base, RelationalCondition cond)
+    {
+        if (!offset) {
+            RegisterID scr = claimScratch();
+            m_assembler.movlMemReg(base, scr);
+            m_assembler.cmplRegReg(right, scr, SH4Condition(cond));
+            releaseScratch(scr);
+            return;
+        }
+
+        if ((offset < 0) || (offset >= 64)) {
+            RegisterID scr = claimScratch();
+            m_assembler.loadConstant(offset, scr);
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, scr);
+            m_assembler.cmplRegReg(right, scr, SH4Condition(cond));
+            releaseScratch(scr);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.movlMemReg(offset >> 2, base, scr);
+        m_assembler.cmplRegReg(right, scr, SH4Condition(cond));
+        releaseScratch(scr);
+    }
+
+    void compare32(int imm, int offset, RegisterID base, RelationalCondition cond)
+    {
+        RegisterID scr = claimScratch();
+        load32(base, offset, scr);
+
+        RegisterID scr1 = claimScratch();
+        move(TrustedImm32(imm), scr1);
+
+        m_assembler.cmplRegReg(scr1, scr, SH4Condition(cond));
+
+        releaseScratch(scr1);
+        releaseScratch(scr);
+    }
+
+    // Memory access operation
+
+    ALWAYS_INLINE void loadEffectiveAddress(BaseIndex address, RegisterID dest, int extraoffset = 0)
+    {
+        if (dest == address.base) {
+            RegisterID scaledIndex = claimScratch();
+            move(address.index, scaledIndex);
+            lshift32(TrustedImm32(address.scale), scaledIndex);
+            add32(scaledIndex, dest);
+            releaseScratch(scaledIndex);
+        } else {
+            move(address.index, dest);
+            lshift32(TrustedImm32(address.scale), dest);
+            add32(address.base, dest);
+        }
+
+        add32(TrustedImm32(address.offset + extraoffset), dest);
+    }
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        load32(address.base, address.offset, dest);
+    }
+
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        load8(address.base, address.offset, dest);
+    }
+
+    void load8(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        load8(scr, address.offset, dest);
+        releaseScratch(scr);
+    }
+
+    void load8(AbsoluteAddress address, RegisterID dest)
+    {
+        move(TrustedImmPtr(address.m_ptr), dest);
+        m_assembler.movbMemReg(dest, dest);
+        m_assembler.extub(dest, dest);
+    }
+
+    void load8(const void* address, RegisterID dest)
+    {
+        load8(AbsoluteAddress(address), dest);
+    }
+
+    void load8PostInc(RegisterID base, RegisterID dest)
+    {
+        m_assembler.movbMemRegIn(base, dest);
+        m_assembler.extub(dest, dest);
+    }
+
+    void load8SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        load8SignedExtendTo32(scr, address.offset, dest);
+        releaseScratch(scr);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        load32(scr, address.offset, dest);
+        releaseScratch(scr);
+    }
+
+    void load32(const void* address, RegisterID dest)
+    {
+        move(TrustedImmPtr(address), dest);
+        m_assembler.movlMemReg(dest, dest);
+    }
+
+    void load32(RegisterID base, int offset, RegisterID dest)
+    {
+        if (!offset) {
+            m_assembler.movlMemReg(base, dest);
+            return;
+        }
+
+        if ((offset >= 0) && (offset < 64)) {
+            m_assembler.movlMemReg(offset >> 2, base, dest);
+            return;
+        }
+
+        RegisterID scr = (dest == base) ? claimScratch() : dest;
+
+        m_assembler.loadConstant(offset, scr);
+        if (base == SH4Registers::r0)
+            m_assembler.movlR0mr(scr, dest);
+        else {
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movlMemReg(scr, dest);
+        }
+
+        if (dest == base)
+            releaseScratch(scr);
+    }
+
+    void load8SignedExtendTo32(RegisterID base, int offset, RegisterID dest)
+    {
+        if (!offset) {
+            m_assembler.movbMemReg(base, dest);
+            return;
+        }
+
+        if ((offset > 0) && (offset <= 15) && (dest == SH4Registers::r0)) {
+            m_assembler.movbMemReg(offset, base, dest);
+            return;
+        }
+
+        RegisterID scr = (dest == base) ? claimScratch() : dest;
+
+        m_assembler.loadConstant(offset, scr);
+        if (base == SH4Registers::r0)
+            m_assembler.movbR0mr(scr, dest);
+        else {
+            m_assembler.addlRegReg(base, scr);
+            m_assembler.movbMemReg(scr, dest);
+        }
+
+        if (dest == base)
+            releaseScratch(scr);
+    }
+
+    void load8(RegisterID base, int offset, RegisterID dest)
+    {
+        load8SignedExtendTo32(base, offset, dest);
+        m_assembler.extub(dest, dest);
+    }
+
+    void load32(RegisterID src, RegisterID dst)
+    {
+        m_assembler.movlMemReg(src, dst);
+    }
+
+    void load16(ImplicitAddress address, RegisterID dest)
+    {
+        if (!address.offset) {
+            m_assembler.movwMemReg(address.base, dest);
+            m_assembler.extuw(dest, dest);
+            return;
+        }
+
+        if ((address.offset > 0) && (address.offset <= 30) && (dest == SH4Registers::r0)) {
+            m_assembler.movwMemReg(address.offset >> 1, address.base, dest);
+            m_assembler.extuw(dest, dest);
+            return;
+        }
+
+        RegisterID scr = (dest == address.base) ? claimScratch() : dest;
+
+        m_assembler.loadConstant(address.offset, scr);
+        if (address.base == SH4Registers::r0)
+            m_assembler.movwR0mr(scr, dest);
+        else {
+            m_assembler.addlRegReg(address.base, scr);
+            m_assembler.movwMemReg(scr, dest);
+        }
+        m_assembler.extuw(dest, dest);
+
+        if (dest == address.base)
+            releaseScratch(scr);
+    }
+
+    void load16Unaligned(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        loadEffectiveAddress(address, scr);
+
+        RegisterID scr1 = claimScratch();
+        load8PostInc(scr, scr1);
+        load8(scr, dest);
+        m_assembler.shllImm8r(8, dest);
+        or32(scr1, dest);
+
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void load16(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movwMemReg(src, dest);
+        m_assembler.extuw(dest, dest);
+    }
+
+    void load16SignedExtendTo32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movwMemReg(src, dest);
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        load16SignedExtendTo32(address, dest);
+        m_assembler.extuw(dest, dest);
+    }
+
+    void load16PostInc(RegisterID base, RegisterID dest)
+    {
+        m_assembler.movwMemRegIn(base, dest);
+        m_assembler.extuw(dest, dest);
+    }
+
+    void load16SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(TrustedImm32(address.offset), scr);
+
+        if (address.base == SH4Registers::r0)
+            m_assembler.movwR0mr(scr, dest);
+        else {
+            add32(address.base, scr);
+            load16SignedExtendTo32(scr, dest);
+        }
+
+        releaseScratch(scr);
+    }
+
+    void store8(RegisterID src, BaseIndex address)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(TrustedImm32(address.offset), scr);
+
+        if (address.base == SH4Registers::r0)
+            m_assembler.movbRegMemr0(src, scr);
+        else {
+            add32(address.base, scr);
+            m_assembler.movbRegMem(src, scr);
+        }
+
+        releaseScratch(scr);
+    }
+
+    void store8(RegisterID src, void* address)
+    {
+        RegisterID destptr = claimScratch();
+        move(TrustedImmPtr(address), destptr);
+        m_assembler.movbRegMem(src, destptr);
+        releaseScratch(destptr);
+    }
+
+    void store8(TrustedImm32 imm, void* address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        RegisterID dstptr = claimScratch();
+        move(TrustedImmPtr(address), dstptr);
+        RegisterID srcval = claimScratch();
+        move(imm8, srcval);
+        m_assembler.movbRegMem(srcval, dstptr);
+        releaseScratch(dstptr);
+        releaseScratch(srcval);
+    }
+
+    void store8(TrustedImm32 imm, Address address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        RegisterID dstptr = claimScratch();
+        move(address.base, dstptr);
+        add32(TrustedImm32(address.offset), dstptr);
+        RegisterID srcval = claimScratch();
+        move(imm8, srcval);
+        m_assembler.movbRegMem(srcval, dstptr);
+        releaseScratch(dstptr);
+        releaseScratch(srcval);
+    }
+
+    void store16(RegisterID src, BaseIndex address)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(TrustedImm32(address.offset), scr);
+
+        if (address.base == SH4Registers::r0)
+            m_assembler.movwRegMemr0(src, scr);
+        else {
+            add32(address.base, scr);
+            m_assembler.movwRegMem(src, scr);
+        }
+
+        releaseScratch(scr);
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        if (!address.offset) {
+            m_assembler.movlRegMem(src, address.base);
+            return;
+        }
+
+        if ((address.offset >= 0) && (address.offset < 64)) {
+            m_assembler.movlRegMem(src, address.offset >> 2, address.base);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(address.offset, scr);
+        if (address.base == SH4Registers::r0)
+            m_assembler.movlRegMemr0(src, scr);
+        else {
+            m_assembler.addlRegReg(address.base, scr);
+            m_assembler.movlRegMem(src, scr);
+        }
+        releaseScratch(scr);
+    }
+
+    void store32(RegisterID src, RegisterID dst)
+    {
+        m_assembler.movlRegMem(src, dst);
+    }
+
+    void store32(TrustedImm32 imm, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        store32(scr, address);
+        releaseScratch(scr);
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        store32(src, Address(scr, address.offset));
+
+        releaseScratch(scr);
+    }
+
+    void store32(TrustedImm32 imm, void* address)
+    {
+        RegisterID scr = claimScratch();
+        RegisterID scr1 = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        move(TrustedImmPtr(address), scr1);
+        m_assembler.movlRegMem(scr, scr1);
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        RegisterID scr = claimScratch();
+        move(TrustedImmPtr(address), scr);
+        m_assembler.movlRegMem(src, scr);
+        releaseScratch(scr);
+    }
+
+    void store32(TrustedImm32 imm, BaseIndex address)
+    {
+        RegisterID destptr = claimScratch();
+
+        loadEffectiveAddress(address, destptr);
+
+        RegisterID srcval = claimScratch();
+        move(imm, srcval);
+        m_assembler.movlRegMem(srcval, destptr);
+        releaseScratch(srcval);
+        releaseScratch(destptr);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        DataLabel32 label(this);
+        m_assembler.loadConstantUnReusable(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movlMemReg(scr, dest);
+        releaseScratch(scr);
+        return label;
+    }
+    
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        RegisterID scr = claimScratch();
+        DataLabel32 label(this);
+        m_assembler.loadConstantUnReusable(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movlRegMem(src, scr);
+        releaseScratch(scr);
+        return label;
+    }
+
+    DataLabelCompact load32WithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabelCompact dataLabel(this);
+        ASSERT(isCompactPtrAlignedAddressOffset(address.offset));
+        m_assembler.movlMemRegCompact(address.offset >> 2, address.base, dest);
+        return dataLabel;
+    }
+
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result(this);
+
+        RegisterID scr = claimScratch();
+        m_assembler.movImm8(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movlMemReg(scr, dest);
+        releaseScratch(scr);
+
+        return result;
+    }
+
+    // Floating-point operations
+
+    static bool supportsFloatingPoint() { return true; }
+    static bool supportsFloatingPointTruncate() { return true; }
+    static bool supportsFloatingPointSqrt() { return true; }
+    static bool supportsFloatingPointAbs() { return true; }
+    static bool supportsFloatingPointRounding() { return false; }
+
+    void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2)
+    {
+        m_assembler.fldsfpul((FPRegisterID)(src + 1));
+        m_assembler.stsfpulReg(dest1);
+        m_assembler.fldsfpul(src);
+        m_assembler.stsfpulReg(dest2);
+    }
+
+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID)
+    {
+        m_assembler.ldsrmfpul(src1);
+        m_assembler.fstsfpul((FPRegisterID)(dest + 1));
+        m_assembler.ldsrmfpul(src2);
+        m_assembler.fstsfpul(dest);
+    }
+
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        if (src != dest) {
+            m_assembler.fmovsRegReg((FPRegisterID)(src + 1), (FPRegisterID)(dest + 1));
+            m_assembler.fmovsRegReg(src, dest);
+        }
+    }
+
+    void swapDouble(FPRegisterID fr1, FPRegisterID fr2)
+    {
+        if (fr1 != fr2) {
+            m_assembler.fldsfpul((FPRegisterID)(fr1 + 1));
+            m_assembler.fmovsRegReg((FPRegisterID)(fr2 + 1), (FPRegisterID)(fr1 + 1));
+            m_assembler.fstsfpul((FPRegisterID)(fr2 + 1));
+            m_assembler.fldsfpul(fr1);
+            m_assembler.fmovsRegReg(fr2, fr1);
+            m_assembler.fstsfpul(fr2);
+        }
+    }
+
+    void loadFloat(BaseIndex address, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        loadEffectiveAddress(address, scr);
+
+        m_assembler.fmovsReadrm(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void loadDouble(BaseIndex address, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        loadEffectiveAddress(address, scr);
+
+        m_assembler.fmovsReadrminc(scr, (FPRegisterID)(dest + 1));
+        m_assembler.fmovsReadrm(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstant(address.offset, scr);
+        if (address.base == SH4Registers::r0) {
+            m_assembler.fmovsReadr0r(scr, (FPRegisterID)(dest + 1));
+            m_assembler.addlImm8r(4, scr);
+            m_assembler.fmovsReadr0r(scr, dest);
+            releaseScratch(scr);
+            return;
+        }
+
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.fmovsReadrminc(scr, (FPRegisterID)(dest + 1));
+        m_assembler.fmovsReadrm(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        move(address, scr);
+        m_assembler.fmovsReadrminc(scr, (FPRegisterID)(dest + 1));
+        m_assembler.fmovsReadrm(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void storeFloat(FPRegisterID src, BaseIndex address)
+    {
+        RegisterID scr = claimScratch();
+        loadEffectiveAddress(address, scr);
+        m_assembler.fmovsWriterm(src, scr);
+        releaseScratch(scr);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(address.offset + 8, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.fmovsWriterndec(src, scr);
+        m_assembler.fmovsWriterndec((FPRegisterID)(src + 1), scr);
+        releaseScratch(scr);
+    }
+
+    void storeDouble(FPRegisterID src, BaseIndex address)
+    {
+        RegisterID scr = claimScratch();
+
+        loadEffectiveAddress(address, scr, 8);
+
+        m_assembler.fmovsWriterndec(src, scr);
+        m_assembler.fmovsWriterndec((FPRegisterID)(src + 1), scr);
+
+        releaseScratch(scr);
+    }
+
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (op1 == dest)
+            addDouble(op2, dest);
+        else {
+            moveDouble(op2, dest);
+            addDouble(op1, dest);
+        }
+    }
+
+    void storeDouble(FPRegisterID src, TrustedImmPtr address)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(reinterpret_cast<uint32_t>(const_cast<void*>(address.m_value)) + 8, scr);
+        m_assembler.fmovsWriterndec(src, scr);
+        m_assembler.fmovsWriterndec((FPRegisterID)(src + 1), scr);
+        releaseScratch(scr);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.daddRegReg(src, dest);
+    }
+
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        loadDouble(TrustedImmPtr(address.m_ptr), fscratch);
+        addDouble(fscratch, dest);
+    }
+
+    void addDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        addDouble(fscratch, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.dsubRegReg(src, dest);
+    }
+
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (op2 == dest) {
+            moveDouble(op1, fscratch);
+            subDouble(op2, fscratch);
+            moveDouble(fscratch, dest);
+        } else {
+            moveDouble(op1, dest);
+            subDouble(op2, dest);
+        }
+    }
+
+    void subDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        subDouble(fscratch, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.dmulRegReg(src, dest);
+    }
+
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (op1 == dest)
+            mulDouble(op2, dest);
+        else {
+            moveDouble(op2, dest);
+            mulDouble(op1, dest);
+        }
+    }
+
+    void mulDouble(Address address, FPRegisterID dest)
+    {
+        loadDouble(address, fscratch);
+        mulDouble(fscratch, dest);
+    }
+
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.ddivRegReg(src, dest);
+    }
+
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (op2 == dest) {
+            moveDouble(op1, fscratch);
+            divDouble(op2, fscratch);
+            moveDouble(fscratch, dest);
+        } else {
+            moveDouble(op1, dest);
+            divDouble(op2, dest);
+        }
+    }
+
+    void negateDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        moveDouble(src, dest);
+        m_assembler.dneg(dest);
+    }
+
+    void convertFloatToDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.fldsfpul(src);
+        m_assembler.dcnvsd(dst);
+    }
+
+    void convertDoubleToFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.dcnvds(src);
+        m_assembler.fstsfpul(dst);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.ldsrmfpul(src);
+        m_assembler.floatfpulDreg(dest);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src.m_ptr, scr);
+        convertInt32ToDouble(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src, scr);
+        convertInt32ToDouble(scr, dest);
+        releaseScratch(scr);
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        Jump m_jump;
+        JumpList end;
+
+        loadEffectiveAddress(address, scr);
+
+        RegisterID scr1 = claimScratch();
+        if (dest != SH4Registers::r0)
+            move(SH4Registers::r0, scr1);
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 58, sizeof(uint32_t));
+        move(scr, SH4Registers::r0);
+        m_assembler.testlImm8r(0x3, SH4Registers::r0);
+        m_jump = Jump(m_assembler.jne(), SH4Assembler::JumpNear);
+
+        if (dest != SH4Registers::r0)
+            move(scr1, SH4Registers::r0);
+
+        load32(scr, dest);
+        end.append(Jump(m_assembler.bra(), SH4Assembler::JumpNear));
+        m_assembler.nop();
+        m_jump.link(this);
+        m_assembler.testlImm8r(0x1, SH4Registers::r0);
+
+        if (dest != SH4Registers::r0)
+            move(scr1, SH4Registers::r0);
+
+        m_jump = Jump(m_assembler.jne(), SH4Assembler::JumpNear);
+        load16PostInc(scr, scr1);
+        load16(scr, dest);
+        m_assembler.shllImm8r(16, dest);
+        or32(scr1, dest);
+        end.append(Jump(m_assembler.bra(), SH4Assembler::JumpNear));
+        m_assembler.nop();
+        m_jump.link(this);
+        load8PostInc(scr, scr1);
+        load16PostInc(scr, dest);
+        m_assembler.shllImm8r(8, dest);
+        or32(dest, scr1);
+        load8(scr, dest);
+        m_assembler.shllImm8r(8, dest);
+        m_assembler.shllImm8r(16, dest);
+        or32(scr1, dest);
+        end.link(this);
+
+        releaseScratch(scr);
+        releaseScratch(scr1);
+    }
+
+    Jump branch32WithUnalignedHalfWords(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        RegisterID scr = scratchReg3;
+        load32WithUnalignedHalfWords(left, scr);
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testlRegReg(scr, scr);
+        else
+            compare32(right.m_value, scr, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.movImm8(0, scratchReg3);
+        convertInt32ToDouble(scratchReg3, scratch);
+        return branchDouble(DoubleNotEqual, reg, scratch);
+    }
+
+    Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID scratch)
+    {
+        m_assembler.movImm8(0, scratchReg3);
+        convertInt32ToDouble(scratchReg3, scratch);
+        return branchDouble(DoubleEqualOrUnordered, reg, scratch);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        if (cond == DoubleEqual) {
+            m_assembler.dcmppeq(right, left);
+            return branchTrue();
+        }
+
+        if (cond == DoubleNotEqual) {
+            JumpList end;
+            m_assembler.dcmppeq(left, left);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            end.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppeq(right, right);
+            end.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppeq(right, left);
+            Jump m_jump = branchFalse();
+            end.link(this);
+            return m_jump;
+        }
+
+        if (cond == DoubleGreaterThan) {
+            m_assembler.dcmppgt(right, left);
+            return branchTrue();
+        }
+
+        if (cond == DoubleGreaterThanOrEqual) {
+            JumpList end;
+            m_assembler.dcmppeq(left, left);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            end.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppeq(right, right);
+            end.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppgt(left, right);
+            Jump m_jump = branchFalse();
+            end.link(this);
+            return m_jump;
+        }
+
+        if (cond == DoubleLessThan) {
+            m_assembler.dcmppgt(left, right);
+            return branchTrue();
+        }
+
+        if (cond == DoubleLessThanOrEqual) {
+            JumpList end;
+            m_assembler.dcmppeq(left, left);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            end.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppeq(right, right);
+            end.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppgt(right, left);
+            Jump m_jump = branchFalse();
+            end.link(this);
+            return m_jump;
+        }
+
+        if (cond == DoubleEqualOrUnordered) {
+            JumpList takeBranch;
+            m_assembler.dcmppeq(left, left);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            takeBranch.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppeq(right, right);
+            takeBranch.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppeq(left, right);
+            m_assembler.branch(BF_OPCODE, 2);
+            takeBranch.link(this);
+            return Jump(m_assembler.extraInstrForBranch(scratchReg3));
+        }
+
+        if (cond == DoubleGreaterThanOrUnordered) {
+            JumpList takeBranch;
+            m_assembler.dcmppeq(left, left);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            takeBranch.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppeq(right, right);
+            takeBranch.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppgt(right, left);
+            m_assembler.branch(BF_OPCODE, 2);
+            takeBranch.link(this);
+            return Jump(m_assembler.extraInstrForBranch(scratchReg3));
+        }
+
+        if (cond == DoubleGreaterThanOrEqualOrUnordered) {
+            m_assembler.dcmppgt(left, right);
+            return branchFalse();
+        }
+
+        if (cond == DoubleLessThanOrUnordered) {
+            JumpList takeBranch;
+            m_assembler.dcmppeq(left, left);
+            m_assembler.ensureSpace(m_assembler.maxInstructionSize + 22, sizeof(uint32_t));
+            takeBranch.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppeq(right, right);
+            takeBranch.append(Jump(m_assembler.jne(), SH4Assembler::JumpNear));
+            m_assembler.dcmppgt(left, right);
+            m_assembler.branch(BF_OPCODE, 2);
+            takeBranch.link(this);
+            return Jump(m_assembler.extraInstrForBranch(scratchReg3));
+        }
+
+        if (cond == DoubleLessThanOrEqualOrUnordered) {
+            m_assembler.dcmppgt(right, left);
+            return branchFalse();
+        }
+
+        ASSERT(cond == DoubleNotEqualOrUnordered);
+        m_assembler.dcmppeq(right, left);
+        return branchFalse();
+    }
+
+    Jump branchTrue()
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 6, sizeof(uint32_t));
+        m_assembler.branch(BF_OPCODE, 2);
+        return Jump(m_assembler.extraInstrForBranch(scratchReg3));
+    }
+
+    Jump branchFalse()
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 6, sizeof(uint32_t));
+        m_assembler.branch(BT_OPCODE, 2);
+        return Jump(m_assembler.extraInstrForBranch(scratchReg3));
+    }
+
+    Jump branch32(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        RegisterID scr = claimScratch();
+        move(left.index, scr);
+        lshift32(TrustedImm32(left.scale), scr);
+        add32(left.base, scr);
+        load32(scr, left.offset, scr);
+        compare32(right.m_value, scr, cond);
+        releaseScratch(scr);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    void sqrtDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        moveDouble(src, dest);
+        m_assembler.dsqrt(dest);
+    }
+    
+    void absDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        moveDouble(src, dest);
+        m_assembler.dabs(dest);
+    }
+
+    NO_RETURN_DUE_TO_CRASH void ceilDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    NO_RETURN_DUE_TO_CRASH void floorDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    NO_RETURN_DUE_TO_CRASH void roundTowardZeroDouble(FPRegisterID, FPRegisterID)
+    {
+        ASSERT(!supportsFloatingPointRounding());
+        CRASH();
+    }
+
+    Jump branchTest8(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        RegisterID addressTempRegister = claimScratch();
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, addressTempRegister);
+        Jump jmp = branchTest32(cond, addressTempRegister, mask8);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    Jump branchTest8(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        RegisterID addressTempRegister = claimScratch();
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, addressTempRegister);
+        Jump jmp = branchTest32(cond, addressTempRegister, mask8);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    Jump branchTest8(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+        RegisterID addressTempRegister = claimScratch();
+        move(TrustedImmPtr(address.m_ptr), addressTempRegister);
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, Address(addressTempRegister), addressTempRegister);
+        Jump jmp = branchTest32(cond, addressTempRegister, mask8);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+
+    Jump branch8(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        RegisterID addressTempRegister = claimScratch();
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, addressTempRegister);
+        Jump jmp = branch32(cond, addressTempRegister, right8);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    Jump branch8(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        RegisterID addressTempRegister = claimScratch();
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, addressTempRegister);
+        Jump jmp = branch32(cond, addressTempRegister, right8);
+        releaseScratch(addressTempRegister);
+        return jmp;
+    }
+
+    void compare8(RelationalCondition cond, Address left, TrustedImm32 right, RegisterID dest)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        RegisterID addressTempRegister = claimScratch();
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, left, addressTempRegister);
+        compare32(cond, addressTempRegister, right8, dest);
+        releaseScratch(addressTempRegister);
+    }
+
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        Jump result;
+        truncateDoubleToInt32(src, dest);
+        RegisterID intscr = claimScratch();
+        m_assembler.loadConstant(0x7fffffff, intscr);
+        m_assembler.cmplRegReg(dest, intscr, SH4Condition(Equal));
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 12, sizeof(uint32_t));
+        if (branchType == BranchIfTruncateFailed) {
+            m_assembler.branch(BT_OPCODE, 2);
+            m_assembler.addlImm8r(1, intscr);
+            m_assembler.cmplRegReg(dest, intscr, SH4Condition(Equal));
+            result = branchTrue();
+        } else {
+            Jump out = Jump(m_assembler.je(), SH4Assembler::JumpNear);
+            m_assembler.addlImm8r(1, intscr);
+            m_assembler.cmplRegReg(dest, intscr, SH4Condition(Equal));
+            result = branchFalse();
+            out.link(this);
+        }
+        releaseScratch(intscr);
+        return result;
+    }
+
+    Jump branchTruncateDoubleToUint32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        Jump result;
+        RegisterID intscr = claimScratch();
+        m_assembler.loadConstant(0x80000000, intscr);
+        convertInt32ToDouble(intscr, fscratch);
+        addDouble(src, fscratch);
+        truncateDoubleToInt32(fscratch, dest);
+        m_assembler.cmplRegReg(dest, intscr, SH4Condition(Equal));
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 16, sizeof(uint32_t));
+        if (branchType == BranchIfTruncateFailed) {
+            m_assembler.branch(BT_OPCODE, 4);
+            m_assembler.addlImm8r(-1, intscr);
+            m_assembler.cmplRegReg(dest, intscr, SH4Condition(Equal));
+            m_assembler.addlImm8r(1, intscr);
+            m_assembler.sublRegReg(intscr, dest);
+            result = branchTrue();
+        } else {
+            Jump out = Jump(m_assembler.je(), SH4Assembler::JumpNear);
+            m_assembler.addlImm8r(-1, intscr);
+            m_assembler.cmplRegReg(dest, intscr, SH4Condition(Equal));
+            m_assembler.addlImm8r(1, intscr);
+            m_assembler.sublRegReg(intscr, dest);
+            result = branchFalse();
+            out.link(this);
+        }
+        releaseScratch(intscr);
+        return result;
+    }
+
+    void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.ftrcdrmfpul(src);
+        m_assembler.stsfpulReg(dest);
+    }
+
+    void truncateDoubleToUint32(FPRegisterID src, RegisterID dest)
+    {
+        RegisterID intscr = claimScratch();
+        m_assembler.loadConstant(0x80000000, intscr);
+        convertInt32ToDouble(intscr, fscratch);
+        addDouble(src, fscratch);
+        m_assembler.ftrcdrmfpul(fscratch);
+        m_assembler.stsfpulReg(dest);
+        m_assembler.sublRegReg(intscr, dest);
+        releaseScratch(intscr);
+    }
+
+    // Stack manipulation operations
+
+    void pop(RegisterID dest)
+    {
+        m_assembler.popReg(dest);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.pushReg(src);
+    }
+
+    void push(TrustedImm32 imm)
+    {
+        RegisterID scr = claimScratch();
+        m_assembler.loadConstant(imm.m_value, scr);
+        push(scr);
+        releaseScratch(scr);
+    }
+
+    // Register move operations
+
+    void move(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.loadConstant(imm.m_value, dest);
+    }
+
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize, sizeof(uint32_t));
+        DataLabelPtr dataLabel(this);
+        m_assembler.loadConstantUnReusable(reinterpret_cast<uint32_t>(initialValue.m_value), dest);
+        return dataLabel;
+    }
+
+    DataLabel32 moveWithPatch(TrustedImm32 initialValue, RegisterID dest)
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize, sizeof(uint32_t));
+        DataLabel32 dataLabel(this);
+        m_assembler.loadConstantUnReusable(static_cast<uint32_t>(initialValue.m_value), dest);
+        return dataLabel;
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.movlRegReg(src, dest);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        m_assembler.loadConstant(imm.asIntptr(), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        if (reg1 != reg2) {
+            xor32(reg1, reg2);
+            xor32(reg2, reg1);
+            xor32(reg1, reg2);
+        }
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmplRegReg(right, left, SH4Condition(cond));
+        if (cond != NotEqual) {
+            m_assembler.movt(dest);
+            return;
+        }
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.movImm8(0, dest);
+        m_assembler.branch(BT_OPCODE, 0);
+        m_assembler.movImm8(1, dest);
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (left != dest) {
+            move(right, dest);
+            compare32(cond, left, dest, dest);
+            return;
+        }
+
+        RegisterID scr = claimScratch();
+        move(right, scr);
+        compare32(cond, left, scr, dest);
+        releaseScratch(scr);
+    }
+
+    void test8(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        TrustedImm32 mask8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, mask);
+
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, address, dest);
+        if ((mask8.m_value & 0xff) == 0xff)
+            compare32(0, dest, static_cast<RelationalCondition>(cond));
+        else
+            testlImm(mask8.m_value, dest);
+        if (cond != NonZero) {
+            m_assembler.movt(dest);
+            return;
+        }
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.movImm8(0, dest);
+        m_assembler.branch(BT_OPCODE, 0);
+        m_assembler.movImm8(1, dest);
+    }
+
+    void test32(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        load32(address, dest);
+        if (mask.m_value == -1)
+            compare32(0, dest, static_cast<RelationalCondition>(cond));
+        else
+            testlImm(mask.m_value, dest);
+        if (cond != NonZero) {
+            m_assembler.movt(dest);
+            return;
+        }
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 4);
+        m_assembler.movImm8(0, dest);
+        m_assembler.branch(BT_OPCODE, 0);
+        m_assembler.movImm8(1, dest);
+    }
+
+    void loadPtrLinkReg(ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        load32(address, scr);
+        m_assembler.ldspr(scr);
+        releaseScratch(scr);
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmplRegReg(right, left, SH4Condition(cond));
+        /* BT label => BF off
+           nop         LDR reg
+           nop         braf @reg
+           nop         nop
+         */
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, TrustedImm32 right)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testlRegReg(left, left);
+        else
+            compare32(right.m_value, left, cond);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, Address right)
+    {
+        compare32(right.offset, right.base, left, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, RegisterID right)
+    {
+        compare32(right, left.offset, left.base, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        compare32(right.m_value, left.offset, left.base, cond);
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        RegisterID scr = claimScratch();
+
+        load32(left.m_ptr, scr);
+        m_assembler.cmplRegReg(right, scr, SH4Condition(cond));
+        releaseScratch(scr);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        RegisterID addressTempRegister = claimScratch();
+
+        move(TrustedImmPtr(left.m_ptr), addressTempRegister);
+        m_assembler.movlMemReg(addressTempRegister, addressTempRegister);
+        compare32(right.m_value, addressTempRegister, cond);
+        releaseScratch(addressTempRegister);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch8(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        TrustedImm32 right8 = MacroAssemblerHelpers::mask8OnCondition(*this, cond, right);
+        RegisterID lefttmp = claimScratch();
+
+        loadEffectiveAddress(left, lefttmp);
+
+        MacroAssemblerHelpers::load8OnCondition(*this, cond, lefttmp, lefttmp);
+        RegisterID righttmp = claimScratch();
+        m_assembler.loadConstant(right8.m_value, righttmp);
+
+        Jump result = branch32(cond, lefttmp, righttmp);
+        releaseScratch(lefttmp);
+        releaseScratch(righttmp);
+        return result;
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        m_assembler.testlRegReg(reg, mask);
+
+        if (cond == NonZero) // NotEqual
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        if (mask.m_value == -1)
+            m_assembler.testlRegReg(reg, reg);
+        else
+            testlImm(mask.m_value, reg);
+
+        if (cond == NonZero) // NotEqual
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        if (mask.m_value == -1)
+            compare32(0, address.offset, address.base, static_cast<RelationalCondition>(cond));
+        else
+            testImm(mask.m_value, address.offset, address.base);
+
+        if (cond == NonZero) // NotEqual
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchTest32(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+
+        RegisterID scr = claimScratch();
+
+        move(address.index, scr);
+        lshift32(TrustedImm32(address.scale), scr);
+        add32(address.base, scr);
+        load32(scr, address.offset, scr);
+
+        if (mask.m_value == -1)
+            m_assembler.testlRegReg(scr, scr);
+        else
+            testlImm(mask.m_value, scr);
+
+        releaseScratch(scr);
+
+        if (cond == NonZero) // NotEqual
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump jump()
+    {
+        return Jump(m_assembler.jmp());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jmpReg(target);
+    }
+
+    void jump(Address address)
+    {
+        RegisterID scr = claimScratch();
+        load32(address, scr);
+        m_assembler.jmpReg(scr);
+        releaseScratch(scr);
+    }
+
+    void jump(AbsoluteAddress address)
+    {
+        RegisterID scr = claimScratch();
+
+        move(TrustedImmPtr(address.m_ptr), scr);
+        m_assembler.movlMemReg(scr, scr);
+        m_assembler.jmpReg(scr);
+        releaseScratch(scr);
+    }
+
+    // Arithmetic control flow operations
+
+    Jump branchNeg32(ResultCondition cond, RegisterID srcDest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow)
+            return branchMul32(cond, srcDest, TrustedImm32(-1), srcDest);
+
+        neg32(srcDest);
+
+        if (cond == Signed) {
+            m_assembler.cmppz(srcDest);
+            return branchFalse();
+        }
+
+        compare32(0, srcDest, Equal);
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            m_assembler.addvlRegReg(src, dest);
+            return branchTrue();
+        }
+
+        m_assembler.addlRegReg(src, dest);
+
+        if ((cond == Signed) || (cond == PositiveOrZero)) {
+            m_assembler.cmppz(dest);
+            return (cond == Signed) ? branchFalse() : branchTrue();
+        }
+
+        compare32(0, dest, Equal);
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            if (src1 == dest)
+                m_assembler.addvlRegReg(src2, dest);
+            else {
+                move(src2, dest);
+                m_assembler.addvlRegReg(src1, dest);
+            }
+            return branchTrue();
+        }
+
+        add32(src1, src2, dest);
+
+        if ((cond == Signed) || (cond == PositiveOrZero)) {
+            m_assembler.cmppz(dest);
+            return (cond == Signed) ? branchFalse() : branchTrue();
+        }
+
+        compare32(0, dest, Equal);
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+
+        RegisterID immval = claimScratch();
+        move(imm, immval);
+        Jump result = branchAdd32(cond, immval, dest);
+        releaseScratch(immval);
+        return result;
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+
+        move(src, dest);
+
+        if (cond == Overflow) {
+            move(imm, scratchReg3);
+            m_assembler.addvlRegReg(scratchReg3, dest);
+            return branchTrue();
+        }
+
+        add32(imm, dest);
+
+        if ((cond == Signed) || (cond == PositiveOrZero)) {
+            m_assembler.cmppz(dest);
+            return (cond == Signed) ? branchFalse() : branchTrue();
+        }
+
+        compare32(0, dest, Equal);
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+        bool result;
+
+        move(imm, scratchReg3);
+        RegisterID destptr = claimScratch();
+        RegisterID destval = claimScratch();
+        move(TrustedImmPtr(dest.m_ptr), destptr);
+        m_assembler.movlMemReg(destptr, destval);
+        if (cond == Overflow) {
+            m_assembler.addvlRegReg(scratchReg3, destval);
+            result = true;
+        } else {
+            m_assembler.addlRegReg(scratchReg3, destval);
+            if ((cond == Signed) || (cond == PositiveOrZero)) {
+                m_assembler.cmppz(destval);
+                result = (cond == PositiveOrZero);
+            } else {
+                m_assembler.testlRegReg(destval, destval);
+                result = (cond != NonZero);
+            }
+        }
+        m_assembler.movlRegMem(destval, destptr);
+        releaseScratch(destval);
+        releaseScratch(destptr);
+        return result ? branchTrue() : branchFalse();
+    }
+
+    Jump branchAdd32(ResultCondition cond, Address src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == PositiveOrZero) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            RegisterID srcVal = claimScratch();
+            load32(src, srcVal);
+            m_assembler.addvlRegReg(srcVal, dest);
+            releaseScratch(srcVal);
+            return branchTrue();
+        }
+
+        add32(src, dest);
+
+        if ((cond == Signed) || (cond == PositiveOrZero)) {
+            m_assembler.cmppz(dest);
+            return (cond == Signed) ? branchFalse() : branchTrue();
+        }
+
+        compare32(0, dest, Equal);
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            RegisterID scrsign = claimScratch();
+            RegisterID msbres = claimScratch();
+            m_assembler.dmulslRegReg(src, dest);
+            m_assembler.stsmacl(dest);
+            m_assembler.cmppz(dest);
+            m_assembler.movt(scrsign);
+            m_assembler.addlImm8r(-1, scrsign);
+            m_assembler.stsmach(msbres);
+            m_assembler.cmplRegReg(msbres, scrsign, SH4Condition(Equal));
+            releaseScratch(msbres);
+            releaseScratch(scrsign);
+            return branchFalse();
+        }
+
+        mul32(src, dest);
+
+        if (cond == Signed) {
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        compare32(0, dest, static_cast<RelationalCondition>(cond));
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            RegisterID scrsign = claimScratch();
+            RegisterID msbres = claimScratch();
+            m_assembler.dmulslRegReg(src1, src2);
+            m_assembler.stsmacl(dest);
+            m_assembler.cmppz(dest);
+            m_assembler.movt(scrsign);
+            m_assembler.addlImm8r(-1, scrsign);
+            m_assembler.stsmach(msbres);
+            m_assembler.cmplRegReg(msbres, scrsign, SH4Condition(Equal));
+            releaseScratch(msbres);
+            releaseScratch(scrsign);
+            return branchFalse();
+        }
+
+        mul32(src1, src2, dest);
+
+        if (cond == Signed) {
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        compare32(0, dest, Equal);
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (src == dest) {
+            move(imm, scratchReg3);
+            return branchMul32(cond, scratchReg3, dest);
+        }
+
+        move(imm, dest);
+        return branchMul32(cond, src, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (cond == Overflow) {
+            m_assembler.subvlRegReg(src, dest);
+            return branchTrue();
+        }
+
+        sub32(src, dest);
+
+        if (cond == Signed) {
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        compare32(0, dest, static_cast<RelationalCondition>(cond));
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchSub32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        RegisterID immval = claimScratch();
+        move(imm, immval);
+        Jump result = branchSub32(cond, immval, dest);
+        releaseScratch(immval);
+        return result;
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        move(src, dest);
+        return branchSub32(cond, imm, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        if (src2 != dest) {
+            move(src1, dest);
+            return branchSub32(cond, src2, dest);
+        }
+
+        if (cond == Overflow) {
+            RegisterID tmpval = claimScratch();
+            move(src1, tmpval);
+            m_assembler.subvlRegReg(src2, tmpval);
+            move(tmpval, dest);
+            releaseScratch(tmpval);
+            return branchTrue();
+        }
+
+        RegisterID tmpval = claimScratch();
+        move(src1, tmpval);
+        sub32(src2, tmpval);
+        move(tmpval, dest);
+        releaseScratch(tmpval);
+
+        if (cond == Signed) {
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        compare32(0, dest, static_cast<RelationalCondition>(cond));
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+
+        or32(src, dest);
+
+        if (cond == Signed) {
+            m_assembler.cmppz(dest);
+            return branchFalse();
+        }
+
+        compare32(0, dest, static_cast<RelationalCondition>(cond));
+        return (cond == NonZero) ? branchFalse() : branchTrue();
+    }
+
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID, bool negZeroCheck = true)
+    {
+        truncateDoubleToInt32(src, dest);
+        convertInt32ToDouble(dest, fscratch);
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, fscratch, src));
+
+        if (negZeroCheck)
+            failureCases.append(branch32(Equal, dest, TrustedImm32(0)));
+    }
+
+    void neg32(RegisterID dst)
+    {
+        m_assembler.neg(dst, dst);
+    }
+
+    void urshift32(RegisterID shiftamount, RegisterID dest)
+    {
+        RegisterID shiftTmp = claimScratch();
+        m_assembler.loadConstant(0x1f, shiftTmp);
+        m_assembler.andlRegReg(shiftamount, shiftTmp);
+        m_assembler.neg(shiftTmp, shiftTmp);
+        m_assembler.shldRegReg(dest, shiftTmp);
+        releaseScratch(shiftTmp);
+    }
+
+    void urshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        move(src, dest);
+        urshift32(shiftAmount, dest);
+    }
+
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        int immMasked = imm.m_value & 0x1f;
+        if (!immMasked)
+            return;
+
+        if ((immMasked == 1) || (immMasked == 2) || (immMasked == 8) || (immMasked == 16)) {
+            m_assembler.shlrImm8r(immMasked, dest);
+            return;
+        }
+
+        RegisterID shiftTmp = claimScratch();
+        m_assembler.loadConstant(-immMasked, shiftTmp);
+        m_assembler.shldRegReg(dest, shiftTmp);
+        releaseScratch(shiftTmp);
+    }
+
+    void urshift32(RegisterID src, TrustedImm32 shiftamount, RegisterID dest)
+    {
+        move(src, dest);
+        urshift32(shiftamount, dest);
+    }
+
+    Call call()
+    {
+        return Call(m_assembler.call(), Call::Linkable);
+    }
+
+    Call nearTailCall()
+    {
+        return Call(m_assembler.jump(), Call::LinkableNearTail);
+    }
+
+    Call nearCall()
+    {
+        return Call(m_assembler.call(), Call::LinkableNear);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.call(target), Call::None);
+    }
+
+    void call(Address address)
+    {
+        RegisterID target = claimScratch();
+        load32(address.base, address.offset, target);
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 2);
+        m_assembler.branch(JSR_OPCODE, target);
+        m_assembler.nop();
+        releaseScratch(target);
+    }
+
+    void breakpoint()
+    {
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 2);
+        m_assembler.bkpt();
+        m_assembler.nop();
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        RegisterID dataTempRegister = claimScratch();
+
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 10, 2 * sizeof(uint32_t));
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        m_assembler.cmplRegReg(dataTempRegister, left, SH4Condition(cond));
+        releaseScratch(dataTempRegister);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstant(left.offset, scr);
+        m_assembler.addlRegReg(left.base, scr);
+        m_assembler.movlMemReg(scr, scr);
+        RegisterID scr1 = claimScratch();
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 10, 2 * sizeof(uint32_t));
+        dataLabel = moveWithPatch(initialRightValue, scr1);
+        m_assembler.cmplRegReg(scr1, scr, SH4Condition(cond));
+        releaseScratch(scr);
+        releaseScratch(scr1);
+
+        if (cond == NotEqual)
+            return branchFalse();
+        return branchTrue();
+    }
+
+    Jump branch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstant(left.offset, scr);
+        m_assembler.addlRegReg(left.base, scr);
+        m_assembler.movlMemReg(scr, scr);
+        RegisterID scr1 = claimScratch();
+        m_assembler.ensureSpace(m_assembler.maxInstructionSize + 10, 2 * sizeof(uint32_t));
+        dataLabel = moveWithPatch(initialRightValue, scr1);
+        m_assembler.cmplRegReg(scr1, scr, SH4Condition(cond));
+        releaseScratch(scr);
+        releaseScratch(scr1);
+
+        return (cond == NotEqual) ? branchFalse() : branchTrue();
+    }
+
+    void ret()
+    {
+        m_assembler.ret();
+        m_assembler.nop();
+    }
+
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        RegisterID scr = claimScratch();
+        DataLabelPtr label = moveWithPatch(initialValue, scr);
+        store32(scr, address);
+        releaseScratch(scr);
+        return label;
+    }
+
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(TrustedImmPtr(0), address); }
+
+    int sizeOfConstantPool()
+    {
+        return m_assembler.sizeOfConstantPool();
+    }
+
+    Call tailRecursiveCall()
+    {
+        RegisterID scr = claimScratch();
+
+        m_assembler.loadConstantUnReusable(0x0, scr, true);
+        Jump m_jump = Jump(m_assembler.jmp(scr));
+        releaseScratch(scr);
+
+        return Call::fromTailJump(m_jump);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+    void nop()
+    {
+        m_assembler.nop();
+    }
+
+    void memoryFence()
+    {
+        m_assembler.synco();
+    }
+
+    void abortWithReason(AbortReason reason)
+    {
+        move(TrustedImm32(reason), SH4Registers::r0);
+        breakpoint();
+    }
+
+    void abortWithReason(AbortReason reason, intptr_t misc)
+    {
+        move(TrustedImm32(misc), SH4Registers::r1);
+        abortWithReason(reason);
+    }
+
+    static FunctionPtr readCallTarget(CodeLocationCall call)
+    {
+        return FunctionPtr(reinterpret_cast<void(*)()>(SH4Assembler::readCallTarget(call.dataLocation())));
+    }
+
+    static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)
+    {
+        SH4Assembler::replaceWithJump(instructionStart.dataLocation(), destination.dataLocation());
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return SH4Assembler::maxJumpReplacementSize();
+    }
+
+    static bool canJumpReplacePatchableBranchPtrWithPatch() { return false; }
+
+    static bool canJumpReplacePatchableBranch32WithPatch() { return false; }
+
+    static CodeLocationLabel startOfBranchPtrWithPatchOnRegister(CodeLocationDataLabelPtr label)
+    {
+        return label.labelAtOffset(0);
+    }
+
+    static void revertJumpReplacementToBranchPtrWithPatch(CodeLocationLabel instructionStart, RegisterID rd, void* initialValue)
+    {
+        SH4Assembler::revertJumpReplacementToBranchPtrWithPatch(instructionStart.dataLocation(), rd, reinterpret_cast<int>(initialValue));
+    }
+
+    static CodeLocationLabel startOfPatchableBranchPtrWithPatchOnAddress(CodeLocationDataLabelPtr)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+
+    static CodeLocationLabel startOfPatchableBranch32WithPatchOnAddress(CodeLocationDataLabel32)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return CodeLocationLabel();
+    }
+
+    static void revertJumpReplacementToPatchableBranchPtrWithPatch(CodeLocationLabel, Address, void*)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+    static void revertJumpReplacementToPatchableBranch32WithPatch(CodeLocationLabel, Address, int32_t)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+    }
+
+protected:
+    SH4Assembler::Condition SH4Condition(RelationalCondition cond)
+    {
+        return static_cast<SH4Assembler::Condition>(cond);
+    }
+
+    SH4Assembler::Condition SH4Condition(ResultCondition cond)
+    {
+        return static_cast<SH4Assembler::Condition>(cond);
+    }
+private:
+    friend class LinkBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        if (call.isFlagSet(Call::Tail))
+            SH4Assembler::linkJump(code, call.m_label, function.value());
+        else
+            SH4Assembler::linkCall(code, call.m_label, function.value());
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        SH4Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        SH4Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/MacroAssemblerX86.h b/assembler/MacroAssemblerX86.h
new file mode 100644
index 0000000..75f3545
--- /dev/null
+++ b/assembler/MacroAssemblerX86.h
@@ -0,0 +1,375 @@
+/*
+ * Copyright (C) 2008, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(X86)
+
+#include "MacroAssemblerX86Common.h"
+
+namespace JSC {
+
+class MacroAssemblerX86 : public MacroAssemblerX86Common {
+public:
+    static const unsigned numGPRs = 8;
+    static const unsigned numFPRs = 8;
+    
+    static const Scale ScalePtr = TimesFour;
+
+    using MacroAssemblerX86Common::add32;
+    using MacroAssemblerX86Common::and32;
+    using MacroAssemblerX86Common::branchAdd32;
+    using MacroAssemblerX86Common::branchSub32;
+    using MacroAssemblerX86Common::sub32;
+    using MacroAssemblerX86Common::or32;
+    using MacroAssemblerX86Common::load32;
+    using MacroAssemblerX86Common::load8;
+    using MacroAssemblerX86Common::store32;
+    using MacroAssemblerX86Common::store8;
+    using MacroAssemblerX86Common::branch32;
+    using MacroAssemblerX86Common::call;
+    using MacroAssemblerX86Common::jump;
+    using MacroAssemblerX86Common::addDouble;
+    using MacroAssemblerX86Common::loadDouble;
+    using MacroAssemblerX86Common::storeDouble;
+    using MacroAssemblerX86Common::convertInt32ToDouble;
+    using MacroAssemblerX86Common::branch8;
+    using MacroAssemblerX86Common::branchTest8;
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.leal_mr(imm.m_value, src, dest);
+    }
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.addl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void add32(AbsoluteAddress address, RegisterID dest)
+    {
+        m_assembler.addl_mr(address.m_ptr, dest);
+    }
+    
+    void add64(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.addl_im(imm.m_value, address.m_ptr);
+        m_assembler.adcl_im(imm.m_value >> 31, reinterpret_cast<const char*>(address.m_ptr) + sizeof(int32_t));
+    }
+
+    void and32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.andl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void or32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.orl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void or32(RegisterID reg, AbsoluteAddress address)
+    {
+        m_assembler.orl_rm(reg, address.m_ptr);
+    }
+    
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.subl_im(imm.m_value, address.m_ptr);
+    }
+
+    void load32(const void* address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address, dest);
+    }
+    
+    void load8(const void* address, RegisterID dest)
+    {
+        m_assembler.movzbl_mr(address, dest);
+    }
+
+    void abortWithReason(AbortReason reason)
+    {
+        move(TrustedImm32(reason), X86Registers::eax);
+        breakpoint();
+    }
+
+    void abortWithReason(AbortReason reason, intptr_t misc)
+    {
+        move(TrustedImm32(misc), X86Registers::edx);
+        abortWithReason(reason);
+    }
+
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result = ConvertibleLoadLabel(this);
+        m_assembler.movl_mr(address.offset, address.base, dest);
+        return result;
+    }
+
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        m_assembler.addsd_mr(address.m_ptr, dest);
+    }
+
+    void storeDouble(FPRegisterID src, TrustedImmPtr address)
+    {
+        ASSERT(isSSE2Present());
+        ASSERT(address.m_value);
+        m_assembler.movsd_rm(src, address.m_value);
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
+    {
+        m_assembler.cvtsi2sd_mr(src.m_ptr, dest);
+    }
+
+    void store32(TrustedImm32 imm, void* address)
+    {
+        m_assembler.movl_i32m(imm.m_value, address);
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        m_assembler.movl_rm(src, address);
+    }
+    
+    void store8(RegisterID src, void* address)
+    {
+        m_assembler.movb_rm(src, address);
+    }
+
+    void store8(TrustedImm32 imm, void* address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        m_assembler.movb_i8m(imm8.m_value, address);
+    }
+    
+    void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.pextrw_irr(3, src, dest1);
+        m_assembler.pextrw_irr(2, src, dest2);
+        lshift32(TrustedImm32(16), dest1);
+        or32(dest1, dest2);
+        moveFloatTo32(src, dest1);
+    }
+
+    void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch)
+    {
+        move32ToFloat(src1, dest);
+        move32ToFloat(src2, scratch);
+        lshiftPacked(TrustedImm32(32), scratch);
+        orPacked(scratch, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress dest)
+    {
+        m_assembler.addl_im(imm.m_value, dest.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress dest)
+    {
+        m_assembler.subl_im(imm.m_value, dest.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        m_assembler.cmpl_rm(right, left.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Call call()
+    {
+        return Call(m_assembler.call(), Call::Linkable);
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(AbsoluteAddress address)
+    {
+        m_assembler.jmp_m(address.m_ptr);
+    }
+
+    Call tailRecursiveCall()
+    {
+        return Call::fromTailJump(jump());
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        return Call::fromTailJump(oldJump);
+    }
+
+
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
+    {
+        padBeforePatch();
+        m_assembler.movl_i32r(initialValue.asIntptr(), dest);
+        return DataLabelPtr(this);
+    }
+    
+    Jump branch8(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        TrustedImm32 right8(static_cast<int8_t>(right.m_value));
+        m_assembler.cmpb_im(right8.m_value, left.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest8(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8(static_cast<int8_t>(mask.m_value));
+        if (mask8.m_value == -1)
+            m_assembler.cmpb_im(0, address.m_ptr);
+        else
+            m_assembler.testb_im(mask8.m_value, address.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        padBeforePatch();
+        m_assembler.cmpl_ir_force32(initialRightValue.asIntptr(), left);
+        dataLabel = DataLabelPtr(this);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        padBeforePatch();
+        m_assembler.cmpl_im_force32(initialRightValue.asIntptr(), left.offset, left.base);
+        dataLabel = DataLabelPtr(this);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        padBeforePatch();
+        m_assembler.cmpl_im_force32(initialRightValue.m_value, left.offset, left.base);
+        dataLabel = DataLabel32(this);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        padBeforePatch();
+        m_assembler.movl_i32m(initialValue.asIntptr(), address.offset, address.base);
+        return DataLabelPtr(this);
+    }
+
+    static bool supportsFloatingPoint() { return isSSE2Present(); }
+    static bool supportsFloatingPointTruncate() { return isSSE2Present(); }
+    static bool supportsFloatingPointSqrt() { return isSSE2Present(); }
+    static bool supportsFloatingPointAbs() { return isSSE2Present(); }
+    
+    static FunctionPtr readCallTarget(CodeLocationCall call)
+    {
+        intptr_t offset = reinterpret_cast<int32_t*>(call.dataLocation())[-1];
+        return FunctionPtr(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(call.dataLocation()) + offset));
+    }
+
+    static bool canJumpReplacePatchableBranchPtrWithPatch() { return true; }
+    static bool canJumpReplacePatchableBranch32WithPatch() { return true; }
+    
+    static CodeLocationLabel startOfBranchPtrWithPatchOnRegister(CodeLocationDataLabelPtr label)
+    {
+        const int opcodeBytes = 1;
+        const int modRMBytes = 1;
+        const int immediateBytes = 4;
+        const int totalBytes = opcodeBytes + modRMBytes + immediateBytes;
+        ASSERT(totalBytes >= maxJumpReplacementSize());
+        return label.labelAtOffset(-totalBytes);
+    }
+    
+    static CodeLocationLabel startOfPatchableBranchPtrWithPatchOnAddress(CodeLocationDataLabelPtr label)
+    {
+        const int opcodeBytes = 1;
+        const int modRMBytes = 1;
+        const int offsetBytes = 0;
+        const int immediateBytes = 4;
+        const int totalBytes = opcodeBytes + modRMBytes + offsetBytes + immediateBytes;
+        ASSERT(totalBytes >= maxJumpReplacementSize());
+        return label.labelAtOffset(-totalBytes);
+    }
+    
+    static CodeLocationLabel startOfPatchableBranch32WithPatchOnAddress(CodeLocationDataLabel32 label)
+    {
+        const int opcodeBytes = 1;
+        const int modRMBytes = 1;
+        const int offsetBytes = 0;
+        const int immediateBytes = 4;
+        const int totalBytes = opcodeBytes + modRMBytes + offsetBytes + immediateBytes;
+        ASSERT(totalBytes >= maxJumpReplacementSize());
+        return label.labelAtOffset(-totalBytes);
+    }
+    
+    static void revertJumpReplacementToBranchPtrWithPatch(CodeLocationLabel instructionStart, RegisterID reg, void* initialValue)
+    {
+        X86Assembler::revertJumpTo_cmpl_ir_force32(instructionStart.executableAddress(), reinterpret_cast<intptr_t>(initialValue), reg);
+    }
+
+    static void revertJumpReplacementToPatchableBranchPtrWithPatch(CodeLocationLabel instructionStart, Address address, void* initialValue)
+    {
+        ASSERT(!address.offset);
+        X86Assembler::revertJumpTo_cmpl_im_force32(instructionStart.executableAddress(), reinterpret_cast<intptr_t>(initialValue), 0, address.base);
+    }
+
+    static void revertJumpReplacementToPatchableBranch32WithPatch(CodeLocationLabel instructionStart, Address address, int32_t initialValue)
+    {
+        ASSERT(!address.offset);
+        X86Assembler::revertJumpTo_cmpl_im_force32(instructionStart.executableAddress(), initialValue, 0, address.base);
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        X86Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        X86Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
+    }
+
+private:
+    friend class LinkBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        if (call.isFlagSet(Call::Tail))
+            X86Assembler::linkJump(code, call.m_label, function.value());
+        else
+            X86Assembler::linkCall(code, call.m_label, function.value());
+    }
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/MacroAssemblerX86Common.cpp b/assembler/MacroAssemblerX86Common.cpp
new file mode 100644
index 0000000..528c60f
--- /dev/null
+++ b/assembler/MacroAssemblerX86Common.cpp
@@ -0,0 +1,562 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(ASSEMBLER) && (CPU(X86) || CPU(X86_64))
+#include "MacroAssemblerX86Common.h"
+
+#include <wtf/InlineASM.h>
+
+namespace JSC {
+
+#if ENABLE(MASM_PROBE)
+
+extern "C" void ctiMasmProbeTrampoline();
+
+#if COMPILER(GCC_OR_CLANG)
+
+// The following are offsets for MacroAssemblerX86Common::ProbeContext fields accessed
+// by the ctiMasmProbeTrampoline stub.
+
+#if CPU(X86)
+#define PTR_SIZE 4
+#else // CPU(X86_64)
+#define PTR_SIZE 8
+#endif
+
+#define PROBE_PROBE_FUNCTION_OFFSET (0 * PTR_SIZE)
+#define PROBE_ARG1_OFFSET (1 * PTR_SIZE)
+#define PROBE_ARG2_OFFSET (2 * PTR_SIZE)
+
+#define PROBE_FIRST_GPR_OFFSET (3 * PTR_SIZE)
+#define PROBE_CPU_EAX_OFFSET (PROBE_FIRST_GPR_OFFSET + (0 * PTR_SIZE))
+#define PROBE_CPU_ECX_OFFSET (PROBE_FIRST_GPR_OFFSET + (1 * PTR_SIZE))
+#define PROBE_CPU_EDX_OFFSET (PROBE_FIRST_GPR_OFFSET + (2 * PTR_SIZE))
+#define PROBE_CPU_EBX_OFFSET (PROBE_FIRST_GPR_OFFSET + (3 * PTR_SIZE))
+#define PROBE_CPU_ESP_OFFSET (PROBE_FIRST_GPR_OFFSET + (4 * PTR_SIZE))
+#define PROBE_CPU_EBP_OFFSET (PROBE_FIRST_GPR_OFFSET + (5 * PTR_SIZE))
+#define PROBE_CPU_ESI_OFFSET (PROBE_FIRST_GPR_OFFSET + (6 * PTR_SIZE))
+#define PROBE_CPU_EDI_OFFSET (PROBE_FIRST_GPR_OFFSET + (7 * PTR_SIZE))
+
+#if CPU(X86)
+#define PROBE_FIRST_SPECIAL_OFFSET (PROBE_FIRST_GPR_OFFSET + (8 * PTR_SIZE))
+#else // CPU(X86_64)
+#define PROBE_CPU_R8_OFFSET (PROBE_FIRST_GPR_OFFSET + (8 * PTR_SIZE))
+#define PROBE_CPU_R9_OFFSET (PROBE_FIRST_GPR_OFFSET + (9 * PTR_SIZE))
+#define PROBE_CPU_R10_OFFSET (PROBE_FIRST_GPR_OFFSET + (10 * PTR_SIZE))
+#define PROBE_CPU_R11_OFFSET (PROBE_FIRST_GPR_OFFSET + (11 * PTR_SIZE))
+#define PROBE_CPU_R12_OFFSET (PROBE_FIRST_GPR_OFFSET + (12 * PTR_SIZE))
+#define PROBE_CPU_R13_OFFSET (PROBE_FIRST_GPR_OFFSET + (13 * PTR_SIZE))
+#define PROBE_CPU_R14_OFFSET (PROBE_FIRST_GPR_OFFSET + (14 * PTR_SIZE))
+#define PROBE_CPU_R15_OFFSET (PROBE_FIRST_GPR_OFFSET + (15 * PTR_SIZE))
+#define PROBE_FIRST_SPECIAL_OFFSET (PROBE_FIRST_GPR_OFFSET + (16 * PTR_SIZE))
+#endif // CPU(X86_64)
+
+#define PROBE_CPU_EIP_OFFSET (PROBE_FIRST_SPECIAL_OFFSET + (0 * PTR_SIZE))
+#define PROBE_CPU_EFLAGS_OFFSET (PROBE_FIRST_SPECIAL_OFFSET + (1 * PTR_SIZE))
+#define PROBE_FIRST_XMM_OFFSET (PROBE_FIRST_SPECIAL_OFFSET + (2 * PTR_SIZE))
+
+#define XMM_SIZE 8
+#define PROBE_CPU_XMM0_OFFSET (PROBE_FIRST_XMM_OFFSET + (0 * XMM_SIZE))
+#define PROBE_CPU_XMM1_OFFSET (PROBE_FIRST_XMM_OFFSET + (1 * XMM_SIZE))
+#define PROBE_CPU_XMM2_OFFSET (PROBE_FIRST_XMM_OFFSET + (2 * XMM_SIZE))
+#define PROBE_CPU_XMM3_OFFSET (PROBE_FIRST_XMM_OFFSET + (3 * XMM_SIZE))
+#define PROBE_CPU_XMM4_OFFSET (PROBE_FIRST_XMM_OFFSET + (4 * XMM_SIZE))
+#define PROBE_CPU_XMM5_OFFSET (PROBE_FIRST_XMM_OFFSET + (5 * XMM_SIZE))
+#define PROBE_CPU_XMM6_OFFSET (PROBE_FIRST_XMM_OFFSET + (6 * XMM_SIZE))
+#define PROBE_CPU_XMM7_OFFSET (PROBE_FIRST_XMM_OFFSET + (7 * XMM_SIZE))
+
+#if CPU(X86)
+#define PROBE_SIZE (PROBE_CPU_XMM7_OFFSET + XMM_SIZE)
+#else // CPU(X86_64)
+#define PROBE_CPU_XMM8_OFFSET (PROBE_FIRST_XMM_OFFSET + (8 * XMM_SIZE))
+#define PROBE_CPU_XMM9_OFFSET (PROBE_FIRST_XMM_OFFSET + (9 * XMM_SIZE))
+#define PROBE_CPU_XMM10_OFFSET (PROBE_FIRST_XMM_OFFSET + (10 * XMM_SIZE))
+#define PROBE_CPU_XMM11_OFFSET (PROBE_FIRST_XMM_OFFSET + (11 * XMM_SIZE))
+#define PROBE_CPU_XMM12_OFFSET (PROBE_FIRST_XMM_OFFSET + (12 * XMM_SIZE))
+#define PROBE_CPU_XMM13_OFFSET (PROBE_FIRST_XMM_OFFSET + (13 * XMM_SIZE))
+#define PROBE_CPU_XMM14_OFFSET (PROBE_FIRST_XMM_OFFSET + (14 * XMM_SIZE))
+#define PROBE_CPU_XMM15_OFFSET (PROBE_FIRST_XMM_OFFSET + (15 * XMM_SIZE))
+#define PROBE_SIZE (PROBE_CPU_XMM15_OFFSET + XMM_SIZE)
+#endif // CPU(X86_64)
+
+// These ASSERTs remind you that if you change the layout of ProbeContext,
+// you need to change ctiMasmProbeTrampoline offsets above to match.
+#define PROBE_OFFSETOF(x) offsetof(struct MacroAssemblerX86Common::ProbeContext, x)
+COMPILE_ASSERT(PROBE_OFFSETOF(probeFunction) == PROBE_PROBE_FUNCTION_OFFSET, ProbeContext_probeFunction_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg1) == PROBE_ARG1_OFFSET, ProbeContext_arg1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(arg2) == PROBE_ARG2_OFFSET, ProbeContext_arg2_offset_matches_ctiMasmProbeTrampoline);
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.eax) == PROBE_CPU_EAX_OFFSET, ProbeContext_cpu_eax_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.ecx) == PROBE_CPU_ECX_OFFSET, ProbeContext_cpu_ecx_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.edx) == PROBE_CPU_EDX_OFFSET, ProbeContext_cpu_edx_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.ebx) == PROBE_CPU_EBX_OFFSET, ProbeContext_cpu_ebx_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.esp) == PROBE_CPU_ESP_OFFSET, ProbeContext_cpu_esp_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.ebp) == PROBE_CPU_EBP_OFFSET, ProbeContext_cpu_ebp_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.esi) == PROBE_CPU_ESI_OFFSET, ProbeContext_cpu_esi_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.edi) == PROBE_CPU_EDI_OFFSET, ProbeContext_cpu_edi_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.eip) == PROBE_CPU_EIP_OFFSET, ProbeContext_cpu_eip_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.eflags) == PROBE_CPU_EFLAGS_OFFSET, ProbeContext_cpu_eflags_offset_matches_ctiMasmProbeTrampoline);
+
+#if CPU(X86_64)
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r8) == PROBE_CPU_R8_OFFSET, ProbeContext_cpu_r8_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r9) == PROBE_CPU_R9_OFFSET, ProbeContext_cpu_r9_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r10) == PROBE_CPU_R10_OFFSET, ProbeContext_cpu_r10_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r11) == PROBE_CPU_R11_OFFSET, ProbeContext_cpu_r11_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r12) == PROBE_CPU_R12_OFFSET, ProbeContext_cpu_r12_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r13) == PROBE_CPU_R13_OFFSET, ProbeContext_cpu_r13_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r14) == PROBE_CPU_R14_OFFSET, ProbeContext_cpu_r14_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.r15) == PROBE_CPU_R15_OFFSET, ProbeContext_cpu_r15_offset_matches_ctiMasmProbeTrampoline);
+#endif // CPU(X86_64)
+
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm0) == PROBE_CPU_XMM0_OFFSET, ProbeContext_cpu_xmm0_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm1) == PROBE_CPU_XMM1_OFFSET, ProbeContext_cpu_xmm1_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm2) == PROBE_CPU_XMM2_OFFSET, ProbeContext_cpu_xmm2_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm3) == PROBE_CPU_XMM3_OFFSET, ProbeContext_cpu_xmm3_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm4) == PROBE_CPU_XMM4_OFFSET, ProbeContext_cpu_xmm4_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm5) == PROBE_CPU_XMM5_OFFSET, ProbeContext_cpu_xmm5_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm6) == PROBE_CPU_XMM6_OFFSET, ProbeContext_cpu_xmm6_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm7) == PROBE_CPU_XMM7_OFFSET, ProbeContext_cpu_xmm7_offset_matches_ctiMasmProbeTrampoline);
+
+#if CPU(X86_64)
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm8) == PROBE_CPU_XMM8_OFFSET, ProbeContext_cpu_xmm8_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm9) == PROBE_CPU_XMM9_OFFSET, ProbeContext_cpu_xmm9_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm10) == PROBE_CPU_XMM10_OFFSET, ProbeContext_cpu_xmm10_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm11) == PROBE_CPU_XMM11_OFFSET, ProbeContext_cpu_xmm11_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm12) == PROBE_CPU_XMM12_OFFSET, ProbeContext_cpu_xmm12_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm13) == PROBE_CPU_XMM13_OFFSET, ProbeContext_cpu_xmm13_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm14) == PROBE_CPU_XMM14_OFFSET, ProbeContext_cpu_xmm14_offset_matches_ctiMasmProbeTrampoline);
+COMPILE_ASSERT(PROBE_OFFSETOF(cpu.xmm15) == PROBE_CPU_XMM15_OFFSET, ProbeContext_cpu_xmm15_offset_matches_ctiMasmProbeTrampoline);
+#endif // CPU(X86_64)
+
+COMPILE_ASSERT(sizeof(MacroAssemblerX86Common::ProbeContext) == PROBE_SIZE, ProbeContext_size_matches_ctiMasmProbeTrampoline);
+
+#undef PROBE_OFFSETOF
+
+#if CPU(X86)
+asm (
+    ".globl " SYMBOL_STRING(ctiMasmProbeTrampoline) "\n"
+    HIDE_SYMBOL(ctiMasmProbeTrampoline) "\n"
+    SYMBOL_STRING(ctiMasmProbeTrampoline) ":" "\n"
+
+    "pushfd" "\n"
+
+    // MacroAssemblerX86Common::probe() has already generated code to store some values.
+    // Together with the eflags pushed above, the top of stack now looks like
+    // this:
+    //     esp[0 * ptrSize]: eflags
+    //     esp[1 * ptrSize]: return address / saved eip
+    //     esp[2 * ptrSize]: probeFunction
+    //     esp[3 * ptrSize]: arg1
+    //     esp[4 * ptrSize]: arg2
+    //     esp[5 * ptrSize]: saved eax
+    //     esp[6 * ptrSize]: saved esp
+
+    "movl %esp, %eax" "\n"
+    "subl $" STRINGIZE_VALUE_OF(PROBE_SIZE) ", %esp" "\n"
+
+    // The X86_64 ABI specifies that the worse case stack alignment requirement
+    // is 32 bytes.
+    "andl $~0x1f, %esp" "\n"
+
+    "movl %ebp, " STRINGIZE_VALUE_OF(PROBE_CPU_EBP_OFFSET) "(%esp)" "\n"
+    "movl %esp, %ebp" "\n" // Save the ProbeContext*.
+
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_ECX_OFFSET) "(%ebp)" "\n"
+    "movl %edx, " STRINGIZE_VALUE_OF(PROBE_CPU_EDX_OFFSET) "(%ebp)" "\n"
+    "movl %ebx, " STRINGIZE_VALUE_OF(PROBE_CPU_EBX_OFFSET) "(%ebp)" "\n"
+    "movl %esi, " STRINGIZE_VALUE_OF(PROBE_CPU_ESI_OFFSET) "(%ebp)" "\n"
+    "movl %edi, " STRINGIZE_VALUE_OF(PROBE_CPU_EDI_OFFSET) "(%ebp)" "\n"
+
+    "movl 0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) "(%ebp)" "\n"
+    "movl 1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_EIP_OFFSET) "(%ebp)" "\n"
+    "movl 2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "(%ebp)" "\n"
+    "movl 3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_ARG1_OFFSET) "(%ebp)" "\n"
+    "movl 4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_ARG2_OFFSET) "(%ebp)" "\n"
+    "movl 5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) "(%ebp)" "\n"
+    "movl 6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%ebp)" "\n"
+
+    "movq %xmm0, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM0_OFFSET) "(%ebp)" "\n"
+    "movq %xmm1, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM1_OFFSET) "(%ebp)" "\n"
+    "movq %xmm2, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM2_OFFSET) "(%ebp)" "\n"
+    "movq %xmm3, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM3_OFFSET) "(%ebp)" "\n"
+    "movq %xmm4, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM4_OFFSET) "(%ebp)" "\n"
+    "movq %xmm5, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM5_OFFSET) "(%ebp)" "\n"
+    "movq %xmm6, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM6_OFFSET) "(%ebp)" "\n"
+    "movq %xmm7, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM7_OFFSET) "(%ebp)" "\n"
+
+    // Reserve stack space for the arg while maintaining the required stack
+    // pointer 32 byte alignment:
+    "subl $0x20, %esp" "\n"
+    "movl %ebp, 0(%esp)" "\n" // the ProbeContext* arg.
+
+    "call *" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "(%ebp)" "\n"
+
+    // To enable probes to modify register state, we copy all registers
+    // out of the ProbeContext before returning.
+
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EDX_OFFSET) "(%ebp), %edx" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EBX_OFFSET) "(%ebp), %ebx" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_ESI_OFFSET) "(%ebp), %esi" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EDI_OFFSET) "(%ebp), %edi" "\n"
+
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM0_OFFSET) "(%ebp), %xmm0" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM1_OFFSET) "(%ebp), %xmm1" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM2_OFFSET) "(%ebp), %xmm2" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM3_OFFSET) "(%ebp), %xmm3" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM4_OFFSET) "(%ebp), %xmm4" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM5_OFFSET) "(%ebp), %xmm5" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM6_OFFSET) "(%ebp), %xmm6" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM7_OFFSET) "(%ebp), %xmm7" "\n"
+
+    // There are 6 more registers left to restore:
+    //     eax, ecx, ebp, esp, eip, and eflags.
+    // We need to handle these last few restores carefully because:
+    //
+    // 1. We need to push the return address on the stack for ret to use.
+    //    That means we need to write to the stack.
+    // 2. The user probe function may have altered the restore value of esp to
+    //    point to the vicinity of one of the restore values for the remaining
+    //    registers left to be restored.
+    //    That means, for requirement 1, we may end up writing over some of the
+    //    restore values. We can check for this, and first copy the restore
+    //    values to a "safe area" on the stack before commencing with the action
+    //    for requirement 1.
+    // 3. For requirement 2, we need to ensure that the "safe area" is
+    //    protected from interrupt handlers overwriting it. Hence, the esp needs
+    //    to be adjusted to include the "safe area" before we start copying the
+    //    the restore values.
+
+    "movl %ebp, %eax" "\n"
+    "addl $" STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) ", %eax" "\n"
+    "cmpl %eax, " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%ebp)" "\n"
+    "jg " SYMBOL_STRING(ctiMasmProbeTrampolineEnd) "\n"
+
+    // Locate the "safe area" at 2x sizeof(ProbeContext) below where the new
+    // rsp will be. This time we don't have to 32-byte align it because we're
+    // not using to store any xmm regs.
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%ebp), %eax" "\n"
+    "subl $2 * " STRINGIZE_VALUE_OF(PROBE_SIZE) ", %eax" "\n"
+    "movl %eax, %esp" "\n"
+
+    "subl $" STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) ", %eax" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_ECX_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_ECX_OFFSET) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EBP_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_EBP_OFFSET) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EIP_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_EIP_OFFSET) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, " STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) "(%eax)" "\n"
+    "movl %eax, %ebp" "\n"
+
+    SYMBOL_STRING(ctiMasmProbeTrampolineEnd) ":" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%ebp), %eax" "\n"
+    "subl $5 * " STRINGIZE_VALUE_OF(PTR_SIZE) ", %eax" "\n"
+    // At this point, %esp should be < %eax.
+
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, 0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, 1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_ECX_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, 2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EBP_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, 3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax)" "\n"
+    "movl " STRINGIZE_VALUE_OF(PROBE_CPU_EIP_OFFSET) "(%ebp), %ecx" "\n"
+    "movl %ecx, 4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%eax)" "\n"
+    "movl %eax, %esp" "\n"
+
+    "popfd" "\n"
+    "popl %eax" "\n"
+    "popl %ecx" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+#endif // CPU(X86)
+
+#if CPU(X86_64)
+asm (
+    ".globl " SYMBOL_STRING(ctiMasmProbeTrampoline) "\n"
+    HIDE_SYMBOL(ctiMasmProbeTrampoline) "\n"
+    SYMBOL_STRING(ctiMasmProbeTrampoline) ":" "\n"
+
+    "pushfq" "\n"
+
+    // MacroAssemblerX86Common::probe() has already generated code to store some values.
+    // Together with the rflags pushed above, the top of stack now looks like
+    // this:
+    //     esp[0 * ptrSize]: rflags
+    //     esp[1 * ptrSize]: return address / saved rip
+    //     esp[2 * ptrSize]: probeFunction
+    //     esp[3 * ptrSize]: arg1
+    //     esp[4 * ptrSize]: arg2
+    //     esp[5 * ptrSize]: saved rax
+    //     esp[6 * ptrSize]: saved rsp
+
+    "movq %rsp, %rax" "\n"
+    "subq $" STRINGIZE_VALUE_OF(PROBE_SIZE) ", %rsp" "\n"
+
+    // The X86_64 ABI specifies that the worse case stack alignment requirement
+    // is 32 bytes.
+    "andq $~0x1f, %rsp" "\n"
+
+    "movq %rbp, " STRINGIZE_VALUE_OF(PROBE_CPU_EBP_OFFSET) "(%rsp)" "\n"
+    "movq %rsp, %rbp" "\n" // Save the ProbeContext*.
+
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_ECX_OFFSET) "(%rbp)" "\n"
+    "movq %rdx, " STRINGIZE_VALUE_OF(PROBE_CPU_EDX_OFFSET) "(%rbp)" "\n"
+    "movq %rbx, " STRINGIZE_VALUE_OF(PROBE_CPU_EBX_OFFSET) "(%rbp)" "\n"
+    "movq %rsi, " STRINGIZE_VALUE_OF(PROBE_CPU_ESI_OFFSET) "(%rbp)" "\n"
+    "movq %rdi, " STRINGIZE_VALUE_OF(PROBE_CPU_EDI_OFFSET) "(%rbp)" "\n"
+
+    "movq 0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) "(%rbp)" "\n"
+    "movq 1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_EIP_OFFSET) "(%rbp)" "\n"
+    "movq 2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "(%rbp)" "\n"
+    "movq 3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_ARG1_OFFSET) "(%rbp)" "\n"
+    "movq 4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_ARG2_OFFSET) "(%rbp)" "\n"
+    "movq 5 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) "(%rbp)" "\n"
+    "movq 6 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%rbp)" "\n"
+
+    "movq %r8, " STRINGIZE_VALUE_OF(PROBE_CPU_R8_OFFSET) "(%rbp)" "\n"
+    "movq %r9, " STRINGIZE_VALUE_OF(PROBE_CPU_R9_OFFSET) "(%rbp)" "\n"
+    "movq %r10, " STRINGIZE_VALUE_OF(PROBE_CPU_R10_OFFSET) "(%rbp)" "\n"
+    "movq %r11, " STRINGIZE_VALUE_OF(PROBE_CPU_R11_OFFSET) "(%rbp)" "\n"
+    "movq %r12, " STRINGIZE_VALUE_OF(PROBE_CPU_R12_OFFSET) "(%rbp)" "\n"
+    "movq %r13, " STRINGIZE_VALUE_OF(PROBE_CPU_R13_OFFSET) "(%rbp)" "\n"
+    "movq %r14, " STRINGIZE_VALUE_OF(PROBE_CPU_R14_OFFSET) "(%rbp)" "\n"
+    "movq %r15, " STRINGIZE_VALUE_OF(PROBE_CPU_R15_OFFSET) "(%rbp)" "\n"
+
+    "movq %xmm0, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM0_OFFSET) "(%rbp)" "\n"
+    "movq %xmm1, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM1_OFFSET) "(%rbp)" "\n"
+    "movq %xmm2, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM2_OFFSET) "(%rbp)" "\n"
+    "movq %xmm3, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM3_OFFSET) "(%rbp)" "\n"
+    "movq %xmm4, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM4_OFFSET) "(%rbp)" "\n"
+    "movq %xmm5, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM5_OFFSET) "(%rbp)" "\n"
+    "movq %xmm6, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM6_OFFSET) "(%rbp)" "\n"
+    "movq %xmm7, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM7_OFFSET) "(%rbp)" "\n"
+    "movq %xmm8, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM8_OFFSET) "(%rbp)" "\n"
+    "movq %xmm9, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM9_OFFSET) "(%rbp)" "\n"
+    "movq %xmm10, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM10_OFFSET) "(%rbp)" "\n"
+    "movq %xmm11, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM11_OFFSET) "(%rbp)" "\n"
+    "movq %xmm12, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM12_OFFSET) "(%rbp)" "\n"
+    "movq %xmm13, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM13_OFFSET) "(%rbp)" "\n"
+    "movq %xmm14, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM14_OFFSET) "(%rbp)" "\n"
+    "movq %xmm15, " STRINGIZE_VALUE_OF(PROBE_CPU_XMM15_OFFSET) "(%rbp)" "\n"
+
+    "movq %rbp, %rdi" "\n" // the ProbeContext* arg.
+    "call *" STRINGIZE_VALUE_OF(PROBE_PROBE_FUNCTION_OFFSET) "(%rbp)" "\n"
+
+    // To enable probes to modify register state, we copy all registers
+    // out of the ProbeContext before returning.
+
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EDX_OFFSET) "(%rbp), %rdx" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EBX_OFFSET) "(%rbp), %rbx" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_ESI_OFFSET) "(%rbp), %rsi" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EDI_OFFSET) "(%rbp), %rdi" "\n"
+
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_R8_OFFSET) "(%rbp), %r8" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_R9_OFFSET) "(%rbp), %r9" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_R10_OFFSET) "(%rbp), %r10" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_R11_OFFSET) "(%rbp), %r11" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_R12_OFFSET) "(%rbp), %r12" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_R13_OFFSET) "(%rbp), %r13" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_R14_OFFSET) "(%rbp), %r14" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_R15_OFFSET) "(%rbp), %r15" "\n"
+
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM0_OFFSET) "(%rbp), %xmm0" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM1_OFFSET) "(%rbp), %xmm1" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM2_OFFSET) "(%rbp), %xmm2" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM3_OFFSET) "(%rbp), %xmm3" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM4_OFFSET) "(%rbp), %xmm4" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM5_OFFSET) "(%rbp), %xmm5" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM6_OFFSET) "(%rbp), %xmm6" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM7_OFFSET) "(%rbp), %xmm7" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM8_OFFSET) "(%rbp), %xmm8" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM9_OFFSET) "(%rbp), %xmm9" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM10_OFFSET) "(%rbp), %xmm10" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM11_OFFSET) "(%rbp), %xmm11" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM12_OFFSET) "(%rbp), %xmm12" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM13_OFFSET) "(%rbp), %xmm13" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM14_OFFSET) "(%rbp), %xmm14" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_XMM15_OFFSET) "(%rbp), %xmm15" "\n"
+
+    // There are 6 more registers left to restore:
+    //     rax, rcx, rbp, rsp, rip, and rflags.
+    // We need to handle these last few restores carefully because:
+    //
+    // 1. We need to push the return address on the stack for ret to use
+    //    That means we need to write to the stack.
+    // 2. The user probe function may have altered the restore value of esp to
+    //    point to the vicinity of one of the restore values for the remaining
+    //    registers left to be restored.
+    //    That means, for requirement 1, we may end up writing over some of the
+    //    restore values. We can check for this, and first copy the restore
+    //    values to a "safe area" on the stack before commencing with the action
+    //    for requirement 1.
+    // 3. For both requirement 2, we need to ensure that the "safe area" is
+    //    protected from interrupt handlers overwriting it. Hence, the esp needs
+    //    to be adjusted to include the "safe area" before we start copying the
+    //    the restore values.
+
+    "movq %rbp, %rax" "\n"
+    "addq $" STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) ", %rax" "\n"
+    "cmpq %rax, " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%rbp)" "\n"
+    "jg " SYMBOL_STRING(ctiMasmProbeTrampolineEnd) "\n"
+
+    // Locate the "safe area" at 2x sizeof(ProbeContext) below where the new
+    // rsp will be. This time we don't have to 32-byte align it because we're
+    // not using to store any xmm regs.
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%rbp), %rax" "\n"
+    "subq $2 * " STRINGIZE_VALUE_OF(PROBE_SIZE) ", %rax" "\n"
+    "movq %rax, %rsp" "\n"
+
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_ECX_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_ECX_OFFSET) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EBP_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_EBP_OFFSET) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EIP_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_EIP_OFFSET) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, " STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) "(%rax)" "\n"
+    "movq %rax, %rbp" "\n"
+
+    SYMBOL_STRING(ctiMasmProbeTrampolineEnd) ":" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_ESP_OFFSET) "(%rbp), %rax" "\n"
+    "subq $5 * " STRINGIZE_VALUE_OF(PTR_SIZE) ", %rax" "\n"
+    // At this point, %rsp should be < %rax.
+
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EFLAGS_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, 0 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EAX_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, 1 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_ECX_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, 2 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EBP_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, 3 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax)" "\n"
+    "movq " STRINGIZE_VALUE_OF(PROBE_CPU_EIP_OFFSET) "(%rbp), %rcx" "\n"
+    "movq %rcx, 4 * " STRINGIZE_VALUE_OF(PTR_SIZE) "(%rax)" "\n"
+    "movq %rax, %rsp" "\n"
+
+    "popfq" "\n"
+    "popq %rax" "\n"
+    "popq %rcx" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+#endif // CPU(X86_64)
+
+#endif // COMPILER(GCC_OR_CLANG)
+
+// What code is emitted for the probe?
+// ==================================
+// We want to keep the size of the emitted probe invocation code as compact as
+// possible to minimize the perturbation to the JIT generated code. However,
+// we also need to preserve the CPU registers and set up the ProbeContext to be
+// passed to the user probe function.
+//
+// Hence, we do only the minimum here to preserve a scratch register (i.e. rax
+// in this case) and the stack pointer (i.e. rsp), and pass the probe arguments.
+// We'll let the ctiMasmProbeTrampoline handle the rest of the probe invocation
+// work i.e. saving the CPUState (and setting up the ProbeContext), calling the
+// user probe function, and restoring the CPUState before returning to JIT
+// generated code.
+//
+// What registers need to be saved?
+// ===============================
+// The registers are saved for 2 reasons:
+// 1. To preserve their state in the JITted code. This means that all registers
+//    that are not callee saved needs to be saved. We also need to save the
+//    condition code registers because the probe can be inserted between a test
+//    and a branch.
+// 2. To allow the probe to inspect the values of the registers for debugging
+//    purposes. This means all registers need to be saved.
+//
+// In summary, save everything. But for reasons stated above, we should do the
+// minimum here and let ctiMasmProbeTrampoline do the heavy lifting to save the
+// full set.
+//
+// What values are in the saved registers?
+// ======================================
+// Conceptually, the saved registers should contain values as if the probe
+// is not present in the JIT generated code. Hence, they should contain values
+// that are expected at the start of the instruction immediately following the
+// probe.
+//
+// Specifically, the saved stack pointer register will point to the stack
+// position before we push the ProbeContext frame. The saved rip will point to
+// the address of the instruction immediately following the probe. 
+
+void MacroAssemblerX86Common::probe(MacroAssemblerX86Common::ProbeFunction function, void* arg1, void* arg2)
+{
+    push(RegisterID::esp);
+    push(RegisterID::eax);
+    move(TrustedImmPtr(arg2), RegisterID::eax);
+    push(RegisterID::eax);
+    move(TrustedImmPtr(arg1), RegisterID::eax);
+    push(RegisterID::eax);
+    move(TrustedImmPtr(reinterpret_cast<void*>(function)), RegisterID::eax);
+    push(RegisterID::eax);
+    move(TrustedImmPtr(reinterpret_cast<void*>(ctiMasmProbeTrampoline)), RegisterID::eax);
+    call(RegisterID::eax);
+}
+
+#endif // ENABLE(MASM_PROBE)
+
+#if CPU(X86) && !OS(MAC_OS_X)
+MacroAssemblerX86Common::SSE2CheckState MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;
+#endif
+
+MacroAssemblerX86Common::CPUIDCheckState MacroAssemblerX86Common::s_sse4_1CheckState = CPUIDCheckState::NotChecked;
+MacroAssemblerX86Common::CPUIDCheckState MacroAssemblerX86Common::s_avxCheckState = CPUIDCheckState::NotChecked;
+MacroAssemblerX86Common::CPUIDCheckState MacroAssemblerX86Common::s_lzcntCheckState = CPUIDCheckState::NotChecked;
+MacroAssemblerX86Common::CPUIDCheckState MacroAssemblerX86Common::s_bmi1CheckState = CPUIDCheckState::NotChecked;
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && (CPU(X86) || CPU(X86_64))
diff --git a/assembler/MacroAssemblerX86Common.h b/assembler/MacroAssemblerX86Common.h
new file mode 100644
index 0000000..dcc778e
--- /dev/null
+++ b/assembler/MacroAssemblerX86Common.h
@@ -0,0 +1,3071 @@
+/*
+ * Copyright (C) 2008, 2014-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER)
+
+#include "X86Assembler.h"
+#include "AbstractMacroAssembler.h"
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler, MacroAssemblerX86Common> {
+public:
+#if CPU(X86_64)
+    // Use this directly only if you're not generating code with it.
+    static const X86Registers::RegisterID s_scratchRegister = X86Registers::r11;
+
+    // Use this when generating code so that we get enforcement of the disallowing of scratch register
+    // usage.
+    X86Registers::RegisterID scratchRegister()
+    {
+        RELEASE_ASSERT(m_allowScratchRegister);
+        return s_scratchRegister;
+    }
+#endif
+    
+protected:
+    static const int DoubleConditionBitInvert = 0x10;
+    static const int DoubleConditionBitSpecial = 0x20;
+    static const int DoubleConditionBits = DoubleConditionBitInvert | DoubleConditionBitSpecial;
+
+public:
+    typedef X86Assembler::XMMRegisterID XMMRegisterID;
+    
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return value >= -128 && value <= 127;
+    }
+
+    enum RelationalCondition {
+        Equal = X86Assembler::ConditionE,
+        NotEqual = X86Assembler::ConditionNE,
+        Above = X86Assembler::ConditionA,
+        AboveOrEqual = X86Assembler::ConditionAE,
+        Below = X86Assembler::ConditionB,
+        BelowOrEqual = X86Assembler::ConditionBE,
+        GreaterThan = X86Assembler::ConditionG,
+        GreaterThanOrEqual = X86Assembler::ConditionGE,
+        LessThan = X86Assembler::ConditionL,
+        LessThanOrEqual = X86Assembler::ConditionLE
+    };
+
+    enum ResultCondition {
+        Overflow = X86Assembler::ConditionO,
+        Signed = X86Assembler::ConditionS,
+        PositiveOrZero = X86Assembler::ConditionNS,
+        Zero = X86Assembler::ConditionE,
+        NonZero = X86Assembler::ConditionNE
+    };
+
+    // FIXME: it would be neat to rename this to FloatingPointCondition in every assembler.
+    enum DoubleCondition {
+        // These conditions will only evaluate to true if the comparison is ordered - i.e. neither operand is NaN.
+        DoubleEqual = X86Assembler::ConditionE | DoubleConditionBitSpecial,
+        DoubleNotEqual = X86Assembler::ConditionNE,
+        DoubleGreaterThan = X86Assembler::ConditionA,
+        DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
+        DoubleLessThan = X86Assembler::ConditionA | DoubleConditionBitInvert,
+        DoubleLessThanOrEqual = X86Assembler::ConditionAE | DoubleConditionBitInvert,
+        // If either operand is NaN, these conditions always evaluate to true.
+        DoubleEqualOrUnordered = X86Assembler::ConditionE,
+        DoubleNotEqualOrUnordered = X86Assembler::ConditionNE | DoubleConditionBitSpecial,
+        DoubleGreaterThanOrUnordered = X86Assembler::ConditionB | DoubleConditionBitInvert,
+        DoubleGreaterThanOrEqualOrUnordered = X86Assembler::ConditionBE | DoubleConditionBitInvert,
+        DoubleLessThanOrUnordered = X86Assembler::ConditionB,
+        DoubleLessThanOrEqualOrUnordered = X86Assembler::ConditionBE,
+    };
+    COMPILE_ASSERT(
+        !((X86Assembler::ConditionE | X86Assembler::ConditionNE | X86Assembler::ConditionA | X86Assembler::ConditionAE | X86Assembler::ConditionB | X86Assembler::ConditionBE) & DoubleConditionBits),
+        DoubleConditionBits_should_not_interfere_with_X86Assembler_Condition_codes);
+
+    static const RegisterID stackPointerRegister = X86Registers::esp;
+    static const RegisterID framePointerRegister = X86Registers::ebp;
+    
+    static bool canBlind() { return true; }
+    static bool shouldBlindForSpecificArch(uint32_t value) { return value >= 0x00ffffff; }
+    static bool shouldBlindForSpecificArch(uint64_t value) { return value >= 0x00ffffff; }
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an TrustedImm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addl_rr(src, dest);
+    }
+
+    void add32(TrustedImm32 imm, Address address)
+    {
+        m_assembler.addl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void add32(TrustedImm32 imm, BaseIndex address)
+    {
+        m_assembler.addl_im(imm.m_value, address.offset, address.base, address.index, address.scale);
+    }
+
+    void add8(TrustedImm32 imm, Address address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        m_assembler.addb_im(imm8.m_value, address.offset, address.base);
+    }
+
+    void add8(TrustedImm32 imm, BaseIndex address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        m_assembler.addb_im(imm8.m_value, address.offset, address.base, address.index, address.scale);
+    }
+
+    void add16(TrustedImm32 imm, Address address)
+    {
+        m_assembler.addw_im(imm.m_value, address.offset, address.base);
+    }
+
+    void add16(TrustedImm32 imm, BaseIndex address)
+    {
+        m_assembler.addw_im(imm.m_value, address.offset, address.base, address.index, address.scale);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value == 1)
+            m_assembler.inc_r(dest);
+        else
+            m_assembler.addl_ir(imm.m_value, dest);
+    }
+    
+    void add32(Address src, RegisterID dest)
+    {
+        m_assembler.addl_mr(src.offset, src.base, dest);
+    }
+
+    void add32(RegisterID src, Address dest)
+    {
+        m_assembler.addl_rm(src, dest.offset, dest.base);
+    }
+
+    void add32(RegisterID src, BaseIndex dest)
+    {
+        m_assembler.addl_rm(src, dest.offset, dest.base, dest.index, dest.scale);
+    }
+
+    void add8(RegisterID src, Address dest)
+    {
+        m_assembler.addb_rm(src, dest.offset, dest.base);
+    }
+
+    void add8(RegisterID src, BaseIndex dest)
+    {
+        m_assembler.addb_rm(src, dest.offset, dest.base, dest.index, dest.scale);
+    }
+
+    void add16(RegisterID src, Address dest)
+    {
+        m_assembler.addw_rm(src, dest.offset, dest.base);
+    }
+
+    void add16(RegisterID src, BaseIndex dest)
+    {
+        m_assembler.addw_rm(src, dest.offset, dest.base, dest.index, dest.scale);
+    }
+
+    void add32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        if (!imm.m_value) {
+            zeroExtend32ToPtr(src, dest);
+            return;
+        }
+
+        if (src == dest) {
+            add32(imm, dest);
+            return;
+        }
+
+        m_assembler.leal_mr(imm.m_value, src, dest);
+    }
+
+    void add32(RegisterID a, RegisterID b, RegisterID dest)
+    {
+        x86Lea32(BaseIndex(a, b, TimesOne), dest);
+    }
+
+    void x86Lea32(BaseIndex index, RegisterID dest)
+    {
+        if (!index.scale && !index.offset) {
+            if (index.base == dest) {
+                add32(index.index, dest);
+                return;
+            }
+            if (index.index == dest) {
+                add32(index.base, dest);
+                return;
+            }
+        }
+        m_assembler.leal_mr(index.offset, index.base, index.index, index.scale, dest);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andl_rr(src, dest);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.andl_ir(imm.m_value, dest);
+    }
+
+    void and32(RegisterID src, Address dest)
+    {
+        m_assembler.andl_rm(src, dest.offset, dest.base);
+    }
+
+    void and32(Address src, RegisterID dest)
+    {
+        m_assembler.andl_mr(src.offset, src.base, dest);
+    }
+
+    void and32(TrustedImm32 imm, Address address)
+    {
+        m_assembler.andl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void and32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            zeroExtend32ToPtr(op1, dest);
+        else if (op1 == dest)
+            and32(op2, dest);
+        else {
+            move32IfNeeded(op2, dest);
+            and32(op1, dest);
+        }
+    }
+
+    void and32(Address op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest)
+            and32(op1, dest);
+        else if (op1.base == dest) {
+            load32(op1, dest);
+            and32(op2, dest);
+        } else {
+            zeroExtend32ToPtr(op2, dest);
+            and32(op1, dest);
+        }
+    }
+
+    void and32(RegisterID op1, Address op2, RegisterID dest)
+    {
+        and32(op2, op1, dest);
+    }
+
+    void and32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move32IfNeeded(src, dest);
+        and32(imm, dest);
+    }
+
+    void countLeadingZeros32(RegisterID src, RegisterID dst)
+    {
+        if (supportsLZCNT()) {
+            m_assembler.lzcnt_rr(src, dst);
+            return;
+        }
+        m_assembler.bsr_rr(src, dst);
+        clz32AfterBsr(dst);
+    }
+
+    void countLeadingZeros32(Address src, RegisterID dst)
+    {
+        if (supportsLZCNT()) {
+            m_assembler.lzcnt_mr(src.offset, src.base, dst);
+            return;
+        }
+        m_assembler.bsr_mr(src.offset, src.base, dst);
+        clz32AfterBsr(dst);
+    }
+
+    void countTrailingZeros32(RegisterID src, RegisterID dst)
+    {
+        if (supportsBMI1()) {
+            m_assembler.tzcnt_rr(src, dst);
+            return;
+        }
+        m_assembler.bsf_rr(src, dst);
+        ctzAfterBsf<32>(dst);
+    }
+
+    // Only used for testing purposes.
+    void illegalInstruction()
+    {
+        m_assembler.illegalInstruction();
+    }
+    
+    void lshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        if (shift_amount == X86Registers::ecx)
+            m_assembler.shll_CLr(dest);
+        else {
+            ASSERT(shift_amount != dest);
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
+            swap(shift_amount, X86Registers::ecx);
+            m_assembler.shll_CLr(dest == X86Registers::ecx ? shift_amount : dest);
+            swap(shift_amount, X86Registers::ecx);
+        }
+    }
+
+    void lshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
+    {
+        ASSERT(shift_amount != dest);
+
+        move32IfNeeded(src, dest);
+        lshift32(shift_amount, dest);
+    }
+
+    void lshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shll_i8r(imm.m_value, dest);
+    }
+    
+    void lshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move32IfNeeded(src, dest);
+        lshift32(imm, dest);
+    }
+    
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.imull_rr(src, dest);
+    }
+
+    void mul32(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src2 == dest) {
+            m_assembler.imull_rr(src1, dest);
+            return;
+        }
+        move32IfNeeded(src1, dest);
+        m_assembler.imull_rr(src2, dest);
+    }
+
+    void mul32(Address src, RegisterID dest)
+    {
+        m_assembler.imull_mr(src.offset, src.base, dest);
+    }
+
+    void mul32(Address op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest)
+            mul32(op1, dest);
+        else if (op1.base == dest) {
+            load32(op1, dest);
+            mul32(op2, dest);
+        } else {
+            zeroExtend32ToPtr(op2, dest);
+            mul32(op1, dest);
+        }
+    }
+
+    void mul32(RegisterID src1, Address src2, RegisterID dest)
+    {
+        mul32(src2, src1, dest);
+    }
+    
+    void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.imull_i32r(src, imm.m_value, dest);
+    }
+
+    void x86ConvertToDoubleWord32()
+    {
+        m_assembler.cdq();
+    }
+
+    void x86ConvertToDoubleWord32(RegisterID eax, RegisterID edx)
+    {
+        ASSERT_UNUSED(eax, eax == X86Registers::eax);
+        ASSERT_UNUSED(edx, edx == X86Registers::edx);
+        x86ConvertToDoubleWord32();
+    }
+
+    void x86Div32(RegisterID denominator)
+    {
+        m_assembler.idivl_r(denominator);
+    }
+
+    void x86Div32(RegisterID eax, RegisterID edx, RegisterID denominator)
+    {
+        ASSERT_UNUSED(eax, eax == X86Registers::eax);
+        ASSERT_UNUSED(edx, edx == X86Registers::edx);
+        x86Div32(denominator);
+    }
+
+    void x86UDiv32(RegisterID denominator)
+    {
+        m_assembler.divl_r(denominator);
+    }
+
+    void x86UDiv32(RegisterID eax, RegisterID edx, RegisterID denominator)
+    {
+        ASSERT_UNUSED(eax, eax == X86Registers::eax);
+        ASSERT_UNUSED(edx, edx == X86Registers::edx);
+        x86UDiv32(denominator);
+    }
+
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.negl_r(srcDest);
+    }
+
+    void neg32(Address srcDest)
+    {
+        m_assembler.negl_m(srcDest.offset, srcDest.base);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orl_rr(src, dest);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.orl_ir(imm.m_value, dest);
+    }
+
+    void or32(RegisterID src, Address dest)
+    {
+        m_assembler.orl_rm(src, dest.offset, dest.base);
+    }
+
+    void or32(Address src, RegisterID dest)
+    {
+        m_assembler.orl_mr(src.offset, src.base, dest);
+    }
+
+    void or32(TrustedImm32 imm, Address address)
+    {
+        m_assembler.orl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void or32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            zeroExtend32ToPtr(op1, dest);
+        else if (op1 == dest)
+            or32(op2, dest);
+        else {
+            move32IfNeeded(op2, dest);
+            or32(op1, dest);
+        }
+    }
+
+    void or32(Address op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest)
+            or32(op1, dest);
+        else if (op1.base == dest) {
+            load32(op1, dest);
+            or32(op2, dest);
+        } else {
+            zeroExtend32ToPtr(op2, dest);
+            or32(op1, dest);
+        }
+    }
+
+    void or32(RegisterID op1, Address op2, RegisterID dest)
+    {
+        or32(op2, op1, dest);
+    }
+
+    void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move32IfNeeded(src, dest);
+        or32(imm, dest);
+    }
+
+    void rshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        if (shift_amount == X86Registers::ecx)
+            m_assembler.sarl_CLr(dest);
+        else {
+            ASSERT(shift_amount != dest);
+            
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
+            swap(shift_amount, X86Registers::ecx);
+            m_assembler.sarl_CLr(dest == X86Registers::ecx ? shift_amount : dest);
+            swap(shift_amount, X86Registers::ecx);
+        }
+    }
+
+    void rshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
+    {
+        ASSERT(shift_amount != dest);
+
+        move32IfNeeded(src, dest);
+        rshift32(shift_amount, dest);
+    }
+
+    void rshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.sarl_i8r(imm.m_value, dest);
+    }
+    
+    void rshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move32IfNeeded(src, dest);
+        rshift32(imm, dest);
+    }
+    
+    void urshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        if (shift_amount == X86Registers::ecx)
+            m_assembler.shrl_CLr(dest);
+        else {
+            ASSERT(shift_amount != dest);
+        
+            // On x86 we can only shift by ecx; if asked to shift by another register we'll
+            // need rejig the shift amount into ecx first, and restore the registers afterwards.
+            // If we dest is ecx, then shift the swapped register!
+            swap(shift_amount, X86Registers::ecx);
+            m_assembler.shrl_CLr(dest == X86Registers::ecx ? shift_amount : dest);
+            swap(shift_amount, X86Registers::ecx);
+        }
+    }
+
+    void urshift32(RegisterID src, RegisterID shift_amount, RegisterID dest)
+    {
+        ASSERT(shift_amount != dest);
+
+        move32IfNeeded(src, dest);
+        urshift32(shift_amount, dest);
+    }
+
+    void urshift32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shrl_i8r(imm.m_value, dest);
+    }
+    
+    void urshift32(RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move32IfNeeded(src, dest);
+        urshift32(imm, dest);
+    }
+
+    void rotateRight32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.rorl_i8r(imm.m_value, dest);
+    }
+
+    void rotateRight32(RegisterID src, RegisterID dest)
+    {
+        if (src == X86Registers::ecx)
+            m_assembler.rorl_CLr(dest);
+        else {
+            ASSERT(src != dest);
+
+            // Can only rotate by ecx, so we do some swapping if we see anything else.
+            swap(src, X86Registers::ecx);
+            m_assembler.rorl_CLr(dest == X86Registers::ecx ? src : dest);
+            swap(src, X86Registers::ecx);
+        }
+    }
+
+    void rotateLeft32(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.roll_i8r(imm.m_value, dest);
+    }
+
+    void rotateLeft32(RegisterID src, RegisterID dest)
+    {
+        if (src == X86Registers::ecx)
+            m_assembler.roll_CLr(dest);
+        else {
+            ASSERT(src != dest);
+
+            // Can only rotate by ecx, so we do some swapping if we see anything else.
+            swap(src, X86Registers::ecx);
+            m_assembler.roll_CLr(dest == X86Registers::ecx ? src : dest);
+            swap(src, X86Registers::ecx);
+        }
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subl_rr(src, dest);
+    }
+
+    void sub32(RegisterID left, RegisterID right, RegisterID dest)
+    {
+        if (dest == right) {
+            neg32(dest);
+            add32(left, dest);
+            return;
+        }
+        move(left, dest);
+        sub32(right, dest);
+    }
+
+    void sub32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value == 1)
+            m_assembler.dec_r(dest);
+        else
+            m_assembler.subl_ir(imm.m_value, dest);
+    }
+    
+    void sub32(TrustedImm32 imm, Address address)
+    {
+        m_assembler.subl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        m_assembler.subl_mr(src.offset, src.base, dest);
+    }
+
+    void sub32(RegisterID src, Address dest)
+    {
+        m_assembler.subl_rm(src, dest.offset, dest.base);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorl_rr(src, dest);
+    }
+
+    void xor32(TrustedImm32 imm, Address dest)
+    {
+        if (imm.m_value == -1)
+            m_assembler.notl_m(dest.offset, dest.base);
+        else
+            m_assembler.xorl_im(imm.m_value, dest.offset, dest.base);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value == -1)
+            m_assembler.notl_r(dest);
+        else
+            m_assembler.xorl_ir(imm.m_value, dest);
+    }
+
+    void xor32(RegisterID src, Address dest)
+    {
+        m_assembler.xorl_rm(src, dest.offset, dest.base);
+    }
+
+    void xor32(Address src, RegisterID dest)
+    {
+        m_assembler.xorl_mr(src.offset, src.base, dest);
+    }
+    
+    void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            move(TrustedImm32(0), dest);
+        else if (op1 == dest)
+            xor32(op2, dest);
+        else {
+            move32IfNeeded(op2, dest);
+            xor32(op1, dest);
+        }
+    }
+
+    void xor32(Address op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest)
+            xor32(op1, dest);
+        else if (op1.base == dest) {
+            load32(op1, dest);
+            xor32(op2, dest);
+        } else {
+            zeroExtend32ToPtr(op2, dest);
+            xor32(op1, dest);
+        }
+    }
+
+    void xor32(RegisterID op1, Address op2, RegisterID dest)
+    {
+        xor32(op2, op1, dest);
+    }
+
+    void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move32IfNeeded(src, dest);
+        xor32(imm, dest);
+    }
+
+    void not32(RegisterID srcDest)
+    {
+        m_assembler.notl_r(srcDest);
+    }
+
+    void not32(Address dest)
+    {
+        m_assembler.notl_m(dest.offset, dest.base);
+    }
+
+    void sqrtDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.sqrtsd_rr(src, dst);
+    }
+
+    void sqrtDouble(Address src, FPRegisterID dst)
+    {
+        m_assembler.sqrtsd_mr(src.offset, src.base, dst);
+    }
+
+    void sqrtFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.sqrtss_rr(src, dst);
+    }
+
+    void sqrtFloat(Address src, FPRegisterID dst)
+    {
+        m_assembler.sqrtss_mr(src.offset, src.base, dst);
+    }
+
+    void absDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        ASSERT(src != dst);
+        static const double negativeZeroConstant = -0.0;
+        loadDouble(TrustedImmPtr(&negativeZeroConstant), dst);
+        m_assembler.andnpd_rr(src, dst);
+    }
+
+    void negateDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        ASSERT(src != dst);
+        static const double negativeZeroConstant = -0.0;
+        loadDouble(TrustedImmPtr(&negativeZeroConstant), dst);
+        m_assembler.xorpd_rr(src, dst);
+    }
+
+    void ceilDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.roundsd_rr(src, dst, X86Assembler::RoundingType::TowardInfiniti);
+    }
+
+    void ceilDouble(Address src, FPRegisterID dst)
+    {
+        m_assembler.roundsd_mr(src.offset, src.base, dst, X86Assembler::RoundingType::TowardInfiniti);
+    }
+
+    void ceilFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.roundss_rr(src, dst, X86Assembler::RoundingType::TowardInfiniti);
+    }
+
+    void ceilFloat(Address src, FPRegisterID dst)
+    {
+        m_assembler.roundss_mr(src.offset, src.base, dst, X86Assembler::RoundingType::TowardInfiniti);
+    }
+
+    void floorDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.roundsd_rr(src, dst, X86Assembler::RoundingType::TowardNegativeInfiniti);
+    }
+
+    void floorDouble(Address src, FPRegisterID dst)
+    {
+        m_assembler.roundsd_mr(src.offset, src.base, dst, X86Assembler::RoundingType::TowardNegativeInfiniti);
+    }
+
+    void floorFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.roundss_rr(src, dst, X86Assembler::RoundingType::TowardNegativeInfiniti);
+    }
+
+    void floorFloat(Address src, FPRegisterID dst)
+    {
+        m_assembler.roundss_mr(src.offset, src.base, dst, X86Assembler::RoundingType::TowardNegativeInfiniti);
+    }
+
+    void roundTowardNearestIntDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.roundsd_rr(src, dst, X86Assembler::RoundingType::ToNearestWithTiesToEven);
+    }
+
+    void roundTowardNearestIntFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.roundss_rr(src, dst, X86Assembler::RoundingType::ToNearestWithTiesToEven);
+    }
+
+    void roundTowardZeroDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.roundsd_rr(src, dst, X86Assembler::RoundingType::TowardZero);
+    }
+
+    void roundTowardZeroDouble(Address src, FPRegisterID dst)
+    {
+        m_assembler.roundsd_mr(src.offset, src.base, dst, X86Assembler::RoundingType::TowardZero);
+    }
+
+    void roundTowardZeroFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.roundss_rr(src, dst, X86Assembler::RoundingType::TowardZero);
+    }
+
+    void roundTowardZeroFloat(Address src, FPRegisterID dst)
+    {
+        m_assembler.roundss_mr(src.offset, src.base, dst, X86Assembler::RoundingType::TowardZero);
+    }
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an TrustedImm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address.offset, address.base, dest);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    void load32WithUnalignedHalfWords(BaseIndex address, RegisterID dest)
+    {
+        load32(address, dest);
+    }
+
+    void load16Unaligned(BaseIndex address, RegisterID dest)
+    {
+        load16(address, dest);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        padBeforePatch();
+        m_assembler.movl_mr_disp32(address.offset, address.base, dest);
+        return DataLabel32(this);
+    }
+    
+    DataLabelCompact load32WithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        padBeforePatch();
+        m_assembler.movl_mr_disp8(address.offset, address.base, dest);
+        return DataLabelCompact(this);
+    }
+    
+    static void repatchCompact(CodeLocationDataLabelCompact dataLabelCompact, int32_t value)
+    {
+        ASSERT(isCompactPtrAlignedAddressOffset(value));
+        AssemblerType_T::repatchCompact(dataLabelCompact.dataLocation(), value);
+    }
+    
+    DataLabelCompact loadCompactWithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        padBeforePatch();
+        m_assembler.movl_mr_disp8(address.offset, address.base, dest);
+        return DataLabelCompact(this);
+    }
+
+    void load8(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movzbl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    void load8(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.movzbl_mr(address.offset, address.base, dest);
+    }
+    
+    void load8SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movsbl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    void load8SignedExtendTo32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.movsbl_mr(address.offset, address.base, dest);
+    }
+
+    void zeroExtend8To32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movzbl_rr(src, dest);
+    }
+    
+    void signExtend8To32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movsbl_rr(src, dest);
+    }
+    
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movzwl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+    
+    void load16(Address address, RegisterID dest)
+    {
+        m_assembler.movzwl_mr(address.offset, address.base, dest);
+    }
+
+    void load16SignedExtendTo32(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movswl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+    
+    void load16SignedExtendTo32(Address address, RegisterID dest)
+    {
+        m_assembler.movswl_mr(address.offset, address.base, dest);
+    }
+
+    void zeroExtend16To32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movzwl_rr(src, dest);
+    }
+    
+    void signExtend16To32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movswl_rr(src, dest);
+    }
+    
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        padBeforePatch();
+        m_assembler.movl_rm_disp32(src, address.offset, address.base);
+        return DataLabel32(this);
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.movl_rm(src, address.offset, address.base);
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        m_assembler.movl_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+
+    void store32(TrustedImm32 imm, ImplicitAddress address)
+    {
+        m_assembler.movl_i32m(imm.m_value, address.offset, address.base);
+    }
+    
+    void store32(TrustedImm32 imm, BaseIndex address)
+    {
+        m_assembler.movl_i32m(imm.m_value, address.offset, address.base, address.index, address.scale);
+    }
+
+    void storeZero32(ImplicitAddress address)
+    {
+        store32(TrustedImm32(0), address);
+    }
+
+    void storeZero32(BaseIndex address)
+    {
+        store32(TrustedImm32(0), address);
+    }
+
+    void store8(TrustedImm32 imm, Address address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        m_assembler.movb_i8m(imm8.m_value, address.offset, address.base);
+    }
+
+    void store8(TrustedImm32 imm, BaseIndex address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        m_assembler.movb_i8m(imm8.m_value, address.offset, address.base, address.index, address.scale);
+    }
+
+    static ALWAYS_INLINE RegisterID getUnusedRegister(BaseIndex address)
+    {
+        if (address.base != X86Registers::eax && address.index != X86Registers::eax)
+            return X86Registers::eax;
+
+        if (address.base != X86Registers::ebx && address.index != X86Registers::ebx)
+            return X86Registers::ebx;
+
+        ASSERT(address.base != X86Registers::ecx && address.index != X86Registers::ecx);
+        return X86Registers::ecx;
+    }
+
+    static ALWAYS_INLINE RegisterID getUnusedRegister(Address address)
+    {
+        if (address.base != X86Registers::eax)
+            return X86Registers::eax;
+
+        ASSERT(address.base != X86Registers::edx);
+        return X86Registers::edx;
+    }
+
+    void store8(RegisterID src, BaseIndex address)
+    {
+#if CPU(X86)
+        // On 32-bit x86 we can only store from the first 4 registers;
+        // esp..edi are mapped to the 'h' registers!
+        if (src >= 4) {
+            // Pick a temporary register.
+            RegisterID temp = getUnusedRegister(address);
+
+            // Swap to the temporary register to perform the store.
+            swap(src, temp);
+            m_assembler.movb_rm(temp, address.offset, address.base, address.index, address.scale);
+            swap(src, temp);
+            return;
+        }
+#endif
+        m_assembler.movb_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+    
+    void store8(RegisterID src, Address address)
+    {
+#if CPU(X86)
+        // On 32-bit x86 we can only store from the first 4 registers;
+        // esp..edi are mapped to the 'h' registers!
+        if (src >= 4) {
+            // Pick a temporary register.
+            RegisterID temp = getUnusedRegister(address);
+
+            // Swap to the temporary register to perform the store.
+            swap(src, temp);
+            m_assembler.movb_rm(temp, address.offset, address.base);
+            swap(src, temp);
+            return;
+        }
+#endif
+        m_assembler.movb_rm(src, address.offset, address.base);
+    }
+
+    void store16(RegisterID src, BaseIndex address)
+    {
+#if CPU(X86)
+        // On 32-bit x86 we can only store from the first 4 registers;
+        // esp..edi are mapped to the 'h' registers!
+        if (src >= 4) {
+            // Pick a temporary register.
+            RegisterID temp = getUnusedRegister(address);
+
+            // Swap to the temporary register to perform the store.
+            swap(src, temp);
+            m_assembler.movw_rm(temp, address.offset, address.base, address.index, address.scale);
+            swap(src, temp);
+            return;
+        }
+#endif
+        m_assembler.movw_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+
+    void store16(RegisterID src, Address address)
+    {
+#if CPU(X86)
+        // On 32-bit x86 we can only store from the first 4 registers;
+        // esp..edi are mapped to the 'h' registers!
+        if (src >= 4) {
+            // Pick a temporary register.
+            RegisterID temp = getUnusedRegister(address);
+
+            // Swap to the temporary register to perform the store.
+            swap(src, temp);
+            m_assembler.movw_rm(temp, address.offset, address.base);
+            swap(src, temp);
+            return;
+        }
+#endif
+        m_assembler.movw_rm(src, address.offset, address.base);
+    }
+
+
+    // Floating-point operation:
+    //
+    // Presently only supports SSE, not x87 floating point.
+
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        if (src != dest)
+            m_assembler.movaps_rr(src, dest);
+    }
+
+    void loadDouble(TrustedImmPtr address, FPRegisterID dest)
+    {
+#if CPU(X86)
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_mr(address.m_value, dest);
+#else
+        move(address, scratchRegister());
+        loadDouble(scratchRegister(), dest);
+#endif
+    }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_mr(address.offset, address.base, dest);
+    }
+
+    void loadDouble(BaseIndex address, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    void loadFloat(ImplicitAddress address, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movss_mr(address.offset, address.base, dest);
+    }
+
+    void loadFloat(BaseIndex address, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movss_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_rm(src, address.offset, address.base);
+    }
+    
+    void storeDouble(FPRegisterID src, BaseIndex address)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+
+    void storeFloat(FPRegisterID src, ImplicitAddress address)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movss_rm(src, address.offset, address.base);
+    }
+
+    void storeFloat(FPRegisterID src, BaseIndex address)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movss_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+    
+    void convertDoubleToFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsd2ss_rr(src, dst);
+    }
+
+    void convertDoubleToFloat(Address address, FPRegisterID dst)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsd2ss_mr(address.offset, address.base, dst);
+    }
+
+    void convertFloatToDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtss2sd_rr(src, dst);
+    }
+
+    void convertFloatToDouble(Address address, FPRegisterID dst)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtss2sd_mr(address.offset, address.base, dst);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        addDouble(src, dest, dest);
+    }
+
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vaddsd_rr(op1, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op1 == dest)
+                m_assembler.addsd_rr(op2, dest);
+            else {
+                moveDouble(op2, dest);
+                m_assembler.addsd_rr(op1, dest);
+            }
+        }
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        addDouble(src, dest, dest);
+    }
+
+    void addDouble(Address op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vaddsd_mr(op1.offset, op1.base, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op2 == dest) {
+                m_assembler.addsd_mr(op1.offset, op1.base, dest);
+                return;
+            }
+
+            loadDouble(op1, dest);
+            addDouble(op2, dest);
+        }
+    }
+
+    void addDouble(FPRegisterID op1, Address op2, FPRegisterID dest)
+    {
+        addDouble(op2, op1, dest);
+    }
+
+    void addDouble(BaseIndex op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vaddsd_mr(op1.offset, op1.base, op1.index, op1.scale, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op2 == dest) {
+                m_assembler.addsd_mr(op1.offset, op1.base, op1.index, op1.scale, dest);
+                return;
+            }
+            loadDouble(op1, dest);
+            addDouble(op2, dest);
+        }
+    }
+
+    void addFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        addFloat(src, dest, dest);
+    }
+
+    void addFloat(Address src, FPRegisterID dest)
+    {
+        addFloat(src, dest, dest);
+    }
+
+    void addFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vaddss_rr(op1, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op1 == dest)
+                m_assembler.addss_rr(op2, dest);
+            else {
+                moveDouble(op2, dest);
+                m_assembler.addss_rr(op1, dest);
+            }
+        }
+    }
+
+    void addFloat(Address op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vaddss_mr(op1.offset, op1.base, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op2 == dest) {
+                m_assembler.addss_mr(op1.offset, op1.base, dest);
+                return;
+            }
+
+            loadFloat(op1, dest);
+            addFloat(op2, dest);
+        }
+    }
+
+    void addFloat(FPRegisterID op1, Address op2, FPRegisterID dest)
+    {
+        addFloat(op2, op1, dest);
+    }
+
+    void addFloat(BaseIndex op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vaddss_mr(op1.offset, op1.base, op1.index, op1.scale, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op2 == dest) {
+                m_assembler.addss_mr(op1.offset, op1.base, op1.index, op1.scale, dest);
+                return;
+            }
+            loadFloat(op1, dest);
+            addFloat(op2, dest);
+        }
+    }
+
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.divsd_rr(src, dest);
+    }
+
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        // B := A / B is invalid.
+        ASSERT(op1 == dest || op2 != dest);
+
+        moveDouble(op1, dest);
+        divDouble(op2, dest);
+    }
+
+    void divDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.divsd_mr(src.offset, src.base, dest);
+    }
+
+    void divFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.divss_rr(src, dest);
+    }
+
+    void divFloat(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.divss_mr(src.offset, src.base, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        subDouble(dest, src, dest);
+    }
+
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vsubsd_rr(op1, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+
+            // B := A - B is invalid.
+            ASSERT(op1 == dest || op2 != dest);
+            moveDouble(op1, dest);
+            m_assembler.subsd_rr(op2, dest);
+        }
+    }
+
+    void subDouble(FPRegisterID op1, Address op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vsubsd_mr(op1, op2.offset, op2.base, dest);
+        else {
+            moveDouble(op1, dest);
+            m_assembler.subsd_mr(op2.offset, op2.base, dest);
+        }
+    }
+
+    void subDouble(FPRegisterID op1, BaseIndex op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vsubsd_mr(op1, op2.offset, op2.base, op2.index, op2.scale, dest);
+        else {
+            moveDouble(op1, dest);
+            m_assembler.subsd_mr(op2.offset, op2.base, op2.index, op2.scale, dest);
+        }
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        subDouble(dest, src, dest);
+    }
+
+    void subFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        subFloat(dest, src, dest);
+    }
+
+    void subFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vsubss_rr(op1, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            // B := A - B is invalid.
+            ASSERT(op1 == dest || op2 != dest);
+            moveDouble(op1, dest);
+            m_assembler.subss_rr(op2, dest);
+        }
+    }
+
+    void subFloat(FPRegisterID op1, Address op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vsubss_mr(op1, op2.offset, op2.base, dest);
+        else {
+            moveDouble(op1, dest);
+            m_assembler.subss_mr(op2.offset, op2.base, dest);
+        }
+    }
+
+    void subFloat(FPRegisterID op1, BaseIndex op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vsubss_mr(op1, op2.offset, op2.base, op2.index, op2.scale, dest);
+        else {
+            moveDouble(op1, dest);
+            m_assembler.subss_mr(op2.offset, op2.base, op2.index, op2.scale, dest);
+        }
+    }
+
+    void subFloat(Address src, FPRegisterID dest)
+    {
+        subFloat(dest, src, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        mulDouble(src, dest, dest);
+    }
+
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vmulsd_rr(op1, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op1 == dest)
+                m_assembler.mulsd_rr(op2, dest);
+            else {
+                moveDouble(op2, dest);
+                m_assembler.mulsd_rr(op1, dest);
+            }
+        }
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        mulDouble(src, dest, dest);
+    }
+
+    void mulDouble(Address op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vmulsd_mr(op1.offset, op1.base, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op2 == dest) {
+                m_assembler.mulsd_mr(op1.offset, op1.base, dest);
+                return;
+            }
+            loadDouble(op1, dest);
+            mulDouble(op2, dest);
+        }
+    }
+
+    void mulDouble(FPRegisterID op1, Address op2, FPRegisterID dest)
+    {
+        return mulDouble(op2, op1, dest);
+    }
+
+    void mulDouble(BaseIndex op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vmulsd_mr(op1.offset, op1.base, op1.index, op1.scale, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op2 == dest) {
+                m_assembler.mulsd_mr(op1.offset, op1.base, op1.index, op1.scale, dest);
+                return;
+            }
+            loadDouble(op1, dest);
+            mulDouble(op2, dest);
+        }
+    }
+
+    void mulFloat(FPRegisterID src, FPRegisterID dest)
+    {
+        mulFloat(src, dest, dest);
+    }
+
+    void mulFloat(Address src, FPRegisterID dest)
+    {
+        mulFloat(src, dest, dest);
+    }
+
+    void mulFloat(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vmulss_rr(op1, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op1 == dest)
+                m_assembler.mulss_rr(op2, dest);
+            else {
+                moveDouble(op2, dest);
+                m_assembler.mulss_rr(op1, dest);
+            }
+        }
+    }
+
+    void mulFloat(Address op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vmulss_mr(op1.offset, op1.base, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op2 == dest) {
+                m_assembler.mulss_mr(op1.offset, op1.base, dest);
+                return;
+            }
+            loadFloat(op1, dest);
+            mulFloat(op2, dest);
+        }
+    }
+
+    void mulFloat(FPRegisterID op1, Address op2, FPRegisterID dest)
+    {
+        mulFloat(op2, op1, dest);
+    }
+
+    void mulFloat(BaseIndex op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        if (supportsAVX())
+            m_assembler.vmulss_mr(op1.offset, op1.base, op1.index, op1.scale, op2, dest);
+        else {
+            ASSERT(isSSE2Present());
+            if (op2 == dest) {
+                m_assembler.mulss_mr(op1.offset, op1.base, op1.index, op1.scale, dest);
+                return;
+            }
+            loadFloat(op1, dest);
+            mulFloat(op2, dest);
+        }
+    }
+
+    void andDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        // ANDPS is defined on 128bits and is shorter than ANDPD.
+        m_assembler.andps_rr(src, dst);
+    }
+
+    void andDouble(FPRegisterID src1, FPRegisterID src2, FPRegisterID dst)
+    {
+        if (src1 == dst)
+            andDouble(src2, dst);
+        else {
+            moveDouble(src2, dst);
+            andDouble(src1, dst);
+        }
+    }
+
+    void andFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.andps_rr(src, dst);
+    }
+
+    void andFloat(FPRegisterID src1, FPRegisterID src2, FPRegisterID dst)
+    {
+        if (src1 == dst)
+            andFloat(src2, dst);
+        else {
+            moveDouble(src2, dst);
+            andFloat(src1, dst);
+        }
+    }
+
+    void xorDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.xorps_rr(src, dst);
+    }
+
+    void xorDouble(FPRegisterID src1, FPRegisterID src2, FPRegisterID dst)
+    {
+        if (src1 == dst)
+            xorDouble(src2, dst);
+        else {
+            moveDouble(src2, dst);
+            xorDouble(src1, dst);
+        }
+    }
+
+    void xorFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.xorps_rr(src, dst);
+    }
+
+    void xorFloat(FPRegisterID src1, FPRegisterID src2, FPRegisterID dst)
+    {
+        if (src1 == dst)
+            xorFloat(src2, dst);
+        else {
+            moveDouble(src2, dst);
+            xorFloat(src1, dst);
+        }
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsi2sd_rr(src, dest);
+    }
+
+    void convertInt32ToDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsi2sd_mr(src.offset, src.base, dest);
+    }
+
+    void convertInt32ToFloat(RegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsi2ss_rr(src, dest);
+    }
+
+    void convertInt32ToFloat(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsi2ss_mr(src.offset, src.base, dest);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        ASSERT(isSSE2Present());
+
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+        return jumpAfterFloatingPointCompare(cond, left, right);
+    }
+
+    Jump branchFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        ASSERT(isSSE2Present());
+
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomiss_rr(left, right);
+        else
+            m_assembler.ucomiss_rr(right, left);
+        return jumpAfterFloatingPointCompare(cond, left, right);
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MIN).
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+        return branch32(branchType ? NotEqual : Equal, dest, TrustedImm32(0x80000000));
+    }
+
+    void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+    }
+
+    void truncateFloatToInt32(FPRegisterID src, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttss2si_rr(src, dest);
+    }
+
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp, bool negZeroCheck = true)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+
+        // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
+#if CPU(X86_64)
+        if (negZeroCheck) {
+            Jump valueIsNonZero = branchTest32(NonZero, dest);
+            m_assembler.movmskpd_rr(src, scratchRegister());
+            failureCases.append(branchTest32(NonZero, scratchRegister(), TrustedImm32(1)));
+            valueIsNonZero.link(this);
+        }
+#else
+        if (negZeroCheck)
+            failureCases.append(branchTest32(Zero, dest));
+#endif
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        convertInt32ToDouble(dest, fpTemp);
+        m_assembler.ucomisd_rr(fpTemp, src);
+        failureCases.append(m_assembler.jp());
+        failureCases.append(m_assembler.jne());
+    }
+
+    void moveZeroToDouble(FPRegisterID reg)
+    {
+        m_assembler.xorps_rr(reg, reg);
+    }
+
+    Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID scratch)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.xorpd_rr(scratch, scratch);
+        return branchDouble(DoubleNotEqual, reg, scratch);
+    }
+
+    Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID scratch)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.xorpd_rr(scratch, scratch);
+        return branchDouble(DoubleEqualOrUnordered, reg, scratch);
+    }
+
+    void lshiftPacked(TrustedImm32 imm, XMMRegisterID reg)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.psllq_i8r(imm.m_value, reg);
+    }
+
+    void rshiftPacked(TrustedImm32 imm, XMMRegisterID reg)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.psrlq_i8r(imm.m_value, reg);
+    }
+
+    void orPacked(XMMRegisterID src, XMMRegisterID dst)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.por_rr(src, dst);
+    }
+
+    void move32ToFloat(RegisterID src, XMMRegisterID dst)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movd_rr(src, dst);
+    }
+
+    void moveFloatTo32(XMMRegisterID src, RegisterID dst)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movd_rr(src, dst);
+    }
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+    
+    void pop(RegisterID dest)
+    {
+        m_assembler.pop_r(dest);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.push_r(src);
+    }
+
+    void push(Address address)
+    {
+        m_assembler.push_m(address.offset, address.base);
+    }
+
+    void push(TrustedImm32 imm)
+    {
+        m_assembler.push_i32(imm.m_value);
+    }
+
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(TrustedImm32 imm, RegisterID dest)
+    {
+        // Note: on 64-bit the TrustedImm32 value is zero extended into the register, it
+        // may be useful to have a separate version that sign extends the value?
+        if (!imm.m_value)
+            m_assembler.xorl_rr(dest, dest);
+        else
+            m_assembler.movl_i32r(imm.m_value, dest);
+    }
+
+#if CPU(X86_64)
+    void move(RegisterID src, RegisterID dest)
+    {
+        // Note: on 64-bit this is is a full register move; perhaps it would be
+        // useful to have separate move32 & movePtr, with move32 zero extending?
+        if (src != dest)
+            m_assembler.movq_rr(src, dest);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            m_assembler.xorq_rr(dest, dest);
+        else
+            m_assembler.movq_i64r(imm.asIntptr(), dest);
+    }
+
+    void move(TrustedImm64 imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            m_assembler.xorq_rr(dest, dest);
+        else
+            m_assembler.movq_i64r(imm.m_value, dest);
+    }
+
+    void moveConditionallyDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID src, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+        moveConditionallyAfterFloatingPointCompare(cond, left, right, src, dest);
+    }
+
+    void moveConditionallyDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        RegisterID src;
+        if (elseCase == dest)
+            src = thenCase;
+        else {
+            cond = invert(cond);
+            src = elseCase;
+        }
+
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+        moveConditionallyAfterFloatingPointCompare(cond, left, right, src, dest);
+    }
+
+    void moveConditionallyFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID src, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomiss_rr(left, right);
+        else
+            m_assembler.ucomiss_rr(right, left);
+        moveConditionallyAfterFloatingPointCompare(cond, left, right, src, dest);
+    }
+
+    void moveConditionallyFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        RegisterID src;
+        if (elseCase == dest)
+            src = thenCase;
+        else {
+            cond = invert(cond);
+            src = elseCase;
+        }
+
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomiss_rr(left, right);
+        else
+            m_assembler.ucomiss_rr(right, left);
+        moveConditionallyAfterFloatingPointCompare(cond, left, right, src, dest);
+    }
+    
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        if (reg1 != reg2)
+            m_assembler.xchgq_rr(reg1, reg2);
+    }
+
+    void signExtend32ToPtr(TrustedImm32 imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            m_assembler.xorq_rr(dest, dest);
+        else
+            m_assembler.mov_i32r(imm.m_value, dest);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movsxd_rr(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movl_rr(src, dest);
+    }
+
+    void zeroExtend32ToPtr(TrustedImm32 src, RegisterID dest)
+    {
+        m_assembler.movl_i32r(src.m_value, dest);
+    }
+#else
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.movl_rr(src, dest);
+    }
+
+    void move(TrustedImmPtr imm, RegisterID dest)
+    {
+        if (!imm.m_value)
+            m_assembler.xorl_rr(dest, dest);
+        else
+            m_assembler.movl_i32r(imm.asIntptr(), dest);
+    }
+
+    void moveConditionallyDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID src, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+
+        if (cond == DoubleEqual) {
+            if (left == right) {
+                m_assembler.cmovnpl_rr(src, dest);
+                return;
+            }
+
+            Jump isUnordered(m_assembler.jp());
+            m_assembler.cmovel_rr(src, dest);
+            isUnordered.link(this);
+            return;
+        }
+
+        if (cond == DoubleNotEqualOrUnordered) {
+            if (left == right) {
+                m_assembler.cmovpl_rr(src, dest);
+                return;
+            }
+
+            m_assembler.cmovpl_rr(src, dest);
+            m_assembler.cmovnel_rr(src, dest);
+            return;
+        }
+
+        ASSERT(!(cond & DoubleConditionBitSpecial));
+        m_assembler.cmovl_rr(static_cast<X86Assembler::Condition>(cond & ~DoubleConditionBits), src, dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        if (reg1 != reg2)
+            m_assembler.xchgl_rr(reg1, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+#endif
+
+    void swap32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xchgl_rr(src, dest);
+    }
+
+    void swap32(RegisterID src, Address dest)
+    {
+        m_assembler.xchgl_rm(src, dest.offset, dest.base);
+    }
+
+    void moveConditionally32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID src, RegisterID dest)
+    {
+        m_assembler.cmpl_rr(right, left);
+        cmov(x86Condition(cond), src, dest);
+    }
+
+    void moveConditionally32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        m_assembler.cmpl_rr(right, left);
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest)
+            cmov(x86Condition(cond), thenCase, dest);
+        else
+            cmov(x86Condition(invert(cond)), elseCase, dest);
+    }
+
+    void moveConditionally32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                moveConditionallyTest32(*resultCondition, left, left, thenCase, elseCase, dest);
+                return;
+            }
+        }
+
+        m_assembler.cmpl_ir(right.m_value, left);
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest)
+            cmov(x86Condition(cond), thenCase, dest);
+        else
+            cmov(x86Condition(invert(cond)), elseCase, dest);
+    }
+
+    void moveConditionallyTest32(ResultCondition cond, RegisterID testReg, RegisterID mask, RegisterID src, RegisterID dest)
+    {
+        m_assembler.testl_rr(testReg, mask);
+        cmov(x86Condition(cond), src, dest);
+    }
+
+    void moveConditionallyTest32(ResultCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        ASSERT(isInvertible(cond));
+        ASSERT_WITH_MESSAGE(cond != Overflow, "TEST does not set the Overflow Flag.");
+
+        m_assembler.testl_rr(right, left);
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest)
+            cmov(x86Condition(cond), thenCase, dest);
+        else
+            cmov(x86Condition(invert(cond)), elseCase, dest);
+    }
+
+    void moveConditionallyTest32(ResultCondition cond, RegisterID testReg, TrustedImm32 mask, RegisterID src, RegisterID dest)
+    {
+        test32(testReg, mask);
+        cmov(x86Condition(cond), src, dest);
+    }
+
+    void moveConditionallyTest32(ResultCondition cond, RegisterID testReg, TrustedImm32 mask, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        ASSERT(isInvertible(cond));
+        ASSERT_WITH_MESSAGE(cond != Overflow, "TEST does not set the Overflow Flag.");
+
+        test32(testReg, mask);
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest)
+            cmov(x86Condition(cond), thenCase, dest);
+        else
+            cmov(x86Condition(invert(cond)), elseCase, dest);
+    }
+
+    template<typename LeftType, typename RightType>
+    void moveDoubleConditionally32(RelationalCondition cond, LeftType left, RightType right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        static_assert(!std::is_same<LeftType, FPRegisterID>::value && !std::is_same<RightType, FPRegisterID>::value, "One of the tested argument could be aliased on dest. Use moveDoubleConditionallyDouble().");
+
+        if (thenCase != dest && elseCase != dest) {
+            moveDouble(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest) {
+            Jump falseCase = branch32(invert(cond), left, right);
+            moveDouble(thenCase, dest);
+            falseCase.link(this);
+        } else {
+            Jump trueCase = branch32(cond, left, right);
+            moveDouble(elseCase, dest);
+            trueCase.link(this);
+        }
+    }
+
+    template<typename TestType, typename MaskType>
+    void moveDoubleConditionallyTest32(ResultCondition cond, TestType test, MaskType mask, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        static_assert(!std::is_same<TestType, FPRegisterID>::value && !std::is_same<MaskType, FPRegisterID>::value, "One of the tested argument could be aliased on dest. Use moveDoubleConditionallyDouble().");
+
+        if (elseCase == dest && isInvertible(cond)) {
+            Jump falseCase = branchTest32(invert(cond), test, mask);
+            moveDouble(thenCase, dest);
+            falseCase.link(this);
+        } else if (thenCase == dest) {
+            Jump trueCase = branchTest32(cond, test, mask);
+            moveDouble(elseCase, dest);
+            trueCase.link(this);
+        }
+
+        Jump trueCase = branchTest32(cond, test, mask);
+        moveDouble(elseCase, dest);
+        Jump falseCase = jump();
+        trueCase.link(this);
+        moveDouble(thenCase, dest);
+        falseCase.link(this);
+    }
+
+    void moveDoubleConditionallyDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        if (elseCase == dest) {
+            Jump falseCase = branchDouble(invert(cond), left, right);
+            moveDouble(thenCase, dest);
+            falseCase.link(this);
+        } else if (thenCase == dest) {
+            Jump trueCase = branchDouble(cond, left, right);
+            moveDouble(elseCase, dest);
+            trueCase.link(this);
+        } else {
+            Jump trueCase = branchDouble(cond, left, right);
+            moveDouble(elseCase, dest);
+            Jump falseCase = jump();
+            trueCase.link(this);
+            moveDouble(thenCase, dest);
+            falseCase.link(this);
+        }
+    }
+
+    void moveDoubleConditionallyFloat(DoubleCondition cond, FPRegisterID left, FPRegisterID right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        if (elseCase == dest) {
+            Jump falseCase = branchFloat(invert(cond), left, right);
+            moveDouble(thenCase, dest);
+            falseCase.link(this);
+        } else if (thenCase == dest) {
+            Jump trueCase = branchFloat(cond, left, right);
+            moveDouble(elseCase, dest);
+            trueCase.link(this);
+        } else {
+            Jump trueCase = branchFloat(cond, left, right);
+            moveDouble(elseCase, dest);
+            Jump falseCase = jump();
+            trueCase.link(this);
+            moveDouble(thenCase, dest);
+            falseCase.link(this);
+        }
+    }
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, TrustedImm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+
+public:
+    Jump branch8(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        TrustedImm32 right8(static_cast<int8_t>(right.m_value));
+        m_assembler.cmpb_im(right8.m_value, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmpl_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(RelationalCondition cond, RegisterID left, TrustedImm32 right)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond))
+                return branchTest32(*resultCondition, left, left);
+        }
+
+        m_assembler.cmpl_ir(right.m_value, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branch32(RelationalCondition cond, RegisterID left, Address right)
+    {
+        m_assembler.cmpl_mr(right.offset, right.base, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branch32(RelationalCondition cond, Address left, RegisterID right)
+    {
+        m_assembler.cmpl_rm(right, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32WithUnalignedHalfWords(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        return branch32(cond, left, right);
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        m_assembler.testl_rr(reg, mask);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    void test32(RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.testl_rr(reg, reg);
+        else if (!(mask.m_value & ~0xff) && reg < X86Registers::esp) { // Using esp and greater as a byte register yields the upper half of the 16 bit registers ax, cx, dx and bx, e.g. esp, register 4, is actually ah.
+            if (mask.m_value == 0xff)
+                m_assembler.testb_rr(reg, reg);
+            else
+                m_assembler.testb_i8r(mask.m_value, reg);
+        } else
+            m_assembler.testl_i32r(mask.m_value, reg);
+    }
+
+    Jump branch(ResultCondition cond)
+    {
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        test32(reg, mask);
+        return branch(cond);
+    }
+
+    Jump branchTest32(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        generateTest32(address, mask);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base, address.index, address.scale);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchTest8(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8(static_cast<int8_t>(mask.m_value));
+        if (mask8.m_value == -1)
+            m_assembler.cmpb_im(0, address.offset, address.base);
+        else
+            m_assembler.testb_im(mask8.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchTest8(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8(static_cast<int8_t>(mask.m_value));
+        if (mask8.m_value == -1)
+            m_assembler.cmpb_im(0, address.offset, address.base, address.index, address.scale);
+        else
+            m_assembler.testb_im(mask8.m_value, address.offset, address.base, address.index, address.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch8(RelationalCondition cond, BaseIndex left, TrustedImm32 right)
+    {
+        TrustedImm32 right8(static_cast<int8_t>(right.m_value));
+        m_assembler.cmpb_im(right8.m_value, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump jump()
+    {
+        return Jump(m_assembler.jmp());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jmp_r(target);
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(Address address)
+    {
+        m_assembler.jmp_m(address.offset, address.base);
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(BaseIndex address)
+    {
+        m_assembler.jmp_m(address.offset, address.base, address.index, address.scale);
+    }
+
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+    
+    Jump branchAdd32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        add32(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 src, Address dest)
+    {
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, Address dest)
+    {
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, Address src, RegisterID dest)
+    {
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            return branchAdd32(cond, src2, dest);
+        move32IfNeeded(src2, dest);
+        return branchAdd32(cond, src1, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, Address op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest)
+            return branchAdd32(cond, op1, dest);
+        if (op1.base == dest) {
+            load32(op1, dest);
+            return branchAdd32(cond, op2, dest);
+        }
+        zeroExtend32ToPtr(op2, dest);
+        return branchAdd32(cond, op1, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src1, Address src2, RegisterID dest)
+    {
+        return branchAdd32(cond, src2, src1, dest);
+    }
+
+    Jump branchAdd32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        move32IfNeeded(src, dest);
+        return branchAdd32(cond, imm, dest);
+    }
+
+    Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        mul32(src, dest);
+        if (cond != Overflow)
+            m_assembler.testl_rr(dest, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchMul32(ResultCondition cond, Address src, RegisterID dest)
+    {
+        mul32(src, dest);
+        if (cond != Overflow)
+            m_assembler.testl_rr(dest, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchMul32(ResultCondition cond, RegisterID src, TrustedImm32 imm, RegisterID dest)
+    {
+        mul32(imm, src, dest);
+        if (cond != Overflow)
+            m_assembler.testl_rr(dest, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchMul32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            return branchMul32(cond, src2, dest);
+        move32IfNeeded(src2, dest);
+        return branchMul32(cond, src1, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        sub32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchSub32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        sub32(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, TrustedImm32 imm, Address dest)
+    {
+        sub32(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src, Address dest)
+    {
+        sub32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, Address src, RegisterID dest)
+    {
+        sub32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        // B := A - B is invalid.
+        ASSERT(src1 == dest || src2 != dest);
+
+        move32IfNeeded(src1, dest);
+        return branchSub32(cond, src2, dest);
+    }
+
+    Jump branchSub32(ResultCondition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest)
+    {
+        move32IfNeeded(src1, dest);
+        return branchSub32(cond, src2, dest);
+    }
+
+    Jump branchNeg32(ResultCondition cond, RegisterID srcDest)
+    {
+        neg32(srcDest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        or32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.int3();
+    }
+
+    Call nearTailCall()
+    {
+        return Call(m_assembler.jmp(), Call::LinkableNearTail);
+    }
+
+    Call nearCall()
+    {
+        return Call(m_assembler.call(), Call::LinkableNear);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.call(target), Call::None);
+    }
+
+    void call(Address address)
+    {
+        m_assembler.call_m(address.offset, address.base);
+    }
+
+    void ret()
+    {
+        m_assembler.ret();
+    }
+
+    void compare8(RelationalCondition cond, Address left, TrustedImm32 right, RegisterID dest)
+    {
+        TrustedImm32 right8(static_cast<int8_t>(right.m_value));
+        m_assembler.cmpb_im(right8.m_value, left.offset, left.base);
+        set32(x86Condition(cond), dest);
+    }
+    
+    void compare32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmpl_rr(right, left);
+        set32(x86Condition(cond), dest);
+    }
+
+    void compare32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                test32(*resultCondition, left, left, dest);
+                return;
+            }
+        }
+
+        m_assembler.cmpl_ir(right.m_value, left);
+        set32(x86Condition(cond), dest);
+    }
+
+    // FIXME:
+    // The mask should be optional... perhaps the argument order should be
+    // dest-src, operations always have a dest? ... possibly not true, considering
+    // asm ops like test, or pseudo ops like pop().
+
+    void test8(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        TrustedImm32 mask8(static_cast<int8_t>(mask.m_value));
+        if (mask8.m_value == -1)
+            m_assembler.cmpb_im(0, address.offset, address.base);
+        else
+            m_assembler.testb_im(mask8.m_value, address.offset, address.base);
+        set32(x86Condition(cond), dest);
+    }
+
+    void test32(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
+    {
+        generateTest32(address, mask);
+        set32(x86Condition(cond), dest);
+    }
+
+    void test32(ResultCondition cond, RegisterID reg, RegisterID mask, RegisterID dest)
+    {
+        m_assembler.testl_rr(reg, mask);
+        set32(x86Condition(cond), dest);
+    }
+
+    void test32(ResultCondition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest)
+    {
+        test32(reg, mask);
+        set32(x86Condition(cond), dest);
+    }
+
+    void setCarry(RegisterID dest)
+    {
+        set32(X86Assembler::ConditionC, dest);
+    }
+
+    // Invert a relational condition, e.g. == becomes !=, < becomes >=, etc.
+    static RelationalCondition invert(RelationalCondition cond)
+    {
+        return static_cast<RelationalCondition>(cond ^ 1);
+    }
+
+    static DoubleCondition invert(DoubleCondition cond)
+    {
+        switch (cond) {
+        case DoubleEqual:
+            return DoubleNotEqualOrUnordered;
+        case DoubleNotEqual:
+            return DoubleEqualOrUnordered;
+        case DoubleGreaterThan:
+            return DoubleLessThanOrEqualOrUnordered;
+        case DoubleGreaterThanOrEqual:
+            return DoubleLessThanOrUnordered;
+        case DoubleLessThan:
+            return DoubleGreaterThanOrEqualOrUnordered;
+        case DoubleLessThanOrEqual:
+            return DoubleGreaterThanOrUnordered;
+        case DoubleEqualOrUnordered:
+            return DoubleNotEqual;
+        case DoubleNotEqualOrUnordered:
+            return DoubleEqual;
+        case DoubleGreaterThanOrUnordered:
+            return DoubleLessThanOrEqual;
+        case DoubleGreaterThanOrEqualOrUnordered:
+            return DoubleLessThan;
+        case DoubleLessThanOrUnordered:
+            return DoubleGreaterThanOrEqual;
+        case DoubleLessThanOrEqualOrUnordered:
+            return DoubleGreaterThan;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return DoubleEqual; // make compiler happy
+    }
+
+    static bool isInvertible(ResultCondition cond)
+    {
+        switch (cond) {
+        case Zero:
+        case NonZero:
+        case Signed:
+        case PositiveOrZero:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    static ResultCondition invert(ResultCondition cond)
+    {
+        switch (cond) {
+        case Zero:
+            return NonZero;
+        case NonZero:
+            return Zero;
+        case Signed:
+            return PositiveOrZero;
+        case PositiveOrZero:
+            return Signed;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return Zero; // Make compiler happy for release builds.
+        }
+    }
+
+    static std::optional<ResultCondition> commuteCompareToZeroIntoTest(RelationalCondition cond)
+    {
+        switch (cond) {
+        case Equal:
+            return Zero;
+        case NotEqual:
+            return NonZero;
+        case LessThan:
+            return Signed;
+        case GreaterThanOrEqual:
+            return PositiveOrZero;
+            break;
+        default:
+            return std::nullopt;
+        }
+    }
+
+    void nop()
+    {
+        m_assembler.nop();
+    }
+    
+    // We take memoryFence to mean acqrel. This has acqrel semantics on x86.
+    void memoryFence()
+    {
+        // lock; orl $0, (%rsp)
+        m_assembler.lock();
+        m_assembler.orl_im(0, 0, X86Registers::esp);
+    }
+
+    // We take this to mean that it prevents motion of normal stores. So, it's a no-op on x86.
+    void storeFence()
+    {
+    }
+
+    // We take this to mean that it prevents motion of normal loads. So, it's a no-op on x86.
+    void loadFence()
+    {
+    }
+
+    static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)
+    {
+        X86Assembler::replaceWithJump(instructionStart.executableAddress(), destination.executableAddress());
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return X86Assembler::maxJumpReplacementSize();
+    }
+
+    static ptrdiff_t patchableJumpSize()
+    {
+        return X86Assembler::patchableJumpSize();
+    }
+
+    static bool supportsFloatingPointRounding()
+    {
+        if (s_sse4_1CheckState == CPUIDCheckState::NotChecked)
+            updateEax1EcxFlags();
+        return s_sse4_1CheckState == CPUIDCheckState::Set;
+    }
+
+    static bool supportsAVX()
+    {
+        // AVX still causes mysterious regressions and those regressions can be massive.
+        return false;
+    }
+
+    static void updateEax1EcxFlags()
+    {
+        int flags = 0;
+#if COMPILER(MSVC)
+        int cpuInfo[4];
+        __cpuid(cpuInfo, 0x1);
+        flags = cpuInfo[2];
+#elif COMPILER(GCC_OR_CLANG)
+#if CPU(X86_64)
+        asm (
+            "movl $0x1, %%eax;"
+            "cpuid;"
+            "movl %%ecx, %0;"
+            : "=g" (flags)
+            :
+            : "%eax", "%ebx", "%ecx", "%edx"
+            );
+#else
+        asm (
+            "movl $0x1, %%eax;"
+            "pushl %%ebx;"
+            "cpuid;"
+            "popl %%ebx;"
+            "movl %%ecx, %0;"
+            : "=g" (flags)
+            :
+            : "%eax", "%ecx", "%edx"
+            );
+#endif
+#endif // COMPILER(GCC_OR_CLANG)
+        s_sse4_1CheckState = (flags & (1 << 19)) ? CPUIDCheckState::Set : CPUIDCheckState::Clear;
+        s_avxCheckState = (flags & (1 << 28)) ? CPUIDCheckState::Set : CPUIDCheckState::Clear;
+    }
+
+#if ENABLE(MASM_PROBE)
+    void probe(ProbeFunction, void* arg1, void* arg2);
+#endif // ENABLE(MASM_PROBE)
+
+protected:
+    X86Assembler::Condition x86Condition(RelationalCondition cond)
+    {
+        return static_cast<X86Assembler::Condition>(cond);
+    }
+
+    X86Assembler::Condition x86Condition(ResultCondition cond)
+    {
+        return static_cast<X86Assembler::Condition>(cond);
+    }
+
+    void set32(X86Assembler::Condition cond, RegisterID dest)
+    {
+#if CPU(X86)
+        // On 32-bit x86 we can only set the first 4 registers;
+        // esp..edi are mapped to the 'h' registers!
+        if (dest >= 4) {
+            m_assembler.xchgl_rr(dest, X86Registers::eax);
+            m_assembler.setCC_r(cond, X86Registers::eax);
+            m_assembler.movzbl_rr(X86Registers::eax, X86Registers::eax);
+            m_assembler.xchgl_rr(dest, X86Registers::eax);
+            return;
+        }
+#endif
+        m_assembler.setCC_r(cond, dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+    void cmov(X86Assembler::Condition cond, RegisterID src, RegisterID dest)
+    {
+#if CPU(X86_64)
+        m_assembler.cmovq_rr(cond, src, dest);
+#else
+        m_assembler.cmovl_rr(cond, src, dest);
+#endif
+    }
+
+    static bool supportsLZCNT()
+    {
+        if (s_lzcntCheckState == CPUIDCheckState::NotChecked) {
+            int flags = 0;
+#if COMPILER(MSVC)
+            int cpuInfo[4];
+            __cpuid(cpuInfo, 0x80000001);
+            flags = cpuInfo[2];
+#elif COMPILER(GCC_OR_CLANG)
+#if CPU(X86_64)
+            asm (
+                "movl $0x80000001, %%eax;"
+                "cpuid;"
+                "movl %%ecx, %0;"
+                : "=g" (flags)
+                :
+                : "%eax", "%ebx", "%ecx", "%edx"
+                );
+#else
+            asm (
+                "movl $0x80000001, %%eax;"
+                "pushl %%ebx;"
+                "cpuid;"
+                "popl %%ebx;"
+                "movl %%ecx, %0;"
+                : "=g" (flags)
+                :
+                : "%eax", "%ecx", "%edx"
+                );
+#endif
+#endif // COMPILER(GCC_OR_CLANG)
+            s_lzcntCheckState = (flags & 0x20) ? CPUIDCheckState::Set : CPUIDCheckState::Clear;
+        }
+        return s_lzcntCheckState == CPUIDCheckState::Set;
+    }
+
+    static bool supportsBMI1()
+    {
+        if (s_bmi1CheckState == CPUIDCheckState::NotChecked) {
+            int flags = 0;
+#if COMPILER(MSVC)
+            int cpuInfo[4];
+            __cpuid(cpuInfo, 0x80000001);
+            flags = cpuInfo[2];
+#elif COMPILER(GCC_OR_CLANG)
+            asm (
+                 "movl $0x7, %%eax;"
+                 "movl $0x0, %%ecx;"
+                 "cpuid;"
+                 "movl %%ebx, %0;"
+                 : "=g" (flags)
+                 :
+                 : "%eax", "%ebx", "%ecx", "%edx"
+                 );
+#endif // COMPILER(GCC_OR_CLANG)
+            static int BMI1FeatureBit = 1 << 3;
+            s_bmi1CheckState = (flags & BMI1FeatureBit) ? CPUIDCheckState::Set : CPUIDCheckState::Clear;
+        }
+        return s_bmi1CheckState == CPUIDCheckState::Set;
+    }
+
+    template<int sizeOfRegister>
+    void ctzAfterBsf(RegisterID dst)
+    {
+        Jump srcIsNonZero = m_assembler.jCC(x86Condition(NonZero));
+        move(TrustedImm32(sizeOfRegister), dst);
+        srcIsNonZero.link(this);
+    }
+
+private:
+    // Only MacroAssemblerX86 should be using the following method; SSE2 is always available on
+    // x86_64, and clients & subclasses of MacroAssembler should be using 'supportsFloatingPoint()'.
+    friend class MacroAssemblerX86;
+
+    ALWAYS_INLINE void generateTest32(Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base);
+        else if (!(mask.m_value & ~0xff))
+            m_assembler.testb_im(mask.m_value, address.offset, address.base);
+        else if (!(mask.m_value & ~0xff00))
+            m_assembler.testb_im(mask.m_value >> 8, address.offset + 1, address.base);
+        else if (!(mask.m_value & ~0xff0000))
+            m_assembler.testb_im(mask.m_value >> 16, address.offset + 2, address.base);
+        else if (!(mask.m_value & ~0xff000000))
+            m_assembler.testb_im(mask.m_value >> 24, address.offset + 3, address.base);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+    }
+
+    // If lzcnt is not available, use this after BSR
+    // to count the leading zeros.
+    void clz32AfterBsr(RegisterID dst)
+    {
+        Jump srcIsNonZero = m_assembler.jCC(x86Condition(NonZero));
+        move(TrustedImm32(32), dst);
+
+        Jump skipNonZeroCase = jump();
+        srcIsNonZero.link(this);
+        xor32(TrustedImm32(0x1f), dst);
+        skipNonZeroCase.link(this);
+    }
+
+    Jump jumpAfterFloatingPointCompare(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        if (cond == DoubleEqual) {
+            if (left == right)
+                return Jump(m_assembler.jnp());
+            Jump isUnordered(m_assembler.jp());
+            Jump result = Jump(m_assembler.je());
+            isUnordered.link(this);
+            return result;
+        }
+        if (cond == DoubleNotEqualOrUnordered) {
+            if (left == right)
+                return Jump(m_assembler.jp());
+            Jump isUnordered(m_assembler.jp());
+            Jump isEqual(m_assembler.je());
+            isUnordered.link(this);
+            Jump result = jump();
+            isEqual.link(this);
+            return result;
+        }
+
+        ASSERT(!(cond & DoubleConditionBitSpecial));
+        return Jump(m_assembler.jCC(static_cast<X86Assembler::Condition>(cond & ~DoubleConditionBits)));
+    }
+
+    // The 32bit Move does not need the REX byte for low registers, making it shorter.
+    // Use this if the top bits are irrelevant because they will be reset by the next instruction.
+    void move32IfNeeded(RegisterID src, RegisterID dest)
+    {
+        if (src == dest)
+            return;
+        m_assembler.movl_rr(src, dest);
+    }
+
+#if CPU(X86_64)
+    void moveConditionallyAfterFloatingPointCompare(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID src, RegisterID dest)
+    {
+        if (cond == DoubleEqual) {
+            if (left == right) {
+                m_assembler.cmovnpq_rr(src, dest);
+                return;
+            }
+
+            Jump isUnordered(m_assembler.jp());
+            m_assembler.cmoveq_rr(src, dest);
+            isUnordered.link(this);
+            return;
+        }
+
+        if (cond == DoubleNotEqualOrUnordered) {
+            if (left == right) {
+                m_assembler.cmovpq_rr(src, dest);
+                return;
+            }
+
+            m_assembler.cmovpq_rr(src, dest);
+            m_assembler.cmovneq_rr(src, dest);
+            return;
+        }
+
+        ASSERT(!(cond & DoubleConditionBitSpecial));
+        cmov(static_cast<X86Assembler::Condition>(cond & ~DoubleConditionBits), src, dest);
+    }
+#endif
+
+#if CPU(X86)
+#if OS(MAC_OS_X)
+
+    // All X86 Macs are guaranteed to support at least SSE2,
+    static bool isSSE2Present()
+    {
+        return true;
+    }
+
+#else // OS(MAC_OS_X)
+
+    enum SSE2CheckState {
+        NotCheckedSSE2,
+        HasSSE2,
+        NoSSE2
+    };
+
+    static bool isSSE2Present()
+    {
+        if (s_sse2CheckState == NotCheckedSSE2) {
+            // Default the flags value to zero; if the compiler is
+            // not MSVC or GCC we will read this as SSE2 not present.
+            int flags = 0;
+#if COMPILER(MSVC)
+            _asm {
+                mov eax, 1 // cpuid function 1 gives us the standard feature set
+                cpuid;
+                mov flags, edx;
+            }
+#elif COMPILER(GCC_OR_CLANG)
+            asm (
+                 "movl $0x1, %%eax;"
+                 "pushl %%ebx;"
+                 "cpuid;"
+                 "popl %%ebx;"
+                 "movl %%edx, %0;"
+                 : "=g" (flags)
+                 :
+                 : "%eax", "%ecx", "%edx"
+                 );
+#endif
+            static const int SSE2FeatureBit = 1 << 26;
+            s_sse2CheckState = (flags & SSE2FeatureBit) ? HasSSE2 : NoSSE2;
+        }
+        // Only check once.
+        ASSERT(s_sse2CheckState != NotCheckedSSE2);
+
+        return s_sse2CheckState == HasSSE2;
+    }
+    
+    JS_EXPORTDATA static SSE2CheckState s_sse2CheckState;
+
+#endif // OS(MAC_OS_X)
+#elif !defined(NDEBUG) // CPU(X86)
+
+    // On x86-64 we should never be checking for SSE2 in a non-debug build,
+    // but non debug add this method to keep the asserts above happy.
+    static bool isSSE2Present()
+    {
+        return true;
+    }
+
+#endif
+
+    enum class CPUIDCheckState {
+        NotChecked,
+        Clear,
+        Set
+    };
+    JS_EXPORT_PRIVATE static CPUIDCheckState s_sse4_1CheckState;
+    JS_EXPORT_PRIVATE static CPUIDCheckState s_avxCheckState;
+    static CPUIDCheckState s_bmi1CheckState;
+    static CPUIDCheckState s_lzcntCheckState;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/MacroAssemblerX86_64.h b/assembler/MacroAssemblerX86_64.h
new file mode 100644
index 0000000..7e18412
--- /dev/null
+++ b/assembler/MacroAssemblerX86_64.h
@@ -0,0 +1,1525 @@
+/*
+ * Copyright (C) 2008, 2012, 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(X86_64)
+
+#include "MacroAssemblerX86Common.h"
+
+#define REPATCH_OFFSET_CALL_R11 3
+
+inline bool CAN_SIGN_EXTEND_32_64(int64_t value) { return value == (int64_t)(int32_t)value; }
+
+namespace JSC {
+
+class MacroAssemblerX86_64 : public MacroAssemblerX86Common {
+public:
+    static const unsigned numGPRs = 16;
+    static const unsigned numFPRs = 16;
+    
+    static const Scale ScalePtr = TimesEight;
+
+    using MacroAssemblerX86Common::add32;
+    using MacroAssemblerX86Common::and32;
+    using MacroAssemblerX86Common::branch32;
+    using MacroAssemblerX86Common::branchAdd32;
+    using MacroAssemblerX86Common::or32;
+    using MacroAssemblerX86Common::sub32;
+    using MacroAssemblerX86Common::load8;
+    using MacroAssemblerX86Common::load32;
+    using MacroAssemblerX86Common::store32;
+    using MacroAssemblerX86Common::store8;
+    using MacroAssemblerX86Common::call;
+    using MacroAssemblerX86Common::jump;
+    using MacroAssemblerX86Common::addDouble;
+    using MacroAssemblerX86Common::loadDouble;
+    using MacroAssemblerX86Common::convertInt32ToDouble;
+
+    void add32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        add32(imm, Address(scratchRegister()));
+    }
+    
+    void and32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        and32(imm, Address(scratchRegister()));
+    }
+    
+    void add32(AbsoluteAddress address, RegisterID dest)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        add32(Address(scratchRegister()), dest);
+    }
+    
+    void or32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        or32(imm, Address(scratchRegister()));
+    }
+
+    void or32(RegisterID reg, AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        or32(reg, Address(scratchRegister()));
+    }
+
+    void sub32(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        sub32(imm, Address(scratchRegister()));
+    }
+    
+    void load8(const void* address, RegisterID dest)
+    {
+        move(TrustedImmPtr(address), dest);
+        load8(dest, dest);
+    }
+
+    void load32(const void* address, RegisterID dest)
+    {
+        if (dest == X86Registers::eax)
+            m_assembler.movl_mEAX(address);
+        else {
+            move(TrustedImmPtr(address), dest);
+            load32(dest, dest);
+        }
+    }
+
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        m_assembler.addsd_mr(0, scratchRegister(), dest);
+    }
+
+    void convertInt32ToDouble(TrustedImm32 imm, FPRegisterID dest)
+    {
+        move(imm, scratchRegister());
+        m_assembler.cvtsi2sd_rr(scratchRegister(), dest);
+    }
+
+    void store32(TrustedImm32 imm, void* address)
+    {
+        move(TrustedImmPtr(address), scratchRegister());
+        store32(imm, scratchRegister());
+    }
+
+    void store32(RegisterID source, void* address)
+    {
+        if (source == X86Registers::eax)
+            m_assembler.movl_EAXm(address);
+        else {
+            move(TrustedImmPtr(address), scratchRegister());
+            store32(source, scratchRegister());
+        }
+    }
+    
+    void store8(TrustedImm32 imm, void* address)
+    {
+        TrustedImm32 imm8(static_cast<int8_t>(imm.m_value));
+        move(TrustedImmPtr(address), scratchRegister());
+        store8(imm8, Address(scratchRegister()));
+    }
+
+    void store8(RegisterID reg, void* address)
+    {
+        move(TrustedImmPtr(address), scratchRegister());
+        store8(reg, Address(scratchRegister()));
+    }
+
+#if OS(WINDOWS)
+    Call callWithSlowPathReturnType()
+    {
+        // On Win64, when the return type is larger than 8 bytes, we need to allocate space on the stack for the return value.
+        // On entry, rcx should contain a pointer to this stack space. The other parameters are shifted to the right,
+        // rdx should contain the first argument, r8 should contain the second argument, and r9 should contain the third argument.
+        // On return, rax contains a pointer to this stack value. See http://msdn.microsoft.com/en-us/library/7572ztz4.aspx.
+        // We then need to copy the 16 byte return value into rax and rdx, since JIT expects the return value to be split between the two.
+        // It is assumed that the parameters are already shifted to the right, when entering this method.
+        // Note: this implementation supports up to 3 parameters.
+
+        // JIT relies on the CallerFrame (frame pointer) being put on the stack,
+        // On Win64 we need to manually copy the frame pointer to the stack, since MSVC may not maintain a frame pointer on 64-bit.
+        // See http://msdn.microsoft.com/en-us/library/9z1stfyw.aspx where it's stated that rbp MAY be used as a frame pointer.
+        store64(X86Registers::ebp, Address(X86Registers::esp, -16));
+
+        // We also need to allocate the shadow space on the stack for the 4 parameter registers.
+        // In addition, we need to allocate 16 bytes for the return value.
+        // Also, we should allocate 16 bytes for the frame pointer, and return address (not populated).
+        sub64(TrustedImm32(8 * sizeof(int64_t)), X86Registers::esp);
+
+        // The first parameter register should contain a pointer to the stack allocated space for the return value.
+        move(X86Registers::esp, X86Registers::ecx);
+        add64(TrustedImm32(4 * sizeof(int64_t)), X86Registers::ecx);
+
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister());
+        Call result = Call(m_assembler.call(scratchRegister()), Call::Linkable);
+
+        add64(TrustedImm32(8 * sizeof(int64_t)), X86Registers::esp);
+
+        // Copy the return value into rax and rdx.
+        load64(Address(X86Registers::eax, sizeof(int64_t)), X86Registers::edx);
+        load64(Address(X86Registers::eax), X86Registers::eax);
+
+        ASSERT_UNUSED(label, differenceBetween(label, result) == REPATCH_OFFSET_CALL_R11);
+        return result;
+    }
+#endif
+
+    Call call()
+    {
+#if OS(WINDOWS)
+        // JIT relies on the CallerFrame (frame pointer) being put on the stack,
+        // On Win64 we need to manually copy the frame pointer to the stack, since MSVC may not maintain a frame pointer on 64-bit.
+        // See http://msdn.microsoft.com/en-us/library/9z1stfyw.aspx where it's stated that rbp MAY be used as a frame pointer.
+        store64(X86Registers::ebp, Address(X86Registers::esp, -16));
+
+        // On Windows we need to copy the arguments that don't fit in registers to the stack location where the callee expects to find them.
+        // We don't know the number of arguments at this point, so the arguments (5, 6, ...) should always be copied.
+
+        // Copy argument 5
+        load64(Address(X86Registers::esp, 4 * sizeof(int64_t)), scratchRegister());
+        store64(scratchRegister(), Address(X86Registers::esp, -4 * static_cast<int32_t>(sizeof(int64_t))));
+
+        // Copy argument 6
+        load64(Address(X86Registers::esp, 5 * sizeof(int64_t)), scratchRegister());
+        store64(scratchRegister(), Address(X86Registers::esp, -3 * static_cast<int32_t>(sizeof(int64_t))));
+
+        // We also need to allocate the shadow space on the stack for the 4 parameter registers.
+        // Also, we should allocate 16 bytes for the frame pointer, and return address (not populated).
+        // In addition, we need to allocate 16 bytes for two more parameters, since the call can have up to 6 parameters.
+        sub64(TrustedImm32(8 * sizeof(int64_t)), X86Registers::esp);
+#endif
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister());
+        Call result = Call(m_assembler.call(scratchRegister()), Call::Linkable);
+#if OS(WINDOWS)
+        add64(TrustedImm32(8 * sizeof(int64_t)), X86Registers::esp);
+#endif
+        ASSERT_UNUSED(label, differenceBetween(label, result) == REPATCH_OFFSET_CALL_R11);
+        return result;
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        jump(Address(scratchRegister()));
+    }
+
+    Call tailRecursiveCall()
+    {
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister());
+        Jump newJump = Jump(m_assembler.jmp_r(scratchRegister()));
+        ASSERT_UNUSED(label, differenceBetween(label, newJump) == REPATCH_OFFSET_CALL_R11);
+        return Call::fromTailJump(newJump);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        DataLabelPtr label = moveWithPatch(TrustedImmPtr(0), scratchRegister());
+        Jump newJump = Jump(m_assembler.jmp_r(scratchRegister()));
+        ASSERT_UNUSED(label, differenceBetween(label, newJump) == REPATCH_OFFSET_CALL_R11);
+        return Call::fromTailJump(newJump);
+    }
+
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 src, AbsoluteAddress dest)
+    {
+        move(TrustedImmPtr(dest.m_ptr), scratchRegister());
+        add32(src, Address(scratchRegister()));
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    void add64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addq_rr(src, dest);
+    }
+    
+    void add64(Address src, RegisterID dest)
+    {
+        m_assembler.addq_mr(src.offset, src.base, dest);
+    }
+
+    void add64(RegisterID src, Address dest)
+    {
+        m_assembler.addq_rm(src, dest.offset, dest.base);
+    }
+
+    void add64(AbsoluteAddress src, RegisterID dest)
+    {
+        move(TrustedImmPtr(src.m_ptr), scratchRegister());
+        add64(Address(scratchRegister()), dest);
+    }
+
+    void add64(TrustedImm32 imm, RegisterID srcDest)
+    {
+        if (imm.m_value == 1)
+            m_assembler.incq_r(srcDest);
+        else
+            m_assembler.addq_ir(imm.m_value, srcDest);
+    }
+
+    void add64(TrustedImm64 imm, RegisterID dest)
+    {
+        if (imm.m_value == 1)
+            m_assembler.incq_r(dest);
+        else {
+            move(imm, scratchRegister());
+            add64(scratchRegister(), dest);
+        }
+    }
+
+    void add64(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.leaq_mr(imm.m_value, src, dest);
+    }
+
+    void add64(TrustedImm32 imm, Address address)
+    {
+        if (imm.m_value == 1)
+            m_assembler.incq_m(address.offset, address.base);
+        else
+            m_assembler.addq_im(imm.m_value, address.offset, address.base);
+    }
+
+    void add64(TrustedImm32 imm, AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        add64(imm, Address(scratchRegister()));
+    }
+
+    void add64(RegisterID a, RegisterID b, RegisterID dest)
+    {
+        x86Lea64(BaseIndex(a, b, TimesOne), dest);
+    }
+
+    void x86Lea64(BaseIndex index, RegisterID dest)
+    {
+        if (!index.scale && !index.offset) {
+            if (index.base == dest) {
+                add64(index.index, dest);
+                return;
+            }
+            if (index.index == dest) {
+                add64(index.base, dest);
+                return;
+            }
+        }
+        m_assembler.leaq_mr(index.offset, index.base, index.index, index.scale, dest);
+    }
+
+    void addPtrNoFlags(TrustedImm32 imm, RegisterID srcDest)
+    {
+        m_assembler.leaq_mr(imm.m_value, srcDest, srcDest);
+    }
+
+    void and64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andq_rr(src, dest);
+    }
+
+    void and64(TrustedImm32 imm, RegisterID srcDest)
+    {
+        m_assembler.andq_ir(imm.m_value, srcDest);
+    }
+
+    void and64(TrustedImmPtr imm, RegisterID srcDest)
+    {
+        intptr_t intValue = imm.asIntptr();
+        if (intValue <= std::numeric_limits<int32_t>::max()
+            && intValue >= std::numeric_limits<int32_t>::min()) {
+            and64(TrustedImm32(static_cast<int32_t>(intValue)), srcDest);
+            return;
+        }
+        move(imm, scratchRegister());
+        and64(scratchRegister(), srcDest);
+    }
+
+    void and64(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2 && op1 != dest && op2 != dest)
+            move(op1, dest);
+        else if (op1 == dest)
+            and64(op2, dest);
+        else {
+            move(op2, dest);
+            and64(op1, dest);
+        }
+    }
+
+    void countLeadingZeros64(RegisterID src, RegisterID dst)
+    {
+        if (supportsLZCNT()) {
+            m_assembler.lzcntq_rr(src, dst);
+            return;
+        }
+        m_assembler.bsrq_rr(src, dst);
+        clz64AfterBsr(dst);
+    }
+
+    void countLeadingZeros64(Address src, RegisterID dst)
+    {
+        if (supportsLZCNT()) {
+            m_assembler.lzcntq_mr(src.offset, src.base, dst);
+            return;
+        }
+        m_assembler.bsrq_mr(src.offset, src.base, dst);
+        clz64AfterBsr(dst);
+    }
+
+    void countTrailingZeros64(RegisterID src, RegisterID dst)
+    {
+        if (supportsBMI1()) {
+            m_assembler.tzcntq_rr(src, dst);
+            return;
+        }
+        m_assembler.bsfq_rr(src, dst);
+        ctzAfterBsf<64>(dst);
+    }
+
+    void lshift64(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shlq_i8r(imm.m_value, dest);
+    }
+    
+    void lshift64(RegisterID src, RegisterID dest)
+    {
+        if (src == X86Registers::ecx)
+            m_assembler.shlq_CLr(dest);
+        else {
+            ASSERT(src != dest);
+
+            // Can only shift by ecx, so we do some swapping if we see anything else.
+            swap(src, X86Registers::ecx);
+            m_assembler.shlq_CLr(dest == X86Registers::ecx ? src : dest);
+            swap(src, X86Registers::ecx);
+        }
+    }
+    
+    void rshift64(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.sarq_i8r(imm.m_value, dest);
+    }
+
+    void rshift64(RegisterID src, RegisterID dest)
+    {
+        if (src == X86Registers::ecx)
+            m_assembler.sarq_CLr(dest);
+        else {
+            ASSERT(src != dest);
+            
+            // Can only shift by ecx, so we do some swapping if we see anything else.
+            swap(src, X86Registers::ecx);
+            m_assembler.sarq_CLr(dest == X86Registers::ecx ? src : dest);
+            swap(src, X86Registers::ecx);
+        }
+    }
+
+    void urshift64(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.shrq_i8r(imm.m_value, dest);
+    }
+
+    void urshift64(RegisterID src, RegisterID dest)
+    {
+        if (src == X86Registers::ecx)
+            m_assembler.shrq_CLr(dest);
+        else {
+            ASSERT(src != dest);
+            
+            // Can only shift by ecx, so we do some swapping if we see anything else.
+            swap(src, X86Registers::ecx);
+            m_assembler.shrq_CLr(dest == X86Registers::ecx ? src : dest);
+            swap(src, X86Registers::ecx);
+        }
+    }
+
+    void rotateRight64(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.rorq_i8r(imm.m_value, dest);
+    }
+
+    void rotateRight64(RegisterID src, RegisterID dest)
+    {
+        if (src == X86Registers::ecx)
+            m_assembler.rorq_CLr(dest);
+        else {
+            ASSERT(src != dest);
+
+            // Can only rotate by ecx, so we do some swapping if we see anything else.
+            swap(src, X86Registers::ecx);
+            m_assembler.rorq_CLr(dest == X86Registers::ecx ? src : dest);
+            swap(src, X86Registers::ecx);
+        }
+    }
+
+    void rotateLeft64(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.rolq_i8r(imm.m_value, dest);
+    }
+
+    void rotateLeft64(RegisterID src, RegisterID dest)
+    {
+        if (src == X86Registers::ecx)
+            m_assembler.rolq_CLr(dest);
+        else {
+            ASSERT(src != dest);
+
+            // Can only rotate by ecx, so we do some swapping if we see anything else.
+            swap(src, X86Registers::ecx);
+            m_assembler.rolq_CLr(dest == X86Registers::ecx ? src : dest);
+            swap(src, X86Registers::ecx);
+        }
+    }
+
+    void mul64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.imulq_rr(src, dest);
+    }
+
+    void mul64(RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src2 == dest) {
+            m_assembler.imulq_rr(src1, dest);
+            return;
+        }
+        move(src1, dest);
+        m_assembler.imulq_rr(src2, dest);
+    }
+    
+    void x86ConvertToQuadWord64()
+    {
+        m_assembler.cqo();
+    }
+
+    void x86ConvertToQuadWord64(RegisterID rax, RegisterID rdx)
+    {
+        ASSERT_UNUSED(rax, rax == X86Registers::eax);
+        ASSERT_UNUSED(rdx, rdx == X86Registers::edx);
+        x86ConvertToQuadWord64();
+    }
+
+    void x86Div64(RegisterID denominator)
+    {
+        m_assembler.idivq_r(denominator);
+    }
+
+    void x86Div64(RegisterID rax, RegisterID rdx, RegisterID denominator)
+    {
+        ASSERT_UNUSED(rax, rax == X86Registers::eax);
+        ASSERT_UNUSED(rdx, rdx == X86Registers::edx);
+        x86Div64(denominator);
+    }
+
+    void x86UDiv64(RegisterID denominator)
+    {
+        m_assembler.divq_r(denominator);
+    }
+
+    void x86UDiv64(RegisterID rax, RegisterID rdx, RegisterID denominator)
+    {
+        ASSERT_UNUSED(rax, rax == X86Registers::eax);
+        ASSERT_UNUSED(rdx, rdx == X86Registers::edx);
+        x86UDiv64(denominator);
+    }
+
+    void neg64(RegisterID dest)
+    {
+        m_assembler.negq_r(dest);
+    }
+
+    void or64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orq_rr(src, dest);
+    }
+
+    void or64(TrustedImm64 imm, RegisterID srcDest)
+    {
+        if (imm.m_value <= std::numeric_limits<int32_t>::max()
+            && imm.m_value >= std::numeric_limits<int32_t>::min()) {
+            or64(TrustedImm32(static_cast<int32_t>(imm.m_value)), srcDest);
+            return;
+        }
+        move(imm, scratchRegister());
+        or64(scratchRegister(), srcDest);
+    }
+
+    void or64(TrustedImm32 imm, RegisterID dest)
+    {
+        m_assembler.orq_ir(imm.m_value, dest);
+    }
+
+    void or64(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            move(op1, dest);
+        else if (op1 == dest)
+            or64(op2, dest);
+        else {
+            move(op2, dest);
+            or64(op1, dest);
+        }
+    }
+
+    void or64(TrustedImm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+        or64(imm, dest);
+    }
+
+    void sub64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subq_rr(src, dest);
+    }
+    
+    void sub64(TrustedImm32 imm, RegisterID dest)
+    {
+        if (imm.m_value == 1)
+            m_assembler.decq_r(dest);
+        else
+            m_assembler.subq_ir(imm.m_value, dest);
+    }
+    
+    void sub64(TrustedImm64 imm, RegisterID dest)
+    {
+        if (imm.m_value == 1)
+            m_assembler.decq_r(dest);
+        else {
+            move(imm, scratchRegister());
+            sub64(scratchRegister(), dest);
+        }
+    }
+
+    void sub64(TrustedImm32 imm, Address address)
+    {
+        m_assembler.subq_im(imm.m_value, address.offset, address.base);
+    }
+
+    void sub64(Address src, RegisterID dest)
+    {
+        m_assembler.subq_mr(src.offset, src.base, dest);
+    }
+
+    void sub64(RegisterID src, Address dest)
+    {
+        m_assembler.subq_rm(src, dest.offset, dest.base);
+    }
+
+    void xor64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorq_rr(src, dest);
+    }
+
+    void xor64(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op1 == op2)
+            move(TrustedImm32(0), dest);
+        else if (op1 == dest)
+            xor64(op2, dest);
+        else {
+            move(op2, dest);
+            xor64(op1, dest);
+        }
+    }
+    
+    void xor64(RegisterID src, Address dest)
+    {
+        m_assembler.xorq_rm(src, dest.offset, dest.base);
+    }
+
+    void xor64(TrustedImm32 imm, RegisterID srcDest)
+    {
+        m_assembler.xorq_ir(imm.m_value, srcDest);
+    }
+
+    void not64(RegisterID srcDest)
+    {
+        m_assembler.notq_r(srcDest);
+    }
+
+    void not64(Address dest)
+    {
+        m_assembler.notq_m(dest.offset, dest.base);
+    }
+
+    void load64(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.movq_mr(address.offset, address.base, dest);
+    }
+
+    void load64(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    void load64(const void* address, RegisterID dest)
+    {
+        if (dest == X86Registers::eax)
+            m_assembler.movq_mEAX(address);
+        else {
+            move(TrustedImmPtr(address), dest);
+            load64(dest, dest);
+        }
+    }
+
+    DataLabel32 load64WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        padBeforePatch();
+        m_assembler.movq_mr_disp32(address.offset, address.base, dest);
+        return DataLabel32(this);
+    }
+    
+    DataLabelCompact load64WithCompactAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        padBeforePatch();
+        m_assembler.movq_mr_disp8(address.offset, address.base, dest);
+        return DataLabelCompact(this);
+    }
+
+    void store64(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.movq_rm(src, address.offset, address.base);
+    }
+
+    void store64(RegisterID src, BaseIndex address)
+    {
+        m_assembler.movq_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+    
+    void store64(RegisterID src, void* address)
+    {
+        if (src == X86Registers::eax)
+            m_assembler.movq_EAXm(address);
+        else {
+            move(TrustedImmPtr(address), scratchRegister());
+            store64(src, scratchRegister());
+        }
+    }
+
+    void store64(TrustedImm32 imm, ImplicitAddress address)
+    {
+        m_assembler.movq_i32m(imm.m_value, address.offset, address.base);
+    }
+
+    void store64(TrustedImm64 imm, ImplicitAddress address)
+    {
+        if (CAN_SIGN_EXTEND_32_64(imm.m_value)) {
+            store64(TrustedImm32(static_cast<int32_t>(imm.m_value)), address);
+            return;
+        }
+
+        move(imm, scratchRegister());
+        store64(scratchRegister(), address);
+    }
+
+    void store64(TrustedImm64 imm, BaseIndex address)
+    {
+        move(imm, scratchRegister());
+        m_assembler.movq_rm(scratchRegister(), address.offset, address.base, address.index, address.scale);
+    }
+    
+    DataLabel32 store64WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        padBeforePatch();
+        m_assembler.movq_rm_disp32(src, address.offset, address.base);
+        return DataLabel32(this);
+    }
+
+    void swap64(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xchgq_rr(src, dest);
+    }
+
+    void swap64(RegisterID src, Address dest)
+    {
+        m_assembler.xchgq_rm(src, dest.offset, dest.base);
+    }
+
+    void move64ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void moveDoubleTo64(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void compare64(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                test64(*resultCondition, left, left, dest);
+                return;
+            }
+        }
+
+        m_assembler.cmpq_ir(right.m_value, left);
+        set32(x86Condition(cond), dest);
+    }
+    
+    void compare64(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmpq_rr(right, left);
+        set32(x86Condition(cond), dest);
+    }
+
+    void compareDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right, RegisterID dest)
+    {
+        if (cond & DoubleConditionBitInvert)
+            m_assembler.ucomisd_rr(left, right);
+        else
+            m_assembler.ucomisd_rr(right, left);
+
+        if (cond == DoubleEqual) {
+            if (left == right) {
+                m_assembler.setnp_r(dest);
+                return;
+            }
+
+            Jump isUnordered(m_assembler.jp());
+            m_assembler.sete_r(dest);
+            isUnordered.link(this);
+            return;
+        }
+
+        if (cond == DoubleNotEqualOrUnordered) {
+            if (left == right) {
+                m_assembler.setp_r(dest);
+                return;
+            }
+
+            m_assembler.setp_r(dest);
+            m_assembler.setne_r(dest);
+            return;
+        }
+
+        ASSERT(!(cond & DoubleConditionBitSpecial));
+        m_assembler.setCC_r(static_cast<X86Assembler::Condition>(cond & ~DoubleConditionBits), dest);
+    }
+
+    Jump branch64(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmpq_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch64(RelationalCondition cond, RegisterID left, TrustedImm32 right)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond))
+                return branchTest64(*resultCondition, left, left);
+        }
+        m_assembler.cmpq_ir(right.m_value, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch64(RelationalCondition cond, RegisterID left, TrustedImm64 right)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value) {
+            m_assembler.testq_rr(left, left);
+            return Jump(m_assembler.jCC(x86Condition(cond)));
+        }
+        move(right, scratchRegister());
+        return branch64(cond, left, scratchRegister());
+    }
+
+    Jump branch64(RelationalCondition cond, RegisterID left, Address right)
+    {
+        m_assembler.cmpq_mr(right.offset, right.base, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch64(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        move(TrustedImmPtr(left.m_ptr), scratchRegister());
+        return branch64(cond, Address(scratchRegister()), right);
+    }
+
+    Jump branch64(RelationalCondition cond, Address left, RegisterID right)
+    {
+        m_assembler.cmpq_rm(right, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch64(RelationalCondition cond, Address left, TrustedImm32 right)
+    {
+        m_assembler.cmpq_im(right.m_value, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch64(RelationalCondition cond, Address left, TrustedImm64 right)
+    {
+        move(right, scratchRegister());
+        return branch64(cond, left, scratchRegister());
+    }
+
+    Jump branch64(RelationalCondition cond, BaseIndex address, RegisterID right)
+    {
+        m_assembler.cmpq_rm(right, address.offset, address.base, address.index, address.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branch32(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, scratchRegister());
+        return branch32(cond, scratchRegister(), right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, BaseIndex left, RegisterID right)
+    {
+        return branch64(cond, left, right);
+    }
+
+    Jump branchPtr(RelationalCondition cond, BaseIndex left, TrustedImmPtr right)
+    {
+        move(right, scratchRegister());
+        return branchPtr(cond, left, scratchRegister());
+    }
+
+    Jump branchTest64(ResultCondition cond, RegisterID reg, RegisterID mask)
+    {
+        m_assembler.testq_rr(reg, mask);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchTest64(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        // if we are only interested in the low seven bits, this can be tested with a testb
+        if (mask.m_value == -1)
+            m_assembler.testq_rr(reg, reg);
+        else if ((mask.m_value & ~0x7f) == 0)
+            m_assembler.testb_i8r(mask.m_value, reg);
+        else
+            m_assembler.testq_i32r(mask.m_value, reg);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest64(ResultCondition cond, RegisterID reg, TrustedImm64 mask)
+    {
+        move(mask, scratchRegister());
+        return branchTest64(cond, reg, scratchRegister());
+    }
+
+    void test64(ResultCondition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest)
+    {
+        if (mask.m_value == -1)
+            m_assembler.testq_rr(reg, reg);
+        else if ((mask.m_value & ~0x7f) == 0)
+            m_assembler.testb_i8r(mask.m_value, reg);
+        else
+            m_assembler.testq_i32r(mask.m_value, reg);
+        set32(x86Condition(cond), dest);
+    }
+
+    void test64(ResultCondition cond, RegisterID reg, RegisterID mask, RegisterID dest)
+    {
+        m_assembler.testq_rr(reg, mask);
+        set32(x86Condition(cond), dest);
+    }
+
+    Jump branchTest64(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        load64(address.m_ptr, scratchRegister());
+        return branchTest64(cond, scratchRegister(), mask);
+    }
+
+    Jump branchTest64(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpq_im(0, address.offset, address.base);
+        else
+            m_assembler.testq_i32m(mask.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest64(ResultCondition cond, Address address, RegisterID reg)
+    {
+        m_assembler.testq_rm(reg, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest64(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale);
+        else
+            m_assembler.testq_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+
+    Jump branchAdd64(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        add64(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd64(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            return branchAdd64(cond, src2, dest);
+        move(src2, dest);
+        return branchAdd64(cond, src1, dest);
+    }
+
+    Jump branchAdd64(ResultCondition cond, Address op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest)
+            return branchAdd64(cond, op1, dest);
+        if (op1.base == dest) {
+            load32(op1, dest);
+            return branchAdd64(cond, op2, dest);
+        }
+        move(op2, dest);
+        return branchAdd64(cond, op1, dest);
+    }
+
+    Jump branchAdd64(ResultCondition cond, RegisterID src1, Address src2, RegisterID dest)
+    {
+        return branchAdd64(cond, src2, src1, dest);
+    }
+
+    Jump branchAdd64(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        add64(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd64(ResultCondition cond, Address src, RegisterID dest)
+    {
+        add64(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchMul64(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        mul64(src, dest);
+        if (cond != Overflow)
+            m_assembler.testq_rr(dest, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchMul64(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
+    {
+        if (src1 == dest)
+            return branchMul64(cond, src2, dest);
+        move(src2, dest);
+        return branchMul64(cond, src1, dest);
+    }
+
+    Jump branchSub64(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
+    {
+        sub64(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub64(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        sub64(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSub64(ResultCondition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest)
+    {
+        move(src1, dest);
+        return branchSub64(cond, src2, dest);
+    }
+
+    Jump branchNeg64(ResultCondition cond, RegisterID srcDest)
+    {
+        neg64(srcDest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    void moveConditionally64(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID src, RegisterID dest)
+    {
+        m_assembler.cmpq_rr(right, left);
+        cmov(x86Condition(cond), src, dest);
+    }
+
+    void moveConditionally64(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        m_assembler.cmpq_rr(right, left);
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest)
+            cmov(x86Condition(cond), thenCase, dest);
+        else
+            cmov(x86Condition(invert(cond)), elseCase, dest);
+    }
+
+    void moveConditionally64(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        if (!right.m_value) {
+            if (auto resultCondition = commuteCompareToZeroIntoTest(cond)) {
+                moveConditionallyTest64(*resultCondition, left, left, thenCase, elseCase, dest);
+                return;
+            }
+        }
+
+        m_assembler.cmpq_ir(right.m_value, left);
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest)
+            cmov(x86Condition(cond), thenCase, dest);
+        else
+            cmov(x86Condition(invert(cond)), elseCase, dest);
+    }
+
+    void moveConditionallyTest64(ResultCondition cond, RegisterID testReg, RegisterID mask, RegisterID src, RegisterID dest)
+    {
+        m_assembler.testq_rr(testReg, mask);
+        cmov(x86Condition(cond), src, dest);
+    }
+
+    void moveConditionallyTest64(ResultCondition cond, RegisterID left, RegisterID right, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        ASSERT(isInvertible(cond));
+        ASSERT_WITH_MESSAGE(cond != Overflow, "TEST does not set the Overflow Flag.");
+
+        m_assembler.testq_rr(right, left);
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest)
+            cmov(x86Condition(cond), thenCase, dest);
+        else
+            cmov(x86Condition(invert(cond)), elseCase, dest);
+    }
+    
+    void moveConditionallyTest64(ResultCondition cond, RegisterID testReg, TrustedImm32 mask, RegisterID src, RegisterID dest)
+    {
+        // if we are only interested in the low seven bits, this can be tested with a testb
+        if (mask.m_value == -1)
+            m_assembler.testq_rr(testReg, testReg);
+        else if ((mask.m_value & ~0x7f) == 0)
+            m_assembler.testb_i8r(mask.m_value, testReg);
+        else
+            m_assembler.testq_i32r(mask.m_value, testReg);
+        cmov(x86Condition(cond), src, dest);
+    }
+
+    void moveConditionallyTest64(ResultCondition cond, RegisterID testReg, TrustedImm32 mask, RegisterID thenCase, RegisterID elseCase, RegisterID dest)
+    {
+        ASSERT(isInvertible(cond));
+        ASSERT_WITH_MESSAGE(cond != Overflow, "TEST does not set the Overflow Flag.");
+
+        if (mask.m_value == -1)
+            m_assembler.testq_rr(testReg, testReg);
+        else if (!(mask.m_value & ~0x7f))
+            m_assembler.testb_i8r(mask.m_value, testReg);
+        else
+            m_assembler.testq_i32r(mask.m_value, testReg);
+
+        if (thenCase != dest && elseCase != dest) {
+            move(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest)
+            cmov(x86Condition(cond), thenCase, dest);
+        else
+            cmov(x86Condition(invert(cond)), elseCase, dest);
+    }
+
+    template<typename LeftType, typename RightType>
+    void moveDoubleConditionally64(RelationalCondition cond, LeftType left, RightType right, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        static_assert(!std::is_same<LeftType, FPRegisterID>::value && !std::is_same<RightType, FPRegisterID>::value, "One of the tested argument could be aliased on dest. Use moveDoubleConditionallyDouble().");
+
+        if (thenCase != dest && elseCase != dest) {
+            moveDouble(elseCase, dest);
+            elseCase = dest;
+        }
+
+        if (elseCase == dest) {
+            Jump falseCase = branch64(invert(cond), left, right);
+            moveDouble(thenCase, dest);
+            falseCase.link(this);
+        } else {
+            Jump trueCase = branch64(cond, left, right);
+            moveDouble(elseCase, dest);
+            trueCase.link(this);
+        }
+    }
+
+    template<typename TestType, typename MaskType>
+    void moveDoubleConditionallyTest64(ResultCondition cond, TestType test, MaskType mask, FPRegisterID thenCase, FPRegisterID elseCase, FPRegisterID dest)
+    {
+        static_assert(!std::is_same<TestType, FPRegisterID>::value && !std::is_same<MaskType, FPRegisterID>::value, "One of the tested argument could be aliased on dest. Use moveDoubleConditionallyDouble().");
+
+        if (elseCase == dest && isInvertible(cond)) {
+            Jump falseCase = branchTest64(invert(cond), test, mask);
+            moveDouble(thenCase, dest);
+            falseCase.link(this);
+        } else if (thenCase == dest) {
+            Jump trueCase = branchTest64(cond, test, mask);
+            moveDouble(elseCase, dest);
+            trueCase.link(this);
+        }
+
+        Jump trueCase = branchTest64(cond, test, mask);
+        moveDouble(elseCase, dest);
+        Jump falseCase = jump();
+        trueCase.link(this);
+        moveDouble(thenCase, dest);
+        falseCase.link(this);
+    }
+    
+    void abortWithReason(AbortReason reason)
+    {
+        move(TrustedImm32(reason), X86Registers::r11);
+        breakpoint();
+    }
+
+    void abortWithReason(AbortReason reason, intptr_t misc)
+    {
+        move(TrustedImm64(misc), X86Registers::r10);
+        abortWithReason(reason);
+    }
+
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result = ConvertibleLoadLabel(this);
+        m_assembler.movq_mr(address.offset, address.base, dest);
+        return result;
+    }
+
+    DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest)
+    {
+        padBeforePatch();
+        m_assembler.movq_i64r(initialValue.asIntptr(), dest);
+        return DataLabelPtr(this);
+    }
+
+    DataLabelPtr moveWithPatch(TrustedImm32 initialValue, RegisterID dest)
+    {
+        padBeforePatch();
+        m_assembler.movq_i64r(initialValue.m_value, dest);
+        return DataLabelPtr(this);
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, scratchRegister());
+        return branch64(cond, left, scratchRegister());
+    }
+
+    Jump branchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, scratchRegister());
+        return branch64(cond, left, scratchRegister());
+    }
+
+    Jump branch32WithPatch(RelationalCondition cond, Address left, DataLabel32& dataLabel, TrustedImm32 initialRightValue = TrustedImm32(0))
+    {
+        padBeforePatch();
+        m_assembler.movl_i32r(initialRightValue.m_value, scratchRegister());
+        dataLabel = DataLabel32(this);
+        return branch32(cond, left, scratchRegister());
+    }
+
+    DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address)
+    {
+        DataLabelPtr label = moveWithPatch(initialValue, scratchRegister());
+        store64(scratchRegister(), address);
+        return label;
+    }
+
+    PatchableJump patchableBranch64(RelationalCondition cond, RegisterID reg, TrustedImm64 imm)
+    {
+        return PatchableJump(branch64(cond, reg, imm));
+    }
+
+    PatchableJump patchableBranch64(RelationalCondition cond, RegisterID left, RegisterID right)
+    {
+        return PatchableJump(branch64(cond, left, right));
+    }
+    
+    using MacroAssemblerX86Common::branch8;
+    Jump branch8(RelationalCondition cond, AbsoluteAddress left, TrustedImm32 right)
+    {
+        MacroAssemblerX86Common::move(TrustedImmPtr(left.m_ptr), scratchRegister());
+        return MacroAssemblerX86Common::branch8(cond, Address(scratchRegister()), right);
+    }
+    
+    using MacroAssemblerX86Common::branchTest8;
+    Jump branchTest8(ResultCondition cond, ExtendedAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8(static_cast<int8_t>(mask.m_value));
+        TrustedImmPtr addr(reinterpret_cast<void*>(address.offset));
+        MacroAssemblerX86Common::move(addr, scratchRegister());
+        return MacroAssemblerX86Common::branchTest8(cond, BaseIndex(scratchRegister(), address.base, TimesOne), mask8);
+    }
+    
+    Jump branchTest8(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1))
+    {
+        TrustedImm32 mask8(static_cast<int8_t>(mask.m_value));
+        MacroAssemblerX86Common::move(TrustedImmPtr(address.m_ptr), scratchRegister());
+        return MacroAssemblerX86Common::branchTest8(cond, Address(scratchRegister()), mask8);
+    }
+
+    void truncateDoubleToUint32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.cvttsd2siq_rr(src, dest);
+    }
+
+    void truncateDoubleToInt64(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.cvttsd2siq_rr(src, dest);
+    }
+
+    // int64Min should contain exactly 0x43E0000000000000 == static_cast<double>(int64_t::min()). scratch may
+    // be the same FPR as src.
+    void truncateDoubleToUint64(FPRegisterID src, RegisterID dest, FPRegisterID scratch, FPRegisterID int64Min)
+    {
+        ASSERT(scratch != int64Min);
+
+        // Since X86 does not have a floating point to unsigned integer instruction, we need to use the signed
+        // integer conversion instruction. If the src is less than int64_t::min() then the results of the two
+        // instructions are the same. Otherwise, we need to: subtract int64_t::min(); truncate double to
+        // uint64_t; then add back int64_t::min() in the destination gpr.
+
+        Jump large = branchDouble(DoubleGreaterThanOrEqual, src, int64Min);
+        m_assembler.cvttsd2siq_rr(src, dest);
+        Jump done = jump();
+        large.link(this);
+        moveDouble(src, scratch);
+        m_assembler.subsd_rr(int64Min, scratch);
+        m_assembler.movq_i64r(0x8000000000000000, scratchRegister());
+        m_assembler.cvttsd2siq_rr(scratch, dest);
+        m_assembler.orq_rr(scratchRegister(), dest);
+        done.link(this);
+    }
+
+    void truncateFloatToUint32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.cvttss2siq_rr(src, dest);
+    }
+
+    void truncateFloatToInt64(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.cvttss2siq_rr(src, dest);
+    }
+
+    // int64Min should contain exactly 0x5f000000 == static_cast<float>(int64_t::min()). scratch may be the
+    // same FPR as src.
+    void truncateFloatToUint64(FPRegisterID src, RegisterID dest, FPRegisterID scratch, FPRegisterID int64Min)
+    {
+        ASSERT(scratch != int64Min);
+
+        // Since X86 does not have a floating point to unsigned integer instruction, we need to use the signed
+        // integer conversion instruction. If the src is less than int64_t::min() then the results of the two
+        // instructions are the same. Otherwise, we need to: subtract int64_t::min(); truncate double to
+        // uint64_t; then add back int64_t::min() in the destination gpr.
+
+        Jump large = branchFloat(DoubleGreaterThanOrEqual, src, int64Min);
+        m_assembler.cvttss2siq_rr(src, dest);
+        Jump done = jump();
+        large.link(this);
+        moveDouble(src, scratch);
+        m_assembler.subss_rr(int64Min, scratch);
+        m_assembler.movq_i64r(0x8000000000000000, scratchRegister());
+        m_assembler.cvttss2siq_rr(scratch, dest);
+        m_assembler.orq_rr(scratchRegister(), dest);
+        done.link(this);
+    }
+
+    void convertInt64ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.cvtsi2sdq_rr(src, dest);
+    }
+
+    void convertInt64ToDouble(Address src, FPRegisterID dest)
+    {
+        m_assembler.cvtsi2sdq_mr(src.offset, src.base, dest);
+    }
+
+    void convertInt64ToFloat(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.cvtsi2ssq_rr(src, dest);
+    }
+
+    void convertInt64ToFloat(Address src, FPRegisterID dest)
+    {
+        m_assembler.cvtsi2ssq_mr(src.offset, src.base, dest);
+    }
+
+    // One of scratch or scratch2 may be the same as src
+    void convertUInt64ToDouble(RegisterID src, FPRegisterID dest, RegisterID scratch)
+    {
+        RegisterID scratch2 = scratchRegister();
+
+        m_assembler.testq_rr(src, src);
+        AssemblerLabel signBitSet = m_assembler.jCC(x86Condition(Signed));
+        m_assembler.cvtsi2sdq_rr(src, dest);
+        AssemblerLabel done = m_assembler.jmp();
+        m_assembler.linkJump(signBitSet, m_assembler.label());
+        if (scratch != src)
+            m_assembler.movq_rr(src, scratch);
+        m_assembler.movq_rr(src, scratch2);
+        m_assembler.shrq_i8r(1, scratch);
+        m_assembler.andq_ir(1, scratch2);
+        m_assembler.orq_rr(scratch, scratch2);
+        m_assembler.cvtsi2sdq_rr(scratch2, dest);
+        m_assembler.addsd_rr(dest, dest);
+        m_assembler.linkJump(done, m_assembler.label());
+    }
+
+    // One of scratch or scratch2 may be the same as src
+    void convertUInt64ToFloat(RegisterID src, FPRegisterID dest, RegisterID scratch)
+    {
+        RegisterID scratch2 = scratchRegister();
+        m_assembler.testq_rr(src, src);
+        AssemblerLabel signBitSet = m_assembler.jCC(x86Condition(Signed));
+        m_assembler.cvtsi2ssq_rr(src, dest);
+        AssemblerLabel done = m_assembler.jmp();
+        m_assembler.linkJump(signBitSet, m_assembler.label());
+        if (scratch != src)
+            m_assembler.movq_rr(src, scratch);
+        m_assembler.movq_rr(src, scratch2);
+        m_assembler.shrq_i8r(1, scratch);
+        m_assembler.andq_ir(1, scratch2);
+        m_assembler.orq_rr(scratch, scratch2);
+        m_assembler.cvtsi2ssq_rr(scratch2, dest);
+        m_assembler.addss_rr(dest, dest);
+        m_assembler.linkJump(done, m_assembler.label());
+    }
+
+    static bool supportsFloatingPoint() { return true; }
+    static bool supportsFloatingPointTruncate() { return true; }
+    static bool supportsFloatingPointSqrt() { return true; }
+    static bool supportsFloatingPointAbs() { return true; }
+    
+    static FunctionPtr readCallTarget(CodeLocationCall call)
+    {
+        return FunctionPtr(X86Assembler::readPointer(call.dataLabelPtrAtOffset(-REPATCH_OFFSET_CALL_R11).dataLocation()));
+    }
+
+    bool haveScratchRegisterForBlinding() { return m_allowScratchRegister; }
+    RegisterID scratchRegisterForBlinding() { return scratchRegister(); }
+
+    static bool canJumpReplacePatchableBranchPtrWithPatch() { return true; }
+    static bool canJumpReplacePatchableBranch32WithPatch() { return true; }
+    
+    static CodeLocationLabel startOfBranchPtrWithPatchOnRegister(CodeLocationDataLabelPtr label)
+    {
+        const int rexBytes = 1;
+        const int opcodeBytes = 1;
+        const int immediateBytes = 8;
+        const int totalBytes = rexBytes + opcodeBytes + immediateBytes;
+        ASSERT(totalBytes >= maxJumpReplacementSize());
+        return label.labelAtOffset(-totalBytes);
+    }
+    
+    static CodeLocationLabel startOfBranch32WithPatchOnRegister(CodeLocationDataLabel32 label)
+    {
+        const int rexBytes = 1;
+        const int opcodeBytes = 1;
+        const int immediateBytes = 4;
+        const int totalBytes = rexBytes + opcodeBytes + immediateBytes;
+        ASSERT(totalBytes >= maxJumpReplacementSize());
+        return label.labelAtOffset(-totalBytes);
+    }
+    
+    static CodeLocationLabel startOfPatchableBranchPtrWithPatchOnAddress(CodeLocationDataLabelPtr label)
+    {
+        return startOfBranchPtrWithPatchOnRegister(label);
+    }
+
+    static CodeLocationLabel startOfPatchableBranch32WithPatchOnAddress(CodeLocationDataLabel32 label)
+    {
+        return startOfBranch32WithPatchOnRegister(label);
+    }
+    
+    static void revertJumpReplacementToPatchableBranchPtrWithPatch(CodeLocationLabel instructionStart, Address, void* initialValue)
+    {
+        X86Assembler::revertJumpTo_movq_i64r(instructionStart.executableAddress(), reinterpret_cast<intptr_t>(initialValue), s_scratchRegister);
+    }
+
+    static void revertJumpReplacementToPatchableBranch32WithPatch(CodeLocationLabel instructionStart, Address, int32_t initialValue)
+    {
+        X86Assembler::revertJumpTo_movl_i32r(instructionStart.executableAddress(), initialValue, s_scratchRegister);
+    }
+
+    static void revertJumpReplacementToBranchPtrWithPatch(CodeLocationLabel instructionStart, RegisterID, void* initialValue)
+    {
+        X86Assembler::revertJumpTo_movq_i64r(instructionStart.executableAddress(), reinterpret_cast<intptr_t>(initialValue), s_scratchRegister);
+    }
+
+    static void repatchCall(CodeLocationCall call, CodeLocationLabel destination)
+    {
+        X86Assembler::repatchPointer(call.dataLabelPtrAtOffset(-REPATCH_OFFSET_CALL_R11).dataLocation(), destination.executableAddress());
+    }
+
+    static void repatchCall(CodeLocationCall call, FunctionPtr destination)
+    {
+        X86Assembler::repatchPointer(call.dataLabelPtrAtOffset(-REPATCH_OFFSET_CALL_R11).dataLocation(), destination.executableAddress());
+    }
+
+private:
+    // If lzcnt is not available, use this after BSR
+    // to count the leading zeros.
+    void clz64AfterBsr(RegisterID dst)
+    {
+        Jump srcIsNonZero = m_assembler.jCC(x86Condition(NonZero));
+        move(TrustedImm32(64), dst);
+
+        Jump skipNonZeroCase = jump();
+        srcIsNonZero.link(this);
+        xor64(TrustedImm32(0x3f), dst);
+        skipNonZeroCase.link(this);
+    }
+
+    friend class LinkBuffer;
+
+    static void linkCall(void* code, Call call, FunctionPtr function)
+    {
+        if (!call.isFlagSet(Call::Near))
+            X86Assembler::linkPointer(code, call.m_label.labelAtOffset(-REPATCH_OFFSET_CALL_R11), function.value());
+        else if (call.isFlagSet(Call::Tail))
+            X86Assembler::linkJump(code, call.m_label, function.value());
+        else
+            X86Assembler::linkCall(code, call.m_label, function.value());
+    }
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
diff --git a/assembler/MaxFrameExtentForSlowPathCall.h b/assembler/MaxFrameExtentForSlowPathCall.h
new file mode 100644
index 0000000..04ca0a7
--- /dev/null
+++ b/assembler/MaxFrameExtentForSlowPathCall.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Register.h"
+#include "StackAlignment.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+// The maxFrameExtentForSlowPathCall is the max amount of stack space (in bytes)
+// that can be used for outgoing args when calling a slow path C function
+// from JS code.
+
+#if !ENABLE(JIT)
+static const size_t maxFrameExtentForSlowPathCall = 0;
+
+#elif CPU(X86_64) && OS(WINDOWS)
+// 4 args in registers, but stack space needs to be allocated for all args.
+static const size_t maxFrameExtentForSlowPathCall = 64;
+
+#elif CPU(X86_64)
+// All args in registers.
+static const size_t maxFrameExtentForSlowPathCall = 0;
+
+#elif CPU(X86)
+// 7 args on stack (28 bytes).
+static const size_t maxFrameExtentForSlowPathCall = 40;
+
+#elif CPU(ARM64)
+// All args in registers.
+static const size_t maxFrameExtentForSlowPathCall = 0;
+
+#elif CPU(ARM)
+// First four args in registers, remaining 4 args on stack.
+static const size_t maxFrameExtentForSlowPathCall = 24;
+
+#elif CPU(SH4)
+// First four args in registers, remaining 4 args on stack.
+static const size_t maxFrameExtentForSlowPathCall = 24;
+
+#elif CPU(MIPS)
+// Though args are in registers, there need to be space on the stack for all args.
+static const size_t maxFrameExtentForSlowPathCall = 40;
+
+#else
+#error "Unsupported CPU: need value for maxFrameExtentForSlowPathCall"
+
+#endif
+
+COMPILE_ASSERT(!(maxFrameExtentForSlowPathCall % sizeof(Register)), extent_must_be_in_multiples_of_registers);
+
+#if ENABLE(JIT)
+// Make sure that cfr - maxFrameExtentForSlowPathCall bytes will make the stack pointer aligned
+COMPILE_ASSERT((maxFrameExtentForSlowPathCall % 16) == 16 - sizeof(CallerFrameAndPC), extent_must_align_stack_from_callframe_pointer);
+#endif
+
+static const size_t maxFrameExtentForSlowPathCallInRegisters = maxFrameExtentForSlowPathCall / sizeof(Register);
+
+} // namespace JSC
diff --git a/assembler/SH4Assembler.h b/assembler/SH4Assembler.h
new file mode 100644
index 0000000..52217d8
--- /dev/null
+++ b/assembler/SH4Assembler.h
@@ -0,0 +1,2222 @@
+/*
+ * Copyright (C) 2013 Cisco Systems, Inc. All rights reserved.
+ * Copyright (C) 2009-2011 STMicroelectronics. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && CPU(SH4)
+
+#include "AssemblerBuffer.h"
+#include "AssemblerBufferWithConstantPool.h"
+#include "JITCompilationEffort.h"
+#include <limits.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <wtf/Assertions.h>
+#include <wtf/DataLog.h>
+#include <wtf/Vector.h>
+
+#ifndef NDEBUG
+#define SH4_ASSEMBLER_TRACING
+#endif
+
+namespace JSC {
+typedef uint16_t SH4Word;
+
+enum {
+    INVALID_OPCODE = 0xffff,
+    ADD_OPCODE = 0x300c,
+    ADDIMM_OPCODE = 0x7000,
+    ADDC_OPCODE = 0x300e,
+    ADDV_OPCODE = 0x300f,
+    AND_OPCODE = 0x2009,
+    ANDIMM_OPCODE = 0xc900,
+    DIV0_OPCODE = 0x2007,
+    DIV1_OPCODE = 0x3004,
+    BF_OPCODE = 0x8b00,
+    BFS_OPCODE = 0x8f00,
+    BRA_OPCODE = 0xa000,
+    BRAF_OPCODE = 0x0023,
+    NOP_OPCODE = 0x0009,
+    BSR_OPCODE = 0xb000,
+    RTS_OPCODE = 0x000b,
+    BT_OPCODE = 0x8900,
+    BTS_OPCODE = 0x8d00,
+    BSRF_OPCODE = 0x0003,
+    BRK_OPCODE = 0x003b,
+    FTRC_OPCODE = 0xf03d,
+    CMPEQ_OPCODE = 0x3000,
+    CMPEQIMM_OPCODE = 0x8800,
+    CMPGE_OPCODE = 0x3003,
+    CMPGT_OPCODE = 0x3007,
+    CMPHI_OPCODE = 0x3006,
+    CMPHS_OPCODE = 0x3002,
+    CMPPL_OPCODE = 0x4015,
+    CMPPZ_OPCODE = 0x4011,
+    CMPSTR_OPCODE = 0x200c,
+    DT_OPCODE = 0x4010,
+    FCMPEQ_OPCODE = 0xf004,
+    FCMPGT_OPCODE = 0xf005,
+    FMOV_OPCODE = 0xf00c,
+    FADD_OPCODE = 0xf000,
+    FMUL_OPCODE = 0xf002,
+    FSUB_OPCODE = 0xf001,
+    FDIV_OPCODE = 0xf003,
+    FNEG_OPCODE = 0xf04d,
+    JMP_OPCODE = 0x402b,
+    JSR_OPCODE = 0x400b,
+    LDSPR_OPCODE = 0x402a,
+    LDSLPR_OPCODE = 0x4026,
+    MOV_OPCODE = 0x6003,
+    MOVIMM_OPCODE = 0xe000,
+    MOVB_WRITE_RN_OPCODE = 0x2000,
+    MOVB_WRITE_RNDEC_OPCODE = 0x2004,
+    MOVB_WRITE_R0RN_OPCODE = 0x0004,
+    MOVB_WRITE_OFFGBR_OPCODE = 0xc000,
+    MOVB_WRITE_OFFRN_OPCODE = 0x8000,
+    MOVB_READ_RM_OPCODE = 0x6000,
+    MOVB_READ_RMINC_OPCODE = 0x6004,
+    MOVB_READ_R0RM_OPCODE = 0x000c,
+    MOVB_READ_OFFGBR_OPCODE = 0xc400,
+    MOVB_READ_OFFRM_OPCODE = 0x8400,
+    MOVL_WRITE_RN_OPCODE = 0x2002,
+    MOVL_WRITE_RNDEC_OPCODE = 0x2006,
+    MOVL_WRITE_R0RN_OPCODE = 0x0006,
+    MOVL_WRITE_OFFGBR_OPCODE = 0xc200,
+    MOVL_WRITE_OFFRN_OPCODE = 0x1000,
+    MOVL_READ_RM_OPCODE = 0x6002,
+    MOVL_READ_RMINC_OPCODE = 0x6006,
+    MOVL_READ_R0RM_OPCODE = 0x000e,
+    MOVL_READ_OFFGBR_OPCODE = 0xc600,
+    MOVL_READ_OFFPC_OPCODE = 0xd000,
+    MOVL_READ_OFFRM_OPCODE = 0x5000,
+    MOVW_WRITE_RN_OPCODE = 0x2001,
+    MOVW_WRITE_R0RN_OPCODE = 0x0005,
+    MOVW_READ_RM_OPCODE = 0x6001,
+    MOVW_READ_RMINC_OPCODE = 0x6005,
+    MOVW_READ_R0RM_OPCODE = 0x000d,
+    MOVW_READ_OFFRM_OPCODE = 0x8500,
+    MOVW_READ_OFFPC_OPCODE = 0x9000,
+    MOVA_READ_OFFPC_OPCODE = 0xc700,
+    MOVT_OPCODE = 0x0029,
+    MULL_OPCODE = 0x0007,
+    DMULL_L_OPCODE = 0x3005,
+    STSMACL_OPCODE = 0x001a,
+    STSMACH_OPCODE = 0x000a,
+    DMULSL_OPCODE = 0x300d,
+    NEG_OPCODE = 0x600b,
+    NEGC_OPCODE = 0x600a,
+    NOT_OPCODE = 0x6007,
+    OR_OPCODE = 0x200b,
+    ORIMM_OPCODE = 0xcb00,
+    ORBIMM_OPCODE = 0xcf00,
+    SETS_OPCODE = 0x0058,
+    SETT_OPCODE = 0x0018,
+    SHAD_OPCODE = 0x400c,
+    SHAL_OPCODE = 0x4020,
+    SHAR_OPCODE = 0x4021,
+    SHLD_OPCODE = 0x400d,
+    SHLL_OPCODE = 0x4000,
+    SHLL2_OPCODE = 0x4008,
+    SHLL8_OPCODE = 0x4018,
+    SHLL16_OPCODE = 0x4028,
+    SHLR_OPCODE = 0x4001,
+    SHLR2_OPCODE = 0x4009,
+    SHLR8_OPCODE = 0x4019,
+    SHLR16_OPCODE = 0x4029,
+    STSPR_OPCODE = 0x002a,
+    STSLPR_OPCODE = 0x4022,
+    FLOAT_OPCODE = 0xf02d,
+    SUB_OPCODE = 0x3008,
+    SUBC_OPCODE = 0x300a,
+    SUBV_OPCODE = 0x300b,
+    TST_OPCODE = 0x2008,
+    TSTIMM_OPCODE = 0xc800,
+    TSTB_OPCODE = 0xcc00,
+    EXTUB_OPCODE = 0x600c,
+    EXTUW_OPCODE = 0x600d,
+    XOR_OPCODE = 0x200a,
+    XORIMM_OPCODE = 0xca00,
+    XORB_OPCODE = 0xce00,
+    FMOVS_READ_RM_INC_OPCODE = 0xf009,
+    FMOVS_READ_RM_OPCODE = 0xf008,
+    FMOVS_READ_R0RM_OPCODE = 0xf006,
+    FMOVS_WRITE_RN_OPCODE = 0xf00a,
+    FMOVS_WRITE_RN_DEC_OPCODE = 0xf00b,
+    FMOVS_WRITE_R0RN_OPCODE = 0xf007,
+    FCNVDS_DRM_FPUL_OPCODE = 0xf0bd,
+    FCNVSD_FPUL_DRN_OPCODE = 0xf0ad,
+    LDS_RM_FPUL_OPCODE = 0x405a,
+    FLDS_FRM_FPUL_OPCODE = 0xf01d,
+    STS_FPUL_RN_OPCODE = 0x005a,
+    FSTS_FPUL_FRN_OPCODE = 0xF00d,
+    LDSFPSCR_OPCODE = 0x406a,
+    STSFPSCR_OPCODE = 0x006a,
+    LDSRMFPUL_OPCODE = 0x405a,
+    FSTSFPULFRN_OPCODE = 0xf00d,
+    FABS_OPCODE = 0xf05d,
+    FSQRT_OPCODE = 0xf06d,
+    FSCHG_OPCODE = 0xf3fd,
+    CLRT_OPCODE = 8,
+    SYNCO_OPCODE = 0x00ab,
+};
+
+namespace SH4Registers {
+typedef enum {
+    r0,
+    r1,
+    r2,
+    r3,
+    r4,
+    r5,
+    r6,
+    r7,
+    r8,
+    r9,
+    r10,
+    r11,
+    r12,
+    r13,
+    r14, fp = r14,
+    r15, sp = r15,
+    pc,
+    pr,
+} RegisterID;
+
+typedef enum {
+    fr0, dr0 = fr0,
+    fr1,
+    fr2, dr2 = fr2,
+    fr3,
+    fr4, dr4 = fr4,
+    fr5,
+    fr6, dr6 = fr6,
+    fr7,
+    fr8, dr8 = fr8,
+    fr9,
+    fr10, dr10 = fr10,
+    fr11,
+    fr12, dr12 = fr12,
+    fr13,
+    fr14, dr14 = fr14,
+    fr15,
+} FPRegisterID;
+}
+
+inline uint16_t getOpcodeGroup1(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0xf) << 4));
+}
+
+inline uint16_t getOpcodeGroup2(uint16_t opc, int rm)
+{
+    return (opc | ((rm & 0xf) << 8));
+}
+
+inline uint16_t getOpcodeGroup3(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | (rn & 0xff));
+}
+
+inline uint16_t getOpcodeGroup4(uint16_t opc, int rm, int rn, int offset)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0xf) << 4) | (offset & 0xf));
+}
+
+inline uint16_t getOpcodeGroup5(uint16_t opc, int rm)
+{
+    return (opc | (rm & 0xff));
+}
+
+inline uint16_t getOpcodeGroup6(uint16_t opc, int rm)
+{
+    return (opc | (rm & 0xfff));
+}
+
+inline uint16_t getOpcodeGroup7(uint16_t opc, int rm)
+{
+    return (opc | ((rm & 0x7) << 9));
+}
+
+inline uint16_t getOpcodeGroup8(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0x7) << 9) | ((rn & 0x7) << 5));
+}
+
+inline uint16_t getOpcodeGroup9(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 8) | ((rn & 0x7) << 5));
+}
+
+inline uint16_t getOpcodeGroup10(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0x7) << 9) | ((rn & 0xf) << 4));
+}
+
+inline uint16_t getOpcodeGroup11(uint16_t opc, int rm, int rn)
+{
+    return (opc | ((rm & 0xf) << 4) | (rn & 0xf));
+}
+
+inline uint16_t getRn(uint16_t x)
+{
+    return ((x & 0xf00) >> 8);
+}
+
+inline uint16_t getRm(uint16_t x)
+{
+    return ((x & 0xf0) >> 4);
+}
+
+inline uint16_t getDisp(uint16_t x)
+{
+    return (x & 0xf);
+}
+
+inline uint16_t getImm8(uint16_t x)
+{
+    return (x & 0xff);
+}
+
+inline uint16_t getImm12(uint16_t x)
+{
+    return (x & 0xfff);
+}
+
+inline uint16_t getDRn(uint16_t x)
+{
+    return ((x & 0xe00) >> 9);
+}
+
+inline uint16_t getDRm(uint16_t x)
+{
+    return ((x & 0xe0) >> 5);
+}
+
+class SH4Assembler {
+public:
+    typedef SH4Registers::RegisterID RegisterID;
+    typedef SH4Registers::FPRegisterID FPRegisterID;
+    typedef AssemblerBufferWithConstantPool<512, 4, 2, SH4Assembler> SH4Buffer;
+    static const RegisterID scratchReg1 = SH4Registers::r3;
+    static const RegisterID scratchReg2 = SH4Registers::r11;
+    static const uint32_t maxInstructionSize = 16;
+
+    static constexpr RegisterID firstRegister() { return SH4Registers::r0; }
+    static constexpr RegisterID lastRegister() { return SH4Registers::r15; }
+
+    static constexpr FPRegisterID firstFPRegister() { return SH4Registers::dr0; }
+    static constexpr FPRegisterID lastFPRegister() { return SH4Registers::dr14; }
+
+    enum {
+        padForAlign8 = 0x00,
+        padForAlign16 = 0x0009,
+        padForAlign32 = 0x00090009,
+    };
+
+    enum JumpType {
+        JumpFar,
+        JumpNear
+    };
+
+    SH4Assembler()
+        : m_claimscratchReg(0x0)
+        , m_indexOfLastWatchpoint(INT_MIN)
+        , m_indexOfTailOfLastWatchpoint(INT_MIN)
+    {
+    }
+
+    SH4Buffer& buffer() { return m_buffer; }
+
+    // SH4 condition codes
+    typedef enum {
+        EQ = 0x0, // Equal
+        NE = 0x1, // Not Equal
+        HS = 0x2, // Unsigned Greater Than equal
+        HI = 0x3, // Unsigned Greater Than
+        LS = 0x4, // Unsigned Lower or Same
+        LI = 0x5, // Unsigned Lower
+        GE = 0x6, // Greater or Equal
+        LT = 0x7, // Less Than
+        GT = 0x8, // Greater Than
+        LE = 0x9, // Less or Equal
+        OF = 0xa, // OverFlow
+        SI = 0xb, // Signed
+        NS = 0xc, // Not Signed
+        EQU= 0xd, // Equal or unordered(NaN)
+        NEU= 0xe,
+        GTU= 0xf,
+        GEU= 0x10,
+        LTU= 0x11,
+        LEU= 0x12,
+    } Condition;
+
+    // Opaque label types
+public:
+    bool isImmediate(int constant)
+    {
+        return ((constant <= 127) && (constant >= -128));
+    }
+
+    RegisterID claimScratch()
+    {
+        ASSERT((m_claimscratchReg != 0x3));
+
+        if (!(m_claimscratchReg & 0x1)) {
+            m_claimscratchReg = (m_claimscratchReg | 0x1);
+            return scratchReg1;
+        }
+
+        m_claimscratchReg = (m_claimscratchReg | 0x2);
+        return scratchReg2;
+    }
+
+    void releaseScratch(RegisterID scratchR)
+    {
+        if (scratchR == scratchReg1)
+            m_claimscratchReg = (m_claimscratchReg & 0x2);
+        else
+            m_claimscratchReg = (m_claimscratchReg & 0x1);
+    }
+
+    // Stack operations
+
+    void pushReg(RegisterID reg)
+    {
+        if (reg == SH4Registers::pr) {
+            oneShortOp(getOpcodeGroup2(STSLPR_OPCODE, SH4Registers::sp));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup1(MOVL_WRITE_RNDEC_OPCODE, SH4Registers::sp, reg));
+    }
+
+    void popReg(RegisterID reg)
+    {
+        if (reg == SH4Registers::pr) {
+            oneShortOp(getOpcodeGroup2(LDSLPR_OPCODE, SH4Registers::sp));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup1(MOVL_READ_RMINC_OPCODE, reg, SH4Registers::sp));
+    }
+
+    void movt(RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(MOVT_OPCODE, dst);
+        oneShortOp(opc);
+    }
+
+    // Arithmetic operations
+
+    void addlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADD_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addclRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADDC_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addvlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(ADDV_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void addlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 127) && (imm8 >= -128));
+
+        uint16_t opc = getOpcodeGroup3(ADDIMM_OPCODE, dst, imm8);
+        oneShortOp(opc);
+    }
+
+    void andlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(AND_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void andlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT_UNUSED(dst, dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(ANDIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void div1lRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DIV1_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void div0lRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DIV0_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void notlReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(NOT_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void orlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(OR_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void orlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT_UNUSED(dst, dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(ORIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void sublRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(SUB_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void subvlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(SUBV_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void xorlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(XOR_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void xorlImm8r(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 255) && (imm8 >= 0));
+        ASSERT_UNUSED(dst, dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(XORIMM_OPCODE, imm8);
+        oneShortOp(opc);
+    }
+
+    void shllImm8r(int imm, RegisterID dst)
+    {
+        switch (imm) {
+        case 1:
+            oneShortOp(getOpcodeGroup2(SHLL_OPCODE, dst));
+            break;
+        case 2:
+            oneShortOp(getOpcodeGroup2(SHLL2_OPCODE, dst));
+            break;
+        case 8:
+            oneShortOp(getOpcodeGroup2(SHLL8_OPCODE, dst));
+            break;
+        case 16:
+            oneShortOp(getOpcodeGroup2(SHLL16_OPCODE, dst));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void neg(RegisterID dst, RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup1(NEG_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void shldRegReg(RegisterID dst, RegisterID rShift)
+    {
+        oneShortOp(getOpcodeGroup1(SHLD_OPCODE, dst, rShift));
+    }
+
+    void shadRegReg(RegisterID dst, RegisterID rShift)
+    {
+        oneShortOp(getOpcodeGroup1(SHAD_OPCODE, dst, rShift));
+    }
+
+    void shlrImm8r(int imm, RegisterID dst)
+    {
+        switch (imm) {
+        case 1:
+            oneShortOp(getOpcodeGroup2(SHLR_OPCODE, dst));
+            break;
+        case 2:
+            oneShortOp(getOpcodeGroup2(SHLR2_OPCODE, dst));
+            break;
+        case 8:
+            oneShortOp(getOpcodeGroup2(SHLR8_OPCODE, dst));
+            break;
+        case 16:
+            oneShortOp(getOpcodeGroup2(SHLR16_OPCODE, dst));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void shalImm8r(int imm, RegisterID dst)
+    {
+        switch (imm) {
+        case 1:
+            oneShortOp(getOpcodeGroup2(SHAL_OPCODE, dst));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void sharImm8r(int imm, RegisterID dst)
+    {
+        switch (imm) {
+        case 1:
+            oneShortOp(getOpcodeGroup2(SHAR_OPCODE, dst));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void imullRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MULL_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void dmullRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DMULL_L_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void dmulslRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(DMULSL_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void stsmacl(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSMACL_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stsmach(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSMACH_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    // Comparisons
+
+    void cmplRegReg(RegisterID left, RegisterID right, Condition cond)
+    {
+        switch (cond) {
+        case NE:
+            oneShortOp(getOpcodeGroup1(CMPEQ_OPCODE, right, left));
+            break;
+        case GT:
+            oneShortOp(getOpcodeGroup1(CMPGT_OPCODE, right, left));
+            break;
+        case EQ:
+            oneShortOp(getOpcodeGroup1(CMPEQ_OPCODE, right, left));
+            break;
+        case GE:
+            oneShortOp(getOpcodeGroup1(CMPGE_OPCODE, right, left));
+            break;
+        case HS:
+            oneShortOp(getOpcodeGroup1(CMPHS_OPCODE, right, left));
+            break;
+        case HI:
+            oneShortOp(getOpcodeGroup1(CMPHI_OPCODE, right, left));
+            break;
+        case LI:
+            oneShortOp(getOpcodeGroup1(CMPHI_OPCODE, left, right));
+            break;
+        case LS:
+            oneShortOp(getOpcodeGroup1(CMPHS_OPCODE, left, right));
+            break;
+        case LE:
+            oneShortOp(getOpcodeGroup1(CMPGE_OPCODE, left, right));
+            break;
+        case LT:
+            oneShortOp(getOpcodeGroup1(CMPGT_OPCODE, left, right));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void cmppl(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(CMPPL_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void cmppz(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(CMPPZ_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void cmpEqImmR0(int imm, RegisterID dst)
+    {
+        ASSERT_UNUSED(dst, dst == SH4Registers::r0);
+        uint16_t opc = getOpcodeGroup5(CMPEQIMM_OPCODE, imm);
+        oneShortOp(opc);
+    }
+
+    void testlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(TST_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void testlImm8r(int imm, RegisterID dst)
+    {
+        ASSERT((imm <= 255) && (imm >= 0));
+        ASSERT_UNUSED(dst, dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup5(TSTIMM_OPCODE, imm);
+        oneShortOp(opc);
+    }
+
+    void nop()
+    {
+        oneShortOp(NOP_OPCODE, false);
+    }
+
+    void synco()
+    {
+        oneShortOp(SYNCO_OPCODE);
+    }
+
+    void sett()
+    {
+        oneShortOp(SETT_OPCODE);
+    }
+
+    void clrt()
+    {
+        oneShortOp(CLRT_OPCODE);
+    }
+
+    void fschg()
+    {
+        oneShortOp(FSCHG_OPCODE);
+    }
+
+    void bkpt()
+    {
+        oneShortOp(BRK_OPCODE, false);
+    }
+
+    void branch(uint16_t opc, int label)
+    {
+        switch (opc) {
+        case BT_OPCODE:
+            ASSERT((label <= 127) && (label >= -128));
+            oneShortOp(getOpcodeGroup5(BT_OPCODE, label));
+            break;
+        case BRA_OPCODE:
+            ASSERT((label <= 2047) && (label >= -2048));
+            oneShortOp(getOpcodeGroup6(BRA_OPCODE, label));
+            break;
+        case BF_OPCODE:
+            ASSERT((label <= 127) && (label >= -128));
+            oneShortOp(getOpcodeGroup5(BF_OPCODE, label));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void branch(uint16_t opc, RegisterID reg)
+    {
+        switch (opc) {
+        case BRAF_OPCODE:
+            oneShortOp(getOpcodeGroup2(BRAF_OPCODE, reg));
+            break;
+        case JMP_OPCODE:
+            oneShortOp(getOpcodeGroup2(JMP_OPCODE, reg));
+            break;
+        case JSR_OPCODE:
+            oneShortOp(getOpcodeGroup2(JSR_OPCODE, reg));
+            break;
+        case BSRF_OPCODE:
+            oneShortOp(getOpcodeGroup2(BSRF_OPCODE, reg));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void ldspr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(LDSPR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stspr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSPR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void extub(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(EXTUB_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+    
+    void extuw(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(EXTUW_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    // float operations
+
+    void ldsrmfpul(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(LDS_RM_FPUL_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void fneg(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(FNEG_OPCODE, dst);
+        oneShortOp(opc, true, false);
+    }
+
+    void fsqrt(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup2(FSQRT_OPCODE, dst);
+        oneShortOp(opc, true, false);
+    }
+
+    void stsfpulReg(RegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(STS_FPUL_RN_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void floatfpulfrn(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FLOAT_OPCODE, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmull(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMUL_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOV_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadrm(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriterm(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_RN_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriter0r(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_R0RN_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadr0r(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsReadrminc(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_READ_RM_INC_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fmovsWriterndec(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(FMOVS_WRITE_RN_DEC_OPCODE, dst, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void ftrcRegfpul(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FTRC_OPCODE, src);
+        oneShortOp(opc, true, false);
+    }
+
+    void fldsfpul(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FLDS_FRM_FPUL_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void fstsfpul(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup2(FSTS_FPUL_FRN_OPCODE, src);
+        oneShortOp(opc);
+    }
+
+    void ldsfpscr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(LDSFPSCR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    void stsfpscr(RegisterID reg)
+    {
+        uint16_t opc = getOpcodeGroup2(STSFPSCR_OPCODE, reg);
+        oneShortOp(opc);
+    }
+
+    // double operations
+
+    void dcnvds(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FCNVDS_DRM_FPUL_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dcnvsd(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup7(FCNVSD_FPUL_DRN_OPCODE, dst >> 1);
+        oneShortOp(opc);
+    }
+
+    void dcmppeq(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FCMPEQ_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dcmppgt(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FCMPGT_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dmulRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FMUL_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dsubRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FSUB_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void daddRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FADD_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dmovRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FMOV_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void ddivRegReg(FPRegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup8(FDIV_OPCODE, dst >> 1, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void dabs(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup7(FABS_OPCODE, dst >> 1);
+        oneShortOp(opc);
+    }
+
+    void dsqrt(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup7(FSQRT_OPCODE, dst >> 1);
+        oneShortOp(opc);
+    }
+
+    void dneg(FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup7(FNEG_OPCODE, dst >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovReadrm(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_RM_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovWriterm(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_RN_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovWriter0r(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_R0RN_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void fmovReadr0r(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_R0RM_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovReadrminc(RegisterID src, FPRegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup10(FMOVS_READ_RM_INC_OPCODE, dst >> 1, src);
+        oneShortOp(opc);
+    }
+
+    void fmovWriterndec(FPRegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup9(FMOVS_WRITE_RN_DEC_OPCODE, dst, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void floatfpulDreg(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FLOAT_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    void ftrcdrmfpul(FPRegisterID src)
+    {
+        uint16_t opc = getOpcodeGroup7(FTRC_OPCODE, src >> 1);
+        oneShortOp(opc);
+    }
+
+    // Various move ops
+
+    void movImm8(int imm8, RegisterID dst)
+    {
+        ASSERT((imm8 <= 127) && (imm8 >= -128));
+
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, imm8);
+        oneShortOp(opc);
+    }
+
+    void movlRegReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOV_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwRegMem(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_WRITE_RN_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwMemReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwMemRegIn(RegisterID base, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_READ_RMINC_OPCODE, dst, base);
+        oneShortOp(opc);
+    }
+
+    void movwPCReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT_UNUSED(base, base == SH4Registers::pc);
+        ASSERT((offset <= 255) && (offset >= 0));
+
+        uint16_t opc = getOpcodeGroup3(MOVW_READ_OFFPC_OPCODE, dst, offset);
+        oneShortOp(opc);
+    }
+
+    void movwMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT_UNUSED(dst, dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup11(MOVW_READ_OFFRM_OPCODE, base, offset);
+        oneShortOp(opc);
+    }
+
+    void movwR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movwRegMemr0(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVW_WRITE_R0RN_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlRegMem(RegisterID src, int offset, RegisterID base)
+    {
+        ASSERT((offset <= 15) && (offset >= 0));
+
+        if (!offset) {
+            oneShortOp(getOpcodeGroup1(MOVL_WRITE_RN_OPCODE, base, src));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup4(MOVL_WRITE_OFFRN_OPCODE, base, src, offset));
+    }
+
+    void movlRegMem(RegisterID src, RegisterID base)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_WRITE_RN_OPCODE, base, src);
+        oneShortOp(opc);
+    }
+
+    void movlMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        if (base == SH4Registers::pc) {
+            ASSERT((offset <= 255) && (offset >= 0));
+            oneShortOp(getOpcodeGroup3(MOVL_READ_OFFPC_OPCODE, dst, offset));
+            return;
+        }
+
+        ASSERT((offset <= 15) && (offset >= 0));
+        if (!offset) {
+            oneShortOp(getOpcodeGroup1(MOVL_READ_RM_OPCODE, dst, base));
+            return;
+        }
+
+        oneShortOp(getOpcodeGroup4(MOVL_READ_OFFRM_OPCODE, dst, base, offset));
+    }
+
+    void movlMemRegCompact(int offset, RegisterID base, RegisterID dst)
+    {
+        oneShortOp(getOpcodeGroup4(MOVL_READ_OFFRM_OPCODE, dst, base, offset));
+    }
+
+    void movbRegMem(RegisterID src, RegisterID base)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_WRITE_RN_OPCODE, base, src);
+        oneShortOp(opc);
+    }
+
+    void movbMemReg(int offset, RegisterID base, RegisterID dst)
+    {
+        ASSERT_UNUSED(dst, dst == SH4Registers::r0);
+
+        uint16_t opc = getOpcodeGroup11(MOVB_READ_OFFRM_OPCODE, base, offset);
+        oneShortOp(opc);
+    }
+
+    void movbR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movbMemReg(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_READ_RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movbMemRegIn(RegisterID base, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_READ_RMINC_OPCODE, dst, base);
+        oneShortOp(opc);
+    }
+
+    void movbRegMemr0(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVB_WRITE_R0RN_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlMemReg(RegisterID base, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_RM_OPCODE, dst, base);
+        oneShortOp(opc);
+    }
+
+    void movlMemRegIn(RegisterID base, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_RMINC_OPCODE, dst, base);
+        oneShortOp(opc);
+    }
+
+    void movlR0mr(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_READ_R0RM_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void movlRegMemr0(RegisterID src, RegisterID dst)
+    {
+        uint16_t opc = getOpcodeGroup1(MOVL_WRITE_R0RN_OPCODE, dst, src);
+        oneShortOp(opc);
+    }
+
+    void loadConstant(uint32_t constant, RegisterID dst)
+    {
+        if (((int)constant <= 0x7f) && ((int)constant >= -0x80)) {
+            movImm8(constant, dst);
+            return;
+        }
+
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, 0);
+
+        m_buffer.ensureSpace(maxInstructionSize, sizeof(uint32_t));
+        printInstr(getOpcodeGroup3(MOVIMM_OPCODE, dst, constant), m_buffer.codeSize());
+        m_buffer.putShortWithConstantInt(opc, constant, true);
+    }
+
+    void loadConstantUnReusable(uint32_t constant, RegisterID dst, bool ensureSpace = false)
+    {
+        uint16_t opc = getOpcodeGroup3(MOVIMM_OPCODE, dst, 0);
+
+        if (ensureSpace)
+            m_buffer.ensureSpace(maxInstructionSize, sizeof(uint32_t));
+
+        printInstr(getOpcodeGroup3(MOVIMM_OPCODE, dst, constant), m_buffer.codeSize());
+        m_buffer.putShortWithConstantInt(opc, constant);
+    }
+
+    // Flow control
+
+    AssemblerLabel call()
+    {
+        RegisterID scr = claimScratch();
+        m_buffer.ensureSpace(maxInstructionSize + 4, sizeof(uint32_t));
+        loadConstantUnReusable(0x0, scr);
+        branch(JSR_OPCODE, scr);
+        nop();
+        releaseScratch(scr);
+        return m_buffer.label();
+    }
+
+    AssemblerLabel call(RegisterID dst)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        branch(JSR_OPCODE, dst);
+        nop();
+        return m_buffer.label();
+    }
+
+    AssemblerLabel jmp()
+    {
+        RegisterID scr = claimScratch();
+        m_buffer.ensureSpace(maxInstructionSize + 4, sizeof(uint32_t));
+        loadConstantUnReusable(0x0, scr);
+        branch(BRAF_OPCODE, scr);
+        nop();
+        releaseScratch(scr);
+        return m_buffer.label();
+    }
+
+    AssemblerLabel extraInstrForBranch(RegisterID dst)
+    {
+        loadConstantUnReusable(0x0, dst);
+        branch(BRAF_OPCODE, dst);
+        nop();
+        return m_buffer.label();
+    }
+
+    AssemblerLabel jmp(RegisterID dst)
+    {
+        jmpReg(dst);
+        return m_buffer.label();
+    }
+
+    void jmpReg(RegisterID dst)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        branch(JMP_OPCODE, dst);
+        nop();
+    }
+
+    AssemblerLabel jne()
+    {
+        branch(BF_OPCODE, 0);
+        return m_buffer.label();
+    }
+
+    AssemblerLabel je()
+    {
+        branch(BT_OPCODE, 0);
+        return m_buffer.label();
+    }
+
+    AssemblerLabel bra()
+    {
+        branch(BRA_OPCODE, 0);
+        return m_buffer.label();
+    }
+
+    void ret()
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        oneShortOp(RTS_OPCODE, false);
+    }
+
+    AssemblerLabel labelIgnoringWatchpoints()
+    {
+        m_buffer.ensureSpaceForAnyInstruction();
+        return m_buffer.label();
+    }
+
+    AssemblerLabel labelForWatchpoint()
+    {
+        m_buffer.ensureSpaceForAnyInstruction();
+        AssemblerLabel result = m_buffer.label();
+        if (static_cast<int>(result.m_offset) != m_indexOfLastWatchpoint)
+            result = label();
+        m_indexOfLastWatchpoint = result.m_offset;
+        m_indexOfTailOfLastWatchpoint = result.m_offset + maxJumpReplacementSize();
+        return result;
+    }
+
+    AssemblerLabel label()
+    {
+        AssemblerLabel result = labelIgnoringWatchpoints();
+        while (UNLIKELY(static_cast<int>(result.m_offset) < m_indexOfTailOfLastWatchpoint)) {
+            nop();
+            result = labelIgnoringWatchpoints();
+        }
+        return result;
+    }
+
+    int sizeOfConstantPool()
+    {
+        return m_buffer.sizeOfConstantPool();
+    }
+
+    AssemblerLabel align(int alignment)
+    {
+        m_buffer.ensureSpace(maxInstructionSize + 2);
+        while (!m_buffer.isAligned(alignment)) {
+            nop();
+            m_buffer.ensureSpace(maxInstructionSize + 2);
+        }
+        return label();
+    }
+
+    static void changePCrelativeAddress(int offset, uint16_t* instructionPtr, uint32_t newAddress)
+    {
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        uint32_t address = (offset << 2) + ((reinterpret_cast<uint32_t>(instructionPtr) + 4) &(~0x3));
+        *reinterpret_cast<uint32_t*>(address) = newAddress;
+    }
+
+    static uint32_t readPCrelativeAddress(int offset, uint16_t* instructionPtr)
+    {
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        uint32_t address = (offset << 2) + ((reinterpret_cast<uint32_t>(instructionPtr) + 4) &(~0x3));
+        return *reinterpret_cast<uint32_t*>(address);
+    }
+
+    static uint16_t* getInstructionPtr(void* code, int offset)
+    {
+        return reinterpret_cast<uint16_t*> (reinterpret_cast<uint32_t>(code) + offset);
+    }
+
+    static void linkJump(void* code, AssemblerLabel from, void* to)
+    {
+        ASSERT(from.isSet());
+
+        uint16_t* instructionPtr = getInstructionPtr(code, from.m_offset) - 3;
+        int offsetBits = (reinterpret_cast<uint32_t>(to) - reinterpret_cast<uint32_t>(code)) - from.m_offset;
+
+        /* MOV #imm, reg => LDR reg
+           braf @reg        braf @reg
+           nop              nop
+        */
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        ASSERT((instructionPtr[1] & 0xf0ff) == BRAF_OPCODE);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits);
+        printInstr(*instructionPtr, from.m_offset + 2);
+    }
+
+    static void linkCall(void* code, AssemblerLabel from, void* to)
+    {
+        uint16_t* instructionPtr = getInstructionPtr(code, from.m_offset);
+        instructionPtr -= 3;
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(to));
+    }
+
+    static void linkPointer(void* code, AssemblerLabel where, void* value)
+    {
+        uint16_t* instructionPtr = getInstructionPtr(code, where.m_offset);
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(value));
+    }
+
+    static unsigned getCallReturnOffset(AssemblerLabel call)
+    {
+        ASSERT(call.isSet());
+        return call.m_offset;
+    }
+
+    static uint32_t* getLdrImmAddressOnPool(SH4Word* insn, uint32_t* constPool)
+    {
+        return (constPool + (*insn & 0xff));
+    }
+
+    static SH4Word patchConstantPoolLoad(SH4Word load, int value)
+    {
+        return ((load & ~0xff) | value);
+    }
+
+    static SH4Buffer::TwoShorts placeConstantPoolBarrier(int offset)
+    {
+        ASSERT(((offset >> 1) <= 2047) && ((offset >> 1) >= -2048));
+
+        SH4Buffer::TwoShorts m_barrier;
+        m_barrier.high = (BRA_OPCODE | (offset >> 1));
+        m_barrier.low = NOP_OPCODE;
+        printInstr(((BRA_OPCODE | (offset >> 1))), 0);
+        printInstr(NOP_OPCODE, 0);
+        return m_barrier;
+    }
+
+    static void patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
+    {
+        SH4Word* instructionPtr = reinterpret_cast<SH4Word*>(loadAddr);
+        SH4Word instruction = *instructionPtr;
+        SH4Word index = instruction & 0xff;
+
+        if ((instruction & 0xf000) != MOVIMM_OPCODE)
+            return;
+
+        ASSERT((((reinterpret_cast<uint32_t>(constPoolAddr) - reinterpret_cast<uint32_t>(loadAddr)) + index * 4)) < 1024);
+
+        int offset = reinterpret_cast<uint32_t>(constPoolAddr) + (index * 4) - ((reinterpret_cast<uint32_t>(instructionPtr) & ~0x03) + 4);
+        instruction &= 0x0f00;
+        instruction |= 0xd000;
+        offset &= 0x03ff;
+        instruction |= (offset >> 2);
+        *instructionPtr = instruction;
+        printInstr(instruction, reinterpret_cast<uint32_t>(loadAddr));
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        patchPointer(where, value);
+    }
+
+    static void* readPointer(void* code)
+    {
+        return reinterpret_cast<void*>(readInt32(code));
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*>(where);
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, value);
+    }
+
+    static void repatchCompact(void* where, int32_t value)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*>(where);
+        ASSERT(value >= 0);
+        ASSERT(value <= 60);
+
+        // Handle the uncommon case where a flushConstantPool occured in movlMemRegCompact.
+        if ((instructionPtr[0] & 0xf000) == BRA_OPCODE)
+            instructionPtr += (instructionPtr[0] & 0x0fff) + 2;
+
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFRM_OPCODE);
+        instructionPtr[0] = (instructionPtr[0] & 0xfff0) | (value >> 2);
+        cacheFlush(instructionPtr, sizeof(uint16_t));
+    }
+
+    static void relinkCall(void* from, void* to)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*>(from);
+        instructionPtr -= 3;
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(to));
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        uint16_t* instructionPtr = reinterpret_cast<uint16_t*> (from);
+        instructionPtr -= 3;
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        ASSERT((instructionPtr[1] & 0xf0ff) == BRAF_OPCODE);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, reinterpret_cast<uint32_t>(to) - reinterpret_cast<uint32_t>(from));
+    }
+
+    // Linking & patching
+
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return sizeof(SH4Word) * 6;
+    }
+
+    static void replaceWithJump(void *instructionStart, void *to)
+    {
+        SH4Word* instruction = reinterpret_cast<SH4Word*>(instructionStart);
+        intptr_t difference = reinterpret_cast<intptr_t>(to) - (reinterpret_cast<intptr_t>(instruction) + 3 * sizeof(SH4Word));
+
+        if ((instruction[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE) {
+            // We have an entry in constant pool and we potentially replace a branchPtrWithPatch, so let's backup what would be the
+            // condition (CMP/xx and Bx opcodes) for later use in revertJumpReplacementToBranchPtrWithPatch before putting the jump.
+            instruction[4] = instruction[1];
+            instruction[5] = instruction[2];
+            instruction[1] = (BRAF_OPCODE | (instruction[0] & 0x0f00));
+            instruction[2] = NOP_OPCODE;
+            cacheFlush(&instruction[1], 2 * sizeof(SH4Word));
+        } else {
+            instruction[0] = getOpcodeGroup3(MOVL_READ_OFFPC_OPCODE, SH4Registers::r13, 1);
+            instruction[1] = getOpcodeGroup2(BRAF_OPCODE, SH4Registers::r13);
+            instruction[2] = NOP_OPCODE;
+            cacheFlush(instruction, 3 * sizeof(SH4Word));
+        }
+
+        changePCrelativeAddress(instruction[0] & 0x00ff, instruction, difference);
+    }
+
+    static void revertJumpReplacementToBranchPtrWithPatch(void* instructionStart, RegisterID rd, int imm)
+    {
+        SH4Word *insn = reinterpret_cast<SH4Word*>(instructionStart);
+        ASSERT((insn[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        ASSERT((insn[0] & 0x00ff) != 1);
+
+        insn[0] = getOpcodeGroup3(MOVL_READ_OFFPC_OPCODE, SH4Registers::r13, insn[0] & 0x00ff);
+        if ((insn[1] & 0xf0ff) == BRAF_OPCODE) {
+            insn[1] = (insn[4] & 0xf00f) | (rd << 8) | (SH4Registers::r13 << 4); // Restore CMP/xx opcode.
+            insn[2] = insn[5];
+            ASSERT(((insn[2] & 0xff00) == BT_OPCODE) || ((insn[2] & 0xff00) == BF_OPCODE));
+            ASSERT((insn[3] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+            insn[4] = (BRAF_OPCODE | (insn[3] & 0x0f00));
+            insn[5] = NOP_OPCODE;
+            cacheFlush(insn, 6 * sizeof(SH4Word));
+        } else {
+            // The branchPtrWithPatch has already been restored, so we just patch the immediate value and ASSERT all is as expected.
+            ASSERT((insn[1] & 0xf000) == 0x3000);
+            insn[1] = (insn[1] & 0xf00f) | (rd << 8) | (SH4Registers::r13 << 4);
+            cacheFlush(insn, 2 * sizeof(SH4Word));
+            ASSERT(((insn[2] & 0xff00) == BT_OPCODE) || ((insn[2] & 0xff00) == BF_OPCODE));
+            ASSERT((insn[3] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+            ASSERT(insn[5] == NOP_OPCODE);
+        }
+
+        changePCrelativeAddress(insn[0] & 0x00ff, insn, imm);
+    }
+
+    void linkJump(AssemblerLabel from, AssemblerLabel to, JumpType type = JumpFar)
+    {
+        ASSERT(to.isSet());
+        ASSERT(from.isSet());
+
+        uint16_t* instructionPtr = getInstructionPtr(data(), from.m_offset) - 1;
+        int offsetBits = (to.m_offset - from.m_offset);
+
+        if (type == JumpNear) {
+            uint16_t instruction = instructionPtr[0];
+            int offset = (offsetBits - 2);
+            ASSERT((((instruction == BT_OPCODE) || (instruction == BF_OPCODE)) && (offset >= -256) && (offset <= 254))
+                || ((instruction == BRA_OPCODE) && (offset >= -4096) && (offset <= 4094)));
+            *instructionPtr++ = instruction | (offset >> 1);
+            printInstr(*instructionPtr, from.m_offset + 2);
+            return;
+        }
+
+        /* MOV # imm, reg => LDR reg
+           braf @reg         braf @reg
+           nop               nop
+        */
+        instructionPtr -= 2;
+        ASSERT((instructionPtr[1] & 0xf0ff) == BRAF_OPCODE);
+
+        if ((instructionPtr[0] & 0xf000) == MOVIMM_OPCODE) {
+            uint32_t* addr = getLdrImmAddressOnPool(instructionPtr, m_buffer.poolAddress());
+            *addr = offsetBits;
+            printInstr(*instructionPtr, from.m_offset + 2);
+            return;
+        }
+
+        ASSERT((instructionPtr[0] & 0xf000) == MOVL_READ_OFFPC_OPCODE);
+        changePCrelativeAddress((*instructionPtr & 0xff), instructionPtr, offsetBits);
+        printInstr(*instructionPtr, from.m_offset + 2);
+    }
+
+    static void* getRelocatedAddress(void* code, AssemblerLabel label)
+    {
+        return reinterpret_cast<void*>(reinterpret_cast<char*>(code) + label.m_offset);
+    }
+
+    static int getDifferenceBetweenLabels(AssemblerLabel a, AssemblerLabel b)
+    {
+        return b.m_offset - a.m_offset;
+    }
+
+    static void patchPointer(void* code, AssemblerLabel where, void* value)
+    {
+        patchPointer(reinterpret_cast<uint32_t*>(code) + where.m_offset, value);
+    }
+
+    static void patchPointer(void* code, void* value)
+    {
+        patchInt32(code, reinterpret_cast<uint32_t>(value));
+    }
+
+    static void patchInt32(void* code, uint32_t value)
+    {
+        changePCrelativeAddress((*(reinterpret_cast<uint16_t*>(code)) & 0xff), reinterpret_cast<uint16_t*>(code), value);
+    }
+
+    static uint32_t readInt32(void* code)
+    {
+        return readPCrelativeAddress((*(reinterpret_cast<uint16_t*>(code)) & 0xff), reinterpret_cast<uint16_t*>(code));
+    }
+
+    static void* readCallTarget(void* from)
+    {
+        uint16_t* instructionPtr = static_cast<uint16_t*>(from);
+        instructionPtr -= 3;
+        return reinterpret_cast<void*>(readPCrelativeAddress((*instructionPtr & 0xff), instructionPtr));
+    }
+
+    static void cacheFlush(void* code, size_t size)
+    {
+#if OS(LINUX)
+        // Flush each page separately, otherwise the whole flush will fail if an uncommited page is in the area.
+        unsigned currentPage = reinterpret_cast<unsigned>(code) & ~(pageSize() - 1);
+        unsigned lastPage = (reinterpret_cast<unsigned>(code) + size - 1) & ~(pageSize() - 1);
+        do {
+#if defined CACHEFLUSH_D_L2
+            syscall(__NR_cacheflush, currentPage, pageSize(), CACHEFLUSH_D_WB | CACHEFLUSH_I | CACHEFLUSH_D_L2);
+#else
+            syscall(__NR_cacheflush, currentPage, pageSize(), CACHEFLUSH_D_WB | CACHEFLUSH_I);
+#endif
+            currentPage += pageSize();
+        } while (lastPage >= currentPage);
+#else
+#error "The cacheFlush support is missing on this platform."
+#endif
+    }
+
+    void prefix(uint16_t pre)
+    {
+        m_buffer.putByte(pre);
+    }
+
+    void oneShortOp(uint16_t opcode, bool checksize = true, bool isDouble = true)
+    {
+        printInstr(opcode, m_buffer.codeSize(), isDouble);
+        if (checksize)
+            m_buffer.ensureSpace(maxInstructionSize);
+        m_buffer.putShortUnchecked(opcode);
+    }
+
+    void ensureSpace(int space)
+    {
+        m_buffer.ensureSpace(space);
+    }
+
+    void ensureSpace(int insnSpace, int constSpace)
+    {
+        m_buffer.ensureSpace(insnSpace, constSpace);
+    }
+
+    // Administrative methods
+
+    void* data() const { return m_buffer.data(); }
+    size_t codeSize() const { return m_buffer.codeSize(); }
+
+    unsigned debugOffset() { return m_buffer.debugOffset(); }
+
+#ifdef SH4_ASSEMBLER_TRACING
+    static void printInstr(uint16_t opc, unsigned size, bool isdoubleInst = true)
+    {
+        if (!getenv("JavaScriptCoreDumpJIT"))
+            return;
+
+        const char *format = 0;
+        printfStdoutInstr("offset: 0x%8.8x\t", size);
+        switch (opc) {
+        case BRK_OPCODE:
+            format = "    BRK\n";
+            break;
+        case NOP_OPCODE:
+            format = "    NOP\n";
+            break;
+        case RTS_OPCODE:
+            format ="    *RTS\n";
+            break;
+        case SETS_OPCODE:
+            format = "    SETS\n";
+            break;
+        case SETT_OPCODE:
+            format = "    SETT\n";
+            break;
+        case CLRT_OPCODE:
+            format = "    CLRT\n";
+            break;
+        case FSCHG_OPCODE:
+            format = "    FSCHG\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format);
+            return;
+        }
+        switch (opc & 0xf0ff) {
+        case BRAF_OPCODE:
+            format = "    *BRAF R%d\n";
+            break;
+        case DT_OPCODE:
+            format = "    DT R%d\n";
+            break;
+        case CMPPL_OPCODE:
+            format = "    CMP/PL R%d\n";
+            break;
+        case CMPPZ_OPCODE:
+            format = "    CMP/PZ R%d\n";
+            break;
+        case JMP_OPCODE:
+            format = "    *JMP @R%d\n";
+            break;
+        case JSR_OPCODE:
+            format = "    *JSR @R%d\n";
+            break;
+        case LDSPR_OPCODE:
+            format = "    LDS R%d, PR\n";
+            break;
+        case LDSLPR_OPCODE:
+            format = "    LDS.L @R%d+, PR\n";
+            break;
+        case MOVT_OPCODE:
+            format = "    MOVT R%d\n";
+            break;
+        case SHAL_OPCODE:
+            format = "    SHAL R%d\n";
+            break;
+        case SHAR_OPCODE:
+            format = "    SHAR R%d\n";
+            break;
+        case SHLL_OPCODE:
+            format = "    SHLL R%d\n";
+            break;
+        case SHLL2_OPCODE:
+            format = "    SHLL2 R%d\n";
+            break;
+        case SHLL8_OPCODE:
+            format = "    SHLL8 R%d\n";
+            break;
+        case SHLL16_OPCODE:
+            format = "    SHLL16 R%d\n";
+            break;
+        case SHLR_OPCODE:
+            format = "    SHLR R%d\n";
+            break;
+        case SHLR2_OPCODE:
+            format = "    SHLR2 R%d\n";
+            break;
+        case SHLR8_OPCODE:
+            format = "    SHLR8 R%d\n";
+            break;
+        case SHLR16_OPCODE:
+            format = "    SHLR16 R%d\n";
+            break;
+        case STSPR_OPCODE:
+            format = "    STS PR, R%d\n";
+            break;
+        case STSLPR_OPCODE:
+            format = "    STS.L PR, @-R%d\n";
+            break;
+        case LDS_RM_FPUL_OPCODE:
+            format = "    LDS R%d, FPUL\n";
+            break;
+        case STS_FPUL_RN_OPCODE:
+            format = "    STS FPUL, R%d \n";
+            break;
+        case FLDS_FRM_FPUL_OPCODE:
+            format = "    FLDS FR%d, FPUL\n";
+            break;
+        case FSTS_FPUL_FRN_OPCODE:
+            format = "    FSTS FPUL, R%d \n";
+            break;
+        case LDSFPSCR_OPCODE:
+            format = "    LDS R%d, FPSCR \n";
+            break;
+        case STSFPSCR_OPCODE:
+            format = "    STS FPSCR, R%d \n";
+            break;
+        case STSMACL_OPCODE:
+            format = "    STS MACL, R%d \n";
+            break;
+        case STSMACH_OPCODE:
+            format = "    STS MACH, R%d \n";
+            break;
+        case BSRF_OPCODE:
+            format = "    *BSRF R%d";
+            break;
+        case FTRC_OPCODE:
+            format = "    FTRC FR%d, FPUL\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getRn(opc));
+            return;
+        }
+        switch (opc & 0xf0ff) {
+        case FNEG_OPCODE:
+            format = "    FNEG DR%d\n";
+            break;
+        case FLOAT_OPCODE:
+            format = "    FLOAT DR%d\n";
+            break;
+        case FTRC_OPCODE:
+            format = "    FTRC FR%d, FPUL\n";
+            break;
+        case FABS_OPCODE:
+            format = "    FABS FR%d\n";
+            break;
+        case FSQRT_OPCODE:
+            format = "    FSQRT FR%d\n";
+            break;
+        case FCNVDS_DRM_FPUL_OPCODE:
+            format = "    FCNVDS FR%d, FPUL\n";
+            break;
+        case FCNVSD_FPUL_DRN_OPCODE:
+            format = "    FCNVSD FPUL, FR%d\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case ADD_OPCODE:
+            format = "    ADD R%d, R%d\n";
+            break;
+        case ADDC_OPCODE:
+            format = "    ADDC R%d, R%d\n";
+            break;
+        case ADDV_OPCODE:
+            format = "    ADDV R%d, R%d\n";
+            break;
+        case AND_OPCODE:
+            format = "    AND R%d, R%d\n";
+            break;
+        case DIV1_OPCODE:
+            format = "    DIV1 R%d, R%d\n";
+            break;
+        case CMPEQ_OPCODE:
+            format = "    CMP/EQ R%d, R%d\n";
+            break;
+        case CMPGE_OPCODE:
+            format = "    CMP/GE R%d, R%d\n";
+            break;
+        case CMPGT_OPCODE:
+            format = "    CMP/GT R%d, R%d\n";
+            break;
+        case CMPHI_OPCODE:
+            format = "    CMP/HI R%d, R%d\n";
+            break;
+        case CMPHS_OPCODE:
+            format = "    CMP/HS R%d, R%d\n";
+            break;
+        case MOV_OPCODE:
+            format = "    MOV R%d, R%d\n";
+            break;
+        case MOVB_WRITE_RN_OPCODE:
+            format = "    MOV.B R%d, @R%d\n";
+            break;
+        case MOVB_WRITE_RNDEC_OPCODE:
+            format = "    MOV.B R%d, @-R%d\n";
+            break;
+        case MOVB_WRITE_R0RN_OPCODE:
+            format = "    MOV.B R%d, @(R0, R%d)\n";
+            break;
+        case MOVB_READ_RM_OPCODE:
+            format = "    MOV.B @R%d, R%d\n";
+            break;
+        case MOVB_READ_RMINC_OPCODE:
+            format = "    MOV.B @R%d+, R%d\n";
+            break;
+        case MOVB_READ_R0RM_OPCODE:
+            format = "    MOV.B @(R0, R%d), R%d\n";
+            break;
+        case MOVL_WRITE_RN_OPCODE:
+            format = "    MOV.L R%d, @R%d\n";
+            break;
+        case MOVL_WRITE_RNDEC_OPCODE:
+            format = "    MOV.L R%d, @-R%d\n";
+            break;
+        case MOVL_WRITE_R0RN_OPCODE:
+            format = "    MOV.L R%d, @(R0, R%d)\n";
+            break;
+        case MOVL_READ_RM_OPCODE:
+            format = "    MOV.L @R%d, R%d\n";
+            break;
+        case MOVL_READ_RMINC_OPCODE:
+            format = "    MOV.L @R%d+, R%d\n";
+            break;
+        case MOVL_READ_R0RM_OPCODE:
+            format = "    MOV.L @(R0, R%d), R%d\n";
+            break;
+        case MULL_OPCODE:
+            format = "    MUL.L R%d, R%d\n";
+            break;
+        case DMULL_L_OPCODE:
+            format = "    DMULU.L R%d, R%d\n";
+            break;
+        case DMULSL_OPCODE:
+            format = "    DMULS.L R%d, R%d\n";
+            break;
+        case NEG_OPCODE:
+            format = "    NEG R%d, R%d\n";
+            break;
+        case NEGC_OPCODE:
+            format = "    NEGC R%d, R%d\n";
+            break;
+        case NOT_OPCODE:
+            format = "    NOT R%d, R%d\n";
+            break;
+        case OR_OPCODE:
+            format = "    OR R%d, R%d\n";
+            break;
+        case SHAD_OPCODE:
+            format = "    SHAD R%d, R%d\n";
+            break;
+        case SHLD_OPCODE:
+            format = "    SHLD R%d, R%d\n";
+            break;
+        case SUB_OPCODE:
+            format = "    SUB R%d, R%d\n";
+            break;
+        case SUBC_OPCODE:
+            format = "    SUBC R%d, R%d\n";
+            break;
+        case SUBV_OPCODE:
+            format = "    SUBV R%d, R%d\n";
+            break;
+        case TST_OPCODE:
+            format = "    TST R%d, R%d\n";
+            break;
+        case XOR_OPCODE:
+            format = "    XOR R%d, R%d\n";break;
+        case MOVW_WRITE_RN_OPCODE:
+            format = "    MOV.W R%d, @R%d\n";
+            break;
+        case MOVW_READ_RM_OPCODE:
+            format = "    MOV.W @R%d, R%d\n";
+            break;
+        case MOVW_READ_RMINC_OPCODE:
+            format = "    MOV.W @R%d+, R%d\n";
+            break;
+        case MOVW_READ_R0RM_OPCODE:
+            format = "    MOV.W @(R0, R%d), R%d\n";
+            break;
+        case MOVW_WRITE_R0RN_OPCODE:
+            format = "    MOV.W R%d, @(R0, R%d)\n";
+            break;
+        case EXTUB_OPCODE:
+            format = "    EXTU.B R%d, R%d\n";
+            break;
+        case EXTUW_OPCODE:
+            format = "    EXTU.W R%d, R%d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FSUB_OPCODE:
+            format = "    FSUB FR%d, FR%d\n";
+            break;
+        case FADD_OPCODE:
+            format = "    FADD FR%d, FR%d\n";
+            break;
+        case FDIV_OPCODE:
+            format = "    FDIV FR%d, FR%d\n";
+            break;
+        case FMUL_OPCODE:
+            format = "    DMULL FR%d, FR%d\n";
+            break;
+        case FMOV_OPCODE:
+            format = "    FMOV FR%d, FR%d\n";
+            break;
+        case FCMPEQ_OPCODE:
+            format = "    FCMP/EQ FR%d, FR%d\n";
+            break;
+        case FCMPGT_OPCODE:
+            format = "    FCMP/GT FR%d, FR%d\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, getDRm(opc) << 1, getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FMOVS_WRITE_RN_DEC_OPCODE:
+            format = "    %s FR%d, @-R%d\n";
+            break;
+        case FMOVS_WRITE_RN_OPCODE:
+            format = "    %s FR%d, @R%d\n";
+            break;
+        case FMOVS_WRITE_R0RN_OPCODE:
+            format = "    %s FR%d, @(R0, R%d)\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, "FMOV", getDRm(opc) << 1, getDRn(opc));
+            else
+                printfStdoutInstr(format, "FMOV.S", getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf00f) {
+        case FMOVS_READ_RM_OPCODE:
+            format = "    %s @R%d, FR%d\n";
+            break;
+        case FMOVS_READ_RM_INC_OPCODE:
+            format = "    %s @R%d+, FR%d\n";
+            break;
+        case FMOVS_READ_R0RM_OPCODE:
+            format = "    %s @(R0, R%d), FR%d\n";
+            break;
+        }
+        if (format) {
+            if (isdoubleInst)
+                printfStdoutInstr(format, "FMOV", getDRm(opc), getDRn(opc) << 1);
+            else
+                printfStdoutInstr(format, "FMOV.S", getRm(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xff00) {
+        case BF_OPCODE:
+            format = "    BF %d\n";
+            break;
+        case BFS_OPCODE:
+            format = "    *BF/S %d\n";
+            break;
+        case ANDIMM_OPCODE:
+            format = "    AND #%d, R0\n";
+            break;
+        case BT_OPCODE:
+            format = "    BT %d\n";
+            break;
+        case BTS_OPCODE:
+            format = "    *BT/S %d\n";
+            break;
+        case CMPEQIMM_OPCODE:
+            format = "    CMP/EQ #%d, R0\n";
+            break;
+        case MOVB_WRITE_OFFGBR_OPCODE:
+            format = "    MOV.B R0, @(%d, GBR)\n";
+            break;
+        case MOVB_READ_OFFGBR_OPCODE:
+            format = "    MOV.B @(%d, GBR), R0\n";
+            break;
+        case MOVL_WRITE_OFFGBR_OPCODE:
+            format = "    MOV.L R0, @(%d, GBR)\n";
+            break;
+        case MOVL_READ_OFFGBR_OPCODE:
+            format = "    MOV.L @(%d, GBR), R0\n";
+            break;
+        case MOVA_READ_OFFPC_OPCODE:
+            format = "    MOVA @(%d, PC), R0\n";
+            break;
+        case ORIMM_OPCODE:
+            format = "    OR #%d, R0\n";
+            break;
+        case ORBIMM_OPCODE:
+            format = "    OR.B #%d, @(R0, GBR)\n";
+            break;
+        case TSTIMM_OPCODE:
+            format = "    TST #%d, R0\n";
+            break;
+        case TSTB_OPCODE:
+            format = "    TST.B %d, @(R0, GBR)\n";
+            break;
+        case XORIMM_OPCODE:
+            format = "    XOR #%d, R0\n";
+            break;
+        case XORB_OPCODE:
+            format = "    XOR.B %d, @(R0, GBR)\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm8(opc));
+            return;
+        }
+        switch (opc & 0xff00) {
+        case MOVB_WRITE_OFFRN_OPCODE:
+            format = "    MOV.B R0, @(%d, R%d)\n";
+            break;
+        case MOVB_READ_OFFRM_OPCODE:
+            format = "    MOV.B @(%d, R%d), R0\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getDisp(opc), getRm(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case BRA_OPCODE:
+            format = "    *BRA %d\n";
+            break;
+        case BSR_OPCODE:
+            format = "    *BSR %d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm12(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case MOVL_READ_OFFPC_OPCODE:
+            format = "    MOV.L @(%d, PC), R%d\n";
+            break;
+        case ADDIMM_OPCODE:
+            format = "    ADD #%d, R%d\n";
+            break;
+        case MOVIMM_OPCODE:
+            format = "    MOV #%d, R%d\n";
+            break;
+        case MOVW_READ_OFFPC_OPCODE:
+            format = "    MOV.W @(%d, PC), R%d\n";
+            break;
+        }
+        if (format) {
+            printfStdoutInstr(format, getImm8(opc), getRn(opc));
+            return;
+        }
+        switch (opc & 0xf000) {
+        case MOVL_WRITE_OFFRN_OPCODE:
+            format = "    MOV.L R%d, @(%d, R%d)\n";
+            printfStdoutInstr(format, getRm(opc), getDisp(opc), getRn(opc));
+            break;
+        case MOVL_READ_OFFRM_OPCODE:
+            format = "    MOV.L @(%d, R%d), R%d\n";
+            printfStdoutInstr(format, getDisp(opc), getRm(opc), getRn(opc));
+            break;
+        }
+    }
+
+    static void printfStdoutInstr(const char* format, ...)
+    {
+        if (getenv("JavaScriptCoreDumpJIT")) {
+            va_list args;
+            va_start(args, format);
+            vprintfStdoutInstr(format, args);
+            va_end(args);
+        }
+    }
+
+    static void vprintfStdoutInstr(const char* format, va_list args)
+    {
+        if (getenv("JavaScriptCoreDumpJIT"))
+            WTF::dataLogFV(format, args);
+    }
+
+    static void printBlockInstr(uint16_t* first, unsigned offset, int nbInstr)
+    {
+        printfStdoutInstr(">> repatch instructions after link\n");
+        for (int i = 0; i <= nbInstr; i++)
+            printInstr(*(first + i), offset + i);
+        printfStdoutInstr(">> end repatch\n");
+    }
+#else
+    static void printInstr(uint16_t, unsigned, bool = true) { };
+    static void printBlockInstr(uint16_t*, unsigned, int) { };
+#endif
+
+    static void replaceWithLoad(void* instructionStart)
+    {
+        SH4Word* insPtr = reinterpret_cast<SH4Word*>(instructionStart);
+
+        insPtr += 2; // skip MOV and ADD opcodes
+
+        if (((*insPtr) & 0xf00f) != MOVL_READ_RM_OPCODE) {
+            *insPtr = MOVL_READ_RM_OPCODE | (*insPtr & 0x0ff0);
+            cacheFlush(insPtr, sizeof(SH4Word));
+        }
+    }
+
+    static void replaceWithAddressComputation(void* instructionStart)
+    {
+        SH4Word* insPtr = reinterpret_cast<SH4Word*>(instructionStart);
+
+        insPtr += 2; // skip MOV and ADD opcodes
+
+        if (((*insPtr) & 0xf00f) != MOV_OPCODE) {
+            *insPtr = MOV_OPCODE | (*insPtr & 0x0ff0);
+            cacheFlush(insPtr, sizeof(SH4Word));
+        }
+    }
+
+private:
+    SH4Buffer m_buffer;
+    int m_claimscratchReg;
+    int m_indexOfLastWatchpoint;
+    int m_indexOfTailOfLastWatchpoint;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(SH4)
diff --git a/assembler/X86Assembler.h b/assembler/X86Assembler.h
new file mode 100644
index 0000000..1f3da42
--- /dev/null
+++ b/assembler/X86Assembler.h
@@ -0,0 +1,3797 @@
+/*
+ * Copyright (C) 2008, 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(ASSEMBLER) && (CPU(X86) || CPU(X86_64))
+
+#include "AssemblerBuffer.h"
+#include "AssemblerCommon.h"
+#include "JITCompilationEffort.h"
+#include <limits.h>
+#include <stdint.h>
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+inline bool CAN_SIGN_EXTEND_8_32(int32_t value) { return value == (int32_t)(signed char)value; }
+
+namespace X86Registers {
+
+#define FOR_EACH_CPU_REGISTER(V) \
+    FOR_EACH_CPU_GPREGISTER(V) \
+    FOR_EACH_CPU_SPECIAL_REGISTER(V) \
+    FOR_EACH_CPU_FPREGISTER(V)
+
+// The following are defined as pairs of the following value:
+// 1. type of the storage needed to save the register value by the JIT probe.
+// 2. name of the register.
+#define FOR_EACH_CPU_GPREGISTER(V) \
+    V(void*, eax) \
+    V(void*, ecx) \
+    V(void*, edx) \
+    V(void*, ebx) \
+    V(void*, esp) \
+    V(void*, ebp) \
+    V(void*, esi) \
+    V(void*, edi) \
+    FOR_EACH_X86_64_CPU_GPREGISTER(V)
+
+#define FOR_EACH_CPU_SPECIAL_REGISTER(V) \
+    V(void*, eip) \
+    V(void*, eflags) \
+
+// Note: the JITs only stores double values in the FP registers.
+#define FOR_EACH_CPU_FPREGISTER(V) \
+    V(double, xmm0) \
+    V(double, xmm1) \
+    V(double, xmm2) \
+    V(double, xmm3) \
+    V(double, xmm4) \
+    V(double, xmm5) \
+    V(double, xmm6) \
+    V(double, xmm7) \
+    FOR_EACH_X86_64_CPU_FPREGISTER(V)
+
+#if CPU(X86)
+
+#define FOR_EACH_X86_64_CPU_GPREGISTER(V) // Nothing to add.
+#define FOR_EACH_X86_64_CPU_FPREGISTER(V) // Nothing to add.
+
+#elif CPU(X86_64)
+
+#define FOR_EACH_X86_64_CPU_GPREGISTER(V) \
+    V(void*, r8) \
+    V(void*, r9) \
+    V(void*, r10) \
+    V(void*, r11) \
+    V(void*, r12) \
+    V(void*, r13) \
+    V(void*, r14) \
+    V(void*, r15)
+
+#define FOR_EACH_X86_64_CPU_FPREGISTER(V) \
+    V(double, xmm8) \
+    V(double, xmm9) \
+    V(double, xmm10) \
+    V(double, xmm11) \
+    V(double, xmm12) \
+    V(double, xmm13) \
+    V(double, xmm14) \
+    V(double, xmm15)
+
+#endif // CPU(X86_64)
+
+typedef enum {
+    #define DECLARE_REGISTER(_type, _regName) _regName,
+    FOR_EACH_CPU_GPREGISTER(DECLARE_REGISTER)
+    #undef DECLARE_REGISTER
+} RegisterID;
+
+typedef enum {
+    #define DECLARE_REGISTER(_type, _regName) _regName,
+    FOR_EACH_CPU_FPREGISTER(DECLARE_REGISTER)
+    #undef DECLARE_REGISTER
+} XMMRegisterID;
+
+} // namespace X86Register
+
+class X86Assembler {
+public:
+    typedef X86Registers::RegisterID RegisterID;
+    
+    static constexpr RegisterID firstRegister() { return X86Registers::eax; }
+    static constexpr RegisterID lastRegister()
+    {
+#if CPU(X86_64)
+        return X86Registers::r15;
+#else
+        return X86Registers::edi;
+#endif
+    }
+    
+    typedef X86Registers::XMMRegisterID XMMRegisterID;
+    typedef XMMRegisterID FPRegisterID;
+    
+    static constexpr FPRegisterID firstFPRegister() { return X86Registers::xmm0; }
+    static constexpr FPRegisterID lastFPRegister()
+    {
+#if CPU(X86_64)
+        return X86Registers::xmm15;
+#else
+        return X86Registers::xmm7;
+#endif
+    }
+
+    typedef enum {
+        ConditionO,
+        ConditionNO,
+        ConditionB,
+        ConditionAE,
+        ConditionE,
+        ConditionNE,
+        ConditionBE,
+        ConditionA,
+        ConditionS,
+        ConditionNS,
+        ConditionP,
+        ConditionNP,
+        ConditionL,
+        ConditionGE,
+        ConditionLE,
+        ConditionG,
+
+        ConditionC  = ConditionB,
+        ConditionNC = ConditionAE,
+    } Condition;
+
+private:
+    // OneByteOpcodeID defines the bytecode for 1 byte instruction. It also contains the prefixes
+    // for two bytes instructions.
+    // TwoByteOpcodeID, ThreeByteOpcodeID define the opcodes for the multibytes instructions.
+    //
+    // The encoding for each instruction can be found in the Intel Architecture Manual in the appendix
+    // "Opcode Map."
+    //
+    // Each opcode can have a suffix describing the type of argument. The full list of suffixes is
+    // in the "Key to Abbreviations" section of the "Opcode Map".
+    // The most common argument types are:
+    //     -E: The argument is either a GPR or a memory address.
+    //     -G: The argument is a GPR.
+    //     -I: The argument is an immediate.
+    // The most common sizes are:
+    //     -v: 32 or 64bit depending on the operand-size attribute.
+    //     -z: 32bit in both 32bit and 64bit mode. Common for immediate values.
+    typedef enum {
+        OP_ADD_EbGb                     = 0x00,
+        OP_ADD_EvGv                     = 0x01,
+        OP_ADD_GvEv                     = 0x03,
+        OP_ADD_EAXIv                    = 0x05,
+        OP_OR_EvGv                      = 0x09,
+        OP_OR_GvEv                      = 0x0B,
+        OP_OR_EAXIv                     = 0x0D,
+        OP_2BYTE_ESCAPE                 = 0x0F,
+        OP_AND_EvGv                     = 0x21,
+        OP_AND_GvEv                     = 0x23,
+        OP_SUB_EvGv                     = 0x29,
+        OP_SUB_GvEv                     = 0x2B,
+        OP_SUB_EAXIv                    = 0x2D,
+        PRE_PREDICT_BRANCH_NOT_TAKEN    = 0x2E,
+        OP_XOR_EvGv                     = 0x31,
+        OP_XOR_GvEv                     = 0x33,
+        OP_XOR_EAXIv                    = 0x35,
+        OP_CMP_EvGv                     = 0x39,
+        OP_CMP_GvEv                     = 0x3B,
+        OP_CMP_EAXIv                    = 0x3D,
+#if CPU(X86_64)
+        PRE_REX                         = 0x40,
+#endif
+        OP_PUSH_EAX                     = 0x50,
+        OP_POP_EAX                      = 0x58,
+#if CPU(X86_64)
+        OP_MOVSXD_GvEv                  = 0x63,
+#endif
+        PRE_OPERAND_SIZE                = 0x66,
+        PRE_SSE_66                      = 0x66,
+        OP_PUSH_Iz                      = 0x68,
+        OP_IMUL_GvEvIz                  = 0x69,
+        OP_GROUP1_EbIb                  = 0x80,
+        OP_GROUP1_EvIz                  = 0x81,
+        OP_GROUP1_EvIb                  = 0x83,
+        OP_TEST_EbGb                    = 0x84,
+        OP_TEST_EvGv                    = 0x85,
+        OP_XCHG_EvGv                    = 0x87,
+        OP_MOV_EbGb                     = 0x88,
+        OP_MOV_EvGv                     = 0x89,
+        OP_MOV_GvEv                     = 0x8B,
+        OP_LEA                          = 0x8D,
+        OP_GROUP1A_Ev                   = 0x8F,
+        OP_NOP                          = 0x90,
+        OP_XCHG_EAX                     = 0x90,
+        OP_CDQ                          = 0x99,
+        OP_MOV_EAXOv                    = 0xA1,
+        OP_MOV_OvEAX                    = 0xA3,
+        OP_TEST_ALIb                    = 0xA8,
+        OP_TEST_EAXIv                   = 0xA9,
+        OP_MOV_EAXIv                    = 0xB8,
+        OP_GROUP2_EvIb                  = 0xC1,
+        OP_RET                          = 0xC3,
+        OP_GROUP11_EvIb                 = 0xC6,
+        OP_GROUP11_EvIz                 = 0xC7,
+        OP_INT3                         = 0xCC,
+        OP_GROUP2_Ev1                   = 0xD1,
+        OP_GROUP2_EvCL                  = 0xD3,
+        OP_ESCAPE_D9                    = 0xD9,
+        OP_ESCAPE_DD                    = 0xDD,
+        OP_CALL_rel32                   = 0xE8,
+        OP_JMP_rel32                    = 0xE9,
+        PRE_LOCK                        = 0xF0,
+        PRE_SSE_F2                      = 0xF2,
+        PRE_SSE_F3                      = 0xF3,
+        OP_HLT                          = 0xF4,
+        OP_GROUP3_EbIb                  = 0xF6,
+        OP_GROUP3_Ev                    = 0xF7,
+        OP_GROUP3_EvIz                  = 0xF7, // OP_GROUP3_Ev has an immediate, when instruction is a test. 
+        OP_GROUP5_Ev                    = 0xFF,
+    } OneByteOpcodeID;
+
+    typedef enum {
+        OP2_UD2             = 0xB,
+        OP2_MOVSD_VsdWsd    = 0x10,
+        OP2_MOVSD_WsdVsd    = 0x11,
+        OP2_MOVSS_VsdWsd    = 0x10,
+        OP2_MOVSS_WsdVsd    = 0x11,
+        OP2_MOVAPD_VpdWpd   = 0x28,
+        OP2_MOVAPS_VpdWpd   = 0x28,
+        OP2_CVTSI2SD_VsdEd  = 0x2A,
+        OP2_CVTTSD2SI_GdWsd = 0x2C,
+        OP2_CVTTSS2SI_GdWsd = 0x2C,
+        OP2_UCOMISD_VsdWsd  = 0x2E,
+        OP2_3BYTE_ESCAPE_3A = 0x3A,
+        OP2_CMOVCC          = 0x40,
+        OP2_ADDSD_VsdWsd    = 0x58,
+        OP2_MULSD_VsdWsd    = 0x59,
+        OP2_CVTSD2SS_VsdWsd = 0x5A,
+        OP2_CVTSS2SD_VsdWsd = 0x5A,
+        OP2_SUBSD_VsdWsd    = 0x5C,
+        OP2_DIVSD_VsdWsd    = 0x5E,
+        OP2_MOVMSKPD_VdEd   = 0x50,
+        OP2_SQRTSD_VsdWsd   = 0x51,
+        OP2_ANDPS_VpdWpd    = 0x54,
+        OP2_ANDNPD_VpdWpd   = 0x55,
+        OP2_XORPD_VpdWpd    = 0x57,
+        OP2_MOVD_VdEd       = 0x6E,
+        OP2_MOVD_EdVd       = 0x7E,
+        OP2_JCC_rel32       = 0x80,
+        OP_SETCC            = 0x90,
+        OP2_3BYTE_ESCAPE_AE = 0xAE,
+        OP2_IMUL_GvEv       = 0xAF,
+        OP2_MOVZX_GvEb      = 0xB6,
+        OP2_BSF             = 0xBC,
+        OP2_TZCNT           = 0xBC,
+        OP2_BSR             = 0xBD,
+        OP2_LZCNT           = 0xBD,
+        OP2_MOVSX_GvEb      = 0xBE,
+        OP2_MOVZX_GvEw      = 0xB7,
+        OP2_MOVSX_GvEw      = 0xBF,
+        OP2_PEXTRW_GdUdIb   = 0xC5,
+        OP2_PSLLQ_UdqIb     = 0x73,
+        OP2_PSRLQ_UdqIb     = 0x73,
+        OP2_POR_VdqWdq      = 0XEB,
+    } TwoByteOpcodeID;
+    
+    typedef enum {
+        OP3_ROUNDSS_VssWssIb = 0x0A,
+        OP3_ROUNDSD_VsdWsdIb = 0x0B,
+        OP3_MFENCE           = 0xF0,
+    } ThreeByteOpcodeID;
+
+    struct VexPrefix {
+        enum : uint8_t {
+            TwoBytes = 0xC5,
+            ThreeBytes = 0xC4
+        };
+    };
+    enum class VexImpliedBytes : uint8_t {
+        TwoBytesOp = 1,
+        ThreeBytesOp38 = 2,
+        ThreeBytesOp3A = 3
+    };
+    
+    TwoByteOpcodeID cmovcc(Condition cond)
+    {
+        return (TwoByteOpcodeID)(OP2_CMOVCC + cond);
+    }
+
+    TwoByteOpcodeID jccRel32(Condition cond)
+    {
+        return (TwoByteOpcodeID)(OP2_JCC_rel32 + cond);
+    }
+
+    TwoByteOpcodeID setccOpcode(Condition cond)
+    {
+        return (TwoByteOpcodeID)(OP_SETCC + cond);
+    }
+
+    typedef enum {
+        GROUP1_OP_ADD = 0,
+        GROUP1_OP_OR  = 1,
+        GROUP1_OP_ADC = 2,
+        GROUP1_OP_AND = 4,
+        GROUP1_OP_SUB = 5,
+        GROUP1_OP_XOR = 6,
+        GROUP1_OP_CMP = 7,
+
+        GROUP1A_OP_POP = 0,
+        
+        GROUP2_OP_ROL = 0,
+        GROUP2_OP_ROR = 1,
+        GROUP2_OP_RCL = 2,
+        GROUP2_OP_RCR = 3,
+        
+        GROUP2_OP_SHL = 4,
+        GROUP2_OP_SHR = 5,
+        GROUP2_OP_SAR = 7,
+
+        GROUP3_OP_TEST = 0,
+        GROUP3_OP_NOT  = 2,
+        GROUP3_OP_NEG  = 3,
+        GROUP3_OP_DIV = 6,
+        GROUP3_OP_IDIV = 7,
+
+        GROUP5_OP_CALLN = 2,
+        GROUP5_OP_JMPN  = 4,
+        GROUP5_OP_PUSH  = 6,
+
+        GROUP11_MOV = 0,
+
+        GROUP14_OP_PSLLQ = 6,
+        GROUP14_OP_PSRLQ = 2,
+
+        ESCAPE_D9_FSTP_singleReal = 3,
+        ESCAPE_DD_FSTP_doubleReal = 3,
+    } GroupOpcodeID;
+    
+    class X86InstructionFormatter;
+public:
+
+    X86Assembler()
+        : m_indexOfLastWatchpoint(INT_MIN)
+        , m_indexOfTailOfLastWatchpoint(INT_MIN)
+    {
+    }
+    
+    AssemblerBuffer& buffer() { return m_formatter.m_buffer; }
+
+    // Stack operations:
+
+    void push_r(RegisterID reg)
+    {
+        m_formatter.oneByteOp(OP_PUSH_EAX, reg);
+    }
+
+    void pop_r(RegisterID reg)
+    {
+        m_formatter.oneByteOp(OP_POP_EAX, reg);
+    }
+
+    void push_i32(int imm)
+    {
+        m_formatter.oneByteOp(OP_PUSH_Iz);
+        m_formatter.immediate32(imm);
+    }
+
+    void push_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_PUSH, base, offset);
+    }
+
+    void pop_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP1A_Ev, GROUP1A_OP_POP, base, offset);
+    }
+
+    // Arithmetic operations:
+
+#if !CPU(X86_64)
+    void adcl_im(int imm, const void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADC, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_ADC, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+#endif
+
+    void addl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_ADD_EvGv, src, dst);
+    }
+
+    void addl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_ADD_GvEv, dst, base, offset);
+    }
+    
+#if !CPU(X86_64)
+    void addl_mr(const void* addr, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_ADD_GvEv, dst, addr);
+    }
+#endif
+
+    void addl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_ADD_EvGv, src, base, offset);
+    }
+
+    void addl_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp(OP_ADD_EvGv, src, base, index, scale, offset);
+    }
+
+    void addb_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp8(OP_ADD_EbGb, src, base, offset);
+    }
+
+    void addb_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp8(OP_ADD_EbGb, src, base, index, scale, offset);
+    }
+
+    void addw_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        m_formatter.oneByteOp8(OP_ADD_EvGv, src, base, offset);
+    }
+
+    void addw_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        m_formatter.oneByteOp8(OP_ADD_EvGv, src, base, index, scale, offset);
+    }
+
+    void addl_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADD, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp(OP_ADD_EAXIv);
+            else
+                m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_ADD, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void addl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void addl_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, index, scale, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_ADD, base, index, scale, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void addb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp8(OP_GROUP1_EbIb, GROUP1_OP_ADD, base, offset);
+        m_formatter.immediate8(imm);
+    }
+
+    void addb_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp8(OP_GROUP1_EbIb, GROUP1_OP_ADD, base, index, scale, offset);
+        m_formatter.immediate8(imm);
+    }
+
+    void addw_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp8(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp8(OP_GROUP1_EvIz, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate16(imm);
+        }
+    }
+
+    void addw_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp8(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, index, scale, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp8(OP_GROUP1_EvIz, GROUP1_OP_ADD, base, index, scale, offset);
+            m_formatter.immediate16(imm);
+        }
+    }
+
+#if CPU(X86_64)
+    void addq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_ADD_EvGv, src, dst);
+    }
+
+    void addq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_ADD_GvEv, dst, base, offset);
+    }
+
+    void addq_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_ADD_EvGv, src, base, offset);
+    }
+
+    void addq_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_ADD, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp64(OP_ADD_EAXIv);
+            else
+                m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_ADD, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void addq_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+#else
+    void addl_im(int imm, const void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADD, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_ADD, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+#endif
+
+    void andl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_AND_EvGv, src, dst);
+    }
+
+    void andl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_AND_GvEv, dst, base, offset);
+    }
+
+    void andl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_AND_EvGv, src, base, offset);
+    }
+
+    void andl_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void andl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+#if CPU(X86_64)
+    void andq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_AND_EvGv, src, dst);
+    }
+
+    void andq_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_AND, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_AND, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+#else
+    void andl_im(int imm, const void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+#endif
+
+    void dec_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP1_OP_OR, dst);
+    }
+
+#if CPU(X86_64)
+    void decq_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP5_Ev, GROUP1_OP_OR, dst);
+    }
+#endif // CPU(X86_64)
+
+    // Only used for testing purposes.
+    void illegalInstruction()
+    {
+        m_formatter.twoByteOp(OP2_UD2);
+    }
+
+    void inc_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP1_OP_ADD, dst);
+    }
+
+#if CPU(X86_64)
+    void incq_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP5_Ev, GROUP1_OP_ADD, dst);
+    }
+
+    void incq_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_GROUP5_Ev, GROUP1_OP_ADD, base, offset);
+    }
+#endif // CPU(X86_64)
+
+    void negl_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NEG, dst);
+    }
+
+#if CPU(X86_64)
+    void negq_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP3_Ev, GROUP3_OP_NEG, dst);
+    }
+#endif
+
+    void negl_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NEG, base, offset);
+    }
+
+    void notl_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NOT, dst);
+    }
+
+    void notl_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NOT, base, offset);
+    }
+
+#if CPU(X86_64)
+    void notq_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP3_Ev, GROUP3_OP_NOT, dst);
+    }
+
+    void notq_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_GROUP3_Ev, GROUP3_OP_NOT, base, offset);
+    }
+#endif
+
+    void orl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_OR_EvGv, src, dst);
+    }
+
+    void orl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_OR_GvEv, dst, base, offset);
+    }
+
+    void orl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_OR_EvGv, src, base, offset);
+    }
+
+    void orl_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp(OP_OR_EAXIv);
+            else
+                m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void orl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+#if CPU(X86_64)
+    void orq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_OR_EvGv, src, dst);
+    }
+
+    void orq_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_OR, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp64(OP_OR_EAXIv);
+            else
+                m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_OR, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+#else
+    void orl_im(int imm, const void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void orl_rm(RegisterID src, const void* addr)
+    {
+        m_formatter.oneByteOp(OP_OR_EvGv, src, addr);
+    }
+#endif
+
+    void subl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_SUB_EvGv, src, dst);
+    }
+
+    void subl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_SUB_GvEv, dst, base, offset);
+    }
+
+    void subl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_SUB_EvGv, src, base, offset);
+    }
+
+    void subl_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_SUB, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp(OP_SUB_EAXIv);
+            else
+                m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_SUB, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+    
+    void subl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_SUB, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_SUB, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+#if CPU(X86_64)
+    void subq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_SUB_EvGv, src, dst);
+    }
+
+    void subq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_SUB_GvEv, dst, base, offset);
+    }
+
+    void subq_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_SUB_EvGv, src, base, offset);
+    }
+
+    void subq_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_SUB, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp64(OP_SUB_EAXIv);
+            else
+                m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_SUB, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void subq_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_SUB, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_SUB, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+#else
+    void subl_im(int imm, const void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_SUB, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_SUB, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+#endif
+
+    void xorl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_XOR_EvGv, src, dst);
+    }
+
+    void xorl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_XOR_GvEv, dst, base, offset);
+    }
+
+    void xorl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_XOR_EvGv, src, base, offset);
+    }
+
+    void xorl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_XOR, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_XOR, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void xorl_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_XOR, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp(OP_XOR_EAXIv);
+            else
+                m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_XOR, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+#if CPU(X86_64)
+    void xorq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_XOR_EvGv, src, dst);
+    }
+
+    void xorq_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_XOR, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp64(OP_XOR_EAXIv);
+            else
+                m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_XOR, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+    
+    void xorq_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_XOR_EvGv, src, base, offset);
+    }
+
+#endif
+
+    void lzcnt_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_LZCNT, dst, src);
+    }
+
+    void lzcnt_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_LZCNT, dst, base, offset);
+    }
+
+#if CPU(X86_64)
+    void lzcntq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp64(OP2_LZCNT, dst, src);
+    }
+
+    void lzcntq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp64(OP2_LZCNT, dst, base, offset);
+    }
+#endif
+
+    void bsr_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_BSR, dst, src);
+    }
+
+    void bsr_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_BSR, dst, base, offset);
+    }
+
+#if CPU(X86_64)
+    void bsrq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(OP2_BSR, dst, src);
+    }
+
+    void bsrq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(OP2_BSR, dst, base, offset);
+    }
+#endif
+
+    void tzcnt_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_TZCNT, dst, src);
+    }
+
+#if CPU(X86_64)
+    void tzcntq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp64(OP2_TZCNT, dst, src);
+    }
+#endif
+
+    void bsf_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_BSF, dst, src);
+    }
+
+#if CPU(X86_64)
+    void bsfq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(OP2_BSF, dst, src);
+    }
+#endif
+
+private:
+    template<GroupOpcodeID op>
+    void shiftInstruction32(int imm, RegisterID dst)
+    {
+        if (imm == 1)
+            m_formatter.oneByteOp(OP_GROUP2_Ev1, op, dst);
+        else {
+            m_formatter.oneByteOp(OP_GROUP2_EvIb, op, dst);
+            m_formatter.immediate8(imm);
+        }
+    }
+public:
+
+    void sarl_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction32<GROUP2_OP_SAR>(imm, dst);
+    }
+
+    void sarl_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP2_EvCL, GROUP2_OP_SAR, dst);
+    }
+    
+    void shrl_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction32<GROUP2_OP_SHR>(imm, dst);
+    }
+    
+    void shrl_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP2_EvCL, GROUP2_OP_SHR, dst);
+    }
+
+    void shll_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction32<GROUP2_OP_SHL>(imm, dst);
+    }
+
+    void shll_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP2_EvCL, GROUP2_OP_SHL, dst);
+    }
+
+    void rorl_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction32<GROUP2_OP_ROR>(imm, dst);
+    }
+
+    void rorl_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP2_EvCL, GROUP2_OP_ROR, dst);
+    }
+
+    void roll_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction32<GROUP2_OP_ROL>(imm, dst);
+    }
+
+    void roll_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP2_EvCL, GROUP2_OP_ROL, dst);
+    }
+
+#if CPU(X86_64)
+private:
+    template<GroupOpcodeID op>
+    void shiftInstruction64(int imm, RegisterID dst)
+    {
+        if (imm == 1)
+            m_formatter.oneByteOp64(OP_GROUP2_Ev1, op, dst);
+        else {
+            m_formatter.oneByteOp64(OP_GROUP2_EvIb, op, dst);
+            m_formatter.immediate8(imm);
+        }
+    }
+public:
+    void sarq_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP2_EvCL, GROUP2_OP_SAR, dst);
+    }
+
+    void sarq_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction64<GROUP2_OP_SAR>(imm, dst);
+    }
+
+    void shrq_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction64<GROUP2_OP_SHR>(imm, dst);
+    }
+
+    void shrq_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP2_EvCL, GROUP2_OP_SHR, dst);
+    }
+
+    void shlq_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction64<GROUP2_OP_SHL>(imm, dst);
+    }
+
+    void shlq_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP2_EvCL, GROUP2_OP_SHL, dst);
+    }
+
+    void rorq_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction64<GROUP2_OP_ROR>(imm, dst);
+    }
+
+    void rorq_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP2_EvCL, GROUP2_OP_ROR, dst);
+    }
+
+    void rolq_i8r(int imm, RegisterID dst)
+    {
+        shiftInstruction64<GROUP2_OP_ROL>(imm, dst);
+    }
+
+    void rolq_CLr(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP2_EvCL, GROUP2_OP_ROL, dst);
+    }
+#endif // CPU(X86_64)
+
+    void imull_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_IMUL_GvEv, dst, src);
+    }
+
+#if CPU(X86_64)
+    void imulq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(OP2_IMUL_GvEv, dst, src);
+    }
+#endif // CPU(X86_64)
+
+    void imull_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_IMUL_GvEv, dst, base, offset);
+    }
+
+    void imull_i32r(RegisterID src, int32_t value, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_IMUL_GvEvIz, dst, src);
+        m_formatter.immediate32(value);
+    }
+
+    void divl_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_DIV, dst);
+    }
+
+    void idivl_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_IDIV, dst);
+    }
+
+#if CPU(X86_64)
+    void divq_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP3_Ev, GROUP3_OP_DIV, dst);
+    }
+
+    void idivq_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP3_Ev, GROUP3_OP_IDIV, dst);
+    }
+#endif // CPU(X86_64)
+
+    // Comparisons:
+
+    void cmpl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_CMP_EvGv, src, dst);
+    }
+
+    void cmpl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_CMP_EvGv, src, base, offset);
+    }
+
+    void cmpl_mr(int offset, RegisterID base, RegisterID src)
+    {
+        m_formatter.oneByteOp(OP_CMP_GvEv, src, base, offset);
+    }
+
+    void cmpl_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp(OP_CMP_EAXIv);
+            else
+                m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void cmpl_ir_force32(int imm, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, dst);
+        m_formatter.immediate32(imm);
+    }
+    
+    void cmpl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+    
+    void cmpb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP1_EbIb, GROUP1_OP_CMP, base, offset);
+        m_formatter.immediate8(imm);
+    }
+    
+    void cmpb_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp(OP_GROUP1_EbIb, GROUP1_OP_CMP, base, index, scale, offset);
+        m_formatter.immediate8(imm);
+    }
+    
+#if CPU(X86)
+    void cmpb_im(int imm, const void* addr)
+    {
+        m_formatter.oneByteOp(OP_GROUP1_EbIb, GROUP1_OP_CMP, addr);
+        m_formatter.immediate8(imm);
+    }
+#endif
+
+    void cmpl_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void cmpl_im_force32(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, offset);
+        m_formatter.immediate32(imm);
+    }
+
+#if CPU(X86_64)
+    void cmpq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_CMP_EvGv, src, dst);
+    }
+
+    void cmpq_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_CMP_EvGv, src, base, offset);
+    }
+
+    void cmpq_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp64(OP_CMP_EvGv, src, base, index, scale, offset);
+    }
+
+    void cmpq_mr(int offset, RegisterID base, RegisterID src)
+    {
+        m_formatter.oneByteOp64(OP_CMP_GvEv, src, base, offset);
+    }
+
+    void cmpq_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_CMP, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            if (dst == X86Registers::eax)
+                m_formatter.oneByteOp64(OP_CMP_EAXIv);
+            else
+                m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_CMP, dst);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void cmpq_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
+    void cmpq_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+#else
+    void cmpl_rm(RegisterID reg, const void* addr)
+    {
+        m_formatter.oneByteOp(OP_CMP_EvGv, reg, addr);
+    }
+
+    void cmpl_im(int imm, const void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+#endif
+
+    void cmpw_ir(int imm, RegisterID dst)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, dst);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, dst);
+            m_formatter.immediate16(imm);
+        }
+    }
+
+    void cmpw_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        m_formatter.oneByteOp(OP_CMP_EvGv, src, base, index, scale, offset);
+    }
+
+    void cmpw_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate16(imm);
+        }
+    }
+
+    void testl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
+    }
+    
+    void testl_i32r(int imm, RegisterID dst)
+    {
+        if (dst == X86Registers::eax)
+            m_formatter.oneByteOp(OP_TEST_EAXIv);
+        else
+            m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, dst);
+        m_formatter.immediate32(imm);
+    }
+
+    void testl_i32m(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, offset);
+        m_formatter.immediate32(imm);
+    }
+
+    void testb_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp8(OP_TEST_EbGb, src, dst);
+    }
+
+    void testb_im(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, offset);
+        m_formatter.immediate8(imm);
+    }
+    
+    void testb_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, base, index, scale, offset);
+        m_formatter.immediate8(imm);
+    }
+
+#if CPU(X86)
+    void testb_im(int imm, const void* addr)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_EbIb, GROUP3_OP_TEST, addr);
+        m_formatter.immediate8(imm);
+    }
+#endif
+
+    void testl_i32m(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, index, scale, offset);
+        m_formatter.immediate32(imm);
+    }
+
+#if CPU(X86_64)
+    void testq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_TEST_EvGv, src, dst);
+    }
+
+    void testq_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_TEST_EvGv, src, base, offset);
+    }
+
+    void testq_i32r(int imm, RegisterID dst)
+    {
+        if (dst == X86Registers::eax)
+            m_formatter.oneByteOp64(OP_TEST_EAXIv);
+        else
+            m_formatter.oneByteOp64(OP_GROUP3_EvIz, GROUP3_OP_TEST, dst);
+        m_formatter.immediate32(imm);
+    }
+
+    void testq_i32m(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, offset);
+        m_formatter.immediate32(imm);
+    }
+
+    void testq_i32m(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp64(OP_GROUP3_EvIz, GROUP3_OP_TEST, base, index, scale, offset);
+        m_formatter.immediate32(imm);
+    }
+#endif 
+
+    void testw_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
+    }
+    
+    void testb_i8r(int imm, RegisterID dst)
+    {
+        if (dst == X86Registers::eax)
+            m_formatter.oneByteOp(OP_TEST_ALIb);
+        else
+            m_formatter.oneByteOp8(OP_GROUP3_EbIb, GROUP3_OP_TEST, dst);
+        m_formatter.immediate8(imm);
+    }
+
+    void setCC_r(Condition cond, RegisterID dst)
+    {
+        m_formatter.twoByteOp8(setccOpcode(cond), (GroupOpcodeID)0, dst);
+    }
+
+    void sete_r(RegisterID dst)
+    {
+        m_formatter.twoByteOp8(setccOpcode(ConditionE), (GroupOpcodeID)0, dst);
+    }
+
+    void setz_r(RegisterID dst)
+    {
+        sete_r(dst);
+    }
+
+    void setne_r(RegisterID dst)
+    {
+        m_formatter.twoByteOp8(setccOpcode(ConditionNE), (GroupOpcodeID)0, dst);
+    }
+
+    void setnz_r(RegisterID dst)
+    {
+        setne_r(dst);
+    }
+
+    void setnp_r(RegisterID dst)
+    {
+        m_formatter.twoByteOp8(setccOpcode(ConditionNP), (GroupOpcodeID)0, dst);
+    }
+
+    void setp_r(RegisterID dst)
+    {
+        m_formatter.twoByteOp8(setccOpcode(ConditionP), (GroupOpcodeID)0, dst);
+    }
+
+    // Various move ops:
+
+    void cdq()
+    {
+        m_formatter.oneByteOp(OP_CDQ);
+    }
+
+#if CPU(X86_64)
+    void cqo()
+    {
+        m_formatter.oneByteOp64(OP_CDQ);
+    }
+#endif
+
+    void fstps(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_ESCAPE_D9, ESCAPE_D9_FSTP_singleReal, base, offset);
+    }
+
+    void fstpl(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_ESCAPE_DD, ESCAPE_DD_FSTP_doubleReal, base, offset);
+    }
+
+    void xchgl_rr(RegisterID src, RegisterID dst)
+    {
+        if (src == X86Registers::eax)
+            m_formatter.oneByteOp(OP_XCHG_EAX, dst);
+        else if (dst == X86Registers::eax)
+            m_formatter.oneByteOp(OP_XCHG_EAX, src);
+        else
+            m_formatter.oneByteOp(OP_XCHG_EvGv, src, dst);
+    }
+
+    void xchgl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_XCHG_EvGv, src, base, offset);
+    }
+
+#if CPU(X86_64)
+    void xchgq_rr(RegisterID src, RegisterID dst)
+    {
+        if (src == X86Registers::eax)
+            m_formatter.oneByteOp64(OP_XCHG_EAX, dst);
+        else if (dst == X86Registers::eax)
+            m_formatter.oneByteOp64(OP_XCHG_EAX, src);
+        else
+            m_formatter.oneByteOp64(OP_XCHG_EvGv, src, dst);
+    }
+
+    void xchgq_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_XCHG_EvGv, src, base, offset);
+    }
+#endif
+
+    void movl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_MOV_EvGv, src, dst);
+    }
+    
+    void movl_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_MOV_EvGv, src, base, offset);
+    }
+
+    void movl_rm_disp32(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp_disp32(OP_MOV_EvGv, src, base, offset);
+    }
+
+    void movl_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp(OP_MOV_EvGv, src, base, index, scale, offset);
+    }
+    
+    void movl_mEAX(const void* addr)
+    {
+        m_formatter.oneByteOp(OP_MOV_EAXOv);
+#if CPU(X86_64)
+        m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
+#else
+        m_formatter.immediate32(reinterpret_cast<int>(addr));
+#endif
+    }
+
+    void movl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_MOV_GvEv, dst, base, offset);
+    }
+
+    void movl_mr_disp32(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp_disp32(OP_MOV_GvEv, dst, base, offset);
+    }
+    
+    void movl_mr_disp8(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp_disp8(OP_MOV_GvEv, dst, base, offset);
+    }
+
+    void movl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_MOV_GvEv, dst, base, index, scale, offset);
+    }
+
+    void movl_i32r(int imm, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_MOV_EAXIv, dst);
+        m_formatter.immediate32(imm);
+    }
+
+    void movl_i32m(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP11_EvIz, GROUP11_MOV, base, offset);
+        m_formatter.immediate32(imm);
+    }
+    
+    void movl_i32m(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp(OP_GROUP11_EvIz, GROUP11_MOV, base, index, scale, offset);
+        m_formatter.immediate32(imm);
+    }
+
+#if !CPU(X86_64)
+    void movb_i8m(int imm, const void* addr)
+    {
+        ASSERT(-128 <= imm && imm < 128);
+        m_formatter.oneByteOp(OP_GROUP11_EvIb, GROUP11_MOV, addr);
+        m_formatter.immediate8(imm);
+    }
+#endif
+
+    void movb_i8m(int imm, int offset, RegisterID base)
+    {
+        ASSERT(-128 <= imm && imm < 128);
+        m_formatter.oneByteOp(OP_GROUP11_EvIb, GROUP11_MOV, base, offset);
+        m_formatter.immediate8(imm);
+    }
+
+    void movb_i8m(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        ASSERT(-128 <= imm && imm < 128);
+        m_formatter.oneByteOp(OP_GROUP11_EvIb, GROUP11_MOV, base, index, scale, offset);
+        m_formatter.immediate8(imm);
+    }
+
+#if !CPU(X86_64)
+    void movb_rm(RegisterID src, const void* addr)
+    {
+        m_formatter.oneByteOp(OP_MOV_EbGb, src, addr);
+    }
+#endif
+    
+    void movb_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp8(OP_MOV_EbGb, src, base, offset);
+    }
+    
+    void movb_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp8(OP_MOV_EbGb, src, base, index, scale, offset);
+    }
+
+    void movw_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+
+        // FIXME: We often use oneByteOp8 for 16-bit operations. It's not clear that this is
+        // necessary. https://bugs.webkit.org/show_bug.cgi?id=153433
+        m_formatter.oneByteOp8(OP_MOV_EvGv, src, base, offset);
+    }
+
+    void movw_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        m_formatter.oneByteOp8(OP_MOV_EvGv, src, base, index, scale, offset);
+    }
+
+    void movl_EAXm(const void* addr)
+    {
+        m_formatter.oneByteOp(OP_MOV_OvEAX);
+#if CPU(X86_64)
+        m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
+#else
+        m_formatter.immediate32(reinterpret_cast<int>(addr));
+#endif
+    }
+
+#if CPU(X86_64)
+    void movq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_MOV_EvGv, src, dst);
+    }
+
+    void movq_rm(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_MOV_EvGv, src, base, offset);
+    }
+
+    void movq_rm_disp32(RegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64_disp32(OP_MOV_EvGv, src, base, offset);
+    }
+
+    void movq_rm(RegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp64(OP_MOV_EvGv, src, base, index, scale, offset);
+    }
+
+    void movq_mEAX(const void* addr)
+    {
+        m_formatter.oneByteOp64(OP_MOV_EAXOv);
+        m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
+    }
+
+    void movq_EAXm(const void* addr)
+    {
+        m_formatter.oneByteOp64(OP_MOV_OvEAX);
+        m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
+    }
+
+    void movq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_MOV_GvEv, dst, base, offset);
+    }
+
+    void movq_mr_disp32(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64_disp32(OP_MOV_GvEv, dst, base, offset);
+    }
+
+    void movq_mr_disp8(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64_disp8(OP_MOV_GvEv, dst, base, offset);
+    }
+
+    void movq_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_MOV_GvEv, dst, base, index, scale, offset);
+    }
+
+    void movq_i32m(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_GROUP11_EvIz, GROUP11_MOV, base, offset);
+        m_formatter.immediate32(imm);
+    }
+
+    void movq_i64r(int64_t imm, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_MOV_EAXIv, dst);
+        m_formatter.immediate64(imm);
+    }
+
+    void mov_i32r(int32_t imm, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_GROUP11_EvIz, GROUP11_MOV, dst);
+        m_formatter.immediate32(imm);
+    }
+    
+    void movsxd_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_MOVSXD_GvEv, dst, src);
+    }
+    
+    
+#else
+    void movl_rm(RegisterID src, const void* addr)
+    {
+        if (src == X86Registers::eax)
+            movl_EAXm(addr);
+        else 
+            m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
+    }
+    
+    void movl_mr(const void* addr, RegisterID dst)
+    {
+        if (dst == X86Registers::eax)
+            movl_mEAX(addr);
+        else
+            m_formatter.oneByteOp(OP_MOV_GvEv, dst, addr);
+    }
+
+    void movl_i32m(int imm, const void* addr)
+    {
+        m_formatter.oneByteOp(OP_GROUP11_EvIz, GROUP11_MOV, addr);
+        m_formatter.immediate32(imm);
+    }
+#endif
+
+    void movzwl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVZX_GvEw, dst, base, offset);
+    }
+
+    void movzwl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVZX_GvEw, dst, base, index, scale, offset);
+    }
+
+    void movswl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVSX_GvEw, dst, base, offset);
+    }
+
+    void movswl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVSX_GvEw, dst, base, index, scale, offset);
+    }
+
+    void movzbl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVZX_GvEb, dst, base, offset);
+    }
+    
+    void movzbl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVZX_GvEb, dst, base, index, scale, offset);
+    }
+
+#if !CPU(X86_64)
+    void movzbl_mr(const void* address, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVZX_GvEb, dst, address);
+    }
+#endif
+
+    void movsbl_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVSX_GvEb, dst, base, offset);
+    }
+    
+    void movsbl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVSX_GvEb, dst, base, index, scale, offset);
+    }
+
+    void movzbl_rr(RegisterID src, RegisterID dst)
+    {
+        // In 64-bit, this may cause an unnecessary REX to be planted (if the dst register
+        // is in the range ESP-EDI, and the src would not have required a REX).  Unneeded
+        // REX prefixes are defined to be silently ignored by the processor.
+        m_formatter.twoByteOp8(OP2_MOVZX_GvEb, dst, src);
+    }
+
+    void movsbl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp8(OP2_MOVSX_GvEb, dst, src);
+    }
+
+    void movzwl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp8(OP2_MOVZX_GvEw, dst, src);
+    }
+
+    void movswl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp8(OP2_MOVSX_GvEw, dst, src);
+    }
+
+    void cmovl_rr(Condition cond, RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp(cmovcc(cond), dst, src);
+    }
+
+    void cmovl_mr(Condition cond, int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp(cmovcc(cond), dst, base, offset);
+    }
+
+    void cmovl_mr(Condition cond, int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.twoByteOp(cmovcc(cond), dst, base, index, scale, offset);
+    }
+
+    void cmovel_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp(cmovcc(ConditionE), dst, src);
+    }
+    
+    void cmovnel_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp(cmovcc(ConditionNE), dst, src);
+    }
+    
+    void cmovpl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp(cmovcc(ConditionP), dst, src);
+    }
+    
+    void cmovnpl_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp(cmovcc(ConditionNP), dst, src);
+    }
+
+#if CPU(X86_64)
+    void cmovq_rr(Condition cond, RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(cmovcc(cond), dst, src);
+    }
+
+    void cmovq_mr(Condition cond, int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(cmovcc(cond), dst, base, offset);
+    }
+
+    void cmovq_mr(Condition cond, int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(cmovcc(cond), dst, base, index, scale, offset);
+    }
+
+    void cmoveq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(cmovcc(ConditionE), dst, src);
+    }
+
+    void cmovneq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(cmovcc(ConditionNE), dst, src);
+    }
+
+    void cmovpq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(cmovcc(ConditionP), dst, src);
+    }
+
+    void cmovnpq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.twoByteOp64(cmovcc(ConditionNP), dst, src);
+    }
+#else
+    void cmovl_mr(Condition cond, const void* addr, RegisterID dst)
+    {
+        m_formatter.twoByteOp(cmovcc(cond), dst, addr);
+    }
+#endif
+
+    void leal_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_LEA, dst, base, offset);
+    }
+
+    void leal_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_LEA, dst, base, index, scale, offset);
+    }
+
+#if CPU(X86_64)
+    void leaq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_LEA, dst, base, offset);
+    }
+
+    void leaq_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_LEA, dst, base, index, scale, offset);
+    }
+#endif
+
+    // Flow control:
+
+    AssemblerLabel call()
+    {
+        m_formatter.oneByteOp(OP_CALL_rel32);
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel call(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, dst);
+        return m_formatter.label();
+    }
+    
+    void call_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, base, offset);
+    }
+
+    AssemblerLabel jmp()
+    {
+        m_formatter.oneByteOp(OP_JMP_rel32);
+        return m_formatter.immediateRel32();
+    }
+    
+    // Return a AssemblerLabel so we have a label to the jump, so we can use this
+    // To make a tail recursive call on x86-64.  The MacroAssembler
+    // really shouldn't wrap this as a Jump, since it can't be linked. :-/
+    AssemblerLabel jmp_r(RegisterID dst)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_JMPN, dst);
+        return m_formatter.label();
+    }
+    
+    void jmp_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_JMPN, base, offset);
+    }
+    
+    void jmp_m(int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_JMPN, base, index, scale, offset);
+    }
+    
+#if !CPU(X86_64)
+    void jmp_m(const void* address)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_JMPN, address);
+    }
+#endif
+
+    AssemblerLabel jne()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionNE));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel jnz()
+    {
+        return jne();
+    }
+
+    AssemblerLabel je()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionE));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel jz()
+    {
+        return je();
+    }
+
+    AssemblerLabel jl()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionL));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel jb()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionB));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel jle()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionLE));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel jbe()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionBE));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel jge()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionGE));
+        return m_formatter.immediateRel32();
+    }
+
+    AssemblerLabel jg()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionG));
+        return m_formatter.immediateRel32();
+    }
+
+    AssemblerLabel ja()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionA));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel jae()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionAE));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel jo()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionO));
+        return m_formatter.immediateRel32();
+    }
+
+    AssemblerLabel jnp()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionNP));
+        return m_formatter.immediateRel32();
+    }
+
+    AssemblerLabel jp()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionP));
+        return m_formatter.immediateRel32();
+    }
+    
+    AssemblerLabel js()
+    {
+        m_formatter.twoByteOp(jccRel32(ConditionS));
+        return m_formatter.immediateRel32();
+    }
+
+    AssemblerLabel jCC(Condition cond)
+    {
+        m_formatter.twoByteOp(jccRel32(cond));
+        return m_formatter.immediateRel32();
+    }
+
+    // SSE operations:
+
+    void addsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void vaddsd_rr(XMMRegisterID a, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigCommutativeTwoByteOp(PRE_SSE_F2, OP2_ADDSD_VsdWsd, (RegisterID)dst, (RegisterID)a, (RegisterID)b);
+    }
+
+    void addsd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void addsd_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, dst, base, index, scale, offset);
+    }
+
+    void vaddsd_mr(int offset, RegisterID base, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F2, OP2_ADDSD_VsdWsd, (RegisterID)dst, (RegisterID)b, base, offset);
+    }
+
+    void vaddsd_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F2, OP2_ADDSD_VsdWsd, (RegisterID)dst, (RegisterID)b, offset, base, index, scale);
+    }
+
+    void addss_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void vaddss_rr(XMMRegisterID a, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigCommutativeTwoByteOp(PRE_SSE_F3, OP2_ADDSD_VsdWsd, (RegisterID)dst, (RegisterID)a, (RegisterID)b);
+    }
+
+    void addss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void addss_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, dst, base, index, scale, offset);
+    }
+
+    void vaddss_mr(int offset, RegisterID base, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F3, OP2_ADDSD_VsdWsd, (RegisterID)dst, (RegisterID)b, base, offset);
+    }
+
+    void vaddss_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F3, OP2_ADDSD_VsdWsd, (RegisterID)dst, (RegisterID)b, offset, base, index, scale);
+    }
+
+#if !CPU(X86_64)
+    void addsd_mr(const void* address, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, (RegisterID)dst, address);
+    }
+#endif
+
+    void cvtsi2sd_rr(RegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, src);
+    }
+
+    void cvtsi2ss_rr(RegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, src);
+    }
+
+#if CPU(X86_64)
+    void cvtsi2sdq_rr(RegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp64(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, src);
+    }
+
+    void cvtsi2ssq_rr(RegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp64(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, src);
+    }
+
+    void cvtsi2sdq_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp64(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
+    }
+
+    void cvtsi2ssq_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp64(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
+    }
+#endif
+
+    void cvtsi2sd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
+    }
+
+    void cvtsi2ss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
+    }
+
+#if !CPU(X86_64)
+    void cvtsi2sd_mr(const void* address, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, address);
+    }
+#endif
+
+    void cvttsd2si_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTTSD2SI_GdWsd, dst, (RegisterID)src);
+    }
+
+    void cvttss2si_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_CVTTSS2SI_GdWsd, dst, (RegisterID)src);
+    }
+
+#if CPU(X86_64)
+    void cvttss2siq_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp64(OP2_CVTTSS2SI_GdWsd, dst, (RegisterID)src);
+    }
+#endif
+
+    void cvtsd2ss_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTSD2SS_VsdWsd, dst, (RegisterID)src);
+    }
+
+    void cvtsd2ss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTSD2SS_VsdWsd, dst, base, offset);
+    }
+
+    void cvtss2sd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_CVTSS2SD_VsdWsd, dst, (RegisterID)src);
+    }
+
+    void cvtss2sd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_CVTSS2SD_VsdWsd, dst, base, offset);
+    }
+
+#if CPU(X86_64)
+    void cvttsd2siq_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp64(OP2_CVTTSD2SI_GdWsd, dst, (RegisterID)src);
+    }
+#endif
+
+    void movd_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_MOVD_EdVd, (RegisterID)src, dst);
+    }
+
+    void movd_rr(RegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_MOVD_VdEd, (RegisterID)dst, src);
+    }
+
+#if CPU(X86_64)
+    void movmskpd_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp64(OP2_MOVMSKPD_VdEd, dst, (RegisterID)src);
+    }
+
+    void movq_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp64(OP2_MOVD_EdVd, (RegisterID)src, dst);
+    }
+
+    void movq_rr(RegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp64(OP2_MOVD_VdEd, (RegisterID)dst, src);
+    }
+#endif
+
+    void movapd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_MOVAPD_VpdWpd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void movaps_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_MOVAPS_VpdWpd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void movsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void movsd_rm(XMMRegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_WsdVsd, (RegisterID)src, base, offset);
+    }
+    
+    void movsd_rm(XMMRegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_WsdVsd, (RegisterID)src, base, index, scale, offset);
+    }
+
+    void movss_rm(XMMRegisterID src, int offset, RegisterID base)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_MOVSD_WsdVsd, (RegisterID)src, base, offset);
+    }
+    
+    void movss_rm(XMMRegisterID src, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_MOVSD_WsdVsd, (RegisterID)src, base, index, scale, offset);
+    }
+    
+    void movsd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void movsd_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, dst, base, index, scale, offset);
+    }
+
+    void movss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void movss_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, dst, base, index, scale, offset);
+    }
+
+#if !CPU(X86_64)
+    void movsd_mr(const void* address, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_VsdWsd, (RegisterID)dst, address);
+    }
+    void movsd_rm(XMMRegisterID src, const void* address)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MOVSD_WsdVsd, (RegisterID)src, address);
+    }
+#endif
+
+    void mulsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MULSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void vmulsd_rr(XMMRegisterID a, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigCommutativeTwoByteOp(PRE_SSE_F2, OP2_MULSD_VsdWsd, (RegisterID)dst, (RegisterID)a, (RegisterID)b);
+    }
+
+    void mulsd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MULSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void mulsd_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_MULSD_VsdWsd, dst, base, index, scale, offset);
+    }
+
+    void vmulsd_mr(int offset, RegisterID base, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F2, OP2_MULSD_VsdWsd, (RegisterID)dst, (RegisterID)b, base, offset);
+    }
+
+    void vmulsd_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F2, OP2_MULSD_VsdWsd, (RegisterID)dst, (RegisterID)b, offset, base, index, scale);
+    }
+
+    void mulss_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_MULSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void vmulss_rr(XMMRegisterID a, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigCommutativeTwoByteOp(PRE_SSE_F3, OP2_MULSD_VsdWsd, (RegisterID)dst, (RegisterID)a, (RegisterID)b);
+    }
+
+    void mulss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_MULSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void mulss_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_MULSD_VsdWsd, dst, base, index, scale, offset);
+    }
+
+    void vmulss_mr(int offset, RegisterID base, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F3, OP2_MULSD_VsdWsd, (RegisterID)dst, (RegisterID)b, base, offset);
+    }
+
+    void vmulss_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F3, OP2_MULSD_VsdWsd, (RegisterID)dst, (RegisterID)b, offset, base, index, scale);
+    }
+
+    void pextrw_irr(int whichWord, XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_PEXTRW_GdUdIb, (RegisterID)dst, (RegisterID)src);
+        m_formatter.immediate8(whichWord);
+    }
+
+    void psllq_i8r(int imm, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp8(OP2_PSLLQ_UdqIb, GROUP14_OP_PSLLQ, (RegisterID)dst);
+        m_formatter.immediate8(imm);
+    }
+
+    void psrlq_i8r(int imm, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp8(OP2_PSRLQ_UdqIb, GROUP14_OP_PSRLQ, (RegisterID)dst);
+        m_formatter.immediate8(imm);
+    }
+
+    void por_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_POR_VdqWdq, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void subsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_SUBSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void vsubsd_rr(XMMRegisterID a, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F2, OP2_SUBSD_VsdWsd, (RegisterID)dst, (RegisterID)a, (RegisterID)b);
+    }
+
+    void subsd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_SUBSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void subsd_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_SUBSD_VsdWsd, dst, base, index, scale, offset);
+    }
+
+    void vsubsd_mr(XMMRegisterID b, int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F2, OP2_SUBSD_VsdWsd, (RegisterID)dst, (RegisterID)b, base, offset);
+    }
+
+    void vsubsd_mr(XMMRegisterID b, int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F2, OP2_SUBSD_VsdWsd, (RegisterID)dst, (RegisterID)b, offset, base, index, scale);
+    }
+
+    void subss_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_SUBSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void vsubss_rr(XMMRegisterID a, XMMRegisterID b, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F3, OP2_SUBSD_VsdWsd, (RegisterID)dst, (RegisterID)a, (RegisterID)b);
+    }
+
+    void subss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_SUBSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void subss_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_SUBSD_VsdWsd, dst, base, index, scale, offset);
+    }
+
+    void vsubss_mr(XMMRegisterID b, int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F3, OP2_SUBSD_VsdWsd, (RegisterID)dst, (RegisterID)b, base, offset);
+    }
+
+    void vsubss_mr(XMMRegisterID b, int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        m_formatter.vexNdsLigWigTwoByteOp(PRE_SSE_F3, OP2_SUBSD_VsdWsd, (RegisterID)dst, (RegisterID)b, offset, base, index, scale);
+    }
+
+    void ucomisd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_UCOMISD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void ucomisd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_UCOMISD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void ucomiss_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_UCOMISD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void ucomiss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_UCOMISD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void divsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_DIVSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void divsd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_DIVSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void divss_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_DIVSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void divss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_DIVSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void andps_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_ANDPS_VpdWpd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void xorps_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.twoByteOp(OP2_XORPD_VpdWpd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void xorpd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        if (src == dst) {
+            xorps_rr(src, dst);
+            return;
+        }
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_XORPD_VpdWpd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void andnpd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_ANDNPD_VpdWpd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void sqrtsd_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_SQRTSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void sqrtsd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_SQRTSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    void sqrtss_rr(XMMRegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_SQRTSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+    }
+
+    void sqrtss_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_F3);
+        m_formatter.twoByteOp(OP2_SQRTSD_VsdWsd, (RegisterID)dst, base, offset);
+    }
+
+    enum class RoundingType : uint8_t {
+        ToNearestWithTiesToEven = 0,
+        TowardNegativeInfiniti = 1,
+        TowardInfiniti = 2,
+        TowardZero = 3
+    };
+
+    void roundss_rr(XMMRegisterID src, XMMRegisterID dst, RoundingType rounding)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.threeByteOp(OP2_3BYTE_ESCAPE_3A, OP3_ROUNDSS_VssWssIb, (RegisterID)dst, (RegisterID)src);
+        m_formatter.immediate8(static_cast<uint8_t>(rounding));
+    }
+
+    void roundss_mr(int offset, RegisterID base, XMMRegisterID dst, RoundingType rounding)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.threeByteOp(OP2_3BYTE_ESCAPE_3A, OP3_ROUNDSS_VssWssIb, (RegisterID)dst, base, offset);
+        m_formatter.immediate8(static_cast<uint8_t>(rounding));
+    }
+
+    void roundsd_rr(XMMRegisterID src, XMMRegisterID dst, RoundingType rounding)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.threeByteOp(OP2_3BYTE_ESCAPE_3A, OP3_ROUNDSD_VsdWsdIb, (RegisterID)dst, (RegisterID)src);
+        m_formatter.immediate8(static_cast<uint8_t>(rounding));
+    }
+
+    void roundsd_mr(int offset, RegisterID base, XMMRegisterID dst, RoundingType rounding)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.threeByteOp(OP2_3BYTE_ESCAPE_3A, OP3_ROUNDSD_VsdWsdIb, (RegisterID)dst, base, offset);
+        m_formatter.immediate8(static_cast<uint8_t>(rounding));
+    }
+
+    // Misc instructions:
+
+    void int3()
+    {
+        m_formatter.oneByteOp(OP_INT3);
+    }
+    
+    void ret()
+    {
+        m_formatter.oneByteOp(OP_RET);
+    }
+
+    void predictNotTaken()
+    {
+        m_formatter.prefix(PRE_PREDICT_BRANCH_NOT_TAKEN);
+    }
+    
+    void lock()
+    {
+        m_formatter.prefix(PRE_LOCK);
+    }
+    
+    void mfence()
+    {
+        m_formatter.threeByteOp(OP2_3BYTE_ESCAPE_AE, OP3_MFENCE);
+    }
+
+    // Assembler admin methods:
+
+    size_t codeSize() const
+    {
+        return m_formatter.codeSize();
+    }
+    
+    AssemblerLabel labelForWatchpoint()
+    {
+        AssemblerLabel result = m_formatter.label();
+        if (static_cast<int>(result.m_offset) != m_indexOfLastWatchpoint)
+            result = label();
+        m_indexOfLastWatchpoint = result.m_offset;
+        m_indexOfTailOfLastWatchpoint = result.m_offset + maxJumpReplacementSize();
+        return result;
+    }
+    
+    AssemblerLabel labelIgnoringWatchpoints()
+    {
+        return m_formatter.label();
+    }
+
+    AssemblerLabel label()
+    {
+        AssemblerLabel result = m_formatter.label();
+        while (UNLIKELY(static_cast<int>(result.m_offset) < m_indexOfTailOfLastWatchpoint)) {
+            nop();
+            result = m_formatter.label();
+        }
+        return result;
+    }
+
+    AssemblerLabel align(int alignment)
+    {
+        while (!m_formatter.isAligned(alignment))
+            m_formatter.oneByteOp(OP_HLT);
+
+        return label();
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    void linkJump(AssemblerLabel from, AssemblerLabel to)
+    {
+        ASSERT(from.isSet());
+        ASSERT(to.isSet());
+
+        char* code = reinterpret_cast<char*>(m_formatter.data());
+        ASSERT(!reinterpret_cast<int32_t*>(code + from.m_offset)[-1]);
+        setRel32(code + from.m_offset, code + to.m_offset);
+    }
+    
+    static void linkJump(void* code, AssemblerLabel from, void* to)
+    {
+        ASSERT(from.isSet());
+
+        setRel32(reinterpret_cast<char*>(code) + from.m_offset, to);
+    }
+
+    static void linkCall(void* code, AssemblerLabel from, void* to)
+    {
+        ASSERT(from.isSet());
+
+        setRel32(reinterpret_cast<char*>(code) + from.m_offset, to);
+    }
+
+    static void linkPointer(void* code, AssemblerLabel where, void* value)
+    {
+        ASSERT(where.isSet());
+
+        setPointer(reinterpret_cast<char*>(code) + where.m_offset, value);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        setRel32(from, to);
+    }
+    
+    static void relinkJumpToNop(void* from)
+    {
+        setInt32(from, 0);
+    }
+    
+    static void relinkCall(void* from, void* to)
+    {
+        setRel32(from, to);
+    }
+    
+    static void repatchCompact(void* where, int32_t value)
+    {
+        ASSERT(value >= std::numeric_limits<int8_t>::min());
+        ASSERT(value <= std::numeric_limits<int8_t>::max());
+        setInt8(where, value);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        setInt32(where, value);
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        setPointer(where, value);
+    }
+    
+    static void* readPointer(void* where)
+    {
+        return reinterpret_cast<void**>(where)[-1];
+    }
+
+    static void replaceWithJump(void* instructionStart, void* to)
+    {
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+        uint8_t* dstPtr = reinterpret_cast<uint8_t*>(to);
+        intptr_t distance = (intptr_t)(dstPtr - (ptr + 5));
+        ptr[0] = static_cast<uint8_t>(OP_JMP_rel32);
+        *reinterpret_cast<int32_t*>(ptr + 1) = static_cast<int32_t>(distance);
+    }
+    
+    static ptrdiff_t maxJumpReplacementSize()
+    {
+        return 5;
+    }
+
+    static constexpr ptrdiff_t patchableJumpSize()
+    {
+        return 5;
+    }
+    
+#if CPU(X86_64)
+    static void revertJumpTo_movq_i64r(void* instructionStart, int64_t imm, RegisterID dst)
+    {
+        const unsigned instructionSize = 10; // REX.W MOV IMM64
+        const int rexBytes = 1;
+        const int opcodeBytes = 1;
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+        ptr[0] = PRE_REX | (1 << 3) | (dst >> 3);
+        ptr[1] = OP_MOV_EAXIv | (dst & 7);
+        
+        union {
+            uint64_t asWord;
+            uint8_t asBytes[8];
+        } u;
+        u.asWord = imm;
+        for (unsigned i = rexBytes + opcodeBytes; i < instructionSize; ++i)
+            ptr[i] = u.asBytes[i - rexBytes - opcodeBytes];
+    }
+
+    static void revertJumpTo_movl_i32r(void* instructionStart, int32_t imm, RegisterID dst)
+    {
+        // We only revert jumps on inline caches, and inline caches always use the scratch register (r11).
+        // FIXME: If the above is ever false then we need to make this smarter with respect to emitting 
+        // the REX byte.
+        ASSERT(dst == X86Registers::r11);
+        const unsigned instructionSize = 6; // REX MOV IMM32
+        const int rexBytes = 1;
+        const int opcodeBytes = 1;
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+        ptr[0] = PRE_REX | (dst >> 3);
+        ptr[1] = OP_MOV_EAXIv | (dst & 7);
+        
+        union {
+            uint32_t asWord;
+            uint8_t asBytes[4];
+        } u;
+        u.asWord = imm;
+        for (unsigned i = rexBytes + opcodeBytes; i < instructionSize; ++i)
+            ptr[i] = u.asBytes[i - rexBytes - opcodeBytes];
+    }
+#endif
+
+    static void revertJumpTo_cmpl_ir_force32(void* instructionStart, int32_t imm, RegisterID dst)
+    {
+        const int opcodeBytes = 1;
+        const int modRMBytes = 1;
+        ASSERT(opcodeBytes + modRMBytes <= maxJumpReplacementSize());
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+        ptr[0] = OP_GROUP1_EvIz;
+        ptr[1] = (X86InstructionFormatter::ModRmRegister << 6) | (GROUP1_OP_CMP << 3) | dst;
+        union {
+            uint32_t asWord;
+            uint8_t asBytes[4];
+        } u;
+        u.asWord = imm;
+        for (unsigned i = opcodeBytes + modRMBytes; i < static_cast<unsigned>(maxJumpReplacementSize()); ++i)
+            ptr[i] = u.asBytes[i - opcodeBytes - modRMBytes];
+    }
+    
+    static void revertJumpTo_cmpl_im_force32(void* instructionStart, int32_t imm, int offset, RegisterID dst)
+    {
+        ASSERT_UNUSED(offset, !offset);
+        const int opcodeBytes = 1;
+        const int modRMBytes = 1;
+        ASSERT(opcodeBytes + modRMBytes <= maxJumpReplacementSize());
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+        ptr[0] = OP_GROUP1_EvIz;
+        ptr[1] = (X86InstructionFormatter::ModRmMemoryNoDisp << 6) | (GROUP1_OP_CMP << 3) | dst;
+        union {
+            uint32_t asWord;
+            uint8_t asBytes[4];
+        } u;
+        u.asWord = imm;
+        for (unsigned i = opcodeBytes + modRMBytes; i < static_cast<unsigned>(maxJumpReplacementSize()); ++i)
+            ptr[i] = u.asBytes[i - opcodeBytes - modRMBytes];
+    }
+    
+    static void replaceWithLoad(void* instructionStart)
+    {
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+#if CPU(X86_64)
+        if ((*ptr & ~15) == PRE_REX)
+            ptr++;
+#endif
+        switch (*ptr) {
+        case OP_MOV_GvEv:
+            break;
+        case OP_LEA:
+            *ptr = OP_MOV_GvEv;
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    
+    static void replaceWithAddressComputation(void* instructionStart)
+    {
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+#if CPU(X86_64)
+        if ((*ptr & ~15) == PRE_REX)
+            ptr++;
+#endif
+        switch (*ptr) {
+        case OP_MOV_GvEv:
+            *ptr = OP_LEA;
+            break;
+        case OP_LEA:
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    
+    static unsigned getCallReturnOffset(AssemblerLabel call)
+    {
+        ASSERT(call.isSet());
+        return call.m_offset;
+    }
+
+    static void* getRelocatedAddress(void* code, AssemblerLabel label)
+    {
+        ASSERT(label.isSet());
+        return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + label.m_offset);
+    }
+    
+    static int getDifferenceBetweenLabels(AssemblerLabel a, AssemblerLabel b)
+    {
+        return b.m_offset - a.m_offset;
+    }
+    
+    unsigned debugOffset() { return m_formatter.debugOffset(); }
+
+    void nop()
+    {
+        m_formatter.oneByteOp(OP_NOP);
+    }
+
+    static void fillNops(void* base, size_t size, bool isCopyingToExecutableMemory)
+    {
+        UNUSED_PARAM(isCopyingToExecutableMemory);
+#if CPU(X86_64)
+        static const uint8_t nops[10][10] = {
+            // nop
+            {0x90},
+            // xchg %ax,%ax
+            {0x66, 0x90},
+            // nopl (%[re]ax)
+            {0x0f, 0x1f, 0x00},
+            // nopl 8(%[re]ax)
+            {0x0f, 0x1f, 0x40, 0x08},
+            // nopl 8(%[re]ax,%[re]ax,1)
+            {0x0f, 0x1f, 0x44, 0x00, 0x08},
+            // nopw 8(%[re]ax,%[re]ax,1)
+            {0x66, 0x0f, 0x1f, 0x44, 0x00, 0x08},
+            // nopl 512(%[re]ax)
+            {0x0f, 0x1f, 0x80, 0x00, 0x02, 0x00, 0x00},
+            // nopl 512(%[re]ax,%[re]ax,1)
+            {0x0f, 0x1f, 0x84, 0x00, 0x00, 0x02, 0x00, 0x00},
+            // nopw 512(%[re]ax,%[re]ax,1)
+            {0x66, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x02, 0x00, 0x00},
+            // nopw %cs:512(%[re]ax,%[re]ax,1)
+            {0x66, 0x2e, 0x0f, 0x1f, 0x84, 0x00, 0x00, 0x02, 0x00, 0x00}
+        };
+
+        uint8_t* where = reinterpret_cast<uint8_t*>(base);
+        while (size) {
+            unsigned nopSize = static_cast<unsigned>(std::min<size_t>(size, 15));
+            unsigned numPrefixes = nopSize <= 10 ? 0 : nopSize - 10;
+            for (unsigned i = 0; i != numPrefixes; ++i)
+                *where++ = 0x66;
+
+            unsigned nopRest = nopSize - numPrefixes;
+            for (unsigned i = 0; i != nopRest; ++i)
+                *where++ = nops[nopRest-1][i];
+
+            size -= nopSize;
+        }
+#else
+        memset(base, OP_NOP, size);
+#endif
+    }
+
+    // This is a no-op on x86
+    ALWAYS_INLINE static void cacheFlush(void*, size_t) { }
+
+private:
+
+    static void setPointer(void* where, void* value)
+    {
+        reinterpret_cast<void**>(where)[-1] = value;
+    }
+
+    static void setInt32(void* where, int32_t value)
+    {
+        reinterpret_cast<int32_t*>(where)[-1] = value;
+    }
+    
+    static void setInt8(void* where, int8_t value)
+    {
+        reinterpret_cast<int8_t*>(where)[-1] = value;
+    }
+
+    static void setRel32(void* from, void* to)
+    {
+        intptr_t offset = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
+        ASSERT(offset == static_cast<int32_t>(offset));
+
+        setInt32(from, offset);
+    }
+
+    class X86InstructionFormatter {
+        static const int maxInstructionSize = 16;
+
+    public:
+        enum ModRmMode {
+            ModRmMemoryNoDisp = 0,
+            ModRmMemoryDisp8 = 1 << 6,
+            ModRmMemoryDisp32 = 2 << 6,
+            ModRmRegister = 3 << 6,
+        };
+
+        // Legacy prefix bytes:
+        //
+        // These are emmitted prior to the instruction.
+
+        void prefix(OneByteOpcodeID pre)
+        {
+            m_buffer.putByte(pre);
+        }
+
+#if CPU(X86_64)
+        // Byte operand register spl & above require a REX prefix (to prevent the 'H' registers be accessed).
+        static bool byteRegRequiresRex(int reg)
+        {
+            static_assert(X86Registers::esp == 4, "Necessary condition for OR-masking");
+            return (reg >= X86Registers::esp);
+        }
+        static bool byteRegRequiresRex(int a, int b)
+        {
+            return byteRegRequiresRex(a | b);
+        }
+
+        // Registers r8 & above require a REX prefixe.
+        static bool regRequiresRex(int reg)
+        {
+            static_assert(X86Registers::r8 == 8, "Necessary condition for OR-masking");
+            return (reg >= X86Registers::r8);
+        }
+        static bool regRequiresRex(int a, int b)
+        {
+            return regRequiresRex(a | b);
+        }
+        static bool regRequiresRex(int a, int b, int c)
+        {
+            return regRequiresRex(a | b | c);
+        }
+#else
+        static bool byteRegRequiresRex(int) { return false; }
+        static bool byteRegRequiresRex(int, int) { return false; }
+        static bool regRequiresRex(int) { return false; }
+        static bool regRequiresRex(int, int) { return false; }
+        static bool regRequiresRex(int, int, int) { return false; }
+#endif
+
+        class SingleInstructionBufferWriter : public AssemblerBuffer::LocalWriter {
+        public:
+            SingleInstructionBufferWriter(AssemblerBuffer& buffer)
+                : AssemblerBuffer::LocalWriter(buffer, maxInstructionSize)
+            {
+            }
+
+            // Internals; ModRm and REX formatters.
+
+            static constexpr RegisterID noBase = X86Registers::ebp;
+            static constexpr RegisterID hasSib = X86Registers::esp;
+            static constexpr RegisterID noIndex = X86Registers::esp;
+
+#if CPU(X86_64)
+            static constexpr RegisterID noBase2 = X86Registers::r13;
+            static constexpr RegisterID hasSib2 = X86Registers::r12;
+
+            // Format a REX prefix byte.
+            ALWAYS_INLINE void emitRex(bool w, int r, int x, int b)
+            {
+                ASSERT(r >= 0);
+                ASSERT(x >= 0);
+                ASSERT(b >= 0);
+                putByteUnchecked(PRE_REX | ((int)w << 3) | ((r>>3)<<2) | ((x>>3)<<1) | (b>>3));
+            }
+
+            // Used to plant a REX byte with REX.w set (for 64-bit operations).
+            ALWAYS_INLINE void emitRexW(int r, int x, int b)
+            {
+                emitRex(true, r, x, b);
+            }
+
+            // Used for operations with byte operands - use byteRegRequiresRex() to check register operands,
+            // regRequiresRex() to check other registers (i.e. address base & index).
+            ALWAYS_INLINE void emitRexIf(bool condition, int r, int x, int b)
+            {
+                if (condition)
+                    emitRex(false, r, x, b);
+            }
+
+            // Used for word sized operations, will plant a REX prefix if necessary (if any register is r8 or above).
+            ALWAYS_INLINE void emitRexIfNeeded(int r, int x, int b)
+            {
+                emitRexIf(regRequiresRex(r, x, b), r, x, b);
+            }
+#else
+            // No REX prefix bytes on 32-bit x86.
+            ALWAYS_INLINE void emitRexIf(bool, int, int, int) { }
+            ALWAYS_INLINE void emitRexIfNeeded(int, int, int) { }
+#endif
+
+            ALWAYS_INLINE void putModRm(ModRmMode mode, int reg, RegisterID rm)
+            {
+                putByteUnchecked(mode | ((reg & 7) << 3) | (rm & 7));
+            }
+
+            ALWAYS_INLINE void putModRmSib(ModRmMode mode, int reg, RegisterID base, RegisterID index, int scale)
+            {
+                ASSERT(mode != ModRmRegister);
+
+                putModRm(mode, reg, hasSib);
+                putByteUnchecked((scale << 6) | ((index & 7) << 3) | (base & 7));
+            }
+
+            ALWAYS_INLINE void registerModRM(int reg, RegisterID rm)
+            {
+                putModRm(ModRmRegister, reg, rm);
+            }
+
+            ALWAYS_INLINE void memoryModRM(int reg, RegisterID base, int offset)
+            {
+                // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
+#if CPU(X86_64)
+                if ((base == hasSib) || (base == hasSib2)) {
+#else
+                if (base == hasSib) {
+#endif
+                    if (!offset) // No need to check if the base is noBase, since we know it is hasSib!
+                        putModRmSib(ModRmMemoryNoDisp, reg, base, noIndex, 0);
+                    else if (CAN_SIGN_EXTEND_8_32(offset)) {
+                        putModRmSib(ModRmMemoryDisp8, reg, base, noIndex, 0);
+                        putByteUnchecked(offset);
+                    } else {
+                        putModRmSib(ModRmMemoryDisp32, reg, base, noIndex, 0);
+                        putIntUnchecked(offset);
+                    }
+                } else {
+#if CPU(X86_64)
+                    if (!offset && (base != noBase) && (base != noBase2))
+#else
+                    if (!offset && (base != noBase))
+#endif
+                        putModRm(ModRmMemoryNoDisp, reg, base);
+                    else if (CAN_SIGN_EXTEND_8_32(offset)) {
+                        putModRm(ModRmMemoryDisp8, reg, base);
+                        putByteUnchecked(offset);
+                    } else {
+                        putModRm(ModRmMemoryDisp32, reg, base);
+                        putIntUnchecked(offset);
+                    }
+                }
+            }
+
+            ALWAYS_INLINE void memoryModRM_disp8(int reg, RegisterID base, int offset)
+            {
+                // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
+                ASSERT(CAN_SIGN_EXTEND_8_32(offset));
+#if CPU(X86_64)
+                if ((base == hasSib) || (base == hasSib2)) {
+#else
+                if (base == hasSib) {
+#endif
+                    putModRmSib(ModRmMemoryDisp8, reg, base, noIndex, 0);
+                    putByteUnchecked(offset);
+                } else {
+                    putModRm(ModRmMemoryDisp8, reg, base);
+                    putByteUnchecked(offset);
+                }
+            }
+
+            ALWAYS_INLINE void memoryModRM_disp32(int reg, RegisterID base, int offset)
+            {
+                // A base of esp or r12 would be interpreted as a sib, so force a sib with no index & put the base in there.
+#if CPU(X86_64)
+                if ((base == hasSib) || (base == hasSib2)) {
+#else
+                if (base == hasSib) {
+#endif
+                    putModRmSib(ModRmMemoryDisp32, reg, base, noIndex, 0);
+                    putIntUnchecked(offset);
+                } else {
+                    putModRm(ModRmMemoryDisp32, reg, base);
+                    putIntUnchecked(offset);
+                }
+            }
+        
+            ALWAYS_INLINE void memoryModRM(int reg, RegisterID base, RegisterID index, int scale, int offset)
+            {
+                ASSERT(index != noIndex);
+
+#if CPU(X86_64)
+                if (!offset && (base != noBase) && (base != noBase2))
+#else
+                if (!offset && (base != noBase))
+#endif
+                    putModRmSib(ModRmMemoryNoDisp, reg, base, index, scale);
+                else if (CAN_SIGN_EXTEND_8_32(offset)) {
+                    putModRmSib(ModRmMemoryDisp8, reg, base, index, scale);
+                    putByteUnchecked(offset);
+                } else {
+                    putModRmSib(ModRmMemoryDisp32, reg, base, index, scale);
+                    putIntUnchecked(offset);
+                }
+            }
+
+#if !CPU(X86_64)
+            ALWAYS_INLINE void memoryModRM(int reg, const void* address)
+            {
+                // noBase + ModRmMemoryNoDisp means noBase + ModRmMemoryDisp32!
+                putModRm(ModRmMemoryNoDisp, reg, noBase);
+                putIntUnchecked(reinterpret_cast<int32_t>(address));
+            }
+#endif
+            ALWAYS_INLINE void twoBytesVex(OneByteOpcodeID simdPrefix, RegisterID inOpReg, RegisterID r)
+            {
+                putByteUnchecked(VexPrefix::TwoBytes);
+
+                uint8_t secondByte = vexEncodeSimdPrefix(simdPrefix);
+                secondByte |= (~inOpReg & 0xf) << 3;
+                secondByte |= !regRequiresRex(r) << 7;
+                putByteUnchecked(secondByte);
+            }
+
+            ALWAYS_INLINE void threeBytesVexNds(OneByteOpcodeID simdPrefix, VexImpliedBytes impliedBytes, RegisterID r, RegisterID inOpReg, RegisterID x, RegisterID b)
+            {
+                putByteUnchecked(VexPrefix::ThreeBytes);
+
+                uint8_t secondByte = static_cast<uint8_t>(impliedBytes);
+                secondByte |= !regRequiresRex(r) << 7;
+                secondByte |= !regRequiresRex(x) << 6;
+                secondByte |= !regRequiresRex(b) << 5;
+                putByteUnchecked(secondByte);
+
+                uint8_t thirdByte = vexEncodeSimdPrefix(simdPrefix);
+                thirdByte |= (~inOpReg & 0xf) << 3;
+                putByteUnchecked(thirdByte);
+            }
+
+            ALWAYS_INLINE void threeBytesVexNds(OneByteOpcodeID simdPrefix, VexImpliedBytes impliedBytes, RegisterID r, RegisterID inOpReg, RegisterID b)
+            {
+                putByteUnchecked(VexPrefix::ThreeBytes);
+
+                uint8_t secondByte = static_cast<uint8_t>(impliedBytes);
+                secondByte |= !regRequiresRex(r) << 7;
+                secondByte |= 1 << 6; // REX.X
+                secondByte |= !regRequiresRex(b) << 5;
+                putByteUnchecked(secondByte);
+
+                uint8_t thirdByte = vexEncodeSimdPrefix(simdPrefix);
+                thirdByte |= (~inOpReg & 0xf) << 3;
+                putByteUnchecked(thirdByte);
+            }
+        private:
+            uint8_t vexEncodeSimdPrefix(OneByteOpcodeID simdPrefix)
+            {
+                switch (simdPrefix) {
+                case 0x66:
+                    return 1;
+                case 0xF3:
+                    return 2;
+                case 0xF2:
+                    return 3;
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                }
+                return 0;
+            }
+
+        };
+
+        // Word-sized operands / no operand instruction formatters.
+        //
+        // In addition to the opcode, the following operand permutations are supported:
+        //   * None - instruction takes no operands.
+        //   * One register - the low three bits of the RegisterID are added into the opcode.
+        //   * Two registers - encode a register form ModRm (for all ModRm formats, the reg field is passed first, and a GroupOpcodeID may be passed in its place).
+        //   * Three argument ModRM - a register, and a register and an offset describing a memory operand.
+        //   * Five argument ModRM - a register, and a base register, an index, scale, and offset describing a memory operand.
+        //
+        // For 32-bit x86 targets, the address operand may also be provided as a void*.
+        // On 64-bit targets REX prefixes will be planted as necessary, where high numbered registers are used.
+        //
+        // The twoByteOp methods plant two-byte Intel instructions sequences (first opcode byte 0x0F).
+
+        void oneByteOp(OneByteOpcodeID opcode)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.putByteUnchecked(opcode);
+        }
+
+        void oneByteOp(OneByteOpcodeID opcode, RegisterID reg)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(0, 0, reg);
+            writer.putByteUnchecked(opcode + (reg & 7));
+        }
+
+        void oneByteOp(OneByteOpcodeID opcode, int reg, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, 0, rm);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(reg, rm);
+        }
+
+        void oneByteOp(OneByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, 0, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, offset);
+        }
+
+        void oneByteOp_disp32(OneByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, 0, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM_disp32(reg, base, offset);
+        }
+        
+        void oneByteOp_disp8(OneByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, 0, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM_disp8(reg, base, offset);
+        }
+
+        void oneByteOp(OneByteOpcodeID opcode, int reg, RegisterID base, RegisterID index, int scale, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, index, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, index, scale, offset);
+        }
+
+#if !CPU(X86_64)
+        void oneByteOp(OneByteOpcodeID opcode, int reg, const void* address)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, address);
+        }
+#endif
+
+        void twoByteOp(TwoByteOpcodeID opcode)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+        }
+
+        void twoByteOp(TwoByteOpcodeID opcode, int reg, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, 0, rm);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(reg, rm);
+        }
+
+        void twoByteOp(TwoByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, 0, base);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, offset);
+        }
+
+        void twoByteOp(TwoByteOpcodeID opcode, int reg, RegisterID base, RegisterID index, int scale, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, index, base);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, index, scale, offset);
+        }
+
+#if !CPU(X86_64)
+        void twoByteOp(TwoByteOpcodeID opcode, int reg, const void* address)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, address);
+        }
+#endif
+        void vexNdsLigWigTwoByteOp(OneByteOpcodeID simdPrefix, TwoByteOpcodeID opcode, RegisterID dest, RegisterID a, RegisterID b)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            if (regRequiresRex(b))
+                writer.threeBytesVexNds(simdPrefix, VexImpliedBytes::TwoBytesOp, dest, a, b);
+            else
+                writer.twoBytesVex(simdPrefix, a, dest);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(dest, b);
+        }
+
+        void vexNdsLigWigCommutativeTwoByteOp(OneByteOpcodeID simdPrefix, TwoByteOpcodeID opcode, RegisterID dest, RegisterID a, RegisterID b)
+        {
+            // Since this is a commutative operation, we can try switching the arguments.
+            if (regRequiresRex(b))
+                std::swap(a, b);
+            vexNdsLigWigTwoByteOp(simdPrefix, opcode, dest, a, b);
+        }
+
+        void vexNdsLigWigTwoByteOp(OneByteOpcodeID simdPrefix, TwoByteOpcodeID opcode, RegisterID dest, RegisterID a, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            if (regRequiresRex(base))
+                writer.threeBytesVexNds(simdPrefix, VexImpliedBytes::TwoBytesOp, dest, a, base);
+            else
+                writer.twoBytesVex(simdPrefix, a, dest);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(dest, base, offset);
+        }
+
+        void vexNdsLigWigTwoByteOp(OneByteOpcodeID simdPrefix, TwoByteOpcodeID opcode, RegisterID dest, RegisterID a, int offset, RegisterID base, RegisterID index, int scale)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            if (regRequiresRex(base, index))
+                writer.threeBytesVexNds(simdPrefix, VexImpliedBytes::TwoBytesOp, dest, a, index, base);
+            else
+                writer.twoBytesVex(simdPrefix, a, dest);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(dest, base, index, scale, offset);
+        }
+
+        void threeByteOp(TwoByteOpcodeID twoBytePrefix, ThreeByteOpcodeID opcode)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(twoBytePrefix);
+            writer.putByteUnchecked(opcode);
+        }
+
+        void threeByteOp(TwoByteOpcodeID twoBytePrefix, ThreeByteOpcodeID opcode, int reg, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, 0, rm);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(twoBytePrefix);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(reg, rm);
+        }
+
+        void threeByteOp(TwoByteOpcodeID twoBytePrefix, ThreeByteOpcodeID opcode, int reg, RegisterID base, int displacement)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIfNeeded(reg, 0, base);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(twoBytePrefix);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, displacement);
+        }
+
+#if CPU(X86_64)
+        // Quad-word-sized operands:
+        //
+        // Used to format 64-bit operantions, planting a REX.w prefix.
+        // When planting d64 or f64 instructions, not requiring a REX.w prefix,
+        // the normal (non-'64'-postfixed) formatters should be used.
+
+        void oneByteOp64(OneByteOpcodeID opcode)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(0, 0, 0);
+            writer.putByteUnchecked(opcode);
+        }
+
+        void oneByteOp64(OneByteOpcodeID opcode, RegisterID reg)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(0, 0, reg);
+            writer.putByteUnchecked(opcode + (reg & 7));
+        }
+
+        void oneByteOp64(OneByteOpcodeID opcode, int reg, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(reg, 0, rm);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(reg, rm);
+        }
+
+        void oneByteOp64(OneByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(reg, 0, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, offset);
+        }
+
+        void oneByteOp64_disp32(OneByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(reg, 0, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM_disp32(reg, base, offset);
+        }
+        
+        void oneByteOp64_disp8(OneByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(reg, 0, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM_disp8(reg, base, offset);
+        }
+
+        void oneByteOp64(OneByteOpcodeID opcode, int reg, RegisterID base, RegisterID index, int scale, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(reg, index, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, index, scale, offset);
+        }
+
+        void twoByteOp64(TwoByteOpcodeID opcode, int reg, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(reg, 0, rm);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(reg, rm);
+        }
+
+        void twoByteOp64(TwoByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(reg, 0, base);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, offset);
+        }
+
+        void twoByteOp64(TwoByteOpcodeID opcode, int reg, RegisterID base, RegisterID index, int scale, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexW(reg, index, base);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, index, scale, offset);
+        }
+#endif
+
+        // Byte-operands:
+        //
+        // These methods format byte operations.  Byte operations differ from the normal
+        // formatters in the circumstances under which they will decide to emit REX prefixes.
+        // These should be used where any register operand signifies a byte register.
+        //
+        // The disctinction is due to the handling of register numbers in the range 4..7 on
+        // x86-64.  These register numbers may either represent the second byte of the first
+        // four registers (ah..bh) or the first byte of the second four registers (spl..dil).
+        //
+        // Since ah..bh cannot be used in all permutations of operands (specifically cannot
+        // be accessed where a REX prefix is present), these are likely best treated as
+        // deprecated.  In order to ensure the correct registers spl..dil are selected a
+        // REX prefix will be emitted for any byte register operand in the range 4..15.
+        //
+        // These formatters may be used in instructions where a mix of operand sizes, in which
+        // case an unnecessary REX will be emitted, for example:
+        //     movzbl %al, %edi
+        // In this case a REX will be planted since edi is 7 (and were this a byte operand
+        // a REX would be required to specify dil instead of bh).  Unneeded REX prefixes will
+        // be silently ignored by the processor.
+        //
+        // Address operands should still be checked using regRequiresRex(), while byteRegRequiresRex()
+        // is provided to check byte register operands.
+
+        void oneByteOp8(OneByteOpcodeID opcode, GroupOpcodeID groupOp, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIf(byteRegRequiresRex(rm), 0, 0, rm);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(groupOp, rm);
+        }
+
+        void oneByteOp8(OneByteOpcodeID opcode, int reg, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIf(byteRegRequiresRex(reg, rm), reg, 0, rm);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(reg, rm);
+        }
+
+        void oneByteOp8(OneByteOpcodeID opcode, int reg, RegisterID base, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIf(byteRegRequiresRex(reg, base), reg, 0, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, offset);
+        }
+
+        void oneByteOp8(OneByteOpcodeID opcode, int reg, RegisterID base, RegisterID index, int scale, int offset)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIf(byteRegRequiresRex(reg) || regRequiresRex(index, base), reg, index, base);
+            writer.putByteUnchecked(opcode);
+            writer.memoryModRM(reg, base, index, scale, offset);
+        }
+
+        void twoByteOp8(TwoByteOpcodeID opcode, RegisterID reg, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIf(byteRegRequiresRex(reg, rm), reg, 0, rm);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(reg, rm);
+        }
+
+        void twoByteOp8(TwoByteOpcodeID opcode, GroupOpcodeID groupOp, RegisterID rm)
+        {
+            SingleInstructionBufferWriter writer(m_buffer);
+            writer.emitRexIf(byteRegRequiresRex(rm), 0, 0, rm);
+            writer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            writer.putByteUnchecked(opcode);
+            writer.registerModRM(groupOp, rm);
+        }
+
+        // Immediates:
+        //
+        // An immedaite should be appended where appropriate after an op has been emitted.
+        // The writes are unchecked since the opcode formatters above will have ensured space.
+
+        void immediate8(int imm)
+        {
+            m_buffer.putByteUnchecked(imm);
+        }
+
+        void immediate16(int imm)
+        {
+            m_buffer.putShortUnchecked(imm);
+        }
+
+        void immediate32(int imm)
+        {
+            m_buffer.putIntUnchecked(imm);
+        }
+
+        void immediate64(int64_t imm)
+        {
+            m_buffer.putInt64Unchecked(imm);
+        }
+
+        AssemblerLabel immediateRel32()
+        {
+            m_buffer.putIntUnchecked(0);
+            return label();
+        }
+
+        // Administrative methods:
+
+        size_t codeSize() const { return m_buffer.codeSize(); }
+        AssemblerLabel label() const { return m_buffer.label(); }
+        bool isAligned(int alignment) const { return m_buffer.isAligned(alignment); }
+        void* data() const { return m_buffer.data(); }
+
+        unsigned debugOffset() { return m_buffer.debugOffset(); }
+
+    public:
+        AssemblerBuffer m_buffer;
+    } m_formatter;
+    int m_indexOfLastWatchpoint;
+    int m_indexOfTailOfLastWatchpoint;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && CPU(X86)
diff --git a/b3/B3ArgumentRegValue.cpp b/b3/B3ArgumentRegValue.cpp
new file mode 100644
index 0000000..594d0d6
--- /dev/null
+++ b/b3/B3ArgumentRegValue.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3ArgumentRegValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+ArgumentRegValue::~ArgumentRegValue()
+{
+}
+
+void ArgumentRegValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma, m_reg);
+}
+
+Value* ArgumentRegValue::cloneImpl() const
+{
+    return new ArgumentRegValue(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ArgumentRegValue.h b/b3/B3ArgumentRegValue.h
new file mode 100644
index 0000000..55b365f
--- /dev/null
+++ b/b3/B3ArgumentRegValue.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+#include "Reg.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE ArgumentRegValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == ArgumentReg; }
+    
+    ~ArgumentRegValue();
+
+    Reg argumentReg() const { return m_reg; }
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    ArgumentRegValue(Origin origin, Reg reg)
+        : Value(CheckedOpcode, ArgumentReg, reg.isGPR() ? pointerType() : Double, origin)
+        , m_reg(reg)
+    {
+        ASSERT(reg.isSet());
+    }
+
+    Reg m_reg;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3BasicBlock.cpp b/b3/B3BasicBlock.cpp
new file mode 100644
index 0000000..63a4e58
--- /dev/null
+++ b/b3/B3BasicBlock.cpp
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3BasicBlock.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3BasicBlockUtils.h"
+#include "B3Procedure.h"
+#include "B3ValueInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 {
+
+const char* const BasicBlock::dumpPrefix = "#";
+
+BasicBlock::BasicBlock(unsigned index, double frequency)
+    : m_index(index)
+    , m_frequency(frequency)
+{
+}
+
+BasicBlock::~BasicBlock()
+{
+}
+
+void BasicBlock::append(Value* value)
+{
+    m_values.append(value);
+    value->owner = this;
+}
+
+void BasicBlock::appendNonTerminal(Value* value)
+{
+    m_values.append(m_values.last());
+    m_values[m_values.size() - 1] = value;
+    value->owner = this;
+}
+
+void BasicBlock::removeLast(Procedure& proc)
+{
+    ASSERT(!m_values.isEmpty());
+    proc.deleteValue(m_values.takeLast());
+}
+
+void BasicBlock::replaceLast(Procedure& proc, Value* value)
+{
+    removeLast(proc);
+    append(value);
+}
+
+Value* BasicBlock::appendIntConstant(Procedure& proc, Origin origin, Type type, int64_t value)
+{
+    Value* result = proc.addIntConstant(origin, type, value);
+    append(result);
+    return result;
+}
+
+Value* BasicBlock::appendIntConstant(Procedure& proc, Value* likeValue, int64_t value)
+{
+    return appendIntConstant(proc, likeValue->origin(), likeValue->type(), value);
+}
+
+Value* BasicBlock::appendBoolConstant(Procedure& proc, Origin origin, bool value)
+{
+    return appendIntConstant(proc, origin, Int32, value ? 1 : 0);
+}
+
+void BasicBlock::clearSuccessors()
+{
+    m_successors.clear();
+}
+
+void BasicBlock::appendSuccessor(FrequentedBlock target)
+{
+    m_successors.append(target);
+}
+
+void BasicBlock::setSuccessors(FrequentedBlock target)
+{
+    m_successors.resize(1);
+    m_successors[0] = target;
+}
+
+void BasicBlock::setSuccessors(FrequentedBlock taken, FrequentedBlock notTaken)
+{
+    m_successors.resize(2);
+    m_successors[0] = taken;
+    m_successors[1] = notTaken;
+}
+
+bool BasicBlock::replaceSuccessor(BasicBlock* from, BasicBlock* to)
+{
+    bool result = false;
+    for (BasicBlock*& successor : successorBlocks()) {
+        if (successor == from) {
+            successor = to;
+            result = true;
+            
+            // Keep looping because a successor may be mentioned multiple times, like in a Switch.
+        }
+    }
+    return result;
+}
+
+bool BasicBlock::addPredecessor(BasicBlock* block)
+{
+    return B3::addPredecessor(this, block);
+}
+
+bool BasicBlock::removePredecessor(BasicBlock* block)
+{
+    return B3::removePredecessor(this, block);
+}
+
+bool BasicBlock::replacePredecessor(BasicBlock* from, BasicBlock* to)
+{
+    return B3::replacePredecessor(this, from, to);
+}
+
+void BasicBlock::updatePredecessorsAfter()
+{
+    B3::updatePredecessorsAfter(this);
+}
+
+void BasicBlock::dump(PrintStream& out) const
+{
+    out.print(dumpPrefix, m_index);
+}
+
+void BasicBlock::deepDump(const Procedure& proc, PrintStream& out) const
+{
+    out.print("BB", *this, ": ; frequency = ", m_frequency, "\n");
+    if (predecessors().size())
+        out.print("  Predecessors: ", pointerListDump(predecessors()), "\n");
+    for (Value* value : *this)
+        out.print("    ", B3::deepDump(proc, value), "\n");
+    if (!successors().isEmpty()) {
+        out.print("  Successors: ");
+        if (size())
+            last()->dumpSuccessors(this, out);
+        else
+            out.print(listDump(successors()));
+        out.print("\n");
+    }
+}
+
+Value* BasicBlock::appendNewControlValue(Procedure& proc, Opcode opcode, Origin origin)
+{
+    RELEASE_ASSERT(opcode == Oops || opcode == Return);
+    clearSuccessors();
+    return appendNew<Value>(proc, opcode, origin);
+}
+
+Value* BasicBlock::appendNewControlValue(Procedure& proc, Opcode opcode, Origin origin, Value* value)
+{
+    RELEASE_ASSERT(opcode == Return);
+    clearSuccessors();
+    return appendNew<Value>(proc, opcode, origin, value);
+}
+
+Value* BasicBlock::appendNewControlValue(Procedure& proc, Opcode opcode, Origin origin, const FrequentedBlock& target)
+{
+    RELEASE_ASSERT(opcode == Jump);
+    setSuccessors(target);
+    return appendNew<Value>(proc, opcode, origin);
+}
+
+Value* BasicBlock::appendNewControlValue(Procedure& proc, Opcode opcode, Origin origin, Value* predicate, const FrequentedBlock& taken, const FrequentedBlock& notTaken)
+{
+    RELEASE_ASSERT(opcode == Branch);
+    setSuccessors(taken, notTaken);
+    return appendNew<Value>(proc, opcode, origin, predicate);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3BasicBlock.h b/b3/B3BasicBlock.h
new file mode 100644
index 0000000..11f4668
--- /dev/null
+++ b/b3/B3BasicBlock.h
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3FrequentedBlock.h"
+#include "B3Opcode.h"
+#include "B3Origin.h"
+#include "B3SuccessorCollection.h"
+#include "B3Type.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class BlockInsertionSet;
+class InsertionSet;
+class Procedure;
+class Value;
+
+class BasicBlock {
+    WTF_MAKE_NONCOPYABLE(BasicBlock);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    typedef Vector<Value*> ValueList;
+    typedef Vector<BasicBlock*, 2> PredecessorList;
+    typedef Vector<FrequentedBlock, 2> SuccessorList;
+
+    static const char* const dumpPrefix;
+
+    ~BasicBlock();
+
+    unsigned index() const { return m_index; }
+
+    ValueList::iterator begin() { return m_values.begin(); }
+    ValueList::iterator end() { return m_values.end(); }
+    ValueList::const_iterator begin() const { return m_values.begin(); }
+    ValueList::const_iterator end() const { return m_values.end(); }
+
+    size_t size() const { return m_values.size(); }
+    Value* at(size_t index) const { return m_values[index]; }
+    Value*& at(size_t index) { return m_values[index]; }
+
+    Value* last() const { return m_values.last(); }
+    Value*& last() { return m_values.last(); }
+
+    const ValueList& values() const { return m_values; }
+    ValueList& values() { return m_values; }
+
+    JS_EXPORT_PRIVATE void append(Value*);
+    JS_EXPORT_PRIVATE void appendNonTerminal(Value*);
+    JS_EXPORT_PRIVATE void replaceLast(Procedure&, Value*);
+
+    template<typename ValueType, typename... Arguments>
+    ValueType* appendNew(Procedure&, Arguments...);
+    template<typename ValueType, typename... Arguments>
+    ValueType* appendNewNonTerminal(Procedure&, Arguments...);
+
+    JS_EXPORT_PRIVATE Value* appendIntConstant(Procedure&, Origin, Type, int64_t value);
+    Value* appendIntConstant(Procedure&, Value* likeValue, int64_t value);
+    Value* appendBoolConstant(Procedure&, Origin, bool);
+
+    void removeLast(Procedure&);
+    
+    template<typename ValueType, typename... Arguments>
+    ValueType* replaceLastWithNew(Procedure&, Arguments...);
+
+    unsigned numSuccessors() const { return m_successors.size(); }
+    const FrequentedBlock& successor(unsigned index) const { return m_successors[index]; }
+    FrequentedBlock& successor(unsigned index) { return m_successors[index]; }
+    const SuccessorList& successors() const { return m_successors; }
+    SuccessorList& successors() { return m_successors; }
+    
+    void clearSuccessors();
+    JS_EXPORT_PRIVATE void appendSuccessor(FrequentedBlock);
+    JS_EXPORT_PRIVATE void setSuccessors(FrequentedBlock);
+    JS_EXPORT_PRIVATE void setSuccessors(FrequentedBlock, FrequentedBlock);
+
+    BasicBlock* successorBlock(unsigned index) const { return successor(index).block(); }
+    BasicBlock*& successorBlock(unsigned index) { return successor(index).block(); }
+    SuccessorCollection<BasicBlock, SuccessorList> successorBlocks()
+    {
+        return SuccessorCollection<BasicBlock, SuccessorList>(successors());
+    }
+    SuccessorCollection<const BasicBlock, const SuccessorList> successorBlocks() const
+    {
+        return SuccessorCollection<const BasicBlock, const SuccessorList>(successors());
+    }
+
+    bool replaceSuccessor(BasicBlock* from, BasicBlock* to);
+    
+    // This is only valid for Jump and Branch.
+    const FrequentedBlock& taken() const;
+    FrequentedBlock& taken();
+    // This is only valid for Branch.
+    const FrequentedBlock& notTaken() const;
+    FrequentedBlock& notTaken();
+    // This is only valid for Branch and Switch.
+    const FrequentedBlock& fallThrough() const;
+    FrequentedBlock& fallThrough();
+
+    unsigned numPredecessors() const { return m_predecessors.size(); }
+    BasicBlock* predecessor(unsigned index) const { return m_predecessors[index]; }
+    BasicBlock*& predecessor(unsigned index) { return m_predecessors[index]; }
+    const PredecessorList& predecessors() const { return m_predecessors; }
+    PredecessorList& predecessors() { return m_predecessors; }
+    bool containsPredecessor(BasicBlock* block) { return m_predecessors.contains(block); }
+
+    bool addPredecessor(BasicBlock*);
+    bool removePredecessor(BasicBlock*);
+    bool replacePredecessor(BasicBlock* from, BasicBlock* to);
+
+    // Update predecessors starting with the successors of this block.
+    void updatePredecessorsAfter();
+
+    double frequency() const { return m_frequency; }
+
+    void dump(PrintStream&) const;
+    void deepDump(const Procedure&, PrintStream&) const;
+
+    // These are deprecated method for compatibility with the old ControlValue class. Don't use them
+    // in new code.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=159440
+    
+    // Use this for Oops.
+    JS_EXPORT_PRIVATE Value* appendNewControlValue(Procedure&, Opcode, Origin);
+    // Use this for Return.
+    JS_EXPORT_PRIVATE Value* appendNewControlValue(Procedure&, Opcode, Origin, Value*);
+    // Use this for Jump.
+    JS_EXPORT_PRIVATE Value* appendNewControlValue(Procedure&, Opcode, Origin, const FrequentedBlock&);
+    // Use this for Branch.
+    JS_EXPORT_PRIVATE Value* appendNewControlValue(Procedure&, Opcode, Origin, Value*, const FrequentedBlock&, const FrequentedBlock&);
+    
+private:
+    friend class BlockInsertionSet;
+    friend class InsertionSet;
+    friend class Procedure;
+    
+    // Instantiate via Procedure.
+    BasicBlock(unsigned index, double frequency);
+
+    unsigned m_index;
+    ValueList m_values;
+    PredecessorList m_predecessors;
+    SuccessorList m_successors;
+    double m_frequency;
+};
+
+class DeepBasicBlockDump {
+public:
+    DeepBasicBlockDump(const Procedure& proc, const BasicBlock* block)
+        : m_proc(proc)
+        , m_block(block)
+    {
+    }
+
+    void dump(PrintStream& out) const
+    {
+        if (m_block)
+            m_block->deepDump(m_proc, out);
+        else
+            out.print("<null>");
+    }
+
+private:
+    const Procedure& m_proc;
+    const BasicBlock* m_block;
+};
+
+inline DeepBasicBlockDump deepDump(const Procedure& proc, const BasicBlock* block)
+{
+    return DeepBasicBlockDump(proc, block);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3BasicBlockInlines.h b/b3/B3BasicBlockInlines.h
new file mode 100644
index 0000000..26c2df4
--- /dev/null
+++ b/b3/B3BasicBlockInlines.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlock.h"
+#include "B3ProcedureInlines.h"
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+template<typename ValueType, typename... Arguments>
+ValueType* BasicBlock::appendNew(Procedure& procedure, Arguments... arguments)
+{
+    ValueType* result = procedure.add<ValueType>(arguments...);
+    append(result);
+    return result;
+}
+
+template<typename ValueType, typename... Arguments>
+ValueType* BasicBlock::appendNewNonTerminal(Procedure& procedure, Arguments... arguments)
+{
+    ValueType* result = procedure.add<ValueType>(arguments...);
+    appendNonTerminal(result);
+    return result;
+}
+
+template<typename ValueType, typename... Arguments>
+ValueType* BasicBlock::replaceLastWithNew(Procedure& procedure, Arguments... arguments)
+{
+    ValueType* result = procedure.add<ValueType>(arguments...);
+    replaceLast(procedure, result);
+    return result;
+}
+
+inline const FrequentedBlock& BasicBlock::taken() const
+{
+    ASSERT(last()->opcode() == Jump || last()->opcode() == Branch);
+    return m_successors[0];
+}
+
+inline FrequentedBlock& BasicBlock::taken()
+{
+    ASSERT(last()->opcode() == Jump || last()->opcode() == Branch);
+    return m_successors[0];
+}
+
+inline const FrequentedBlock& BasicBlock::notTaken() const
+{
+    ASSERT(last()->opcode() == Branch);
+    return m_successors[1];
+}
+
+inline FrequentedBlock& BasicBlock::notTaken()
+{
+    ASSERT(last()->opcode() == Branch);
+    return m_successors[1];
+}
+
+inline const FrequentedBlock& BasicBlock::fallThrough() const
+{
+    ASSERT(last()->opcode() == Branch || last()->opcode() == Switch);
+    return m_successors.last();
+}
+
+inline FrequentedBlock& BasicBlock::fallThrough()
+{
+    ASSERT(last()->opcode() == Branch || last()->opcode() == Switch);
+    return m_successors.last();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3BasicBlockUtils.h b/b3/B3BasicBlockUtils.h
new file mode 100644
index 0000000..e5998c8
--- /dev/null
+++ b/b3/B3BasicBlockUtils.h
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/GraphNodeWorklist.h>
+#include <wtf/IndexSet.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+template<typename BasicBlock>
+bool addPredecessor(BasicBlock* block, BasicBlock* predecessor)
+{
+    auto& predecessors = block->predecessors();
+
+    if (predecessors.contains(predecessor))
+        return false;
+
+    predecessors.append(predecessor);
+    return true;
+}
+
+template<typename BasicBlock>
+bool removePredecessor(BasicBlock* block, BasicBlock* predecessor)
+{
+    auto& predecessors = block->predecessors();
+    for (unsigned i = 0; i < predecessors.size(); ++i) {
+        if (predecessors[i] == predecessor) {
+            predecessors[i--] = predecessors.last();
+            predecessors.removeLast();
+            ASSERT(!predecessors.contains(predecessor));
+            return true;
+        }
+    }
+    return false;
+}
+
+template<typename BasicBlock>
+bool replacePredecessor(BasicBlock* block, BasicBlock* from, BasicBlock* to)
+{
+    bool changed = false;
+    // We do it this way because 'to' may already be a predecessor of 'block'.
+    changed |= removePredecessor(block, from);
+    changed |= addPredecessor(block, to);
+    return changed;
+}
+
+template<typename BasicBlock>
+void updatePredecessorsAfter(BasicBlock* root)
+{
+    Vector<BasicBlock*, 16> worklist;
+    worklist.append(root);
+    while (!worklist.isEmpty()) {
+        BasicBlock* block = worklist.takeLast();
+        for (BasicBlock* successor : block->successorBlocks()) {
+            if (addPredecessor(successor, block))
+                worklist.append(successor);
+        }
+    }
+}
+
+template<typename BasicBlock>
+void clearPredecessors(Vector<std::unique_ptr<BasicBlock>>& blocks)
+{
+    for (auto& block : blocks) {
+        if (block)
+            block->predecessors().resize(0);
+    }
+}
+
+template<typename BasicBlock>
+void recomputePredecessors(Vector<std::unique_ptr<BasicBlock>>& blocks)
+{
+    clearPredecessors(blocks);
+    updatePredecessorsAfter(blocks[0].get());
+}
+
+template<typename BasicBlock>
+bool isBlockDead(BasicBlock* block)
+{
+    if (!block)
+        return false;
+    if (!block->index())
+        return false;
+    return block->predecessors().isEmpty();
+}
+
+template<typename BasicBlock>
+Vector<BasicBlock*> blocksInPreOrder(BasicBlock* root)
+{
+    Vector<BasicBlock*> result;
+    GraphNodeWorklist<BasicBlock*, IndexSet<BasicBlock>> worklist;
+    worklist.push(root);
+    while (BasicBlock* block = worklist.pop()) {
+        result.append(block);
+        for (BasicBlock* successor : block->successorBlocks())
+            worklist.push(successor);
+    }
+    return result;
+}
+
+template<typename BasicBlock>
+Vector<BasicBlock*> blocksInPostOrder(BasicBlock* root)
+{
+    Vector<BasicBlock*> result;
+    PostOrderGraphNodeWorklist<BasicBlock*, IndexSet<BasicBlock>> worklist;
+    worklist.push(root);
+    while (GraphNodeWithOrder<BasicBlock*> item = worklist.pop()) {
+        switch (item.order) {
+        case GraphVisitOrder::Pre:
+            worklist.pushPost(item.node);
+            for (BasicBlock* successor : item.node->successorBlocks())
+                worklist.push(successor);
+            break;
+        case GraphVisitOrder::Post:
+            result.append(item.node);
+            break;
+        }
+    }
+    return result;
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3BlockInsertionSet.cpp b/b3/B3BlockInsertionSet.cpp
new file mode 100644
index 0000000..76a1668
--- /dev/null
+++ b/b3/B3BlockInsertionSet.cpp
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3BlockInsertionSet.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3InsertionSet.h"
+#include "B3ProcedureInlines.h"
+#include <wtf/BubbleSort.h>
+
+namespace JSC { namespace B3 {
+
+BlockInsertionSet::BlockInsertionSet(Procedure &proc)
+    : m_proc(proc)
+{
+}
+
+BlockInsertionSet::~BlockInsertionSet() { }
+
+void BlockInsertionSet::insert(BlockInsertion&& insertion)
+{
+    m_insertions.append(WTFMove(insertion));
+}
+
+BasicBlock* BlockInsertionSet::insert(unsigned index, double frequency)
+{
+    std::unique_ptr<BasicBlock> block(new BasicBlock(UINT_MAX, frequency));
+    BasicBlock* result = block.get();
+    insert(BlockInsertion(index, WTFMove(block)));
+    return result;
+}
+
+BasicBlock* BlockInsertionSet::insertBefore(BasicBlock* before, double frequency)
+{
+    return insert(before->index(), frequency == frequency ? frequency : before->frequency());
+}
+
+BasicBlock* BlockInsertionSet::insertAfter(BasicBlock* after, double frequency)
+{
+    return insert(after->index() + 1, frequency == frequency ? frequency : after->frequency());
+}
+
+BasicBlock* BlockInsertionSet::splitForward(
+    BasicBlock* block, unsigned& valueIndex, InsertionSet* insertionSet, double frequency)
+{
+    Value* value = block->at(valueIndex);
+
+    // Create a new block that will go just before 'block', and make it contain everything prior
+    // to 'valueIndex'.
+    BasicBlock* result = insertBefore(block, frequency);
+    result->m_values.resize(valueIndex + 1);
+    for (unsigned i = valueIndex; i--;)
+        result->m_values[i] = block->m_values[i];
+
+    // Make the new block jump to 'block'.
+    result->m_values[valueIndex] = m_proc.add<Value>(Jump, value->origin());
+    result->setSuccessors(FrequentedBlock(block));
+
+    // If we had inserted things into 'block' before this, execute those insertions now.
+    if (insertionSet)
+        insertionSet->execute(result);
+
+    // Remove everything prior to 'valueIndex' from 'block', since those things are now in the
+    // new block.
+    block->m_values.remove(0, valueIndex);
+
+    // This is being used in a forward loop over 'block'. Update the index of the loop so that
+    // it can continue to the next block.
+    valueIndex = 0;
+
+    // Fixup the predecessors of 'block'. They now must jump to the new block.
+    result->predecessors() = WTFMove(block->predecessors());
+    block->addPredecessor(result);
+    for (BasicBlock* predecessor : result->predecessors())
+        predecessor->replaceSuccessor(block, result);
+
+    return result;
+}
+
+bool BlockInsertionSet::execute()
+{
+    if (m_insertions.isEmpty())
+        return false;
+    
+    // We allow insertions to be given to us in any order. So, we need to sort them before
+    // running WTF::executeInsertions. We strongly prefer a stable sort and we want it to be
+    // fast, so we use bubble sort.
+    bubbleSort(m_insertions.begin(), m_insertions.end());
+
+    executeInsertions(m_proc.m_blocks, m_insertions);
+    
+    // Prune out empty entries. This isn't strictly necessary but it's
+    // healthy to keep the block list from growing.
+    m_proc.m_blocks.removeAllMatching(
+        [&] (std::unique_ptr<BasicBlock>& blockPtr) -> bool {
+            return !blockPtr;
+        });
+    
+    // Make sure that the blocks know their new indices.
+    for (unsigned i = 0; i < m_proc.m_blocks.size(); ++i)
+        m_proc.m_blocks[i]->m_index = i;
+    
+    return true;
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3BlockInsertionSet.h b/b3/B3BlockInsertionSet.h
new file mode 100644
index 0000000..b316f64
--- /dev/null
+++ b/b3/B3BlockInsertionSet.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Procedure.h"
+#include <wtf/Insertion.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class InsertionSet;
+
+typedef WTF::Insertion<std::unique_ptr<BasicBlock>> BlockInsertion;
+
+class BlockInsertionSet {
+public:
+    BlockInsertionSet(Procedure&);
+    ~BlockInsertionSet();
+    
+    void insert(BlockInsertion&&);
+
+    // Insert a new block at a given index.
+    BasicBlock* insert(unsigned index, double frequency = PNaN);
+
+    // Inserts a new block before the given block. Usually you will not pass the frequency
+    // argument. Passing PNaN causes us to just use the frequency of the 'before' block. That's
+    // usually what you want.
+    BasicBlock* insertBefore(BasicBlock* before, double frequency = PNaN);
+
+    // Inserts a new block after the given block.
+    BasicBlock* insertAfter(BasicBlock* after, double frequency = PNaN);
+
+    // A helper to split a block when forward iterating over it. It creates a new block to hold
+    // everything before the instruction at valueIndex. The current block is left with
+    // everything at and after valueIndex. If the optional InsertionSet is provided, it will get
+    // executed on the newly created block - this makes sense if you had previously inserted
+    // things into the original block, since the newly created block will be indexed identically
+    // to how this block was indexed for all values prior to valueIndex. After this runs, it sets
+    // valueIndex to zero. This allows you to use this method for things like:
+    //
+    // for (unsigned valueIndex = 0; valueIndex < block->size(); ++valueIndex) {
+    //     Value* value = block->at(valueIndex);
+    //     if (value->opcode() == Foo) {
+    //         BasicBlock* predecessor =
+    //             m_blockInsertionSet.splitForward(block, valueIndex, &m_insertionSet);
+    //         ... // Now you can append to predecessor, insert new blocks before 'block', and
+    //         ... // you can use m_insertionSet to insert more thing before 'value'.
+    //         predecessor->updatePredecessorsAfter();
+    //     }
+    // }
+    //
+    // Note how usually this idiom ends in a all to updatePredecessorsAftter(), which ensures
+    // that the predecessors involved in any of the new control flow that you've created are up
+    // to date.
+    BasicBlock* splitForward(
+        BasicBlock*, unsigned& valueIndex, InsertionSet* = nullptr,
+        double frequency = PNaN);
+    
+    bool execute();
+
+private:
+    Procedure& m_proc;
+    Vector<BlockInsertion, 8> m_insertions;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3BlockWorklist.h b/b3/B3BlockWorklist.h
new file mode 100644
index 0000000..6fa197c
--- /dev/null
+++ b/b3/B3BlockWorklist.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/GraphNodeWorklist.h>
+#include <wtf/IndexSet.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class BasicBlock;
+
+typedef GraphNodeWorklist<BasicBlock*, IndexSet<BasicBlock>> BlockWorklist;
+
+// When you say BlockWith<int> you should read it as "block with an int".
+template<typename T> using BlockWith = GraphNodeWith<BasicBlock*, T>;
+
+// Extended block worklist is useful for enqueueing some meta-data along with the block. It also
+// permits forcibly enqueueing things even if the block has already been seen. It's useful for
+// things like building a spanning tree, in which case T (the auxiliary payload) would be the
+// successor index.
+template<typename T> using ExtendedBlockWorklist = ExtendedGraphNodeWorklist<BasicBlock*, T, IndexSet<BasicBlock>>;
+
+typedef GraphVisitOrder VisitOrder;
+
+typedef GraphNodeWithOrder<BasicBlock*> BlockWithOrder;
+
+typedef PostOrderGraphNodeWorklist<BasicBlock*, IndexSet<BasicBlock>> PostOrderBlockWorklist;
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3BottomProvider.h b/b3/B3BottomProvider.h
new file mode 100644
index 0000000..9a977f0
--- /dev/null
+++ b/b3/B3BottomProvider.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3InsertionSet.h"
+
+namespace JSC { namespace B3 {
+
+// This exists because we cannot convert values to constants in-place.
+// FIXME: https://bugs.webkit.org/show_bug.cgi?id=159119
+
+class BottomProvider {
+public:
+    BottomProvider(InsertionSet& insertionSet, size_t index)
+        : m_insertionSet(&insertionSet)
+        , m_index(index)
+    {
+    }
+    
+    Value* operator()(Origin origin, Type type) const
+    {
+        return m_insertionSet->insertBottom(m_index, origin, type);
+    }
+    
+private:
+    InsertionSet* m_insertionSet;
+    size_t m_index;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3BreakCriticalEdges.cpp b/b3/B3BreakCriticalEdges.cpp
new file mode 100644
index 0000000..abdf0ce
--- /dev/null
+++ b/b3/B3BreakCriticalEdges.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3BreakCriticalEdges.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3BlockInsertionSet.h"
+#include "B3ProcedureInlines.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+void breakCriticalEdges(Procedure& proc)
+{
+    BlockInsertionSet insertionSet(proc);
+    
+    for (BasicBlock* block : proc) {
+        if (block->numSuccessors() <= 1)
+            continue;
+
+        for (BasicBlock*& successor : block->successorBlocks()) {
+            if (successor->numPredecessors() <= 1)
+                continue;
+
+            BasicBlock* pad =
+                insertionSet.insertBefore(successor, successor->frequency());
+            pad->appendNew<Value>(proc, Jump, successor->at(0)->origin());
+            pad->setSuccessors(FrequentedBlock(successor));
+            pad->addPredecessor(block);
+            successor->replacePredecessor(block, pad);
+            successor = pad;
+        }
+    }
+
+    insertionSet.execute();
+    proc.invalidateCFG();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3BreakCriticalEdges.h b/b3/B3BreakCriticalEdges.h
new file mode 100644
index 0000000..75c324f
--- /dev/null
+++ b/b3/B3BreakCriticalEdges.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+void breakCriticalEdges(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3CCallValue.cpp b/b3/B3CCallValue.cpp
new file mode 100644
index 0000000..518d723
--- /dev/null
+++ b/b3/B3CCallValue.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3CCallValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+CCallValue::~CCallValue()
+{
+}
+
+Value* CCallValue::cloneImpl() const
+{
+    return new CCallValue(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3CCallValue.h b/b3/B3CCallValue.h
new file mode 100644
index 0000000..44ec349
--- /dev/null
+++ b/b3/B3CCallValue.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Effects.h"
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE CCallValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == CCall; }
+
+    ~CCallValue();
+
+    Effects effects;
+
+protected:
+    Value* cloneImpl() const override;
+    
+private:
+    friend class Procedure;
+
+    template<typename... Arguments>
+    CCallValue(Type type, Origin origin, Arguments... arguments)
+        : Value(CheckedOpcode, CCall, type, origin, arguments...)
+        , effects(Effects::forCall())
+    {
+        RELEASE_ASSERT(numChildren() >= 1);
+    }
+
+    template<typename... Arguments>
+    CCallValue(Type type, Origin origin, const Effects& effects, Arguments... arguments)
+        : Value(CheckedOpcode, CCall, type, origin, arguments...)
+        , effects(effects)
+    {
+        RELEASE_ASSERT(numChildren() >= 1);
+    }
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3CFG.h b/b3/B3CFG.h
new file mode 100644
index 0000000..3d1418e
--- /dev/null
+++ b/b3/B3CFG.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlock.h"
+#include "B3Procedure.h"
+#include <wtf/IndexMap.h>
+#include <wtf/IndexSet.h>
+
+namespace JSC { namespace B3 {
+
+class CFG {
+    WTF_MAKE_NONCOPYABLE(CFG);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    typedef BasicBlock* Node;
+    typedef IndexSet<BasicBlock> Set;
+    template<typename T> using Map = IndexMap<BasicBlock, T>;
+    typedef Vector<BasicBlock*, 4> List;
+
+    CFG(Procedure& proc)
+        : m_proc(proc)
+    {
+    }
+
+    Node root() { return m_proc[0]; }
+
+    template<typename T>
+    Map<T> newMap() { return IndexMap<JSC::B3::BasicBlock, T>(m_proc.size()); }
+
+    SuccessorCollection<BasicBlock, BasicBlock::SuccessorList> successors(Node node) { return node->successorBlocks(); }
+    BasicBlock::PredecessorList& predecessors(Node node) { return node->predecessors(); }
+
+    unsigned index(Node node) const { return node->index(); }
+    Node node(unsigned index) const { return m_proc[index]; }
+    unsigned numNodes() const { return m_proc.size(); }
+
+    PointerDump<BasicBlock> dump(Node node) const { return pointerDump(node); }
+
+    void dump(PrintStream& out) const
+    {
+        m_proc.dump(out);
+    }
+
+private:
+    Procedure& m_proc;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3CaseCollection.cpp b/b3/B3CaseCollection.cpp
new file mode 100644
index 0000000..5221eba
--- /dev/null
+++ b/b3/B3CaseCollection.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3CaseCollection.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3CaseCollectionInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC { namespace B3 {
+
+void CaseCollection::dump(PrintStream& out) const
+{
+    CommaPrinter comma;
+    for (SwitchCase switchCase : *this)
+        out.print(comma, switchCase);
+    out.print(comma, "default->", fallThrough());
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3CaseCollection.h b/b3/B3CaseCollection.h
new file mode 100644
index 0000000..c45cc64
--- /dev/null
+++ b/b3/B3CaseCollection.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3SwitchCase.h"
+
+namespace JSC { namespace B3 {
+
+class BasicBlock;
+class SwitchValue;
+
+// NOTE: You'll always want to include B3CaseCollectionInlines.h when you use this.
+
+class CaseCollection {
+public:
+    CaseCollection()
+    {
+    }
+    
+    CaseCollection(const SwitchValue* terminal, const BasicBlock* owner)
+        : m_switch(terminal)
+        , m_owner(owner)
+    {
+    }
+    
+    const FrequentedBlock& fallThrough() const;
+
+    unsigned size() const;
+    SwitchCase at(unsigned index) const;
+    
+    SwitchCase operator[](unsigned index) const
+    {
+        return at(index);
+    }
+
+    class iterator {
+    public:
+        iterator()
+            : m_collection(nullptr)
+            , m_index(0)
+        {
+        }
+
+        iterator(const CaseCollection& collection, unsigned index)
+            : m_collection(&collection)
+            , m_index(index)
+        {
+        }
+
+        SwitchCase operator*()
+        {
+            return m_collection->at(m_index);
+        }
+
+        iterator& operator++()
+        {
+            m_index++;
+            return *this;
+        }
+
+        bool operator==(const iterator& other) const
+        {
+            ASSERT(m_collection == other.m_collection);
+            return m_index == other.m_index;
+        }
+
+        bool operator!=(const iterator& other) const
+        {
+            return !(*this == other);
+        }
+
+    private:
+        const CaseCollection* m_collection;
+        unsigned m_index;
+    };
+
+    typedef iterator const_iterator;
+
+    iterator begin() const { return iterator(*this, 0); }
+    iterator end() const { return iterator(*this, size()); }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    const SwitchValue* m_switch { nullptr };
+    const BasicBlock* m_owner { nullptr };
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3CaseCollectionInlines.h b/b3/B3CaseCollectionInlines.h
new file mode 100644
index 0000000..237a568
--- /dev/null
+++ b/b3/B3CaseCollectionInlines.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3CaseCollection.h"
+#include "B3SwitchValue.h"
+#include "B3BasicBlock.h"
+
+namespace JSC { namespace B3 {
+
+inline const FrequentedBlock& CaseCollection::fallThrough() const
+{
+    return m_owner->fallThrough();
+}
+
+inline unsigned CaseCollection::size() const
+{
+    return m_switch->numCaseValues();
+}
+
+inline SwitchCase CaseCollection::at(unsigned index) const
+{
+    return SwitchCase(m_switch->caseValue(index), m_owner->successor(index));
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3CheckSpecial.cpp b/b3/B3CheckSpecial.cpp
new file mode 100644
index 0000000..6f7826c
--- /dev/null
+++ b/b3/B3CheckSpecial.cpp
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3CheckSpecial.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirGenerationContext.h"
+#include "AirInstInlines.h"
+#include "B3StackmapGenerationParams.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+using namespace Air;
+
+namespace {
+
+unsigned numB3Args(B3::Kind kind)
+{
+    switch (kind.opcode()) {
+    case CheckAdd:
+    case CheckSub:
+    case CheckMul:
+        return 2;
+    case Check:
+        return 1;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+unsigned numB3Args(Value* value)
+{
+    return numB3Args(value->kind());
+}
+
+unsigned numB3Args(Inst& inst)
+{
+    return numB3Args(inst.origin);
+}
+
+} // anonymous namespace
+
+CheckSpecial::Key::Key(const Inst& inst)
+{
+    m_kind = inst.kind;
+    m_numArgs = inst.args.size();
+    m_stackmapRole = SameAsRep;
+}
+
+void CheckSpecial::Key::dump(PrintStream& out) const
+{
+    out.print(m_kind, "(", m_numArgs, ",", m_stackmapRole, ")");
+}
+
+CheckSpecial::CheckSpecial(Air::Kind kind, unsigned numArgs, RoleMode stackmapRole)
+    : m_checkKind(kind)
+    , m_stackmapRole(stackmapRole)
+    , m_numCheckArgs(numArgs)
+{
+    ASSERT(isDefinitelyTerminal(kind.opcode));
+}
+
+CheckSpecial::CheckSpecial(const CheckSpecial::Key& key)
+    : CheckSpecial(key.kind(), key.numArgs(), key.stackmapRole())
+{
+}
+
+CheckSpecial::~CheckSpecial()
+{
+}
+
+Inst CheckSpecial::hiddenBranch(const Inst& inst) const
+{
+    Inst hiddenBranch(m_checkKind, inst.origin);
+    hiddenBranch.args.reserveInitialCapacity(m_numCheckArgs);
+    for (unsigned i = 0; i < m_numCheckArgs; ++i)
+        hiddenBranch.args.append(inst.args[i + 1]);
+    ASSERT(hiddenBranch.isTerminal());
+    return hiddenBranch;
+}
+
+void CheckSpecial::forEachArg(Inst& inst, const ScopedLambda<Inst::EachArgCallback>& callback)
+{
+    Inst hidden = hiddenBranch(inst);
+    hidden.forEachArg(
+        [&] (Arg& arg, Arg::Role role, Arg::Type type, Arg::Width width) {
+            unsigned index = &arg - &hidden.args[0];
+            callback(inst.args[1 + index], role, type, width);
+        });
+
+    std::optional<unsigned> firstRecoverableIndex;
+    if (m_checkKind.opcode == BranchAdd32 || m_checkKind.opcode == BranchAdd64)
+        firstRecoverableIndex = 1;
+    forEachArgImpl(numB3Args(inst), m_numCheckArgs + 1, inst, m_stackmapRole, firstRecoverableIndex, callback);
+}
+
+bool CheckSpecial::isValid(Inst& inst)
+{
+    return hiddenBranch(inst).isValidForm()
+        && isValidImpl(numB3Args(inst), m_numCheckArgs + 1, inst)
+        && inst.args.size() - m_numCheckArgs - 1 == inst.origin->numChildren() - numB3Args(inst);
+}
+
+bool CheckSpecial::admitsStack(Inst& inst, unsigned argIndex)
+{
+    if (argIndex >= 1 && argIndex < 1 + m_numCheckArgs)
+        return hiddenBranch(inst).admitsStack(argIndex - 1);
+    return admitsStackImpl(numB3Args(inst), m_numCheckArgs + 1, inst, argIndex);
+}
+
+std::optional<unsigned> CheckSpecial::shouldTryAliasingDef(Inst& inst)
+{
+    if (std::optional<unsigned> branchDef = hiddenBranch(inst).shouldTryAliasingDef())
+        return *branchDef + 1;
+    return std::nullopt;
+}
+
+CCallHelpers::Jump CheckSpecial::generate(Inst& inst, CCallHelpers& jit, GenerationContext& context)
+{
+    CCallHelpers::Jump fail = hiddenBranch(inst).generate(jit, context);
+    ASSERT(fail.isSet());
+
+    StackmapValue* value = inst.origin->as<StackmapValue>();
+    ASSERT(value);
+
+    Vector<ValueRep> reps = repsImpl(context, numB3Args(inst), m_numCheckArgs + 1, inst);
+
+    // Set aside the args that are relevant to undoing the operation. This is because we don't want to
+    // capture all of inst in the closure below.
+    Vector<Arg, 3> args;
+    for (unsigned i = 0; i < m_numCheckArgs; ++i)
+        args.append(inst.args[1 + i]);
+
+    context.latePaths.append(
+        createSharedTask<GenerationContext::LatePathFunction>(
+            [=] (CCallHelpers& jit, GenerationContext& context) {
+                fail.link(&jit);
+
+                // If necessary, undo the operation.
+                switch (m_checkKind.opcode) {
+                case BranchAdd32:
+                    if ((m_numCheckArgs == 4 && args[1] == args[2] && args[2] == args[3])
+                        || (m_numCheckArgs == 3 && args[1] == args[2])) {
+                        // This is ugly, but that's fine - we won't have to do this very often.
+                        ASSERT(args[1].isGPR());
+                        GPRReg valueGPR = args[1].gpr();
+                        GPRReg scratchGPR = CCallHelpers::selectScratchGPR(valueGPR);
+                        jit.pushToSave(scratchGPR);
+                        jit.setCarry(scratchGPR);
+                        jit.lshift32(CCallHelpers::TrustedImm32(31), scratchGPR);
+                        jit.urshift32(CCallHelpers::TrustedImm32(1), valueGPR);
+                        jit.or32(scratchGPR, valueGPR);
+                        jit.popToRestore(scratchGPR);
+                        break;
+                    }
+                    if (m_numCheckArgs == 4) {
+                        if (args[1] == args[3])
+                            Inst(Sub32, nullptr, args[2], args[3]).generate(jit, context);
+                        else if (args[2] == args[3])
+                            Inst(Sub32, nullptr, args[1], args[3]).generate(jit, context);
+                    } else if (m_numCheckArgs == 3)
+                        Inst(Sub32, nullptr, args[1], args[2]).generate(jit, context);
+                    break;
+                case BranchAdd64:
+                    if ((m_numCheckArgs == 4 && args[1] == args[2] && args[2] == args[3])
+                        || (m_numCheckArgs == 3 && args[1] == args[2])) {
+                        // This is ugly, but that's fine - we won't have to do this very often.
+                        ASSERT(args[1].isGPR());
+                        GPRReg valueGPR = args[1].gpr();
+                        GPRReg scratchGPR = CCallHelpers::selectScratchGPR(valueGPR);
+                        jit.pushToSave(scratchGPR);
+                        jit.setCarry(scratchGPR);
+                        jit.lshift64(CCallHelpers::TrustedImm32(63), scratchGPR);
+                        jit.urshift64(CCallHelpers::TrustedImm32(1), valueGPR);
+                        jit.or64(scratchGPR, valueGPR);
+                        jit.popToRestore(scratchGPR);
+                        break;
+                    }
+                    if (m_numCheckArgs == 4) {
+                        if (args[1] == args[3])
+                            Inst(Sub64, nullptr, args[2], args[3]).generate(jit, context);
+                        else if (args[2] == args[3])
+                            Inst(Sub64, nullptr, args[1], args[3]).generate(jit, context);
+                    } else if (m_numCheckArgs == 3)
+                        Inst(Sub64, nullptr, args[1], args[2]).generate(jit, context);
+                    break;
+                case BranchSub32:
+                    Inst(Add32, nullptr, args[1], args[2]).generate(jit, context);
+                    break;
+                case BranchSub64:
+                    Inst(Add64, nullptr, args[1], args[2]).generate(jit, context);
+                    break;
+                case BranchNeg32:
+                    Inst(Neg32, nullptr, args[1]).generate(jit, context);
+                    break;
+                case BranchNeg64:
+                    Inst(Neg64, nullptr, args[1]).generate(jit, context);
+                    break;
+                default:
+                    break;
+                }
+                
+                value->m_generator->run(jit, StackmapGenerationParams(value, reps, context));
+            }));
+
+    return CCallHelpers::Jump(); // As far as Air thinks, we are not a terminal.
+}
+
+void CheckSpecial::dumpImpl(PrintStream& out) const
+{
+    out.print(m_checkKind, "(", m_numCheckArgs, ",", m_stackmapRole, ")");
+}
+
+void CheckSpecial::deepDumpImpl(PrintStream& out) const
+{
+    out.print("B3::CheckValue lowered to ", m_checkKind, " with ", m_numCheckArgs, " args.");
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3CheckSpecial.h b/b3/B3CheckSpecial.h
new file mode 100644
index 0000000..aa7f2fe
--- /dev/null
+++ b/b3/B3CheckSpecial.h
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "AirKind.h"
+#include "B3StackmapSpecial.h"
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace B3 {
+
+namespace Air {
+struct Inst;
+}
+
+// We want to lower Check instructions to a branch, but then we want to route that branch to our
+// out-of-line code instead of doing anything else. For this reason, a CheckSpecial will remember
+// which branch opcode we have selected along with the number of args in the overload we want. It
+// will create an Inst with that opcode plus the appropriate args from the owning Inst whenever you
+// call any of the callbacks.
+//
+// Note that for CheckAdd, CheckSub, and CheckMul we expect that the B3 arguments are the reverse
+// of the Air arguments (Add(a, b) => Add32 b, a). Except:
+// - CheckSub(0, x), which turns into BranchNeg32 x.
+// - CheckMul(a, b), which turns into Mul32 b, a but we pass Any for a's ValueRep.
+
+class CheckSpecial : public StackmapSpecial {
+public:
+    // Support for hash consing these things.
+    class Key {
+    public:
+        Key()
+            : m_stackmapRole(SameAsRep)
+            , m_numArgs(0)
+        {
+        }
+        
+        Key(Air::Kind kind, unsigned numArgs, RoleMode stackmapRole = SameAsRep)
+            : m_kind(kind)
+            , m_stackmapRole(stackmapRole)
+            , m_numArgs(numArgs)
+        {
+        }
+
+        explicit Key(const Air::Inst&);
+
+        bool operator==(const Key& other) const
+        {
+            return m_kind == other.m_kind
+                && m_numArgs == other.m_numArgs
+                && m_stackmapRole == other.m_stackmapRole;
+        }
+
+        bool operator!=(const Key& other) const
+        {
+            return !(*this == other);
+        }
+
+        explicit operator bool() const { return *this != Key(); }
+
+        Air::Kind kind() const { return m_kind; }
+        unsigned numArgs() const { return m_numArgs; }
+        RoleMode stackmapRole() const { return m_stackmapRole; }
+
+        void dump(PrintStream& out) const;
+
+        Key(WTF::HashTableDeletedValueType)
+            : m_stackmapRole(SameAsRep)
+            , m_numArgs(1)
+        {
+        }
+
+        bool isHashTableDeletedValue() const
+        {
+            return *this == Key(WTF::HashTableDeletedValue);
+        }
+
+        unsigned hash() const
+        {
+            // Seriously, we don't need to be smart here. It just doesn't matter.
+            return m_kind.hash() + m_numArgs + m_stackmapRole;
+        }
+        
+    private:
+        Air::Kind m_kind;
+        RoleMode m_stackmapRole;
+        unsigned m_numArgs;
+    };
+    
+    CheckSpecial(Air::Kind, unsigned numArgs, RoleMode stackmapRole = SameAsRep);
+    CheckSpecial(const Key&);
+    ~CheckSpecial();
+
+protected:
+    // Constructs and returns the Inst representing the branch that this will use.
+    Air::Inst hiddenBranch(const Air::Inst&) const;
+
+    void forEachArg(Air::Inst&, const ScopedLambda<Air::Inst::EachArgCallback>&) override;
+    bool isValid(Air::Inst&) override;
+    bool admitsStack(Air::Inst&, unsigned argIndex) override;
+    std::optional<unsigned> shouldTryAliasingDef(Air::Inst&) override;
+
+    // NOTE: the generate method will generate the hidden branch and then register a LatePath that
+    // generates the stackmap. Super crazy dude!
+
+    CCallHelpers::Jump generate(Air::Inst&, CCallHelpers&, Air::GenerationContext&) override;
+
+    void dumpImpl(PrintStream&) const override;
+    void deepDumpImpl(PrintStream&) const override;
+
+private:
+    Air::Kind m_checkKind;
+    RoleMode m_stackmapRole;
+    unsigned m_numCheckArgs;
+};
+
+struct CheckSpecialKeyHash {
+    static unsigned hash(const CheckSpecial::Key& key) { return key.hash(); }
+    static bool equal(const CheckSpecial::Key& a, const CheckSpecial::Key& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::B3::CheckSpecial::Key> {
+    typedef JSC::B3::CheckSpecialKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::B3::CheckSpecial::Key> : SimpleClassHashTraits<JSC::B3::CheckSpecial::Key> {
+    // I don't want to think about this very hard, it's not worth it. I'm a be conservative.
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3CheckValue.cpp b/b3/B3CheckValue.cpp
new file mode 100644
index 0000000..79b6c6e
--- /dev/null
+++ b/b3/B3CheckValue.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3CheckValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+CheckValue::~CheckValue()
+{
+}
+
+void CheckValue::convertToAdd()
+{
+    RELEASE_ASSERT(opcode() == CheckAdd || opcode() == CheckSub || opcode() == CheckMul);
+    m_kind = CheckAdd;
+}
+
+Value* CheckValue::cloneImpl() const
+{
+    return new CheckValue(*this);
+}
+
+// Use this form for CheckAdd, CheckSub, and CheckMul.
+CheckValue::CheckValue(Kind kind, Origin origin, Value* left, Value* right)
+    : StackmapValue(CheckedOpcode, kind, left->type(), origin)
+{
+    ASSERT(B3::isInt(type()));
+    ASSERT(left->type() == right->type());
+    ASSERT(kind == CheckAdd || kind == CheckSub || kind == CheckMul);
+    append(ConstrainedValue(left, ValueRep::WarmAny));
+    append(ConstrainedValue(right, ValueRep::WarmAny));
+}
+
+// Use this form for Check.
+CheckValue::CheckValue(Kind kind, Origin origin, Value* predicate)
+    : StackmapValue(CheckedOpcode, kind, Void, origin)
+{
+    ASSERT(kind == Check);
+    append(ConstrainedValue(predicate, ValueRep::WarmAny));
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3CheckValue.h b/b3/B3CheckValue.h
new file mode 100644
index 0000000..e3d94ba
--- /dev/null
+++ b/b3/B3CheckValue.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3StackmapValue.h"
+
+namespace JSC { namespace B3 {
+
+class CheckValue : public StackmapValue {
+public:
+    static bool accepts(Kind kind)
+    {
+        switch (kind.opcode()) {
+        case CheckAdd:
+        case CheckSub:
+        case CheckMul:
+        case Check:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    ~CheckValue();
+
+    void convertToAdd();
+
+protected:
+    Value* cloneImpl() const override;
+    
+private:
+    friend class Procedure;
+
+    // Use this form for CheckAdd, CheckSub, and CheckMul.
+    JS_EXPORT_PRIVATE CheckValue(Kind, Origin, Value* left, Value* right);
+
+    // Use this form for Check.
+    JS_EXPORT_PRIVATE CheckValue(Kind, Origin, Value* predicate);
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Common.cpp b/b3/B3Common.cpp
new file mode 100644
index 0000000..60da362
--- /dev/null
+++ b/b3/B3Common.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Common.h"
+
+#if ENABLE(B3_JIT)
+
+#include "DFGCommon.h"
+#include "FTLState.h"
+#include "Options.h"
+
+namespace JSC { namespace B3 {
+
+bool shouldDumpIR(B3ComplitationMode mode)
+{
+#if ENABLE(FTL_JIT)
+    return FTL::verboseCompilationEnabled() || FTL::shouldDumpDisassembly() || shouldDumpIRAtEachPhase(mode);
+#else
+    return shouldDumpIRAtEachPhase(mode);
+#endif
+}
+
+bool shouldDumpIRAtEachPhase(B3ComplitationMode mode)
+{
+    if (mode == B3Mode)
+        return Options::dumpGraphAtEachPhase() || Options::dumpB3GraphAtEachPhase();
+    return Options::dumpGraphAtEachPhase() || Options::dumpAirGraphAtEachPhase();
+}
+
+bool shouldValidateIR()
+{
+    return DFG::validationEnabled() || shouldValidateIRAtEachPhase();
+}
+
+bool shouldValidateIRAtEachPhase()
+{
+    return Options::validateGraphAtEachPhase();
+}
+
+bool shouldSaveIRBeforePhase()
+{
+    return Options::verboseValidationFailure();
+}
+
+bool shouldMeasurePhaseTiming()
+{
+    return Options::logB3PhaseTimes();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3Common.h b/b3/B3Common.h
new file mode 100644
index 0000000..41e8ee0
--- /dev/null
+++ b/b3/B3Common.h
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "JSExportMacros.h"
+#include <wtf/Optional.h>
+
+namespace JSC { namespace B3 {
+
+inline bool is64Bit() { return sizeof(void*) == 8; }
+inline bool is32Bit() { return !is64Bit(); }
+
+enum B3ComplitationMode {
+    B3Mode,
+    AirMode
+};
+
+JS_EXPORT_PRIVATE bool shouldDumpIR(B3ComplitationMode);
+bool shouldDumpIRAtEachPhase(B3ComplitationMode);
+bool shouldValidateIR();
+bool shouldValidateIRAtEachPhase();
+bool shouldSaveIRBeforePhase();
+bool shouldMeasurePhaseTiming();
+
+template<typename BitsType, typename InputType>
+inline bool isIdentical(InputType left, InputType right)
+{
+    BitsType leftBits = bitwise_cast<BitsType>(left);
+    BitsType rightBits = bitwise_cast<BitsType>(right);
+    return leftBits == rightBits;
+}
+
+inline bool isIdentical(int32_t left, int32_t right)
+{
+    return isIdentical<int32_t>(left, right);
+}
+
+inline bool isIdentical(int64_t left, int64_t right)
+{
+    return isIdentical<int64_t>(left, right);
+}
+
+inline bool isIdentical(double left, double right)
+{
+    return isIdentical<int64_t>(left, right);
+}
+
+inline bool isIdentical(float left, float right)
+{
+    return isIdentical<int32_t>(left, right);
+}
+
+template<typename ResultType, typename InputType, typename BitsType>
+inline bool isRepresentableAsImpl(InputType originalValue)
+{
+    // Convert the original value to the desired result type.
+    ResultType result = static_cast<ResultType>(originalValue);
+
+    // Convert the converted value back to the original type. The original value is representable
+    // using the new type if such round-tripping doesn't lose bits.
+    InputType newValue = static_cast<InputType>(result);
+
+    return isIdentical<BitsType>(originalValue, newValue);
+}
+
+template<typename ResultType>
+inline bool isRepresentableAs(int32_t value)
+{
+    return isRepresentableAsImpl<ResultType, int32_t, int32_t>(value);
+}
+
+template<typename ResultType>
+inline bool isRepresentableAs(int64_t value)
+{
+    return isRepresentableAsImpl<ResultType, int64_t, int64_t>(value);
+}
+
+template<typename ResultType>
+inline bool isRepresentableAs(double value)
+{
+    return isRepresentableAsImpl<ResultType, double, int64_t>(value);
+}
+
+template<typename IntType>
+static IntType chillDiv(IntType numerator, IntType denominator)
+{
+    if (!denominator)
+        return 0;
+    if (denominator == -1 && numerator == std::numeric_limits<IntType>::min())
+        return std::numeric_limits<IntType>::min();
+    return numerator / denominator;
+}
+
+template<typename IntType>
+static IntType chillMod(IntType numerator, IntType denominator)
+{
+    if (!denominator)
+        return 0;
+    if (denominator == -1 && numerator == std::numeric_limits<IntType>::min())
+        return 0;
+    return numerator % denominator;
+}
+
+template<typename IntType>
+static IntType chillUDiv(IntType numerator, IntType denominator)
+{
+    typedef typename std::make_unsigned<IntType>::type UnsignedIntType;
+    UnsignedIntType unsignedNumerator = static_cast<UnsignedIntType>(numerator);
+    UnsignedIntType unsignedDenominator = static_cast<UnsignedIntType>(denominator);
+    if (!unsignedDenominator)
+        return 0;
+    return unsignedNumerator / unsignedDenominator;
+}
+
+template<typename IntType>
+static IntType chillUMod(IntType numerator, IntType denominator)
+{
+    typedef typename std::make_unsigned<IntType>::type UnsignedIntType;
+    UnsignedIntType unsignedNumerator = static_cast<UnsignedIntType>(numerator);
+    UnsignedIntType unsignedDenominator = static_cast<UnsignedIntType>(denominator);
+    if (!unsignedDenominator)
+        return 0;
+    return unsignedNumerator % unsignedDenominator;
+}
+
+template<typename IntType>
+static IntType rotateRight(IntType value, int32_t shift)
+{
+    typedef typename std::make_unsigned<IntType>::type UnsignedIntType;
+    UnsignedIntType uValue = static_cast<UnsignedIntType>(value);
+    int32_t bits = sizeof(IntType) * 8;
+    int32_t mask = bits - 1;
+    shift &= mask;
+    return (uValue >> shift) | (uValue << ((bits - shift) & mask));
+}
+
+template<typename IntType>
+static IntType rotateLeft(IntType value, int32_t shift)
+{
+    typedef typename std::make_unsigned<IntType>::type UnsignedIntType;
+    UnsignedIntType uValue = static_cast<UnsignedIntType>(value);
+    int32_t bits = sizeof(IntType) * 8;
+    int32_t mask = bits - 1;
+    shift &= mask;
+    return (uValue << shift) | (uValue >> ((bits - shift) & mask));
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Commutativity.cpp b/b3/B3Commutativity.cpp
new file mode 100644
index 0000000..5de43e6
--- /dev/null
+++ b/b3/B3Commutativity.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Commutativity.h"
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC::B3;
+
+void printInternal(PrintStream& out, Commutativity commutativity)
+{
+    switch (commutativity) {
+    case Commutative:
+        out.print("Commutative");
+        return;
+    case NotCommutative:
+        out.print("NotCommutative");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Commutativity.h b/b3/B3Commutativity.h
new file mode 100644
index 0000000..bf0de75
--- /dev/null
+++ b/b3/B3Commutativity.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+enum Commutativity {
+    Commutative,
+    NotCommutative
+};
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::B3::Commutativity);
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Compilation.cpp b/b3/B3Compilation.cpp
new file mode 100644
index 0000000..9e20a6b
--- /dev/null
+++ b/b3/B3Compilation.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Compilation.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3OpaqueByproducts.h"
+#include "CCallHelpers.h"
+
+namespace JSC { namespace B3 {
+
+Compilation::Compilation(MacroAssemblerCodeRef codeRef, std::unique_ptr<OpaqueByproducts> byproducts)
+    : m_codeRef(codeRef)
+    , m_byproducts(WTFMove(byproducts))
+{
+}
+
+Compilation::Compilation(Compilation&& other)
+    : m_codeRef(WTFMove(other.m_codeRef))
+    , m_byproducts(WTFMove(other.m_byproducts))
+{
+}
+
+Compilation::~Compilation()
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3Compilation.h b/b3/B3Compilation.h
new file mode 100644
index 0000000..7398652
--- /dev/null
+++ b/b3/B3Compilation.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "MacroAssemblerCodeRef.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class VM;
+
+namespace B3 {
+
+class OpaqueByproducts;
+class Procedure;
+
+// This class is a way to keep the result of a B3 compilation alive
+// and runnable.
+
+class Compilation {
+    WTF_MAKE_NONCOPYABLE(Compilation);
+    WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    JS_EXPORT_PRIVATE Compilation(MacroAssemblerCodeRef, std::unique_ptr<OpaqueByproducts>);
+    JS_EXPORT_PRIVATE Compilation(Compilation&&);
+    JS_EXPORT_PRIVATE ~Compilation();
+
+    MacroAssemblerCodePtr code() const { return m_codeRef.code(); }
+    MacroAssemblerCodeRef codeRef() const { return m_codeRef; }
+    
+    CString disassembly() const { return m_codeRef.disassembly(); }
+
+private:
+    MacroAssemblerCodeRef m_codeRef;
+    std::unique_ptr<OpaqueByproducts> m_byproducts;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Compile.cpp b/b3/B3Compile.cpp
new file mode 100644
index 0000000..980390a
--- /dev/null
+++ b/b3/B3Compile.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Compile.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3Generate.h"
+#include "B3OpaqueByproducts.h"
+#include "B3Procedure.h"
+#include "B3TimingScope.h"
+#include "CCallHelpers.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+
+namespace JSC { namespace B3 {
+
+Compilation compile(VM& vm, Procedure& proc, unsigned optLevel)
+{
+    TimingScope timingScope("Compilation");
+    
+    prepareForGeneration(proc, optLevel);
+    
+    CCallHelpers jit(&vm);
+    generate(proc, jit);
+    LinkBuffer linkBuffer(vm, jit, nullptr);
+
+    return Compilation(FINALIZE_CODE(linkBuffer, ("B3::Compilation")), proc.releaseByproducts());
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3Compile.h b/b3/B3Compile.h
new file mode 100644
index 0000000..37db160
--- /dev/null
+++ b/b3/B3Compile.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Compilation.h"
+
+namespace JSC {
+
+class VM;
+
+namespace B3 {
+
+class Procedure;
+
+// This is a fool-proof API for compiling a Procedure to code and then running that code. You compile
+// a Procedure using this API by doing:
+//
+// Compilation compilation = B3::compile(vm, proc);
+//
+// Then you keep the Compilation object alive for as long as you want to be able to run the code.
+// If this API feels too high-level, you can use B3::generate() directly.
+
+JS_EXPORT_PRIVATE Compilation compile(VM&, Procedure&, unsigned optLevel = 1);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ComputeDivisionMagic.h b/b3/B3ComputeDivisionMagic.h
new file mode 100644
index 0000000..8c17ed6
--- /dev/null
+++ b/b3/B3ComputeDivisionMagic.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ * This contains code taken from LLVM's APInt class. That code implements finding the magic
+ * numbers for strength-reducing division. The LLVM code on which this code is based was
+ * implemented using "Hacker's Delight", Henry S. Warren, Jr., chapter 10.
+ *
+ * ==============================================================================
+ * LLVM Release License
+ * ==============================================================================
+ * University of Illinois/NCSA
+ * Open Source License
+ * 
+ * Copyright (c) 2003-2014 University of Illinois at Urbana-Champaign.
+ * All rights reserved.
+ * 
+ * Developed by:
+ * 
+ *     LLVM Team
+ * 
+ *     University of Illinois at Urbana-Champaign
+ * 
+ *     http://llvm.org
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal with
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is furnished to do
+ * so, subject to the following conditions:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimers.
+ * 
+ *     * Redistributions in binary form must reproduce the above copyright notice,
+ *       this list of conditions and the following disclaimers in the
+ *       documentation and/or other materials provided with the distribution.
+ * 
+ *     * Neither the names of the LLVM Team, University of Illinois at
+ *       Urbana-Champaign, nor the names of its contributors may be used to
+ *       endorse or promote products derived from this Software without specific
+ *       prior written permission.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+ * CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE
+ * SOFTWARE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+template<typename T>
+struct DivisionMagic {
+    T magicMultiplier;
+    unsigned shift;
+};
+
+// This contains code taken from LLVM's APInt::magic(). It's modestly adapted to our style, but
+// not completely, to make it easier to apply their changes in the future.
+template<typename T>
+DivisionMagic<T> computeDivisionMagic(T divisor)
+{
+    typedef typename std::make_unsigned<T>::type UnsignedT;
+    UnsignedT d = divisor;
+    unsigned p;
+    UnsignedT ad, anc, delta, q1, r1, q2, r2, t;
+    UnsignedT signedMin = static_cast<UnsignedT>(std::numeric_limits<T>::min());
+    DivisionMagic<T> mag;
+    unsigned bitWidth = sizeof(divisor) * 8;
+
+    // This code doesn't like to think of signedness as a type. Instead it likes to think that
+    // operations have signedness. This is how we generally do it in B3 as well. For this reason,
+    // we cast all the operated values once to unsigned. And later, we convert it to signed.
+    // Only `divisor` have signedness here.
+
+    ad = divisor < 0 ? -divisor : divisor; // -(signed min value) < signed max value. So there is no loss.
+    t = signedMin + (d >> (bitWidth - 1));
+    anc = t - 1 - (t % ad);   // absolute value of nc
+    p = bitWidth - 1;    // initialize p
+    q1 = signedMin / anc;   // initialize q1 = 2p/abs(nc)
+    r1 = signedMin - q1*anc;    // initialize r1 = rem(2p,abs(nc))
+    q2 = signedMin / ad;    // initialize q2 = 2p/abs(d)
+    r2 = signedMin - q2*ad;     // initialize r2 = rem(2p,abs(d))
+    do {
+        p = p + 1;
+        q1 = q1 << 1;          // update q1 = 2p/abs(nc)
+        r1 = r1 << 1;          // update r1 = rem(2p/abs(nc))
+        if (r1 >= anc) {  // must be unsigned comparison
+            q1 = q1 + 1;
+            r1 = r1 - anc;
+        }
+        q2 = q2 << 1;          // update q2 = 2p/abs(d)
+        r2 = r2 << 1;          // update r2 = rem(2p/abs(d))
+        if (r2 >= ad) {   // must be unsigned comparison
+            q2 = q2 + 1;
+            r2 = r2 - ad;
+        }
+        delta = ad - r2;
+    } while (q1 < delta || (q1 == delta && r1 == 0));
+
+    mag.magicMultiplier = q2 + 1;
+    if (divisor < 0)
+        mag.magicMultiplier = -mag.magicMultiplier;   // resulting magic number
+    mag.shift = p - bitWidth;          // resulting shift
+
+    return mag;
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Const32Value.cpp b/b3/B3Const32Value.cpp
new file mode 100644
index 0000000..49a7453
--- /dev/null
+++ b/b3/B3Const32Value.cpp
@@ -0,0 +1,289 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Const32Value.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3ProcedureInlines.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+Const32Value::~Const32Value()
+{
+}
+
+Value* Const32Value::negConstant(Procedure& proc) const
+{
+    return proc.add<Const32Value>(origin(), -m_value);
+}
+
+Value* Const32Value::addConstant(Procedure& proc, int32_t other) const
+{
+    return proc.add<Const32Value>(origin(), m_value + other);
+}
+
+Value* Const32Value::addConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), m_value + other->asInt32());
+}
+
+Value* Const32Value::subConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), m_value - other->asInt32());
+}
+
+Value* Const32Value::mulConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), m_value * other->asInt32());
+}
+
+Value* Const32Value::checkAddConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    CheckedInt32 result = CheckedInt32(m_value) + CheckedInt32(other->asInt32());
+    if (result.hasOverflowed())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), result.unsafeGet());
+}
+
+Value* Const32Value::checkSubConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    CheckedInt32 result = CheckedInt32(m_value) - CheckedInt32(other->asInt32());
+    if (result.hasOverflowed())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), result.unsafeGet());
+}
+
+Value* Const32Value::checkMulConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    CheckedInt32 result = CheckedInt32(m_value) * CheckedInt32(other->asInt32());
+    if (result.hasOverflowed())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), result.unsafeGet());
+}
+
+Value* Const32Value::checkNegConstant(Procedure& proc) const
+{
+    if (m_value == -m_value)
+        return nullptr;
+    return negConstant(proc);
+}
+
+Value* Const32Value::divConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), chillDiv(m_value, other->asInt32()));
+}
+
+Value* Const32Value::uDivConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), chillUDiv(m_value, other->asInt32()));
+}
+
+Value* Const32Value::modConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), chillMod(m_value, other->asInt32()));
+}
+
+Value* Const32Value::uModConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), chillUMod(m_value, other->asInt32()));
+}
+
+Value* Const32Value::bitAndConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), m_value & other->asInt32());
+}
+
+Value* Const32Value::bitOrConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), m_value | other->asInt32());
+}
+
+Value* Const32Value::bitXorConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), m_value ^ other->asInt32());
+}
+
+Value* Const32Value::shlConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), m_value << (other->asInt32() & 31));
+}
+
+Value* Const32Value::sShrConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), m_value >> (other->asInt32() & 31));
+}
+
+Value* Const32Value::zShrConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), static_cast<int32_t>(static_cast<uint32_t>(m_value) >> (other->asInt32() & 31)));
+}
+
+Value* Const32Value::rotRConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), rotateRight(m_value, other->asInt32()));
+}
+
+Value* Const32Value::rotLConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const32Value>(origin(), rotateLeft(m_value, other->asInt32()));
+}
+
+Value* Const32Value::bitwiseCastConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), bitwise_cast<float>(m_value));
+}
+
+Value* Const32Value::iToDConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), static_cast<double>(m_value));
+}
+
+Value* Const32Value::iToFConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), static_cast<float>(m_value));
+}
+
+TriState Const32Value::equalConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(m_value == other->asInt32());
+}
+
+TriState Const32Value::notEqualConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(m_value != other->asInt32());
+}
+
+TriState Const32Value::lessThanConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(m_value < other->asInt32());
+}
+
+TriState Const32Value::greaterThanConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(m_value > other->asInt32());
+}
+
+TriState Const32Value::lessEqualConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(m_value <= other->asInt32());
+}
+
+TriState Const32Value::greaterEqualConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(m_value >= other->asInt32());
+}
+
+TriState Const32Value::aboveConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(static_cast<uint32_t>(m_value) > static_cast<uint32_t>(other->asInt32()));
+}
+
+TriState Const32Value::belowConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(static_cast<uint32_t>(m_value) < static_cast<uint32_t>(other->asInt32()));
+}
+
+TriState Const32Value::aboveEqualConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(static_cast<uint32_t>(m_value) >= static_cast<uint32_t>(other->asInt32()));
+}
+
+TriState Const32Value::belowEqualConstant(const Value* other) const
+{
+    if (!other->hasInt32())
+        return MixedTriState;
+    return triState(static_cast<uint32_t>(m_value) <= static_cast<uint32_t>(other->asInt32()));
+}
+
+void Const32Value::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma, m_value);
+}
+
+Value* Const32Value::cloneImpl() const
+{
+    return new Const32Value(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Const32Value.h b/b3/B3Const32Value.h
new file mode 100644
index 0000000..af4d08b
--- /dev/null
+++ b/b3/B3Const32Value.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE Const32Value : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == Const32; }
+    
+    ~Const32Value();
+    
+    int32_t value() const { return m_value; }
+
+    Value* negConstant(Procedure&) const override;
+    Value* addConstant(Procedure&, int32_t other) const override;
+    Value* addConstant(Procedure&, const Value* other) const override;
+    Value* subConstant(Procedure&, const Value* other) const override;
+    Value* mulConstant(Procedure&, const Value* other) const override;
+    Value* checkAddConstant(Procedure&, const Value* other) const override;
+    Value* checkSubConstant(Procedure&, const Value* other) const override;
+    Value* checkMulConstant(Procedure&, const Value* other) const override;
+    Value* checkNegConstant(Procedure&) const override;
+    Value* divConstant(Procedure&, const Value* other) const override;
+    Value* uDivConstant(Procedure&, const Value* other) const override;
+    Value* modConstant(Procedure&, const Value* other) const override;
+    Value* uModConstant(Procedure&, const Value* other) const override;
+    Value* bitAndConstant(Procedure&, const Value* other) const override;
+    Value* bitOrConstant(Procedure&, const Value* other) const override;
+    Value* bitXorConstant(Procedure&, const Value* other) const override;
+    Value* shlConstant(Procedure&, const Value* other) const override;
+    Value* sShrConstant(Procedure&, const Value* other) const override;
+    Value* zShrConstant(Procedure&, const Value* other) const override;
+    Value* rotRConstant(Procedure&, const Value* other) const override;
+    Value* rotLConstant(Procedure&, const Value* other) const override;
+    Value* bitwiseCastConstant(Procedure&) const override;
+    Value* iToDConstant(Procedure&) const override;
+    Value* iToFConstant(Procedure&) const override;
+
+    TriState equalConstant(const Value* other) const override;
+    TriState notEqualConstant(const Value* other) const override;
+    TriState lessThanConstant(const Value* other) const override;
+    TriState greaterThanConstant(const Value* other) const override;
+    TriState lessEqualConstant(const Value* other) const override;
+    TriState greaterEqualConstant(const Value* other) const override;
+    TriState aboveConstant(const Value* other) const override;
+    TriState belowConstant(const Value* other) const override;
+    TriState aboveEqualConstant(const Value* other) const override;
+    TriState belowEqualConstant(const Value* other) const override;
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+    friend class Procedure;
+
+    Const32Value(Origin origin, int32_t value)
+        : Value(CheckedOpcode, Const32, Int32, origin)
+        , m_value(value)
+    {
+    }
+
+private:
+    int32_t m_value;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Const64Value.cpp b/b3/B3Const64Value.cpp
new file mode 100644
index 0000000..4f7b86b
--- /dev/null
+++ b/b3/B3Const64Value.cpp
@@ -0,0 +1,289 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Const64Value.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3ProcedureInlines.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+Const64Value::~Const64Value()
+{
+}
+
+Value* Const64Value::negConstant(Procedure& proc) const
+{
+    return proc.add<Const64Value>(origin(), -m_value);
+}
+
+Value* Const64Value::addConstant(Procedure& proc, int32_t other) const
+{
+    return proc.add<Const64Value>(origin(), m_value + static_cast<int64_t>(other));
+}
+
+Value* Const64Value::addConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), m_value + other->asInt64());
+}
+
+Value* Const64Value::subConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), m_value - other->asInt64());
+}
+
+Value* Const64Value::mulConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), m_value * other->asInt64());
+}
+
+Value* Const64Value::checkAddConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    CheckedInt64 result = CheckedInt64(m_value) + CheckedInt64(other->asInt64());
+    if (result.hasOverflowed())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), result.unsafeGet());
+}
+
+Value* Const64Value::checkSubConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    CheckedInt64 result = CheckedInt64(m_value) - CheckedInt64(other->asInt64());
+    if (result.hasOverflowed())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), result.unsafeGet());
+}
+
+Value* Const64Value::checkMulConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    CheckedInt64 result = CheckedInt64(m_value) * CheckedInt64(other->asInt64());
+    if (result.hasOverflowed())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), result.unsafeGet());
+}
+
+Value* Const64Value::checkNegConstant(Procedure& proc) const
+{
+    if (m_value == -m_value)
+        return nullptr;
+    return negConstant(proc);
+}
+
+Value* Const64Value::divConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), chillDiv(m_value, other->asInt64()));
+}
+
+Value* Const64Value::uDivConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), chillUDiv(m_value, other->asInt64()));
+}
+
+Value* Const64Value::modConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), chillMod(m_value, other->asInt64()));
+}
+
+Value* Const64Value::uModConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), chillUMod(m_value, other->asInt64()));
+}
+
+Value* Const64Value::bitAndConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), m_value & other->asInt64());
+}
+
+Value* Const64Value::bitOrConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), m_value | other->asInt64());
+}
+
+Value* Const64Value::bitXorConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt64())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), m_value ^ other->asInt64());
+}
+
+Value* Const64Value::shlConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), m_value << (other->asInt32() & 63));
+}
+
+Value* Const64Value::sShrConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), m_value >> (other->asInt32() & 63));
+}
+
+Value* Const64Value::zShrConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), static_cast<int64_t>(static_cast<uint64_t>(m_value) >> (other->asInt32() & 63)));
+}
+
+Value* Const64Value::rotRConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), rotateRight(m_value, other->asInt32()));
+}
+
+Value* Const64Value::rotLConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasInt32())
+        return nullptr;
+    return proc.add<Const64Value>(origin(), rotateLeft(m_value, other->asInt32()));
+}
+
+Value* Const64Value::bitwiseCastConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), bitwise_cast<double>(m_value));
+}
+
+Value* Const64Value::iToDConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), static_cast<double>(m_value));
+}
+
+Value* Const64Value::iToFConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), static_cast<float>(m_value));
+}
+
+TriState Const64Value::equalConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(m_value == other->asInt64());
+}
+
+TriState Const64Value::notEqualConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(m_value != other->asInt64());
+}
+
+TriState Const64Value::lessThanConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(m_value < other->asInt64());
+}
+
+TriState Const64Value::greaterThanConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(m_value > other->asInt64());
+}
+
+TriState Const64Value::lessEqualConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(m_value <= other->asInt64());
+}
+
+TriState Const64Value::greaterEqualConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(m_value >= other->asInt64());
+}
+
+TriState Const64Value::aboveConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(static_cast<uint64_t>(m_value) > static_cast<uint64_t>(other->asInt64()));
+}
+
+TriState Const64Value::belowConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(static_cast<uint64_t>(m_value) < static_cast<uint64_t>(other->asInt64()));
+}
+
+TriState Const64Value::aboveEqualConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(static_cast<uint64_t>(m_value) >= static_cast<uint64_t>(other->asInt64()));
+}
+
+TriState Const64Value::belowEqualConstant(const Value* other) const
+{
+    if (!other->hasInt64())
+        return MixedTriState;
+    return triState(static_cast<uint64_t>(m_value) <= static_cast<uint64_t>(other->asInt64()));
+}
+
+void Const64Value::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma, m_value);
+}
+
+Value* Const64Value::cloneImpl() const
+{
+    return new Const64Value(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Const64Value.h b/b3/B3Const64Value.h
new file mode 100644
index 0000000..3efd558
--- /dev/null
+++ b/b3/B3Const64Value.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE Const64Value : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == Const64; }
+    
+    ~Const64Value();
+    
+    int64_t value() const { return m_value; }
+
+    Value* negConstant(Procedure&) const override;
+    Value* addConstant(Procedure&, int32_t other) const override;
+    Value* addConstant(Procedure&, const Value* other) const override;
+    Value* subConstant(Procedure&, const Value* other) const override;
+    Value* mulConstant(Procedure&, const Value* other) const override;
+    Value* checkAddConstant(Procedure&, const Value* other) const override;
+    Value* checkSubConstant(Procedure&, const Value* other) const override;
+    Value* checkMulConstant(Procedure&, const Value* other) const override;
+    Value* checkNegConstant(Procedure&) const override;
+    Value* divConstant(Procedure&, const Value* other) const override;
+    Value* uDivConstant(Procedure&, const Value* other) const override;
+    Value* modConstant(Procedure&, const Value* other) const override;
+    Value* uModConstant(Procedure&, const Value* other) const override;
+    Value* bitAndConstant(Procedure&, const Value* other) const override;
+    Value* bitOrConstant(Procedure&, const Value* other) const override;
+    Value* bitXorConstant(Procedure&, const Value* other) const override;
+    Value* shlConstant(Procedure&, const Value* other) const override;
+    Value* sShrConstant(Procedure&, const Value* other) const override;
+    Value* zShrConstant(Procedure&, const Value* other) const override;
+    Value* rotRConstant(Procedure&, const Value* other) const override;
+    Value* rotLConstant(Procedure&, const Value* other) const override;
+    Value* bitwiseCastConstant(Procedure&) const override;
+    Value* iToDConstant(Procedure&) const override;
+    Value* iToFConstant(Procedure&) const override;
+
+    TriState equalConstant(const Value* other) const override;
+    TriState notEqualConstant(const Value* other) const override;
+    TriState lessThanConstant(const Value* other) const override;
+    TriState greaterThanConstant(const Value* other) const override;
+    TriState lessEqualConstant(const Value* other) const override;
+    TriState greaterEqualConstant(const Value* other) const override;
+    TriState aboveConstant(const Value* other) const override;
+    TriState belowConstant(const Value* other) const override;
+    TriState aboveEqualConstant(const Value* other) const override;
+    TriState belowEqualConstant(const Value* other) const override;
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+    friend class Procedure;
+
+    Const64Value(Origin origin, int64_t value)
+        : Value(CheckedOpcode, Const64, Int64, origin)
+        , m_value(value)
+    {
+    }
+    
+private:
+    int64_t m_value;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ConstDoubleValue.cpp b/b3/B3ConstDoubleValue.cpp
new file mode 100644
index 0000000..46183f3
--- /dev/null
+++ b/b3/B3ConstDoubleValue.cpp
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3ConstDoubleValue.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3ConstFloatValue.h"
+#include "B3ProcedureInlines.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+ConstDoubleValue::~ConstDoubleValue()
+{
+}
+
+Value* ConstDoubleValue::negConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), -m_value);
+}
+
+Value* ConstDoubleValue::addConstant(Procedure& proc, int32_t other) const
+{
+    return proc.add<ConstDoubleValue>(origin(), m_value + static_cast<double>(other));
+}
+
+Value* ConstDoubleValue::addConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasDouble())
+        return nullptr;
+    return proc.add<ConstDoubleValue>(origin(), m_value + other->asDouble());
+}
+
+Value* ConstDoubleValue::subConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasDouble())
+        return nullptr;
+    return proc.add<ConstDoubleValue>(origin(), m_value - other->asDouble());
+}
+
+Value* ConstDoubleValue::mulConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasDouble())
+        return nullptr;
+    return proc.add<ConstDoubleValue>(origin(), m_value * other->asDouble());
+}
+
+Value* ConstDoubleValue::bitAndConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasDouble())
+        return nullptr;
+    double result = bitwise_cast<double>(bitwise_cast<uint64_t>(m_value) & bitwise_cast<uint64_t>(other->asDouble()));
+    return proc.add<ConstDoubleValue>(origin(), result);
+}
+
+Value* ConstDoubleValue::bitwiseCastConstant(Procedure& proc) const
+{
+    return proc.add<Const64Value>(origin(), bitwise_cast<int64_t>(m_value));
+}
+
+Value* ConstDoubleValue::doubleToFloatConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), static_cast<float>(m_value));
+}
+
+Value* ConstDoubleValue::absConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), fabs(m_value));
+}
+
+Value* ConstDoubleValue::ceilConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), ceil(m_value));
+}
+
+Value* ConstDoubleValue::floorConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), floor(m_value));
+}
+
+Value* ConstDoubleValue::sqrtConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), sqrt(m_value));
+}
+
+Value* ConstDoubleValue::divConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasDouble())
+        return nullptr;
+    return proc.add<ConstDoubleValue>(origin(), m_value / other->asDouble());
+}
+
+Value* ConstDoubleValue::modConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasDouble())
+        return nullptr;
+    return proc.add<ConstDoubleValue>(origin(), fmod(m_value, other->asDouble()));
+}
+
+TriState ConstDoubleValue::equalConstant(const Value* other) const
+{
+    if (!other->hasDouble())
+        return MixedTriState;
+    return triState(m_value == other->asDouble());
+}
+
+TriState ConstDoubleValue::notEqualConstant(const Value* other) const
+{
+    if (!other->hasDouble())
+        return MixedTriState;
+    return triState(m_value != other->asDouble());
+}
+
+TriState ConstDoubleValue::lessThanConstant(const Value* other) const
+{
+    if (!other->hasDouble())
+        return MixedTriState;
+    return triState(m_value < other->asDouble());
+}
+
+TriState ConstDoubleValue::greaterThanConstant(const Value* other) const
+{
+    if (!other->hasDouble())
+        return MixedTriState;
+    return triState(m_value > other->asDouble());
+}
+
+TriState ConstDoubleValue::lessEqualConstant(const Value* other) const
+{
+    if (!other->hasDouble())
+        return MixedTriState;
+    return triState(m_value <= other->asDouble());
+}
+
+TriState ConstDoubleValue::greaterEqualConstant(const Value* other) const
+{
+    if (!other->hasDouble())
+        return MixedTriState;
+    return triState(m_value >= other->asDouble());
+}
+
+TriState ConstDoubleValue::equalOrUnorderedConstant(const Value* other) const
+{
+    if (std::isnan(m_value))
+        return TrueTriState;
+
+    if (!other->hasDouble())
+        return MixedTriState;
+    double otherValue = other->asDouble();
+    return triState(std::isunordered(m_value, otherValue) || m_value == otherValue);
+}
+
+void ConstDoubleValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma);
+    out.printf("%le", m_value);
+}
+
+Value* ConstDoubleValue::cloneImpl() const
+{
+    return new ConstDoubleValue(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ConstDoubleValue.h b/b3/B3ConstDoubleValue.h
new file mode 100644
index 0000000..75976f3
--- /dev/null
+++ b/b3/B3ConstDoubleValue.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE ConstDoubleValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == ConstDouble; }
+    
+    ~ConstDoubleValue();
+    
+    double value() const { return m_value; }
+
+    Value* negConstant(Procedure&) const override;
+    Value* addConstant(Procedure&, int32_t other) const override;
+    Value* addConstant(Procedure&, const Value* other) const override;
+    Value* subConstant(Procedure&, const Value* other) const override;
+    Value* divConstant(Procedure&, const Value* other) const override;
+    Value* modConstant(Procedure&, const Value* other) const override;
+    Value* mulConstant(Procedure&, const Value* other) const override;
+    Value* bitAndConstant(Procedure&, const Value* other) const override;
+    Value* bitwiseCastConstant(Procedure&) const override;
+    Value* doubleToFloatConstant(Procedure&) const override;
+    Value* absConstant(Procedure&) const override;
+    Value* ceilConstant(Procedure&) const override;
+    Value* floorConstant(Procedure&) const override;
+    Value* sqrtConstant(Procedure&) const override;
+
+    TriState equalConstant(const Value* other) const override;
+    TriState notEqualConstant(const Value* other) const override;
+    TriState lessThanConstant(const Value* other) const override;
+    TriState greaterThanConstant(const Value* other) const override;
+    TriState lessEqualConstant(const Value* other) const override;
+    TriState greaterEqualConstant(const Value* other) const override;
+    TriState equalOrUnorderedConstant(const Value* other) const override;
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    ConstDoubleValue(Origin origin, double value)
+        : Value(CheckedOpcode, ConstDouble, Double, origin)
+        , m_value(value)
+    {
+    }
+    
+    double m_value;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ConstFloatValue.cpp b/b3/B3ConstFloatValue.cpp
new file mode 100644
index 0000000..7c1b395
--- /dev/null
+++ b/b3/B3ConstFloatValue.cpp
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3ConstFloatValue.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3ConstDoubleValue.h"
+#include "B3ProcedureInlines.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+ConstFloatValue::~ConstFloatValue()
+{
+}
+
+Value* ConstFloatValue::negConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), -m_value);
+}
+
+Value* ConstFloatValue::addConstant(Procedure& proc, int32_t other) const
+{
+    return proc.add<ConstFloatValue>(origin(), m_value + static_cast<float>(other));
+}
+
+Value* ConstFloatValue::addConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasFloat())
+        return nullptr;
+    return proc.add<ConstFloatValue>(origin(), m_value + other->asFloat());
+}
+
+Value* ConstFloatValue::subConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasFloat())
+        return nullptr;
+    return proc.add<ConstFloatValue>(origin(), m_value - other->asFloat());
+}
+
+Value* ConstFloatValue::mulConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasFloat())
+        return nullptr;
+    return proc.add<ConstFloatValue>(origin(), m_value * other->asFloat());
+}
+
+Value* ConstFloatValue::bitAndConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasFloat())
+        return nullptr;
+    float result = bitwise_cast<float>(bitwise_cast<uint32_t>(m_value) & bitwise_cast<uint32_t>(other->asFloat()));
+    return proc.add<ConstFloatValue>(origin(), result);
+}
+
+Value* ConstFloatValue::bitwiseCastConstant(Procedure& proc) const
+{
+    return proc.add<Const32Value>(origin(), bitwise_cast<int32_t>(m_value));
+}
+
+Value* ConstFloatValue::floatToDoubleConstant(Procedure& proc) const
+{
+    return proc.add<ConstDoubleValue>(origin(), static_cast<double>(m_value));
+}
+
+Value* ConstFloatValue::absConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), static_cast<float>(fabs(m_value)));
+}
+
+Value* ConstFloatValue::ceilConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), ceilf(m_value));
+}
+
+Value* ConstFloatValue::floorConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), floorf(m_value));
+}
+
+Value* ConstFloatValue::sqrtConstant(Procedure& proc) const
+{
+    return proc.add<ConstFloatValue>(origin(), static_cast<float>(sqrt(m_value)));
+}
+
+Value* ConstFloatValue::divConstant(Procedure& proc, const Value* other) const
+{
+    if (!other->hasFloat())
+        return nullptr;
+    return proc.add<ConstFloatValue>(origin(), m_value / other->asFloat());
+}
+
+TriState ConstFloatValue::equalConstant(const Value* other) const
+{
+    if (!other->hasFloat())
+        return MixedTriState;
+    return triState(m_value == other->asFloat());
+}
+
+TriState ConstFloatValue::notEqualConstant(const Value* other) const
+{
+    if (!other->hasFloat())
+        return MixedTriState;
+    return triState(m_value != other->asFloat());
+}
+
+TriState ConstFloatValue::lessThanConstant(const Value* other) const
+{
+    if (!other->hasFloat())
+        return MixedTriState;
+    return triState(m_value < other->asFloat());
+}
+
+TriState ConstFloatValue::greaterThanConstant(const Value* other) const
+{
+    if (!other->hasFloat())
+        return MixedTriState;
+    return triState(m_value > other->asFloat());
+}
+
+TriState ConstFloatValue::lessEqualConstant(const Value* other) const
+{
+    if (!other->hasFloat())
+        return MixedTriState;
+    return triState(m_value <= other->asFloat());
+}
+
+TriState ConstFloatValue::greaterEqualConstant(const Value* other) const
+{
+    if (!other->hasFloat())
+        return MixedTriState;
+    return triState(m_value >= other->asFloat());
+}
+
+void ConstFloatValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma);
+    out.printf("%le", m_value);
+}
+
+Value* ConstFloatValue::cloneImpl() const
+{
+    return new ConstFloatValue(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ConstFloatValue.h b/b3/B3ConstFloatValue.h
new file mode 100644
index 0000000..1974f8c
--- /dev/null
+++ b/b3/B3ConstFloatValue.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE ConstFloatValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == ConstFloat; }
+
+    ~ConstFloatValue();
+
+    float value() const { return m_value; }
+
+    Value* negConstant(Procedure&) const override;
+    Value* addConstant(Procedure&, int32_t other) const override;
+    Value* addConstant(Procedure&, const Value* other) const override;
+    Value* subConstant(Procedure&, const Value* other) const override;
+    Value* divConstant(Procedure&, const Value* other) const override;
+    Value* mulConstant(Procedure&, const Value* other) const override;
+    Value* bitAndConstant(Procedure&, const Value* other) const override;
+    Value* bitwiseCastConstant(Procedure&) const override;
+    Value* floatToDoubleConstant(Procedure&) const override;
+    Value* absConstant(Procedure&) const override;
+    Value* ceilConstant(Procedure&) const override;
+    Value* floorConstant(Procedure&) const override;
+    Value* sqrtConstant(Procedure&) const override;
+
+    TriState equalConstant(const Value* other) const override;
+    TriState notEqualConstant(const Value* other) const override;
+    TriState lessThanConstant(const Value* other) const override;
+    TriState greaterThanConstant(const Value* other) const override;
+    TriState lessEqualConstant(const Value* other) const override;
+    TriState greaterEqualConstant(const Value* other) const override;
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    ConstFloatValue(Origin origin, float value)
+        : Value(CheckedOpcode, ConstFloat, Float, origin)
+        , m_value(value)
+    {
+    }
+
+    float m_value;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ConstPtrValue.h b/b3/B3ConstPtrValue.h
new file mode 100644
index 0000000..78bcba3
--- /dev/null
+++ b/b3/B3ConstPtrValue.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Const32Value.h"
+#include "B3Const64Value.h"
+
+namespace JSC { namespace B3 {
+
+// Usually you want to use Const32Value or Const64Value directly. But this is useful for writing
+// platform-agnostic code. Note that a ConstPtrValue will behave like either a Const32Value or
+// Const64Value depending on platform.
+
+#if USE(JSVALUE64)
+typedef Const64Value ConstPtrValueBase;
+#else
+typedef Const32Value ConstPtrValueBase;
+#endif
+
+class ConstPtrValue : public ConstPtrValueBase {
+public:
+    void* value() const
+    {
+        return bitwise_cast<void*>(ConstPtrValueBase::value());
+    }
+
+private:
+    friend class Procedure;
+
+    template<typename T>
+    ConstPtrValue(Origin origin, T* pointer)
+        : ConstPtrValueBase(origin, bitwise_cast<intptr_t>(pointer))
+    {
+    }
+    template<typename T>
+    ConstPtrValue(Origin origin, T pointer)
+        : ConstPtrValueBase(origin, static_cast<intptr_t>(pointer))
+    {
+    }
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ConstrainedValue.cpp b/b3/B3ConstrainedValue.cpp
new file mode 100644
index 0000000..dd1762f
--- /dev/null
+++ b/b3/B3ConstrainedValue.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3ConstrainedValue.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+void ConstrainedValue::dump(PrintStream& out) const
+{
+    out.print(pointerDump(m_value), ":", m_rep);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3ConstrainedValue.h b/b3/B3ConstrainedValue.h
new file mode 100644
index 0000000..d2cd31f
--- /dev/null
+++ b/b3/B3ConstrainedValue.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3ValueRep.h"
+
+namespace JSC { namespace B3 {
+
+class Value;
+
+class ConstrainedValue {
+public:
+    ConstrainedValue()
+    {
+    }
+
+    ConstrainedValue(Value* value)
+        : m_value(value)
+        , m_rep(ValueRep::WarmAny)
+    {
+    }
+
+    ConstrainedValue(Value* value, const ValueRep& rep)
+        : m_value(value)
+        , m_rep(rep)
+    {
+    }
+
+    explicit operator bool() const { return m_value || m_rep; }
+
+    Value* value() const { return m_value; }
+    const ValueRep& rep() const { return m_rep; }
+
+    void dump(PrintStream& out) const;
+
+private:
+    Value* m_value;
+    ValueRep m_rep;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3DataSection.cpp b/b3/B3DataSection.cpp
new file mode 100644
index 0000000..f4e68bc
--- /dev/null
+++ b/b3/B3DataSection.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3DataSection.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+DataSection::DataSection(size_t size)
+    : m_data(fastZeroedMalloc(size))
+    , m_size(size)
+{
+}
+
+DataSection::~DataSection()
+{
+    fastFree(m_data);
+}
+
+void DataSection::dump(PrintStream& out) const
+{
+    out.print("DataSection at ", RawPointer(m_data), " with ", m_size, " bytes.");
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3DataSection.h b/b3/B3DataSection.h
new file mode 100644
index 0000000..0bca40e
--- /dev/null
+++ b/b3/B3DataSection.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3OpaqueByproduct.h"
+
+namespace JSC { namespace B3 {
+
+class DataSection : public OpaqueByproduct {
+public:
+    DataSection(size_t size);
+    virtual ~DataSection();
+
+    void* data() const { return m_data; }
+    size_t size() const { return m_size; }
+
+    void dump(PrintStream&) const override;
+
+private:
+    void* m_data;
+    size_t m_size;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Dominators.h b/b3/B3Dominators.h
new file mode 100644
index 0000000..4a9d085
--- /dev/null
+++ b/b3/B3Dominators.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3CFG.h"
+#include "B3Procedure.h"
+#include <wtf/Dominators.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace B3 {
+
+class Dominators : public WTF::Dominators<CFG> {
+    WTF_MAKE_NONCOPYABLE(Dominators);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    Dominators(Procedure& proc)
+        : WTF::Dominators<CFG>(proc.cfg())
+    {
+    }
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3DuplicateTails.cpp b/b3/B3DuplicateTails.cpp
new file mode 100644
index 0000000..fe94a60
--- /dev/null
+++ b/b3/B3DuplicateTails.cpp
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3DuplicateTails.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3BreakCriticalEdges.h"
+#include "B3Dominators.h"
+#include "B3FixSSA.h"
+#include "B3InsertionSetInlines.h"
+#include "B3PhaseScope.h"
+#include "B3ProcedureInlines.h"
+#include "B3SwitchValue.h"
+#include "B3UpsilonValue.h"
+#include "B3ValueInlines.h"
+#include <wtf/IndexSet.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+const bool verbose = false;
+
+class DuplicateTails {
+public:
+    DuplicateTails(Procedure& proc)
+        : m_proc(proc)
+        , m_insertionSet(proc)
+        , m_maxSize(Options::maxB3TailDupBlockSize())
+        , m_maxSuccessors(Options::maxB3TailDupBlockSuccessors())
+    {
+    }
+
+    void run()
+    {
+        // Breaking critical edges introduces blocks that jump to things. Those Jumps' successors
+        // become candidates for tail duplication. Prior to critical edge breaking, some of those
+        // Jumps would have been Branches, and so no tail duplication would have happened.
+        breakCriticalEdges(m_proc);
+        
+        // Find blocks that would be candidates for tail duplication. They must be small enough
+        // and they much not have too many successors.
+
+        m_proc.resetValueOwners();
+
+        IndexSet<BasicBlock> candidates;
+
+        for (BasicBlock* block : m_proc) {
+            if (block->size() > m_maxSize)
+                continue;
+            if (block->numSuccessors() > m_maxSuccessors)
+                continue;
+            if (block->last()->type() != Void) // Demoting doesn't handle terminals with values.
+                continue;
+
+            candidates.add(block);
+        }
+
+        // Collect the set of values that must be de-SSA'd.
+        IndexSet<Value> valuesToDemote;
+        for (BasicBlock* block : m_proc) {
+            for (Value* value : *block) {
+                if (value->opcode() == Phi && candidates.contains(block))
+                    valuesToDemote.add(value);
+                for (Value* child : value->children()) {
+                    if (child->owner != block && candidates.contains(child->owner))
+                        valuesToDemote.add(child);
+                }
+            }
+        }
+        demoteValues(m_proc, valuesToDemote);
+        if (verbose) {
+            dataLog("Procedure after value demotion:\n");
+            dataLog(m_proc);
+        }
+
+        for (BasicBlock* block : m_proc) {
+            if (block->last()->opcode() != Jump)
+                continue;
+
+            BasicBlock* tail = block->successorBlock(0);
+            if (!candidates.contains(tail))
+                continue;
+
+            // Don't tail duplicate a trivial self-loop, because the code below can't handle block and
+            // tail being the same block.
+            if (block == tail)
+                continue;
+
+            // We're about to change 'block'. Make sure that nobody duplicates block after this
+            // point.
+            candidates.remove(block);
+
+            if (verbose)
+                dataLog("Duplicating ", *tail, " into ", *block, "\n");
+
+            block->removeLast(m_proc);
+
+            HashMap<Value*, Value*> map;
+            for (Value* value : *tail) {
+                Value* clone = m_proc.clone(value);
+                for (Value*& child : clone->children()) {
+                    if (Value* replacement = map.get(child))
+                        child = replacement;
+                }
+                if (value->type() != Void)
+                    map.add(value, clone);
+                block->append(clone);
+            }
+            block->successors() = tail->successors();
+        }
+
+        m_proc.resetReachability();
+        m_proc.invalidateCFG();
+    }
+    
+private:
+
+    Procedure& m_proc;
+    InsertionSet m_insertionSet;
+    unsigned m_maxSize;
+    unsigned m_maxSuccessors;
+};
+
+} // anonymous namespace
+
+void duplicateTails(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "duplicateTails");
+    DuplicateTails duplicateTails(proc);
+    duplicateTails.run();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3DuplicateTails.h b/b3/B3DuplicateTails.h
new file mode 100644
index 0000000..443adaf
--- /dev/null
+++ b/b3/B3DuplicateTails.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Replaces jumps to tiny basic blocks with the contents of those basic blocks. Also simplifies
+// branches that are path-redundant. Does not do a fixpoint, because it does not have a good way
+// of detecting termination.
+
+void duplicateTails(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Effects.cpp b/b3/B3Effects.cpp
new file mode 100644
index 0000000..aeda46f
--- /dev/null
+++ b/b3/B3Effects.cpp
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Effects.h"
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/CommaPrinter.h>
+#include <wtf/DataLog.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+// These helpers cascade in such a way that after the helper for terminal, we don't have to worry
+// about terminal again, since the terminal case considers all ways that a terminal may interfere
+// with something else. And after the exit sideways case, we don't have to worry about either
+// exitsSideways or terminal. And so on...
+
+bool interferesWithTerminal(const Effects& terminal, const Effects& other)
+{
+    if (!terminal.terminal)
+        return false;
+    return other.terminal || other.controlDependent || other.writesLocalState || other.writes || other.writesPinned;
+}
+
+bool interferesWithExitSideways(const Effects& exitsSideways, const Effects& other)
+{
+    if (!exitsSideways.exitsSideways)
+        return false;
+    return other.controlDependent || other.writes || other.writesPinned;
+}
+
+bool interferesWithWritesLocalState(const Effects& writesLocalState, const Effects& other)
+{
+    if (!writesLocalState.writesLocalState)
+        return false;
+    return other.writesLocalState || other.readsLocalState;
+}
+
+bool interferesWithWritesPinned(const Effects& writesPinned, const Effects& other)
+{
+    if (!writesPinned.writesPinned)
+        return false;
+    return other.writesPinned || other.readsPinned;
+}
+
+} // anonymous namespace
+
+bool Effects::interferes(const Effects& other) const
+{
+    return interferesWithTerminal(*this, other)
+        || interferesWithTerminal(other, *this)
+        || interferesWithExitSideways(*this, other)
+        || interferesWithExitSideways(other, *this)
+        || interferesWithWritesLocalState(*this, other)
+        || interferesWithWritesLocalState(other, *this)
+        || interferesWithWritesPinned(*this, other)
+        || interferesWithWritesPinned(other, *this)
+        || writes.overlaps(other.writes)
+        || writes.overlaps(other.reads)
+        || reads.overlaps(other.writes);
+}
+
+bool Effects::operator==(const Effects& other) const
+{
+    return terminal == other.terminal
+        && exitsSideways == other.exitsSideways
+        && controlDependent == other.controlDependent
+        && writesLocalState == other.writesLocalState
+        && readsLocalState == other.readsLocalState
+        && writesPinned == other.writesPinned
+        && readsPinned == other.readsPinned
+        && writes == other.writes
+        && reads == other.reads;
+}
+
+bool Effects::operator!=(const Effects& other) const
+{
+    return !(*this == other);
+}
+
+void Effects::dump(PrintStream& out) const
+{
+    CommaPrinter comma("|");
+    if (terminal)
+        out.print(comma, "Terminal");
+    if (exitsSideways)
+        out.print(comma, "ExitsSideways");
+    if (controlDependent)
+        out.print(comma, "ControlDependent");
+    if (writesLocalState)
+        out.print(comma, "WritesLocalState");
+    if (readsLocalState)
+        out.print(comma, "ReadsLocalState");
+    if (writesPinned)
+        out.print(comma, "WritesPinned");
+    if (readsPinned)
+        out.print(comma, "ReadsPinned");
+    if (writes)
+        out.print(comma, "Writes:", writes);
+    if (reads)
+        out.print(comma, "Reads:", reads);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3Effects.h b/b3/B3Effects.h
new file mode 100644
index 0000000..7a08853
--- /dev/null
+++ b/b3/B3Effects.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3HeapRange.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+struct Effects {
+    // True if this cannot continue execution in the current block.
+    bool terminal { false };
+
+    // True if this value can cause execution to terminate abruptly, and that this abrupt termination is
+    // observable. An example of how this gets used is to limit the hoisting of controlDependent values.
+    // Note that if exitsSideways is set to true but reads is bottom, then B3 is free to assume that
+    // after abrupt termination of this procedure, none of the heap will be read. That's usually false,
+    // so make sure that reads corresponds to the set of things that are readable after this function
+    // terminates abruptly.
+    bool exitsSideways { false };
+
+    // True if the instruction may change semantics if hoisted above some control flow. For example,
+    // loads are usually control-dependent because we must assume that any control construct (either
+    // a terminal like Branch or anything that exits sideways, like Check) validates whether the
+    // pointer is valid. Hoisting the load above control may cause the load to trap even though it
+    // would not have otherwise trapped.
+    bool controlDependent { false };
+
+    // True if this writes to the local state. Operations that write local state don't write to anything
+    // in "memory" but they have a side-effect anyway. This is for modeling Upsilons, Sets, and Fences.
+    // This is a way of saying: even though this operation is not a terminal, does not exit sideways,
+    // and does not write to the heap, you still cannot kill this operation.
+    bool writesLocalState { false };
+
+    // True if this reads from the local state. This is only used for Phi and Get.
+    bool readsLocalState { false };
+
+    // B3 understands things about pinned registers. Therefore, it needs to know who reads them and
+    // who writes them. We don't track this on a per-register basis because that would be harder and
+    // we don't need it. Note that if you want to construct an immutable pinned register while also
+    // having other pinned registers that are mutable, then you can use ArgumentReg. Also note that
+    // nobody will stop you from making this get out-of-sync with your clobbered register sets in
+    // Patchpoint. It's recommended that you err on the side of being conservative.
+    // FIXME: Explore making these be RegisterSets. That's mainly hard because it would be awkward to
+    // reconcile with StackmapValue's support for clobbered regs.
+    // https://bugs.webkit.org/show_bug.cgi?id=163173
+    bool readsPinned { false };
+    bool writesPinned { false };
+
+    HeapRange writes;
+    HeapRange reads;
+    
+    static Effects none()
+    {
+        return Effects();
+    }
+
+    static Effects forCall()
+    {
+        Effects result;
+        result.exitsSideways = true;
+        result.controlDependent = true;
+        result.writes = HeapRange::top();
+        result.reads = HeapRange::top();
+        result.readsPinned = true;
+        result.writesPinned = true;
+        return result;
+    }
+
+    static Effects forCheck()
+    {
+        Effects result;
+        result.exitsSideways = true;
+        // The program could read anything after exiting, and it's on us to declare this.
+        result.reads = HeapRange::top();
+        return result;
+    }
+
+    bool mustExecute() const
+    {
+        return terminal || exitsSideways || writesLocalState || writes || writesPinned;
+    }
+
+    // Returns true if reordering instructions with these respective effects would change program
+    // behavior in an observable way.
+    bool interferes(const Effects&) const;
+    
+    JS_EXPORT_PRIVATE bool operator==(const Effects&) const;
+    JS_EXPORT_PRIVATE bool operator!=(const Effects&) const;
+
+    JS_EXPORT_PRIVATE void dump(PrintStream& out) const;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3EliminateCommonSubexpressions.cpp b/b3/B3EliminateCommonSubexpressions.cpp
new file mode 100644
index 0000000..feaacda
--- /dev/null
+++ b/b3/B3EliminateCommonSubexpressions.cpp
@@ -0,0 +1,703 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3EliminateCommonSubexpressions.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3BlockWorklist.h"
+#include "B3Dominators.h"
+#include "B3HeapRange.h"
+#include "B3InsertionSetInlines.h"
+#include "B3MemoryValue.h"
+#include "B3PhaseScope.h"
+#include "B3ProcedureInlines.h"
+#include "B3PureCSE.h"
+#include "B3SlotBaseValue.h"
+#include "B3StackSlot.h"
+#include "B3ValueKey.h"
+#include "B3ValueInlines.h"
+#include "B3Variable.h"
+#include "B3VariableValue.h"
+#include "DFGGraph.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/HashMap.h>
+#include <wtf/ListDump.h>
+#include <wtf/RangeSet.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+const bool verbose = false;
+
+// FIXME: We could treat Patchpoints with a non-empty set of reads as a "memory value" and somehow
+// eliminate redundant ones. We would need some way of determining if two patchpoints are replacable.
+// It doesn't seem right to use the reads set for this. We could use the generator, but that feels
+// lame because the FTL will pretty much use a unique generator for each patchpoint even when two
+// patchpoints have the same semantics as far as CSE would be concerned. We could invent something
+// like a "value ID" for patchpoints. By default, each one gets a unique value ID, but FTL could force
+// some patchpoints to share the same one as a signal that they will return the same value if executed
+// in the same heap with the same inputs.
+
+typedef Vector<MemoryValue*, 1> MemoryMatches;
+
+class MemoryValueMap {
+public:
+    MemoryValueMap() { }
+
+    void add(MemoryValue* memory)
+    {
+        Matches& matches = m_map.add(memory->lastChild(), Matches()).iterator->value;
+        if (matches.contains(memory))
+            return;
+        matches.append(memory);
+    }
+
+    template<typename Functor>
+    void removeIf(const Functor& functor)
+    {
+        m_map.removeIf(
+            [&] (HashMap<Value*, Matches>::KeyValuePairType& entry) -> bool {
+                entry.value.removeAllMatching(
+                    [&] (Value* value) -> bool {
+                        if (MemoryValue* memory = value->as<MemoryValue>())
+                            return functor(memory);
+                        return true;
+                    });
+                return entry.value.isEmpty();
+            });
+    }
+
+    Matches* find(Value* ptr)
+    {
+        auto iter = m_map.find(ptr);
+        if (iter == m_map.end())
+            return nullptr;
+        return &iter->value;
+    }
+
+    template<typename Functor>
+    MemoryValue* find(Value* ptr, const Functor& functor)
+    {
+        if (Matches* matches = find(ptr)) {
+            for (Value* candidateValue : *matches) {
+                if (MemoryValue* candidateMemory = candidateValue->as<MemoryValue>()) {
+                    if (functor(candidateMemory))
+                        return candidateMemory;
+                }
+            }
+        }
+        return nullptr;
+    }
+
+    void dump(PrintStream& out) const
+    {
+        out.print("{");
+        CommaPrinter comma;
+        for (auto& entry : m_map)
+            out.print(comma, pointerDump(entry.key), "=>", pointerListDump(entry.value));
+        out.print("}");
+    }
+    
+private:
+    // This uses Matches for two reasons:
+    // - It cannot be a MemoryValue* because the key is imprecise. Many MemoryValues could have the
+    //   same key while being unaliased.
+    // - It can't be a MemoryMatches array because the MemoryValue*'s could be turned into Identity's.
+    HashMap<Value*, Matches> m_map;
+};
+
+struct ImpureBlockData {
+    void dump(PrintStream& out) const
+    {
+        out.print(
+            "{reads = ", reads, ", writes = ", writes, ", storesAtHead = ", storesAtHead,
+            ", memoryValuesAtTail = ", memoryValuesAtTail, "}");
+    }
+
+    RangeSet<HeapRange> reads; // This only gets used for forward store elimination.
+    RangeSet<HeapRange> writes; // This gets used for both load and store elimination.
+
+    MemoryValueMap storesAtHead;
+    MemoryValueMap memoryValuesAtTail;
+};
+
+class CSE {
+public:
+    CSE(Procedure& proc)
+        : m_proc(proc)
+        , m_dominators(proc.dominators())
+        , m_impureBlockData(proc.size())
+        , m_insertionSet(proc)
+    {
+    }
+
+    bool run()
+    {
+        if (verbose)
+            dataLog("B3 before CSE:\n", m_proc);
+        
+        m_proc.resetValueOwners();
+
+        // Summarize the impure effects of each block, and the impure values available at the end of
+        // each block. This doesn't edit code yet.
+        for (BasicBlock* block : m_proc) {
+            ImpureBlockData& data = m_impureBlockData[block];
+            for (Value* value : *block) {
+                Effects effects = value->effects();
+                MemoryValue* memory = value->as<MemoryValue>();
+                
+                if (memory && memory->isStore()
+                    && !data.reads.overlaps(memory->range())
+                    && !data.writes.overlaps(memory->range()))
+                    data.storesAtHead.add(memory);
+                data.reads.add(effects.reads);
+
+                if (HeapRange writes = effects.writes)
+                    clobber(data, writes);
+
+                if (memory)
+                    data.memoryValuesAtTail.add(memory);
+            }
+
+            if (verbose)
+                dataLog("Block ", *block, ": ", data, "\n");
+        }
+
+        // Perform CSE. This edits code.
+        Vector<BasicBlock*> postOrder = m_proc.blocksInPostOrder();
+        for (unsigned i = postOrder.size(); i--;) {
+            m_block = postOrder[i];
+            if (verbose)
+                dataLog("Looking at ", *m_block, ":\n");
+
+            m_data = ImpureBlockData();
+            for (m_index = 0; m_index < m_block->size(); ++m_index) {
+                m_value = m_block->at(m_index);
+                process();
+            }
+            m_insertionSet.execute(m_block);
+            m_impureBlockData[m_block] = m_data;
+        }
+
+        // The previous pass might have requested that we insert code in some basic block other than
+        // the one that it was looking at. This inserts them.
+        for (BasicBlock* block : m_proc) {
+            for (unsigned valueIndex = 0; valueIndex < block->size(); ++valueIndex) {
+                auto iter = m_sets.find(block->at(valueIndex));
+                if (iter == m_sets.end())
+                    continue;
+
+                for (Value* value : iter->value)
+                    m_insertionSet.insertValue(valueIndex + 1, value);
+            }
+            m_insertionSet.execute(block);
+        }
+
+        if (verbose)
+            dataLog("B3 after CSE:\n", m_proc);
+
+        return m_changed;
+    }
+    
+private:
+    void process()
+    {
+        m_value->performSubstitution();
+
+        if (m_pureCSE.process(m_value, m_dominators)) {
+            ASSERT(!m_value->effects().writes);
+            m_changed = true;
+            return;
+        }
+
+        MemoryValue* memory = m_value->as<MemoryValue>();
+        if (memory && processMemoryBeforeClobber(memory))
+            return;
+
+        if (HeapRange writes = m_value->effects().writes)
+            clobber(m_data, writes);
+        
+        if (memory)
+            processMemoryAfterClobber(memory);
+    }
+
+    // Return true if we got rid of the operation. If you changed IR in this function, you have to
+    // set m_changed even if you also return true.
+    bool processMemoryBeforeClobber(MemoryValue* memory)
+    {
+        Value* value = memory->child(0);
+        Value* ptr = memory->lastChild();
+        HeapRange range = memory->range();
+        int32_t offset = memory->offset();
+
+        switch (memory->opcode()) {
+        case Store8:
+            return handleStoreBeforeClobber(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->offset() == offset
+                        && ((candidate->opcode() == Store8 && candidate->child(0) == value)
+                            || ((candidate->opcode() == Load8Z || candidate->opcode() == Load8S)
+                                && candidate == value));
+                });
+        case Store16:
+            return handleStoreBeforeClobber(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->offset() == offset
+                        && ((candidate->opcode() == Store16 && candidate->child(0) == value)
+                            || ((candidate->opcode() == Load16Z || candidate->opcode() == Load16S)
+                                && candidate == value));
+                });
+        case Store:
+            return handleStoreBeforeClobber(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->offset() == offset
+                        && ((candidate->opcode() == Store && candidate->child(0) == value)
+                            || (candidate->opcode() == Load && candidate == value));
+                });
+        default:
+            return false;
+        }
+    }
+
+    void clobber(ImpureBlockData& data, HeapRange writes)
+    {
+        data.writes.add(writes);
+        
+        data.memoryValuesAtTail.removeIf(
+            [&] (MemoryValue* memory) {
+                return memory->range().overlaps(writes);
+            });
+    }
+
+    void processMemoryAfterClobber(MemoryValue* memory)
+    {
+        Value* ptr = memory->lastChild();
+        HeapRange range = memory->range();
+        int32_t offset = memory->offset();
+        Type type = memory->type();
+
+        // FIXME: Empower this to insert more casts and shifts. For example, a Load8 could match a
+        // Store and mask the result. You could even have:
+        //
+        // Store(@value, @ptr, offset = 0)
+        // Load8Z(@ptr, offset = 2)
+        //
+        // Which could be turned into something like this:
+        //
+        // Store(@value, @ptr, offset = 0)
+        // ZShr(@value, 16)
+        
+        switch (memory->opcode()) {
+        case Load8Z: {
+            handleMemoryValue(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->offset() == offset
+                        && (candidate->opcode() == Load8Z || candidate->opcode() == Store8);
+                },
+                [&] (MemoryValue* match, Vector<Value*>& fixups) -> Value* {
+                    if (match->opcode() == Store8) {
+                        Value* mask = m_proc.add<Const32Value>(m_value->origin(), 0xff);
+                        fixups.append(mask);
+                        Value* zext = m_proc.add<Value>(
+                            BitAnd, m_value->origin(), match->child(0), mask);
+                        fixups.append(zext);
+                        return zext;
+                    }
+                    return nullptr;
+                });
+            break;
+        }
+
+        case Load8S: {
+            handleMemoryValue(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->offset() == offset
+                        && (candidate->opcode() == Load8S || candidate->opcode() == Store8);
+                },
+                [&] (MemoryValue* match, Vector<Value*>& fixups) -> Value* {
+                    if (match->opcode() == Store8) {
+                        Value* sext = m_proc.add<Value>(
+                            SExt8, m_value->origin(), match->child(0));
+                        fixups.append(sext);
+                        return sext;
+                    }
+                    return nullptr;
+                });
+            break;
+        }
+
+        case Load16Z: {
+            handleMemoryValue(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->offset() == offset
+                        && (candidate->opcode() == Load16Z || candidate->opcode() == Store16);
+                },
+                [&] (MemoryValue* match, Vector<Value*>& fixups) -> Value* {
+                    if (match->opcode() == Store16) {
+                        Value* mask = m_proc.add<Const32Value>(m_value->origin(), 0xffff);
+                        fixups.append(mask);
+                        Value* zext = m_proc.add<Value>(
+                            BitAnd, m_value->origin(), match->child(0), mask);
+                        fixups.append(zext);
+                        return zext;
+                    }
+                    return nullptr;
+                });
+            break;
+        }
+
+        case Load16S: {
+            handleMemoryValue(
+                ptr, range, [&] (MemoryValue* candidate) -> bool {
+                    return candidate->offset() == offset
+                        && (candidate->opcode() == Load16S || candidate->opcode() == Store16);
+                },
+                [&] (MemoryValue* match, Vector<Value*>& fixups) -> Value* {
+                    if (match->opcode() == Store16) {
+                        Value* sext = m_proc.add<Value>(
+                            SExt16, m_value->origin(), match->child(0));
+                        fixups.append(sext);
+                        return sext;
+                    }
+                    return nullptr;
+                });
+            break;
+        }
+
+        case Load: {
+            handleMemoryValue(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    if (candidate->offset() != offset)
+                        return false;
+
+                    if (candidate->opcode() == Load && candidate->type() == type)
+                        return true;
+
+                    if (candidate->opcode() == Store && candidate->child(0)->type() == type)
+                        return true;
+
+                    return false;
+                });
+            break;
+        }
+
+        case Store8: {
+            handleStoreAfterClobber(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->opcode() == Store8
+                        && candidate->offset() == offset;
+                });
+            break;
+        }
+            
+        case Store16: {
+            handleStoreAfterClobber(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->opcode() == Store16
+                        && candidate->offset() == offset;
+                });
+            break;
+        }
+            
+        case Store: {
+            handleStoreAfterClobber(
+                ptr, range,
+                [&] (MemoryValue* candidate) -> bool {
+                    return candidate->opcode() == Store
+                        && candidate->offset() == offset;
+                });
+            break;
+        }
+
+        default:
+            dataLog("Bad memory value: ", deepDump(m_proc, m_value), "\n");
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+
+    template<typename Filter>
+    bool handleStoreBeforeClobber(Value* ptr, HeapRange range, const Filter& filter)
+    {
+        MemoryMatches matches = findMemoryValue(ptr, range, filter);
+        if (matches.isEmpty())
+            return false;
+
+        m_value->replaceWithNop();
+        m_changed = true;
+        return true;
+    }
+
+    template<typename Filter>
+    void handleStoreAfterClobber(Value* ptr, HeapRange range, const Filter& filter)
+    {
+        if (!m_value->traps() && findStoreAfterClobber(ptr, range, filter)) {
+            m_value->replaceWithNop();
+            m_changed = true;
+            return;
+        }
+
+        m_data.memoryValuesAtTail.add(m_value->as<MemoryValue>());
+    }
+
+    template<typename Filter>
+    bool findStoreAfterClobber(Value* ptr, HeapRange range, const Filter& filter)
+    {
+        // We can eliminate a store if every forward path hits a store to the same location before
+        // hitting any operation that observes the store. This search seems like it should be
+        // expensive, but in the overwhelming majority of cases it will almost immediately hit an 
+        // operation that interferes.
+
+        if (verbose)
+            dataLog(*m_value, ": looking forward for stores to ", *ptr, "...\n");
+
+        // First search forward in this basic block.
+        // FIXME: It would be cool to get rid of this linear search. It's not super critical since
+        // we will probably bail out very quickly, but it *is* annoying.
+        for (unsigned index = m_index + 1; index < m_block->size(); ++index) {
+            Value* value = m_block->at(index);
+
+            if (MemoryValue* memoryValue = value->as<MemoryValue>()) {
+                if (memoryValue->lastChild() == ptr && filter(memoryValue))
+                    return true;
+            }
+
+            Effects effects = value->effects();
+            if (effects.reads.overlaps(range) || effects.writes.overlaps(range))
+                return false;
+        }
+
+        if (!m_block->numSuccessors())
+            return false;
+
+        BlockWorklist worklist;
+        worklist.pushAll(m_block->successorBlocks());
+
+        while (BasicBlock* block = worklist.pop()) {
+            ImpureBlockData& data = m_impureBlockData[block];
+
+            MemoryValue* match = data.storesAtHead.find(ptr, filter);
+            if (match && match != m_value)
+                continue;
+
+            if (data.writes.overlaps(range) || data.reads.overlaps(range))
+                return false;
+
+            if (!block->numSuccessors())
+                return false;
+
+            worklist.pushAll(block->successorBlocks());
+        }
+
+        return true;
+    }
+
+    template<typename Filter>
+    void handleMemoryValue(Value* ptr, HeapRange range, const Filter& filter)
+    {
+        handleMemoryValue(
+            ptr, range, filter,
+            [] (MemoryValue*, Vector<Value*>&) -> Value* {
+                return nullptr;
+            });
+    }
+
+    template<typename Filter, typename Replace>
+    void handleMemoryValue(
+        Value* ptr, HeapRange range, const Filter& filter, const Replace& replace)
+    {
+        MemoryMatches matches = findMemoryValue(ptr, range, filter);
+        if (replaceMemoryValue(matches, replace))
+            return;
+        m_data.memoryValuesAtTail.add(m_value->as<MemoryValue>());
+    }
+
+    template<typename Replace>
+    bool replaceMemoryValue(const MemoryMatches& matches, const Replace& replace)
+    {
+        if (matches.isEmpty())
+            return false;
+
+        if (verbose)
+            dataLog("Eliminating ", *m_value, " due to ", pointerListDump(matches), "\n");
+        
+        m_changed = true;
+
+        if (matches.size() == 1) {
+            MemoryValue* dominatingMatch = matches[0];
+            RELEASE_ASSERT(m_dominators.dominates(dominatingMatch->owner, m_block));
+            
+            if (verbose)
+                dataLog("    Eliminating using ", *dominatingMatch, "\n");
+            Vector<Value*> extraValues;
+            if (Value* value = replace(dominatingMatch, extraValues)) {
+                for (Value* extraValue : extraValues)
+                    m_insertionSet.insertValue(m_index, extraValue);
+                m_value->replaceWithIdentity(value);
+            } else {
+                if (dominatingMatch->isStore())
+                    m_value->replaceWithIdentity(dominatingMatch->child(0));
+                else
+                    m_value->replaceWithIdentity(dominatingMatch);
+            }
+            return true;
+        }
+
+        // FIXME: It would be way better if this phase just did SSA calculation directly.
+        // Right now we're relying on the fact that CSE's position in the phase order is
+        // almost right before SSA fixup.
+
+        Variable* variable = m_proc.addVariable(m_value->type());
+
+        VariableValue* get = m_insertionSet.insert<VariableValue>(
+            m_index, Get, m_value->origin(), variable);
+        if (verbose)
+            dataLog("    Inserting get of value: ", *get, "\n");
+        m_value->replaceWithIdentity(get);
+            
+        for (MemoryValue* match : matches) {
+            Vector<Value*>& sets = m_sets.add(match, Vector<Value*>()).iterator->value;
+
+            Value* value = replace(match, sets);
+            if (!value) {
+                if (match->isStore())
+                    value = match->child(0);
+                else
+                    value = match;
+            }
+                
+            Value* set = m_proc.add<VariableValue>(Set, m_value->origin(), variable, value);
+            sets.append(set);
+        }
+
+        return true;
+    }
+
+    template<typename Filter>
+    MemoryMatches findMemoryValue(Value* ptr, HeapRange range, const Filter& filter)
+    {
+        if (verbose)
+            dataLog(*m_value, ": looking backward for ", *ptr, "...\n");
+        
+        if (MemoryValue* match = m_data.memoryValuesAtTail.find(ptr, filter)) {
+            if (verbose)
+                dataLog("    Found ", *match, " locally.\n");
+            return { match };
+        }
+
+        if (m_data.writes.overlaps(range)) {
+            if (verbose)
+                dataLog("    Giving up because of writes.\n");
+            return { };
+        }
+
+        BlockWorklist worklist;
+        worklist.pushAll(m_block->predecessors());
+
+        MemoryMatches matches;
+
+        while (BasicBlock* block = worklist.pop()) {
+            if (verbose)
+                dataLog("    Looking at ", *block, "\n");
+
+            ImpureBlockData& data = m_impureBlockData[block];
+
+            MemoryValue* match = data.memoryValuesAtTail.find(ptr, filter);
+            if (match && match != m_value) {
+                if (verbose)
+                    dataLog("    Found match: ", *match, "\n");
+                matches.append(match);
+                continue;
+            }
+
+            if (data.writes.overlaps(range)) {
+                if (verbose)
+                    dataLog("    Giving up because of writes.\n");
+                return { };
+            }
+
+            if (!block->numPredecessors()) {
+                if (verbose)
+                    dataLog("    Giving up because it's live at root.\n");
+                // This essentially proves that this is live at the prologue. That means that we
+                // cannot reliably optimize this case.
+                return { };
+            }
+            
+            worklist.pushAll(block->predecessors());
+        }
+
+        if (verbose)
+            dataLog("    Got matches: ", pointerListDump(matches), "\n");
+        return matches;
+    }
+
+    Procedure& m_proc;
+
+    Dominators& m_dominators;
+    PureCSE m_pureCSE;
+    
+    IndexMap<BasicBlock, ImpureBlockData> m_impureBlockData;
+
+    ImpureBlockData m_data;
+
+    BasicBlock* m_block;
+    unsigned m_index;
+    Value* m_value;
+
+    HashMap<Value*, Vector<Value*>> m_sets;
+
+    InsertionSet m_insertionSet;
+
+    bool m_changed { false };
+};
+
+} // anonymous namespace
+
+bool eliminateCommonSubexpressions(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "eliminateCommonSubexpressions");
+
+    CSE cse(proc);
+    return cse.run();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3EliminateCommonSubexpressions.h b/b3/B3EliminateCommonSubexpressions.h
new file mode 100644
index 0000000..ce994be
--- /dev/null
+++ b/b3/B3EliminateCommonSubexpressions.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// This does global common subexpression elimination (CSE) over both pure values and memory accesses.
+
+bool eliminateCommonSubexpressions(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3FenceValue.cpp b/b3/B3FenceValue.cpp
new file mode 100644
index 0000000..80e2792
--- /dev/null
+++ b/b3/B3FenceValue.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "B3FenceValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+FenceValue::~FenceValue()
+{
+}
+
+Value* FenceValue::cloneImpl() const
+{
+    return new FenceValue(*this);
+}
+
+FenceValue::FenceValue(Origin origin, HeapRange read, HeapRange write)
+    : Value(CheckedOpcode, Fence, Void, origin)
+    , read(read)
+    , write(write)
+{
+}
+
+FenceValue::FenceValue(Origin origin)
+    : FenceValue(origin, HeapRange::top(), HeapRange::top())
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3FenceValue.h b/b3/B3FenceValue.h
new file mode 100644
index 0000000..d147052
--- /dev/null
+++ b/b3/B3FenceValue.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3HeapRange.h"
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE FenceValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == Fence; }
+    
+    ~FenceValue();
+    
+    // The read/write heaps are reflected in the effects() of this value. The compiler may change
+    // the lowering of a Fence based on the heaps. For example, if a fence does not write anything
+    // then it is understood to be a store-store fence. On x86, this may lead us to not emit any
+    // code, while on ARM we may emit a cheaper fence (dmb ishst instead of dmb ish). We will do
+    // the same optimization for load-load fences, which are expressed as a Fence that writes but
+    // does not read.
+    //
+    // This abstraction allows us to cover all of the fences on x86 and all of the standalone fences
+    // on ARM. X86 really just has one fence: mfence. This fence should be used to protect stores
+    // from being sunk below loads. WTF calls it the storeLoadFence. A classic example is the Steele
+    // barrier:
+    //
+    //     o.f = v  =>  o.f = v
+    //                  if (color(o) == black)
+    //                      log(o)
+    //
+    // We are trying to ensure that if the store to o.f occurs after the collector has started
+    // visiting o, then we will log o. Under sequential consistency, this would work. The collector
+    // would set color(o) to black just before it started visiting. But x86's illusion of sequential
+    // consistency is broken in exactly just this store->load ordering case. The store to o.f may
+    // get buffered, and it may occur some time after we have loaded and checked color(o). As well,
+    // the collector's store to set color(o) to black may get buffered and it may occur some time
+    // after the collector has finished visiting o. Therefore, we need mfences. In B3 we model this
+    // as a Fence that reads and writes some heaps. Setting writes to the empty set will cause B3 to
+    // not emit any barrier on x86.
+    //
+    // On ARM there are many more fences. The Fence instruction is meant to model just two of them:
+    // dmb ish and dmb ishst. You can emit a dmb ishst by using a Fence with an empty write heap.
+    // Otherwise, you will get a dmb ish.
+    // FIXME: Add fenced memory accesses. https://bugs.webkit.org/show_bug.cgi?id=162349
+    // FIXME: Add a Depend operation. https://bugs.webkit.org/show_bug.cgi?id=162350
+    HeapRange read { HeapRange::top() };
+    HeapRange write { HeapRange::top() };
+
+protected:
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+    
+    JS_EXPORT_PRIVATE FenceValue(Origin origin, HeapRange read, HeapRange write);
+    
+    JS_EXPORT_PRIVATE FenceValue(Origin origin);
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3FixSSA.cpp b/b3/B3FixSSA.cpp
new file mode 100644
index 0000000..730c2c8
--- /dev/null
+++ b/b3/B3FixSSA.cpp
@@ -0,0 +1,270 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3FixSSA.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3BreakCriticalEdges.h"
+#include "B3Dominators.h"
+#include "B3InsertionSetInlines.h"
+#include "B3PhaseScope.h"
+#include "B3ProcedureInlines.h"
+#include "B3SSACalculator.h"
+#include "B3UpsilonValue.h"
+#include "B3ValueInlines.h"
+#include "B3Variable.h"
+#include "B3VariableValue.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/IndexSet.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+const bool verbose = false;
+} // anonymous namespace
+
+void demoteValues(Procedure& proc, const IndexSet<Value>& values)
+{
+    HashMap<Value*, Variable*> map;
+    HashMap<Value*, Variable*> phiMap;
+
+    // Create stack slots.
+    for (Value* value : values.values(proc.values())) {
+        map.add(value, proc.addVariable(value->type()));
+
+        if (value->opcode() == Phi)
+            phiMap.add(value, proc.addVariable(value->type()));
+    }
+
+    if (verbose) {
+        dataLog("Demoting values as follows:\n");
+        dataLog("   map = ");
+        CommaPrinter comma;
+        for (auto& entry : map)
+            dataLog(comma, *entry.key, "=>", *entry.value);
+        dataLog("\n");
+        dataLog("   phiMap = ");
+        comma = CommaPrinter();
+        for (auto& entry : phiMap)
+            dataLog(comma, *entry.key, "=>", *entry.value);
+        dataLog("\n");
+    }
+
+    // Change accesses to the values to accesses to the stack slots.
+    InsertionSet insertionSet(proc);
+    for (BasicBlock* block : proc) {
+        for (unsigned valueIndex = 0; valueIndex < block->size(); ++valueIndex) {
+            Value* value = block->at(valueIndex);
+
+            if (value->opcode() == Phi) {
+                if (Variable* variable = phiMap.get(value)) {
+                    value->replaceWithIdentity(
+                        insertionSet.insert<VariableValue>(
+                            valueIndex, Get, value->origin(), variable));
+                }
+            } else {
+                for (Value*& child : value->children()) {
+                    if (Variable* variable = map.get(child)) {
+                        child = insertionSet.insert<VariableValue>(
+                            valueIndex, Get, value->origin(), variable);
+                    }
+                }
+
+                if (UpsilonValue* upsilon = value->as<UpsilonValue>()) {
+                    if (Variable* variable = phiMap.get(upsilon->phi())) {
+                        insertionSet.insert<VariableValue>(
+                            valueIndex, Set, upsilon->origin(), variable, upsilon->child(0));
+                        value->replaceWithNop();
+                    }
+                }
+            }
+
+            if (Variable* variable = map.get(value)) {
+                insertionSet.insert<VariableValue>(
+                    valueIndex + 1, Set, value->origin(), variable, value);
+            }
+        }
+        insertionSet.execute(block);
+    }
+}
+
+bool fixSSA(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "fixSSA");
+
+    // Just for sanity, remove any unused variables first. It's unlikely that this code has any
+    // bugs having to do with dead variables, but it would be silly to have to fix such a bug if
+    // it did arise.
+    IndexSet<Variable> liveVariables;
+    for (Value* value : proc.values()) {
+        if (VariableValue* variableValue = value->as<VariableValue>())
+            liveVariables.add(variableValue->variable());
+    }
+
+    for (Variable* variable : proc.variables()) {
+        if (!liveVariables.contains(variable))
+            proc.deleteVariable(variable);
+    }
+
+    if (proc.variables().isEmpty())
+        return false;
+
+    // We know that we have variables to optimize, so do that now.
+    breakCriticalEdges(proc);
+
+    SSACalculator ssa(proc);
+
+    // Create a SSACalculator::Variable ("calcVar") for every variable.
+    Vector<Variable*> calcVarToVariable;
+    IndexMap<Variable, SSACalculator::Variable*> variableToCalcVar(proc.variables().size());
+
+    for (Variable* variable : proc.variables()) {
+        SSACalculator::Variable* calcVar = ssa.newVariable();
+        RELEASE_ASSERT(calcVar->index() == calcVarToVariable.size());
+        calcVarToVariable.append(variable);
+        variableToCalcVar[variable] = calcVar;
+    }
+
+    // Create Defs for all of the stores to the stack variable.
+    for (BasicBlock* block : proc) {
+        for (Value* value : *block) {
+            if (value->opcode() != Set)
+                continue;
+
+            Variable* variable = value->as<VariableValue>()->variable();
+
+            if (SSACalculator::Variable* calcVar = variableToCalcVar[variable])
+                ssa.newDef(calcVar, block, value->child(0));
+        }
+    }
+
+    // Decide where Phis are to be inserted. This creates them but does not insert them.
+    ssa.computePhis(
+        [&] (SSACalculator::Variable* calcVar, BasicBlock* block) -> Value* {
+            Variable* variable = calcVarToVariable[calcVar->index()];
+            Value* phi = proc.add<Value>(Phi, variable->type(), block->at(0)->origin());
+            if (verbose) {
+                dataLog(
+                    "Adding Phi for ", pointerDump(variable), " at ", *block, ": ",
+                    deepDump(proc, phi), "\n");
+            }
+            return phi;
+        });
+
+    // Now perform the conversion.
+    InsertionSet insertionSet(proc);
+    IndexMap<Variable, Value*> mapping(proc.variables().size());
+    for (BasicBlock* block : proc.blocksInPreOrder()) {
+        mapping.clear();
+
+        for (unsigned index = calcVarToVariable.size(); index--;) {
+            Variable* variable = calcVarToVariable[index];
+            SSACalculator::Variable* calcVar = ssa.variable(index);
+
+            SSACalculator::Def* def = ssa.reachingDefAtHead(block, calcVar);
+            if (def)
+                mapping[variable] = def->value();
+        }
+
+        for (SSACalculator::Def* phiDef : ssa.phisForBlock(block)) {
+            Variable* variable = calcVarToVariable[phiDef->variable()->index()];
+
+            insertionSet.insertValue(0, phiDef->value());
+            mapping[variable] = phiDef->value();
+        }
+
+        for (unsigned valueIndex = 0; valueIndex < block->size(); ++valueIndex) {
+            Value* value = block->at(valueIndex);
+            value->performSubstitution();
+
+            switch (value->opcode()) {
+            case Get: {
+                VariableValue* variableValue = value->as<VariableValue>();
+                Variable* variable = variableValue->variable();
+
+                if (Value* replacement = mapping[variable])
+                    value->replaceWithIdentity(replacement);
+                else {
+                    value->replaceWithIdentity(
+                        insertionSet.insertBottom(valueIndex, value));
+                }
+                break;
+            }
+                
+            case Set: {
+                VariableValue* variableValue = value->as<VariableValue>();
+                Variable* variable = variableValue->variable();
+
+                mapping[variable] = value->child(0);
+                value->replaceWithNop();
+                break;
+            }
+
+            default:
+                break;
+            }
+        }
+
+        unsigned upsilonInsertionPoint = block->size() - 1;
+        Origin upsilonOrigin = block->last()->origin();
+        for (BasicBlock* successorBlock : block->successorBlocks()) {
+            for (SSACalculator::Def* phiDef : ssa.phisForBlock(successorBlock)) {
+                Value* phi = phiDef->value();
+                SSACalculator::Variable* calcVar = phiDef->variable();
+                Variable* variable = calcVarToVariable[calcVar->index()];
+
+                Value* mappedValue = mapping[variable];
+                if (verbose) {
+                    dataLog(
+                        "Mapped value for ", *variable, " with successor Phi ", *phi,
+                        " at end of ", *block, ": ", pointerDump(mappedValue), "\n");
+                }
+                
+                if (!mappedValue)
+                    mappedValue = insertionSet.insertBottom(upsilonInsertionPoint, phi);
+                
+                insertionSet.insert<UpsilonValue>(
+                    upsilonInsertionPoint, upsilonOrigin, mappedValue, phi);
+            }
+        }
+
+        insertionSet.execute(block);
+    }
+
+    if (verbose) {
+        dataLog("B3 after SSA conversion:\n");
+        dataLog(proc);
+    }
+
+    return true;
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3FixSSA.h b/b3/B3FixSSA.h
new file mode 100644
index 0000000..775c322
--- /dev/null
+++ b/b3/B3FixSSA.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+#include <wtf/IndexSet.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Turns all mentions of the given values into accesses to variables. This is meant to be used
+// from phases that don't like SSA for whatever reason.
+void demoteValues(Procedure&, const IndexSet<Value>&);
+
+// This fixes SSA for you. Use this after you have done demoteValues() and you have performed
+// whatever evil transformation you needed.
+bool fixSSA(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3FoldPathConstants.cpp b/b3/B3FoldPathConstants.cpp
new file mode 100644
index 0000000..24a0134
--- /dev/null
+++ b/b3/B3FoldPathConstants.cpp
@@ -0,0 +1,275 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3FoldPathConstants.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3CaseCollectionInlines.h"
+#include "B3Dominators.h"
+#include "B3InsertionSetInlines.h"
+#include "B3PhaseScope.h"
+#include "B3ProcedureInlines.h"
+#include "B3SwitchValue.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+const bool verbose = false;
+
+class FoldPathConstants {
+public:
+    FoldPathConstants(Procedure& proc)
+        : m_proc(proc)
+        , m_insertionSet(proc)
+    {
+    }
+
+    void run()
+    {
+        bool changed = false;
+
+        if (verbose)
+            dataLog("B3 before folding path constants: \n", m_proc, "\n");
+        
+        // Find all of the values that are the subject of a branch or switch. For any successor
+        // that we dominate, install a value override at that block.
+
+        HashMap<Value*, Vector<Override>> overrides;
+
+        Dominators& dominators = m_proc.dominators();
+        
+        auto addOverride = [&] (
+            BasicBlock* from, Value* value, const Override& override) {
+
+            if (override.block->numPredecessors() != 1)
+                return;
+            ASSERT(override.block->predecessor(0) == from);
+
+            Vector<Override>& forValue =
+                overrides.add(value, Vector<Override>()).iterator->value;
+
+            if (!ASSERT_DISABLED) {
+                for (const Override& otherOverride : forValue)
+                    ASSERT_UNUSED(otherOverride, otherOverride.block != override.block);
+            }
+
+            if (verbose)
+                dataLog("Overriding ", *value, " from ", *from, ": ", override, "\n");
+            
+            forValue.append(override);
+        };
+        
+        for (BasicBlock* block : m_proc) {
+            Value* branch = block->last();
+            switch (branch->opcode()) {
+            case Branch:
+                if (block->successorBlock(0) == block->successorBlock(1))
+                    continue;
+                addOverride(
+                    block, branch->child(0),
+                    Override::nonZero(block->successorBlock(0)));
+                addOverride(
+                    block, branch->child(0),
+                    Override::constant(block->successorBlock(1), 0));
+                break;
+            case Switch: {
+                HashMap<BasicBlock*, unsigned> targetUses;
+                for (const SwitchCase& switchCase : branch->as<SwitchValue>()->cases(block))
+                    targetUses.add(switchCase.targetBlock(), 0).iterator->value++;
+
+                for (const SwitchCase& switchCase : branch->as<SwitchValue>()->cases(block)) {
+                    if (targetUses.find(switchCase.targetBlock())->value != 1)
+                        continue;
+
+                    addOverride(
+                        block, branch->child(0),
+                        Override::constant(switchCase.targetBlock(), switchCase.caseValue()));
+                }
+                break;
+            }
+            default:
+                break;
+            }
+        }
+
+        // Install the constants in the override blocks. We use one-shot insertion sets because
+        // each block will get at most one thing inserted into it anyway.
+        for (auto& entry : overrides) {
+            for (Override& override : entry.value) {
+                if (!override.hasValue)
+                    continue;
+                override.valueNode =
+                    m_insertionSet.insertIntConstant(0, entry.key, override.value);
+                m_insertionSet.execute(override.block);
+            }
+        }
+
+        // Replace all uses of a value that has an override with that override, if appropriate.
+        // Certain instructions get special treatment.
+        auto getOverride = [&] (BasicBlock* block, Value* value) -> Override {
+            auto iter = overrides.find(value);
+            if (iter == overrides.end())
+                return Override();
+
+            Vector<Override>& forValue = iter->value;
+            Override result;
+            for (Override& override : forValue) {
+                if (dominators.dominates(override.block, block)
+                    && override.isBetterThan(result))
+                    result = override;
+            }
+
+            if (verbose)
+                dataLog("In block ", *block, " getting override for ", *value, ": ", result, "\n");
+
+            return result;
+        };
+        
+        for (BasicBlock* block : m_proc) {
+            for (unsigned valueIndex = 0; valueIndex < block->size(); ++valueIndex) {
+                Value* value = block->at(valueIndex);
+
+                switch (value->opcode()) {
+                case Branch: {
+                    if (getOverride(block, value->child(0)).isNonZero) {
+                        value->replaceWithJump(block, block->taken());
+                        changed = true;
+                    }
+                    break;
+                }
+
+                case Equal: {
+                    if (value->child(1)->isInt(0)
+                        && getOverride(block, value->child(0)).isNonZero) {
+                        value->replaceWithIdentity(
+                            m_insertionSet.insertIntConstant(valueIndex, value, 0));
+                    }
+                    break;
+                }
+
+                case NotEqual: {
+                    if (value->child(1)->isInt(0)
+                        && getOverride(block, value->child(0)).isNonZero) {
+                        value->replaceWithIdentity(
+                            m_insertionSet.insertIntConstant(valueIndex, value, 1));
+                    }
+                    break;
+                }
+
+                default:
+                    break;
+                }
+
+                for (Value*& child : value->children()) {
+                    Override override = getOverride(block, child);
+                    if (override.valueNode)
+                        child = override.valueNode;
+                }
+            }
+            m_insertionSet.execute(block);
+        }
+
+        if (changed) {
+            m_proc.resetReachability();
+            m_proc.invalidateCFG();
+        }
+    }
+    
+private:
+    struct Override {
+        Override()
+        {
+        }
+
+        static Override constant(BasicBlock* block, int64_t value)
+        {
+            Override result;
+            result.block = block;
+            result.hasValue = true;
+            result.value = value;
+            if (value)
+                result.isNonZero = true;
+            return result;
+        }
+
+        static Override nonZero(BasicBlock* block)
+        {
+            Override result;
+            result.block = block;
+            result.isNonZero = true;
+            return result;
+        }
+
+        bool isBetterThan(const Override& override)
+        {
+            if (hasValue && !override.hasValue)
+                return true;
+            if (isNonZero && !override.isNonZero)
+                return true;
+            return false;
+        }
+
+        void dump(PrintStream& out) const
+        {
+            out.print("{block = ", pointerDump(block), ", value = ");
+            if (hasValue)
+                out.print(value);
+            else
+                out.print("<none>");
+            out.print(", isNonZero = ", isNonZero);
+            if (valueNode)
+                out.print(", valueNode = ", *valueNode);
+            out.print("}");
+        }
+
+        BasicBlock* block { nullptr };
+        bool hasValue { false };
+        bool isNonZero { false };
+        int64_t value { 0 };
+        Value* valueNode { nullptr };
+    };
+
+    Procedure& m_proc;
+    InsertionSet m_insertionSet;
+};
+
+} // anonymous namespace
+
+void foldPathConstants(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "foldPathConstants");
+    FoldPathConstants foldPathConstants(proc);
+    foldPathConstants.run();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3FoldPathConstants.h b/b3/B3FoldPathConstants.h
new file mode 100644
index 0000000..a55c770
--- /dev/null
+++ b/b3/B3FoldPathConstants.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Does very basic simplification of uses of values that were branched on by a dominating branch.
+
+void foldPathConstants(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3FrequencyClass.cpp b/b3/B3FrequencyClass.cpp
new file mode 100644
index 0000000..816850c
--- /dev/null
+++ b/b3/B3FrequencyClass.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3FrequencyClass.h"
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC::B3;
+
+void printInternal(PrintStream& out, FrequencyClass frequency)
+{
+    switch (frequency) {
+    case FrequencyClass::Normal:
+        out.print("Normal");
+        return;
+    case FrequencyClass::Rare:
+        out.print("Rare");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3FrequencyClass.h b/b3/B3FrequencyClass.h
new file mode 100644
index 0000000..607c439
--- /dev/null
+++ b/b3/B3FrequencyClass.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+enum class FrequencyClass : uint8_t {
+    // We don't have any hypothesis about the frequency of this control flow construct. This is
+    // the common case. We can still use basic block frequency in this case.
+    Normal,
+
+    // We expect that this control flow construct will be reached super rarely. It's valid to
+    // perform optimizations that punish Rare code. Note that there will be situations where you
+    // have to somehow construct a new frequency class from a merging of multiple classes. When
+    // this happens, never choose Rare; always go with Normal. This is necessary because we
+    // really do punish Rare code very badly.
+    Rare
+};
+
+inline FrequencyClass maxFrequency(FrequencyClass a, FrequencyClass b)
+{
+    if (a == FrequencyClass::Normal)
+        return FrequencyClass::Normal;
+    return b;
+}
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::B3::FrequencyClass);
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3FrequentedBlock.h b/b3/B3FrequentedBlock.h
new file mode 100644
index 0000000..9b63ff4
--- /dev/null
+++ b/b3/B3FrequentedBlock.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3GenericFrequentedBlock.h"
+
+namespace JSC { namespace B3 {
+
+class BasicBlock;
+
+typedef GenericFrequentedBlock<BasicBlock> FrequentedBlock;
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Generate.cpp b/b3/B3Generate.cpp
new file mode 100644
index 0000000..e328c6a
--- /dev/null
+++ b/b3/B3Generate.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Generate.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirGenerate.h"
+#include "AirInstInlines.h"
+#include "B3Common.h"
+#include "B3DuplicateTails.h"
+#include "B3EliminateCommonSubexpressions.h"
+#include "B3FixSSA.h"
+#include "B3FoldPathConstants.h"
+#include "B3InferSwitches.h"
+#include "B3LegalizeMemoryOffsets.h"
+#include "B3LowerMacros.h"
+#include "B3LowerMacrosAfterOptimizations.h"
+#include "B3LowerToAir.h"
+#include "B3MoveConstants.h"
+#include "B3Procedure.h"
+#include "B3ReduceDoubleToFloat.h"
+#include "B3ReduceStrength.h"
+#include "B3TimingScope.h"
+#include "B3Validate.h"
+#include "PCToCodeOriginMap.h"
+
+namespace JSC { namespace B3 {
+
+void prepareForGeneration(Procedure& procedure, unsigned optLevel)
+{
+    TimingScope timingScope("prepareForGeneration");
+
+    generateToAir(procedure, optLevel);
+    Air::prepareForGeneration(procedure.code());
+}
+
+void generate(Procedure& procedure, CCallHelpers& jit)
+{
+    Air::generate(procedure.code(), jit);
+}
+
+void generateToAir(Procedure& procedure, unsigned optLevel)
+{
+    TimingScope timingScope("generateToAir");
+    
+    if (shouldDumpIR(B3Mode) && !shouldDumpIRAtEachPhase(B3Mode)) {
+        dataLog("Initial B3:\n");
+        dataLog(procedure);
+    }
+
+    // We don't require the incoming IR to have predecessors computed.
+    procedure.resetReachability();
+    
+    if (shouldValidateIR())
+        validate(procedure);
+
+    if (optLevel >= 1) {
+        reduceDoubleToFloat(procedure);
+        reduceStrength(procedure);
+        eliminateCommonSubexpressions(procedure);
+        inferSwitches(procedure);
+        duplicateTails(procedure);
+        fixSSA(procedure);
+        foldPathConstants(procedure);
+        
+        // FIXME: Add more optimizations here.
+        // https://bugs.webkit.org/show_bug.cgi?id=150507
+    }
+
+    lowerMacros(procedure);
+
+    if (optLevel >= 1) {
+        reduceStrength(procedure);
+
+        // FIXME: Add more optimizations here.
+        // https://bugs.webkit.org/show_bug.cgi?id=150507
+    }
+
+    lowerMacrosAfterOptimizations(procedure);
+    legalizeMemoryOffsets(procedure);
+    moveConstants(procedure);
+
+    // FIXME: We should run pureCSE here to clean up some platform specific changes from the previous phases.
+    // https://bugs.webkit.org/show_bug.cgi?id=164873
+
+    if (shouldValidateIR())
+        validate(procedure);
+    
+    // If we're doing super verbose dumping, the phase scope of any phase will already do a dump.
+    // Note that lowerToAir() acts like a phase in this regard.
+    if (shouldDumpIR(B3Mode) && !shouldDumpIRAtEachPhase(B3Mode)) {
+        dataLog("B3 after ", procedure.lastPhaseName(), ", before generation:\n");
+        dataLog(procedure);
+    }
+
+    lowerToAir(procedure);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3Generate.h b/b3/B3Generate.h
new file mode 100644
index 0000000..2ffcd0e
--- /dev/null
+++ b/b3/B3Generate.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC {
+
+class CCallHelpers;
+
+namespace B3 {
+
+class Procedure;
+namespace Air { class Code; }
+
+// This takes a B3::Procedure, optimizes it in-place, lowers it to Air, and prepares the Air for
+// generation.
+JS_EXPORT_PRIVATE void prepareForGeneration(Procedure&, unsigned optLevel = 1);
+
+// This takes a B3::Procedure that has been prepared for generation (i.e. it has been lowered to Air and
+// the Air has been prepared for generation) and generates it. This is the equivalent of calling
+// Air::generate() on the Procedure::code().
+JS_EXPORT_PRIVATE void generate(Procedure&, CCallHelpers&);
+
+// This takes a B3::Procedure, optimizes it in-place, and lowers it to Air. You can then generate
+// the Air to machine code using Air::prepareForGeneration() and Air::generate() on the Procedure's
+// code().
+void generateToAir(Procedure&, unsigned optLevel = 1);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3GenericFrequentedBlock.h b/b3/B3GenericFrequentedBlock.h
new file mode 100644
index 0000000..1c5e75c
--- /dev/null
+++ b/b3/B3GenericFrequentedBlock.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3FrequencyClass.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+// A frequented block is a tuple of BasicBlock* and FrequencyClass. It's usually used as a
+// successor edge.
+
+template<typename BasicBlock>
+class GenericFrequentedBlock {
+public:
+    GenericFrequentedBlock(
+        BasicBlock* block = nullptr, FrequencyClass frequency = FrequencyClass::Normal)
+        : m_block(block)
+        , m_frequency(frequency)
+    {
+    }
+
+    bool operator==(const GenericFrequentedBlock& other) const
+    {
+        return m_block == other.m_block
+            && m_frequency == other.m_frequency;
+    }
+
+    bool operator!=(const GenericFrequentedBlock& other) const
+    {
+        return !(*this == other);
+    }
+
+    explicit operator bool() const
+    {
+        return *this != GenericFrequentedBlock();
+    }
+
+    BasicBlock* block() const { return m_block; }
+    BasicBlock*& block() { return m_block; }
+    FrequencyClass frequency() const { return m_frequency; }
+    FrequencyClass& frequency() { return m_frequency; }
+
+    bool isRare() const { return frequency() == FrequencyClass::Rare; }
+
+    void dump(PrintStream& out) const
+    {
+        if (frequency() != FrequencyClass::Normal)
+            out.print(frequency(), ":");
+        out.print(pointerDump(m_block));
+    }
+
+private:
+    BasicBlock* m_block;
+    FrequencyClass m_frequency;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3HeapRange.cpp b/b3/B3HeapRange.cpp
new file mode 100644
index 0000000..a5768f9
--- /dev/null
+++ b/b3/B3HeapRange.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3HeapRange.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+void HeapRange::dump(PrintStream& out) const
+{
+    if (*this == HeapRange()) {
+        out.print("Bottom");
+        return;
+    }
+    if (*this == top()) {
+        out.print("Top");
+        return;
+    }
+    out.print(m_begin, "...", m_end);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3HeapRange.h b/b3/B3HeapRange.h
new file mode 100644
index 0000000..03866bd
--- /dev/null
+++ b/b3/B3HeapRange.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <limits.h>
+#include <wtf/MathExtras.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+// Alias analysis in B3 is done by checking if two integer ranges overlap. This is powerful enough
+// to be used for TBAA-style alias analysis used by the DFG, FTL, and LLVM: you just turn each node
+// in the tree of abstract heaps into a pre/post range.
+//
+// Note that the 'begin' is inclusive, while the 'end' is exclusive. These two ranges are non-
+// overlapping:
+//
+//     rangeA = 0...8
+//     rangeB = 8...16
+
+class HeapRange {
+public:
+    typedef unsigned Type;
+    
+    HeapRange()
+        : m_begin(0)
+        , m_end(0)
+    {
+    }
+
+    explicit HeapRange(unsigned value)
+        : m_begin(value)
+        , m_end(value + 1)
+    {
+        ASSERT(m_end >= m_begin);
+    }
+
+    HeapRange(unsigned begin, unsigned end)
+        : m_begin(begin)
+        , m_end(end)
+    {
+        ASSERT(m_end >= m_begin);
+        if (m_begin == m_end) {
+            // Canonicalize empty ranges.
+            m_begin = 0;
+            m_end = 0;
+        }
+    }
+
+    static HeapRange top()
+    {
+        return HeapRange(0, UINT_MAX);
+    }
+
+    bool operator==(const HeapRange& other) const
+    {
+        return m_begin == other.m_begin
+            && m_end == other.m_end;
+    }
+
+    bool operator!=(const HeapRange& other) const
+    {
+        return !(*this == other);
+    }
+    
+    explicit operator bool() const { return m_begin != m_end; }
+
+    unsigned begin() const { return m_begin; }
+    unsigned end() const { return m_end; }
+
+    bool overlaps(const HeapRange& other) const
+    {
+        return WTF::rangesOverlap(m_begin, m_end, other.m_begin, other.m_end);
+    }
+
+    JS_EXPORT_PRIVATE void dump(PrintStream& out) const;
+
+private:
+    unsigned m_begin;
+    unsigned m_end;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3InferSwitches.cpp b/b3/B3InferSwitches.cpp
new file mode 100644
index 0000000..2f17812
--- /dev/null
+++ b/b3/B3InferSwitches.cpp
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3InferSwitches.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3CaseCollectionInlines.h"
+#include "B3InsertionSetInlines.h"
+#include "B3PhaseScope.h"
+#include "B3ProcedureInlines.h"
+#include "B3SwitchValue.h"
+#include "B3UseCounts.h"
+#include "B3ValueInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+const bool verbose = false;
+
+class InferSwitches {
+public:
+    InferSwitches(Procedure& proc)
+        : m_proc(proc)
+        , m_insertionSet(proc)
+        , m_useCounts(proc)
+    {
+    }
+    
+    bool run()
+    {
+        if (verbose)
+            dataLog("B3 before inferSwitches:\n", m_proc);
+        
+        bool changed = true;
+        bool everChanged = false;
+        while (changed) {
+            changed = false;
+            
+            if (verbose)
+                dataLog("Performing fixpoint iteration:\n");
+            
+            for (BasicBlock* block : m_proc)
+                changed |= attemptToMergeWithPredecessor(block);
+
+            everChanged |= changed;
+        }
+        
+        if (everChanged) {
+            m_proc.resetReachability();
+            m_proc.invalidateCFG();
+            
+            m_proc.deleteOrphans();
+            
+            if (verbose)
+                dataLog("B3 after inferSwitches:\n", m_proc);
+            return true;
+        }
+        
+        return false;
+    }
+    
+private:
+    bool attemptToMergeWithPredecessor(BasicBlock* block)
+    {
+        // No point in considering the root block. We also don't consider blocks with multiple
+        // predecessors, but we could handle this if we made this code a bit more general and we were
+        // not afraid of code bloat.
+        if (block->numPredecessors() != 1)
+            return false;
+        
+        SwitchDescription description = describe(block);
+        if (verbose)
+            dataLog("Description of primary block ", *block, ": ", description, "\n");
+        if (!description) {
+            if (verbose)
+                dataLog("    Bailing because not switch-like.\n");
+            return false;
+        }
+        
+        // We know that this block behaves like a switch. But we need to verify that it doesn't also
+        // perform any effects or do expensive things. We don't want to create a switch if that will
+        // make expensive things execute unconditionally. We're very conservative about how we define
+        // "expensive".
+        for (Value* value : *block) {
+            if (value->isFree())
+                continue;
+            if (value == description.extra)
+                continue;
+            if (value == description.branch)
+                continue;
+            if (verbose)
+                dataLog("    Bailing because of ", deepDump(m_proc, value), "\n");
+            return false;
+        }
+        
+        BasicBlock* predecessor = block->predecessor(0);
+        SwitchDescription predecessorDescription = describe(predecessor);
+        if (verbose)
+            dataLog("    Description of predecessor block ", *predecessor, ": ", predecessorDescription, "\n");
+        if (!predecessorDescription) {
+            if (verbose)
+                dataLog("    Bailing because not switch-like.\n");
+            return false;
+        }
+        
+        // Both us and the predecessor are switch-like, but that doesn't mean that we're compatible.
+        // We may be switching on different values!
+        if (description.source != predecessorDescription.source) {
+            if (verbose)
+                dataLog("    Bailing because sources don't match.\n");
+            return false;
+        }
+        
+        // We expect that we are the fall-through destination of the predecessor. This is a bit of a
+        // goofy condition. If we were not the fall-through destination then our switch is probably
+        // just totally redundant and we should be getting rid of it. But we don't handle that here,
+        // yet.
+        if (predecessorDescription.fallThrough.block() != block) {
+            if (verbose)
+                dataLog("    Bailing because fall-through of predecessor is not the primary block.\n");
+            return false;
+        }
+        
+        // Make sure that there ain't no loops.
+        if (description.fallThrough.block() == block
+            || description.fallThrough.block() == predecessor) {
+            if (verbose)
+                dataLog("    Bailing because of fall-through loop.\n");
+            return false;
+        }
+        for (SwitchCase switchCase : description.cases) {
+            if (switchCase.targetBlock() == block
+                || switchCase.targetBlock() == predecessor) {
+                if (verbose)
+                    dataLog("    Bailing because of loop in primary cases.\n");
+                return false;
+            }
+        }
+        for (SwitchCase switchCase : predecessorDescription.cases) {
+            if (switchCase.targetBlock() == block
+                || switchCase.targetBlock() == predecessor) {
+                if (verbose)
+                    dataLog("    Bailing because of loop in predecessor cases.\n");
+                return false;
+            }
+        }
+        
+        if (verbose)
+            dataLog("    Doing it!\n");
+        // We're committed to doing the thing.
+        
+        // Delete the extra value from the predecessor, since that would break downstream inference
+        // on the next fixpoint iteration. We would think that this block is too expensive to merge
+        // because of the Equal or NotEqual value even though that value is dead! We know it's dead
+        // so we kill it ourselves.
+        for (Value* value : *predecessor) {
+            if (value == predecessorDescription.extra)
+                value->replaceWithNopIgnoringType();
+        }
+        
+        // Insert all non-terminal values from our block into our predecessor. We definitely need to
+        // do this for constants. We must not do it for the extra value, since that would break
+        // downstream inference on the next fixpoint iteration. As a bonus, we don't do it for nops,
+        // so that we limit how big blocks get in this phase.
+        for (unsigned i = 0; i < block->size() - 1; ++i) {
+            Value* value = block->at(i);
+            if (value != description.extra && value->opcode() != Nop)
+                m_insertionSet.insertValue(predecessor->size() - 1, value);
+        }
+        m_insertionSet.execute(predecessor);
+        block->values().resize(0);
+        block->appendNew<Value>(m_proc, Oops, description.branch->origin());
+        block->removePredecessor(predecessor);
+        
+        for (BasicBlock* successorBlock : description.block->successorBlocks())
+            successorBlock->replacePredecessor(block, predecessor);
+
+        block->clearSuccessors();
+        
+        SwitchValue* switchValue = predecessor->replaceLastWithNew<SwitchValue>(
+            m_proc, predecessor->last()->origin(), description.source);
+        predecessor->clearSuccessors();
+        switchValue->setFallThrough(description.fallThrough);
+        
+        Vector<int64_t> predecessorCases;
+        for (SwitchCase switchCase : predecessorDescription.cases) {
+            switchValue->appendCase(switchCase);
+            predecessorCases.append(switchCase.caseValue());
+        }
+        std::sort(predecessorCases.begin(), predecessorCases.end());
+        auto isPredecessorCase = [&] (int64_t value) -> bool {
+            return !!tryBinarySearch<int64_t>(
+                predecessorCases, predecessorCases.size(), value,
+                [] (int64_t* element) -> int64_t { return *element; });
+        };
+        
+        for (SwitchCase switchCase : description.cases) {
+            if (!isPredecessorCase(switchCase.caseValue()))
+                switchValue->appendCase(switchCase);
+        }
+        return true;
+    }
+
+    struct SwitchDescription {
+        SwitchDescription()
+        {
+        }
+        
+        explicit operator bool() { return !!block; }
+        
+        void dump(PrintStream& out) const
+        {
+            out.print(
+                "{block = ", pointerDump(block),
+                ", branch = ", pointerDump(branch),
+                ", extra = ", pointerDump(extra),
+                ", source = ", pointerDump(source),
+                ", cases = ", listDump(cases),
+                ", fallThrough = ", fallThrough, "}");
+        }
+
+        BasicBlock* block { nullptr };
+        Value* branch { nullptr };
+        Value* extra { nullptr }; // This is the Equal or NotEqual value, if applicable.
+        Value* source { nullptr };
+        Vector<SwitchCase, 1> cases;
+        FrequentedBlock fallThrough;
+    };
+    
+    SwitchDescription describe(BasicBlock* block)
+    {
+        SwitchDescription result;
+        result.block = block;
+        result.branch = block->last();
+        
+        switch (result.branch->opcode()) {
+        case Branch: {
+            Value* predicate = result.branch->child(0);
+            FrequentedBlock taken = result.block->taken();
+            FrequentedBlock notTaken = result.block->notTaken();
+            bool handled = false;
+            // NOTE: This uses UseCounts that we computed before any transformation. This is fine
+            // because although we may have mutated the IR, we would not have added any new
+            // predicates.
+            if (predicate->numChildren() == 2
+                && predicate->child(1)->hasInt()
+                && m_useCounts.numUses(predicate) == 1) {
+                switch (predicate->opcode()) {
+                case Equal:
+                    result.source = predicate->child(0);
+                    result.extra = predicate;
+                    result.cases.append(SwitchCase(predicate->child(1)->asInt(), taken));
+                    result.fallThrough = notTaken;
+                    handled = true;
+                    break;
+                case NotEqual:
+                    result.source = predicate->child(0);
+                    result.extra = predicate;
+                    result.cases.append(SwitchCase(predicate->child(1)->asInt(), notTaken));
+                    result.fallThrough = taken;
+                    handled = true;
+                    break;
+                default:
+                    break;
+                }
+            }
+            if (handled)
+                break;
+            result.source = predicate;
+            result.cases.append(SwitchCase(0, notTaken));
+            result.fallThrough = taken;
+            break;
+        }
+            
+        case Switch: {
+            SwitchValue* switchValue = result.branch->as<SwitchValue>();
+            result.source = switchValue->child(0);
+            for (SwitchCase switchCase : switchValue->cases(result.block))
+                result.cases.append(switchCase);
+            result.fallThrough = result.block->fallThrough();
+            break;
+        }
+            
+        default:
+            result.block = nullptr;
+            result.branch = nullptr;
+            break;
+        }
+        
+        return result;
+    }
+    
+    Procedure& m_proc;
+    InsertionSet m_insertionSet;
+    UseCounts m_useCounts;
+};
+
+} // anonymous namespace
+
+bool inferSwitches(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "inferSwitches");
+    InferSwitches inferSwitches(proc);
+    return inferSwitches.run();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3InferSwitches.h b/b3/B3InferSwitches.h
new file mode 100644
index 0000000..d0466f8
--- /dev/null
+++ b/b3/B3InferSwitches.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Fixpoints to convert chains of branches into switches.
+
+bool inferSwitches(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABE(B3_JIT)
diff --git a/b3/B3InsertionSet.cpp b/b3/B3InsertionSet.cpp
new file mode 100644
index 0000000..a6e119f
--- /dev/null
+++ b/b3/B3InsertionSet.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3InsertionSet.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlock.h"
+#include "B3ProcedureInlines.h"
+#include "B3ValueInlines.h"
+#include <wtf/BubbleSort.h>
+
+namespace JSC { namespace B3 {
+
+Value* InsertionSet::insertIntConstant(size_t index, Origin origin, Type type, int64_t value)
+{
+    return insertValue(index, m_procedure.addIntConstant(origin, type, value));
+}
+
+Value* InsertionSet::insertIntConstant(size_t index, Value* likeValue, int64_t value)
+{
+    return insertIntConstant(index, likeValue->origin(), likeValue->type(), value);
+}
+
+Value* InsertionSet::insertBottom(size_t index, Origin origin, Type type)
+{
+    Value*& bottom = m_bottomForType[type];
+    if (!bottom)
+        bottom = insertValue(index, m_procedure.addBottom(origin, type));
+    return bottom;
+}
+
+Value* InsertionSet::insertBottom(size_t index, Value* likeValue)
+{
+    return insertBottom(index, likeValue->origin(), likeValue->type());
+}
+
+void InsertionSet::execute(BasicBlock* block)
+{
+    bubbleSort(m_insertions.begin(), m_insertions.end());
+    executeInsertions(block->m_values, m_insertions);
+    m_bottomForType = TypeMap<Value*>();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3InsertionSet.h b/b3/B3InsertionSet.h
new file mode 100644
index 0000000..1eb5272
--- /dev/null
+++ b/b3/B3InsertionSet.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Origin.h"
+#include "B3Type.h"
+#include "B3TypeMap.h"
+#include <wtf/Insertion.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class BasicBlock;
+class Procedure;
+class Value;
+
+typedef WTF::Insertion<Value*> Insertion;
+
+class InsertionSet {
+public:
+    InsertionSet(Procedure& procedure)
+        : m_procedure(procedure)
+    {
+    }
+
+    bool isEmpty() const { return m_insertions.isEmpty(); }
+
+    Procedure& code() { return m_procedure; }
+
+    void appendInsertion(const Insertion& insertion)
+    {
+        m_insertions.append(insertion);
+    }
+
+    Value* insertValue(size_t index, Value* value)
+    {
+        appendInsertion(Insertion(index, value));
+        return value;
+    }
+
+    template<typename ValueType, typename... Arguments>
+    ValueType* insert(size_t index, Arguments... arguments);
+
+    Value* insertIntConstant(size_t index, Origin, Type, int64_t value);
+    Value* insertIntConstant(size_t index, Value* likeValue, int64_t value);
+
+    Value* insertBottom(size_t index, Origin, Type);
+    Value* insertBottom(size_t index, Value*);
+
+    void execute(BasicBlock*);
+
+private:
+    Procedure& m_procedure;
+    Vector<Insertion, 8> m_insertions;
+
+    TypeMap<Value*> m_bottomForType;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3InsertionSetInlines.h b/b3/B3InsertionSetInlines.h
new file mode 100644
index 0000000..c5b03df
--- /dev/null
+++ b/b3/B3InsertionSetInlines.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3InsertionSet.h"
+#include "B3ProcedureInlines.h"
+
+namespace JSC { namespace B3 {
+
+template<typename ValueType, typename... Arguments>
+ValueType* InsertionSet::insert(size_t index, Arguments... arguments)
+{
+    return static_cast<ValueType*>(insertValue(index, m_procedure.add<ValueType>(arguments...)));
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Kind.cpp b/b3/B3Kind.cpp
new file mode 100644
index 0000000..147ab23
--- /dev/null
+++ b/b3/B3Kind.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Kind.h"
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/CommaPrinter.h>
+
+namespace JSC { namespace B3 {
+
+void Kind::dump(PrintStream& out) const
+{
+    out.print(m_opcode);
+    
+    CommaPrinter comma(", ", "<");
+    if (isChill())
+        out.print(comma, "Chill");
+    if (traps())
+        out.print(comma, "Traps");
+    if (comma.didPrint())
+        out.print(">");
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3Kind.h b/b3/B3Kind.h
new file mode 100644
index 0000000..268c8e7
--- /dev/null
+++ b/b3/B3Kind.h
@@ -0,0 +1,236 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef B3Kind_h
+#define B3Kind_h
+
+#if ENABLE(B3_JIT)
+
+#include "B3Opcode.h"
+#include <wtf/HashTable.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+// A Kind is a terse summary of what a Value does. There is a fixed number of possible
+// Kinds. Kind is a tuple of Opcode (see B3Opcode.h) and some extra bits. Most opcodes don't
+// get any extra bits, and those bits must remain zero if the Kind's opcode field is set to
+// one of those opcodes. The purpose of Kind is to be like an opcode in other IRs, but to
+// be multidimensional. For example, a Load has many dimensions of customization that we may
+// eventually implement. A Load can have different alignments, alignment failure modes,
+// temporality modes, trapping modes, ordering modes, etc. It's fine to put such flags into
+// subclasses of Value, but in some cases that would be overkill, particularly since if you
+// did that for a pure value then you'd also have to thread it through ValueKey. It's much
+// easier to put it in Kind, and then your extra bit will get carried around by everyone who
+// knows how to carry around Kinds. Most importantly, putting flags into Kind allows you to
+// use them as part of B3::Value's dynamic cast facility. For example we could have a
+// trapping Load that uses a Value subclass that has a stackmap while non-trapping Loads
+// continue to use the normal MemoryValue.
+//
+// Note that any code in the compiler that transcribes IR (like a strength reduction that
+// replaces an Add with a different Add, or even with a different opcode entirely) will
+// probably drop unknown bits by default. This is definitely not correct for many bits (like
+// isChill for Div/Mod and all of the envisioned Load/Store flags), so if you add a new bit
+// you will probably have to audit the compiler to make sure that phases that transcribe
+// your opcode do the right thing with your bit.
+
+class Kind {
+public:
+    Kind(Opcode opcode)
+        : m_opcode(opcode)
+        , m_isChill(false)
+        , m_traps(false)
+    {
+    }
+    
+    Kind()
+        : Kind(Oops)
+    {
+    }
+    
+    Opcode opcode() const { return m_opcode; }
+    void setOpcode(Opcode opcode) { m_opcode = opcode; }
+    
+    bool hasExtraBits() const { return m_isChill || m_traps; }
+    
+    // Chill bit. This applies to division-based arithmetic ops, which may trap on some
+    // platforms or exhibit bizarre behavior when passed certain inputs. The non-chill
+    // version will behave as unpredictably as it wants. For example, it's legal to
+    // constant-fold Div(x, 0) to any value or to replace it with any effectful operation.
+    // But when it's chill, that means that the semantics when it would have trapped are
+    // the JS semantics. For example, Div<Chill>(@a, @b) means:
+    //
+    //     ((a | 0) / (b | 0)) | 0
+    //
+    // And Mod<Chill>(a, b) means:
+    //
+    //     ((a | 0) % (b | 0)) | 0
+    //
+    // Note that Div<Chill> matches exactly how ARM handles integer division.
+    bool hasIsChill() const
+    {
+        switch (m_opcode) {
+        case Div:
+        case Mod:
+            return true;
+        default:
+            return false;
+        }
+    }
+    bool isChill() const
+    {
+        return m_isChill;
+    }
+    void setIsChill(bool isChill)
+    {
+        ASSERT(hasIsChill());
+        m_isChill = isChill;
+    }
+    
+    // Traps bit. This applies to memory access ops. It means that the instruction could
+    // trap as part of some check it performs, and that we mean to make this observable. This
+    // currently only applies to memory accesses (loads and stores). You don't get to find out where
+    // in the Procedure the trap happened. If you try to work it out using Origin, you'll have a bad
+    // time because the instruction selector is too sloppy with Origin().
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=162688
+    bool hasTraps() const
+    {
+        switch (m_opcode) {
+        case Load8Z:
+        case Load8S:
+        case Load16Z:
+        case Load16S:
+        case Load:
+        case Store8:
+        case Store16:
+        case Store:
+            return true;
+        default:
+            return false;
+        }
+    }
+    bool traps() const
+    {
+        return m_traps;
+    }
+    void setTraps(bool traps)
+    {
+        ASSERT(hasTraps());
+        m_traps = traps;
+    }
+    
+    // Rules for adding new properties:
+    // - Put the accessors here.
+    // - hasBlah() should check if the opcode allows for your property.
+    // - blah() returns a default value if !hasBlah()
+    // - setBlah() asserts if !hasBlah()
+    // - Try not to increase the size of Kind too much. But it wouldn't be the end of the
+    //   world if it bloated to 64 bits.
+    
+    bool operator==(const Kind& other) const
+    {
+        return m_opcode == other.m_opcode
+            && m_isChill == other.m_isChill
+            && m_traps == other.m_traps;
+    }
+    
+    bool operator!=(const Kind& other) const
+    {
+        return !(*this == other);
+    }
+    
+    void dump(PrintStream&) const;
+    
+    unsigned hash() const
+    {
+        // It's almost certainly more important that this hash function is cheap to compute than
+        // anything else. We can live with some kind hash collisions.
+        return m_opcode + (static_cast<unsigned>(m_isChill) << 16) + (static_cast<unsigned>(m_traps) << 7);
+    }
+    
+    Kind(WTF::HashTableDeletedValueType)
+        : m_opcode(Oops)
+        , m_isChill(true)
+        , m_traps(false)
+    {
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return *this == Kind(WTF::HashTableDeletedValue);
+    }
+    
+private:
+    Opcode m_opcode;
+    bool m_isChill : 1;
+    bool m_traps : 1;
+};
+
+// For every flag 'foo' you add, it's customary to create a Kind B3::foo(Kind) function that makes
+// a kind with the flag set. For example, for chill, this lets us say:
+//
+//     block->appendNew<Value>(m_proc, chill(Mod), Origin(), a, b);
+//
+// I like to make the flag name fill in the sentence "Mod _____" (like "isChill" or "traps") while
+// the flag constructor fills in the phrase "_____ Mod" (like "chill" or "trapping").
+
+inline Kind chill(Kind kind)
+{
+    kind.setIsChill(true);
+    return kind;
+}
+
+inline Kind trapping(Kind kind)
+{
+    kind.setTraps(true);
+    return kind;
+}
+
+struct KindHash {
+    static unsigned hash(const Kind& key) { return key.hash(); }
+    static bool equal(const Kind& a, const Kind& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::B3::Kind> {
+    typedef JSC::B3::KindHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::B3::Kind> : public SimpleClassHashTraits<JSC::B3::Kind> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
+
+#endif // B3Kind_h
+
diff --git a/b3/B3LegalizeMemoryOffsets.cpp b/b3/B3LegalizeMemoryOffsets.cpp
new file mode 100644
index 0000000..8c17ff5
--- /dev/null
+++ b/b3/B3LegalizeMemoryOffsets.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "B3LegalizeMemoryOffsets.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "B3InsertionSetInlines.h"
+#include "B3MemoryValue.h"
+#include "B3PhaseScope.h"
+#include "B3ProcedureInlines.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+class LegalizeMemoryOffsets {
+public:
+    LegalizeMemoryOffsets(Procedure& proc)
+        : m_proc(proc)
+        , m_insertionSet(proc)
+    {
+    }
+
+    void run()
+    {
+        if (!isARM64())
+            return;
+
+        for (BasicBlock* block : m_proc) {
+            for (unsigned index = 0; index < block->size(); ++index) {
+                MemoryValue* memoryValue = block->at(index)->as<MemoryValue>();
+                if (!memoryValue)
+                    continue;
+
+                int32_t offset = memoryValue->offset();
+                Air::Arg::Width width = Air::Arg::widthForBytes(memoryValue->accessByteSize());
+                if (!Air::Arg::isValidAddrForm(offset, width)) {
+                    Value* base = memoryValue->lastChild();
+                    Value* offsetValue = m_insertionSet.insertIntConstant(index, memoryValue->origin(), pointerType(), offset);
+                    Value* resolvedAddress = m_proc.add<Value>(Add, memoryValue->origin(), base, offsetValue);
+                    m_insertionSet.insertValue(index, resolvedAddress);
+
+                    memoryValue->lastChild() = resolvedAddress;
+                    memoryValue->setOffset(0);
+                }
+            }
+            m_insertionSet.execute(block);
+        }
+    }
+
+    Procedure& m_proc;
+    InsertionSet m_insertionSet;
+};
+
+} // anonymous namespace
+
+void legalizeMemoryOffsets(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "legalizeMemoryOffsets");
+    LegalizeMemoryOffsets legalizeMemoryOffsets(proc);
+    legalizeMemoryOffsets.run();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3LegalizeMemoryOffsets.h b/b3/B3LegalizeMemoryOffsets.h
new file mode 100644
index 0000000..c482ab2
--- /dev/null
+++ b/b3/B3LegalizeMemoryOffsets.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// If the offsets of a MemoryValue cannot be represented in the target instruction set,
+// compute it explicitly.
+void legalizeMemoryOffsets(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3LowerMacros.cpp b/b3/B3LowerMacros.cpp
new file mode 100644
index 0000000..6841510
--- /dev/null
+++ b/b3/B3LowerMacros.cpp
@@ -0,0 +1,500 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3LowerMacros.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AllowMacroScratchRegisterUsage.h"
+#include "B3BasicBlockInlines.h"
+#include "B3BlockInsertionSet.h"
+#include "B3CCallValue.h"
+#include "B3CaseCollectionInlines.h"
+#include "B3ConstPtrValue.h"
+#include "B3InsertionSetInlines.h"
+#include "B3MemoryValue.h"
+#include "B3PatchpointValue.h"
+#include "B3PhaseScope.h"
+#include "B3ProcedureInlines.h"
+#include "B3StackmapGenerationParams.h"
+#include "B3SwitchValue.h"
+#include "B3UpsilonValue.h"
+#include "B3ValueInlines.h"
+#include "CCallHelpers.h"
+#include "LinkBuffer.h"
+#include <cmath>
+#include <wtf/BitVector.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+class LowerMacros {
+public:
+    LowerMacros(Procedure& proc)
+        : m_proc(proc)
+        , m_blockInsertionSet(proc)
+        , m_insertionSet(proc)
+    {
+    }
+
+    bool run()
+    {
+        for (BasicBlock* block : m_proc) {
+            m_block = block;
+            processCurrentBlock();
+        }
+        m_changed |= m_blockInsertionSet.execute();
+        if (m_changed) {
+            m_proc.resetReachability();
+            m_proc.invalidateCFG();
+        }
+        return m_changed;
+    }
+    
+private:
+    void processCurrentBlock()
+    {
+        for (m_index = 0; m_index < m_block->size(); ++m_index) {
+            m_value = m_block->at(m_index);
+            m_origin = m_value->origin();
+            switch (m_value->opcode()) {
+            case Mod: {
+                if (m_value->isChill()) {
+                    if (isARM64()) {
+                        BasicBlock* before = m_blockInsertionSet.splitForward(m_block, m_index, &m_insertionSet);
+                        BasicBlock* zeroDenCase = m_blockInsertionSet.insertBefore(m_block);
+                        BasicBlock* normalModCase = m_blockInsertionSet.insertBefore(m_block);
+
+                        before->replaceLastWithNew<Value>(m_proc, Branch, m_origin, m_value->child(1));
+                        before->setSuccessors(
+                            FrequentedBlock(normalModCase, FrequencyClass::Normal),
+                            FrequentedBlock(zeroDenCase, FrequencyClass::Rare));
+
+                        Value* divResult = normalModCase->appendNew<Value>(m_proc, chill(Div), m_origin, m_value->child(0), m_value->child(1));
+                        Value* multipliedBack = normalModCase->appendNew<Value>(m_proc, Mul, m_origin, divResult, m_value->child(1));
+                        Value* result = normalModCase->appendNew<Value>(m_proc, Sub, m_origin, m_value->child(0), multipliedBack);
+                        UpsilonValue* normalResult = normalModCase->appendNew<UpsilonValue>(m_proc, m_origin, result);
+                        normalModCase->appendNew<Value>(m_proc, Jump, m_origin);
+                        normalModCase->setSuccessors(FrequentedBlock(m_block));
+
+                        UpsilonValue* zeroResult = zeroDenCase->appendNew<UpsilonValue>(
+                            m_proc, m_origin,
+                            zeroDenCase->appendIntConstant(m_proc, m_value, 0));
+                        zeroDenCase->appendNew<Value>(m_proc, Jump, m_origin);
+                        zeroDenCase->setSuccessors(FrequentedBlock(m_block));
+
+                        Value* phi = m_insertionSet.insert<Value>(m_index, Phi, m_value->type(), m_origin);
+                        normalResult->setPhi(phi);
+                        zeroResult->setPhi(phi);
+                        m_value->replaceWithIdentity(phi);
+                        before->updatePredecessorsAfter();
+                        m_changed = true;
+                    } else
+                        makeDivisionChill(Mod);
+                    break;
+                }
+                
+                double (*fmodDouble)(double, double) = fmod;
+                if (m_value->type() == Double) {
+                    Value* functionAddress = m_insertionSet.insert<ConstPtrValue>(m_index, m_origin, fmodDouble);
+                    Value* result = m_insertionSet.insert<CCallValue>(m_index, Double, m_origin,
+                        Effects::none(),
+                        functionAddress,
+                        m_value->child(0),
+                        m_value->child(1));
+                    m_value->replaceWithIdentity(result);
+                    m_changed = true;
+                } else if (m_value->type() == Float) {
+                    Value* numeratorAsDouble = m_insertionSet.insert<Value>(m_index, FloatToDouble, m_origin, m_value->child(0));
+                    Value* denominatorAsDouble = m_insertionSet.insert<Value>(m_index, FloatToDouble, m_origin, m_value->child(1));
+                    Value* functionAddress = m_insertionSet.insert<ConstPtrValue>(m_index, m_origin, fmodDouble);
+                    Value* doubleMod = m_insertionSet.insert<CCallValue>(m_index, Double, m_origin,
+                        Effects::none(),
+                        functionAddress,
+                        numeratorAsDouble,
+                        denominatorAsDouble);
+                    Value* result = m_insertionSet.insert<Value>(m_index, DoubleToFloat, m_origin, doubleMod);
+                    m_value->replaceWithIdentity(result);
+                    m_changed = true;
+                } else if (isARM64()) {
+                    Value* divResult = m_insertionSet.insert<Value>(m_index, chill(Div), m_origin, m_value->child(0), m_value->child(1));
+                    Value* multipliedBack = m_insertionSet.insert<Value>(m_index, Mul, m_origin, divResult, m_value->child(1));
+                    Value* result = m_insertionSet.insert<Value>(m_index, Sub, m_origin, m_value->child(0), multipliedBack);
+                    m_value->replaceWithIdentity(result);
+                    m_changed = true;
+                }
+                break;
+            }
+
+            case UMod: {
+                if (isARM64()) {
+                    Value* divResult = m_insertionSet.insert<Value>(m_index, UDiv, m_origin, m_value->child(0), m_value->child(1));
+                    Value* multipliedBack = m_insertionSet.insert<Value>(m_index, Mul, m_origin, divResult, m_value->child(1));
+                    Value* result = m_insertionSet.insert<Value>(m_index, Sub, m_origin, m_value->child(0), multipliedBack);
+                    m_value->replaceWithIdentity(result);
+                    m_changed = true;
+                }
+                break;
+            }
+
+            case Div: {
+                if (m_value->isChill())
+                    makeDivisionChill(Div);
+                break;
+            }
+
+            case Switch: {
+                SwitchValue* switchValue = m_value->as<SwitchValue>();
+                Vector<SwitchCase> cases;
+                for (const SwitchCase& switchCase : switchValue->cases(m_block))
+                    cases.append(switchCase);
+                std::sort(
+                    cases.begin(), cases.end(),
+                    [] (const SwitchCase& left, const SwitchCase& right) {
+                        return left.caseValue() < right.caseValue();
+                    });
+                FrequentedBlock fallThrough = m_block->fallThrough();
+                m_block->values().removeLast();
+                recursivelyBuildSwitch(cases, fallThrough, 0, false, cases.size(), m_block);
+                m_proc.deleteValue(switchValue);
+                m_block->updatePredecessorsAfter();
+                m_changed = true;
+                break;
+            }
+
+            default:
+                break;
+            }
+        }
+        m_insertionSet.execute(m_block);
+    }
+
+    void makeDivisionChill(Opcode nonChillOpcode)
+    {
+        ASSERT(nonChillOpcode == Div || nonChillOpcode == Mod);
+
+        // ARM supports this instruction natively.
+        if (isARM64())
+            return;
+
+        // We implement "res = Div<Chill>/Mod<Chill>(num, den)" as follows:
+        //
+        //     if (den + 1 <=_unsigned 1) {
+        //         if (!den) {
+        //             res = 0;
+        //             goto done;
+        //         }
+        //         if (num == -2147483648) {
+        //             res = isDiv ? num : 0;
+        //             goto done;
+        //         }
+        //     }
+        //     res = num (/ or %) dev;
+        // done:
+        m_changed = true;
+
+        Value* num = m_value->child(0);
+        Value* den = m_value->child(1);
+
+        Value* one = m_insertionSet.insertIntConstant(m_index, m_value, 1);
+        Value* isDenOK = m_insertionSet.insert<Value>(
+            m_index, Above, m_origin,
+            m_insertionSet.insert<Value>(m_index, Add, m_origin, den, one),
+            one);
+
+        BasicBlock* before = m_blockInsertionSet.splitForward(m_block, m_index, &m_insertionSet);
+
+        BasicBlock* normalDivCase = m_blockInsertionSet.insertBefore(m_block);
+        BasicBlock* shadyDenCase = m_blockInsertionSet.insertBefore(m_block);
+        BasicBlock* zeroDenCase = m_blockInsertionSet.insertBefore(m_block);
+        BasicBlock* neg1DenCase = m_blockInsertionSet.insertBefore(m_block);
+        BasicBlock* intMinCase = m_blockInsertionSet.insertBefore(m_block);
+
+        before->replaceLastWithNew<Value>(m_proc, Branch, m_origin, isDenOK);
+        before->setSuccessors(
+            FrequentedBlock(normalDivCase, FrequencyClass::Normal),
+            FrequentedBlock(shadyDenCase, FrequencyClass::Rare));
+
+        UpsilonValue* normalResult = normalDivCase->appendNew<UpsilonValue>(
+            m_proc, m_origin,
+            normalDivCase->appendNew<Value>(m_proc, nonChillOpcode, m_origin, num, den));
+        normalDivCase->appendNew<Value>(m_proc, Jump, m_origin);
+        normalDivCase->setSuccessors(FrequentedBlock(m_block));
+
+        shadyDenCase->appendNew<Value>(m_proc, Branch, m_origin, den);
+        shadyDenCase->setSuccessors(
+            FrequentedBlock(neg1DenCase, FrequencyClass::Normal),
+            FrequentedBlock(zeroDenCase, FrequencyClass::Rare));
+
+        UpsilonValue* zeroResult = zeroDenCase->appendNew<UpsilonValue>(
+            m_proc, m_origin,
+            zeroDenCase->appendIntConstant(m_proc, m_value, 0));
+        zeroDenCase->appendNew<Value>(m_proc, Jump, m_origin);
+        zeroDenCase->setSuccessors(FrequentedBlock(m_block));
+
+        int64_t badNumeratorConst = 0;
+        switch (m_value->type()) {
+        case Int32:
+            badNumeratorConst = std::numeric_limits<int32_t>::min();
+            break;
+        case Int64:
+            badNumeratorConst = std::numeric_limits<int64_t>::min();
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            badNumeratorConst = 0;
+        }
+
+        Value* badNumerator =
+            neg1DenCase->appendIntConstant(m_proc, m_value, badNumeratorConst);
+
+        neg1DenCase->appendNew<Value>(
+            m_proc, Branch, m_origin,
+            neg1DenCase->appendNew<Value>(
+                m_proc, Equal, m_origin, num, badNumerator));
+        neg1DenCase->setSuccessors(
+            FrequentedBlock(intMinCase, FrequencyClass::Rare),
+            FrequentedBlock(normalDivCase, FrequencyClass::Normal));
+
+        Value* intMinResult = nonChillOpcode == Div ? badNumerator : intMinCase->appendIntConstant(m_proc, m_value, 0);
+        UpsilonValue* intMinResultUpsilon = intMinCase->appendNew<UpsilonValue>(
+            m_proc, m_origin, intMinResult);
+        intMinCase->appendNew<Value>(m_proc, Jump, m_origin);
+        intMinCase->setSuccessors(FrequentedBlock(m_block));
+
+        Value* phi = m_insertionSet.insert<Value>(
+            m_index, Phi, m_value->type(), m_origin);
+        normalResult->setPhi(phi);
+        zeroResult->setPhi(phi);
+        intMinResultUpsilon->setPhi(phi);
+
+        m_value->replaceWithIdentity(phi);
+        before->updatePredecessorsAfter();
+    }
+
+    void recursivelyBuildSwitch(
+        const Vector<SwitchCase>& cases, FrequentedBlock fallThrough, unsigned start, bool hardStart,
+        unsigned end, BasicBlock* before)
+    {
+        Value* child = m_value->child(0);
+        Type type = child->type();
+        
+        // It's a good idea to use a table-based switch in some cases: the number of cases has to be
+        // large enough and they have to be dense enough. This could probably be improved a lot. For
+        // example, we could still use a jump table in cases where the inputs are sparse so long as we
+        // shift off the uninteresting bits. On the other hand, it's not clear that this would
+        // actually be any better than what we have done here and it's not clear that it would be
+        // better than a binary switch.
+        const unsigned minCasesForTable = 7;
+        const unsigned densityLimit = 4;
+        if (end - start >= minCasesForTable) {
+            int64_t firstValue = cases[start].caseValue();
+            int64_t lastValue = cases[end - 1].caseValue();
+            if ((lastValue - firstValue + 1) / (end - start) < densityLimit) {
+                BasicBlock* switchBlock = m_blockInsertionSet.insertAfter(m_block);
+                Value* index = before->appendNew<Value>(
+                    m_proc, Sub, m_origin, child,
+                    before->appendIntConstant(m_proc, m_origin, type, firstValue));
+                before->appendNew<Value>(
+                    m_proc, Branch, m_origin,
+                    before->appendNew<Value>(
+                        m_proc, Above, m_origin, index,
+                        before->appendIntConstant(m_proc, m_origin, type, lastValue - firstValue)));
+                before->setSuccessors(fallThrough, FrequentedBlock(switchBlock));
+                
+                size_t tableSize = lastValue - firstValue + 1;
+                
+                if (index->type() != pointerType() && index->type() == Int32)
+                    index = switchBlock->appendNew<Value>(m_proc, ZExt32, m_origin, index);
+                
+                PatchpointValue* patchpoint =
+                    switchBlock->appendNew<PatchpointValue>(m_proc, Void, m_origin);
+
+                // Even though this loads from the jump table, the jump table is immutable. For the
+                // purpose of alias analysis, reading something immutable is like reading nothing.
+                patchpoint->effects = Effects();
+                patchpoint->effects.terminal = true;
+                
+                patchpoint->appendSomeRegister(index);
+                patchpoint->numGPScratchRegisters++;
+                // Technically, we don't have to clobber macro registers on X86_64. This is probably
+                // OK though.
+                patchpoint->clobber(RegisterSet::macroScratchRegisters());
+                
+                BitVector handledIndices;
+                for (unsigned i = start; i < end; ++i) {
+                    FrequentedBlock block = cases[i].target();
+                    int64_t value = cases[i].caseValue();
+                    switchBlock->appendSuccessor(block);
+                    size_t index = value - firstValue;
+                    ASSERT(!handledIndices.get(index));
+                    handledIndices.set(index);
+                }
+                
+                bool hasUnhandledIndex = false;
+                for (unsigned i = 0; i < tableSize; ++i) {
+                    if (!handledIndices.get(i)) {
+                        hasUnhandledIndex = true;
+                        break;
+                    }
+                }
+                
+                if (hasUnhandledIndex)
+                    switchBlock->appendSuccessor(fallThrough);
+
+                patchpoint->setGenerator(
+                    [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+                        
+                        MacroAssemblerCodePtr* jumpTable = static_cast<MacroAssemblerCodePtr*>(
+                            params.proc().addDataSection(sizeof(MacroAssemblerCodePtr) * tableSize));
+                        
+                        GPRReg index = params[0].gpr();
+                        GPRReg scratch = params.gpScratch(0);
+                        
+                        jit.move(CCallHelpers::TrustedImmPtr(jumpTable), scratch);
+                        jit.jump(CCallHelpers::BaseIndex(scratch, index, CCallHelpers::timesPtr()));
+                        
+                        // These labels are guaranteed to be populated before either late paths or
+                        // link tasks run.
+                        Vector<Box<CCallHelpers::Label>> labels = params.successorLabels();
+                        
+                        jit.addLinkTask(
+                            [=] (LinkBuffer& linkBuffer) {
+                                if (hasUnhandledIndex) {
+                                    MacroAssemblerCodePtr fallThrough =
+                                        linkBuffer.locationOf(*labels.last());
+                                    for (unsigned i = tableSize; i--;)
+                                        jumpTable[i] = fallThrough;
+                                }
+                                
+                                unsigned labelIndex = 0;
+                                for (unsigned tableIndex : handledIndices) {
+                                    jumpTable[tableIndex] =
+                                        linkBuffer.locationOf(*labels[labelIndex++]);
+                                }
+                            });
+                    });
+                return;
+            }
+        }
+        
+        // See comments in jit/BinarySwitch.cpp for a justification of this algorithm. The only
+        // thing we do differently is that we don't use randomness.
+
+        const unsigned leafThreshold = 3;
+
+        unsigned size = end - start;
+
+        if (size <= leafThreshold) {
+            bool allConsecutive = false;
+
+            if ((hardStart || (start && cases[start - 1].caseValue() == cases[start].caseValue() - 1))
+                && end < cases.size()
+                && cases[end - 1].caseValue() == cases[end].caseValue() - 1) {
+                allConsecutive = true;
+                for (unsigned i = 0; i < size - 1; ++i) {
+                    if (cases[start + i].caseValue() + 1 != cases[start + i + 1].caseValue()) {
+                        allConsecutive = false;
+                        break;
+                    }
+                }
+            }
+
+            unsigned limit = allConsecutive ? size - 1 : size;
+            
+            for (unsigned i = 0; i < limit; ++i) {
+                BasicBlock* nextCheck = m_blockInsertionSet.insertAfter(m_block);
+                before->appendNew<Value>(
+                    m_proc, Branch, m_origin,
+                    before->appendNew<Value>(
+                        m_proc, Equal, m_origin, child,
+                        before->appendIntConstant(
+                            m_proc, m_origin, type,
+                            cases[start + i].caseValue())));
+                before->setSuccessors(cases[start + i].target(), FrequentedBlock(nextCheck));
+
+                before = nextCheck;
+            }
+
+            before->appendNew<Value>(m_proc, Jump, m_origin);
+            if (allConsecutive)
+                before->setSuccessors(cases[end - 1].target());
+            else
+                before->setSuccessors(fallThrough);
+            return;
+        }
+
+        unsigned medianIndex = (start + end) / 2;
+
+        BasicBlock* left = m_blockInsertionSet.insertAfter(m_block);
+        BasicBlock* right = m_blockInsertionSet.insertAfter(m_block);
+
+        before->appendNew<Value>(
+            m_proc, Branch, m_origin,
+            before->appendNew<Value>(
+                m_proc, LessThan, m_origin, child,
+                before->appendIntConstant(
+                    m_proc, m_origin, type,
+                    cases[medianIndex].caseValue())));
+        before->setSuccessors(FrequentedBlock(left), FrequentedBlock(right));
+
+        recursivelyBuildSwitch(cases, fallThrough, start, hardStart, medianIndex, left);
+        recursivelyBuildSwitch(cases, fallThrough, medianIndex, true, end, right);
+    }
+    
+    Procedure& m_proc;
+    BlockInsertionSet m_blockInsertionSet;
+    InsertionSet m_insertionSet;
+    BasicBlock* m_block;
+    unsigned m_index;
+    Value* m_value;
+    Origin m_origin;
+    bool m_changed { false };
+};
+
+bool lowerMacrosImpl(Procedure& proc)
+{
+    LowerMacros lowerMacros(proc);
+    return lowerMacros.run();
+}
+
+} // anonymous namespace
+
+bool lowerMacros(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "lowerMacros");
+    bool result = lowerMacrosImpl(proc);
+    if (shouldValidateIR())
+        RELEASE_ASSERT(!lowerMacrosImpl(proc));
+    return result;
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3LowerMacros.h b/b3/B3LowerMacros.h
new file mode 100644
index 0000000..f9649e2
--- /dev/null
+++ b/b3/B3LowerMacros.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Lowers high-level operations that it's easier to deal with once they are broken up. Currently
+// this includes Switch and ChillDiv.
+
+bool lowerMacros(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3LowerMacrosAfterOptimizations.cpp b/b3/B3LowerMacrosAfterOptimizations.cpp
new file mode 100644
index 0000000..dbe158b
--- /dev/null
+++ b/b3/B3LowerMacrosAfterOptimizations.cpp
@@ -0,0 +1,205 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3LowerMacrosAfterOptimizations.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3BlockInsertionSet.h"
+#include "B3CCallValue.h"
+#include "B3ConstDoubleValue.h"
+#include "B3ConstFloatValue.h"
+#include "B3ConstPtrValue.h"
+#include "B3InsertionSetInlines.h"
+#include "B3PhaseScope.h"
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+class LowerMacros {
+public:
+    LowerMacros(Procedure& proc)
+        : m_proc(proc)
+        , m_blockInsertionSet(proc)
+        , m_insertionSet(proc)
+    {
+    }
+
+    bool run()
+    {
+        for (BasicBlock* block : m_proc) {
+            m_block = block;
+            processCurrentBlock();
+        }
+        m_changed |= m_blockInsertionSet.execute();
+        if (m_changed) {
+            m_proc.resetReachability();
+            m_proc.invalidateCFG();
+        }
+        return m_changed;
+    }
+    
+private:
+    void processCurrentBlock()
+    {
+        for (m_index = 0; m_index < m_block->size(); ++m_index) {
+            m_value = m_block->at(m_index);
+            m_origin = m_value->origin();
+            switch (m_value->opcode()) {
+            case Abs: {
+                // ARM supports this instruction natively.
+                if (isARM64())
+                    break;
+
+                Value* mask = nullptr;
+                if (m_value->type() == Double)
+                    mask = m_insertionSet.insert<ConstDoubleValue>(m_index, m_origin, bitwise_cast<double>(~(1ll << 63)));
+                else if (m_value->type() == Float)
+                    mask = m_insertionSet.insert<ConstFloatValue>(m_index, m_origin, bitwise_cast<float>(~(1 << 31)));
+                else
+                    RELEASE_ASSERT_NOT_REACHED();
+                Value* result = m_insertionSet.insert<Value>(m_index, BitAnd, m_origin, m_value->child(0), mask);
+                m_value->replaceWithIdentity(result);
+                break;
+            }
+            case Ceil: {
+                if (MacroAssembler::supportsFloatingPointRounding())
+                    break;
+
+                Value* functionAddress = nullptr;
+                if (m_value->type() == Double) {
+                    double (*ceilDouble)(double) = ceil;
+                    functionAddress = m_insertionSet.insert<ConstPtrValue>(m_index, m_origin, ceilDouble);
+                } else if (m_value->type() == Float)
+                    functionAddress = m_insertionSet.insert<ConstPtrValue>(m_index, m_origin, ceilf);
+                else
+                    RELEASE_ASSERT_NOT_REACHED();
+
+                Value* result = m_insertionSet.insert<CCallValue>(m_index,
+                    m_value->type(),
+                    m_origin,
+                    Effects::none(),
+                    functionAddress,
+                    m_value->child(0));
+                m_value->replaceWithIdentity(result);
+                break;
+            }
+            case Floor: {
+                if (MacroAssembler::supportsFloatingPointRounding())
+                    break;
+
+                Value* functionAddress = nullptr;
+                if (m_value->type() == Double) {
+                    double (*floorDouble)(double) = floor;
+                    functionAddress = m_insertionSet.insert<ConstPtrValue>(m_index, m_origin, floorDouble);
+                } else if (m_value->type() == Float)
+                    functionAddress = m_insertionSet.insert<ConstPtrValue>(m_index, m_origin, floorf);
+                else
+                    RELEASE_ASSERT_NOT_REACHED();
+
+                Value* result = m_insertionSet.insert<CCallValue>(m_index,
+                    m_value->type(),
+                    m_origin,
+                    Effects::none(),
+                    functionAddress,
+                    m_value->child(0));
+                m_value->replaceWithIdentity(result);
+                break;
+            }
+            case Neg: {
+                if (!isFloat(m_value->type()))
+                    break;
+                
+                // X86 is odd in that it requires this.
+                if (!isX86())
+                    break;
+
+                Value* mask = nullptr;
+                if (m_value->type() == Double)
+                    mask = m_insertionSet.insert<ConstDoubleValue>(m_index, m_origin, -0.0);
+                else {
+                    RELEASE_ASSERT(m_value->type() == Float);
+                    mask = m_insertionSet.insert<ConstFloatValue>(m_index, m_origin, -0.0f);
+                }
+
+                Value* result = m_insertionSet.insert<Value>(
+                    m_index, BitXor, m_origin, m_value->child(0), mask);
+                m_value->replaceWithIdentity(result);
+                break;
+            }
+
+            case RotL: {
+                // ARM64 doesn't have a rotate left.
+                if (isARM64()) {
+                    if (isARM64()) {
+                        Value* newShift = m_insertionSet.insert<Value>(m_index, Neg, m_value->origin(), m_value->child(1));
+                        Value* rotate = m_insertionSet.insert<Value>(m_index, RotR, m_value->origin(), m_value->child(0), newShift);
+                        m_value->replaceWithIdentity(rotate);
+                        break;
+                    }
+                }
+                break;
+            }
+            default:
+                break;
+            }
+        }
+        m_insertionSet.execute(m_block);
+    }
+    
+    Procedure& m_proc;
+    BlockInsertionSet m_blockInsertionSet;
+    InsertionSet m_insertionSet;
+    BasicBlock* m_block;
+    unsigned m_index;
+    Value* m_value;
+    Origin m_origin;
+    bool m_changed { false };
+};
+
+bool lowerMacrosImpl(Procedure& proc)
+{
+    LowerMacros lowerMacros(proc);
+    return lowerMacros.run();
+}
+
+} // anonymous namespace
+
+bool lowerMacrosAfterOptimizations(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "lowerMacrosAfterOptimizations");
+    bool result = lowerMacrosImpl(proc);
+    if (shouldValidateIR())
+        RELEASE_ASSERT(!lowerMacrosImpl(proc));
+    return result;
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3LowerMacrosAfterOptimizations.h b/b3/B3LowerMacrosAfterOptimizations.h
new file mode 100644
index 0000000..f7b6536
--- /dev/null
+++ b/b3/B3LowerMacrosAfterOptimizations.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Lower certain high level opcodes to lower-level opcode to help code generation.
+
+bool lowerMacrosAfterOptimizations(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3LowerToAir.cpp b/b3/B3LowerToAir.cpp
new file mode 100644
index 0000000..1b2585f
--- /dev/null
+++ b/b3/B3LowerToAir.cpp
@@ -0,0 +1,2899 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3LowerToAir.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCCallSpecial.h"
+#include "AirCode.h"
+#include "AirInsertionSet.h"
+#include "AirInstInlines.h"
+#include "AirStackSlot.h"
+#include "B3ArgumentRegValue.h"
+#include "B3BasicBlockInlines.h"
+#include "B3BlockWorklist.h"
+#include "B3CCallValue.h"
+#include "B3CheckSpecial.h"
+#include "B3Commutativity.h"
+#include "B3Dominators.h"
+#include "B3FenceValue.h"
+#include "B3MemoryValue.h"
+#include "B3PatchpointSpecial.h"
+#include "B3PatchpointValue.h"
+#include "B3PhaseScope.h"
+#include "B3PhiChildren.h"
+#include "B3Procedure.h"
+#include "B3SlotBaseValue.h"
+#include "B3StackSlot.h"
+#include "B3UpsilonValue.h"
+#include "B3UseCounts.h"
+#include "B3ValueInlines.h"
+#include "B3Variable.h"
+#include "B3VariableValue.h"
+#include "B3WasmAddressValue.h"
+#include <wtf/IndexMap.h>
+#include <wtf/IndexSet.h>
+#include <wtf/ListDump.h>
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wreturn-type"
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+namespace JSC { namespace B3 {
+
+using namespace Air;
+
+namespace {
+
+const bool verbose = false;
+
+class LowerToAir {
+public:
+    LowerToAir(Procedure& procedure)
+        : m_valueToTmp(procedure.values().size())
+        , m_phiToTmp(procedure.values().size())
+        , m_blockToBlock(procedure.size())
+        , m_useCounts(procedure)
+        , m_phiChildren(procedure)
+        , m_dominators(procedure.dominators())
+        , m_procedure(procedure)
+        , m_code(procedure.code())
+    {
+    }
+
+    void run()
+    {
+        for (B3::BasicBlock* block : m_procedure)
+            m_blockToBlock[block] = m_code.addBlock(block->frequency());
+        
+        for (Value* value : m_procedure.values()) {
+            switch (value->opcode()) {
+            case Phi: {
+                m_phiToTmp[value] = m_code.newTmp(Arg::typeForB3Type(value->type()));
+                if (verbose)
+                    dataLog("Phi tmp for ", *value, ": ", m_phiToTmp[value], "\n");
+                break;
+            }
+            default:
+                break;
+            }
+        }
+
+        for (B3::StackSlot* stack : m_procedure.stackSlots())
+            m_stackToStack.add(stack, m_code.addStackSlot(stack));
+        for (Variable* variable : m_procedure.variables())
+            m_variableToTmp.add(variable, m_code.newTmp(Arg::typeForB3Type(variable->type())));
+
+        // Figure out which blocks are not rare.
+        m_fastWorklist.push(m_procedure[0]);
+        while (B3::BasicBlock* block = m_fastWorklist.pop()) {
+            for (B3::FrequentedBlock& successor : block->successors()) {
+                if (!successor.isRare())
+                    m_fastWorklist.push(successor.block());
+            }
+        }
+
+        m_procedure.resetValueOwners(); // Used by crossesInterference().
+
+        // Lower defs before uses on a global level. This is a good heuristic to lock down a
+        // hoisted address expression before we duplicate it back into the loop.
+        for (B3::BasicBlock* block : m_procedure.blocksInPreOrder()) {
+            m_block = block;
+            // Reset some state.
+            m_insts.resize(0);
+
+            m_isRare = !m_fastWorklist.saw(block);
+
+            if (verbose)
+                dataLog("Lowering Block ", *block, ":\n");
+            
+            // Process blocks in reverse order so we see uses before defs. That's what allows us
+            // to match patterns effectively.
+            for (unsigned i = block->size(); i--;) {
+                m_index = i;
+                m_value = block->at(i);
+                if (m_locked.contains(m_value))
+                    continue;
+                m_insts.append(Vector<Inst>());
+                if (verbose)
+                    dataLog("Lowering ", deepDump(m_procedure, m_value), ":\n");
+                lower();
+                if (verbose) {
+                    for (Inst& inst : m_insts.last())
+                        dataLog("    ", inst, "\n");
+                }
+            }
+
+            // Now append the instructions. m_insts contains them in reverse order, so we process
+            // it in reverse.
+            for (unsigned i = m_insts.size(); i--;) {
+                for (Inst& inst : m_insts[i])
+                    m_blockToBlock[block]->appendInst(WTFMove(inst));
+            }
+
+            // Make sure that the successors are set up correctly.
+            for (B3::FrequentedBlock successor : block->successors()) {
+                m_blockToBlock[block]->successors().append(
+                    Air::FrequentedBlock(m_blockToBlock[successor.block()], successor.frequency()));
+            }
+        }
+
+        Air::InsertionSet insertionSet(m_code);
+        for (Inst& inst : m_prologue)
+            insertionSet.insertInst(0, WTFMove(inst));
+        insertionSet.execute(m_code[0]);
+    }
+
+private:
+    bool shouldCopyPropagate(Value* value)
+    {
+        switch (value->opcode()) {
+        case Trunc:
+        case Identity:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    class ArgPromise {
+        WTF_MAKE_NONCOPYABLE(ArgPromise);
+    public:
+        ArgPromise() { }
+
+        ArgPromise(const Arg& arg, Value* valueToLock = nullptr)
+            : m_arg(arg)
+            , m_value(valueToLock)
+        {
+        }
+        
+        void swap(ArgPromise& other)
+        {
+            std::swap(m_arg, other.m_arg);
+            std::swap(m_value, other.m_value);
+            std::swap(m_wasConsumed, other.m_wasConsumed);
+            std::swap(m_wasWrapped, other.m_wasWrapped);
+            std::swap(m_traps, other.m_traps);
+        }
+        
+        ArgPromise(ArgPromise&& other)
+        {
+            swap(other);
+        }
+        
+        ArgPromise& operator=(ArgPromise&& other)
+        {
+            swap(other);
+            return *this;
+        }
+        
+        ~ArgPromise()
+        {
+            if (m_wasConsumed)
+                RELEASE_ASSERT(m_wasWrapped);
+        }
+        
+        void setTraps(bool value)
+        {
+            m_traps = value;
+        }
+
+        static ArgPromise tmp(Value* value)
+        {
+            ArgPromise result;
+            result.m_value = value;
+            return result;
+        }
+
+        explicit operator bool() const { return m_arg || m_value; }
+
+        Arg::Kind kind() const
+        {
+            if (!m_arg && m_value)
+                return Arg::Tmp;
+            return m_arg.kind();
+        }
+
+        const Arg& peek() const
+        {
+            return m_arg;
+        }
+
+        Arg consume(LowerToAir& lower)
+        {
+            m_wasConsumed = true;
+            if (!m_arg && m_value)
+                return lower.tmp(m_value);
+            if (m_value)
+                lower.commitInternal(m_value);
+            return m_arg;
+        }
+        
+        template<typename... Args>
+        Inst inst(Args&&... args)
+        {
+            Inst result(std::forward<Args>(args)...);
+            result.kind.traps |= m_traps;
+            m_wasWrapped = true;
+            return result;
+        }
+        
+    private:
+        // Three forms:
+        // Everything null: invalid.
+        // Arg non-null, value null: just use the arg, nothing special.
+        // Arg null, value non-null: it's a tmp, pin it when necessary.
+        // Arg non-null, value non-null: use the arg, lock the value.
+        Arg m_arg;
+        Value* m_value { nullptr };
+        bool m_wasConsumed { false };
+        bool m_wasWrapped { false };
+        bool m_traps { false };
+    };
+
+    // Consider using tmpPromise() in cases where you aren't sure that you want to pin the value yet.
+    // Here are three canonical ways of using tmp() and tmpPromise():
+    //
+    // Idiom #1: You know that you want a tmp() and you know that it will be valid for the
+    // instruction you're emitting.
+    //
+    //     append(Foo, tmp(bar));
+    //
+    // Idiom #2: You don't know if you want to use a tmp() because you haven't determined if the
+    // instruction will accept it, so you query first. Note that the call to tmp() happens only after
+    // you are sure that you will use it.
+    //
+    //     if (isValidForm(Foo, Arg::Tmp))
+    //         append(Foo, tmp(bar))
+    //
+    // Idiom #3: Same as Idiom #2, but using tmpPromise. Notice that this calls consume() only after
+    // it's sure it will use the tmp. That's deliberate. Also note that you're required to pass any
+    // Inst you create with consumed promises through that promise's inst() function.
+    //
+    //     ArgPromise promise = tmpPromise(bar);
+    //     if (isValidForm(Foo, promise.kind()))
+    //         append(promise.inst(Foo, promise.consume(*this)))
+    //
+    // In both idiom #2 and idiom #3, we don't pin the value to a temporary except when we actually
+    // emit the instruction. Both tmp() and tmpPromise().consume(*this) will pin it. Pinning means
+    // that we will henceforth require that the value of 'bar' is generated as a separate
+    // instruction. We don't want to pin the value to a temporary if we might change our minds, and
+    // pass an address operand representing 'bar' to Foo instead.
+    //
+    // Because tmp() pins, the following is not an idiom you should use:
+    //
+    //     Tmp tmp = this->tmp(bar);
+    //     if (isValidForm(Foo, tmp.kind()))
+    //         append(Foo, tmp);
+    //
+    // That's because if isValidForm() returns false, you will have already pinned the 'bar' to a
+    // temporary. You might later want to try to do something like loadPromise(), and that will fail.
+    // This arises in operations that have both a Addr,Tmp and Tmp,Addr forms. The following code
+    // seems right, but will actually fail to ever match the Tmp,Addr form because by then, the right
+    // value is already pinned.
+    //
+    //     auto tryThings = [this] (const Arg& left, const Arg& right) {
+    //         if (isValidForm(Foo, left.kind(), right.kind()))
+    //             return Inst(Foo, m_value, left, right);
+    //         return Inst();
+    //     };
+    //     if (Inst result = tryThings(loadAddr(left), tmp(right)))
+    //         return result;
+    //     if (Inst result = tryThings(tmp(left), loadAddr(right))) // this never succeeds.
+    //         return result;
+    //     return Inst(Foo, m_value, tmp(left), tmp(right));
+    //
+    // If you imagine that loadAddr(value) is just loadPromise(value).consume(*this), then this code
+    // will run correctly - it will generate OK code - but the second form is never matched.
+    // loadAddr(right) will never succeed because it will observe that 'right' is already pinned.
+    // Of course, it's exactly because of the risky nature of such code that we don't have a
+    // loadAddr() helper and require you to balance ArgPromise's in code like this. Such code will
+    // work fine if written as:
+    //
+    //     auto tryThings = [this] (ArgPromise& left, ArgPromise& right) {
+    //         if (isValidForm(Foo, left.kind(), right.kind()))
+    //             return left.inst(right.inst(Foo, m_value, left.consume(*this), right.consume(*this)));
+    //         return Inst();
+    //     };
+    //     if (Inst result = tryThings(loadPromise(left), tmpPromise(right)))
+    //         return result;
+    //     if (Inst result = tryThings(tmpPromise(left), loadPromise(right)))
+    //         return result;
+    //     return Inst(Foo, m_value, tmp(left), tmp(right));
+    //
+    // Notice that we did use tmp in the fall-back case at the end, because by then, we know for sure
+    // that we want a tmp. But using tmpPromise in the tryThings() calls ensures that doing so
+    // doesn't prevent us from trying loadPromise on the same value.
+    Tmp tmp(Value* value)
+    {
+        Tmp& tmp = m_valueToTmp[value];
+        if (!tmp) {
+            while (shouldCopyPropagate(value))
+                value = value->child(0);
+
+            if (value->opcode() == FramePointer)
+                return Tmp(GPRInfo::callFrameRegister);
+
+            Tmp& realTmp = m_valueToTmp[value];
+            if (!realTmp) {
+                realTmp = m_code.newTmp(Arg::typeForB3Type(value->type()));
+                if (m_procedure.isFastConstant(value->key()))
+                    m_code.addFastTmp(realTmp);
+                if (verbose)
+                    dataLog("Tmp for ", *value, ": ", realTmp, "\n");
+            }
+            tmp = realTmp;
+        }
+        return tmp;
+    }
+
+    ArgPromise tmpPromise(Value* value)
+    {
+        return ArgPromise::tmp(value);
+    }
+
+    bool canBeInternal(Value* value)
+    {
+        // If one of the internal things has already been computed, then we don't want to cause
+        // it to be recomputed again.
+        if (m_valueToTmp[value])
+            return false;
+        
+        // We require internals to have only one use - us. It's not clear if this should be numUses() or
+        // numUsingInstructions(). Ideally, it would be numUsingInstructions(), except that it's not clear
+        // if we'd actually do the right thing when matching over such a DAG pattern. For now, it simply
+        // doesn't matter because we don't implement patterns that would trigger this.
+        if (m_useCounts.numUses(value) != 1)
+            return false;
+
+        return true;
+    }
+
+    // If you ask canBeInternal() and then construct something from that, and you commit to emitting
+    // that code, then you must commitInternal() on that value. This is tricky, and you only need to
+    // do it if you're pattern matching by hand rather than using the patterns language. Long story
+    // short, you should avoid this by using the pattern matcher to match patterns.
+    void commitInternal(Value* value)
+    {
+        if (value)
+            m_locked.add(value);
+    }
+
+    bool crossesInterference(Value* value)
+    {
+        // If it's in a foreign block, then be conservative. We could handle this if we were
+        // willing to do heavier analysis. For example, if we had liveness, then we could label
+        // values as "crossing interference" if they interfere with anything that they are live
+        // across. But, it's not clear how useful this would be.
+        if (value->owner != m_value->owner)
+            return true;
+
+        Effects effects = value->effects();
+
+        for (unsigned i = m_index; i--;) {
+            Value* otherValue = m_block->at(i);
+            if (otherValue == value)
+                return false;
+            if (effects.interferes(otherValue->effects()))
+                return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return true;
+    }
+    
+    std::optional<unsigned> scaleForShl(Value* shl, int32_t offset, std::optional<Arg::Width> width = std::nullopt)
+    {
+        if (shl->opcode() != Shl)
+            return std::nullopt;
+        if (!shl->child(1)->hasInt32())
+            return std::nullopt;
+        unsigned logScale = shl->child(1)->asInt32();
+        if (shl->type() == Int32)
+            logScale &= 31;
+        else
+            logScale &= 63;
+        // Use 64-bit math to perform the shift so that <<32 does the right thing, but then switch
+        // to signed since that's what all of our APIs want.
+        int64_t bigScale = static_cast<uint64_t>(1) << static_cast<uint64_t>(logScale);
+        if (!isRepresentableAs<int32_t>(bigScale))
+            return std::nullopt;
+        unsigned scale = static_cast<int32_t>(bigScale);
+        if (!Arg::isValidIndexForm(scale, offset, width))
+            return std::nullopt;
+        return scale;
+    }
+
+    // This turns the given operand into an address.
+    Arg effectiveAddr(Value* address, int32_t offset, Arg::Width width)
+    {
+        ASSERT(Arg::isValidAddrForm(offset, width));
+
+        auto fallback = [&] () -> Arg {
+            return Arg::addr(tmp(address), offset);
+        };
+        
+        static const unsigned lotsOfUses = 10; // This is arbitrary and we should tune it eventually.
+
+        // Only match if the address value isn't used in some large number of places.
+        if (m_useCounts.numUses(address) > lotsOfUses)
+            return fallback();
+        
+        switch (address->opcode()) {
+        case Add: {
+            Value* left = address->child(0);
+            Value* right = address->child(1);
+
+            auto tryIndex = [&] (Value* index, Value* base) -> Arg {
+                std::optional<unsigned> scale = scaleForShl(index, offset, width);
+                if (!scale)
+                    return Arg();
+                if (m_locked.contains(index->child(0)) || m_locked.contains(base))
+                    return Arg();
+                return Arg::index(tmp(base), tmp(index->child(0)), *scale, offset);
+            };
+
+            if (Arg result = tryIndex(left, right))
+                return result;
+            if (Arg result = tryIndex(right, left))
+                return result;
+
+            if (m_locked.contains(left) || m_locked.contains(right)
+                || !Arg::isValidIndexForm(1, offset, width))
+                return fallback();
+            
+            return Arg::index(tmp(left), tmp(right), 1, offset);
+        }
+
+        case Shl: {
+            Value* left = address->child(0);
+
+            // We'll never see child(1)->isInt32(0), since that would have been reduced. If the shift
+            // amount is greater than 1, then there isn't really anything smart that we could do here.
+            // We avoid using baseless indexes because their encoding isn't particularly efficient.
+            if (m_locked.contains(left) || !address->child(1)->isInt32(1)
+                || !Arg::isValidIndexForm(1, offset, width))
+                return fallback();
+
+            return Arg::index(tmp(left), tmp(left), 1, offset);
+        }
+
+        case FramePointer:
+            return Arg::addr(Tmp(GPRInfo::callFrameRegister), offset);
+
+        case SlotBase:
+            return Arg::stack(m_stackToStack.get(address->as<SlotBaseValue>()->slot()), offset);
+
+        case WasmAddress: {
+            WasmAddressValue* wasmAddress = address->as<WasmAddressValue>();
+            Value* pointer = wasmAddress->child(0);
+            ASSERT(Arg::isValidIndexForm(1, offset, width));
+            if (m_locked.contains(pointer))
+                return fallback();
+
+            // FIXME: We should support ARM64 LDR 32-bit addressing, which will
+            // allow us to fuse a Shl ptr, 2 into the address. Additionally, and
+            // perhaps more importantly, it would allow us to avoid a truncating
+            // move. See: https://bugs.webkit.org/show_bug.cgi?id=163465
+
+            return Arg::index(Tmp(wasmAddress->pinnedGPR()), tmp(pointer), 1, offset);
+        }
+
+        default:
+            return fallback();
+        }
+    }
+
+    // This gives you the address of the given Load or Store. If it's not a Load or Store, then
+    // it returns Arg().
+    Arg addr(Value* memoryValue)
+    {
+        MemoryValue* value = memoryValue->as<MemoryValue>();
+        if (!value)
+            return Arg();
+
+        int32_t offset = value->offset();
+        Arg::Width width = Arg::widthForBytes(value->accessByteSize());
+
+        Arg result = effectiveAddr(value->lastChild(), offset, width);
+        ASSERT(result.isValidForm(width));
+
+        return result;
+    }
+    
+    template<typename... Args>
+    Inst trappingInst(bool traps, Args&&... args)
+    {
+        Inst result(std::forward<Args>(args)...);
+        result.kind.traps |= traps;
+        return result;
+    }
+    
+    template<typename... Args>
+    Inst trappingInst(Value* value, Args&&... args)
+    {
+        return trappingInst(value->traps(), std::forward<Args>(args)...);
+    }
+    
+    ArgPromise loadPromiseAnyOpcode(Value* loadValue)
+    {
+        if (!canBeInternal(loadValue))
+            return Arg();
+        if (crossesInterference(loadValue))
+            return Arg();
+        ArgPromise result(addr(loadValue), loadValue);
+        if (loadValue->traps())
+            result.setTraps(true);
+        return result;
+    }
+
+    ArgPromise loadPromise(Value* loadValue, B3::Opcode loadOpcode)
+    {
+        if (loadValue->opcode() != loadOpcode)
+            return Arg();
+        return loadPromiseAnyOpcode(loadValue);
+    }
+
+    ArgPromise loadPromise(Value* loadValue)
+    {
+        return loadPromise(loadValue, Load);
+    }
+
+    Arg imm(int64_t intValue)
+    {
+        if (Arg::isValidImmForm(intValue))
+            return Arg::imm(intValue);
+        return Arg();
+    }
+
+    Arg imm(Value* value)
+    {
+        if (value->hasInt())
+            return imm(value->asInt());
+        return Arg();
+    }
+
+    Arg bitImm(Value* value)
+    {
+        if (value->hasInt()) {
+            int64_t intValue = value->asInt();
+            if (Arg::isValidBitImmForm(intValue))
+                return Arg::bitImm(intValue);
+        }
+        return Arg();
+    }
+
+    Arg bitImm64(Value* value)
+    {
+        if (value->hasInt()) {
+            int64_t intValue = value->asInt();
+            if (Arg::isValidBitImm64Form(intValue))
+                return Arg::bitImm64(intValue);
+        }
+        return Arg();
+    }
+
+    Arg immOrTmp(Value* value)
+    {
+        if (Arg result = imm(value))
+            return result;
+        return tmp(value);
+    }
+
+    // By convention, we use Oops to mean "I don't know".
+    Air::Opcode tryOpcodeForType(
+        Air::Opcode opcode32, Air::Opcode opcode64, Air::Opcode opcodeDouble, Air::Opcode opcodeFloat, Type type)
+    {
+        Air::Opcode opcode;
+        switch (type) {
+        case Int32:
+            opcode = opcode32;
+            break;
+        case Int64:
+            opcode = opcode64;
+            break;
+        case Float:
+            opcode = opcodeFloat;
+            break;
+        case Double:
+            opcode = opcodeDouble;
+            break;
+        default:
+            opcode = Air::Oops;
+            break;
+        }
+
+        return opcode;
+    }
+
+    Air::Opcode tryOpcodeForType(Air::Opcode opcode32, Air::Opcode opcode64, Type type)
+    {
+        return tryOpcodeForType(opcode32, opcode64, Air::Oops, Air::Oops, type);
+    }
+
+    Air::Opcode opcodeForType(
+        Air::Opcode opcode32, Air::Opcode opcode64, Air::Opcode opcodeDouble, Air::Opcode opcodeFloat, Type type)
+    {
+        Air::Opcode opcode = tryOpcodeForType(opcode32, opcode64, opcodeDouble, opcodeFloat, type);
+        RELEASE_ASSERT(opcode != Air::Oops);
+        return opcode;
+    }
+
+    Air::Opcode opcodeForType(Air::Opcode opcode32, Air::Opcode opcode64, Type type)
+    {
+        return tryOpcodeForType(opcode32, opcode64, Air::Oops, Air::Oops, type);
+    }
+
+    template<Air::Opcode opcode32, Air::Opcode opcode64, Air::Opcode opcodeDouble = Air::Oops, Air::Opcode opcodeFloat = Air::Oops>
+    void appendUnOp(Value* value)
+    {
+        Air::Opcode opcode = opcodeForType(opcode32, opcode64, opcodeDouble, opcodeFloat, value->type());
+        
+        Tmp result = tmp(m_value);
+
+        // Two operand forms like:
+        //     Op a, b
+        // mean something like:
+        //     b = Op a
+
+        ArgPromise addr = loadPromise(value);
+        if (isValidForm(opcode, addr.kind(), Arg::Tmp)) {
+            append(addr.inst(opcode, m_value, addr.consume(*this), result));
+            return;
+        }
+
+        if (isValidForm(opcode, Arg::Tmp, Arg::Tmp)) {
+            append(opcode, tmp(value), result);
+            return;
+        }
+
+        ASSERT(value->type() == m_value->type());
+        append(relaxedMoveForType(m_value->type()), tmp(value), result);
+        append(opcode, result);
+    }
+
+    // Call this method when doing two-operand lowering of a commutative operation. You have a choice of
+    // which incoming Value is moved into the result. This will select which one is likely to be most
+    // profitable to use as the result. Doing the right thing can have big performance consequences in tight
+    // kernels.
+    bool preferRightForResult(Value* left, Value* right)
+    {
+        // The default is to move left into result, because that's required for non-commutative instructions.
+        // The value that we want to move into result position is the one that dies here. So, if we're
+        // compiling a commutative operation and we know that actually right is the one that dies right here,
+        // then we can flip things around to help coalescing, which then kills the move instruction.
+        //
+        // But it's more complicated:
+        // - Used-once is a bad estimate of whether the variable dies here.
+        // - A child might be a candidate for coalescing with this value.
+        //
+        // Currently, we have machinery in place to recognize super obvious forms of the latter issue.
+        
+        // We recognize when a child is a Phi that has this value as one of its children. We're very
+        // conservative about this; for example we don't even consider transitive Phi children.
+        bool leftIsPhiWithThis = m_phiChildren[left].transitivelyUses(m_value);
+        bool rightIsPhiWithThis = m_phiChildren[right].transitivelyUses(m_value);
+
+        if (leftIsPhiWithThis != rightIsPhiWithThis)
+            return rightIsPhiWithThis;
+
+        if (m_useCounts.numUsingInstructions(right) != 1)
+            return false;
+        
+        if (m_useCounts.numUsingInstructions(left) != 1)
+            return true;
+
+        // The use count might be 1 if the variable is live around a loop. We can guarantee that we
+        // pick the the variable that is least likely to suffer this problem if we pick the one that
+        // is closest to us in an idom walk. By convention, we slightly bias this in favor of
+        // returning true.
+
+        // We cannot prefer right if right is further away in an idom walk.
+        if (m_dominators.strictlyDominates(right->owner, left->owner))
+            return false;
+
+        return true;
+    }
+
+    template<Air::Opcode opcode32, Air::Opcode opcode64, Air::Opcode opcodeDouble, Air::Opcode opcodeFloat, Commutativity commutativity = NotCommutative>
+    void appendBinOp(Value* left, Value* right)
+    {
+        Air::Opcode opcode = opcodeForType(opcode32, opcode64, opcodeDouble, opcodeFloat, left->type());
+        
+        Tmp result = tmp(m_value);
+        
+        // Three-operand forms like:
+        //     Op a, b, c
+        // mean something like:
+        //     c = a Op b
+
+        if (isValidForm(opcode, Arg::Imm, Arg::Tmp, Arg::Tmp)) {
+            if (commutativity == Commutative) {
+                if (imm(right)) {
+                    append(opcode, imm(right), tmp(left), result);
+                    return;
+                }
+            } else {
+                // A non-commutative operation could have an immediate in left.
+                if (imm(left)) {
+                    append(opcode, imm(left), tmp(right), result);
+                    return;
+                }
+            }
+        }
+
+        if (isValidForm(opcode, Arg::BitImm, Arg::Tmp, Arg::Tmp)) {
+            if (commutativity == Commutative) {
+                if (Arg rightArg = bitImm(right)) {
+                    append(opcode, rightArg, tmp(left), result);
+                    return;
+                }
+            } else {
+                // A non-commutative operation could have an immediate in left.
+                if (Arg leftArg = bitImm(left)) {
+                    append(opcode, leftArg, tmp(right), result);
+                    return;
+                }
+            }
+        }
+
+        if (isValidForm(opcode, Arg::BitImm64, Arg::Tmp, Arg::Tmp)) {
+            if (commutativity == Commutative) {
+                if (Arg rightArg = bitImm64(right)) {
+                    append(opcode, rightArg, tmp(left), result);
+                    return;
+                }
+            } else {
+                // A non-commutative operation could have an immediate in left.
+                if (Arg leftArg = bitImm64(left)) {
+                    append(opcode, leftArg, tmp(right), result);
+                    return;
+                }
+            }
+        }
+
+        if (imm(right) && isValidForm(opcode, Arg::Tmp, Arg::Imm, Arg::Tmp)) {
+            append(opcode, tmp(left), imm(right), result);
+            return;
+        }
+
+        // Note that no extant architecture has a three-operand form of binary operations that also
+        // load from memory. If such an abomination did exist, we would handle it somewhere around
+        // here.
+
+        // Two-operand forms like:
+        //     Op a, b
+        // mean something like:
+        //     b = b Op a
+
+        // At this point, we prefer versions of the operation that have a fused load or an immediate
+        // over three operand forms.
+
+        if (left != right) {
+            ArgPromise leftAddr = loadPromise(left);
+            if (isValidForm(opcode, leftAddr.kind(), Arg::Tmp, Arg::Tmp)) {
+                append(leftAddr.inst(opcode, m_value, leftAddr.consume(*this), tmp(right), result));
+                return;
+            }
+
+            if (commutativity == Commutative) {
+                if (isValidForm(opcode, leftAddr.kind(), Arg::Tmp)) {
+                    append(relaxedMoveForType(m_value->type()), tmp(right), result);
+                    append(leftAddr.inst(opcode, m_value, leftAddr.consume(*this), result));
+                    return;
+                }
+            }
+
+            ArgPromise rightAddr = loadPromise(right);
+            if (isValidForm(opcode, Arg::Tmp, rightAddr.kind(), Arg::Tmp)) {
+                append(rightAddr.inst(opcode, m_value, tmp(left), rightAddr.consume(*this), result));
+                return;
+            }
+
+            if (commutativity == Commutative) {
+                if (isValidForm(opcode, rightAddr.kind(), Arg::Tmp, Arg::Tmp)) {
+                    append(rightAddr.inst(opcode, m_value, rightAddr.consume(*this), tmp(left), result));
+                    return;
+                }
+            }
+
+            if (isValidForm(opcode, rightAddr.kind(), Arg::Tmp)) {
+                append(relaxedMoveForType(m_value->type()), tmp(left), result);
+                append(rightAddr.inst(opcode, m_value, rightAddr.consume(*this), result));
+                return;
+            }
+        }
+
+        if (imm(right) && isValidForm(opcode, Arg::Imm, Arg::Tmp)) {
+            append(relaxedMoveForType(m_value->type()), tmp(left), result);
+            append(opcode, imm(right), result);
+            return;
+        }
+
+        if (isValidForm(opcode, Arg::Tmp, Arg::Tmp, Arg::Tmp)) {
+            append(opcode, tmp(left), tmp(right), result);
+            return;
+        }
+
+        if (commutativity == Commutative && preferRightForResult(left, right)) {
+            append(relaxedMoveForType(m_value->type()), tmp(right), result);
+            append(opcode, tmp(left), result);
+            return;
+        }
+        
+        append(relaxedMoveForType(m_value->type()), tmp(left), result);
+        append(opcode, tmp(right), result);
+    }
+
+    template<Air::Opcode opcode32, Air::Opcode opcode64, Commutativity commutativity = NotCommutative>
+    void appendBinOp(Value* left, Value* right)
+    {
+        appendBinOp<opcode32, opcode64, Air::Oops, Air::Oops, commutativity>(left, right);
+    }
+
+    template<Air::Opcode opcode32, Air::Opcode opcode64>
+    void appendShift(Value* value, Value* amount)
+    {
+        Air::Opcode opcode = opcodeForType(opcode32, opcode64, value->type());
+        
+        if (imm(amount)) {
+            if (isValidForm(opcode, Arg::Tmp, Arg::Imm, Arg::Tmp)) {
+                append(opcode, tmp(value), imm(amount), tmp(m_value));
+                return;
+            }
+            if (isValidForm(opcode, Arg::Imm, Arg::Tmp)) {
+                append(Move, tmp(value), tmp(m_value));
+                append(opcode, imm(amount), tmp(m_value));
+                return;
+            }
+        }
+
+        if (isValidForm(opcode, Arg::Tmp, Arg::Tmp, Arg::Tmp)) {
+            append(opcode, tmp(value), tmp(amount), tmp(m_value));
+            return;
+        }
+
+#if CPU(X86) || CPU(X86_64)
+        append(Move, tmp(value), tmp(m_value));
+        append(Move, tmp(amount), Tmp(X86Registers::ecx));
+        append(opcode, Tmp(X86Registers::ecx), tmp(m_value));
+#endif
+    }
+
+    template<Air::Opcode opcode32, Air::Opcode opcode64>
+    bool tryAppendStoreUnOp(Value* value)
+    {
+        Air::Opcode opcode = tryOpcodeForType(opcode32, opcode64, value->type());
+        if (opcode == Air::Oops)
+            return false;
+        
+        Arg storeAddr = addr(m_value);
+        ASSERT(storeAddr);
+
+        ArgPromise loadPromise = this->loadPromise(value);
+        if (loadPromise.peek() != storeAddr)
+            return false;
+
+        if (!isValidForm(opcode, storeAddr.kind()))
+            return false;
+        
+        loadPromise.consume(*this);
+        append(trappingInst(m_value, loadPromise.inst(opcode, m_value, storeAddr)));
+        return true;
+    }
+
+    template<
+        Air::Opcode opcode32, Air::Opcode opcode64, Commutativity commutativity = NotCommutative>
+    bool tryAppendStoreBinOp(Value* left, Value* right)
+    {
+        Air::Opcode opcode = tryOpcodeForType(opcode32, opcode64, left->type());
+        if (opcode == Air::Oops)
+            return false;
+        
+        Arg storeAddr = addr(m_value);
+        ASSERT(storeAddr);
+
+        auto getLoadPromise = [&] (Value* load) -> ArgPromise {
+            switch (m_value->opcode()) {
+            case B3::Store:
+                if (load->opcode() != B3::Load)
+                    return ArgPromise();
+                break;
+            case B3::Store8:
+                if (load->opcode() != B3::Load8Z && load->opcode() != B3::Load8S)
+                    return ArgPromise();
+                break;
+            case B3::Store16:
+                if (load->opcode() != B3::Load16Z && load->opcode() != B3::Load16S)
+                    return ArgPromise();
+                break;
+            default:
+                return ArgPromise();
+            }
+            return loadPromiseAnyOpcode(load);
+        };
+        
+        ArgPromise loadPromise;
+        Value* otherValue = nullptr;
+
+        loadPromise = getLoadPromise(left);
+        if (loadPromise.peek() == storeAddr)
+            otherValue = right;
+        else if (commutativity == Commutative) {
+            loadPromise = getLoadPromise(right);
+            if (loadPromise.peek() == storeAddr)
+                otherValue = left;
+        }
+
+        if (!otherValue)
+            return false;
+
+        if (isValidForm(opcode, Arg::Imm, storeAddr.kind()) && imm(otherValue)) {
+            loadPromise.consume(*this);
+            append(trappingInst(m_value, loadPromise.inst(opcode, m_value, imm(otherValue), storeAddr)));
+            return true;
+        }
+
+        if (!isValidForm(opcode, Arg::Tmp, storeAddr.kind()))
+            return false;
+
+        loadPromise.consume(*this);
+        append(trappingInst(m_value, loadPromise.inst(opcode, m_value, tmp(otherValue), storeAddr)));
+        return true;
+    }
+
+    Inst createStore(Air::Opcode move, Value* value, const Arg& dest)
+    {
+        if (imm(value) && isValidForm(move, Arg::Imm, dest.kind()))
+            return Inst(move, m_value, imm(value), dest);
+
+        return Inst(move, m_value, tmp(value), dest);
+    }
+
+    Inst createStore(Value* value, const Arg& dest)
+    {
+        Air::Opcode moveOpcode = moveForType(value->type());
+        return createStore(moveOpcode, value, dest);
+    }
+
+    template<typename... Args>
+    void appendStore(Args&&... args)
+    {
+        append(trappingInst(m_value, createStore(std::forward<Args>(args)...)));
+    }
+
+    Air::Opcode moveForType(Type type)
+    {
+        switch (type) {
+        case Int32:
+            return Move32;
+        case Int64:
+            RELEASE_ASSERT(is64Bit());
+            return Move;
+        case Float:
+            return MoveFloat;
+        case Double:
+            return MoveDouble;
+        case Void:
+            break;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return Air::Oops;
+    }
+
+    Air::Opcode relaxedMoveForType(Type type)
+    {
+        switch (type) {
+        case Int32:
+        case Int64:
+            // For Int32, we could return Move or Move32. It's a trade-off.
+            //
+            // Move32: Using Move32 guarantees that we use the narrower move, but in cases where the
+            //     register allocator can't prove that the variables involved are 32-bit, this will
+            //     disable coalescing.
+            //
+            // Move: Using Move guarantees that the register allocator can coalesce normally, but in
+            //     cases where it can't prove that the variables are 32-bit and it doesn't coalesce,
+            //     this will force us to use a full 64-bit Move instead of the slightly cheaper
+            //     32-bit Move32.
+            //
+            // Coalescing is a lot more profitable than turning Move into Move32. So, it's better to
+            // use Move here because in cases where the register allocator cannot prove that
+            // everything is 32-bit, we still get coalescing.
+            return Move;
+        case Float:
+            // MoveFloat is always coalescable and we never convert MoveDouble to MoveFloat, so we
+            // should use MoveFloat when we know that the temporaries involved are 32-bit.
+            return MoveFloat;
+        case Double:
+            return MoveDouble;
+        case Void:
+            break;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return Air::Oops;
+    }
+
+    template<typename... Arguments>
+    void append(Air::Opcode opcode, Arguments&&... arguments)
+    {
+        m_insts.last().append(Inst(opcode, m_value, std::forward<Arguments>(arguments)...));
+    }
+    
+    void append(Inst&& inst)
+    {
+        m_insts.last().append(WTFMove(inst));
+    }
+    void append(const Inst& inst)
+    {
+        m_insts.last().append(inst);
+    }
+
+    template<typename T, typename... Arguments>
+    T* ensureSpecial(T*& field, Arguments&&... arguments)
+    {
+        if (!field) {
+            field = static_cast<T*>(
+                m_code.addSpecial(std::make_unique<T>(std::forward<Arguments>(arguments)...)));
+        }
+        return field;
+    }
+
+    template<typename... Arguments>
+    CheckSpecial* ensureCheckSpecial(Arguments&&... arguments)
+    {
+        CheckSpecial::Key key(std::forward<Arguments>(arguments)...);
+        auto result = m_checkSpecials.add(key, nullptr);
+        return ensureSpecial(result.iterator->value, key);
+    }
+
+    void fillStackmap(Inst& inst, StackmapValue* stackmap, unsigned numSkipped)
+    {
+        for (unsigned i = numSkipped; i < stackmap->numChildren(); ++i) {
+            ConstrainedValue value = stackmap->constrainedChild(i);
+
+            Arg arg;
+            switch (value.rep().kind()) {
+            case ValueRep::WarmAny:
+            case ValueRep::ColdAny:
+            case ValueRep::LateColdAny:
+                if (imm(value.value()))
+                    arg = imm(value.value());
+                else if (value.value()->hasInt64())
+                    arg = Arg::bigImm(value.value()->asInt64());
+                else if (value.value()->hasDouble() && canBeInternal(value.value())) {
+                    commitInternal(value.value());
+                    arg = Arg::bigImm(bitwise_cast<int64_t>(value.value()->asDouble()));
+                } else
+                    arg = tmp(value.value());
+                break;
+            case ValueRep::SomeRegister:
+                arg = tmp(value.value());
+                break;
+            case ValueRep::LateRegister:
+            case ValueRep::Register:
+                stackmap->earlyClobbered().clear(value.rep().reg());
+                arg = Tmp(value.rep().reg());
+                append(relaxedMoveForType(value.value()->type()), immOrTmp(value.value()), arg);
+                break;
+            case ValueRep::StackArgument:
+                arg = Arg::callArg(value.rep().offsetFromSP());
+                appendStore(value.value(), arg);
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            inst.args.append(arg);
+        }
+    }
+    
+    // Create an Inst to do the comparison specified by the given value.
+    template<typename CompareFunctor, typename TestFunctor, typename CompareDoubleFunctor, typename CompareFloatFunctor>
+    Inst createGenericCompare(
+        Value* value,
+        const CompareFunctor& compare, // Signature: (Arg::Width, Arg relCond, Arg, Arg) -> Inst
+        const TestFunctor& test, // Signature: (Arg::Width, Arg resCond, Arg, Arg) -> Inst
+        const CompareDoubleFunctor& compareDouble, // Signature: (Arg doubleCond, Arg, Arg) -> Inst
+        const CompareFloatFunctor& compareFloat, // Signature: (Arg doubleCond, Arg, Arg) -> Inst
+        bool inverted = false)
+    {
+        // NOTE: This is totally happy to match comparisons that have already been computed elsewhere
+        // since on most architectures, the cost of branching on a previously computed comparison
+        // result is almost always higher than just doing another fused compare/branch. The only time
+        // it could be worse is if we have a binary comparison and both operands are variables (not
+        // constants), and we encounter register pressure. Even in this case, duplicating the compare
+        // so that we can fuse it to the branch will be more efficient most of the time, since
+        // register pressure is not *that* common. For this reason, this algorithm will always
+        // duplicate the comparison.
+        //
+        // However, we cannot duplicate loads. The canBeInternal() on a load will assume that we
+        // already validated canBeInternal() on all of the values that got us to the load. So, even
+        // if we are sharing a value, we still need to call canBeInternal() for the purpose of
+        // tracking whether we are still in good shape to fuse loads.
+        //
+        // We could even have a chain of compare values that we fuse, and any member of the chain
+        // could be shared. Once any of them are shared, then the shared one's transitive children
+        // cannot be locked (i.e. commitInternal()). But if none of them are shared, then we want to
+        // lock all of them because that's a prerequisite to fusing the loads so that the loads don't
+        // get duplicated. For example, we might have: 
+        //
+        //     @tmp1 = LessThan(@a, @b)
+        //     @tmp2 = Equal(@tmp1, 0)
+        //     Branch(@tmp2)
+        //
+        // If either @a or @b are loads, then we want to have locked @tmp1 and @tmp2 so that they
+        // don't emit the loads a second time. But if we had another use of @tmp2, then we cannot
+        // lock @tmp1 (or @a or @b) because then we'll get into trouble when the other values that
+        // try to share @tmp1 with us try to do their lowering.
+        //
+        // There's one more wrinkle. If we don't lock an internal value, then this internal value may
+        // have already separately locked its children. So, if we're not locking a value then we need
+        // to make sure that its children aren't locked. We encapsulate this in two ways:
+        //
+        // canCommitInternal: This variable tells us if the values that we've fused so far are
+        // locked. This means that we're not sharing any of them with anyone. This permits us to fuse
+        // loads. If it's false, then we cannot fuse loads and we also need to ensure that the
+        // children of any values we try to fuse-by-sharing are not already locked. You don't have to
+        // worry about the children locking thing if you use prepareToFuse() before trying to fuse a
+        // sharable value. But, you do need to guard any load fusion by checking if canCommitInternal
+        // is true.
+        //
+        // FusionResult prepareToFuse(value): Call this when you think that you would like to fuse
+        // some value and that value is not a load. It will automatically handle the shared-or-locked
+        // issues and it will clear canCommitInternal if necessary. This will return CannotFuse
+        // (which acts like false) if the value cannot be locked and its children are locked. That's
+        // rare, but you just need to make sure that you do smart things when this happens (i.e. just
+        // use the value rather than trying to fuse it). After you call prepareToFuse(), you can
+        // still change your mind about whether you will actually fuse the value. If you do fuse it,
+        // you need to call commitFusion(value, fusionResult).
+        //
+        // commitFusion(value, fusionResult): Handles calling commitInternal(value) if fusionResult
+        // is FuseAndCommit.
+        
+        bool canCommitInternal = true;
+
+        enum FusionResult {
+            CannotFuse,
+            FuseAndCommit,
+            Fuse
+        };
+        auto prepareToFuse = [&] (Value* value) -> FusionResult {
+            if (value == m_value) {
+                // It's not actually internal. It's the root value. We're good to go.
+                return Fuse;
+            }
+
+            if (canCommitInternal && canBeInternal(value)) {
+                // We are the only users of this value. This also means that the value's children
+                // could not have been locked, since we have now proved that m_value dominates value
+                // in the data flow graph. To only other way to value is from a user of m_value. If
+                // value's children are shared with others, then they could not have been locked
+                // because their use count is greater than 1. If they are only used from value, then
+                // in order for value's children to be locked, value would also have to be locked,
+                // and we just proved that it wasn't.
+                return FuseAndCommit;
+            }
+
+            // We're going to try to share value with others. It's possible that some other basic
+            // block had already emitted code for value and then matched over its children and then
+            // locked them, in which case we just want to use value instead of duplicating it. So, we
+            // validate the children. Note that this only arises in linear chains like:
+            //
+            //     BB#1:
+            //         @1 = Foo(...)
+            //         @2 = Bar(@1)
+            //         Jump(#2)
+            //     BB#2:
+            //         @3 = Baz(@2)
+            //
+            // Notice how we could start by generating code for BB#1 and then decide to lock @1 when
+            // generating code for @2, if we have some way of fusing Bar and Foo into a single
+            // instruction. This is legal, since indeed @1 only has one user. The fact that @2 now
+            // has a tmp (i.e. @2 is pinned), canBeInternal(@2) will return false, which brings us
+            // here. In that case, we cannot match over @2 because then we'd hit a hazard if we end
+            // up deciding not to fuse Foo into the fused Baz/Bar.
+            //
+            // Happily, there are only two places where this kind of child validation happens is in
+            // rules that admit sharing, like this and effectiveAddress().
+            //
+            // N.B. We could probably avoid the need to do value locking if we committed to a well
+            // chosen code generation order. For example, if we guaranteed that all of the users of
+            // a value get generated before that value, then there's no way for the lowering of @3 to
+            // see @1 locked. But we don't want to do that, since this is a greedy instruction
+            // selector and so we want to be able to play with order.
+            for (Value* child : value->children()) {
+                if (m_locked.contains(child))
+                    return CannotFuse;
+            }
+
+            // It's safe to share value, but since we're sharing, it means that we aren't locking it.
+            // If we don't lock it, then fusing loads is off limits and all of value's children will
+            // have to go through the sharing path as well.
+            canCommitInternal = false;
+            
+            return Fuse;
+        };
+
+        auto commitFusion = [&] (Value* value, FusionResult result) {
+            if (result == FuseAndCommit)
+                commitInternal(value);
+        };
+        
+        // Chew through any inversions. This loop isn't necessary for comparisons and branches, but
+        // we do need at least one iteration of it for Check.
+        for (;;) {
+            bool shouldInvert =
+                (value->opcode() == BitXor && value->child(1)->hasInt() && (value->child(1)->asInt() & 1) && value->child(0)->returnsBool())
+                || (value->opcode() == Equal && value->child(1)->isInt(0));
+            if (!shouldInvert)
+                break;
+
+            FusionResult fusionResult = prepareToFuse(value);
+            if (fusionResult == CannotFuse)
+                break;
+            commitFusion(value, fusionResult);
+            
+            value = value->child(0);
+            inverted = !inverted;
+        }
+
+        auto createRelCond = [&] (
+            MacroAssembler::RelationalCondition relationalCondition,
+            MacroAssembler::DoubleCondition doubleCondition) {
+            Arg relCond = Arg::relCond(relationalCondition).inverted(inverted);
+            Arg doubleCond = Arg::doubleCond(doubleCondition).inverted(inverted);
+            Value* left = value->child(0);
+            Value* right = value->child(1);
+
+            if (isInt(value->child(0)->type())) {
+                // FIXME: We wouldn't have to worry about leftImm if we canonicalized integer
+                // comparisons.
+                // https://bugs.webkit.org/show_bug.cgi?id=150958
+                
+                Arg leftImm = imm(left);
+                Arg rightImm = imm(right);
+
+                auto tryCompare = [&] (
+                    Arg::Width width, ArgPromise&& left, ArgPromise&& right) -> Inst {
+                    if (Inst result = compare(width, relCond, left, right))
+                        return result;
+                    if (Inst result = compare(width, relCond.flipped(), right, left))
+                        return result;
+                    return Inst();
+                };
+
+                auto tryCompareLoadImm = [&] (
+                    Arg::Width width, B3::Opcode loadOpcode, Arg::Signedness signedness) -> Inst {
+                    if (rightImm && rightImm.isRepresentableAs(width, signedness)) {
+                        if (Inst result = tryCompare(width, loadPromise(left, loadOpcode), rightImm)) {
+                            commitInternal(left);
+                            return result;
+                        }
+                    }
+                    if (leftImm && leftImm.isRepresentableAs(width, signedness)) {
+                        if (Inst result = tryCompare(width, leftImm, loadPromise(right, loadOpcode))) {
+                            commitInternal(right);
+                            return result;
+                        }
+                    }
+                    return Inst();
+                };
+
+                Arg::Width width = Arg::widthForB3Type(value->child(0)->type());
+                
+                if (canCommitInternal) {
+                    // First handle compares that involve fewer bits than B3's type system supports.
+                    // This is pretty important. For example, we want this to be a single
+                    // instruction:
+                    //
+                    //     @1 = Load8S(...)
+                    //     @2 = Const32(...)
+                    //     @3 = LessThan(@1, @2)
+                    //     Branch(@3)
+                
+                    if (relCond.isSignedCond()) {
+                        if (Inst result = tryCompareLoadImm(Arg::Width8, Load8S, Arg::Signed))
+                            return result;
+                    }
+                
+                    if (relCond.isUnsignedCond()) {
+                        if (Inst result = tryCompareLoadImm(Arg::Width8, Load8Z, Arg::Unsigned))
+                            return result;
+                    }
+
+                    if (relCond.isSignedCond()) {
+                        if (Inst result = tryCompareLoadImm(Arg::Width16, Load16S, Arg::Signed))
+                            return result;
+                    }
+                
+                    if (relCond.isUnsignedCond()) {
+                        if (Inst result = tryCompareLoadImm(Arg::Width16, Load16Z, Arg::Unsigned))
+                            return result;
+                    }
+
+                    // Now handle compares that involve a load and an immediate.
+
+                    if (Inst result = tryCompareLoadImm(width, Load, Arg::Signed))
+                        return result;
+
+                    // Now handle compares that involve a load. It's not obvious that it's better to
+                    // handle this before the immediate cases or not. Probably doesn't matter.
+
+                    if (Inst result = tryCompare(width, loadPromise(left), tmpPromise(right))) {
+                        commitInternal(left);
+                        return result;
+                    }
+                
+                    if (Inst result = tryCompare(width, tmpPromise(left), loadPromise(right))) {
+                        commitInternal(right);
+                        return result;
+                    }
+                }
+
+                // Now handle compares that involve an immediate and a tmp.
+                
+                if (leftImm && leftImm.isRepresentableAs<int32_t>()) {
+                    if (Inst result = tryCompare(width, leftImm, tmpPromise(right)))
+                        return result;
+                }
+                
+                if (rightImm && rightImm.isRepresentableAs<int32_t>()) {
+                    if (Inst result = tryCompare(width, tmpPromise(left), rightImm))
+                        return result;
+                }
+
+                // Finally, handle comparison between tmps.
+                ArgPromise leftPromise = tmpPromise(left);
+                ArgPromise rightPromise = tmpPromise(right);
+                return compare(width, relCond, leftPromise, rightPromise);
+            }
+
+            // Floating point comparisons can't really do anything smart.
+            ArgPromise leftPromise = tmpPromise(left);
+            ArgPromise rightPromise = tmpPromise(right);
+            if (value->child(0)->type() == Float)
+                return compareFloat(doubleCond, leftPromise, rightPromise);
+            return compareDouble(doubleCond, leftPromise, rightPromise);
+        };
+
+        Arg::Width width = Arg::widthForB3Type(value->type());
+        Arg resCond = Arg::resCond(MacroAssembler::NonZero).inverted(inverted);
+        
+        auto tryTest = [&] (
+            Arg::Width width, ArgPromise&& left, ArgPromise&& right) -> Inst {
+            if (Inst result = test(width, resCond, left, right))
+                return result;
+            if (Inst result = test(width, resCond, right, left))
+                return result;
+            return Inst();
+        };
+
+        auto attemptFused = [&] () -> Inst {
+            switch (value->opcode()) {
+            case NotEqual:
+                return createRelCond(MacroAssembler::NotEqual, MacroAssembler::DoubleNotEqualOrUnordered);
+            case Equal:
+                return createRelCond(MacroAssembler::Equal, MacroAssembler::DoubleEqual);
+            case LessThan:
+                return createRelCond(MacroAssembler::LessThan, MacroAssembler::DoubleLessThan);
+            case GreaterThan:
+                return createRelCond(MacroAssembler::GreaterThan, MacroAssembler::DoubleGreaterThan);
+            case LessEqual:
+                return createRelCond(MacroAssembler::LessThanOrEqual, MacroAssembler::DoubleLessThanOrEqual);
+            case GreaterEqual:
+                return createRelCond(MacroAssembler::GreaterThanOrEqual, MacroAssembler::DoubleGreaterThanOrEqual);
+            case EqualOrUnordered:
+                // The integer condition is never used in this case.
+                return createRelCond(MacroAssembler::Equal, MacroAssembler::DoubleEqualOrUnordered);
+            case Above:
+                // We use a bogus double condition because these integer comparisons won't got down that
+                // path anyway.
+                return createRelCond(MacroAssembler::Above, MacroAssembler::DoubleEqual);
+            case Below:
+                return createRelCond(MacroAssembler::Below, MacroAssembler::DoubleEqual);
+            case AboveEqual:
+                return createRelCond(MacroAssembler::AboveOrEqual, MacroAssembler::DoubleEqual);
+            case BelowEqual:
+                return createRelCond(MacroAssembler::BelowOrEqual, MacroAssembler::DoubleEqual);
+            case BitAnd: {
+                Value* left = value->child(0);
+                Value* right = value->child(1);
+
+                bool hasRightConst;
+                int64_t rightConst;
+                Arg rightImm;
+                Arg rightImm64;
+
+                hasRightConst = right->hasInt();
+                if (hasRightConst) {
+                    rightConst = right->asInt();
+                    rightImm = bitImm(right);
+                    rightImm64 = bitImm64(right);
+                }
+                
+                auto tryTestLoadImm = [&] (Arg::Width width, Arg::Signedness signedness, B3::Opcode loadOpcode) -> Inst {
+                    if (!hasRightConst)
+                        return Inst();
+                    // Signed loads will create high bits, so if the immediate has high bits
+                    // then we cannot proceed. Consider BitAnd(Load8S(ptr), 0x101). This cannot
+                    // be turned into testb (ptr), $1, since if the high bit within that byte
+                    // was set then it would be extended to include 0x100. The handling below
+                    // won't anticipate this, so we need to catch it here.
+                    if (signedness == Arg::Signed
+                        && !Arg::isRepresentableAs(width, Arg::Unsigned, rightConst))
+                        return Inst();
+                    
+                    // FIXME: If this is unsigned then we can chop things off of the immediate.
+                    // This might make the immediate more legal. Perhaps that's a job for
+                    // strength reduction?
+                    
+                    if (rightImm) {
+                        if (Inst result = tryTest(width, loadPromise(left, loadOpcode), rightImm)) {
+                            commitInternal(left);
+                            return result;
+                        }
+                    }
+                    if (rightImm64) {
+                        if (Inst result = tryTest(width, loadPromise(left, loadOpcode), rightImm64)) {
+                            commitInternal(left);
+                            return result;
+                        }
+                    }
+                    return Inst();
+                };
+
+                if (canCommitInternal) {
+                    // First handle test's that involve fewer bits than B3's type system supports.
+
+                    if (Inst result = tryTestLoadImm(Arg::Width8, Arg::Unsigned, Load8Z))
+                        return result;
+                    
+                    if (Inst result = tryTestLoadImm(Arg::Width8, Arg::Signed, Load8S))
+                        return result;
+                    
+                    if (Inst result = tryTestLoadImm(Arg::Width16, Arg::Unsigned, Load16Z))
+                        return result;
+                    
+                    if (Inst result = tryTestLoadImm(Arg::Width16, Arg::Signed, Load16S))
+                        return result;
+
+                    // This allows us to use a 32-bit test for 64-bit BitAnd if the immediate is
+                    // representable as an unsigned 32-bit value. The logic involved is the same
+                    // as if we were pondering using a 32-bit test for
+                    // BitAnd(SExt(Load(ptr)), const), in the sense that in both cases we have
+                    // to worry about high bits. So, we use the "Signed" version of this helper.
+                    if (Inst result = tryTestLoadImm(Arg::Width32, Arg::Signed, Load))
+                        return result;
+                    
+                    // This is needed to handle 32-bit test for arbitrary 32-bit immediates.
+                    if (Inst result = tryTestLoadImm(width, Arg::Unsigned, Load))
+                        return result;
+                    
+                    // Now handle test's that involve a load.
+                    
+                    Arg::Width width = Arg::widthForB3Type(value->child(0)->type());
+                    if (Inst result = tryTest(width, loadPromise(left), tmpPromise(right))) {
+                        commitInternal(left);
+                        return result;
+                    }
+                    
+                    if (Inst result = tryTest(width, tmpPromise(left), loadPromise(right))) {
+                        commitInternal(right);
+                        return result;
+                    }
+                }
+
+                // Now handle test's that involve an immediate and a tmp.
+
+                if (hasRightConst) {
+                    if ((width == Arg::Width32 && rightConst == 0xffffffff)
+                        || (width == Arg::Width64 && rightConst == -1)) {
+                        if (Inst result = tryTest(width, tmpPromise(left), tmpPromise(left)))
+                            return result;
+                    }
+                    if (isRepresentableAs<uint32_t>(rightConst)) {
+                        if (Inst result = tryTest(Arg::Width32, tmpPromise(left), rightImm))
+                            return result;
+                        if (Inst result = tryTest(Arg::Width32, tmpPromise(left), rightImm64))
+                            return result;
+                    }
+                    if (Inst result = tryTest(width, tmpPromise(left), rightImm))
+                        return result;
+                    if (Inst result = tryTest(width, tmpPromise(left), rightImm64))
+                        return result;
+                }
+
+                // Finally, just do tmp's.
+                return tryTest(width, tmpPromise(left), tmpPromise(right));
+            }
+            default:
+                return Inst();
+            }
+        };
+
+        if (FusionResult fusionResult = prepareToFuse(value)) {
+            if (Inst result = attemptFused()) {
+                commitFusion(value, fusionResult);
+                return result;
+            }
+        }
+
+        if (Arg::isValidBitImmForm(-1)) {
+            if (canCommitInternal && value->as<MemoryValue>()) {
+                // Handle things like Branch(Load8Z(value))
+
+                if (Inst result = tryTest(Arg::Width8, loadPromise(value, Load8Z), Arg::bitImm(-1))) {
+                    commitInternal(value);
+                    return result;
+                }
+
+                if (Inst result = tryTest(Arg::Width8, loadPromise(value, Load8S), Arg::bitImm(-1))) {
+                    commitInternal(value);
+                    return result;
+                }
+
+                if (Inst result = tryTest(Arg::Width16, loadPromise(value, Load16Z), Arg::bitImm(-1))) {
+                    commitInternal(value);
+                    return result;
+                }
+
+                if (Inst result = tryTest(Arg::Width16, loadPromise(value, Load16S), Arg::bitImm(-1))) {
+                    commitInternal(value);
+                    return result;
+                }
+
+                if (Inst result = tryTest(width, loadPromise(value), Arg::bitImm(-1))) {
+                    commitInternal(value);
+                    return result;
+                }
+            }
+
+            ArgPromise leftPromise = tmpPromise(value);
+            ArgPromise rightPromise = Arg::bitImm(-1);
+            if (Inst result = test(width, resCond, leftPromise, rightPromise))
+                return result;
+        }
+        
+        // Sometimes this is the only form of test available. We prefer not to use this because
+        // it's less canonical.
+        ArgPromise leftPromise = tmpPromise(value);
+        ArgPromise rightPromise = tmpPromise(value);
+        return test(width, resCond, leftPromise, rightPromise);
+    }
+
+    Inst createBranch(Value* value, bool inverted = false)
+    {
+        return createGenericCompare(
+            value,
+            [this] (
+                Arg::Width width, const Arg& relCond,
+                ArgPromise& left, ArgPromise& right) -> Inst {
+                switch (width) {
+                case Arg::Width8:
+                    if (isValidForm(Branch8, Arg::RelCond, left.kind(), right.kind())) {
+                        return left.inst(right.inst(
+                            Branch8, m_value, relCond,
+                            left.consume(*this), right.consume(*this)));
+                    }
+                    return Inst();
+                case Arg::Width16:
+                    return Inst();
+                case Arg::Width32:
+                    if (isValidForm(Branch32, Arg::RelCond, left.kind(), right.kind())) {
+                        return left.inst(right.inst(
+                            Branch32, m_value, relCond,
+                            left.consume(*this), right.consume(*this)));
+                    }
+                    return Inst();
+                case Arg::Width64:
+                    if (isValidForm(Branch64, Arg::RelCond, left.kind(), right.kind())) {
+                        return left.inst(right.inst(
+                            Branch64, m_value, relCond,
+                            left.consume(*this), right.consume(*this)));
+                    }
+                    return Inst();
+                }
+                ASSERT_NOT_REACHED();
+            },
+            [this] (
+                Arg::Width width, const Arg& resCond,
+                ArgPromise& left, ArgPromise& right) -> Inst {
+                switch (width) {
+                case Arg::Width8:
+                    if (isValidForm(BranchTest8, Arg::ResCond, left.kind(), right.kind())) {
+                        return left.inst(right.inst(
+                            BranchTest8, m_value, resCond,
+                            left.consume(*this), right.consume(*this)));
+                    }
+                    return Inst();
+                case Arg::Width16:
+                    return Inst();
+                case Arg::Width32:
+                    if (isValidForm(BranchTest32, Arg::ResCond, left.kind(), right.kind())) {
+                        return left.inst(right.inst(
+                            BranchTest32, m_value, resCond,
+                            left.consume(*this), right.consume(*this)));
+                    }
+                    return Inst();
+                case Arg::Width64:
+                    if (isValidForm(BranchTest64, Arg::ResCond, left.kind(), right.kind())) {
+                        return left.inst(right.inst(
+                            BranchTest64, m_value, resCond,
+                            left.consume(*this), right.consume(*this)));
+                    }
+                    return Inst();
+                }
+                ASSERT_NOT_REACHED();
+            },
+            [this] (Arg doubleCond, ArgPromise& left, ArgPromise& right) -> Inst {
+                if (isValidForm(BranchDouble, Arg::DoubleCond, left.kind(), right.kind())) {
+                    return left.inst(right.inst(
+                        BranchDouble, m_value, doubleCond,
+                        left.consume(*this), right.consume(*this)));
+                }
+                return Inst();
+            },
+            [this] (Arg doubleCond, ArgPromise& left, ArgPromise& right) -> Inst {
+                if (isValidForm(BranchFloat, Arg::DoubleCond, left.kind(), right.kind())) {
+                    return left.inst(right.inst(
+                        BranchFloat, m_value, doubleCond,
+                        left.consume(*this), right.consume(*this)));
+                }
+                return Inst();
+            },
+            inverted);
+    }
+
+    Inst createCompare(Value* value, bool inverted = false)
+    {
+        return createGenericCompare(
+            value,
+            [this] (
+                Arg::Width width, const Arg& relCond,
+                ArgPromise& left, ArgPromise& right) -> Inst {
+                switch (width) {
+                case Arg::Width8:
+                case Arg::Width16:
+                    return Inst();
+                case Arg::Width32:
+                    if (isValidForm(Compare32, Arg::RelCond, left.kind(), right.kind(), Arg::Tmp)) {
+                        return left.inst(right.inst(
+                            Compare32, m_value, relCond,
+                            left.consume(*this), right.consume(*this), tmp(m_value)));
+                    }
+                    return Inst();
+                case Arg::Width64:
+                    if (isValidForm(Compare64, Arg::RelCond, left.kind(), right.kind(), Arg::Tmp)) {
+                        return left.inst(right.inst(
+                            Compare64, m_value, relCond,
+                            left.consume(*this), right.consume(*this), tmp(m_value)));
+                    }
+                    return Inst();
+                }
+                ASSERT_NOT_REACHED();
+            },
+            [this] (
+                Arg::Width width, const Arg& resCond,
+                ArgPromise& left, ArgPromise& right) -> Inst {
+                switch (width) {
+                case Arg::Width8:
+                case Arg::Width16:
+                    return Inst();
+                case Arg::Width32:
+                    if (isValidForm(Test32, Arg::ResCond, left.kind(), right.kind(), Arg::Tmp)) {
+                        return left.inst(right.inst(
+                            Test32, m_value, resCond,
+                            left.consume(*this), right.consume(*this), tmp(m_value)));
+                    }
+                    return Inst();
+                case Arg::Width64:
+                    if (isValidForm(Test64, Arg::ResCond, left.kind(), right.kind(), Arg::Tmp)) {
+                        return left.inst(right.inst(
+                            Test64, m_value, resCond,
+                            left.consume(*this), right.consume(*this), tmp(m_value)));
+                    }
+                    return Inst();
+                }
+                ASSERT_NOT_REACHED();
+            },
+            [this] (const Arg& doubleCond, ArgPromise& left, ArgPromise& right) -> Inst {
+                if (isValidForm(CompareDouble, Arg::DoubleCond, left.kind(), right.kind(), Arg::Tmp)) {
+                    return left.inst(right.inst(
+                        CompareDouble, m_value, doubleCond,
+                        left.consume(*this), right.consume(*this), tmp(m_value)));
+                }
+                return Inst();
+            },
+            [this] (const Arg& doubleCond, ArgPromise& left, ArgPromise& right) -> Inst {
+                if (isValidForm(CompareFloat, Arg::DoubleCond, left.kind(), right.kind(), Arg::Tmp)) {
+                    return left.inst(right.inst(
+                        CompareFloat, m_value, doubleCond,
+                        left.consume(*this), right.consume(*this), tmp(m_value)));
+                }
+                return Inst();
+            },
+            inverted);
+    }
+
+    struct MoveConditionallyConfig {
+        Air::Opcode moveConditionally32;
+        Air::Opcode moveConditionally64;
+        Air::Opcode moveConditionallyTest32;
+        Air::Opcode moveConditionallyTest64;
+        Air::Opcode moveConditionallyDouble;
+        Air::Opcode moveConditionallyFloat;
+    };
+    Inst createSelect(const MoveConditionallyConfig& config)
+    {
+        auto createSelectInstruction = [&] (Air::Opcode opcode, const Arg& condition, ArgPromise& left, ArgPromise& right) -> Inst {
+            if (isValidForm(opcode, condition.kind(), left.kind(), right.kind(), Arg::Tmp, Arg::Tmp, Arg::Tmp)) {
+                Tmp result = tmp(m_value);
+                Tmp thenCase = tmp(m_value->child(1));
+                Tmp elseCase = tmp(m_value->child(2));
+                return left.inst(right.inst(
+                    opcode, m_value, condition,
+                    left.consume(*this), right.consume(*this), thenCase, elseCase, result));
+            }
+            if (isValidForm(opcode, condition.kind(), left.kind(), right.kind(), Arg::Tmp, Arg::Tmp)) {
+                Tmp result = tmp(m_value);
+                Tmp source = tmp(m_value->child(1));
+                append(relaxedMoveForType(m_value->type()), tmp(m_value->child(2)), result);
+                return left.inst(right.inst(
+                    opcode, m_value, condition,
+                    left.consume(*this), right.consume(*this), source, result));
+            }
+            return Inst();
+        };
+
+        return createGenericCompare(
+            m_value->child(0),
+            [&] (
+                Arg::Width width, const Arg& relCond,
+                ArgPromise& left, ArgPromise& right) -> Inst {
+                switch (width) {
+                case Arg::Width8:
+                    // FIXME: Support these things.
+                    // https://bugs.webkit.org/show_bug.cgi?id=151504
+                    return Inst();
+                case Arg::Width16:
+                    return Inst();
+                case Arg::Width32:
+                    return createSelectInstruction(config.moveConditionally32, relCond, left, right);
+                case Arg::Width64:
+                    return createSelectInstruction(config.moveConditionally64, relCond, left, right);
+                }
+                ASSERT_NOT_REACHED();
+            },
+            [&] (
+                Arg::Width width, const Arg& resCond,
+                ArgPromise& left, ArgPromise& right) -> Inst {
+                switch (width) {
+                case Arg::Width8:
+                    // FIXME: Support more things.
+                    // https://bugs.webkit.org/show_bug.cgi?id=151504
+                    return Inst();
+                case Arg::Width16:
+                    return Inst();
+                case Arg::Width32:
+                    return createSelectInstruction(config.moveConditionallyTest32, resCond, left, right);
+                case Arg::Width64:
+                    return createSelectInstruction(config.moveConditionallyTest64, resCond, left, right);
+                }
+                ASSERT_NOT_REACHED();
+            },
+            [&] (Arg doubleCond, ArgPromise& left, ArgPromise& right) -> Inst {
+                return createSelectInstruction(config.moveConditionallyDouble, doubleCond, left, right);
+            },
+            [&] (Arg doubleCond, ArgPromise& left, ArgPromise& right) -> Inst {
+                return createSelectInstruction(config.moveConditionallyFloat, doubleCond, left, right);
+            },
+            false);
+    }
+    
+    bool tryAppendLea()
+    {
+        Air::Opcode leaOpcode = tryOpcodeForType(Lea32, Lea64, m_value->type());
+        if (!isValidForm(leaOpcode, Arg::Index, Arg::Tmp))
+            return false;
+        
+        // This lets us turn things like this:
+        //
+        //     Add(Add(@x, Shl(@y, $2)), $100)
+        //
+        // Into this:
+        //
+        //     lea 100(%rdi,%rsi,4), %rax
+        //
+        // We have a choice here between committing the internal bits of an index or sharing
+        // them. There are solid arguments for both.
+        //
+        // Sharing: The word on the street is that the cost of a lea is one cycle no matter
+        // what it does. Every experiment I've ever seen seems to confirm this. So, sharing
+        // helps us in situations where Wasm input did this:
+        //
+        //     x = a[i].x;
+        //     y = a[i].y;
+        //
+        // With sharing we would do:
+        //
+        //     leal (%a,%i,4), %tmp
+        //     cmp (%size, %tmp)
+        //     ja _fail
+        //     movl (%base, %tmp), %x
+        //     leal 4(%a,%i,4), %tmp
+        //     cmp (%size, %tmp)
+        //     ja _fail
+        //     movl (%base, %tmp), %y
+        //
+        // In the absence of sharing, we may find ourselves needing separate registers for
+        // the innards of the index. That's relatively unlikely to be a thing due to other
+        // optimizations that we already have, but it could happen
+        //
+        // Committing: The worst case is that there is a complicated graph of additions and
+        // shifts, where each value has multiple uses. In that case, it's better to compute
+        // each one separately from the others since that way, each calculation will use a
+        // relatively nearby tmp as its input. That seems uncommon, but in those cases,
+        // committing is a clear winner: it would result in a simple interference graph
+        // while sharing would result in a complex one. Interference sucks because it means
+        // more time in IRC and it means worse code.
+        //
+        // It's not super clear if any of these corner cases would ever arise. Committing
+        // has the benefit that it's easier to reason about, and protects a much darker
+        // corner case (more interference).
+                
+        // Here are the things we want to match:
+        // Add(Add(@x, @y), $c)
+        // Add(Shl(@x, $c), @y)
+        // Add(@x, Shl(@y, $c))
+        // Add(Add(@x, Shl(@y, $c)), $d)
+        // Add(Add(Shl(@x, $c), @y), $d)
+        //
+        // Note that if you do Add(Shl(@x, $c), $d) then we will treat $d as a non-constant and
+        // force it to materialize. You'll get something like this:
+        //
+        // movl $d, %tmp
+        // leal (%tmp,%x,1<<c), %result
+        //
+        // Which is pretty close to optimal and has the nice effect of being able to handle large
+        // constants gracefully.
+        
+        Value* innerAdd = nullptr;
+        
+        Value* value = m_value;
+        
+        // We're going to consume Add(Add(_), $c). If we succeed at consuming it then we have these
+        // patterns left (i.e. in the Add(_)):
+        //
+        // Add(Add(@x, @y), $c)
+        // Add(Add(@x, Shl(@y, $c)), $d)
+        // Add(Add(Shl(@x, $c), @y), $d)
+        //
+        // Otherwise we are looking at these patterns:
+        //
+        // Add(Shl(@x, $c), @y)
+        // Add(@x, Shl(@y, $c))
+        //
+        // This means that the subsequent code only has to worry about three patterns:
+        //
+        // Add(Shl(@x, $c), @y)
+        // Add(@x, Shl(@y, $c))
+        // Add(@x, @y) (only if offset != 0)
+        int32_t offset = 0;
+        if (value->child(1)->isRepresentableAs<int32_t>()
+            && canBeInternal(value->child(0))
+            && value->child(0)->opcode() == Add) {
+            innerAdd = value->child(0);
+            offset = static_cast<int32_t>(value->child(1)->asInt());
+            value = value->child(0);
+        }
+        
+        auto tryShl = [&] (Value* shl, Value* other) -> bool {
+            std::optional<unsigned> scale = scaleForShl(shl, offset);
+            if (!scale)
+                return false;
+            if (!canBeInternal(shl))
+                return false;
+            
+            ASSERT(!m_locked.contains(shl->child(0)));
+            ASSERT(!m_locked.contains(other));
+            
+            append(leaOpcode, Arg::index(tmp(other), tmp(shl->child(0)), *scale, offset), tmp(m_value));
+            commitInternal(innerAdd);
+            commitInternal(shl);
+            return true;
+        };
+        
+        if (tryShl(value->child(0), value->child(1)))
+            return true;
+        if (tryShl(value->child(1), value->child(0)))
+            return true;
+        
+        // The remaining pattern is just:
+        // Add(@x, @y) (only if offset != 0)
+        if (!offset)
+            return false;
+        ASSERT(!m_locked.contains(value->child(0)));
+        ASSERT(!m_locked.contains(value->child(1)));
+        append(leaOpcode, Arg::index(tmp(value->child(0)), tmp(value->child(1)), 1, offset), tmp(m_value));
+        commitInternal(innerAdd);
+        return true;
+    }
+
+    void lower()
+    {
+        switch (m_value->opcode()) {
+        case B3::Nop: {
+            // Yes, we will totally see Nop's because some phases will replaceWithNop() instead of
+            // properly removing things.
+            return;
+        }
+            
+        case Load: {
+            append(trappingInst(m_value, moveForType(m_value->type()), m_value, addr(m_value), tmp(m_value)));
+            return;
+        }
+            
+        case Load8S: {
+            append(trappingInst(m_value, Load8SignedExtendTo32, m_value, addr(m_value), tmp(m_value)));
+            return;
+        }
+
+        case Load8Z: {
+            append(trappingInst(m_value, Load8, m_value, addr(m_value), tmp(m_value)));
+            return;
+        }
+
+        case Load16S: {
+            append(trappingInst(m_value, Load16SignedExtendTo32, m_value, addr(m_value), tmp(m_value)));
+            return;
+        }
+
+        case Load16Z: {
+            append(trappingInst(m_value, Load16, m_value, addr(m_value), tmp(m_value)));
+            return;
+        }
+
+        case Add: {
+            if (tryAppendLea())
+                return;
+            
+            Air::Opcode multiplyAddOpcode = tryOpcodeForType(MultiplyAdd32, MultiplyAdd64, m_value->type());
+            if (isValidForm(multiplyAddOpcode, Arg::Tmp, Arg::Tmp, Arg::Tmp, Arg::Tmp)) {
+                Value* left = m_value->child(0);
+                Value* right = m_value->child(1);
+                if (!imm(right) || m_valueToTmp[right]) {
+                    auto tryAppendMultiplyAdd = [&] (Value* left, Value* right) -> bool {
+                        if (left->opcode() != Mul || !canBeInternal(left))
+                            return false;
+
+                        Value* multiplyLeft = left->child(0);
+                        Value* multiplyRight = left->child(1);
+                        if (canBeInternal(multiplyLeft) || canBeInternal(multiplyRight))
+                            return false;
+
+                        append(multiplyAddOpcode, tmp(multiplyLeft), tmp(multiplyRight), tmp(right), tmp(m_value));
+                        commitInternal(left);
+
+                        return true;
+                    };
+
+                    if (tryAppendMultiplyAdd(left, right))
+                        return;
+                    if (tryAppendMultiplyAdd(right, left))
+                        return;
+                }
+            }
+
+            appendBinOp<Add32, Add64, AddDouble, AddFloat, Commutative>(
+                m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case Sub: {
+            Air::Opcode multiplySubOpcode = tryOpcodeForType(MultiplySub32, MultiplySub64, m_value->type());
+            if (multiplySubOpcode != Air::Oops
+                && isValidForm(multiplySubOpcode, Arg::Tmp, Arg::Tmp, Arg::Tmp, Arg::Tmp)) {
+                Value* left = m_value->child(0);
+                Value* right = m_value->child(1);
+                if (!imm(right) || m_valueToTmp[right]) {
+                    auto tryAppendMultiplySub = [&] () -> bool {
+                        if (right->opcode() != Mul || !canBeInternal(right))
+                            return false;
+
+                        Value* multiplyLeft = right->child(0);
+                        Value* multiplyRight = right->child(1);
+                        if (m_locked.contains(multiplyLeft) || m_locked.contains(multiplyRight))
+                            return false;
+
+                        append(multiplySubOpcode, tmp(multiplyLeft), tmp(multiplyRight), tmp(left), tmp(m_value));
+                        commitInternal(right);
+
+                        return true;
+                    };
+
+                    if (tryAppendMultiplySub())
+                        return;
+                }
+            }
+
+            appendBinOp<Sub32, Sub64, SubDouble, SubFloat>(m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case Neg: {
+            Air::Opcode multiplyNegOpcode = tryOpcodeForType(MultiplyNeg32, MultiplyNeg64, m_value->type());
+            if (multiplyNegOpcode != Air::Oops
+                && isValidForm(multiplyNegOpcode, Arg::Tmp, Arg::Tmp, Arg::Tmp)
+                && m_value->child(0)->opcode() == Mul
+                && canBeInternal(m_value->child(0))) {
+                Value* multiplyOperation = m_value->child(0);
+                Value* multiplyLeft = multiplyOperation->child(0);
+                Value* multiplyRight = multiplyOperation->child(1);
+                if (!m_locked.contains(multiplyLeft) && !m_locked.contains(multiplyRight)) {
+                    append(multiplyNegOpcode, tmp(multiplyLeft), tmp(multiplyRight), tmp(m_value));
+                    commitInternal(multiplyOperation);
+                    return;
+                }
+            }
+
+            appendUnOp<Neg32, Neg64, NegateDouble, NegateFloat>(m_value->child(0));
+            return;
+        }
+
+        case Mul: {
+            appendBinOp<Mul32, Mul64, MulDouble, MulFloat, Commutative>(
+                m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case Div: {
+            if (m_value->isChill())
+                RELEASE_ASSERT(isARM64());
+            if (isInt(m_value->type()) && isX86()) {
+                lowerX86Div(Div);
+                return;
+            }
+            ASSERT(!isX86() || isFloat(m_value->type()));
+
+            appendBinOp<Div32, Div64, DivDouble, DivFloat>(m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case UDiv: {
+            if (isInt(m_value->type()) && isX86()) {
+                lowerX86UDiv(UDiv);
+                return;
+            }
+
+            ASSERT(!isX86() && !isFloat(m_value->type()));
+
+            appendBinOp<UDiv32, UDiv64, Air::Oops, Air::Oops>(m_value->child(0), m_value->child(1));
+            return;
+
+        }
+
+        case Mod: {
+            RELEASE_ASSERT(isX86());
+            RELEASE_ASSERT(!m_value->isChill());
+            lowerX86Div(Mod);
+            return;
+        }
+
+        case UMod: {
+            RELEASE_ASSERT(isX86());
+            lowerX86UDiv(UMod);
+            return;
+        }
+
+        case BitAnd: {
+            if (m_value->child(1)->isInt(0xff)) {
+                appendUnOp<ZeroExtend8To32, ZeroExtend8To32>(m_value->child(0));
+                return;
+            }
+            
+            if (m_value->child(1)->isInt(0xffff)) {
+                appendUnOp<ZeroExtend16To32, ZeroExtend16To32>(m_value->child(0));
+                return;
+            }
+
+            if (m_value->child(1)->isInt(0xffffffff)) {
+                appendUnOp<Move32, Move32>(m_value->child(0));
+                return;
+            }
+            
+            appendBinOp<And32, And64, AndDouble, AndFloat, Commutative>(
+                m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case BitOr: {
+            appendBinOp<Or32, Or64, Commutative>(
+                m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case BitXor: {
+            // FIXME: If canBeInternal(child), we should generate this using the comparison path.
+            // https://bugs.webkit.org/show_bug.cgi?id=152367
+            
+            if (m_value->child(1)->isInt(-1)) {
+                appendUnOp<Not32, Not64>(m_value->child(0));
+                return;
+            }
+            appendBinOp<Xor32, Xor64, XorDouble, XorFloat, Commutative>(
+                m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case Shl: {
+            if (m_value->child(1)->isInt32(1)) {
+                appendBinOp<Add32, Add64, AddDouble, AddFloat, Commutative>(m_value->child(0), m_value->child(0));
+                return;
+            }
+            
+            appendShift<Lshift32, Lshift64>(m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case SShr: {
+            appendShift<Rshift32, Rshift64>(m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case ZShr: {
+            appendShift<Urshift32, Urshift64>(m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case RotR: {
+            appendShift<RotateRight32, RotateRight64>(m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case RotL: {
+            appendShift<RotateLeft32, RotateLeft64>(m_value->child(0), m_value->child(1));
+            return;
+        }
+
+        case Clz: {
+            appendUnOp<CountLeadingZeros32, CountLeadingZeros64>(m_value->child(0));
+            return;
+        }
+
+        case Abs: {
+            RELEASE_ASSERT_WITH_MESSAGE(!isX86(), "Abs is not supported natively on x86. It must be replaced before generation.");
+            appendUnOp<Air::Oops, Air::Oops, AbsDouble, AbsFloat>(m_value->child(0));
+            return;
+        }
+
+        case Ceil: {
+            appendUnOp<Air::Oops, Air::Oops, CeilDouble, CeilFloat>(m_value->child(0));
+            return;
+        }
+
+        case Floor: {
+            appendUnOp<Air::Oops, Air::Oops, FloorDouble, FloorFloat>(m_value->child(0));
+            return;
+        }
+
+        case Sqrt: {
+            appendUnOp<Air::Oops, Air::Oops, SqrtDouble, SqrtFloat>(m_value->child(0));
+            return;
+        }
+
+        case BitwiseCast: {
+            appendUnOp<Move32ToFloat, Move64ToDouble, MoveDoubleTo64, MoveFloatTo32>(m_value->child(0));
+            return;
+        }
+
+        case Store: {
+            Value* valueToStore = m_value->child(0);
+            if (canBeInternal(valueToStore)) {
+                bool matched = false;
+                switch (valueToStore->opcode()) {
+                case Add:
+                    matched = tryAppendStoreBinOp<Add32, Add64, Commutative>(
+                        valueToStore->child(0), valueToStore->child(1));
+                    break;
+                case Sub:
+                    if (valueToStore->child(0)->isInt(0)) {
+                        matched = tryAppendStoreUnOp<Neg32, Neg64>(valueToStore->child(1));
+                        break;
+                    }
+                    matched = tryAppendStoreBinOp<Sub32, Sub64>(
+                        valueToStore->child(0), valueToStore->child(1));
+                    break;
+                case BitAnd:
+                    matched = tryAppendStoreBinOp<And32, And64, Commutative>(
+                        valueToStore->child(0), valueToStore->child(1));
+                    break;
+                case BitXor:
+                    if (valueToStore->child(1)->isInt(-1)) {
+                        matched = tryAppendStoreUnOp<Not32, Not64>(valueToStore->child(0));
+                        break;
+                    }
+                    matched = tryAppendStoreBinOp<Xor32, Xor64, Commutative>(
+                        valueToStore->child(0), valueToStore->child(1));
+                    break;
+                default:
+                    break;
+                }
+                if (matched) {
+                    commitInternal(valueToStore);
+                    return;
+                }
+            }
+
+            appendStore(valueToStore, addr(m_value));
+            return;
+        }
+
+        case B3::Store8: {
+            Value* valueToStore = m_value->child(0);
+            if (canBeInternal(valueToStore)) {
+                bool matched = false;
+                switch (valueToStore->opcode()) {
+                case Add:
+                    matched = tryAppendStoreBinOp<Add8, Air::Oops, Commutative>(
+                        valueToStore->child(0), valueToStore->child(1));
+                    break;
+                default:
+                    break;
+                }
+                if (matched) {
+                    commitInternal(valueToStore);
+                    return;
+                }
+            }
+            appendStore(Air::Store8, valueToStore, addr(m_value));
+            return;
+        }
+
+        case B3::Store16: {
+            Value* valueToStore = m_value->child(0);
+            if (canBeInternal(valueToStore)) {
+                bool matched = false;
+                switch (valueToStore->opcode()) {
+                case Add:
+                    matched = tryAppendStoreBinOp<Add16, Air::Oops, Commutative>(
+                        valueToStore->child(0), valueToStore->child(1));
+                    break;
+                default:
+                    break;
+                }
+                if (matched) {
+                    commitInternal(valueToStore);
+                    return;
+                }
+            }
+            appendStore(Air::Store16, valueToStore, addr(m_value));
+            return;
+        }
+
+        case WasmAddress: {
+            WasmAddressValue* address = m_value->as<WasmAddressValue>();
+
+            append(Add64, Arg(address->pinnedGPR()), tmp(address));
+            return;
+        }
+
+        case Fence: {
+            FenceValue* fence = m_value->as<FenceValue>();
+            if (!fence->write && !fence->read)
+                return;
+            if (!fence->write) {
+                // A fence that reads but does not write is for protecting motion of stores.
+                append(StoreFence);
+                return;
+            }
+            if (!fence->read) {
+                // A fence that writes but does not read is for protecting motion of loads.
+                append(LoadFence);
+                return;
+            }
+            append(MemoryFence);
+            return;
+        }
+
+        case Trunc: {
+            ASSERT(tmp(m_value->child(0)) == tmp(m_value));
+            return;
+        }
+
+        case SExt8: {
+            appendUnOp<SignExtend8To32, Air::Oops>(m_value->child(0));
+            return;
+        }
+
+        case SExt16: {
+            appendUnOp<SignExtend16To32, Air::Oops>(m_value->child(0));
+            return;
+        }
+
+        case ZExt32: {
+            appendUnOp<Move32, Air::Oops>(m_value->child(0));
+            return;
+        }
+
+        case SExt32: {
+            // FIXME: We should have support for movsbq/movswq
+            // https://bugs.webkit.org/show_bug.cgi?id=152232
+            
+            appendUnOp<SignExtend32ToPtr, Air::Oops>(m_value->child(0));
+            return;
+        }
+
+        case FloatToDouble: {
+            appendUnOp<Air::Oops, Air::Oops, Air::Oops, ConvertFloatToDouble>(m_value->child(0));
+            return;
+        }
+
+        case DoubleToFloat: {
+            appendUnOp<Air::Oops, Air::Oops, ConvertDoubleToFloat>(m_value->child(0));
+            return;
+        }
+
+        case ArgumentReg: {
+            m_prologue.append(Inst(
+                moveForType(m_value->type()), m_value,
+                Tmp(m_value->as<ArgumentRegValue>()->argumentReg()),
+                tmp(m_value)));
+            return;
+        }
+
+        case Const32:
+        case Const64: {
+            if (imm(m_value))
+                append(Move, imm(m_value), tmp(m_value));
+            else
+                append(Move, Arg::bigImm(m_value->asInt()), tmp(m_value));
+            return;
+        }
+
+        case ConstDouble:
+        case ConstFloat: {
+            // We expect that the moveConstants() phase has run, and any doubles referenced from
+            // stackmaps get fused.
+            RELEASE_ASSERT(m_value->opcode() == ConstFloat || isIdentical(m_value->asDouble(), 0.0));
+            RELEASE_ASSERT(m_value->opcode() == ConstDouble || isIdentical(m_value->asFloat(), 0.0f));
+            append(MoveZeroToDouble, tmp(m_value));
+            return;
+        }
+
+        case FramePointer: {
+            ASSERT(tmp(m_value) == Tmp(GPRInfo::callFrameRegister));
+            return;
+        }
+
+        case SlotBase: {
+            append(
+                pointerType() == Int64 ? Lea64 : Lea32,
+                Arg::stack(m_stackToStack.get(m_value->as<SlotBaseValue>()->slot())),
+                tmp(m_value));
+            return;
+        }
+
+        case Equal:
+        case NotEqual:
+        case LessThan:
+        case GreaterThan:
+        case LessEqual:
+        case GreaterEqual:
+        case Above:
+        case Below:
+        case AboveEqual:
+        case BelowEqual:
+        case EqualOrUnordered: {
+            m_insts.last().append(createCompare(m_value));
+            return;
+        }
+
+        case Select: {
+            MoveConditionallyConfig config;
+            if (isInt(m_value->type())) {
+                config.moveConditionally32 = MoveConditionally32;
+                config.moveConditionally64 = MoveConditionally64;
+                config.moveConditionallyTest32 = MoveConditionallyTest32;
+                config.moveConditionallyTest64 = MoveConditionallyTest64;
+                config.moveConditionallyDouble = MoveConditionallyDouble;
+                config.moveConditionallyFloat = MoveConditionallyFloat;
+            } else {
+                // FIXME: it's not obvious that these are particularly efficient.
+                config.moveConditionally32 = MoveDoubleConditionally32;
+                config.moveConditionally64 = MoveDoubleConditionally64;
+                config.moveConditionallyTest32 = MoveDoubleConditionallyTest32;
+                config.moveConditionallyTest64 = MoveDoubleConditionallyTest64;
+                config.moveConditionallyDouble = MoveDoubleConditionallyDouble;
+                config.moveConditionallyFloat = MoveDoubleConditionallyFloat;
+            }
+            
+            m_insts.last().append(createSelect(config));
+            return;
+        }
+
+        case IToD: {
+            appendUnOp<ConvertInt32ToDouble, ConvertInt64ToDouble>(m_value->child(0));
+            return;
+        }
+
+        case IToF: {
+            appendUnOp<ConvertInt32ToFloat, ConvertInt64ToFloat>(m_value->child(0));
+            return;
+        }
+
+        case B3::CCall: {
+            CCallValue* cCall = m_value->as<CCallValue>();
+
+            Inst inst(m_isRare ? Air::ColdCCall : Air::CCall, cCall);
+
+            // We have a ton of flexibility regarding the callee argument, but currently, we don't
+            // use it yet. It gets weird for reasons:
+            // 1) We probably will never take advantage of this. We don't have C calls to locations
+            //    loaded from addresses. We have JS calls like that, but those use Patchpoints.
+            // 2) On X86_64 we still don't support call with BaseIndex.
+            // 3) On non-X86, we don't natively support any kind of loading from address.
+            // 4) We don't have an isValidForm() for the CCallSpecial so we have no smart way to
+            //    decide.
+            // FIXME: https://bugs.webkit.org/show_bug.cgi?id=151052
+            inst.args.append(tmp(cCall->child(0)));
+
+            if (cCall->type() != Void)
+                inst.args.append(tmp(cCall));
+
+            for (unsigned i = 1; i < cCall->numChildren(); ++i)
+                inst.args.append(immOrTmp(cCall->child(i)));
+
+            m_insts.last().append(WTFMove(inst));
+            return;
+        }
+
+        case Patchpoint: {
+            PatchpointValue* patchpointValue = m_value->as<PatchpointValue>();
+            ensureSpecial(m_patchpointSpecial);
+            
+            Inst inst(Patch, patchpointValue, Arg::special(m_patchpointSpecial));
+
+            Vector<Inst> after;
+            if (patchpointValue->type() != Void) {
+                switch (patchpointValue->resultConstraint.kind()) {
+                case ValueRep::WarmAny:
+                case ValueRep::ColdAny:
+                case ValueRep::LateColdAny:
+                case ValueRep::SomeRegister:
+                case ValueRep::SomeEarlyRegister:
+                    inst.args.append(tmp(patchpointValue));
+                    break;
+                case ValueRep::Register: {
+                    Tmp reg = Tmp(patchpointValue->resultConstraint.reg());
+                    inst.args.append(reg);
+                    after.append(Inst(
+                        relaxedMoveForType(patchpointValue->type()), m_value, reg, tmp(patchpointValue)));
+                    break;
+                }
+                case ValueRep::StackArgument: {
+                    Arg arg = Arg::callArg(patchpointValue->resultConstraint.offsetFromSP());
+                    inst.args.append(arg);
+                    after.append(Inst(
+                        moveForType(patchpointValue->type()), m_value, arg, tmp(patchpointValue)));
+                    break;
+                }
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                    break;
+                }
+            }
+            
+            fillStackmap(inst, patchpointValue, 0);
+            
+            if (patchpointValue->resultConstraint.isReg())
+                patchpointValue->lateClobbered().clear(patchpointValue->resultConstraint.reg());
+
+            for (unsigned i = patchpointValue->numGPScratchRegisters; i--;)
+                inst.args.append(m_code.newTmp(Arg::GP));
+            for (unsigned i = patchpointValue->numFPScratchRegisters; i--;)
+                inst.args.append(m_code.newTmp(Arg::FP));
+            
+            m_insts.last().append(WTFMove(inst));
+            m_insts.last().appendVector(after);
+            return;
+        }
+
+        case CheckAdd:
+        case CheckSub:
+        case CheckMul: {
+            CheckValue* checkValue = m_value->as<CheckValue>();
+
+            Value* left = checkValue->child(0);
+            Value* right = checkValue->child(1);
+
+            Tmp result = tmp(m_value);
+
+            // Handle checked negation.
+            if (checkValue->opcode() == CheckSub && left->isInt(0)) {
+                append(Move, tmp(right), result);
+
+                Air::Opcode opcode =
+                    opcodeForType(BranchNeg32, BranchNeg64, checkValue->type());
+                CheckSpecial* special = ensureCheckSpecial(opcode, 2);
+
+                Inst inst(Patch, checkValue, Arg::special(special));
+                inst.args.append(Arg::resCond(MacroAssembler::Overflow));
+                inst.args.append(result);
+
+                fillStackmap(inst, checkValue, 2);
+
+                m_insts.last().append(WTFMove(inst));
+                return;
+            }
+
+            Air::Opcode opcode = Air::Oops;
+            Commutativity commutativity = NotCommutative;
+            StackmapSpecial::RoleMode stackmapRole = StackmapSpecial::SameAsRep;
+            switch (m_value->opcode()) {
+            case CheckAdd:
+                opcode = opcodeForType(BranchAdd32, BranchAdd64, m_value->type());
+                stackmapRole = StackmapSpecial::ForceLateUseUnlessRecoverable;
+                commutativity = Commutative;
+                break;
+            case CheckSub:
+                opcode = opcodeForType(BranchSub32, BranchSub64, m_value->type());
+                break;
+            case CheckMul:
+                opcode = opcodeForType(BranchMul32, BranchMul64, checkValue->type());
+                stackmapRole = StackmapSpecial::ForceLateUse;
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+
+            // FIXME: It would be great to fuse Loads into these. We currently don't do it because the
+            // rule for stackmaps is that all addresses are just stack addresses. Maybe we could relax
+            // this rule here.
+            // https://bugs.webkit.org/show_bug.cgi?id=151228
+
+            Vector<Arg, 2> sources;
+            if (imm(right) && isValidForm(opcode, Arg::ResCond, Arg::Tmp, Arg::Imm, Arg::Tmp)) {
+                sources.append(tmp(left));
+                sources.append(imm(right));
+            } else if (imm(right) && isValidForm(opcode, Arg::ResCond, Arg::Imm, Arg::Tmp)) {
+                sources.append(imm(right));
+                append(Move, tmp(left), result);
+            } else if (isValidForm(opcode, Arg::ResCond, Arg::Tmp, Arg::Tmp, Arg::Tmp)) {
+                sources.append(tmp(left));
+                sources.append(tmp(right));
+            }  else if (isValidForm(opcode, Arg::ResCond, Arg::Tmp, Arg::Tmp)) {
+                if (commutativity == Commutative && preferRightForResult(left, right)) {
+                    sources.append(tmp(left));
+                    append(Move, tmp(right), result);
+                } else {
+                    sources.append(tmp(right));
+                    append(Move, tmp(left), result);
+                }
+            } else if (isValidForm(opcode, Arg::ResCond, Arg::Tmp, Arg::Tmp, Arg::Tmp, Arg::Tmp, Arg::Tmp)) {
+                sources.append(tmp(left));
+                sources.append(tmp(right));
+                sources.append(m_code.newTmp(Arg::typeForB3Type(m_value->type())));
+                sources.append(m_code.newTmp(Arg::typeForB3Type(m_value->type())));
+            }
+
+            // There is a really hilarious case that arises when we do BranchAdd32(%x, %x). We won't emit
+            // such code, but the coalescing in our register allocator also does copy propagation, so
+            // although we emit:
+            //
+            //     Move %tmp1, %tmp2
+            //     BranchAdd32 %tmp1, %tmp2
+            //
+            // The register allocator may turn this into:
+            //
+            //     BranchAdd32 %rax, %rax
+            //
+            // Currently we handle this by ensuring that even this kind of addition can be undone. We can
+            // undo it by using the carry flag. It's tempting to get rid of that code and just "fix" this
+            // here by forcing LateUse on the stackmap. If we did that unconditionally, we'd lose a lot of
+            // performance. So it's tempting to do it only if left == right. But that creates an awkward
+            // constraint on Air: it means that Air would not be allowed to do any copy propagation.
+            // Notice that the %rax,%rax situation happened after Air copy-propagated the Move we are
+            // emitting. We know that copy-propagating over that Move causes add-to-self. But what if we
+            // emit something like a Move - or even do other kinds of copy-propagation on tmp's -
+            // somewhere else in this code. The add-to-self situation may only emerge after some other Air
+            // optimizations remove other Move's or identity-like operations. That's why we don't use
+            // LateUse here to take care of add-to-self.
+            
+            CheckSpecial* special = ensureCheckSpecial(opcode, 2 + sources.size(), stackmapRole);
+            
+            Inst inst(Patch, checkValue, Arg::special(special));
+
+            inst.args.append(Arg::resCond(MacroAssembler::Overflow));
+
+            inst.args.appendVector(sources);
+            inst.args.append(result);
+
+            fillStackmap(inst, checkValue, 2);
+
+            m_insts.last().append(WTFMove(inst));
+            return;
+        }
+
+        case Check: {
+            Inst branch = createBranch(m_value->child(0));
+
+            CheckSpecial* special = ensureCheckSpecial(branch);
+            
+            CheckValue* checkValue = m_value->as<CheckValue>();
+            
+            Inst inst(Patch, checkValue, Arg::special(special));
+            inst.args.appendVector(branch.args);
+            
+            fillStackmap(inst, checkValue, 1);
+            
+            m_insts.last().append(WTFMove(inst));
+            return;
+        }
+
+        case B3::WasmBoundsCheck: {
+            WasmBoundsCheckValue* value = m_value->as<WasmBoundsCheckValue>();
+
+            Value* ptr = value->child(0);
+
+            Arg temp = m_code.newTmp(Arg::GP);
+            append(Inst(Move32, value, tmp(ptr), temp));
+            if (value->offset()) {
+                if (imm(value->offset()))
+                    append(Add64, imm(value->offset()), temp);
+                else {
+                    Arg bigImm = m_code.newTmp(Arg::GP);
+                    append(Move, Arg::bigImm(value->offset()), bigImm);
+                    append(Add64, bigImm, temp);
+                }
+            }
+            append(Inst(Air::WasmBoundsCheck, value, temp, Arg(value->pinnedGPR())));
+            return;
+        }
+
+        case Upsilon: {
+            Value* value = m_value->child(0);
+            append(
+                relaxedMoveForType(value->type()), immOrTmp(value),
+                m_phiToTmp[m_value->as<UpsilonValue>()->phi()]);
+            return;
+        }
+
+        case Phi: {
+            // Snapshot the value of the Phi. It may change under us because you could do:
+            // a = Phi()
+            // Upsilon(@x, ^a)
+            // @a => this should get the value of the Phi before the Upsilon, i.e. not @x.
+
+            append(relaxedMoveForType(m_value->type()), m_phiToTmp[m_value], tmp(m_value));
+            return;
+        }
+
+        case Set: {
+            Value* value = m_value->child(0);
+            append(
+                relaxedMoveForType(value->type()), immOrTmp(value),
+                m_variableToTmp.get(m_value->as<VariableValue>()->variable()));
+            return;
+        }
+
+        case Get: {
+            append(
+                relaxedMoveForType(m_value->type()),
+                m_variableToTmp.get(m_value->as<VariableValue>()->variable()), tmp(m_value));
+            return;
+        }
+
+        case Branch: {
+            m_insts.last().append(createBranch(m_value->child(0)));
+            return;
+        }
+
+        case B3::Jump: {
+            append(Air::Jump);
+            return;
+        }
+            
+        case Identity: {
+            ASSERT(tmp(m_value->child(0)) == tmp(m_value));
+            return;
+        }
+
+        case Return: {
+            if (!m_value->numChildren()) {
+                append(RetVoid);
+                return;
+            }
+            Value* value = m_value->child(0);
+            Tmp returnValueGPR = Tmp(GPRInfo::returnValueGPR);
+            Tmp returnValueFPR = Tmp(FPRInfo::returnValueFPR);
+            switch (value->type()) {
+            case Void:
+                // It's impossible for a void value to be used as a child. If we did want to have a
+                // void return, we'd introduce a different opcode, like ReturnVoid.
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            case Int32:
+                append(Move, immOrTmp(value), returnValueGPR);
+                append(Ret32, returnValueGPR);
+                break;
+            case Int64:
+                append(Move, immOrTmp(value), returnValueGPR);
+                append(Ret64, returnValueGPR);
+                break;
+            case Float:
+                append(MoveFloat, tmp(value), returnValueFPR);
+                append(RetFloat, returnValueFPR);
+                break;
+            case Double:
+                append(MoveDouble, tmp(value), returnValueFPR);
+                append(RetDouble, returnValueFPR);
+                break;
+            }
+            return;
+        }
+
+        case B3::Oops: {
+            append(Air::Oops);
+            return;
+        }
+            
+        case B3::EntrySwitch: {
+            append(Air::EntrySwitch);
+            return;
+        }
+
+        default:
+            break;
+        }
+
+        dataLog("FATAL: could not lower ", deepDump(m_procedure, m_value), "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    void lowerX86Div(B3::Opcode op)
+    {
+#if CPU(X86) || CPU(X86_64)
+        Tmp eax = Tmp(X86Registers::eax);
+        Tmp edx = Tmp(X86Registers::edx);
+
+        Air::Opcode convertToDoubleWord;
+        Air::Opcode div;
+        switch (m_value->type()) {
+        case Int32:
+            convertToDoubleWord = X86ConvertToDoubleWord32;
+            div = X86Div32;
+            break;
+        case Int64:
+            convertToDoubleWord = X86ConvertToQuadWord64;
+            div = X86Div64;
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+
+        ASSERT(op == Div || op == Mod);
+        X86Registers::RegisterID result = op == Div ? X86Registers::eax : X86Registers::edx;
+
+        append(Move, tmp(m_value->child(0)), eax);
+        append(convertToDoubleWord, eax, edx);
+        append(div, eax, edx, tmp(m_value->child(1)));
+        append(Move, Tmp(result), tmp(m_value));
+
+#else
+        UNUSED_PARAM(op);
+        UNREACHABLE_FOR_PLATFORM();
+#endif
+    }
+
+    void lowerX86UDiv(B3::Opcode op)
+    {
+#if CPU(X86) || CPU(X86_64)
+        Tmp eax = Tmp(X86Registers::eax);
+        Tmp edx = Tmp(X86Registers::edx);
+
+        Air::Opcode div = m_value->type() == Int32 ? X86UDiv32 : X86UDiv64;
+
+        ASSERT(op == UDiv || op == UMod);
+        X86Registers::RegisterID result = op == UDiv ? X86Registers::eax : X86Registers::edx;
+
+        append(Move, tmp(m_value->child(0)), eax);
+        append(Xor64, edx, edx);
+        append(div, eax, edx, tmp(m_value->child(1)));
+        append(Move, Tmp(result), tmp(m_value));
+#else
+        UNUSED_PARAM(op);
+        UNREACHABLE_FOR_PLATFORM();
+#endif
+    }
+
+    IndexSet<Value> m_locked; // These are values that will have no Tmp in Air.
+    IndexMap<Value, Tmp> m_valueToTmp; // These are values that must have a Tmp in Air. We say that a Value* with a non-null Tmp is "pinned".
+    IndexMap<Value, Tmp> m_phiToTmp; // Each Phi gets its own Tmp.
+    IndexMap<B3::BasicBlock, Air::BasicBlock*> m_blockToBlock;
+    HashMap<B3::StackSlot*, Air::StackSlot*> m_stackToStack;
+    HashMap<Variable*, Tmp> m_variableToTmp;
+
+    UseCounts m_useCounts;
+    PhiChildren m_phiChildren;
+    BlockWorklist m_fastWorklist;
+    Dominators& m_dominators;
+
+    Vector<Vector<Inst, 4>> m_insts;
+    Vector<Inst> m_prologue;
+
+    B3::BasicBlock* m_block;
+    bool m_isRare;
+    unsigned m_index;
+    Value* m_value;
+
+    PatchpointSpecial* m_patchpointSpecial { nullptr };
+    HashMap<CheckSpecial::Key, CheckSpecial*> m_checkSpecials;
+
+    Procedure& m_procedure;
+    Code& m_code;
+};
+
+} // anonymous namespace
+
+void lowerToAir(Procedure& procedure)
+{
+    PhaseScope phaseScope(procedure, "lowerToAir");
+    LowerToAir lowerToAir(procedure);
+    lowerToAir.run();
+}
+
+} } // namespace JSC::B3
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic pop
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3LowerToAir.h b/b3/B3LowerToAir.h
new file mode 100644
index 0000000..a668376
--- /dev/null
+++ b/b3/B3LowerToAir.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+namespace Air { class Code; }
+
+// This lowers the current B3 procedure to an Air code.
+
+JS_EXPORT_PRIVATE void lowerToAir(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3MathExtras.cpp b/b3/B3MathExtras.cpp
new file mode 100644
index 0000000..1c99379
--- /dev/null
+++ b/b3/B3MathExtras.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "B3MathExtras.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3CCallValue.h"
+#include "B3Const32Value.h"
+#include "B3ConstDoubleValue.h"
+#include "B3ConstPtrValue.h"
+#include "B3UpsilonValue.h"
+#include "B3ValueInlines.h"
+#include "MathCommon.h"
+
+namespace JSC { namespace B3 {
+
+std::pair<BasicBlock*, Value*> powDoubleInt32(Procedure& procedure, BasicBlock* start, Origin origin, Value* x, Value* y)
+{
+    BasicBlock* functionCallCase = procedure.addBlock();
+    BasicBlock* loopPreHeaderCase = procedure.addBlock();
+    BasicBlock* loopTestForEvenCase = procedure.addBlock();
+    BasicBlock* loopOdd = procedure.addBlock();
+    BasicBlock* loopEvenOdd = procedure.addBlock();
+    BasicBlock* continuation = procedure.addBlock();
+
+    Value* shouldGoSlowPath = start->appendNew<Value>(procedure, Above, origin,
+        y,
+        start->appendNew<Const32Value>(procedure, origin, maxExponentForIntegerMathPow));
+    start->appendNew<Value>(procedure, Branch, origin, shouldGoSlowPath);
+    start->setSuccessors(FrequentedBlock(functionCallCase), FrequentedBlock(loopPreHeaderCase));
+
+    // Function call.
+    Value* yAsDouble = functionCallCase->appendNew<Value>(procedure, IToD, origin, y);
+    double (*powDouble)(double, double) = pow;
+    Value* powResult = functionCallCase->appendNew<CCallValue>(
+        procedure, Double, origin,
+        functionCallCase->appendNew<ConstPtrValue>(procedure, origin, bitwise_cast<void*>(powDouble)),
+        x, yAsDouble);
+    UpsilonValue* powResultUpsilon = functionCallCase->appendNew<UpsilonValue>(procedure, origin, powResult);
+    functionCallCase->appendNew<Value>(procedure, Jump, origin);
+    functionCallCase->setSuccessors(FrequentedBlock(continuation));
+
+    // Loop pre-header.
+    Value* initialResult = loopPreHeaderCase->appendNew<ConstDoubleValue>(procedure, origin, 1.);
+    UpsilonValue* initialLoopValue = loopPreHeaderCase->appendNew<UpsilonValue>(procedure, origin, initialResult);
+    UpsilonValue* initialResultValue = loopPreHeaderCase->appendNew<UpsilonValue>(procedure, origin, initialResult);
+    UpsilonValue* initialSquaredInput = loopPreHeaderCase->appendNew<UpsilonValue>(procedure, origin, x);
+    UpsilonValue* initialLoopCounter = loopPreHeaderCase->appendNew<UpsilonValue>(procedure, origin, y);
+    loopPreHeaderCase->appendNew<Value>(procedure, Jump, origin);
+    loopPreHeaderCase->setSuccessors(FrequentedBlock(loopTestForEvenCase));
+
+    // Test if what is left of the counter is even.
+    Value* inLoopCounter = loopTestForEvenCase->appendNew<Value>(procedure, Phi, Int32, origin);
+    Value* inLoopSquaredInput = loopTestForEvenCase->appendNew<Value>(procedure, Phi, Double, origin);
+    Value* lastCounterBit = loopTestForEvenCase->appendNew<Value>(procedure, BitAnd, origin,
+        inLoopCounter,
+        loopTestForEvenCase->appendNew<Const32Value>(procedure, origin, 1));
+    loopTestForEvenCase->appendNew<Value>(procedure, Branch, origin, lastCounterBit);
+    loopTestForEvenCase->setSuccessors(FrequentedBlock(loopOdd), FrequentedBlock(loopEvenOdd));
+
+    // Counter is odd.
+    Value* inLoopResult = loopOdd->appendNew<Value>(procedure, Phi, Double, origin);
+    Value* updatedResult = loopOdd->appendNew<Value>(procedure, Mul, origin, inLoopResult, inLoopSquaredInput);
+    UpsilonValue* updatedLoopResultUpsilon = loopOdd->appendNew<UpsilonValue>(procedure, origin, updatedResult);
+    initialLoopValue->setPhi(inLoopResult);
+    updatedLoopResultUpsilon->setPhi(inLoopResult);
+    UpsilonValue* updatedLoopResult = loopOdd->appendNew<UpsilonValue>(procedure, origin, updatedResult);
+
+    loopOdd->appendNew<Value>(procedure, Jump, origin);
+    loopOdd->setSuccessors(FrequentedBlock(loopEvenOdd));
+
+    // Even value and following the Odd.
+    Value* squaredInput = loopEvenOdd->appendNew<Value>(procedure, Mul, origin, inLoopSquaredInput, inLoopSquaredInput);
+    UpsilonValue* squaredInputUpsilon = loopEvenOdd->appendNew<UpsilonValue>(procedure, origin, squaredInput);
+    initialSquaredInput->setPhi(inLoopSquaredInput);
+    squaredInputUpsilon->setPhi(inLoopSquaredInput);
+
+    Value* updatedCounter = loopEvenOdd->appendNew<Value>(procedure, ZShr, origin,
+        inLoopCounter,
+        loopEvenOdd->appendNew<Const32Value>(procedure, origin, 1));
+    UpsilonValue* updatedCounterUpsilon = loopEvenOdd->appendNew<UpsilonValue>(procedure, origin, updatedCounter);
+    initialLoopCounter->setPhi(inLoopCounter);
+    updatedCounterUpsilon->setPhi(inLoopCounter);
+
+    loopEvenOdd->appendNew<Value>(procedure, Branch, origin, updatedCounter);
+    loopEvenOdd->setSuccessors(FrequentedBlock(loopTestForEvenCase), FrequentedBlock(continuation));
+
+    // Inline loop.
+    Value* finalResultPhi = continuation->appendNew<Value>(procedure, Phi, Double, origin);
+    powResultUpsilon->setPhi(finalResultPhi);
+    initialResultValue->setPhi(finalResultPhi);
+    updatedLoopResult->setPhi(finalResultPhi);
+    return std::make_pair(continuation, finalResultPhi);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3MathExtras.h b/b3/B3MathExtras.h
new file mode 100644
index 0000000..b6bddea
--- /dev/null
+++ b/b3/B3MathExtras.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Origin.h"
+
+namespace JSC { namespace B3 {
+
+class BasicBlock;
+class Procedure;
+class Value;
+
+// Raise "x" to "y" power.
+// Return a new block continuing the flow and the value representing the result.
+JS_EXPORT_PRIVATE std::pair<BasicBlock*, Value*> powDoubleInt32(Procedure&, BasicBlock*, Origin, Value* x, Value* y);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3MemoryValue.cpp b/b3/B3MemoryValue.cpp
new file mode 100644
index 0000000..3764b74
--- /dev/null
+++ b/b3/B3MemoryValue.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3MemoryValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+MemoryValue::~MemoryValue()
+{
+}
+
+size_t MemoryValue::accessByteSize() const
+{
+    switch (opcode()) {
+    case Load8Z:
+    case Load8S:
+    case Store8:
+        return 1;
+    case Load16Z:
+    case Load16S:
+    case Store16:
+        return 2;
+    case Load:
+        return sizeofType(type());
+    case Store:
+        return sizeofType(child(0)->type());
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+void MemoryValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    if (m_offset)
+        out.print(comma, "offset = ", m_offset);
+    if ((isLoad() && effects().reads != range())
+        || (isStore() && effects().writes != range()))
+        out.print(comma, "range = ", range());
+}
+
+Value* MemoryValue::cloneImpl() const
+{
+    return new MemoryValue(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3MemoryValue.h b/b3/B3MemoryValue.h
new file mode 100644
index 0000000..9a0504f
--- /dev/null
+++ b/b3/B3MemoryValue.h
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3HeapRange.h"
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+// FIXME: We want to allow fenced memory accesses on ARM.
+// https://bugs.webkit.org/show_bug.cgi?id=162349
+
+class JS_EXPORT_PRIVATE MemoryValue : public Value {
+public:
+    static bool accepts(Kind kind)
+    {
+        switch (kind.opcode()) {
+        case Load8Z:
+        case Load8S:
+        case Load16Z:
+        case Load16S:
+        case Load:
+        case Store8:
+        case Store16:
+        case Store:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    static bool isStore(Kind kind)
+    {
+        switch (kind.opcode()) {
+        case Store8:
+        case Store16:
+        case Store:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    static bool isLoad(Kind kind)
+    {
+        return accepts(kind) && !isStore(kind);
+    }
+
+    ~MemoryValue();
+
+    int32_t offset() const { return m_offset; }
+    void setOffset(int32_t offset) { m_offset = offset; }
+
+    const HeapRange& range() const { return m_range; }
+    void setRange(const HeapRange& range) { m_range = range; }
+
+    bool isStore() const { return type() == Void; }
+    bool isLoad() const { return type() != Void; }
+
+    size_t accessByteSize() const;
+
+protected:
+    void dumpMeta(CommaPrinter& comma, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    // Use this form for Load (but not Load8Z, Load8S, or any of the Loads that have a suffix that
+    // describes the returned type).
+    MemoryValue(Kind kind, Type type, Origin origin, Value* pointer, int32_t offset = 0)
+        : Value(CheckedOpcode, kind, type, origin, pointer)
+        , m_offset(offset)
+        , m_range(HeapRange::top())
+    {
+        if (!ASSERT_DISABLED) {
+            switch (kind.opcode()) {
+            case Load:
+                break;
+            case Load8Z:
+            case Load8S:
+            case Load16Z:
+            case Load16S:
+                ASSERT(type == Int32);
+                break;
+            case Store8:
+            case Store16:
+            case Store:
+                ASSERT(type == Void);
+                break;
+            default:
+                ASSERT_NOT_REACHED();
+            }
+        }
+    }
+
+    // Use this form for loads where the return type is implied.
+    MemoryValue(Kind kind, Origin origin, Value* pointer, int32_t offset = 0)
+        : MemoryValue(kind, Int32, origin, pointer, offset)
+    {
+    }
+
+    // Use this form for stores.
+    MemoryValue(Kind kind, Origin origin, Value* value, Value* pointer, int32_t offset = 0)
+        : Value(CheckedOpcode, kind, Void, origin, value, pointer)
+        , m_offset(offset)
+        , m_range(HeapRange::top())
+    {
+        if (!ASSERT_DISABLED) {
+            switch (kind.opcode()) {
+            case Store8:
+            case Store16:
+            case Store:
+                break;
+            default:
+                ASSERT_NOT_REACHED();
+                break;
+            }
+        }
+    }
+
+    int32_t m_offset { 0 };
+    HeapRange m_range;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3MoveConstants.cpp b/b3/B3MoveConstants.cpp
new file mode 100644
index 0000000..0d98773
--- /dev/null
+++ b/b3/B3MoveConstants.cpp
@@ -0,0 +1,363 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3MoveConstants.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3Dominators.h"
+#include "B3InsertionSetInlines.h"
+#include "B3MemoryValue.h"
+#include "B3PhaseScope.h"
+#include "B3ProcedureInlines.h"
+#include "B3ValueInlines.h"
+#include "B3ValueKeyInlines.h"
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+class MoveConstants {
+public:
+    MoveConstants(Procedure& proc)
+        : m_proc(proc)
+        , m_insertionSet(proc)
+    {
+    }
+
+    void run()
+    {
+        hoistConstants(
+            [&] (const ValueKey& key) -> bool {
+                return key.opcode() == ConstFloat || key.opcode() == ConstDouble;
+            });
+        
+        lowerFPConstants();
+        
+        hoistConstants(
+            [&] (const ValueKey& key) -> bool {
+                return key.opcode() == Const32 || key.opcode() == Const64 || key.opcode() == ArgumentReg;
+            });
+    }
+
+private:
+    template<typename Filter>
+    void hoistConstants(const Filter& filter)
+    {
+        Dominators& dominators = m_proc.dominators();
+        HashMap<ValueKey, Value*> valueForConstant;
+        IndexMap<BasicBlock, Vector<Value*>> materializations(m_proc.size());
+
+        // We determine where things get materialized based on where they are used.
+        for (BasicBlock* block : m_proc) {
+            for (Value* value : *block) {
+                for (Value*& child : value->children()) {
+                    ValueKey key = child->key();
+                    if (!filter(key))
+                        continue;
+
+                    auto result = valueForConstant.add(key, child);
+                    if (result.isNewEntry) {
+                        // Assume that this block is where we want to materialize the value.
+                        child->owner = block;
+                        continue;
+                    }
+
+                    // Make 'value' use the canonical constant rather than the one it was using.
+                    child = result.iterator->value;
+
+                    // Determine the least common dominator. That's the lowest place in the CFG where
+                    // we could materialize the constant while still having only one materialization
+                    // in the resulting code.
+                    while (!dominators.dominates(child->owner, block))
+                        child->owner = dominators.idom(child->owner);
+                }
+            }
+        }
+
+        // Make sure that each basic block knows what to materialize. This also refines the
+        // materialization block based on execution frequency. It finds the minimum block frequency
+        // of all of its dominators, and selects the closest block amongst those that are tied for
+        // lowest frequency.
+        for (auto& entry : valueForConstant) {
+            Value* value = entry.value;
+            for (BasicBlock* block = value->owner; block; block = dominators.idom(block)) {
+                if (block->frequency() < value->owner->frequency())
+                    value->owner = block;
+            }
+            materializations[value->owner].append(value);
+        }
+
+        // Get rid of Value's that are fast constants but aren't canonical. Also remove the canonical
+        // ones from the CFG, since we're going to reinsert them elsewhere.
+        for (BasicBlock* block : m_proc) {
+            for (Value*& value : *block) {
+                ValueKey key = value->key();
+                if (!filter(key))
+                    continue;
+
+                if (valueForConstant.get(key) == value)
+                    value = m_proc.add<Value>(Nop, value->origin());
+                else
+                    value->replaceWithNopIgnoringType();
+            }
+        }
+
+        // Now make sure that we move constants to where they are supposed to go. Again, we do this
+        // based on uses.
+        for (BasicBlock* block : m_proc) {
+            for (unsigned valueIndex = 0; valueIndex < block->size(); ++valueIndex) {
+                Value* value = block->at(valueIndex);
+                
+                // This finds the outermost (best) block last. So, the functor overrides the result
+                // each time it finds something acceptable.
+                auto findBestConstant = [&] (const auto& predicate) -> Value* {
+                    Value* result = nullptr;
+                    dominators.forAllDominatorsOf(
+                        block,
+                        [&] (BasicBlock* dominator) {
+                            for (Value* value : materializations[dominator]) {
+                                if (predicate(value)) {
+                                    result = value;
+                                    break;
+                                }
+                            }
+                        });
+                    return result;
+                };
+                
+                // We call this when we have found a constant that we'd like to use. It's possible that
+                // we have computed that the constant should be meterialized in this block, but we
+                // haven't inserted it yet. This inserts the constant if necessary.
+                auto materialize = [&] (Value* child) {
+                    ValueKey key = child->key();
+                    if (!filter(key))
+                        return;
+
+                    // If we encounter a fast constant, then it must be canonical, since we already
+                    // got rid of the non-canonical ones.
+                    ASSERT(valueForConstant.get(key) == child);
+
+                    if (child->owner != block) {
+                        // This constant isn't our problem. It's going to be materialized in another
+                        // block.
+                        return;
+                    }
+                    
+                    // We're supposed to materialize this constant in this block, and we haven't
+                    // done it yet.
+                    m_insertionSet.insertValue(valueIndex, child);
+                    child->owner = nullptr;
+                };
+                
+                if (MemoryValue* memoryValue = value->as<MemoryValue>()) {
+                    Value* pointer = memoryValue->lastChild();
+                    if (pointer->hasIntPtr() && filter(pointer->key())) {
+                        auto desiredOffset = [&] (Value* otherPointer) -> intptr_t {
+                            // We would turn this:
+                            //
+                            //     Load(@p, offset = c)
+                            //
+                            // into this:
+                            //
+                            //     Load(@q, offset = ?)
+                            //
+                            // The offset should be c + @p - @q, because then we're loading from:
+                            //
+                            //     @q + c + @p - @q
+                            uintptr_t c = static_cast<uintptr_t>(static_cast<intptr_t>(memoryValue->offset()));
+                            uintptr_t p = pointer->asIntPtr();
+                            uintptr_t q = otherPointer->asIntPtr();
+                            return c + p - q;
+                        };
+                        
+                        Value* bestPointer = findBestConstant(
+                            [&] (Value* candidatePointer) -> bool {
+                                if (!candidatePointer->hasIntPtr())
+                                    return false;
+                                
+                                intptr_t offset = desiredOffset(candidatePointer);
+                                if (!B3::isRepresentableAs<int32_t>(static_cast<int64_t>(offset)))
+                                    return false;
+                                return Air::Arg::isValidAddrForm(
+                                    static_cast<int32_t>(offset),
+                                    Air::Arg::widthForBytes(memoryValue->accessByteSize()));
+                            });
+                        
+                        if (bestPointer) {
+                            memoryValue->lastChild() = bestPointer;
+                            memoryValue->setOffset(desiredOffset(bestPointer));
+                        }
+                    }
+                } else {
+                    switch (value->opcode()) {
+                    case Add:
+                    case Sub: {
+                        Value* addend = value->child(1);
+                        if (!addend->hasInt() || !filter(addend->key()))
+                            break;
+                        int64_t addendConst = addend->asInt();
+                        Value* bestAddend = findBestConstant(
+                            [&] (Value* candidateAddend) -> bool {
+                                if (candidateAddend->type() != addend->type())
+                                    return false;
+                                if (!candidateAddend->hasInt())
+                                    return false;
+                                return candidateAddend == addend
+                                    || candidateAddend->asInt() == -addendConst;
+                            });
+                        if (!bestAddend || bestAddend == addend)
+                            break;
+                        materialize(value->child(0));
+                        materialize(bestAddend);
+                        value->replaceWithIdentity(
+                            m_insertionSet.insert<Value>(
+                                valueIndex, value->opcode() == Add ? Sub : Add, value->origin(),
+                                value->child(0), bestAddend));
+                        break;
+                    }
+                    default:
+                        break;
+                    }
+                }
+                
+                for (Value* child : value->children())
+                    materialize(child);
+            }
+
+            // We may have some constants that need to be materialized right at the end of this
+            // block.
+            for (Value* value : materializations[block]) {
+                if (!value->owner) {
+                    // It's already materialized in this block.
+                    continue;
+                }
+
+                m_insertionSet.insertValue(block->size() - 1, value);
+            }
+            m_insertionSet.execute(block);
+        }
+    }
+
+    void lowerFPConstants()
+    {
+        for (Value* value : m_proc.values()) {
+            ValueKey key = value->key();
+            if (goesInTable(key))
+                m_constTable.add(key, m_constTable.size());
+        }
+        
+        m_dataSection = static_cast<int64_t*>(m_proc.addDataSection(m_constTable.size() * sizeof(int64_t)));
+        for (auto& entry : m_constTable)
+            m_dataSection[entry.value] = entry.key.value();
+
+        IndexSet<Value> offLimits;
+        for (BasicBlock* block : m_proc) {
+            for (unsigned valueIndex = 0; valueIndex < block->size(); ++valueIndex) {
+                StackmapValue* value = block->at(valueIndex)->as<StackmapValue>();
+                if (!value)
+                    continue;
+
+                for (unsigned childIndex = 0; childIndex < value->numChildren(); ++childIndex) {
+                    if (!value->constrainedChild(childIndex).rep().isAny())
+                        continue;
+                    
+                    Value*& child = value->child(childIndex);
+                    ValueKey key = child->key();
+                    if (!goesInTable(key))
+                        continue;
+
+                    child = m_insertionSet.insertValue(
+                        valueIndex, key.materialize(m_proc, value->origin()));
+                    offLimits.add(child);
+                }
+            }
+
+            m_insertionSet.execute(block);
+        }
+
+        for (BasicBlock* block : m_proc) {
+            for (unsigned valueIndex = 0; valueIndex < block->size(); ++valueIndex) {
+                Value* value = block->at(valueIndex);
+                ValueKey key = value->key();
+                if (!goesInTable(key))
+                    continue;
+                if (offLimits.contains(value))
+                    continue;
+
+                Value* tableBase = m_insertionSet.insertIntConstant(
+                    valueIndex, value->origin(), pointerType(),
+                    bitwise_cast<intptr_t>(m_dataSection));
+                Value* result = m_insertionSet.insert<MemoryValue>(
+                    valueIndex, Load, value->type(), value->origin(), tableBase,
+                    sizeof(int64_t) * m_constTable.get(key));
+                value->replaceWithIdentity(result);
+            }
+
+            m_insertionSet.execute(block);
+        }
+    }
+
+    bool goesInTable(const ValueKey& key)
+    {
+        return (key.opcode() == ConstDouble && key != doubleZero())
+            || (key.opcode() == ConstFloat && key != floatZero());
+    }
+
+    static ValueKey doubleZero()
+    {
+        return ValueKey(ConstDouble, Double, 0.0);
+    }
+
+    static ValueKey floatZero()
+    {
+        return ValueKey(ConstFloat, Double, 0.0);
+    }
+
+    Procedure& m_proc;
+    Vector<Value*> m_toRemove;
+    HashMap<ValueKey, unsigned> m_constTable;
+    int64_t* m_dataSection;
+    HashMap<ValueKey, Value*> m_constants;
+    InsertionSet m_insertionSet;
+};
+
+} // anonymous namespace
+
+void moveConstants(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "moveConstants");
+    MoveConstants moveConstants(proc);
+    moveConstants.run();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3MoveConstants.h b/b3/B3MoveConstants.h
new file mode 100644
index 0000000..b9f92ff
--- /dev/null
+++ b/b3/B3MoveConstants.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Moves large constants around, with the goal of placing them in the optimal points in the program.
+
+JS_EXPORT_PRIVATE void moveConstants(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3OpaqueByproduct.h b/b3/B3OpaqueByproduct.h
new file mode 100644
index 0000000..35a2a06
--- /dev/null
+++ b/b3/B3OpaqueByproduct.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+class OpaqueByproduct {
+    WTF_MAKE_NONCOPYABLE(OpaqueByproduct);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    OpaqueByproduct() { }
+    virtual ~OpaqueByproduct() { }
+
+    virtual void dump(PrintStream&) const = 0;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3OpaqueByproducts.cpp b/b3/B3OpaqueByproducts.cpp
new file mode 100644
index 0000000..f89f8bf
--- /dev/null
+++ b/b3/B3OpaqueByproducts.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3OpaqueByproducts.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+OpaqueByproducts::OpaqueByproducts()
+{
+}
+
+OpaqueByproducts::~OpaqueByproducts()
+{
+}
+
+void OpaqueByproducts::add(std::unique_ptr<OpaqueByproduct> byproduct)
+{
+    m_byproducts.append(WTFMove(byproduct));
+}
+
+void OpaqueByproducts::dump(PrintStream& out) const
+{
+    out.print("Byproducts:\n");
+    if (m_byproducts.isEmpty()) {
+        out.print("    <empty>\n");
+        return;
+    }
+    for (auto& byproduct : m_byproducts)
+        out.print("    ", *byproduct, "\n");
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3OpaqueByproducts.h b/b3/B3OpaqueByproducts.h
new file mode 100644
index 0000000..e8eec11
--- /dev/null
+++ b/b3/B3OpaqueByproducts.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3OpaqueByproduct.h"
+#include <memory>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class OpaqueByproducts {
+    WTF_MAKE_NONCOPYABLE(OpaqueByproducts)
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    OpaqueByproducts();
+    JS_EXPORT_PRIVATE ~OpaqueByproducts();
+
+    size_t count() const { return m_byproducts.size(); }
+    
+    void add(std::unique_ptr<OpaqueByproduct>);
+
+    void dump(PrintStream&) const;
+
+private:
+    Vector<std::unique_ptr<OpaqueByproduct>> m_byproducts;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Opcode.cpp b/b3/B3Opcode.cpp
new file mode 100644
index 0000000..a0aa5a9
--- /dev/null
+++ b/b3/B3Opcode.cpp
@@ -0,0 +1,323 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Opcode.h"
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+std::optional<Opcode> invertedCompare(Opcode opcode, Type type)
+{
+    switch (opcode) {
+    case Equal:
+        return NotEqual;
+    case NotEqual:
+        return Equal;
+    case LessThan:
+        if (isInt(type))
+            return GreaterEqual;
+        return std::nullopt;
+    case GreaterThan:
+        if (isInt(type))
+            return LessEqual;
+        return std::nullopt;
+    case LessEqual:
+        if (isInt(type))
+            return GreaterThan;
+        return std::nullopt;
+    case GreaterEqual:
+        if (isInt(type))
+            return LessThan;
+        return std::nullopt;
+    case Above:
+        return BelowEqual;
+    case Below:
+        return AboveEqual;
+    case AboveEqual:
+        return Below;
+    case BelowEqual:
+        return Above;
+    default:
+        return std::nullopt;
+    }
+}
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+using namespace JSC::B3;
+
+void printInternal(PrintStream& out, Opcode opcode)
+{
+    switch (opcode) {
+    case Nop:
+        out.print("Nop");
+        return;
+    case Identity:
+        out.print("Identity");
+        return;
+    case Const32:
+        out.print("Const32");
+        return;
+    case Const64:
+        out.print("Const64");
+        return;
+    case ConstDouble:
+        out.print("ConstDouble");
+        return;
+    case ConstFloat:
+        out.print("ConstFloat");
+        return;
+    case Get:
+        out.print("Get");
+        return;
+    case Set:
+        out.print("Set");
+        return;
+    case SlotBase:
+        out.print("SlotBase");
+        return;
+    case ArgumentReg:
+        out.print("ArgumentReg");
+        return;
+    case FramePointer:
+        out.print("FramePointer");
+        return;
+    case Add:
+        out.print("Add");
+        return;
+    case Sub:
+        out.print("Sub");
+        return;
+    case Mul:
+        out.print("Mul");
+        return;
+    case Div:
+        out.print("Div");
+        return;
+    case UDiv:
+        out.print("UDiv");
+        return;
+    case Mod:
+        out.print("Mod");
+        return;
+    case UMod:
+        out.print("UMod");
+        return;
+    case Neg:
+        out.print("Neg");
+        return;
+    case BitAnd:
+        out.print("BitAnd");
+        return;
+    case BitOr:
+        out.print("BitOr");
+        return;
+    case BitXor:
+        out.print("BitXor");
+        return;
+    case Shl:
+        out.print("Shl");
+        return;
+    case SShr:
+        out.print("SShr");
+        return;
+    case ZShr:
+        out.print("ZShr");
+        return;
+    case RotR:
+        out.print("RotR");
+        return;
+    case RotL:
+        out.print("RotL");
+        return;
+    case Clz:
+        out.print("Clz");
+        return;
+    case Abs:
+        out.print("Abs");
+        return;
+    case Ceil:
+        out.print("Ceil");
+        return;
+    case Floor:
+        out.print("Floor");
+        return;
+    case Sqrt:
+        out.print("Sqrt");
+        return;
+    case BitwiseCast:
+        out.print("BitwiseCast");
+        return;
+    case SExt8:
+        out.print("SExt8");
+        return;
+    case SExt16:
+        out.print("SExt16");
+        return;
+    case SExt32:
+        out.print("SExt32");
+        return;
+    case ZExt32:
+        out.print("ZExt32");
+        return;
+    case Trunc:
+        out.print("Trunc");
+        return;
+    case IToD:
+        out.print("IToD");
+        return;
+    case IToF:
+        out.print("IToF");
+        return;
+    case FloatToDouble:
+        out.print("FloatToDouble");
+        return;
+    case DoubleToFloat:
+        out.print("DoubleToFloat");
+        return;
+    case Equal:
+        out.print("Equal");
+        return;
+    case NotEqual:
+        out.print("NotEqual");
+        return;
+    case LessThan:
+        out.print("LessThan");
+        return;
+    case GreaterThan:
+        out.print("GreaterThan");
+        return;
+    case LessEqual:
+        out.print("LessEqual");
+        return;
+    case GreaterEqual:
+        out.print("GreaterEqual");
+        return;
+    case Above:
+        out.print("Above");
+        return;
+    case Below:
+        out.print("Below");
+        return;
+    case AboveEqual:
+        out.print("AboveEqual");
+        return;
+    case BelowEqual:
+        out.print("BelowEqual");
+        return;
+    case EqualOrUnordered:
+        out.print("EqualOrUnordered");
+        return;
+    case Select:
+        out.print("Select");
+        return;
+    case Load8Z:
+        out.print("Load8Z");
+        return;
+    case Load8S:
+        out.print("Load8S");
+        return;
+    case Load16Z:
+        out.print("Load16Z");
+        return;
+    case Load16S:
+        out.print("Load16S");
+        return;
+    case Load:
+        out.print("Load");
+        return;
+    case Store8:
+        out.print("Store8");
+        return;
+    case Store16:
+        out.print("Store16");
+        return;
+    case Store:
+        out.print("Store");
+        return;
+    case WasmAddress:
+        out.print("WasmAddress");
+        return;
+    case Fence:
+        out.print("Fence");
+        return;
+    case CCall:
+        out.print("CCall");
+        return;
+    case Patchpoint:
+        out.print("Patchpoint");
+        return;
+    case CheckAdd:
+        out.print("CheckAdd");
+        return;
+    case CheckSub:
+        out.print("CheckSub");
+        return;
+    case CheckMul:
+        out.print("CheckMul");
+        return;
+    case Check:
+        out.print("Check");
+        return;
+    case WasmBoundsCheck:
+        out.print("WasmBoundsCheck");
+        return;
+    case Upsilon:
+        out.print("Upsilon");
+        return;
+    case Phi:
+        out.print("Phi");
+        return;
+    case Jump:
+        out.print("Jump");
+        return;
+    case Branch:
+        out.print("Branch");
+        return;
+    case Switch:
+        out.print("Switch");
+        return;
+    case EntrySwitch:
+        out.print("EntrySwitch");
+        return;
+    case Return:
+        out.print("Return");
+        return;
+    case Oops:
+        out.print("Oops");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Opcode.h b/b3/B3Opcode.h
new file mode 100644
index 0000000..956dba9
--- /dev/null
+++ b/b3/B3Opcode.h
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Type.h"
+#include <wtf/Optional.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC { namespace B3 {
+
+// Warning: In B3, an Opcode is just one part of a Kind. Kind is used the way that an opcode
+// would be used in simple IRs. See B3Kind.h.
+
+enum Opcode : int16_t {
+    // A no-op that returns Void, useful for when you want to remove a value.
+    Nop,
+    
+    // Polymorphic identity, usable with any value type.
+    Identity,
+
+    // Constants. Use the ConstValue* classes. Constants exist in the control flow, so that we can
+    // reason about where we would construct them. Large constants are expensive to create.
+    Const32,
+    Const64,
+    ConstDouble,
+    ConstFloat,
+
+    // B3 supports non-SSA variables. These are accessed using Get and Set opcodes. Use the
+    // VariableValue class. It's a good idea to run fixSSA() to turn these into SSA. The
+    // optimizer will do that eventually, but if your input tends to use these opcodes, you
+    // should run fixSSA() directly before launching the optimizer.
+    Set,
+    Get,
+
+    // Gets the base address of a StackSlot.
+    SlotBase,
+
+    // The magical argument register. This is viewed as executing at the top of the program
+    // regardless of where in control flow you put it, and the compiler takes care to ensure that we
+    // don't clobber the value by register allocation or calls (either by saving the argument to the
+    // stack or preserving it in a callee-save register). Use the ArgumentRegValue class. The return
+    // type is either pointer() (for GPRs) or Double (for FPRs).
+    ArgumentReg,
+
+    // The frame pointer. You can put this anywhere in control flow but it will always yield the
+    // frame pointer, with a caveat: if our compiler changes the frame pointer temporarily for some
+    // silly reason, the FramePointer intrinsic will return where the frame pointer *should* be not
+    // where it happens to be right now.
+    FramePointer,
+
+    // Polymorphic math, usable with any value type.
+    Add,
+    Sub,
+    Mul,
+    Div, // All bets are off as to what will happen when you execute this for -2^31/-1 and x/0.
+    UDiv,
+    Mod, // All bets are off as to what will happen when you execute this for -2^31%-1 and x%0.
+    UMod,
+
+
+    // Polymorphic negation. Note that we only need this for floating point, since integer negation
+    // is exactly like Sub(0, x). But that's not true for floating point. Sub(0, 0) is 0, while
+    // Neg(0) is -0. Also, we canonicalize Sub(0, x) into Neg(x) in case of integers.
+    Neg,
+
+    // Integer math.
+    BitAnd,
+    BitOr,
+    BitXor,
+    Shl,
+    SShr, // Arithmetic Shift.
+    ZShr, // Logical Shift.
+    RotR, // Rotate Right.
+    RotL, // Rotate Left.
+    Clz, // Count leading zeros.
+
+    // Floating point math.
+    Abs,
+    Ceil,
+    Floor,
+    Sqrt,
+
+    // Casts and such.
+    // Bitwise Cast of Double->Int64 or Int64->Double
+    BitwiseCast,
+    // Takes and returns Int32:
+    SExt8,
+    SExt16,
+    // Takes Int32 and returns Int64:
+    SExt32,
+    ZExt32,
+    // Does a bitwise truncation of Int64->Int32 and Double->Float:
+    Trunc,
+    // Takes ints and returns floating point value. Note that we don't currently provide the opposite operation,
+    // because double-to-int conversions have weirdly different semantics on different platforms. Use
+    // a patchpoint if you need to do that.
+    IToD,
+    IToF,
+    // Convert between double and float.
+    FloatToDouble,
+    DoubleToFloat,
+
+    // Polymorphic comparisons, usable with any value type. Returns int32 0 or 1. Note that "Not"
+    // is just Equal(x, 0), and "ToBoolean" is just NotEqual(x, 0).
+    Equal,
+    NotEqual,
+    LessThan,
+    GreaterThan,
+    LessEqual,
+    GreaterEqual,
+
+    // Integer comparisons. Returns int32 0 or 1.
+    Above,
+    Below,
+    AboveEqual,
+    BelowEqual,
+
+    // Unordered floating point compare: values are equal or either one is NaN.
+    EqualOrUnordered,
+
+    // SSA form of conditional move. The first child is evaluated for truthiness. If true, the second child
+    // is returned. Otherwise, the third child is returned.
+    Select,
+
+    // Memory loads. Opcode indicates how we load and the loaded type. These use MemoryValue.
+    // These return Int32:
+    Load8Z,
+    Load8S,
+    Load16Z,
+    Load16S,
+    // This returns whatever the return type is:
+    Load,
+
+    // Memory stores. Opcode indicates how the value is stored. These use MemoryValue.
+    // These take an Int32 value:
+    Store8,
+    Store16,
+    // This is a polymorphic store for Int32, Int64, Float, and Double.
+    Store,
+
+    // This is used to compute the actual address of a Wasm memory operation. It takes an IntPtr
+    // and a pinned register then computes the appropriate IntPtr address. For the use-case of
+    // Wasm it is important that the first child initially be a ZExt32 so the top bits are cleared.
+    // We do WasmAddress(ZExt32(ptr), ...) so that we can avoid generating extraneous moves in Air.
+    WasmAddress,
+    
+    // This is used to represent standalone fences - i.e. fences that are not part of other
+    // instructions. It's expressive enough to expose mfence on x86 and dmb ish/ishst on ARM. On
+    // x86, it also acts as a compiler store-store fence in those cases where it would have been a
+    // dmb ishst on ARM.
+    Fence,
+
+    // This is a regular ordinary C function call, using the system C calling convention. Make sure
+    // that the arguments are passed using the right types. The first argument is the callee.
+    CCall,
+
+    // This is a patchpoint. Use the PatchpointValue class. This is viewed as behaving like a call,
+    // but only emits code via a code generation callback. That callback gets to emit code inline.
+    // You can pass a stackmap along with constraints on how each stackmap argument must be passed.
+    // It's legal to request that a stackmap argument is in some register and it's legal to request
+    // that a stackmap argument is at some offset from the top of the argument passing area on the
+    // stack.
+    Patchpoint,
+
+    // Checked math. Use the CheckValue class. Like a Patchpoint, this takes a code generation
+    // callback. That callback gets to emit some code after the epilogue, and gets to link the jump
+    // from the check, and the choice of registers. You also get to supply a stackmap. Note that you
+    // are not allowed to jump back into the mainline code from your slow path, since the compiler
+    // will assume that the execution of these instructions proves that overflow didn't happen. For
+    // example, if you have two CheckAdd's:
+    //
+    // a = CheckAdd(x, y)
+    // b = CheckAdd(x, y)
+    //
+    // Then it's valid to change this to:
+    //
+    // a = CheckAdd(x, y)
+    // b = Identity(a)
+    //
+    // This is valid regardless of the callbacks used by the two CheckAdds. They may have different
+    // callbacks. Yet, this transformation is valid even if they are different because we know that
+    // after the first CheckAdd executes, the second CheckAdd could not have possibly taken slow
+    // path. Therefore, the second CheckAdd's callback is irrelevant.
+    //
+    // Note that the first two children of these operations have ValueRep's as input constraints but do
+    // not have output constraints.
+    CheckAdd,
+    CheckSub,
+    CheckMul,
+
+    // Check that side-exits. Use the CheckValue class. Like CheckAdd and friends, this has a
+    // stackmap with a generation callback. This takes an int argument that this branches on, with
+    // full branch fusion in the instruction selector. A true value jumps to the generator's slow
+    // path. Note that the predicate child is has both an input ValueRep. The input constraint must be
+    // WarmAny. It will not have an output constraint.
+    Check,
+
+    // Special Wasm opcode that takes a Int32, a special pinned gpr and an offset. This node exists
+    // to allow us to CSE WasmBoundsChecks if both use the same pointer and one dominates the other.
+    // Without some such node B3 would not have enough information about the inner workings of wasm
+    // to be able to perform such optimizations.
+    WasmBoundsCheck,
+
+    // SSA support, in the style of DFG SSA.
+    Upsilon, // This uses the UpsilonValue class.
+    Phi,
+
+    // Jump.
+    Jump,
+    
+    // Polymorphic branch, usable with any integer type. Branches if not equal to zero. The 0-index
+    // successor is the true successor.
+    Branch,
+
+    // Switch. Switches over either Int32 or Int64. Uses the SwitchValue class.
+    Switch,
+    
+    // Multiple entrypoints are supported via the EntrySwitch operation. Place this in the root
+    // block and list the entrypoints as the successors. All blocks backwards-reachable from
+    // EntrySwitch are duplicated for each entrypoint.
+    EntrySwitch,
+
+    // Return. Note that B3 procedures don't know their return type, so this can just return any
+    // type.
+    Return,
+
+    // This is a terminal that indicates that we will never get here.
+    Oops
+};
+
+inline bool isCheckMath(Opcode opcode)
+{
+    switch (opcode) {
+    case CheckAdd:
+    case CheckSub:
+    case CheckMul:
+        return true;
+    default:
+        return false;
+    }
+}
+
+std::optional<Opcode> invertedCompare(Opcode, Type);
+
+inline Opcode constPtrOpcode()
+{
+    if (is64Bit())
+        return Const64;
+    return Const32;
+}
+
+inline bool isConstant(Opcode opcode)
+{
+    switch (opcode) {
+    case Const32:
+    case Const64:
+    case ConstDouble:
+    case ConstFloat:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool isDefinitelyTerminal(Opcode opcode)
+{
+    switch (opcode) {
+    case Jump:
+    case Branch:
+    case Switch:
+    case Oops:
+    case Return:
+        return true;
+    default:
+        return false;
+    }
+}
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+class PrintStream;
+
+JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::B3::Opcode);
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Origin.cpp b/b3/B3Origin.cpp
new file mode 100644
index 0000000..8baf012
--- /dev/null
+++ b/b3/B3Origin.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Origin.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+void Origin::dump(PrintStream& out) const
+{
+    out.print("Origin(", RawPointer(m_data), ")");
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Origin.h b/b3/B3Origin.h
new file mode 100644
index 0000000..47fd10f
--- /dev/null
+++ b/b3/B3Origin.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+// Whoever generates B3IR can choose to put origins on values. When you do this, B3 will be able to
+// account, down to the machine code, which instruction corresponds to which origin. B3
+// transformations must preserve Origins carefully. It's an error to write a transformation that
+// either drops Origins or lies about them.
+class Origin {
+public:
+    explicit Origin(const void* data = nullptr)
+        : m_data(data)
+    {
+    }
+
+    explicit operator bool() const { return !!m_data; }
+
+    const void* data() const { return m_data; }
+
+    bool operator==(const Origin& other) const { return m_data == other.m_data; }
+
+    // You should avoid using this. Use OriginDump instead.
+    void dump(PrintStream&) const;
+    
+private:
+    const void* m_data;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3OriginDump.cpp b/b3/B3OriginDump.cpp
new file mode 100644
index 0000000..da7afee
--- /dev/null
+++ b/b3/B3OriginDump.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3OriginDump.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3Procedure.h"
+
+namespace JSC { namespace B3 {
+
+void OriginDump::dump(PrintStream& out) const
+{
+    if (m_proc)
+        m_proc->printOrigin(out, m_origin);
+    else
+        out.print(m_origin);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3OriginDump.h b/b3/B3OriginDump.h
new file mode 100644
index 0000000..5392ac9
--- /dev/null
+++ b/b3/B3OriginDump.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Origin.h"
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+class OriginDump {
+public:
+    OriginDump(const Procedure* proc, Origin origin)
+        : m_proc(proc)
+        , m_origin(origin)
+    {
+    }
+
+    void dump(PrintStream& out) const;
+
+private:
+    const Procedure* m_proc;
+    Origin m_origin;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PCToOriginMap.h b/b3/B3PCToOriginMap.h
new file mode 100644
index 0000000..5e6ce45
--- /dev/null
+++ b/b3/B3PCToOriginMap.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Origin.h"
+#include "MacroAssembler.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class PCToOriginMap {
+    WTF_MAKE_NONCOPYABLE(PCToOriginMap);
+public:
+    PCToOriginMap()
+    { }
+
+    PCToOriginMap(PCToOriginMap&& other)
+        : m_ranges(WTFMove(other.m_ranges))
+    { }
+
+    struct OriginRange {
+        MacroAssembler::Label label;
+        Origin origin;
+    };
+
+    void appendItem(MacroAssembler::Label label, Origin origin)
+    {
+        if (m_ranges.size()) {
+            if (m_ranges.last().label == label)
+                return;
+        }
+
+        m_ranges.append(OriginRange{label, origin});
+    }
+
+    const Vector<OriginRange>& ranges() const  { return m_ranges; }
+
+private:
+    Vector<OriginRange> m_ranges;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PatchpointSpecial.cpp b/b3/B3PatchpointSpecial.cpp
new file mode 100644
index 0000000..c5fc588
--- /dev/null
+++ b/b3/B3PatchpointSpecial.cpp
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3PatchpointSpecial.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirGenerationContext.h"
+#include "B3StackmapGenerationParams.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+using namespace Air;
+
+PatchpointSpecial::PatchpointSpecial()
+{
+}
+
+PatchpointSpecial::~PatchpointSpecial()
+{
+}
+
+void PatchpointSpecial::forEachArg(Inst& inst, const ScopedLambda<Inst::EachArgCallback>& callback)
+{
+    PatchpointValue* patchpoint = inst.origin->as<PatchpointValue>();
+    unsigned argIndex = 1;
+
+    if (patchpoint->type() != Void) {
+        Arg::Role role;
+        if (patchpoint->resultConstraint.kind() == ValueRep::SomeEarlyRegister)
+            role = Arg::EarlyDef;
+        else
+            role = Arg::Def;
+        
+        callback(inst.args[argIndex++], role, inst.origin->airType(), inst.origin->airWidth());
+    }
+
+    forEachArgImpl(0, argIndex, inst, SameAsRep, std::nullopt, callback);
+    argIndex += inst.origin->numChildren();
+
+    for (unsigned i = patchpoint->numGPScratchRegisters; i--;)
+        callback(inst.args[argIndex++], Arg::Scratch, Arg::GP, Arg::conservativeWidth(Arg::GP));
+    for (unsigned i = patchpoint->numFPScratchRegisters; i--;)
+        callback(inst.args[argIndex++], Arg::Scratch, Arg::FP, Arg::conservativeWidth(Arg::FP));
+}
+
+bool PatchpointSpecial::isValid(Inst& inst)
+{
+    PatchpointValue* patchpoint = inst.origin->as<PatchpointValue>();
+    unsigned argIndex = 1;
+
+    if (inst.origin->type() != Void) {
+        if (argIndex >= inst.args.size())
+            return false;
+        
+        if (!isArgValidForValue(inst.args[argIndex], patchpoint))
+            return false;
+        if (!isArgValidForRep(code(), inst.args[argIndex], patchpoint->resultConstraint))
+            return false;
+        argIndex++;
+    }
+
+    if (!isValidImpl(0, argIndex, inst))
+        return false;
+    argIndex += patchpoint->numChildren();
+
+    if (argIndex + patchpoint->numGPScratchRegisters + patchpoint->numFPScratchRegisters
+        != inst.args.size())
+        return false;
+
+    for (unsigned i = patchpoint->numGPScratchRegisters; i--;) {
+        Arg arg = inst.args[argIndex++];
+        if (!arg.isGPTmp())
+            return false;
+    }
+    for (unsigned i = patchpoint->numFPScratchRegisters; i--;) {
+        Arg arg = inst.args[argIndex++];
+        if (!arg.isFPTmp())
+            return false;
+    }
+
+    return true;
+}
+
+bool PatchpointSpecial::admitsStack(Inst& inst, unsigned argIndex)
+{
+    if (inst.origin->type() == Void)
+        return admitsStackImpl(0, 1, inst, argIndex);
+
+    if (argIndex == 1) {
+        switch (inst.origin->as<PatchpointValue>()->resultConstraint.kind()) {
+        case ValueRep::WarmAny:
+        case ValueRep::StackArgument:
+            return true;
+        case ValueRep::SomeRegister:
+        case ValueRep::SomeEarlyRegister:
+        case ValueRep::Register:
+        case ValueRep::LateRegister:
+            return false;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+
+    return admitsStackImpl(0, 2, inst, argIndex);
+}
+
+CCallHelpers::Jump PatchpointSpecial::generate(
+    Inst& inst, CCallHelpers& jit, GenerationContext& context)
+{
+    PatchpointValue* value = inst.origin->as<PatchpointValue>();
+    ASSERT(value);
+
+    Vector<ValueRep> reps;
+    unsigned offset = 1;
+    if (inst.origin->type() != Void)
+        reps.append(repForArg(*context.code, inst.args[offset++]));
+    reps.appendVector(repsImpl(context, 0, offset, inst));
+    offset += value->numChildren();
+
+    StackmapGenerationParams params(value, reps, context);
+
+    for (unsigned i = value->numGPScratchRegisters; i--;)
+        params.m_gpScratch.append(inst.args[offset++].gpr());
+    for (unsigned i = value->numFPScratchRegisters; i--;)
+        params.m_fpScratch.append(inst.args[offset++].fpr());
+    
+    value->m_generator->run(jit, params);
+
+    return CCallHelpers::Jump();
+}
+
+bool PatchpointSpecial::isTerminal(Inst& inst)
+{
+    return inst.origin->as<PatchpointValue>()->effects.terminal;
+}
+
+void PatchpointSpecial::dumpImpl(PrintStream& out) const
+{
+    out.print("Patchpoint");
+}
+
+void PatchpointSpecial::deepDumpImpl(PrintStream& out) const
+{
+    out.print("Lowered B3::PatchpointValue.");
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PatchpointSpecial.h b/b3/B3PatchpointSpecial.h
new file mode 100644
index 0000000..4e1b2a3
--- /dev/null
+++ b/b3/B3PatchpointSpecial.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3StackmapSpecial.h"
+
+namespace JSC { namespace B3 {
+
+// This is a special that recognizes that there are two uses of Patchpoint: Void and and non-Void.
+// In the Void case, the syntax of the Air Patch instruction is:
+//
+//     Patch &patchpoint, args...
+//
+// Where "args..." are the lowered arguments to the Patchpoint instruction. In the non-Void case
+// we will have:
+//
+//     Patch &patchpoint, result, args...
+
+class PatchpointSpecial : public StackmapSpecial {
+public:
+    PatchpointSpecial();
+    virtual ~PatchpointSpecial();
+
+protected:
+    void forEachArg(Air::Inst&, const ScopedLambda<Air::Inst::EachArgCallback>&) override;
+    bool isValid(Air::Inst&) override;
+    bool admitsStack(Air::Inst&, unsigned argIndex) override;
+
+    // NOTE: the generate method will generate the hidden branch and then register a LatePath that
+    // generates the stackmap. Super crazy dude!
+
+    CCallHelpers::Jump generate(Air::Inst&, CCallHelpers&, Air::GenerationContext&) override;
+    
+    bool isTerminal(Air::Inst&) override;
+
+    void dumpImpl(PrintStream&) const override;
+    void deepDumpImpl(PrintStream&) const override;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PatchpointValue.cpp b/b3/B3PatchpointValue.cpp
new file mode 100644
index 0000000..b33c558
--- /dev/null
+++ b/b3/B3PatchpointValue.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3PatchpointValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+PatchpointValue::~PatchpointValue()
+{
+}
+
+void PatchpointValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    Base::dumpMeta(comma, out);
+    out.print(comma, "resultConstraint = ", resultConstraint);
+    if (numGPScratchRegisters)
+        out.print(comma, "numGPScratchRegisters = ", numGPScratchRegisters);
+    if (numFPScratchRegisters)
+        out.print(comma, "numFPScratchRegisters = ", numFPScratchRegisters);
+}
+
+Value* PatchpointValue::cloneImpl() const
+{
+    return new PatchpointValue(*this);
+}
+
+PatchpointValue::PatchpointValue(Type type, Origin origin)
+    : Base(CheckedOpcode, Patchpoint, type, origin)
+    , effects(Effects::forCall())
+    , resultConstraint(type == Void ? ValueRep::WarmAny : ValueRep::SomeRegister)
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PatchpointValue.h b/b3/B3PatchpointValue.h
new file mode 100644
index 0000000..3378dc4
--- /dev/null
+++ b/b3/B3PatchpointValue.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Effects.h"
+#include "B3StackmapValue.h"
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class PatchpointValue : public StackmapValue {
+public:
+    typedef StackmapValue Base;
+    
+    static bool accepts(Kind kind) { return kind == Patchpoint; }
+
+    ~PatchpointValue();
+
+    // The effects of the patchpoint. This defaults to Effects::forCall(), but you can set it to anything.
+    //
+    // If there are no effects, B3 is free to assume any use of this PatchpointValue can be replaced with
+    // a use of a different PatchpointValue, so long as the other one also has no effects and has the
+    // same children. Note that this comparison ignores child constraints, the result constraint, and all
+    // other StackmapValue meta-data. If there are read effects but not write effects, then this same sort
+    // of substitution could be made so long as there are no interfering writes.
+    Effects effects;
+
+    // The input representation (i.e. constraint) of the return value. This defaults to WarmAny if the
+    // type is Void and it defaults to SomeRegister otherwise. It's illegal to mess with this if the type
+    // is Void. Otherwise you can set this to any input constraint.
+    ValueRep resultConstraint;
+
+    // The number of scratch registers that this patchpoint gets. The scratch register is guaranteed
+    // to be different from any input register and the destination register. It's also guaranteed not
+    // to be clobbered either early or late. These are 0 by default.
+    uint8_t numGPScratchRegisters { 0 };
+    uint8_t numFPScratchRegisters { 0 };
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    JS_EXPORT_PRIVATE PatchpointValue(Type, Origin);
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PhaseScope.cpp b/b3/B3PhaseScope.cpp
new file mode 100644
index 0000000..27b22de
--- /dev/null
+++ b/b3/B3PhaseScope.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3PhaseScope.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3Common.h"
+#include "B3Procedure.h"
+#include "B3Validate.h"
+#include <wtf/DataLog.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace B3 {
+
+PhaseScope::PhaseScope(Procedure& procedure, const char* name)
+    : m_procedure(procedure)
+    , m_name(name)
+    , m_timingScope(name)
+{
+    if (shouldDumpIRAtEachPhase(B3Mode)) {
+        dataLog("B3 after ", procedure.lastPhaseName(), ", before ", name, ":\n");
+        dataLog(procedure);
+    }
+
+    if (shouldSaveIRBeforePhase())
+        m_dumpBefore = toCString(procedure);
+}
+
+PhaseScope::~PhaseScope()
+{
+    m_procedure.setLastPhaseName(m_name);
+    if (shouldValidateIRAtEachPhase())
+        validate(m_procedure, m_dumpBefore.data());
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PhaseScope.h b/b3/B3PhaseScope.h
new file mode 100644
index 0000000..a176988
--- /dev/null
+++ b/b3/B3PhaseScope.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3TimingScope.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/text/CString.h>
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+class PhaseScope {
+    WTF_MAKE_NONCOPYABLE(PhaseScope);
+public:
+    PhaseScope(Procedure&, const char* name);
+    ~PhaseScope(); // this does validation
+
+private:
+    Procedure& m_procedure;
+    const char* m_name;
+    TimingScope m_timingScope;
+    CString m_dumpBefore;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PhiChildren.cpp b/b3/B3PhiChildren.cpp
new file mode 100644
index 0000000..3b9b4e2
--- /dev/null
+++ b/b3/B3PhiChildren.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3PhiChildren.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+PhiChildren::PhiChildren(Procedure& proc)
+    : m_upsilons(proc.values().size())
+{
+    for (Value* value : proc.values()) {
+        if (UpsilonValue* upsilon = value->as<UpsilonValue>()) {
+            Value* phi = upsilon->phi();
+            Vector<UpsilonValue*>& vector = m_upsilons[phi];
+            if (vector.isEmpty())
+                m_phis.append(phi);
+            vector.append(upsilon);
+        }
+    }
+}
+
+PhiChildren::~PhiChildren()
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3PhiChildren.h b/b3/B3PhiChildren.h
new file mode 100644
index 0000000..22b8277
--- /dev/null
+++ b/b3/B3PhiChildren.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Procedure.h"
+#include "B3UpsilonValue.h"
+#include <wtf/GraphNodeWorklist.h>
+#include <wtf/IndexMap.h>
+
+namespace JSC { namespace B3 {
+
+class PhiChildren {
+public:
+    PhiChildren(Procedure&);
+    ~PhiChildren();
+
+    class ValueCollection {
+    public:
+        ValueCollection(Vector<UpsilonValue*>* values = nullptr)
+            : m_values(values)
+        {
+        }
+
+        unsigned size() const { return m_values->size(); }
+        Value* at(unsigned index) const { return m_values->at(index)->child(0); }
+        Value* operator[](unsigned index) const { return at(index); }
+
+        bool contains(Value* value) const
+        {
+            for (unsigned i = size(); i--;) {
+                if (at(i) == value)
+                    return true;
+            }
+            return false;
+        }
+
+        class iterator {
+        public:
+            iterator(Vector<UpsilonValue*>* values = nullptr, unsigned index = 0)
+                : m_values(values)
+                , m_index(index)
+            {
+            }
+
+            Value* operator*() const
+            {
+                return m_values->at(m_index)->child(0);
+            }
+
+            iterator& operator++()
+            {
+                m_index++;
+                return *this;
+            }
+
+            bool operator==(const iterator& other) const
+            {
+                ASSERT(m_values == other.m_values);
+                return m_index == other.m_index;
+            }
+
+            bool operator!=(const iterator& other) const
+            {
+                return !(*this == other);
+            }
+
+        private:
+            Vector<UpsilonValue*>* m_values;
+            unsigned m_index;
+        };
+
+        iterator begin() const { return iterator(m_values); }
+        iterator end() const { return iterator(m_values, m_values->size()); }
+
+    private:
+        Vector<UpsilonValue*>* m_values;
+    };
+    
+    class UpsilonCollection {
+    public:
+        UpsilonCollection()
+        {
+        }
+        
+        UpsilonCollection(PhiChildren* phiChildren, Value* value, Vector<UpsilonValue*>* values)
+            : m_phiChildren(phiChildren)
+            , m_value(value)
+            , m_values(values)
+        {
+        }
+
+        unsigned size() const { return m_values->size(); }
+        Value* at(unsigned index) const { return m_values->at(index); }
+        Value* operator[](unsigned index) const { return at(index); }
+
+        bool contains(Value* value) const { return m_values->contains(value); }
+
+        typedef Vector<UpsilonValue*>::const_iterator iterator;
+        Vector<UpsilonValue*>::const_iterator begin() const { return m_values->begin(); }
+        Vector<UpsilonValue*>::const_iterator end() const { return m_values->end(); }
+
+        ValueCollection values() { return ValueCollection(m_values); }
+        
+        template<typename Functor>
+        void forAllTransitiveIncomingValues(const Functor& functor)
+        {
+            if (m_value->opcode() != Phi) {
+                functor(m_value);
+                return;
+            }
+            
+            GraphNodeWorklist<Value*> worklist;
+            worklist.push(m_value);
+            while (Value* phi = worklist.pop()) {
+                for (Value* child : m_phiChildren->at(phi).values()) {
+                    if (child->opcode() == Phi)
+                        worklist.push(child);
+                    else
+                        functor(child);
+                }
+            }
+        }
+
+        bool transitivelyUses(Value* candidate)
+        {
+            bool result = false;
+            forAllTransitiveIncomingValues(
+                [&] (Value* child) {
+                    result |= child == candidate;
+                });
+            return result;
+        }
+
+    private:
+        PhiChildren* m_phiChildren { nullptr };
+        Value* m_value { nullptr };
+        Vector<UpsilonValue*>* m_values { nullptr };
+    };
+
+    UpsilonCollection at(Value* value) { return UpsilonCollection(this, value, &m_upsilons[value]); }
+    UpsilonCollection operator[](Value* value) { return at(value); }
+
+    const Vector<Value*, 8>& phis() const { return m_phis; }
+
+private:
+    IndexMap<Value, Vector<UpsilonValue*>> m_upsilons;
+    Vector<Value*, 8> m_phis;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Procedure.cpp b/b3/B3Procedure.cpp
new file mode 100644
index 0000000..0cb48c4
--- /dev/null
+++ b/b3/B3Procedure.cpp
@@ -0,0 +1,362 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Procedure.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "B3BasicBlockInlines.h"
+#include "B3BasicBlockUtils.h"
+#include "B3BlockWorklist.h"
+#include "B3CFG.h"
+#include "B3DataSection.h"
+#include "B3Dominators.h"
+#include "B3OpaqueByproducts.h"
+#include "B3PhiChildren.h"
+#include "B3StackSlot.h"
+#include "B3ValueInlines.h"
+#include "B3Variable.h"
+
+namespace JSC { namespace B3 {
+
+Procedure::Procedure()
+    : m_cfg(new CFG(*this))
+    , m_lastPhaseName("initial")
+    , m_byproducts(std::make_unique<OpaqueByproducts>())
+    , m_code(new Air::Code(*this))
+{
+}
+
+Procedure::~Procedure()
+{
+}
+
+void Procedure::printOrigin(PrintStream& out, Origin origin) const
+{
+    if (m_originPrinter)
+        m_originPrinter->run(out, origin);
+    else
+        out.print(origin);
+}
+
+BasicBlock* Procedure::addBlock(double frequency)
+{
+    std::unique_ptr<BasicBlock> block(new BasicBlock(m_blocks.size(), frequency));
+    BasicBlock* result = block.get();
+    m_blocks.append(WTFMove(block));
+    return result;
+}
+
+StackSlot* Procedure::addStackSlot(unsigned byteSize)
+{
+    return m_stackSlots.addNew(byteSize);
+}
+
+Variable* Procedure::addVariable(Type type)
+{
+    return m_variables.addNew(type); 
+}
+
+Value* Procedure::clone(Value* value)
+{
+    std::unique_ptr<Value> clone(value->cloneImpl());
+    clone->m_index = UINT_MAX;
+    clone->owner = nullptr;
+    return m_values.add(WTFMove(clone));
+}
+
+Value* Procedure::addIntConstant(Origin origin, Type type, int64_t value)
+{
+    switch (type) {
+    case Int32:
+        return add<Const32Value>(origin, static_cast<int32_t>(value));
+    case Int64:
+        return add<Const64Value>(origin, value);
+    case Double:
+        return add<ConstDoubleValue>(origin, static_cast<double>(value));
+    case Float:
+        return add<ConstFloatValue>(origin, static_cast<float>(value));
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+}
+
+Value* Procedure::addIntConstant(Value* likeValue, int64_t value)
+{
+    return addIntConstant(likeValue->origin(), likeValue->type(), value);
+}
+
+Value* Procedure::addBottom(Origin origin, Type type)
+{
+    return addIntConstant(origin, type, 0);
+}
+
+Value* Procedure::addBottom(Value* value)
+{
+    return addBottom(value->origin(), value->type());
+}
+
+Value* Procedure::addBoolConstant(Origin origin, TriState triState)
+{
+    int32_t value = 0;
+    switch (triState) {
+    case FalseTriState:
+        value = 0;
+        break;
+    case TrueTriState:
+        value = 1;
+        break;
+    case MixedTriState:
+        return nullptr;
+    }
+
+    return addIntConstant(origin, Int32, value);
+}
+
+void Procedure::resetValueOwners()
+{
+    for (BasicBlock* block : *this) {
+        for (Value* value : *block)
+            value->owner = block;
+    }
+}
+
+void Procedure::resetReachability()
+{
+    recomputePredecessors(m_blocks);
+    
+    // The common case is that this does not find any dead blocks.
+    bool foundDead = false;
+    for (auto& block : m_blocks) {
+        if (isBlockDead(block.get())) {
+            foundDead = true;
+            break;
+        }
+    }
+    if (!foundDead)
+        return;
+    
+    resetValueOwners();
+
+    for (Value* value : values()) {
+        if (UpsilonValue* upsilon = value->as<UpsilonValue>()) {
+            if (isBlockDead(upsilon->phi()->owner))
+                upsilon->replaceWithNop();
+        }
+    }
+    
+    for (auto& block : m_blocks) {
+        if (isBlockDead(block.get())) {
+            for (Value* value : *block)
+                deleteValue(value);
+            block = nullptr;
+        }
+    }
+}
+
+void Procedure::invalidateCFG()
+{
+    m_dominators = nullptr;
+}
+
+void Procedure::dump(PrintStream& out) const
+{
+    IndexSet<Value> valuesInBlocks;
+    for (BasicBlock* block : *this) {
+        out.print(deepDump(*this, block));
+        valuesInBlocks.addAll(*block);
+    }
+    bool didPrint = false;
+    for (Value* value : values()) {
+        if (valuesInBlocks.contains(value))
+            continue;
+
+        if (!didPrint) {
+            dataLog("Orphaned values:\n");
+            didPrint = true;
+        }
+        dataLog("    ", deepDump(*this, value), "\n");
+    }
+    if (variables().size()) {
+        out.print("Variables:\n");
+        for (Variable* variable : variables())
+            out.print("    ", deepDump(variable), "\n");
+    }
+    if (stackSlots().size()) {
+        out.print("Stack slots:\n");
+        for (StackSlot* slot : stackSlots())
+            out.print("    ", pointerDump(slot), ": ", deepDump(slot), "\n");
+    }
+    if (m_byproducts->count())
+        out.print(*m_byproducts);
+}
+
+Vector<BasicBlock*> Procedure::blocksInPreOrder()
+{
+    return B3::blocksInPreOrder(at(0));
+}
+
+Vector<BasicBlock*> Procedure::blocksInPostOrder()
+{
+    return B3::blocksInPostOrder(at(0));
+}
+
+void Procedure::deleteStackSlot(StackSlot* stackSlot)
+{
+    m_stackSlots.remove(stackSlot);
+}
+
+void Procedure::deleteVariable(Variable* variable)
+{
+    m_variables.remove(variable);
+}
+
+void Procedure::deleteValue(Value* value)
+{
+    m_values.remove(value);
+}
+
+void Procedure::deleteOrphans()
+{
+    IndexSet<Value> valuesInBlocks;
+    for (BasicBlock* block : *this)
+        valuesInBlocks.addAll(*block);
+
+    // Since this method is not on any hot path, we do it conservatively: first a pass to
+    // identify the values to be removed, and then a second pass to remove them. This avoids any
+    // risk of the value iteration being broken by removals.
+    Vector<Value*, 16> toRemove;
+    for (Value* value : values()) {
+        if (!valuesInBlocks.contains(value))
+            toRemove.append(value);
+        else if (UpsilonValue* upsilon = value->as<UpsilonValue>()) {
+            if (!valuesInBlocks.contains(upsilon->phi()))
+                upsilon->replaceWithNop();
+        }
+    }
+
+    for (Value* value : toRemove)
+        deleteValue(value);
+}
+
+Dominators& Procedure::dominators()
+{
+    if (!m_dominators)
+        m_dominators = std::make_unique<Dominators>(*this);
+    return *m_dominators;
+}
+
+void Procedure::addFastConstant(const ValueKey& constant)
+{
+    RELEASE_ASSERT(constant.isConstant());
+    m_fastConstants.add(constant);
+}
+
+bool Procedure::isFastConstant(const ValueKey& constant)
+{
+    if (!constant)
+        return false;
+    return m_fastConstants.contains(constant);
+}
+
+CCallHelpers::Label Procedure::entrypointLabel(unsigned index) const
+{
+    return m_code->entrypointLabel(index);
+}
+
+void* Procedure::addDataSection(size_t size)
+{
+    if (!size)
+        return nullptr;
+    std::unique_ptr<DataSection> dataSection = std::make_unique<DataSection>(size);
+    void* result = dataSection->data();
+    m_byproducts->add(WTFMove(dataSection));
+    return result;
+}
+
+unsigned Procedure::callArgAreaSizeInBytes() const
+{
+    return code().callArgAreaSizeInBytes();
+}
+
+void Procedure::requestCallArgAreaSizeInBytes(unsigned size)
+{
+    code().requestCallArgAreaSizeInBytes(size);
+}
+
+void Procedure::pinRegister(Reg reg)
+{
+    code().pinRegister(reg);
+}
+
+unsigned Procedure::frameSize() const
+{
+    return code().frameSize();
+}
+
+const RegisterAtOffsetList& Procedure::calleeSaveRegisters() const
+{
+    return code().calleeSaveRegisters();
+}
+
+Value* Procedure::addValueImpl(Value* value)
+{
+    return m_values.add(std::unique_ptr<Value>(value));
+}
+
+void Procedure::setBlockOrderImpl(Vector<BasicBlock*>& blocks)
+{
+    IndexSet<BasicBlock> blocksSet;
+    blocksSet.addAll(blocks);
+
+    for (BasicBlock* block : *this) {
+        if (!blocksSet.contains(block))
+            blocks.append(block);
+    }
+
+    // Place blocks into this's block list by first leaking all of the blocks and then readopting
+    // them.
+    for (auto& entry : m_blocks)
+        entry.release();
+
+    m_blocks.resize(blocks.size());
+    for (unsigned i = 0; i < blocks.size(); ++i) {
+        BasicBlock* block = blocks[i];
+        block->m_index = i;
+        m_blocks[i] = std::unique_ptr<BasicBlock>(block);
+    }
+}
+
+void Procedure::setWasmBoundsCheckGenerator(RefPtr<WasmBoundsCheckGenerator> generator)
+{
+    code().setWasmBoundsCheckGenerator(generator);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Procedure.h b/b3/B3Procedure.h
new file mode 100644
index 0000000..2236145
--- /dev/null
+++ b/b3/B3Procedure.h
@@ -0,0 +1,259 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3OpaqueByproducts.h"
+#include "B3Origin.h"
+#include "B3PCToOriginMap.h"
+#include "B3SparseCollection.h"
+#include "B3Type.h"
+#include "B3ValueKey.h"
+#include "CCallHelpers.h"
+#include "PureNaN.h"
+#include "RegisterAtOffsetList.h"
+#include <wtf/Bag.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/HashSet.h>
+#include <wtf/IndexedContainerIterator.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+#include <wtf/SharedTask.h>
+#include <wtf/TriState.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class BasicBlock;
+class BlockInsertionSet;
+class CFG;
+class Dominators;
+class StackSlot;
+class Value;
+class Variable;
+
+namespace Air { class Code; }
+
+typedef void WasmBoundsCheckGeneratorFunction(CCallHelpers&, GPRReg, unsigned);
+typedef SharedTask<WasmBoundsCheckGeneratorFunction> WasmBoundsCheckGenerator;
+
+// This represents B3's view of a piece of code. Note that this object must exist in a 1:1
+// relationship with Air::Code. B3::Procedure and Air::Code are just different facades of the B3
+// compiler's knowledge about a piece of code. Some kinds of state aren't perfect fits for either
+// Procedure or Code, and are placed in one or the other based on convenience. Procedure always
+// allocates a Code, and a Code cannot be allocated without an owning Procedure and they always
+// have references to each other.
+
+class Procedure {
+    WTF_MAKE_NONCOPYABLE(Procedure);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+
+    JS_EXPORT_PRIVATE Procedure();
+    JS_EXPORT_PRIVATE ~Procedure();
+
+    template<typename Callback>
+    void setOriginPrinter(Callback&& callback)
+    {
+        m_originPrinter = createSharedTask<void(PrintStream&, Origin)>(
+            std::forward<Callback>(callback));
+    }
+
+    // Usually you use this via OriginDump, though it's cool to use it directly.
+    void printOrigin(PrintStream& out, Origin origin) const;
+
+    // This is a debugging hack. Sometimes while debugging B3 you need to break the abstraction
+    // and get at the DFG Graph, or whatever data structure the frontend used to describe the
+    // program. The FTL passes the DFG Graph.
+    void setFrontendData(const void* value) { m_frontendData = value; }
+    const void* frontendData() const { return m_frontendData; }
+
+    JS_EXPORT_PRIVATE BasicBlock* addBlock(double frequency = 1);
+
+    // Changes the order of basic blocks to be as in the supplied vector. The vector does not
+    // need to mention every block in the procedure. Blocks not mentioned will be placed after
+    // these blocks in the same order as they were in originally.
+    template<typename BlockIterable>
+    void setBlockOrder(const BlockIterable& iterable)
+    {
+        Vector<BasicBlock*> blocks;
+        for (BasicBlock* block : iterable)
+            blocks.append(block);
+        setBlockOrderImpl(blocks);
+    }
+
+    JS_EXPORT_PRIVATE StackSlot* addStackSlot(unsigned byteSize);
+    JS_EXPORT_PRIVATE Variable* addVariable(Type);
+    
+    template<typename ValueType, typename... Arguments>
+    ValueType* add(Arguments...);
+
+    Value* clone(Value*);
+
+    Value* addIntConstant(Origin, Type, int64_t value);
+    Value* addIntConstant(Value*, int64_t value);
+
+    Value* addBottom(Origin, Type);
+    Value* addBottom(Value*);
+
+    // Returns null for MixedTriState.
+    Value* addBoolConstant(Origin, TriState);
+
+    void resetValueOwners();
+    JS_EXPORT_PRIVATE void resetReachability();
+
+    // This destroys CFG analyses. If we ask for them again, we will recompute them. Usually you
+    // should call this anytime you call resetReachability().
+    void invalidateCFG();
+
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+
+    unsigned size() const { return m_blocks.size(); }
+    BasicBlock* at(unsigned index) const { return m_blocks[index].get(); }
+    BasicBlock* operator[](unsigned index) const { return at(index); }
+
+    typedef WTF::IndexedContainerIterator<Procedure> iterator;
+
+    iterator begin() const { return iterator(*this, 0); }
+    iterator end() const { return iterator(*this, size()); }
+
+    Vector<BasicBlock*> blocksInPreOrder();
+    Vector<BasicBlock*> blocksInPostOrder();
+
+    SparseCollection<StackSlot>& stackSlots() { return m_stackSlots; }
+    const SparseCollection<StackSlot>& stackSlots() const { return m_stackSlots; }
+
+    // Short for stackSlots().remove(). It's better to call this method since it's out of line.
+    void deleteStackSlot(StackSlot*);
+
+    SparseCollection<Variable>& variables() { return m_variables; }
+    const SparseCollection<Variable>& variables() const { return m_variables; }
+
+    // Short for variables().remove(). It's better to call this method since it's out of line.
+    void deleteVariable(Variable*);
+
+    SparseCollection<Value>& values() { return m_values; }
+    const SparseCollection<Value>& values() const { return m_values; }
+
+    // Short for values().remove(). It's better to call this method since it's out of line.
+    void deleteValue(Value*);
+
+    // A valid procedure cannot contain any orphan values. An orphan is a value that is not in
+    // any basic block. It is possible to create an orphan value during code generation or during
+    // transformation. If you know that you may have created some, you can call this method to
+    // delete them, making the procedure valid again.
+    void deleteOrphans();
+
+    CFG& cfg() const { return *m_cfg; }
+
+    Dominators& dominators();
+
+    void addFastConstant(const ValueKey&);
+    bool isFastConstant(const ValueKey&);
+    
+    unsigned numEntrypoints() const { return m_numEntrypoints; }
+    void setNumEntrypoints(unsigned numEntrypoints) { m_numEntrypoints = numEntrypoints; }
+    
+    // Only call this after code generation is complete. Note that the label for the 0th entrypoint
+    // should point to exactly where the code generation cursor was before you started generating
+    // code.
+    JS_EXPORT_PRIVATE CCallHelpers::Label entrypointLabel(unsigned entrypointIndex) const;
+
+    // The name has to be a string literal, since we don't do any memory management for the string.
+    void setLastPhaseName(const char* name)
+    {
+        m_lastPhaseName = name;
+    }
+
+    const char* lastPhaseName() const { return m_lastPhaseName; }
+
+    // Allocates a slab of memory that will be kept alive by anyone who keeps the resulting code
+    // alive. Great for compiler-generated data sections, like switch jump tables and constant pools.
+    // This returns memory that has been zero-initialized.
+    JS_EXPORT_PRIVATE void* addDataSection(size_t);
+
+    OpaqueByproducts& byproducts() { return *m_byproducts; }
+
+    // Below are methods that make sense to call after you have generated code for the procedure.
+
+    // You have to call this method after calling generate(). The code generated by B3::generate()
+    // will require you to keep this object alive for as long as that code is runnable. Usually, this
+    // just keeps alive things like the double constant pool and switch lookup tables. If this sounds
+    // confusing, you should probably be using the B3::Compilation API to compile code. If you use
+    // that API, then you don't have to worry about this.
+    std::unique_ptr<OpaqueByproducts> releaseByproducts() { return WTFMove(m_byproducts); }
+
+    // This gives you direct access to Code. However, the idea is that clients of B3 shouldn't have to
+    // call this. So, Procedure has some methods (below) that expose some Air::Code functionality.
+    const Air::Code& code() const { return *m_code; }
+    Air::Code& code() { return *m_code; }
+
+    unsigned callArgAreaSizeInBytes() const;
+    void requestCallArgAreaSizeInBytes(unsigned size);
+
+    // This tells the register allocators to stay away from this register.
+    JS_EXPORT_PRIVATE void pinRegister(Reg);
+
+    JS_EXPORT_PRIVATE unsigned frameSize() const;
+    JS_EXPORT_PRIVATE const RegisterAtOffsetList& calleeSaveRegisters() const;
+
+    PCToOriginMap& pcToOriginMap() { return m_pcToOriginMap; }
+    PCToOriginMap releasePCToOriginMap() { return WTFMove(m_pcToOriginMap); }
+
+    JS_EXPORT_PRIVATE void setWasmBoundsCheckGenerator(RefPtr<WasmBoundsCheckGenerator>);
+
+    template<typename Functor>
+    void setWasmBoundsCheckGenerator(const Functor& functor)
+    {
+        setWasmBoundsCheckGenerator(RefPtr<WasmBoundsCheckGenerator>(createSharedTask<WasmBoundsCheckGeneratorFunction>(functor)));
+    }
+
+private:
+    friend class BlockInsertionSet;
+
+    JS_EXPORT_PRIVATE Value* addValueImpl(Value*);
+    void setBlockOrderImpl(Vector<BasicBlock*>&);
+
+    SparseCollection<StackSlot> m_stackSlots;
+    SparseCollection<Variable> m_variables;
+    Vector<std::unique_ptr<BasicBlock>> m_blocks;
+    SparseCollection<Value> m_values;
+    std::unique_ptr<CFG> m_cfg;
+    std::unique_ptr<Dominators> m_dominators;
+    HashSet<ValueKey> m_fastConstants;
+    unsigned m_numEntrypoints { 1 };
+    const char* m_lastPhaseName;
+    std::unique_ptr<OpaqueByproducts> m_byproducts;
+    std::unique_ptr<Air::Code> m_code;
+    RefPtr<SharedTask<void(PrintStream&, Origin)>> m_originPrinter;
+    const void* m_frontendData;
+    PCToOriginMap m_pcToOriginMap;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ProcedureInlines.h b/b3/B3ProcedureInlines.h
new file mode 100644
index 0000000..990ba31
--- /dev/null
+++ b/b3/B3ProcedureInlines.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlock.h"
+#include "B3Procedure.h"
+
+namespace JSC { namespace B3 {
+
+template<typename ValueType, typename... Arguments>
+ValueType* Procedure::add(Arguments... arguments)
+{
+    return static_cast<ValueType*>(addValueImpl(new ValueType(arguments...)));
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3PureCSE.cpp b/b3/B3PureCSE.cpp
new file mode 100644
index 0000000..4030e28
--- /dev/null
+++ b/b3/B3PureCSE.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3PureCSE.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3Dominators.h"
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+PureCSE::PureCSE()
+{
+}
+
+PureCSE::~PureCSE()
+{
+}
+
+void PureCSE::clear()
+{
+    m_map.clear();
+}
+
+Value* PureCSE::findMatch(const ValueKey& key, BasicBlock* block, Dominators& dominators)
+{
+    if (!key)
+        return nullptr;
+
+    auto iter = m_map.find(key);
+    if (iter == m_map.end())
+        return nullptr;
+
+    for (Value* match : iter->value) {
+        if (dominators.dominates(match->owner, block))
+            return match;
+    }
+
+    return nullptr;
+}
+
+bool PureCSE::process(Value* value, Dominators& dominators)
+{
+    if (value->opcode() == Identity)
+        return false;
+
+    ValueKey key = value->key();
+    if (!key)
+        return false;
+
+    Matches& matches = m_map.add(key, Matches()).iterator->value;
+
+    for (Value* match : matches) {
+        if (dominators.dominates(match->owner, value->owner)) {
+            value->replaceWithIdentity(match);
+            return true;
+        }
+    }
+
+    matches.append(value);
+    return false;
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3PureCSE.h b/b3/B3PureCSE.h
new file mode 100644
index 0000000..942966c
--- /dev/null
+++ b/b3/B3PureCSE.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3ValueKey.h"
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class BasicBlock;
+class Dominators;
+class Value;
+
+typedef Vector<Value*, 1> Matches;
+
+// This is a reusable utility for doing pure CSE. You can use it to do pure CSE on a program by just
+// proceeding in order an calling process().
+class PureCSE {
+public:
+    PureCSE();
+    ~PureCSE();
+
+    void clear();
+
+    Value* findMatch(const ValueKey&, BasicBlock*, Dominators&);
+
+    bool process(Value*, Dominators&);
+    
+private:
+    HashMap<ValueKey, Matches> m_map;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ReduceDoubleToFloat.cpp b/b3/B3ReduceDoubleToFloat.cpp
new file mode 100644
index 0000000..ef92811
--- /dev/null
+++ b/b3/B3ReduceDoubleToFloat.cpp
@@ -0,0 +1,496 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3ReduceDoubleToFloat.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlock.h"
+#include "B3InsertionSetInlines.h"
+#include "B3PhaseScope.h"
+#include "B3UseCounts.h"
+#include "B3ValueInlines.h"
+#include <wtf/IndexSet.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+bool verbose = false;
+bool printRemainingConversions = false;
+
+class DoubleToFloatReduction {
+public:
+    DoubleToFloatReduction(Procedure& procedure)
+        : m_procedure(procedure)
+    {
+    }
+
+    void run()
+    {
+        if (!findCandidates())
+            return;
+
+        findPhisContainingFloat();
+
+        simplify();
+
+        cleanUp();
+    }
+
+private:
+    // This step find values that are used as Double and cannot be converted to Float..
+    // It flows the information backward through Phi-Upsilons.
+    bool findCandidates()
+    {
+        bool foundConversionCandidate = false;
+        Vector<Value*, 32> upsilons;
+
+        // First, we find all values that are strictly used as double.
+        // Those are values used by something else than DoubleToFloat.
+        //
+        // We don't know the state of Upsilons until their Phi has been
+        // set. We just keep a list of them and update them next.
+        for (BasicBlock* block : m_procedure) {
+            for (Value* value : *block) {
+                value->performSubstitution();
+
+                if (value->opcode() == DoubleToFloat) {
+                    foundConversionCandidate = true;
+
+                    Value* child = value->child(0);
+                    if (child->opcode() == FloatToDouble) {
+                        // We don't really need to simplify this early but it simplifies debugging.
+                        value->replaceWithIdentity(child->child(0));
+                    }
+                    continue;
+                }
+
+                if (value->opcode() == FloatToDouble)
+                    foundConversionCandidate = true;
+
+                if (value->opcode() == Upsilon) {
+                    Value* child = value->child(0);
+                    if (child->type() == Double)
+                        upsilons.append(value);
+                    continue;
+                }
+
+                for (Value* child : value->children()) {
+                    if (child->type() == Double)
+                        m_valuesUsedAsDouble.add(child);
+                }
+            }
+        }
+
+        if (!foundConversionCandidate)
+            return false;
+
+        // Now we just need to propagate through Phi-Upsilon.
+        // A Upsilon can convert its input to float if its phi is never used as double.
+        // If we modify a phi, we need to continue until all the Upsilon-Phi converge.
+        bool changedPhiState;
+        do {
+            changedPhiState = false;
+            for (Value* value : upsilons) {
+                UpsilonValue* upsilon = value->as<UpsilonValue>();
+                Value* phi = upsilon->phi();
+                if (!m_valuesUsedAsDouble.contains(phi))
+                    continue;
+
+                Value* child = value->child(0);
+                bool childChanged = m_valuesUsedAsDouble.add(child);
+                if (childChanged && child->opcode() == Phi)
+                    changedPhiState = true;
+            }
+        } while (changedPhiState);
+
+        if (verbose) {
+            dataLog("Conversion candidates:\n");
+            for (BasicBlock* block : m_procedure) {
+                for (Value* value : *block) {
+                    if (value->type() == Double && !m_valuesUsedAsDouble.contains(value))
+                        dataLog("    ", deepDump(m_procedure, value), "\n");
+                }
+            }
+            dataLog("\n");
+        }
+
+        return true;
+    }
+
+    // This step finds Phis of type Double that effectively contains Float values.
+    // It flows that information forward through Phi-Upsilons.
+    void findPhisContainingFloat()
+    {
+        Vector<Value*, 32> upsilons;
+
+        // The Double value that can be safely turned into a Float are:
+        // - FloatToDouble
+        // - ConstDouble with a value that converts to Float without losing precision.
+        for (BasicBlock* block : m_procedure) {
+            for (Value* value : *block) {
+                if (value->opcode() != Upsilon)
+                    continue;
+
+                Value* child = value->child(0);
+                if (child->type() != Double
+                    || child->opcode() == FloatToDouble)
+                    continue;
+
+                if (child->hasDouble()) {
+                    double constValue = child->asDouble();
+                    if (isIdentical(static_cast<double>(static_cast<float>(constValue)), constValue))
+                        continue;
+                }
+
+                if (child->opcode() == Phi) {
+                    upsilons.append(value);
+                    continue;
+                }
+
+                UpsilonValue* upsilon = value->as<UpsilonValue>();
+                Value* phi = upsilon->phi();
+                m_phisContainingDouble.add(phi);
+            }
+        }
+
+        // Propagate the flags forward.
+        bool changedPhiState;
+        do {
+            changedPhiState = false;
+            for (Value* value : upsilons) {
+                Value* child = value->child(0);
+                if (m_phisContainingDouble.contains(child)) {
+                    UpsilonValue* upsilon = value->as<UpsilonValue>();
+                    Value* phi = upsilon->phi();
+                    changedPhiState |= m_phisContainingDouble.add(phi);
+                }
+            }
+        } while (changedPhiState);
+
+        if (verbose) {
+            dataLog("Phis containing float values:\n");
+            for (BasicBlock* block : m_procedure) {
+                for (Value* value : *block) {
+                    if (value->opcode() == Phi
+                        && value->type() == Double
+                        && !m_phisContainingDouble.contains(value))
+                        dataLog("    ", deepDump(m_procedure, value), "\n");
+                }
+            }
+            dataLog("\n");
+        }
+    }
+
+    bool canBeTransformedToFloat(Value* value)
+    {
+        if (value->opcode() == FloatToDouble)
+            return true;
+
+        if (value->hasDouble())
+            return true; // Double constant truncated to float.
+
+        if (value->opcode() == Phi) {
+            return value->type() == Float
+                || (value->type() == Double && !m_phisContainingDouble.contains(value));
+        }
+        return false;
+    }
+
+    Value* transformToFloat(Value* value, unsigned valueIndex, InsertionSet& insertionSet)
+    {
+        ASSERT(canBeTransformedToFloat(value));
+        if (value->opcode() == FloatToDouble)
+            return value->child(0);
+
+        if (value->hasDouble())
+            return insertionSet.insert<ConstFloatValue>(valueIndex, value->origin(), static_cast<float>(value->asDouble()));
+
+        if (value->opcode() == Phi) {
+            ASSERT(value->type() == Double || value->type() == Float);
+            if (value->type() == Double)
+                convertPhi(value);
+            return value;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    void convertPhi(Value* phi)
+    {
+        ASSERT(phi->opcode() == Phi);
+        ASSERT(phi->type() == Double);
+        phi->setType(Float);
+        m_convertedPhis.add(phi);
+    }
+
+    bool attemptTwoOperandsSimplify(Value* candidate, unsigned candidateIndex, InsertionSet& insertionSet)
+    {
+        Value* left = candidate->child(0);
+        Value* right = candidate->child(1);
+        if (!canBeTransformedToFloat(left) || !canBeTransformedToFloat(right))
+            return false;
+
+        m_convertedValue.add(candidate);
+        candidate->child(0) = transformToFloat(left, candidateIndex, insertionSet);
+        candidate->child(1) = transformToFloat(right, candidateIndex, insertionSet);
+        return true;
+    }
+
+    // Simplify Double operations into Float operations.
+    void simplify()
+    {
+        Vector<Value*, 32> upsilonReferencingDoublePhi;
+
+        InsertionSet insertionSet(m_procedure);
+        for (BasicBlock* block : m_procedure) {
+            for (unsigned index = 0; index < block->size(); ++index) {
+                Value* value = block->at(index);
+
+                switch (value->opcode()) {
+                case Equal:
+                case NotEqual:
+                case LessThan:
+                case GreaterThan:
+                case LessEqual:
+                case GreaterEqual:
+                case EqualOrUnordered:
+                    attemptTwoOperandsSimplify(value, index, insertionSet);
+                    continue;
+                case Upsilon: {
+                    Value* child = value->child(0);
+                    if (child->opcode() == Phi && child->type() == Double)
+                        upsilonReferencingDoublePhi.append(value);
+                    continue;
+                }
+                default:
+                    break;
+                }
+
+                if (m_valuesUsedAsDouble.contains(value))
+                    continue;
+
+                switch (value->opcode()) {
+                case Add:
+                case Sub:
+                case Mul:
+                case Div:
+                    if (attemptTwoOperandsSimplify(value, index, insertionSet))
+                        value->setType(Float);
+                    break;
+                case Abs:
+                case Ceil:
+                case Floor:
+                case Neg:
+                case Sqrt: {
+                    Value* child = value->child(0);
+                    if (canBeTransformedToFloat(child)) {
+                        value->child(0) = transformToFloat(child, index, insertionSet);
+                        value->setType(Float);
+                        m_convertedValue.add(value);
+                    }
+                    break;
+                }
+                case IToD: {
+                    Value* iToF = insertionSet.insert<Value>(index, IToF, value->origin(), value->child(0));
+                    value->setType(Float);
+                    value->replaceWithIdentity(iToF);
+                    m_convertedValue.add(value);
+                    break;
+                }
+                case FloatToDouble:
+                    // This happens if we round twice.
+                    // Typically, this is indirect through Phi-Upsilons.
+                    // The Upsilon rounds and the Phi rounds.
+                    value->setType(Float);
+                    value->replaceWithIdentity(value->child(0));
+                    m_convertedValue.add(value);
+                    break;
+                case Phi:
+                    // If a Phi is always converted to Float, we always make it into a float Phi-Upsilon.
+                    // This is a simplistic view of things. Ideally we should keep type that will minimize
+                    // the amount of conversion in the loop.
+                    if (value->type() == Double)
+                        convertPhi(value);
+                    break;
+                default:
+                    break;
+                }
+            }
+            insertionSet.execute(block);
+        }
+
+        if (!upsilonReferencingDoublePhi.isEmpty()) {
+            // If a Phi contains Float values typed as Double, but is not used as Float
+            // by a non-trivial operation, we did not convert it.
+            //
+            // We fix that now by converting the remaining phis that contains
+            // float but where not converted to float.
+            bool changedPhi;
+            do {
+                changedPhi = false;
+
+                for (Value* value : upsilonReferencingDoublePhi) {
+                    UpsilonValue* upsilon = value->as<UpsilonValue>();
+                    Value* child = value->child(0);
+                    Value* phi = upsilon->phi();
+                    if (phi->type() == Float && child->type() == Double
+                        && !m_phisContainingDouble.contains(child)) {
+                        convertPhi(child);
+                        changedPhi = true;
+                    }
+                }
+
+            } while (changedPhi);
+        }
+    }
+
+    // We are in an inconsistent state where we have
+    // DoubleToFloat nodes over values producing float and Phis that are
+    // float for Upsilons that are Double.
+    //
+    // This steps puts us back in a consistent state.
+    void cleanUp()
+    {
+        InsertionSet insertionSet(m_procedure);
+
+        for (BasicBlock* block : m_procedure) {
+            for (unsigned index = 0; index < block->size(); ++index) {
+                Value* value = block->at(index);
+                if (value->opcode() == DoubleToFloat && value->child(0)->type() == Float) {
+                    value->replaceWithIdentity(value->child(0));
+                    continue;
+                }
+
+                if (value->opcode() == Upsilon) {
+                    UpsilonValue* upsilon = value->as<UpsilonValue>();
+                    Value* child = value->child(0);
+                    Value* phi = upsilon->phi();
+
+                    if (phi->type() == Float) {
+                        if (child->type() == Double) {
+                            Value* newChild = nullptr;
+                            if (child->opcode() == FloatToDouble)
+                                newChild = child->child(0);
+                            else if (child->hasDouble())
+                                newChild = insertionSet.insert<ConstFloatValue>(index, child->origin(), static_cast<float>(child->asDouble()));
+                            else
+                                newChild = insertionSet.insert<Value>(index, DoubleToFloat, upsilon->origin(), child);
+                            upsilon->child(0) = newChild;
+                        }
+                        continue;
+                    }
+                }
+
+                if (!m_convertedValue.contains(value)) {
+                    // Phis can be converted from Double to Float if the value they contain
+                    // is not more precise than a Float.
+                    // If the value is needed as Double, it has to be converted back.
+                    for (Value*& child : value->children()) {
+                        if (m_convertedPhis.contains(child))
+                            child = insertionSet.insert<Value>(index, FloatToDouble, value->origin(), child);
+                    }
+                }
+            }
+            insertionSet.execute(block);
+        }
+    }
+
+    Procedure& m_procedure;
+
+    // Set of all the Double values that are actually used as Double.
+    // Converting any of them to Float would lose precision.
+    IndexSet<Value> m_valuesUsedAsDouble;
+
+    // Set of all the Phi of type Double that really contains a Double.
+    // Any Double Phi not in the set can be converted to Float without losing precision.
+    IndexSet<Value> m_phisContainingDouble;
+
+    // Any value that was converted from producing a Double to producing a Float.
+    // This set does not include Phi-Upsilons.
+    IndexSet<Value> m_convertedValue;
+
+    // Any value that previously produced Double and now produce Float.
+    IndexSet<Value> m_convertedPhis;
+};
+
+void printGraphIfConverting(Procedure& procedure)
+{
+    if (!printRemainingConversions)
+        return;
+
+    UseCounts useCount(procedure);
+
+    Vector<Value*> doubleToFloat;
+    Vector<Value*> floatToDouble;
+
+    for (BasicBlock* block : procedure) {
+        for (Value* value : *block) {
+            if (!useCount.numUses(value))
+                continue;
+
+            if (value->opcode() == DoubleToFloat)
+                doubleToFloat.append(value);
+            if (value->opcode() == FloatToDouble)
+                floatToDouble.append(value);
+        }
+    }
+
+    if (doubleToFloat.isEmpty() && floatToDouble.isEmpty())
+        return;
+
+    dataLog("Procedure with Float-Double conversion:\n", procedure, "\n");
+    dataLog("Converting nodes:\n");
+    for (Value* value : doubleToFloat)
+        dataLog("    ", deepDump(procedure, value), "\n");
+    for (Value* value : floatToDouble)
+        dataLog("    ", deepDump(procedure, value), "\n");
+
+}
+
+} // anonymous namespace.
+
+void reduceDoubleToFloat(Procedure& procedure)
+{
+    PhaseScope phaseScope(procedure, "reduceDoubleToFloat");
+
+    if (verbose)
+        dataLog("Before DoubleToFloatReduction:\n", procedure, "\n");
+
+    DoubleToFloatReduction doubleToFloatReduction(procedure);
+    doubleToFloatReduction.run();
+
+    if (verbose)
+        dataLog("After DoubleToFloatReduction:\n", procedure, "\n");
+
+    printGraphIfConverting(procedure);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3ReduceDoubleToFloat.h b/b3/B3ReduceDoubleToFloat.h
new file mode 100644
index 0000000..899f770
--- /dev/null
+++ b/b3/B3ReduceDoubleToFloat.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Change Double operations to Float operations when the difference is not observable
+// and doing so is likely beneficial.
+void reduceDoubleToFloat(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ReduceStrength.cpp b/b3/B3ReduceStrength.cpp
new file mode 100644
index 0000000..43c7302
--- /dev/null
+++ b/b3/B3ReduceStrength.cpp
@@ -0,0 +1,2518 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3ReduceStrength.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3BlockInsertionSet.h"
+#include "B3ComputeDivisionMagic.h"
+#include "B3Dominators.h"
+#include "B3InsertionSetInlines.h"
+#include "B3MemoryValue.h"
+#include "B3PhaseScope.h"
+#include "B3PhiChildren.h"
+#include "B3ProcedureInlines.h"
+#include "B3PureCSE.h"
+#include "B3SlotBaseValue.h"
+#include "B3StackSlot.h"
+#include "B3UpsilonValue.h"
+#include "B3ValueKeyInlines.h"
+#include "B3ValueInlines.h"
+#include "B3Variable.h"
+#include "B3VariableValue.h"
+#include <wtf/GraphNodeWorklist.h>
+#include <wtf/HashMap.h>
+#include <wtf/IndexSet.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+// The goal of this phase is to:
+//
+// - Replace operations with less expensive variants. This includes constant folding and classic
+//   strength reductions like turning Mul(x, 1 << k) into Shl(x, k).
+//
+// - Reassociate constant operations. For example, Load(Add(x, c)) is turned into Load(x, offset = c)
+//   and Add(Add(x, c), d) is turned into Add(x, c + d).
+//
+// - Canonicalize operations. There are some cases where it's not at all obvious which kind of
+//   operation is less expensive, but it's useful for subsequent phases - particularly LowerToAir -
+//   to have only one way of representing things.
+//
+// This phase runs to fixpoint. Therefore, the canonicalizations must be designed to be monotonic.
+// For example, if we had a canonicalization that said that Add(x, -c) should be Sub(x, c) and
+// another canonicalization that said that Sub(x, d) should be Add(x, -d), then this phase would end
+// up running forever. We don't want that.
+//
+// Therefore, we need to prioritize certain canonical forms over others. Naively, we want strength
+// reduction to reduce the number of values, and so a form involving fewer total values is more
+// canonical. But we might break this, for example when reducing strength of Mul(x, 9). This could be
+// better written as Add(Shl(x, 3), x), which also happens to be representable using a single
+// instruction on x86.
+//
+// Here are some of the rules we have:
+//
+// Canonical form of logical not: BitXor(value, 1). We may have to avoid using this form if we don't
+// know for sure that 'value' is 0-or-1 (i.e. returnsBool). In that case we fall back on
+// Equal(value, 0).
+//
+// Canonical form of commutative operations: if the operation involves a constant, the constant must
+// come second. Add(x, constant) is canonical, while Add(constant, x) is not. If there are no
+// constants then the canonical form involves the lower-indexed value first. Given Add(x, y), it's
+// canonical if x->index() <= y->index().
+
+bool verbose = false;
+
+// FIXME: This IntRange stuff should be refactored into a general constant propagator. It's weird
+// that it's just sitting here in this file.
+class IntRange {
+public:
+    IntRange()
+    {
+    }
+
+    IntRange(int64_t min, int64_t max)
+        : m_min(min)
+        , m_max(max)
+    {
+    }
+
+    template<typename T>
+    static IntRange top()
+    {
+        return IntRange(std::numeric_limits<T>::min(), std::numeric_limits<T>::max());
+    }
+
+    static IntRange top(Type type)
+    {
+        switch (type) {
+        case Int32:
+            return top<int32_t>();
+        case Int64:
+            return top<int64_t>();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+    template<typename T>
+    static IntRange rangeForMask(T mask)
+    {
+        if (!(mask + 1))
+            return top<T>();
+        return IntRange(0, mask);
+    }
+
+    static IntRange rangeForMask(int64_t mask, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return rangeForMask<int32_t>(static_cast<int32_t>(mask));
+        case Int64:
+            return rangeForMask<int64_t>(mask);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+    template<typename T>
+    static IntRange rangeForZShr(int32_t shiftAmount)
+    {
+        typename std::make_unsigned<T>::type mask = 0;
+        mask--;
+        mask >>= shiftAmount;
+        return rangeForMask<T>(static_cast<T>(mask));
+    }
+
+    static IntRange rangeForZShr(int32_t shiftAmount, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return rangeForZShr<int32_t>(shiftAmount);
+        case Int64:
+            return rangeForZShr<int64_t>(shiftAmount);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+    int64_t min() const { return m_min; }
+    int64_t max() const { return m_max; }
+
+    void dump(PrintStream& out) const
+    {
+        out.print("[", m_min, ",", m_max, "]");
+    }
+
+    template<typename T>
+    bool couldOverflowAdd(const IntRange& other)
+    {
+        return sumOverflows<T>(m_min, other.m_min)
+            || sumOverflows<T>(m_min, other.m_max)
+            || sumOverflows<T>(m_max, other.m_min)
+            || sumOverflows<T>(m_max, other.m_max);
+    }
+
+    bool couldOverflowAdd(const IntRange& other, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return couldOverflowAdd<int32_t>(other);
+        case Int64:
+            return couldOverflowAdd<int64_t>(other);
+        default:
+            return true;
+        }
+    }
+
+    template<typename T>
+    bool couldOverflowSub(const IntRange& other)
+    {
+        return differenceOverflows<T>(m_min, other.m_min)
+            || differenceOverflows<T>(m_min, other.m_max)
+            || differenceOverflows<T>(m_max, other.m_min)
+            || differenceOverflows<T>(m_max, other.m_max);
+    }
+
+    bool couldOverflowSub(const IntRange& other, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return couldOverflowSub<int32_t>(other);
+        case Int64:
+            return couldOverflowSub<int64_t>(other);
+        default:
+            return true;
+        }
+    }
+
+    template<typename T>
+    bool couldOverflowMul(const IntRange& other)
+    {
+        return productOverflows<T>(m_min, other.m_min)
+            || productOverflows<T>(m_min, other.m_max)
+            || productOverflows<T>(m_max, other.m_min)
+            || productOverflows<T>(m_max, other.m_max);
+    }
+
+    bool couldOverflowMul(const IntRange& other, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return couldOverflowMul<int32_t>(other);
+        case Int64:
+            return couldOverflowMul<int64_t>(other);
+        default:
+            return true;
+        }
+    }
+
+    template<typename T>
+    IntRange shl(int32_t shiftAmount)
+    {
+        T newMin = static_cast<T>(m_min) << static_cast<T>(shiftAmount);
+        T newMax = static_cast<T>(m_max) << static_cast<T>(shiftAmount);
+
+        if ((newMin >> shiftAmount) != static_cast<T>(m_min))
+            newMin = std::numeric_limits<T>::min();
+        if ((newMax >> shiftAmount) != static_cast<T>(m_max))
+            newMax = std::numeric_limits<T>::max();
+
+        return IntRange(newMin, newMax);
+    }
+
+    IntRange shl(int32_t shiftAmount, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return shl<int32_t>(shiftAmount);
+        case Int64:
+            return shl<int64_t>(shiftAmount);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+    template<typename T>
+    IntRange sShr(int32_t shiftAmount)
+    {
+        T newMin = static_cast<T>(m_min) >> static_cast<T>(shiftAmount);
+        T newMax = static_cast<T>(m_max) >> static_cast<T>(shiftAmount);
+
+        return IntRange(newMin, newMax);
+    }
+
+    IntRange sShr(int32_t shiftAmount, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return sShr<int32_t>(shiftAmount);
+        case Int64:
+            return sShr<int64_t>(shiftAmount);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+    template<typename T>
+    IntRange zShr(int32_t shiftAmount)
+    {
+        // This is an awkward corner case for all of the other logic.
+        if (!shiftAmount)
+            return *this;
+
+        // If the input range may be negative, then all we can say about the output range is that it
+        // will be masked. That's because -1 right shifted just produces that mask.
+        if (m_min < 0)
+            return rangeForZShr<T>(shiftAmount);
+
+        // If the input range is non-negative, then this just brings the range closer to zero.
+        typedef typename std::make_unsigned<T>::type UnsignedT;
+        UnsignedT newMin = static_cast<UnsignedT>(m_min) >> static_cast<UnsignedT>(shiftAmount);
+        UnsignedT newMax = static_cast<UnsignedT>(m_max) >> static_cast<UnsignedT>(shiftAmount);
+        
+        return IntRange(newMin, newMax);
+    }
+
+    IntRange zShr(int32_t shiftAmount, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return zShr<int32_t>(shiftAmount);
+        case Int64:
+            return zShr<int64_t>(shiftAmount);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+    template<typename T>
+    IntRange add(const IntRange& other)
+    {
+        if (couldOverflowAdd<T>(other))
+            return top<T>();
+        return IntRange(m_min + other.m_min, m_max + other.m_max);
+    }
+
+    IntRange add(const IntRange& other, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return add<int32_t>(other);
+        case Int64:
+            return add<int64_t>(other);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+    template<typename T>
+    IntRange sub(const IntRange& other)
+    {
+        if (couldOverflowSub<T>(other))
+            return top<T>();
+        return IntRange(m_min - other.m_max, m_max - other.m_min);
+    }
+
+    IntRange sub(const IntRange& other, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return sub<int32_t>(other);
+        case Int64:
+            return sub<int64_t>(other);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+    template<typename T>
+    IntRange mul(const IntRange& other)
+    {
+        if (couldOverflowMul<T>(other))
+            return top<T>();
+        return IntRange(
+            std::min(
+                std::min(m_min * other.m_min, m_min * other.m_max),
+                std::min(m_max * other.m_min, m_max * other.m_max)),
+            std::max(
+                std::max(m_min * other.m_min, m_min * other.m_max),
+                std::max(m_max * other.m_min, m_max * other.m_max)));
+    }
+
+    IntRange mul(const IntRange& other, Type type)
+    {
+        switch (type) {
+        case Int32:
+            return mul<int32_t>(other);
+        case Int64:
+            return mul<int64_t>(other);
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return IntRange();
+        }
+    }
+
+private:
+    int64_t m_min { 0 };
+    int64_t m_max { 0 };
+};
+
+class ReduceStrength {
+public:
+    ReduceStrength(Procedure& proc)
+        : m_proc(proc)
+        , m_insertionSet(proc)
+        , m_blockInsertionSet(proc)
+    {
+    }
+
+    bool run()
+    {
+        bool result = false;
+        bool first = true;
+        unsigned index = 0;
+        do {
+            m_changed = false;
+            m_changedCFG = false;
+            ++index;
+
+            if (first)
+                first = false;
+            else if (verbose) {
+                dataLog("B3 after iteration #", index - 1, " of reduceStrength:\n");
+                dataLog(m_proc);
+            }
+            
+            simplifyCFG();
+
+            if (m_changedCFG) {
+                m_proc.resetReachability();
+                m_proc.invalidateCFG();
+                m_changed = true;
+            }
+
+            // We definitely want to do DCE before we do CSE so that we don't hoist things. For
+            // example:
+            //
+            // @dead = Mul(@a, @b)
+            // ... lots of control flow and stuff
+            // @thing = Mul(@a, @b)
+            //
+            // If we do CSE before DCE, we will remove @thing and keep @dead. Effectively, we will
+            // "hoist" @thing. On the other hand, if we run DCE before CSE, we will kill @dead and
+            // keep @thing. That's better, since we usually want things to stay wherever the client
+            // put them. We're not actually smart enough to move things around at random.
+            killDeadCode();
+            
+            simplifySSA();
+            
+            m_proc.resetValueOwners();
+            m_dominators = &m_proc.dominators(); // Recompute if necessary.
+            m_pureCSE.clear();
+
+            for (BasicBlock* block : m_proc.blocksInPreOrder()) {
+                m_block = block;
+                
+                for (m_index = 0; m_index < block->size(); ++m_index) {
+                    if (verbose) {
+                        dataLog(
+                            "Looking at ", *block, " #", m_index, ": ",
+                            deepDump(m_proc, block->at(m_index)), "\n");
+                    }
+                    m_value = m_block->at(m_index);
+                    m_value->performSubstitution();
+                    
+                    reduceValueStrength();
+                    replaceIfRedundant();
+                }
+                m_insertionSet.execute(m_block);
+            }
+
+            m_changedCFG |= m_blockInsertionSet.execute();
+            if (m_changedCFG) {
+                m_proc.resetReachability();
+                m_proc.invalidateCFG();
+                m_dominators = nullptr; // Dominators are not valid anymore, and we don't need them yet.
+                m_changed = true;
+            }
+            
+            result |= m_changed;
+        } while (m_changed);
+        return result;
+    }
+    
+private:
+    void reduceValueStrength()
+    {
+        switch (m_value->opcode()) {
+        case Add:
+            handleCommutativity();
+            
+            if (m_value->child(0)->opcode() == Add && isInt(m_value->type())) {
+                // Turn this: Add(Add(value, constant1), constant2)
+                // Into this: Add(value, constant1 + constant2)
+                Value* newSum = m_value->child(1)->addConstant(m_proc, m_value->child(0)->child(1));
+                if (newSum) {
+                    m_insertionSet.insertValue(m_index, newSum);
+                    m_value->child(0) = m_value->child(0)->child(0);
+                    m_value->child(1) = newSum;
+                    m_changed = true;
+                    break;
+                }
+                
+                // Turn this: Add(Add(value, constant), otherValue)
+                // Into this: Add(Add(value, otherValue), constant)
+                if (!m_value->child(1)->hasInt() && m_value->child(0)->child(1)->hasInt()) {
+                    Value* value = m_value->child(0)->child(0);
+                    Value* constant = m_value->child(0)->child(1);
+                    Value* otherValue = m_value->child(1);
+                    // This could create duplicate code if Add(value, constant) is used elsewhere.
+                    // However, we already model adding a constant as if it was free in other places
+                    // so let's just roll with it. The alternative would mean having to do good use
+                    // counts, which reduceStrength() currently doesn't have.
+                    m_value->child(0) =
+                        m_insertionSet.insert<Value>(
+                            m_index, Add, m_value->origin(), value, otherValue);
+                    m_value->child(1) = constant;
+                    m_changed = true;
+                    break;
+                }
+            }
+            
+            // Turn this: Add(otherValue, Add(value, constant))
+            // Into this: Add(Add(value, otherValue), constant)
+            if (isInt(m_value->type())
+                && !m_value->child(0)->hasInt()
+                && m_value->child(1)->opcode() == Add
+                && m_value->child(1)->child(1)->hasInt()) {
+                Value* value = m_value->child(1)->child(0);
+                Value* constant = m_value->child(1)->child(1);
+                Value* otherValue = m_value->child(0);
+                // This creates a duplicate add. That's dangerous but probably fine, see above.
+                m_value->child(0) =
+                    m_insertionSet.insert<Value>(
+                        m_index, Add, m_value->origin(), value, otherValue);
+                m_value->child(1) = constant;
+                m_changed = true;
+                break;
+            }
+            
+            // Turn this: Add(constant1, constant2)
+            // Into this: constant1 + constant2
+            if (Value* constantAdd = m_value->child(0)->addConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constantAdd);
+                break;
+            }
+
+            // Turn this: Integer Add(value, value)
+            // Into this: Shl(value, 1)
+            // This is a useful canonicalization. It's not meant to be a strength reduction.
+            if (m_value->isInteger() && m_value->child(0) == m_value->child(1)) {
+                replaceWithNewValue(
+                    m_proc.add<Value>(
+                        Shl, m_value->origin(), m_value->child(0),
+                        m_insertionSet.insert<Const32Value>(m_index, m_value->origin(), 1)));
+                break;
+            }
+
+            // Turn this: Add(value, zero)
+            // Into an Identity.
+            //
+            // Addition is subtle with doubles. Zero is not the neutral value, negative zero is:
+            //    0 + 0 = 0
+            //    0 + -0 = 0
+            //    -0 + 0 = 0
+            //    -0 + -0 = -0
+            if (m_value->child(1)->isInt(0) || m_value->child(1)->isNegativeZero()) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            // Turn this: Integer Add(Sub(0, value), -1)
+            // Into this: BitXor(value, -1)
+            if (m_value->isInteger()
+                && m_value->child(0)->opcode() == Sub
+                && m_value->child(1)->isInt(-1)
+                && m_value->child(0)->child(0)->isInt(0)) {
+                replaceWithNewValue(m_proc.add<Value>(BitXor, m_value->origin(), m_value->child(0)->child(1), m_value->child(1)));
+                break;
+            }
+
+            break;
+
+        case Sub:
+            // Turn this: Sub(constant1, constant2)
+            // Into this: constant1 - constant2
+            if (Value* constantSub = m_value->child(0)->subConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constantSub);
+                break;
+            }
+
+            if (isInt(m_value->type())) {
+                // Turn this: Sub(value, constant)
+                // Into this: Add(value, -constant)
+                if (Value* negatedConstant = m_value->child(1)->negConstant(m_proc)) {
+                    m_insertionSet.insertValue(m_index, negatedConstant);
+                    replaceWithNew<Value>(
+                        Add, m_value->origin(), m_value->child(0), negatedConstant);
+                    break;
+                }
+                
+                // Turn this: Sub(0, value)
+                // Into this: Neg(value)
+                if (m_value->child(0)->isInt(0)) {
+                    replaceWithNew<Value>(Neg, m_value->origin(), m_value->child(1));
+                    break;
+                }
+            }
+
+            break;
+
+        case Neg:
+            // Turn this: Neg(constant)
+            // Into this: -constant
+            if (Value* constant = m_value->child(0)->negConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+            
+            // Turn this: Neg(Neg(value))
+            // Into this: value
+            if (m_value->child(0)->opcode() == Neg) {
+                replaceWithIdentity(m_value->child(0)->child(0));
+                break;
+            }
+            
+            break;
+
+        case Mul:
+            handleCommutativity();
+
+            // Turn this: Mul(constant1, constant2)
+            // Into this: constant1 * constant2
+            if (Value* value = m_value->child(0)->mulConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(value);
+                break;
+            }
+
+            if (m_value->child(1)->hasInt()) {
+                int64_t factor = m_value->child(1)->asInt();
+
+                // Turn this: Mul(value, 0)
+                // Into this: 0
+                // Note that we don't do this for doubles because that's wrong. For example, -1 * 0
+                // and 1 * 0 yield different results.
+                if (!factor) {
+                    replaceWithIdentity(m_value->child(1));
+                    break;
+                }
+
+                // Turn this: Mul(value, 1)
+                // Into this: value
+                if (factor == 1) {
+                    replaceWithIdentity(m_value->child(0));
+                    break;
+                }
+
+                // Turn this: Mul(value, -1)
+                // Into this: Sub(0, value)
+                if (factor == -1) {
+                    replaceWithNewValue(
+                        m_proc.add<Value>(
+                            Sub, m_value->origin(),
+                            m_insertionSet.insertIntConstant(m_index, m_value, 0),
+                            m_value->child(0)));
+                    break;
+                }
+                
+                // Turn this: Mul(value, constant)
+                // Into this: Shl(value, log2(constant))
+                if (hasOneBitSet(factor)) {
+                    unsigned shiftAmount = WTF::fastLog2(static_cast<uint64_t>(factor));
+                    replaceWithNewValue(
+                        m_proc.add<Value>(
+                            Shl, m_value->origin(), m_value->child(0),
+                            m_insertionSet.insert<Const32Value>(
+                                m_index, m_value->origin(), shiftAmount)));
+                    break;
+                }
+            } else if (m_value->child(1)->hasDouble()) {
+                double factor = m_value->child(1)->asDouble();
+
+                // Turn this: Mul(value, 1)
+                // Into this: value
+                if (factor == 1) {
+                    replaceWithIdentity(m_value->child(0));
+                    break;
+                }
+            }
+
+            break;
+
+        case Div:
+            // Turn this: Div(constant1, constant2)
+            // Into this: constant1 / constant2
+            // Note that this uses Div<Chill> semantics. That's fine, because the rules for Div
+            // are strictly weaker: it has corner cases where it's allowed to do anything it
+            // likes.
+            if (replaceWithNewValue(m_value->child(0)->divConstant(m_proc, m_value->child(1))))
+                break;
+
+            if (m_value->child(1)->hasInt()) {
+                switch (m_value->child(1)->asInt()) {
+                case -1:
+                    // Turn this: Div(value, -1)
+                    // Into this: Neg(value)
+                    replaceWithNewValue(
+                        m_proc.add<Value>(Neg, m_value->origin(), m_value->child(0)));
+                    break;
+
+                case 0:
+                    // Turn this: Div(value, 0)
+                    // Into this: 0
+                    // We can do this because it's precisely correct for ChillDiv and for Div we
+                    // are allowed to do whatever we want.
+                    replaceWithIdentity(m_value->child(1));
+                    break;
+
+                case 1:
+                    // Turn this: Div(value, 1)
+                    // Into this: value
+                    replaceWithIdentity(m_value->child(0));
+                    break;
+
+                default:
+                    // Perform super comprehensive strength reduction of division. Currently we
+                    // only do this for 32-bit divisions, since we need a high multiply
+                    // operation. We emulate it using 64-bit multiply. We can't emulate 64-bit
+                    // high multiply with a 128-bit multiply because we don't have a 128-bit
+                    // multiply. We could do it with a patchpoint if we cared badly enough.
+
+                    if (m_value->type() != Int32)
+                        break;
+
+                    int32_t divisor = m_value->child(1)->asInt32();
+                    DivisionMagic<int32_t> magic = computeDivisionMagic(divisor);
+
+                    // Perform the "high" multiplication. We do it just to get the high bits.
+                    // This is sort of like multiplying by the reciprocal, just more gnarly. It's
+                    // from Hacker's Delight and I don't claim to understand it.
+                    Value* magicQuotient = m_insertionSet.insert<Value>(
+                        m_index, Trunc, m_value->origin(),
+                        m_insertionSet.insert<Value>(
+                            m_index, ZShr, m_value->origin(),
+                            m_insertionSet.insert<Value>(
+                                m_index, Mul, m_value->origin(),
+                                m_insertionSet.insert<Value>(
+                                    m_index, SExt32, m_value->origin(), m_value->child(0)),
+                                m_insertionSet.insert<Const64Value>(
+                                    m_index, m_value->origin(), magic.magicMultiplier)),
+                            m_insertionSet.insert<Const32Value>(
+                                m_index, m_value->origin(), 32)));
+
+                    if (divisor > 0 && magic.magicMultiplier < 0) {
+                        magicQuotient = m_insertionSet.insert<Value>(
+                            m_index, Add, m_value->origin(), magicQuotient, m_value->child(0));
+                    }
+                    if (divisor < 0 && magic.magicMultiplier > 0) {
+                        magicQuotient = m_insertionSet.insert<Value>(
+                            m_index, Sub, m_value->origin(), magicQuotient, m_value->child(0));
+                    }
+                    if (magic.shift > 0) {
+                        magicQuotient = m_insertionSet.insert<Value>(
+                            m_index, SShr, m_value->origin(), magicQuotient,
+                            m_insertionSet.insert<Const32Value>(
+                                m_index, m_value->origin(), magic.shift));
+                    }
+                    replaceWithIdentity(
+                        m_insertionSet.insert<Value>(
+                            m_index, Add, m_value->origin(), magicQuotient,
+                            m_insertionSet.insert<Value>(
+                                m_index, ZShr, m_value->origin(), magicQuotient,
+                                m_insertionSet.insert<Const32Value>(
+                                    m_index, m_value->origin(), 31))));
+                    break;
+                }
+                break;
+            }
+            break;
+
+        case UDiv:
+            // Turn this: UDiv(constant1, constant2)
+            // Into this: constant1 / constant2
+            if (replaceWithNewValue(m_value->child(0)->uDivConstant(m_proc, m_value->child(1))))
+                break;
+
+            if (m_value->child(1)->hasInt()) {
+                switch (m_value->child(1)->asInt()) {
+                case 0:
+                    // Turn this: UDiv(value, 0)
+                    // Into this: 0
+                    // We can do whatever we want here so we might as well do the chill thing,
+                    // in case we add chill versions of UDiv in the future.
+                    replaceWithIdentity(m_value->child(1));
+                    break;
+
+                case 1:
+                    // Turn this: UDiv(value, 1)
+                    // Into this: value
+                    replaceWithIdentity(m_value->child(0));
+                    break;
+                default:
+                    // FIXME: We should do comprehensive strength reduction for unsigned numbers. Likely,
+                    // we will just want copy what llvm does. https://bugs.webkit.org/show_bug.cgi?id=164809
+                    break;
+                }
+            }
+            break;
+
+        case Mod:
+            // Turn this: Mod(constant1, constant2)
+            // Into this: constant1 / constant2
+            // Note that this uses Mod<Chill> semantics.
+            if (replaceWithNewValue(m_value->child(0)->modConstant(m_proc, m_value->child(1))))
+                break;
+
+            // Modulo by constant is more efficient if we turn it into Div, and then let Div get
+            // optimized.
+            if (m_value->child(1)->hasInt()) {
+                switch (m_value->child(1)->asInt()) {
+                case 0:
+                    // Turn this: Mod(value, 0)
+                    // Into this: 0
+                    // This is correct according to ChillMod semantics.
+                    replaceWithIdentity(m_value->child(1));
+                    break;
+
+                default:
+                    // Turn this: Mod(N, D)
+                    // Into this: Sub(N, Mul(Div(N, D), D))
+                    //
+                    // This is a speed-up because we use our existing Div optimizations.
+                    //
+                    // Here's an easier way to look at it:
+                    //     N % D = N - N / D * D
+                    //
+                    // Note that this does not work for D = 0 and ChillMod. The expected result is 0.
+                    // That's why we have a special-case above.
+                    //     X % 0 = X - X / 0 * 0 = X     (should be 0)
+                    //
+                    // This does work for the D = -1 special case.
+                    //     -2^31 % -1 = -2^31 - -2^31 / -1 * -1
+                    //                = -2^31 - -2^31 * -1
+                    //                = -2^31 - -2^31
+                    //                = 0
+
+                    Kind divKind = Div;
+                    divKind.setIsChill(m_value->isChill());
+
+                    replaceWithIdentity(
+                        m_insertionSet.insert<Value>(
+                            m_index, Sub, m_value->origin(),
+                            m_value->child(0),
+                            m_insertionSet.insert<Value>(
+                                m_index, Mul, m_value->origin(),
+                                m_insertionSet.insert<Value>(
+                                    m_index, divKind, m_value->origin(),
+                                    m_value->child(0), m_value->child(1)),
+                                m_value->child(1))));
+                    break;
+                }
+                break;
+            }
+            
+            break;
+
+        case UMod:
+            // Turn this: UMod(constant1, constant2)
+            // Into this: constant1 / constant2
+            replaceWithNewValue(m_value->child(0)->uModConstant(m_proc, m_value->child(1)));
+            // FIXME: We should do what we do for Mod since the same principle applies here.
+            // https://bugs.webkit.org/show_bug.cgi?id=164809
+            break;
+
+        case BitAnd:
+            handleCommutativity();
+
+            // Turn this: BitAnd(constant1, constant2)
+            // Into this: constant1 & constant2
+            if (Value* constantBitAnd = m_value->child(0)->bitAndConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constantBitAnd);
+                break;
+            }
+
+            // Turn this: BitAnd(BitAnd(value, constant1), constant2)
+            // Into this: BitAnd(value, constant1 & constant2).
+            if (m_value->child(0)->opcode() == BitAnd) {
+                Value* newConstant = m_value->child(1)->bitAndConstant(m_proc, m_value->child(0)->child(1));
+                if (newConstant) {
+                    m_insertionSet.insertValue(m_index, newConstant);
+                    m_value->child(0) = m_value->child(0)->child(0);
+                    m_value->child(1) = newConstant;
+                    m_changed = true;
+                }
+            }
+
+            // Turn this: BitAnd(valueX, valueX)
+            // Into this: valueX.
+            if (m_value->child(0) == m_value->child(1)) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            // Turn this: BitAnd(value, zero-constant)
+            // Into this: zero-constant.
+            if (m_value->child(1)->isInt(0)) {
+                replaceWithIdentity(m_value->child(1));
+                break;
+            }
+
+            // Turn this: BitAnd(value, all-ones)
+            // Into this: value.
+            if ((m_value->type() == Int64 && m_value->child(1)->isInt(0xffffffffffffffff))
+                || (m_value->type() == Int32 && m_value->child(1)->isInt(0xffffffff))) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            // Turn this: BitAnd(64-bit value, 32 ones)
+            // Into this: ZExt32(Trunc(64-bit value))
+            if (m_value->child(1)->isInt64(0xffffffffllu)) {
+                Value* newValue = m_insertionSet.insert<Value>(
+                    m_index, ZExt32, m_value->origin(),
+                    m_insertionSet.insert<Value>(m_index, Trunc, m_value->origin(), m_value->child(0)));
+                replaceWithIdentity(newValue);
+                break;
+            }
+
+            // Turn this: BitAnd(SExt8(value), mask) where (mask & 0xffffff00) == 0
+            // Into this: BitAnd(value, mask)
+            if (m_value->child(0)->opcode() == SExt8 && m_value->child(1)->hasInt32()
+                && !(m_value->child(1)->asInt32() & 0xffffff00)) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                m_changed = true;
+            }
+
+            // Turn this: BitAnd(SExt16(value), mask) where (mask & 0xffff0000) == 0
+            // Into this: BitAnd(value, mask)
+            if (m_value->child(0)->opcode() == SExt16 && m_value->child(1)->hasInt32()
+                && !(m_value->child(1)->asInt32() & 0xffff0000)) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                m_changed = true;
+            }
+
+            // Turn this: BitAnd(SExt32(value), mask) where (mask & 0xffffffff00000000) == 0
+            // Into this: BitAnd(ZExt32(value), mask)
+            if (m_value->child(0)->opcode() == SExt32 && m_value->child(1)->hasInt32()
+                && !(m_value->child(1)->asInt32() & 0xffffffff00000000llu)) {
+                m_value->child(0) = m_insertionSet.insert<Value>(
+                    m_index, ZExt32, m_value->origin(),
+                    m_value->child(0)->child(0), m_value->child(0)->child(1));
+                m_changed = true;
+            }
+
+            // Turn this: BitAnd(Op(value, constant1), constant2)
+            //     where !(constant1 & constant2)
+            //       and Op is BitOr or BitXor
+            // into this: BitAnd(value, constant2)
+            if (m_value->child(1)->hasInt()) {
+                int64_t constant2 = m_value->child(1)->asInt();
+                switch (m_value->child(0)->opcode()) {
+                case BitOr:
+                case BitXor:
+                    if (m_value->child(0)->child(1)->hasInt()
+                        && !(m_value->child(0)->child(1)->asInt() & constant2)) {
+                        m_value->child(0) = m_value->child(0)->child(0);
+                        m_changed = true;
+                        break;
+                    }
+                    break;
+                default:
+                    break;
+                }
+            }
+            break;
+
+        case BitOr:
+            handleCommutativity();
+
+            // Turn this: BitOr(constant1, constant2)
+            // Into this: constant1 | constant2
+            if (Value* constantBitOr = m_value->child(0)->bitOrConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constantBitOr);
+                break;
+            }
+
+            // Turn this: BitOr(BitOr(value, constant1), constant2)
+            // Into this: BitOr(value, constant1 & constant2).
+            if (m_value->child(0)->opcode() == BitOr) {
+                Value* newConstant = m_value->child(1)->bitOrConstant(m_proc, m_value->child(0)->child(1));
+                if (newConstant) {
+                    m_insertionSet.insertValue(m_index, newConstant);
+                    m_value->child(0) = m_value->child(0)->child(0);
+                    m_value->child(1) = newConstant;
+                    m_changed = true;
+                }
+            }
+
+            // Turn this: BitOr(valueX, valueX)
+            // Into this: valueX.
+            if (m_value->child(0) == m_value->child(1)) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            // Turn this: BitOr(value, zero-constant)
+            // Into this: value.
+            if (m_value->child(1)->isInt(0)) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            // Turn this: BitOr(value, all-ones)
+            // Into this: all-ones.
+            if ((m_value->type() == Int64 && m_value->child(1)->isInt(0xffffffffffffffff))
+                || (m_value->type() == Int32 && m_value->child(1)->isInt(0xffffffff))) {
+                replaceWithIdentity(m_value->child(1));
+                break;
+            }
+
+            break;
+
+        case BitXor:
+            handleCommutativity();
+
+            // Turn this: BitXor(constant1, constant2)
+            // Into this: constant1 ^ constant2
+            if (Value* constantBitXor = m_value->child(0)->bitXorConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constantBitXor);
+                break;
+            }
+
+            // Turn this: BitXor(BitXor(value, constant1), constant2)
+            // Into this: BitXor(value, constant1 ^ constant2).
+            if (m_value->child(0)->opcode() == BitXor) {
+                Value* newConstant = m_value->child(1)->bitXorConstant(m_proc, m_value->child(0)->child(1));
+                if (newConstant) {
+                    m_insertionSet.insertValue(m_index, newConstant);
+                    m_value->child(0) = m_value->child(0)->child(0);
+                    m_value->child(1) = newConstant;
+                    m_changed = true;
+                }
+            }
+
+            // Turn this: BitXor(compare, 1)
+            // Into this: invertedCompare
+            if (m_value->child(1)->isInt32(1)) {
+                if (Value* invertedCompare = m_value->child(0)->invertedCompare(m_proc)) {
+                    replaceWithNewValue(invertedCompare);
+                    break;
+                }
+            }
+
+            // Turn this: BitXor(valueX, valueX)
+            // Into this: zero-constant.
+            if (m_value->child(0) == m_value->child(1)) {
+                replaceWithNewValue(m_proc.addIntConstant(m_value, 0));
+                break;
+            }
+
+            // Turn this: BitXor(value, zero-constant)
+            // Into this: value.
+            if (m_value->child(1)->isInt(0)) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            break;
+
+        case Shl:
+            // Turn this: Shl(constant1, constant2)
+            // Into this: constant1 << constant2
+            if (Value* constant = m_value->child(0)->shlConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            handleShiftAmount();
+            break;
+
+        case SShr:
+            // Turn this: SShr(constant1, constant2)
+            // Into this: constant1 >> constant2
+            if (Value* constant = m_value->child(0)->sShrConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            if (m_value->child(1)->hasInt32()
+                && m_value->child(0)->opcode() == Shl
+                && m_value->child(0)->child(1)->hasInt32()
+                && m_value->child(1)->asInt32() == m_value->child(0)->child(1)->asInt32()) {
+                switch (m_value->child(1)->asInt32()) {
+                case 16:
+                    if (m_value->type() == Int32) {
+                        // Turn this: SShr(Shl(value, 16), 16)
+                        // Into this: SExt16(value)
+                        replaceWithNewValue(
+                            m_proc.add<Value>(
+                                SExt16, m_value->origin(), m_value->child(0)->child(0)));
+                    }
+                    break;
+
+                case 24:
+                    if (m_value->type() == Int32) {
+                        // Turn this: SShr(Shl(value, 24), 24)
+                        // Into this: SExt8(value)
+                        replaceWithNewValue(
+                            m_proc.add<Value>(
+                                SExt8, m_value->origin(), m_value->child(0)->child(0)));
+                    }
+                    break;
+
+                case 32:
+                    if (m_value->type() == Int64) {
+                        // Turn this: SShr(Shl(value, 32), 32)
+                        // Into this: SExt32(Trunc(value))
+                        replaceWithNewValue(
+                            m_proc.add<Value>(
+                                SExt32, m_value->origin(),
+                                m_insertionSet.insert<Value>(
+                                    m_index, Trunc, m_value->origin(),
+                                    m_value->child(0)->child(0))));
+                    }
+                    break;
+
+                // FIXME: Add cases for 48 and 56, but that would translate to SExt32(SExt8) or
+                // SExt32(SExt16), which we don't currently lower efficiently.
+
+                default:
+                    break;
+                }
+
+                if (m_value->opcode() != SShr)
+                    break;
+            }
+
+            handleShiftAmount();
+            break;
+
+        case ZShr:
+            // Turn this: ZShr(constant1, constant2)
+            // Into this: (unsigned)constant1 >> constant2
+            if (Value* constant = m_value->child(0)->zShrConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            handleShiftAmount();
+            break;
+
+        case RotR:
+            // Turn this: RotR(constant1, constant2)
+            // Into this: (constant1 >> constant2) | (constant1 << sizeof(constant1) * 8 - constant2)
+            if (Value* constant = m_value->child(0)->rotRConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            handleShiftAmount();
+            break;
+
+        case RotL:
+            // Turn this: RotL(constant1, constant2)
+            // Into this: (constant1 << constant2) | (constant1 >> sizeof(constant1) * 8 - constant2)
+            if (Value* constant = m_value->child(0)->rotLConstant(m_proc, m_value->child(1))) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            handleShiftAmount();
+            break;
+
+        case Abs:
+            // Turn this: Abs(constant)
+            // Into this: fabs<value->type()>(constant)
+            if (Value* constant = m_value->child(0)->absConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            // Turn this: Abs(Abs(value))
+            // Into this: Abs(value)
+            if (m_value->child(0)->opcode() == Abs) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            // Turn this: Abs(BitwiseCast(value))
+            // Into this: BitwiseCast(And(value, mask-top-bit))
+            if (m_value->child(0)->opcode() == BitwiseCast) {
+                Value* mask;
+                if (m_value->type() == Double)
+                    mask = m_insertionSet.insert<Const64Value>(m_index, m_value->origin(), ~(1ll << 63));
+                else
+                    mask = m_insertionSet.insert<Const32Value>(m_index, m_value->origin(), ~(1l << 31));
+
+                Value* bitAnd = m_insertionSet.insert<Value>(m_index, BitAnd, m_value->origin(),
+                    m_value->child(0)->child(0),
+                    mask);
+                Value* cast = m_insertionSet.insert<Value>(m_index, BitwiseCast, m_value->origin(), bitAnd);
+                replaceWithIdentity(cast);
+                break;
+            }
+            break;
+
+        case Ceil:
+            // Turn this: Ceil(constant)
+            // Into this: ceil<value->type()>(constant)
+            if (Value* constant = m_value->child(0)->ceilConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            // Turn this: Ceil(roundedValue)
+            // Into this: roundedValue
+            if (m_value->child(0)->isRounded()) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+            break;
+
+        case Floor:
+            // Turn this: Floor(constant)
+            // Into this: floor<value->type()>(constant)
+            if (Value* constant = m_value->child(0)->floorConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            // Turn this: Floor(roundedValue)
+            // Into this: roundedValue
+            if (m_value->child(0)->isRounded()) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+            break;
+
+        case Sqrt:
+            // Turn this: Sqrt(constant)
+            // Into this: sqrt<value->type()>(constant)
+            if (Value* constant = m_value->child(0)->sqrtConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+            break;
+
+        case BitwiseCast:
+            // Turn this: BitwiseCast(constant)
+            // Into this: bitwise_cast<value->type()>(constant)
+            if (Value* constant = m_value->child(0)->bitwiseCastConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+
+            // Turn this: BitwiseCast(BitwiseCast(value))
+            // Into this: value
+            if (m_value->child(0)->opcode() == BitwiseCast) {
+                replaceWithIdentity(m_value->child(0)->child(0));
+                break;
+            }
+            break;
+
+        case SExt8:
+            // Turn this: SExt8(constant)
+            // Into this: static_cast<int8_t>(constant)
+            if (m_value->child(0)->hasInt32()) {
+                int32_t result = static_cast<int8_t>(m_value->child(0)->asInt32());
+                replaceWithNewValue(m_proc.addIntConstant(m_value, result));
+                break;
+            }
+
+            // Turn this: SExt8(SExt8(value))
+            //   or this: SExt8(SExt16(value))
+            // Into this: SExt8(value)
+            if (m_value->child(0)->opcode() == SExt8 || m_value->child(0)->opcode() == SExt16) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                m_changed = true;
+            }
+
+            if (m_value->child(0)->opcode() == BitAnd && m_value->child(0)->child(1)->hasInt32()) {
+                Value* input = m_value->child(0)->child(0);
+                int32_t mask = m_value->child(0)->child(1)->asInt32();
+                
+                // Turn this: SExt8(BitAnd(input, mask)) where (mask & 0xff) == 0xff
+                // Into this: SExt8(input)
+                if ((mask & 0xff) == 0xff) {
+                    m_value->child(0) = input;
+                    m_changed = true;
+                    break;
+                }
+                
+                // Turn this: SExt8(BitAnd(input, mask)) where (mask & 0x80) == 0
+                // Into this: BitAnd(input, const & 0x7f)
+                if (!(mask & 0x80)) {
+                    replaceWithNewValue(
+                        m_proc.add<Value>(
+                            BitAnd, m_value->origin(), input,
+                            m_insertionSet.insert<Const32Value>(
+                                m_index, m_value->origin(), mask & 0x7f)));
+                    break;
+                }
+            }
+            break;
+
+        case SExt16:
+            // Turn this: SExt16(constant)
+            // Into this: static_cast<int16_t>(constant)
+            if (m_value->child(0)->hasInt32()) {
+                int32_t result = static_cast<int16_t>(m_value->child(0)->asInt32());
+                replaceWithNewValue(m_proc.addIntConstant(m_value, result));
+                break;
+            }
+
+            // Turn this: SExt16(SExt16(value))
+            // Into this: SExt16(value)
+            if (m_value->child(0)->opcode() == SExt16) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                m_changed = true;
+            }
+
+            // Turn this: SExt16(SExt8(value))
+            // Into this: SExt8(value)
+            if (m_value->child(0)->opcode() == SExt8) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            if (m_value->child(0)->opcode() == BitAnd && m_value->child(0)->child(1)->hasInt32()) {
+                Value* input = m_value->child(0)->child(0);
+                int32_t mask = m_value->child(0)->child(1)->asInt32();
+                
+                // Turn this: SExt16(BitAnd(input, mask)) where (mask & 0xffff) == 0xffff
+                // Into this: SExt16(input)
+                if ((mask & 0xffff) == 0xffff) {
+                    m_value->child(0) = input;
+                    m_changed = true;
+                    break;
+                }
+                
+                // Turn this: SExt16(BitAnd(input, mask)) where (mask & 0x8000) == 0
+                // Into this: BitAnd(input, const & 0x7fff)
+                if (!(mask & 0x8000)) {
+                    replaceWithNewValue(
+                        m_proc.add<Value>(
+                            BitAnd, m_value->origin(), input,
+                            m_insertionSet.insert<Const32Value>(
+                                m_index, m_value->origin(), mask & 0x7fff)));
+                    break;
+                }
+            }
+            break;
+
+        case SExt32:
+            // Turn this: SExt32(constant)
+            // Into this: static_cast<int64_t>(constant)
+            if (m_value->child(0)->hasInt32()) {
+                replaceWithNewValue(m_proc.addIntConstant(m_value, m_value->child(0)->asInt32()));
+                break;
+            }
+
+            // Turn this: SExt32(BitAnd(input, mask)) where (mask & 0x80000000) == 0
+            // Into this: ZExt32(BitAnd(input, mask))
+            if (m_value->child(0)->opcode() == BitAnd && m_value->child(0)->child(1)->hasInt32()
+                && !(m_value->child(0)->child(1)->asInt32() & 0x80000000)) {
+                replaceWithNewValue(
+                    m_proc.add<Value>(
+                        ZExt32, m_value->origin(), m_value->child(0)));
+                break;
+            }
+            break;
+
+        case ZExt32:
+            // Turn this: ZExt32(constant)
+            // Into this: static_cast<uint64_t>(static_cast<uint32_t>(constant))
+            if (m_value->child(0)->hasInt32()) {
+                replaceWithNewValue(
+                    m_proc.addIntConstant(
+                        m_value,
+                        static_cast<uint64_t>(static_cast<uint32_t>(m_value->child(0)->asInt32()))));
+                break;
+            }
+            break;
+
+        case Trunc:
+            // Turn this: Trunc(constant)
+            // Into this: static_cast<int32_t>(constant)
+            if (m_value->child(0)->hasInt64() || m_value->child(0)->hasDouble()) {
+                replaceWithNewValue(
+                    m_proc.addIntConstant(m_value, static_cast<int32_t>(m_value->child(0)->asInt64())));
+                break;
+            }
+
+            // Turn this: Trunc(SExt32(value)) or Trunc(ZExt32(value))
+            // Into this: value
+            if (m_value->child(0)->opcode() == SExt32 || m_value->child(0)->opcode() == ZExt32) {
+                replaceWithIdentity(m_value->child(0)->child(0));
+                break;
+            }
+
+            // Turn this: Trunc(Op(value, constant))
+            //     where !(constant & 0xffffffff)
+            //       and Op is Add, Sub, BitOr, or BitXor
+            // into this: Trunc(value)
+            switch (m_value->child(0)->opcode()) {
+            case Add:
+            case Sub:
+            case BitOr:
+            case BitXor:
+                if (m_value->child(0)->child(1)->hasInt64()
+                    && !(m_value->child(0)->child(1)->asInt64() & 0xffffffffll)) {
+                    m_value->child(0) = m_value->child(0)->child(0);
+                    m_changed = true;
+                    break;
+                }
+                break;
+            default:
+                break;
+            }
+            break;
+
+        case IToD:
+            // Turn this: IToD(constant)
+            // Into this: ConstDouble(constant)
+            if (Value* constant = m_value->child(0)->iToDConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+            break;
+
+        case IToF:
+            // Turn this: IToF(constant)
+            // Into this: ConstFloat(constant)
+            if (Value* constant = m_value->child(0)->iToFConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+            break;
+
+        case FloatToDouble:
+            // Turn this: FloatToDouble(constant)
+            // Into this: ConstDouble(constant)
+            if (Value* constant = m_value->child(0)->floatToDoubleConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+            break;
+
+        case DoubleToFloat:
+            // Turn this: DoubleToFloat(FloatToDouble(value))
+            // Into this: value
+            if (m_value->child(0)->opcode() == FloatToDouble) {
+                replaceWithIdentity(m_value->child(0)->child(0));
+                break;
+            }
+
+            // Turn this: DoubleToFloat(constant)
+            // Into this: ConstFloat(constant)
+            if (Value* constant = m_value->child(0)->doubleToFloatConstant(m_proc)) {
+                replaceWithNewValue(constant);
+                break;
+            }
+            break;
+
+        case Select:
+            // Turn this: Select(constant, a, b)
+            // Into this: constant ? a : b
+            if (m_value->child(0)->hasInt32()) {
+                replaceWithIdentity(
+                    m_value->child(0)->asInt32() ? m_value->child(1) : m_value->child(2));
+                break;
+            }
+
+            // Turn this: Select(Equal(x, 0), a, b)
+            // Into this: Select(x, b, a)
+            if (m_value->child(0)->opcode() == Equal && m_value->child(0)->child(1)->isInt(0)) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                std::swap(m_value->child(1), m_value->child(2));
+                m_changed = true;
+                break;
+            }
+
+            // Turn this: Select(BitXor(bool, 1), a, b)
+            // Into this: Select(bool, b, a)
+            if (m_value->child(0)->opcode() == BitXor
+                && m_value->child(0)->child(1)->isInt32(1)
+                && m_value->child(0)->child(0)->returnsBool()) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                std::swap(m_value->child(1), m_value->child(2));
+                m_changed = true;
+                break;
+            }
+
+            // Turn this: Select(BitAnd(bool, xyz1), a, b)
+            // Into this: Select(bool, a, b)
+            if (m_value->child(0)->opcode() == BitAnd
+                && m_value->child(0)->child(1)->hasInt()
+                && m_value->child(0)->child(1)->asInt() & 1
+                && m_value->child(0)->child(0)->returnsBool()) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                m_changed = true;
+                break;
+            }
+
+            // Turn this: Select(stuff, x, x)
+            // Into this: x
+            if (m_value->child(1) == m_value->child(2)) {
+                replaceWithIdentity(m_value->child(1));
+                break;
+            }
+            break;
+
+        case Load8Z:
+        case Load8S:
+        case Load16Z:
+        case Load16S:
+        case Load:
+        case Store8:
+        case Store16:
+        case Store: {
+            Value* address = m_value->lastChild();
+            MemoryValue* memory = m_value->as<MemoryValue>();
+
+            // Turn this: Load(Add(address, offset1), offset = offset2)
+            // Into this: Load(address, offset = offset1 + offset2)
+            //
+            // Also turns this: Store(value, Add(address, offset1), offset = offset2)
+            // Into this: Store(value, address, offset = offset1 + offset2)
+            if (address->opcode() == Add && address->child(1)->hasIntPtr()) {
+                intptr_t offset = address->child(1)->asIntPtr();
+                if (!sumOverflows<intptr_t>(offset, memory->offset())) {
+                    offset += memory->offset();
+                    int32_t smallOffset = static_cast<int32_t>(offset);
+                    if (smallOffset == offset) {
+                        address = address->child(0);
+                        memory->lastChild() = address;
+                        memory->setOffset(smallOffset);
+                        m_changed = true;
+                    }
+                }
+            }
+
+            // Turn this: Load(constant1, offset = constant2)
+            // Into this: Load(constant1 + constant2)
+            //
+            // This is a fun canonicalization. It purely regresses naively generated code. We rely
+            // on constant materialization to be smart enough to materialize this constant the smart
+            // way. We want this canonicalization because we want to know if two memory accesses see
+            // the same address.
+            if (memory->offset()) {
+                if (Value* newAddress = address->addConstant(m_proc, memory->offset())) {
+                    m_insertionSet.insertValue(m_index, newAddress);
+                    address = newAddress;
+                    memory->lastChild() = newAddress;
+                    memory->setOffset(0);
+                    m_changed = true;
+                }
+            }
+            
+            break;
+        }
+
+        case CCall: {
+            // Turn this: Call(fmod, constant1, constant2)
+            // Into this: fcall-constant(constant1, constant2)
+            double(*fmodDouble)(double, double) = fmod;
+            if (m_value->type() == Double
+                && m_value->numChildren() == 3
+                && m_value->child(0)->isIntPtr(reinterpret_cast<intptr_t>(fmodDouble))
+                && m_value->child(1)->type() == Double
+                && m_value->child(2)->type() == Double) {
+                replaceWithNewValue(m_value->child(1)->modConstant(m_proc, m_value->child(2)));
+            }
+            break;
+        }
+        case Equal:
+            handleCommutativity();
+
+            // Turn this: Equal(bool, 0)
+            // Into this: BitXor(bool, 1)
+            if (m_value->child(0)->returnsBool() && m_value->child(1)->isInt32(0)) {
+                replaceWithNew<Value>(
+                    BitXor, m_value->origin(), m_value->child(0),
+                    m_insertionSet.insert<Const32Value>(m_index, m_value->origin(), 1));
+                break;
+            }
+            
+            // Turn this Equal(bool, 1)
+            // Into this: bool
+            if (m_value->child(0)->returnsBool() && m_value->child(1)->isInt32(1)) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            // Turn this: Equal(const1, const2)
+            // Into this: const1 == const2
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->equalConstant(m_value->child(1))));
+            break;
+            
+        case NotEqual:
+            handleCommutativity();
+
+            if (m_value->child(0)->returnsBool()) {
+                // Turn this: NotEqual(bool, 0)
+                // Into this: bool
+                if (m_value->child(1)->isInt32(0)) {
+                    replaceWithIdentity(m_value->child(0));
+                    break;
+                }
+                
+                // Turn this: NotEqual(bool, 1)
+                // Into this: Equal(bool, 0)
+                if (m_value->child(1)->isInt32(1)) {
+                    replaceWithNew<Value>(
+                        Equal, m_value->origin(), m_value->child(0),
+                        m_insertionSet.insertIntConstant(m_index, m_value->origin(), Int32, 0));
+                    break;
+                }
+            }
+
+            // Turn this: NotEqual(const1, const2)
+            // Into this: const1 != const2
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->notEqualConstant(m_value->child(1))));
+            break;
+
+        case LessThan:
+            // FIXME: We could do a better job of canonicalizing integer comparisons.
+            // https://bugs.webkit.org/show_bug.cgi?id=150958
+
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->lessThanConstant(m_value->child(1))));
+            break;
+
+        case GreaterThan:
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->greaterThanConstant(m_value->child(1))));
+            break;
+
+        case LessEqual:
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->lessEqualConstant(m_value->child(1))));
+            break;
+
+        case GreaterEqual:
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->greaterEqualConstant(m_value->child(1))));
+            break;
+
+        case Above:
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->aboveConstant(m_value->child(1))));
+            break;
+
+        case Below:
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->belowConstant(m_value->child(1))));
+            break;
+
+        case AboveEqual:
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->aboveEqualConstant(m_value->child(1))));
+            break;
+
+        case BelowEqual:
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(0)->belowEqualConstant(m_value->child(1))));
+            break;
+
+        case EqualOrUnordered:
+            handleCommutativity();
+
+            // Turn this: Equal(const1, const2)
+            // Into this: isunordered(const1, const2) || const1 == const2.
+            // Turn this: Equal(value, const_NaN)
+            // Into this: 1.
+            replaceWithNewValue(
+                m_proc.addBoolConstant(
+                    m_value->origin(),
+                    m_value->child(1)->equalOrUnorderedConstant(m_value->child(0))));
+            break;
+
+        case CheckAdd: {
+            if (replaceWithNewValue(m_value->child(0)->checkAddConstant(m_proc, m_value->child(1))))
+                break;
+
+            handleCommutativity();
+            
+            if (m_value->child(1)->isInt(0)) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            IntRange leftRange = rangeFor(m_value->child(0));
+            IntRange rightRange = rangeFor(m_value->child(1));
+            if (!leftRange.couldOverflowAdd(rightRange, m_value->type())) {
+                replaceWithNewValue(
+                    m_proc.add<Value>(Add, m_value->origin(), m_value->child(0), m_value->child(1)));
+                break;
+            }
+            break;
+        }
+
+        case CheckSub: {
+            if (replaceWithNewValue(m_value->child(0)->checkSubConstant(m_proc, m_value->child(1))))
+                break;
+
+            if (m_value->child(1)->isInt(0)) {
+                replaceWithIdentity(m_value->child(0));
+                break;
+            }
+
+            if (Value* negatedConstant = m_value->child(1)->checkNegConstant(m_proc)) {
+                m_insertionSet.insertValue(m_index, negatedConstant);
+                m_value->as<CheckValue>()->convertToAdd();
+                m_value->child(1) = negatedConstant;
+                m_changed = true;
+                break;
+            }
+
+            IntRange leftRange = rangeFor(m_value->child(0));
+            IntRange rightRange = rangeFor(m_value->child(1));
+            if (!leftRange.couldOverflowSub(rightRange, m_value->type())) {
+                replaceWithNewValue(
+                    m_proc.add<Value>(Sub, m_value->origin(), m_value->child(0), m_value->child(1)));
+                break;
+            }
+            break;
+        }
+
+        case CheckMul: {
+            if (replaceWithNewValue(m_value->child(0)->checkMulConstant(m_proc, m_value->child(1))))
+                break;
+
+            handleCommutativity();
+
+            if (m_value->child(1)->hasInt()) {
+                bool modified = true;
+                switch (m_value->child(1)->asInt()) {
+                case 0:
+                    replaceWithNewValue(m_proc.addIntConstant(m_value, 0));
+                    break;
+                case 1:
+                    replaceWithIdentity(m_value->child(0));
+                    break;
+                case 2:
+                    m_value->as<CheckValue>()->convertToAdd();
+                    m_value->child(1) = m_value->child(0);
+                    m_changed = true;
+                    break;
+                default:
+                    modified = false;
+                    break;
+                }
+                if (modified)
+                    break;
+            }
+
+            IntRange leftRange = rangeFor(m_value->child(0));
+            IntRange rightRange = rangeFor(m_value->child(1));
+            if (!leftRange.couldOverflowMul(rightRange, m_value->type())) {
+                replaceWithNewValue(
+                    m_proc.add<Value>(Mul, m_value->origin(), m_value->child(0), m_value->child(1)));
+                break;
+            }
+            break;
+        }
+
+        case Check: {
+            CheckValue* checkValue = m_value->as<CheckValue>();
+            
+            if (checkValue->child(0)->isLikeZero()) {
+                checkValue->replaceWithNop();
+                m_changed = true;
+                break;
+            }
+
+            if (checkValue->child(0)->isLikeNonZero()) {
+                PatchpointValue* patchpoint =
+                    m_insertionSet.insert<PatchpointValue>(m_index, Void, checkValue->origin());
+
+                patchpoint->effects = Effects();
+                patchpoint->effects.reads = HeapRange::top();
+                patchpoint->effects.exitsSideways = true;
+
+                for (unsigned i = 1; i < checkValue->numChildren(); ++i)
+                    patchpoint->append(checkValue->constrainedChild(i));
+
+                patchpoint->setGenerator(checkValue->generator());
+
+                // Replace the rest of the block with an Oops.
+                for (unsigned i = m_index + 1; i < m_block->size() - 1; ++i)
+                    m_block->at(i)->replaceWithBottom(m_insertionSet, m_index);
+                m_block->last()->replaceWithOops(m_block);
+                m_block->last()->setOrigin(checkValue->origin());
+
+                // Replace ourselves last.
+                checkValue->replaceWithNop();
+                m_changedCFG = true;
+                break;
+            }
+
+            if (checkValue->child(0)->opcode() == NotEqual
+                && checkValue->child(0)->child(1)->isInt(0)) {
+                checkValue->child(0) = checkValue->child(0)->child(0);
+                m_changed = true;
+            }
+
+            // If we are checking some bounded-size SSA expression that leads to a Select that
+            // has a constant as one of its results, then turn the Select into a Branch and split
+            // the code between the Check and the Branch. For example, this:
+            //
+            //     @a = Select(@p, @x, 42)
+            //     @b = Add(@a, 35)
+            //     Check(@b)
+            //
+            // becomes this:
+            //
+            //     Branch(@p, #truecase, #falsecase)
+            //
+            //   BB#truecase:
+            //     @b_truecase = Add(@x, 35)
+            //     Check(@b_truecase)
+            //     Upsilon(@x, ^a)
+            //     Upsilon(@b_truecase, ^b)
+            //     Jump(#continuation)
+            //
+            //   BB#falsecase:
+            //     @b_falsecase = Add(42, 35)
+            //     Check(@b_falsecase)
+            //     Upsilon(42, ^a)
+            //     Upsilon(@b_falsecase, ^b)
+            //     Jump(#continuation)
+            //
+            //   BB#continuation:
+            //     @a = Phi()
+            //     @b = Phi()
+            //
+            // The goal of this optimization is to kill a lot of code in one of those basic
+            // blocks. This is pretty much guaranteed since one of those blocks will replace all
+            // uses of the Select with a constant, and that constant will be transitively used
+            // from the check.
+            static const unsigned selectSpecializationBound = 3;
+            Value* select = findRecentNodeMatching(
+                m_value->child(0), selectSpecializationBound,
+                [&] (Value* value) -> bool {
+                    return value->opcode() == Select
+                        && (value->child(1)->isConstant() && value->child(2)->isConstant());
+                });
+            
+            if (select) {
+                specializeSelect(select);
+                break;
+            }
+            break;
+        }
+
+        case Branch: {
+            // Turn this: Branch(NotEqual(x, 0))
+            // Into this: Branch(x)
+            if (m_value->child(0)->opcode() == NotEqual && m_value->child(0)->child(1)->isInt(0)) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                m_changed = true;
+            }
+
+            // Turn this: Branch(Equal(x, 0), then, else)
+            // Into this: Branch(x, else, then)
+            if (m_value->child(0)->opcode() == Equal && m_value->child(0)->child(1)->isInt(0)) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                std::swap(m_block->taken(), m_block->notTaken());
+                m_changed = true;
+            }
+            
+            // Turn this: Branch(BitXor(bool, 1), then, else)
+            // Into this: Branch(bool, else, then)
+            if (m_value->child(0)->opcode() == BitXor
+                && m_value->child(0)->child(1)->isInt32(1)
+                && m_value->child(0)->child(0)->returnsBool()) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                std::swap(m_block->taken(), m_block->notTaken());
+                m_changed = true;
+            }
+
+            // Turn this: Branch(BitAnd(bool, xyb1), then, else)
+            // Into this: Branch(bool, then, else)
+            if (m_value->child(0)->opcode() == BitAnd
+                && m_value->child(0)->child(1)->hasInt()
+                && m_value->child(0)->child(1)->asInt() & 1
+                && m_value->child(0)->child(0)->returnsBool()) {
+                m_value->child(0) = m_value->child(0)->child(0);
+                m_changed = true;
+            }
+
+            TriState triState = m_value->child(0)->asTriState();
+
+            // Turn this: Branch(0, then, else)
+            // Into this: Jump(else)
+            if (triState == FalseTriState) {
+                m_block->taken().block()->removePredecessor(m_block);
+                m_value->replaceWithJump(m_block, m_block->notTaken());
+                m_changedCFG = true;
+                break;
+            }
+
+            // Turn this: Branch(not 0, then, else)
+            // Into this: Jump(then)
+            if (triState == TrueTriState) {
+                m_block->notTaken().block()->removePredecessor(m_block);
+                m_value->replaceWithJump(m_block, m_block->taken());
+                m_changedCFG = true;
+                break;
+            }
+
+            // If a check for the same property dominates us, we can kill the branch. This sort
+            // of makes sense here because it's cheap, but hacks like this show that we're going
+            // to need SCCP.
+            Value* check = m_pureCSE.findMatch(
+                ValueKey(Check, Void, m_value->child(0)), m_block, *m_dominators);
+            if (check) {
+                // The Check would have side-exited if child(0) was non-zero. So, it must be
+                // zero here.
+                m_block->taken().block()->removePredecessor(m_block);
+                m_value->replaceWithJump(m_block, m_block->notTaken());
+                m_changedCFG = true;
+            }
+            break;
+        }
+            
+        default:
+            break;
+        }
+    }
+
+    // Find a node that:
+    //     - functor(node) returns true.
+    //     - it's reachable from the given node via children.
+    //     - it's in the last "bound" slots in the current basic block.
+    // This algorithm is optimized under the assumption that the bound is small.
+    template<typename Functor>
+    Value* findRecentNodeMatching(Value* start, unsigned bound, const Functor& functor)
+    {
+        unsigned startIndex = bound < m_index ? m_index - bound : 0;
+        Value* result = nullptr;
+        start->walk(
+            [&] (Value* value) -> Value::WalkStatus {
+                bool found = false;
+                for (unsigned i = startIndex; i <= m_index; ++i) {
+                    if (m_block->at(i) == value)
+                        found = true;
+                }
+                if (!found)
+                    return Value::IgnoreChildren;
+
+                if (functor(value)) {
+                    result = value;
+                    return Value::Stop;
+                }
+
+                return Value::Continue;
+            });
+        return result;
+    }
+
+    // This specializes a sequence of code up to a Select. This doesn't work when we're at a
+    // terminal. It would be cool to fix that eventually. The main problem is that instead of
+    // splitting the block, we should just insert the then/else blocks. We'll have to create
+    // double the Phis and double the Upsilons. It'll probably be the sort of optimization that
+    // we want to do only after we've done loop optimizations, since this will *definitely*
+    // obscure things. In fact, even this simpler form of select specialization will possibly
+    // obscure other optimizations. It would be great to have two modes of strength reduction,
+    // one that does obscuring optimizations and runs late, and another that does not do
+    // obscuring optimizations and runs early.
+    // FIXME: Make select specialization handle branches.
+    // FIXME: Have a form of strength reduction that does no obscuring optimizations and runs
+    // early.
+    void specializeSelect(Value* source)
+    {
+        if (verbose)
+            dataLog("Specializing select: ", deepDump(m_proc, source), "\n");
+
+        // This mutates startIndex to account for the fact that m_block got the front of it
+        // chopped off.
+        BasicBlock* predecessor =
+            m_blockInsertionSet.splitForward(m_block, m_index, &m_insertionSet);
+
+        // Splitting will commit the insertion set, which changes the exact position of the
+        // source. That's why we do the search after splitting.
+        unsigned startIndex = UINT_MAX;
+        for (unsigned i = predecessor->size(); i--;) {
+            if (predecessor->at(i) == source) {
+                startIndex = i;
+                break;
+            }
+        }
+        
+        RELEASE_ASSERT(startIndex != UINT_MAX);
+
+        // By BasicBlock convention, caseIndex == 0 => then, caseIndex == 1 => else.
+        static const unsigned numCases = 2;
+        BasicBlock* cases[numCases];
+        for (unsigned i = 0; i < numCases; ++i)
+            cases[i] = m_blockInsertionSet.insertBefore(m_block);
+
+        HashMap<Value*, Value*> mappings[2];
+
+        // Save things we want to know about the source.
+        Value* predicate = source->child(0);
+
+        for (unsigned i = 0; i < numCases; ++i)
+            mappings[i].add(source, source->child(1 + i));
+
+        auto cloneValue = [&] (Value* value) {
+            ASSERT(value != source);
+
+            for (unsigned i = 0; i < numCases; ++i) {
+                Value* clone = m_proc.clone(value);
+                for (Value*& child : clone->children()) {
+                    if (Value* newChild = mappings[i].get(child))
+                        child = newChild;
+                }
+                if (value->type() != Void)
+                    mappings[i].add(value, clone);
+
+                cases[i]->append(clone);
+                if (value->type() != Void)
+                    cases[i]->appendNew<UpsilonValue>(m_proc, value->origin(), clone, value);
+            }
+
+            value->replaceWithPhi();
+        };
+
+        // The jump that the splitter inserted is of no use to us.
+        predecessor->removeLast(m_proc);
+
+        // Hance the source, it's special.
+        for (unsigned i = 0; i < numCases; ++i) {
+            cases[i]->appendNew<UpsilonValue>(
+                m_proc, source->origin(), source->child(1 + i), source);
+        }
+        source->replaceWithPhi();
+        m_insertionSet.insertValue(m_index, source);
+
+        // Now handle all values between the source and the check.
+        for (unsigned i = startIndex + 1; i < predecessor->size(); ++i) {
+            Value* value = predecessor->at(i);
+            value->owner = nullptr;
+
+            cloneValue(value);
+
+            if (value->type() != Void)
+                m_insertionSet.insertValue(m_index, value);
+            else
+                m_proc.deleteValue(value);
+        }
+
+        // Finally, deal with the check.
+        cloneValue(m_value);
+
+        // Remove the values from the predecessor.
+        predecessor->values().resize(startIndex);
+        
+        predecessor->appendNew<Value>(m_proc, Branch, source->origin(), predicate);
+        predecessor->setSuccessors(FrequentedBlock(cases[0]), FrequentedBlock(cases[1]));
+
+        for (unsigned i = 0; i < numCases; ++i) {
+            cases[i]->appendNew<Value>(m_proc, Jump, m_value->origin());
+            cases[i]->setSuccessors(FrequentedBlock(m_block));
+        }
+
+        m_changed = true;
+
+        predecessor->updatePredecessorsAfter();
+    }
+
+    // Turn this: Add(constant, value)
+    // Into this: Add(value, constant)
+    //
+    // Also:
+    // Turn this: Add(value1, value2)
+    // Into this: Add(value2, value1)
+    // If we decide that value2 coming first is the canonical ordering.
+    void handleCommutativity()
+    {
+        // Note that we have commutative operations that take more than two children. Those operations may
+        // commute their first two children while leaving the rest unaffected.
+        ASSERT(m_value->numChildren() >= 2);
+        
+        // Leave it alone if the right child is a constant.
+        if (m_value->child(1)->isConstant())
+            return;
+        
+        if (m_value->child(0)->isConstant()) {
+            std::swap(m_value->child(0), m_value->child(1));
+            m_changed = true;
+            return;
+        }
+
+        // Sort the operands. This is an important canonicalization. We use the index instead of
+        // the address to make this at least slightly deterministic.
+        if (m_value->child(0)->index() > m_value->child(1)->index()) {
+            std::swap(m_value->child(0), m_value->child(1));
+            m_changed = true;
+            return;
+        }
+    }
+
+    // FIXME: This should really be a forward analysis. Instead, we uses a bounded-search backwards
+    // analysis.
+    IntRange rangeFor(Value* value, unsigned timeToLive = 5)
+    {
+        if (!timeToLive)
+            return IntRange::top(value->type());
+        
+        switch (value->opcode()) {
+        case Const32:
+        case Const64: {
+            int64_t intValue = value->asInt();
+            return IntRange(intValue, intValue);
+        }
+
+        case BitAnd:
+            if (value->child(1)->hasInt())
+                return IntRange::rangeForMask(value->child(1)->asInt(), value->type());
+            break;
+
+        case SShr:
+            if (value->child(1)->hasInt32()) {
+                return rangeFor(value->child(0), timeToLive - 1).sShr(
+                    value->child(1)->asInt32(), value->type());
+            }
+            break;
+
+        case ZShr:
+            if (value->child(1)->hasInt32()) {
+                return rangeFor(value->child(0), timeToLive - 1).zShr(
+                    value->child(1)->asInt32(), value->type());
+            }
+            break;
+
+        case Shl:
+            if (value->child(1)->hasInt32()) {
+                return rangeFor(value->child(0), timeToLive - 1).shl(
+                    value->child(1)->asInt32(), value->type());
+            }
+            break;
+
+        case Add:
+            return rangeFor(value->child(0), timeToLive - 1).add(
+                rangeFor(value->child(1), timeToLive - 1), value->type());
+
+        case Sub:
+            return rangeFor(value->child(0), timeToLive - 1).sub(
+                rangeFor(value->child(1), timeToLive - 1), value->type());
+
+        case Mul:
+            return rangeFor(value->child(0), timeToLive - 1).mul(
+                rangeFor(value->child(1), timeToLive - 1), value->type());
+
+        default:
+            break;
+        }
+
+        return IntRange::top(value->type());
+    }
+
+    template<typename ValueType, typename... Arguments>
+    void replaceWithNew(Arguments... arguments)
+    {
+        replaceWithNewValue(m_proc.add<ValueType>(arguments...));
+    }
+
+    bool replaceWithNewValue(Value* newValue)
+    {
+        if (!newValue)
+            return false;
+        m_insertionSet.insertValue(m_index, newValue);
+        m_value->replaceWithIdentity(newValue);
+        m_changed = true;
+        return true;
+    }
+
+    void replaceWithIdentity(Value* newValue)
+    {
+        m_value->replaceWithIdentity(newValue);
+        m_changed = true;
+    }
+
+    void handleShiftAmount()
+    {
+        // Shift anything by zero is identity.
+        if (m_value->child(1)->isInt32(0)) {
+            replaceWithIdentity(m_value->child(0));
+            return;
+        }
+
+        // The shift already masks its shift amount. If the shift amount is being masked by a
+        // redundant amount, then remove the mask. For example,
+        // Turn this: Shl(@x, BitAnd(@y, 63))
+        // Into this: Shl(@x, @y)
+        unsigned mask = sizeofType(m_value->type()) * 8 - 1;
+        if (m_value->child(1)->opcode() == BitAnd
+            && m_value->child(1)->child(1)->hasInt32()
+            && (m_value->child(1)->child(1)->asInt32() & mask) == mask) {
+            m_value->child(1) = m_value->child(1)->child(0);
+            m_changed = true;
+        }
+    }
+
+    void replaceIfRedundant()
+    {
+        m_changed |= m_pureCSE.process(m_value, *m_dominators);
+    }
+
+    void simplifyCFG()
+    {
+        if (verbose) {
+            dataLog("Before simplifyCFG:\n");
+            dataLog(m_proc);
+        }
+        
+        // We have three easy simplification rules:
+        //
+        // 1) If a successor is a block that just jumps to another block, then jump directly to
+        //    that block.
+        //
+        // 2) If all successors are the same and the operation has no effects, then use a jump
+        //    instead.
+        //
+        // 3) If you jump to a block that is not you and has one predecessor, then merge.
+        //
+        // Note that because of the first rule, this phase may introduce critical edges. That's fine.
+        // If you need broken critical edges, then you have to break them yourself.
+
+        // Note that this relies on predecessors being at least conservatively correct. It's fine for
+        // predecessors to mention a block that isn't actually a predecessor. It's *not* fine for a
+        // predecessor to be omitted. We assert as much in the loop. In practice, we precisely preserve
+        // predecessors during strength reduction since that minimizes the total number of fixpoint
+        // iterations needed to kill a lot of code.
+
+        for (BasicBlock* block : m_proc) {
+            if (verbose)
+                dataLog("Considering block ", *block, ":\n");
+
+            checkPredecessorValidity();
+
+            // We don't care about blocks that don't have successors.
+            if (!block->numSuccessors())
+                continue;
+
+            // First check if any of the successors of this block can be forwarded over.
+            for (BasicBlock*& successor : block->successorBlocks()) {
+                if (successor != block
+                    && successor->size() == 1
+                    && successor->last()->opcode() == Jump) {
+                    BasicBlock* newSuccessor = successor->successorBlock(0);
+                    if (newSuccessor != successor) {
+                        if (verbose) {
+                            dataLog(
+                                "Replacing ", pointerDump(block), "->", pointerDump(successor),
+                                " with ", pointerDump(block), "->", pointerDump(newSuccessor),
+                                "\n");
+                        }
+                        // Note that we do not do replacePredecessor() because the block we're
+                        // skipping will still have newSuccessor as its successor.
+                        newSuccessor->addPredecessor(block);
+                        successor = newSuccessor;
+                        m_changedCFG = true;
+                    }
+                }
+            }
+
+            // Now check if the block's terminal can be replaced with a jump.
+            if (block->numSuccessors() > 1) {
+                // The terminal must not have weird effects.
+                Effects effects = block->last()->effects();
+                effects.terminal = false;
+                if (!effects.mustExecute()) {
+                    // All of the successors must be the same.
+                    bool allSame = true;
+                    BasicBlock* firstSuccessor = block->successorBlock(0);
+                    for (unsigned i = 1; i < block->numSuccessors(); ++i) {
+                        if (block->successorBlock(i) != firstSuccessor) {
+                            allSame = false;
+                            break;
+                        }
+                    }
+                    if (allSame) {
+                        if (verbose) {
+                            dataLog(
+                                "Changing ", pointerDump(block), "'s terminal to a Jump.\n");
+                        }
+                        block->last()->replaceWithJump(block, FrequentedBlock(firstSuccessor));
+                        m_changedCFG = true;
+                    }
+                }
+            }
+
+            // Finally handle jumps to a block with one predecessor.
+            if (block->numSuccessors() == 1) {
+                BasicBlock* successor = block->successorBlock(0);
+                if (successor != block && successor->numPredecessors() == 1) {
+                    RELEASE_ASSERT(successor->predecessor(0) == block);
+                    
+                    // We can merge the two blocks, because the predecessor only jumps to the successor
+                    // and the successor is only reachable from the predecessor.
+                    
+                    // Remove the terminal.
+                    Value* value = block->values().takeLast();
+                    Origin jumpOrigin = value->origin();
+                    RELEASE_ASSERT(value->effects().terminal);
+                    m_proc.deleteValue(value);
+                    
+                    // Append the full contents of the successor to the predecessor.
+                    block->values().appendVector(successor->values());
+                    block->successors() = successor->successors();
+                    
+                    // Make sure that the successor has nothing left in it. Make sure that the block
+                    // has a terminal so that nobody chokes when they look at it.
+                    successor->values().resize(0);
+                    successor->appendNew<Value>(m_proc, Oops, jumpOrigin);
+                    successor->clearSuccessors();
+                    
+                    // Ensure that predecessors of block's new successors know what's up.
+                    for (BasicBlock* newSuccessor : block->successorBlocks())
+                        newSuccessor->replacePredecessor(successor, block);
+
+                    if (verbose) {
+                        dataLog(
+                            "Merged ", pointerDump(block), "->", pointerDump(successor), "\n");
+                    }
+                    
+                    m_changedCFG = true;
+                }
+            }
+        }
+
+        if (m_changedCFG && verbose) {
+            dataLog("B3 after simplifyCFG:\n");
+            dataLog(m_proc);
+        }
+    }
+
+    void checkPredecessorValidity()
+    {
+        if (!shouldValidateIRAtEachPhase())
+            return;
+
+        for (BasicBlock* block : m_proc) {
+            for (BasicBlock* successor : block->successorBlocks())
+                RELEASE_ASSERT(successor->containsPredecessor(block));
+        }
+    }
+
+    void killDeadCode()
+    {
+        GraphNodeWorklist<Value*, IndexSet<Value>> worklist;
+        Vector<UpsilonValue*, 64> upsilons;
+        for (BasicBlock* block : m_proc) {
+            for (Value* value : *block) {
+                Effects effects;
+                // We don't care about effects of SSA operations, since we model them more
+                // accurately than the effects() method does.
+                if (value->opcode() != Phi && value->opcode() != Upsilon)
+                    effects = value->effects();
+                
+                if (effects.mustExecute())
+                    worklist.push(value);
+                
+                if (UpsilonValue* upsilon = value->as<UpsilonValue>())
+                    upsilons.append(upsilon);
+            }
+        }
+        for (;;) {
+            while (Value* value = worklist.pop()) {
+                for (Value* child : value->children())
+                    worklist.push(child);
+            }
+            
+            bool didPush = false;
+            for (size_t upsilonIndex = 0; upsilonIndex < upsilons.size(); ++upsilonIndex) {
+                UpsilonValue* upsilon = upsilons[upsilonIndex];
+                if (worklist.saw(upsilon->phi())) {
+                    worklist.push(upsilon);
+                    upsilons[upsilonIndex--] = upsilons.last();
+                    upsilons.takeLast();
+                    didPush = true;
+                }
+            }
+            if (!didPush)
+                break;
+        }
+
+        IndexSet<Variable> liveVariables;
+        
+        for (BasicBlock* block : m_proc) {
+            size_t sourceIndex = 0;
+            size_t targetIndex = 0;
+            while (sourceIndex < block->size()) {
+                Value* value = block->at(sourceIndex++);
+                if (worklist.saw(value)) {
+                    if (VariableValue* variableValue = value->as<VariableValue>())
+                        liveVariables.add(variableValue->variable());
+                    block->at(targetIndex++) = value;
+                } else {
+                    m_proc.deleteValue(value);
+                    m_changed = true;
+                }
+            }
+            block->values().resize(targetIndex);
+        }
+
+        for (Variable* variable : m_proc.variables()) {
+            if (!liveVariables.contains(variable))
+                m_proc.deleteVariable(variable);
+        }
+    }
+
+    void simplifySSA()
+    {
+        // This runs Aycock and Horspool's algorithm on our Phi functions [1]. For most CFG patterns,
+        // this can take a suboptimal arrangement of Phi functions and make it optimal, as if you had
+        // run Cytron, Ferrante, Rosen, Wegman, and Zadeck. It's only suboptimal for irreducible
+        // CFGs. In practice, that doesn't matter, since we expect clients of B3 to run their own SSA
+        // conversion before lowering to B3, and in the case of the DFG, that conversion uses Cytron
+        // et al. In that context, this algorithm is intended to simplify Phi functions that were
+        // made redundant by prior CFG simplification. But according to Aycock and Horspool's paper,
+        // this algorithm is good enough that a B3 client could just give us maximal Phi's (i.e. Phi
+        // for each variable at each basic block) and we will make them optimal.
+        // [1] http://pages.cpsc.ucalgary.ca/~aycock/papers/ssa.ps
+
+        // Aycock and Horspool prescribe two rules that are to be run to fixpoint:
+        //
+        // 1) If all of the Phi's children are the same (i.e. it's one child referenced from one or
+        //    more Upsilons), then replace all uses of the Phi with the one child.
+        //
+        // 2) If all of the Phi's children are either the Phi itself or exactly one other child, then
+        //    replace all uses of the Phi with the one other child.
+        //
+        // Rule (2) subsumes rule (1), so we can just run (2). We only run one fixpoint iteration
+        // here. This premise is that in common cases, this will only find optimization opportunities
+        // as a result of CFG simplification and usually CFG simplification will only do one round
+        // of block merging per ReduceStrength fixpoint iteration, so it's OK for this to only do one
+        // round of Phi merging - since Phis are the value analogue of blocks.
+
+        PhiChildren phiChildren(m_proc);
+
+        for (Value* phi : phiChildren.phis()) {
+            Value* otherChild = nullptr;
+            bool ok = true;
+            for (Value* child : phiChildren[phi].values()) {
+                if (child == phi)
+                    continue;
+                if (child == otherChild)
+                    continue;
+                if (!otherChild) {
+                    otherChild = child;
+                    continue;
+                }
+                ok = false;
+                break;
+            }
+            if (!ok)
+                continue;
+            if (!otherChild) {
+                // Wow, this would be super weird. It probably won't happen, except that things could
+                // get weird as a consequence of stepwise simplifications in the strength reduction
+                // fixpoint.
+                continue;
+            }
+            
+            // Turn the Phi into an Identity and turn the Upsilons into Nops.
+            m_changed = true;
+            for (Value* upsilon : phiChildren[phi])
+                upsilon->replaceWithNop();
+            phi->replaceWithIdentity(otherChild);
+        }
+    }
+
+    Procedure& m_proc;
+    InsertionSet m_insertionSet;
+    BlockInsertionSet m_blockInsertionSet;
+    BasicBlock* m_block { nullptr };
+    unsigned m_index { 0 };
+    Value* m_value { nullptr };
+    Dominators* m_dominators { nullptr };
+    PureCSE m_pureCSE;
+    bool m_changed { false };
+    bool m_changedCFG { false };
+};
+
+} // anonymous namespace
+
+bool reduceStrength(Procedure& proc)
+{
+    PhaseScope phaseScope(proc, "reduceStrength");
+    ReduceStrength reduceStrength(proc);
+    return reduceStrength.run();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3ReduceStrength.h b/b3/B3ReduceStrength.h
new file mode 100644
index 0000000..1abb80f
--- /dev/null
+++ b/b3/B3ReduceStrength.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+// Does strength reduction, constant folding, canonicalization, CFG simplification, DCE, and very
+// simple CSE. This phase runs those optimizations to fixpoint. The goal of the phase is to
+// dramatically reduce the complexity of the code. In the future, it's preferable to add optimizations
+// to this phase rather than creating new optimizations because then the optimizations can participate
+// in the fixpoint. However, because of the many interlocking optimizations, it can be difficult to
+// add sophisticated optimizations to it. For that reason we have full CSE in a different phase, for
+// example.
+
+JS_EXPORT_PRIVATE bool reduceStrength(Procedure&);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SSACalculator.cpp b/b3/B3SSACalculator.cpp
new file mode 100644
index 0000000..30692a9
--- /dev/null
+++ b/b3/B3SSACalculator.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3SSACalculator.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 {
+
+void SSACalculator::Variable::dump(PrintStream& out) const
+{
+    out.print("var", m_index);
+}
+
+void SSACalculator::Variable::dumpVerbose(PrintStream& out) const
+{
+    dump(out);
+    if (!m_blocksWithDefs.isEmpty()) {
+        out.print("(defs: ");
+        CommaPrinter comma;
+        for (BasicBlock* block : m_blocksWithDefs)
+            out.print(comma, *block);
+        out.print(")");
+    }
+}
+
+void SSACalculator::Def::dump(PrintStream& out) const
+{
+    out.print("def(", *m_variable, ", ", *m_block, ", ", pointerDump(m_value), ")");
+}
+
+SSACalculator::SSACalculator(Procedure& proc)
+    : m_data(proc.size())
+    , m_proc(proc)
+{
+}
+
+SSACalculator::~SSACalculator()
+{
+}
+
+void SSACalculator::reset()
+{
+    m_variables.clear();
+    m_defs.clear();
+    m_phis.clear();
+    for (unsigned blockIndex = m_data.size(); blockIndex--;) {
+        m_data[blockIndex].m_defs.clear();
+        m_data[blockIndex].m_phis.clear();
+    }
+}
+
+SSACalculator::Variable* SSACalculator::newVariable()
+{
+    return &m_variables.alloc(Variable(m_variables.size()));
+}
+
+SSACalculator::Def* SSACalculator::newDef(Variable* variable, BasicBlock* block, Value* value)
+{
+    Def* def = m_defs.add(Def(variable, block, value));
+    auto result = m_data[block].m_defs.add(variable, def);
+    if (result.isNewEntry)
+        variable->m_blocksWithDefs.append(block);
+    else
+        result.iterator->value = def;
+    return def;
+}
+
+SSACalculator::Def* SSACalculator::nonLocalReachingDef(BasicBlock* block, Variable* variable)
+{
+    return reachingDefAtTail(m_dominators->idom(block), variable);
+}
+
+SSACalculator::Def* SSACalculator::reachingDefAtTail(BasicBlock* block, Variable* variable)
+{
+    for (; block; block = m_dominators->idom(block)) {
+        if (Def* def = m_data[block].m_defs.get(variable))
+            return def;
+    }
+    return nullptr;
+}
+
+void SSACalculator::dump(PrintStream& out) const
+{
+    out.print("<Variables: [");
+    CommaPrinter comma;
+    for (unsigned i = 0; i < m_variables.size(); ++i) {
+        out.print(comma);
+        m_variables[i].dumpVerbose(out);
+    }
+    out.print("], Defs: [");
+    comma = CommaPrinter();
+    for (Def* def : const_cast<SSACalculator*>(this)->m_defs)
+        out.print(comma, *def);
+    out.print("], Phis: [");
+    comma = CommaPrinter();
+    for (Def* def : const_cast<SSACalculator*>(this)->m_phis)
+        out.print(comma, *def);
+    out.print("], Block data: [");
+    comma = CommaPrinter();
+    for (unsigned blockIndex = 0; blockIndex < m_proc.size(); ++blockIndex) {
+        BasicBlock* block = m_proc[blockIndex];
+        if (!block)
+            continue;
+        
+        out.print(comma, *block, "=>(");
+        out.print("Defs: {");
+        CommaPrinter innerComma;
+        for (auto entry : m_data[block].m_defs)
+            out.print(innerComma, *entry.key, "->", *entry.value);
+        out.print("}, Phis: {");
+        innerComma = CommaPrinter();
+        for (Def* def : m_data[block].m_phis)
+            out.print(innerComma, *def);
+        out.print("})");
+    }
+    out.print("]>");
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3SSACalculator.h b/b3/B3SSACalculator.h
new file mode 100644
index 0000000..be9a064
--- /dev/null
+++ b/b3/B3SSACalculator.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Dominators.h"
+#include "B3ProcedureInlines.h"
+#include <wtf/Bag.h>
+#include <wtf/IndexMap.h>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC { namespace B3 {
+
+// SSACalculator provides a reusable tool for building SSA's. It's modeled after
+// DFG::SSACalculator.
+
+class SSACalculator {
+public:
+    SSACalculator(Procedure&);
+    ~SSACalculator();
+
+    void reset();
+
+    class Variable {
+    public:
+        unsigned index() const { return m_index; }
+        
+        void dump(PrintStream&) const;
+        void dumpVerbose(PrintStream&) const;
+        
+    private:
+        friend class SSACalculator;
+        
+        Variable()
+            : m_index(UINT_MAX)
+        {
+        }
+        
+        Variable(unsigned index)
+            : m_index(index)
+        {
+        }
+
+        Vector<BasicBlock*, 4> m_blocksWithDefs;
+        unsigned m_index;
+    };
+
+    class Def {
+    public:
+        Variable* variable() const { return m_variable; }
+        BasicBlock* block() const { return m_block; }
+        
+        Value* value() const { return m_value; }
+        
+        void dump(PrintStream&) const;
+        
+    private:
+        friend class SSACalculator;
+        
+        Def()
+            : m_variable(nullptr)
+            , m_block(nullptr)
+            , m_value(nullptr)
+        {
+        }
+        
+        Def(Variable* variable, BasicBlock* block, Value* value)
+            : m_variable(variable)
+            , m_block(block)
+            , m_value(value)
+        {
+        }
+        
+        Variable* m_variable;
+        BasicBlock* m_block;
+        Value* m_value;
+    };
+
+    Variable* newVariable();
+    Def* newDef(Variable*, BasicBlock*, Value*);
+
+    Variable* variable(unsigned index) { return &m_variables[index]; }
+
+    template<typename Functor>
+    void computePhis(const Functor& functor)
+    {
+        m_dominators = &m_proc.dominators();
+        for (Variable& variable : m_variables) {
+            m_dominators->forAllBlocksInPrunedIteratedDominanceFrontierOf(
+                variable.m_blocksWithDefs,
+                [&] (BasicBlock* block) -> bool {
+                    Value* phi = functor(&variable, block);
+                    if (!phi)
+                        return false;
+
+                    BlockData& data = m_data[block];
+                    Def* phiDef = m_phis.add(Def(&variable, block, phi));
+                    data.m_phis.append(phiDef);
+
+                    data.m_defs.add(&variable, phiDef);
+                    return true;
+                });
+        }
+    }
+
+    const Vector<Def*>& phisForBlock(BasicBlock* block)
+    {
+        return m_data[block].m_phis;
+    }
+    
+    // Ignores defs within the given block; it assumes that you've taken care of those
+    // yourself.
+    Def* nonLocalReachingDef(BasicBlock*, Variable*);
+    Def* reachingDefAtHead(BasicBlock* block, Variable* variable)
+    {
+        return nonLocalReachingDef(block, variable);
+    }
+    
+    // Considers the def within the given block, but only works at the tail of the block.
+    Def* reachingDefAtTail(BasicBlock*, Variable*);
+    
+    void dump(PrintStream&) const;
+    
+private:
+    SegmentedVector<Variable> m_variables;
+    Bag<Def> m_defs;
+    
+    Bag<Def> m_phis;
+    
+    struct BlockData {
+        HashMap<Variable*, Def*> m_defs;
+        Vector<Def*> m_phis;
+    };
+    
+    IndexMap<BasicBlock, BlockData> m_data;
+
+    Dominators* m_dominators { nullptr };
+    Procedure& m_proc;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SlotBaseValue.cpp b/b3/B3SlotBaseValue.cpp
new file mode 100644
index 0000000..b5fd69b
--- /dev/null
+++ b/b3/B3SlotBaseValue.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3SlotBaseValue.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3StackSlot.h"
+
+namespace JSC { namespace B3 {
+
+SlotBaseValue::~SlotBaseValue()
+{
+}
+
+void SlotBaseValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma, pointerDump(m_slot));
+}
+
+Value* SlotBaseValue::cloneImpl() const
+{
+    return new SlotBaseValue(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SlotBaseValue.h b/b3/B3SlotBaseValue.h
new file mode 100644
index 0000000..19392ea
--- /dev/null
+++ b/b3/B3SlotBaseValue.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class StackSlot;
+
+class JS_EXPORT_PRIVATE SlotBaseValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == SlotBase; }
+
+    ~SlotBaseValue();
+
+    StackSlot* slot() const { return m_slot; }
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    SlotBaseValue(Origin origin, StackSlot* slot)
+        : Value(CheckedOpcode, SlotBase, pointerType(), origin)
+        , m_slot(slot)
+    {
+    }
+
+    StackSlot* m_slot;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SparseCollection.h b/b3/B3SparseCollection.h
new file mode 100644
index 0000000..46c33a9
--- /dev/null
+++ b/b3/B3SparseCollection.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+// B3::Procedure and Air::Code have a lot of collections of indexed things. This has all of the
+// logic.
+
+template<typename T>
+class SparseCollection {
+    typedef Vector<std::unique_ptr<T>> VectorType;
+    
+public:
+    SparseCollection()
+    {
+    }
+
+    T* add(std::unique_ptr<T> value)
+    {
+        T* result = value.get();
+        
+        size_t index;
+        if (m_indexFreeList.isEmpty()) {
+            index = m_vector.size();
+            m_vector.append(nullptr);
+        } else
+            index = m_indexFreeList.takeLast();
+
+        value->m_index = index;
+        ASSERT(!m_vector[index]);
+        new (NotNull, &m_vector[index]) std::unique_ptr<T>(WTFMove(value));
+
+        return result;
+    }
+
+    template<typename... Arguments>
+    T* addNew(Arguments&&... arguments)
+    {
+        return add(std::unique_ptr<T>(new T(std::forward<Arguments>(arguments)...)));
+    }
+
+    void remove(T* value)
+    {
+        RELEASE_ASSERT(m_vector[value->m_index].get() == value);
+        m_indexFreeList.append(value->m_index);
+        m_vector[value->m_index] = nullptr;
+    }
+
+    unsigned size() const { return m_vector.size(); }
+    bool isEmpty() const { return m_vector.isEmpty(); }
+    
+    T* at(unsigned index) const { return m_vector[index].get(); }
+    T* operator[](unsigned index) const { return at(index); }
+
+    class iterator {
+    public:
+        iterator()
+            : m_collection(nullptr)
+            , m_index(0)
+        {
+        }
+
+        iterator(const SparseCollection& collection, unsigned index)
+            : m_collection(&collection)
+            , m_index(findNext(index))
+        {
+        }
+
+        T* operator*()
+        {
+            return m_collection->at(m_index);
+        }
+
+        iterator& operator++()
+        {
+            m_index = findNext(m_index + 1);
+            return *this;
+        }
+
+        bool operator==(const iterator& other) const
+        {
+            ASSERT(m_collection == other.m_collection);
+            return m_index == other.m_index;
+        }
+
+        bool operator!=(const iterator& other) const
+        {
+            return !(*this == other);
+        }
+
+    private:
+        unsigned findNext(unsigned index)
+        {
+            while (index < m_collection->size() && !m_collection->at(index))
+                index++;
+            return index;
+        }
+
+        const SparseCollection* m_collection;
+        unsigned m_index;
+    };
+
+    iterator begin() const { return iterator(*this, 0); }
+    iterator end() const { return iterator(*this, size()); }
+
+private:
+    Vector<std::unique_ptr<T>, 0, UnsafeVectorOverflow> m_vector;
+    Vector<size_t, 0, UnsafeVectorOverflow> m_indexFreeList;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3StackSlot.cpp b/b3/B3StackSlot.cpp
new file mode 100644
index 0000000..4e22014
--- /dev/null
+++ b/b3/B3StackSlot.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3StackSlot.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+StackSlot::~StackSlot()
+{
+}
+
+void StackSlot::dump(PrintStream& out) const
+{
+    out.print("stack", m_index);
+}
+
+void StackSlot::deepDump(PrintStream& out) const
+{
+    out.print("byteSize = ", m_byteSize, ", offsetFromFP = ", m_offsetFromFP);
+}
+
+StackSlot::StackSlot(unsigned byteSize)
+    : m_byteSize(byteSize)
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3StackSlot.h b/b3/B3StackSlot.h
new file mode 100644
index 0000000..4a47509
--- /dev/null
+++ b/b3/B3StackSlot.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3SparseCollection.h"
+#include <limits.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+namespace Air {
+class StackSlot;
+} // namespace Air
+
+class StackSlot {
+    WTF_MAKE_NONCOPYABLE(StackSlot);
+    WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    ~StackSlot();
+
+    unsigned byteSize() const { return m_byteSize; }
+    unsigned index() const { return m_index; }
+
+    // This gets assigned at the end of compilation. But, you can totally pin stack slots. Use the
+    // set method to do that.
+    intptr_t offsetFromFP() const { return m_offsetFromFP; }
+
+    // Note that this is meaningless unless the stack slot is Locked.
+    void setOffsetFromFP(intptr_t value)
+    {
+        m_offsetFromFP = value;
+    }
+
+    void dump(PrintStream&) const;
+    void deepDump(PrintStream&) const;
+
+private:
+    friend class Air::StackSlot;
+    friend class Procedure;
+    friend class SparseCollection<StackSlot>;
+
+    StackSlot(unsigned byteSize);
+
+    unsigned m_index { UINT_MAX };
+    unsigned m_byteSize { 0 };
+    intptr_t m_offsetFromFP { 0 };
+};
+
+class DeepStackSlotDump {
+public:
+    DeepStackSlotDump(const StackSlot* slot)
+        : m_slot(slot)
+    {
+    }
+
+    void dump(PrintStream& out) const
+    {
+        if (m_slot)
+            m_slot->deepDump(out);
+        else
+            out.print("<null>");
+    }
+
+private:
+    const StackSlot* m_slot;
+};
+
+inline DeepStackSlotDump deepDump(const StackSlot* slot)
+{
+    return DeepStackSlotDump(slot);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3StackmapGenerationParams.cpp b/b3/B3StackmapGenerationParams.cpp
new file mode 100644
index 0000000..0a07e4e
--- /dev/null
+++ b/b3/B3StackmapGenerationParams.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3StackmapGenerationParams.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirGenerationContext.h"
+#include "B3StackmapValue.h"
+
+namespace JSC { namespace B3 {
+
+using namespace Air;
+
+const RegisterSet& StackmapGenerationParams::usedRegisters() const
+{
+    return m_value->m_usedRegisters;
+}
+
+RegisterSet StackmapGenerationParams::unavailableRegisters() const
+{
+    RegisterSet result = usedRegisters();
+    
+    RegisterSet unsavedCalleeSaves = RegisterSet::vmCalleeSaveRegisters();
+    for (const RegisterAtOffset& regAtOffset : m_context.code->calleeSaveRegisters())
+        unsavedCalleeSaves.clear(regAtOffset.reg());
+
+    result.merge(unsavedCalleeSaves);
+
+    for (GPRReg gpr : m_gpScratch)
+        result.clear(gpr);
+    for (FPRReg fpr : m_fpScratch)
+        result.clear(fpr);
+    
+    return result;
+}
+
+Vector<Box<CCallHelpers::Label>> StackmapGenerationParams::successorLabels() const
+{
+    RELEASE_ASSERT(m_context.indexInBlock == m_context.currentBlock->size() - 1);
+    RELEASE_ASSERT(m_value->effects().terminal);
+    
+    Vector<Box<CCallHelpers::Label>> result(m_context.currentBlock->numSuccessors());
+    for (unsigned i = m_context.currentBlock->numSuccessors(); i--;)
+        result[i] = m_context.blockLabels[m_context.currentBlock->successorBlock(i)];
+    return result;
+}
+
+bool StackmapGenerationParams::fallsThroughToSuccessor(unsigned successorIndex) const
+{
+    RELEASE_ASSERT(m_context.indexInBlock == m_context.currentBlock->size() - 1);
+    RELEASE_ASSERT(m_value->effects().terminal);
+    
+    Air::BasicBlock* successor = m_context.currentBlock->successorBlock(successorIndex);
+    Air::BasicBlock* nextBlock = m_context.code->findNextBlock(m_context.currentBlock);
+    return successor == nextBlock;
+}
+
+Procedure& StackmapGenerationParams::proc() const
+{
+    return m_context.code->proc();
+}
+
+StackmapGenerationParams::StackmapGenerationParams(
+    StackmapValue* value, const Vector<ValueRep>& reps, Air::GenerationContext& context)
+    : m_value(value)
+    , m_reps(reps)
+    , m_context(context)
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3StackmapGenerationParams.h b/b3/B3StackmapGenerationParams.h
new file mode 100644
index 0000000..31d19ed
--- /dev/null
+++ b/b3/B3StackmapGenerationParams.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirGenerationContext.h"
+#include "B3ValueRep.h"
+#include "CCallHelpers.h"
+#include "RegisterSet.h"
+#include <wtf/Box.h>
+
+namespace JSC { namespace B3 {
+
+class CheckSpecial;
+class PatchpointSpecial;
+class Procedure;
+class StackmapValue;
+
+// NOTE: It's possible to capture StackmapGenerationParams by value, but not all of the methods will
+// work if you do that.
+class StackmapGenerationParams {
+public:
+    // This is the stackmap value that we're generating.
+    StackmapValue* value() const { return m_value; }
+    
+    // This tells you the actual value representations that were chosen. This is usually different
+    // from the constraints we supplied.
+    const Vector<ValueRep>& reps() const { return m_reps; };
+
+    // Usually we wish to access the reps. We make this easy by making ourselves appear to be a
+    // collection of reps.
+    unsigned size() const { return m_reps.size(); }
+    const ValueRep& at(unsigned index) const { return m_reps[index]; }
+    const ValueRep& operator[](unsigned index) const { return at(index); }
+    Vector<ValueRep>::const_iterator begin() const { return m_reps.begin(); }
+    Vector<ValueRep>::const_iterator end() const { return m_reps.end(); }
+    
+    // This tells you the registers that were used.
+    const RegisterSet& usedRegisters() const;
+
+    // This is a useful helper if you want to do register allocation inside of a patchpoint. The
+    // usedRegisters() set is not directly useful for this purpose because:
+    //
+    // - You can only use callee-save registers for scratch if they were saved in the prologue. So,
+    //   if a register is callee-save, it's not enough that it's not in usedRegisters().
+    //
+    // - Scratch registers are going to be in usedRegisters() at the patchpoint. So, if you want to
+    //   find one of your requested scratch registers using usedRegisters(), you'll have a bad time.
+    //
+    // This gives you the used register set that's useful for allocating scratch registers. This set
+    // is defined as:
+    //
+    //     (usedRegisters() | (RegisterSet::calleeSaveRegisters() - proc.calleeSaveRegisters()))
+    //     - gpScratchRegisters - fpScratchRegisters
+    //
+    // I.e. it is like usedRegisters() but also includes unsaved callee-saves and excludes scratch
+    // registers.
+    JS_EXPORT_PRIVATE RegisterSet unavailableRegisters() const;
+
+    GPRReg gpScratch(unsigned index) const { return m_gpScratch[index]; }
+    FPRReg fpScratch(unsigned index) const { return m_fpScratch[index]; }
+    
+    // This is computed lazily, so it won't work if you capture StackmapGenerationParams by value.
+    // These labels will get populated before any late paths or link tasks execute.
+    JS_EXPORT_PRIVATE Vector<Box<CCallHelpers::Label>> successorLabels() const;
+    
+    // This is computed lazily, so it won't work if you capture StackmapGenerationParams by value.
+    // Returns true if the successor at the given index is going to be emitted right after the
+    // patchpoint.
+    JS_EXPORT_PRIVATE bool fallsThroughToSuccessor(unsigned successorIndex) const;
+
+    // This is provided for convenience; it means that you don't have to capture it if you don't want to.
+    JS_EXPORT_PRIVATE Procedure& proc() const;
+    
+    // The Air::GenerationContext gives you even more power.
+    Air::GenerationContext& context() const { return m_context; };
+
+    template<typename Functor>
+    void addLatePath(const Functor& functor) const
+    {
+        context().latePaths.append(
+            createSharedTask<Air::GenerationContext::LatePathFunction>(
+                [=] (CCallHelpers& jit, Air::GenerationContext&) {
+                    functor(jit);
+                }));
+    }
+
+private:
+    friend class CheckSpecial;
+    friend class PatchpointSpecial;
+    
+    StackmapGenerationParams(StackmapValue*, const Vector<ValueRep>& reps, Air::GenerationContext&);
+
+    StackmapValue* m_value;
+    Vector<ValueRep> m_reps;
+    Vector<GPRReg> m_gpScratch;
+    Vector<FPRReg> m_fpScratch;
+    Air::GenerationContext& m_context;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3StackmapSpecial.cpp b/b3/B3StackmapSpecial.cpp
new file mode 100644
index 0000000..b5aa6c3
--- /dev/null
+++ b/b3/B3StackmapSpecial.cpp
@@ -0,0 +1,304 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3StackmapSpecial.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirGenerationContext.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 {
+
+using namespace Air;
+
+StackmapSpecial::StackmapSpecial()
+{
+}
+
+StackmapSpecial::~StackmapSpecial()
+{
+}
+
+void StackmapSpecial::reportUsedRegisters(Inst& inst, const RegisterSet& usedRegisters)
+{
+    StackmapValue* value = inst.origin->as<StackmapValue>();
+    ASSERT(value);
+
+    // FIXME: If the Inst that uses the StackmapSpecial gets duplicated, then we end up merging used
+    // register sets from multiple places. This currently won't happen since Air doesn't have taildup
+    // or things like that. But maybe eventually it could be a problem.
+    value->m_usedRegisters.merge(usedRegisters);
+}
+
+RegisterSet StackmapSpecial::extraClobberedRegs(Inst& inst)
+{
+    StackmapValue* value = inst.origin->as<StackmapValue>();
+    ASSERT(value);
+
+    return value->lateClobbered();
+}
+
+RegisterSet StackmapSpecial::extraEarlyClobberedRegs(Inst& inst)
+{
+    StackmapValue* value = inst.origin->as<StackmapValue>();
+    ASSERT(value);
+
+    return value->earlyClobbered();
+}
+
+void StackmapSpecial::forEachArgImpl(
+    unsigned numIgnoredB3Args, unsigned numIgnoredAirArgs,
+    Inst& inst, RoleMode roleMode, std::optional<unsigned> firstRecoverableIndex,
+    const ScopedLambda<Inst::EachArgCallback>& callback)
+{
+    StackmapValue* value = inst.origin->as<StackmapValue>();
+    ASSERT(value);
+
+    // Check that insane things have not happened.
+    ASSERT(inst.args.size() >= numIgnoredAirArgs);
+    ASSERT(value->children().size() >= numIgnoredB3Args);
+    ASSERT(inst.args.size() - numIgnoredAirArgs >= value->children().size() - numIgnoredB3Args);
+    
+    for (unsigned i = 0; i < value->children().size() - numIgnoredB3Args; ++i) {
+        Arg& arg = inst.args[i + numIgnoredAirArgs];
+        ConstrainedValue child = value->constrainedChild(i + numIgnoredB3Args);
+
+        Arg::Role role;
+        switch (roleMode) {
+        case ForceLateUseUnlessRecoverable:
+            ASSERT(firstRecoverableIndex);
+            if (arg != inst.args[*firstRecoverableIndex] && arg != inst.args[*firstRecoverableIndex + 1]) {
+                role = Arg::LateColdUse;
+                break;
+            }
+            FALLTHROUGH;
+        case SameAsRep:
+            switch (child.rep().kind()) {
+            case ValueRep::WarmAny:
+            case ValueRep::SomeRegister:
+            case ValueRep::Register:
+            case ValueRep::Stack:
+            case ValueRep::StackArgument:
+            case ValueRep::Constant:
+                role = Arg::Use;
+                break;
+            case ValueRep::LateRegister:
+                role = Arg::LateUse;
+                break;
+            case ValueRep::ColdAny:
+                role = Arg::ColdUse;
+                break;
+            case ValueRep::LateColdAny:
+                role = Arg::LateColdUse;
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            break;
+        case ForceLateUse:
+            role = Arg::LateColdUse;
+            break;
+        }
+
+        Type type = child.value()->type();
+        callback(arg, role, Arg::typeForB3Type(type), Arg::widthForB3Type(type));
+    }
+}
+
+bool StackmapSpecial::isValidImpl(
+    unsigned numIgnoredB3Args, unsigned numIgnoredAirArgs,
+    Inst& inst)
+{
+    StackmapValue* value = inst.origin->as<StackmapValue>();
+    ASSERT(value);
+
+    // Check that insane things have not happened.
+    ASSERT(inst.args.size() >= numIgnoredAirArgs);
+    ASSERT(value->children().size() >= numIgnoredB3Args);
+
+    // For the Inst to be valid, it needs to have the right number of arguments.
+    if (inst.args.size() - numIgnoredAirArgs < value->children().size() - numIgnoredB3Args)
+        return false;
+
+    // Regardless of constraints, stackmaps have some basic requirements for their arguments. For
+    // example, you can't have a non-FP-offset address. This verifies those conditions as well as the
+    // argument types.
+    for (unsigned i = 0; i < value->children().size() - numIgnoredB3Args; ++i) {
+        Value* child = value->child(i + numIgnoredB3Args);
+        Arg& arg = inst.args[i + numIgnoredAirArgs];
+
+        if (!isArgValidForValue(arg, child))
+            return false;
+    }
+
+    // The number of constraints has to be no greater than the number of B3 children.
+    ASSERT(value->m_reps.size() <= value->children().size());
+
+    // Verify any explicitly supplied constraints.
+    for (unsigned i = numIgnoredB3Args; i < value->m_reps.size(); ++i) {
+        ValueRep& rep = value->m_reps[i];
+        Arg& arg = inst.args[i - numIgnoredB3Args + numIgnoredAirArgs];
+
+        if (!isArgValidForRep(code(), arg, rep))
+            return false;
+    }
+
+    return true;
+}
+
+bool StackmapSpecial::admitsStackImpl(
+    unsigned numIgnoredB3Args, unsigned numIgnoredAirArgs,
+    Inst& inst, unsigned argIndex)
+{
+    StackmapValue* value = inst.origin->as<StackmapValue>();
+    ASSERT(value);
+
+    unsigned stackmapArgIndex = argIndex - numIgnoredAirArgs + numIgnoredB3Args;
+
+    if (stackmapArgIndex >= value->numChildren()) {
+        // It's not a stackmap argument, so as far as we are concerned, it doesn't admit stack.
+        return false;
+    }
+
+    if (stackmapArgIndex >= value->m_reps.size()) {
+        // This means that there was no constraint.
+        return true;
+    }
+    
+    // We only admit stack for Any's, since Stack is not a valid input constraint, and StackArgument
+    // translates to a CallArg in Air.
+    if (value->m_reps[stackmapArgIndex].isAny())
+        return true;
+
+    return false;
+}
+
+Vector<ValueRep> StackmapSpecial::repsImpl(
+    GenerationContext& context, unsigned numIgnoredB3Args, unsigned numIgnoredAirArgs, Inst& inst)
+{
+    Vector<ValueRep> result;
+    for (unsigned i = 0; i < inst.origin->numChildren() - numIgnoredB3Args; ++i)
+        result.append(repForArg(*context.code, inst.args[i + numIgnoredAirArgs]));
+    return result;
+}
+
+bool StackmapSpecial::isArgValidForValue(const Air::Arg& arg, Value* value)
+{
+    switch (arg.kind()) {
+    case Arg::Tmp:
+    case Arg::Imm:
+    case Arg::BigImm:
+        break;
+    default:
+        if (!arg.isStackMemory())
+            return false;
+        break;
+    }
+
+    return arg.canRepresent(value);
+}
+
+bool StackmapSpecial::isArgValidForRep(Air::Code& code, const Air::Arg& arg, const ValueRep& rep)
+{
+    switch (rep.kind()) {
+    case ValueRep::WarmAny:
+    case ValueRep::ColdAny:
+    case ValueRep::LateColdAny:
+        // We already verified by isArgValidForValue().
+        return true;
+    case ValueRep::SomeRegister:
+    case ValueRep::SomeEarlyRegister:
+        return arg.isTmp();
+    case ValueRep::LateRegister:
+    case ValueRep::Register:
+        return arg == Tmp(rep.reg());
+    case ValueRep::StackArgument:
+        if (arg == Arg::callArg(rep.offsetFromSP()))
+            return true;
+        if (arg.isAddr() && code.frameSize()) {
+            if (arg.base() == Tmp(GPRInfo::callFrameRegister)
+                && arg.offset() == rep.offsetFromSP() - code.frameSize())
+                return true;
+            if (arg.base() == Tmp(MacroAssembler::stackPointerRegister)
+                && arg.offset() == rep.offsetFromSP())
+                return true;
+        }
+        return false;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
+ValueRep StackmapSpecial::repForArg(Code& code, const Arg& arg)
+{
+    switch (arg.kind()) {
+    case Arg::Tmp:
+        return ValueRep::reg(arg.reg());
+        break;
+    case Arg::Imm:
+    case Arg::BigImm:
+        return ValueRep::constant(arg.value());
+        break;
+    case Arg::Addr:
+        if (arg.base() == Tmp(GPRInfo::callFrameRegister))
+            return ValueRep::stack(arg.offset());
+        ASSERT(arg.base() == Tmp(MacroAssembler::stackPointerRegister));
+        return ValueRep::stack(arg.offset() - static_cast<int32_t>(code.frameSize()));
+    default:
+        ASSERT_NOT_REACHED();
+        return ValueRep();
+    }
+}
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+using namespace JSC::B3;
+
+void printInternal(PrintStream& out, StackmapSpecial::RoleMode mode)
+{
+    switch (mode) {
+    case StackmapSpecial::SameAsRep:
+        out.print("SameAsRep");
+        return;
+    case StackmapSpecial::ForceLateUseUnlessRecoverable:
+        out.print("ForceLateUseUnlessRecoverable");
+        return;
+    case StackmapSpecial::ForceLateUse:
+        out.print("ForceLateUse");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3StackmapSpecial.h b/b3/B3StackmapSpecial.h
new file mode 100644
index 0000000..97a0813
--- /dev/null
+++ b/b3/B3StackmapSpecial.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "AirSpecial.h"
+#include "B3ValueRep.h"
+
+namespace JSC { namespace B3 {
+
+namespace Air { class Code; }
+
+// This is a base class for specials that have stackmaps. Note that it can find the Stackmap by
+// asking for the Inst's origin. Hence, these objects don't need to even hold a reference to the
+// Stackmap.
+
+class StackmapSpecial : public Air::Special {
+public:
+    StackmapSpecial();
+    virtual ~StackmapSpecial();
+
+    enum RoleMode : int8_t {
+        SameAsRep,
+        ForceLateUseUnlessRecoverable,
+        ForceLateUse
+    };
+
+protected:
+    void reportUsedRegisters(Air::Inst&, const RegisterSet&) override;
+    RegisterSet extraEarlyClobberedRegs(Air::Inst&) override;
+    RegisterSet extraClobberedRegs(Air::Inst&) override;
+
+    // Note that this does not override generate() or dumpImpl()/deepDumpImpl(). We have many some
+    // subclasses that implement that.
+    void forEachArgImpl(
+        unsigned numIgnoredB3Args, unsigned numIgnoredAirArgs,
+        Air::Inst&, RoleMode, std::optional<unsigned> firstRecoverableIndex,
+        const ScopedLambda<Air::Inst::EachArgCallback>&);
+    
+    bool isValidImpl(
+        unsigned numIgnoredB3Args, unsigned numIgnoredAirArgs,
+        Air::Inst&);
+    bool admitsStackImpl(
+        unsigned numIgnoredB3Args, unsigned numIgnoredAirArgs,
+        Air::Inst&, unsigned argIndex);
+
+    // Appends the reps for the Inst's args, starting with numIgnoredArgs, to the given vector.
+    Vector<ValueRep> repsImpl(
+        Air::GenerationContext&, unsigned numIgnoredB3Args, unsigned numIgnoredAirArgs, Air::Inst&);
+
+    static bool isArgValidForValue(const Air::Arg&, Value*);
+    static bool isArgValidForRep(Air::Code&, const Air::Arg&, const ValueRep&);
+    static ValueRep repForArg(Air::Code&, const Air::Arg&);
+};
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::B3::StackmapSpecial::RoleMode);
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3StackmapValue.cpp b/b3/B3StackmapValue.cpp
new file mode 100644
index 0000000..9b0db2f
--- /dev/null
+++ b/b3/B3StackmapValue.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3StackmapValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+StackmapValue::~StackmapValue()
+{
+}
+
+void StackmapValue::append(Value* value, const ValueRep& rep)
+{
+    if (rep == ValueRep::ColdAny) {
+        children().append(value);
+        return;
+    }
+
+    while (m_reps.size() < numChildren())
+        m_reps.append(ValueRep::ColdAny);
+
+    children().append(value);
+    m_reps.append(rep);
+}
+
+void StackmapValue::appendSomeRegister(Value* value)
+{
+    append(ConstrainedValue(value, ValueRep::SomeRegister));
+}
+
+void StackmapValue::setConstrainedChild(unsigned index, const ConstrainedValue& constrainedValue)
+{
+    child(index) = constrainedValue.value();
+    setConstraint(index, constrainedValue.rep());
+}
+
+void StackmapValue::setConstraint(unsigned index, const ValueRep& rep)
+{
+    if (rep == ValueRep(ValueRep::ColdAny))
+        return;
+
+    while (m_reps.size() <= index)
+        m_reps.append(ValueRep::ColdAny);
+
+    m_reps[index] = rep;
+}
+
+void StackmapValue::dumpChildren(CommaPrinter& comma, PrintStream& out) const
+{
+    for (ConstrainedValue value : constrainedChildren())
+        out.print(comma, value);
+}
+
+void StackmapValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(
+        comma, "generator = ", RawPointer(m_generator.get()), ", earlyClobbered = ", m_earlyClobbered,
+        ", lateClobbered = ", m_lateClobbered, ", usedRegisters = ", m_usedRegisters);
+}
+
+StackmapValue::StackmapValue(CheckedOpcodeTag, Kind kind, Type type, Origin origin)
+    : Value(CheckedOpcode, kind, type, origin)
+{
+    ASSERT(accepts(kind));
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3StackmapValue.h b/b3/B3StackmapValue.h
new file mode 100644
index 0000000..66fc644
--- /dev/null
+++ b/b3/B3StackmapValue.h
@@ -0,0 +1,308 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3ConstrainedValue.h"
+#include "B3Value.h"
+#include "B3ValueRep.h"
+#include "CCallHelpers.h"
+#include "RegisterSet.h"
+#include <wtf/SharedTask.h>
+
+namespace JSC { namespace B3 {
+
+class StackmapGenerationParams;
+
+typedef void StackmapGeneratorFunction(CCallHelpers&, const StackmapGenerationParams&);
+typedef SharedTask<StackmapGeneratorFunction> StackmapGenerator;
+
+class JS_EXPORT_PRIVATE StackmapValue : public Value {
+public:
+    static bool accepts(Kind kind)
+    {
+        // This needs to include opcodes of all subclasses.
+        switch (kind.opcode()) {
+        case CheckAdd:
+        case CheckSub:
+        case CheckMul:
+        case Check:
+        case Patchpoint:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    ~StackmapValue();
+
+    // Use this to add children. Note that you could also add children by doing
+    // children().append(). That will work fine, but it's not recommended.
+    void append(const ConstrainedValue& value)
+    {
+        append(value.value(), value.rep());
+    }
+
+    void append(Value*, const ValueRep&);
+
+    template<typename VectorType>
+    void appendVector(const VectorType& vector)
+    {
+        for (const auto& value : vector)
+            append(value);
+    }
+
+    // Helper for appending a bunch of values with some ValueRep.
+    template<typename VectorType>
+    void appendVectorWithRep(const VectorType& vector, const ValueRep& rep)
+    {
+        for (Value* value : vector)
+            append(value, rep);
+    }
+
+    // Helper for appending cold any's. This often used by clients to implement OSR.
+    template<typename VectorType>
+    void appendColdAnys(const VectorType& vector)
+    {
+        appendVectorWithRep(vector, ValueRep::ColdAny);
+    }
+    template<typename VectorType>
+    void appendLateColdAnys(const VectorType& vector)
+    {
+        appendVectorWithRep(vector, ValueRep::LateColdAny);
+    }
+
+    // This is a helper for something you might do a lot of: append a value that should be constrained
+    // to SomeRegister.
+    void appendSomeRegister(Value*);
+
+    const Vector<ValueRep>& reps() const { return m_reps; }
+
+    // Stackmaps allow you to specify that the operation may clobber some registers. Clobbering a register
+    // means that the operation appears to store a value into the register, but the compiler doesn't
+    // assume to know anything about what kind of value might have been stored. In B3's model of
+    // execution, registers are read or written at instruction boundaries rather than inside the
+    // instructions themselves. A register could be read or written immediately before the instruction
+    // executes, or immediately after. Note that at a boundary between instruction A and instruction B we
+    // simultaneously look at what A does after it executes and what B does before it executes. This is
+    // because when the compiler considers what happens to registers, it views the boundary between two
+    // instructions as a kind of atomic point where the late effects of A happen at the same time as the
+    // early effects of B.
+    //
+    // The compiler views a stackmap as a single instruction, even though of course the stackmap may be
+    // composed of any number of instructions (if it's a Patchpoint). You can claim that a stackmap value
+    // clobbers a set of registers before the stackmap's instruction or after. Clobbering before is called
+    // early clobber, while clobbering after is called late clobber.
+    //
+    // This is quite flexible but it has its limitations. Any register listed as an early clobber will
+    // interfere with all uses of the stackmap. Any register listed as a late clobber will interfere with
+    // all defs of the stackmap (i.e. the result). This means that it's currently not possible to claim
+    // to clobber a register while still allowing that register to be used for both an input and an output
+    // of the instruction. It just so happens that B3's sole client (the FTL) currently never wants to
+    // convey such a constraint, but it will want it eventually (FIXME:
+    // https://bugs.webkit.org/show_bug.cgi?id=151823).
+    //
+    // Note that a common use case of early clobber sets is to indicate that this is the set of registers
+    // that shall not be used for inputs to the value. But B3 supports two different ways of specifying
+    // this, the other being LateUse in combination with late clobber (not yet available to stackmaps
+    // directly, FIXME: https://bugs.webkit.org/show_bug.cgi?id=151335). A late use makes the use of that
+    // value appear to happen after the instruction. This means that a late use cannot use the same
+    // register as the result and it cannot use the same register as either early or late clobbered
+    // registers. Late uses are usually a better way of saying that a clobbered register cannot be used
+    // for an input. Early clobber means that some register(s) interfere with *all* inputs, while LateUse
+    // means that some value interferes with whatever is live after the instruction. Below is a list of
+    // examples of how the FTL can handle its various kinds of scenarios using a combination of early
+    // clobber, late clobber, and late use. These examples are for X86_64, w.l.o.g.
+    //
+    // Basic ById patchpoint: Early and late clobber of r11. Early clobber prevents any inputs from using
+    // r11 since that would mess with the MacroAssembler's assumptions when we
+    // AllowMacroScratchRegisterUsage. Late clobber tells B3 that the patchpoint may overwrite r11.
+    //
+    // ById patchpoint in a try block with some live state: This might throw an exception after already
+    // assigning to the result. So, this should LateUse all stackmap values to ensure that the stackmap
+    // values don't interfere with the result. Note that we do not LateUse the non-OSR inputs of the ById
+    // since LateUse implies that the use is cold: the register allocator will assume that the use is not
+    // important for the critical path. Also, early and late clobber of r11.
+    //
+    // Basic ByIdFlush patchpoint: We could do Flush the same way we did it with LLVM: ignore it and let
+    // PolymorphicAccess figure it out. Or, we could add internal clobber support (FIXME:
+    // https://bugs.webkit.org/show_bug.cgi?id=151823). Or, we could do it by early clobbering r11, late
+    // clobbering all volatile registers, and constraining the result to some register. Or, we could do
+    // that but leave the result constrained to SomeRegister, which will cause it to use a callee-save
+    // register. Internal clobber support would allow us to use SomeRegister while getting the result into
+    // a volatile register.
+    //
+    // ByIdFlush patchpoint in a try block with some live state: LateUse all for-OSR stackmap values,
+    // early clobber of r11 to prevent the other inputs from using r11, and late clobber of all volatile
+    // registers to make way for the call. To handle the result, we could do any of what is listed in the
+    // previous paragraph.
+    //
+    // Basic JS call: Force all non-OSR inputs into specific locations (register, stack, whatever).
+    // All volatile registers are late-clobbered. The output is constrained to a register as well.
+    //
+    // JS call in a try block with some live state: LateUse all for-OSR stackmap values, fully constrain
+    // all non-OSR inputs and the result, and late clobber all volatile registers.
+    //
+    // JS tail call: Pass all inputs as a warm variant of Any (FIXME:
+    // https://bugs.webkit.org/show_bug.cgi?id=151811).
+    //
+    // Note that we cannot yet do all of these things because although Air already supports all of these
+    // various forms of uses (LateUse and warm unconstrained use), B3 doesn't yet expose all of it. The
+    // bugs are:
+    // https://bugs.webkit.org/show_bug.cgi?id=151335 (LateUse)
+    // https://bugs.webkit.org/show_bug.cgi?id=151811 (warm Any)
+    void clobberEarly(const RegisterSet& set)
+    {
+        m_earlyClobbered.merge(set);
+    }
+
+    void clobberLate(const RegisterSet& set)
+    {
+        m_lateClobbered.merge(set);
+    }
+
+    void clobber(const RegisterSet& set)
+    {
+        clobberEarly(set);
+        clobberLate(set);
+    }
+
+    RegisterSet& earlyClobbered() { return m_earlyClobbered; }
+    RegisterSet& lateClobbered() { return m_lateClobbered; }
+    const RegisterSet& earlyClobbered() const { return m_earlyClobbered; }
+    const RegisterSet& lateClobbered() const { return m_lateClobbered; }
+
+    void setGenerator(RefPtr<StackmapGenerator> generator)
+    {
+        m_generator = generator;
+    }
+
+    template<typename Functor>
+    void setGenerator(const Functor& functor)
+    {
+        m_generator = createSharedTask<StackmapGeneratorFunction>(functor);
+    }
+
+    RefPtr<StackmapGenerator> generator() const { return m_generator; }
+
+    ConstrainedValue constrainedChild(unsigned index) const
+    {
+        return ConstrainedValue(child(index), index < m_reps.size() ? m_reps[index] : ValueRep::ColdAny);
+    }
+
+    void setConstrainedChild(unsigned index, const ConstrainedValue&);
+    
+    void setConstraint(unsigned index, const ValueRep&);
+
+    class ConstrainedValueCollection {
+    public:
+        ConstrainedValueCollection(const StackmapValue& value)
+            : m_value(value)
+        {
+        }
+
+        unsigned size() const { return m_value.numChildren(); }
+        
+        ConstrainedValue at(unsigned index) const { return m_value.constrainedChild(index); }
+
+        ConstrainedValue operator[](unsigned index) const { return at(index); }
+
+        class iterator {
+        public:
+            iterator()
+                : m_collection(nullptr)
+                , m_index(0)
+            {
+            }
+
+            iterator(const ConstrainedValueCollection& collection, unsigned index)
+                : m_collection(&collection)
+                , m_index(index)
+            {
+            }
+
+            ConstrainedValue operator*() const
+            {
+                return m_collection->at(m_index);
+            }
+
+            iterator& operator++()
+            {
+                m_index++;
+                return *this;
+            }
+
+            bool operator==(const iterator& other) const
+            {
+                ASSERT(m_collection == other.m_collection);
+                return m_index == other.m_index;
+            }
+
+            bool operator!=(const iterator& other) const
+            {
+                return !(*this == other);
+            }
+            
+        private:
+            const ConstrainedValueCollection* m_collection;
+            unsigned m_index;
+        };
+
+        iterator begin() const { return iterator(*this, 0); }
+        iterator end() const { return iterator(*this, size()); }
+
+    private:
+        const StackmapValue& m_value;
+    };
+
+    ConstrainedValueCollection constrainedChildren() const
+    {
+        return ConstrainedValueCollection(*this);
+    }
+
+protected:
+    void dumpChildren(CommaPrinter&, PrintStream&) const override;
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    StackmapValue(CheckedOpcodeTag, Kind, Type, Origin);
+
+private:
+    friend class CheckSpecial;
+    friend class PatchpointSpecial;
+    friend class StackmapGenerationParams;
+    friend class StackmapSpecial;
+    
+    Vector<ValueRep> m_reps;
+    RefPtr<StackmapGenerator> m_generator;
+    RegisterSet m_earlyClobbered;
+    RegisterSet m_lateClobbered;
+    RegisterSet m_usedRegisters; // Stackmaps could be further duplicated by Air, but that's unlikely, so we just merge the used registers sets if that were to happen.
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SuccessorCollection.h b/b3/B3SuccessorCollection.h
new file mode 100644
index 0000000..0a7df24
--- /dev/null
+++ b/b3/B3SuccessorCollection.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+// This is a generic wrapper around lists of frequented blocks, which gives you just the blocks.
+
+template<typename BasicBlock, typename SuccessorList>
+class SuccessorCollection {
+public:
+    SuccessorCollection(SuccessorList& list)
+        : m_list(list)
+    {
+    }
+
+    size_t size() const { return m_list.size(); }
+    BasicBlock* at(size_t index) const { return m_list[index].block(); }
+    BasicBlock*& at(size_t index) { return m_list[index].block(); }
+    BasicBlock* operator[](size_t index) const { return at(index); }
+    BasicBlock*& operator[](size_t index) { return at(index); }
+
+    class iterator {
+    public:
+        iterator()
+            : m_collection(nullptr)
+            , m_index(0)
+        {
+        }
+
+        iterator(SuccessorCollection& collection, size_t index)
+            : m_collection(&collection)
+            , m_index(index)
+        {
+        }
+
+        BasicBlock*& operator*() const
+        {
+            return m_collection->at(m_index);
+        }
+
+        iterator& operator++()
+        {
+            m_index++;
+            return *this;
+        }
+
+        bool operator==(const iterator& other) const
+        {
+            ASSERT(m_collection == other.m_collection);
+            return m_index == other.m_index;
+        }
+
+        bool operator!=(const iterator& other) const
+        {
+            return !(*this == other);
+        }
+
+    private:
+        SuccessorCollection* m_collection;
+        size_t m_index;
+    };
+
+    iterator begin() { return iterator(*this, 0); }
+    iterator end() { return iterator(*this, size()); }
+
+    class const_iterator {
+    public:
+        const_iterator()
+            : m_collection(nullptr)
+            , m_index(0)
+        {
+        }
+
+        const_iterator(const SuccessorCollection& collection, size_t index)
+            : m_collection(&collection)
+            , m_index(index)
+        {
+        }
+
+        BasicBlock* operator*() const
+        {
+            return m_collection->at(m_index);
+        }
+
+        const_iterator& operator++()
+        {
+            m_index++;
+            return *this;
+        }
+
+        bool operator==(const const_iterator& other) const
+        {
+            ASSERT(m_collection == other.m_collection);
+            return m_index == other.m_index;
+        }
+
+        bool operator!=(const const_iterator& other) const
+        {
+            return !(*this == other);
+        }
+
+    private:
+        const SuccessorCollection* m_collection;
+        size_t m_index;
+    };
+
+    const_iterator begin() const { return const_iterator(*this, 0); }
+    const_iterator end() const { return const_iterator(*this, size()); }
+
+private:
+    SuccessorList& m_list;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SwitchCase.cpp b/b3/B3SwitchCase.cpp
new file mode 100644
index 0000000..d05332b
--- /dev/null
+++ b/b3/B3SwitchCase.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3SwitchCase.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlock.h"
+
+namespace JSC { namespace B3 {
+
+void SwitchCase::dump(PrintStream& out) const
+{
+    out.print(m_caseValue, "->", m_target);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SwitchCase.h b/b3/B3SwitchCase.h
new file mode 100644
index 0000000..5ba6a48
--- /dev/null
+++ b/b3/B3SwitchCase.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3FrequentedBlock.h"
+#include <wtf/StdLibExtras.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+class SwitchCase {
+public:
+    SwitchCase()
+    {
+    }
+
+    SwitchCase(int64_t caseValue, const FrequentedBlock& target)
+        : m_caseValue(caseValue)
+        , m_target(target)
+    {
+    }
+
+    explicit operator bool() const { return !!m_target; }
+
+    int64_t caseValue() const { return m_caseValue; }
+    FrequentedBlock target() const { return m_target; }
+    BasicBlock* targetBlock() const { return m_target.block(); }
+
+    void dump(PrintStream& out) const;
+
+private:
+    int64_t m_caseValue;
+    FrequentedBlock m_target;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SwitchValue.cpp b/b3/B3SwitchValue.cpp
new file mode 100644
index 0000000..8b88034
--- /dev/null
+++ b/b3/B3SwitchValue.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3SwitchValue.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlock.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 {
+
+SwitchValue::~SwitchValue()
+{
+}
+
+SwitchCase SwitchValue::removeCase(BasicBlock* block, unsigned index)
+{
+    FrequentedBlock resultBlock = block->successor(index);
+    int64_t resultValue = m_values[index];
+    block->successor(index) = block->successors().last();
+    block->successors().removeLast();
+    m_values[index] = m_values.last();
+    m_values.removeLast();
+    return SwitchCase(resultValue, resultBlock);
+}
+
+bool SwitchValue::hasFallThrough(const BasicBlock* block) const
+{
+    unsigned numSuccessors = block->numSuccessors();
+    unsigned numValues = m_values.size();
+    RELEASE_ASSERT(numValues == numSuccessors || numValues + 1 == numSuccessors);
+    
+    return numValues + 1 == numSuccessors;
+}
+
+bool SwitchValue::hasFallThrough() const
+{
+    return hasFallThrough(owner);
+}
+
+void SwitchValue::setFallThrough(BasicBlock* block, const FrequentedBlock& target)
+{
+    if (!hasFallThrough())
+        block->successors().append(target);
+    else
+        block->successors().last() = target;
+    ASSERT(hasFallThrough(block));
+}
+
+void SwitchValue::appendCase(BasicBlock* block, const SwitchCase& switchCase)
+{
+    if (!hasFallThrough())
+        block->successors().append(switchCase.target());
+    else {
+        block->successors().append(block->successors().last());
+        block->successor(block->numSuccessors() - 2) = switchCase.target();
+    }
+    m_values.append(switchCase.caseValue());
+}
+
+void SwitchValue::setFallThrough(const FrequentedBlock& target)
+{
+    setFallThrough(owner, target);
+}
+
+void SwitchValue::appendCase(const SwitchCase& switchCase)
+{
+    appendCase(owner, switchCase);
+}
+
+void SwitchValue::dumpSuccessors(const BasicBlock* block, PrintStream& out) const
+{
+    // We must not crash due to a number-of-successors mismatch! Someone debugging a
+    // number-of-successors bug will want to dump IR!
+    if (numCaseValues() + 1 != block->numSuccessors()) {
+        Value::dumpSuccessors(block, out);
+        return;
+    }
+    
+    out.print(cases(block));
+}
+
+void SwitchValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma, "cases = [", listDump(m_values), "]");
+}
+
+Value* SwitchValue::cloneImpl() const
+{
+    return new SwitchValue(*this);
+}
+
+SwitchValue::SwitchValue(Origin origin, Value* child)
+    : Value(CheckedOpcode, Switch, Void, origin, child)
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3SwitchValue.h b/b3/B3SwitchValue.h
new file mode 100644
index 0000000..a1c27cd
--- /dev/null
+++ b/b3/B3SwitchValue.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3CaseCollection.h"
+#include "B3SwitchCase.h"
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class SwitchValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == Switch; }
+
+    ~SwitchValue();
+
+    // numCaseValues() + 1 == numSuccessors().
+    unsigned numCaseValues() const { return m_values.size(); }
+
+    // The successor for this case value is at the same index.
+    int64_t caseValue(unsigned index) const { return m_values[index]; }
+    
+    const Vector<int64_t>& caseValues() const { return m_values; }
+
+    CaseCollection cases(const BasicBlock* owner) const { return CaseCollection(this, owner); }
+    CaseCollection cases() const { return cases(owner); }
+
+    // This removes the case and reorders things a bit. If you're iterating the cases from 0 to N,
+    // then you can keep iterating after this so long as you revisit this same index (which will now
+    // contain some other case value). This removes the case that was removed.
+    SwitchCase removeCase(BasicBlock*, unsigned index);
+
+    bool hasFallThrough(const BasicBlock*) const;
+    bool hasFallThrough() const;
+
+    // These two functions can be called in any order.
+    void setFallThrough(BasicBlock*, const FrequentedBlock&);
+    void appendCase(BasicBlock*, const SwitchCase&);
+    
+    JS_EXPORT_PRIVATE void setFallThrough(const FrequentedBlock&);
+    JS_EXPORT_PRIVATE void appendCase(const SwitchCase&);
+
+    void dumpSuccessors(const BasicBlock*, PrintStream&) const override;
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    JS_EXPORT_PRIVATE SwitchValue(Origin, Value* child);
+
+    Vector<int64_t> m_values;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3TimingScope.cpp b/b3/B3TimingScope.cpp
new file mode 100644
index 0000000..d8ad421
--- /dev/null
+++ b/b3/B3TimingScope.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3TimingScope.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3Common.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/DataLog.h>
+
+namespace JSC { namespace B3 {
+
+TimingScope::TimingScope(const char* name)
+    : m_name(name)
+{
+    if (shouldMeasurePhaseTiming())
+        m_before = monotonicallyIncreasingTimeMS();
+}
+
+TimingScope::~TimingScope()
+{
+    if (shouldMeasurePhaseTiming()) {
+        double after = monotonicallyIncreasingTimeMS();
+        dataLog("[B3] ", m_name, " took: ", after - m_before, " ms.\n");
+    }
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3TimingScope.h b/b3/B3TimingScope.h
new file mode 100644
index 0000000..a957a0e
--- /dev/null
+++ b/b3/B3TimingScope.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace B3 {
+
+class TimingScope {
+    WTF_MAKE_NONCOPYABLE(TimingScope);
+public:
+    TimingScope(const char* name);
+    ~TimingScope();
+
+private:
+    const char* m_name;
+    double m_before;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Type.cpp b/b3/B3Type.cpp
new file mode 100644
index 0000000..0057eaf
--- /dev/null
+++ b/b3/B3Type.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Type.h"
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC::B3;
+
+void printInternal(PrintStream& out, Type type)
+{
+    switch (type) {
+    case Void:
+        out.print("Void");
+        return;
+    case Int32:
+        out.print("Int32");
+        return;
+    case Int64:
+        out.print("Int64");
+        return;
+    case Float:
+        out.print("Float");
+        return;
+    case Double:
+        out.print("Double");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Type.h b/b3/B3Type.h
new file mode 100644
index 0000000..4ceaa8a
--- /dev/null
+++ b/b3/B3Type.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Common.h"
+#include <wtf/StdLibExtras.h>
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wreturn-type"
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+namespace JSC { namespace B3 {
+
+enum Type : int8_t {
+    Void,
+    Int32,
+    Int64,
+    Float,
+    Double,
+};
+
+inline bool isInt(Type type)
+{
+    return type == Int32 || type == Int64;
+}
+
+inline bool isFloat(Type type)
+{
+    return type == Float || type == Double;
+}
+
+inline Type pointerType()
+{
+    if (is32Bit())
+        return Int32;
+    return Int64;
+}
+
+inline size_t sizeofType(Type type)
+{
+    switch (type) {
+    case Void:
+        return 0;
+    case Int32:
+    case Float:
+        return 4;
+    case Int64:
+    case Double:
+        return 8;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::B3::Type);
+
+} // namespace WTF
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic pop
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3TypeMap.h b/b3/B3TypeMap.h
new file mode 100644
index 0000000..c0ea413
--- /dev/null
+++ b/b3/B3TypeMap.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Type.h"
+#include <wtf/PrintStream.h>
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wreturn-type"
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+namespace JSC { namespace B3 {
+
+template<typename T>
+class TypeMap {
+public:
+    TypeMap()
+        : m_void()
+        , m_int32()
+        , m_int64()
+        , m_float()
+        , m_double()
+    {
+    }
+    
+    T& at(Type type)
+    {
+        switch (type) {
+        case Void:
+            return m_void;
+        case Int32:
+            return m_int32;
+        case Int64:
+            return m_int64;
+        case Float:
+            return m_float;
+        case Double:
+            return m_double;
+        }
+        ASSERT_NOT_REACHED();
+    }
+    
+    const T& at(Type type) const
+    {
+        return bitwise_cast<TypeMap*>(this)->at(type);
+    }
+    
+    T& operator[](Type type)
+    {
+        return at(type);
+    }
+    
+    const T& operator[](Type type) const
+    {
+        return at(type);
+    }
+    
+    void dump(PrintStream& out) const
+    {
+        out.print(
+            "{void = ", m_void,
+            ", int32 = ", m_int32,
+            ", int64 = ", m_int64,
+            ", float = ", m_float,
+            ", double = ", m_double, "}");
+    }
+    
+private:
+    T m_void;
+    T m_int32;
+    T m_int64;
+    T m_float;
+    T m_double;
+};
+
+} } // namespace JSC::B3
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic pop
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3UpsilonValue.cpp b/b3/B3UpsilonValue.cpp
new file mode 100644
index 0000000..c87432f
--- /dev/null
+++ b/b3/B3UpsilonValue.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3UpsilonValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+UpsilonValue::~UpsilonValue()
+{
+}
+
+void UpsilonValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    if (m_phi)
+        out.print(comma, "^", m_phi->index());
+    else {
+        // We want to have a dump for when the Phi isn't set yet, since although such IR won't pass
+        // validation, we may have such IR as an intermediate step.
+        out.print(comma, "^(null)");
+    }
+}
+
+Value* UpsilonValue::cloneImpl() const
+{
+    return new UpsilonValue(*this);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3UpsilonValue.h b/b3/B3UpsilonValue.h
new file mode 100644
index 0000000..4c479e4
--- /dev/null
+++ b/b3/B3UpsilonValue.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE UpsilonValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == Upsilon; }
+
+    ~UpsilonValue();
+
+    Value* phi() const { return m_phi; }
+    void setPhi(Value* phi)
+    {
+        ASSERT(child(0)->type() == phi->type());
+        ASSERT(phi->opcode() == Phi);
+        m_phi = phi;
+    }
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    // Note that passing the Phi during construction is optional. A valid pattern is to first create
+    // the Upsilons without the Phi, then create the Phi, then go back and tell the Upsilons about
+    // the Phi. This allows you to emit code in its natural order.
+    UpsilonValue(Origin origin, Value* value, Value* phi = nullptr)
+        : Value(CheckedOpcode, Upsilon, Void, origin, value)
+        , m_phi(phi)
+    {
+        if (phi)
+            ASSERT(value->type() == phi->type());
+    }
+
+    Value* m_phi;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3UseCounts.cpp b/b3/B3UseCounts.cpp
new file mode 100644
index 0000000..5fe18d4
--- /dev/null
+++ b/b3/B3UseCounts.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3UseCounts.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3Procedure.h"
+
+namespace JSC { namespace B3 {
+
+UseCounts::UseCounts(Procedure& procedure)
+    : m_counts(procedure.values().size())
+{
+    Vector<Value*, 64> children;
+    for (Value* value : procedure.values()) {
+        children.resize(0);
+        for (Value* child : value->children()) {
+            m_counts[child].numUses++;
+            children.append(child);
+        }
+        std::sort(children.begin(), children.end());
+        Value* last = nullptr;
+        for (Value* child : children) {
+            if (child == last)
+                continue;
+
+            m_counts[child].numUsingInstructions++;
+            last = child;
+        }
+    }
+}
+
+UseCounts::~UseCounts()
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3UseCounts.h b/b3/B3UseCounts.h
new file mode 100644
index 0000000..f5a0492
--- /dev/null
+++ b/b3/B3UseCounts.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+#include <wtf/IndexMap.h>
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+class UseCounts {
+public:
+    JS_EXPORT_PRIVATE UseCounts(Procedure&);
+    JS_EXPORT_PRIVATE ~UseCounts();
+
+    unsigned numUses(Value* value) const { return m_counts[value].numUses; }
+    unsigned numUsingInstructions(Value* value) const { return m_counts[value].numUsingInstructions; }
+    
+private:
+    struct Counts {
+        unsigned numUses { 0 };
+        unsigned numUsingInstructions { 0 };
+    };
+    
+    IndexMap<Value, Counts> m_counts;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Validate.cpp b/b3/B3Validate.cpp
new file mode 100644
index 0000000..f7224cf
--- /dev/null
+++ b/b3/B3Validate.cpp
@@ -0,0 +1,601 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Validate.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "B3ArgumentRegValue.h"
+#include "B3BasicBlockInlines.h"
+#include "B3Dominators.h"
+#include "B3MemoryValue.h"
+#include "B3Procedure.h"
+#include "B3SlotBaseValue.h"
+#include "B3StackSlot.h"
+#include "B3SwitchValue.h"
+#include "B3UpsilonValue.h"
+#include "B3ValueInlines.h"
+#include "B3Variable.h"
+#include "B3VariableValue.h"
+#include "B3WasmBoundsCheckValue.h"
+#include <wtf/HashSet.h>
+#include <wtf/StringPrintStream.h>
+#include <wtf/text/CString.h>
+
+namespace JSC { namespace B3 {
+
+namespace {
+
+class Validater {
+public:
+    Validater(Procedure& procedure, const char* dumpBefore)
+        : m_procedure(procedure)
+        , m_dumpBefore(dumpBefore)
+    {
+    }
+
+#define VALIDATE(condition, message) do {                               \
+        if (condition)                                                  \
+            break;                                                      \
+        fail(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, #condition, toCString message); \
+    } while (false)
+
+    void run()
+    {
+        HashSet<BasicBlock*> blocks;
+        HashSet<Value*> valueInProc;
+        HashMap<Value*, unsigned> valueInBlock;
+        HashMap<Value*, BasicBlock*> valueOwner;
+        HashMap<Value*, unsigned> valueIndex;
+
+        for (BasicBlock* block : m_procedure) {
+            blocks.add(block);
+            for (unsigned i = 0; i < block->size(); ++i) {
+                Value* value = block->at(i);
+                valueInBlock.add(value, 0).iterator->value++;
+                valueOwner.add(value, block);
+                valueIndex.add(value, i);
+            }
+        }
+
+        for (Value* value : m_procedure.values())
+            valueInProc.add(value);
+
+        for (Value* value : valueInProc)
+            VALIDATE(valueInBlock.contains(value), ("At ", *value));
+        for (auto& entry : valueInBlock) {
+            VALIDATE(valueInProc.contains(entry.key), ("At ", *entry.key));
+            VALIDATE(entry.value == 1, ("At ", *entry.key));
+        }
+
+        // Compute dominators ourselves to avoid perturbing Procedure.
+        Dominators dominators(m_procedure);
+
+        for (Value* value : valueInProc) {
+            for (Value* child : value->children()) {
+                VALIDATE(child, ("At ", *value));
+                VALIDATE(valueInProc.contains(child), ("At ", *value, "->", pointerDump(child)));
+                if (valueOwner.get(child) == valueOwner.get(value))
+                    VALIDATE(valueIndex.get(value) > valueIndex.get(child), ("At ", *value, "->", pointerDump(child)));
+                else
+                    VALIDATE(dominators.dominates(valueOwner.get(child), valueOwner.get(value)), ("at ", *value, "->", pointerDump(child)));
+            }
+        }
+
+        HashMap<BasicBlock*, HashSet<BasicBlock*>> allPredecessors;
+        for (BasicBlock* block : blocks) {
+            VALIDATE(block->size() >= 1, ("At ", *block));
+            for (unsigned i = 0; i < block->size() - 1; ++i)
+                VALIDATE(!block->at(i)->effects().terminal, ("At ", *block->at(i)));
+            VALIDATE(block->last()->effects().terminal, ("At ", *block->last()));
+            
+            for (BasicBlock* successor : block->successorBlocks()) {
+                allPredecessors.add(successor, HashSet<BasicBlock*>()).iterator->value.add(block);
+                VALIDATE(
+                    blocks.contains(successor), ("At ", *block, "->", pointerDump(successor)));
+            }
+        }
+
+        // Note that this totally allows dead code.
+        for (auto& entry : allPredecessors) {
+            BasicBlock* successor = entry.key;
+            HashSet<BasicBlock*>& predecessors = entry.value;
+            VALIDATE(predecessors == successor->predecessors(), ("At ", *successor));
+        }
+
+        for (Value* value : m_procedure.values()) {
+            for (Value* child : value->children())
+                VALIDATE(child->type() != Void, ("At ", *value, "->", *child));
+            switch (value->opcode()) {
+            case Nop:
+            case Fence:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                break;
+            case Identity:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->type() == value->child(0)->type(), ("At ", *value));
+                VALIDATE(value->type() != Void, ("At ", *value));
+                break;
+            case Const32:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == Int32, ("At ", *value));
+                break;
+            case Const64:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == Int64, ("At ", *value));
+                break;
+            case ConstDouble:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == Double, ("At ", *value));
+                break;
+            case ConstFloat:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == Float, ("At ", *value));
+                break;
+            case Set:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == value->as<VariableValue>()->variable()->type(), ("At ", *value));
+                break;
+            case Get:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == value->as<VariableValue>()->variable()->type(), ("At ", *value));
+                break;
+            case SlotBase:
+            case FramePointer:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == pointerType(), ("At ", *value));
+                break;
+            case ArgumentReg:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(
+                    (value->as<ArgumentRegValue>()->argumentReg().isGPR() ? pointerType() : Double)
+                    == value->type(), ("At ", *value));
+                break;
+            case Add:
+            case Sub:
+            case Mul:
+            case Div:
+            case UDiv:
+            case Mod:
+            case UMod:
+            case BitAnd:
+            case BitXor:
+                VALIDATE(!value->kind().traps(), ("At ", *value));
+                switch (value->opcode()) {
+                case Div:
+                case Mod:
+                    if (value->isChill()) {
+                        VALIDATE(value->opcode() == Div || value->opcode() == Mod, ("At ", *value));
+                        VALIDATE(isInt(value->type()), ("At ", *value));
+                    }
+                    break;
+                default:
+                    VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                    break;
+                }
+                VALIDATE(value->numChildren() == 2, ("At ", *value));
+                VALIDATE(value->type() == value->child(0)->type(), ("At ", *value));
+                VALIDATE(value->type() == value->child(1)->type(), ("At ", *value));
+                VALIDATE(value->type() != Void, ("At ", *value));
+                break;
+            case Neg:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->type() == value->child(0)->type(), ("At ", *value));
+                VALIDATE(value->type() != Void, ("At ", *value));
+                break;
+            case BitOr:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 2, ("At ", *value));
+                VALIDATE(value->type() == value->child(0)->type(), ("At ", *value));
+                VALIDATE(value->type() == value->child(1)->type(), ("At ", *value));
+                VALIDATE(isInt(value->type()), ("At ", *value));
+                break;
+            case Shl:
+            case SShr:
+            case ZShr:
+            case RotR:
+                case RotL:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 2, ("At ", *value));
+                VALIDATE(value->type() == value->child(0)->type(), ("At ", *value));
+                VALIDATE(value->child(1)->type() == Int32, ("At ", *value));
+                VALIDATE(isInt(value->type()), ("At ", *value));
+                break;
+            case BitwiseCast:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->type() != value->child(0)->type(), ("At ", *value));
+                VALIDATE(
+                    (value->type() == Int64 && value->child(0)->type() == Double)
+                    || (value->type() == Double && value->child(0)->type() == Int64)
+                    || (value->type() == Float && value->child(0)->type() == Int32)
+                    || (value->type() == Int32 && value->child(0)->type() == Float),
+                    ("At ", *value));
+                break;
+            case SExt8:
+            case SExt16:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == Int32, ("At ", *value));
+                VALIDATE(value->type() == Int32, ("At ", *value));
+                break;
+            case SExt32:
+            case ZExt32:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == Int32, ("At ", *value));
+                VALIDATE(value->type() == Int64, ("At ", *value));
+                break;
+            case Clz:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(isInt(value->type()), ("At ", *value));
+                break;
+            case Trunc:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(
+                    (value->type() == Int32 && value->child(0)->type() == Int64)
+                    || (value->type() == Float && value->child(0)->type() == Double),
+                    ("At ", *value));
+                break;
+            case Abs:
+            case Ceil:
+            case Floor:
+            case Sqrt:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(isFloat(value->child(0)->type()), ("At ", *value));
+                VALIDATE(isFloat(value->type()), ("At ", *value));
+                break;
+            case IToD:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(value->type() == Double, ("At ", *value));
+                break;
+            case IToF:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(value->type() == Float, ("At ", *value));
+                break;
+            case FloatToDouble:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == Float, ("At ", *value));
+                VALIDATE(value->type() == Double, ("At ", *value));
+                break;
+            case DoubleToFloat:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == Double, ("At ", *value));
+                VALIDATE(value->type() == Float, ("At ", *value));
+                break;
+            case Equal:
+            case NotEqual:
+            case LessThan:
+            case GreaterThan:
+            case LessEqual:
+            case GreaterEqual:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 2, ("At ", *value));
+                VALIDATE(value->child(0)->type() == value->child(1)->type(), ("At ", *value));
+                VALIDATE(value->type() == Int32, ("At ", *value));
+                break;
+            case Above:
+            case Below:
+            case AboveEqual:
+            case BelowEqual:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 2, ("At ", *value));
+                VALIDATE(value->child(0)->type() == value->child(1)->type(), ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(value->type() == Int32, ("At ", *value));
+                break;
+            case EqualOrUnordered:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 2, ("At ", *value));
+                VALIDATE(value->child(0)->type() == value->child(1)->type(), ("At ", *value));
+                VALIDATE(isFloat(value->child(0)->type()), ("At ", *value));
+                VALIDATE(value->type() == Int32, ("At ", *value));
+                break;
+            case Select:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 3, ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(value->type() == value->child(1)->type(), ("At ", *value));
+                VALIDATE(value->type() == value->child(2)->type(), ("At ", *value));
+                break;
+            case Load8Z:
+            case Load8S:
+            case Load16Z:
+            case Load16S:
+                VALIDATE(!value->kind().isChill(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == pointerType(), ("At ", *value));
+                VALIDATE(value->type() == Int32, ("At ", *value));
+                validateStackAccess(value);
+                break;
+            case Load:
+                VALIDATE(!value->kind().isChill(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == pointerType(), ("At ", *value));
+                VALIDATE(value->type() != Void, ("At ", *value));
+                validateStackAccess(value);
+                break;
+            case Store8:
+            case Store16:
+                VALIDATE(!value->kind().isChill(), ("At ", *value));
+                VALIDATE(value->numChildren() == 2, ("At ", *value));
+                VALIDATE(value->child(0)->type() == Int32, ("At ", *value));
+                VALIDATE(value->child(1)->type() == pointerType(), ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                validateStackAccess(value);
+                break;
+            case Store:
+                VALIDATE(!value->kind().isChill(), ("At ", *value));
+                VALIDATE(value->numChildren() == 2, ("At ", *value));
+                VALIDATE(value->child(1)->type() == pointerType(), ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                validateStackAccess(value);
+                break;
+            case WasmAddress:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == pointerType(), ("At ", *value));
+                VALIDATE(value->type() == pointerType(), ("At ", *value));
+                break;
+            case CCall:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() >= 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == pointerType(), ("At ", *value));
+                break;
+            case Patchpoint:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                if (value->type() == Void)
+                    VALIDATE(value->as<PatchpointValue>()->resultConstraint == ValueRep::WarmAny, ("At ", *value));
+                else {
+                    switch (value->as<PatchpointValue>()->resultConstraint.kind()) {
+                    case ValueRep::WarmAny:
+                    case ValueRep::SomeRegister:
+                    case ValueRep::SomeEarlyRegister:
+                    case ValueRep::Register:
+                    case ValueRep::StackArgument:
+                        break;
+                    default:
+                        VALIDATE(false, ("At ", *value));
+                        break;
+                    }
+                    
+                    validateStackmapConstraint(value, ConstrainedValue(value, value->as<PatchpointValue>()->resultConstraint), ConstraintRole::Def);
+                }
+                validateStackmap(value);
+                break;
+            case CheckAdd:
+            case CheckSub:
+            case CheckMul:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() >= 2, ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(isInt(value->child(1)->type()), ("At ", *value));
+                VALIDATE(value->as<StackmapValue>()->constrainedChild(0).rep() == ValueRep::WarmAny, ("At ", *value));
+                VALIDATE(value->as<StackmapValue>()->constrainedChild(1).rep() == ValueRep::WarmAny, ("At ", *value));
+                validateStackmap(value);
+                break;
+            case Check:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() >= 1, ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(value->as<StackmapValue>()->constrainedChild(0).rep() == ValueRep::WarmAny, ("At ", *value));
+                validateStackmap(value);
+                break;
+            case WasmBoundsCheck:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->child(0)->type() == Int32, ("At ", *value));
+                VALIDATE(m_procedure.code().isPinned(value->as<WasmBoundsCheckValue>()->pinnedGPR()), ("At ", *value));
+                VALIDATE(m_procedure.code().wasmBoundsCheckGenerator(), ("At ", *value));
+                break;
+            case Upsilon:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(value->as<UpsilonValue>()->phi(), ("At ", *value));
+                VALIDATE(value->as<UpsilonValue>()->phi()->opcode() == Phi, ("At ", *value));
+                VALIDATE(value->child(0)->type() == value->as<UpsilonValue>()->phi()->type(), ("At ", *value));
+                VALIDATE(valueInProc.contains(value->as<UpsilonValue>()->phi()), ("At ", *value));
+                break;
+            case Phi:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() != Void, ("At ", *value));
+                break;
+            case Jump:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                VALIDATE(valueOwner.get(value)->numSuccessors() == 1, ("At ", *value));
+                break;
+            case Oops:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                VALIDATE(!valueOwner.get(value)->numSuccessors(), ("At ", *value));
+                break;
+            case Return:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() <= 1, ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                VALIDATE(!valueOwner.get(value)->numSuccessors(), ("At ", *value));
+                break;
+            case Branch:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                VALIDATE(valueOwner.get(value)->numSuccessors() == 2, ("At ", *value));
+                break;
+            case Switch: {
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(value->numChildren() == 1, ("At ", *value));
+                VALIDATE(isInt(value->child(0)->type()), ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                VALIDATE(value->as<SwitchValue>()->hasFallThrough(valueOwner.get(value)), ("At ", *value));
+                // This validates the same thing as hasFallThrough, but more explicitly. We want to
+                // make sure that if anyone tries to change the definition of hasFallThrough, they
+                // will feel some pain here, since this is fundamental.
+                VALIDATE(valueOwner.get(value)->numSuccessors() == value->as<SwitchValue>()->numCaseValues() + 1, ("At ", *value));
+                
+                // Check that there are no duplicate cases.
+                Vector<int64_t> caseValues = value->as<SwitchValue>()->caseValues();
+                std::sort(caseValues.begin(), caseValues.end());
+                for (unsigned i = 1; i < caseValues.size(); ++i)
+                    VALIDATE(caseValues[i - 1] != caseValues[i], ("At ", *value, ", caseValue = ", caseValues[i]));
+                break;
+            }
+            case EntrySwitch:
+                VALIDATE(!value->kind().hasExtraBits(), ("At ", *value));
+                VALIDATE(!value->numChildren(), ("At ", *value));
+                VALIDATE(value->type() == Void, ("At ", *value));
+                VALIDATE(valueOwner.get(value)->numSuccessors() == m_procedure.numEntrypoints(), ("At ", *value));
+                break;
+            }
+
+            VALIDATE(!(value->effects().writes && value->key()), ("At ", *value));
+        }
+
+        for (Variable* variable : m_procedure.variables())
+            VALIDATE(variable->type() != Void, ("At ", *variable));
+    }
+
+private:
+    void validateStackmap(Value* value)
+    {
+        StackmapValue* stackmap = value->as<StackmapValue>();
+        VALIDATE(stackmap, ("At ", *value));
+        VALIDATE(stackmap->numChildren() >= stackmap->reps().size(), ("At ", *stackmap));
+        for (ConstrainedValue child : stackmap->constrainedChildren())
+            validateStackmapConstraint(stackmap, child);
+    }
+    
+    enum class ConstraintRole {
+        Use,
+        Def
+    };
+    void validateStackmapConstraint(Value* context, const ConstrainedValue& value, ConstraintRole role = ConstraintRole::Use)
+    {
+        switch (value.rep().kind()) {
+        case ValueRep::WarmAny:
+        case ValueRep::ColdAny:
+        case ValueRep::LateColdAny:
+        case ValueRep::SomeRegister:
+        case ValueRep::StackArgument:
+            break;
+        case ValueRep::SomeEarlyRegister:
+            VALIDATE(role == ConstraintRole::Def, ("At ", *context, ": ", value));
+            break;
+        case ValueRep::Register:
+        case ValueRep::LateRegister:
+            if (value.rep().reg().isGPR())
+                VALIDATE(isInt(value.value()->type()), ("At ", *context, ": ", value));
+            else
+                VALIDATE(isFloat(value.value()->type()), ("At ", *context, ": ", value));
+            break;
+        default:
+            VALIDATE(false, ("At ", *context, ": ", value));
+            break;
+        }
+    }
+
+    void validateStackAccess(Value* value)
+    {
+        MemoryValue* memory = value->as<MemoryValue>();
+        SlotBaseValue* slotBase = value->lastChild()->as<SlotBaseValue>();
+        if (!slotBase)
+            return;
+
+        StackSlot* stack = slotBase->slot();
+
+        VALIDATE(memory->offset() >= 0, ("At ", *value));
+        VALIDATE(memory->offset() + memory->accessByteSize() <= stack->byteSize(), ("At ", *value));
+    }
+    
+    NO_RETURN_DUE_TO_CRASH void fail(
+        const char* filename, int lineNumber, const char* function, const char* condition,
+        CString message)
+    {
+        CString failureMessage;
+        {
+            StringPrintStream out;
+            out.print("B3 VALIDATION FAILURE\n");
+            out.print("    ", condition, " (", filename, ":", lineNumber, ")\n");
+            out.print("    ", message, "\n");
+            out.print("    After ", m_procedure.lastPhaseName(), "\n");
+            failureMessage = out.toCString();
+        }
+
+        dataLog(failureMessage);
+        if (m_dumpBefore) {
+            dataLog("Before ", m_procedure.lastPhaseName(), ":\n");
+            dataLog(m_dumpBefore);
+        }
+        dataLog("At time of failure:\n");
+        dataLog(m_procedure);
+
+        dataLog(failureMessage);
+        WTFReportAssertionFailure(filename, lineNumber, function, condition);
+        CRASH();
+    }
+    
+    Procedure& m_procedure;
+    const char* m_dumpBefore;
+};
+
+} // anonymous namespace
+
+void validate(Procedure& procedure, const char* dumpBefore)
+{
+    Validater validater(procedure, dumpBefore);
+    validater.run();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Validate.h b/b3/B3Validate.h
new file mode 100644
index 0000000..d115e22
--- /dev/null
+++ b/b3/B3Validate.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+JS_EXPORT_PRIVATE void validate(Procedure&, const char* dumpBefore = nullptr);
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Value.cpp b/b3/B3Value.cpp
new file mode 100644
index 0000000..b4fc433
--- /dev/null
+++ b/b3/B3Value.cpp
@@ -0,0 +1,870 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Value.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3ArgumentRegValue.h"
+#include "B3BasicBlockInlines.h"
+#include "B3BottomProvider.h"
+#include "B3CCallValue.h"
+#include "B3FenceValue.h"
+#include "B3MemoryValue.h"
+#include "B3OriginDump.h"
+#include "B3ProcedureInlines.h"
+#include "B3SlotBaseValue.h"
+#include "B3StackSlot.h"
+#include "B3UpsilonValue.h"
+#include "B3ValueInlines.h"
+#include "B3ValueKeyInlines.h"
+#include "B3VariableValue.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/ListDump.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace B3 {
+
+const char* const Value::dumpPrefix = "@";
+
+Value::~Value()
+{
+}
+
+void Value::replaceWithIdentity(Value* value)
+{
+    // This is a bit crazy. It does an in-place replacement of whatever Value subclass this is with
+    // a plain Identity Value. We first collect all of the information we need, then we destruct the
+    // previous value in place, and then we construct the Identity Value in place.
+
+    ASSERT(m_type == value->m_type);
+
+    if (m_type == Void) {
+        replaceWithNopIgnoringType();
+        return;
+    }
+
+    unsigned index = m_index;
+    Type type = m_type;
+    Origin origin = m_origin;
+    BasicBlock* owner = this->owner;
+
+    RELEASE_ASSERT(type == value->type());
+
+    this->~Value();
+
+    new (this) Value(Identity, type, origin, value);
+
+    this->owner = owner;
+    this->m_index = index;
+}
+
+void Value::replaceWithBottom(InsertionSet& insertionSet, size_t index)
+{
+    replaceWithBottom(BottomProvider(insertionSet, index));
+}
+
+void Value::replaceWithNop()
+{
+    RELEASE_ASSERT(m_type == Void);
+    replaceWithNopIgnoringType();
+}
+
+void Value::replaceWithNopIgnoringType()
+{
+    unsigned index = m_index;
+    Origin origin = m_origin;
+    BasicBlock* owner = this->owner;
+
+    this->~Value();
+
+    new (this) Value(Nop, Void, origin);
+
+    this->owner = owner;
+    this->m_index = index;
+}
+
+void Value::replaceWithPhi()
+{
+    if (m_type == Void) {
+        replaceWithNop();
+        return;
+    }
+    
+    unsigned index = m_index;
+    Origin origin = m_origin;
+    BasicBlock* owner = this->owner;
+    Type type = m_type;
+
+    this->~Value();
+
+    new (this) Value(Phi, type, origin);
+
+    this->owner = owner;
+    this->m_index = index;
+}
+
+void Value::replaceWithJump(BasicBlock* owner, FrequentedBlock target)
+{
+    RELEASE_ASSERT(owner->last() == this);
+    
+    unsigned index = m_index;
+    Origin origin = m_origin;
+    
+    this->~Value();
+    
+    new (this) Value(Jump, Void, origin);
+    
+    this->owner = owner;
+    this->m_index = index;
+    
+    owner->setSuccessors(target);
+}
+
+void Value::replaceWithOops(BasicBlock* owner)
+{
+    RELEASE_ASSERT(owner->last() == this);
+    
+    unsigned index = m_index;
+    Origin origin = m_origin;
+    
+    this->~Value();
+    
+    new (this) Value(Oops, Void, origin);
+    
+    this->owner = owner;
+    this->m_index = index;
+    
+    owner->clearSuccessors();
+}
+
+void Value::replaceWithJump(FrequentedBlock target)
+{
+    replaceWithJump(owner, target);
+}
+
+void Value::replaceWithOops()
+{
+    replaceWithOops(owner);
+}
+
+void Value::dump(PrintStream& out) const
+{
+    bool isConstant = false;
+
+    switch (opcode()) {
+    case Const32:
+        out.print("$", asInt32(), "(");
+        isConstant = true;
+        break;
+    case Const64:
+        out.print("$", asInt64(), "(");
+        isConstant = true;
+        break;
+    case ConstFloat:
+        out.print("$", asFloat(), "(");
+        isConstant = true;
+        break;
+    case ConstDouble:
+        out.print("$", asDouble(), "(");
+        isConstant = true;
+        break;
+    default:
+        break;
+    }
+    
+    out.print(dumpPrefix, m_index);
+
+    if (isConstant)
+        out.print(")");
+}
+
+Value* Value::cloneImpl() const
+{
+    return new Value(*this);
+}
+
+void Value::dumpChildren(CommaPrinter& comma, PrintStream& out) const
+{
+    for (Value* child : children())
+        out.print(comma, pointerDump(child));
+}
+
+void Value::deepDump(const Procedure* proc, PrintStream& out) const
+{
+    out.print(m_type, " ", dumpPrefix, m_index, " = ", m_kind);
+
+    out.print("(");
+    CommaPrinter comma;
+    dumpChildren(comma, out);
+
+    if (m_origin)
+        out.print(comma, OriginDump(proc, m_origin));
+
+    dumpMeta(comma, out);
+
+    {
+        CString string = toCString(effects());
+        if (string.length())
+            out.print(comma, string);
+    }
+
+    out.print(")");
+}
+
+void Value::dumpSuccessors(const BasicBlock* block, PrintStream& out) const
+{
+    // Note that this must not crash if we have the wrong number of successors, since someone
+    // debugging a number-of-successors bug will probably want to dump IR!
+    
+    if (opcode() == Branch && block->numSuccessors() == 2) {
+        out.print("Then:", block->taken(), ", Else:", block->notTaken());
+        return;
+    }
+    
+    out.print(listDump(block->successors()));
+}
+
+Value* Value::negConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::addConstant(Procedure&, int32_t) const
+{
+    return nullptr;
+}
+
+Value* Value::addConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::subConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::mulConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::checkAddConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::checkSubConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::checkMulConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::checkNegConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::divConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::uDivConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::modConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::uModConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::bitAndConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::bitOrConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::bitXorConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::shlConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::sShrConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::zShrConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::rotRConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::rotLConstant(Procedure&, const Value*) const
+{
+    return nullptr;
+}
+
+Value* Value::bitwiseCastConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::iToDConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::iToFConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::doubleToFloatConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::floatToDoubleConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::absConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::ceilConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::floorConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+Value* Value::sqrtConstant(Procedure&) const
+{
+    return nullptr;
+}
+
+TriState Value::equalConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::notEqualConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::lessThanConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::greaterThanConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::lessEqualConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::greaterEqualConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::aboveConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::belowConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::aboveEqualConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::belowEqualConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+TriState Value::equalOrUnorderedConstant(const Value*) const
+{
+    return MixedTriState;
+}
+
+Value* Value::invertedCompare(Procedure& proc) const
+{
+    if (!numChildren())
+        return nullptr;
+    if (std::optional<Opcode> invertedOpcode = B3::invertedCompare(opcode(), child(0)->type())) {
+        ASSERT(!kind().hasExtraBits());
+        return proc.add<Value>(*invertedOpcode, type(), origin(), children());
+    }
+    return nullptr;
+}
+
+bool Value::isRounded() const
+{
+    ASSERT(isFloat(type()));
+    switch (opcode()) {
+    case Floor:
+    case Ceil:
+    case IToD:
+    case IToF:
+        return true;
+
+    case ConstDouble: {
+        double value = asDouble();
+        return std::isfinite(value) && value == ceil(value);
+    }
+
+    case ConstFloat: {
+        float value = asFloat();
+        return std::isfinite(value) && value == ceilf(value);
+    }
+
+    default:
+        return false;
+    }
+}
+
+bool Value::returnsBool() const
+{
+    if (type() != Int32)
+        return false;
+    switch (opcode()) {
+    case Const32:
+        return asInt32() == 0 || asInt32() == 1;
+    case BitAnd:
+        return child(1)->isInt32(1)
+            || (child(0)->returnsBool() && child(1)->hasInt() && child(1)->asInt() & 1);
+    case Equal:
+    case NotEqual:
+    case LessThan:
+    case GreaterThan:
+    case LessEqual:
+    case GreaterEqual:
+    case Above:
+    case Below:
+    case AboveEqual:
+    case BelowEqual:
+    case EqualOrUnordered:
+        return true;
+    case Phi:
+        // FIXME: We should have a story here.
+        // https://bugs.webkit.org/show_bug.cgi?id=150725
+        return false;
+    default:
+        return false;
+    }
+}
+
+TriState Value::asTriState() const
+{
+    switch (opcode()) {
+    case Const32:
+        return triState(!!asInt32());
+    case Const64:
+        return triState(!!asInt64());
+    case ConstDouble:
+        // Use "!= 0" to really emphasize what this mean with respect to NaN and such.
+        return triState(asDouble() != 0);
+    case ConstFloat:
+        return triState(asFloat() != 0.);
+    default:
+        return MixedTriState;
+    }
+}
+
+Effects Value::effects() const
+{
+    Effects result;
+    switch (opcode()) {
+    case Nop:
+    case Identity:
+    case Const32:
+    case Const64:
+    case ConstDouble:
+    case ConstFloat:
+    case SlotBase:
+    case ArgumentReg:
+    case FramePointer:
+    case Add:
+    case Sub:
+    case Mul:
+    case Neg:
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case Shl:
+    case SShr:
+    case ZShr:
+    case RotR:
+    case RotL:
+    case Clz:
+    case Abs:
+    case Ceil:
+    case Floor:
+    case Sqrt:
+    case BitwiseCast:
+    case SExt8:
+    case SExt16:
+    case SExt32:
+    case ZExt32:
+    case Trunc:
+    case IToD:
+    case IToF:
+    case FloatToDouble:
+    case DoubleToFloat:
+    case Equal:
+    case NotEqual:
+    case LessThan:
+    case GreaterThan:
+    case LessEqual:
+    case GreaterEqual:
+    case Above:
+    case Below:
+    case AboveEqual:
+    case BelowEqual:
+    case EqualOrUnordered:
+    case Select:
+        break;
+    case Div:
+    case UDiv:
+    case Mod:
+    case UMod:
+        result.controlDependent = true;
+        break;
+    case Load8Z:
+    case Load8S:
+    case Load16Z:
+    case Load16S:
+    case Load:
+        result.reads = as<MemoryValue>()->range();
+        result.controlDependent = true;
+        break;
+    case Store8:
+    case Store16:
+    case Store:
+        result.writes = as<MemoryValue>()->range();
+        result.controlDependent = true;
+        break;
+    case WasmAddress:
+        result.readsPinned = true;
+        break;
+    case Fence: {
+        const FenceValue* fence = as<FenceValue>();
+        result.reads = fence->read;
+        result.writes = fence->write;
+        
+        // Prevent killing of fences that claim not to write anything. It's a bit weird that we use
+        // local state as the way to do this, but it happens to work: we must assume that we cannot
+        // kill writesLocalState unless we understands exactly what the instruction is doing (like
+        // the way that fixSSA understands Set/Get and the way that reduceStrength and others
+        // understand Upsilon). This would only become a problem if we had some analysis that was
+        // looking to use the writesLocalState bit to invalidate a CSE over local state operations.
+        // Then a Fence would look block, say, the elimination of a redundant Get. But it like
+        // that's not at all how our optimizations for Set/Get/Upsilon/Phi work - they grok their
+        // operations deeply enough that they have no need to check this bit - so this cheat is
+        // fine.
+        result.writesLocalState = true;
+        break;
+    }
+    case CCall:
+        result = as<CCallValue>()->effects;
+        break;
+    case Patchpoint:
+        result = as<PatchpointValue>()->effects;
+        break;
+    case CheckAdd:
+    case CheckSub:
+    case CheckMul:
+    case Check:
+        result = Effects::forCheck();
+        break;
+    case WasmBoundsCheck:
+        result.readsPinned = true;
+        result.exitsSideways = true;
+        break;
+    case Upsilon:
+    case Set:
+        result.writesLocalState = true;
+        break;
+    case Phi:
+    case Get:
+        result.readsLocalState = true;
+        break;
+    case Jump:
+    case Branch:
+    case Switch:
+    case Return:
+    case Oops:
+    case EntrySwitch:
+        result.terminal = true;
+        break;
+    }
+    if (traps()) {
+        result.exitsSideways = true;
+        result.reads = HeapRange::top();
+    }
+    return result;
+}
+
+ValueKey Value::key() const
+{
+    switch (opcode()) {
+    case FramePointer:
+        return ValueKey(kind(), type());
+    case Identity:
+    case Abs:
+    case Ceil:
+    case Floor:
+    case Sqrt:
+    case SExt8:
+    case SExt16:
+    case SExt32:
+    case ZExt32:
+    case Clz:
+    case Trunc:
+    case IToD:
+    case IToF:
+    case FloatToDouble:
+    case DoubleToFloat:
+    case Check:
+    case BitwiseCast:
+    case Neg:
+        return ValueKey(kind(), type(), child(0));
+    case Add:
+    case Sub:
+    case Mul:
+    case Div:
+    case UDiv:
+    case Mod:
+    case UMod:
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case Shl:
+    case SShr:
+    case ZShr:
+    case RotR:
+    case RotL:
+    case Equal:
+    case NotEqual:
+    case LessThan:
+    case GreaterThan:
+    case Above:
+    case Below:
+    case AboveEqual:
+    case BelowEqual:
+    case EqualOrUnordered:
+    case CheckAdd:
+    case CheckSub:
+    case CheckMul:
+        return ValueKey(kind(), type(), child(0), child(1));
+    case Select:
+        return ValueKey(kind(), type(), child(0), child(1), child(2));
+    case Const32:
+        return ValueKey(Const32, type(), static_cast<int64_t>(asInt32()));
+    case Const64:
+        return ValueKey(Const64, type(), asInt64());
+    case ConstDouble:
+        return ValueKey(ConstDouble, type(), asDouble());
+    case ConstFloat:
+        return ValueKey(ConstFloat, type(), asFloat());
+    case ArgumentReg:
+        return ValueKey(
+            ArgumentReg, type(),
+            static_cast<int64_t>(as<ArgumentRegValue>()->argumentReg().index()));
+    case SlotBase:
+        return ValueKey(
+            SlotBase, type(),
+            static_cast<int64_t>(as<SlotBaseValue>()->slot()->index()));
+    default:
+        return ValueKey();
+    }
+}
+
+void Value::performSubstitution()
+{
+    for (Value*& child : children()) {
+        while (child->opcode() == Identity)
+            child = child->child(0);
+    }
+}
+
+bool Value::isFree() const
+{
+    switch (opcode()) {
+    case Const32:
+    case Const64:
+    case ConstDouble:
+    case ConstFloat:
+    case Identity:
+    case Nop:
+        return true;
+    default:
+        return false;
+    }
+}
+
+void Value::dumpMeta(CommaPrinter&, PrintStream&) const
+{
+}
+
+Type Value::typeFor(Kind kind, Value* firstChild, Value* secondChild)
+{
+    switch (kind.opcode()) {
+    case Identity:
+    case Add:
+    case Sub:
+    case Mul:
+    case Div:
+    case UDiv:
+    case Mod:
+    case UMod:
+    case Neg:
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case Shl:
+    case SShr:
+    case ZShr:
+    case RotR:
+    case RotL:
+    case Clz:
+    case Abs:
+    case Ceil:
+    case Floor:
+    case Sqrt:
+    case CheckAdd:
+    case CheckSub:
+    case CheckMul:
+        return firstChild->type();
+    case FramePointer:
+        return pointerType();
+    case SExt8:
+    case SExt16:
+    case Equal:
+    case NotEqual:
+    case LessThan:
+    case GreaterThan:
+    case LessEqual:
+    case GreaterEqual:
+    case Above:
+    case Below:
+    case AboveEqual:
+    case BelowEqual:
+    case EqualOrUnordered:
+        return Int32;
+    case Trunc:
+        return firstChild->type() == Int64 ? Int32 : Float;
+    case SExt32:
+    case ZExt32:
+        return Int64;
+    case FloatToDouble:
+    case IToD:
+        return Double;
+    case DoubleToFloat:
+    case IToF:
+        return Float;
+    case BitwiseCast:
+        switch (firstChild->type()) {
+        case Int64:
+            return Double;
+        case Double:
+            return Int64;
+        case Int32:
+            return Float;
+        case Float:
+            return Int32;
+        case Void:
+            ASSERT_NOT_REACHED();
+        }
+        return Void;
+    case Nop:
+    case Jump:
+    case Branch:
+    case Return:
+    case Oops:
+    case EntrySwitch:
+    case WasmBoundsCheck:
+        return Void;
+    case Select:
+        ASSERT(secondChild);
+        return secondChild->type();
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+
+void Value::badKind(Kind kind, unsigned numArgs)
+{
+    dataLog("Bad kind ", kind, " with ", numArgs, " args.\n");
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Value.h b/b3/B3Value.h
new file mode 100644
index 0000000..ebe52ad
--- /dev/null
+++ b/b3/B3Value.h
@@ -0,0 +1,515 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "B3Effects.h"
+#include "B3FrequentedBlock.h"
+#include "B3Kind.h"
+#include "B3Origin.h"
+#include "B3SparseCollection.h"
+#include "B3Type.h"
+#include "B3ValueKey.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace B3 {
+
+class BasicBlock;
+class CheckValue;
+class InsertionSet;
+class PhiChildren;
+class Procedure;
+
+class JS_EXPORT_PRIVATE Value {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    typedef Vector<Value*, 3> AdjacencyList;
+
+    static const char* const dumpPrefix;
+
+    static bool accepts(Kind) { return true; }
+
+    virtual ~Value();
+
+    unsigned index() const { return m_index; }
+    
+    // Note that the kind is immutable, except for replacing values with:
+    // Identity, Nop, Oops, Jump, and Phi. See below for replaceWithXXX() methods.
+    Kind kind() const { return m_kind; }
+    
+    Opcode opcode() const { return kind().opcode(); }
+    
+    // It's good practice to mirror Kind methods here, so you can say value->isBlah()
+    // instead of value->kind().isBlah().
+    bool isChill() const { return kind().isChill(); }
+    bool traps() const { return kind().traps(); }
+
+    Origin origin() const { return m_origin; }
+    void setOrigin(Origin origin) { m_origin = origin; }
+    
+    Value*& child(unsigned index) { return m_children[index]; }
+    Value* child(unsigned index) const { return m_children[index]; }
+
+    Value*& lastChild() { return m_children.last(); }
+    Value* lastChild() const { return m_children.last(); }
+
+    unsigned numChildren() const { return m_children.size(); }
+
+    Type type() const { return m_type; }
+    void setType(Type type) { m_type = type; }
+
+    // This is useful when lowering. Note that this is only valid for non-void values.
+    Air::Arg::Type airType() const { return Air::Arg::typeForB3Type(type()); }
+    Air::Arg::Width airWidth() const { return Air::Arg::widthForB3Type(type()); }
+
+    AdjacencyList& children() { return m_children; } 
+    const AdjacencyList& children() const { return m_children; }
+
+    // If you want to replace all uses of this value with a different value, then replace this
+    // value with Identity. Then do a pass of performSubstitution() on all of the values that use
+    // this one. Usually we do all of this in one pass in pre-order, which ensures that the
+    // X->replaceWithIdentity() calls happen before the performSubstitution() calls on X's users.
+    void replaceWithIdentity(Value*);
+    
+    // It's often necessary to kill a value. It's tempting to replace the value with Nop or to
+    // just remove it. But unless you are sure that the value is Void, you will probably still
+    // have other values that use this one. Sure, you may kill those later, or you might not. This
+    // method lets you kill a value safely. It will replace Void values with Nop and non-Void
+    // values with Identities on bottom constants. For this reason, this takes a callback that is
+    // responsible for creating bottoms. There's a utility for this, see B3BottomProvider.h. You
+    // can also access that utility using replaceWithBottom(InsertionSet&, size_t).
+    template<typename BottomProvider>
+    void replaceWithBottom(const BottomProvider&);
+    
+    void replaceWithBottom(InsertionSet&, size_t index);
+
+    // Use this if you want to kill a value and you are sure that the value is Void.
+    void replaceWithNop();
+    
+    // Use this if you want to kill a value and you are sure that nobody is using it anymore.
+    void replaceWithNopIgnoringType();
+    
+    void replaceWithPhi();
+    
+    // These transformations are only valid for terminals.
+    void replaceWithJump(BasicBlock* owner, FrequentedBlock);
+    void replaceWithOops(BasicBlock* owner);
+    
+    // You can use this form if owners are valid. They're usually not valid.
+    void replaceWithJump(FrequentedBlock);
+    void replaceWithOops();
+
+    void dump(PrintStream&) const;
+    void deepDump(const Procedure*, PrintStream&) const;
+    
+    virtual void dumpSuccessors(const BasicBlock*, PrintStream&) const;
+
+    // This is how you cast Values. For example, if you want to do something provided that we have a
+    // ArgumentRegValue, you can do:
+    //
+    // if (ArgumentRegValue* argumentReg = value->as<ArgumentRegValue>()) {
+    //     things
+    // }
+    //
+    // This will return null if this kind() != ArgumentReg. This works because this returns nullptr
+    // if T::accepts(kind()) returns false.
+    template<typename T>
+    T* as();
+    template<typename T>
+    const T* as() const;
+
+    // What follows are a bunch of helpers for inspecting and modifying values. Note that we have a
+    // bunch of different idioms for implementing such helpers. You can use virtual methods, and
+    // override from the various Value subclasses. You can put the method inside Value and make it
+    // non-virtual, and the implementation can switch on kind. The method could be inline or not.
+    // If a method is specific to some Value subclass, you could put it in the subclass, or you could
+    // put it on Value anyway. It's fine to pick whatever feels right, and we shouldn't restrict
+    // ourselves to any particular idiom.
+
+    bool isConstant() const;
+    bool isInteger() const;
+    
+    virtual Value* negConstant(Procedure&) const;
+    virtual Value* addConstant(Procedure&, int32_t other) const;
+    virtual Value* addConstant(Procedure&, const Value* other) const;
+    virtual Value* subConstant(Procedure&, const Value* other) const;
+    virtual Value* mulConstant(Procedure&, const Value* other) const;
+    virtual Value* checkAddConstant(Procedure&, const Value* other) const;
+    virtual Value* checkSubConstant(Procedure&, const Value* other) const;
+    virtual Value* checkMulConstant(Procedure&, const Value* other) const;
+    virtual Value* checkNegConstant(Procedure&) const;
+    virtual Value* divConstant(Procedure&, const Value* other) const; // This chooses Div<Chill> semantics for integers.
+    virtual Value* uDivConstant(Procedure&, const Value* other) const;
+    virtual Value* modConstant(Procedure&, const Value* other) const; // This chooses Mod<Chill> semantics.
+    virtual Value* uModConstant(Procedure&, const Value* other) const;
+    virtual Value* bitAndConstant(Procedure&, const Value* other) const;
+    virtual Value* bitOrConstant(Procedure&, const Value* other) const;
+    virtual Value* bitXorConstant(Procedure&, const Value* other) const;
+    virtual Value* shlConstant(Procedure&, const Value* other) const;
+    virtual Value* sShrConstant(Procedure&, const Value* other) const;
+    virtual Value* zShrConstant(Procedure&, const Value* other) const;
+    virtual Value* rotRConstant(Procedure&, const Value* other) const;
+    virtual Value* rotLConstant(Procedure&, const Value* other) const;
+    virtual Value* bitwiseCastConstant(Procedure&) const;
+    virtual Value* iToDConstant(Procedure&) const;
+    virtual Value* iToFConstant(Procedure&) const;
+    virtual Value* doubleToFloatConstant(Procedure&) const;
+    virtual Value* floatToDoubleConstant(Procedure&) const;
+    virtual Value* absConstant(Procedure&) const;
+    virtual Value* ceilConstant(Procedure&) const;
+    virtual Value* floorConstant(Procedure&) const;
+    virtual Value* sqrtConstant(Procedure&) const;
+
+    virtual TriState equalConstant(const Value* other) const;
+    virtual TriState notEqualConstant(const Value* other) const;
+    virtual TriState lessThanConstant(const Value* other) const;
+    virtual TriState greaterThanConstant(const Value* other) const;
+    virtual TriState lessEqualConstant(const Value* other) const;
+    virtual TriState greaterEqualConstant(const Value* other) const;
+    virtual TriState aboveConstant(const Value* other) const;
+    virtual TriState belowConstant(const Value* other) const;
+    virtual TriState aboveEqualConstant(const Value* other) const;
+    virtual TriState belowEqualConstant(const Value* other) const;
+    virtual TriState equalOrUnorderedConstant(const Value* other) const;
+    
+    // If the value is a comparison then this returns the inverted form of that comparison, if
+    // possible. It can be impossible for double comparisons, where for example LessThan and
+    // GreaterEqual behave differently. If this returns a value, it is a new value, which must be
+    // either inserted into some block or deleted.
+    Value* invertedCompare(Procedure&) const;
+
+    bool hasInt32() const;
+    int32_t asInt32() const;
+    bool isInt32(int32_t) const;
+    
+    bool hasInt64() const;
+    int64_t asInt64() const;
+    bool isInt64(int64_t) const;
+
+    bool hasInt() const;
+    int64_t asInt() const;
+    bool isInt(int64_t value) const;
+
+    bool hasIntPtr() const;
+    intptr_t asIntPtr() const;
+    bool isIntPtr(intptr_t) const;
+
+    bool hasDouble() const;
+    double asDouble() const;
+    bool isEqualToDouble(double) const; // We say "isEqualToDouble" because "isDouble" would be a bit equality.
+
+    bool hasFloat() const;
+    float asFloat() const;
+
+    bool hasNumber() const;
+    template<typename T> bool isRepresentableAs() const;
+    template<typename T> T asNumber() const;
+
+    // Booleans in B3 are Const32(0) or Const32(1). So this is true if the type is Int32 and the only
+    // possible return values are 0 or 1. It's OK for this method to conservatively return false.
+    bool returnsBool() const;
+
+    bool isNegativeZero() const;
+
+    bool isRounded() const;
+
+    TriState asTriState() const;
+    bool isLikeZero() const { return asTriState() == FalseTriState; }
+    bool isLikeNonZero() const { return asTriState() == TrueTriState; }
+
+    Effects effects() const;
+
+    // This returns a ValueKey that describes that this Value returns when it executes. Returns an
+    // empty ValueKey if this Value is impure. Note that an operation that returns Void could still
+    // have a non-empty ValueKey. This happens for example with Check operations.
+    ValueKey key() const;
+
+    // Makes sure that none of the children are Identity's. If a child points to Identity, this will
+    // repoint it at the Identity's child. For simplicity, this will follow arbitrarily long chains
+    // of Identity's.
+    void performSubstitution();
+    
+    // Free values are those whose presence is guaranteed not to hurt code. We consider constants,
+    // Identities, and Nops to be free. Constants are free because we hoist them to an optimal place.
+    // Identities and Nops are free because we remove them.
+    bool isFree() const;
+
+    // Walk the ancestors of this value (i.e. the graph of things it transitively uses). This
+    // either walks phis or not, depending on whether PhiChildren is null. Your callback gets
+    // called with the signature:
+    //
+    //     (Value*) -> WalkStatus
+    enum WalkStatus {
+        Continue,
+        IgnoreChildren,
+        Stop
+    };
+    template<typename Functor>
+    void walk(const Functor& functor, PhiChildren* = nullptr);
+
+protected:
+    virtual Value* cloneImpl() const;
+    
+    virtual void dumpChildren(CommaPrinter&, PrintStream&) const;
+    virtual void dumpMeta(CommaPrinter&, PrintStream&) const;
+
+private:
+    friend class Procedure;
+    friend class SparseCollection<Value>;
+
+    // Checks that this kind is valid for use with B3::Value.
+    ALWAYS_INLINE static void checkKind(Kind kind, unsigned numArgs)
+    {
+        switch (kind.opcode()) {
+        case FramePointer:
+        case Nop:
+        case Phi:
+        case Jump:
+        case Oops:
+        case EntrySwitch:
+            if (UNLIKELY(numArgs))
+                badKind(kind, numArgs);
+            break;
+        case Return:
+            if (UNLIKELY(numArgs > 1))
+                badKind(kind, numArgs);
+            break;
+        case Identity:
+        case Neg:
+        case Clz:
+        case Abs:
+        case Ceil:
+        case Floor:
+        case Sqrt:
+        case SExt8:
+        case SExt16:
+        case Trunc:
+        case SExt32:
+        case ZExt32:
+        case FloatToDouble:
+        case IToD:
+        case DoubleToFloat:
+        case IToF:
+        case BitwiseCast:
+        case Branch:
+            if (UNLIKELY(numArgs != 1))
+                badKind(kind, numArgs);
+            break;
+        case Add:
+        case Sub:
+        case Mul:
+        case Div:
+        case UDiv:
+        case Mod:
+        case UMod:
+        case BitAnd:
+        case BitOr:
+        case BitXor:
+        case Shl:
+        case SShr:
+        case ZShr:
+        case RotR:
+        case RotL:
+        case Equal:
+        case NotEqual:
+        case LessThan:
+        case GreaterThan:
+        case LessEqual:
+        case GreaterEqual:
+        case Above:
+        case Below:
+        case AboveEqual:
+        case BelowEqual:
+        case EqualOrUnordered:
+            if (UNLIKELY(numArgs != 2))
+                badKind(kind, numArgs);
+            break;
+        case Select:
+            if (UNLIKELY(numArgs != 3))
+                badKind(kind, numArgs);
+            break;
+        default:
+            badKind(kind, numArgs);
+            break;
+        }
+    }
+
+protected:
+    enum CheckedOpcodeTag { CheckedOpcode };
+
+    Value(const Value&) = default;
+    Value& operator=(const Value&) = default;
+    
+    // Instantiate values via Procedure.
+    // This form requires specifying the type explicitly:
+    template<typename... Arguments>
+    explicit Value(CheckedOpcodeTag, Kind kind, Type type, Origin origin, Value* firstChild, Arguments... arguments)
+        : m_kind(kind)
+        , m_type(type)
+        , m_origin(origin)
+        , m_children{ firstChild, arguments... }
+    {
+    }
+    // This form is for specifying the type explicitly when the opcode has no children:
+    explicit Value(CheckedOpcodeTag, Kind kind, Type type, Origin origin)
+        : m_kind(kind)
+        , m_type(type)
+        , m_origin(origin)
+    {
+    }
+    // This form is for those opcodes that can infer their type from the opcode and first child:
+    template<typename... Arguments>
+    explicit Value(CheckedOpcodeTag, Kind kind, Origin origin, Value* firstChild)
+        : m_kind(kind)
+        , m_type(typeFor(kind, firstChild))
+        , m_origin(origin)
+        , m_children{ firstChild }
+    {
+    }
+    // This form is for those opcodes that can infer their type from the opcode and first and second child:
+    template<typename... Arguments>
+    explicit Value(CheckedOpcodeTag, Kind kind, Origin origin, Value* firstChild, Value* secondChild, Arguments... arguments)
+        : m_kind(kind)
+        , m_type(typeFor(kind, firstChild, secondChild))
+        , m_origin(origin)
+        , m_children{ firstChild, secondChild, arguments... }
+    {
+    }
+    // This form is for those opcodes that can infer their type from the opcode alone, and that don't
+    // take any arguments:
+    explicit Value(CheckedOpcodeTag, Kind kind, Origin origin)
+        : m_kind(kind)
+        , m_type(typeFor(kind, nullptr))
+        , m_origin(origin)
+    {
+    }
+    // Use this form for varargs.
+    explicit Value(CheckedOpcodeTag, Kind kind, Type type, Origin origin, const AdjacencyList& children)
+        : m_kind(kind)
+        , m_type(type)
+        , m_origin(origin)
+        , m_children(children)
+    {
+    }
+    explicit Value(CheckedOpcodeTag, Kind kind, Type type, Origin origin, AdjacencyList&& children)
+        : m_kind(kind)
+        , m_type(type)
+        , m_origin(origin)
+        , m_children(WTFMove(children))
+    {
+    }
+
+    // This is the constructor you end up actually calling, if you're instantiating Value
+    // directly.
+    template<typename... Arguments>
+        explicit Value(Kind kind, Type type, Origin origin)
+        : Value(CheckedOpcode, kind, type, origin)
+    {
+        checkKind(kind, 0);
+    }
+    template<typename... Arguments>
+        explicit Value(Kind kind, Type type, Origin origin, Value* firstChild, Arguments&&... arguments)
+        : Value(CheckedOpcode, kind, type, origin, firstChild, std::forward<Arguments>(arguments)...)
+    {
+        checkKind(kind, 1 + sizeof...(arguments));
+    }
+    template<typename... Arguments>
+        explicit Value(Kind kind, Type type, Origin origin, const AdjacencyList& children)
+        : Value(CheckedOpcode, kind, type, origin, children)
+    {
+        checkKind(kind, children.size());
+    }
+    template<typename... Arguments>
+        explicit Value(Kind kind, Type type, Origin origin, AdjacencyList&& children)
+        : Value(CheckedOpcode, kind, type, origin, WTFMove(children))
+    {
+        checkKind(kind, m_children.size());
+    }
+    template<typename... Arguments>
+        explicit Value(Kind kind, Origin origin, Arguments&&... arguments)
+        : Value(CheckedOpcode, kind, origin, std::forward<Arguments>(arguments)...)
+    {
+        checkKind(kind, sizeof...(arguments));
+    }
+
+private:
+    friend class CheckValue; // CheckValue::convertToAdd() modifies m_kind.
+    
+    static Type typeFor(Kind, Value* firstChild, Value* secondChild = nullptr);
+
+    // This group of fields is arranged to fit in 64 bits.
+protected:
+    unsigned m_index { UINT_MAX };
+private:
+    Kind m_kind;
+    Type m_type;
+    
+    Origin m_origin;
+    AdjacencyList m_children;
+
+    JS_EXPORT_PRIVATE NO_RETURN_DUE_TO_CRASH static void badKind(Kind, unsigned);
+
+public:
+    BasicBlock* owner { nullptr }; // computed by Procedure::resetValueOwners().
+};
+
+class DeepValueDump {
+public:
+    DeepValueDump(const Procedure* proc, const Value* value)
+        : m_proc(proc)
+        , m_value(value)
+    {
+    }
+
+    void dump(PrintStream& out) const
+    {
+        if (m_value)
+            m_value->deepDump(m_proc, out);
+        else
+            out.print("<null>");
+    }
+
+private:
+    const Procedure* m_proc;
+    const Value* m_value;
+};
+
+inline DeepValueDump deepDump(const Procedure& proc, const Value* value)
+{
+    return DeepValueDump(&proc, value);
+}
+inline DeepValueDump deepDump(const Value* value)
+{
+    return DeepValueDump(nullptr, value);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ValueInlines.h b/b3/B3ValueInlines.h
new file mode 100644
index 0000000..57f93d6
--- /dev/null
+++ b/b3/B3ValueInlines.h
@@ -0,0 +1,247 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3CheckValue.h"
+#include "B3Const32Value.h"
+#include "B3Const64Value.h"
+#include "B3ConstDoubleValue.h"
+#include "B3ConstFloatValue.h"
+#include "B3PatchpointValue.h"
+#include "B3PhiChildren.h"
+#include "B3Procedure.h"
+#include "B3Value.h"
+#include <wtf/GraphNodeWorklist.h>
+
+namespace JSC { namespace B3 {
+
+template<typename BottomProvider>
+void Value::replaceWithBottom(const BottomProvider& bottomProvider)
+{
+    if (m_type == Void) {
+        replaceWithNop();
+        return;
+    }
+    
+    if (isConstant())
+        return;
+    
+    replaceWithIdentity(bottomProvider(m_origin, m_type));
+}
+
+template<typename T>
+inline T* Value::as()
+{
+    if (T::accepts(kind()))
+        return static_cast<T*>(this);
+    return nullptr;
+}
+
+template<typename T>
+inline const T* Value::as() const
+{
+    return const_cast<Value*>(this)->as<T>();
+}
+
+inline bool Value::isConstant() const
+{
+    return B3::isConstant(opcode());
+}
+
+inline bool Value::isInteger() const
+{
+    return type() == Int32 || type() == Int64;
+}
+
+inline bool Value::hasInt32() const
+{
+    return !!as<Const32Value>();
+}
+
+inline int32_t Value::asInt32() const
+{
+    return as<Const32Value>()->value();
+}
+
+inline bool Value::isInt32(int32_t value) const
+{
+    return hasInt32() && asInt32() == value;
+}
+
+inline bool Value::hasInt64() const
+{
+    return !!as<Const64Value>();
+}
+
+inline int64_t Value::asInt64() const
+{
+    return as<Const64Value>()->value();
+}
+
+inline bool Value::isInt64(int64_t value) const
+{
+    return hasInt64() && asInt64() == value;
+}
+
+inline bool Value::hasInt() const
+{
+    return hasInt32() || hasInt64();
+}
+
+inline int64_t Value::asInt() const
+{
+    return hasInt32() ? asInt32() : asInt64();
+}
+
+inline bool Value::isInt(int64_t value) const
+{
+    return hasInt() && asInt() == value;
+}
+
+inline bool Value::hasIntPtr() const
+{
+    if (is64Bit())
+        return hasInt64();
+    return hasInt32();
+}
+
+inline intptr_t Value::asIntPtr() const
+{
+    if (is64Bit())
+        return asInt64();
+    return asInt32();
+}
+
+inline bool Value::isIntPtr(intptr_t value) const
+{
+    return hasIntPtr() && asIntPtr() == value;
+}
+
+inline bool Value::hasDouble() const
+{
+    return !!as<ConstDoubleValue>();
+}
+
+inline double Value::asDouble() const
+{
+    return as<ConstDoubleValue>()->value();
+}
+
+inline bool Value::isEqualToDouble(double value) const
+{
+    return hasDouble() && asDouble() == value;
+}
+
+inline bool Value::hasFloat() const
+{
+    return !!as<ConstFloatValue>();
+}
+
+inline float Value::asFloat() const
+{
+    return as<ConstFloatValue>()->value();
+}
+
+inline bool Value::hasNumber() const
+{
+    return hasInt() || hasDouble() || hasFloat();
+}
+
+inline bool Value::isNegativeZero() const
+{
+    if (hasDouble()) {
+        double value = asDouble();
+        return !value && std::signbit(value);
+    }
+    if (hasFloat()) {
+        float value = asFloat();
+        return !value && std::signbit(value);
+    }
+    return false;
+}
+
+template<typename T>
+inline bool Value::isRepresentableAs() const
+{
+    switch (opcode()) {
+    case Const32:
+        return B3::isRepresentableAs<T>(asInt32());
+    case Const64:
+        return B3::isRepresentableAs<T>(asInt64());
+    case ConstDouble:
+        return B3::isRepresentableAs<T>(asDouble());
+    case ConstFloat:
+        return B3::isRepresentableAs<T>(asFloat());
+    default:
+        return false;
+    }
+}
+
+template<typename T>
+inline T Value::asNumber() const
+{
+    switch (opcode()) {
+    case Const32:
+        return static_cast<T>(asInt32());
+    case Const64:
+        return static_cast<T>(asInt64());
+    case ConstDouble:
+        return static_cast<T>(asDouble());
+    case ConstFloat:
+        return static_cast<T>(asFloat());
+    default:
+        return T();
+    }
+}
+
+template<typename Functor>
+void Value::walk(const Functor& functor, PhiChildren* phiChildren)
+{
+    GraphNodeWorklist<Value*> worklist;
+    worklist.push(this);
+    while (Value* value = worklist.pop()) {
+        WalkStatus status = functor(value);
+        switch (status) {
+        case Continue:
+            if (value->opcode() == Phi) {
+                if (phiChildren)
+                    worklist.pushAll(phiChildren->at(value).values());
+            } else
+                worklist.pushAll(value->children());
+            break;
+        case IgnoreChildren:
+            break;
+        case Stop:
+            return;
+        }
+    }
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ValueKey.cpp b/b3/B3ValueKey.cpp
new file mode 100644
index 0000000..10edff3
--- /dev/null
+++ b/b3/B3ValueKey.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3ValueKey.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3ArgumentRegValue.h"
+#include "B3ProcedureInlines.h"
+#include "B3SlotBaseValue.h"
+#include "B3ValueInlines.h"
+#include "B3ValueKeyInlines.h"
+
+namespace JSC { namespace B3 {
+
+ValueKey ValueKey::intConstant(Type type, int64_t value)
+{
+    switch (type) {
+    case Int32:
+        return ValueKey(Const32, Int32, value);
+    case Int64:
+        return ValueKey(Const64, Int64, value);
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return ValueKey();
+    }
+}
+
+void ValueKey::dump(PrintStream& out) const
+{
+    out.print(m_type, " ", m_kind, "(", u.indices[0], ", ", u.indices[1], ", ", u.indices[2], ")");
+}
+
+Value* ValueKey::materialize(Procedure& proc, Origin origin) const
+{
+    switch (opcode()) {
+    case FramePointer:
+        return proc.add<Value>(kind(), type(), origin);
+    case Identity:
+    case Sqrt:
+    case SExt8:
+    case SExt16:
+    case SExt32:
+    case ZExt32:
+    case Clz:
+    case Trunc:
+    case IToD:
+    case IToF:
+    case FloatToDouble:
+    case DoubleToFloat:
+    case Check:
+        return proc.add<Value>(kind(), type(), origin, child(proc, 0));
+    case Add:
+    case Sub:
+    case Mul:
+    case Div:
+    case UDiv:
+    case Mod:
+    case UMod:
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case Shl:
+    case SShr:
+    case ZShr:
+    case RotR:
+    case RotL:
+    case Equal:
+    case NotEqual:
+    case LessThan:
+    case GreaterThan:
+    case Above:
+    case Below:
+    case AboveEqual:
+    case BelowEqual:
+        return proc.add<Value>(kind(), type(), origin, child(proc, 0), child(proc, 1));
+    case Select:
+        return proc.add<Value>(kind(), type(), origin, child(proc, 0), child(proc, 1), child(proc, 2));
+    case Const32:
+        return proc.add<Const32Value>(origin, static_cast<int32_t>(value()));
+    case Const64:
+        return proc.add<Const64Value>(origin, value());
+    case ConstDouble:
+        return proc.add<ConstDoubleValue>(origin, doubleValue());
+    case ConstFloat:
+        return proc.add<ConstFloatValue>(origin, floatValue());
+    case ArgumentReg:
+        return proc.add<ArgumentRegValue>(origin, Reg::fromIndex(static_cast<unsigned>(value())));
+    case SlotBase:
+        return proc.add<SlotBaseValue>(origin, proc.stackSlots()[value()]);
+    default:
+        return nullptr;
+    }
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3ValueKey.h b/b3/B3ValueKey.h
new file mode 100644
index 0000000..18b092c
--- /dev/null
+++ b/b3/B3ValueKey.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3HeapRange.h"
+#include "B3Kind.h"
+#include "B3Origin.h"
+#include "B3Type.h"
+#include <wtf/HashTable.h>
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+class Value;
+
+// ValueKeys are useful for CSE. They abstractly describe the value that a Value returns when it
+// executes. Any Value that has the same ValueKey is guaranteed to return the same value, provided
+// that they return a non-empty ValueKey. Operations that have effects, or that can have their
+// behavior affected by other operations' effects, will return an empty ValueKey. You have to use
+// other mechanisms for doing CSE for impure operations.
+
+class ValueKey {
+public:
+    ValueKey()
+    {
+    }
+
+    ValueKey(Kind kind, Type type)
+        : m_kind(kind)
+        , m_type(type)
+    {
+    }
+
+    ValueKey(Kind, Type, Value* child);
+
+    ValueKey(Kind, Type, Value* left, Value* right);
+
+    ValueKey(Kind, Type, Value* a, Value* b, Value* c);
+
+    ValueKey(Kind kind, Type type, int64_t value)
+        : m_kind(kind)
+        , m_type(type)
+    {
+        u.value = value;
+    }
+
+    ValueKey(Kind kind, Type type, double value)
+        : m_kind(kind)
+        , m_type(type)
+    {
+        u.doubleValue = value;
+    }
+
+    ValueKey(Kind kind, Type type, float value)
+        : m_kind(kind)
+        , m_type(type)
+    {
+        u.floatValue = value;
+    }
+
+    static ValueKey intConstant(Type type, int64_t value);
+
+    Kind kind() const { return m_kind; }
+    Opcode opcode() const { return kind().opcode(); }
+    Type type() const { return m_type; }
+    unsigned childIndex(unsigned index) const { return u.indices[index]; }
+    Value* child(Procedure&, unsigned index) const;
+    int64_t value() const { return u.value; }
+    double doubleValue() const { return u.doubleValue; }
+    double floatValue() const { return u.floatValue; }
+
+    bool operator==(const ValueKey& other) const
+    {
+        return m_kind == other.m_kind
+            && m_type == other.m_type
+            && u == other.u;
+    }
+
+    bool operator!=(const ValueKey& other) const
+    {
+        return !(*this == other);
+    }
+
+    unsigned hash() const
+    {
+        return m_kind.hash() + m_type + WTF::IntHash<int32_t>::hash(u.indices[0]) + u.indices[1] + u.indices[2];
+    }
+
+    explicit operator bool() const { return *this != ValueKey(); }
+
+    void dump(PrintStream&) const;
+
+    bool canMaterialize() const
+    {
+        if (!*this)
+            return false;
+        switch (opcode()) {
+        case CheckAdd:
+        case CheckSub:
+        case CheckMul:
+            return false;
+        default:
+            return true;
+        }
+    }
+
+    bool isConstant() const
+    {
+        return B3::isConstant(opcode());
+    }
+
+    // Attempts to materialize the Value for this ValueKey. May return nullptr if the value cannot
+    // be materialized. This happens for CheckAdd and friends. You can use canMaterialize() to check
+    // if your key is materializable.
+    Value* materialize(Procedure&, Origin) const;
+
+    ValueKey(WTF::HashTableDeletedValueType)
+        : m_type { Int32 }
+    {
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return *this == ValueKey(WTF::HashTableDeletedValue);
+    }
+        
+private:
+    Kind m_kind;
+    Type m_type { Void };
+    union U {
+        unsigned indices[3];
+        int64_t value;
+        double doubleValue;
+        float floatValue;
+
+        U()
+        {
+            indices[0] = 0;
+            indices[1] = 0;
+            indices[2] = 0;
+        }
+
+        bool operator==(const U& other) const
+        {
+            return indices[0] == other.indices[0]
+                && indices[1] == other.indices[1]
+                && indices[2] == other.indices[2];
+        }
+    } u;
+};
+
+struct ValueKeyHash {
+    static unsigned hash(const ValueKey& key) { return key.hash(); }
+    static bool equal(const ValueKey& a, const ValueKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::B3::ValueKey> {
+    typedef JSC::B3::ValueKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::B3::ValueKey> : public SimpleClassHashTraits<JSC::B3::ValueKey> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ValueKeyInlines.h b/b3/B3ValueKeyInlines.h
new file mode 100644
index 0000000..14158d5
--- /dev/null
+++ b/b3/B3ValueKeyInlines.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Procedure.h"
+#include "B3Value.h"
+#include "B3ValueKey.h"
+
+namespace JSC { namespace B3 {
+
+inline ValueKey::ValueKey(Kind kind, Type type, Value* child)
+    : m_kind(kind)
+    , m_type(type)
+{
+    u.indices[0] = child->index();
+}
+
+inline ValueKey::ValueKey(Kind kind, Type type, Value* left, Value* right)
+    : m_kind(kind)
+    , m_type(type)
+{
+    u.indices[0] = left->index();
+    u.indices[1] = right->index();
+}
+
+inline ValueKey::ValueKey(Kind kind, Type type, Value* a, Value* b, Value* c)
+    : m_kind(kind)
+    , m_type(type)
+{
+    u.indices[0] = a->index();
+    u.indices[1] = b->index();
+    u.indices[2] = c->index();
+}
+
+inline Value* ValueKey::child(Procedure& proc, unsigned index) const
+{
+    return proc.values()[index];
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ValueRep.cpp b/b3/B3ValueRep.cpp
new file mode 100644
index 0000000..9888d22
--- /dev/null
+++ b/b3/B3ValueRep.cpp
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3ValueRep.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AssemblyHelpers.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace B3 {
+
+void ValueRep::addUsedRegistersTo(RegisterSet& set) const
+{
+    switch (m_kind) {
+    case WarmAny:
+    case ColdAny:
+    case LateColdAny:
+    case SomeRegister:
+    case SomeEarlyRegister:
+    case Constant:
+        return;
+    case LateRegister:
+    case Register:
+        set.set(reg());
+        return;
+    case Stack:
+    case StackArgument:
+        set.set(MacroAssembler::stackPointerRegister);
+        set.set(GPRInfo::callFrameRegister);
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+RegisterSet ValueRep::usedRegisters() const
+{
+    RegisterSet result;
+    addUsedRegistersTo(result);
+    return result;
+}
+
+void ValueRep::dump(PrintStream& out) const
+{
+    out.print(m_kind);
+    switch (m_kind) {
+    case WarmAny:
+    case ColdAny:
+    case LateColdAny:
+    case SomeRegister:
+    case SomeEarlyRegister:
+        return;
+    case LateRegister:
+    case Register:
+        out.print("(", reg(), ")");
+        return;
+    case Stack:
+        out.print("(", offsetFromFP(), ")");
+        return;
+    case StackArgument:
+        out.print("(", offsetFromSP(), ")");
+        return;
+    case Constant:
+        out.print("(", value(), ")");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ValueRep::emitRestore(AssemblyHelpers& jit, Reg reg) const
+{
+    if (reg.isGPR()) {
+        switch (kind()) {
+        case LateRegister:
+        case Register:
+            if (isGPR())
+                jit.move(gpr(), reg.gpr());
+            else
+                jit.moveDoubleTo64(fpr(), reg.gpr());
+            break;
+        case Stack:
+            jit.load64(AssemblyHelpers::Address(GPRInfo::callFrameRegister, offsetFromFP()), reg.gpr());
+            break;
+        case Constant:
+            jit.move(AssemblyHelpers::TrustedImm64(value()), reg.gpr());
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        return;
+    }
+    
+    switch (kind()) {
+    case LateRegister:
+    case Register:
+        if (isGPR())
+            jit.move64ToDouble(gpr(), reg.fpr());
+        else
+            jit.moveDouble(fpr(), reg.fpr());
+        break;
+    case Stack:
+        jit.loadDouble(AssemblyHelpers::Address(GPRInfo::callFrameRegister, offsetFromFP()), reg.fpr());
+        break;
+    case Constant:
+        jit.move(AssemblyHelpers::TrustedImm64(value()), jit.scratchRegister());
+        jit.move64ToDouble(jit.scratchRegister(), reg.fpr());
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+ValueRecovery ValueRep::recoveryForJSValue() const
+{
+    switch (kind()) {
+    case LateRegister:
+    case Register:
+        return ValueRecovery::inGPR(gpr(), DataFormatJS);
+    case Stack:
+        RELEASE_ASSERT(!(offsetFromFP() % sizeof(EncodedJSValue)));
+        return ValueRecovery::displacedInJSStack(
+            VirtualRegister(offsetFromFP() / sizeof(EncodedJSValue)),
+            DataFormatJS);
+    case Constant:
+        return ValueRecovery::constant(JSValue::decode(value()));
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return { };
+    }
+}
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+using namespace JSC::B3;
+
+void printInternal(PrintStream& out, ValueRep::Kind kind)
+{
+    switch (kind) {
+    case ValueRep::WarmAny:
+        out.print("WarmAny");
+        return;
+    case ValueRep::ColdAny:
+        out.print("ColdAny");
+        return;
+    case ValueRep::LateColdAny:
+        out.print("LateColdAny");
+        return;
+    case ValueRep::SomeRegister:
+        out.print("SomeRegister");
+        return;
+    case ValueRep::SomeEarlyRegister:
+        out.print("SomeEarlyRegister");
+        return;
+    case ValueRep::Register:
+        out.print("Register");
+        return;
+    case ValueRep::LateRegister:
+        out.print("LateRegister");
+        return;
+    case ValueRep::Stack:
+        out.print("Stack");
+        return;
+    case ValueRep::StackArgument:
+        out.print("StackArgument");
+        return;
+    case ValueRep::Constant:
+        out.print("Constant");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3ValueRep.h b/b3/B3ValueRep.h
new file mode 100644
index 0000000..5f9635e
--- /dev/null
+++ b/b3/B3ValueRep.h
@@ -0,0 +1,288 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "JSCJSValue.h"
+#include "Reg.h"
+#include "RegisterSet.h"
+#include "ValueRecovery.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class AssemblyHelpers;
+
+namespace B3 {
+
+// We use this class to describe value representations at stackmaps. It's used both to force a
+// representation and to get the representation. When the B3 client forces a representation, we say
+// that it's an input. When B3 tells the client what representation it picked, we say that it's an
+// output.
+
+class ValueRep {
+public:
+    enum Kind {
+        // As an input representation, this means that B3 can pick any representation. As an output
+        // representation, this means that we don't know. This will only arise as an output
+        // representation for the active arguments of Check/CheckAdd/CheckSub/CheckMul.
+        WarmAny,
+
+        // Same as WarmAny, but implies that the use is cold. A cold use is not counted as a use for
+        // computing the priority of the used temporary.
+        ColdAny,
+
+        // Same as ColdAny, but also implies that the use occurs after all other effects of the stackmap
+        // value.
+        LateColdAny,
+
+        // As an input representation, this means that B3 should pick some register. It could be a
+        // register that this claims to clobber!
+        SomeRegister,
+
+        // As an input representation, this tells us that B3 should pick some register, but implies
+        // that the def happens before any of the effects of the stackmap. This is only valid for
+        // the result constraint of a Patchpoint.
+        SomeEarlyRegister,
+
+        // As an input representation, this forces a particular register. As an output
+        // representation, this tells us what register B3 picked.
+        Register,
+
+        // As an input representation, this forces a particular register and states that
+        // the register is used late. This means that the register is used after the result
+        // is defined (i.e, the result will interfere with this as an input).
+        // It's not a valid output representation.
+        LateRegister,
+
+        // As an output representation, this tells us what stack slot B3 picked. It's not a valid
+        // input representation.
+        Stack,
+
+        // As an input representation, this forces the value to end up in the argument area at some
+        // offset.
+        StackArgument,
+
+        // As an output representation, this tells us that B3 constant-folded the value.
+        Constant
+    };
+    
+    ValueRep()
+        : m_kind(WarmAny)
+    {
+    }
+
+    explicit ValueRep(Reg reg)
+        : m_kind(Register)
+    {
+        u.reg = reg;
+    }
+
+    ValueRep(Kind kind)
+        : m_kind(kind)
+    {
+        ASSERT(kind == WarmAny || kind == ColdAny || kind == LateColdAny || kind == SomeRegister || kind == SomeEarlyRegister);
+    }
+
+    static ValueRep reg(Reg reg)
+    {
+        return ValueRep(reg);
+    }
+
+    static ValueRep lateReg(Reg reg)
+    {
+        ValueRep result(reg);
+        result.m_kind = LateRegister;
+        return result;
+    }
+
+    static ValueRep stack(intptr_t offsetFromFP)
+    {
+        ValueRep result;
+        result.m_kind = Stack;
+        result.u.offsetFromFP = offsetFromFP;
+        return result;
+    }
+
+    static ValueRep stackArgument(intptr_t offsetFromSP)
+    {
+        ValueRep result;
+        result.m_kind = StackArgument;
+        result.u.offsetFromSP = offsetFromSP;
+        return result;
+    }
+
+    static ValueRep constant(int64_t value)
+    {
+        ValueRep result;
+        result.m_kind = Constant;
+        result.u.value = value;
+        return result;
+    }
+
+    static ValueRep constantDouble(double value)
+    {
+        return ValueRep::constant(bitwise_cast<int64_t>(value));
+    }
+
+    Kind kind() const { return m_kind; }
+
+    bool operator==(const ValueRep& other) const
+    {
+        if (kind() != other.kind())
+            return false;
+        switch (kind()) {
+        case LateRegister:
+        case Register:
+            return u.reg == other.u.reg;
+        case Stack:
+            return u.offsetFromFP == other.u.offsetFromFP;
+        case StackArgument:
+            return u.offsetFromSP == other.u.offsetFromSP;
+        case Constant:
+            return u.value == other.u.value;
+        default:
+            return true;
+        }
+    }
+
+    bool operator!=(const ValueRep& other) const
+    {
+        return !(*this == other);
+    }
+
+    explicit operator bool() const { return kind() != WarmAny; }
+
+    bool isAny() const { return kind() == WarmAny || kind() == ColdAny || kind() == LateColdAny; }
+
+    bool isReg() const { return kind() == Register || kind() == LateRegister; }
+    
+    Reg reg() const
+    {
+        ASSERT(isReg());
+        return u.reg;
+    }
+
+    bool isGPR() const { return isReg() && reg().isGPR(); }
+    bool isFPR() const { return isReg() && reg().isFPR(); }
+
+    GPRReg gpr() const { return reg().gpr(); }
+    FPRReg fpr() const { return reg().fpr(); }
+
+    bool isStack() const { return kind() == Stack; }
+
+    intptr_t offsetFromFP() const
+    {
+        ASSERT(isStack());
+        return u.offsetFromFP;
+    }
+
+    bool isStackArgument() const { return kind() == StackArgument; }
+
+    intptr_t offsetFromSP() const
+    {
+        ASSERT(isStackArgument());
+        return u.offsetFromSP;
+    }
+
+    bool isConstant() const { return kind() == Constant; }
+
+    int64_t value() const
+    {
+        ASSERT(isConstant());
+        return u.value;
+    }
+
+    double doubleValue() const
+    {
+        return bitwise_cast<double>(value());
+    }
+
+    ValueRep withOffset(intptr_t offset) const
+    {
+        switch (kind()) {
+        case Stack:
+            return stack(offsetFromFP() + offset);
+        case StackArgument:
+            return stackArgument(offsetFromSP() + offset);
+        default:
+            return *this;
+        }
+    }
+
+    void addUsedRegistersTo(RegisterSet&) const;
+    
+    RegisterSet usedRegisters() const;
+
+    // Get the used registers for a vector of ValueReps.
+    template<typename VectorType>
+    static RegisterSet usedRegisters(const VectorType& vector)
+    {
+        RegisterSet result;
+        for (const ValueRep& value : vector)
+            value.addUsedRegistersTo(result);
+        return result;
+    }
+
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+
+    // This has a simple contract: it emits code to restore the value into the given register. This
+    // will work even if it requires moving between bits a GPR and a FPR.
+    void emitRestore(AssemblyHelpers&, Reg) const;
+
+    // Computes the ValueRecovery assuming that the Value* was for a JSValue (i.e. Int64).
+    // NOTE: We should avoid putting JSValue-related methods in B3, but this was hard to avoid
+    // because some parts of JSC use ValueRecovery like a general "where my bits at" object, almost
+    // exactly like ValueRep.
+    ValueRecovery recoveryForJSValue() const;
+
+private:
+    Kind m_kind;
+    union U {
+        Reg reg;
+        intptr_t offsetFromFP;
+        intptr_t offsetFromSP;
+        int64_t value;
+
+        U()
+        {
+            memset(this, 0, sizeof(*this));
+        }
+    } u;
+};
+
+} } // namespace JSC::B3
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::B3::ValueRep::Kind);
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3Variable.cpp b/b3/B3Variable.cpp
new file mode 100644
index 0000000..2314ee2
--- /dev/null
+++ b/b3/B3Variable.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3Variable.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+Variable::~Variable()
+{
+}
+
+void Variable::dump(PrintStream& out) const
+{
+    out.print("var", m_index);
+}
+
+void Variable::deepDump(PrintStream& out) const
+{
+    out.print(m_type, " var", m_index);
+}
+
+Variable::Variable(Type type)
+    : m_type(type)
+{
+    ASSERT(type != Void);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3Variable.h b/b3/B3Variable.h
new file mode 100644
index 0000000..f4d610f
--- /dev/null
+++ b/b3/B3Variable.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3SparseCollection.h"
+#include "B3Type.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+class Variable {
+    WTF_MAKE_NONCOPYABLE(Variable);
+    WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    ~Variable();
+
+    Type type() const { return m_type; }
+    unsigned index() const { return m_index; }
+
+    void dump(PrintStream&) const;
+    void deepDump(PrintStream&) const;
+
+private:
+    friend class Procedure;
+    friend class SparseCollection<Variable>;
+
+    Variable(Type);
+    
+    unsigned m_index;
+    Type m_type;
+};
+
+class DeepVariableDump {
+public:
+    DeepVariableDump(const Variable* variable)
+        : m_variable(variable)
+    {
+    }
+
+    void dump(PrintStream& out) const
+    {
+        if (m_variable)
+            m_variable->deepDump(out);
+        else
+            out.print("<null>");
+    }
+
+private:
+    const Variable* m_variable;
+};
+
+inline DeepVariableDump deepDump(const Variable* variable)
+{
+    return DeepVariableDump(variable);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3VariableValue.cpp b/b3/B3VariableValue.cpp
new file mode 100644
index 0000000..6aeef47
--- /dev/null
+++ b/b3/B3VariableValue.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "B3VariableValue.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3Variable.h"
+
+namespace JSC { namespace B3 {
+
+VariableValue::~VariableValue()
+{
+}
+
+void VariableValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma, pointerDump(m_variable));
+}
+
+Value* VariableValue::cloneImpl() const
+{
+    return new VariableValue(*this);
+}
+
+VariableValue::VariableValue(Kind kind, Origin origin, Variable* variable, Value* value)
+    : Value(CheckedOpcode, kind, Void, origin, value)
+    , m_variable(variable)
+{
+    ASSERT(kind == Set);
+}
+
+VariableValue::VariableValue(Kind kind, Origin origin, Variable* variable)
+    : Value(CheckedOpcode, kind, variable->type(), origin)
+    , m_variable(variable)
+{
+    ASSERT(kind == Get);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3VariableValue.h b/b3/B3VariableValue.h
new file mode 100644
index 0000000..067ba42
--- /dev/null
+++ b/b3/B3VariableValue.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class Variable;
+
+class JS_EXPORT_PRIVATE VariableValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == Get || kind == Set; }
+
+    ~VariableValue();
+
+    Variable* variable() const { return m_variable; }
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    // Use this for Set.
+    VariableValue(Kind, Origin, Variable*, Value*);
+
+    // Use this for Get.
+    VariableValue(Kind, Origin, Variable*);
+
+    Variable* m_variable;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3WasmAddressValue.cpp b/b3/B3WasmAddressValue.cpp
new file mode 100644
index 0000000..57d7628
--- /dev/null
+++ b/b3/B3WasmAddressValue.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "B3WasmAddressValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+WasmAddressValue::~WasmAddressValue()
+{
+}
+
+void WasmAddressValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma, m_pinnedGPR);
+}
+
+Value* WasmAddressValue::cloneImpl() const
+{
+    return new WasmAddressValue(*this);
+}
+
+WasmAddressValue::WasmAddressValue(Origin origin, Value* value, GPRReg pinnedGPR)
+    : Value(CheckedOpcode, WasmAddress, Int64, origin, value)
+    , m_pinnedGPR(pinnedGPR)
+{
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/B3WasmAddressValue.h b/b3/B3WasmAddressValue.h
new file mode 100644
index 0000000..d938602
--- /dev/null
+++ b/b3/B3WasmAddressValue.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+
+namespace JSC { namespace B3 {
+
+class JS_EXPORT_PRIVATE WasmAddressValue : public Value {
+public:
+    static bool accepts(Kind kind) { return kind == WasmAddress; }
+
+    ~WasmAddressValue();
+
+    GPRReg pinnedGPR() const { return m_pinnedGPR; }
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    WasmAddressValue(Origin, Value*, GPRReg);
+
+    GPRReg m_pinnedGPR;
+};
+
+} } // namespace JSC::B3
+
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3WasmBoundsCheckValue.cpp b/b3/B3WasmBoundsCheckValue.cpp
new file mode 100644
index 0000000..b3a3290
--- /dev/null
+++ b/b3/B3WasmBoundsCheckValue.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "B3WasmBoundsCheckValue.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 {
+
+WasmBoundsCheckValue::~WasmBoundsCheckValue()
+{
+}
+
+WasmBoundsCheckValue::WasmBoundsCheckValue(Origin origin, Value* ptr, GPRReg pinnedGPR, unsigned offset)
+    : Value(CheckedOpcode, WasmBoundsCheck, origin, ptr)
+    , m_pinnedGPR(pinnedGPR)
+    , m_offset(offset)
+{
+}
+
+Value* WasmBoundsCheckValue::cloneImpl() const
+{
+    return new WasmBoundsCheckValue(*this);
+}
+
+void WasmBoundsCheckValue::dumpMeta(CommaPrinter& comma, PrintStream& out) const
+{
+    out.print(comma, "sizeRegister = ", m_pinnedGPR, ", offset = ", m_offset);
+}
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/B3WasmBoundsCheckValue.h b/b3/B3WasmBoundsCheckValue.h
new file mode 100644
index 0000000..ccc54b8
--- /dev/null
+++ b/b3/B3WasmBoundsCheckValue.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3Value.h"
+#include "CCallHelpers.h"
+
+namespace JSC { namespace B3 {
+
+class WasmBoundsCheckValue : public Value {
+public:
+    static bool accepts(Kind kind)
+    {
+        switch (kind.opcode()) {
+        case WasmBoundsCheck:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    ~WasmBoundsCheckValue();
+
+    GPRReg pinnedGPR() const { return m_pinnedGPR; }
+    unsigned offset() const { return m_offset; }
+
+protected:
+    void dumpMeta(CommaPrinter&, PrintStream&) const override;
+
+    Value* cloneImpl() const override;
+
+private:
+    friend class Procedure;
+
+    JS_EXPORT_PRIVATE WasmBoundsCheckValue(Origin, Value* ptr, GPRReg pinnedGPR, unsigned offset);
+
+    GPRReg m_pinnedGPR;
+    unsigned m_offset;
+};
+
+} } // namespace JSC::B3
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirAllocateStack.cpp b/b3/air/AirAllocateStack.cpp
new file mode 100644
index 0000000..de9297f
--- /dev/null
+++ b/b3/air/AirAllocateStack.cpp
@@ -0,0 +1,308 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirAllocateStack.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirArgInlines.h"
+#include "AirCode.h"
+#include "AirInsertionSet.h"
+#include "AirInstInlines.h"
+#include "AirLiveness.h"
+#include "AirPhaseScope.h"
+#include "StackAlignment.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+const bool verbose = false;
+
+bool attemptAssignment(
+    StackSlot* slot, intptr_t offsetFromFP, const Vector<StackSlot*>& otherSlots)
+{
+    if (verbose)
+        dataLog("Attempting to assign ", pointerDump(slot), " to ", offsetFromFP, " with interference ", pointerListDump(otherSlots), "\n");
+
+    // Need to align it to the slot's desired alignment.
+    offsetFromFP = -WTF::roundUpToMultipleOf(slot->alignment(), -offsetFromFP);
+    
+    for (StackSlot* otherSlot : otherSlots) {
+        if (!otherSlot->offsetFromFP())
+            continue;
+        bool overlap = WTF::rangesOverlap(
+            offsetFromFP,
+            offsetFromFP + static_cast<intptr_t>(slot->byteSize()),
+            otherSlot->offsetFromFP(),
+            otherSlot->offsetFromFP() + static_cast<intptr_t>(otherSlot->byteSize()));
+        if (overlap)
+            return false;
+    }
+
+    if (verbose)
+        dataLog("Assigned ", pointerDump(slot), " to ", offsetFromFP, "\n");
+    slot->setOffsetFromFP(offsetFromFP);
+    return true;
+}
+
+void assign(StackSlot* slot, const Vector<StackSlot*>& otherSlots)
+{
+    if (verbose)
+        dataLog("Attempting to assign ", pointerDump(slot), " with interference ", pointerListDump(otherSlots), "\n");
+    
+    if (attemptAssignment(slot, -static_cast<intptr_t>(slot->byteSize()), otherSlots))
+        return;
+
+    for (StackSlot* otherSlot : otherSlots) {
+        if (!otherSlot->offsetFromFP())
+            continue;
+        bool didAssign = attemptAssignment(
+            slot, otherSlot->offsetFromFP() - static_cast<intptr_t>(slot->byteSize()), otherSlots);
+        if (didAssign)
+            return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // anonymous namespace
+
+void allocateStack(Code& code)
+{
+    PhaseScope phaseScope(code, "allocateStack");
+
+    // Allocate all of the escaped slots in order. This is kind of a crazy algorithm to allow for
+    // the possibility of stack slots being assigned frame offsets before we even get here.
+    ASSERT(!code.frameSize());
+    Vector<StackSlot*> assignedEscapedStackSlots;
+    Vector<StackSlot*> escapedStackSlotsWorklist;
+    for (StackSlot* slot : code.stackSlots()) {
+        if (slot->isLocked()) {
+            if (slot->offsetFromFP())
+                assignedEscapedStackSlots.append(slot);
+            else
+                escapedStackSlotsWorklist.append(slot);
+        } else {
+            // It would be super strange to have an unlocked stack slot that has an offset already.
+            ASSERT(!slot->offsetFromFP());
+        }
+    }
+    // This is a fairly expensive loop, but it's OK because we'll usually only have a handful of
+    // escaped stack slots.
+    while (!escapedStackSlotsWorklist.isEmpty()) {
+        StackSlot* slot = escapedStackSlotsWorklist.takeLast();
+        assign(slot, assignedEscapedStackSlots);
+        assignedEscapedStackSlots.append(slot);
+    }
+
+    // Now we handle the spill slots.
+    StackSlotLiveness liveness(code);
+    IndexMap<StackSlot, HashSet<StackSlot*>> interference(code.stackSlots().size());
+    Vector<StackSlot*> slots;
+
+    for (BasicBlock* block : code) {
+        StackSlotLiveness::LocalCalc localCalc(liveness, block);
+
+        auto interfere = [&] (unsigned instIndex) {
+            if (verbose)
+                dataLog("Interfering: ", WTF::pointerListDump(localCalc.live()), "\n");
+
+            Inst::forEachDef<Arg>(
+                block->get(instIndex), block->get(instIndex + 1),
+                [&] (Arg& arg, Arg::Role, Arg::Type, Arg::Width) {
+                    if (!arg.isStack())
+                        return;
+                    StackSlot* slot = arg.stackSlot();
+                    if (slot->kind() != StackSlotKind::Spill)
+                        return;
+
+                    for (StackSlot* otherSlot : localCalc.live()) {
+                        interference[slot].add(otherSlot);
+                        interference[otherSlot].add(slot);
+                    }
+                });
+        };
+
+        for (unsigned instIndex = block->size(); instIndex--;) {
+            if (verbose)
+                dataLog("Analyzing: ", block->at(instIndex), "\n");
+
+            // Kill dead stores. For simplicity we say that a store is killable if it has only late
+            // defs and those late defs are to things that are dead right now. We only do that
+            // because that's the only kind of dead stack store we will see here.
+            Inst& inst = block->at(instIndex);
+            if (!inst.hasNonArgEffects()) {
+                bool ok = true;
+                inst.forEachArg(
+                    [&] (Arg& arg, Arg::Role role, Arg::Type, Arg::Width) {
+                        if (Arg::isEarlyDef(role)) {
+                            ok = false;
+                            return;
+                        }
+                        if (!Arg::isLateDef(role))
+                            return;
+                        if (!arg.isStack()) {
+                            ok = false;
+                            return;
+                        }
+                        StackSlot* slot = arg.stackSlot();
+                        if (slot->kind() != StackSlotKind::Spill) {
+                            ok = false;
+                            return;
+                        }
+
+                        if (localCalc.isLive(slot)) {
+                            ok = false;
+                            return;
+                        }
+                    });
+                if (ok)
+                    inst = Inst();
+            }
+            
+            interfere(instIndex);
+            localCalc.execute(instIndex);
+        }
+        interfere(-1);
+        
+        block->insts().removeAllMatching(
+            [&] (const Inst& inst) -> bool {
+                return !inst;
+            });
+    }
+
+    if (verbose) {
+        for (StackSlot* slot : code.stackSlots())
+            dataLog("Interference of ", pointerDump(slot), ": ", pointerListDump(interference[slot]), "\n");
+    }
+
+    // Now we assign stack locations. At its heart this algorithm is just first-fit. For each
+    // StackSlot we just want to find the offsetFromFP that is closest to zero while ensuring no
+    // overlap with other StackSlots that this overlaps with.
+    Vector<StackSlot*> otherSlots = assignedEscapedStackSlots;
+    for (StackSlot* slot : code.stackSlots()) {
+        if (slot->offsetFromFP()) {
+            // Already assigned an offset.
+            continue;
+        }
+
+        HashSet<StackSlot*>& interferingSlots = interference[slot];
+        otherSlots.resize(assignedEscapedStackSlots.size());
+        otherSlots.resize(assignedEscapedStackSlots.size() + interferingSlots.size());
+        unsigned nextIndex = assignedEscapedStackSlots.size();
+        for (StackSlot* otherSlot : interferingSlots)
+            otherSlots[nextIndex++] = otherSlot;
+
+        assign(slot, otherSlots);
+    }
+
+    // Figure out how much stack we're using for stack slots.
+    unsigned frameSizeForStackSlots = 0;
+    for (StackSlot* slot : code.stackSlots()) {
+        frameSizeForStackSlots = std::max(
+            frameSizeForStackSlots,
+            static_cast<unsigned>(-slot->offsetFromFP()));
+    }
+
+    frameSizeForStackSlots = WTF::roundUpToMultipleOf(stackAlignmentBytes(), frameSizeForStackSlots);
+
+    // Now we need to deduce how much argument area we need.
+    for (BasicBlock* block : code) {
+        for (Inst& inst : *block) {
+            for (Arg& arg : inst.args) {
+                if (arg.isCallArg()) {
+                    // For now, we assume that we use 8 bytes of the call arg. But that's not
+                    // such an awesome assumption.
+                    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=150454
+                    ASSERT(arg.offset() >= 0);
+                    code.requestCallArgAreaSizeInBytes(arg.offset() + 8);
+                }
+            }
+        }
+    }
+
+    code.setFrameSize(frameSizeForStackSlots + code.callArgAreaSizeInBytes());
+
+    // Finally, transform the code to use Addr's instead of StackSlot's. This is a lossless
+    // transformation since we can search the StackSlots array to figure out which StackSlot any
+    // offset-from-FP refers to.
+
+    // FIXME: This may produce addresses that aren't valid if we end up with a ginormous stack frame.
+    // We would have to scavenge for temporaries if this happened. Fortunately, this case will be
+    // extremely rare so we can do crazy things when it arises.
+    // https://bugs.webkit.org/show_bug.cgi?id=152530
+
+    InsertionSet insertionSet(code);
+    for (BasicBlock* block : code) {
+        for (unsigned instIndex = 0; instIndex < block->size(); ++instIndex) {
+            Inst& inst = block->at(instIndex);
+            inst.forEachArg(
+                [&] (Arg& arg, Arg::Role role, Arg::Type, Arg::Width width) {
+                    auto stackAddr = [&] (int32_t offset) -> Arg {
+                        return Arg::stackAddr(offset, code.frameSize(), width);
+                    };
+                    
+                    switch (arg.kind()) {
+                    case Arg::Stack: {
+                        StackSlot* slot = arg.stackSlot();
+                        if (Arg::isZDef(role)
+                            && slot->kind() == StackSlotKind::Spill
+                            && slot->byteSize() > Arg::bytes(width)) {
+                            // Currently we only handle this simple case because it's the only one
+                            // that arises: ZDef's are only 32-bit right now. So, when we hit these
+                            // assertions it means that we need to implement those other kinds of
+                            // zero fills.
+                            RELEASE_ASSERT(slot->byteSize() == 8);
+                            RELEASE_ASSERT(width == Arg::Width32);
+
+                            RELEASE_ASSERT(isValidForm(StoreZero32, Arg::Stack));
+                            insertionSet.insert(
+                                instIndex + 1, StoreZero32, inst.origin,
+                                stackAddr(arg.offset() + 4 + slot->offsetFromFP()));
+                        }
+                        arg = stackAddr(arg.offset() + slot->offsetFromFP());
+                        break;
+                    }
+                    case Arg::CallArg:
+                        arg = stackAddr(arg.offset() - code.frameSize());
+                        break;
+                    default:
+                        break;
+                    }
+                }
+            );
+        }
+        insertionSet.execute(block);
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
+
diff --git a/b3/air/AirAllocateStack.h b/b3/air/AirAllocateStack.h
new file mode 100644
index 0000000..31519d2
--- /dev/null
+++ b/b3/air/AirAllocateStack.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This allocates StackSlots to places on the stack. It first allocates the pinned ones in index
+// order and then it allocates the rest using first fit. Takes the opportunity to kill dead
+// assignments to stack slots, since it knows which ones are live. Also fixes ZDefs to anonymous
+// stack slots.
+
+void allocateStack(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirArg.cpp b/b3/air/AirArg.cpp
new file mode 100644
index 0000000..c777928
--- /dev/null
+++ b/b3/air/AirArg.cpp
@@ -0,0 +1,350 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirArg.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirSpecial.h"
+#include "AirStackSlot.h"
+#include "B3Value.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wreturn-type"
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+namespace JSC { namespace B3 { namespace Air {
+
+bool Arg::isStackMemory() const
+{
+    switch (kind()) {
+    case Addr:
+        return base() == Air::Tmp(GPRInfo::callFrameRegister)
+            || base() == Air::Tmp(MacroAssembler::stackPointerRegister);
+    case Stack:
+    case CallArg:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool Arg::isRepresentableAs(Width width, Signedness signedness) const
+{
+    return isRepresentableAs(width, signedness, value());
+}
+
+bool Arg::usesTmp(Air::Tmp tmp) const
+{
+    bool uses = false;
+    const_cast<Arg*>(this)->forEachTmpFast(
+        [&] (Air::Tmp otherTmp) {
+            if (otherTmp == tmp)
+                uses = true;
+        });
+    return uses;
+}
+
+bool Arg::canRepresent(Value* value) const
+{
+    return isType(typeForB3Type(value->type()));
+}
+
+bool Arg::isCompatibleType(const Arg& other) const
+{
+    if (hasType())
+        return other.isType(type());
+    if (other.hasType())
+        return isType(other.type());
+    return true;
+}
+
+unsigned Arg::jsHash() const
+{
+    unsigned result = static_cast<unsigned>(m_kind);
+    
+    switch (m_kind) {
+    case Invalid:
+    case Special:
+        break;
+    case Tmp:
+        result += m_base.internalValue();
+        break;
+    case Imm:
+    case BitImm:
+    case CallArg:
+    case RelCond:
+    case ResCond:
+    case DoubleCond:
+    case WidthArg:
+        result += static_cast<unsigned>(m_offset);
+        break;
+    case BigImm:
+    case BitImm64:
+        result += static_cast<unsigned>(m_offset);
+        result += static_cast<unsigned>(m_offset >> 32);
+        break;
+    case Addr:
+        result += m_offset;
+        result += m_base.internalValue();
+        break;
+    case Index:
+        result += static_cast<unsigned>(m_offset);
+        result += m_scale;
+        result += m_base.internalValue();
+        result += m_index.internalValue();
+        break;
+    case Stack:
+        result += static_cast<unsigned>(m_scale);
+        result += stackSlot()->index();
+        break;
+    }
+    
+    return result;
+}
+
+void Arg::dump(PrintStream& out) const
+{
+    switch (m_kind) {
+    case Invalid:
+        out.print("<invalid>");
+        return;
+    case Tmp:
+        out.print(tmp());
+        return;
+    case Imm:
+        out.print("$", m_offset);
+        return;
+    case BigImm:
+        out.printf("$0x%llx", static_cast<long long unsigned>(m_offset));
+        return;
+    case BitImm:
+        out.print("$", m_offset);
+        return;
+    case BitImm64:
+        out.printf("$0x%llx", static_cast<long long unsigned>(m_offset));
+        return;
+    case Addr:
+        if (offset())
+            out.print(offset());
+        out.print("(", base(), ")");
+        return;
+    case Index:
+        if (offset())
+            out.print(offset());
+        out.print("(", base(), ",", index());
+        if (scale() != 1)
+            out.print(",", scale());
+        out.print(")");
+        return;
+    case Stack:
+        if (offset())
+            out.print(offset());
+        out.print("(", pointerDump(stackSlot()), ")");
+        return;
+    case CallArg:
+        if (offset())
+            out.print(offset());
+        out.print("(callArg)");
+        return;
+    case RelCond:
+        out.print(asRelationalCondition());
+        return;
+    case ResCond:
+        out.print(asResultCondition());
+        return;
+    case DoubleCond:
+        out.print(asDoubleCondition());
+        return;
+    case Special:
+        out.print(pointerDump(special()));
+        return;
+    case WidthArg:
+        out.print(width());
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} } } // namespace JSC::B3::Air
+
+namespace WTF {
+
+using namespace JSC::B3::Air;
+
+void printInternal(PrintStream& out, Arg::Kind kind)
+{
+    switch (kind) {
+    case Arg::Invalid:
+        out.print("Invalid");
+        return;
+    case Arg::Tmp:
+        out.print("Tmp");
+        return;
+    case Arg::Imm:
+        out.print("Imm");
+        return;
+    case Arg::BigImm:
+        out.print("BigImm");
+        return;
+    case Arg::BitImm:
+        out.print("BitImm");
+        return;
+    case Arg::BitImm64:
+        out.print("BitImm64");
+        return;
+    case Arg::Addr:
+        out.print("Addr");
+        return;
+    case Arg::Stack:
+        out.print("Stack");
+        return;
+    case Arg::CallArg:
+        out.print("CallArg");
+        return;
+    case Arg::Index:
+        out.print("Index");
+        return;
+    case Arg::RelCond:
+        out.print("RelCond");
+        return;
+    case Arg::ResCond:
+        out.print("ResCond");
+        return;
+    case Arg::DoubleCond:
+        out.print("DoubleCond");
+        return;
+    case Arg::Special:
+        out.print("Special");
+        return;
+    case Arg::WidthArg:
+        out.print("WidthArg");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, Arg::Role role)
+{
+    switch (role) {
+    case Arg::Use:
+        out.print("Use");
+        return;
+    case Arg::Def:
+        out.print("Def");
+        return;
+    case Arg::UseDef:
+        out.print("UseDef");
+        return;
+    case Arg::ZDef:
+        out.print("ZDef");
+        return;
+    case Arg::UseZDef:
+        out.print("UseZDef");
+        return;
+    case Arg::UseAddr:
+        out.print("UseAddr");
+        return;
+    case Arg::ColdUse:
+        out.print("ColdUse");
+        return;
+    case Arg::LateUse:
+        out.print("LateUse");
+        return;
+    case Arg::LateColdUse:
+        out.print("LateColdUse");
+        return;
+    case Arg::EarlyDef:
+        out.print("EarlyDef");
+        return;
+    case Arg::Scratch:
+        out.print("Scratch");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, Arg::Type type)
+{
+    switch (type) {
+    case Arg::GP:
+        out.print("GP");
+        return;
+    case Arg::FP:
+        out.print("FP");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, Arg::Width width)
+{
+    switch (width) {
+    case Arg::Width8:
+        out.print("8");
+        return;
+    case Arg::Width16:
+        out.print("16");
+        return;
+    case Arg::Width32:
+        out.print("32");
+        return;
+    case Arg::Width64:
+        out.print("64");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, Arg::Signedness signedness)
+{
+    switch (signedness) {
+    case Arg::Signed:
+        out.print("Signed");
+        return;
+    case Arg::Unsigned:
+        out.print("Unsigned");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic pop
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirArg.h b/b3/air/AirArg.h
new file mode 100644
index 0000000..13db1ce
--- /dev/null
+++ b/b3/air/AirArg.h
@@ -0,0 +1,1383 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirTmp.h"
+#include "B3Common.h"
+#include "B3Type.h"
+#include <wtf/Optional.h>
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wreturn-type"
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+namespace JSC { namespace B3 {
+
+class Value;
+
+namespace Air {
+
+class Special;
+class StackSlot;
+
+// This class name is also intentionally terse because we will say it a lot. You'll see code like
+// Inst(..., Arg::imm(5), Arg::addr(thing, blah), ...)
+class Arg {
+public:
+    // These enum members are intentionally terse because we have to mention them a lot.
+    enum Kind : int8_t {
+        Invalid,
+
+        // This is either an unassigned temporary or a register. All unassigned temporaries
+        // eventually become registers.
+        Tmp,
+
+        // This is an immediate that the instruction will materialize. Imm is the immediate that can be
+        // inlined into most instructions, while BigImm indicates a constant materialization and is
+        // usually only usable with Move. Specials may also admit it, for example for stackmaps used for
+        // OSR exit and tail calls.
+        // BitImm is an immediate for Bitwise operation (And, Xor, etc).
+        Imm,
+        BigImm,
+        BitImm,
+        BitImm64,
+
+        // These are the addresses. Instructions may load from (Use), store to (Def), or evaluate
+        // (UseAddr) addresses.
+        Addr,
+        Stack,
+        CallArg,
+        Index,
+
+        // Immediate operands that customize the behavior of an operation. You can think of them as
+        // secondary opcodes. They are always "Use"'d.
+        RelCond,
+        ResCond,
+        DoubleCond,
+        Special,
+        WidthArg
+    };
+
+    enum Role : int8_t {
+        // Use means that the Inst will read from this value before doing anything else.
+        //
+        // For Tmp: The Inst will read this Tmp.
+        // For Arg::addr and friends: The Inst will load from this address.
+        // For Arg::imm and friends: The Inst will materialize and use this immediate.
+        // For RelCond/ResCond/Special: This is the only valid role for these kinds.
+        //
+        // Note that Use of an address does not mean escape. It only means that the instruction will
+        // load from the address before doing anything else. This is a bit tricky; for example
+        // Specials could theoretically squirrel away the address and effectively escape it. However,
+        // this is not legal. On the other hand, any address other than Stack is presumed to be
+        // always escaping, and Stack is presumed to be always escaping if it's Locked.
+        Use,
+
+        // Exactly like Use, except that it also implies that the use is cold: that is, replacing the
+        // use with something on the stack is free.
+        ColdUse,
+
+        // LateUse means that the Inst will read from this value after doing its Def's. Note that LateUse
+        // on an Addr or Index still means Use on the internal temporaries. Note that specifying the
+        // same Tmp once as Def and once as LateUse has undefined behavior: the use may happen before
+        // the def, or it may happen after it.
+        LateUse,
+
+        // Combination of LateUse and ColdUse.
+        LateColdUse,
+
+        // Def means that the Inst will write to this value after doing everything else.
+        //
+        // For Tmp: The Inst will write to this Tmp.
+        // For Arg::addr and friends: The Inst will store to this address.
+        // This isn't valid for any other kinds.
+        //
+        // Like Use of address, Def of address does not mean escape.
+        Def,
+
+        // This is a special variant of Def that implies that the upper bits of the target register are
+        // zero-filled. Specifically, if the Width of a ZDef is less than the largest possible width of
+        // the argument (for example, we're on a 64-bit machine and we have a Width32 ZDef of a GPR) then
+        // this has different implications for the upper bits (i.e. the top 32 bits in our example)
+        // depending on the kind of the argument:
+        //
+        // For register: the upper bits are zero-filled.
+        // For anonymous stack slot: the upper bits are zero-filled.
+        // For address: the upper bits are not touched (i.e. we do a 32-bit store in our example).
+        // For tmp: either the upper bits are not touched or they are zero-filled, and we won't know
+        // which until we lower the tmp to either a StackSlot or a Reg.
+        //
+        // The behavior of ZDef is consistent with what happens when you perform 32-bit operations on a
+        // 64-bit GPR. It's not consistent with what happens with 8-bit or 16-bit Defs on x86 GPRs, or
+        // what happens with float Defs in ARM NEON or X86 SSE. Hence why we have both Def and ZDef.
+        ZDef,
+
+        // This is a combined Use and Def. It means that both things happen.
+        UseDef,
+
+        // This is a combined Use and ZDef. It means that both things happen.
+        UseZDef,
+
+        // This is like Def, but implies that the assignment occurs before the start of the Inst's
+        // execution rather than after. Note that specifying the same Tmp once as EarlyDef and once
+        // as Use has undefined behavior: the use may happen before the def, or it may happen after
+        // it.
+        EarlyDef,
+
+        // Some instructions need a scratch register. We model this by saying that the temporary is
+        // defined early and used late. This role implies that.
+        Scratch,
+
+        // This is a special kind of use that is only valid for addresses. It means that the
+        // instruction will evaluate the address expression and consume the effective address, but it
+        // will neither load nor store. This is an escaping use, because now the address may be
+        // passed along to who-knows-where. Note that this isn't really a Use of the Arg, but it does
+        // imply that we're Use'ing any registers that the Arg contains.
+        UseAddr
+    };
+
+    enum Type : int8_t {
+        GP,
+        FP
+    };
+
+    static const unsigned numTypes = 2;
+
+    template<typename Functor>
+    static void forEachType(const Functor& functor)
+    {
+        functor(GP);
+        functor(FP);
+    }
+
+    enum Width : int8_t {
+        Width8,
+        Width16,
+        Width32,
+        Width64
+    };
+
+    static Width pointerWidth()
+    {
+        if (sizeof(void*) == 8)
+            return Width64;
+        return Width32;
+    }
+
+    enum Signedness : int8_t {
+        Signed,
+        Unsigned
+    };
+
+    // Returns true if the Role implies that the Inst will Use the Arg. It's deliberately false for
+    // UseAddr, since isAnyUse() for an Arg::addr means that we are loading from the address.
+    static bool isAnyUse(Role role)
+    {
+        switch (role) {
+        case Use:
+        case ColdUse:
+        case UseDef:
+        case UseZDef:
+        case LateUse:
+        case LateColdUse:
+        case Scratch:
+            return true;
+        case Def:
+        case ZDef:
+        case UseAddr:
+        case EarlyDef:
+            return false;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    static bool isColdUse(Role role)
+    {
+        switch (role) {
+        case ColdUse:
+        case LateColdUse:
+            return true;
+        case Use:
+        case UseDef:
+        case UseZDef:
+        case LateUse:
+        case Def:
+        case ZDef:
+        case UseAddr:
+        case Scratch:
+        case EarlyDef:
+            return false;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    static bool isWarmUse(Role role)
+    {
+        return isAnyUse(role) && !isColdUse(role);
+    }
+
+    static Role cooled(Role role)
+    {
+        switch (role) {
+        case ColdUse:
+        case LateColdUse:
+        case UseDef:
+        case UseZDef:
+        case Def:
+        case ZDef:
+        case UseAddr:
+        case Scratch:
+        case EarlyDef:
+            return role;
+        case Use:
+            return ColdUse;
+        case LateUse:
+            return LateColdUse;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    // Returns true if the Role implies that the Inst will Use the Arg before doing anything else.
+    static bool isEarlyUse(Role role)
+    {
+        switch (role) {
+        case Use:
+        case ColdUse:
+        case UseDef:
+        case UseZDef:
+            return true;
+        case Def:
+        case ZDef:
+        case UseAddr:
+        case LateUse:
+        case LateColdUse:
+        case Scratch:
+        case EarlyDef:
+            return false;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    // Returns true if the Role implies that the Inst will Use the Arg after doing everything else.
+    static bool isLateUse(Role role)
+    {
+        switch (role) {
+        case LateUse:
+        case LateColdUse:
+        case Scratch:
+            return true;
+        case ColdUse:
+        case Use:
+        case UseDef:
+        case UseZDef:
+        case Def:
+        case ZDef:
+        case UseAddr:
+        case EarlyDef:
+            return false;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    // Returns true if the Role implies that the Inst will Def the Arg.
+    static bool isAnyDef(Role role)
+    {
+        switch (role) {
+        case Use:
+        case ColdUse:
+        case UseAddr:
+        case LateUse:
+        case LateColdUse:
+            return false;
+        case Def:
+        case UseDef:
+        case ZDef:
+        case UseZDef:
+        case EarlyDef:
+        case Scratch:
+            return true;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    // Returns true if the Role implies that the Inst will Def the Arg before start of execution.
+    static bool isEarlyDef(Role role)
+    {
+        switch (role) {
+        case Use:
+        case ColdUse:
+        case UseAddr:
+        case LateUse:
+        case Def:
+        case UseDef:
+        case ZDef:
+        case UseZDef:
+        case LateColdUse:
+            return false;
+        case EarlyDef:
+        case Scratch:
+            return true;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    // Returns true if the Role implies that the Inst will Def the Arg after the end of execution.
+    static bool isLateDef(Role role)
+    {
+        switch (role) {
+        case Use:
+        case ColdUse:
+        case UseAddr:
+        case LateUse:
+        case EarlyDef:
+        case Scratch:
+        case LateColdUse:
+            return false;
+        case Def:
+        case UseDef:
+        case ZDef:
+        case UseZDef:
+            return true;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    // Returns true if the Role implies that the Inst will ZDef the Arg.
+    static bool isZDef(Role role)
+    {
+        switch (role) {
+        case Use:
+        case ColdUse:
+        case UseAddr:
+        case LateUse:
+        case Def:
+        case UseDef:
+        case EarlyDef:
+        case Scratch:
+        case LateColdUse:
+            return false;
+        case ZDef:
+        case UseZDef:
+            return true;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    static Type typeForB3Type(B3::Type type)
+    {
+        switch (type) {
+        case Void:
+            ASSERT_NOT_REACHED();
+            return GP;
+        case Int32:
+        case Int64:
+            return GP;
+        case Float:
+        case Double:
+            return FP;
+        }
+        ASSERT_NOT_REACHED();
+        return GP;
+    }
+
+    static Width widthForB3Type(B3::Type type)
+    {
+        switch (type) {
+        case Void:
+            ASSERT_NOT_REACHED();
+            return Width8;
+        case Int32:
+        case Float:
+            return Width32;
+        case Int64:
+        case Double:
+            return Width64;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    static Width conservativeWidth(Type type)
+    {
+        return type == GP ? pointerWidth() : Width64;
+    }
+
+    static Width minimumWidth(Type type)
+    {
+        return type == GP ? Width8 : Width32;
+    }
+
+    static unsigned bytes(Width width)
+    {
+        return 1 << width;
+    }
+
+    static Width widthForBytes(unsigned bytes)
+    {
+        switch (bytes) {
+        case 0:
+        case 1:
+            return Width8;
+        case 2:
+            return Width16;
+        case 3:
+        case 4:
+            return Width32;
+        default:
+            return Width64;
+        }
+    }
+
+    Arg()
+        : m_kind(Invalid)
+    {
+    }
+
+    Arg(Air::Tmp tmp)
+        : m_kind(Tmp)
+        , m_base(tmp)
+    {
+    }
+
+    Arg(Reg reg)
+        : Arg(Air::Tmp(reg))
+    {
+    }
+
+    static Arg imm(int64_t value)
+    {
+        Arg result;
+        result.m_kind = Imm;
+        result.m_offset = value;
+        return result;
+    }
+
+    static Arg bigImm(int64_t value)
+    {
+        Arg result;
+        result.m_kind = BigImm;
+        result.m_offset = value;
+        return result;
+    }
+
+    static Arg bitImm(int64_t value)
+    {
+        Arg result;
+        result.m_kind = BitImm;
+        result.m_offset = value;
+        return result;
+    }
+
+    static Arg bitImm64(int64_t value)
+    {
+        Arg result;
+        result.m_kind = BitImm64;
+        result.m_offset = value;
+        return result;
+    }
+
+    static Arg immPtr(const void* address)
+    {
+        return bigImm(bitwise_cast<intptr_t>(address));
+    }
+
+    static Arg addr(Air::Tmp base, int32_t offset = 0)
+    {
+        ASSERT(base.isGP());
+        Arg result;
+        result.m_kind = Addr;
+        result.m_base = base;
+        result.m_offset = offset;
+        return result;
+    }
+
+    static Arg stack(StackSlot* value, int32_t offset = 0)
+    {
+        Arg result;
+        result.m_kind = Stack;
+        result.m_offset = bitwise_cast<intptr_t>(value);
+        result.m_scale = offset; // I know, yuck.
+        return result;
+    }
+
+    static Arg callArg(int32_t offset)
+    {
+        Arg result;
+        result.m_kind = CallArg;
+        result.m_offset = offset;
+        return result;
+    }
+
+    static Arg stackAddr(int32_t offsetFromFP, unsigned frameSize, Width width)
+    {
+        Arg result = Arg::addr(Air::Tmp(GPRInfo::callFrameRegister), offsetFromFP);
+        if (!result.isValidForm(width)) {
+            result = Arg::addr(
+                Air::Tmp(MacroAssembler::stackPointerRegister),
+                offsetFromFP + frameSize);
+        }
+        return result;
+    }
+
+    // If you don't pass a Width, this optimistically assumes that you're using the right width.
+    static bool isValidScale(unsigned scale, std::optional<Width> width = std::nullopt)
+    {
+        switch (scale) {
+        case 1:
+            if (isX86() || isARM64())
+                return true;
+            return false;
+        case 2:
+        case 4:
+        case 8:
+            if (isX86())
+                return true;
+            if (isARM64()) {
+                if (!width)
+                    return true;
+                return scale == 1 || scale == bytes(*width);
+            }
+            return false;
+        default:
+            return false;
+        }
+    }
+
+    static unsigned logScale(unsigned scale)
+    {
+        switch (scale) {
+        case 1:
+            return 0;
+        case 2:
+            return 1;
+        case 4:
+            return 2;
+        case 8:
+            return 3;
+        default:
+            ASSERT_NOT_REACHED();
+            return 0;
+        }
+    }
+
+    static Arg index(Air::Tmp base, Air::Tmp index, unsigned scale = 1, int32_t offset = 0)
+    {
+        ASSERT(base.isGP());
+        ASSERT(index.isGP());
+        ASSERT(isValidScale(scale));
+        Arg result;
+        result.m_kind = Index;
+        result.m_base = base;
+        result.m_index = index;
+        result.m_scale = static_cast<int32_t>(scale);
+        result.m_offset = offset;
+        return result;
+    }
+
+    static Arg relCond(MacroAssembler::RelationalCondition condition)
+    {
+        Arg result;
+        result.m_kind = RelCond;
+        result.m_offset = condition;
+        return result;
+    }
+
+    static Arg resCond(MacroAssembler::ResultCondition condition)
+    {
+        Arg result;
+        result.m_kind = ResCond;
+        result.m_offset = condition;
+        return result;
+    }
+
+    static Arg doubleCond(MacroAssembler::DoubleCondition condition)
+    {
+        Arg result;
+        result.m_kind = DoubleCond;
+        result.m_offset = condition;
+        return result;
+    }
+
+    static Arg special(Air::Special* special)
+    {
+        Arg result;
+        result.m_kind = Special;
+        result.m_offset = bitwise_cast<intptr_t>(special);
+        return result;
+    }
+
+    static Arg widthArg(Width width)
+    {
+        Arg result;
+        result.m_kind = WidthArg;
+        result.m_offset = width;
+        return result;
+    }
+
+    bool operator==(const Arg& other) const
+    {
+        return m_offset == other.m_offset
+            && m_kind == other.m_kind
+            && m_base == other.m_base
+            && m_index == other.m_index
+            && m_scale == other.m_scale;
+    }
+
+    bool operator!=(const Arg& other) const
+    {
+        return !(*this == other);
+    }
+
+    explicit operator bool() const { return *this != Arg(); }
+
+    Kind kind() const
+    {
+        return m_kind;
+    }
+
+    bool isTmp() const
+    {
+        return kind() == Tmp;
+    }
+
+    bool isImm() const
+    {
+        return kind() == Imm;
+    }
+
+    bool isBigImm() const
+    {
+        return kind() == BigImm;
+    }
+
+    bool isBitImm() const
+    {
+        return kind() == BitImm;
+    }
+
+    bool isBitImm64() const
+    {
+        return kind() == BitImm64;
+    }
+
+    bool isSomeImm() const
+    {
+        switch (kind()) {
+        case Imm:
+        case BigImm:
+        case BitImm:
+        case BitImm64:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isAddr() const
+    {
+        return kind() == Addr;
+    }
+
+    bool isStack() const
+    {
+        return kind() == Stack;
+    }
+
+    bool isCallArg() const
+    {
+        return kind() == CallArg;
+    }
+
+    bool isIndex() const
+    {
+        return kind() == Index;
+    }
+
+    bool isMemory() const
+    {
+        switch (kind()) {
+        case Addr:
+        case Stack:
+        case CallArg:
+        case Index:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isStackMemory() const;
+
+    bool isRelCond() const
+    {
+        return kind() == RelCond;
+    }
+
+    bool isResCond() const
+    {
+        return kind() == ResCond;
+    }
+
+    bool isDoubleCond() const
+    {
+        return kind() == DoubleCond;
+    }
+
+    bool isCondition() const
+    {
+        switch (kind()) {
+        case RelCond:
+        case ResCond:
+        case DoubleCond:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isSpecial() const
+    {
+        return kind() == Special;
+    }
+
+    bool isWidthArg() const
+    {
+        return kind() == WidthArg;
+    }
+
+    bool isAlive() const
+    {
+        return isTmp() || isStack();
+    }
+
+    Air::Tmp tmp() const
+    {
+        ASSERT(kind() == Tmp);
+        return m_base;
+    }
+
+    int64_t value() const
+    {
+        ASSERT(isSomeImm());
+        return m_offset;
+    }
+
+    template<typename T>
+    bool isRepresentableAs() const
+    {
+        return B3::isRepresentableAs<T>(value());
+    }
+    
+    static bool isRepresentableAs(Width width, Signedness signedness, int64_t value)
+    {
+        switch (signedness) {
+        case Signed:
+            switch (width) {
+            case Width8:
+                return B3::isRepresentableAs<int8_t>(value);
+            case Width16:
+                return B3::isRepresentableAs<int16_t>(value);
+            case Width32:
+                return B3::isRepresentableAs<int32_t>(value);
+            case Width64:
+                return B3::isRepresentableAs<int64_t>(value);
+            }
+        case Unsigned:
+            switch (width) {
+            case Width8:
+                return B3::isRepresentableAs<uint8_t>(value);
+            case Width16:
+                return B3::isRepresentableAs<uint16_t>(value);
+            case Width32:
+                return B3::isRepresentableAs<uint32_t>(value);
+            case Width64:
+                return B3::isRepresentableAs<uint64_t>(value);
+            }
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    bool isRepresentableAs(Width, Signedness) const;
+    
+    static int64_t castToType(Width width, Signedness signedness, int64_t value)
+    {
+        switch (signedness) {
+        case Signed:
+            switch (width) {
+            case Width8:
+                return static_cast<int8_t>(value);
+            case Width16:
+                return static_cast<int16_t>(value);
+            case Width32:
+                return static_cast<int32_t>(value);
+            case Width64:
+                return static_cast<int64_t>(value);
+            }
+        case Unsigned:
+            switch (width) {
+            case Width8:
+                return static_cast<uint8_t>(value);
+            case Width16:
+                return static_cast<uint16_t>(value);
+            case Width32:
+                return static_cast<uint32_t>(value);
+            case Width64:
+                return static_cast<uint64_t>(value);
+            }
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    template<typename T>
+    T asNumber() const
+    {
+        return static_cast<T>(value());
+    }
+
+    void* pointerValue() const
+    {
+        ASSERT(kind() == BigImm);
+        return bitwise_cast<void*>(static_cast<intptr_t>(m_offset));
+    }
+
+    Air::Tmp base() const
+    {
+        ASSERT(kind() == Addr || kind() == Index);
+        return m_base;
+    }
+
+    bool hasOffset() const { return isMemory(); }
+    
+    int32_t offset() const
+    {
+        if (kind() == Stack)
+            return static_cast<int32_t>(m_scale);
+        ASSERT(kind() == Addr || kind() == CallArg || kind() == Index);
+        return static_cast<int32_t>(m_offset);
+    }
+
+    StackSlot* stackSlot() const
+    {
+        ASSERT(kind() == Stack);
+        return bitwise_cast<StackSlot*>(m_offset);
+    }
+
+    Air::Tmp index() const
+    {
+        ASSERT(kind() == Index);
+        return m_index;
+    }
+
+    unsigned scale() const
+    {
+        ASSERT(kind() == Index);
+        return m_scale;
+    }
+
+    unsigned logScale() const
+    {
+        return logScale(scale());
+    }
+
+    Air::Special* special() const
+    {
+        ASSERT(kind() == Special);
+        return bitwise_cast<Air::Special*>(m_offset);
+    }
+
+    Width width() const
+    {
+        ASSERT(kind() == WidthArg);
+        return static_cast<Width>(m_offset);
+    }
+
+    bool isGPTmp() const
+    {
+        return isTmp() && tmp().isGP();
+    }
+
+    bool isFPTmp() const
+    {
+        return isTmp() && tmp().isFP();
+    }
+    
+    // Tells us if this Arg can be used in a position that requires a GP value.
+    bool isGP() const
+    {
+        switch (kind()) {
+        case Imm:
+        case BigImm:
+        case BitImm:
+        case BitImm64:
+        case Addr:
+        case Index:
+        case Stack:
+        case CallArg:
+        case RelCond:
+        case ResCond:
+        case DoubleCond:
+        case Special:
+        case WidthArg:
+            return true;
+        case Tmp:
+            return isGPTmp();
+        case Invalid:
+            return false;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    // Tells us if this Arg can be used in a position that requires a FP value.
+    bool isFP() const
+    {
+        switch (kind()) {
+        case Imm:
+        case BitImm:
+        case BitImm64:
+        case RelCond:
+        case ResCond:
+        case DoubleCond:
+        case Special:
+        case WidthArg:
+        case Invalid:
+            return false;
+        case Addr:
+        case Index:
+        case Stack:
+        case CallArg:
+        case BigImm: // Yes, we allow BigImm as a double immediate. We use this for implementing stackmaps.
+            return true;
+        case Tmp:
+            return isFPTmp();
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    bool hasType() const
+    {
+        switch (kind()) {
+        case Imm:
+        case BitImm:
+        case BitImm64:
+        case Special:
+        case Tmp:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    // The type is ambiguous for some arg kinds. Call with care.
+    Type type() const
+    {
+        return isGP() ? GP : FP;
+    }
+
+    bool isType(Type type) const
+    {
+        switch (type) {
+        case GP:
+            return isGP();
+        case FP:
+            return isFP();
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    bool canRepresent(Value* value) const;
+
+    bool isCompatibleType(const Arg& other) const;
+
+    bool isGPR() const
+    {
+        return isTmp() && tmp().isGPR();
+    }
+
+    GPRReg gpr() const
+    {
+        return tmp().gpr();
+    }
+
+    bool isFPR() const
+    {
+        return isTmp() && tmp().isFPR();
+    }
+
+    FPRReg fpr() const
+    {
+        return tmp().fpr();
+    }
+    
+    bool isReg() const
+    {
+        return isTmp() && tmp().isReg();
+    }
+
+    Reg reg() const
+    {
+        return tmp().reg();
+    }
+
+    unsigned gpTmpIndex() const
+    {
+        return tmp().gpTmpIndex();
+    }
+
+    unsigned fpTmpIndex() const
+    {
+        return tmp().fpTmpIndex();
+    }
+
+    unsigned tmpIndex() const
+    {
+        return tmp().tmpIndex();
+    }
+
+    static bool isValidImmForm(int64_t value)
+    {
+        if (isX86())
+            return B3::isRepresentableAs<int32_t>(value);
+        if (isARM64())
+            return isUInt12(value);
+        return false;
+    }
+
+    static bool isValidBitImmForm(int64_t value)
+    {
+        if (isX86())
+            return B3::isRepresentableAs<int32_t>(value);
+        if (isARM64())
+            return ARM64LogicalImmediate::create32(value).isValid();
+        return false;
+    }
+
+    static bool isValidBitImm64Form(int64_t value)
+    {
+        if (isX86())
+            return B3::isRepresentableAs<int32_t>(value);
+        if (isARM64())
+            return ARM64LogicalImmediate::create64(value).isValid();
+        return false;
+    }
+
+    static bool isValidAddrForm(int32_t offset, std::optional<Width> width = std::nullopt)
+    {
+        if (isX86())
+            return true;
+        if (isARM64()) {
+            if (!width)
+                return true;
+
+            if (isValidSignedImm9(offset))
+                return true;
+
+            switch (*width) {
+            case Width8:
+                return isValidScaledUImm12<8>(offset);
+            case Width16:
+                return isValidScaledUImm12<16>(offset);
+            case Width32:
+                return isValidScaledUImm12<32>(offset);
+            case Width64:
+                return isValidScaledUImm12<64>(offset);
+            }
+        }
+        return false;
+    }
+
+    static bool isValidIndexForm(unsigned scale, int32_t offset, std::optional<Width> width = std::nullopt)
+    {
+        if (!isValidScale(scale, width))
+            return false;
+        if (isX86())
+            return true;
+        if (isARM64())
+            return !offset;
+        return false;
+    }
+
+    // If you don't pass a width then this optimistically assumes that you're using the right width. But
+    // the width is relevant to validity, so passing a null width is only useful for assertions. Don't
+    // pass null widths when cascading through Args in the instruction selector!
+    bool isValidForm(std::optional<Width> width = std::nullopt) const
+    {
+        switch (kind()) {
+        case Invalid:
+            return false;
+        case Tmp:
+            return true;
+        case Imm:
+            return isValidImmForm(value());
+        case BigImm:
+            return true;
+        case BitImm:
+            return isValidBitImmForm(value());
+        case BitImm64:
+            return isValidBitImm64Form(value());
+        case Addr:
+        case Stack:
+        case CallArg:
+            return isValidAddrForm(offset(), width);
+        case Index:
+            return isValidIndexForm(scale(), offset(), width);
+        case RelCond:
+        case ResCond:
+        case DoubleCond:
+        case Special:
+        case WidthArg:
+            return true;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    template<typename Functor>
+    void forEachTmpFast(const Functor& functor)
+    {
+        switch (m_kind) {
+        case Tmp:
+        case Addr:
+            functor(m_base);
+            break;
+        case Index:
+            functor(m_base);
+            functor(m_index);
+            break;
+        default:
+            break;
+        }
+    }
+
+    bool usesTmp(Air::Tmp tmp) const;
+
+    template<typename Thing>
+    bool is() const;
+
+    template<typename Thing>
+    Thing as() const;
+
+    template<typename Thing, typename Functor>
+    void forEachFast(const Functor&);
+
+    template<typename Thing, typename Functor>
+    void forEach(Role, Type, Width, const Functor&);
+
+    // This is smart enough to know that an address arg in a Def or UseDef rule will use its
+    // tmps and never def them. For example, this:
+    //
+    // mov %rax, (%rcx)
+    //
+    // This defs (%rcx) but uses %rcx.
+    template<typename Functor>
+    void forEachTmp(Role argRole, Type argType, Width argWidth, const Functor& functor)
+    {
+        switch (m_kind) {
+        case Tmp:
+            ASSERT(isAnyUse(argRole) || isAnyDef(argRole));
+            functor(m_base, argRole, argType, argWidth);
+            break;
+        case Addr:
+            functor(m_base, Use, GP, argRole == UseAddr ? argWidth : pointerWidth());
+            break;
+        case Index:
+            functor(m_base, Use, GP, argRole == UseAddr ? argWidth : pointerWidth());
+            functor(m_index, Use, GP, argRole == UseAddr ? argWidth : pointerWidth());
+            break;
+        default:
+            break;
+        }
+    }
+
+    MacroAssembler::TrustedImm32 asTrustedImm32() const
+    {
+        ASSERT(isImm() || isBitImm());
+        return MacroAssembler::TrustedImm32(static_cast<int32_t>(m_offset));
+    }
+
+#if USE(JSVALUE64)
+    MacroAssembler::TrustedImm64 asTrustedImm64() const
+    {
+        ASSERT(isBigImm() || isBitImm64());
+        return MacroAssembler::TrustedImm64(value());
+    }
+#endif
+
+    MacroAssembler::TrustedImmPtr asTrustedImmPtr() const
+    {
+        if (is64Bit())
+            ASSERT(isBigImm());
+        else
+            ASSERT(isImm());
+        return MacroAssembler::TrustedImmPtr(pointerValue());
+    }
+
+    MacroAssembler::Address asAddress() const
+    {
+        ASSERT(isAddr());
+        return MacroAssembler::Address(m_base.gpr(), static_cast<int32_t>(m_offset));
+    }
+
+    MacroAssembler::BaseIndex asBaseIndex() const
+    {
+        ASSERT(isIndex());
+        return MacroAssembler::BaseIndex(
+            m_base.gpr(), m_index.gpr(), static_cast<MacroAssembler::Scale>(logScale()),
+            static_cast<int32_t>(m_offset));
+    }
+
+    MacroAssembler::RelationalCondition asRelationalCondition() const
+    {
+        ASSERT(isRelCond());
+        return static_cast<MacroAssembler::RelationalCondition>(m_offset);
+    }
+
+    MacroAssembler::ResultCondition asResultCondition() const
+    {
+        ASSERT(isResCond());
+        return static_cast<MacroAssembler::ResultCondition>(m_offset);
+    }
+
+    MacroAssembler::DoubleCondition asDoubleCondition() const
+    {
+        ASSERT(isDoubleCond());
+        return static_cast<MacroAssembler::DoubleCondition>(m_offset);
+    }
+    
+    // Tells you if the Arg is invertible. Only condition arguments are invertible, and even for those, there
+    // are a few exceptions - notably Overflow and Signed.
+    bool isInvertible() const
+    {
+        switch (kind()) {
+        case RelCond:
+        case DoubleCond:
+            return true;
+        case ResCond:
+            return MacroAssembler::isInvertible(asResultCondition());
+        default:
+            return false;
+        }
+    }
+
+    // This is valid for condition arguments. It will invert them.
+    Arg inverted(bool inverted = true) const
+    {
+        if (!inverted)
+            return *this;
+        switch (kind()) {
+        case RelCond:
+            return relCond(MacroAssembler::invert(asRelationalCondition()));
+        case ResCond:
+            return resCond(MacroAssembler::invert(asResultCondition()));
+        case DoubleCond:
+            return doubleCond(MacroAssembler::invert(asDoubleCondition()));
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return Arg();
+        }
+    }
+
+    Arg flipped(bool flipped = true) const
+    {
+        if (!flipped)
+            return Arg();
+        return relCond(MacroAssembler::flip(asRelationalCondition()));
+    }
+
+    bool isSignedCond() const
+    {
+        return isRelCond() && MacroAssembler::isSigned(asRelationalCondition());
+    }
+
+    bool isUnsignedCond() const
+    {
+        return isRelCond() && MacroAssembler::isUnsigned(asRelationalCondition());
+    }
+
+    // This computes a hash for comparing this to JSAir's Arg.
+    unsigned jsHash() const;
+    
+    void dump(PrintStream&) const;
+
+    Arg(WTF::HashTableDeletedValueType)
+        : m_base(WTF::HashTableDeletedValue)
+    {
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return *this == Arg(WTF::HashTableDeletedValue);
+    }
+
+    unsigned hash() const
+    {
+        // This really doesn't have to be that great.
+        return WTF::IntHash<int64_t>::hash(m_offset) + m_kind + m_scale + m_base.hash() +
+            m_index.hash();
+    }
+
+private:
+    int64_t m_offset { 0 };
+    Kind m_kind { Invalid };
+    int32_t m_scale { 1 };
+    Air::Tmp m_base;
+    Air::Tmp m_index;
+};
+
+struct ArgHash {
+    static unsigned hash(const Arg& key) { return key.hash(); }
+    static bool equal(const Arg& a, const Arg& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } } // namespace JSC::B3::Air
+
+namespace WTF {
+
+JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::B3::Air::Arg::Kind);
+JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::B3::Air::Arg::Role);
+JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::B3::Air::Arg::Type);
+JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::B3::Air::Arg::Width);
+JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::B3::Air::Arg::Signedness);
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::B3::Air::Arg> {
+    typedef JSC::B3::Air::ArgHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::B3::Air::Arg> : SimpleClassHashTraits<JSC::B3::Air::Arg> {
+    // Because m_scale is 1 in the empty value.
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic pop
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirArgInlines.h b/b3/air/AirArgInlines.h
new file mode 100644
index 0000000..73f7d5b
--- /dev/null
+++ b/b3/air/AirArgInlines.h
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+template<typename T> struct ArgThingHelper;
+
+template<> struct ArgThingHelper<Tmp> {
+    static bool is(const Arg& arg)
+    {
+        return arg.isTmp();
+    }
+
+    static Tmp as(const Arg& arg)
+    {
+        if (is(arg))
+            return arg.tmp();
+        return Tmp();
+    }
+
+    template<typename Functor>
+    static void forEachFast(Arg& arg, const Functor& functor)
+    {
+        arg.forEachTmpFast(functor);
+    }
+
+    template<typename Functor>
+    static void forEach(Arg& arg, Arg::Role role, Arg::Type type, Arg::Width width, const Functor& functor)
+    {
+        arg.forEachTmp(role, type, width, functor);
+    }
+};
+
+template<> struct ArgThingHelper<Arg> {
+    static bool is(const Arg&)
+    {
+        return true;
+    }
+
+    static Arg as(const Arg& arg)
+    {
+        return arg;
+    }
+
+    template<typename Functor>
+    static void forEachFast(Arg& arg, const Functor& functor)
+    {
+        functor(arg);
+    }
+
+    template<typename Functor>
+    static void forEach(Arg& arg, Arg::Role role, Arg::Type type, Arg::Width width, const Functor& functor)
+    {
+        functor(arg, role, type, width);
+    }
+};
+
+template<> struct ArgThingHelper<StackSlot*> {
+    static bool is(const Arg& arg)
+    {
+        return arg.isStack();
+    }
+    
+    static StackSlot* as(const Arg& arg)
+    {
+        return arg.stackSlot();
+    }
+    
+    template<typename Functor>
+    static void forEachFast(Arg& arg, const Functor& functor)
+    {
+        if (!arg.isStack())
+            return;
+        
+        StackSlot* stackSlot = arg.stackSlot();
+        functor(stackSlot);
+        arg = Arg::stack(stackSlot, arg.offset());
+    }
+    
+    template<typename Functor>
+    static void forEach(Arg& arg, Arg::Role role, Arg::Type type, Arg::Width width, const Functor& functor)
+    {
+        if (!arg.isStack())
+            return;
+        
+        StackSlot* stackSlot = arg.stackSlot();
+        
+        // FIXME: This is way too optimistic about the meaning of "Def". It gets lucky for
+        // now because our only use of "Anonymous" stack slots happens to want the optimistic
+        // semantics. We could fix this by just changing the comments that describe the
+        // semantics of "Anonymous".
+        // https://bugs.webkit.org/show_bug.cgi?id=151128
+        
+        functor(stackSlot, role, type, width);
+        arg = Arg::stack(stackSlot, arg.offset());
+    }
+};
+
+template<> struct ArgThingHelper<Reg> {
+    static bool is(const Arg& arg)
+    {
+        return arg.isReg();
+    }
+    
+    static Reg as(const Arg& arg)
+    {
+        return arg.reg();
+    }
+    
+    template<typename Functor>
+    static void forEachFast(Arg& arg, const Functor& functor)
+    {
+        arg.forEachTmpFast(
+            [&] (Tmp& tmp) {
+                if (!tmp.isReg())
+                    return;
+                
+                Reg reg = tmp.reg();
+                functor(reg);
+                tmp = Tmp(reg);
+            });
+    }
+    
+    template<typename Functor>
+    static void forEach(Arg& arg, Arg::Role argRole, Arg::Type argType, Arg::Width argWidth, const Functor& functor)
+    {
+        arg.forEachTmp(
+            argRole, argType, argWidth,
+            [&] (Tmp& tmp, Arg::Role role, Arg::Type type, Arg::Width width) {
+                if (!tmp.isReg())
+                    return;
+                
+                Reg reg = tmp.reg();
+                functor(reg, role, type, width);
+                tmp = Tmp(reg);
+            });
+    }
+};
+
+template<typename Thing>
+bool Arg::is() const
+{
+    return ArgThingHelper<Thing>::is(*this);
+}
+
+template<typename Thing>
+Thing Arg::as() const
+{
+    return ArgThingHelper<Thing>::as(*this);
+}
+
+template<typename Thing, typename Functor>
+void Arg::forEachFast(const Functor& functor)
+{
+    ArgThingHelper<Thing>::forEachFast(*this, functor);
+}
+
+template<typename Thing, typename Functor>
+void Arg::forEach(Role role, Type type, Width width, const Functor& functor)
+{
+    ArgThingHelper<Thing>::forEach(*this, role, type, width, functor);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirBasicBlock.cpp b/b3/air/AirBasicBlock.cpp
new file mode 100644
index 0000000..fa3ad8e
--- /dev/null
+++ b/b3/air/AirBasicBlock.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirBasicBlock.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3BasicBlockUtils.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+const char* const BasicBlock::dumpPrefix = "#";
+
+bool BasicBlock::addPredecessor(BasicBlock* block)
+{
+    return B3::addPredecessor(this, block);
+}
+
+bool BasicBlock::removePredecessor(BasicBlock* block)
+{
+    return B3::removePredecessor(this, block);
+}
+
+bool BasicBlock::replacePredecessor(BasicBlock* from, BasicBlock* to)
+{
+    return B3::replacePredecessor(this, from, to);
+}
+
+void BasicBlock::dump(PrintStream& out) const
+{
+    out.print(dumpPrefix, m_index);
+}
+
+void BasicBlock::deepDump(PrintStream& out) const
+{
+    dumpHeader(out);
+    for (const Inst& inst : *this)
+        out.print("    ", inst, "\n");
+    dumpFooter(out);
+}
+
+void BasicBlock::dumpHeader(PrintStream& out) const
+{
+    out.print("BB", *this, ": ; frequency = ", m_frequency, "\n");
+    if (predecessors().size())
+        out.print("  Predecessors: ", pointerListDump(predecessors()), "\n");
+}
+
+void BasicBlock::dumpFooter(PrintStream& out) const
+{
+    if (successors().size())
+        out.print("  Successors: ", listDump(successors()), "\n");
+}
+
+BasicBlock::BasicBlock(unsigned index, double frequency)
+    : m_index(index)
+    , m_frequency(frequency)
+{
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirBasicBlock.h b/b3/air/AirBasicBlock.h
new file mode 100644
index 0000000..431bd71
--- /dev/null
+++ b/b3/air/AirBasicBlock.h
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirFrequentedBlock.h"
+#include "AirInst.h"
+#include "B3SuccessorCollection.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class BlockInsertionSet;
+class Code;
+class InsertionSet;
+
+class BasicBlock {
+    WTF_MAKE_NONCOPYABLE(BasicBlock);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static const char* const dumpPrefix;
+
+    typedef Vector<Inst> InstList;
+    typedef Vector<BasicBlock*, 2> PredecessorList;
+    typedef Vector<FrequentedBlock, 2> SuccessorList;
+
+    unsigned index() const { return m_index; }
+
+    // This method is exposed for phases that mess with the layout of basic blocks. Currently that means just
+    // optimizeBlockOrder().
+    void setIndex(unsigned index) { m_index = index; }
+    
+    unsigned size() const { return m_insts.size(); }
+    InstList::iterator begin() { return m_insts.begin(); }
+    InstList::iterator end() { return m_insts.end(); }
+    InstList::const_iterator begin() const { return m_insts.begin(); }
+    InstList::const_iterator end() const { return m_insts.end(); }
+
+    const Inst& at(unsigned index) const { return m_insts[index]; }
+    Inst& at(unsigned index) { return m_insts[index]; }
+
+    Inst* get(unsigned index)
+    {
+        return index < size() ? &at(index) : nullptr;
+    }
+
+    const Inst& last() const { return m_insts.last(); }
+    Inst& last() { return m_insts.last(); }
+
+    void resize(unsigned size) { m_insts.resize(size); }
+
+    const InstList& insts() const { return m_insts; }
+    InstList& insts() { return m_insts; }
+
+    template<typename Inst>
+    Inst& appendInst(Inst&& inst)
+    {
+        m_insts.append(std::forward<Inst>(inst));
+        return m_insts.last();
+    }
+
+    template<typename... Arguments>
+    Inst& append(Arguments&&... arguments)
+    {
+        m_insts.append(Inst(std::forward<Arguments>(arguments)...));
+        return m_insts.last();
+    }
+
+    // The "0" case is the case to which the branch jumps, so the "then" case. The "1" case is the
+    // "else" case, and is used to represent the fall-through of a conditional branch.
+    unsigned numSuccessors() const { return m_successors.size(); }
+    FrequentedBlock successor(unsigned index) const { return m_successors[index]; }
+    FrequentedBlock& successor(unsigned index) { return m_successors[index]; }
+    const SuccessorList& successors() const { return m_successors; }
+    SuccessorList& successors() { return m_successors; }
+
+    BasicBlock* successorBlock(unsigned index) const { return successor(index).block(); }
+    BasicBlock*& successorBlock(unsigned index) { return successor(index).block(); }
+    SuccessorCollection<BasicBlock, SuccessorList> successorBlocks()
+    {
+        return SuccessorCollection<BasicBlock, SuccessorList>(m_successors);
+    }
+    SuccessorCollection<const BasicBlock, const SuccessorList> successorBlocks() const
+    {
+        return SuccessorCollection<const BasicBlock, const SuccessorList>(m_successors);
+    }
+
+    unsigned numPredecessors() const { return m_predecessors.size(); }
+    BasicBlock* predecessor(unsigned index) const { return m_predecessors[index]; }
+    BasicBlock*& predecessor(unsigned index) { return m_predecessors[index]; }
+    const PredecessorList& predecessors() const { return m_predecessors; }
+    PredecessorList& predecessors() { return m_predecessors; }
+
+    bool addPredecessor(BasicBlock*);
+    bool removePredecessor(BasicBlock*);
+    bool replacePredecessor(BasicBlock* from, BasicBlock* to);
+    bool containsPredecessor(BasicBlock* predecessor) const { return m_predecessors.contains(predecessor); }
+
+    double frequency() const { return m_frequency; }
+
+    void dump(PrintStream&) const;
+    void deepDump(PrintStream&) const;
+
+    void dumpHeader(PrintStream&) const;
+    void dumpFooter(PrintStream&) const;
+
+private:
+    friend class BlockInsertionSet;
+    friend class Code;
+    friend class InsertionSet;
+    
+    BasicBlock(unsigned index, double frequency);
+
+    unsigned m_index;
+    InstList m_insts;
+    SuccessorList m_successors;
+    PredecessorList m_predecessors;
+    double m_frequency;
+};
+
+class DeepBasicBlockDump {
+public:
+    DeepBasicBlockDump(const BasicBlock* block)
+        : m_block(block)
+    {
+    }
+
+    void dump(PrintStream& out) const
+    {
+        if (m_block)
+            m_block->deepDump(out);
+        else
+            out.print("<null>");
+    }
+
+private:
+    const BasicBlock* m_block;
+};
+
+inline DeepBasicBlockDump deepDump(const BasicBlock* block)
+{
+    return DeepBasicBlockDump(block);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirBlockWorklist.h b/b3/air/AirBlockWorklist.h
new file mode 100644
index 0000000..ba231a9
--- /dev/null
+++ b/b3/air/AirBlockWorklist.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirBasicBlock.h"
+#include "B3BlockWorklist.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+typedef GraphNodeWorklist<BasicBlock*, IndexSet<BasicBlock>> BlockWorklist;
+
+// When you say BlockWith<int> you should read it as "block with an int".
+template<typename T> using BlockWith = GraphNodeWith<BasicBlock*, T>;
+
+// Extended block worklist is useful for enqueueing some meta-data along with the block. It also
+// permits forcibly enqueueing things even if the block has already been seen. It's useful for
+// things like building a spanning tree, in which case T (the auxiliary payload) would be the
+// successor index.
+template<typename T> using ExtendedBlockWorklist = ExtendedGraphNodeWorklist<BasicBlock*, T, IndexSet<BasicBlock>>;
+
+typedef GraphNodeWithOrder<BasicBlock*> BlockWithOrder;
+
+typedef PostOrderGraphNodeWorklist<BasicBlock*, IndexSet<BasicBlock>> PostOrderBlockWorklist;
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirCCallSpecial.cpp b/b3/air/AirCCallSpecial.cpp
new file mode 100644
index 0000000..f1b6d71
--- /dev/null
+++ b/b3/air/AirCCallSpecial.cpp
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirCCallSpecial.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+CCallSpecial::CCallSpecial()
+{
+    m_clobberedRegs = RegisterSet::allRegisters();
+    m_clobberedRegs.exclude(RegisterSet::stackRegisters());
+    m_clobberedRegs.exclude(RegisterSet::reservedHardwareRegisters());
+    m_clobberedRegs.exclude(RegisterSet::calleeSaveRegisters());
+    m_clobberedRegs.clear(GPRInfo::returnValueGPR);
+    m_clobberedRegs.clear(GPRInfo::returnValueGPR2);
+    m_clobberedRegs.clear(FPRInfo::returnValueFPR);
+}
+
+CCallSpecial::~CCallSpecial()
+{
+}
+
+void CCallSpecial::forEachArg(Inst& inst, const ScopedLambda<Inst::EachArgCallback>& callback)
+{
+    for (unsigned i = 0; i < numCalleeArgs; ++i)
+        callback(inst.args[calleeArgOffset + i], Arg::Use, Arg::GP, Arg::pointerWidth());
+    for (unsigned i = 0; i < numReturnGPArgs; ++i)
+        callback(inst.args[returnGPArgOffset + i], Arg::Def, Arg::GP, Arg::pointerWidth());
+    for (unsigned i = 0; i < numReturnFPArgs; ++i)
+        callback(inst.args[returnFPArgOffset + i], Arg::Def, Arg::FP, Arg::Width64);
+    
+    for (unsigned i = argArgOffset; i < inst.args.size(); ++i) {
+        // For the type, we can just query the arg's type. The arg will have a type, because we
+        // require these args to be argument registers.
+        Arg::Type type = inst.args[i].type();
+        callback(inst.args[i], Arg::Use, type, Arg::conservativeWidth(type));
+    }
+}
+
+bool CCallSpecial::isValid(Inst& inst)
+{
+    if (inst.args.size() < argArgOffset)
+        return false;
+
+    for (unsigned i = 0; i < numCalleeArgs; ++i) {
+        Arg& arg = inst.args[i + calleeArgOffset];
+        if (!arg.isGP())
+            return false;
+        switch (arg.kind()) {
+        case Arg::Imm:
+            if (is32Bit())
+                break;
+            return false;
+        case Arg::BigImm:
+            if (is64Bit())
+                break;
+            return false;
+        case Arg::Tmp:
+        case Arg::Addr:
+        case Arg::Stack:
+        case Arg::CallArg:
+            break;
+        default:
+            return false;
+        }
+    }
+
+    // Return args need to be exact.
+    if (inst.args[returnGPArgOffset + 0] != Tmp(GPRInfo::returnValueGPR))
+        return false;
+    if (inst.args[returnGPArgOffset + 1] != Tmp(GPRInfo::returnValueGPR2))
+        return false;
+    if (inst.args[returnFPArgOffset + 0] != Tmp(FPRInfo::returnValueFPR))
+        return false;
+
+    for (unsigned i = argArgOffset; i < inst.args.size(); ++i) {
+        if (!inst.args[i].isReg())
+            return false;
+
+        if (inst.args[i] == Tmp(scratchRegister))
+            return false;
+    }
+    return true;
+}
+
+bool CCallSpecial::admitsStack(Inst&, unsigned argIndex)
+{
+    // The callee can be on the stack.
+    if (argIndex == calleeArgOffset)
+        return true;
+    
+    return false;
+}
+
+void CCallSpecial::reportUsedRegisters(Inst&, const RegisterSet&)
+{
+}
+
+CCallHelpers::Jump CCallSpecial::generate(Inst& inst, CCallHelpers& jit, GenerationContext&)
+{
+    switch (inst.args[calleeArgOffset].kind()) {
+    case Arg::Imm:
+    case Arg::BigImm:
+        jit.move(inst.args[calleeArgOffset].asTrustedImmPtr(), scratchRegister);
+        jit.call(scratchRegister);
+        break;
+    case Arg::Tmp:
+        jit.call(inst.args[calleeArgOffset].gpr());
+        break;
+    case Arg::Addr:
+        jit.call(inst.args[calleeArgOffset].asAddress());
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    return CCallHelpers::Jump();
+}
+
+RegisterSet CCallSpecial::extraEarlyClobberedRegs(Inst&)
+{
+    return m_emptyRegs;
+}
+
+RegisterSet CCallSpecial::extraClobberedRegs(Inst&)
+{
+    return m_clobberedRegs;
+}
+
+void CCallSpecial::dumpImpl(PrintStream& out) const
+{
+    out.print("CCall");
+}
+
+void CCallSpecial::deepDumpImpl(PrintStream& out) const
+{
+    out.print("function call that uses the C calling convention.");
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirCCallSpecial.h b/b3/air/AirCCallSpecial.h
new file mode 100644
index 0000000..ec909b9
--- /dev/null
+++ b/b3/air/AirCCallSpecial.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirSpecial.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+// Use this special for constructing a C call. Arg 0 is of course a Special arg that refers to the
+// CCallSpecial object. Arg 1 is the callee, and it can be an ImmPtr, a register, or an address. The
+// next three args - arg 2, arg 3, and arg 4 - hold the return value GPRs and FPR. The remaining args
+// are just the set of argument registers used by this call. For arguments that go to the stack, you
+// have to do the grunt work of doing those stack stores. In fact, the only reason why we specify the
+// argument registers as arguments to a call is so that the liveness analysis can see that they get
+// used here. It would be wrong to automagically report all argument registers as being used because
+// if we had a call that didn't pass them, then they'd appear to be live until some clobber point or
+// the prologue, whichever happened sooner.
+
+class CCallSpecial : public Special {
+public:
+    CCallSpecial();
+    ~CCallSpecial();
+
+    // You cannot use this register to pass arguments. It just so happens that this register is not
+    // used for arguments in the C calling convention. By the way, this is the only thing that causes
+    // this special to be specific to C calls.
+    static const GPRReg scratchRegister = GPRInfo::nonArgGPR0;
+
+protected:
+    void forEachArg(Inst&, const ScopedLambda<Inst::EachArgCallback>&) override;
+    bool isValid(Inst&) override;
+    bool admitsStack(Inst&, unsigned argIndex) override;
+    void reportUsedRegisters(Inst&, const RegisterSet&) override;
+    CCallHelpers::Jump generate(Inst&, CCallHelpers&, GenerationContext&) override;
+    RegisterSet extraEarlyClobberedRegs(Inst&) override;
+    RegisterSet extraClobberedRegs(Inst&) override;
+
+    void dumpImpl(PrintStream&) const override;
+    void deepDumpImpl(PrintStream&) const override;
+
+private:
+    static const unsigned specialArgOffset = 0;
+    static const unsigned numSpecialArgs = 1;
+    static const unsigned calleeArgOffset = numSpecialArgs;
+    static const unsigned numCalleeArgs = 1;
+    static const unsigned returnGPArgOffset = numSpecialArgs + numCalleeArgs;
+    static const unsigned numReturnGPArgs = 2;
+    static const unsigned returnFPArgOffset = numSpecialArgs + numCalleeArgs + numReturnGPArgs;
+    static const unsigned numReturnFPArgs = 1;
+    static const unsigned argArgOffset =
+        numSpecialArgs + numCalleeArgs + numReturnGPArgs + numReturnFPArgs;
+    
+    RegisterSet m_clobberedRegs;
+    RegisterSet m_emptyRegs;
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirCCallingConvention.cpp b/b3/air/AirCCallingConvention.cpp
new file mode 100644
index 0000000..2b6f733
--- /dev/null
+++ b/b3/air/AirCCallingConvention.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirCCallingConvention.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCCallSpecial.h"
+#include "AirCode.h"
+#include "B3CCallValue.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+template<typename BankInfo>
+Arg marshallCCallArgumentImpl(unsigned& argumentCount, unsigned& stackOffset, Value* child)
+{
+    unsigned argumentIndex = argumentCount++;
+    if (argumentIndex < BankInfo::numberOfArgumentRegisters)
+        return Tmp(BankInfo::toArgumentRegister(argumentIndex));
+
+    unsigned slotSize;
+    if (isARM64() && isIOS()) {
+        // Arguments are packed.
+        slotSize = sizeofType(child->type());
+    } else {
+        // Arguments are aligned.
+        slotSize = 8;
+    }
+
+    stackOffset = WTF::roundUpToMultipleOf(slotSize, stackOffset);
+    Arg result = Arg::callArg(stackOffset);
+    stackOffset += slotSize;
+    return result;
+}
+
+Arg marshallCCallArgument(
+    unsigned& gpArgumentCount, unsigned& fpArgumentCount, unsigned& stackOffset, Value* child)
+{
+    switch (Arg::typeForB3Type(child->type())) {
+    case Arg::GP:
+        return marshallCCallArgumentImpl<GPRInfo>(gpArgumentCount, stackOffset, child);
+    case Arg::FP:
+        return marshallCCallArgumentImpl<FPRInfo>(fpArgumentCount, stackOffset, child);
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return Arg();
+}
+
+} // anonymous namespace
+
+Vector<Arg> computeCCallingConvention(Code& code, CCallValue* value)
+{
+    Vector<Arg> result;
+    result.append(Tmp(CCallSpecial::scratchRegister));
+    unsigned gpArgumentCount = 0;
+    unsigned fpArgumentCount = 0;
+    unsigned stackOffset = 0;
+    for (unsigned i = 1; i < value->numChildren(); ++i) {
+        result.append(
+            marshallCCallArgument(gpArgumentCount, fpArgumentCount, stackOffset, value->child(i)));
+    }
+    code.requestCallArgAreaSizeInBytes(WTF::roundUpToMultipleOf(stackAlignmentBytes(), stackOffset));
+    return result;
+}
+
+Tmp cCallResult(Type type)
+{
+    switch (type) {
+    case Void:
+        return Tmp();
+    case Int32:
+    case Int64:
+        return Tmp(GPRInfo::returnValueGPR);
+    case Float:
+    case Double:
+        return Tmp(FPRInfo::returnValueFPR);
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return Tmp();
+}
+
+Inst buildCCall(Code& code, Value* origin, const Vector<Arg>& arguments)
+{
+    Inst inst(Patch, origin, Arg::special(code.cCallSpecial()));
+    inst.args.append(arguments[0]);
+    inst.args.append(Tmp(GPRInfo::returnValueGPR));
+    inst.args.append(Tmp(GPRInfo::returnValueGPR2));
+    inst.args.append(Tmp(FPRInfo::returnValueFPR));
+    for (unsigned i = 1; i < arguments.size(); ++i) {
+        Arg arg = arguments[i];
+        if (arg.isTmp())
+            inst.args.append(arg);
+    }
+    return inst;
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirCCallingConvention.h b/b3/air/AirCCallingConvention.h
new file mode 100644
index 0000000..76acc29
--- /dev/null
+++ b/b3/air/AirCCallingConvention.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "AirInst.h"
+#include "B3Type.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class CCallValue;
+
+namespace Air {
+
+class Code;
+
+Vector<Arg> computeCCallingConvention(Code&, CCallValue*);
+
+Tmp cCallResult(Type);
+
+Inst buildCCall(Code&, Value* origin, const Vector<Arg>&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirCode.cpp b/b3/air/AirCode.cpp
new file mode 100644
index 0000000..79e2c0c
--- /dev/null
+++ b/b3/air/AirCode.cpp
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirCode.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCCallSpecial.h"
+#include "B3BasicBlockUtils.h"
+#include "B3Procedure.h"
+#include "B3StackSlot.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+Code::Code(Procedure& proc)
+    : m_proc(proc)
+    , m_lastPhaseName("initial")
+{
+    // Come up with initial orderings of registers. The user may replace this with something else.
+    Arg::forEachType(
+        [&] (Arg::Type type) {
+            Vector<Reg> result;
+            RegisterSet all = type == Arg::GP ? RegisterSet::allGPRs() : RegisterSet::allFPRs();
+            all.exclude(RegisterSet::stackRegisters());
+            all.exclude(RegisterSet::reservedHardwareRegisters());
+            RegisterSet calleeSave = RegisterSet::calleeSaveRegisters();
+            all.forEach(
+                [&] (Reg reg) {
+                    if (!calleeSave.get(reg))
+                        result.append(reg);
+                });
+            all.forEach(
+                [&] (Reg reg) {
+                    if (calleeSave.get(reg))
+                        result.append(reg);
+                });
+            setRegsInPriorityOrder(type, result);
+        });
+}
+
+Code::~Code()
+{
+}
+
+void Code::setRegsInPriorityOrder(Arg::Type type, const Vector<Reg>& regs)
+{
+    regsInPriorityOrderImpl(type) = regs;
+    m_mutableRegs = RegisterSet();
+    Arg::forEachType(
+        [&] (Arg::Type type) {
+            for (Reg reg : regsInPriorityOrder(type))
+                m_mutableRegs.set(reg);
+        });
+}
+
+void Code::pinRegister(Reg reg)
+{
+    Vector<Reg>& regs = regsInPriorityOrderImpl(Arg(Tmp(reg)).type());
+    regs.removeFirst(reg);
+    m_mutableRegs.clear(reg);
+    ASSERT(!regs.contains(reg));
+}
+
+BasicBlock* Code::addBlock(double frequency)
+{
+    std::unique_ptr<BasicBlock> block(new BasicBlock(m_blocks.size(), frequency));
+    BasicBlock* result = block.get();
+    m_blocks.append(WTFMove(block));
+    return result;
+}
+
+StackSlot* Code::addStackSlot(unsigned byteSize, StackSlotKind kind, B3::StackSlot* b3Slot)
+{
+    return m_stackSlots.addNew(byteSize, kind, b3Slot);
+}
+
+StackSlot* Code::addStackSlot(B3::StackSlot* b3Slot)
+{
+    return addStackSlot(b3Slot->byteSize(), StackSlotKind::Locked, b3Slot);
+}
+
+Special* Code::addSpecial(std::unique_ptr<Special> special)
+{
+    special->m_code = this;
+    return m_specials.add(WTFMove(special));
+}
+
+CCallSpecial* Code::cCallSpecial()
+{
+    if (!m_cCallSpecial) {
+        m_cCallSpecial = static_cast<CCallSpecial*>(
+            addSpecial(std::make_unique<CCallSpecial>()));
+    }
+
+    return m_cCallSpecial;
+}
+
+bool Code::isEntrypoint(BasicBlock* block) const
+{
+    if (m_entrypoints.isEmpty())
+        return !block->index();
+    
+    for (const FrequentedBlock& entrypoint : m_entrypoints) {
+        if (entrypoint.block() == block)
+            return true;
+    }
+    return false;
+}
+
+void Code::resetReachability()
+{
+    clearPredecessors(m_blocks);
+    if (m_entrypoints.isEmpty())
+        updatePredecessorsAfter(m_blocks[0].get());
+    else {
+        for (const FrequentedBlock& entrypoint : m_entrypoints)
+            updatePredecessorsAfter(entrypoint.block());
+    }
+    
+    for (auto& block : m_blocks) {
+        if (isBlockDead(block.get()) && !isEntrypoint(block.get()))
+            block = nullptr;
+    }
+}
+
+void Code::dump(PrintStream& out) const
+{
+    if (!m_entrypoints.isEmpty())
+        out.print("Entrypoints: ", listDump(m_entrypoints), "\n");
+    for (BasicBlock* block : *this)
+        out.print(deepDump(block));
+    if (stackSlots().size()) {
+        out.print("Stack slots:\n");
+        for (StackSlot* slot : stackSlots())
+            out.print("    ", pointerDump(slot), ": ", deepDump(slot), "\n");
+    }
+    if (specials().size()) {
+        out.print("Specials:\n");
+        for (Special* special : specials())
+            out.print("    ", deepDump(special), "\n");
+    }
+    if (m_frameSize)
+        out.print("Frame size: ", m_frameSize, "\n");
+    if (m_callArgAreaSize)
+        out.print("Call arg area size: ", m_callArgAreaSize, "\n");
+    if (m_calleeSaveRegisters.size())
+        out.print("Callee saves: ", m_calleeSaveRegisters, "\n");
+}
+
+unsigned Code::findFirstBlockIndex(unsigned index) const
+{
+    while (index < size() && !at(index))
+        index++;
+    return index;
+}
+
+unsigned Code::findNextBlockIndex(unsigned index) const
+{
+    return findFirstBlockIndex(index + 1);
+}
+
+BasicBlock* Code::findNextBlock(BasicBlock* block) const
+{
+    unsigned index = findNextBlockIndex(block->index());
+    if (index < size())
+        return at(index);
+    return nullptr;
+}
+
+void Code::addFastTmp(Tmp tmp)
+{
+    m_fastTmps.add(tmp);
+}
+
+void* Code::addDataSection(size_t size)
+{
+    return m_proc.addDataSection(size);
+}
+
+unsigned Code::jsHash() const
+{
+    unsigned result = 0;
+    
+    for (BasicBlock* block : *this) {
+        result *= 1000001;
+        for (Inst& inst : *block) {
+            result *= 97;
+            result += inst.jsHash();
+        }
+        for (BasicBlock* successor : block->successorBlocks()) {
+            result *= 7;
+            result += successor->index();
+        }
+    }
+    for (StackSlot* slot : stackSlots()) {
+        result *= 101;
+        result += slot->jsHash();
+    }
+    
+    return result;
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirCode.h b/b3/air/AirCode.h
new file mode 100644
index 0000000..6d4a147
--- /dev/null
+++ b/b3/air/AirCode.h
@@ -0,0 +1,321 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "AirBasicBlock.h"
+#include "AirSpecial.h"
+#include "AirStackSlot.h"
+#include "AirTmp.h"
+#include "B3SparseCollection.h"
+#include "CCallHelpers.h"
+#include "RegisterAtOffsetList.h"
+#include "StackAlignment.h"
+#include <wtf/IndexMap.h>
+
+namespace JSC { namespace B3 {
+
+class Procedure;
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wreturn-type"
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+namespace Air {
+
+class BlockInsertionSet;
+class CCallSpecial;
+
+typedef void WasmBoundsCheckGeneratorFunction(CCallHelpers&, GPRReg, unsigned);
+typedef SharedTask<WasmBoundsCheckGeneratorFunction> WasmBoundsCheckGenerator;
+
+// This is an IR that is very close to the bare metal. It requires about 40x more bytes than the
+// generated machine code - for example if you're generating 1MB of machine code, you need about
+// 40MB of Air.
+
+class Code {
+    WTF_MAKE_NONCOPYABLE(Code);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ~Code();
+
+    Procedure& proc() { return m_proc; }
+    
+    const Vector<Reg>& regsInPriorityOrder(Arg::Type type) const
+    {
+        switch (type) {
+        case Arg::GP:
+            return m_gpRegsInPriorityOrder;
+        case Arg::FP:
+            return m_fpRegsInPriorityOrder;
+        }
+        ASSERT_NOT_REACHED();
+    }
+    
+    void setRegsInPriorityOrder(Arg::Type, const Vector<Reg>&);
+    
+    // This is the set of registers that Air is allowed to emit code to mutate. It's derived from
+    // regsInPriorityOrder. Any registers not in this set are said to be "pinned".
+    const RegisterSet& mutableRegs() const { return m_mutableRegs; }
+    
+    bool isPinned(Reg reg) const { return !mutableRegs().get(reg); }
+    
+    void pinRegister(Reg);
+
+    JS_EXPORT_PRIVATE BasicBlock* addBlock(double frequency = 1);
+
+    // Note that you can rely on stack slots always getting indices that are larger than the index
+    // of any prior stack slot. In fact, all stack slots you create in the future will have an index
+    // that is >= stackSlots().size().
+    JS_EXPORT_PRIVATE StackSlot* addStackSlot(
+        unsigned byteSize, StackSlotKind, B3::StackSlot* = nullptr);
+    StackSlot* addStackSlot(B3::StackSlot*);
+
+    Special* addSpecial(std::unique_ptr<Special>);
+
+    // This is the special you need to make a C call!
+    CCallSpecial* cCallSpecial();
+
+    Tmp newTmp(Arg::Type type)
+    {
+        switch (type) {
+        case Arg::GP:
+            return Tmp::gpTmpForIndex(m_numGPTmps++);
+        case Arg::FP:
+            return Tmp::fpTmpForIndex(m_numFPTmps++);
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    unsigned numTmps(Arg::Type type)
+    {
+        switch (type) {
+        case Arg::GP:
+            return m_numGPTmps;
+        case Arg::FP:
+            return m_numFPTmps;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    unsigned callArgAreaSizeInBytes() const { return m_callArgAreaSize; }
+
+    // You can call this before code generation to force a minimum call arg area size.
+    void requestCallArgAreaSizeInBytes(unsigned size)
+    {
+        m_callArgAreaSize = std::max(
+            m_callArgAreaSize,
+            static_cast<unsigned>(WTF::roundUpToMultipleOf(stackAlignmentBytes(), size)));
+    }
+
+    unsigned frameSize() const { return m_frameSize; }
+
+    // Only phases that do stack allocation are allowed to set this. Currently, only
+    // Air::allocateStack() does this.
+    void setFrameSize(unsigned frameSize)
+    {
+        m_frameSize = frameSize;
+    }
+
+    // Note that this is not the same thing as proc().numEntrypoints(). This value here may be zero
+    // until we lower EntrySwitch.
+    unsigned numEntrypoints() const { return m_entrypoints.size(); }
+    const Vector<FrequentedBlock>& entrypoints() const { return m_entrypoints; }
+    const FrequentedBlock& entrypoint(unsigned index) const { return m_entrypoints[index]; }
+    bool isEntrypoint(BasicBlock*) const;
+    
+    // This is used by lowerEntrySwitch().
+    template<typename Vector>
+    void setEntrypoints(Vector&& vector)
+    {
+        m_entrypoints = std::forward<Vector>(vector);
+    }
+    
+    CCallHelpers::Label entrypointLabel(unsigned index) const
+    {
+        return m_entrypointLabels[index];
+    }
+    
+    // This is used by generate().
+    template<typename Vector>
+    void setEntrypointLabels(Vector&& vector)
+    {
+        m_entrypointLabels = std::forward<Vector>(vector);
+    }
+
+    const RegisterAtOffsetList& calleeSaveRegisters() const { return m_calleeSaveRegisters; }
+    RegisterAtOffsetList& calleeSaveRegisters() { return m_calleeSaveRegisters; }
+
+    // Recomputes predecessors and deletes unreachable blocks.
+    void resetReachability();
+
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+
+    unsigned size() const { return m_blocks.size(); }
+    BasicBlock* at(unsigned index) const { return m_blocks[index].get(); }
+    BasicBlock* operator[](unsigned index) const { return at(index); }
+
+    // This is used by phases that optimize the block list. You shouldn't use this unless you really know
+    // what you're doing.
+    Vector<std::unique_ptr<BasicBlock>>& blockList() { return m_blocks; }
+
+    // Finds the smallest index' such that at(index') != null and index' >= index.
+    JS_EXPORT_PRIVATE unsigned findFirstBlockIndex(unsigned index) const;
+
+    // Finds the smallest index' such that at(index') != null and index' > index.
+    unsigned findNextBlockIndex(unsigned index) const;
+
+    BasicBlock* findNextBlock(BasicBlock*) const;
+
+    class iterator {
+    public:
+        iterator()
+            : m_code(nullptr)
+            , m_index(0)
+        {
+        }
+
+        iterator(const Code& code, unsigned index)
+            : m_code(&code)
+            , m_index(m_code->findFirstBlockIndex(index))
+        {
+        }
+
+        BasicBlock* operator*()
+        {
+            return m_code->at(m_index);
+        }
+
+        iterator& operator++()
+        {
+            m_index = m_code->findFirstBlockIndex(m_index + 1);
+            return *this;
+        }
+
+        bool operator==(const iterator& other) const
+        {
+            return m_index == other.m_index;
+        }
+
+        bool operator!=(const iterator& other) const
+        {
+            return !(*this == other);
+        }
+
+    private:
+        const Code* m_code;
+        unsigned m_index;
+    };
+
+    iterator begin() const { return iterator(*this, 0); }
+    iterator end() const { return iterator(*this, size()); }
+
+    const SparseCollection<StackSlot>& stackSlots() const { return m_stackSlots; }
+    SparseCollection<StackSlot>& stackSlots() { return m_stackSlots; }
+
+    const SparseCollection<Special>& specials() const { return m_specials; }
+    SparseCollection<Special>& specials() { return m_specials; }
+
+    template<typename Callback>
+    void forAllTmps(const Callback& callback) const
+    {
+        for (unsigned i = m_numGPTmps; i--;)
+            callback(Tmp::gpTmpForIndex(i));
+        for (unsigned i = m_numFPTmps; i--;)
+            callback(Tmp::fpTmpForIndex(i));
+    }
+
+    void addFastTmp(Tmp);
+    bool isFastTmp(Tmp tmp) const { return m_fastTmps.contains(tmp); }
+    
+    void* addDataSection(size_t);
+    
+    // The name has to be a string literal, since we don't do any memory management for the string.
+    void setLastPhaseName(const char* name)
+    {
+        m_lastPhaseName = name;
+    }
+
+    const char* lastPhaseName() const { return m_lastPhaseName; }
+
+    void setWasmBoundsCheckGenerator(RefPtr<WasmBoundsCheckGenerator> generator)
+    {
+        m_wasmBoundsCheckGenerator = generator;
+    }
+
+    RefPtr<WasmBoundsCheckGenerator> wasmBoundsCheckGenerator() const { return m_wasmBoundsCheckGenerator; }
+
+    // This is a hash of the code. You can use this if you want to put code into a hashtable, but
+    // it's mainly for validating the results from JSAir.
+    unsigned jsHash() const;
+
+private:
+    friend class ::JSC::B3::Procedure;
+    friend class BlockInsertionSet;
+    
+    Code(Procedure&);
+
+    Vector<Reg>& regsInPriorityOrderImpl(Arg::Type type)
+    {
+        switch (type) {
+        case Arg::GP:
+            return m_gpRegsInPriorityOrder;
+        case Arg::FP:
+            return m_fpRegsInPriorityOrder;
+        }
+        ASSERT_NOT_REACHED();
+    }
+
+    Procedure& m_proc; // Some meta-data, like byproducts, is stored in the Procedure.
+    Vector<Reg> m_gpRegsInPriorityOrder;
+    Vector<Reg> m_fpRegsInPriorityOrder;
+    RegisterSet m_mutableRegs;
+    SparseCollection<StackSlot> m_stackSlots;
+    Vector<std::unique_ptr<BasicBlock>> m_blocks;
+    SparseCollection<Special> m_specials;
+    HashSet<Tmp> m_fastTmps;
+    CCallSpecial* m_cCallSpecial { nullptr };
+    unsigned m_numGPTmps { 0 };
+    unsigned m_numFPTmps { 0 };
+    unsigned m_frameSize { 0 };
+    unsigned m_callArgAreaSize { 0 };
+    RegisterAtOffsetList m_calleeSaveRegisters;
+    Vector<FrequentedBlock> m_entrypoints; // This is empty until after lowerEntrySwitch().
+    Vector<CCallHelpers::Label> m_entrypointLabels; // This is empty until code generation.
+    RefPtr<WasmBoundsCheckGenerator> m_wasmBoundsCheckGenerator;
+    const char* m_lastPhaseName;
+};
+
+} } } // namespace JSC::B3::Air
+
+#if COMPILER(GCC) && ASSERT_DISABLED
+#pragma GCC diagnostic pop
+#endif // COMPILER(GCC) && ASSERT_DISABLED
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirCustom.cpp b/b3/air/AirCustom.cpp
new file mode 100644
index 0000000..2a2df2f
--- /dev/null
+++ b/b3/air/AirCustom.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirCustom.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirInstInlines.h"
+#include "B3CCallValue.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+bool PatchCustom::isValidForm(Inst& inst)
+{
+    if (inst.args.size() < 1)
+        return false;
+    if (!inst.args[0].isSpecial())
+        return false;
+    if (!inst.args[0].special()->isValid(inst))
+        return false;
+    RegisterSet clobberedEarly = inst.extraEarlyClobberedRegs();
+    RegisterSet clobberedLate = inst.extraClobberedRegs();
+    bool ok = true;
+    inst.forEachTmp(
+        [&] (Tmp& tmp, Arg::Role role, Arg::Type, Arg::Width) {
+            if (!tmp.isReg())
+                return;
+            if (Arg::isLateDef(role) || Arg::isLateUse(role))
+                ok &= !clobberedLate.get(tmp.reg());
+            else
+                ok &= !clobberedEarly.get(tmp.reg());
+        });
+    return ok;
+}
+
+bool CCallCustom::isValidForm(Inst& inst)
+{
+    CCallValue* value = inst.origin->as<CCallValue>();
+    if (!value)
+        return false;
+
+    if (inst.args.size() != (value->type() == Void ? 0 : 1) + value->numChildren())
+        return false;
+
+    // The arguments can only refer to the stack, tmps, or immediates.
+    for (Arg& arg : inst.args) {
+        if (!arg.isTmp() && !arg.isStackMemory() && !arg.isSomeImm())
+            return false;
+    }
+
+    unsigned offset = 0;
+
+    if (!inst.args[0].isGP())
+        return false;
+
+    // If there is a result then it cannot be an immediate.
+    if (value->type() != Void) {
+        if (inst.args[1].isSomeImm())
+            return false;
+        if (!inst.args[1].canRepresent(value))
+            return false;
+        offset++;
+    }
+
+    for (unsigned i = value->numChildren(); i-- > 1;) {
+        Value* child = value->child(i);
+        Arg arg = inst.args[offset + i];
+        if (!arg.canRepresent(child))
+            return false;
+    }
+
+    return true;
+}
+
+CCallHelpers::Jump CCallCustom::generate(Inst& inst, CCallHelpers&, GenerationContext&)
+{
+    dataLog("FATAL: Unlowered C call: ", inst, "\n");
+    UNREACHABLE_FOR_PLATFORM();
+    return CCallHelpers::Jump();
+}
+
+bool ShuffleCustom::isValidForm(Inst& inst)
+{
+    if (inst.args.size() % 3)
+        return false;
+
+    // A destination may only appear once. This requirement allows us to avoid the undefined behavior
+    // of having a destination that is supposed to get multiple inputs simultaneously. It also
+    // imposes some interesting constraints on the "shape" of the shuffle. If we treat a shuffle pair
+    // as an edge and the Args as nodes, then the single-destination requirement means that the
+    // shuffle graph consists of two kinds of subgraphs:
+    //
+    // - Spanning trees. We call these shifts. They can be executed as a sequence of Move
+    //   instructions and don't usually require scratch registers.
+    //
+    // - Closed loops. These loops consist of nodes that have one successor and one predecessor, so
+    //   there is no way to "get into" the loop from outside of it. These can be executed using swaps
+    //   or by saving one of the Args to a scratch register and executing it as a shift.
+    HashSet<Arg> dsts;
+
+    for (unsigned i = 0; i < inst.args.size(); ++i) {
+        Arg arg = inst.args[i];
+        unsigned mode = i % 3;
+
+        if (mode == 2) {
+            // It's the width.
+            if (!arg.isWidthArg())
+                return false;
+            continue;
+        }
+
+        // The source can be an immediate.
+        if (!mode) {
+            if (arg.isSomeImm())
+                continue;
+
+            if (!arg.isCompatibleType(inst.args[i + 1]))
+                return false;
+        } else {
+            ASSERT(mode == 1);
+            if (!dsts.add(arg).isNewEntry)
+                return false;
+        }
+
+        if (arg.isTmp() || arg.isMemory())
+            continue;
+
+        return false;
+    }
+
+    // No destination register may appear in any address expressions. The lowering can't handle it
+    // and it's not useful for the way we end up using Shuffles. Normally, Shuffles only used for
+    // stack addresses and non-stack registers.
+    for (Arg& arg : inst.args) {
+        if (!arg.isMemory())
+            continue;
+        bool ok = true;
+        arg.forEachTmpFast(
+            [&] (Tmp tmp) {
+                if (dsts.contains(tmp))
+                    ok = false;
+            });
+        if (!ok)
+            return false;
+    }
+
+    return true;
+}
+
+CCallHelpers::Jump ShuffleCustom::generate(Inst& inst, CCallHelpers&, GenerationContext&)
+{
+    dataLog("FATAL: Unlowered shuffle: ", inst, "\n");
+    UNREACHABLE_FOR_PLATFORM();
+    return CCallHelpers::Jump();
+}
+
+bool WasmBoundsCheckCustom::isValidForm(Inst& inst)
+{
+    if (inst.args.size() != 2)
+        return false;
+    if (!inst.args[0].isTmp() && !inst.args[0].isSomeImm())
+        return false;
+
+    return inst.args[1].isReg();
+}
+
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirCustom.h b/b3/air/AirCustom.h
new file mode 100644
index 0000000..644b7a1
--- /dev/null
+++ b/b3/air/AirCustom.h
@@ -0,0 +1,328 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirGenerationContext.h"
+#include "AirInst.h"
+#include "AirSpecial.h"
+#include "B3ValueInlines.h"
+#include "B3WasmBoundsCheckValue.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+// This defines the behavior of custom instructions - i.e. those whose behavior cannot be
+// described using AirOpcode.opcodes. If you define an opcode as "custom Foo" in that file, then
+// you will need to create a "struct FooCustom" here that implements the custom behavior
+// methods.
+//
+// The customizability granted by the custom instruction mechanism is strictly less than what
+// you get using the Patch instruction and implementing a Special. However, that path requires
+// allocating a Special object and ensuring that it's the first operand. For many instructions,
+// that is not as convenient as using Custom, which makes the instruction look like any other
+// instruction. Note that both of those extra powers of the Patch instruction happen because we
+// special-case that instruction in many phases and analyses. Non-special-cased behaviors of
+// Patch are implemented using the custom instruction mechanism.
+//
+// Specials are still more flexible if you need to list extra clobbered registers and you'd like
+// that to be expressed as a bitvector rather than an arglist. They are also more flexible if
+// you need to carry extra state around with the instruction. Also, Specials mean that you
+// always have access to Code& even in methods that don't take a GenerationContext.
+
+// Definition of Patch instruction. Patch is used to delegate the behavior of the instruction to the
+// Special object, which will be the first argument to the instruction.
+struct PatchCustom {
+    template<typename Functor>
+    static void forEachArg(Inst& inst, const Functor& functor)
+    {
+        // This is basically bogus, but it works for analyses that model Special as an
+        // immediate.
+        functor(inst.args[0], Arg::Use, Arg::GP, Arg::pointerWidth());
+        
+        inst.args[0].special()->forEachArg(inst, scopedLambda<Inst::EachArgCallback>(functor));
+    }
+
+    template<typename... Arguments>
+    static bool isValidFormStatic(Arguments...)
+    {
+        return false;
+    }
+
+    static bool isValidForm(Inst& inst);
+
+    static bool admitsStack(Inst& inst, unsigned argIndex)
+    {
+        if (!argIndex)
+            return false;
+        return inst.args[0].special()->admitsStack(inst, argIndex);
+    }
+
+    static std::optional<unsigned> shouldTryAliasingDef(Inst& inst)
+    {
+        return inst.args[0].special()->shouldTryAliasingDef(inst);
+    }
+    
+    static bool isTerminal(Inst& inst)
+    {
+        return inst.args[0].special()->isTerminal(inst);
+    }
+
+    static bool hasNonArgEffects(Inst& inst)
+    {
+        return inst.args[0].special()->hasNonArgEffects(inst);
+    }
+
+    static bool hasNonArgNonControlEffects(Inst& inst)
+    {
+        return inst.args[0].special()->hasNonArgNonControlEffects(inst);
+    }
+
+    static CCallHelpers::Jump generate(
+        Inst& inst, CCallHelpers& jit, GenerationContext& context)
+    {
+        return inst.args[0].special()->generate(inst, jit, context);
+    }
+};
+
+template<typename Subtype>
+struct CommonCustomBase {
+    static bool hasNonArgEffects(Inst& inst)
+    {
+        return Subtype::isTerminal(inst) || Subtype::hasNonArgNonControlEffects(inst);
+    }
+};
+
+// Definition of CCall instruction. CCall is used for hot path C function calls. It's lowered to a
+// Patch with an Air CCallSpecial along with code to marshal instructions. The lowering happens
+// before register allocation, so that the register allocator sees the clobbers.
+struct CCallCustom : public CommonCustomBase<CCallCustom> {
+    template<typename Functor>
+    static void forEachArg(Inst& inst, const Functor& functor)
+    {
+        Value* value = inst.origin;
+
+        unsigned index = 0;
+
+        functor(inst.args[index++], Arg::Use, Arg::GP, Arg::pointerWidth()); // callee
+        
+        if (value->type() != Void) {
+            functor(
+                inst.args[index++], Arg::Def,
+                Arg::typeForB3Type(value->type()),
+                Arg::widthForB3Type(value->type()));
+        }
+
+        for (unsigned i = 1; i < value->numChildren(); ++i) {
+            Value* child = value->child(i);
+            functor(
+                inst.args[index++], Arg::Use,
+                Arg::typeForB3Type(child->type()),
+                Arg::widthForB3Type(child->type()));
+        }
+    }
+
+    template<typename... Arguments>
+    static bool isValidFormStatic(Arguments...)
+    {
+        return false;
+    }
+
+    static bool isValidForm(Inst&);
+
+    static bool admitsStack(Inst&, unsigned)
+    {
+        return true;
+    }
+    
+    static bool isTerminal(Inst&)
+    {
+        return false;
+    }
+
+    static bool hasNonArgNonControlEffects(Inst&)
+    {
+        return true;
+    }
+
+    // This just crashes, since we expect C calls to be lowered before generation.
+    static CCallHelpers::Jump generate(Inst&, CCallHelpers&, GenerationContext&);
+};
+
+struct ColdCCallCustom : CCallCustom {
+    template<typename Functor>
+    static void forEachArg(Inst& inst, const Functor& functor)
+    {
+        // This is just like a call, but uses become cold.
+        CCallCustom::forEachArg(
+            inst,
+            [&] (Arg& arg, Arg::Role role, Arg::Type type, Arg::Width width) {
+                functor(arg, Arg::cooled(role), type, width);
+            });
+    }
+};
+
+struct ShuffleCustom : public CommonCustomBase<ShuffleCustom> {
+    template<typename Functor>
+    static void forEachArg(Inst& inst, const Functor& functor)
+    {
+        unsigned limit = inst.args.size() / 3 * 3;
+        for (unsigned i = 0; i < limit; i += 3) {
+            Arg& src = inst.args[i + 0];
+            Arg& dst = inst.args[i + 1];
+            Arg& widthArg = inst.args[i + 2];
+            Arg::Width width = widthArg.width();
+            Arg::Type type = src.isGP() && dst.isGP() ? Arg::GP : Arg::FP;
+            functor(src, Arg::Use, type, width);
+            functor(dst, Arg::Def, type, width);
+            functor(widthArg, Arg::Use, Arg::GP, Arg::Width8);
+        }
+    }
+
+    template<typename... Arguments>
+    static bool isValidFormStatic(Arguments...)
+    {
+        return false;
+    }
+
+    static bool isValidForm(Inst&);
+    
+    static bool admitsStack(Inst&, unsigned index)
+    {
+        switch (index % 3) {
+        case 0:
+        case 1:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    static bool isTerminal(Inst&)
+    {
+        return false;
+    }
+
+    static bool hasNonArgNonControlEffects(Inst&)
+    {
+        return false;
+    }
+
+    static CCallHelpers::Jump generate(Inst&, CCallHelpers&, GenerationContext&);
+};
+
+struct EntrySwitchCustom : public CommonCustomBase<EntrySwitchCustom> {
+    template<typename Func>
+    static void forEachArg(Inst&, const Func&)
+    {
+    }
+    
+    template<typename... Arguments>
+    static bool isValidFormStatic(Arguments...)
+    {
+        return !sizeof...(Arguments);
+    }
+    
+    static bool isValidForm(Inst& inst)
+    {
+        return inst.args.isEmpty();
+    }
+    
+    static bool admitsStack(Inst&, unsigned)
+    {
+        return false;
+    }
+    
+    static bool isTerminal(Inst&)
+    {
+        return true;
+    }
+    
+    static bool hasNonArgNonControlEffects(Inst&)
+    {
+        return false;
+    }
+
+    static CCallHelpers::Jump generate(Inst&, CCallHelpers&, GenerationContext&)
+    {
+        // This should never be reached because we should have lowered EntrySwitch before
+        // generation.
+        UNREACHABLE_FOR_PLATFORM();
+        return CCallHelpers::Jump();
+    }
+};
+
+struct WasmBoundsCheckCustom : public CommonCustomBase<WasmBoundsCheckCustom> {
+    template<typename Func>
+    static void forEachArg(Inst& inst, const Func& functor)
+    {
+        functor(inst.args[0], Arg::Use, Arg::GP, Arg::Width64);
+        functor(inst.args[1], Arg::Use, Arg::GP, Arg::Width64);
+    }
+
+    template<typename... Arguments>
+    static bool isValidFormStatic(Arguments...)
+    {
+        return false;
+    }
+
+    static bool isValidForm(Inst&);
+
+    static bool admitsStack(Inst&, unsigned)
+    {
+        return false;
+    }
+
+    static bool isTerminal(Inst&)
+    {
+        return false;
+    }
+    
+    static bool hasNonArgNonControlEffects(Inst&)
+    {
+        return true;
+    }
+
+    static CCallHelpers::Jump generate(Inst& inst, CCallHelpers& jit, GenerationContext& context)
+    {
+        WasmBoundsCheckValue* value = inst.origin->as<WasmBoundsCheckValue>();
+        CCallHelpers::Jump outOfBounds = Inst(Air::Branch64, value, Arg::relCond(CCallHelpers::AboveOrEqual), inst.args[0], inst.args[1]).generate(jit, context);
+
+        context.latePaths.append(createSharedTask<GenerationContext::LatePathFunction>(
+            [=] (CCallHelpers& jit, Air::GenerationContext&) {
+                outOfBounds.link(&jit);
+                context.code->wasmBoundsCheckGenerator()->run(jit, value->pinnedGPR(), value->offset());
+            }));
+
+        // We said we were not a terminal.
+        return CCallHelpers::Jump();
+    }
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirDumpAsJS.cpp b/b3/air/AirDumpAsJS.cpp
new file mode 100644
index 0000000..3d8d6fb
--- /dev/null
+++ b/b3/air/AirDumpAsJS.cpp
@@ -0,0 +1,245 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirDumpAsJS.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInstInlines.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+CString varNameForBlockAtIndex(unsigned index)
+{
+    return toCString("bb", index);
+}
+
+CString varName(BasicBlock* block)
+{
+    return varNameForBlockAtIndex(block->index());
+}
+
+CString varNameForStackSlotAtIndex(unsigned index)
+{
+    return toCString("slot", index);
+}
+
+CString varName(StackSlot* slot)
+{
+    return varNameForStackSlotAtIndex(slot->index());
+}
+
+CString varName(Reg reg)
+{
+    return toCString("Reg.", reg.debugName());
+}
+
+CString varNameForTmpWithTypeAndIndex(Arg::Type type, unsigned index)
+{
+    return toCString(type == Arg::FP ? "f" : "", "tmp", index);
+}
+
+CString varName(Tmp tmp)
+{
+    if (tmp.isReg())
+        return varName(tmp.reg());
+    return varNameForTmpWithTypeAndIndex(Arg(tmp).type(), tmp.tmpIndex());
+}
+
+} // anonymous namespace
+
+void dumpAsJS(Code& code, PrintStream& out)
+{
+    out.println("let code = new Code();");
+    
+    for (unsigned i = 0; i < code.size(); ++i)
+        out.println("let ", varNameForBlockAtIndex(i), " = code.addBlock();");
+    
+    out.println("let hash;");
+
+    for (unsigned i = 0; i < code.stackSlots().size(); ++i) {
+        StackSlot* slot = code.stackSlots()[i];
+        if (slot) {
+            out.println("let ", varName(slot), " = code.addStackSlot(", slot->byteSize(), ", ", slot->kind(), ");");
+            if (slot->offsetFromFP())
+                out.println(varName(slot), ".setOffsetFromFP(", slot->offsetFromFP(), ");");
+            out.println("hash = ", varName(slot), ".hash();");
+            out.println("if (hash != ", slot->jsHash(), ")");
+            out.println("    throw new Error(\"Bad hash: \" + hash);");
+        } else
+            out.println("code.addStackSlot(1, Spill);");
+    }
+    
+    Arg::forEachType(
+        [&] (Arg::Type type) {
+            for (unsigned i = code.numTmps(type); i--;) {
+                out.println(
+                    "let ", varNameForTmpWithTypeAndIndex(type, i), " = code.newTmp(", type, ");");
+            }
+        });
+    
+    out.println("let inst;");
+    out.println("let arg;");
+    
+    for (BasicBlock* block : code) {
+        for (FrequentedBlock successor : block->successors()) {
+            out.println(
+                varName(block), ".successors.push(new FrequentedBlock(",
+                varName(successor.block()), ", ", successor.frequency(), "));");
+        }
+        
+        for (BasicBlock* predecessor : block->predecessors())
+            out.println(varName(block), ".predecessors.push(", varName(predecessor), ");");
+        
+        for (Inst& inst : *block) {
+            // FIXME: This should do something for flags.
+            // https://bugs.webkit.org/show_bug.cgi?id=162751
+            out.println("inst = new Inst(", inst.kind.opcode, ");");
+            
+            inst.forEachArg(
+                [&] (Arg& arg, Arg::Role, Arg::Type, Arg::Width) {
+                    switch (arg.kind()) {
+                    case Arg::Invalid:
+                        RELEASE_ASSERT_NOT_REACHED();
+                        break;
+                        
+                    case Arg::Tmp:
+                        out.println("arg = Arg.createTmp(", varName(arg.tmp()), ");");
+                        break;
+                        
+                    case Arg::Imm:
+                        out.println("arg = Arg.createImm(", arg.value(), ");");
+                        break;
+                        
+                    case Arg::BigImm:
+                        out.println(
+                            "arg = Arg.createBigImm(",
+                            static_cast<int32_t>(arg.value()), ", ",
+                            static_cast<int32_t>(arg.value() >> 32), ");");
+                        break;
+                        
+                    case Arg::BitImm:
+                        out.println("arg = Arg.createBitImm(", arg.value(), ");");
+                        break;
+                        
+                    case Arg::BitImm64:
+                        out.println(
+                            "arg = Arg.createBitImm64(",
+                            static_cast<int32_t>(arg.value()), ", ",
+                            static_cast<int32_t>(arg.value() >> 32), ");");
+                        break;
+                        
+                    case Arg::Addr:
+                        out.println(
+                            "arg = Arg.createAddr(", varName(arg.base()), ", ", arg.offset(), ");");
+                        break;
+                        
+                    case Arg::Stack:
+                        out.println(
+                            "arg = Arg.createStack(", varName(arg.stackSlot()), ", ", arg.offset(), ");");
+                        break;
+                        
+                    case Arg::CallArg:
+                        out.println("arg = Arg.createCallArg(", arg.offset(), ");");
+                        break;
+                        
+                    case Arg::Index:
+                        out.println(
+                            "arg = Arg.createIndex(", varName(arg.base()), ", ",
+                            varName(arg.index()), ", ", arg.scale(), ", ", arg.offset(), ");");
+                        break;
+                        
+                    case Arg::RelCond:
+                        out.println("arg = Arg.createRelCond(", arg.asRelationalCondition(), ");");
+                        break;
+                        
+                    case Arg::ResCond:
+                        out.println("arg = Arg.createResCond(", arg.asResultCondition(), ");");
+                        break;
+                        
+                    case Arg::DoubleCond:
+                        out.println("arg = Arg.createDoubleCond(", arg.asDoubleCondition(), ");");
+                        break;
+                        
+                    case Arg::Special:
+                        out.println("arg = Arg.createSpecial();");
+                        break;
+                        
+                    case Arg::WidthArg:
+                        out.println("arg = Arg.createWidthArg(", arg.width(), ");");
+                        break;
+                    }
+                    
+                    out.println("inst.args.push(arg);");
+                });
+            
+            if (inst.kind.opcode == Patch) {
+                if (inst.hasNonArgEffects())
+                    out.println("inst.patchHasNonArgEffects = true;");
+                
+                out.println("inst.extraEarlyClobberedRegs = new Set();");
+                out.println("inst.extraClobberedRegs = new Set();");
+                inst.extraEarlyClobberedRegs().forEach(
+                    [&] (Reg reg) {
+                        out.println("inst.extraEarlyClobberedRegs.add(", varName(reg), ");");
+                    });
+                inst.extraClobberedRegs().forEach(
+                    [&] (Reg reg) {
+                        out.println("inst.extraClobberedRegs.add(", varName(reg), ");");
+                    });
+                
+                out.println("inst.patchArgData = [];");
+                inst.forEachArg(
+                    [&] (Arg&, Arg::Role role, Arg::Type type, Arg::Width width) {
+                        out.println(
+                            "inst.patchArgData.push({role: Arg.", role, ", type: ", type,
+                            ", width: ", width, "});");
+                    });
+            }
+            
+            if (inst.kind.opcode == CCall || inst.kind.opcode == ColdCCall) {
+                out.println("inst.cCallType = ", inst.origin->type());
+                out.println("inst.cCallArgTypes = [];");
+                for (unsigned i = 1; i < inst.origin->numChildren(); ++i)
+                    out.println("inst.cCallArgTypes.push(", inst.origin->child(i)->type(), ");");
+            }
+            
+            out.println("hash = inst.hash();");
+            out.println("if (hash != ", inst.jsHash(), ")");
+            out.println("    throw new Error(\"Bad hash: \" + hash);");
+            
+            out.println(varName(block), ".append(inst);");
+        }
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirDumpAsJS.h b/b3/air/AirDumpAsJS.h
new file mode 100644
index 0000000..8895f58
--- /dev/null
+++ b/b3/air/AirDumpAsJS.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This is used for benchmarking. Various operations on Air are interesting from a benchmarking
+// standpoint. We can write some Air phases in JS and then use that to benchmark JS. The benchmark
+// is called JSAir, and it's in PerformanceTests/JSAir.
+void dumpAsJS(Code&, PrintStream&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirEliminateDeadCode.cpp b/b3/air/AirEliminateDeadCode.cpp
new file mode 100644
index 0000000..ca36af9
--- /dev/null
+++ b/b3/air/AirEliminateDeadCode.cpp
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirEliminateDeadCode.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirPhaseScope.h"
+#include <wtf/IndexSet.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+bool eliminateDeadCode(Code& code)
+{
+    PhaseScope phaseScope(code, "eliminateDeadCode");
+
+    HashSet<Tmp> liveTmps;
+    IndexSet<StackSlot> liveStackSlots;
+    bool changed;
+
+    auto isArgLive = [&] (const Arg& arg) -> bool {
+        switch (arg.kind()) {
+        case Arg::Tmp:
+            if (arg.isReg())
+                return true;
+            return liveTmps.contains(arg.tmp());
+        case Arg::Stack:
+            if (arg.stackSlot()->isLocked())
+                return true;
+            return liveStackSlots.contains(arg.stackSlot());
+        default:
+            return true;
+        }
+    };
+
+    auto addLiveArg = [&] (const Arg& arg) -> bool {
+        switch (arg.kind()) {
+        case Arg::Tmp:
+            if (arg.isReg())
+                return false;
+            return liveTmps.add(arg.tmp()).isNewEntry;
+        case Arg::Stack:
+            if (arg.stackSlot()->isLocked())
+                return false;
+            return liveStackSlots.add(arg.stackSlot());
+        default:
+            return false;
+        }
+    };
+
+    auto isInstLive = [&] (Inst& inst) -> bool {
+        if (inst.hasNonArgEffects())
+            return true;
+
+        // This instruction should be presumed dead, if its Args are all dead.
+        bool storesToLive = false;
+        inst.forEachArg(
+            [&] (Arg& arg, Arg::Role role, Arg::Type, Arg::Width) {
+                if (!Arg::isAnyDef(role))
+                    return;
+                if (role == Arg::Scratch)
+                    return;
+                storesToLive |= isArgLive(arg);
+            });
+        return storesToLive;
+    };
+
+    auto handleInst = [&] (Inst& inst) {
+        if (!isInstLive(inst))
+            return;
+
+        // We get here if the Inst is live. For simplicity we say that a live instruction forces
+        // liveness upon everything it mentions.
+        for (Arg& arg : inst.args) {
+            changed |= addLiveArg(arg);
+            arg.forEachTmpFast(
+                [&] (Tmp& tmp) {
+                    changed |= addLiveArg(tmp);
+                });
+        }
+    };
+
+    auto runForward = [&] () -> bool {
+        changed = false;
+        for (BasicBlock* block : code) {
+            for (Inst& inst : *block)
+                handleInst(inst);
+        }
+        return changed;
+    };
+
+    auto runBackward = [&] () -> bool {
+        changed = false;
+        for (unsigned blockIndex = code.size(); blockIndex--;) {
+            BasicBlock* block = code[blockIndex];
+            for (unsigned instIndex = block->size(); instIndex--;)
+                handleInst(block->at(instIndex));
+        }
+        return changed;
+    };
+
+    for (;;) {
+        // Propagating backward is most likely to be profitable.
+        if (!runBackward())
+            break;
+        if (!runBackward())
+            break;
+
+        // Occasionally propagating forward greatly reduces the likelihood of pathologies.
+        if (!runForward())
+            break;
+    }
+
+    unsigned removedInstCount = 0;
+    for (BasicBlock* block : code) {
+        removedInstCount += block->insts().removeAllMatching(
+            [&] (Inst& inst) -> bool {
+                return !isInstLive(inst);
+            });
+    }
+
+    return !!removedInstCount;
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirEliminateDeadCode.h b/b3/air/AirEliminateDeadCode.h
new file mode 100644
index 0000000..1b718f6
--- /dev/null
+++ b/b3/air/AirEliminateDeadCode.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This eliminates instructions that have no observable effect. These are instructions whose only
+// effect would be storing to some Arg, except that we proved that the location specified by the Arg
+// is never loaded from. The only Args for which we can do such analysis are non-Reg Tmps and
+// anonymous StackSlots.
+
+bool eliminateDeadCode(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirEmitShuffle.cpp b/b3/air/AirEmitShuffle.cpp
new file mode 100644
index 0000000..3184719
--- /dev/null
+++ b/b3/air/AirEmitShuffle.cpp
@@ -0,0 +1,543 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirEmitShuffle.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include <wtf/GraphNodeWorklist.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+bool verbose = false;
+
+template<typename Functor>
+Tmp findPossibleScratch(Code& code, Arg::Type type, const Functor& functor) {
+    for (Reg reg : code.regsInPriorityOrder(type)) {
+        Tmp tmp(reg);
+        if (functor(tmp))
+            return tmp;
+    }
+    return Tmp();
+}
+
+Tmp findPossibleScratch(Code& code, Arg::Type type, const Arg& arg1, const Arg& arg2) {
+    return findPossibleScratch(
+        code, type,
+        [&] (Tmp tmp) -> bool {
+            return !arg1.usesTmp(tmp) && !arg2.usesTmp(tmp);
+        });
+}
+
+// Example: (a => b, b => a, a => c, b => d)
+struct Rotate {
+    Vector<ShufflePair> loop; // in the example, this is the loop: (a => b, b => a)
+    Vector<ShufflePair> fringe; // in the example, these are the associated shifts: (a => c, b => d)
+};
+
+} // anonymous namespace
+
+void ShufflePair::dump(PrintStream& out) const
+{
+    out.print(width(), ":", src(), "=>", dst());
+}
+
+Inst createShuffle(Value* origin, const Vector<ShufflePair>& pairs)
+{
+    Inst result(Shuffle, origin);
+    for (const ShufflePair& pair : pairs)
+        result.append(pair.src(), pair.dst(), Arg::widthArg(pair.width()));
+    return result;
+}
+
+Vector<Inst> emitShuffle(
+    Code& code, Vector<ShufflePair> pairs, std::array<Arg, 2> scratches, Arg::Type type,
+    Value* origin)
+{
+    if (verbose) {
+        dataLog(
+            "Dealing with pairs: ", listDump(pairs), " and scratches ", scratches[0], ", ",
+            scratches[1], "\n");
+    }
+    
+    pairs.removeAllMatching(
+        [&] (const ShufflePair& pair) -> bool {
+            return pair.src() == pair.dst();
+        });
+    
+    // First validate that this is the kind of shuffle that we know how to deal with.
+#if !ASSERT_DISABLED
+    for (const ShufflePair& pair : pairs) {
+        ASSERT(pair.src().isType(type));
+        ASSERT(pair.dst().isType(type));
+        ASSERT(pair.dst().isTmp() || pair.dst().isMemory());
+    }
+#endif // !ASSERT_DISABLED
+
+    // There are two possible kinds of operations that we will do:
+    //
+    // - Shift. Example: (a => b, b => c). We emit this as "Move b, c; Move a, b". This only requires
+    //   scratch registers if there are memory->memory moves. We want to find as many of these as
+    //   possible because they are cheaper. Note that shifts can involve the same source mentioned
+    //   multiple times. Example: (a => b, a => c, b => d, b => e).
+    //
+    // - Rotate. Example: (a => b, b => a). We want to emit this as "Swap a, b", but that instruction
+    //   may not be available, in which case we may need a scratch register or a scratch memory
+    //   location. A gnarlier example is (a => b, b => c, c => a). We can emit this as "Swap b, c;
+    //   Swap a, b". Note that swapping has to be careful about differing widths.
+    //
+    // Note that a rotate can have "fringe". For example, we might have (a => b, b => a, a =>c,
+    // b => d). This has a rotate loop (a => b, b => a) and some fringe (a => c, b => d). We treat
+    // the whole thing as a single rotate.
+    //
+    // We will find multiple disjoint such operations. We can execute them in any order.
+
+    // We interpret these as Moves that should be executed backwards. All shifts are keyed by their
+    // starting source.
+    HashMap<Arg, Vector<ShufflePair>> shifts;
+
+    // We interpret these as Swaps over src()'s that should be executed backwards, i.e. for a list
+    // of size 3 we would do "Swap list[1].src(), list[2].src(); Swap list[0].src(), list[1].src()".
+    // Note that we actually can't do that if the widths don't match or other bad things happen.
+    // But, prior to executing all of that, we need to execute the fringe: the shifts comming off the
+    // rotate.
+    Vector<Rotate> rotates;
+
+    {
+        HashMap<Arg, Vector<ShufflePair>> mapping;
+        for (const ShufflePair& pair : pairs)
+            mapping.add(pair.src(), Vector<ShufflePair>()).iterator->value.append(pair);
+
+        Vector<ShufflePair> currentPairs;
+
+        while (!mapping.isEmpty()) {
+            ASSERT(currentPairs.isEmpty());
+            Arg originalSrc = mapping.begin()->key;
+            ASSERT(!shifts.contains(originalSrc));
+            if (verbose)
+                dataLog("Processing from ", originalSrc, "\n");
+            
+            GraphNodeWorklist<Arg> worklist;
+            worklist.push(originalSrc);
+            while (Arg src = worklist.pop()) {
+                HashMap<Arg, Vector<ShufflePair>>::iterator iter = mapping.find(src);
+                if (iter == mapping.end()) {
+                    // With a shift it's possible that we previously built the tail of this shift.
+                    // See if that's the case now.
+                    if (verbose)
+                        dataLog("Trying to append shift at ", src, "\n");
+                    currentPairs.appendVector(shifts.take(src));
+                    continue;
+                }
+                Vector<ShufflePair> pairs = WTFMove(iter->value);
+                mapping.remove(iter);
+
+                for (const ShufflePair& pair : pairs) {
+                    currentPairs.append(pair);
+                    ASSERT(pair.src() == src);
+                    worklist.push(pair.dst());
+                }
+            }
+
+            ASSERT(currentPairs.size());
+            ASSERT(currentPairs[0].src() == originalSrc);
+
+            if (verbose)
+                dataLog("currentPairs = ", listDump(currentPairs), "\n");
+
+            bool isRotate = false;
+            for (const ShufflePair& pair : currentPairs) {
+                if (pair.dst() == originalSrc) {
+                    isRotate = true;
+                    break;
+                }
+            }
+
+            if (isRotate) {
+                if (verbose)
+                    dataLog("It's a rotate.\n");
+                Rotate rotate;
+
+                // The common case is that the rotate does not have fringe. The only way to
+                // check for this is to examine the whole rotate.
+                bool ok;
+                if (currentPairs.last().dst() == originalSrc) {
+                    ok = true;
+                    for (unsigned i = currentPairs.size() - 1; i--;)
+                        ok &= currentPairs[i].dst() == currentPairs[i + 1].src();
+                } else
+                    ok = false;
+                
+                if (ok)
+                    rotate.loop = WTFMove(currentPairs);
+                else {
+                    // This is the slow path. The rotate has fringe.
+                    
+                    HashMap<Arg, ShufflePair> dstMapping;
+                    for (const ShufflePair& pair : currentPairs)
+                        dstMapping.add(pair.dst(), pair);
+
+                    ShufflePair pair = dstMapping.take(originalSrc);
+                    for (;;) {
+                        rotate.loop.append(pair);
+
+                        auto iter = dstMapping.find(pair.src());
+                        if (iter == dstMapping.end())
+                            break;
+                        pair = iter->value;
+                        dstMapping.remove(iter);
+                    }
+
+                    rotate.loop.reverse();
+
+                    // Make sure that the fringe appears in the same order as how it appeared in the
+                    // currentPairs, since that's the DFS order.
+                    for (const ShufflePair& pair : currentPairs) {
+                        // But of course we only include it if it's not in the loop.
+                        if (dstMapping.contains(pair.dst()))
+                            rotate.fringe.append(pair);
+                    }
+                }
+                
+                // If the graph search terminates because we returned to the first source, then the
+                // pair list has to have a very particular shape.
+                for (unsigned i = rotate.loop.size() - 1; i--;)
+                    ASSERT(rotate.loop[i].dst() == rotate.loop[i + 1].src());
+                rotates.append(WTFMove(rotate));
+                currentPairs.resize(0);
+            } else {
+                if (verbose)
+                    dataLog("It's a shift.\n");
+                shifts.add(originalSrc, WTFMove(currentPairs));
+            }
+        }
+    }
+
+    if (verbose) {
+        dataLog("Shifts:\n");
+        for (auto& entry : shifts)
+            dataLog("    ", entry.key, ": ", listDump(entry.value), "\n");
+        dataLog("Rotates:\n");
+        for (auto& rotate : rotates)
+            dataLog("    loop = ", listDump(rotate.loop), ", fringe = ", listDump(rotate.fringe), "\n");
+    }
+
+    // In the worst case, we need two scratch registers. The way we do this is that the client passes
+    // us what scratch registers he happens to have laying around. We will need scratch registers in
+    // the following cases:
+    //
+    // - Shuffle pairs where both src and dst refer to memory.
+    // - Rotate when no Swap instruction is available.
+    //
+    // Lucky for us, we are guaranteed to have extra scratch registers anytime we have a Shift that
+    // ends with a register. We search for such a register right now.
+
+    auto moveForWidth = [&] (Arg::Width width) -> Opcode {
+        switch (width) {
+        case Arg::Width32:
+            return type == Arg::GP ? Move32 : MoveFloat;
+        case Arg::Width64:
+            return type == Arg::GP ? Move : MoveDouble;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    };
+
+    Opcode conservativeMove = moveForWidth(Arg::conservativeWidth(type));
+
+    // We will emit things in reverse. We maintain a list of packs of instructions, and then we emit
+    // append them together in reverse (for example the thing at the end of resultPacks is placed
+    // first). This is useful because the last thing we emit frees up its destination registers, so
+    // it affects how we emit things before it.
+    Vector<Vector<Inst>> resultPacks;
+    Vector<Inst> result;
+
+    auto commitResult = [&] () {
+        resultPacks.append(WTFMove(result));
+    };
+
+    auto getScratch = [&] (unsigned index, Tmp possibleScratch) -> Tmp {
+        if (scratches[index].isTmp())
+            return scratches[index].tmp();
+
+        if (!possibleScratch)
+            return Tmp();
+        result.append(Inst(conservativeMove, origin, possibleScratch, scratches[index]));
+        return possibleScratch;
+    };
+
+    auto returnScratch = [&] (unsigned index, Tmp tmp) {
+        if (Arg(tmp) != scratches[index])
+            result.append(Inst(conservativeMove, origin, scratches[index], tmp));
+    };
+
+    auto handleShiftPair = [&] (const ShufflePair& pair, unsigned scratchIndex) {
+        Opcode move = moveForWidth(pair.width());
+        
+        if (!isValidForm(move, pair.src().kind(), pair.dst().kind())) {
+            Tmp scratch =
+                getScratch(scratchIndex, findPossibleScratch(code, type, pair.src(), pair.dst()));
+            RELEASE_ASSERT(scratch);
+            if (isValidForm(move, pair.src().kind(), Arg::Tmp))
+                result.append(Inst(moveForWidth(pair.width()), origin, pair.src(), scratch));
+            else {
+                ASSERT(pair.src().isSomeImm());
+                ASSERT(move == Move32);
+                result.append(Inst(Move, origin, Arg::bigImm(pair.src().value()), scratch));
+            }
+            result.append(Inst(moveForWidth(pair.width()), origin, scratch, pair.dst()));
+            returnScratch(scratchIndex, scratch);
+            return;
+        }
+        
+        result.append(Inst(move, origin, pair.src(), pair.dst()));
+    };
+
+    auto handleShift = [&] (Vector<ShufflePair>& shift) {
+        // FIXME: We could optimize the spill behavior of the shifter by checking if any of the
+        // shifts need spills. If they do, then we could try to get a register out here. Note that
+        // this may fail where the current strategy succeeds: out here we need a register that does
+        // not interfere with any of the shifts, while the current strategy only needs to find a
+        // scratch register that does not interfer with a particular shift. So, this optimization
+        // will be opportunistic: if it succeeds, then the individual shifts can use that scratch,
+        // otherwise they will do what they do now.
+        
+        for (unsigned i = shift.size(); i--;)
+            handleShiftPair(shift[i], 0);
+
+        Arg lastDst = shift.last().dst();
+        if (lastDst.isTmp()) {
+            for (Arg& scratch : scratches) {
+                ASSERT(scratch != lastDst);
+                if (!scratch.isTmp()) {
+                    scratch = lastDst;
+                    break;
+                }
+            }
+        }
+    };
+
+    // First handle shifts whose last destination is a tmp because these free up scratch registers.
+    // These end up last in the final sequence, so the final destination of these shifts will be
+    // available as a scratch location for anything emitted prior (so, after, since we're emitting in
+    // reverse).
+    for (auto& entry : shifts) {
+        Vector<ShufflePair>& shift = entry.value;
+        if (shift.last().dst().isTmp())
+            handleShift(shift);
+        commitResult();
+    }
+
+    // Now handle the rest of the shifts.
+    for (auto& entry : shifts) {
+        Vector<ShufflePair>& shift = entry.value;
+        if (!shift.last().dst().isTmp())
+            handleShift(shift);
+        commitResult();
+    }
+
+    for (Rotate& rotate : rotates) {
+        if (!rotate.fringe.isEmpty()) {
+            // Make sure we do the fringe first! This won't clobber any of the registers that are
+            // part of the rotation.
+            handleShift(rotate.fringe);
+        }
+        
+        bool canSwap = false;
+        Opcode swap = Oops;
+        Arg::Width swapWidth = Arg::Width8; // bogus value
+
+        // Currently, the swap instruction is not available for floating point on any architecture we
+        // support.
+        if (type == Arg::GP) {
+            // Figure out whether we will be doing 64-bit swaps or 32-bit swaps. If we have a mix of
+            // widths we handle that by fixing up the relevant register with zero-extends.
+            swap = Swap32;
+            swapWidth = Arg::Width32;
+            bool hasMemory = false;
+            bool hasIndex = false;
+            for (ShufflePair& pair : rotate.loop) {
+                switch (pair.width()) {
+                case Arg::Width32:
+                    break;
+                case Arg::Width64:
+                    swap = Swap64;
+                    swapWidth = Arg::Width64;
+                    break;
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                    break;
+                }
+
+                hasMemory |= pair.src().isMemory() || pair.dst().isMemory();
+                hasIndex |= pair.src().isIndex() || pair.dst().isIndex();
+            }
+            
+            canSwap = isValidForm(swap, Arg::Tmp, Arg::Tmp);
+
+            // We can totally use swaps even if there are shuffles involving memory. But, we play it
+            // safe in that case. There are corner cases we don't handle, and our ability to do it is
+            // contingent upon swap form availability.
+            
+            if (hasMemory) {
+                canSwap &= isValidForm(swap, Arg::Tmp, Arg::Addr);
+                
+                // We don't take the swapping path if there is a mix of widths and some of the
+                // shuffles involve memory. That gets too confusing. We might be able to relax this
+                // to only bail if there are subwidth pairs involving memory, but I haven't thought
+                // about it very hard. Anyway, this case is not common: rotates involving memory
+                // don't arise for function calls, and they will only happen for rotates in user code
+                // if some of the variables get spilled. It's hard to imagine a program that rotates
+                // data around in variables while also doing a combination of uint32->uint64 and
+                // int64->int32 casts.
+                for (ShufflePair& pair : rotate.loop)
+                    canSwap &= pair.width() == swapWidth;
+            }
+
+            if (hasIndex)
+                canSwap &= isValidForm(swap, Arg::Tmp, Arg::Index);
+        }
+
+        if (canSwap) {
+            for (unsigned i = rotate.loop.size() - 1; i--;) {
+                Arg left = rotate.loop[i].src();
+                Arg right = rotate.loop[i + 1].src();
+
+                if (left.isMemory() && right.isMemory()) {
+                    // Note that this is a super rare outcome. Rotates are rare. Spills are rare.
+                    // Moving data between two spills is rare. To get here a lot of rare stuff has to
+                    // all happen at once.
+                    
+                    Tmp scratch = getScratch(0, findPossibleScratch(code, type, left, right));
+                    RELEASE_ASSERT(scratch);
+                    result.append(Inst(moveForWidth(swapWidth), origin, left, scratch));
+                    result.append(Inst(swap, origin, scratch, right));
+                    result.append(Inst(moveForWidth(swapWidth), origin, scratch, left));
+                    returnScratch(0, scratch);
+                    continue;
+                }
+
+                if (left.isMemory())
+                    std::swap(left, right);
+                
+                result.append(Inst(swap, origin, left, right));
+            }
+
+            for (ShufflePair pair : rotate.loop) {
+                if (pair.width() == swapWidth)
+                    continue;
+
+                RELEASE_ASSERT(pair.width() == Arg::Width32);
+                RELEASE_ASSERT(swapWidth == Arg::Width64);
+                RELEASE_ASSERT(pair.dst().isTmp());
+
+                // Need to do an extra zero extension.
+                result.append(Inst(Move32, origin, pair.dst(), pair.dst()));
+            }
+        } else {
+            // We can treat this as a shift so long as we take the last destination (i.e. first
+            // source) and save it first. Then we handle the first entry in the pair in the rotate
+            // specially, after we restore the last destination. This requires some special care to
+            // find a scratch register. It's possible that we have a rotate that uses the entire
+            // available register file.
+
+            Tmp scratch = findPossibleScratch(
+                code, type,
+                [&] (Tmp tmp) -> bool {
+                    for (ShufflePair pair : rotate.loop) {
+                        if (pair.src().usesTmp(tmp))
+                            return false;
+                        if (pair.dst().usesTmp(tmp))
+                            return false;
+                    }
+                    return true;
+                });
+
+            // NOTE: This is the most likely use of scratch registers.
+            scratch = getScratch(0, scratch);
+
+            // We may not have found a scratch register. When this happens, we can just use the spill
+            // slot directly.
+            Arg rotateSave = scratch ? Arg(scratch) : scratches[0];
+            
+            handleShiftPair(
+                ShufflePair(rotate.loop.last().dst(), rotateSave, rotate.loop[0].width()), 1);
+
+            for (unsigned i = rotate.loop.size(); i-- > 1;)
+                handleShiftPair(rotate.loop[i], 1);
+
+            handleShiftPair(
+                ShufflePair(rotateSave, rotate.loop[0].dst(), rotate.loop[0].width()), 1);
+
+            if (scratch)
+                returnScratch(0, scratch);
+        }
+
+        commitResult();
+    }
+
+    ASSERT(result.isEmpty());
+
+    for (unsigned i = resultPacks.size(); i--;)
+        result.appendVector(resultPacks[i]);
+
+    return result;
+}
+
+Vector<Inst> emitShuffle(
+    Code& code, const Vector<ShufflePair>& pairs,
+    const std::array<Arg, 2>& gpScratch, const std::array<Arg, 2>& fpScratch,
+    Value* origin)
+{
+    Vector<ShufflePair> gpPairs;
+    Vector<ShufflePair> fpPairs;
+    for (const ShufflePair& pair : pairs) {
+        if (pair.src().isMemory() && pair.dst().isMemory() && pair.width() > Arg::pointerWidth()) {
+            // 8-byte memory-to-memory moves on a 32-bit platform are best handled as float moves.
+            fpPairs.append(pair);
+        } else if (pair.src().isGP() && pair.dst().isGP()) {
+            // This means that gpPairs gets memory-to-memory shuffles. The assumption is that we
+            // can do that more efficiently using GPRs, except in the special case above.
+            gpPairs.append(pair);
+        } else
+            fpPairs.append(pair);
+    }
+
+    Vector<Inst> result;
+    result.appendVector(emitShuffle(code, gpPairs, gpScratch, Arg::GP, origin));
+    result.appendVector(emitShuffle(code, fpPairs, fpScratch, Arg::FP, origin));
+    return result;
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirEmitShuffle.h b/b3/air/AirEmitShuffle.h
new file mode 100644
index 0000000..b2c3bb0
--- /dev/null
+++ b/b3/air/AirEmitShuffle.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "AirInst.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 {
+
+class Value;
+
+namespace Air {
+
+class Code;
+
+class ShufflePair {
+public:
+    ShufflePair()
+    {
+    }
+    
+    ShufflePair(const Arg& src, const Arg& dst, Arg::Width width)
+        : m_src(src)
+        , m_dst(dst)
+        , m_width(width)
+    {
+    }
+
+    const Arg& src() const { return m_src; }
+    const Arg& dst() const { return m_dst; }
+
+    // The width determines the kind of move we do. You can only choose Width32 or Width64 right now.
+    // For GP, it picks between Move32 and Move. For FP, it picks between MoveFloat and MoveDouble.
+    Arg::Width width() const { return m_width; }
+
+    void dump(PrintStream&) const;
+    
+private:
+    Arg m_src;
+    Arg m_dst;
+    Arg::Width m_width { Arg::Width8 };
+};
+
+// Create a Shuffle instruction.
+Inst createShuffle(Value* origin, const Vector<ShufflePair>&);
+
+// Perform a shuffle of a given type. The scratch argument is mandatory. You should pass it as
+// follows: If you know that you have scratch registers or temporaries available - that is, they're
+// registers that are not mentioned in the shuffle, have the same type as the shuffle, and are not
+// live at the shuffle - then you can pass them. If you don't have scratch registers available or if
+// you don't feel like looking for them, you can pass memory locations. It's always safe to pass a
+// pair of memory locations, and replacing either memory location with a register can be viewed as an
+// optimization. It's a pretty important optimization. Some more notes:
+//
+// - We define scratch registers as things that are not live before the shuffle and are not one of
+//   the destinations of the shuffle. Not being live before the shuffle also means that they cannot
+//   be used for any of the sources of the shuffle.
+//
+// - A second scratch location is only needed when you have shuffle pairs where memory is used both
+//   as source and destination.
+//
+// - You're guaranteed not to need any scratch locations if there is a Swap instruction available for
+//   the type and you don't have any memory locations that are both the source and the destination of
+//   some pairs. GP supports Swap on x86 while FP never supports Swap.
+//
+// - Passing memory locations as scratch if are running emitShuffle() before register allocation is
+//   silly, since that will cause emitShuffle() to pick some specific registers when it does need
+//   scratch. One easy way to avoid that predicament is to ensure that you call emitShuffle() after
+//   register allocation. For this reason we could add a Shuffle instruction so that we can defer
+//   shufflings until after regalloc.
+//
+// - Shuffles with memory=>memory pairs are not very well tuned. You should avoid them if you want
+//   performance. If you need to do them, then making sure that you reserve a temporary is one way to
+//   get acceptable performance.
+//
+// NOTE: Use this method (and its friend below) to emit shuffles after register allocation. Before
+// register allocation it is much better to simply use the Shuffle instruction.
+Vector<Inst> emitShuffle(
+    Code& code, Vector<ShufflePair>, std::array<Arg, 2> scratch, Arg::Type, Value* origin);
+
+// Perform a shuffle that involves any number of types. Pass scratch registers or memory locations
+// for each type according to the rules above.
+Vector<Inst> emitShuffle(
+    Code& code, const Vector<ShufflePair>&,
+    const std::array<Arg, 2>& gpScratch, const std::array<Arg, 2>& fpScratch,
+    Value* origin);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirFixObviousSpills.cpp b/b3/air/AirFixObviousSpills.cpp
new file mode 100644
index 0000000..d000d6c
--- /dev/null
+++ b/b3/air/AirFixObviousSpills.cpp
@@ -0,0 +1,569 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AirFixObviousSpills.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirArgInlines.h"
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirPhaseScope.h"
+#include <wtf/IndexMap.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+bool verbose = false;
+
+class FixObviousSpills {
+public:
+    FixObviousSpills(Code& code)
+        : m_code(code)
+        , m_atHead(code.size())
+    {
+    }
+
+    void run()
+    {
+        if (verbose)
+            dataLog("Code before fixObviousSpills:\n", m_code);
+        
+        computeAliases();
+        fixCode();
+    }
+
+private:
+    void computeAliases()
+    {
+        m_atHead[m_code[0]].wasVisited = true;
+        
+        bool changed = true;
+        while (changed) {
+            changed = false;
+            
+            for (BasicBlock* block : m_code) {
+                m_block = block;
+                m_state = m_atHead[block];
+                if (!m_state.wasVisited)
+                    continue;
+
+                if (verbose)
+                    dataLog("Executing block ", *m_block, ": ", m_state, "\n");
+                
+                for (m_instIndex = 0; m_instIndex < block->size(); ++m_instIndex)
+                    executeInst();
+
+                for (BasicBlock* successor : block->successorBlocks()) {
+                    State& toState = m_atHead[successor];
+                    if (toState.wasVisited)
+                        changed |= toState.merge(m_state);
+                    else {
+                        toState = m_state;
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+
+    void fixCode()
+    {
+        for (BasicBlock* block : m_code) {
+            m_block = block;
+            m_state = m_atHead[block];
+            RELEASE_ASSERT(m_state.wasVisited);
+
+            for (m_instIndex = 0; m_instIndex < block->size(); ++m_instIndex) {
+                fixInst();
+                executeInst();
+            }
+        }
+    }
+
+    void executeInst()
+    {
+        Inst& inst = m_block->at(m_instIndex);
+
+        if (verbose)
+            dataLog("    Executing ", inst, ": ", m_state, "\n");
+
+        Inst::forEachDefWithExtraClobberedRegs<Arg>(
+            &inst, &inst,
+            [&] (const Arg& arg, Arg::Role, Arg::Type, Arg::Width) {
+                if (verbose)
+                    dataLog("        Clobbering ", arg, "\n");
+                m_state.clobber(arg);
+            });
+
+        switch (inst.kind.opcode) {
+        case Move:
+            if (inst.args[0].isSomeImm()) {
+                if (inst.args[1].isReg())
+                    m_state.addAlias(RegConst(inst.args[1].reg(), inst.args[0].value()));
+                else if (isSpillSlot(inst.args[1]))
+                    m_state.addAlias(SlotConst(inst.args[1].stackSlot(), inst.args[0].value()));
+            } else if (isSpillSlot(inst.args[0]) && inst.args[1].isReg()) {
+                if (std::optional<int64_t> constant = m_state.constantFor(inst.args[0]))
+                    m_state.addAlias(RegConst(inst.args[1].reg(), *constant));
+                m_state.addAlias(
+                    RegSlot(inst.args[1].reg(), inst.args[0].stackSlot(), RegSlot::AllBits));
+            } else if (inst.args[0].isReg() && isSpillSlot(inst.args[1])) {
+                if (std::optional<int64_t> constant = m_state.constantFor(inst.args[0]))
+                    m_state.addAlias(SlotConst(inst.args[1].stackSlot(), *constant));
+                m_state.addAlias(
+                    RegSlot(inst.args[0].reg(), inst.args[1].stackSlot(), RegSlot::AllBits));
+            }
+            break;
+
+        case Move32:
+            if (inst.args[0].isSomeImm()) {
+                if (inst.args[1].isReg())
+                    m_state.addAlias(RegConst(inst.args[1].reg(), static_cast<uint32_t>(inst.args[0].value())));
+                else if (isSpillSlot(inst.args[1]))
+                    m_state.addAlias(SlotConst(inst.args[1].stackSlot(), static_cast<uint32_t>(inst.args[0].value())));
+            } else if (isSpillSlot(inst.args[0]) && inst.args[1].isReg()) {
+                if (std::optional<int64_t> constant = m_state.constantFor(inst.args[0]))
+                    m_state.addAlias(RegConst(inst.args[1].reg(), static_cast<uint32_t>(*constant)));
+                m_state.addAlias(
+                    RegSlot(inst.args[1].reg(), inst.args[0].stackSlot(), RegSlot::ZExt32));
+            } else if (inst.args[0].isReg() && isSpillSlot(inst.args[1])) {
+                if (std::optional<int64_t> constant = m_state.constantFor(inst.args[0]))
+                    m_state.addAlias(SlotConst(inst.args[1].stackSlot(), static_cast<int32_t>(*constant)));
+                m_state.addAlias(
+                    RegSlot(inst.args[0].reg(), inst.args[1].stackSlot(), RegSlot::Match32));
+            }
+            break;
+
+        case MoveFloat:
+            if (isSpillSlot(inst.args[0]) && inst.args[1].isReg()) {
+                m_state.addAlias(
+                    RegSlot(inst.args[1].reg(), inst.args[0].stackSlot(), RegSlot::Match32));
+            } else if (inst.args[0].isReg() && isSpillSlot(inst.args[1])) {
+                m_state.addAlias(
+                    RegSlot(inst.args[0].reg(), inst.args[1].stackSlot(), RegSlot::Match32));
+            }
+            break;
+
+        case MoveDouble:
+            if (isSpillSlot(inst.args[0]) && inst.args[1].isReg()) {
+                m_state.addAlias(
+                    RegSlot(inst.args[1].reg(), inst.args[0].stackSlot(), RegSlot::AllBits));
+            } else if (inst.args[0].isReg() && isSpillSlot(inst.args[1])) {
+                m_state.addAlias(
+                    RegSlot(inst.args[0].reg(), inst.args[1].stackSlot(), RegSlot::AllBits));
+            }
+            break;
+
+        default:
+            break;
+        }
+    }
+
+    void fixInst()
+    {
+        Inst& inst = m_block->at(m_instIndex);
+
+        if (verbose)
+            dataLog("Fixing inst ", inst, ": ", m_state, "\n");
+        
+        // First handle some special instructions.
+        switch (inst.kind.opcode) {
+        case Move: {
+            if (inst.args[0].isBigImm() && inst.args[1].isReg()
+                && isValidForm(Add64, Arg::Imm, Arg::Tmp, Arg::Tmp)) {
+                // BigImm materializations are super expensive on both x86 and ARM. Let's try to
+                // materialize this bad boy using math instead. Note that we use unsigned math here
+                // since it's more deterministic.
+                uint64_t myValue = inst.args[0].value();
+                Reg myDest = inst.args[1].reg();
+                for (const RegConst& regConst : m_state.regConst) {
+                    uint64_t otherValue = regConst.constant;
+                    
+                    // Let's try add. That's the only thing that works on all platforms, since it's
+                    // the only cheap arithmetic op that x86 does in three operands. Long term, we
+                    // should add fancier materializations here for ARM if the BigImm is yuge.
+                    uint64_t delta = myValue - otherValue;
+                    
+                    if (Arg::isValidImmForm(delta)) {
+                        inst.kind = Add64;
+                        inst.args.resize(3);
+                        inst.args[0] = Arg::imm(delta);
+                        inst.args[1] = Tmp(regConst.reg);
+                        inst.args[2] = Tmp(myDest);
+                        return;
+                    }
+                }
+                return;
+            }
+            break;
+        }
+            
+        default:
+            break;
+        }
+
+        // Create a copy in case we invalidate the instruction. That doesn't happen often.
+        Inst instCopy = inst;
+
+        // The goal is to replace references to stack slots. We only care about early uses. We can't
+        // handle UseDefs. We could teach this to handle UseDefs if we inserted a store instruction
+        // after and we proved that the register aliased to the stack slot dies here. We can get that
+        // information from the liveness analysis. We also can't handle late uses, because we don't
+        // look at late clobbers when doing this.
+        bool didThings = false;
+        auto handleArg = [&] (Arg& arg, Arg::Role role, Arg::Type, Arg::Width width) {
+            if (!isSpillSlot(arg))
+                return;
+            if (!Arg::isEarlyUse(role))
+                return;
+            if (Arg::isAnyDef(role))
+                return;
+            
+            // Try to get a register if at all possible.
+            if (const RegSlot* alias = m_state.getRegSlot(arg.stackSlot())) {
+                switch (width) {
+                case Arg::Width64:
+                    if (alias->mode != RegSlot::AllBits)
+                        return;
+                    if (verbose)
+                        dataLog("    Replacing ", arg, " with ", alias->reg, "\n");
+                    arg = Tmp(alias->reg);
+                    didThings = true;
+                    return;
+                case Arg::Width32:
+                    if (verbose)
+                        dataLog("    Replacing ", arg, " with ", alias->reg, " (subwidth case)\n");
+                    arg = Tmp(alias->reg);
+                    didThings = true;
+                    return;
+                default:
+                    return;
+                }
+            }
+
+            // Revert to immediate if that didn't work.
+            if (const SlotConst* alias = m_state.getSlotConst(arg.stackSlot())) {
+                if (verbose)
+                    dataLog("    Replacing ", arg, " with constant ", alias->constant, "\n");
+                if (Arg::isValidImmForm(alias->constant))
+                    arg = Arg::imm(alias->constant);
+                else
+                    arg = Arg::bigImm(alias->constant);
+                didThings = true;
+                return;
+            }
+        };
+        
+        inst.forEachArg(handleArg);
+        if (!didThings || inst.isValidForm())
+            return;
+        
+        // We introduced something invalid along the way. Back up and carefully handle each argument.
+        inst = instCopy;
+        ASSERT(inst.isValidForm());
+        inst.forEachArg(
+            [&] (Arg& arg, Arg::Role role, Arg::Type type, Arg::Width width) {
+                Arg argCopy = arg;
+                handleArg(arg, role, type, width);
+                if (!inst.isValidForm())
+                    arg = argCopy;
+            });
+    }
+    
+    static bool isSpillSlot(const Arg& arg)
+    {
+        return arg.isStack() && arg.stackSlot()->isSpill();
+    }
+    
+    struct RegConst {
+        RegConst()
+        {
+        }
+        
+        RegConst(Reg reg, int64_t constant)
+            : reg(reg)
+            , constant(constant)
+        {
+        }
+
+        explicit operator bool() const
+        {
+            return !!reg;
+        }
+
+        void dump(PrintStream& out) const
+        {
+            out.print(reg, "->", constant);
+        }
+        
+        Reg reg;
+        int64_t constant { 0 };
+    };
+
+    struct RegSlot {
+        enum Mode : int8_t {
+            AllBits,
+            ZExt32, // Register contains zero-extended contents of stack slot.
+            Match32 // Low 32 bits of register match low 32 bits of stack slot.
+        };
+        
+        RegSlot()
+        {
+        }
+
+        RegSlot(Reg reg, StackSlot* slot, Mode mode)
+            : slot(slot)
+            , reg(reg)
+            , mode(mode)
+        {
+        }
+
+        explicit operator bool() const
+        {
+            return slot && reg;
+        }
+
+        void dump(PrintStream& out) const
+        {
+            out.print(pointerDump(slot), "->", reg);
+            switch (mode) {
+            case AllBits:
+                out.print("(AllBits)");
+                break;
+            case ZExt32:
+                out.print("(ZExt32)");
+                break;
+            case Match32:
+                out.print("(Match32)");
+                break;
+            }
+        }
+        
+        StackSlot* slot { nullptr };
+        Reg reg;
+        Mode mode { AllBits };
+    };
+
+    struct SlotConst {
+        SlotConst()
+        {
+        }
+
+        SlotConst(StackSlot* slot, int64_t constant)
+            : slot(slot)
+            , constant(constant)
+        {
+        }
+
+        explicit operator bool() const
+        {
+            return slot;
+        }
+
+        void dump(PrintStream& out) const
+        {
+            out.print(pointerDump(slot), "->", constant);
+        }
+        
+        StackSlot* slot { nullptr };
+        int64_t constant { 0 };
+    };
+
+    struct State {
+        void addAlias(const RegConst& newAlias)
+        {
+            regConst.append(newAlias);
+        }
+        void addAlias(const RegSlot& newAlias)
+        {
+            regSlot.append(newAlias);
+        }
+        void addAlias(const SlotConst& newAlias)
+        {
+            slotConst.append(newAlias);
+        }
+
+        const RegConst* getRegConst(Reg reg) const
+        {
+            for (const RegConst& alias : regConst) {
+                if (alias.reg == reg)
+                    return &alias;
+            }
+            return nullptr;
+        }
+
+        const RegSlot* getRegSlot(Reg reg) const
+        {
+            for (const RegSlot& alias : regSlot) {
+                if (alias.reg == reg)
+                    return &alias;
+            }
+            return nullptr;
+        }
+
+        const RegSlot* getRegSlot(StackSlot* slot) const
+        {
+            for (const RegSlot& alias : regSlot) {
+                if (alias.slot == slot)
+                    return &alias;
+            }
+            return nullptr;
+        }
+
+        const RegSlot* getRegSlot(Reg reg, StackSlot* slot) const
+        {
+            for (const RegSlot& alias : regSlot) {
+                if (alias.reg == reg && alias.slot == slot)
+                    return &alias;
+            }
+            return nullptr;
+        }
+
+        const SlotConst* getSlotConst(StackSlot* slot) const
+        {
+            for (const SlotConst& alias : slotConst) {
+                if (alias.slot == slot)
+                    return &alias;
+            }
+            return nullptr;
+        }
+
+        std::optional<int64_t> constantFor(const Arg& arg)
+        {
+            if (arg.isReg()) {
+                if (const RegConst* alias = getRegConst(arg.reg()))
+                    return alias->constant;
+                return std::nullopt;
+            }
+            if (arg.isStack()) {
+                if (const SlotConst* alias = getSlotConst(arg.stackSlot()))
+                    return alias->constant;
+                return std::nullopt;
+            }
+            return std::nullopt;
+        }
+
+        void clobber(const Arg& arg)
+        {
+            if (arg.isReg()) {
+                regConst.removeAllMatching(
+                    [&] (const RegConst& alias) -> bool {
+                        return alias.reg == arg.reg();
+                    });
+                regSlot.removeAllMatching(
+                    [&] (const RegSlot& alias) -> bool {
+                        return alias.reg == arg.reg();
+                    });
+                return;
+            }
+            if (arg.isStack()) {
+                slotConst.removeAllMatching(
+                    [&] (const SlotConst& alias) -> bool {
+                        return alias.slot == arg.stackSlot();
+                    });
+                regSlot.removeAllMatching(
+                    [&] (const RegSlot& alias) -> bool {
+                        return alias.slot == arg.stackSlot();
+                    });
+            }
+        }
+
+        bool merge(const State& other)
+        {
+            bool changed = false;
+            
+            changed |= !!regConst.removeAllMatching(
+                [&] (RegConst& alias) -> bool {
+                    const RegConst* otherAlias = other.getRegConst(alias.reg);
+                    if (!otherAlias)
+                        return true;
+                    if (alias.constant != otherAlias->constant)
+                        return true;
+                    return false;
+                });
+
+            changed |= !!slotConst.removeAllMatching(
+                [&] (SlotConst& alias) -> bool {
+                    const SlotConst* otherAlias = other.getSlotConst(alias.slot);
+                    if (!otherAlias)
+                        return true;
+                    if (alias.constant != otherAlias->constant)
+                        return true;
+                    return false;
+                });
+
+            changed |= !!regSlot.removeAllMatching(
+                [&] (RegSlot& alias) -> bool {
+                    const RegSlot* otherAlias = other.getRegSlot(alias.reg, alias.slot);
+                    if (!otherAlias)
+                        return true;
+                    if (alias.mode != RegSlot::Match32 && alias.mode != otherAlias->mode) {
+                        alias.mode = RegSlot::Match32;
+                        changed = true;
+                    }
+                    return false;
+                });
+
+            return changed;
+        }
+
+        void dump(PrintStream& out) const
+        {
+            out.print(
+                "{regConst = [", listDump(regConst), "], slotConst = [", listDump(slotConst),
+                "], regSlot = [", listDump(regSlot), "], wasVisited = ", wasVisited, "}");
+        }
+
+        Vector<RegConst> regConst;
+        Vector<SlotConst> slotConst;
+        Vector<RegSlot> regSlot;
+        bool wasVisited { false };
+    };
+
+    Code& m_code;
+    IndexMap<BasicBlock, State> m_atHead;
+    State m_state;
+    BasicBlock* m_block { nullptr };
+    unsigned m_instIndex { 0 };
+};
+
+} // anonymous namespace
+
+void fixObviousSpills(Code& code)
+{
+    PhaseScope phaseScope(code, "fixObviousSpills");
+
+    FixObviousSpills fixObviousSpills(code);
+    fixObviousSpills.run();
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirFixObviousSpills.h b/b3/air/AirFixObviousSpills.h
new file mode 100644
index 0000000..fb8e41f
--- /dev/null
+++ b/b3/air/AirFixObviousSpills.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This is a forward flow phase that tracks equivalence between spills slots and registers. It
+// removes loads from spill slots in cases when the contents of the spill slot can be found in (or
+// computed from) a register.
+void fixObviousSpills(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirFixPartialRegisterStalls.cpp b/b3/air/AirFixPartialRegisterStalls.cpp
new file mode 100644
index 0000000..b3d5d0b
--- /dev/null
+++ b/b3/air/AirFixPartialRegisterStalls.cpp
@@ -0,0 +1,239 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AirFixPartialRegisterStalls.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirBasicBlock.h"
+#include "AirCode.h"
+#include "AirInsertionSet.h"
+#include "AirInst.h"
+#include "AirInstInlines.h"
+#include "AirPhaseScope.h"
+#include "MacroAssembler.h"
+#include <wtf/IndexMap.h>
+#include <wtf/IndexSet.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+bool hasPartialXmmRegUpdate(const Inst& inst)
+{
+    switch (inst.kind.opcode) {
+    case ConvertDoubleToFloat:
+    case ConvertFloatToDouble:
+    case ConvertInt32ToDouble:
+    case ConvertInt64ToDouble:
+    case ConvertInt32ToFloat:
+    case ConvertInt64ToFloat:
+    case SqrtDouble:
+    case SqrtFloat:
+    case CeilDouble:
+    case CeilFloat:
+    case FloorDouble:
+    case FloorFloat:
+        return true;
+    default:
+        break;
+    }
+    return false;
+}
+
+bool isDependencyBreaking(const Inst& inst)
+{
+    // "xorps reg, reg" is used by the frontend to remove the dependency on its argument.
+    return inst.kind.opcode == MoveZeroToDouble;
+}
+
+// FIXME: find a good distance per architecture experimentally.
+// LLVM uses a distance of 16 but that comes from Nehalem.
+unsigned char minimumSafeDistance = 16;
+
+struct FPDefDistance {
+    FPDefDistance()
+    {
+        for (unsigned i = 0; i < MacroAssembler::numberOfFPRegisters(); ++i)
+            distance[i] = 255;
+    }
+
+    void reset(FPRReg reg)
+    {
+        unsigned index = MacroAssembler::fpRegisterIndex(reg);
+        distance[index] = 255;
+    }
+
+    void add(FPRReg reg, unsigned registerDistance)
+    {
+        unsigned index = MacroAssembler::fpRegisterIndex(reg);
+        if (registerDistance < distance[index])
+            distance[index] = static_cast<unsigned char>(registerDistance);
+    }
+
+    bool updateFromPrecessor(FPDefDistance& precessorDistance, unsigned constantOffset = 0)
+    {
+        bool changed = false;
+        for (unsigned i = 0; i < MacroAssembler::numberOfFPRegisters(); ++i) {
+            unsigned regDistance = precessorDistance.distance[i] + constantOffset;
+            if (regDistance < minimumSafeDistance && regDistance < distance[i]) {
+                distance[i] = regDistance;
+                changed = true;
+            }
+        }
+        return changed;
+    }
+
+    unsigned char distance[MacroAssembler::numberOfFPRegisters()];
+};
+
+void updateDistances(Inst& inst, FPDefDistance& localDistance, unsigned& distanceToBlockEnd)
+{
+    --distanceToBlockEnd;
+
+    if (isDependencyBreaking(inst)) {
+        localDistance.reset(inst.args[0].tmp().fpr());
+        return;
+    }
+
+    inst.forEachTmp([&] (Tmp& tmp, Arg::Role role, Arg::Type, Arg::Width) {
+        ASSERT_WITH_MESSAGE(tmp.isReg(), "This phase must be run after register allocation.");
+
+        if (tmp.isFPR() && Arg::isAnyDef(role))
+            localDistance.add(tmp.fpr(), distanceToBlockEnd);
+    });
+}
+
+}
+
+void fixPartialRegisterStalls(Code& code)
+{
+    if (!isX86())
+        return;
+
+    PhaseScope phaseScope(code, "fixPartialRegisterStalls");
+
+    Vector<BasicBlock*> candidates;
+
+    for (BasicBlock* block : code) {
+        for (const Inst& inst : *block) {
+            if (hasPartialXmmRegUpdate(inst)) {
+                candidates.append(block);
+                break;
+            }
+        }
+    }
+
+    // Fortunately, Partial Stalls are rarely used. Return early if no block
+    // cares about them.
+    if (candidates.isEmpty())
+        return;
+
+    // For each block, this provides the distance to the last instruction setting each register
+    // on block *entry*.
+    IndexMap<BasicBlock, FPDefDistance> lastDefDistance(code.size());
+
+    // Blocks with dirty distance at head.
+    IndexSet<BasicBlock> dirty;
+
+    // First, we compute the local distance for each block and push it to the successors.
+    for (BasicBlock* block : code) {
+        FPDefDistance localDistance;
+
+        unsigned distanceToBlockEnd = block->size();
+        for (Inst& inst : *block)
+            updateDistances(inst, localDistance, distanceToBlockEnd);
+
+        for (BasicBlock* successor : block->successorBlocks()) {
+            if (lastDefDistance[successor].updateFromPrecessor(localDistance))
+                dirty.add(successor);
+        }
+    }
+
+    // Now we propagate the minimums accross blocks.
+    bool changed;
+    do {
+        changed = false;
+
+        for (BasicBlock* block : code) {
+            if (!dirty.remove(block))
+                continue;
+
+            // Little shortcut: if the block is big enough, propagating it won't add any information.
+            if (block->size() >= minimumSafeDistance)
+                continue;
+
+            unsigned blockSize = block->size();
+            FPDefDistance& blockDistance = lastDefDistance[block];
+            for (BasicBlock* successor : block->successorBlocks()) {
+                if (lastDefDistance[successor].updateFromPrecessor(blockDistance, blockSize)) {
+                    dirty.add(successor);
+                    changed = true;
+                }
+            }
+        }
+    } while (changed);
+
+    // Finally, update each block as needed.
+    InsertionSet insertionSet(code);
+    for (BasicBlock* block : candidates) {
+        unsigned distanceToBlockEnd = block->size();
+        FPDefDistance& localDistance = lastDefDistance[block];
+
+        for (unsigned i = 0; i < block->size(); ++i) {
+            Inst& inst = block->at(i);
+
+            if (hasPartialXmmRegUpdate(inst)) {
+                RegisterSet defs;
+                RegisterSet uses;
+                inst.forEachTmp([&] (Tmp& tmp, Arg::Role role, Arg::Type, Arg::Width) {
+                    if (tmp.isFPR()) {
+                        if (Arg::isAnyDef(role))
+                            defs.set(tmp.fpr());
+                        if (Arg::isAnyUse(role))
+                            uses.set(tmp.fpr());
+                    }
+                });
+                // We only care about values we define but not use. Otherwise we have to wait
+                // for the value to be resolved anyway.
+                defs.exclude(uses);
+
+                defs.forEach([&] (Reg reg) {
+                    if (localDistance.distance[MacroAssembler::fpRegisterIndex(reg.fpr())] < minimumSafeDistance)
+                        insertionSet.insert(i, MoveZeroToDouble, inst.origin, Tmp(reg));
+                });
+            }
+
+            updateDistances(inst, localDistance, distanceToBlockEnd);
+        }
+        insertionSet.execute(block);
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirFixPartialRegisterStalls.h b/b3/air/AirFixPartialRegisterStalls.h
new file mode 100644
index 0000000..0093279
--- /dev/null
+++ b/b3/air/AirFixPartialRegisterStalls.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// x86 has a pipelining hazard caused by false dependencies between instructions.
+//
+// Some instructions update only part of a register, they can only be scheduled after
+// the previous definition is computed. This problem can be avoided by the compiler
+// by explicitely resetting the entire register before executing the instruction with
+// partial update.
+//
+// See "Partial XMM Register Stalls" and "Dependency Breaking Idioms" in the manual.
+void fixPartialRegisterStalls(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirFrequentedBlock.h b/b3/air/AirFrequentedBlock.h
new file mode 100644
index 0000000..37cd287
--- /dev/null
+++ b/b3/air/AirFrequentedBlock.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3GenericFrequentedBlock.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+class BasicBlock;
+
+typedef GenericFrequentedBlock<BasicBlock> FrequentedBlock;
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirGenerate.cpp b/b3/air/AirGenerate.cpp
new file mode 100644
index 0000000..a99f050
--- /dev/null
+++ b/b3/air/AirGenerate.cpp
@@ -0,0 +1,292 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirGenerate.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirAllocateStack.h"
+#include "AirCode.h"
+#include "AirDumpAsJS.h"
+#include "AirEliminateDeadCode.h"
+#include "AirFixObviousSpills.h"
+#include "AirFixPartialRegisterStalls.h"
+#include "AirGenerationContext.h"
+#include "AirHandleCalleeSaves.h"
+#include "AirIteratedRegisterCoalescing.h"
+#include "AirLogRegisterPressure.h"
+#include "AirLowerAfterRegAlloc.h"
+#include "AirLowerEntrySwitch.h"
+#include "AirLowerMacros.h"
+#include "AirOpcodeUtils.h"
+#include "AirOptimizeBlockOrder.h"
+#include "AirReportUsedRegisters.h"
+#include "AirSimplifyCFG.h"
+#include "AirSpillEverything.h"
+#include "AirValidate.h"
+#include "B3Common.h"
+#include "B3Procedure.h"
+#include "B3TimingScope.h"
+#include "B3ValueInlines.h"
+#include "CCallHelpers.h"
+#include "DisallowMacroScratchRegisterUsage.h"
+#include "LinkBuffer.h"
+#include <wtf/IndexMap.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+void prepareForGeneration(Code& code)
+{
+    TimingScope timingScope("Air::prepareForGeneration");
+    
+    // We don't expect the incoming code to have predecessors computed.
+    code.resetReachability();
+    
+    if (shouldValidateIR())
+        validate(code);
+
+    // If we're doing super verbose dumping, the phase scope of any phase will already do a dump.
+    if (shouldDumpIR(AirMode) && !shouldDumpIRAtEachPhase(AirMode)) {
+        dataLog("Initial air:\n");
+        dataLog(code);
+    }
+
+    lowerMacros(code);
+
+    // This is where we run our optimizations and transformations.
+    // FIXME: Add Air optimizations.
+    // https://bugs.webkit.org/show_bug.cgi?id=150456
+    
+    eliminateDeadCode(code);
+
+    // Register allocation for all the Tmps that do not have a corresponding machine register.
+    // After this phase, every Tmp has a reg.
+    //
+    // For debugging, you can use spillEverything() to put everything to the stack between each Inst.
+    if (Options::airSpillsEverything())
+        spillEverything(code);
+    else
+        iteratedRegisterCoalescing(code);
+
+    if (Options::logAirRegisterPressure()) {
+        dataLog("Register pressure after register allocation:\n");
+        logRegisterPressure(code);
+    }
+
+    // This replaces uses of spill slots with registers or constants if possible. It does this by
+    // minimizing the amount that we perturb the already-chosen register allocation. It may extend
+    // the live ranges of registers though.
+    fixObviousSpills(code);
+
+    lowerAfterRegAlloc(code);
+
+    // Prior to this point the prologue and epilogue is implicit. This makes it explicit. It also
+    // does things like identify which callee-saves we're using and saves them.
+    handleCalleeSaves(code);
+    
+    if (Options::dumpAirAsJSBeforeAllocateStack()) {
+        dataLog("Dumping Air as JS before allocateStack:\n");
+        dumpAsJS(code, WTF::dataFile());
+        dataLog("Air hash: ", code.jsHash(), "\n");
+    }
+
+    // This turns all Stack and CallArg Args into Addr args that use the frame pointer. It does
+    // this by first-fit allocating stack slots. It should be pretty darn close to optimal, so we
+    // shouldn't have to worry about this very much.
+    allocateStack(code);
+    
+    if (Options::dumpAirAfterAllocateStack()) {
+        dataLog("Dumping Air after allocateStack:\n");
+        dataLog(code);
+        dataLog("Air hash: ", code.jsHash(), "\n");
+    }
+
+    // If we coalesced moves then we can unbreak critical edges. This is the main reason for this
+    // phase.
+    simplifyCFG(code);
+
+    // This is needed to satisfy a requirement of B3::StackmapValue.
+    reportUsedRegisters(code);
+
+    // Attempt to remove false dependencies between instructions created by partial register changes.
+    // This must be executed as late as possible as it depends on the instructions order and register
+    // use. We _must_ run this after reportUsedRegisters(), since that kills variable assignments
+    // that seem dead. Luckily, this phase does not change register liveness, so that's OK.
+    fixPartialRegisterStalls(code);
+    
+    // Actually create entrypoints.
+    lowerEntrySwitch(code);
+    
+    // The control flow graph can be simplified further after we have lowered EntrySwitch.
+    simplifyCFG(code);
+
+    // This sorts the basic blocks in Code to achieve an ordering that maximizes the likelihood that a high
+    // frequency successor is also the fall-through target.
+    optimizeBlockOrder(code);
+
+    if (shouldValidateIR())
+        validate(code);
+
+    // Do a final dump of Air. Note that we have to do this even if we are doing per-phase dumping,
+    // since the final generation is not a phase.
+    if (shouldDumpIR(AirMode)) {
+        dataLog("Air after ", code.lastPhaseName(), ", before generation:\n");
+        dataLog(code);
+    }
+}
+
+void generate(Code& code, CCallHelpers& jit)
+{
+    TimingScope timingScope("Air::generate");
+
+    DisallowMacroScratchRegisterUsage disallowScratch(jit);
+
+    auto argFor = [&] (const RegisterAtOffset& entry) -> CCallHelpers::Address {
+        return CCallHelpers::Address(GPRInfo::callFrameRegister, entry.offset());
+    };
+    
+    // And now, we generate code.
+    GenerationContext context;
+    context.code = &code;
+    context.blockLabels.resize(code.size());
+    for (BasicBlock* block : code) {
+        if (block)
+            context.blockLabels[block] = Box<CCallHelpers::Label>::create();
+    }
+    IndexMap<BasicBlock, CCallHelpers::JumpList> blockJumps(code.size());
+
+    auto link = [&] (CCallHelpers::Jump jump, BasicBlock* target) {
+        if (context.blockLabels[target]->isSet()) {
+            jump.linkTo(*context.blockLabels[target], &jit);
+            return;
+        }
+
+        blockJumps[target].append(jump);
+    };
+
+    PCToOriginMap& pcToOriginMap = code.proc().pcToOriginMap();
+    auto addItem = [&] (Inst& inst) {
+        if (!inst.origin) {
+            pcToOriginMap.appendItem(jit.labelIgnoringWatchpoints(), Origin());
+            return;
+        }
+        pcToOriginMap.appendItem(jit.labelIgnoringWatchpoints(), inst.origin->origin());
+    };
+
+    for (BasicBlock* block : code) {
+        context.currentBlock = block;
+        context.indexInBlock = UINT_MAX;
+        blockJumps[block].link(&jit);
+        CCallHelpers::Label label = jit.label();
+        *context.blockLabels[block] = label;
+
+        if (code.isEntrypoint(block)) {
+            jit.emitFunctionPrologue();
+            if (code.frameSize())
+                jit.addPtr(CCallHelpers::TrustedImm32(-code.frameSize()), MacroAssembler::stackPointerRegister);
+            
+            for (const RegisterAtOffset& entry : code.calleeSaveRegisters()) {
+                if (entry.reg().isGPR())
+                    jit.storePtr(entry.reg().gpr(), argFor(entry));
+                else
+                    jit.storeDouble(entry.reg().fpr(), argFor(entry));
+            }
+        }
+        
+        ASSERT(block->size() >= 1);
+        for (unsigned i = 0; i < block->size() - 1; ++i) {
+            context.indexInBlock = i;
+            Inst& inst = block->at(i);
+            addItem(inst);
+            CCallHelpers::Jump jump = inst.generate(jit, context);
+            ASSERT_UNUSED(jump, !jump.isSet());
+        }
+
+        context.indexInBlock = block->size() - 1;
+        
+        if (block->last().kind.opcode == Jump
+            && block->successorBlock(0) == code.findNextBlock(block))
+            continue;
+
+        addItem(block->last());
+
+        if (isReturn(block->last().kind.opcode)) {
+            // We currently don't represent the full prologue/epilogue in Air, so we need to
+            // have this override.
+            if (code.frameSize()) {
+                for (const RegisterAtOffset& entry : code.calleeSaveRegisters()) {
+                    if (entry.reg().isGPR())
+                        jit.loadPtr(argFor(entry), entry.reg().gpr());
+                    else
+                        jit.loadDouble(argFor(entry), entry.reg().fpr());
+                }
+                jit.emitFunctionEpilogue();
+            } else
+                jit.emitFunctionEpilogueWithEmptyFrame();
+            jit.ret();
+            addItem(block->last());
+            continue;
+        }
+
+        CCallHelpers::Jump jump = block->last().generate(jit, context);
+        // The jump won't be set for patchpoints. It won't be set for Oops because then it won't have
+        // any successors.
+        if (jump.isSet()) {
+            switch (block->numSuccessors()) {
+            case 1:
+                link(jump, block->successorBlock(0));
+                break;
+            case 2:
+                link(jump, block->successorBlock(0));
+                if (block->successorBlock(1) != code.findNextBlock(block))
+                    link(jit.jump(), block->successorBlock(1));
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+        }
+        addItem(block->last());
+    }
+    
+    context.currentBlock = nullptr;
+    context.indexInBlock = UINT_MAX;
+    
+    Vector<CCallHelpers::Label> entrypointLabels(code.numEntrypoints());
+    for (unsigned i = code.numEntrypoints(); i--;)
+        entrypointLabels[i] = *context.blockLabels[code.entrypoint(i).block()];
+    code.setEntrypointLabels(WTFMove(entrypointLabels));
+
+    pcToOriginMap.appendItem(jit.label(), Origin());
+    // FIXME: Make late paths have Origins: https://bugs.webkit.org/show_bug.cgi?id=153689
+    for (auto& latePath : context.latePaths)
+        latePath->run(jit, context);
+    pcToOriginMap.appendItem(jit.label(), Origin());
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirGenerate.h b/b3/air/AirGenerate.h
new file mode 100644
index 0000000..60839be
--- /dev/null
+++ b/b3/air/AirGenerate.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC {
+
+class CCallHelpers;
+
+namespace B3 { namespace Air {
+
+class Code;
+
+// This takes an Air::Code that hasn't had any stack allocation and optionally hasn't had any
+// register allocation and does both of those things.
+JS_EXPORT_PRIVATE void prepareForGeneration(Code&);
+
+// This generates the code using the given CCallHelpers instance. Note that this may call callbacks
+// in the supplied code as it is generating.
+JS_EXPORT_PRIVATE void generate(Code&, CCallHelpers&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirGenerated.cpp b/b3/air/AirGenerated.cpp
new file mode 100644
index 0000000..6dd2304
--- /dev/null
+++ b/b3/air/AirGenerated.cpp
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(B3_JIT)
+
+// This is generated by opcode_generator.rb.
+#include "AirOpcodeGenerated.h"
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirGenerationContext.h b/b3/air/AirGenerationContext.h
new file mode 100644
index 0000000..17e1126
--- /dev/null
+++ b/b3/air/AirGenerationContext.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirBasicBlock.h"
+#include "CCallHelpers.h"
+#include <wtf/Box.h>
+#include <wtf/IndexMap.h>
+#include <wtf/SharedTask.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+struct GenerationContext {
+    typedef void LatePathFunction(CCallHelpers&, GenerationContext&);
+    typedef SharedTask<LatePathFunction> LatePath;
+
+    Vector<RefPtr<LatePath>> latePaths;
+    IndexMap<BasicBlock, Box<CCallHelpers::Label>> blockLabels;
+    BasicBlock* currentBlock { nullptr };
+    unsigned indexInBlock { UINT_MAX };
+    Code* code { nullptr };
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirHandleCalleeSaves.cpp b/b3/air/AirHandleCalleeSaves.cpp
new file mode 100644
index 0000000..97cdfa1
--- /dev/null
+++ b/b3/air/AirHandleCalleeSaves.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirHandleCalleeSaves.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirPhaseScope.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+void handleCalleeSaves(Code& code)
+{
+    PhaseScope phaseScope(code, "handleCalleeSaves");
+
+    RegisterSet usedCalleeSaves;
+
+    for (BasicBlock* block : code) {
+        for (Inst& inst : *block) {
+            inst.forEachTmpFast(
+                [&] (Tmp& tmp) {
+                    // At first we just record all used regs.
+                    usedCalleeSaves.set(tmp.reg());
+                });
+
+            if (inst.kind.opcode == Patch)
+                usedCalleeSaves.merge(inst.extraClobberedRegs());
+        }
+    }
+
+    // Now we filter to really get the callee saves.
+    usedCalleeSaves.filter(RegisterSet::calleeSaveRegisters());
+    usedCalleeSaves.filter(code.mutableRegs());
+    usedCalleeSaves.exclude(RegisterSet::stackRegisters()); // We don't need to save FP here.
+
+    if (!usedCalleeSaves.numberOfSetRegisters())
+        return;
+
+    code.calleeSaveRegisters() = RegisterAtOffsetList(usedCalleeSaves);
+
+    size_t byteSize = 0;
+    for (const RegisterAtOffset& entry : code.calleeSaveRegisters())
+        byteSize = std::max(static_cast<size_t>(-entry.offset()), byteSize);
+
+    StackSlot* savesArea = code.addStackSlot(byteSize, StackSlotKind::Locked);
+    // This is a bit weird since we could have already pinned a different stack slot to this
+    // area. Also, our runtime does not require us to pin the saves area. Maybe we shouldn't pin it?
+    savesArea->setOffsetFromFP(-byteSize);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirHandleCalleeSaves.h b/b3/air/AirHandleCalleeSaves.h
new file mode 100644
index 0000000..b4b78a3
--- /dev/null
+++ b/b3/air/AirHandleCalleeSaves.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This phase identifies callee-save registers and adds code to save/restore them in the
+// prologue/epilogue to the code. It's a mandatory phase.
+
+// FIXME: It would be cool to make this more interactive with the Air client and also more
+// powerful.
+// We should have shrink wrapping: https://bugs.webkit.org/show_bug.cgi?id=150458
+// We should make this interact with the client: https://bugs.webkit.org/show_bug.cgi?id=150459
+
+void handleCalleeSaves(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirInsertionSet.cpp b/b3/air/AirInsertionSet.cpp
new file mode 100644
index 0000000..452d488
--- /dev/null
+++ b/b3/air/AirInsertionSet.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirInsertionSet.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirBasicBlock.h"
+#include <wtf/BubbleSort.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+void InsertionSet::insertInsts(size_t index, Vector<Inst>&& insts)
+{
+    for (Inst& inst : insts)
+        insertInst(index, WTFMove(inst));
+}
+
+void InsertionSet::execute(BasicBlock* block)
+{
+    bubbleSort(m_insertions.begin(), m_insertions.end());
+    executeInsertions(block->m_insts, m_insertions);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirInsertionSet.h b/b3/air/AirInsertionSet.h
new file mode 100644
index 0000000..84a791d
--- /dev/null
+++ b/b3/air/AirInsertionSet.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirInst.h"
+#include <wtf/Insertion.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class BasicBlock;
+class Code;
+
+typedef WTF::Insertion<Inst> Insertion;
+
+class InsertionSet {
+public:
+    InsertionSet(Code& code)
+        : m_code(code)
+    {
+    }
+
+    Code& code() { return m_code; }
+
+    template<typename T>
+    void appendInsertion(T&& insertion)
+    {
+        m_insertions.append(std::forward<T>(insertion));
+    }
+
+    template<typename Inst>
+    void insertInst(size_t index, Inst&& inst)
+    {
+        appendInsertion(Insertion(index, std::forward<Inst>(inst)));
+    }
+
+    template <typename InstVector>
+    void insertInsts(size_t index, const InstVector& insts)
+    {
+        for (const Inst& inst : insts)
+            insertInst(index, inst);
+    }
+    void insertInsts(size_t index, Vector<Inst>&&);
+    
+    template<typename... Arguments>
+    void insert(size_t index, Arguments&&... arguments)
+    {
+        insertInst(index, Inst(std::forward<Arguments>(arguments)...));
+    }
+
+    void execute(BasicBlock*);
+
+private:
+    Code& m_code;
+    Vector<Insertion, 8> m_insertions;
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirInst.cpp b/b3/air/AirInst.cpp
new file mode 100644
index 0000000..defb344
--- /dev/null
+++ b/b3/air/AirInst.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirInst.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirInstInlines.h"
+#include "B3Value.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+bool Inst::hasArgEffects()
+{
+    bool result = false;
+    forEachArg(
+        [&] (Arg&, Arg::Role role, Arg::Type, Arg::Width) {
+            if (Arg::isAnyDef(role))
+                result = true;
+        });
+    return result;
+}
+
+unsigned Inst::jsHash() const
+{
+    // FIXME: This should do something for flags.
+    // https://bugs.webkit.org/show_bug.cgi?id=162751
+    unsigned result = static_cast<unsigned>(kind.opcode);
+    
+    for (const Arg& arg : args)
+        result += arg.jsHash();
+    
+    return result;
+}
+
+void Inst::dump(PrintStream& out) const
+{
+    out.print(kind, " ", listDump(args));
+    if (origin) {
+        if (args.size())
+            out.print(", ");
+        out.print(*origin);
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirInst.h b/b3/air/AirInst.h
new file mode 100644
index 0000000..f38c21d
--- /dev/null
+++ b/b3/air/AirInst.h
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "AirKind.h"
+#include "CCallHelpers.h"
+
+namespace JSC {
+
+class CCallHelpers;
+class RegisterSet;
+
+namespace B3 {
+
+class Value;
+
+namespace Air {
+
+struct GenerationContext;
+
+struct Inst {
+public:
+    typedef Vector<Arg, 3> ArgList;
+
+    Inst()
+        : origin(nullptr)
+    {
+    }
+    
+    Inst(Kind kind, Value* origin)
+        : origin(origin)
+        , kind(kind)
+    {
+    }
+    
+    template<typename... Arguments>
+    Inst(Kind kind, Value* origin, Arg arg, Arguments... arguments)
+        : args{ arg, arguments... }
+        , origin(origin)
+        , kind(kind)
+    {
+    }
+
+    Inst(Kind kind, Value* origin, const ArgList& arguments)
+        : args(arguments)
+        , origin(origin)
+        , kind(kind)
+    {
+    }
+
+    Inst(Kind kind, Value* origin, ArgList&& arguments)
+        : args(WTFMove(arguments))
+        , origin(origin)
+        , kind(kind)
+    {
+    }
+
+    explicit operator bool() const { return origin || kind || args.size(); }
+
+    void append() { }
+    
+    template<typename... Arguments>
+    void append(Arg arg, Arguments... arguments)
+    {
+        args.append(arg);
+        append(arguments...);
+    }
+
+    // Note that these functors all avoid using "const" because we want to use them for things that
+    // edit IR. IR is meant to be edited; if you're carrying around a "const Inst&" then you're
+    // probably doing it wrong.
+
+    // This only walks those Tmps that are explicitly mentioned, and it doesn't tell you their role
+    // or type.
+    template<typename Functor>
+    void forEachTmpFast(const Functor& functor)
+    {
+        for (Arg& arg : args)
+            arg.forEachTmpFast(functor);
+    }
+
+    typedef void EachArgCallback(Arg&, Arg::Role, Arg::Type, Arg::Width);
+    
+    // Calls the functor with (arg, role, type, width). This function is auto-generated by
+    // opcode_generator.rb.
+    template<typename Functor>
+    void forEachArg(const Functor&);
+
+    // Calls the functor with (tmp, role, type, width).
+    template<typename Functor>
+    void forEachTmp(const Functor& functor)
+    {
+        forEachArg(
+            [&] (Arg& arg, Arg::Role role, Arg::Type type, Arg::Width width) {
+                arg.forEachTmp(role, type, width, functor);
+            });
+    }
+
+    // Thing can be either Arg, Tmp, or StackSlot*.
+    template<typename Thing, typename Functor>
+    void forEach(const Functor&);
+
+    // Reports any additional registers clobbered by this operation. Note that for efficiency,
+    // extraClobberedRegs() only works for the Patch opcode.
+    RegisterSet extraClobberedRegs();
+    RegisterSet extraEarlyClobberedRegs();
+
+    // Iterate over all Def's that happen at the end of an instruction. You supply a pair
+    // instructions. The instructions must appear next to each other, in that order, in some basic
+    // block. You can pass null for the first instruction when analyzing what happens at the top of
+    // a basic block. You can pass null for the second instruction when analyzing what happens at the
+    // bottom of a basic block.
+    template<typename Thing, typename Functor>
+    static void forEachDef(Inst* prevInst, Inst* nextInst, const Functor&);
+
+    // Iterate over all Def's that happen at the end of this instruction, including extra clobbered
+    // registers. Note that Thing can only be Arg or Tmp when you use this functor.
+    template<typename Thing, typename Functor>
+    static void forEachDefWithExtraClobberedRegs(Inst* prevInst, Inst* nextInst, const Functor&);
+
+    // Use this to report which registers are live. This should be done just before codegen. Note
+    // that for efficiency, reportUsedRegisters() only works for the Patch opcode.
+    void reportUsedRegisters(const RegisterSet&);
+
+    // Is this instruction in one of the valid forms right now? This function is auto-generated by
+    // opcode_generator.rb.
+    bool isValidForm();
+
+    // Assuming this instruction is in a valid form right now, will it still be in one of the valid
+    // forms if we put an Addr referencing the stack (or a StackSlot or CallArg, of course) in the
+    // given index? Spilling uses this: it walks the args by index to find Tmps that need spilling;
+    // if it finds one, it calls this to see if it can replace the Arg::Tmp with an Arg::Addr. If it
+    // finds a non-Tmp Arg, then it calls that Arg's forEachTmp to do a replacement that way.
+    //
+    // This function is auto-generated by opcode_generator.rb.
+    bool admitsStack(unsigned argIndex);
+    bool admitsStack(Arg&);
+    
+    // Defined by opcode_generator.rb.
+    bool isTerminal();
+
+    // Returns true if this instruction can have any effects other than control flow or arguments.
+    bool hasNonArgNonControlEffects();
+
+    // Returns true if this instruction can have any effects other than what is implied by arguments.
+    // For example, "Move $42, (%rax)" will return false because the effect of storing to (%rax) is
+    // implied by the second argument.
+    bool hasNonArgEffects();
+
+    // Tells you if this operation has arg effects.
+    bool hasArgEffects();
+    
+    // Tells you if this operation has non-control effects.
+    bool hasNonControlEffects() { return hasNonArgNonControlEffects() || hasArgEffects(); }
+
+    // Generate some code for this instruction. This is, like, literally our backend. If this is the
+    // terminal, it returns the jump that needs to be linked for the "then" case, with the "else"
+    // case being fall-through. This function is auto-generated by opcode_generator.rb.
+    CCallHelpers::Jump generate(CCallHelpers&, GenerationContext&);
+
+    // If source arguments benefits from being aliased to a destination argument,
+    // this return the index of the destination argument.
+    // The source are assumed to be at (index - 1) and (index - 2)
+    // For example,
+    //     Add Tmp1, Tmp2, Tmp3
+    // returns 2 if 0 and 1 benefit from aliasing to Tmp3.
+    std::optional<unsigned> shouldTryAliasingDef();
+    
+    // This computes a hash for comparing this to JSAir's Inst.
+    unsigned jsHash() const;
+
+    void dump(PrintStream&) const;
+
+    ArgList args;
+    Value* origin; // The B3::Value that this originated from.
+    Kind kind;
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirInstInlines.h b/b3/air/AirInstInlines.h
new file mode 100644
index 0000000..b753921
--- /dev/null
+++ b/b3/air/AirInstInlines.h
@@ -0,0 +1,280 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirInst.h"
+#include "AirOpcodeUtils.h"
+#include "AirSpecial.h"
+#include "AirStackSlot.h"
+#include "B3Value.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+template<typename Thing, typename Functor>
+void Inst::forEach(const Functor& functor)
+{
+    forEachArg(
+        [&] (Arg& arg, Arg::Role role, Arg::Type type, Arg::Width width) {
+            arg.forEach<Thing>(role, type, width, functor);
+        });
+}
+
+inline RegisterSet Inst::extraClobberedRegs()
+{
+    ASSERT(kind.opcode == Patch);
+    return args[0].special()->extraClobberedRegs(*this);
+}
+
+inline RegisterSet Inst::extraEarlyClobberedRegs()
+{
+    ASSERT(kind.opcode == Patch);
+    return args[0].special()->extraEarlyClobberedRegs(*this);
+}
+
+template<typename Thing, typename Functor>
+inline void Inst::forEachDef(Inst* prevInst, Inst* nextInst, const Functor& functor)
+{
+    if (prevInst) {
+        prevInst->forEach<Thing>(
+            [&] (Thing& thing, Arg::Role role, Arg::Type argType, Arg::Width argWidth) {
+                if (Arg::isLateDef(role))
+                    functor(thing, role, argType, argWidth);
+            });
+    }
+
+    if (nextInst) {
+        nextInst->forEach<Thing>(
+            [&] (Thing& thing, Arg::Role role, Arg::Type argType, Arg::Width argWidth) {
+                if (Arg::isEarlyDef(role))
+                    functor(thing, role, argType, argWidth);
+            });
+    }
+}
+
+template<typename Thing, typename Functor>
+inline void Inst::forEachDefWithExtraClobberedRegs(
+    Inst* prevInst, Inst* nextInst, const Functor& functor)
+{
+    forEachDef<Thing>(prevInst, nextInst, functor);
+
+    Arg::Role regDefRole;
+    
+    auto reportReg = [&] (Reg reg) {
+        Arg::Type type = reg.isGPR() ? Arg::GP : Arg::FP;
+        functor(Thing(reg), regDefRole, type, Arg::conservativeWidth(type));
+    };
+
+    if (prevInst && prevInst->kind.opcode == Patch) {
+        regDefRole = Arg::Def;
+        prevInst->extraClobberedRegs().forEach(reportReg);
+    }
+
+    if (nextInst && nextInst->kind.opcode == Patch) {
+        regDefRole = Arg::EarlyDef;
+        nextInst->extraEarlyClobberedRegs().forEach(reportReg);
+    }
+}
+
+inline void Inst::reportUsedRegisters(const RegisterSet& usedRegisters)
+{
+    ASSERT(kind.opcode == Patch);
+    args[0].special()->reportUsedRegisters(*this, usedRegisters);
+}
+
+inline bool Inst::admitsStack(Arg& arg)
+{
+    return admitsStack(&arg - &args[0]);
+}
+
+inline std::optional<unsigned> Inst::shouldTryAliasingDef()
+{
+    if (!isX86())
+        return std::nullopt;
+
+    switch (kind.opcode) {
+    case Add32:
+    case Add64:
+    case And32:
+    case And64:
+    case Mul32:
+    case Mul64:
+    case Or32:
+    case Or64:
+    case Xor32:
+    case Xor64:
+    case AndFloat:
+    case AndDouble:
+    case XorDouble:
+    case XorFloat:
+        if (args.size() == 3)
+            return 2;
+        break;
+    case AddDouble:
+    case AddFloat:
+    case MulDouble:
+    case MulFloat:
+#if CPU(X86) || CPU(X86_64)
+        if (MacroAssembler::supportsAVX())
+            return std::nullopt;
+#endif
+        if (args.size() == 3)
+            return 2;
+        break;
+    case BranchAdd32:
+    case BranchAdd64:
+        if (args.size() == 4)
+            return 3;
+        break;
+    case MoveConditionally32:
+    case MoveConditionally64:
+    case MoveConditionallyTest32:
+    case MoveConditionallyTest64:
+    case MoveConditionallyDouble:
+    case MoveConditionallyFloat:
+    case MoveDoubleConditionally32:
+    case MoveDoubleConditionally64:
+    case MoveDoubleConditionallyTest32:
+    case MoveDoubleConditionallyTest64:
+    case MoveDoubleConditionallyDouble:
+    case MoveDoubleConditionallyFloat:
+        if (args.size() == 6)
+            return 5;
+        break;
+        break;
+    case Patch:
+        return PatchCustom::shouldTryAliasingDef(*this);
+    default:
+        break;
+    }
+    return std::nullopt;
+}
+
+inline bool isShiftValid(const Inst& inst)
+{
+#if CPU(X86) || CPU(X86_64)
+    return inst.args[0] == Tmp(X86Registers::ecx);
+#else
+    UNUSED_PARAM(inst);
+    return true;
+#endif
+}
+
+inline bool isLshift32Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isLshift64Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isRshift32Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isRshift64Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isUrshift32Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isUrshift64Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isRotateRight32Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isRotateLeft32Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isRotateRight64Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isRotateLeft64Valid(const Inst& inst)
+{
+    return isShiftValid(inst);
+}
+
+inline bool isX86DivHelperValid(const Inst& inst)
+{
+#if CPU(X86) || CPU(X86_64)
+    return inst.args[0] == Tmp(X86Registers::eax)
+        && inst.args[1] == Tmp(X86Registers::edx);
+#else
+    UNUSED_PARAM(inst);
+    return false;
+#endif
+}
+
+inline bool isX86ConvertToDoubleWord32Valid(const Inst& inst)
+{
+    return isX86DivHelperValid(inst);
+}
+
+inline bool isX86ConvertToQuadWord64Valid(const Inst& inst)
+{
+    return isX86DivHelperValid(inst);
+}
+
+inline bool isX86Div32Valid(const Inst& inst)
+{
+    return isX86DivHelperValid(inst);
+}
+
+inline bool isX86UDiv32Valid(const Inst& inst)
+{
+    return isX86DivHelperValid(inst);
+}
+
+inline bool isX86Div64Valid(const Inst& inst)
+{
+    return isX86DivHelperValid(inst);
+}
+
+inline bool isX86UDiv64Valid(const Inst& inst)
+{
+    return isX86DivHelperValid(inst);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirIteratedRegisterCoalescing.cpp b/b3/air/AirIteratedRegisterCoalescing.cpp
new file mode 100644
index 0000000..7e81b5e
--- /dev/null
+++ b/b3/air/AirIteratedRegisterCoalescing.cpp
@@ -0,0 +1,1656 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AirIteratedRegisterCoalescing.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInsertionSet.h"
+#include "AirInstInlines.h"
+#include "AirLiveness.h"
+#include "AirPadInterference.h"
+#include "AirPhaseScope.h"
+#include "AirTmpInlines.h"
+#include "AirTmpWidth.h"
+#include "AirUseCounts.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+bool debug = false;
+bool traceDebug = false;
+bool reportStats = false;
+
+// The AbstractColoringAllocator defines all the code that is independant
+// from the type or register and can be shared when allocating registers.
+template<typename IndexType>
+class AbstractColoringAllocator {
+public:
+    AbstractColoringAllocator(const Vector<Reg>& regsInPriorityOrder, IndexType lastPrecoloredRegisterIndex, unsigned tmpArraySize, const HashSet<unsigned>& unspillableTmp)
+        : m_regsInPriorityOrder(regsInPriorityOrder)
+        , m_lastPrecoloredRegisterIndex(lastPrecoloredRegisterIndex)
+        , m_unspillableTmps(unspillableTmp)
+    {
+        for (Reg reg : m_regsInPriorityOrder)
+            m_mutableRegs.set(reg);
+        
+        initializeDegrees(tmpArraySize);
+        
+        m_adjacencyList.resize(tmpArraySize);
+        m_moveList.resize(tmpArraySize);
+        m_coalescedTmps.fill(0, tmpArraySize);
+        m_isOnSelectStack.ensureSize(tmpArraySize);
+    }
+
+protected:
+    IndexType getAlias(IndexType tmpIndex) const
+    {
+        IndexType alias = tmpIndex;
+        while (IndexType nextAlias = m_coalescedTmps[alias])
+            alias = nextAlias;
+        return alias;
+    }
+
+    void addEdge(IndexType a, IndexType b)
+    {
+        if (a == b)
+            return;
+        addEdgeDistinct(a, b);
+    }
+
+    void makeWorkList()
+    {
+        IndexType firstNonRegIndex = m_lastPrecoloredRegisterIndex + 1;
+        for (IndexType i = firstNonRegIndex; i < m_degrees.size(); ++i) {
+            unsigned degree = m_degrees[i];
+            if (degree >= m_regsInPriorityOrder.size())
+                addToSpill(i);
+            else if (!m_moveList[i].isEmpty())
+                m_freezeWorklist.add(i);
+            else
+                m_simplifyWorklist.append(i);
+        }
+    }
+
+    void addToSpill(unsigned toSpill)
+    {
+        if (m_unspillableTmps.contains(toSpill))
+            return;
+
+        m_spillWorklist.add(toSpill);
+    }
+
+    // Low-degree vertex can always be colored: just pick any of the color taken by any
+    // other adjacent verices.
+    // The "Simplify" phase takes a low-degree out of the interference graph to simplify it.
+    void simplify()
+    {
+        IndexType lastIndex = m_simplifyWorklist.takeLast();
+
+        ASSERT(!m_selectStack.contains(lastIndex));
+        ASSERT(!m_isOnSelectStack.get(lastIndex));
+        m_selectStack.append(lastIndex);
+        m_isOnSelectStack.quickSet(lastIndex);
+
+        forEachAdjacent(lastIndex, [this](IndexType adjacentTmpIndex) {
+            decrementDegree(adjacentTmpIndex);
+        });
+    }
+
+    void freeze()
+    {
+        IndexType victimIndex = m_freezeWorklist.takeAny();
+        ASSERT_WITH_MESSAGE(getAlias(victimIndex) == victimIndex, "coalesce() should not leave aliased Tmp in the worklist.");
+        m_simplifyWorklist.append(victimIndex);
+        freezeMoves(victimIndex);
+    }
+
+    void freezeMoves(IndexType tmpIndex)
+    {
+        forEachNodeMoves(tmpIndex, [this, tmpIndex] (IndexType moveIndex) {
+            if (!m_activeMoves.quickClear(moveIndex))
+                m_worklistMoves.takeMove(moveIndex);
+
+            const MoveOperands& moveOperands = m_coalescingCandidates[moveIndex];
+            IndexType srcTmpIndex = moveOperands.srcIndex;
+            IndexType dstTmpIndex = moveOperands.dstIndex;
+
+            IndexType originalOtherTmp = srcTmpIndex != tmpIndex ? srcTmpIndex : dstTmpIndex;
+            IndexType otherTmpIndex = getAlias(originalOtherTmp);
+            if (m_degrees[otherTmpIndex] < m_regsInPriorityOrder.size() && !isMoveRelated(otherTmpIndex)) {
+                if (m_freezeWorklist.remove(otherTmpIndex))
+                    m_simplifyWorklist.append(otherTmpIndex);
+            }
+        });
+    }
+
+    void coalesce()
+    {
+        unsigned moveIndex = m_worklistMoves.takeLastMove();
+        const MoveOperands& moveOperands = m_coalescingCandidates[moveIndex];
+        IndexType u = getAlias(moveOperands.srcIndex);
+        IndexType v = getAlias(moveOperands.dstIndex);
+
+        if (isPrecolored(v))
+            std::swap(u, v);
+
+        if (traceDebug)
+            dataLog("Coalescing move at index ", moveIndex, " u = ", u, " v = ", v, "\n");
+
+        if (u == v) {
+            addWorkList(u);
+
+            if (traceDebug)
+                dataLog("    Coalesced\n");
+        } else if (isPrecolored(v)
+            || m_interferenceEdges.contains(InterferenceEdge(u, v))
+            || (u == m_framePointerIndex && m_interferesWithFramePointer.quickGet(v))) {
+            addWorkList(u);
+            addWorkList(v);
+
+            if (traceDebug)
+                dataLog("    Constrained\n");
+        } else if (canBeSafelyCoalesced(u, v)) {
+            combine(u, v);
+            addWorkList(u);
+            m_hasCoalescedNonTrivialMove = true;
+
+            if (traceDebug)
+                dataLog("    Safe Coalescing\n");
+        } else {
+            m_activeMoves.quickSet(moveIndex);
+
+            if (traceDebug)
+                dataLog("    Failed coalescing, added to active moves.\n");
+        }
+    }
+
+    void assignColors()
+    {
+        ASSERT(m_simplifyWorklist.isEmpty());
+        ASSERT(m_worklistMoves.isEmpty());
+        ASSERT(m_freezeWorklist.isEmpty());
+        ASSERT(m_spillWorklist.isEmpty());
+
+        // Reclaim as much memory as possible.
+        m_interferenceEdges.clear();
+        m_degrees.clear();
+        m_moveList.clear();
+        m_worklistMoves.clear();
+        m_simplifyWorklist.clear();
+        m_spillWorklist.clear();
+        m_freezeWorklist.clear();
+
+        // Try to color the Tmp on the stack.
+        m_coloredTmp.resize(m_adjacencyList.size());
+
+        while (!m_selectStack.isEmpty()) {
+            unsigned tmpIndex = m_selectStack.takeLast();
+            ASSERT(!isPrecolored(tmpIndex));
+            ASSERT(!m_coloredTmp[tmpIndex]);
+
+            RegisterSet coloredRegisters;
+            for (IndexType adjacentTmpIndex : m_adjacencyList[tmpIndex]) {
+                IndexType aliasTmpIndex = getAlias(adjacentTmpIndex);
+                Reg reg = m_coloredTmp[aliasTmpIndex];
+
+                ASSERT(!isPrecolored(aliasTmpIndex) || (isPrecolored(aliasTmpIndex) && reg));
+
+                if (reg)
+                    coloredRegisters.set(reg);
+            }
+
+            bool colorAssigned = false;
+            for (Reg reg : m_regsInPriorityOrder) {
+                if (!coloredRegisters.get(reg)) {
+                    m_coloredTmp[tmpIndex] = reg;
+                    colorAssigned = true;
+                    break;
+                }
+            }
+
+            if (!colorAssigned)
+                m_spilledTmps.append(tmpIndex);
+        }
+        m_selectStack.clear();
+
+        if (m_spilledTmps.isEmpty())
+            m_coalescedTmpsAtSpill.clear();
+        else
+            m_coloredTmp.clear();
+    }
+
+private:
+    void initializeDegrees(unsigned tmpArraySize)
+    {
+        m_degrees.resize(tmpArraySize);
+
+        // All precolored registers have  an "infinite" degree.
+        unsigned firstNonRegIndex = m_lastPrecoloredRegisterIndex + 1;
+        for (unsigned i = 0; i < firstNonRegIndex; ++i)
+            m_degrees[i] = std::numeric_limits<unsigned>::max();
+
+        memset(m_degrees.data() + firstNonRegIndex, 0, (tmpArraySize - firstNonRegIndex) * sizeof(unsigned));
+    }
+
+    void addEdgeDistinct(IndexType a, IndexType b)
+    {
+        ASSERT(a != b);
+        if (m_interferenceEdges.add(InterferenceEdge(a, b)).isNewEntry) {
+            if (!isPrecolored(a)) {
+                ASSERT(!m_adjacencyList[a].contains(b));
+                m_adjacencyList[a].append(b);
+                m_degrees[a]++;
+            }
+
+            if (!isPrecolored(b)) {
+                ASSERT(!m_adjacencyList[b].contains(a));
+                m_adjacencyList[b].append(a);
+                m_degrees[b]++;
+            }
+        }
+    }
+
+    void decrementDegree(IndexType tmpIndex)
+    {
+        ASSERT(m_degrees[tmpIndex]);
+
+        unsigned oldDegree = m_degrees[tmpIndex]--;
+        if (oldDegree == m_regsInPriorityOrder.size()) {
+            enableMovesOnValueAndAdjacents(tmpIndex);
+            m_spillWorklist.remove(tmpIndex);
+            if (isMoveRelated(tmpIndex))
+                m_freezeWorklist.add(tmpIndex);
+            else
+                m_simplifyWorklist.append(tmpIndex);
+        }
+    }
+
+
+    bool addEdgeDistinctWithoutDegreeChange(IndexType a, IndexType b)
+    {
+        ASSERT(a != b);
+        if (m_interferenceEdges.add(InterferenceEdge(a, b)).isNewEntry) {
+            if (!isPrecolored(a)) {
+                ASSERT(!m_adjacencyList[a].contains(b));
+                m_adjacencyList[a].append(b);
+            }
+
+            if (!isPrecolored(b)) {
+                ASSERT(!m_adjacencyList[b].contains(a));
+                m_adjacencyList[b].append(a);
+            }
+            return true;
+        }
+        return false;
+    }
+
+    bool isMoveRelated(IndexType tmpIndex)
+    {
+        for (unsigned moveIndex : m_moveList[tmpIndex]) {
+            if (m_activeMoves.quickGet(moveIndex) || m_worklistMoves.contains(moveIndex))
+                return true;
+        }
+        return false;
+    }
+
+    template<typename Function>
+    void forEachAdjacent(IndexType tmpIndex, Function function)
+    {
+        for (IndexType adjacentTmpIndex : m_adjacencyList[tmpIndex]) {
+            if (!hasBeenSimplified(adjacentTmpIndex))
+                function(adjacentTmpIndex);
+        }
+    }
+
+    bool hasBeenSimplified(IndexType tmpIndex)
+    {
+        return m_isOnSelectStack.quickGet(tmpIndex) || !!m_coalescedTmps[tmpIndex];
+    }
+
+    template<typename Function>
+    void forEachNodeMoves(IndexType tmpIndex, Function function)
+    {
+        for (unsigned moveIndex : m_moveList[tmpIndex]) {
+            if (m_activeMoves.quickGet(moveIndex) || m_worklistMoves.contains(moveIndex))
+                function(moveIndex);
+        }
+    }
+
+    void enableMovesOnValue(IndexType tmpIndex)
+    {
+        for (unsigned moveIndex : m_moveList[tmpIndex]) {
+            if (m_activeMoves.quickClear(moveIndex))
+                m_worklistMoves.returnMove(moveIndex);
+        }
+    }
+
+    void enableMovesOnValueAndAdjacents(IndexType tmpIndex)
+    {
+        enableMovesOnValue(tmpIndex);
+
+        forEachAdjacent(tmpIndex, [this] (IndexType adjacentTmpIndex) {
+            enableMovesOnValue(adjacentTmpIndex);
+        });
+    }
+
+    bool isPrecolored(IndexType tmpIndex)
+    {
+        return tmpIndex <= m_lastPrecoloredRegisterIndex;
+    }
+
+    void addWorkList(IndexType tmpIndex)
+    {
+        if (!isPrecolored(tmpIndex) && m_degrees[tmpIndex] < m_regsInPriorityOrder.size() && !isMoveRelated(tmpIndex)) {
+            m_freezeWorklist.remove(tmpIndex);
+            m_simplifyWorklist.append(tmpIndex);
+        }
+    }
+
+    void combine(IndexType u, IndexType v)
+    {
+        if (!m_freezeWorklist.remove(v))
+            m_spillWorklist.remove(v);
+
+        ASSERT(!m_coalescedTmps[v]);
+        m_coalescedTmps[v] = u;
+
+        auto& vMoves = m_moveList[v];
+        m_moveList[u].add(vMoves.begin(), vMoves.end());
+
+        forEachAdjacent(v, [this, u] (IndexType adjacentTmpIndex) {
+            if (addEdgeDistinctWithoutDegreeChange(adjacentTmpIndex, u)) {
+                // If we added a new edge between the adjacentTmp and u, it replaces the edge
+                // that existed with v.
+                // The degree of adjacentTmp remains the same since the edge just changed from u to v.
+                // All we need to do is update the degree of u.
+                if (!isPrecolored(u))
+                    m_degrees[u]++;
+            } else {
+                // If we already had an edge between the adjacentTmp and u, the degree of u
+                // is already correct. The degree of the adjacentTmp decreases since the edge
+                // with v is no longer relevant (we can think of it as merged with the edge with u).
+                decrementDegree(adjacentTmpIndex);
+            }
+        });
+
+        if (m_framePointerIndex && m_interferesWithFramePointer.quickGet(v))
+            m_interferesWithFramePointer.quickSet(u);
+
+        if (m_degrees[u] >= m_regsInPriorityOrder.size() && m_freezeWorklist.remove(u))
+            addToSpill(u);
+    }
+
+    bool canBeSafelyCoalesced(IndexType u, IndexType v)
+    {
+        ASSERT(!isPrecolored(v));
+        if (isPrecolored(u))
+            return precoloredCoalescingHeuristic(u, v);
+        return conservativeHeuristic(u, v);
+    }
+
+    bool conservativeHeuristic(IndexType u, IndexType v)
+    {
+        // This is using the Briggs' conservative coalescing rule:
+        // If the number of combined adjacent node with a degree >= K is less than K,
+        // it is safe to combine the two nodes. The reason is that we know that if the graph
+        // is colorable, we have fewer than K adjacents with high order and there is a color
+        // for the current node.
+        ASSERT(u != v);
+        ASSERT(!isPrecolored(u));
+        ASSERT(!isPrecolored(v));
+
+        const auto& adjacentsOfU = m_adjacencyList[u];
+        const auto& adjacentsOfV = m_adjacencyList[v];
+
+        if (adjacentsOfU.size() + adjacentsOfV.size() < m_regsInPriorityOrder.size()) {
+            // Shortcut: if the total number of adjacents is less than the number of register, the condition is always met.
+            return true;
+        }
+
+        HashSet<IndexType> highOrderAdjacents;
+
+        for (IndexType adjacentTmpIndex : adjacentsOfU) {
+            ASSERT(adjacentTmpIndex != v);
+            ASSERT(adjacentTmpIndex != u);
+            if (!hasBeenSimplified(adjacentTmpIndex) && m_degrees[adjacentTmpIndex] >= m_regsInPriorityOrder.size()) {
+                auto addResult = highOrderAdjacents.add(adjacentTmpIndex);
+                if (addResult.isNewEntry && highOrderAdjacents.size() >= m_regsInPriorityOrder.size())
+                    return false;
+            }
+        }
+        for (IndexType adjacentTmpIndex : adjacentsOfV) {
+            ASSERT(adjacentTmpIndex != u);
+            ASSERT(adjacentTmpIndex != v);
+            if (!hasBeenSimplified(adjacentTmpIndex) && m_degrees[adjacentTmpIndex] >= m_regsInPriorityOrder.size()) {
+                auto addResult = highOrderAdjacents.add(adjacentTmpIndex);
+                if (addResult.isNewEntry && highOrderAdjacents.size() >= m_regsInPriorityOrder.size())
+                    return false;
+            }
+        }
+
+        ASSERT(highOrderAdjacents.size() < m_regsInPriorityOrder.size());
+        return true;
+    }
+
+    bool precoloredCoalescingHeuristic(IndexType u, IndexType v)
+    {
+        if (traceDebug)
+            dataLog("    Checking precoloredCoalescingHeuristic\n");
+        ASSERT(isPrecolored(u));
+        ASSERT(!isPrecolored(v));
+        
+        // If u is a pinned register then it's always safe to coalesce. Note that when we call this,
+        // we have already proved that there is no interference between u and v.
+        if (!m_mutableRegs.get(m_coloredTmp[u]))
+            return true;
+
+        // If any adjacent of the non-colored node is not an adjacent of the colored node AND has a degree >= K
+        // there is a risk that this node needs to have the same color as our precolored node. If we coalesce such
+        // move, we may create an uncolorable graph.
+        const auto& adjacentsOfV = m_adjacencyList[v];
+        for (unsigned adjacentTmpIndex : adjacentsOfV) {
+            if (!isPrecolored(adjacentTmpIndex)
+                && !hasBeenSimplified(adjacentTmpIndex)
+                && m_degrees[adjacentTmpIndex] >= m_regsInPriorityOrder.size()
+                && !m_interferenceEdges.contains(InterferenceEdge(u, adjacentTmpIndex)))
+                return false;
+        }
+        return true;
+    }
+
+protected:
+#if PLATFORM(COCOA)
+#pragma mark -
+#endif
+
+    // Interference edges are not directed. An edge between any two Tmps is represented
+    // by the concatenated values of the smallest Tmp followed by the bigger Tmp.
+    class InterferenceEdge {
+    public:
+        InterferenceEdge()
+        {
+        }
+
+        InterferenceEdge(IndexType a, IndexType b)
+        {
+            ASSERT(a);
+            ASSERT(b);
+            ASSERT_WITH_MESSAGE(a != b, "A Tmp can never interfere with itself. Doing so would force it to be the superposition of two registers.");
+
+            if (b < a)
+                std::swap(a, b);
+            m_value = static_cast<uint64_t>(a) << 32 | b;
+        }
+
+        InterferenceEdge(WTF::HashTableDeletedValueType)
+            : m_value(std::numeric_limits<uint64_t>::max())
+        {
+        }
+
+        IndexType first() const
+        {
+            return m_value >> 32 & 0xffffffff;
+        }
+
+        IndexType second() const
+        {
+            return m_value & 0xffffffff;
+        }
+
+        bool operator==(const InterferenceEdge other) const
+        {
+            return m_value == other.m_value;
+        }
+
+        bool isHashTableDeletedValue() const
+        {
+            return *this == InterferenceEdge(WTF::HashTableDeletedValue);
+        }
+
+        unsigned hash() const
+        {
+            return WTF::IntHash<uint64_t>::hash(m_value);
+        }
+
+        void dump(PrintStream& out) const
+        {
+            out.print(first(), "<=>", second());
+        }
+
+    private:
+        uint64_t m_value { 0 };
+    };
+
+    struct InterferenceEdgeHash {
+        static unsigned hash(const InterferenceEdge& key) { return key.hash(); }
+        static bool equal(const InterferenceEdge& a, const InterferenceEdge& b) { return a == b; }
+        static const bool safeToCompareToEmptyOrDeleted = true;
+    };
+    typedef SimpleClassHashTraits<InterferenceEdge> InterferenceEdgeHashTraits;
+
+    const Vector<Reg>& m_regsInPriorityOrder;
+    RegisterSet m_mutableRegs;
+    IndexType m_lastPrecoloredRegisterIndex { 0 };
+
+    // The interference graph.
+    HashSet<InterferenceEdge, InterferenceEdgeHash, InterferenceEdgeHashTraits> m_interferenceEdges;
+    Vector<Vector<IndexType, 0, UnsafeVectorOverflow, 4>, 0, UnsafeVectorOverflow> m_adjacencyList;
+    Vector<IndexType, 0, UnsafeVectorOverflow> m_degrees;
+
+    // Instead of keeping track of the move instructions, we just keep their operands around and use the index
+    // in the vector as the "identifier" for the move.
+    struct MoveOperands {
+        IndexType srcIndex;
+        IndexType dstIndex;
+    };
+    Vector<MoveOperands, 0, UnsafeVectorOverflow> m_coalescingCandidates;
+
+    // List of every move instruction associated with a Tmp.
+    Vector<HashSet<IndexType, typename DefaultHash<IndexType>::Hash, WTF::UnsignedWithZeroKeyHashTraits<IndexType>>> m_moveList;
+
+    // Colors.
+    Vector<Reg, 0, UnsafeVectorOverflow> m_coloredTmp;
+    Vector<IndexType> m_spilledTmps;
+
+    // Values that have been coalesced with an other value.
+    Vector<IndexType, 0, UnsafeVectorOverflow> m_coalescedTmps;
+
+    // The stack of Tmp removed from the graph and ready for coloring.
+    BitVector m_isOnSelectStack;
+    Vector<IndexType> m_selectStack;
+
+    IndexType m_framePointerIndex { 0 };
+    BitVector m_interferesWithFramePointer;
+
+    struct OrderedMoveSet {
+        unsigned addMove()
+        {
+            ASSERT(m_lowPriorityMoveList.isEmpty());
+            ASSERT(!m_firstLowPriorityMoveIndex);
+
+            unsigned nextIndex = m_positionInMoveList.size();
+            unsigned position = m_moveList.size();
+            m_moveList.append(nextIndex);
+            m_positionInMoveList.append(position);
+            return nextIndex;
+        }
+
+        void startAddingLowPriorityMoves()
+        {
+            ASSERT(m_lowPriorityMoveList.isEmpty());
+            m_firstLowPriorityMoveIndex = m_moveList.size();
+        }
+
+        unsigned addLowPriorityMove()
+        {
+            ASSERT(m_firstLowPriorityMoveIndex == m_moveList.size());
+
+            unsigned nextIndex = m_positionInMoveList.size();
+            unsigned position = m_lowPriorityMoveList.size();
+            m_lowPriorityMoveList.append(nextIndex);
+            m_positionInMoveList.append(position);
+
+            ASSERT(nextIndex >= m_firstLowPriorityMoveIndex);
+
+            return nextIndex;
+        }
+
+        bool isEmpty() const
+        {
+            return m_moveList.isEmpty() && m_lowPriorityMoveList.isEmpty();
+        }
+
+        bool contains(unsigned index)
+        {
+            return m_positionInMoveList[index] != std::numeric_limits<unsigned>::max();
+        }
+
+        void takeMove(unsigned moveIndex)
+        {
+            unsigned positionInMoveList = m_positionInMoveList[moveIndex];
+            if (positionInMoveList == std::numeric_limits<unsigned>::max())
+                return;
+
+            if (moveIndex < m_firstLowPriorityMoveIndex) {
+                ASSERT(m_moveList[positionInMoveList] == moveIndex);
+                unsigned lastIndex = m_moveList.last();
+                m_positionInMoveList[lastIndex] = positionInMoveList;
+                m_moveList[positionInMoveList] = lastIndex;
+                m_moveList.removeLast();
+            } else {
+                ASSERT(m_lowPriorityMoveList[positionInMoveList] == moveIndex);
+                unsigned lastIndex = m_lowPriorityMoveList.last();
+                m_positionInMoveList[lastIndex] = positionInMoveList;
+                m_lowPriorityMoveList[positionInMoveList] = lastIndex;
+                m_lowPriorityMoveList.removeLast();
+            }
+
+            m_positionInMoveList[moveIndex] = std::numeric_limits<unsigned>::max();
+
+            ASSERT(!contains(moveIndex));
+        }
+
+        unsigned takeLastMove()
+        {
+            ASSERT(!isEmpty());
+
+            unsigned lastIndex;
+            if (!m_moveList.isEmpty()) {
+                lastIndex = m_moveList.takeLast();
+                ASSERT(m_positionInMoveList[lastIndex] == m_moveList.size());
+            } else {
+                lastIndex = m_lowPriorityMoveList.takeLast();
+                ASSERT(m_positionInMoveList[lastIndex] == m_lowPriorityMoveList.size());
+            }
+            m_positionInMoveList[lastIndex] = std::numeric_limits<unsigned>::max();
+
+            ASSERT(!contains(lastIndex));
+            return lastIndex;
+        }
+
+        void returnMove(unsigned index)
+        {
+            // This assertion is a bit strict but that is how the move list should be used. The only kind of moves that can
+            // return to the list are the ones that we previously failed to coalesce with the conservative heuristics.
+            // Values should not be added back if they were never taken out when attempting coalescing.
+            ASSERT(!contains(index));
+
+            if (index < m_firstLowPriorityMoveIndex) {
+                unsigned position = m_moveList.size();
+                m_moveList.append(index);
+                m_positionInMoveList[index] = position;
+            } else {
+                unsigned position = m_lowPriorityMoveList.size();
+                m_lowPriorityMoveList.append(index);
+                m_positionInMoveList[index] = position;
+            }
+
+            ASSERT(contains(index));
+        }
+
+        void clear()
+        {
+            m_positionInMoveList.clear();
+            m_moveList.clear();
+            m_lowPriorityMoveList.clear();
+        }
+
+    private:
+        Vector<unsigned, 0, UnsafeVectorOverflow> m_positionInMoveList;
+        Vector<unsigned, 0, UnsafeVectorOverflow> m_moveList;
+        Vector<unsigned, 0, UnsafeVectorOverflow> m_lowPriorityMoveList;
+        unsigned m_firstLowPriorityMoveIndex { 0 };
+    };
+
+    // Work lists.
+    // Set of "move" enabled for possible coalescing.
+    OrderedMoveSet m_worklistMoves;
+    // Set of "move" not yet ready for coalescing.
+    BitVector m_activeMoves;
+    // Low-degree, non-Move related.
+    Vector<IndexType> m_simplifyWorklist;
+    // High-degree Tmp.
+    HashSet<IndexType> m_spillWorklist;
+    // Low-degree, Move related.
+    HashSet<IndexType> m_freezeWorklist;
+
+    bool m_hasSelectedSpill { false };
+    bool m_hasCoalescedNonTrivialMove { false };
+
+    // The mapping of Tmp to their alias for Moves that are always coalescing regardless of spilling.
+    Vector<IndexType, 0, UnsafeVectorOverflow> m_coalescedTmpsAtSpill;
+    
+    const HashSet<unsigned>& m_unspillableTmps;
+};
+
+// This perform all the tasks that are specific to certain register type.
+template<Arg::Type type>
+class ColoringAllocator : public AbstractColoringAllocator<unsigned> {
+public:
+    ColoringAllocator(Code& code, TmpWidth& tmpWidth, const UseCounts<Tmp>& useCounts, const HashSet<unsigned>& unspillableTmp)
+        : AbstractColoringAllocator<unsigned>(code.regsInPriorityOrder(type), AbsoluteTmpMapper<type>::lastMachineRegisterIndex(), tmpArraySize(code), unspillableTmp)
+        , m_code(code)
+        , m_tmpWidth(tmpWidth)
+        , m_useCounts(useCounts)
+    {
+        if (type == Arg::GP) {
+            m_framePointerIndex = AbsoluteTmpMapper<type>::absoluteIndex(Tmp(MacroAssembler::framePointerRegister));
+            m_interferesWithFramePointer.ensureSize(tmpArraySize(code));
+        }
+
+        initializePrecoloredTmp();
+        build();
+        allocate();
+    }
+
+    Tmp getAlias(Tmp tmp) const
+    {
+        return AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(getAlias(AbsoluteTmpMapper<type>::absoluteIndex(tmp)));
+    }
+
+    // This tells you if a Move will be coalescable if the src and dst end up matching. This method
+    // relies on an analysis that is invalidated by register allocation, so you it's only meaningful to
+    // call this *before* replacing the Tmp's in this Inst with registers or spill slots.
+    bool mayBeCoalescable(const Inst& inst) const
+    {
+        return mayBeCoalescableImpl(inst, &m_tmpWidth);
+    }
+
+    bool isUselessMove(const Inst& inst) const
+    {
+        return mayBeCoalescableImpl(inst, nullptr) && inst.args[0].tmp() == inst.args[1].tmp();
+    }
+
+    Tmp getAliasWhenSpilling(Tmp tmp) const
+    {
+        ASSERT_WITH_MESSAGE(!m_spilledTmps.isEmpty(), "This function is only valid for coalescing during spilling.");
+
+        if (m_coalescedTmpsAtSpill.isEmpty())
+            return tmp;
+
+        unsigned aliasIndex = AbsoluteTmpMapper<type>::absoluteIndex(tmp);
+        while (unsigned nextAliasIndex = m_coalescedTmpsAtSpill[aliasIndex])
+            aliasIndex = nextAliasIndex;
+
+        Tmp alias = AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(aliasIndex);
+
+        ASSERT_WITH_MESSAGE(!m_spilledTmps.contains(aliasIndex) || alias == tmp, "The aliases at spill should always be colorable. Something went horribly wrong.");
+
+        return alias;
+    }
+
+    template<typename IndexIterator>
+    class IndexToTmpIteratorAdaptor {
+    public:
+        IndexToTmpIteratorAdaptor(IndexIterator&& indexIterator)
+            : m_indexIterator(WTFMove(indexIterator))
+        {
+        }
+
+        Tmp operator*() const { return AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(*m_indexIterator); }
+        IndexToTmpIteratorAdaptor& operator++() { ++m_indexIterator; return *this; }
+
+        bool operator==(const IndexToTmpIteratorAdaptor& other) const
+        {
+            return m_indexIterator == other.m_indexIterator;
+        }
+
+        bool operator!=(const IndexToTmpIteratorAdaptor& other) const
+        {
+            return !(*this == other);
+        }
+
+    private:
+        IndexIterator m_indexIterator;
+    };
+
+    template<typename Collection>
+    class IndexToTmpIterableAdaptor {
+    public:
+        IndexToTmpIterableAdaptor(const Collection& collection)
+            : m_collection(collection)
+        {
+        }
+
+        IndexToTmpIteratorAdaptor<typename Collection::const_iterator> begin() const
+        {
+            return m_collection.begin();
+        }
+
+        IndexToTmpIteratorAdaptor<typename Collection::const_iterator> end() const
+        {
+            return m_collection.end();
+        }
+
+    private:
+        const Collection& m_collection;
+    };
+
+    IndexToTmpIterableAdaptor<Vector<unsigned>> spilledTmps() const { return m_spilledTmps; }
+
+    bool requiresSpilling() const { return !m_spilledTmps.isEmpty(); }
+
+    Reg allocatedReg(Tmp tmp) const
+    {
+        ASSERT(!tmp.isReg());
+        ASSERT(m_coloredTmp.size());
+        ASSERT(tmp.isGP() == (type == Arg::GP));
+
+        Reg reg = m_coloredTmp[AbsoluteTmpMapper<type>::absoluteIndex(tmp)];
+        if (!reg) {
+            dataLog("FATAL: No color for ", tmp, "\n");
+            dataLog("Code:\n");
+            dataLog(m_code);
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+        return reg;
+    }
+
+private:
+    static unsigned tmpArraySize(Code& code)
+    {
+        unsigned numTmps = code.numTmps(type);
+        return AbsoluteTmpMapper<type>::absoluteIndex(numTmps);
+    }
+
+    void initializePrecoloredTmp()
+    {
+        m_coloredTmp.resize(m_lastPrecoloredRegisterIndex + 1);
+        for (unsigned i = 1; i <= m_lastPrecoloredRegisterIndex; ++i) {
+            Tmp tmp = AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(i);
+            ASSERT(tmp.isReg());
+            m_coloredTmp[i] = tmp.reg();
+        }
+    }
+
+    bool mayBeCoalesced(Arg left, Arg right)
+    {
+        if (!left.isTmp() || !right.isTmp())
+            return false;
+
+        Tmp leftTmp = left.tmp();
+        Tmp rightTmp = right.tmp();
+
+        if (leftTmp == rightTmp)
+            return false;
+
+        if (leftTmp.isGP() != (type == Arg::GP) || rightTmp.isGP() != (type == Arg::GP))
+            return false;
+
+        unsigned leftIndex = AbsoluteTmpMapper<type>::absoluteIndex(leftTmp);
+        unsigned rightIndex = AbsoluteTmpMapper<type>::absoluteIndex(rightTmp);
+
+        return !m_interferenceEdges.contains(InterferenceEdge(leftIndex, rightIndex));
+    }
+
+    void addToLowPriorityCoalescingCandidates(Arg left, Arg right)
+    {
+        ASSERT(mayBeCoalesced(left, right));
+        Tmp leftTmp = left.tmp();
+        Tmp rightTmp = right.tmp();
+
+        unsigned leftIndex = AbsoluteTmpMapper<type>::absoluteIndex(leftTmp);
+        unsigned rightIndex = AbsoluteTmpMapper<type>::absoluteIndex(rightTmp);
+
+        unsigned nextMoveIndex = m_coalescingCandidates.size();
+        m_coalescingCandidates.append({ leftIndex, rightIndex });
+
+        unsigned newIndexInWorklist = m_worklistMoves.addLowPriorityMove();
+        ASSERT_UNUSED(newIndexInWorklist, newIndexInWorklist == nextMoveIndex);
+
+        ASSERT(nextMoveIndex <= m_activeMoves.size());
+        m_activeMoves.ensureSize(nextMoveIndex + 1);
+
+        m_moveList[leftIndex].add(nextMoveIndex);
+        m_moveList[rightIndex].add(nextMoveIndex);
+    }
+
+    void build()
+    {
+        TmpLiveness<type> liveness(m_code);
+        for (BasicBlock* block : m_code) {
+            typename TmpLiveness<type>::LocalCalc localCalc(liveness, block);
+            for (unsigned instIndex = block->size(); instIndex--;) {
+                Inst& inst = block->at(instIndex);
+                Inst* nextInst = block->get(instIndex + 1);
+                build(&inst, nextInst, localCalc);
+                localCalc.execute(instIndex);
+            }
+            build(nullptr, &block->at(0), localCalc);
+        }
+        buildLowPriorityMoveList();
+    }
+
+    void build(Inst* prevInst, Inst* nextInst, const typename TmpLiveness<type>::LocalCalc& localCalc)
+    {
+        if (traceDebug)
+            dataLog("Building between ", pointerDump(prevInst), " and ", pointerDump(nextInst), ":\n");
+        Inst::forEachDefWithExtraClobberedRegs<Tmp>(
+            prevInst, nextInst,
+            [&] (const Tmp& arg, Arg::Role, Arg::Type argType, Arg::Width) {
+                if (argType != type)
+                    return;
+                
+                // All the Def()s interfere with each other and with all the extra clobbered Tmps.
+                // We should not use forEachDefWithExtraClobberedRegs() here since colored Tmps
+                // do not need interference edges in our implementation.
+                Inst::forEachDef<Tmp>(
+                    prevInst, nextInst,
+                    [&] (Tmp& otherArg, Arg::Role, Arg::Type argType, Arg::Width) {
+                        if (argType != type)
+                            return;
+                        
+                        if (traceDebug)
+                            dataLog("    Adding def-def edge: ", arg, ", ", otherArg, "\n");
+                        this->addEdge(arg, otherArg);
+                    });
+            });
+
+        if (prevInst && mayBeCoalescable(*prevInst)) {
+            // We do not want the Use() of this move to interfere with the Def(), even if it is live
+            // after the Move. If we were to add the interference edge, it would be impossible to
+            // coalesce the Move even if the two Tmp never interfere anywhere.
+            Tmp defTmp;
+            Tmp useTmp;
+            prevInst->forEachTmp([&defTmp, &useTmp] (Tmp& argTmp, Arg::Role role, Arg::Type, Arg::Width) {
+                if (Arg::isLateDef(role))
+                    defTmp = argTmp;
+                else {
+                    ASSERT(Arg::isEarlyUse(role));
+                    useTmp = argTmp;
+                }
+            });
+            ASSERT(defTmp);
+            ASSERT(useTmp);
+
+            unsigned nextMoveIndex = m_coalescingCandidates.size();
+            m_coalescingCandidates.append({ AbsoluteTmpMapper<type>::absoluteIndex(useTmp), AbsoluteTmpMapper<type>::absoluteIndex(defTmp) });
+
+            unsigned newIndexInWorklist = m_worklistMoves.addMove();
+            ASSERT_UNUSED(newIndexInWorklist, newIndexInWorklist == nextMoveIndex);
+
+            ASSERT(nextMoveIndex <= m_activeMoves.size());
+            m_activeMoves.ensureSize(nextMoveIndex + 1);
+
+            for (const Arg& arg : prevInst->args) {
+                auto& list = m_moveList[AbsoluteTmpMapper<type>::absoluteIndex(arg.tmp())];
+                list.add(nextMoveIndex);
+            }
+
+            for (const Tmp& liveTmp : localCalc.live()) {
+                if (liveTmp != useTmp) {
+                    if (traceDebug)
+                        dataLog("    Adding def-live for coalescable: ", defTmp, ", ", liveTmp, "\n");
+                    addEdge(defTmp, liveTmp);
+                }
+            }
+
+            // The next instruction could have early clobbers or early def's. We need to consider
+            // those now.
+            addEdges(nullptr, nextInst, localCalc.live());
+        } else
+            addEdges(prevInst, nextInst, localCalc.live());
+    }
+
+    void buildLowPriorityMoveList()
+    {
+        if (!isX86())
+            return;
+
+        m_worklistMoves.startAddingLowPriorityMoves();
+        for (BasicBlock* block : m_code) {
+            for (Inst& inst : *block) {
+                if (std::optional<unsigned> defArgIndex = inst.shouldTryAliasingDef()) {
+                    Arg op1 = inst.args[*defArgIndex - 2];
+                    Arg op2 = inst.args[*defArgIndex - 1];
+                    Arg dest = inst.args[*defArgIndex];
+
+                    if (op1 == dest || op2 == dest)
+                        continue;
+
+                    if (mayBeCoalesced(op1, dest))
+                        addToLowPriorityCoalescingCandidates(op1, dest);
+                    if (op1 != op2 && mayBeCoalesced(op2, dest))
+                        addToLowPriorityCoalescingCandidates(op2, dest);
+                }
+            }
+        }
+    }
+
+    void addEdges(Inst* prevInst, Inst* nextInst, typename TmpLiveness<type>::LocalCalc::Iterable liveTmps)
+    {
+        // All the Def()s interfere with everthing live.
+        Inst::forEachDefWithExtraClobberedRegs<Tmp>(
+            prevInst, nextInst,
+            [&] (const Tmp& arg, Arg::Role, Arg::Type argType, Arg::Width) {
+                if (argType != type)
+                    return;
+                
+                for (const Tmp& liveTmp : liveTmps) {
+                    ASSERT(liveTmp.isGP() == (type == Arg::GP));
+                    
+                    if (traceDebug)
+                        dataLog("    Adding def-live edge: ", arg, ", ", liveTmp, "\n");
+                    
+                    addEdge(arg, liveTmp);
+                }
+
+                if (type == Arg::GP && !arg.isGPR())
+                    m_interferesWithFramePointer.quickSet(AbsoluteTmpMapper<type>::absoluteIndex(arg));
+            });
+    }
+
+    void addEdge(Tmp a, Tmp b)
+    {
+        ASSERT_WITH_MESSAGE(a.isGP() == b.isGP(), "An interference between registers of different types does not make sense, it can lead to non-colorable graphs.");
+
+        addEdge(AbsoluteTmpMapper<type>::absoluteIndex(a), AbsoluteTmpMapper<type>::absoluteIndex(b));
+    }
+
+    // Calling this without a tmpWidth will perform a more conservative coalescing analysis that assumes
+    // that Move32's are not coalescable.
+    static bool mayBeCoalescableImpl(const Inst& inst, TmpWidth* tmpWidth)
+    {
+        switch (type) {
+        case Arg::GP:
+            switch (inst.kind.opcode) {
+            case Move:
+            case Move32:
+                break;
+            default:
+                return false;
+            }
+            break;
+        case Arg::FP:
+            switch (inst.kind.opcode) {
+            case MoveFloat:
+            case MoveDouble:
+                break;
+            default:
+                return false;
+            }
+            break;
+        }
+
+        ASSERT_WITH_MESSAGE(inst.args.size() == 2, "We assume coalecable moves only have two arguments in a few places.");
+
+        if (!inst.args[0].isTmp() || !inst.args[1].isTmp())
+            return false;
+
+        ASSERT(inst.args[0].type() == type);
+        ASSERT(inst.args[1].type() == type);
+
+        // We can coalesce a Move32 so long as either of the following holds:
+        // - The input is already zero-filled.
+        // - The output only cares about the low 32 bits.
+        //
+        // Note that the input property requires an analysis over ZDef's, so it's only valid so long
+        // as the input gets a register. We don't know if the input gets a register, but we do know
+        // that if it doesn't get a register then we will still emit this Move32.
+        if (inst.kind.opcode == Move32) {
+            if (!tmpWidth)
+                return false;
+
+            if (tmpWidth->defWidth(inst.args[0].tmp()) > Arg::Width32
+                && tmpWidth->useWidth(inst.args[1].tmp()) > Arg::Width32)
+                return false;
+        }
+        
+        return true;
+    }
+
+    void selectSpill()
+    {
+        if (!m_hasSelectedSpill) {
+            m_hasSelectedSpill = true;
+
+            if (m_hasCoalescedNonTrivialMove)
+                m_coalescedTmpsAtSpill = m_coalescedTmps;
+        }
+
+        auto iterator = m_spillWorklist.begin();
+
+        RELEASE_ASSERT_WITH_MESSAGE(iterator != m_spillWorklist.end(), "selectSpill() called when there was no spill.");
+        RELEASE_ASSERT_WITH_MESSAGE(!m_unspillableTmps.contains(*iterator), "trying to spill unspillable tmp");
+
+        // Higher score means more desirable to spill. Lower scores maximize the likelihood that a tmp
+        // gets a register.
+        auto score = [&] (Tmp tmp) -> double {
+            // Air exposes the concept of "fast tmps", and we interpret that to mean that the tmp
+            // should always be in a register.
+            if (m_code.isFastTmp(tmp))
+                return 0;
+            
+            // All else being equal, the score should be directly related to the degree.
+            double degree = static_cast<double>(m_degrees[AbsoluteTmpMapper<type>::absoluteIndex(tmp)]);
+
+            // All else being equal, the score should be inversely related to the number of warm uses and
+            // defs.
+            const UseCounts<Tmp>::Counts* counts = m_useCounts[tmp];
+            if (!counts)
+                return std::numeric_limits<double>::infinity();
+            
+            double uses = counts->numWarmUses + counts->numDefs;
+
+            // If it's a constant, then it's not as bad to spill. We can rematerialize it in many
+            // cases.
+            if (counts->numConstDefs == 1 && counts->numDefs == 1)
+                uses /= 2;
+
+            return degree / uses;
+        };
+
+        auto victimIterator = iterator;
+        double maxScore = score(AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(*iterator));
+
+        ++iterator;
+        for (;iterator != m_spillWorklist.end(); ++iterator) {
+            double tmpScore = score(AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(*iterator));
+            if (tmpScore > maxScore) {
+                ASSERT(!m_unspillableTmps.contains(*iterator));
+                victimIterator = iterator;
+                maxScore = tmpScore;
+            }
+        }
+
+        unsigned victimIndex = *victimIterator;
+        m_spillWorklist.remove(victimIterator);
+        m_simplifyWorklist.append(victimIndex);
+
+        freezeMoves(victimIndex);
+    }
+
+    void allocate()
+    {
+        ASSERT_WITH_MESSAGE(m_activeMoves.size() >= m_coalescingCandidates.size(), "The activeMove set should be big enough for the quick operations of BitVector.");
+
+        makeWorkList();
+
+        if (debug) {
+            dataLog("Interference: ", listDump(m_interferenceEdges), "\n");
+            dumpInterferenceGraphInDot(WTF::dataFile());
+            dataLog("Coalescing candidates:\n");
+            for (MoveOperands& moveOp : m_coalescingCandidates) {
+                dataLog("    ", AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(moveOp.srcIndex),
+                    " -> ", AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(moveOp.dstIndex), "\n");
+            }
+            dataLog("Initial work list\n");
+            dumpWorkLists(WTF::dataFile());
+        }
+
+        do {
+            if (traceDebug) {
+                dataLog("Before Graph simplification iteration\n");
+                dumpWorkLists(WTF::dataFile());
+            }
+
+            if (!m_simplifyWorklist.isEmpty())
+                simplify();
+            else if (!m_worklistMoves.isEmpty())
+                coalesce();
+            else if (!m_freezeWorklist.isEmpty())
+                freeze();
+            else if (!m_spillWorklist.isEmpty())
+                selectSpill();
+
+            if (traceDebug) {
+                dataLog("After Graph simplification iteration\n");
+                dumpWorkLists(WTF::dataFile());
+            }
+        } while (!m_simplifyWorklist.isEmpty() || !m_worklistMoves.isEmpty() || !m_freezeWorklist.isEmpty() || !m_spillWorklist.isEmpty());
+
+        assignColors();
+    }
+
+#if PLATFORM(COCOA)
+#pragma mark - Debugging helpers.
+#endif
+
+    void dumpInterferenceGraphInDot(PrintStream& out)
+    {
+        out.print("graph InterferenceGraph { \n");
+
+        HashSet<Tmp> tmpsWithInterferences;
+        for (const auto& edge : m_interferenceEdges) {
+            tmpsWithInterferences.add(AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(edge.first()));
+            tmpsWithInterferences.add(AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(edge.second()));
+        }
+
+        for (const auto& tmp : tmpsWithInterferences) {
+            unsigned tmpIndex = AbsoluteTmpMapper<type>::absoluteIndex(tmp);
+            if (tmpIndex < m_degrees.size())
+                out.print("    ", tmp.internalValue(), " [label=\"", tmp, " (", m_degrees[tmpIndex], ")\"];\n");
+            else
+                out.print("    ", tmp.internalValue(), " [label=\"", tmp, "\"];\n");
+        }
+
+        for (const auto& edge : m_interferenceEdges)
+            out.print("    ", edge.first(), " -- ", edge.second(), ";\n");
+        out.print("}\n");
+    }
+
+    void dumpWorkLists(PrintStream& out)
+    {
+        out.print("Simplify work list:\n");
+        for (unsigned tmpIndex : m_simplifyWorklist)
+            out.print("    ", AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(tmpIndex), "\n");
+        out.printf("Moves work list is empty? %d\n", m_worklistMoves.isEmpty());
+        out.print("Freeze work list:\n");
+        for (unsigned tmpIndex : m_freezeWorklist)
+            out.print("    ", AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(tmpIndex), "\n");
+        out.print("Spill work list:\n");
+        for (unsigned tmpIndex : m_spillWorklist)
+            out.print("    ", AbsoluteTmpMapper<type>::tmpFromAbsoluteIndex(tmpIndex), "\n");
+    }
+
+    using AbstractColoringAllocator<unsigned>::addEdge;
+    using AbstractColoringAllocator<unsigned>::getAlias;
+
+    Code& m_code;
+    TmpWidth& m_tmpWidth;
+    // FIXME: spilling should not type specific. It is only a side effect of using UseCounts.
+    const UseCounts<Tmp>& m_useCounts;
+};
+
+class IteratedRegisterCoalescing {
+public:
+    IteratedRegisterCoalescing(Code& code)
+        : m_code(code)
+        , m_useCounts(code)
+    {
+    }
+
+    void run()
+    {
+        padInterference(m_code);
+        
+        iteratedRegisterCoalescingOnType<Arg::GP>();
+        iteratedRegisterCoalescingOnType<Arg::FP>();
+
+        fixSpillsAfterTerminals();
+
+        if (reportStats)
+            dataLog("Num iterations = ", m_numIterations, "\n");
+    }
+
+private:
+    template<Arg::Type type>
+    void iteratedRegisterCoalescingOnType()
+    {
+        HashSet<unsigned> unspillableTmps = computeUnspillableTmps<type>();
+
+        // FIXME: If a Tmp is used only from a Scratch role and that argument is !admitsStack, then
+        // we should add the Tmp to unspillableTmps. That will help avoid relooping only to turn the
+        // Tmp into an unspillable Tmp.
+        // https://bugs.webkit.org/show_bug.cgi?id=152699
+        
+        while (true) {
+            ++m_numIterations;
+
+            if (traceDebug)
+                dataLog("Code at iteration ", m_numIterations, ":\n", m_code);
+
+            // FIXME: One way to optimize this code is to remove the recomputation inside the fixpoint.
+            // We need to recompute because spilling adds tmps, but we could just update tmpWidth when we
+            // add those tmps. Note that one easy way to remove the recomputation is to make any newly
+            // added Tmps get the same use/def widths that the original Tmp got. But, this may hurt the
+            // spill code we emit. Since we currently recompute TmpWidth after spilling, the newly
+            // created Tmps may get narrower use/def widths. On the other hand, the spiller already
+            // selects which move instruction to use based on the original Tmp's widths, so it may not
+            // matter than a subsequent iteration sees a coservative width for the new Tmps. Also, the
+            // recomputation may not actually be a performance problem; it's likely that a better way to
+            // improve performance of TmpWidth is to replace its HashMap with something else. It's
+            // possible that most of the TmpWidth overhead is from queries of TmpWidth rather than the
+            // recomputation, in which case speeding up the lookup would be a bigger win.
+            // https://bugs.webkit.org/show_bug.cgi?id=152478
+            m_tmpWidth.recompute(m_code);
+            
+            ColoringAllocator<type> allocator(m_code, m_tmpWidth, m_useCounts, unspillableTmps);
+            if (!allocator.requiresSpilling()) {
+                assignRegistersToTmp(allocator);
+                if (traceDebug)
+                    dataLog("Successfull allocation at iteration ", m_numIterations, ":\n", m_code);
+
+                return;
+            }
+            addSpillAndFill<type>(allocator, unspillableTmps);
+        }
+    }
+
+    template<Arg::Type type>
+    HashSet<unsigned> computeUnspillableTmps()
+    {
+        HashSet<unsigned> unspillableTmps;
+
+        struct Range {
+            unsigned first { std::numeric_limits<unsigned>::max() };
+            unsigned last { 0 };
+            unsigned count { 0 };
+            unsigned admitStackCount { 0 };
+        };
+
+        unsigned numTmps = m_code.numTmps(type);
+        unsigned arraySize = AbsoluteTmpMapper<type>::absoluteIndex(numTmps);
+
+        Vector<Range, 0, UnsafeVectorOverflow> ranges;
+        ranges.fill(Range(), arraySize);
+
+        unsigned globalIndex = 0;
+        for (BasicBlock* block : m_code) {
+            for (Inst& inst : *block) {
+                inst.forEachArg([&] (Arg& arg, Arg::Role, Arg::Type argType, Arg::Width) {
+                    if (arg.isTmp() && inst.admitsStack(arg)) {
+                        if (argType != type)
+                            return;
+
+                        Tmp tmp = arg.tmp();
+                        Range& range = ranges[AbsoluteTmpMapper<type>::absoluteIndex(tmp)];
+                        range.count++;
+                        range.admitStackCount++;
+                        if (globalIndex < range.first) {
+                            range.first = globalIndex;
+                            range.last = globalIndex;
+                        } else
+                            range.last = globalIndex;
+
+                        return;
+                    }
+
+                    arg.forEachTmpFast([&] (Tmp& tmp) {
+                        if (tmp.isGP() != (type == Arg::GP))
+                            return;
+
+                        Range& range = ranges[AbsoluteTmpMapper<type>::absoluteIndex(tmp)];
+                        range.count++;
+                        if (globalIndex < range.first) {
+                            range.first = globalIndex;
+                            range.last = globalIndex;
+                        } else
+                            range.last = globalIndex;
+                    });
+                });
+
+                ++globalIndex;
+            }
+            ++globalIndex;
+        }
+        for (unsigned i = AbsoluteTmpMapper<type>::lastMachineRegisterIndex() + 1; i < ranges.size(); ++i) {
+            Range& range = ranges[i];
+            if (range.last - range.first <= 1 && range.count > range.admitStackCount)
+                unspillableTmps.add(i);
+        }
+
+        return unspillableTmps;
+    }
+
+    template<Arg::Type type>
+    void assignRegistersToTmp(const ColoringAllocator<type>& allocator)
+    {
+        for (BasicBlock* block : m_code) {
+            // Give Tmp a valid register.
+            for (unsigned instIndex = 0; instIndex < block->size(); ++instIndex) {
+                Inst& inst = block->at(instIndex);
+
+                // The mayBeCoalescable() method will change its mind for some operations after we
+                // complete register allocation. So, we record this before starting.
+                bool mayBeCoalescable = allocator.mayBeCoalescable(inst);
+
+                // Move32 is cheaper if we know that it's equivalent to a Move. It's
+                // equivalent if the destination's high bits are not observable or if the source's high
+                // bits are all zero. Note that we don't have the opposite optimization for other
+                // architectures, which may prefer Move over Move32, because Move is canonical already.
+                if (type == Arg::GP && inst.kind.opcode == Move
+                    && inst.args[0].isTmp() && inst.args[1].isTmp()) {
+                    if (m_tmpWidth.useWidth(inst.args[1].tmp()) <= Arg::Width32
+                        || m_tmpWidth.defWidth(inst.args[0].tmp()) <= Arg::Width32)
+                        inst.kind.opcode = Move32;
+                }
+
+                inst.forEachTmpFast([&] (Tmp& tmp) {
+                    if (tmp.isReg() || tmp.isGP() == (type != Arg::GP))
+                        return;
+
+                    Tmp aliasTmp = allocator.getAlias(tmp);
+                    Tmp assignedTmp;
+                    if (aliasTmp.isReg())
+                        assignedTmp = Tmp(aliasTmp.reg());
+                    else {
+                        auto reg = allocator.allocatedReg(aliasTmp);
+                        ASSERT(reg);
+                        assignedTmp = Tmp(reg);
+                    }
+                    ASSERT(assignedTmp.isReg());
+                    tmp = assignedTmp;
+                });
+
+                if (mayBeCoalescable && inst.args[0].isTmp() && inst.args[1].isTmp()
+                    && inst.args[0].tmp() == inst.args[1].tmp())
+                    inst = Inst();
+            }
+
+            // Remove all the useless moves we created in this block.
+            block->insts().removeAllMatching([&] (const Inst& inst) {
+                return !inst;
+            });
+        }
+    }
+
+    static unsigned stackSlotMinimumWidth(Arg::Width width)
+    {
+        return width <= Arg::Width32 ? 4 : 8;
+    }
+
+    template<Arg::Type type>
+    void addSpillAndFill(const ColoringAllocator<type>& allocator, HashSet<unsigned>& unspillableTmps)
+    {
+        HashMap<Tmp, StackSlot*> stackSlots;
+        for (Tmp tmp : allocator.spilledTmps()) {
+            // All the spilled values become unspillable.
+            unspillableTmps.add(AbsoluteTmpMapper<type>::absoluteIndex(tmp));
+
+            // Allocate stack slot for each spilled value.
+            StackSlot* stackSlot = m_code.addStackSlot(
+                stackSlotMinimumWidth(m_tmpWidth.requiredWidth(tmp)), StackSlotKind::Spill);
+            bool isNewTmp = stackSlots.add(tmp, stackSlot).isNewEntry;
+            ASSERT_UNUSED(isNewTmp, isNewTmp);
+        }
+
+        // Rewrite the program to get rid of the spilled Tmp.
+        InsertionSet insertionSet(m_code);
+        for (BasicBlock* block : m_code) {
+            bool hasAliasedTmps = false;
+
+            for (unsigned instIndex = 0; instIndex < block->size(); ++instIndex) {
+                Inst& inst = block->at(instIndex);
+
+                // The TmpWidth analysis will say that a Move only stores 32 bits into the destination,
+                // if the source only had 32 bits worth of non-zero bits. Same for the source: it will
+                // only claim to read 32 bits from the source if only 32 bits of the destination are
+                // read. Note that we only apply this logic if this turns into a load or store, since
+                // Move is the canonical way to move data between GPRs.
+                bool canUseMove32IfDidSpill = false;
+                bool didSpill = false;
+                if (type == Arg::GP && inst.kind.opcode == Move) {
+                    if ((inst.args[0].isTmp() && m_tmpWidth.width(inst.args[0].tmp()) <= Arg::Width32)
+                        || (inst.args[1].isTmp() && m_tmpWidth.width(inst.args[1].tmp()) <= Arg::Width32))
+                        canUseMove32IfDidSpill = true;
+                }
+
+                // Try to replace the register use by memory use when possible.
+                inst.forEachArg(
+                    [&] (Arg& arg, Arg::Role role, Arg::Type argType, Arg::Width width) {
+                        if (!arg.isTmp())
+                            return;
+                        if (argType != type)
+                            return;
+                        if (arg.isReg())
+                            return;
+                        
+                        auto stackSlotEntry = stackSlots.find(arg.tmp());
+                        if (stackSlotEntry == stackSlots.end())
+                            return;
+                        if (!inst.admitsStack(arg))
+                            return;
+                        
+                        // If the Tmp holds a constant then we want to rematerialize its
+                        // value rather than loading it from the stack. In order for that
+                        // optimization to kick in, we need to avoid placing the Tmp's stack
+                        // address into the instruction.
+                        if (!Arg::isColdUse(role)) {
+                            const UseCounts<Tmp>::Counts* counts = m_useCounts[arg.tmp()];
+                            if (counts && counts->numConstDefs == 1 && counts->numDefs == 1)
+                                return;
+                        }
+                        
+                        Arg::Width spillWidth = m_tmpWidth.requiredWidth(arg.tmp());
+                        if (Arg::isAnyDef(role) && width < spillWidth)
+                            return;
+                        ASSERT(inst.kind.opcode == Move || !(Arg::isAnyUse(role) && width > spillWidth));
+                        
+                        if (spillWidth != Arg::Width32)
+                            canUseMove32IfDidSpill = false;
+                        
+                        stackSlotEntry->value->ensureSize(
+                            canUseMove32IfDidSpill ? 4 : Arg::bytes(width));
+                        arg = Arg::stack(stackSlotEntry->value);
+                        didSpill = true;
+                    });
+
+                if (didSpill && canUseMove32IfDidSpill)
+                    inst.kind.opcode = Move32;
+
+                // For every other case, add Load/Store as needed.
+                inst.forEachTmp([&] (Tmp& tmp, Arg::Role role, Arg::Type argType, Arg::Width) {
+                    if (tmp.isReg() || argType != type)
+                        return;
+
+                    auto stackSlotEntry = stackSlots.find(tmp);
+                    if (stackSlotEntry == stackSlots.end()) {
+                        Tmp alias = allocator.getAliasWhenSpilling(tmp);
+                        if (alias != tmp) {
+                            tmp = alias;
+                            hasAliasedTmps = true;
+                        }
+                        return;
+                    }
+
+                    Arg::Width spillWidth = m_tmpWidth.requiredWidth(tmp);
+                    Opcode move = Oops;
+                    switch (stackSlotMinimumWidth(spillWidth)) {
+                    case 4:
+                        move = type == Arg::GP ? Move32 : MoveFloat;
+                        break;
+                    case 8:
+                        move = type == Arg::GP ? Move : MoveDouble;
+                        break;
+                    default:
+                        RELEASE_ASSERT_NOT_REACHED();
+                        break;
+                    }
+
+                    tmp = m_code.newTmp(type);
+                    unspillableTmps.add(AbsoluteTmpMapper<type>::absoluteIndex(tmp));
+
+                    Arg arg = Arg::stack(stackSlotEntry->value);
+                    if (Arg::isAnyUse(role) && role != Arg::Scratch)
+                        insertionSet.insert(instIndex, move, inst.origin, arg, tmp);
+                    if (Arg::isAnyDef(role))
+                        insertionSet.insert(instIndex + 1, move, inst.origin, tmp, arg);
+                });
+            }
+            insertionSet.execute(block);
+
+            if (hasAliasedTmps) {
+                block->insts().removeAllMatching([&] (const Inst& inst) {
+                    return allocator.isUselessMove(inst);
+                });
+            }
+        }
+    }
+
+    void fixSpillsAfterTerminals()
+    {
+        // Because there may be terminals that produce values, IRC may
+        // want to spill those terminals. It'll happen to spill it after
+        // the terminal. If we left the graph in this state, it'd be invalid
+        // because a terminal must be the last instruction in a block.
+        // We fix that here.
+
+        InsertionSet insertionSet(m_code);
+
+        bool addedBlocks = false;
+
+        for (BasicBlock* block : m_code) {
+            unsigned terminalIndex = block->size();
+            bool foundTerminal = false;
+            while (terminalIndex--) {
+                if (block->at(terminalIndex).isTerminal()) {
+                    foundTerminal = true;
+                    break;
+                }
+            }
+            ASSERT_UNUSED(foundTerminal, foundTerminal);
+
+            if (terminalIndex == block->size() - 1)
+                continue;
+
+            // There must be instructions after the terminal because it's not the last instruction.
+            ASSERT(terminalIndex < block->size() - 1);
+            Vector<Inst, 1> instsToMove;
+            for (unsigned i = terminalIndex + 1; i < block->size(); i++)
+                instsToMove.append(block->at(i));
+            RELEASE_ASSERT(instsToMove.size());
+
+            for (FrequentedBlock& frequentedSuccessor : block->successors()) {
+                BasicBlock* successor = frequentedSuccessor.block();
+                // If successor's only predecessor is block, we can plant the spill inside
+                // the successor. Otherwise, we must split the critical edge and create
+                // a new block for the spill.
+                if (successor->numPredecessors() == 1) {
+                    insertionSet.insertInsts(0, instsToMove);
+                    insertionSet.execute(successor);
+                } else {
+                    addedBlocks = true;
+                    // FIXME: We probably want better block ordering here.
+                    BasicBlock* newBlock = m_code.addBlock();
+                    for (const Inst& inst : instsToMove)
+                        newBlock->appendInst(inst);
+                    newBlock->appendInst(Inst(Jump, instsToMove.last().origin));
+                    newBlock->successors().append(successor);
+                    frequentedSuccessor.block() = newBlock;
+                }
+            }
+
+            block->resize(terminalIndex + 1);
+        }
+
+        if (addedBlocks)
+            m_code.resetReachability();
+    }
+
+    Code& m_code;
+    TmpWidth m_tmpWidth;
+    UseCounts<Tmp> m_useCounts;
+    unsigned m_numIterations { 0 };
+};
+
+} // anonymous namespace
+
+void iteratedRegisterCoalescing(Code& code)
+{
+    PhaseScope phaseScope(code, "iteratedRegisterCoalescing");
+    
+    IteratedRegisterCoalescing iteratedRegisterCoalescing(code);
+    iteratedRegisterCoalescing.run();
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirIteratedRegisterCoalescing.h b/b3/air/AirIteratedRegisterCoalescing.h
new file mode 100644
index 0000000..ab689b3
--- /dev/null
+++ b/b3/air/AirIteratedRegisterCoalescing.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This is a register allocation phase based on Andrew Appel's Iterated Register Coalescing
+// http://www.cs.cmu.edu/afs/cs/academic/class/15745-s07/www/papers/george.pdf
+void iteratedRegisterCoalescing(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirKind.cpp b/b3/air/AirKind.cpp
new file mode 100644
index 0000000..9fe2525
--- /dev/null
+++ b/b3/air/AirKind.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirKind.h"
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/CommaPrinter.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+void Kind::dump(PrintStream& out) const
+{
+    out.print(opcode);
+    
+    CommaPrinter comma(", ", "<");
+    if (traps)
+        out.print(comma, "Traps");
+    if (comma.didPrint())
+        out.print(">");
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirKind.h b/b3/air/AirKind.h
new file mode 100644
index 0000000..e723d46
--- /dev/null
+++ b/b3/air/AirKind.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AirKind_h
+#define AirKind_h
+
+#if ENABLE(B3_JIT)
+
+#include "AirOpcode.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+// Air opcodes are always carried around with some flags. These flags are understood as having no
+// meaning if they are set for an opcode to which they do not apply. This makes sense, since Air
+// is a complex instruction set and most of these flags can apply to basically any opcode. In
+// fact, it's recommended to only represent something as a flag if you believe that it is largely
+// opcode-agnostic.
+
+struct Kind {
+    Kind(Opcode opcode)
+        : opcode(opcode)
+        , traps(false)
+    {
+    }
+    
+    Kind()
+        : Kind(Nop)
+    {
+    }
+    
+    bool operator==(const Kind& other) const
+    {
+        return opcode == other.opcode
+            && traps == other.traps;
+    }
+    
+    bool operator!=(const Kind& other) const
+    {
+        return !(*this == other);
+    }
+    
+    unsigned hash() const
+    {
+        return static_cast<unsigned>(opcode) + (static_cast<unsigned>(traps) << 16);
+    }
+    
+    explicit operator bool() const
+    {
+        return *this != Kind();
+    }
+    
+    void dump(PrintStream&) const;
+    
+    Opcode opcode;
+    
+    // This is an opcode-agnostic flag that indicates that we expect that this instruction will
+    // trap. This causes the compiler to assume that this side-exits and therefore has non-control
+    // non-arg effects. This also causes the compiler to tell you about all of these instructions.
+    // Note that this is just one of several ways of supporting trapping in Air, and it's the less
+    // precise variant because it's origin-based. This means that if an instruction was fused out
+    // of B3 values that had different origins, then the origin at which you'll appear to trap
+    // will be somewhat random. The upside of this approach is that it imposes by far the least
+    // overhead on the compiler.
+    // FIXME: Make this completely work.
+    // https://bugs.webkit.org/show_bug.cgi?id=162689
+    bool traps : 1;
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
+#endif // AirKind_h
+
diff --git a/b3/air/AirLiveness.h b/b3/air/AirLiveness.h
new file mode 100644
index 0000000..e727c36
--- /dev/null
+++ b/b3/air/AirLiveness.h
@@ -0,0 +1,392 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirBasicBlock.h"
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirStackSlot.h"
+#include "AirTmpInlines.h"
+#include <wtf/IndexMap.h>
+#include <wtf/IndexSet.h>
+#include <wtf/IndexSparseSet.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+template<Arg::Type adapterType>
+struct TmpLivenessAdapter {
+    typedef Tmp Thing;
+    typedef HashSet<unsigned> IndexSet;
+
+    TmpLivenessAdapter(Code&) { }
+
+    static unsigned numIndices(Code& code)
+    {
+        unsigned numTmps = code.numTmps(adapterType);
+        return AbsoluteTmpMapper<adapterType>::absoluteIndex(numTmps);
+    }
+    static bool acceptsType(Arg::Type type) { return type == adapterType; }
+    static unsigned valueToIndex(Tmp tmp) { return AbsoluteTmpMapper<adapterType>::absoluteIndex(tmp); }
+    static Tmp indexToValue(unsigned index) { return AbsoluteTmpMapper<adapterType>::tmpFromAbsoluteIndex(index); }
+};
+
+struct StackSlotLivenessAdapter {
+    typedef StackSlot* Thing;
+    typedef HashSet<unsigned, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned>> IndexSet;
+
+    StackSlotLivenessAdapter(Code& code)
+        : m_code(code)
+    {
+    }
+
+    static unsigned numIndices(Code& code)
+    {
+        return code.stackSlots().size();
+    }
+    static bool acceptsType(Arg::Type) { return true; }
+    static unsigned valueToIndex(StackSlot* stackSlot) { return stackSlot->index(); }
+    StackSlot* indexToValue(unsigned index) { return m_code.stackSlots()[index]; }
+
+private:
+    Code& m_code;
+};
+
+struct RegLivenessAdapter {
+    typedef Reg Thing;
+    typedef BitVector IndexSet;
+
+    RegLivenessAdapter(Code&) { }
+
+    static unsigned numIndices(Code&)
+    {
+        return Reg::maxIndex() + 1;
+    }
+
+    static bool acceptsType(Arg::Type) { return true; }
+    static unsigned valueToIndex(Reg reg) { return reg.index(); }
+    Reg indexToValue(unsigned index) { return Reg::fromIndex(index); }
+};
+
+template<typename Adapter>
+class AbstractLiveness : public Adapter {
+    struct Workset;
+public:
+    typedef typename Adapter::Thing Thing;
+    
+    AbstractLiveness(Code& code)
+        : Adapter(code)
+        , m_workset(Adapter::numIndices(code))
+        , m_liveAtHead(code.size())
+        , m_liveAtTail(code.size())
+    {
+        // The liveAtTail of each block automatically contains the LateUse's of the terminal.
+        for (BasicBlock* block : code) {
+            typename Adapter::IndexSet& liveAtTail = m_liveAtTail[block];
+
+            block->last().forEach<typename Adapter::Thing>(
+                [&] (typename Adapter::Thing& thing, Arg::Role role, Arg::Type type, Arg::Width) {
+                    if (Arg::isLateUse(role) && Adapter::acceptsType(type))
+                        liveAtTail.add(Adapter::valueToIndex(thing));
+                });
+        }
+
+        // Blocks with new live values at tail.
+        BitVector dirtyBlocks;
+        for (size_t blockIndex = 0; blockIndex < code.size(); ++blockIndex)
+            dirtyBlocks.set(blockIndex);
+
+        bool changed;
+        do {
+            changed = false;
+
+            for (size_t blockIndex = code.size(); blockIndex--;) {
+                BasicBlock* block = code.at(blockIndex);
+                if (!block)
+                    continue;
+
+                if (!dirtyBlocks.quickClear(blockIndex))
+                    continue;
+
+                LocalCalc localCalc(*this, block);
+                for (size_t instIndex = block->size(); instIndex--;)
+                    localCalc.execute(instIndex);
+
+                // Handle the early def's of the first instruction.
+                block->at(0).forEach<typename Adapter::Thing>(
+                    [&] (typename Adapter::Thing& thing, Arg::Role role, Arg::Type type, Arg::Width) {
+                        if (Arg::isEarlyDef(role) && Adapter::acceptsType(type))
+                            m_workset.remove(Adapter::valueToIndex(thing));
+                    });
+
+                Vector<unsigned>& liveAtHead = m_liveAtHead[block];
+
+                // We only care about Tmps that were discovered in this iteration. It is impossible
+                // to remove a live value from the head.
+                // We remove all the values we already knew about so that we only have to deal with
+                // what is new in LiveAtHead.
+                if (m_workset.size() == liveAtHead.size())
+                    m_workset.clear();
+                else {
+                    for (unsigned liveIndexAtHead : liveAtHead)
+                        m_workset.remove(liveIndexAtHead);
+                }
+
+                if (m_workset.isEmpty())
+                    continue;
+
+                liveAtHead.reserveCapacity(liveAtHead.size() + m_workset.size());
+                for (unsigned newValue : m_workset)
+                    liveAtHead.uncheckedAppend(newValue);
+
+                for (BasicBlock* predecessor : block->predecessors()) {
+                    typename Adapter::IndexSet& liveAtTail = m_liveAtTail[predecessor];
+                    for (unsigned newValue : m_workset) {
+                        if (liveAtTail.add(newValue)) {
+                            if (!dirtyBlocks.quickSet(predecessor->index()))
+                                changed = true;
+                        }
+                    }
+                }
+            }
+        } while (changed);
+    }
+
+    // This calculator has to be run in reverse.
+    class LocalCalc {
+    public:
+        LocalCalc(AbstractLiveness& liveness, BasicBlock* block)
+            : m_liveness(liveness)
+            , m_block(block)
+        {
+            auto& workset = liveness.m_workset;
+            workset.clear();
+            typename Adapter::IndexSet& liveAtTail = liveness.m_liveAtTail[block];
+            for (unsigned index : liveAtTail)
+                workset.add(index);
+        }
+
+        struct Iterator {
+            Iterator(Adapter& adapter, IndexSparseSet<UnsafeVectorOverflow>::const_iterator sparceSetIterator)
+                : m_adapter(adapter)
+                , m_sparceSetIterator(sparceSetIterator)
+            {
+            }
+
+            Iterator& operator++()
+            {
+                ++m_sparceSetIterator;
+                return *this;
+            }
+
+            typename Adapter::Thing operator*() const
+            {
+                return m_adapter.indexToValue(*m_sparceSetIterator);
+            }
+
+            bool operator==(const Iterator& other) { return m_sparceSetIterator == other.m_sparceSetIterator; }
+            bool operator!=(const Iterator& other) { return m_sparceSetIterator != other.m_sparceSetIterator; }
+
+        private:
+            Adapter& m_adapter;
+            IndexSparseSet<UnsafeVectorOverflow>::const_iterator m_sparceSetIterator;
+        };
+
+        struct Iterable {
+            Iterable(AbstractLiveness& liveness)
+                : m_liveness(liveness)
+            {
+            }
+
+            Iterator begin() const { return Iterator(m_liveness, m_liveness.m_workset.begin()); }
+            Iterator end() const { return Iterator(m_liveness, m_liveness.m_workset.end()); }
+            
+            bool contains(const typename Adapter::Thing& thing) const
+            {
+                return m_liveness.m_workset.contains(Adapter::valueToIndex(thing));
+            }
+
+        private:
+            AbstractLiveness& m_liveness;
+        };
+
+        Iterable live() const
+        {
+            return Iterable(m_liveness);
+        }
+
+        bool isLive(const typename Adapter::Thing& thing) const
+        {
+            return live().contains(thing);
+        }
+
+        void execute(unsigned instIndex)
+        {
+            Inst& inst = m_block->at(instIndex);
+            auto& workset = m_liveness.m_workset;
+
+            // First handle the early def's of the next instruction.
+            if (instIndex + 1 < m_block->size()) {
+                Inst& nextInst = m_block->at(instIndex + 1);
+                nextInst.forEach<typename Adapter::Thing>(
+                    [&] (typename Adapter::Thing& thing, Arg::Role role, Arg::Type type, Arg::Width) {
+                        if (Arg::isEarlyDef(role) && Adapter::acceptsType(type))
+                            workset.remove(Adapter::valueToIndex(thing));
+                    });
+            }
+            
+            // Then handle def's.
+            inst.forEach<typename Adapter::Thing>(
+                [&] (typename Adapter::Thing& thing, Arg::Role role, Arg::Type type, Arg::Width) {
+                    if (Arg::isLateDef(role) && Adapter::acceptsType(type))
+                        workset.remove(Adapter::valueToIndex(thing));
+                });
+
+            // Then handle use's.
+            inst.forEach<typename Adapter::Thing>(
+                [&] (typename Adapter::Thing& thing, Arg::Role role, Arg::Type type, Arg::Width) {
+                    if (Arg::isEarlyUse(role) && Adapter::acceptsType(type))
+                        workset.add(Adapter::valueToIndex(thing));
+                });
+
+            // And finally, handle the late use's of the previous instruction.
+            if (instIndex) {
+                Inst& prevInst = m_block->at(instIndex - 1);
+                prevInst.forEach<typename Adapter::Thing>(
+                    [&] (typename Adapter::Thing& thing, Arg::Role role, Arg::Type type, Arg::Width) {
+                        if (Arg::isLateUse(role) && Adapter::acceptsType(type))
+                            workset.add(Adapter::valueToIndex(thing));
+                    });
+            }
+        }
+
+    private:
+        AbstractLiveness& m_liveness;
+        BasicBlock* m_block;
+    };
+
+    const Vector<unsigned>& rawLiveAtHead(BasicBlock* block)
+    {
+        return m_liveAtHead[block];
+    }
+
+    template<typename UnderlyingIterable>
+    class Iterable {
+    public:
+        Iterable(AbstractLiveness& liveness, const UnderlyingIterable& iterable)
+            : m_liveness(liveness)
+            , m_iterable(iterable)
+        {
+        }
+
+        class iterator {
+        public:
+            iterator()
+                : m_liveness(nullptr)
+                , m_iter()
+            {
+            }
+            
+            iterator(AbstractLiveness& liveness, typename UnderlyingIterable::const_iterator iter)
+                : m_liveness(&liveness)
+                , m_iter(iter)
+            {
+            }
+
+            typename Adapter::Thing operator*()
+            {
+                return m_liveness->indexToValue(*m_iter);
+            }
+
+            iterator& operator++()
+            {
+                ++m_iter;
+                return *this;
+            }
+
+            bool operator==(const iterator& other) const
+            {
+                ASSERT(m_liveness == other.m_liveness);
+                return m_iter == other.m_iter;
+            }
+
+            bool operator!=(const iterator& other) const
+            {
+                return !(*this == other);
+            }
+
+        private:
+            AbstractLiveness* m_liveness;
+            typename UnderlyingIterable::const_iterator m_iter;
+        };
+
+        iterator begin() const { return iterator(m_liveness, m_iterable.begin()); }
+        iterator end() const { return iterator(m_liveness, m_iterable.end()); }
+
+        bool contains(const typename Adapter::Thing& thing) const
+        {
+            return m_liveness.m_workset.contains(Adapter::valueToIndex(thing));
+        }
+
+    private:
+        AbstractLiveness& m_liveness;
+        const UnderlyingIterable& m_iterable;
+    };
+
+    Iterable<Vector<unsigned>> liveAtHead(BasicBlock* block)
+    {
+        return Iterable<Vector<unsigned>>(*this, m_liveAtHead[block]);
+    }
+
+    Iterable<typename Adapter::IndexSet> liveAtTail(BasicBlock* block)
+    {
+        return Iterable<typename Adapter::IndexSet>(*this, m_liveAtTail[block]);
+    }
+
+    IndexSparseSet<UnsafeVectorOverflow>& workset() { return m_workset; }
+
+private:
+    friend class LocalCalc;
+    friend struct LocalCalc::Iterable;
+
+    IndexSparseSet<UnsafeVectorOverflow> m_workset;
+    IndexMap<BasicBlock, Vector<unsigned>> m_liveAtHead;
+    IndexMap<BasicBlock, typename Adapter::IndexSet> m_liveAtTail;
+};
+
+template<Arg::Type type>
+using TmpLiveness = AbstractLiveness<TmpLivenessAdapter<type>>;
+
+typedef AbstractLiveness<TmpLivenessAdapter<Arg::GP>> GPLiveness;
+typedef AbstractLiveness<TmpLivenessAdapter<Arg::FP>> FPLiveness;
+typedef AbstractLiveness<StackSlotLivenessAdapter> StackSlotLiveness;
+typedef AbstractLiveness<RegLivenessAdapter> RegLiveness;
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirLogRegisterPressure.cpp b/b3/air/AirLogRegisterPressure.cpp
new file mode 100644
index 0000000..dbbb257
--- /dev/null
+++ b/b3/air/AirLogRegisterPressure.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AirLogRegisterPressure.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirArgInlines.h"
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirLiveness.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+void logRegisterPressure(Code& code)
+{
+    const unsigned totalColumns = 200;
+    const unsigned registerColumns = 100;
+    
+    RegLiveness liveness(code);
+
+    for (BasicBlock* block : code) {
+        RegLiveness::LocalCalc localCalc(liveness, block);
+
+        block->dumpHeader(WTF::dataFile());
+
+        Vector<CString> instDumps;
+        for (unsigned instIndex = block->size(); instIndex--;) {
+            Inst& inst = block->at(instIndex);
+            Inst* prevInst = block->get(instIndex - 1);
+
+            localCalc.execute(instIndex);
+
+            RegisterSet set;
+            set.setAll(localCalc.live());
+            Inst::forEachDefWithExtraClobberedRegs<Reg>(
+                prevInst, &inst,
+                [&] (Reg reg, Arg::Role, Arg::Type, Arg::Width) {
+                    set.set(reg);
+                });
+
+            StringPrintStream instOut;
+            StringPrintStream lineOut;
+            lineOut.print("   ");
+            if (set.numberOfSetRegisters()) {
+                set.forEach(
+                    [&] (Reg reg) {
+                        CString text = toCString(" ", reg);
+                        if (text.length() + lineOut.length() > totalColumns) {
+                            instOut.print(lineOut.toCString(), "\n");
+                            lineOut.reset();
+                            lineOut.print("       ");
+                        }
+                        lineOut.print(text);
+                    });
+                lineOut.print(":");
+            }
+            if (lineOut.length() > registerColumns) {
+                instOut.print(lineOut.toCString(), "\n");
+                lineOut.reset();
+            }
+            while (lineOut.length() < registerColumns)
+                lineOut.print(" ");
+            lineOut.print(" ");
+            lineOut.print(inst);
+            instOut.print(lineOut.toCString(), "\n");
+            instDumps.append(instOut.toCString());
+        }
+
+        for (unsigned i = instDumps.size(); i--;)
+            dataLog(instDumps[i]);
+        
+        block->dumpFooter(WTF::dataFile());
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirLogRegisterPressure.h b/b3/air/AirLogRegisterPressure.h
new file mode 100644
index 0000000..3f7c3e2
--- /dev/null
+++ b/b3/air/AirLogRegisterPressure.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// Dumps the registers that are used at each instruction.
+void logRegisterPressure(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirLowerAfterRegAlloc.cpp b/b3/air/AirLowerAfterRegAlloc.cpp
new file mode 100644
index 0000000..e001873
--- /dev/null
+++ b/b3/air/AirLowerAfterRegAlloc.cpp
@@ -0,0 +1,250 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirLowerAfterRegAlloc.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirArgInlines.h"
+#include "AirCCallingConvention.h"
+#include "AirCode.h"
+#include "AirEmitShuffle.h"
+#include "AirInsertionSet.h"
+#include "AirInstInlines.h"
+#include "AirLiveness.h"
+#include "AirPhaseScope.h"
+#include "B3CCallValue.h"
+#include "B3ValueInlines.h"
+#include "RegisterSet.h"
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+bool verbose = false;
+    
+} // anonymous namespace
+
+void lowerAfterRegAlloc(Code& code)
+{
+    PhaseScope phaseScope(code, "lowerAfterRegAlloc");
+
+    if (verbose)
+        dataLog("Code before lowerAfterRegAlloc:\n", code);
+
+    HashMap<Inst*, RegisterSet> usedRegisters;
+
+    RegLiveness liveness(code);
+    for (BasicBlock* block : code) {
+        RegLiveness::LocalCalc localCalc(liveness, block);
+
+        for (unsigned instIndex = block->size(); instIndex--;) {
+            Inst& inst = block->at(instIndex);
+            
+            RegisterSet set;
+
+            bool isRelevant = inst.kind.opcode == Shuffle || inst.kind.opcode == ColdCCall;
+            
+            if (isRelevant) {
+                for (Reg reg : localCalc.live())
+                    set.set(reg);
+            }
+            
+            localCalc.execute(instIndex);
+
+            if (isRelevant)
+                usedRegisters.add(&inst, set);
+        }
+    }
+
+    auto getScratches = [&] (RegisterSet set, Arg::Type type) -> std::array<Arg, 2> {
+        std::array<Arg, 2> result;
+        for (unsigned i = 0; i < 2; ++i) {
+            bool found = false;
+            for (Reg reg : code.regsInPriorityOrder(type)) {
+                if (!set.get(reg)) {
+                    result[i] = Tmp(reg);
+                    set.set(reg);
+                    found = true;
+                    break;
+                }
+            }
+            if (!found) {
+                result[i] = Arg::stack(
+                    code.addStackSlot(
+                        Arg::bytes(Arg::conservativeWidth(type)),
+                        StackSlotKind::Spill));
+            }
+        }
+        return result;
+    };
+
+    // Now transform the code.
+    InsertionSet insertionSet(code);
+    for (BasicBlock* block : code) {
+        for (unsigned instIndex = 0; instIndex < block->size(); ++instIndex) {
+            Inst& inst = block->at(instIndex);
+
+            switch (inst.kind.opcode) {
+            case Shuffle: {
+                RegisterSet set = usedRegisters.get(&inst);
+                Vector<ShufflePair> pairs;
+                for (unsigned i = 0; i < inst.args.size(); i += 3) {
+                    Arg src = inst.args[i + 0];
+                    Arg dst = inst.args[i + 1];
+                    Arg::Width width = inst.args[i + 2].width();
+
+                    // The used register set contains things live after the shuffle. But
+                    // emitShuffle() wants a scratch register that is not just dead but also does not
+                    // interfere with either sources or destinations.
+                    auto excludeRegisters = [&] (Tmp tmp) {
+                        if (tmp.isReg())
+                            set.set(tmp.reg());
+                    };
+                    src.forEachTmpFast(excludeRegisters);
+                    dst.forEachTmpFast(excludeRegisters);
+                    
+                    pairs.append(ShufflePair(src, dst, width));
+                }
+                std::array<Arg, 2> gpScratch = getScratches(set, Arg::GP);
+                std::array<Arg, 2> fpScratch = getScratches(set, Arg::FP);
+                insertionSet.insertInsts(
+                    instIndex, emitShuffle(code, pairs, gpScratch, fpScratch, inst.origin));
+                inst = Inst();
+                break;
+            }
+
+            case ColdCCall: {
+                CCallValue* value = inst.origin->as<CCallValue>();
+                Kind oldKind = inst.kind;
+
+                RegisterSet liveRegs = usedRegisters.get(&inst);
+                RegisterSet regsToSave = liveRegs;
+                regsToSave.exclude(RegisterSet::calleeSaveRegisters());
+                regsToSave.exclude(RegisterSet::stackRegisters());
+                regsToSave.exclude(RegisterSet::reservedHardwareRegisters());
+
+                RegisterSet preUsed = regsToSave;
+                Vector<Arg> destinations = computeCCallingConvention(code, value);
+                Tmp result = cCallResult(value->type());
+                Arg originalResult = result ? inst.args[1] : Arg();
+                
+                Vector<ShufflePair> pairs;
+                for (unsigned i = 0; i < destinations.size(); ++i) {
+                    Value* child = value->child(i);
+                    Arg src = inst.args[result ? (i >= 1 ? i + 1 : i) : i ];
+                    Arg dst = destinations[i];
+                    Arg::Width width = Arg::widthForB3Type(child->type());
+                    pairs.append(ShufflePair(src, dst, width));
+
+                    auto excludeRegisters = [&] (Tmp tmp) {
+                        if (tmp.isReg())
+                            preUsed.set(tmp.reg());
+                    };
+                    src.forEachTmpFast(excludeRegisters);
+                    dst.forEachTmpFast(excludeRegisters);
+                }
+
+                std::array<Arg, 2> gpScratch = getScratches(preUsed, Arg::GP);
+                std::array<Arg, 2> fpScratch = getScratches(preUsed, Arg::FP);
+                
+                // Also need to save all live registers. Don't need to worry about the result
+                // register.
+                if (originalResult.isReg())
+                    regsToSave.clear(originalResult.reg());
+                Vector<StackSlot*> stackSlots;
+                regsToSave.forEach(
+                    [&] (Reg reg) {
+                        Tmp tmp(reg);
+                        Arg arg(tmp);
+                        Arg::Width width = Arg::conservativeWidth(arg.type());
+                        StackSlot* stackSlot =
+                            code.addStackSlot(Arg::bytes(width), StackSlotKind::Spill);
+                        pairs.append(ShufflePair(arg, Arg::stack(stackSlot), width));
+                        stackSlots.append(stackSlot);
+                    });
+
+                if (verbose)
+                    dataLog("Pre-call pairs for ", inst, ": ", listDump(pairs), "\n");
+                
+                insertionSet.insertInsts(
+                    instIndex, emitShuffle(code, pairs, gpScratch, fpScratch, inst.origin));
+
+                inst = buildCCall(code, inst.origin, destinations);
+                if (oldKind.traps)
+                    inst.kind.traps = true;
+
+                // Now we need to emit code to restore registers.
+                pairs.resize(0);
+                unsigned stackSlotIndex = 0;
+                regsToSave.forEach(
+                    [&] (Reg reg) {
+                        Tmp tmp(reg);
+                        Arg arg(tmp);
+                        Arg::Width width = Arg::conservativeWidth(arg.type());
+                        StackSlot* stackSlot = stackSlots[stackSlotIndex++];
+                        pairs.append(ShufflePair(Arg::stack(stackSlot), arg, width));
+                    });
+                if (result) {
+                    ShufflePair pair(result, originalResult, Arg::widthForB3Type(value->type()));
+                    pairs.append(pair);
+                }
+
+                // For finding scratch registers, we need to account for the possibility that
+                // the result is dead.
+                if (originalResult.isReg())
+                    liveRegs.set(originalResult.reg());
+
+                gpScratch = getScratches(liveRegs, Arg::GP);
+                fpScratch = getScratches(liveRegs, Arg::FP);
+                
+                insertionSet.insertInsts(
+                    instIndex + 1, emitShuffle(code, pairs, gpScratch, fpScratch, inst.origin));
+                break;
+            }
+
+            default:
+                break;
+            }
+        }
+
+        insertionSet.execute(block);
+
+        block->insts().removeAllMatching(
+            [&] (Inst& inst) -> bool {
+                return !inst;
+            });
+    }
+
+    if (verbose)
+        dataLog("Code after lowerAfterRegAlloc:\n", code);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirLowerAfterRegAlloc.h b/b3/air/AirLowerAfterRegAlloc.h
new file mode 100644
index 0000000..d8234a7
--- /dev/null
+++ b/b3/air/AirLowerAfterRegAlloc.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This lowers Shuffle and ColdCCall instructions. This phase is designed to be run after register
+// allocation.
+
+void lowerAfterRegAlloc(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirLowerEntrySwitch.cpp b/b3/air/AirLowerEntrySwitch.cpp
new file mode 100644
index 0000000..e14641d
--- /dev/null
+++ b/b3/air/AirLowerEntrySwitch.cpp
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirLowerEntrySwitch.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirBlockWorklist.h"
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirPhaseScope.h"
+#include "B3Procedure.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+void lowerEntrySwitch(Code& code)
+{
+    PhaseScope phaseScope(code, "lowerEntrySwitch");
+    
+    // Figure out the set of blocks that should be duplicated.
+    BlockWorklist worklist;
+    for (BasicBlock* block : code) {
+        if (block->last().kind.opcode == EntrySwitch)
+            worklist.push(block);
+    }
+    
+    // It's possible that we don't have any EntrySwitches. That's fine.
+    if (worklist.seen().isEmpty()) {
+        Vector<FrequentedBlock> entrypoints(code.proc().numEntrypoints(), FrequentedBlock(code[0]));
+        code.setEntrypoints(WTFMove(entrypoints));
+        return;
+    }
+    
+    while (BasicBlock* block = worklist.pop())
+        worklist.pushAll(block->predecessors());
+    
+    RELEASE_ASSERT(worklist.saw(code[0]));
+    
+    Vector<FrequencyClass> entrypointFrequencies(code.proc().numEntrypoints(), FrequencyClass::Rare);
+    for (BasicBlock* block : code) {
+        if (block->last().kind.opcode != EntrySwitch)
+            continue;
+        for (unsigned entrypointIndex = code.proc().numEntrypoints(); entrypointIndex--;) {
+            entrypointFrequencies[entrypointIndex] = maxFrequency(
+                entrypointFrequencies[entrypointIndex],
+                block->successor(entrypointIndex).frequency());
+        }
+    }
+    
+    auto fixEntrySwitch = [&] (BasicBlock* block, unsigned entrypointIndex) {
+        if (block->last().kind.opcode != EntrySwitch)
+            return;
+        FrequentedBlock target = block->successor(entrypointIndex);
+        block->last().kind.opcode = Jump;
+        block->successors().resize(1);
+        block->successor(0) = target;
+    };
+    
+    // Now duplicate them.
+    Vector<FrequentedBlock> entrypoints;
+    entrypoints.append(FrequentedBlock(code[0], entrypointFrequencies[0]));
+    IndexMap<BasicBlock, BasicBlock*> map(code.size());
+    for (unsigned entrypointIndex = 1; entrypointIndex < code.proc().numEntrypoints(); ++entrypointIndex) {
+        map.clear();
+        for (BasicBlock* block : worklist.seen().values(code))
+            map[block] = code.addBlock(block->frequency());
+        entrypoints.append(FrequentedBlock(map[code[0]], entrypointFrequencies[entrypointIndex]));
+        for (BasicBlock* block : worklist.seen().values(code)) {
+            BasicBlock* newBlock = map[block];
+            for (const Inst& inst : *block)
+                newBlock->appendInst(inst);
+            newBlock->successors() = block->successors();
+            for (BasicBlock*& successor : newBlock->successorBlocks()) {
+                if (BasicBlock* replacement = map[successor])
+                    successor = replacement;
+            }
+            fixEntrySwitch(newBlock, entrypointIndex);
+        }
+    }
+    for (BasicBlock* block : worklist.seen().values(code))
+        fixEntrySwitch(block, 0);
+    
+    code.setEntrypoints(WTFMove(entrypoints));
+    code.resetReachability();
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
+
diff --git a/b3/air/AirLowerEntrySwitch.h b/b3/air/AirLowerEntrySwitch.h
new file mode 100644
index 0000000..ff35007
--- /dev/null
+++ b/b3/air/AirLowerEntrySwitch.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// Converts code that seems to have one entrypoint and emulates multiple entrypoints with
+// EntrySwitch into code that really has multiple entrypoints. This is accomplished by duplicating
+// the backwards transitive closure from all EntrySwitches.
+void lowerEntrySwitch(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirLowerMacros.cpp b/b3/air/AirLowerMacros.cpp
new file mode 100644
index 0000000..b086b7b
--- /dev/null
+++ b/b3/air/AirLowerMacros.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirLowerMacros.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCCallingConvention.h"
+#include "AirCode.h"
+#include "AirInsertionSet.h"
+#include "AirInstInlines.h"
+#include "AirPhaseScope.h"
+#include "B3CCallValue.h"
+#include "B3ValueInlines.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+void lowerMacros(Code& code)
+{
+    PhaseScope phaseScope(code, "lowerMacros");
+
+    InsertionSet insertionSet(code);
+    for (BasicBlock* block : code) {
+        for (unsigned instIndex = 0; instIndex < block->size(); ++instIndex) {
+            Inst& inst = block->at(instIndex);
+
+            switch (inst.kind.opcode) {
+            case CCall: {
+                CCallValue* value = inst.origin->as<CCallValue>();
+                Kind oldKind = inst.kind;
+
+                Vector<Arg> destinations = computeCCallingConvention(code, value);
+
+                Inst shuffleArguments(Shuffle, value);
+                unsigned offset = value->type() == Void ? 0 : 1;
+                for (unsigned i = 1; i < destinations.size(); ++i) {
+                    Value* child = value->child(i);
+                    shuffleArguments.args.append(inst.args[offset + i]);
+                    shuffleArguments.args.append(destinations[i]);
+                    shuffleArguments.args.append(Arg::widthArg(Arg::widthForB3Type(child->type())));
+                }
+                insertionSet.insertInst(instIndex, WTFMove(shuffleArguments));
+
+                // Indicate that we're using our original callee argument.
+                destinations[0] = inst.args[0];
+
+                // Save where the original instruction put its result.
+                Arg resultDst = value->type() == Void ? Arg() : inst.args[1];
+                
+                inst = buildCCall(code, inst.origin, destinations);
+                if (oldKind.traps)
+                    inst.kind.traps = true;
+
+                Tmp result = cCallResult(value->type());
+                switch (value->type()) {
+                case Void:
+                    break;
+                case Float:
+                    insertionSet.insert(instIndex + 1, MoveFloat, value, result, resultDst);
+                    break;
+                case Double:
+                    insertionSet.insert(instIndex + 1, MoveDouble, value, result, resultDst);
+                    break;
+                case Int32:
+                    insertionSet.insert(instIndex + 1, Move32, value, result, resultDst);
+                    break;
+                case Int64:
+                    insertionSet.insert(instIndex + 1, Move, value, result, resultDst);
+                    break;
+                }
+                break;
+            }
+
+            default:
+                break;
+            }
+        }
+        insertionSet.execute(block);
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirLowerMacros.h b/b3/air/AirLowerMacros.h
new file mode 100644
index 0000000..2dcd76d
--- /dev/null
+++ b/b3/air/AirLowerMacros.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// Air has some opcodes that are very high-level and are meant to reduce the amount of low-level
+// knowledge in the B3->Air lowering. The current example is CCall.
+
+void lowerMacros(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirOpcode.opcodes b/b3/air/AirOpcode.opcodes
new file mode 100644
index 0000000..4170f74
--- /dev/null
+++ b/b3/air/AirOpcode.opcodes
@@ -0,0 +1,931 @@
+# Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Syllabus:
+#
+# Examples of some roles, types, and widths:
+# U:G:32 => use of the low 32 bits of a general-purpose register or value
+# D:G:32 => def of the low 32 bits of a general-purpose register or value
+# UD:G:32 => use and def of the low 32 bits of a general-purpose register or value
+# U:G:64 => use of the low 64 bits of a general-purpose register or value
+# ZD:G:32 => def of all bits of a general-purpose register, where all but the low 32 bits are guaranteed to be zeroed.
+# UA:G:Ptr => UseAddr (see comment in Arg.h)
+# U:F:32 => use of a float register or value
+# U:F:64 => use of a double register or value
+# D:F:32 => def of a float register or value
+# UD:F:32 => use and def of a float register or value
+# S:F:32 => scratch float register.
+#
+# Argument kinds:
+# Tmp => temporary or register
+# Imm => 32-bit immediate int
+# BigImm => TrustedImm64
+# Addr => address as temporary/register+offset
+# Index => BaseIndex address
+# Abs => AbsoluteAddress
+#
+# The parser views these things as keywords, and understands that they fall into two distinct classes
+# of things. So, although this file uses a particular indentation style, none of the whitespace or
+# even newlines are meaningful to the parser. For example, you could write:
+#
+# Foo42 U:G:32, UD:F:32 Imm, Tmp Addr, Tmp
+#
+# And the parser would know that this is the same as:
+#
+# Foo42 U:G:32, UD:F:32
+#     Imm, Tmp
+#     Addr, Tmp
+#
+# I.e. a two-form instruction that uses a GPR or an int immediate and uses+defs a float register.
+#
+# Any opcode or opcode form can be preceded with an architecture list, which restricts the opcode to the
+# union of those architectures. For example, if this is the only overload of the opcode, then it makes the
+# opcode only available on x86_64:
+#
+# x86_64: Fuzz UD:G:64, D:G:64
+#     Tmp, Tmp
+#     Tmp, Addr
+#
+# But this only restricts the two-operand form, the other form is allowed on all architectures:
+#
+# x86_64: Fuzz UD:G:64, D:G:64
+#     Tmp, Tmp
+#     Tmp, Addr
+# Fuzz UD:G:Ptr, D:G:Ptr, U:F:Ptr
+#     Tmp, Tmp, Tmp
+#     Tmp, Addr, Tmp
+#
+# And you can also restrict individual forms:
+#
+# Thingy UD:G:32, D:G:32
+#     Tmp, Tmp
+#     arm64: Tmp, Addr
+#
+# Additionally, you can have an intersection between the architectures of the opcode overload and the
+# form. In this example, the version that takes an address is only available on armv7 while the other
+# versions are available on armv7 or x86_64:
+#
+# x86_64 armv7: Buzz U:G:32, UD:F:32
+#     Tmp, Tmp
+#     Imm, Tmp
+#     armv7: Addr, Tmp
+#
+# Finally, you can specify architectures using helpful architecture groups. Here are all of the
+# architecture keywords that we support:
+#
+# x86: means x86-32 or x86-64.
+# x86_32: means just x86-32.
+# x86_64: means just x86-64.
+# arm: means armv7 or arm64.
+# armv7: means just armv7.
+# arm64: means just arm64.
+# 32: means x86-32 or armv7.
+# 64: means x86-64 or arm64.
+
+# Note that the opcodes here have a leading capital (Add32) but must correspond to MacroAssembler
+# API that has a leading lower-case (add32).
+
+Nop
+
+Add32 U:G:32, U:G:32, ZD:G:32
+    Imm, Tmp, Tmp
+    Tmp, Tmp, Tmp
+
+Add32 U:G:32, UZD:G:32
+    Tmp, Tmp
+    x86: Imm, Addr
+    x86: Imm, Index
+    Imm, Tmp
+    x86: Addr, Tmp
+    x86: Tmp, Addr
+    x86: Tmp, Index
+
+x86: Add8 U:G:8, UD:G:8
+    Imm, Addr
+    Imm, Index
+    Tmp, Addr
+    Tmp, Index
+
+x86: Add16 U:G:16, UD:G:16
+    Imm, Addr
+    Imm, Index
+    Tmp, Addr
+    Tmp, Index
+
+64: Add64 U:G:64, UD:G:64
+    Tmp, Tmp
+    x86: Imm, Addr
+    Imm, Tmp
+    x86: Addr, Tmp
+    x86: Tmp, Addr
+
+64: Add64 U:G:64, U:G:64, D:G:64
+    Imm, Tmp, Tmp
+    Tmp, Tmp, Tmp
+
+AddDouble U:F:64, U:F:64, D:F:64
+    Tmp, Tmp, Tmp
+    x86: Addr, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Index, Tmp, Tmp
+
+x86: AddDouble U:F:64, UD:F:64
+    Tmp, Tmp
+    Addr, Tmp
+
+AddFloat U:F:32, U:F:32, D:F:32
+    Tmp, Tmp, Tmp
+    x86: Addr, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Index, Tmp, Tmp
+
+x86: AddFloat U:F:32, UD:F:32
+    Tmp, Tmp
+    Addr, Tmp
+
+Sub32 U:G:32, UZD:G:32
+    Tmp, Tmp
+    x86: Imm, Addr
+    Imm, Tmp
+    x86: Addr, Tmp
+    x86: Tmp, Addr
+
+arm64: Sub32 U:G:32, U:G:32, D:G:32
+    Tmp, Tmp, Tmp
+
+64: Sub64 U:G:64, UD:G:64
+    Tmp, Tmp
+    x86: Imm, Addr
+    Imm, Tmp
+    x86: Addr, Tmp
+    x86: Tmp, Addr
+
+arm64: Sub64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+
+SubDouble U:F:64, U:F:64, D:F:64
+    arm64: Tmp, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Tmp, Index, Tmp
+
+x86: SubDouble U:F:64, UD:F:64
+    Tmp, Tmp
+    Addr, Tmp
+
+SubFloat U:F:32, U:F:32, D:F:32
+    arm64: Tmp, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Tmp, Index, Tmp
+
+x86: SubFloat U:F:32, UD:F:32
+    Tmp, Tmp
+    Addr, Tmp
+
+Neg32 UZD:G:32
+    Tmp
+    x86: Addr
+
+64: Neg64 UD:G:64
+    Tmp
+
+arm64: NegateDouble U:F:64, D:F:64
+    Tmp, Tmp
+
+arm64: NegateFloat U:F:32, D:F:32
+    Tmp, Tmp
+
+Mul32 U:G:32, UZD:G:32
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+Mul32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+    x86: Addr, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Imm, Tmp, Tmp
+
+64: Mul64 U:G:64, UD:G:64
+    Tmp, Tmp
+
+Mul64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+
+arm64: MultiplyAdd32 U:G:32, U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp, Tmp
+
+arm64: MultiplyAdd64 U:G:64, U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp, Tmp
+
+arm64: MultiplySub32 U:G:32, U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp, Tmp
+
+arm64: MultiplySub64 U:G:64, U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp, Tmp
+
+arm64: MultiplyNeg32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+
+arm64: MultiplyNeg64 U:G:64, U:G:64, ZD:G:64
+    Tmp, Tmp, Tmp
+
+arm64: Div32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+
+arm64: UDiv32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+
+arm64: Div64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+
+arm64: UDiv64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+
+MulDouble U:F:64, U:F:64, D:F:64
+    Tmp, Tmp, Tmp
+    x86: Addr, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Index, Tmp, Tmp
+
+x86: MulDouble U:F:64, UD:F:64
+    Tmp, Tmp
+    Addr, Tmp
+
+MulFloat U:F:32, U:F:32, D:F:32
+    Tmp, Tmp, Tmp
+    x86: Addr, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Index, Tmp, Tmp
+
+x86: MulFloat U:F:32, UD:F:32
+    Tmp, Tmp
+    Addr, Tmp
+
+arm64: DivDouble U:F:64, U:F:32, D:F:64
+    Tmp, Tmp, Tmp
+
+x86: DivDouble U:F:64, UD:F:64
+    Tmp, Tmp
+    Addr, Tmp
+
+arm64: DivFloat U:F:32, U:F:32, D:F:32
+    Tmp, Tmp, Tmp
+
+x86: DivFloat U:F:32, UD:F:32
+    Tmp, Tmp
+    Addr, Tmp
+
+x86: X86ConvertToDoubleWord32 U:G:32, ZD:G:32
+    Tmp*, Tmp*
+
+x86_64: X86ConvertToQuadWord64 U:G:64, D:G:64
+    Tmp*, Tmp*
+
+x86: X86Div32 UZD:G:32, UZD:G:32, U:G:32
+    Tmp*, Tmp*, Tmp
+
+x86: X86UDiv32 UZD:G:32, UZD:G:32, U:G:32
+    Tmp*, Tmp*, Tmp
+
+x86_64: X86Div64 UZD:G:64, UZD:G:64, U:G:64
+    Tmp*, Tmp*, Tmp
+
+x86_64: X86UDiv64 UZD:G:64, UZD:G:64, U:G:64
+    Tmp*, Tmp*, Tmp
+
+Lea32 UA:G:32, D:G:32
+    Addr, Tmp
+    x86: Index, Tmp as x86Lea32
+
+Lea64 UA:G:64, D:G:64
+    Addr, Tmp
+    x86: Index, Tmp as x86Lea64
+
+And32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+    arm64: BitImm, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Addr, Tmp, Tmp
+
+And32 U:G:32, UZD:G:32
+    Tmp, Tmp
+    x86: Imm, Tmp
+    x86: Tmp, Addr
+    x86: Addr, Tmp
+    x86: Imm, Addr
+
+64: And64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+    arm64: BitImm64, Tmp, Tmp
+
+x86_64: And64 U:G:64, UD:G:64
+    Tmp, Tmp
+    x86: Imm, Tmp
+
+AndDouble U:F:64, U:F:64, D:F:64
+    Tmp, Tmp, Tmp
+
+x86: AndDouble U:F:64, UD:F:64
+    Tmp, Tmp
+
+AndFloat U:F:32, U:F:32, D:F:32
+    Tmp, Tmp, Tmp
+
+x86: AndFloat U:F:32, UD:F:32
+    Tmp, Tmp
+
+x86: XorDouble U:F:64, U:F:64, D:F:64
+    Tmp, Tmp, Tmp
+
+x86: XorDouble U:F:64, UD:F:64
+    Tmp, Tmp
+
+x86: XorFloat U:F:32, U:F:32, D:F:32
+    Tmp, Tmp, Tmp
+
+x86: XorFloat U:F:32, UD:F:32
+    Tmp, Tmp
+
+arm64: Lshift32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+    Tmp, Imm, Tmp
+
+x86:Lshift32 U:G:32, UZD:G:32
+    Tmp*, Tmp
+    Imm, Tmp
+
+arm64: Lshift64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+    Tmp, Imm, Tmp
+
+x86_64: Lshift64 U:G:64, UD:G:64
+    Tmp*, Tmp
+    Imm, Tmp
+
+arm64: Rshift32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+    Tmp, Imm, Tmp
+
+x86: Rshift32 U:G:32, UZD:G:32
+    Tmp*, Tmp
+    Imm, Tmp
+
+arm64: Rshift64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+    Tmp, Imm, Tmp
+
+x86_64: Rshift64 U:G:64, UD:G:64
+    Tmp*, Tmp
+    Imm, Tmp
+
+arm64: Urshift32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+    Tmp, Imm, Tmp
+
+x86: Urshift32 U:G:32, UZD:G:32
+    Tmp*, Tmp
+    Imm, Tmp
+
+arm64: Urshift64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+    Tmp, Imm, Tmp
+
+x86_64: Urshift64 U:G:64, UD:G:64
+    Tmp*, Tmp
+    Imm, Tmp
+
+x86_64: RotateRight32 U:G:32, UZD:G:32
+    Tmp*, Tmp
+    Imm, Tmp
+
+arm64: RotateRight32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+    Tmp, Imm, Tmp
+
+x86_64: RotateRight64 U:G:64, UD:G:64
+    Tmp*, Tmp
+    Imm, Tmp
+
+arm64: RotateRight64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+    Tmp, Imm, Tmp
+
+x86_64: RotateLeft32 U:G:32, UZD:G:32
+    Tmp*, Tmp
+    Imm, Tmp
+
+x86_64: RotateLeft64 U:G:64, UD:G:64
+    Tmp*, Tmp
+    Imm, Tmp
+
+Or32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+    arm64: BitImm, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Addr, Tmp, Tmp
+
+Or32 U:G:32, UZD:G:32
+    Tmp, Tmp
+    x86: Imm, Tmp
+    x86: Tmp, Addr
+    x86: Addr, Tmp
+    x86: Imm, Addr
+
+64: Or64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+    arm64: BitImm64, Tmp, Tmp
+
+64: Or64 U:G:64, UD:G:64
+    Tmp, Tmp
+    x86: Imm, Tmp
+
+Xor32 U:G:32, U:G:32, ZD:G:32
+    Tmp, Tmp, Tmp
+    arm64: BitImm, Tmp, Tmp
+    x86: Tmp, Addr, Tmp
+    x86: Addr, Tmp, Tmp
+
+Xor32 U:G:32, UZD:G:32
+    Tmp, Tmp
+    x86: Imm, Tmp
+    x86: Tmp, Addr
+    x86: Addr, Tmp
+    x86: Imm, Addr
+
+64: Xor64 U:G:64, U:G:64, D:G:64
+    Tmp, Tmp, Tmp
+    arm64: BitImm64, Tmp, Tmp
+
+64: Xor64 U:G:64, UD:G:64
+    Tmp, Tmp
+    x86: Tmp, Addr
+    x86: Imm, Tmp
+
+arm64: Not32 U:G:32, ZD:G:32
+    Tmp, Tmp
+
+x86: Not32 UZD:G:32
+    Tmp
+    Addr
+
+arm64: Not64 U:G:64, D:G:64
+    Tmp, Tmp
+
+x86: Not64 UD:G:64
+    Tmp
+    Addr
+
+arm64: AbsDouble U:F:64, D:F:64
+    Tmp, Tmp
+
+arm64: AbsFloat U:F:32, D:F:32
+    Tmp, Tmp
+
+CeilDouble U:F:64, D:F:64
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+CeilFloat U:F:32, D:F:32
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+FloorDouble U:F:64, D:F:64
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+FloorFloat U:F:32, D:F:32
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+SqrtDouble U:F:64, D:F:64
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+SqrtFloat U:F:32, D:F:32
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+ConvertInt32ToDouble U:G:32, D:F:64
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+64: ConvertInt64ToDouble U:G:64, D:F:64
+    Tmp, Tmp
+    x86_64: Addr, Tmp
+
+ConvertInt32ToFloat U:G:32, D:F:32
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+64: ConvertInt64ToFloat U:G:64, D:F:32
+    Tmp, Tmp
+    x86_64: Addr, Tmp
+
+CountLeadingZeros32 U:G:32, ZD:G:32
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+64: CountLeadingZeros64 U:G:64, D:G:64
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+ConvertDoubleToFloat U:F:64, D:F:32
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+ConvertFloatToDouble U:F:32, D:F:64
+    Tmp, Tmp
+    x86: Addr, Tmp
+
+# Note that Move operates over the full register size, which is either 32-bit or 64-bit depending on
+# the platform. I'm not entirely sure that this is a good thing; it might be better to just have a
+# Move64 instruction. OTOH, our MacroAssemblers already have this notion of "move()" that basically
+# means movePtr.
+Move U:G:Ptr, D:G:Ptr
+    Tmp, Tmp
+    Imm, Tmp as signExtend32ToPtr
+    BigImm, Tmp
+    Addr, Tmp as loadPtr # This means that "Move Addr, Tmp" is code-generated as "load" not "move".
+    Index, Tmp as loadPtr
+    Tmp, Addr as storePtr
+    Tmp, Index as storePtr
+    x86: Imm, Addr as storePtr
+
+x86: Swap32 UD:G:32, UD:G:32
+    Tmp, Tmp
+    Tmp, Addr
+
+x86_64: Swap64 UD:G:64, UD:G:64
+    Tmp, Tmp
+    Tmp, Addr
+
+Move32 U:G:32, ZD:G:32
+    Tmp, Tmp as zeroExtend32ToPtr
+    Addr, Tmp as load32
+    Index, Tmp as load32
+    Tmp, Addr as store32
+    Tmp, Index as store32
+    x86: Imm, Tmp as zeroExtend32ToPtr
+    x86: Imm, Addr as store32
+    x86: Imm, Index as store32
+
+StoreZero32 U:G:32
+    Addr
+    Index
+
+SignExtend32ToPtr U:G:32, D:G:Ptr
+    Tmp, Tmp
+
+ZeroExtend8To32 U:G:8, ZD:G:32
+    Tmp, Tmp
+    x86: Addr, Tmp as load8
+    x86: Index, Tmp as load8
+
+SignExtend8To32 U:G:8, ZD:G:32
+    Tmp, Tmp
+    x86: Addr, Tmp as load8SignedExtendTo32
+    x86: Index, Tmp as load8SignedExtendTo32
+
+ZeroExtend16To32 U:G:16, ZD:G:32
+    Tmp, Tmp
+    x86: Addr, Tmp as load16
+    x86: Index, Tmp as load16
+
+SignExtend16To32 U:G:16, ZD:G:32
+    Tmp, Tmp
+    x86: Addr, Tmp as load16SignedExtendTo32
+    x86: Index, Tmp as load16SignedExtendTo32
+
+MoveFloat U:F:32, D:F:32
+    Tmp, Tmp as moveDouble
+    Addr, Tmp as loadFloat
+    Index, Tmp as loadFloat
+    Tmp, Addr as storeFloat
+    Tmp, Index as storeFloat
+
+MoveDouble U:F:64, D:F:64
+    Tmp, Tmp
+    Addr, Tmp as loadDouble
+    Index, Tmp as loadDouble
+    Tmp, Addr as storeDouble
+    Tmp, Index as storeDouble
+
+MoveZeroToDouble D:F:64
+    Tmp
+
+64: Move64ToDouble U:G:64, D:F:64
+    Tmp, Tmp
+    x86: Addr, Tmp as loadDouble
+    Index, Tmp as loadDouble
+
+Move32ToFloat U:G:32, D:F:32
+    Tmp, Tmp
+    x86: Addr, Tmp as loadFloat
+    Index, Tmp as loadFloat
+
+64: MoveDoubleTo64 U:F:64, D:G:64
+    Tmp, Tmp
+    Addr, Tmp as load64
+    Index, Tmp as load64
+
+MoveFloatTo32 U:F:32, D:G:32
+    Tmp, Tmp
+    Addr, Tmp as load32
+    Index, Tmp as load32
+
+Load8 U:G:8, ZD:G:32
+    Addr, Tmp
+    Index, Tmp
+
+Store8 U:G:8, D:G:8
+    Tmp, Index
+    Tmp, Addr
+    x86: Imm, Index
+    x86: Imm, Addr
+
+Load8SignedExtendTo32 U:G:8, ZD:G:32
+    Addr, Tmp
+    Index, Tmp
+
+Load16 U:G:16, ZD:G:32
+    Addr, Tmp
+    Index, Tmp
+
+Load16SignedExtendTo32 U:G:16, ZD:G:32
+    Addr, Tmp
+    Index, Tmp
+
+Store16 U:G:16, D:G:16
+    Tmp, Index
+    Tmp, Addr
+
+Compare32 U:G:32, U:G:32, U:G:32, ZD:G:32
+    RelCond, Tmp, Tmp, Tmp
+    RelCond, Tmp, Imm, Tmp
+
+64: Compare64 U:G:32, U:G:64, U:G:64, ZD:G:32
+    RelCond, Tmp, Tmp, Tmp
+    x86: RelCond, Tmp, Imm, Tmp
+
+Test32 U:G:32, U:G:32, U:G:32, ZD:G:32
+    x86: ResCond, Addr, Imm, Tmp
+    ResCond, Tmp, Tmp, Tmp
+    ResCond, Tmp, BitImm, Tmp
+
+64: Test64 U:G:32, U:G:64, U:G:64, ZD:G:32
+    x86: ResCond, Tmp, Imm, Tmp
+    ResCond, Tmp, Tmp, Tmp
+
+CompareDouble U:G:32, U:F:64, U:F:64, ZD:G:32
+    DoubleCond, Tmp, Tmp, Tmp
+
+CompareFloat U:G:32, U:F:32, U:F:32, ZD:G:32
+    DoubleCond, Tmp, Tmp, Tmp
+
+# Note that branches have some logic in AirOptimizeBlockOrder.cpp. If you add new branches, please make sure
+# you opt them into the block order optimizations.
+
+Branch8 U:G:32, U:G:8, U:G:8 /branch
+    x86: RelCond, Addr, Imm
+    x86: RelCond, Index, Imm
+
+Branch32 U:G:32, U:G:32, U:G:32 /branch
+    x86: RelCond, Addr, Imm
+    RelCond, Tmp, Tmp
+    RelCond, Tmp, Imm
+    x86: RelCond, Tmp, Addr
+    x86: RelCond, Addr, Tmp
+    x86: RelCond, Index, Imm
+
+64: Branch64 U:G:32, U:G:64, U:G:64 /branch
+    RelCond, Tmp, Tmp
+    RelCond, Tmp, Imm
+    x86: RelCond, Tmp, Addr
+    x86: RelCond, Addr, Tmp
+    x86: RelCond, Addr, Imm
+    x86: RelCond, Index, Tmp
+
+BranchTest8 U:G:32, U:G:8, U:G:8 /branch
+    x86: ResCond, Addr, BitImm
+    x86: ResCond, Index, BitImm
+
+BranchTest32 U:G:32, U:G:32, U:G:32 /branch
+    ResCond, Tmp, Tmp
+    ResCond, Tmp, BitImm
+    x86: ResCond, Addr, BitImm
+    x86: ResCond, Index, BitImm
+
+# Warning: forms that take an immediate will sign-extend their immediate. You probably want
+# BranchTest32 in most cases where you use an immediate.
+64: BranchTest64 U:G:32, U:G:64, U:G:64 /branch
+    ResCond, Tmp, Tmp
+    arm64: ResCond, Tmp, BitImm64
+    x86: ResCond, Tmp, BitImm
+    x86: ResCond, Addr, BitImm
+    x86: ResCond, Addr, Tmp
+    x86: ResCond, Index, BitImm
+
+BranchDouble U:G:32, U:F:64, U:F:64 /branch
+    DoubleCond, Tmp, Tmp
+
+BranchFloat U:G:32, U:F:32, U:F:32 /branch
+    DoubleCond, Tmp, Tmp
+
+BranchAdd32 U:G:32, U:G:32, U:G:32, ZD:G:32 /branch
+    ResCond, Tmp, Tmp, Tmp
+    x86:ResCond, Tmp, Addr, Tmp
+    x86:ResCond, Addr, Tmp, Tmp
+
+BranchAdd32 U:G:32, U:G:32, UZD:G:32 /branch
+    ResCond, Tmp, Tmp
+    ResCond, Imm, Tmp
+    x86: ResCond, Imm, Addr
+    x86: ResCond, Tmp, Addr
+    x86: ResCond, Addr, Tmp
+
+BranchAdd64 U:G:32, U:G:64, U:G:64, ZD:G:64 /branch
+    ResCond, Tmp, Tmp, Tmp
+    x86:ResCond, Tmp, Addr, Tmp
+    x86:ResCond, Addr, Tmp, Tmp
+
+64: BranchAdd64 U:G:32, U:G:64, UD:G:64 /branch
+    ResCond, Imm, Tmp
+    ResCond, Tmp, Tmp
+    x86:ResCond, Addr, Tmp
+
+x86: BranchMul32 U:G:32, U:G:32, UZD:G:32 /branch
+    ResCond, Tmp, Tmp
+    ResCond, Addr, Tmp
+
+x86: BranchMul32 U:G:32, U:G:32, U:G:32, ZD:G:32 /branch
+    ResCond, Tmp, Imm, Tmp
+
+arm64: BranchMul32 U:G:32, U:G:32, U:G:32, S:G:32, S:G:32, ZD:G:32 /branch
+    ResCond, Tmp, Tmp, Tmp, Tmp, Tmp
+
+x86_64: BranchMul64 U:G:32, U:G:64, UZD:G:64 /branch
+    ResCond, Tmp, Tmp
+
+arm64: BranchMul64 U:G:32, U:G:64, U:G:64, S:G:64, S:G:64, ZD:G:64 /branch
+    ResCond, Tmp, Tmp, Tmp, Tmp, Tmp
+
+BranchSub32 U:G:32, U:G:32, UZD:G:32 /branch
+    ResCond, Tmp, Tmp
+    ResCond, Imm, Tmp
+    x86: ResCond, Imm, Addr
+    x86: ResCond, Tmp, Addr
+    x86: ResCond, Addr, Tmp
+
+64: BranchSub64 U:G:32, U:G:64, UD:G:64 /branch
+    ResCond, Imm, Tmp
+    ResCond, Tmp, Tmp
+
+BranchNeg32 U:G:32, UZD:G:32 /branch
+    ResCond, Tmp
+
+64: BranchNeg64 U:G:32, UZD:G:64 /branch
+    ResCond, Tmp
+
+MoveConditionally32 U:G:32, U:G:32, U:G:32, U:G:Ptr, UD:G:Ptr
+    RelCond, Tmp, Tmp, Tmp, Tmp
+
+MoveConditionally32 U:G:32, U:G:32, U:G:32, U:G:Ptr, U:G:Ptr, D:G:Ptr
+    RelCond, Tmp, Tmp, Tmp, Tmp, Tmp
+    RelCond, Tmp, Imm, Tmp, Tmp, Tmp
+
+64: MoveConditionally64 U:G:32, U:G:64, U:G:64, U:G:Ptr, UD:G:Ptr
+    RelCond, Tmp, Tmp, Tmp, Tmp
+
+64: MoveConditionally64 U:G:32, U:G:64, U:G:64, U:G:Ptr, U:G:Ptr, D:G:Ptr
+    RelCond, Tmp, Tmp, Tmp, Tmp, Tmp
+    RelCond, Tmp, Imm, Tmp, Tmp, Tmp
+
+MoveConditionallyTest32 U:G:32, U:G:32, U:G:32, U:G:Ptr, UD:G:Ptr
+    ResCond, Tmp, Tmp, Tmp, Tmp
+    x86: ResCond, Tmp, Imm, Tmp, Tmp
+
+MoveConditionallyTest32 U:G:32, U:G:32, U:G:32, U:G:Ptr, U:G:Ptr, D:G:Ptr
+    ResCond, Tmp, Tmp, Tmp, Tmp, Tmp
+    ResCond, Tmp, BitImm, Tmp, Tmp, Tmp
+
+64: MoveConditionallyTest64 U:G:32, U:G:64, U:G:64, U:G:Ptr, UD:G:Ptr
+    ResCond, Tmp, Tmp, Tmp, Tmp
+    x86: ResCond, Tmp, Imm, Tmp, Tmp
+
+64: MoveConditionallyTest64 U:G:32, U:G:32, U:G:32, U:G:Ptr, U:G:Ptr, D:G:Ptr
+    ResCond, Tmp, Tmp, Tmp, Tmp, Tmp
+    x86_64: ResCond, Tmp, Imm, Tmp, Tmp, Tmp
+
+MoveConditionallyDouble U:G:32, U:F:64, U:F:64, U:G:Ptr, U:G:Ptr, D:G:Ptr
+    DoubleCond, Tmp, Tmp, Tmp, Tmp, Tmp
+
+MoveConditionallyDouble U:G:32, U:F:64, U:F:64, U:G:Ptr, UD:G:Ptr
+    DoubleCond, Tmp, Tmp, Tmp, Tmp
+
+MoveConditionallyFloat U:G:32, U:F:32, U:F:32, U:G:Ptr, U:G:Ptr, D:G:Ptr
+    DoubleCond, Tmp, Tmp, Tmp, Tmp, Tmp
+
+MoveConditionallyFloat U:G:32, U:F:32, U:F:32, U:G:Ptr, UD:G:Ptr
+    DoubleCond, Tmp, Tmp, Tmp, Tmp
+
+MoveDoubleConditionally32 U:G:32, U:G:32, U:G:32, U:F:64, U:F:64, D:F:64
+    RelCond, Tmp, Tmp, Tmp, Tmp, Tmp
+    RelCond, Tmp, Imm, Tmp, Tmp, Tmp
+    x86: RelCond, Addr, Imm, Tmp, Tmp, Tmp
+    x86: RelCond, Tmp, Addr, Tmp, Tmp, Tmp
+    x86: RelCond, Addr, Tmp, Tmp, Tmp, Tmp
+    x86: RelCond, Index, Imm, Tmp, Tmp, Tmp
+
+64: MoveDoubleConditionally64 U:G:32, U:G:64, U:G:64, U:F:64, U:F:64, D:F:64
+    RelCond, Tmp, Tmp, Tmp, Tmp, Tmp
+    RelCond, Tmp, Imm, Tmp, Tmp, Tmp
+    x86_64: RelCond, Tmp, Addr, Tmp, Tmp, Tmp
+    x86_64: RelCond, Addr, Tmp, Tmp, Tmp, Tmp
+    x86_64: RelCond, Addr, Imm, Tmp, Tmp, Tmp
+    x86_64: RelCond, Index, Tmp, Tmp, Tmp, Tmp
+
+MoveDoubleConditionallyTest32 U:G:32, U:G:32, U:G:32, U:F:64, U:F:64, D:F:64
+    ResCond, Tmp, Tmp, Tmp, Tmp, Tmp
+    ResCond, Tmp, BitImm, Tmp, Tmp, Tmp
+    x86: ResCond, Addr, Imm, Tmp, Tmp, Tmp
+    x86: ResCond, Index, Imm, Tmp, Tmp, Tmp
+
+# Warning: forms that take an immediate will sign-extend their immediate. You probably want
+# MoveDoubleConditionallyTest32 in most cases where you use an immediate.
+64: MoveDoubleConditionallyTest64 U:G:32, U:G:64, U:G:64, U:F:64, U:F:64, D:F:64
+    ResCond, Tmp, Tmp, Tmp, Tmp, Tmp
+    x86_64: ResCond, Tmp, Imm, Tmp, Tmp, Tmp
+    x86_64: ResCond, Addr, Imm, Tmp, Tmp, Tmp
+    x86_64: ResCond, Addr, Tmp, Tmp, Tmp, Tmp
+    x86_64: ResCond, Index, Imm, Tmp, Tmp, Tmp
+
+MoveDoubleConditionallyDouble U:G:32, U:F:64, U:F:64, U:F:64, U:F:64, D:F:64
+    DoubleCond, Tmp, Tmp, Tmp, Tmp, Tmp
+
+MoveDoubleConditionallyFloat U:G:32, U:F:32, U:F:32, U:F:64, U:F:64, D:F:64
+    DoubleCond, Tmp, Tmp, Tmp, Tmp, Tmp
+
+MemoryFence /effects
+StoreFence /effects
+LoadFence /effects
+
+Jump /branch
+
+RetVoid /return
+
+Ret32 U:G:32 /return
+    Tmp
+
+64: Ret64 U:G:64 /return
+    Tmp
+
+RetFloat U:F:32 /return
+    Tmp
+
+RetDouble U:F:64 /return
+    Tmp
+
+Oops /terminal
+
+# This is a terminal but we express it as a Custom because we don't want it to have a code
+# generator.
+custom EntrySwitch
+
+# A Shuffle is a multi-source, multi-destination move. It simultaneously does multiple moves at once.
+# The moves are specified as triplets of src, dst, and width. For example you can request a swap this
+# way:
+#     Shuffle %tmp1, %tmp2, 64, %tmp2, %tmp1, 64
+custom Shuffle
+
+# Air allows for exotic behavior. A Patch's behavior is determined entirely by the Special operand,
+# which must be the first operand.
+custom Patch
+
+# Instructions used for lowering C calls. These don't make it to Air generation. They get lowered to
+# something else first. The origin Value must be a CCallValue.
+custom CCall
+custom ColdCCall
+
+# This is a special wasm opcode that branches to a trap handler. This uses the generator located to Air::Code
+# to produce the side-exit code.
+custom WasmBoundsCheck
+
diff --git a/b3/air/AirOptimizeBlockOrder.cpp b/b3/air/AirOptimizeBlockOrder.cpp
new file mode 100644
index 0000000..11ca3f3
--- /dev/null
+++ b/b3/air/AirOptimizeBlockOrder.cpp
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirOptimizeBlockOrder.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirBlockWorklist.h"
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirPhaseScope.h"
+#include <wtf/BubbleSort.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+class SortedSuccessors {
+public:
+    SortedSuccessors()
+    {
+    }
+
+    void append(BasicBlock* block)
+    {
+        m_successors.append(block);
+    }
+
+    void process(BlockWorklist& worklist)
+    {
+        // We prefer a stable sort, and we don't want it to go off the rails if we see NaN. Also, the number
+        // of successors is bounded. In fact, it currently cannot be more than 2. :-)
+        bubbleSort(
+            m_successors.begin(), m_successors.end(),
+            [] (BasicBlock* left, BasicBlock* right) {
+                return left->frequency() < right->frequency();
+            });
+
+        // Pushing the successors in ascending order of frequency ensures that the very next block we visit
+        // is our highest-frequency successor (unless that successor has already been visited).
+        for (unsigned i = 0; i < m_successors.size(); ++i)
+            worklist.push(m_successors[i]);
+        
+        m_successors.resize(0);
+    }
+
+private:
+    Vector<BasicBlock*, 2> m_successors;
+};
+
+} // anonymous namespace
+
+Vector<BasicBlock*> blocksInOptimizedOrder(Code& code)
+{
+    Vector<BasicBlock*> blocksInOrder;
+
+    BlockWorklist fastWorklist;
+    SortedSuccessors sortedSuccessors;
+    SortedSuccessors sortedSlowSuccessors;
+    
+    // We expect entrypoint lowering to have already happened.
+    RELEASE_ASSERT(code.numEntrypoints());
+
+    auto appendSuccessor = [&] (const FrequentedBlock& block) {
+        if (block.isRare())
+            sortedSlowSuccessors.append(block.block());
+        else
+            sortedSuccessors.append(block.block());
+    };
+    
+    // For everything but the first entrypoint, we push them in order of frequency and frequency
+    // class.
+    for (unsigned i = 1; i < code.numEntrypoints(); ++i)
+        appendSuccessor(code.entrypoint(i));
+    
+    // Always push the primary successor last so that it gets highest priority.
+    fastWorklist.push(code.entrypoint(0).block());
+    
+    while (BasicBlock* block = fastWorklist.pop()) {
+        blocksInOrder.append(block);
+        for (FrequentedBlock& successor : block->successors())
+            appendSuccessor(successor);
+        sortedSuccessors.process(fastWorklist);
+    }
+
+    BlockWorklist slowWorklist;
+    sortedSlowSuccessors.process(slowWorklist);
+
+    while (BasicBlock* block = slowWorklist.pop()) {
+        // We might have already processed this block.
+        if (fastWorklist.saw(block))
+            continue;
+        
+        blocksInOrder.append(block);
+        for (BasicBlock* successor : block->successorBlocks())
+            sortedSuccessors.append(successor);
+        sortedSuccessors.process(slowWorklist);
+    }
+
+    ASSERT(fastWorklist.isEmpty());
+    ASSERT(slowWorklist.isEmpty());
+
+    return blocksInOrder;
+}
+
+void optimizeBlockOrder(Code& code)
+{
+    PhaseScope phaseScope(code, "optimizeBlockOrder");
+
+    Vector<BasicBlock*> blocksInOrder = blocksInOptimizedOrder(code);
+    
+    // Place blocks into Code's block list according to the ordering in blocksInOrder. We do this by leaking
+    // all of the blocks and then readopting them.
+    for (auto& entry : code.blockList())
+        entry.release();
+
+    code.blockList().resize(0);
+
+    for (unsigned i = 0; i < blocksInOrder.size(); ++i) {
+        BasicBlock* block = blocksInOrder[i];
+        block->setIndex(i);
+        code.blockList().append(std::unique_ptr<BasicBlock>(block));
+    }
+
+    // Finally, flip any branches that we recognize. It's most optimal if the taken successor does not point
+    // at the next block.
+    for (BasicBlock* block : code) {
+        Inst& branch = block->last();
+
+        // It's somewhat tempting to just say that if the block has two successors and the first arg is
+        // invertible, then we can do the optimization. But that's wagging the dog. The fact that an
+        // instruction happens to have an argument that is invertible doesn't mean it's a branch, even though
+        // it is true that currently only branches have invertible arguments. It's also tempting to say that
+        // the /branch flag in AirOpcode.opcodes tells us that something is a branch - except that there,
+        // /branch also means Jump. The approach taken here means that if you add new branch instructions and
+        // forget about this phase, then at worst your new instructions won't opt into the inversion
+        // optimization.  You'll probably realize that as soon as you look at the disassembly, and it
+        // certainly won't cause any correctness issues.
+        
+        switch (branch.kind.opcode) {
+        case Branch8:
+        case Branch32:
+        case Branch64:
+        case BranchTest8:
+        case BranchTest32:
+        case BranchTest64:
+        case BranchFloat:
+        case BranchDouble:
+        case BranchAdd32:
+        case BranchAdd64:
+        case BranchMul32:
+        case BranchMul64:
+        case BranchSub32:
+        case BranchSub64:
+        case BranchNeg32:
+        case BranchNeg64:
+            if (code.findNextBlock(block) == block->successorBlock(0) && branch.args[0].isInvertible()) {
+                std::swap(block->successor(0), block->successor(1));
+                branch.args[0] = branch.args[0].inverted();
+            }
+            break;
+            
+        default:
+            break;
+        }
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirOptimizeBlockOrder.h b/b3/air/AirOptimizeBlockOrder.h
new file mode 100644
index 0000000..3911fcc
--- /dev/null
+++ b/b3/air/AirOptimizeBlockOrder.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/Vector.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class BasicBlock;
+class Code;
+
+// Returns a list of blocks sorted according to what would be the current optimal order. This shares
+// some properties with a pre-order traversal. In particular, each block will appear after at least
+// one of its predecessors.
+Vector<BasicBlock*> blocksInOptimizedOrder(Code&);
+
+// Reorders the basic blocks to keep hot blocks at the top, and maximize the likelihood that a frequently
+// taken edge is just a fall-through.
+
+void optimizeBlockOrder(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirPadInterference.cpp b/b3/air/AirPadInterference.cpp
new file mode 100644
index 0000000..91de56b
--- /dev/null
+++ b/b3/air/AirPadInterference.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirPadInterference.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInsertionSet.h"
+#include "AirInstInlines.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+void padInterference(Code& code)
+{
+    InsertionSet insertionSet(code);
+    for (BasicBlock* block : code) {
+        bool prevHadLate = false;
+        for (unsigned instIndex = 0; instIndex < block->size(); ++instIndex) {
+            Inst& inst = block->at(instIndex);
+            
+            bool hasEarlyDef = false;
+            bool hasLate = false;
+            inst.forEachArg(
+                [&] (Arg&, Arg::Role role, Arg::Type, Arg::Width) {
+                    switch (role) {
+                    case Arg::EarlyDef:
+                        hasEarlyDef = true;
+                        break;
+                    case Arg::LateUse:
+                    case Arg::Def:
+                    case Arg::ZDef:
+                    case Arg::LateColdUse:
+                    case Arg::UseDef:
+                    case Arg::UseZDef:
+                        hasLate = true;
+                        break;
+                    case Arg::Scratch:
+                        hasEarlyDef = true;
+                        hasLate = true;
+                        break;
+                    case Arg::Use:
+                    case Arg::ColdUse:
+                    case Arg::UseAddr:
+                        break;
+                    }
+                });
+            if (inst.kind.opcode == Patch) {
+                hasEarlyDef |= !inst.extraEarlyClobberedRegs().isEmpty();
+                hasLate |= !inst.extraClobberedRegs().isEmpty();
+            }
+            
+            if (hasEarlyDef && prevHadLate)
+                insertionSet.insert(instIndex, Nop, inst.origin);
+            
+            prevHadLate = hasLate;
+        }
+        insertionSet.execute(block);
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirPadInterference.h b/b3/air/AirPadInterference.h
new file mode 100644
index 0000000..18f8083
--- /dev/null
+++ b/b3/air/AirPadInterference.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This isn't a phase - it's meant to be a utility that other phases use. Air reasons about liveness by
+// reasoning about interference at boundaries between instructions. This can go wrong - for example, a
+// late use in one instruction doesn't actually interfere with an early def of the next instruction, but
+// Air thinks that it does. This is convenient because it works great in the most common case: early uses
+// and late defs. In practice, only the register allocators need to use this, since only they need to be
+// able to color the interference graph using a bounded number of colors.
+//
+// See https://bugs.webkit.org/show_bug.cgi?id=163548#c2 for more info.
+
+void padInterference(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirPhaseScope.cpp b/b3/air/AirPhaseScope.cpp
new file mode 100644
index 0000000..062ea24
--- /dev/null
+++ b/b3/air/AirPhaseScope.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirPhaseScope.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirValidate.h"
+#include "B3Common.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+PhaseScope::PhaseScope(Code& code, const char* name)
+    : m_code(code)
+    , m_name(name)
+    , m_timingScope(name)
+{
+    if (shouldDumpIRAtEachPhase(AirMode)) {
+        dataLog("Air after ", code.lastPhaseName(), ", before ", name, ":\n");
+        dataLog(code);
+    }
+
+    if (shouldSaveIRBeforePhase())
+        m_dumpBefore = toCString(code);
+}
+
+PhaseScope::~PhaseScope()
+{
+    m_code.setLastPhaseName(m_name);
+    if (shouldValidateIRAtEachPhase())
+        validate(m_code, m_dumpBefore.data());
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirPhaseScope.h b/b3/air/AirPhaseScope.h
new file mode 100644
index 0000000..71f788f
--- /dev/null
+++ b/b3/air/AirPhaseScope.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "B3TimingScope.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/text/CString.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+class PhaseScope {
+    WTF_MAKE_NONCOPYABLE(PhaseScope);
+public:
+    PhaseScope(Code&, const char* name);
+    ~PhaseScope(); // this does validation
+
+private:
+    Code& m_code;
+    const char* m_name;
+    TimingScope m_timingScope;
+    CString m_dumpBefore;
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirReportUsedRegisters.cpp b/b3/air/AirReportUsedRegisters.cpp
new file mode 100644
index 0000000..bb0aeab
--- /dev/null
+++ b/b3/air/AirReportUsedRegisters.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirReportUsedRegisters.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirArgInlines.h"
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirLiveness.h"
+#include "AirPhaseScope.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+void reportUsedRegisters(Code& code)
+{
+    PhaseScope phaseScope(code, "reportUsedRegisters");
+
+    RegLiveness liveness(code);
+
+    for (BasicBlock* block : code) {
+        RegLiveness::LocalCalc localCalc(liveness, block);
+
+        for (unsigned instIndex = block->size(); instIndex--;) {
+            Inst& inst = block->at(instIndex);
+
+            // Kill dead assignments to registers. For simplicity we say that a store is killable if
+            // it has only late defs and those late defs are to registers that are dead right now.
+            if (!inst.hasNonArgEffects()) {
+                bool canDelete = true;
+                inst.forEachArg(
+                    [&] (Arg& arg, Arg::Role role, Arg::Type, Arg::Width) {
+                        if (Arg::isEarlyDef(role)) {
+                            canDelete = false;
+                            return;
+                        }
+                        if (!Arg::isLateDef(role))
+                            return;
+                        if (!arg.isReg()) {
+                            canDelete = false;
+                            return;
+                        }
+                        if (localCalc.isLive(arg.reg())) {
+                            canDelete = false;
+                            return;
+                        }
+                    });
+                if (canDelete)
+                    inst = Inst();
+            }
+            
+            if (inst.kind.opcode == Patch) {
+                RegisterSet registerSet;
+                for (Reg reg : localCalc.live())
+                    registerSet.set(reg);
+                inst.reportUsedRegisters(registerSet);
+            }
+            localCalc.execute(instIndex);
+        }
+        
+        block->insts().removeAllMatching(
+            [&] (const Inst& inst) -> bool {
+                return !inst;
+            });
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
+
diff --git a/b3/air/AirReportUsedRegisters.h b/b3/air/AirReportUsedRegisters.h
new file mode 100644
index 0000000..ea175dc
--- /dev/null
+++ b/b3/air/AirReportUsedRegisters.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// Performs a liveness analysis over registers and reports the live registers to every Special. Takes
+// the opportunity to kill dead assignments to registers, since it has access to register liveness.
+
+void reportUsedRegisters(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirSimplifyCFG.cpp b/b3/air/AirSimplifyCFG.cpp
new file mode 100644
index 0000000..c66f63f
--- /dev/null
+++ b/b3/air/AirSimplifyCFG.cpp
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirSimplifyCFG.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirPhaseScope.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+bool simplifyCFG(Code& code)
+{
+    const bool verbose = false;
+    
+    PhaseScope phaseScope(code, "simplifyCFG");
+    
+    // We have three easy simplification rules:
+    //
+    // 1) If a successor is a block that just jumps to another block, then jump directly to
+    //    that block.
+    //
+    // 2) If all successors are the same and the operation has no effects, then use a jump
+    //    instead.
+    //
+    // 3) If you jump to a block that is not you and has one predecessor, then merge.
+    //
+    // Note that because of the first rule, this phase may introduce critical edges. That's fine.
+    // If you need broken critical edges, then you have to break them yourself.
+
+    bool result = false;
+    for (;;) {
+        if (verbose) {
+            dataLog("Air before an iteration of simplifyCFG:\n");
+            dataLog(code);
+        }
+        
+        bool changed = false;
+        for (BasicBlock* block : code) {
+            // We rely on predecessors being conservatively correct. Verify this here.
+            if (shouldValidateIRAtEachPhase()) {
+                for (BasicBlock* block : code) {
+                    for (BasicBlock* successor : block->successorBlocks())
+                        RELEASE_ASSERT(successor->containsPredecessor(block));
+                }
+            }
+
+            // We don't care about blocks that don't have successors.
+            if (!block->numSuccessors())
+                continue;
+
+            // First check if any of the successors of this block can be forwarded over.
+            for (BasicBlock*& successor : block->successorBlocks()) {
+                if (successor != block
+                    && successor->size() == 1
+                    && successor->last().kind.opcode == Jump) {
+                    BasicBlock* newSuccessor = successor->successorBlock(0);
+                    if (newSuccessor != successor) {
+                        if (verbose) {
+                            dataLog(
+                                "Replacing ", pointerDump(block), "->", pointerDump(successor),
+                                " with ", pointerDump(block), "->", pointerDump(newSuccessor), "\n");
+                        }
+                        // Note that we do not do replacePredecessor() because the block we're
+                        // skipping will still have newSuccessor as its successor.
+                        newSuccessor->addPredecessor(block);
+                        successor = newSuccessor;
+                        changed = true;
+                    }
+                }
+            }
+
+            // Now check if the block's terminal can be replaced with a jump. The terminal must not
+            // have weird effects.
+            if (block->numSuccessors() > 1 
+                && !block->last().hasNonControlEffects()) {
+                // All of the successors must be the same.
+                bool allSame = true;
+                BasicBlock* firstSuccessor = block->successorBlock(0);
+                for (unsigned i = 1; i < block->numSuccessors(); ++i) {
+                    if (block->successorBlock(i) != firstSuccessor) {
+                        allSame = false;
+                        break;
+                    }
+                }
+                if (allSame) {
+                    if (verbose)
+                        dataLog("Changing ", pointerDump(block), "'s terminal to a Jump.\n");
+                    block->last() = Inst(Jump, block->last().origin);
+                    block->successors().resize(1);
+                    block->successors()[0].frequency() = FrequencyClass::Normal;
+                    changed = true;
+                }
+            }
+
+            // Finally handle jumps to a block with one predecessor.
+            if (block->numSuccessors() == 1
+                && !block->last().hasNonControlEffects()) {
+                BasicBlock* successor = block->successorBlock(0);
+                if (successor != block && successor->numPredecessors() == 1) {
+                    RELEASE_ASSERT(successor->predecessor(0) == block);
+
+                    // We can merge the two blocks because the predecessor only jumps to the successor
+                    // and the successor is only reachable from the predecessor.
+
+                    // Remove the terminal.
+                    Value* origin = block->insts().takeLast().origin;
+
+                    // Append the full contents of the successor to the predecessor.
+                    block->insts().reserveCapacity(block->size() + successor->size());
+                    for (Inst& inst : *successor)
+                        block->appendInst(WTFMove(inst));
+
+                    // Make sure that our successors are the successor's successors.
+                    block->successors() = WTFMove(successor->successors());
+
+                    // Make sure that the successor has nothing left in it except an oops.
+                    successor->resize(1);
+                    successor->last() = Inst(Oops, origin);
+                    successor->successors().clear();
+
+                    // Ensure that the predecessors of block's new successors know what's up.
+                    for (BasicBlock* newSuccessor : block->successorBlocks())
+                        newSuccessor->replacePredecessor(successor, block);
+
+                    if (verbose)
+                        dataLog("Merged ", pointerDump(block), "->", pointerDump(successor), "\n");
+                    changed = true;
+                }
+            }
+        }
+
+        if (!changed)
+            break;
+        result = true;
+        code.resetReachability();
+    }
+
+    return result;
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
+
diff --git a/b3/air/AirSimplifyCFG.h b/b3/air/AirSimplifyCFG.h
new file mode 100644
index 0000000..7ac510d
--- /dev/null
+++ b/b3/air/AirSimplifyCFG.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// Simplifies the control flow graph by removing jump-only blocks and merging jumps.
+
+bool simplifyCFG(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirSpecial.cpp b/b3/air/AirSpecial.cpp
new file mode 100644
index 0000000..e825767
--- /dev/null
+++ b/b3/air/AirSpecial.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirSpecial.h"
+
+#if ENABLE(B3_JIT)
+
+#include <limits.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+const char* const Special::dumpPrefix = "&";
+
+Special::Special()
+{
+}
+
+Special::~Special()
+{
+}
+
+CString Special::name() const
+{
+    StringPrintStream out;
+    dumpImpl(out);
+    return out.toCString();
+}
+
+std::optional<unsigned> Special::shouldTryAliasingDef(Inst&)
+{
+    return std::nullopt;
+}
+
+bool Special::isTerminal(Inst&)
+{
+    return false;
+}
+
+bool Special::hasNonArgEffects(Inst&)
+{
+    return true;
+}
+
+bool Special::hasNonArgNonControlEffects(Inst&)
+{
+    return true;
+}
+
+void Special::dump(PrintStream& out) const
+{
+    out.print(dumpPrefix);
+    dumpImpl(out);
+    if (m_index != UINT_MAX)
+        out.print(m_index);
+}
+
+void Special::deepDump(PrintStream& out) const
+{
+    out.print(*this, ": ");
+    deepDumpImpl(out);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirSpecial.h b/b3/air/AirSpecial.h
new file mode 100644
index 0000000..480cbfc
--- /dev/null
+++ b/b3/air/AirSpecial.h
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirInst.h"
+#include "B3SparseCollection.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/ScopedLambda.h>
+#include <wtf/text/CString.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+struct GenerationContext;
+
+class Special {
+    WTF_MAKE_NONCOPYABLE(Special);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static const char* const dumpPrefix;
+    
+    Special();
+    virtual ~Special();
+
+    Code& code() const { return *m_code; }
+
+    CString name() const;
+
+    virtual void forEachArg(Inst&, const ScopedLambda<Inst::EachArgCallback>&) = 0;
+    virtual bool isValid(Inst&) = 0;
+    virtual bool admitsStack(Inst&, unsigned argIndex) = 0;
+    virtual std::optional<unsigned> shouldTryAliasingDef(Inst&);
+
+    // This gets called on for each Inst that uses this Special. Note that there is no way to
+    // guarantee that a Special gets used from just one Inst, because Air might taildup late. So,
+    // if you want to pass this information down to generate(), then you have to either:
+    //
+    // 1) Generate Air that starts with a separate Special per Patch Inst, and then merge
+    //    usedRegister sets. This is probably not great, but it optimizes for the common case that
+    //    Air didn't duplicate code or that such duplication didn't cause any interesting changes to
+    //    register assignment.
+    //
+    // 2) Have the Special maintain a HashMap<Inst*, RegisterSet>. This works because the analysis
+    //    that feeds into this call is performed just before code generation and there is no way
+    //    for the Vector<>'s that contain the Insts to be reallocated. This allows generate() to
+    //    consult the HashMap.
+    //
+    // 3) Hybrid: you could use (1) and fire up a HashMap if you see multiple calls.
+    //
+    // Note that it's not possible to rely on reportUsedRegisters() being called in the same order
+    // as generate(). If we could rely on that, then we could just have each Special instance
+    // maintain a Vector of RegisterSet's and then process that vector in the right order in
+    // generate(). But, the ordering difference is unlikely to change since it would harm the
+    // performance of the liveness analysis.
+    //
+    // Currently, we do (1) for B3 stackmaps.
+    virtual void reportUsedRegisters(Inst&, const RegisterSet&) = 0;
+    
+    virtual CCallHelpers::Jump generate(Inst&, CCallHelpers&, GenerationContext&) = 0;
+
+    virtual RegisterSet extraEarlyClobberedRegs(Inst&) = 0;
+    virtual RegisterSet extraClobberedRegs(Inst&) = 0;
+    
+    // By default, this returns false.
+    virtual bool isTerminal(Inst&);
+
+    // By default, this returns true.
+    virtual bool hasNonArgEffects(Inst&);
+
+    // By default, this returns true.
+    virtual bool hasNonArgNonControlEffects(Inst&);
+
+    void dump(PrintStream&) const;
+    void deepDump(PrintStream&) const;
+
+protected:
+    virtual void dumpImpl(PrintStream&) const = 0;
+    virtual void deepDumpImpl(PrintStream&) const = 0;
+
+private:
+    friend class Code;
+    friend class SparseCollection<Special>;
+
+    unsigned m_index { UINT_MAX };
+    Code* m_code { nullptr };
+};
+
+class DeepSpecialDump {
+public:
+    DeepSpecialDump(const Special* special)
+        : m_special(special)
+    {
+    }
+
+    void dump(PrintStream& out) const
+    {
+        if (m_special)
+            m_special->deepDump(out);
+        else
+            out.print("<null>");
+    }
+
+private:
+    const Special* m_special;
+};
+
+inline DeepSpecialDump deepDump(const Special* special)
+{
+    return DeepSpecialDump(special);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirSpillEverything.cpp b/b3/air/AirSpillEverything.cpp
new file mode 100644
index 0000000..ebf3774
--- /dev/null
+++ b/b3/air/AirSpillEverything.cpp
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirSpillEverything.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirArgInlines.h"
+#include "AirCode.h"
+#include "AirInsertionSet.h"
+#include "AirInstInlines.h"
+#include "AirLiveness.h"
+#include "AirPadInterference.h"
+#include "AirPhaseScope.h"
+#include <wtf/IndexMap.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+void spillEverything(Code& code)
+{
+    PhaseScope phaseScope(code, "spillEverything");
+    
+    padInterference(code);
+
+    // We want to know the set of registers used at every point in every basic block.
+    IndexMap<BasicBlock, Vector<RegisterSet>> usedRegisters(code.size());
+    GPLiveness gpLiveness(code);
+    FPLiveness fpLiveness(code);
+    for (BasicBlock* block : code) {
+        GPLiveness::LocalCalc gpLocalCalc(gpLiveness, block);
+        FPLiveness::LocalCalc fpLocalCalc(fpLiveness, block);
+
+        usedRegisters[block].resize(block->size() + 1);
+
+        auto setUsedRegisters = [&] (unsigned index) {
+            RegisterSet& registerSet = usedRegisters[block][index];
+            for (Tmp tmp : gpLocalCalc.live()) {
+                if (tmp.isReg())
+                    registerSet.set(tmp.reg());
+            }
+            for (Tmp tmp : fpLocalCalc.live()) {
+                if (tmp.isReg())
+                    registerSet.set(tmp.reg());
+            }
+
+            // Gotta account for dead assignments to registers. These may happen because the input
+            // code is suboptimal.
+            Inst::forEachDefWithExtraClobberedRegs<Tmp>(
+                block->get(index - 1), block->get(index),
+                [&] (const Tmp& tmp, Arg::Role, Arg::Type, Arg::Width) {
+                    if (tmp.isReg())
+                        registerSet.set(tmp.reg());
+                });
+        };
+
+        for (unsigned instIndex = block->size(); instIndex--;) {
+            setUsedRegisters(instIndex + 1);
+            gpLocalCalc.execute(instIndex);
+            fpLocalCalc.execute(instIndex);
+        }
+        setUsedRegisters(0);
+    }
+
+    // Allocate a stack slot for each tmp.
+    Vector<StackSlot*> allStackSlots[Arg::numTypes];
+    for (unsigned typeIndex = 0; typeIndex < Arg::numTypes; ++typeIndex) {
+        Vector<StackSlot*>& stackSlots = allStackSlots[typeIndex];
+        Arg::Type type = static_cast<Arg::Type>(typeIndex);
+        stackSlots.resize(code.numTmps(type));
+        for (unsigned tmpIndex = code.numTmps(type); tmpIndex--;)
+            stackSlots[tmpIndex] = code.addStackSlot(8, StackSlotKind::Spill);
+    }
+
+    InsertionSet insertionSet(code);
+    for (BasicBlock* block : code) {
+        for (unsigned instIndex = 0; instIndex < block->size(); ++instIndex) {
+            RegisterSet& setBefore = usedRegisters[block][instIndex];
+            RegisterSet& setAfter = usedRegisters[block][instIndex + 1];
+            Inst& inst = block->at(instIndex);
+
+            // First try to spill directly.
+            for (unsigned i = 0; i < inst.args.size(); ++i) {
+                Arg& arg = inst.args[i];
+
+                if (arg.isTmp()) {
+                    if (arg.isReg())
+                        continue;
+
+                    if (inst.admitsStack(i)) {
+                        StackSlot* stackSlot = allStackSlots[arg.type()][arg.tmpIndex()];
+                        arg = Arg::stack(stackSlot);
+                        continue;
+                    }
+                }
+            }
+
+            // Now fall back on spilling using separate Move's to load/store the tmp.
+            inst.forEachTmp(
+                [&] (Tmp& tmp, Arg::Role role, Arg::Type type, Arg::Width) {
+                    if (tmp.isReg())
+                        return;
+                    
+                    StackSlot* stackSlot = allStackSlots[type][tmp.tmpIndex()];
+                    Arg arg = Arg::stack(stackSlot);
+
+                    // Need to figure out a register to use. How we do that depends on the role.
+                    Reg chosenReg;
+                    switch (role) {
+                    case Arg::Use:
+                    case Arg::ColdUse:
+                        for (Reg reg : code.regsInPriorityOrder(type)) {
+                            if (!setBefore.get(reg)) {
+                                setBefore.set(reg);
+                                chosenReg = reg;
+                                break;
+                            }
+                        }
+                        break;
+                    case Arg::Def:
+                    case Arg::ZDef:
+                        for (Reg reg : code.regsInPriorityOrder(type)) {
+                            if (!setAfter.get(reg)) {
+                                setAfter.set(reg);
+                                chosenReg = reg;
+                                break;
+                            }
+                        }
+                        break;
+                    case Arg::UseDef:
+                    case Arg::UseZDef:
+                    case Arg::LateUse:
+                    case Arg::LateColdUse:
+                    case Arg::Scratch:
+                    case Arg::EarlyDef:
+                        for (Reg reg : code.regsInPriorityOrder(type)) {
+                            if (!setBefore.get(reg) && !setAfter.get(reg)) {
+                                setAfter.set(reg);
+                                setBefore.set(reg);
+                                chosenReg = reg;
+                                break;
+                            }
+                        }
+                        break;
+                    case Arg::UseAddr:
+                        // We will never UseAddr a Tmp, that doesn't make sense.
+                        RELEASE_ASSERT_NOT_REACHED();
+                        break;
+                    }
+                    RELEASE_ASSERT(chosenReg);
+
+                    tmp = Tmp(chosenReg);
+
+                    Opcode move = type == Arg::GP ? Move : MoveDouble;
+
+                    if (Arg::isAnyUse(role) && role != Arg::Scratch)
+                        insertionSet.insert(instIndex, move, inst.origin, arg, tmp);
+                    if (Arg::isAnyDef(role))
+                        insertionSet.insert(instIndex + 1, move, inst.origin, tmp, arg);
+                });
+        }
+        insertionSet.execute(block);
+    }
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirSpillEverything.h b/b3/air/AirSpillEverything.h
new file mode 100644
index 0000000..0fdca66
--- /dev/null
+++ b/b3/air/AirSpillEverything.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// This is a phase for testing. It behaves like a register allocator in the sense that it
+// eliminates temporaries from the program. It accomplishes this by always spilling all
+// temporaries. The resulting code is going to be very inefficient. This phase is great if you
+// think that there is a bug in the register allocator. You can confirm this by running this
+// phase instead of the register allocator.
+//
+// Note that even though this phase does the cheapest thing possible, it's not even written in a
+// particularly efficient way. So, don't get any ideas about using this phase to reduce compiler
+// latency. If you wanted to do that, you should come up with a clever algorithm instead of using
+// this silly thing.
+
+void spillEverything(Code&);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirStackSlot.cpp b/b3/air/AirStackSlot.cpp
new file mode 100644
index 0000000..58cac06
--- /dev/null
+++ b/b3/air/AirStackSlot.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirStackSlot.h"
+
+#if ENABLE(B3_JIT)
+
+#include "B3StackSlot.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+void StackSlot::setOffsetFromFP(intptr_t value)
+{
+    m_offsetFromFP = value;
+    if (m_b3Slot)
+        m_b3Slot->m_offsetFromFP = value;
+}
+
+unsigned StackSlot::jsHash() const
+{
+    return static_cast<unsigned>(m_kind) + m_byteSize * 3 + m_offsetFromFP * 7;
+}
+
+void StackSlot::dump(PrintStream& out) const
+{
+    if (isSpill())
+        out.print("spill");
+    else
+        out.print("stack");
+    out.print(m_index);
+}
+
+void StackSlot::deepDump(PrintStream& out) const
+{
+    out.print("byteSize = ", m_byteSize, ", offsetFromFP = ", m_offsetFromFP, ", kind = ", m_kind);
+    if (m_b3Slot)
+        out.print(", b3Slot = ", *m_b3Slot, ": (", B3::deepDump(m_b3Slot), ")");
+}
+
+StackSlot::StackSlot(unsigned byteSize, StackSlotKind kind, B3::StackSlot* b3Slot)
+    : m_byteSize(byteSize)
+    , m_offsetFromFP(b3Slot ? b3Slot->offsetFromFP() : 0)
+    , m_kind(kind)
+    , m_b3Slot(b3Slot)
+{
+    ASSERT(byteSize);
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirStackSlot.h b/b3/air/AirStackSlot.h
new file mode 100644
index 0000000..85c94ac
--- /dev/null
+++ b/b3/air/AirStackSlot.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirStackSlotKind.h"
+#include "B3SparseCollection.h"
+#include <limits.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace B3 {
+
+class StackSlot;
+
+namespace Air {
+
+class StackSlot {
+    WTF_MAKE_NONCOPYABLE(StackSlot);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    unsigned byteSize() const { return m_byteSize; }
+    StackSlotKind kind() const { return m_kind; }
+    bool isLocked() const { return m_kind == StackSlotKind::Locked; }
+    bool isSpill() const { return m_kind == StackSlotKind::Spill; }
+    unsigned index() const { return m_index; }
+
+    void ensureSize(unsigned requestedSize)
+    {
+        ASSERT(!m_offsetFromFP);
+        m_byteSize = std::max(m_byteSize, requestedSize);
+    }
+
+    unsigned alignment() const
+    {
+        if (byteSize() <= 1)
+            return 1;
+        if (byteSize() <= 2)
+            return 2;
+        if (byteSize() <= 4)
+            return 4;
+        return 8;
+    }
+
+    B3::StackSlot* b3Slot() const { return m_b3Slot; }
+
+    // Zero means that it's not yet assigned.
+    intptr_t offsetFromFP() const { return m_offsetFromFP; }
+
+    // This should usually just be called from phases that do stack allocation. But you can
+    // totally force a stack slot to land at some offset.
+    void setOffsetFromFP(intptr_t);
+    
+    // This computes a hash for comparing this to JSAir's StackSlot.
+    unsigned jsHash() const;
+
+    void dump(PrintStream&) const;
+    void deepDump(PrintStream&) const;
+
+private:
+    friend class Code;
+    friend class SparseCollection<StackSlot>;
+
+    StackSlot(unsigned byteSize, StackSlotKind, B3::StackSlot*);
+    
+    unsigned m_byteSize { 0 };
+    unsigned m_index { UINT_MAX };
+    intptr_t m_offsetFromFP { 0 };
+    StackSlotKind m_kind { StackSlotKind::Locked };
+    B3::StackSlot* m_b3Slot { nullptr };
+};
+
+class DeepStackSlotDump {
+public:
+    DeepStackSlotDump(const StackSlot* slot)
+        : m_slot(slot)
+    {
+    }
+
+    void dump(PrintStream& out) const
+    {
+        if (m_slot)
+            m_slot->deepDump(out);
+        else
+            out.print("<null>");
+    }
+
+private:
+    const StackSlot* m_slot;
+};
+
+inline DeepStackSlotDump deepDump(const StackSlot* slot)
+{
+    return DeepStackSlotDump(slot);
+}
+
+} } } // namespace JSC::B3::Air
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::B3::Air::StackSlot* stackSlot)
+{
+    out.print(pointerDump(stackSlot));
+}
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirStackSlotKind.cpp b/b3/air/AirStackSlotKind.cpp
new file mode 100644
index 0000000..af83de1
--- /dev/null
+++ b/b3/air/AirStackSlotKind.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirStackSlotKind.h"
+
+#if ENABLE(B3_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC::B3::Air;
+
+void printInternal(PrintStream& out, StackSlotKind kind)
+{
+    switch (kind) {
+    case StackSlotKind::Locked:
+        out.print("Locked");
+        return;
+    case StackSlotKind::Spill:
+        out.print("Spill");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirStackSlotKind.h b/b3/air/AirStackSlotKind.h
new file mode 100644
index 0000000..9ef2057
--- /dev/null
+++ b/b3/air/AirStackSlotKind.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+enum class StackSlotKind : uint8_t {
+    // A locked stack slot is an area of stack requested by the client. It cannot be killed. The
+    // client can get its FP offset and write to it from stack walking code, so we must assume
+    // that reads and writes to a locked stack slot can be clobbered the same way as reads and
+    // writes to any memory location.
+    Locked,
+
+    // A spill slot. These have fundamentally different behavior than a typical memory location.
+    // They are lowered to from temporaries. This means for example that a 32-bit ZDef store to a
+    // 8 byte stack slot will zero the top 4 bytes, even though a 32-bit ZDef store to any other
+    // kind of memory location would do no such thing. UseAddr on a spill slot is not allowed, so
+    // they never escape.
+    Spill
+
+    // FIXME: We should add a third mode, which means that the stack slot will be read asynchronously
+    // as with Locked, but never written to asynchronously. Then, Air could optimize spilling and
+    // filling by tracking whether the value had been stored to a read-only locked slot. If it had,
+    // then we can refill from that slot.
+    // https://bugs.webkit.org/show_bug.cgi?id=150587
+};
+
+} } } // namespace JSC::B3::Air
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::B3::Air::StackSlotKind);
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirTmp.cpp b/b3/air/AirTmp.cpp
new file mode 100644
index 0000000..487f521
--- /dev/null
+++ b/b3/air/AirTmp.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirTmp.h"
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+void Tmp::dump(PrintStream& out) const
+{
+    if (!*this) {
+        out.print("<none>");
+        return;
+    }
+
+    if (isReg()) {
+        out.print(reg());
+        return;
+    }
+
+    if (isGP()) {
+        out.print("%tmp", gpTmpIndex());
+        return;
+    }
+
+    out.print("%ftmp", fpTmpIndex());
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirTmp.h b/b3/air/AirTmp.h
new file mode 100644
index 0000000..c01427c
--- /dev/null
+++ b/b3/air/AirTmp.h
@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "Reg.h"
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Arg;
+
+// A Tmp is a generalization of a register. It can be used to refer to any GPR or FPR. It can also
+// be used to refer to an unallocated register (i.e. a temporary). Like many Air classes, we use
+// deliberately terse naming since we will have to use this name a lot.
+
+class Tmp {
+public:
+    Tmp()
+        : m_value(0)
+    {
+    }
+
+    explicit Tmp(Reg reg)
+    {
+        if (reg) {
+            if (reg.isGPR())
+                m_value = encodeGPR(reg.gpr());
+            else
+                m_value = encodeFPR(reg.fpr());
+        } else
+            m_value = 0;
+    }
+
+    explicit Tmp(const Arg&);
+
+    static Tmp gpTmpForIndex(unsigned index)
+    {
+        Tmp result;
+        result.m_value = encodeGPTmp(index);
+        return result;
+    }
+
+    static Tmp fpTmpForIndex(unsigned index)
+    {
+        Tmp result;
+        result.m_value = encodeFPTmp(index);
+        return result;
+    }
+
+    explicit operator bool() const { return !!m_value; }
+
+    bool isGP() const
+    {
+        return isEncodedGP(m_value);
+    }
+
+    bool isFP() const
+    {
+        return isEncodedFP(m_value);
+    }
+
+    bool isGPR() const
+    {
+        return isEncodedGPR(m_value);
+    }
+
+    bool isFPR() const
+    {
+        return isEncodedFPR(m_value);
+    }
+
+    bool isReg() const
+    {
+        return isGPR() || isFPR();
+    }
+
+    GPRReg gpr() const
+    {
+        return decodeGPR(m_value);
+    }
+
+    FPRReg fpr() const
+    {
+        return decodeFPR(m_value);
+    }
+
+    Reg reg() const
+    {
+        if (isGP())
+            return gpr();
+        return fpr();
+    }
+
+    bool hasTmpIndex() const
+    {
+        return !isReg();
+    }
+
+    unsigned gpTmpIndex() const
+    {
+        return decodeGPTmp(m_value);
+    }
+
+    unsigned fpTmpIndex() const
+    {
+        return decodeFPTmp(m_value);
+    }
+
+    unsigned tmpIndex() const
+    {
+        if (isGP())
+            return gpTmpIndex();
+        return fpTmpIndex();
+    }
+
+    bool isAlive() const
+    {
+        return !!*this;
+    }
+
+    bool operator==(const Tmp& other) const
+    {
+        return m_value == other.m_value;
+    }
+
+    bool operator!=(const Tmp& other) const
+    {
+        return !(*this == other);
+    }
+
+    void dump(PrintStream& out) const;
+
+    Tmp(WTF::HashTableDeletedValueType)
+        : m_value(std::numeric_limits<int>::max())
+    {
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return *this == Tmp(WTF::HashTableDeletedValue);
+    }
+
+    unsigned hash() const
+    {
+        return WTF::IntHash<int>::hash(m_value);
+    }
+
+    unsigned internalValue() const { return static_cast<unsigned>(m_value); }
+
+    static Tmp tmpForInternalValue(unsigned index)
+    {
+        Tmp result;
+        result.m_value = static_cast<int>(index);
+        return result;
+    }
+
+private:
+    static int encodeGP(unsigned index)
+    {
+        return 1 + index;
+    }
+
+    static int encodeFP(unsigned index)
+    {
+        return -1 - index;
+    }
+
+    static int encodeGPR(GPRReg gpr)
+    {
+        return encodeGP(gpr - MacroAssembler::firstRegister());
+    }
+
+    static int encodeFPR(FPRReg fpr)
+    {
+        return encodeFP(fpr - MacroAssembler::firstFPRegister());
+    }
+
+    static int encodeGPTmp(unsigned index)
+    {
+        return encodeGPR(MacroAssembler::lastRegister()) + 1 + index;
+    }
+
+    static int encodeFPTmp(unsigned index)
+    {
+        return encodeFPR(MacroAssembler::lastFPRegister()) - 1 - index;
+    }
+
+    static bool isEncodedGP(int value)
+    {
+        return value > 0;
+    }
+
+    static bool isEncodedFP(int value)
+    {
+        return value < 0;
+    }
+
+    static bool isEncodedGPR(int value)
+    {
+        return isEncodedGP(value) && value <= encodeGPR(MacroAssembler::lastRegister());
+    }
+
+    static bool isEncodedFPR(int value)
+    {
+        return isEncodedFP(value) && value >= encodeFPR(MacroAssembler::lastFPRegister());
+    }
+
+    static bool isEncodedGPTmp(int value)
+    {
+        return isEncodedGP(value) && !isEncodedGPR(value);
+    }
+
+    static bool isEncodedFPTmp(int value)
+    {
+        return isEncodedFP(value) && !isEncodedFPR(value);
+    }
+
+    static GPRReg decodeGPR(int value)
+    {
+        ASSERT(isEncodedGPR(value));
+        return static_cast<GPRReg>(
+            (value - encodeGPR(MacroAssembler::firstRegister())) + MacroAssembler::firstRegister());
+    }
+
+    static FPRReg decodeFPR(int value)
+    {
+        ASSERT(isEncodedFPR(value));
+        return static_cast<FPRReg>(
+            (encodeFPR(MacroAssembler::firstFPRegister()) - value) +
+            MacroAssembler::firstFPRegister());
+    }
+
+    static unsigned decodeGPTmp(int value)
+    {
+        ASSERT(isEncodedGPTmp(value));
+        return value - (encodeGPR(MacroAssembler::lastRegister()) + 1);
+    }
+
+    static unsigned decodeFPTmp(int value)
+    {
+        ASSERT(isEncodedFPTmp(value));
+        return (encodeFPR(MacroAssembler::lastFPRegister()) - 1) - value;
+    }
+
+    // 0: empty Tmp
+    // positive: GPRs and then GP temps.
+    // negative: FPRs and then FP temps.
+    int m_value;
+};
+
+struct TmpHash {
+    static unsigned hash(const Tmp& key) { return key.hash(); }
+    static bool equal(const Tmp& a, const Tmp& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } } // namespace JSC::B3::Air
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::B3::Air::Tmp> {
+    typedef JSC::B3::Air::TmpHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::B3::Air::Tmp> : SimpleClassHashTraits<JSC::B3::Air::Tmp> { };
+
+} // namespace WTF
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirTmpInlines.h b/b3/air/AirTmpInlines.h
new file mode 100644
index 0000000..a7de098
--- /dev/null
+++ b/b3/air/AirTmpInlines.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+#include "AirTmp.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+inline Tmp::Tmp(const Arg& arg)
+{
+    *this = arg.tmp();
+}
+
+// When a Hash structure is too slow or when Sets contains most values, you can
+// use direct array addressing with Tmps.
+template<Arg::Type type>
+struct AbsoluteTmpMapper;
+
+template<>
+struct AbsoluteTmpMapper<Arg::GP> {
+    static unsigned absoluteIndex(const Tmp& tmp)
+    {
+        ASSERT(tmp.isGP());
+        ASSERT(static_cast<int>(tmp.internalValue()) > 0);
+        return tmp.internalValue();
+    }
+
+    static unsigned absoluteIndex(unsigned tmpIndex)
+    {
+        return absoluteIndex(Tmp::gpTmpForIndex(tmpIndex));
+    }
+
+    static unsigned lastMachineRegisterIndex()
+    {
+        return absoluteIndex(Tmp(MacroAssembler::lastRegister()));
+    }
+
+    static Tmp tmpFromAbsoluteIndex(unsigned tmpIndex)
+    {
+        return Tmp::tmpForInternalValue(tmpIndex);
+    }
+};
+
+template<>
+struct AbsoluteTmpMapper<Arg::FP> {
+    static unsigned absoluteIndex(const Tmp& tmp)
+    {
+        ASSERT(tmp.isFP());
+        ASSERT(static_cast<int>(tmp.internalValue()) < 0);
+        return -tmp.internalValue();
+    }
+
+    static unsigned absoluteIndex(unsigned tmpIndex)
+    {
+        return absoluteIndex(Tmp::fpTmpForIndex(tmpIndex));
+    }
+
+    static unsigned lastMachineRegisterIndex()
+    {
+        return absoluteIndex(Tmp(MacroAssembler::lastFPRegister()));
+    }
+
+    static Tmp tmpFromAbsoluteIndex(unsigned tmpIndex)
+    {
+        return Tmp::tmpForInternalValue(-tmpIndex);
+    }
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirTmpWidth.cpp b/b3/air/AirTmpWidth.cpp
new file mode 100644
index 0000000..f1173c0
--- /dev/null
+++ b/b3/air/AirTmpWidth.cpp
@@ -0,0 +1,183 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AirTmpWidth.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+TmpWidth::TmpWidth()
+{
+}
+
+TmpWidth::TmpWidth(Code& code)
+{
+    recompute(code);
+}
+
+TmpWidth::~TmpWidth()
+{
+}
+
+void TmpWidth::recompute(Code& code)
+{
+    // Set this to true to cause this analysis to always return pessimistic results.
+    const bool beCareful = false;
+
+    const bool verbose = false;
+
+    if (verbose) {
+        dataLog("Code before TmpWidth:\n");
+        dataLog(code);
+    }
+    
+    m_width.clear();
+    
+    auto assumeTheWorst = [&] (Tmp tmp) {
+        Widths& widths = m_width.add(tmp, Widths()).iterator->value;
+        Arg::Type type = Arg(tmp).type();
+        widths.use = Arg::conservativeWidth(type);
+        widths.def = Arg::conservativeWidth(type);
+    };
+    
+    // Assume the worst for registers.
+    RegisterSet::allRegisters().forEach(
+        [&] (Reg reg) {
+            assumeTheWorst(Tmp(reg));
+        });
+
+    if (beCareful) {
+        code.forAllTmps(assumeTheWorst);
+        
+        // We fall through because the fixpoint that follows can only make things even more
+        // conservative. This mode isn't meant to be fast, just safe.
+    }
+
+    // Now really analyze everything but Move's over Tmp's, but set aside those Move's so we can find
+    // them quickly during the fixpoint below. Note that we can make this analysis stronger by
+    // recognizing more kinds of Move's or anything that has Move-like behavior, though it's probably not
+    // worth it.
+    Vector<Inst*> moves;
+    for (BasicBlock* block : code) {
+        for (Inst& inst : *block) {
+            if (inst.kind.opcode == Move && inst.args[1].isTmp()) {
+                if (inst.args[0].isTmp()) {
+                    // Make sure that both sides of the Move have a width already initialized. The
+                    // fixpoint below assumes that it never has to add things to the HashMap.
+                    m_width.add(inst.args[0].tmp(), Widths(Arg::GP));
+                    m_width.add(inst.args[1].tmp(), Widths(Arg::GP));
+                    
+                    moves.append(&inst);
+                    continue;
+                }
+                if (inst.args[0].isImm()
+                    && inst.args[0].value() >= 0) {
+                    Tmp tmp = inst.args[1].tmp();
+                    Widths& widths = m_width.add(tmp, Widths(Arg::GP)).iterator->value;
+                    
+                    if (inst.args[0].value() <= std::numeric_limits<int8_t>::max())
+                        widths.def = std::max(widths.def, Arg::Width8);
+                    else if (inst.args[0].value() <= std::numeric_limits<int16_t>::max())
+                        widths.def = std::max(widths.def, Arg::Width16);
+                    else if (inst.args[0].value() <= std::numeric_limits<int32_t>::max())
+                        widths.def = std::max(widths.def, Arg::Width32);
+                    else
+                        widths.def = std::max(widths.def, Arg::Width64);
+
+                    continue;
+                }
+            }
+            inst.forEachTmp(
+                [&] (Tmp& tmp, Arg::Role role, Arg::Type type, Arg::Width width) {
+                    Widths& widths = m_width.add(tmp, Widths(type)).iterator->value;
+                    
+                    if (Arg::isAnyUse(role))
+                        widths.use = std::max(widths.use, width);
+
+                    if (Arg::isZDef(role))
+                        widths.def = std::max(widths.def, width);
+                    else if (Arg::isAnyDef(role))
+                        widths.def = Arg::conservativeWidth(type);
+                });
+        }
+    }
+
+    // Finally, fixpoint over the Move's.
+    bool changed = true;
+    while (changed) {
+        changed = false;
+        for (Inst* move : moves) {
+            ASSERT(move->kind.opcode == Move);
+            ASSERT(move->args[0].isTmp());
+            ASSERT(move->args[1].isTmp());
+
+            // We already ensure that both tmps are added to the width map. That's important
+            // because you cannot add both tmps here while simultaneously getting a reference to
+            // their values, since the second add would invalidate the reference returned by the
+            // first one.
+            Widths& srcWidths = m_width.find(move->args[0].tmp())->value;
+            Widths& dstWidths = m_width.find(move->args[1].tmp())->value;
+
+            // Legend:
+            //
+            //     Move %src, %dst
+
+            // defWidth(%dst) is a promise about how many high bits are zero. The smaller the width, the
+            // stronger the promise. This Move may weaken that promise if we know that %src is making a
+            // weaker promise. Such forward flow is the only thing that determines defWidth().
+            if (dstWidths.def < srcWidths.def) {
+                dstWidths.def = srcWidths.def;
+                changed = true;
+            }
+
+            // srcWidth(%src) is a promise about how many high bits are ignored. The smaller the width,
+            // the stronger the promise. This Move may weaken that promise if we know that %dst is making
+            // a weaker promise. Such backward flow is the only thing that determines srcWidth().
+            if (srcWidths.use < dstWidths.use) {
+                srcWidths.use = dstWidths.use;
+                changed = true;
+            }
+        }
+    }
+
+    if (verbose)
+        dataLog("width: ", mapDump(m_width), "\n");
+}
+
+void TmpWidth::Widths::dump(PrintStream& out) const
+{
+    out.print("{use = ", use, ", def = ", def, "}");
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirTmpWidth.h b/b3/air/AirTmpWidth.h
new file mode 100644
index 0000000..ea612b6
--- /dev/null
+++ b/b3/air/AirTmpWidth.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArg.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+class TmpWidth {
+public:
+    TmpWidth();
+    TmpWidth(Code&);
+    ~TmpWidth();
+
+    void recompute(Code&);
+
+    // The width of a Tmp is the number of bits that you need to be able to track without some trivial
+    // recovery. A Tmp may have a "subwidth" (say, Width32 on a 64-bit system) if either of the following
+    // is true:
+    //
+    // - The high bits are never read.
+    // - The high bits are always zero.
+    //
+    // This doesn't tell you which of those properties holds, but you can query that using the other
+    // methods.
+    Arg::Width width(Tmp tmp) const
+    {
+        auto iter = m_width.find(tmp);
+        if (iter == m_width.end())
+            return Arg::minimumWidth(Arg(tmp).type());
+        return std::min(iter->value.use, iter->value.def);
+    }
+
+    // Return the minimum required width for all defs/uses of this Tmp.
+    Arg::Width requiredWidth(Tmp tmp)
+    {
+        auto iter = m_width.find(tmp);
+        if (iter == m_width.end())
+            return Arg::minimumWidth(Arg(tmp).type());
+        return std::max(iter->value.use, iter->value.def);
+    }
+
+    // This indirectly tells you how much of the tmp's high bits are guaranteed to be zero. The number of
+    // high bits that are zero are:
+    //
+    //     TotalBits - defWidth(tmp)
+    //
+    // Where TotalBits are the total number of bits in the register, so 64 on a 64-bit system.
+    Arg::Width defWidth(Tmp tmp) const
+    {
+        auto iter = m_width.find(tmp);
+        if (iter == m_width.end())
+            return Arg::minimumWidth(Arg(tmp).type());
+        return iter->value.def;
+    }
+
+    // This tells you how much of Tmp is going to be read.
+    Arg::Width useWidth(Tmp tmp) const
+    {
+        auto iter = m_width.find(tmp);
+        if (iter == m_width.end())
+            return Arg::minimumWidth(Arg(tmp).type());
+        return iter->value.use;
+    }
+    
+private:
+    struct Widths {
+        Widths() { }
+
+        Widths(Arg::Type type)
+        {
+            use = Arg::minimumWidth(type);
+            def = Arg::minimumWidth(type);
+        }
+
+        void dump(PrintStream& out) const;
+        
+        Arg::Width use;
+        Arg::Width def;
+    };
+    
+    HashMap<Tmp, Widths> m_width;
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirUseCounts.h b/b3/air/AirUseCounts.h
new file mode 100644
index 0000000..98a7493
--- /dev/null
+++ b/b3/air/AirUseCounts.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+#include "AirArgInlines.h"
+#include "AirBlockWorklist.h"
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include <wtf/HashMap.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+// Computes the number of uses of a variable based on frequency of execution. The frequency of blocks
+// that are only reachable by rare edges is scaled by Options::rareBlockPenalty().
+
+// Thing can be either Tmp or Arg.
+template<typename Thing>
+class UseCounts {
+public:
+    struct Counts {
+        void dump(PrintStream& out) const
+        {
+            out.print(
+                "{numWarmUses = ", numWarmUses, ", numColdUses = ", numColdUses, ", numDefs = ",
+                numDefs, "}");
+        }
+        
+        double numWarmUses { 0 };
+        double numColdUses { 0 };
+        double numDefs { 0 };
+        double numConstDefs { 0 };
+    };
+    
+    UseCounts(Code& code)
+    {
+        // Find non-rare blocks.
+        BlockWorklist fastWorklist;
+        fastWorklist.push(code[0]);
+        while (BasicBlock* block = fastWorklist.pop()) {
+            for (FrequentedBlock& successor : block->successors()) {
+                if (!successor.isRare())
+                    fastWorklist.push(successor.block());
+            }
+        }
+        
+        for (BasicBlock* block : code) {
+            double frequency = block->frequency();
+            if (!fastWorklist.saw(block))
+                frequency *= Options::rareBlockPenalty();
+            for (Inst& inst : *block) {
+                inst.forEach<Thing>(
+                    [&] (Thing& arg, Arg::Role role, Arg::Type, Arg::Width) {
+                        Counts& counts = m_counts.add(arg, Counts()).iterator->value;
+
+                        if (Arg::isWarmUse(role))
+                            counts.numWarmUses += frequency;
+                        if (Arg::isColdUse(role))
+                            counts.numColdUses += frequency;
+                        if (Arg::isAnyDef(role))
+                            counts.numDefs += frequency;
+                    });
+
+                if ((inst.kind.opcode == Move || inst.kind.opcode == Move32)
+                    && inst.args[0].isSomeImm()
+                    && inst.args[1].is<Thing>())
+                    m_counts.add(inst.args[1].as<Thing>(), Counts()).iterator->value.numConstDefs++;
+            }
+        }
+    }
+
+    const Counts* operator[](const Thing& arg) const
+    {
+        auto iter = m_counts.find(arg);
+        if (iter == m_counts.end())
+            return nullptr;
+        return &iter->value;
+    }
+
+    void dump(PrintStream& out) const
+    {
+        out.print(mapDump(m_counts));
+    }
+
+private:
+    HashMap<Thing, Counts> m_counts;
+};
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/AirValidate.cpp b/b3/air/AirValidate.cpp
new file mode 100644
index 0000000..d90de62
--- /dev/null
+++ b/b3/air/AirValidate.cpp
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AirValidate.h"
+
+#if ENABLE(B3_JIT)
+
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "B3Procedure.h"
+
+namespace JSC { namespace B3 { namespace Air {
+
+namespace {
+
+class Validater {
+public:
+    Validater(Code& code, const char* dumpBefore)
+        : m_code(code)
+        , m_dumpBefore(dumpBefore)
+    {
+    }
+
+#define VALIDATE(condition, message) do {                               \
+        if (condition)                                                  \
+            break;                                                      \
+        fail(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, #condition, toCString message); \
+    } while (false)
+    
+    void run()
+    {
+        HashSet<StackSlot*> validSlots;
+        HashSet<BasicBlock*> validBlocks;
+        HashSet<Special*> validSpecials;
+        
+        for (BasicBlock* block : m_code)
+            validBlocks.add(block);
+        for (StackSlot* slot : m_code.stackSlots())
+            validSlots.add(slot);
+        for (Special* special : m_code.specials())
+            validSpecials.add(special);
+
+        for (BasicBlock* block : m_code) {
+            // Blocks that are entrypoints must not have predecessors.
+            if (m_code.isEntrypoint(block))
+                VALIDATE(!block->numPredecessors(), ("At entrypoint ", *block));
+            
+            for (unsigned instIndex = 0; instIndex < block->size(); ++instIndex) {
+                Inst& inst = block->at(instIndex);
+                for (Arg& arg : inst.args) {
+                    switch (arg.kind()) {
+                    case Arg::Stack:
+                        VALIDATE(validSlots.contains(arg.stackSlot()), ("At ", inst, " in ", *block));
+                        break;
+                    case Arg::Special:
+                        VALIDATE(validSpecials.contains(arg.special()), ("At ", inst, " in ", *block));
+                        break;
+                    default:
+                        break;
+                    }
+                }
+                VALIDATE(inst.isValidForm(), ("At ", inst, " in ", *block));
+                if (instIndex == block->size() - 1)
+                    VALIDATE(inst.isTerminal(), ("At ", inst, " in ", *block));
+                else
+                    VALIDATE(!inst.isTerminal(), ("At ", inst, " in ", *block));
+
+                // forEachArg must return Arg&'s that point into the args array.
+                inst.forEachArg(
+                    [&] (Arg& arg, Arg::Role, Arg::Type, Arg::Width) {
+                        VALIDATE(&arg >= &inst.args[0], ("At ", arg, " in ", inst, " in ", *block));
+                        VALIDATE(&arg <= &inst.args.last(), ("At ", arg, " in ", inst, " in ", *block));
+                    });
+                
+                switch (inst.kind.opcode) {
+                case EntrySwitch:
+                    VALIDATE(block->numSuccessors() == m_code.proc().numEntrypoints(), ("At ", inst, " in ", *block));
+                    break;
+                case Shuffle:
+                    // We can't handle trapping shuffles because of how we lower them. That could
+                    // be fixed though.
+                    VALIDATE(!inst.kind.traps, ("At ", inst, " in ", *block));
+                    break;
+                default:
+                    break;
+                }
+            }
+            for (BasicBlock* successor : block->successorBlocks())
+                VALIDATE(validBlocks.contains(successor), ("In ", *block));
+        }
+    }
+
+private:
+    NO_RETURN_DUE_TO_CRASH void fail(
+        const char* filename, int lineNumber, const char* function, const char* condition,
+        CString message)
+    {
+        CString failureMessage;
+        {
+            StringPrintStream out;
+            out.print("AIR VALIDATION FAILURE\n");
+            out.print("    ", condition, " (", filename, ":", lineNumber, ")\n");
+            out.print("    ", message, "\n");
+            out.print("    After ", m_code.lastPhaseName(), "\n");
+            failureMessage = out.toCString();
+        }
+
+        dataLog(failureMessage);
+        if (m_dumpBefore) {
+            dataLog("Before ", m_code.lastPhaseName(), ":\n");
+            dataLog(m_dumpBefore);
+        }
+        dataLog("At time of failure:\n");
+        dataLog(m_code);
+
+        dataLog(failureMessage);
+        WTFReportAssertionFailure(filename, lineNumber, function, condition);
+        CRASH();
+    }
+    
+    Code& m_code;
+    const char* m_dumpBefore;
+};
+
+} // anonymous namespace
+
+void validate(Code& code, const char* dumpBefore)
+{
+    Validater validater(code, dumpBefore);
+    validater.run();
+}
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
+
diff --git a/b3/air/AirValidate.h b/b3/air/AirValidate.h
new file mode 100644
index 0000000..472c763
--- /dev/null
+++ b/b3/air/AirValidate.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(B3_JIT)
+
+namespace JSC { namespace B3 { namespace Air {
+
+class Code;
+
+JS_EXPORT_PRIVATE void validate(Code&, const char* dumpBefore = nullptr);
+
+} } } // namespace JSC::B3::Air
+
+#endif // ENABLE(B3_JIT)
diff --git a/b3/air/opcode_generator.rb b/b3/air/opcode_generator.rb
new file mode 100644
index 0000000..d142405
--- /dev/null
+++ b/b3/air/opcode_generator.rb
@@ -0,0 +1,1228 @@
+#!/usr/bin/env ruby
+
+# Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "pathname"
+
+class Opcode
+    attr_reader :name, :custom, :overloads
+    attr_reader :attributes
+
+    def initialize(name, custom)
+        @name = name
+        @custom = custom
+        @attributes = {}
+        unless custom
+            @overloads = []
+        end
+    end
+
+    def masmName
+        name[0].downcase + name[1..-1]
+    end
+end
+
+class Arg
+    attr_reader :role, :type, :width
+
+    def initialize(role, type, width)
+        @role = role
+        @type = type
+        @width = width
+    end
+
+    def widthCode
+        if width == "Ptr"
+            "Arg::pointerWidth()"
+        else
+            "Arg::Width#{width}"
+        end
+    end
+end
+
+class Overload
+    attr_reader :signature, :forms
+
+    def initialize(signature, forms)
+        @signature = signature
+        @forms = forms
+    end
+end
+
+class Kind
+    attr_reader :name
+    attr_accessor :custom
+
+    def initialize(name)
+        @name = name
+        @custom = false
+    end
+
+    def ==(other)
+        if other.is_a? String
+            @name == other
+        else
+            @name == other.name and @custom == other.custom
+        end
+    end
+
+    def Kind.argKinds(kind)
+        if kind == "Addr"
+            ["Addr", "Stack", "CallArg"]
+        else
+            [kind]
+        end
+    end
+
+    def argKinds
+        Kind.argKinds(kind)
+    end
+end
+
+class Form
+    attr_reader :kinds, :altName, :archs
+
+    def initialize(kinds, altName, archs)
+        @kinds = kinds
+        @altName = altName
+        @archs = archs
+    end
+end
+
+class Origin
+    attr_reader :fileName, :lineNumber
+    
+    def initialize(fileName, lineNumber)
+        @fileName = fileName
+        @lineNumber = lineNumber
+    end
+    
+    def to_s
+        "#{fileName}:#{lineNumber}"
+    end
+end
+
+class Token
+    attr_reader :origin, :string
+    
+    def initialize(origin, string)
+        @origin = origin
+        @string = string
+    end
+    
+    def ==(other)
+        if other.is_a? Token
+            @string == other.string
+        else
+            @string == other
+        end
+    end
+    
+    def =~(other)
+        @string =~ other
+    end
+    
+    def to_s
+        "#{@string.inspect} at #{origin}"
+    end
+    
+    def parseError(*comment)
+        if comment.empty?
+            raise "Parse error: #{to_s}"
+        else
+            raise "Parse error: #{to_s}: #{comment[0]}"
+        end
+    end
+end
+
+def lex(str, fileName)
+    fileName = Pathname.new(fileName)
+    result = []
+    lineNumber = 1
+    while not str.empty?
+        case str
+        when /\A\#([^\n]*)/
+            # comment, ignore
+        when /\A\n/
+            # newline, ignore
+            lineNumber += 1
+        when /\A([a-zA-Z0-9_]+)/
+            result << Token.new(Origin.new(fileName, lineNumber), $&)
+        when /\A([ \t\r]+)/
+            # whitespace, ignore
+        when /\A[,:*\/]/
+            result << Token.new(Origin.new(fileName, lineNumber), $&)
+        else
+            raise "Lexer error at #{Origin.new(fileName, lineNumber).to_s}, unexpected sequence #{str[0..20].inspect}"
+        end
+        str = $~.post_match
+    end
+    result
+end
+
+def isRole(token)
+    token =~ /\A((U)|(D)|(UD)|(ZD)|(UZD)|(UA)|(S))\Z/
+end
+
+def isGF(token)
+    token =~ /\A((G)|(F))\Z/
+end
+
+def isKind(token)
+    token =~ /\A((Tmp)|(Imm)|(BigImm)|(BitImm)|(BitImm64)|(Addr)|(Index)|(RelCond)|(ResCond)|(DoubleCond))\Z/
+end
+
+def isArch(token)
+    token =~ /\A((x86)|(x86_32)|(x86_64)|(arm)|(armv7)|(arm64)|(32)|(64))\Z/
+end
+
+def isWidth(token)
+    token =~ /\A((8)|(16)|(32)|(64)|(Ptr))\Z/
+end
+
+def isKeyword(token)
+    isRole(token) or isGF(token) or isKind(token) or isArch(token) or isWidth(token) or
+        token == "custom" or token == "as"
+end
+
+def isIdentifier(token)
+    token =~ /\A([a-zA-Z0-9_]+)\Z/ and not isKeyword(token)
+end
+
+class Parser
+    def initialize(data, fileName)
+        @tokens = lex(data, fileName)
+        @idx = 0
+    end
+
+    def token
+        @tokens[@idx]
+    end
+
+    def advance
+        @idx += 1
+    end
+
+    def parseError(*comment)
+        if token
+            token.parseError(*comment)
+        else
+            if comment.empty?
+                raise "Parse error at end of file"
+            else
+                raise "Parse error at end of file: #{comment[0]}"
+            end
+        end
+    end
+
+    def consume(string)
+        parseError("Expected #{string}") unless token == string
+        advance
+    end
+
+    def consumeIdentifier
+        result = token.string
+        parseError("Expected identifier") unless isIdentifier(result)
+        advance
+        result
+    end
+
+    def consumeRole
+        result = token.string
+        parseError("Expected role (U, D, UD, ZD, UZD, UA, or S)") unless isRole(result)
+        advance
+        result
+    end
+
+    def consumeType
+        result = token.string
+        parseError("Expected type (G or F)") unless isGF(result)
+        advance
+        result
+    end
+
+    def consumeKind
+        result = token.string
+        parseError("Expected kind (Imm, BigImm, BitImm, BitImm64, Tmp, Addr, Index, RelCond, ResCond, or DoubleCond)") unless isKind(result)
+        advance
+        result
+    end
+
+    def consumeWidth
+        result = token.string
+        parseError("Expected width (8, 16, 32, or 64)") unless isWidth(result)
+        advance
+        result
+    end
+
+    def parseArchs
+        return nil unless isArch(token)
+
+        result = []
+        while isArch(token)
+            case token.string
+            when "x86"
+                result << "X86"
+                result << "X86_64"
+            when "x86_32"
+                result << "X86"
+            when "x86_64"
+                result << "X86_64"
+            when "arm"
+                result << "ARMv7"
+                result << "ARM64"
+            when "armv7"
+                result << "ARMv7"
+            when "arm64"
+                result << "ARM64"
+            when "32"
+                result << "X86"
+                result << "ARMv7"
+            when "64"
+                result << "X86_64"
+                result << "ARM64"
+            else
+                raise token.string
+            end
+            advance
+        end
+
+        consume(":")
+        @lastArchs = result
+    end
+
+    def consumeArchs
+        result = @lastArchs
+        @lastArchs = nil
+        result
+    end
+
+    def parseAndConsumeArchs
+        parseArchs
+        consumeArchs
+    end
+
+    def intersectArchs(left, right)
+        return left unless right
+        return right unless left
+
+        left.select {
+            | value |
+            right.find {
+                | otherValue |
+                value == otherValue
+            }
+        }
+    end
+
+    def parse
+        result = {}
+        
+        loop {
+            break if @idx >= @tokens.length
+
+            if token == "custom"
+                consume("custom")
+                opcodeName = consumeIdentifier
+
+                parseError("Cannot overload a custom opcode") if result[opcodeName]
+
+                result[opcodeName] = Opcode.new(opcodeName, true)
+            else
+                opcodeArchs = parseAndConsumeArchs
+
+                opcodeName = consumeIdentifier
+
+                if result[opcodeName]
+                    opcode = result[opcodeName]
+                    parseError("Cannot overload a custom opcode") if opcode.custom
+                else
+                    opcode = Opcode.new(opcodeName, false)
+                    result[opcodeName] = opcode
+                end
+
+                signature = []
+                forms = []
+                
+                if isRole(token)
+                    loop {
+                        role = consumeRole
+                        consume(":")
+                        type = consumeType
+                        consume(":")
+                        width = consumeWidth
+                        
+                        signature << Arg.new(role, type, width)
+                        
+                        break unless token == ","
+                        consume(",")
+                    }
+                end
+
+                while token == "/"
+                    consume("/")
+                    case token.string
+                    when "branch"
+                        opcode.attributes[:branch] = true
+                        opcode.attributes[:terminal] = true
+                    when "terminal"
+                        opcode.attributes[:terminal] = true
+                    when "effects"
+                        opcode.attributes[:effects] = true
+                    when "return"
+                        opcode.attributes[:return] = true
+                        opcode.attributes[:terminal] = true
+                    else
+                        parseError("Bad / directive")
+                    end
+                    advance
+                end
+
+                parseArchs
+                if isKind(token)
+                    loop {
+                        kinds = []
+                        altName = nil
+                        formArchs = consumeArchs
+                        loop {
+                            kinds << Kind.new(consumeKind)
+
+                            if token == "*"
+                                parseError("Can only apply * to Tmp") unless kinds[-1].name == "Tmp"
+                                kinds[-1].custom = true
+                                consume("*")
+                            end
+
+                            break unless token == ","
+                            consume(",")
+                        }
+
+                        if token == "as"
+                            consume("as")
+                            altName = consumeIdentifier
+                        end
+
+                        parseError("Form has wrong number of arguments for overload") unless kinds.length == signature.length
+                        kinds.each_with_index {
+                            | kind, index |
+                            if kind.name == "Imm" or kind.name == "BigImm" or kind.name == "BitImm" or kind.name == "BitImm64"
+                                if signature[index].role != "U"
+                                    parseError("Form has an immediate for a non-use argument")
+                                end
+                                if signature[index].type != "G"
+                                    parseError("Form has an immediate for a non-general-purpose argument")
+                                end
+                            end
+                        }
+                        forms << Form.new(kinds, altName, intersectArchs(opcodeArchs, formArchs))
+
+                        parseArchs
+                        break unless isKind(token)
+                    }
+                end
+
+                if signature.length == 0
+                    raise unless forms.length == 0
+                    forms << Form.new([], nil, opcodeArchs)
+                end
+
+                opcode.overloads << Overload.new(signature, forms)
+            end
+        }
+
+        result
+    end
+end
+
+$fileName = ARGV[0]
+
+parser = Parser.new(IO::read($fileName), $fileName)
+$opcodes = parser.parse
+
+def writeH(filename)
+    File.open("Air#{filename}.h", "w") {
+        | outp |
+        
+        outp.puts "// Generated by opcode_generator.rb from #{$fileName} -- do not edit!"
+        
+        outp.puts "#ifndef Air#{filename}_h"
+        outp.puts "#define Air#{filename}_h"
+
+        yield outp
+        
+        outp.puts "#endif // Air#{filename}_h"
+    }
+end
+
+writeH("Opcode") {
+    | outp |
+    outp.puts "namespace JSC { namespace B3 { namespace Air {"
+    outp.puts "enum Opcode : int16_t {"
+    $opcodes.keys.sort.each {
+        | opcode |
+        outp.puts "    #{opcode},"
+    }
+    outp.puts "};"
+
+    outp.puts "static const unsigned numOpcodes = #{$opcodes.keys.size};"
+    outp.puts "} } } // namespace JSC::B3::Air"
+    
+    outp.puts "namespace WTF {"
+    outp.puts "class PrintStream;"
+    outp.puts "JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::B3::Air::Opcode);"
+    outp.puts "} // namespace WTF"
+}
+
+# From here on, we don't try to emit properly indented code, since we're using a recursive pattern
+# matcher.
+
+def matchForms(outp, speed, forms, columnIndex, columnGetter, filter, callback)
+    return if forms.length == 0
+
+    if filter[forms]
+        return
+    end
+
+    if columnIndex >= forms[0].kinds.length
+        raise "Did not reduce to one form: #{forms.inspect}" unless forms.length == 1
+        callback[forms[0]]
+        outp.puts "break;"
+        return
+    end
+    
+    groups = {}
+    forms.each {
+        | form |
+        kind = form.kinds[columnIndex].name
+        if groups[kind]
+            groups[kind] << form
+        else
+            groups[kind] = [form]
+        end
+    }
+
+    if speed == :fast and groups.length == 1
+        matchForms(outp, speed, forms, columnIndex + 1, columnGetter, filter, callback)
+        return
+    end
+
+    outp.puts "switch (#{columnGetter[columnIndex]}) {"
+    groups.each_pair {
+        | key, value |
+        outp.puts "#if USE(JSVALUE64)" if key == "BigImm" or key == "BitImm64"
+        Kind.argKinds(key).each {
+            | argKind |
+            outp.puts "case Arg::#{argKind}:"
+        }
+        matchForms(outp, speed, value, columnIndex + 1, columnGetter, filter, callback)
+        outp.puts "break;"
+        outp.puts "#endif // USE(JSVALUE64)" if key == "BigImm" or key == "BitImm64"
+    }
+    outp.puts "default:"
+    outp.puts "break;"
+    outp.puts "}"
+end
+
+def matchInstOverload(outp, speed, inst)
+    outp.puts "switch (#{inst}->kind.opcode) {"
+    $opcodes.values.each {
+        | opcode |
+        outp.puts "case #{opcode.name}:"
+        if opcode.custom
+            yield opcode, nil
+        else
+            needOverloadSwitch = ((opcode.overloads.size != 1) or speed == :safe)
+            outp.puts "switch (#{inst}->args.size()) {" if needOverloadSwitch
+            opcode.overloads.each {
+                | overload |
+                outp.puts "case #{overload.signature.length}:" if needOverloadSwitch
+                yield opcode, overload
+                outp.puts "break;" if needOverloadSwitch
+            }
+            if needOverloadSwitch
+                outp.puts "default:"
+                outp.puts "break;"
+                outp.puts "}"
+            end
+        end
+        outp.puts "break;"
+    }
+    outp.puts "default:"
+    outp.puts "break;"
+    outp.puts "}"
+end
+    
+def matchInstOverloadForm(outp, speed, inst)
+    matchInstOverload(outp, speed, inst) {
+        | opcode, overload |
+        if opcode.custom
+            yield opcode, nil, nil
+        else
+            columnGetter = proc {
+                | columnIndex |
+                "#{inst}->args[#{columnIndex}].kind()"
+            }
+            filter = proc { false }
+            callback = proc {
+                | form |
+                yield opcode, overload, form
+            }
+            matchForms(outp, speed, overload.forms, 0, columnGetter, filter, callback)
+        end
+    }
+end
+
+def beginArchs(outp, archs)
+    return unless archs
+    if archs.empty?
+        outp.puts "#if 0"
+        return
+    end
+    outp.puts("#if " + archs.map {
+                  | arch |
+                  "CPU(#{arch})"
+              }.join(" || "))
+end
+
+def endArchs(outp, archs)
+    return unless archs
+    outp.puts "#endif"
+end
+
+writeH("OpcodeUtils") {
+    | outp |
+    outp.puts "#include \"AirCustom.h\""
+    outp.puts "#include \"AirInst.h\""
+    outp.puts "namespace JSC { namespace B3 { namespace Air {"
+    
+    outp.puts "inline bool opgenHiddenTruth() { return true; }"
+    outp.puts "template<typename T>"
+    outp.puts "inline T* opgenHiddenPtrIdentity(T* pointer) { return pointer; }"
+    outp.puts "#define OPGEN_RETURN(value) do {\\"
+    outp.puts "    if (opgenHiddenTruth())\\"
+    outp.puts "        return value;\\"
+    outp.puts "} while (false)"
+
+    outp.puts "template<typename Functor>"
+    outp.puts "void Inst::forEachArg(const Functor& functor)"
+    outp.puts "{"
+    matchInstOverload(outp, :fast, "this") {
+        | opcode, overload |
+        if opcode.custom
+            outp.puts "#{opcode.name}Custom::forEachArg(*this, functor);"
+        else
+            overload.signature.each_with_index {
+                | arg, index |
+                
+                role = nil
+                case arg.role
+                when "U"
+                    role = "Use"
+                when "D"
+                    role = "Def"
+                when "ZD"
+                    role = "ZDef"
+                when "UD"
+                    role = "UseDef"
+                when "UZD"
+                    role = "UseZDef"
+                when "UA"
+                    role = "UseAddr"
+                when "S"
+                    role = "Scratch"
+                else
+                    raise
+                end
+
+                outp.puts "functor(args[#{index}], Arg::#{role}, Arg::#{arg.type}P, #{arg.widthCode});"
+            }
+        end
+    }
+    outp.puts "}"
+
+    outp.puts "template<typename... Arguments>"
+    outp.puts "ALWAYS_INLINE bool isValidForm(Opcode opcode, Arguments... arguments)"
+    outp.puts "{"
+    outp.puts "Arg::Kind kinds[sizeof...(Arguments)] = { arguments... };"
+    outp.puts "switch (opcode) {"
+    $opcodes.values.each {
+        | opcode |
+        outp.puts "case #{opcode.name}:"
+        if opcode.custom
+            outp.puts "OPGEN_RETURN(#{opcode.name}Custom::isValidFormStatic(arguments...));"
+        else
+            outp.puts "switch (sizeof...(Arguments)) {"
+            opcode.overloads.each {
+                | overload |
+                outp.puts "case #{overload.signature.length}:"
+                columnGetter = proc { | columnIndex | "opgenHiddenPtrIdentity(kinds)[#{columnIndex}]" }
+                filter = proc { false }
+                callback = proc {
+                    | form |
+                    # This conservatively says that Stack is not a valid form for UseAddr,
+                    # because it's only valid if it's not a spill slot. This is consistent with
+                    # isValidForm() being conservative and it also happens to be practical since
+                    # we don't really use isValidForm for deciding when Stack is safe.
+                    overload.signature.length.times {
+                        | index |
+                        if overload.signature[index].role == "UA"
+                            outp.puts "if (opgenHiddenPtrIdentity(kinds)[#{index}] == Arg::Stack)"
+                            outp.puts "    return false;"
+                        end
+                    }
+                    
+                    notCustom = (not form.kinds.detect { | kind | kind.custom })
+                    if notCustom
+                        beginArchs(outp, form.archs)
+                        outp.puts "OPGEN_RETURN(true);"
+                        endArchs(outp, form.archs)
+                    end
+                }
+                matchForms(outp, :safe, overload.forms, 0, columnGetter, filter, callback)
+                outp.puts "break;"
+            }
+            outp.puts "default:"
+            outp.puts "break;"
+            outp.puts "}"
+        end
+        outp.puts "break;"
+    }
+    outp.puts "default:"
+    outp.puts "break;"
+    outp.puts "}"
+    outp.puts "return false; "
+    outp.puts "}"
+
+    outp.puts "inline bool isDefinitelyTerminal(Opcode opcode)"
+    outp.puts "{"
+    outp.puts "switch (opcode) {"
+    didFindTerminals = false
+    $opcodes.values.each {
+        | opcode |
+        if opcode.attributes[:terminal]
+            outp.puts "case #{opcode.name}:"
+            didFindTerminals = true
+        end
+    }
+    if didFindTerminals
+        outp.puts "return true;"
+    end
+    outp.puts "default:"
+    outp.puts "return false;"
+    outp.puts "}"
+    outp.puts "}"
+
+    outp.puts "inline bool isReturn(Opcode opcode)"
+    outp.puts "{"
+    outp.puts "switch (opcode) {"
+    didFindReturns = false
+    $opcodes.values.each {
+        | opcode |
+        if opcode.attributes[:return]
+            outp.puts "case #{opcode.name}:"
+            didFindReturns = true
+        end
+    }
+    if didFindReturns
+        outp.puts "return true;"
+    end
+    outp.puts "default:"
+    outp.puts "return false;"
+    outp.puts "}"
+    outp.puts "}"
+    
+    outp.puts "} } } // namespace JSC::B3::Air"
+}
+
+writeH("OpcodeGenerated") {
+    | outp |
+    outp.puts "#include \"AirInstInlines.h\""
+    outp.puts "#include \"wtf/PrintStream.h\""
+    outp.puts "namespace WTF {"
+    outp.puts "using namespace JSC::B3::Air;"
+    outp.puts "void printInternal(PrintStream& out, Opcode opcode)"
+    outp.puts "{"
+    outp.puts "    switch (opcode) {"
+    $opcodes.keys.each {
+        | opcode |
+        outp.puts "    case #{opcode}:"
+        outp.puts "        out.print(\"#{opcode}\");"
+        outp.puts "        return;"
+    }
+    outp.puts "    }"
+    outp.puts "    RELEASE_ASSERT_NOT_REACHED();"
+    outp.puts "}"
+    outp.puts "} // namespace WTF"
+    outp.puts "namespace JSC { namespace B3 { namespace Air {"
+    outp.puts "bool Inst::isValidForm()"
+    outp.puts "{"
+    matchInstOverloadForm(outp, :safe, "this") {
+        | opcode, overload, form |
+        if opcode.custom
+            outp.puts "OPGEN_RETURN(#{opcode.name}Custom::isValidForm(*this));"
+        else
+            beginArchs(outp, form.archs)
+            needsMoreValidation = false
+            overload.signature.length.times {
+                | index |
+                arg = overload.signature[index]
+                kind = form.kinds[index]
+                needsMoreValidation |= kind.custom
+
+                # Some kinds of Args reqire additional validation.
+                case kind.name
+                when "Tmp"
+                    outp.puts "if (!args[#{index}].tmp().is#{arg.type}P())"
+                    outp.puts "OPGEN_RETURN(false);"
+                when "Imm"
+                    outp.puts "if (!Arg::isValidImmForm(args[#{index}].value()))"
+                    outp.puts "OPGEN_RETURN(false);"
+                when "BitImm"
+                    outp.puts "if (!Arg::isValidBitImmForm(args[#{index}].value()))"
+                    outp.puts "OPGEN_RETURN(false);"
+                when "BitImm64"
+                    outp.puts "if (!Arg::isValidBitImm64Form(args[#{index}].value()))"
+                    outp.puts "OPGEN_RETURN(false);"
+                when "Addr"
+                    if arg.role == "UA"
+                        outp.puts "if (args[#{index}].isStack() && args[#{index}].stackSlot()->isSpill())"
+                        outp.puts "OPGEN_RETURN(false);"
+                    end
+                    
+                    outp.puts "if (!Arg::isValidAddrForm(args[#{index}].offset()))"
+                    outp.puts "OPGEN_RETURN(false);"
+                when "Index"
+                    outp.puts "if (!Arg::isValidIndexForm(args[#{index}].scale(), args[#{index}].offset(), #{arg.widthCode}))"
+                    outp.puts "OPGEN_RETURN(false);"
+                when "BigImm"
+                when "RelCond"
+                when "ResCond"
+                when "DoubleCond"
+                else
+                    raise "Unexpected kind: #{kind.name}"
+                end
+            }
+            if needsMoreValidation
+                outp.puts "if (!is#{opcode.name}Valid(*this))"
+                outp.puts "OPGEN_RETURN(false);"
+            end
+            outp.puts "OPGEN_RETURN(true);"
+            endArchs(outp, form.archs)
+        end
+    }
+    outp.puts "return false;"
+    outp.puts "}"
+
+    outp.puts "bool Inst::admitsStack(unsigned argIndex)"
+    outp.puts "{"
+    outp.puts "switch (kind.opcode) {"
+    $opcodes.values.each {
+        | opcode |
+        outp.puts "case #{opcode.name}:"
+
+        if opcode.custom
+            outp.puts "OPGEN_RETURN(#{opcode.name}Custom::admitsStack(*this, argIndex));"
+        else
+            # Switch on the argIndex.
+            outp.puts "switch (argIndex) {"
+
+            numArgs = opcode.overloads.map {
+                | overload |
+                overload.signature.length
+            }.max
+            
+            numArgs.times {
+                | argIndex |
+                outp.puts "case #{argIndex}:"
+
+                # Check if all of the forms of all of the overloads either do, or don't, admit an address
+                # at this index. We expect this to be a very common case.
+                numYes = 0
+                numNo = 0
+                opcode.overloads.each {
+                    | overload |
+                    useAddr = (overload.signature[argIndex] and
+                               overload.signature[argIndex].role == "UA")
+                    overload.forms.each {
+                        | form |
+                        if form.kinds[argIndex] == "Addr" and not useAddr
+                            numYes += 1
+                        else
+                            numNo += 1
+                        end
+                    }
+                }
+
+                # Note that we deliberately test numYes first because if we end up with no forms, we want
+                # to say that Address is inadmissible.
+                if numYes == 0
+                    outp.puts "OPGEN_RETURN(false);"
+                elsif numNo == 0
+                    outp.puts "OPGEN_RETURN(true);"
+                else
+                    # Now do the full test.
+
+                    needOverloadSwitch = (opcode.overloads.size != 1)
+
+                    outp.puts "switch (args.size()) {" if needOverloadSwitch
+                    opcode.overloads.each {
+                        | overload |
+
+                        useAddr = (overload.signature[argIndex] and
+                                   overload.signature[argIndex].role == "UA")
+                        
+                        # Again, check if all of them do what we want.
+                        numYes = 0
+                        numNo = 0
+                        overload.forms.each {
+                            | form |
+                            if form.kinds[argIndex] == "Addr" and not useAddr
+                                numYes += 1
+                            else
+                                numNo += 1
+                            end
+                        }
+
+                        if numYes == 0
+                            # Don't emit anything, just drop to default.
+                        elsif numNo == 0
+                            outp.puts "case #{overload.signature.length}:" if needOverloadSwitch
+                            outp.puts "OPGEN_RETURN(true);"
+                            outp.puts "break;" if needOverloadSwitch
+                        else
+                            outp.puts "case #{overload.signature.length}:" if needOverloadSwitch
+
+                            # This is how we test the hypothesis that changing this argument to an
+                            # address yields a valid form.
+                            columnGetter = proc {
+                                | columnIndex |
+                                if columnIndex == argIndex
+                                    "Arg::Addr"
+                                else
+                                    "args[#{columnIndex}].kind()"
+                                end
+                            }
+                            filter = proc {
+                                | forms |
+                                numYes = 0
+
+                                forms.each {
+                                    | form |
+                                    if form.kinds[argIndex] == "Addr"
+                                        numYes += 1
+                                    end
+                                }
+
+                                if numYes == 0
+                                    # Drop down, emit no code, since we cannot match.
+                                    true
+                                else
+                                    # Keep going.
+                                    false
+                                end
+                            }
+                            callback = proc {
+                                | form |
+                                beginArchs(outp, form.archs)
+                                outp.puts "OPGEN_RETURN(true);"
+                                endArchs(outp, form.archs)
+                            }
+                            matchForms(outp, :safe, overload.forms, 0, columnGetter, filter, callback)
+
+                            outp.puts "break;" if needOverloadSwitch
+                        end
+                    }
+                    if needOverloadSwitch
+                        outp.puts "default:"
+                        outp.puts "break;"
+                        outp.puts "}"
+                    end
+                end
+                
+                outp.puts "break;"
+            }
+            
+            outp.puts "default:"
+            outp.puts "break;"
+            outp.puts "}"
+        end
+        
+        outp.puts "break;"
+    }
+    outp.puts "default:";
+    outp.puts "break;"
+    outp.puts "}"
+    outp.puts "return false;"
+    outp.puts "}"
+
+    outp.puts "bool Inst::isTerminal()"
+    outp.puts "{"
+    outp.puts "switch (kind.opcode) {"
+    foundTrue = false
+    $opcodes.values.each {
+        | opcode |
+        if opcode.attributes[:terminal]
+            outp.puts "case #{opcode.name}:"
+            foundTrue = true
+        end
+    }
+    if foundTrue
+        outp.puts "return true;"
+    end
+    $opcodes.values.each {
+        | opcode |
+        if opcode.custom
+            outp.puts "case #{opcode.name}:"
+            outp.puts "return #{opcode.name}Custom::isTerminal(*this);"
+        end
+    }
+    outp.puts "default:"
+    outp.puts "return false;"
+    outp.puts "}"
+    outp.puts "}"
+    
+    outp.puts "bool Inst::hasNonArgNonControlEffects()"
+    outp.puts "{"
+    outp.puts "if (kind.traps)"
+    outp.puts "return true;"
+    outp.puts "switch (kind.opcode) {"
+    foundTrue = false
+    $opcodes.values.each {
+        | opcode |
+        if opcode.attributes[:effects]
+            outp.puts "case #{opcode.name}:"
+            foundTrue = true
+        end
+    }
+    if foundTrue
+        outp.puts "return true;"
+    end
+    $opcodes.values.each {
+        | opcode |
+        if opcode.custom
+            outp.puts "case #{opcode.name}:"
+            outp.puts "return #{opcode.name}Custom::hasNonArgNonControlEffects(*this);"
+        end
+    }
+    outp.puts "default:"
+    outp.puts "return false;"
+    outp.puts "}"
+    outp.puts "}"
+    
+    outp.puts "bool Inst::hasNonArgEffects()"
+    outp.puts "{"
+    outp.puts "if (kind.traps)"
+    outp.puts "return true;"
+    outp.puts "switch (kind.opcode) {"
+    foundTrue = false
+    $opcodes.values.each {
+        | opcode |
+        if opcode.attributes[:terminal] or opcode.attributes[:effects]
+            outp.puts "case #{opcode.name}:"
+            foundTrue = true
+        end
+    }
+    if foundTrue
+        outp.puts "return true;"
+    end
+    $opcodes.values.each {
+        | opcode |
+        if opcode.custom
+            outp.puts "case #{opcode.name}:"
+            outp.puts "return #{opcode.name}Custom::hasNonArgEffects(*this);"
+        end
+    }
+    outp.puts "default:"
+    outp.puts "return false;"
+    outp.puts "}"
+    outp.puts "}"
+    
+    outp.puts "CCallHelpers::Jump Inst::generate(CCallHelpers& jit, GenerationContext& context)"
+    outp.puts "{"
+    outp.puts "UNUSED_PARAM(jit);"
+    outp.puts "UNUSED_PARAM(context);"
+    outp.puts "CCallHelpers::Jump result;"
+    matchInstOverloadForm(outp, :fast, "this") {
+        | opcode, overload, form |
+        if opcode.custom
+            outp.puts "OPGEN_RETURN(#{opcode.name}Custom::generate(*this, jit, context));"
+        else
+            beginArchs(outp, form.archs)
+            if form.altName
+                methodName = form.altName
+            else
+                methodName = opcode.masmName
+            end
+            if opcode.attributes[:branch]
+                outp.print "result = "
+            end
+            outp.print "jit.#{methodName}("
+
+            form.kinds.each_with_index {
+                | kind, index |
+                if index != 0
+                    outp.print ", "
+                end
+                case kind.name
+                when "Tmp"
+                    if overload.signature[index].type == "G"
+                        outp.print "args[#{index}].gpr()"
+                    else
+                        outp.print "args[#{index}].fpr()"
+                    end
+                when "Imm", "BitImm"
+                    outp.print "args[#{index}].asTrustedImm32()"
+                when "BigImm", "BitImm64"
+                    outp.print "args[#{index}].asTrustedImm64()"
+                when "Addr"
+                    outp.print "args[#{index}].asAddress()"
+                when "Index"
+                    outp.print "args[#{index}].asBaseIndex()"
+                when "RelCond"
+                    outp.print "args[#{index}].asRelationalCondition()"
+                when "ResCond"
+                    outp.print "args[#{index}].asResultCondition()"
+                when "DoubleCond"
+                    outp.print "args[#{index}].asDoubleCondition()"
+                end
+            }
+
+            outp.puts ");"
+            outp.puts "OPGEN_RETURN(result);"
+            endArchs(outp, form.archs)
+        end
+    }
+    outp.puts "RELEASE_ASSERT_NOT_REACHED();"
+    outp.puts "return result;"
+    outp.puts "}"
+
+    outp.puts "} } } // namespace JSC::B3::Air"
+}
+
+# This is a hack for JSAir. It's a joke.
+File.open("JSAir_opcode.js", "w") {
+    | outp |
+    outp.puts "\"use strict\";"
+    outp.puts "// Generated by opcode_generator.rb from #{$fileName} -- do not edit!"
+    
+    $opcodes.values.each {
+        | opcode |
+        outp.puts "const #{opcode.name} = Symbol(#{opcode.name.inspect});"
+    }
+    
+    outp.puts "function Inst_forEachArg(inst, func)"
+    outp.puts "{"
+    outp.puts "let replacement;"
+    outp.puts "switch (inst.opcode) {"
+    $opcodes.values.each {
+        | opcode |
+        outp.puts "case #{opcode.name}:"
+        if opcode.custom
+            outp.puts "#{opcode.name}Custom.forEachArg(inst, func);"
+        else
+            needOverloadSwitch = opcode.overloads.size != 1
+            outp.puts "switch (inst.args.length) {" if needOverloadSwitch
+            opcode.overloads.each {
+                | overload |
+                outp.puts "case #{overload.signature.length}:" if needOverloadSwitch
+                overload.signature.each_with_index {
+                    | arg, index |
+                    role = nil
+                    case arg.role
+                    when "U"
+                        role = "Use"
+                    when "D"
+                        role = "Def"
+                    when "ZD"
+                        role = "ZDef"
+                    when "UD"
+                        role = "UseDef"
+                    when "UZD"
+                        role = "UseZDef"
+                    when "UA"
+                        role = "UseAddr"
+                    when "S"
+                        role = "Scratch"
+                    else
+                        raise
+                    end
+                    
+                    outp.puts "inst.visitArg(#{index}, func, Arg.#{role}, #{arg.type}P, #{arg.width});"
+                }
+                outp.puts "break;"
+            }
+            if needOverloadSwitch
+                outp.puts "default:"
+                outp.puts "throw new Error(\"Bad overload\");"
+                outp.puts "break;"
+                outp.puts "}"
+            end
+        end
+        outp.puts "break;"
+    }
+    outp.puts "default:"
+    outp.puts "throw \"Bad opcode\";"
+    outp.puts "}"
+    outp.puts "}"
+    
+    outp.puts "function Inst_hasNonArgEffects(inst)"
+    outp.puts "{"
+    outp.puts "switch (inst.opcode) {"
+    foundTrue = false
+    $opcodes.values.each {
+        | opcode |
+        if opcode.attributes[:terminal] or opcode.attributes[:effects]
+            outp.puts "case #{opcode.name}:"
+            foundTrue = true
+        end
+    }
+    if foundTrue
+        outp.puts "return true;"
+    end
+    $opcodes.values.each {
+        | opcode |
+        if opcode.custom
+            outp.puts "case #{opcode.name}:"
+            outp.puts "return #{opcode.name}Custom.hasNonArgNonControlEffects(inst);"
+        end
+    }
+    outp.puts "default:"
+    outp.puts "return false;"
+    outp.puts "}"
+    outp.puts "}"
+    
+    outp.puts "function opcodeCode(opcode)"
+    outp.puts "{"
+    outp.puts "switch (opcode) {"
+    $opcodes.keys.sort.each_with_index {
+        | opcode, index |
+        outp.puts "case #{opcode}:"
+        outp.puts "return #{index}"
+    }
+    outp.puts "default:"
+    outp.puts "throw new Error(\"bad opcode\");"
+    outp.puts "}"
+    outp.puts "}"
+}
+
diff --git a/b3/air/testair.cpp b/b3/air/testair.cpp
new file mode 100644
index 0000000..9f8a8d8
--- /dev/null
+++ b/b3/air/testair.cpp
@@ -0,0 +1,1964 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "AirCode.h"
+#include "AirGenerate.h"
+#include "AirInstInlines.h"
+#include "AllowMacroScratchRegisterUsage.h"
+#include "B3Compilation.h"
+#include "B3Procedure.h"
+#include "CCallHelpers.h"
+#include "InitializeThreading.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "PureNaN.h"
+#include "VM.h"
+#include <cmath>
+#include <map>
+#include <string>
+#include <wtf/Lock.h>
+#include <wtf/NumberOfCores.h>
+#include <wtf/Threading.h>
+
+// We don't have a NO_RETURN_DUE_TO_EXIT, nor should we. That's ridiculous.
+static bool hiddenTruthBecauseNoReturnIsStupid() { return true; }
+
+static void usage()
+{
+    dataLog("Usage: testb3 [<filter>]\n");
+    if (hiddenTruthBecauseNoReturnIsStupid())
+        exit(1);
+}
+
+#if ENABLE(B3_JIT)
+
+using namespace JSC;
+using namespace JSC::B3::Air;
+
+namespace {
+
+StaticLock crashLock;
+
+// Nothing fancy for now; we just use the existing WTF assertion machinery.
+#define CHECK(x) do {                                                   \
+        if (!!(x))                                                      \
+            break;                                                      \
+        crashLock.lock();                                               \
+        WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, #x); \
+        CRASH();                                                        \
+    } while (false)
+
+VM* vm;
+
+std::unique_ptr<B3::Compilation> compile(B3::Procedure& proc)
+{
+    prepareForGeneration(proc.code());
+    CCallHelpers jit(vm);
+    generate(proc.code(), jit);
+    LinkBuffer linkBuffer(*vm, jit, nullptr);
+
+    return std::make_unique<B3::Compilation>(
+        FINALIZE_CODE(linkBuffer, ("testair compilation")), proc.releaseByproducts());
+}
+
+template<typename T, typename... Arguments>
+T invoke(const B3::Compilation& code, Arguments... arguments)
+{
+    T (*function)(Arguments...) = bitwise_cast<T(*)(Arguments...)>(code.code().executableAddress());
+    return function(arguments...);
+}
+
+template<typename T, typename... Arguments>
+T compileAndRun(B3::Procedure& procedure, Arguments... arguments)
+{
+    return invoke<T>(*compile(procedure), arguments...);
+}
+
+void testSimple()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(Move, nullptr, Arg::imm(42), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(compileAndRun<int>(proc) == 42);
+}
+
+// Use this to put a constant into a register without Air being able to see the constant.
+template<typename T>
+void loadConstantImpl(BasicBlock* block, T value, B3::Air::Opcode move, Tmp tmp, Tmp scratch)
+{
+    static StaticLock lock;
+    static std::map<T, T*>* map; // I'm not messing with HashMap's problems with integers.
+
+    LockHolder locker(lock);
+    if (!map)
+        map = new std::map<T, T*>();
+
+    if (!map->count(value))
+        (*map)[value] = new T(value);
+
+    T* ptr = (*map)[value];
+    block->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(ptr)), scratch);
+    block->append(move, nullptr, Arg::addr(scratch), tmp);
+}
+
+void loadConstant(BasicBlock* block, intptr_t value, Tmp tmp)
+{
+    loadConstantImpl<intptr_t>(block, value, Move, tmp, tmp);
+}
+
+void loadDoubleConstant(BasicBlock* block, double value, Tmp tmp, Tmp scratch)
+{
+    loadConstantImpl<double>(block, value, MoveDouble, tmp, scratch);
+}
+
+void testShuffleSimpleSwap()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32));
+
+    int32_t things[4];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 2);
+    CHECK(things[2] == 4);
+    CHECK(things[3] == 3);
+}
+
+void testShuffleSimpleShift()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32));
+
+    int32_t things[5];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 2);
+    CHECK(things[2] == 3);
+    CHECK(things[3] == 3);
+    CHECK(things[4] == 4);
+}
+
+void testShuffleLongShift()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    loadConstant(root, 7, Tmp(GPRInfo::regT6));
+    loadConstant(root, 8, Tmp(GPRInfo::regT7));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT4), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT5), Tmp(GPRInfo::regT6), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT6), Tmp(GPRInfo::regT7), Arg::widthArg(Arg::Width32));
+
+    int32_t things[8];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT6), Arg::addr(base, 6 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT7), Arg::addr(base, 7 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 2);
+    CHECK(things[3] == 3);
+    CHECK(things[4] == 4);
+    CHECK(things[5] == 5);
+    CHECK(things[6] == 6);
+    CHECK(things[7] == 7);
+}
+
+void testShuffleLongShiftBackwards()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    loadConstant(root, 7, Tmp(GPRInfo::regT6));
+    loadConstant(root, 8, Tmp(GPRInfo::regT7));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT6), Tmp(GPRInfo::regT7), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT5), Tmp(GPRInfo::regT6), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT4), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32));
+
+    int32_t things[8];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT6), Arg::addr(base, 6 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT7), Arg::addr(base, 7 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 2);
+    CHECK(things[3] == 3);
+    CHECK(things[4] == 4);
+    CHECK(things[5] == 5);
+    CHECK(things[6] == 6);
+    CHECK(things[7] == 7);
+}
+
+void testShuffleSimpleRotate()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT0), Arg::widthArg(Arg::Width32));
+
+    int32_t things[4];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 3);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 2);
+    CHECK(things[3] == 4);
+}
+
+void testShuffleSimpleBroadcast()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32));
+
+    int32_t things[4];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 1);
+    CHECK(things[3] == 1);
+}
+
+void testShuffleBroadcastAllRegs()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    const Vector<Reg>& regs = code.regsInPriorityOrder(Arg::GP);
+
+    BasicBlock* root = code.addBlock();
+    root->append(Move, nullptr, Arg::imm(35), Tmp(GPRInfo::regT0));
+    unsigned count = 1;
+    for (Reg reg : regs) {
+        if (reg != Reg(GPRInfo::regT0))
+            loadConstant(root, count++, Tmp(reg));
+    }
+    Inst& shuffle = root->append(Shuffle, nullptr);
+    for (Reg reg : regs) {
+        if (reg != Reg(GPRInfo::regT0))
+            shuffle.append(Tmp(GPRInfo::regT0), Tmp(reg), Arg::widthArg(Arg::Width32));
+    }
+
+    StackSlot* slot = code.addStackSlot(sizeof(int32_t) * regs.size(), StackSlotKind::Locked);
+    for (unsigned i = 0; i < regs.size(); ++i)
+        root->append(Move32, nullptr, Tmp(regs[i]), Arg::stack(slot, i * sizeof(int32_t)));
+
+    Vector<int32_t> things(regs.size(), 666);
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things[0])), base);
+    for (unsigned i = 0; i < regs.size(); ++i) {
+        root->append(Move32, nullptr, Arg::stack(slot, i * sizeof(int32_t)), Tmp(GPRInfo::regT0));
+        root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, i * sizeof(int32_t)));
+    }
+    
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(!compileAndRun<int>(proc));
+
+    for (int32_t thing : things)
+        CHECK(thing == 35);
+}
+
+void testShuffleTreeShift()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    loadConstant(root, 7, Tmp(GPRInfo::regT6));
+    loadConstant(root, 8, Tmp(GPRInfo::regT7));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT6), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT7), Arg::widthArg(Arg::Width32));
+
+    int32_t things[8];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT6), Arg::addr(base, 6 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT7), Arg::addr(base, 7 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 1);
+    CHECK(things[3] == 2);
+    CHECK(things[4] == 2);
+    CHECK(things[5] == 3);
+    CHECK(things[6] == 3);
+    CHECK(things[7] == 4);
+}
+
+void testShuffleTreeShiftBackward()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    loadConstant(root, 7, Tmp(GPRInfo::regT6));
+    loadConstant(root, 8, Tmp(GPRInfo::regT7));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT7), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT6), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32));
+
+    int32_t things[8];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT6), Arg::addr(base, 6 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT7), Arg::addr(base, 7 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 1);
+    CHECK(things[3] == 2);
+    CHECK(things[4] == 2);
+    CHECK(things[5] == 3);
+    CHECK(things[6] == 3);
+    CHECK(things[7] == 4);
+}
+
+void testShuffleTreeShiftOtherBackward()
+{
+    // NOTE: This test was my original attempt at TreeShiftBackward but mistakes were made. So, this
+    // ends up being just a weird test. But weird tests are useful, so I kept it.
+    
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    loadConstant(root, 7, Tmp(GPRInfo::regT6));
+    loadConstant(root, 8, Tmp(GPRInfo::regT7));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT4), Tmp(GPRInfo::regT7), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT5), Tmp(GPRInfo::regT6), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT5), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT6), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT6), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT7), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT7), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32));
+
+    int32_t things[8];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT6), Arg::addr(base, 6 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT7), Arg::addr(base, 7 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 8);
+    CHECK(things[2] == 8);
+    CHECK(things[3] == 7);
+    CHECK(things[4] == 7);
+    CHECK(things[5] == 6);
+    CHECK(things[6] == 6);
+    CHECK(things[7] == 5);
+}
+
+void testShuffleMultipleShifts()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32));
+
+    int32_t things[6];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 3);
+    CHECK(things[3] == 3);
+    CHECK(things[4] == 3);
+    CHECK(things[5] == 1);
+}
+
+void testShuffleRotateWithFringe()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT0), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32));
+
+    int32_t things[6];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 3);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 2);
+    CHECK(things[3] == 1);
+    CHECK(things[4] == 2);
+    CHECK(things[5] == 3);
+}
+
+void testShuffleRotateWithFringeInWeirdOrder()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT0), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32));
+
+    int32_t things[6];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 3);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 2);
+    CHECK(things[3] == 1);
+    CHECK(things[4] == 2);
+    CHECK(things[5] == 3);
+}
+
+void testShuffleRotateWithLongFringe()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT0), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT4), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32));
+
+    int32_t things[6];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 3);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 2);
+    CHECK(things[3] == 1);
+    CHECK(things[4] == 4);
+    CHECK(things[5] == 5);
+}
+
+void testShuffleMultipleRotates()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT0), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT4), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT5), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32));
+
+    int32_t things[6];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 3);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 2);
+    CHECK(things[3] == 6);
+    CHECK(things[4] == 4);
+    CHECK(things[5] == 5);
+}
+
+void testShuffleShiftAndRotate()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    loadConstant(root, 4, Tmp(GPRInfo::regT3));
+    loadConstant(root, 5, Tmp(GPRInfo::regT4));
+    loadConstant(root, 6, Tmp(GPRInfo::regT5));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT1), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT0), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT4), Tmp(GPRInfo::regT5), Arg::widthArg(Arg::Width32));
+
+    int32_t things[6];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT5), Arg::addr(base, 5 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 3);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 2);
+    CHECK(things[3] == 4);
+    CHECK(things[4] == 4);
+    CHECK(things[5] == 5);
+}
+
+void testShuffleShiftAllRegs()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    const Vector<Reg>& regs = code.regsInPriorityOrder(Arg::GP);
+
+    BasicBlock* root = code.addBlock();
+    for (unsigned i = 0; i < regs.size(); ++i)
+        loadConstant(root, 35 + i, Tmp(regs[i]));
+    Inst& shuffle = root->append(Shuffle, nullptr);
+    for (unsigned i = 1; i < regs.size(); ++i)
+        shuffle.append(Tmp(regs[i - 1]), Tmp(regs[i]), Arg::widthArg(Arg::Width32));
+
+    StackSlot* slot = code.addStackSlot(sizeof(int32_t) * regs.size(), StackSlotKind::Locked);
+    for (unsigned i = 0; i < regs.size(); ++i)
+        root->append(Move32, nullptr, Tmp(regs[i]), Arg::stack(slot, i * sizeof(int32_t)));
+
+    Vector<int32_t> things(regs.size(), 666);
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things[0])), base);
+    for (unsigned i = 0; i < regs.size(); ++i) {
+        root->append(Move32, nullptr, Arg::stack(slot, i * sizeof(int32_t)), Tmp(GPRInfo::regT0));
+        root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, i * sizeof(int32_t)));
+    }
+    
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 35);
+    for (unsigned i = 1; i < regs.size(); ++i)
+        CHECK(things[i] == 35 + static_cast<int32_t>(i) - 1);
+}
+
+void testShuffleRotateAllRegs()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    const Vector<Reg>& regs = code.regsInPriorityOrder(Arg::GP);
+
+    BasicBlock* root = code.addBlock();
+    for (unsigned i = 0; i < regs.size(); ++i)
+        loadConstant(root, 35 + i, Tmp(regs[i]));
+    Inst& shuffle = root->append(Shuffle, nullptr);
+    for (unsigned i = 1; i < regs.size(); ++i)
+        shuffle.append(Tmp(regs[i - 1]), Tmp(regs[i]), Arg::widthArg(Arg::Width32));
+    shuffle.append(Tmp(regs.last()), Tmp(regs[0]), Arg::widthArg(Arg::Width32));
+
+    StackSlot* slot = code.addStackSlot(sizeof(int32_t) * regs.size(), StackSlotKind::Locked);
+    for (unsigned i = 0; i < regs.size(); ++i)
+        root->append(Move32, nullptr, Tmp(regs[i]), Arg::stack(slot, i * sizeof(int32_t)));
+
+    Vector<int32_t> things(regs.size(), 666);
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things[0])), base);
+    for (unsigned i = 0; i < regs.size(); ++i) {
+        root->append(Move32, nullptr, Arg::stack(slot, i * sizeof(int32_t)), Tmp(GPRInfo::regT0));
+        root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, i * sizeof(int32_t)));
+    }
+    
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 35 + static_cast<int32_t>(regs.size()) - 1);
+    for (unsigned i = 1; i < regs.size(); ++i)
+        CHECK(things[i] == 35 + static_cast<int32_t>(i) - 1);
+}
+
+void testShuffleSimpleSwap64()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 10000000000000000ll, Tmp(GPRInfo::regT0));
+    loadConstant(root, 20000000000000000ll, Tmp(GPRInfo::regT1));
+    loadConstant(root, 30000000000000000ll, Tmp(GPRInfo::regT2));
+    loadConstant(root, 40000000000000000ll, Tmp(GPRInfo::regT3));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width64),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width64));
+
+    int64_t things[4];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int64_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 10000000000000000ll);
+    CHECK(things[1] == 20000000000000000ll);
+    CHECK(things[2] == 40000000000000000ll);
+    CHECK(things[3] == 30000000000000000ll);
+}
+
+void testShuffleSimpleShift64()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 10000000000000000ll, Tmp(GPRInfo::regT0));
+    loadConstant(root, 20000000000000000ll, Tmp(GPRInfo::regT1));
+    loadConstant(root, 30000000000000000ll, Tmp(GPRInfo::regT2));
+    loadConstant(root, 40000000000000000ll, Tmp(GPRInfo::regT3));
+    loadConstant(root, 50000000000000000ll, Tmp(GPRInfo::regT4));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width64),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width64));
+
+    int64_t things[5];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int64_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 10000000000000000ll);
+    CHECK(things[1] == 20000000000000000ll);
+    CHECK(things[2] == 30000000000000000ll);
+    CHECK(things[3] == 30000000000000000ll);
+    CHECK(things[4] == 40000000000000000ll);
+}
+
+void testShuffleSwapMixedWidth()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 10000000000000000ll, Tmp(GPRInfo::regT0));
+    loadConstant(root, 20000000000000000ll, Tmp(GPRInfo::regT1));
+    loadConstant(root, 30000000000000000ll, Tmp(GPRInfo::regT2));
+    loadConstant(root, 40000000000000000ll, Tmp(GPRInfo::regT3));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width32),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT2), Arg::widthArg(Arg::Width64));
+
+    int64_t things[4];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int64_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 10000000000000000ll);
+    CHECK(things[1] == 20000000000000000ll);
+    CHECK(things[2] == 40000000000000000ll);
+    CHECK(things[3] == static_cast<uint32_t>(30000000000000000ll));
+}
+
+void testShuffleShiftMixedWidth()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 10000000000000000ll, Tmp(GPRInfo::regT0));
+    loadConstant(root, 20000000000000000ll, Tmp(GPRInfo::regT1));
+    loadConstant(root, 30000000000000000ll, Tmp(GPRInfo::regT2));
+    loadConstant(root, 40000000000000000ll, Tmp(GPRInfo::regT3));
+    loadConstant(root, 50000000000000000ll, Tmp(GPRInfo::regT4));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT2), Tmp(GPRInfo::regT3), Arg::widthArg(Arg::Width64),
+        Tmp(GPRInfo::regT3), Tmp(GPRInfo::regT4), Arg::widthArg(Arg::Width32));
+
+    int64_t things[5];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT3), Arg::addr(base, 3 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT4), Arg::addr(base, 4 * sizeof(int64_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 10000000000000000ll);
+    CHECK(things[1] == 20000000000000000ll);
+    CHECK(things[2] == 30000000000000000ll);
+    CHECK(things[3] == 30000000000000000ll);
+    CHECK(things[4] == static_cast<uint32_t>(40000000000000000ll));
+}
+
+void testShuffleShiftMemory()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int32_t memory[2];
+    memory[0] = 35;
+    memory[1] = 36;
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT2));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        Arg::addr(Tmp(GPRInfo::regT2), 0 * sizeof(int32_t)),
+        Arg::addr(Tmp(GPRInfo::regT2), 1 * sizeof(int32_t)), Arg::widthArg(Arg::Width32));
+
+    int32_t things[2];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 1);
+    CHECK(memory[0] == 35);
+    CHECK(memory[1] == 35);
+}
+
+void testShuffleShiftMemoryLong()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int32_t memory[2];
+    memory[0] = 35;
+    memory[1] = 36;
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    loadConstant(root, 3, Tmp(GPRInfo::regT2));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT3));
+    root->append(
+        Shuffle, nullptr,
+        
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+        
+        Tmp(GPRInfo::regT1), Arg::addr(Tmp(GPRInfo::regT3), 0 * sizeof(int32_t)),
+        Arg::widthArg(Arg::Width32),
+        
+        Arg::addr(Tmp(GPRInfo::regT3), 0 * sizeof(int32_t)),
+        Arg::addr(Tmp(GPRInfo::regT3), 1 * sizeof(int32_t)), Arg::widthArg(Arg::Width32),
+
+        Arg::addr(Tmp(GPRInfo::regT3), 1 * sizeof(int32_t)), Tmp(GPRInfo::regT2),
+        Arg::widthArg(Arg::Width32));
+
+    int32_t things[3];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT2), Arg::addr(base, 2 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 1);
+    CHECK(things[2] == 36);
+    CHECK(memory[0] == 2);
+    CHECK(memory[1] == 35);
+}
+
+void testShuffleShiftMemoryAllRegs()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int32_t memory[2];
+    memory[0] = 35;
+    memory[1] = 36;
+
+    Vector<Reg> regs = code.regsInPriorityOrder(Arg::GP);
+    regs.removeFirst(Reg(GPRInfo::regT0));
+
+    BasicBlock* root = code.addBlock();
+    for (unsigned i = 0; i < regs.size(); ++i)
+        loadConstant(root, i + 1, Tmp(regs[i]));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT0));
+    Inst& shuffle = root->append(
+        Shuffle, nullptr,
+        
+        Tmp(regs[0]), Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int32_t)),
+        Arg::widthArg(Arg::Width32),
+        
+        Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int32_t)),
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int32_t)), Arg::widthArg(Arg::Width32),
+
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int32_t)), Tmp(regs[1]),
+        Arg::widthArg(Arg::Width32));
+
+    for (unsigned i = 2; i < regs.size(); ++i)
+        shuffle.append(Tmp(regs[i - 1]), Tmp(regs[i]), Arg::widthArg(Arg::Width32));
+
+    Vector<int32_t> things(regs.size(), 666);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things[0])), Tmp(GPRInfo::regT0));
+    for (unsigned i = 0; i < regs.size(); ++i) {
+        root->append(
+            Move32, nullptr, Tmp(regs[i]), Arg::addr(Tmp(GPRInfo::regT0), i * sizeof(int32_t)));
+    }
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 36);
+    for (unsigned i = 2; i < regs.size(); ++i)
+        CHECK(things[i] == static_cast<int32_t>(i));
+    CHECK(memory[0] == 1);
+    CHECK(memory[1] == 35);
+}
+
+void testShuffleShiftMemoryAllRegs64()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int64_t memory[2];
+    memory[0] = 35000000000000ll;
+    memory[1] = 36000000000000ll;
+
+    Vector<Reg> regs = code.regsInPriorityOrder(Arg::GP);
+    regs.removeFirst(Reg(GPRInfo::regT0));
+
+    BasicBlock* root = code.addBlock();
+    for (unsigned i = 0; i < regs.size(); ++i)
+        loadConstant(root, (i + 1) * 1000000000000ll, Tmp(regs[i]));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT0));
+    Inst& shuffle = root->append(
+        Shuffle, nullptr,
+        
+        Tmp(regs[0]), Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int64_t)),
+        Arg::widthArg(Arg::Width64),
+        
+        Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int64_t)),
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int64_t)), Arg::widthArg(Arg::Width64),
+
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int64_t)), Tmp(regs[1]),
+        Arg::widthArg(Arg::Width64));
+
+    for (unsigned i = 2; i < regs.size(); ++i)
+        shuffle.append(Tmp(regs[i - 1]), Tmp(regs[i]), Arg::widthArg(Arg::Width64));
+
+    Vector<int64_t> things(regs.size(), 666);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things[0])), Tmp(GPRInfo::regT0));
+    for (unsigned i = 0; i < regs.size(); ++i) {
+        root->append(
+            Move, nullptr, Tmp(regs[i]), Arg::addr(Tmp(GPRInfo::regT0), i * sizeof(int64_t)));
+    }
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1000000000000ll);
+    CHECK(things[1] == 36000000000000ll);
+    for (unsigned i = 2; i < regs.size(); ++i)
+        CHECK(things[i] == static_cast<int64_t>(i) * 1000000000000ll);
+    CHECK(memory[0] == 1000000000000ll);
+    CHECK(memory[1] == 35000000000000ll);
+}
+
+int64_t combineHiLo(int64_t high, int64_t low)
+{
+    union {
+        int64_t value;
+        int32_t halves[2];
+    } u;
+    u.value = high;
+    u.halves[0] = static_cast<int32_t>(low);
+    return u.value;
+}
+
+void testShuffleShiftMemoryAllRegsMixedWidth()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int64_t memory[2];
+    memory[0] = 35000000000000ll;
+    memory[1] = 36000000000000ll;
+
+    Vector<Reg> regs = code.regsInPriorityOrder(Arg::GP);
+    regs.removeFirst(Reg(GPRInfo::regT0));
+
+    BasicBlock* root = code.addBlock();
+    for (unsigned i = 0; i < regs.size(); ++i)
+        loadConstant(root, (i + 1) * 1000000000000ll, Tmp(regs[i]));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT0));
+    Inst& shuffle = root->append(
+        Shuffle, nullptr,
+        
+        Tmp(regs[0]), Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int64_t)),
+        Arg::widthArg(Arg::Width32),
+        
+        Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int64_t)),
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int64_t)), Arg::widthArg(Arg::Width64),
+
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int64_t)), Tmp(regs[1]),
+        Arg::widthArg(Arg::Width32));
+
+    for (unsigned i = 2; i < regs.size(); ++i) {
+        shuffle.append(
+            Tmp(regs[i - 1]), Tmp(regs[i]),
+            (i & 1) ? Arg::widthArg(Arg::Width32) : Arg::widthArg(Arg::Width64));
+    }
+
+    Vector<int64_t> things(regs.size(), 666);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things[0])), Tmp(GPRInfo::regT0));
+    for (unsigned i = 0; i < regs.size(); ++i) {
+        root->append(
+            Move, nullptr, Tmp(regs[i]), Arg::addr(Tmp(GPRInfo::regT0), i * sizeof(int64_t)));
+    }
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1000000000000ll);
+    CHECK(things[1] == static_cast<uint32_t>(36000000000000ll));
+    for (unsigned i = 2; i < regs.size(); ++i) {
+        int64_t value = static_cast<int64_t>(i) * 1000000000000ll;
+        CHECK(things[i] == ((i & 1) ? static_cast<uint32_t>(value) : value));
+    }
+    CHECK(memory[0] == combineHiLo(35000000000000ll, 1000000000000ll));
+    CHECK(memory[1] == 35000000000000ll);
+}
+
+void testShuffleRotateMemory()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int32_t memory[2];
+    memory[0] = 35;
+    memory[1] = 36;
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2, Tmp(GPRInfo::regT1));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT2));
+    root->append(
+        Shuffle, nullptr,
+        
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+
+        Tmp(GPRInfo::regT1), Arg::addr(Tmp(GPRInfo::regT2), 0 * sizeof(int32_t)),
+        Arg::widthArg(Arg::Width32),
+        
+        Arg::addr(Tmp(GPRInfo::regT2), 0 * sizeof(int32_t)),
+        Arg::addr(Tmp(GPRInfo::regT2), 1 * sizeof(int32_t)), Arg::widthArg(Arg::Width32),
+
+        Arg::addr(Tmp(GPRInfo::regT2), 1 * sizeof(int32_t)), Tmp(GPRInfo::regT0),
+        Arg::widthArg(Arg::Width32));
+
+    int32_t things[2];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int32_t)));
+    root->append(Move32, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int32_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 36);
+    CHECK(things[1] == 1);
+    CHECK(memory[0] == 2);
+    CHECK(memory[1] == 35);
+}
+
+void testShuffleRotateMemory64()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int64_t memory[2];
+    memory[0] = 35000000000000ll;
+    memory[1] = 36000000000000ll;
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1000000000000ll, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2000000000000ll, Tmp(GPRInfo::regT1));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT2));
+    root->append(
+        Shuffle, nullptr,
+        
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width64),
+
+        Tmp(GPRInfo::regT1), Arg::addr(Tmp(GPRInfo::regT2), 0 * sizeof(int64_t)),
+        Arg::widthArg(Arg::Width64),
+        
+        Arg::addr(Tmp(GPRInfo::regT2), 0 * sizeof(int64_t)),
+        Arg::addr(Tmp(GPRInfo::regT2), 1 * sizeof(int64_t)), Arg::widthArg(Arg::Width64),
+
+        Arg::addr(Tmp(GPRInfo::regT2), 1 * sizeof(int64_t)), Tmp(GPRInfo::regT0),
+        Arg::widthArg(Arg::Width64));
+
+    int64_t things[2];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int64_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 36000000000000ll);
+    CHECK(things[1] == 1000000000000ll);
+    CHECK(memory[0] == 2000000000000ll);
+    CHECK(memory[1] == 35000000000000ll);
+}
+
+void testShuffleRotateMemoryMixedWidth()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int64_t memory[2];
+    memory[0] = 35000000000000ll;
+    memory[1] = 36000000000000ll;
+
+    BasicBlock* root = code.addBlock();
+    loadConstant(root, 1000000000000ll, Tmp(GPRInfo::regT0));
+    loadConstant(root, 2000000000000ll, Tmp(GPRInfo::regT1));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT2));
+    root->append(
+        Shuffle, nullptr,
+        
+        Tmp(GPRInfo::regT0), Tmp(GPRInfo::regT1), Arg::widthArg(Arg::Width32),
+
+        Tmp(GPRInfo::regT1), Arg::addr(Tmp(GPRInfo::regT2), 0 * sizeof(int64_t)),
+        Arg::widthArg(Arg::Width64),
+        
+        Arg::addr(Tmp(GPRInfo::regT2), 0 * sizeof(int64_t)),
+        Arg::addr(Tmp(GPRInfo::regT2), 1 * sizeof(int64_t)), Arg::widthArg(Arg::Width32),
+
+        Arg::addr(Tmp(GPRInfo::regT2), 1 * sizeof(int64_t)), Tmp(GPRInfo::regT0),
+        Arg::widthArg(Arg::Width64));
+
+    int64_t things[2];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(Move, nullptr, Tmp(GPRInfo::regT0), Arg::addr(base, 0 * sizeof(int64_t)));
+    root->append(Move, nullptr, Tmp(GPRInfo::regT1), Arg::addr(base, 1 * sizeof(int64_t)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 36000000000000ll);
+    CHECK(things[1] == static_cast<uint32_t>(1000000000000ll));
+    CHECK(memory[0] == 2000000000000ll);
+    CHECK(memory[1] == combineHiLo(36000000000000ll, 35000000000000ll));
+}
+
+void testShuffleRotateMemoryAllRegs64()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int64_t memory[2];
+    memory[0] = 35000000000000ll;
+    memory[1] = 36000000000000ll;
+
+    Vector<Reg> regs = code.regsInPriorityOrder(Arg::GP);
+    regs.removeFirst(Reg(GPRInfo::regT0));
+
+    BasicBlock* root = code.addBlock();
+    for (unsigned i = 0; i < regs.size(); ++i)
+        loadConstant(root, (i + 1) * 1000000000000ll, Tmp(regs[i]));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT0));
+    Inst& shuffle = root->append(
+        Shuffle, nullptr,
+        
+        Tmp(regs[0]), Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int64_t)),
+        Arg::widthArg(Arg::Width64),
+        
+        Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int64_t)),
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int64_t)), Arg::widthArg(Arg::Width64),
+
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int64_t)), Tmp(regs[1]),
+        Arg::widthArg(Arg::Width64),
+
+        regs.last(), regs[0], Arg::widthArg(Arg::Width64));
+
+    for (unsigned i = 2; i < regs.size(); ++i)
+        shuffle.append(Tmp(regs[i - 1]), Tmp(regs[i]), Arg::widthArg(Arg::Width64));
+
+    Vector<int64_t> things(regs.size(), 666);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things[0])), Tmp(GPRInfo::regT0));
+    for (unsigned i = 0; i < regs.size(); ++i) {
+        root->append(
+            Move, nullptr, Tmp(regs[i]), Arg::addr(Tmp(GPRInfo::regT0), i * sizeof(int64_t)));
+    }
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == static_cast<int64_t>(regs.size()) * 1000000000000ll);
+    CHECK(things[1] == 36000000000000ll);
+    for (unsigned i = 2; i < regs.size(); ++i)
+        CHECK(things[i] == static_cast<int64_t>(i) * 1000000000000ll);
+    CHECK(memory[0] == 1000000000000ll);
+    CHECK(memory[1] == 35000000000000ll);
+}
+
+void testShuffleRotateMemoryAllRegsMixedWidth()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    int64_t memory[2];
+    memory[0] = 35000000000000ll;
+    memory[1] = 36000000000000ll;
+
+    Vector<Reg> regs = code.regsInPriorityOrder(Arg::GP);
+    regs.removeFirst(Reg(GPRInfo::regT0));
+
+    BasicBlock* root = code.addBlock();
+    for (unsigned i = 0; i < regs.size(); ++i)
+        loadConstant(root, (i + 1) * 1000000000000ll, Tmp(regs[i]));
+    root->append(Move, nullptr, Arg::immPtr(&memory), Tmp(GPRInfo::regT0));
+    Inst& shuffle = root->append(
+        Shuffle, nullptr,
+        
+        Tmp(regs[0]), Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int64_t)),
+        Arg::widthArg(Arg::Width32),
+        
+        Arg::addr(Tmp(GPRInfo::regT0), 0 * sizeof(int64_t)),
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int64_t)), Arg::widthArg(Arg::Width64),
+
+        Arg::addr(Tmp(GPRInfo::regT0), 1 * sizeof(int64_t)), Tmp(regs[1]),
+        Arg::widthArg(Arg::Width32),
+
+        regs.last(), regs[0], Arg::widthArg(Arg::Width32));
+
+    for (unsigned i = 2; i < regs.size(); ++i)
+        shuffle.append(Tmp(regs[i - 1]), Tmp(regs[i]), Arg::widthArg(Arg::Width64));
+
+    Vector<int64_t> things(regs.size(), 666);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things[0])), Tmp(GPRInfo::regT0));
+    for (unsigned i = 0; i < regs.size(); ++i) {
+        root->append(
+            Move, nullptr, Tmp(regs[i]), Arg::addr(Tmp(GPRInfo::regT0), i * sizeof(int64_t)));
+    }
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == static_cast<uint32_t>(static_cast<int64_t>(regs.size()) * 1000000000000ll));
+    CHECK(things[1] == static_cast<uint32_t>(36000000000000ll));
+    for (unsigned i = 2; i < regs.size(); ++i)
+        CHECK(things[i] == static_cast<int64_t>(i) * 1000000000000ll);
+    CHECK(memory[0] == combineHiLo(35000000000000ll, 1000000000000ll));
+    CHECK(memory[1] == 35000000000000ll);
+}
+
+void testShuffleSwapDouble()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadDoubleConstant(root, 1, Tmp(FPRInfo::fpRegT0), Tmp(GPRInfo::regT0));
+    loadDoubleConstant(root, 2, Tmp(FPRInfo::fpRegT1), Tmp(GPRInfo::regT0));
+    loadDoubleConstant(root, 3, Tmp(FPRInfo::fpRegT2), Tmp(GPRInfo::regT0));
+    loadDoubleConstant(root, 4, Tmp(FPRInfo::fpRegT3), Tmp(GPRInfo::regT0));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(FPRInfo::fpRegT2), Tmp(FPRInfo::fpRegT3), Arg::widthArg(Arg::Width64),
+        Tmp(FPRInfo::fpRegT3), Tmp(FPRInfo::fpRegT2), Arg::widthArg(Arg::Width64));
+
+    double things[4];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::fpRegT0), Arg::addr(base, 0 * sizeof(double)));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::fpRegT1), Arg::addr(base, 1 * sizeof(double)));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::fpRegT2), Arg::addr(base, 2 * sizeof(double)));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::fpRegT3), Arg::addr(base, 3 * sizeof(double)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 2);
+    CHECK(things[2] == 4);
+    CHECK(things[3] == 3);
+}
+
+void testShuffleShiftDouble()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    loadDoubleConstant(root, 1, Tmp(FPRInfo::fpRegT0), Tmp(GPRInfo::regT0));
+    loadDoubleConstant(root, 2, Tmp(FPRInfo::fpRegT1), Tmp(GPRInfo::regT0));
+    loadDoubleConstant(root, 3, Tmp(FPRInfo::fpRegT2), Tmp(GPRInfo::regT0));
+    loadDoubleConstant(root, 4, Tmp(FPRInfo::fpRegT3), Tmp(GPRInfo::regT0));
+    root->append(
+        Shuffle, nullptr,
+        Tmp(FPRInfo::fpRegT2), Tmp(FPRInfo::fpRegT3), Arg::widthArg(Arg::Width64));
+
+    double things[4];
+    Tmp base = code.newTmp(Arg::GP);
+    root->append(Move, nullptr, Arg::bigImm(bitwise_cast<intptr_t>(&things)), base);
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::fpRegT0), Arg::addr(base, 0 * sizeof(double)));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::fpRegT1), Arg::addr(base, 1 * sizeof(double)));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::fpRegT2), Arg::addr(base, 2 * sizeof(double)));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::fpRegT3), Arg::addr(base, 3 * sizeof(double)));
+    root->append(Move, nullptr, Arg::imm(0), Tmp(GPRInfo::returnValueGPR));
+    root->append(Ret32, nullptr, Tmp(GPRInfo::returnValueGPR));
+
+    memset(things, 0, sizeof(things));
+    
+    CHECK(!compileAndRun<int>(proc));
+
+    CHECK(things[0] == 1);
+    CHECK(things[1] == 2);
+    CHECK(things[2] == 3);
+    CHECK(things[3] == 3);
+}
+
+#if CPU(X86) || CPU(X86_64)
+void testX86VMULSD()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(MulDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Tmp(FPRInfo::argumentFPR1), Tmp(FPRInfo::argumentFPR2));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::argumentFPR2), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    CHECK(compileAndRun<double>(proc, 2.4, 4.2, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDDestRex()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(MulDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Tmp(FPRInfo::argumentFPR1), Tmp(X86Registers::xmm15));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm15), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    CHECK(compileAndRun<double>(proc, 2.4, 4.2, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDOp1DestRex()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Tmp(X86Registers::xmm14));
+    root->append(MulDouble, nullptr, Tmp(X86Registers::xmm14), Tmp(FPRInfo::argumentFPR1), Tmp(X86Registers::xmm15));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm15), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    CHECK(compileAndRun<double>(proc, 2.4, 4.2, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDOp2DestRex()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::argumentFPR1), Tmp(X86Registers::xmm14));
+    root->append(MulDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Tmp(X86Registers::xmm14), Tmp(X86Registers::xmm15));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm15), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    CHECK(compileAndRun<double>(proc, 2.4, 4.2, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDOpsDestRex()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Tmp(X86Registers::xmm14));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::argumentFPR1), Tmp(X86Registers::xmm13));
+    root->append(MulDouble, nullptr, Tmp(X86Registers::xmm14), Tmp(X86Registers::xmm13), Tmp(X86Registers::xmm15));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm15), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    CHECK(compileAndRun<double>(proc, 2.4, 4.2, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDAddr()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(MulDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Arg::addr(Tmp(GPRInfo::argumentGPR0), - 16), Tmp(FPRInfo::argumentFPR2));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::argumentFPR2), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    double secondArg = 4.2;
+    CHECK(compileAndRun<double>(proc, 2.4, &secondArg + 2, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDAddrOpRexAddr()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(Move, nullptr, Tmp(GPRInfo::argumentGPR0), Tmp(X86Registers::r13));
+    root->append(MulDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Arg::addr(Tmp(X86Registers::r13), - 16), Tmp(FPRInfo::argumentFPR2));
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::argumentFPR2), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    double secondArg = 4.2;
+    CHECK(compileAndRun<double>(proc, 2.4, &secondArg + 2, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDDestRexAddr()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(MulDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Arg::addr(Tmp(GPRInfo::argumentGPR0), 16), Tmp(X86Registers::xmm15));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm15), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    double secondArg = 4.2;
+    CHECK(compileAndRun<double>(proc, 2.4, &secondArg - 2, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDRegOpDestRexAddr()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(MoveDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Tmp(X86Registers::xmm14));
+    root->append(MulDouble, nullptr, Arg::addr(Tmp(GPRInfo::argumentGPR0)), Tmp(X86Registers::xmm14), Tmp(X86Registers::xmm15));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm15), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    double secondArg = 4.2;
+    CHECK(compileAndRun<double>(proc, 2.4, &secondArg, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDAddrOpDestRexAddr()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(Move, nullptr, Tmp(GPRInfo::argumentGPR0), Tmp(X86Registers::r13));
+    root->append(MulDouble, nullptr, Tmp(FPRInfo::argumentFPR0), Arg::addr(Tmp(X86Registers::r13), 8), Tmp(X86Registers::xmm15));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm15), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    double secondArg = 4.2;
+    CHECK(compileAndRun<double>(proc, 2.4, &secondArg - 1, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDBaseNeedsRex()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(Move, nullptr, Tmp(GPRInfo::argumentGPR0), Tmp(X86Registers::r13));
+    root->append(MulDouble, nullptr, Arg::index(Tmp(X86Registers::r13), Tmp(GPRInfo::argumentGPR1)), Tmp(FPRInfo::argumentFPR0), Tmp(X86Registers::xmm0));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm0), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    double secondArg = 4.2;
+    uint64_t index = 8;
+    CHECK(compileAndRun<double>(proc, 2.4, &secondArg - 1, index, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDIndexNeedsRex()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(Move, nullptr, Tmp(GPRInfo::argumentGPR1), Tmp(X86Registers::r13));
+    root->append(MulDouble, nullptr, Arg::index(Tmp(GPRInfo::argumentGPR0), Tmp(X86Registers::r13)), Tmp(FPRInfo::argumentFPR0), Tmp(X86Registers::xmm0));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm0), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    double secondArg = 4.2;
+    uint64_t index = - 8;
+    CHECK(compileAndRun<double>(proc, 2.4, &secondArg + 1, index, pureNaN()) == 2.4 * 4.2);
+}
+
+void testX86VMULSDBaseIndexNeedRex()
+{
+    B3::Procedure proc;
+    Code& code = proc.code();
+
+    BasicBlock* root = code.addBlock();
+    root->append(Move, nullptr, Tmp(GPRInfo::argumentGPR0), Tmp(X86Registers::r12));
+    root->append(Move, nullptr, Tmp(GPRInfo::argumentGPR1), Tmp(X86Registers::r13));
+    root->append(MulDouble, nullptr, Arg::index(Tmp(X86Registers::r12), Tmp(X86Registers::r13)), Tmp(FPRInfo::argumentFPR0), Tmp(X86Registers::xmm0));
+    root->append(MoveDouble, nullptr, Tmp(X86Registers::xmm0), Tmp(FPRInfo::returnValueFPR));
+    root->append(RetDouble, nullptr, Tmp(FPRInfo::returnValueFPR));
+
+    double secondArg = 4.2;
+    uint64_t index = 16;
+    CHECK(compileAndRun<double>(proc, 2.4, &secondArg - 2, index, pureNaN()) == 2.4 * 4.2);
+}
+
+#endif
+
+#define RUN(test) do {                          \
+        if (!shouldRun(#test))                  \
+            break;                              \
+        tasks.append(                           \
+            createSharedTask<void()>(           \
+                [&] () {                        \
+                    dataLog(#test "...\n");     \
+                    test;                       \
+                    dataLog(#test ": OK!\n");   \
+                }));                            \
+    } while (false);
+
+void run(const char* filter)
+{
+    JSC::initializeThreading();
+    vm = &VM::create(LargeHeap).leakRef();
+
+    Deque<RefPtr<SharedTask<void()>>> tasks;
+
+    auto shouldRun = [&] (const char* testName) -> bool {
+        return !filter || !!strcasestr(testName, filter);
+    };
+
+    RUN(testSimple());
+    
+    RUN(testShuffleSimpleSwap());
+    RUN(testShuffleSimpleShift());
+    RUN(testShuffleLongShift());
+    RUN(testShuffleLongShiftBackwards());
+    RUN(testShuffleSimpleRotate());
+    RUN(testShuffleSimpleBroadcast());
+    RUN(testShuffleBroadcastAllRegs());
+    RUN(testShuffleTreeShift());
+    RUN(testShuffleTreeShiftBackward());
+    RUN(testShuffleTreeShiftOtherBackward());
+    RUN(testShuffleMultipleShifts());
+    RUN(testShuffleRotateWithFringe());
+    RUN(testShuffleRotateWithFringeInWeirdOrder());
+    RUN(testShuffleRotateWithLongFringe());
+    RUN(testShuffleMultipleRotates());
+    RUN(testShuffleShiftAndRotate());
+    RUN(testShuffleShiftAllRegs());
+    RUN(testShuffleRotateAllRegs());
+    RUN(testShuffleSimpleSwap64());
+    RUN(testShuffleSimpleShift64());
+    RUN(testShuffleSwapMixedWidth());
+    RUN(testShuffleShiftMixedWidth());
+    RUN(testShuffleShiftMemory());
+    RUN(testShuffleShiftMemoryLong());
+    RUN(testShuffleShiftMemoryAllRegs());
+    RUN(testShuffleShiftMemoryAllRegs64());
+    RUN(testShuffleShiftMemoryAllRegsMixedWidth());
+    RUN(testShuffleRotateMemory());
+    RUN(testShuffleRotateMemory64());
+    RUN(testShuffleRotateMemoryMixedWidth());
+    RUN(testShuffleRotateMemoryAllRegs64());
+    RUN(testShuffleRotateMemoryAllRegsMixedWidth());
+    RUN(testShuffleSwapDouble());
+    RUN(testShuffleShiftDouble());
+
+#if CPU(X86) || CPU(X86_64)
+    RUN(testX86VMULSD());
+    RUN(testX86VMULSDDestRex());
+    RUN(testX86VMULSDOp1DestRex());
+    RUN(testX86VMULSDOp2DestRex());
+    RUN(testX86VMULSDOpsDestRex());
+
+    RUN(testX86VMULSDAddr());
+    RUN(testX86VMULSDAddrOpRexAddr());
+    RUN(testX86VMULSDDestRexAddr());
+    RUN(testX86VMULSDRegOpDestRexAddr());
+    RUN(testX86VMULSDAddrOpDestRexAddr());
+
+    RUN(testX86VMULSDBaseNeedsRex());
+    RUN(testX86VMULSDIndexNeedsRex());
+    RUN(testX86VMULSDBaseIndexNeedRex());
+#endif
+
+    if (tasks.isEmpty())
+        usage();
+
+    Lock lock;
+
+    Vector<ThreadIdentifier> threads;
+    for (unsigned i = filter ? 1 : WTF::numberOfProcessorCores(); i--;) {
+        threads.append(
+            createThread(
+                "testb3 thread",
+                [&] () {
+                    for (;;) {
+                        RefPtr<SharedTask<void()>> task;
+                        {
+                            LockHolder locker(lock);
+                            if (tasks.isEmpty())
+                                return;
+                            task = tasks.takeFirst();
+                        }
+
+                        task->run();
+                    }
+                }));
+    }
+
+    for (ThreadIdentifier thread : threads)
+        waitForThreadCompletion(thread);
+    crashLock.lock();
+}
+
+} // anonymois namespace
+
+#else // ENABLE(B3_JIT)
+
+static void run(const char*)
+{
+    dataLog("B3 JIT is not enabled.\n");
+}
+
+#endif // ENABLE(B3_JIT)
+
+int main(int argc, char** argv)
+{
+    const char* filter = nullptr;
+    switch (argc) {
+    case 1:
+        break;
+    case 2:
+        filter = argv[1];
+        break;
+    default:
+        usage();
+        break;
+    }
+    
+    run(filter);
+    return 0;
+}
diff --git a/b3/testb3.cpp b/b3/testb3.cpp
new file mode 100644
index 0000000..2cec4b5
--- /dev/null
+++ b/b3/testb3.cpp
@@ -0,0 +1,15735 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "AirCode.h"
+#include "AirInstInlines.h"
+#include "AirValidate.h"
+#include "AllowMacroScratchRegisterUsage.h"
+#include "B3ArgumentRegValue.h"
+#include "B3BasicBlockInlines.h"
+#include "B3CCallValue.h"
+#include "B3Compilation.h"
+#include "B3Compile.h"
+#include "B3ComputeDivisionMagic.h"
+#include "B3Const32Value.h"
+#include "B3ConstPtrValue.h"
+#include "B3Effects.h"
+#include "B3FenceValue.h"
+#include "B3Generate.h"
+#include "B3LowerToAir.h"
+#include "B3MathExtras.h"
+#include "B3MemoryValue.h"
+#include "B3MoveConstants.h"
+#include "B3Procedure.h"
+#include "B3ReduceStrength.h"
+#include "B3SlotBaseValue.h"
+#include "B3StackSlot.h"
+#include "B3StackmapGenerationParams.h"
+#include "B3SwitchValue.h"
+#include "B3UpsilonValue.h"
+#include "B3UseCounts.h"
+#include "B3Validate.h"
+#include "B3ValueInlines.h"
+#include "B3VariableValue.h"
+#include "B3WasmAddressValue.h"
+#include "B3WasmBoundsCheckValue.h"
+#include "CCallHelpers.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "InitializeThreading.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "PureNaN.h"
+#include "VM.h"
+#include <cmath>
+#include <string>
+#include <wtf/ListDump.h>
+#include <wtf/Lock.h>
+#include <wtf/NumberOfCores.h>
+#include <wtf/Threading.h>
+
+// We don't have a NO_RETURN_DUE_TO_EXIT, nor should we. That's ridiculous.
+static bool hiddenTruthBecauseNoReturnIsStupid() { return true; }
+
+static void usage()
+{
+    dataLog("Usage: testb3 [<filter>]\n");
+    if (hiddenTruthBecauseNoReturnIsStupid())
+        exit(1);
+}
+
+#if ENABLE(B3_JIT)
+
+using namespace JSC;
+using namespace JSC::B3;
+
+namespace {
+
+bool shouldBeVerbose()
+{
+    return shouldDumpIR(B3Mode);
+}
+
+StaticLock crashLock;
+
+// Nothing fancy for now; we just use the existing WTF assertion machinery.
+#define CHECK(x) do {                                                   \
+        if (!!(x))                                                      \
+            break;                                                      \
+        crashLock.lock();                                               \
+        WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, #x); \
+        CRASH();                                                        \
+    } while (false)
+
+#define CHECK_EQ(x, y) do { \
+        auto __x = (x); \
+        auto __y = (y); \
+        if (__x == __y) \
+            break; \
+        crashLock.lock(); \
+        WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, toCString(#x " == " #y, " (" #x " == ", __x, ", " #y " == ", __y, ")").data()); \
+        CRASH(); \
+    } while (false)
+
+VM* vm;
+
+std::unique_ptr<Compilation> compile(Procedure& procedure, unsigned optLevel = 1)
+{
+    return std::make_unique<Compilation>(B3::compile(*vm, procedure, optLevel));
+}
+
+template<typename T, typename... Arguments>
+T invoke(MacroAssemblerCodePtr ptr, Arguments... arguments)
+{
+    T (*function)(Arguments...) = bitwise_cast<T(*)(Arguments...)>(ptr.executableAddress());
+    return function(arguments...);
+}
+
+template<typename T, typename... Arguments>
+T invoke(const Compilation& code, Arguments... arguments)
+{
+    return invoke<T>(code.code(), arguments...);
+}
+
+template<typename T, typename... Arguments>
+T compileAndRun(Procedure& procedure, Arguments... arguments)
+{
+    return invoke<T>(*compile(procedure), arguments...);
+}
+
+void lowerToAirForTesting(Procedure& proc)
+{
+    proc.resetReachability();
+    
+    if (shouldBeVerbose())
+        dataLog("B3 before lowering:\n", proc);
+    
+    validate(proc);
+    lowerToAir(proc);
+    
+    if (shouldBeVerbose())
+        dataLog("Air after lowering:\n", proc.code());
+    
+    Air::validate(proc.code());
+}
+
+template<typename Func>
+void checkDisassembly(Compilation& compilation, const Func& func, CString failText)
+{
+    CString disassembly = compilation.disassembly();
+    if (func(disassembly.data()))
+        return;
+    
+    crashLock.lock();
+    dataLog("Bad lowering!  ", failText, "\n");
+    dataLog(disassembly);
+    CRASH();
+}
+
+void checkUsesInstruction(Compilation& compilation, const char* text)
+{
+    checkDisassembly(
+        compilation,
+        [&] (const char* disassembly) -> bool {
+            return strstr(disassembly, text);
+        },
+        toCString("Expected to find ", text, " but didnt!"));
+}
+
+void checkDoesNotUseInstruction(Compilation& compilation, const char* text)
+{
+    checkDisassembly(
+        compilation,
+        [&] (const char* disassembly) -> bool {
+            return !strstr(disassembly, text);
+        },
+        toCString("Did not expected to find ", text, " but it's there!"));
+}
+
+template<typename Type>
+struct Operand {
+    const char* name;
+    Type value;
+};
+
+typedef Operand<int64_t> Int64Operand;
+typedef Operand<int32_t> Int32Operand;
+
+template<typename FloatType>
+void populateWithInterestingValues(Vector<Operand<FloatType>>& operands)
+{
+    operands.append({ "0.", static_cast<FloatType>(0.) });
+    operands.append({ "-0.", static_cast<FloatType>(-0.) });
+    operands.append({ "0.4", static_cast<FloatType>(0.5) });
+    operands.append({ "-0.4", static_cast<FloatType>(-0.5) });
+    operands.append({ "0.5", static_cast<FloatType>(0.5) });
+    operands.append({ "-0.5", static_cast<FloatType>(-0.5) });
+    operands.append({ "0.6", static_cast<FloatType>(0.5) });
+    operands.append({ "-0.6", static_cast<FloatType>(-0.5) });
+    operands.append({ "1.", static_cast<FloatType>(1.) });
+    operands.append({ "-1.", static_cast<FloatType>(-1.) });
+    operands.append({ "2.", static_cast<FloatType>(2.) });
+    operands.append({ "-2.", static_cast<FloatType>(-2.) });
+    operands.append({ "M_PI", static_cast<FloatType>(M_PI) });
+    operands.append({ "-M_PI", static_cast<FloatType>(-M_PI) });
+    operands.append({ "min", std::numeric_limits<FloatType>::min() });
+    operands.append({ "max", std::numeric_limits<FloatType>::max() });
+    operands.append({ "lowest", std::numeric_limits<FloatType>::lowest() });
+    operands.append({ "epsilon", std::numeric_limits<FloatType>::epsilon() });
+    operands.append({ "infiniti", std::numeric_limits<FloatType>::infinity() });
+    operands.append({ "-infiniti", - std::numeric_limits<FloatType>::infinity() });
+    operands.append({ "PNaN", static_cast<FloatType>(PNaN) });
+}
+
+template<typename FloatType>
+Vector<Operand<FloatType>> floatingPointOperands()
+{
+    Vector<Operand<FloatType>> operands;
+    populateWithInterestingValues(operands);
+    return operands;
+};
+
+static Vector<Int64Operand> int64Operands()
+{
+    Vector<Int64Operand> operands;
+    operands.append({ "0", 0 });
+    operands.append({ "1", 1 });
+    operands.append({ "-1", -1 });
+    operands.append({ "42", 42 });
+    operands.append({ "-42", -42 });
+    operands.append({ "int64-max", std::numeric_limits<int64_t>::max() });
+    operands.append({ "int64-min", std::numeric_limits<int64_t>::min() });
+    operands.append({ "int32-max", std::numeric_limits<int32_t>::max() });
+    operands.append({ "int32-min", std::numeric_limits<int32_t>::min() });
+
+    return operands;
+}
+
+static Vector<Int32Operand> int32Operands()
+{
+    Vector<Int32Operand> operands({
+        { "0", 0 },
+        { "1", 1 },
+        { "-1", -1 },
+        { "42", 42 },
+        { "-42", -42 },
+        { "int32-max", std::numeric_limits<int32_t>::max() },
+        { "int32-min", std::numeric_limits<int32_t>::min() }
+    });
+    return operands;
+}
+
+void add32(CCallHelpers& jit, GPRReg src1, GPRReg src2, GPRReg dest)
+{
+    if (src2 == dest)
+        jit.add32(src1, dest);
+    else {
+        jit.move(src1, dest);
+        jit.add32(src2, dest);
+    }
+}
+
+void test42()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* const42 = root->appendNew<Const32Value>(proc, Origin(), 42);
+    root->appendNewControlValue(proc, Return, Origin(), const42);
+
+    CHECK(compileAndRun<int>(proc) == 42);
+}
+
+void testLoad42()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int x = 42;
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, Int32, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &x)));
+
+    CHECK(compileAndRun<int>(proc) == 42);
+}
+
+void testLoadWithOffsetImpl(int32_t offset64, int32_t offset32)
+{
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        int64_t x = -42;
+        Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, Load, Int64, Origin(),
+                base,
+                offset64));
+
+        char* address = reinterpret_cast<char*>(&x) - offset64;
+        CHECK(compileAndRun<int64_t>(proc, address) == -42);
+    }
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        int32_t x = -42;
+        Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, Load, Int32, Origin(),
+                base,
+                offset32));
+
+        char* address = reinterpret_cast<char*>(&x) - offset32;
+        CHECK(compileAndRun<int32_t>(proc, address) == -42);
+    }
+}
+
+void testLoadOffsetImm9Max()
+{
+    testLoadWithOffsetImpl(255, 255);
+}
+
+void testLoadOffsetImm9MaxPlusOne()
+{
+    testLoadWithOffsetImpl(256, 256);
+}
+
+void testLoadOffsetImm9MaxPlusTwo()
+{
+    testLoadWithOffsetImpl(257, 257);
+}
+
+void testLoadOffsetImm9Min()
+{
+    testLoadWithOffsetImpl(-256, -256);
+}
+
+void testLoadOffsetImm9MinMinusOne()
+{
+    testLoadWithOffsetImpl(-257, -257);
+}
+
+void testLoadOffsetScaledUnsignedImm12Max()
+{
+    testLoadWithOffsetImpl(32760, 16380);
+}
+
+void testLoadOffsetScaledUnsignedOverImm12Max()
+{
+    testLoadWithOffsetImpl(32760, 32760);
+    testLoadWithOffsetImpl(32761, 16381);
+    testLoadWithOffsetImpl(32768, 16384);
+}
+
+void testArg(int argument)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+
+    CHECK(compileAndRun<int>(proc, argument) == argument);
+}
+
+void testReturnConst64(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const64Value>(proc, Origin(), value));
+
+    CHECK(compileAndRun<int64_t>(proc) == value);
+}
+
+void testReturnVoid()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(proc, Return, Origin());
+    compileAndRun<void>(proc);
+}
+
+void testAddArg(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Add, Origin(), value, value));
+
+    CHECK(compileAndRun<int>(proc, a) == a + a);
+}
+
+void testAddArgs(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    CHECK(compileAndRun<int>(proc, a, b) == a + b);
+}
+
+void testAddArgImm(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int>(proc, a) == a + b);
+}
+
+void testAddImmArg(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(compileAndRun<int>(proc, b) == a + b);
+}
+
+void testAddArgMem(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        load);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int64_t inputOutput = b;
+    CHECK(!compileAndRun<int64_t>(proc, a, &inputOutput));
+    CHECK(inputOutput == a + b);
+}
+
+void testAddMemArg(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(),
+        load,
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int64_t>(proc, &a, b) == a + b);
+}
+
+void testAddImmMem(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(),
+        root->appendNew<Const64Value>(proc, Origin(), a),
+        load);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int64_t inputOutput = b;
+    CHECK(!compileAndRun<int>(proc, &inputOutput));
+    CHECK(inputOutput == a + b);
+}
+
+void testAddArg32(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Add, Origin(), value, value));
+
+    CHECK(compileAndRun<int>(proc, a) == a + a);
+}
+
+void testAddArgs32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int>(proc, a, b) == a + b);
+}
+
+void testAddArgMem32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), argument, load);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int32_t inputOutput = b;
+    CHECK(!compileAndRun<int32_t>(proc, a, &inputOutput));
+    CHECK(inputOutput == a + b);
+}
+
+void testAddMemArg32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), load, argument);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int32_t>(proc, &a, b) == a + b);
+}
+
+void testAddImmMem32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), a),
+        load);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int32_t inputOutput = b;
+    CHECK(!compileAndRun<int>(proc, &inputOutput));
+    CHECK(inputOutput == a + b);
+}
+
+void testAddArgZeroImmZDef()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* constZero = root->appendNew<Const32Value>(proc, Origin(), 0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            arg,
+            constZero));
+
+    auto code = compile(proc, 0);
+    CHECK(invoke<int64_t>(*code, 0x0123456789abcdef) == 0x89abcdef);
+}
+
+void testAddLoadTwice()
+{
+    auto test = [&] (unsigned optLevel) {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        int32_t value = 42;
+        Value* load = root->appendNew<MemoryValue>(
+            proc, Load, Int32, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &value));
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(proc, Add, Origin(), load, load));
+
+        auto code = compile(proc, optLevel);
+        CHECK(invoke<int32_t>(*code) == 42 * 2);
+    };
+
+    test(0);
+    test(1);
+}
+
+void testAddArgDouble(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Add, Origin(), value, value));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), a + a));
+}
+
+void testAddArgsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Add, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a, b), a + b));
+}
+
+void testAddArgImmDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Add, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), a + b));
+}
+
+void testAddImmArgDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Add, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, b), a + b));
+}
+
+void testAddImmsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Add, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), a + b));
+}
+
+void testAddArgFloat(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), floatValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a + a)));
+}
+
+void testAddArgsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), floatValue1, floatValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a + b)));
+}
+
+void testAddFPRArgsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0));
+    Value* argument2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1));
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, a, b), a + b));
+}
+
+void testAddArgImmFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), floatValue, constValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a + b)));
+}
+
+void testAddImmArgFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), constValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a + b)));
+}
+
+void testAddImmsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* constValue1 = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* constValue2 = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), constValue1, constValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc), bitwise_cast<int32_t>(a + b)));
+}
+
+void testAddArgFloatWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentInt32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentInt32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), asDouble, asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a + a)));
+}
+
+void testAddArgsFloatWithUselessDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* asDouble1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* asDouble2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), asDouble1, asDouble2);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a + b)));
+}
+
+void testAddArgsFloatWithEffectfulDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* asDouble1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* asDouble2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), asDouble1, asDouble2);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* doubleAddress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, doubleAddress);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    double effect = 0;
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b), &effect), bitwise_cast<int32_t>(a + b)));
+    CHECK(isIdentical(effect, static_cast<double>(a) + static_cast<double>(b)));
+}
+
+void testMulArg(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<Value>(
+        proc, Trunc, Origin(), root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mul, Origin(), value, value));
+
+    CHECK(compileAndRun<int>(proc, a) == a * a);
+}
+
+void testMulArgStore(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    int mulSlot;
+    int valueSlot;
+    
+    Value* value = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* mul = root->appendNew<Value>(proc, Mul, Origin(), value, value);
+
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(), value,
+        root->appendNew<ConstPtrValue>(proc, Origin(), &valueSlot));
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(), mul,
+        root->appendNew<ConstPtrValue>(proc, Origin(), &mulSlot));
+
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, a));
+    CHECK(mulSlot == a * a);
+    CHECK(valueSlot == a);
+}
+
+void testMulAddArg(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(proc, Mul, Origin(), value, value),
+            value));
+
+    CHECK(compileAndRun<int>(proc, a) == a * a + a);
+}
+
+void testMulArgs(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Mul, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    CHECK(compileAndRun<int>(proc, a, b) == a * b);
+}
+
+void testMulArgImm(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Mul, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == a * b);
+}
+
+void testMulImmArg(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Mul, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(compileAndRun<int>(proc, b) == a * b);
+}
+
+void testMulArgs32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Mul, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int>(proc, a, b) == a * b);
+}
+
+void testMulLoadTwice()
+{
+    auto test = [&] (unsigned optLevel) {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        int32_t value = 42;
+        Value* load = root->appendNew<MemoryValue>(
+            proc, Load, Int32, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &value));
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(proc, Mul, Origin(), load, load));
+
+        auto code = compile(proc, optLevel);
+        CHECK(invoke<int32_t>(*code) == 42 * 42);
+    };
+
+    test(0);
+    test(1);
+}
+
+void testMulAddArgsLeft()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg0, arg1);
+    Value* added = root->appendNew<Value>(proc, Add, Origin(), multiplied, arg2);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int64Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            for (auto c : testValues) {
+                CHECK(invoke<int64_t>(*code, a.value, b.value, c.value) == a.value * b.value + c.value);
+            }
+        }
+    }
+}
+
+void testMulAddArgsRight()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg1, arg2);
+    Value* added = root->appendNew<Value>(proc, Add, Origin(), arg0, multiplied);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int64Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            for (auto c : testValues) {
+                CHECK(invoke<int64_t>(*code, a.value, b.value, c.value) == a.value + b.value * c.value);
+            }
+        }
+    }
+}
+
+void testMulAddArgsLeft32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* arg2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2));
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg0, arg1);
+    Value* added = root->appendNew<Value>(proc, Add, Origin(), multiplied, arg2);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int32Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            for (auto c : testValues) {
+                CHECK(invoke<int32_t>(*code, a.value, b.value, c.value) == a.value * b.value + c.value);
+            }
+        }
+    }
+}
+
+void testMulAddArgsRight32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* arg2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2));
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg1, arg2);
+    Value* added = root->appendNew<Value>(proc, Add, Origin(), arg0, multiplied);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int32Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            for (auto c : testValues) {
+                CHECK(invoke<int32_t>(*code, a.value, b.value, c.value) == a.value + b.value * c.value);
+            }
+        }
+    }
+}
+
+void testMulSubArgsLeft()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg0, arg1);
+    Value* added = root->appendNew<Value>(proc, Sub, Origin(), multiplied, arg2);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int64Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            for (auto c : testValues) {
+                CHECK(invoke<int64_t>(*code, a.value, b.value, c.value) == a.value * b.value - c.value);
+            }
+        }
+    }
+}
+
+void testMulSubArgsRight()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg1, arg2);
+    Value* added = root->appendNew<Value>(proc, Sub, Origin(), arg0, multiplied);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int64Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            for (auto c : testValues) {
+                CHECK(invoke<int64_t>(*code, a.value, b.value, c.value) == a.value - b.value * c.value);
+            }
+        }
+    }
+}
+
+void testMulSubArgsLeft32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* arg2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2));
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg0, arg1);
+    Value* added = root->appendNew<Value>(proc, Sub, Origin(), multiplied, arg2);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int32Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            for (auto c : testValues) {
+                CHECK(invoke<int32_t>(*code, a.value, b.value, c.value) == a.value * b.value - c.value);
+            }
+        }
+    }
+}
+
+void testMulSubArgsRight32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* arg2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2));
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg1, arg2);
+    Value* added = root->appendNew<Value>(proc, Sub, Origin(), arg0, multiplied);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int32Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            for (auto c : testValues) {
+                CHECK(invoke<int32_t>(*code, a.value, b.value, c.value) == a.value - b.value * c.value);
+            }
+        }
+    }
+}
+
+void testMulNegArgs()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg0, arg1);
+    Value* zero = root->appendNew<Const64Value>(proc, Origin(), 0);
+    Value* added = root->appendNew<Value>(proc, Sub, Origin(), zero, multiplied);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int64Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            CHECK(invoke<int64_t>(*code, a.value, b.value) == -(a.value * b.value));
+        }
+    }
+}
+
+void testMulNegArgs32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg0 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* multiplied = root->appendNew<Value>(proc, Mul, Origin(), arg0, arg1);
+    Value* zero = root->appendNew<Const32Value>(proc, Origin(), 0);
+    Value* added = root->appendNew<Value>(proc, Sub, Origin(), zero, multiplied);
+    root->appendNewControlValue(proc, Return, Origin(), added);
+
+    auto code = compile(proc);
+
+    auto testValues = int32Operands();
+    for (auto a : testValues) {
+        for (auto b : testValues) {
+            CHECK(invoke<int32_t>(*code, a.value, b.value) == -(a.value * b.value));
+        }
+    }
+}
+
+void testMulArgDouble(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mul, Origin(), value, value));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), a * a));
+}
+
+void testMulArgsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mul, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a, b), a * b));
+}
+
+void testMulArgImmDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mul, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), a * b));
+}
+
+void testMulImmArgDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mul, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, b), a * b));
+}
+
+void testMulImmsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mul, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), a * b));
+}
+
+void testMulArgFloat(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Mul, Origin(), floatValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a * a)));
+}
+
+void testMulArgsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* result = root->appendNew<Value>(proc, Mul, Origin(), floatValue1, floatValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a * b)));
+}
+
+void testMulArgImmFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Mul, Origin(), floatValue, constValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a * b)));
+}
+
+void testMulImmArgFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Mul, Origin(), constValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a * b)));
+}
+
+void testMulImmsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* constValue1 = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* constValue2 = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Mul, Origin(), constValue1, constValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc), bitwise_cast<int32_t>(a * b)));
+}
+
+void testMulArgFloatWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentInt32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentInt32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Mul, Origin(), asDouble, asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a * a)));
+}
+
+void testMulArgsFloatWithUselessDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* asDouble1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* asDouble2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+    Value* result = root->appendNew<Value>(proc, Mul, Origin(), asDouble1, asDouble2);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a * b)));
+}
+
+void testMulArgsFloatWithEffectfulDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* asDouble1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* asDouble2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+    Value* result = root->appendNew<Value>(proc, Mul, Origin(), asDouble1, asDouble2);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* doubleMulress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, doubleMulress);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    double effect = 0;
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b), &effect), bitwise_cast<int32_t>(a * b)));
+    CHECK(isIdentical(effect, static_cast<double>(a) * static_cast<double>(b)));
+}
+
+void testDivArgDouble(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Div, Origin(), value, value));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), a / a));
+}
+
+void testDivArgsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Div, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a, b), a / b));
+}
+
+void testDivArgImmDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Div, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), a / b));
+}
+
+void testDivImmArgDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Div, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, b), a / b));
+}
+
+void testDivImmsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Div, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), a / b));
+}
+
+void testDivArgFloat(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Div, Origin(), floatValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a / a)));
+}
+
+void testDivArgsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* result = root->appendNew<Value>(proc, Div, Origin(), floatValue1, floatValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a / b)));
+}
+
+void testDivArgImmFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Div, Origin(), floatValue, constValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a / b)));
+}
+
+void testDivImmArgFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Div, Origin(), constValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a / b)));
+}
+
+void testDivImmsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* constValue1 = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* constValue2 = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Div, Origin(), constValue1, constValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc), bitwise_cast<int32_t>(a / b)));
+}
+
+void testModArgDouble(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mod, Origin(), value, value));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), fmod(a, a)));
+}
+
+void testModArgsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mod, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a, b), fmod(a, b)));
+}
+
+void testModArgImmDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mod, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), fmod(a, b)));
+}
+
+void testModImmArgDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mod, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, b), fmod(a, b)));
+}
+
+void testModImmsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Mod, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), fmod(a, b)));
+}
+
+void testModArgFloat(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), floatValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(static_cast<float>(fmod(a, a)))));
+}
+
+void testModArgsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), floatValue1, floatValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(static_cast<float>(fmod(a, b)))));
+}
+
+void testModArgImmFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), floatValue, constValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(static_cast<float>(fmod(a, b)))));
+}
+
+void testModImmArgFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), constValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(static_cast<float>(fmod(a, b)))));
+}
+
+void testModImmsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* constValue1 = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* constValue2 = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), constValue1, constValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc), bitwise_cast<int32_t>(static_cast<float>(fmod(a, b)))));
+}
+
+void testDivArgFloatWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentInt32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentInt32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Div, Origin(), asDouble, asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a / a)));
+}
+
+void testDivArgsFloatWithUselessDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* asDouble1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* asDouble2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+    Value* result = root->appendNew<Value>(proc, Div, Origin(), asDouble1, asDouble2);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a / b)));
+}
+
+void testDivArgsFloatWithEffectfulDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* asDouble1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* asDouble2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+    Value* result = root->appendNew<Value>(proc, Div, Origin(), asDouble1, asDouble2);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* doubleDivress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, doubleDivress);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    double effect = 0;
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b), &effect), bitwise_cast<int32_t>(a / b)));
+    CHECK(isIdentical(effect, static_cast<double>(a) / static_cast<double>(b)));
+}
+
+void testUDivArgsInt32(uint32_t a, uint32_t b)
+{
+    // UDiv with denominator == 0 is invalid.
+    if (!b)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* result = root->appendNew<Value>(proc, UDiv, Origin(), argument1, argument2);
+    root->appendNew<Value>(proc, Return, Origin(), result);
+
+    CHECK_EQ(compileAndRun<uint32_t>(proc, a, b), a / b);
+}
+
+void testUDivArgsInt64(uint64_t a, uint64_t b)
+{
+    // UDiv with denominator == 0 is invalid.
+    if (!b)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* result = root->appendNew<Value>(proc, UDiv, Origin(), argument1, argument2);
+    root->appendNew<Value>(proc, Return, Origin(), result);
+
+    CHECK_EQ(compileAndRun<uint64_t>(proc, a, b), a / b);
+}
+
+void testUModArgsInt32(uint32_t a, uint32_t b)
+{
+    // UMod with denominator == 0 is invalid.
+    if (!b)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* result = root->appendNew<Value>(proc, UMod, Origin(), argument1, argument2);
+    root->appendNew<Value>(proc, Return, Origin(), result);
+
+    CHECK_EQ(compileAndRun<uint32_t>(proc, a, b), a % b);
+}
+
+void testUModArgsInt64(uint64_t a, uint64_t b)
+{
+    // UMod with denominator == 0 is invalid.
+    if (!b)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* result = root->appendNew<Value>(proc, UMod, Origin(), argument1, argument2);
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    CHECK_EQ(compileAndRun<uint64_t>(proc, a, b), a % b);
+}
+
+void testSubArg(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sub, Origin(), value, value));
+
+    CHECK(!compileAndRun<int>(proc, a));
+}
+
+void testSubArgs(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    CHECK(compileAndRun<int>(proc, a, b) == a - b);
+}
+
+void testSubArgImm(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == a - b);
+}
+
+void testNegValueSubOne(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* negArgument = root->appendNew<Value>(proc, Sub, Origin(),
+        root->appendNew<Const64Value>(proc, Origin(), 0),
+        argument);
+    Value* negArgumentMinusOne = root->appendNew<Value>(proc, Sub, Origin(),
+        negArgument,
+        root->appendNew<Const64Value>(proc, Origin(), 1));
+    root->appendNewControlValue(proc, Return, Origin(), negArgumentMinusOne);
+    CHECK(compileAndRun<int>(proc, a) == -a - 1);
+}
+
+void testSubImmArg(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(compileAndRun<int>(proc, b) == a - b);
+}
+
+void testSubArgMem(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        load);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int64_t>(proc, a, &b) == a - b);
+}
+
+void testSubMemArg(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(),
+        load,
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int64_t inputOutput = a;
+    CHECK(!compileAndRun<int64_t>(proc, &inputOutput, b));
+    CHECK(inputOutput == a - b);
+}
+
+void testSubImmMem(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(),
+        root->appendNew<Const64Value>(proc, Origin(), a),
+        load);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int64_t inputOutput = b;
+    CHECK(!compileAndRun<int>(proc, &inputOutput));
+    CHECK(inputOutput == a - b);
+}
+
+void testSubMemImm(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(),
+        load,
+        root->appendNew<Const64Value>(proc, Origin(), b));
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int64_t inputOutput = a;
+    CHECK(!compileAndRun<int>(proc, &inputOutput));
+    CHECK(inputOutput == a - b);
+}
+
+
+void testSubArgs32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int>(proc, a, b) == a - b);
+}
+
+void testSubArgImm32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int>(proc, a) == a - b);
+}
+
+void testSubImmArg32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int>(proc, b) == a - b);
+}
+
+void testSubMemArg32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), load, argument);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int32_t inputOutput = a;
+    CHECK(!compileAndRun<int32_t>(proc, &inputOutput, b));
+    CHECK(inputOutput == a - b);
+}
+
+void testSubArgMem32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), argument, load);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int32_t>(proc, a, &b) == a - b);
+}
+
+void testSubImmMem32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), a),
+        load);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int32_t inputOutput = b;
+    CHECK(!compileAndRun<int>(proc, &inputOutput));
+    CHECK(inputOutput == a - b);
+}
+
+void testSubMemImm32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(),
+        load,
+        root->appendNew<Const32Value>(proc, Origin(), b));
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int32_t inputOutput = a;
+    CHECK(!compileAndRun<int>(proc, &inputOutput));
+    CHECK(inputOutput == a - b);
+}
+
+void testNegValueSubOne32(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* negArgument = root->appendNew<Value>(proc, Sub, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0),
+        argument);
+    Value* negArgumentMinusOne = root->appendNew<Value>(proc, Sub, Origin(),
+        negArgument,
+        root->appendNew<Const32Value>(proc, Origin(), 1));
+    root->appendNewControlValue(proc, Return, Origin(), negArgumentMinusOne);
+    CHECK(compileAndRun<int>(proc, a) == -a - 1);
+}
+
+void testSubArgDouble(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sub, Origin(), value, value));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), a - a));
+}
+
+void testSubArgsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sub, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a, b), a - b));
+}
+
+void testSubArgImmDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sub, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), a - b));
+}
+
+void testSubImmArgDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sub, Origin(), valueA, valueB));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, b), a - b));
+}
+
+void testSubImmsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* valueA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* valueB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sub, Origin(), valueA, valueB));
+    
+    CHECK(isIdentical(compileAndRun<double>(proc), a - b));
+}
+
+void testSubArgFloat(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), floatValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a - a)));
+}
+
+void testSubArgsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), floatValue1, floatValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a - b)));
+}
+
+void testSubArgImmFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), floatValue, constValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a - b)));
+}
+
+void testSubImmArgFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* constValue = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), constValue, floatValue);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a - b)));
+}
+
+void testSubImmsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* constValue1 = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* constValue2 = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), constValue1, constValue2);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc), bitwise_cast<int32_t>(a - b)));
+}
+
+void testSubArgFloatWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentInt32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentInt32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), asDouble, asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(a - a)));
+}
+
+void testSubArgsFloatWithUselessDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* asDouble1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* asDouble2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), asDouble1, asDouble2);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitwise_cast<int32_t>(a - b)));
+}
+
+void testSubArgsFloatWithEffectfulDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* asDouble1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* asDouble2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), asDouble1, asDouble2);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* doubleSubress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, doubleSubress);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    double effect = 0;
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b), &effect), bitwise_cast<int32_t>(a - b)));
+    CHECK(isIdentical(effect, static_cast<double>(a) - static_cast<double>(b)));
+}
+
+void testTernarySubInstructionSelection(B3::Opcode valueModifier, Type valueType, Air::Opcode expectedOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* left = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* right = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+
+    if (valueModifier == Trunc) {
+        left = root->appendNew<Value>(proc, valueModifier, valueType, Origin(), left);
+        right = root->appendNew<Value>(proc, valueModifier, valueType, Origin(), right);
+    }
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sub, Origin(), left, right));
+
+    lowerToAirForTesting(proc);
+
+    auto block = proc.code()[0];
+    unsigned numberOfSubInstructions = 0;
+    for (auto instruction : *block) {
+        if (instruction.kind.opcode == expectedOpcode) {
+            CHECK_EQ(instruction.args.size(), 3ul);
+            CHECK_EQ(instruction.args[0].kind(), Air::Arg::Tmp);
+            CHECK_EQ(instruction.args[1].kind(), Air::Arg::Tmp);
+            CHECK_EQ(instruction.args[2].kind(), Air::Arg::Tmp);
+            numberOfSubInstructions++;
+        }
+    }
+    CHECK_EQ(numberOfSubInstructions, 1ul);
+}
+
+void testNegDouble(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Neg, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0)));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), -a));
+}
+
+void testNegFloat(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Neg, Origin(), floatValue));
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), -a));
+}
+
+void testNegFloatWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentInt32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentInt32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Neg, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), floatResult);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), -a));
+}
+
+void testBitAndArgs(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    CHECK(compileAndRun<int64_t>(proc, a, b) == (a & b));
+}
+
+void testBitAndSameArg(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            argument,
+            argument));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == a);
+}
+
+void testBitAndImms(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc) == (a & b));
+}
+
+void testBitAndArgImm(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == (a & b));
+}
+
+void testBitAndImmArg(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(compileAndRun<int64_t>(proc, b) == (a & b));
+}
+
+void testBitAndBitAndArgImmImm(int64_t a, int64_t b, int64_t c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitAnd = root->appendNew<Value>(
+        proc, BitAnd, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Const64Value>(proc, Origin(), b));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            innerBitAnd,
+            root->appendNew<Const64Value>(proc, Origin(), c)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == ((a & b) & c));
+}
+
+void testBitAndImmBitAndArgImm(int64_t a, int64_t b, int64_t c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitAnd = root->appendNew<Value>(
+        proc, BitAnd, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Const64Value>(proc, Origin(), c));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            innerBitAnd));
+
+    CHECK(compileAndRun<int64_t>(proc, b) == (a & (b & c)));
+}
+
+void testBitAndArgs32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int>(proc, a, b) == (a & b));
+}
+
+void testBitAndSameArg32(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            argument,
+            argument));
+
+    CHECK(compileAndRun<int>(proc, a) == a);
+}
+
+void testBitAndImms32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int>(proc) == (a & b));
+}
+
+void testBitAndArgImm32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int>(proc, a) == (a & b));
+}
+
+void testBitAndImmArg32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int>(proc, b) == (a & b));
+}
+
+void testBitAndBitAndArgImmImm32(int a, int b, int c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitAnd = root->appendNew<Value>(
+        proc, BitAnd, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<Const32Value>(proc, Origin(), b));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            innerBitAnd,
+            root->appendNew<Const32Value>(proc, Origin(), c)));
+
+    CHECK(compileAndRun<int>(proc, a) == ((a & b) & c));
+}
+
+void testBitAndImmBitAndArgImm32(int a, int b, int c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitAnd = root->appendNew<Value>(
+        proc, BitAnd, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<Const32Value>(proc, Origin(), c));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            innerBitAnd));
+
+    CHECK(compileAndRun<int>(proc, b) == (a & (b & c)));
+}
+
+void testBitAndWithMaskReturnsBooleans(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* equal = root->appendNew<Value>(proc, Equal, Origin(), arg0, arg1);
+    Value* maskedEqual = root->appendNew<Value>(proc, BitAnd, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0x5),
+        equal);
+    Value* inverted = root->appendNew<Value>(proc, BitXor, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0x1),
+        maskedEqual);
+    Value* select = root->appendNew<Value>(proc, Select, Origin(), inverted,
+        root->appendNew<Const64Value>(proc, Origin(), 42),
+        root->appendNew<Const64Value>(proc, Origin(), -5));
+
+    root->appendNewControlValue(proc, Return, Origin(), select);
+
+    int64_t expected = (a == b) ? -5 : 42;
+    CHECK(compileAndRun<int64_t>(proc, a, b) == expected);
+}
+
+double bitAndDouble(double a, double b)
+{
+    return bitwise_cast<double>(bitwise_cast<uint64_t>(a) & bitwise_cast<uint64_t>(b));
+}
+
+void testBitAndArgDouble(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* result = root->appendNew<Value>(proc, BitAnd, Origin(), argument, argument);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), bitAndDouble(a, a)));
+}
+
+void testBitAndArgsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* argumentB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    Value* result = root->appendNew<Value>(proc, BitAnd, Origin(), argumentA, argumentB);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a, b), bitAndDouble(a, b)));
+}
+
+void testBitAndArgImmDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* argumentB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, BitAnd, Origin(), argumentA, argumentB);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a, b), bitAndDouble(a, b)));
+}
+
+void testBitAndImmsDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* argumentB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, BitAnd, Origin(), argumentA, argumentB);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<double>(proc), bitAndDouble(a, b)));
+}
+
+float bitAndFloat(float a, float b)
+{
+    return bitwise_cast<float>(bitwise_cast<uint32_t>(a) & bitwise_cast<uint32_t>(b));
+}
+
+void testBitAndArgFloat(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+        root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+    Value* result = root->appendNew<Value>(proc, BitAnd, Origin(), argument, argument);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), bitAndFloat(a, a)));
+}
+
+void testBitAndArgsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentA = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+        root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+    Value* argumentB = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+        root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+    Value* result = root->appendNew<Value>(proc, BitAnd, Origin(), argumentA, argumentB);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitAndFloat(a, b)));
+}
+
+void testBitAndArgImmFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentA = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+        root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+    Value* argumentB = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, BitAnd, Origin(), argumentA, argumentB);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), bitAndFloat(a, b)));
+}
+
+void testBitAndImmsFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentA = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* argumentB = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+    Value* result = root->appendNew<Value>(proc, BitAnd, Origin(), argumentA, argumentB);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(isIdentical(compileAndRun<float>(proc), bitAndFloat(a, b)));
+}
+
+void testBitAndArgsFloatWithUselessDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentA = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+        root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+    Value* argumentB = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+        root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+    Value* argumentAasDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), argumentA);
+    Value* argumentBasDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), argumentB);
+    Value* doubleResult = root->appendNew<Value>(proc, BitAnd, Origin(), argumentAasDouble, argumentBasDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), doubleResult);
+    root->appendNewControlValue(proc, Return, Origin(), floatResult);
+
+    double doubleA = a;
+    double doubleB = b;
+    float expected = static_cast<float>(bitAndDouble(doubleA, doubleB));
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), expected));
+}
+
+void testBitOrArgs(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    CHECK(compileAndRun<int64_t>(proc, a, b) == (a | b));
+}
+
+void testBitOrSameArg(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            argument,
+            argument));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == a);
+}
+
+void testBitOrImms(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc) == (a | b));
+}
+
+void testBitOrArgImm(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == (a | b));
+}
+
+void testBitOrImmArg(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(compileAndRun<int64_t>(proc, b) == (a | b));
+}
+
+void testBitOrBitOrArgImmImm(int64_t a, int64_t b, int64_t c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitOr = root->appendNew<Value>(
+        proc, BitOr, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Const64Value>(proc, Origin(), b));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            innerBitOr,
+            root->appendNew<Const64Value>(proc, Origin(), c)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == ((a | b) | c));
+}
+
+void testBitOrImmBitOrArgImm(int64_t a, int64_t b, int64_t c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitOr = root->appendNew<Value>(
+        proc, BitOr, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Const64Value>(proc, Origin(), c));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            innerBitOr));
+
+    CHECK(compileAndRun<int64_t>(proc, b) == (a | (b | c)));
+}
+
+void testBitOrArgs32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int>(proc, a, b) == (a | b));
+}
+
+void testBitOrSameArg32(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            argument,
+            argument));
+
+    CHECK(compileAndRun<int>(proc, a) == a);
+}
+
+void testBitOrImms32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int>(proc) == (a | b));
+}
+
+void testBitOrArgImm32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int>(proc, a) == (a | b));
+}
+
+void testBitOrImmArg32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int>(proc, b) == (a | b));
+}
+
+void testBitOrBitOrArgImmImm32(int a, int b, int c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitOr = root->appendNew<Value>(
+        proc, BitOr, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<Const32Value>(proc, Origin(), b));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            innerBitOr,
+            root->appendNew<Const32Value>(proc, Origin(), c)));
+
+    CHECK(compileAndRun<int>(proc, a) == ((a | b) | c));
+}
+
+void testBitOrImmBitOrArgImm32(int a, int b, int c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitOr = root->appendNew<Value>(
+        proc, BitOr, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<Const32Value>(proc, Origin(), c));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitOr, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            innerBitOr));
+
+    CHECK(compileAndRun<int>(proc, b) == (a | (b | c)));
+}
+
+void testBitXorArgs(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    CHECK(compileAndRun<int64_t>(proc, a, b) == (a ^ b));
+}
+
+void testBitXorSameArg(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            argument,
+            argument));
+
+    CHECK(!compileAndRun<int64_t>(proc, a));
+}
+
+void testBitXorImms(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc) == (a ^ b));
+}
+
+void testBitXorArgImm(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const64Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == (a ^ b));
+}
+
+void testBitXorImmArg(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(compileAndRun<int64_t>(proc, b) == (a ^ b));
+}
+
+void testBitXorBitXorArgImmImm(int64_t a, int64_t b, int64_t c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitXor = root->appendNew<Value>(
+        proc, BitXor, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Const64Value>(proc, Origin(), b));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            innerBitXor,
+            root->appendNew<Const64Value>(proc, Origin(), c)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == ((a ^ b) ^ c));
+}
+
+void testBitXorImmBitXorArgImm(int64_t a, int64_t b, int64_t c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitXor = root->appendNew<Value>(
+        proc, BitXor, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Const64Value>(proc, Origin(), c));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            innerBitXor));
+
+    CHECK(compileAndRun<int64_t>(proc, b) == (a ^ (b ^ c)));
+}
+
+void testBitXorArgs32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int>(proc, a, b) == (a ^ b));
+}
+
+void testBitXorSameArg32(int a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            argument,
+            argument));
+
+    CHECK(!compileAndRun<int>(proc, a));
+}
+
+void testBitXorImms32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int>(proc) == (a ^ b));
+}
+
+void testBitXorArgImm32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int>(proc, a) == (a ^ b));
+}
+
+void testBitXorImmArg32(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int>(proc, b) == (a ^ b));
+}
+
+void testBitXorBitXorArgImmImm32(int a, int b, int c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitXor = root->appendNew<Value>(
+        proc, BitXor, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<Const32Value>(proc, Origin(), b));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            innerBitXor,
+            root->appendNew<Const32Value>(proc, Origin(), c)));
+
+    CHECK(compileAndRun<int>(proc, a) == ((a ^ b) ^ c));
+}
+
+void testBitXorImmBitXorArgImm32(int a, int b, int c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* innerBitXor = root->appendNew<Value>(
+        proc, BitXor, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<Const32Value>(proc, Origin(), c));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            innerBitXor));
+
+    CHECK(compileAndRun<int>(proc, b) == (a ^ (b ^ c)));
+}
+
+void testBitNotArg(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), -1),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(isIdentical(compileAndRun<int64_t>(proc, a), static_cast<int64_t>((static_cast<uint64_t>(a) ^ 0xffffffffffffffff))));
+}
+
+void testBitNotImm(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), -1),
+            root->appendNew<Const64Value>(proc, Origin(), a)));
+
+    CHECK(isIdentical(compileAndRun<int64_t>(proc, a), static_cast<int64_t>((static_cast<uint64_t>(a) ^ 0xffffffffffffffff))));
+}
+
+void testBitNotMem(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* notLoad = root->appendNew<Value>(proc, BitXor, Origin(),
+        root->appendNew<Const64Value>(proc, Origin(), -1),
+        load);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), notLoad, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int64_t input = a;
+    compileAndRun<int32_t>(proc, &input);
+    CHECK(isIdentical(input, static_cast<int64_t>((static_cast<uint64_t>(a) ^ 0xffffffffffffffff))));
+}
+
+void testBitNotArg32(int32_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, BitXor, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), -1),
+            argument));
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, a), static_cast<int32_t>((static_cast<uint32_t>(a) ^ 0xffffffff))));
+}
+
+void testBitNotImm32(int32_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitXor, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), -1),
+            root->appendNew<Const32Value>(proc, Origin(), a)));
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, a), static_cast<int32_t>((static_cast<uint32_t>(a) ^ 0xffffffff))));
+}
+
+void testBitNotMem32(int32_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* notLoad = root->appendNew<Value>(proc, BitXor, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), -1),
+        load);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), notLoad, address);
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    int32_t input = a;
+    compileAndRun<int32_t>(proc, &input);
+    CHECK(isIdentical(input, static_cast<int32_t>((static_cast<uint32_t>(a) ^ 0xffffffff))));
+}
+
+void testBitNotOnBooleanAndBranch32(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* arg1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* argsAreEqual = root->appendNew<Value>(proc, Equal, Origin(), arg1, arg2);
+    Value* argsAreNotEqual = root->appendNew<Value>(proc, BitXor, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), -1),
+        argsAreEqual);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        argsAreNotEqual,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -42));
+
+    int32_t expectedValue = (a != b) ? 42 : -42;
+    CHECK(compileAndRun<int32_t>(proc, a, b) == expectedValue);
+}
+
+void testShlArgs(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int64_t>(proc, a, b) == (a << b));
+}
+
+void testShlImms(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc) == (a << b));
+}
+
+void testShlArgImm(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == (a << b));
+}
+
+void testShlArg32(int32_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Shl, Origin(), value, value));
+
+    CHECK(compileAndRun<int32_t>(proc, a) == (a << a));
+}
+
+void testShlArgs32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int32_t>(proc, a, b) == (a << b));
+}
+
+void testShlImms32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int32_t>(proc) == (a << b));
+}
+
+void testShlArgImm32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int32_t>(proc, a) == (a << b));
+}
+
+void testSShrArgs(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int64_t>(proc, a, b) == (a >> b));
+}
+
+void testSShrImms(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc) == (a >> b));
+}
+
+void testSShrArgImm(int64_t a, int64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int64_t>(proc, a) == (a >> b));
+}
+
+void testSShrArg32(int32_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, SShr, Origin(), value, value));
+
+    CHECK(compileAndRun<int32_t>(proc, a) == (a >> (a & 31)));
+}
+
+void testSShrArgs32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<int32_t>(proc, a, b) == (a >> b));
+}
+
+void testSShrImms32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int32_t>(proc) == (a >> b));
+}
+
+void testSShrArgImm32(int32_t a, int32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<int32_t>(proc, a) == (a >> b));
+}
+
+void testZShrArgs(uint64_t a, uint64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZShr, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<uint64_t>(proc, a, b) == (a >> b));
+}
+
+void testZShrImms(uint64_t a, uint64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZShr, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<uint64_t>(proc) == (a >> b));
+}
+
+void testZShrArgImm(uint64_t a, uint64_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZShr, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<uint64_t>(proc, a) == (a >> b));
+}
+
+void testZShrArg32(uint32_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, ZShr, Origin(), value, value));
+
+    CHECK(compileAndRun<uint32_t>(proc, a) == (a >> (a & 31)));
+}
+
+void testZShrArgs32(uint32_t a, uint32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZShr, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+    CHECK(compileAndRun<uint32_t>(proc, a, b) == (a >> b));
+}
+
+void testZShrImms32(uint32_t a, uint32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZShr, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), a),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<uint32_t>(proc) == (a >> b));
+}
+
+void testZShrArgImm32(uint32_t a, uint32_t b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZShr, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), b)));
+
+    CHECK(compileAndRun<uint32_t>(proc, a) == (a >> b));
+}
+
+template<typename IntegerType>
+static unsigned countLeadingZero(IntegerType value)
+{
+    unsigned bitCount = sizeof(IntegerType) * 8;
+    if (!value)
+        return bitCount;
+
+    unsigned counter = 0;
+    while (!(static_cast<uint64_t>(value) & (1l << (bitCount - 1)))) {
+        value <<= 1;
+        ++counter;
+    }
+    return counter;
+}
+
+void testClzArg64(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* clzValue = root->appendNew<Value>(proc, Clz, Origin(), argument);
+    root->appendNewControlValue(proc, Return, Origin(), clzValue);
+    CHECK(compileAndRun<unsigned>(proc, a) == countLeadingZero(a));
+}
+
+void testClzMem64(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* value = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* clzValue = root->appendNew<Value>(proc, Clz, Origin(), value);
+    root->appendNewControlValue(proc, Return, Origin(), clzValue);
+    CHECK(compileAndRun<unsigned>(proc, &a) == countLeadingZero(a));
+}
+
+void testClzArg32(int32_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* clzValue = root->appendNew<Value>(proc, Clz, Origin(), argument);
+    root->appendNewControlValue(proc, Return, Origin(), clzValue);
+    CHECK(compileAndRun<unsigned>(proc, a) == countLeadingZero(a));
+}
+
+void testClzMem32(int32_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* value = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* clzValue = root->appendNew<Value>(proc, Clz, Origin(), value);
+    root->appendNewControlValue(proc, Return, Origin(), clzValue);
+    CHECK(compileAndRun<unsigned>(proc, &a) == countLeadingZero(a));
+}
+
+void testAbsArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Abs, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0)));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), fabs(a)));
+}
+
+void testAbsImm(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Abs, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), fabs(a)));
+}
+
+void testAbsMem(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadDouble = root->appendNew<MemoryValue>(proc, Load, Double, Origin(), address);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Abs, Origin(), loadDouble));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, &a), fabs(a)));
+}
+
+void testAbsAbsArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* firstAbs = root->appendNew<Value>(proc, Abs, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0));
+    Value* secondAbs = root->appendNew<Value>(proc, Abs, Origin(), firstAbs);
+    root->appendNewControlValue(proc, Return, Origin(), secondAbs);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), fabs(a)));
+}
+
+void testAbsBitwiseCastArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentAsInt64 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argumentAsDouble = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentAsInt64);
+    Value* absValue = root->appendNew<Value>(proc, Abs, Origin(), argumentAsDouble);
+    root->appendNewControlValue(proc, Return, Origin(), absValue);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, bitwise_cast<int64_t>(a)), fabs(a)));
+}
+
+void testBitwiseCastAbsBitwiseCastArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentAsInt64 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argumentAsDouble = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentAsInt64);
+    Value* absValue = root->appendNew<Value>(proc, Abs, Origin(), argumentAsDouble);
+    Value* resultAsInt64 = root->appendNew<Value>(proc, BitwiseCast, Origin(), absValue);
+
+    root->appendNewControlValue(proc, Return, Origin(), resultAsInt64);
+
+    int64_t expectedResult = bitwise_cast<int64_t>(fabs(a));
+    CHECK(isIdentical(compileAndRun<int64_t>(proc, bitwise_cast<int64_t>(a)), expectedResult));
+}
+
+void testAbsArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Abs, Origin(), argument);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(static_cast<float>(fabs(a)))));
+}
+
+void testAbsImm(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Abs, Origin(), argument);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(static_cast<float>(fabs(a)))));
+}
+
+void testAbsMem(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadFloat = root->appendNew<MemoryValue>(proc, Load, Float, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Abs, Origin(), loadFloat);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, &a), bitwise_cast<int32_t>(static_cast<float>(fabs(a)))));
+}
+
+void testAbsAbsArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* firstAbs = root->appendNew<Value>(proc, Abs, Origin(), argument);
+    Value* secondAbs = root->appendNew<Value>(proc, Abs, Origin(), firstAbs);
+    root->appendNewControlValue(proc, Return, Origin(), secondAbs);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), static_cast<float>(fabs(a))));
+}
+
+void testAbsBitwiseCastArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentAsInt32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argumentAsfloat = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentAsInt32);
+    Value* absValue = root->appendNew<Value>(proc, Abs, Origin(), argumentAsfloat);
+    root->appendNewControlValue(proc, Return, Origin(), absValue);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), static_cast<float>(fabs(a))));
+}
+
+void testBitwiseCastAbsBitwiseCastArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argumentAsInt32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argumentAsfloat = root->appendNew<Value>(proc, BitwiseCast, Origin(), argumentAsInt32);
+    Value* absValue = root->appendNew<Value>(proc, Abs, Origin(), argumentAsfloat);
+    Value* resultAsInt64 = root->appendNew<Value>(proc, BitwiseCast, Origin(), absValue);
+
+    root->appendNewControlValue(proc, Return, Origin(), resultAsInt64);
+
+    int32_t expectedResult = bitwise_cast<int32_t>(static_cast<float>(fabs(a)));
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), expectedResult));
+}
+
+void testAbsArgWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Abs, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(static_cast<float>(fabs(a)))));
+}
+
+void testAbsArgWithEffectfulDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Abs, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    Value* doubleAddress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, doubleAddress);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    double effect = 0;
+    int32_t resultValue = compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), &effect);
+    CHECK(isIdentical(resultValue, bitwise_cast<int32_t>(static_cast<float>(fabs(a)))));
+    CHECK(isIdentical(effect, static_cast<double>(fabs(a))));
+}
+
+void testCeilArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Ceil, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0)));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), ceil(a)));
+}
+
+void testCeilImm(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Ceil, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), ceil(a)));
+}
+
+void testCeilMem(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadDouble = root->appendNew<MemoryValue>(proc, Load, Double, Origin(), address);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Ceil, Origin(), loadDouble));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, &a), ceil(a)));
+}
+
+void testCeilCeilArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* firstCeil = root->appendNew<Value>(proc, Ceil, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0));
+    Value* secondCeil = root->appendNew<Value>(proc, Ceil, Origin(), firstCeil);
+    root->appendNewControlValue(proc, Return, Origin(), secondCeil);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), ceil(a)));
+}
+
+void testFloorCeilArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* firstCeil = root->appendNew<Value>(proc, Ceil, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0));
+    Value* wrappingFloor = root->appendNew<Value>(proc, Floor, Origin(), firstCeil);
+    root->appendNewControlValue(proc, Return, Origin(), wrappingFloor);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), ceil(a)));
+}
+
+void testCeilIToD64(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argumentAsDouble = root->appendNew<Value>(proc, IToD, Origin(), argument);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Ceil, Origin(), argumentAsDouble));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), ceil(static_cast<double>(a))));
+}
+
+void testCeilIToD32(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argumentAsDouble = root->appendNew<Value>(proc, IToD, Origin(), argument);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Ceil, Origin(), argumentAsDouble));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), ceil(static_cast<double>(a))));
+}
+
+void testCeilArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Ceil, Origin(), argument);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(ceilf(a))));
+}
+
+void testCeilImm(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Ceil, Origin(), argument);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(ceilf(a))));
+}
+
+void testCeilMem(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadFloat = root->appendNew<MemoryValue>(proc, Load, Float, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Ceil, Origin(), loadFloat);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, &a), bitwise_cast<int32_t>(ceilf(a))));
+}
+
+void testCeilCeilArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* firstCeil = root->appendNew<Value>(proc, Ceil, Origin(), argument);
+    Value* secondCeil = root->appendNew<Value>(proc, Ceil, Origin(), firstCeil);
+    root->appendNewControlValue(proc, Return, Origin(), secondCeil);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), ceilf(a)));
+}
+
+void testFloorCeilArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* firstCeil = root->appendNew<Value>(proc, Ceil, Origin(), argument);
+    Value* wrappingFloor = root->appendNew<Value>(proc, Floor, Origin(), firstCeil);
+    root->appendNewControlValue(proc, Return, Origin(), wrappingFloor);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), ceilf(a)));
+}
+
+void testCeilArgWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Ceil, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(ceilf(a))));
+}
+
+void testCeilArgWithEffectfulDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Ceil, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    Value* doubleAddress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, doubleAddress);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    double effect = 0;
+    int32_t resultValue = compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), &effect);
+    CHECK(isIdentical(resultValue, bitwise_cast<int32_t>(ceilf(a))));
+    CHECK(isIdentical(effect, static_cast<double>(ceilf(a))));
+}
+
+void testFloorArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Floor, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0)));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), floor(a)));
+}
+
+void testFloorImm(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Floor, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), floor(a)));
+}
+
+void testFloorMem(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadDouble = root->appendNew<MemoryValue>(proc, Load, Double, Origin(), address);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Floor, Origin(), loadDouble));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, &a), floor(a)));
+}
+
+void testFloorFloorArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* firstFloor = root->appendNew<Value>(proc, Floor, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0));
+    Value* secondFloor = root->appendNew<Value>(proc, Floor, Origin(), firstFloor);
+    root->appendNewControlValue(proc, Return, Origin(), secondFloor);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), floor(a)));
+}
+
+void testCeilFloorArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* firstFloor = root->appendNew<Value>(proc, Floor, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0));
+    Value* wrappingCeil = root->appendNew<Value>(proc, Ceil, Origin(), firstFloor);
+    root->appendNewControlValue(proc, Return, Origin(), wrappingCeil);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), floor(a)));
+}
+
+void testFloorIToD64(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argumentAsDouble = root->appendNew<Value>(proc, IToD, Origin(), argument);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Floor, Origin(), argumentAsDouble));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), floor(static_cast<double>(a))));
+}
+
+void testFloorIToD32(int64_t a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argumentAsDouble = root->appendNew<Value>(proc, IToD, Origin(), argument);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Floor, Origin(), argumentAsDouble));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), floor(static_cast<double>(a))));
+}
+
+void testFloorArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Floor, Origin(), argument);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(floorf(a))));
+}
+
+void testFloorImm(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Floor, Origin(), argument);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(floorf(a))));
+}
+
+void testFloorMem(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadFloat = root->appendNew<MemoryValue>(proc, Load, Float, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Floor, Origin(), loadFloat);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, &a), bitwise_cast<int32_t>(floorf(a))));
+}
+
+void testFloorFloorArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* firstFloor = root->appendNew<Value>(proc, Floor, Origin(), argument);
+    Value* secondFloor = root->appendNew<Value>(proc, Floor, Origin(), firstFloor);
+    root->appendNewControlValue(proc, Return, Origin(), secondFloor);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), floorf(a)));
+}
+
+void testCeilFloorArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* firstFloor = root->appendNew<Value>(proc, Floor, Origin(), argument);
+    Value* wrappingCeil = root->appendNew<Value>(proc, Ceil, Origin(), firstFloor);
+    root->appendNewControlValue(proc, Return, Origin(), wrappingCeil);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a)), floorf(a)));
+}
+
+void testFloorArgWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Floor, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(floorf(a))));
+}
+
+void testFloorArgWithEffectfulDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Floor, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    Value* doubleAddress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, doubleAddress);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    double effect = 0;
+    int32_t resultValue = compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), &effect);
+    CHECK(isIdentical(resultValue, bitwise_cast<int32_t>(floorf(a))));
+    CHECK(isIdentical(effect, static_cast<double>(floorf(a))));
+}
+
+void testSqrtArg(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sqrt, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0)));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, a), sqrt(a)));
+}
+
+void testSqrtImm(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sqrt, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), sqrt(a)));
+}
+
+void testSqrtMem(double a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadDouble = root->appendNew<MemoryValue>(proc, Load, Double, Origin(), address);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Sqrt, Origin(), loadDouble));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, &a), sqrt(a)));
+}
+
+void testSqrtArg(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* result = root->appendNew<Value>(proc, Sqrt, Origin(), argument);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(static_cast<float>(sqrt(a)))));
+}
+
+void testSqrtImm(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* result = root->appendNew<Value>(proc, Sqrt, Origin(), argument);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(static_cast<float>(sqrt(a)))));
+}
+
+void testSqrtMem(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadFloat = root->appendNew<MemoryValue>(proc, Load, Float, Origin(), address);
+    Value* result = root->appendNew<Value>(proc, Sqrt, Origin(), loadFloat);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), result);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, &a), bitwise_cast<int32_t>(static_cast<float>(sqrt(a)))));
+}
+
+void testSqrtArgWithUselessDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Sqrt, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a)), bitwise_cast<int32_t>(static_cast<float>(sqrt(a)))));
+}
+
+void testSqrtArgWithEffectfulDoubleConversion(float a)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* result = root->appendNew<Value>(proc, Sqrt, Origin(), asDouble);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), result);
+    Value* result32 = root->appendNew<Value>(proc, BitwiseCast, Origin(), floatResult);
+    Value* doubleAddress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), result, doubleAddress);
+    root->appendNewControlValue(proc, Return, Origin(), result32);
+
+    double effect = 0;
+    int32_t resultValue = compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), &effect);
+    CHECK(isIdentical(resultValue, bitwise_cast<int32_t>(static_cast<float>(sqrt(a)))));
+    CHECK(isIdentical(effect, static_cast<double>(sqrt(a))));
+}
+
+void testCompareTwoFloatToDouble(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg1As32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg1Float = root->appendNew<Value>(proc, BitwiseCast, Origin(), arg1As32);
+    Value* arg1AsDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), arg1Float);
+
+    Value* arg2As32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* arg2Float = root->appendNew<Value>(proc, BitwiseCast, Origin(), arg2As32);
+    Value* arg2AsDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), arg2Float);
+    Value* equal = root->appendNew<Value>(proc, Equal, Origin(), arg1AsDouble, arg2AsDouble);
+
+    root->appendNewControlValue(proc, Return, Origin(), equal);
+
+    CHECK(compileAndRun<int64_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)) == (a == b));
+}
+
+void testCompareOneFloatToDouble(float a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg1As32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg1Float = root->appendNew<Value>(proc, BitwiseCast, Origin(), arg1As32);
+    Value* arg1AsDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), arg1Float);
+
+    Value* arg2AsDouble = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* equal = root->appendNew<Value>(proc, Equal, Origin(), arg1AsDouble, arg2AsDouble);
+
+    root->appendNewControlValue(proc, Return, Origin(), equal);
+
+    CHECK(compileAndRun<int64_t>(proc, bitwise_cast<int32_t>(a), b) == (a == b));
+}
+
+void testCompareFloatToDoubleThroughPhi(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* tail = proc.addBlock();
+
+    Value* condition = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+    Value* arg1As32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* arg1Float = root->appendNew<Value>(proc, BitwiseCast, Origin(), arg1As32);
+    Value* arg1AsDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), arg1Float);
+
+    Value* arg2AsDouble = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* arg2AsFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), arg2AsDouble);
+    Value* arg2AsFRoundedDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), arg2AsFloat);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        condition,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    UpsilonValue* thenValue = thenCase->appendNew<UpsilonValue>(proc, Origin(), arg1AsDouble);
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* elseConst = elseCase->appendNew<ConstDoubleValue>(proc, Origin(), 0.);
+    UpsilonValue* elseValue = elseCase->appendNew<UpsilonValue>(proc, Origin(), elseConst);
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* doubleInput = tail->appendNew<Value>(proc, Phi, Double, Origin());
+    thenValue->setPhi(doubleInput);
+    elseValue->setPhi(doubleInput);
+    Value* equal = tail->appendNew<Value>(proc, Equal, Origin(), doubleInput, arg2AsFRoundedDouble);
+    tail->appendNewControlValue(proc, Return, Origin(), equal);
+
+    auto code = compile(proc);
+    int32_t integerA = bitwise_cast<int32_t>(a);
+    double doubleB = b;
+    CHECK(invoke<int64_t>(*code, 1, integerA, doubleB) == (a == b));
+    CHECK(invoke<int64_t>(*code, 0, integerA, doubleB) == (b == 0));
+}
+
+void testDoubleToFloatThroughPhi(float value)
+{
+    // Simple case of:
+    //     if (a) {
+    //         x = DoubleAdd(a, b)
+    //     else
+    //         x = DoubleAdd(a, c)
+    //     DoubleToFloat(x)
+    //
+    // Both Adds can be converted to float add.
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* tail = proc.addBlock();
+
+    Value* condition = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* argAsDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        condition,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    Value* postitiveConst = thenCase->appendNew<ConstDoubleValue>(proc, Origin(), 42.5f);
+    Value* thenAdd = thenCase->appendNew<Value>(proc, Add, Origin(), argAsDouble, postitiveConst);
+    UpsilonValue* thenValue = thenCase->appendNew<UpsilonValue>(proc, Origin(), thenAdd);
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* elseConst = elseCase->appendNew<ConstDoubleValue>(proc, Origin(), M_PI);
+    UpsilonValue* elseValue = elseCase->appendNew<UpsilonValue>(proc, Origin(), elseConst);
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* doubleInput = tail->appendNew<Value>(proc, Phi, Double, Origin());
+    thenValue->setPhi(doubleInput);
+    elseValue->setPhi(doubleInput);
+    Value* floatResult = tail->appendNew<Value>(proc, DoubleToFloat, Origin(), doubleInput);
+    tail->appendNewControlValue(proc, Return, Origin(), floatResult);
+
+    auto code = compile(proc);
+    CHECK(isIdentical(invoke<float>(*code, 1, bitwise_cast<int32_t>(value)), value + 42.5f));
+    CHECK(isIdentical(invoke<float>(*code, 0, bitwise_cast<int32_t>(value)), static_cast<float>(M_PI)));
+}
+
+void testReduceFloatToDoubleValidates()
+{
+    // Simple case of:
+    //     f = DoubleToFloat(Bitcast(argGPR0))
+    //     if (a) {
+    //         x = FloatConst()
+    //     else
+    //         x = FloatConst()
+    //     p = Phi(x)
+    //     a = Mul(p, p)
+    //     b = Add(a, f)
+    //     c = Add(p, b)
+    //     Return(c)
+    //
+    // This should not crash in the validator after ReduceFloatToDouble.
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* tail = proc.addBlock();
+
+    Value* condition = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* thingy = root->appendNew<Value>(proc, BitwiseCast, Origin(), condition);
+    thingy = root->appendNew<Value>(proc, DoubleToFloat, Origin(), thingy); // Make the phase think it has work to do.
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        condition,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    UpsilonValue* thenValue = thenCase->appendNew<UpsilonValue>(proc, Origin(),
+        thenCase->appendNew<ConstFloatValue>(proc, Origin(), 11.5));
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    UpsilonValue* elseValue = elseCase->appendNew<UpsilonValue>(proc, Origin(), 
+        elseCase->appendNew<ConstFloatValue>(proc, Origin(), 10.5));
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* phi =  tail->appendNew<Value>(proc, Phi, Float, Origin());
+    thenValue->setPhi(phi);
+    elseValue->setPhi(phi);
+    Value* result = tail->appendNew<Value>(proc, Mul, Origin(), 
+            phi, phi);
+    result = tail->appendNew<Value>(proc, Add, Origin(), 
+            result,
+            thingy);
+    result = tail->appendNew<Value>(proc, Add, Origin(), 
+            phi,
+            result);
+    tail->appendNewControlValue(proc, Return, Origin(), result);
+
+    auto code = compile(proc);
+    CHECK(isIdentical(invoke<float>(*code, 1), 11.5f * 11.5f + static_cast<float>(bitwise_cast<double>(static_cast<uint64_t>(1))) + 11.5f));
+    CHECK(isIdentical(invoke<float>(*code, 0), 10.5f * 10.5f + static_cast<float>(bitwise_cast<double>(static_cast<uint64_t>(0))) + 10.5f));
+}
+
+void testDoubleProducerPhiToFloatConversion(float value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* tail = proc.addBlock();
+
+    Value* condition = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        condition,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    Value* asDouble = thenCase->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    UpsilonValue* thenValue = thenCase->appendNew<UpsilonValue>(proc, Origin(), asDouble);
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* constDouble = elseCase->appendNew<ConstDoubleValue>(proc, Origin(), 42.5);
+    UpsilonValue* elseValue = elseCase->appendNew<UpsilonValue>(proc, Origin(), constDouble);
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* doubleInput = tail->appendNew<Value>(proc, Phi, Double, Origin());
+    thenValue->setPhi(doubleInput);
+    elseValue->setPhi(doubleInput);
+
+    Value* argAsDoubleAgain = tail->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* finalAdd = tail->appendNew<Value>(proc, Add, Origin(), doubleInput, argAsDoubleAgain);
+    Value* floatResult = tail->appendNew<Value>(proc, DoubleToFloat, Origin(), finalAdd);
+    tail->appendNewControlValue(proc, Return, Origin(), floatResult);
+
+    auto code = compile(proc);
+    CHECK(isIdentical(invoke<float>(*code, 1, bitwise_cast<int32_t>(value)), value + value));
+    CHECK(isIdentical(invoke<float>(*code, 0, bitwise_cast<int32_t>(value)), 42.5f + value));
+}
+
+void testDoubleProducerPhiToFloatConversionWithDoubleConsumer(float value)
+{
+    // In this case, the Upsilon-Phi effectively contains a Float value, but it is used
+    // as a Float and as a Double.
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* tail = proc.addBlock();
+
+    Value* condition = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        condition,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    Value* asDouble = thenCase->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    UpsilonValue* thenValue = thenCase->appendNew<UpsilonValue>(proc, Origin(), asDouble);
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* constDouble = elseCase->appendNew<ConstDoubleValue>(proc, Origin(), 42.5);
+    UpsilonValue* elseValue = elseCase->appendNew<UpsilonValue>(proc, Origin(), constDouble);
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* doubleInput = tail->appendNew<Value>(proc, Phi, Double, Origin());
+    thenValue->setPhi(doubleInput);
+    elseValue->setPhi(doubleInput);
+
+    Value* argAsDoubleAgain = tail->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* floatAdd = tail->appendNew<Value>(proc, Add, Origin(), doubleInput, argAsDoubleAgain);
+
+    // FRound.
+    Value* floatResult = tail->appendNew<Value>(proc, DoubleToFloat, Origin(), floatAdd);
+    Value* doubleResult = tail->appendNew<Value>(proc, FloatToDouble, Origin(), floatResult);
+
+    // This one *cannot* be eliminated
+    Value* doubleAdd = tail->appendNew<Value>(proc, Add, Origin(), doubleInput, doubleResult);
+
+    tail->appendNewControlValue(proc, Return, Origin(), doubleAdd);
+
+    auto code = compile(proc);
+    CHECK(isIdentical(invoke<double>(*code, 1, bitwise_cast<int32_t>(value)), (value + value) + static_cast<double>(value)));
+    CHECK(isIdentical(invoke<double>(*code, 0, bitwise_cast<int32_t>(value)), static_cast<double>((42.5f + value) + 42.5f)));
+}
+
+void testDoubleProducerPhiWithNonFloatConst(float value, double constValue)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* tail = proc.addBlock();
+
+    Value* condition = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        condition,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    Value* asDouble = thenCase->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    UpsilonValue* thenValue = thenCase->appendNew<UpsilonValue>(proc, Origin(), asDouble);
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* constDouble = elseCase->appendNew<ConstDoubleValue>(proc, Origin(), constValue);
+    UpsilonValue* elseValue = elseCase->appendNew<UpsilonValue>(proc, Origin(), constDouble);
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    Value* doubleInput = tail->appendNew<Value>(proc, Phi, Double, Origin());
+    thenValue->setPhi(doubleInput);
+    elseValue->setPhi(doubleInput);
+
+    Value* argAsDoubleAgain = tail->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    Value* finalAdd = tail->appendNew<Value>(proc, Add, Origin(), doubleInput, argAsDoubleAgain);
+    Value* floatResult = tail->appendNew<Value>(proc, DoubleToFloat, Origin(), finalAdd);
+    tail->appendNewControlValue(proc, Return, Origin(), floatResult);
+
+    auto code = compile(proc);
+    CHECK(isIdentical(invoke<float>(*code, 1, bitwise_cast<int32_t>(value)), value + value));
+    CHECK(isIdentical(invoke<float>(*code, 0, bitwise_cast<int32_t>(value)), static_cast<float>(constValue + value)));
+}
+
+void testDoubleArgToInt64BitwiseCast(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitwiseCast, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<int64_t>(proc, value), bitwise_cast<int64_t>(value)));
+}
+
+void testDoubleImmToInt64BitwiseCast(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstDoubleValue>(proc, Origin(), value);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitwiseCast, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<int64_t>(proc), bitwise_cast<int64_t>(value)));
+}
+
+void testTwoBitwiseCastOnDouble(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* first = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument);
+    Value* second = root->appendNew<Value>(proc, BitwiseCast, Origin(), first);
+    root->appendNewControlValue(proc, Return, Origin(), second);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, value), value));
+}
+
+void testBitwiseCastOnDoubleInMemory(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadDouble = root->appendNew<MemoryValue>(proc, Load, Double, Origin(), address);
+    Value* cast = root->appendNew<Value>(proc, BitwiseCast, Origin(), loadDouble);
+    root->appendNewControlValue(proc, Return, Origin(), cast);
+
+    CHECK(isIdentical(compileAndRun<int64_t>(proc, &value), bitwise_cast<int64_t>(value)));
+}
+
+void testBitwiseCastOnDoubleInMemoryIndexed(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* offset = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* scaledOffset = root->appendNew<Value>(proc, Shl, Origin(),
+        offset,
+        root->appendNew<Const32Value>(proc, Origin(), 3));
+    Value* address = root->appendNew<Value>(proc, Add, Origin(), base, scaledOffset);
+    MemoryValue* loadDouble = root->appendNew<MemoryValue>(proc, Load, Double, Origin(), address);
+    Value* cast = root->appendNew<Value>(proc, BitwiseCast, Origin(), loadDouble);
+    root->appendNewControlValue(proc, Return, Origin(), cast);
+
+    CHECK(isIdentical(compileAndRun<int64_t>(proc, &value, 0), bitwise_cast<int64_t>(value)));
+}
+
+void testInt64BArgToDoubleBitwiseCast(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitwiseCast, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, value), bitwise_cast<double>(value)));
+}
+
+void testInt64BImmToDoubleBitwiseCast(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Const64Value>(proc, Origin(), value);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitwiseCast, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), bitwise_cast<double>(value)));
+}
+
+void testTwoBitwiseCastOnInt64(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* first = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument);
+    Value* second = root->appendNew<Value>(proc, BitwiseCast, Origin(), first);
+    root->appendNewControlValue(proc, Return, Origin(), second);
+
+    CHECK(isIdentical(compileAndRun<int64_t>(proc, value), value));
+}
+
+void testBitwiseCastOnInt64InMemory(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadDouble = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* cast = root->appendNew<Value>(proc, BitwiseCast, Origin(), loadDouble);
+    root->appendNewControlValue(proc, Return, Origin(), cast);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, &value), bitwise_cast<double>(value)));
+}
+
+void testBitwiseCastOnInt64InMemoryIndexed(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* offset = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* scaledOffset = root->appendNew<Value>(proc, Shl, Origin(),
+        offset,
+        root->appendNew<Const32Value>(proc, Origin(), 3));
+    Value* address = root->appendNew<Value>(proc, Add, Origin(), base, scaledOffset);
+    MemoryValue* loadDouble = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* cast = root->appendNew<Value>(proc, BitwiseCast, Origin(), loadDouble);
+    root->appendNewControlValue(proc, Return, Origin(), cast);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, &value, 0), bitwise_cast<double>(value)));
+}
+
+void testFloatImmToInt32BitwiseCast(float value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstFloatValue>(proc, Origin(), value);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitwiseCast, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc), bitwise_cast<int32_t>(value)));
+}
+
+void testBitwiseCastOnFloatInMemory(float value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadFloat = root->appendNew<MemoryValue>(proc, Load, Float, Origin(), address);
+    Value* cast = root->appendNew<Value>(proc, BitwiseCast, Origin(), loadFloat);
+    root->appendNewControlValue(proc, Return, Origin(), cast);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, &value), bitwise_cast<int32_t>(value)));
+}
+
+void testInt32BArgToFloatBitwiseCast(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitwiseCast, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<float>(proc, value), bitwise_cast<float>(value)));
+}
+
+void testInt32BImmToFloatBitwiseCast(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<Const64Value>(proc, Origin(), value);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitwiseCast, Origin(), argument));
+
+    CHECK(isIdentical(compileAndRun<float>(proc), bitwise_cast<float>(value)));
+}
+
+void testTwoBitwiseCastOnInt32(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* first = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument);
+    Value* second = root->appendNew<Value>(proc, BitwiseCast, Origin(), first);
+    root->appendNewControlValue(proc, Return, Origin(), second);
+
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, value), value));
+}
+
+void testBitwiseCastOnInt32InMemory(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadFloat = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* cast = root->appendNew<Value>(proc, BitwiseCast, Origin(), loadFloat);
+    root->appendNewControlValue(proc, Return, Origin(), cast);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, &value), bitwise_cast<float>(value)));
+}
+
+void testConvertDoubleToFloatArg(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* asFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), argument);
+    root->appendNewControlValue(proc, Return, Origin(), asFloat);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, value), static_cast<float>(value)));
+}
+
+void testConvertDoubleToFloatImm(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstDoubleValue>(proc, Origin(), value);
+    Value* asFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), argument);
+    root->appendNewControlValue(proc, Return, Origin(), asFloat);
+
+    CHECK(isIdentical(compileAndRun<float>(proc), static_cast<float>(value)));
+}
+
+void testConvertDoubleToFloatMem(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadedDouble = root->appendNew<MemoryValue>(proc, Load, Double, Origin(), address);
+    Value* asFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), loadedDouble);
+    root->appendNewControlValue(proc, Return, Origin(), asFloat);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, &value), static_cast<float>(value)));
+}
+
+void testConvertFloatToDoubleArg(float value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* floatValue = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument32);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue);
+    root->appendNewControlValue(proc, Return, Origin(), asDouble);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, bitwise_cast<int32_t>(value)), static_cast<double>(value)));
+}
+
+void testConvertFloatToDoubleImm(float value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ConstFloatValue>(proc, Origin(), value);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), argument);
+    root->appendNewControlValue(proc, Return, Origin(), asDouble);
+
+    CHECK(isIdentical(compileAndRun<double>(proc), static_cast<double>(value)));
+}
+
+void testConvertFloatToDoubleMem(float value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadedFloat = root->appendNew<MemoryValue>(proc, Load, Float, Origin(), address);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), loadedFloat);
+    root->appendNewControlValue(proc, Return, Origin(), asDouble);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, &value), static_cast<double>(value)));
+}
+
+void testConvertDoubleToFloatToDoubleToFloat(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* asFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), argument);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), asFloat);
+    Value* asFloatAgain = root->appendNew<Value>(proc, DoubleToFloat, Origin(), asDouble);
+    root->appendNewControlValue(proc, Return, Origin(), asFloatAgain);
+
+    CHECK(isIdentical(compileAndRun<float>(proc, value), static_cast<float>(value)));
+}
+
+void testLoadFloatConvertDoubleConvertFloatStoreFloat(float value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* dst = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    MemoryValue* loadedFloat = root->appendNew<MemoryValue>(proc, Load, Float, Origin(), src);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), loadedFloat);
+    Value* asFloatAgain = root->appendNew<Value>(proc, DoubleToFloat, Origin(), asDouble);
+    root->appendNew<MemoryValue>(proc, Store, Origin(), asFloatAgain, dst);
+
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    float input = value;
+    float output = 0.;
+    CHECK(!compileAndRun<int64_t>(proc, &input, &output));
+    CHECK(isIdentical(input, output));
+}
+
+void testFroundArg(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* asFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), argument);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), asFloat);
+    root->appendNewControlValue(proc, Return, Origin(), asDouble);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, value), static_cast<double>(static_cast<float>(value))));
+}
+
+void testFroundMem(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadedDouble = root->appendNew<MemoryValue>(proc, Load, Double, Origin(), address);
+    Value* asFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), loadedDouble);
+    Value* asDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), asFloat);
+    root->appendNewControlValue(proc, Return, Origin(), asDouble);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, &value), static_cast<double>(static_cast<float>(value))));
+}
+
+void testIToD64Arg()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* srcAsDouble = root->appendNew<Value>(proc, IToD, Origin(), src);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsDouble);
+
+    auto code = compile(proc);
+    for (auto testValue : int64Operands())
+        CHECK(isIdentical(invoke<double>(*code, testValue.value), static_cast<double>(testValue.value)));
+}
+
+void testIToF64Arg()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* srcAsFloat = root->appendNew<Value>(proc, IToF, Origin(), src);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsFloat);
+
+    auto code = compile(proc);
+    for (auto testValue : int64Operands())
+        CHECK(isIdentical(invoke<float>(*code, testValue.value), static_cast<float>(testValue.value)));
+}
+
+void testIToD32Arg()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* srcAsDouble = root->appendNew<Value>(proc, IToD, Origin(), src);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsDouble);
+
+    auto code = compile(proc);
+    for (auto testValue : int32Operands())
+        CHECK(isIdentical(invoke<double>(*code, testValue.value), static_cast<double>(testValue.value)));
+}
+
+void testIToF32Arg()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* srcAsFloat = root->appendNew<Value>(proc, IToF, Origin(), src);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsFloat);
+
+    auto code = compile(proc);
+    for (auto testValue : int32Operands())
+        CHECK(isIdentical(invoke<float>(*code, testValue.value), static_cast<float>(testValue.value)));
+}
+
+void testIToD64Mem()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadedSrc = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* srcAsDouble = root->appendNew<Value>(proc, IToD, Origin(), loadedSrc);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsDouble);
+
+    auto code = compile(proc);
+    int64_t inMemoryValue;
+    for (auto testValue : int64Operands()) {
+        inMemoryValue = testValue.value;
+        CHECK(isIdentical(invoke<double>(*code, &inMemoryValue), static_cast<double>(testValue.value)));
+        CHECK(inMemoryValue == testValue.value);
+    }
+}
+
+void testIToF64Mem()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadedSrc = root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), address);
+    Value* srcAsFloat = root->appendNew<Value>(proc, IToF, Origin(), loadedSrc);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsFloat);
+
+    auto code = compile(proc);
+    int64_t inMemoryValue;
+    for (auto testValue : int64Operands()) {
+        inMemoryValue = testValue.value;
+        CHECK(isIdentical(invoke<float>(*code, &inMemoryValue), static_cast<float>(testValue.value)));
+        CHECK(inMemoryValue == testValue.value);
+    }
+}
+
+void testIToD32Mem()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadedSrc = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* srcAsDouble = root->appendNew<Value>(proc, IToD, Origin(), loadedSrc);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsDouble);
+
+    auto code = compile(proc);
+    int32_t inMemoryValue;
+    for (auto testValue : int32Operands()) {
+        inMemoryValue = testValue.value;
+        CHECK(isIdentical(invoke<double>(*code, &inMemoryValue), static_cast<double>(testValue.value)));
+        CHECK(inMemoryValue == testValue.value);
+    }
+}
+
+void testIToF32Mem()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* loadedSrc = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), address);
+    Value* srcAsFloat = root->appendNew<Value>(proc, IToF, Origin(), loadedSrc);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsFloat);
+
+    auto code = compile(proc);
+    int32_t inMemoryValue;
+    for (auto testValue : int32Operands()) {
+        inMemoryValue = testValue.value;
+        CHECK(isIdentical(invoke<float>(*code, &inMemoryValue), static_cast<float>(testValue.value)));
+        CHECK(inMemoryValue == testValue.value);
+    }
+}
+
+void testIToD64Imm(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<Const64Value>(proc, Origin(), value);
+    Value* srcAsFloatingPoint = root->appendNew<Value>(proc, IToD, Origin(), src);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsFloatingPoint);
+    CHECK(isIdentical(compileAndRun<double>(proc), static_cast<double>(value)));
+}
+
+void testIToF64Imm(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<Const64Value>(proc, Origin(), value);
+    Value* srcAsFloatingPoint = root->appendNew<Value>(proc, IToF, Origin(), src);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsFloatingPoint);
+    CHECK(isIdentical(compileAndRun<float>(proc), static_cast<float>(value)));
+}
+
+void testIToD32Imm(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<Const32Value>(proc, Origin(), value);
+    Value* srcAsFloatingPoint = root->appendNew<Value>(proc, IToD, Origin(), src);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsFloatingPoint);
+    CHECK(isIdentical(compileAndRun<double>(proc), static_cast<double>(value)));
+}
+
+void testIToF32Imm(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<Const32Value>(proc, Origin(), value);
+    Value* srcAsFloatingPoint = root->appendNew<Value>(proc, IToF, Origin(), src);
+    root->appendNewControlValue(proc, Return, Origin(), srcAsFloatingPoint);
+    CHECK(isIdentical(compileAndRun<float>(proc), static_cast<float>(value)));
+}
+
+void testIToDReducedToIToF64Arg()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* srcAsDouble = root->appendNew<Value>(proc, IToD, Origin(), src);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), srcAsDouble);
+    root->appendNewControlValue(proc, Return, Origin(), floatResult);
+
+    auto code = compile(proc);
+    for (auto testValue : int64Operands())
+        CHECK(isIdentical(invoke<float>(*code, testValue.value), static_cast<float>(testValue.value)));
+}
+
+void testIToDReducedToIToF32Arg()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* src = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* srcAsDouble = root->appendNew<Value>(proc, IToD, Origin(), src);
+    Value* floatResult = root->appendNew<Value>(proc, DoubleToFloat, Origin(), srcAsDouble);
+    root->appendNewControlValue(proc, Return, Origin(), floatResult);
+
+    auto code = compile(proc);
+    for (auto testValue : int32Operands())
+        CHECK(isIdentical(invoke<float>(*code, testValue.value), static_cast<float>(testValue.value)));
+}
+
+void testStore32(int value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slot = 0xbaadbeef;
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<ConstPtrValue>(proc, Origin(), &slot));
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, value));
+    CHECK(slot == value);
+}
+
+void testStoreConstant(int value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slot = 0xbaadbeef;
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), value),
+        root->appendNew<ConstPtrValue>(proc, Origin(), &slot));
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == value);
+}
+
+void testStoreConstantPtr(intptr_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    intptr_t slot;
+    if (is64Bit())
+        slot = (static_cast<intptr_t>(0xbaadbeef) << 32) + static_cast<intptr_t>(0xbaadbeef);
+    else
+        slot = 0xbaadbeef;
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), value),
+        root->appendNew<ConstPtrValue>(proc, Origin(), &slot));
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == value);
+}
+
+void testStore8Arg()
+{
+    { // Direct addressing.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* value = root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+        Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+
+        root->appendNew<MemoryValue>(proc, Store8, Origin(), value, address);
+        root->appendNewControlValue(proc, Return, Origin(), value);
+
+        int8_t storage = 0;
+        CHECK(compileAndRun<int64_t>(proc, 42, &storage) == 42);
+        CHECK(storage == 42);
+    }
+
+    { // Indexed addressing.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* value = root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+        Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        Value* offset = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+        Value* displacement = root->appendNew<Const64Value>(proc, Origin(), -1);
+
+        Value* baseDisplacement = root->appendNew<Value>(proc, Add, Origin(), displacement, base);
+        Value* address = root->appendNew<Value>(proc, Add, Origin(), baseDisplacement, offset);
+
+        root->appendNew<MemoryValue>(proc, Store8, Origin(), value, address);
+        root->appendNewControlValue(proc, Return, Origin(), value);
+
+        int8_t storage = 0;
+        CHECK(compileAndRun<int64_t>(proc, 42, &storage, 1) == 42);
+        CHECK(storage == 42);
+    }
+}
+
+void testStore8Imm()
+{
+    { // Direct addressing.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* value = root->appendNew<Const32Value>(proc, Origin(), 42);
+        Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+        root->appendNew<MemoryValue>(proc, Store8, Origin(), value, address);
+        root->appendNewControlValue(proc, Return, Origin(), value);
+
+        int8_t storage = 0;
+        CHECK(compileAndRun<int64_t>(proc, &storage) == 42);
+        CHECK(storage == 42);
+    }
+
+    { // Indexed addressing.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* value = root->appendNew<Const32Value>(proc, Origin(), 42);
+        Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        Value* offset = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        Value* displacement = root->appendNew<Const64Value>(proc, Origin(), -1);
+
+        Value* baseDisplacement = root->appendNew<Value>(proc, Add, Origin(), displacement, base);
+        Value* address = root->appendNew<Value>(proc, Add, Origin(), baseDisplacement, offset);
+
+        root->appendNew<MemoryValue>(proc, Store8, Origin(), value, address);
+        root->appendNewControlValue(proc, Return, Origin(), value);
+
+        int8_t storage = 0;
+        CHECK(compileAndRun<int64_t>(proc, &storage, 1) == 42);
+        CHECK(storage == 42);
+    }
+}
+
+void testStorePartial8BitRegisterOnX86()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    // We want to have this in ECX.
+    Value* returnValue = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+    // We want this suck in EDX.
+    Value* whereToStore = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+
+    // The patch point is there to help us force the hand of the compiler.
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+
+    // For the value above to be materialized and give the allocator
+    // a stronger insentive to name those register the way we need.
+    patchpoint->append(ConstrainedValue(returnValue, ValueRep(GPRInfo::regT3)));
+    patchpoint->append(ConstrainedValue(whereToStore, ValueRep(GPRInfo::regT2)));
+
+    // We'll produce EDI.
+    patchpoint->resultConstraint = ValueRep::reg(GPRInfo::regT6);
+
+    // Give the allocator a good reason not to use any other register.
+    RegisterSet clobberSet = RegisterSet::allGPRs();
+    clobberSet.exclude(RegisterSet::stackRegisters());
+    clobberSet.exclude(RegisterSet::reservedHardwareRegisters());
+    clobberSet.clear(GPRInfo::regT3);
+    clobberSet.clear(GPRInfo::regT2);
+    clobberSet.clear(GPRInfo::regT6);
+    patchpoint->clobberLate(clobberSet);
+
+    // Set EDI.
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.xor64(params[0].gpr(), params[0].gpr());
+        });
+
+    // If everything went well, we should have the big number in eax,
+    // patchpoint == EDI and whereToStore = EDX.
+    // Since EDI == 5, and AH = 5 on 8 bit store, this would go wrong
+    // if we use X86 partial registers.
+    root->appendNew<MemoryValue>(proc, Store8, Origin(), patchpoint, whereToStore);
+
+    root->appendNewControlValue(proc, Return, Origin(), returnValue);
+
+    int8_t storage = 0xff;
+    CHECK(compileAndRun<int64_t>(proc, 0x12345678abcdef12, &storage) == 0x12345678abcdef12);
+    CHECK(!storage);
+}
+
+void testStore16Arg()
+{
+    { // Direct addressing.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* value = root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+        Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+
+        root->appendNew<MemoryValue>(proc, Store16, Origin(), value, address);
+        root->appendNewControlValue(proc, Return, Origin(), value);
+
+        int16_t storage = -1;
+        CHECK(compileAndRun<int64_t>(proc, 42, &storage) == 42);
+        CHECK(storage == 42);
+    }
+
+    { // Indexed addressing.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* value = root->appendNew<Value>(proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+        Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        Value* offset = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+        Value* displacement = root->appendNew<Const64Value>(proc, Origin(), -1);
+
+        Value* baseDisplacement = root->appendNew<Value>(proc, Add, Origin(), displacement, base);
+        Value* address = root->appendNew<Value>(proc, Add, Origin(), baseDisplacement, offset);
+
+        root->appendNew<MemoryValue>(proc, Store16, Origin(), value, address);
+        root->appendNewControlValue(proc, Return, Origin(), value);
+
+        int16_t storage = -1;
+        CHECK(compileAndRun<int64_t>(proc, 42, &storage, 1) == 42);
+        CHECK(storage == 42);
+    }
+}
+
+void testStore16Imm()
+{
+    { // Direct addressing.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* value = root->appendNew<Const32Value>(proc, Origin(), 42);
+        Value* address = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+        root->appendNew<MemoryValue>(proc, Store16, Origin(), value, address);
+        root->appendNewControlValue(proc, Return, Origin(), value);
+
+        int16_t storage = -1;
+        CHECK(compileAndRun<int64_t>(proc, &storage) == 42);
+        CHECK(storage == 42);
+    }
+
+    { // Indexed addressing.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* value = root->appendNew<Const32Value>(proc, Origin(), 42);
+        Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        Value* offset = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        Value* displacement = root->appendNew<Const64Value>(proc, Origin(), -1);
+
+        Value* baseDisplacement = root->appendNew<Value>(proc, Add, Origin(), displacement, base);
+        Value* address = root->appendNew<Value>(proc, Add, Origin(), baseDisplacement, offset);
+
+        root->appendNew<MemoryValue>(proc, Store16, Origin(), value, address);
+        root->appendNewControlValue(proc, Return, Origin(), value);
+
+        int16_t storage = -1;
+        CHECK(compileAndRun<int64_t>(proc, &storage, 1) == 42);
+        CHECK(storage == 42);
+    }
+}
+
+void testTrunc(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(compileAndRun<int>(proc, value) == static_cast<int>(value));
+}
+
+void testAdd1(int value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), 1)));
+
+    CHECK(compileAndRun<int>(proc, value) == value + 1);
+}
+
+void testAdd1Ptr(intptr_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 1)));
+
+    CHECK(compileAndRun<intptr_t>(proc, value) == value + 1);
+}
+
+void testNeg32(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), 0),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == -value);
+}
+
+void testNegPtr(intptr_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+    CHECK(compileAndRun<intptr_t>(proc, value) == -value);
+}
+
+void testStoreAddLoad32(int amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slot = 37;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), slotPtr),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoadImm32(int amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slot = 37;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), slotPtr),
+            root->appendNew<Const32Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoad8(int amount, B3::Opcode loadOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int8_t slot = 37;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store8, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, loadOpcode, Origin(), slotPtr),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoadImm8(int amount, B3::Opcode loadOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int8_t slot = 37;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store8, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, loadOpcode, Origin(), slotPtr),
+            root->appendNew<Const32Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoad16(int amount, B3::Opcode loadOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int16_t slot = 37;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store16, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, loadOpcode, Origin(), slotPtr),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoadImm16(int amount, B3::Opcode loadOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int16_t slot = 37;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store16, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, loadOpcode, Origin(), slotPtr),
+            root->appendNew<Const32Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoad64(int amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int64_t slot = 37000000000ll;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), slotPtr),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == 37000000000ll + amount);
+}
+
+void testStoreAddLoadImm64(int64_t amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int64_t slot = 370000000000ll;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), slotPtr),
+            root->appendNew<Const64Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == 370000000000ll + amount);
+}
+
+void testStoreAddLoad32Index(int amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slot = 37;
+    int* ptr = &slot;
+    intptr_t zero = 0;
+    Value* slotPtr = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &ptr)),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &zero)));
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), slotPtr),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoadImm32Index(int amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slot = 37;
+    int* ptr = &slot;
+    intptr_t zero = 0;
+    Value* slotPtr = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &ptr)),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &zero)));
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), slotPtr),
+            root->appendNew<Const32Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoad8Index(int amount, B3::Opcode loadOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int8_t slot = 37;
+    int8_t* ptr = &slot;
+    intptr_t zero = 0;
+    Value* slotPtr = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &ptr)),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &zero)));
+    root->appendNew<MemoryValue>(
+        proc, Store8, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, loadOpcode, Origin(), slotPtr),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoadImm8Index(int amount, B3::Opcode loadOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int8_t slot = 37;
+    int8_t* ptr = &slot;
+    intptr_t zero = 0;
+    Value* slotPtr = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &ptr)),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &zero)));
+    root->appendNew<MemoryValue>(
+        proc, Store8, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, loadOpcode, Origin(), slotPtr),
+            root->appendNew<Const32Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoad16Index(int amount, B3::Opcode loadOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int16_t slot = 37;
+    int16_t* ptr = &slot;
+    intptr_t zero = 0;
+    Value* slotPtr = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &ptr)),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &zero)));
+    root->appendNew<MemoryValue>(
+        proc, Store16, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, loadOpcode, Origin(), slotPtr),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoadImm16Index(int amount, B3::Opcode loadOpcode)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int16_t slot = 37;
+    int16_t* ptr = &slot;
+    intptr_t zero = 0;
+    Value* slotPtr = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &ptr)),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &zero)));
+    root->appendNew<MemoryValue>(
+        proc, Store16, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, loadOpcode, Origin(), slotPtr),
+            root->appendNew<Const32Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddLoad64Index(int amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int64_t slot = 37000000000ll;
+    int64_t* ptr = &slot;
+    intptr_t zero = 0;
+    Value* slotPtr = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &ptr)),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &zero)));
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), slotPtr),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == 37000000000ll + amount);
+}
+
+void testStoreAddLoadImm64Index(int64_t amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int64_t slot = 370000000000ll;
+    int64_t* ptr = &slot;
+    intptr_t zero = 0;
+    Value* slotPtr = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &ptr)),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &zero)));
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int64, Origin(), slotPtr),
+            root->appendNew<Const64Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == 370000000000ll + amount);
+}
+
+void testStoreSubLoad(int amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int32_t startValue = std::numeric_limits<int32_t>::min();
+    int32_t slot = startValue;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), slotPtr),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, amount));
+    CHECK(slot == startValue - amount);
+}
+
+void testStoreAddLoadInterference(int amount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slot = 37;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    ArgumentRegValue* otherSlotPtr =
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    MemoryValue* load = root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), slotPtr);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 666),
+        otherSlotPtr);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            load, root->appendNew<Const32Value>(proc, Origin(), amount)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc, &slot));
+    CHECK(slot == 37 + amount);
+}
+
+void testStoreAddAndLoad(int amount, int mask)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slot = 37;
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Value>(
+                proc, Add, Origin(),
+                root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), slotPtr),
+                root->appendNew<Const32Value>(proc, Origin(), amount)),
+            root->appendNew<Const32Value>(proc, Origin(), mask)),
+        slotPtr);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+    CHECK(slot == ((37 + amount) & mask));
+}
+
+void testStoreNegLoad32(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    int32_t slot = value;
+
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), 0),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), slotPtr)),
+        slotPtr);
+    
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int32_t>(proc));
+    CHECK(slot == -value);
+}
+
+void testStoreNegLoadPtr(intptr_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    intptr_t slot = value;
+
+    ConstPtrValue* slotPtr = root->appendNew<ConstPtrValue>(proc, Origin(), &slot);
+    
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Sub, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 0),
+            root->appendNew<MemoryValue>(proc, Load, pointerType(), Origin(), slotPtr)),
+        slotPtr);
+    
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int32_t>(proc));
+    CHECK(slot == -value);
+}
+
+void testAdd1Uncommuted(int value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), 1),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int>(proc, value) == value + 1);
+}
+
+void testLoadOffset()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int array[] = { 1, 2 };
+    ConstPtrValue* arrayPtr = root->appendNew<ConstPtrValue>(proc, Origin(), array);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), arrayPtr, 0),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), arrayPtr, sizeof(int))));
+
+    CHECK(compileAndRun<int>(proc) == array[0] + array[1]);
+}
+
+void testLoadOffsetNotConstant()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int array[] = { 1, 2 };
+    Value* arrayPtr = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), arrayPtr, 0),
+            root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), arrayPtr, sizeof(int))));
+
+    CHECK(compileAndRun<int>(proc, &array[0]) == array[0] + array[1]);
+}
+
+void testLoadOffsetUsingAdd()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int array[] = { 1, 2 };
+    ConstPtrValue* arrayPtr = root->appendNew<ConstPtrValue>(proc, Origin(), array);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, Load, Int32, Origin(),
+                root->appendNew<Value>(
+                    proc, Add, Origin(), arrayPtr,
+                    root->appendNew<ConstPtrValue>(proc, Origin(), 0))),
+            root->appendNew<MemoryValue>(
+                proc, Load, Int32, Origin(),
+                root->appendNew<Value>(
+                    proc, Add, Origin(), arrayPtr,
+                    root->appendNew<ConstPtrValue>(proc, Origin(), sizeof(int))))));
+    
+    CHECK(compileAndRun<int>(proc) == array[0] + array[1]);
+}
+
+void testLoadOffsetUsingAddInterference()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int array[] = { 1, 2 };
+    ConstPtrValue* arrayPtr = root->appendNew<ConstPtrValue>(proc, Origin(), array);
+    ArgumentRegValue* otherArrayPtr =
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Const32Value* theNumberOfTheBeast = root->appendNew<Const32Value>(proc, Origin(), 666);
+    MemoryValue* left = root->appendNew<MemoryValue>(
+        proc, Load, Int32, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(), arrayPtr,
+            root->appendNew<ConstPtrValue>(proc, Origin(), 0)));
+    MemoryValue* right = root->appendNew<MemoryValue>(
+        proc, Load, Int32, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(), arrayPtr,
+            root->appendNew<ConstPtrValue>(proc, Origin(), sizeof(int))));
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(), theNumberOfTheBeast, otherArrayPtr, 0);
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(), theNumberOfTheBeast, otherArrayPtr, sizeof(int));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(), left, right));
+    
+    CHECK(compileAndRun<int>(proc, &array[0]) == 1 + 2);
+    CHECK(array[0] == 666);
+    CHECK(array[1] == 666);
+}
+
+void testLoadOffsetUsingAddNotConstant()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int array[] = { 1, 2 };
+    Value* arrayPtr = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, Load, Int32, Origin(),
+                root->appendNew<Value>(
+                    proc, Add, Origin(), arrayPtr,
+                    root->appendNew<ConstPtrValue>(proc, Origin(), 0))),
+            root->appendNew<MemoryValue>(
+                proc, Load, Int32, Origin(),
+                root->appendNew<Value>(
+                    proc, Add, Origin(), arrayPtr,
+                    root->appendNew<ConstPtrValue>(proc, Origin(), sizeof(int))))));
+    
+    CHECK(compileAndRun<int>(proc, &array[0]) == array[0] + array[1]);
+}
+
+void testLoadAddrShift(unsigned shift)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int slots[2];
+
+    // Figure out which slot to use while having proper alignment for the shift.
+    int* slot;
+    uintptr_t arg;
+    for (unsigned i = sizeof(slots)/sizeof(slots[0]); i--;) {
+        slot = slots + i;
+        arg = bitwise_cast<uintptr_t>(slot) >> shift;
+        if (bitwise_cast<int*>(arg << shift) == slot)
+            break;
+    }
+
+    *slot = 8675309;
+    
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, Int32, Origin(),
+            root->appendNew<Value>(
+                proc, Shl, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<Const32Value>(proc, Origin(), shift))));
+
+    CHECK(compileAndRun<int>(proc, arg) == 8675309);
+}
+
+void testFramePointer()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, FramePointer, Origin()));
+
+    void* fp = compileAndRun<void*>(proc);
+    CHECK(fp < &proc);
+    CHECK(fp >= bitwise_cast<char*>(&proc) - 10000);
+}
+
+void testOverrideFramePointer()
+{
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        // Add a stack slot to make the frame non trivial.
+        root->appendNew<SlotBaseValue>(proc, Origin(), proc.addStackSlot(8));
+
+        // Sub on x86 UseDef the source. If FP is not protected correctly, it will be overridden since it is the last visible use.
+        Value* offset = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        Value* fp = root->appendNew<Value>(proc, FramePointer, Origin());
+        Value* result = root->appendNew<Value>(proc, Sub, Origin(), fp, offset);
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        CHECK(compileAndRun<int64_t>(proc, 1));
+    }
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        root->appendNew<SlotBaseValue>(proc, Origin(), proc.addStackSlot(8));
+
+        Value* offset = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        Value* fp = root->appendNew<Value>(proc, FramePointer, Origin());
+        Value* offsetFP = root->appendNew<Value>(proc, BitAnd, Origin(), offset, fp);
+        Value* arg = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        Value* offsetArg = root->appendNew<Value>(proc, Add, Origin(), offset, arg);
+        Value* result = root->appendNew<Value>(proc, Add, Origin(), offsetArg, offsetFP);
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        CHECK(compileAndRun<int64_t>(proc, 1, 2));
+    }
+}
+
+void testStackSlot()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<SlotBaseValue>(proc, Origin(), proc.addStackSlot(1)));
+
+    void* stackSlot = compileAndRun<void*>(proc);
+    CHECK(stackSlot < &proc);
+    CHECK(stackSlot >= bitwise_cast<char*>(&proc) - 10000);
+}
+
+void testLoadFromFramePointer()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<Value>(proc, FramePointer, Origin())));
+
+    void* fp = compileAndRun<void*>(proc);
+    void* myFP = __builtin_frame_address(0);
+    CHECK(fp <= myFP);
+    CHECK(fp >= bitwise_cast<char*>(myFP) - 10000);
+}
+
+void testStoreLoadStackSlot(int value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    SlotBaseValue* stack =
+        root->appendNew<SlotBaseValue>(proc, Origin(), proc.addStackSlot(sizeof(int)));
+
+    root->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        stack);
+    
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<MemoryValue>(proc, Load, Int32, Origin(), stack));
+
+    CHECK(compileAndRun<int>(proc, value) == value);
+}
+
+template<typename LoadedType, typename EffectiveType>
+EffectiveType modelLoad(EffectiveType value)
+{
+    union {
+        EffectiveType original;
+        LoadedType loaded;
+    } u;
+
+    u.original = value;
+    if (std::is_signed<LoadedType>::value)
+        return static_cast<EffectiveType>(u.loaded);
+    return static_cast<EffectiveType>(static_cast<typename std::make_unsigned<EffectiveType>::type>(u.loaded));
+}
+
+template<>
+float modelLoad<float, float>(float value) { return value; }
+
+template<>
+double modelLoad<double, double>(double value) { return value; }
+
+template<B3::Type type, typename CType, typename InputType>
+void testLoad(B3::Opcode opcode, InputType value)
+{
+    // Simple load from an absolute address.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, opcode, type, Origin(),
+                root->appendNew<ConstPtrValue>(proc, Origin(), &value)));
+
+        CHECK(isIdentical(compileAndRun<CType>(proc), modelLoad<CType>(value)));
+    }
+    
+    // Simple load from an address in a register.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, opcode, type, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+
+        CHECK(isIdentical(compileAndRun<CType>(proc, &value), modelLoad<CType>(value)));
+    }
+    
+    // Simple load from an address in a register, at an offset.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, opcode, type, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                sizeof(InputType)));
+
+        CHECK(isIdentical(compileAndRun<CType>(proc, &value - 1), modelLoad<CType>(value)));
+    }
+
+    // Load from a simple base-index with various scales.
+    for (unsigned logScale = 0; logScale <= 3; ++logScale) {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, opcode, type, Origin(),
+                root->appendNew<Value>(
+                    proc, Add, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                    root->appendNew<Value>(
+                        proc, Shl, Origin(),
+                        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+                        root->appendNew<Const32Value>(proc, Origin(), logScale)))));
+
+        CHECK(isIdentical(compileAndRun<CType>(proc, &value - 2, (sizeof(InputType) * 2) >> logScale), modelLoad<CType>(value)));
+    }
+
+    // Load from a simple base-index with various scales, but commuted.
+    for (unsigned logScale = 0; logScale <= 3; ++logScale) {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, opcode, type, Origin(),
+                root->appendNew<Value>(
+                    proc, Add, Origin(),
+                    root->appendNew<Value>(
+                        proc, Shl, Origin(),
+                        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+                        root->appendNew<Const32Value>(proc, Origin(), logScale)),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+        CHECK(isIdentical(compileAndRun<CType>(proc, &value - 2, (sizeof(InputType) * 2) >> logScale), modelLoad<CType>(value)));
+    }
+}
+
+template<typename T>
+void testLoad(B3::Opcode opcode, int32_t value)
+{
+    return testLoad<Int32, T>(opcode, value);
+}
+
+template<B3::Type type, typename T>
+void testLoad(T value)
+{
+    return testLoad<type, T>(Load, value);
+}
+
+void testStoreFloat(double input)
+{
+    // Simple store from an address in a register.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+        Value* argumentAsFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), argument);
+
+        Value* destinationAddress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        root->appendNew<MemoryValue>(proc, Store, Origin(), argumentAsFloat, destinationAddress);
+
+        root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+        float output = 0.;
+        CHECK(!compileAndRun<int64_t>(proc, input, &output));
+        CHECK(isIdentical(static_cast<float>(input), output));
+    }
+
+    // Simple indexed store.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+        Value* argumentAsFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), argument);
+
+        Value* destinationBaseAddress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        Value* index = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        Value* scaledIndex = root->appendNew<Value>(
+            proc, Shl, Origin(),
+            index,
+            root->appendNew<Const32Value>(proc, Origin(), 2));
+        Value* destinationAddress = root->appendNew<Value>(proc, Add, Origin(), scaledIndex, destinationBaseAddress);
+
+        root->appendNew<MemoryValue>(proc, Store, Origin(), argumentAsFloat, destinationAddress);
+
+        root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+        float output = 0.;
+        CHECK(!compileAndRun<int64_t>(proc, input, &output - 1, 1));
+        CHECK(isIdentical(static_cast<float>(input), output));
+    }
+}
+
+void testStoreDoubleConstantAsFloat(double input)
+{
+    // Simple store from an address in a register.
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* value = root->appendNew<ConstDoubleValue>(proc, Origin(), input);
+    Value* valueAsFloat = root->appendNew<Value>(proc, DoubleToFloat, Origin(), value);
+
+    Value* destinationAddress = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+    root->appendNew<MemoryValue>(proc, Store, Origin(), valueAsFloat, destinationAddress);
+
+    root->appendNewControlValue(proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    float output = 0.;
+    CHECK(!compileAndRun<int64_t>(proc, input, &output));
+    CHECK(isIdentical(static_cast<float>(input), output));
+}
+
+void testSpillGP()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Vector<Value*> sources;
+    sources.append(root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    sources.append(root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+
+    for (unsigned i = 0; i < 30; ++i) {
+        sources.append(
+            root->appendNew<Value>(proc, Add, Origin(), sources[sources.size() - 1], sources[sources.size() - 2])
+        );
+    }
+
+    Value* total = root->appendNew<Const64Value>(proc, Origin(), 0);
+    for (Value* value : sources)
+        total = root->appendNew<Value>(proc, Add, Origin(), total, value);
+
+    root->appendNewControlValue(proc, Return, Origin(), total);
+    compileAndRun<int>(proc, 1, 2);
+}
+
+void testSpillFP()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Vector<Value*> sources;
+    sources.append(root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0));
+    sources.append(root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1));
+
+    for (unsigned i = 0; i < 30; ++i) {
+        sources.append(
+            root->appendNew<Value>(proc, Add, Origin(), sources[sources.size() - 1], sources[sources.size() - 2])
+        );
+    }
+
+    Value* total = root->appendNew<ConstDoubleValue>(proc, Origin(), 0.);
+    for (Value* value : sources)
+        total = root->appendNew<Value>(proc, Add, Origin(), total, value);
+
+    root->appendNewControlValue(proc, Return, Origin(), total);
+    compileAndRun<double>(proc, 1.1, 2.5);
+}
+
+void testInt32ToDoublePartialRegisterStall()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* loop = proc.addBlock();
+    BasicBlock* done = proc.addBlock();
+
+    // Head.
+    Value* total = root->appendNew<ConstDoubleValue>(proc, Origin(), 0.);
+    Value* counter = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    UpsilonValue* originalTotal = root->appendNew<UpsilonValue>(proc, Origin(), total);
+    UpsilonValue* originalCounter = root->appendNew<UpsilonValue>(proc, Origin(), counter);
+    root->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(loop));
+
+    // Loop.
+    Value* loopCounter = loop->appendNew<Value>(proc, Phi, Int64, Origin());
+    Value* loopTotal = loop->appendNew<Value>(proc, Phi, Double, Origin());
+    originalCounter->setPhi(loopCounter);
+    originalTotal->setPhi(loopTotal);
+
+    Value* truncatedCounter = loop->appendNew<Value>(proc, Trunc, Origin(), loopCounter);
+    Value* doubleCounter = loop->appendNew<Value>(proc, IToD, Origin(), truncatedCounter);
+    Value* updatedTotal = loop->appendNew<Value>(proc, Add, Origin(), doubleCounter, loopTotal);
+    UpsilonValue* updatedTotalUpsilon = loop->appendNew<UpsilonValue>(proc, Origin(), updatedTotal);
+    updatedTotalUpsilon->setPhi(loopTotal);
+
+    Value* decCounter = loop->appendNew<Value>(proc, Sub, Origin(), loopCounter, loop->appendNew<Const64Value>(proc, Origin(), 1));
+    UpsilonValue* decCounterUpsilon = loop->appendNew<UpsilonValue>(proc, Origin(), decCounter);
+    decCounterUpsilon->setPhi(loopCounter);
+    loop->appendNewControlValue(
+        proc, Branch, Origin(),
+        decCounter,
+        FrequentedBlock(loop), FrequentedBlock(done));
+
+    // Tail.
+    done->appendNewControlValue(proc, Return, Origin(), updatedTotal);
+    CHECK(isIdentical(compileAndRun<double>(proc, 100000), 5000050000.));
+}
+
+void testInt32ToDoublePartialRegisterWithoutStall()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* loop = proc.addBlock();
+    BasicBlock* done = proc.addBlock();
+
+    // Head.
+    Value* total = root->appendNew<ConstDoubleValue>(proc, Origin(), 0.);
+    Value* counter = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    UpsilonValue* originalTotal = root->appendNew<UpsilonValue>(proc, Origin(), total);
+    UpsilonValue* originalCounter = root->appendNew<UpsilonValue>(proc, Origin(), counter);
+    uint64_t forPaddingInput;
+    Value* forPaddingInputAddress = root->appendNew<ConstPtrValue>(proc, Origin(), &forPaddingInput);
+    uint64_t forPaddingOutput;
+    Value* forPaddingOutputAddress = root->appendNew<ConstPtrValue>(proc, Origin(), &forPaddingOutput);
+    root->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(loop));
+
+    // Loop.
+    Value* loopCounter = loop->appendNew<Value>(proc, Phi, Int64, Origin());
+    Value* loopTotal = loop->appendNew<Value>(proc, Phi, Double, Origin());
+    originalCounter->setPhi(loopCounter);
+    originalTotal->setPhi(loopTotal);
+
+    Value* truncatedCounter = loop->appendNew<Value>(proc, Trunc, Origin(), loopCounter);
+    Value* doubleCounter = loop->appendNew<Value>(proc, IToD, Origin(), truncatedCounter);
+    Value* updatedTotal = loop->appendNew<Value>(proc, Add, Origin(), doubleCounter, loopTotal);
+
+    // Add enough padding instructions to avoid a stall.
+    Value* loadPadding = loop->appendNew<MemoryValue>(proc, Load, Int64, Origin(), forPaddingInputAddress);
+    Value* padding = loop->appendNew<Value>(proc, BitXor, Origin(), loadPadding, loopCounter);
+    padding = loop->appendNew<Value>(proc, Add, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, BitOr, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, Sub, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, BitXor, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, Add, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, BitOr, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, Sub, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, BitXor, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, Add, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, BitOr, Origin(), padding, loopCounter);
+    padding = loop->appendNew<Value>(proc, Sub, Origin(), padding, loopCounter);
+    loop->appendNew<MemoryValue>(proc, Store, Origin(), padding, forPaddingOutputAddress);
+
+    UpsilonValue* updatedTotalUpsilon = loop->appendNew<UpsilonValue>(proc, Origin(), updatedTotal);
+    updatedTotalUpsilon->setPhi(loopTotal);
+
+    Value* decCounter = loop->appendNew<Value>(proc, Sub, Origin(), loopCounter, loop->appendNew<Const64Value>(proc, Origin(), 1));
+    UpsilonValue* decCounterUpsilon = loop->appendNew<UpsilonValue>(proc, Origin(), decCounter);
+    decCounterUpsilon->setPhi(loopCounter);
+    loop->appendNewControlValue(
+        proc, Branch, Origin(),
+        decCounter,
+        FrequentedBlock(loop), FrequentedBlock(done));
+
+    // Tail.
+    done->appendNewControlValue(proc, Return, Origin(), updatedTotal);
+    CHECK(isIdentical(compileAndRun<double>(proc, 100000), 5000050000.));
+}
+
+void testBranch()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchPtr()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, static_cast<intptr_t>(42)) == 1);
+    CHECK(invoke<int>(*code, static_cast<intptr_t>(0)) == 0);
+}
+
+void testDiamond()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* done = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    UpsilonValue* thenResult = thenCase->appendNew<UpsilonValue>(
+        proc, Origin(), thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(done));
+
+    UpsilonValue* elseResult = elseCase->appendNew<UpsilonValue>(
+        proc, Origin(), elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(done));
+
+    Value* phi = done->appendNew<Value>(proc, Phi, Int32, Origin());
+    thenResult->setPhi(phi);
+    elseResult->setPhi(phi);
+    done->appendNewControlValue(proc, Return, Origin(), phi);
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchNotEqual()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, NotEqual, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), 0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchNotEqualCommute()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, NotEqual, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), 0),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchNotEqualNotEqual()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, NotEqual, Origin(),
+            root->appendNew<Value>(
+                proc, NotEqual, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Const32Value>(proc, Origin(), 0)),
+            root->appendNew<Const32Value>(proc, Origin(), 0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchEqual()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Equal, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            root->appendNew<Const32Value>(proc, Origin(), 0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchEqualEqual()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Equal, Origin(),
+            root->appendNew<Value>(
+                proc, Equal, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Const32Value>(proc, Origin(), 0)),
+            root->appendNew<Const32Value>(proc, Origin(), 0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchEqualCommute()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Equal, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), 0),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchEqualEqual1()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Equal, Origin(),
+            root->appendNew<Value>(
+                proc, Equal, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Const32Value>(proc, Origin(), 0)),
+            root->appendNew<Const32Value>(proc, Origin(), 1)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    auto code = compile(proc);
+    CHECK(invoke<int>(*code, 42) == 1);
+    CHECK(invoke<int>(*code, 0) == 0);
+}
+
+void testBranchEqualOrUnorderedArgs(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argumentA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* argumentB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, EqualOrUnordered, Origin(),
+            argumentA,
+            argumentB),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (std::isunordered(a, b) || a == b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc, a, b) == expected);
+}
+
+void testBranchEqualOrUnorderedArgs(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argumentA = root->appendNew<MemoryValue>(proc, Load, Float, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argumentB = root->appendNew<MemoryValue>(proc, Load, Float, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, EqualOrUnordered, Origin(),
+            argumentA,
+            argumentB),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (std::isunordered(a, b) || a == b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc, &a, &b) == expected);
+}
+
+void testBranchNotEqualAndOrderedArgs(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argumentA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* argumentB = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    Value* equalOrUnordered = root->appendNew<Value>(
+        proc, EqualOrUnordered, Origin(),
+        argumentA,
+        argumentB);
+    Value* notEqualAndOrdered = root->appendNew<Value>(
+        proc, Equal, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0),
+        equalOrUnordered);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        notEqualAndOrdered,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (!std::isunordered(a, b) && a != b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc, a, b) == expected);
+}
+
+void testBranchNotEqualAndOrderedArgs(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argumentA = root->appendNew<MemoryValue>(proc, Load, Float, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argumentB = root->appendNew<MemoryValue>(proc, Load, Float, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* equalOrUnordered = root->appendNew<Value>(
+        proc, EqualOrUnordered, Origin(),
+        argumentA,
+        argumentB);
+    Value* notEqualAndOrdered = root->appendNew<Value>(
+        proc, Equal, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0),
+        equalOrUnordered);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        notEqualAndOrdered,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (!std::isunordered(a, b) && a != b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc, &a, &b) == expected);
+}
+
+void testBranchEqualOrUnorderedDoubleArgImm(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argumentA = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* argumentB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, EqualOrUnordered, Origin(),
+            argumentA,
+            argumentB),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (std::isunordered(a, b) || a == b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc, a) == expected);
+}
+
+void testBranchEqualOrUnorderedFloatArgImm(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argumentA = root->appendNew<MemoryValue>(proc, Load, Float, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argumentB = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, EqualOrUnordered, Origin(),
+            argumentA,
+            argumentB),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (std::isunordered(a, b) || a == b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc, &a) == expected);
+}
+
+void testBranchEqualOrUnorderedDoubleImms(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argumentA = root->appendNew<ConstDoubleValue>(proc, Origin(), a);
+    Value* argumentB = root->appendNew<ConstDoubleValue>(proc, Origin(), b);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, EqualOrUnordered, Origin(),
+            argumentA,
+            argumentB),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (std::isunordered(a, b) || a == b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc) == expected);
+}
+
+void testBranchEqualOrUnorderedFloatImms(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argumentA = root->appendNew<ConstFloatValue>(proc, Origin(), a);
+    Value* argumentB = root->appendNew<ConstFloatValue>(proc, Origin(), b);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, EqualOrUnordered, Origin(),
+            argumentA,
+            argumentB),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (std::isunordered(a, b) || a == b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc) == expected);
+}
+
+void testBranchEqualOrUnorderedFloatWithUselessDoubleConversion(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* argument1 = root->appendNew<MemoryValue>(proc, Load, Float, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2 = root->appendNew<MemoryValue>(proc, Load, Float, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* argument1AsDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), argument1);
+    Value* argument2AsDouble = root->appendNew<Value>(proc, FloatToDouble, Origin(), argument2);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, EqualOrUnordered, Origin(),
+            argument1AsDouble,
+            argument2AsDouble),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 42));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), -13));
+
+    int64_t expected = (std::isunordered(a, b) || a == b) ? 42 : -13;
+    CHECK(compileAndRun<int64_t>(proc, &a, &b) == expected);
+}
+
+void testBranchFold(int value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), value),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(compileAndRun<int>(proc) == !!value);
+}
+
+void testDiamondFold(int value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* done = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), value),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    UpsilonValue* thenResult = thenCase->appendNew<UpsilonValue>(
+        proc, Origin(), thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(done));
+
+    UpsilonValue* elseResult = elseCase->appendNew<UpsilonValue>(
+        proc, Origin(), elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(done));
+
+    Value* phi = done->appendNew<Value>(proc, Phi, Int32, Origin());
+    thenResult->setPhi(phi);
+    elseResult->setPhi(phi);
+    done->appendNewControlValue(proc, Return, Origin(), phi);
+
+    CHECK(compileAndRun<int>(proc) == !!value);
+}
+
+void testBranchNotEqualFoldPtr(intptr_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, NotEqual, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), value),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(compileAndRun<int>(proc) == !!value);
+}
+
+void testBranchEqualFoldPtr(intptr_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Equal, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), value),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(compileAndRun<int>(proc) == !value);
+}
+
+void testBranchLoadPtr()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    intptr_t cond;
+    cond = 42;
+    CHECK(invoke<int>(*code, &cond) == 1);
+    cond = 0;
+    CHECK(invoke<int>(*code, &cond) == 0);
+}
+
+void testBranchLoad32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, Int32, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    int32_t cond;
+    cond = 42;
+    CHECK(invoke<int>(*code, &cond) == 1);
+    cond = 0;
+    CHECK(invoke<int>(*code, &cond) == 0);
+}
+
+void testBranchLoad8S()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load8S, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    int8_t cond;
+    cond = -1;
+    CHECK(invoke<int>(*code, &cond) == 1);
+    cond = 0;
+    CHECK(invoke<int>(*code, &cond) == 0);
+}
+
+void testBranchLoad8Z()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    uint8_t cond;
+    cond = 1;
+    CHECK(invoke<int>(*code, &cond) == 1);
+    cond = 0;
+    CHECK(invoke<int>(*code, &cond) == 0);
+}
+
+void testBranchLoad16S()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load16S, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    int16_t cond;
+    cond = -1;
+    CHECK(invoke<int>(*code, &cond) == 1);
+    cond = 0;
+    CHECK(invoke<int>(*code, &cond) == 0);
+}
+
+void testBranchLoad16Z()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load16Z, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    uint16_t cond;
+    cond = 1;
+    CHECK(invoke<int>(*code, &cond) == 1);
+    cond = 0;
+    CHECK(invoke<int>(*code, &cond) == 0);
+}
+
+void testBranch8WithLoad8ZIndex()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    int logScale = 1;
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Above, Origin(),
+            root->appendNew<MemoryValue>(
+                proc, Load8Z, Origin(),
+                root->appendNew<Value>(
+                    proc, Add, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                    root->appendNew<Value>(
+                        proc, Shl, Origin(),
+                        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+                        root->appendNew<Const32Value>(proc, Origin(), logScale)))),
+            root->appendNew<Const32Value>(proc, Origin(), 250)),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<Const32Value>(proc, Origin(), 1));
+
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    uint32_t cond;
+    cond = 0xffffffffU; // All bytes are 0xff.
+    CHECK(invoke<int>(*code, &cond - 2, (sizeof(uint32_t) * 2) >> logScale) == 1);
+    cond = 0x00000000U; // All bytes are 0.
+    CHECK(invoke<int>(*code, &cond - 2, (sizeof(uint32_t) * 2) >> logScale) == 0);
+}
+
+void testComplex(unsigned numVars, unsigned numConstructs)
+{
+    double before = monotonicallyIncreasingTimeMS();
+    
+    Procedure proc;
+    BasicBlock* current = proc.addBlock();
+
+    Const32Value* one = current->appendNew<Const32Value>(proc, Origin(), 1);
+
+    Vector<int32_t> varSlots;
+    for (unsigned i = numVars; i--;)
+        varSlots.append(i);
+
+    Vector<Value*> vars;
+    for (int32_t& varSlot : varSlots) {
+        Value* varSlotPtr = current->appendNew<ConstPtrValue>(proc, Origin(), &varSlot);
+        vars.append(current->appendNew<MemoryValue>(proc, Load, Int32, Origin(), varSlotPtr));
+    }
+
+    for (unsigned i = 0; i < numConstructs; ++i) {
+        if (i & 1) {
+            // Control flow diamond.
+            unsigned predicateVarIndex = ((i >> 1) + 2) % numVars;
+            unsigned thenIncVarIndex = ((i >> 1) + 0) % numVars;
+            unsigned elseIncVarIndex = ((i >> 1) + 1) % numVars;
+
+            BasicBlock* thenBlock = proc.addBlock();
+            BasicBlock* elseBlock = proc.addBlock();
+            BasicBlock* continuation = proc.addBlock();
+
+            current->appendNewControlValue(
+                proc, Branch, Origin(), vars[predicateVarIndex],
+                FrequentedBlock(thenBlock), FrequentedBlock(elseBlock));
+
+            UpsilonValue* thenThenResult = thenBlock->appendNew<UpsilonValue>(
+                proc, Origin(),
+                thenBlock->appendNew<Value>(proc, Add, Origin(), vars[thenIncVarIndex], one));
+            UpsilonValue* thenElseResult = thenBlock->appendNew<UpsilonValue>(
+                proc, Origin(), vars[elseIncVarIndex]);
+            thenBlock->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(continuation));
+
+            UpsilonValue* elseElseResult = elseBlock->appendNew<UpsilonValue>(
+                proc, Origin(),
+                elseBlock->appendNew<Value>(proc, Add, Origin(), vars[elseIncVarIndex], one));
+            UpsilonValue* elseThenResult = elseBlock->appendNew<UpsilonValue>(
+                proc, Origin(), vars[thenIncVarIndex]);
+            elseBlock->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(continuation));
+
+            Value* thenPhi = continuation->appendNew<Value>(proc, Phi, Int32, Origin());
+            thenThenResult->setPhi(thenPhi);
+            elseThenResult->setPhi(thenPhi);
+            vars[thenIncVarIndex] = thenPhi;
+            
+            Value* elsePhi = continuation->appendNew<Value>(proc, Phi, Int32, Origin());
+            thenElseResult->setPhi(elsePhi);
+            elseElseResult->setPhi(elsePhi);
+            vars[elseIncVarIndex] = thenPhi;
+            
+            current = continuation;
+        } else {
+            // Loop.
+
+            BasicBlock* loopEntry = proc.addBlock();
+            BasicBlock* loopReentry = proc.addBlock();
+            BasicBlock* loopBody = proc.addBlock();
+            BasicBlock* loopExit = proc.addBlock();
+            BasicBlock* loopSkip = proc.addBlock();
+            BasicBlock* continuation = proc.addBlock();
+            
+            Value* startIndex = vars[((i >> 1) + 1) % numVars];
+            Value* startSum = current->appendNew<Const32Value>(proc, Origin(), 0);
+            current->appendNewControlValue(
+                proc, Branch, Origin(), startIndex,
+                FrequentedBlock(loopEntry), FrequentedBlock(loopSkip));
+
+            UpsilonValue* startIndexForBody = loopEntry->appendNew<UpsilonValue>(
+                proc, Origin(), startIndex);
+            UpsilonValue* startSumForBody = loopEntry->appendNew<UpsilonValue>(
+                proc, Origin(), startSum);
+            loopEntry->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(loopBody));
+
+            Value* bodyIndex = loopBody->appendNew<Value>(proc, Phi, Int32, Origin());
+            startIndexForBody->setPhi(bodyIndex);
+            Value* bodySum = loopBody->appendNew<Value>(proc, Phi, Int32, Origin());
+            startSumForBody->setPhi(bodySum);
+            Value* newBodyIndex = loopBody->appendNew<Value>(proc, Sub, Origin(), bodyIndex, one);
+            Value* newBodySum = loopBody->appendNew<Value>(
+                proc, Add, Origin(),
+                bodySum,
+                loopBody->appendNew<MemoryValue>(
+                    proc, Load, Int32, Origin(),
+                    loopBody->appendNew<Value>(
+                        proc, Add, Origin(),
+                        loopBody->appendNew<ConstPtrValue>(proc, Origin(), varSlots.data()),
+                        loopBody->appendNew<Value>(
+                            proc, Shl, Origin(),
+                            loopBody->appendNew<Value>(
+                                proc, ZExt32, Origin(),
+                                loopBody->appendNew<Value>(
+                                    proc, BitAnd, Origin(),
+                                    newBodyIndex,
+                                    loopBody->appendNew<Const32Value>(
+                                        proc, Origin(), numVars - 1))),
+                            loopBody->appendNew<Const32Value>(proc, Origin(), 2)))));
+            loopBody->appendNewControlValue(
+                proc, Branch, Origin(), newBodyIndex,
+                FrequentedBlock(loopReentry), FrequentedBlock(loopExit));
+
+            loopReentry->appendNew<UpsilonValue>(proc, Origin(), newBodyIndex, bodyIndex);
+            loopReentry->appendNew<UpsilonValue>(proc, Origin(), newBodySum, bodySum);
+            loopReentry->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(loopBody));
+
+            UpsilonValue* exitSum = loopExit->appendNew<UpsilonValue>(proc, Origin(), newBodySum);
+            loopExit->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(continuation));
+
+            UpsilonValue* skipSum = loopSkip->appendNew<UpsilonValue>(proc, Origin(), startSum);
+            loopSkip->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(continuation));
+
+            Value* finalSum = continuation->appendNew<Value>(proc, Phi, Int32, Origin());
+            exitSum->setPhi(finalSum);
+            skipSum->setPhi(finalSum);
+
+            current = continuation;
+            vars[((i >> 1) + 0) % numVars] = finalSum;
+        }
+    }
+
+    current->appendNewControlValue(proc, Return, Origin(), vars[0]);
+
+    compile(proc);
+
+    double after = monotonicallyIncreasingTimeMS();
+    dataLog(toCString("    That took ", after - before, " ms.\n"));
+}
+
+void testSimplePatchpoint()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+    patchpoint->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isGPR());
+            add32(jit, params[1].gpr(), params[2].gpr(), params[0].gpr());
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testSimplePatchpointWithoutOuputClobbersGPArgs()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* const1 = root->appendNew<Const64Value>(proc, Origin(), 42);
+    Value* const2 = root->appendNew<Const64Value>(proc, Origin(), 13);
+
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    patchpoint->clobberLate(RegisterSet(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1));
+    patchpoint->append(ConstrainedValue(const1, ValueRep::SomeRegister));
+    patchpoint->append(ConstrainedValue(const2, ValueRep::SomeRegister));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.move(CCallHelpers::TrustedImm32(0x00ff00ff), params[0].gpr());
+            jit.move(CCallHelpers::TrustedImm32(0x00ff00ff), params[1].gpr());
+            jit.move(CCallHelpers::TrustedImm32(0x00ff00ff), GPRInfo::argumentGPR0);
+            jit.move(CCallHelpers::TrustedImm32(0x00ff00ff), GPRInfo::argumentGPR1);
+        });
+
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), arg1, arg2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testSimplePatchpointWithOuputClobbersGPArgs()
+{
+    // We can't predict where the output will be but we want to be sure it is not
+    // one of the clobbered registers which is a bit hard to test.
+    //
+    // What we do is force the hand of our register allocator by clobbering absolutely
+    // everything but 1. The only valid allocation is to give it to the result and
+    // spill everything else.
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* const1 = root->appendNew<Const64Value>(proc, Origin(), 42);
+    Value* const2 = root->appendNew<Const64Value>(proc, Origin(), 13);
+
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int64, Origin());
+
+    RegisterSet clobberAll = RegisterSet::allGPRs();
+    clobberAll.exclude(RegisterSet::stackRegisters());
+    clobberAll.exclude(RegisterSet::reservedHardwareRegisters());
+    clobberAll.clear(GPRInfo::argumentGPR2);
+    patchpoint->clobberLate(clobberAll);
+
+    patchpoint->append(ConstrainedValue(const1, ValueRep::SomeRegister));
+    patchpoint->append(ConstrainedValue(const2, ValueRep::SomeRegister));
+
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isGPR());
+            jit.move(params[1].gpr(), params[0].gpr());
+            jit.add64(params[2].gpr(), params[0].gpr());
+
+            clobberAll.forEach([&] (Reg reg) {
+                jit.move(CCallHelpers::TrustedImm32(0x00ff00ff), reg.gpr());
+            });
+        });
+
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), patchpoint,
+        root->appendNew<Value>(proc, Add, Origin(), arg1, arg2));
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 58);
+}
+
+void testSimplePatchpointWithoutOuputClobbersFPArgs()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    Value* const1 = root->appendNew<ConstDoubleValue>(proc, Origin(), 42.5);
+    Value* const2 = root->appendNew<ConstDoubleValue>(proc, Origin(), 13.1);
+
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    patchpoint->clobberLate(RegisterSet(FPRInfo::argumentFPR0, FPRInfo::argumentFPR1));
+    patchpoint->append(ConstrainedValue(const1, ValueRep::SomeRegister));
+    patchpoint->append(ConstrainedValue(const2, ValueRep::SomeRegister));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isFPR());
+            CHECK(params[1].isFPR());
+            jit.moveZeroToDouble(params[0].fpr());
+            jit.moveZeroToDouble(params[1].fpr());
+            jit.moveZeroToDouble(FPRInfo::argumentFPR0);
+            jit.moveZeroToDouble(FPRInfo::argumentFPR1);
+        });
+
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), arg1, arg2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<double>(proc, 1.5, 2.5) == 4);
+}
+
+void testSimplePatchpointWithOuputClobbersFPArgs()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+    Value* const1 = root->appendNew<ConstDoubleValue>(proc, Origin(), 42.5);
+    Value* const2 = root->appendNew<ConstDoubleValue>(proc, Origin(), 13.1);
+
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Double, Origin());
+
+    RegisterSet clobberAll = RegisterSet::allFPRs();
+    clobberAll.exclude(RegisterSet::stackRegisters());
+    clobberAll.exclude(RegisterSet::reservedHardwareRegisters());
+    clobberAll.clear(FPRInfo::argumentFPR2);
+    patchpoint->clobberLate(clobberAll);
+
+    patchpoint->append(ConstrainedValue(const1, ValueRep::SomeRegister));
+    patchpoint->append(ConstrainedValue(const2, ValueRep::SomeRegister));
+
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0].isFPR());
+            CHECK(params[1].isFPR());
+            CHECK(params[2].isFPR());
+            jit.addDouble(params[1].fpr(), params[2].fpr(), params[0].fpr());
+
+            clobberAll.forEach([&] (Reg reg) {
+                jit.moveZeroToDouble(reg.fpr());
+            });
+        });
+
+    Value* result = root->appendNew<Value>(proc, Add, Origin(), patchpoint,
+        root->appendNew<Value>(proc, Add, Origin(), arg1, arg2));
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<double>(proc, 1.5, 2.5) == 59.6);
+}
+
+void testPatchpointWithEarlyClobber()
+{
+    auto test = [] (GPRReg registerToClobber, bool arg1InArgGPR, bool arg2InArgGPR) {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        
+        PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+        patchpoint->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+        patchpoint->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+        patchpoint->clobberEarly(RegisterSet(registerToClobber));
+        patchpoint->setGenerator(
+            [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                CHECK((params[1].gpr() == GPRInfo::argumentGPR0) == arg1InArgGPR);
+                CHECK((params[2].gpr() == GPRInfo::argumentGPR1) == arg2InArgGPR);
+                
+                add32(jit, params[1].gpr(), params[2].gpr(), params[0].gpr());
+            });
+
+        root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+        CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+    };
+
+    test(GPRInfo::nonArgGPR0, true, true);
+    test(GPRInfo::argumentGPR0, false, true);
+    test(GPRInfo::argumentGPR1, true, false);
+}
+
+void testPatchpointCallArg()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(ConstrainedValue(arg1, ValueRep::stackArgument(0)));
+    patchpoint->append(ConstrainedValue(arg2, ValueRep::stackArgument(8)));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isStack());
+            CHECK(params[2].isStack());
+            jit.load32(
+                CCallHelpers::Address(GPRInfo::callFrameRegister, params[1].offsetFromFP()),
+                params[0].gpr());
+            jit.add32(
+                CCallHelpers::Address(GPRInfo::callFrameRegister, params[2].offsetFromFP()),
+                params[0].gpr());
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testPatchpointFixedRegister()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(ConstrainedValue(arg1, ValueRep(GPRInfo::regT0)));
+    patchpoint->append(ConstrainedValue(arg2, ValueRep(GPRInfo::regT1)));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0].isGPR());
+            CHECK(params[1] == ValueRep(GPRInfo::regT0));
+            CHECK(params[2] == ValueRep(GPRInfo::regT1));
+            add32(jit, GPRInfo::regT0, GPRInfo::regT1, params[0].gpr());
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testPatchpointAny(ValueRep rep)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(ConstrainedValue(arg1, rep));
+    patchpoint->append(ConstrainedValue(arg2, rep));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            // We shouldn't have spilled the inputs, so we assert that they're in registers.
+            CHECK(params.size() == 3);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isGPR());
+            add32(jit, params[1].gpr(), params[2].gpr(), params[0].gpr());
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testPatchpointGPScratch()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(arg1, ValueRep::SomeRegister);
+    patchpoint->append(arg2, ValueRep::SomeRegister);
+    patchpoint->numGPScratchRegisters = 2;
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            // We shouldn't have spilled the inputs, so we assert that they're in registers.
+            CHECK(params.size() == 3);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isGPR());
+            CHECK(params.gpScratch(0) != InvalidGPRReg);
+            CHECK(params.gpScratch(0) != params[0].gpr());
+            CHECK(params.gpScratch(0) != params[1].gpr());
+            CHECK(params.gpScratch(0) != params[2].gpr());
+            CHECK(params.gpScratch(1) != InvalidGPRReg);
+            CHECK(params.gpScratch(1) != params.gpScratch(0));
+            CHECK(params.gpScratch(1) != params[0].gpr());
+            CHECK(params.gpScratch(1) != params[1].gpr());
+            CHECK(params.gpScratch(1) != params[2].gpr());
+            CHECK(!params.unavailableRegisters().get(params.gpScratch(0)));
+            CHECK(!params.unavailableRegisters().get(params.gpScratch(1)));
+            add32(jit, params[1].gpr(), params[2].gpr(), params[0].gpr());
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testPatchpointFPScratch()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(arg1, ValueRep::SomeRegister);
+    patchpoint->append(arg2, ValueRep::SomeRegister);
+    patchpoint->numFPScratchRegisters = 2;
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            // We shouldn't have spilled the inputs, so we assert that they're in registers.
+            CHECK(params.size() == 3);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isGPR());
+            CHECK(params.fpScratch(0) != InvalidFPRReg);
+            CHECK(params.fpScratch(1) != InvalidFPRReg);
+            CHECK(params.fpScratch(1) != params.fpScratch(0));
+            CHECK(!params.unavailableRegisters().get(params.fpScratch(0)));
+            CHECK(!params.unavailableRegisters().get(params.fpScratch(1)));
+            add32(jit, params[1].gpr(), params[2].gpr(), params[0].gpr());
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testPatchpointLotsOfLateAnys()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Vector<int> things;
+    for (unsigned i = 200; i--;)
+        things.append(i);
+
+    Vector<Value*> values;
+    for (int& thing : things) {
+        Value* value = root->appendNew<MemoryValue>(
+            proc, Load, Int32, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), &thing));
+        values.append(value);
+    }
+
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
+    for (Value* value : values)
+        patchpoint->append(ConstrainedValue(value, ValueRep::LateColdAny));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            // We shouldn't have spilled the inputs, so we assert that they're in registers.
+            CHECK(params.size() == things.size() + 1);
+            CHECK(params[0].isGPR());
+            jit.move(CCallHelpers::TrustedImm32(0), params[0].gpr());
+            for (unsigned i = 1; i < params.size(); ++i) {
+                if (params[i].isGPR()) {
+                    CHECK(params[i] != params[0]);
+                    jit.add32(params[i].gpr(), params[0].gpr());
+                } else {
+                    CHECK(params[i].isStack());
+                    jit.add32(CCallHelpers::Address(GPRInfo::callFrameRegister, params[i].offsetFromFP()), params[0].gpr());
+                }
+            }
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc) == (things.size() * (things.size() - 1)) / 2);
+}
+
+void testPatchpointAnyImm(ValueRep rep)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), 42);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(ConstrainedValue(arg1, rep));
+    patchpoint->append(ConstrainedValue(arg2, rep));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isConstant());
+            CHECK(params[2].value() == 42);
+            jit.add32(
+                CCallHelpers::TrustedImm32(static_cast<int32_t>(params[2].value())),
+                params[1].gpr(), params[0].gpr());
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1) == 43);
+}
+
+void testPatchpointManyImms()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const32Value>(proc, Origin(), 42);
+    Value* arg2 = root->appendNew<Const64Value>(proc, Origin(), 43);
+    Value* arg3 = root->appendNew<Const64Value>(proc, Origin(), 43000000000000ll);
+    Value* arg4 = root->appendNew<ConstDoubleValue>(proc, Origin(), 42.5);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    patchpoint->append(ConstrainedValue(arg1, ValueRep::WarmAny));
+    patchpoint->append(ConstrainedValue(arg2, ValueRep::WarmAny));
+    patchpoint->append(ConstrainedValue(arg3, ValueRep::WarmAny));
+    patchpoint->append(ConstrainedValue(arg4, ValueRep::WarmAny));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers&, const StackmapGenerationParams& params) {
+            CHECK(params.size() == 4);
+            CHECK(params[0] == ValueRep::constant(42));
+            CHECK(params[1] == ValueRep::constant(43));
+            CHECK(params[2] == ValueRep::constant(43000000000000ll));
+            CHECK(params[3] == ValueRep::constant(bitwise_cast<int64_t>(42.5)));
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    CHECK(!compileAndRun<int>(proc));
+}
+
+void testPatchpointWithRegisterResult()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+    patchpoint->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    patchpoint->resultConstraint = ValueRep::reg(GPRInfo::nonArgGPR0);
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0] == ValueRep::reg(GPRInfo::nonArgGPR0));
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isGPR());
+            add32(jit, params[1].gpr(), params[2].gpr(), GPRInfo::nonArgGPR0);
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testPatchpointWithStackArgumentResult()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+    patchpoint->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    patchpoint->resultConstraint = ValueRep::stackArgument(0);
+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0] == ValueRep::stack(-static_cast<intptr_t>(proc.frameSize())));
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isGPR());
+            jit.add32(params[1].gpr(), params[2].gpr(), jit.scratchRegister());
+            jit.store32(jit.scratchRegister(), CCallHelpers::Address(CCallHelpers::stackPointerRegister, 0));
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<int>(proc, 1, 2) == 3);
+}
+
+void testPatchpointWithAnyResult()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Double, Origin());
+    patchpoint->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+    patchpoint->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    patchpoint->resultConstraint = ValueRep::WarmAny;
+    patchpoint->clobberLate(RegisterSet::allFPRs());
+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
+    patchpoint->clobber(RegisterSet(GPRInfo::regT0));
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 3);
+            CHECK(params[0].isStack());
+            CHECK(params[1].isGPR());
+            CHECK(params[2].isGPR());
+            add32(jit, params[1].gpr(), params[2].gpr(), GPRInfo::regT0);
+            jit.convertInt32ToDouble(GPRInfo::regT0, FPRInfo::fpRegT0);
+            jit.storeDouble(FPRInfo::fpRegT0, CCallHelpers::Address(GPRInfo::callFrameRegister, params[0].offsetFromFP()));
+        });
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    CHECK(compileAndRun<double>(proc, 1, 2) == 3);
+}
+
+void testSimpleCheck()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    CheckValue* check = root->appendNew<CheckValue>(proc, Check, Origin(), arg);
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    
+    CHECK(invoke<int>(*code, 0) == 0);
+    CHECK(invoke<int>(*code, 1) == 42);
+}
+
+void testCheckFalse()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    CheckValue* check = root->appendNew<CheckValue>(
+        proc, Check, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+    check->setGenerator(
+        [&] (CCallHelpers&, const StackmapGenerationParams&) {
+            CHECK(!"This should not have executed");
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    
+    CHECK(invoke<int>(*code) == 0);
+}
+
+void testCheckTrue()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    CheckValue* check = root->appendNew<CheckValue>(
+        proc, Check, Origin(), root->appendNew<Const32Value>(proc, Origin(), 1));
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.value()->opcode() == Patchpoint);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    
+    CHECK(invoke<int>(*code) == 42);
+}
+
+void testCheckLessThan()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    CheckValue* check = root->appendNew<CheckValue>(
+        proc, Check, Origin(),
+        root->appendNew<Value>(
+            proc, LessThan, Origin(), arg,
+            root->appendNew<Const32Value>(proc, Origin(), 42)));
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    
+    CHECK(invoke<int>(*code, 42) == 0);
+    CHECK(invoke<int>(*code, 1000) == 0);
+    CHECK(invoke<int>(*code, 41) == 42);
+    CHECK(invoke<int>(*code, 0) == 42);
+    CHECK(invoke<int>(*code, -1) == 42);
+}
+
+void testCheckMegaCombo()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* index = root->appendNew<Value>(
+        proc, ZExt32, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    Value* ptr = root->appendNew<Value>(
+        proc, Add, Origin(), base,
+        root->appendNew<Value>(
+            proc, Shl, Origin(), index,
+            root->appendNew<Const32Value>(proc, Origin(), 1)));
+    
+    CheckValue* check = root->appendNew<CheckValue>(
+        proc, Check, Origin(),
+        root->appendNew<Value>(
+            proc, LessThan, Origin(),
+            root->appendNew<MemoryValue>(proc, Load8S, Origin(), ptr),
+            root->appendNew<Const32Value>(proc, Origin(), 42)));
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+
+    int8_t value;
+    value = 42;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 0);
+    value = 127;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 0);
+    value = 41;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 42);
+    value = 0;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 42);
+    value = -1;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 42);
+}
+
+void testCheckTrickyMegaCombo()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* index = root->appendNew<Value>(
+        proc, ZExt32, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)),
+            root->appendNew<Const32Value>(proc, Origin(), 1)));
+
+    Value* ptr = root->appendNew<Value>(
+        proc, Add, Origin(), base,
+        root->appendNew<Value>(
+            proc, Shl, Origin(), index,
+            root->appendNew<Const32Value>(proc, Origin(), 1)));
+    
+    CheckValue* check = root->appendNew<CheckValue>(
+        proc, Check, Origin(),
+        root->appendNew<Value>(
+            proc, LessThan, Origin(),
+            root->appendNew<MemoryValue>(proc, Load8S, Origin(), ptr),
+            root->appendNew<Const32Value>(proc, Origin(), 42)));
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+
+    int8_t value;
+    value = 42;
+    CHECK(invoke<int>(*code, &value - 2, 0) == 0);
+    value = 127;
+    CHECK(invoke<int>(*code, &value - 2, 0) == 0);
+    value = 41;
+    CHECK(invoke<int>(*code, &value - 2, 0) == 42);
+    value = 0;
+    CHECK(invoke<int>(*code, &value - 2, 0) == 42);
+    value = -1;
+    CHECK(invoke<int>(*code, &value - 2, 0) == 42);
+}
+
+void testCheckTwoMegaCombos()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* index = root->appendNew<Value>(
+        proc, ZExt32, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    Value* ptr = root->appendNew<Value>(
+        proc, Add, Origin(), base,
+        root->appendNew<Value>(
+            proc, Shl, Origin(), index,
+            root->appendNew<Const32Value>(proc, Origin(), 1)));
+
+    Value* predicate = root->appendNew<Value>(
+        proc, LessThan, Origin(),
+        root->appendNew<MemoryValue>(proc, Load8S, Origin(), ptr),
+        root->appendNew<Const32Value>(proc, Origin(), 42));
+    
+    CheckValue* check = root->appendNew<CheckValue>(proc, Check, Origin(), predicate);
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    CheckValue* check2 = root->appendNew<CheckValue>(proc, Check, Origin(), predicate);
+    check2->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(43), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+
+    int8_t value;
+    value = 42;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 0);
+    value = 127;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 0);
+    value = 41;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 42);
+    value = 0;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 42);
+    value = -1;
+    CHECK(invoke<int>(*code, &value - 2, 1) == 42);
+}
+
+void testCheckTwoNonRedundantMegaCombos()
+{
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    
+    Value* base = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* index = root->appendNew<Value>(
+        proc, ZExt32, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+    Value* branchPredicate = root->appendNew<Value>(
+        proc, BitAnd, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)),
+        root->appendNew<Const32Value>(proc, Origin(), 0xff));
+
+    Value* ptr = root->appendNew<Value>(
+        proc, Add, Origin(), base,
+        root->appendNew<Value>(
+            proc, Shl, Origin(), index,
+            root->appendNew<Const32Value>(proc, Origin(), 1)));
+
+    Value* checkPredicate = root->appendNew<Value>(
+        proc, LessThan, Origin(),
+        root->appendNew<MemoryValue>(proc, Load8S, Origin(), ptr),
+        root->appendNew<Const32Value>(proc, Origin(), 42));
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(), branchPredicate,
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+    
+    CheckValue* check = thenCase->appendNew<CheckValue>(proc, Check, Origin(), checkPredicate);
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(), thenCase->appendNew<Const32Value>(proc, Origin(), 43));
+
+    CheckValue* check2 = elseCase->appendNew<CheckValue>(proc, Check, Origin(), checkPredicate);
+    check2->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(!params.size());
+
+            // This should always work because a function this simple should never have callee
+            // saves.
+            jit.move(CCallHelpers::TrustedImm32(44), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(), elseCase->appendNew<Const32Value>(proc, Origin(), 45));
+
+    auto code = compile(proc);
+
+    int8_t value;
+
+    value = 42;
+    CHECK(invoke<int>(*code, &value - 2, 1, true) == 43);
+    value = 127;
+    CHECK(invoke<int>(*code, &value - 2, 1, true) == 43);
+    value = 41;
+    CHECK(invoke<int>(*code, &value - 2, 1, true) == 42);
+    value = 0;
+    CHECK(invoke<int>(*code, &value - 2, 1, true) == 42);
+    value = -1;
+    CHECK(invoke<int>(*code, &value - 2, 1, true) == 42);
+
+    value = 42;
+    CHECK(invoke<int>(*code, &value - 2, 1, false) == 45);
+    value = 127;
+    CHECK(invoke<int>(*code, &value - 2, 1, false) == 45);
+    value = 41;
+    CHECK(invoke<int>(*code, &value - 2, 1, false) == 44);
+    value = 0;
+    CHECK(invoke<int>(*code, &value - 2, 1, false) == 44);
+    value = -1;
+    CHECK(invoke<int>(*code, &value - 2, 1, false) == 44);
+}
+
+void testCheckAddImm()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), 42);
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg1, arg2);
+    checkAdd->append(arg1);
+    checkAdd->append(arg2);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == 42);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(42), FPRInfo::fpRegT1);
+            jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkAdd));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0) == 42.0);
+    CHECK(invoke<double>(*code, 1) == 43.0);
+    CHECK(invoke<double>(*code, 42) == 84.0);
+    CHECK(invoke<double>(*code, 2147483647) == 2147483689.0);
+}
+
+void testCheckAddImmCommute()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), 42);
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg2, arg1);
+    checkAdd->append(arg1);
+    checkAdd->append(arg2);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == 42);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(42), FPRInfo::fpRegT1);
+            jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkAdd));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0) == 42.0);
+    CHECK(invoke<double>(*code, 1) == 43.0);
+    CHECK(invoke<double>(*code, 42) == 84.0);
+    CHECK(invoke<double>(*code, 2147483647) == 2147483689.0);
+}
+
+void testCheckAddImmSomeRegister()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), 42);
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg1, arg2);
+    checkAdd->appendSomeRegister(arg1);
+    checkAdd->appendSomeRegister(arg2);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkAdd));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0) == 42.0);
+    CHECK(invoke<double>(*code, 1) == 43.0);
+    CHECK(invoke<double>(*code, 42) == 84.0);
+    CHECK(invoke<double>(*code, 2147483647) == 2147483689.0);
+}
+
+void testCheckAdd()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg1, arg2);
+    checkAdd->appendSomeRegister(arg1);
+    checkAdd->appendSomeRegister(arg2);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkAdd));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0, 42) == 42.0);
+    CHECK(invoke<double>(*code, 1, 42) == 43.0);
+    CHECK(invoke<double>(*code, 42, 42) == 84.0);
+    CHECK(invoke<double>(*code, 2147483647, 42) == 2147483689.0);
+}
+
+void testCheckAdd64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg1, arg2);
+    checkAdd->appendSomeRegister(arg1);
+    checkAdd->appendSomeRegister(arg2);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt64ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.addDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkAdd));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0ll, 42ll) == 42.0);
+    CHECK(invoke<double>(*code, 1ll, 42ll) == 43.0);
+    CHECK(invoke<double>(*code, 42ll, 42ll) == 84.0);
+    CHECK(invoke<double>(*code, 9223372036854775807ll, 42ll) == static_cast<double>(9223372036854775807ll) + 42.0);
+}
+
+void testCheckAddFold(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const32Value>(proc, Origin(), a);
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), b);
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg1, arg2);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers&, const StackmapGenerationParams&) {
+            CHECK(!"Should have been folded");
+        });
+    root->appendNewControlValue(proc, Return, Origin(), checkAdd);
+
+    auto code = compile(proc);
+
+    CHECK(invoke<int>(*code) == a + b);
+}
+
+void testCheckAddFoldFail(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const32Value>(proc, Origin(), a);
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), b);
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg1, arg2);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(proc, Return, Origin(), checkAdd);
+
+    auto code = compile(proc);
+
+    CHECK(invoke<int>(*code) == 42);
+}
+
+void testCheckAddArgumentAliasing64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* arg3 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+
+    // Pretend to use all the args.
+    PatchpointValue* useArgs = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    useArgs->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+    useArgs->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    useArgs->append(ConstrainedValue(arg3, ValueRep::SomeRegister));
+    useArgs->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    // Last use of first arg (here, arg1).
+    CheckValue* checkAdd1 = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg1, arg2);
+    checkAdd1->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    // Last use of second arg (here, arg2).
+    CheckValue* checkAdd2 = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg3, arg2);
+    checkAdd2->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    // Keep arg3 live.
+    PatchpointValue* keepArg2Live = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    keepArg2Live->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    keepArg2Live->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    // Only use of checkAdd1 and checkAdd2.
+    CheckValue* checkAdd3 = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), checkAdd1, checkAdd2);
+    checkAdd3->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    root->appendNewControlValue(proc, Return, Origin(), checkAdd3);
+
+    CHECK(compileAndRun<int64_t>(proc, 1, 2, 3) == 8);
+}
+
+void testCheckAddArgumentAliasing32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* arg3 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2));
+
+    // Pretend to use all the args.
+    PatchpointValue* useArgs = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    useArgs->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+    useArgs->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    useArgs->append(ConstrainedValue(arg3, ValueRep::SomeRegister));
+    useArgs->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    // Last use of first arg (here, arg1).
+    CheckValue* checkAdd1 = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg1, arg2);
+    checkAdd1->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    // Last use of second arg (here, arg3).
+    CheckValue* checkAdd2 = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg2, arg3);
+    checkAdd2->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    // Keep arg3 live.
+    PatchpointValue* keepArg2Live = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    keepArg2Live->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    keepArg2Live->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    // Only use of checkAdd1 and checkAdd2.
+    CheckValue* checkAdd3 = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), checkAdd1, checkAdd2);
+    checkAdd3->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    root->appendNewControlValue(proc, Return, Origin(), checkAdd3);
+
+    CHECK(compileAndRun<int32_t>(proc, 1, 2, 3) == 8);
+}
+
+void testCheckAddSelfOverflow64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg, arg);
+    checkAdd->append(arg);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.move(params[0].gpr(), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+
+    // Make sure the arg is not the destination of the operation.
+    PatchpointValue* opaqueUse = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    opaqueUse->append(ConstrainedValue(arg, ValueRep::SomeRegister));
+    opaqueUse->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    root->appendNewControlValue(proc, Return, Origin(), checkAdd);
+
+    auto code = compile(proc);
+
+    CHECK(invoke<int64_t>(*code, 0ll) == 0);
+    CHECK(invoke<int64_t>(*code, 1ll) == 2);
+    CHECK(invoke<int64_t>(*code, std::numeric_limits<int64_t>::max()) == std::numeric_limits<int64_t>::max());
+}
+
+void testCheckAddSelfOverflow32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    CheckValue* checkAdd = root->appendNew<CheckValue>(proc, CheckAdd, Origin(), arg, arg);
+    checkAdd->append(arg);
+    checkAdd->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.move(params[0].gpr(), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+
+    // Make sure the arg is not the destination of the operation.
+    PatchpointValue* opaqueUse = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    opaqueUse->append(ConstrainedValue(arg, ValueRep::SomeRegister));
+    opaqueUse->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    root->appendNewControlValue(proc, Return, Origin(), checkAdd);
+
+    auto code = compile(proc);
+
+    CHECK(invoke<int32_t>(*code, 0ll) == 0);
+    CHECK(invoke<int32_t>(*code, 1ll) == 2);
+    CHECK(invoke<int32_t>(*code, std::numeric_limits<int32_t>::max()) == std::numeric_limits<int32_t>::max());
+}
+
+void testCheckSubImm()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), 42);
+    CheckValue* checkSub = root->appendNew<CheckValue>(proc, CheckSub, Origin(), arg1, arg2);
+    checkSub->append(arg1);
+    checkSub->append(arg2);
+    checkSub->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == 42);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(42), FPRInfo::fpRegT1);
+            jit.subDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkSub));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0) == -42.0);
+    CHECK(invoke<double>(*code, 1) == -41.0);
+    CHECK(invoke<double>(*code, 42) == 0.0);
+    CHECK(invoke<double>(*code, -2147483647) == -2147483689.0);
+}
+
+void testCheckSubBadImm()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    int32_t badImm = std::numeric_limits<int>::min();
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), badImm);
+    CheckValue* checkSub = root->appendNew<CheckValue>(proc, CheckSub, Origin(), arg1, arg2);
+    checkSub->append(arg1);
+    checkSub->append(arg2);
+    checkSub->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+
+            if (params[1].isConstant()) {
+                CHECK(params[1].value() == badImm);
+                jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(badImm), FPRInfo::fpRegT1);
+            } else {
+                CHECK(params[1].isGPR());
+                jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            }
+            jit.subDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkSub));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0) == -static_cast<double>(badImm));
+    CHECK(invoke<double>(*code, -1) == -static_cast<double>(badImm) - 1);
+    CHECK(invoke<double>(*code, 1) == -static_cast<double>(badImm) + 1);
+    CHECK(invoke<double>(*code, 42) == -static_cast<double>(badImm) + 42);
+}
+
+void testCheckSub()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    CheckValue* checkSub = root->appendNew<CheckValue>(proc, CheckSub, Origin(), arg1, arg2);
+    checkSub->append(arg1);
+    checkSub->append(arg2);
+    checkSub->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.subDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkSub));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0, 42) == -42.0);
+    CHECK(invoke<double>(*code, 1, 42) == -41.0);
+    CHECK(invoke<double>(*code, 42, 42) == 0.0);
+    CHECK(invoke<double>(*code, -2147483647, 42) == -2147483689.0);
+}
+
+NEVER_INLINE double doubleSub(double a, double b)
+{
+    return a - b;
+}
+
+void testCheckSub64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    CheckValue* checkSub = root->appendNew<CheckValue>(proc, CheckSub, Origin(), arg1, arg2);
+    checkSub->append(arg1);
+    checkSub->append(arg2);
+    checkSub->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt64ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.subDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkSub));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0ll, 42ll) == -42.0);
+    CHECK(invoke<double>(*code, 1ll, 42ll) == -41.0);
+    CHECK(invoke<double>(*code, 42ll, 42ll) == 0.0);
+    CHECK(invoke<double>(*code, -9223372036854775807ll, 42ll) == doubleSub(static_cast<double>(-9223372036854775807ll), 42.0));
+}
+
+void testCheckSubFold(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const32Value>(proc, Origin(), a);
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), b);
+    CheckValue* checkSub = root->appendNew<CheckValue>(proc, CheckSub, Origin(), arg1, arg2);
+    checkSub->setGenerator(
+        [&] (CCallHelpers&, const StackmapGenerationParams&) {
+            CHECK(!"Should have been folded");
+        });
+    root->appendNewControlValue(proc, Return, Origin(), checkSub);
+
+    auto code = compile(proc);
+
+    CHECK(invoke<int>(*code) == a - b);
+}
+
+void testCheckSubFoldFail(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const32Value>(proc, Origin(), a);
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), b);
+    CheckValue* checkSub = root->appendNew<CheckValue>(proc, CheckSub, Origin(), arg1, arg2);
+    checkSub->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(proc, Return, Origin(), checkSub);
+
+    auto code = compile(proc);
+
+    CHECK(invoke<int>(*code) == 42);
+}
+
+void testCheckNeg()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const32Value>(proc, Origin(), 0);
+    Value* arg2 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    CheckValue* checkNeg = root->appendNew<CheckValue>(proc, CheckSub, Origin(), arg1, arg2);
+    checkNeg->append(arg2);
+    checkNeg->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 1);
+            CHECK(params[0].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT1);
+            jit.negateDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkNeg));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0) == 0.0);
+    CHECK(invoke<double>(*code, 1) == -1.0);
+    CHECK(invoke<double>(*code, 42) == -42.0);
+    CHECK(invoke<double>(*code, -2147483647 - 1) == 2147483648.0);
+}
+
+void testCheckNeg64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const64Value>(proc, Origin(), 0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    CheckValue* checkNeg = root->appendNew<CheckValue>(proc, CheckSub, Origin(), arg1, arg2);
+    checkNeg->append(arg2);
+    checkNeg->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 1);
+            CHECK(params[0].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT1);
+            jit.negateDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkNeg));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0ll) == 0.0);
+    CHECK(invoke<double>(*code, 1ll) == -1.0);
+    CHECK(invoke<double>(*code, 42ll) == -42.0);
+    CHECK(invoke<double>(*code, -9223372036854775807ll - 1) == 9223372036854775808.0);
+}
+
+void testCheckMul()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    CheckValue* checkMul = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul->append(arg1);
+    checkMul->append(arg2);
+    checkMul->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkMul));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0, 42) == 0.0);
+    CHECK(invoke<double>(*code, 1, 42) == 42.0);
+    CHECK(invoke<double>(*code, 42, 42) == 42.0 * 42.0);
+    CHECK(invoke<double>(*code, 2147483647, 42) == 2147483647.0 * 42.0);
+}
+
+void testCheckMulMemory()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    int left;
+    int right;
+    
+    Value* arg1 = root->appendNew<MemoryValue>(
+        proc, Load, Int32, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), &left));
+    Value* arg2 = root->appendNew<MemoryValue>(
+        proc, Load, Int32, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), &right));
+    CheckValue* checkMul = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul->append(arg1);
+    checkMul->append(arg2);
+    checkMul->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkMul));
+
+    auto code = compile(proc);
+
+    left = 0;
+    right = 42;
+    CHECK(invoke<double>(*code) == 0.0);
+    
+    left = 1;
+    right = 42;
+    CHECK(invoke<double>(*code) == 42.0);
+
+    left = 42;
+    right = 42;
+    CHECK(invoke<double>(*code) == 42.0 * 42.0);
+
+    left = 2147483647;
+    right = 42;
+    CHECK(invoke<double>(*code) == 2147483647.0 * 42.0);
+}
+
+void testCheckMul2()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), 2);
+    CheckValue* checkMul = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul->append(arg1);
+    checkMul->append(arg2);
+    checkMul->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isConstant());
+            CHECK(params[1].value() == 2);
+            jit.convertInt32ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt32ToDouble(CCallHelpers::TrustedImm32(2), FPRInfo::fpRegT1);
+            jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkMul));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0) == 0.0);
+    CHECK(invoke<double>(*code, 1) == 2.0);
+    CHECK(invoke<double>(*code, 42) == 42.0 * 2.0);
+    CHECK(invoke<double>(*code, 2147483647) == 2147483647.0 * 2.0);
+}
+
+void testCheckMul64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    CheckValue* checkMul = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul->append(arg1);
+    checkMul->append(arg2);
+    checkMul->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt64ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkMul));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0, 42) == 0.0);
+    CHECK(invoke<double>(*code, 1, 42) == 42.0);
+    CHECK(invoke<double>(*code, 42, 42) == 42.0 * 42.0);
+    CHECK(invoke<double>(*code, 9223372036854775807ll, 42) == static_cast<double>(9223372036854775807ll) * 42.0);
+}
+
+void testCheckMulFold(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const32Value>(proc, Origin(), a);
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), b);
+    CheckValue* checkMul = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul->setGenerator(
+        [&] (CCallHelpers&, const StackmapGenerationParams&) {
+            CHECK(!"Should have been folded");
+        });
+    root->appendNewControlValue(proc, Return, Origin(), checkMul);
+
+    auto code = compile(proc);
+
+    CHECK(invoke<int>(*code) == a * b);
+}
+
+void testCheckMulFoldFail(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Const32Value>(proc, Origin(), a);
+    Value* arg2 = root->appendNew<Const32Value>(proc, Origin(), b);
+    CheckValue* checkMul = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(proc, Return, Origin(), checkMul);
+
+    auto code = compile(proc);
+
+    CHECK(invoke<int>(*code) == 42);
+}
+
+void testCheckMulArgumentAliasing64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* arg3 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+
+    // Pretend to use all the args.
+    PatchpointValue* useArgs = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    useArgs->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+    useArgs->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    useArgs->append(ConstrainedValue(arg3, ValueRep::SomeRegister));
+    useArgs->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    // Last use of first arg (here, arg1).
+    CheckValue* checkMul1 = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul1->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    // Last use of second arg (here, arg2).
+    CheckValue* checkMul2 = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg3, arg2);
+    checkMul2->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    // Keep arg3 live.
+    PatchpointValue* keepArg2Live = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    keepArg2Live->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    keepArg2Live->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    // Only use of checkMul1 and checkMul2.
+    CheckValue* checkMul3 = root->appendNew<CheckValue>(proc, CheckMul, Origin(), checkMul1, checkMul2);
+    checkMul3->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    root->appendNewControlValue(proc, Return, Origin(), checkMul3);
+
+    CHECK(compileAndRun<int64_t>(proc, 2, 3, 4) == 72);
+}
+
+void testCheckMulArgumentAliasing32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* arg3 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2));
+
+    // Pretend to use all the args.
+    PatchpointValue* useArgs = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    useArgs->append(ConstrainedValue(arg1, ValueRep::SomeRegister));
+    useArgs->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    useArgs->append(ConstrainedValue(arg3, ValueRep::SomeRegister));
+    useArgs->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    // Last use of first arg (here, arg1).
+    CheckValue* checkMul1 = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul1->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    // Last use of second arg (here, arg3).
+    CheckValue* checkMul2 = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg2, arg3);
+    checkMul2->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    // Keep arg3 live.
+    PatchpointValue* keepArg2Live = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    keepArg2Live->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+    keepArg2Live->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+    // Only use of checkMul1 and checkMul2.
+    CheckValue* checkMul3 = root->appendNew<CheckValue>(proc, CheckMul, Origin(), checkMul1, checkMul2);
+    checkMul3->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) { jit.oops(); });
+
+    root->appendNewControlValue(proc, Return, Origin(), checkMul3);
+
+    CHECK(compileAndRun<int32_t>(proc, 2, 3, 4) == 72);
+}
+
+void testCheckMul64SShr()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<Value>(
+        proc, SShr, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Const32Value>(proc, Origin(), 1));
+    Value* arg2 = root->appendNew<Value>(
+        proc, SShr, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+        root->appendNew<Const32Value>(proc, Origin(), 1));
+    CheckValue* checkMul = root->appendNew<CheckValue>(proc, CheckMul, Origin(), arg1, arg2);
+    checkMul->append(arg1);
+    checkMul->append(arg2);
+    checkMul->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params.size() == 2);
+            CHECK(params[0].isGPR());
+            CHECK(params[1].isGPR());
+            jit.convertInt64ToDouble(params[0].gpr(), FPRInfo::fpRegT0);
+            jit.convertInt64ToDouble(params[1].gpr(), FPRInfo::fpRegT1);
+            jit.mulDouble(FPRInfo::fpRegT1, FPRInfo::fpRegT0);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, IToD, Origin(), checkMul));
+
+    auto code = compile(proc);
+
+    CHECK(invoke<double>(*code, 0ll, 42ll) == 0.0);
+    CHECK(invoke<double>(*code, 1ll, 42ll) == 0.0);
+    CHECK(invoke<double>(*code, 42ll, 42ll) == (42.0 / 2.0) * (42.0 / 2.0));
+    CHECK(invoke<double>(*code, 10000000000ll, 10000000000ll) == 25000000000000000000.0);
+}
+
+template<typename LeftFunctor, typename RightFunctor, typename InputType>
+void genericTestCompare(
+    B3::Opcode opcode, const LeftFunctor& leftFunctor, const RightFunctor& rightFunctor,
+    InputType left, InputType right, int result)
+{
+    // Using a compare.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* leftValue = leftFunctor(root, proc);
+        Value* rightValue = rightFunctor(root, proc);
+        Value* comparisonResult = root->appendNew<Value>(proc, opcode, Origin(), leftValue, rightValue);
+        
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, NotEqual, Origin(),
+                comparisonResult,
+                root->appendIntConstant(proc, Origin(), comparisonResult->type(), 0)));
+
+        CHECK(compileAndRun<int>(proc, left, right) == result);
+    }
+    
+    // Using a branch.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        BasicBlock* thenCase = proc.addBlock();
+        BasicBlock* elseCase = proc.addBlock();
+
+        Value* leftValue = leftFunctor(root, proc);
+        Value* rightValue = rightFunctor(root, proc);
+
+        root->appendNewControlValue(
+            proc, Branch, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), leftValue, rightValue),
+            FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+        // We use a patchpoint on the then case to ensure that this doesn't get if-converted.
+        PatchpointValue* patchpoint = thenCase->appendNew<PatchpointValue>(proc, Int32, Origin());
+        patchpoint->setGenerator(
+            [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                CHECK(params.size() == 1);
+                CHECK(params[0].isGPR());
+                jit.move(CCallHelpers::TrustedImm32(1), params[0].gpr());
+            });
+        thenCase->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+        elseCase->appendNewControlValue(
+            proc, Return, Origin(),
+            elseCase->appendNew<Const32Value>(proc, Origin(), 0));
+
+        CHECK(compileAndRun<int>(proc, left, right) == result);
+    }
+}
+
+template<typename InputType>
+InputType modelCompare(B3::Opcode opcode, InputType left, InputType right)
+{
+    switch (opcode) {
+    case Equal:
+        return left == right;
+    case NotEqual:
+        return left != right;
+    case LessThan:
+        return left < right;
+    case GreaterThan:
+        return left > right;
+    case LessEqual:
+        return left <= right;
+    case GreaterEqual:
+        return left >= right;
+    case Above:
+        return static_cast<typename std::make_unsigned<InputType>::type>(left) >
+            static_cast<typename std::make_unsigned<InputType>::type>(right);
+    case Below:
+        return static_cast<typename std::make_unsigned<InputType>::type>(left) <
+            static_cast<typename std::make_unsigned<InputType>::type>(right);
+    case AboveEqual:
+        return static_cast<typename std::make_unsigned<InputType>::type>(left) >=
+            static_cast<typename std::make_unsigned<InputType>::type>(right);
+    case BelowEqual:
+        return static_cast<typename std::make_unsigned<InputType>::type>(left) <=
+            static_cast<typename std::make_unsigned<InputType>::type>(right);
+    case BitAnd:
+        return !!(left & right);
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+template<typename T>
+void testCompareLoad(B3::Opcode opcode, B3::Opcode loadOpcode, int left, int right)
+{
+    int result = modelCompare(opcode, modelLoad<T>(left), right);
+    
+    // Test addr-to-tmp
+    int slot = left;
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<MemoryValue>(
+                proc, loadOpcode, Int32, Origin(),
+                block->appendNew<ConstPtrValue>(proc, Origin(), &slot));
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Value>(
+                proc, Trunc, Origin(),
+                block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+        },
+        left, right, result);
+
+    // Test addr-to-imm
+    slot = left;
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<MemoryValue>(
+                proc, loadOpcode, Int32, Origin(),
+                block->appendNew<ConstPtrValue>(proc, Origin(), &slot));
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const32Value>(proc, Origin(), right);
+        },
+        left, right, result);
+
+    result = modelCompare(opcode, left, modelLoad<T>(right));
+    
+    // Test tmp-to-addr
+    slot = right;
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Value>(
+                proc, Trunc, Origin(),
+                block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<MemoryValue>(
+                proc, loadOpcode, Int32, Origin(),
+                block->appendNew<ConstPtrValue>(proc, Origin(), &slot));
+        },
+        left, right, result);
+
+    // Test imm-to-addr
+    slot = right;
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const32Value>(proc, Origin(), left);
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<MemoryValue>(
+                proc, loadOpcode, Int32, Origin(),
+                block->appendNew<ConstPtrValue>(proc, Origin(), &slot));
+        },
+        left, right, result);
+
+    // Test addr-to-addr, with the same addr.
+    slot = left;
+    Value* value;
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            value = block->appendNew<MemoryValue>(
+                proc, loadOpcode, Int32, Origin(),
+                block->appendNew<ConstPtrValue>(proc, Origin(), &slot));
+            return value;
+        },
+        [&] (BasicBlock*, Procedure&) {
+            return value;
+        },
+        left, left, modelCompare(opcode, modelLoad<T>(left), modelLoad<T>(left)));
+}
+
+void testCompareImpl(B3::Opcode opcode, int64_t left, int64_t right)
+{
+    int64_t result = modelCompare(opcode, left, right);
+    int32_t int32Result = modelCompare(opcode, static_cast<int32_t>(left), static_cast<int32_t>(right));
+    
+    // Test tmp-to-tmp.
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        },
+        left, right, result);
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Value>(
+                proc, Trunc, Origin(),
+                block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Value>(
+                proc, Trunc, Origin(),
+                block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+        },
+        left, right, int32Result);
+
+    // Test imm-to-tmp.
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const64Value>(proc, Origin(), left);
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        },
+        left, right, result);
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const32Value>(proc, Origin(), left);
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Value>(
+                proc, Trunc, Origin(),
+                block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+        },
+        left, right, int32Result);
+
+    // Test tmp-to-imm.
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const64Value>(proc, Origin(), right);
+        },
+        left, right, result);
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Value>(
+                proc, Trunc, Origin(),
+                block->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const32Value>(proc, Origin(), right);
+        },
+        left, right, int32Result);
+
+    // Test imm-to-imm.
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const64Value>(proc, Origin(), left);
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const64Value>(proc, Origin(), right);
+        },
+        left, right, result);
+    genericTestCompare(
+        opcode,
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const32Value>(proc, Origin(), left);
+        },
+        [&] (BasicBlock* block, Procedure& proc) {
+            return block->appendNew<Const32Value>(proc, Origin(), right);
+        },
+        left, right, int32Result);
+
+    testCompareLoad<int32_t>(opcode, Load, left, right);
+    testCompareLoad<int8_t>(opcode, Load8S, left, right);
+    testCompareLoad<uint8_t>(opcode, Load8Z, left, right);
+    testCompareLoad<int16_t>(opcode, Load16S, left, right);
+    testCompareLoad<uint16_t>(opcode, Load16Z, left, right);
+}
+
+void testCompare(B3::Opcode opcode, int64_t left, int64_t right)
+{
+    testCompareImpl(opcode, left, right);
+    testCompareImpl(opcode, left, right + 1);
+    testCompareImpl(opcode, left, right - 1);
+}
+
+void testEqualDouble(double left, double right, bool result)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Equal, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1)));
+
+    CHECK(compileAndRun<bool>(proc, left, right) == result);
+}
+
+int simpleFunction(int a, int b)
+{
+    return a + b;
+}
+
+void testCallSimple(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<CCallValue>(
+            proc, Int32, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(simpleFunction)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    CHECK(compileAndRun<int>(proc, a, b) == a + b);
+}
+
+void testCallRare(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* common = proc.addBlock();
+    BasicBlock* rare = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        FrequentedBlock(rare, FrequencyClass::Rare),
+        FrequentedBlock(common));
+
+    common->appendNewControlValue(
+        proc, Return, Origin(), common->appendNew<Const32Value>(proc, Origin(), 0));
+    
+    rare->appendNewControlValue(
+        proc, Return, Origin(),
+        rare->appendNew<CCallValue>(
+            proc, Int32, Origin(),
+            rare->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(simpleFunction)),
+            rare->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            rare->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+
+    CHECK(compileAndRun<int>(proc, true, a, b) == a + b);
+}
+
+void testCallRareLive(int a, int b, int c)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* common = proc.addBlock();
+    BasicBlock* rare = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        FrequentedBlock(rare, FrequencyClass::Rare),
+        FrequentedBlock(common));
+
+    common->appendNewControlValue(
+        proc, Return, Origin(), common->appendNew<Const32Value>(proc, Origin(), 0));
+    
+    rare->appendNewControlValue(
+        proc, Return, Origin(),
+        rare->appendNew<Value>(
+            proc, Add, Origin(),
+            rare->appendNew<CCallValue>(
+                proc, Int32, Origin(),
+                rare->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(simpleFunction)),
+                rare->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+                rare->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)),
+            rare->appendNew<Value>(
+                proc, Trunc, Origin(),
+                rare->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3))));
+
+    CHECK(compileAndRun<int>(proc, true, a, b, c) == a + b + c);
+}
+
+void testCallSimplePure(int a, int b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<CCallValue>(
+            proc, Int32, Origin(), Effects::none(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(simpleFunction)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    CHECK(compileAndRun<int>(proc, a, b) == a + b);
+}
+
+int functionWithHellaArguments(int a, int b, int c, int d, int e, int f, int g, int h, int i, int j, int k, int l, int m, int n, int o, int p, int q, int r, int s, int t, int u, int v, int w, int x, int y, int z)
+{
+    return (a << 0) + (b << 1) + (c << 2) + (d << 3) + (e << 4) + (f << 5) + (g << 6) + (h << 7) + (i << 8) + (j << 9) + (k << 10) + (l << 11) + (m << 12) + (n << 13) + (o << 14) + (p << 15) + (q << 16) + (r << 17) + (s << 18) + (t << 19) + (u << 20) + (v << 21) + (w << 22) + (x << 23) + (y << 24) + (z << 25);
+}
+
+void testCallFunctionWithHellaArguments()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Vector<Value*> args;
+    for (unsigned i = 0; i < 26; ++i)
+        args.append(root->appendNew<Const32Value>(proc, Origin(), i + 1));
+
+    CCallValue* call = root->appendNew<CCallValue>(
+        proc, Int32, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(functionWithHellaArguments)));
+    call->children().appendVector(args);
+    
+    root->appendNewControlValue(proc, Return, Origin(), call);
+
+    CHECK(compileAndRun<int>(proc) == functionWithHellaArguments(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26));
+}
+
+void testReturnDouble(double value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<ConstDoubleValue>(proc, Origin(), value));
+
+    CHECK(isIdentical(compileAndRun<double>(proc), value));
+}
+
+void testReturnFloat(float value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<ConstFloatValue>(proc, Origin(), value));
+
+    CHECK(isIdentical(compileAndRun<float>(proc), value));
+}
+
+double simpleFunctionDouble(double a, double b)
+{
+    return a + b;
+}
+
+void testCallSimpleDouble(double a, double b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<CCallValue>(
+            proc, Double, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(simpleFunctionDouble)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1)));
+
+    CHECK(compileAndRun<double>(proc, a, b) == a + b);
+}
+
+float simpleFunctionFloat(float a, float b)
+{
+    return a + b;
+}
+
+void testCallSimpleFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<CCallValue>(
+            proc, Float, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(simpleFunctionFloat)),
+            floatValue1,
+            floatValue2));
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b)), a + b));
+}
+
+double functionWithHellaDoubleArguments(double a, double b, double c, double d, double e, double f, double g, double h, double i, double j, double k, double l, double m, double n, double o, double p, double q, double r, double s, double t, double u, double v, double w, double x, double y, double z)
+{
+    return a * pow(2, 0) + b * pow(2, 1) + c * pow(2, 2) + d * pow(2, 3) + e * pow(2, 4) + f * pow(2, 5) + g * pow(2, 6) + h * pow(2, 7) + i * pow(2, 8) + j * pow(2, 9) + k * pow(2, 10) + l * pow(2, 11) + m * pow(2, 12) + n * pow(2, 13) + o * pow(2, 14) + p * pow(2, 15) + q * pow(2, 16) + r * pow(2, 17) + s * pow(2, 18) + t * pow(2, 19) + u * pow(2, 20) + v * pow(2, 21) + w * pow(2, 22) + x * pow(2, 23) + y * pow(2, 24) + z * pow(2, 25);
+}
+
+void testCallFunctionWithHellaDoubleArguments()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Vector<Value*> args;
+    for (unsigned i = 0; i < 26; ++i)
+        args.append(root->appendNew<ConstDoubleValue>(proc, Origin(), i + 1));
+
+    CCallValue* call = root->appendNew<CCallValue>(
+        proc, Double, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(functionWithHellaDoubleArguments)));
+    call->children().appendVector(args);
+    
+    root->appendNewControlValue(proc, Return, Origin(), call);
+
+    CHECK(compileAndRun<double>(proc) == functionWithHellaDoubleArguments(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26));
+}
+
+float functionWithHellaFloatArguments(float a, float b, float c, float d, float e, float f, float g, float h, float i, float j, float k, float l, float m, float n, float o, float p, float q, float r, float s, float t, float u, float v, float w, float x, float y, float z)
+{
+    return a * pow(2, 0) + b * pow(2, 1) + c * pow(2, 2) + d * pow(2, 3) + e * pow(2, 4) + f * pow(2, 5) + g * pow(2, 6) + h * pow(2, 7) + i * pow(2, 8) + j * pow(2, 9) + k * pow(2, 10) + l * pow(2, 11) + m * pow(2, 12) + n * pow(2, 13) + o * pow(2, 14) + p * pow(2, 15) + q * pow(2, 16) + r * pow(2, 17) + s * pow(2, 18) + t * pow(2, 19) + u * pow(2, 20) + v * pow(2, 21) + w * pow(2, 22) + x * pow(2, 23) + y * pow(2, 24) + z * pow(2, 25);
+}
+
+void testCallFunctionWithHellaFloatArguments()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Vector<Value*> args;
+    for (unsigned i = 0; i < 26; ++i)
+        args.append(root->appendNew<ConstFloatValue>(proc, Origin(), i + 1));
+
+    CCallValue* call = root->appendNew<CCallValue>(
+        proc, Float, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), bitwise_cast<void*>(functionWithHellaFloatArguments)));
+    call->children().appendVector(args);
+    
+    root->appendNewControlValue(proc, Return, Origin(), call);
+
+    CHECK(compileAndRun<float>(proc) == functionWithHellaFloatArguments(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26));
+}
+
+void testChillDiv(int num, int den, int res)
+{
+    // Test non-constant.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, chill(Div), Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+
+        CHECK(compileAndRun<int>(proc, num, den) == res);
+    }
+
+    // Test constant.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, chill(Div), Origin(),
+                root->appendNew<Const32Value>(proc, Origin(), num),
+                root->appendNew<Const32Value>(proc, Origin(), den)));
+        
+        CHECK(compileAndRun<int>(proc) == res);
+    }
+}
+
+void testChillDivTwice(int num1, int den1, int num2, int den2, int res)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(
+                proc, chill(Div), Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))),
+            root->appendNew<Value>(
+                proc, chill(Div), Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3)))));
+    
+    CHECK(compileAndRun<int>(proc, num1, den1, num2, den2) == res);
+}
+
+void testChillDiv64(int64_t num, int64_t den, int64_t res)
+{
+    if (!is64Bit())
+        return;
+
+    // Test non-constant.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, chill(Div), Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+        
+        CHECK(compileAndRun<int64_t>(proc, num, den) == res);
+    }
+
+    // Test constant.
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, chill(Div), Origin(),
+                root->appendNew<Const64Value>(proc, Origin(), num),
+                root->appendNew<Const64Value>(proc, Origin(), den)));
+        
+        CHECK(compileAndRun<int64_t>(proc) == res);
+    }
+}
+
+void testModArg(int64_t value)
+{
+    if (!value)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), argument, argument);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(!compileAndRun<int64_t>(proc, value));
+}
+
+void testModArgs(int64_t numerator, int64_t denominator)
+{
+    if (!denominator)
+        return;
+    if (numerator == std::numeric_limits<int64_t>::min() && denominator == -1)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int64_t>(proc, numerator, denominator) == numerator % denominator);
+}
+
+void testModImms(int64_t numerator, int64_t denominator)
+{
+    if (!denominator)
+        return;
+    if (numerator == std::numeric_limits<int64_t>::min() && denominator == -1)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument1 = root->appendNew<Const64Value>(proc, Origin(), numerator);
+    Value* argument2 = root->appendNew<Const64Value>(proc, Origin(), denominator);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int64_t>(proc, numerator, denominator) == numerator % denominator);
+}
+
+void testModArg32(int32_t value)
+{
+    if (!value)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), argument, argument);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(!compileAndRun<int32_t>(proc, value));
+}
+
+void testModArgs32(int32_t numerator, int32_t denominator)
+{
+    if (!denominator)
+        return;
+    if (numerator == std::numeric_limits<int32_t>::min() && denominator == -1)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int32_t>(proc, numerator, denominator) == numerator % denominator);
+}
+
+void testModImms32(int32_t numerator, int32_t denominator)
+{
+    if (!denominator)
+        return;
+    if (numerator == std::numeric_limits<int32_t>::min() && denominator == -1)
+        return;
+
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument1 = root->appendNew<Const32Value>(proc, Origin(), numerator);
+    Value* argument2 = root->appendNew<Const32Value>(proc, Origin(), denominator);
+    Value* result = root->appendNew<Value>(proc, Mod, Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int32_t>(proc, numerator, denominator) == numerator % denominator);
+}
+
+void testChillModArg(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* result = root->appendNew<Value>(proc, chill(Mod), Origin(), argument, argument);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(!compileAndRun<int64_t>(proc, value));
+}
+
+void testChillModArgs(int64_t numerator, int64_t denominator)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* result = root->appendNew<Value>(proc, chill(Mod), Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int64_t>(proc, numerator, denominator) == chillMod(numerator, denominator));
+}
+
+void testChillModImms(int64_t numerator, int64_t denominator)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument1 = root->appendNew<Const64Value>(proc, Origin(), numerator);
+    Value* argument2 = root->appendNew<Const64Value>(proc, Origin(), denominator);
+    Value* result = root->appendNew<Value>(proc, chill(Mod), Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int64_t>(proc, numerator, denominator) == chillMod(numerator, denominator));
+}
+
+void testChillModArg32(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* result = root->appendNew<Value>(proc, chill(Mod), Origin(), argument, argument);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(!compileAndRun<int32_t>(proc, value));
+}
+
+void testChillModArgs32(int32_t numerator, int32_t denominator)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument1 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* result = root->appendNew<Value>(proc, chill(Mod), Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int32_t>(proc, numerator, denominator) == chillMod(numerator, denominator));
+}
+
+void testChillModImms32(int32_t numerator, int32_t denominator)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* argument1 = root->appendNew<Const32Value>(proc, Origin(), numerator);
+    Value* argument2 = root->appendNew<Const32Value>(proc, Origin(), denominator);
+    Value* result = root->appendNew<Value>(proc, chill(Mod), Origin(), argument1, argument2);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    CHECK(compileAndRun<int32_t>(proc, numerator, denominator) == chillMod(numerator, denominator));
+}
+
+void testSwitch(unsigned degree, unsigned gap = 1)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    BasicBlock* terminate = proc.addBlock();
+    terminate->appendNewControlValue(
+        proc, Return, Origin(),
+        terminate->appendNew<Const32Value>(proc, Origin(), 0));
+
+    SwitchValue* switchValue = root->appendNew<SwitchValue>(
+        proc, Origin(), root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    switchValue->setFallThrough(FrequentedBlock(terminate));
+
+    for (unsigned i = 0; i < degree; ++i) {
+        BasicBlock* newBlock = proc.addBlock();
+        newBlock->appendNewControlValue(
+            proc, Return, Origin(),
+            newBlock->appendNew<ArgumentRegValue>(
+                proc, Origin(), (i & 1) ? GPRInfo::argumentGPR2 : GPRInfo::argumentGPR1));
+        switchValue->appendCase(SwitchCase(gap * i, FrequentedBlock(newBlock)));
+    }
+
+    auto code = compile(proc);
+
+    for (unsigned i = 0; i < degree; ++i) {
+        CHECK(invoke<int32_t>(*code, i * gap, 42, 11) == ((i & 1) ? 11 : 42));
+        if (gap > 1) {
+            CHECK(!invoke<int32_t>(*code, i * gap + 1, 42, 11));
+            CHECK(!invoke<int32_t>(*code, i * gap - 1, 42, 11));
+        }
+    }
+
+    CHECK(!invoke<int32_t>(*code, -1, 42, 11));
+    CHECK(!invoke<int32_t>(*code, degree * gap, 42, 11));
+    CHECK(!invoke<int32_t>(*code, degree * gap + 1, 42, 11));
+}
+
+void testSwitchChillDiv(unsigned degree, unsigned gap = 1)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* left = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    Value* right = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+
+    BasicBlock* terminate = proc.addBlock();
+    terminate->appendNewControlValue(
+        proc, Return, Origin(),
+        terminate->appendNew<Const32Value>(proc, Origin(), 0));
+
+    SwitchValue* switchValue = root->appendNew<SwitchValue>(
+        proc, Origin(), root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    switchValue->setFallThrough(FrequentedBlock(terminate));
+
+    for (unsigned i = 0; i < degree; ++i) {
+        BasicBlock* newBlock = proc.addBlock();
+
+        newBlock->appendNewControlValue(
+            proc, Return, Origin(),
+            newBlock->appendNew<Value>(
+                proc, chill(Div), Origin(), (i & 1) ? right : left, (i & 1) ? left : right));
+        
+        switchValue->appendCase(SwitchCase(gap * i, FrequentedBlock(newBlock)));
+    }
+
+    auto code = compile(proc);
+
+    for (unsigned i = 0; i < degree; ++i) {
+        dataLog("i = ", i, "\n");
+        int32_t result = invoke<int32_t>(*code, i * gap, 42, 11);
+        dataLog("result = ", result, "\n");
+        CHECK(result == ((i & 1) ? 11/42 : 42/11));
+        if (gap > 1) {
+            CHECK(!invoke<int32_t>(*code, i * gap + 1, 42, 11));
+            CHECK(!invoke<int32_t>(*code, i * gap - 1, 42, 11));
+        }
+    }
+
+    CHECK(!invoke<int32_t>(*code, -1, 42, 11));
+    CHECK(!invoke<int32_t>(*code, degree * gap, 42, 11));
+    CHECK(!invoke<int32_t>(*code, degree * gap + 1, 42, 11));
+}
+
+void testSwitchTargettingSameBlock()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    BasicBlock* terminate = proc.addBlock();
+    terminate->appendNewControlValue(
+        proc, Return, Origin(),
+        terminate->appendNew<Const32Value>(proc, Origin(), 5));
+
+    SwitchValue* switchValue = root->appendNew<SwitchValue>(
+        proc, Origin(), root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    switchValue->setFallThrough(FrequentedBlock(terminate));
+
+    BasicBlock* otherTarget = proc.addBlock();
+    otherTarget->appendNewControlValue(
+        proc, Return, Origin(),
+        otherTarget->appendNew<Const32Value>(proc, Origin(), 42));
+    switchValue->appendCase(SwitchCase(3, FrequentedBlock(otherTarget)));
+    switchValue->appendCase(SwitchCase(13, FrequentedBlock(otherTarget)));
+
+    auto code = compile(proc);
+
+    for (unsigned i = 0; i < 20; ++i) {
+        int32_t expected = (i == 3 || i == 13) ? 42 : 5;
+        CHECK(invoke<int32_t>(*code, i) == expected);
+    }
+}
+
+void testSwitchTargettingSameBlockFoldPathConstant()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    BasicBlock* terminate = proc.addBlock();
+    terminate->appendNewControlValue(
+        proc, Return, Origin(),
+        terminate->appendNew<Const32Value>(proc, Origin(), 42));
+
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    SwitchValue* switchValue = root->appendNew<SwitchValue>(proc, Origin(), argument);
+    switchValue->setFallThrough(FrequentedBlock(terminate));
+
+    BasicBlock* otherTarget = proc.addBlock();
+    otherTarget->appendNewControlValue(
+        proc, Return, Origin(), argument);
+    switchValue->appendCase(SwitchCase(3, FrequentedBlock(otherTarget)));
+    switchValue->appendCase(SwitchCase(13, FrequentedBlock(otherTarget)));
+
+    auto code = compile(proc);
+
+    for (unsigned i = 0; i < 20; ++i) {
+        int32_t expected = (i == 3 || i == 13) ? i : 42;
+        CHECK(invoke<int32_t>(*code, i) == expected);
+    }
+}
+
+void testTruncFold(int64_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<Const64Value>(proc, Origin(), value)));
+
+    CHECK(compileAndRun<int>(proc) == static_cast<int>(value));
+}
+
+void testZExt32(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZExt32, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<uint64_t>(proc, value) == static_cast<uint64_t>(static_cast<uint32_t>(value)));
+}
+
+void testZExt32Fold(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZExt32, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), value)));
+
+    CHECK(compileAndRun<uint64_t>(proc, value) == static_cast<uint64_t>(static_cast<uint32_t>(value)));
+}
+
+void testSExt32(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt32, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int64_t>(proc, value) == static_cast<int64_t>(value));
+}
+
+void testSExt32Fold(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt32, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), value)));
+
+    CHECK(compileAndRun<int64_t>(proc, value) == static_cast<int64_t>(value));
+}
+
+void testTruncZExt32(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<Value>(
+                proc, ZExt32, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == value);
+}
+
+void testTruncSExt32(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<Value>(
+                proc, SExt32, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == value);
+}
+
+void testSExt8(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt8, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<int32_t>(static_cast<int8_t>(value)));
+}
+
+void testSExt8Fold(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt8, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), value)));
+
+    CHECK(compileAndRun<int32_t>(proc) == static_cast<int32_t>(static_cast<int8_t>(value)));
+}
+
+void testSExt8SExt8(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt8, Origin(),
+            root->appendNew<Value>(
+                proc, SExt8, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<int32_t>(static_cast<int8_t>(value)));
+}
+
+void testSExt8SExt16(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt8, Origin(),
+            root->appendNew<Value>(
+                proc, SExt16, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<int32_t>(static_cast<int8_t>(value)));
+}
+
+void testSExt8BitAnd(int32_t value, int32_t mask)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt8, Origin(),
+            root->appendNew<Value>(
+                proc, BitAnd, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Const32Value>(proc, Origin(), mask))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<int32_t>(static_cast<int8_t>(value & mask)));
+}
+
+void testBitAndSExt8(int32_t value, int32_t mask)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Value>(
+                proc, SExt8, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+            root->appendNew<Const32Value>(proc, Origin(), mask)));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == (static_cast<int32_t>(static_cast<int8_t>(value)) & mask));
+}
+
+void testSExt16(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt16, Origin(),
+            root->appendNew<Value>(
+                proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<int32_t>(static_cast<int16_t>(value)));
+}
+
+void testSExt16Fold(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt16, Origin(),
+            root->appendNew<Const32Value>(proc, Origin(), value)));
+
+    CHECK(compileAndRun<int32_t>(proc) == static_cast<int32_t>(static_cast<int16_t>(value)));
+}
+
+void testSExt16SExt16(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt16, Origin(),
+            root->appendNew<Value>(
+                proc, SExt16, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<int32_t>(static_cast<int16_t>(value)));
+}
+
+void testSExt16SExt8(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt16, Origin(),
+            root->appendNew<Value>(
+                proc, SExt8, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<int32_t>(static_cast<int8_t>(value)));
+}
+
+void testSExt16BitAnd(int32_t value, int32_t mask)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt16, Origin(),
+            root->appendNew<Value>(
+                proc, BitAnd, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Const32Value>(proc, Origin(), mask))));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<int32_t>(static_cast<int16_t>(value & mask)));
+}
+
+void testBitAndSExt16(int32_t value, int32_t mask)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Value>(
+                proc, SExt16, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+            root->appendNew<Const32Value>(proc, Origin(), mask)));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == (static_cast<int32_t>(static_cast<int16_t>(value)) & mask));
+}
+
+void testSExt32BitAnd(int32_t value, int32_t mask)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SExt32, Origin(),
+            root->appendNew<Value>(
+                proc, BitAnd, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Const32Value>(proc, Origin(), mask))));
+
+    CHECK(compileAndRun<int64_t>(proc, value) == static_cast<int64_t>(value & mask));
+}
+
+void testBitAndSExt32(int32_t value, int64_t mask)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Value>(
+                proc, SExt32, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))),
+            root->appendNew<Const64Value>(proc, Origin(), mask)));
+
+    CHECK(compileAndRun<int64_t>(proc, value) == (static_cast<int64_t>(value) & mask));
+}
+
+void testBasicSelect()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, Equal, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<ConstPtrValue>(proc, Origin(), 42)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+
+    auto code = compile(proc);
+    CHECK(invoke<intptr_t>(*code, 42, 1, 2) == 1);
+    CHECK(invoke<intptr_t>(*code, 42, 642462, 32533) == 642462);
+    CHECK(invoke<intptr_t>(*code, 43, 1, 2) == 2);
+    CHECK(invoke<intptr_t>(*code, 43, 642462, 32533) == 32533);
+}
+
+void testSelectTest()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+
+    auto code = compile(proc);
+    CHECK(invoke<intptr_t>(*code, 42, 1, 2) == 1);
+    CHECK(invoke<intptr_t>(*code, 42, 642462, 32533) == 642462);
+    CHECK(invoke<intptr_t>(*code, 0, 1, 2) == 2);
+    CHECK(invoke<intptr_t>(*code, 0, 642462, 32533) == 32533);
+}
+
+void testSelectCompareDouble()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, LessThan, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    auto code = compile(proc);
+    CHECK(invoke<intptr_t>(*code, -1.0, 1.0, 1, 2) == 1);
+    CHECK(invoke<intptr_t>(*code, 42.5, 42.51, 642462, 32533) == 642462);
+    CHECK(invoke<intptr_t>(*code, PNaN, 0.0, 1, 2) == 2);
+    CHECK(invoke<intptr_t>(*code, 42.51, 42.5, 642462, 32533) == 32533);
+    CHECK(invoke<intptr_t>(*code, 42.52, 42.52, 524978245, 352) == 352);
+}
+
+template<B3::Opcode opcode>
+void testSelectCompareFloat(float a, float b, bool (*operation)(float, float))
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, opcode, Origin(),
+                floatValue1,
+                floatValue2),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3)));
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b), 42, -5), operation(a, b) ? 42 : -5));
+}
+
+void testSelectCompareFloat(float a, float b)
+{
+    testSelectCompareFloat<Equal>(a, b, [](float a, float b) -> bool { return a == b; });
+    testSelectCompareFloat<NotEqual>(a, b, [](float a, float b) -> bool { return a != b; });
+    testSelectCompareFloat<LessThan>(a, b, [](float a, float b) -> bool { return a < b; });
+    testSelectCompareFloat<GreaterThan>(a, b, [](float a, float b) -> bool { return a > b; });
+    testSelectCompareFloat<LessEqual>(a, b, [](float a, float b) -> bool { return a <= b; });
+    testSelectCompareFloat<GreaterEqual>(a, b, [](float a, float b) -> bool { return a >= b; });
+    testSelectCompareFloat<EqualOrUnordered>(a, b, [](float a, float b) -> bool { return a != a || b != b || a == b; });
+}
+
+template<B3::Opcode opcode>
+void testSelectCompareFloatToDouble(float a, float b, bool (*operation)(float, float))
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* doubleValue1 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue1);
+    Value* doubleValue2 = root->appendNew<Value>(proc, FloatToDouble, Origin(), floatValue2);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, opcode, Origin(),
+                doubleValue1,
+                doubleValue2),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3)));
+    CHECK(isIdentical(compileAndRun<int32_t>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b), 42, -5), operation(a, b) ? 42 : -5));
+}
+
+void testSelectCompareFloatToDouble(float a, float b)
+{
+    testSelectCompareFloatToDouble<Equal>(a, b, [](float a, float b) -> bool { return a == b; });
+    testSelectCompareFloatToDouble<NotEqual>(a, b, [](float a, float b) -> bool { return a != b; });
+    testSelectCompareFloatToDouble<LessThan>(a, b, [](float a, float b) -> bool { return a < b; });
+    testSelectCompareFloatToDouble<GreaterThan>(a, b, [](float a, float b) -> bool { return a > b; });
+    testSelectCompareFloatToDouble<LessEqual>(a, b, [](float a, float b) -> bool { return a <= b; });
+    testSelectCompareFloatToDouble<GreaterEqual>(a, b, [](float a, float b) -> bool { return a >= b; });
+    testSelectCompareFloatToDouble<EqualOrUnordered>(a, b, [](float a, float b) -> bool { return a != a || b != b || a == b; });
+}
+
+void testSelectDouble()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, Equal, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<ConstPtrValue>(proc, Origin(), 42)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1)));
+
+    auto code = compile(proc);
+    CHECK(invoke<double>(*code, 42, 1.5, 2.6) == 1.5);
+    CHECK(invoke<double>(*code, 42, 642462.7, 32533.8) == 642462.7);
+    CHECK(invoke<double>(*code, 43, 1.9, 2.0) == 2.0);
+    CHECK(invoke<double>(*code, 43, 642462.1, 32533.2) == 32533.2);
+}
+
+void testSelectDoubleTest()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1)));
+
+    auto code = compile(proc);
+    CHECK(invoke<double>(*code, 42, 1.5, 2.6) == 1.5);
+    CHECK(invoke<double>(*code, 42, 642462.7, 32533.8) == 642462.7);
+    CHECK(invoke<double>(*code, 0, 1.9, 2.0) == 2.0);
+    CHECK(invoke<double>(*code, 0, 642462.1, 32533.2) == 32533.2);
+}
+
+void testSelectDoubleCompareDouble()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, LessThan, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR2),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR3)));
+
+    auto code = compile(proc);
+    CHECK(invoke<double>(*code, -1.0, 1.0, 1.1, 2.2) == 1.1);
+    CHECK(invoke<double>(*code, 42.5, 42.51, 642462.3, 32533.4) == 642462.3);
+    CHECK(invoke<double>(*code, PNaN, 0.0, 1.5, 2.6) == 2.6);
+    CHECK(invoke<double>(*code, 42.51, 42.5, 642462.7, 32533.8) == 32533.8);
+    CHECK(invoke<double>(*code, 42.52, 42.52, 524978245.9, 352.0) == 352.0);
+}
+
+void testSelectDoubleCompareFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, LessThan, Origin(),
+                floatValue1,
+                floatValue2),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1)));
+
+    CHECK(isIdentical(compileAndRun<double>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b), 42.1, -M_PI), a < b ? 42.1 : -M_PI));
+}
+
+void testSelectFloatCompareFloat(float a, float b)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* argument1int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* argument2int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* argument3int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2));
+    Value* argument4int32 = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3));
+    Value* floatValue1 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument1int32);
+    Value* floatValue2 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument2int32);
+    Value* floatValue3 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument3int32);
+    Value* floatValue4 = root->appendNew<Value>(proc, BitwiseCast, Origin(), argument4int32);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, LessThan, Origin(),
+                floatValue1,
+                floatValue2),
+            floatValue3,
+            floatValue4));
+
+    CHECK(isIdentical(compileAndRun<float>(proc, bitwise_cast<int32_t>(a), bitwise_cast<int32_t>(b), bitwise_cast<int32_t>(1.1f), bitwise_cast<int32_t>(-42.f)), a < b ? 1.1f : -42.f));
+}
+
+
+template<B3::Opcode opcode>
+void testSelectDoubleCompareDouble(bool (*operation)(double, double))
+{
+    { // Compare arguments and selected arguments are all different.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+        Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+        Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR2);
+        Value* arg3 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR3);
+
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, Select, Origin(),
+                root->appendNew<Value>(
+                    proc, opcode, Origin(),
+                    arg0,
+                    arg1),
+                arg2,
+                arg3));
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<double>()) {
+            for (auto& right : floatingPointOperands<double>()) {
+                double expected = operation(left.value, right.value) ? 42.5 : -66.5;
+                CHECK(isIdentical(invoke<double>(*code, left.value, right.value, 42.5, -66.5), expected));
+            }
+        }
+    }
+    { // Compare arguments and selected arguments are all different. "thenCase" is live after operation.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+        Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+        Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR2);
+        Value* arg3 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR3);
+
+        Value* result = root->appendNew<Value>(proc, Select, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), arg0, arg1),
+            arg2,
+            arg3);
+
+        PatchpointValue* keepValuesLive = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        keepValuesLive->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+        keepValuesLive->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<double>()) {
+            for (auto& right : floatingPointOperands<double>()) {
+                double expected = operation(left.value, right.value) ? 42.5 : -66.5;
+                CHECK(isIdentical(invoke<double>(*code, left.value, right.value, 42.5, -66.5), expected));
+            }
+        }
+    }
+    { // Compare arguments and selected arguments are all different. "elseCase" is live after operation.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+        Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+        Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR2);
+        Value* arg3 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR3);
+
+        Value* result = root->appendNew<Value>(proc, Select, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), arg0, arg1),
+            arg2,
+            arg3);
+
+        PatchpointValue* keepValuesLive = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        keepValuesLive->append(ConstrainedValue(arg3, ValueRep::SomeRegister));
+        keepValuesLive->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<double>()) {
+            for (auto& right : floatingPointOperands<double>()) {
+                double expected = operation(left.value, right.value) ? 42.5 : -66.5;
+                CHECK(isIdentical(invoke<double>(*code, left.value, right.value, 42.5, -66.5), expected));
+            }
+        }
+    }
+    { // Compare arguments and selected arguments are all different. Both cases are live after operation.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+        Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+        Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR2);
+        Value* arg3 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR3);
+
+        Value* result = root->appendNew<Value>(proc, Select, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), arg0, arg1),
+            arg2,
+            arg3);
+
+        PatchpointValue* keepValuesLive = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        keepValuesLive->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+        keepValuesLive->append(ConstrainedValue(arg3, ValueRep::SomeRegister));
+        keepValuesLive->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<double>()) {
+            for (auto& right : floatingPointOperands<double>()) {
+                double expected = operation(left.value, right.value) ? 42.5 : -66.5;
+                CHECK(isIdentical(invoke<double>(*code, left.value, right.value, 42.5, -66.5), expected));
+            }
+        }
+    }
+    { // The left argument is the same as the "elseCase" argument.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+        Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+        Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR2);
+
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, Select, Origin(),
+                root->appendNew<Value>(
+                    proc, opcode, Origin(),
+                    arg0,
+                    arg1),
+                arg2,
+                arg0));
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<double>()) {
+            for (auto& right : floatingPointOperands<double>()) {
+                double expected = operation(left.value, right.value) ? 42.5 : left.value;
+                CHECK(isIdentical(invoke<double>(*code, left.value, right.value, 42.5, left.value), expected));
+            }
+        }
+    }
+    { // The left argument is the same as the "elseCase" argument. "thenCase" is live after operation.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+        Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR1);
+        Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR2);
+
+        Value* result = root->appendNew<Value>(proc, Select, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), arg0, arg1),
+            arg2,
+            arg0);
+
+        PatchpointValue* keepValuesLive = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        keepValuesLive->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+        keepValuesLive->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<double>()) {
+            for (auto& right : floatingPointOperands<double>()) {
+                double expected = operation(left.value, right.value) ? 42.5 : left.value;
+                CHECK(isIdentical(invoke<double>(*code, left.value, right.value, 42.5, left.value), expected));
+            }
+        }
+    }
+}
+
+void testSelectDoubleCompareDoubleWithAliasing()
+{
+    testSelectDoubleCompareDouble<Equal>([](double a, double b) -> bool { return a == b; });
+    testSelectDoubleCompareDouble<NotEqual>([](double a, double b) -> bool { return a != b; });
+    testSelectDoubleCompareDouble<LessThan>([](double a, double b) -> bool { return a < b; });
+    testSelectDoubleCompareDouble<GreaterThan>([](double a, double b) -> bool { return a > b; });
+    testSelectDoubleCompareDouble<LessEqual>([](double a, double b) -> bool { return a <= b; });
+    testSelectDoubleCompareDouble<GreaterEqual>([](double a, double b) -> bool { return a >= b; });
+    testSelectDoubleCompareDouble<EqualOrUnordered>([](double a, double b) -> bool { return a != a || b != b || a == b; });
+}
+
+template<B3::Opcode opcode>
+void testSelectFloatCompareFloat(bool (*operation)(float, float))
+{
+    { // Compare arguments and selected arguments are all different.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+
+        Value* arg0 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+        Value* arg1 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+        Value* arg2 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+        Value* arg3 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3)));
+
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, Select, Origin(),
+                root->appendNew<Value>(
+                    proc, opcode, Origin(),
+                    arg0,
+                    arg1),
+                arg2,
+                arg3));
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<float>()) {
+            for (auto& right : floatingPointOperands<float>()) {
+                float expected = operation(left.value, right.value) ? 42.5 : -66.5;
+                CHECK(isIdentical(invoke<float>(*code, bitwise_cast<int32_t>(left.value), bitwise_cast<int32_t>(right.value), bitwise_cast<int32_t>(42.5f), bitwise_cast<int32_t>(-66.5f)), expected));
+            }
+        }
+    }
+    { // Compare arguments and selected arguments are all different. "thenCase" is live after operation.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+        Value* arg1 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+        Value* arg2 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+        Value* arg3 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3)));
+
+        Value* result = root->appendNew<Value>(proc, Select, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), arg0, arg1),
+            arg2,
+            arg3);
+
+        PatchpointValue* keepValuesLive = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        keepValuesLive->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+        keepValuesLive->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<float>()) {
+            for (auto& right : floatingPointOperands<float>()) {
+                float expected = operation(left.value, right.value) ? 42.5 : -66.5;
+                CHECK(isIdentical(invoke<float>(*code, bitwise_cast<int32_t>(left.value), bitwise_cast<int32_t>(right.value), bitwise_cast<int32_t>(42.5f), bitwise_cast<int32_t>(-66.5f)), expected));
+            }
+        }
+    }
+    { // Compare arguments and selected arguments are all different. "elseCase" is live after operation.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+        Value* arg1 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+        Value* arg2 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+        Value* arg3 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3)));
+
+        Value* result = root->appendNew<Value>(proc, Select, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), arg0, arg1),
+            arg2,
+            arg3);
+
+        PatchpointValue* keepValuesLive = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        keepValuesLive->append(ConstrainedValue(arg3, ValueRep::SomeRegister));
+        keepValuesLive->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<float>()) {
+            for (auto& right : floatingPointOperands<float>()) {
+                float expected = operation(left.value, right.value) ? 42.5 : -66.5;
+                CHECK(isIdentical(invoke<float>(*code, bitwise_cast<int32_t>(left.value), bitwise_cast<int32_t>(right.value), bitwise_cast<int32_t>(42.5f), bitwise_cast<int32_t>(-66.5f)), expected));
+            }
+        }
+    }
+    { // Compare arguments and selected arguments are all different. Both cases are live after operation.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+        Value* arg1 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+        Value* arg2 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+        Value* arg3 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3)));
+
+        Value* result = root->appendNew<Value>(proc, Select, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), arg0, arg1),
+            arg2,
+            arg3);
+
+        PatchpointValue* keepValuesLive = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        keepValuesLive->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+        keepValuesLive->append(ConstrainedValue(arg3, ValueRep::SomeRegister));
+        keepValuesLive->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<float>()) {
+            for (auto& right : floatingPointOperands<float>()) {
+                float expected = operation(left.value, right.value) ? 42.5 : -66.5;
+                CHECK(isIdentical(invoke<float>(*code, bitwise_cast<int32_t>(left.value), bitwise_cast<int32_t>(right.value), bitwise_cast<int32_t>(42.5f), bitwise_cast<int32_t>(-66.5f)), expected));
+            }
+        }
+    }
+    { // The left argument is the same as the "elseCase" argument.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+        Value* arg1 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+        Value* arg2 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+
+        root->appendNewControlValue(
+            proc, Return, Origin(),
+            root->appendNew<Value>(
+                proc, Select, Origin(),
+                root->appendNew<Value>(
+                    proc, opcode, Origin(),
+                    arg0,
+                    arg1),
+                arg2,
+                arg0));
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<float>()) {
+            for (auto& right : floatingPointOperands<float>()) {
+                float expected = operation(left.value, right.value) ? 42.5 : left.value;
+                CHECK(isIdentical(invoke<float>(*code, bitwise_cast<int32_t>(left.value), bitwise_cast<int32_t>(right.value), bitwise_cast<int32_t>(42.5f), bitwise_cast<int32_t>(left.value)), expected));
+            }
+        }
+    }
+    { // The left argument is the same as the "elseCase" argument. "thenCase" is live after operation.
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* arg0 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+        Value* arg1 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+        Value* arg2 = root->appendNew<Value>(proc, BitwiseCast, Origin(),
+            root->appendNew<Value>(proc, Trunc, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+
+        Value* result = root->appendNew<Value>(proc, Select, Origin(),
+            root->appendNew<Value>(proc, opcode, Origin(), arg0, arg1),
+            arg2,
+            arg0);
+
+        PatchpointValue* keepValuesLive = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        keepValuesLive->append(ConstrainedValue(arg2, ValueRep::SomeRegister));
+        keepValuesLive->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+
+        root->appendNewControlValue(proc, Return, Origin(), result);
+        auto code = compile(proc);
+
+        for (auto& left : floatingPointOperands<float>()) {
+            for (auto& right : floatingPointOperands<float>()) {
+                float expected = operation(left.value, right.value) ? 42.5 : left.value;
+                CHECK(isIdentical(invoke<float>(*code, bitwise_cast<int32_t>(left.value), bitwise_cast<int32_t>(right.value), bitwise_cast<int32_t>(42.5f), bitwise_cast<int32_t>(left.value)), expected));
+            }
+        }
+    }
+}
+
+void testSelectFloatCompareFloatWithAliasing()
+{
+    testSelectFloatCompareFloat<Equal>([](float a, float b) -> bool { return a == b; });
+    testSelectFloatCompareFloat<NotEqual>([](float a, float b) -> bool { return a != b; });
+    testSelectFloatCompareFloat<LessThan>([](float a, float b) -> bool { return a < b; });
+    testSelectFloatCompareFloat<GreaterThan>([](float a, float b) -> bool { return a > b; });
+    testSelectFloatCompareFloat<LessEqual>([](float a, float b) -> bool { return a <= b; });
+    testSelectFloatCompareFloat<GreaterEqual>([](float a, float b) -> bool { return a >= b; });
+    testSelectFloatCompareFloat<EqualOrUnordered>([](float a, float b) -> bool { return a != a || b != b || a == b; });
+}
+
+void testSelectFold(intptr_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, Equal, Origin(),
+                root->appendNew<ConstPtrValue>(proc, Origin(), value),
+                root->appendNew<ConstPtrValue>(proc, Origin(), 42)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+
+    auto code = compile(proc);
+    CHECK(invoke<intptr_t>(*code, 1, 2) == (value == 42 ? 1 : 2));
+    CHECK(invoke<intptr_t>(*code, 642462, 32533) == (value == 42 ? 642462 : 32533));
+}
+
+void testSelectInvert()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Select, Origin(),
+            root->appendNew<Value>(
+                proc, Equal, Origin(),
+                root->appendNew<Value>(
+                    proc, NotEqual, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                    root->appendNew<ConstPtrValue>(proc, Origin(), 42)),
+                root->appendNew<Const32Value>(proc, Origin(), 0)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2)));
+
+    auto code = compile(proc);
+    CHECK(invoke<intptr_t>(*code, 42, 1, 2) == 1);
+    CHECK(invoke<intptr_t>(*code, 42, 642462, 32533) == 642462);
+    CHECK(invoke<intptr_t>(*code, 43, 1, 2) == 2);
+    CHECK(invoke<intptr_t>(*code, 43, 642462, 32533) == 32533);
+}
+
+void testCheckSelect()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    CheckValue* check = root->appendNew<CheckValue>(
+        proc, Check, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(
+                proc, Select, Origin(),
+                root->appendNew<Value>(
+                    proc, BitAnd, Origin(),
+                    root->appendNew<Value>(
+                        proc, Trunc, Origin(),
+                        root->appendNew<ArgumentRegValue>(
+                            proc, Origin(), GPRInfo::argumentGPR0)),
+                    root->appendNew<Const32Value>(proc, Origin(), 0xff)),
+                root->appendNew<ConstPtrValue>(proc, Origin(), -42),
+                root->appendNew<ConstPtrValue>(proc, Origin(), 35)),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 42)));
+    unsigned generationCount = 0;
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+
+            generationCount++;
+            jit.move(CCallHelpers::TrustedImm32(666), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    CHECK(generationCount == 1);
+    CHECK(invoke<int>(*code, true) == 0);
+    CHECK(invoke<int>(*code, false) == 666);
+}
+
+void testCheckSelectCheckSelect()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    CheckValue* check = root->appendNew<CheckValue>(
+        proc, Check, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(
+                proc, Select, Origin(),
+                root->appendNew<Value>(
+                    proc, BitAnd, Origin(),
+                    root->appendNew<Value>(
+                        proc, Trunc, Origin(),
+                        root->appendNew<ArgumentRegValue>(
+                            proc, Origin(), GPRInfo::argumentGPR0)),
+                    root->appendNew<Const32Value>(proc, Origin(), 0xff)),
+                root->appendNew<ConstPtrValue>(proc, Origin(), -42),
+                root->appendNew<ConstPtrValue>(proc, Origin(), 35)),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 42)));
+
+    unsigned generationCount = 0;
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+
+            generationCount++;
+            jit.move(CCallHelpers::TrustedImm32(666), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    
+    CheckValue* check2 = root->appendNew<CheckValue>(
+        proc, Check, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(
+                proc, Select, Origin(),
+                root->appendNew<Value>(
+                    proc, BitAnd, Origin(),
+                    root->appendNew<Value>(
+                        proc, Trunc, Origin(),
+                        root->appendNew<ArgumentRegValue>(
+                            proc, Origin(), GPRInfo::argumentGPR1)),
+                    root->appendNew<Const32Value>(proc, Origin(), 0xff)),
+                root->appendNew<ConstPtrValue>(proc, Origin(), -43),
+                root->appendNew<ConstPtrValue>(proc, Origin(), 36)),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 43)));
+
+    unsigned generationCount2 = 0;
+    check2->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+
+            generationCount2++;
+            jit.move(CCallHelpers::TrustedImm32(667), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 0));
+
+    auto code = compile(proc);
+    CHECK(generationCount == 1);
+    CHECK(generationCount2 == 1);
+    CHECK(invoke<int>(*code, true, true) == 0);
+    CHECK(invoke<int>(*code, false, true) == 666);
+    CHECK(invoke<int>(*code, true, false) == 667);
+}
+
+double b3Pow(double x, int y)
+{
+    if (y < 0 || y > 1000)
+        return pow(x, y);
+    double result = 1;
+    while (y) {
+        if (y & 1)
+            result *= x;
+        x *= x;
+        y >>= 1;
+    }
+    return result;
+}
+
+void testPowDoubleByIntegerLoop(double xOperand, int32_t yOperand)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* x = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    Value* y = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    auto result = powDoubleInt32(proc, root, Origin(), x, y);
+    BasicBlock* continuation = result.first;
+    continuation->appendNewControlValue(proc, Return, Origin(), result.second);
+
+    CHECK(isIdentical(compileAndRun<double>(proc, xOperand, yOperand), b3Pow(xOperand, yOperand)));
+}
+
+void testTruncOrHigh()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<Value>(
+                proc, BitOr, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<Const64Value>(proc, Origin(), 0x100000000))));
+
+    int64_t value = 0x123456781234;
+    CHECK(compileAndRun<int>(proc, value) == 0x56781234);
+}
+
+void testTruncOrLow()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<Value>(
+                proc, BitOr, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<Const64Value>(proc, Origin(), 0x1000000))));
+
+    int64_t value = 0x123456781234;
+    CHECK(compileAndRun<int>(proc, value) == 0x57781234);
+}
+
+void testBitAndOrHigh()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Value>(
+                proc, BitOr, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<Const64Value>(proc, Origin(), 0x8)),
+            root->appendNew<Const64Value>(proc, Origin(), 0x777777777777)));
+
+    int64_t value = 0x123456781234;
+    CHECK(compileAndRun<int64_t>(proc, value) == 0x123456701234ll);
+}
+
+void testBitAndOrLow()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<Value>(
+                proc, BitOr, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<Const64Value>(proc, Origin(), 0x1)),
+            root->appendNew<Const64Value>(proc, Origin(), 0x777777777777)));
+
+    int64_t value = 0x123456781234;
+    CHECK(compileAndRun<int64_t>(proc, value) == 0x123456701235ll);
+}
+
+void testBranch64Equal(int64_t left, int64_t right)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(proc, Equal, Origin(), arg1, arg2),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    bool trueResult = true;
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            thenCase->appendNew<ConstPtrValue>(proc, Origin(), &trueResult)));
+
+    bool elseResult = false;
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            elseCase->appendNew<ConstPtrValue>(proc, Origin(), &elseResult)));
+
+    CHECK(compileAndRun<bool>(proc, left, right) == (left == right));
+}
+
+void testBranch64EqualImm(int64_t left, int64_t right)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ConstPtrValue>(proc, Origin(), right);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(proc, Equal, Origin(), arg1, arg2),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    bool trueResult = true;
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            thenCase->appendNew<ConstPtrValue>(proc, Origin(), &trueResult)));
+
+    bool elseResult = false;
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            elseCase->appendNew<ConstPtrValue>(proc, Origin(), &elseResult)));
+
+    CHECK(compileAndRun<bool>(proc, left) == (left == right));
+}
+
+void testBranch64EqualMem(int64_t left, int64_t right)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* arg1 = root->appendNew<MemoryValue>(
+        proc, Load, pointerType(), Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(proc, Equal, Origin(), arg1, arg2),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    bool trueResult = true;
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            thenCase->appendNew<ConstPtrValue>(proc, Origin(), &trueResult)));
+
+    bool elseResult = false;
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            elseCase->appendNew<ConstPtrValue>(proc, Origin(), &elseResult)));
+
+    CHECK(compileAndRun<bool>(proc, &left, right) == (left == right));
+}
+
+void testBranch64EqualMemImm(int64_t left, int64_t right)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+
+    Value* arg1 = root->appendNew<MemoryValue>(
+        proc, Load, pointerType(), Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg2 = root->appendNew<ConstPtrValue>(proc, Origin(), right);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(proc, Equal, Origin(), arg1, arg2),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    bool trueResult = true;
+    thenCase->appendNewControlValue(
+        proc, Return, Origin(),
+        thenCase->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            thenCase->appendNew<ConstPtrValue>(proc, Origin(), &trueResult)));
+
+    bool elseResult = false;
+    elseCase->appendNewControlValue(
+        proc, Return, Origin(),
+        elseCase->appendNew<MemoryValue>(
+            proc, Load8Z, Origin(),
+            elseCase->appendNew<ConstPtrValue>(proc, Origin(), &elseResult)));
+
+    CHECK(compileAndRun<bool>(proc, &left) == (left == right));
+}
+
+void testStore8Load8Z(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    
+    int8_t byte;
+    Value* ptr = root->appendNew<ConstPtrValue>(proc, Origin(), &byte);
+    
+    root->appendNew<MemoryValue>(
+        proc, Store8, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        ptr);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<MemoryValue>(proc, Load8Z, Origin(), ptr));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<uint8_t>(value));
+}
+
+void testStore16Load16Z(int32_t value)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    
+    int16_t byte;
+    Value* ptr = root->appendNew<ConstPtrValue>(proc, Origin(), &byte);
+    
+    root->appendNew<MemoryValue>(
+        proc, Store16, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        ptr);
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<MemoryValue>(proc, Load16Z, Origin(), ptr));
+
+    CHECK(compileAndRun<int32_t>(proc, value) == static_cast<uint16_t>(value));
+}
+
+void testSShrShl32(int32_t value, int32_t sshrAmount, int32_t shlAmount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(),
+            root->appendNew<Value>(
+                proc, Shl, Origin(),
+                root->appendNew<Value>(
+                    proc, Trunc, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+                root->appendNew<Const32Value>(proc, Origin(), shlAmount)),
+            root->appendNew<Const32Value>(proc, Origin(), sshrAmount)));
+
+    CHECK(
+        compileAndRun<int32_t>(proc, value)
+        == ((value << (shlAmount & 31)) >> (sshrAmount & 31)));
+}
+
+void testSShrShl64(int64_t value, int32_t sshrAmount, int32_t shlAmount)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(),
+            root->appendNew<Value>(
+                proc, Shl, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<Const32Value>(proc, Origin(), shlAmount)),
+            root->appendNew<Const32Value>(proc, Origin(), sshrAmount)));
+
+    CHECK(
+        compileAndRun<int64_t>(proc, value)
+        == ((value << (shlAmount & 63)) >> (sshrAmount & 63)));
+}
+
+template<typename T>
+void testRotR(T valueInt, int32_t shift)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    if (sizeof(T) == 4)
+        value = root->appendNew<Value>(proc, Trunc, Origin(), value);
+
+    Value* ammount = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    root->appendNewControlValue(proc, Return, Origin(),
+        root->appendNew<Value>(proc, RotR, Origin(), value, ammount));
+
+    CHECK_EQ(compileAndRun<T>(proc, valueInt, shift), rotateRight(valueInt, shift));
+}
+
+template<typename T>
+void testRotL(T valueInt, int32_t shift)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    if (sizeof(T) == 4)
+        value = root->appendNew<Value>(proc, Trunc, Origin(), value);
+
+    Value* ammount = root->appendNew<Value>(proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    root->appendNewControlValue(proc, Return, Origin(),
+        root->appendNew<Value>(proc, RotL, Origin(), value, ammount));
+
+    CHECK_EQ(compileAndRun<T>(proc, valueInt, shift), rotateLeft(valueInt, shift));
+}
+
+template<typename T>
+void testRotRWithImmShift(T valueInt, int32_t shift)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    if (sizeof(T) == 4)
+        value = root->appendNew<Value>(proc, Trunc, Origin(), value);
+
+    Value* ammount = root->appendIntConstant(proc, Origin(), Int32, shift);
+    root->appendNewControlValue(proc, Return, Origin(),
+        root->appendNew<Value>(proc, RotR, Origin(), value, ammount));
+
+    CHECK_EQ(compileAndRun<T>(proc, valueInt, shift), rotateRight(valueInt, shift));
+}
+
+template<typename T>
+void testRotLWithImmShift(T valueInt, int32_t shift)
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* value = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    if (sizeof(T) == 4)
+        value = root->appendNew<Value>(proc, Trunc, Origin(), value);
+
+    Value* ammount = root->appendIntConstant(proc, Origin(), Int32, shift);
+    root->appendNewControlValue(proc, Return, Origin(),
+        root->appendNew<Value>(proc, RotL, Origin(), value, ammount));
+
+    CHECK_EQ(compileAndRun<T>(proc, valueInt, shift), rotateLeft(valueInt, shift));
+}
+
+template<typename T>
+void testComputeDivisionMagic(T value, T magicMultiplier, unsigned shift)
+{
+    DivisionMagic<T> magic = computeDivisionMagic(value);
+    CHECK(magic.magicMultiplier == magicMultiplier);
+    CHECK(magic.shift == shift);
+}
+
+void testTrivialInfiniteLoop()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* loop = proc.addBlock();
+    root->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(loop));
+    loop->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(loop));
+
+    compile(proc);
+}
+
+void testFoldPathEqual()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenBlock = proc.addBlock();
+    BasicBlock* elseBlock = proc.addBlock();
+
+    Value* arg = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+
+    root->appendNewControlValue(
+        proc, Branch, Origin(), arg, FrequentedBlock(thenBlock), FrequentedBlock(elseBlock));
+
+    thenBlock->appendNewControlValue(
+        proc, Return, Origin(),
+        thenBlock->appendNew<Value>(
+            proc, Equal, Origin(), arg, thenBlock->appendNew<ConstPtrValue>(proc, Origin(), 0)));
+
+    elseBlock->appendNewControlValue(
+        proc, Return, Origin(),
+        elseBlock->appendNew<Value>(
+            proc, Equal, Origin(), arg, elseBlock->appendNew<ConstPtrValue>(proc, Origin(), 0)));
+
+    auto code = compile(proc);
+    CHECK(invoke<intptr_t>(*code, 0) == 1);
+    CHECK(invoke<intptr_t>(*code, 1) == 0);
+    CHECK(invoke<intptr_t>(*code, 42) == 0);
+}
+
+void testLShiftSelf32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, Shl, Origin(), arg, arg));
+
+    auto code = compile(proc);
+
+    auto check = [&] (int32_t value) {
+        CHECK(invoke<int32_t>(*code, value) == value << (value & 31));
+    };
+
+    check(0);
+    check(1);
+    check(31);
+    check(32);
+}
+
+void testRShiftSelf32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, SShr, Origin(), arg, arg));
+
+    auto code = compile(proc);
+
+    auto check = [&] (int32_t value) {
+        CHECK(invoke<int32_t>(*code, value) == value >> (value & 31));
+    };
+
+    check(0);
+    check(1);
+    check(31);
+    check(32);
+}
+
+void testURShiftSelf32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(proc, ZShr, Origin(), arg, arg));
+
+    auto code = compile(proc);
+
+    auto check = [&] (uint32_t value) {
+        CHECK(invoke<uint32_t>(*code, value) == value >> (value & 31));
+    };
+
+    check(0);
+    check(1);
+    check(31);
+    check(32);
+}
+
+void testLShiftSelf64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Shl, Origin(), arg, root->appendNew<Value>(proc, Trunc, Origin(), arg)));
+
+    auto code = compile(proc);
+
+    auto check = [&] (int64_t value) {
+        CHECK(invoke<int64_t>(*code, value) == value << (value & 63));
+    };
+
+    check(0);
+    check(1);
+    check(31);
+    check(32);
+    check(63);
+    check(64);
+}
+
+void testRShiftSelf64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, SShr, Origin(), arg, root->appendNew<Value>(proc, Trunc, Origin(), arg)));
+
+    auto code = compile(proc);
+
+    auto check = [&] (int64_t value) {
+        CHECK(invoke<int64_t>(*code, value) == value >> (value & 63));
+    };
+
+    check(0);
+    check(1);
+    check(31);
+    check(32);
+    check(63);
+    check(64);
+}
+
+void testURShiftSelf64()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    root->appendNewControlValue(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, ZShr, Origin(), arg, root->appendNew<Value>(proc, Trunc, Origin(), arg)));
+
+    auto code = compile(proc);
+
+    auto check = [&] (uint64_t value) {
+        CHECK(invoke<uint64_t>(*code, value) == value >> (value & 63));
+    };
+
+    check(0);
+    check(1);
+    check(31);
+    check(32);
+    check(63);
+    check(64);
+}
+
+void testPatchpointDoubleRegs()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    Value* arg = root->appendNew<ArgumentRegValue>(proc, Origin(), FPRInfo::argumentFPR0);
+    
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Double, Origin());
+    patchpoint->append(arg, ValueRep(FPRInfo::fpRegT0));
+    patchpoint->resultConstraint = ValueRep(FPRInfo::fpRegT0);
+
+    unsigned numCalls = 0;
+    patchpoint->setGenerator(
+        [&] (CCallHelpers&, const StackmapGenerationParams&) {
+            numCalls++;
+        });
+
+    root->appendNewControlValue(proc, Return, Origin(), patchpoint);
+
+    auto code = compile(proc);
+    CHECK(numCalls == 1);
+    CHECK(invoke<double>(*code, 42.5) == 42.5);
+}
+
+void testSpillDefSmallerThanUse()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    // Move32.
+    Value* arg32 = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* arg64 = root->appendNew<Value>(proc, ZExt32, Origin(), arg32);
+
+    // Make sure arg64 is on the stack.
+    PatchpointValue* forceSpill = root->appendNew<PatchpointValue>(proc, Int64, Origin());
+    RegisterSet clobberSet = RegisterSet::allGPRs();
+    clobberSet.exclude(RegisterSet::stackRegisters());
+    clobberSet.exclude(RegisterSet::reservedHardwareRegisters());
+    clobberSet.clear(GPRInfo::returnValueGPR); // Force the return value for aliasing below.
+    forceSpill->clobberLate(clobberSet);
+    forceSpill->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.xor64(params[0].gpr(), params[0].gpr());
+        });
+
+    // On x86, Sub admit an address for any operand. If it uses the stack, the top bits must be zero.
+    Value* result = root->appendNew<Value>(proc, Sub, Origin(), forceSpill, arg64);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    auto code = compile(proc);
+    CHECK(invoke<int64_t>(*code, 0xffffffff00000000) == 0);
+}
+
+void testSpillUseLargerThanDef()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* thenCase = proc.addBlock();
+    BasicBlock* elseCase = proc.addBlock();
+    BasicBlock* tail = proc.addBlock();
+
+    RegisterSet clobberSet = RegisterSet::allGPRs();
+    clobberSet.exclude(RegisterSet::stackRegisters());
+    clobberSet.exclude(RegisterSet::reservedHardwareRegisters());
+
+    Value* condition = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* argument = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    root->appendNewControlValue(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            condition),
+        FrequentedBlock(thenCase), FrequentedBlock(elseCase));
+
+    Value* truncated = thenCase->appendNew<Value>(proc, ZExt32, Origin(),
+        thenCase->appendNew<Value>(proc, Trunc, Origin(), argument));
+    UpsilonValue* thenResult = thenCase->appendNew<UpsilonValue>(proc, Origin(), truncated);
+    thenCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    UpsilonValue* elseResult = elseCase->appendNew<UpsilonValue>(proc, Origin(), argument);
+    elseCase->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(tail));
+
+    for (unsigned i = 0; i < 100; ++i) {
+        PatchpointValue* preventTailDuplication = tail->appendNew<PatchpointValue>(proc, Void, Origin());
+        preventTailDuplication->clobberLate(clobberSet);
+        preventTailDuplication->setGenerator([] (CCallHelpers&, const StackmapGenerationParams&) { });
+    }
+
+    PatchpointValue* forceSpill = tail->appendNew<PatchpointValue>(proc, Void, Origin());
+    forceSpill->clobberLate(clobberSet);
+    forceSpill->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            clobberSet.forEach([&] (Reg reg) {
+                jit.move(CCallHelpers::TrustedImm64(0xffffffffffffffff), reg.gpr());
+            });
+        });
+
+    Value* phi = tail->appendNew<Value>(proc, Phi, Int64, Origin());
+    thenResult->setPhi(phi);
+    elseResult->setPhi(phi);
+    tail->appendNewControlValue(proc, Return, Origin(), phi);
+
+    auto code = compile(proc);
+    CHECK(invoke<uint64_t>(*code, 1, 0xffffffff00000000) == 0);
+    CHECK(invoke<uint64_t>(*code, 0, 0xffffffff00000000) == 0xffffffff00000000);
+
+    // A second time since the previous run is still on the stack.
+    CHECK(invoke<uint64_t>(*code, 1, 0xffffffff00000000) == 0);
+
+}
+
+void testLateRegister()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    // This works by making all but 1 register be input to the first patchpoint as LateRegister.
+    // The other 1 register is just a regular Register input. We assert our result is the regular
+    // register input. There would be no other way for the register allocator to arrange things
+    // because LateRegister interferes with the result.
+    // Then, the second patchpoint takes the result of the first as an argument and asks for
+    // it in a register that was a LateRegister. This is to incentivize the register allocator
+    // to use that LateRegister as the result for the first patchpoint. But of course it can not do that.
+    // So it must issue a mov after the first patchpoint from the first's result into the second's input.
+
+    RegisterSet regs = RegisterSet::allGPRs();
+    regs.exclude(RegisterSet::stackRegisters());
+    regs.exclude(RegisterSet::reservedHardwareRegisters());
+    Vector<Value*> lateUseArgs;
+    unsigned result = 0;
+    for (GPRReg reg = CCallHelpers::firstRegister(); reg <= CCallHelpers::lastRegister(); reg = CCallHelpers::nextRegister(reg)) {
+        if (!regs.get(reg))
+            continue;
+        result++;
+        if (reg == GPRInfo::regT0)
+            continue;
+        Value* value = root->appendNew<Const64Value>(proc, Origin(), 1);
+        lateUseArgs.append(value);
+    }
+    Value* regularUse = root->appendNew<Const64Value>(proc, Origin(), 1);
+    PatchpointValue* firstPatchpoint = root->appendNew<PatchpointValue>(proc, Int64, Origin());
+    {
+        unsigned i = 0;
+        for (GPRReg reg = CCallHelpers::firstRegister(); reg <= CCallHelpers::lastRegister(); reg = CCallHelpers::nextRegister(reg)) {
+            if (!regs.get(reg))
+                continue;
+            if (reg == GPRInfo::regT0)
+                continue;
+            Value* value = lateUseArgs[i++];
+            firstPatchpoint->append(value, ValueRep::lateReg(reg));
+        }
+        firstPatchpoint->append(regularUse, ValueRep::reg(GPRInfo::regT0));
+    }
+
+    firstPatchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params[0].gpr() == GPRInfo::regT0);
+            // Note that regT0 should also start off as 1, so we're implicitly starting our add with 1, which is also an argument.
+            unsigned skipped = 0;
+            for (unsigned i = 1; i < params.size(); i++) {
+                if (params[i].gpr() == params[0].gpr()) {
+                    skipped = i;
+                    continue;
+                }
+                jit.add64(params[i].gpr(), params[0].gpr());
+            }
+            CHECK(!!skipped);
+        });
+
+    PatchpointValue* secondPatchpoint = root->appendNew<PatchpointValue>(proc, Int64, Origin());
+    secondPatchpoint->append(firstPatchpoint, ValueRep::reg(GPRInfo::regT1));
+    secondPatchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            CHECK(params[1].gpr() == GPRInfo::regT1);
+            jit.nop();
+            jit.nop();
+            jit.move(params[1].gpr(), params[0].gpr());
+            jit.nop();
+            jit.nop();
+        });
+    root->appendNewControlValue(proc, Return, Origin(), secondPatchpoint);
+    
+    auto code = compile(proc);
+    CHECK(invoke<uint64_t>(*code) == result);
+}
+
+void interpreterPrint(Vector<intptr_t>* stream, intptr_t value)
+{
+    stream->append(value);
+}
+
+void testInterpreter()
+{
+    // This implements a silly interpreter to test building custom switch statements using
+    // Patchpoint.
+    
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* dispatch = proc.addBlock();
+    BasicBlock* addToDataPointer = proc.addBlock();
+    BasicBlock* addToCodePointer = proc.addBlock();
+    BasicBlock* addToCodePointerTaken = proc.addBlock();
+    BasicBlock* addToCodePointerNotTaken = proc.addBlock();
+    BasicBlock* addToData = proc.addBlock();
+    BasicBlock* print = proc.addBlock();
+    BasicBlock* stop = proc.addBlock();
+    
+    Variable* dataPointer = proc.addVariable(pointerType());
+    Variable* codePointer = proc.addVariable(pointerType());
+    
+    root->appendNew<VariableValue>(
+        proc, Set, Origin(), dataPointer,
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNew<VariableValue>(
+        proc, Set, Origin(), codePointer,
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    Value* context = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+    root->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(dispatch));
+
+    // NOTE: It's totally valid for this patchpoint to be tail-duplicated.
+    Value* codePointerValue =
+        dispatch->appendNew<VariableValue>(proc, B3::Get, Origin(), codePointer);
+    Value* opcode = dispatch->appendNew<MemoryValue>(
+        proc, Load, pointerType(), Origin(), codePointerValue);
+    PatchpointValue* polyJump = dispatch->appendNew<PatchpointValue>(proc, Void, Origin());
+    polyJump->effects = Effects();
+    polyJump->effects.terminal = true;
+    polyJump->appendSomeRegister(opcode);
+    polyJump->clobber(RegisterSet::macroScratchRegisters());
+    polyJump->numGPScratchRegisters++;
+    dispatch->appendSuccessor(FrequentedBlock(addToDataPointer));
+    dispatch->appendSuccessor(FrequentedBlock(addToCodePointer));
+    dispatch->appendSuccessor(FrequentedBlock(addToData));
+    dispatch->appendSuccessor(FrequentedBlock(print));
+    dispatch->appendSuccessor(FrequentedBlock(stop));
+    
+    // Our "opcodes".
+    static const intptr_t AddDP = 0;
+    static const intptr_t AddCP = 1;
+    static const intptr_t Add = 2;
+    static const intptr_t Print = 3;
+    static const intptr_t Stop = 4;
+    
+    polyJump->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            Vector<Box<CCallHelpers::Label>> labels = params.successorLabels();
+
+            MacroAssemblerCodePtr* jumpTable = bitwise_cast<MacroAssemblerCodePtr*>(
+                params.proc().addDataSection(sizeof(MacroAssemblerCodePtr) * labels.size()));
+
+            jit.move(CCallHelpers::TrustedImmPtr(jumpTable), params.gpScratch(0));
+            jit.jump(CCallHelpers::BaseIndex(params.gpScratch(0), params[0].gpr(), CCallHelpers::timesPtr()));
+            
+            jit.addLinkTask(
+                [&, jumpTable, labels] (LinkBuffer& linkBuffer) {
+                    for (unsigned i = labels.size(); i--;)
+                        jumpTable[i] = linkBuffer.locationOf(*labels[i]);
+                });
+        });
+    
+    // AddDP <operand>: adds <operand> to DP.
+    codePointerValue =
+        addToDataPointer->appendNew<VariableValue>(proc, B3::Get, Origin(), codePointer);
+    addToDataPointer->appendNew<VariableValue>(
+        proc, Set, Origin(), dataPointer,
+        addToDataPointer->appendNew<Value>(
+            proc, B3::Add, Origin(),
+            addToDataPointer->appendNew<VariableValue>(proc, B3::Get, Origin(), dataPointer),
+            addToDataPointer->appendNew<Value>(
+                proc, Mul, Origin(),
+                addToDataPointer->appendNew<MemoryValue>(
+                    proc, Load, pointerType(), Origin(), codePointerValue, sizeof(intptr_t)),
+                addToDataPointer->appendIntConstant(
+                    proc, Origin(), pointerType(), sizeof(intptr_t)))));
+    addToDataPointer->appendNew<VariableValue>(
+        proc, Set, Origin(), codePointer,
+        addToDataPointer->appendNew<Value>(
+            proc, B3::Add, Origin(), codePointerValue,
+            addToDataPointer->appendIntConstant(
+                proc, Origin(), pointerType(), sizeof(intptr_t) * 2)));
+    addToDataPointer->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(dispatch));
+    
+    // AddCP <operand>: adds <operand> to CP if the current value at DP is non-zero, otherwise
+    // falls through normally.
+    codePointerValue =
+        addToCodePointer->appendNew<VariableValue>(proc, B3::Get, Origin(), codePointer);
+    Value* dataPointerValue =
+        addToCodePointer->appendNew<VariableValue>(proc, B3::Get, Origin(), dataPointer);
+    addToCodePointer->appendNewControlValue(
+        proc, Branch, Origin(),
+        addToCodePointer->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(), dataPointerValue),
+        FrequentedBlock(addToCodePointerTaken), FrequentedBlock(addToCodePointerNotTaken));
+    addToCodePointerTaken->appendNew<VariableValue>(
+        proc, Set, Origin(), codePointer,
+        addToCodePointerTaken->appendNew<Value>(
+            proc, B3::Add, Origin(), codePointerValue,
+            addToCodePointerTaken->appendNew<Value>(
+                proc, Mul, Origin(),
+                addToCodePointerTaken->appendNew<MemoryValue>(
+                    proc, Load, pointerType(), Origin(), codePointerValue, sizeof(intptr_t)),
+                addToCodePointerTaken->appendIntConstant(
+                    proc, Origin(), pointerType(), sizeof(intptr_t)))));
+    addToCodePointerTaken->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(dispatch));
+    addToCodePointerNotTaken->appendNew<VariableValue>(
+        proc, Set, Origin(), codePointer,
+        addToCodePointerNotTaken->appendNew<Value>(
+            proc, B3::Add, Origin(), codePointerValue,
+            addToCodePointerNotTaken->appendIntConstant(
+                proc, Origin(), pointerType(), sizeof(intptr_t) * 2)));
+    addToCodePointerNotTaken->appendNewControlValue(
+        proc, Jump, Origin(), FrequentedBlock(dispatch));
+
+    // Add <operand>: adds <operand> to the slot pointed to by DP.
+    codePointerValue = addToData->appendNew<VariableValue>(proc, B3::Get, Origin(), codePointer);
+    dataPointerValue = addToData->appendNew<VariableValue>(proc, B3::Get, Origin(), dataPointer);
+    addToData->appendNew<MemoryValue>(
+        proc, Store, Origin(),
+        addToData->appendNew<Value>(
+            proc, B3::Add, Origin(),
+            addToData->appendNew<MemoryValue>(
+                proc, Load, pointerType(), Origin(), dataPointerValue),
+            addToData->appendNew<MemoryValue>(
+                proc, Load, pointerType(), Origin(), codePointerValue, sizeof(intptr_t))),
+        dataPointerValue);
+    addToData->appendNew<VariableValue>(
+        proc, Set, Origin(), codePointer,
+        addToData->appendNew<Value>(
+            proc, B3::Add, Origin(), codePointerValue,
+            addToData->appendIntConstant(proc, Origin(), pointerType(), sizeof(intptr_t) * 2)));
+    addToData->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(dispatch));
+    
+    // Print: "prints" the value pointed to by DP. What this actually means is that the value is
+    // appended to the stream vector by the interpreterPrint function.
+    codePointerValue = print->appendNew<VariableValue>(proc, B3::Get, Origin(), codePointer);
+    dataPointerValue = print->appendNew<VariableValue>(proc, B3::Get, Origin(), dataPointer);
+    print->appendNew<CCallValue>(
+        proc, Void, Origin(),
+        print->appendNew<ConstPtrValue>(
+            proc, Origin(), bitwise_cast<void*>(interpreterPrint)),
+        context,
+        print->appendNew<MemoryValue>(proc, Load, pointerType(), Origin(), dataPointerValue));
+    print->appendNew<VariableValue>(
+        proc, Set, Origin(), codePointer,
+        print->appendNew<Value>(
+            proc, B3::Add, Origin(), codePointerValue,
+            print->appendIntConstant(proc, Origin(), pointerType(), sizeof(intptr_t))));
+    print->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(dispatch));
+    
+    // Stop: returns.
+    stop->appendNewControlValue(
+        proc, Return, Origin(),
+        stop->appendIntConstant(proc, Origin(), pointerType(), 0));
+    
+    auto interpreter = compile(proc);
+    
+    Vector<intptr_t> data;
+    Vector<intptr_t> code;
+    Vector<intptr_t> stream;
+    
+    data.append(1);
+    data.append(0);
+    
+    if (shouldBeVerbose())
+        dataLog("data = ", listDump(data), "\n");
+    
+    // We'll write a program that prints the numbers 1..100.
+    // We expect DP to point at #0.
+    code.append(AddCP);
+    code.append(6); // go to loop body
+    
+    // Loop re-entry:
+    // We expect DP to point at #1 and for #1 to be offset by -100.
+    code.append(Add);
+    code.append(100);
+    
+    code.append(AddDP);
+    code.append(-1);
+    
+    // Loop header:
+    // We expect DP to point at #0.
+    code.append(AddDP);
+    code.append(1);
+    
+    code.append(Add);
+    code.append(1);
+    
+    code.append(Print);
+    
+    code.append(Add);
+    code.append(-100);
+    
+    // We want to stop if it's zero and continue if it's non-zero. AddCP takes the branch if it's
+    // non-zero.
+    code.append(AddCP);
+    code.append(-11); // go to loop re-entry.
+    
+    code.append(Stop);
+    
+    if (shouldBeVerbose())
+        dataLog("code = ", listDump(code), "\n");
+    
+    CHECK(!invoke<intptr_t>(*interpreter, data.data(), code.data(), &stream));
+    
+    CHECK(stream.size() == 100);
+    for (unsigned i = 0; i < 100; ++i)
+        CHECK(stream[i] == i + 1);
+    
+    if (shouldBeVerbose())
+        dataLog("stream = ", listDump(stream), "\n");
+}
+
+void testReduceStrengthCheckBottomUseInAnotherBlock()
+{
+    Procedure proc;
+    
+    BasicBlock* one = proc.addBlock();
+    BasicBlock* two = proc.addBlock();
+    
+    CheckValue* check = one->appendNew<CheckValue>(
+        proc, Check, Origin(), one->appendNew<Const32Value>(proc, Origin(), 1));
+    check->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+
+            jit.move(CCallHelpers::TrustedImm32(666), GPRInfo::returnValueGPR);
+            jit.emitFunctionEpilogue();
+            jit.ret();
+        });
+    Value* arg = one->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    one->appendNewControlValue(proc, Jump, Origin(), FrequentedBlock(two));
+    
+    check = two->appendNew<CheckValue>(
+        proc, CheckAdd, Origin(), arg,
+        two->appendNew<ConstPtrValue>(proc, Origin(), 1));
+    check->setGenerator(
+        [&] (CCallHelpers&, const StackmapGenerationParams&) {
+            CHECK(!"Should not execute");
+        });
+    two->appendNewControlValue(proc, Return, Origin(), check);
+    
+    proc.resetReachability();
+    reduceStrength(proc);
+}
+
+void testResetReachabilityDanglingReference()
+{
+    Procedure proc;
+    
+    BasicBlock* one = proc.addBlock();
+    BasicBlock* two = proc.addBlock();
+    
+    UpsilonValue* upsilon = one->appendNew<UpsilonValue>(
+        proc, Origin(), one->appendNew<Const32Value>(proc, Origin(), 42));
+    one->appendNewControlValue(proc, Oops, Origin());
+    
+    Value* phi = two->appendNew<Value>(proc, Phi, Int32, Origin());
+    upsilon->setPhi(phi);
+    two->appendNewControlValue(proc, Oops, Origin());
+    
+    proc.resetReachability();
+    validate(proc);
+}
+
+void testEntrySwitchSimple()
+{
+    Procedure proc;
+    proc.setNumEntrypoints(3);
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* one = proc.addBlock();
+    BasicBlock* two = proc.addBlock();
+    BasicBlock* three = proc.addBlock();
+    
+    root->appendNew<Value>(proc, EntrySwitch, Origin());
+    root->appendSuccessor(FrequentedBlock(one));
+    root->appendSuccessor(FrequentedBlock(two));
+    root->appendSuccessor(FrequentedBlock(three));
+    
+    one->appendNew<Value>(
+        proc, Return, Origin(),
+        one->appendNew<Value>(
+            proc, Add, Origin(),
+            one->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            one->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+    
+    two->appendNew<Value>(
+        proc, Return, Origin(),
+        two->appendNew<Value>(
+            proc, Sub, Origin(),
+            two->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            two->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+    
+    three->appendNew<Value>(
+        proc, Return, Origin(),
+        three->appendNew<Value>(
+            proc, Mul, Origin(),
+            three->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            three->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+    
+    prepareForGeneration(proc);
+    
+    CCallHelpers jit(vm);
+    generate(proc, jit);
+    LinkBuffer linkBuffer(*vm, jit, nullptr);
+    CodeLocationLabel labelOne = linkBuffer.locationOf(proc.entrypointLabel(0));
+    CodeLocationLabel labelTwo = linkBuffer.locationOf(proc.entrypointLabel(1));
+    CodeLocationLabel labelThree = linkBuffer.locationOf(proc.entrypointLabel(2));
+    
+    MacroAssemblerCodeRef codeRef = FINALIZE_CODE(linkBuffer, ("testb3 compilation"));
+    
+    CHECK(invoke<int>(labelOne, 1, 2) == 3);
+    CHECK(invoke<int>(labelTwo, 1, 2) == -1);
+    CHECK(invoke<int>(labelThree, 1, 2) == 2);
+    CHECK(invoke<int>(labelOne, -1, 2) == 1);
+    CHECK(invoke<int>(labelTwo, -1, 2) == -3);
+    CHECK(invoke<int>(labelThree, -1, 2) == -2);
+}
+
+void testEntrySwitchNoEntrySwitch()
+{
+    Procedure proc;
+    proc.setNumEntrypoints(3);
+    
+    BasicBlock* root = proc.addBlock();
+    
+    root->appendNew<Value>(
+        proc, Return, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1)));
+    
+    prepareForGeneration(proc);
+    
+    CCallHelpers jit(vm);
+    generate(proc, jit);
+    LinkBuffer linkBuffer(*vm, jit, nullptr);
+    CodeLocationLabel labelOne = linkBuffer.locationOf(proc.entrypointLabel(0));
+    CodeLocationLabel labelTwo = linkBuffer.locationOf(proc.entrypointLabel(1));
+    CodeLocationLabel labelThree = linkBuffer.locationOf(proc.entrypointLabel(2));
+    
+    MacroAssemblerCodeRef codeRef = FINALIZE_CODE(linkBuffer, ("testb3 compilation"));
+    
+    CHECK_EQ(invoke<int>(labelOne, 1, 2), 3);
+    CHECK_EQ(invoke<int>(labelTwo, 1, 2), 3);
+    CHECK_EQ(invoke<int>(labelThree, 1, 2), 3);
+    CHECK_EQ(invoke<int>(labelOne, -1, 2), 1);
+    CHECK_EQ(invoke<int>(labelTwo, -1, 2), 1);
+    CHECK_EQ(invoke<int>(labelThree, -1, 2), 1);
+}
+
+void testEntrySwitchWithCommonPaths()
+{
+    Procedure proc;
+    proc.setNumEntrypoints(3);
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* one = proc.addBlock();
+    BasicBlock* two = proc.addBlock();
+    BasicBlock* three = proc.addBlock();
+    BasicBlock* end = proc.addBlock();
+    
+    root->appendNew<Value>(proc, EntrySwitch, Origin());
+    root->appendSuccessor(FrequentedBlock(one));
+    root->appendSuccessor(FrequentedBlock(two));
+    root->appendSuccessor(FrequentedBlock(three));
+    
+    UpsilonValue* upsilonOne = one->appendNew<UpsilonValue>(
+        proc, Origin(),
+        one->appendNew<Value>(
+            proc, Add, Origin(),
+            one->appendNew<Value>(
+                proc, Trunc, Origin(),
+                one->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            one->appendNew<Value>(
+                proc, Trunc, Origin(),
+                one->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+    one->appendNew<Value>(proc, Jump, Origin());
+    one->setSuccessors(FrequentedBlock(end));
+    
+    UpsilonValue* upsilonTwo = two->appendNew<UpsilonValue>(
+        proc, Origin(),
+        two->appendNew<Value>(
+            proc, Sub, Origin(),
+            two->appendNew<Value>(
+                proc, Trunc, Origin(),
+                two->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            two->appendNew<Value>(
+                proc, Trunc, Origin(),
+                two->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+    two->appendNew<Value>(proc, Jump, Origin());
+    two->setSuccessors(FrequentedBlock(end));
+    
+    UpsilonValue* upsilonThree = three->appendNew<UpsilonValue>(
+        proc, Origin(),
+        three->appendNew<Value>(
+            proc, Mul, Origin(),
+            three->appendNew<Value>(
+                proc, Trunc, Origin(),
+                three->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+            three->appendNew<Value>(
+                proc, Trunc, Origin(),
+                three->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+    three->appendNew<Value>(proc, Jump, Origin());
+    three->setSuccessors(FrequentedBlock(end));
+    
+    Value* phi = end->appendNew<Value>(proc, Phi, Int32, Origin());
+    upsilonOne->setPhi(phi);
+    upsilonTwo->setPhi(phi);
+    upsilonThree->setPhi(phi);
+    
+    end->appendNew<Value>(
+        proc, Return, Origin(),
+        end->appendNew<Value>(
+            proc, chill(Mod), Origin(),
+            phi, end->appendNew<Value>(
+                proc, Trunc, Origin(),
+                end->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2))));
+    
+    prepareForGeneration(proc);
+    
+    CCallHelpers jit(vm);
+    generate(proc, jit);
+    LinkBuffer linkBuffer(*vm, jit, nullptr);
+    CodeLocationLabel labelOne = linkBuffer.locationOf(proc.entrypointLabel(0));
+    CodeLocationLabel labelTwo = linkBuffer.locationOf(proc.entrypointLabel(1));
+    CodeLocationLabel labelThree = linkBuffer.locationOf(proc.entrypointLabel(2));
+    
+    MacroAssemblerCodeRef codeRef = FINALIZE_CODE(linkBuffer, ("testb3 compilation"));
+    
+    CHECK_EQ(invoke<int>(labelOne, 1, 2, 10), 3);
+    CHECK_EQ(invoke<int>(labelTwo, 1, 2, 10), -1);
+    CHECK_EQ(invoke<int>(labelThree, 1, 2, 10), 2);
+    CHECK_EQ(invoke<int>(labelOne, -1, 2, 10), 1);
+    CHECK_EQ(invoke<int>(labelTwo, -1, 2, 10), -3);
+    CHECK_EQ(invoke<int>(labelThree, -1, 2, 10), -2);
+    CHECK_EQ(invoke<int>(labelOne, 1, 2, 2), 1);
+    CHECK_EQ(invoke<int>(labelTwo, 1, 2, 2), -1);
+    CHECK_EQ(invoke<int>(labelThree, 1, 2, 2), 0);
+    CHECK_EQ(invoke<int>(labelOne, -1, 2, 2), 1);
+    CHECK_EQ(invoke<int>(labelTwo, -1, 2, 2), -1);
+    CHECK_EQ(invoke<int>(labelThree, -1, 2, 2), 0);
+    CHECK_EQ(invoke<int>(labelOne, 1, 2, 0), 0);
+    CHECK_EQ(invoke<int>(labelTwo, 1, 2, 0), 0);
+    CHECK_EQ(invoke<int>(labelThree, 1, 2, 0), 0);
+    CHECK_EQ(invoke<int>(labelOne, -1, 2, 0), 0);
+    CHECK_EQ(invoke<int>(labelTwo, -1, 2, 0), 0);
+    CHECK_EQ(invoke<int>(labelThree, -1, 2, 0), 0);
+}
+
+void testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint()
+{
+    Procedure proc;
+    proc.setNumEntrypoints(3);
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* negate = proc.addBlock();
+    BasicBlock* dispatch = proc.addBlock();
+    BasicBlock* one = proc.addBlock();
+    BasicBlock* two = proc.addBlock();
+    BasicBlock* three = proc.addBlock();
+    BasicBlock* end = proc.addBlock();
+
+    UpsilonValue* upsilonBase = root->appendNew<UpsilonValue>(
+        proc, Origin(), root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+    root->appendNew<Value>(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR3),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 0xff)));
+    root->setSuccessors(FrequentedBlock(negate), FrequentedBlock(dispatch));
+    
+    UpsilonValue* upsilonNegate = negate->appendNew<UpsilonValue>(
+        proc, Origin(),
+        negate->appendNew<Value>(
+            proc, Neg, Origin(),
+            negate->appendNew<Value>(
+                proc, Trunc, Origin(),
+                negate->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0))));
+    negate->appendNew<Value>(proc, Jump, Origin());
+    negate->setSuccessors(FrequentedBlock(dispatch));
+    
+    Value* arg0 = dispatch->appendNew<Value>(proc, Phi, Int32, Origin());
+    upsilonBase->setPhi(arg0);
+    upsilonNegate->setPhi(arg0);
+    dispatch->appendNew<Value>(proc, EntrySwitch, Origin());
+    dispatch->appendSuccessor(FrequentedBlock(one));
+    dispatch->appendSuccessor(FrequentedBlock(two));
+    dispatch->appendSuccessor(FrequentedBlock(three));
+    
+    UpsilonValue* upsilonOne = one->appendNew<UpsilonValue>(
+        proc, Origin(),
+        one->appendNew<Value>(
+            proc, Add, Origin(),
+            arg0, one->appendNew<Value>(
+                proc, Trunc, Origin(),
+                one->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+    one->appendNew<Value>(proc, Jump, Origin());
+    one->setSuccessors(FrequentedBlock(end));
+    
+    UpsilonValue* upsilonTwo = two->appendNew<UpsilonValue>(
+        proc, Origin(),
+        two->appendNew<Value>(
+            proc, Sub, Origin(),
+            arg0, two->appendNew<Value>(
+                proc, Trunc, Origin(),
+                two->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+    two->appendNew<Value>(proc, Jump, Origin());
+    two->setSuccessors(FrequentedBlock(end));
+    
+    UpsilonValue* upsilonThree = three->appendNew<UpsilonValue>(
+        proc, Origin(),
+        three->appendNew<Value>(
+            proc, Mul, Origin(),
+            arg0, three->appendNew<Value>(
+                proc, Trunc, Origin(),
+                three->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1))));
+    three->appendNew<Value>(proc, Jump, Origin());
+    three->setSuccessors(FrequentedBlock(end));
+    
+    Value* phi = end->appendNew<Value>(proc, Phi, Int32, Origin());
+    upsilonOne->setPhi(phi);
+    upsilonTwo->setPhi(phi);
+    upsilonThree->setPhi(phi);
+    
+    end->appendNew<Value>(
+        proc, Return, Origin(),
+        end->appendNew<Value>(
+            proc, chill(Mod), Origin(),
+            phi, end->appendNew<Value>(
+                proc, Trunc, Origin(),
+                end->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2))));
+    
+    prepareForGeneration(proc);
+    
+    CCallHelpers jit(vm);
+    generate(proc, jit);
+    LinkBuffer linkBuffer(*vm, jit, nullptr);
+    CodeLocationLabel labelOne = linkBuffer.locationOf(proc.entrypointLabel(0));
+    CodeLocationLabel labelTwo = linkBuffer.locationOf(proc.entrypointLabel(1));
+    CodeLocationLabel labelThree = linkBuffer.locationOf(proc.entrypointLabel(2));
+    
+    MacroAssemblerCodeRef codeRef = FINALIZE_CODE(linkBuffer, ("testb3 compilation"));
+    
+    CHECK_EQ(invoke<int>(labelOne, 1, 2, 10, false), 3);
+    CHECK_EQ(invoke<int>(labelTwo, 1, 2, 10, false), -1);
+    CHECK_EQ(invoke<int>(labelThree, 1, 2, 10, false), 2);
+    CHECK_EQ(invoke<int>(labelOne, -1, 2, 10, false), 1);
+    CHECK_EQ(invoke<int>(labelTwo, -1, 2, 10, false), -3);
+    CHECK_EQ(invoke<int>(labelThree, -1, 2, 10, false), -2);
+    CHECK_EQ(invoke<int>(labelOne, 1, 2, 10, true), 1);
+    CHECK_EQ(invoke<int>(labelTwo, 1, 2, 10, true), -3);
+    CHECK_EQ(invoke<int>(labelThree, 1, 2, 10, true), -2);
+    CHECK_EQ(invoke<int>(labelOne, -1, 2, 10, true), 3);
+    CHECK_EQ(invoke<int>(labelTwo, -1, 2, 10, true), -1);
+    CHECK_EQ(invoke<int>(labelThree, -1, 2, 10, true), 2);
+    CHECK_EQ(invoke<int>(labelOne, 1, 2, 2, false), 1);
+    CHECK_EQ(invoke<int>(labelTwo, 1, 2, 2, false), -1);
+    CHECK_EQ(invoke<int>(labelThree, 1, 2, 2, false), 0);
+    CHECK_EQ(invoke<int>(labelOne, -1, 2, 2, false), 1);
+    CHECK_EQ(invoke<int>(labelTwo, -1, 2, 2, false), -1);
+    CHECK_EQ(invoke<int>(labelThree, -1, 2, 2, false), 0);
+    CHECK_EQ(invoke<int>(labelOne, 1, 2, 0, false), 0);
+    CHECK_EQ(invoke<int>(labelTwo, 1, 2, 0, false), 0);
+    CHECK_EQ(invoke<int>(labelThree, 1, 2, 0, false), 0);
+    CHECK_EQ(invoke<int>(labelOne, -1, 2, 0, false), 0);
+    CHECK_EQ(invoke<int>(labelTwo, -1, 2, 0, false), 0);
+    CHECK_EQ(invoke<int>(labelThree, -1, 2, 0, false), 0);
+}
+
+void testEntrySwitchLoop()
+{
+    // This is a completely absurd use of EntrySwitch, where it impacts the loop condition. This
+    // should cause duplication of either nearly the entire Procedure. At time of writing, we ended
+    // up duplicating all of it, which is fine. It's important to test this case, to make sure that
+    // the duplication algorithm can handle interesting control flow.
+    
+    Procedure proc;
+    proc.setNumEntrypoints(2);
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* loopHeader = proc.addBlock();
+    BasicBlock* loopFooter = proc.addBlock();
+    BasicBlock* end = proc.addBlock();
+
+    UpsilonValue* initialValue = root->appendNew<UpsilonValue>(
+        proc, Origin(), root->appendNew<Value>(
+            proc, Trunc, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)));
+    root->appendNew<Value>(proc, Jump, Origin());
+    root->setSuccessors(loopHeader);
+    
+    Value* valueInLoop = loopHeader->appendNew<Value>(proc, Phi, Int32, Origin());
+    initialValue->setPhi(valueInLoop);
+    Value* newValue = loopHeader->appendNew<Value>(
+        proc, Add, Origin(), valueInLoop,
+        loopHeader->appendNew<Const32Value>(proc, Origin(), 1));
+    loopHeader->appendNew<Value>(proc, EntrySwitch, Origin());
+    loopHeader->appendSuccessor(end);
+    loopHeader->appendSuccessor(loopFooter);
+    
+    loopFooter->appendNew<UpsilonValue>(proc, Origin(), newValue, valueInLoop);
+    loopFooter->appendNew<Value>(
+        proc, Branch, Origin(),
+        loopFooter->appendNew<Value>(
+            proc, LessThan, Origin(), newValue,
+            loopFooter->appendNew<Const32Value>(proc, Origin(), 100)));
+    loopFooter->setSuccessors(loopHeader, end);
+    
+    end->appendNew<Value>(proc, Return, Origin(), newValue);
+    
+    prepareForGeneration(proc);
+    
+    CCallHelpers jit(vm);
+    generate(proc, jit);
+    LinkBuffer linkBuffer(*vm, jit, nullptr);
+    CodeLocationLabel labelOne = linkBuffer.locationOf(proc.entrypointLabel(0));
+    CodeLocationLabel labelTwo = linkBuffer.locationOf(proc.entrypointLabel(1));
+    
+    MacroAssemblerCodeRef codeRef = FINALIZE_CODE(linkBuffer, ("testb3 compilation"));
+
+    CHECK(invoke<int>(labelOne, 0) == 1);
+    CHECK(invoke<int>(labelOne, 42) == 43);
+    CHECK(invoke<int>(labelOne, 1000) == 1001);
+    
+    CHECK(invoke<int>(labelTwo, 0) == 100);
+    CHECK(invoke<int>(labelTwo, 42) == 100);
+    CHECK(invoke<int>(labelTwo, 1000) == 1001);
+}
+
+void testSomeEarlyRegister()
+{
+    auto run = [&] (bool succeed) {
+        Procedure proc;
+        
+        BasicBlock* root = proc.addBlock();
+        
+        PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+        patchpoint->resultConstraint = ValueRep::reg(GPRInfo::returnValueGPR);
+        bool ranFirstPatchpoint = false;
+        patchpoint->setGenerator(
+            [&] (CCallHelpers&, const StackmapGenerationParams& params) {
+                CHECK(params[0].gpr() == GPRInfo::returnValueGPR);
+                ranFirstPatchpoint = true;
+            });
+        
+        Value* arg = patchpoint;
+        
+        patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+        patchpoint->appendSomeRegister(arg);
+        if (succeed)
+            patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
+        bool ranSecondPatchpoint = false;
+        patchpoint->setGenerator(
+            [&] (CCallHelpers&, const StackmapGenerationParams& params) {
+                if (succeed)
+                    CHECK(params[0].gpr() != params[1].gpr());
+                else
+                    CHECK(params[0].gpr() == params[1].gpr());
+                ranSecondPatchpoint = true;
+            });
+        
+        root->appendNew<Value>(proc, Return, Origin(), patchpoint);
+        
+        compile(proc);
+        CHECK(ranFirstPatchpoint);
+        CHECK(ranSecondPatchpoint);
+    };
+    
+    run(true);
+    run(false);
+}
+
+void testBranchBitAndImmFusion(
+    B3::Opcode valueModifier, Type valueType, int64_t constant,
+    Air::Opcode expectedOpcode, Air::Arg::Kind firstKind)
+{
+    // Currently this test should pass on all CPUs. But some CPUs may not support this fused
+    // instruction. It's OK to skip this test on those CPUs.
+    
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* one = proc.addBlock();
+    BasicBlock* two = proc.addBlock();
+    
+    Value* left = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    
+    if (valueModifier != Identity) {
+        if (MemoryValue::accepts(valueModifier))
+            left = root->appendNew<MemoryValue>(proc, valueModifier, valueType, Origin(), left);
+        else
+            left = root->appendNew<Value>(proc, valueModifier, valueType, Origin(), left);
+    }
+    
+    root->appendNew<Value>(
+        proc, Branch, Origin(),
+        root->appendNew<Value>(
+            proc, BitAnd, Origin(), left,
+            root->appendIntConstant(proc, Origin(), valueType, constant)));
+    root->setSuccessors(FrequentedBlock(one), FrequentedBlock(two));
+    
+    one->appendNew<Value>(proc, Oops, Origin());
+    two->appendNew<Value>(proc, Oops, Origin());
+
+    lowerToAirForTesting(proc);
+
+    // The first basic block must end in a BranchTest64(resCond, tmp, bitImm).
+    Air::Inst terminal = proc.code()[0]->last();
+    CHECK_EQ(terminal.kind.opcode, expectedOpcode);
+    CHECK_EQ(terminal.args[0].kind(), Air::Arg::ResCond);
+    CHECK_EQ(terminal.args[1].kind(), firstKind);
+    CHECK(terminal.args[2].kind() == Air::Arg::BitImm || terminal.args[2].kind() == Air::Arg::BitImm64);
+}
+
+void testTerminalPatchpointThatNeedsToBeSpilled()
+{
+    // This is a unit test for how FTL's heap allocation fast paths behave.
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* success = proc.addBlock();
+    BasicBlock* slowPath = proc.addBlock();
+    
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->effects.terminal = true;
+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
+    
+    root->appendSuccessor(success);
+    root->appendSuccessor(FrequentedBlock(slowPath, FrequencyClass::Rare));
+    
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.move(CCallHelpers::TrustedImm32(42), params[0].gpr());
+            
+            CCallHelpers::Jump jumpToSuccess;
+            if (!params.fallsThroughToSuccessor(0))
+                jumpToSuccess = jit.jump();
+            
+            Vector<Box<CCallHelpers::Label>> labels = params.successorLabels();
+            
+            params.addLatePath(
+                [=] (CCallHelpers& jit) {
+                    if (jumpToSuccess.isSet())
+                        jumpToSuccess.linkTo(*labels[0], &jit);
+                });
+        });
+    
+    Vector<Value*> args;
+    {
+        RegisterSet fillAllGPRsSet = RegisterSet::allGPRs();
+        fillAllGPRsSet.exclude(RegisterSet::stackRegisters());
+        fillAllGPRsSet.exclude(RegisterSet::reservedHardwareRegisters());
+
+        for (unsigned i = 0; i < fillAllGPRsSet.numberOfSetRegisters(); i++)
+            args.append(success->appendNew<Const32Value>(proc, Origin(), i));
+    }
+
+    {
+        // Now force all values into every available register.
+        PatchpointValue* p = success->appendNew<PatchpointValue>(proc, Void, Origin());
+        for (Value* v : args)
+            p->append(v, ValueRep::SomeRegister);
+        p->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+    }
+
+    {
+        // Now require the original patchpoint to be materialized into a register.
+        PatchpointValue* p = success->appendNew<PatchpointValue>(proc, Void, Origin());
+        p->append(patchpoint, ValueRep::SomeRegister);
+        p->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+    }
+
+    success->appendNew<Value>(proc, Return, Origin(), success->appendNew<Const32Value>(proc, Origin(), 10));
+    
+    slowPath->appendNew<Value>(proc, Return, Origin(), slowPath->appendNew<Const32Value>(proc, Origin(), 20));
+    
+    auto code = compile(proc);
+    CHECK_EQ(invoke<int>(*code), 10);
+}
+
+void testTerminalPatchpointThatNeedsToBeSpilled2()
+{
+    // This is a unit test for how FTL's heap allocation fast paths behave.
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* one = proc.addBlock();
+    BasicBlock* success = proc.addBlock();
+    BasicBlock* slowPath = proc.addBlock();
+
+    Value* arg = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+
+    root->appendNew<Value>(
+        proc, Branch, Origin(), arg);
+    root->appendSuccessor(one);
+    root->appendSuccessor(FrequentedBlock(slowPath, FrequencyClass::Rare));
+    
+    PatchpointValue* patchpoint = one->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->effects.terminal = true;
+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    
+    one->appendSuccessor(success);
+    one->appendSuccessor(FrequentedBlock(slowPath, FrequencyClass::Rare));
+    
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            jit.move(CCallHelpers::TrustedImm32(666), params[0].gpr());
+            auto goToFastPath = jit.branch32(CCallHelpers::Equal, params[1].gpr(), CCallHelpers::TrustedImm32(42));
+            auto jumpToSlow = jit.jump();
+            
+            // Make sure the asserts here pass.
+            params.fallsThroughToSuccessor(0);
+            params.fallsThroughToSuccessor(1);
+
+            Vector<Box<CCallHelpers::Label>> labels = params.successorLabels();
+            
+            params.addLatePath(
+                [=] (CCallHelpers& jit) {
+                    goToFastPath.linkTo(*labels[0], &jit);
+                    jumpToSlow.linkTo(*labels[1], &jit);
+                });
+        });
+    
+    Vector<Value*> args;
+    {
+        RegisterSet fillAllGPRsSet = RegisterSet::allGPRs();
+        fillAllGPRsSet.exclude(RegisterSet::stackRegisters());
+        fillAllGPRsSet.exclude(RegisterSet::reservedHardwareRegisters());
+
+        for (unsigned i = 0; i < fillAllGPRsSet.numberOfSetRegisters(); i++)
+            args.append(success->appendNew<Const32Value>(proc, Origin(), i));
+    }
+
+    {
+        // Now force all values into every available register.
+        PatchpointValue* p = success->appendNew<PatchpointValue>(proc, Void, Origin());
+        for (Value* v : args)
+            p->append(v, ValueRep::SomeRegister);
+        p->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+    }
+
+    {
+        // Now require the original patchpoint to be materialized into a register.
+        PatchpointValue* p = success->appendNew<PatchpointValue>(proc, Void, Origin());
+        p->append(patchpoint, ValueRep::SomeRegister);
+        p->setGenerator([&] (CCallHelpers&, const StackmapGenerationParams&) { });
+    }
+
+    success->appendNew<Value>(proc, Return, Origin(), patchpoint);
+    
+    slowPath->appendNew<Value>(proc, Return, Origin(), arg);
+    
+    auto original1 = Options::maxB3TailDupBlockSize();
+    auto original2 = Options::maxB3TailDupBlockSuccessors();
+
+    // Tail duplication will break the critical edge we're trying to test because it
+    // will clone the slowPath block for both edges to it!
+    Options::maxB3TailDupBlockSize() = 0;
+    Options::maxB3TailDupBlockSuccessors() = 0;
+
+    auto code = compile(proc);
+    CHECK_EQ(invoke<int>(*code, 1), 1);
+    CHECK_EQ(invoke<int>(*code, 0), 0);
+    CHECK_EQ(invoke<int>(*code, 42), 666);
+
+    Options::maxB3TailDupBlockSize() = original1;
+    Options::maxB3TailDupBlockSuccessors() = original2;
+}
+
+void testPatchpointTerminalReturnValue(bool successIsRare)
+{
+    // This is a unit test for how FTL's heap allocation fast paths behave.
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* success = proc.addBlock();
+    BasicBlock* slowPath = proc.addBlock();
+    BasicBlock* continuation = proc.addBlock();
+    
+    Value* arg = root->appendNew<Value>(
+        proc, Trunc, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Int32, Origin());
+    patchpoint->effects.terminal = true;
+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
+    
+    if (successIsRare) {
+        root->appendSuccessor(FrequentedBlock(success, FrequencyClass::Rare));
+        root->appendSuccessor(slowPath);
+    } else {
+        root->appendSuccessor(success);
+        root->appendSuccessor(FrequentedBlock(slowPath, FrequencyClass::Rare));
+    }
+    
+    patchpoint->appendSomeRegister(arg);
+    
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            
+            CCallHelpers::Jump jumpToSlow =
+                jit.branch32(CCallHelpers::Above, params[1].gpr(), CCallHelpers::TrustedImm32(42));
+            
+            jit.add32(CCallHelpers::TrustedImm32(31), params[1].gpr(), params[0].gpr());
+            
+            CCallHelpers::Jump jumpToSuccess;
+            if (!params.fallsThroughToSuccessor(0))
+                jumpToSuccess = jit.jump();
+            
+            Vector<Box<CCallHelpers::Label>> labels = params.successorLabels();
+            
+            params.addLatePath(
+                [=] (CCallHelpers& jit) {
+                    jumpToSlow.linkTo(*labels[1], &jit);
+                    if (jumpToSuccess.isSet())
+                        jumpToSuccess.linkTo(*labels[0], &jit);
+                });
+        });
+    
+    UpsilonValue* successUpsilon = success->appendNew<UpsilonValue>(proc, Origin(), patchpoint);
+    success->appendNew<Value>(proc, Jump, Origin());
+    success->setSuccessors(continuation);
+    
+    UpsilonValue* slowPathUpsilon = slowPath->appendNew<UpsilonValue>(
+        proc, Origin(), slowPath->appendNew<Const32Value>(proc, Origin(), 666));
+    slowPath->appendNew<Value>(proc, Jump, Origin());
+    slowPath->setSuccessors(continuation);
+    
+    Value* phi = continuation->appendNew<Value>(proc, Phi, Int32, Origin());
+    successUpsilon->setPhi(phi);
+    slowPathUpsilon->setPhi(phi);
+    continuation->appendNew<Value>(proc, Return, Origin(), phi);
+    
+    auto code = compile(proc);
+    CHECK_EQ(invoke<int>(*code, 0), 31);
+    CHECK_EQ(invoke<int>(*code, 1), 32);
+    CHECK_EQ(invoke<int>(*code, 41), 72);
+    CHECK_EQ(invoke<int>(*code, 42), 73);
+    CHECK_EQ(invoke<int>(*code, 43), 666);
+    CHECK_EQ(invoke<int>(*code, -1), 666);
+}
+
+void testMemoryFence()
+{
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    
+    root->appendNew<FenceValue>(proc, Origin());
+    root->appendNew<Value>(proc, Return, Origin(), root->appendIntConstant(proc, Origin(), Int32, 42));
+    
+    auto code = compile(proc);
+    CHECK_EQ(invoke<int>(*code), 42);
+    if (isX86())
+        checkUsesInstruction(*code, "lock or $0x0, (%rsp)");
+    if (isARM64())
+        checkUsesInstruction(*code, "dmb    ish");
+    checkDoesNotUseInstruction(*code, "mfence");
+    checkDoesNotUseInstruction(*code, "dmb    ishst");
+}
+
+void testStoreFence()
+{
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    
+    root->appendNew<FenceValue>(proc, Origin(), HeapRange::top(), HeapRange());
+    root->appendNew<Value>(proc, Return, Origin(), root->appendIntConstant(proc, Origin(), Int32, 42));
+    
+    auto code = compile(proc);
+    CHECK_EQ(invoke<int>(*code), 42);
+    checkDoesNotUseInstruction(*code, "lock");
+    checkDoesNotUseInstruction(*code, "mfence");
+    if (isARM64())
+        checkUsesInstruction(*code, "dmb    ishst");
+}
+
+void testLoadFence()
+{
+    Procedure proc;
+    
+    BasicBlock* root = proc.addBlock();
+    
+    root->appendNew<FenceValue>(proc, Origin(), HeapRange(), HeapRange::top());
+    root->appendNew<Value>(proc, Return, Origin(), root->appendIntConstant(proc, Origin(), Int32, 42));
+    
+    auto code = compile(proc);
+    CHECK_EQ(invoke<int>(*code), 42);
+    checkDoesNotUseInstruction(*code, "lock");
+    checkDoesNotUseInstruction(*code, "mfence");
+    if (isARM64())
+        checkUsesInstruction(*code, "dmb    ish");
+    checkDoesNotUseInstruction(*code, "dmb    ishst");
+}
+
+void testTrappingLoad()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int x = 42;
+    MemoryValue* value = root->appendNew<MemoryValue>(
+        proc, trapping(Load), Int32, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), &x));
+    Effects expectedEffects;
+    expectedEffects.exitsSideways = true;
+    expectedEffects.controlDependent= true;
+    expectedEffects.reads = HeapRange::top();
+    CHECK_EQ(value->range(), HeapRange::top());
+    CHECK_EQ(value->effects(), expectedEffects);
+    value->setRange(HeapRange(0));
+    CHECK_EQ(value->range(), HeapRange(0));
+    CHECK_EQ(value->effects(), expectedEffects); // We still reads top!
+    root->appendNew<Value>(proc, Return, Origin(), value);
+    CHECK_EQ(compileAndRun<int>(proc), 42);
+    unsigned trapsCount = 0;
+    for (Air::BasicBlock* block : proc.code()) {
+        for (Air::Inst& inst : *block) {
+            if (inst.kind.traps)
+                trapsCount++;
+        }
+    }
+    CHECK_EQ(trapsCount, 1u);
+}
+
+void testTrappingStore()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int x = 42;
+    MemoryValue* value = root->appendNew<MemoryValue>(
+        proc, trapping(Store), Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 111),
+        root->appendNew<ConstPtrValue>(proc, Origin(), &x));
+    Effects expectedEffects;
+    expectedEffects.exitsSideways = true;
+    expectedEffects.controlDependent= true;
+    expectedEffects.reads = HeapRange::top();
+    expectedEffects.writes = HeapRange::top();
+    CHECK_EQ(value->range(), HeapRange::top());
+    CHECK_EQ(value->effects(), expectedEffects);
+    value->setRange(HeapRange(0));
+    CHECK_EQ(value->range(), HeapRange(0));
+    expectedEffects.writes = HeapRange(0);
+    CHECK_EQ(value->effects(), expectedEffects); // We still reads top!
+    root->appendNew<Value>(proc, Return, Origin());
+    compileAndRun<int>(proc);
+    CHECK_EQ(x, 111);
+    unsigned trapsCount = 0;
+    for (Air::BasicBlock* block : proc.code()) {
+        for (Air::Inst& inst : *block) {
+            if (inst.kind.traps)
+                trapsCount++;
+        }
+    }
+    CHECK_EQ(trapsCount, 1u);
+}
+
+void testTrappingLoadAddStore()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int x = 42;
+    ConstPtrValue* ptr = root->appendNew<ConstPtrValue>(proc, Origin(), &x);
+    root->appendNew<MemoryValue>(
+        proc, trapping(Store), Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<MemoryValue>(proc, trapping(Load), Int32, Origin(), ptr),
+            root->appendNew<Const32Value>(proc, Origin(), 3)),
+        ptr);
+    root->appendNew<Value>(proc, Return, Origin());
+    compileAndRun<int>(proc);
+    CHECK_EQ(x, 45);
+    bool traps = false;
+    for (Air::BasicBlock* block : proc.code()) {
+        for (Air::Inst& inst : *block) {
+            if (inst.kind.traps)
+                traps = true;
+        }
+    }
+    CHECK(traps);
+}
+
+void testTrappingLoadDCE()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int x = 42;
+    root->appendNew<MemoryValue>(
+        proc, trapping(Load), Int32, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), &x));
+    root->appendNew<Value>(proc, Return, Origin());
+    compileAndRun<int>(proc);
+    unsigned trapsCount = 0;
+    for (Air::BasicBlock* block : proc.code()) {
+        for (Air::Inst& inst : *block) {
+            if (inst.kind.traps)
+                trapsCount++;
+        }
+    }
+    CHECK_EQ(trapsCount, 1u);
+}
+
+void testTrappingStoreElimination()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    int x = 42;
+    Value* ptr = root->appendNew<ConstPtrValue>(proc, Origin(), &x);
+    root->appendNew<MemoryValue>(
+        proc, trapping(Store), Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 43),
+        ptr);
+    root->appendNew<MemoryValue>(
+        proc, trapping(Store), Origin(),
+        root->appendNew<Const32Value>(proc, Origin(), 44),
+        ptr);
+    root->appendNew<Value>(proc, Return, Origin());
+    compileAndRun<int>(proc);
+    unsigned storeCount = 0;
+    for (Value* value : proc.values()) {
+        if (MemoryValue::isStore(value->opcode()))
+            storeCount++;
+    }
+    CHECK_EQ(storeCount, 2u);
+}
+
+void testMoveConstants()
+{
+    auto check = [] (Procedure& proc) {
+        proc.resetReachability();
+        
+        if (shouldBeVerbose()) {
+            dataLog("IR before:\n");
+            dataLog(proc);
+        }
+        
+        moveConstants(proc);
+        
+        if (shouldBeVerbose()) {
+            dataLog("IR after:\n");
+            dataLog(proc);
+        }
+        
+        UseCounts useCounts(proc);
+        unsigned count = 0;
+        for (Value* value : proc.values()) {
+            if (useCounts.numUses(value) && value->hasInt64())
+                count++;
+        }
+        
+        if (count == 1)
+            return;
+        
+        crashLock.lock();
+        dataLog("Fail in testMoveConstants: got more than one Const64:\n");
+        dataLog(proc);
+        CRASH();
+    };
+
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* a = root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(), 
+            root->appendNew<ConstPtrValue>(proc, Origin(), 0x123412341234));
+        Value* b = root->appendNew<MemoryValue>(
+            proc, Load, pointerType(), Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), 0x123412341334));
+        root->appendNew<CCallValue>(proc, Void, Origin(), a, b);
+        root->appendNew<Value>(proc, Return, Origin());
+        check(proc);
+    }
+    
+    {
+        Procedure proc;
+        BasicBlock* root = proc.addBlock();
+        Value* x = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        Value* a = root->appendNew<Value>(
+            proc, Add, Origin(), x, root->appendNew<ConstPtrValue>(proc, Origin(), 0x123412341234));
+        Value* b = root->appendNew<Value>(
+            proc, Add, Origin(), x, root->appendNew<ConstPtrValue>(proc, Origin(), -0x123412341234));
+        root->appendNew<CCallValue>(proc, Void, Origin(), a, b);
+        root->appendNew<Value>(proc, Return, Origin());
+        check(proc);
+    }
+}
+
+void testPCOriginMapDoesntInsertNops()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+
+    CCallHelpers::Label watchpointLabel;
+
+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            watchpointLabel = jit.watchpointLabel();
+        });
+
+    patchpoint = root->appendNew<PatchpointValue>(proc, Void, Origin());
+    patchpoint->setGenerator(
+        [&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            CCallHelpers::Label labelIgnoringWatchpoints = jit.labelIgnoringWatchpoints();
+
+            CHECK(watchpointLabel == labelIgnoringWatchpoints);
+        });
+
+    root->appendNew<Value>(proc, Return, Origin());
+
+    compile(proc);
+}
+
+void testPinRegisters()
+{
+    auto go = [&] (bool pin) {
+        Procedure proc;
+        RegisterSet csrs;
+        csrs.merge(RegisterSet::calleeSaveRegisters());
+        csrs.exclude(RegisterSet::stackRegisters());
+        if (pin) {
+            csrs.forEach(
+                [&] (Reg reg) {
+                    proc.pinRegister(reg);
+                });
+        }
+        BasicBlock* root = proc.addBlock();
+        Value* a = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+        Value* b = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+        Value* c = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR2);
+        Value* d = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::regCS0);
+        root->appendNew<CCallValue>(
+            proc, Void, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), static_cast<intptr_t>(0x1234)));
+        root->appendNew<CCallValue>(
+            proc, Void, Origin(),
+            root->appendNew<ConstPtrValue>(proc, Origin(), static_cast<intptr_t>(0x1235)),
+            a, b, c);
+        PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Void, Origin());
+        patchpoint->appendSomeRegister(d);
+        patchpoint->setGenerator(
+            [&] (CCallHelpers&, const StackmapGenerationParams& params) {
+                CHECK_EQ(params[0].gpr(), GPRInfo::regCS0);
+            });
+        root->appendNew<Value>(proc, Return, Origin());
+        auto code = compile(proc);
+        bool usesCSRs = false;
+        for (Air::BasicBlock* block : proc.code()) {
+            for (Air::Inst& inst : *block) {
+                if (inst.kind.opcode == Air::Patch && inst.origin == patchpoint)
+                    continue;
+                inst.forEachTmpFast(
+                    [&] (Air::Tmp tmp) {
+                        if (tmp.isReg())
+                            usesCSRs |= csrs.get(tmp.reg());
+                    });
+            }
+        }
+        for (const RegisterAtOffset& regAtOffset : proc.calleeSaveRegisters())
+            usesCSRs |= csrs.get(regAtOffset.reg());
+        CHECK_EQ(usesCSRs, !pin);
+    };
+    
+    go(true);
+    go(false);
+}
+
+void testX86LeaAddAddShlLeft()
+{
+    // Add(Add(Shl(@x, $c), @y), $d)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<Value>(
+                proc, Shl, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+                root->appendNew<Const32Value>(proc, Origin(), 2)),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<ConstPtrValue>(proc, Origin(), 100));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    checkUsesInstruction(*code, "lea 0x64(%rdi,%rsi,4), %rax");
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), (1 + (2 << 2)) + 100);
+}
+
+void testX86LeaAddAddShlRight()
+{
+    // Add(Add(@x, Shl(@y, $c)), $d)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+            root->appendNew<Value>(
+                proc, Shl, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+                root->appendNew<Const32Value>(proc, Origin(), 2))),
+        root->appendNew<ConstPtrValue>(proc, Origin(), 100));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    checkUsesInstruction(*code, "lea 0x64(%rdi,%rsi,4), %rax");
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), (1 + (2 << 2)) + 100);
+}
+
+void testX86LeaAddAdd()
+{
+    // Add(Add(@x, @y), $c)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<Value>(
+            proc, Add, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0)),
+        root->appendNew<ConstPtrValue>(proc, Origin(), 100));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    checkDisassembly(
+        *code,
+        [&] (const char* disassembly) -> bool {
+            return strstr(disassembly, "lea 0x64(%rdi,%rsi), %rax")
+                || strstr(disassembly, "lea 0x64(%rsi,%rdi), %rax");
+        },
+        "Expected to find something like lea 0x64(%rdi,%rsi), %rax but didn't!");
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), (1 + 2) + 100);
+}
+
+void testX86LeaAddShlRight()
+{
+    // Add(Shl(@x, $c), @y)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<Const32Value>(proc, Origin(), 2)));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    checkUsesInstruction(*code, "lea (%rdi,%rsi,4), %rax");
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), 1 + (2 << 2));
+}
+
+void testX86LeaAddShlLeftScale1()
+{
+    // Add(Shl(@x, $c), @y)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<Const32Value>(proc, Origin(), 0)));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    checkDisassembly(
+        *code,
+        [&] (const char* disassembly) -> bool {
+            return strstr(disassembly, "lea (%rdi,%rsi), %rax")
+                || strstr(disassembly, "lea (%rsi,%rdi), %rax");
+        },
+        "Expected to find something like lea (%rdi,%rsi), %rax but didn't!");
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), 1 + 2);
+}
+
+void testX86LeaAddShlLeftScale2()
+{
+    // Add(Shl(@x, $c), @y)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<Const32Value>(proc, Origin(), 1)));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    checkUsesInstruction(*code, "lea (%rdi,%rsi,2), %rax");
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), 1 + (2 << 1));
+}
+
+void testX86LeaAddShlLeftScale4()
+{
+    // Add(Shl(@x, $c), @y)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<Const32Value>(proc, Origin(), 2)),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    checkUsesInstruction(*code, "lea (%rdi,%rsi,4), %rax");
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), 1 + (2 << 2));
+}
+
+void testX86LeaAddShlLeftScale8()
+{
+    // Add(Shl(@x, $c), @y)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<Const32Value>(proc, Origin(), 3)));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    checkUsesInstruction(*code, "lea (%rdi,%rsi,8), %rax");
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), 1 + (2 << 3));
+}
+
+void testAddShl32()
+{
+    // Add(Shl(@x, $c), @y)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<Const32Value>(proc, Origin(), 32)));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), 1 + (static_cast<intptr_t>(2) << static_cast<intptr_t>(32)));
+}
+
+void testAddShl64()
+{
+    // Add(Shl(@x, $c), @y)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<Const32Value>(proc, Origin(), 64)));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), 1 + 2);
+}
+
+void testAddShl65()
+{
+    // Add(Shl(@x, $c), @y)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* result = root->appendNew<Value>(
+        proc, Add, Origin(),
+        root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+        root->appendNew<Value>(
+            proc, Shl, Origin(),
+            root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+            root->appendNew<Const32Value>(proc, Origin(), 65)));
+    root->appendNew<Value>(proc, Return, Origin(), result);
+    
+    auto code = compile(proc);
+    CHECK_EQ(invoke<intptr_t>(*code, 1, 2), 1 + (2 << 1));
+}
+
+void testReduceStrengthReassociation(bool flip)
+{
+    // Add(Add(@x, $c), @y) -> Add(Add(@x, @y), $c)
+    // and
+    // Add(@y, Add(@x, $c)) -> Add(Add(@x, @y), $c)
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* arg2 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1);
+    
+    Value* innerAdd = root->appendNew<Value>(
+        proc, Add, Origin(), arg1,
+        root->appendNew<ConstPtrValue>(proc, Origin(), 42));
+    
+    Value* outerAdd;
+    if (flip)
+        outerAdd = root->appendNew<Value>(proc, Add, Origin(), arg2, innerAdd);
+    else
+        outerAdd = root->appendNew<Value>(proc, Add, Origin(), innerAdd, arg2);
+    
+    root->appendNew<Value>(proc, Return, Origin(), outerAdd);
+    
+    proc.resetReachability();
+
+    if (shouldBeVerbose()) {
+        dataLog("IR before reduceStrength:\n");
+        dataLog(proc);
+    }
+    
+    reduceStrength(proc);
+    
+    if (shouldBeVerbose()) {
+        dataLog("IR after reduceStrength:\n");
+        dataLog(proc);
+    }
+    
+    CHECK_EQ(root->last()->opcode(), Return);
+    CHECK_EQ(root->last()->child(0)->opcode(), Add);
+    CHECK(root->last()->child(0)->child(1)->isIntPtr(42));
+    CHECK_EQ(root->last()->child(0)->child(0)->opcode(), Add);
+    CHECK(
+        (root->last()->child(0)->child(0)->child(0) == arg1 && root->last()->child(0)->child(0)->child(1) == arg2) ||
+        (root->last()->child(0)->child(0)->child(0) == arg2 && root->last()->child(0)->child(0)->child(1) == arg1));
+}
+
+void testLoadBaseIndexShift2()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNew<Value>(
+        proc, Return, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, Int32, Origin(),
+            root->appendNew<Value>(
+                proc, Add, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<Value>(
+                    proc, Shl, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+                    root->appendNew<Const32Value>(proc, Origin(), 2)))));
+    auto code = compile(proc);
+    if (isX86())
+        checkUsesInstruction(*code, "(%rdi,%rsi,4)");
+    int32_t value = 12341234;
+    char* ptr = bitwise_cast<char*>(&value);
+    for (unsigned i = 0; i < 10; ++i)
+        CHECK_EQ(invoke<int32_t>(*code, ptr - (static_cast<intptr_t>(1) << static_cast<intptr_t>(2)) * i, i), 12341234);
+}
+
+void testLoadBaseIndexShift32()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNew<Value>(
+        proc, Return, Origin(),
+        root->appendNew<MemoryValue>(
+            proc, Load, Int32, Origin(),
+            root->appendNew<Value>(
+                proc, Add, Origin(),
+                root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0),
+                root->appendNew<Value>(
+                    proc, Shl, Origin(),
+                    root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1),
+                    root->appendNew<Const32Value>(proc, Origin(), 32)))));
+    auto code = compile(proc);
+    int32_t value = 12341234;
+    char* ptr = bitwise_cast<char*>(&value);
+    for (unsigned i = 0; i < 10; ++i)
+        CHECK_EQ(invoke<int32_t>(*code, ptr - (static_cast<intptr_t>(1) << static_cast<intptr_t>(32)) * i, i), 12341234);
+}
+
+void testOptimizeMaterialization()
+{
+    Procedure proc;
+    BasicBlock* root = proc.addBlock();
+    root->appendNew<CCallValue>(
+        proc, Void, Origin(),
+        root->appendNew<ConstPtrValue>(proc, Origin(), 0x123423453456llu),
+        root->appendNew<ConstPtrValue>(proc, Origin(), 0x123423453456llu + 35));
+    root->appendNew<Value>(proc, Return, Origin());
+    
+    auto code = compile(proc);
+    bool found = false;
+    for (Air::BasicBlock* block : proc.code()) {
+        for (Air::Inst& inst : *block) {
+            if (inst.kind.opcode != Air::Add64)
+                continue;
+            if (inst.args[0] != Air::Arg::imm(35))
+                continue;
+            found = true;
+        }
+    }
+    CHECK(found);
+}
+
+void testWasmBoundsCheck(unsigned offset)
+{
+    Procedure proc;
+    GPRReg pinned = GPRInfo::argumentGPR1;
+    proc.pinRegister(pinned);
+
+    proc.setWasmBoundsCheckGenerator([=] (CCallHelpers& jit, GPRReg pinnedGPR, unsigned actualOffset) {
+        CHECK_EQ(pinnedGPR, pinned);
+        CHECK_EQ(actualOffset, offset);
+
+        // This should always work because a function this simple should never have callee
+        // saves.
+        jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+        jit.emitFunctionEpilogue();
+        jit.ret();
+    });
+
+    BasicBlock* root = proc.addBlock();
+    Value* left = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    if (pointerType() != Int32)
+        left = root->appendNew<Value>(proc, Trunc, Origin(), left);
+    root->appendNew<WasmBoundsCheckValue>(proc, Origin(), left, pinned, offset);
+    Value* result = root->appendNew<Const32Value>(proc, Origin(), 0x42);
+    root->appendNewControlValue(proc, Return, Origin(), result);
+
+    auto code = compile(proc);
+    CHECK_EQ(invoke<int32_t>(*code, 1, 2 + offset), 0x42);
+    CHECK_EQ(invoke<int32_t>(*code, 3, 2 + offset), 42);
+    CHECK_EQ(invoke<int32_t>(*code, 2, 2 + offset), 42);
+}
+
+void testWasmAddress()
+{
+    Procedure proc;
+    GPRReg pinnedGPR = GPRInfo::argumentGPR2;
+    proc.pinRegister(pinnedGPR);
+
+    unsigned loopCount = 100;
+    Vector<unsigned> values(loopCount);
+    unsigned numToStore = 42;
+
+    BasicBlock* root = proc.addBlock();
+    BasicBlock* header = proc.addBlock();
+    BasicBlock* body = proc.addBlock();
+    BasicBlock* continuation = proc.addBlock();
+
+    // Root
+    Value* loopCountValue = root->appendNew<Value>(proc, Trunc, Origin(), root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0));
+    Value* valueToStore = root->appendNew<Value>(proc, Trunc, Origin(), root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR1));
+    UpsilonValue* beginUpsilon = root->appendNew<UpsilonValue>(proc, Origin(), root->appendNew<Const32Value>(proc, Origin(), 0));
+    root->appendNewControlValue(proc, Jump, Origin(), header);
+
+    // Header
+    Value* indexPhi = header->appendNew<Value>(proc, Phi, Int32, Origin());
+    header->appendNewControlValue(proc, Branch, Origin(),
+        header->appendNew<Value>(proc, Below, Origin(), indexPhi, loopCountValue),
+        body, continuation);
+
+    // Body
+    Value* pointer = body->appendNew<Value>(proc, Mul, Origin(), indexPhi,
+        body->appendNew<Const32Value>(proc, Origin(), sizeof(unsigned)));
+    pointer = body->appendNew<Value>(proc, ZExt32, Origin(), pointer);
+    body->appendNew<MemoryValue>(proc, Store, Origin(), valueToStore,
+        body->appendNew<WasmAddressValue>(proc, Origin(), pointer, pinnedGPR));
+    UpsilonValue* incUpsilon = body->appendNew<UpsilonValue>(proc, Origin(),
+        body->appendNew<Value>(proc, Add, Origin(), indexPhi,
+            body->appendNew<Const32Value>(proc, Origin(), 1)));
+    body->appendNewControlValue(proc, Jump, Origin(), header);
+
+    // Continuation
+    continuation->appendNewControlValue(proc, Return, Origin());
+
+    beginUpsilon->setPhi(indexPhi);
+    incUpsilon->setPhi(indexPhi);
+
+
+    auto code = compile(proc);
+    invoke<void>(*code, loopCount, numToStore, values.data());
+    for (unsigned value : values)
+        CHECK_EQ(numToStore, value);
+}
+
+// Make sure the compiler does not try to optimize anything out.
+NEVER_INLINE double zero()
+{
+    return 0.;
+}
+
+double negativeZero()
+{
+    return -zero();
+}
+
+#define RUN(test) do {                          \
+        if (!shouldRun(#test))                  \
+            break;                              \
+        tasks.append(                           \
+            createSharedTask<void()>(           \
+                [&] () {                        \
+                    dataLog(#test "...\n");     \
+                    test;                       \
+                    dataLog(#test ": OK!\n");   \
+                }));                            \
+    } while (false);
+
+#define RUN_UNARY(test, values) \
+    for (auto a : values) {                             \
+        CString testStr = toCString(#test, "(", a.name, ")"); \
+        if (!shouldRun(testStr.data()))                 \
+            continue;                                   \
+        tasks.append(createSharedTask<void()>(          \
+            [=] () {                                    \
+                dataLog(toCString(testStr, "...\n"));   \
+                test(a.value);                          \
+                dataLog(toCString(testStr, ": OK!\n")); \
+            }));                                        \
+    }
+
+#define RUN_BINARY(test, valuesA, valuesB) \
+    for (auto a : valuesA) {                                \
+        for (auto b : valuesB) {                            \
+            CString testStr = toCString(#test, "(", a.name, ", ", b.name, ")"); \
+            if (!shouldRun(testStr.data()))                 \
+                continue;                                   \
+            tasks.append(createSharedTask<void()>(          \
+                [=] () {                                    \
+                    dataLog(toCString(testStr, "...\n"));   \
+                    test(a.value, b.value);                 \
+                    dataLog(toCString(testStr, ": OK!\n")); \
+                }));                                        \
+        }                                                   \
+    }
+
+void run(const char* filter)
+{
+    JSC::initializeThreading();
+    vm = &VM::create(LargeHeap).leakRef();
+
+    Deque<RefPtr<SharedTask<void()>>> tasks;
+
+    auto shouldRun = [&] (const char* testName) -> bool {
+        return !filter || !!strcasestr(testName, filter);
+    };
+
+    // We run this test first because it fiddles with some
+    // JSC options.
+    testTerminalPatchpointThatNeedsToBeSpilled2();
+
+    RUN(test42());
+    RUN(testLoad42());
+    RUN(testLoadOffsetImm9Max());
+    RUN(testLoadOffsetImm9MaxPlusOne());
+    RUN(testLoadOffsetImm9MaxPlusTwo());
+    RUN(testLoadOffsetImm9Min());
+    RUN(testLoadOffsetImm9MinMinusOne());
+    RUN(testLoadOffsetScaledUnsignedImm12Max());
+    RUN(testLoadOffsetScaledUnsignedOverImm12Max());
+    RUN(testArg(43));
+    RUN(testReturnConst64(5));
+    RUN(testReturnConst64(-42));
+    RUN(testReturnVoid());
+
+    RUN(testAddArg(111));
+    RUN(testAddArgs(1, 1));
+    RUN(testAddArgs(1, 2));
+    RUN(testAddArgImm(1, 2));
+    RUN(testAddArgImm(0, 2));
+    RUN(testAddArgImm(1, 0));
+    RUN(testAddImmArg(1, 2));
+    RUN(testAddImmArg(0, 2));
+    RUN(testAddImmArg(1, 0));
+    RUN_BINARY(testAddArgMem, int64Operands(), int64Operands());
+    RUN_BINARY(testAddMemArg, int64Operands(), int64Operands());
+    RUN_BINARY(testAddImmMem, int64Operands(), int64Operands());
+    RUN_UNARY(testAddArg32, int32Operands());
+    RUN(testAddArgs32(1, 1));
+    RUN(testAddArgs32(1, 2));
+    RUN_BINARY(testAddArgMem32, int32Operands(), int32Operands());
+    RUN_BINARY(testAddMemArg32, int32Operands(), int32Operands());
+    RUN_BINARY(testAddImmMem32, int32Operands(), int32Operands());
+    RUN(testAddArgZeroImmZDef());
+    RUN(testAddLoadTwice());
+
+    RUN(testAddArgDouble(M_PI));
+    RUN(testAddArgsDouble(M_PI, 1));
+    RUN(testAddArgsDouble(M_PI, -M_PI));
+    RUN(testAddArgImmDouble(M_PI, 1));
+    RUN(testAddArgImmDouble(M_PI, 0));
+    RUN(testAddArgImmDouble(M_PI, negativeZero()));
+    RUN(testAddArgImmDouble(0, 0));
+    RUN(testAddArgImmDouble(0, negativeZero()));
+    RUN(testAddArgImmDouble(negativeZero(), 0));
+    RUN(testAddArgImmDouble(negativeZero(), negativeZero()));
+    RUN(testAddImmArgDouble(M_PI, 1));
+    RUN(testAddImmArgDouble(M_PI, 0));
+    RUN(testAddImmArgDouble(M_PI, negativeZero()));
+    RUN(testAddImmArgDouble(0, 0));
+    RUN(testAddImmArgDouble(0, negativeZero()));
+    RUN(testAddImmArgDouble(negativeZero(), 0));
+    RUN(testAddImmArgDouble(negativeZero(), negativeZero()));
+    RUN(testAddImmsDouble(M_PI, 1));
+    RUN(testAddImmsDouble(M_PI, 0));
+    RUN(testAddImmsDouble(M_PI, negativeZero()));
+    RUN(testAddImmsDouble(0, 0));
+    RUN(testAddImmsDouble(0, negativeZero()));
+    RUN(testAddImmsDouble(negativeZero(), negativeZero()));
+    RUN_UNARY(testAddArgFloat, floatingPointOperands<float>());
+    RUN_BINARY(testAddArgsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testAddFPRArgsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testAddArgImmFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testAddImmArgFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testAddImmsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_UNARY(testAddArgFloatWithUselessDoubleConversion, floatingPointOperands<float>());
+    RUN_BINARY(testAddArgsFloatWithUselessDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testAddArgsFloatWithEffectfulDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+
+    RUN(testMulArg(5));
+    RUN(testMulAddArg(5));
+    RUN(testMulAddArg(85));
+    RUN(testMulArgStore(5));
+    RUN(testMulArgStore(85));
+    RUN(testMulArgs(1, 1));
+    RUN(testMulArgs(1, 2));
+    RUN(testMulArgs(3, 3));
+    RUN(testMulArgImm(1, 2));
+    RUN(testMulArgImm(1, 4));
+    RUN(testMulArgImm(1, 8));
+    RUN(testMulArgImm(1, 16));
+    RUN(testMulArgImm(1, 0x80000000llu));
+    RUN(testMulArgImm(1, 0x800000000000llu));
+    RUN(testMulArgImm(7, 2));
+    RUN(testMulArgImm(7, 4));
+    RUN(testMulArgImm(7, 8));
+    RUN(testMulArgImm(7, 16));
+    RUN(testMulArgImm(7, 0x80000000llu));
+    RUN(testMulArgImm(7, 0x800000000000llu));
+    RUN(testMulArgImm(-42, 2));
+    RUN(testMulArgImm(-42, 4));
+    RUN(testMulArgImm(-42, 8));
+    RUN(testMulArgImm(-42, 16));
+    RUN(testMulArgImm(-42, 0x80000000llu));
+    RUN(testMulArgImm(-42, 0x800000000000llu));
+    RUN(testMulArgImm(0, 2));
+    RUN(testMulArgImm(1, 0));
+    RUN(testMulArgImm(3, 3));
+    RUN(testMulArgImm(3, -1));
+    RUN(testMulArgImm(-3, -1));
+    RUN(testMulArgImm(0, -1));
+    RUN(testMulImmArg(1, 2));
+    RUN(testMulImmArg(0, 2));
+    RUN(testMulImmArg(1, 0));
+    RUN(testMulImmArg(3, 3));
+    RUN(testMulArgs32(1, 1));
+    RUN(testMulArgs32(1, 2));
+    RUN(testMulLoadTwice());
+    RUN(testMulAddArgsLeft());
+    RUN(testMulAddArgsRight());
+    RUN(testMulAddArgsLeft32());
+    RUN(testMulAddArgsRight32());
+    RUN(testMulSubArgsLeft());
+    RUN(testMulSubArgsRight());
+    RUN(testMulSubArgsLeft32());
+    RUN(testMulSubArgsRight32());
+    RUN(testMulNegArgs());
+    RUN(testMulNegArgs32());
+
+    RUN_UNARY(testMulArgDouble, floatingPointOperands<double>());
+    RUN_BINARY(testMulArgsDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testMulArgImmDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testMulImmArgDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testMulImmsDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_UNARY(testMulArgFloat, floatingPointOperands<float>());
+    RUN_BINARY(testMulArgsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testMulArgImmFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testMulImmArgFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testMulImmsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_UNARY(testMulArgFloatWithUselessDoubleConversion, floatingPointOperands<float>());
+    RUN_BINARY(testMulArgsFloatWithUselessDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testMulArgsFloatWithEffectfulDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+
+    RUN(testDivArgDouble(M_PI));
+    RUN(testDivArgsDouble(M_PI, 1));
+    RUN(testDivArgsDouble(M_PI, -M_PI));
+    RUN(testDivArgImmDouble(M_PI, 1));
+    RUN(testDivArgImmDouble(M_PI, 0));
+    RUN(testDivArgImmDouble(M_PI, negativeZero()));
+    RUN(testDivArgImmDouble(0, 0));
+    RUN(testDivArgImmDouble(0, negativeZero()));
+    RUN(testDivArgImmDouble(negativeZero(), 0));
+    RUN(testDivArgImmDouble(negativeZero(), negativeZero()));
+    RUN(testDivImmArgDouble(M_PI, 1));
+    RUN(testDivImmArgDouble(M_PI, 0));
+    RUN(testDivImmArgDouble(M_PI, negativeZero()));
+    RUN(testDivImmArgDouble(0, 0));
+    RUN(testDivImmArgDouble(0, negativeZero()));
+    RUN(testDivImmArgDouble(negativeZero(), 0));
+    RUN(testDivImmArgDouble(negativeZero(), negativeZero()));
+    RUN(testDivImmsDouble(M_PI, 1));
+    RUN(testDivImmsDouble(M_PI, 0));
+    RUN(testDivImmsDouble(M_PI, negativeZero()));
+    RUN(testDivImmsDouble(0, 0));
+    RUN(testDivImmsDouble(0, negativeZero()));
+    RUN(testDivImmsDouble(negativeZero(), negativeZero()));
+    RUN_UNARY(testDivArgFloat, floatingPointOperands<float>());
+    RUN_BINARY(testDivArgsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testDivArgImmFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testDivImmArgFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testDivImmsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_UNARY(testDivArgFloatWithUselessDoubleConversion, floatingPointOperands<float>());
+    RUN_BINARY(testDivArgsFloatWithUselessDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testDivArgsFloatWithEffectfulDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+
+    RUN_BINARY(testUDivArgsInt32, int32Operands(), int32Operands());
+    RUN_BINARY(testUDivArgsInt64, int64Operands(), int64Operands());
+
+    RUN_UNARY(testModArgDouble, floatingPointOperands<double>());
+    RUN_BINARY(testModArgsDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testModArgImmDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testModImmArgDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testModImmsDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_UNARY(testModArgFloat, floatingPointOperands<float>());
+    RUN_BINARY(testModArgsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testModArgImmFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testModImmArgFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testModImmsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+
+    RUN_BINARY(testUModArgsInt32, int32Operands(), int32Operands());
+    RUN_BINARY(testUModArgsInt64, int64Operands(), int64Operands());
+
+    RUN(testSubArg(24));
+    RUN(testSubArgs(1, 1));
+    RUN(testSubArgs(1, 2));
+    RUN(testSubArgs(13, -42));
+    RUN(testSubArgs(-13, 42));
+    RUN(testSubArgImm(1, 1));
+    RUN(testSubArgImm(1, 2));
+    RUN(testSubArgImm(13, -42));
+    RUN(testSubArgImm(-13, 42));
+    RUN(testSubArgImm(42, 0));
+    RUN(testSubImmArg(1, 1));
+    RUN(testSubImmArg(1, 2));
+    RUN(testSubImmArg(13, -42));
+    RUN(testSubImmArg(-13, 42));
+    RUN_BINARY(testSubArgMem, int64Operands(), int64Operands());
+    RUN_BINARY(testSubMemArg, int64Operands(), int64Operands());
+    RUN_BINARY(testSubImmMem, int32Operands(), int32Operands());
+    RUN_BINARY(testSubMemImm, int32Operands(), int32Operands());
+    RUN_UNARY(testNegValueSubOne, int32Operands());
+
+    RUN(testSubArgs32(1, 1));
+    RUN(testSubArgs32(1, 2));
+    RUN(testSubArgs32(13, -42));
+    RUN(testSubArgs32(-13, 42));
+    RUN(testSubArgImm32(1, 1));
+    RUN(testSubArgImm32(1, 2));
+    RUN(testSubArgImm32(13, -42));
+    RUN(testSubArgImm32(-13, 42));
+    RUN(testSubImmArg32(1, 1));
+    RUN(testSubImmArg32(1, 2));
+    RUN(testSubImmArg32(13, -42));
+    RUN(testSubImmArg32(-13, 42));
+    RUN_BINARY(testSubArgMem32, int32Operands(), int32Operands());
+    RUN_BINARY(testSubMemArg32, int32Operands(), int32Operands());
+    RUN_BINARY(testSubImmMem32, int32Operands(), int32Operands());
+    RUN_BINARY(testSubMemImm32, int32Operands(), int32Operands());
+    RUN_UNARY(testNegValueSubOne32, int64Operands());
+
+    RUN_UNARY(testSubArgDouble, floatingPointOperands<double>());
+    RUN_BINARY(testSubArgsDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testSubArgImmDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testSubImmArgDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testSubImmsDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_UNARY(testSubArgFloat, floatingPointOperands<float>());
+    RUN_BINARY(testSubArgsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testSubArgImmFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testSubImmArgFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testSubImmsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_UNARY(testSubArgFloatWithUselessDoubleConversion, floatingPointOperands<float>());
+    RUN_BINARY(testSubArgsFloatWithUselessDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testSubArgsFloatWithEffectfulDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+
+    RUN_UNARY(testNegDouble, floatingPointOperands<double>());
+    RUN_UNARY(testNegFloat, floatingPointOperands<float>());
+    RUN_UNARY(testNegFloatWithUselessDoubleConversion, floatingPointOperands<float>());
+
+    RUN(testBitAndArgs(43, 43));
+    RUN(testBitAndArgs(43, 0));
+    RUN(testBitAndArgs(10, 3));
+    RUN(testBitAndArgs(42, 0xffffffffffffffff));
+    RUN(testBitAndSameArg(43));
+    RUN(testBitAndSameArg(0));
+    RUN(testBitAndSameArg(3));
+    RUN(testBitAndSameArg(0xffffffffffffffff));
+    RUN(testBitAndImms(43, 43));
+    RUN(testBitAndImms(43, 0));
+    RUN(testBitAndImms(10, 3));
+    RUN(testBitAndImms(42, 0xffffffffffffffff));
+    RUN(testBitAndArgImm(43, 43));
+    RUN(testBitAndArgImm(43, 0));
+    RUN(testBitAndArgImm(10, 3));
+    RUN(testBitAndArgImm(42, 0xffffffffffffffff));
+    RUN(testBitAndArgImm(42, 0xff));
+    RUN(testBitAndArgImm(300, 0xff));
+    RUN(testBitAndArgImm(-300, 0xff));
+    RUN(testBitAndArgImm(42, 0xffff));
+    RUN(testBitAndArgImm(40000, 0xffff));
+    RUN(testBitAndArgImm(-40000, 0xffff));
+    RUN(testBitAndImmArg(43, 43));
+    RUN(testBitAndImmArg(43, 0));
+    RUN(testBitAndImmArg(10, 3));
+    RUN(testBitAndImmArg(42, 0xffffffffffffffff));
+    RUN(testBitAndBitAndArgImmImm(2, 7, 3));
+    RUN(testBitAndBitAndArgImmImm(1, 6, 6));
+    RUN(testBitAndBitAndArgImmImm(0xffff, 24, 7));
+    RUN(testBitAndImmBitAndArgImm(7, 2, 3));
+    RUN(testBitAndImmBitAndArgImm(6, 1, 6));
+    RUN(testBitAndImmBitAndArgImm(24, 0xffff, 7));
+    RUN(testBitAndArgs32(43, 43));
+    RUN(testBitAndArgs32(43, 0));
+    RUN(testBitAndArgs32(10, 3));
+    RUN(testBitAndArgs32(42, 0xffffffff));
+    RUN(testBitAndSameArg32(43));
+    RUN(testBitAndSameArg32(0));
+    RUN(testBitAndSameArg32(3));
+    RUN(testBitAndSameArg32(0xffffffff));
+    RUN(testBitAndImms32(43, 43));
+    RUN(testBitAndImms32(43, 0));
+    RUN(testBitAndImms32(10, 3));
+    RUN(testBitAndImms32(42, 0xffffffff));
+    RUN(testBitAndArgImm32(43, 43));
+    RUN(testBitAndArgImm32(43, 0));
+    RUN(testBitAndArgImm32(10, 3));
+    RUN(testBitAndArgImm32(42, 0xffffffff));
+    RUN(testBitAndImmArg32(43, 43));
+    RUN(testBitAndImmArg32(43, 0));
+    RUN(testBitAndImmArg32(10, 3));
+    RUN(testBitAndImmArg32(42, 0xffffffff));
+    RUN(testBitAndImmArg32(42, 0xff));
+    RUN(testBitAndImmArg32(300, 0xff));
+    RUN(testBitAndImmArg32(-300, 0xff));
+    RUN(testBitAndImmArg32(42, 0xffff));
+    RUN(testBitAndImmArg32(40000, 0xffff));
+    RUN(testBitAndImmArg32(-40000, 0xffff));
+    RUN(testBitAndBitAndArgImmImm32(2, 7, 3));
+    RUN(testBitAndBitAndArgImmImm32(1, 6, 6));
+    RUN(testBitAndBitAndArgImmImm32(0xffff, 24, 7));
+    RUN(testBitAndImmBitAndArgImm32(7, 2, 3));
+    RUN(testBitAndImmBitAndArgImm32(6, 1, 6));
+    RUN(testBitAndImmBitAndArgImm32(24, 0xffff, 7));
+    RUN_BINARY(testBitAndWithMaskReturnsBooleans, int64Operands(), int64Operands());
+    RUN_UNARY(testBitAndArgDouble, floatingPointOperands<double>());
+    RUN_BINARY(testBitAndArgsDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testBitAndArgImmDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testBitAndImmsDouble, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_UNARY(testBitAndArgFloat, floatingPointOperands<float>());
+    RUN_BINARY(testBitAndArgsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testBitAndArgImmFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testBitAndImmsFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testBitAndArgsFloatWithUselessDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+
+    RUN(testBitOrArgs(43, 43));
+    RUN(testBitOrArgs(43, 0));
+    RUN(testBitOrArgs(10, 3));
+    RUN(testBitOrArgs(42, 0xffffffffffffffff));
+    RUN(testBitOrSameArg(43));
+    RUN(testBitOrSameArg(0));
+    RUN(testBitOrSameArg(3));
+    RUN(testBitOrSameArg(0xffffffffffffffff));
+    RUN(testBitOrImms(43, 43));
+    RUN(testBitOrImms(43, 0));
+    RUN(testBitOrImms(10, 3));
+    RUN(testBitOrImms(42, 0xffffffffffffffff));
+    RUN(testBitOrArgImm(43, 43));
+    RUN(testBitOrArgImm(43, 0));
+    RUN(testBitOrArgImm(10, 3));
+    RUN(testBitOrArgImm(42, 0xffffffffffffffff));
+    RUN(testBitOrImmArg(43, 43));
+    RUN(testBitOrImmArg(43, 0));
+    RUN(testBitOrImmArg(10, 3));
+    RUN(testBitOrImmArg(42, 0xffffffffffffffff));
+    RUN(testBitOrBitOrArgImmImm(2, 7, 3));
+    RUN(testBitOrBitOrArgImmImm(1, 6, 6));
+    RUN(testBitOrBitOrArgImmImm(0xffff, 24, 7));
+    RUN(testBitOrImmBitOrArgImm(7, 2, 3));
+    RUN(testBitOrImmBitOrArgImm(6, 1, 6));
+    RUN(testBitOrImmBitOrArgImm(24, 0xffff, 7));
+    RUN(testBitOrArgs32(43, 43));
+    RUN(testBitOrArgs32(43, 0));
+    RUN(testBitOrArgs32(10, 3));
+    RUN(testBitOrArgs32(42, 0xffffffff));
+    RUN(testBitOrSameArg32(43));
+    RUN(testBitOrSameArg32(0));
+    RUN(testBitOrSameArg32(3));
+    RUN(testBitOrSameArg32(0xffffffff));
+    RUN(testBitOrImms32(43, 43));
+    RUN(testBitOrImms32(43, 0));
+    RUN(testBitOrImms32(10, 3));
+    RUN(testBitOrImms32(42, 0xffffffff));
+    RUN(testBitOrArgImm32(43, 43));
+    RUN(testBitOrArgImm32(43, 0));
+    RUN(testBitOrArgImm32(10, 3));
+    RUN(testBitOrArgImm32(42, 0xffffffff));
+    RUN(testBitOrImmArg32(43, 43));
+    RUN(testBitOrImmArg32(43, 0));
+    RUN(testBitOrImmArg32(10, 3));
+    RUN(testBitOrImmArg32(42, 0xffffffff));
+    RUN(testBitOrBitOrArgImmImm32(2, 7, 3));
+    RUN(testBitOrBitOrArgImmImm32(1, 6, 6));
+    RUN(testBitOrBitOrArgImmImm32(0xffff, 24, 7));
+    RUN(testBitOrImmBitOrArgImm32(7, 2, 3));
+    RUN(testBitOrImmBitOrArgImm32(6, 1, 6));
+    RUN(testBitOrImmBitOrArgImm32(24, 0xffff, 7));
+
+    RUN_BINARY(testBitXorArgs, int64Operands(), int64Operands());
+    RUN_UNARY(testBitXorSameArg, int64Operands());
+    RUN_BINARY(testBitXorImms, int64Operands(), int64Operands());
+    RUN_BINARY(testBitXorArgImm, int64Operands(), int64Operands());
+    RUN_BINARY(testBitXorImmArg, int64Operands(), int64Operands());
+    RUN(testBitXorBitXorArgImmImm(2, 7, 3));
+    RUN(testBitXorBitXorArgImmImm(1, 6, 6));
+    RUN(testBitXorBitXorArgImmImm(0xffff, 24, 7));
+    RUN(testBitXorImmBitXorArgImm(7, 2, 3));
+    RUN(testBitXorImmBitXorArgImm(6, 1, 6));
+    RUN(testBitXorImmBitXorArgImm(24, 0xffff, 7));
+    RUN(testBitXorArgs32(43, 43));
+    RUN(testBitXorArgs32(43, 0));
+    RUN(testBitXorArgs32(10, 3));
+    RUN(testBitXorArgs32(42, 0xffffffff));
+    RUN(testBitXorSameArg32(43));
+    RUN(testBitXorSameArg32(0));
+    RUN(testBitXorSameArg32(3));
+    RUN(testBitXorSameArg32(0xffffffff));
+    RUN(testBitXorImms32(43, 43));
+    RUN(testBitXorImms32(43, 0));
+    RUN(testBitXorImms32(10, 3));
+    RUN(testBitXorImms32(42, 0xffffffff));
+    RUN(testBitXorArgImm32(43, 43));
+    RUN(testBitXorArgImm32(43, 0));
+    RUN(testBitXorArgImm32(10, 3));
+    RUN(testBitXorArgImm32(42, 0xffffffff));
+    RUN(testBitXorImmArg32(43, 43));
+    RUN(testBitXorImmArg32(43, 0));
+    RUN(testBitXorImmArg32(10, 3));
+    RUN(testBitXorImmArg32(42, 0xffffffff));
+    RUN(testBitXorBitXorArgImmImm32(2, 7, 3));
+    RUN(testBitXorBitXorArgImmImm32(1, 6, 6));
+    RUN(testBitXorBitXorArgImmImm32(0xffff, 24, 7));
+    RUN(testBitXorImmBitXorArgImm32(7, 2, 3));
+    RUN(testBitXorImmBitXorArgImm32(6, 1, 6));
+    RUN(testBitXorImmBitXorArgImm32(24, 0xffff, 7));
+
+    RUN_UNARY(testBitNotArg, int64Operands());
+    RUN_UNARY(testBitNotImm, int64Operands());
+    RUN_UNARY(testBitNotMem, int64Operands());
+    RUN_UNARY(testBitNotArg32, int32Operands());
+    RUN_UNARY(testBitNotImm32, int32Operands());
+    RUN_UNARY(testBitNotMem32, int32Operands());
+    RUN_BINARY(testBitNotOnBooleanAndBranch32, int32Operands(), int32Operands());
+
+    RUN(testShlArgs(1, 0));
+    RUN(testShlArgs(1, 1));
+    RUN(testShlArgs(1, 62));
+    RUN(testShlArgs(0xffffffffffffffff, 0));
+    RUN(testShlArgs(0xffffffffffffffff, 1));
+    RUN(testShlArgs(0xffffffffffffffff, 63));
+    RUN(testShlImms(1, 0));
+    RUN(testShlImms(1, 1));
+    RUN(testShlImms(1, 62));
+    RUN(testShlImms(1, 65));
+    RUN(testShlImms(0xffffffffffffffff, 0));
+    RUN(testShlImms(0xffffffffffffffff, 1));
+    RUN(testShlImms(0xffffffffffffffff, 63));
+    RUN(testShlArgImm(1, 0));
+    RUN(testShlArgImm(1, 1));
+    RUN(testShlArgImm(1, 62));
+    RUN(testShlArgImm(1, 65));
+    RUN(testShlArgImm(0xffffffffffffffff, 0));
+    RUN(testShlArgImm(0xffffffffffffffff, 1));
+    RUN(testShlArgImm(0xffffffffffffffff, 63));
+    RUN(testShlArg32(2));
+    RUN(testShlArgs32(1, 0));
+    RUN(testShlArgs32(1, 1));
+    RUN(testShlArgs32(1, 62));
+    RUN(testShlImms32(1, 33));
+    RUN(testShlArgs32(0xffffffff, 0));
+    RUN(testShlArgs32(0xffffffff, 1));
+    RUN(testShlArgs32(0xffffffff, 63));
+    RUN(testShlImms32(1, 0));
+    RUN(testShlImms32(1, 1));
+    RUN(testShlImms32(1, 62));
+    RUN(testShlImms32(1, 33));
+    RUN(testShlImms32(0xffffffff, 0));
+    RUN(testShlImms32(0xffffffff, 1));
+    RUN(testShlImms32(0xffffffff, 63));
+    RUN(testShlArgImm32(1, 0));
+    RUN(testShlArgImm32(1, 1));
+    RUN(testShlArgImm32(1, 62));
+    RUN(testShlArgImm32(0xffffffff, 0));
+    RUN(testShlArgImm32(0xffffffff, 1));
+    RUN(testShlArgImm32(0xffffffff, 63));
+
+    RUN(testSShrArgs(1, 0));
+    RUN(testSShrArgs(1, 1));
+    RUN(testSShrArgs(1, 62));
+    RUN(testSShrArgs(0xffffffffffffffff, 0));
+    RUN(testSShrArgs(0xffffffffffffffff, 1));
+    RUN(testSShrArgs(0xffffffffffffffff, 63));
+    RUN(testSShrImms(1, 0));
+    RUN(testSShrImms(1, 1));
+    RUN(testSShrImms(1, 62));
+    RUN(testSShrImms(1, 65));
+    RUN(testSShrImms(0xffffffffffffffff, 0));
+    RUN(testSShrImms(0xffffffffffffffff, 1));
+    RUN(testSShrImms(0xffffffffffffffff, 63));
+    RUN(testSShrArgImm(1, 0));
+    RUN(testSShrArgImm(1, 1));
+    RUN(testSShrArgImm(1, 62));
+    RUN(testSShrArgImm(1, 65));
+    RUN(testSShrArgImm(0xffffffffffffffff, 0));
+    RUN(testSShrArgImm(0xffffffffffffffff, 1));
+    RUN(testSShrArgImm(0xffffffffffffffff, 63));
+    RUN(testSShrArg32(32));
+    RUN(testSShrArgs32(1, 0));
+    RUN(testSShrArgs32(1, 1));
+    RUN(testSShrArgs32(1, 62));
+    RUN(testSShrArgs32(1, 33));
+    RUN(testSShrArgs32(0xffffffff, 0));
+    RUN(testSShrArgs32(0xffffffff, 1));
+    RUN(testSShrArgs32(0xffffffff, 63));
+    RUN(testSShrImms32(1, 0));
+    RUN(testSShrImms32(1, 1));
+    RUN(testSShrImms32(1, 62));
+    RUN(testSShrImms32(1, 33));
+    RUN(testSShrImms32(0xffffffff, 0));
+    RUN(testSShrImms32(0xffffffff, 1));
+    RUN(testSShrImms32(0xffffffff, 63));
+    RUN(testSShrArgImm32(1, 0));
+    RUN(testSShrArgImm32(1, 1));
+    RUN(testSShrArgImm32(1, 62));
+    RUN(testSShrArgImm32(0xffffffff, 0));
+    RUN(testSShrArgImm32(0xffffffff, 1));
+    RUN(testSShrArgImm32(0xffffffff, 63));
+
+    RUN(testZShrArgs(1, 0));
+    RUN(testZShrArgs(1, 1));
+    RUN(testZShrArgs(1, 62));
+    RUN(testZShrArgs(0xffffffffffffffff, 0));
+    RUN(testZShrArgs(0xffffffffffffffff, 1));
+    RUN(testZShrArgs(0xffffffffffffffff, 63));
+    RUN(testZShrImms(1, 0));
+    RUN(testZShrImms(1, 1));
+    RUN(testZShrImms(1, 62));
+    RUN(testZShrImms(1, 65));
+    RUN(testZShrImms(0xffffffffffffffff, 0));
+    RUN(testZShrImms(0xffffffffffffffff, 1));
+    RUN(testZShrImms(0xffffffffffffffff, 63));
+    RUN(testZShrArgImm(1, 0));
+    RUN(testZShrArgImm(1, 1));
+    RUN(testZShrArgImm(1, 62));
+    RUN(testZShrArgImm(1, 65));
+    RUN(testZShrArgImm(0xffffffffffffffff, 0));
+    RUN(testZShrArgImm(0xffffffffffffffff, 1));
+    RUN(testZShrArgImm(0xffffffffffffffff, 63));
+    RUN(testZShrArg32(32));
+    RUN(testZShrArgs32(1, 0));
+    RUN(testZShrArgs32(1, 1));
+    RUN(testZShrArgs32(1, 62));
+    RUN(testZShrArgs32(1, 33));
+    RUN(testZShrArgs32(0xffffffff, 0));
+    RUN(testZShrArgs32(0xffffffff, 1));
+    RUN(testZShrArgs32(0xffffffff, 63));
+    RUN(testZShrImms32(1, 0));
+    RUN(testZShrImms32(1, 1));
+    RUN(testZShrImms32(1, 62));
+    RUN(testZShrImms32(1, 33));
+    RUN(testZShrImms32(0xffffffff, 0));
+    RUN(testZShrImms32(0xffffffff, 1));
+    RUN(testZShrImms32(0xffffffff, 63));
+    RUN(testZShrArgImm32(1, 0));
+    RUN(testZShrArgImm32(1, 1));
+    RUN(testZShrArgImm32(1, 62));
+    RUN(testZShrArgImm32(0xffffffff, 0));
+    RUN(testZShrArgImm32(0xffffffff, 1));
+    RUN(testZShrArgImm32(0xffffffff, 63));
+
+    RUN_UNARY(testClzArg64, int64Operands());
+    RUN_UNARY(testClzMem64, int64Operands());
+    RUN_UNARY(testClzArg32, int32Operands());
+    RUN_UNARY(testClzMem32, int64Operands());
+
+    RUN_UNARY(testAbsArg, floatingPointOperands<double>());
+    RUN_UNARY(testAbsImm, floatingPointOperands<double>());
+    RUN_UNARY(testAbsMem, floatingPointOperands<double>());
+    RUN_UNARY(testAbsAbsArg, floatingPointOperands<double>());
+    RUN_UNARY(testAbsBitwiseCastArg, floatingPointOperands<double>());
+    RUN_UNARY(testBitwiseCastAbsBitwiseCastArg, floatingPointOperands<double>());
+    RUN_UNARY(testAbsArg, floatingPointOperands<float>());
+    RUN_UNARY(testAbsImm, floatingPointOperands<float>());
+    RUN_UNARY(testAbsMem, floatingPointOperands<float>());
+    RUN_UNARY(testAbsAbsArg, floatingPointOperands<float>());
+    RUN_UNARY(testAbsBitwiseCastArg, floatingPointOperands<float>());
+    RUN_UNARY(testBitwiseCastAbsBitwiseCastArg, floatingPointOperands<float>());
+    RUN_UNARY(testAbsArgWithUselessDoubleConversion, floatingPointOperands<float>());
+    RUN_UNARY(testAbsArgWithEffectfulDoubleConversion, floatingPointOperands<float>());
+
+    RUN_UNARY(testCeilArg, floatingPointOperands<double>());
+    RUN_UNARY(testCeilImm, floatingPointOperands<double>());
+    RUN_UNARY(testCeilMem, floatingPointOperands<double>());
+    RUN_UNARY(testCeilCeilArg, floatingPointOperands<double>());
+    RUN_UNARY(testFloorCeilArg, floatingPointOperands<double>());
+    RUN_UNARY(testCeilIToD64, int64Operands());
+    RUN_UNARY(testCeilIToD32, int32Operands());
+    RUN_UNARY(testCeilArg, floatingPointOperands<float>());
+    RUN_UNARY(testCeilImm, floatingPointOperands<float>());
+    RUN_UNARY(testCeilMem, floatingPointOperands<float>());
+    RUN_UNARY(testCeilCeilArg, floatingPointOperands<float>());
+    RUN_UNARY(testFloorCeilArg, floatingPointOperands<float>());
+    RUN_UNARY(testCeilArgWithUselessDoubleConversion, floatingPointOperands<float>());
+    RUN_UNARY(testCeilArgWithEffectfulDoubleConversion, floatingPointOperands<float>());
+
+    RUN_UNARY(testFloorArg, floatingPointOperands<double>());
+    RUN_UNARY(testFloorImm, floatingPointOperands<double>());
+    RUN_UNARY(testFloorMem, floatingPointOperands<double>());
+    RUN_UNARY(testFloorFloorArg, floatingPointOperands<double>());
+    RUN_UNARY(testCeilFloorArg, floatingPointOperands<double>());
+    RUN_UNARY(testFloorIToD64, int64Operands());
+    RUN_UNARY(testFloorIToD32, int32Operands());
+    RUN_UNARY(testFloorArg, floatingPointOperands<float>());
+    RUN_UNARY(testFloorImm, floatingPointOperands<float>());
+    RUN_UNARY(testFloorMem, floatingPointOperands<float>());
+    RUN_UNARY(testFloorFloorArg, floatingPointOperands<float>());
+    RUN_UNARY(testCeilFloorArg, floatingPointOperands<float>());
+    RUN_UNARY(testFloorArgWithUselessDoubleConversion, floatingPointOperands<float>());
+    RUN_UNARY(testFloorArgWithEffectfulDoubleConversion, floatingPointOperands<float>());
+
+    RUN_UNARY(testSqrtArg, floatingPointOperands<double>());
+    RUN_UNARY(testSqrtImm, floatingPointOperands<double>());
+    RUN_UNARY(testSqrtMem, floatingPointOperands<double>());
+    RUN_UNARY(testSqrtArg, floatingPointOperands<float>());
+    RUN_UNARY(testSqrtImm, floatingPointOperands<float>());
+    RUN_UNARY(testSqrtMem, floatingPointOperands<float>());
+    RUN_UNARY(testSqrtArgWithUselessDoubleConversion, floatingPointOperands<float>());
+    RUN_UNARY(testSqrtArgWithEffectfulDoubleConversion, floatingPointOperands<float>());
+
+    RUN_BINARY(testCompareTwoFloatToDouble, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testCompareOneFloatToDouble, floatingPointOperands<float>(), floatingPointOperands<double>());
+    RUN_BINARY(testCompareFloatToDoubleThroughPhi, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_UNARY(testDoubleToFloatThroughPhi, floatingPointOperands<float>());
+    RUN(testReduceFloatToDoubleValidates());
+    RUN_UNARY(testDoubleProducerPhiToFloatConversion, floatingPointOperands<float>());
+    RUN_UNARY(testDoubleProducerPhiToFloatConversionWithDoubleConsumer, floatingPointOperands<float>());
+    RUN_BINARY(testDoubleProducerPhiWithNonFloatConst, floatingPointOperands<float>(), floatingPointOperands<double>());
+
+    RUN_UNARY(testDoubleArgToInt64BitwiseCast, floatingPointOperands<double>());
+    RUN_UNARY(testDoubleImmToInt64BitwiseCast, floatingPointOperands<double>());
+    RUN_UNARY(testTwoBitwiseCastOnDouble, floatingPointOperands<double>());
+    RUN_UNARY(testBitwiseCastOnDoubleInMemory, floatingPointOperands<double>());
+    RUN_UNARY(testBitwiseCastOnDoubleInMemoryIndexed, floatingPointOperands<double>());
+    RUN_UNARY(testInt64BArgToDoubleBitwiseCast, int64Operands());
+    RUN_UNARY(testInt64BImmToDoubleBitwiseCast, int64Operands());
+    RUN_UNARY(testTwoBitwiseCastOnInt64, int64Operands());
+    RUN_UNARY(testBitwiseCastOnInt64InMemory, int64Operands());
+    RUN_UNARY(testBitwiseCastOnInt64InMemoryIndexed, int64Operands());
+    RUN_UNARY(testFloatImmToInt32BitwiseCast, floatingPointOperands<float>());
+    RUN_UNARY(testBitwiseCastOnFloatInMemory, floatingPointOperands<float>());
+    RUN_UNARY(testInt32BArgToFloatBitwiseCast, int32Operands());
+    RUN_UNARY(testInt32BImmToFloatBitwiseCast, int32Operands());
+    RUN_UNARY(testTwoBitwiseCastOnInt32, int32Operands());
+    RUN_UNARY(testBitwiseCastOnInt32InMemory, int32Operands());
+
+    RUN_UNARY(testConvertDoubleToFloatArg, floatingPointOperands<double>());
+    RUN_UNARY(testConvertDoubleToFloatImm, floatingPointOperands<double>());
+    RUN_UNARY(testConvertDoubleToFloatMem, floatingPointOperands<double>());
+    RUN_UNARY(testConvertFloatToDoubleArg, floatingPointOperands<float>());
+    RUN_UNARY(testConvertFloatToDoubleImm, floatingPointOperands<float>());
+    RUN_UNARY(testConvertFloatToDoubleMem, floatingPointOperands<float>());
+    RUN_UNARY(testConvertDoubleToFloatToDoubleToFloat, floatingPointOperands<double>());
+    RUN_UNARY(testStoreFloat, floatingPointOperands<double>());
+    RUN_UNARY(testStoreDoubleConstantAsFloat, floatingPointOperands<double>());
+    RUN_UNARY(testLoadFloatConvertDoubleConvertFloatStoreFloat, floatingPointOperands<float>());
+    RUN_UNARY(testFroundArg, floatingPointOperands<double>());
+    RUN_UNARY(testFroundMem, floatingPointOperands<double>());
+
+    RUN(testIToD64Arg());
+    RUN(testIToF64Arg());
+    RUN(testIToD32Arg());
+    RUN(testIToF32Arg());
+    RUN(testIToD64Mem());
+    RUN(testIToF64Mem());
+    RUN(testIToD32Mem());
+    RUN(testIToF32Mem());
+    RUN_UNARY(testIToD64Imm, int64Operands());
+    RUN_UNARY(testIToF64Imm, int64Operands());
+    RUN_UNARY(testIToD32Imm, int32Operands());
+    RUN_UNARY(testIToF32Imm, int32Operands());
+    RUN(testIToDReducedToIToF64Arg());
+    RUN(testIToDReducedToIToF32Arg());
+
+    RUN(testStore32(44));
+    RUN(testStoreConstant(49));
+    RUN(testStoreConstantPtr(49));
+    RUN(testStore8Arg());
+    RUN(testStore8Imm());
+    RUN(testStorePartial8BitRegisterOnX86());
+    RUN(testStore16Arg());
+    RUN(testStore16Imm());
+    RUN(testTrunc((static_cast<int64_t>(1) << 40) + 42));
+    RUN(testAdd1(45));
+    RUN(testAdd1Ptr(51));
+    RUN(testAdd1Ptr(bitwise_cast<intptr_t>(vm)));
+    RUN(testNeg32(52));
+    RUN(testNegPtr(53));
+    RUN(testStoreAddLoad32(46));
+    RUN(testStoreAddLoadImm32(46));
+    RUN(testStoreAddLoad64(4600));
+    RUN(testStoreAddLoadImm64(4600));
+    RUN(testStoreAddLoad8(4, Load8Z));
+    RUN(testStoreAddLoadImm8(4, Load8Z));
+    RUN(testStoreAddLoad8(4, Load8S));
+    RUN(testStoreAddLoadImm8(4, Load8S));
+    RUN(testStoreAddLoad16(6, Load16Z));
+    RUN(testStoreAddLoadImm16(6, Load16Z));
+    RUN(testStoreAddLoad16(6, Load16S));
+    RUN(testStoreAddLoadImm16(6, Load16S));
+    RUN(testStoreAddLoad32Index(46));
+    RUN(testStoreAddLoadImm32Index(46));
+    RUN(testStoreAddLoad64Index(4600));
+    RUN(testStoreAddLoadImm64Index(4600));
+    RUN(testStoreAddLoad8Index(4, Load8Z));
+    RUN(testStoreAddLoadImm8Index(4, Load8Z));
+    RUN(testStoreAddLoad8Index(4, Load8S));
+    RUN(testStoreAddLoadImm8Index(4, Load8S));
+    RUN(testStoreAddLoad16Index(6, Load16Z));
+    RUN(testStoreAddLoadImm16Index(6, Load16Z));
+    RUN(testStoreAddLoad16Index(6, Load16S));
+    RUN(testStoreAddLoadImm16Index(6, Load16S));
+    RUN(testStoreSubLoad(46));
+    RUN(testStoreAddLoadInterference(52));
+    RUN(testStoreAddAndLoad(47, 0xffff));
+    RUN(testStoreAddAndLoad(470000, 0xffff));
+    RUN(testStoreNegLoad32(54));
+    RUN(testStoreNegLoadPtr(55));
+    RUN(testAdd1Uncommuted(48));
+    RUN(testLoadOffset());
+    RUN(testLoadOffsetNotConstant());
+    RUN(testLoadOffsetUsingAdd());
+    RUN(testLoadOffsetUsingAddInterference());
+    RUN(testLoadOffsetUsingAddNotConstant());
+    RUN(testLoadAddrShift(0));
+    RUN(testLoadAddrShift(1));
+    RUN(testLoadAddrShift(2));
+    RUN(testLoadAddrShift(3));
+    RUN(testFramePointer());
+    RUN(testOverrideFramePointer());
+    RUN(testStackSlot());
+    RUN(testLoadFromFramePointer());
+    RUN(testStoreLoadStackSlot(50));
+    
+    RUN(testBranch());
+    RUN(testBranchPtr());
+    RUN(testDiamond());
+    RUN(testBranchNotEqual());
+    RUN(testBranchNotEqualCommute());
+    RUN(testBranchNotEqualNotEqual());
+    RUN(testBranchEqual());
+    RUN(testBranchEqualEqual());
+    RUN(testBranchEqualCommute());
+    RUN(testBranchEqualEqual1());
+    RUN_BINARY(testBranchEqualOrUnorderedArgs, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testBranchEqualOrUnorderedArgs, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testBranchNotEqualAndOrderedArgs, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testBranchNotEqualAndOrderedArgs, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testBranchEqualOrUnorderedDoubleArgImm, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testBranchEqualOrUnorderedFloatArgImm, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testBranchEqualOrUnorderedDoubleImms, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testBranchEqualOrUnorderedFloatImms, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testBranchEqualOrUnorderedFloatWithUselessDoubleConversion, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testBranchNotEqualAndOrderedArgs, floatingPointOperands<double>(), floatingPointOperands<double>());
+    RUN_BINARY(testBranchNotEqualAndOrderedArgs, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN(testBranchFold(42));
+    RUN(testBranchFold(0));
+    RUN(testDiamondFold(42));
+    RUN(testDiamondFold(0));
+    RUN(testBranchNotEqualFoldPtr(42));
+    RUN(testBranchNotEqualFoldPtr(0));
+    RUN(testBranchEqualFoldPtr(42));
+    RUN(testBranchEqualFoldPtr(0));
+    RUN(testBranchLoadPtr());
+    RUN(testBranchLoad32());
+    RUN(testBranchLoad8S());
+    RUN(testBranchLoad8Z());
+    RUN(testBranchLoad16S());
+    RUN(testBranchLoad16Z());
+    RUN(testBranch8WithLoad8ZIndex());
+
+    RUN(testComplex(64, 128));
+    RUN(testComplex(4, 128));
+    RUN(testComplex(4, 256));
+    RUN(testComplex(4, 384));
+
+    RUN(testSimplePatchpoint());
+    RUN(testSimplePatchpointWithoutOuputClobbersGPArgs());
+    RUN(testSimplePatchpointWithOuputClobbersGPArgs());
+    RUN(testSimplePatchpointWithoutOuputClobbersFPArgs());
+    RUN(testSimplePatchpointWithOuputClobbersFPArgs());
+    RUN(testPatchpointWithEarlyClobber());
+    RUN(testPatchpointCallArg());
+    RUN(testPatchpointFixedRegister());
+    RUN(testPatchpointAny(ValueRep::WarmAny));
+    RUN(testPatchpointAny(ValueRep::ColdAny));
+    RUN(testPatchpointGPScratch());
+    RUN(testPatchpointFPScratch());
+    RUN(testPatchpointLotsOfLateAnys());
+    RUN(testPatchpointAnyImm(ValueRep::WarmAny));
+    RUN(testPatchpointAnyImm(ValueRep::ColdAny));
+    RUN(testPatchpointAnyImm(ValueRep::LateColdAny));
+    RUN(testPatchpointManyImms());
+    RUN(testPatchpointWithRegisterResult());
+    RUN(testPatchpointWithStackArgumentResult());
+    RUN(testPatchpointWithAnyResult());
+    RUN(testSimpleCheck());
+    RUN(testCheckFalse());
+    RUN(testCheckTrue());
+    RUN(testCheckLessThan());
+    RUN(testCheckMegaCombo());
+    RUN(testCheckTrickyMegaCombo());
+    RUN(testCheckTwoMegaCombos());
+    RUN(testCheckTwoNonRedundantMegaCombos());
+    RUN(testCheckAddImm());
+    RUN(testCheckAddImmCommute());
+    RUN(testCheckAddImmSomeRegister());
+    RUN(testCheckAdd());
+    RUN(testCheckAdd64());
+    RUN(testCheckAddFold(100, 200));
+    RUN(testCheckAddFoldFail(2147483647, 100));
+    RUN(testCheckAddArgumentAliasing64());
+    RUN(testCheckAddArgumentAliasing32());
+    RUN(testCheckAddSelfOverflow64());
+    RUN(testCheckAddSelfOverflow32());
+    RUN(testCheckSubImm());
+    RUN(testCheckSubBadImm());
+    RUN(testCheckSub());
+    RUN(testCheckSub64());
+    RUN(testCheckSubFold(100, 200));
+    RUN(testCheckSubFoldFail(-2147483647, 100));
+    RUN(testCheckNeg());
+    RUN(testCheckNeg64());
+    RUN(testCheckMul());
+    RUN(testCheckMulMemory());
+    RUN(testCheckMul2());
+    RUN(testCheckMul64());
+    RUN(testCheckMulFold(100, 200));
+    RUN(testCheckMulFoldFail(2147483647, 100));
+    RUN(testCheckMulArgumentAliasing64());
+    RUN(testCheckMulArgumentAliasing32());
+
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(Equal, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(NotEqual, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(LessThan, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(GreaterThan, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(LessEqual, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(GreaterEqual, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(Below, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(Above, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(BelowEqual, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(AboveEqual, a, b); }, int64Operands(), int64Operands());
+    RUN_BINARY([](int32_t a, int32_t b) { testCompare(BitAnd, a, b); }, int64Operands(), int64Operands());
+
+    RUN(testEqualDouble(42, 42, true));
+    RUN(testEqualDouble(0, -0, true));
+    RUN(testEqualDouble(42, 43, false));
+    RUN(testEqualDouble(PNaN, 42, false));
+    RUN(testEqualDouble(42, PNaN, false));
+    RUN(testEqualDouble(PNaN, PNaN, false));
+
+    RUN(testLoad<Int32>(60));
+    RUN(testLoad<Int32>(-60));
+    RUN(testLoad<Int32>(1000));
+    RUN(testLoad<Int32>(-1000));
+    RUN(testLoad<Int32>(1000000));
+    RUN(testLoad<Int32>(-1000000));
+    RUN(testLoad<Int32>(1000000000));
+    RUN(testLoad<Int32>(-1000000000));
+    RUN_UNARY(testLoad<Int64>, int64Operands());
+    RUN_UNARY(testLoad<Float>, floatingPointOperands<float>());
+    RUN_UNARY(testLoad<Double>, floatingPointOperands<double>());
+    
+    RUN(testLoad<int8_t>(Load8S, 60));
+    RUN(testLoad<int8_t>(Load8S, -60));
+    RUN(testLoad<int8_t>(Load8S, 1000));
+    RUN(testLoad<int8_t>(Load8S, -1000));
+    RUN(testLoad<int8_t>(Load8S, 1000000));
+    RUN(testLoad<int8_t>(Load8S, -1000000));
+    RUN(testLoad<int8_t>(Load8S, 1000000000));
+    RUN(testLoad<int8_t>(Load8S, -1000000000));
+    
+    RUN(testLoad<uint8_t>(Load8Z, 60));
+    RUN(testLoad<uint8_t>(Load8Z, -60));
+    RUN(testLoad<uint8_t>(Load8Z, 1000));
+    RUN(testLoad<uint8_t>(Load8Z, -1000));
+    RUN(testLoad<uint8_t>(Load8Z, 1000000));
+    RUN(testLoad<uint8_t>(Load8Z, -1000000));
+    RUN(testLoad<uint8_t>(Load8Z, 1000000000));
+    RUN(testLoad<uint8_t>(Load8Z, -1000000000));
+
+    RUN(testLoad<int16_t>(Load16S, 60));
+    RUN(testLoad<int16_t>(Load16S, -60));
+    RUN(testLoad<int16_t>(Load16S, 1000));
+    RUN(testLoad<int16_t>(Load16S, -1000));
+    RUN(testLoad<int16_t>(Load16S, 1000000));
+    RUN(testLoad<int16_t>(Load16S, -1000000));
+    RUN(testLoad<int16_t>(Load16S, 1000000000));
+    RUN(testLoad<int16_t>(Load16S, -1000000000));
+    
+    RUN(testLoad<uint16_t>(Load16Z, 60));
+    RUN(testLoad<uint16_t>(Load16Z, -60));
+    RUN(testLoad<uint16_t>(Load16Z, 1000));
+    RUN(testLoad<uint16_t>(Load16Z, -1000));
+    RUN(testLoad<uint16_t>(Load16Z, 1000000));
+    RUN(testLoad<uint16_t>(Load16Z, -1000000));
+    RUN(testLoad<uint16_t>(Load16Z, 1000000000));
+    RUN(testLoad<uint16_t>(Load16Z, -1000000000));
+
+    RUN(testSpillGP());
+    RUN(testSpillFP());
+
+    RUN(testInt32ToDoublePartialRegisterStall());
+    RUN(testInt32ToDoublePartialRegisterWithoutStall());
+
+    RUN(testCallSimple(1, 2));
+    RUN(testCallRare(1, 2));
+    RUN(testCallRareLive(1, 2, 3));
+    RUN(testCallSimplePure(1, 2));
+    RUN(testCallFunctionWithHellaArguments());
+
+    RUN(testReturnDouble(0.0));
+    RUN(testReturnDouble(negativeZero()));
+    RUN(testReturnDouble(42.5));
+    RUN_UNARY(testReturnFloat, floatingPointOperands<float>());
+
+    RUN(testCallSimpleDouble(1, 2));
+    RUN(testCallFunctionWithHellaDoubleArguments());
+    RUN_BINARY(testCallSimpleFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN(testCallFunctionWithHellaFloatArguments());
+
+    RUN(testChillDiv(4, 2, 2));
+    RUN(testChillDiv(1, 0, 0));
+    RUN(testChillDiv(0, 0, 0));
+    RUN(testChillDiv(1, -1, -1));
+    RUN(testChillDiv(-2147483647 - 1, 0, 0));
+    RUN(testChillDiv(-2147483647 - 1, 1, -2147483647 - 1));
+    RUN(testChillDiv(-2147483647 - 1, -1, -2147483647 - 1));
+    RUN(testChillDiv(-2147483647 - 1, 2, -1073741824));
+    RUN(testChillDiv64(4, 2, 2));
+    RUN(testChillDiv64(1, 0, 0));
+    RUN(testChillDiv64(0, 0, 0));
+    RUN(testChillDiv64(1, -1, -1));
+    RUN(testChillDiv64(-9223372036854775807ll - 1, 0, 0));
+    RUN(testChillDiv64(-9223372036854775807ll - 1, 1, -9223372036854775807ll - 1));
+    RUN(testChillDiv64(-9223372036854775807ll - 1, -1, -9223372036854775807ll - 1));
+    RUN(testChillDiv64(-9223372036854775807ll - 1, 2, -4611686018427387904));
+    RUN(testChillDivTwice(4, 2, 6, 2, 5));
+    RUN(testChillDivTwice(4, 0, 6, 2, 3));
+    RUN(testChillDivTwice(4, 2, 6, 0, 2));
+
+    RUN_UNARY(testModArg, int64Operands());
+    RUN_BINARY(testModArgs, int64Operands(), int64Operands());
+    RUN_BINARY(testModImms, int64Operands(), int64Operands());
+    RUN_UNARY(testModArg32, int32Operands());
+    RUN_BINARY(testModArgs32, int32Operands(), int32Operands());
+    RUN_BINARY(testModImms32, int32Operands(), int32Operands());
+    RUN_UNARY(testChillModArg, int64Operands());
+    RUN_BINARY(testChillModArgs, int64Operands(), int64Operands());
+    RUN_BINARY(testChillModImms, int64Operands(), int64Operands());
+    RUN_UNARY(testChillModArg32, int32Operands());
+    RUN_BINARY(testChillModArgs32, int32Operands(), int32Operands());
+    RUN_BINARY(testChillModImms32, int32Operands(), int32Operands());
+
+    RUN(testSwitch(0, 1));
+    RUN(testSwitch(1, 1));
+    RUN(testSwitch(2, 1));
+    RUN(testSwitch(2, 2));
+    RUN(testSwitch(10, 1));
+    RUN(testSwitch(10, 2));
+    RUN(testSwitch(100, 1));
+    RUN(testSwitch(100, 100));
+
+    RUN(testSwitchChillDiv(0, 1));
+    RUN(testSwitchChillDiv(1, 1));
+    RUN(testSwitchChillDiv(2, 1));
+    RUN(testSwitchChillDiv(2, 2));
+    RUN(testSwitchChillDiv(10, 1));
+    RUN(testSwitchChillDiv(10, 2));
+    RUN(testSwitchChillDiv(100, 1));
+    RUN(testSwitchChillDiv(100, 100));
+
+    RUN(testSwitchTargettingSameBlock());
+    RUN(testSwitchTargettingSameBlockFoldPathConstant());
+
+    RUN(testTrunc(0));
+    RUN(testTrunc(1));
+    RUN(testTrunc(-1));
+    RUN(testTrunc(1000000000000ll));
+    RUN(testTrunc(-1000000000000ll));
+    RUN(testTruncFold(0));
+    RUN(testTruncFold(1));
+    RUN(testTruncFold(-1));
+    RUN(testTruncFold(1000000000000ll));
+    RUN(testTruncFold(-1000000000000ll));
+    
+    RUN(testZExt32(0));
+    RUN(testZExt32(1));
+    RUN(testZExt32(-1));
+    RUN(testZExt32(1000000000ll));
+    RUN(testZExt32(-1000000000ll));
+    RUN(testZExt32Fold(0));
+    RUN(testZExt32Fold(1));
+    RUN(testZExt32Fold(-1));
+    RUN(testZExt32Fold(1000000000ll));
+    RUN(testZExt32Fold(-1000000000ll));
+
+    RUN(testSExt32(0));
+    RUN(testSExt32(1));
+    RUN(testSExt32(-1));
+    RUN(testSExt32(1000000000ll));
+    RUN(testSExt32(-1000000000ll));
+    RUN(testSExt32Fold(0));
+    RUN(testSExt32Fold(1));
+    RUN(testSExt32Fold(-1));
+    RUN(testSExt32Fold(1000000000ll));
+    RUN(testSExt32Fold(-1000000000ll));
+
+    RUN(testTruncZExt32(0));
+    RUN(testTruncZExt32(1));
+    RUN(testTruncZExt32(-1));
+    RUN(testTruncZExt32(1000000000ll));
+    RUN(testTruncZExt32(-1000000000ll));
+    RUN(testTruncSExt32(0));
+    RUN(testTruncSExt32(1));
+    RUN(testTruncSExt32(-1));
+    RUN(testTruncSExt32(1000000000ll));
+    RUN(testTruncSExt32(-1000000000ll));
+
+    RUN(testSExt8(0));
+    RUN(testSExt8(1));
+    RUN(testSExt8(42));
+    RUN(testSExt8(-1));
+    RUN(testSExt8(0xff));
+    RUN(testSExt8(0x100));
+    RUN(testSExt8Fold(0));
+    RUN(testSExt8Fold(1));
+    RUN(testSExt8Fold(42));
+    RUN(testSExt8Fold(-1));
+    RUN(testSExt8Fold(0xff));
+    RUN(testSExt8Fold(0x100));
+    RUN(testSExt8SExt8(0));
+    RUN(testSExt8SExt8(1));
+    RUN(testSExt8SExt8(42));
+    RUN(testSExt8SExt8(-1));
+    RUN(testSExt8SExt8(0xff));
+    RUN(testSExt8SExt8(0x100));
+    RUN(testSExt8SExt16(0));
+    RUN(testSExt8SExt16(1));
+    RUN(testSExt8SExt16(42));
+    RUN(testSExt8SExt16(-1));
+    RUN(testSExt8SExt16(0xff));
+    RUN(testSExt8SExt16(0x100));
+    RUN(testSExt8SExt16(0xffff));
+    RUN(testSExt8SExt16(0x10000));
+    RUN(testSExt8BitAnd(0, 0));
+    RUN(testSExt8BitAnd(1, 0));
+    RUN(testSExt8BitAnd(42, 0));
+    RUN(testSExt8BitAnd(-1, 0));
+    RUN(testSExt8BitAnd(0xff, 0));
+    RUN(testSExt8BitAnd(0x100, 0));
+    RUN(testSExt8BitAnd(0xffff, 0));
+    RUN(testSExt8BitAnd(0x10000, 0));
+    RUN(testSExt8BitAnd(0, 0xf));
+    RUN(testSExt8BitAnd(1, 0xf));
+    RUN(testSExt8BitAnd(42, 0xf));
+    RUN(testSExt8BitAnd(-1, 0xf));
+    RUN(testSExt8BitAnd(0xff, 0xf));
+    RUN(testSExt8BitAnd(0x100, 0xf));
+    RUN(testSExt8BitAnd(0xffff, 0xf));
+    RUN(testSExt8BitAnd(0x10000, 0xf));
+    RUN(testSExt8BitAnd(0, 0xff));
+    RUN(testSExt8BitAnd(1, 0xff));
+    RUN(testSExt8BitAnd(42, 0xff));
+    RUN(testSExt8BitAnd(-1, 0xff));
+    RUN(testSExt8BitAnd(0xff, 0xff));
+    RUN(testSExt8BitAnd(0x100, 0xff));
+    RUN(testSExt8BitAnd(0xffff, 0xff));
+    RUN(testSExt8BitAnd(0x10000, 0xff));
+    RUN(testSExt8BitAnd(0, 0x80));
+    RUN(testSExt8BitAnd(1, 0x80));
+    RUN(testSExt8BitAnd(42, 0x80));
+    RUN(testSExt8BitAnd(-1, 0x80));
+    RUN(testSExt8BitAnd(0xff, 0x80));
+    RUN(testSExt8BitAnd(0x100, 0x80));
+    RUN(testSExt8BitAnd(0xffff, 0x80));
+    RUN(testSExt8BitAnd(0x10000, 0x80));
+    RUN(testBitAndSExt8(0, 0xf));
+    RUN(testBitAndSExt8(1, 0xf));
+    RUN(testBitAndSExt8(42, 0xf));
+    RUN(testBitAndSExt8(-1, 0xf));
+    RUN(testBitAndSExt8(0xff, 0xf));
+    RUN(testBitAndSExt8(0x100, 0xf));
+    RUN(testBitAndSExt8(0xffff, 0xf));
+    RUN(testBitAndSExt8(0x10000, 0xf));
+    RUN(testBitAndSExt8(0, 0xff));
+    RUN(testBitAndSExt8(1, 0xff));
+    RUN(testBitAndSExt8(42, 0xff));
+    RUN(testBitAndSExt8(-1, 0xff));
+    RUN(testBitAndSExt8(0xff, 0xff));
+    RUN(testBitAndSExt8(0x100, 0xff));
+    RUN(testBitAndSExt8(0xffff, 0xff));
+    RUN(testBitAndSExt8(0x10000, 0xff));
+    RUN(testBitAndSExt8(0, 0xfff));
+    RUN(testBitAndSExt8(1, 0xfff));
+    RUN(testBitAndSExt8(42, 0xfff));
+    RUN(testBitAndSExt8(-1, 0xfff));
+    RUN(testBitAndSExt8(0xff, 0xfff));
+    RUN(testBitAndSExt8(0x100, 0xfff));
+    RUN(testBitAndSExt8(0xffff, 0xfff));
+    RUN(testBitAndSExt8(0x10000, 0xfff));
+
+    RUN(testSExt16(0));
+    RUN(testSExt16(1));
+    RUN(testSExt16(42));
+    RUN(testSExt16(-1));
+    RUN(testSExt16(0xffff));
+    RUN(testSExt16(0x10000));
+    RUN(testSExt16Fold(0));
+    RUN(testSExt16Fold(1));
+    RUN(testSExt16Fold(42));
+    RUN(testSExt16Fold(-1));
+    RUN(testSExt16Fold(0xffff));
+    RUN(testSExt16Fold(0x10000));
+    RUN(testSExt16SExt8(0));
+    RUN(testSExt16SExt8(1));
+    RUN(testSExt16SExt8(42));
+    RUN(testSExt16SExt8(-1));
+    RUN(testSExt16SExt8(0xffff));
+    RUN(testSExt16SExt8(0x10000));
+    RUN(testSExt16SExt16(0));
+    RUN(testSExt16SExt16(1));
+    RUN(testSExt16SExt16(42));
+    RUN(testSExt16SExt16(-1));
+    RUN(testSExt16SExt16(0xffff));
+    RUN(testSExt16SExt16(0x10000));
+    RUN(testSExt16SExt16(0xffffff));
+    RUN(testSExt16SExt16(0x1000000));
+    RUN(testSExt16BitAnd(0, 0));
+    RUN(testSExt16BitAnd(1, 0));
+    RUN(testSExt16BitAnd(42, 0));
+    RUN(testSExt16BitAnd(-1, 0));
+    RUN(testSExt16BitAnd(0xffff, 0));
+    RUN(testSExt16BitAnd(0x10000, 0));
+    RUN(testSExt16BitAnd(0xffffff, 0));
+    RUN(testSExt16BitAnd(0x1000000, 0));
+    RUN(testSExt16BitAnd(0, 0xf));
+    RUN(testSExt16BitAnd(1, 0xf));
+    RUN(testSExt16BitAnd(42, 0xf));
+    RUN(testSExt16BitAnd(-1, 0xf));
+    RUN(testSExt16BitAnd(0xffff, 0xf));
+    RUN(testSExt16BitAnd(0x10000, 0xf));
+    RUN(testSExt16BitAnd(0xffffff, 0xf));
+    RUN(testSExt16BitAnd(0x1000000, 0xf));
+    RUN(testSExt16BitAnd(0, 0xffff));
+    RUN(testSExt16BitAnd(1, 0xffff));
+    RUN(testSExt16BitAnd(42, 0xffff));
+    RUN(testSExt16BitAnd(-1, 0xffff));
+    RUN(testSExt16BitAnd(0xffff, 0xffff));
+    RUN(testSExt16BitAnd(0x10000, 0xffff));
+    RUN(testSExt16BitAnd(0xffffff, 0xffff));
+    RUN(testSExt16BitAnd(0x1000000, 0xffff));
+    RUN(testSExt16BitAnd(0, 0x8000));
+    RUN(testSExt16BitAnd(1, 0x8000));
+    RUN(testSExt16BitAnd(42, 0x8000));
+    RUN(testSExt16BitAnd(-1, 0x8000));
+    RUN(testSExt16BitAnd(0xffff, 0x8000));
+    RUN(testSExt16BitAnd(0x10000, 0x8000));
+    RUN(testSExt16BitAnd(0xffffff, 0x8000));
+    RUN(testSExt16BitAnd(0x1000000, 0x8000));
+    RUN(testBitAndSExt16(0, 0xf));
+    RUN(testBitAndSExt16(1, 0xf));
+    RUN(testBitAndSExt16(42, 0xf));
+    RUN(testBitAndSExt16(-1, 0xf));
+    RUN(testBitAndSExt16(0xffff, 0xf));
+    RUN(testBitAndSExt16(0x10000, 0xf));
+    RUN(testBitAndSExt16(0xffffff, 0xf));
+    RUN(testBitAndSExt16(0x1000000, 0xf));
+    RUN(testBitAndSExt16(0, 0xffff));
+    RUN(testBitAndSExt16(1, 0xffff));
+    RUN(testBitAndSExt16(42, 0xffff));
+    RUN(testBitAndSExt16(-1, 0xffff));
+    RUN(testBitAndSExt16(0xffff, 0xffff));
+    RUN(testBitAndSExt16(0x10000, 0xffff));
+    RUN(testBitAndSExt16(0xffffff, 0xffff));
+    RUN(testBitAndSExt16(0x1000000, 0xffff));
+    RUN(testBitAndSExt16(0, 0xfffff));
+    RUN(testBitAndSExt16(1, 0xfffff));
+    RUN(testBitAndSExt16(42, 0xfffff));
+    RUN(testBitAndSExt16(-1, 0xfffff));
+    RUN(testBitAndSExt16(0xffff, 0xfffff));
+    RUN(testBitAndSExt16(0x10000, 0xfffff));
+    RUN(testBitAndSExt16(0xffffff, 0xfffff));
+    RUN(testBitAndSExt16(0x1000000, 0xfffff));
+
+    RUN(testSExt32BitAnd(0, 0));
+    RUN(testSExt32BitAnd(1, 0));
+    RUN(testSExt32BitAnd(42, 0));
+    RUN(testSExt32BitAnd(-1, 0));
+    RUN(testSExt32BitAnd(0x80000000, 0));
+    RUN(testSExt32BitAnd(0, 0xf));
+    RUN(testSExt32BitAnd(1, 0xf));
+    RUN(testSExt32BitAnd(42, 0xf));
+    RUN(testSExt32BitAnd(-1, 0xf));
+    RUN(testSExt32BitAnd(0x80000000, 0xf));
+    RUN(testSExt32BitAnd(0, 0x80000000));
+    RUN(testSExt32BitAnd(1, 0x80000000));
+    RUN(testSExt32BitAnd(42, 0x80000000));
+    RUN(testSExt32BitAnd(-1, 0x80000000));
+    RUN(testSExt32BitAnd(0x80000000, 0x80000000));
+    RUN(testBitAndSExt32(0, 0xf));
+    RUN(testBitAndSExt32(1, 0xf));
+    RUN(testBitAndSExt32(42, 0xf));
+    RUN(testBitAndSExt32(-1, 0xf));
+    RUN(testBitAndSExt32(0xffff, 0xf));
+    RUN(testBitAndSExt32(0x10000, 0xf));
+    RUN(testBitAndSExt32(0xffffff, 0xf));
+    RUN(testBitAndSExt32(0x1000000, 0xf));
+    RUN(testBitAndSExt32(0, 0xffff00000000llu));
+    RUN(testBitAndSExt32(1, 0xffff00000000llu));
+    RUN(testBitAndSExt32(42, 0xffff00000000llu));
+    RUN(testBitAndSExt32(-1, 0xffff00000000llu));
+    RUN(testBitAndSExt32(0x80000000, 0xffff00000000llu));
+
+    RUN(testBasicSelect());
+    RUN(testSelectTest());
+    RUN(testSelectCompareDouble());
+    RUN_BINARY(testSelectCompareFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testSelectCompareFloatToDouble, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN(testSelectDouble());
+    RUN(testSelectDoubleTest());
+    RUN(testSelectDoubleCompareDouble());
+    RUN_BINARY(testSelectDoubleCompareFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN_BINARY(testSelectFloatCompareFloat, floatingPointOperands<float>(), floatingPointOperands<float>());
+    RUN(testSelectDoubleCompareDoubleWithAliasing());
+    RUN(testSelectFloatCompareFloatWithAliasing());
+    RUN(testSelectFold(42));
+    RUN(testSelectFold(43));
+    RUN(testSelectInvert());
+    RUN(testCheckSelect());
+    RUN(testCheckSelectCheckSelect());
+    RUN_BINARY(testPowDoubleByIntegerLoop, floatingPointOperands<double>(), int64Operands());
+
+    RUN(testTruncOrHigh());
+    RUN(testTruncOrLow());
+    RUN(testBitAndOrHigh());
+    RUN(testBitAndOrLow());
+
+    RUN(testBranch64Equal(0, 0));
+    RUN(testBranch64Equal(1, 1));
+    RUN(testBranch64Equal(-1, -1));
+    RUN(testBranch64Equal(1, -1));
+    RUN(testBranch64Equal(-1, 1));
+    RUN(testBranch64EqualImm(0, 0));
+    RUN(testBranch64EqualImm(1, 1));
+    RUN(testBranch64EqualImm(-1, -1));
+    RUN(testBranch64EqualImm(1, -1));
+    RUN(testBranch64EqualImm(-1, 1));
+    RUN(testBranch64EqualMem(0, 0));
+    RUN(testBranch64EqualMem(1, 1));
+    RUN(testBranch64EqualMem(-1, -1));
+    RUN(testBranch64EqualMem(1, -1));
+    RUN(testBranch64EqualMem(-1, 1));
+    RUN(testBranch64EqualMemImm(0, 0));
+    RUN(testBranch64EqualMemImm(1, 1));
+    RUN(testBranch64EqualMemImm(-1, -1));
+    RUN(testBranch64EqualMemImm(1, -1));
+    RUN(testBranch64EqualMemImm(-1, 1));
+
+    RUN(testStore8Load8Z(0));
+    RUN(testStore8Load8Z(123));
+    RUN(testStore8Load8Z(12345));
+    RUN(testStore8Load8Z(-123));
+
+    RUN(testStore16Load16Z(0));
+    RUN(testStore16Load16Z(123));
+    RUN(testStore16Load16Z(12345));
+    RUN(testStore16Load16Z(12345678));
+    RUN(testStore16Load16Z(-123));
+
+    RUN(testSShrShl32(42, 24, 24));
+    RUN(testSShrShl32(-42, 24, 24));
+    RUN(testSShrShl32(4200, 24, 24));
+    RUN(testSShrShl32(-4200, 24, 24));
+    RUN(testSShrShl32(4200000, 24, 24));
+    RUN(testSShrShl32(-4200000, 24, 24));
+
+    RUN(testSShrShl32(42, 16, 16));
+    RUN(testSShrShl32(-42, 16, 16));
+    RUN(testSShrShl32(4200, 16, 16));
+    RUN(testSShrShl32(-4200, 16, 16));
+    RUN(testSShrShl32(4200000, 16, 16));
+    RUN(testSShrShl32(-4200000, 16, 16));
+
+    RUN(testSShrShl32(42, 8, 8));
+    RUN(testSShrShl32(-42, 8, 8));
+    RUN(testSShrShl32(4200, 8, 8));
+    RUN(testSShrShl32(-4200, 8, 8));
+    RUN(testSShrShl32(4200000, 8, 8));
+    RUN(testSShrShl32(-4200000, 8, 8));
+    RUN(testSShrShl32(420000000, 8, 8));
+    RUN(testSShrShl32(-420000000, 8, 8));
+
+    RUN(testSShrShl64(42, 56, 56));
+    RUN(testSShrShl64(-42, 56, 56));
+    RUN(testSShrShl64(4200, 56, 56));
+    RUN(testSShrShl64(-4200, 56, 56));
+    RUN(testSShrShl64(4200000, 56, 56));
+    RUN(testSShrShl64(-4200000, 56, 56));
+    RUN(testSShrShl64(420000000, 56, 56));
+    RUN(testSShrShl64(-420000000, 56, 56));
+    RUN(testSShrShl64(42000000000, 56, 56));
+    RUN(testSShrShl64(-42000000000, 56, 56));
+
+    RUN(testSShrShl64(42, 48, 48));
+    RUN(testSShrShl64(-42, 48, 48));
+    RUN(testSShrShl64(4200, 48, 48));
+    RUN(testSShrShl64(-4200, 48, 48));
+    RUN(testSShrShl64(4200000, 48, 48));
+    RUN(testSShrShl64(-4200000, 48, 48));
+    RUN(testSShrShl64(420000000, 48, 48));
+    RUN(testSShrShl64(-420000000, 48, 48));
+    RUN(testSShrShl64(42000000000, 48, 48));
+    RUN(testSShrShl64(-42000000000, 48, 48));
+
+    RUN(testSShrShl64(42, 32, 32));
+    RUN(testSShrShl64(-42, 32, 32));
+    RUN(testSShrShl64(4200, 32, 32));
+    RUN(testSShrShl64(-4200, 32, 32));
+    RUN(testSShrShl64(4200000, 32, 32));
+    RUN(testSShrShl64(-4200000, 32, 32));
+    RUN(testSShrShl64(420000000, 32, 32));
+    RUN(testSShrShl64(-420000000, 32, 32));
+    RUN(testSShrShl64(42000000000, 32, 32));
+    RUN(testSShrShl64(-42000000000, 32, 32));
+
+    RUN(testSShrShl64(42, 24, 24));
+    RUN(testSShrShl64(-42, 24, 24));
+    RUN(testSShrShl64(4200, 24, 24));
+    RUN(testSShrShl64(-4200, 24, 24));
+    RUN(testSShrShl64(4200000, 24, 24));
+    RUN(testSShrShl64(-4200000, 24, 24));
+    RUN(testSShrShl64(420000000, 24, 24));
+    RUN(testSShrShl64(-420000000, 24, 24));
+    RUN(testSShrShl64(42000000000, 24, 24));
+    RUN(testSShrShl64(-42000000000, 24, 24));
+
+    RUN(testSShrShl64(42, 16, 16));
+    RUN(testSShrShl64(-42, 16, 16));
+    RUN(testSShrShl64(4200, 16, 16));
+    RUN(testSShrShl64(-4200, 16, 16));
+    RUN(testSShrShl64(4200000, 16, 16));
+    RUN(testSShrShl64(-4200000, 16, 16));
+    RUN(testSShrShl64(420000000, 16, 16));
+    RUN(testSShrShl64(-420000000, 16, 16));
+    RUN(testSShrShl64(42000000000, 16, 16));
+    RUN(testSShrShl64(-42000000000, 16, 16));
+
+    RUN(testSShrShl64(42, 8, 8));
+    RUN(testSShrShl64(-42, 8, 8));
+    RUN(testSShrShl64(4200, 8, 8));
+    RUN(testSShrShl64(-4200, 8, 8));
+    RUN(testSShrShl64(4200000, 8, 8));
+    RUN(testSShrShl64(-4200000, 8, 8));
+    RUN(testSShrShl64(420000000, 8, 8));
+    RUN(testSShrShl64(-420000000, 8, 8));
+    RUN(testSShrShl64(42000000000, 8, 8));
+    RUN(testSShrShl64(-42000000000, 8, 8));
+
+    RUN(testCheckMul64SShr());
+
+    RUN_BINARY(testRotR, int32Operands(), int32Operands());
+    RUN_BINARY(testRotR, int64Operands(), int32Operands());
+    RUN_BINARY(testRotL, int32Operands(), int32Operands());
+    RUN_BINARY(testRotL, int64Operands(), int32Operands());
+
+    RUN_BINARY(testRotRWithImmShift, int32Operands(), int32Operands());
+    RUN_BINARY(testRotRWithImmShift, int64Operands(), int32Operands());
+    RUN_BINARY(testRotLWithImmShift, int32Operands(), int32Operands());
+    RUN_BINARY(testRotLWithImmShift, int64Operands(), int32Operands());
+
+    RUN(testComputeDivisionMagic<int32_t>(2, -2147483647, 0));
+    RUN(testTrivialInfiniteLoop());
+    RUN(testFoldPathEqual());
+    
+    RUN(testRShiftSelf32());
+    RUN(testURShiftSelf32());
+    RUN(testLShiftSelf32());
+    RUN(testRShiftSelf64());
+    RUN(testURShiftSelf64());
+    RUN(testLShiftSelf64());
+
+    RUN(testPatchpointDoubleRegs());
+    RUN(testSpillDefSmallerThanUse());
+    RUN(testSpillUseLargerThanDef());
+    RUN(testLateRegister());
+    RUN(testInterpreter());
+    RUN(testReduceStrengthCheckBottomUseInAnotherBlock());
+    RUN(testResetReachabilityDanglingReference());
+    
+    RUN(testEntrySwitchSimple());
+    RUN(testEntrySwitchNoEntrySwitch());
+    RUN(testEntrySwitchWithCommonPaths());
+    RUN(testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint());
+    RUN(testEntrySwitchLoop());
+
+    RUN(testSomeEarlyRegister());
+    RUN(testPatchpointTerminalReturnValue(true));
+    RUN(testPatchpointTerminalReturnValue(false));
+    RUN(testTerminalPatchpointThatNeedsToBeSpilled());
+
+    RUN(testMemoryFence());
+    RUN(testStoreFence());
+    RUN(testLoadFence());
+    RUN(testTrappingLoad());
+    RUN(testTrappingStore());
+    RUN(testTrappingLoadAddStore());
+    RUN(testTrappingLoadDCE());
+    RUN(testTrappingStoreElimination());
+    RUN(testMoveConstants());
+    RUN(testPCOriginMapDoesntInsertNops());
+    RUN(testPinRegisters());
+    RUN(testReduceStrengthReassociation(true));
+    RUN(testReduceStrengthReassociation(false));
+    RUN(testAddShl32());
+    RUN(testAddShl64());
+    RUN(testAddShl65());
+    RUN(testLoadBaseIndexShift2());
+    RUN(testLoadBaseIndexShift32());
+    RUN(testOptimizeMaterialization());
+
+    RUN(testWasmBoundsCheck(0));
+    RUN(testWasmBoundsCheck(100));
+    RUN(testWasmBoundsCheck(10000));
+    RUN(testWasmBoundsCheck(std::numeric_limits<unsigned>::max() - 5));
+    RUN(testWasmAddress());
+
+    if (isX86()) {
+        RUN(testBranchBitAndImmFusion(Identity, Int64, 1, Air::BranchTest32, Air::Arg::Tmp));
+        RUN(testBranchBitAndImmFusion(Identity, Int64, 0xff, Air::BranchTest32, Air::Arg::Tmp));
+        RUN(testBranchBitAndImmFusion(Trunc, Int32, 1, Air::BranchTest32, Air::Arg::Tmp));
+        RUN(testBranchBitAndImmFusion(Trunc, Int32, 0xff, Air::BranchTest32, Air::Arg::Tmp));
+        RUN(testBranchBitAndImmFusion(Load8S, Int32, 1, Air::BranchTest8, Air::Arg::Addr));
+        RUN(testBranchBitAndImmFusion(Load8Z, Int32, 1, Air::BranchTest8, Air::Arg::Addr));
+        RUN(testBranchBitAndImmFusion(Load, Int32, 1, Air::BranchTest32, Air::Arg::Addr));
+        RUN(testBranchBitAndImmFusion(Load, Int64, 1, Air::BranchTest32, Air::Arg::Addr));
+        RUN(testX86LeaAddAddShlLeft());
+        RUN(testX86LeaAddAddShlRight());
+        RUN(testX86LeaAddAdd());
+        RUN(testX86LeaAddShlRight());
+        RUN(testX86LeaAddShlLeftScale1());
+        RUN(testX86LeaAddShlLeftScale2());
+        RUN(testX86LeaAddShlLeftScale4());
+        RUN(testX86LeaAddShlLeftScale8());
+    }
+
+    if (isARM64()) {
+        RUN(testTernarySubInstructionSelection(Identity, Int64, Air::Sub64));
+        RUN(testTernarySubInstructionSelection(Trunc, Int32, Air::Sub32));
+    }
+
+    if (tasks.isEmpty())
+        usage();
+
+    Lock lock;
+
+    Vector<ThreadIdentifier> threads;
+    for (unsigned i = filter ? 1 : WTF::numberOfProcessorCores(); i--;) {
+        threads.append(
+            createThread(
+                "testb3 thread",
+                [&] () {
+                    for (;;) {
+                        RefPtr<SharedTask<void()>> task;
+                        {
+                            LockHolder locker(lock);
+                            if (tasks.isEmpty())
+                                return;
+                            task = tasks.takeFirst();
+                        }
+
+                        task->run();
+                    }
+                }));
+    }
+
+    for (ThreadIdentifier thread : threads)
+        waitForThreadCompletion(thread);
+    crashLock.lock();
+}
+
+} // anonymous namespace
+
+#else // ENABLE(B3_JIT)
+
+static void run(const char*)
+{
+    dataLog("B3 JIT is not enabled.\n");
+}
+
+#endif // ENABLE(B3_JIT)
+
+int main(int argc, char** argv)
+{
+    const char* filter = nullptr;
+    switch (argc) {
+    case 1:
+        break;
+    case 2:
+        filter = argv[1];
+        break;
+    default:
+        usage();
+        break;
+    }
+    
+    run(filter);
+    return 0;
+}
+
diff --git a/bindings/ScriptFunctionCall.cpp b/bindings/ScriptFunctionCall.cpp
new file mode 100644
index 0000000..b649c28
--- /dev/null
+++ b/bindings/ScriptFunctionCall.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptFunctionCall.h"
+
+#include "JSCInlines.h"
+#include "JSLock.h"
+#include "ScriptValue.h"
+#include <wtf/text/WTFString.h>
+
+using namespace JSC;
+
+namespace Deprecated {
+
+void ScriptCallArgumentHandler::appendArgument(const String& argument)
+{
+    JSLockHolder lock(m_exec);
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptCallArgumentHandler::appendArgument(const char* argument)
+{
+    JSLockHolder lock(m_exec);
+    m_arguments.append(jsString(m_exec, String(argument)));
+}
+
+void ScriptCallArgumentHandler::appendArgument(JSValue argument)
+{
+    m_arguments.append(argument);
+}
+
+void ScriptCallArgumentHandler::appendArgument(long argument)
+{
+    JSLockHolder lock(m_exec);
+    m_arguments.append(jsNumber(argument));
+}
+
+void ScriptCallArgumentHandler::appendArgument(long long argument)
+{
+    JSLockHolder lock(m_exec);
+    m_arguments.append(jsNumber(argument));
+}
+
+void ScriptCallArgumentHandler::appendArgument(unsigned int argument)
+{
+    JSLockHolder lock(m_exec);
+    m_arguments.append(jsNumber(argument));
+}
+
+void ScriptCallArgumentHandler::appendArgument(unsigned long argument)
+{
+    JSLockHolder lock(m_exec);
+    m_arguments.append(jsNumber(argument));
+}
+
+void ScriptCallArgumentHandler::appendArgument(int argument)
+{
+    JSLockHolder lock(m_exec);
+    m_arguments.append(jsNumber(argument));
+}
+
+void ScriptCallArgumentHandler::appendArgument(bool argument)
+{
+    m_arguments.append(jsBoolean(argument));
+}
+
+ScriptFunctionCall::ScriptFunctionCall(const Deprecated::ScriptObject& thisObject, const String& name, ScriptFunctionCallHandler callHandler)
+    : ScriptCallArgumentHandler(thisObject.scriptState())
+    , m_callHandler(callHandler)
+    , m_thisObject(thisObject)
+    , m_name(name)
+{
+}
+
+JSValue ScriptFunctionCall::call(bool& hadException)
+{
+    JSObject* thisObject = m_thisObject.jsObject();
+
+    VM& vm = m_exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue function = thisObject->get(m_exec, Identifier::fromString(m_exec, m_name));
+    if (UNLIKELY(scope.exception())) {
+        hadException = true;
+        return { };
+    }
+
+    CallData callData;
+    CallType callType = getCallData(function, callData);
+    if (callType == CallType::None)
+        return { };
+
+    JSValue result;
+    NakedPtr<Exception> exception;
+    if (m_callHandler)
+        result = m_callHandler(m_exec, function, callType, callData, thisObject, m_arguments, exception);
+    else
+        result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments, exception);
+
+    if (exception) {
+        // Do not treat a terminated execution exception as having an exception. Just treat it as an empty result.
+        hadException = !isTerminatedExecutionException(exception);
+        return { };
+    }
+
+    return result;
+}
+
+JSC::JSValue ScriptFunctionCall::call()
+{
+    bool hadException;
+    return call(hadException);
+}
+
+} // namespace Deprecated
diff --git a/bindings/ScriptFunctionCall.h b/bindings/ScriptFunctionCall.h
new file mode 100644
index 0000000..6978414
--- /dev/null
+++ b/bindings/ScriptFunctionCall.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ArgList.h"
+#include "ScriptObject.h"
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+class JSValue;
+}
+
+namespace Deprecated {
+
+class JS_EXPORT_PRIVATE ScriptCallArgumentHandler {
+public:
+    ScriptCallArgumentHandler(JSC::ExecState* state) : m_exec(state) { }
+
+    void appendArgument(const char*);
+    void appendArgument(const String&);
+    void appendArgument(JSC::JSValue);
+    void appendArgument(long);
+    void appendArgument(long long);
+    void appendArgument(unsigned int);
+    void appendArgument(unsigned long);
+    void appendArgument(int);
+    void appendArgument(bool);
+
+protected:
+    JSC::MarkedArgumentBuffer m_arguments;
+    JSC::ExecState* m_exec;
+
+private:
+    // MarkedArgumentBuffer must be stack allocated, so prevent heap
+    // alloc of ScriptFunctionCall as well.
+    void* operator new(size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
+    void* operator new[](size_t) { ASSERT_NOT_REACHED(); return reinterpret_cast<void*>(0xbadbeef); }
+};
+
+class JS_EXPORT_PRIVATE ScriptFunctionCall : public ScriptCallArgumentHandler {
+public:
+    typedef JSC::JSValue (*ScriptFunctionCallHandler)(JSC::ExecState* exec, JSC::JSValue functionObject, JSC::CallType callType, const JSC::CallData& callData, JSC::JSValue thisValue, const JSC::ArgList& args, NakedPtr<JSC::Exception>&);
+    ScriptFunctionCall(const ScriptObject& thisObject, const String& name, ScriptFunctionCallHandler handler = nullptr);
+    JSC::JSValue call(bool& hadException);
+    JSC::JSValue call();
+
+protected:
+    ScriptFunctionCallHandler m_callHandler;
+    ScriptObject m_thisObject;
+    String m_name;
+};
+
+} // namespace Deprecated
diff --git a/bindings/ScriptObject.cpp b/bindings/ScriptObject.cpp
new file mode 100644
index 0000000..70422e2
--- /dev/null
+++ b/bindings/ScriptObject.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObject.h"
+
+#include "JSCInlines.h"
+
+using namespace JSC;
+
+namespace Deprecated {
+
+ScriptObject::ScriptObject(ExecState* scriptState, JSObject* object)
+    : ScriptValue(scriptState->vm(), object)
+    , m_scriptState(scriptState)
+{
+}
+
+ScriptObject::ScriptObject(ExecState* scriptState, const ScriptValue& scriptValue)
+    : ScriptValue(scriptState->vm(), scriptValue.jsValue())
+    , m_scriptState(scriptState)
+{
+}
+
+} // namespace Deprecated
diff --git a/bindings/ScriptObject.h b/bindings/ScriptObject.h
new file mode 100644
index 0000000..baa1ea8
--- /dev/null
+++ b/bindings/ScriptObject.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "ScriptValue.h"
+
+namespace Deprecated {
+
+class ScriptObject : public ScriptValue {
+public:
+    JS_EXPORT_PRIVATE ScriptObject(JSC::ExecState*, JSC::JSObject*);
+    JS_EXPORT_PRIVATE ScriptObject(JSC::ExecState*, const ScriptValue&);
+    ScriptObject() { }
+
+    operator JSC::JSObject*() const { return jsObject(); }
+
+    JSC::JSObject* jsObject() const { return asObject(jsValue()); }
+    JSC::ExecState* scriptState() const { return m_scriptState; }
+
+private:
+    JSC::ExecState* m_scriptState { nullptr };
+};
+
+} // namespace Deprecated
diff --git a/bindings/ScriptValue.cpp b/bindings/ScriptValue.cpp
new file mode 100644
index 0000000..2a94f3b
--- /dev/null
+++ b/bindings/ScriptValue.cpp
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2013 Apple Inc. All rights reserved.
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptValue.h"
+
+#include "APICast.h"
+#include "InspectorValues.h"
+#include "JSCInlines.h"
+#include "JSLock.h"
+
+using namespace JSC;
+using namespace Inspector;
+
+namespace Inspector {
+
+static RefPtr<InspectorValue> jsToInspectorValue(ExecState& scriptState, JSValue value, int maxDepth)
+{
+    if (!value) {
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    if (!maxDepth)
+        return nullptr;
+
+    maxDepth--;
+
+    if (value.isUndefinedOrNull())
+        return InspectorValue::null();
+    if (value.isBoolean())
+        return InspectorValue::create(value.asBoolean());
+    if (value.isNumber() && value.isDouble())
+        return InspectorValue::create(value.asNumber());
+    if (value.isNumber() && value.isAnyInt())
+        return InspectorValue::create(static_cast<int>(value.asAnyInt()));
+    if (value.isString())
+        return InspectorValue::create(asString(value)->value(&scriptState));
+
+    if (value.isObject()) {
+        if (isJSArray(value)) {
+            auto inspectorArray = InspectorArray::create();
+            auto& array = *asArray(value);
+            unsigned length = array.length();
+            for (unsigned i = 0; i < length; i++) {
+                auto elementValue = jsToInspectorValue(scriptState, array.getIndex(&scriptState, i), maxDepth);
+                if (!elementValue)
+                    return nullptr;
+                inspectorArray->pushValue(WTFMove(elementValue));
+            }
+            return WTFMove(inspectorArray);
+        }
+        auto inspectorObject = InspectorObject::create();
+        auto& object = *value.getObject();
+        PropertyNameArray propertyNames(&scriptState, PropertyNameMode::Strings);
+        object.methodTable()->getOwnPropertyNames(&object, &scriptState, propertyNames, EnumerationMode());
+        for (auto& name : propertyNames) {
+            auto inspectorValue = jsToInspectorValue(scriptState, object.get(&scriptState, name), maxDepth);
+            if (!inspectorValue)
+                return nullptr;
+            inspectorObject->setValue(name.string(), WTFMove(inspectorValue));
+        }
+        return WTFMove(inspectorObject);
+    }
+
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+RefPtr<InspectorValue> toInspectorValue(ExecState& state, JSValue value)
+{
+    // FIXME: Maybe we should move the JSLockHolder stuff to the callers since this function takes a JSValue directly.
+    // Doing the locking here made sense when we were trying to abstract the difference between multiple JavaScript engines.
+    JSLockHolder holder(&state);
+    return jsToInspectorValue(state, value, InspectorValue::maxDepth);
+}
+
+} // namespace Inspector
+
+namespace Deprecated {
+
+ScriptValue::~ScriptValue()
+{
+}
+
+bool ScriptValue::getString(ExecState* scriptState, String& result) const
+{
+    if (!m_value)
+        return false;
+    JSLockHolder lock(scriptState);
+    if (!m_value.get().getString(scriptState, result))
+        return false;
+    return true;
+}
+
+String ScriptValue::toString(ExecState* scriptState) const
+{
+    VM& vm = scriptState->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    String result = m_value.get().toWTFString(scriptState);
+    // Handle the case where an exception is thrown as part of invoking toString on the object.
+    if (UNLIKELY(scope.exception()))
+        scope.clearException();
+    return result;
+}
+
+bool ScriptValue::isEqual(ExecState* scriptState, const ScriptValue& anotherValue) const
+{
+    if (hasNoValue())
+        return anotherValue.hasNoValue();
+    return JSValueIsStrictEqual(toRef(scriptState), toRef(scriptState, jsValue()), toRef(scriptState, anotherValue.jsValue()));
+}
+
+bool ScriptValue::isNull() const
+{
+    if (!m_value)
+        return false;
+    return m_value.get().isNull();
+}
+
+bool ScriptValue::isUndefined() const
+{
+    if (!m_value)
+        return false;
+    return m_value.get().isUndefined();
+}
+
+bool ScriptValue::isObject() const
+{
+    if (!m_value)
+        return false;
+    return m_value.get().isObject();
+}
+
+bool ScriptValue::isFunction() const
+{
+    CallData callData;
+    return getCallData(m_value.get(), callData) != CallType::None;
+}
+
+RefPtr<InspectorValue> ScriptValue::toInspectorValue(ExecState* scriptState) const
+{
+    JSLockHolder holder(scriptState);
+    return jsToInspectorValue(*scriptState, m_value.get(), InspectorValue::maxDepth);
+}
+
+} // namespace Deprecated
diff --git a/bindings/ScriptValue.h b/bindings/ScriptValue.h
new file mode 100644
index 0000000..7eb5072
--- /dev/null
+++ b/bindings/ScriptValue.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (c) 2008, 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "JSCJSValueInlines.h"
+#include "Operations.h"
+#include "Strong.h"
+#include "StrongInlines.h"
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class InspectorValue;
+
+JS_EXPORT_PRIVATE RefPtr<InspectorValue> toInspectorValue(JSC::ExecState&, JSC::JSValue);
+
+}
+
+namespace Deprecated {
+
+class JS_EXPORT_PRIVATE ScriptValue {
+public:
+    ScriptValue() { }
+    ScriptValue(JSC::VM& vm, JSC::JSValue value) : m_value(vm, value) { }
+    virtual ~ScriptValue();
+
+    operator JSC::JSValue() const { return jsValue(); }
+    JSC::JSValue jsValue() const { return m_value.get(); }
+    bool getString(JSC::ExecState*, String& result) const;
+    String toString(JSC::ExecState*) const;
+    bool isEqual(JSC::ExecState*, const ScriptValue&) const;
+    bool isNull() const;
+    bool isUndefined() const;
+    bool isObject() const;
+    bool isFunction() const;
+    bool hasNoValue() const { return !m_value; }
+
+    void clear() { m_value.clear(); }
+
+    bool operator==(const ScriptValue& other) const { return m_value == other.m_value; }
+
+    RefPtr<Inspector::InspectorValue> toInspectorValue(JSC::ExecState*) const;
+
+private:
+    JSC::Strong<JSC::Unknown> m_value;
+};
+
+} // namespace Deprecated
diff --git a/builtins/ArrayConstructor.js b/builtins/ArrayConstructor.js
new file mode 100644
index 0000000..73add1a
--- /dev/null
+++ b/builtins/ArrayConstructor.js
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function of(/* items... */)
+{
+    "use strict";
+
+    var length = arguments.length;
+    var array = @isConstructor(this) ? new this(length) : @newArrayWithSize(length);
+    for (var k = 0; k < length; ++k)
+        @putByValDirect(array, k, arguments[k]);
+    array.length = length;
+    return array;
+}
+
+function from(items /*, mapFn, thisArg */)
+{
+    "use strict";
+
+    var thisObj = this;
+
+    var mapFn = @argument(1);
+
+    var thisArg;
+
+    if (mapFn !== @undefined) {
+        if (typeof mapFn !== "function")
+            @throwTypeError("Array.from requires that the second argument, when provided, be a function");
+
+        thisArg = @argument(2);
+    }
+
+    if (items == null)
+        @throwTypeError("Array.from requires an array-like object - not null or undefined");
+
+    var iteratorMethod = items.@iteratorSymbol;
+    if (iteratorMethod != null) {
+        if (typeof iteratorMethod !== "function")
+            @throwTypeError("Array.from requires that the property of the first argument, items[Symbol.iterator], when exists, be a function");
+
+        var result = @isConstructor(thisObj) ? new thisObj() : [];
+
+        var k = 0;
+        var iterator = iteratorMethod.@call(items);
+
+        // Since for-of loop once more looks up the @@iterator property of a given iterable,
+        // it could be observable if the user defines a getter for @@iterator.
+        // To avoid this situation, we define a wrapper object that @@iterator just returns a given iterator.
+        var wrapper = {}
+        wrapper.@iteratorSymbol = function() { return iterator; };
+
+        for (var value of wrapper) {
+            if (mapFn)
+                @putByValDirect(result, k, thisArg === @undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));
+            else
+                @putByValDirect(result, k, value);
+            k += 1;
+        }
+
+        result.length = k;
+        return result;
+    }
+
+    var arrayLike = @Object(items);
+    var arrayLikeLength = @toLength(arrayLike.length);
+
+    var result = @isConstructor(thisObj) ? new thisObj(arrayLikeLength) : @newArrayWithSize(arrayLikeLength);
+
+    var k = 0;
+    while (k < arrayLikeLength) {
+        var value = arrayLike[k];
+        if (mapFn)
+            @putByValDirect(result, k, thisArg === @undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));
+        else
+            @putByValDirect(result, k, value);
+        k += 1;
+    }
+
+    result.length = arrayLikeLength;
+    return result;
+}
+
+function isArray(array)
+{
+    "use strict";
+
+    if (@isJSArray(array) || @isDerivedArray(array))
+        return true;
+    if (!@isProxyObject(array))
+        return false;
+    return @isArraySlow(array);
+}
diff --git a/builtins/ArrayIteratorPrototype.js b/builtins/ArrayIteratorPrototype.js
new file mode 100644
index 0000000..92640f7
--- /dev/null
+++ b/builtins/ArrayIteratorPrototype.js
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function next()
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("%ArrayIteratorPrototype%.next requires that |this| not be null or undefined");
+
+    let next = this.@arrayIteratorNext;
+    if (next === @undefined)
+        @throwTypeError("%ArrayIteratorPrototype%.next requires that |this| be an Array Iterator instance");
+
+    return next.@call(this);
+}
+
+@globalPrivate
+function arrayIteratorValueNext()
+{
+    "use strict";
+    var done = true;
+    var value;
+
+    var array = this.@iteratedObject;
+    if (!this.@arrayIteratorIsDone) {
+        var index = this.@arrayIteratorNextIndex;
+        var length = array.length >>> 0;
+        if (index >= length) {
+            this.@arrayIteratorIsDone = true;
+        } else {
+            this.@arrayIteratorNextIndex = index + 1;
+            done = false;
+            value = array[index];
+        }
+    }
+
+    return { done, value };
+}
+
+@globalPrivate
+function arrayIteratorKeyNext()
+{
+    "use strict";
+    var done = true;
+    var value;
+
+    var array = this.@iteratedObject;
+    if (!this.@arrayIteratorIsDone) {
+        var index = this.@arrayIteratorNextIndex;
+        var length = array.length >>> 0;
+        if (index >= length) {
+            this.@arrayIteratorIsDone = true;
+        } else {
+            this.@arrayIteratorNextIndex = index + 1;
+            done = false;
+            value = index;
+        }
+    }
+
+    return { done, value };
+}
+
+@globalPrivate
+function arrayIteratorKeyValueNext()
+{
+    "use strict";
+    var done = true;
+    var value;
+
+    var array = this.@iteratedObject;
+    if (!this.@arrayIteratorIsDone) {
+        var index = this.@arrayIteratorNextIndex;
+        var length = array.length >>> 0;
+        if (index >= length) {
+            this.@arrayIteratorIsDone = true;
+        } else {
+            this.@arrayIteratorNextIndex = index + 1;
+            done = false;
+            value = [ index, array[index] ];
+        }
+    }
+
+    return { done, value };
+}
diff --git a/builtins/ArrayPrototype.js b/builtins/ArrayPrototype.js
new file mode 100644
index 0000000..55090c6
--- /dev/null
+++ b/builtins/ArrayPrototype.js
@@ -0,0 +1,782 @@
+/*
+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+@constructor
+@globalPrivate
+function createArrayIterator(iteratedObject, kind, iterationFunction)
+{
+    this.@iteratedObject = iteratedObject;
+    this.@arrayIteratorKind = kind;
+    this.@arrayIteratorNextIndex = 0;
+    this.@arrayIteratorNext = iterationFunction;
+    this.@arrayIteratorIsDone = false;
+}
+
+function values()
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.values requires that |this| not be null or undefined");
+
+    return new @createArrayIterator(@Object(this), "value", @arrayIteratorValueNext);
+}
+
+function keys()
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.keys requires that |this| not be null or undefined");
+
+    return new @createArrayIterator(@Object(this), "key", @arrayIteratorKeyNext);
+}
+
+function entries()
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.entries requires that |this| not be null or undefined");
+
+    return new @createArrayIterator(@Object(this), "key+value", @arrayIteratorKeyValueNext);
+}
+
+function reduce(callback /*, initialValue */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.reduce requires that |this| not be null or undefined");
+
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.reduce callback must be a function");
+
+    var argumentCount = @argumentCount();
+    if (length === 0 && argumentCount < 2)
+        @throwTypeError("reduce of empty array with no initial value");
+
+    var accumulator, k = 0;
+    if (argumentCount > 1)
+        accumulator = @argument(1);
+    else {
+        while (k < length && !(k in array))
+            k += 1;
+        if (k >= length)
+            @throwTypeError("reduce of empty array with no initial value");
+        accumulator = array[k++];
+    }
+
+    while (k < length) {
+        if (k in array)
+            accumulator = callback.@call(@undefined, accumulator, array[k], k, array);
+        k += 1;
+    }
+    return accumulator;
+}
+
+function reduceRight(callback /*, initialValue */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.reduceRight requires that |this| not be null or undefined");
+
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.reduceRight callback must be a function");
+
+    var argumentCount = @argumentCount();
+    if (length === 0 && argumentCount < 2)
+        @throwTypeError("reduceRight of empty array with no initial value");
+
+    var accumulator, k = length - 1;
+    if (argumentCount > 1)
+        accumulator = @argument(1);
+    else {
+        while (k >= 0 && !(k in array))
+            k -= 1;
+        if (k < 0)
+            @throwTypeError("reduceRight of empty array with no initial value");
+        accumulator = array[k--];
+    }
+
+    while (k >= 0) {
+        if (k in array)
+            accumulator = callback.@call(@undefined, accumulator, array[k], k, array);
+        k -= 1;
+    }
+    return accumulator;
+}
+
+function every(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.every requires that |this| not be null or undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.every callback must be a function");
+    
+    var thisArg = @argument(1);
+    
+    for (var i = 0; i < length; i++) {
+        if (!(i in array))
+            continue;
+        if (!callback.@call(thisArg, array[i], i, array))
+            return false;
+    }
+    
+    return true;
+}
+
+function forEach(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.forEach requires that |this| not be null or undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.forEach callback must be a function");
+    
+    var thisArg = @argument(1);
+    
+    for (var i = 0; i < length; i++) {
+        if (i in array)
+            callback.@call(thisArg, array[i], i, array);
+    }
+}
+
+function filter(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.filter requires that |this| not be null or undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.filter callback must be a function");
+    
+    var thisArg = @argument(1);
+
+    // Do 9.4.2.3 ArraySpeciesCreate
+    var result;
+    var constructor;
+    if (@isArray(array)) {
+        constructor = array.constructor;
+        // We have this check so that if some array from a different global object
+        // calls this map they don't get an array with the Array.prototype of the
+        // other global object.
+        if (@isArrayConstructor(constructor) && @Array !== constructor)
+            constructor = @undefined;
+        if (@isObject(constructor)) {
+            constructor = constructor.@speciesSymbol;
+            if (constructor === null)
+                constructor = @undefined;
+        }
+    }
+    if (constructor === @Array || constructor === @undefined)
+        result = @newArrayWithSize(0);
+    else
+        result = new constructor(0);
+
+    var nextIndex = 0;
+    for (var i = 0; i < length; i++) {
+        if (!(i in array))
+            continue;
+        var current = array[i]
+        if (callback.@call(thisArg, current, i, array)) {
+            @putByValDirect(result, nextIndex, current);
+            ++nextIndex;
+        }
+    }
+    return result;
+}
+
+function map(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.map requires that |this| not be null or undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.map callback must be a function");
+    
+    var thisArg = @argument(1);
+
+    // Do 9.4.2.3 ArraySpeciesCreate
+    var result;
+    var constructor;
+    if (@isArray(array)) {
+        constructor = array.constructor;
+        // We have this check so that if some array from a different global object
+        // calls this map they don't get an array with the Array.prototype of the
+        // other global object.
+        if (@isArrayConstructor(constructor) && @Array !== constructor)
+            constructor = @undefined;
+        if (@isObject(constructor)) {
+            constructor = constructor.@speciesSymbol;
+            if (constructor === null)
+                constructor = @undefined;
+        }
+    }
+    if (constructor === @Array || constructor === @undefined)
+        result = @newArrayWithSize(length);
+    else
+        result = new constructor(length);
+
+    var nextIndex = 0;
+    for (var i = 0; i < length; i++) {
+        if (!(i in array))
+            continue;
+        var mappedValue = callback.@call(thisArg, array[i], i, array);
+        @putByValDirect(result, i, mappedValue);
+    }
+    return result;
+}
+
+function some(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.some requires that |this| not be null or undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.some callback must be a function");
+    
+    var thisArg = @argument(1);
+    for (var i = 0; i < length; i++) {
+        if (!(i in array))
+            continue;
+        if (callback.@call(thisArg, array[i], i, array))
+            return true;
+    }
+    return false;
+}
+
+function fill(value /* [, start [, end]] */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.fill requires that |this| not be null or undefined");
+
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    var relativeStart = @toInteger(@argument(1));
+    var k = 0;
+    if (relativeStart < 0) {
+        k = length + relativeStart;
+        if (k < 0)
+            k = 0;
+    } else {
+        k = relativeStart;
+        if (k > length)
+            k = length;
+    }
+    var relativeEnd = length;
+    var end = @argument(2);
+    if (end !== @undefined)
+        relativeEnd = @toInteger(end);
+    var final = 0;
+    if (relativeEnd < 0) {
+        final = length + relativeEnd;
+        if (final < 0)
+            final = 0;
+    } else {
+        final = relativeEnd;
+        if (final > length)
+            final = length;
+    }
+    for (; k < final; k++)
+        array[k] = value;
+    return array;
+}
+
+function find(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.find requires that |this| not be null or undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.find callback must be a function");
+    
+    var thisArg = @argument(1);
+    for (var i = 0; i < length; i++) {
+        var kValue = array[i];
+        if (callback.@call(thisArg, kValue, i, array))
+            return kValue;
+    }
+    return @undefined;
+}
+
+function findIndex(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.findIndex requires that |this| not be null or undefined");
+    
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (typeof callback !== "function")
+        @throwTypeError("Array.prototype.findIndex callback must be a function");
+    
+    var thisArg = @argument(1);
+    for (var i = 0; i < length; i++) {
+        if (callback.@call(thisArg, array[i], i, array))
+            return i;
+    }
+    return -1;
+}
+
+function includes(searchElement /*, fromIndex*/)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.includes requires that |this| not be null or undefined");
+
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    if (length === 0)
+        return false;
+
+    var fromIndex = 0;
+    var from = @argument(1);
+    if (from !== @undefined)
+        fromIndex = @toInteger(from);
+
+    var index;
+    if (fromIndex >= 0)
+        index = fromIndex;
+    else
+        index = length + fromIndex;
+
+    if (index < 0)
+        index = 0;
+
+    var currentElement;
+    for (; index < length; ++index) {
+        currentElement = array[index];
+        // Use SameValueZero comparison, rather than just StrictEquals.
+        if (searchElement === currentElement || (searchElement !== searchElement && currentElement !== currentElement))
+            return true;
+    }
+    return false;
+}
+
+function sort(comparator)
+{
+    "use strict";
+
+    function min(a, b)
+    {
+        return a < b ? a : b;
+    }
+
+    function stringComparator(a, b)
+    {
+        var aString = a.string;
+        var bString = b.string;
+
+        var aLength = aString.length;
+        var bLength = bString.length;
+        var length = min(aLength, bLength);
+
+        for (var i = 0; i < length; ++i) {
+            var aCharCode = aString.@charCodeAt(i);
+            var bCharCode = bString.@charCodeAt(i);
+
+            if (aCharCode == bCharCode)
+                continue;
+
+            return aCharCode - bCharCode;
+        }
+
+        return aLength - bLength;
+    }
+
+    // Move undefineds and holes to the end of a sparse array. Result is [values..., undefineds..., holes...].
+    function compactSparse(array, dst, src, length)
+    {
+        var values = [ ];
+        var seen = { };
+        var valueCount = 0;
+        var undefinedCount = 0;
+
+        // Clean up after the in-progress non-sparse compaction that failed.
+        for (var i = dst; i < src; ++i)
+            delete array[i];
+
+        for (var object = array; object; object = @Object.@getPrototypeOf(object)) {
+            var propertyNames = @Object.@getOwnPropertyNames(object);
+            for (var i = 0; i < propertyNames.length; ++i) {
+                var index = propertyNames[i];
+                if (index < length) { // Exclude non-numeric properties and properties past length.
+                    if (seen[index]) // Exclude duplicates.
+                        continue;
+                    seen[index] = 1;
+
+                    var value = array[index];
+                    delete array[index];
+
+                    if (value === @undefined) {
+                        ++undefinedCount;
+                        continue;
+                    }
+
+                    array[valueCount++] = value;
+                }
+            }
+        }
+
+        for (var i = valueCount; i < valueCount + undefinedCount; ++i)
+            array[i] = @undefined;
+
+        return valueCount;
+    }
+
+    function compactSlow(array, length)
+    {
+        var holeCount = 0;
+
+        for (var dst = 0, src = 0; src < length; ++src) {
+            if (!(src in array)) {
+                ++holeCount;
+                if (holeCount < 256)
+                    continue;
+                return compactSparse(array, dst, src, length);
+            }
+
+            var value = array[src];
+            if (value === @undefined)
+                continue;
+
+            array[dst++] = value;
+        }
+
+        var valueCount = dst;
+        var undefinedCount = length - valueCount - holeCount;
+
+        for (var i = valueCount; i < valueCount + undefinedCount; ++i)
+            array[i] = @undefined;
+
+        for (var i = valueCount + undefinedCount; i < length; ++i)
+            delete array[i];
+
+        return valueCount;
+    }
+
+    // Move undefineds and holes to the end of an array. Result is [values..., undefineds..., holes...].
+    function compact(array, length)
+    {
+        for (var i = 0; i < array.length; ++i) {
+            if (array[i] === @undefined)
+                return compactSlow(array, length);
+        }
+
+        return length;
+    }
+
+    function merge(dst, src, srcIndex, srcEnd, width, comparator)
+    {
+        var left = srcIndex;
+        var leftEnd = min(left + width, srcEnd);
+        var right = leftEnd;
+        var rightEnd = min(right + width, srcEnd);
+
+        for (var dstIndex = left; dstIndex < rightEnd; ++dstIndex) {
+            if (right < rightEnd) {
+                if (left >= leftEnd || comparator(src[right], src[left]) < 0) {
+                    dst[dstIndex] = src[right++];
+                    continue;
+                }
+            }
+
+            dst[dstIndex] = src[left++];
+        }
+    }
+
+    function mergeSort(array, valueCount, comparator)
+    {
+        var buffer = [ ];
+        buffer.length = valueCount;
+
+        var dst = buffer;
+        var src = array;
+        for (var width = 1; width < valueCount; width *= 2) {
+            for (var srcIndex = 0; srcIndex < valueCount; srcIndex += 2 * width)
+                merge(dst, src, srcIndex, valueCount, width, comparator);
+
+            var tmp = src;
+            src = dst;
+            dst = tmp;
+        }
+
+        if (src != array) {
+            for(var i = 0; i < valueCount; i++)
+                array[i] = src[i];
+        }
+    }
+
+    function bucketSort(array, dst, bucket, depth)
+    {
+        if (bucket.length < 32 || depth > 32) {
+            mergeSort(bucket, bucket.length, stringComparator);
+            for (var i = 0; i < bucket.length; ++i)
+                array[dst++] = bucket[i].value;
+            return dst;
+        }
+
+        var buckets = [ ];
+        for (var i = 0; i < bucket.length; ++i) {
+            var entry = bucket[i];
+            var string = entry.string;
+            if (string.length == depth) {
+                array[dst++] = entry.value;
+                continue;
+            }
+
+            var c = string.@charCodeAt(depth);
+            if (!buckets[c])
+                buckets[c] = [ ];
+            buckets[c][buckets[c].length] = entry;
+        }
+
+        for (var i = 0; i < buckets.length; ++i) {
+            if (!buckets[i])
+                continue;
+            dst = bucketSort(array, dst, buckets[i], depth + 1);
+        }
+
+        return dst;
+    }
+
+    function comparatorSort(array, length, comparator)
+    {
+        var valueCount = compact(array, length);
+        mergeSort(array, valueCount, comparator);
+    }
+
+    function stringSort(array, length)
+    {
+        var valueCount = compact(array, length);
+
+        var strings = @newArrayWithSize(valueCount);
+        for (var i = 0; i < valueCount; ++i)
+            strings[i] = { string: @toString(array[i]), value: array[i] };
+
+        bucketSort(array, 0, strings, 0);
+    }
+
+    if (this == null)
+        @throwTypeError("Array.prototype.sort requires that |this| not be null or undefined");
+
+    var array = @Object(this);
+
+    var length = array.length >>> 0;
+
+    // For compatibility with Firefox and Chrome, do nothing observable
+    // to the target array if it has 0 or 1 sortable properties.
+    if (length < 2)
+        return array;
+
+    if (typeof comparator == "function")
+        comparatorSort(array, length, comparator);
+    else if (comparator === @undefined)
+        stringSort(array, length);
+    else
+        @throwTypeError("Array.prototype.sort requires the comparsion function be a function or undefined");
+
+    return array;
+}
+
+function concatSlowPath()
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("Array.prototype.concat requires that |this| not be null or undefined");
+
+    var currentElement = @Object(this);
+
+    var constructor;
+    if (@isArray(currentElement)) {
+        constructor = currentElement.constructor;
+        // We have this check so that if some array from a different global object
+        // calls this map they don't get an array with the Array.prototype of the
+        // other global object.
+        if (@isArrayConstructor(constructor) && @Array !== constructor)
+            constructor = @undefined;
+        else if (@isObject(constructor)) {
+            constructor = constructor.@speciesSymbol;
+            if (constructor === null)
+                constructor = @Array;
+        }
+    }
+
+    var argCount = arguments.length;
+    var result;
+    if (constructor === @Array || constructor === @undefined)
+        result = @newArrayWithSize(0);
+    else
+        result = new constructor(0);
+    var resultIsArray = @isJSArray(result);
+
+    var resultIndex = 0;
+    var argIndex = 0;
+
+    do {
+        let spreadable = @isObject(currentElement) && currentElement.@isConcatSpreadableSymbol;
+        if ((spreadable === @undefined && @isArray(currentElement)) || spreadable) {
+            let length = @toLength(currentElement.length);
+            if (length + resultIndex > @MAX_ARRAY_INDEX)
+                @throwRangeError("Length exceeded the maximum array length");
+            if (resultIsArray && @isJSArray(currentElement)) {
+                @appendMemcpy(result, currentElement, resultIndex);
+                resultIndex += length;
+            } else {
+                for (var i = 0; i < length; i++) {
+                    if (i in currentElement)
+                        @putByValDirect(result, resultIndex, currentElement[i]);
+                    resultIndex++;
+                }
+            }
+        } else {
+            if (resultIndex >= @MAX_ARRAY_INDEX)
+                @throwRangeError("Length exceeded the maximum array length");
+            @putByValDirect(result, resultIndex++, currentElement);
+        }
+        currentElement = arguments[argIndex];
+    } while (argIndex++ < argCount);
+
+    result.length = resultIndex;
+    return result;
+}
+
+function concat(first)
+{
+    "use strict";
+
+    if (@argumentCount() === 1
+        && @isJSArray(this)
+        && this.@isConcatSpreadableSymbol === @undefined
+        && (!@isObject(first) || first.@isConcatSpreadableSymbol === @undefined)) {
+
+        let result = @concatMemcpy(this, first);
+        if (result !== null)
+            return result;
+    }
+
+    return @tailCallForwardArguments(@concatSlowPath, this);
+}
+
+function copyWithin(target, start /*, end */)
+{
+    "use strict";
+
+    function maxWithPositives(a, b)
+    {
+        return (a < b) ? b : a;
+    }
+
+    function minWithMaybeNegativeZeroAndPositive(maybeNegativeZero, positive)
+    {
+        return (maybeNegativeZero < positive) ? maybeNegativeZero : positive;
+    }
+
+    if (this == null)
+        @throwTypeError("Array.copyWithin requires that |this| not be null or undefined");
+
+    var array = @Object(this);
+    var length = @toLength(array.length);
+
+    var relativeTarget = @toInteger(target);
+    var to = (relativeTarget < 0) ? maxWithPositives(length + relativeTarget, 0) : minWithMaybeNegativeZeroAndPositive(relativeTarget, length);
+
+    var relativeStart = @toInteger(start);
+    var from = (relativeStart < 0) ? maxWithPositives(length + relativeStart, 0) : minWithMaybeNegativeZeroAndPositive(relativeStart, length);
+
+    var relativeEnd;
+    var end = @argument(2);
+    if (end === @undefined)
+        relativeEnd = length;
+    else
+        relativeEnd = @toInteger(end);
+
+    var finalValue = (relativeEnd < 0) ? maxWithPositives(length + relativeEnd, 0) : minWithMaybeNegativeZeroAndPositive(relativeEnd, length);
+
+    var count = minWithMaybeNegativeZeroAndPositive(finalValue - from, length - to);
+
+    var direction = 1;
+    if (from < to && to < from + count) {
+        direction = -1;
+        from = from + count - 1;
+        to = to + count - 1;
+    }
+
+    for (var i = 0; i < count; ++i, from += direction, to += direction) {
+        if (from in array)
+            array[to] = array[from];
+        else
+            delete array[to];
+    }
+
+    return array;
+}
diff --git a/builtins/AsyncFunctionPrototype.js b/builtins/AsyncFunctionPrototype.js
new file mode 100644
index 0000000..88cfb01
--- /dev/null
+++ b/builtins/AsyncFunctionPrototype.js
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2016 Caitlin Potter <caitp@igalia.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+@globalPrivate
+function asyncFunctionResume(generator, promiseCapability, sentValue, resumeMode)
+{
+    "use strict";
+    let state = generator.@generatorState;
+    let value = @undefined;
+
+    if (state === @GeneratorStateCompleted || (resumeMode !== @GeneratorResumeModeNormal && resumeMode !== @GeneratorResumeModeThrow))
+        @throwTypeError("Async function illegally resumed");
+
+    try {
+        generator.@generatorState = @GeneratorStateExecuting;
+        value = generator.@generatorNext.@call(generator.@generatorThis, generator, state, sentValue, resumeMode, generator.@generatorFrame);
+        if (generator.@generatorState === @GeneratorStateExecuting) {
+            generator.@generatorState = @GeneratorStateCompleted;
+            promiseCapability.@resolve(value);
+            return promiseCapability.@promise;
+        }
+    } catch (error) {
+        generator.@generatorState = @GeneratorStateCompleted;
+        promiseCapability.@reject(error);
+        return promiseCapability.@promise;
+    }
+
+    let wrappedValue = @newPromiseCapability(@Promise);
+    wrappedValue.@resolve.@call(@undefined, value);
+
+    wrappedValue.@promise.@then(
+        function(value) { @asyncFunctionResume(generator, promiseCapability, value, @GeneratorResumeModeNormal); },
+        function(error) { @asyncFunctionResume(generator, promiseCapability, error, @GeneratorResumeModeThrow); });
+
+    return promiseCapability.@promise;
+}
diff --git a/builtins/BuiltinExecutableCreator.cpp b/builtins/BuiltinExecutableCreator.cpp
new file mode 100644
index 0000000..2b79e7e
--- /dev/null
+++ b/builtins/BuiltinExecutableCreator.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BuiltinExecutableCreator.h"
+
+#include "BuiltinExecutables.h"
+
+namespace JSC {
+
+UnlinkedFunctionExecutable* createBuiltinExecutable(VM& vm, const SourceCode& source, const Identifier& ident, ConstructorKind kind, ConstructAbility ability)
+{
+    return BuiltinExecutables::createExecutable(vm, source, ident, kind, ability);
+}
+    
+} // namespace JSC
diff --git a/builtins/BuiltinExecutableCreator.h b/builtins/BuiltinExecutableCreator.h
new file mode 100644
index 0000000..19c0884
--- /dev/null
+++ b/builtins/BuiltinExecutableCreator.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConstructAbility.h"
+#include "ParserModes.h"
+#include "SourceCode.h"
+
+namespace JSC {
+
+JS_EXPORT_PRIVATE UnlinkedFunctionExecutable* createBuiltinExecutable(VM&, const SourceCode&, const Identifier&, ConstructorKind, ConstructAbility);
+
+} // namespace JSC
diff --git a/builtins/BuiltinExecutables.cpp b/builtins/BuiltinExecutables.cpp
new file mode 100644
index 0000000..c741e5b
--- /dev/null
+++ b/builtins/BuiltinExecutables.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+#include "BuiltinExecutables.h"
+
+#include "BuiltinNames.h"
+#include "JSCInlines.h"
+#include "Parser.h"
+#include <wtf/NeverDestroyed.h>
+
+namespace JSC {
+
+BuiltinExecutables::BuiltinExecutables(VM& vm)
+    : m_vm(vm)
+#define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(makeSource(StringImpl::createFromLiteral(s_##name, length)))
+    JSC_FOREACH_BUILTIN_CODE(INITIALIZE_BUILTIN_SOURCE_MEMBERS)
+#undef EXPOSE_BUILTIN_STRINGS
+{
+}
+
+UnlinkedFunctionExecutable* BuiltinExecutables::createDefaultConstructor(ConstructorKind constructorKind, const Identifier& name)
+{
+    static NeverDestroyed<const String> baseConstructorCode(ASCIILiteral("(function () { })"));
+    static NeverDestroyed<const String> derivedConstructorCode(ASCIILiteral("(function (...args) { super(...args); })"));
+
+    switch (constructorKind) {
+    case ConstructorKind::None:
+        break;
+    case ConstructorKind::Base:
+        return createExecutable(m_vm, makeSource(baseConstructorCode), name, constructorKind, ConstructAbility::CanConstruct);
+    case ConstructorKind::Extends:
+        return createExecutable(m_vm, makeSource(derivedConstructorCode), name, constructorKind, ConstructAbility::CanConstruct);
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+UnlinkedFunctionExecutable* BuiltinExecutables::createBuiltinExecutable(const SourceCode& code, const Identifier& name, ConstructAbility constructAbility)
+{
+    return createExecutable(m_vm, code, name, ConstructorKind::None, constructAbility);
+}
+
+UnlinkedFunctionExecutable* createBuiltinExecutable(VM& vm, const SourceCode& code, const Identifier& name, ConstructAbility constructAbility)
+{
+    return BuiltinExecutables::createExecutable(vm, code, name, ConstructorKind::None, constructAbility);
+}
+
+UnlinkedFunctionExecutable* BuiltinExecutables::createExecutable(VM& vm, const SourceCode& source, const Identifier& name, ConstructorKind constructorKind, ConstructAbility constructAbility)
+{
+    JSTextPosition positionBeforeLastNewline;
+    ParserError error;
+    bool isParsingDefaultConstructor = constructorKind != ConstructorKind::None;
+    JSParserBuiltinMode builtinMode = isParsingDefaultConstructor ? JSParserBuiltinMode::NotBuiltin : JSParserBuiltinMode::Builtin;
+    UnlinkedFunctionKind kind = isParsingDefaultConstructor ? UnlinkedNormalFunction : UnlinkedBuiltinFunction;
+    SourceCode parentSourceOverride = isParsingDefaultConstructor ? source : SourceCode();
+    std::unique_ptr<ProgramNode> program = parse<ProgramNode>(
+        &vm, source, Identifier(), builtinMode,
+        JSParserStrictMode::NotStrict, JSParserScriptMode::Classic, SourceParseMode::ProgramMode, SuperBinding::NotNeeded, error,
+        &positionBeforeLastNewline, constructorKind);
+
+    if (!program) {
+        dataLog("Fatal error compiling builtin function '", name.string(), "': ", error.message());
+        CRASH();
+    }
+
+    StatementNode* exprStatement = program->singleStatement();
+    RELEASE_ASSERT(exprStatement);
+    RELEASE_ASSERT(exprStatement->isExprStatement());
+    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
+    RELEASE_ASSERT(funcExpr);
+    RELEASE_ASSERT(funcExpr->isFuncExprNode());
+    FunctionMetadataNode* metadata = static_cast<FuncExprNode*>(funcExpr)->metadata();
+    RELEASE_ASSERT(!program->hasCapturedVariables());
+    
+    metadata->setEndPosition(positionBeforeLastNewline);
+    RELEASE_ASSERT(metadata);
+    RELEASE_ASSERT(metadata->ident().isNull());
+    
+    // This function assumes an input string that would result in a single anonymous function expression.
+    metadata->setEndPosition(positionBeforeLastNewline);
+    RELEASE_ASSERT(metadata);
+    metadata->overrideName(name);
+    VariableEnvironment dummyTDZVariables;
+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&vm, source, metadata, kind, constructAbility, JSParserScriptMode::Classic, dummyTDZVariables, DerivedContextType::None, WTFMove(parentSourceOverride));
+    return functionExecutable;
+}
+
+void BuiltinExecutables::finalize(Handle<Unknown>, void* context)
+{
+    static_cast<Weak<UnlinkedFunctionExecutable>*>(context)->clear();
+}
+
+#define DEFINE_BUILTIN_EXECUTABLES(name, functionName, length) \
+UnlinkedFunctionExecutable* BuiltinExecutables::name##Executable() \
+{\
+    if (!m_##name##Executable)\
+        m_##name##Executable = Weak<UnlinkedFunctionExecutable>(createBuiltinExecutable(m_##name##Source, m_vm.propertyNames->builtinNames().functionName##PublicName(), s_##name##ConstructAbility), this, &m_##name##Executable);\
+    return m_##name##Executable.get();\
+}
+JSC_FOREACH_BUILTIN_CODE(DEFINE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_SOURCES
+
+}
diff --git a/builtins/BuiltinExecutables.h b/builtins/BuiltinExecutables.h
new file mode 100644
index 0000000..ee0eaad
--- /dev/null
+++ b/builtins/BuiltinExecutables.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCBuiltins.h"
+#include "ParserModes.h"
+#include "SourceCode.h"
+#include "Weak.h"
+#include "WeakHandleOwner.h"
+
+namespace JSC {
+
+class UnlinkedFunctionExecutable;
+class Identifier;
+class VM;
+
+class BuiltinExecutables final: private WeakHandleOwner {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    explicit BuiltinExecutables(VM&);
+
+#define EXPOSE_BUILTIN_EXECUTABLES(name, functionName, length) \
+UnlinkedFunctionExecutable* name##Executable(); \
+const SourceCode& name##Source() { return m_##name##Source; }
+    
+    JSC_FOREACH_BUILTIN_CODE(EXPOSE_BUILTIN_EXECUTABLES)
+#undef EXPOSE_BUILTIN_SOURCES
+
+    UnlinkedFunctionExecutable* createDefaultConstructor(ConstructorKind, const Identifier& name);
+
+    static UnlinkedFunctionExecutable* createExecutable(VM&, const SourceCode&, const Identifier&, ConstructorKind, ConstructAbility);
+private:
+    void finalize(Handle<Unknown>, void* context) override;
+
+    VM& m_vm;
+
+    UnlinkedFunctionExecutable* createBuiltinExecutable(const SourceCode&, const Identifier&, ConstructAbility);
+
+#define DECLARE_BUILTIN_SOURCE_MEMBERS(name, functionName, length)\
+    SourceCode m_##name##Source; \
+    Weak<UnlinkedFunctionExecutable> m_##name##Executable;
+    JSC_FOREACH_BUILTIN_CODE(DECLARE_BUILTIN_SOURCE_MEMBERS)
+#undef DECLARE_BUILTIN_SOURCE_MEMBERS
+};
+
+}
diff --git a/builtins/BuiltinNames.h b/builtins/BuiltinNames.h
new file mode 100644
index 0000000..f9045bf
--- /dev/null
+++ b/builtins/BuiltinNames.h
@@ -0,0 +1,276 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BuiltinUtils.h"
+#include "BytecodeIntrinsicRegistry.h"
+#include "CommonIdentifiers.h"
+#include "JSCBuiltins.h"
+
+namespace JSC {
+
+#define JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_PROPERTY_NAME(macro) \
+    JSC_COMMON_BYTECODE_INTRINSIC_FUNCTIONS_EACH_NAME(macro) \
+    JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(macro) \
+    macro(arrayIteratorNextIndex) \
+    macro(arrayIterationKind) \
+    macro(arrayIteratorNext) \
+    macro(arrayIteratorIsDone) \
+    macro(arrayIteratorKind) \
+    macro(charCodeAt) \
+    macro(isView) \
+    macro(iteratedObject) \
+    macro(iteratedString) \
+    macro(stringIteratorNextIndex) \
+    macro(promise) \
+    macro(fulfillmentHandler) \
+    macro(rejectionHandler) \
+    macro(index) \
+    macro(deferred) \
+    macro(countdownHolder) \
+    macro(Object) \
+    macro(ownEnumerablePropertyKeys) \
+    macro(Number) \
+    macro(Array) \
+    macro(ArrayBuffer) \
+    macro(String) \
+    macro(RegExp) \
+    macro(Map) \
+    macro(Promise) \
+    macro(Reflect) \
+    macro(InternalPromise) \
+    macro(abs) \
+    macro(floor) \
+    macro(trunc) \
+    macro(create) \
+    macro(defineProperty) \
+    macro(getPrototypeOf) \
+    macro(getOwnPropertyDescriptor) \
+    macro(getOwnPropertyNames) \
+    macro(ownKeys) \
+    macro(Error) \
+    macro(RangeError) \
+    macro(TypeError) \
+    macro(typedArrayLength) \
+    macro(typedArraySort) \
+    macro(typedArrayGetOriginalConstructor) \
+    macro(typedArraySubarrayCreate) \
+    macro(BuiltinLog) \
+    macro(homeObject) \
+    macro(getTemplateObject) \
+    macro(templateRegistryKey) \
+    macro(enqueueJob) \
+    macro(promiseState) \
+    macro(promiseReactions) \
+    macro(promiseResult) \
+    macro(onFulfilled) \
+    macro(onRejected) \
+    macro(push) \
+    macro(repeatCharacter) \
+    macro(capabilities) \
+    macro(starDefault) \
+    macro(InspectorInstrumentation) \
+    macro(get) \
+    macro(set) \
+    macro(shift) \
+    macro(allocateTypedArray) \
+    macro(Int8Array) \
+    macro(Int16Array) \
+    macro(Int32Array) \
+    macro(Uint8Array) \
+    macro(Uint8ClampedArray) \
+    macro(Uint16Array) \
+    macro(Uint32Array) \
+    macro(Float32Array) \
+    macro(Float64Array) \
+    macro(exec) \
+    macro(generator) \
+    macro(generatorNext) \
+    macro(generatorState) \
+    macro(generatorFrame) \
+    macro(generatorValue) \
+    macro(generatorThis) \
+    macro(generatorResumeMode) \
+    macro(Collator) \
+    macro(DateTimeFormat) \
+    macro(NumberFormat) \
+    macro(intlSubstituteValue) \
+    macro(thisTimeValue) \
+    macro(thisNumberValue) \
+    macro(newTargetLocal) \
+    macro(derivedConstructor) \
+    macro(isTypedArrayView) \
+    macro(isBoundFunction) \
+    macro(hasInstanceBoundFunction) \
+    macro(instanceOf) \
+    macro(isArraySlow) \
+    macro(isArrayConstructor) \
+    macro(isConstructor) \
+    macro(isDerivedConstructor) \
+    macro(concatMemcpy) \
+    macro(appendMemcpy) \
+    macro(predictFinalLengthFromArgumunts) \
+    macro(print) \
+    macro(regExpCreate) \
+    macro(SetIterator) \
+    macro(setIteratorNext) \
+    macro(replaceUsingRegExp) \
+    macro(replaceUsingStringSearch) \
+    macro(MapIterator) \
+    macro(mapIteratorNext) \
+    macro(regExpBuiltinExec) \
+    macro(regExpMatchFast) \
+    macro(regExpProtoFlagsGetter) \
+    macro(regExpProtoGlobalGetter) \
+    macro(regExpProtoIgnoreCaseGetter) \
+    macro(regExpProtoMultilineGetter) \
+    macro(regExpProtoSourceGetter) \
+    macro(regExpProtoStickyGetter) \
+    macro(regExpProtoUnicodeGetter) \
+    macro(regExpPrototypeSymbolReplace) \
+    macro(regExpReplaceFast) \
+    macro(regExpSearchFast) \
+    macro(regExpSplitFast) \
+    macro(regExpTestFast) \
+    macro(stringIncludesInternal) \
+    macro(stringSplitFast) \
+    macro(stringSubstrInternal) \
+    macro(makeBoundFunction) \
+    macro(hasOwnLengthProperty) \
+    macro(WebAssembly) \
+    macro(Module) \
+    macro(Instance) \
+    macro(Memory) \
+    macro(Table) \
+    macro(CompileError) \
+    macro(RuntimeError) \
+
+
+#define INITIALIZE_PRIVATE_TO_PUBLIC_ENTRY(name) m_privateToPublicMap.add(m_##name##PrivateName.impl(), &m_##name);
+#define INITIALIZE_PUBLIC_TO_PRIVATE_ENTRY(name) m_publicToPrivateMap.add(m_##name.impl(), &m_##name##PrivateName);
+
+// We commandeer the publicToPrivateMap to allow us to convert private symbol names into the appropriate symbol.
+// e.g. @iteratorSymbol points to Symbol.iterator in this map rather than to a an actual private name.
+// FIXME: This is a weird hack and we shouldn't need to do this.
+#define INITIALIZE_SYMBOL_PUBLIC_TO_PRIVATE_ENTRY(name) m_publicToPrivateMap.add(m_##name##SymbolPrivateIdentifier.impl(), &m_##name##Symbol);
+
+class BuiltinNames {
+    WTF_MAKE_NONCOPYABLE(BuiltinNames); WTF_MAKE_FAST_ALLOCATED;
+    
+public:
+    // We treat the dollarVM name as a special case below for $vm (because CommonIdentifiers does not
+    // yet support the $ character).
+
+    BuiltinNames(VM* vm, CommonIdentifiers* commonIdentifiers)
+        : m_emptyIdentifier(commonIdentifiers->emptyIdentifier)
+        JSC_FOREACH_BUILTIN_FUNCTION_NAME(INITIALIZE_BUILTIN_NAMES)
+        JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_PROPERTY_NAME(INITIALIZE_BUILTIN_NAMES)
+        JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_BUILTIN_SYMBOLS)
+        , m_dollarVMName(Identifier::fromString(vm, "$vm"))
+        , m_dollarVMPrivateName(Identifier::fromUid(PrivateName(PrivateName::Description, ASCIILiteral("PrivateSymbol.$vm"))))
+    {
+        JSC_FOREACH_BUILTIN_FUNCTION_NAME(INITIALIZE_PRIVATE_TO_PUBLIC_ENTRY)
+        JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_PROPERTY_NAME(INITIALIZE_PRIVATE_TO_PUBLIC_ENTRY)
+        JSC_FOREACH_BUILTIN_FUNCTION_NAME(INITIALIZE_PUBLIC_TO_PRIVATE_ENTRY)
+        JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_PROPERTY_NAME(INITIALIZE_PUBLIC_TO_PRIVATE_ENTRY)
+        JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_SYMBOL_PUBLIC_TO_PRIVATE_ENTRY)
+        m_privateToPublicMap.add(m_dollarVMPrivateName.impl(), &m_dollarVMName);
+        m_publicToPrivateMap.add(m_dollarVMName.impl(), &m_dollarVMPrivateName);
+    }
+
+    bool isPrivateName(SymbolImpl& uid) const;
+    bool isPrivateName(UniquedStringImpl& uid) const;
+    bool isPrivateName(const Identifier&) const;
+    const Identifier* lookUpPrivateName(const Identifier&) const;
+    const Identifier& lookUpPublicName(const Identifier&) const;
+    
+    void appendExternalName(const Identifier& publicName, const Identifier& privateName);
+
+    JSC_FOREACH_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+    JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_PROPERTY_NAME(DECLARE_BUILTIN_IDENTIFIER_ACCESSOR)
+    JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(DECLARE_BUILTIN_SYMBOL_ACCESSOR)
+    const JSC::Identifier& dollarVMPublicName() const { return m_dollarVMName; }
+    const JSC::Identifier& dollarVMPrivateName() const { return m_dollarVMPrivateName; }
+
+private:
+    Identifier m_emptyIdentifier;
+    JSC_FOREACH_BUILTIN_FUNCTION_NAME(DECLARE_BUILTIN_NAMES)
+    JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_PROPERTY_NAME(DECLARE_BUILTIN_NAMES)
+    JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(DECLARE_BUILTIN_SYMBOLS)
+    const JSC::Identifier m_dollarVMName;
+    const JSC::Identifier m_dollarVMPrivateName;
+    typedef HashMap<RefPtr<UniquedStringImpl>, const Identifier*, IdentifierRepHash> BuiltinNamesMap;
+    BuiltinNamesMap m_publicToPrivateMap;
+    BuiltinNamesMap m_privateToPublicMap;
+};
+
+inline bool BuiltinNames::isPrivateName(SymbolImpl& uid) const
+{
+    return m_privateToPublicMap.contains(&uid);
+}
+
+inline bool BuiltinNames::isPrivateName(UniquedStringImpl& uid) const
+{
+    if (!uid.isSymbol())
+        return false;
+    return m_privateToPublicMap.contains(&uid);
+}
+
+inline bool BuiltinNames::isPrivateName(const Identifier& ident) const
+{
+    if (ident.isNull())
+        return false;
+    return isPrivateName(*ident.impl());
+}
+
+inline const Identifier* BuiltinNames::lookUpPrivateName(const Identifier& ident) const
+{
+    auto iter = m_publicToPrivateMap.find(ident.impl());
+    if (iter != m_publicToPrivateMap.end())
+        return iter->value;
+    return 0;
+}
+
+inline const Identifier& BuiltinNames::lookUpPublicName(const Identifier& ident) const
+{
+    auto iter = m_privateToPublicMap.find(ident.impl());
+    if (iter != m_privateToPublicMap.end())
+        return *iter->value;
+    return m_emptyIdentifier;
+}
+
+inline void BuiltinNames::appendExternalName(const Identifier& publicName, const Identifier& privateName)
+{
+#ifndef NDEBUG
+    for (const auto& key : m_publicToPrivateMap.keys())
+        ASSERT(publicName.string() != *key);
+#endif
+
+    m_privateToPublicMap.add(privateName.impl(), &publicName);
+    m_publicToPrivateMap.add(publicName.impl(), &privateName);
+}
+
+} // namespace JSC
diff --git a/builtins/BuiltinUtils.h b/builtins/BuiltinUtils.h
new file mode 100644
index 0000000..26da291
--- /dev/null
+++ b/builtins/BuiltinUtils.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConstructAbility.h"
+
+namespace JSC {
+
+#define INITIALIZE_BUILTIN_NAMES(name) , m_##name(JSC::Identifier::fromString(vm, #name)), m_##name##PrivateName(JSC::Identifier::fromUid(JSC::PrivateName(JSC::PrivateName::Description, ASCIILiteral("PrivateSymbol." #name))))
+#define DECLARE_BUILTIN_NAMES(name) const JSC::Identifier m_##name; const JSC::Identifier m_##name##PrivateName;
+#define DECLARE_BUILTIN_IDENTIFIER_ACCESSOR(name) \
+    const JSC::Identifier& name##PublicName() const { return m_##name; } \
+    const JSC::Identifier& name##PrivateName() const { return m_##name##PrivateName; }
+
+#define INITIALIZE_BUILTIN_SYMBOLS(name) , m_##name##Symbol(JSC::Identifier::fromUid(JSC::PrivateName(JSC::PrivateName::Description, ASCIILiteral("Symbol." #name)))), m_##name##SymbolPrivateIdentifier(JSC::Identifier::fromString(vm, #name "Symbol"))
+#define DECLARE_BUILTIN_SYMBOLS(name) const JSC::Identifier m_##name##Symbol; const JSC::Identifier m_##name##SymbolPrivateIdentifier;
+#define DECLARE_BUILTIN_SYMBOL_ACCESSOR(name) \
+    const JSC::Identifier& name##Symbol() const { return m_##name##Symbol; }
+
+class Identifier;
+class SourceCode;
+class UnlinkedFunctionExecutable;
+class VM;
+
+JS_EXPORT_PRIVATE UnlinkedFunctionExecutable* createBuiltinExecutable(VM&, const SourceCode&, const Identifier&, ConstructAbility);
+    
+} // namespace JSC
diff --git a/builtins/DatePrototype.js b/builtins/DatePrototype.js
new file mode 100644
index 0000000..234f185
--- /dev/null
+++ b/builtins/DatePrototype.js
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner <thetalecrafter@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @conditional=ENABLE(INTL)
+
+function toLocaleString(/* locales, options */)
+{
+    "use strict";
+
+    function toDateTimeOptionsAnyAll(opts)
+    {
+        // ToDateTimeOptions(options, "any", "all")
+        // http://www.ecma-international.org/ecma-402/2.0/#sec-InitializeDateTimeFormat
+
+        var options;
+        if (opts === @undefined)
+            options = null;
+        else if (opts === null)
+            @throwTypeError("null is not an object");
+        else
+            options = @Object(opts);
+
+        // Check original instead of descendant to reduce lookups up the prototype chain.
+        var needsDefaults = !options || (
+            options.weekday === @undefined &&
+            options.year === @undefined &&
+            options.month === @undefined &&
+            options.day === @undefined &&
+            options.hour === @undefined &&
+            options.minute === @undefined &&
+            options.second === @undefined
+        );
+
+        // Only create descendant if it will have own properties.
+        if (needsDefaults) {
+            options = @Object.@create(options);
+            options.year = "numeric";
+            options.month = "numeric";
+            options.day = "numeric";
+            options.hour = "numeric";
+            options.minute = "numeric";
+            options.second = "numeric";
+        }
+
+        // 9. Return options.
+        return options;
+    }
+
+    // 13.3.1 Date.prototype.toLocaleString ([locales [, options ]]) (ECMA-402 2.0)
+    // http://www.ecma-international.org/ecma-402/2.0/#sec-Date.prototype.toLocaleString
+
+    var value = @thisTimeValue.@call(this);
+    if (@isNaN(value))
+        return "Invalid Date";
+
+    var options = toDateTimeOptionsAnyAll(@argument(1));
+    var locales = @argument(0);
+
+    var dateFormat = new @DateTimeFormat(locales, options);
+    return dateFormat.format(value);
+}
+
+function toLocaleDateString(/* locales, options */)
+{
+    "use strict";
+
+    function toDateTimeOptionsDateDate(opts)
+    {
+        // ToDateTimeOptions(options, "date", "date")
+        // http://www.ecma-international.org/ecma-402/2.0/#sec-InitializeDateTimeFormat
+
+        var options;
+        if (opts === @undefined)
+            options = null;
+        else if (opts === null)
+            @throwTypeError("null is not an object");
+        else
+            options = @Object(opts);
+
+        // Check original instead of descendant to reduce lookups up the prototype chain.
+        var needsDefaults = !options || (
+            options.weekday === @undefined &&
+            options.year === @undefined &&
+            options.month === @undefined &&
+            options.day === @undefined
+        );
+
+        // Only create descendant if it will have own properties.
+        if (needsDefaults) {
+            options = @Object.@create(options);
+            options.year = "numeric";
+            options.month = "numeric";
+            options.day = "numeric";
+        }
+
+        return options;
+    }
+
+    // 13.3.2 Date.prototype.toLocaleDateString ([locales [, options ]]) (ECMA-402 2.0)
+    // http://www.ecma-international.org/ecma-402/2.0/#sec-Date.prototype.toLocaleDateString
+
+    var value = @thisTimeValue.@call(this);
+    if (@isNaN(value))
+        return "Invalid Date";
+
+    var options = toDateTimeOptionsDateDate(@argument(1));
+    var locales = @argument(0);
+
+    var dateFormat = new @DateTimeFormat(locales, options);
+    return dateFormat.format(value);
+}
+
+function toLocaleTimeString(/* locales, options */)
+{
+    "use strict";
+
+    function toDateTimeOptionsTimeTime(opts)
+    {
+        // ToDateTimeOptions(options, "time", "time")
+        // http://www.ecma-international.org/ecma-402/2.0/#sec-InitializeDateTimeFormat
+
+        var options;
+        if (opts === @undefined)
+            options = null;
+        else if (opts === null)
+            @throwTypeError("null is not an object");
+        else
+            options = @Object(opts);
+
+        // Check original instead of descendant to reduce lookups up the prototype chain.
+        var needsDefaults = !options || (
+            options.hour === @undefined &&
+            options.minute === @undefined &&
+            options.second === @undefined
+        );
+
+        // Only create descendant if it will have own properties.
+        if (needsDefaults) {
+            options = @Object.@create(options);
+            options.hour = "numeric";
+            options.minute = "numeric";
+            options.second = "numeric";
+        }
+
+        return options;
+    }
+
+    // 13.3.3 Date.prototype.toLocaleTimeString ([locales [, options ]]) (ECMA-402 2.0)
+    // http://www.ecma-international.org/ecma-402/2.0/#sec-Date.prototype.toLocaleTimeString
+
+    var value = @thisTimeValue.@call(this);
+    if (@isNaN(value))
+        return "Invalid Date";
+
+    var options = toDateTimeOptionsTimeTime(@argument(1));
+    var locales = @argument(0);
+
+    var dateFormat = new @DateTimeFormat(locales, options);
+    return dateFormat.format(value);
+}
diff --git a/builtins/FunctionPrototype.js b/builtins/FunctionPrototype.js
new file mode 100644
index 0000000..f1ee867
--- /dev/null
+++ b/builtins/FunctionPrototype.js
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function call(thisArgument)
+{
+    "use strict";
+
+    let argumentValues = [];
+    // Start from 1 to ignore thisArgument
+    for (let i = 1; i < arguments.length; i++)
+        @putByValDirect(argumentValues, i-1, arguments[i]);
+
+    return this.@apply(thisArgument, argumentValues);
+}
+
+function apply(thisValue, argumentValues)
+{
+    "use strict";
+
+    return this.@apply(thisValue, argumentValues);
+}
+
+// FIXME: this should have a different name: https://bugs.webkit.org/show_bug.cgi?id=151363
+function symbolHasInstance(value)
+{
+    "use strict";
+
+    if (typeof this !== "function")
+        return false;
+
+    if (@isBoundFunction(this))
+        return @hasInstanceBoundFunction(this, value);
+
+    let target = this.prototype;
+    return @instanceOf(value, target);
+}
+
+function bind(thisValue)
+{
+    "use strict";
+
+    let target = this;
+    if (typeof target !== "function")
+        @throwTypeError("|this| is not a function inside Function.prototype.bind");
+
+    let argumentCount = arguments.length;
+    let boundArgs = null;
+    let numBoundArgs = 0;
+    if (argumentCount > 1) {
+        numBoundArgs = argumentCount - 1;
+        boundArgs = @newArrayWithSize(numBoundArgs);
+        for (let i = 0; i < numBoundArgs; i++)
+            @putByValDirect(boundArgs, i, arguments[i + 1]);
+    }
+
+    let length = 0;
+    if (@hasOwnLengthProperty(target)) {
+        let lengthValue = target.length;
+        if (typeof lengthValue === "number") {
+            lengthValue = lengthValue | 0;
+            // Note that we only care about positive lengthValues, however, this comparision
+            // against numBoundArgs suffices to prove we're not a negative number.
+            if (lengthValue > numBoundArgs)
+                length = lengthValue - numBoundArgs;
+        }
+    }
+
+    let name = target.name;
+    if (typeof name !== "string")
+        name = "";
+
+    return @makeBoundFunction(target, arguments[0], boundArgs, length, name);
+}
diff --git a/builtins/GeneratorPrototype.js b/builtins/GeneratorPrototype.js
new file mode 100644
index 0000000..4128a35
--- /dev/null
+++ b/builtins/GeneratorPrototype.js
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2015-2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// 25.3.3.3 GeneratorResume ( generator, value )
+// 25.3.3.4 GeneratorResumeAbrupt(generator, abruptCompletion)
+@globalPrivate
+function generatorResume(generator, sentValue, resumeMode)
+{
+    "use strict";
+
+    let state = generator.@generatorState;
+    let done = false;
+    let value = @undefined;
+
+    if (typeof state !== 'number')
+        @throwTypeError("|this| should be a generator");
+
+    if (state === @GeneratorStateExecuting)
+        @throwTypeError("Generator is executing");
+
+    if (state === @GeneratorStateCompleted) {
+        if (resumeMode === @GeneratorResumeModeThrow)
+            throw sentValue;
+
+        done = true;
+        if (resumeMode === @GeneratorResumeModeReturn)
+            value = sentValue;
+    } else {
+        try {
+            generator.@generatorState = @GeneratorStateExecuting;
+            value = generator.@generatorNext.@call(generator.@generatorThis, generator, state, sentValue, resumeMode, generator.@generatorFrame);
+            if (generator.@generatorState === @GeneratorStateExecuting) {
+                generator.@generatorState = @GeneratorStateCompleted;
+                done = true;
+            }
+        } catch (error) {
+            generator.@generatorState = @GeneratorStateCompleted;
+            throw error;
+        }
+    }
+    return { done, value };
+}
+
+function next(value)
+{
+    "use strict";
+
+    return @generatorResume(this, value, @GeneratorResumeModeNormal);
+}
+
+function return(value)
+{
+    "use strict";
+
+    return @generatorResume(this, value, @GeneratorResumeModeReturn);
+}
+
+function throw(exception)
+{
+    "use strict";
+
+    return @generatorResume(this, exception, @GeneratorResumeModeThrow);
+}
diff --git a/builtins/GlobalObject.js b/builtins/GlobalObject.js
new file mode 100644
index 0000000..804930c
--- /dev/null
+++ b/builtins/GlobalObject.js
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015-2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+@globalPrivate
+function isFinite(value)
+{
+    "use strict";
+
+    var numberValue = @toNumber(value);
+    // Return false if numberValue is |NaN|.
+    if (numberValue !== numberValue)
+        return false;
+    return numberValue !== @Infinity && numberValue !== -@Infinity;
+}
+
+@globalPrivate
+function isNaN(value)
+{
+    "use strict";
+
+    var numberValue = @toNumber(value);
+    return numberValue !== numberValue;
+}
diff --git a/builtins/GlobalOperations.js b/builtins/GlobalOperations.js
new file mode 100644
index 0000000..22220cf
--- /dev/null
+++ b/builtins/GlobalOperations.js
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @internal
+
+@globalPrivate
+function toInteger(target)
+{
+    "use strict";
+
+    var numberValue = @Number(target);
+
+    // isNaN(numberValue)
+    if (numberValue !== numberValue)
+        return 0;
+    return @trunc(numberValue);
+}
+
+@globalPrivate
+function toLength(target)
+{
+    "use strict";
+
+    var length = @toInteger(target);
+    // originally Math.min(Math.max(length, 0), maxSafeInteger));
+    return length > 0 ? (length < @MAX_SAFE_INTEGER ? length : @MAX_SAFE_INTEGER) : 0;
+}
+
+@globalPrivate
+function isDictionary(object)
+{
+    "use strict";
+
+    return object == null || typeof object === "object";
+}
+
+// FIXME: this needs to have it's name changed to "get [Symbol.species]".
+// see: https://bugs.webkit.org/show_bug.cgi?id=151363
+@globalPrivate
+function speciesGetter()
+{
+    return this;
+}
+
+@globalPrivate
+function speciesConstructor(obj, defaultConstructor)
+{
+    var constructor = obj.constructor;
+    if (constructor === @undefined)
+        return defaultConstructor;
+    if (!@isObject(constructor))
+        @throwTypeError("|this|.constructor is not an Object or undefined");
+    constructor = constructor.@speciesSymbol;
+    if (constructor == null)
+        return defaultConstructor;
+    if (@isConstructor(constructor))
+        return constructor;
+    @throwTypeError("|this|.constructor[Symbol.species] is not a constructor");
+}
diff --git a/builtins/InspectorInstrumentationObject.js b/builtins/InspectorInstrumentationObject.js
new file mode 100644
index 0000000..fb7d9ea
--- /dev/null
+++ b/builtins/InspectorInstrumentationObject.js
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function promiseFulfilled(promise, value, reactions)
+{
+    "use strict";
+
+    if (!this.isEnabled)
+        return;
+}
+
+function promiseRejected(promise, reason, reactions)
+{
+    "use strict";
+
+    if (!this.isEnabled)
+        return;
+}
diff --git a/builtins/InternalPromiseConstructor.js b/builtins/InternalPromiseConstructor.js
new file mode 100644
index 0000000..d01f5f7
--- /dev/null
+++ b/builtins/InternalPromiseConstructor.js
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function internalAll(array)
+{
+    // This function is intended to be used in the JSC internals.
+    // The implementation should take care not to perform the user
+    // observable / trappable operations.
+    //
+    // 1. Don't use for-of and iterables. This function only accepts
+    //    the dense array of the promises.
+    // 2. Don't look up this.constructor / @@species. Always construct
+    //    the plain Promise object.
+
+    "use strict";
+
+    var promiseCapability = @newPromiseCapability(@InternalPromise);
+
+    var values = [];
+    var index = 0;
+    var remainingElementsCount = 0;
+
+    function newResolveElement(index)
+    {
+        var alreadyCalled = false;
+        return function (argument)
+        {
+            if (alreadyCalled)
+                return @undefined;
+            alreadyCalled = true;
+
+            @putByValDirect(values, index, argument);
+
+            --remainingElementsCount;
+            if (remainingElementsCount === 0)
+                return promiseCapability.@resolve.@call(@undefined, values);
+
+            return @undefined;
+        }
+    }
+
+    try {
+        if (array.length === 0)
+            promiseCapability.@resolve.@call(@undefined, values);
+        else {
+            for (var index = 0, length = array.length; index < length; ++index) {
+                var value = array[index];
+                @putByValDirect(values, index, @undefined);
+
+                var nextPromiseCapability = @newPromiseCapability(@InternalPromise);
+                nextPromiseCapability.@resolve.@call(@undefined, value);
+                var nextPromise = nextPromiseCapability.@promise;
+
+                var resolveElement = newResolveElement(index);
+                ++remainingElementsCount;
+                nextPromise.then(resolveElement, promiseCapability.@reject);
+            }
+        }
+    } catch (error) {
+        promiseCapability.@reject.@call(@undefined, error);
+    }
+
+    return promiseCapability.@promise;
+}
diff --git a/builtins/IteratorHelpers.js b/builtins/IteratorHelpers.js
new file mode 100644
index 0000000..f565d44
--- /dev/null
+++ b/builtins/IteratorHelpers.js
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function performIteration(iterable)
+{
+    "use strict";
+    // This is performing a spread operation on the iterable passed in,
+    // and returning the result in an array.
+    // https://tc39.github.io/ecma262/#sec-runtime-semantics-arrayaccumulation
+
+    let result = [];
+
+    let iterator = iterable.@iteratorSymbol();
+    let item;
+    let index = 0;
+    while (true) {
+        item = iterator.next();
+        if (!@isObject(item))
+            @throwTypeError("Iterator result interface is not an object");
+        if (item.done)
+            return result;
+        @putByValDirect(result, index++, item.value);
+    }
+}
diff --git a/builtins/IteratorPrototype.js b/builtins/IteratorPrototype.js
new file mode 100644
index 0000000..5c1691a
--- /dev/null
+++ b/builtins/IteratorPrototype.js
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function symbolIteratorGetter()
+{
+    "use strict";
+
+    return this;
+}
diff --git a/builtins/MapPrototype.js b/builtins/MapPrototype.js
new file mode 100644
index 0000000..8302602
--- /dev/null
+++ b/builtins/MapPrototype.js
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function forEach(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (!@isMap(this))
+        @throwTypeError("Map operation called on non-Map object");
+
+    if (typeof callback !== 'function')
+        @throwTypeError("Map.prototype.forEach callback must be a function");
+
+    var thisArg = @argument(1);
+    var iterator = @MapIterator(this);
+
+    // To avoid object allocations for iterator result objects, we pass the placeholder to the special "next" function in order to fill the results.
+    var value = [ @undefined, @undefined ];
+    for (;;) {
+        if (@mapIteratorNext.@call(iterator, value))
+            break;
+        callback.@call(thisArg, value[1], value[0], this);
+    }
+}
diff --git a/builtins/ModuleLoaderPrototype.js b/builtins/ModuleLoaderPrototype.js
new file mode 100644
index 0000000..01c2b21
--- /dev/null
+++ b/builtins/ModuleLoaderPrototype.js
@@ -0,0 +1,472 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// https://whatwg.github.io/loader/#loader-object
+// Module Loader has several hooks that can be customized by the platform.
+// For example, the [[Fetch]] hook can be provided by the JavaScriptCore shell
+// as fetching the payload from the local file system.
+// Currently, there are 4 hooks.
+//    1. Loader.resolve
+//    2. Loader.fetch
+//    3. Loader.instantiate
+
+@globalPrivate
+function setStateToMax(entry, newState)
+{
+    // https://whatwg.github.io/loader/#set-state-to-max
+
+    "use strict";
+
+    if (entry.state < newState)
+        entry.state = newState;
+}
+
+@globalPrivate
+function newRegistryEntry(key)
+{
+    // https://whatwg.github.io/loader/#registry
+    //
+    // Each registry entry becomes one of the 5 states.
+    // 1. Fetch
+    //     Ready to fetch (or now fetching) the resource of this module.
+    //     Typically, we fetch the source code over the network or from the file system.
+    //     a. If the status is Fetch and there is no entry.fetch promise, the entry is ready to fetch.
+    //     b. If the status is Fetch and there is the entry.fetch promise, the entry is just fetching the resource.
+    //
+    // 2. Instantiate (AnalyzeModule)
+    //     Ready to instantiate (or now instantiating) the module record from the fetched
+    //     source code.
+    //     Typically, we parse the module code, extract the dependencies and binding information.
+    //     a. If the status is Instantiate and there is no entry.instantiate promise, the entry is ready to instantiate.
+    //     b. If the status is Instantiate and there is the entry.fetch promise, the entry is just instantiating
+    //        the module record.
+    //
+    // 3. Satisfy
+    //     Ready to request the dependent modules (or now requesting & resolving).
+    //     Without this state, the current draft causes infinite recursion when there is circular dependency.
+    //     a. If the status is Satisfy and there is no entry.satisfy promise, the entry is ready to resolve the dependencies.
+    //     b. If the status is Satisfy and there is the entry.satisfy promise, the entry is just resolving
+    //        the dependencies.
+    //
+    // 4. Link
+    //     Ready to link the module with the other modules.
+    //     Linking means that the module imports and exports the bindings from/to the other modules.
+    //
+    // 5. Ready
+    //     The module is linked, so the module is ready to be executed.
+    //
+    // Each registry entry has the 4 promises; "fetch", "instantiate" and "satisfy".
+    // They are assigned when starting the each phase. And they are fulfilled when the each phase is completed.
+    //
+    // In the current module draft, linking will be performed after the whole modules are instantiated and the dependencies are resolved.
+    // And execution is also done after the all modules are linked.
+    //
+    // TODO: We need to exploit the way to execute the module while fetching non-related modules.
+    // One solution; introducing the ready promise chain to execute the modules concurrently while keeping
+    // the execution order.
+
+    "use strict";
+
+    return {
+        key: key,
+        state: @ModuleFetch,
+        metadata: @undefined,
+        fetch: @undefined,
+        instantiate: @undefined,
+        satisfy: @undefined,
+        dependencies: [], // To keep the module order, we store the module keys in the array.
+        dependenciesMap: @undefined,
+        module: @undefined, // JSModuleRecord
+        error: @undefined,
+    };
+}
+
+function ensureRegistered(key)
+{
+    // https://whatwg.github.io/loader/#ensure-registered
+
+    "use strict";
+
+    var entry = this.registry.@get(key);
+    if (entry)
+        return entry;
+
+    entry = @newRegistryEntry(key);
+    this.registry.@set(key, entry);
+
+    return entry;
+}
+
+function forceFulfillPromise(promise, value)
+{
+    "use strict";
+
+    if (promise.@promiseState === @promiseStatePending)
+        @fulfillPromise(promise, value);
+}
+
+function fulfillFetch(entry, payload)
+{
+    // https://whatwg.github.io/loader/#fulfill-fetch
+
+    "use strict";
+
+    if (!entry.fetch)
+        entry.fetch = @newPromiseCapability(@InternalPromise).@promise;
+    this.forceFulfillPromise(entry.fetch, payload);
+    @setStateToMax(entry, @ModuleInstantiate);
+}
+
+function fulfillInstantiate(entry, optionalInstance, source)
+{
+    // https://whatwg.github.io/loader/#fulfill-instantiate
+
+    "use strict";
+
+    if (!entry.instantiate)
+        entry.instantiate = @newPromiseCapability(@InternalPromise).@promise;
+    this.commitInstantiated(entry, optionalInstance, source);
+
+    // FIXME: The draft fulfills the promise in the CommitInstantiated operation.
+    // But it CommitInstantiated is also used in the requestInstantiate and
+    // we should not "force fulfill" there.
+    // So we separate "force fulfill" operation from the CommitInstantiated operation.
+    // https://github.com/whatwg/loader/pull/67
+    this.forceFulfillPromise(entry.instantiate, entry);
+}
+
+function commitInstantiated(entry, optionalInstance, source)
+{
+    // https://whatwg.github.io/loader/#commit-instantiated
+
+    "use strict";
+
+    var moduleRecord = this.instantiation(optionalInstance, source, entry);
+
+    // FIXME: Described in the draft,
+    //   4. Fulfill entry.[[Instantiate]] with instance.
+    // But, instantiate promise should be fulfilled with the entry.
+    // We remove this statement because instantiate promise will be
+    // fulfilled without this "force fulfill" operation.
+    // https://github.com/whatwg/loader/pull/67
+
+    var dependencies = [];
+    var dependenciesMap = moduleRecord.dependenciesMap;
+    moduleRecord.registryEntry = entry;
+    var requestedModules = this.requestedModules(moduleRecord);
+    for (var i = 0, length = requestedModules.length; i < length; ++i) {
+        var depKey = requestedModules[i];
+        var pair = {
+            key: depKey,
+            value: @undefined
+        };
+        @putByValDirect(dependencies, dependencies.length, pair);
+        dependenciesMap.@set(depKey, pair);
+    }
+    entry.dependencies = dependencies;
+    entry.dependenciesMap = dependenciesMap;
+    entry.module = moduleRecord;
+    @setStateToMax(entry, @ModuleSatisfy);
+}
+
+function instantiation(result, source, entry)
+{
+    // https://whatwg.github.io/loader/#instantiation
+    // FIXME: Current implementation does not support optionalInstance.
+    // https://bugs.webkit.org/show_bug.cgi?id=148171
+
+    "use strict";
+
+    return this.parseModule(entry.key, source);
+}
+
+// Loader.
+
+function requestFetch(key, initiator)
+{
+    // https://whatwg.github.io/loader/#request-fetch
+
+    "use strict";
+
+    var entry = this.ensureRegistered(key);
+    if (entry.fetch)
+        return entry.fetch;
+
+    // Hook point.
+    // 2. Loader.fetch
+    //     https://whatwg.github.io/loader/#browser-fetch
+    //     Take the key and fetch the resource actually.
+    //     For example, JavaScriptCore shell can provide the hook fetching the resource
+    //     from the local file system.
+    var fetchPromise = this.fetch(key, initiator).then((payload) => {
+        @setStateToMax(entry, @ModuleInstantiate);
+        return payload;
+    });
+    entry.fetch = fetchPromise;
+    return fetchPromise;
+}
+
+function requestInstantiate(key, initiator)
+{
+    // https://whatwg.github.io/loader/#request-instantiate
+
+    "use strict";
+
+    var entry = this.ensureRegistered(key);
+    if (entry.instantiate)
+        return entry.instantiate;
+
+    var instantiatePromise = this.requestFetch(key, initiator).then((source) => {
+        // Hook point.
+        // 3. Loader.instantiate
+        //     https://whatwg.github.io/loader/#browser-instantiate
+        //     Take the key and the fetched source code, and instantiate the module record
+        //     by parsing the module source code.
+        //     It has the chance to provide the optional module instance that is different from
+        //     the ordinary one.
+        return this.instantiate(key, source, initiator).then((optionalInstance) => {
+            this.commitInstantiated(entry, optionalInstance, source);
+            return entry;
+        });
+    });
+    entry.instantiate = instantiatePromise;
+    return instantiatePromise;
+}
+
+function requestSatisfy(key, initiator)
+{
+    // https://whatwg.github.io/loader/#satisfy-instance
+
+    "use strict";
+
+    var entry = this.ensureRegistered(key);
+    if (entry.satisfy)
+        return entry.satisfy;
+
+    var satisfyPromise = this.requestInstantiate(key, initiator).then((entry) => {
+        var depLoads = [];
+        for (var i = 0, length = entry.dependencies.length; i < length; ++i) {
+            let pair = entry.dependencies[i];
+
+            // Hook point.
+            // 1. Loader.resolve.
+            //     https://whatwg.github.io/loader/#browser-resolve
+            //     Take the name and resolve it to the unique identifier for the resource location.
+            //     For example, take the "jquery" and return the URL for the resource.
+            var promise = this.resolve(pair.key, key, initiator).then((depKey) => {
+                var depEntry = this.ensureRegistered(depKey);
+
+                // Recursive resolving. The dependencies of this entry is being resolved or already resolved.
+                // Stop tracing the circular dependencies.
+                // But to retrieve the instantiated module record correctly,
+                // we need to wait for the instantiation for the dependent module.
+                // For example, reaching here, the module is starting resolving the dependencies.
+                // But the module may or may not reach the instantiation phase in the loader's pipeline.
+                // If we wait for the Satisfy for this module, it construct the circular promise chain and
+                // rejected by the Promises runtime. Since only we need is the instantiated module, instead of waiting
+                // the Satisfy for this module, we just wait Instantiate for this.
+                if (depEntry.satisfy) {
+                    return depEntry.instantiate.then((entry) => {
+                        pair.value = entry.module;
+                        return entry;
+                    });
+                }
+
+                return this.requestSatisfy(depKey, initiator).then((entry) => {
+                    pair.value = entry.module;
+                    return entry;
+                });
+            });
+            @putByValDirect(depLoads, depLoads.length, promise);
+        }
+
+        return @InternalPromise.internalAll(depLoads).then((modules) => {
+            @setStateToMax(entry, @ModuleLink);
+            return entry;
+        });
+    });
+
+    entry.satisfy = satisfyPromise;
+    return satisfyPromise;
+}
+
+function requestInstantiateAll(key, initiator)
+{
+    // https://whatwg.github.io/loader/#request-instantiate-all
+
+    "use strict";
+
+    return this.requestSatisfy(key, initiator);
+}
+
+function requestLink(key, initiator)
+{
+    // https://whatwg.github.io/loader/#request-link
+
+    "use strict";
+
+    var entry = this.ensureRegistered(key);
+    if (entry.state > @ModuleLink) {
+        var deferred = @newPromiseCapability(@InternalPromise);
+        deferred.@resolve.@call(@undefined, entry);
+        return deferred.@promise;
+    }
+
+    return this.requestInstantiateAll(key, initiator).then((entry) => {
+        this.link(entry, initiator);
+        return entry;
+    });
+}
+
+function requestReady(key, initiator)
+{
+    // https://whatwg.github.io/loader/#request-ready
+
+    "use strict";
+
+    return this.requestLink(key, initiator).then((entry) => {
+        this.moduleEvaluation(entry.module, initiator);
+    });
+}
+
+// Linking semantics.
+
+function link(entry, initiator)
+{
+    // https://whatwg.github.io/loader/#link
+
+    "use strict";
+
+    // FIXME: Current implementation does not support optionalInstance.
+    // So Link's step 3 is skipped.
+    // https://bugs.webkit.org/show_bug.cgi?id=148171
+
+    if (entry.state === @ModuleReady)
+        return;
+    @setStateToMax(entry, @ModuleReady);
+
+    // Since we already have the "dependencies" field,
+    // we can call moduleDeclarationInstantiation with the correct order
+    // without constructing the dependency graph by calling dependencyGraph.
+    var dependencies = entry.dependencies;
+    for (var i = 0, length = dependencies.length; i < length; ++i) {
+        var pair = dependencies[i];
+        this.link(pair.value.registryEntry, initiator);
+    }
+
+    this.moduleDeclarationInstantiation(entry.module, initiator);
+}
+
+// Module semantics.
+
+function moduleEvaluation(moduleRecord, initiator)
+{
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-moduleevaluation
+
+    "use strict";
+
+    if (moduleRecord.evaluated)
+        return;
+    moduleRecord.evaluated = true;
+
+    var entry = moduleRecord.registryEntry;
+
+    // The contents of the [[RequestedModules]] is cloned into entry.dependencies.
+    var dependencies = entry.dependencies;
+    for (var i = 0, length = dependencies.length; i < length; ++i) {
+        var pair = dependencies[i];
+        var requiredModuleRecord = pair.value;
+        this.moduleEvaluation(requiredModuleRecord, initiator);
+    }
+    this.evaluate(entry.key, moduleRecord, initiator);
+}
+
+// APIs to control the module loader.
+
+function provide(key, stage, value)
+{
+    "use strict";
+
+    var entry = this.ensureRegistered(key);
+
+    if (stage === @ModuleFetch) {
+        if (entry.state > @ModuleFetch)
+            @throwTypeError("Requested module is already fetched.");
+        this.fulfillFetch(entry, value);
+        return;
+    }
+
+    if (stage === @ModuleInstantiate) {
+        if (entry.state > @ModuleInstantiate)
+            @throwTypeError("Requested module is already instantiated.");
+        this.fulfillFetch(entry, @undefined);
+        entry.fetch.then((source) => {
+            this.fulfillInstantiate(entry, value, source);
+        });
+        return;
+    }
+
+    @throwTypeError("Requested module is already ready to be executed.");
+}
+
+function loadAndEvaluateModule(moduleName, referrer, initiator)
+{
+    "use strict";
+
+    // Loader.resolve hook point.
+    // resolve: moduleName => Promise(moduleKey)
+    // Take the name and resolve it to the unique identifier for the resource location.
+    // For example, take the "jquery" and return the URL for the resource.
+    return this.resolve(moduleName, referrer, initiator).then((key) => {
+        return this.requestReady(key, initiator);
+    });
+}
+
+function loadModule(moduleName, referrer, initiator)
+{
+    "use strict";
+
+    // Loader.resolve hook point.
+    // resolve: moduleName => Promise(moduleKey)
+    // Take the name and resolve it to the unique identifier for the resource location.
+    // For example, take the "jquery" and return the URL for the resource.
+    return this.resolve(moduleName, referrer, initiator).then((key) => {
+        return this.requestInstantiateAll(key, initiator);
+    }).then((entry) => {
+        return entry.key;
+    });
+}
+
+function linkAndEvaluateModule(key, initiator)
+{
+    "use strict";
+
+    var entry = this.ensureRegistered(key);
+    if (entry.state < @ModuleLink)
+        @throwTypeError("Requested module is not instantiated yet.");
+
+    this.link(entry, initiator);
+    return this.moduleEvaluation(entry.module, initiator);
+}
diff --git a/builtins/NumberConstructor.js b/builtins/NumberConstructor.js
new file mode 100644
index 0000000..2c0e4c8
--- /dev/null
+++ b/builtins/NumberConstructor.js
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function isFinite(value)
+{
+    "use strict";
+
+    if (typeof value !== "number")
+        return false;
+
+    // Return false if value is |NaN|.
+    if (value !== value)
+        return false;
+
+    return value !== @Infinity && value !== -@Infinity;
+}
+
+function isNaN(value)
+{
+    "use strict";
+
+    return value !== value;
+}
diff --git a/builtins/NumberPrototype.js b/builtins/NumberPrototype.js
new file mode 100644
index 0000000..435ea78
--- /dev/null
+++ b/builtins/NumberPrototype.js
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner <thetalecrafter@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @conditional=ENABLE(INTL)
+
+function toLocaleString(/* locales, options */)
+{
+    "use strict";
+
+    // 13.2.1 Number.prototype.toLocaleString ([locales [, options ]]) (ECMA-402 2.0)
+    // http://ecma-international.org/publications/standards/Ecma-402.htm
+
+    // 1. Let x be thisNumberValue(this value).
+    // 2. ReturnIfAbrupt(x).
+    var number = @thisNumberValue.@call(this);
+
+    // 3. Let numberFormat be Construct(%NumberFormat%, «locales, options»).
+    // 4. ReturnIfAbrupt(numberFormat).
+    var numberFormat = new @NumberFormat(@argument(0), @argument(1));
+
+    // 5. Return FormatNumber(numberFormat, x).
+    return numberFormat.format(number);
+}
diff --git a/builtins/ObjectConstructor.js b/builtins/ObjectConstructor.js
new file mode 100644
index 0000000..d855beb
--- /dev/null
+++ b/builtins/ObjectConstructor.js
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2016 Oleksandr Skachkov <gskachkov@gmail.com>.
+ * Copyright (C) 2015 Jordan Harband. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+@globalPrivate
+function enumerableOwnProperties(object, kind)
+{
+    "use strict";
+
+    const obj = @Object(object);
+    const ownKeys = @Reflect.@ownKeys(obj);
+    const properties = [];
+    for (let i = 0, keysLength = ownKeys.length; i < keysLength; ++i) {
+        let nextKey = ownKeys[i];
+        if (typeof nextKey === 'string') {
+            let descriptor = @Reflect.@getOwnPropertyDescriptor(obj, nextKey);
+            if (descriptor !== @undefined && descriptor.enumerable) {
+                if (kind === @iterationKindValue)
+                    properties.@push(obj[nextKey]);
+                else if (kind === @iterationKindKeyValue)
+                    properties.@push([nextKey, obj[nextKey]]);
+            }
+        }
+    }
+    
+    return properties;
+}
+
+function values(object)
+{
+    "use strict";
+    
+    if (object == null)
+        @throwTypeError("Object.values requires that input parameter not be null or undefined");
+
+    return @enumerableOwnProperties(object, @iterationKindValue);
+}
+
+function entries(object)
+{
+    "use strict";
+    
+    if (object == null)
+        @throwTypeError("Object.entries requires that input parameter not be null or undefined");
+    
+    return @enumerableOwnProperties(object, @iterationKindKeyValue);
+}
+
+function assign(target/*[*/, /*...*/sources/*] */)
+{
+    "use strict";
+
+    if (target == null)
+        @throwTypeError("Object.assign requires that input parameter not be null or undefined");
+
+    let objTarget = @Object(target);
+    for (let s = 1, argumentsLength = arguments.length; s < argumentsLength; ++s) {
+        let nextSource = arguments[s];
+        if (nextSource != null) {
+            let from = @Object(nextSource);
+            let keys = @Reflect.@ownKeys(from);
+            for (let i = 0, keysLength = keys.length; i < keysLength; ++i) {
+                let nextKey = keys[i];
+                let descriptor = @Reflect.@getOwnPropertyDescriptor(from, nextKey);
+                if (descriptor !== @undefined && descriptor.enumerable)
+                    objTarget[nextKey] = from[nextKey];
+            }
+        }
+    }
+    return objTarget;
+}
diff --git a/builtins/PromiseConstructor.js b/builtins/PromiseConstructor.js
new file mode 100644
index 0000000..3f0848d
--- /dev/null
+++ b/builtins/PromiseConstructor.js
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function all(iterable)
+{
+    "use strict";
+
+    if (!@isObject(this))
+        @throwTypeError("|this| is not a object");
+
+    var promiseCapability = @newPromiseCapability(this);
+
+    var values = [];
+    var index = 0;
+    var remainingElementsCount = 1;
+
+    function newResolveElement(index)
+    {
+        var alreadyCalled = false;
+        return function (argument)
+        {
+            if (alreadyCalled)
+                return @undefined;
+            alreadyCalled = true;
+
+            @putByValDirect(values, index, argument);
+
+            --remainingElementsCount;
+            if (remainingElementsCount === 0)
+                return promiseCapability.@resolve.@call(@undefined, values);
+
+            return @undefined;
+        }
+    }
+
+    try {
+        for (var value of iterable) {
+            @putByValDirect(values, index, @undefined);
+            var nextPromise = this.resolve(value);
+            var resolveElement = newResolveElement(index);
+            ++remainingElementsCount;
+            nextPromise.then(resolveElement, promiseCapability.@reject);
+            ++index;
+        }
+
+        --remainingElementsCount;
+        if (remainingElementsCount === 0)
+            promiseCapability.@resolve.@call(@undefined, values);
+    } catch (error) {
+        promiseCapability.@reject.@call(@undefined, error);
+    }
+
+    return promiseCapability.@promise;
+}
+
+function race(iterable)
+{
+    "use strict";
+
+    if (!@isObject(this))
+        @throwTypeError("|this| is not a object");
+
+    var promiseCapability = @newPromiseCapability(this);
+
+    try {
+        for (var value of iterable) {
+            var nextPromise = this.resolve(value);
+            nextPromise.then(promiseCapability.@resolve, promiseCapability.@reject);
+        }
+    } catch (error) {
+        promiseCapability.@reject.@call(@undefined, error);
+    }
+
+    return promiseCapability.@promise;
+}
+
+function reject(reason)
+{
+    "use strict";
+
+    if (!@isObject(this))
+        @throwTypeError("|this| is not a object");
+
+    var promiseCapability = @newPromiseCapability(this);
+
+    promiseCapability.@reject.@call(@undefined, reason);
+
+    return promiseCapability.@promise;
+}
+
+function resolve(value)
+{
+    "use strict";
+
+    if (!@isObject(this))
+        @throwTypeError("|this| is not a object");
+
+    if (@isPromise(value)) {
+        var valueConstructor = value.constructor;
+        if (valueConstructor === this)
+            return value;
+    }
+
+    var promiseCapability = @newPromiseCapability(this);
+
+    promiseCapability.@resolve.@call(@undefined, value);
+
+    return promiseCapability.@promise;
+}
diff --git a/builtins/PromiseOperations.js b/builtins/PromiseOperations.js
new file mode 100644
index 0000000..61564e7
--- /dev/null
+++ b/builtins/PromiseOperations.js
@@ -0,0 +1,224 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// @internal
+
+@globalPrivate
+function isPromise(promise)
+{
+    "use strict";
+
+    return @isObject(promise) && !!promise.@promiseState;
+}
+
+@globalPrivate
+function newPromiseReaction(capability, onFulfilled, onRejected)
+{
+    "use strict";
+
+    return {
+        @capabilities: capability,
+        @onFulfilled: onFulfilled,
+        @onRejected: onRejected,
+    };
+}
+
+@globalPrivate
+function newPromiseCapability(constructor)
+{
+    "use strict";
+
+    if (!@isConstructor(constructor))
+        @throwTypeError("promise capability requires a constructor function");
+
+    var promiseCapability = {
+        @promise: @undefined,
+        @resolve: @undefined,
+        @reject: @undefined
+    };
+
+    function executor(resolve, reject)
+    {
+        if (promiseCapability.@resolve !== @undefined)
+            @throwTypeError("resolve function is already set");
+        if (promiseCapability.@reject !== @undefined)
+            @throwTypeError("reject function is already set");
+
+        promiseCapability.@resolve = resolve;
+        promiseCapability.@reject = reject;
+    }
+
+    var promise = new constructor(executor);
+
+    if (typeof promiseCapability.@resolve !== "function")
+        @throwTypeError("executor did not take a resolve function");
+
+    if (typeof promiseCapability.@reject !== "function")
+        @throwTypeError("executor did not take a reject function");
+
+    promiseCapability.@promise = promise;
+
+    return promiseCapability;
+}
+
+@globalPrivate
+function triggerPromiseReactions(state, reactions, argument)
+{
+    "use strict";
+
+    for (var index = 0, length = reactions.length; index < length; ++index)
+        @enqueueJob(@promiseReactionJob, [state, reactions[index], argument]);
+}
+
+@globalPrivate
+function rejectPromise(promise, reason)
+{
+    "use strict";
+
+    var reactions = promise.@promiseReactions;
+    promise.@promiseResult = reason;
+    promise.@promiseReactions = @undefined;
+    promise.@promiseState = @promiseStateRejected;
+
+    @InspectorInstrumentation.promiseRejected(promise, reason, reactions);
+
+    @triggerPromiseReactions(@promiseStateRejected, reactions, reason);
+}
+
+@globalPrivate
+function fulfillPromise(promise, value)
+{
+    "use strict";
+
+    var reactions = promise.@promiseReactions;
+    promise.@promiseResult = value;
+    promise.@promiseReactions = @undefined;
+    promise.@promiseState = @promiseStateFulfilled;
+
+    @InspectorInstrumentation.promiseFulfilled(promise, value, reactions);
+
+    @triggerPromiseReactions(@promiseStateFulfilled, reactions, value);
+}
+
+@globalPrivate
+function createResolvingFunctions(promise)
+{
+    "use strict";
+
+    var alreadyResolved = false;
+
+    var resolve = function (resolution) {
+        if (alreadyResolved)
+            return @undefined;
+        alreadyResolved = true;
+
+        if (resolution === promise)
+            return @rejectPromise(promise, new @TypeError("Resolve a promise with itself"));
+
+        if (!@isObject(resolution))
+            return @fulfillPromise(promise, resolution);
+
+        var then;
+        try {
+            then = resolution.then;
+        } catch (error) {
+            return @rejectPromise(promise, error);
+        }
+
+        if (typeof then !== 'function')
+            return @fulfillPromise(promise, resolution);
+
+        @enqueueJob(@promiseResolveThenableJob, [promise, resolution, then]);
+
+        return @undefined;
+    };
+
+    var reject = function (reason) {
+        if (alreadyResolved)
+            return @undefined;
+        alreadyResolved = true;
+
+        return @rejectPromise(promise, reason);
+    };
+
+    return {
+        @resolve: resolve,
+        @reject: reject
+    };
+}
+
+@globalPrivate
+function promiseReactionJob(state, reaction, argument)
+{
+    "use strict";
+
+    var promiseCapability = reaction.@capabilities;
+
+    var result;
+    var handler = (state === @promiseStateFulfilled) ? reaction.@onFulfilled: reaction.@onRejected;
+    try {
+        result = handler(argument);
+    } catch (error) {
+        return promiseCapability.@reject.@call(@undefined, error);
+    }
+
+    return promiseCapability.@resolve.@call(@undefined, result);
+}
+
+@globalPrivate
+function promiseResolveThenableJob(promiseToResolve, thenable, then)
+{
+    "use strict";
+
+    var resolvingFunctions = @createResolvingFunctions(promiseToResolve);
+
+    try {
+        return then.@call(thenable, resolvingFunctions.@resolve, resolvingFunctions.@reject);
+    } catch (error) {
+        return resolvingFunctions.@reject.@call(@undefined, error);
+    }
+}
+
+@globalPrivate
+function initializePromise(executor)
+{
+    "use strict";
+
+    if (typeof executor !== 'function')
+        @throwTypeError("Promise constructor takes a function argument");
+
+    this.@promiseState = @promiseStatePending;
+    this.@promiseReactions = [];
+
+    var resolvingFunctions = @createResolvingFunctions(this);
+    try {
+        executor(resolvingFunctions.@resolve, resolvingFunctions.@reject);
+    } catch (error) {
+        return resolvingFunctions.@reject.@call(@undefined, error);
+    }
+
+    return this;
+}
diff --git a/builtins/PromisePrototype.js b/builtins/PromisePrototype.js
new file mode 100644
index 0000000..6065ad8
--- /dev/null
+++ b/builtins/PromisePrototype.js
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function catch(onRejected)
+{
+    "use strict";
+
+    return this.then(@undefined, onRejected);
+}
+
+function then(onFulfilled, onRejected)
+{
+    "use strict";
+
+    if (!@isPromise(this))
+        @throwTypeError("|this| is not a object");
+
+    var constructor = @speciesConstructor(this, @Promise);
+
+    var resultCapability = @newPromiseCapability(constructor);
+
+    if (typeof onFulfilled !== "function")
+        onFulfilled = function (argument) { return argument; };
+
+    if (typeof onRejected !== "function")
+        onRejected = function (argument) { throw argument; };
+
+    var reaction = @newPromiseReaction(resultCapability, onFulfilled, onRejected);
+
+    var state = this.@promiseState;
+    if (state === @promiseStatePending)
+        @putByValDirect(this.@promiseReactions, this.@promiseReactions.length, reaction);
+    else
+        @enqueueJob(@promiseReactionJob, [state, reaction, this.@promiseResult]);
+
+    return resultCapability.@promise;
+}
diff --git a/builtins/ReflectObject.js b/builtins/ReflectObject.js
new file mode 100644
index 0000000..1aaa1f4
--- /dev/null
+++ b/builtins/ReflectObject.js
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// https://tc39.github.io/ecma262/#sec-reflect.apply
+function apply(target, thisArgument, argumentsList)
+{
+    "use strict";
+
+    if (typeof target !== "function")
+        @throwTypeError("Reflect.apply requires the first argument be a function");
+
+    if (!@isObject(argumentsList))
+        @throwTypeError("Reflect.apply requires the third argument be an object");
+
+    return target.@apply(thisArgument, argumentsList);
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.deleteproperty
+function deleteProperty(target, propertyKey)
+{
+    // Intentionally keep the code the sloppy mode to suppress the TypeError
+    // raised by the delete operator under the strict mode.
+
+    if (!@isObject(target))
+        @throwTypeError("Reflect.deleteProperty requires the first argument be an object");
+
+    return delete target[propertyKey];
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.has
+function has(target, propertyKey)
+{
+    "use strict";
+
+    if (!@isObject(target))
+        @throwTypeError("Reflect.has requires the first argument be an object");
+
+    return propertyKey in target;
+}
diff --git a/builtins/RegExpPrototype.js b/builtins/RegExpPrototype.js
new file mode 100644
index 0000000..017a81c
--- /dev/null
+++ b/builtins/RegExpPrototype.js
@@ -0,0 +1,529 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+@globalPrivate
+function advanceStringIndex(string, index, unicode)
+{
+    // This function implements AdvanceStringIndex described in ES6 21.2.5.2.3.
+    "use strict";
+
+    if (!unicode)
+        return index + 1;
+
+    if (index + 1 >= string.length)
+        return index + 1;
+
+    let first = string.@charCodeAt(index);
+    if (first < 0xD800 || first > 0xDBFF)
+        return index + 1;
+
+    let second = string.@charCodeAt(index + 1);
+    if (second < 0xDC00 || second > 0xDFFF)
+        return index + 1;
+
+    return index + 2;
+}
+
+@globalPrivate
+function regExpExec(regexp, str)
+{
+    "use strict";
+
+    let exec = regexp.exec;
+    let builtinExec = @regExpBuiltinExec;
+    if (exec !== builtinExec && typeof exec === "function") {
+        let result = exec.@call(regexp, str);
+        if (result !== null && !@isObject(result))
+            @throwTypeError("The result of a RegExp exec must be null or an object");
+        return result;
+    }
+    return builtinExec.@call(regexp, str);
+}
+
+@globalPrivate
+function hasObservableSideEffectsForRegExpMatch(regexp) {
+    // This is accessed by the RegExpExec internal function.
+    let regexpExec = @tryGetById(regexp, "exec");
+    if (regexpExec !== @regExpBuiltinExec)
+        return true;
+
+    let regexpGlobal = @tryGetById(regexp, "global");
+    if (regexpGlobal !== @regExpProtoGlobalGetter)
+        return true;
+    let regexpUnicode = @tryGetById(regexp, "unicode");
+    if (regexpUnicode !== @regExpProtoUnicodeGetter)
+        return true;
+
+    return !@isRegExpObject(regexp);
+}
+
+function match(strArg)
+{
+    "use strict";
+
+    if (!@isObject(this))
+        @throwTypeError("RegExp.prototype.@@match requires that |this| be an Object");
+
+    let regexp = this;
+
+    // Check for observable side effects and call the fast path if there aren't any.
+    if (!@hasObservableSideEffectsForRegExpMatch(regexp))
+        return @regExpMatchFast.@call(regexp, strArg);
+
+    let str = @toString(strArg);
+
+    if (!regexp.global)
+        return @regExpExec(regexp, str);
+    
+    let unicode = regexp.unicode;
+    regexp.lastIndex = 0;
+    let resultList = [];
+
+    // FIXME: It would be great to implement a solution similar to what we do in
+    // RegExpObject::matchGlobal(). It's not clear if this is possible, since this loop has
+    // effects. https://bugs.webkit.org/show_bug.cgi?id=158145
+    const maximumReasonableMatchSize = 100000000;
+
+    while (true) {
+        let result = @regExpExec(regexp, str);
+        
+        if (result === null) {
+            if (resultList.length === 0)
+                return null;
+            return resultList;
+        }
+
+        if (resultList.length > maximumReasonableMatchSize)
+            @throwOutOfMemoryError();
+
+        if (!@isObject(result))
+            @throwTypeError("RegExp.prototype.@@match call to RegExp.exec didn't return null or an object");
+
+        let resultString = @toString(result[0]);
+
+        if (!resultString.length)
+            regexp.lastIndex = @advanceStringIndex(str, regexp.lastIndex, unicode);
+
+        resultList.@push(resultString);
+    }
+}
+
+function replace(strArg, replace)
+{
+    "use strict";
+
+    function getSubstitution(matched, str, position, captures, replacement)
+    {
+        "use strict";
+
+        let matchLength = matched.length;
+        let stringLength = str.length;
+        let tailPos = position + matchLength;
+        let m = captures.length;
+        let replacementLength = replacement.length;
+        let result = "";
+        let lastStart = 0;
+
+        for (let start = 0; start = replacement.indexOf("$", lastStart), start !== -1; lastStart = start) {
+            if (start - lastStart > 0)
+                result = result + replacement.substring(lastStart, start);
+            start++;
+            let ch = replacement.charAt(start);
+            if (ch === "")
+                result = result + "$";
+            else {
+                switch (ch)
+                {
+                case "$":
+                    result = result + "$";
+                    start++;
+                    break;
+                case "&":
+                    result = result + matched;
+                    start++;
+                    break;
+                case "`":
+                    if (position > 0)
+                        result = result + str.substring(0, position);
+                    start++;
+                    break;
+                case "'":
+                    if (tailPos < stringLength)
+                        result = result + str.substring(tailPos);
+                    start++;
+                    break;
+                default:
+                    let chCode = ch.charCodeAt(0);
+                    if (chCode >= 0x30 && chCode <= 0x39) {
+                        start++;
+                        let n = chCode - 0x30;
+                        if (n > m)
+                            break;
+                        if (start < replacementLength) {
+                            let nextChCode = replacement.charCodeAt(start);
+                            if (nextChCode >= 0x30 && nextChCode <= 0x39) {
+                                let nn = 10 * n + nextChCode - 0x30;
+                                if (nn <= m) {
+                                    n = nn;
+                                    start++;
+                                }
+                            }
+                        }
+
+                        if (n == 0)
+                            break;
+
+                        if (captures[n] != @undefined)
+                            result = result + captures[n];
+                    } else
+                        result = result + "$";
+                    break;
+                }
+            }
+        }
+
+        return result + replacement.substring(lastStart);
+    }
+
+    if (!@isObject(this))
+        @throwTypeError("RegExp.prototype.@@replace requires that |this| be an Object");
+
+    let regexp = this;
+
+    let str = @toString(strArg);
+    let stringLength = str.length;
+    let functionalReplace = typeof replace === 'function';
+
+    if (!functionalReplace)
+        replace = @toString(replace);
+
+    let global = regexp.global;
+    let unicode = false;
+
+    if (global) {
+        unicode = regexp.unicode;
+        regexp.lastIndex = 0;
+    }
+
+    let resultList = [];
+    let result;
+    let done = false;
+    while (!done) {
+        result = @regExpExec(regexp, str);
+
+        if (result === null)
+            done = true;
+        else {
+            resultList.@push(result);
+            if (!global)
+                done = true;
+            else {
+                let matchStr = @toString(result[0]);
+
+                if (!matchStr.length)
+                    regexp.lastIndex = @advanceStringIndex(str, regexp.lastIndex, unicode);
+            }
+        }
+    }
+
+    let accumulatedResult = "";
+    let nextSourcePosition = 0;
+    let lastPosition = 0;
+
+    for (result of resultList) {
+        let nCaptures = result.length - 1;
+        if (nCaptures < 0)
+            nCaptures = 0;
+        let matched = @toString(result[0]);
+        let matchLength = matched.length;
+        let position = result.index;
+        position = (position > stringLength) ? stringLength : position;
+        position = (position < 0) ? 0 : position;
+
+        let captures = [];
+        for (let n = 1; n <= nCaptures; n++) {
+            let capN = result[n];
+            if (capN !== @undefined)
+                capN = @toString(capN);
+            captures[n] = capN;
+        }
+
+        let replacement;
+
+        if (functionalReplace) {
+            let replacerArgs = [ matched ].concat(captures.slice(1));
+            replacerArgs.@push(position);
+            replacerArgs.@push(str);
+
+            let replValue = replace.@apply(@undefined, replacerArgs);
+            replacement = @toString(replValue);
+        } else
+            replacement = getSubstitution(matched, str, position, captures, replace);
+
+        if (position >= nextSourcePosition && position >= lastPosition) {
+            accumulatedResult = accumulatedResult + str.substring(nextSourcePosition, position) + replacement;
+            nextSourcePosition = position + matchLength;
+            lastPosition = position;
+        }
+    }
+
+    if (nextSourcePosition >= stringLength)
+        return  accumulatedResult;
+
+    return accumulatedResult + str.substring(nextSourcePosition);
+}
+
+// 21.2.5.9 RegExp.prototype[@@search] (string)
+function search(strArg)
+{
+    "use strict";
+
+    let regexp = this;
+
+    // Check for observable side effects and call the fast path if there aren't any.
+    if (@isRegExpObject(regexp) && @tryGetById(regexp, "exec") === @regExpBuiltinExec)
+        return @regExpSearchFast.@call(regexp, strArg);
+
+    // 1. Let rx be the this value.
+    // 2. If Type(rx) is not Object, throw a TypeError exception.
+    if (!@isObject(this))
+        @throwTypeError("RegExp.prototype.@@search requires that |this| be an Object");
+
+    // 3. Let S be ? ToString(string).
+    let str = @toString(strArg)
+
+    // 4. Let previousLastIndex be ? Get(rx, "lastIndex").
+    let previousLastIndex = regexp.lastIndex;
+    // 5. Perform ? Set(rx, "lastIndex", 0, true).
+    regexp.lastIndex = 0;
+    // 6. Let result be ? RegExpExec(rx, S).
+    let result = @regExpExec(regexp, str);
+    // 7. Perform ? Set(rx, "lastIndex", previousLastIndex, true).
+    regexp.lastIndex = previousLastIndex;
+    // 8. If result is null, return -1.
+    if (result === null)
+        return -1;
+    // 9. Return ? Get(result, "index").
+    return result.index;
+}
+
+@globalPrivate
+function hasObservableSideEffectsForRegExpSplit(regexp) {
+    // This is accessed by the RegExpExec internal function.
+    let regexpExec = @tryGetById(regexp, "exec");
+    if (regexpExec !== @regExpBuiltinExec)
+        return true;
+    
+    // This is accessed by step 5 below.
+    let regexpFlags = @tryGetById(regexp, "flags");
+    if (regexpFlags !== @regExpProtoFlagsGetter)
+        return true;
+    
+    // These are accessed by the builtin flags getter.
+    let regexpGlobal = @tryGetById(regexp, "global");
+    if (regexpGlobal !== @regExpProtoGlobalGetter)
+        return true;
+    let regexpIgnoreCase = @tryGetById(regexp, "ignoreCase");
+    if (regexpIgnoreCase !== @regExpProtoIgnoreCaseGetter)
+        return true;
+    let regexpMultiline = @tryGetById(regexp, "multiline");
+    if (regexpMultiline !== @regExpProtoMultilineGetter)
+        return true;
+    let regexpSticky = @tryGetById(regexp, "sticky");
+    if (regexpSticky !== @regExpProtoStickyGetter)
+        return true;
+    let regexpUnicode = @tryGetById(regexp, "unicode");
+    if (regexpUnicode !== @regExpProtoUnicodeGetter)
+        return true;
+    
+    // This is accessed by the RegExp species constructor.
+    let regexpSource = @tryGetById(regexp, "source");
+    if (regexpSource !== @regExpProtoSourceGetter)
+        return true;
+    
+    return !@isRegExpObject(regexp);
+}
+
+// ES 21.2.5.11 RegExp.prototype[@@split](string, limit)
+function split(string, limit)
+{
+    "use strict";
+
+    // 1. Let rx be the this value.
+    // 2. If Type(rx) is not Object, throw a TypeError exception.
+    if (!@isObject(this))
+        @throwTypeError("RegExp.prototype.@@split requires that |this| be an Object");
+    let regexp = this;
+
+    // 3. Let S be ? ToString(string).
+    let str = @toString(string);
+
+    // 4. Let C be ? SpeciesConstructor(rx, %RegExp%).
+    let speciesConstructor = @speciesConstructor(regexp, @RegExp);
+
+    if (speciesConstructor === @RegExp && !@hasObservableSideEffectsForRegExpSplit(regexp))
+        return @regExpSplitFast.@call(regexp, str, limit);
+
+    // 5. Let flags be ? ToString(? Get(rx, "flags")).
+    let flags = @toString(regexp.flags);
+
+    // 6. If flags contains "u", let unicodeMatching be true.
+    // 7. Else, let unicodeMatching be false.
+    let unicodeMatching = @stringIncludesInternal.@call(flags, "u");
+    // 8. If flags contains "y", let newFlags be flags.
+    // 9. Else, let newFlags be the string that is the concatenation of flags and "y".
+    let newFlags = @stringIncludesInternal.@call(flags, "y") ? flags : flags + "y";
+
+    // 10. Let splitter be ? Construct(C, « rx, newFlags »).
+    let splitter = new speciesConstructor(regexp, newFlags);
+
+    // We need to check again for RegExp subclasses that will fail the speciesConstructor test
+    // but can still use the fast path after we invoke the constructor above.
+    if (!@hasObservableSideEffectsForRegExpSplit(splitter))
+        return @regExpSplitFast.@call(splitter, str, limit);
+
+    // 11. Let A be ArrayCreate(0).
+    // 12. Let lengthA be 0.
+    let result = [];
+
+    // 13. If limit is undefined, let lim be 2^32-1; else let lim be ? ToUint32(limit).
+    limit = (limit === @undefined) ? 0xffffffff : limit >>> 0;
+
+    // 16. If lim = 0, return A.
+    if (!limit)
+        return result;
+
+    // 14. [Defered from above] Let size be the number of elements in S.
+    let size = str.length;
+
+    // 17. If size = 0, then
+    if (!size) {
+        // a. Let z be ? RegExpExec(splitter, S).
+        let z = @regExpExec(splitter, str);
+        // b. If z is not null, return A.
+        if (z != null)
+            return result;
+        // c. Perform ! CreateDataProperty(A, "0", S).
+        @putByValDirect(result, 0, str);
+        // d. Return A.
+        return result;
+    }
+
+    // 15. [Defered from above] Let p be 0.
+    let position = 0;
+    // 18. Let q be p.
+    let matchPosition = 0;
+
+    // 19. Repeat, while q < size
+    while (matchPosition < size) {
+        // a. Perform ? Set(splitter, "lastIndex", q, true).
+        splitter.lastIndex = matchPosition;
+        // b. Let z be ? RegExpExec(splitter, S).
+        let matches = @regExpExec(splitter, str);
+        // c. If z is null, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (matches === null)
+            matchPosition = @advanceStringIndex(str, matchPosition, unicodeMatching);
+        // d. Else z is not null,
+        else {
+            // i. Let e be ? ToLength(? Get(splitter, "lastIndex")).
+            let endPosition = @toLength(splitter.lastIndex);
+            // ii. Let e be min(e, size).
+            endPosition = (endPosition <= size) ? endPosition : size;
+            // iii. If e = p, let q be AdvanceStringIndex(S, q, unicodeMatching).
+            if (endPosition === position)
+                matchPosition = @advanceStringIndex(str, matchPosition, unicodeMatching);
+            // iv. Else e != p,
+            else {
+                // 1. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through q (exclusive).
+                let subStr = @stringSubstrInternal.@call(str, position, matchPosition - position);
+                // 2. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+                // 3. Let lengthA be lengthA + 1.
+                @putByValDirect(result, result.length, subStr);
+                // 4. If lengthA = lim, return A.
+                if (result.length == limit)
+                    return result;
+
+                // 5. Let p be e.
+                position = endPosition;
+                // 6. Let numberOfCaptures be ? ToLength(? Get(z, "length")).
+                // 7. Let numberOfCaptures be max(numberOfCaptures-1, 0).
+                let numberOfCaptures = matches.length > 1 ? matches.length - 1 : 0;
+
+                // 8. Let i be 1.
+                let i = 1;
+                // 9. Repeat, while i <= numberOfCaptures,
+                while (i <= numberOfCaptures) {
+                    // a. Let nextCapture be ? Get(z, ! ToString(i)).
+                    let nextCapture = matches[i];
+                    // b. Perform ! CreateDataProperty(A, ! ToString(lengthA), nextCapture).
+                    // d. Let lengthA be lengthA + 1.
+                    @putByValDirect(result, result.length, nextCapture);
+                    // e. If lengthA = lim, return A.
+                    if (result.length == limit)
+                        return result;
+                    // c. Let i be i + 1.
+                    i++;
+                }
+                // 10. Let q be p.
+                matchPosition = position;
+            }
+        }
+    }
+    // 20. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through size (exclusive).
+    let remainingStr = @stringSubstrInternal.@call(str, position, size);
+    // 21. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+    @putByValDirect(result, result.length, remainingStr);
+    // 22. Return A.
+    return result;
+}
+
+// ES 21.2.5.13 RegExp.prototype.test(string)
+@intrinsic=RegExpTestIntrinsic
+function test(strArg)
+{
+    "use strict";
+
+    let regexp = this;
+
+    // Check for observable side effects and call the fast path if there aren't any.
+    if (@isRegExpObject(regexp) && @tryGetById(regexp, "exec") === @regExpBuiltinExec)
+        return @regExpTestFast.@call(regexp, strArg);
+
+    // 1. Let R be the this value.
+    // 2. If Type(R) is not Object, throw a TypeError exception.
+    if (!@isObject(regexp))
+        @throwTypeError("RegExp.prototype.test requires that |this| be an Object");
+
+    // 3. Let string be ? ToString(S).
+    let str = @toString(strArg);
+
+    // 4. Let match be ? RegExpExec(R, string).
+    let match = @regExpExec(regexp, str);
+
+    // 5. If match is not null, return true; else return false.
+    if (match !== null)
+        return true;
+    return false;
+}
diff --git a/builtins/SetPrototype.js b/builtins/SetPrototype.js
new file mode 100644
index 0000000..e9b6626
--- /dev/null
+++ b/builtins/SetPrototype.js
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function forEach(callback /*, thisArg */)
+{
+    "use strict";
+
+    if (!@isSet(this))
+        @throwTypeError("Set operation called on non-Set object");
+
+    if (typeof callback !== 'function')
+        @throwTypeError("Set.prototype.forEach callback must be a function");
+
+    var thisArg = @argument(1);
+    var iterator = @SetIterator(this);
+
+    // To avoid object allocations for iterator result objects, we pass the placeholder to the special "next" function in order to fill the results.
+    var value = [ @undefined ];
+    for (;;) {
+        if (@setIteratorNext.@call(iterator, value))
+            break;
+        callback.@call(thisArg, value[0], value[0], this);
+    }
+}
diff --git a/builtins/StringConstructor.js b/builtins/StringConstructor.js
new file mode 100644
index 0000000..a329332
--- /dev/null
+++ b/builtins/StringConstructor.js
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function raw(template)
+{
+    "use strict";
+
+    if (template === null || template === @undefined)
+        @throwTypeError("String.raw requires template not be null or undefined");
+    var cookedSegments = @Object(template);
+
+    var rawValue = cookedSegments.raw;
+    if (rawValue === null || rawValue === @undefined)
+        @throwTypeError("String.raw requires template.raw not be null or undefined");
+    var rawSegments = @Object(rawValue);
+
+    var numberOfSubstitutions = arguments.length - 1;
+
+    var segmentCount = @toLength(rawSegments.length);
+
+    if (segmentCount <= 0)
+        return '';
+
+    var stringElements = '';
+    for (var i = 0; ; ++i) {
+        var segment = @toString(rawSegments[i]);
+        stringElements += segment;
+
+        if ((i + 1) === segmentCount)
+            return stringElements;
+
+        if (i < numberOfSubstitutions) {
+            var substitutionIndexInArguments = i + 1;
+            var next = @toString(arguments[substitutionIndexInArguments]);
+            stringElements += next;
+        }
+    }
+}
diff --git a/builtins/StringIteratorPrototype.js b/builtins/StringIteratorPrototype.js
new file mode 100644
index 0000000..52762db
--- /dev/null
+++ b/builtins/StringIteratorPrototype.js
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function next()
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("%StringIteratorPrototype%.next requires that |this| not be null or undefined");
+
+    var position = this.@stringIteratorNextIndex;
+    if (position === @undefined)
+        @throwTypeError("%StringIteratorPrototype%.next requires that |this| be a String Iterator instance");
+
+    var done = true;
+    var value = @undefined;
+
+    var string = this.@iteratedString;
+    if (string !== @undefined) {
+        var length = string.length >>> 0;
+        if (position >= length) {
+            this.@iteratedString = @undefined;
+        } else {
+            done = false;
+
+            var first = string.@charCodeAt(position);
+            if (first < 0xD800 || first > 0xDBFF || position + 1 === length)
+                value = string[position];
+            else {
+                var second = string.@charCodeAt(position + 1);
+                if (second < 0xDC00 || second > 0xDFFF)
+                    value = string[position];
+                else
+                    value = string[position] + string[position + 1];
+            }
+
+            this.@stringIteratorNextIndex = position + value.length;
+        }
+    }
+
+    return {done, value};
+}
diff --git a/builtins/StringPrototype.js b/builtins/StringPrototype.js
new file mode 100644
index 0000000..c9cdfcf
--- /dev/null
+++ b/builtins/StringPrototype.js
@@ -0,0 +1,300 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner <thetalecrafter@gmail.com>.
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+function match(regexp)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("String.prototype.match requires that |this| not be null or undefined");
+
+    if (regexp != null) {
+        var matcher = regexp.@matchSymbol;
+        if (matcher != @undefined)
+            return matcher.@call(regexp, this);
+    }
+
+    let thisString = @toString(this);
+    let createdRegExp = @regExpCreate(regexp, @undefined);
+    return createdRegExp.@matchSymbol(thisString);
+}
+
+@globalPrivate
+function repeatSlowPath(string, count)
+{
+    "use strict";
+
+    // Return an empty string.
+    if (count === 0 || string.length === 0)
+        return "";
+
+    // Return the original string.
+    if (count === 1)
+        return string;
+
+    if (string.length * count > @MAX_STRING_LENGTH)
+        @throwOutOfMemoryError();
+
+    // Bit operation onto |count| is safe because |count| should be within Int32 range,
+    // Repeat log N times to generate the repeated string rope.
+    var result = "";
+    var operand = string;
+    while (true) {
+        if (count & 1)
+            result += operand;
+        count >>= 1;
+        if (!count)
+            return result;
+        operand += operand;
+    }
+}
+
+@globalPrivate
+function repeatCharactersSlowPath(string, count)
+{
+    "use strict";
+    var repeatCount = (count / string.length) | 0;
+    var remainingCharacters = count - repeatCount * string.length;
+    var result = "";
+    var operand = string;
+    // Bit operation onto |repeatCount| is safe because |repeatCount| should be within Int32 range,
+    // Repeat log N times to generate the repeated string rope.
+    while (true) {
+        if (repeatCount & 1)
+            result += operand;
+        repeatCount >>= 1;
+        if (!repeatCount)
+            break;
+        operand += operand;
+    }
+    if (remainingCharacters)
+        result += @stringSubstrInternal.@call(string, 0, remainingCharacters);
+    return result;
+}
+
+
+function repeat(count)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("String.prototype.repeat requires that |this| not be null or undefined");
+
+    var string = @toString(this);
+    count = @toInteger(count);
+
+    if (count < 0 || count === @Infinity)
+        @throwRangeError("String.prototype.repeat argument must be greater than or equal to 0 and not be Infinity");
+
+    if (string.length === 1)
+        return @repeatCharacter(string, count);
+
+    return @repeatSlowPath(string, count);
+}
+
+function padStart(maxLength/*, fillString*/)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("String.prototype.padStart requires that |this| not be null or undefined");
+
+    var string = @toString(this);
+    maxLength = @toLength(maxLength);
+
+    var stringLength = string.length;
+    if (maxLength <= stringLength)
+        return string;
+
+    var filler;
+    var fillString = @argument(1);
+    if (fillString === @undefined)
+        filler = " ";
+    else {
+        filler = @toString(fillString);
+        if (filler === "")
+            return string;
+    }
+
+    if (maxLength > @MAX_STRING_LENGTH)
+        @throwOutOfMemoryError();
+
+    var fillLength = maxLength - stringLength;
+    var truncatedStringFiller;
+
+    if (filler.length === 1)
+        truncatedStringFiller = @repeatCharacter(filler, fillLength);
+    else
+        truncatedStringFiller = @repeatCharactersSlowPath(filler, fillLength);
+    return truncatedStringFiller + string;
+}
+
+function padEnd(maxLength/*, fillString*/)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("String.prototype.padEnd requires that |this| not be null or undefined");
+
+    var string = @toString(this);
+    maxLength = @toLength(maxLength);
+
+    var stringLength = string.length;
+    if (maxLength <= stringLength)
+        return string;
+
+    var filler;
+    var fillString = @argument(1);
+    if (fillString === @undefined)
+        filler = " ";
+    else {
+        filler = @toString(fillString);
+        if (filler === "")
+            return string;
+    }
+
+    if (maxLength > @MAX_STRING_LENGTH)
+        @throwOutOfMemoryError();
+
+    var fillLength = maxLength - stringLength;
+    var truncatedStringFiller;
+
+    if (filler.length === 1)
+        truncatedStringFiller = @repeatCharacter(filler, fillLength);
+    else
+        truncatedStringFiller = @repeatCharactersSlowPath(filler, fillLength);
+    return string + truncatedStringFiller;
+}
+
+@globalPrivate
+function hasObservableSideEffectsForStringReplace(regexp, replacer) {
+    if (replacer !== @regExpPrototypeSymbolReplace)
+        return true;
+    
+    let regexpExec = @tryGetById(regexp, "exec");
+    if (regexpExec !== @regExpBuiltinExec)
+        return true;
+
+    let regexpGlobal = @tryGetById(regexp, "global");
+    if (regexpGlobal !== @regExpProtoGlobalGetter)
+        return true;
+
+    let regexpUnicode = @tryGetById(regexp, "unicode");
+    if (regexpUnicode !== @regExpProtoUnicodeGetter)
+        return true;
+
+    return !@isRegExpObject(regexp);
+}
+
+@intrinsic=StringPrototypeReplaceIntrinsic
+function replace(search, replace)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("String.prototype.replace requires that |this| not be null or undefined");
+
+    if (search != null) {
+        let replacer = search.@replaceSymbol;
+        if (replacer !== @undefined) {
+            if (!@hasObservableSideEffectsForStringReplace(search, replacer))
+                return @toString(this).@replaceUsingRegExp(search, replace);
+            return replacer.@call(search, this, replace);
+        }
+    }
+
+    let thisString = @toString(this);
+    let searchString = @toString(search);
+    return thisString.@replaceUsingStringSearch(searchString, replace);
+}
+    
+function localeCompare(that/*, locales, options */)
+{
+    "use strict";
+
+    // 13.1.1 String.prototype.localeCompare (that [, locales [, options ]]) (ECMA-402 2.0)
+    // http://ecma-international.org/publications/standards/Ecma-402.htm
+
+    // 1. Let O be RequireObjectCoercible(this value).
+    if (this == null)
+        @throwTypeError("String.prototype.localeCompare requires that |this| not be null or undefined");
+
+    // 2. Let S be ToString(O).
+    // 3. ReturnIfAbrupt(S).
+    var thisString = @toString(this);
+
+    // 4. Let That be ToString(that).
+    // 5. ReturnIfAbrupt(That).
+    var thatString = @toString(that);
+
+    // Avoid creating a collator for defaults.
+    var locales = @argument(1);
+    var options = @argument(2);
+    if (locales === @undefined && options === @undefined)
+        return @Collator.prototype.compare(thisString, thatString);
+
+    // 6. Let collator be Construct(%Collator%, «locales, options»).
+    // 7. ReturnIfAbrupt(collator).
+    var collator = new @Collator(locales, options);
+
+    // 8. Return CompareStrings(collator, S, That).
+    return collator.compare(thisString, thatString);
+}
+
+function search(regexp)
+{
+    "use strict";
+
+    if (this == null)
+        @throwTypeError("String.prototype.search requires that |this| not be null or undefined");
+
+    if (regexp != null) {
+        var searcher = regexp.@searchSymbol;
+        if (searcher != @undefined)
+            return searcher.@call(regexp, this);
+    }
+
+    var thisString = @toString(this);
+    var createdRegExp = @regExpCreate(regexp, @undefined);
+    return createdRegExp.@searchSymbol(thisString);
+}
+
+function split(separator, limit)
+{
+    "use strict";
+    
+    if (this == null)
+        @throwTypeError("String.prototype.split requires that |this| not be null or undefined");
+    
+    if (separator != null) {
+        var splitter = separator.@splitSymbol;
+        if (splitter != @undefined)
+            return splitter.@call(separator, this, limit);
+    }
+    
+    return @stringSplitFast.@call(this, separator, limit);
+}
diff --git a/builtins/TypedArrayConstructor.js b/builtins/TypedArrayConstructor.js
new file mode 100644
index 0000000..54a957b
--- /dev/null
+++ b/builtins/TypedArrayConstructor.js
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// According to the spec we are supposed to crawl the prototype chain looking
+// for the a TypedArray constructor. The way we implement this is with a
+// private function, @alloctateTypedArray, on each of the prototypes.
+// This enables us to optimize this lookup in the inline cache.
+
+function of(/* items... */)
+{
+    "use strict";
+    let len = arguments.length;
+    let constructFunction = this.@allocateTypedArray;
+    if (constructFunction === @undefined)
+        @throwTypeError("TypedArray.of requires its this argument to subclass a TypedArray constructor");
+
+    let result = constructFunction(len);
+
+    for (let i = 0; i < len; i++)
+        result[i] = arguments[i];
+
+    return result;
+}
+
+function from(items /* [ , mapfn [ , thisArg ] ] */)
+{
+    "use strict";
+
+    let mapFn = @argument(1);
+
+    let thisArg;
+
+    if (mapFn !== @undefined) {
+        if (typeof mapFn !== "function")
+            @throwTypeError("TypedArray.from requires that the second argument, when provided, be a function");
+
+        thisArg = @argument(2);
+    }
+
+    if (items == null)
+        @throwTypeError("TypedArray.from requires an array-like object - not null or undefined");
+
+    let iteratorMethod = items.@iteratorSymbol;
+    if (iteratorMethod != null) {
+        if (typeof iteratorMethod !== "function")
+            @throwTypeError("TypedArray.from requires that the property of the first argument, items[Symbol.iterator], when exists, be a function");
+
+        let accumulator = [];
+
+        let k = 0;
+        let iterator = iteratorMethod.@call(items);
+
+        // Since for-of loop once more looks up the @@iterator property of a given iterable,
+        // it could be observable if the user defines a getter for @@iterator.
+        // To avoid this situation, we define a wrapper object that @@iterator just returns a given iterator.
+        let wrapper = {};
+        wrapper.@iteratorSymbol = function() { return iterator; }
+
+        for (let value of wrapper) {
+            if (mapFn)
+                @putByValDirect(accumulator, k, thisArg === @undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k));
+            else
+                @putByValDirect(accumulator, k, value);
+            k++;
+        }
+
+        let constructFunction = this.@allocateTypedArray;
+        if (constructFunction === @undefined)
+            @throwTypeError("TypedArray.from requires its this argument subclass a TypedArray constructor");
+
+        let result = constructFunction(k);
+
+        for (let i = 0; i < k; i++) 
+            result[i] = accumulator[i];
+
+
+        return result;
+    }
+
+    let arrayLike = @Object(items);
+    let arrayLikeLength = @toLength(arrayLike.length);
+
+    let constructFunction = this.@allocateTypedArray;
+    if (constructFunction === @undefined)
+        @throwTypeError("this does not subclass a TypedArray constructor");
+
+    let result = constructFunction(arrayLikeLength);
+
+    let k = 0;
+    while (k < arrayLikeLength) {
+        let value = arrayLike[k];
+        if (mapFn)
+            result[k] = thisArg === @undefined ? mapFn(value, k) : mapFn.@call(thisArg, value, k);
+        else
+            result[k] = value;
+        k++;
+    }
+
+    return result;
+}
+
+function allocateInt8Array(length)
+{
+    return new @Int8Array(length);
+}
+
+function allocateInt16Array(length)
+{
+    return new @Int16Array(length);    
+}
+
+function allocateInt32Array(length)
+{
+    return new @Int32Array(length);   
+}
+
+function allocateUint32Array(length)
+{
+    return new @Uint32Array(length);
+}
+
+function allocateUint16Array(length)
+{
+    return new @Uint16Array(length);   
+}
+
+function allocateUint8Array(length)
+{
+    return new @Uint8Array(length);   
+}
+
+function allocateUint8ClampedArray(length)
+{
+    return new @Uint8ClampedArray(length);
+}
+
+function allocateFloat32Array(length)
+{
+    return new @Float32Array(length);
+}
+
+function allocateFloat64Array(length)
+{
+    return new @Float64Array(length);
+}
diff --git a/builtins/TypedArrayPrototype.js b/builtins/TypedArrayPrototype.js
new file mode 100644
index 0000000..53674bf
--- /dev/null
+++ b/builtins/TypedArrayPrototype.js
@@ -0,0 +1,413 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Note that the intrisic @typedArrayLength checks that the argument passed is a typed array
+// and throws if it is not.
+
+
+// Typed Arrays have their own species constructor function since they need
+// to look up their default constructor, which is expensive. If we used the
+// normal speciesConstructor helper we would need to look up the default
+// constructor every time.
+@globalPrivate
+function typedArraySpeciesConstructor(value)
+{
+    "use strict";
+    let constructor = value.constructor;
+    if (constructor === @undefined)
+        return @typedArrayGetOriginalConstructor(value);
+
+    if (!@isObject(constructor))
+        @throwTypeError("|this|.constructor is not an Object or undefined");
+
+    constructor = constructor.@speciesSymbol;
+    if (constructor == null)
+        return @typedArrayGetOriginalConstructor(value);
+    // The lack of an @isConstructor(constructor) check here is not observable because
+    // the first thing we will do with the value is attempt to construct the result with it.
+    // If any user of this function does not immediately construct the result they need to
+    // verify that the result is a constructor.
+    return constructor;
+}
+
+@globalPrivate
+function typedArrayClampArgumentToStartOrEnd(value, length, undefinedValue)
+{
+    "use strict";
+
+    if (value === @undefined)
+        return undefinedValue;
+
+    let int = @toInteger(value);
+    if (int < 0) {
+        int += length;
+        return int < 0 ? 0 : int;
+    }
+    return int > length ? length : int;
+}
+
+function values()
+{
+    "use strict";
+    @typedArrayLength(this);
+    return new @createArrayIterator(this, "value", @arrayIteratorValueNext);
+}
+
+function keys()
+{
+    "use strict";
+    @typedArrayLength(this);
+    return new @createArrayIterator(this, "key", @arrayIteratorKeyNext);
+}
+
+function entries()
+{
+    "use strict";
+    @typedArrayLength(this);
+    return new @createArrayIterator(this, "key+value", @arrayIteratorKeyValueNext);
+}
+
+function every(callback /*, thisArg */)
+{
+    "use strict";
+    var length = @typedArrayLength(this);
+    var thisArg = @argument(1);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.every callback must be a function");
+
+    for (var i = 0; i < length; i++) {
+        if (!callback.@call(thisArg, this[i], i, this))
+            return false;
+    }
+
+    return true;
+}
+
+function fill(value /* [, start [, end]] */)
+{
+    "use strict";
+
+    let length = @typedArrayLength(this);
+
+    let start = @argument(1);
+    let end = @argument(2);
+
+    start = @typedArrayClampArgumentToStartOrEnd(start, length, 0);
+    end = @typedArrayClampArgumentToStartOrEnd(end, length, length);
+
+    for (let i = start; i < end; i++)
+        this[i] = value;
+    return this;
+}
+
+function find(callback /* [, thisArg] */)
+{
+    "use strict";
+    var length = @typedArrayLength(this);
+    var thisArg = @argument(1);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.find callback must be a function");
+
+    for (var i = 0; i < length; i++) {
+        let elem = this[i];
+        if (callback.@call(thisArg, elem, i, this))
+            return elem;
+    }
+    return @undefined;
+}
+
+function findIndex(callback /* [, thisArg] */)
+{
+    "use strict";
+    var length = @typedArrayLength(this);
+    var thisArg = @argument(1);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.findIndex callback must be a function");
+
+    for (var i = 0; i < length; i++) {
+        if (callback.@call(thisArg, this[i], i, this))
+            return i;
+    }
+    return -1;
+}
+
+function forEach(callback /* [, thisArg] */)
+{
+    "use strict";
+    var length = @typedArrayLength(this);
+    var thisArg = @argument(1);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.forEach callback must be a function");
+
+    for (var i = 0; i < length; i++)
+        callback.@call(thisArg, this[i], i, this);
+}
+
+function some(callback /* [, thisArg] */)
+{
+    // 22.2.3.24
+    "use strict";
+    var length = @typedArrayLength(this);
+    var thisArg = @argument(1);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.some callback must be a function");
+
+    for (var i = 0; i < length; i++) {
+        if (callback.@call(thisArg, this[i], i, this))
+            return true;
+    }
+
+    return false;
+}
+
+function sort(comparator)
+{
+    // 22.2.3.25
+    "use strict";
+
+    function min(a, b)
+    {
+        return a < b ? a : b;
+    }
+
+    function merge(dst, src, srcIndex, srcEnd, width, comparator)
+    {
+        var left = srcIndex;
+        var leftEnd = min(left + width, srcEnd);
+        var right = leftEnd;
+        var rightEnd = min(right + width, srcEnd);
+
+        for (var dstIndex = left; dstIndex < rightEnd; ++dstIndex) {
+            if (right < rightEnd) {
+                if (left >= leftEnd || comparator(src[right], src[left]) < 0) {
+                    dst[dstIndex] = src[right++];
+                    continue;
+                }
+            }
+
+            dst[dstIndex] = src[left++];
+        }
+    }
+
+    function mergeSort(array, valueCount, comparator)
+    {
+        var buffer = [ ];
+        buffer.length = valueCount;
+
+        var dst = buffer;
+        var src = array;
+
+        for (var width = 1; width < valueCount; width *= 2) {
+            for (var srcIndex = 0; srcIndex < valueCount; srcIndex += 2 * width)
+                merge(dst, src, srcIndex, valueCount, width, comparator);
+
+            var tmp = src;
+            src = dst;
+            dst = tmp;
+        }
+
+        if (src != array) {
+            for(var i = 0; i < valueCount; i++)
+                array[i] = src[i];
+        }
+    }
+
+    var length = @typedArrayLength(this);
+
+    if (length < 2)
+        return;
+
+    if (typeof comparator == "function")
+        mergeSort(this, length, comparator);
+    else
+        @typedArraySort(this);
+    
+    return this;
+}
+
+function subarray(begin, end)
+{
+    "use strict";
+
+    if (!@isTypedArrayView(this))
+        @throwTypeError("|this| should be a typed array view");
+
+    let start = @toInteger(begin);
+    let finish;
+    if (end !== @undefined)
+        finish = @toInteger(end);
+
+    let constructor = @typedArraySpeciesConstructor(this);
+
+    return @typedArraySubarrayCreate.@call(this, start, finish, constructor);
+}
+
+function reduce(callback /* [, initialValue] */)
+{
+    // 22.2.3.19
+    "use strict";
+
+    var length = @typedArrayLength(this);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.reduce callback must be a function");
+
+    var argumentCount = @argumentCount();
+    if (length === 0 && argumentCount < 2)
+        @throwTypeError("TypedArray.prototype.reduce of empty array with no initial value");
+
+    var accumulator, k = 0;
+    if (argumentCount > 1)
+        accumulator = @argument(1);
+    else
+        accumulator = this[k++];
+
+    for (; k < length; k++)
+        accumulator = callback.@call(@undefined, accumulator, this[k], k, this);
+
+    return accumulator;
+}
+
+function reduceRight(callback /* [, initialValue] */)
+{
+    // 22.2.3.20
+    "use strict";
+
+    var length = @typedArrayLength(this);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.reduceRight callback must be a function");
+
+    var argumentCount = @argumentCount();
+    if (length === 0 && argumentCount < 2)
+        @throwTypeError("TypedArray.prototype.reduceRight of empty array with no initial value");
+
+    var accumulator, k = length - 1;
+    if (argumentCount > 1)
+        accumulator = @argument(1);
+    else
+        accumulator = this[k--];
+
+    for (; k >= 0; k--)
+        accumulator = callback.@call(@undefined, accumulator, this[k], k, this);
+
+    return accumulator;
+}
+
+function map(callback /*, thisArg */)
+{
+    // 22.2.3.18
+    "use strict";
+
+    var length = @typedArrayLength(this);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.map callback must be a function");
+
+    var thisArg = @argument(1);
+
+    // Do species construction
+    var constructor = this.constructor;
+    var result;
+    if (constructor === @undefined)
+        result = new (@typedArrayGetOriginalConstructor(this))(length);
+    else {
+        var speciesConstructor = @Object(constructor).@speciesSymbol;
+        if (speciesConstructor === null || speciesConstructor === @undefined)
+            result = new (@typedArrayGetOriginalConstructor(this))(length);
+        else {
+            result = new speciesConstructor(length);
+            // typedArrayLength throws if it doesn't get a view.
+            @typedArrayLength(result);
+        }
+    }
+
+    for (var i = 0; i < length; i++) {
+        var mappedValue = callback.@call(thisArg, this[i], i, this);
+        result[i] = mappedValue;
+    }
+    return result;
+}
+
+function filter(callback /*, thisArg */)
+{
+    "use strict";
+
+    var length = @typedArrayLength(this);
+
+    if (typeof callback !== "function")
+        @throwTypeError("TypedArray.prototype.filter callback must be a function");
+
+    var thisArg = @argument(1);
+    var kept = [];
+
+    for (var i = 0; i < length; i++) {
+        var value = this[i];
+        if (callback.@call(thisArg, value, i, this))
+            kept.@push(value);
+    }
+
+    var constructor = this.constructor;
+    var result;
+    var resultLength = kept.length;
+    if (constructor === @undefined)
+        result = new (@typedArrayGetOriginalConstructor(this))(resultLength);
+    else {
+        var speciesConstructor = @Object(constructor).@speciesSymbol;
+        if (speciesConstructor === null || speciesConstructor === @undefined)
+            result = new (@typedArrayGetOriginalConstructor(this))(resultLength);
+        else {
+            result = new speciesConstructor(resultLength);
+            // typedArrayLength throws if it doesn't get a view.
+            @typedArrayLength(result);
+        }
+    }
+
+    for (var i = 0; i < kept.length; i++)
+        result[i] = kept[i];
+
+    return result;
+}
+
+function toLocaleString()
+{
+    "use strict";
+
+    var length = @typedArrayLength(this);
+
+    if (length == 0)
+        return "";
+
+    var string = this[0].toLocaleString();
+    for (var i = 1; i < length; i++)
+        string += "," + this[i].toLocaleString();
+
+    return string;
+}
diff --git a/bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp b/bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp
new file mode 100644
index 0000000..2fd7031
--- /dev/null
+++ b/bytecode/AdaptiveInferredPropertyValueWatchpointBase.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AdaptiveInferredPropertyValueWatchpointBase.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+AdaptiveInferredPropertyValueWatchpointBase::AdaptiveInferredPropertyValueWatchpointBase(const ObjectPropertyCondition& key)
+    : m_key(key)
+{
+    RELEASE_ASSERT(key.kind() == PropertyCondition::Equivalence);
+}
+
+void AdaptiveInferredPropertyValueWatchpointBase::install()
+{
+    RELEASE_ASSERT(m_key.isWatchable());
+
+    m_key.object()->structure()->addTransitionWatchpoint(&m_structureWatchpoint);
+
+    PropertyOffset offset = m_key.object()->structure()->getConcurrently(m_key.uid());
+    WatchpointSet* set = m_key.object()->structure()->propertyReplacementWatchpointSet(offset);
+    set->add(&m_propertyWatchpoint);
+}
+
+void AdaptiveInferredPropertyValueWatchpointBase::fire(const FireDetail& detail)
+{
+    // One of the watchpoints fired, but the other one didn't. Make sure that neither of them are
+    // in any set anymore. This simplifies things by allowing us to reinstall the watchpoints
+    // wherever from scratch.
+    if (m_structureWatchpoint.isOnList())
+        m_structureWatchpoint.remove();
+    if (m_propertyWatchpoint.isOnList())
+        m_propertyWatchpoint.remove();
+
+    if (m_key.isWatchable(PropertyCondition::EnsureWatchability)) {
+        install();
+        return;
+    }
+
+    handleFire(detail);
+}
+
+void AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::fireInternal(const FireDetail& detail)
+{
+    ptrdiff_t myOffset = OBJECT_OFFSETOF(AdaptiveInferredPropertyValueWatchpointBase, m_structureWatchpoint);
+
+    AdaptiveInferredPropertyValueWatchpointBase* parent = bitwise_cast<AdaptiveInferredPropertyValueWatchpointBase*>(bitwise_cast<char*>(this) - myOffset);
+
+    parent->fire(detail);
+}
+
+void AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::fireInternal(const FireDetail& detail)
+{
+    ptrdiff_t myOffset = OBJECT_OFFSETOF(AdaptiveInferredPropertyValueWatchpointBase, m_propertyWatchpoint);
+
+    AdaptiveInferredPropertyValueWatchpointBase* parent = bitwise_cast<AdaptiveInferredPropertyValueWatchpointBase*>(bitwise_cast<char*>(this) - myOffset);
+    
+    parent->fire(detail);
+}
+    
+} // namespace JSC
diff --git a/bytecode/AdaptiveInferredPropertyValueWatchpointBase.h b/bytecode/AdaptiveInferredPropertyValueWatchpointBase.h
new file mode 100644
index 0000000..410a93f
--- /dev/null
+++ b/bytecode/AdaptiveInferredPropertyValueWatchpointBase.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ObjectPropertyCondition.h"
+#include "Watchpoint.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class AdaptiveInferredPropertyValueWatchpointBase {
+    WTF_MAKE_NONCOPYABLE(AdaptiveInferredPropertyValueWatchpointBase);
+    WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    AdaptiveInferredPropertyValueWatchpointBase(const ObjectPropertyCondition&);
+
+    const ObjectPropertyCondition& key() const { return m_key; }
+
+    void install();
+
+    virtual ~AdaptiveInferredPropertyValueWatchpointBase() = default;
+
+protected:
+    virtual void handleFire(const FireDetail&) = 0;
+
+private:
+    class StructureWatchpoint : public Watchpoint {
+    public:
+        StructureWatchpoint() { }
+    protected:
+        void fireInternal(const FireDetail&) override;
+    };
+    class PropertyWatchpoint : public Watchpoint {
+    public:
+        PropertyWatchpoint() { }
+    protected:
+        void fireInternal(const FireDetail&) override;
+    };
+
+    void fire(const FireDetail&);
+
+    ObjectPropertyCondition m_key;
+    StructureWatchpoint m_structureWatchpoint;
+    PropertyWatchpoint m_propertyWatchpoint;
+};
+
+} // namespace JSC
diff --git a/bytecode/ArithProfile.cpp b/bytecode/ArithProfile.cpp
new file mode 100644
index 0000000..1fa7c79
--- /dev/null
+++ b/bytecode/ArithProfile.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ArithProfile.h"
+
+#include "CCallHelpers.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+#if ENABLE(JIT)
+void ArithProfile::emitObserveResult(CCallHelpers& jit, JSValueRegs regs, TagRegistersMode mode)
+{
+    if (!shouldEmitSetDouble() && !shouldEmitSetNonNumber())
+        return;
+
+    CCallHelpers::Jump isInt32 = jit.branchIfInt32(regs, mode);
+    CCallHelpers::Jump notDouble = jit.branchIfNotDoubleKnownNotInt32(regs, mode);
+    emitSetDouble(jit);
+    CCallHelpers::Jump done = jit.jump();
+    notDouble.link(&jit);
+    emitSetNonNumber(jit);
+    done.link(&jit);
+    isInt32.link(&jit);
+}
+
+bool ArithProfile::shouldEmitSetDouble() const
+{
+    uint32_t mask = ArithProfile::Int32Overflow | ArithProfile::Int52Overflow | ArithProfile::NegZeroDouble | ArithProfile::NonNegZeroDouble;
+    return (m_bits & mask) != mask;
+}
+
+void ArithProfile::emitSetDouble(CCallHelpers& jit) const
+{
+    if (shouldEmitSetDouble())
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::Int32Overflow | ArithProfile::Int52Overflow | ArithProfile::NegZeroDouble | ArithProfile::NonNegZeroDouble), CCallHelpers::AbsoluteAddress(addressOfBits()));
+}
+
+bool ArithProfile::shouldEmitSetNonNumber() const
+{
+    uint32_t mask = ArithProfile::NonNumber;
+    return (m_bits & mask) != mask;
+}
+
+void ArithProfile::emitSetNonNumber(CCallHelpers& jit) const
+{
+    if (shouldEmitSetNonNumber())
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::NonNumber), CCallHelpers::AbsoluteAddress(addressOfBits()));
+}
+#endif // ENABLE(JIT)
+
+} // namespace JSC
+
+namespace WTF {
+    
+using namespace JSC;
+
+void printInternal(PrintStream& out, const ArithProfile& profile)
+{
+    const char* separator = "";
+
+    out.print("Result:<");
+    if (!profile.didObserveNonInt32()) {
+        out.print("Int32");
+        separator = "|";
+    } else {
+        if (profile.didObserveNegZeroDouble()) {
+            out.print(separator, "NegZeroDouble");
+            separator = "|";
+        }
+        if (profile.didObserveNonNegZeroDouble()) {
+            out.print(separator, "NonNegZeroDouble");
+            separator = "|";
+        }
+        if (profile.didObserveNonNumber()) {
+            out.print(separator, "NonNumber");
+            separator = "|";
+        }
+        if (profile.didObserveInt32Overflow()) {
+            out.print(separator, "Int32Overflow");
+            separator = "|";
+        }
+        if (profile.didObserveInt52Overflow()) {
+            out.print(separator, "Int52Overflow");
+            separator = "|";
+        }
+    }
+    if (profile.tookSpecialFastPath())
+        out.print(separator, "Took special fast path.");
+    out.print(">");
+
+    out.print(" LHS ObservedType:<");
+    out.print(profile.lhsObservedType());
+    out.print("> RHS ObservedType:<");
+    out.print(profile.rhsObservedType());
+    out.print(">");
+
+    out.print(" LHS ResultType:<", RawPointer(bitwise_cast<void*>(static_cast<uintptr_t>(profile.lhsResultType().bits()))));
+    out.print("> RHS ResultType:<", RawPointer(bitwise_cast<void*>(static_cast<uintptr_t>(profile.rhsResultType().bits()))));
+    out.print(">");
+}
+
+void printInternal(PrintStream& out, const JSC::ObservedType& observedType)
+{
+    const char* separator = "";
+    if (observedType.sawInt32()) {
+        out.print(separator, "Int32");
+        separator = "|";
+    }
+    if (observedType.sawNumber()) {
+        out.print(separator, "Number");
+        separator = "|";
+    }
+    if (observedType.sawNonNumber()) {
+        out.print(separator, "NonNumber");
+        separator = "|";
+    }
+}
+
+} // namespace WTF
diff --git a/bytecode/ArithProfile.h b/bytecode/ArithProfile.h
new file mode 100644
index 0000000..40fad1b
--- /dev/null
+++ b/bytecode/ArithProfile.h
@@ -0,0 +1,241 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GPRInfo.h"
+#include "JSCJSValue.h"
+#include "ResultType.h"
+#include "TagRegistersMode.h"
+
+namespace JSC {
+
+class CCallHelpers;
+
+struct ObservedType {
+    ObservedType(uint8_t bits = TypeEmpty)
+        : m_bits(bits)
+    { }
+
+    bool sawInt32() const { return m_bits & TypeInt32; }
+    bool isOnlyInt32() const { return m_bits == TypeInt32; }
+    bool sawNumber() const { return m_bits & TypeNumber; }
+    bool isOnlyNumber() const { return m_bits == TypeNumber; }
+    bool sawNonNumber() const { return m_bits & TypeNonNumber; }
+    bool isOnlyNonNumber() const { return m_bits == TypeNonNumber; }
+    bool isEmpty() const { return !m_bits; }
+    uint8_t bits() const { return m_bits; }
+
+    ObservedType withInt32() const { return ObservedType(m_bits | TypeInt32); }
+    ObservedType withNumber() const { return ObservedType(m_bits | TypeNumber); }
+    ObservedType withNonNumber() const { return ObservedType(m_bits | TypeNonNumber); }
+    ObservedType withoutNonNumber() const { return ObservedType(m_bits & ~TypeNonNumber); }
+
+    bool operator==(const ObservedType& other) const { return m_bits == other.m_bits; }
+
+    static const uint8_t TypeEmpty = 0x0;
+    static const uint8_t TypeInt32 = 0x1;
+    static const uint8_t TypeNumber = 0x02;
+    static const uint8_t TypeNonNumber = 0x04;
+
+    static const uint32_t numBitsNeeded = 3;
+
+private:
+    uint8_t m_bits;
+};
+
+struct ArithProfile {
+private:
+    static const uint32_t numberOfFlagBits = 5;
+    static const uint32_t rhsResultTypeShift = numberOfFlagBits;
+    static const uint32_t lhsResultTypeShift = rhsResultTypeShift + ResultType::numBitsNeeded;
+    static const uint32_t rhsObservedTypeShift = lhsResultTypeShift + ResultType::numBitsNeeded;
+    static const uint32_t lhsObservedTypeShift = rhsObservedTypeShift + ObservedType::numBitsNeeded;
+
+    static_assert(ObservedType::numBitsNeeded == 3, "We make a hard assumption about that here.");
+    static const uint32_t clearRhsObservedTypeBitMask = static_cast<uint32_t>(~((1 << rhsObservedTypeShift) | (1 << (rhsObservedTypeShift + 1)) | (1 << (rhsObservedTypeShift + 2))));
+    static const uint32_t clearLhsObservedTypeBitMask = static_cast<uint32_t>(~((1 << lhsObservedTypeShift) | (1 << (lhsObservedTypeShift + 1)) | (1 << (lhsObservedTypeShift + 2))));
+
+    static const uint32_t resultTypeMask = (1 << ResultType::numBitsNeeded) - 1;
+    static const uint32_t observedTypeMask = (1 << ObservedType::numBitsNeeded) - 1;
+public:
+    static const uint32_t specialFastPathBit = 1 << (lhsObservedTypeShift + ObservedType::numBitsNeeded);
+    static_assert((lhsObservedTypeShift + ObservedType::numBitsNeeded) <= (sizeof(uint32_t) * 8) - 1, "Should fit in a uint32_t.");
+    static_assert(!(specialFastPathBit & ~clearLhsObservedTypeBitMask), "These bits should not intersect.");
+    static_assert(specialFastPathBit & clearLhsObservedTypeBitMask, "These bits should intersect.");
+    static_assert(specialFastPathBit > ~clearLhsObservedTypeBitMask, "These bits should not intersect and specialFastPathBit should be a higher bit.");
+
+    ArithProfile(ResultType arg)
+    {
+        m_bits = (arg.bits() << lhsResultTypeShift);
+        ASSERT(lhsResultType().bits() == arg.bits());
+        ASSERT(lhsObservedType().isEmpty());
+        ASSERT(rhsObservedType().isEmpty());
+    }
+
+    ArithProfile(ResultType lhs, ResultType rhs)
+    {
+        m_bits = (lhs.bits() << lhsResultTypeShift) | (rhs.bits() << rhsResultTypeShift);
+        ASSERT(lhsResultType().bits() == lhs.bits() && rhsResultType().bits() == rhs.bits());
+        ASSERT(lhsObservedType().isEmpty());
+        ASSERT(rhsObservedType().isEmpty());
+    }
+    ArithProfile() = default;
+
+    static ArithProfile fromInt(uint32_t bits)
+    {
+        ArithProfile result;
+        result.m_bits = bits;
+        return result;
+    }
+
+    enum ObservedResults {
+        NonNegZeroDouble = 1 << 0,
+        NegZeroDouble    = 1 << 1,
+        NonNumber        = 1 << 2,
+        Int32Overflow    = 1 << 3,
+        Int52Overflow    = 1 << 4,
+    };
+
+    ResultType lhsResultType() const { return ResultType((m_bits >> lhsResultTypeShift) & resultTypeMask); }
+    ResultType rhsResultType() const { return ResultType((m_bits >> rhsResultTypeShift) & resultTypeMask); }
+
+    ObservedType lhsObservedType() const { return ObservedType((m_bits >> lhsObservedTypeShift) & observedTypeMask); }
+    ObservedType rhsObservedType() const { return ObservedType((m_bits >> rhsObservedTypeShift) & observedTypeMask); }
+    void setLhsObservedType(ObservedType type)
+    {
+        uint32_t bits = m_bits;
+        bits &= clearLhsObservedTypeBitMask;
+        bits |= type.bits() << lhsObservedTypeShift;
+        m_bits = bits;
+        ASSERT(lhsObservedType() == type);
+    }
+
+    void setRhsObservedType(ObservedType type)
+    { 
+        uint32_t bits = m_bits;
+        bits &= clearRhsObservedTypeBitMask;
+        bits |= type.bits() << rhsObservedTypeShift;
+        m_bits = bits;
+        ASSERT(rhsObservedType() == type);
+    }
+
+    bool tookSpecialFastPath() const { return m_bits & specialFastPathBit; }
+
+    bool didObserveNonInt32() const { return hasBits(NonNegZeroDouble | NegZeroDouble | NonNumber); }
+    bool didObserveDouble() const { return hasBits(NonNegZeroDouble | NegZeroDouble); }
+    bool didObserveNonNegZeroDouble() const { return hasBits(NonNegZeroDouble); }
+    bool didObserveNegZeroDouble() const { return hasBits(NegZeroDouble); }
+    bool didObserveNonNumber() const { return hasBits(NonNumber); }
+    bool didObserveInt32Overflow() const { return hasBits(Int32Overflow); }
+    bool didObserveInt52Overflow() const { return hasBits(Int52Overflow); }
+
+    void setObservedNonNegZeroDouble() { setBit(NonNegZeroDouble); }
+    void setObservedNegZeroDouble() { setBit(NegZeroDouble); }
+    void setObservedNonNumber() { setBit(NonNumber); }
+    void setObservedInt32Overflow() { setBit(Int32Overflow); }
+    void setObservedInt52Overflow() { setBit(Int52Overflow); }
+
+    const void* addressOfBits() const { return &m_bits; }
+
+    void observeResult(JSValue value)
+    {
+        if (value.isInt32())
+            return;
+        if (value.isNumber()) {
+            m_bits |= Int32Overflow | Int52Overflow | NonNegZeroDouble | NegZeroDouble;
+            return;
+        }
+        m_bits |= NonNumber;
+    }
+
+    void lhsSawInt32() { setLhsObservedType(lhsObservedType().withInt32()); }
+    void lhsSawNumber() { setLhsObservedType(lhsObservedType().withNumber()); }
+    void lhsSawNonNumber() { setLhsObservedType(lhsObservedType().withNonNumber()); }
+    void rhsSawInt32() { setRhsObservedType(rhsObservedType().withInt32()); }
+    void rhsSawNumber() { setRhsObservedType(rhsObservedType().withNumber()); }
+    void rhsSawNonNumber() { setRhsObservedType(rhsObservedType().withNonNumber()); }
+
+    void observeLHS(JSValue lhs)
+    {
+        ArithProfile newProfile = *this;
+        if (lhs.isNumber()) {
+            if (lhs.isInt32())
+                newProfile.lhsSawInt32();
+            else
+                newProfile.lhsSawNumber();
+        } else
+            newProfile.lhsSawNonNumber();
+
+        m_bits = newProfile.bits();
+    }
+
+    void observeLHSAndRHS(JSValue lhs, JSValue rhs)
+    {
+        observeLHS(lhs);
+
+        ArithProfile newProfile = *this;
+        if (rhs.isNumber()) {
+            if (rhs.isInt32())
+                newProfile.rhsSawInt32();
+            else
+                newProfile.rhsSawNumber();
+        } else
+            newProfile.rhsSawNonNumber();
+
+        m_bits = newProfile.bits();
+    }
+
+#if ENABLE(JIT)    
+    // Sets (Int32Overflow | Int52Overflow | NonNegZeroDouble | NegZeroDouble) if it sees a
+    // double. Sets NonNumber if it sees a non-number.
+    void emitObserveResult(CCallHelpers&, JSValueRegs, TagRegistersMode = HaveTagRegisters);
+    
+    // Sets (Int32Overflow | Int52Overflow | NonNegZeroDouble | NegZeroDouble).
+    bool shouldEmitSetDouble() const;
+    void emitSetDouble(CCallHelpers&) const;
+    
+    // Sets NonNumber.
+    void emitSetNonNumber(CCallHelpers&) const;
+    bool shouldEmitSetNonNumber() const;
+#endif // ENABLE(JIT)
+
+    uint32_t bits() const { return m_bits; }
+
+private:
+    bool hasBits(int mask) const { return m_bits & mask; }
+    void setBit(int mask) { m_bits |= mask; }
+
+    uint32_t m_bits { 0 }; // We take care to update m_bits only in a single operation. We don't ever store an inconsistent bit representation to it.
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, const JSC::ArithProfile&);
+void printInternal(PrintStream&, const JSC::ObservedType&);
+
+} // namespace WTF
diff --git a/bytecode/ArrayAllocationProfile.cpp b/bytecode/ArrayAllocationProfile.cpp
new file mode 100644
index 0000000..905b5bd
--- /dev/null
+++ b/bytecode/ArrayAllocationProfile.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ArrayAllocationProfile.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+void ArrayAllocationProfile::updateIndexingType()
+{
+    // This is awkwardly racy but totally sound even when executed concurrently. The
+    // worst cases go something like this:
+    //
+    // - Two threads race to execute this code; one of them succeeds in updating the
+    //   m_currentIndexingType and the other either updates it again, or sees a null
+    //   m_lastArray; if it updates it again then at worst it will cause the profile
+    //   to "forget" some array. That's still sound, since we don't promise that
+    //   this profile is a reflection of any kind of truth.
+    //
+    // - A concurrent thread reads m_lastArray, but that array is now dead. While
+    //   it's possible for that array to no longer be reachable, it cannot actually
+    //   be freed, since we require the GC to wait until all concurrent JITing
+    //   finishes.
+    
+    JSArray* lastArray = m_lastArray;
+    if (!lastArray)
+        return;
+    m_currentIndexingType = leastUpperBoundOfIndexingTypes(m_currentIndexingType, lastArray->indexingType());
+    m_lastArray = 0;
+}
+
+} // namespace JSC
+
diff --git a/bytecode/ArrayAllocationProfile.h b/bytecode/ArrayAllocationProfile.h
new file mode 100644
index 0000000..cf30de6
--- /dev/null
+++ b/bytecode/ArrayAllocationProfile.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "IndexingType.h"
+#include "JSArray.h"
+
+namespace JSC {
+
+class ArrayAllocationProfile {
+public:
+    ArrayAllocationProfile()
+        : m_currentIndexingType(ArrayWithUndecided)
+        , m_lastArray(0)
+    {
+    }
+    
+    IndexingType selectIndexingType()
+    {
+        JSArray* lastArray = m_lastArray;
+        if (lastArray && UNLIKELY(lastArray->indexingType() != m_currentIndexingType))
+            updateIndexingType();
+        return m_currentIndexingType;
+    }
+    
+    JSArray* updateLastAllocation(JSArray* lastArray)
+    {
+        m_lastArray = lastArray;
+        return lastArray;
+    }
+    
+    JS_EXPORT_PRIVATE void updateIndexingType();
+    
+    static IndexingType selectIndexingTypeFor(ArrayAllocationProfile* profile)
+    {
+        if (!profile)
+            return ArrayWithUndecided;
+        return profile->selectIndexingType();
+    }
+    
+    static JSArray* updateLastAllocationFor(ArrayAllocationProfile* profile, JSArray* lastArray)
+    {
+        if (profile)
+            profile->updateLastAllocation(lastArray);
+        return lastArray;
+    }
+
+private:
+    
+    IndexingType m_currentIndexingType;
+    JSArray* m_lastArray;
+};
+
+} // namespace JSC
diff --git a/bytecode/ArrayProfile.cpp b/bytecode/ArrayProfile.cpp
new file mode 100644
index 0000000..3146b18
--- /dev/null
+++ b/bytecode/ArrayProfile.cpp
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ArrayProfile.h"
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/StringExtras.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+void dumpArrayModes(PrintStream& out, ArrayModes arrayModes)
+{
+    if (!arrayModes) {
+        out.print("<empty>");
+        return;
+    }
+    
+    if (arrayModes == ALL_ARRAY_MODES) {
+        out.print("TOP");
+        return;
+    }
+    
+    CommaPrinter comma("|");
+    if (arrayModes & asArrayModes(NonArray))
+        out.print(comma, "NonArray");
+    if (arrayModes & asArrayModes(NonArrayWithInt32))
+        out.print(comma, "NonArrayWithInt32");
+    if (arrayModes & asArrayModes(NonArrayWithDouble))
+        out.print(comma, "NonArrayWithDouble");
+    if (arrayModes & asArrayModes(NonArrayWithContiguous))
+        out.print(comma, "NonArrayWithContiguous");
+    if (arrayModes & asArrayModes(NonArrayWithArrayStorage))
+        out.print(comma, "NonArrayWithArrayStorage");
+    if (arrayModes & asArrayModes(NonArrayWithSlowPutArrayStorage))
+        out.print(comma, "NonArrayWithSlowPutArrayStorage");
+    if (arrayModes & asArrayModes(ArrayClass))
+        out.print(comma, "ArrayClass");
+    if (arrayModes & asArrayModes(ArrayWithUndecided))
+        out.print(comma, "ArrayWithUndecided");
+    if (arrayModes & asArrayModes(ArrayWithInt32))
+        out.print(comma, "ArrayWithInt32");
+    if (arrayModes & asArrayModes(ArrayWithDouble))
+        out.print(comma, "ArrayWithDouble");
+    if (arrayModes & asArrayModes(ArrayWithContiguous))
+        out.print(comma, "ArrayWithContiguous");
+    if (arrayModes & asArrayModes(ArrayWithArrayStorage))
+        out.print(comma, "ArrayWithArrayStorage");
+    if (arrayModes & asArrayModes(ArrayWithSlowPutArrayStorage))
+        out.print(comma, "ArrayWithSlowPutArrayStorage");
+
+    if (arrayModes & Int8ArrayMode)
+        out.print(comma, "Int8ArrayMode");
+    if (arrayModes & Int16ArrayMode)
+        out.print(comma, "Int16ArrayMode");
+    if (arrayModes & Int32ArrayMode)
+        out.print(comma, "Int32ArrayMode");
+    if (arrayModes & Uint8ArrayMode)
+        out.print(comma, "Uint8ArrayMode");
+    if (arrayModes & Uint8ClampedArrayMode)
+        out.print(comma, "Uint8ClampedArrayMode");
+    if (arrayModes & Uint16ArrayMode)
+        out.print(comma, "Uint16ArrayMode");
+    if (arrayModes & Uint32ArrayMode)
+        out.print(comma, "Uint32ArrayMode");
+    if (arrayModes & Float32ArrayMode)
+        out.print(comma, "Float32ArrayMode");
+    if (arrayModes & Float64ArrayMode)
+        out.print(comma, "Float64ArrayMode");
+}
+
+void ArrayProfile::computeUpdatedPrediction(const ConcurrentJSLocker& locker, CodeBlock* codeBlock)
+{
+    if (!m_lastSeenStructureID)
+        return;
+    
+    Structure* lastSeenStructure = codeBlock->heap()->structureIDTable().get(m_lastSeenStructureID);
+    computeUpdatedPrediction(locker, codeBlock, lastSeenStructure);
+    m_lastSeenStructureID = 0;
+}
+
+void ArrayProfile::computeUpdatedPrediction(const ConcurrentJSLocker&, CodeBlock* codeBlock, Structure* lastSeenStructure)
+{
+    m_observedArrayModes |= arrayModeFromStructure(lastSeenStructure);
+    
+    if (!m_didPerformFirstRunPruning
+        && hasTwoOrMoreBitsSet(m_observedArrayModes)) {
+        m_observedArrayModes = arrayModeFromStructure(lastSeenStructure);
+        m_didPerformFirstRunPruning = true;
+    }
+    
+    m_mayInterceptIndexedAccesses |=
+        lastSeenStructure->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero();
+    JSGlobalObject* globalObject = codeBlock->globalObject();
+    if (!globalObject->isOriginalArrayStructure(lastSeenStructure)
+        && !globalObject->isOriginalTypedArrayStructure(lastSeenStructure))
+        m_usesOriginalArrayStructures = false;
+}
+
+CString ArrayProfile::briefDescription(const ConcurrentJSLocker& locker, CodeBlock* codeBlock)
+{
+    computeUpdatedPrediction(locker, codeBlock);
+    return briefDescriptionWithoutUpdating(locker);
+}
+
+CString ArrayProfile::briefDescriptionWithoutUpdating(const ConcurrentJSLocker&)
+{
+    StringPrintStream out;
+    
+    bool hasPrinted = false;
+    
+    if (m_observedArrayModes) {
+        if (hasPrinted)
+            out.print(", ");
+        out.print(ArrayModesDump(m_observedArrayModes));
+        hasPrinted = true;
+    }
+    
+    if (m_mayStoreToHole) {
+        if (hasPrinted)
+            out.print(", ");
+        out.print("Hole");
+        hasPrinted = true;
+    }
+    
+    if (m_outOfBounds) {
+        if (hasPrinted)
+            out.print(", ");
+        out.print("OutOfBounds");
+        hasPrinted = true;
+    }
+    
+    if (m_mayInterceptIndexedAccesses) {
+        if (hasPrinted)
+            out.print(", ");
+        out.print("Intercept");
+        hasPrinted = true;
+    }
+    
+    if (m_usesOriginalArrayStructures) {
+        if (hasPrinted)
+            out.print(", ");
+        out.print("Original");
+        hasPrinted = true;
+    }
+    
+    UNUSED_PARAM(hasPrinted);
+    
+    return out.toCString();
+}
+
+} // namespace JSC
+
diff --git a/bytecode/ArrayProfile.h b/bytecode/ArrayProfile.h
new file mode 100644
index 0000000..279906d
--- /dev/null
+++ b/bytecode/ArrayProfile.h
@@ -0,0 +1,250 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "JSArray.h"
+#include "Structure.h"
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+class CodeBlock;
+class LLIntOffsetsExtractor;
+
+// This is a bitfield where each bit represents an type of array access that we have seen.
+// There are 16 indexing types that use the lower bits.
+// There are 9 typed array types taking the bits 16 to 25.
+typedef unsigned ArrayModes;
+
+const ArrayModes Int8ArrayMode = 1 << 16;
+const ArrayModes Int16ArrayMode = 1 << 17;
+const ArrayModes Int32ArrayMode = 1 << 18;
+const ArrayModes Uint8ArrayMode = 1 << 19;
+const ArrayModes Uint8ClampedArrayMode = 1 << 20;
+const ArrayModes Uint16ArrayMode = 1 << 21;
+const ArrayModes Uint32ArrayMode = 1 << 22;
+const ArrayModes Float32ArrayMode = 1 << 23;
+const ArrayModes Float64ArrayMode = 1 << 24;
+
+#define asArrayModes(type) \
+    (static_cast<unsigned>(1) << static_cast<unsigned>(type))
+
+#define ALL_TYPED_ARRAY_MODES \
+    (Int8ArrayMode            \
+    | Int16ArrayMode          \
+    | Int32ArrayMode          \
+    | Uint8ArrayMode          \
+    | Uint8ClampedArrayMode   \
+    | Uint16ArrayMode         \
+    | Uint32ArrayMode         \
+    | Float32ArrayMode        \
+    | Float64ArrayMode        \
+    )
+
+#define ALL_NON_ARRAY_ARRAY_MODES                       \
+    (asArrayModes(NonArray)                             \
+    | asArrayModes(NonArrayWithInt32)                   \
+    | asArrayModes(NonArrayWithDouble)                  \
+    | asArrayModes(NonArrayWithContiguous)              \
+    | asArrayModes(NonArrayWithArrayStorage)            \
+    | asArrayModes(NonArrayWithSlowPutArrayStorage)     \
+    | ALL_TYPED_ARRAY_MODES)
+
+#define ALL_ARRAY_ARRAY_MODES                           \
+    (asArrayModes(ArrayClass)                           \
+    | asArrayModes(ArrayWithUndecided)                  \
+    | asArrayModes(ArrayWithInt32)                      \
+    | asArrayModes(ArrayWithDouble)                     \
+    | asArrayModes(ArrayWithContiguous)                 \
+    | asArrayModes(ArrayWithArrayStorage)               \
+    | asArrayModes(ArrayWithSlowPutArrayStorage))
+
+#define ALL_ARRAY_MODES (ALL_NON_ARRAY_ARRAY_MODES | ALL_ARRAY_ARRAY_MODES)
+
+inline ArrayModes arrayModeFromStructure(Structure* structure)
+{
+    switch (structure->classInfo()->typedArrayStorageType) {
+    case TypeInt8:
+        return Int8ArrayMode;
+    case TypeUint8:
+        return Uint8ArrayMode;
+    case TypeUint8Clamped:
+        return Uint8ClampedArrayMode;
+    case TypeInt16:
+        return Int16ArrayMode;
+    case TypeUint16:
+        return Uint16ArrayMode;
+    case TypeInt32:
+        return Int32ArrayMode;
+    case TypeUint32:
+        return Uint32ArrayMode;
+    case TypeFloat32:
+        return Float32ArrayMode;
+    case TypeFloat64:
+        return Float64ArrayMode;
+    case TypeDataView:
+    case NotTypedArray:
+        break;
+    }
+    return asArrayModes(structure->indexingType());
+}
+
+void dumpArrayModes(PrintStream&, ArrayModes);
+MAKE_PRINT_ADAPTOR(ArrayModesDump, ArrayModes, dumpArrayModes);
+
+inline bool mergeArrayModes(ArrayModes& left, ArrayModes right)
+{
+    ArrayModes newModes = left | right;
+    if (newModes == left)
+        return false;
+    left = newModes;
+    return true;
+}
+
+inline bool arrayModesAreClearOrTop(ArrayModes modes)
+{
+    return !modes || modes == ALL_ARRAY_MODES;
+}
+
+// Checks if proven is a subset of expected.
+inline bool arrayModesAlreadyChecked(ArrayModes proven, ArrayModes expected)
+{
+    return (expected | proven) == expected;
+}
+
+inline bool arrayModesInclude(ArrayModes arrayModes, IndexingType shape)
+{
+    return !!(arrayModes & (asArrayModes(NonArray | shape) | asArrayModes(ArrayClass | shape)));
+}
+
+inline bool shouldUseSlowPutArrayStorage(ArrayModes arrayModes)
+{
+    return arrayModesInclude(arrayModes, SlowPutArrayStorageShape);
+}
+
+inline bool shouldUseFastArrayStorage(ArrayModes arrayModes)
+{
+    return arrayModesInclude(arrayModes, ArrayStorageShape);
+}
+
+inline bool shouldUseContiguous(ArrayModes arrayModes)
+{
+    return arrayModesInclude(arrayModes, ContiguousShape);
+}
+
+inline bool shouldUseDouble(ArrayModes arrayModes)
+{
+    return arrayModesInclude(arrayModes, DoubleShape);
+}
+
+inline bool shouldUseInt32(ArrayModes arrayModes)
+{
+    return arrayModesInclude(arrayModes, Int32Shape);
+}
+
+inline bool hasSeenArray(ArrayModes arrayModes)
+{
+    return arrayModes & ALL_ARRAY_ARRAY_MODES;
+}
+
+inline bool hasSeenNonArray(ArrayModes arrayModes)
+{
+    return arrayModes & ALL_NON_ARRAY_ARRAY_MODES;
+}
+
+class ArrayProfile {
+public:
+    ArrayProfile()
+        : m_bytecodeOffset(std::numeric_limits<unsigned>::max())
+        , m_lastSeenStructureID(0)
+        , m_mayStoreToHole(false)
+        , m_outOfBounds(false)
+        , m_mayInterceptIndexedAccesses(false)
+        , m_usesOriginalArrayStructures(true)
+        , m_didPerformFirstRunPruning(false)
+        , m_observedArrayModes(0)
+    {
+    }
+    
+    ArrayProfile(unsigned bytecodeOffset)
+        : m_bytecodeOffset(bytecodeOffset)
+        , m_lastSeenStructureID(0)
+        , m_mayStoreToHole(false)
+        , m_outOfBounds(false)
+        , m_mayInterceptIndexedAccesses(false)
+        , m_usesOriginalArrayStructures(true)
+        , m_didPerformFirstRunPruning(false)
+        , m_observedArrayModes(0)
+    {
+    }
+    
+    unsigned bytecodeOffset() const { return m_bytecodeOffset; }
+    
+    StructureID* addressOfLastSeenStructureID() { return &m_lastSeenStructureID; }
+    ArrayModes* addressOfArrayModes() { return &m_observedArrayModes; }
+    bool* addressOfMayStoreToHole() { return &m_mayStoreToHole; }
+
+    void setOutOfBounds() { m_outOfBounds = true; }
+    bool* addressOfOutOfBounds() { return &m_outOfBounds; }
+    
+    void observeStructure(Structure* structure)
+    {
+        m_lastSeenStructureID = structure->id();
+    }
+    
+    void computeUpdatedPrediction(const ConcurrentJSLocker&, CodeBlock*);
+    void computeUpdatedPrediction(const ConcurrentJSLocker&, CodeBlock*, Structure* lastSeenStructure);
+    
+    ArrayModes observedArrayModes(const ConcurrentJSLocker&) const { return m_observedArrayModes; }
+    bool mayInterceptIndexedAccesses(const ConcurrentJSLocker&) const { return m_mayInterceptIndexedAccesses; }
+    
+    bool mayStoreToHole(const ConcurrentJSLocker&) const { return m_mayStoreToHole; }
+    bool outOfBounds(const ConcurrentJSLocker&) const { return m_outOfBounds; }
+    
+    bool usesOriginalArrayStructures(const ConcurrentJSLocker&) const { return m_usesOriginalArrayStructures; }
+    
+    CString briefDescription(const ConcurrentJSLocker&, CodeBlock*);
+    CString briefDescriptionWithoutUpdating(const ConcurrentJSLocker&);
+    
+private:
+    friend class LLIntOffsetsExtractor;
+    
+    static Structure* polymorphicStructure() { return static_cast<Structure*>(reinterpret_cast<void*>(1)); }
+    
+    unsigned m_bytecodeOffset;
+    StructureID m_lastSeenStructureID;
+    bool m_mayStoreToHole; // This flag may become overloaded to indicate other special cases that were encountered during array access, as it depends on indexing type. Since we currently have basically just one indexing type (two variants of ArrayStorage), this flag for now just means exactly what its name implies.
+    bool m_outOfBounds;
+    bool m_mayInterceptIndexedAccesses : 1;
+    bool m_usesOriginalArrayStructures : 1;
+    bool m_didPerformFirstRunPruning : 1;
+    ArrayModes m_observedArrayModes;
+};
+
+typedef SegmentedVector<ArrayProfile, 4> ArrayProfileVector;
+
+} // namespace JSC
diff --git a/bytecode/ByValInfo.h b/bytecode/ByValInfo.h
new file mode 100644
index 0000000..e5fa708
--- /dev/null
+++ b/bytecode/ByValInfo.h
@@ -0,0 +1,257 @@
+/*
+ * Copyright (C) 2012, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ClassInfo.h"
+#include "CodeLocation.h"
+#include "CodeOrigin.h"
+#include "IndexingType.h"
+#include "JITStubRoutine.h"
+#include "Structure.h"
+
+namespace JSC {
+
+class Symbol;
+
+#if ENABLE(JIT)
+
+class StructureStubInfo;
+
+enum JITArrayMode {
+    JITInt32,
+    JITDouble,
+    JITContiguous,
+    JITArrayStorage,
+    JITDirectArguments,
+    JITScopedArguments,
+    JITInt8Array,
+    JITInt16Array,
+    JITInt32Array,
+    JITUint8Array,
+    JITUint8ClampedArray,
+    JITUint16Array,
+    JITUint32Array,
+    JITFloat32Array,
+    JITFloat64Array
+};
+
+inline bool isOptimizableIndexingType(IndexingType indexingType)
+{
+    switch (indexingType) {
+    case ALL_INT32_INDEXING_TYPES:
+    case ALL_DOUBLE_INDEXING_TYPES:
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+    case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool hasOptimizableIndexingForJSType(JSType type)
+{
+    switch (type) {
+    case DirectArgumentsType:
+    case ScopedArgumentsType:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool hasOptimizableIndexingForClassInfo(const ClassInfo* classInfo)
+{
+    return isTypedView(classInfo->typedArrayStorageType);
+}
+
+inline bool hasOptimizableIndexing(Structure* structure)
+{
+    return isOptimizableIndexingType(structure->indexingType())
+        || hasOptimizableIndexingForJSType(structure->typeInfo().type())
+        || hasOptimizableIndexingForClassInfo(structure->classInfo());
+}
+
+inline JITArrayMode jitArrayModeForIndexingType(IndexingType indexingType)
+{
+    switch (indexingType) {
+    case ALL_INT32_INDEXING_TYPES:
+        return JITInt32;
+    case ALL_DOUBLE_INDEXING_TYPES:
+        return JITDouble;
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        return JITContiguous;
+    case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES:
+        return JITArrayStorage;
+    default:
+        CRASH();
+        return JITContiguous;
+    }
+}
+
+inline JITArrayMode jitArrayModeForJSType(JSType type)
+{
+    switch (type) {
+    case DirectArgumentsType:
+        return JITDirectArguments;
+    case ScopedArgumentsType:
+        return JITScopedArguments;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return JITContiguous;
+    }
+}
+
+inline JITArrayMode jitArrayModeForClassInfo(const ClassInfo* classInfo)
+{
+    switch (classInfo->typedArrayStorageType) {
+    case TypeInt8:
+        return JITInt8Array;
+    case TypeInt16:
+        return JITInt16Array;
+    case TypeInt32:
+        return JITInt32Array;
+    case TypeUint8:
+        return JITUint8Array;
+    case TypeUint8Clamped:
+        return JITUint8ClampedArray;
+    case TypeUint16:
+        return JITUint16Array;
+    case TypeUint32:
+        return JITUint32Array;
+    case TypeFloat32:
+        return JITFloat32Array;
+    case TypeFloat64:
+        return JITFloat64Array;
+    default:
+        CRASH();
+        return JITContiguous;
+    }
+}
+
+inline bool jitArrayModePermitsPut(JITArrayMode mode)
+{
+    switch (mode) {
+    case JITDirectArguments:
+    case JITScopedArguments:
+        // We could support put_by_val on these at some point, but it's just not that profitable
+        // at the moment.
+        return false;
+    default:
+        return true;
+    }
+}
+
+inline TypedArrayType typedArrayTypeForJITArrayMode(JITArrayMode mode)
+{
+    switch (mode) {
+    case JITInt8Array:
+        return TypeInt8;
+    case JITInt16Array:
+        return TypeInt16;
+    case JITInt32Array:
+        return TypeInt32;
+    case JITUint8Array:
+        return TypeUint8;
+    case JITUint8ClampedArray:
+        return TypeUint8Clamped;
+    case JITUint16Array:
+        return TypeUint16;
+    case JITUint32Array:
+        return TypeUint32;
+    case JITFloat32Array:
+        return TypeFloat32;
+    case JITFloat64Array:
+        return TypeFloat64;
+    default:
+        CRASH();
+        return NotTypedArray;
+    }
+}
+
+inline JITArrayMode jitArrayModeForStructure(Structure* structure)
+{
+    if (isOptimizableIndexingType(structure->indexingType()))
+        return jitArrayModeForIndexingType(structure->indexingType());
+    
+    if (hasOptimizableIndexingForJSType(structure->typeInfo().type()))
+        return jitArrayModeForJSType(structure->typeInfo().type());
+    
+    ASSERT(hasOptimizableIndexingForClassInfo(structure->classInfo()));
+    return jitArrayModeForClassInfo(structure->classInfo());
+}
+
+struct ByValInfo {
+    ByValInfo() { }
+
+    ByValInfo(unsigned bytecodeIndex, CodeLocationJump notIndexJump, CodeLocationJump badTypeJump, CodeLocationLabel exceptionHandler, JITArrayMode arrayMode, ArrayProfile* arrayProfile, int16_t badTypeJumpToDone, int16_t badTypeJumpToNextHotPath, int16_t returnAddressToSlowPath)
+        : bytecodeIndex(bytecodeIndex)
+        , notIndexJump(notIndexJump)
+        , badTypeJump(badTypeJump)
+        , exceptionHandler(exceptionHandler)
+        , arrayMode(arrayMode)
+        , arrayProfile(arrayProfile)
+        , badTypeJumpToDone(badTypeJumpToDone)
+        , badTypeJumpToNextHotPath(badTypeJumpToNextHotPath)
+        , returnAddressToSlowPath(returnAddressToSlowPath)
+        , slowPathCount(0)
+        , stubInfo(nullptr)
+        , tookSlowPath(false)
+        , seen(false)
+    {
+    }
+
+    unsigned bytecodeIndex;
+    CodeLocationJump notIndexJump;
+    CodeLocationJump badTypeJump;
+    CodeLocationLabel exceptionHandler;
+    JITArrayMode arrayMode; // The array mode that was baked into the inline JIT code.
+    ArrayProfile* arrayProfile;
+    int16_t badTypeJumpToDone;
+    int16_t badTypeJumpToNextHotPath;
+    int16_t returnAddressToSlowPath;
+    unsigned slowPathCount;
+    RefPtr<JITStubRoutine> stubRoutine;
+    Identifier cachedId;
+    WriteBarrier<Symbol> cachedSymbol;
+    StructureStubInfo* stubInfo;
+    bool tookSlowPath : 1;
+    bool seen : 1;
+};
+
+inline unsigned getByValInfoBytecodeIndex(ByValInfo* info)
+{
+    return info->bytecodeIndex;
+}
+
+typedef HashMap<CodeOrigin, ByValInfo*, CodeOriginApproximateHash> ByValInfoMap;
+
+#else // ENABLE(JIT)
+
+typedef HashMap<int, void*> ByValInfoMap;
+
+#endif // ENABLE(JIT)
+
+} // namespace JSC
diff --git a/bytecode/BytecodeBasicBlock.cpp b/bytecode/BytecodeBasicBlock.cpp
new file mode 100644
index 0000000..47c481d
--- /dev/null
+++ b/bytecode/BytecodeBasicBlock.cpp
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BytecodeBasicBlock.h"
+
+#include "CodeBlock.h"
+#include "InterpreterInlines.h"
+#include "JSCInlines.h"
+#include "PreciseJumpTargets.h"
+
+namespace JSC {
+
+void BytecodeBasicBlock::shrinkToFit()
+{
+    m_offsets.shrinkToFit();
+    m_successors.shrinkToFit();
+}
+
+static bool isJumpTarget(OpcodeID opcodeID, const Vector<unsigned, 32>& jumpTargets, unsigned bytecodeOffset)
+{
+    if (opcodeID == op_catch)
+        return true;
+
+    return std::binary_search(jumpTargets.begin(), jumpTargets.end(), bytecodeOffset);
+}
+
+template<typename Block, typename Instruction>
+void BytecodeBasicBlock::computeImpl(Block* codeBlock, Instruction* instructionsBegin, unsigned instructionCount, Vector<std::unique_ptr<BytecodeBasicBlock>>& basicBlocks)
+{
+    Vector<unsigned, 32> jumpTargets;
+    computePreciseJumpTargets(codeBlock, instructionsBegin, instructionCount, jumpTargets);
+
+    auto appendBlock = [&] (std::unique_ptr<BytecodeBasicBlock>&& block) {
+        block->m_index = basicBlocks.size();
+        basicBlocks.append(WTFMove(block));
+    };
+
+    auto linkBlocks = [&] (BytecodeBasicBlock* from, BytecodeBasicBlock* to) {
+        from->addSuccessor(to);
+    };
+
+    // Create the entry and exit basic blocks.
+    basicBlocks.reserveCapacity(jumpTargets.size() + 2);
+
+    auto entry = std::make_unique<BytecodeBasicBlock>(BytecodeBasicBlock::EntryBlock);
+    auto firstBlock = std::make_unique<BytecodeBasicBlock>(0, 0);
+    linkBlocks(entry.get(), firstBlock.get());
+
+    appendBlock(WTFMove(entry));
+    BytecodeBasicBlock* current = firstBlock.get();
+    appendBlock(WTFMove(firstBlock));
+
+    auto exit = std::make_unique<BytecodeBasicBlock>(BytecodeBasicBlock::ExitBlock);
+
+    bool nextInstructionIsLeader = false;
+
+    Interpreter* interpreter = codeBlock->vm()->interpreter;
+    for (unsigned bytecodeOffset = 0; bytecodeOffset < instructionCount;) {
+        OpcodeID opcodeID = interpreter->getOpcodeID(instructionsBegin[bytecodeOffset]);
+        unsigned opcodeLength = opcodeLengths[opcodeID];
+
+        bool createdBlock = false;
+        // If the current bytecode is a jump target, then it's the leader of its own basic block.
+        if (isJumpTarget(opcodeID, jumpTargets, bytecodeOffset) || nextInstructionIsLeader) {
+            auto newBlock = std::make_unique<BytecodeBasicBlock>(bytecodeOffset, opcodeLength);
+            current = newBlock.get();
+            appendBlock(WTFMove(newBlock));
+            createdBlock = true;
+            nextInstructionIsLeader = false;
+            bytecodeOffset += opcodeLength;
+        }
+
+        // If the current bytecode is a branch or a return, then the next instruction is the leader of its own basic block.
+        if (isBranch(opcodeID) || isTerminal(opcodeID) || isThrow(opcodeID))
+            nextInstructionIsLeader = true;
+
+        if (createdBlock)
+            continue;
+
+        // Otherwise, just add to the length of the current block.
+        current->addLength(opcodeLength);
+        bytecodeOffset += opcodeLength;
+    }
+
+    // Link basic blocks together.
+    for (unsigned i = 0; i < basicBlocks.size(); i++) {
+        BytecodeBasicBlock* block = basicBlocks[i].get();
+
+        if (block->isEntryBlock() || block->isExitBlock())
+            continue;
+
+        bool fallsThrough = true; 
+        for (unsigned bytecodeOffset = block->leaderOffset(); bytecodeOffset < block->leaderOffset() + block->totalLength();) {
+            OpcodeID opcodeID = interpreter->getOpcodeID(instructionsBegin[bytecodeOffset]);
+            unsigned opcodeLength = opcodeLengths[opcodeID];
+            // If we found a terminal bytecode, link to the exit block.
+            if (isTerminal(opcodeID)) {
+                ASSERT(bytecodeOffset + opcodeLength == block->leaderOffset() + block->totalLength());
+                linkBlocks(block, exit.get());
+                fallsThrough = false;
+                break;
+            }
+
+            // If we found a throw, get the HandlerInfo for this instruction to see where we will jump. 
+            // If there isn't one, treat this throw as a terminal. This is true even if we have a finally
+            // block because the finally block will create its own catch, which will generate a HandlerInfo.
+            if (isThrow(opcodeID)) {
+                ASSERT(bytecodeOffset + opcodeLength == block->leaderOffset() + block->totalLength());
+                auto* handler = codeBlock->handlerForBytecodeOffset(bytecodeOffset);
+                fallsThrough = false;
+                if (!handler) {
+                    linkBlocks(block, exit.get());
+                    break;
+                }
+                for (unsigned i = 0; i < basicBlocks.size(); i++) {
+                    BytecodeBasicBlock* otherBlock = basicBlocks[i].get();
+                    if (handler->target == otherBlock->leaderOffset()) {
+                        linkBlocks(block, otherBlock);
+                        break;
+                    }
+                }
+                break;
+            }
+
+            // If we found a branch, link to the block(s) that we jump to.
+            if (isBranch(opcodeID)) {
+                ASSERT(bytecodeOffset + opcodeLength == block->leaderOffset() + block->totalLength());
+                Vector<unsigned, 1> bytecodeOffsetsJumpedTo;
+                findJumpTargetsForBytecodeOffset(codeBlock, instructionsBegin, bytecodeOffset, bytecodeOffsetsJumpedTo);
+
+                size_t numberOfJumpTargets = bytecodeOffsetsJumpedTo.size();
+                ASSERT(numberOfJumpTargets);
+                for (unsigned i = 0; i < basicBlocks.size(); i++) {
+                    BytecodeBasicBlock* otherBlock = basicBlocks[i].get();
+                    if (bytecodeOffsetsJumpedTo.contains(otherBlock->leaderOffset())) {
+                        linkBlocks(block, otherBlock);
+                        --numberOfJumpTargets;
+                        if (!numberOfJumpTargets)
+                            break;
+                    }
+                }
+                // numberOfJumpTargets may not be 0 here if there are multiple jumps targeting the same
+                // basic blocks (e.g. in a switch type opcode). Since we only decrement numberOfJumpTargets
+                // once per basic block, the duplicates are not accounted for. For our purpose here,
+                // that doesn't matter because we only need to link to the target block once regardless
+                // of how many ways this block can jump there.
+
+                if (isUnconditionalBranch(opcodeID))
+                    fallsThrough = false;
+
+                break;
+            }
+            bytecodeOffset += opcodeLength;
+        }
+
+        // If we fall through then link to the next block in program order.
+        if (fallsThrough) {
+            ASSERT(i + 1 < basicBlocks.size());
+            BytecodeBasicBlock* nextBlock = basicBlocks[i + 1].get();
+            linkBlocks(block, nextBlock);
+        }
+    }
+
+    appendBlock(WTFMove(exit));
+    
+    for (auto& basicBlock : basicBlocks)
+        basicBlock->shrinkToFit();
+}
+
+void BytecodeBasicBlock::compute(CodeBlock* codeBlock, Instruction* instructionsBegin, unsigned instructionCount, Vector<std::unique_ptr<BytecodeBasicBlock>>& basicBlocks)
+{
+    computeImpl(codeBlock, instructionsBegin, instructionCount, basicBlocks);
+}
+
+void BytecodeBasicBlock::compute(UnlinkedCodeBlock* codeBlock, UnlinkedInstruction* instructionsBegin, unsigned instructionCount, Vector<std::unique_ptr<BytecodeBasicBlock>>& basicBlocks)
+{
+    BytecodeBasicBlock::computeImpl(codeBlock, instructionsBegin, instructionCount, basicBlocks);
+}
+
+} // namespace JSC
diff --git a/bytecode/BytecodeBasicBlock.h b/bytecode/BytecodeBasicBlock.h
new file mode 100644
index 0000000..fb81650
--- /dev/null
+++ b/bytecode/BytecodeBasicBlock.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <limits.h>
+#include <wtf/FastBitVector.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CodeBlock;
+class UnlinkedCodeBlock;
+struct Instruction;
+struct UnlinkedInstruction;
+
+class BytecodeBasicBlock {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    enum SpecialBlockType { EntryBlock, ExitBlock };
+    BytecodeBasicBlock(unsigned start, unsigned length);
+    BytecodeBasicBlock(SpecialBlockType);
+    void shrinkToFit();
+
+    bool isEntryBlock() { return !m_leaderOffset && !m_totalLength; }
+    bool isExitBlock() { return m_leaderOffset == UINT_MAX && m_totalLength == UINT_MAX; }
+
+    unsigned leaderOffset() { return m_leaderOffset; }
+    unsigned totalLength() { return m_totalLength; }
+
+    const Vector<unsigned>& offsets() const { return m_offsets; }
+
+    const Vector<BytecodeBasicBlock*>& successors() const { return m_successors; }
+
+    FastBitVector& in() { return m_in; }
+    FastBitVector& out() { return m_out; }
+
+    unsigned index() const { return m_index; }
+
+    static void compute(CodeBlock*, Instruction* instructionsBegin, unsigned instructionCount, Vector<std::unique_ptr<BytecodeBasicBlock>>&);
+    static void compute(UnlinkedCodeBlock*, UnlinkedInstruction* instructionsBegin, unsigned instructionCount, Vector<std::unique_ptr<BytecodeBasicBlock>>&);
+
+private:
+    template<typename Block, typename Instruction> static void computeImpl(Block* codeBlock, Instruction* instructionsBegin, unsigned instructionCount, Vector<std::unique_ptr<BytecodeBasicBlock>>& basicBlocks);
+
+    void addSuccessor(BytecodeBasicBlock* block) { m_successors.append(block); }
+
+    void addLength(unsigned);
+
+    unsigned m_leaderOffset;
+    unsigned m_totalLength;
+    unsigned m_index;
+
+    Vector<unsigned> m_offsets;
+    Vector<BytecodeBasicBlock*> m_successors;
+
+    FastBitVector m_in;
+    FastBitVector m_out;
+};
+
+inline BytecodeBasicBlock::BytecodeBasicBlock(unsigned start, unsigned length)
+    : m_leaderOffset(start)
+    , m_totalLength(length)
+{
+    m_offsets.append(m_leaderOffset);
+}
+
+inline BytecodeBasicBlock::BytecodeBasicBlock(BytecodeBasicBlock::SpecialBlockType blockType)
+    : m_leaderOffset(blockType == BytecodeBasicBlock::EntryBlock ? 0 : UINT_MAX)
+    , m_totalLength(blockType == BytecodeBasicBlock::EntryBlock ? 0 : UINT_MAX)
+{
+}
+
+inline void BytecodeBasicBlock::addLength(unsigned bytecodeLength)
+{
+    m_offsets.append(m_leaderOffset + m_totalLength);
+    m_totalLength += bytecodeLength;
+}
+
+} // namespace JSC
diff --git a/bytecode/BytecodeConventions.h b/bytecode/BytecodeConventions.h
new file mode 100644
index 0000000..7781378
--- /dev/null
+++ b/bytecode/BytecodeConventions.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+// Register numbers used in bytecode operations have different meaning according to their ranges:
+//      0x80000000-0xFFFFFFFF  Negative indices from the CallFrame pointer are entries in the call frame.
+//      0x00000000-0x3FFFFFFF  Forwards indices from the CallFrame pointer are local vars and temporaries with the function's callframe.
+//      0x40000000-0x7FFFFFFF  Positive indices from 0x40000000 specify entries in the constant pool on the CodeBlock.
+static const int FirstConstantRegisterIndex = 0x40000000;
diff --git a/bytecode/BytecodeGeneratorification.cpp b/bytecode/BytecodeGeneratorification.cpp
new file mode 100644
index 0000000..f7e1e9a
--- /dev/null
+++ b/bytecode/BytecodeGeneratorification.cpp
@@ -0,0 +1,268 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BytecodeGeneratorification.h"
+
+#include "BytecodeLivenessAnalysisInlines.h"
+#include "BytecodeRewriter.h"
+#include "BytecodeUseDef.h"
+#include "IdentifierInlines.h"
+#include "InterpreterInlines.h"
+#include "JSCInlines.h"
+#include "JSCJSValueInlines.h"
+#include "JSGeneratorFunction.h"
+#include "StrongInlines.h"
+#include "UnlinkedCodeBlock.h"
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+struct YieldData {
+    size_t point { 0 };
+    int argument { 0 };
+    FastBitVector liveness;
+};
+
+class BytecodeGeneratorification {
+public:
+    typedef Vector<YieldData> Yields;
+
+    BytecodeGeneratorification(UnlinkedCodeBlock* codeBlock, UnlinkedCodeBlock::UnpackedInstructions& instructions, SymbolTable* generatorFrameSymbolTable, int generatorFrameSymbolTableIndex)
+        : m_graph(codeBlock, instructions)
+        , m_generatorFrameSymbolTable(*codeBlock->vm(), generatorFrameSymbolTable)
+        , m_generatorFrameSymbolTableIndex(generatorFrameSymbolTableIndex)
+    {
+        for (BytecodeBasicBlock* block : m_graph) {
+            for (unsigned bytecodeOffset : block->offsets()) {
+                const UnlinkedInstruction* pc = &m_graph.instructions()[bytecodeOffset];
+                switch (pc->u.opcode) {
+                case op_enter: {
+                    m_enterPoint = bytecodeOffset;
+                    break;
+                }
+
+                case op_yield: {
+                    unsigned liveCalleeLocalsIndex = pc[2].u.index;
+                    if (liveCalleeLocalsIndex >= m_yields.size())
+                        m_yields.resize(liveCalleeLocalsIndex + 1);
+                    YieldData& data = m_yields[liveCalleeLocalsIndex];
+                    data.point = bytecodeOffset;
+                    data.argument = pc[3].u.operand;
+                    break;
+                }
+
+                default:
+                    break;
+                }
+            }
+        }
+    }
+
+    struct Storage {
+        Identifier identifier;
+        unsigned identifierIndex;
+        ScopeOffset scopeOffset;
+    };
+
+    void run();
+
+    BytecodeGraph<UnlinkedCodeBlock>& graph() { return m_graph; }
+
+    const Yields& yields() const
+    {
+        return m_yields;
+    }
+
+    Yields& yields()
+    {
+        return m_yields;
+    }
+
+    unsigned enterPoint() const
+    {
+        return m_enterPoint;
+    }
+
+private:
+    Storage storageForGeneratorLocal(unsigned index)
+    {
+        // We assign a symbol to a register. There is one-on-one corresponding between a register and a symbol.
+        // By doing so, we allocate the specific storage to save the given register.
+        // This allow us not to save all the live registers even if the registers are not overwritten from the previous resuming time.
+        // It means that, the register can be retrieved even if the immediate previous op_save does not save it.
+
+        if (m_storages.size() <= index)
+            m_storages.resize(index + 1);
+        if (std::optional<Storage> storage = m_storages[index])
+            return *storage;
+
+        UnlinkedCodeBlock* codeBlock = m_graph.codeBlock();
+        Identifier identifier = Identifier::fromUid(PrivateName());
+        unsigned identifierIndex = codeBlock->numberOfIdentifiers();
+        codeBlock->addIdentifier(identifier);
+        ScopeOffset scopeOffset = m_generatorFrameSymbolTable->takeNextScopeOffset(NoLockingNecessary);
+        m_generatorFrameSymbolTable->set(NoLockingNecessary, identifier.impl(), SymbolTableEntry(VarOffset(scopeOffset)));
+
+        Storage storage = {
+            identifier,
+            identifierIndex,
+            scopeOffset
+        };
+        m_storages[index] = storage;
+        return storage;
+    }
+
+    unsigned m_enterPoint { 0 };
+    BytecodeGraph<UnlinkedCodeBlock> m_graph;
+    Vector<std::optional<Storage>> m_storages;
+    Yields m_yields;
+    Strong<SymbolTable> m_generatorFrameSymbolTable;
+    int m_generatorFrameSymbolTableIndex;
+};
+
+class GeneratorLivenessAnalysis : public BytecodeLivenessPropagation<GeneratorLivenessAnalysis> {
+public:
+    GeneratorLivenessAnalysis(BytecodeGeneratorification& generatorification)
+        : m_generatorification(generatorification)
+    {
+    }
+
+    template<typename Functor>
+    void computeDefsForBytecodeOffset(UnlinkedCodeBlock* codeBlock, OpcodeID opcodeID, UnlinkedInstruction* instruction, FastBitVector&, const Functor& functor)
+    {
+        JSC::computeDefsForBytecodeOffset(codeBlock, opcodeID, instruction, functor);
+    }
+
+    template<typename Functor>
+    void computeUsesForBytecodeOffset(UnlinkedCodeBlock* codeBlock, OpcodeID opcodeID, UnlinkedInstruction* instruction, FastBitVector&, const Functor& functor)
+    {
+        JSC::computeUsesForBytecodeOffset(codeBlock, opcodeID, instruction, functor);
+    }
+
+    void run()
+    {
+        // Perform modified liveness analysis to determine which locals are live at the merge points.
+        // This produces the conservative results for the question, "which variables should be saved and resumed?".
+
+        runLivenessFixpoint(m_generatorification.graph());
+
+        for (YieldData& data : m_generatorification.yields())
+            data.liveness = getLivenessInfoAtBytecodeOffset(m_generatorification.graph(), data.point + opcodeLength(op_yield));
+    }
+
+private:
+    BytecodeGeneratorification& m_generatorification;
+};
+
+void BytecodeGeneratorification::run()
+{
+    // We calculate the liveness at each merge point. This gives us the information which registers should be saved and resumed conservatively.
+
+    {
+        GeneratorLivenessAnalysis pass(*this);
+        pass.run();
+    }
+
+    UnlinkedCodeBlock* codeBlock = m_graph.codeBlock();
+    BytecodeRewriter rewriter(m_graph);
+
+    // Setup the global switch for the generator.
+    {
+        unsigned nextToEnterPoint = enterPoint() + opcodeLength(op_enter);
+        unsigned switchTableIndex = m_graph.codeBlock()->numberOfSwitchJumpTables();
+        VirtualRegister state = virtualRegisterForArgument(static_cast<int32_t>(JSGeneratorFunction::GeneratorArgument::State));
+        auto& jumpTable = m_graph.codeBlock()->addSwitchJumpTable();
+        jumpTable.min = 0;
+        jumpTable.branchOffsets.resize(m_yields.size() + 1);
+        jumpTable.branchOffsets.fill(0);
+        jumpTable.add(0, nextToEnterPoint);
+        for (unsigned i = 0; i < m_yields.size(); ++i)
+            jumpTable.add(i + 1, m_yields[i].point);
+
+        rewriter.insertFragmentBefore(nextToEnterPoint, [&](BytecodeRewriter::Fragment& fragment) {
+            fragment.appendInstruction(op_switch_imm, switchTableIndex, nextToEnterPoint, state.offset());
+        });
+    }
+
+    for (const YieldData& data : m_yields) {
+        VirtualRegister scope = virtualRegisterForArgument(static_cast<int32_t>(JSGeneratorFunction::GeneratorArgument::Frame));
+
+        // Emit save sequence.
+        rewriter.insertFragmentBefore(data.point, [&](BytecodeRewriter::Fragment& fragment) {
+            data.liveness.forEachSetBit([&](size_t index) {
+                VirtualRegister operand = virtualRegisterForLocal(index);
+                Storage storage = storageForGeneratorLocal(index);
+
+                fragment.appendInstruction(
+                    op_put_to_scope,
+                    scope.offset(), // scope
+                    storage.identifierIndex, // identifier
+                    operand.offset(), // value
+                    GetPutInfo(DoNotThrowIfNotFound, LocalClosureVar, InitializationMode::NotInitialization).operand(), // info
+                    m_generatorFrameSymbolTableIndex, // symbol table constant index
+                    storage.scopeOffset.offset() // scope offset
+                );
+            });
+
+            // Insert op_ret just after save sequence.
+            fragment.appendInstruction(op_ret, data.argument);
+        });
+
+        // Emit resume sequence.
+        rewriter.insertFragmentAfter(data.point, [&](BytecodeRewriter::Fragment& fragment) {
+            data.liveness.forEachSetBit([&](size_t index) {
+                VirtualRegister operand = virtualRegisterForLocal(index);
+                Storage storage = storageForGeneratorLocal(index);
+
+                UnlinkedValueProfile profile = codeBlock->addValueProfile();
+                fragment.appendInstruction(
+                    op_get_from_scope,
+                    operand.offset(), // dst
+                    scope.offset(), // scope
+                    storage.identifierIndex, // identifier
+                    GetPutInfo(DoNotThrowIfNotFound, LocalClosureVar, InitializationMode::NotInitialization).operand(), // info
+                    0, // local scope depth
+                    storage.scopeOffset.offset(), // scope offset
+                    profile // profile
+                );
+            });
+        });
+
+        // Clip the unnecessary bytecodes.
+        rewriter.removeBytecode(data.point);
+    }
+
+    rewriter.execute();
+}
+
+void performGeneratorification(UnlinkedCodeBlock* codeBlock, UnlinkedCodeBlock::UnpackedInstructions& instructions, SymbolTable* generatorFrameSymbolTable, int generatorFrameSymbolTableIndex)
+{
+    BytecodeGeneratorification pass(codeBlock, instructions, generatorFrameSymbolTable, generatorFrameSymbolTableIndex);
+    pass.run();
+}
+
+} // namespace JSC
diff --git a/bytecode/BytecodeGeneratorification.h b/bytecode/BytecodeGeneratorification.h
new file mode 100644
index 0000000..c7b6137
--- /dev/null
+++ b/bytecode/BytecodeGeneratorification.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "UnlinkedCodeBlock.h"
+
+namespace JSC {
+
+class SymbolTable;
+
+void performGeneratorification(UnlinkedCodeBlock*, UnlinkedCodeBlock::UnpackedInstructions&, SymbolTable* generatorFrameSymbolTable, int generatorFrameSymbolTableIndex);
+
+} // namespace JSC
diff --git a/bytecode/BytecodeGraph.h b/bytecode/BytecodeGraph.h
new file mode 100644
index 0000000..38a13c6
--- /dev/null
+++ b/bytecode/BytecodeGraph.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BytecodeBasicBlock.h"
+#include <wtf/IndexedContainerIterator.h>
+#include <wtf/IteratorRange.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class BytecodeBasicBlock;
+
+template<typename Block>
+class BytecodeGraph {
+    WTF_MAKE_FAST_ALLOCATED;
+    WTF_MAKE_NONCOPYABLE(BytecodeGraph);
+public:
+    typedef Block CodeBlock;
+    typedef typename Block::Instruction Instruction;
+    typedef Vector<std::unique_ptr<BytecodeBasicBlock>> BasicBlocksVector;
+
+    typedef WTF::IndexedContainerIterator<BytecodeGraph<Block>> iterator;
+
+    inline BytecodeGraph(Block*, typename Block::UnpackedInstructions&);
+
+    Block* codeBlock() const { return m_codeBlock; }
+
+    typename Block::UnpackedInstructions& instructions() { return m_instructions; }
+
+    WTF::IteratorRange<BasicBlocksVector::reverse_iterator> basicBlocksInReverseOrder()
+    {
+        return WTF::makeIteratorRange(m_basicBlocks.rbegin(), m_basicBlocks.rend());
+    }
+
+    static bool blockContainsBytecodeOffset(BytecodeBasicBlock* block, unsigned bytecodeOffset)
+    {
+        unsigned leaderOffset = block->leaderOffset();
+        return bytecodeOffset >= leaderOffset && bytecodeOffset < leaderOffset + block->totalLength();
+    }
+
+    BytecodeBasicBlock* findBasicBlockForBytecodeOffset(unsigned bytecodeOffset)
+    {
+        /*
+            for (unsigned i = 0; i < m_basicBlocks.size(); i++) {
+                if (blockContainsBytecodeOffset(m_basicBlocks[i].get(), bytecodeOffset))
+                    return m_basicBlocks[i].get();
+            }
+            return 0;
+        */
+
+        std::unique_ptr<BytecodeBasicBlock>* basicBlock = approximateBinarySearch<std::unique_ptr<BytecodeBasicBlock>, unsigned>(m_basicBlocks, m_basicBlocks.size(), bytecodeOffset, [] (std::unique_ptr<BytecodeBasicBlock>* basicBlock) { return (*basicBlock)->leaderOffset(); });
+        // We found the block we were looking for.
+        if (blockContainsBytecodeOffset((*basicBlock).get(), bytecodeOffset))
+            return (*basicBlock).get();
+
+        // Basic block is to the left of the returned block.
+        if (bytecodeOffset < (*basicBlock)->leaderOffset()) {
+            ASSERT(basicBlock - 1 >= m_basicBlocks.data());
+            ASSERT(blockContainsBytecodeOffset(basicBlock[-1].get(), bytecodeOffset));
+            return basicBlock[-1].get();
+        }
+
+        // Basic block is to the right of the returned block.
+        ASSERT(&basicBlock[1] <= &m_basicBlocks.last());
+        ASSERT(blockContainsBytecodeOffset(basicBlock[1].get(), bytecodeOffset));
+        return basicBlock[1].get();
+    }
+
+    BytecodeBasicBlock* findBasicBlockWithLeaderOffset(unsigned leaderOffset)
+    {
+        return (*tryBinarySearch<std::unique_ptr<BytecodeBasicBlock>, unsigned>(m_basicBlocks, m_basicBlocks.size(), leaderOffset, [] (std::unique_ptr<BytecodeBasicBlock>* basicBlock) { return (*basicBlock)->leaderOffset(); })).get();
+    }
+
+    unsigned size() const { return m_basicBlocks.size(); }
+    BytecodeBasicBlock* at(unsigned index) const { return m_basicBlocks[index].get(); }
+    BytecodeBasicBlock* operator[](unsigned index) const { return at(index); }
+
+    iterator begin() const { return iterator(*this, 0); }
+    iterator end() const { return iterator(*this, size()); }
+    BytecodeBasicBlock* first() { return at(0); }
+    BytecodeBasicBlock* last() { return at(size() - 1); }
+
+private:
+    Block* m_codeBlock;
+    BasicBlocksVector m_basicBlocks;
+    typename Block::UnpackedInstructions& m_instructions;
+};
+
+
+template<typename Block>
+BytecodeGraph<Block>::BytecodeGraph(Block* codeBlock, typename Block::UnpackedInstructions& instructions)
+    : m_codeBlock(codeBlock)
+    , m_instructions(instructions)
+{
+    ASSERT(m_codeBlock);
+    BytecodeBasicBlock::compute(m_codeBlock, instructions.begin(), instructions.size(), m_basicBlocks);
+    ASSERT(m_basicBlocks.size());
+}
+
+} // namespace JSC
diff --git a/bytecode/BytecodeIntrinsicRegistry.cpp b/bytecode/BytecodeIntrinsicRegistry.cpp
new file mode 100644
index 0000000..00c9c01
--- /dev/null
+++ b/bytecode/BytecodeIntrinsicRegistry.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BytecodeIntrinsicRegistry.h"
+
+#include "ArrayIteratorPrototype.h"
+#include "BuiltinNames.h"
+#include "BytecodeGenerator.h"
+#include "JSCJSValueInlines.h"
+#include "JSGeneratorFunction.h"
+#include "JSModuleLoader.h"
+#include "JSPromise.h"
+#include "Nodes.h"
+#include "StrongInlines.h"
+
+namespace JSC {
+
+#define INITIALIZE_BYTECODE_INTRINSIC_NAMES_TO_SET(name) m_bytecodeIntrinsicMap.add(vm.propertyNames->builtinNames().name##PrivateName().impl(), &BytecodeIntrinsicNode::emit_intrinsic_##name);
+
+BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry(VM& vm)
+    : m_vm(vm)
+    , m_bytecodeIntrinsicMap()
+{
+    JSC_COMMON_BYTECODE_INTRINSIC_FUNCTIONS_EACH_NAME(INITIALIZE_BYTECODE_INTRINSIC_NAMES_TO_SET)
+    JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(INITIALIZE_BYTECODE_INTRINSIC_NAMES_TO_SET)
+
+    m_undefined.set(m_vm, jsUndefined());
+    m_Infinity.set(m_vm, jsDoubleNumber(std::numeric_limits<double>::infinity()));
+    m_iterationKindKey.set(m_vm, jsNumber(IterateKey));
+    m_iterationKindValue.set(m_vm, jsNumber(IterateValue));
+    m_iterationKindKeyValue.set(m_vm, jsNumber(IterateKeyValue));
+    m_MAX_ARRAY_INDEX.set(m_vm, jsNumber(MAX_ARRAY_INDEX));
+    m_MAX_STRING_LENGTH.set(m_vm, jsNumber(JSString::MaxLength));
+    m_MAX_SAFE_INTEGER.set(m_vm, jsDoubleNumber(maxSafeInteger()));
+    m_ModuleFetch.set(m_vm, jsNumber(static_cast<unsigned>(JSModuleLoader::Status::Fetch)));
+    m_ModuleInstantiate.set(m_vm, jsNumber(static_cast<unsigned>(JSModuleLoader::Status::Instantiate)));
+    m_ModuleSatisfy.set(m_vm, jsNumber(static_cast<unsigned>(JSModuleLoader::Status::Satisfy)));
+    m_ModuleLink.set(m_vm, jsNumber(static_cast<unsigned>(JSModuleLoader::Status::Link)));
+    m_ModuleReady.set(m_vm, jsNumber(static_cast<unsigned>(JSModuleLoader::Status::Ready)));
+    m_promiseStatePending.set(m_vm, jsNumber(static_cast<unsigned>(JSPromise::Status::Pending)));
+    m_promiseStateFulfilled.set(m_vm, jsNumber(static_cast<unsigned>(JSPromise::Status::Fulfilled)));
+    m_promiseStateRejected.set(m_vm, jsNumber(static_cast<unsigned>(JSPromise::Status::Rejected)));
+    m_GeneratorResumeModeNormal.set(m_vm, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::NormalMode)));
+    m_GeneratorResumeModeThrow.set(m_vm, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::ThrowMode)));
+    m_GeneratorResumeModeReturn.set(m_vm, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::ReturnMode)));
+    m_GeneratorStateCompleted.set(m_vm, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorState::Completed)));
+    m_GeneratorStateExecuting.set(m_vm, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorState::Executing)));
+}
+
+BytecodeIntrinsicNode::EmitterType BytecodeIntrinsicRegistry::lookup(const Identifier& ident) const
+{
+    if (!m_vm.propertyNames->isPrivateName(ident))
+        return nullptr;
+    auto iterator = m_bytecodeIntrinsicMap.find(ident.impl());
+    if (iterator == m_bytecodeIntrinsicMap.end())
+        return nullptr;
+    return iterator->value;
+}
+
+#define JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS(name) \
+    JSValue BytecodeIntrinsicRegistry::name##Value(BytecodeGenerator&) \
+    { \
+        return m_##name.get(); \
+    }
+    JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS)
+#undef JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS
+
+} // namespace JSC
+
diff --git a/bytecode/BytecodeIntrinsicRegistry.h b/bytecode/BytecodeIntrinsicRegistry.h
new file mode 100644
index 0000000..0259bc6
--- /dev/null
+++ b/bytecode/BytecodeIntrinsicRegistry.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class CommonIdentifiers;
+class BytecodeGenerator;
+class BytecodeIntrinsicNode;
+class RegisterID;
+class Identifier;
+
+#define JSC_COMMON_BYTECODE_INTRINSIC_FUNCTIONS_EACH_NAME(macro) \
+    macro(argument) \
+    macro(argumentCount) \
+    macro(assert) \
+    macro(isObject) \
+    macro(isJSArray) \
+    macro(isProxyObject) \
+    macro(isDerivedArray) \
+    macro(isRegExpObject) \
+    macro(isMap) \
+    macro(isSet) \
+    macro(tailCallForwardArguments) \
+    macro(throwTypeError) \
+    macro(throwRangeError) \
+    macro(throwOutOfMemoryError) \
+    macro(tryGetById) \
+    macro(putByValDirect) \
+    macro(toNumber) \
+    macro(toString) \
+    macro(newArrayWithSize) \
+
+#define JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(macro) \
+    macro(undefined) \
+    macro(Infinity) \
+    macro(iterationKindKey) \
+    macro(iterationKindValue) \
+    macro(iterationKindKeyValue) \
+    macro(MAX_ARRAY_INDEX) \
+    macro(MAX_STRING_LENGTH) \
+    macro(MAX_SAFE_INTEGER) \
+    macro(ModuleFetch) \
+    macro(ModuleTranslate) \
+    macro(ModuleInstantiate) \
+    macro(ModuleSatisfy) \
+    macro(ModuleLink) \
+    macro(ModuleReady) \
+    macro(promiseStatePending) \
+    macro(promiseStateFulfilled) \
+    macro(promiseStateRejected) \
+    macro(GeneratorResumeModeNormal) \
+    macro(GeneratorResumeModeThrow) \
+    macro(GeneratorResumeModeReturn) \
+    macro(GeneratorStateCompleted) \
+    macro(GeneratorStateExecuting) \
+
+
+class BytecodeIntrinsicRegistry {
+    WTF_MAKE_NONCOPYABLE(BytecodeIntrinsicRegistry);
+public:
+    explicit BytecodeIntrinsicRegistry(VM&);
+
+    typedef RegisterID* (BytecodeIntrinsicNode::* EmitterType)(BytecodeGenerator&, RegisterID*);
+
+    EmitterType lookup(const Identifier&) const;
+
+#define JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS(name) JSValue name##Value(BytecodeGenerator&);
+    JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS)
+#undef JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS
+
+private:
+    VM& m_vm;
+    HashMap<RefPtr<UniquedStringImpl>, EmitterType, IdentifierRepHash> m_bytecodeIntrinsicMap;
+
+#define JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS(name) Strong<Unknown> m_##name;
+    JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS)
+#undef JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS
+};
+
+} // namespace JSC
diff --git a/bytecode/BytecodeKills.h b/bytecode/BytecodeKills.h
new file mode 100644
index 0000000..dbdd44d
--- /dev/null
+++ b/bytecode/BytecodeKills.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include <wtf/FastBitVector.h>
+
+namespace JSC {
+
+class BytecodeLivenessAnalysis;
+
+class BytecodeKills {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    BytecodeKills()
+        : m_codeBlock(nullptr)
+    {
+    }
+    
+    // By convention, we say that non-local operands are never killed.
+    bool operandIsKilled(unsigned bytecodeIndex, int operand) const
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(bytecodeIndex < m_codeBlock->instructions().size());
+        VirtualRegister reg(operand);
+        if (reg.isLocal())
+            return m_killSets[bytecodeIndex].contains(operand);
+        return false;
+    }
+    
+    bool operandIsKilled(Instruction* instruction, int operand) const
+    {
+        return operandIsKilled(instruction - m_codeBlock->instructions().begin(), operand);
+    }
+    
+    template<typename Functor>
+    void forEachOperandKilledAt(unsigned bytecodeIndex, const Functor& functor) const
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(bytecodeIndex < m_codeBlock->instructions().size());
+        m_killSets[bytecodeIndex].forEachLocal(
+            [&] (unsigned local) {
+                functor(virtualRegisterForLocal(local));
+            });
+    }
+    
+    template<typename Functor>
+    void forEachOperandKilledAt(Instruction* pc, const Functor& functor) const
+    {
+        forEachOperandKilledAt(pc - m_codeBlock->instructions().begin(), functor);
+    }
+    
+private:
+    friend class BytecodeLivenessAnalysis;
+
+    class KillSet {
+    public:
+        KillSet()
+            : m_word(0)
+        {
+        }
+
+        ~KillSet()
+        {
+            if (hasVector())
+                delete vector();
+        }
+        
+        void add(unsigned local)
+        {
+            if (isEmpty()) {
+                setOneItem(local);
+                return;
+            }
+            if (hasOneItem()) {
+                ASSERT(oneItem() != local);
+                Vector<unsigned>* vector = new Vector<unsigned>();
+                vector->append(oneItem());
+                vector->append(local);
+                setVector(vector);
+                return;
+            }
+            ASSERT(!vector()->contains(local));
+            vector()->append(local);
+        }
+        
+        template<typename Functor>
+        void forEachLocal(const Functor& functor)
+        {
+            if (isEmpty())
+                return;
+            if (hasOneItem()) {
+                functor(oneItem());
+                return;
+            }
+            for (unsigned local : *vector())
+                functor(local);
+        }
+        
+        bool contains(unsigned expectedLocal)
+        {
+            if (isEmpty())
+                return false;
+            if (hasOneItem())
+                return oneItem() == expectedLocal;
+            for (unsigned local : *vector()) {
+                if (local == expectedLocal)
+                    return true;
+            }
+            return false;
+        }
+        
+    private:
+        bool isEmpty() const
+        {
+            return !m_word;
+        }
+        
+        bool hasOneItem() const
+        {
+            return m_word & 1;
+        }
+        
+        unsigned oneItem() const
+        {
+            return m_word >> 1;
+        }
+        
+        void setOneItem(unsigned value)
+        {
+            m_word = (value << 1) | 1;
+        }
+        
+        bool hasVector() const
+        {
+            return !isEmpty() && !hasOneItem();
+        }
+        
+        Vector<unsigned>* vector()
+        {
+            return bitwise_cast<Vector<unsigned>*>(m_word);
+        }
+        
+        void setVector(Vector<unsigned>* value)
+        {
+            m_word = bitwise_cast<uintptr_t>(value);
+        }
+        
+        uintptr_t m_word;
+    };
+    
+    CodeBlock* m_codeBlock;
+    std::unique_ptr<KillSet[]> m_killSets;
+};
+
+} // namespace JSC
diff --git a/bytecode/BytecodeList.json b/bytecode/BytecodeList.json
new file mode 100644
index 0000000..fafded7
--- /dev/null
+++ b/bytecode/BytecodeList.json
@@ -0,0 +1,200 @@
+[
+    {
+        "section" : "Bytecodes", "emitInHFile" : true, "emitInASMFile" : true, 
+        "macroNameComponent" : "BYTECODE", "asmPrefix" : "llint_", 
+        "bytecodes" : [
+            { "name" : "op_enter", "length" : 1 },
+            { "name" : "op_get_scope", "length" : 2 },
+            { "name" : "op_create_direct_arguments", "length" : 2 },
+            { "name" : "op_create_scoped_arguments", "length" : 3 },
+            { "name" : "op_create_cloned_arguments", "length" : 2 },
+            { "name" : "op_create_this", "length" : 5 },
+            { "name" : "op_get_argument", "length" : 4 },
+            { "name" : "op_argument_count", "length" : 2 },
+            { "name" : "op_to_this", "length" : 4 },
+            { "name" : "op_check_tdz", "length" : 2 },
+            { "name" : "op_new_object", "length" : 4 },
+            { "name" : "op_new_array", "length" : 5 },
+            { "name" : "op_new_array_with_size", "length" : 4 },
+            { "name" : "op_new_array_with_spread", "length" : 5 },
+            { "name" : "op_spread", "length" : 3 },
+            { "name" : "op_new_array_buffer", "length" : 5 },
+            { "name" : "op_new_regexp", "length" : 3 },
+            { "name" : "op_mov", "length" : 3 },
+            { "name" : "op_not", "length" : 3 },
+            { "name" : "op_eq", "length" : 4 },
+            { "name" : "op_eq_null", "length" : 3 },
+            { "name" : "op_neq", "length" : 4 },
+            { "name" : "op_neq_null", "length" : 3 },
+            { "name" : "op_stricteq", "length" : 4 },
+            { "name" : "op_nstricteq", "length" : 4 },
+            { "name" : "op_less", "length" : 4 },
+            { "name" : "op_lesseq", "length" : 4 },
+            { "name" : "op_greater", "length" : 4 },
+            { "name" : "op_greatereq", "length" : 4 },
+            { "name" : "op_inc", "length" : 2 },
+            { "name" : "op_dec", "length" : 2 },
+            { "name" : "op_to_number", "length" : 4 },
+            { "name" : "op_to_string", "length" : 3 },
+            { "name" : "op_negate", "length" : 4 },
+            { "name" : "op_add", "length" : 5 },
+            { "name" : "op_mul", "length" : 5 },
+            { "name" : "op_div", "length" : 5 },
+            { "name" : "op_mod", "length" : 4 },
+            { "name" : "op_sub", "length" : 5 },
+            { "name" : "op_pow", "length" : 4 },
+            { "name" : "op_lshift", "length" : 4 },
+            { "name" : "op_rshift", "length" : 4 },
+            { "name" : "op_urshift", "length" : 4 },
+            { "name" : "op_unsigned", "length" : 3 },
+            { "name" : "op_bitand", "length" : 5 },
+            { "name" : "op_bitxor", "length" : 5 },
+            { "name" : "op_bitor", "length" : 5 },
+            { "name" : "op_overrides_has_instance", "length" : 4 },
+            { "name" : "op_instanceof", "length" : 4 },
+            { "name" : "op_instanceof_custom", "length" : 5 },
+            { "name" : "op_typeof", "length" : 3 },
+            { "name" : "op_is_empty", "length" : 3 },
+            { "name" : "op_is_undefined", "length" : 3 },
+            { "name" : "op_is_boolean", "length" : 3 },
+            { "name" : "op_is_number", "length" : 3 },
+            { "name" : "op_is_object", "length" : 3 },
+            { "name" : "op_is_object_or_null", "length" : 3 },
+            { "name" : "op_is_function", "length" : 3 },
+            { "name" : "op_is_cell_with_type", "length" : 4 },
+            { "name" : "op_in", "length" : 4 },
+            { "name" : "op_get_array_length", "length" : 9 },
+            { "name" : "op_get_by_id", "length" : 9  },
+            { "name" : "op_get_by_id_proto_load", "length" : 9 },
+            { "name" : "op_get_by_id_unset", "length" : 9 },
+            { "name" : "op_get_by_id_with_this", "length" : 6 },
+            { "name" : "op_get_by_val_with_this", "length" : 6 },
+            { "name" : "op_try_get_by_id", "length" : 5 },
+            { "name" : "op_put_by_id", "length" : 9 },
+            { "name" : "op_put_by_id_with_this", "length" : 5 },
+            { "name" : "op_del_by_id", "length" : 4 },
+            { "name" : "op_get_by_val", "length" : 6 },
+            { "name" : "op_put_by_val", "length" : 5 },
+            { "name" : "op_put_by_val_with_this", "length" : 5 },
+            { "name" : "op_put_by_val_direct", "length" : 5 },
+            { "name" : "op_del_by_val", "length" : 4 },
+            { "name" : "op_put_by_index", "length" : 4 },
+            { "name" : "op_put_getter_by_id", "length" : 5 },
+            { "name" : "op_put_setter_by_id", "length" : 5 },
+            { "name" : "op_put_getter_setter_by_id", "length" : 6 },
+            { "name" : "op_put_getter_by_val", "length" : 5 },
+            { "name" : "op_put_setter_by_val", "length" : 5 },
+            { "name" : "op_define_data_property", "length" : 5 },
+            { "name" : "op_define_accessor_property", "length" : 6 },
+            { "name" : "op_jmp", "length" : 2 },
+            { "name" : "op_jtrue", "length" : 3 },
+            { "name" : "op_jfalse", "length" : 3 },
+            { "name" : "op_jeq_null", "length" : 3 },
+            { "name" : "op_jneq_null", "length" : 3 },
+            { "name" : "op_jneq_ptr", "length" : 5 },
+            { "name" : "op_jless", "length" : 4 },
+            { "name" : "op_jlesseq", "length" : 4 },
+            { "name" : "op_jgreater", "length" : 4 },
+            { "name" : "op_jgreatereq", "length" : 4 },
+            { "name" : "op_jnless", "length" : 4 },
+            { "name" : "op_jnlesseq", "length" : 4 },
+            { "name" : "op_jngreater", "length" : 4 },
+            { "name" : "op_jngreatereq", "length" : 4 },
+            { "name" : "op_loop_hint", "length" : 1 },
+            { "name" : "op_switch_imm", "length" : 4 },
+            { "name" : "op_switch_char", "length" : 4 },
+            { "name" : "op_switch_string", "length" : 4 },
+            { "name" : "op_new_func", "length" : 4 },
+            { "name" : "op_new_func_exp", "length" : 4 },
+            { "name" : "op_new_generator_func", "length" : 4 },
+            { "name" : "op_new_generator_func_exp", "length" : 4 },
+            { "name" : "op_new_async_func", "length" : 4 },
+            { "name" : "op_new_async_func_exp", "length" : 4 },
+            { "name" : "op_set_function_name", "length" : 3 },
+            { "name" : "op_call", "length" : 9 },
+            { "name" : "op_tail_call", "length" : 9 },
+            { "name" : "op_call_eval", "length" : 9 },
+            { "name" : "op_call_varargs", "length" : 9 },
+            { "name" : "op_tail_call_varargs", "length" : 9 },
+            { "name" : "op_tail_call_forward_arguments", "length" : 9 },
+            { "name" : "op_ret", "length" : 2 },
+            { "name" : "op_construct", "length" : 9 },
+            { "name" : "op_construct_varargs", "length" : 9 },
+            { "name" : "op_strcat", "length" : 4 },
+            { "name" : "op_to_primitive", "length" : 3 },
+            { "name" : "op_resolve_scope", "length" : 7 },
+            { "name" : "op_get_from_scope", "length" : 8 },
+            { "name" : "op_put_to_scope", "length" : 7 },
+            { "name" : "op_get_from_arguments", "length" : 5 },
+            { "name" : "op_put_to_arguments", "length" : 4 },
+            { "name" : "op_push_with_scope", "length" : 4 },
+            { "name" : "op_create_lexical_environment", "length" : 5 },
+            { "name" : "op_get_parent_scope", "length" : 3 },
+            { "name" : "op_catch", "length" : 3 },
+            { "name" : "op_throw", "length" : 2 },
+            { "name" : "op_throw_static_error", "length" : 3 },
+            { "name" : "op_debug", "length" : 3 },
+            { "name" : "op_end", "length" : 2 },
+            { "name" : "op_profile_type", "length" : 6 },
+            { "name" : "op_profile_control_flow", "length" : 2 },
+            { "name" : "op_get_enumerable_length", "length" : 3 },
+            { "name" : "op_has_indexed_property", "length" : 5 },
+            { "name" : "op_has_structure_property", "length" : 5 },
+            { "name" : "op_has_generic_property", "length" : 4 },
+            { "name" : "op_get_direct_pname", "length" : 7 },
+            { "name" : "op_get_property_enumerator", "length" : 3 },
+            { "name" : "op_enumerator_structure_pname", "length" : 4 },
+            { "name" : "op_enumerator_generic_pname", "length" : 4 },
+            { "name" : "op_to_index_string", "length" : 3 },
+            { "name" : "op_assert", "length" : 3 },
+            { "name" : "op_create_rest", "length": 4 },
+            { "name" : "op_get_rest_length", "length": 3 },
+            { "name" : "op_yield", "length" : 4 },
+            { "name" : "op_watchdog", "length" : 1 },
+            { "name" : "op_log_shadow_chicken_prologue", "length" : 2},
+            { "name" : "op_log_shadow_chicken_tail", "length" : 3}
+        ]
+    },
+    {
+        "section" : "CLoopHelpers", "emitInHFile" : true, "emitInASMFile" : false, "defaultLength" : 1,
+        "macroNameComponent" : "CLOOP_BYTECODE_HELPER",
+        "bytecodes" : [
+            { "name" : "llint_entry" },
+            { "name" : "getHostCallReturnValue" },
+            { "name" : "llint_return_to_host" },
+            { "name" : "llint_vm_entry_to_javascript" },
+            { "name" : "llint_vm_entry_to_native" },
+            { "name" : "llint_cloop_did_return_from_js_1" },
+            { "name" : "llint_cloop_did_return_from_js_2" },
+            { "name" : "llint_cloop_did_return_from_js_3" },
+            { "name" : "llint_cloop_did_return_from_js_4" },
+            { "name" : "llint_cloop_did_return_from_js_5" },
+            { "name" : "llint_cloop_did_return_from_js_6" },
+            { "name" : "llint_cloop_did_return_from_js_7" },
+            { "name" : "llint_cloop_did_return_from_js_8" },
+            { "name" : "llint_cloop_did_return_from_js_9" },
+            { "name" : "llint_cloop_did_return_from_js_10" },
+            { "name" : "llint_cloop_did_return_from_js_11" },
+            { "name" : "llint_cloop_did_return_from_js_12" }
+        ]
+    },
+    {
+        "section" : "NativeHelpers", "emitInHFile" : true, "emitInASMFile" : true, "defaultLength" : 1,
+        "macroNameComponent" : "BYTECODE_HELPER",
+        "bytecodes" : [
+            { "name" : "llint_program_prologue" },
+            { "name" : "llint_eval_prologue" },
+            { "name" : "llint_module_program_prologue" },
+            { "name" : "llint_function_for_call_prologue" },
+            { "name" : "llint_function_for_construct_prologue" },
+            { "name" : "llint_function_for_call_arity_check" },
+            { "name" : "llint_function_for_construct_arity_check" },
+            { "name" : "llint_generic_return_point" },
+            { "name" : "llint_throw_from_slow_path_trampoline" },
+            { "name" : "llint_throw_during_call_trampoline" },
+            { "name" : "llint_native_call_trampoline" },
+            { "name" : "llint_native_construct_trampoline" },
+            { "name" : "handleUncaughtException" }
+        ]
+    }
+]
diff --git a/bytecode/BytecodeLivenessAnalysis.cpp b/bytecode/BytecodeLivenessAnalysis.cpp
new file mode 100644
index 0000000..60eeb71
--- /dev/null
+++ b/bytecode/BytecodeLivenessAnalysis.cpp
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BytecodeLivenessAnalysis.h"
+
+#include "BytecodeKills.h"
+#include "BytecodeLivenessAnalysisInlines.h"
+#include "BytecodeUseDef.h"
+#include "CodeBlock.h"
+#include "FullBytecodeLiveness.h"
+#include "HeapInlines.h"
+#include "InterpreterInlines.h"
+#include "PreciseJumpTargets.h"
+
+namespace JSC {
+
+BytecodeLivenessAnalysis::BytecodeLivenessAnalysis(CodeBlock* codeBlock)
+    : m_graph(codeBlock, codeBlock->instructions())
+{
+    compute();
+}
+
+template<typename Functor>
+void BytecodeLivenessAnalysis::computeDefsForBytecodeOffset(CodeBlock* codeBlock, OpcodeID opcodeID, Instruction* instruction, FastBitVector&, const Functor& functor)
+{
+    JSC::computeDefsForBytecodeOffset(codeBlock, opcodeID, instruction, functor);
+}
+
+template<typename Functor>
+void BytecodeLivenessAnalysis::computeUsesForBytecodeOffset(CodeBlock* codeBlock, OpcodeID opcodeID, Instruction* instruction, FastBitVector&, const Functor& functor)
+{
+    JSC::computeUsesForBytecodeOffset(codeBlock, opcodeID, instruction, functor);
+}
+
+void BytecodeLivenessAnalysis::getLivenessInfoAtBytecodeOffset(unsigned bytecodeOffset, FastBitVector& result)
+{
+    BytecodeBasicBlock* block = m_graph.findBasicBlockForBytecodeOffset(bytecodeOffset);
+    ASSERT(block);
+    ASSERT(!block->isEntryBlock());
+    ASSERT(!block->isExitBlock());
+    result.resize(block->out().numBits());
+    computeLocalLivenessForBytecodeOffset(m_graph, block, bytecodeOffset, result);
+}
+
+bool BytecodeLivenessAnalysis::operandIsLiveAtBytecodeOffset(int operand, unsigned bytecodeOffset)
+{
+    if (operandIsAlwaysLive(operand))
+        return true;
+    FastBitVector result;
+    getLivenessInfoAtBytecodeOffset(bytecodeOffset, result);
+    return operandThatIsNotAlwaysLiveIsLive(result, operand);
+}
+
+FastBitVector BytecodeLivenessAnalysis::getLivenessInfoAtBytecodeOffset(unsigned bytecodeOffset)
+{
+    FastBitVector out;
+    getLivenessInfoAtBytecodeOffset(bytecodeOffset, out);
+    return out;
+}
+
+void BytecodeLivenessAnalysis::computeFullLiveness(FullBytecodeLiveness& result)
+{
+    FastBitVector out;
+    CodeBlock* codeBlock = m_graph.codeBlock();
+    
+    result.m_map.resize(codeBlock->instructions().size());
+    
+    for (std::unique_ptr<BytecodeBasicBlock>& block : m_graph.basicBlocksInReverseOrder()) {
+        if (block->isEntryBlock() || block->isExitBlock())
+            continue;
+        
+        out = block->out();
+        
+        for (unsigned i = block->offsets().size(); i--;) {
+            unsigned bytecodeOffset = block->offsets()[i];
+            stepOverInstruction(m_graph, bytecodeOffset, out);
+            result.m_map[bytecodeOffset] = out;
+        }
+    }
+}
+
+void BytecodeLivenessAnalysis::computeKills(BytecodeKills& result)
+{
+    FastBitVector out;
+    
+    CodeBlock* codeBlock = m_graph.codeBlock();
+    result.m_codeBlock = codeBlock;
+    result.m_killSets = std::make_unique<BytecodeKills::KillSet[]>(codeBlock->instructions().size());
+    
+    for (std::unique_ptr<BytecodeBasicBlock>& block : m_graph.basicBlocksInReverseOrder()) {
+        if (block->isEntryBlock() || block->isExitBlock())
+            continue;
+        
+        out = block->out();
+        
+        for (unsigned i = block->offsets().size(); i--;) {
+            unsigned bytecodeOffset = block->offsets()[i];
+            stepOverInstruction(
+                m_graph, bytecodeOffset, out,
+                [&] (unsigned index) {
+                    // This is for uses.
+                    if (out[index])
+                        return;
+                    result.m_killSets[bytecodeOffset].add(index);
+                    out[index] = true;
+                },
+                [&] (unsigned index) {
+                    // This is for defs.
+                    out[index] = false;
+                });
+        }
+    }
+}
+
+void BytecodeLivenessAnalysis::dumpResults()
+{
+    CodeBlock* codeBlock = m_graph.codeBlock();
+    dataLog("\nDumping bytecode liveness for ", *codeBlock, ":\n");
+    Interpreter* interpreter = codeBlock->vm()->interpreter;
+    Instruction* instructionsBegin = codeBlock->instructions().begin();
+    unsigned i = 0;
+
+    unsigned numberOfBlocks = m_graph.size();
+    Vector<FastBitVector> predecessors(numberOfBlocks);
+    for (BytecodeBasicBlock* block : m_graph)
+        predecessors[block->index()].resize(numberOfBlocks);
+    for (BytecodeBasicBlock* block : m_graph) {
+        for (unsigned j = 0; j < block->successors().size(); j++) {
+            unsigned blockIndex = block->index();
+            unsigned successorIndex = block->successors()[j]->index();
+            predecessors[successorIndex][blockIndex] = true;
+        }
+    }
+
+    auto dumpBitVector = [] (FastBitVector& bits) {
+        for (unsigned j = 0; j < bits.numBits(); j++) {
+            if (bits[j])
+                dataLogF(" %u", j);
+        }
+    };
+
+    for (BytecodeBasicBlock* block : m_graph) {
+        dataLogF("\nBytecode basic block %u: %p (offset: %u, length: %u)\n", i++, block, block->leaderOffset(), block->totalLength());
+
+        dataLogF("Predecessors:");
+        dumpBitVector(predecessors[block->index()]);
+        dataLogF("\n");
+
+        dataLogF("Successors:");
+        FastBitVector successors;
+        successors.resize(numberOfBlocks);
+        for (unsigned j = 0; j < block->successors().size(); j++) {
+            BytecodeBasicBlock* successor = block->successors()[j];
+            successors[successor->index()] = true;
+        }
+        dumpBitVector(successors); // Dump in sorted order.
+        dataLogF("\n");
+
+        if (block->isEntryBlock()) {
+            dataLogF("Entry block %p\n", block);
+            continue;
+        }
+        if (block->isExitBlock()) {
+            dataLogF("Exit block: %p\n", block);
+            continue;
+        }
+        for (unsigned bytecodeOffset = block->leaderOffset(); bytecodeOffset < block->leaderOffset() + block->totalLength();) {
+            const Instruction* currentInstruction = &instructionsBegin[bytecodeOffset];
+
+            dataLogF("Live variables:");
+            FastBitVector liveBefore = getLivenessInfoAtBytecodeOffset(bytecodeOffset);
+            dumpBitVector(liveBefore);
+            dataLogF("\n");
+            codeBlock->dumpBytecode(WTF::dataFile(), codeBlock->globalObject()->globalExec(), instructionsBegin, currentInstruction);
+
+            OpcodeID opcodeID = interpreter->getOpcodeID(instructionsBegin[bytecodeOffset].u.opcode);
+            unsigned opcodeLength = opcodeLengths[opcodeID];
+            bytecodeOffset += opcodeLength;
+        }
+
+        dataLogF("Live variables:");
+        FastBitVector liveAfter = block->out();
+        dumpBitVector(liveAfter);
+        dataLogF("\n");
+    }
+}
+
+void BytecodeLivenessAnalysis::compute()
+{
+    runLivenessFixpoint(m_graph);
+
+    if (Options::dumpBytecodeLivenessResults())
+        dumpResults();
+}
+
+} // namespace JSC
diff --git a/bytecode/BytecodeLivenessAnalysis.h b/bytecode/BytecodeLivenessAnalysis.h
new file mode 100644
index 0000000..e12cd8e
--- /dev/null
+++ b/bytecode/BytecodeLivenessAnalysis.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BytecodeBasicBlock.h"
+#include "BytecodeGraph.h"
+#include "CodeBlock.h"
+#include <wtf/FastBitVector.h>
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class BytecodeKills;
+class FullBytecodeLiveness;
+
+template<typename DerivedAnalysis>
+class BytecodeLivenessPropagation {
+protected:
+    template<typename Graph, typename UseFunctor, typename DefFunctor> void stepOverInstruction(Graph&, unsigned bytecodeOffset, FastBitVector& out, const UseFunctor&, const DefFunctor&);
+
+    template<typename Graph> void stepOverInstruction(Graph&, unsigned bytecodeOffset, FastBitVector& out);
+
+    template<typename Graph> bool computeLocalLivenessForBytecodeOffset(Graph&, BytecodeBasicBlock*, unsigned targetOffset, FastBitVector& result);
+
+    template<typename Graph> bool computeLocalLivenessForBlock(Graph&, BytecodeBasicBlock*);
+
+    template<typename Graph> FastBitVector getLivenessInfoAtBytecodeOffset(Graph&, unsigned bytecodeOffset);
+
+    template<typename Graph> void runLivenessFixpoint(Graph&);
+};
+
+class BytecodeLivenessAnalysis : private BytecodeLivenessPropagation<BytecodeLivenessAnalysis> {
+    WTF_MAKE_FAST_ALLOCATED;
+    WTF_MAKE_NONCOPYABLE(BytecodeLivenessAnalysis);
+public:
+    friend class BytecodeLivenessPropagation<BytecodeLivenessAnalysis>;
+    BytecodeLivenessAnalysis(CodeBlock*);
+    
+    bool operandIsLiveAtBytecodeOffset(int operand, unsigned bytecodeOffset);
+    FastBitVector getLivenessInfoAtBytecodeOffset(unsigned bytecodeOffset);
+    
+    void computeFullLiveness(FullBytecodeLiveness& result);
+    void computeKills(BytecodeKills& result);
+
+private:
+    void compute();
+    void dumpResults();
+
+    void getLivenessInfoAtBytecodeOffset(unsigned bytecodeOffset, FastBitVector&);
+
+    template<typename Functor> void computeDefsForBytecodeOffset(CodeBlock*, OpcodeID, Instruction*, FastBitVector&, const Functor&);
+    template<typename Functor> void computeUsesForBytecodeOffset(CodeBlock*, OpcodeID, Instruction*, FastBitVector&, const Functor&);
+
+    BytecodeGraph<CodeBlock> m_graph;
+};
+
+inline bool operandIsAlwaysLive(int operand);
+inline bool operandThatIsNotAlwaysLiveIsLive(const FastBitVector& out, int operand);
+inline bool operandIsLive(const FastBitVector& out, int operand);
+inline bool isValidRegisterForLiveness(int operand);
+
+} // namespace JSC
diff --git a/bytecode/BytecodeLivenessAnalysisInlines.h b/bytecode/BytecodeLivenessAnalysisInlines.h
new file mode 100644
index 0000000..3371237
--- /dev/null
+++ b/bytecode/BytecodeLivenessAnalysisInlines.h
@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BytecodeGraph.h"
+#include "BytecodeLivenessAnalysis.h"
+#include "CodeBlock.h"
+#include "Interpreter.h"
+#include "Operations.h"
+
+namespace JSC {
+
+inline bool operandIsAlwaysLive(int operand)
+{
+    return !VirtualRegister(operand).isLocal();
+}
+
+inline bool operandThatIsNotAlwaysLiveIsLive(const FastBitVector& out, int operand)
+{
+    unsigned local = VirtualRegister(operand).toLocal();
+    if (local >= out.numBits())
+        return false;
+    return out[local];
+}
+
+inline bool operandIsLive(const FastBitVector& out, int operand)
+{
+    return operandIsAlwaysLive(operand) || operandThatIsNotAlwaysLiveIsLive(out, operand);
+}
+
+inline bool isValidRegisterForLiveness(int operand)
+{
+    VirtualRegister virtualReg(operand);
+    if (virtualReg.isConstant())
+        return false;
+    return virtualReg.isLocal();
+}
+
+// Simplified interface to bytecode use/def, which determines defs first and then uses, and includes
+// exception handlers in the uses.
+template<typename DerivedAnalysis>
+template<typename Graph, typename UseFunctor, typename DefFunctor>
+inline void BytecodeLivenessPropagation<DerivedAnalysis>::stepOverInstruction(Graph& graph, unsigned bytecodeOffset, FastBitVector& out, const UseFunctor& use, const DefFunctor& def)
+{
+    // This abstractly execute the instruction in reverse. Instructions logically first use operands and
+    // then define operands. This logical ordering is necessary for operations that use and def the same
+    // operand, like:
+    //
+    //     op_add loc1, loc1, loc2
+    //
+    // The use of loc1 happens before the def of loc1. That's a semantic requirement since the add
+    // operation cannot travel forward in time to read the value that it will produce after reading that
+    // value. Since we are executing in reverse, this means that we must do defs before uses (reverse of
+    // uses before defs).
+    //
+    // Since this is a liveness analysis, this ordering ends up being particularly important: if we did
+    // uses before defs, then the add operation above would appear to not have loc1 live, since we'd
+    // first add it to the out set (the use), and then we'd remove it (the def).
+
+    auto* codeBlock = graph.codeBlock();
+    Interpreter* interpreter = codeBlock->vm()->interpreter;
+    auto* instructionsBegin = graph.instructions().begin();
+    auto* instruction = &instructionsBegin[bytecodeOffset];
+    OpcodeID opcodeID = interpreter->getOpcodeID(*instruction);
+
+    static_cast<DerivedAnalysis*>(this)->computeDefsForBytecodeOffset(
+        codeBlock, opcodeID, instruction, out,
+        [&] (typename Graph::CodeBlock*, typename Graph::Instruction*, OpcodeID, int operand) {
+            if (isValidRegisterForLiveness(operand))
+                def(VirtualRegister(operand).toLocal());
+        });
+
+    static_cast<DerivedAnalysis*>(this)->computeUsesForBytecodeOffset(
+        codeBlock, opcodeID, instruction, out,
+        [&] (typename Graph::CodeBlock*, typename Graph::Instruction*, OpcodeID, int operand) {
+            if (isValidRegisterForLiveness(operand))
+                use(VirtualRegister(operand).toLocal());
+        });
+
+    // If we have an exception handler, we want the live-in variables of the 
+    // exception handler block to be included in the live-in of this particular bytecode.
+    if (auto* handler = codeBlock->handlerForBytecodeOffset(bytecodeOffset)) {
+        BytecodeBasicBlock* handlerBlock = graph.findBasicBlockWithLeaderOffset(handler->target);
+        ASSERT(handlerBlock);
+        handlerBlock->in().forEachSetBit(use);
+    }
+}
+
+template<typename DerivedAnalysis>
+template<typename Graph>
+inline void BytecodeLivenessPropagation<DerivedAnalysis>::stepOverInstruction(Graph& graph, unsigned bytecodeOffset, FastBitVector& out)
+{
+    stepOverInstruction(
+        graph, bytecodeOffset, out,
+        [&] (unsigned bitIndex) {
+            // This is the use functor, so we set the bit.
+            out[bitIndex] = true;
+        },
+        [&] (unsigned bitIndex) {
+            // This is the def functor, so we clear the bit.
+            out[bitIndex] = false;
+        });
+}
+
+template<typename DerivedAnalysis>
+template<typename Graph>
+inline bool BytecodeLivenessPropagation<DerivedAnalysis>::computeLocalLivenessForBytecodeOffset(Graph& graph, BytecodeBasicBlock* block, unsigned targetOffset, FastBitVector& result)
+{
+    ASSERT(!block->isExitBlock());
+    ASSERT(!block->isEntryBlock());
+
+    FastBitVector out = block->out();
+
+    for (int i = block->offsets().size() - 1; i >= 0; i--) {
+        unsigned bytecodeOffset = block->offsets()[i];
+        if (targetOffset > bytecodeOffset)
+            break;
+        stepOverInstruction(graph, bytecodeOffset, out);
+    }
+
+    return result.setAndCheck(out);
+}
+
+template<typename DerivedAnalysis>
+template<typename Graph>
+inline bool BytecodeLivenessPropagation<DerivedAnalysis>::computeLocalLivenessForBlock(Graph& graph, BytecodeBasicBlock* block)
+{
+    if (block->isExitBlock() || block->isEntryBlock())
+        return false;
+    return computeLocalLivenessForBytecodeOffset(graph, block, block->leaderOffset(), block->in());
+}
+
+template<typename DerivedAnalysis>
+template<typename Graph>
+inline FastBitVector BytecodeLivenessPropagation<DerivedAnalysis>::getLivenessInfoAtBytecodeOffset(Graph& graph, unsigned bytecodeOffset)
+{
+    BytecodeBasicBlock* block = graph.findBasicBlockForBytecodeOffset(bytecodeOffset);
+    ASSERT(block);
+    ASSERT(!block->isEntryBlock());
+    ASSERT(!block->isExitBlock());
+    FastBitVector out;
+    out.resize(block->out().numBits());
+    computeLocalLivenessForBytecodeOffset(graph, block, bytecodeOffset, out);
+    return out;
+}
+
+template<typename DerivedAnalysis>
+template<typename Graph>
+inline void BytecodeLivenessPropagation<DerivedAnalysis>::runLivenessFixpoint(Graph& graph)
+{
+    auto* codeBlock = graph.codeBlock();
+    unsigned numberOfVariables = codeBlock->numCalleeLocals();
+    for (BytecodeBasicBlock* block : graph) {
+        block->in().resize(numberOfVariables);
+        block->out().resize(numberOfVariables);
+        block->in().clearAll();
+        block->out().clearAll();
+    }
+
+    bool changed;
+    BytecodeBasicBlock* lastBlock = graph.last();
+    lastBlock->in().clearAll();
+    lastBlock->out().clearAll();
+    FastBitVector newOut;
+    newOut.resize(lastBlock->out().numBits());
+    do {
+        changed = false;
+        for (std::unique_ptr<BytecodeBasicBlock>& block : graph.basicBlocksInReverseOrder()) {
+            newOut.clearAll();
+            for (BytecodeBasicBlock* successor : block->successors())
+                newOut |= successor->in();
+            block->out() = newOut;
+            changed |= computeLocalLivenessForBlock(graph, block.get());
+        }
+    } while (changed);
+}
+
+} // namespace JSC
diff --git a/bytecode/BytecodeRewriter.cpp b/bytecode/BytecodeRewriter.cpp
new file mode 100644
index 0000000..6dadb6e
--- /dev/null
+++ b/bytecode/BytecodeRewriter.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BytecodeRewriter.h"
+
+#include "HeapInlines.h"
+#include "PreciseJumpTargetsInlines.h"
+#include <wtf/BubbleSort.h>
+
+namespace JSC {
+
+void BytecodeRewriter::applyModification()
+{
+    for (size_t insertionIndex = m_insertions.size(); insertionIndex--;) {
+        Insertion& insertion = m_insertions[insertionIndex];
+        if (insertion.type == Insertion::Type::Remove)
+            m_graph.instructions().remove(insertion.index.bytecodeOffset, insertion.length());
+        else {
+            if (insertion.includeBranch == IncludeBranch::Yes) {
+                int finalOffset = insertion.index.bytecodeOffset + calculateDifference(m_insertions.begin(), m_insertions.begin() + insertionIndex);
+                adjustJumpTargetsInFragment(finalOffset, insertion);
+            }
+            m_graph.instructions().insertVector(insertion.index.bytecodeOffset, insertion.instructions);
+        }
+    }
+    m_insertions.clear();
+}
+
+void BytecodeRewriter::execute()
+{
+    WTF::bubbleSort(m_insertions.begin(), m_insertions.end(), [] (const Insertion& lhs, const Insertion& rhs) {
+        return lhs.index < rhs.index;
+    });
+
+    UnlinkedCodeBlock* codeBlock = m_graph.codeBlock();
+    codeBlock->applyModification(*this);
+}
+
+void BytecodeRewriter::adjustJumpTargetsInFragment(unsigned finalOffset, Insertion& insertion)
+{
+    auto& fragment = insertion.instructions;
+    UnlinkedInstruction* instructionsBegin = fragment.data();
+    for (unsigned fragmentOffset = 0, fragmentCount = fragment.size(); fragmentOffset < fragmentCount;) {
+        UnlinkedInstruction& instruction = fragment[fragmentOffset];
+        OpcodeID opcodeID = instruction.u.opcode;
+        if (isBranch(opcodeID)) {
+            unsigned bytecodeOffset = finalOffset + fragmentOffset;
+            UnlinkedCodeBlock* codeBlock = m_graph.codeBlock();
+            extractStoredJumpTargetsForBytecodeOffset(codeBlock, codeBlock->vm()->interpreter, instructionsBegin, fragmentOffset, [&](int32_t& label) {
+                int absoluteOffset = adjustAbsoluteOffset(label);
+                label = absoluteOffset - static_cast<int>(bytecodeOffset);
+            });
+        }
+        fragmentOffset += opcodeLength(opcodeID);
+    }
+}
+
+void BytecodeRewriter::insertImpl(InsertionPoint insertionPoint, IncludeBranch includeBranch, Vector<UnlinkedInstruction>&& fragment)
+{
+    ASSERT(insertionPoint.position == Position::Before || insertionPoint.position == Position::After);
+    m_insertions.append(Insertion {
+        insertionPoint,
+        Insertion::Type::Insert,
+        includeBranch,
+        0,
+        WTFMove(fragment)
+    });
+}
+
+int BytecodeRewriter::adjustJumpTarget(InsertionPoint startPoint, InsertionPoint jumpTargetPoint)
+{
+    if (startPoint < jumpTargetPoint) {
+        int jumpTarget = jumpTargetPoint.bytecodeOffset;
+        auto start = std::lower_bound(m_insertions.begin(), m_insertions.end(), startPoint, [&] (const Insertion& insertion, InsertionPoint startPoint) {
+            return insertion.index < startPoint;
+        });
+        if (start != m_insertions.end()) {
+            auto end = std::lower_bound(m_insertions.begin(), m_insertions.end(), jumpTargetPoint, [&] (const Insertion& insertion, InsertionPoint jumpTargetPoint) {
+                return insertion.index < jumpTargetPoint;
+            });
+            jumpTarget += calculateDifference(start, end);
+        }
+        return jumpTarget - startPoint.bytecodeOffset;
+    }
+
+    if (startPoint == jumpTargetPoint)
+        return 0;
+
+    return -adjustJumpTarget(jumpTargetPoint, startPoint);
+}
+
+} // namespace JSC
diff --git a/bytecode/BytecodeRewriter.h b/bytecode/BytecodeRewriter.h
new file mode 100644
index 0000000..035f900
--- /dev/null
+++ b/bytecode/BytecodeRewriter.h
@@ -0,0 +1,235 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BytecodeGraph.h"
+#include "Bytecodes.h"
+#include "Opcode.h"
+#include "UnlinkedCodeBlock.h"
+#include <wtf/Insertion.h>
+
+namespace JSC {
+
+// BytecodeRewriter offers the ability to insert and remove the bytecodes including jump operations.
+//
+// We use the original bytecode offsets as labels. When you emit some jumps, you can specify the jump target by
+// using the original bytecode offsets. These bytecode offsets are later converted appropriate values by the
+// rewriter. And we also use the labels to represents the position the new bytecodes inserted.
+//
+//                      |  [bytecode]  |  [bytecode]  |
+//   offsets            A              B              C
+//
+// We can use the above "A", "B", and "C" offsets as labels. And the rewriter has the ability to insert bytecode fragments
+// before and after the label. For example, if you insert the fragment after "B", the layout becomes like this.
+//
+//                      |  [bytecode]  |  [fragment]  [bytecode]  |
+//   offsets            A              B                          C
+//
+//  And even if you remove some original bytecodes, the offset remains as labels. For example, when you remove the A's bytecode,
+//  the layout becomes like this.
+//
+//                      |              |  [bytecode]  |
+//   offsets            A              B              C
+//
+//  And still you can insert fragments before and after "A".
+//
+//                      |  [fragment]  |  [bytecode]  |
+//   offsets            A              B              C
+//
+//   We can insert bytecode fragments "Before" and "After" the labels. This inserted position, either "Before" and "After",
+//   has effect when the label is involved with jumps. For example, when you have jump to the position "B",
+//
+//                      |  [bytecode]  |  [bytecode]  |
+//   offsets            A              B              C
+//                                     ^
+//                                     jump to here.
+//
+//  and you insert the bytecode before/after "B",
+//
+//                      |  [bytecode] [before]  |  [after] [bytecode]  |
+//   offsets            A                       B              C
+//                                              ^
+//                                              jump to here.
+//
+//  as you can see, the execution jumping into "B" does not execute [before] code.
+class BytecodeRewriter {
+WTF_MAKE_NONCOPYABLE(BytecodeRewriter);
+public:
+    enum class Position : int8_t {
+        EntryPoint = -2,
+        Before = -1,
+        LabelPoint = 0,
+        After = 1,
+        OriginalBytecodePoint = 2,
+    };
+
+    enum class IncludeBranch : uint8_t {
+        No = 0,
+        Yes = 1,
+    };
+
+    struct InsertionPoint {
+        int bytecodeOffset;
+        Position position;
+
+        InsertionPoint(int offset, Position pos)
+            : bytecodeOffset(offset)
+            , position(pos)
+        {
+        }
+
+        bool operator<(const InsertionPoint& other) const
+        {
+            if (bytecodeOffset == other.bytecodeOffset)
+                return position < other.position;
+            return bytecodeOffset < other.bytecodeOffset;
+        }
+
+        bool operator==(const InsertionPoint& other) const
+        {
+            return bytecodeOffset == other.bytecodeOffset && position == other.position;
+        }
+    };
+
+private:
+    struct Insertion {
+        enum class Type : uint8_t { Insert = 0, Remove = 1, };
+
+        size_t length() const
+        {
+            if (type == Type::Remove)
+                return removeLength;
+            return instructions.size();
+        }
+
+        InsertionPoint index;
+        Type type;
+        IncludeBranch includeBranch;
+        size_t removeLength;
+        Vector<UnlinkedInstruction> instructions;
+    };
+
+public:
+    class Fragment {
+    WTF_MAKE_NONCOPYABLE(Fragment);
+    public:
+        Fragment(Vector<UnlinkedInstruction>& fragment, IncludeBranch& includeBranch)
+            : m_fragment(fragment)
+            , m_includeBranch(includeBranch)
+        {
+        }
+
+        template<class... Args>
+        void appendInstruction(OpcodeID opcodeID, Args... args)
+        {
+            if (isBranch(opcodeID))
+                m_includeBranch = IncludeBranch::Yes;
+
+            UnlinkedInstruction instructions[sizeof...(args) + 1] = {
+                UnlinkedInstruction(opcodeID),
+                UnlinkedInstruction(args)...
+            };
+            m_fragment.append(instructions, sizeof...(args) + 1);
+        }
+
+    private:
+        Vector<UnlinkedInstruction>& m_fragment;
+        IncludeBranch& m_includeBranch;
+    };
+
+    BytecodeRewriter(BytecodeGraph<UnlinkedCodeBlock>& graph)
+        : m_graph(graph)
+    {
+    }
+
+    template<class Function>
+    void insertFragmentBefore(unsigned bytecodeOffset, Function function)
+    {
+        IncludeBranch includeBranch = IncludeBranch::No;
+        Vector<UnlinkedInstruction> instructions;
+        Fragment fragment(instructions, includeBranch);
+        function(fragment);
+        insertImpl(InsertionPoint(bytecodeOffset, Position::Before), includeBranch, WTFMove(instructions));
+    }
+
+    template<class Function>
+    void insertFragmentAfter(unsigned bytecodeOffset, Function function)
+    {
+        IncludeBranch includeBranch = IncludeBranch::No;
+        Vector<UnlinkedInstruction> instructions;
+        Fragment fragment(instructions, includeBranch);
+        function(fragment);
+        insertImpl(InsertionPoint(bytecodeOffset, Position::After), includeBranch, WTFMove(instructions));
+    }
+
+    void removeBytecode(unsigned bytecodeOffset)
+    {
+        m_insertions.append(Insertion { InsertionPoint(bytecodeOffset, Position::OriginalBytecodePoint), Insertion::Type::Remove, IncludeBranch::No, opcodeLength(m_graph.instructions()[bytecodeOffset].u.opcode), { } });
+    }
+
+    void execute();
+
+    BytecodeGraph<UnlinkedCodeBlock>& graph() { return m_graph; }
+
+    int adjustAbsoluteOffset(int absoluteOffset)
+    {
+        return adjustJumpTarget(InsertionPoint(0, Position::EntryPoint), InsertionPoint(absoluteOffset, Position::LabelPoint));
+    }
+
+    int adjustJumpTarget(int originalBytecodeOffset, int originalJumpTarget)
+    {
+        return adjustJumpTarget(InsertionPoint(originalBytecodeOffset, Position::LabelPoint), InsertionPoint(originalJumpTarget, Position::LabelPoint));
+    }
+
+private:
+    void insertImpl(InsertionPoint, IncludeBranch, Vector<UnlinkedInstruction>&& fragment);
+
+    friend class UnlinkedCodeBlock;
+    void applyModification();
+    void adjustJumpTargetsInFragment(unsigned finalOffset, Insertion&);
+
+    int adjustJumpTarget(InsertionPoint startPoint, InsertionPoint jumpTargetPoint);
+    template<typename Iterator> int calculateDifference(Iterator begin, Iterator end);
+
+    BytecodeGraph<UnlinkedCodeBlock>& m_graph;
+    Vector<Insertion, 8> m_insertions;
+};
+
+template<typename Iterator>
+inline int BytecodeRewriter::calculateDifference(Iterator begin, Iterator end)
+{
+    int result = 0;
+    for (; begin != end; ++begin) {
+        if (begin->type == Insertion::Type::Remove)
+            result -= begin->length();
+        else
+            result += begin->length();
+    }
+    return result;
+}
+
+} // namespace JSC
diff --git a/bytecode/BytecodeUseDef.h b/bytecode/BytecodeUseDef.h
new file mode 100644
index 0000000..99b9394
--- /dev/null
+++ b/bytecode/BytecodeUseDef.h
@@ -0,0 +1,491 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "Interpreter.h"
+
+namespace JSC {
+
+template<typename Block, typename Functor, typename Instruction>
+void computeUsesForBytecodeOffset(Block* codeBlock, OpcodeID opcodeID, Instruction* instruction, const Functor& functor)
+{
+    if (opcodeID != op_enter && codeBlock->wasCompiledWithDebuggingOpcodes() && codeBlock->scopeRegister().isValid())
+        functor(codeBlock, instruction, opcodeID, codeBlock->scopeRegister().offset());
+
+    switch (opcodeID) {
+    // No uses.
+    case op_new_regexp:
+    case op_new_array_buffer:
+    case op_throw_static_error:
+    case op_debug:
+    case op_jneq_ptr:
+    case op_loop_hint:
+    case op_jmp:
+    case op_new_object:
+    case op_enter:
+    case op_argument_count:
+    case op_catch:
+    case op_profile_control_flow:
+    case op_create_direct_arguments:
+    case op_create_cloned_arguments:
+    case op_get_rest_length:
+    case op_watchdog:
+    case op_get_argument:
+        return;
+    case op_assert:
+    case op_get_scope:
+    case op_to_this:
+    case op_check_tdz:
+    case op_profile_type:
+    case op_throw:
+    case op_end:
+    case op_ret:
+    case op_jtrue:
+    case op_jfalse:
+    case op_jeq_null:
+    case op_jneq_null:
+    case op_dec:
+    case op_inc:
+    case op_log_shadow_chicken_prologue: {
+        ASSERT(opcodeLengths[opcodeID] > 1);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        return;
+    }
+    case op_jlesseq:
+    case op_jgreater:
+    case op_jgreatereq:
+    case op_jnless:
+    case op_jnlesseq:
+    case op_jngreater:
+    case op_jngreatereq:
+    case op_jless:
+    case op_set_function_name:
+    case op_log_shadow_chicken_tail: {
+        ASSERT(opcodeLengths[opcodeID] > 2);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        return;
+    }
+    case op_put_by_val_direct:
+    case op_put_by_val: {
+        ASSERT(opcodeLengths[opcodeID] > 3);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        return;
+    }
+    case op_put_by_index:
+    case op_put_by_id:
+    case op_put_to_scope:
+    case op_put_to_arguments: {
+        ASSERT(opcodeLengths[opcodeID] > 3);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        return;
+    }
+    case op_put_by_id_with_this: {
+        ASSERT(opcodeLengths[opcodeID] > 4);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        return;
+    }
+    case op_put_by_val_with_this: {
+        ASSERT(opcodeLengths[opcodeID] > 4);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        return;
+    }
+    case op_put_getter_by_id:
+    case op_put_setter_by_id: {
+        ASSERT(opcodeLengths[opcodeID] > 4);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        return;
+    }
+    case op_put_getter_setter_by_id: {
+        ASSERT(opcodeLengths[opcodeID] > 5);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[5].u.operand);
+        return;
+    }
+    case op_put_getter_by_val:
+    case op_put_setter_by_val: {
+        ASSERT(opcodeLengths[opcodeID] > 4);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        return;
+    }
+    case op_define_data_property: {
+        ASSERT(opcodeLengths[opcodeID] > 4);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        return;
+    }
+    case op_define_accessor_property: {
+        ASSERT(opcodeLengths[opcodeID] > 5);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[5].u.operand);
+        return;
+    }
+    case op_spread:
+    case op_get_property_enumerator:
+    case op_get_enumerable_length:
+    case op_new_func_exp:
+    case op_new_generator_func_exp:
+    case op_new_async_func_exp:
+    case op_to_index_string:
+    case op_create_lexical_environment:
+    case op_resolve_scope:
+    case op_get_from_scope:
+    case op_to_primitive:
+    case op_try_get_by_id:
+    case op_get_by_id:
+    case op_get_by_id_proto_load:
+    case op_get_by_id_unset:
+    case op_get_array_length:
+    case op_typeof:
+    case op_is_empty:
+    case op_is_undefined:
+    case op_is_boolean:
+    case op_is_number:
+    case op_is_object:
+    case op_is_object_or_null:
+    case op_is_cell_with_type:
+    case op_is_function:
+    case op_to_number:
+    case op_to_string:
+    case op_negate:
+    case op_neq_null:
+    case op_eq_null:
+    case op_not:
+    case op_mov:
+    case op_new_array_with_size:
+    case op_create_this:
+    case op_del_by_id:
+    case op_unsigned:
+    case op_new_func:
+    case op_new_generator_func:
+    case op_new_async_func:
+    case op_get_parent_scope:
+    case op_create_scoped_arguments:
+    case op_create_rest:
+    case op_get_from_arguments: {
+        ASSERT(opcodeLengths[opcodeID] > 2);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        return;
+    }
+    case op_has_generic_property:
+    case op_has_indexed_property:
+    case op_enumerator_structure_pname:
+    case op_enumerator_generic_pname:
+    case op_get_by_val:
+    case op_in:
+    case op_overrides_has_instance:
+    case op_instanceof:
+    case op_add:
+    case op_mul:
+    case op_div:
+    case op_mod:
+    case op_sub:
+    case op_pow:
+    case op_lshift:
+    case op_rshift:
+    case op_urshift:
+    case op_bitand:
+    case op_bitxor:
+    case op_bitor:
+    case op_less:
+    case op_lesseq:
+    case op_greater:
+    case op_greatereq:
+    case op_nstricteq:
+    case op_stricteq:
+    case op_neq:
+    case op_eq:
+    case op_push_with_scope:
+    case op_get_by_id_with_this:
+    case op_del_by_val:
+    case op_tail_call_forward_arguments: {
+        ASSERT(opcodeLengths[opcodeID] > 3);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        return;
+    }
+    case op_get_by_val_with_this: {
+        ASSERT(opcodeLengths[opcodeID] > 4);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        return;
+    }
+    case op_instanceof_custom:
+    case op_has_structure_property:
+    case op_construct_varargs:
+    case op_call_varargs:
+    case op_tail_call_varargs: {
+        ASSERT(opcodeLengths[opcodeID] > 4);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        return;
+    }
+    case op_get_direct_pname: {
+        ASSERT(opcodeLengths[opcodeID] > 5);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[4].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[5].u.operand);
+        return;
+    }
+    case op_switch_string:
+    case op_switch_char:
+    case op_switch_imm: {
+        ASSERT(opcodeLengths[opcodeID] > 3);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        return;
+    }
+    case op_new_array_with_spread:
+    case op_new_array:
+    case op_strcat: {
+        int base = instruction[2].u.operand;
+        int count = instruction[3].u.operand;
+        for (int i = 0; i < count; i++)
+            functor(codeBlock, instruction, opcodeID, base - i);
+        return;
+    }
+    case op_construct:
+    case op_call_eval:
+    case op_call:
+    case op_tail_call: {
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        int argCount = instruction[3].u.operand;
+        int registerOffset = -instruction[4].u.operand;
+        int lastArg = registerOffset + CallFrame::thisArgumentOffset();
+        for (int i = 0; i < argCount; i++)
+            functor(codeBlock, instruction, opcodeID, lastArg + i);
+        if (opcodeID == op_call_eval)
+            functor(codeBlock, instruction, opcodeID, codeBlock->scopeRegister().offset());
+        return;
+    }
+    case op_yield: {
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
+        return;
+    }
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+template<typename Block, typename Instruction, typename Functor>
+void computeDefsForBytecodeOffset(Block* codeBlock, OpcodeID opcodeID, Instruction* instruction, const Functor& functor)
+{
+    switch (opcodeID) {
+    // These don't define anything.
+    case op_put_to_scope:
+    case op_end:
+    case op_throw:
+    case op_throw_static_error:
+    case op_assert:
+    case op_debug:
+    case op_ret:
+    case op_jmp:
+    case op_jtrue:
+    case op_jfalse:
+    case op_jeq_null:
+    case op_jneq_null:
+    case op_jneq_ptr:
+    case op_jless:
+    case op_jlesseq:
+    case op_jgreater:
+    case op_jgreatereq:
+    case op_jnless:
+    case op_jnlesseq:
+    case op_jngreater:
+    case op_jngreatereq:
+    case op_loop_hint:
+    case op_switch_imm:
+    case op_switch_char:
+    case op_switch_string:
+    case op_put_by_id:
+    case op_put_by_id_with_this:
+    case op_put_by_val_with_this:
+    case op_put_getter_by_id:
+    case op_put_setter_by_id:
+    case op_put_getter_setter_by_id:
+    case op_put_getter_by_val:
+    case op_put_setter_by_val:
+    case op_put_by_val:
+    case op_put_by_val_direct:
+    case op_put_by_index:
+    case op_define_data_property:
+    case op_define_accessor_property:
+    case op_profile_type:
+    case op_profile_control_flow:
+    case op_put_to_arguments:
+    case op_set_function_name:
+    case op_watchdog:
+    case op_log_shadow_chicken_prologue:
+    case op_log_shadow_chicken_tail:
+    case op_yield:
+#define LLINT_HELPER_OPCODES(opcode, length) case opcode:
+        FOR_EACH_LLINT_OPCODE_EXTENSION(LLINT_HELPER_OPCODES);
+#undef LLINT_HELPER_OPCODES
+        return;
+    // These all have a single destination for the first argument.
+    case op_argument_count:
+    case op_to_index_string:
+    case op_get_enumerable_length:
+    case op_has_indexed_property:
+    case op_has_structure_property:
+    case op_has_generic_property:
+    case op_get_direct_pname:
+    case op_get_property_enumerator:
+    case op_enumerator_structure_pname:
+    case op_enumerator_generic_pname:
+    case op_get_parent_scope:
+    case op_push_with_scope:
+    case op_create_lexical_environment:
+    case op_resolve_scope:
+    case op_strcat:
+    case op_to_primitive:
+    case op_create_this:
+    case op_new_array:
+    case op_new_array_with_spread:
+    case op_spread:
+    case op_new_array_buffer:
+    case op_new_array_with_size:
+    case op_new_regexp:
+    case op_new_func:
+    case op_new_func_exp:
+    case op_new_generator_func:
+    case op_new_generator_func_exp:
+    case op_new_async_func:
+    case op_new_async_func_exp:
+    case op_call_varargs:
+    case op_tail_call_varargs:
+    case op_tail_call_forward_arguments:
+    case op_construct_varargs:
+    case op_get_from_scope:
+    case op_call:
+    case op_tail_call:
+    case op_call_eval:
+    case op_construct:
+    case op_try_get_by_id:
+    case op_get_by_id:
+    case op_get_by_id_proto_load:
+    case op_get_by_id_unset:
+    case op_get_by_id_with_this:
+    case op_get_by_val_with_this:
+    case op_get_array_length:
+    case op_overrides_has_instance:
+    case op_instanceof:
+    case op_instanceof_custom:
+    case op_get_by_val:
+    case op_typeof:
+    case op_is_empty:
+    case op_is_undefined:
+    case op_is_boolean:
+    case op_is_number:
+    case op_is_object:
+    case op_is_object_or_null:
+    case op_is_cell_with_type:
+    case op_is_function:
+    case op_in:
+    case op_to_number:
+    case op_to_string:
+    case op_negate:
+    case op_add:
+    case op_mul:
+    case op_div:
+    case op_mod:
+    case op_sub:
+    case op_pow:
+    case op_lshift:
+    case op_rshift:
+    case op_urshift:
+    case op_bitand:
+    case op_bitxor:
+    case op_bitor:
+    case op_inc:
+    case op_dec:
+    case op_eq:
+    case op_neq:
+    case op_stricteq:
+    case op_nstricteq:
+    case op_less:
+    case op_lesseq:
+    case op_greater:
+    case op_greatereq:
+    case op_neq_null:
+    case op_eq_null:
+    case op_not:
+    case op_mov:
+    case op_new_object:
+    case op_to_this:
+    case op_check_tdz:
+    case op_get_scope:
+    case op_create_direct_arguments:
+    case op_create_scoped_arguments:
+    case op_create_cloned_arguments:
+    case op_del_by_id:
+    case op_del_by_val:
+    case op_unsigned:
+    case op_get_from_arguments: 
+    case op_get_argument:
+    case op_create_rest:
+    case op_get_rest_length: {
+        ASSERT(opcodeLengths[opcodeID] > 1);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        return;
+    }
+    case op_catch: {
+        ASSERT(opcodeLengths[opcodeID] > 2);
+        functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
+        functor(codeBlock, instruction, opcodeID, instruction[2].u.operand);
+        return;
+    }
+    case op_enter: {
+        for (unsigned i = codeBlock->m_numVars; i--;)
+            functor(codeBlock, instruction, opcodeID, virtualRegisterForLocal(i).offset());
+        return;
+    }
+    }
+}
+
+} // namespace JSC
diff --git a/bytecode/CallEdge.cpp b/bytecode/CallEdge.cpp
new file mode 100644
index 0000000..dffff6d
--- /dev/null
+++ b/bytecode/CallEdge.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallEdge.h"
+
+namespace JSC {
+
+void CallEdge::dump(PrintStream& out) const
+{
+    out.print("<", m_callee, ", count: ", m_count, ">");
+}
+
+} // namespace JSC
+
diff --git a/bytecode/CallEdge.h b/bytecode/CallEdge.h
new file mode 100644
index 0000000..8c7abbc
--- /dev/null
+++ b/bytecode/CallEdge.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallVariant.h"
+
+namespace JSC {
+
+class CallEdge {
+public:
+    CallEdge();
+    CallEdge(CallVariant, uint32_t);
+    
+    bool operator!() const { return !m_callee; }
+    
+    CallVariant callee() const { return m_callee; }
+    uint32_t count() const { return m_count; }
+    
+    CallEdge despecifiedClosure() const
+    {
+        return CallEdge(m_callee.despecifiedClosure(), m_count);
+    }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    CallVariant m_callee;
+    uint32_t m_count;
+};
+
+inline CallEdge::CallEdge(CallVariant callee, uint32_t count)
+    : m_callee(callee)
+    , m_count(count)
+{
+}
+
+inline CallEdge::CallEdge()
+    : CallEdge(CallVariant(), 0)
+{
+}
+
+typedef Vector<CallEdge, 1> CallEdgeList;
+
+} // namespace JSC
diff --git a/bytecode/CallLinkInfo.cpp b/bytecode/CallLinkInfo.cpp
new file mode 100644
index 0000000..7ffda05
--- /dev/null
+++ b/bytecode/CallLinkInfo.cpp
@@ -0,0 +1,273 @@
+/*
+ * Copyright (C) 2012-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallLinkInfo.h"
+
+#include "CallFrameShuffleData.h"
+#include "DFGOperations.h"
+#include "DFGThunks.h"
+#include "FunctionCodeBlock.h"
+#include "JSCInlines.h"
+#include "MacroAssembler.h"
+#include "Opcode.h"
+#include "Repatch.h"
+#include <wtf/ListDump.h>
+
+#if ENABLE(JIT)
+namespace JSC {
+
+CallLinkInfo::CallType CallLinkInfo::callTypeFor(OpcodeID opcodeID)
+{
+    if (opcodeID == op_call || opcodeID == op_call_eval)
+        return Call;
+    if (opcodeID == op_call_varargs)
+        return CallVarargs;
+    if (opcodeID == op_construct)
+        return Construct;
+    if (opcodeID == op_construct_varargs)
+        return ConstructVarargs;
+    if (opcodeID == op_tail_call)
+        return TailCall;
+    ASSERT(opcodeID == op_tail_call_varargs || op_tail_call_forward_arguments);
+    return TailCallVarargs;
+}
+
+CallLinkInfo::CallLinkInfo()
+    : m_hasSeenShouldRepatch(false)
+    , m_hasSeenClosure(false)
+    , m_clearedByGC(false)
+    , m_allowStubs(true)
+    , m_isLinked(false)
+    , m_callType(None)
+    , m_calleeGPR(255)
+    , m_maxNumArguments(0)
+    , m_slowPathCount(0)
+{
+}
+
+CallLinkInfo::~CallLinkInfo()
+{
+    clearStub();
+    
+    if (isOnList())
+        remove();
+}
+
+void CallLinkInfo::clearStub()
+{
+    if (!stub())
+        return;
+
+    m_stub->clearCallNodesFor(this);
+    m_stub = nullptr;
+}
+
+void CallLinkInfo::unlink(VM& vm)
+{
+    // We could be called even if we're not linked anymore because of how polymorphic calls
+    // work. Each callsite within the polymorphic call stub may separately ask us to unlink().
+    if (isLinked())
+        unlinkFor(vm, *this);
+
+    // Either we were unlinked, in which case we should not have been on any list, or we unlinked
+    // ourselves so that we're not on any list anymore.
+    RELEASE_ASSERT(!isOnList());
+}
+
+CodeLocationNearCall CallLinkInfo::callReturnLocation()
+{
+    RELEASE_ASSERT(!isDirect());
+    return CodeLocationNearCall(m_callReturnLocationOrPatchableJump, Regular);
+}
+
+CodeLocationJump CallLinkInfo::patchableJump()
+{
+    RELEASE_ASSERT(callType() == DirectTailCall);
+    return CodeLocationJump(m_callReturnLocationOrPatchableJump);
+}
+
+CodeLocationDataLabelPtr CallLinkInfo::hotPathBegin()
+{
+    RELEASE_ASSERT(!isDirect());
+    return CodeLocationDataLabelPtr(m_hotPathBeginOrSlowPathStart);
+}
+
+CodeLocationLabel CallLinkInfo::slowPathStart()
+{
+    RELEASE_ASSERT(isDirect());
+    return m_hotPathBeginOrSlowPathStart;
+}
+
+void CallLinkInfo::setCallee(VM& vm, JSCell* owner, JSFunction* callee)
+{
+    RELEASE_ASSERT(!isDirect());
+    MacroAssembler::repatchPointer(hotPathBegin(), callee);
+    m_calleeOrCodeBlock.set(vm, owner, callee);
+    m_isLinked = true;
+}
+
+void CallLinkInfo::clearCallee()
+{
+    RELEASE_ASSERT(!isDirect());
+    MacroAssembler::repatchPointer(hotPathBegin(), nullptr);
+    m_calleeOrCodeBlock.clear();
+    m_isLinked = false;
+}
+
+JSFunction* CallLinkInfo::callee()
+{
+    RELEASE_ASSERT(!isDirect());
+    return jsCast<JSFunction*>(m_calleeOrCodeBlock.get());
+}
+
+void CallLinkInfo::setCodeBlock(VM& vm, JSCell* owner, FunctionCodeBlock* codeBlock)
+{
+    RELEASE_ASSERT(isDirect());
+    m_calleeOrCodeBlock.setMayBeNull(vm, owner, codeBlock);
+    m_isLinked = true;
+}
+
+void CallLinkInfo::clearCodeBlock()
+{
+    RELEASE_ASSERT(isDirect());
+    m_calleeOrCodeBlock.clear();
+    m_isLinked = false;
+}
+
+FunctionCodeBlock* CallLinkInfo::codeBlock()
+{
+    RELEASE_ASSERT(isDirect());
+    return jsCast<FunctionCodeBlock*>(m_calleeOrCodeBlock.get());
+}
+
+void CallLinkInfo::setLastSeenCallee(VM& vm, const JSCell* owner, JSFunction* callee)
+{
+    RELEASE_ASSERT(!isDirect());
+    m_lastSeenCalleeOrExecutable.set(vm, owner, callee);
+}
+
+void CallLinkInfo::clearLastSeenCallee()
+{
+    RELEASE_ASSERT(!isDirect());
+    m_lastSeenCalleeOrExecutable.clear();
+}
+
+JSFunction* CallLinkInfo::lastSeenCallee()
+{
+    RELEASE_ASSERT(!isDirect());
+    return jsCast<JSFunction*>(m_lastSeenCalleeOrExecutable.get());
+}
+
+bool CallLinkInfo::haveLastSeenCallee()
+{
+    RELEASE_ASSERT(!isDirect());
+    return !!m_lastSeenCalleeOrExecutable;
+}
+
+void CallLinkInfo::setExecutableDuringCompilation(ExecutableBase* executable)
+{
+    RELEASE_ASSERT(isDirect());
+    m_lastSeenCalleeOrExecutable.setWithoutWriteBarrier(executable);
+}
+
+ExecutableBase* CallLinkInfo::executable()
+{
+    RELEASE_ASSERT(isDirect());
+    return jsCast<ExecutableBase*>(m_lastSeenCalleeOrExecutable.get());
+}
+
+void CallLinkInfo::setMaxNumArguments(unsigned value)
+{
+    RELEASE_ASSERT(isDirect());
+    RELEASE_ASSERT(value);
+    m_maxNumArguments = value;
+}
+
+void CallLinkInfo::visitWeak(VM& vm)
+{
+    auto handleSpecificCallee = [&] (JSFunction* callee) {
+        if (Heap::isMarked(callee->executable()))
+            m_hasSeenClosure = true;
+        else
+            m_clearedByGC = true;
+    };
+    
+    if (isLinked()) {
+        if (stub()) {
+            if (!stub()->visitWeak(vm)) {
+                if (Options::verboseOSR()) {
+                    dataLog(
+                        "Clearing closure call to ",
+                        listDump(stub()->variants()), ", stub routine ", RawPointer(stub()),
+                        ".\n");
+                }
+                unlink(vm);
+                m_clearedByGC = true;
+            }
+        } else if (!Heap::isMarked(m_calleeOrCodeBlock.get())) {
+            if (isDirect()) {
+                if (Options::verboseOSR()) {
+                    dataLog(
+                        "Clearing call to ", RawPointer(codeBlock()), " (",
+                        pointerDump(codeBlock()), ").\n");
+                }
+            } else {
+                if (Options::verboseOSR()) {
+                    dataLog(
+                        "Clearing call to ",
+                        RawPointer(callee()), " (",
+                        callee()->executable()->hashFor(specializationKind()),
+                        ").\n");
+                }
+                handleSpecificCallee(callee());
+            }
+            unlink(vm);
+        } else if (isDirect() && !Heap::isMarked(m_lastSeenCalleeOrExecutable.get())) {
+            if (Options::verboseOSR()) {
+                dataLog(
+                    "Clearing call to ", RawPointer(executable()),
+                    " because the executable is dead.\n");
+            }
+            unlink(vm);
+            // We should only get here once the owning CodeBlock is dying, since the executable must
+            // already be in the owner's weak references.
+            m_lastSeenCalleeOrExecutable.clear();
+        }
+    }
+    if (!isDirect() && haveLastSeenCallee() && !Heap::isMarked(lastSeenCallee())) {
+        handleSpecificCallee(lastSeenCallee());
+        clearLastSeenCallee();
+    }
+}
+
+void CallLinkInfo::setFrameShuffleData(const CallFrameShuffleData& shuffleData)
+{
+    m_frameShuffleData = std::make_unique<CallFrameShuffleData>(shuffleData);
+}
+
+} // namespace JSC
+#endif // ENABLE(JIT)
+
diff --git a/bytecode/CallLinkInfo.h b/bytecode/CallLinkInfo.h
new file mode 100644
index 0000000..0a91020
--- /dev/null
+++ b/bytecode/CallLinkInfo.h
@@ -0,0 +1,363 @@
+/*
+ * Copyright (C) 2012, 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallMode.h"
+#include "CodeLocation.h"
+#include "CodeSpecializationKind.h"
+#include "PolymorphicCallStubRoutine.h"
+#include "WriteBarrier.h"
+#include <wtf/SentinelLinkedList.h>
+
+namespace JSC {
+
+#if ENABLE(JIT)
+
+class FunctionCodeBlock;
+class JSFunction;
+enum OpcodeID : unsigned;
+struct CallFrameShuffleData;
+
+class CallLinkInfo : public BasicRawSentinelNode<CallLinkInfo> {
+public:
+    enum CallType {
+        None,
+        Call,
+        CallVarargs,
+        Construct,
+        ConstructVarargs,
+        TailCall,
+        TailCallVarargs,
+        DirectCall,
+        DirectConstruct,
+        DirectTailCall
+    };
+    
+    static CallType callTypeFor(OpcodeID opcodeID);
+
+    static bool isVarargsCallType(CallType callType)
+    {
+        switch (callType) {
+        case CallVarargs:
+        case ConstructVarargs:
+        case TailCallVarargs:
+            return true;
+
+        default:
+            return false;
+        }
+    }
+
+    CallLinkInfo();
+        
+    ~CallLinkInfo();
+    
+    static CodeSpecializationKind specializationKindFor(CallType callType)
+    {
+        return specializationFromIsConstruct(callType == Construct || callType == ConstructVarargs || callType == DirectConstruct);
+    }
+    CodeSpecializationKind specializationKind() const
+    {
+        return specializationKindFor(static_cast<CallType>(m_callType));
+    }
+    
+    static CallMode callModeFor(CallType callType)
+    {
+        switch (callType) {
+        case Call:
+        case CallVarargs:
+        case DirectCall:
+            return CallMode::Regular;
+        case TailCall:
+        case TailCallVarargs:
+        case DirectTailCall:
+            return CallMode::Tail;
+        case Construct:
+        case ConstructVarargs:
+        case DirectConstruct:
+            return CallMode::Construct;
+        case None:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    static bool isDirect(CallType callType)
+    {
+        switch (callType) {
+        case DirectCall:
+        case DirectTailCall:
+        case DirectConstruct:
+            return true;
+        case Call:
+        case CallVarargs:
+        case TailCall:
+        case TailCallVarargs:
+        case Construct:
+        case ConstructVarargs:
+            return false;
+        case None:
+            RELEASE_ASSERT_NOT_REACHED();
+            return false;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+    
+    CallMode callMode() const
+    {
+        return callModeFor(static_cast<CallType>(m_callType));
+    }
+
+    bool isDirect()
+    {
+        return isDirect(static_cast<CallType>(m_callType));
+    }
+
+    bool isTailCall() const
+    {
+        return callMode() == CallMode::Tail;
+    }
+    
+    NearCallMode nearCallMode() const
+    {
+        return isTailCall() ? Tail : Regular;
+    }
+
+    bool isVarargs() const
+    {
+        return isVarargsCallType(static_cast<CallType>(m_callType));
+    }
+
+    bool isLinked() { return m_stub || m_calleeOrCodeBlock; }
+    void unlink(VM&);
+
+    void setUpCall(CallType callType, CodeOrigin codeOrigin, unsigned calleeGPR)
+    {
+        m_callType = callType;
+        m_codeOrigin = codeOrigin;
+        m_calleeGPR = calleeGPR;
+    }
+
+    void setCallLocations(
+        CodeLocationLabel callReturnLocationOrPatchableJump,
+        CodeLocationLabel hotPathBeginOrSlowPathStart,
+        CodeLocationNearCall hotPathOther)
+    {
+        m_callReturnLocationOrPatchableJump = callReturnLocationOrPatchableJump;
+        m_hotPathBeginOrSlowPathStart = hotPathBeginOrSlowPathStart;
+        m_hotPathOther = hotPathOther;
+    }
+
+    bool allowStubs() const { return m_allowStubs; }
+
+    void disallowStubs()
+    {
+        m_allowStubs = false;
+    }
+
+    CodeLocationNearCall callReturnLocation();
+    CodeLocationJump patchableJump();
+    CodeLocationDataLabelPtr hotPathBegin();
+    CodeLocationLabel slowPathStart();
+
+    CodeLocationNearCall hotPathOther()
+    {
+        return m_hotPathOther;
+    }
+
+    void setCallee(VM&, JSCell*, JSFunction* callee);
+    void clearCallee();
+    JSFunction* callee();
+
+    void setCodeBlock(VM&, JSCell*, FunctionCodeBlock*);
+    void clearCodeBlock();
+    FunctionCodeBlock* codeBlock();
+
+    void setLastSeenCallee(VM& vm, const JSCell* owner, JSFunction* callee);
+    void clearLastSeenCallee();
+    JSFunction* lastSeenCallee();
+    bool haveLastSeenCallee();
+    
+    void setExecutableDuringCompilation(ExecutableBase*);
+    ExecutableBase* executable();
+    
+    void setStub(PassRefPtr<PolymorphicCallStubRoutine> newStub)
+    {
+        clearStub();
+        m_stub = newStub;
+    }
+
+    void clearStub();
+
+    PolymorphicCallStubRoutine* stub()
+    {
+        return m_stub.get();
+    }
+
+    void setSlowStub(PassRefPtr<JITStubRoutine> newSlowStub)
+    {
+        m_slowStub = newSlowStub;
+    }
+
+    void clearSlowStub()
+    {
+        m_slowStub = nullptr;
+    }
+
+    JITStubRoutine* slowStub()
+    {
+        return m_slowStub.get();
+    }
+
+    bool seenOnce()
+    {
+        return m_hasSeenShouldRepatch;
+    }
+
+    void clearSeen()
+    {
+        m_hasSeenShouldRepatch = false;
+    }
+
+    void setSeen()
+    {
+        m_hasSeenShouldRepatch = true;
+    }
+
+    bool hasSeenClosure()
+    {
+        return m_hasSeenClosure;
+    }
+
+    void setHasSeenClosure()
+    {
+        m_hasSeenClosure = true;
+    }
+
+    bool clearedByGC()
+    {
+        return m_clearedByGC;
+    }
+
+    void setCallType(CallType callType)
+    {
+        m_callType = callType;
+    }
+
+    CallType callType()
+    {
+        return static_cast<CallType>(m_callType);
+    }
+
+    uint32_t* addressOfMaxNumArguments()
+    {
+        return &m_maxNumArguments;
+    }
+
+    uint32_t maxNumArguments()
+    {
+        return m_maxNumArguments;
+    }
+    
+    void setMaxNumArguments(unsigned);
+
+    static ptrdiff_t offsetOfSlowPathCount()
+    {
+        return OBJECT_OFFSETOF(CallLinkInfo, m_slowPathCount);
+    }
+
+    void setCalleeGPR(unsigned calleeGPR)
+    {
+        m_calleeGPR = calleeGPR;
+    }
+
+    unsigned calleeGPR()
+    {
+        return m_calleeGPR;
+    }
+
+    uint32_t slowPathCount()
+    {
+        return m_slowPathCount;
+    }
+
+    void setCodeOrigin(CodeOrigin codeOrigin)
+    {
+        m_codeOrigin = codeOrigin;
+    }
+
+    CodeOrigin codeOrigin()
+    {
+        return m_codeOrigin;
+    }
+
+    void visitWeak(VM&);
+
+    void setFrameShuffleData(const CallFrameShuffleData&);
+
+    const CallFrameShuffleData* frameShuffleData()
+    {
+        return m_frameShuffleData.get();
+    }
+
+private:
+    CodeLocationLabel m_callReturnLocationOrPatchableJump;
+    CodeLocationLabel m_hotPathBeginOrSlowPathStart;
+    CodeLocationNearCall m_hotPathOther;
+    WriteBarrier<JSCell> m_calleeOrCodeBlock;
+    WriteBarrier<JSCell> m_lastSeenCalleeOrExecutable;
+    RefPtr<PolymorphicCallStubRoutine> m_stub;
+    RefPtr<JITStubRoutine> m_slowStub;
+    std::unique_ptr<CallFrameShuffleData> m_frameShuffleData;
+    bool m_hasSeenShouldRepatch : 1;
+    bool m_hasSeenClosure : 1;
+    bool m_clearedByGC : 1;
+    bool m_allowStubs : 1;
+    bool m_isLinked : 1;
+    unsigned m_callType : 4; // CallType
+    unsigned m_calleeGPR : 8;
+    uint32_t m_maxNumArguments; // For varargs: the profiled maximum number of arguments. For direct: the number of stack slots allocated for arguments.
+    uint32_t m_slowPathCount;
+    CodeOrigin m_codeOrigin;
+};
+
+inline CodeOrigin getCallLinkInfoCodeOrigin(CallLinkInfo& callLinkInfo)
+{
+    return callLinkInfo.codeOrigin();
+}
+
+typedef HashMap<CodeOrigin, CallLinkInfo*, CodeOriginApproximateHash> CallLinkInfoMap;
+
+#else // ENABLE(JIT)
+
+typedef HashMap<int, void*> CallLinkInfoMap;
+
+#endif // ENABLE(JIT)
+
+} // namespace JSC
diff --git a/bytecode/CallLinkStatus.cpp b/bytecode/CallLinkStatus.cpp
new file mode 100644
index 0000000..cbc555d
--- /dev/null
+++ b/bytecode/CallLinkStatus.cpp
@@ -0,0 +1,363 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallLinkStatus.h"
+
+#include "CallLinkInfo.h"
+#include "CodeBlock.h"
+#include "DFGJITCode.h"
+#include "InlineCallFrame.h"
+#include "Interpreter.h"
+#include "LLIntCallLinkInfo.h"
+#include "JSCInlines.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+static const bool verbose = false;
+
+CallLinkStatus::CallLinkStatus(JSValue value)
+    : m_couldTakeSlowPath(false)
+    , m_isProved(false)
+{
+    if (!value || !value.isCell()) {
+        m_couldTakeSlowPath = true;
+        return;
+    }
+    
+    m_variants.append(CallVariant(value.asCell()));
+}
+
+CallLinkStatus CallLinkStatus::computeFromLLInt(const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, unsigned bytecodeIndex)
+{
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+#if ENABLE(DFG_JIT)
+    if (profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadCell))) {
+        // We could force this to be a closure call, but instead we'll just assume that it
+        // takes slow path.
+        return takesSlowPath();
+    }
+#else
+    UNUSED_PARAM(locker);
+#endif
+
+    VM& vm = *profiledBlock->vm();
+    
+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
+    OpcodeID op = vm.interpreter->getOpcodeID(instruction[0].u.opcode);
+    if (op != op_call && op != op_construct && op != op_tail_call)
+        return CallLinkStatus();
+    
+    LLIntCallLinkInfo* callLinkInfo = instruction[5].u.callLinkInfo;
+    
+    return CallLinkStatus(callLinkInfo->lastSeenCallee.get());
+}
+
+CallLinkStatus CallLinkStatus::computeFor(
+    CodeBlock* profiledBlock, unsigned bytecodeIndex, const CallLinkInfoMap& map)
+{
+    ConcurrentJSLocker locker(profiledBlock->m_lock);
+    
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+    UNUSED_PARAM(map);
+#if ENABLE(DFG_JIT)
+    ExitSiteData exitSiteData = computeExitSiteData(locker, profiledBlock, bytecodeIndex);
+    
+    CallLinkInfo* callLinkInfo = map.get(CodeOrigin(bytecodeIndex));
+    if (!callLinkInfo) {
+        if (exitSiteData.takesSlowPath)
+            return takesSlowPath();
+        return computeFromLLInt(locker, profiledBlock, bytecodeIndex);
+    }
+    
+    return computeFor(locker, profiledBlock, *callLinkInfo, exitSiteData);
+#else
+    return CallLinkStatus();
+#endif
+}
+
+CallLinkStatus::ExitSiteData CallLinkStatus::computeExitSiteData(
+    const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, unsigned bytecodeIndex)
+{
+    ExitSiteData exitSiteData;
+    
+#if ENABLE(DFG_JIT)
+    exitSiteData.takesSlowPath =
+        profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadType))
+        || profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadExecutable));
+    exitSiteData.badFunction =
+        profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadCell));
+#else
+    UNUSED_PARAM(locker);
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+#endif
+    
+    return exitSiteData;
+}
+
+#if ENABLE(JIT)
+CallLinkStatus CallLinkStatus::computeFor(
+    const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, CallLinkInfo& callLinkInfo)
+{
+    // We don't really need this, but anytime we have to debug this code, it becomes indispensable.
+    UNUSED_PARAM(profiledBlock);
+    
+    CallLinkStatus result = computeFromCallLinkInfo(locker, callLinkInfo);
+    result.m_maxNumArguments = callLinkInfo.maxNumArguments();
+    return result;
+}
+
+CallLinkStatus CallLinkStatus::computeFromCallLinkInfo(
+    const ConcurrentJSLocker&, CallLinkInfo& callLinkInfo)
+{
+    if (callLinkInfo.clearedByGC())
+        return takesSlowPath();
+    
+    // Note that despite requiring that the locker is held, this code is racy with respect
+    // to the CallLinkInfo: it may get cleared while this code runs! This is because
+    // CallLinkInfo::unlink() may be called from a different CodeBlock than the one that owns
+    // the CallLinkInfo and currently we save space by not having CallLinkInfos know who owns
+    // them. So, there is no way for either the caller of CallLinkInfo::unlock() or unlock()
+    // itself to figure out which lock to lock.
+    //
+    // Fortunately, that doesn't matter. The only things we ask of CallLinkInfo - the slow
+    // path count, the stub, and the target - can all be asked racily. Stubs and targets can
+    // only be deleted at next GC, so if we load a non-null one, then it must contain data
+    // that is still marginally valid (i.e. the pointers ain't stale). This kind of raciness
+    // is probably OK for now.
+    
+    // PolymorphicCallStubRoutine is a GCAwareJITStubRoutine, so if non-null, it will stay alive
+    // until next GC even if the CallLinkInfo is concurrently cleared. Also, the variants list is
+    // never mutated after the PolymorphicCallStubRoutine is instantiated. We have some conservative
+    // fencing in place to make sure that we see the variants list after construction.
+    if (PolymorphicCallStubRoutine* stub = callLinkInfo.stub()) {
+        WTF::loadLoadFence();
+        
+        CallEdgeList edges = stub->edges();
+        
+        // Now that we've loaded the edges list, there are no further concurrency concerns. We will
+        // just manipulate and prune this list to our liking - mostly removing entries that are too
+        // infrequent and ensuring that it's sorted in descending order of frequency.
+        
+        RELEASE_ASSERT(edges.size());
+        
+        std::sort(
+            edges.begin(), edges.end(),
+            [] (CallEdge a, CallEdge b) {
+                return a.count() > b.count();
+            });
+        RELEASE_ASSERT(edges.first().count() >= edges.last().count());
+        
+        double totalCallsToKnown = 0;
+        double totalCallsToUnknown = callLinkInfo.slowPathCount();
+        CallVariantList variants;
+        for (size_t i = 0; i < edges.size(); ++i) {
+            CallEdge edge = edges[i];
+            // If the call is at the tail of the distribution, then we don't optimize it and we
+            // treat it as if it was a call to something unknown. We define the tail as being either
+            // a call that doesn't belong to the N most frequent callees (N =
+            // maxPolymorphicCallVariantsForInlining) or that has a total call count that is too
+            // small.
+            if (i >= Options::maxPolymorphicCallVariantsForInlining()
+                || edge.count() < Options::frequentCallThreshold())
+                totalCallsToUnknown += edge.count();
+            else {
+                totalCallsToKnown += edge.count();
+                variants.append(edge.callee());
+            }
+        }
+        
+        // Bail if we didn't find any calls that qualified.
+        RELEASE_ASSERT(!!totalCallsToKnown == !!variants.size());
+        if (variants.isEmpty())
+            return takesSlowPath();
+        
+        // We require that the distribution of callees is skewed towards a handful of common ones.
+        if (totalCallsToKnown / totalCallsToUnknown < Options::minimumCallToKnownRate())
+            return takesSlowPath();
+        
+        RELEASE_ASSERT(totalCallsToKnown);
+        RELEASE_ASSERT(variants.size());
+        
+        CallLinkStatus result;
+        result.m_variants = variants;
+        result.m_couldTakeSlowPath = !!totalCallsToUnknown;
+        result.m_isBasedOnStub = true;
+        return result;
+    }
+    
+    CallLinkStatus result;
+    
+    if (JSFunction* target = callLinkInfo.lastSeenCallee()) {
+        CallVariant variant(target);
+        if (callLinkInfo.hasSeenClosure())
+            variant = variant.despecifiedClosure();
+        result.m_variants.append(variant);
+    }
+    
+    result.m_couldTakeSlowPath = !!callLinkInfo.slowPathCount();
+
+    return result;
+}
+
+CallLinkStatus CallLinkStatus::computeFor(
+    const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, CallLinkInfo& callLinkInfo,
+    ExitSiteData exitSiteData)
+{
+    CallLinkStatus result = computeFor(locker, profiledBlock, callLinkInfo);
+    if (exitSiteData.badFunction) {
+        if (result.isBasedOnStub()) {
+            // If we have a polymorphic stub, then having an exit site is not quite so useful. In
+            // most cases, the information in the stub has higher fidelity.
+            result.makeClosureCall();
+        } else {
+            // We might not have a polymorphic stub for any number of reasons. When this happens, we
+            // are in less certain territory, so exit sites mean a lot.
+            result.m_couldTakeSlowPath = true;
+        }
+    }
+    if (exitSiteData.takesSlowPath)
+        result.m_couldTakeSlowPath = true;
+    
+    return result;
+}
+#endif
+
+void CallLinkStatus::computeDFGStatuses(
+    CodeBlock* dfgCodeBlock, CallLinkStatus::ContextMap& map)
+{
+#if ENABLE(DFG_JIT)
+    RELEASE_ASSERT(dfgCodeBlock->jitType() == JITCode::DFGJIT);
+    CodeBlock* baselineCodeBlock = dfgCodeBlock->alternative();
+    for (auto iter = dfgCodeBlock->callLinkInfosBegin(); !!iter; ++iter) {
+        CallLinkInfo& info = **iter;
+        if (info.isDirect()) {
+            // If the DFG was able to get a direct call then probably so will we. However, there is
+            // a remote chance that it's bad news to lose information about what the DFG did. We'd
+            // ideally like to just know that the DFG had emitted a DirectCall.
+            continue;
+        }
+        CodeOrigin codeOrigin = info.codeOrigin();
+        
+        // Check if we had already previously made a terrible mistake in the FTL for this
+        // code origin. Note that this is approximate because we could have a monovariant
+        // inline in the FTL that ended up failing. We should fix that at some point by
+        // having data structures to track the context of frequent exits. This is currently
+        // challenging because it would require creating a CodeOrigin-based database in
+        // baseline CodeBlocks, but those CodeBlocks don't really have a place to put the
+        // InlineCallFrames.
+        CodeBlock* currentBaseline =
+            baselineCodeBlockForOriginAndBaselineCodeBlock(codeOrigin, baselineCodeBlock);
+        ExitSiteData exitSiteData;
+        {
+            ConcurrentJSLocker locker(currentBaseline->m_lock);
+            exitSiteData = computeExitSiteData(
+                locker, currentBaseline, codeOrigin.bytecodeIndex);
+        }
+        
+        {
+            ConcurrentJSLocker locker(dfgCodeBlock->m_lock);
+            map.add(info.codeOrigin(), computeFor(locker, dfgCodeBlock, info, exitSiteData));
+        }
+    }
+#else
+    UNUSED_PARAM(dfgCodeBlock);
+#endif // ENABLE(DFG_JIT)
+    
+    if (verbose) {
+        dataLog("Context map:\n");
+        ContextMap::iterator iter = map.begin();
+        ContextMap::iterator end = map.end();
+        for (; iter != end; ++iter) {
+            dataLog("    ", iter->key, ":\n");
+            dataLog("        ", iter->value, "\n");
+        }
+    }
+}
+
+CallLinkStatus CallLinkStatus::computeFor(
+    CodeBlock* profiledBlock, CodeOrigin codeOrigin,
+    const CallLinkInfoMap& baselineMap, const CallLinkStatus::ContextMap& dfgMap)
+{
+    auto iter = dfgMap.find(codeOrigin);
+    if (iter != dfgMap.end())
+        return iter->value;
+    
+    return computeFor(profiledBlock, codeOrigin.bytecodeIndex, baselineMap);
+}
+
+void CallLinkStatus::setProvenConstantCallee(CallVariant variant)
+{
+    m_variants = CallVariantList{ variant };
+    m_couldTakeSlowPath = false;
+    m_isProved = true;
+}
+
+bool CallLinkStatus::isClosureCall() const
+{
+    for (unsigned i = m_variants.size(); i--;) {
+        if (m_variants[i].isClosureCall())
+            return true;
+    }
+    return false;
+}
+
+void CallLinkStatus::makeClosureCall()
+{
+    m_variants = despecifiedVariantList(m_variants);
+}
+
+void CallLinkStatus::dump(PrintStream& out) const
+{
+    if (!isSet()) {
+        out.print("Not Set");
+        return;
+    }
+    
+    CommaPrinter comma;
+    
+    if (m_isProved)
+        out.print(comma, "Statically Proved");
+    
+    if (m_couldTakeSlowPath)
+        out.print(comma, "Could Take Slow Path");
+    
+    if (m_isBasedOnStub)
+        out.print(comma, "Based On Stub");
+    
+    if (!m_variants.isEmpty())
+        out.print(comma, listDump(m_variants));
+    
+    if (m_maxNumArguments)
+        out.print(comma, "maxNumArguments = ", m_maxNumArguments);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/CallLinkStatus.h b/bytecode/CallLinkStatus.h
new file mode 100644
index 0000000..353deaa
--- /dev/null
+++ b/bytecode/CallLinkStatus.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallLinkInfo.h"
+#include "CallVariant.h"
+#include "CodeOrigin.h"
+#include "CodeSpecializationKind.h"
+#include "ConcurrentJSLock.h"
+#include "ExitingJITType.h"
+#include "Intrinsic.h"
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+class CodeBlock;
+class InternalFunction;
+class JSFunction;
+class Structure;
+class CallLinkInfo;
+
+class CallLinkStatus {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    CallLinkStatus()
+    {
+    }
+    
+    static CallLinkStatus takesSlowPath()
+    {
+        CallLinkStatus result;
+        result.m_couldTakeSlowPath = true;
+        return result;
+    }
+    
+    explicit CallLinkStatus(JSValue);
+    
+    CallLinkStatus(CallVariant variant)
+        : m_variants(1, variant)
+    {
+    }
+    
+    static CallLinkStatus computeFor(
+        CodeBlock*, unsigned bytecodeIndex, const CallLinkInfoMap&);
+
+    struct ExitSiteData {
+        bool takesSlowPath { false };
+        bool badFunction { false };
+    };
+    static ExitSiteData computeExitSiteData(const ConcurrentJSLocker&, CodeBlock*, unsigned bytecodeIndex);
+    
+#if ENABLE(JIT)
+    // Computes the status assuming that we never took slow path and never previously
+    // exited.
+    static CallLinkStatus computeFor(const ConcurrentJSLocker&, CodeBlock*, CallLinkInfo&);
+    static CallLinkStatus computeFor(
+        const ConcurrentJSLocker&, CodeBlock*, CallLinkInfo&, ExitSiteData);
+#endif
+    
+    typedef HashMap<CodeOrigin, CallLinkStatus, CodeOriginApproximateHash> ContextMap;
+    
+    // Computes all of the statuses of the DFG code block. Doesn't include statuses that had
+    // no information. Currently we use this when compiling FTL code, to enable polyvariant
+    // inlining.
+    static void computeDFGStatuses(CodeBlock* dfgCodeBlock, ContextMap&);
+    
+    // Helper that first consults the ContextMap and then does computeFor().
+    static CallLinkStatus computeFor(
+        CodeBlock*, CodeOrigin, const CallLinkInfoMap&, const ContextMap&);
+    
+    void setProvenConstantCallee(CallVariant);
+    
+    bool isSet() const { return !m_variants.isEmpty() || m_couldTakeSlowPath; }
+    
+    bool operator!() const { return !isSet(); }
+    
+    bool couldTakeSlowPath() const { return m_couldTakeSlowPath; }
+    
+    void setCouldTakeSlowPath(bool value) { m_couldTakeSlowPath = value; }
+    
+    CallVariantList variants() const { return m_variants; }
+    unsigned size() const { return m_variants.size(); }
+    CallVariant at(unsigned i) const { return m_variants[i]; }
+    CallVariant operator[](unsigned i) const { return at(i); }
+    bool isProved() const { return m_isProved; }
+    bool isBasedOnStub() const { return m_isBasedOnStub; }
+    bool canOptimize() const { return !m_variants.isEmpty(); }
+
+    bool isClosureCall() const; // Returns true if any callee is a closure call.
+    
+    unsigned maxNumArguments() const { return m_maxNumArguments; }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    void makeClosureCall();
+    
+    static CallLinkStatus computeFromLLInt(const ConcurrentJSLocker&, CodeBlock*, unsigned bytecodeIndex);
+#if ENABLE(JIT)
+    static CallLinkStatus computeFromCallLinkInfo(
+        const ConcurrentJSLocker&, CallLinkInfo&);
+#endif
+    
+    CallVariantList m_variants;
+    bool m_couldTakeSlowPath { false };
+    bool m_isProved { false };
+    bool m_isBasedOnStub { false };
+    unsigned m_maxNumArguments { 0 };
+};
+
+} // namespace JSC
diff --git a/bytecode/CallMode.cpp b/bytecode/CallMode.cpp
new file mode 100644
index 0000000..5757b18
--- /dev/null
+++ b/bytecode/CallMode.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallMode.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::CallMode callMode)
+{
+    switch (callMode) {
+    case JSC::CallMode::Tail:
+        out.print("TailCall");
+        return;
+    case JSC::CallMode::Regular:
+        out.print("Call");
+        return;
+    case JSC::CallMode::Construct:
+        out.print("Construct");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
diff --git a/bytecode/CallMode.h b/bytecode/CallMode.h
new file mode 100644
index 0000000..02d90e1
--- /dev/null
+++ b/bytecode/CallMode.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeSpecializationKind.h"
+
+namespace JSC {
+
+enum class CallMode { Regular, Tail, Construct };
+
+enum FrameAction { KeepTheFrame = 0, ReuseTheFrame };
+
+inline CodeSpecializationKind specializationKindFor(CallMode callMode)
+{
+    if (callMode == CallMode::Construct)
+        return CodeForConstruct;
+
+    return CodeForCall;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::CallMode);
+
+} // namespace WTF
diff --git a/bytecode/CallReturnOffsetToBytecodeOffset.h b/bytecode/CallReturnOffsetToBytecodeOffset.h
new file mode 100644
index 0000000..2d1b00c
--- /dev/null
+++ b/bytecode/CallReturnOffsetToBytecodeOffset.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+#if ENABLE(JIT)
+// This structure is used to map from a call return location
+// (given as an offset in bytes into the JIT code) back to
+// the bytecode index of the corresponding bytecode operation.
+// This is then used to look up the corresponding handler.
+// FIXME: This should be made inlining aware! Currently it isn't
+// because we never inline code that has exception handlers.
+struct CallReturnOffsetToBytecodeOffset {
+    CallReturnOffsetToBytecodeOffset(unsigned callReturnOffset, unsigned bytecodeOffset)
+        : callReturnOffset(callReturnOffset)
+        , bytecodeOffset(bytecodeOffset)
+    {
+    }
+
+    unsigned callReturnOffset;
+    unsigned bytecodeOffset;
+};
+
+inline unsigned getCallReturnOffset(CallReturnOffsetToBytecodeOffset* pc)
+{
+    return pc->callReturnOffset;
+}
+#endif
+
+} // namespace JSC
diff --git a/bytecode/CallVariant.cpp b/bytecode/CallVariant.cpp
new file mode 100644
index 0000000..9745dde
--- /dev/null
+++ b/bytecode/CallVariant.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallVariant.h"
+
+#include "JSCInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+void CallVariant::dump(PrintStream& out) const
+{
+    if (!*this) {
+        out.print("null");
+        return;
+    }
+    
+    if (InternalFunction* internalFunction = this->internalFunction()) {
+        out.print("InternalFunction: ", JSValue(internalFunction));
+        return;
+    }
+    
+    if (JSFunction* function = this->function()) {
+        out.print("(Function: ", JSValue(function), "; Executable: ", *executable(), ")");
+        return;
+    }
+    
+    out.print("Executable: ", *executable());
+}
+
+CallVariantList variantListWithVariant(const CallVariantList& list, CallVariant variantToAdd)
+{
+    ASSERT(variantToAdd);
+    CallVariantList result;
+    for (CallVariant variant : list) {
+        ASSERT(variant);
+        if (!!variantToAdd) {
+            if (variant == variantToAdd)
+                variantToAdd = CallVariant();
+            else if (variant.despecifiedClosure() == variantToAdd.despecifiedClosure()) {
+                variant = variant.despecifiedClosure();
+                variantToAdd = CallVariant();
+            }
+        }
+        result.append(variant);
+    }
+    if (!!variantToAdd)
+        result.append(variantToAdd);
+    
+    if (!ASSERT_DISABLED) {
+        for (unsigned i = 0; i < result.size(); ++i) {
+            for (unsigned j = i + 1; j < result.size(); ++j) {
+                if (result[i] != result[j])
+                    continue;
+                
+                dataLog("variantListWithVariant(", listDump(list), ", ", variantToAdd, ") failed: got duplicates in result: ", listDump(result), "\n");
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+    }
+    
+    return result;
+}
+
+CallVariantList despecifiedVariantList(const CallVariantList& list)
+{
+    CallVariantList result;
+    for (CallVariant variant : list)
+        result = variantListWithVariant(result, variant.despecifiedClosure());
+    return result;
+}
+
+} // namespace JSC
+
diff --git a/bytecode/CallVariant.h b/bytecode/CallVariant.h
new file mode 100644
index 0000000..cb288c6
--- /dev/null
+++ b/bytecode/CallVariant.h
@@ -0,0 +1,214 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "FunctionExecutable.h"
+#include "JSCell.h"
+#include "JSFunction.h"
+#include "NativeExecutable.h"
+
+namespace JSC {
+
+// The CallVariant class is meant to encapsulate a callee in a way that is useful for call linking
+// and inlining. Because JavaScript has closures, and because JSC implements the notion of internal
+// non-function objects that nevertheless provide call traps, the call machinery wants to see a
+// callee in one of the following four forms:
+//
+// JSFunction callee: This means that we expect the callsite to always call a particular function
+//     instance, that is associated with a particular lexical environment. This pinpoints not
+//     just the code that will be called (i.e. the executable) but also the scope within which
+//     the code runs.
+//
+// Executable callee: This corresponds to a call to a closure. In this case, we know that the
+//     callsite will call a JSFunction, but we do not know which particular JSFunction. We do know
+//     what code will be called - i.e. we know the executable.
+//
+// InternalFunction callee: JSC supports a special kind of native functions that support bizarre
+//     semantics. These are always singletons. If we know that the callee is an InternalFunction
+//     then we know both the code that will be called and the scope; in fact the "scope" is really
+//     just the InternalFunction itself.
+//
+// Something else: It's possible call all manner of rubbish in JavaScript. This implicitly supports
+//     bizarre object callees, but it can't really tell you anything interesting about them other
+//     than the fact that they don't fall into any of the above categories.
+//
+// This class serves as a kind of union over these four things. It does so by just holding a
+// JSCell*. We determine which of the modes its in by doing type checks on the cell. Note that we
+// cannot use WriteBarrier<> here because this gets used inside the compiler.
+
+class CallVariant {
+public:
+    explicit CallVariant(JSCell* callee = nullptr)
+        : m_callee(callee)
+    {
+    }
+    
+    CallVariant(WTF::HashTableDeletedValueType)
+        : m_callee(deletedToken())
+    {
+    }
+    
+    bool operator!() const { return !m_callee; }
+    
+    // If this variant refers to a function, change it to refer to its executable.
+    ALWAYS_INLINE CallVariant despecifiedClosure() const
+    {
+        if (m_callee->type() == JSFunctionType)
+            return CallVariant(jsCast<JSFunction*>(m_callee)->executable());
+        return *this;
+    }
+    
+    JSCell* rawCalleeCell() const { return m_callee; }
+    
+    InternalFunction* internalFunction() const
+    {
+        return jsDynamicCast<InternalFunction*>(m_callee);
+    }
+    
+    JSFunction* function() const
+    {
+        return jsDynamicCast<JSFunction*>(m_callee);
+    }
+    
+    bool isClosureCall() const { return !!jsDynamicCast<ExecutableBase*>(m_callee); }
+    
+    ExecutableBase* executable() const
+    {
+        if (JSFunction* function = this->function())
+            return function->executable();
+        return jsDynamicCast<ExecutableBase*>(m_callee);
+    }
+    
+    JSCell* nonExecutableCallee() const
+    {
+        RELEASE_ASSERT(!isClosureCall());
+        return m_callee;
+    }
+    
+    Intrinsic intrinsicFor(CodeSpecializationKind kind) const
+    {
+        if (ExecutableBase* executable = this->executable())
+            return executable->intrinsicFor(kind);
+        return NoIntrinsic;
+    }
+    
+    FunctionExecutable* functionExecutable() const
+    {
+        if (ExecutableBase* executable = this->executable())
+            return jsDynamicCast<FunctionExecutable*>(executable);
+        return nullptr;
+    }
+
+    NativeExecutable* nativeExecutable() const
+    {
+        if (ExecutableBase* executable = this->executable())
+            return jsDynamicCast<NativeExecutable*>(executable);
+        return nullptr;
+    }
+
+    const DOMJIT::Signature* signatureFor(CodeSpecializationKind kind) const
+    {
+        if (NativeExecutable* nativeExecutable = this->nativeExecutable())
+            return nativeExecutable->signatureFor(kind);
+        return nullptr;
+    }
+    
+    void dump(PrintStream& out) const;
+    
+    bool isHashTableDeletedValue() const
+    {
+        return m_callee == deletedToken();
+    }
+    
+    bool operator==(const CallVariant& other) const
+    {
+        return m_callee == other.m_callee;
+    }
+    
+    bool operator!=(const CallVariant& other) const
+    {
+        return !(*this == other);
+    }
+    
+    bool operator<(const CallVariant& other) const
+    {
+        return m_callee < other.m_callee;
+    }
+    
+    bool operator>(const CallVariant& other) const
+    {
+        return other < *this;
+    }
+    
+    bool operator<=(const CallVariant& other) const
+    {
+        return !(*this < other);
+    }
+    
+    bool operator>=(const CallVariant& other) const
+    {
+        return other <= *this;
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::PtrHash<JSCell*>::hash(m_callee);
+    }
+    
+private:
+    static JSCell* deletedToken() { return bitwise_cast<JSCell*>(static_cast<uintptr_t>(1)); }
+    
+    JSCell* m_callee;
+};
+
+struct CallVariantHash {
+    static unsigned hash(const CallVariant& key) { return key.hash(); }
+    static bool equal(const CallVariant& a, const CallVariant& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+typedef Vector<CallVariant, 1> CallVariantList;
+
+// Returns a new variant list by attempting to either append the given variant or merge it with one
+// of the variants we already have by despecifying closures.
+CallVariantList variantListWithVariant(const CallVariantList&, CallVariant);
+
+// Returns a new list where every element is despecified, and the list is deduplicated.
+CallVariantList despecifiedVariantList(const CallVariantList&);
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::CallVariant> {
+    typedef JSC::CallVariantHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::CallVariant> : SimpleClassHashTraits<JSC::CallVariant> { };
+
+} // namespace WTF
diff --git a/bytecode/CodeBlock.cpp b/bytecode/CodeBlock.cpp
new file mode 100644
index 0000000..d2566a7
--- /dev/null
+++ b/bytecode/CodeBlock.cpp
@@ -0,0 +1,4573 @@
+/*
+ * Copyright (C) 2008-2010, 2012-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CodeBlock.h"
+
+#include "ArithProfile.h"
+#include "BasicBlockLocation.h"
+#include "BytecodeGenerator.h"
+#include "BytecodeLivenessAnalysis.h"
+#include "BytecodeUseDef.h"
+#include "CallLinkStatus.h"
+#include "CodeBlockSet.h"
+#include "DFGCapabilities.h"
+#include "DFGCommon.h"
+#include "DFGDriver.h"
+#include "DFGJITCode.h"
+#include "DFGWorklist.h"
+#include "Debugger.h"
+#include "EvalCodeBlock.h"
+#include "FunctionCodeBlock.h"
+#include "FunctionExecutableDump.h"
+#include "GetPutInfo.h"
+#include "InlineCallFrame.h"
+#include "Interpreter.h"
+#include "JIT.h"
+#include "JITMathIC.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSFunction.h"
+#include "JSLexicalEnvironment.h"
+#include "JSModuleEnvironment.h"
+#include "LLIntData.h"
+#include "LLIntEntrypoint.h"
+#include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
+#include "LowLevelInterpreter.h"
+#include "ModuleProgramCodeBlock.h"
+#include "PCToCodeOriginMap.h"
+#include "PolymorphicAccess.h"
+#include "ProfilerDatabase.h"
+#include "ProgramCodeBlock.h"
+#include "ReduceWhitespace.h"
+#include "Repatch.h"
+#include "SlotVisitorInlines.h"
+#include "StackVisitor.h"
+#include "StructureStubInfo.h"
+#include "TypeLocationCache.h"
+#include "TypeProfiler.h"
+#include "UnlinkedInstructionStream.h"
+#include "VMInlines.h"
+#include <wtf/BagToHashMap.h>
+#include <wtf/CommaPrinter.h>
+#include <wtf/SimpleStats.h>
+#include <wtf/StringExtras.h>
+#include <wtf/StringPrintStream.h>
+#include <wtf/text/UniquedStringImpl.h>
+
+#if ENABLE(JIT)
+#include "RegisterAtOffsetList.h"
+#endif
+
+#if ENABLE(DFG_JIT)
+#include "DFGOperations.h"
+#endif
+
+#if ENABLE(FTL_JIT)
+#include "FTLJITCode.h"
+#endif
+
+namespace JSC {
+
+const ClassInfo CodeBlock::s_info = {
+    "CodeBlock", 0, 0,
+    CREATE_METHOD_TABLE(CodeBlock)
+};
+
+CString CodeBlock::inferredName() const
+{
+    switch (codeType()) {
+    case GlobalCode:
+        return "<global>";
+    case EvalCode:
+        return "<eval>";
+    case FunctionCode:
+        return jsCast<FunctionExecutable*>(ownerExecutable())->inferredName().utf8();
+    case ModuleCode:
+        return "<module>";
+    default:
+        CRASH();
+        return CString("", 0);
+    }
+}
+
+bool CodeBlock::hasHash() const
+{
+    return !!m_hash;
+}
+
+bool CodeBlock::isSafeToComputeHash() const
+{
+    return !isCompilationThread();
+}
+
+CodeBlockHash CodeBlock::hash() const
+{
+    if (!m_hash) {
+        RELEASE_ASSERT(isSafeToComputeHash());
+        m_hash = CodeBlockHash(ownerScriptExecutable()->source(), specializationKind());
+    }
+    return m_hash;
+}
+
+CString CodeBlock::sourceCodeForTools() const
+{
+    if (codeType() != FunctionCode)
+        return ownerScriptExecutable()->source().toUTF8();
+    
+    SourceProvider* provider = source();
+    FunctionExecutable* executable = jsCast<FunctionExecutable*>(ownerExecutable());
+    UnlinkedFunctionExecutable* unlinked = executable->unlinkedExecutable();
+    unsigned unlinkedStartOffset = unlinked->startOffset();
+    unsigned linkedStartOffset = executable->source().startOffset();
+    int delta = linkedStartOffset - unlinkedStartOffset;
+    unsigned rangeStart = delta + unlinked->unlinkedFunctionNameStart();
+    unsigned rangeEnd = delta + unlinked->startOffset() + unlinked->sourceLength();
+    return toCString(
+        "function ",
+        provider->source().substring(rangeStart, rangeEnd - rangeStart).utf8());
+}
+
+CString CodeBlock::sourceCodeOnOneLine() const
+{
+    return reduceWhitespace(sourceCodeForTools());
+}
+
+CString CodeBlock::hashAsStringIfPossible() const
+{
+    if (hasHash() || isSafeToComputeHash())
+        return toCString(hash());
+    return "<no-hash>";
+}
+
+void CodeBlock::dumpAssumingJITType(PrintStream& out, JITCode::JITType jitType) const
+{
+    out.print(inferredName(), "#", hashAsStringIfPossible());
+    out.print(":[", RawPointer(this), "->");
+    if (!!m_alternative)
+        out.print(RawPointer(alternative()), "->");
+    out.print(RawPointer(ownerExecutable()), ", ", jitType, codeType());
+
+    if (codeType() == FunctionCode)
+        out.print(specializationKind());
+    out.print(", ", instructionCount());
+    if (this->jitType() == JITCode::BaselineJIT && m_shouldAlwaysBeInlined)
+        out.print(" (ShouldAlwaysBeInlined)");
+    if (ownerScriptExecutable()->neverInline())
+        out.print(" (NeverInline)");
+    if (ownerScriptExecutable()->neverOptimize())
+        out.print(" (NeverOptimize)");
+    else if (ownerScriptExecutable()->neverFTLOptimize())
+        out.print(" (NeverFTLOptimize)");
+    if (ownerScriptExecutable()->didTryToEnterInLoop())
+        out.print(" (DidTryToEnterInLoop)");
+    if (ownerScriptExecutable()->isStrictMode())
+        out.print(" (StrictMode)");
+    if (m_didFailJITCompilation)
+        out.print(" (JITFail)");
+    if (this->jitType() == JITCode::BaselineJIT && m_didFailFTLCompilation)
+        out.print(" (FTLFail)");
+    if (this->jitType() == JITCode::BaselineJIT && m_hasBeenCompiledWithFTL)
+        out.print(" (HadFTLReplacement)");
+    out.print("]");
+}
+
+void CodeBlock::dump(PrintStream& out) const
+{
+    dumpAssumingJITType(out, jitType());
+}
+
+static CString idName(int id0, const Identifier& ident)
+{
+    return toCString(ident.impl(), "(@id", id0, ")");
+}
+
+CString CodeBlock::registerName(int r) const
+{
+    if (isConstantRegisterIndex(r))
+        return constantName(r);
+
+    return toCString(VirtualRegister(r));
+}
+
+CString CodeBlock::constantName(int index) const
+{
+    JSValue value = getConstant(index);
+    return toCString(value, "(", VirtualRegister(index), ")");
+}
+
+static CString regexpToSourceString(RegExp* regExp)
+{
+    char postfix[5] = { '/', 0, 0, 0, 0 };
+    int index = 1;
+    if (regExp->global())
+        postfix[index++] = 'g';
+    if (regExp->ignoreCase())
+        postfix[index++] = 'i';
+    if (regExp->multiline())
+        postfix[index] = 'm';
+    if (regExp->sticky())
+        postfix[index++] = 'y';
+    if (regExp->unicode())
+        postfix[index++] = 'u';
+
+    return toCString("/", regExp->pattern().impl(), postfix);
+}
+
+static CString regexpName(int re, RegExp* regexp)
+{
+    return toCString(regexpToSourceString(regexp), "(@re", re, ")");
+}
+
+NEVER_INLINE static const char* debugHookName(int debugHookType)
+{
+    switch (static_cast<DebugHookType>(debugHookType)) {
+        case DidEnterCallFrame:
+            return "didEnterCallFrame";
+        case WillLeaveCallFrame:
+            return "willLeaveCallFrame";
+        case WillExecuteStatement:
+            return "willExecuteStatement";
+        case WillExecuteExpression:
+            return "willExecuteExpression";
+        case WillExecuteProgram:
+            return "willExecuteProgram";
+        case DidExecuteProgram:
+            return "didExecuteProgram";
+        case DidReachBreakpoint:
+            return "didReachBreakpoint";
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return "";
+}
+
+void CodeBlock::printUnaryOp(PrintStream& out, ExecState* exec, int location, const Instruction*& it, const char* op)
+{
+    int r0 = (++it)->u.operand;
+    int r1 = (++it)->u.operand;
+
+    printLocationAndOp(out, exec, location, it, op);
+    out.printf("%s, %s", registerName(r0).data(), registerName(r1).data());
+}
+
+void CodeBlock::printBinaryOp(PrintStream& out, ExecState* exec, int location, const Instruction*& it, const char* op)
+{
+    int r0 = (++it)->u.operand;
+    int r1 = (++it)->u.operand;
+    int r2 = (++it)->u.operand;
+    printLocationAndOp(out, exec, location, it, op);
+    out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data());
+}
+
+void CodeBlock::printConditionalJump(PrintStream& out, ExecState* exec, const Instruction*, const Instruction*& it, int location, const char* op)
+{
+    int r0 = (++it)->u.operand;
+    int offset = (++it)->u.operand;
+    printLocationAndOp(out, exec, location, it, op);
+    out.printf("%s, %d(->%d)", registerName(r0).data(), offset, location + offset);
+}
+
+void CodeBlock::printGetByIdOp(PrintStream& out, ExecState* exec, int location, const Instruction*& it)
+{
+    const char* op;
+    switch (exec->interpreter()->getOpcodeID(it->u.opcode)) {
+    case op_get_by_id:
+        op = "get_by_id";
+        break;
+    case op_get_by_id_proto_load:
+        op = "get_by_id_proto_load";
+        break;
+    case op_get_by_id_unset:
+        op = "get_by_id_unset";
+        break;
+    case op_get_array_length:
+        op = "array_length";
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+        op = 0;
+#endif
+    }
+    int r0 = (++it)->u.operand;
+    int r1 = (++it)->u.operand;
+    int id0 = (++it)->u.operand;
+    printLocationAndOp(out, exec, location, it, op);
+    out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), idName(id0, identifier(id0)).data());
+    it += 4; // Increment up to the value profiler.
+}
+
+static void dumpStructure(PrintStream& out, const char* name, Structure* structure, const Identifier& ident)
+{
+    if (!structure)
+        return;
+    
+    out.printf("%s = %p", name, structure);
+    
+    PropertyOffset offset = structure->getConcurrently(ident.impl());
+    if (offset != invalidOffset)
+        out.printf(" (offset = %d)", offset);
+}
+
+static void dumpChain(PrintStream& out, StructureChain* chain, const Identifier& ident)
+{
+    out.printf("chain = %p: [", chain);
+    bool first = true;
+    for (WriteBarrier<Structure>* currentStructure = chain->head();
+         *currentStructure;
+         ++currentStructure) {
+        if (first)
+            first = false;
+        else
+            out.printf(", ");
+        dumpStructure(out, "struct", currentStructure->get(), ident);
+    }
+    out.printf("]");
+}
+
+void CodeBlock::printGetByIdCacheStatus(PrintStream& out, ExecState* exec, int location, const StubInfoMap& map)
+{
+    Instruction* instruction = instructions().begin() + location;
+
+    const Identifier& ident = identifier(instruction[3].u.operand);
+    
+    UNUSED_PARAM(ident); // tell the compiler to shut up in certain platform configurations.
+    
+    if (exec->interpreter()->getOpcodeID(instruction[0].u.opcode) == op_get_array_length)
+        out.printf(" llint(array_length)");
+    else if (StructureID structureID = instruction[4].u.structureID) {
+        Structure* structure = m_vm->heap.structureIDTable().get(structureID);
+        out.printf(" llint(");
+        dumpStructure(out, "struct", structure, ident);
+        out.printf(")");
+        if (exec->interpreter()->getOpcodeID(instruction[0].u.opcode) == op_get_by_id_proto_load)
+            out.printf(" proto(%p)", instruction[6].u.pointer);
+    }
+
+#if ENABLE(JIT)
+    if (StructureStubInfo* stubPtr = map.get(CodeOrigin(location))) {
+        StructureStubInfo& stubInfo = *stubPtr;
+        if (stubInfo.resetByGC)
+            out.print(" (Reset By GC)");
+        
+        out.printf(" jit(");
+            
+        Structure* baseStructure = nullptr;
+        PolymorphicAccess* stub = nullptr;
+            
+        switch (stubInfo.cacheType) {
+        case CacheType::GetByIdSelf:
+            out.printf("self");
+            baseStructure = stubInfo.u.byIdSelf.baseObjectStructure.get();
+            break;
+        case CacheType::Stub:
+            out.printf("stub");
+            stub = stubInfo.u.stub;
+            break;
+        case CacheType::Unset:
+            out.printf("unset");
+            break;
+        case CacheType::ArrayLength:
+            out.printf("ArrayLength");
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+            
+        if (baseStructure) {
+            out.printf(", ");
+            dumpStructure(out, "struct", baseStructure, ident);
+        }
+
+        if (stub)
+            out.print(", ", *stub);
+
+        out.printf(")");
+    }
+#else
+    UNUSED_PARAM(map);
+#endif
+}
+
+void CodeBlock::printPutByIdCacheStatus(PrintStream& out, int location, const StubInfoMap& map)
+{
+    Instruction* instruction = instructions().begin() + location;
+
+    const Identifier& ident = identifier(instruction[2].u.operand);
+    
+    UNUSED_PARAM(ident); // tell the compiler to shut up in certain platform configurations.
+
+    out.print(", ", instruction[8].u.putByIdFlags);
+    
+    if (StructureID structureID = instruction[4].u.structureID) {
+        Structure* structure = m_vm->heap.structureIDTable().get(structureID);
+        out.print(" llint(");
+        if (StructureID newStructureID = instruction[6].u.structureID) {
+            Structure* newStructure = m_vm->heap.structureIDTable().get(newStructureID);
+            dumpStructure(out, "prev", structure, ident);
+            out.print(", ");
+            dumpStructure(out, "next", newStructure, ident);
+            if (StructureChain* chain = instruction[7].u.structureChain.get()) {
+                out.print(", ");
+                dumpChain(out, chain, ident);
+            }
+        } else
+            dumpStructure(out, "struct", structure, ident);
+        out.print(")");
+    }
+
+#if ENABLE(JIT)
+    if (StructureStubInfo* stubPtr = map.get(CodeOrigin(location))) {
+        StructureStubInfo& stubInfo = *stubPtr;
+        if (stubInfo.resetByGC)
+            out.print(" (Reset By GC)");
+        
+        out.printf(" jit(");
+        
+        switch (stubInfo.cacheType) {
+        case CacheType::PutByIdReplace:
+            out.print("replace, ");
+            dumpStructure(out, "struct", stubInfo.u.byIdSelf.baseObjectStructure.get(), ident);
+            break;
+        case CacheType::Stub: {
+            out.print("stub, ", *stubInfo.u.stub);
+            break;
+        }
+        case CacheType::Unset:
+            out.printf("unset");
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        out.printf(")");
+    }
+#else
+    UNUSED_PARAM(map);
+#endif
+}
+
+void CodeBlock::printCallOp(PrintStream& out, ExecState* exec, int location, const Instruction*& it, const char* op, CacheDumpMode cacheDumpMode, bool& hasPrintedProfiling, const CallLinkInfoMap& map)
+{
+    int dst = (++it)->u.operand;
+    int func = (++it)->u.operand;
+    int argCount = (++it)->u.operand;
+    int registerOffset = (++it)->u.operand;
+    printLocationAndOp(out, exec, location, it, op);
+    out.print(registerName(dst), ", ", registerName(func), ", ", argCount, ", ", registerOffset);
+    out.print(" (this at ", virtualRegisterForArgument(0, -registerOffset), ")");
+    if (cacheDumpMode == DumpCaches) {
+        LLIntCallLinkInfo* callLinkInfo = it[1].u.callLinkInfo;
+        if (callLinkInfo->lastSeenCallee) {
+            out.printf(
+                " llint(%p, exec %p)",
+                callLinkInfo->lastSeenCallee.get(),
+                callLinkInfo->lastSeenCallee->executable());
+        }
+#if ENABLE(JIT)
+        if (CallLinkInfo* info = map.get(CodeOrigin(location))) {
+            JSFunction* target = info->lastSeenCallee();
+            if (target)
+                out.printf(" jit(%p, exec %p)", target, target->executable());
+        }
+        
+        if (jitType() != JITCode::FTLJIT)
+            out.print(" status(", CallLinkStatus::computeFor(this, location, map), ")");
+#else
+        UNUSED_PARAM(map);
+#endif
+    }
+    ++it;
+    ++it;
+    dumpArrayProfiling(out, it, hasPrintedProfiling);
+    dumpValueProfiling(out, it, hasPrintedProfiling);
+}
+
+void CodeBlock::printPutByIdOp(PrintStream& out, ExecState* exec, int location, const Instruction*& it, const char* op)
+{
+    int r0 = (++it)->u.operand;
+    int id0 = (++it)->u.operand;
+    int r1 = (++it)->u.operand;
+    printLocationAndOp(out, exec, location, it, op);
+    out.printf("%s, %s, %s", registerName(r0).data(), idName(id0, identifier(id0)).data(), registerName(r1).data());
+    it += 5;
+}
+
+void CodeBlock::dumpSource()
+{
+    dumpSource(WTF::dataFile());
+}
+
+void CodeBlock::dumpSource(PrintStream& out)
+{
+    ScriptExecutable* executable = ownerScriptExecutable();
+    if (executable->isFunctionExecutable()) {
+        FunctionExecutable* functionExecutable = reinterpret_cast<FunctionExecutable*>(executable);
+        StringView source = functionExecutable->source().provider()->getRange(
+            functionExecutable->parametersStartOffset(),
+            functionExecutable->typeProfilingEndOffset() + 1); // Type profiling end offset is the character before the '}'.
+        
+        out.print("function ", inferredName(), source);
+        return;
+    }
+    out.print(executable->source().view());
+}
+
+void CodeBlock::dumpBytecode()
+{
+    dumpBytecode(WTF::dataFile());
+}
+
+void CodeBlock::dumpBytecode(PrintStream& out)
+{
+    // We only use the ExecState* for things that don't actually lead to JS execution,
+    // like converting a JSString to a String. Hence the globalExec is appropriate.
+    ExecState* exec = m_globalObject->globalExec();
+    
+    size_t instructionCount = 0;
+
+    for (size_t i = 0; i < instructions().size(); i += opcodeLengths[exec->interpreter()->getOpcodeID(instructions()[i].u.opcode)])
+        ++instructionCount;
+
+    out.print(*this);
+    out.printf(
+        ": %lu m_instructions; %lu bytes; %d parameter(s); %d callee register(s); %d variable(s)",
+        static_cast<unsigned long>(instructions().size()),
+        static_cast<unsigned long>(instructions().size() * sizeof(Instruction)),
+        m_numParameters, m_numCalleeLocals, m_numVars);
+    out.print("; scope at ", scopeRegister());
+    out.printf("\n");
+    
+    StubInfoMap stubInfos;
+    CallLinkInfoMap callLinkInfos;
+    getStubInfoMap(stubInfos);
+    getCallLinkInfoMap(callLinkInfos);
+    
+    const Instruction* begin = instructions().begin();
+    const Instruction* end = instructions().end();
+    for (const Instruction* it = begin; it != end; ++it)
+        dumpBytecode(out, exec, begin, it, stubInfos, callLinkInfos);
+    
+    if (numberOfIdentifiers()) {
+        out.printf("\nIdentifiers:\n");
+        size_t i = 0;
+        do {
+            out.printf("  id%u = %s\n", static_cast<unsigned>(i), identifier(i).string().utf8().data());
+            ++i;
+        } while (i != numberOfIdentifiers());
+    }
+
+    if (!m_constantRegisters.isEmpty()) {
+        out.printf("\nConstants:\n");
+        size_t i = 0;
+        do {
+            const char* sourceCodeRepresentationDescription = nullptr;
+            switch (m_constantsSourceCodeRepresentation[i]) {
+            case SourceCodeRepresentation::Double:
+                sourceCodeRepresentationDescription = ": in source as double";
+                break;
+            case SourceCodeRepresentation::Integer:
+                sourceCodeRepresentationDescription = ": in source as integer";
+                break;
+            case SourceCodeRepresentation::Other:
+                sourceCodeRepresentationDescription = "";
+                break;
+            }
+            out.printf("   k%u = %s%s\n", static_cast<unsigned>(i), toCString(m_constantRegisters[i].get()).data(), sourceCodeRepresentationDescription);
+            ++i;
+        } while (i < m_constantRegisters.size());
+    }
+
+    if (size_t count = m_unlinkedCode->numberOfRegExps()) {
+        out.printf("\nm_regexps:\n");
+        size_t i = 0;
+        do {
+            out.printf("  re%u = %s\n", static_cast<unsigned>(i), regexpToSourceString(m_unlinkedCode->regexp(i)).data());
+            ++i;
+        } while (i < count);
+    }
+
+    dumpExceptionHandlers(out);
+    
+    if (m_rareData && !m_rareData->m_switchJumpTables.isEmpty()) {
+        out.printf("Switch Jump Tables:\n");
+        unsigned i = 0;
+        do {
+            out.printf("  %1d = {\n", i);
+            int entry = 0;
+            Vector<int32_t>::const_iterator end = m_rareData->m_switchJumpTables[i].branchOffsets.end();
+            for (Vector<int32_t>::const_iterator iter = m_rareData->m_switchJumpTables[i].branchOffsets.begin(); iter != end; ++iter, ++entry) {
+                if (!*iter)
+                    continue;
+                out.printf("\t\t%4d => %04d\n", entry + m_rareData->m_switchJumpTables[i].min, *iter);
+            }
+            out.printf("      }\n");
+            ++i;
+        } while (i < m_rareData->m_switchJumpTables.size());
+    }
+    
+    if (m_rareData && !m_rareData->m_stringSwitchJumpTables.isEmpty()) {
+        out.printf("\nString Switch Jump Tables:\n");
+        unsigned i = 0;
+        do {
+            out.printf("  %1d = {\n", i);
+            StringJumpTable::StringOffsetTable::const_iterator end = m_rareData->m_stringSwitchJumpTables[i].offsetTable.end();
+            for (StringJumpTable::StringOffsetTable::const_iterator iter = m_rareData->m_stringSwitchJumpTables[i].offsetTable.begin(); iter != end; ++iter)
+                out.printf("\t\t\"%s\" => %04d\n", iter->key->utf8().data(), iter->value.branchOffset);
+            out.printf("      }\n");
+            ++i;
+        } while (i < m_rareData->m_stringSwitchJumpTables.size());
+    }
+
+    out.printf("\n");
+}
+
+void CodeBlock::dumpExceptionHandlers(PrintStream& out)
+{
+    if (m_rareData && !m_rareData->m_exceptionHandlers.isEmpty()) {
+        out.printf("\nException Handlers:\n");
+        unsigned i = 0;
+        do {
+            HandlerInfo& handler = m_rareData->m_exceptionHandlers[i];
+            out.printf("\t %d: { start: [%4d] end: [%4d] target: [%4d] } %s\n",
+                i + 1, handler.start, handler.end, handler.target, handler.typeName());
+            ++i;
+        } while (i < m_rareData->m_exceptionHandlers.size());
+    }
+}
+
+void CodeBlock::beginDumpProfiling(PrintStream& out, bool& hasPrintedProfiling)
+{
+    if (hasPrintedProfiling) {
+        out.print("; ");
+        return;
+    }
+    
+    out.print("    ");
+    hasPrintedProfiling = true;
+}
+
+void CodeBlock::dumpValueProfiling(PrintStream& out, const Instruction*& it, bool& hasPrintedProfiling)
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    ++it;
+    CString description = it->u.profile->briefDescription(locker);
+    if (!description.length())
+        return;
+    beginDumpProfiling(out, hasPrintedProfiling);
+    out.print(description);
+}
+
+void CodeBlock::dumpArrayProfiling(PrintStream& out, const Instruction*& it, bool& hasPrintedProfiling)
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    ++it;
+    if (!it->u.arrayProfile)
+        return;
+    CString description = it->u.arrayProfile->briefDescription(locker, this);
+    if (!description.length())
+        return;
+    beginDumpProfiling(out, hasPrintedProfiling);
+    out.print(description);
+}
+
+void CodeBlock::dumpRareCaseProfile(PrintStream& out, const char* name, RareCaseProfile* profile, bool& hasPrintedProfiling)
+{
+    if (!profile || !profile->m_counter)
+        return;
+
+    beginDumpProfiling(out, hasPrintedProfiling);
+    out.print(name, profile->m_counter);
+}
+
+void CodeBlock::dumpArithProfile(PrintStream& out, ArithProfile* profile, bool& hasPrintedProfiling)
+{
+    if (!profile)
+        return;
+    
+    beginDumpProfiling(out, hasPrintedProfiling);
+    out.print("results: ", *profile);
+}
+
+void CodeBlock::printLocationAndOp(PrintStream& out, ExecState*, int location, const Instruction*&, const char* op)
+{
+    out.printf("[%4d] %-17s ", location, op);
+}
+
+void CodeBlock::printLocationOpAndRegisterOperand(PrintStream& out, ExecState* exec, int location, const Instruction*& it, const char* op, int operand)
+{
+    printLocationAndOp(out, exec, location, it, op);
+    out.printf("%s", registerName(operand).data());
+}
+
+void CodeBlock::dumpBytecode(
+    PrintStream& out, ExecState* exec, const Instruction* begin, const Instruction*& it,
+    const StubInfoMap& stubInfos, const CallLinkInfoMap& callLinkInfos)
+{
+    int location = it - begin;
+    bool hasPrintedProfiling = false;
+    OpcodeID opcode = exec->interpreter()->getOpcodeID(it->u.opcode);
+    switch (opcode) {
+        case op_enter: {
+            printLocationAndOp(out, exec, location, it, "enter");
+            break;
+        }
+        case op_get_scope: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "get_scope", r0);
+            break;
+        }
+        case op_create_direct_arguments: {
+            int r0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "create_direct_arguments");
+            out.printf("%s", registerName(r0).data());
+            break;
+        }
+        case op_create_scoped_arguments: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "create_scoped_arguments");
+            out.printf("%s, %s", registerName(r0).data(), registerName(r1).data());
+            break;
+        }
+        case op_create_cloned_arguments: {
+            int r0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "create_cloned_arguments");
+            out.printf("%s", registerName(r0).data());
+            break;
+        }
+        case op_argument_count: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "argument_count", r0);
+            break;
+        }
+        case op_get_argument: {
+            int r0 = (++it)->u.operand;
+            int index = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "argument", r0);
+            out.printf(", %d", index);
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_create_rest: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            unsigned argumentOffset = (++it)->u.unsignedValue;
+            printLocationAndOp(out, exec, location, it, "create_rest");
+            out.printf("%s, %s, ", registerName(r0).data(), registerName(r1).data());
+            out.printf("ArgumentsOffset: %u", argumentOffset);
+            break;
+        }
+        case op_get_rest_length: {
+            int r0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "get_rest_length");
+            out.printf("%s, ", registerName(r0).data());
+            unsigned argumentOffset = (++it)->u.unsignedValue;
+            out.printf("ArgumentsOffset: %u", argumentOffset);
+            break;
+        }
+        case op_create_this: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            unsigned inferredInlineCapacity = (++it)->u.operand;
+            unsigned cachedFunction = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "create_this");
+            out.printf("%s, %s, %u, %u", registerName(r0).data(), registerName(r1).data(), inferredInlineCapacity, cachedFunction);
+            break;
+        }
+        case op_to_this: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "to_this", r0);
+            Structure* structure = (++it)->u.structure.get();
+            if (structure)
+                out.print(", cache(struct = ", RawPointer(structure), ")");
+            out.print(", ", (++it)->u.toThisStatus);
+            break;
+        }
+        case op_check_tdz: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "op_check_tdz", r0);
+            break;
+        }
+        case op_new_object: {
+            int r0 = (++it)->u.operand;
+            unsigned inferredInlineCapacity = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_object");
+            out.printf("%s, %u", registerName(r0).data(), inferredInlineCapacity);
+            ++it; // Skip object allocation profile.
+            break;
+        }
+        case op_new_array: {
+            int dst = (++it)->u.operand;
+            int argv = (++it)->u.operand;
+            int argc = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_array");
+            out.printf("%s, %s, %d", registerName(dst).data(), registerName(argv).data(), argc);
+            ++it; // Skip array allocation profile.
+            break;
+        }
+        case op_new_array_with_spread: {
+            int dst = (++it)->u.operand;
+            int argv = (++it)->u.operand;
+            int argc = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_array_with_spread");
+            out.printf("%s, %s, %d, ", registerName(dst).data(), registerName(argv).data(), argc);
+            unsigned bitVectorIndex = (++it)->u.unsignedValue;
+            const BitVector& bitVector = m_unlinkedCode->bitVector(bitVectorIndex);
+            out.print("BitVector:", bitVectorIndex, ":");
+            for (unsigned i = 0; i < static_cast<unsigned>(argc); i++) {
+                if (bitVector.get(i))
+                    out.print("1");
+                else
+                    out.print("0");
+            }
+            break;
+        }
+        case op_spread: {
+            int dst = (++it)->u.operand;
+            int arg = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "spread");
+            out.printf("%s, %s", registerName(dst).data(), registerName(arg).data());
+            break;
+        }
+        case op_new_array_with_size: {
+            int dst = (++it)->u.operand;
+            int length = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_array_with_size");
+            out.printf("%s, %s", registerName(dst).data(), registerName(length).data());
+            ++it; // Skip array allocation profile.
+            break;
+        }
+        case op_new_array_buffer: {
+            int dst = (++it)->u.operand;
+            int argv = (++it)->u.operand;
+            int argc = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_array_buffer");
+            out.printf("%s, %d, %d", registerName(dst).data(), argv, argc);
+            ++it; // Skip array allocation profile.
+            break;
+        }
+        case op_new_regexp: {
+            int r0 = (++it)->u.operand;
+            int re0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_regexp");
+            out.printf("%s, ", registerName(r0).data());
+            if (r0 >=0 && r0 < (int)m_unlinkedCode->numberOfRegExps())
+                out.printf("%s", regexpName(re0, regexp(re0)).data());
+            else
+                out.printf("bad_regexp(%d)", re0);
+            break;
+        }
+        case op_mov: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "mov");
+            out.printf("%s, %s", registerName(r0).data(), registerName(r1).data());
+            break;
+        }
+        case op_profile_type: {
+            int r0 = (++it)->u.operand;
+            ++it;
+            ++it;
+            ++it;
+            ++it;
+            printLocationAndOp(out, exec, location, it, "op_profile_type");
+            out.printf("%s", registerName(r0).data());
+            break;
+        }
+        case op_profile_control_flow: {
+            BasicBlockLocation* basicBlockLocation = (++it)->u.basicBlockLocation;
+            printLocationAndOp(out, exec, location, it, "profile_control_flow");
+            out.printf("[%d, %d]", basicBlockLocation->startOffset(), basicBlockLocation->endOffset());
+            break;
+        }
+        case op_not: {
+            printUnaryOp(out, exec, location, it, "not");
+            break;
+        }
+        case op_eq: {
+            printBinaryOp(out, exec, location, it, "eq");
+            break;
+        }
+        case op_eq_null: {
+            printUnaryOp(out, exec, location, it, "eq_null");
+            break;
+        }
+        case op_neq: {
+            printBinaryOp(out, exec, location, it, "neq");
+            break;
+        }
+        case op_neq_null: {
+            printUnaryOp(out, exec, location, it, "neq_null");
+            break;
+        }
+        case op_stricteq: {
+            printBinaryOp(out, exec, location, it, "stricteq");
+            break;
+        }
+        case op_nstricteq: {
+            printBinaryOp(out, exec, location, it, "nstricteq");
+            break;
+        }
+        case op_less: {
+            printBinaryOp(out, exec, location, it, "less");
+            break;
+        }
+        case op_lesseq: {
+            printBinaryOp(out, exec, location, it, "lesseq");
+            break;
+        }
+        case op_greater: {
+            printBinaryOp(out, exec, location, it, "greater");
+            break;
+        }
+        case op_greatereq: {
+            printBinaryOp(out, exec, location, it, "greatereq");
+            break;
+        }
+        case op_inc: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "inc", r0);
+            break;
+        }
+        case op_dec: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "dec", r0);
+            break;
+        }
+        case op_to_number: {
+            printUnaryOp(out, exec, location, it, "to_number");
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_to_string: {
+            printUnaryOp(out, exec, location, it, "to_string");
+            break;
+        }
+        case op_negate: {
+            printUnaryOp(out, exec, location, it, "negate");
+            ++it; // op_negate has an extra operand for the ArithProfile.
+            break;
+        }
+        case op_add: {
+            printBinaryOp(out, exec, location, it, "add");
+            ++it;
+            break;
+        }
+        case op_mul: {
+            printBinaryOp(out, exec, location, it, "mul");
+            ++it;
+            break;
+        }
+        case op_div: {
+            printBinaryOp(out, exec, location, it, "div");
+            ++it;
+            break;
+        }
+        case op_mod: {
+            printBinaryOp(out, exec, location, it, "mod");
+            break;
+        }
+        case op_pow: {
+            printBinaryOp(out, exec, location, it, "pow");
+            break;
+        }
+        case op_sub: {
+            printBinaryOp(out, exec, location, it, "sub");
+            ++it;
+            break;
+        }
+        case op_lshift: {
+            printBinaryOp(out, exec, location, it, "lshift");
+            break;            
+        }
+        case op_rshift: {
+            printBinaryOp(out, exec, location, it, "rshift");
+            break;
+        }
+        case op_urshift: {
+            printBinaryOp(out, exec, location, it, "urshift");
+            break;
+        }
+        case op_bitand: {
+            printBinaryOp(out, exec, location, it, "bitand");
+            ++it;
+            break;
+        }
+        case op_bitxor: {
+            printBinaryOp(out, exec, location, it, "bitxor");
+            ++it;
+            break;
+        }
+        case op_bitor: {
+            printBinaryOp(out, exec, location, it, "bitor");
+            ++it;
+            break;
+        }
+        case op_overrides_has_instance: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "overrides_has_instance");
+            out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data());
+            break;
+        }
+        case op_instanceof: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "instanceof");
+            out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data());
+            break;
+        }
+        case op_instanceof_custom: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            int r3 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "instanceof_custom");
+            out.printf("%s, %s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data(), registerName(r3).data());
+            break;
+        }
+        case op_unsigned: {
+            printUnaryOp(out, exec, location, it, "unsigned");
+            break;
+        }
+        case op_typeof: {
+            printUnaryOp(out, exec, location, it, "typeof");
+            break;
+        }
+        case op_is_empty: {
+            printUnaryOp(out, exec, location, it, "is_empty");
+            break;
+        }
+        case op_is_undefined: {
+            printUnaryOp(out, exec, location, it, "is_undefined");
+            break;
+        }
+        case op_is_boolean: {
+            printUnaryOp(out, exec, location, it, "is_boolean");
+            break;
+        }
+        case op_is_number: {
+            printUnaryOp(out, exec, location, it, "is_number");
+            break;
+        }
+        case op_is_cell_with_type: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int type = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "is_cell_with_type");
+            out.printf("%s, %s, %d", registerName(r0).data(), registerName(r1).data(), type);
+            break;
+        }
+        case op_is_object: {
+            printUnaryOp(out, exec, location, it, "is_object");
+            break;
+        }
+        case op_is_object_or_null: {
+            printUnaryOp(out, exec, location, it, "is_object_or_null");
+            break;
+        }
+        case op_is_function: {
+            printUnaryOp(out, exec, location, it, "is_function");
+            break;
+        }
+        case op_in: {
+            printBinaryOp(out, exec, location, it, "in");
+            break;
+        }
+        case op_try_get_by_id: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "try_get_by_id");
+            out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), idName(id0, identifier(id0)).data());
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_get_by_id:
+        case op_get_by_id_proto_load:
+        case op_get_by_id_unset:
+        case op_get_array_length: {
+            printGetByIdOp(out, exec, location, it);
+            printGetByIdCacheStatus(out, exec, location, stubInfos);
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_get_by_id_with_this: {
+            printLocationAndOp(out, exec, location, it, "get_by_id_with_this");
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            out.printf("%s, %s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data(), idName(id0, identifier(id0)).data());
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_get_by_val_with_this: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            int r3 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "get_by_val_with_this");
+            out.printf("%s, %s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data(), registerName(r3).data());
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_put_by_id: {
+            printPutByIdOp(out, exec, location, it, "put_by_id");
+            printPutByIdCacheStatus(out, location, stubInfos);
+            break;
+        }
+        case op_put_by_id_with_this: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_by_id_with_this");
+            out.printf("%s, %s, %s, %s", registerName(r0).data(), registerName(r1).data(), idName(id0, identifier(id0)).data(), registerName(r2).data());
+            break;
+        }
+        case op_put_by_val_with_this: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            int r3 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_by_val_with_this");
+            out.printf("%s, %s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data(), registerName(r3).data());
+            break;
+        }
+        case op_put_getter_by_id: {
+            int r0 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            int n0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_getter_by_id");
+            out.printf("%s, %s, %d, %s", registerName(r0).data(), idName(id0, identifier(id0)).data(), n0, registerName(r1).data());
+            break;
+        }
+        case op_put_setter_by_id: {
+            int r0 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            int n0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_setter_by_id");
+            out.printf("%s, %s, %d, %s", registerName(r0).data(), idName(id0, identifier(id0)).data(), n0, registerName(r1).data());
+            break;
+        }
+        case op_put_getter_setter_by_id: {
+            int r0 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            int n0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_getter_setter_by_id");
+            out.printf("%s, %s, %d, %s, %s", registerName(r0).data(), idName(id0, identifier(id0)).data(), n0, registerName(r1).data(), registerName(r2).data());
+            break;
+        }
+        case op_put_getter_by_val: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int n0 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_getter_by_val");
+            out.printf("%s, %s, %d, %s", registerName(r0).data(), registerName(r1).data(), n0, registerName(r2).data());
+            break;
+        }
+        case op_put_setter_by_val: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int n0 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_setter_by_val");
+            out.printf("%s, %s, %d, %s", registerName(r0).data(), registerName(r1).data(), n0, registerName(r2).data());
+            break;
+        }
+        case op_define_data_property: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            int r3 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "define_data_property");
+            out.printf("%s, %s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data(), registerName(r3).data());
+            break;
+        }
+        case op_define_accessor_property: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            int r3 = (++it)->u.operand;
+            int r4 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "define_accessor_property");
+            out.printf("%s, %s, %s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data(), registerName(r3).data(), registerName(r4).data());
+            break;
+        }
+        case op_del_by_id: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "del_by_id");
+            out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), idName(id0, identifier(id0)).data());
+            break;
+        }
+        case op_get_by_val: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "get_by_val");
+            out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data());
+            dumpArrayProfiling(out, it, hasPrintedProfiling);
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_put_by_val: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_by_val");
+            out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data());
+            dumpArrayProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_put_by_val_direct: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_by_val_direct");
+            out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data());
+            dumpArrayProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_del_by_val: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "del_by_val");
+            out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), registerName(r2).data());
+            break;
+        }
+        case op_put_by_index: {
+            int r0 = (++it)->u.operand;
+            unsigned n0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_by_index");
+            out.printf("%s, %u, %s", registerName(r0).data(), n0, registerName(r1).data());
+            break;
+        }
+        case op_jmp: {
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jmp");
+            out.printf("%d(->%d)", offset, location + offset);
+            break;
+        }
+        case op_jtrue: {
+            printConditionalJump(out, exec, begin, it, location, "jtrue");
+            break;
+        }
+        case op_jfalse: {
+            printConditionalJump(out, exec, begin, it, location, "jfalse");
+            break;
+        }
+        case op_jeq_null: {
+            printConditionalJump(out, exec, begin, it, location, "jeq_null");
+            break;
+        }
+        case op_jneq_null: {
+            printConditionalJump(out, exec, begin, it, location, "jneq_null");
+            break;
+        }
+        case op_jneq_ptr: {
+            int r0 = (++it)->u.operand;
+            Special::Pointer pointer = (++it)->u.specialPointer;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jneq_ptr");
+            out.printf("%s, %d (%p), %d(->%d)", registerName(r0).data(), pointer, m_globalObject->actualPointerFor(pointer), offset, location + offset);
+            ++it;
+            break;
+        }
+        case op_jless: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jless");
+            out.printf("%s, %s, %d(->%d)", registerName(r0).data(), registerName(r1).data(), offset, location + offset);
+            break;
+        }
+        case op_jlesseq: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jlesseq");
+            out.printf("%s, %s, %d(->%d)", registerName(r0).data(), registerName(r1).data(), offset, location + offset);
+            break;
+        }
+        case op_jgreater: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jgreater");
+            out.printf("%s, %s, %d(->%d)", registerName(r0).data(), registerName(r1).data(), offset, location + offset);
+            break;
+        }
+        case op_jgreatereq: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jgreatereq");
+            out.printf("%s, %s, %d(->%d)", registerName(r0).data(), registerName(r1).data(), offset, location + offset);
+            break;
+        }
+        case op_jnless: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jnless");
+            out.printf("%s, %s, %d(->%d)", registerName(r0).data(), registerName(r1).data(), offset, location + offset);
+            break;
+        }
+        case op_jnlesseq: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jnlesseq");
+            out.printf("%s, %s, %d(->%d)", registerName(r0).data(), registerName(r1).data(), offset, location + offset);
+            break;
+        }
+        case op_jngreater: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jngreater");
+            out.printf("%s, %s, %d(->%d)", registerName(r0).data(), registerName(r1).data(), offset, location + offset);
+            break;
+        }
+        case op_jngreatereq: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "jngreatereq");
+            out.printf("%s, %s, %d(->%d)", registerName(r0).data(), registerName(r1).data(), offset, location + offset);
+            break;
+        }
+        case op_loop_hint: {
+            printLocationAndOp(out, exec, location, it, "loop_hint");
+            break;
+        }
+        case op_watchdog: {
+            printLocationAndOp(out, exec, location, it, "watchdog");
+            break;
+        }
+        case op_log_shadow_chicken_prologue: {
+            int r0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "log_shadow_chicken_prologue");
+            out.printf("%s", registerName(r0).data());
+            break;
+        }
+        case op_log_shadow_chicken_tail: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "log_shadow_chicken_tail");
+            out.printf("%s, %s", registerName(r0).data(), registerName(r1).data());
+            break;
+        }
+        case op_switch_imm: {
+            int tableIndex = (++it)->u.operand;
+            int defaultTarget = (++it)->u.operand;
+            int scrutineeRegister = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "switch_imm");
+            out.printf("%d, %d(->%d), %s", tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).data());
+            break;
+        }
+        case op_switch_char: {
+            int tableIndex = (++it)->u.operand;
+            int defaultTarget = (++it)->u.operand;
+            int scrutineeRegister = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "switch_char");
+            out.printf("%d, %d(->%d), %s", tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).data());
+            break;
+        }
+        case op_switch_string: {
+            int tableIndex = (++it)->u.operand;
+            int defaultTarget = (++it)->u.operand;
+            int scrutineeRegister = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "switch_string");
+            out.printf("%d, %d(->%d), %s", tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).data());
+            break;
+        }
+        case op_new_func: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int f0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_func");
+            out.printf("%s, %s, f%d", registerName(r0).data(), registerName(r1).data(), f0);
+            break;
+        }
+        case op_new_generator_func: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int f0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_generator_func");
+            out.printf("%s, %s, f%d", registerName(r0).data(), registerName(r1).data(), f0);
+            break;
+        }
+        case op_new_async_func: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int f0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_async_func");
+            out.printf("%s, %s, f%d", registerName(r0).data(), registerName(r1).data(), f0);
+            break;
+        }
+        case op_new_func_exp: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int f0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_func_exp");
+            out.printf("%s, %s, f%d", registerName(r0).data(), registerName(r1).data(), f0);
+            break;
+        }
+        case op_new_generator_func_exp: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int f0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_generator_func_exp");
+            out.printf("%s, %s, f%d", registerName(r0).data(), registerName(r1).data(), f0);
+            break;
+        }
+        case op_new_async_func_exp: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int f0 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "new_async_func_exp");
+            out.printf("%s, %s, f%d", registerName(r0).data(), registerName(r1).data(), f0);
+            break;
+        }
+        case op_set_function_name: {
+            int funcReg = (++it)->u.operand;
+            int nameReg = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "set_function_name");
+            out.printf("%s, %s", registerName(funcReg).data(), registerName(nameReg).data());
+            break;
+        }
+        case op_call: {
+            printCallOp(out, exec, location, it, "call", DumpCaches, hasPrintedProfiling, callLinkInfos);
+            break;
+        }
+        case op_tail_call: {
+            printCallOp(out, exec, location, it, "tail_call", DumpCaches, hasPrintedProfiling, callLinkInfos);
+            break;
+        }
+        case op_call_eval: {
+            printCallOp(out, exec, location, it, "call_eval", DontDumpCaches, hasPrintedProfiling, callLinkInfos);
+            break;
+        }
+            
+        case op_construct_varargs:
+        case op_call_varargs:
+        case op_tail_call_varargs:
+        case op_tail_call_forward_arguments: {
+            int result = (++it)->u.operand;
+            int callee = (++it)->u.operand;
+            int thisValue = (++it)->u.operand;
+            int arguments = (++it)->u.operand;
+            int firstFreeRegister = (++it)->u.operand;
+            int varArgOffset = (++it)->u.operand;
+            ++it;
+            const char* opName;
+            if (opcode == op_call_varargs)
+                opName = "call_varargs";
+            else if (opcode == op_construct_varargs)
+                opName = "construct_varargs";
+            else if (opcode == op_tail_call_varargs)
+                opName = "tail_call_varargs";
+            else if (opcode == op_tail_call_forward_arguments)
+                opName = "tail_call_forward_arguments";
+            else
+                RELEASE_ASSERT_NOT_REACHED();
+
+            printLocationAndOp(out, exec, location, it, opName);
+            out.printf("%s, %s, %s, %s, %d, %d", registerName(result).data(), registerName(callee).data(), registerName(thisValue).data(), registerName(arguments).data(), firstFreeRegister, varArgOffset);
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+
+        case op_ret: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "ret", r0);
+            break;
+        }
+        case op_construct: {
+            printCallOp(out, exec, location, it, "construct", DumpCaches, hasPrintedProfiling, callLinkInfos);
+            break;
+        }
+        case op_strcat: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int count = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "strcat");
+            out.printf("%s, %s, %d", registerName(r0).data(), registerName(r1).data(), count);
+            break;
+        }
+        case op_to_primitive: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "to_primitive");
+            out.printf("%s, %s", registerName(r0).data(), registerName(r1).data());
+            break;
+        }
+        case op_get_enumerable_length: {
+            int dst = it[1].u.operand;
+            int base = it[2].u.operand;
+            printLocationAndOp(out, exec, location, it, "op_get_enumerable_length");
+            out.printf("%s, %s", registerName(dst).data(), registerName(base).data());
+            it += OPCODE_LENGTH(op_get_enumerable_length) - 1;
+            break;
+        }
+        case op_has_indexed_property: {
+            int dst = it[1].u.operand;
+            int base = it[2].u.operand;
+            int propertyName = it[3].u.operand;
+            ArrayProfile* arrayProfile = it[4].u.arrayProfile;
+            printLocationAndOp(out, exec, location, it, "op_has_indexed_property");
+            out.printf("%s, %s, %s, %p", registerName(dst).data(), registerName(base).data(), registerName(propertyName).data(), arrayProfile);
+            it += OPCODE_LENGTH(op_has_indexed_property) - 1;
+            break;
+        }
+        case op_has_structure_property: {
+            int dst = it[1].u.operand;
+            int base = it[2].u.operand;
+            int propertyName = it[3].u.operand;
+            int enumerator = it[4].u.operand;
+            printLocationAndOp(out, exec, location, it, "op_has_structure_property");
+            out.printf("%s, %s, %s, %s", registerName(dst).data(), registerName(base).data(), registerName(propertyName).data(), registerName(enumerator).data());
+            it += OPCODE_LENGTH(op_has_structure_property) - 1;
+            break;
+        }
+        case op_has_generic_property: {
+            int dst = it[1].u.operand;
+            int base = it[2].u.operand;
+            int propertyName = it[3].u.operand;
+            printLocationAndOp(out, exec, location, it, "op_has_generic_property");
+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(base).data(), registerName(propertyName).data());
+            it += OPCODE_LENGTH(op_has_generic_property) - 1;
+            break;
+        }
+        case op_get_direct_pname: {
+            int dst = it[1].u.operand;
+            int base = it[2].u.operand;
+            int propertyName = it[3].u.operand;
+            int index = it[4].u.operand;
+            int enumerator = it[5].u.operand;
+            ValueProfile* profile = it[6].u.profile;
+            printLocationAndOp(out, exec, location, it, "op_get_direct_pname");
+            out.printf("%s, %s, %s, %s, %s, %p", registerName(dst).data(), registerName(base).data(), registerName(propertyName).data(), registerName(index).data(), registerName(enumerator).data(), profile);
+            it += OPCODE_LENGTH(op_get_direct_pname) - 1;
+            break;
+
+        }
+        case op_get_property_enumerator: {
+            int dst = it[1].u.operand;
+            int base = it[2].u.operand;
+            printLocationAndOp(out, exec, location, it, "op_get_property_enumerator");
+            out.printf("%s, %s", registerName(dst).data(), registerName(base).data());
+            it += OPCODE_LENGTH(op_get_property_enumerator) - 1;
+            break;
+        }
+        case op_enumerator_structure_pname: {
+            int dst = it[1].u.operand;
+            int enumerator = it[2].u.operand;
+            int index = it[3].u.operand;
+            printLocationAndOp(out, exec, location, it, "op_enumerator_structure_pname");
+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(enumerator).data(), registerName(index).data());
+            it += OPCODE_LENGTH(op_enumerator_structure_pname) - 1;
+            break;
+        }
+        case op_enumerator_generic_pname: {
+            int dst = it[1].u.operand;
+            int enumerator = it[2].u.operand;
+            int index = it[3].u.operand;
+            printLocationAndOp(out, exec, location, it, "op_enumerator_generic_pname");
+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(enumerator).data(), registerName(index).data());
+            it += OPCODE_LENGTH(op_enumerator_generic_pname) - 1;
+            break;
+        }
+        case op_to_index_string: {
+            int dst = it[1].u.operand;
+            int index = it[2].u.operand;
+            printLocationAndOp(out, exec, location, it, "op_to_index_string");
+            out.printf("%s, %s", registerName(dst).data(), registerName(index).data());
+            it += OPCODE_LENGTH(op_to_index_string) - 1;
+            break;
+        }
+        case op_push_with_scope: {
+            int dst = (++it)->u.operand;
+            int newScope = (++it)->u.operand;
+            int currentScope = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "push_with_scope");
+            out.printf("%s, %s, %s", registerName(dst).data(), registerName(newScope).data(), registerName(currentScope).data());
+            break;
+        }
+        case op_get_parent_scope: {
+            int dst = (++it)->u.operand;
+            int parentScope = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "get_parent_scope");
+            out.printf("%s, %s", registerName(dst).data(), registerName(parentScope).data());
+            break;
+        }
+        case op_create_lexical_environment: {
+            int dst = (++it)->u.operand;
+            int scope = (++it)->u.operand;
+            int symbolTable = (++it)->u.operand;
+            int initialValue = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "create_lexical_environment");
+            out.printf("%s, %s, %s, %s", 
+                registerName(dst).data(), registerName(scope).data(), registerName(symbolTable).data(), registerName(initialValue).data());
+            break;
+        }
+        case op_catch: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "catch");
+            out.printf("%s, %s", registerName(r0).data(), registerName(r1).data());
+            break;
+        }
+        case op_throw: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "throw", r0);
+            break;
+        }
+        case op_throw_static_error: {
+            int k0 = (++it)->u.operand;
+            ErrorType k1 = static_cast<ErrorType>((++it)->u.unsignedValue);
+            printLocationAndOp(out, exec, location, it, "throw_static_error");
+            out.printf("%s, ", constantName(k0).data());
+            out.print(k1);
+            break;
+        }
+        case op_debug: {
+            int debugHookType = (++it)->u.operand;
+            int hasBreakpointFlag = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "debug");
+            out.printf("%s, %d", debugHookName(debugHookType), hasBreakpointFlag);
+            break;
+        }
+        case op_assert: {
+            int condition = (++it)->u.operand;
+            int line = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "assert");
+            out.printf("%s, %d", registerName(condition).data(), line);
+            break;
+        }
+        case op_end: {
+            int r0 = (++it)->u.operand;
+            printLocationOpAndRegisterOperand(out, exec, location, it, "end", r0);
+            break;
+        }
+        case op_resolve_scope: {
+            int r0 = (++it)->u.operand;
+            int scope = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            ResolveType resolveType = static_cast<ResolveType>((++it)->u.operand);
+            int depth = (++it)->u.operand;
+            void* pointer = (++it)->u.pointer;
+            printLocationAndOp(out, exec, location, it, "resolve_scope");
+            out.printf("%s, %s, %s, <%s>, %d, %p", registerName(r0).data(), registerName(scope).data(), idName(id0, identifier(id0)).data(), resolveTypeName(resolveType), depth, pointer);
+            break;
+        }
+        case op_get_from_scope: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            GetPutInfo getPutInfo = GetPutInfo((++it)->u.operand);
+            ++it; // Structure
+            int operand = (++it)->u.operand; // Operand
+            printLocationAndOp(out, exec, location, it, "get_from_scope");
+            out.print(registerName(r0), ", ", registerName(r1));
+            if (static_cast<unsigned>(id0) == UINT_MAX)
+                out.print(", anonymous");
+            else
+                out.print(", ", idName(id0, identifier(id0)));
+            out.print(", ", getPutInfo.operand(), "<", resolveModeName(getPutInfo.resolveMode()), "|", resolveTypeName(getPutInfo.resolveType()), "|", initializationModeName(getPutInfo.initializationMode()), ">, ", operand);
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_put_to_scope: {
+            int r0 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            GetPutInfo getPutInfo = GetPutInfo((++it)->u.operand);
+            ++it; // Structure
+            int operand = (++it)->u.operand; // Operand
+            printLocationAndOp(out, exec, location, it, "put_to_scope");
+            out.print(registerName(r0));
+            if (static_cast<unsigned>(id0) == UINT_MAX)
+                out.print(", anonymous");
+            else
+                out.print(", ", idName(id0, identifier(id0)));
+            out.print(", ", registerName(r1), ", ", getPutInfo.operand(), "<", resolveModeName(getPutInfo.resolveMode()), "|", resolveTypeName(getPutInfo.resolveType()), "|", initializationModeName(getPutInfo.initializationMode()), ">, <structure>, ", operand);
+            break;
+        }
+        case op_get_from_arguments: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "get_from_arguments");
+            out.printf("%s, %s, %d", registerName(r0).data(), registerName(r1).data(), offset);
+            dumpValueProfiling(out, it, hasPrintedProfiling);
+            break;
+        }
+        case op_put_to_arguments: {
+            int r0 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printLocationAndOp(out, exec, location, it, "put_to_arguments");
+            out.printf("%s, %d, %s", registerName(r0).data(), offset, registerName(r1).data());
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    dumpRareCaseProfile(out, "rare case: ", rareCaseProfileForBytecodeOffset(location), hasPrintedProfiling);
+    {
+        dumpArithProfile(out, arithProfileForBytecodeOffset(location), hasPrintedProfiling);
+    }
+    
+#if ENABLE(DFG_JIT)
+    Vector<DFG::FrequentExitSite> exitSites = exitProfile().exitSitesFor(location);
+    if (!exitSites.isEmpty()) {
+        out.print(" !! frequent exits: ");
+        CommaPrinter comma;
+        for (unsigned i = 0; i < exitSites.size(); ++i)
+            out.print(comma, exitSites[i].kind(), " ", exitSites[i].jitType());
+    }
+#else // ENABLE(DFG_JIT)
+    UNUSED_PARAM(location);
+#endif // ENABLE(DFG_JIT)
+    out.print("\n");
+}
+
+void CodeBlock::dumpBytecode(
+    PrintStream& out, unsigned bytecodeOffset,
+    const StubInfoMap& stubInfos, const CallLinkInfoMap& callLinkInfos)
+{
+    ExecState* exec = m_globalObject->globalExec();
+    const Instruction* it = instructions().begin() + bytecodeOffset;
+    dumpBytecode(out, exec, instructions().begin(), it, stubInfos, callLinkInfos);
+}
+
+#define FOR_EACH_MEMBER_VECTOR(macro) \
+    macro(instructions) \
+    macro(callLinkInfos) \
+    macro(linkedCallerList) \
+    macro(identifiers) \
+    macro(functionExpressions) \
+    macro(constantRegisters)
+
+template<typename T>
+static size_t sizeInBytes(const Vector<T>& vector)
+{
+    return vector.capacity() * sizeof(T);
+}
+
+namespace {
+
+class PutToScopeFireDetail : public FireDetail {
+public:
+    PutToScopeFireDetail(CodeBlock* codeBlock, const Identifier& ident)
+        : m_codeBlock(codeBlock)
+        , m_ident(ident)
+    {
+    }
+    
+    void dump(PrintStream& out) const override
+    {
+        out.print("Linking put_to_scope in ", FunctionExecutableDump(jsCast<FunctionExecutable*>(m_codeBlock->ownerExecutable())), " for ", m_ident);
+    }
+    
+private:
+    CodeBlock* m_codeBlock;
+    const Identifier& m_ident;
+};
+
+} // anonymous namespace
+
+CodeBlock::CodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, CodeBlock& other)
+    : JSCell(*vm, structure)
+    , m_globalObject(other.m_globalObject)
+    , m_numCalleeLocals(other.m_numCalleeLocals)
+    , m_numVars(other.m_numVars)
+    , m_shouldAlwaysBeInlined(true)
+#if ENABLE(JIT)
+    , m_capabilityLevelState(DFG::CapabilityLevelNotSet)
+#endif
+    , m_didFailJITCompilation(false)
+    , m_didFailFTLCompilation(false)
+    , m_hasBeenCompiledWithFTL(false)
+    , m_isConstructor(other.m_isConstructor)
+    , m_isStrictMode(other.m_isStrictMode)
+    , m_codeType(other.m_codeType)
+    , m_unlinkedCode(*other.m_vm, this, other.m_unlinkedCode.get())
+    , m_hasDebuggerStatement(false)
+    , m_steppingMode(SteppingModeDisabled)
+    , m_numBreakpoints(0)
+    , m_ownerExecutable(*other.m_vm, this, other.m_ownerExecutable.get())
+    , m_vm(other.m_vm)
+    , m_instructions(other.m_instructions)
+    , m_thisRegister(other.m_thisRegister)
+    , m_scopeRegister(other.m_scopeRegister)
+    , m_hash(other.m_hash)
+    , m_source(other.m_source)
+    , m_sourceOffset(other.m_sourceOffset)
+    , m_firstLineColumnOffset(other.m_firstLineColumnOffset)
+    , m_constantRegisters(other.m_constantRegisters)
+    , m_constantsSourceCodeRepresentation(other.m_constantsSourceCodeRepresentation)
+    , m_functionDecls(other.m_functionDecls)
+    , m_functionExprs(other.m_functionExprs)
+    , m_osrExitCounter(0)
+    , m_optimizationDelayCounter(0)
+    , m_reoptimizationRetryCounter(0)
+    , m_creationTime(std::chrono::steady_clock::now())
+{
+    m_visitWeaklyHasBeenCalled = false;
+
+    ASSERT(heap()->isDeferred());
+    ASSERT(m_scopeRegister.isLocal());
+
+    setNumParameters(other.numParameters());
+}
+
+void CodeBlock::finishCreation(VM& vm, CopyParsedBlockTag, CodeBlock& other)
+{
+    Base::finishCreation(vm);
+
+    optimizeAfterWarmUp();
+    jitAfterWarmUp();
+
+    if (other.m_rareData) {
+        createRareDataIfNecessary();
+        
+        m_rareData->m_exceptionHandlers = other.m_rareData->m_exceptionHandlers;
+        m_rareData->m_constantBuffers = other.m_rareData->m_constantBuffers;
+        m_rareData->m_switchJumpTables = other.m_rareData->m_switchJumpTables;
+        m_rareData->m_stringSwitchJumpTables = other.m_rareData->m_stringSwitchJumpTables;
+    }
+    
+    heap()->m_codeBlocks->add(this);
+}
+
+CodeBlock::CodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,
+    JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+    : JSCell(*vm, structure)
+    , m_globalObject(scope->globalObject()->vm(), this, scope->globalObject())
+    , m_numCalleeLocals(unlinkedCodeBlock->m_numCalleeLocals)
+    , m_numVars(unlinkedCodeBlock->m_numVars)
+    , m_shouldAlwaysBeInlined(true)
+#if ENABLE(JIT)
+    , m_capabilityLevelState(DFG::CapabilityLevelNotSet)
+#endif
+    , m_didFailJITCompilation(false)
+    , m_didFailFTLCompilation(false)
+    , m_hasBeenCompiledWithFTL(false)
+    , m_isConstructor(unlinkedCodeBlock->isConstructor())
+    , m_isStrictMode(unlinkedCodeBlock->isStrictMode())
+    , m_codeType(unlinkedCodeBlock->codeType())
+    , m_unlinkedCode(m_globalObject->vm(), this, unlinkedCodeBlock)
+    , m_hasDebuggerStatement(false)
+    , m_steppingMode(SteppingModeDisabled)
+    , m_numBreakpoints(0)
+    , m_ownerExecutable(m_globalObject->vm(), this, ownerExecutable)
+    , m_vm(unlinkedCodeBlock->vm())
+    , m_thisRegister(unlinkedCodeBlock->thisRegister())
+    , m_scopeRegister(unlinkedCodeBlock->scopeRegister())
+    , m_source(sourceProvider)
+    , m_sourceOffset(sourceOffset)
+    , m_firstLineColumnOffset(firstLineColumnOffset)
+    , m_osrExitCounter(0)
+    , m_optimizationDelayCounter(0)
+    , m_reoptimizationRetryCounter(0)
+    , m_creationTime(std::chrono::steady_clock::now())
+{
+    m_visitWeaklyHasBeenCalled = false;
+
+    ASSERT(heap()->isDeferred());
+    ASSERT(m_scopeRegister.isLocal());
+
+    ASSERT(m_source);
+    setNumParameters(unlinkedCodeBlock->numParameters());
+}
+
+void CodeBlock::finishCreation(VM& vm, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,
+    JSScope* scope)
+{
+    Base::finishCreation(vm);
+
+    if (vm.typeProfiler() || vm.controlFlowProfiler())
+        vm.functionHasExecutedCache()->removeUnexecutedRange(ownerExecutable->sourceID(), ownerExecutable->typeProfilingStartOffset(), ownerExecutable->typeProfilingEndOffset());
+
+    setConstantRegisters(unlinkedCodeBlock->constantRegisters(), unlinkedCodeBlock->constantsSourceCodeRepresentation());
+    if (unlinkedCodeBlock->usesGlobalObject())
+        m_constantRegisters[unlinkedCodeBlock->globalObjectRegister().toConstantIndex()].set(*m_vm, this, m_globalObject.get());
+
+    for (unsigned i = 0; i < LinkTimeConstantCount; i++) {
+        LinkTimeConstant type = static_cast<LinkTimeConstant>(i);
+        if (unsigned registerIndex = unlinkedCodeBlock->registerIndexForLinkTimeConstant(type))
+            m_constantRegisters[registerIndex].set(*m_vm, this, m_globalObject->jsCellForLinkTimeConstant(type));
+    }
+
+    // We already have the cloned symbol table for the module environment since we need to instantiate
+    // the module environments before linking the code block. We replace the stored symbol table with the already cloned one.
+    if (UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock = jsDynamicCast<UnlinkedModuleProgramCodeBlock*>(unlinkedCodeBlock)) {
+        SymbolTable* clonedSymbolTable = jsCast<ModuleProgramExecutable*>(ownerExecutable)->moduleEnvironmentSymbolTable();
+        if (m_vm->typeProfiler()) {
+            ConcurrentJSLocker locker(clonedSymbolTable->m_lock);
+            clonedSymbolTable->prepareForTypeProfiling(locker);
+        }
+        replaceConstant(unlinkedModuleProgramCodeBlock->moduleEnvironmentSymbolTableConstantRegisterOffset(), clonedSymbolTable);
+    }
+
+    bool shouldUpdateFunctionHasExecutedCache = vm.typeProfiler() || vm.controlFlowProfiler();
+    m_functionDecls = RefCountedArray<WriteBarrier<FunctionExecutable>>(unlinkedCodeBlock->numberOfFunctionDecls());
+    for (size_t count = unlinkedCodeBlock->numberOfFunctionDecls(), i = 0; i < count; ++i) {
+        UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionDecl(i);
+        if (shouldUpdateFunctionHasExecutedCache)
+            vm.functionHasExecutedCache()->insertUnexecutedRange(ownerExecutable->sourceID(), unlinkedExecutable->typeProfilingStartOffset(), unlinkedExecutable->typeProfilingEndOffset());
+        m_functionDecls[i].set(*m_vm, this, unlinkedExecutable->link(*m_vm, ownerExecutable->source()));
+    }
+
+    m_functionExprs = RefCountedArray<WriteBarrier<FunctionExecutable>>(unlinkedCodeBlock->numberOfFunctionExprs());
+    for (size_t count = unlinkedCodeBlock->numberOfFunctionExprs(), i = 0; i < count; ++i) {
+        UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionExpr(i);
+        if (shouldUpdateFunctionHasExecutedCache)
+            vm.functionHasExecutedCache()->insertUnexecutedRange(ownerExecutable->sourceID(), unlinkedExecutable->typeProfilingStartOffset(), unlinkedExecutable->typeProfilingEndOffset());
+        m_functionExprs[i].set(*m_vm, this, unlinkedExecutable->link(*m_vm, ownerExecutable->source()));
+    }
+
+    if (unlinkedCodeBlock->hasRareData()) {
+        createRareDataIfNecessary();
+        if (size_t count = unlinkedCodeBlock->constantBufferCount()) {
+            m_rareData->m_constantBuffers.grow(count);
+            for (size_t i = 0; i < count; i++) {
+                const UnlinkedCodeBlock::ConstantBuffer& buffer = unlinkedCodeBlock->constantBuffer(i);
+                m_rareData->m_constantBuffers[i] = buffer;
+            }
+        }
+        if (size_t count = unlinkedCodeBlock->numberOfExceptionHandlers()) {
+            m_rareData->m_exceptionHandlers.resizeToFit(count);
+            for (size_t i = 0; i < count; i++) {
+                const UnlinkedHandlerInfo& unlinkedHandler = unlinkedCodeBlock->exceptionHandler(i);
+                HandlerInfo& handler = m_rareData->m_exceptionHandlers[i];
+#if ENABLE(JIT)
+                handler.initialize(unlinkedHandler, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(LLInt::getCodePtr(op_catch))));
+#else
+                handler.initialize(unlinkedHandler);
+#endif
+            }
+        }
+
+        if (size_t count = unlinkedCodeBlock->numberOfStringSwitchJumpTables()) {
+            m_rareData->m_stringSwitchJumpTables.grow(count);
+            for (size_t i = 0; i < count; i++) {
+                UnlinkedStringJumpTable::StringOffsetTable::iterator ptr = unlinkedCodeBlock->stringSwitchJumpTable(i).offsetTable.begin();
+                UnlinkedStringJumpTable::StringOffsetTable::iterator end = unlinkedCodeBlock->stringSwitchJumpTable(i).offsetTable.end();
+                for (; ptr != end; ++ptr) {
+                    OffsetLocation offset;
+                    offset.branchOffset = ptr->value.branchOffset;
+                    m_rareData->m_stringSwitchJumpTables[i].offsetTable.add(ptr->key, offset);
+                }
+            }
+        }
+
+        if (size_t count = unlinkedCodeBlock->numberOfSwitchJumpTables()) {
+            m_rareData->m_switchJumpTables.grow(count);
+            for (size_t i = 0; i < count; i++) {
+                UnlinkedSimpleJumpTable& sourceTable = unlinkedCodeBlock->switchJumpTable(i);
+                SimpleJumpTable& destTable = m_rareData->m_switchJumpTables[i];
+                destTable.branchOffsets = sourceTable.branchOffsets;
+                destTable.min = sourceTable.min;
+            }
+        }
+    }
+
+    // Allocate metadata buffers for the bytecode
+    if (size_t size = unlinkedCodeBlock->numberOfLLintCallLinkInfos())
+        m_llintCallLinkInfos = RefCountedArray<LLIntCallLinkInfo>(size);
+    if (size_t size = unlinkedCodeBlock->numberOfArrayProfiles())
+        m_arrayProfiles.grow(size);
+    if (size_t size = unlinkedCodeBlock->numberOfArrayAllocationProfiles())
+        m_arrayAllocationProfiles = RefCountedArray<ArrayAllocationProfile>(size);
+    if (size_t size = unlinkedCodeBlock->numberOfValueProfiles())
+        m_valueProfiles = RefCountedArray<ValueProfile>(size);
+    if (size_t size = unlinkedCodeBlock->numberOfObjectAllocationProfiles())
+        m_objectAllocationProfiles = RefCountedArray<ObjectAllocationProfile>(size);
+
+#if ENABLE(JIT)
+    setCalleeSaveRegisters(RegisterSet::llintBaselineCalleeSaveRegisters());
+#endif
+
+    // Copy and translate the UnlinkedInstructions
+    unsigned instructionCount = unlinkedCodeBlock->instructions().count();
+    UnlinkedInstructionStream::Reader instructionReader(unlinkedCodeBlock->instructions());
+
+    // Bookkeep the strongly referenced module environments.
+    HashSet<JSModuleEnvironment*> stronglyReferencedModuleEnvironments;
+
+    RefCountedArray<Instruction> instructions(instructionCount);
+
+    unsigned valueProfileCount = 0;
+    auto linkValueProfile = [&](unsigned bytecodeOffset, unsigned opLength) {
+        unsigned valueProfileIndex = valueProfileCount++;
+        ValueProfile* profile = &m_valueProfiles[valueProfileIndex];
+        ASSERT(profile->m_bytecodeOffset == -1);
+        profile->m_bytecodeOffset = bytecodeOffset;
+        instructions[bytecodeOffset + opLength - 1] = profile;
+    };
+
+    for (unsigned i = 0; !instructionReader.atEnd(); ) {
+        const UnlinkedInstruction* pc = instructionReader.next();
+
+        unsigned opLength = opcodeLength(pc[0].u.opcode);
+
+        instructions[i] = vm.interpreter->getOpcode(pc[0].u.opcode);
+        for (size_t j = 1; j < opLength; ++j) {
+            if (sizeof(int32_t) != sizeof(intptr_t))
+                instructions[i + j].u.pointer = 0;
+            instructions[i + j].u.operand = pc[j].u.operand;
+        }
+        switch (pc[0].u.opcode) {
+        case op_has_indexed_property: {
+            int arrayProfileIndex = pc[opLength - 1].u.operand;
+            m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
+
+            instructions[i + opLength - 1] = &m_arrayProfiles[arrayProfileIndex];
+            break;
+        }
+        case op_call_varargs:
+        case op_tail_call_varargs:
+        case op_tail_call_forward_arguments:
+        case op_construct_varargs:
+        case op_get_by_val: {
+            int arrayProfileIndex = pc[opLength - 2].u.operand;
+            m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
+
+            instructions[i + opLength - 2] = &m_arrayProfiles[arrayProfileIndex];
+            FALLTHROUGH;
+        }
+        case op_get_direct_pname:
+        case op_get_by_id:
+        case op_get_by_id_with_this:
+        case op_try_get_by_id:
+        case op_get_by_val_with_this:
+        case op_get_from_arguments:
+        case op_to_number:
+        case op_get_argument: {
+            linkValueProfile(i, opLength);
+            break;
+        }
+        case op_put_by_val: {
+            int arrayProfileIndex = pc[opLength - 1].u.operand;
+            m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
+            instructions[i + opLength - 1] = &m_arrayProfiles[arrayProfileIndex];
+            break;
+        }
+        case op_put_by_val_direct: {
+            int arrayProfileIndex = pc[opLength - 1].u.operand;
+            m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
+            instructions[i + opLength - 1] = &m_arrayProfiles[arrayProfileIndex];
+            break;
+        }
+
+        case op_new_array:
+        case op_new_array_buffer:
+        case op_new_array_with_size: {
+            int arrayAllocationProfileIndex = pc[opLength - 1].u.operand;
+            instructions[i + opLength - 1] = &m_arrayAllocationProfiles[arrayAllocationProfileIndex];
+            break;
+        }
+        case op_new_object: {
+            int objectAllocationProfileIndex = pc[opLength - 1].u.operand;
+            ObjectAllocationProfile* objectAllocationProfile = &m_objectAllocationProfiles[objectAllocationProfileIndex];
+            int inferredInlineCapacity = pc[opLength - 2].u.operand;
+
+            instructions[i + opLength - 1] = objectAllocationProfile;
+            objectAllocationProfile->initialize(vm,
+                m_globalObject.get(), this, m_globalObject->objectPrototype(), inferredInlineCapacity);
+            break;
+        }
+
+        case op_call:
+        case op_tail_call:
+        case op_call_eval: {
+            linkValueProfile(i, opLength);
+            int arrayProfileIndex = pc[opLength - 2].u.operand;
+            m_arrayProfiles[arrayProfileIndex] = ArrayProfile(i);
+            instructions[i + opLength - 2] = &m_arrayProfiles[arrayProfileIndex];
+            instructions[i + 5] = &m_llintCallLinkInfos[pc[5].u.operand];
+            break;
+        }
+        case op_construct: {
+            instructions[i + 5] = &m_llintCallLinkInfos[pc[5].u.operand];
+            linkValueProfile(i, opLength);
+            break;
+        }
+        case op_get_array_length:
+            CRASH();
+
+        case op_resolve_scope: {
+            const Identifier& ident = identifier(pc[3].u.operand);
+            ResolveType type = static_cast<ResolveType>(pc[4].u.operand);
+            RELEASE_ASSERT(type != LocalClosureVar);
+            int localScopeDepth = pc[5].u.operand;
+
+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), localScopeDepth, scope, ident, Get, type, InitializationMode::NotInitialization);
+            instructions[i + 4].u.operand = op.type;
+            instructions[i + 5].u.operand = op.depth;
+            if (op.lexicalEnvironment) {
+                if (op.type == ModuleVar) {
+                    // Keep the linked module environment strongly referenced.
+                    if (stronglyReferencedModuleEnvironments.add(jsCast<JSModuleEnvironment*>(op.lexicalEnvironment)).isNewEntry)
+                        addConstant(op.lexicalEnvironment);
+                    instructions[i + 6].u.jsCell.set(vm, this, op.lexicalEnvironment);
+                } else
+                    instructions[i + 6].u.symbolTable.set(vm, this, op.lexicalEnvironment->symbolTable());
+            } else if (JSScope* constantScope = JSScope::constantScopeForCodeBlock(op.type, this))
+                instructions[i + 6].u.jsCell.set(vm, this, constantScope);
+            else
+                instructions[i + 6].u.pointer = nullptr;
+            break;
+        }
+
+        case op_get_from_scope: {
+            linkValueProfile(i, opLength);
+
+            // get_from_scope dst, scope, id, GetPutInfo, Structure, Operand
+
+            int localScopeDepth = pc[5].u.operand;
+            instructions[i + 5].u.pointer = nullptr;
+
+            GetPutInfo getPutInfo = GetPutInfo(pc[4].u.operand);
+            ASSERT(!isInitialization(getPutInfo.initializationMode()));
+            if (getPutInfo.resolveType() == LocalClosureVar) {
+                instructions[i + 4] = GetPutInfo(getPutInfo.resolveMode(), ClosureVar, getPutInfo.initializationMode()).operand();
+                break;
+            }
+
+            const Identifier& ident = identifier(pc[3].u.operand);
+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), localScopeDepth, scope, ident, Get, getPutInfo.resolveType(), InitializationMode::NotInitialization);
+
+            instructions[i + 4].u.operand = GetPutInfo(getPutInfo.resolveMode(), op.type, getPutInfo.initializationMode()).operand();
+            if (op.type == ModuleVar)
+                instructions[i + 4].u.operand = GetPutInfo(getPutInfo.resolveMode(), ClosureVar, getPutInfo.initializationMode()).operand();
+            if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks || op.type == GlobalLexicalVar || op.type == GlobalLexicalVarWithVarInjectionChecks)
+                instructions[i + 5].u.watchpointSet = op.watchpointSet;
+            else if (op.structure)
+                instructions[i + 5].u.structure.set(vm, this, op.structure);
+            instructions[i + 6].u.pointer = reinterpret_cast<void*>(op.operand);
+            break;
+        }
+
+        case op_put_to_scope: {
+            // put_to_scope scope, id, value, GetPutInfo, Structure, Operand
+            GetPutInfo getPutInfo = GetPutInfo(pc[4].u.operand);
+            if (getPutInfo.resolveType() == LocalClosureVar) {
+                // Only do watching if the property we're putting to is not anonymous.
+                if (static_cast<unsigned>(pc[2].u.operand) != UINT_MAX) {
+                    int symbolTableIndex = pc[5].u.operand;
+                    SymbolTable* symbolTable = jsCast<SymbolTable*>(getConstant(symbolTableIndex));
+                    const Identifier& ident = identifier(pc[2].u.operand);
+                    ConcurrentJSLocker locker(symbolTable->m_lock);
+                    auto iter = symbolTable->find(locker, ident.impl());
+                    ASSERT(iter != symbolTable->end(locker));
+                    iter->value.prepareToWatch();
+                    instructions[i + 5].u.watchpointSet = iter->value.watchpointSet();
+                } else
+                    instructions[i + 5].u.watchpointSet = nullptr;
+                break;
+            }
+
+            const Identifier& ident = identifier(pc[2].u.operand);
+            int localScopeDepth = pc[5].u.operand;
+            instructions[i + 5].u.pointer = nullptr;
+            ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), localScopeDepth, scope, ident, Put, getPutInfo.resolveType(), getPutInfo.initializationMode());
+
+            instructions[i + 4].u.operand = GetPutInfo(getPutInfo.resolveMode(), op.type, getPutInfo.initializationMode()).operand();
+            if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks || op.type == GlobalLexicalVar || op.type == GlobalLexicalVarWithVarInjectionChecks)
+                instructions[i + 5].u.watchpointSet = op.watchpointSet;
+            else if (op.type == ClosureVar || op.type == ClosureVarWithVarInjectionChecks) {
+                if (op.watchpointSet)
+                    op.watchpointSet->invalidate(vm, PutToScopeFireDetail(this, ident));
+            } else if (op.structure)
+                instructions[i + 5].u.structure.set(vm, this, op.structure);
+            instructions[i + 6].u.pointer = reinterpret_cast<void*>(op.operand);
+
+            break;
+        }
+
+        case op_profile_type: {
+            RELEASE_ASSERT(vm.typeProfiler());
+            // The format of this instruction is: op_profile_type regToProfile, TypeLocation*, flag, identifier?, resolveType?
+            size_t instructionOffset = i + opLength - 1;
+            unsigned divotStart, divotEnd;
+            GlobalVariableID globalVariableID = 0;
+            RefPtr<TypeSet> globalTypeSet;
+            bool shouldAnalyze = m_unlinkedCode->typeProfilerExpressionInfoForBytecodeOffset(instructionOffset, divotStart, divotEnd);
+            VirtualRegister profileRegister(pc[1].u.operand);
+            ProfileTypeBytecodeFlag flag = static_cast<ProfileTypeBytecodeFlag>(pc[3].u.operand);
+            SymbolTable* symbolTable = nullptr;
+
+            switch (flag) {
+            case ProfileTypeBytecodeClosureVar: {
+                const Identifier& ident = identifier(pc[4].u.operand);
+                int localScopeDepth = pc[2].u.operand;
+                ResolveType type = static_cast<ResolveType>(pc[5].u.operand);
+                // Even though type profiling may be profiling either a Get or a Put, we can always claim a Get because
+                // we're abstractly "read"ing from a JSScope.
+                ResolveOp op = JSScope::abstractResolve(m_globalObject->globalExec(), localScopeDepth, scope, ident, Get, type, InitializationMode::NotInitialization);
+
+                if (op.type == ClosureVar || op.type == ModuleVar)
+                    symbolTable = op.lexicalEnvironment->symbolTable();
+                else if (op.type == GlobalVar)
+                    symbolTable = m_globalObject.get()->symbolTable();
+
+                UniquedStringImpl* impl = (op.type == ModuleVar) ? op.importedName.get() : ident.impl();
+                if (symbolTable) {
+                    ConcurrentJSLocker locker(symbolTable->m_lock);
+                    // If our parent scope was created while profiling was disabled, it will not have prepared for profiling yet.
+                    symbolTable->prepareForTypeProfiling(locker);
+                    globalVariableID = symbolTable->uniqueIDForVariable(locker, impl, vm);
+                    globalTypeSet = symbolTable->globalTypeSetForVariable(locker, impl, vm);
+                } else
+                    globalVariableID = TypeProfilerNoGlobalIDExists;
+
+                break;
+            }
+            case ProfileTypeBytecodeLocallyResolved: {
+                int symbolTableIndex = pc[2].u.operand;
+                SymbolTable* symbolTable = jsCast<SymbolTable*>(getConstant(symbolTableIndex));
+                const Identifier& ident = identifier(pc[4].u.operand);
+                ConcurrentJSLocker locker(symbolTable->m_lock);
+                // If our parent scope was created while profiling was disabled, it will not have prepared for profiling yet.
+                globalVariableID = symbolTable->uniqueIDForVariable(locker, ident.impl(), vm);
+                globalTypeSet = symbolTable->globalTypeSetForVariable(locker, ident.impl(), vm);
+
+                break;
+            }
+            case ProfileTypeBytecodeDoesNotHaveGlobalID: 
+            case ProfileTypeBytecodeFunctionArgument: {
+                globalVariableID = TypeProfilerNoGlobalIDExists;
+                break;
+            }
+            case ProfileTypeBytecodeFunctionReturnStatement: {
+                RELEASE_ASSERT(ownerExecutable->isFunctionExecutable());
+                globalTypeSet = jsCast<FunctionExecutable*>(ownerExecutable)->returnStatementTypeSet();
+                globalVariableID = TypeProfilerReturnStatement;
+                if (!shouldAnalyze) {
+                    // Because a return statement can be added implicitly to return undefined at the end of a function,
+                    // and these nodes don't emit expression ranges because they aren't in the actual source text of
+                    // the user's program, give the type profiler some range to identify these return statements.
+                    // Currently, the text offset that is used as identification is "f" in the function keyword
+                    // and is stored on TypeLocation's m_divotForFunctionOffsetIfReturnStatement member variable.
+                    divotStart = divotEnd = ownerExecutable->typeProfilingStartOffset();
+                    shouldAnalyze = true;
+                }
+                break;
+            }
+            }
+
+            std::pair<TypeLocation*, bool> locationPair = vm.typeProfiler()->typeLocationCache()->getTypeLocation(globalVariableID,
+                ownerExecutable->sourceID(), divotStart, divotEnd, globalTypeSet, &vm);
+            TypeLocation* location = locationPair.first;
+            bool isNewLocation = locationPair.second;
+
+            if (flag == ProfileTypeBytecodeFunctionReturnStatement)
+                location->m_divotForFunctionOffsetIfReturnStatement = ownerExecutable->typeProfilingStartOffset();
+
+            if (shouldAnalyze && isNewLocation)
+                vm.typeProfiler()->insertNewLocation(location);
+
+            instructions[i + 2].u.location = location;
+            break;
+        }
+
+        case op_debug: {
+            if (pc[1].u.index == DidReachBreakpoint)
+                m_hasDebuggerStatement = true;
+            break;
+        }
+
+        case op_create_rest: {
+            int numberOfArgumentsToSkip = instructions[i + 3].u.operand;
+            ASSERT_UNUSED(numberOfArgumentsToSkip, numberOfArgumentsToSkip >= 0);
+            ASSERT_WITH_MESSAGE(numberOfArgumentsToSkip == numParameters() - 1, "We assume that this is true when rematerializing the rest parameter during OSR exit in the FTL JIT.");
+            break;
+        }
+
+        default:
+            break;
+        }
+        i += opLength;
+    }
+
+    if (vm.controlFlowProfiler())
+        insertBasicBlockBoundariesForControlFlowProfiler(instructions);
+
+    m_instructions = WTFMove(instructions);
+
+    // Set optimization thresholds only after m_instructions is initialized, since these
+    // rely on the instruction count (and are in theory permitted to also inspect the
+    // instruction stream to more accurate assess the cost of tier-up).
+    optimizeAfterWarmUp();
+    jitAfterWarmUp();
+
+    // If the concurrent thread will want the code block's hash, then compute it here
+    // synchronously.
+    if (Options::alwaysComputeHash())
+        hash();
+
+    if (Options::dumpGeneratedBytecodes())
+        dumpBytecode();
+    
+    heap()->m_codeBlocks->add(this);
+    heap()->reportExtraMemoryAllocated(m_instructions.size() * sizeof(Instruction));
+}
+
+CodeBlock::~CodeBlock()
+{
+    if (m_vm->m_perBytecodeProfiler)
+        m_vm->m_perBytecodeProfiler->notifyDestruction(this);
+
+    if (unlinkedCodeBlock()->didOptimize() == MixedTriState)
+        unlinkedCodeBlock()->setDidOptimize(FalseTriState);
+
+#if ENABLE(VERBOSE_VALUE_PROFILE)
+    dumpValueProfiles();
+#endif
+
+    // We may be destroyed before any CodeBlocks that refer to us are destroyed.
+    // Consider that two CodeBlocks become unreachable at the same time. There
+    // is no guarantee about the order in which the CodeBlocks are destroyed.
+    // So, if we don't remove incoming calls, and get destroyed before the
+    // CodeBlock(s) that have calls into us, then the CallLinkInfo vector's
+    // destructor will try to remove nodes from our (no longer valid) linked list.
+    unlinkIncomingCalls();
+    
+    // Note that our outgoing calls will be removed from other CodeBlocks'
+    // m_incomingCalls linked lists through the execution of the ~CallLinkInfo
+    // destructors.
+
+#if ENABLE(JIT)
+    for (Bag<StructureStubInfo>::iterator iter = m_stubInfos.begin(); !!iter; ++iter) {
+        StructureStubInfo* stub = *iter;
+        stub->aboutToDie();
+        stub->deref();
+    }
+#endif // ENABLE(JIT)
+}
+
+void CodeBlock::setConstantRegisters(const Vector<WriteBarrier<Unknown>>& constants, const Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation)
+{
+    ASSERT(constants.size() == constantsSourceCodeRepresentation.size());
+    size_t count = constants.size();
+    m_constantRegisters.resizeToFit(count);
+    bool hasTypeProfiler = !!m_vm->typeProfiler();
+    for (size_t i = 0; i < count; i++) {
+        JSValue constant = constants[i].get();
+
+        if (!constant.isEmpty()) {
+            if (SymbolTable* symbolTable = jsDynamicCast<SymbolTable*>(constant)) {
+                if (hasTypeProfiler) {
+                    ConcurrentJSLocker locker(symbolTable->m_lock);
+                    symbolTable->prepareForTypeProfiling(locker);
+                }
+
+                SymbolTable* clone = symbolTable->cloneScopePart(*m_vm);
+                if (wasCompiledWithDebuggingOpcodes())
+                    clone->setRareDataCodeBlock(this);
+
+                constant = clone;
+            }
+        }
+
+        m_constantRegisters[i].set(*m_vm, this, constant);
+    }
+
+    m_constantsSourceCodeRepresentation = constantsSourceCodeRepresentation;
+}
+
+void CodeBlock::setAlternative(VM& vm, CodeBlock* alternative)
+{
+    m_alternative.set(vm, this, alternative);
+}
+
+void CodeBlock::setNumParameters(int newValue)
+{
+    m_numParameters = newValue;
+
+    m_argumentValueProfiles = RefCountedArray<ValueProfile>(newValue);
+}
+
+CodeBlock* CodeBlock::specialOSREntryBlockOrNull()
+{
+#if ENABLE(FTL_JIT)
+    if (jitType() != JITCode::DFGJIT)
+        return 0;
+    DFG::JITCode* jitCode = m_jitCode->dfg();
+    return jitCode->osrEntryBlock();
+#else // ENABLE(FTL_JIT)
+    return 0;
+#endif // ENABLE(FTL_JIT)
+}
+
+void CodeBlock::visitWeakly(SlotVisitor& visitor)
+{
+    ConcurrentJSLocker locker(m_lock);
+    if (m_visitWeaklyHasBeenCalled)
+        return;
+    
+    m_visitWeaklyHasBeenCalled = true;
+
+    if (Heap::isMarkedConcurrently(this))
+        return;
+
+    if (shouldVisitStrongly(locker)) {
+        visitor.appendUnbarriered(this);
+        return;
+    }
+    
+    // There are two things that may use unconditional finalizers: inline cache clearing
+    // and jettisoning. The probability of us wanting to do at least one of those things
+    // is probably quite close to 1. So we add one no matter what and when it runs, it
+    // figures out whether it has any work to do.
+    visitor.addUnconditionalFinalizer(&m_unconditionalFinalizer);
+
+    if (!JITCode::isOptimizingJIT(jitType()))
+        return;
+
+    // If we jettison ourselves we'll install our alternative, so make sure that it
+    // survives GC even if we don't.
+    visitor.append(m_alternative);
+    
+    // There are two things that we use weak reference harvesters for: DFG fixpoint for
+    // jettisoning, and trying to find structures that would be live based on some
+    // inline cache. So it makes sense to register them regardless.
+    visitor.addWeakReferenceHarvester(&m_weakReferenceHarvester);
+
+#if ENABLE(DFG_JIT)
+    // We get here if we're live in the sense that our owner executable is live,
+    // but we're not yet live for sure in another sense: we may yet decide that this
+    // code block should be jettisoned based on its outgoing weak references being
+    // stale. Set a flag to indicate that we're still assuming that we're dead, and
+    // perform one round of determining if we're live. The GC may determine, based on
+    // either us marking additional objects, or by other objects being marked for
+    // other reasons, that this iteration should run again; it will notify us of this
+    // decision by calling harvestWeakReferences().
+
+    m_allTransitionsHaveBeenMarked = false;
+    propagateTransitions(locker, visitor);
+
+    m_jitCode->dfgCommon()->livenessHasBeenProved = false;
+    determineLiveness(locker, visitor);
+#endif // ENABLE(DFG_JIT)
+}
+
+size_t CodeBlock::estimatedSize(JSCell* cell)
+{
+    CodeBlock* thisObject = jsCast<CodeBlock*>(cell);
+    size_t extraMemoryAllocated = thisObject->m_instructions.size() * sizeof(Instruction);
+    if (thisObject->m_jitCode)
+        extraMemoryAllocated += thisObject->m_jitCode->size();
+    return Base::estimatedSize(cell) + extraMemoryAllocated;
+}
+
+void CodeBlock::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    CodeBlock* thisObject = jsCast<CodeBlock*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    JSCell::visitChildren(thisObject, visitor);
+    thisObject->visitChildren(visitor);
+}
+
+void CodeBlock::visitChildren(SlotVisitor& visitor)
+{
+    ConcurrentJSLocker locker(m_lock);
+    // There are two things that may use unconditional finalizers: inline cache clearing
+    // and jettisoning. The probability of us wanting to do at least one of those things
+    // is probably quite close to 1. So we add one no matter what and when it runs, it
+    // figures out whether it has any work to do.
+    visitor.addUnconditionalFinalizer(&m_unconditionalFinalizer);
+
+    if (CodeBlock* otherBlock = specialOSREntryBlockOrNull())
+        visitor.appendUnbarriered(otherBlock);
+
+    if (m_jitCode)
+        visitor.reportExtraMemoryVisited(m_jitCode->size());
+    if (m_instructions.size()) {
+        unsigned refCount = m_instructions.refCount();
+        RELEASE_ASSERT(refCount);
+        visitor.reportExtraMemoryVisited(m_instructions.size() * sizeof(Instruction) / refCount);
+    }
+
+    stronglyVisitStrongReferences(locker, visitor);
+    stronglyVisitWeakReferences(locker, visitor);
+
+    m_allTransitionsHaveBeenMarked = false;
+    propagateTransitions(locker, visitor);
+}
+
+bool CodeBlock::shouldVisitStrongly(const ConcurrentJSLocker& locker)
+{
+    if (Options::forceCodeBlockLiveness())
+        return true;
+
+    if (shouldJettisonDueToOldAge(locker))
+        return false;
+
+    // Interpreter and Baseline JIT CodeBlocks don't need to be jettisoned when
+    // their weak references go stale. So if a basline JIT CodeBlock gets
+    // scanned, we can assume that this means that it's live.
+    if (!JITCode::isOptimizingJIT(jitType()))
+        return true;
+
+    return false;
+}
+
+bool CodeBlock::shouldJettisonDueToWeakReference()
+{
+    if (!JITCode::isOptimizingJIT(jitType()))
+        return false;
+    return !Heap::isMarked(this);
+}
+
+static std::chrono::milliseconds timeToLive(JITCode::JITType jitType)
+{
+    if (UNLIKELY(Options::useEagerCodeBlockJettisonTiming())) {
+        switch (jitType) {
+        case JITCode::InterpreterThunk:
+            return std::chrono::milliseconds(10);
+        case JITCode::BaselineJIT:
+            return std::chrono::milliseconds(10 + 20);
+        case JITCode::DFGJIT:
+            return std::chrono::milliseconds(40);
+        case JITCode::FTLJIT:
+            return std::chrono::milliseconds(120);
+        default:
+            return std::chrono::milliseconds::max();
+        }
+    }
+
+    switch (jitType) {
+    case JITCode::InterpreterThunk:
+        return std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::seconds(5));
+    case JITCode::BaselineJIT:
+        // Effectively 10 additional seconds, since BaselineJIT and
+        // InterpreterThunk share a CodeBlock.
+        return std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::seconds(5 + 10));
+    case JITCode::DFGJIT:
+        return std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::seconds(20));
+    case JITCode::FTLJIT:
+        return std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::seconds(60));
+    default:
+        return std::chrono::milliseconds::max();
+    }
+}
+
+bool CodeBlock::shouldJettisonDueToOldAge(const ConcurrentJSLocker&)
+{
+    if (Heap::isMarkedConcurrently(this))
+        return false;
+
+    if (UNLIKELY(Options::forceCodeBlockToJettisonDueToOldAge()))
+        return true;
+    
+    if (timeSinceCreation() < timeToLive(jitType()))
+        return false;
+    
+    return true;
+}
+
+#if ENABLE(DFG_JIT)
+static bool shouldMarkTransition(DFG::WeakReferenceTransition& transition)
+{
+    if (transition.m_codeOrigin && !Heap::isMarkedConcurrently(transition.m_codeOrigin.get()))
+        return false;
+    
+    if (!Heap::isMarkedConcurrently(transition.m_from.get()))
+        return false;
+    
+    return true;
+}
+#endif // ENABLE(DFG_JIT)
+
+void CodeBlock::propagateTransitions(const ConcurrentJSLocker&, SlotVisitor& visitor)
+{
+    UNUSED_PARAM(visitor);
+
+    if (m_allTransitionsHaveBeenMarked)
+        return;
+
+    bool allAreMarkedSoFar = true;
+        
+    Interpreter* interpreter = m_vm->interpreter;
+    if (jitType() == JITCode::InterpreterThunk) {
+        const Vector<unsigned>& propertyAccessInstructions = m_unlinkedCode->propertyAccessInstructions();
+        for (size_t i = 0; i < propertyAccessInstructions.size(); ++i) {
+            Instruction* instruction = &instructions()[propertyAccessInstructions[i]];
+            switch (interpreter->getOpcodeID(instruction[0].u.opcode)) {
+            case op_put_by_id: {
+                StructureID oldStructureID = instruction[4].u.structureID;
+                StructureID newStructureID = instruction[6].u.structureID;
+                if (!oldStructureID || !newStructureID)
+                    break;
+                Structure* oldStructure =
+                    m_vm->heap.structureIDTable().get(oldStructureID);
+                Structure* newStructure =
+                    m_vm->heap.structureIDTable().get(newStructureID);
+                if (Heap::isMarkedConcurrently(oldStructure))
+                    visitor.appendUnbarriered(newStructure);
+                else
+                    allAreMarkedSoFar = false;
+                break;
+            }
+            default:
+                break;
+            }
+        }
+    }
+
+#if ENABLE(JIT)
+    if (JITCode::isJIT(jitType())) {
+        for (Bag<StructureStubInfo>::iterator iter = m_stubInfos.begin(); !!iter; ++iter)
+            allAreMarkedSoFar &= (*iter)->propagateTransitions(visitor);
+    }
+#endif // ENABLE(JIT)
+    
+#if ENABLE(DFG_JIT)
+    if (JITCode::isOptimizingJIT(jitType())) {
+        DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
+        for (auto& weakReference : dfgCommon->weakStructureReferences)
+            allAreMarkedSoFar &= weakReference->markIfCheap(visitor);
+        
+        for (unsigned i = 0; i < dfgCommon->transitions.size(); ++i) {
+            if (shouldMarkTransition(dfgCommon->transitions[i])) {
+                // If the following three things are live, then the target of the
+                // transition is also live:
+                //
+                // - This code block. We know it's live already because otherwise
+                //   we wouldn't be scanning ourselves.
+                //
+                // - The code origin of the transition. Transitions may arise from
+                //   code that was inlined. They are not relevant if the user's
+                //   object that is required for the inlinee to run is no longer
+                //   live.
+                //
+                // - The source of the transition. The transition checks if some
+                //   heap location holds the source, and if so, stores the target.
+                //   Hence the source must be live for the transition to be live.
+                //
+                // We also short-circuit the liveness if the structure is harmless
+                // to mark (i.e. its global object and prototype are both already
+                // live).
+                
+                visitor.append(dfgCommon->transitions[i].m_to);
+            } else
+                allAreMarkedSoFar = false;
+        }
+    }
+#endif // ENABLE(DFG_JIT)
+    
+    if (allAreMarkedSoFar)
+        m_allTransitionsHaveBeenMarked = true;
+}
+
+void CodeBlock::determineLiveness(const ConcurrentJSLocker&, SlotVisitor& visitor)
+{
+    UNUSED_PARAM(visitor);
+    
+#if ENABLE(DFG_JIT)
+    // Check if we have any remaining work to do.
+    DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
+    if (dfgCommon->livenessHasBeenProved)
+        return;
+    
+    // Now check all of our weak references. If all of them are live, then we
+    // have proved liveness and so we scan our strong references. If at end of
+    // GC we still have not proved liveness, then this code block is toast.
+    bool allAreLiveSoFar = true;
+    for (unsigned i = 0; i < dfgCommon->weakReferences.size(); ++i) {
+        ASSERT(!jsDynamicCast<CodeBlock*>(dfgCommon->weakReferences[i].get()));
+        if (!Heap::isMarkedConcurrently(dfgCommon->weakReferences[i].get())) {
+            allAreLiveSoFar = false;
+            break;
+        }
+    }
+    if (allAreLiveSoFar) {
+        for (unsigned i = 0; i < dfgCommon->weakStructureReferences.size(); ++i) {
+            if (!Heap::isMarkedConcurrently(dfgCommon->weakStructureReferences[i].get())) {
+                allAreLiveSoFar = false;
+                break;
+            }
+        }
+    }
+    
+    // If some weak references are dead, then this fixpoint iteration was
+    // unsuccessful.
+    if (!allAreLiveSoFar)
+        return;
+    
+    // All weak references are live. Record this information so we don't
+    // come back here again, and scan the strong references.
+    dfgCommon->livenessHasBeenProved = true;
+    visitor.appendUnbarriered(this);
+#endif // ENABLE(DFG_JIT)
+}
+
+void CodeBlock::WeakReferenceHarvester::visitWeakReferences(SlotVisitor& visitor)
+{
+    CodeBlock* codeBlock =
+        bitwise_cast<CodeBlock*>(
+            bitwise_cast<char*>(this) - OBJECT_OFFSETOF(CodeBlock, m_weakReferenceHarvester));
+    
+    codeBlock->propagateTransitions(NoLockingNecessary, visitor);
+    codeBlock->determineLiveness(NoLockingNecessary, visitor);
+}
+
+void CodeBlock::clearLLIntGetByIdCache(Instruction* instruction)
+{
+    instruction[0].u.opcode = LLInt::getOpcode(op_get_by_id);
+    instruction[4].u.pointer = nullptr;
+    instruction[5].u.pointer = nullptr;
+    instruction[6].u.pointer = nullptr;
+}
+
+void CodeBlock::finalizeLLIntInlineCaches()
+{
+    Interpreter* interpreter = m_vm->interpreter;
+    const Vector<unsigned>& propertyAccessInstructions = m_unlinkedCode->propertyAccessInstructions();
+    for (size_t size = propertyAccessInstructions.size(), i = 0; i < size; ++i) {
+        Instruction* curInstruction = &instructions()[propertyAccessInstructions[i]];
+        switch (interpreter->getOpcodeID(curInstruction[0].u.opcode)) {
+        case op_get_by_id:
+        case op_get_by_id_proto_load:
+        case op_get_by_id_unset: {
+            StructureID oldStructureID = curInstruction[4].u.structureID;
+            if (!oldStructureID || Heap::isMarked(m_vm->heap.structureIDTable().get(oldStructureID)))
+                break;
+            if (Options::verboseOSR())
+                dataLogF("Clearing LLInt property access.\n");
+            clearLLIntGetByIdCache(curInstruction);
+            break;
+        }
+        case op_put_by_id: {
+            StructureID oldStructureID = curInstruction[4].u.structureID;
+            StructureID newStructureID = curInstruction[6].u.structureID;
+            StructureChain* chain = curInstruction[7].u.structureChain.get();
+            if ((!oldStructureID || Heap::isMarked(m_vm->heap.structureIDTable().get(oldStructureID))) &&
+                (!newStructureID || Heap::isMarked(m_vm->heap.structureIDTable().get(newStructureID))) &&
+                (!chain || Heap::isMarked(chain)))
+                break;
+            if (Options::verboseOSR())
+                dataLogF("Clearing LLInt put transition.\n");
+            curInstruction[4].u.structureID = 0;
+            curInstruction[5].u.operand = 0;
+            curInstruction[6].u.structureID = 0;
+            curInstruction[7].u.structureChain.clear();
+            break;
+        }
+        case op_get_array_length:
+            break;
+        case op_to_this:
+            if (!curInstruction[2].u.structure || Heap::isMarked(curInstruction[2].u.structure.get()))
+                break;
+            if (Options::verboseOSR())
+                dataLogF("Clearing LLInt to_this with structure %p.\n", curInstruction[2].u.structure.get());
+            curInstruction[2].u.structure.clear();
+            curInstruction[3].u.toThisStatus = merge(
+                curInstruction[3].u.toThisStatus, ToThisClearedByGC);
+            break;
+        case op_create_this: {
+            auto& cacheWriteBarrier = curInstruction[4].u.jsCell;
+            if (!cacheWriteBarrier || cacheWriteBarrier.unvalidatedGet() == JSCell::seenMultipleCalleeObjects())
+                break;
+            JSCell* cachedFunction = cacheWriteBarrier.get();
+            if (Heap::isMarked(cachedFunction))
+                break;
+            if (Options::verboseOSR())
+                dataLogF("Clearing LLInt create_this with cached callee %p.\n", cachedFunction);
+            cacheWriteBarrier.clear();
+            break;
+        }
+        case op_resolve_scope: {
+            // Right now this isn't strictly necessary. Any symbol tables that this will refer to
+            // are for outer functions, and we refer to those functions strongly, and they refer
+            // to the symbol table strongly. But it's nice to be on the safe side.
+            WriteBarrierBase<SymbolTable>& symbolTable = curInstruction[6].u.symbolTable;
+            if (!symbolTable || Heap::isMarked(symbolTable.get()))
+                break;
+            if (Options::verboseOSR())
+                dataLogF("Clearing dead symbolTable %p.\n", symbolTable.get());
+            symbolTable.clear();
+            break;
+        }
+        case op_get_from_scope:
+        case op_put_to_scope: {
+            GetPutInfo getPutInfo = GetPutInfo(curInstruction[4].u.operand);
+            if (getPutInfo.resolveType() == GlobalVar || getPutInfo.resolveType() == GlobalVarWithVarInjectionChecks 
+                || getPutInfo.resolveType() == LocalClosureVar || getPutInfo.resolveType() == GlobalLexicalVar || getPutInfo.resolveType() == GlobalLexicalVarWithVarInjectionChecks)
+                continue;
+            WriteBarrierBase<Structure>& structure = curInstruction[5].u.structure;
+            if (!structure || Heap::isMarked(structure.get()))
+                break;
+            if (Options::verboseOSR())
+                dataLogF("Clearing scope access with structure %p.\n", structure.get());
+            structure.clear();
+            break;
+        }
+        default:
+            OpcodeID opcodeID = interpreter->getOpcodeID(curInstruction[0].u.opcode);
+            ASSERT_WITH_MESSAGE_UNUSED(opcodeID, false, "Unhandled opcode in CodeBlock::finalizeUnconditionally, %s(%d) at bc %u", opcodeNames[opcodeID], opcodeID, propertyAccessInstructions[i]);
+        }
+    }
+
+    // We can't just remove all the sets when we clear the caches since we might have created a watchpoint set
+    // then cleared the cache without GCing in between.
+    m_llintGetByIdWatchpointMap.removeIf([](const StructureWatchpointMap::KeyValuePairType& pair) -> bool {
+        return !Heap::isMarked(pair.key);
+    });
+
+    for (unsigned i = 0; i < m_llintCallLinkInfos.size(); ++i) {
+        if (m_llintCallLinkInfos[i].isLinked() && !Heap::isMarked(m_llintCallLinkInfos[i].callee.get())) {
+            if (Options::verboseOSR())
+                dataLog("Clearing LLInt call from ", *this, "\n");
+            m_llintCallLinkInfos[i].unlink();
+        }
+        if (!!m_llintCallLinkInfos[i].lastSeenCallee && !Heap::isMarked(m_llintCallLinkInfos[i].lastSeenCallee.get()))
+            m_llintCallLinkInfos[i].lastSeenCallee.clear();
+    }
+}
+
+void CodeBlock::finalizeBaselineJITInlineCaches()
+{
+#if ENABLE(JIT)
+    for (auto iter = callLinkInfosBegin(); !!iter; ++iter)
+        (*iter)->visitWeak(*vm());
+
+    for (Bag<StructureStubInfo>::iterator iter = m_stubInfos.begin(); !!iter; ++iter) {
+        StructureStubInfo& stubInfo = **iter;
+        stubInfo.visitWeakReferences(this);
+    }
+#endif
+}
+
+void CodeBlock::UnconditionalFinalizer::finalizeUnconditionally()
+{
+    CodeBlock* codeBlock = bitwise_cast<CodeBlock*>(
+        bitwise_cast<char*>(this) - OBJECT_OFFSETOF(CodeBlock, m_unconditionalFinalizer));
+    
+    codeBlock->updateAllPredictions();
+    
+    if (!Heap::isMarked(codeBlock)) {
+        if (codeBlock->shouldJettisonDueToWeakReference())
+            codeBlock->jettison(Profiler::JettisonDueToWeakReference);
+        else
+            codeBlock->jettison(Profiler::JettisonDueToOldAge);
+        return;
+    }
+
+    if (JITCode::couldBeInterpreted(codeBlock->jitType()))
+        codeBlock->finalizeLLIntInlineCaches();
+
+#if ENABLE(JIT)
+    if (!!codeBlock->jitCode())
+        codeBlock->finalizeBaselineJITInlineCaches();
+#endif
+}
+
+void CodeBlock::getStubInfoMap(const ConcurrentJSLocker&, StubInfoMap& result)
+{
+#if ENABLE(JIT)
+    if (JITCode::isJIT(jitType()))
+        toHashMap(m_stubInfos, getStructureStubInfoCodeOrigin, result);
+#else
+    UNUSED_PARAM(result);
+#endif
+}
+
+void CodeBlock::getStubInfoMap(StubInfoMap& result)
+{
+    ConcurrentJSLocker locker(m_lock);
+    getStubInfoMap(locker, result);
+}
+
+void CodeBlock::getCallLinkInfoMap(const ConcurrentJSLocker&, CallLinkInfoMap& result)
+{
+#if ENABLE(JIT)
+    if (JITCode::isJIT(jitType()))
+        toHashMap(m_callLinkInfos, getCallLinkInfoCodeOrigin, result);
+#else
+    UNUSED_PARAM(result);
+#endif
+}
+
+void CodeBlock::getCallLinkInfoMap(CallLinkInfoMap& result)
+{
+    ConcurrentJSLocker locker(m_lock);
+    getCallLinkInfoMap(locker, result);
+}
+
+void CodeBlock::getByValInfoMap(const ConcurrentJSLocker&, ByValInfoMap& result)
+{
+#if ENABLE(JIT)
+    if (JITCode::isJIT(jitType())) {
+        for (auto* byValInfo : m_byValInfos)
+            result.add(CodeOrigin(byValInfo->bytecodeIndex), byValInfo);
+    }
+#else
+    UNUSED_PARAM(result);
+#endif
+}
+
+void CodeBlock::getByValInfoMap(ByValInfoMap& result)
+{
+    ConcurrentJSLocker locker(m_lock);
+    getByValInfoMap(locker, result);
+}
+
+#if ENABLE(JIT)
+StructureStubInfo* CodeBlock::addStubInfo(AccessType accessType)
+{
+    ConcurrentJSLocker locker(m_lock);
+    return m_stubInfos.add(accessType);
+}
+
+JITAddIC* CodeBlock::addJITAddIC(ArithProfile* arithProfile)
+{
+    return m_addICs.add(arithProfile);
+}
+
+JITMulIC* CodeBlock::addJITMulIC(ArithProfile* arithProfile)
+{
+    return m_mulICs.add(arithProfile);
+}
+
+JITSubIC* CodeBlock::addJITSubIC(ArithProfile* arithProfile)
+{
+    return m_subICs.add(arithProfile);
+}
+
+JITNegIC* CodeBlock::addJITNegIC(ArithProfile* arithProfile)
+{
+    return m_negICs.add(arithProfile);
+}
+
+StructureStubInfo* CodeBlock::findStubInfo(CodeOrigin codeOrigin)
+{
+    for (StructureStubInfo* stubInfo : m_stubInfos) {
+        if (stubInfo->codeOrigin == codeOrigin)
+            return stubInfo;
+    }
+    return nullptr;
+}
+
+ByValInfo* CodeBlock::addByValInfo()
+{
+    ConcurrentJSLocker locker(m_lock);
+    return m_byValInfos.add();
+}
+
+CallLinkInfo* CodeBlock::addCallLinkInfo()
+{
+    ConcurrentJSLocker locker(m_lock);
+    return m_callLinkInfos.add();
+}
+
+CallLinkInfo* CodeBlock::getCallLinkInfoForBytecodeIndex(unsigned index)
+{
+    for (auto iter = m_callLinkInfos.begin(); !!iter; ++iter) {
+        if ((*iter)->codeOrigin() == CodeOrigin(index))
+            return *iter;
+    }
+    return nullptr;
+}
+
+void CodeBlock::resetJITData()
+{
+    RELEASE_ASSERT(!JITCode::isJIT(jitType()));
+    ConcurrentJSLocker locker(m_lock);
+    
+    // We can clear these because no other thread will have references to any stub infos, call
+    // link infos, or by val infos if we don't have JIT code. Attempts to query these data
+    // structures using the concurrent API (getStubInfoMap and friends) will return nothing if we
+    // don't have JIT code.
+    m_stubInfos.clear();
+    m_callLinkInfos.clear();
+    m_byValInfos.clear();
+    
+    // We can clear this because the DFG's queries to these data structures are guarded by whether
+    // there is JIT code.
+    m_rareCaseProfiles.clear();
+}
+#endif
+
+void CodeBlock::visitOSRExitTargets(const ConcurrentJSLocker&, SlotVisitor& visitor)
+{
+    // We strongly visit OSR exits targets because we don't want to deal with
+    // the complexity of generating an exit target CodeBlock on demand and
+    // guaranteeing that it matches the details of the CodeBlock we compiled
+    // the OSR exit against.
+
+    visitor.append(m_alternative);
+
+#if ENABLE(DFG_JIT)
+    DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
+    if (dfgCommon->inlineCallFrames) {
+        for (auto* inlineCallFrame : *dfgCommon->inlineCallFrames) {
+            ASSERT(inlineCallFrame->baselineCodeBlock);
+            visitor.append(inlineCallFrame->baselineCodeBlock);
+        }
+    }
+#endif
+}
+
+void CodeBlock::stronglyVisitStrongReferences(const ConcurrentJSLocker& locker, SlotVisitor& visitor)
+{
+    UNUSED_PARAM(locker);
+    
+    visitor.append(m_globalObject);
+    visitor.append(m_ownerExecutable);
+    visitor.append(m_unlinkedCode);
+    if (m_rareData)
+        m_rareData->m_directEvalCodeCache.visitAggregate(visitor);
+    visitor.appendValues(m_constantRegisters.data(), m_constantRegisters.size());
+    for (size_t i = 0; i < m_functionExprs.size(); ++i)
+        visitor.append(m_functionExprs[i]);
+    for (size_t i = 0; i < m_functionDecls.size(); ++i)
+        visitor.append(m_functionDecls[i]);
+    for (unsigned i = 0; i < m_objectAllocationProfiles.size(); ++i)
+        m_objectAllocationProfiles[i].visitAggregate(visitor);
+
+#if ENABLE(JIT)
+    for (ByValInfo* byValInfo : m_byValInfos)
+        visitor.append(byValInfo->cachedSymbol);
+#endif
+
+#if ENABLE(DFG_JIT)
+    if (JITCode::isOptimizingJIT(jitType()))
+        visitOSRExitTargets(locker, visitor);
+#endif
+}
+
+void CodeBlock::stronglyVisitWeakReferences(const ConcurrentJSLocker&, SlotVisitor& visitor)
+{
+    UNUSED_PARAM(visitor);
+
+#if ENABLE(DFG_JIT)
+    if (!JITCode::isOptimizingJIT(jitType()))
+        return;
+    
+    DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
+
+    for (unsigned i = 0; i < dfgCommon->transitions.size(); ++i) {
+        if (!!dfgCommon->transitions[i].m_codeOrigin)
+            visitor.append(dfgCommon->transitions[i].m_codeOrigin); // Almost certainly not necessary, since the code origin should also be a weak reference. Better to be safe, though.
+        visitor.append(dfgCommon->transitions[i].m_from);
+        visitor.append(dfgCommon->transitions[i].m_to);
+    }
+    
+    for (unsigned i = 0; i < dfgCommon->weakReferences.size(); ++i)
+        visitor.append(dfgCommon->weakReferences[i]);
+
+    for (unsigned i = 0; i < dfgCommon->weakStructureReferences.size(); ++i)
+        visitor.append(dfgCommon->weakStructureReferences[i]);
+
+    dfgCommon->livenessHasBeenProved = true;
+#endif    
+}
+
+CodeBlock* CodeBlock::baselineAlternative()
+{
+#if ENABLE(JIT)
+    CodeBlock* result = this;
+    while (result->alternative())
+        result = result->alternative();
+    RELEASE_ASSERT(result);
+    RELEASE_ASSERT(JITCode::isBaselineCode(result->jitType()) || result->jitType() == JITCode::None);
+    return result;
+#else
+    return this;
+#endif
+}
+
+CodeBlock* CodeBlock::baselineVersion()
+{
+#if ENABLE(JIT)
+    if (JITCode::isBaselineCode(jitType()))
+        return this;
+    CodeBlock* result = replacement();
+    if (!result) {
+        // This can happen if we're creating the original CodeBlock for an executable.
+        // Assume that we're the baseline CodeBlock.
+        RELEASE_ASSERT(jitType() == JITCode::None);
+        return this;
+    }
+    result = result->baselineAlternative();
+    return result;
+#else
+    return this;
+#endif
+}
+
+#if ENABLE(JIT)
+bool CodeBlock::hasOptimizedReplacement(JITCode::JITType typeToReplace)
+{
+    return JITCode::isHigherTier(replacement()->jitType(), typeToReplace);
+}
+
+bool CodeBlock::hasOptimizedReplacement()
+{
+    return hasOptimizedReplacement(jitType());
+}
+#endif
+
+HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset, RequiredHandler requiredHandler)
+{
+    RELEASE_ASSERT(bytecodeOffset < instructions().size());
+    return handlerForIndex(bytecodeOffset, requiredHandler);
+}
+
+HandlerInfo* CodeBlock::handlerForIndex(unsigned index, RequiredHandler requiredHandler)
+{
+    if (!m_rareData)
+        return 0;
+    return HandlerInfo::handlerForIndex(m_rareData->m_exceptionHandlers, index, requiredHandler);
+}
+
+CallSiteIndex CodeBlock::newExceptionHandlingCallSiteIndex(CallSiteIndex originalCallSite)
+{
+#if ENABLE(DFG_JIT)
+    RELEASE_ASSERT(JITCode::isOptimizingJIT(jitType()));
+    RELEASE_ASSERT(canGetCodeOrigin(originalCallSite));
+    ASSERT(!!handlerForIndex(originalCallSite.bits()));
+    CodeOrigin originalOrigin = codeOrigin(originalCallSite);
+    return m_jitCode->dfgCommon()->addUniqueCallSiteIndex(originalOrigin);
+#else
+    // We never create new on-the-fly exception handling
+    // call sites outside the DFG/FTL inline caches.
+    UNUSED_PARAM(originalCallSite);
+    RELEASE_ASSERT_NOT_REACHED();
+    return CallSiteIndex(0u);
+#endif
+}
+
+void CodeBlock::removeExceptionHandlerForCallSite(CallSiteIndex callSiteIndex)
+{
+    RELEASE_ASSERT(m_rareData);
+    Vector<HandlerInfo>& exceptionHandlers = m_rareData->m_exceptionHandlers;
+    unsigned index = callSiteIndex.bits();
+    for (size_t i = 0; i < exceptionHandlers.size(); ++i) {
+        HandlerInfo& handler = exceptionHandlers[i];
+        if (handler.start <= index && handler.end > index) {
+            exceptionHandlers.remove(i);
+            return;
+        }
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+unsigned CodeBlock::lineNumberForBytecodeOffset(unsigned bytecodeOffset)
+{
+    RELEASE_ASSERT(bytecodeOffset < instructions().size());
+    return ownerScriptExecutable()->firstLine() + m_unlinkedCode->lineNumberForBytecodeOffset(bytecodeOffset);
+}
+
+unsigned CodeBlock::columnNumberForBytecodeOffset(unsigned bytecodeOffset)
+{
+    int divot;
+    int startOffset;
+    int endOffset;
+    unsigned line;
+    unsigned column;
+    expressionRangeForBytecodeOffset(bytecodeOffset, divot, startOffset, endOffset, line, column);
+    return column;
+}
+
+void CodeBlock::expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset, unsigned& line, unsigned& column) const
+{
+    m_unlinkedCode->expressionRangeForBytecodeOffset(bytecodeOffset, divot, startOffset, endOffset, line, column);
+    divot += m_sourceOffset;
+    column += line ? 1 : firstLineColumnOffset();
+    line += ownerScriptExecutable()->firstLine();
+}
+
+bool CodeBlock::hasOpDebugForLineAndColumn(unsigned line, unsigned column)
+{
+    Interpreter* interpreter = vm()->interpreter;
+    const Instruction* begin = instructions().begin();
+    const Instruction* end = instructions().end();
+    for (const Instruction* it = begin; it != end;) {
+        OpcodeID opcodeID = interpreter->getOpcodeID(it->u.opcode);
+        if (opcodeID == op_debug) {
+            unsigned bytecodeOffset = it - begin;
+            int unused;
+            unsigned opDebugLine;
+            unsigned opDebugColumn;
+            expressionRangeForBytecodeOffset(bytecodeOffset, unused, unused, unused, opDebugLine, opDebugColumn);
+            if (line == opDebugLine && (column == Breakpoint::unspecifiedColumn || column == opDebugColumn))
+                return true;
+        }
+        it += opcodeLengths[opcodeID];
+    }
+    return false;
+}
+
+void CodeBlock::shrinkToFit(ShrinkMode shrinkMode)
+{
+    ConcurrentJSLocker locker(m_lock);
+
+    m_rareCaseProfiles.shrinkToFit();
+    
+    if (shrinkMode == EarlyShrink) {
+        m_constantRegisters.shrinkToFit();
+        m_constantsSourceCodeRepresentation.shrinkToFit();
+        
+        if (m_rareData) {
+            m_rareData->m_switchJumpTables.shrinkToFit();
+            m_rareData->m_stringSwitchJumpTables.shrinkToFit();
+        }
+    } // else don't shrink these, because we would have already pointed pointers into these tables.
+}
+
+#if ENABLE(JIT)
+void CodeBlock::linkIncomingCall(ExecState* callerFrame, CallLinkInfo* incoming)
+{
+    noticeIncomingCall(callerFrame);
+    m_incomingCalls.push(incoming);
+}
+
+void CodeBlock::linkIncomingPolymorphicCall(ExecState* callerFrame, PolymorphicCallNode* incoming)
+{
+    noticeIncomingCall(callerFrame);
+    m_incomingPolymorphicCalls.push(incoming);
+}
+#endif // ENABLE(JIT)
+
+void CodeBlock::unlinkIncomingCalls()
+{
+    while (m_incomingLLIntCalls.begin() != m_incomingLLIntCalls.end())
+        m_incomingLLIntCalls.begin()->unlink();
+#if ENABLE(JIT)
+    while (m_incomingCalls.begin() != m_incomingCalls.end())
+        m_incomingCalls.begin()->unlink(*vm());
+    while (m_incomingPolymorphicCalls.begin() != m_incomingPolymorphicCalls.end())
+        m_incomingPolymorphicCalls.begin()->unlink(*vm());
+#endif // ENABLE(JIT)
+}
+
+void CodeBlock::linkIncomingCall(ExecState* callerFrame, LLIntCallLinkInfo* incoming)
+{
+    noticeIncomingCall(callerFrame);
+    m_incomingLLIntCalls.push(incoming);
+}
+
+CodeBlock* CodeBlock::newReplacement()
+{
+    return ownerScriptExecutable()->newReplacementCodeBlockFor(specializationKind());
+}
+
+#if ENABLE(JIT)
+CodeBlock* CodeBlock::replacement()
+{
+    const ClassInfo* classInfo = this->classInfo();
+
+    if (classInfo == FunctionCodeBlock::info())
+        return jsCast<FunctionExecutable*>(ownerExecutable())->codeBlockFor(m_isConstructor ? CodeForConstruct : CodeForCall);
+
+    if (classInfo == EvalCodeBlock::info())
+        return jsCast<EvalExecutable*>(ownerExecutable())->codeBlock();
+
+    if (classInfo == ProgramCodeBlock::info())
+        return jsCast<ProgramExecutable*>(ownerExecutable())->codeBlock();
+
+    if (classInfo == ModuleProgramCodeBlock::info())
+        return jsCast<ModuleProgramExecutable*>(ownerExecutable())->codeBlock();
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+DFG::CapabilityLevel CodeBlock::computeCapabilityLevel()
+{
+    const ClassInfo* classInfo = this->classInfo();
+
+    if (classInfo == FunctionCodeBlock::info()) {
+        if (m_isConstructor)
+            return DFG::functionForConstructCapabilityLevel(this);
+        return DFG::functionForCallCapabilityLevel(this);
+    }
+
+    if (classInfo == EvalCodeBlock::info())
+        return DFG::evalCapabilityLevel(this);
+
+    if (classInfo == ProgramCodeBlock::info())
+        return DFG::programCapabilityLevel(this);
+
+    if (classInfo == ModuleProgramCodeBlock::info())
+        return DFG::programCapabilityLevel(this);
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return DFG::CannotCompile;
+}
+
+#endif // ENABLE(JIT)
+
+void CodeBlock::jettison(Profiler::JettisonReason reason, ReoptimizationMode mode, const FireDetail* detail)
+{
+#if !ENABLE(DFG_JIT)
+    UNUSED_PARAM(mode);
+    UNUSED_PARAM(detail);
+#endif
+    
+    CODEBLOCK_LOG_EVENT(this, "jettison", ("due to ", reason, ", counting = ", mode == CountReoptimization, ", detail = ", pointerDump(detail)));
+
+    RELEASE_ASSERT(reason != Profiler::NotJettisoned);
+    
+#if ENABLE(DFG_JIT)
+    if (DFG::shouldDumpDisassembly()) {
+        dataLog("Jettisoning ", *this);
+        if (mode == CountReoptimization)
+            dataLog(" and counting reoptimization");
+        dataLog(" due to ", reason);
+        if (detail)
+            dataLog(", ", *detail);
+        dataLog(".\n");
+    }
+    
+    if (reason == Profiler::JettisonDueToWeakReference) {
+        if (DFG::shouldDumpDisassembly()) {
+            dataLog(*this, " will be jettisoned because of the following dead references:\n");
+            DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
+            for (unsigned i = 0; i < dfgCommon->transitions.size(); ++i) {
+                DFG::WeakReferenceTransition& transition = dfgCommon->transitions[i];
+                JSCell* origin = transition.m_codeOrigin.get();
+                JSCell* from = transition.m_from.get();
+                JSCell* to = transition.m_to.get();
+                if ((!origin || Heap::isMarked(origin)) && Heap::isMarked(from))
+                    continue;
+                dataLog("    Transition under ", RawPointer(origin), ", ", RawPointer(from), " -> ", RawPointer(to), ".\n");
+            }
+            for (unsigned i = 0; i < dfgCommon->weakReferences.size(); ++i) {
+                JSCell* weak = dfgCommon->weakReferences[i].get();
+                if (Heap::isMarked(weak))
+                    continue;
+                dataLog("    Weak reference ", RawPointer(weak), ".\n");
+            }
+        }
+    }
+#endif // ENABLE(DFG_JIT)
+
+    DeferGCForAWhile deferGC(*heap());
+    
+    // We want to accomplish two things here:
+    // 1) Make sure that if this CodeBlock is on the stack right now, then if we return to it
+    //    we should OSR exit at the top of the next bytecode instruction after the return.
+    // 2) Make sure that if we call the owner executable, then we shouldn't call this CodeBlock.
+
+#if ENABLE(DFG_JIT)
+    if (reason != Profiler::JettisonDueToOldAge) {
+        if (Profiler::Compilation* compilation = jitCode()->dfgCommon()->compilation.get())
+            compilation->setJettisonReason(reason, detail);
+        
+        // This accomplishes (1), and does its own book-keeping about whether it has already happened.
+        if (!jitCode()->dfgCommon()->invalidate()) {
+            // We've already been invalidated.
+            RELEASE_ASSERT(this != replacement() || (m_vm->heap.isCurrentThreadBusy() && !Heap::isMarked(ownerScriptExecutable())));
+            return;
+        }
+    }
+    
+    if (DFG::shouldDumpDisassembly())
+        dataLog("    Did invalidate ", *this, "\n");
+    
+    // Count the reoptimization if that's what the user wanted.
+    if (mode == CountReoptimization) {
+        // FIXME: Maybe this should call alternative().
+        // https://bugs.webkit.org/show_bug.cgi?id=123677
+        baselineAlternative()->countReoptimization();
+        if (DFG::shouldDumpDisassembly())
+            dataLog("    Did count reoptimization for ", *this, "\n");
+    }
+    
+    if (this != replacement()) {
+        // This means that we were never the entrypoint. This can happen for OSR entry code
+        // blocks.
+        return;
+    }
+
+    if (alternative())
+        alternative()->optimizeAfterWarmUp();
+
+    if (reason != Profiler::JettisonDueToOldAge)
+        tallyFrequentExitSites();
+#endif // ENABLE(DFG_JIT)
+
+    // Jettison can happen during GC. We don't want to install code to a dead executable
+    // because that would add a dead object to the remembered set.
+    if (m_vm->heap.isCurrentThreadBusy() && !Heap::isMarked(ownerScriptExecutable()))
+        return;
+
+    // This accomplishes (2).
+    ownerScriptExecutable()->installCode(
+        m_globalObject->vm(), alternative(), codeType(), specializationKind());
+
+#if ENABLE(DFG_JIT)
+    if (DFG::shouldDumpDisassembly())
+        dataLog("    Did install baseline version of ", *this, "\n");
+#endif // ENABLE(DFG_JIT)
+}
+
+JSGlobalObject* CodeBlock::globalObjectFor(CodeOrigin codeOrigin)
+{
+    if (!codeOrigin.inlineCallFrame)
+        return globalObject();
+    return codeOrigin.inlineCallFrame->baselineCodeBlock->globalObject();
+}
+
+class RecursionCheckFunctor {
+public:
+    RecursionCheckFunctor(CallFrame* startCallFrame, CodeBlock* codeBlock, unsigned depthToCheck)
+        : m_startCallFrame(startCallFrame)
+        , m_codeBlock(codeBlock)
+        , m_depthToCheck(depthToCheck)
+        , m_foundStartCallFrame(false)
+        , m_didRecurse(false)
+    { }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        CallFrame* currentCallFrame = visitor->callFrame();
+
+        if (currentCallFrame == m_startCallFrame)
+            m_foundStartCallFrame = true;
+
+        if (m_foundStartCallFrame) {
+            if (visitor->callFrame()->codeBlock() == m_codeBlock) {
+                m_didRecurse = true;
+                return StackVisitor::Done;
+            }
+
+            if (!m_depthToCheck--)
+                return StackVisitor::Done;
+        }
+
+        return StackVisitor::Continue;
+    }
+
+    bool didRecurse() const { return m_didRecurse; }
+
+private:
+    CallFrame* m_startCallFrame;
+    CodeBlock* m_codeBlock;
+    mutable unsigned m_depthToCheck;
+    mutable bool m_foundStartCallFrame;
+    mutable bool m_didRecurse;
+};
+
+void CodeBlock::noticeIncomingCall(ExecState* callerFrame)
+{
+    CodeBlock* callerCodeBlock = callerFrame->codeBlock();
+    
+    if (Options::verboseCallLink())
+        dataLog("Noticing call link from ", pointerDump(callerCodeBlock), " to ", *this, "\n");
+    
+#if ENABLE(DFG_JIT)
+    if (!m_shouldAlwaysBeInlined)
+        return;
+    
+    if (!callerCodeBlock) {
+        m_shouldAlwaysBeInlined = false;
+        if (Options::verboseCallLink())
+            dataLog("    Clearing SABI because caller is native.\n");
+        return;
+    }
+
+    if (!hasBaselineJITProfiling())
+        return;
+
+    if (!DFG::mightInlineFunction(this))
+        return;
+
+    if (!canInline(capabilityLevelState()))
+        return;
+    
+    if (!DFG::isSmallEnoughToInlineCodeInto(callerCodeBlock)) {
+        m_shouldAlwaysBeInlined = false;
+        if (Options::verboseCallLink())
+            dataLog("    Clearing SABI because caller is too large.\n");
+        return;
+    }
+
+    if (callerCodeBlock->jitType() == JITCode::InterpreterThunk) {
+        // If the caller is still in the interpreter, then we can't expect inlining to
+        // happen anytime soon. Assume it's profitable to optimize it separately. This
+        // ensures that a function is SABI only if it is called no more frequently than
+        // any of its callers.
+        m_shouldAlwaysBeInlined = false;
+        if (Options::verboseCallLink())
+            dataLog("    Clearing SABI because caller is in LLInt.\n");
+        return;
+    }
+    
+    if (JITCode::isOptimizingJIT(callerCodeBlock->jitType())) {
+        m_shouldAlwaysBeInlined = false;
+        if (Options::verboseCallLink())
+            dataLog("    Clearing SABI bcause caller was already optimized.\n");
+        return;
+    }
+    
+    if (callerCodeBlock->codeType() != FunctionCode) {
+        // If the caller is either eval or global code, assume that that won't be
+        // optimized anytime soon. For eval code this is particularly true since we
+        // delay eval optimization by a *lot*.
+        m_shouldAlwaysBeInlined = false;
+        if (Options::verboseCallLink())
+            dataLog("    Clearing SABI because caller is not a function.\n");
+        return;
+    }
+
+    // Recursive calls won't be inlined.
+    RecursionCheckFunctor functor(callerFrame, this, Options::maximumInliningDepth());
+    vm()->topCallFrame->iterate(functor);
+
+    if (functor.didRecurse()) {
+        if (Options::verboseCallLink())
+            dataLog("    Clearing SABI because recursion was detected.\n");
+        m_shouldAlwaysBeInlined = false;
+        return;
+    }
+    
+    if (callerCodeBlock->capabilityLevelState() == DFG::CapabilityLevelNotSet) {
+        dataLog("In call from ", *callerCodeBlock, " ", callerFrame->codeOrigin(), " to ", *this, ": caller's DFG capability level is not set.\n");
+        CRASH();
+    }
+    
+    if (canCompile(callerCodeBlock->capabilityLevelState()))
+        return;
+    
+    if (Options::verboseCallLink())
+        dataLog("    Clearing SABI because the caller is not a DFG candidate.\n");
+    
+    m_shouldAlwaysBeInlined = false;
+#endif
+}
+
+unsigned CodeBlock::reoptimizationRetryCounter() const
+{
+#if ENABLE(JIT)
+    ASSERT(m_reoptimizationRetryCounter <= Options::reoptimizationRetryCounterMax());
+    return m_reoptimizationRetryCounter;
+#else
+    return 0;
+#endif // ENABLE(JIT)
+}
+
+#if ENABLE(JIT)
+void CodeBlock::setCalleeSaveRegisters(RegisterSet calleeSaveRegisters)
+{
+    m_calleeSaveRegisters = std::make_unique<RegisterAtOffsetList>(calleeSaveRegisters);
+}
+
+void CodeBlock::setCalleeSaveRegisters(std::unique_ptr<RegisterAtOffsetList> registerAtOffsetList)
+{
+    m_calleeSaveRegisters = WTFMove(registerAtOffsetList);
+}
+    
+static size_t roundCalleeSaveSpaceAsVirtualRegisters(size_t calleeSaveRegisters)
+{
+    static const unsigned cpuRegisterSize = sizeof(void*);
+    return (WTF::roundUpToMultipleOf(sizeof(Register), calleeSaveRegisters * cpuRegisterSize) / sizeof(Register));
+
+}
+
+size_t CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters()
+{
+    return roundCalleeSaveSpaceAsVirtualRegisters(numberOfLLIntBaselineCalleeSaveRegisters());
+}
+
+size_t CodeBlock::calleeSaveSpaceAsVirtualRegisters()
+{
+    return roundCalleeSaveSpaceAsVirtualRegisters(m_calleeSaveRegisters->size());
+}
+
+void CodeBlock::countReoptimization()
+{
+    m_reoptimizationRetryCounter++;
+    if (m_reoptimizationRetryCounter > Options::reoptimizationRetryCounterMax())
+        m_reoptimizationRetryCounter = Options::reoptimizationRetryCounterMax();
+}
+
+unsigned CodeBlock::numberOfDFGCompiles()
+{
+    ASSERT(JITCode::isBaselineCode(jitType()));
+    if (Options::testTheFTL()) {
+        if (m_didFailFTLCompilation)
+            return 1000000;
+        return (m_hasBeenCompiledWithFTL ? 1 : 0) + m_reoptimizationRetryCounter;
+    }
+    return (JITCode::isOptimizingJIT(replacement()->jitType()) ? 1 : 0) + m_reoptimizationRetryCounter;
+}
+
+int32_t CodeBlock::codeTypeThresholdMultiplier() const
+{
+    if (codeType() == EvalCode)
+        return Options::evalThresholdMultiplier();
+    
+    return 1;
+}
+
+double CodeBlock::optimizationThresholdScalingFactor()
+{
+    // This expression arises from doing a least-squares fit of
+    //
+    // F[x_] =: a * Sqrt[x + b] + Abs[c * x] + d
+    //
+    // against the data points:
+    //
+    //    x       F[x_]
+    //    10       0.9          (smallest reasonable code block)
+    //   200       1.0          (typical small-ish code block)
+    //   320       1.2          (something I saw in 3d-cube that I wanted to optimize)
+    //  1268       5.0          (something I saw in 3d-cube that I didn't want to optimize)
+    //  4000       5.5          (random large size, used to cause the function to converge to a shallow curve of some sort)
+    // 10000       6.0          (similar to above)
+    //
+    // I achieve the minimization using the following Mathematica code:
+    //
+    // MyFunctionTemplate[x_, a_, b_, c_, d_] := a*Sqrt[x + b] + Abs[c*x] + d
+    //
+    // samples = {{10, 0.9}, {200, 1}, {320, 1.2}, {1268, 5}, {4000, 5.5}, {10000, 6}}
+    //
+    // solution = 
+    //     Minimize[Plus @@ ((MyFunctionTemplate[#[[1]], a, b, c, d] - #[[2]])^2 & /@ samples),
+    //         {a, b, c, d}][[2]]
+    //
+    // And the code below (to initialize a, b, c, d) is generated by:
+    //
+    // Print["const double " <> ToString[#[[1]]] <> " = " <>
+    //     If[#[[2]] < 0.00001, "0.0", ToString[#[[2]]]] <> ";"] & /@ solution
+    //
+    // We've long known the following to be true:
+    // - Small code blocks are cheap to optimize and so we should do it sooner rather
+    //   than later.
+    // - Large code blocks are expensive to optimize and so we should postpone doing so,
+    //   and sometimes have a large enough threshold that we never optimize them.
+    // - The difference in cost is not totally linear because (a) just invoking the
+    //   DFG incurs some base cost and (b) for large code blocks there is enough slop
+    //   in the correlation between instruction count and the actual compilation cost
+    //   that for those large blocks, the instruction count should not have a strong
+    //   influence on our threshold.
+    //
+    // I knew the goals but I didn't know how to achieve them; so I picked an interesting
+    // example where the heuristics were right (code block in 3d-cube with instruction
+    // count 320, which got compiled early as it should have been) and one where they were
+    // totally wrong (code block in 3d-cube with instruction count 1268, which was expensive
+    // to compile and didn't run often enough to warrant compilation in my opinion), and
+    // then threw in additional data points that represented my own guess of what our
+    // heuristics should do for some round-numbered examples.
+    //
+    // The expression to which I decided to fit the data arose because I started with an
+    // affine function, and then did two things: put the linear part in an Abs to ensure
+    // that the fit didn't end up choosing a negative value of c (which would result in
+    // the function turning over and going negative for large x) and I threw in a Sqrt
+    // term because Sqrt represents my intution that the function should be more sensitive
+    // to small changes in small values of x, but less sensitive when x gets large.
+    
+    // Note that the current fit essentially eliminates the linear portion of the
+    // expression (c == 0.0).
+    const double a = 0.061504;
+    const double b = 1.02406;
+    const double c = 0.0;
+    const double d = 0.825914;
+    
+    double instructionCount = this->instructionCount();
+    
+    ASSERT(instructionCount); // Make sure this is called only after we have an instruction stream; otherwise it'll just return the value of d, which makes no sense.
+    
+    double result = d + a * sqrt(instructionCount + b) + c * instructionCount;
+    
+    result *= codeTypeThresholdMultiplier();
+    
+    if (Options::verboseOSR()) {
+        dataLog(
+            *this, ": instruction count is ", instructionCount,
+            ", scaling execution counter by ", result, " * ", codeTypeThresholdMultiplier(),
+            "\n");
+    }
+    return result;
+}
+
+static int32_t clipThreshold(double threshold)
+{
+    if (threshold < 1.0)
+        return 1;
+    
+    if (threshold > static_cast<double>(std::numeric_limits<int32_t>::max()))
+        return std::numeric_limits<int32_t>::max();
+    
+    return static_cast<int32_t>(threshold);
+}
+
+int32_t CodeBlock::adjustedCounterValue(int32_t desiredThreshold)
+{
+    return clipThreshold(
+        static_cast<double>(desiredThreshold) *
+        optimizationThresholdScalingFactor() *
+        (1 << reoptimizationRetryCounter()));
+}
+
+bool CodeBlock::checkIfOptimizationThresholdReached()
+{
+#if ENABLE(DFG_JIT)
+    if (DFG::Worklist* worklist = DFG::existingGlobalDFGWorklistOrNull()) {
+        if (worklist->compilationState(DFG::CompilationKey(this, DFG::DFGMode))
+            == DFG::Worklist::Compiled) {
+            optimizeNextInvocation();
+            return true;
+        }
+    }
+#endif
+    
+    return m_jitExecuteCounter.checkIfThresholdCrossedAndSet(this);
+}
+
+void CodeBlock::optimizeNextInvocation()
+{
+    if (Options::verboseOSR())
+        dataLog(*this, ": Optimizing next invocation.\n");
+    m_jitExecuteCounter.setNewThreshold(0, this);
+}
+
+void CodeBlock::dontOptimizeAnytimeSoon()
+{
+    if (Options::verboseOSR())
+        dataLog(*this, ": Not optimizing anytime soon.\n");
+    m_jitExecuteCounter.deferIndefinitely();
+}
+
+void CodeBlock::optimizeAfterWarmUp()
+{
+    if (Options::verboseOSR())
+        dataLog(*this, ": Optimizing after warm-up.\n");
+#if ENABLE(DFG_JIT)
+    m_jitExecuteCounter.setNewThreshold(
+        adjustedCounterValue(Options::thresholdForOptimizeAfterWarmUp()), this);
+#endif
+}
+
+void CodeBlock::optimizeAfterLongWarmUp()
+{
+    if (Options::verboseOSR())
+        dataLog(*this, ": Optimizing after long warm-up.\n");
+#if ENABLE(DFG_JIT)
+    m_jitExecuteCounter.setNewThreshold(
+        adjustedCounterValue(Options::thresholdForOptimizeAfterLongWarmUp()), this);
+#endif
+}
+
+void CodeBlock::optimizeSoon()
+{
+    if (Options::verboseOSR())
+        dataLog(*this, ": Optimizing soon.\n");
+#if ENABLE(DFG_JIT)
+    m_jitExecuteCounter.setNewThreshold(
+        adjustedCounterValue(Options::thresholdForOptimizeSoon()), this);
+#endif
+}
+
+void CodeBlock::forceOptimizationSlowPathConcurrently()
+{
+    if (Options::verboseOSR())
+        dataLog(*this, ": Forcing slow path concurrently.\n");
+    m_jitExecuteCounter.forceSlowPathConcurrently();
+}
+
+#if ENABLE(DFG_JIT)
+void CodeBlock::setOptimizationThresholdBasedOnCompilationResult(CompilationResult result)
+{
+    JITCode::JITType type = jitType();
+    if (type != JITCode::BaselineJIT) {
+        dataLog(*this, ": expected to have baseline code but have ", type, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    CodeBlock* theReplacement = replacement();
+    if ((result == CompilationSuccessful) != (theReplacement != this)) {
+        dataLog(*this, ": we have result = ", result, " but ");
+        if (theReplacement == this)
+            dataLog("we are our own replacement.\n");
+        else
+            dataLog("our replacement is ", pointerDump(theReplacement), "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    switch (result) {
+    case CompilationSuccessful:
+        RELEASE_ASSERT(JITCode::isOptimizingJIT(replacement()->jitType()));
+        optimizeNextInvocation();
+        return;
+    case CompilationFailed:
+        dontOptimizeAnytimeSoon();
+        return;
+    case CompilationDeferred:
+        // We'd like to do dontOptimizeAnytimeSoon() but we cannot because
+        // forceOptimizationSlowPathConcurrently() is inherently racy. It won't
+        // necessarily guarantee anything. So, we make sure that even if that
+        // function ends up being a no-op, we still eventually retry and realize
+        // that we have optimized code ready.
+        optimizeAfterWarmUp();
+        return;
+    case CompilationInvalidated:
+        // Retry with exponential backoff.
+        countReoptimization();
+        optimizeAfterWarmUp();
+        return;
+    }
+    
+    dataLog("Unrecognized result: ", static_cast<int>(result), "\n");
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+#endif
+    
+uint32_t CodeBlock::adjustedExitCountThreshold(uint32_t desiredThreshold)
+{
+    ASSERT(JITCode::isOptimizingJIT(jitType()));
+    // Compute this the lame way so we don't saturate. This is called infrequently
+    // enough that this loop won't hurt us.
+    unsigned result = desiredThreshold;
+    for (unsigned n = baselineVersion()->reoptimizationRetryCounter(); n--;) {
+        unsigned newResult = result << 1;
+        if (newResult < result)
+            return std::numeric_limits<uint32_t>::max();
+        result = newResult;
+    }
+    return result;
+}
+
+uint32_t CodeBlock::exitCountThresholdForReoptimization()
+{
+    return adjustedExitCountThreshold(Options::osrExitCountForReoptimization() * codeTypeThresholdMultiplier());
+}
+
+uint32_t CodeBlock::exitCountThresholdForReoptimizationFromLoop()
+{
+    return adjustedExitCountThreshold(Options::osrExitCountForReoptimizationFromLoop() * codeTypeThresholdMultiplier());
+}
+
+bool CodeBlock::shouldReoptimizeNow()
+{
+    return osrExitCounter() >= exitCountThresholdForReoptimization();
+}
+
+bool CodeBlock::shouldReoptimizeFromLoopNow()
+{
+    return osrExitCounter() >= exitCountThresholdForReoptimizationFromLoop();
+}
+#endif
+
+ArrayProfile* CodeBlock::getArrayProfile(const ConcurrentJSLocker&, unsigned bytecodeOffset)
+{
+    for (unsigned i = 0; i < m_arrayProfiles.size(); ++i) {
+        if (m_arrayProfiles[i].bytecodeOffset() == bytecodeOffset)
+            return &m_arrayProfiles[i];
+    }
+    return 0;
+}
+
+ArrayProfile* CodeBlock::getArrayProfile(unsigned bytecodeOffset)
+{
+    ConcurrentJSLocker locker(m_lock);
+    return getArrayProfile(locker, bytecodeOffset);
+}
+
+ArrayProfile* CodeBlock::addArrayProfile(const ConcurrentJSLocker&, unsigned bytecodeOffset)
+{
+    m_arrayProfiles.append(ArrayProfile(bytecodeOffset));
+    return &m_arrayProfiles.last();
+}
+
+ArrayProfile* CodeBlock::addArrayProfile(unsigned bytecodeOffset)
+{
+    ConcurrentJSLocker locker(m_lock);
+    return addArrayProfile(locker, bytecodeOffset);
+}
+
+ArrayProfile* CodeBlock::getOrAddArrayProfile(const ConcurrentJSLocker& locker, unsigned bytecodeOffset)
+{
+    ArrayProfile* result = getArrayProfile(locker, bytecodeOffset);
+    if (result)
+        return result;
+    return addArrayProfile(locker, bytecodeOffset);
+}
+
+ArrayProfile* CodeBlock::getOrAddArrayProfile(unsigned bytecodeOffset)
+{
+    ConcurrentJSLocker locker(m_lock);
+    return getOrAddArrayProfile(locker, bytecodeOffset);
+}
+
+#if ENABLE(DFG_JIT)
+Vector<CodeOrigin, 0, UnsafeVectorOverflow>& CodeBlock::codeOrigins()
+{
+    return m_jitCode->dfgCommon()->codeOrigins;
+}
+
+size_t CodeBlock::numberOfDFGIdentifiers() const
+{
+    if (!JITCode::isOptimizingJIT(jitType()))
+        return 0;
+    
+    return m_jitCode->dfgCommon()->dfgIdentifiers.size();
+}
+
+const Identifier& CodeBlock::identifier(int index) const
+{
+    size_t unlinkedIdentifiers = m_unlinkedCode->numberOfIdentifiers();
+    if (static_cast<unsigned>(index) < unlinkedIdentifiers)
+        return m_unlinkedCode->identifier(index);
+    ASSERT(JITCode::isOptimizingJIT(jitType()));
+    return m_jitCode->dfgCommon()->dfgIdentifiers[index - unlinkedIdentifiers];
+}
+#endif // ENABLE(DFG_JIT)
+
+void CodeBlock::updateAllPredictionsAndCountLiveness(unsigned& numberOfLiveNonArgumentValueProfiles, unsigned& numberOfSamplesInProfiles)
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    numberOfLiveNonArgumentValueProfiles = 0;
+    numberOfSamplesInProfiles = 0; // If this divided by ValueProfile::numberOfBuckets equals numberOfValueProfiles() then value profiles are full.
+    for (unsigned i = 0; i < totalNumberOfValueProfiles(); ++i) {
+        ValueProfile* profile = getFromAllValueProfiles(i);
+        unsigned numSamples = profile->totalNumberOfSamples();
+        if (numSamples > ValueProfile::numberOfBuckets)
+            numSamples = ValueProfile::numberOfBuckets; // We don't want profiles that are extremely hot to be given more weight.
+        numberOfSamplesInProfiles += numSamples;
+        if (profile->m_bytecodeOffset < 0) {
+            profile->computeUpdatedPrediction(locker);
+            continue;
+        }
+        if (profile->numberOfSamples() || profile->m_prediction != SpecNone)
+            numberOfLiveNonArgumentValueProfiles++;
+        profile->computeUpdatedPrediction(locker);
+    }
+    
+#if ENABLE(DFG_JIT)
+    m_lazyOperandValueProfiles.computeUpdatedPredictions(locker);
+#endif
+}
+
+void CodeBlock::updateAllValueProfilePredictions()
+{
+    unsigned ignoredValue1, ignoredValue2;
+    updateAllPredictionsAndCountLiveness(ignoredValue1, ignoredValue2);
+}
+
+void CodeBlock::updateAllArrayPredictions()
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    for (unsigned i = m_arrayProfiles.size(); i--;)
+        m_arrayProfiles[i].computeUpdatedPrediction(locker, this);
+    
+    // Don't count these either, for similar reasons.
+    for (unsigned i = m_arrayAllocationProfiles.size(); i--;)
+        m_arrayAllocationProfiles[i].updateIndexingType();
+}
+
+void CodeBlock::updateAllPredictions()
+{
+    updateAllValueProfilePredictions();
+    updateAllArrayPredictions();
+}
+
+bool CodeBlock::shouldOptimizeNow()
+{
+    if (Options::verboseOSR())
+        dataLog("Considering optimizing ", *this, "...\n");
+
+    if (m_optimizationDelayCounter >= Options::maximumOptimizationDelay())
+        return true;
+    
+    updateAllArrayPredictions();
+    
+    unsigned numberOfLiveNonArgumentValueProfiles;
+    unsigned numberOfSamplesInProfiles;
+    updateAllPredictionsAndCountLiveness(numberOfLiveNonArgumentValueProfiles, numberOfSamplesInProfiles);
+
+    if (Options::verboseOSR()) {
+        dataLogF(
+            "Profile hotness: %lf (%u / %u), %lf (%u / %u)\n",
+            (double)numberOfLiveNonArgumentValueProfiles / numberOfValueProfiles(),
+            numberOfLiveNonArgumentValueProfiles, numberOfValueProfiles(),
+            (double)numberOfSamplesInProfiles / ValueProfile::numberOfBuckets / numberOfValueProfiles(),
+            numberOfSamplesInProfiles, ValueProfile::numberOfBuckets * numberOfValueProfiles());
+    }
+
+    if ((!numberOfValueProfiles() || (double)numberOfLiveNonArgumentValueProfiles / numberOfValueProfiles() >= Options::desiredProfileLivenessRate())
+        && (!totalNumberOfValueProfiles() || (double)numberOfSamplesInProfiles / ValueProfile::numberOfBuckets / totalNumberOfValueProfiles() >= Options::desiredProfileFullnessRate())
+        && static_cast<unsigned>(m_optimizationDelayCounter) + 1 >= Options::minimumOptimizationDelay())
+        return true;
+    
+    ASSERT(m_optimizationDelayCounter < std::numeric_limits<uint8_t>::max());
+    m_optimizationDelayCounter++;
+    optimizeAfterWarmUp();
+    return false;
+}
+
+#if ENABLE(DFG_JIT)
+void CodeBlock::tallyFrequentExitSites()
+{
+    ASSERT(JITCode::isOptimizingJIT(jitType()));
+    ASSERT(alternative()->jitType() == JITCode::BaselineJIT);
+    
+    CodeBlock* profiledBlock = alternative();
+    
+    switch (jitType()) {
+    case JITCode::DFGJIT: {
+        DFG::JITCode* jitCode = m_jitCode->dfg();
+        for (unsigned i = 0; i < jitCode->osrExit.size(); ++i) {
+            DFG::OSRExit& exit = jitCode->osrExit[i];
+            exit.considerAddingAsFrequentExitSite(profiledBlock);
+        }
+        break;
+    }
+
+#if ENABLE(FTL_JIT)
+    case JITCode::FTLJIT: {
+        // There is no easy way to avoid duplicating this code since the FTL::JITCode::osrExit
+        // vector contains a totally different type, that just so happens to behave like
+        // DFG::JITCode::osrExit.
+        FTL::JITCode* jitCode = m_jitCode->ftl();
+        for (unsigned i = 0; i < jitCode->osrExit.size(); ++i) {
+            FTL::OSRExit& exit = jitCode->osrExit[i];
+            exit.considerAddingAsFrequentExitSite(profiledBlock);
+        }
+        break;
+    }
+#endif
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+#endif // ENABLE(DFG_JIT)
+
+#if ENABLE(VERBOSE_VALUE_PROFILE)
+void CodeBlock::dumpValueProfiles()
+{
+    dataLog("ValueProfile for ", *this, ":\n");
+    for (unsigned i = 0; i < totalNumberOfValueProfiles(); ++i) {
+        ValueProfile* profile = getFromAllValueProfiles(i);
+        if (profile->m_bytecodeOffset < 0) {
+            ASSERT(profile->m_bytecodeOffset == -1);
+            dataLogF("   arg = %u: ", i);
+        } else
+            dataLogF("   bc = %d: ", profile->m_bytecodeOffset);
+        if (!profile->numberOfSamples() && profile->m_prediction == SpecNone) {
+            dataLogF("<empty>\n");
+            continue;
+        }
+        profile->dump(WTF::dataFile());
+        dataLogF("\n");
+    }
+    dataLog("RareCaseProfile for ", *this, ":\n");
+    for (unsigned i = 0; i < numberOfRareCaseProfiles(); ++i) {
+        RareCaseProfile* profile = rareCaseProfile(i);
+        dataLogF("   bc = %d: %u\n", profile->m_bytecodeOffset, profile->m_counter);
+    }
+}
+#endif // ENABLE(VERBOSE_VALUE_PROFILE)
+
+unsigned CodeBlock::frameRegisterCount()
+{
+    switch (jitType()) {
+    case JITCode::InterpreterThunk:
+        return LLInt::frameRegisterCountFor(this);
+
+#if ENABLE(JIT)
+    case JITCode::BaselineJIT:
+        return JIT::frameRegisterCountFor(this);
+#endif // ENABLE(JIT)
+
+#if ENABLE(DFG_JIT)
+    case JITCode::DFGJIT:
+    case JITCode::FTLJIT:
+        return jitCode()->dfgCommon()->frameRegisterCount;
+#endif // ENABLE(DFG_JIT)
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+int CodeBlock::stackPointerOffset()
+{
+    return virtualRegisterForLocal(frameRegisterCount() - 1).offset();
+}
+
+size_t CodeBlock::predictedMachineCodeSize()
+{
+    // This will be called from CodeBlock::CodeBlock before either m_vm or the
+    // instructions have been initialized. It's OK to return 0 because what will really
+    // matter is the recomputation of this value when the slow path is triggered.
+    if (!m_vm)
+        return 0;
+    
+    if (!*m_vm->machineCodeBytesPerBytecodeWordForBaselineJIT)
+        return 0; // It's as good of a prediction as we'll get.
+    
+    // Be conservative: return a size that will be an overestimation 84% of the time.
+    double multiplier = m_vm->machineCodeBytesPerBytecodeWordForBaselineJIT->mean() +
+        m_vm->machineCodeBytesPerBytecodeWordForBaselineJIT->standardDeviation();
+    
+    // Be paranoid: silently reject bogus multipiers. Silently doing the "wrong" thing
+    // here is OK, since this whole method is just a heuristic.
+    if (multiplier < 0 || multiplier > 1000)
+        return 0;
+    
+    double doubleResult = multiplier * m_instructions.size();
+    
+    // Be even more paranoid: silently reject values that won't fit into a size_t. If
+    // the function is so huge that we can't even fit it into virtual memory then we
+    // should probably have some other guards in place to prevent us from even getting
+    // to this point.
+    if (doubleResult > std::numeric_limits<size_t>::max())
+        return 0;
+    
+    return static_cast<size_t>(doubleResult);
+}
+
+bool CodeBlock::usesOpcode(OpcodeID opcodeID)
+{
+    Interpreter* interpreter = vm()->interpreter;
+    Instruction* instructionsBegin = instructions().begin();
+    unsigned instructionCount = instructions().size();
+    
+    for (unsigned bytecodeOffset = 0; bytecodeOffset < instructionCount; ) {
+        switch (interpreter->getOpcodeID(instructionsBegin[bytecodeOffset].u.opcode)) {
+#define DEFINE_OP(curOpcode, length)        \
+        case curOpcode:                     \
+            if (curOpcode == opcodeID)      \
+                return true;                \
+            bytecodeOffset += length;       \
+            break;
+            FOR_EACH_OPCODE_ID(DEFINE_OP)
+#undef DEFINE_OP
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+    
+    return false;
+}
+
+String CodeBlock::nameForRegister(VirtualRegister virtualRegister)
+{
+    for (unsigned i = 0; i < m_constantRegisters.size(); i++) {
+        if (m_constantRegisters[i].get().isEmpty())
+            continue;
+        if (SymbolTable* symbolTable = jsDynamicCast<SymbolTable*>(m_constantRegisters[i].get())) {
+            ConcurrentJSLocker locker(symbolTable->m_lock);
+            auto end = symbolTable->end(locker);
+            for (auto ptr = symbolTable->begin(locker); ptr != end; ++ptr) {
+                if (ptr->value.varOffset() == VarOffset(virtualRegister)) {
+                    // FIXME: This won't work from the compilation thread.
+                    // https://bugs.webkit.org/show_bug.cgi?id=115300
+                    return ptr->key.get();
+                }
+            }
+        }
+    }
+    if (virtualRegister == thisRegister())
+        return ASCIILiteral("this");
+    if (virtualRegister.isArgument())
+        return String::format("arguments[%3d]", virtualRegister.toArgument());
+
+    return "";
+}
+
+ValueProfile* CodeBlock::valueProfileForBytecodeOffset(int bytecodeOffset)
+{
+    OpcodeID opcodeID = m_vm->interpreter->getOpcodeID(instructions()[bytecodeOffset].u.opcode);
+    unsigned length = opcodeLength(opcodeID);
+    return instructions()[bytecodeOffset + length - 1].u.profile;
+}
+
+void CodeBlock::validate()
+{
+    BytecodeLivenessAnalysis liveness(this); // Compute directly from scratch so it doesn't effect CodeBlock footprint.
+    
+    FastBitVector liveAtHead = liveness.getLivenessInfoAtBytecodeOffset(0);
+    
+    if (liveAtHead.numBits() != static_cast<size_t>(m_numCalleeLocals)) {
+        beginValidationDidFail();
+        dataLog("    Wrong number of bits in result!\n");
+        dataLog("    Result: ", liveAtHead, "\n");
+        dataLog("    Bit count: ", liveAtHead.numBits(), "\n");
+        endValidationDidFail();
+    }
+    
+    for (unsigned i = m_numCalleeLocals; i--;) {
+        VirtualRegister reg = virtualRegisterForLocal(i);
+        
+        if (liveAtHead[i]) {
+            beginValidationDidFail();
+            dataLog("    Variable ", reg, " is expected to be dead.\n");
+            dataLog("    Result: ", liveAtHead, "\n");
+            endValidationDidFail();
+        }
+    }
+}
+
+void CodeBlock::beginValidationDidFail()
+{
+    dataLog("Validation failure in ", *this, ":\n");
+    dataLog("\n");
+}
+
+void CodeBlock::endValidationDidFail()
+{
+    dataLog("\n");
+    dumpBytecode();
+    dataLog("\n");
+    dataLog("Validation failure.\n");
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void CodeBlock::addBreakpoint(unsigned numBreakpoints)
+{
+    m_numBreakpoints += numBreakpoints;
+    ASSERT(m_numBreakpoints);
+    if (JITCode::isOptimizingJIT(jitType()))
+        jettison(Profiler::JettisonDueToDebuggerBreakpoint);
+}
+
+void CodeBlock::setSteppingMode(CodeBlock::SteppingMode mode)
+{
+    m_steppingMode = mode;
+    if (mode == SteppingModeEnabled && JITCode::isOptimizingJIT(jitType()))
+        jettison(Profiler::JettisonDueToDebuggerStepping);
+}
+
+RareCaseProfile* CodeBlock::addRareCaseProfile(int bytecodeOffset)
+{
+    m_rareCaseProfiles.append(RareCaseProfile(bytecodeOffset));
+    return &m_rareCaseProfiles.last();
+}
+
+RareCaseProfile* CodeBlock::rareCaseProfileForBytecodeOffset(int bytecodeOffset)
+{
+    return tryBinarySearch<RareCaseProfile, int>(
+        m_rareCaseProfiles, m_rareCaseProfiles.size(), bytecodeOffset,
+        getRareCaseProfileBytecodeOffset);
+}
+
+unsigned CodeBlock::rareCaseProfileCountForBytecodeOffset(int bytecodeOffset)
+{
+    RareCaseProfile* profile = rareCaseProfileForBytecodeOffset(bytecodeOffset);
+    if (profile)
+        return profile->m_counter;
+    return 0;
+}
+
+ArithProfile* CodeBlock::arithProfileForBytecodeOffset(int bytecodeOffset)
+{
+    return arithProfileForPC(instructions().begin() + bytecodeOffset);
+}
+
+ArithProfile* CodeBlock::arithProfileForPC(Instruction* pc)
+{
+    auto opcodeID = vm()->interpreter->getOpcodeID(pc[0].u.opcode);
+    switch (opcodeID) {
+    case op_negate:
+        return bitwise_cast<ArithProfile*>(&pc[3].u.operand);
+    case op_bitor:
+    case op_bitand:
+    case op_bitxor:
+    case op_add:
+    case op_mul:
+    case op_sub:
+    case op_div:
+        return bitwise_cast<ArithProfile*>(&pc[4].u.operand);
+    default:
+        break;
+    }
+
+    return nullptr;
+}
+
+bool CodeBlock::couldTakeSpecialFastCase(int bytecodeOffset)
+{
+    if (!hasBaselineJITProfiling())
+        return false;
+    ArithProfile* profile = arithProfileForBytecodeOffset(bytecodeOffset);
+    if (!profile)
+        return false;
+    return profile->tookSpecialFastPath();
+}
+
+#if ENABLE(JIT)
+DFG::CapabilityLevel CodeBlock::capabilityLevel()
+{
+    DFG::CapabilityLevel result = computeCapabilityLevel();
+    m_capabilityLevelState = result;
+    return result;
+}
+#endif
+
+void CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler(RefCountedArray<Instruction>& instructions)
+{
+    if (!unlinkedCodeBlock()->hasOpProfileControlFlowBytecodeOffsets())
+        return;
+    const Vector<size_t>& bytecodeOffsets = unlinkedCodeBlock()->opProfileControlFlowBytecodeOffsets();
+    for (size_t i = 0, offsetsLength = bytecodeOffsets.size(); i < offsetsLength; i++) {
+        // Because op_profile_control_flow is emitted at the beginning of every basic block, finding 
+        // the next op_profile_control_flow will give us the text range of a single basic block.
+        size_t startIdx = bytecodeOffsets[i];
+        RELEASE_ASSERT(vm()->interpreter->getOpcodeID(instructions[startIdx].u.opcode) == op_profile_control_flow);
+        int basicBlockStartOffset = instructions[startIdx + 1].u.operand;
+        int basicBlockEndOffset;
+        if (i + 1 < offsetsLength) {
+            size_t endIdx = bytecodeOffsets[i + 1];
+            RELEASE_ASSERT(vm()->interpreter->getOpcodeID(instructions[endIdx].u.opcode) == op_profile_control_flow);
+            basicBlockEndOffset = instructions[endIdx + 1].u.operand - 1;
+        } else {
+            basicBlockEndOffset = m_sourceOffset + ownerScriptExecutable()->source().length() - 1; // Offset before the closing brace.
+            basicBlockStartOffset = std::min(basicBlockStartOffset, basicBlockEndOffset); // Some start offsets may be at the closing brace, ensure it is the offset before.
+        }
+
+        // The following check allows for the same textual JavaScript basic block to have its bytecode emitted more
+        // than once and still play nice with the control flow profiler. When basicBlockStartOffset is larger than 
+        // basicBlockEndOffset, it indicates that the bytecode generator has emitted code for the same AST node 
+        // more than once (for example: ForInNode, Finally blocks in TryNode, etc). Though these are different 
+        // basic blocks at the bytecode level, they are generated from the same textual basic block in the JavaScript 
+        // program. The condition: 
+        // (basicBlockEndOffset < basicBlockStartOffset) 
+        // is encountered when op_profile_control_flow lies across the boundary of these duplicated bytecode basic 
+        // blocks and the textual offset goes from the end of the duplicated block back to the beginning. These 
+        // ranges are dummy ranges and are ignored. The duplicated bytecode basic blocks point to the same 
+        // internal data structure, so if any of them execute, it will record the same textual basic block in the 
+        // JavaScript program as executing.
+        // At the bytecode level, this situation looks like:
+        // j: op_profile_control_flow (from j->k, we have basicBlockEndOffset < basicBlockStartOffset)
+        // ...
+        // k: op_profile_control_flow (we want to skip over the j->k block and start fresh at offset k as the start of a new basic block k->m).
+        // ...
+        // m: op_profile_control_flow
+        if (basicBlockEndOffset < basicBlockStartOffset) {
+            RELEASE_ASSERT(i + 1 < offsetsLength); // We should never encounter dummy blocks at the end of a CodeBlock.
+            instructions[startIdx + 1].u.basicBlockLocation = vm()->controlFlowProfiler()->dummyBasicBlock();
+            continue;
+        }
+
+        BasicBlockLocation* basicBlockLocation = vm()->controlFlowProfiler()->getBasicBlockLocation(ownerScriptExecutable()->sourceID(), basicBlockStartOffset, basicBlockEndOffset);
+
+        // Find all functions that are enclosed within the range: [basicBlockStartOffset, basicBlockEndOffset]
+        // and insert these functions' start/end offsets as gaps in the current BasicBlockLocation.
+        // This is necessary because in the original source text of a JavaScript program, 
+        // function literals form new basic blocks boundaries, but they aren't represented 
+        // inside the CodeBlock's instruction stream.
+        auto insertFunctionGaps = [basicBlockLocation, basicBlockStartOffset, basicBlockEndOffset] (const WriteBarrier<FunctionExecutable>& functionExecutable) {
+            const UnlinkedFunctionExecutable* executable = functionExecutable->unlinkedExecutable();
+            int functionStart = executable->typeProfilingStartOffset();
+            int functionEnd = executable->typeProfilingEndOffset();
+            if (functionStart >= basicBlockStartOffset && functionEnd <= basicBlockEndOffset)
+                basicBlockLocation->insertGap(functionStart, functionEnd);
+        };
+
+        for (const WriteBarrier<FunctionExecutable>& executable : m_functionDecls)
+            insertFunctionGaps(executable);
+        for (const WriteBarrier<FunctionExecutable>& executable : m_functionExprs)
+            insertFunctionGaps(executable);
+
+        instructions[startIdx + 1].u.basicBlockLocation = basicBlockLocation;
+    }
+}
+
+#if ENABLE(JIT)
+void CodeBlock::setPCToCodeOriginMap(std::unique_ptr<PCToCodeOriginMap>&& map) 
+{ 
+    m_pcToCodeOriginMap = WTFMove(map);
+}
+
+std::optional<CodeOrigin> CodeBlock::findPC(void* pc)
+{
+    if (m_pcToCodeOriginMap) {
+        if (std::optional<CodeOrigin> codeOrigin = m_pcToCodeOriginMap->findPC(pc))
+            return codeOrigin;
+    }
+
+    for (Bag<StructureStubInfo>::iterator iter = m_stubInfos.begin(); !!iter; ++iter) {
+        StructureStubInfo* stub = *iter;
+        if (stub->containsPC(pc))
+            return std::optional<CodeOrigin>(stub->codeOrigin);
+    }
+
+    if (std::optional<CodeOrigin> codeOrigin = m_jitCode->findPC(this, pc))
+        return codeOrigin;
+
+    return std::nullopt;
+}
+#endif // ENABLE(JIT)
+
+std::optional<unsigned> CodeBlock::bytecodeOffsetFromCallSiteIndex(CallSiteIndex callSiteIndex)
+{
+    std::optional<unsigned> bytecodeOffset;
+    JITCode::JITType jitType = this->jitType();
+    if (jitType == JITCode::InterpreterThunk || jitType == JITCode::BaselineJIT) {
+#if USE(JSVALUE64)
+        bytecodeOffset = callSiteIndex.bits();
+#else
+        Instruction* instruction = bitwise_cast<Instruction*>(callSiteIndex.bits());
+        bytecodeOffset = instruction - instructions().begin();
+#endif
+    } else if (jitType == JITCode::DFGJIT || jitType == JITCode::FTLJIT) {
+#if ENABLE(DFG_JIT)
+        RELEASE_ASSERT(canGetCodeOrigin(callSiteIndex));
+        CodeOrigin origin = codeOrigin(callSiteIndex);
+        bytecodeOffset = origin.bytecodeIndex;
+#else
+        RELEASE_ASSERT_NOT_REACHED();
+#endif
+    }
+
+    return bytecodeOffset;
+}
+
+int32_t CodeBlock::thresholdForJIT(int32_t threshold)
+{
+    switch (unlinkedCodeBlock()->didOptimize()) {
+    case MixedTriState:
+        return threshold;
+    case FalseTriState:
+        return threshold * 4;
+    case TrueTriState:
+        return threshold / 2;
+    }
+    ASSERT_NOT_REACHED();
+    return threshold;
+}
+
+void CodeBlock::jitAfterWarmUp()
+{
+    m_llintExecuteCounter.setNewThreshold(thresholdForJIT(Options::thresholdForJITAfterWarmUp()), this);
+}
+
+void CodeBlock::jitSoon()
+{
+    m_llintExecuteCounter.setNewThreshold(thresholdForJIT(Options::thresholdForJITSoon()), this);
+}
+
+void CodeBlock::dumpMathICStats()
+{
+#if ENABLE(MATH_IC_STATS)
+    double numAdds = 0.0;
+    double totalAddSize = 0.0;
+    double numMuls = 0.0;
+    double totalMulSize = 0.0;
+    double numNegs = 0.0;
+    double totalNegSize = 0.0;
+    double numSubs = 0.0;
+    double totalSubSize = 0.0;
+
+    auto countICs = [&] (CodeBlock* codeBlock) {
+        for (JITAddIC* addIC : codeBlock->m_addICs) {
+            numAdds++;
+            totalAddSize += addIC->codeSize();
+        }
+
+        for (JITMulIC* mulIC : codeBlock->m_mulICs) {
+            numMuls++;
+            totalMulSize += mulIC->codeSize();
+        }
+
+        for (JITNegIC* negIC : codeBlock->m_negICs) {
+            numNegs++;
+            totalNegSize += negIC->codeSize();
+        }
+
+        for (JITSubIC* subIC : codeBlock->m_subICs) {
+            numSubs++;
+            totalSubSize += subIC->codeSize();
+        }
+
+        return false;
+    };
+    heap()->forEachCodeBlock(countICs);
+
+    dataLog("Num Adds: ", numAdds, "\n");
+    dataLog("Total Add size in bytes: ", totalAddSize, "\n");
+    dataLog("Average Add size: ", totalAddSize / numAdds, "\n");
+    dataLog("\n");
+    dataLog("Num Muls: ", numMuls, "\n");
+    dataLog("Total Mul size in bytes: ", totalMulSize, "\n");
+    dataLog("Average Mul size: ", totalMulSize / numMuls, "\n");
+    dataLog("\n");
+    dataLog("Num Negs: ", numNegs, "\n");
+    dataLog("Total Neg size in bytes: ", totalNegSize, "\n");
+    dataLog("Average Neg size: ", totalNegSize / numNegs, "\n");
+    dataLog("\n");
+    dataLog("Num Subs: ", numSubs, "\n");
+    dataLog("Total Sub size in bytes: ", totalSubSize, "\n");
+    dataLog("Average Sub size: ", totalSubSize / numSubs, "\n");
+
+    dataLog("-----------------------\n");
+#endif
+}
+
+BytecodeLivenessAnalysis& CodeBlock::livenessAnalysisSlow()
+{
+    std::unique_ptr<BytecodeLivenessAnalysis> analysis = std::make_unique<BytecodeLivenessAnalysis>(this);
+    {
+        ConcurrentJSLocker locker(m_lock);
+        if (!m_livenessAnalysis)
+            m_livenessAnalysis = WTFMove(analysis);
+        return *m_livenessAnalysis;
+    }
+}
+
+
+} // namespace JSC
diff --git a/bytecode/CodeBlock.h b/bytecode/CodeBlock.h
new file mode 100644
index 0000000..1159bb3
--- /dev/null
+++ b/bytecode/CodeBlock.h
@@ -0,0 +1,1101 @@
+/*
+ * Copyright (C) 2008-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ArrayProfile.h"
+#include "ByValInfo.h"
+#include "BytecodeConventions.h"
+#include "CallLinkInfo.h"
+#include "CallReturnOffsetToBytecodeOffset.h"
+#include "CodeBlockHash.h"
+#include "CodeOrigin.h"
+#include "CodeType.h"
+#include "CompactJITCodeMap.h"
+#include "ConcurrentJSLock.h"
+#include "DFGCommon.h"
+#include "DFGExitProfile.h"
+#include "DeferredCompilationCallback.h"
+#include "DirectEvalCodeCache.h"
+#include "EvalExecutable.h"
+#include "ExecutionCounter.h"
+#include "ExpressionRangeInfo.h"
+#include "FunctionExecutable.h"
+#include "HandlerInfo.h"
+#include "Instruction.h"
+#include "JITCode.h"
+#include "JITMathICForwards.h"
+#include "JSCell.h"
+#include "JSGlobalObject.h"
+#include "JumpTable.h"
+#include "LLIntCallLinkInfo.h"
+#include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
+#include "LazyOperandValueProfile.h"
+#include "ModuleProgramExecutable.h"
+#include "ObjectAllocationProfile.h"
+#include "Options.h"
+#include "ProfilerJettisonReason.h"
+#include "ProgramExecutable.h"
+#include "PutPropertySlot.h"
+#include "UnconditionalFinalizer.h"
+#include "ValueProfile.h"
+#include "VirtualRegister.h"
+#include "Watchpoint.h"
+#include <wtf/Bag.h>
+#include <wtf/FastBitVector.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/RefCountedArray.h>
+#include <wtf/RefPtr.h>
+#include <wtf/SegmentedVector.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class BytecodeLivenessAnalysis;
+class CodeBlockSet;
+class ExecState;
+class JSModuleEnvironment;
+class LLIntOffsetsExtractor;
+class PCToCodeOriginMap;
+class RegisterAtOffsetList;
+class StructureStubInfo;
+
+enum class AccessType : int8_t;
+
+struct ArithProfile;
+
+typedef HashMap<CodeOrigin, StructureStubInfo*, CodeOriginApproximateHash> StubInfoMap;
+
+enum ReoptimizationMode { DontCountReoptimization, CountReoptimization };
+
+class CodeBlock : public JSCell {
+    typedef JSCell Base;
+    friend class BytecodeLivenessAnalysis;
+    friend class JIT;
+    friend class LLIntOffsetsExtractor;
+
+    class UnconditionalFinalizer : public JSC::UnconditionalFinalizer { 
+        void finalizeUnconditionally() override;
+    };
+
+    class WeakReferenceHarvester : public JSC::WeakReferenceHarvester {
+        void visitWeakReferences(SlotVisitor&) override;
+    };
+
+public:
+    enum CopyParsedBlockTag { CopyParsedBlock };
+
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    DECLARE_INFO;
+
+protected:
+    CodeBlock(VM*, Structure*, CopyParsedBlockTag, CodeBlock& other);
+    CodeBlock(VM*, Structure*, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*, PassRefPtr<SourceProvider>, unsigned sourceOffset, unsigned firstLineColumnOffset);
+
+    void finishCreation(VM&, CopyParsedBlockTag, CodeBlock& other);
+    void finishCreation(VM&, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*);
+
+    WriteBarrier<JSGlobalObject> m_globalObject;
+
+public:
+    JS_EXPORT_PRIVATE ~CodeBlock();
+
+    UnlinkedCodeBlock* unlinkedCodeBlock() const { return m_unlinkedCode.get(); }
+
+    CString inferredName() const;
+    CodeBlockHash hash() const;
+    bool hasHash() const;
+    bool isSafeToComputeHash() const;
+    CString hashAsStringIfPossible() const;
+    CString sourceCodeForTools() const; // Not quite the actual source we parsed; this will do things like prefix the source for a function with a reified signature.
+    CString sourceCodeOnOneLine() const; // As sourceCodeForTools(), but replaces all whitespace runs with a single space.
+    void dumpAssumingJITType(PrintStream&, JITCode::JITType) const;
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+
+    int numParameters() const { return m_numParameters; }
+    void setNumParameters(int newValue);
+
+    int numCalleeLocals() const { return m_numCalleeLocals; }
+
+    int* addressOfNumParameters() { return &m_numParameters; }
+    static ptrdiff_t offsetOfNumParameters() { return OBJECT_OFFSETOF(CodeBlock, m_numParameters); }
+
+    CodeBlock* alternative() const { return static_cast<CodeBlock*>(m_alternative.get()); }
+    void setAlternative(VM&, CodeBlock*);
+
+    template <typename Functor> void forEachRelatedCodeBlock(Functor&& functor)
+    {
+        Functor f(std::forward<Functor>(functor));
+        Vector<CodeBlock*, 4> codeBlocks;
+        codeBlocks.append(this);
+
+        while (!codeBlocks.isEmpty()) {
+            CodeBlock* currentCodeBlock = codeBlocks.takeLast();
+            f(currentCodeBlock);
+
+            if (CodeBlock* alternative = currentCodeBlock->alternative())
+                codeBlocks.append(alternative);
+            if (CodeBlock* osrEntryBlock = currentCodeBlock->specialOSREntryBlockOrNull())
+                codeBlocks.append(osrEntryBlock);
+        }
+    }
+    
+    CodeSpecializationKind specializationKind() const
+    {
+        return specializationFromIsConstruct(m_isConstructor);
+    }
+
+    CodeBlock* alternativeForJettison();    
+    JS_EXPORT_PRIVATE CodeBlock* baselineAlternative();
+    
+    // FIXME: Get rid of this.
+    // https://bugs.webkit.org/show_bug.cgi?id=123677
+    CodeBlock* baselineVersion();
+
+    static size_t estimatedSize(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    void visitChildren(SlotVisitor&);
+    void visitWeakly(SlotVisitor&);
+    void clearVisitWeaklyHasBeenCalled();
+
+    void dumpSource();
+    void dumpSource(PrintStream&);
+
+    void dumpBytecode();
+    void dumpBytecode(PrintStream&);
+    void dumpBytecode(
+        PrintStream&, unsigned bytecodeOffset,
+        const StubInfoMap& = StubInfoMap(), const CallLinkInfoMap& = CallLinkInfoMap());
+    void dumpExceptionHandlers(PrintStream&);
+    void printStructures(PrintStream&, const Instruction*);
+    void printStructure(PrintStream&, const char* name, const Instruction*, int operand);
+
+    void dumpMathICStats();
+
+    bool isStrictMode() const { return m_isStrictMode; }
+    ECMAMode ecmaMode() const { return isStrictMode() ? StrictMode : NotStrictMode; }
+
+    inline bool isKnownNotImmediate(int index)
+    {
+        if (index == m_thisRegister.offset() && !m_isStrictMode)
+            return true;
+
+        if (isConstantRegisterIndex(index))
+            return getConstant(index).isCell();
+
+        return false;
+    }
+
+    ALWAYS_INLINE bool isTemporaryRegisterIndex(int index)
+    {
+        return index >= m_numVars;
+    }
+
+    HandlerInfo* handlerForBytecodeOffset(unsigned bytecodeOffset, RequiredHandler = RequiredHandler::AnyHandler);
+    HandlerInfo* handlerForIndex(unsigned, RequiredHandler = RequiredHandler::AnyHandler);
+    void removeExceptionHandlerForCallSite(CallSiteIndex);
+    unsigned lineNumberForBytecodeOffset(unsigned bytecodeOffset);
+    unsigned columnNumberForBytecodeOffset(unsigned bytecodeOffset);
+    void expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot,
+        int& startOffset, int& endOffset, unsigned& line, unsigned& column) const;
+
+    std::optional<unsigned> bytecodeOffsetFromCallSiteIndex(CallSiteIndex);
+
+    void getStubInfoMap(const ConcurrentJSLocker&, StubInfoMap& result);
+    void getStubInfoMap(StubInfoMap& result);
+    
+    void getCallLinkInfoMap(const ConcurrentJSLocker&, CallLinkInfoMap& result);
+    void getCallLinkInfoMap(CallLinkInfoMap& result);
+
+    void getByValInfoMap(const ConcurrentJSLocker&, ByValInfoMap& result);
+    void getByValInfoMap(ByValInfoMap& result);
+    
+#if ENABLE(JIT)
+    StructureStubInfo* addStubInfo(AccessType);
+    JITAddIC* addJITAddIC(ArithProfile*);
+    JITMulIC* addJITMulIC(ArithProfile*);
+    JITNegIC* addJITNegIC(ArithProfile*);
+    JITSubIC* addJITSubIC(ArithProfile*);
+    Bag<StructureStubInfo>::iterator stubInfoBegin() { return m_stubInfos.begin(); }
+    Bag<StructureStubInfo>::iterator stubInfoEnd() { return m_stubInfos.end(); }
+    
+    // O(n) operation. Use getStubInfoMap() unless you really only intend to get one
+    // stub info.
+    StructureStubInfo* findStubInfo(CodeOrigin);
+
+    ByValInfo* addByValInfo();
+
+    CallLinkInfo* addCallLinkInfo();
+    Bag<CallLinkInfo>::iterator callLinkInfosBegin() { return m_callLinkInfos.begin(); }
+    Bag<CallLinkInfo>::iterator callLinkInfosEnd() { return m_callLinkInfos.end(); }
+
+    // This is a slow function call used primarily for compiling OSR exits in the case
+    // that there had been inlining. Chances are if you want to use this, you're really
+    // looking for a CallLinkInfoMap to amortize the cost of calling this.
+    CallLinkInfo* getCallLinkInfoForBytecodeIndex(unsigned bytecodeIndex);
+    
+    // We call this when we want to reattempt compiling something with the baseline JIT. Ideally
+    // the baseline JIT would not add data to CodeBlock, but instead it would put its data into
+    // a newly created JITCode, which could be thrown away if we bail on JIT compilation. Then we
+    // would be able to get rid of this silly function.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=159061
+    void resetJITData();
+#endif // ENABLE(JIT)
+
+    void unlinkIncomingCalls();
+
+#if ENABLE(JIT)
+    void linkIncomingCall(ExecState* callerFrame, CallLinkInfo*);
+    void linkIncomingPolymorphicCall(ExecState* callerFrame, PolymorphicCallNode*);
+#endif // ENABLE(JIT)
+
+    void linkIncomingCall(ExecState* callerFrame, LLIntCallLinkInfo*);
+
+    void setJITCodeMap(std::unique_ptr<CompactJITCodeMap> jitCodeMap)
+    {
+        m_jitCodeMap = WTFMove(jitCodeMap);
+    }
+    CompactJITCodeMap* jitCodeMap()
+    {
+        return m_jitCodeMap.get();
+    }
+    
+    static void clearLLIntGetByIdCache(Instruction*);
+
+    unsigned bytecodeOffset(Instruction* returnAddress)
+    {
+        RELEASE_ASSERT(returnAddress >= instructions().begin() && returnAddress < instructions().end());
+        return static_cast<Instruction*>(returnAddress) - instructions().begin();
+    }
+
+    typedef JSC::Instruction Instruction;
+    typedef RefCountedArray<Instruction>& UnpackedInstructions;
+
+    unsigned numberOfInstructions() const { return m_instructions.size(); }
+    RefCountedArray<Instruction>& instructions() { return m_instructions; }
+    const RefCountedArray<Instruction>& instructions() const { return m_instructions; }
+
+    size_t predictedMachineCodeSize();
+
+    bool usesOpcode(OpcodeID);
+
+    unsigned instructionCount() const { return m_instructions.size(); }
+
+    // Exactly equivalent to codeBlock->ownerExecutable()->newReplacementCodeBlockFor(codeBlock->specializationKind())
+    CodeBlock* newReplacement();
+    
+    void setJITCode(PassRefPtr<JITCode> code)
+    {
+        ASSERT(heap()->isDeferred());
+        heap()->reportExtraMemoryAllocated(code->size());
+        ConcurrentJSLocker locker(m_lock);
+        WTF::storeStoreFence(); // This is probably not needed because the lock will also do something similar, but it's good to be paranoid.
+        m_jitCode = code;
+    }
+    PassRefPtr<JITCode> jitCode() { return m_jitCode; }
+    static ptrdiff_t jitCodeOffset() { return OBJECT_OFFSETOF(CodeBlock, m_jitCode); }
+    JITCode::JITType jitType() const
+    {
+        JITCode* jitCode = m_jitCode.get();
+        WTF::loadLoadFence();
+        JITCode::JITType result = JITCode::jitTypeFor(jitCode);
+        WTF::loadLoadFence(); // This probably isn't needed. Oh well, paranoia is good.
+        return result;
+    }
+
+    bool hasBaselineJITProfiling() const
+    {
+        return jitType() == JITCode::BaselineJIT;
+    }
+    
+#if ENABLE(JIT)
+    CodeBlock* replacement();
+
+    DFG::CapabilityLevel computeCapabilityLevel();
+    DFG::CapabilityLevel capabilityLevel();
+    DFG::CapabilityLevel capabilityLevelState() { return static_cast<DFG::CapabilityLevel>(m_capabilityLevelState); }
+
+    bool hasOptimizedReplacement(JITCode::JITType typeToReplace);
+    bool hasOptimizedReplacement(); // the typeToReplace is my JITType
+#endif
+
+    void jettison(Profiler::JettisonReason, ReoptimizationMode = DontCountReoptimization, const FireDetail* = nullptr);
+    
+    ExecutableBase* ownerExecutable() const { return m_ownerExecutable.get(); }
+    ScriptExecutable* ownerScriptExecutable() const { return jsCast<ScriptExecutable*>(m_ownerExecutable.get()); }
+
+    VM* vm() const { return m_vm; }
+
+    void setThisRegister(VirtualRegister thisRegister) { m_thisRegister = thisRegister; }
+    VirtualRegister thisRegister() const { return m_thisRegister; }
+
+    bool usesEval() const { return m_unlinkedCode->usesEval(); }
+
+    void setScopeRegister(VirtualRegister scopeRegister)
+    {
+        ASSERT(scopeRegister.isLocal() || !scopeRegister.isValid());
+        m_scopeRegister = scopeRegister;
+    }
+
+    VirtualRegister scopeRegister() const
+    {
+        return m_scopeRegister;
+    }
+    
+    CodeType codeType() const
+    {
+        return static_cast<CodeType>(m_codeType);
+    }
+
+    PutPropertySlot::Context putByIdContext() const
+    {
+        if (codeType() == EvalCode)
+            return PutPropertySlot::PutByIdEval;
+        return PutPropertySlot::PutById;
+    }
+
+    SourceProvider* source() const { return m_source.get(); }
+    unsigned sourceOffset() const { return m_sourceOffset; }
+    unsigned firstLineColumnOffset() const { return m_firstLineColumnOffset; }
+
+    size_t numberOfJumpTargets() const { return m_unlinkedCode->numberOfJumpTargets(); }
+    unsigned jumpTarget(int index) const { return m_unlinkedCode->jumpTarget(index); }
+
+    String nameForRegister(VirtualRegister);
+
+    unsigned numberOfArgumentValueProfiles()
+    {
+        ASSERT(m_numParameters >= 0);
+        ASSERT(m_argumentValueProfiles.size() == static_cast<unsigned>(m_numParameters));
+        return m_argumentValueProfiles.size();
+    }
+    ValueProfile* valueProfileForArgument(unsigned argumentIndex)
+    {
+        ValueProfile* result = &m_argumentValueProfiles[argumentIndex];
+        ASSERT(result->m_bytecodeOffset == -1);
+        return result;
+    }
+
+    unsigned numberOfValueProfiles() { return m_valueProfiles.size(); }
+    ValueProfile* valueProfile(int index) { return &m_valueProfiles[index]; }
+    ValueProfile* valueProfileForBytecodeOffset(int bytecodeOffset);
+    SpeculatedType valueProfilePredictionForBytecodeOffset(const ConcurrentJSLocker& locker, int bytecodeOffset)
+    {
+        if (ValueProfile* valueProfile = valueProfileForBytecodeOffset(bytecodeOffset))
+            return valueProfile->computeUpdatedPrediction(locker);
+        return SpecNone;
+    }
+
+    unsigned totalNumberOfValueProfiles()
+    {
+        return numberOfArgumentValueProfiles() + numberOfValueProfiles();
+    }
+    ValueProfile* getFromAllValueProfiles(unsigned index)
+    {
+        if (index < numberOfArgumentValueProfiles())
+            return valueProfileForArgument(index);
+        return valueProfile(index - numberOfArgumentValueProfiles());
+    }
+
+    RareCaseProfile* addRareCaseProfile(int bytecodeOffset);
+    unsigned numberOfRareCaseProfiles() { return m_rareCaseProfiles.size(); }
+    RareCaseProfile* rareCaseProfileForBytecodeOffset(int bytecodeOffset);
+    unsigned rareCaseProfileCountForBytecodeOffset(int bytecodeOffset);
+
+    bool likelyToTakeSlowCase(int bytecodeOffset)
+    {
+        if (!hasBaselineJITProfiling())
+            return false;
+        unsigned value = rareCaseProfileCountForBytecodeOffset(bytecodeOffset);
+        return value >= Options::likelyToTakeSlowCaseMinimumCount();
+    }
+
+    bool couldTakeSlowCase(int bytecodeOffset)
+    {
+        if (!hasBaselineJITProfiling())
+            return false;
+        unsigned value = rareCaseProfileCountForBytecodeOffset(bytecodeOffset);
+        return value >= Options::couldTakeSlowCaseMinimumCount();
+    }
+
+    ArithProfile* arithProfileForBytecodeOffset(int bytecodeOffset);
+    ArithProfile* arithProfileForPC(Instruction*);
+
+    bool couldTakeSpecialFastCase(int bytecodeOffset);
+
+    unsigned numberOfArrayProfiles() const { return m_arrayProfiles.size(); }
+    const ArrayProfileVector& arrayProfiles() { return m_arrayProfiles; }
+    ArrayProfile* addArrayProfile(const ConcurrentJSLocker&, unsigned bytecodeOffset);
+    ArrayProfile* addArrayProfile(unsigned bytecodeOffset);
+    ArrayProfile* getArrayProfile(const ConcurrentJSLocker&, unsigned bytecodeOffset);
+    ArrayProfile* getArrayProfile(unsigned bytecodeOffset);
+    ArrayProfile* getOrAddArrayProfile(const ConcurrentJSLocker&, unsigned bytecodeOffset);
+    ArrayProfile* getOrAddArrayProfile(unsigned bytecodeOffset);
+
+    // Exception handling support
+
+    size_t numberOfExceptionHandlers() const { return m_rareData ? m_rareData->m_exceptionHandlers.size() : 0; }
+    HandlerInfo& exceptionHandler(int index) { RELEASE_ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
+
+    bool hasExpressionInfo() { return m_unlinkedCode->hasExpressionInfo(); }
+
+#if ENABLE(DFG_JIT)
+    Vector<CodeOrigin, 0, UnsafeVectorOverflow>& codeOrigins();
+    
+    // Having code origins implies that there has been some inlining.
+    bool hasCodeOrigins()
+    {
+        return JITCode::isOptimizingJIT(jitType());
+    }
+        
+    bool canGetCodeOrigin(CallSiteIndex index)
+    {
+        if (!hasCodeOrigins())
+            return false;
+        return index.bits() < codeOrigins().size();
+    }
+
+    CodeOrigin codeOrigin(CallSiteIndex index)
+    {
+        return codeOrigins()[index.bits()];
+    }
+
+    bool addFrequentExitSite(const DFG::FrequentExitSite& site)
+    {
+        ASSERT(JITCode::isBaselineCode(jitType()));
+        ConcurrentJSLocker locker(m_lock);
+        return m_exitProfile.add(locker, this, site);
+    }
+
+    bool hasExitSite(const ConcurrentJSLocker& locker, const DFG::FrequentExitSite& site) const
+    {
+        return m_exitProfile.hasExitSite(locker, site);
+    }
+    bool hasExitSite(const DFG::FrequentExitSite& site) const
+    {
+        ConcurrentJSLocker locker(m_lock);
+        return hasExitSite(locker, site);
+    }
+
+    DFG::ExitProfile& exitProfile() { return m_exitProfile; }
+
+    CompressedLazyOperandValueProfileHolder& lazyOperandValueProfiles()
+    {
+        return m_lazyOperandValueProfiles;
+    }
+#endif // ENABLE(DFG_JIT)
+
+    // Constant Pool
+#if ENABLE(DFG_JIT)
+    size_t numberOfIdentifiers() const { return m_unlinkedCode->numberOfIdentifiers() + numberOfDFGIdentifiers(); }
+    size_t numberOfDFGIdentifiers() const;
+    const Identifier& identifier(int index) const;
+#else
+    size_t numberOfIdentifiers() const { return m_unlinkedCode->numberOfIdentifiers(); }
+    const Identifier& identifier(int index) const { return m_unlinkedCode->identifier(index); }
+#endif
+
+    Vector<WriteBarrier<Unknown>>& constants() { return m_constantRegisters; }
+    Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation() { return m_constantsSourceCodeRepresentation; }
+    unsigned addConstant(JSValue v)
+    {
+        unsigned result = m_constantRegisters.size();
+        m_constantRegisters.append(WriteBarrier<Unknown>());
+        m_constantRegisters.last().set(m_globalObject->vm(), this, v);
+        m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
+        return result;
+    }
+
+    unsigned addConstantLazily()
+    {
+        unsigned result = m_constantRegisters.size();
+        m_constantRegisters.append(WriteBarrier<Unknown>());
+        m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
+        return result;
+    }
+
+    WriteBarrier<Unknown>& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
+    static ALWAYS_INLINE bool isConstantRegisterIndex(int index) { return index >= FirstConstantRegisterIndex; }
+    ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].get(); }
+    ALWAYS_INLINE SourceCodeRepresentation constantSourceCodeRepresentation(int index) const { return m_constantsSourceCodeRepresentation[index - FirstConstantRegisterIndex]; }
+
+    FunctionExecutable* functionDecl(int index) { return m_functionDecls[index].get(); }
+    int numberOfFunctionDecls() { return m_functionDecls.size(); }
+    FunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
+    
+    RegExp* regexp(int index) const { return m_unlinkedCode->regexp(index); }
+
+    unsigned numberOfConstantBuffers() const
+    {
+        if (!m_rareData)
+            return 0;
+        return m_rareData->m_constantBuffers.size();
+    }
+    unsigned addConstantBuffer(const Vector<JSValue>& buffer)
+    {
+        createRareDataIfNecessary();
+        unsigned size = m_rareData->m_constantBuffers.size();
+        m_rareData->m_constantBuffers.append(buffer);
+        return size;
+    }
+
+    Vector<JSValue>& constantBufferAsVector(unsigned index)
+    {
+        ASSERT(m_rareData);
+        return m_rareData->m_constantBuffers[index];
+    }
+    JSValue* constantBuffer(unsigned index)
+    {
+        return constantBufferAsVector(index).data();
+    }
+
+    Heap* heap() const { return &m_vm->heap; }
+    JSGlobalObject* globalObject() { return m_globalObject.get(); }
+
+    JSGlobalObject* globalObjectFor(CodeOrigin);
+
+    BytecodeLivenessAnalysis& livenessAnalysis()
+    {
+        {
+            ConcurrentJSLocker locker(m_lock);
+            if (!!m_livenessAnalysis)
+                return *m_livenessAnalysis;
+        }
+        return livenessAnalysisSlow();
+    }
+    
+    void validate();
+
+    // Jump Tables
+
+    size_t numberOfSwitchJumpTables() const { return m_rareData ? m_rareData->m_switchJumpTables.size() : 0; }
+    SimpleJumpTable& addSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_switchJumpTables.append(SimpleJumpTable()); return m_rareData->m_switchJumpTables.last(); }
+    SimpleJumpTable& switchJumpTable(int tableIndex) { RELEASE_ASSERT(m_rareData); return m_rareData->m_switchJumpTables[tableIndex]; }
+    void clearSwitchJumpTables()
+    {
+        if (!m_rareData)
+            return;
+        m_rareData->m_switchJumpTables.clear();
+    }
+
+    size_t numberOfStringSwitchJumpTables() const { return m_rareData ? m_rareData->m_stringSwitchJumpTables.size() : 0; }
+    StringJumpTable& addStringSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_stringSwitchJumpTables.append(StringJumpTable()); return m_rareData->m_stringSwitchJumpTables.last(); }
+    StringJumpTable& stringSwitchJumpTable(int tableIndex) { RELEASE_ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
+
+    DirectEvalCodeCache& directEvalCodeCache() { createRareDataIfNecessary(); return m_rareData->m_directEvalCodeCache; }
+
+    enum ShrinkMode {
+        // Shrink prior to generating machine code that may point directly into vectors.
+        EarlyShrink,
+
+        // Shrink after generating machine code, and after possibly creating new vectors
+        // and appending to others. At this time it is not safe to shrink certain vectors
+        // because we would have generated machine code that references them directly.
+        LateShrink
+    };
+    void shrinkToFit(ShrinkMode);
+
+    // Functions for controlling when JITting kicks in, in a mixed mode
+    // execution world.
+
+    bool checkIfJITThresholdReached()
+    {
+        return m_llintExecuteCounter.checkIfThresholdCrossedAndSet(this);
+    }
+
+    void dontJITAnytimeSoon()
+    {
+        m_llintExecuteCounter.deferIndefinitely();
+    }
+
+    int32_t thresholdForJIT(int32_t threshold);
+    void jitAfterWarmUp();
+    void jitSoon();
+
+    const BaselineExecutionCounter& llintExecuteCounter() const
+    {
+        return m_llintExecuteCounter;
+    }
+
+    typedef HashMap<Structure*, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>> StructureWatchpointMap;
+    StructureWatchpointMap& llintGetByIdWatchpointMap() { return m_llintGetByIdWatchpointMap; }
+
+    // Functions for controlling when tiered compilation kicks in. This
+    // controls both when the optimizing compiler is invoked and when OSR
+    // entry happens. Two triggers exist: the loop trigger and the return
+    // trigger. In either case, when an addition to m_jitExecuteCounter
+    // causes it to become non-negative, the optimizing compiler is
+    // invoked. This includes a fast check to see if this CodeBlock has
+    // already been optimized (i.e. replacement() returns a CodeBlock
+    // that was optimized with a higher tier JIT than this one). In the
+    // case of the loop trigger, if the optimized compilation succeeds
+    // (or has already succeeded in the past) then OSR is attempted to
+    // redirect program flow into the optimized code.
+
+    // These functions are called from within the optimization triggers,
+    // and are used as a single point at which we define the heuristics
+    // for how much warm-up is mandated before the next optimization
+    // trigger files. All CodeBlocks start out with optimizeAfterWarmUp(),
+    // as this is called from the CodeBlock constructor.
+
+    // When we observe a lot of speculation failures, we trigger a
+    // reoptimization. But each time, we increase the optimization trigger
+    // to avoid thrashing.
+    JS_EXPORT_PRIVATE unsigned reoptimizationRetryCounter() const;
+    void countReoptimization();
+#if ENABLE(JIT)
+    static unsigned numberOfLLIntBaselineCalleeSaveRegisters() { return RegisterSet::llintBaselineCalleeSaveRegisters().numberOfSetRegisters(); }
+    static size_t llintBaselineCalleeSaveSpaceAsVirtualRegisters();
+    size_t calleeSaveSpaceAsVirtualRegisters();
+
+    unsigned numberOfDFGCompiles();
+
+    int32_t codeTypeThresholdMultiplier() const;
+
+    int32_t adjustedCounterValue(int32_t desiredThreshold);
+
+    int32_t* addressOfJITExecuteCounter()
+    {
+        return &m_jitExecuteCounter.m_counter;
+    }
+
+    static ptrdiff_t offsetOfJITExecuteCounter() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(BaselineExecutionCounter, m_counter); }
+    static ptrdiff_t offsetOfJITExecutionActiveThreshold() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(BaselineExecutionCounter, m_activeThreshold); }
+    static ptrdiff_t offsetOfJITExecutionTotalCount() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(BaselineExecutionCounter, m_totalCount); }
+
+    const BaselineExecutionCounter& jitExecuteCounter() const { return m_jitExecuteCounter; }
+
+    unsigned optimizationDelayCounter() const { return m_optimizationDelayCounter; }
+
+    // Check if the optimization threshold has been reached, and if not,
+    // adjust the heuristics accordingly. Returns true if the threshold has
+    // been reached.
+    bool checkIfOptimizationThresholdReached();
+
+    // Call this to force the next optimization trigger to fire. This is
+    // rarely wise, since optimization triggers are typically more
+    // expensive than executing baseline code.
+    void optimizeNextInvocation();
+
+    // Call this to prevent optimization from happening again. Note that
+    // optimization will still happen after roughly 2^29 invocations,
+    // so this is really meant to delay that as much as possible. This
+    // is called if optimization failed, and we expect it to fail in
+    // the future as well.
+    void dontOptimizeAnytimeSoon();
+
+    // Call this to reinitialize the counter to its starting state,
+    // forcing a warm-up to happen before the next optimization trigger
+    // fires. This is called in the CodeBlock constructor. It also
+    // makes sense to call this if an OSR exit occurred. Note that
+    // OSR exit code is code generated, so the value of the execute
+    // counter that this corresponds to is also available directly.
+    void optimizeAfterWarmUp();
+
+    // Call this to force an optimization trigger to fire only after
+    // a lot of warm-up.
+    void optimizeAfterLongWarmUp();
+
+    // Call this to cause an optimization trigger to fire soon, but
+    // not necessarily the next one. This makes sense if optimization
+    // succeeds. Successfuly optimization means that all calls are
+    // relinked to the optimized code, so this only affects call
+    // frames that are still executing this CodeBlock. The value here
+    // is tuned to strike a balance between the cost of OSR entry
+    // (which is too high to warrant making every loop back edge to
+    // trigger OSR immediately) and the cost of executing baseline
+    // code (which is high enough that we don't necessarily want to
+    // have a full warm-up). The intuition for calling this instead of
+    // optimizeNextInvocation() is for the case of recursive functions
+    // with loops. Consider that there may be N call frames of some
+    // recursive function, for a reasonably large value of N. The top
+    // one triggers optimization, and then returns, and then all of
+    // the others return. We don't want optimization to be triggered on
+    // each return, as that would be superfluous. It only makes sense
+    // to trigger optimization if one of those functions becomes hot
+    // in the baseline code.
+    void optimizeSoon();
+
+    void forceOptimizationSlowPathConcurrently();
+
+    void setOptimizationThresholdBasedOnCompilationResult(CompilationResult);
+    
+    uint32_t osrExitCounter() const { return m_osrExitCounter; }
+
+    void countOSRExit() { m_osrExitCounter++; }
+
+    uint32_t* addressOfOSRExitCounter() { return &m_osrExitCounter; }
+
+    static ptrdiff_t offsetOfOSRExitCounter() { return OBJECT_OFFSETOF(CodeBlock, m_osrExitCounter); }
+
+    uint32_t adjustedExitCountThreshold(uint32_t desiredThreshold);
+    uint32_t exitCountThresholdForReoptimization();
+    uint32_t exitCountThresholdForReoptimizationFromLoop();
+    bool shouldReoptimizeNow();
+    bool shouldReoptimizeFromLoopNow();
+
+    void setCalleeSaveRegisters(RegisterSet);
+    void setCalleeSaveRegisters(std::unique_ptr<RegisterAtOffsetList>);
+    
+    RegisterAtOffsetList* calleeSaveRegisters() const { return m_calleeSaveRegisters.get(); }
+#else // No JIT
+    static unsigned numberOfLLIntBaselineCalleeSaveRegisters() { return 0; }
+    static size_t llintBaselineCalleeSaveSpaceAsVirtualRegisters() { return 0; };
+    void optimizeAfterWarmUp() { }
+    unsigned numberOfDFGCompiles() { return 0; }
+#endif
+
+    bool shouldOptimizeNow();
+    void updateAllValueProfilePredictions();
+    void updateAllArrayPredictions();
+    void updateAllPredictions();
+
+    unsigned frameRegisterCount();
+    int stackPointerOffset();
+
+    bool hasOpDebugForLineAndColumn(unsigned line, unsigned column);
+
+    bool hasDebuggerRequests() const { return m_debuggerRequests; }
+    void* debuggerRequestsAddress() { return &m_debuggerRequests; }
+
+    void addBreakpoint(unsigned numBreakpoints);
+    void removeBreakpoint(unsigned numBreakpoints)
+    {
+        ASSERT(m_numBreakpoints >= numBreakpoints);
+        m_numBreakpoints -= numBreakpoints;
+    }
+
+    enum SteppingMode {
+        SteppingModeDisabled,
+        SteppingModeEnabled
+    };
+    void setSteppingMode(SteppingMode);
+
+    void clearDebuggerRequests()
+    {
+        m_steppingMode = SteppingModeDisabled;
+        m_numBreakpoints = 0;
+    }
+
+    bool wasCompiledWithDebuggingOpcodes() const { return m_unlinkedCode->wasCompiledWithDebuggingOpcodes(); }
+    
+    // FIXME: Make these remaining members private.
+
+    int m_numCalleeLocals;
+    int m_numVars;
+    
+    // This is intentionally public; it's the responsibility of anyone doing any
+    // of the following to hold the lock:
+    //
+    // - Modifying any inline cache in this code block.
+    //
+    // - Quering any inline cache in this code block, from a thread other than
+    //   the main thread.
+    //
+    // Additionally, it's only legal to modify the inline cache on the main
+    // thread. This means that the main thread can query the inline cache without
+    // locking. This is crucial since executing the inline cache is effectively
+    // "querying" it.
+    //
+    // Another exception to the rules is that the GC can do whatever it wants
+    // without holding any locks, because the GC is guaranteed to wait until any
+    // concurrent compilation threads finish what they're doing.
+    mutable ConcurrentJSLock m_lock;
+
+    bool m_visitWeaklyHasBeenCalled;
+
+    bool m_shouldAlwaysBeInlined; // Not a bitfield because the JIT wants to store to it.
+
+#if ENABLE(JIT)
+    unsigned m_capabilityLevelState : 2; // DFG::CapabilityLevel
+#endif
+
+    bool m_allTransitionsHaveBeenMarked : 1; // Initialized and used on every GC.
+
+    bool m_didFailJITCompilation : 1;
+    bool m_didFailFTLCompilation : 1;
+    bool m_hasBeenCompiledWithFTL : 1;
+    bool m_isConstructor : 1;
+    bool m_isStrictMode : 1;
+    unsigned m_codeType : 2; // CodeType
+
+    // Internal methods for use by validation code. It would be private if it wasn't
+    // for the fact that we use it from anonymous namespaces.
+    void beginValidationDidFail();
+    NO_RETURN_DUE_TO_CRASH void endValidationDidFail();
+
+    struct RareData {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        Vector<HandlerInfo> m_exceptionHandlers;
+
+        // Buffers used for large array literals
+        Vector<Vector<JSValue>> m_constantBuffers;
+
+        // Jump Tables
+        Vector<SimpleJumpTable> m_switchJumpTables;
+        Vector<StringJumpTable> m_stringSwitchJumpTables;
+
+        DirectEvalCodeCache m_directEvalCodeCache;
+    };
+
+    void clearExceptionHandlers()
+    {
+        if (m_rareData)
+            m_rareData->m_exceptionHandlers.clear();
+    }
+
+    void appendExceptionHandler(const HandlerInfo& handler)
+    {
+        createRareDataIfNecessary(); // We may be handling the exception of an inlined call frame.
+        m_rareData->m_exceptionHandlers.append(handler);
+    }
+
+    CallSiteIndex newExceptionHandlingCallSiteIndex(CallSiteIndex originalCallSite);
+
+#if ENABLE(JIT)
+    void setPCToCodeOriginMap(std::unique_ptr<PCToCodeOriginMap>&&);
+    std::optional<CodeOrigin> findPC(void* pc);
+#endif
+
+protected:
+    void finalizeLLIntInlineCaches();
+    void finalizeBaselineJITInlineCaches();
+
+#if ENABLE(DFG_JIT)
+    void tallyFrequentExitSites();
+#else
+    void tallyFrequentExitSites() { }
+#endif
+
+private:
+    friend class CodeBlockSet;
+
+    BytecodeLivenessAnalysis& livenessAnalysisSlow();
+    
+    CodeBlock* specialOSREntryBlockOrNull();
+    
+    void noticeIncomingCall(ExecState* callerFrame);
+    
+    double optimizationThresholdScalingFactor();
+
+    void updateAllPredictionsAndCountLiveness(unsigned& numberOfLiveNonArgumentValueProfiles, unsigned& numberOfSamplesInProfiles);
+
+    void setConstantRegisters(const Vector<WriteBarrier<Unknown>>& constants, const Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation);
+
+    void replaceConstant(int index, JSValue value)
+    {
+        ASSERT(isConstantRegisterIndex(index) && static_cast<size_t>(index - FirstConstantRegisterIndex) < m_constantRegisters.size());
+        m_constantRegisters[index - FirstConstantRegisterIndex].set(m_globalObject->vm(), this, value);
+    }
+
+    void dumpBytecode(
+        PrintStream&, ExecState*, const Instruction* begin, const Instruction*&,
+        const StubInfoMap& = StubInfoMap(), const CallLinkInfoMap& = CallLinkInfoMap());
+
+    CString registerName(int r) const;
+    CString constantName(int index) const;
+    void printUnaryOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op);
+    void printBinaryOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op);
+    void printConditionalJump(PrintStream&, ExecState*, const Instruction*, const Instruction*&, int location, const char* op);
+    void printGetByIdOp(PrintStream&, ExecState*, int location, const Instruction*&);
+    void printGetByIdCacheStatus(PrintStream&, ExecState*, int location, const StubInfoMap&);
+    enum CacheDumpMode { DumpCaches, DontDumpCaches };
+    void printCallOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op, CacheDumpMode, bool& hasPrintedProfiling, const CallLinkInfoMap&);
+    void printPutByIdOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op);
+    void printPutByIdCacheStatus(PrintStream&, int location, const StubInfoMap&);
+    void printLocationAndOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op);
+    void printLocationOpAndRegisterOperand(PrintStream&, ExecState*, int location, const Instruction*& it, const char* op, int operand);
+
+    void beginDumpProfiling(PrintStream&, bool& hasPrintedProfiling);
+    void dumpValueProfiling(PrintStream&, const Instruction*&, bool& hasPrintedProfiling);
+    void dumpArrayProfiling(PrintStream&, const Instruction*&, bool& hasPrintedProfiling);
+    void dumpRareCaseProfile(PrintStream&, const char* name, RareCaseProfile*, bool& hasPrintedProfiling);
+    void dumpArithProfile(PrintStream&, ArithProfile*, bool& hasPrintedProfiling);
+
+    bool shouldVisitStrongly(const ConcurrentJSLocker&);
+    bool shouldJettisonDueToWeakReference();
+    bool shouldJettisonDueToOldAge(const ConcurrentJSLocker&);
+    
+    void propagateTransitions(const ConcurrentJSLocker&, SlotVisitor&);
+    void determineLiveness(const ConcurrentJSLocker&, SlotVisitor&);
+        
+    void stronglyVisitStrongReferences(const ConcurrentJSLocker&, SlotVisitor&);
+    void stronglyVisitWeakReferences(const ConcurrentJSLocker&, SlotVisitor&);
+    void visitOSRExitTargets(const ConcurrentJSLocker&, SlotVisitor&);
+
+    std::chrono::milliseconds timeSinceCreation()
+    {
+        return std::chrono::duration_cast<std::chrono::milliseconds>(
+            std::chrono::steady_clock::now() - m_creationTime);
+    }
+
+    void createRareDataIfNecessary()
+    {
+        if (!m_rareData)
+            m_rareData = std::make_unique<RareData>();
+    }
+
+    void insertBasicBlockBoundariesForControlFlowProfiler(RefCountedArray<Instruction>&);
+
+    WriteBarrier<UnlinkedCodeBlock> m_unlinkedCode;
+    int m_numParameters;
+    union {
+        unsigned m_debuggerRequests;
+        struct {
+            unsigned m_hasDebuggerStatement : 1;
+            unsigned m_steppingMode : 1;
+            unsigned m_numBreakpoints : 30;
+        };
+    };
+    WriteBarrier<ExecutableBase> m_ownerExecutable;
+    VM* m_vm;
+
+    RefCountedArray<Instruction> m_instructions;
+    VirtualRegister m_thisRegister;
+    VirtualRegister m_scopeRegister;
+    mutable CodeBlockHash m_hash;
+
+    RefPtr<SourceProvider> m_source;
+    unsigned m_sourceOffset;
+    unsigned m_firstLineColumnOffset;
+
+    RefCountedArray<LLIntCallLinkInfo> m_llintCallLinkInfos;
+    SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo>> m_incomingLLIntCalls;
+    StructureWatchpointMap m_llintGetByIdWatchpointMap;
+    RefPtr<JITCode> m_jitCode;
+#if ENABLE(JIT)
+    std::unique_ptr<RegisterAtOffsetList> m_calleeSaveRegisters;
+    Bag<StructureStubInfo> m_stubInfos;
+    Bag<JITAddIC> m_addICs;
+    Bag<JITMulIC> m_mulICs;
+    Bag<JITNegIC> m_negICs;
+    Bag<JITSubIC> m_subICs;
+    Bag<ByValInfo> m_byValInfos;
+    Bag<CallLinkInfo> m_callLinkInfos;
+    SentinelLinkedList<CallLinkInfo, BasicRawSentinelNode<CallLinkInfo>> m_incomingCalls;
+    SentinelLinkedList<PolymorphicCallNode, BasicRawSentinelNode<PolymorphicCallNode>> m_incomingPolymorphicCalls;
+    std::unique_ptr<PCToCodeOriginMap> m_pcToCodeOriginMap;
+#endif
+    std::unique_ptr<CompactJITCodeMap> m_jitCodeMap;
+#if ENABLE(DFG_JIT)
+    // This is relevant to non-DFG code blocks that serve as the profiled code block
+    // for DFG code blocks.
+    DFG::ExitProfile m_exitProfile;
+    CompressedLazyOperandValueProfileHolder m_lazyOperandValueProfiles;
+#endif
+    RefCountedArray<ValueProfile> m_argumentValueProfiles;
+    RefCountedArray<ValueProfile> m_valueProfiles;
+    SegmentedVector<RareCaseProfile, 8> m_rareCaseProfiles;
+    RefCountedArray<ArrayAllocationProfile> m_arrayAllocationProfiles;
+    ArrayProfileVector m_arrayProfiles;
+    RefCountedArray<ObjectAllocationProfile> m_objectAllocationProfiles;
+
+    // Constant Pool
+    COMPILE_ASSERT(sizeof(Register) == sizeof(WriteBarrier<Unknown>), Register_must_be_same_size_as_WriteBarrier_Unknown);
+    // TODO: This could just be a pointer to m_unlinkedCodeBlock's data, but the DFG mutates
+    // it, so we're stuck with it for now.
+    Vector<WriteBarrier<Unknown>> m_constantRegisters;
+    Vector<SourceCodeRepresentation> m_constantsSourceCodeRepresentation;
+    RefCountedArray<WriteBarrier<FunctionExecutable>> m_functionDecls;
+    RefCountedArray<WriteBarrier<FunctionExecutable>> m_functionExprs;
+
+    WriteBarrier<CodeBlock> m_alternative;
+    
+    BaselineExecutionCounter m_llintExecuteCounter;
+
+    BaselineExecutionCounter m_jitExecuteCounter;
+    uint32_t m_osrExitCounter;
+    uint16_t m_optimizationDelayCounter;
+    uint16_t m_reoptimizationRetryCounter;
+
+    std::chrono::steady_clock::time_point m_creationTime;
+
+    std::unique_ptr<BytecodeLivenessAnalysis> m_livenessAnalysis;
+
+    std::unique_ptr<RareData> m_rareData;
+
+    UnconditionalFinalizer m_unconditionalFinalizer;
+    WeakReferenceHarvester m_weakReferenceHarvester;
+};
+
+inline Register& ExecState::r(int index)
+{
+    CodeBlock* codeBlock = this->codeBlock();
+    if (codeBlock->isConstantRegisterIndex(index))
+        return *reinterpret_cast<Register*>(&codeBlock->constantRegister(index));
+    return this[index];
+}
+
+inline Register& ExecState::r(VirtualRegister reg)
+{
+    return r(reg.offset());
+}
+
+inline Register& ExecState::uncheckedR(int index)
+{
+    RELEASE_ASSERT(index < FirstConstantRegisterIndex);
+    return this[index];
+}
+
+inline Register& ExecState::uncheckedR(VirtualRegister reg)
+{
+    return uncheckedR(reg.offset());
+}
+
+inline void CodeBlock::clearVisitWeaklyHasBeenCalled()
+{
+    m_visitWeaklyHasBeenCalled = false;
+}
+
+template <typename ExecutableType>
+JSObject* ScriptExecutable::prepareForExecution(VM& vm, JSFunction* function, JSScope* scope, CodeSpecializationKind kind, CodeBlock*& resultCodeBlock)
+{
+    if (hasJITCodeFor(kind)) {
+        if (std::is_same<ExecutableType, EvalExecutable>::value)
+            resultCodeBlock = jsCast<CodeBlock*>(jsCast<EvalExecutable*>(this)->codeBlock());
+        else if (std::is_same<ExecutableType, ProgramExecutable>::value)
+            resultCodeBlock = jsCast<CodeBlock*>(jsCast<ProgramExecutable*>(this)->codeBlock());
+        else if (std::is_same<ExecutableType, ModuleProgramExecutable>::value)
+            resultCodeBlock = jsCast<CodeBlock*>(jsCast<ModuleProgramExecutable*>(this)->codeBlock());
+        else if (std::is_same<ExecutableType, FunctionExecutable>::value)
+            resultCodeBlock = jsCast<CodeBlock*>(jsCast<FunctionExecutable*>(this)->codeBlockFor(kind));
+        else
+            RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    return prepareForExecutionImpl(vm, function, scope, kind, resultCodeBlock);
+}
+
+#define CODEBLOCK_LOG_EVENT(codeBlock, summary, details) \
+    (codeBlock->vm()->logEvent(codeBlock, summary, [&] () { return toCString details; }))
+
+} // namespace JSC
diff --git a/bytecode/CodeBlockHash.cpp b/bytecode/CodeBlockHash.cpp
new file mode 100644
index 0000000..87c092f
--- /dev/null
+++ b/bytecode/CodeBlockHash.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CodeBlockHash.h"
+
+#include "SourceCode.h"
+#include <wtf/SHA1.h>
+#include <wtf/SixCharacterHash.h>
+
+namespace JSC {
+
+CodeBlockHash::CodeBlockHash(const char* string)
+    : m_hash(sixCharacterHashStringToInteger(string))
+{
+}
+
+CodeBlockHash::CodeBlockHash(const SourceCode& sourceCode, CodeSpecializationKind kind)
+    : m_hash(0)
+{
+    SHA1 sha1;
+    sha1.addBytes(sourceCode.toUTF8());
+    SHA1::Digest digest;
+    sha1.computeHash(digest);
+    m_hash += digest[0] | (digest[1] << 8) | (digest[2] << 16) | (digest[3] << 24);
+    m_hash ^= static_cast<unsigned>(kind);
+    
+    // Ensure that 0 corresponds to the hash not having been computed.
+    if (!m_hash)
+        m_hash = 1;
+}
+
+void CodeBlockHash::dump(PrintStream& out) const
+{
+    std::array<char, 7> buffer = integerToSixCharacterHashString(m_hash);
+    
+#if !ASSERT_DISABLED
+    CodeBlockHash recompute(buffer.data());
+    ASSERT(recompute == *this);
+#endif // !ASSERT_DISABLED
+    
+    out.print(buffer.data());
+}
+
+} // namespace JSC
+
diff --git a/bytecode/CodeBlockHash.h b/bytecode/CodeBlockHash.h
new file mode 100644
index 0000000..b828fe8
--- /dev/null
+++ b/bytecode/CodeBlockHash.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeSpecializationKind.h"
+#include <wtf/PrintStream.h>
+
+// CodeBlock hashes are useful for informally identifying code blocks. They correspond
+// to the low 32 bits of a SHA1 hash of the source code with two low bit flipped
+// according to the role that the code block serves (call, construct). Additionally, the
+// hashes are typically operated over using a string in which the hash is transformed
+// into a 6-byte alphanumeric representation. This can be retrieved by using
+// toString(const CodeBlockHash&). Finally, we support CodeBlockHashes for native
+// functions, in which case the hash is replaced by the function address.
+
+namespace JSC {
+
+class SourceCode;
+
+class CodeBlockHash {
+public:
+    CodeBlockHash()
+        : m_hash(0)
+    {
+    }
+    
+    explicit CodeBlockHash(unsigned hash)
+        : m_hash(hash)
+    {
+    }
+    
+    CodeBlockHash(const SourceCode&, CodeSpecializationKind);
+    
+    explicit CodeBlockHash(const char*);
+
+    bool isSet() const { return !!m_hash; }
+    bool operator!() const { return !isSet(); }
+    
+    unsigned hash() const { return m_hash; }
+    
+    void dump(PrintStream&) const;
+    
+    // Comparison methods useful for bisection.
+    bool operator==(const CodeBlockHash& other) const { return hash() == other.hash(); }
+    bool operator!=(const CodeBlockHash& other) const { return hash() != other.hash(); }
+    bool operator<(const CodeBlockHash& other) const { return hash() < other.hash(); }
+    bool operator>(const CodeBlockHash& other) const { return hash() > other.hash(); }
+    bool operator<=(const CodeBlockHash& other) const { return hash() <= other.hash(); }
+    bool operator>=(const CodeBlockHash& other) const { return hash() >= other.hash(); }
+    
+private:
+    unsigned m_hash;
+};
+
+} // namespace JSC
diff --git a/bytecode/CodeBlockJettisoningWatchpoint.cpp b/bytecode/CodeBlockJettisoningWatchpoint.cpp
new file mode 100644
index 0000000..50cf737
--- /dev/null
+++ b/bytecode/CodeBlockJettisoningWatchpoint.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CodeBlockJettisoningWatchpoint.h"
+
+#include "CodeBlock.h"
+#include "DFGCommon.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+void CodeBlockJettisoningWatchpoint::fireInternal(const FireDetail& detail)
+{
+    if (DFG::shouldDumpDisassembly())
+        dataLog("Firing watchpoint ", RawPointer(this), " on ", *m_codeBlock, "\n");
+
+    m_codeBlock->jettison(Profiler::JettisonDueToUnprofiledWatchpoint, CountReoptimization, &detail);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/CodeBlockJettisoningWatchpoint.h b/bytecode/CodeBlockJettisoningWatchpoint.h
new file mode 100644
index 0000000..635cd78
--- /dev/null
+++ b/bytecode/CodeBlockJettisoningWatchpoint.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Watchpoint.h"
+
+namespace JSC {
+
+class CodeBlock;
+
+class CodeBlockJettisoningWatchpoint : public Watchpoint {
+public:
+    CodeBlockJettisoningWatchpoint(CodeBlock* codeBlock)
+        : m_codeBlock(codeBlock)
+    {
+    }
+    
+protected:
+    void fireInternal(const FireDetail&) override;
+
+private:
+    CodeBlock* m_codeBlock;
+};
+
+} // namespace JSC
diff --git a/bytecode/CodeBlockWithJITType.h b/bytecode/CodeBlockWithJITType.h
new file mode 100644
index 0000000..37f83c4
--- /dev/null
+++ b/bytecode/CodeBlockWithJITType.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+
+namespace JSC {
+
+// We sometimes what to print the CodeBlock's ID before setting its JITCode. At that
+// point the CodeBlock will claim a bogus JITType. This helper class lets us do that.
+
+class CodeBlockWithJITType {
+public:
+    CodeBlockWithJITType(CodeBlock* codeBlock, JITCode::JITType jitType)
+        : m_codeBlock(codeBlock)
+        , m_jitType(jitType)
+    {
+    }
+    
+    void dump(PrintStream& out) const
+    {
+        m_codeBlock->dumpAssumingJITType(out, m_jitType);
+    }
+private:
+    CodeBlock* m_codeBlock;
+    JITCode::JITType m_jitType;
+};
+
+} // namespace JSC
diff --git a/bytecode/CodeOrigin.cpp b/bytecode/CodeOrigin.cpp
new file mode 100644
index 0000000..a52df92
--- /dev/null
+++ b/bytecode/CodeOrigin.cpp
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CodeOrigin.h"
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "InlineCallFrame.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+unsigned CodeOrigin::inlineDepthForCallFrame(InlineCallFrame* inlineCallFrame)
+{
+    unsigned result = 1;
+    for (InlineCallFrame* current = inlineCallFrame; current; current = current->directCaller.inlineCallFrame)
+        result++;
+    return result;
+}
+
+unsigned CodeOrigin::inlineDepth() const
+{
+    return inlineDepthForCallFrame(inlineCallFrame);
+}
+
+bool CodeOrigin::isApproximatelyEqualTo(const CodeOrigin& other) const
+{
+    CodeOrigin a = *this;
+    CodeOrigin b = other;
+
+    if (!a.isSet())
+        return !b.isSet();
+    if (!b.isSet())
+        return false;
+    
+    if (a.isHashTableDeletedValue())
+        return b.isHashTableDeletedValue();
+    if (b.isHashTableDeletedValue())
+        return false;
+    
+    for (;;) {
+        ASSERT(a.isSet());
+        ASSERT(b.isSet());
+        
+        if (a.bytecodeIndex != b.bytecodeIndex)
+            return false;
+        
+        if ((!!a.inlineCallFrame) != (!!b.inlineCallFrame))
+            return false;
+        
+        if (!a.inlineCallFrame)
+            return true;
+        
+        if (a.inlineCallFrame->baselineCodeBlock.get() != b.inlineCallFrame->baselineCodeBlock.get())
+            return false;
+        
+        a = a.inlineCallFrame->directCaller;
+        b = b.inlineCallFrame->directCaller;
+    }
+}
+
+unsigned CodeOrigin::approximateHash() const
+{
+    if (!isSet())
+        return 0;
+    if (isHashTableDeletedValue())
+        return 1;
+    
+    unsigned result = 2;
+    CodeOrigin codeOrigin = *this;
+    for (;;) {
+        result += codeOrigin.bytecodeIndex;
+        
+        if (!codeOrigin.inlineCallFrame)
+            return result;
+        
+        result += WTF::PtrHash<JSCell*>::hash(codeOrigin.inlineCallFrame->baselineCodeBlock.get());
+        
+        codeOrigin = codeOrigin.inlineCallFrame->directCaller;
+    }
+}
+
+Vector<CodeOrigin> CodeOrigin::inlineStack() const
+{
+    Vector<CodeOrigin> result(inlineDepth());
+    result.last() = *this;
+    unsigned index = result.size() - 2;
+    for (InlineCallFrame* current = inlineCallFrame; current; current = current->directCaller.inlineCallFrame)
+        result[index--] = current->directCaller;
+    RELEASE_ASSERT(!result[0].inlineCallFrame);
+    return result;
+}
+
+CodeBlock* CodeOrigin::codeOriginOwner() const
+{
+    if (!inlineCallFrame)
+        return 0;
+    return inlineCallFrame->baselineCodeBlock.get();
+}
+
+int CodeOrigin::stackOffset() const
+{
+    if (!inlineCallFrame)
+        return 0;
+    
+    return inlineCallFrame->stackOffset;
+}
+
+void CodeOrigin::dump(PrintStream& out) const
+{
+    if (!isSet()) {
+        out.print("<none>");
+        return;
+    }
+    
+    Vector<CodeOrigin> stack = inlineStack();
+    for (unsigned i = 0; i < stack.size(); ++i) {
+        if (i)
+            out.print(" --> ");
+        
+        if (InlineCallFrame* frame = stack[i].inlineCallFrame) {
+            out.print(frame->briefFunctionInformation(), ":<", RawPointer(frame->baselineCodeBlock.get()), "> ");
+            if (frame->isClosureCall)
+                out.print("(closure) ");
+        }
+        
+        out.print("bc#", stack[i].bytecodeIndex);
+    }
+}
+
+void CodeOrigin::dumpInContext(PrintStream& out, DumpContext*) const
+{
+    dump(out);
+}
+
+} // namespace JSC
diff --git a/bytecode/CodeOrigin.h b/bytecode/CodeOrigin.h
new file mode 100644
index 0000000..38712f9
--- /dev/null
+++ b/bytecode/CodeOrigin.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2011-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallMode.h"
+#include "CodeBlockHash.h"
+#include "CodeSpecializationKind.h"
+#include "WriteBarrier.h"
+#include <wtf/HashMap.h>
+#include <wtf/PrintStream.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CodeBlock;
+struct DumpContext;
+struct InlineCallFrame;
+
+struct CodeOrigin {
+    static const unsigned invalidBytecodeIndex = UINT_MAX;
+    
+    // Bytecode offset that you'd use to re-execute this instruction, and the
+    // bytecode index of the bytecode instruction that produces some result that
+    // you're interested in (used for mapping Nodes whose values you're using
+    // to bytecode instructions that have the appropriate value profile).
+    unsigned bytecodeIndex;
+    
+    InlineCallFrame* inlineCallFrame;
+    
+    CodeOrigin()
+        : bytecodeIndex(invalidBytecodeIndex)
+        , inlineCallFrame(0)
+    {
+    }
+    
+    CodeOrigin(WTF::HashTableDeletedValueType)
+        : bytecodeIndex(invalidBytecodeIndex)
+        , inlineCallFrame(deletedMarker())
+    {
+    }
+    
+    explicit CodeOrigin(unsigned bytecodeIndex, InlineCallFrame* inlineCallFrame = 0)
+        : bytecodeIndex(bytecodeIndex)
+        , inlineCallFrame(inlineCallFrame)
+    {
+        ASSERT(bytecodeIndex < invalidBytecodeIndex);
+    }
+    
+    bool isSet() const { return bytecodeIndex != invalidBytecodeIndex; }
+    explicit operator bool() const { return isSet(); }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return bytecodeIndex == invalidBytecodeIndex && !!inlineCallFrame;
+    }
+    
+    // The inline depth is the depth of the inline stack, so 1 = not inlined,
+    // 2 = inlined one deep, etc.
+    unsigned inlineDepth() const;
+    
+    // If the code origin corresponds to inlined code, gives you the heap object that
+    // would have owned the code if it had not been inlined. Otherwise returns 0.
+    CodeBlock* codeOriginOwner() const;
+    
+    int stackOffset() const;
+    
+    static unsigned inlineDepthForCallFrame(InlineCallFrame*);
+    
+    unsigned hash() const;
+    bool operator==(const CodeOrigin& other) const;
+    bool operator!=(const CodeOrigin& other) const { return !(*this == other); }
+    
+    // This checks if the two code origins correspond to the same stack trace snippets,
+    // but ignore whether the InlineCallFrame's are identical.
+    bool isApproximatelyEqualTo(const CodeOrigin& other) const;
+    
+    unsigned approximateHash() const;
+
+    template <typename Function>
+    void walkUpInlineStack(const Function&);
+    
+    // Get the inline stack. This is slow, and is intended for debugging only.
+    Vector<CodeOrigin> inlineStack() const;
+    
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+
+private:
+    static InlineCallFrame* deletedMarker()
+    {
+        return bitwise_cast<InlineCallFrame*>(static_cast<uintptr_t>(1));
+    }
+};
+
+inline unsigned CodeOrigin::hash() const
+{
+    return WTF::IntHash<unsigned>::hash(bytecodeIndex) +
+        WTF::PtrHash<InlineCallFrame*>::hash(inlineCallFrame);
+}
+
+inline bool CodeOrigin::operator==(const CodeOrigin& other) const
+{
+    return bytecodeIndex == other.bytecodeIndex
+        && inlineCallFrame == other.inlineCallFrame;
+}
+
+struct CodeOriginHash {
+    static unsigned hash(const CodeOrigin& key) { return key.hash(); }
+    static bool equal(const CodeOrigin& a, const CodeOrigin& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+struct CodeOriginApproximateHash {
+    static unsigned hash(const CodeOrigin& key) { return key.approximateHash(); }
+    static bool equal(const CodeOrigin& a, const CodeOrigin& b) { return a.isApproximatelyEqualTo(b); }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::CodeOrigin> {
+    typedef JSC::CodeOriginHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::CodeOrigin> : SimpleClassHashTraits<JSC::CodeOrigin> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
diff --git a/bytecode/CodeType.cpp b/bytecode/CodeType.cpp
new file mode 100644
index 0000000..0c7043d
--- /dev/null
+++ b/bytecode/CodeType.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CodeType.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::CodeType codeType)
+{
+    switch (codeType) {
+    case JSC::GlobalCode:
+        out.print("Global");
+        return;
+    case JSC::EvalCode:
+        out.print("Eval");
+        return;
+    case JSC::FunctionCode:
+        out.print("Function");
+        return;
+    case JSC::ModuleCode:
+        out.print("Module");
+        return;
+    default:
+        CRASH();
+        return;
+    }
+}
+
+} // namespace WTF
+
diff --git a/bytecode/CodeType.h b/bytecode/CodeType.h
new file mode 100644
index 0000000..3c38ca2
--- /dev/null
+++ b/bytecode/CodeType.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum CodeType { GlobalCode, EvalCode, FunctionCode, ModuleCode };
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::CodeType);
+
+} // namespace WTF
diff --git a/bytecode/ComplexGetStatus.cpp b/bytecode/ComplexGetStatus.cpp
new file mode 100644
index 0000000..0622553
--- /dev/null
+++ b/bytecode/ComplexGetStatus.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ComplexGetStatus.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+ComplexGetStatus ComplexGetStatus::computeFor(
+    Structure* headStructure, const ObjectPropertyConditionSet& conditionSet, UniquedStringImpl* uid)
+{
+    // FIXME: We should assert that we never see a structure that
+    // getOwnPropertySlotIsImpure() but for which we don't
+    // newImpurePropertyFiresWatchpoints(). We're not at a point where we can do
+    // that, yet.
+    // https://bugs.webkit.org/show_bug.cgi?id=131810
+    
+    ASSERT(conditionSet.isValid());
+    
+    if (headStructure->takesSlowPathInDFGForImpureProperty())
+        return takesSlowPath();
+    
+    ComplexGetStatus result;
+    result.m_kind = Inlineable;
+    
+    if (!conditionSet.isEmpty()) {
+        result.m_conditionSet = conditionSet;
+        
+        if (!result.m_conditionSet.structuresEnsureValidity())
+            return skip();
+
+        unsigned numberOfSlotBases =
+            result.m_conditionSet.numberOfConditionsWithKind(PropertyCondition::Presence);
+        RELEASE_ASSERT(numberOfSlotBases <= 1);
+        if (!numberOfSlotBases) {
+            ASSERT(result.m_offset == invalidOffset);
+            return result;
+        }
+        ObjectPropertyCondition base = result.m_conditionSet.slotBaseCondition();
+        ASSERT(base.kind() == PropertyCondition::Presence);
+
+        result.m_offset = base.offset();
+    } else
+        result.m_offset = headStructure->getConcurrently(uid);
+    
+    if (!isValidOffset(result.m_offset))
+        return takesSlowPath();
+    
+    return result;
+}
+
+} // namespace JSC
+
+
diff --git a/bytecode/ComplexGetStatus.h b/bytecode/ComplexGetStatus.h
new file mode 100644
index 0000000..d94b312
--- /dev/null
+++ b/bytecode/ComplexGetStatus.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "ObjectPropertyConditionSet.h"
+#include "PropertyOffset.h"
+
+namespace JSC {
+
+class CodeBlock;
+class StructureChain;
+
+// This class is useful for figuring out how to inline a cached get-like access. We
+// say "get-like" because this is appropriate for loading the GetterSetter object in
+// a put_by_id that hits a setter. Notably, this doesn't figure out how to call
+// accessors, or even whether they should be called. What it gives us, is a way of
+// determining how to load the value from the requested property (identified by a
+// StringImpl* uid) from an object of the given structure in the given CodeBlock,
+// assuming that such an access had already been cached by Repatch (and so Repatch had
+// already done a bunch of safety checks). This doesn't reexecute any checks that
+// Repatch would have executed, and for prototype chain accesses, it doesn't ask the
+// objects in the prototype chain whether their getOwnPropertySlot would attempt to
+// intercept the access - so this really is only appropriate if you already know that
+// one of the JITOperations had OK'd this for caching and that Repatch concurred.
+//
+// The typical use pattern is something like:
+//
+//     ComplexGetStatus status = ComplexGetStatus::computeFor(...);
+//     switch (status.kind()) {
+//     case ComplexGetStatus::ShouldSkip:
+//         // Handle the case where this kind of access is possibly safe but wouldn't
+//         // pass the required safety checks. For example, if an IC gives us a list of
+//         // accesses and one of them is ShouldSkip, then we should pretend as if it
+//         // wasn't even there.
+//         break;
+//     case ComplexGetStatus::TakesSlowPath:
+//         // This kind of access is not safe to inline. Bail out of any attempst to
+//         // inline.
+//         break;
+//     case ComplexGetStatus::Inlineable:
+//         // The good stuff goes here. If it's Inlineable then the other properties of
+//         // the 'status' object will tell you everything you need to know about how
+//         // to execute the get-like operation.
+//         break;
+//     }
+
+class ComplexGetStatus {
+public:
+    enum Kind {
+        ShouldSkip,
+        TakesSlowPath,
+        Inlineable
+    };
+    
+    ComplexGetStatus()
+        : m_kind(ShouldSkip)
+        , m_offset(invalidOffset)
+    {
+    }
+    
+    static ComplexGetStatus skip()
+    {
+        return ComplexGetStatus();
+    }
+    
+    static ComplexGetStatus takesSlowPath()
+    {
+        ComplexGetStatus result;
+        result.m_kind = TakesSlowPath;
+        return result;
+    }
+    
+    static ComplexGetStatus computeFor(
+        Structure* headStructure, const ObjectPropertyConditionSet&, UniquedStringImpl* uid);
+    
+    Kind kind() const { return m_kind; }
+    PropertyOffset offset() const { return m_offset; }
+    const ObjectPropertyConditionSet& conditionSet() const { return m_conditionSet; }
+    
+private:
+    Kind m_kind;
+    PropertyOffset m_offset;
+    ObjectPropertyConditionSet m_conditionSet;
+};
+
+} // namespace JSC
diff --git a/bytecode/DFGExitProfile.cpp b/bytecode/DFGExitProfile.cpp
new file mode 100644
index 0000000..64fe9a3
--- /dev/null
+++ b/bytecode/DFGExitProfile.cpp
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGExitProfile.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "VMInlines.h"
+
+namespace JSC { namespace DFG {
+
+void FrequentExitSite::dump(PrintStream& out) const
+{
+    out.print("bc#", m_bytecodeOffset, ": ", m_kind, "/", m_jitType);
+}
+
+ExitProfile::ExitProfile() { }
+ExitProfile::~ExitProfile() { }
+
+bool ExitProfile::add(const ConcurrentJSLocker&, CodeBlock* owner, const FrequentExitSite& site)
+{
+    ASSERT(site.jitType() != ExitFromAnything);
+
+    CODEBLOCK_LOG_EVENT(owner, "frequentExit", (site));
+    
+    if (Options::verboseExitProfile())
+        dataLog(pointerDump(owner), ": Adding exit site: ", site, "\n");
+    
+    // If we've never seen any frequent exits then create the list and put this site
+    // into it.
+    if (!m_frequentExitSites) {
+        m_frequentExitSites = std::make_unique<Vector<FrequentExitSite>>();
+        m_frequentExitSites->append(site);
+        return true;
+    }
+    
+    // Don't add it if it's already there. This is O(n), but that's OK, because we
+    // know that the total number of places where code exits tends to not be large,
+    // and this code is only used when recompilation is triggered.
+    for (unsigned i = 0; i < m_frequentExitSites->size(); ++i) {
+        if (m_frequentExitSites->at(i) == site)
+            return false;
+    }
+    
+    m_frequentExitSites->append(site);
+    return true;
+}
+
+Vector<FrequentExitSite> ExitProfile::exitSitesFor(unsigned bytecodeIndex)
+{
+    Vector<FrequentExitSite> result;
+    
+    if (!m_frequentExitSites)
+        return result;
+    
+    for (unsigned i = 0; i < m_frequentExitSites->size(); ++i) {
+        if (m_frequentExitSites->at(i).bytecodeOffset() == bytecodeIndex)
+            result.append(m_frequentExitSites->at(i));
+    }
+    
+    return result;
+}
+
+bool ExitProfile::hasExitSite(const ConcurrentJSLocker&, const FrequentExitSite& site) const
+{
+    if (!m_frequentExitSites)
+        return false;
+    
+    for (unsigned i = m_frequentExitSites->size(); i--;) {
+        if (site.subsumes(m_frequentExitSites->at(i)))
+            return true;
+    }
+    return false;
+}
+
+QueryableExitProfile::QueryableExitProfile() { }
+QueryableExitProfile::~QueryableExitProfile() { }
+
+void QueryableExitProfile::initialize(const ConcurrentJSLocker&, const ExitProfile& profile)
+{
+    if (!profile.m_frequentExitSites)
+        return;
+    
+    for (unsigned i = 0; i < profile.m_frequentExitSites->size(); ++i)
+        m_frequentExitSites.add(profile.m_frequentExitSites->at(i));
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/bytecode/DFGExitProfile.h b/bytecode/DFGExitProfile.h
new file mode 100644
index 0000000..337e3ec
--- /dev/null
+++ b/bytecode/DFGExitProfile.h
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2011-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "ConcurrentJSLock.h"
+#include "ExitKind.h"
+#include "ExitingJITType.h"
+#include <wtf/HashSet.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class FrequentExitSite {
+public:
+    FrequentExitSite()
+        : m_bytecodeOffset(0) // 0 = empty value
+        , m_kind(ExitKindUnset)
+        , m_jitType(ExitFromAnything)
+    {
+    }
+    
+    FrequentExitSite(WTF::HashTableDeletedValueType)
+        : m_bytecodeOffset(1) // 1 = deleted value
+        , m_kind(ExitKindUnset)
+        , m_jitType(ExitFromAnything)
+    {
+    }
+    
+    explicit FrequentExitSite(unsigned bytecodeOffset, ExitKind kind, ExitingJITType jitType = ExitFromAnything)
+        : m_bytecodeOffset(bytecodeOffset)
+        , m_kind(kind)
+        , m_jitType(jitType)
+    {
+        if (m_kind == ArgumentsEscaped) {
+            // Count this one globally. It doesn't matter where in the code block the arguments excaped;
+            // the fact that they did is not associated with any particular instruction.
+            m_bytecodeOffset = 0;
+        }
+    }
+    
+    // Use this constructor if you wish for the exit site to be counted globally within its
+    // code block.
+    explicit FrequentExitSite(ExitKind kind, ExitingJITType jitType = ExitFromAnything)
+        : m_bytecodeOffset(0)
+        , m_kind(kind)
+        , m_jitType(jitType)
+    {
+    }
+    
+    bool operator!() const
+    {
+        return m_kind == ExitKindUnset;
+    }
+    
+    bool operator==(const FrequentExitSite& other) const
+    {
+        return m_bytecodeOffset == other.m_bytecodeOffset
+            && m_kind == other.m_kind
+            && m_jitType == other.m_jitType;
+    }
+    
+    bool subsumes(const FrequentExitSite& other) const
+    {
+        if (m_bytecodeOffset != other.m_bytecodeOffset)
+            return false;
+        if (m_kind != other.m_kind)
+            return false;
+        if (m_jitType == ExitFromAnything)
+            return true;
+        return m_jitType == other.m_jitType;
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::intHash(m_bytecodeOffset) + m_kind + m_jitType * 7;
+    }
+    
+    unsigned bytecodeOffset() const { return m_bytecodeOffset; }
+    ExitKind kind() const { return m_kind; }
+    ExitingJITType jitType() const { return m_jitType; }
+    
+    FrequentExitSite withJITType(ExitingJITType jitType) const
+    {
+        FrequentExitSite result = *this;
+        result.m_jitType = jitType;
+        return result;
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return m_kind == ExitKindUnset && m_bytecodeOffset;
+    }
+    
+    void dump(PrintStream& out) const;
+
+private:
+    unsigned m_bytecodeOffset;
+    ExitKind m_kind;
+    ExitingJITType m_jitType;
+};
+
+struct FrequentExitSiteHash {
+    static unsigned hash(const FrequentExitSite& key) { return key.hash(); }
+    static bool equal(const FrequentExitSite& a, const FrequentExitSite& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::FrequentExitSite> {
+    typedef JSC::DFG::FrequentExitSiteHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::FrequentExitSite> : SimpleClassHashTraits<JSC::DFG::FrequentExitSite> { };
+
+} // namespace WTF
+
+namespace JSC { namespace DFG {
+
+class QueryableExitProfile;
+
+class ExitProfile {
+public:
+    ExitProfile();
+    ~ExitProfile();
+    
+    // Add a new frequent exit site. Return true if this is a new one, or false
+    // if we already knew about it. This is an O(n) operation, because it errs
+    // on the side of keeping the data structure compact. Also, this will only
+    // be called a fixed number of times per recompilation. Recompilation is
+    // rare to begin with, and implies doing O(n) operations on the CodeBlock
+    // anyway.
+    bool add(const ConcurrentJSLocker&, CodeBlock* owner, const FrequentExitSite&);
+    
+    // Get the frequent exit sites for a bytecode index. This is O(n), and is
+    // meant to only be used from debugging/profiling code.
+    Vector<FrequentExitSite> exitSitesFor(unsigned bytecodeIndex);
+    
+    // This is O(n) and should be called on less-frequently executed code paths
+    // in the compiler. It should be strictly cheaper than building a
+    // QueryableExitProfile, if you really expect this to be called infrequently
+    // and you believe that there are few exit sites.
+    bool hasExitSite(const ConcurrentJSLocker&, const FrequentExitSite&) const;
+    bool hasExitSite(const ConcurrentJSLocker& locker, ExitKind kind) const
+    {
+        return hasExitSite(locker, FrequentExitSite(kind));
+    }
+    bool hasExitSite(const ConcurrentJSLocker& locker, unsigned bytecodeIndex, ExitKind kind) const
+    {
+        return hasExitSite(locker, FrequentExitSite(bytecodeIndex, kind));
+    }
+    
+private:
+    friend class QueryableExitProfile;
+    
+    std::unique_ptr<Vector<FrequentExitSite>> m_frequentExitSites;
+};
+
+class QueryableExitProfile {
+public:
+    QueryableExitProfile();
+    ~QueryableExitProfile();
+    
+    void initialize(const ConcurrentJSLocker&, const ExitProfile&);
+
+    bool hasExitSite(const FrequentExitSite& site) const
+    {
+        if (site.jitType() == ExitFromAnything) {
+            return hasExitSite(site.withJITType(ExitFromDFG))
+                || hasExitSite(site.withJITType(ExitFromFTL));
+        }
+        return m_frequentExitSites.find(site) != m_frequentExitSites.end();
+    }
+    
+    bool hasExitSite(ExitKind kind) const
+    {
+        return hasExitSite(FrequentExitSite(kind));
+    }
+    
+    bool hasExitSite(unsigned bytecodeIndex, ExitKind kind) const
+    {
+        return hasExitSite(FrequentExitSite(bytecodeIndex, kind));
+    }
+private:
+    HashSet<FrequentExitSite> m_frequentExitSites;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/bytecode/DOMJITAccessCasePatchpointParams.cpp b/bytecode/DOMJITAccessCasePatchpointParams.cpp
new file mode 100644
index 0000000..95e1401
--- /dev/null
+++ b/bytecode/DOMJITAccessCasePatchpointParams.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMJITAccessCasePatchpointParams.h"
+
+#include "LinkBuffer.h"
+#include "PolymorphicAccess.h"
+#include "StructureStubInfo.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+template<typename JumpType, typename FunctionType, typename ResultType, typename... Arguments>
+class SlowPathCallGeneratorWithArguments : public DOMJITAccessCasePatchpointParams::SlowPathCallGenerator {
+public:
+    SlowPathCallGeneratorWithArguments(JumpType from, CCallHelpers::Label to, FunctionType function, ResultType result, std::tuple<Arguments...> arguments)
+        : m_from(from)
+        , m_to(to)
+        , m_function(function)
+        , m_result(result)
+        , m_arguments(arguments)
+    {
+    }
+
+    template<size_t... ArgumentsIndex>
+    CCallHelpers::JumpList generateImpl(AccessGenerationState& state, const RegisterSet& usedRegistersByPatchpoint, CCallHelpers& jit, std::index_sequence<ArgumentsIndex...>)
+    {
+        CCallHelpers::JumpList exceptions;
+        // We spill (1) the used registers by IC and (2) the used registers by DOMJIT::Patchpoint.
+        AccessGenerationState::SpillState spillState = state.preserveLiveRegistersToStackForCall(usedRegistersByPatchpoint);
+
+        jit.store32(
+            CCallHelpers::TrustedImm32(state.callSiteIndexForExceptionHandlingOrOriginal().bits()),
+            CCallHelpers::tagFor(static_cast<VirtualRegister>(CallFrameSlot::argumentCount)));
+
+        jit.makeSpaceOnStackForCCall();
+
+        // FIXME: Currently, we do not check any ARM EABI / SH4 things here.
+        // But it is OK because a compile error happens when you pass JSValueRegs as an argument.
+        // https://bugs.webkit.org/show_bug.cgi?id=163099
+        jit.setupArgumentsWithExecState(std::get<ArgumentsIndex>(m_arguments)...);
+
+        CCallHelpers::Call operationCall = jit.call();
+        auto function = m_function;
+        jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+            linkBuffer.link(operationCall, FunctionPtr(function));
+        });
+
+        jit.setupResults(m_result);
+        jit.reclaimSpaceOnStackForCCall();
+
+        CCallHelpers::Jump noException = jit.emitExceptionCheck(CCallHelpers::InvertedExceptionCheck);
+
+        state.restoreLiveRegistersFromStackForCallWithThrownException(spillState);
+        exceptions.append(jit.jump());
+
+        noException.link(&jit);
+        RegisterSet dontRestore;
+        dontRestore.set(m_result);
+        state.restoreLiveRegistersFromStackForCall(spillState, dontRestore);
+
+        return exceptions;
+    }
+
+    CCallHelpers::JumpList generate(AccessGenerationState& state, const RegisterSet& usedRegistersByPatchpoint, CCallHelpers& jit) override
+    {
+        m_from.link(&jit);
+        CCallHelpers::JumpList exceptions = generateImpl(state, usedRegistersByPatchpoint, jit, std::make_index_sequence<std::tuple_size<std::tuple<Arguments...>>::value>());
+        jit.jump().linkTo(m_to, &jit);
+        return exceptions;
+    }
+
+protected:
+    JumpType m_from;
+    CCallHelpers::Label m_to;
+    FunctionType m_function;
+    ResultType m_result;
+    std::tuple<Arguments...> m_arguments;
+};
+
+#define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) \
+    void DOMJITAccessCasePatchpointParams::addSlowPathCallImpl(CCallHelpers::JumpList from, CCallHelpers& jit, OperationType operation, ResultType result, std::tuple<__VA_ARGS__> args) \
+    { \
+        CCallHelpers::Label to = jit.label(); \
+        m_generators.append(std::make_unique<SlowPathCallGeneratorWithArguments<CCallHelpers::JumpList, OperationType, ResultType, __VA_ARGS__>>(from, to, operation, result, args)); \
+    } \
+
+DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
+#undef JSC_DEFINE_CALL_OPERATIONS
+
+CCallHelpers::JumpList DOMJITAccessCasePatchpointParams::emitSlowPathCalls(AccessGenerationState& state, const RegisterSet& usedRegistersByPatchpoint, CCallHelpers& jit)
+{
+    CCallHelpers::JumpList exceptions;
+    for (auto& generator : m_generators)
+        exceptions.append(generator->generate(state, usedRegistersByPatchpoint, jit));
+    return exceptions;
+}
+
+}
+
+#endif
diff --git a/bytecode/DOMJITAccessCasePatchpointParams.h b/bytecode/DOMJITAccessCasePatchpointParams.h
new file mode 100644
index 0000000..8cf9751
--- /dev/null
+++ b/bytecode/DOMJITAccessCasePatchpointParams.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "DOMJITPatchpointParams.h"
+
+namespace JSC {
+
+struct AccessGenerationState;
+
+class DOMJITAccessCasePatchpointParams : public DOMJIT::PatchpointParams {
+public:
+    DOMJITAccessCasePatchpointParams(Vector<DOMJIT::Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
+        : DOMJIT::PatchpointParams(WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch))
+    {
+    }
+
+    class SlowPathCallGenerator {
+    public:
+        virtual ~SlowPathCallGenerator() { }
+        virtual CCallHelpers::JumpList generate(AccessGenerationState&, const RegisterSet& usedRegistersByPatchpoint, CCallHelpers&) = 0;
+    };
+
+    CCallHelpers::JumpList emitSlowPathCalls(AccessGenerationState&, const RegisterSet& usedRegistersByPatchpoint, CCallHelpers&);
+
+private:
+#define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) void addSlowPathCallImpl(CCallHelpers::JumpList, CCallHelpers&, OperationType, ResultType, std::tuple<__VA_ARGS__> args) override;
+    DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
+#undef JSC_DEFINE_CALL_OPERATIONS
+    Vector<std::unique_ptr<SlowPathCallGenerator>> m_generators;
+};
+
+}
+
+#endif
diff --git a/bytecode/DataFormat.cpp b/bytecode/DataFormat.cpp
new file mode 100644
index 0000000..8bd42e1
--- /dev/null
+++ b/bytecode/DataFormat.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DataFormat.h"
+
+#include <wtf/Assertions.h>
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::DataFormat dataFormat)
+{
+    out.print(dataFormatToString(dataFormat));
+}
+
+} // namespace WTF
diff --git a/bytecode/DataFormat.h b/bytecode/DataFormat.h
new file mode 100644
index 0000000..22c6492
--- /dev/null
+++ b/bytecode/DataFormat.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2011, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+// === DataFormat ===
+//
+// This enum tracks the current representation in which a value is being held.
+// Values may be unboxed primitives (int32, double, or cell), or boxed as a JSValue.
+// For boxed values, we may know the type of boxing that has taken place.
+// (May also need bool, array, object, string types!)
+enum DataFormat {
+    DataFormatNone = 0,
+    DataFormatInt32 = 1,
+    DataFormatInt52 = 2, // Int52's are left-shifted by 16 by default.
+    DataFormatStrictInt52 = 3, // "Strict" Int52 means it's not shifted.
+    DataFormatDouble = 4,
+    DataFormatBoolean = 5,
+    DataFormatCell = 6,
+    DataFormatStorage = 7,
+    DataFormatJS = 8,
+    DataFormatJSInt32 = DataFormatJS | DataFormatInt32,
+    DataFormatJSDouble = DataFormatJS | DataFormatDouble,
+    DataFormatJSCell = DataFormatJS | DataFormatCell,
+    DataFormatJSBoolean = DataFormatJS | DataFormatBoolean,
+    
+    // Marker deliminating ordinary data formats and OSR-only data formats.
+    DataFormatOSRMarker = 32, 
+    
+    // Special data formats used only for OSR.
+    DataFormatDead = 33, // Implies jsUndefined().
+};
+
+inline const char* dataFormatToString(DataFormat dataFormat)
+{
+    switch (dataFormat) {
+    case DataFormatNone:
+        return "None";
+    case DataFormatInt32:
+        return "Int32";
+    case DataFormatInt52:
+        return "Int52";
+    case DataFormatStrictInt52:
+        return "StrictInt52";
+    case DataFormatDouble:
+        return "Double";
+    case DataFormatCell:
+        return "Cell";
+    case DataFormatBoolean:
+        return "Boolean";
+    case DataFormatStorage:
+        return "Storage";
+    case DataFormatJS:
+        return "JS";
+    case DataFormatJSInt32:
+        return "JSInt32";
+    case DataFormatJSDouble:
+        return "JSDouble";
+    case DataFormatJSCell:
+        return "JSCell";
+    case DataFormatJSBoolean:
+        return "JSBoolean";
+    case DataFormatDead:
+        return "Dead";
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return "Unknown";
+    }
+}
+
+inline bool isJSFormat(DataFormat format, DataFormat expectedFormat)
+{
+    ASSERT(expectedFormat & DataFormatJS);
+    return (format | DataFormatJS) == expectedFormat;
+}
+
+inline bool isJSInt32(DataFormat format)
+{
+    return isJSFormat(format, DataFormatJSInt32);
+}
+
+inline bool isJSDouble(DataFormat format)
+{
+    return isJSFormat(format, DataFormatJSDouble);
+}
+
+inline bool isJSCell(DataFormat format)
+{
+    return isJSFormat(format, DataFormatJSCell);
+}
+
+inline bool isJSBoolean(DataFormat format)
+{
+    return isJSFormat(format, DataFormatJSBoolean);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::DataFormat);
+
+} // namespace WTF
diff --git a/bytecode/DeferredCompilationCallback.cpp b/bytecode/DeferredCompilationCallback.cpp
new file mode 100644
index 0000000..762387c
--- /dev/null
+++ b/bytecode/DeferredCompilationCallback.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DeferredCompilationCallback.h"
+
+#include "CodeBlock.h"
+
+namespace JSC {
+
+DeferredCompilationCallback::DeferredCompilationCallback() { }
+DeferredCompilationCallback::~DeferredCompilationCallback() { }
+
+void DeferredCompilationCallback::compilationDidComplete(CodeBlock*, CodeBlock*, CompilationResult result)
+{
+    dumpCompiledSourcesIfNeeded();
+
+    switch (result) {
+    case CompilationFailed:
+    case CompilationInvalidated:
+    case CompilationSuccessful:
+        break;
+    case CompilationDeferred:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+
+Vector<DeferredSourceDump>& DeferredCompilationCallback::ensureDeferredSourceDump()
+{
+    if (!m_deferredSourceDump)
+        m_deferredSourceDump = std::make_unique<Vector<DeferredSourceDump>>();
+    return *m_deferredSourceDump;
+}
+
+void DeferredCompilationCallback::dumpCompiledSourcesIfNeeded()
+{
+    if (!m_deferredSourceDump)
+        return;
+
+    ASSERT(Options::dumpSourceAtDFGTime());
+    unsigned index = 0;
+    for (auto& info : *m_deferredSourceDump) {
+        dataLog("[", ++index, "] ");
+        info.dump();
+    }
+}
+
+} // JSC
+
diff --git a/bytecode/DeferredCompilationCallback.h b/bytecode/DeferredCompilationCallback.h
new file mode 100644
index 0000000..9257110
--- /dev/null
+++ b/bytecode/DeferredCompilationCallback.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CompilationResult.h"
+#include "DeferredSourceDump.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CodeBlock;
+
+class DeferredCompilationCallback : public RefCounted<DeferredCompilationCallback> {
+protected:
+    DeferredCompilationCallback();
+
+public:
+    virtual ~DeferredCompilationCallback();
+
+    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*, CodeBlock* profiledDFGCodeBlock) = 0;
+    virtual void compilationDidComplete(CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationResult);
+
+    Vector<DeferredSourceDump>& ensureDeferredSourceDump();
+
+private:
+    void dumpCompiledSourcesIfNeeded();
+
+    std::unique_ptr<Vector<DeferredSourceDump>> m_deferredSourceDump;
+};
+
+} // namespace JSC
diff --git a/bytecode/DeferredSourceDump.cpp b/bytecode/DeferredSourceDump.cpp
new file mode 100644
index 0000000..48079db
--- /dev/null
+++ b/bytecode/DeferredSourceDump.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DeferredSourceDump.h"
+
+#include "CodeBlock.h"
+#include "CodeBlockWithJITType.h"
+
+namespace JSC {
+
+DeferredSourceDump::DeferredSourceDump(CodeBlock* codeBlock)
+    : m_codeBlock(codeBlock)
+    , m_rootCodeBlock(nullptr)
+    , m_rootJITType(JITCode::None)
+{
+}
+
+DeferredSourceDump::DeferredSourceDump(CodeBlock* codeBlock, CodeBlock* rootCodeBlock, JITCode::JITType rootJITType, CodeOrigin callerCodeOrigin)
+    : m_codeBlock(codeBlock)
+    , m_rootCodeBlock(rootCodeBlock)
+    , m_rootJITType(rootJITType)
+    , m_callerCodeOrigin(callerCodeOrigin)
+{
+}
+
+void DeferredSourceDump::dump()
+{
+    bool isInlinedFrame = !!m_rootCodeBlock;
+    if (isInlinedFrame)
+        dataLog("Inlined ");
+    else
+        dataLog("Compiled ");
+    dataLog(*m_codeBlock);
+
+    if (isInlinedFrame)
+        dataLog(" at ", CodeBlockWithJITType(m_rootCodeBlock, m_rootJITType), " ", m_callerCodeOrigin);
+
+    dataLog("\n'''");
+    m_codeBlock->dumpSource();
+    dataLog("'''\n");
+}
+
+} // namespace JSC
diff --git a/bytecode/DeferredSourceDump.h b/bytecode/DeferredSourceDump.h
new file mode 100644
index 0000000..6c9943d
--- /dev/null
+++ b/bytecode/DeferredSourceDump.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeOrigin.h"
+#include "JITCode.h"
+
+namespace JSC {
+
+class CodeBlock;
+
+class DeferredSourceDump {
+public:
+    DeferredSourceDump(CodeBlock*);
+    DeferredSourceDump(CodeBlock*, CodeBlock* rootCodeBlock, JITCode::JITType rootJITType, CodeOrigin callerCodeOrigin);
+
+    void dump();
+
+private:
+    CodeBlock* m_codeBlock;
+    CodeBlock* m_rootCodeBlock;
+    JITCode::JITType m_rootJITType;
+    CodeOrigin m_callerCodeOrigin;
+};
+
+} // namespace JSC
diff --git a/bytecode/DirectEvalCodeCache.cpp b/bytecode/DirectEvalCodeCache.cpp
new file mode 100644
index 0000000..5bfef12
--- /dev/null
+++ b/bytecode/DirectEvalCodeCache.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DirectEvalCodeCache.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+void DirectEvalCodeCache::setSlow(ExecState* exec, JSCell* owner, const String& evalSource, CallSiteIndex callSiteIndex, DirectEvalExecutable* evalExecutable)
+{
+    LockHolder locker(m_lock);
+    m_cacheMap.set(CacheKey(evalSource, callSiteIndex), WriteBarrier<DirectEvalExecutable>(exec->vm(), owner, evalExecutable));
+}
+
+void DirectEvalCodeCache::clear()
+{
+    LockHolder locker(m_lock);
+    m_cacheMap.clear();
+}
+
+void DirectEvalCodeCache::visitAggregate(SlotVisitor& visitor)
+{
+    LockHolder locker(m_lock);
+    EvalCacheMap::iterator end = m_cacheMap.end();
+    for (EvalCacheMap::iterator ptr = m_cacheMap.begin(); ptr != end; ++ptr)
+        visitor.append(ptr->value);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/DirectEvalCodeCache.h b/bytecode/DirectEvalCodeCache.h
new file mode 100644
index 0000000..e075357
--- /dev/null
+++ b/bytecode/DirectEvalCodeCache.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DirectEvalExecutable.h"
+#include <wtf/HashMap.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/StringHash.h>
+
+namespace JSC {
+
+    class SlotVisitor;
+
+    class DirectEvalCodeCache {
+    public:
+        class CacheKey {
+        public:
+            CacheKey(const String& source, CallSiteIndex callSiteIndex)
+                : m_source(source.impl())
+                , m_callSiteIndex(callSiteIndex)
+            {
+            }
+
+            CacheKey(WTF::HashTableDeletedValueType)
+                : m_source(WTF::HashTableDeletedValue)
+            {
+            }
+
+            CacheKey() = default;
+
+            unsigned hash() const { return m_source->hash() ^ m_callSiteIndex.bits(); }
+
+            bool isEmptyValue() const { return !m_source; }
+
+            bool operator==(const CacheKey& other) const
+            {
+                return m_callSiteIndex == other.m_callSiteIndex && WTF::equal(m_source.get(), other.m_source.get());
+            }
+
+            bool isHashTableDeletedValue() const { return m_source.isHashTableDeletedValue(); }
+
+            struct Hash {
+                static unsigned hash(const CacheKey& key)
+                {
+                    return key.hash();
+                }
+                static bool equal(const CacheKey& lhs, const CacheKey& rhs)
+                {
+                    return lhs == rhs;
+                }
+                static const bool safeToCompareToEmptyOrDeleted = false;
+            };
+
+            typedef SimpleClassHashTraits<CacheKey> HashTraits;
+
+        private:
+            RefPtr<StringImpl> m_source;
+            CallSiteIndex m_callSiteIndex;
+        };
+
+        DirectEvalExecutable* tryGet(const String& evalSource, CallSiteIndex callSiteIndex)
+        {
+            return m_cacheMap.fastGet(CacheKey(evalSource, callSiteIndex)).get();
+        }
+        
+        void set(ExecState* exec, JSCell* owner, const String& evalSource, CallSiteIndex callSiteIndex, DirectEvalExecutable* evalExecutable)
+        {
+            if (m_cacheMap.size() < maxCacheEntries)
+                setSlow(exec, owner, evalSource, callSiteIndex, evalExecutable);
+        }
+
+        bool isEmpty() const { return m_cacheMap.isEmpty(); }
+
+        void visitAggregate(SlotVisitor&);
+
+        void clear();
+
+    private:
+        static const int maxCacheEntries = 64;
+
+        void setSlow(ExecState*, JSCell* owner, const String& evalSource, CallSiteIndex, DirectEvalExecutable*);
+
+        typedef HashMap<CacheKey, WriteBarrier<DirectEvalExecutable>, CacheKey::Hash, CacheKey::HashTraits> EvalCacheMap;
+        EvalCacheMap m_cacheMap;
+        Lock m_lock;
+    };
+
+} // namespace JSC
diff --git a/bytecode/EvalCodeBlock.cpp b/bytecode/EvalCodeBlock.cpp
new file mode 100644
index 0000000..5232a0e
--- /dev/null
+++ b/bytecode/EvalCodeBlock.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008-2010, 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EvalCodeBlock.h"
+
+namespace JSC {
+
+const ClassInfo EvalCodeBlock::s_info = {
+    "EvalCodeBlock", &Base::s_info, 0,
+    CREATE_METHOD_TABLE(EvalCodeBlock)
+};
+
+void EvalCodeBlock::destroy(JSCell* cell)
+{
+    static_cast<EvalCodeBlock*>(cell)->~EvalCodeBlock();
+}
+
+} // namespace JSC
diff --git a/bytecode/EvalCodeBlock.h b/bytecode/EvalCodeBlock.h
new file mode 100644
index 0000000..e9e61ba
--- /dev/null
+++ b/bytecode/EvalCodeBlock.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2008-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GlobalCodeBlock.h"
+
+namespace JSC {
+
+class EvalCodeBlock : public GlobalCodeBlock {
+public:
+    typedef GlobalCodeBlock Base;
+    DECLARE_INFO;
+
+    static EvalCodeBlock* create(VM* vm, CopyParsedBlockTag, EvalCodeBlock& other)
+    {
+        EvalCodeBlock* instance = new (NotNull, allocateCell<EvalCodeBlock>(vm->heap))
+            EvalCodeBlock(vm, vm->evalCodeBlockStructure.get(), CopyParsedBlock, other);
+        instance->finishCreation(*vm, CopyParsedBlock, other);
+        return instance;
+    }
+
+    static EvalCodeBlock* create(VM* vm, EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock,
+        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider)
+    {
+        EvalCodeBlock* instance = new (NotNull, allocateCell<EvalCodeBlock>(vm->heap))
+            EvalCodeBlock(vm, vm->evalCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider);
+        instance->finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
+        return instance;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    const Identifier& variable(unsigned index) { return unlinkedEvalCodeBlock()->variable(index); }
+    unsigned numVariables() { return unlinkedEvalCodeBlock()->numVariables(); }
+    
+private:
+    EvalCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, EvalCodeBlock& other)
+        : GlobalCodeBlock(vm, structure, CopyParsedBlock, other)
+    {
+    }
+        
+    EvalCodeBlock(VM* vm, Structure* structure, EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock,
+        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, 1)
+    {
+    }
+    
+    static void destroy(JSCell*);
+
+private:
+    UnlinkedEvalCodeBlock* unlinkedEvalCodeBlock() const { return jsCast<UnlinkedEvalCodeBlock*>(unlinkedCodeBlock()); }
+};
+
+} // namespace JSC
diff --git a/bytecode/ExecutableInfo.h b/bytecode/ExecutableInfo.h
new file mode 100644
index 0000000..750900e
--- /dev/null
+++ b/bytecode/ExecutableInfo.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ParserModes.h"
+
+namespace JSC {
+    
+enum class DerivedContextType : uint8_t { None, DerivedConstructorContext, DerivedMethodContext };
+enum class EvalContextType    : uint8_t { None, FunctionEvalContext };
+
+// FIXME: These flags, ParserModes and propagation to XXXCodeBlocks should be reorganized.
+// https://bugs.webkit.org/show_bug.cgi?id=151547
+struct ExecutableInfo {
+    ExecutableInfo(bool usesEval, bool isStrictMode, bool isConstructor, bool isBuiltinFunction, ConstructorKind constructorKind, JSParserScriptMode scriptMode, SuperBinding superBinding, SourceParseMode parseMode, DerivedContextType derivedContextType, bool isArrowFunctionContext, bool isClassContext, EvalContextType evalContextType)
+        : m_usesEval(usesEval)
+        , m_isStrictMode(isStrictMode)
+        , m_isConstructor(isConstructor)
+        , m_isBuiltinFunction(isBuiltinFunction)
+        , m_constructorKind(static_cast<unsigned>(constructorKind))
+        , m_superBinding(static_cast<unsigned>(superBinding))
+        , m_scriptMode(static_cast<unsigned>(scriptMode))
+        , m_parseMode(parseMode)
+        , m_derivedContextType(static_cast<unsigned>(derivedContextType))
+        , m_isArrowFunctionContext(isArrowFunctionContext)
+        , m_isClassContext(isClassContext)
+        , m_evalContextType(static_cast<unsigned>(evalContextType))
+    {
+        ASSERT(m_constructorKind == static_cast<unsigned>(constructorKind));
+        ASSERT(m_superBinding == static_cast<unsigned>(superBinding));
+        ASSERT(m_scriptMode == static_cast<unsigned>(scriptMode));
+    }
+
+    bool usesEval() const { return m_usesEval; }
+    bool isStrictMode() const { return m_isStrictMode; }
+    bool isConstructor() const { return m_isConstructor; }
+    bool isBuiltinFunction() const { return m_isBuiltinFunction; }
+    ConstructorKind constructorKind() const { return static_cast<ConstructorKind>(m_constructorKind); }
+    SuperBinding superBinding() const { return static_cast<SuperBinding>(m_superBinding); }
+    JSParserScriptMode scriptMode() const { return static_cast<JSParserScriptMode>(m_scriptMode); }
+    SourceParseMode parseMode() const { return m_parseMode; }
+    DerivedContextType derivedContextType() const { return static_cast<DerivedContextType>(m_derivedContextType); }
+    EvalContextType evalContextType() const { return static_cast<EvalContextType>(m_evalContextType); }
+    bool isArrowFunctionContext() const { return m_isArrowFunctionContext; }
+    bool isClassContext() const { return m_isClassContext; }
+
+private:
+    unsigned m_usesEval : 1;
+    unsigned m_isStrictMode : 1;
+    unsigned m_isConstructor : 1;
+    unsigned m_isBuiltinFunction : 1;
+    unsigned m_constructorKind : 2;
+    unsigned m_superBinding : 1;
+    unsigned m_scriptMode: 1;
+    SourceParseMode m_parseMode;
+    unsigned m_derivedContextType : 2;
+    unsigned m_isArrowFunctionContext : 1;
+    unsigned m_isClassContext : 1;
+    unsigned m_evalContextType : 2;
+};
+
+} // namespace JSC
diff --git a/bytecode/ExecutionCounter.cpp b/bytecode/ExecutionCounter.cpp
new file mode 100644
index 0000000..237c0e7
--- /dev/null
+++ b/bytecode/ExecutionCounter.cpp
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2012, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ExecutionCounter.h"
+
+#include "CodeBlock.h"
+#include "ExecutableAllocator.h"
+#include "JSCInlines.h"
+#include "VMInlines.h"
+#include <wtf/StringExtras.h>
+
+namespace JSC {
+
+template<CountingVariant countingVariant>
+ExecutionCounter<countingVariant>::ExecutionCounter()
+{
+    reset();
+}
+
+template<CountingVariant countingVariant>
+void ExecutionCounter<countingVariant>::forceSlowPathConcurrently()
+{
+    m_counter = 0;
+}
+
+template<CountingVariant countingVariant>
+bool ExecutionCounter<countingVariant>::checkIfThresholdCrossedAndSet(CodeBlock* codeBlock)
+{
+    if (hasCrossedThreshold(codeBlock))
+        return true;
+    
+    if (setThreshold(codeBlock))
+        return true;
+    
+    return false;
+}
+
+template<CountingVariant countingVariant>
+void ExecutionCounter<countingVariant>::setNewThreshold(int32_t threshold, CodeBlock* codeBlock)
+{
+    reset();
+    m_activeThreshold = threshold;
+    setThreshold(codeBlock);
+}
+
+template<CountingVariant countingVariant>
+void ExecutionCounter<countingVariant>::deferIndefinitely()
+{
+    m_totalCount = 0;
+    m_activeThreshold = std::numeric_limits<int32_t>::max();
+    m_counter = std::numeric_limits<int32_t>::min();
+}
+
+double applyMemoryUsageHeuristics(int32_t value, CodeBlock* codeBlock)
+{
+#if ENABLE(JIT)
+    double multiplier =
+        ExecutableAllocator::memoryPressureMultiplier(
+            codeBlock->baselineAlternative()->predictedMachineCodeSize());
+#else
+    // This code path will probably not be taken, but if it is, we fake it.
+    double multiplier = 1.0;
+    UNUSED_PARAM(codeBlock);
+#endif
+    ASSERT(multiplier >= 1.0);
+    return multiplier * value;
+}
+
+int32_t applyMemoryUsageHeuristicsAndConvertToInt(int32_t value, CodeBlock* codeBlock)
+{
+    double doubleResult = applyMemoryUsageHeuristics(value, codeBlock);
+    
+    ASSERT(doubleResult >= 0);
+    
+    if (doubleResult > std::numeric_limits<int32_t>::max())
+        return std::numeric_limits<int32_t>::max();
+    
+    return static_cast<int32_t>(doubleResult);
+}
+
+template<CountingVariant countingVariant>
+bool ExecutionCounter<countingVariant>::hasCrossedThreshold(CodeBlock* codeBlock) const
+{
+    // This checks if the current count rounded up to the threshold we were targeting.
+    // For example, if we are using half of available executable memory and have
+    // m_activeThreshold = 1000, applyMemoryUsageHeuristics(m_activeThreshold) will be
+    // 2000, but we will pretend as if the threshold was crossed if we reach 2000 -
+    // 1000 / 2, or 1500. The reasoning here is that we want to avoid thrashing. If
+    // this method returns false, then the JIT's threshold for when it will again call
+    // into the slow path (which will call this method a second time) will be set
+    // according to the difference between the current count and the target count
+    // according to *current* memory usage. But by the time we call into this again, we
+    // may have JIT'ed more code, and so the target count will increase slightly. This
+    // may lead to a repeating pattern where the target count is slightly incremented,
+    // the JIT immediately matches that increase, calls into the slow path again, and
+    // again the target count is slightly incremented. Instead of having this vicious
+    // cycle, we declare victory a bit early if the difference between the current
+    // total and our target according to memory heuristics is small. Our definition of
+    // small is arbitrarily picked to be half of the original threshold (i.e.
+    // m_activeThreshold).
+    
+    double modifiedThreshold = applyMemoryUsageHeuristics(m_activeThreshold, codeBlock);
+    
+    double actualCount = static_cast<double>(m_totalCount) + m_counter;
+    double desiredCount = modifiedThreshold - static_cast<double>(
+        std::min(m_activeThreshold, maximumExecutionCountsBetweenCheckpoints())) / 2;
+    
+    bool result = actualCount >= desiredCount;
+    
+    CODEBLOCK_LOG_EVENT(codeBlock, "thresholdCheck", ("activeThreshold = ", m_activeThreshold, ", modifiedThreshold = ", modifiedThreshold, ", actualCount = ", actualCount, ", desiredCount = ", desiredCount));
+    
+    return result;
+}
+
+template<CountingVariant countingVariant>
+bool ExecutionCounter<countingVariant>::setThreshold(CodeBlock* codeBlock)
+{
+    if (m_activeThreshold == std::numeric_limits<int32_t>::max()) {
+        deferIndefinitely();
+        return false;
+    }
+        
+    // Compute the true total count.
+    double trueTotalCount = count();
+    
+    // Correct the threshold for current memory usage.
+    double threshold = applyMemoryUsageHeuristics(m_activeThreshold, codeBlock);
+        
+    // Threshold must be non-negative and not NaN.
+    ASSERT(threshold >= 0);
+        
+    // Adjust the threshold according to the number of executions we have already
+    // seen. This shouldn't go negative, but it might, because of round-off errors.
+    threshold -= trueTotalCount;
+        
+    if (threshold <= 0) {
+        m_counter = 0;
+        m_totalCount = trueTotalCount;
+        return true;
+    }
+
+    threshold = clippedThreshold(codeBlock->globalObject(), threshold);
+    
+    m_counter = static_cast<int32_t>(-threshold);
+        
+    m_totalCount = trueTotalCount + threshold;
+        
+    return false;
+}
+
+template<CountingVariant countingVariant>
+void ExecutionCounter<countingVariant>::reset()
+{
+    m_counter = 0;
+    m_totalCount = 0;
+    m_activeThreshold = 0;
+}
+
+template<CountingVariant countingVariant>
+void ExecutionCounter<countingVariant>::dump(PrintStream& out) const
+{
+    out.printf("%lf/%lf, %d", count(), static_cast<double>(m_activeThreshold), m_counter);
+}
+
+template class ExecutionCounter<CountingForBaseline>;
+template class ExecutionCounter<CountingForUpperTiers>;
+
+} // namespace JSC
+
diff --git a/bytecode/ExecutionCounter.h b/bytecode/ExecutionCounter.h
new file mode 100644
index 0000000..f78a912
--- /dev/null
+++ b/bytecode/ExecutionCounter.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSGlobalObject.h"
+#include "Options.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class CodeBlock;
+
+enum CountingVariant {
+    CountingForBaseline,
+    CountingForUpperTiers
+};
+
+double applyMemoryUsageHeuristics(int32_t value, CodeBlock*);
+int32_t applyMemoryUsageHeuristicsAndConvertToInt(int32_t value, CodeBlock*);
+
+inline int32_t formattedTotalExecutionCount(float value)
+{
+    union {
+        int32_t i;
+        float f;
+    } u;
+    u.f = value;
+    return u.i;
+}
+    
+template<CountingVariant countingVariant>
+class ExecutionCounter {
+public:
+    ExecutionCounter();
+    void forceSlowPathConcurrently(); // If you use this, checkIfThresholdCrossedAndSet() may still return false.
+    bool checkIfThresholdCrossedAndSet(CodeBlock*);
+    void setNewThreshold(int32_t threshold, CodeBlock*);
+    void deferIndefinitely();
+    double count() const { return static_cast<double>(m_totalCount) + m_counter; }
+    void dump(PrintStream&) const;
+    
+    static int32_t maximumExecutionCountsBetweenCheckpoints()
+    {
+        switch (countingVariant) {
+        case CountingForBaseline:
+            return Options::maximumExecutionCountsBetweenCheckpointsForBaseline();
+        case CountingForUpperTiers:
+            return Options::maximumExecutionCountsBetweenCheckpointsForUpperTiers();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return 0;
+        }
+    }
+    
+    template<typename T>
+    static T clippedThreshold(JSGlobalObject* globalObject, T threshold)
+    {
+        int32_t maxThreshold;
+        if (Options::randomizeExecutionCountsBetweenCheckpoints())
+            maxThreshold = globalObject->weakRandomInteger() % maximumExecutionCountsBetweenCheckpoints();
+        else
+            maxThreshold = maximumExecutionCountsBetweenCheckpoints();
+        if (threshold > maxThreshold)
+            threshold = maxThreshold;
+        return threshold;
+    }
+
+private:
+    bool hasCrossedThreshold(CodeBlock*) const;
+    bool setThreshold(CodeBlock*);
+    void reset();
+
+public:
+    // NB. These are intentionally public because it will be modified from machine code.
+    
+    // This counter is incremented by the JIT or LLInt. It starts out negative and is
+    // counted up until it becomes non-negative. At the start of a counting period,
+    // the threshold we wish to reach is m_totalCount + m_counter, in the sense that
+    // we will add X to m_totalCount and subtract X from m_counter.
+    int32_t m_counter;
+
+    // Counts the total number of executions we have seen plus the ones we've set a
+    // threshold for in m_counter. Because m_counter's threshold is negative, the
+    // total number of actual executions can always be computed as m_totalCount +
+    // m_counter.
+    float m_totalCount;
+
+    // This is the threshold we were originally targeting, without any correction for
+    // the memory usage heuristics.
+    int32_t m_activeThreshold;
+};
+
+typedef ExecutionCounter<CountingForBaseline> BaselineExecutionCounter;
+typedef ExecutionCounter<CountingForUpperTiers> UpperTierExecutionCounter;
+
+} // namespace JSC
diff --git a/bytecode/ExitKind.cpp b/bytecode/ExitKind.cpp
new file mode 100644
index 0000000..f1ea76d
--- /dev/null
+++ b/bytecode/ExitKind.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ExitKind.h"
+
+#include <wtf/Assertions.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+const char* exitKindToString(ExitKind kind)
+{
+    switch (kind) {
+    case ExitKindUnset:
+        return "Unset";
+    case BadType:
+        return "BadType";
+    case BadCell:
+        return "BadCell";
+    case BadIdent:
+        return "BadIdent";
+    case BadExecutable:
+        return "BadExecutable";
+    case BadCache:
+        return "BadCache";
+    case BadConstantCache:
+        return "BadConstantCache";
+    case BadIndexingType:
+        return "BadIndexingType";
+    case BadTypeInfoFlags:
+        return "BadTypeInfoFlags";
+    case Overflow:
+        return "Overflow";
+    case NegativeZero:
+        return "NegativeZero";
+    case Int52Overflow:
+        return "Int52Overflow";
+    case StoreToHole:
+        return "StoreToHole";
+    case LoadFromHole:
+        return "LoadFromHole";
+    case OutOfBounds:
+        return "OutOfBounds";
+    case InadequateCoverage:
+        return "InadequateCoverage";
+    case ArgumentsEscaped:
+        return "ArgumentsEscaped";
+    case ExoticObjectMode:
+        return "ExoticObjectMode";
+    case NotStringObject:
+        return "NotStringObject";
+    case VarargsOverflow:
+        return "VarargsOverflow";
+    case TDZFailure:
+        return "TDZFailure";
+    case HoistingFailed:
+        return "HoistingFailed";
+    case Uncountable:
+        return "Uncountable";
+    case UncountableInvalidation:
+        return "UncountableInvalidation";
+    case WatchdogTimerFired:
+        return "WatchdogTimerFired";
+    case DebuggerEvent:
+        return "DebuggerEvent";
+    case ExceptionCheck:
+        return "ExceptionCheck";
+    case GenericUnwind:
+        return "GenericUnwind";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return "Unknown";
+}
+
+bool exitKindMayJettison(ExitKind kind)
+{
+    switch (kind) {
+    case ExceptionCheck:
+    case GenericUnwind:
+        return false;
+    default:
+        return true;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::ExitKind kind)
+{
+    out.print(exitKindToString(kind));
+}
+
+} // namespace WTF
+
diff --git a/bytecode/ExitKind.h b/bytecode/ExitKind.h
new file mode 100644
index 0000000..a6c2e0e
--- /dev/null
+++ b/bytecode/ExitKind.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum ExitKind : uint8_t {
+    ExitKindUnset,
+    BadType, // We exited because a type prediction was wrong.
+    BadCell, // We exited because we made an incorrect assumption about what cell we would see. Usually used for function checks.
+    BadIdent, // We exited because we made an incorrect assumption about what identifier we would see. Usually used for cached Id check in get_by_val.
+    BadExecutable, // We exited because we made an incorrect assumption about what executable we would see.
+    BadCache, // We exited because an inline cache was wrong.
+    BadConstantCache, // We exited because a cache on a weak constant (usually a prototype) was wrong.
+    BadIndexingType, // We exited because an indexing type was wrong.
+    BadTypeInfoFlags, // We exited because we made an incorrect assumption about what TypeInfo flags we would see.
+    Overflow, // We exited because of overflow.
+    NegativeZero, // We exited because we encountered negative zero.
+    Int52Overflow, // We exited because of an Int52 overflow.
+    StoreToHole, // We had a store to a hole.
+    LoadFromHole, // We had a load from a hole.
+    OutOfBounds, // We had an out-of-bounds access to an array.
+    InadequateCoverage, // We exited because we ended up in code that didn't have profiling coverage.
+    ArgumentsEscaped, // We exited because arguments escaped but we didn't expect them to.
+    ExoticObjectMode, // We exited because some exotic object that we were accessing was in an exotic mode (like Arguments with slow arguments).
+    NotStringObject, // We exited because we shouldn't have attempted to optimize string object access.
+    VarargsOverflow, // We exited because a varargs call passed more arguments than we expected.
+    TDZFailure, // We exited because we were in the TDZ and accessed the variable.
+    HoistingFailed, // Something that was hoisted exited. So, assume that hoisting is a bad idea.
+    Uncountable, // We exited for none of the above reasons, and we should not count it. Most uses of this should be viewed as a FIXME.
+    UncountableInvalidation, // We exited because the code block was invalidated; this means that we've already counted the reasons why the code block was invalidated.
+    WatchdogTimerFired, // We exited because we need to service the watchdog timer.
+    DebuggerEvent, // We exited because we need to service the debugger.
+    ExceptionCheck, // We exited because a direct exception check showed that we threw an exception from a C call.
+    GenericUnwind, // We exited because a we arrived at this OSR exit from genericUnwind.
+};
+
+const char* exitKindToString(ExitKind);
+bool exitKindMayJettison(ExitKind);
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::ExitKind);
+
+} // namespace WTF
diff --git a/bytecode/ExitingJITType.cpp b/bytecode/ExitingJITType.cpp
new file mode 100644
index 0000000..aa8f120
--- /dev/null
+++ b/bytecode/ExitingJITType.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ExitingJITType.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, ExitingJITType type)
+{
+    switch (type) {
+    case ExitFromAnything:
+        out.print("FromAnything");
+        return;
+    case ExitFromDFG:
+        out.print("FromDFG");
+        return;
+    case ExitFromFTL:
+        out.print("FromFTL");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/bytecode/ExitingJITType.h b/bytecode/ExitingJITType.h
new file mode 100644
index 0000000..dfbfee4
--- /dev/null
+++ b/bytecode/ExitingJITType.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JITCode.h"
+
+namespace JSC {
+
+enum ExitingJITType : uint8_t {
+    ExitFromAnything,
+    ExitFromDFG,
+    ExitFromFTL
+};
+
+inline ExitingJITType exitingJITTypeFor(JITCode::JITType type)
+{
+    switch (type) {
+    case JITCode::DFGJIT:
+        return ExitFromDFG;
+    case JITCode::FTLJIT:
+        return ExitFromFTL;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return ExitFromAnything;
+    }
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::ExitingJITType);
+
+} // namespace WTF
diff --git a/bytecode/ExpressionRangeInfo.h b/bytecode/ExpressionRangeInfo.h
new file mode 100644
index 0000000..8f83527
--- /dev/null
+++ b/bytecode/ExpressionRangeInfo.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2012-2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+struct ExpressionRangeInfo {
+    // Line and column values are encoded in 1 of 3 modes depending on the size
+    // of their values. These modes are:
+    //
+    //   1. FatLine: 22-bit line, 8-bit column.
+    //   2. FatColumn: 8-bit line, 22-bit column.
+    //   3. FatLineAndColumn: 32-bit line, 32-bit column.
+    //
+    // For the first 2 modes, the line and column will be encoded in the 30-bit
+    // position field in the ExpressionRangeInfo. For the FatLineAndColumn mode,
+    // the position field will hold an index into a FatPosition vector which
+    // holds the FatPosition records with the full 32-bit line and column values.
+
+    enum {
+        FatLineMode,
+        FatColumnMode,
+        FatLineAndColumnMode
+    };
+
+    struct FatPosition {
+        uint32_t line;
+        uint32_t column;
+    };
+
+    enum {
+        FatLineModeLineShift = 8,
+        FatLineModeLineMask = (1 << 22) - 1,
+        FatLineModeColumnMask = (1 << 8) - 1,
+        FatColumnModeLineShift = 22,
+        FatColumnModeLineMask = (1 << 8) - 1,
+        FatColumnModeColumnMask = (1 << 22) - 1
+    };
+
+    enum {
+        MaxOffset = (1 << 7) - 1, 
+        MaxDivot = (1 << 25) - 1,
+        MaxFatLineModeLine = (1 << 22) - 1,
+        MaxFatLineModeColumn = (1 << 8) - 1,
+        MaxFatColumnModeLine = (1 << 8) - 1,
+        MaxFatColumnModeColumn = (1 << 22) - 1
+    };
+
+    void encodeFatLineMode(unsigned line, unsigned column)
+    {
+        ASSERT(line <= MaxFatLineModeLine);
+        ASSERT(column <= MaxFatLineModeColumn);
+        position = ((line & FatLineModeLineMask) << FatLineModeLineShift | (column & FatLineModeColumnMask));
+    }
+
+    void encodeFatColumnMode(unsigned line, unsigned column)
+    {
+        ASSERT(line <= MaxFatColumnModeLine);
+        ASSERT(column <= MaxFatColumnModeColumn);
+        position = ((line & FatColumnModeLineMask) << FatColumnModeLineShift | (column & FatColumnModeColumnMask));
+    }
+
+    void decodeFatLineMode(unsigned& line, unsigned& column) const
+    {
+        line = (position >> FatLineModeLineShift) & FatLineModeLineMask;
+        column = position & FatLineModeColumnMask;
+    }
+
+    void decodeFatColumnMode(unsigned& line, unsigned& column) const
+    {
+        line = (position >> FatColumnModeLineShift) & FatColumnModeLineMask;
+        column = position & FatColumnModeColumnMask;
+    }
+
+    uint32_t instructionOffset : 25;
+    uint32_t startOffset : 7;
+    uint32_t divotPoint : 25;
+    uint32_t endOffset : 7;
+    uint32_t mode : 2;
+    uint32_t position : 30;
+};
+
+} // namespace JSC
diff --git a/bytecode/FullBytecodeLiveness.h b/bytecode/FullBytecodeLiveness.h
new file mode 100644
index 0000000..073ce27
--- /dev/null
+++ b/bytecode/FullBytecodeLiveness.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/FastBitVector.h>
+
+namespace JSC {
+
+class BytecodeLivenessAnalysis;
+
+typedef HashMap<unsigned, FastBitVector, WTF::IntHash<unsigned>, WTF::UnsignedWithZeroKeyHashTraits<unsigned>> BytecodeToBitmapMap;
+
+class FullBytecodeLiveness {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    const FastBitVector& getLiveness(unsigned bytecodeIndex) const
+    {
+        return m_map[bytecodeIndex];
+    }
+    
+    bool operandIsLive(int operand, unsigned bytecodeIndex) const
+    {
+        return operandIsAlwaysLive(operand) || operandThatIsNotAlwaysLiveIsLive(getLiveness(bytecodeIndex), operand);
+    }
+    
+private:
+    friend class BytecodeLivenessAnalysis;
+    
+    Vector<FastBitVector, 0, UnsafeVectorOverflow> m_map;
+};
+
+} // namespace JSC
diff --git a/bytecode/FunctionCodeBlock.cpp b/bytecode/FunctionCodeBlock.cpp
new file mode 100644
index 0000000..56eadc6
--- /dev/null
+++ b/bytecode/FunctionCodeBlock.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008-2010, 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FunctionCodeBlock.h"
+
+namespace JSC {
+
+const ClassInfo FunctionCodeBlock::s_info = {
+    "FunctionCodeBlock", &Base::s_info, 0,
+    CREATE_METHOD_TABLE(FunctionCodeBlock)
+};
+
+void FunctionCodeBlock::destroy(JSCell* cell)
+{
+    static_cast<FunctionCodeBlock*>(cell)->~FunctionCodeBlock();
+}
+
+} // namespace JSC
diff --git a/bytecode/FunctionCodeBlock.h b/bytecode/FunctionCodeBlock.h
new file mode 100644
index 0000000..5b418b1
--- /dev/null
+++ b/bytecode/FunctionCodeBlock.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2008-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "UnlinkedFunctionCodeBlock.h"
+
+namespace JSC {
+
+class FunctionCodeBlock : public CodeBlock {
+public:
+    typedef CodeBlock Base;
+    DECLARE_INFO;
+
+    static FunctionCodeBlock* create(VM* vm, CopyParsedBlockTag, FunctionCodeBlock& other)
+    {
+        FunctionCodeBlock* instance = new (NotNull, allocateCell<FunctionCodeBlock>(vm->heap))
+            FunctionCodeBlock(vm, vm->functionCodeBlockStructure.get(), CopyParsedBlock, other);
+        instance->finishCreation(*vm, CopyParsedBlock, other);
+        return instance;
+    }
+
+    static FunctionCodeBlock* create(VM* vm, FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope,
+        PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+    {
+        FunctionCodeBlock* instance = new (NotNull, allocateCell<FunctionCodeBlock>(vm->heap))
+            FunctionCodeBlock(vm, vm->functionCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset);
+        instance->finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
+        return instance;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+private:
+    FunctionCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, FunctionCodeBlock& other)
+        : CodeBlock(vm, structure, CopyParsedBlock, other)
+    {
+    }
+
+    FunctionCodeBlock(VM* vm, Structure* structure, FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope,
+        PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
+    {
+    }
+    
+    static void destroy(JSCell*);
+};
+
+} // namespace JSC
diff --git a/bytecode/GetByIdStatus.cpp b/bytecode/GetByIdStatus.cpp
new file mode 100644
index 0000000..a6c458c
--- /dev/null
+++ b/bytecode/GetByIdStatus.cpp
@@ -0,0 +1,432 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GetByIdStatus.h"
+
+#include "CodeBlock.h"
+#include "ComplexGetStatus.h"
+#include "JSCInlines.h"
+#include "JSScope.h"
+#include "LLIntData.h"
+#include "LowLevelInterpreter.h"
+#include "PolymorphicAccess.h"
+#include "StructureStubInfo.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
+
+bool GetByIdStatus::appendVariant(const GetByIdVariant& variant)
+{
+    // Attempt to merge this variant with an already existing variant.
+    for (unsigned i = 0; i < m_variants.size(); ++i) {
+        if (m_variants[i].attemptToMerge(variant))
+            return true;
+    }
+    
+    // Make sure there is no overlap. We should have pruned out opportunities for
+    // overlap but it's possible that an inline cache got into a weird state. We are
+    // defensive and bail if we detect crazy.
+    for (unsigned i = 0; i < m_variants.size(); ++i) {
+        if (m_variants[i].structureSet().overlaps(variant.structureSet()))
+            return false;
+    }
+    
+    m_variants.append(variant);
+    return true;
+}
+
+#if ENABLE(DFG_JIT)
+bool GetByIdStatus::hasExitSite(const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, unsigned bytecodeIndex)
+{
+    return profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadCache))
+        || profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadConstantCache));
+}
+#endif
+
+GetByIdStatus GetByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex, UniquedStringImpl* uid)
+{
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+    UNUSED_PARAM(uid);
+
+    VM& vm = *profiledBlock->vm();
+    
+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
+
+    Opcode opcode = instruction[0].u.opcode;
+
+    ASSERT(opcode == LLInt::getOpcode(op_get_array_length) || opcode == LLInt::getOpcode(op_try_get_by_id) || opcode == LLInt::getOpcode(op_get_by_id_proto_load) || opcode == LLInt::getOpcode(op_get_by_id) || opcode == LLInt::getOpcode(op_get_by_id_unset));
+
+    // FIXME: We should not just bail if we see a try_get_by_id or a get_by_id_proto_load.
+    // https://bugs.webkit.org/show_bug.cgi?id=158039
+    if (opcode != LLInt::getOpcode(op_get_by_id))
+        return GetByIdStatus(NoInformation, false);
+
+    StructureID structureID = instruction[4].u.structureID;
+    if (!structureID)
+        return GetByIdStatus(NoInformation, false);
+
+    Structure* structure = vm.heap.structureIDTable().get(structureID);
+
+    if (structure->takesSlowPathInDFGForImpureProperty())
+        return GetByIdStatus(NoInformation, false);
+
+    unsigned attributes;
+    PropertyOffset offset = structure->getConcurrently(uid, attributes);
+    if (!isValidOffset(offset))
+        return GetByIdStatus(NoInformation, false);
+    if (attributes & CustomAccessor)
+        return GetByIdStatus(NoInformation, false);
+    
+    return GetByIdStatus(Simple, false, GetByIdVariant(StructureSet(structure), offset));
+}
+
+GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, StubInfoMap& map, unsigned bytecodeIndex, UniquedStringImpl* uid)
+{
+    ConcurrentJSLocker locker(profiledBlock->m_lock);
+
+    GetByIdStatus result;
+
+#if ENABLE(DFG_JIT)
+    result = computeForStubInfoWithoutExitSiteFeedback(
+        locker, profiledBlock, map.get(CodeOrigin(bytecodeIndex)), uid,
+        CallLinkStatus::computeExitSiteData(locker, profiledBlock, bytecodeIndex));
+    
+    if (!result.takesSlowPath()
+        && hasExitSite(locker, profiledBlock, bytecodeIndex))
+        return GetByIdStatus(result.makesCalls() ? MakesCalls : TakesSlowPath, true);
+#else
+    UNUSED_PARAM(map);
+#endif
+
+    if (!result)
+        return computeFromLLInt(profiledBlock, bytecodeIndex, uid);
+    
+    return result;
+}
+
+#if ENABLE(DFG_JIT)
+GetByIdStatus GetByIdStatus::computeForStubInfo(const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, CodeOrigin codeOrigin, UniquedStringImpl* uid)
+{
+    GetByIdStatus result = GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback(
+        locker, profiledBlock, stubInfo, uid,
+        CallLinkStatus::computeExitSiteData(locker, profiledBlock, codeOrigin.bytecodeIndex));
+
+    if (!result.takesSlowPath() && GetByIdStatus::hasExitSite(locker, profiledBlock, codeOrigin.bytecodeIndex))
+        return GetByIdStatus(result.makesCalls() ? GetByIdStatus::MakesCalls : GetByIdStatus::TakesSlowPath, true);
+    return result;
+}
+#endif // ENABLE(DFG_JIT)
+
+#if ENABLE(JIT)
+GetByIdStatus GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback(
+    const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, UniquedStringImpl* uid,
+    CallLinkStatus::ExitSiteData callExitSiteData)
+{
+    if (!stubInfo || !stubInfo->everConsidered)
+        return GetByIdStatus(NoInformation);
+
+    PolymorphicAccess* list = 0;
+    State slowPathState = TakesSlowPath;
+    if (stubInfo->cacheType == CacheType::Stub) {
+        list = stubInfo->u.stub;
+        for (unsigned i = 0; i < list->size(); ++i) {
+            const AccessCase& access = list->at(i);
+            if (access.doesCalls())
+                slowPathState = MakesCalls;
+        }
+    }
+    
+    if (stubInfo->tookSlowPath)
+        return GetByIdStatus(slowPathState);
+    
+    // Finally figure out if we can derive an access strategy.
+    GetByIdStatus result;
+    result.m_state = Simple;
+    result.m_wasSeenInJIT = true; // This is interesting for bytecode dumping only.
+    switch (stubInfo->cacheType) {
+    case CacheType::Unset:
+        return GetByIdStatus(NoInformation);
+        
+    case CacheType::GetByIdSelf: {
+        Structure* structure = stubInfo->u.byIdSelf.baseObjectStructure.get();
+        if (structure->takesSlowPathInDFGForImpureProperty())
+            return GetByIdStatus(slowPathState, true);
+        unsigned attributes;
+        GetByIdVariant variant;
+        variant.m_offset = structure->getConcurrently(uid, attributes);
+        if (!isValidOffset(variant.m_offset))
+            return GetByIdStatus(slowPathState, true);
+        if (attributes & CustomAccessor)
+            return GetByIdStatus(slowPathState, true);
+        
+        variant.m_structureSet.add(structure);
+        bool didAppend = result.appendVariant(variant);
+        ASSERT_UNUSED(didAppend, didAppend);
+        return result;
+    }
+        
+    case CacheType::Stub: {
+        for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {
+            const AccessCase& access = list->at(listIndex);
+            if (access.viaProxy())
+                return GetByIdStatus(slowPathState, true);
+            
+            Structure* structure = access.structure();
+            if (!structure) {
+                // The null structure cases arise due to array.length and string.length. We have no way
+                // of creating a GetByIdVariant for those, and we don't really have to since the DFG
+                // handles those cases in FixupPhase using value profiling. That's a bit awkward - we
+                // shouldn't have to use value profiling to discover something that the AccessCase
+                // could have told us. But, it works well enough. So, our only concern here is to not
+                // crash on null structure.
+                return GetByIdStatus(slowPathState, true);
+            }
+            
+            ComplexGetStatus complexGetStatus = ComplexGetStatus::computeFor(
+                structure, access.conditionSet(), uid);
+             
+            switch (complexGetStatus.kind()) {
+            case ComplexGetStatus::ShouldSkip:
+                continue;
+                 
+            case ComplexGetStatus::TakesSlowPath:
+                return GetByIdStatus(slowPathState, true);
+                 
+            case ComplexGetStatus::Inlineable: {
+                std::unique_ptr<CallLinkStatus> callLinkStatus;
+                JSFunction* intrinsicFunction = nullptr;
+                DOMJIT::GetterSetter* domJIT = nullptr;
+
+                switch (access.type()) {
+                case AccessCase::Load:
+                case AccessCase::GetGetter:
+                case AccessCase::Miss: {
+                    break;
+                }
+                case AccessCase::IntrinsicGetter: {
+                    intrinsicFunction = access.intrinsicFunction();
+                    break;
+                }
+                case AccessCase::Getter: {
+                    callLinkStatus = std::make_unique<CallLinkStatus>();
+                    if (CallLinkInfo* callLinkInfo = access.callLinkInfo()) {
+                        *callLinkStatus = CallLinkStatus::computeFor(
+                            locker, profiledBlock, *callLinkInfo, callExitSiteData);
+                    }
+                    break;
+                }
+                case AccessCase::CustomAccessorGetter: {
+                    domJIT = access.domJIT();
+                    if (!domJIT)
+                        return GetByIdStatus(slowPathState, true);
+                    result.m_state = Custom;
+                    break;
+                }
+                default: {
+                    // FIXME: It would be totally sweet to support more of these at some point in the
+                    // future. https://bugs.webkit.org/show_bug.cgi?id=133052
+                    return GetByIdStatus(slowPathState, true);
+                } }
+
+                ASSERT((AccessCase::Miss == access.type()) == (access.offset() == invalidOffset));
+                GetByIdVariant variant(
+                    StructureSet(structure), complexGetStatus.offset(),
+                    complexGetStatus.conditionSet(), WTFMove(callLinkStatus),
+                    intrinsicFunction,
+                    domJIT);
+
+                if (!result.appendVariant(variant))
+                    return GetByIdStatus(slowPathState, true);
+
+                if (domJIT) {
+                    // Give up when cutom accesses are not merged into one.
+                    if (result.numVariants() != 1)
+                        return GetByIdStatus(slowPathState, true);
+                } else {
+                    // Give up when custom access and simple access are mixed.
+                    if (result.m_state == Custom)
+                        return GetByIdStatus(slowPathState, true);
+                }
+                break;
+            } }
+        }
+        
+        return result;
+    }
+        
+    default:
+        return GetByIdStatus(slowPathState, true);
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return GetByIdStatus();
+}
+#endif // ENABLE(JIT)
+
+GetByIdStatus GetByIdStatus::computeFor(
+    CodeBlock* profiledBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap,
+    StubInfoMap& dfgMap, CodeOrigin codeOrigin, UniquedStringImpl* uid)
+{
+#if ENABLE(DFG_JIT)
+    if (dfgBlock) {
+        CallLinkStatus::ExitSiteData exitSiteData;
+        {
+            ConcurrentJSLocker locker(profiledBlock->m_lock);
+            exitSiteData = CallLinkStatus::computeExitSiteData(
+                locker, profiledBlock, codeOrigin.bytecodeIndex);
+        }
+        
+        GetByIdStatus result;
+        {
+            ConcurrentJSLocker locker(dfgBlock->m_lock);
+            result = computeForStubInfoWithoutExitSiteFeedback(
+                locker, dfgBlock, dfgMap.get(codeOrigin), uid, exitSiteData);
+        }
+
+        if (result.takesSlowPath())
+            return result;
+    
+        {
+            ConcurrentJSLocker locker(profiledBlock->m_lock);
+            if (hasExitSite(locker, profiledBlock, codeOrigin.bytecodeIndex))
+                return GetByIdStatus(TakesSlowPath, true);
+        }
+        
+        if (result.isSet())
+            return result;
+    }
+#else
+    UNUSED_PARAM(dfgBlock);
+    UNUSED_PARAM(dfgMap);
+#endif
+
+    return computeFor(profiledBlock, baselineMap, codeOrigin.bytecodeIndex, uid);
+}
+
+GetByIdStatus GetByIdStatus::computeFor(const StructureSet& set, UniquedStringImpl* uid)
+{
+    // For now we only handle the super simple self access case. We could handle the
+    // prototype case in the future.
+    
+    if (set.isEmpty())
+        return GetByIdStatus();
+
+    if (parseIndex(*uid))
+        return GetByIdStatus(TakesSlowPath);
+    
+    GetByIdStatus result;
+    result.m_state = Simple;
+    result.m_wasSeenInJIT = false;
+    for (unsigned i = 0; i < set.size(); ++i) {
+        Structure* structure = set[i];
+        if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
+            return GetByIdStatus(TakesSlowPath);
+        
+        if (!structure->propertyAccessesAreCacheable())
+            return GetByIdStatus(TakesSlowPath);
+        
+        unsigned attributes;
+        PropertyOffset offset = structure->getConcurrently(uid, attributes);
+        if (!isValidOffset(offset))
+            return GetByIdStatus(TakesSlowPath); // It's probably a prototype lookup. Give up on life for now, even though we could totally be way smarter about it.
+        if (attributes & Accessor)
+            return GetByIdStatus(MakesCalls); // We could be smarter here, like strength-reducing this to a Call.
+        if (attributes & CustomAccessor)
+            return GetByIdStatus(TakesSlowPath);
+        
+        if (!result.appendVariant(GetByIdVariant(structure, offset)))
+            return GetByIdStatus(TakesSlowPath);
+    }
+    
+    return result;
+}
+
+bool GetByIdStatus::makesCalls() const
+{
+    switch (m_state) {
+    case NoInformation:
+    case TakesSlowPath:
+    case Custom:
+        return false;
+    case Simple:
+        for (unsigned i = m_variants.size(); i--;) {
+            if (m_variants[i].callLinkStatus())
+                return true;
+        }
+        return false;
+    case MakesCalls:
+        return true;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+
+    return false;
+}
+
+void GetByIdStatus::filter(const StructureSet& set)
+{
+    if (m_state != Simple)
+        return;
+    
+    // FIXME: We could also filter the variants themselves.
+    
+    m_variants.removeAllMatching(
+        [&] (GetByIdVariant& variant) -> bool {
+            return !variant.structureSet().overlaps(set);
+        });
+    
+    if (m_variants.isEmpty())
+        m_state = NoInformation;
+}
+
+void GetByIdStatus::dump(PrintStream& out) const
+{
+    out.print("(");
+    switch (m_state) {
+    case NoInformation:
+        out.print("NoInformation");
+        break;
+    case Simple:
+        out.print("Simple");
+        break;
+    case Custom:
+        out.print("Custom");
+        break;
+    case TakesSlowPath:
+        out.print("TakesSlowPath");
+        break;
+    case MakesCalls:
+        out.print("MakesCalls");
+        break;
+    }
+    out.print(", ", listDump(m_variants), ", seenInJIT = ", m_wasSeenInJIT, ")");
+}
+
+} // namespace JSC
+
diff --git a/bytecode/GetByIdStatus.h b/bytecode/GetByIdStatus.h
new file mode 100644
index 0000000..e8aad89
--- /dev/null
+++ b/bytecode/GetByIdStatus.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallLinkStatus.h"
+#include "CodeOrigin.h"
+#include "ConcurrentJSLock.h"
+#include "ExitingJITType.h"
+#include "GetByIdVariant.h"
+
+namespace JSC {
+
+class CodeBlock;
+class StructureStubInfo;
+
+typedef HashMap<CodeOrigin, StructureStubInfo*, CodeOriginApproximateHash> StubInfoMap;
+
+class GetByIdStatus {
+public:
+    enum State {
+        NoInformation,  // It's uncached so we have no information.
+        Simple,         // It's cached for a simple access to a known object property with
+                        // a possible structure chain and a possible specific value.
+        Custom,         // It's cached for a custom accessor with a possible structure chain.
+        TakesSlowPath,  // It's known to often take slow path.
+        MakesCalls      // It's known to take paths that make calls.
+    };
+
+    GetByIdStatus()
+        : m_state(NoInformation)
+    {
+    }
+    
+    explicit GetByIdStatus(State state)
+        : m_state(state)
+    {
+        ASSERT(state == NoInformation || state == TakesSlowPath || state == MakesCalls);
+    }
+    
+    GetByIdStatus(
+        State state, bool wasSeenInJIT, const GetByIdVariant& variant = GetByIdVariant())
+        : m_state(state)
+        , m_wasSeenInJIT(wasSeenInJIT)
+    {
+        ASSERT((state == Simple || state == Custom) == variant.isSet());
+        m_variants.append(variant);
+    }
+    
+    static GetByIdStatus computeFor(CodeBlock*, StubInfoMap&, unsigned bytecodeIndex, UniquedStringImpl* uid);
+    static GetByIdStatus computeFor(const StructureSet&, UniquedStringImpl* uid);
+    
+    static GetByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin, UniquedStringImpl* uid);
+
+#if ENABLE(DFG_JIT)
+    static GetByIdStatus computeForStubInfo(const ConcurrentJSLocker&, CodeBlock* baselineBlock, StructureStubInfo*, CodeOrigin, UniquedStringImpl* uid);
+#endif
+
+    State state() const { return m_state; }
+    
+    bool isSet() const { return m_state != NoInformation; }
+    bool operator!() const { return !isSet(); }
+    bool isSimple() const { return m_state == Simple; }
+    bool isCustom() const { return m_state == Custom; }
+
+    size_t numVariants() const { return m_variants.size(); }
+    const Vector<GetByIdVariant, 1>& variants() const { return m_variants; }
+    const GetByIdVariant& at(size_t index) const { return m_variants[index]; }
+    const GetByIdVariant& operator[](size_t index) const { return at(index); }
+
+    bool takesSlowPath() const { return m_state == TakesSlowPath || m_state == MakesCalls || m_state == Custom; }
+    bool makesCalls() const;
+    
+    bool wasSeenInJIT() const { return m_wasSeenInJIT; }
+    
+    // Attempts to reduce the set of variants to fit the given structure set. This may be approximate.
+    void filter(const StructureSet&);
+    
+    void dump(PrintStream&) const;
+    
+private:
+#if ENABLE(DFG_JIT)
+    static bool hasExitSite(const ConcurrentJSLocker&, CodeBlock*, unsigned bytecodeIndex);
+#endif
+#if ENABLE(JIT)
+    static GetByIdStatus computeForStubInfoWithoutExitSiteFeedback(
+        const ConcurrentJSLocker&, CodeBlock* profiledBlock, StructureStubInfo*,
+        UniquedStringImpl* uid, CallLinkStatus::ExitSiteData);
+#endif
+    static GetByIdStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex, UniquedStringImpl* uid);
+    
+    bool appendVariant(const GetByIdVariant&);
+    
+    State m_state;
+    Vector<GetByIdVariant, 1> m_variants;
+    bool m_wasSeenInJIT;
+};
+
+} // namespace JSC
diff --git a/bytecode/GetByIdVariant.cpp b/bytecode/GetByIdVariant.cpp
new file mode 100644
index 0000000..d940b62
--- /dev/null
+++ b/bytecode/GetByIdVariant.cpp
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GetByIdVariant.h"
+
+#include "CallLinkStatus.h"
+#include "JSCInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+GetByIdVariant::GetByIdVariant(
+    const StructureSet& structureSet, PropertyOffset offset,
+    const ObjectPropertyConditionSet& conditionSet,
+    std::unique_ptr<CallLinkStatus> callLinkStatus,
+    JSFunction* intrinsicFunction,
+    DOMJIT::GetterSetter* domJIT)
+    : m_structureSet(structureSet)
+    , m_conditionSet(conditionSet)
+    , m_offset(offset)
+    , m_callLinkStatus(WTFMove(callLinkStatus))
+    , m_intrinsicFunction(intrinsicFunction)
+    , m_domJIT(domJIT)
+{
+    if (!structureSet.size()) {
+        ASSERT(offset == invalidOffset);
+        ASSERT(conditionSet.isEmpty());
+    }
+    if (intrinsicFunction)
+        ASSERT(intrinsic() != NoIntrinsic);
+}
+                     
+GetByIdVariant::~GetByIdVariant() { }
+
+GetByIdVariant::GetByIdVariant(const GetByIdVariant& other)
+    : GetByIdVariant()
+{
+    *this = other;
+}
+
+GetByIdVariant& GetByIdVariant::operator=(const GetByIdVariant& other)
+{
+    m_structureSet = other.m_structureSet;
+    m_conditionSet = other.m_conditionSet;
+    m_offset = other.m_offset;
+    m_intrinsicFunction = other.m_intrinsicFunction;
+    m_domJIT = other.m_domJIT;
+    if (other.m_callLinkStatus)
+        m_callLinkStatus = std::make_unique<CallLinkStatus>(*other.m_callLinkStatus);
+    else
+        m_callLinkStatus = nullptr;
+    return *this;
+}
+
+inline bool GetByIdVariant::canMergeIntrinsicStructures(const GetByIdVariant& other) const
+{
+    if (m_intrinsicFunction != other.m_intrinsicFunction)
+        return false;
+    switch (intrinsic()) {
+    case TypedArrayByteLengthIntrinsic: {
+        // We can merge these sets as long as the element size of the two sets is the same.
+        TypedArrayType thisType = (*m_structureSet.begin())->classInfo()->typedArrayStorageType;
+        TypedArrayType otherType = (*other.m_structureSet.begin())->classInfo()->typedArrayStorageType;
+
+        ASSERT(isTypedView(thisType) && isTypedView(otherType));
+
+        return logElementSize(thisType) == logElementSize(otherType);
+    }
+
+    default:
+        return true;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool GetByIdVariant::attemptToMerge(const GetByIdVariant& other)
+{
+    if (m_offset != other.m_offset)
+        return false;
+    if (m_callLinkStatus || other.m_callLinkStatus)
+        return false;
+
+    if (!canMergeIntrinsicStructures(other))
+        return false;
+
+    if (m_domJIT != other.m_domJIT)
+        return false;
+
+    if (m_conditionSet.isEmpty() != other.m_conditionSet.isEmpty())
+        return false;
+    
+    ObjectPropertyConditionSet mergedConditionSet;
+    if (!m_conditionSet.isEmpty()) {
+        mergedConditionSet = m_conditionSet.mergedWith(other.m_conditionSet);
+        if (!mergedConditionSet.isValid() || !mergedConditionSet.hasOneSlotBaseCondition())
+            return false;
+    }
+    m_conditionSet = mergedConditionSet;
+    
+    m_structureSet.merge(other.m_structureSet);
+    
+    return true;
+}
+
+void GetByIdVariant::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+void GetByIdVariant::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    if (!isSet()) {
+        out.print("<empty>");
+        return;
+    }
+    
+    out.print(
+        "<", inContext(structureSet(), context), ", ", inContext(m_conditionSet, context));
+    out.print(", offset = ", offset());
+    if (m_callLinkStatus)
+        out.print(", call = ", *m_callLinkStatus);
+    if (m_intrinsicFunction)
+        out.print(", intrinsic = ", *m_intrinsicFunction);
+    if (m_domJIT)
+        out.print(", domjit = ", RawPointer(m_domJIT));
+    out.print(">");
+}
+
+} // namespace JSC
+
diff --git a/bytecode/GetByIdVariant.h b/bytecode/GetByIdVariant.h
new file mode 100644
index 0000000..8ded248
--- /dev/null
+++ b/bytecode/GetByIdVariant.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallLinkStatus.h"
+#include "JSCJSValue.h"
+#include "ObjectPropertyConditionSet.h"
+#include "PropertyOffset.h"
+#include "StructureSet.h"
+
+namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
+
+class CallLinkStatus;
+class GetByIdStatus;
+struct DumpContext;
+
+class GetByIdVariant {
+public:
+    GetByIdVariant(
+        const StructureSet& structureSet = StructureSet(), PropertyOffset offset = invalidOffset,
+        const ObjectPropertyConditionSet& = ObjectPropertyConditionSet(),
+        std::unique_ptr<CallLinkStatus> = nullptr,
+        JSFunction* = nullptr,
+        DOMJIT::GetterSetter* = nullptr);
+
+    ~GetByIdVariant();
+    
+    GetByIdVariant(const GetByIdVariant&);
+    GetByIdVariant& operator=(const GetByIdVariant&);
+    
+    bool isSet() const { return !!m_structureSet.size(); }
+    bool operator!() const { return !isSet(); }
+    const StructureSet& structureSet() const { return m_structureSet; }
+    StructureSet& structureSet() { return m_structureSet; }
+
+    // A non-empty condition set means that this is a prototype load.
+    const ObjectPropertyConditionSet& conditionSet() const { return m_conditionSet; }
+    
+    PropertyOffset offset() const { return m_offset; }
+    CallLinkStatus* callLinkStatus() const { return m_callLinkStatus.get(); }
+    JSFunction* intrinsicFunction() const { return m_intrinsicFunction; }
+    Intrinsic intrinsic() const { return m_intrinsicFunction ? m_intrinsicFunction->intrinsic() : NoIntrinsic; }
+    DOMJIT::GetterSetter* domJIT() const { return m_domJIT; }
+
+    bool isPropertyUnset() const { return offset() == invalidOffset; }
+
+    bool attemptToMerge(const GetByIdVariant& other);
+    
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    
+private:
+    friend class GetByIdStatus;
+
+    bool canMergeIntrinsicStructures(const GetByIdVariant&) const;
+    
+    StructureSet m_structureSet;
+    ObjectPropertyConditionSet m_conditionSet;
+    PropertyOffset m_offset;
+    std::unique_ptr<CallLinkStatus> m_callLinkStatus;
+    JSFunction* m_intrinsicFunction;
+    DOMJIT::GetterSetter* m_domJIT;
+};
+
+} // namespace JSC
diff --git a/bytecode/GlobalCodeBlock.h b/bytecode/GlobalCodeBlock.h
new file mode 100644
index 0000000..9ab2226
--- /dev/null
+++ b/bytecode/GlobalCodeBlock.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2008-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+
+namespace JSC {
+
+// Program code is not marked by any function, so we make the global object
+// responsible for marking it.
+
+class GlobalCodeBlock : public CodeBlock {
+    typedef CodeBlock Base;
+
+protected:
+    GlobalCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, GlobalCodeBlock& other)
+        : CodeBlock(vm, structure, CopyParsedBlock, other)
+    {
+    }
+
+    GlobalCodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
+    {
+    }
+};
+
+} // namespace JSC
diff --git a/bytecode/HandlerInfo.h b/bytecode/HandlerInfo.h
new file mode 100644
index 0000000..0b1bd3b
--- /dev/null
+++ b/bytecode/HandlerInfo.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeLocation.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+enum class HandlerType {
+    Illegal = 0,
+    Catch = 1,
+    Finally = 2,
+    SynthesizedFinally = 3
+};
+
+enum class RequiredHandler {
+    CatchHandler,
+    AnyHandler
+};
+
+struct HandlerInfoBase {
+    HandlerType type() const { return static_cast<HandlerType>(typeBits); }
+    void setType(HandlerType type) { typeBits = static_cast<uint32_t>(type); }
+
+    const char* typeName()
+    {
+        switch (type()) {
+        case HandlerType::Catch:
+            return "catch";
+        case HandlerType::Finally:
+            return "finally";
+        case HandlerType::SynthesizedFinally:
+            return "synthesized finally";
+        default:
+            ASSERT_NOT_REACHED();
+        }
+        return nullptr;
+    }
+
+    bool isCatchHandler() const { return type() == HandlerType::Catch; }
+
+    template<typename Handler>
+    static Handler* handlerForIndex(Vector<Handler>& exeptionHandlers, unsigned index, RequiredHandler requiredHandler)
+    {
+        for (Handler& handler : exeptionHandlers) {
+            if ((requiredHandler == RequiredHandler::CatchHandler) && !handler.isCatchHandler())
+                continue;
+
+            // Handlers are ordered innermost first, so the first handler we encounter
+            // that contains the source address is the correct handler to use.
+            // This index used is either the BytecodeOffset or a CallSiteIndex.
+            if (handler.start <= index && handler.end > index)
+                return &handler;
+        }
+
+        return nullptr;
+    }
+
+    uint32_t start;
+    uint32_t end;
+    uint32_t target;
+    uint32_t typeBits : 2; // HandlerType
+};
+
+struct UnlinkedHandlerInfo : public HandlerInfoBase {
+    UnlinkedHandlerInfo(uint32_t start, uint32_t end, uint32_t target, HandlerType handlerType)
+    {
+        this->start = start;
+        this->end = end;
+        this->target = target;
+        setType(handlerType);
+        ASSERT(type() == handlerType);
+    }
+};
+
+struct HandlerInfo : public HandlerInfoBase {
+    void initialize(const UnlinkedHandlerInfo& unlinkedInfo)
+    {
+        start = unlinkedInfo.start;
+        end = unlinkedInfo.end;
+        target = unlinkedInfo.target;
+        typeBits = unlinkedInfo.typeBits;
+    }
+
+#if ENABLE(JIT)
+    void initialize(const UnlinkedHandlerInfo& unlinkedInfo, CodeLocationLabel label)
+    {
+        initialize(unlinkedInfo);
+        nativeCode = label;
+    }
+
+    CodeLocationLabel nativeCode;
+#endif
+};
+
+} // namespace JSC
diff --git a/bytecode/InlineAccess.cpp b/bytecode/InlineAccess.cpp
new file mode 100644
index 0000000..667492a
--- /dev/null
+++ b/bytecode/InlineAccess.cpp
@@ -0,0 +1,299 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "InlineAccess.h"
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "JSArray.h"
+#include "JSCellInlines.h"
+#include "LinkBuffer.h"
+#include "ScratchRegisterAllocator.h"
+#include "Structure.h"
+#include "StructureStubInfo.h"
+#include "VM.h"
+
+namespace JSC {
+
+void InlineAccess::dumpCacheSizesAndCrash(VM& vm)
+{
+    GPRReg base = GPRInfo::regT0;
+    GPRReg value = GPRInfo::regT1;
+#if USE(JSVALUE32_64)
+    JSValueRegs regs(base, value);
+#else
+    JSValueRegs regs(base);
+#endif
+
+    {
+        CCallHelpers jit(&vm);
+
+        GPRReg scratchGPR = value;
+        jit.load8(CCallHelpers::Address(base, JSCell::indexingTypeAndMiscOffset()), value);
+        jit.and32(CCallHelpers::TrustedImm32(IsArray | IndexingShapeMask), value);
+        jit.patchableBranch32(
+            CCallHelpers::NotEqual, value, CCallHelpers::TrustedImm32(IsArray | ContiguousShape));
+        jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value);
+        jit.load32(CCallHelpers::Address(value, ArrayStorage::lengthOffset()), value);
+        jit.boxInt32(scratchGPR, regs);
+
+        dataLog("array length size: ", jit.m_assembler.buffer().codeSize(), "\n");
+    }
+
+    {
+        CCallHelpers jit(&vm);
+
+        jit.patchableBranch32(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(base, JSCell::structureIDOffset()),
+            MacroAssembler::TrustedImm32(0x000ab21ca));
+        jit.loadPtr(
+            CCallHelpers::Address(base, JSObject::butterflyOffset()),
+            value);
+        GPRReg storageGPR = value;
+        jit.loadValue(
+            CCallHelpers::Address(storageGPR, 0x000ab21ca), regs);
+
+        dataLog("out of line offset cache size: ", jit.m_assembler.buffer().codeSize(), "\n");
+    }
+
+    {
+        CCallHelpers jit(&vm);
+
+        jit.patchableBranch32(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(base, JSCell::structureIDOffset()),
+            MacroAssembler::TrustedImm32(0x000ab21ca));
+        jit.loadValue(
+            MacroAssembler::Address(base, 0x000ab21ca), regs);
+
+        dataLog("inline offset cache size: ", jit.m_assembler.buffer().codeSize(), "\n");
+    }
+
+    {
+        CCallHelpers jit(&vm);
+
+        jit.patchableBranch32(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(base, JSCell::structureIDOffset()),
+            MacroAssembler::TrustedImm32(0x000ab21ca));
+
+        jit.storeValue(
+            regs, MacroAssembler::Address(base, 0x000ab21ca));
+
+        dataLog("replace cache size: ", jit.m_assembler.buffer().codeSize(), "\n");
+    }
+
+    {
+        CCallHelpers jit(&vm);
+
+        jit.patchableBranch32(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(base, JSCell::structureIDOffset()),
+            MacroAssembler::TrustedImm32(0x000ab21ca));
+
+        jit.loadPtr(MacroAssembler::Address(base, JSObject::butterflyOffset()), value);
+        jit.storeValue(
+            regs,
+            MacroAssembler::Address(base, 120342));
+
+        dataLog("replace out of line cache size: ", jit.m_assembler.buffer().codeSize(), "\n");
+    }
+
+    CRASH();
+}
+
+
+template <typename Function>
+ALWAYS_INLINE static bool linkCodeInline(const char* name, CCallHelpers& jit, StructureStubInfo& stubInfo, const Function& function)
+{
+    if (jit.m_assembler.buffer().codeSize() <= stubInfo.patch.inlineSize) {
+        bool needsBranchCompaction = false;
+        LinkBuffer linkBuffer(jit, stubInfo.patch.start.dataLocation(), stubInfo.patch.inlineSize, JITCompilationMustSucceed, needsBranchCompaction);
+        ASSERT(linkBuffer.isValid());
+        function(linkBuffer);
+        FINALIZE_CODE(linkBuffer, ("InlineAccessType: '%s'", name));
+        return true;
+    }
+
+    // This is helpful when determining the size for inline ICs on various
+    // platforms. You want to choose a size that usually succeeds, but sometimes
+    // there may be variability in the length of the code we generate just because
+    // of randomness. It's helpful to flip this on when running tests or browsing
+    // the web just to see how often it fails. You don't want an IC size that always fails.
+    const bool failIfCantInline = false;
+    if (failIfCantInline) {
+        dataLog("Failure for: ", name, "\n");
+        dataLog("real size: ", jit.m_assembler.buffer().codeSize(), " inline size:", stubInfo.patch.inlineSize, "\n");
+        CRASH();
+    }
+
+    return false;
+}
+
+bool InlineAccess::generateSelfPropertyAccess(VM& vm, StructureStubInfo& stubInfo, Structure* structure, PropertyOffset offset)
+{
+    CCallHelpers jit(&vm);
+    
+    GPRReg base = static_cast<GPRReg>(stubInfo.patch.baseGPR);
+    JSValueRegs value = stubInfo.valueRegs();
+
+    auto branchToSlowPath = jit.patchableBranch32(
+        MacroAssembler::NotEqual,
+        MacroAssembler::Address(base, JSCell::structureIDOffset()),
+        MacroAssembler::TrustedImm32(bitwise_cast<uint32_t>(structure->id())));
+    GPRReg storage;
+    if (isInlineOffset(offset))
+        storage = base;
+    else {
+        jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value.payloadGPR());
+        storage = value.payloadGPR();
+    }
+    
+    jit.loadValue(
+        MacroAssembler::Address(storage, offsetRelativeToBase(offset)), value);
+
+    bool linkedCodeInline = linkCodeInline("property access", jit, stubInfo, [&] (LinkBuffer& linkBuffer) {
+        linkBuffer.link(branchToSlowPath, stubInfo.slowPathStartLocation());
+    });
+    return linkedCodeInline;
+}
+
+ALWAYS_INLINE static GPRReg getScratchRegister(StructureStubInfo& stubInfo)
+{
+    ScratchRegisterAllocator allocator(stubInfo.patch.usedRegisters);
+    allocator.lock(static_cast<GPRReg>(stubInfo.patch.baseGPR));
+    allocator.lock(static_cast<GPRReg>(stubInfo.patch.valueGPR));
+#if USE(JSVALUE32_64)
+    allocator.lock(static_cast<GPRReg>(stubInfo.patch.baseTagGPR));
+    allocator.lock(static_cast<GPRReg>(stubInfo.patch.valueTagGPR));
+#endif
+    GPRReg scratch = allocator.allocateScratchGPR();
+    if (allocator.didReuseRegisters())
+        return InvalidGPRReg;
+    return scratch;
+}
+
+ALWAYS_INLINE static bool hasFreeRegister(StructureStubInfo& stubInfo)
+{
+    return getScratchRegister(stubInfo) != InvalidGPRReg;
+}
+
+bool InlineAccess::canGenerateSelfPropertyReplace(StructureStubInfo& stubInfo, PropertyOffset offset)
+{
+    if (isInlineOffset(offset))
+        return true;
+
+    return hasFreeRegister(stubInfo);
+}
+
+bool InlineAccess::generateSelfPropertyReplace(VM& vm, StructureStubInfo& stubInfo, Structure* structure, PropertyOffset offset)
+{
+    ASSERT(canGenerateSelfPropertyReplace(stubInfo, offset));
+
+    CCallHelpers jit(&vm);
+
+    GPRReg base = static_cast<GPRReg>(stubInfo.patch.baseGPR);
+    JSValueRegs value = stubInfo.valueRegs();
+
+    auto branchToSlowPath = jit.patchableBranch32(
+        MacroAssembler::NotEqual,
+        MacroAssembler::Address(base, JSCell::structureIDOffset()),
+        MacroAssembler::TrustedImm32(bitwise_cast<uint32_t>(structure->id())));
+
+    GPRReg storage;
+    if (isInlineOffset(offset))
+        storage = base;
+    else {
+        storage = getScratchRegister(stubInfo);
+        ASSERT(storage != InvalidGPRReg);
+        jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), storage);
+    }
+
+    jit.storeValue(
+        value, MacroAssembler::Address(storage, offsetRelativeToBase(offset)));
+
+    bool linkedCodeInline = linkCodeInline("property replace", jit, stubInfo, [&] (LinkBuffer& linkBuffer) {
+        linkBuffer.link(branchToSlowPath, stubInfo.slowPathStartLocation());
+    });
+    return linkedCodeInline;
+}
+
+bool InlineAccess::isCacheableArrayLength(StructureStubInfo& stubInfo, JSArray* array)
+{
+    ASSERT(array->indexingType() & IsArray);
+
+    if (!hasFreeRegister(stubInfo))
+        return false;
+
+    return array->indexingType() == ArrayWithInt32
+        || array->indexingType() == ArrayWithDouble
+        || array->indexingType() == ArrayWithContiguous;
+}
+
+bool InlineAccess::generateArrayLength(VM& vm, StructureStubInfo& stubInfo, JSArray* array)
+{
+    ASSERT(isCacheableArrayLength(stubInfo, array));
+
+    CCallHelpers jit(&vm);
+
+    GPRReg base = static_cast<GPRReg>(stubInfo.patch.baseGPR);
+    JSValueRegs value = stubInfo.valueRegs();
+    GPRReg scratch = getScratchRegister(stubInfo);
+
+    jit.load8(CCallHelpers::Address(base, JSCell::indexingTypeAndMiscOffset()), scratch);
+    jit.and32(CCallHelpers::TrustedImm32(IsArray | IndexingShapeMask), scratch);
+    auto branchToSlowPath = jit.patchableBranch32(
+        CCallHelpers::NotEqual, scratch, CCallHelpers::TrustedImm32(array->indexingType()));
+    jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value.payloadGPR());
+    jit.load32(CCallHelpers::Address(value.payloadGPR(), ArrayStorage::lengthOffset()), value.payloadGPR());
+    jit.boxInt32(value.payloadGPR(), value);
+
+    bool linkedCodeInline = linkCodeInline("array length", jit, stubInfo, [&] (LinkBuffer& linkBuffer) {
+        linkBuffer.link(branchToSlowPath, stubInfo.slowPathStartLocation());
+    });
+    return linkedCodeInline;
+}
+
+void InlineAccess::rewireStubAsJump(VM& vm, StructureStubInfo& stubInfo, CodeLocationLabel target)
+{
+    CCallHelpers jit(&vm);
+
+    auto jump = jit.jump();
+
+    // We don't need a nop sled here because nobody should be jumping into the middle of an IC.
+    bool needsBranchCompaction = false;
+    LinkBuffer linkBuffer(jit, stubInfo.patch.start.dataLocation(), jit.m_assembler.buffer().codeSize(), JITCompilationMustSucceed, needsBranchCompaction);
+    RELEASE_ASSERT(linkBuffer.isValid());
+    linkBuffer.link(jump, target);
+
+    FINALIZE_CODE(linkBuffer, ("InlineAccess: linking constant jump"));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/bytecode/InlineAccess.h b/bytecode/InlineAccess.h
new file mode 100644
index 0000000..3910c5b
--- /dev/null
+++ b/bytecode/InlineAccess.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CodeLocation.h"
+#include "PropertyOffset.h"
+
+namespace JSC {
+
+class JSArray;
+class Structure;
+class StructureStubInfo;
+class VM;
+
+class InlineAccess {
+public:
+
+    // This is the maximum between inline and out of line self access cases.
+    static constexpr size_t sizeForPropertyAccess()
+    {
+#if CPU(X86_64)
+        return 23;
+#elif CPU(X86)
+        return 27;
+#elif CPU(ARM64)
+        return 40;
+#elif CPU(ARM)
+#if CPU(ARM_THUMB2)
+        return 48;
+#else
+        return 52;
+#endif
+#else
+#error "unsupported platform"
+#endif
+    }
+
+    // This is the maximum between inline and out of line property replace cases.
+    static constexpr size_t sizeForPropertyReplace()
+    {
+#if CPU(X86_64)
+        return 23;
+#elif CPU(X86)
+        return 27;
+#elif CPU(ARM64)
+        return 40;
+#elif CPU(ARM)
+#if CPU(ARM_THUMB2)
+        return 48;
+#else
+        return 48;
+#endif
+#else
+#error "unsupported platform"
+#endif
+    }
+
+    // FIXME: Make this constexpr when GCC is able to compile std::max() inside a constexpr function.
+    // https://bugs.webkit.org/show_bug.cgi?id=159436
+    //
+    // This is the maximum between the size for array length access, and the size for regular self access.
+    ALWAYS_INLINE static size_t sizeForLengthAccess()
+    {
+#if CPU(X86_64)
+        size_t size = 26;
+#elif CPU(X86)
+        size_t size = 27;
+#elif CPU(ARM64)
+        size_t size = 32;
+#elif CPU(ARM)
+#if CPU(ARM_THUMB2)
+        size_t size = 30;
+#else
+        size_t size = 32;
+#endif
+#else
+#error "unsupported platform"
+#endif
+        return std::max(size, sizeForPropertyAccess());
+    }
+
+    static bool generateSelfPropertyAccess(VM&, StructureStubInfo&, Structure*, PropertyOffset);
+    static bool canGenerateSelfPropertyReplace(StructureStubInfo&, PropertyOffset);
+    static bool generateSelfPropertyReplace(VM&, StructureStubInfo&, Structure*, PropertyOffset);
+    static bool isCacheableArrayLength(StructureStubInfo&, JSArray*);
+    static bool generateArrayLength(VM&, StructureStubInfo&, JSArray*);
+    static void rewireStubAsJump(VM&, StructureStubInfo&, CodeLocationLabel);
+
+    // This is helpful when determining the size of an IC on
+    // various platforms. When adding a new type of IC, implement
+    // its placeholder code here, and log the size. That way we
+    // can intelligently choose sizes on various platforms.
+    NO_RETURN_DUE_TO_CRASH static void dumpCacheSizesAndCrash(VM&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/bytecode/InlineCallFrame.cpp b/bytecode/InlineCallFrame.cpp
new file mode 100644
index 0000000..97ce84d
--- /dev/null
+++ b/bytecode/InlineCallFrame.cpp
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "InlineCallFrame.h"
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+JSFunction* InlineCallFrame::calleeConstant() const
+{
+    if (calleeRecovery.isConstant())
+        return jsCast<JSFunction*>(calleeRecovery.constant());
+    return nullptr;
+}
+
+JSFunction* InlineCallFrame::calleeForCallFrame(ExecState* exec) const
+{
+    return jsCast<JSFunction*>(calleeRecovery.recover(exec));
+}
+
+CodeBlockHash InlineCallFrame::hash() const
+{
+    return baselineCodeBlock->hash();
+}
+
+CString InlineCallFrame::hashAsStringIfPossible() const
+{
+    return baselineCodeBlock->hashAsStringIfPossible();
+}
+
+CString InlineCallFrame::inferredName() const
+{
+    return jsCast<FunctionExecutable*>(baselineCodeBlock->ownerExecutable())->inferredName().utf8();
+}
+
+void InlineCallFrame::dumpBriefFunctionInformation(PrintStream& out) const
+{
+    out.print(inferredName(), "#", hashAsStringIfPossible());
+}
+
+void InlineCallFrame::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    out.print(briefFunctionInformation(), ":<", RawPointer(baselineCodeBlock.get()));
+    if (isStrictMode())
+        out.print(" (StrictMode)");
+    out.print(", bc#", directCaller.bytecodeIndex, ", ", static_cast<Kind>(kind));
+    if (isClosureCall)
+        out.print(", closure call");
+    else
+        out.print(", known callee: ", inContext(calleeRecovery.constant(), context));
+    out.print(", numArgs+this = ", arguments.size());
+    out.print(", stackOffset = ", stackOffset);
+    out.print(" (", virtualRegisterForLocal(0), " maps to ", virtualRegisterForLocal(0) + stackOffset, ")>");
+}
+
+void InlineCallFrame::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::InlineCallFrame::Kind kind)
+{
+    switch (kind) {
+    case JSC::InlineCallFrame::Call:
+        out.print("Call");
+        return;
+    case JSC::InlineCallFrame::Construct:
+        out.print("Construct");
+        return;
+    case JSC::InlineCallFrame::TailCall:
+        out.print("TailCall");
+        return;
+    case JSC::InlineCallFrame::CallVarargs:
+        out.print("CallVarargs");
+        return;
+    case JSC::InlineCallFrame::ConstructVarargs:
+        out.print("ConstructVarargs");
+        return;
+    case JSC::InlineCallFrame::TailCallVarargs:
+        out.print("TailCallVarargs");
+        return;
+    case JSC::InlineCallFrame::GetterCall:
+        out.print("GetterCall");
+        return;
+    case JSC::InlineCallFrame::SetterCall:
+        out.print("SetterCall");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/bytecode/InlineCallFrame.h b/bytecode/InlineCallFrame.h
new file mode 100644
index 0000000..cd2a5fe
--- /dev/null
+++ b/bytecode/InlineCallFrame.h
@@ -0,0 +1,265 @@
+/*
+ * Copyright (C) 2011-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "CodeBlockHash.h"
+#include "CodeOrigin.h"
+#include "ValueRecovery.h"
+#include "WriteBarrier.h"
+#include <wtf/HashMap.h>
+#include <wtf/PrintStream.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+struct InlineCallFrame;
+class ExecState;
+class JSFunction;
+
+struct InlineCallFrame {
+    enum Kind {
+        Call,
+        Construct,
+        TailCall,
+        CallVarargs,
+        ConstructVarargs,
+        TailCallVarargs,
+        
+        // For these, the stackOffset incorporates the argument count plus the true return PC
+        // slot.
+        GetterCall,
+        SetterCall
+    };
+
+    static CallMode callModeFor(Kind kind)
+    {
+        switch (kind) {
+        case Call:
+        case CallVarargs:
+        case GetterCall:
+        case SetterCall:
+            return CallMode::Regular;
+        case TailCall:
+        case TailCallVarargs:
+            return CallMode::Tail;
+        case Construct:
+        case ConstructVarargs:
+            return CallMode::Construct;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    static Kind kindFor(CallMode callMode)
+    {
+        switch (callMode) {
+        case CallMode::Regular:
+            return Call;
+        case CallMode::Construct:
+            return Construct;
+        case CallMode::Tail:
+            return TailCall;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    static Kind varargsKindFor(CallMode callMode)
+    {
+        switch (callMode) {
+        case CallMode::Regular:
+            return CallVarargs;
+        case CallMode::Construct:
+            return ConstructVarargs;
+        case CallMode::Tail:
+            return TailCallVarargs;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    static CodeSpecializationKind specializationKindFor(Kind kind)
+    {
+        switch (kind) {
+        case Call:
+        case CallVarargs:
+        case TailCall:
+        case TailCallVarargs:
+        case GetterCall:
+        case SetterCall:
+            return CodeForCall;
+        case Construct:
+        case ConstructVarargs:
+            return CodeForConstruct;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    static bool isVarargs(Kind kind)
+    {
+        switch (kind) {
+        case CallVarargs:
+        case TailCallVarargs:
+        case ConstructVarargs:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    static bool isTail(Kind kind)
+    {
+        switch (kind) {
+        case TailCall:
+        case TailCallVarargs:
+            return true;
+        default:
+            return false;
+        }
+    }
+    bool isTail() const
+    {
+        return isTail(static_cast<Kind>(kind));
+    }
+
+    static CodeOrigin* computeCallerSkippingTailCalls(InlineCallFrame* inlineCallFrame, Kind* callerCallKind = nullptr)
+    {
+        CodeOrigin* codeOrigin;
+        bool tailCallee;
+        int callKind;
+        do {
+            tailCallee = inlineCallFrame->isTail();
+            callKind = inlineCallFrame->kind;
+            codeOrigin = &inlineCallFrame->directCaller;
+            inlineCallFrame = codeOrigin->inlineCallFrame;
+        } while (inlineCallFrame && tailCallee);
+
+        if (tailCallee)
+            return nullptr;
+
+        if (callerCallKind)
+            *callerCallKind = static_cast<Kind>(callKind);
+
+        return codeOrigin;
+    }
+
+    CodeOrigin* getCallerSkippingTailCalls(Kind* callerCallKind = nullptr)
+    {
+        return computeCallerSkippingTailCalls(this, callerCallKind);
+    }
+
+    InlineCallFrame* getCallerInlineFrameSkippingTailCalls()
+    {
+        CodeOrigin* caller = getCallerSkippingTailCalls();
+        return caller ? caller->inlineCallFrame : nullptr;
+    }
+    
+    Vector<ValueRecovery> arguments; // Includes 'this'.
+    WriteBarrier<CodeBlock> baselineCodeBlock;
+    ValueRecovery calleeRecovery;
+    CodeOrigin directCaller;
+
+    signed stackOffset : 28;
+    unsigned kind : 3; // real type is Kind
+    bool isClosureCall : 1; // If false then we know that callee/scope are constants and the DFG won't treat them as variables, i.e. they have to be recovered manually.
+    VirtualRegister argumentCountRegister; // Only set when we inline a varargs call.
+    
+    // There is really no good notion of a "default" set of values for
+    // InlineCallFrame's fields. This constructor is here just to reduce confusion if
+    // we forgot to initialize explicitly.
+    InlineCallFrame()
+        : stackOffset(0)
+        , kind(Call)
+        , isClosureCall(false)
+    {
+    }
+    
+    bool isVarargs() const
+    {
+        return isVarargs(static_cast<Kind>(kind));
+    }
+
+    CodeSpecializationKind specializationKind() const { return specializationKindFor(static_cast<Kind>(kind)); }
+
+    JSFunction* calleeConstant() const;
+    
+    // Get the callee given a machine call frame to which this InlineCallFrame belongs.
+    JSFunction* calleeForCallFrame(ExecState*) const;
+    
+    CString inferredName() const;
+    CodeBlockHash hash() const;
+    CString hashAsStringIfPossible() const;
+    
+    void setStackOffset(signed offset)
+    {
+        stackOffset = offset;
+        RELEASE_ASSERT(static_cast<signed>(stackOffset) == offset);
+    }
+
+    ptrdiff_t callerFrameOffset() const { return stackOffset * sizeof(Register) + CallFrame::callerFrameOffset(); }
+    ptrdiff_t returnPCOffset() const { return stackOffset * sizeof(Register) + CallFrame::returnPCOffset(); }
+
+    bool isStrictMode() const { return baselineCodeBlock->isStrictMode(); }
+
+    void dumpBriefFunctionInformation(PrintStream&) const;
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+
+    MAKE_PRINT_METHOD(InlineCallFrame, dumpBriefFunctionInformation, briefFunctionInformation);
+
+};
+
+inline CodeBlock* baselineCodeBlockForInlineCallFrame(InlineCallFrame* inlineCallFrame)
+{
+    RELEASE_ASSERT(inlineCallFrame);
+    return inlineCallFrame->baselineCodeBlock.get();
+}
+
+inline CodeBlock* baselineCodeBlockForOriginAndBaselineCodeBlock(const CodeOrigin& codeOrigin, CodeBlock* baselineCodeBlock)
+{
+    if (codeOrigin.inlineCallFrame)
+        return baselineCodeBlockForInlineCallFrame(codeOrigin.inlineCallFrame);
+    return baselineCodeBlock;
+}
+
+template <typename Function>
+inline void CodeOrigin::walkUpInlineStack(const Function& function)
+{
+    CodeOrigin codeOrigin = *this;
+    while (true) {
+        function(codeOrigin);
+        if (!codeOrigin.inlineCallFrame)
+            break;
+        codeOrigin = codeOrigin.inlineCallFrame->directCaller;
+    }
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::InlineCallFrame::Kind);
+
+} // namespace WTF
diff --git a/bytecode/InlineCallFrameSet.cpp b/bytecode/InlineCallFrameSet.cpp
new file mode 100644
index 0000000..402cfd0
--- /dev/null
+++ b/bytecode/InlineCallFrameSet.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "InlineCallFrameSet.h"
+
+#include "InlineCallFrame.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+InlineCallFrameSet::InlineCallFrameSet() { }
+InlineCallFrameSet::~InlineCallFrameSet() { }
+
+InlineCallFrame* InlineCallFrameSet::add()
+{
+    return m_frames.add();
+}
+
+} // namespace JSC
+
diff --git a/bytecode/InlineCallFrameSet.h b/bytecode/InlineCallFrameSet.h
new file mode 100644
index 0000000..6c61841
--- /dev/null
+++ b/bytecode/InlineCallFrameSet.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeOrigin.h"
+#include <wtf/Bag.h>
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+class InlineCallFrameSet : public RefCounted<InlineCallFrameSet> {
+public:
+    InlineCallFrameSet();
+    ~InlineCallFrameSet();
+    
+    bool isEmpty() const { return m_frames.isEmpty(); }
+    
+    InlineCallFrame* add();
+    
+    typedef Bag<InlineCallFrame>::iterator iterator;
+    iterator begin() { return m_frames.begin(); }
+    iterator end() { return m_frames.end(); }
+
+private:
+    Bag<InlineCallFrame> m_frames;
+};
+
+} // namespace JSC
diff --git a/bytecode/Instruction.h b/bytecode/Instruction.h
new file mode 100644
index 0000000..a86739f
--- /dev/null
+++ b/bytecode/Instruction.h
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2008, 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BasicBlockLocation.h"
+#include "MacroAssembler.h"
+#include "PutByIdFlags.h"
+#include "SymbolTable.h"
+#include "TypeLocation.h"
+#include "PropertySlot.h"
+#include "SpecialPointer.h"
+#include "Structure.h"
+#include "StructureChain.h"
+#include "ToThisStatus.h"
+#include "VirtualRegister.h"
+#include <wtf/VectorTraits.h>
+
+namespace JSC {
+
+class ArrayAllocationProfile;
+class ArrayProfile;
+class ObjectAllocationProfile;
+class WatchpointSet;
+struct LLIntCallLinkInfo;
+struct ValueProfile;
+
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+typedef void* Opcode;
+#else
+typedef OpcodeID Opcode;
+#endif
+
+struct Instruction {
+    Instruction()
+    {
+        u.jsCell.clear();
+    }
+        
+    Instruction(Opcode opcode)
+    {
+#if !ENABLE(COMPUTED_GOTO_OPCODES)
+        // We have to initialize one of the pointer members to ensure that
+        // the entire struct is initialized, when opcode is not a pointer.
+        u.jsCell.clear();
+#endif
+        u.opcode = opcode;
+    }
+
+    Instruction(int operand)
+    {
+        // We have to initialize one of the pointer members to ensure that
+        // the entire struct is initialized in 64-bit.
+        u.jsCell.clear();
+        u.operand = operand;
+    }
+    Instruction(unsigned unsignedValue)
+    {
+        // We have to initialize one of the pointer members to ensure that
+        // the entire struct is initialized in 64-bit.
+        u.jsCell.clear();
+        u.unsignedValue = unsignedValue;
+    }
+
+    Instruction(PutByIdFlags flags)
+    {
+        u.putByIdFlags = flags;
+    }
+
+    Instruction(VM& vm, JSCell* owner, Structure* structure)
+    {
+        u.structure.clear();
+        u.structure.set(vm, owner, structure);
+    }
+    Instruction(VM& vm, JSCell* owner, StructureChain* structureChain)
+    {
+        u.structureChain.clear();
+        u.structureChain.set(vm, owner, structureChain);
+    }
+    Instruction(VM& vm, JSCell* owner, JSCell* jsCell)
+    {
+        u.jsCell.clear();
+        u.jsCell.set(vm, owner, jsCell);
+    }
+
+    Instruction(PropertySlot::GetValueFunc getterFunc) { u.getterFunc = getterFunc; }
+        
+    Instruction(LLIntCallLinkInfo* callLinkInfo) { u.callLinkInfo = callLinkInfo; }
+    Instruction(ValueProfile* profile) { u.profile = profile; }
+    Instruction(ArrayProfile* profile) { u.arrayProfile = profile; }
+    Instruction(ArrayAllocationProfile* profile) { u.arrayAllocationProfile = profile; }
+    Instruction(ObjectAllocationProfile* profile) { u.objectAllocationProfile = profile; }
+    Instruction(WriteBarrier<Unknown>* variablePointer) { u.variablePointer = variablePointer; }
+    Instruction(Special::Pointer pointer) { u.specialPointer = pointer; }
+    Instruction(UniquedStringImpl* uid) { u.uid = uid; }
+    Instruction(bool* predicatePointer) { u.predicatePointer = predicatePointer; }
+
+    union {
+        Opcode opcode;
+        int operand;
+        unsigned unsignedValue;
+        WriteBarrierBase<Structure> structure;
+        StructureID structureID;
+        WriteBarrierBase<SymbolTable> symbolTable;
+        WriteBarrierBase<StructureChain> structureChain;
+        WriteBarrierBase<JSCell> jsCell;
+        WriteBarrier<Unknown>* variablePointer;
+        Special::Pointer specialPointer;
+        PropertySlot::GetValueFunc getterFunc;
+        LLIntCallLinkInfo* callLinkInfo;
+        UniquedStringImpl* uid;
+        ValueProfile* profile;
+        ArrayProfile* arrayProfile;
+        ArrayAllocationProfile* arrayAllocationProfile;
+        ObjectAllocationProfile* objectAllocationProfile;
+        WatchpointSet* watchpointSet;
+        void* pointer;
+        bool* predicatePointer;
+        ToThisStatus toThisStatus;
+        TypeLocation* location;
+        BasicBlockLocation* basicBlockLocation;
+        PutByIdFlags putByIdFlags;
+    } u;
+        
+private:
+    Instruction(StructureChain*);
+    Instruction(Structure*);
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<> struct VectorTraits<JSC::Instruction> : VectorTraitsBase<true, JSC::Instruction> { };
+
+} // namespace WTF
diff --git a/bytecode/InternalFunctionAllocationProfile.h b/bytecode/InternalFunctionAllocationProfile.h
new file mode 100644
index 0000000..a486523
--- /dev/null
+++ b/bytecode/InternalFunctionAllocationProfile.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSGlobalObject.h"
+#include "ObjectPrototype.h"
+#include "SlotVisitor.h"
+#include "WriteBarrier.h"
+
+namespace JSC {
+
+class InternalFunctionAllocationProfile {
+public:
+    Structure* structure() { return m_structure.get(); }
+    Structure* createAllocationStructureFromBase(VM&, JSGlobalObject*, JSCell* owner, JSObject* prototype, Structure* base);
+
+    void clear() { m_structure.clear(); }
+    void visitAggregate(SlotVisitor& visitor) { visitor.append(m_structure); }
+
+private:
+    WriteBarrier<Structure> m_structure;
+};
+
+inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSGlobalObject* globalObject, JSCell* owner, JSObject* prototype, Structure* baseStructure)
+{
+    ASSERT(!m_structure || m_structure.get()->classInfo() != baseStructure->classInfo());
+
+    Structure* structure;
+    if (prototype == baseStructure->storedPrototype())
+        structure = baseStructure;
+    else
+        structure = vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(globalObject, prototype, baseStructure);
+
+    // Ensure that if another thread sees the structure, it will see it properly created.
+    WTF::storeStoreFence();
+
+    m_structure.set(vm, owner, structure);
+    return m_structure.get();
+}
+
+} // namespace JSC
diff --git a/bytecode/JumpTable.cpp b/bytecode/JumpTable.cpp
new file mode 100644
index 0000000..e22ad03
--- /dev/null
+++ b/bytecode/JumpTable.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JumpTable.h"
+
+#include <wtf/text/StringHash.h>
+
+namespace JSC {
+
+int32_t SimpleJumpTable::offsetForValue(int32_t value, int32_t defaultOffset)
+{
+    if (value >= min && static_cast<uint32_t>(value - min) < branchOffsets.size()) {
+        int32_t offset = branchOffsets[value - min];
+        if (offset)
+            return offset;
+    }
+    return defaultOffset;        
+}
+
+} // namespace JSC
diff --git a/bytecode/JumpTable.h b/bytecode/JumpTable.h
new file mode 100644
index 0000000..3335425
--- /dev/null
+++ b/bytecode/JumpTable.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2008, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "MacroAssembler.h"
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringImpl.h>
+
+namespace JSC {
+
+    struct OffsetLocation {
+        int32_t branchOffset;
+#if ENABLE(JIT)
+        CodeLocationLabel ctiOffset;
+#endif
+    };
+
+    struct StringJumpTable {
+        typedef HashMap<RefPtr<StringImpl>, OffsetLocation> StringOffsetTable;
+        StringOffsetTable offsetTable;
+#if ENABLE(JIT)
+        CodeLocationLabel ctiDefault; // FIXME: it should not be necessary to store this.
+#endif
+
+        inline int32_t offsetForValue(StringImpl* value, int32_t defaultOffset)
+        {
+            StringOffsetTable::const_iterator end = offsetTable.end();
+            StringOffsetTable::const_iterator loc = offsetTable.find(value);
+            if (loc == end)
+                return defaultOffset;
+            return loc->value.branchOffset;
+        }
+
+#if ENABLE(JIT)
+        inline CodeLocationLabel ctiForValue(StringImpl* value)
+        {
+            StringOffsetTable::const_iterator end = offsetTable.end();
+            StringOffsetTable::const_iterator loc = offsetTable.find(value);
+            if (loc == end)
+                return ctiDefault;
+            return loc->value.ctiOffset;
+        }
+#endif
+        
+        void clear()
+        {
+            offsetTable.clear();
+        }
+    };
+
+    struct SimpleJumpTable {
+        // FIXME: The two Vectors can be combind into one Vector<OffsetLocation>
+        Vector<int32_t> branchOffsets;
+        int32_t min;
+#if ENABLE(JIT)
+        Vector<CodeLocationLabel> ctiOffsets;
+        CodeLocationLabel ctiDefault;
+#endif
+
+        int32_t offsetForValue(int32_t value, int32_t defaultOffset);
+        void add(int32_t key, int32_t offset)
+        {
+            if (!branchOffsets[key])
+                branchOffsets[key] = offset;
+        }
+
+#if ENABLE(JIT)
+        void ensureCTITable()
+        {
+            ASSERT(ctiOffsets.isEmpty() || ctiOffsets.size() == branchOffsets.size());
+            ctiOffsets.grow(branchOffsets.size());
+        }
+        
+        inline CodeLocationLabel ctiForValue(int32_t value)
+        {
+            if (value >= min && static_cast<uint32_t>(value - min) < ctiOffsets.size())
+                return ctiOffsets[value - min];
+            return ctiDefault;
+        }
+#endif
+        
+        void clear()
+        {
+            branchOffsets.clear();
+#if ENABLE(JIT)
+            ctiOffsets.clear();
+#endif
+        }
+    };
+
+} // namespace JSC
diff --git a/bytecode/LLIntCallLinkInfo.h b/bytecode/LLIntCallLinkInfo.h
new file mode 100644
index 0000000..c2cf4d1
--- /dev/null
+++ b/bytecode/LLIntCallLinkInfo.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSFunction.h"
+#include "MacroAssemblerCodeRef.h"
+#include <wtf/SentinelLinkedList.h>
+
+namespace JSC {
+
+struct Instruction;
+
+struct LLIntCallLinkInfo : public BasicRawSentinelNode<LLIntCallLinkInfo> {
+    LLIntCallLinkInfo()
+    {
+    }
+    
+    ~LLIntCallLinkInfo()
+    {
+        if (isOnList())
+            remove();
+    }
+    
+    bool isLinked() { return !!callee; }
+    
+    void unlink()
+    {
+        callee.clear();
+        machineCodeTarget = MacroAssemblerCodePtr();
+        if (isOnList())
+            remove();
+    }
+    
+    WriteBarrier<JSFunction> callee;
+    WriteBarrier<JSFunction> lastSeenCallee;
+    MacroAssemblerCodePtr machineCodeTarget;
+};
+
+} // namespace JSC
diff --git a/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp b/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
new file mode 100644
index 0000000..9a5ac01
--- /dev/null
+++ b/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
+
+#include "CodeBlock.h"
+#include "Instruction.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+LLIntPrototypeLoadAdaptiveStructureWatchpoint::LLIntPrototypeLoadAdaptiveStructureWatchpoint(const ObjectPropertyCondition& key, Instruction* getByIdInstruction)
+    : m_key(key)
+    , m_getByIdInstruction(getByIdInstruction)
+{
+    RELEASE_ASSERT(key.watchingRequiresStructureTransitionWatchpoint());
+    RELEASE_ASSERT(!key.watchingRequiresReplacementWatchpoint());
+}
+
+void LLIntPrototypeLoadAdaptiveStructureWatchpoint::install()
+{
+    RELEASE_ASSERT(m_key.isWatchable());
+
+    m_key.object()->structure()->addTransitionWatchpoint(this);
+}
+
+void LLIntPrototypeLoadAdaptiveStructureWatchpoint::fireInternal(const FireDetail& detail)
+{
+    if (m_key.isWatchable(PropertyCondition::EnsureWatchability)) {
+        install();
+        return;
+    }
+
+    StringPrintStream out;
+    out.print("ObjectToStringValue Adaptation of ", m_key, " failed: ", detail);
+
+    StringFireDetail stringDetail(out.toCString().data());
+
+    CodeBlock::clearLLIntGetByIdCache(m_getByIdInstruction);
+}
+
+} // namespace JSC
diff --git a/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h b/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h
new file mode 100644
index 0000000..8a73c6c
--- /dev/null
+++ b/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Instruction.h"
+#include "ObjectPropertyCondition.h"
+#include "Watchpoint.h"
+
+namespace JSC {
+
+class LLIntPrototypeLoadAdaptiveStructureWatchpoint : public Watchpoint {
+public:
+    LLIntPrototypeLoadAdaptiveStructureWatchpoint(const ObjectPropertyCondition&, Instruction*);
+
+    void install();
+
+protected:
+    void fireInternal(const FireDetail&) override;
+
+private:
+    ObjectPropertyCondition m_key;
+    Instruction* m_getByIdInstruction;
+};
+
+} // namespace JSC
diff --git a/bytecode/LazyOperandValueProfile.cpp b/bytecode/LazyOperandValueProfile.cpp
new file mode 100644
index 0000000..0929d6f
--- /dev/null
+++ b/bytecode/LazyOperandValueProfile.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LazyOperandValueProfile.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+CompressedLazyOperandValueProfileHolder::CompressedLazyOperandValueProfileHolder() { }
+CompressedLazyOperandValueProfileHolder::~CompressedLazyOperandValueProfileHolder() { }
+
+void CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions(const ConcurrentJSLocker& locker)
+{
+    if (!m_data)
+        return;
+    
+    for (unsigned i = 0; i < m_data->size(); ++i)
+        m_data->at(i).computeUpdatedPrediction(locker);
+}
+
+LazyOperandValueProfile* CompressedLazyOperandValueProfileHolder::add(
+    const ConcurrentJSLocker&, const LazyOperandValueProfileKey& key)
+{
+    if (!m_data)
+        m_data = std::make_unique<LazyOperandValueProfile::List>();
+    else {
+        for (unsigned i = 0; i < m_data->size(); ++i) {
+            if (m_data->at(i).key() == key)
+                return &m_data->at(i);
+        }
+    }
+    
+    m_data->append(LazyOperandValueProfile(key));
+    return &m_data->last();
+}
+
+LazyOperandValueProfileParser::LazyOperandValueProfileParser() { }
+LazyOperandValueProfileParser::~LazyOperandValueProfileParser() { }
+
+void LazyOperandValueProfileParser::initialize(
+    const ConcurrentJSLocker&, CompressedLazyOperandValueProfileHolder& holder)
+{
+    ASSERT(m_map.isEmpty());
+    
+    if (!holder.m_data)
+        return;
+    
+    LazyOperandValueProfile::List& data = *holder.m_data;
+    for (unsigned i = 0; i < data.size(); ++i)
+        m_map.add(data[i].key(), &data[i]);
+}
+
+LazyOperandValueProfile* LazyOperandValueProfileParser::getIfPresent(
+    const LazyOperandValueProfileKey& key) const
+{
+    HashMap<LazyOperandValueProfileKey, LazyOperandValueProfile*>::const_iterator iter =
+        m_map.find(key);
+    
+    if (iter == m_map.end())
+        return 0;
+    
+    return iter->value;
+}
+
+SpeculatedType LazyOperandValueProfileParser::prediction(
+    const ConcurrentJSLocker& locker, const LazyOperandValueProfileKey& key) const
+{
+    LazyOperandValueProfile* profile = getIfPresent(key);
+    if (!profile)
+        return SpecNone;
+    
+    return profile->computeUpdatedPrediction(locker);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/LazyOperandValueProfile.h b/bytecode/LazyOperandValueProfile.h
new file mode 100644
index 0000000..9c3b068
--- /dev/null
+++ b/bytecode/LazyOperandValueProfile.h
@@ -0,0 +1,183 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "ValueProfile.h"
+#include "VirtualRegister.h"
+#include <wtf/HashMap.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+class ScriptExecutable;
+
+class LazyOperandValueProfileKey {
+public:
+    LazyOperandValueProfileKey()
+        : m_bytecodeOffset(0) // 0 = empty value
+        , m_operand(VirtualRegister()) // not a valid operand index in our current scheme
+    {
+    }
+    
+    LazyOperandValueProfileKey(WTF::HashTableDeletedValueType)
+        : m_bytecodeOffset(1) // 1 = deleted value
+        , m_operand(VirtualRegister()) // not a valid operand index in our current scheme
+    {
+    }
+    
+    LazyOperandValueProfileKey(unsigned bytecodeOffset, VirtualRegister operand)
+        : m_bytecodeOffset(bytecodeOffset)
+        , m_operand(operand)
+    {
+        ASSERT(m_operand.isValid());
+    }
+    
+    bool operator!() const
+    {
+        return !m_operand.isValid();
+    }
+    
+    bool operator==(const LazyOperandValueProfileKey& other) const
+    {
+        return m_bytecodeOffset == other.m_bytecodeOffset
+            && m_operand == other.m_operand;
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::intHash(m_bytecodeOffset) + m_operand.offset();
+    }
+    
+    unsigned bytecodeOffset() const
+    {
+        ASSERT(!!*this);
+        return m_bytecodeOffset;
+    }
+
+    VirtualRegister operand() const
+    {
+        ASSERT(!!*this);
+        return m_operand;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return !m_operand.isValid() && m_bytecodeOffset;
+    }
+private: 
+    unsigned m_bytecodeOffset;
+    VirtualRegister m_operand;
+};
+
+struct LazyOperandValueProfileKeyHash {
+    static unsigned hash(const LazyOperandValueProfileKey& key) { return key.hash(); }
+    static bool equal(
+        const LazyOperandValueProfileKey& a,
+        const LazyOperandValueProfileKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::LazyOperandValueProfileKey> {
+    typedef JSC::LazyOperandValueProfileKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::LazyOperandValueProfileKey> : public GenericHashTraits<JSC::LazyOperandValueProfileKey> {
+    static void constructDeletedValue(JSC::LazyOperandValueProfileKey& slot) { new (NotNull, &slot) JSC::LazyOperandValueProfileKey(HashTableDeletedValue); }
+    static bool isDeletedValue(const JSC::LazyOperandValueProfileKey& value) { return value.isHashTableDeletedValue(); }
+};
+
+} // namespace WTF
+
+namespace JSC {
+
+struct LazyOperandValueProfile : public MinimalValueProfile {
+    LazyOperandValueProfile()
+        : MinimalValueProfile()
+        , m_operand(VirtualRegister())
+    {
+    }
+    
+    explicit LazyOperandValueProfile(const LazyOperandValueProfileKey& key)
+        : MinimalValueProfile(key.bytecodeOffset())
+        , m_operand(key.operand())
+    {
+    }
+    
+    LazyOperandValueProfileKey key() const
+    {
+        return LazyOperandValueProfileKey(m_bytecodeOffset, m_operand);
+    }
+    
+    VirtualRegister m_operand;
+    
+    typedef SegmentedVector<LazyOperandValueProfile, 8> List;
+};
+
+class LazyOperandValueProfileParser;
+
+class CompressedLazyOperandValueProfileHolder {
+    WTF_MAKE_NONCOPYABLE(CompressedLazyOperandValueProfileHolder);
+public:
+    CompressedLazyOperandValueProfileHolder();
+    ~CompressedLazyOperandValueProfileHolder();
+    
+    void computeUpdatedPredictions(const ConcurrentJSLocker&);
+    
+    LazyOperandValueProfile* add(
+        const ConcurrentJSLocker&, const LazyOperandValueProfileKey& key);
+    
+private:
+    friend class LazyOperandValueProfileParser;
+    std::unique_ptr<LazyOperandValueProfile::List> m_data;
+};
+
+class LazyOperandValueProfileParser {
+    WTF_MAKE_NONCOPYABLE(LazyOperandValueProfileParser);
+public:
+    explicit LazyOperandValueProfileParser();
+    ~LazyOperandValueProfileParser();
+    
+    void initialize(
+        const ConcurrentJSLocker&, CompressedLazyOperandValueProfileHolder& holder);
+    
+    LazyOperandValueProfile* getIfPresent(
+        const LazyOperandValueProfileKey& key) const;
+    
+    SpeculatedType prediction(
+        const ConcurrentJSLocker&, const LazyOperandValueProfileKey& key) const;
+private:
+    HashMap<LazyOperandValueProfileKey, LazyOperandValueProfile*> m_map;
+};
+
+} // namespace JSC
diff --git a/bytecode/MethodOfGettingAValueProfile.cpp b/bytecode/MethodOfGettingAValueProfile.cpp
new file mode 100644
index 0000000..f479e5f
--- /dev/null
+++ b/bytecode/MethodOfGettingAValueProfile.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MethodOfGettingAValueProfile.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArithProfile.h"
+#include "CCallHelpers.h"
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+MethodOfGettingAValueProfile MethodOfGettingAValueProfile::fromLazyOperand(
+    CodeBlock* codeBlock, const LazyOperandValueProfileKey& key)
+{
+    MethodOfGettingAValueProfile result;
+    result.m_kind = LazyOperand;
+    result.u.lazyOperand.codeBlock = codeBlock;
+    result.u.lazyOperand.bytecodeOffset = key.bytecodeOffset();
+    result.u.lazyOperand.operand = key.operand().offset();
+    return result;
+}
+
+void MethodOfGettingAValueProfile::emitReportValue(CCallHelpers& jit, JSValueRegs regs) const
+{
+    switch (m_kind) {
+    case None:
+        return;
+        
+    case Ready:
+        jit.storeValue(regs, u.profile->specFailBucket(0));
+        return;
+        
+    case LazyOperand: {
+        LazyOperandValueProfileKey key(u.lazyOperand.bytecodeOffset, VirtualRegister(u.lazyOperand.operand));
+        
+        ConcurrentJSLocker locker(u.lazyOperand.codeBlock->m_lock);
+        LazyOperandValueProfile* profile =
+            u.lazyOperand.codeBlock->lazyOperandValueProfiles().add(locker, key);
+        jit.storeValue(regs, profile->specFailBucket(0));
+        return;
+    }
+        
+    case ArithProfileReady: {
+        u.arithProfile->emitObserveResult(jit, regs, DoNotHaveTagRegisters);
+        return;
+    } }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/bytecode/MethodOfGettingAValueProfile.h b/bytecode/MethodOfGettingAValueProfile.h
new file mode 100644
index 0000000..98e39db
--- /dev/null
+++ b/bytecode/MethodOfGettingAValueProfile.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+// This is guarded by ENABLE_DFG_JIT only because it uses some value profiles
+// that are currently only used if the DFG is enabled (i.e. they are not
+// available in the profile-only configuration). Hopefully someday all of
+// these #if's will disappear...
+#if ENABLE(DFG_JIT)
+
+#include "GPRInfo.h"
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+class CCallHelpers;
+class CodeBlock;
+class LazyOperandValueProfileKey;
+struct ArithProfile;
+struct ValueProfile;
+
+class MethodOfGettingAValueProfile {
+public:
+    MethodOfGettingAValueProfile()
+        : m_kind(None)
+    {
+    }
+    
+    MethodOfGettingAValueProfile(ValueProfile* profile)
+    {
+        if (profile) {
+            m_kind = Ready;
+            u.profile = profile;
+        } else
+            m_kind = None;
+    }
+    
+    MethodOfGettingAValueProfile(ArithProfile* profile)
+    {
+        if (profile) {
+            m_kind = ArithProfileReady;
+            u.arithProfile = profile;
+        } else
+            m_kind = None;
+    }
+    
+    static MethodOfGettingAValueProfile fromLazyOperand(
+        CodeBlock*, const LazyOperandValueProfileKey&);
+    
+    explicit operator bool() const { return m_kind != None; }
+    
+    void emitReportValue(CCallHelpers&, JSValueRegs) const;
+    
+private:
+    enum Kind {
+        None,
+        Ready,
+        ArithProfileReady,
+        LazyOperand
+    };
+    
+    Kind m_kind;
+    union {
+        ValueProfile* profile;
+        ArithProfile* arithProfile;
+        struct {
+            CodeBlock* codeBlock;
+            unsigned bytecodeOffset;
+            int operand;
+        } lazyOperand;
+    } u;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(DFG_JIT)
diff --git a/bytecode/ModuleProgramCodeBlock.cpp b/bytecode/ModuleProgramCodeBlock.cpp
new file mode 100644
index 0000000..3d54c3a
--- /dev/null
+++ b/bytecode/ModuleProgramCodeBlock.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008-2010, 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ModuleProgramCodeBlock.h"
+
+namespace JSC {
+
+const ClassInfo ModuleProgramCodeBlock::s_info = {
+    "ModuleProgramCodeBlock", &Base::s_info, 0,
+    CREATE_METHOD_TABLE(ModuleProgramCodeBlock)
+};
+
+void ModuleProgramCodeBlock::destroy(JSCell* cell)
+{
+    static_cast<ModuleProgramCodeBlock*>(cell)->~ModuleProgramCodeBlock();
+}
+
+} // namespace JSC
diff --git a/bytecode/ModuleProgramCodeBlock.h b/bytecode/ModuleProgramCodeBlock.h
new file mode 100644
index 0000000..b3c3b11
--- /dev/null
+++ b/bytecode/ModuleProgramCodeBlock.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2008-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GlobalCodeBlock.h"
+#include "UnlinkedModuleProgramCodeBlock.h"
+
+namespace JSC {
+
+class ModuleProgramCodeBlock : public GlobalCodeBlock {
+public:
+    typedef GlobalCodeBlock Base;
+    DECLARE_INFO;
+
+    static ModuleProgramCodeBlock* create(VM* vm, CopyParsedBlockTag, ModuleProgramCodeBlock& other)
+    {
+        ModuleProgramCodeBlock* instance = new (NotNull, allocateCell<ModuleProgramCodeBlock>(vm->heap))
+            ModuleProgramCodeBlock(vm, vm->moduleProgramCodeBlockStructure.get(), CopyParsedBlock, other);
+        instance->finishCreation(*vm, CopyParsedBlock, other);
+        return instance;
+    }
+
+    static ModuleProgramCodeBlock* create(VM* vm, ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock,
+        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned firstLineColumnOffset)
+    {
+        ModuleProgramCodeBlock* instance = new (NotNull, allocateCell<ModuleProgramCodeBlock>(vm->heap))
+            ModuleProgramCodeBlock(vm, vm->moduleProgramCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, firstLineColumnOffset);
+        instance->finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
+        return instance;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+private:
+    ModuleProgramCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, ModuleProgramCodeBlock& other)
+        : GlobalCodeBlock(vm, structure, CopyParsedBlock, other)
+    {
+    }
+
+    ModuleProgramCodeBlock(VM* vm, Structure* structure, ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock,
+        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned firstLineColumnOffset)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
+    {
+    }
+
+    static void destroy(JSCell*);
+};
+
+} // namespace JSC
diff --git a/bytecode/ObjectAllocationProfile.h b/bytecode/ObjectAllocationProfile.h
new file mode 100644
index 0000000..1bc6b15
--- /dev/null
+++ b/bytecode/ObjectAllocationProfile.h
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "VM.h"
+#include "JSGlobalObject.h"
+#include "ObjectPrototype.h"
+#include "SlotVisitor.h"
+#include "WriteBarrier.h"
+
+namespace JSC {
+
+class ObjectAllocationProfile {
+    friend class LLIntOffsetsExtractor;
+public:
+    static ptrdiff_t offsetOfAllocator() { return OBJECT_OFFSETOF(ObjectAllocationProfile, m_allocator); }
+    static ptrdiff_t offsetOfStructure() { return OBJECT_OFFSETOF(ObjectAllocationProfile, m_structure); }
+    static ptrdiff_t offsetOfInlineCapacity() { return OBJECT_OFFSETOF(ObjectAllocationProfile, m_inlineCapacity); }
+
+    ObjectAllocationProfile()
+        : m_allocator(0)
+        , m_inlineCapacity(0)
+    {
+    }
+
+    bool isNull() { return !m_structure; }
+
+    void initialize(VM& vm, JSGlobalObject* globalObject, JSCell* owner, JSObject* prototype, unsigned inferredInlineCapacity)
+    {
+        ASSERT(!m_allocator);
+        ASSERT(!m_structure);
+        ASSERT(!m_inlineCapacity);
+
+        unsigned inlineCapacity = 0;
+        if (inferredInlineCapacity < JSFinalObject::defaultInlineCapacity()) {
+            // Try to shrink the object based on static analysis.
+            inferredInlineCapacity += possibleDefaultPropertyCount(vm, prototype);
+
+            if (!inferredInlineCapacity) {
+                // Empty objects are rare, so most likely the static analyzer just didn't
+                // see the real initializer function. This can happen with helper functions.
+                inferredInlineCapacity = JSFinalObject::defaultInlineCapacity();
+            } else if (inferredInlineCapacity > JSFinalObject::defaultInlineCapacity()) {
+                // Default properties are weak guesses, so don't allow them to turn a small
+                // object into a large object.
+                inferredInlineCapacity = JSFinalObject::defaultInlineCapacity();
+            }
+
+            inlineCapacity = inferredInlineCapacity;
+            ASSERT(inlineCapacity < JSFinalObject::maxInlineCapacity());
+        } else {
+            // Normal or large object.
+            inlineCapacity = inferredInlineCapacity;
+            if (inlineCapacity > JSFinalObject::maxInlineCapacity())
+                inlineCapacity = JSFinalObject::maxInlineCapacity();
+        }
+
+        ASSERT(inlineCapacity > 0);
+        ASSERT(inlineCapacity <= JSFinalObject::maxInlineCapacity());
+
+        size_t allocationSize = JSFinalObject::allocationSize(inlineCapacity);
+        MarkedAllocator* allocator = vm.cellSpace.allocatorFor(allocationSize);
+        
+        // Take advantage of extra inline capacity available in the size class.
+        if (allocator) {
+            size_t slop = (allocator->cellSize() - allocationSize) / sizeof(WriteBarrier<Unknown>);
+            inlineCapacity += slop;
+            if (inlineCapacity > JSFinalObject::maxInlineCapacity())
+                inlineCapacity = JSFinalObject::maxInlineCapacity();
+        }
+
+        Structure* structure = vm.prototypeMap.emptyObjectStructureForPrototype(globalObject, prototype, inlineCapacity);
+
+        // Ensure that if another thread sees the structure, it will see it properly created
+        WTF::storeStoreFence();
+
+        m_allocator = allocator;
+        m_structure.set(vm, owner, structure);
+        m_inlineCapacity = inlineCapacity;
+    }
+
+    Structure* structure()
+    {
+        Structure* structure = m_structure.get();
+        // Ensure that if we see the structure, it has been properly created
+        WTF::loadLoadFence();
+        return structure;
+    }
+    unsigned inlineCapacity() { return m_inlineCapacity; }
+
+    void clear()
+    {
+        m_allocator = 0;
+        m_structure.clear();
+        m_inlineCapacity = 0;
+        ASSERT(isNull());
+    }
+
+    void visitAggregate(SlotVisitor& visitor)
+    {
+        visitor.append(m_structure);
+    }
+
+private:
+
+    unsigned possibleDefaultPropertyCount(VM& vm, JSObject* prototype)
+    {
+        if (prototype == prototype->globalObject()->objectPrototype())
+            return 0;
+
+        size_t count = 0;
+        PropertyNameArray propertyNameArray(&vm, PropertyNameMode::StringsAndSymbols);
+        prototype->structure()->getPropertyNamesFromStructure(vm, propertyNameArray, EnumerationMode());
+        PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArray.data()->propertyNameVector();
+        for (size_t i = 0; i < propertyNameVector.size(); ++i) {
+            JSValue value = prototype->getDirect(vm, propertyNameVector[i]);
+
+            // Functions are common, and are usually class-level objects that are not overridden.
+            if (jsDynamicCast<JSFunction*>(value))
+                continue;
+
+            ++count;
+
+        }
+        return count;
+    }
+
+    MarkedAllocator* m_allocator; // Precomputed to make things easier for generated code.
+    WriteBarrier<Structure> m_structure;
+    unsigned m_inlineCapacity;
+};
+
+} // namespace JSC
diff --git a/bytecode/ObjectPropertyCondition.cpp b/bytecode/ObjectPropertyCondition.cpp
new file mode 100644
index 0000000..f7d8ee8
--- /dev/null
+++ b/bytecode/ObjectPropertyCondition.cpp
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ObjectPropertyCondition.h"
+
+#include "JSCInlines.h"
+#include "TrackedReferences.h"
+
+namespace JSC {
+
+void ObjectPropertyCondition::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    if (!*this) {
+        out.print("<invalid>");
+        return;
+    }
+    
+    out.print("<", inContext(JSValue(m_object), context), ": ", inContext(m_condition, context), ">");
+}
+
+void ObjectPropertyCondition::dump(PrintStream& out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+bool ObjectPropertyCondition::structureEnsuresValidityAssumingImpurePropertyWatchpoint(
+    Structure* structure) const
+{
+    return m_condition.isStillValidAssumingImpurePropertyWatchpoint(structure);
+}
+
+bool ObjectPropertyCondition::structureEnsuresValidityAssumingImpurePropertyWatchpoint() const
+{
+    if (!*this)
+        return false;
+    
+    return structureEnsuresValidityAssumingImpurePropertyWatchpoint(m_object->structure());
+}
+
+bool ObjectPropertyCondition::validityRequiresImpurePropertyWatchpoint(Structure* structure) const
+{
+    return m_condition.validityRequiresImpurePropertyWatchpoint(structure);
+}
+
+bool ObjectPropertyCondition::validityRequiresImpurePropertyWatchpoint() const
+{
+    if (!*this)
+        return false;
+    
+    return validityRequiresImpurePropertyWatchpoint(m_object->structure());
+}
+
+bool ObjectPropertyCondition::isStillValidAssumingImpurePropertyWatchpoint(Structure* structure) const
+{
+    return m_condition.isStillValidAssumingImpurePropertyWatchpoint(structure, m_object);
+}
+
+bool ObjectPropertyCondition::isStillValidAssumingImpurePropertyWatchpoint() const
+{
+    if (!*this)
+        return false;
+
+    return isStillValidAssumingImpurePropertyWatchpoint(m_object->structure());
+}
+
+
+bool ObjectPropertyCondition::isStillValid(Structure* structure) const
+{
+    return m_condition.isStillValid(structure, m_object);
+}
+
+bool ObjectPropertyCondition::isStillValid() const
+{
+    if (!*this)
+        return false;
+    
+    return isStillValid(m_object->structure());
+}
+
+bool ObjectPropertyCondition::structureEnsuresValidity(Structure* structure) const
+{
+    return m_condition.isStillValid(structure);
+}
+
+bool ObjectPropertyCondition::structureEnsuresValidity() const
+{
+    if (!*this)
+        return false;
+    
+    return structureEnsuresValidity(m_object->structure());
+}
+
+bool ObjectPropertyCondition::isWatchableAssumingImpurePropertyWatchpoint(
+    Structure* structure, PropertyCondition::WatchabilityEffort effort) const
+{
+    return m_condition.isWatchableAssumingImpurePropertyWatchpoint(structure, m_object, effort);
+}
+
+bool ObjectPropertyCondition::isWatchableAssumingImpurePropertyWatchpoint(
+    PropertyCondition::WatchabilityEffort effort) const
+{
+    if (!*this)
+        return false;
+    
+    return isWatchableAssumingImpurePropertyWatchpoint(m_object->structure(), effort);
+}
+
+bool ObjectPropertyCondition::isWatchable(
+    Structure* structure, PropertyCondition::WatchabilityEffort effort) const
+{
+    return m_condition.isWatchable(structure, m_object, effort);
+}
+
+bool ObjectPropertyCondition::isWatchable(PropertyCondition::WatchabilityEffort effort) const
+{
+    if (!*this)
+        return false;
+    
+    return isWatchable(m_object->structure(), effort);
+}
+
+bool ObjectPropertyCondition::isStillLive() const
+{
+    if (!*this)
+        return false;
+    
+    if (!Heap::isMarked(m_object))
+        return false;
+    
+    return m_condition.isStillLive();
+}
+
+void ObjectPropertyCondition::validateReferences(const TrackedReferences& tracked) const
+{
+    if (!*this)
+        return;
+    
+    tracked.check(m_object);
+    m_condition.validateReferences(tracked);
+}
+
+ObjectPropertyCondition ObjectPropertyCondition::attemptToMakeEquivalenceWithoutBarrier() const
+{
+    PropertyCondition result = condition().attemptToMakeEquivalenceWithoutBarrier(object());
+    if (!result)
+        return ObjectPropertyCondition();
+    return ObjectPropertyCondition(object(), result);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/ObjectPropertyCondition.h b/bytecode/ObjectPropertyCondition.h
new file mode 100644
index 0000000..568736b
--- /dev/null
+++ b/bytecode/ObjectPropertyCondition.h
@@ -0,0 +1,269 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "PropertyCondition.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class TrackedReferences;
+
+class ObjectPropertyCondition {
+public:
+    ObjectPropertyCondition()
+        : m_object(nullptr)
+    {
+    }
+    
+    ObjectPropertyCondition(WTF::HashTableDeletedValueType token)
+        : m_object(nullptr)
+        , m_condition(token)
+    {
+    }
+    
+    ObjectPropertyCondition(JSObject* object, const PropertyCondition& condition)
+        : m_object(object)
+        , m_condition(condition)
+    {
+    }
+    
+    static ObjectPropertyCondition presenceWithoutBarrier(
+        JSObject* object, UniquedStringImpl* uid, PropertyOffset offset, unsigned attributes)
+    {
+        ObjectPropertyCondition result;
+        result.m_object = object;
+        result.m_condition = PropertyCondition::presenceWithoutBarrier(uid, offset, attributes); 
+        return result;
+    }
+    
+    static ObjectPropertyCondition presence(
+        VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid, PropertyOffset offset,
+        unsigned attributes)
+    {
+        if (owner)
+            vm.heap.writeBarrier(owner);
+        return presenceWithoutBarrier(object, uid, offset, attributes);
+    }
+
+    // NOTE: The prototype is the storedPrototype, not the prototypeForLookup.
+    static ObjectPropertyCondition absenceWithoutBarrier(
+        JSObject* object, UniquedStringImpl* uid, JSObject* prototype)
+    {
+        ObjectPropertyCondition result;
+        result.m_object = object;
+        result.m_condition = PropertyCondition::absenceWithoutBarrier(uid, prototype);
+        return result;
+    }
+    
+    static ObjectPropertyCondition absence(
+        VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid, JSObject* prototype)
+    {
+        if (owner)
+            vm.heap.writeBarrier(owner);
+        return absenceWithoutBarrier(object, uid, prototype);
+    }
+    
+    static ObjectPropertyCondition absenceOfSetterWithoutBarrier(
+        JSObject* object, UniquedStringImpl* uid, JSObject* prototype)
+    {
+        ObjectPropertyCondition result;
+        result.m_object = object;
+        result.m_condition = PropertyCondition::absenceOfSetterWithoutBarrier(uid, prototype);
+        return result;
+    }
+    
+    static ObjectPropertyCondition absenceOfSetter(
+        VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid, JSObject* prototype)
+    {
+        if (owner)
+            vm.heap.writeBarrier(owner);
+        return absenceOfSetterWithoutBarrier(object, uid, prototype);
+    }
+    
+    static ObjectPropertyCondition equivalenceWithoutBarrier(
+        JSObject* object, UniquedStringImpl* uid, JSValue value)
+    {
+        ObjectPropertyCondition result;
+        result.m_object = object;
+        result.m_condition = PropertyCondition::equivalenceWithoutBarrier(uid, value);
+        return result;
+    }
+    
+    static ObjectPropertyCondition equivalence(
+        VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid, JSValue value)
+    {
+        if (owner)
+            vm.heap.writeBarrier(owner);
+        return equivalenceWithoutBarrier(object, uid, value);
+    }
+
+    explicit operator bool() const { return !!m_condition; }
+    
+    JSObject* object() const { return m_object; }
+    PropertyCondition condition() const { return m_condition; }
+    
+    PropertyCondition::Kind kind() const { return condition().kind(); }
+    UniquedStringImpl* uid() const { return condition().uid(); }
+    bool hasOffset() const { return condition().hasOffset(); }
+    PropertyOffset offset() const { return condition().offset(); }
+    unsigned hasAttributes() const { return condition().hasAttributes(); }
+    unsigned attributes() const { return condition().attributes(); }
+    bool hasPrototype() const { return condition().hasPrototype(); }
+    JSObject* prototype() const { return condition().prototype(); }
+    bool hasRequiredValue() const { return condition().hasRequiredValue(); }
+    JSValue requiredValue() const { return condition().requiredValue(); }
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+    
+    unsigned hash() const
+    {
+        return WTF::PtrHash<JSObject*>::hash(m_object) ^ m_condition.hash();
+    }
+    
+    bool operator==(const ObjectPropertyCondition& other) const
+    {
+        return m_object == other.m_object
+            && m_condition == other.m_condition;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return !m_object && m_condition.isHashTableDeletedValue();
+    }
+    
+    // Two conditions are compatible if they are identical or if they speak of different uids or
+    // different objects. If false is returned, you have to decide how to resolve the conflict -
+    // for example if there is a Presence and an Equivalence then in some cases you'll want the
+    // more general of the two while in other cases you'll want the more specific of the two. This
+    // will also return false for contradictions, like Presence and Absence on the same
+    // object/uid. By convention, invalid conditions aren't compatible with anything.
+    bool isCompatibleWith(const ObjectPropertyCondition& other) const
+    {
+        if (!*this || !other)
+            return false;
+        return *this == other || uid() != other.uid() || object() != other.object();
+    }
+    
+    // These validity-checking methods can optionally take a Struture* instead of loading the
+    // Structure* from the object. If you're in the concurrent JIT, then you must use the forms
+    // that take an explicit Structure* because you want the compiler to optimize for the same
+    // structure that you validated (i.e. avoid a TOCTOU race).
+    
+    // Checks if the object's structure claims that the property won't be intercepted. Validity
+    // does not require watchpoints on the object.
+    bool structureEnsuresValidityAssumingImpurePropertyWatchpoint(Structure*) const;
+    bool structureEnsuresValidityAssumingImpurePropertyWatchpoint() const;
+    
+    // Returns true if we need an impure property watchpoint to ensure validity even if
+    // isStillValidAccordingToStructure() returned true.
+    bool validityRequiresImpurePropertyWatchpoint(Structure*) const;
+    bool validityRequiresImpurePropertyWatchpoint() const;
+
+    // Checks if the condition still holds setting aside the need for an impure property watchpoint.
+    // Validity might still require watchpoints on the object.
+    bool isStillValidAssumingImpurePropertyWatchpoint(Structure*) const;
+    bool isStillValidAssumingImpurePropertyWatchpoint() const;
+
+    // Checks if the condition still holds. May conservatively return false, if the object and
+    // structure alone don't guarantee the condition. Note that this may return true if the
+    // condition still requires some watchpoints on the object in addition to checking the
+    // structure. If you want to check if the condition holds by using the structure alone,
+    // use structureEnsuresValidity().
+    bool isStillValid(Structure*) const;
+    bool isStillValid() const;
+    
+    // Shorthand for condition().isStillValid(structure).
+    bool structureEnsuresValidity(Structure*) const;
+    bool structureEnsuresValidity() const;
+    
+    // This means that it's still valid and we could enforce validity by setting a transition
+    // watchpoint on the structure and possibly an impure property watchpoint.
+    bool isWatchableAssumingImpurePropertyWatchpoint(
+        Structure*,
+        PropertyCondition::WatchabilityEffort = PropertyCondition::MakeNoChanges) const;
+    bool isWatchableAssumingImpurePropertyWatchpoint(
+        PropertyCondition::WatchabilityEffort = PropertyCondition::MakeNoChanges) const;
+
+    // This means that it's still valid and we could enforce validity by setting a transition
+    // watchpoint on the structure.
+    bool isWatchable(
+        Structure*,
+        PropertyCondition::WatchabilityEffort = PropertyCondition::MakeNoChanges) const;
+    bool isWatchable(
+        PropertyCondition::WatchabilityEffort = PropertyCondition::MakeNoChanges) const;
+    
+    bool watchingRequiresStructureTransitionWatchpoint() const
+    {
+        return condition().watchingRequiresStructureTransitionWatchpoint();
+    }
+    bool watchingRequiresReplacementWatchpoint() const
+    {
+        return condition().watchingRequiresReplacementWatchpoint();
+    }
+    
+    // This means that the objects involved in this are still live.
+    bool isStillLive() const;
+    
+    void validateReferences(const TrackedReferences&) const;
+
+    bool isValidValueForPresence(JSValue value) const
+    {
+        return condition().isValidValueForPresence(value);
+    }
+
+    ObjectPropertyCondition attemptToMakeEquivalenceWithoutBarrier() const;
+
+private:
+    JSObject* m_object;
+    PropertyCondition m_condition;
+};
+
+struct ObjectPropertyConditionHash {
+    static unsigned hash(const ObjectPropertyCondition& key) { return key.hash(); }
+    static bool equal(
+        const ObjectPropertyCondition& a, const ObjectPropertyCondition& b)
+    {
+        return a == b;
+    }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::ObjectPropertyCondition> {
+    typedef JSC::ObjectPropertyConditionHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::ObjectPropertyCondition> : SimpleClassHashTraits<JSC::ObjectPropertyCondition> { };
+
+} // namespace WTF
diff --git a/bytecode/ObjectPropertyConditionSet.cpp b/bytecode/ObjectPropertyConditionSet.cpp
new file mode 100644
index 0000000..e2e4a8f
--- /dev/null
+++ b/bytecode/ObjectPropertyConditionSet.cpp
@@ -0,0 +1,431 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ObjectPropertyConditionSet.h"
+
+#include "JSCInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+ObjectPropertyCondition ObjectPropertyConditionSet::forObject(JSObject* object) const
+{
+    for (const ObjectPropertyCondition& condition : *this) {
+        if (condition.object() == object)
+            return condition;
+    }
+    return ObjectPropertyCondition();
+}
+
+ObjectPropertyCondition ObjectPropertyConditionSet::forConditionKind(
+    PropertyCondition::Kind kind) const
+{
+    for (const ObjectPropertyCondition& condition : *this) {
+        if (condition.kind() == kind)
+            return condition;
+    }
+    return ObjectPropertyCondition();
+}
+
+unsigned ObjectPropertyConditionSet::numberOfConditionsWithKind(PropertyCondition::Kind kind) const
+{
+    unsigned result = 0;
+    for (const ObjectPropertyCondition& condition : *this) {
+        if (condition.kind() == kind)
+            result++;
+    }
+    return result;
+}
+
+bool ObjectPropertyConditionSet::hasOneSlotBaseCondition() const
+{
+    return (numberOfConditionsWithKind(PropertyCondition::Presence) == 1) != (numberOfConditionsWithKind(PropertyCondition::Equivalence) == 1);
+}
+
+ObjectPropertyCondition ObjectPropertyConditionSet::slotBaseCondition() const
+{
+    ObjectPropertyCondition result;
+    unsigned numFound = 0;
+    for (const ObjectPropertyCondition& condition : *this) {
+        if (condition.kind() == PropertyCondition::Presence
+            || condition.kind() == PropertyCondition::Equivalence) {
+            result = condition;
+            numFound++;
+        }
+    }
+    RELEASE_ASSERT(numFound == 1);
+    return result;
+}
+
+ObjectPropertyConditionSet ObjectPropertyConditionSet::mergedWith(
+    const ObjectPropertyConditionSet& other) const
+{
+    if (!isValid() || !other.isValid())
+        return invalid();
+
+    Vector<ObjectPropertyCondition> result;
+    
+    if (!isEmpty())
+        result.appendVector(m_data->vector);
+    
+    for (const ObjectPropertyCondition& newCondition : other) {
+        bool foundMatch = false;
+        for (const ObjectPropertyCondition& existingCondition : *this) {
+            if (newCondition == existingCondition) {
+                foundMatch = true;
+                continue;
+            }
+            if (!newCondition.isCompatibleWith(existingCondition))
+                return invalid();
+        }
+        if (!foundMatch)
+            result.append(newCondition);
+    }
+
+    return create(result);
+}
+
+bool ObjectPropertyConditionSet::structuresEnsureValidity() const
+{
+    if (!isValid())
+        return false;
+    
+    for (const ObjectPropertyCondition& condition : *this) {
+        if (!condition.structureEnsuresValidity())
+            return false;
+    }
+    return true;
+}
+
+bool ObjectPropertyConditionSet::structuresEnsureValidityAssumingImpurePropertyWatchpoint() const
+{
+    if (!isValid())
+        return false;
+    
+    for (const ObjectPropertyCondition& condition : *this) {
+        if (!condition.structureEnsuresValidityAssumingImpurePropertyWatchpoint())
+            return false;
+    }
+    return true;
+}
+
+bool ObjectPropertyConditionSet::needImpurePropertyWatchpoint() const
+{
+    for (const ObjectPropertyCondition& condition : *this) {
+        if (condition.validityRequiresImpurePropertyWatchpoint())
+            return true;
+    }
+    return false;
+}
+
+bool ObjectPropertyConditionSet::areStillLive() const
+{
+    for (const ObjectPropertyCondition& condition : *this) {
+        if (!condition.isStillLive())
+            return false;
+    }
+    return true;
+}
+
+void ObjectPropertyConditionSet::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    if (!isValid()) {
+        out.print("<invalid>");
+        return;
+    }
+    
+    out.print("[");
+    if (m_data)
+        out.print(listDumpInContext(m_data->vector, context));
+    out.print("]");
+}
+
+void ObjectPropertyConditionSet::dump(PrintStream& out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+bool ObjectPropertyConditionSet::isValidAndWatchable() const
+{
+    if (!isValid())
+        return false;
+
+    for (ObjectPropertyCondition condition : m_data->vector) {
+        if (!condition.isWatchable())
+            return false;
+    }
+    return true;
+}
+
+namespace {
+
+bool verbose = false;
+
+ObjectPropertyCondition generateCondition(
+    VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid, PropertyCondition::Kind conditionKind)
+{
+    Structure* structure = object->structure();
+    if (verbose)
+        dataLog("Creating condition ", conditionKind, " for ", pointerDump(structure), "\n");
+
+    ObjectPropertyCondition result;
+    switch (conditionKind) {
+    case PropertyCondition::Presence: {
+        unsigned attributes;
+        PropertyOffset offset = structure->getConcurrently(uid, attributes);
+        if (offset == invalidOffset)
+            return ObjectPropertyCondition();
+        result = ObjectPropertyCondition::presence(vm, owner, object, uid, offset, attributes);
+        break;
+    }
+    case PropertyCondition::Absence: {
+        result = ObjectPropertyCondition::absence(
+            vm, owner, object, uid, object->structure()->storedPrototypeObject());
+        break;
+    }
+    case PropertyCondition::AbsenceOfSetter: {
+        result = ObjectPropertyCondition::absenceOfSetter(
+            vm, owner, object, uid, object->structure()->storedPrototypeObject());
+        break;
+    }
+    case PropertyCondition::Equivalence: {
+        unsigned attributes;
+        PropertyOffset offset = structure->getConcurrently(uid, attributes);
+        if (offset == invalidOffset)
+            return ObjectPropertyCondition();
+        JSValue value = object->getDirect(offset);
+        result = ObjectPropertyCondition::equivalence(vm, owner, object, uid, value);
+        break;
+    }
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return ObjectPropertyCondition();
+    }
+
+    if (!result.isStillValidAssumingImpurePropertyWatchpoint()) {
+        if (verbose)
+            dataLog("Failed to create condition: ", result, "\n");
+        return ObjectPropertyCondition();
+    }
+
+    if (verbose)
+        dataLog("New condition: ", result, "\n");
+    return result;
+}
+
+enum Concurrency {
+    MainThread,
+    Concurrent
+};
+template<typename Functor>
+ObjectPropertyConditionSet generateConditions(
+    VM& vm, JSGlobalObject* globalObject, Structure* structure, JSObject* prototype, const Functor& functor,
+    Concurrency concurrency = MainThread)
+{
+    Vector<ObjectPropertyCondition> conditions;
+    
+    for (;;) {
+        if (verbose)
+            dataLog("Considering structure: ", pointerDump(structure), "\n");
+        
+        if (structure->isProxy()) {
+            if (verbose)
+                dataLog("It's a proxy, so invalid.\n");
+            return ObjectPropertyConditionSet::invalid();
+        }
+        
+        JSValue value = structure->prototypeForLookup(globalObject);
+        
+        if (value.isNull()) {
+            if (!prototype) {
+                if (verbose)
+                    dataLog("Reached end of prototype chain as expected, done.\n");
+                break;
+            }
+            if (verbose)
+                dataLog("Unexpectedly reached end of prototype chain, so invalid.\n");
+            return ObjectPropertyConditionSet::invalid();
+        }
+        
+        JSObject* object = jsCast<JSObject*>(value);
+        structure = object->structure(vm);
+        
+        if (structure->isDictionary()) {
+            if (concurrency == MainThread) {
+                if (structure->hasBeenFlattenedBefore()) {
+                    if (verbose)
+                        dataLog("Dictionary has been flattened before, so invalid.\n");
+                    return ObjectPropertyConditionSet::invalid();
+                }
+
+                if (verbose)
+                    dataLog("Flattening ", pointerDump(structure));
+                structure->flattenDictionaryStructure(vm, object);
+            } else {
+                if (verbose)
+                    dataLog("Cannot flatten dictionary when not on main thread, so invalid.\n");
+                return ObjectPropertyConditionSet::invalid();
+            }
+        }
+
+        if (!functor(conditions, object)) {
+            if (verbose)
+                dataLog("Functor failed, invalid.\n");
+            return ObjectPropertyConditionSet::invalid();
+        }
+        
+        if (object == prototype) {
+            if (verbose)
+                dataLog("Reached desired prototype, done.\n");
+            break;
+        }
+    }
+
+    if (verbose)
+        dataLog("Returning conditions: ", listDump(conditions), "\n");
+    return ObjectPropertyConditionSet::create(conditions);
+}
+
+} // anonymous namespace
+
+ObjectPropertyConditionSet generateConditionsForPropertyMiss(
+    VM& vm, JSCell* owner, ExecState* exec, Structure* headStructure, UniquedStringImpl* uid)
+{
+    return generateConditions(
+        vm, exec->lexicalGlobalObject(), headStructure, nullptr,
+        [&] (Vector<ObjectPropertyCondition>& conditions, JSObject* object) -> bool {
+            ObjectPropertyCondition result =
+                generateCondition(vm, owner, object, uid, PropertyCondition::Absence);
+            if (!result)
+                return false;
+            conditions.append(result);
+            return true;
+        });
+}
+
+ObjectPropertyConditionSet generateConditionsForPropertySetterMiss(
+    VM& vm, JSCell* owner, ExecState* exec, Structure* headStructure, UniquedStringImpl* uid)
+{
+    return generateConditions(
+        vm, exec->lexicalGlobalObject(), headStructure, nullptr,
+        [&] (Vector<ObjectPropertyCondition>& conditions, JSObject* object) -> bool {
+            ObjectPropertyCondition result =
+                generateCondition(vm, owner, object, uid, PropertyCondition::AbsenceOfSetter);
+            if (!result)
+                return false;
+            conditions.append(result);
+            return true;
+        });
+}
+
+ObjectPropertyConditionSet generateConditionsForPrototypePropertyHit(
+    VM& vm, JSCell* owner, ExecState* exec, Structure* headStructure, JSObject* prototype,
+    UniquedStringImpl* uid)
+{
+    return generateConditions(
+        vm, exec->lexicalGlobalObject(), headStructure, prototype,
+        [&] (Vector<ObjectPropertyCondition>& conditions, JSObject* object) -> bool {
+            PropertyCondition::Kind kind =
+                object == prototype ? PropertyCondition::Presence : PropertyCondition::Absence;
+            ObjectPropertyCondition result =
+                generateCondition(vm, owner, object, uid, kind);
+            if (!result)
+                return false;
+            conditions.append(result);
+            return true;
+        });
+}
+
+ObjectPropertyConditionSet generateConditionsForPrototypePropertyHitCustom(
+    VM& vm, JSCell* owner, ExecState* exec, Structure* headStructure, JSObject* prototype,
+    UniquedStringImpl* uid)
+{
+    return generateConditions(
+        vm, exec->lexicalGlobalObject(), headStructure, prototype,
+        [&] (Vector<ObjectPropertyCondition>& conditions, JSObject* object) -> bool {
+            if (object == prototype)
+                return true;
+            ObjectPropertyCondition result =
+                generateCondition(vm, owner, object, uid, PropertyCondition::Absence);
+            if (!result)
+                return false;
+            conditions.append(result);
+            return true;
+        });
+}
+
+ObjectPropertyConditionSet generateConditionsForPrototypeEquivalenceConcurrently(
+    VM& vm, JSGlobalObject* globalObject, Structure* headStructure, JSObject* prototype, UniquedStringImpl* uid)
+{
+    return generateConditions(vm, globalObject, headStructure, prototype,
+        [&] (Vector<ObjectPropertyCondition>& conditions, JSObject* object) -> bool {
+            PropertyCondition::Kind kind =
+                object == prototype ? PropertyCondition::Equivalence : PropertyCondition::Absence;
+            ObjectPropertyCondition result = generateCondition(vm, nullptr, object, uid, kind);
+            if (!result)
+                return false;
+            conditions.append(result);
+            return true;
+        }, Concurrent);
+}
+
+ObjectPropertyConditionSet generateConditionsForPropertyMissConcurrently(
+    VM& vm, JSGlobalObject* globalObject, Structure* headStructure, UniquedStringImpl* uid)
+{
+    return generateConditions(
+        vm, globalObject, headStructure, nullptr,
+        [&] (Vector<ObjectPropertyCondition>& conditions, JSObject* object) -> bool {
+            ObjectPropertyCondition result = generateCondition(vm, nullptr, object, uid, PropertyCondition::Absence);
+            if (!result)
+                return false;
+            conditions.append(result);
+            return true;
+        }, Concurrent);
+}
+
+ObjectPropertyConditionSet generateConditionsForPropertySetterMissConcurrently(
+    VM& vm, JSGlobalObject* globalObject, Structure* headStructure, UniquedStringImpl* uid)
+{
+    return generateConditions(
+        vm, globalObject, headStructure, nullptr,
+        [&] (Vector<ObjectPropertyCondition>& conditions, JSObject* object) -> bool {
+            ObjectPropertyCondition result =
+                generateCondition(vm, nullptr, object, uid, PropertyCondition::AbsenceOfSetter);
+            if (!result)
+                return false;
+            conditions.append(result);
+            return true;
+        }, Concurrent);
+}
+
+ObjectPropertyCondition generateConditionForSelfEquivalence(
+    VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid)
+{
+    return generateCondition(vm, owner, object, uid, PropertyCondition::Equivalence);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/ObjectPropertyConditionSet.h b/bytecode/ObjectPropertyConditionSet.h
new file mode 100644
index 0000000..2b15965
--- /dev/null
+++ b/bytecode/ObjectPropertyConditionSet.h
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ObjectPropertyCondition.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+// An object property condition set is used to represent the set of additional conditions
+// that need to be met for some heap access to be valid. The set can have the following
+// interesting states:
+//
+// Empty: There are no special conditions that need to be met.
+// Invalid: The heap access is never valid.
+// Non-empty: The heap access is valid if all the ObjectPropertyConditions in the set are valid.
+
+class ObjectPropertyConditionSet {
+public:
+    ObjectPropertyConditionSet() { }
+    
+    static ObjectPropertyConditionSet invalid()
+    {
+        ObjectPropertyConditionSet result;
+        result.m_data = adoptRef(new Data());
+        return result;
+    }
+    
+    static ObjectPropertyConditionSet create(const Vector<ObjectPropertyCondition>& vector)
+    {
+        if (vector.isEmpty())
+            return ObjectPropertyConditionSet();
+        
+        ObjectPropertyConditionSet result;
+        result.m_data = adoptRef(new Data());
+        result.m_data->vector = vector;
+        return result;
+    }
+    
+    bool isValid() const
+    {
+        return !m_data || !m_data->vector.isEmpty();
+    }
+
+    bool isValidAndWatchable() const;
+    
+    bool isEmpty() const
+    {
+        return !m_data;
+    }
+    
+    typedef const ObjectPropertyCondition* iterator;
+    
+    iterator begin() const
+    {
+        if (!m_data)
+            return nullptr;
+        return m_data->vector.begin();
+    }
+    iterator end() const
+    {
+        if (!m_data)
+            return nullptr;
+        return m_data->vector.end();
+    }
+    
+    ObjectPropertyCondition forObject(JSObject*) const;
+    ObjectPropertyCondition forConditionKind(PropertyCondition::Kind) const;
+
+    unsigned numberOfConditionsWithKind(PropertyCondition::Kind) const;
+
+    bool hasOneSlotBaseCondition() const;
+    
+    // If this is a condition set for a prototype hit, then this is guaranteed to return the
+    // condition on the prototype itself. This allows you to get the object, offset, and
+    // attributes for the prototype. This will RELEASE_ASSERT that there is exactly one Presence
+    // in the set, and it will return that presence.
+    ObjectPropertyCondition slotBaseCondition() const;
+    
+    // Attempt to create a new condition set by merging this one with the other one. This will
+    // fail if any of the conditions are incompatible with each other. When if fails, it returns
+    // invalid().
+    ObjectPropertyConditionSet mergedWith(const ObjectPropertyConditionSet& other) const;
+    
+    bool structuresEnsureValidity() const;
+    bool structuresEnsureValidityAssumingImpurePropertyWatchpoint() const;
+    
+    bool needImpurePropertyWatchpoint() const;
+    bool areStillLive() const;
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+    
+    // Helpers for using this in a union.
+    void* releaseRawPointer()
+    {
+        return static_cast<void*>(m_data.leakRef());
+    }
+    static ObjectPropertyConditionSet adoptRawPointer(void* rawPointer)
+    {
+        ObjectPropertyConditionSet result;
+        result.m_data = adoptRef(static_cast<Data*>(rawPointer));
+        return result;
+    }
+    static ObjectPropertyConditionSet fromRawPointer(void* rawPointer)
+    {
+        ObjectPropertyConditionSet result;
+        result.m_data = static_cast<Data*>(rawPointer);
+        return result;
+    }
+
+    // FIXME: Everything below here should be private, but cannot be because of a bug in VS.
+    
+    // Internally, this represents Invalid using a pointer to a Data that has an empty vector.
+    
+    // FIXME: This could be made more compact by having it internally use a vector that just has
+    // the non-uid portion of ObjectPropertyCondition, and then requiring that the callers of all
+    // of the APIs supply the uid.
+    
+    class Data : public ThreadSafeRefCounted<Data> {
+        WTF_MAKE_NONCOPYABLE(Data);
+        WTF_MAKE_FAST_ALLOCATED;
+        
+    public:
+        Data() { }
+        
+        Vector<ObjectPropertyCondition> vector;
+    };
+    
+private:
+    RefPtr<Data> m_data;
+};
+
+ObjectPropertyCondition generateConditionForSelfEquivalence(
+    VM&, JSCell* owner, JSObject* object, UniquedStringImpl* uid);
+
+ObjectPropertyConditionSet generateConditionsForPropertyMiss(
+    VM&, JSCell* owner, ExecState*, Structure* headStructure, UniquedStringImpl* uid);
+ObjectPropertyConditionSet generateConditionsForPropertySetterMiss(
+    VM&, JSCell* owner, ExecState*, Structure* headStructure, UniquedStringImpl* uid);
+ObjectPropertyConditionSet generateConditionsForPrototypePropertyHit(
+    VM&, JSCell* owner, ExecState*, Structure* headStructure, JSObject* prototype,
+    UniquedStringImpl* uid);
+ObjectPropertyConditionSet generateConditionsForPrototypePropertyHitCustom(
+    VM&, JSCell* owner, ExecState*, Structure* headStructure, JSObject* prototype,
+    UniquedStringImpl* uid);
+
+ObjectPropertyConditionSet generateConditionsForPrototypeEquivalenceConcurrently(
+    VM&, JSGlobalObject*, Structure* headStructure, JSObject* prototype,
+    UniquedStringImpl* uid);
+ObjectPropertyConditionSet generateConditionsForPropertyMissConcurrently(
+    VM&, JSGlobalObject*, Structure* headStructure, UniquedStringImpl* uid);
+ObjectPropertyConditionSet generateConditionsForPropertySetterMissConcurrently(
+    VM&, JSGlobalObject*, Structure* headStructure, UniquedStringImpl* uid);
+
+} // namespace JSC
diff --git a/bytecode/Opcode.cpp b/bytecode/Opcode.cpp
new file mode 100644
index 0000000..0d16dfc
--- /dev/null
+++ b/bytecode/Opcode.cpp
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Opcode.h"
+
+#include <wtf/PrintStream.h>
+
+#if ENABLE(OPCODE_STATS)
+#include <array>
+#include <wtf/DataLog.h>
+#endif
+
+using namespace std;
+
+namespace JSC {
+
+const char* const opcodeNames[] = {
+#define OPCODE_NAME_ENTRY(opcode, size) #opcode,
+    FOR_EACH_OPCODE_ID(OPCODE_NAME_ENTRY)
+#undef OPCODE_NAME_ENTRY
+};
+
+#if ENABLE(OPCODE_STATS)
+
+long long OpcodeStats::opcodeCounts[numOpcodeIDs];
+long long OpcodeStats::opcodePairCounts[numOpcodeIDs][numOpcodeIDs];
+int OpcodeStats::lastOpcode = -1;
+
+static OpcodeStats logger;
+
+OpcodeStats::OpcodeStats()
+{
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        opcodeCounts[i] = 0;
+    
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        for (int j = 0; j < numOpcodeIDs; ++j)
+            opcodePairCounts[i][j] = 0;
+}
+
+static int compareOpcodeIndices(const void* left, const void* right)
+{
+    long long leftValue = OpcodeStats::opcodeCounts[*(int*) left];
+    long long rightValue = OpcodeStats::opcodeCounts[*(int*) right];
+    
+    if (leftValue < rightValue)
+        return 1;
+    else if (leftValue > rightValue)
+        return -1;
+    else
+        return 0;
+}
+
+static int compareOpcodePairIndices(const void* left, const void* right)
+{
+    std::pair<int, int> leftPair = *(pair<int, int>*) left;
+    long long leftValue = OpcodeStats::opcodePairCounts[leftPair.first][leftPair.second];
+    std::pair<int, int> rightPair = *(pair<int, int>*) right;
+    long long rightValue = OpcodeStats::opcodePairCounts[rightPair.first][rightPair.second];
+    
+    if (leftValue < rightValue)
+        return 1;
+    else if (leftValue > rightValue)
+        return -1;
+    else
+        return 0;
+}
+
+OpcodeStats::~OpcodeStats()
+{
+    long long totalInstructions = 0;
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        totalInstructions += opcodeCounts[i];
+    
+    long long totalInstructionPairs = 0;
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        for (int j = 0; j < numOpcodeIDs; ++j)
+            totalInstructionPairs += opcodePairCounts[i][j];
+
+    std::array<int, numOpcodeIDs> sortedIndices;
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        sortedIndices[i] = i;
+    qsort(sortedIndices.data(), numOpcodeIDs, sizeof(int), compareOpcodeIndices);
+    
+    std::pair<int, int> sortedPairIndices[numOpcodeIDs * numOpcodeIDs];
+    std::pair<int, int>* currentPairIndex = sortedPairIndices;
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        for (int j = 0; j < numOpcodeIDs; ++j)
+            *(currentPairIndex++) = std::make_pair(i, j);
+    qsort(sortedPairIndices, numOpcodeIDs * numOpcodeIDs, sizeof(std::pair<int, int>), compareOpcodePairIndices);
+    
+    dataLogF("\nExecuted opcode statistics\n"); 
+    
+    dataLogF("Total instructions executed: %lld\n\n", totalInstructions);
+
+    dataLogF("All opcodes by frequency:\n\n");
+
+    for (int i = 0; i < numOpcodeIDs; ++i) {
+        int index = sortedIndices[i];
+        dataLogF("%s:%s %lld - %.2f%%\n", opcodeNames[index], padOpcodeName((OpcodeID)index, 28), opcodeCounts[index], ((double) opcodeCounts[index]) / ((double) totalInstructions) * 100.0);    
+    }
+    
+    dataLogF("\n");
+    dataLogF("2-opcode sequences by frequency: %lld\n\n", totalInstructions);
+    
+    for (int i = 0; i < numOpcodeIDs * numOpcodeIDs; ++i) {
+        std::pair<int, int> indexPair = sortedPairIndices[i];
+        long long count = opcodePairCounts[indexPair.first][indexPair.second];
+        
+        if (!count)
+            break;
+        
+        dataLogF("%s%s %s:%s %lld %.2f%%\n", opcodeNames[indexPair.first], padOpcodeName((OpcodeID)indexPair.first, 28), opcodeNames[indexPair.second], padOpcodeName((OpcodeID)indexPair.second, 28), count, ((double) count) / ((double) totalInstructionPairs) * 100.0);
+    }
+    
+    dataLogF("\n");
+    dataLogF("Most common opcodes and sequences:\n");
+
+    for (int i = 0; i < numOpcodeIDs; ++i) {
+        int index = sortedIndices[i];
+        long long opcodeCount = opcodeCounts[index];
+        double opcodeProportion = ((double) opcodeCount) / ((double) totalInstructions);
+        if (opcodeProportion < 0.0001)
+            break;
+        dataLogF("\n%s:%s %lld - %.2f%%\n", opcodeNames[index], padOpcodeName((OpcodeID)index, 28), opcodeCount, opcodeProportion * 100.0);
+
+        for (int j = 0; j < numOpcodeIDs * numOpcodeIDs; ++j) {
+            std::pair<int, int> indexPair = sortedPairIndices[j];
+            long long pairCount = opcodePairCounts[indexPair.first][indexPair.second];
+            double pairProportion = ((double) pairCount) / ((double) totalInstructionPairs);
+        
+            if (!pairCount || pairProportion < 0.0001 || pairProportion < opcodeProportion / 100)
+                break;
+
+            if (indexPair.first != index && indexPair.second != index)
+                continue;
+
+            dataLogF("    %s%s %s:%s %lld - %.2f%%\n", opcodeNames[indexPair.first], padOpcodeName((OpcodeID)indexPair.first, 28), opcodeNames[indexPair.second], padOpcodeName((OpcodeID)indexPair.second, 28), pairCount, pairProportion * 100.0);
+        }
+        
+    }
+    dataLogF("\n");
+}
+
+void OpcodeStats::recordInstruction(int opcode)
+{
+    opcodeCounts[opcode]++;
+    
+    if (lastOpcode != -1)
+        opcodePairCounts[lastOpcode][opcode]++;
+    
+    lastOpcode = opcode;
+}
+
+void OpcodeStats::resetLastInstruction()
+{
+    lastOpcode = -1;
+}
+
+#endif
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, OpcodeID opcode)
+{
+    out.print(opcodeNames[opcode]);
+}
+
+} // namespace WTF
diff --git a/bytecode/Opcode.h b/bytecode/Opcode.h
new file mode 100644
index 0000000..41c8509
--- /dev/null
+++ b/bytecode/Opcode.h
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2008, 2009, 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Bytecodes.h"
+#include "LLIntOpcode.h"
+
+#include <algorithm>
+#include <string.h>
+
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+#define FOR_EACH_CORE_OPCODE_ID_WITH_EXTENSION(macro, extension__) \
+    FOR_EACH_BYTECODE_ID(macro) \
+    extension__
+
+#define FOR_EACH_CORE_OPCODE_ID(macro) \
+    FOR_EACH_CORE_OPCODE_ID_WITH_EXTENSION(macro, /* No extension */ )
+
+#define FOR_EACH_OPCODE_ID(macro) \
+    FOR_EACH_CORE_OPCODE_ID_WITH_EXTENSION( \
+        macro, \
+        FOR_EACH_LLINT_OPCODE_EXTENSION(macro) \
+    )
+
+
+#define OPCODE_ID_ENUM(opcode, length) opcode,
+    enum OpcodeID : unsigned { FOR_EACH_OPCODE_ID(OPCODE_ID_ENUM) };
+#undef OPCODE_ID_ENUM
+
+const int maxOpcodeLength = 9;
+#if !ENABLE(JIT)
+const int numOpcodeIDs = NUMBER_OF_BYTECODE_IDS + NUMBER_OF_CLOOP_BYTECODE_HELPER_IDS + NUMBER_OF_BYTECODE_HELPER_IDS;
+#else
+const int numOpcodeIDs = NUMBER_OF_BYTECODE_IDS + NUMBER_OF_BYTECODE_HELPER_IDS;
+#endif
+
+#define OPCODE_ID_LENGTHS(id, length) const int id##_length = length;
+    FOR_EACH_OPCODE_ID(OPCODE_ID_LENGTHS);
+#undef OPCODE_ID_LENGTHS
+
+#define OPCODE_LENGTH(opcode) opcode##_length
+
+#define OPCODE_ID_LENGTH_MAP(opcode, length) length,
+    const int opcodeLengths[numOpcodeIDs] = { FOR_EACH_OPCODE_ID(OPCODE_ID_LENGTH_MAP) };
+#undef OPCODE_ID_LENGTH_MAP
+
+#if COMPILER(GCC)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wtype-limits"
+#endif
+
+#define VERIFY_OPCODE_ID(id, size) COMPILE_ASSERT(id <= numOpcodeIDs, ASSERT_THAT_JS_OPCODE_IDS_ARE_VALID);
+    FOR_EACH_OPCODE_ID(VERIFY_OPCODE_ID);
+#undef VERIFY_OPCODE_ID
+
+#if COMPILER(GCC)
+#pragma GCC diagnostic pop
+#endif
+
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+typedef void* Opcode;
+#else
+typedef OpcodeID Opcode;
+#endif
+
+#define PADDING_STRING "                                "
+#define PADDING_STRING_LENGTH static_cast<unsigned>(strlen(PADDING_STRING))
+
+extern const char* const opcodeNames[];
+
+inline const char* padOpcodeName(OpcodeID op, unsigned width)
+{
+    unsigned pad = width - strlen(opcodeNames[op]);
+    pad = std::min(pad, PADDING_STRING_LENGTH);
+    return PADDING_STRING + PADDING_STRING_LENGTH - pad;
+}
+
+#undef PADDING_STRING_LENGTH
+#undef PADDING_STRING
+
+#if ENABLE(OPCODE_STATS)
+
+struct OpcodeStats {
+    OpcodeStats();
+    ~OpcodeStats();
+    static long long opcodeCounts[numOpcodeIDs];
+    static long long opcodePairCounts[numOpcodeIDs][numOpcodeIDs];
+    static int lastOpcode;
+    
+    static void recordInstruction(int opcode);
+    static void resetLastInstruction();
+};
+
+#endif
+
+inline size_t opcodeLength(OpcodeID opcode)
+{
+    switch (opcode) {
+#define OPCODE_ID_LENGTHS(id, length) case id: return OPCODE_LENGTH(id);
+         FOR_EACH_OPCODE_ID(OPCODE_ID_LENGTHS)
+#undef OPCODE_ID_LENGTHS
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+inline bool isBranch(OpcodeID opcodeID)
+{
+    switch (opcodeID) {
+    case op_jmp:
+    case op_jtrue:
+    case op_jfalse:
+    case op_jeq_null:
+    case op_jneq_null:
+    case op_jneq_ptr:
+    case op_jless:
+    case op_jlesseq:
+    case op_jgreater:
+    case op_jgreatereq:
+    case op_jnless:
+    case op_jnlesseq:
+    case op_jngreater:
+    case op_jngreatereq:
+    case op_switch_imm:
+    case op_switch_char:
+    case op_switch_string:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool isUnconditionalBranch(OpcodeID opcodeID)
+{
+    switch (opcodeID) {
+    case op_jmp:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool isTerminal(OpcodeID opcodeID)
+{
+    switch (opcodeID) {
+    case op_ret:
+    case op_end:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool isThrow(OpcodeID opcodeID)
+{
+    switch (opcodeID) {
+    case op_throw:
+    case op_throw_static_error:
+        return true;
+    default:
+        return false;
+    }
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::OpcodeID);
+
+} // namespace WTF
diff --git a/bytecode/Operands.h b/bytecode/Operands.h
new file mode 100644
index 0000000..1028798
--- /dev/null
+++ b/bytecode/Operands.h
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) 2011, 2012, 2013, 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "JSObject.h"
+#include "VirtualRegister.h"
+
+#include <wtf/PrintStream.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+template<typename T> struct OperandValueTraits;
+
+enum OperandKind { ArgumentOperand, LocalOperand };
+
+enum OperandsLikeTag { OperandsLike };
+
+template<typename T>
+class Operands {
+public:
+    Operands() { }
+    
+    explicit Operands(size_t numArguments, size_t numLocals)
+    {
+        if (WTF::VectorTraits<T>::needsInitialization) {
+            m_arguments.resize(numArguments);
+            m_locals.resize(numLocals);
+        } else {
+            m_arguments.fill(T(), numArguments);
+            m_locals.fill(T(), numLocals);
+        }
+    }
+
+    explicit Operands(size_t numArguments, size_t numLocals, const T& initialValue)
+    {
+        m_arguments.fill(initialValue, numArguments);
+        m_locals.fill(initialValue, numLocals);
+    }
+    
+    template<typename U>
+    explicit Operands(OperandsLikeTag, const Operands<U>& other)
+    {
+        m_arguments.fill(T(), other.numberOfArguments());
+        m_locals.fill(T(), other.numberOfLocals());
+    }
+    
+    size_t numberOfArguments() const { return m_arguments.size(); }
+    size_t numberOfLocals() const { return m_locals.size(); }
+    
+    T& argument(size_t idx) { return m_arguments[idx]; }
+    const T& argument(size_t idx) const { return m_arguments[idx]; }
+    
+    T& local(size_t idx) { return m_locals[idx]; }
+    const T& local(size_t idx) const { return m_locals[idx]; }
+    
+    template<OperandKind operandKind>
+    size_t sizeFor() const
+    {
+        if (operandKind == ArgumentOperand)
+            return numberOfArguments();
+        return numberOfLocals();
+    }
+    template<OperandKind operandKind>
+    T& atFor(size_t idx)
+    {
+        if (operandKind == ArgumentOperand)
+            return argument(idx);
+        return local(idx);
+    }
+    template<OperandKind operandKind>
+    const T& atFor(size_t idx) const
+    {
+        if (operandKind == ArgumentOperand)
+            return argument(idx);
+        return local(idx);
+    }
+    
+    void ensureLocals(size_t size)
+    {
+        if (size <= m_locals.size())
+            return;
+
+        size_t oldSize = m_locals.size();
+        m_locals.resize(size);
+        if (!WTF::VectorTraits<T>::needsInitialization) {
+            for (size_t i = oldSize; i < m_locals.size(); ++i)
+                m_locals[i] = T();
+        }
+    }
+
+    void ensureLocals(size_t size, const T& ensuredValue)
+    {
+        if (size <= m_locals.size())
+            return;
+
+        size_t oldSize = m_locals.size();
+        m_locals.resize(size);
+        for (size_t i = oldSize; i < m_locals.size(); ++i)
+            m_locals[i] = ensuredValue;
+    }
+    
+    void setLocal(size_t idx, const T& value)
+    {
+        ensureLocals(idx + 1);
+        
+        m_locals[idx] = value;
+    }
+    
+    T getLocal(size_t idx)
+    {
+        if (idx >= m_locals.size())
+            return T();
+        return m_locals[idx];
+    }
+    
+    void setArgumentFirstTime(size_t idx, const T& value)
+    {
+        ASSERT(m_arguments[idx] == T());
+        argument(idx) = value;
+    }
+    
+    void setLocalFirstTime(size_t idx, const T& value)
+    {
+        ASSERT(idx >= m_locals.size() || m_locals[idx] == T());
+        setLocal(idx, value);
+    }
+    
+    T& operand(int operand)
+    {
+        if (operandIsArgument(operand)) {
+            int argument = VirtualRegister(operand).toArgument();
+            return m_arguments[argument];
+        }
+
+        return m_locals[VirtualRegister(operand).toLocal()];
+    }
+
+    T& operand(VirtualRegister virtualRegister)
+    {
+        return operand(virtualRegister.offset());
+    }
+
+    const T& operand(int operand) const { return const_cast<const T&>(const_cast<Operands*>(this)->operand(operand)); }
+    const T& operand(VirtualRegister operand) const { return const_cast<const T&>(const_cast<Operands*>(this)->operand(operand)); }
+    
+    bool hasOperand(int operand) const
+    {
+        if (operandIsArgument(operand))
+            return true;
+        return static_cast<size_t>(VirtualRegister(operand).toLocal()) < numberOfLocals();
+    }
+    bool hasOperand(VirtualRegister reg) const
+    {
+        return hasOperand(reg.offset());
+    }
+    
+    void setOperand(int operand, const T& value)
+    {
+        if (operandIsArgument(operand)) {
+            int argument = VirtualRegister(operand).toArgument();
+            m_arguments[argument] = value;
+            return;
+        }
+        
+        setLocal(VirtualRegister(operand).toLocal(), value);
+    }
+    
+    void setOperand(VirtualRegister virtualRegister, const T& value)
+    {
+        setOperand(virtualRegister.offset(), value);
+    }
+
+    size_t size() const { return numberOfArguments() + numberOfLocals(); }
+    const T& at(size_t index) const
+    {
+        if (index < numberOfArguments())
+            return m_arguments[index];
+        return m_locals[index - numberOfArguments()];
+    }
+    T& at(size_t index)
+    {
+        if (index < numberOfArguments())
+            return m_arguments[index];
+        return m_locals[index - numberOfArguments()];
+    }
+    const T& operator[](size_t index) const { return at(index); }
+    T& operator[](size_t index) { return at(index); }
+
+    bool isArgument(size_t index) const { return index < numberOfArguments(); }
+    bool isVariable(size_t index) const { return !isArgument(index); }
+    int argumentForIndex(size_t index) const
+    {
+        return index;
+    }
+    int variableForIndex(size_t index) const
+    {
+        return index - m_arguments.size();
+    }
+    int operandForIndex(size_t index) const
+    {
+        if (index < numberOfArguments())
+            return virtualRegisterForArgument(index).offset();
+        return virtualRegisterForLocal(index - numberOfArguments()).offset();
+    }
+    VirtualRegister virtualRegisterForIndex(size_t index) const
+    {
+        return VirtualRegister(operandForIndex(index));
+    }
+    size_t indexForOperand(int operand) const
+    {
+        if (operandIsArgument(operand))
+            return static_cast<size_t>(VirtualRegister(operand).toArgument());
+        return static_cast<size_t>(VirtualRegister(operand).toLocal()) + numberOfArguments();
+    }
+    size_t indexForOperand(VirtualRegister reg) const
+    {
+        return indexForOperand(reg.offset());
+    }
+    
+    void setOperandFirstTime(int operand, const T& value)
+    {
+        if (operandIsArgument(operand)) {
+            setArgumentFirstTime(VirtualRegister(operand).toArgument(), value);
+            return;
+        }
+        
+        setLocalFirstTime(VirtualRegister(operand).toLocal(), value);
+    }
+    
+    void fill(T value)
+    {
+        for (size_t i = 0; i < m_arguments.size(); ++i)
+            m_arguments[i] = value;
+        for (size_t i = 0; i < m_locals.size(); ++i)
+            m_locals[i] = value;
+    }
+    
+    void clear()
+    {
+        fill(T());
+    }
+    
+    bool operator==(const Operands& other) const
+    {
+        ASSERT(numberOfArguments() == other.numberOfArguments());
+        ASSERT(numberOfLocals() == other.numberOfLocals());
+        
+        return m_arguments == other.m_arguments && m_locals == other.m_locals;
+    }
+    
+    void dumpInContext(PrintStream& out, DumpContext* context) const;
+    void dump(PrintStream& out) const;
+    
+private:
+    Vector<T, 8> m_arguments;
+    Vector<T, 16> m_locals;
+};
+
+} // namespace JSC
diff --git a/bytecode/OperandsInlines.h b/bytecode/OperandsInlines.h
new file mode 100644
index 0000000..65fedda
--- /dev/null
+++ b/bytecode/OperandsInlines.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Operands.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+template<typename T>
+void Operands<T>::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    CommaPrinter comma(" ");
+    for (size_t argumentIndex = numberOfArguments(); argumentIndex--;) {
+        if (!argument(argumentIndex))
+            continue;
+        out.print(comma, "arg", argumentIndex, ":", inContext(argument(argumentIndex), context));
+    }
+    for (size_t localIndex = 0; localIndex < numberOfLocals(); ++localIndex) {
+        if (!local(localIndex))
+            continue;
+        out.print(comma, "loc", localIndex, ":", inContext(local(localIndex), context));
+    }
+}
+
+template<typename T>
+void Operands<T>::dump(PrintStream& out) const
+{
+    CommaPrinter comma(" ");
+    for (size_t argumentIndex = numberOfArguments(); argumentIndex--;) {
+        if (!argument(argumentIndex))
+            continue;
+        out.print(comma, "arg", argumentIndex, ":", argument(argumentIndex));
+    }
+    for (size_t localIndex = 0; localIndex < numberOfLocals(); ++localIndex) {
+        if (!local(localIndex))
+            continue;
+        out.print(comma, "loc", localIndex, ":", local(localIndex));
+    }
+}
+
+} // namespace JSC
diff --git a/bytecode/PolymorphicAccess.cpp b/bytecode/PolymorphicAccess.cpp
new file mode 100644
index 0000000..fae6081
--- /dev/null
+++ b/bytecode/PolymorphicAccess.cpp
@@ -0,0 +1,2061 @@
+/*
+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PolymorphicAccess.h"
+
+#if ENABLE(JIT)
+
+#include "BinarySwitch.h"
+#include "CCallHelpers.h"
+#include "CodeBlock.h"
+#include "DOMJITAccessCasePatchpointParams.h"
+#include "DOMJITCallDOMGetterPatchpoint.h"
+#include "DirectArguments.h"
+#include "GetterSetter.h"
+#include "Heap.h"
+#include "JITOperations.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "ScopedArguments.h"
+#include "ScratchRegisterAllocator.h"
+#include "StructureStubClearingWatchpoint.h"
+#include "StructureStubInfo.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+static const bool verbose = false;
+
+void AccessGenerationResult::dump(PrintStream& out) const
+{
+    out.print(m_kind);
+    if (m_code)
+        out.print(":", m_code);
+}
+
+Watchpoint* AccessGenerationState::addWatchpoint(const ObjectPropertyCondition& condition)
+{
+    return WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint(
+        watchpoints, jit->codeBlock(), stubInfo, condition);
+}
+
+void AccessGenerationState::restoreScratch()
+{
+    allocator->restoreReusedRegistersByPopping(*jit, preservedReusedRegisterState);
+}
+
+void AccessGenerationState::succeed()
+{
+    restoreScratch();
+    success.append(jit->jump());
+}
+
+const RegisterSet& AccessGenerationState::liveRegistersForCall()
+{
+    if (!m_calculatedRegistersForCallAndExceptionHandling)
+        calculateLiveRegistersForCallAndExceptionHandling();
+    return m_liveRegistersForCall;
+}
+
+const RegisterSet& AccessGenerationState::liveRegistersToPreserveAtExceptionHandlingCallSite()
+{
+    if (!m_calculatedRegistersForCallAndExceptionHandling)
+        calculateLiveRegistersForCallAndExceptionHandling();
+    return m_liveRegistersToPreserveAtExceptionHandlingCallSite;
+}
+
+static RegisterSet calleeSaveRegisters()
+{
+    RegisterSet result = RegisterSet::registersToNotSaveForJSCall();
+    result.filter(RegisterSet::registersToNotSaveForCCall());
+    return result;
+}
+
+const RegisterSet& AccessGenerationState::calculateLiveRegistersForCallAndExceptionHandling()
+{
+    if (!m_calculatedRegistersForCallAndExceptionHandling) {
+        m_calculatedRegistersForCallAndExceptionHandling = true;
+
+        m_liveRegistersToPreserveAtExceptionHandlingCallSite = jit->codeBlock()->jitCode()->liveRegistersToPreserveAtExceptionHandlingCallSite(jit->codeBlock(), stubInfo->callSiteIndex);
+        m_needsToRestoreRegistersIfException = m_liveRegistersToPreserveAtExceptionHandlingCallSite.numberOfSetRegisters() > 0;
+        if (m_needsToRestoreRegistersIfException)
+            RELEASE_ASSERT(JITCode::isOptimizingJIT(jit->codeBlock()->jitType()));
+
+        m_liveRegistersForCall = RegisterSet(m_liveRegistersToPreserveAtExceptionHandlingCallSite, allocator->usedRegisters());
+        m_liveRegistersForCall.exclude(calleeSaveRegisters());
+    }
+    return m_liveRegistersForCall;
+}
+
+auto AccessGenerationState::preserveLiveRegistersToStackForCall(const RegisterSet& extra) -> SpillState
+{
+    RegisterSet liveRegisters = liveRegistersForCall();
+    liveRegisters.merge(extra);
+    
+    unsigned extraStackPadding = 0;
+    unsigned numberOfStackBytesUsedForRegisterPreservation = ScratchRegisterAllocator::preserveRegistersToStackForCall(*jit, liveRegisters, extraStackPadding);
+    return SpillState {
+        WTFMove(liveRegisters),
+        numberOfStackBytesUsedForRegisterPreservation
+    };
+}
+
+void AccessGenerationState::restoreLiveRegistersFromStackForCallWithThrownException(const SpillState& spillState)
+{
+    // Even if we're a getter, we don't want to ignore the result value like we normally do
+    // because the getter threw, and therefore, didn't return a value that means anything.
+    // Instead, we want to restore that register to what it was upon entering the getter
+    // inline cache. The subtlety here is if the base and the result are the same register,
+    // and the getter threw, we want OSR exit to see the original base value, not the result
+    // of the getter call.
+    RegisterSet dontRestore = spillState.spilledRegisters;
+    // As an optimization here, we only need to restore what is live for exception handling.
+    // We can construct the dontRestore set to accomplish this goal by having it contain only
+    // what is live for call but not live for exception handling. By ignoring things that are
+    // only live at the call but not the exception handler, we will only restore things live
+    // at the exception handler.
+    dontRestore.exclude(liveRegistersToPreserveAtExceptionHandlingCallSite());
+    restoreLiveRegistersFromStackForCall(spillState, dontRestore);
+}
+
+void AccessGenerationState::restoreLiveRegistersFromStackForCall(const SpillState& spillState, const RegisterSet& dontRestore)
+{
+    unsigned extraStackPadding = 0;
+    ScratchRegisterAllocator::restoreRegistersFromStackForCall(*jit, spillState.spilledRegisters, dontRestore, spillState.numberOfStackBytesUsedForRegisterPreservation, extraStackPadding);
+}
+
+CallSiteIndex AccessGenerationState::callSiteIndexForExceptionHandlingOrOriginal()
+{
+    if (!m_calculatedRegistersForCallAndExceptionHandling)
+        calculateLiveRegistersForCallAndExceptionHandling();
+
+    if (!m_calculatedCallSiteIndex) {
+        m_calculatedCallSiteIndex = true;
+
+        if (m_needsToRestoreRegistersIfException)
+            m_callSiteIndex = jit->codeBlock()->newExceptionHandlingCallSiteIndex(stubInfo->callSiteIndex);
+        else
+            m_callSiteIndex = originalCallSiteIndex();
+    }
+
+    return m_callSiteIndex;
+}
+
+const HandlerInfo& AccessGenerationState::originalExceptionHandler()
+{
+    if (!m_calculatedRegistersForCallAndExceptionHandling)
+        calculateLiveRegistersForCallAndExceptionHandling();
+
+    RELEASE_ASSERT(m_needsToRestoreRegistersIfException);
+    HandlerInfo* exceptionHandler = jit->codeBlock()->handlerForIndex(stubInfo->callSiteIndex.bits());
+    RELEASE_ASSERT(exceptionHandler);
+    return *exceptionHandler;
+}
+
+CallSiteIndex AccessGenerationState::originalCallSiteIndex() const { return stubInfo->callSiteIndex; }
+
+void AccessGenerationState::emitExplicitExceptionHandler()
+{
+    restoreScratch();
+    jit->copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+    if (needsToRestoreRegistersIfException()) {
+        // To the JIT that produces the original exception handling
+        // call site, they will expect the OSR exit to be arrived
+        // at from genericUnwind. Therefore we must model what genericUnwind
+        // does here. I.e, set callFrameForCatch and copy callee saves.
+
+        jit->storePtr(GPRInfo::callFrameRegister, jit->vm()->addressOfCallFrameForCatch());
+        CCallHelpers::Jump jumpToOSRExitExceptionHandler = jit->jump();
+
+        // We don't need to insert a new exception handler in the table
+        // because we're doing a manual exception check here. i.e, we'll
+        // never arrive here from genericUnwind().
+        HandlerInfo originalHandler = originalExceptionHandler();
+        jit->addLinkTask(
+            [=] (LinkBuffer& linkBuffer) {
+                linkBuffer.link(jumpToOSRExitExceptionHandler, originalHandler.nativeCode);
+            });
+    } else {
+        jit->setupArguments(CCallHelpers::TrustedImmPtr(jit->vm()), GPRInfo::callFrameRegister);
+        CCallHelpers::Call lookupExceptionHandlerCall = jit->call();
+        jit->addLinkTask(
+            [=] (LinkBuffer& linkBuffer) {
+                linkBuffer.link(lookupExceptionHandlerCall, lookupExceptionHandler);
+            });
+        jit->jumpToExceptionHandler();
+    }
+}
+
+AccessCase::AccessCase()
+{
+}
+
+std::unique_ptr<AccessCase> AccessCase::tryGet(
+    VM& vm, JSCell* owner, AccessType type, PropertyOffset offset, Structure* structure,
+    const ObjectPropertyConditionSet& conditionSet, bool viaProxy, WatchpointSet* additionalSet)
+{
+    std::unique_ptr<AccessCase> result(new AccessCase());
+
+    result->m_type = type;
+    result->m_offset = offset;
+    result->m_structure.set(vm, owner, structure);
+    result->m_conditionSet = conditionSet;
+
+    if (viaProxy || additionalSet) {
+        result->m_rareData = std::make_unique<RareData>();
+        result->m_rareData->viaProxy = viaProxy;
+        result->m_rareData->additionalSet = additionalSet;
+    }
+
+    return result;
+}
+
+std::unique_ptr<AccessCase> AccessCase::get(
+    VM& vm, JSCell* owner, AccessType type, PropertyOffset offset, Structure* structure,
+    const ObjectPropertyConditionSet& conditionSet, bool viaProxy, WatchpointSet* additionalSet,
+    PropertySlot::GetValueFunc customGetter, JSObject* customSlotBase, DOMJIT::GetterSetter* domJIT)
+{
+    std::unique_ptr<AccessCase> result(new AccessCase());
+
+    result->m_type = type;
+    result->m_offset = offset;
+    result->m_structure.set(vm, owner, structure);
+    result->m_conditionSet = conditionSet;
+
+    if (viaProxy || additionalSet || result->doesCalls() || customGetter || customSlotBase || domJIT) {
+        result->m_rareData = std::make_unique<RareData>();
+        result->m_rareData->viaProxy = viaProxy;
+        result->m_rareData->additionalSet = additionalSet;
+        result->m_rareData->customAccessor.getter = customGetter;
+        result->m_rareData->customSlotBase.setMayBeNull(vm, owner, customSlotBase);
+        result->m_rareData->domJIT = domJIT;
+    }
+
+    return result;
+}
+
+std::unique_ptr<AccessCase> AccessCase::megamorphicLoad(VM& vm, JSCell* owner)
+{
+    UNUSED_PARAM(vm);
+    UNUSED_PARAM(owner);
+    
+    if (GPRInfo::numberOfRegisters < 9)
+        return nullptr;
+    
+    std::unique_ptr<AccessCase> result(new AccessCase());
+    
+    result->m_type = MegamorphicLoad;
+    
+    return result;
+}
+
+std::unique_ptr<AccessCase> AccessCase::replace(
+    VM& vm, JSCell* owner, Structure* structure, PropertyOffset offset)
+{
+    std::unique_ptr<AccessCase> result(new AccessCase());
+
+    result->m_type = Replace;
+    result->m_offset = offset;
+    result->m_structure.set(vm, owner, structure);
+
+    return result;
+}
+
+std::unique_ptr<AccessCase> AccessCase::transition(
+    VM& vm, JSCell* owner, Structure* oldStructure, Structure* newStructure, PropertyOffset offset,
+    const ObjectPropertyConditionSet& conditionSet)
+{
+    RELEASE_ASSERT(oldStructure == newStructure->previousID());
+
+    // Skip optimizing the case where we need a realloc, if we don't have
+    // enough registers to make it happen.
+    if (GPRInfo::numberOfRegisters < 6
+        && oldStructure->outOfLineCapacity() != newStructure->outOfLineCapacity()
+        && oldStructure->outOfLineCapacity()) {
+        return nullptr;
+    }
+
+    std::unique_ptr<AccessCase> result(new AccessCase());
+
+    result->m_type = Transition;
+    result->m_offset = offset;
+    result->m_structure.set(vm, owner, newStructure);
+    result->m_conditionSet = conditionSet;
+
+    return result;
+}
+
+std::unique_ptr<AccessCase> AccessCase::setter(
+    VM& vm, JSCell* owner, AccessType type, Structure* structure, PropertyOffset offset,
+    const ObjectPropertyConditionSet& conditionSet, PutPropertySlot::PutValueFunc customSetter,
+    JSObject* customSlotBase)
+{
+    std::unique_ptr<AccessCase> result(new AccessCase());
+
+    result->m_type = type;
+    result->m_offset = offset;
+    result->m_structure.set(vm, owner, structure);
+    result->m_conditionSet = conditionSet;
+    result->m_rareData = std::make_unique<RareData>();
+    result->m_rareData->customAccessor.setter = customSetter;
+    result->m_rareData->customSlotBase.setMayBeNull(vm, owner, customSlotBase);
+
+    return result;
+}
+
+std::unique_ptr<AccessCase> AccessCase::in(
+    VM& vm, JSCell* owner, AccessType type, Structure* structure,
+    const ObjectPropertyConditionSet& conditionSet)
+{
+    std::unique_ptr<AccessCase> result(new AccessCase());
+
+    result->m_type = type;
+    result->m_structure.set(vm, owner, structure);
+    result->m_conditionSet = conditionSet;
+
+    return result;
+}
+
+std::unique_ptr<AccessCase> AccessCase::getLength(VM&, JSCell*, AccessType type)
+{
+    std::unique_ptr<AccessCase> result(new AccessCase());
+
+    result->m_type = type;
+
+    return result;
+}
+
+std::unique_ptr<AccessCase> AccessCase::getIntrinsic(
+    VM& vm, JSCell* owner, JSFunction* getter, PropertyOffset offset,
+    Structure* structure, const ObjectPropertyConditionSet& conditionSet)
+{
+    std::unique_ptr<AccessCase> result(new AccessCase());
+
+    result->m_type = IntrinsicGetter;
+    result->m_structure.set(vm, owner, structure);
+    result->m_conditionSet = conditionSet;
+    result->m_offset = offset;
+
+    result->m_rareData = std::make_unique<RareData>();
+    result->m_rareData->intrinsicFunction.set(vm, owner, getter);
+
+    return result;
+}
+
+AccessCase::~AccessCase()
+{
+}
+
+std::unique_ptr<AccessCase> AccessCase::fromStructureStubInfo(
+    VM& vm, JSCell* owner, StructureStubInfo& stubInfo)
+{
+    switch (stubInfo.cacheType) {
+    case CacheType::GetByIdSelf:
+        return get(
+            vm, owner, Load, stubInfo.u.byIdSelf.offset,
+            stubInfo.u.byIdSelf.baseObjectStructure.get());
+
+    case CacheType::PutByIdReplace:
+        return replace(
+            vm, owner, stubInfo.u.byIdSelf.baseObjectStructure.get(), stubInfo.u.byIdSelf.offset);
+
+    default:
+        return nullptr;
+    }
+}
+
+std::unique_ptr<AccessCase> AccessCase::clone() const
+{
+    std::unique_ptr<AccessCase> result(new AccessCase());
+    result->m_type = m_type;
+    result->m_offset = m_offset;
+    result->m_structure = m_structure;
+    result->m_conditionSet = m_conditionSet;
+    if (RareData* rareData = m_rareData.get()) {
+        result->m_rareData = std::make_unique<RareData>();
+        result->m_rareData->viaProxy = rareData->viaProxy;
+        result->m_rareData->additionalSet = rareData->additionalSet;
+        // NOTE: We don't copy the callLinkInfo, since that's created during code generation.
+        result->m_rareData->customAccessor.opaque = rareData->customAccessor.opaque;
+        result->m_rareData->customSlotBase = rareData->customSlotBase;
+        result->m_rareData->intrinsicFunction = rareData->intrinsicFunction;
+        result->m_rareData->domJIT = rareData->domJIT;
+    }
+    return result;
+}
+
+Vector<WatchpointSet*, 2> AccessCase::commit(VM& vm, const Identifier& ident)
+{
+    // It's fine to commit something that is already committed. That arises when we switch to using
+    // newly allocated watchpoints. When it happens, it's not efficient - but we think that's OK
+    // because most AccessCases have no extra watchpoints anyway.
+    RELEASE_ASSERT(m_state == Primordial || m_state == Committed);
+    
+    Vector<WatchpointSet*, 2> result;
+    
+    if ((structure() && structure()->needImpurePropertyWatchpoint())
+        || m_conditionSet.needImpurePropertyWatchpoint())
+        result.append(vm.ensureWatchpointSetForImpureProperty(ident));
+
+    if (additionalSet())
+        result.append(additionalSet());
+    
+    m_state = Committed;
+    
+    return result;
+}
+
+bool AccessCase::guardedByStructureCheck() const
+{
+    if (viaProxy())
+        return false;
+
+    switch (m_type) {
+    case MegamorphicLoad:
+    case ArrayLength:
+    case StringLength:
+    case DirectArgumentsLength:
+    case ScopedArgumentsLength:
+        return false;
+    default:
+        return true;
+    }
+}
+
+JSObject* AccessCase::alternateBase() const
+{
+    if (customSlotBase())
+        return customSlotBase();
+    return conditionSet().slotBaseCondition().object();
+}
+
+bool AccessCase::doesCalls(Vector<JSCell*>* cellsToMark) const
+{
+    switch (type()) {
+    case Getter:
+    case Setter:
+    case CustomValueGetter:
+    case CustomAccessorGetter:
+    case CustomValueSetter:
+    case CustomAccessorSetter:
+        return true;
+    case Transition:
+        if (newStructure()->outOfLineCapacity() != structure()->outOfLineCapacity()
+            && structure()->couldHaveIndexingHeader()) {
+            if (cellsToMark)
+                cellsToMark->append(newStructure());
+            return true;
+        }
+        return false;
+    default:
+        return false;
+    }
+}
+
+bool AccessCase::couldStillSucceed() const
+{
+    return m_conditionSet.structuresEnsureValidityAssumingImpurePropertyWatchpoint();
+}
+
+bool AccessCase::canBeReplacedByMegamorphicLoad() const
+{
+    if (type() == MegamorphicLoad)
+        return true;
+    
+    return type() == Load
+        && !viaProxy()
+        && conditionSet().isEmpty()
+        && !additionalSet()
+        && !customSlotBase();
+}
+
+bool AccessCase::canReplace(const AccessCase& other) const
+{
+    // This puts in a good effort to try to figure out if 'other' is made superfluous by '*this'.
+    // It's fine for this to return false if it's in doubt.
+
+    switch (type()) {
+    case MegamorphicLoad:
+        return other.canBeReplacedByMegamorphicLoad();
+    case ArrayLength:
+    case StringLength:
+    case DirectArgumentsLength:
+    case ScopedArgumentsLength:
+        return other.type() == type();
+    default:
+        if (!guardedByStructureCheck() || !other.guardedByStructureCheck())
+            return false;
+        
+        return structure() == other.structure();
+    }
+}
+
+void AccessCase::dump(PrintStream& out) const
+{
+    out.print(m_type, ":(");
+
+    CommaPrinter comma;
+    
+    out.print(comma, m_state);
+
+    if (m_type == Transition)
+        out.print(comma, "structure = ", pointerDump(structure()), " -> ", pointerDump(newStructure()));
+    else if (m_structure)
+        out.print(comma, "structure = ", pointerDump(m_structure.get()));
+
+    if (isValidOffset(m_offset))
+        out.print(comma, "offset = ", m_offset);
+    if (!m_conditionSet.isEmpty())
+        out.print(comma, "conditions = ", m_conditionSet);
+
+    if (RareData* rareData = m_rareData.get()) {
+        if (rareData->viaProxy)
+            out.print(comma, "viaProxy = ", rareData->viaProxy);
+        if (rareData->additionalSet)
+            out.print(comma, "additionalSet = ", RawPointer(rareData->additionalSet.get()));
+        if (rareData->callLinkInfo)
+            out.print(comma, "callLinkInfo = ", RawPointer(rareData->callLinkInfo.get()));
+        if (rareData->customAccessor.opaque)
+            out.print(comma, "customAccessor = ", RawPointer(rareData->customAccessor.opaque));
+        if (rareData->customSlotBase)
+            out.print(comma, "customSlotBase = ", RawPointer(rareData->customSlotBase.get()));
+    }
+
+    out.print(")");
+}
+
+bool AccessCase::visitWeak(VM& vm) const
+{
+    if (m_structure && !Heap::isMarked(m_structure.get()))
+        return false;
+    if (!m_conditionSet.areStillLive())
+        return false;
+    if (m_rareData) {
+        if (m_rareData->callLinkInfo)
+            m_rareData->callLinkInfo->visitWeak(vm);
+        if (m_rareData->customSlotBase && !Heap::isMarked(m_rareData->customSlotBase.get()))
+            return false;
+        if (m_rareData->intrinsicFunction && !Heap::isMarked(m_rareData->intrinsicFunction.get()))
+            return false;
+    }
+    return true;
+}
+
+bool AccessCase::propagateTransitions(SlotVisitor& visitor) const
+{
+    bool result = true;
+    
+    if (m_structure)
+        result &= m_structure->markIfCheap(visitor);
+    
+    switch (m_type) {
+    case Transition:
+        if (Heap::isMarkedConcurrently(m_structure->previousID()))
+            visitor.appendUnbarriered(m_structure.get());
+        else
+            result = false;
+        break;
+    default:
+        break;
+    }
+    
+    return result;
+}
+
+void AccessCase::generateWithGuard(
+    AccessGenerationState& state, CCallHelpers::JumpList& fallThrough)
+{
+    SuperSamplerScope superSamplerScope(false);
+
+    RELEASE_ASSERT(m_state == Committed);
+    m_state = Generated;
+    
+    CCallHelpers& jit = *state.jit;
+    VM& vm = *jit.vm();
+    const Identifier& ident = *state.ident;
+    StructureStubInfo& stubInfo = *state.stubInfo;
+    JSValueRegs valueRegs = state.valueRegs;
+    GPRReg baseGPR = state.baseGPR;
+    GPRReg scratchGPR = state.scratchGPR;
+    
+    UNUSED_PARAM(vm);
+
+    switch (m_type) {
+    case ArrayLength: {
+        ASSERT(!viaProxy());
+        jit.load8(CCallHelpers::Address(baseGPR, JSCell::indexingTypeAndMiscOffset()), scratchGPR);
+        fallThrough.append(
+            jit.branchTest32(
+                CCallHelpers::Zero, scratchGPR, CCallHelpers::TrustedImm32(IsArray)));
+        fallThrough.append(
+            jit.branchTest32(
+                CCallHelpers::Zero, scratchGPR, CCallHelpers::TrustedImm32(IndexingShapeMask)));
+        break;
+    }
+
+    case StringLength: {
+        ASSERT(!viaProxy());
+        fallThrough.append(
+            jit.branch8(
+                CCallHelpers::NotEqual,
+                CCallHelpers::Address(baseGPR, JSCell::typeInfoTypeOffset()),
+                CCallHelpers::TrustedImm32(StringType)));
+        break;
+    }
+        
+    case DirectArgumentsLength: {
+        ASSERT(!viaProxy());
+        fallThrough.append(
+            jit.branch8(
+                CCallHelpers::NotEqual,
+                CCallHelpers::Address(baseGPR, JSCell::typeInfoTypeOffset()),
+                CCallHelpers::TrustedImm32(DirectArgumentsType)));
+
+        fallThrough.append(
+            jit.branchTestPtr(
+                CCallHelpers::NonZero,
+                CCallHelpers::Address(baseGPR, DirectArguments::offsetOfOverrides())));
+        jit.load32(
+            CCallHelpers::Address(baseGPR, DirectArguments::offsetOfLength()),
+            valueRegs.payloadGPR());
+        jit.boxInt32(valueRegs.payloadGPR(), valueRegs);
+        state.succeed();
+        return;
+    }
+        
+    case ScopedArgumentsLength: {
+        ASSERT(!viaProxy());
+        fallThrough.append(
+            jit.branch8(
+                CCallHelpers::NotEqual,
+                CCallHelpers::Address(baseGPR, JSCell::typeInfoTypeOffset()),
+                CCallHelpers::TrustedImm32(ScopedArgumentsType)));
+
+        fallThrough.append(
+            jit.branchTest8(
+                CCallHelpers::NonZero,
+                CCallHelpers::Address(baseGPR, ScopedArguments::offsetOfOverrodeThings())));
+        jit.load32(
+            CCallHelpers::Address(baseGPR, ScopedArguments::offsetOfTotalLength()),
+            valueRegs.payloadGPR());
+        jit.boxInt32(valueRegs.payloadGPR(), valueRegs);
+        state.succeed();
+        return;
+    }
+        
+    case MegamorphicLoad: {
+        UniquedStringImpl* key = ident.impl();
+        unsigned hash = IdentifierRepHash::hash(key);
+        
+        ScratchRegisterAllocator allocator(stubInfo.patch.usedRegisters);
+        allocator.lock(baseGPR);
+#if USE(JSVALUE32_64)
+        allocator.lock(static_cast<GPRReg>(stubInfo.patch.baseTagGPR));
+#endif
+        allocator.lock(valueRegs);
+        allocator.lock(scratchGPR);
+        
+        GPRReg intermediateGPR = scratchGPR;
+        GPRReg maskGPR = allocator.allocateScratchGPR();
+        GPRReg maskedHashGPR = allocator.allocateScratchGPR();
+        GPRReg indexGPR = allocator.allocateScratchGPR();
+        GPRReg offsetGPR = allocator.allocateScratchGPR();
+        
+        if (verbose) {
+            dataLog("baseGPR = ", baseGPR, "\n");
+            dataLog("valueRegs = ", valueRegs, "\n");
+            dataLog("scratchGPR = ", scratchGPR, "\n");
+            dataLog("intermediateGPR = ", intermediateGPR, "\n");
+            dataLog("maskGPR = ", maskGPR, "\n");
+            dataLog("maskedHashGPR = ", maskedHashGPR, "\n");
+            dataLog("indexGPR = ", indexGPR, "\n");
+            dataLog("offsetGPR = ", offsetGPR, "\n");
+        }
+
+        ScratchRegisterAllocator::PreservedState preservedState =
+            allocator.preserveReusedRegistersByPushing(jit, ScratchRegisterAllocator::ExtraStackSpace::SpaceForCCall);
+
+        CCallHelpers::JumpList myFailAndIgnore;
+        CCallHelpers::JumpList myFallThrough;
+        
+        jit.emitLoadStructure(baseGPR, intermediateGPR, maskGPR);
+        jit.loadPtr(
+            CCallHelpers::Address(intermediateGPR, Structure::propertyTableUnsafeOffset()),
+            intermediateGPR);
+        
+        myFailAndIgnore.append(jit.branchTestPtr(CCallHelpers::Zero, intermediateGPR));
+        
+        jit.load32(CCallHelpers::Address(intermediateGPR, PropertyTable::offsetOfIndexMask()), maskGPR);
+        jit.loadPtr(CCallHelpers::Address(intermediateGPR, PropertyTable::offsetOfIndex()), indexGPR);
+        jit.load32(
+            CCallHelpers::Address(intermediateGPR, PropertyTable::offsetOfIndexSize()),
+            intermediateGPR);
+
+        jit.move(maskGPR, maskedHashGPR);
+        jit.and32(CCallHelpers::TrustedImm32(hash), maskedHashGPR);
+        jit.lshift32(CCallHelpers::TrustedImm32(2), intermediateGPR);
+        jit.addPtr(indexGPR, intermediateGPR);
+        
+        CCallHelpers::Label loop = jit.label();
+        
+        jit.load32(CCallHelpers::BaseIndex(indexGPR, maskedHashGPR, CCallHelpers::TimesFour), offsetGPR);
+        
+        myFallThrough.append(
+            jit.branch32(
+                CCallHelpers::Equal,
+                offsetGPR,
+                CCallHelpers::TrustedImm32(PropertyTable::EmptyEntryIndex)));
+        
+        jit.sub32(CCallHelpers::TrustedImm32(1), offsetGPR);
+        jit.mul32(CCallHelpers::TrustedImm32(sizeof(PropertyMapEntry)), offsetGPR, offsetGPR);
+        jit.addPtr(intermediateGPR, offsetGPR);
+        
+        CCallHelpers::Jump collision =  jit.branchPtr(
+            CCallHelpers::NotEqual,
+            CCallHelpers::Address(offsetGPR, OBJECT_OFFSETOF(PropertyMapEntry, key)),
+            CCallHelpers::TrustedImmPtr(key));
+        
+        // offsetGPR currently holds a pointer to the PropertyMapEntry, which has the offset and attributes.
+        // Check them and then attempt the load.
+        
+        myFallThrough.append(
+            jit.branchTest32(
+                CCallHelpers::NonZero,
+                CCallHelpers::Address(offsetGPR, OBJECT_OFFSETOF(PropertyMapEntry, attributes)),
+                CCallHelpers::TrustedImm32(Accessor | CustomAccessor)));
+        
+        jit.load32(CCallHelpers::Address(offsetGPR, OBJECT_OFFSETOF(PropertyMapEntry, offset)), offsetGPR);
+        
+        jit.loadProperty(baseGPR, offsetGPR, valueRegs);
+        
+        allocator.restoreReusedRegistersByPopping(jit, preservedState);
+        state.succeed();
+        
+        collision.link(&jit);
+
+        jit.add32(CCallHelpers::TrustedImm32(1), maskedHashGPR);
+        
+        // FIXME: We could be smarter about this. Currently we're burning a GPR for the mask. But looping
+        // around isn't super common so we could, for example, recompute the mask from the difference between
+        // the table and index. But before we do that we should probably make it easier to multiply and
+        // divide by the size of PropertyMapEntry. That probably involves making PropertyMapEntry be arranged
+        // to have a power-of-2 size.
+        jit.and32(maskGPR, maskedHashGPR);
+        jit.jump().linkTo(loop, &jit);
+        
+        if (allocator.didReuseRegisters()) {
+            myFailAndIgnore.link(&jit);
+            allocator.restoreReusedRegistersByPopping(jit, preservedState);
+            state.failAndIgnore.append(jit.jump());
+            
+            myFallThrough.link(&jit);
+            allocator.restoreReusedRegistersByPopping(jit, preservedState);
+            fallThrough.append(jit.jump());
+        } else {
+            state.failAndIgnore.append(myFailAndIgnore);
+            fallThrough.append(myFallThrough);
+        }
+        return;
+    }
+
+    default: {
+        if (viaProxy()) {
+            fallThrough.append(
+                jit.branch8(
+                    CCallHelpers::NotEqual,
+                    CCallHelpers::Address(baseGPR, JSCell::typeInfoTypeOffset()),
+                    CCallHelpers::TrustedImm32(PureForwardingProxyType)));
+
+            jit.loadPtr(CCallHelpers::Address(baseGPR, JSProxy::targetOffset()), scratchGPR);
+
+            fallThrough.append(
+                jit.branchStructure(
+                    CCallHelpers::NotEqual,
+                    CCallHelpers::Address(scratchGPR, JSCell::structureIDOffset()),
+                    structure()));
+        } else {
+            fallThrough.append(
+                jit.branchStructure(
+                    CCallHelpers::NotEqual,
+                    CCallHelpers::Address(baseGPR, JSCell::structureIDOffset()),
+                    structure()));
+        }
+        break;
+    } };
+
+    generateImpl(state);
+}
+
+void AccessCase::generate(AccessGenerationState& state)
+{
+    RELEASE_ASSERT(m_state == Committed);
+    m_state = Generated;
+    
+    generateImpl(state);
+}
+
+void AccessCase::generateImpl(AccessGenerationState& state)
+{
+    SuperSamplerScope superSamplerScope(false);
+    if (verbose)
+        dataLog("Generating code for: ", *this, "\n");
+    
+    ASSERT(m_state == Generated); // We rely on the callers setting this for us.
+    
+    CCallHelpers& jit = *state.jit;
+    VM& vm = *jit.vm();
+    CodeBlock* codeBlock = jit.codeBlock();
+    StructureStubInfo& stubInfo = *state.stubInfo;
+    const Identifier& ident = *state.ident;
+    JSValueRegs valueRegs = state.valueRegs;
+    GPRReg baseGPR = state.baseGPR;
+    GPRReg scratchGPR = state.scratchGPR;
+
+    ASSERT(m_conditionSet.structuresEnsureValidityAssumingImpurePropertyWatchpoint());
+
+    for (const ObjectPropertyCondition& condition : m_conditionSet) {
+        Structure* structure = condition.object()->structure();
+
+        if (condition.isWatchableAssumingImpurePropertyWatchpoint()) {
+            structure->addTransitionWatchpoint(state.addWatchpoint(condition));
+            continue;
+        }
+
+        if (!condition.structureEnsuresValidityAssumingImpurePropertyWatchpoint(structure)) {
+            // The reason why this cannot happen is that we require that PolymorphicAccess calls
+            // AccessCase::generate() only after it has verified that
+            // AccessCase::couldStillSucceed() returned true.
+            
+            dataLog("This condition is no longer met: ", condition, "\n");
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        // We will emit code that has a weak reference that isn't otherwise listed anywhere.
+        state.weakReferences.append(WriteBarrier<JSCell>(vm, codeBlock, structure));
+        
+        jit.move(CCallHelpers::TrustedImmPtr(condition.object()), scratchGPR);
+        state.failAndRepatch.append(
+            jit.branchStructure(
+                CCallHelpers::NotEqual,
+                CCallHelpers::Address(scratchGPR, JSCell::structureIDOffset()),
+                structure));
+    }
+
+    switch (m_type) {
+    case InHit:
+    case InMiss:
+        jit.boxBooleanPayload(m_type == InHit, valueRegs.payloadGPR());
+        state.succeed();
+        return;
+
+    case Miss:
+        jit.moveTrustedValue(jsUndefined(), valueRegs);
+        state.succeed();
+        return;
+
+    case Load:
+    case GetGetter:
+    case Getter:
+    case Setter:
+    case CustomValueGetter:
+    case CustomAccessorGetter:
+    case CustomValueSetter:
+    case CustomAccessorSetter: {
+        GPRReg valueRegsPayloadGPR = valueRegs.payloadGPR();
+        
+        if (isValidOffset(m_offset)) {
+            Structure* currStructure;
+            if (m_conditionSet.isEmpty())
+                currStructure = structure();
+            else
+                currStructure = m_conditionSet.slotBaseCondition().object()->structure();
+            currStructure->startWatchingPropertyForReplacements(vm, offset());
+        }
+
+        GPRReg baseForGetGPR;
+        if (viaProxy()) {
+            ASSERT(m_type != CustomValueSetter || m_type != CustomAccessorSetter); // Because setters need to not trash valueRegsPayloadGPR.
+            if (m_type == Getter || m_type == Setter)
+                baseForGetGPR = scratchGPR;
+            else
+                baseForGetGPR = valueRegsPayloadGPR;
+
+            ASSERT((m_type != Getter && m_type != Setter) || baseForGetGPR != baseGPR);
+            ASSERT(m_type != Setter || baseForGetGPR != valueRegsPayloadGPR);
+
+            jit.loadPtr(
+                CCallHelpers::Address(baseGPR, JSProxy::targetOffset()),
+                baseForGetGPR);
+        } else
+            baseForGetGPR = baseGPR;
+
+        GPRReg baseForAccessGPR;
+        if (!m_conditionSet.isEmpty()) {
+            jit.move(
+                CCallHelpers::TrustedImmPtr(alternateBase()),
+                scratchGPR);
+            baseForAccessGPR = scratchGPR;
+        } else
+            baseForAccessGPR = baseForGetGPR;
+
+        GPRReg loadedValueGPR = InvalidGPRReg;
+        if (m_type != CustomValueGetter && m_type != CustomAccessorGetter && m_type != CustomValueSetter && m_type != CustomAccessorSetter) {
+            if (m_type == Load || m_type == GetGetter)
+                loadedValueGPR = valueRegsPayloadGPR;
+            else
+                loadedValueGPR = scratchGPR;
+
+            ASSERT((m_type != Getter && m_type != Setter) || loadedValueGPR != baseGPR);
+            ASSERT(m_type != Setter || loadedValueGPR != valueRegsPayloadGPR);
+
+            GPRReg storageGPR;
+            if (isInlineOffset(m_offset))
+                storageGPR = baseForAccessGPR;
+            else {
+                jit.loadPtr(
+                    CCallHelpers::Address(baseForAccessGPR, JSObject::butterflyOffset()),
+                    loadedValueGPR);
+                storageGPR = loadedValueGPR;
+            }
+
+#if USE(JSVALUE64)
+            jit.load64(
+                CCallHelpers::Address(storageGPR, offsetRelativeToBase(m_offset)), loadedValueGPR);
+#else
+            if (m_type == Load || m_type == GetGetter) {
+                jit.load32(
+                    CCallHelpers::Address(storageGPR, offsetRelativeToBase(m_offset) + TagOffset),
+                    valueRegs.tagGPR());
+            }
+            jit.load32(
+                CCallHelpers::Address(storageGPR, offsetRelativeToBase(m_offset) + PayloadOffset),
+                loadedValueGPR);
+#endif
+        }
+
+        if (m_type == Load || m_type == GetGetter) {
+            state.succeed();
+            return;
+        }
+
+        if (Options::useDOMJIT() && m_type == CustomAccessorGetter && m_rareData->domJIT) {
+            // We do not need to emit CheckDOM operation since structure check ensures
+            // that the structure of the given base value is structure()! So all we should
+            // do is performing the CheckDOM thingy in IC compiling time here.
+            if (structure()->classInfo()->isSubClassOf(m_rareData->domJIT->thisClassInfo())) {
+                emitDOMJITGetter(state, baseForGetGPR);
+                return;
+            }
+        }
+
+        // Stuff for custom getters/setters.
+        CCallHelpers::Call operationCall;
+
+        // Stuff for JS getters/setters.
+        CCallHelpers::DataLabelPtr addressOfLinkFunctionCheck;
+        CCallHelpers::Call fastPathCall;
+        CCallHelpers::Call slowPathCall;
+
+        // This also does the necessary calculations of whether or not we're an
+        // exception handling call site.
+        AccessGenerationState::SpillState spillState = state.preserveLiveRegistersToStackForCall();
+
+        auto restoreLiveRegistersFromStackForCall = [&](AccessGenerationState::SpillState& spillState, bool callHasReturnValue) {
+            RegisterSet dontRestore;
+            if (callHasReturnValue) {
+                // This is the result value. We don't want to overwrite the result with what we stored to the stack.
+                // We sometimes have to store it to the stack just in case we throw an exception and need the original value.
+                dontRestore.set(valueRegs);
+            }
+            state.restoreLiveRegistersFromStackForCall(spillState, dontRestore);
+        };
+
+        jit.store32(
+            CCallHelpers::TrustedImm32(state.callSiteIndexForExceptionHandlingOrOriginal().bits()),
+            CCallHelpers::tagFor(static_cast<VirtualRegister>(CallFrameSlot::argumentCount)));
+
+        if (m_type == Getter || m_type == Setter) {
+            ASSERT(baseGPR != loadedValueGPR);
+            ASSERT(m_type != Setter || (baseGPR != valueRegsPayloadGPR && loadedValueGPR != valueRegsPayloadGPR));
+
+            // Create a JS call using a JS call inline cache. Assume that:
+            //
+            // - SP is aligned and represents the extent of the calling compiler's stack usage.
+            //
+            // - FP is set correctly (i.e. it points to the caller's call frame header).
+            //
+            // - SP - FP is an aligned difference.
+            //
+            // - Any byte between FP (exclusive) and SP (inclusive) could be live in the calling
+            //   code.
+            //
+            // Therefore, we temporarily grow the stack for the purpose of the call and then
+            // shrink it after.
+
+            state.setSpillStateForJSGetterSetter(spillState);
+
+            RELEASE_ASSERT(!m_rareData->callLinkInfo);
+            m_rareData->callLinkInfo = std::make_unique<CallLinkInfo>();
+            
+            // FIXME: If we generated a polymorphic call stub that jumped back to the getter
+            // stub, which then jumped back to the main code, then we'd have a reachability
+            // situation that the GC doesn't know about. The GC would ensure that the polymorphic
+            // call stub stayed alive, and it would ensure that the main code stayed alive, but
+            // it wouldn't know that the getter stub was alive. Ideally JIT stub routines would
+            // be GC objects, and then we'd be able to say that the polymorphic call stub has a
+            // reference to the getter stub.
+            // https://bugs.webkit.org/show_bug.cgi?id=148914
+            m_rareData->callLinkInfo->disallowStubs();
+            
+            m_rareData->callLinkInfo->setUpCall(
+                CallLinkInfo::Call, stubInfo.codeOrigin, loadedValueGPR);
+
+            CCallHelpers::JumpList done;
+
+            // There is a "this" argument.
+            unsigned numberOfParameters = 1;
+            // ... and a value argument if we're calling a setter.
+            if (m_type == Setter)
+                numberOfParameters++;
+
+            // Get the accessor; if there ain't one then the result is jsUndefined().
+            if (m_type == Setter) {
+                jit.loadPtr(
+                    CCallHelpers::Address(loadedValueGPR, GetterSetter::offsetOfSetter()),
+                    loadedValueGPR);
+            } else {
+                jit.loadPtr(
+                    CCallHelpers::Address(loadedValueGPR, GetterSetter::offsetOfGetter()),
+                    loadedValueGPR);
+            }
+
+            CCallHelpers::Jump returnUndefined = jit.branchTestPtr(
+                CCallHelpers::Zero, loadedValueGPR);
+
+            unsigned numberOfRegsForCall = CallFrame::headerSizeInRegisters + numberOfParameters;
+
+            unsigned numberOfBytesForCall =
+                numberOfRegsForCall * sizeof(Register) - sizeof(CallerFrameAndPC);
+
+            unsigned alignedNumberOfBytesForCall =
+                WTF::roundUpToMultipleOf(stackAlignmentBytes(), numberOfBytesForCall);
+
+            jit.subPtr(
+                CCallHelpers::TrustedImm32(alignedNumberOfBytesForCall),
+                CCallHelpers::stackPointerRegister);
+
+            CCallHelpers::Address calleeFrame = CCallHelpers::Address(
+                CCallHelpers::stackPointerRegister,
+                -static_cast<ptrdiff_t>(sizeof(CallerFrameAndPC)));
+
+            jit.store32(
+                CCallHelpers::TrustedImm32(numberOfParameters),
+                calleeFrame.withOffset(CallFrameSlot::argumentCount * sizeof(Register) + PayloadOffset));
+
+            jit.storeCell(
+                loadedValueGPR, calleeFrame.withOffset(CallFrameSlot::callee * sizeof(Register)));
+
+            jit.storeCell(
+                baseGPR,
+                calleeFrame.withOffset(virtualRegisterForArgument(0).offset() * sizeof(Register)));
+
+            if (m_type == Setter) {
+                jit.storeValue(
+                    valueRegs,
+                    calleeFrame.withOffset(
+                        virtualRegisterForArgument(1).offset() * sizeof(Register)));
+            }
+
+            CCallHelpers::Jump slowCase = jit.branchPtrWithPatch(
+                CCallHelpers::NotEqual, loadedValueGPR, addressOfLinkFunctionCheck,
+                CCallHelpers::TrustedImmPtr(0));
+
+            fastPathCall = jit.nearCall();
+            if (m_type == Getter)
+                jit.setupResults(valueRegs);
+            done.append(jit.jump());
+
+            slowCase.link(&jit);
+            jit.move(loadedValueGPR, GPRInfo::regT0);
+#if USE(JSVALUE32_64)
+            // We *always* know that the getter/setter, if non-null, is a cell.
+            jit.move(CCallHelpers::TrustedImm32(JSValue::CellTag), GPRInfo::regT1);
+#endif
+            jit.move(CCallHelpers::TrustedImmPtr(m_rareData->callLinkInfo.get()), GPRInfo::regT2);
+            slowPathCall = jit.nearCall();
+            if (m_type == Getter)
+                jit.setupResults(valueRegs);
+            done.append(jit.jump());
+
+            returnUndefined.link(&jit);
+            if (m_type == Getter)
+                jit.moveTrustedValue(jsUndefined(), valueRegs);
+
+            done.link(&jit);
+
+            jit.addPtr(CCallHelpers::TrustedImm32((codeBlock->stackPointerOffset() * sizeof(Register)) - state.preservedReusedRegisterState.numberOfBytesPreserved - spillState.numberOfStackBytesUsedForRegisterPreservation),
+                GPRInfo::callFrameRegister, CCallHelpers::stackPointerRegister);
+            bool callHasReturnValue = isGetter();
+            restoreLiveRegistersFromStackForCall(spillState, callHasReturnValue);
+
+            jit.addLinkTask(
+                [=, &vm] (LinkBuffer& linkBuffer) {
+                    m_rareData->callLinkInfo->setCallLocations(
+                        CodeLocationLabel(linkBuffer.locationOfNearCall(slowPathCall)),
+                        CodeLocationLabel(linkBuffer.locationOf(addressOfLinkFunctionCheck)),
+                        linkBuffer.locationOfNearCall(fastPathCall));
+
+                    linkBuffer.link(
+                        slowPathCall,
+                        CodeLocationLabel(vm.getCTIStub(linkCallThunkGenerator).code()));
+                });
+        } else {
+            ASSERT(m_type == CustomValueGetter || m_type == CustomAccessorGetter || m_type == CustomValueSetter || m_type == CustomAccessorSetter);
+
+            // Need to make room for the C call so any of our stack spillage isn't overwritten. It's
+            // hard to track if someone did spillage or not, so we just assume that we always need
+            // to make some space here.
+            jit.makeSpaceOnStackForCCall();
+
+            // getter: EncodedJSValue (*GetValueFunc)(ExecState*, EncodedJSValue thisValue, PropertyName);
+            // setter: void (*PutValueFunc)(ExecState*, EncodedJSValue thisObject, EncodedJSValue value);
+            // Custom values are passed the slotBase (the property holder), custom accessors are passed the thisVaule (reciever).
+            // FIXME: Remove this differences in custom values and custom accessors.
+            // https://bugs.webkit.org/show_bug.cgi?id=158014
+            GPRReg baseForCustomValue = m_type == CustomValueGetter || m_type == CustomValueSetter ? baseForAccessGPR : baseForGetGPR;
+#if USE(JSVALUE64)
+            if (m_type == CustomValueGetter || m_type == CustomAccessorGetter) {
+                jit.setupArgumentsWithExecState(
+                    baseForCustomValue,
+                    CCallHelpers::TrustedImmPtr(ident.impl()));
+            } else
+                jit.setupArgumentsWithExecState(baseForCustomValue, valueRegs.gpr());
+#else
+            if (m_type == CustomValueGetter || m_type == CustomAccessorGetter) {
+                jit.setupArgumentsWithExecState(
+                    EABI_32BIT_DUMMY_ARG baseForCustomValue,
+                    CCallHelpers::TrustedImm32(JSValue::CellTag),
+                    CCallHelpers::TrustedImmPtr(ident.impl()));
+            } else {
+                jit.setupArgumentsWithExecState(
+                    EABI_32BIT_DUMMY_ARG baseForCustomValue,
+                    CCallHelpers::TrustedImm32(JSValue::CellTag),
+                    valueRegs.payloadGPR(), valueRegs.tagGPR());
+            }
+#endif
+            jit.storePtr(GPRInfo::callFrameRegister, &vm.topCallFrame);
+
+            operationCall = jit.call();
+            jit.addLinkTask(
+                [=] (LinkBuffer& linkBuffer) {
+                    linkBuffer.link(operationCall, FunctionPtr(m_rareData->customAccessor.opaque));
+                });
+
+            if (m_type == CustomValueGetter || m_type == CustomAccessorGetter)
+                jit.setupResults(valueRegs);
+            jit.reclaimSpaceOnStackForCCall();
+
+            CCallHelpers::Jump noException =
+                jit.emitExceptionCheck(CCallHelpers::InvertedExceptionCheck);
+
+            state.restoreLiveRegistersFromStackForCallWithThrownException(spillState);
+            state.emitExplicitExceptionHandler();
+        
+            noException.link(&jit);
+            bool callHasReturnValue = isGetter();
+            restoreLiveRegistersFromStackForCall(spillState, callHasReturnValue);
+        }
+        state.succeed();
+        return;
+    }
+
+    case Replace: {
+        if (InferredType* type = structure()->inferredTypeFor(ident.impl())) {
+            if (verbose)
+                dataLog("Have type: ", type->descriptor(), "\n");
+            state.failAndRepatch.append(
+                jit.branchIfNotType(valueRegs, scratchGPR, type->descriptor()));
+        } else if (verbose)
+            dataLog("Don't have type.\n");
+        
+        if (isInlineOffset(m_offset)) {
+            jit.storeValue(
+                valueRegs,
+                CCallHelpers::Address(
+                    baseGPR,
+                    JSObject::offsetOfInlineStorage() +
+                    offsetInInlineStorage(m_offset) * sizeof(JSValue)));
+        } else {
+            jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
+            jit.storeValue(
+                valueRegs,
+                CCallHelpers::Address(
+                    scratchGPR, offsetInButterfly(m_offset) * sizeof(JSValue)));
+        }
+        state.succeed();
+        return;
+    }
+
+    case Transition: {
+        // AccessCase::transition() should have returned null if this wasn't true.
+        RELEASE_ASSERT(GPRInfo::numberOfRegisters >= 6 || !structure()->outOfLineCapacity() || structure()->outOfLineCapacity() == newStructure()->outOfLineCapacity());
+
+        if (InferredType* type = newStructure()->inferredTypeFor(ident.impl())) {
+            if (verbose)
+                dataLog("Have type: ", type->descriptor(), "\n");
+            state.failAndRepatch.append(
+                jit.branchIfNotType(valueRegs, scratchGPR, type->descriptor()));
+        } else if (verbose)
+            dataLog("Don't have type.\n");
+        
+        // NOTE: This logic is duplicated in AccessCase::doesCalls(). It's important that doesCalls() knows
+        // exactly when this would make calls.
+        bool allocating = newStructure()->outOfLineCapacity() != structure()->outOfLineCapacity();
+        bool reallocating = allocating && structure()->outOfLineCapacity();
+        bool allocatingInline = allocating && !structure()->couldHaveIndexingHeader();
+
+        ScratchRegisterAllocator allocator(stubInfo.patch.usedRegisters);
+        allocator.lock(baseGPR);
+#if USE(JSVALUE32_64)
+        allocator.lock(static_cast<GPRReg>(stubInfo.patch.baseTagGPR));
+#endif
+        allocator.lock(valueRegs);
+        allocator.lock(scratchGPR);
+
+        GPRReg scratchGPR2 = InvalidGPRReg;
+        GPRReg scratchGPR3 = InvalidGPRReg;
+        if (allocatingInline) {
+            scratchGPR2 = allocator.allocateScratchGPR();
+            scratchGPR3 = allocator.allocateScratchGPR();
+        }
+
+        ScratchRegisterAllocator::PreservedState preservedState =
+            allocator.preserveReusedRegistersByPushing(jit, ScratchRegisterAllocator::ExtraStackSpace::SpaceForCCall);
+        
+        CCallHelpers::JumpList slowPath;
+
+        ASSERT(structure()->transitionWatchpointSetHasBeenInvalidated());
+
+        if (allocating) {
+            size_t newSize = newStructure()->outOfLineCapacity() * sizeof(JSValue);
+            
+            if (allocatingInline) {
+                MarkedAllocator* allocator = vm.auxiliarySpace.allocatorFor(newSize);
+                
+                if (!allocator) {
+                    // Yuck, this case would suck!
+                    slowPath.append(jit.jump());
+                }
+                
+                jit.move(CCallHelpers::TrustedImmPtr(allocator), scratchGPR2);
+                jit.emitAllocate(scratchGPR, allocator, scratchGPR2, scratchGPR3, slowPath);
+                jit.addPtr(CCallHelpers::TrustedImm32(newSize + sizeof(IndexingHeader)), scratchGPR);
+                
+                size_t oldSize = structure()->outOfLineCapacity() * sizeof(JSValue);
+                ASSERT(newSize > oldSize);
+                
+                if (reallocating) {
+                    // Handle the case where we are reallocating (i.e. the old structure/butterfly
+                    // already had out-of-line property storage).
+                    
+                    jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR3);
+                    
+                    // We have scratchGPR = new storage, scratchGPR3 = old storage,
+                    // scratchGPR2 = available
+                    for (size_t offset = 0; offset < oldSize; offset += sizeof(void*)) {
+                        jit.loadPtr(
+                            CCallHelpers::Address(
+                                scratchGPR3,
+                                -static_cast<ptrdiff_t>(
+                                    offset + sizeof(JSValue) + sizeof(void*))),
+                            scratchGPR2);
+                        jit.storePtr(
+                            scratchGPR2,
+                            CCallHelpers::Address(
+                                scratchGPR,
+                                -static_cast<ptrdiff_t>(offset + sizeof(JSValue) + sizeof(void*))));
+                    }
+                }
+                
+                for (size_t offset = oldSize; offset < newSize; offset += sizeof(void*))
+                    jit.storePtr(CCallHelpers::TrustedImmPtr(0), CCallHelpers::Address(scratchGPR, -static_cast<ptrdiff_t>(offset + sizeof(JSValue) + sizeof(void*))));
+            } else {
+                // Handle the case where we are allocating out-of-line using an operation.
+                RegisterSet extraRegistersToPreserve;
+                extraRegistersToPreserve.set(baseGPR);
+                extraRegistersToPreserve.set(valueRegs);
+                AccessGenerationState::SpillState spillState = state.preserveLiveRegistersToStackForCall(extraRegistersToPreserve);
+                
+                jit.store32(
+                    CCallHelpers::TrustedImm32(
+                        state.callSiteIndexForExceptionHandlingOrOriginal().bits()),
+                    CCallHelpers::tagFor(static_cast<VirtualRegister>(CallFrameSlot::argumentCount)));
+                
+                jit.makeSpaceOnStackForCCall();
+                
+                if (!reallocating) {
+                    jit.setupArgumentsWithExecState(baseGPR);
+                    
+                    CCallHelpers::Call operationCall = jit.call();
+                    jit.addLinkTask(
+                        [=] (LinkBuffer& linkBuffer) {
+                            linkBuffer.link(
+                                operationCall,
+                                FunctionPtr(operationReallocateButterflyToHavePropertyStorageWithInitialCapacity));
+                        });
+                } else {
+                    // Handle the case where we are reallocating (i.e. the old structure/butterfly
+                    // already had out-of-line property storage).
+                    jit.setupArgumentsWithExecState(
+                        baseGPR, CCallHelpers::TrustedImm32(newSize / sizeof(JSValue)));
+                    
+                    CCallHelpers::Call operationCall = jit.call();
+                    jit.addLinkTask(
+                        [=] (LinkBuffer& linkBuffer) {
+                            linkBuffer.link(
+                                operationCall,
+                                FunctionPtr(operationReallocateButterflyToGrowPropertyStorage));
+                        });
+                }
+                
+                jit.reclaimSpaceOnStackForCCall();
+                jit.move(GPRInfo::returnValueGPR, scratchGPR);
+                
+                CCallHelpers::Jump noException =
+                    jit.emitExceptionCheck(CCallHelpers::InvertedExceptionCheck);
+                
+                state.restoreLiveRegistersFromStackForCallWithThrownException(spillState);
+                state.emitExplicitExceptionHandler();
+                
+                noException.link(&jit);
+                state.restoreLiveRegistersFromStackForCall(spillState);
+            }
+        }
+
+        if (isInlineOffset(m_offset)) {
+            jit.storeValue(
+                valueRegs,
+                CCallHelpers::Address(
+                    baseGPR,
+                    JSObject::offsetOfInlineStorage() +
+                    offsetInInlineStorage(m_offset) * sizeof(JSValue)));
+        } else {
+            if (!allocating)
+                jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
+            jit.storeValue(
+                valueRegs,
+                CCallHelpers::Address(scratchGPR, offsetInButterfly(m_offset) * sizeof(JSValue)));
+        }
+        
+        if (allocatingInline) {
+            // We set the new butterfly and the structure last. Doing it this way ensures that
+            // whatever we had done up to this point is forgotten if we choose to branch to slow
+            // path.
+            jit.nukeStructureAndStoreButterfly(scratchGPR, baseGPR);
+        }
+        
+        uint32_t structureBits = bitwise_cast<uint32_t>(newStructure()->id());
+        jit.store32(
+            CCallHelpers::TrustedImm32(structureBits),
+            CCallHelpers::Address(baseGPR, JSCell::structureIDOffset()));
+
+        allocator.restoreReusedRegistersByPopping(jit, preservedState);
+        state.succeed();
+        
+        // We will have a slow path if we were allocating without the help of an operation.
+        if (allocatingInline) {
+            if (allocator.didReuseRegisters()) {
+                slowPath.link(&jit);
+                allocator.restoreReusedRegistersByPopping(jit, preservedState);
+                state.failAndIgnore.append(jit.jump());
+            } else
+                state.failAndIgnore.append(slowPath);
+        } else
+            RELEASE_ASSERT(slowPath.empty());
+        return;
+    }
+
+    case ArrayLength: {
+        jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
+        jit.load32(CCallHelpers::Address(scratchGPR, ArrayStorage::lengthOffset()), scratchGPR);
+        state.failAndIgnore.append(
+            jit.branch32(CCallHelpers::LessThan, scratchGPR, CCallHelpers::TrustedImm32(0)));
+        jit.boxInt32(scratchGPR, valueRegs);
+        state.succeed();
+        return;
+    }
+
+    case StringLength: {
+        jit.load32(CCallHelpers::Address(baseGPR, JSString::offsetOfLength()), valueRegs.payloadGPR());
+        jit.boxInt32(valueRegs.payloadGPR(), valueRegs);
+        state.succeed();
+        return;
+    }
+        
+    case IntrinsicGetter: {
+        RELEASE_ASSERT(isValidOffset(offset()));
+
+        // We need to ensure the getter value does not move from under us. Note that GetterSetters
+        // are immutable so we just need to watch the property not any value inside it.
+        Structure* currStructure;
+        if (m_conditionSet.isEmpty())
+            currStructure = structure();
+        else
+            currStructure = m_conditionSet.slotBaseCondition().object()->structure();
+        currStructure->startWatchingPropertyForReplacements(vm, offset());
+
+        emitIntrinsicGetter(state);
+        return;
+    }
+
+    case DirectArgumentsLength:
+    case ScopedArgumentsLength:
+    case MegamorphicLoad:
+        // These need to be handled by generateWithGuard(), since the guard is part of the
+        // algorithm. We can be sure that nobody will call generate() directly for these since they
+        // are not guarded by structure checks.
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void AccessCase::emitDOMJITGetter(AccessGenerationState& state, GPRReg baseForGetGPR)
+{
+    CCallHelpers& jit = *state.jit;
+    StructureStubInfo& stubInfo = *state.stubInfo;
+    JSValueRegs valueRegs = state.valueRegs;
+    GPRReg baseGPR = state.baseGPR;
+    GPRReg scratchGPR = state.scratchGPR;
+
+    // We construct the environment that can execute the DOMJIT::Patchpoint here.
+    Ref<DOMJIT::CallDOMGetterPatchpoint> patchpoint = m_rareData->domJIT->callDOMGetter();
+
+    Vector<GPRReg> gpScratch;
+    Vector<FPRReg> fpScratch;
+    Vector<DOMJIT::Value> regs;
+
+    ScratchRegisterAllocator allocator(stubInfo.patch.usedRegisters);
+    allocator.lock(baseGPR);
+#if USE(JSVALUE32_64)
+    allocator.lock(static_cast<GPRReg>(stubInfo.patch.baseTagGPR));
+#endif
+    allocator.lock(valueRegs);
+    allocator.lock(scratchGPR);
+
+    GPRReg paramBaseGPR = InvalidGPRReg;
+    GPRReg paramGlobalObjectGPR = InvalidGPRReg;
+    JSValueRegs paramValueRegs = valueRegs;
+    GPRReg remainingScratchGPR = InvalidGPRReg;
+
+    // valueRegs and baseForGetGPR may be the same. For example, in Baseline JIT, we pass the same regT0 for baseGPR and valueRegs.
+    // In FTL, there is no constraint that the baseForGetGPR interferes with the result. To make implementation simple in
+    // DOMJIT::Patchpoint, DOMJIT::Patchpoint assumes that result registers always early interfere with input registers, in this case,
+    // baseForGetGPR. So we move baseForGetGPR to the other register if baseForGetGPR == valueRegs.
+    if (baseForGetGPR != valueRegs.payloadGPR()) {
+        paramBaseGPR = baseForGetGPR;
+        if (!patchpoint->requireGlobalObject)
+            remainingScratchGPR = scratchGPR;
+        else
+            paramGlobalObjectGPR = scratchGPR;
+    } else {
+        jit.move(valueRegs.payloadGPR(), scratchGPR);
+        paramBaseGPR = scratchGPR;
+        if (patchpoint->requireGlobalObject)
+            paramGlobalObjectGPR = allocator.allocateScratchGPR();
+    }
+
+    JSGlobalObject* globalObjectForDOMJIT = structure()->globalObject();
+
+    regs.append(paramValueRegs);
+    regs.append(paramBaseGPR);
+    if (patchpoint->requireGlobalObject) {
+        ASSERT(paramGlobalObjectGPR != InvalidGPRReg);
+        regs.append(DOMJIT::Value(paramGlobalObjectGPR, globalObjectForDOMJIT));
+    }
+
+    if (patchpoint->numGPScratchRegisters) {
+        unsigned i = 0;
+        if (remainingScratchGPR != InvalidGPRReg) {
+            gpScratch.append(remainingScratchGPR);
+            ++i;
+        }
+        for (; i < patchpoint->numGPScratchRegisters; ++i)
+            gpScratch.append(allocator.allocateScratchGPR());
+    }
+
+    for (unsigned i = 0; i < patchpoint->numFPScratchRegisters; ++i)
+        fpScratch.append(allocator.allocateScratchFPR());
+
+    // Let's store the reused registers to the stack. After that, we can use allocated scratch registers.
+    ScratchRegisterAllocator::PreservedState preservedState =
+        allocator.preserveReusedRegistersByPushing(jit, ScratchRegisterAllocator::ExtraStackSpace::SpaceForCCall);
+
+    if (verbose) {
+        dataLog("baseGPR = ", baseGPR, "\n");
+        dataLog("valueRegs = ", valueRegs, "\n");
+        dataLog("scratchGPR = ", scratchGPR, "\n");
+        dataLog("paramBaseGPR = ", paramBaseGPR, "\n");
+        if (paramGlobalObjectGPR != InvalidGPRReg)
+            dataLog("paramGlobalObjectGPR = ", paramGlobalObjectGPR, "\n");
+        dataLog("paramValueRegs = ", paramValueRegs, "\n");
+        for (unsigned i = 0; i < patchpoint->numGPScratchRegisters; ++i)
+            dataLog("gpScratch[", i, "] = ", gpScratch[i], "\n");
+    }
+
+    if (patchpoint->requireGlobalObject)
+        jit.move(CCallHelpers::TrustedImmPtr(globalObjectForDOMJIT), paramGlobalObjectGPR);
+
+    // We just spill the registers used in DOMJIT::Patchpoint here. For not spilled registers here explicitly,
+    // they must be in the used register set passed by the callers (Baseline, DFG, and FTL) if they need to be kept.
+    // Some registers can be locked, but not in the used register set. For example, the caller could make baseGPR
+    // same to valueRegs, and not include it in the used registers since it will be changed.
+    RegisterSet registersToSpillForCCall;
+    for (auto& value : regs) {
+        DOMJIT::Reg reg = value.reg();
+        if (reg.isJSValueRegs())
+            registersToSpillForCCall.set(reg.jsValueRegs());
+        else if (reg.isGPR())
+            registersToSpillForCCall.set(reg.gpr());
+        else
+            registersToSpillForCCall.set(reg.fpr());
+    }
+    for (GPRReg reg : gpScratch)
+        registersToSpillForCCall.set(reg);
+    for (FPRReg reg : fpScratch)
+        registersToSpillForCCall.set(reg);
+    registersToSpillForCCall.exclude(RegisterSet::registersToNotSaveForCCall());
+
+    DOMJITAccessCasePatchpointParams params(WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
+    patchpoint->generator()->run(jit, params);
+    allocator.restoreReusedRegistersByPopping(jit, preservedState);
+    state.succeed();
+
+    CCallHelpers::JumpList exceptions = params.emitSlowPathCalls(state, registersToSpillForCCall, jit);
+    if (!exceptions.empty()) {
+        exceptions.link(&jit);
+        allocator.restoreReusedRegistersByPopping(jit, preservedState);
+        state.emitExplicitExceptionHandler();
+    }
+}
+
+PolymorphicAccess::PolymorphicAccess() { }
+PolymorphicAccess::~PolymorphicAccess() { }
+
+AccessGenerationResult PolymorphicAccess::addCases(
+    VM& vm, CodeBlock* codeBlock, StructureStubInfo& stubInfo, const Identifier& ident,
+    Vector<std::unique_ptr<AccessCase>, 2> originalCasesToAdd)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    // This method will add the originalCasesToAdd to the list one at a time while preserving the
+    // invariants:
+    // - If a newly added case canReplace() any existing case, then the existing case is removed before
+    //   the new case is added. Removal doesn't change order of the list. Any number of existing cases
+    //   can be removed via the canReplace() rule.
+    // - Cases in the list always appear in ascending order of time of addition. Therefore, if you
+    //   cascade through the cases in reverse order, you will get the most recent cases first.
+    // - If this method fails (returns null, doesn't add the cases), then both the previous case list
+    //   and the previous stub are kept intact and the new cases are destroyed. It's OK to attempt to
+    //   add more things after failure.
+    
+    // First ensure that the originalCasesToAdd doesn't contain duplicates.
+    Vector<std::unique_ptr<AccessCase>> casesToAdd;
+    for (unsigned i = 0; i < originalCasesToAdd.size(); ++i) {
+        std::unique_ptr<AccessCase> myCase = WTFMove(originalCasesToAdd[i]);
+
+        // Add it only if it is not replaced by the subsequent cases in the list.
+        bool found = false;
+        for (unsigned j = i + 1; j < originalCasesToAdd.size(); ++j) {
+            if (originalCasesToAdd[j]->canReplace(*myCase)) {
+                found = true;
+                break;
+            }
+        }
+
+        if (found)
+            continue;
+        
+        casesToAdd.append(WTFMove(myCase));
+    }
+
+    if (verbose)
+        dataLog("casesToAdd: ", listDump(casesToAdd), "\n");
+
+    // If there aren't any cases to add, then fail on the grounds that there's no point to generating a
+    // new stub that will be identical to the old one. Returning null should tell the caller to just
+    // keep doing what they were doing before.
+    if (casesToAdd.isEmpty())
+        return AccessGenerationResult::MadeNoChanges;
+
+    // Now add things to the new list. Note that at this point, we will still have old cases that
+    // may be replaced by the new ones. That's fine. We will sort that out when we regenerate.
+    for (auto& caseToAdd : casesToAdd) {
+        commit(vm, m_watchpoints, codeBlock, stubInfo, ident, *caseToAdd);
+        m_list.append(WTFMove(caseToAdd));
+    }
+    
+    if (verbose)
+        dataLog("After addCases: m_list: ", listDump(m_list), "\n");
+
+    return AccessGenerationResult::Buffered;
+}
+
+AccessGenerationResult PolymorphicAccess::addCase(
+    VM& vm, CodeBlock* codeBlock, StructureStubInfo& stubInfo, const Identifier& ident,
+    std::unique_ptr<AccessCase> newAccess)
+{
+    Vector<std::unique_ptr<AccessCase>, 2> newAccesses;
+    newAccesses.append(WTFMove(newAccess));
+    return addCases(vm, codeBlock, stubInfo, ident, WTFMove(newAccesses));
+}
+
+bool PolymorphicAccess::visitWeak(VM& vm) const
+{
+    for (unsigned i = 0; i < size(); ++i) {
+        if (!at(i).visitWeak(vm))
+            return false;
+    }
+    if (Vector<WriteBarrier<JSCell>>* weakReferences = m_weakReferences.get()) {
+        for (WriteBarrier<JSCell>& weakReference : *weakReferences) {
+            if (!Heap::isMarked(weakReference.get()))
+                return false;
+        }
+    }
+    return true;
+}
+
+bool PolymorphicAccess::propagateTransitions(SlotVisitor& visitor) const
+{
+    bool result = true;
+    for (unsigned i = 0; i < size(); ++i)
+        result &= at(i).propagateTransitions(visitor);
+    return result;
+}
+
+void PolymorphicAccess::dump(PrintStream& out) const
+{
+    out.print(RawPointer(this), ":[");
+    CommaPrinter comma;
+    for (auto& entry : m_list)
+        out.print(comma, *entry);
+    out.print("]");
+}
+
+void PolymorphicAccess::commit(
+    VM& vm, std::unique_ptr<WatchpointsOnStructureStubInfo>& watchpoints, CodeBlock* codeBlock,
+    StructureStubInfo& stubInfo, const Identifier& ident, AccessCase& accessCase)
+{
+    // NOTE: We currently assume that this is relatively rare. It mainly arises for accesses to
+    // properties on DOM nodes. For sure we cache many DOM node accesses, but even in
+    // Real Pages (TM), we appear to spend most of our time caching accesses to properties on
+    // vanilla objects or exotic objects from within JSC (like Arguments, those are super popular).
+    // Those common kinds of JSC object accesses don't hit this case.
+    
+    for (WatchpointSet* set : accessCase.commit(vm, ident)) {
+        Watchpoint* watchpoint =
+            WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint(
+                watchpoints, codeBlock, &stubInfo, ObjectPropertyCondition());
+        
+        set->add(watchpoint);
+    }
+}
+
+AccessGenerationResult PolymorphicAccess::regenerate(
+    VM& vm, CodeBlock* codeBlock, StructureStubInfo& stubInfo, const Identifier& ident)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    if (verbose)
+        dataLog("Regenerate with m_list: ", listDump(m_list), "\n");
+    
+    AccessGenerationState state;
+
+    state.access = this;
+    state.stubInfo = &stubInfo;
+    state.ident = &ident;
+    
+    state.baseGPR = static_cast<GPRReg>(stubInfo.patch.baseGPR);
+    state.valueRegs = stubInfo.valueRegs();
+
+    ScratchRegisterAllocator allocator(stubInfo.patch.usedRegisters);
+    state.allocator = &allocator;
+    allocator.lock(state.baseGPR);
+    allocator.lock(state.valueRegs);
+#if USE(JSVALUE32_64)
+    allocator.lock(static_cast<GPRReg>(stubInfo.patch.baseTagGPR));
+#endif
+
+    state.scratchGPR = allocator.allocateScratchGPR();
+    
+    CCallHelpers jit(&vm, codeBlock);
+    state.jit = &jit;
+
+    state.preservedReusedRegisterState =
+        allocator.preserveReusedRegistersByPushing(jit, ScratchRegisterAllocator::ExtraStackSpace::NoExtraSpace);
+
+    // Regenerating is our opportunity to figure out what our list of cases should look like. We
+    // do this here. The newly produced 'cases' list may be smaller than m_list. We don't edit
+    // m_list in-place because we may still fail, in which case we want the PolymorphicAccess object
+    // to be unmutated. For sure, we want it to hang onto any data structures that may be referenced
+    // from the code of the current stub (aka previous).
+    ListType cases;
+    unsigned srcIndex = 0;
+    unsigned dstIndex = 0;
+    while (srcIndex < m_list.size()) {
+        std::unique_ptr<AccessCase> someCase = WTFMove(m_list[srcIndex++]);
+        
+        // If the case had been generated, then we have to keep the original in m_list in case we
+        // fail to regenerate. That case may have data structures that are used by the code that it
+        // had generated. If the case had not been generated, then we want to remove it from m_list.
+        bool isGenerated = someCase->state() == AccessCase::Generated;
+        
+        [&] () {
+            if (!someCase->couldStillSucceed())
+                return;
+
+            // Figure out if this is replaced by any later case.
+            for (unsigned j = srcIndex; j < m_list.size(); ++j) {
+                if (m_list[j]->canReplace(*someCase))
+                    return;
+            }
+            
+            if (isGenerated)
+                cases.append(someCase->clone());
+            else
+                cases.append(WTFMove(someCase));
+        }();
+        
+        if (isGenerated)
+            m_list[dstIndex++] = WTFMove(someCase);
+    }
+    m_list.resize(dstIndex);
+    
+    if (verbose)
+        dataLog("In regenerate: cases: ", listDump(cases), "\n");
+    
+    // Now that we've removed obviously unnecessary cases, we can check if the megamorphic load
+    // optimization is applicable. Note that we basically tune megamorphicLoadCost according to code
+    // size. It would be faster to just allow more repatching with many load cases, and avoid the
+    // megamorphicLoad optimization, if we had infinite executable memory.
+    if (cases.size() >= Options::maxAccessVariantListSize()) {
+        unsigned numSelfLoads = 0;
+        for (auto& newCase : cases) {
+            if (newCase->canBeReplacedByMegamorphicLoad())
+                numSelfLoads++;
+        }
+        
+        if (numSelfLoads >= Options::megamorphicLoadCost()) {
+            if (auto mega = AccessCase::megamorphicLoad(vm, codeBlock)) {
+                cases.removeAllMatching(
+                    [&] (std::unique_ptr<AccessCase>& newCase) -> bool {
+                        return newCase->canBeReplacedByMegamorphicLoad();
+                    });
+                
+                cases.append(WTFMove(mega));
+            }
+        }
+    }
+    
+    if (verbose)
+        dataLog("Optimized cases: ", listDump(cases), "\n");
+    
+    // At this point we're convinced that 'cases' contains the cases that we want to JIT now and we
+    // won't change that set anymore.
+    
+    bool allGuardedByStructureCheck = true;
+    bool hasJSGetterSetterCall = false;
+    for (auto& newCase : cases) {
+        commit(vm, state.watchpoints, codeBlock, stubInfo, ident, *newCase);
+        allGuardedByStructureCheck &= newCase->guardedByStructureCheck();
+        if (newCase->type() == AccessCase::Getter || newCase->type() == AccessCase::Setter)
+            hasJSGetterSetterCall = true;
+    }
+
+    if (cases.isEmpty()) {
+        // This is super unlikely, but we make it legal anyway.
+        state.failAndRepatch.append(jit.jump());
+    } else if (!allGuardedByStructureCheck || cases.size() == 1) {
+        // If there are any proxies in the list, we cannot just use a binary switch over the structure.
+        // We need to resort to a cascade. A cascade also happens to be optimal if we only have just
+        // one case.
+        CCallHelpers::JumpList fallThrough;
+
+        // Cascade through the list, preferring newer entries.
+        for (unsigned i = cases.size(); i--;) {
+            fallThrough.link(&jit);
+            fallThrough.clear();
+            cases[i]->generateWithGuard(state, fallThrough);
+        }
+        state.failAndRepatch.append(fallThrough);
+    } else {
+        jit.load32(
+            CCallHelpers::Address(state.baseGPR, JSCell::structureIDOffset()),
+            state.scratchGPR);
+        
+        Vector<int64_t> caseValues(cases.size());
+        for (unsigned i = 0; i < cases.size(); ++i)
+            caseValues[i] = bitwise_cast<int32_t>(cases[i]->structure()->id());
+        
+        BinarySwitch binarySwitch(state.scratchGPR, caseValues, BinarySwitch::Int32);
+        while (binarySwitch.advance(jit))
+            cases[binarySwitch.caseIndex()]->generate(state);
+        state.failAndRepatch.append(binarySwitch.fallThrough());
+    }
+
+    if (!state.failAndIgnore.empty()) {
+        state.failAndIgnore.link(&jit);
+        
+        // Make sure that the inline cache optimization code knows that we are taking slow path because
+        // of something that isn't patchable. The slow path will decrement "countdown" and will only
+        // patch things if the countdown reaches zero. We increment the slow path count here to ensure
+        // that the slow path does not try to patch.
+#if CPU(X86) || CPU(X86_64)
+        jit.move(CCallHelpers::TrustedImmPtr(&stubInfo.countdown), state.scratchGPR);
+        jit.add8(CCallHelpers::TrustedImm32(1), CCallHelpers::Address(state.scratchGPR));
+#else
+        jit.load8(&stubInfo.countdown, state.scratchGPR);
+        jit.add32(CCallHelpers::TrustedImm32(1), state.scratchGPR);
+        jit.store8(state.scratchGPR, &stubInfo.countdown);
+#endif
+    }
+
+    CCallHelpers::JumpList failure;
+    if (allocator.didReuseRegisters()) {
+        state.failAndRepatch.link(&jit);
+        state.restoreScratch();
+    } else
+        failure = state.failAndRepatch;
+    failure.append(jit.jump());
+
+    CodeBlock* codeBlockThatOwnsExceptionHandlers = nullptr;
+    CallSiteIndex callSiteIndexForExceptionHandling;
+    if (state.needsToRestoreRegistersIfException() && hasJSGetterSetterCall) {
+        // Emit the exception handler.
+        // Note that this code is only reachable when doing genericUnwind from a pure JS getter/setter .
+        // Note also that this is not reachable from custom getter/setter. Custom getter/setters will have 
+        // their own exception handling logic that doesn't go through genericUnwind.
+        MacroAssembler::Label makeshiftCatchHandler = jit.label();
+
+        int stackPointerOffset = codeBlock->stackPointerOffset() * sizeof(EncodedJSValue);
+        AccessGenerationState::SpillState spillStateForJSGetterSetter = state.spillStateForJSGetterSetter();
+        ASSERT(!spillStateForJSGetterSetter.isEmpty());
+        stackPointerOffset -= state.preservedReusedRegisterState.numberOfBytesPreserved;
+        stackPointerOffset -= spillStateForJSGetterSetter.numberOfStackBytesUsedForRegisterPreservation;
+
+        jit.loadPtr(vm.addressOfCallFrameForCatch(), GPRInfo::callFrameRegister);
+        jit.addPtr(CCallHelpers::TrustedImm32(stackPointerOffset), GPRInfo::callFrameRegister, CCallHelpers::stackPointerRegister);
+
+        state.restoreLiveRegistersFromStackForCallWithThrownException(spillStateForJSGetterSetter);
+        state.restoreScratch();
+        CCallHelpers::Jump jumpToOSRExitExceptionHandler = jit.jump();
+
+        HandlerInfo oldHandler = state.originalExceptionHandler();
+        CallSiteIndex newExceptionHandlingCallSite = state.callSiteIndexForExceptionHandling();
+        jit.addLinkTask(
+            [=] (LinkBuffer& linkBuffer) {
+                linkBuffer.link(jumpToOSRExitExceptionHandler, oldHandler.nativeCode);
+
+                HandlerInfo handlerToRegister = oldHandler;
+                handlerToRegister.nativeCode = linkBuffer.locationOf(makeshiftCatchHandler);
+                handlerToRegister.start = newExceptionHandlingCallSite.bits();
+                handlerToRegister.end = newExceptionHandlingCallSite.bits() + 1;
+                codeBlock->appendExceptionHandler(handlerToRegister);
+            });
+
+        // We set these to indicate to the stub to remove itself from the CodeBlock's
+        // exception handler table when it is deallocated.
+        codeBlockThatOwnsExceptionHandlers = codeBlock;
+        ASSERT(JITCode::isOptimizingJIT(codeBlockThatOwnsExceptionHandlers->jitType()));
+        callSiteIndexForExceptionHandling = state.callSiteIndexForExceptionHandling();
+    }
+
+    LinkBuffer linkBuffer(vm, jit, codeBlock, JITCompilationCanFail);
+    if (linkBuffer.didFailToAllocate()) {
+        if (verbose)
+            dataLog("Did fail to allocate.\n");
+        return AccessGenerationResult::GaveUp;
+    }
+
+    CodeLocationLabel successLabel = stubInfo.doneLocation();
+        
+    linkBuffer.link(state.success, successLabel);
+
+    linkBuffer.link(failure, stubInfo.slowPathStartLocation());
+    
+    if (verbose)
+        dataLog(*codeBlock, " ", stubInfo.codeOrigin, ": Generating polymorphic access stub for ", listDump(cases), "\n");
+
+    MacroAssemblerCodeRef code = FINALIZE_CODE_FOR(
+        codeBlock, linkBuffer,
+        ("%s", toCString("Access stub for ", *codeBlock, " ", stubInfo.codeOrigin, " with return point ", successLabel, ": ", listDump(cases)).data()));
+
+    bool doesCalls = false;
+    Vector<JSCell*> cellsToMark;
+    for (auto& entry : cases)
+        doesCalls |= entry->doesCalls(&cellsToMark);
+    
+    m_stubRoutine = createJITStubRoutine(code, vm, codeBlock, doesCalls, cellsToMark, codeBlockThatOwnsExceptionHandlers, callSiteIndexForExceptionHandling);
+    m_watchpoints = WTFMove(state.watchpoints);
+    if (!state.weakReferences.isEmpty())
+        m_weakReferences = std::make_unique<Vector<WriteBarrier<JSCell>>>(WTFMove(state.weakReferences));
+    if (verbose)
+        dataLog("Returning: ", code.code(), "\n");
+    
+    m_list = WTFMove(cases);
+    
+    AccessGenerationResult::Kind resultKind;
+    if (m_list.size() >= Options::maxAccessVariantListSize())
+        resultKind = AccessGenerationResult::GeneratedFinalCode;
+    else
+        resultKind = AccessGenerationResult::GeneratedNewCode;
+    
+    return AccessGenerationResult(resultKind, code.code());
+}
+
+void PolymorphicAccess::aboutToDie()
+{
+    if (m_stubRoutine)
+        m_stubRoutine->aboutToDie();
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, AccessGenerationResult::Kind kind)
+{
+    switch (kind) {
+    case AccessGenerationResult::MadeNoChanges:
+        out.print("MadeNoChanges");
+        return;
+    case AccessGenerationResult::GaveUp:
+        out.print("GaveUp");
+        return;
+    case AccessGenerationResult::Buffered:
+        out.print("Buffered");
+        return;
+    case AccessGenerationResult::GeneratedNewCode:
+        out.print("GeneratedNewCode");
+        return;
+    case AccessGenerationResult::GeneratedFinalCode:
+        out.print("GeneratedFinalCode");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, AccessCase::AccessType type)
+{
+    switch (type) {
+    case AccessCase::Load:
+        out.print("Load");
+        return;
+    case AccessCase::MegamorphicLoad:
+        out.print("MegamorphicLoad");
+        return;
+    case AccessCase::Transition:
+        out.print("Transition");
+        return;
+    case AccessCase::Replace:
+        out.print("Replace");
+        return;
+    case AccessCase::Miss:
+        out.print("Miss");
+        return;
+    case AccessCase::GetGetter:
+        out.print("GetGetter");
+        return;
+    case AccessCase::Getter:
+        out.print("Getter");
+        return;
+    case AccessCase::Setter:
+        out.print("Setter");
+        return;
+    case AccessCase::CustomValueGetter:
+        out.print("CustomValueGetter");
+        return;
+    case AccessCase::CustomAccessorGetter:
+        out.print("CustomAccessorGetter");
+        return;
+    case AccessCase::CustomValueSetter:
+        out.print("CustomValueSetter");
+        return;
+    case AccessCase::CustomAccessorSetter:
+        out.print("CustomAccessorSetter");
+        return;
+    case AccessCase::IntrinsicGetter:
+        out.print("IntrinsicGetter");
+        return;
+    case AccessCase::InHit:
+        out.print("InHit");
+        return;
+    case AccessCase::InMiss:
+        out.print("InMiss");
+        return;
+    case AccessCase::ArrayLength:
+        out.print("ArrayLength");
+        return;
+    case AccessCase::StringLength:
+        out.print("StringLength");
+        return;
+    case AccessCase::DirectArgumentsLength:
+        out.print("DirectArgumentsLength");
+        return;
+    case AccessCase::ScopedArgumentsLength:
+        out.print("ScopedArgumentsLength");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, AccessCase::State state)
+{
+    switch (state) {
+    case AccessCase::Primordial:
+        out.print("Primordial");
+        return;
+    case AccessCase::Committed:
+        out.print("Committed");
+        return;
+    case AccessCase::Generated:
+        out.print("Generated");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(JIT)
+
+
diff --git a/bytecode/PolymorphicAccess.h b/bytecode/PolymorphicAccess.h
new file mode 100644
index 0000000..6f701c5
--- /dev/null
+++ b/bytecode/PolymorphicAccess.h
@@ -0,0 +1,547 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CodeOrigin.h"
+#include "JITStubRoutine.h"
+#include "JSFunctionInlines.h"
+#include "MacroAssembler.h"
+#include "ObjectPropertyConditionSet.h"
+#include "ScratchRegisterAllocator.h"
+#include "Structure.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
+
+class CodeBlock;
+class PolymorphicAccess;
+class StructureStubInfo;
+class WatchpointsOnStructureStubInfo;
+class ScratchRegisterAllocator;
+
+struct AccessGenerationState;
+
+// An AccessCase describes one of the cases of a PolymorphicAccess. A PolymorphicAccess represents a
+// planned (to generate in future) or generated stub for some inline cache. That stub contains fast
+// path code for some finite number of fast cases, each described by an AccessCase object.
+//
+// An AccessCase object has a lifecycle that proceeds through several states. Note that the states
+// of AccessCase have a lot to do with the global effect epoch (we'll say epoch for short). This is
+// a simple way of reasoning about the state of the system outside this AccessCase. Any observable
+// effect - like storing to a property, changing an object's structure, etc. - increments the epoch.
+// The states are:
+//
+// Primordial:   This is an AccessCase that was just allocated. It does not correspond to any actual
+//               code and it is not owned by any PolymorphicAccess. In this state, the AccessCase
+//               assumes that it is in the same epoch as when it was created. This is important
+//               because it may make claims about itself ("I represent a valid case so long as you
+//               register a watchpoint on this set") that could be contradicted by some outside
+//               effects (like firing and deleting the watchpoint set in question). This is also the
+//               state that an AccessCase is in when it is cloned (AccessCase::clone()).
+//
+// Committed:    This happens as soon as some PolymorphicAccess takes ownership of this AccessCase.
+//               In this state, the AccessCase no longer assumes anything about the epoch. To
+//               accomplish this, PolymorphicAccess calls AccessCase::commit(). This must be done
+//               during the same epoch when the AccessCase was created, either by the client or by
+//               clone(). When created by the client, committing during the same epoch works because
+//               we can be sure that whatever watchpoint sets they spoke of are still valid. When
+//               created by clone(), we can be sure that the set is still valid because the original
+//               of the clone still has watchpoints on it.
+//
+// Generated:    This is the state when the PolymorphicAccess generates code for this case by
+//               calling AccessCase::generate() or AccessCase::generateWithGuard(). At this point
+//               the case object will have some extra stuff in it, like possibly the CallLinkInfo
+//               object associated with the inline cache.
+//               FIXME: Moving into the Generated state should not mutate the AccessCase object or
+//               put more stuff into it. If we fix this, then we can get rid of AccessCase::clone().
+//               https://bugs.webkit.org/show_bug.cgi?id=156456
+//
+// An AccessCase may be destroyed while in any of these states.
+//
+// We will sometimes buffer committed AccessCases in the PolymorphicAccess object before generating
+// code. This allows us to only regenerate once we've accumulated (hopefully) more than one new
+// AccessCase.
+class AccessCase {
+    WTF_MAKE_NONCOPYABLE(AccessCase);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    enum AccessType : uint8_t {
+        Load,
+        MegamorphicLoad,
+        Transition,
+        Replace,
+        Miss,
+        GetGetter,
+        Getter,
+        Setter,
+        CustomValueGetter,
+        CustomAccessorGetter,
+        CustomValueSetter,
+        CustomAccessorSetter,
+        IntrinsicGetter,
+        InHit,
+        InMiss,
+        ArrayLength,
+        StringLength,
+        DirectArgumentsLength,
+        ScopedArgumentsLength
+    };
+    
+    enum State : uint8_t {
+        Primordial,
+        Committed,
+        Generated
+    };
+
+    static std::unique_ptr<AccessCase> tryGet(
+        VM&, JSCell* owner, AccessType, PropertyOffset, Structure*,
+        const ObjectPropertyConditionSet& = ObjectPropertyConditionSet(),
+        bool viaProxy = false,
+        WatchpointSet* additionalSet = nullptr);
+
+    static std::unique_ptr<AccessCase> get(
+        VM&, JSCell* owner, AccessType, PropertyOffset, Structure*,
+        const ObjectPropertyConditionSet& = ObjectPropertyConditionSet(),
+        bool viaProxy = false,
+        WatchpointSet* additionalSet = nullptr,
+        PropertySlot::GetValueFunc = nullptr,
+        JSObject* customSlotBase = nullptr,
+        DOMJIT::GetterSetter* = nullptr);
+    
+    static std::unique_ptr<AccessCase> megamorphicLoad(VM&, JSCell* owner);
+    
+    static std::unique_ptr<AccessCase> replace(VM&, JSCell* owner, Structure*, PropertyOffset);
+
+    static std::unique_ptr<AccessCase> transition(
+        VM&, JSCell* owner, Structure* oldStructure, Structure* newStructure, PropertyOffset,
+        const ObjectPropertyConditionSet& = ObjectPropertyConditionSet());
+
+    static std::unique_ptr<AccessCase> setter(
+        VM&, JSCell* owner, AccessType, Structure*, PropertyOffset,
+        const ObjectPropertyConditionSet&, PutPropertySlot::PutValueFunc = nullptr,
+        JSObject* customSlotBase = nullptr);
+
+    static std::unique_ptr<AccessCase> in(
+        VM&, JSCell* owner, AccessType, Structure*,
+        const ObjectPropertyConditionSet& = ObjectPropertyConditionSet());
+
+    static std::unique_ptr<AccessCase> getLength(VM&, JSCell* owner, AccessType);
+    static std::unique_ptr<AccessCase> getIntrinsic(VM&, JSCell* owner, JSFunction* intrinsic, PropertyOffset, Structure*, const ObjectPropertyConditionSet&);
+    
+    static std::unique_ptr<AccessCase> fromStructureStubInfo(VM&, JSCell* owner, StructureStubInfo&);
+
+    ~AccessCase();
+    
+    AccessType type() const { return m_type; }
+    State state() const { return m_state; }
+    PropertyOffset offset() const { return m_offset; }
+    bool viaProxy() const { return m_rareData ? m_rareData->viaProxy : false; }
+    
+    Structure* structure() const
+    {
+        if (m_type == Transition)
+            return m_structure->previousID();
+        return m_structure.get();
+    }
+    bool guardedByStructureCheck() const;
+
+    Structure* newStructure() const
+    {
+        ASSERT(m_type == Transition);
+        return m_structure.get();
+    }
+    
+    ObjectPropertyConditionSet conditionSet() const { return m_conditionSet; }
+    JSFunction* intrinsicFunction() const
+    {
+        ASSERT(type() == IntrinsicGetter && m_rareData);
+        return m_rareData->intrinsicFunction.get();
+    }
+    Intrinsic intrinsic() const
+    {
+        return intrinsicFunction()->intrinsic();
+    }
+
+    DOMJIT::GetterSetter* domJIT() const
+    {
+        ASSERT(m_rareData);
+        return m_rareData->domJIT;
+    }
+
+    WatchpointSet* additionalSet() const
+    {
+        return m_rareData ? m_rareData->additionalSet.get() : nullptr;
+    }
+
+    JSObject* customSlotBase() const
+    {
+        return m_rareData ? m_rareData->customSlotBase.get() : nullptr;
+    }
+
+    JSObject* alternateBase() const;
+
+    // If you supply the optional vector, this will append the set of cells that this will need to keep alive
+    // past the call.
+    bool doesCalls(Vector<JSCell*>* cellsToMark = nullptr) const;
+
+    bool isGetter() const
+    {
+        switch (type()) {
+        case Getter:
+        case CustomValueGetter:
+        case CustomAccessorGetter:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    // This can return null even for a getter/setter, if it hasn't been generated yet. That's
+    // actually somewhat likely because of how we do buffering of new cases.
+    CallLinkInfo* callLinkInfo() const
+    {
+        if (!m_rareData)
+            return nullptr;
+        return m_rareData->callLinkInfo.get();
+    }
+    
+    // Is it still possible for this case to ever be taken?  Must call this as a prerequisite for
+    // calling generate() and friends.  If this returns true, then you can call generate().  If
+    // this returns false, then generate() will crash.  You must call generate() in the same epoch
+    // as when you called couldStillSucceed().
+    bool couldStillSucceed() const;
+    
+    static bool canEmitIntrinsicGetter(JSFunction*, Structure*);
+
+    bool canBeReplacedByMegamorphicLoad() const;
+
+    // If this method returns true, then it's a good idea to remove 'other' from the access once 'this'
+    // is added. This method assumes that in case of contradictions, 'this' represents a newer, and so
+    // more useful, truth. This method can be conservative; it will return false when it doubt.
+    bool canReplace(const AccessCase& other) const;
+
+    void dump(PrintStream& out) const;
+    
+private:
+    friend class CodeBlock;
+    friend class PolymorphicAccess;
+
+    AccessCase();
+
+    bool visitWeak(VM&) const;
+    bool propagateTransitions(SlotVisitor&) const;
+    
+    // FIXME: This only exists because of how AccessCase puts post-generation things into itself.
+    // https://bugs.webkit.org/show_bug.cgi?id=156456
+    std::unique_ptr<AccessCase> clone() const;
+    
+    // Perform any action that must be performed before the end of the epoch in which the case
+    // was created. Returns a set of watchpoint sets that will need to be watched.
+    Vector<WatchpointSet*, 2> commit(VM&, const Identifier&);
+
+    // Fall through on success. Two kinds of failures are supported: fall-through, which means that we
+    // should try a different case; and failure, which means that this was the right case but it needs
+    // help from the slow path.
+    void generateWithGuard(AccessGenerationState&, MacroAssembler::JumpList& fallThrough);
+
+    // Fall through on success, add a jump to the failure list on failure.
+    void generate(AccessGenerationState&);
+    
+    void generateImpl(AccessGenerationState&);
+    void emitIntrinsicGetter(AccessGenerationState&);
+    void emitDOMJITGetter(AccessGenerationState&, GPRReg baseForGetGPR);
+    
+    AccessType m_type { Load };
+    State m_state { Primordial };
+    PropertyOffset m_offset { invalidOffset };
+
+    // Usually this is the structure that we expect the base object to have. But, this is the *new*
+    // structure for a transition and we rely on the fact that it has a strong reference to the old
+    // structure. For proxies, this is the structure of the object behind the proxy.
+    WriteBarrier<Structure> m_structure;
+
+    ObjectPropertyConditionSet m_conditionSet;
+
+    class RareData {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        RareData()
+            : viaProxy(false)
+            , domJIT(nullptr)
+        {
+            customAccessor.opaque = nullptr;
+        }
+        
+        bool viaProxy;
+        RefPtr<WatchpointSet> additionalSet;
+        // FIXME: This should probably live in the stub routine object.
+        // https://bugs.webkit.org/show_bug.cgi?id=156456
+        std::unique_ptr<CallLinkInfo> callLinkInfo;
+        union {
+            PropertySlot::GetValueFunc getter;
+            PutPropertySlot::PutValueFunc setter;
+            void* opaque;
+        } customAccessor;
+        WriteBarrier<JSObject> customSlotBase;
+        WriteBarrier<JSFunction> intrinsicFunction;
+        DOMJIT::GetterSetter* domJIT;
+    };
+
+    std::unique_ptr<RareData> m_rareData;
+};
+
+class AccessGenerationResult {
+public:
+    enum Kind {
+        MadeNoChanges,
+        GaveUp,
+        Buffered,
+        GeneratedNewCode,
+        GeneratedFinalCode // Generated so much code that we never want to generate code again.
+    };
+    
+    AccessGenerationResult()
+    {
+    }
+    
+    AccessGenerationResult(Kind kind)
+        : m_kind(kind)
+    {
+        RELEASE_ASSERT(kind != GeneratedNewCode);
+        RELEASE_ASSERT(kind != GeneratedFinalCode);
+    }
+    
+    AccessGenerationResult(Kind kind, MacroAssemblerCodePtr code)
+        : m_kind(kind)
+        , m_code(code)
+    {
+        RELEASE_ASSERT(kind == GeneratedNewCode || kind == GeneratedFinalCode);
+        RELEASE_ASSERT(code);
+    }
+    
+    bool operator==(const AccessGenerationResult& other) const
+    {
+        return m_kind == other.m_kind && m_code == other.m_code;
+    }
+    
+    bool operator!=(const AccessGenerationResult& other) const
+    {
+        return !(*this == other);
+    }
+    
+    explicit operator bool() const
+    {
+        return *this != AccessGenerationResult();
+    }
+    
+    Kind kind() const { return m_kind; }
+    
+    const MacroAssemblerCodePtr& code() const { return m_code; }
+    
+    bool madeNoChanges() const { return m_kind == MadeNoChanges; }
+    bool gaveUp() const { return m_kind == GaveUp; }
+    bool buffered() const { return m_kind == Buffered; }
+    bool generatedNewCode() const { return m_kind == GeneratedNewCode; }
+    bool generatedFinalCode() const { return m_kind == GeneratedFinalCode; }
+    
+    // If we gave up on this attempt to generate code, or if we generated the "final" code, then we
+    // should give up after this.
+    bool shouldGiveUpNow() const { return gaveUp() || generatedFinalCode(); }
+    
+    bool generatedSomeCode() const { return generatedNewCode() || generatedFinalCode(); }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    Kind m_kind;
+    MacroAssemblerCodePtr m_code;
+};
+
+class PolymorphicAccess {
+    WTF_MAKE_NONCOPYABLE(PolymorphicAccess);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    PolymorphicAccess();
+    ~PolymorphicAccess();
+
+    // When this fails (returns GaveUp), this will leave the old stub intact but you should not try
+    // to call this method again for that PolymorphicAccess instance.
+    AccessGenerationResult addCases(
+        VM&, CodeBlock*, StructureStubInfo&, const Identifier&, Vector<std::unique_ptr<AccessCase>, 2>);
+
+    AccessGenerationResult addCase(
+        VM&, CodeBlock*, StructureStubInfo&, const Identifier&, std::unique_ptr<AccessCase>);
+    
+    AccessGenerationResult regenerate(VM&, CodeBlock*, StructureStubInfo&, const Identifier&);
+    
+    bool isEmpty() const { return m_list.isEmpty(); }
+    unsigned size() const { return m_list.size(); }
+    const AccessCase& at(unsigned i) const { return *m_list[i]; }
+    const AccessCase& operator[](unsigned i) const { return *m_list[i]; }
+
+    // If this returns false then we are requesting a reset of the owning StructureStubInfo.
+    bool visitWeak(VM&) const;
+    
+    // This returns true if it has marked everything it will ever marked. This can be used as an
+    // optimization to then avoid calling this method again during the fixpoint.
+    bool propagateTransitions(SlotVisitor&) const;
+
+    void aboutToDie();
+
+    void dump(PrintStream& out) const;
+    bool containsPC(void* pc) const
+    { 
+        if (!m_stubRoutine)
+            return false;
+
+        uintptr_t pcAsInt = bitwise_cast<uintptr_t>(pc);
+        return m_stubRoutine->startAddress() <= pcAsInt && pcAsInt <= m_stubRoutine->endAddress();
+    }
+
+private:
+    friend class AccessCase;
+    friend class CodeBlock;
+    friend struct AccessGenerationState;
+    
+    typedef Vector<std::unique_ptr<AccessCase>, 2> ListType;
+    
+    void commit(
+        VM&, std::unique_ptr<WatchpointsOnStructureStubInfo>&, CodeBlock*, StructureStubInfo&,
+        const Identifier&, AccessCase&);
+
+    MacroAssemblerCodePtr regenerate(
+        VM&, CodeBlock*, StructureStubInfo&, const Identifier&, ListType& cases);
+
+    ListType m_list;
+    RefPtr<JITStubRoutine> m_stubRoutine;
+    std::unique_ptr<WatchpointsOnStructureStubInfo> m_watchpoints;
+    std::unique_ptr<Vector<WriteBarrier<JSCell>>> m_weakReferences;
+};
+
+struct AccessGenerationState {
+    AccessGenerationState()
+        : m_calculatedRegistersForCallAndExceptionHandling(false)
+        , m_needsToRestoreRegistersIfException(false)
+        , m_calculatedCallSiteIndex(false)
+    {
+    }
+    CCallHelpers* jit { nullptr };
+    ScratchRegisterAllocator* allocator;
+    ScratchRegisterAllocator::PreservedState preservedReusedRegisterState;
+    PolymorphicAccess* access { nullptr };
+    StructureStubInfo* stubInfo { nullptr };
+    MacroAssembler::JumpList success;
+    MacroAssembler::JumpList failAndRepatch;
+    MacroAssembler::JumpList failAndIgnore;
+    GPRReg baseGPR { InvalidGPRReg };
+    JSValueRegs valueRegs;
+    GPRReg scratchGPR { InvalidGPRReg };
+    const Identifier* ident;
+    std::unique_ptr<WatchpointsOnStructureStubInfo> watchpoints;
+    Vector<WriteBarrier<JSCell>> weakReferences;
+
+    Watchpoint* addWatchpoint(const ObjectPropertyCondition& = ObjectPropertyCondition());
+
+    void restoreScratch();
+    void succeed();
+
+    struct SpillState {
+        SpillState() = default;
+        SpillState(RegisterSet&& regs, unsigned usedStackBytes)
+            : spilledRegisters(WTFMove(regs))
+            , numberOfStackBytesUsedForRegisterPreservation(usedStackBytes)
+        {
+        }
+
+        RegisterSet spilledRegisters { };
+        unsigned numberOfStackBytesUsedForRegisterPreservation { std::numeric_limits<unsigned>::max() };
+
+        bool isEmpty() const { return numberOfStackBytesUsedForRegisterPreservation == std::numeric_limits<unsigned>::max(); }
+    };
+
+    const RegisterSet& calculateLiveRegistersForCallAndExceptionHandling();
+
+    SpillState preserveLiveRegistersToStackForCall(const RegisterSet& extra = RegisterSet());
+
+    void restoreLiveRegistersFromStackForCallWithThrownException(const SpillState&);
+    void restoreLiveRegistersFromStackForCall(const SpillState&, const RegisterSet& dontRestore = RegisterSet());
+
+    const RegisterSet& liveRegistersForCall();
+
+    CallSiteIndex callSiteIndexForExceptionHandlingOrOriginal();
+    CallSiteIndex callSiteIndexForExceptionHandling()
+    {
+        RELEASE_ASSERT(m_calculatedRegistersForCallAndExceptionHandling);
+        RELEASE_ASSERT(m_needsToRestoreRegistersIfException);
+        RELEASE_ASSERT(m_calculatedCallSiteIndex);
+        return m_callSiteIndex;
+    }
+
+    const HandlerInfo& originalExceptionHandler();
+
+    bool needsToRestoreRegistersIfException() const { return m_needsToRestoreRegistersIfException; }
+    CallSiteIndex originalCallSiteIndex() const;
+    
+    void emitExplicitExceptionHandler();
+
+    void setSpillStateForJSGetterSetter(SpillState& spillState)
+    {
+        if (!m_spillStateForJSGetterSetter.isEmpty()) {
+            ASSERT(m_spillStateForJSGetterSetter.numberOfStackBytesUsedForRegisterPreservation == spillState.numberOfStackBytesUsedForRegisterPreservation);
+            ASSERT(m_spillStateForJSGetterSetter.spilledRegisters == spillState.spilledRegisters);
+        }
+        m_spillStateForJSGetterSetter = spillState;
+    }
+    SpillState spillStateForJSGetterSetter() const { return m_spillStateForJSGetterSetter; }
+    
+private:
+    const RegisterSet& liveRegistersToPreserveAtExceptionHandlingCallSite();
+    
+    RegisterSet m_liveRegistersToPreserveAtExceptionHandlingCallSite;
+    RegisterSet m_liveRegistersForCall;
+    CallSiteIndex m_callSiteIndex { CallSiteIndex(std::numeric_limits<unsigned>::max()) };
+    SpillState m_spillStateForJSGetterSetter;
+    bool m_calculatedRegistersForCallAndExceptionHandling : 1;
+    bool m_needsToRestoreRegistersIfException : 1;
+    bool m_calculatedCallSiteIndex : 1;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::AccessGenerationResult::Kind);
+void printInternal(PrintStream&, JSC::AccessCase::AccessType);
+void printInternal(PrintStream&, JSC::AccessCase::State);
+
+} // namespace WTF
+
+#endif // ENABLE(JIT)
diff --git a/bytecode/PreciseJumpTargets.cpp b/bytecode/PreciseJumpTargets.cpp
new file mode 100644
index 0000000..9c06e7e
--- /dev/null
+++ b/bytecode/PreciseJumpTargets.cpp
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PreciseJumpTargets.h"
+
+#include "InterpreterInlines.h"
+#include "JSCInlines.h"
+#include "PreciseJumpTargetsInlines.h"
+
+namespace JSC {
+
+template <size_t vectorSize, typename Block, typename Instruction>
+static void getJumpTargetsForBytecodeOffset(Block* codeBlock, Interpreter* interpreter, Instruction* instructionsBegin, unsigned bytecodeOffset, Vector<unsigned, vectorSize>& out)
+{
+    OpcodeID opcodeID = interpreter->getOpcodeID(instructionsBegin[bytecodeOffset]);
+    extractStoredJumpTargetsForBytecodeOffset(codeBlock, interpreter, instructionsBegin, bytecodeOffset, [&](int32_t& relativeOffset) {
+        out.append(bytecodeOffset + relativeOffset);
+    });
+    // op_loop_hint does not have jump target stored in bytecode instructions.
+    if (opcodeID == op_loop_hint)
+        out.append(bytecodeOffset);
+}
+
+enum class ComputePreciseJumpTargetsMode {
+    FollowCodeBlockClaim,
+    ForceCompute,
+};
+
+template<ComputePreciseJumpTargetsMode Mode, typename Block, typename Instruction, size_t vectorSize>
+void computePreciseJumpTargetsInternal(Block* codeBlock, Instruction* instructionsBegin, unsigned instructionCount, Vector<unsigned, vectorSize>& out)
+{
+    ASSERT(out.isEmpty());
+    
+    // We will derive a superset of the jump targets that the code block thinks it has.
+    // So, if the code block claims there are none, then we are done.
+    if (Mode == ComputePreciseJumpTargetsMode::FollowCodeBlockClaim && !codeBlock->numberOfJumpTargets())
+        return;
+    
+    for (unsigned i = codeBlock->numberOfExceptionHandlers(); i--;) {
+        out.append(codeBlock->exceptionHandler(i).target);
+        out.append(codeBlock->exceptionHandler(i).start);
+        out.append(codeBlock->exceptionHandler(i).end);
+    }
+
+    Interpreter* interpreter = codeBlock->vm()->interpreter;
+    for (unsigned bytecodeOffset = 0; bytecodeOffset < instructionCount;) {
+        OpcodeID opcodeID = interpreter->getOpcodeID(instructionsBegin[bytecodeOffset]);
+        getJumpTargetsForBytecodeOffset(codeBlock, interpreter, instructionsBegin, bytecodeOffset, out);
+        bytecodeOffset += opcodeLengths[opcodeID];
+    }
+    
+    std::sort(out.begin(), out.end());
+    
+    // We will have duplicates, and we must remove them.
+    unsigned toIndex = 0;
+    unsigned fromIndex = 0;
+    unsigned lastValue = UINT_MAX;
+    while (fromIndex < out.size()) {
+        unsigned value = out[fromIndex++];
+        if (value == lastValue)
+            continue;
+        out[toIndex++] = value;
+        lastValue = value;
+    }
+    out.resize(toIndex);
+    out.shrinkToFit();
+}
+
+void computePreciseJumpTargets(CodeBlock* codeBlock, Vector<unsigned, 32>& out)
+{
+    computePreciseJumpTargetsInternal<ComputePreciseJumpTargetsMode::FollowCodeBlockClaim>(codeBlock, codeBlock->instructions().begin(), codeBlock->instructions().size(), out);
+}
+
+void computePreciseJumpTargets(CodeBlock* codeBlock, Instruction* instructionsBegin, unsigned instructionCount, Vector<unsigned, 32>& out)
+{
+    computePreciseJumpTargetsInternal<ComputePreciseJumpTargetsMode::FollowCodeBlockClaim>(codeBlock, instructionsBegin, instructionCount, out);
+}
+
+void computePreciseJumpTargets(UnlinkedCodeBlock* codeBlock, UnlinkedInstruction* instructionsBegin, unsigned instructionCount, Vector<unsigned, 32>& out)
+{
+    computePreciseJumpTargetsInternal<ComputePreciseJumpTargetsMode::FollowCodeBlockClaim>(codeBlock, instructionsBegin, instructionCount, out);
+}
+
+void recomputePreciseJumpTargets(UnlinkedCodeBlock* codeBlock, UnlinkedInstruction* instructionsBegin, unsigned instructionCount, Vector<unsigned>& out)
+{
+    computePreciseJumpTargetsInternal<ComputePreciseJumpTargetsMode::ForceCompute>(codeBlock, instructionsBegin, instructionCount, out);
+}
+
+void findJumpTargetsForBytecodeOffset(CodeBlock* codeBlock, Instruction* instructionsBegin, unsigned bytecodeOffset, Vector<unsigned, 1>& out)
+{
+    getJumpTargetsForBytecodeOffset(codeBlock, codeBlock->vm()->interpreter, instructionsBegin, bytecodeOffset, out);
+}
+
+void findJumpTargetsForBytecodeOffset(UnlinkedCodeBlock* codeBlock, UnlinkedInstruction* instructionsBegin, unsigned bytecodeOffset, Vector<unsigned, 1>& out)
+{
+    getJumpTargetsForBytecodeOffset(codeBlock, codeBlock->vm()->interpreter, instructionsBegin, bytecodeOffset, out);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/PreciseJumpTargets.h b/bytecode/PreciseJumpTargets.h
new file mode 100644
index 0000000..bcc9346
--- /dev/null
+++ b/bytecode/PreciseJumpTargets.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+
+namespace JSC {
+
+class UnlinkedCodeBlock;
+struct UnlinkedInstruction;
+
+// Return a sorted list of bytecode index that are the destination of a jump.
+void computePreciseJumpTargets(CodeBlock*, Vector<unsigned, 32>& out);
+void computePreciseJumpTargets(CodeBlock*, Instruction* instructionsBegin, unsigned instructionCount, Vector<unsigned, 32>& out);
+void computePreciseJumpTargets(UnlinkedCodeBlock*, UnlinkedInstruction* instructionsBegin, unsigned instructionCount, Vector<unsigned, 32>& out);
+
+void recomputePreciseJumpTargets(UnlinkedCodeBlock*, UnlinkedInstruction* instructionsBegin, unsigned instructionCount, Vector<unsigned>& out);
+
+void findJumpTargetsForBytecodeOffset(CodeBlock*, Instruction* instructionsBegin, unsigned bytecodeOffset, Vector<unsigned, 1>& out);
+void findJumpTargetsForBytecodeOffset(UnlinkedCodeBlock*, UnlinkedInstruction* instructionsBegin, unsigned bytecodeOffset, Vector<unsigned, 1>& out);
+
+} // namespace JSC
diff --git a/bytecode/PreciseJumpTargetsInlines.h b/bytecode/PreciseJumpTargetsInlines.h
new file mode 100644
index 0000000..19fdcdc
--- /dev/null
+++ b/bytecode/PreciseJumpTargetsInlines.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InterpreterInlines.h"
+#include "Opcode.h"
+#include "PreciseJumpTargets.h"
+
+namespace JSC {
+
+template<typename Block, typename Instruction, typename Function>
+inline void extractStoredJumpTargetsForBytecodeOffset(Block* codeBlock, Interpreter* interpreter, Instruction* instructionsBegin, unsigned bytecodeOffset, Function function)
+{
+    OpcodeID opcodeID = interpreter->getOpcodeID(instructionsBegin[bytecodeOffset]);
+    Instruction* current = instructionsBegin + bytecodeOffset;
+    switch (opcodeID) {
+    case op_jmp:
+        function(current[1].u.operand);
+        break;
+    case op_jtrue:
+    case op_jfalse:
+    case op_jeq_null:
+    case op_jneq_null:
+        function(current[2].u.operand);
+        break;
+    case op_jneq_ptr:
+    case op_jless:
+    case op_jlesseq:
+    case op_jgreater:
+    case op_jgreatereq:
+    case op_jnless:
+    case op_jnlesseq:
+    case op_jngreater:
+    case op_jngreatereq:
+        function(current[3].u.operand);
+        break;
+    case op_switch_imm:
+    case op_switch_char: {
+        auto& table = codeBlock->switchJumpTable(current[1].u.operand);
+        for (unsigned i = table.branchOffsets.size(); i--;)
+            function(table.branchOffsets[i]);
+        function(current[2].u.operand);
+        break;
+    }
+    case op_switch_string: {
+        auto& table = codeBlock->stringSwitchJumpTable(current[1].u.operand);
+        auto iter = table.offsetTable.begin();
+        auto end = table.offsetTable.end();
+        for (; iter != end; ++iter)
+            function(iter->value.branchOffset);
+        function(current[2].u.operand);
+        break;
+    }
+    default:
+        break;
+    }
+}
+
+} // namespace JSC
diff --git a/bytecode/ProgramCodeBlock.cpp b/bytecode/ProgramCodeBlock.cpp
new file mode 100644
index 0000000..b4fac57
--- /dev/null
+++ b/bytecode/ProgramCodeBlock.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008-2010, 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProgramCodeBlock.h"
+
+namespace JSC {
+
+const ClassInfo ProgramCodeBlock::s_info = {
+    "ProgramCodeBlock", &Base::s_info, 0,
+    CREATE_METHOD_TABLE(ProgramCodeBlock)
+};
+
+void ProgramCodeBlock::destroy(JSCell* cell)
+{
+    static_cast<ProgramCodeBlock*>(cell)->~ProgramCodeBlock();
+}
+
+} // namespace JSC
diff --git a/bytecode/ProgramCodeBlock.h b/bytecode/ProgramCodeBlock.h
new file mode 100644
index 0000000..94c7a7a
--- /dev/null
+++ b/bytecode/ProgramCodeBlock.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2008-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GlobalCodeBlock.h"
+#include "UnlinkedProgramCodeBlock.h"
+
+namespace JSC {
+
+class ProgramCodeBlock : public GlobalCodeBlock {
+public:
+    typedef GlobalCodeBlock Base;
+    DECLARE_INFO;
+
+    static ProgramCodeBlock* create(VM* vm, CopyParsedBlockTag, ProgramCodeBlock& other)
+    {
+        ProgramCodeBlock* instance = new (NotNull, allocateCell<ProgramCodeBlock>(vm->heap))
+            ProgramCodeBlock(vm, vm->programCodeBlockStructure.get(), CopyParsedBlock, other);
+        instance->finishCreation(*vm, CopyParsedBlock, other);
+        return instance;
+    }
+
+    static ProgramCodeBlock* create(VM* vm, ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock,
+        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned firstLineColumnOffset)
+    {
+        ProgramCodeBlock* instance = new (NotNull, allocateCell<ProgramCodeBlock>(vm->heap))
+            ProgramCodeBlock(vm, vm->programCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, firstLineColumnOffset);
+        instance->finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
+        return instance;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+private:
+    ProgramCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, ProgramCodeBlock& other)
+        : GlobalCodeBlock(vm, structure, CopyParsedBlock, other)
+    {
+    }
+
+    ProgramCodeBlock(VM* vm, Structure* structure, ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock,
+        JSScope* scope, PassRefPtr<SourceProvider> sourceProvider, unsigned firstLineColumnOffset)
+        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
+    {
+    }
+
+    static void destroy(JSCell*);
+};
+
+} // namespace JSC
diff --git a/bytecode/PropertyCondition.cpp b/bytecode/PropertyCondition.cpp
new file mode 100644
index 0000000..cb19283
--- /dev/null
+++ b/bytecode/PropertyCondition.cpp
@@ -0,0 +1,364 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PropertyCondition.h"
+
+#include "GetterSetter.h"
+#include "JSCInlines.h"
+#include "TrackedReferences.h"
+
+namespace JSC {
+
+static bool verbose = false;
+
+void PropertyCondition::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    if (!*this) {
+        out.print("<invalid>");
+        return;
+    }
+    
+    out.print(m_kind, " of ", m_uid);
+    switch (m_kind) {
+    case Presence:
+        out.print(" at ", offset(), " with attributes ", attributes());
+        return;
+    case Absence:
+    case AbsenceOfSetter:
+        out.print(" with prototype ", inContext(JSValue(prototype()), context));
+        return;
+    case Equivalence:
+        out.print(" with ", inContext(requiredValue(), context));
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void PropertyCondition::dump(PrintStream& out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+bool PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint(
+    Structure* structure, JSObject* base) const
+{
+    if (verbose) {
+        dataLog(
+            "Determining validity of ", *this, " with structure ", pointerDump(structure), " and base ",
+            JSValue(base), " assuming impure property watchpoints are set.\n");
+    }
+    
+    if (!*this) {
+        if (verbose)
+            dataLog("Invalid because unset.\n");
+        return false;
+    }
+    
+    if (!structure->propertyAccessesAreCacheable()) {
+        if (verbose)
+            dataLog("Invalid because accesses are not cacheable.\n");
+        return false;
+    }
+    
+    switch (m_kind) {
+    case Presence: {
+        unsigned currentAttributes;
+        PropertyOffset currentOffset = structure->getConcurrently(uid(), currentAttributes);
+        if (currentOffset != offset() || currentAttributes != attributes()) {
+            if (verbose) {
+                dataLog(
+                    "Invalid because we need offset, attributes to be ", offset(), ", ", attributes(),
+                    " but they are ", currentOffset, ", ", currentAttributes, "\n");
+            }
+            return false;
+        }
+        return true;
+    }
+        
+    case Absence: {
+        if (structure->isDictionary()) {
+            if (verbose)
+                dataLog("Invalid because it's a dictionary.\n");
+            return false;
+        }
+
+        PropertyOffset currentOffset = structure->getConcurrently(uid());
+        if (currentOffset != invalidOffset) {
+            if (verbose)
+                dataLog("Invalid because the property exists at offset: ", currentOffset, "\n");
+            return false;
+        }
+        
+        if (structure->storedPrototypeObject() != prototype()) {
+            if (verbose) {
+                dataLog(
+                    "Invalid because the prototype is ", structure->storedPrototype(), " even though "
+                    "it should have been ", JSValue(prototype()), "\n");
+            }
+            return false;
+        }
+        
+        return true;
+    }
+    
+    case AbsenceOfSetter: {
+        if (structure->isDictionary()) {
+            if (verbose)
+                dataLog("Invalid because it's a dictionary.\n");
+            return false;
+        }
+        
+        unsigned currentAttributes;
+        PropertyOffset currentOffset = structure->getConcurrently(uid(), currentAttributes);
+        if (currentOffset != invalidOffset) {
+            if (currentAttributes & (Accessor | CustomAccessor)) {
+                if (verbose) {
+                    dataLog(
+                        "Invalid because we expected not to have a setter, but we have one at offset ",
+                        currentOffset, " with attributes ", currentAttributes, "\n");
+                }
+                return false;
+            }
+        }
+        
+        if (structure->storedPrototypeObject() != prototype()) {
+            if (verbose) {
+                dataLog(
+                    "Invalid because the prototype is ", structure->storedPrototype(), " even though "
+                    "it should have been ", JSValue(prototype()), "\n");
+            }
+            return false;
+        }
+        
+        return true;
+    }
+        
+    case Equivalence: {
+        if (!base || base->structure() != structure) {
+            // Conservatively return false, since we cannot verify this one without having the
+            // object.
+            if (verbose) {
+                dataLog(
+                    "Invalid because we don't have a base or the base has the wrong structure: ",
+                    RawPointer(base), "\n");
+            }
+            return false;
+        }
+        
+        // FIXME: This is somewhat racy, and maybe more risky than we want.
+        // https://bugs.webkit.org/show_bug.cgi?id=134641
+        
+        PropertyOffset currentOffset = structure->getConcurrently(uid());
+        if (currentOffset == invalidOffset) {
+            if (verbose) {
+                dataLog(
+                    "Invalid because the base no long appears to have ", uid(), " on its structure: ",
+                        RawPointer(base), "\n");
+            }
+            return false;
+        }
+
+        JSValue currentValue = base->getDirect(currentOffset);
+        if (currentValue != requiredValue()) {
+            if (verbose) {
+                dataLog(
+                    "Invalid because the value is ", currentValue, " but we require ", requiredValue(),
+                    "\n");
+            }
+            return false;
+        }
+        
+        return true;
+    } }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool PropertyCondition::validityRequiresImpurePropertyWatchpoint(Structure* structure) const
+{
+    if (!*this)
+        return false;
+    
+    switch (m_kind) {
+    case Presence:
+    case Absence:
+    case Equivalence:
+        return structure->needImpurePropertyWatchpoint();
+    default:
+        return false;
+    }
+}
+
+bool PropertyCondition::isStillValid(Structure* structure, JSObject* base) const
+{
+    if (!isStillValidAssumingImpurePropertyWatchpoint(structure, base))
+        return false;
+
+    // Currently we assume that an impure property can cause a property to appear, and can also
+    // "shadow" an existing JS property on the same object. Hence it affects both presence and
+    // absence. It doesn't affect AbsenceOfSetter because impure properties aren't ever setters.
+    switch (m_kind) {
+    case Absence:
+        if (structure->typeInfo().getOwnPropertySlotIsImpure() || structure->typeInfo().getOwnPropertySlotIsImpureForPropertyAbsence())
+            return false;
+        break;
+    case Presence:
+    case Equivalence:
+        if (structure->typeInfo().getOwnPropertySlotIsImpure())
+            return false;
+        break;
+    default:
+        break;
+    }
+    
+    return true;
+}
+
+bool PropertyCondition::isWatchableWhenValid(
+    Structure* structure, WatchabilityEffort effort) const
+{
+    if (structure->transitionWatchpointSetHasBeenInvalidated())
+        return false;
+    
+    switch (m_kind) {
+    case Equivalence: {
+        PropertyOffset offset = structure->getConcurrently(uid());
+        
+        // This method should only be called when some variant of isValid returned true, which
+        // implies that we already confirmed that the structure knows of the property. We should
+        // also have verified that the Structure is a cacheable dictionary, which means we
+        // shouldn't have a TOCTOU race either.
+        RELEASE_ASSERT(offset != invalidOffset);
+        
+        WatchpointSet* set = nullptr;
+        switch (effort) {
+        case MakeNoChanges:
+            set = structure->propertyReplacementWatchpointSet(offset);
+            break;
+        case EnsureWatchability:
+            set = structure->ensurePropertyReplacementWatchpointSet(
+                *Heap::heap(structure)->vm(), offset);
+            break;
+        }
+        
+        if (!set || !set->isStillValid())
+            return false;
+        
+        break;
+    }
+        
+    default:
+        break;
+    }
+    
+    return true;
+}
+
+bool PropertyCondition::isWatchableAssumingImpurePropertyWatchpoint(
+    Structure* structure, JSObject* base, WatchabilityEffort effort) const
+{
+    return isStillValidAssumingImpurePropertyWatchpoint(structure, base)
+        && isWatchableWhenValid(structure, effort);
+}
+
+bool PropertyCondition::isWatchable(
+    Structure* structure, JSObject* base, WatchabilityEffort effort) const
+{
+    return isStillValid(structure, base)
+        && isWatchableWhenValid(structure, effort);
+}
+
+bool PropertyCondition::isStillLive() const
+{
+    if (hasPrototype() && prototype() && !Heap::isMarked(prototype()))
+        return false;
+    
+    if (hasRequiredValue()
+        && requiredValue()
+        && requiredValue().isCell()
+        && !Heap::isMarked(requiredValue().asCell()))
+        return false;
+    
+    return true;
+}
+
+void PropertyCondition::validateReferences(const TrackedReferences& tracked) const
+{
+    if (hasPrototype())
+        tracked.check(prototype());
+    
+    if (hasRequiredValue())
+        tracked.check(requiredValue());
+}
+
+bool PropertyCondition::isValidValueForAttributes(JSValue value, unsigned attributes)
+{
+    bool attributesClaimAccessor = !!(attributes & Accessor);
+    bool valueClaimsAccessor = !!jsDynamicCast<GetterSetter*>(value);
+    return attributesClaimAccessor == valueClaimsAccessor;
+}
+
+bool PropertyCondition::isValidValueForPresence(JSValue value) const
+{
+    return isValidValueForAttributes(value, attributes());
+}
+
+PropertyCondition PropertyCondition::attemptToMakeEquivalenceWithoutBarrier(JSObject* base) const
+{
+    Structure* structure = base->structure();
+    if (!structure->isValidOffset(offset()))
+        return PropertyCondition();
+    JSValue value = base->getDirect(offset());
+    if (!isValidValueForPresence(value))
+        return PropertyCondition();
+    return equivalenceWithoutBarrier(uid(), value);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::PropertyCondition::Kind condition)
+{
+    switch (condition) {
+    case JSC::PropertyCondition::Presence:
+        out.print("Presence");
+        return;
+    case JSC::PropertyCondition::Absence:
+        out.print("Absence");
+        return;
+    case JSC::PropertyCondition::AbsenceOfSetter:
+        out.print("Absence");
+        return;
+    case JSC::PropertyCondition::Equivalence:
+        out.print("Equivalence");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
diff --git a/bytecode/PropertyCondition.h b/bytecode/PropertyCondition.h
new file mode 100644
index 0000000..ea85b18
--- /dev/null
+++ b/bytecode/PropertyCondition.h
@@ -0,0 +1,334 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class TrackedReferences;
+
+class PropertyCondition {
+public:
+    enum Kind {
+        Presence,
+        Absence,
+        AbsenceOfSetter,
+        Equivalence // An adaptive watchpoint on this will be a pair of watchpoints, and when the structure transitions, we will set the replacement watchpoint on the new structure.
+    };
+    
+    PropertyCondition()
+        : m_uid(nullptr)
+        , m_kind(Presence)
+    {
+        memset(&u, 0, sizeof(u));
+    }
+    
+    PropertyCondition(WTF::HashTableDeletedValueType)
+        : m_uid(nullptr)
+        , m_kind(Absence)
+    {
+        memset(&u, 0, sizeof(u));
+    }
+    
+    static PropertyCondition presenceWithoutBarrier(UniquedStringImpl* uid, PropertyOffset offset, unsigned attributes)
+    {
+        PropertyCondition result;
+        result.m_uid = uid;
+        result.m_kind = Presence;
+        result.u.presence.offset = offset;
+        result.u.presence.attributes = attributes;
+        return result;
+    }
+    
+    static PropertyCondition presence(
+        VM&, JSCell*, UniquedStringImpl* uid, PropertyOffset offset, unsigned attributes)
+    {
+        return presenceWithoutBarrier(uid, offset, attributes);
+    }
+
+    // NOTE: The prototype is the storedPrototype not the prototypeForLookup.
+    static PropertyCondition absenceWithoutBarrier(UniquedStringImpl* uid, JSObject* prototype)
+    {
+        PropertyCondition result;
+        result.m_uid = uid;
+        result.m_kind = Absence;
+        result.u.absence.prototype = prototype;
+        return result;
+    }
+    
+    static PropertyCondition absence(
+        VM& vm, JSCell* owner, UniquedStringImpl* uid, JSObject* prototype)
+    {
+        if (owner)
+            vm.heap.writeBarrier(owner);
+        return absenceWithoutBarrier(uid, prototype);
+    }
+    
+    static PropertyCondition absenceOfSetterWithoutBarrier(
+        UniquedStringImpl* uid, JSObject* prototype)
+    {
+        PropertyCondition result;
+        result.m_uid = uid;
+        result.m_kind = AbsenceOfSetter;
+        result.u.absence.prototype = prototype;
+        return result;
+    }
+    
+    static PropertyCondition absenceOfSetter(
+        VM& vm, JSCell* owner, UniquedStringImpl* uid, JSObject* prototype)
+    {
+        if (owner)
+            vm.heap.writeBarrier(owner);
+        return absenceOfSetterWithoutBarrier(uid, prototype);
+    }
+    
+    static PropertyCondition equivalenceWithoutBarrier(
+        UniquedStringImpl* uid, JSValue value)
+    {
+        PropertyCondition result;
+        result.m_uid = uid;
+        result.m_kind = Equivalence;
+        result.u.equivalence.value = JSValue::encode(value);
+        return result;
+    }
+        
+    static PropertyCondition equivalence(
+        VM& vm, JSCell* owner, UniquedStringImpl* uid, JSValue value)
+    {
+        if (value.isCell() && owner)
+            vm.heap.writeBarrier(owner);
+        return equivalenceWithoutBarrier(uid, value);
+    }
+    
+    explicit operator bool() const { return m_uid || m_kind != Presence; }
+    
+    Kind kind() const { return m_kind; }
+    UniquedStringImpl* uid() const { return m_uid; }
+    
+    bool hasOffset() const { return !!*this && m_kind == Presence; };
+    PropertyOffset offset() const
+    {
+        ASSERT(hasOffset());
+        return u.presence.offset;
+    }
+    bool hasAttributes() const { return !!*this && m_kind == Presence; };
+    unsigned attributes() const
+    {
+        ASSERT(hasAttributes());
+        return u.presence.attributes;
+    }
+    
+    bool hasPrototype() const { return !!*this && (m_kind == Absence || m_kind == AbsenceOfSetter); }
+    JSObject* prototype() const
+    {
+        ASSERT(hasPrototype());
+        return u.absence.prototype;
+    }
+    
+    bool hasRequiredValue() const { return !!*this && m_kind == Equivalence; }
+    JSValue requiredValue() const
+    {
+        ASSERT(hasRequiredValue());
+        return JSValue::decode(u.equivalence.value);
+    }
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+    
+    unsigned hash() const
+    {
+        unsigned result = WTF::PtrHash<UniquedStringImpl*>::hash(m_uid) + static_cast<unsigned>(m_kind);
+        switch (m_kind) {
+        case Presence:
+            result ^= u.presence.offset;
+            result ^= u.presence.attributes;
+            break;
+        case Absence:
+        case AbsenceOfSetter:
+            result ^= WTF::PtrHash<JSObject*>::hash(u.absence.prototype);
+            break;
+        case Equivalence:
+            result ^= EncodedJSValueHash::hash(u.equivalence.value);
+            break;
+        }
+        return result;
+    }
+    
+    bool operator==(const PropertyCondition& other) const
+    {
+        if (m_uid != other.m_uid)
+            return false;
+        if (m_kind != other.m_kind)
+            return false;
+        switch (m_kind) {
+        case Presence:
+            return u.presence.offset == other.u.presence.offset
+                && u.presence.attributes == other.u.presence.attributes;
+        case Absence:
+        case AbsenceOfSetter:
+            return u.absence.prototype == other.u.absence.prototype;
+        case Equivalence:
+            return u.equivalence.value == other.u.equivalence.value;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return !m_uid && m_kind == Absence;
+    }
+    
+    // Two conditions are compatible if they are identical or if they speak of different uids. If
+    // false is returned, you have to decide how to resolve the conflict - for example if there is
+    // a Presence and an Equivalence then in some cases you'll want the more general of the two
+    // while in other cases you'll want the more specific of the two. This will also return false
+    // for contradictions, like Presence and Absence on the same uid. By convention, invalid
+    // conditions aren't compatible with anything.
+    bool isCompatibleWith(const PropertyCondition& other) const
+    {
+        if (!*this || !other)
+            return false;
+        return *this == other || uid() != other.uid();
+    }
+    
+    // Checks if the object's structure claims that the property won't be intercepted.
+    bool isStillValidAssumingImpurePropertyWatchpoint(Structure*, JSObject* base = nullptr) const;
+    
+    // Returns true if we need an impure property watchpoint to ensure validity even if
+    // isStillValidAccordingToStructure() returned true.
+    bool validityRequiresImpurePropertyWatchpoint(Structure*) const;
+    
+    // Checks if the condition is still valid right now for the given object and structure.
+    // May conservatively return false, if the object and structure alone don't guarantee the
+    // condition. This happens for an Absence condition on an object that may have impure
+    // properties. If the object is not supplied, then a "true" return indicates that checking if
+    // an object has the given structure guarantees the condition still holds. If an object is
+    // supplied, then you may need to use some other watchpoints on the object to guarantee the
+    // condition in addition to the structure check.
+    bool isStillValid(Structure*, JSObject* base = nullptr) const;
+    
+    // In some cases, the condition is not watchable, but could be made watchable by enabling the
+    // appropriate watchpoint. For example, replacement watchpoints are enabled only when some
+    // access is cached on the property in some structure. This is mainly to save space for
+    // dictionary properties or properties that never get very hot. But, it's always safe to
+    // enable watching, provided that this is called from the main thread.
+    enum WatchabilityEffort {
+        // This is the default. It means that we don't change the state of any Structure or
+        // object, and implies that if the property happens not to be watchable then we don't make
+        // it watchable. This is mandatory if calling from a JIT thread. This is also somewhat
+        // preferable when first deciding whether to watch a condition for the first time (i.e.
+        // not from a watchpoint fire that causes us to see if we should adapt), since a
+        // watchpoint not being initialized for watching implies that maybe we don't know enough
+        // yet to make it profitable to watch -- as in, the thing being watched may not have
+        // stabilized yet. We prefer to only assume that a condition will hold if it has been
+        // known to hold for a while already.
+        MakeNoChanges,
+        
+        // Do what it takes to ensure that the property can be watched, if doing so has no
+        // user-observable effect. For now this just means that we will ensure that a property
+        // replacement watchpoint is enabled if it hadn't been enabled already. Do not use this
+        // from JIT threads, since the act of enabling watchpoints is not thread-safe.
+        EnsureWatchability
+    };
+    
+    // This means that it's still valid and we could enforce validity by setting a transition
+    // watchpoint on the structure and possibly an impure property watchpoint.
+    bool isWatchableAssumingImpurePropertyWatchpoint(
+        Structure*, JSObject* base = nullptr, WatchabilityEffort = MakeNoChanges) const;
+    
+    // This means that it's still valid and we could enforce validity by setting a transition
+    // watchpoint on the structure.
+    bool isWatchable(
+        Structure*, JSObject* base = nullptr, WatchabilityEffort = MakeNoChanges) const;
+    
+    bool watchingRequiresStructureTransitionWatchpoint() const
+    {
+        // Currently, this is required for all of our conditions.
+        return !!*this;
+    }
+    bool watchingRequiresReplacementWatchpoint() const
+    {
+        return !!*this && m_kind == Equivalence;
+    }
+    
+    // This means that the objects involved in this are still live.
+    bool isStillLive() const;
+    
+    void validateReferences(const TrackedReferences&) const;
+
+    static bool isValidValueForAttributes(JSValue value, unsigned attributes);
+
+    bool isValidValueForPresence(JSValue) const;
+
+    PropertyCondition attemptToMakeEquivalenceWithoutBarrier(JSObject* base) const;
+
+private:
+    bool isWatchableWhenValid(Structure*, WatchabilityEffort) const;
+
+    UniquedStringImpl* m_uid;
+    Kind m_kind;
+    union {
+        struct {
+            PropertyOffset offset;
+            unsigned attributes;
+        } presence;
+        struct {
+            JSObject* prototype;
+        } absence;
+        struct {
+            EncodedJSValue value;
+        } equivalence;
+    } u;
+};
+
+struct PropertyConditionHash {
+    static unsigned hash(const PropertyCondition& key) { return key.hash(); }
+    static bool equal(
+        const PropertyCondition& a, const PropertyCondition& b)
+    {
+        return a == b;
+    }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::PropertyCondition::Kind);
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::PropertyCondition> {
+    typedef JSC::PropertyConditionHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::PropertyCondition> : SimpleClassHashTraits<JSC::PropertyCondition> { };
+
+} // namespace WTF
diff --git a/bytecode/PutByIdFlags.cpp b/bytecode/PutByIdFlags.cpp
new file mode 100644
index 0000000..f280900
--- /dev/null
+++ b/bytecode/PutByIdFlags.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PutByIdFlags.h"
+
+#include "InferredType.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/PrintStream.h>
+#include <wtf/StringPrintStream.h>
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, PutByIdFlags flags) {
+    CommaPrinter comma("|");
+    if (flags & PutByIdIsDirect)
+        out.print(comma, "IsDirect");
+
+    InferredType::Kind kind = InferredType::kindForFlags(flags);
+    out.print(comma, kind);
+    if (InferredType::hasStructure(kind))
+        out.print(":", bitwise_cast<int32_t>(decodeStructureID(flags)));
+}
+
+} // namespace WTF
+
diff --git a/bytecode/PutByIdFlags.h b/bytecode/PutByIdFlags.h
new file mode 100644
index 0000000..dc2c5e2
--- /dev/null
+++ b/bytecode/PutByIdFlags.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "StructureIDTable.h"
+
+namespace JSC {
+
+enum PutByIdFlags : intptr_t {
+    PutByIdNone = 0,
+
+    // This flag indicates that the put_by_id is direct. That means that we store the property without
+    // checking if the prototype chain has a setter.
+    PutByIdIsDirect = 0x1,
+    PutByIdPersistentFlagsMask = 0x1,
+
+    // NOTE: The values below must be in sync with what is in LowLevelInterpreter.asm.
+
+    // Determining the required inferred type involves first checking the primary type mask, and then
+    // using that to figure out the meaning of the secondary mask:
+    // switch (flags & PutByIdPrimaryTypeMask) {
+    // case PutByIdPrimaryTypeSecondary:
+    //     switch (flags & PutByIdSecondaryTypeMask) {
+    //     ...
+    //     }
+    //     break;
+    // case PutByIdPrimaryTypeObjectWithStructure:
+    // case PutByIdPrimaryTypeObjectWithStructureOrOther:
+    //     StructureID structureID = decodeStructureID(flags);
+    //     break;
+    // }
+    PutByIdPrimaryTypeMask = 0x6,
+    PutByIdPrimaryTypeSecondary = 0x0, // Need to check the secondary type mask for the type.
+    PutByIdPrimaryTypeObjectWithStructure = 0x2, // Secondary type has structure ID.
+    PutByIdPrimaryTypeObjectWithStructureOrOther = 0x4, // Secondary type has structure ID.
+
+    PutByIdSecondaryTypeMask = -0x8,
+    PutByIdSecondaryTypeBottom = 0x0,
+    PutByIdSecondaryTypeBoolean = 0x8,
+    PutByIdSecondaryTypeOther = 0x10,
+    PutByIdSecondaryTypeInt32 = 0x18,
+    PutByIdSecondaryTypeNumber = 0x20,
+    PutByIdSecondaryTypeString = 0x28,
+    PutByIdSecondaryTypeSymbol = 0x30,
+    PutByIdSecondaryTypeObject = 0x38,
+    PutByIdSecondaryTypeObjectOrOther = 0x40,
+    PutByIdSecondaryTypeTop = 0x48
+};
+
+inline PutByIdFlags encodeStructureID(StructureID id)
+{
+#if USE(JSVALUE64)
+    return static_cast<PutByIdFlags>(static_cast<PutByIdFlags>(id) << 3);
+#else
+    PutByIdFlags result = bitwise_cast<PutByIdFlags>(id);
+    ASSERT(!(result & ~PutByIdSecondaryTypeMask));
+    return result;
+#endif
+}
+
+inline StructureID decodeStructureID(PutByIdFlags flags)
+{
+#if USE(JSVALUE64)
+    return static_cast<StructureID>(flags >> 3);
+#else
+    return bitwise_cast<StructureID>(flags & PutByIdSecondaryTypeMask);
+#endif
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::PutByIdFlags);
+
+} // namespace WTF
diff --git a/bytecode/PutByIdStatus.cpp b/bytecode/PutByIdStatus.cpp
new file mode 100644
index 0000000..fc0a472
--- /dev/null
+++ b/bytecode/PutByIdStatus.cpp
@@ -0,0 +1,419 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PutByIdStatus.h"
+
+#include "CodeBlock.h"
+#include "ComplexGetStatus.h"
+#include "LLIntData.h"
+#include "LowLevelInterpreter.h"
+#include "JSCInlines.h"
+#include "PolymorphicAccess.h"
+#include "Structure.h"
+#include "StructureChain.h"
+#include "StructureStubInfo.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+bool PutByIdStatus::appendVariant(const PutByIdVariant& variant)
+{
+    for (unsigned i = 0; i < m_variants.size(); ++i) {
+        if (m_variants[i].attemptToMerge(variant))
+            return true;
+    }
+    for (unsigned i = 0; i < m_variants.size(); ++i) {
+        if (m_variants[i].oldStructure().overlaps(variant.oldStructure()))
+            return false;
+    }
+    m_variants.append(variant);
+    return true;
+}
+
+#if ENABLE(DFG_JIT)
+bool PutByIdStatus::hasExitSite(const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, unsigned bytecodeIndex)
+{
+    return profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadCache))
+        || profiledBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadConstantCache));
+    
+}
+#endif
+
+PutByIdStatus PutByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned bytecodeIndex, UniquedStringImpl* uid)
+{
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+    UNUSED_PARAM(uid);
+
+    VM& vm = *profiledBlock->vm();
+    
+    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
+
+    StructureID structureID = instruction[4].u.structureID;
+    if (!structureID)
+        return PutByIdStatus(NoInformation);
+    
+    Structure* structure = vm.heap.structureIDTable().get(structureID);
+
+    StructureID newStructureID = instruction[6].u.structureID;
+    if (!newStructureID) {
+        PropertyOffset offset = structure->getConcurrently(uid);
+        if (!isValidOffset(offset))
+            return PutByIdStatus(NoInformation);
+        
+        return PutByIdVariant::replace(structure, offset, structure->inferredTypeDescriptorFor(uid));
+    }
+
+    Structure* newStructure = vm.heap.structureIDTable().get(newStructureID);
+    
+    ASSERT(structure->transitionWatchpointSetHasBeenInvalidated());
+    
+    PropertyOffset offset = newStructure->getConcurrently(uid);
+    if (!isValidOffset(offset))
+        return PutByIdStatus(NoInformation);
+    
+    ObjectPropertyConditionSet conditionSet;
+    if (!(instruction[8].u.putByIdFlags & PutByIdIsDirect)) {
+        conditionSet =
+            generateConditionsForPropertySetterMissConcurrently(
+                *profiledBlock->vm(), profiledBlock->globalObject(), structure, uid);
+        if (!conditionSet.isValid())
+            return PutByIdStatus(NoInformation);
+    }
+    
+    return PutByIdVariant::transition(
+        structure, newStructure, conditionSet, offset, newStructure->inferredTypeDescriptorFor(uid));
+}
+
+PutByIdStatus PutByIdStatus::computeFor(CodeBlock* profiledBlock, StubInfoMap& map, unsigned bytecodeIndex, UniquedStringImpl* uid)
+{
+    ConcurrentJSLocker locker(profiledBlock->m_lock);
+    
+    UNUSED_PARAM(profiledBlock);
+    UNUSED_PARAM(bytecodeIndex);
+    UNUSED_PARAM(uid);
+#if ENABLE(DFG_JIT)
+    if (hasExitSite(locker, profiledBlock, bytecodeIndex))
+        return PutByIdStatus(TakesSlowPath);
+    
+    StructureStubInfo* stubInfo = map.get(CodeOrigin(bytecodeIndex));
+    PutByIdStatus result = computeForStubInfo(
+        locker, profiledBlock, stubInfo, uid,
+        CallLinkStatus::computeExitSiteData(locker, profiledBlock, bytecodeIndex));
+    if (!result)
+        return computeFromLLInt(profiledBlock, bytecodeIndex, uid);
+    
+    return result;
+#else // ENABLE(JIT)
+    UNUSED_PARAM(map);
+    return PutByIdStatus(NoInformation);
+#endif // ENABLE(JIT)
+}
+
+#if ENABLE(JIT)
+PutByIdStatus PutByIdStatus::computeForStubInfo(const ConcurrentJSLocker& locker, CodeBlock* baselineBlock, StructureStubInfo* stubInfo, CodeOrigin codeOrigin, UniquedStringImpl* uid)
+{
+    return computeForStubInfo(
+        locker, baselineBlock, stubInfo, uid,
+        CallLinkStatus::computeExitSiteData(locker, baselineBlock, codeOrigin.bytecodeIndex));
+}
+
+PutByIdStatus PutByIdStatus::computeForStubInfo(
+    const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo,
+    UniquedStringImpl* uid, CallLinkStatus::ExitSiteData callExitSiteData)
+{
+    if (!stubInfo || !stubInfo->everConsidered)
+        return PutByIdStatus();
+    
+    if (stubInfo->tookSlowPath)
+        return PutByIdStatus(TakesSlowPath);
+    
+    switch (stubInfo->cacheType) {
+    case CacheType::Unset:
+        // This means that we attempted to cache but failed for some reason.
+        return PutByIdStatus(TakesSlowPath);
+        
+    case CacheType::PutByIdReplace: {
+        PropertyOffset offset =
+            stubInfo->u.byIdSelf.baseObjectStructure->getConcurrently(uid);
+        if (isValidOffset(offset)) {
+            return PutByIdVariant::replace(
+                stubInfo->u.byIdSelf.baseObjectStructure.get(), offset, InferredType::Top);
+        }
+        return PutByIdStatus(TakesSlowPath);
+    }
+        
+    case CacheType::Stub: {
+        PolymorphicAccess* list = stubInfo->u.stub;
+        
+        PutByIdStatus result;
+        result.m_state = Simple;
+        
+        State slowPathState = TakesSlowPath;
+        for (unsigned i = 0; i < list->size(); ++i) {
+            const AccessCase& access = list->at(i);
+            if (access.doesCalls())
+                slowPathState = MakesCalls;
+        }
+        
+        for (unsigned i = 0; i < list->size(); ++i) {
+            const AccessCase& access = list->at(i);
+            if (access.viaProxy())
+                return PutByIdStatus(slowPathState);
+            
+            PutByIdVariant variant;
+            
+            switch (access.type()) {
+            case AccessCase::Replace: {
+                Structure* structure = access.structure();
+                PropertyOffset offset = structure->getConcurrently(uid);
+                if (!isValidOffset(offset))
+                    return PutByIdStatus(slowPathState);
+                variant = PutByIdVariant::replace(
+                    structure, offset, structure->inferredTypeDescriptorFor(uid));
+                break;
+            }
+                
+            case AccessCase::Transition: {
+                PropertyOffset offset =
+                    access.newStructure()->getConcurrently(uid);
+                if (!isValidOffset(offset))
+                    return PutByIdStatus(slowPathState);
+                ObjectPropertyConditionSet conditionSet = access.conditionSet();
+                if (!conditionSet.structuresEnsureValidity())
+                    return PutByIdStatus(slowPathState);
+                variant = PutByIdVariant::transition(
+                    access.structure(), access.newStructure(), conditionSet, offset,
+                    access.newStructure()->inferredTypeDescriptorFor(uid));
+                break;
+            }
+                
+            case AccessCase::Setter: {
+                Structure* structure = access.structure();
+                
+                ComplexGetStatus complexGetStatus = ComplexGetStatus::computeFor(
+                    structure, access.conditionSet(), uid);
+                
+                switch (complexGetStatus.kind()) {
+                case ComplexGetStatus::ShouldSkip:
+                    continue;
+                    
+                case ComplexGetStatus::TakesSlowPath:
+                    return PutByIdStatus(slowPathState);
+                    
+                case ComplexGetStatus::Inlineable: {
+                    std::unique_ptr<CallLinkStatus> callLinkStatus =
+                        std::make_unique<CallLinkStatus>();
+                    if (CallLinkInfo* callLinkInfo = access.callLinkInfo()) {
+                        *callLinkStatus = CallLinkStatus::computeFor(
+                            locker, profiledBlock, *callLinkInfo, callExitSiteData);
+                    }
+                    
+                    variant = PutByIdVariant::setter(
+                        structure, complexGetStatus.offset(), complexGetStatus.conditionSet(),
+                        WTFMove(callLinkStatus));
+                } }
+                break;
+            }
+                
+            case AccessCase::CustomValueSetter:
+            case AccessCase::CustomAccessorSetter:
+                return PutByIdStatus(MakesCalls);
+
+            default:
+                return PutByIdStatus(slowPathState);
+            }
+            
+            if (!result.appendVariant(variant))
+                return PutByIdStatus(slowPathState);
+        }
+        
+        return result;
+    }
+        
+    default:
+        return PutByIdStatus(TakesSlowPath);
+    }
+}
+#endif
+
+PutByIdStatus PutByIdStatus::computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin codeOrigin, UniquedStringImpl* uid)
+{
+#if ENABLE(DFG_JIT)
+    if (dfgBlock) {
+        CallLinkStatus::ExitSiteData exitSiteData;
+        {
+            ConcurrentJSLocker locker(baselineBlock->m_lock);
+            if (hasExitSite(locker, baselineBlock, codeOrigin.bytecodeIndex))
+                return PutByIdStatus(TakesSlowPath);
+            exitSiteData = CallLinkStatus::computeExitSiteData(
+                locker, baselineBlock, codeOrigin.bytecodeIndex);
+        }
+            
+        PutByIdStatus result;
+        {
+            ConcurrentJSLocker locker(dfgBlock->m_lock);
+            result = computeForStubInfo(
+                locker, dfgBlock, dfgMap.get(codeOrigin), uid, exitSiteData);
+        }
+        
+        // We use TakesSlowPath in some cases where the stub was unset. That's weird and
+        // it would be better not to do that. But it means that we have to defend
+        // ourselves here.
+        if (result.isSimple())
+            return result;
+    }
+#else
+    UNUSED_PARAM(dfgBlock);
+    UNUSED_PARAM(dfgMap);
+#endif
+
+    return computeFor(baselineBlock, baselineMap, codeOrigin.bytecodeIndex, uid);
+}
+
+PutByIdStatus PutByIdStatus::computeFor(JSGlobalObject* globalObject, const StructureSet& set, UniquedStringImpl* uid, bool isDirect)
+{
+    if (parseIndex(*uid))
+        return PutByIdStatus(TakesSlowPath);
+
+    if (set.isEmpty())
+        return PutByIdStatus();
+    
+    PutByIdStatus result;
+    result.m_state = Simple;
+    for (unsigned i = 0; i < set.size(); ++i) {
+        Structure* structure = set[i];
+        
+        if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
+            return PutByIdStatus(TakesSlowPath);
+
+        if (!structure->propertyAccessesAreCacheable())
+            return PutByIdStatus(TakesSlowPath);
+    
+        unsigned attributes;
+        PropertyOffset offset = structure->getConcurrently(uid, attributes);
+        if (isValidOffset(offset)) {
+            if (attributes & CustomAccessor)
+                return PutByIdStatus(MakesCalls);
+
+            if (attributes & (Accessor | ReadOnly))
+                return PutByIdStatus(TakesSlowPath);
+            
+            WatchpointSet* replaceSet = structure->propertyReplacementWatchpointSet(offset);
+            if (!replaceSet || replaceSet->isStillValid()) {
+                // When this executes, it'll create, and fire, this replacement watchpoint set.
+                // That means that  this has probably never executed or that something fishy is
+                // going on. Also, we cannot create or fire the watchpoint set from the concurrent
+                // JIT thread, so even if we wanted to do this, we'd need to have a lazy thingy.
+                // So, better leave this alone and take slow path.
+                return PutByIdStatus(TakesSlowPath);
+            }
+
+            PutByIdVariant variant =
+                PutByIdVariant::replace(structure, offset, structure->inferredTypeDescriptorFor(uid));
+            if (!result.appendVariant(variant))
+                return PutByIdStatus(TakesSlowPath);
+            continue;
+        }
+    
+        // Our hypothesis is that we're doing a transition. Before we prove that this is really
+        // true, we want to do some sanity checks.
+    
+        // Don't cache put transitions on dictionaries.
+        if (structure->isDictionary())
+            return PutByIdStatus(TakesSlowPath);
+
+        // If the structure corresponds to something that isn't an object, then give up, since
+        // we don't want to be adding properties to strings.
+        if (!structure->typeInfo().isObject())
+            return PutByIdStatus(TakesSlowPath);
+    
+        ObjectPropertyConditionSet conditionSet;
+        if (!isDirect) {
+            conditionSet = generateConditionsForPropertySetterMissConcurrently(
+                globalObject->vm(), globalObject, structure, uid);
+            if (!conditionSet.isValid())
+                return PutByIdStatus(TakesSlowPath);
+        }
+    
+        // We only optimize if there is already a structure that the transition is cached to.
+        Structure* transition =
+            Structure::addPropertyTransitionToExistingStructureConcurrently(structure, uid, 0, offset);
+        if (!transition)
+            return PutByIdStatus(TakesSlowPath);
+        ASSERT(isValidOffset(offset));
+    
+        bool didAppend = result.appendVariant(
+            PutByIdVariant::transition(
+                structure, transition, conditionSet, offset,
+                transition->inferredTypeDescriptorFor(uid)));
+        if (!didAppend)
+            return PutByIdStatus(TakesSlowPath);
+    }
+    
+    return result;
+}
+
+bool PutByIdStatus::makesCalls() const
+{
+    if (m_state == MakesCalls)
+        return true;
+    
+    if (m_state != Simple)
+        return false;
+    
+    for (unsigned i = m_variants.size(); i--;) {
+        if (m_variants[i].makesCalls())
+            return true;
+    }
+    
+    return false;
+}
+
+void PutByIdStatus::dump(PrintStream& out) const
+{
+    switch (m_state) {
+    case NoInformation:
+        out.print("(NoInformation)");
+        return;
+        
+    case Simple:
+        out.print("(", listDump(m_variants), ")");
+        return;
+        
+    case TakesSlowPath:
+        out.print("(TakesSlowPath)");
+        return;
+    case MakesCalls:
+        out.print("(MakesCalls)");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace JSC
+
diff --git a/bytecode/PutByIdStatus.h b/bytecode/PutByIdStatus.h
new file mode 100644
index 0000000..1dd95cd
--- /dev/null
+++ b/bytecode/PutByIdStatus.h
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallLinkStatus.h"
+#include "ExitingJITType.h"
+#include "PutByIdVariant.h"
+#include <wtf/text/StringImpl.h>
+
+namespace JSC {
+
+class CodeBlock;
+class VM;
+class JSGlobalObject;
+class Structure;
+class StructureChain;
+class StructureStubInfo;
+
+typedef HashMap<CodeOrigin, StructureStubInfo*, CodeOriginApproximateHash> StubInfoMap;
+
+class PutByIdStatus {
+public:
+    enum State {
+        // It's uncached so we have no information.
+        NoInformation,
+        // It's cached as a simple store of some kind.
+        Simple,
+        // It's known to often take slow path.
+        TakesSlowPath,
+        // It's known to take paths that make calls.
+        MakesCalls
+    };
+    
+    PutByIdStatus()
+        : m_state(NoInformation)
+    {
+    }
+    
+    explicit PutByIdStatus(State state)
+        : m_state(state)
+    {
+        ASSERT(m_state == NoInformation || m_state == TakesSlowPath || m_state == MakesCalls);
+    }
+    
+    PutByIdStatus(const PutByIdVariant& variant)
+        : m_state(Simple)
+    {
+        m_variants.append(variant);
+    }
+    
+    static PutByIdStatus computeFor(CodeBlock*, StubInfoMap&, unsigned bytecodeIndex, UniquedStringImpl* uid);
+    static PutByIdStatus computeFor(JSGlobalObject*, const StructureSet&, UniquedStringImpl* uid, bool isDirect);
+    
+    static PutByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin, UniquedStringImpl* uid);
+
+#if ENABLE(JIT)
+    static PutByIdStatus computeForStubInfo(const ConcurrentJSLocker&, CodeBlock* baselineBlock, StructureStubInfo*, CodeOrigin, UniquedStringImpl* uid);
+#endif
+    
+    State state() const { return m_state; }
+    
+    bool isSet() const { return m_state != NoInformation; }
+    bool operator!() const { return m_state == NoInformation; }
+    bool isSimple() const { return m_state == Simple; }
+    bool takesSlowPath() const { return m_state == TakesSlowPath || m_state == MakesCalls; }
+    bool makesCalls() const;
+    
+    size_t numVariants() const { return m_variants.size(); }
+    const Vector<PutByIdVariant, 1>& variants() const { return m_variants; }
+    const PutByIdVariant& at(size_t index) const { return m_variants[index]; }
+    const PutByIdVariant& operator[](size_t index) const { return at(index); }
+    
+    void dump(PrintStream&) const;
+    
+private:
+#if ENABLE(DFG_JIT)
+    static bool hasExitSite(const ConcurrentJSLocker&, CodeBlock*, unsigned bytecodeIndex);
+#endif
+#if ENABLE(JIT)
+    static PutByIdStatus computeForStubInfo(
+        const ConcurrentJSLocker&, CodeBlock*, StructureStubInfo*, UniquedStringImpl* uid,
+        CallLinkStatus::ExitSiteData);
+#endif
+    static PutByIdStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex, UniquedStringImpl* uid);
+    
+    bool appendVariant(const PutByIdVariant&);
+    
+    State m_state;
+    Vector<PutByIdVariant, 1> m_variants;
+};
+
+} // namespace JSC
diff --git a/bytecode/PutByIdVariant.cpp b/bytecode/PutByIdVariant.cpp
new file mode 100644
index 0000000..9904c62
--- /dev/null
+++ b/bytecode/PutByIdVariant.cpp
@@ -0,0 +1,249 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PutByIdVariant.h"
+
+#include "CallLinkStatus.h"
+#include "JSCInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+PutByIdVariant::PutByIdVariant(const PutByIdVariant& other)
+    : PutByIdVariant()
+{
+    *this = other;
+}
+
+PutByIdVariant& PutByIdVariant::operator=(const PutByIdVariant& other)
+{
+    m_kind = other.m_kind;
+    m_oldStructure = other.m_oldStructure;
+    m_newStructure = other.m_newStructure;
+    m_conditionSet = other.m_conditionSet;
+    m_offset = other.m_offset;
+    m_requiredType = other.m_requiredType;
+    if (other.m_callLinkStatus)
+        m_callLinkStatus = std::make_unique<CallLinkStatus>(*other.m_callLinkStatus);
+    else
+        m_callLinkStatus = nullptr;
+    return *this;
+}
+
+PutByIdVariant PutByIdVariant::replace(
+    const StructureSet& structure, PropertyOffset offset, const InferredType::Descriptor& requiredType)
+{
+    PutByIdVariant result;
+    result.m_kind = Replace;
+    result.m_oldStructure = structure;
+    result.m_offset = offset;
+    result.m_requiredType = requiredType;
+    return result;
+}
+
+PutByIdVariant PutByIdVariant::transition(
+    const StructureSet& oldStructure, Structure* newStructure,
+    const ObjectPropertyConditionSet& conditionSet, PropertyOffset offset,
+    const InferredType::Descriptor& requiredType)
+{
+    PutByIdVariant result;
+    result.m_kind = Transition;
+    result.m_oldStructure = oldStructure;
+    result.m_newStructure = newStructure;
+    result.m_conditionSet = conditionSet;
+    result.m_offset = offset;
+    result.m_requiredType = requiredType;
+    return result;
+}
+
+PutByIdVariant PutByIdVariant::setter(
+    const StructureSet& structure, PropertyOffset offset,
+    const ObjectPropertyConditionSet& conditionSet,
+    std::unique_ptr<CallLinkStatus> callLinkStatus)
+{
+    PutByIdVariant result;
+    result.m_kind = Setter;
+    result.m_oldStructure = structure;
+    result.m_conditionSet = conditionSet;
+    result.m_offset = offset;
+    result.m_callLinkStatus = WTFMove(callLinkStatus);
+    result.m_requiredType = InferredType::Top;
+    return result;
+}
+
+Structure* PutByIdVariant::oldStructureForTransition() const
+{
+    ASSERT(kind() == Transition);
+    ASSERT(m_oldStructure.size() <= 2);
+    for (unsigned i = m_oldStructure.size(); i--;) {
+        Structure* structure = m_oldStructure[i];
+        if (structure != m_newStructure)
+            return structure;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+
+    return nullptr;
+}
+
+bool PutByIdVariant::writesStructures() const
+{
+    switch (kind()) {
+    case Transition:
+    case Setter:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool PutByIdVariant::reallocatesStorage() const
+{
+    switch (kind()) {
+    case Transition:
+        return oldStructureForTransition()->outOfLineCapacity() != newStructure()->outOfLineCapacity();
+    case Setter:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool PutByIdVariant::makesCalls() const
+{
+    return kind() == Setter;
+}
+
+bool PutByIdVariant::attemptToMerge(const PutByIdVariant& other)
+{
+    if (m_offset != other.m_offset)
+        return false;
+
+    if (m_requiredType != other.m_requiredType)
+        return false;
+    
+    switch (m_kind) {
+    case Replace: {
+        switch (other.m_kind) {
+        case Replace: {
+            ASSERT(m_conditionSet.isEmpty());
+            ASSERT(other.m_conditionSet.isEmpty());
+            
+            m_oldStructure.merge(other.m_oldStructure);
+            return true;
+        }
+            
+        case Transition: {
+            PutByIdVariant newVariant = other;
+            if (newVariant.attemptToMergeTransitionWithReplace(*this)) {
+                *this = newVariant;
+                return true;
+            }
+            return false;
+        }
+            
+        default:
+            return false;
+        }
+    }
+        
+    case Transition:
+        switch (other.m_kind) {
+        case Replace:
+            return attemptToMergeTransitionWithReplace(other);
+            
+        default:
+            return false;
+        }
+        
+    default:
+        return false;
+    }
+}
+
+bool PutByIdVariant::attemptToMergeTransitionWithReplace(const PutByIdVariant& replace)
+{
+    ASSERT(m_kind == Transition);
+    ASSERT(replace.m_kind == Replace);
+    ASSERT(m_offset == replace.m_offset);
+    ASSERT(!replace.writesStructures());
+    ASSERT(!replace.reallocatesStorage());
+    ASSERT(replace.conditionSet().isEmpty());
+    
+    // This sort of merging only works when we have one path along which we add a new field which
+    // transitions to structure S while the other path was already on structure S. This doesn't
+    // work if we need to reallocate anything or if the replace path is polymorphic.
+    
+    if (reallocatesStorage())
+        return false;
+    
+    if (replace.m_oldStructure.onlyStructure() != m_newStructure)
+        return false;
+    
+    m_oldStructure.merge(m_newStructure);
+    return true;
+}
+
+void PutByIdVariant::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+void PutByIdVariant::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    switch (kind()) {
+    case NotSet:
+        out.print("<empty>");
+        return;
+        
+    case Replace:
+        out.print(
+            "<Replace: ", inContext(structure(), context), ", offset = ", offset(), ", ",
+            inContext(requiredType(), context), ">");
+        return;
+        
+    case Transition:
+        out.print(
+            "<Transition: ", inContext(oldStructure(), context), " -> ",
+            pointerDumpInContext(newStructure(), context), ", [",
+            inContext(m_conditionSet, context), "], offset = ", offset(), ", ",
+            inContext(requiredType(), context), ">");
+        return;
+        
+    case Setter:
+        out.print(
+            "<Setter: ", inContext(structure(), context), ", [",
+            inContext(m_conditionSet, context), "]");
+        out.print(", offset = ", m_offset);
+        out.print(", call = ", *m_callLinkStatus);
+        out.print(">");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace JSC
+
diff --git a/bytecode/PutByIdVariant.h b/bytecode/PutByIdVariant.h
new file mode 100644
index 0000000..bda17bb
--- /dev/null
+++ b/bytecode/PutByIdVariant.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ObjectPropertyConditionSet.h"
+#include "PropertyOffset.h"
+#include "StructureSet.h"
+
+namespace JSC {
+
+class CallLinkStatus;
+
+class PutByIdVariant {
+public:
+    enum Kind {
+        NotSet,
+        Replace,
+        Transition,
+        Setter
+    };
+    
+    PutByIdVariant()
+        : m_kind(NotSet)
+        , m_newStructure(nullptr)
+        , m_offset(invalidOffset)
+    {
+    }
+    
+    PutByIdVariant(const PutByIdVariant&);
+    PutByIdVariant& operator=(const PutByIdVariant&);
+
+    static PutByIdVariant replace(const StructureSet&, PropertyOffset, const InferredType::Descriptor&);
+    
+    static PutByIdVariant transition(
+        const StructureSet& oldStructure, Structure* newStructure,
+        const ObjectPropertyConditionSet&, PropertyOffset, const InferredType::Descriptor&);
+    
+    static PutByIdVariant setter(
+        const StructureSet&, PropertyOffset, const ObjectPropertyConditionSet&,
+        std::unique_ptr<CallLinkStatus>);
+    
+    Kind kind() const { return m_kind; }
+    
+    bool isSet() const { return kind() != NotSet; }
+    bool operator!() const { return !isSet(); }
+    
+    const StructureSet& structure() const
+    {
+        ASSERT(kind() == Replace || kind() == Setter);
+        return m_oldStructure;
+    }
+    
+    const StructureSet& structureSet() const
+    {
+        return structure();
+    }
+    
+    const StructureSet& oldStructure() const
+    {
+        ASSERT(kind() == Transition || kind() == Replace || kind() == Setter);
+        return m_oldStructure;
+    }
+    
+    StructureSet& oldStructure()
+    {
+        ASSERT(kind() == Transition || kind() == Replace || kind() == Setter);
+        return m_oldStructure;
+    }
+    
+    Structure* oldStructureForTransition() const;
+    
+    Structure* newStructure() const
+    {
+        ASSERT(kind() == Transition);
+        return m_newStructure;
+    }
+
+    InferredType::Descriptor requiredType() const
+    {
+        return m_requiredType;
+    }
+
+    bool writesStructures() const;
+    bool reallocatesStorage() const;
+    bool makesCalls() const;
+    
+    const ObjectPropertyConditionSet& conditionSet() const { return m_conditionSet; }
+    
+    // We don't support intrinsics for Setters (it would be sweet if we did) but we need this for templated helpers.
+    Intrinsic intrinsic() const { return NoIntrinsic; }
+
+    // This is needed for templated helpers.
+    bool isPropertyUnset() const { return false; }
+
+    PropertyOffset offset() const
+    {
+        ASSERT(isSet());
+        return m_offset;
+    }
+    
+    CallLinkStatus* callLinkStatus() const
+    {
+        ASSERT(kind() == Setter);
+        return m_callLinkStatus.get();
+    }
+
+    bool attemptToMerge(const PutByIdVariant& other);
+    
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+
+private:
+    bool attemptToMergeTransitionWithReplace(const PutByIdVariant& replace);
+    
+    Kind m_kind;
+    StructureSet m_oldStructure;
+    Structure* m_newStructure;
+    ObjectPropertyConditionSet m_conditionSet;
+    PropertyOffset m_offset;
+    InferredType::Descriptor m_requiredType;
+    std::unique_ptr<CallLinkStatus> m_callLinkStatus;
+};
+
+} // namespace JSC
diff --git a/bytecode/PutKind.h b/bytecode/PutKind.h
new file mode 100644
index 0000000..611279f
--- /dev/null
+++ b/bytecode/PutKind.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum PutKind { Direct, NotDirect };
+
+} // namespace JSC
diff --git a/bytecode/ReduceWhitespace.cpp b/bytecode/ReduceWhitespace.cpp
new file mode 100644
index 0000000..d1f25b0
--- /dev/null
+++ b/bytecode/ReduceWhitespace.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ReduceWhitespace.h"
+
+#include <wtf/ASCIICType.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+CString reduceWhitespace(const CString& input)
+{
+    StringPrintStream out;
+    
+    const char* data = input.data();
+    
+    for (unsigned i = 0; i < input.length();) {
+        if (isASCIISpace(data[i])) {
+            while (i < input.length() && isASCIISpace(data[i]))
+                ++i;
+            out.print(CharacterDump(' '));
+            continue;
+        }
+        out.print(CharacterDump(data[i]));
+        ++i;
+    }
+    
+    return out.toCString();
+}
+
+} // namespace JSC
diff --git a/bytecode/ReduceWhitespace.h b/bytecode/ReduceWhitespace.h
new file mode 100644
index 0000000..fcb86c0
--- /dev/null
+++ b/bytecode/ReduceWhitespace.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+// Replace all whitespace runs with a single space.
+CString reduceWhitespace(const CString&);
+
+} // namespace JSC
diff --git a/bytecode/SpecialPointer.cpp b/bytecode/SpecialPointer.cpp
new file mode 100644
index 0000000..dc5a363
--- /dev/null
+++ b/bytecode/SpecialPointer.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SpecialPointer.h"
+
+#include "CodeBlock.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+void* actualPointerFor(JSGlobalObject* globalObject, Special::Pointer pointer)
+{
+    return globalObject->actualPointerFor(pointer);
+}
+
+void* actualPointerFor(CodeBlock* codeBlock, Special::Pointer pointer)
+{
+    return actualPointerFor(codeBlock->globalObject(), pointer);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/SpecialPointer.h b/bytecode/SpecialPointer.h
new file mode 100644
index 0000000..21329ec
--- /dev/null
+++ b/bytecode/SpecialPointer.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+class CodeBlock;
+class JSGlobalObject;
+
+namespace Special {
+enum Pointer {
+    CallFunction,
+    ApplyFunction,
+    ObjectConstructor,
+    ArrayConstructor,
+    TableSize // Not a real special pointer. Use this to determine the number of pointers.
+};
+} // namespace Special
+
+enum class LinkTimeConstant {
+    ThrowTypeErrorFunction,
+};
+const unsigned LinkTimeConstantCount = 1;
+
+inline bool pointerIsFunction(Special::Pointer pointer)
+{
+    ASSERT_UNUSED(pointer, pointer < Special::TableSize);
+    return true;
+}
+
+inline bool pointerIsCell(Special::Pointer pointer)
+{
+    ASSERT_UNUSED(pointer, pointer < Special::TableSize);
+    return true;
+}
+
+void* actualPointerFor(JSGlobalObject*, Special::Pointer);
+void* actualPointerFor(CodeBlock*, Special::Pointer);
+
+} // namespace JSC
diff --git a/bytecode/SpeculatedType.cpp b/bytecode/SpeculatedType.cpp
new file mode 100644
index 0000000..2425292
--- /dev/null
+++ b/bytecode/SpeculatedType.cpp
@@ -0,0 +1,643 @@
+/*
+ * Copyright (C) 2011-2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SpeculatedType.h"
+
+#include "DirectArguments.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSMap.h"
+#include "JSSet.h"
+#include "ProxyObject.h"
+#include "RegExpObject.h"
+#include "ScopedArguments.h"
+#include "StringObject.h"
+#include "ValueProfile.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+void dumpSpeculation(PrintStream& out, SpeculatedType value)
+{
+    if (value == SpecNone) {
+        out.print("None");
+        return;
+    }
+    
+    StringPrintStream myOut;
+    
+    bool isTop = true;
+    
+    if ((value & SpecCell) == SpecCell)
+        myOut.print("Cell");
+    else {
+        if ((value & SpecObject) == SpecObject)
+            myOut.print("Object");
+        else {
+            if (value & SpecCellOther)
+                myOut.print("Othercell");
+            else
+                isTop = false;
+    
+            if (value & SpecObjectOther)
+                myOut.print("Otherobj");
+            else
+                isTop = false;
+    
+            if (value & SpecFinalObject)
+                myOut.print("Final");
+            else
+                isTop = false;
+
+            if (value & SpecArray)
+                myOut.print("Array");
+            else
+                isTop = false;
+    
+            if (value & SpecInt8Array)
+                myOut.print("Int8array");
+            else
+                isTop = false;
+    
+            if (value & SpecInt16Array)
+                myOut.print("Int16array");
+            else
+                isTop = false;
+    
+            if (value & SpecInt32Array)
+                myOut.print("Int32array");
+            else
+                isTop = false;
+    
+            if (value & SpecUint8Array)
+                myOut.print("Uint8array");
+            else
+                isTop = false;
+
+            if (value & SpecUint8ClampedArray)
+                myOut.print("Uint8clampedarray");
+            else
+                isTop = false;
+    
+            if (value & SpecUint16Array)
+                myOut.print("Uint16array");
+            else
+                isTop = false;
+    
+            if (value & SpecUint32Array)
+                myOut.print("Uint32array");
+            else
+                isTop = false;
+    
+            if (value & SpecFloat32Array)
+                myOut.print("Float32array");
+            else
+                isTop = false;
+    
+            if (value & SpecFloat64Array)
+                myOut.print("Float64array");
+            else
+                isTop = false;
+    
+            if (value & SpecFunction)
+                myOut.print("Function");
+            else
+                isTop = false;
+    
+            if (value & SpecDirectArguments)
+                myOut.print("Directarguments");
+            else
+                isTop = false;
+    
+            if (value & SpecScopedArguments)
+                myOut.print("Scopedarguments");
+            else
+                isTop = false;
+    
+            if (value & SpecStringObject)
+                myOut.print("Stringobject");
+            else
+                isTop = false;
+    
+            if (value & SpecRegExpObject)
+                myOut.print("Regexpobject");
+            else
+                isTop = false;
+
+            if (value & SpecMapObject)
+                myOut.print("Mapobject");
+            else
+                isTop = false;
+
+            if (value & SpecSetObject)
+                myOut.print("Setobject");
+            else
+                isTop = false;
+
+            if (value & SpecProxyObject)
+                myOut.print("Proxyobject");
+            else
+                isTop = false;
+
+            if (value & SpecDerivedArray)
+                myOut.print("Derivedarray");
+            else
+                isTop = false;
+        }
+
+        if ((value & SpecString) == SpecString)
+            myOut.print("String");
+        else {
+            if (value & SpecStringIdent)
+                myOut.print("Stringident");
+            else
+                isTop = false;
+            
+            if (value & SpecStringVar)
+                myOut.print("Stringvar");
+            else
+                isTop = false;
+        }
+
+        if (value & SpecSymbol)
+            myOut.print("Symbol");
+        else
+            isTop = false;
+    }
+    
+    if (value == SpecInt32Only)
+        myOut.print("Int32");
+    else {
+        if (value & SpecBoolInt32)
+            myOut.print("Boolint32");
+        else
+            isTop = false;
+        
+        if (value & SpecNonBoolInt32)
+            myOut.print("Nonboolint32");
+        else
+            isTop = false;
+    }
+    
+    if (value & SpecInt52Only)
+        myOut.print("Int52");
+        
+    if ((value & SpecBytecodeDouble) == SpecBytecodeDouble)
+        myOut.print("Bytecodedouble");
+    else {
+        if (value & SpecAnyIntAsDouble)
+            myOut.print("AnyIntAsDouble");
+        else
+            isTop = false;
+        
+        if (value & SpecNonIntAsDouble)
+            myOut.print("Nonintasdouble");
+        else
+            isTop = false;
+        
+        if (value & SpecDoublePureNaN)
+            myOut.print("Doublepurenan");
+        else
+            isTop = false;
+    }
+    
+    if (value & SpecDoubleImpureNaN)
+        out.print("Doubleimpurenan");
+    
+    if (value & SpecBoolean)
+        myOut.print("Bool");
+    else
+        isTop = false;
+    
+    if (value & SpecOther)
+        myOut.print("Other");
+    else
+        isTop = false;
+    
+    if (isTop)
+        out.print("Top");
+    else
+        out.print(myOut.toCString());
+    
+    if (value & SpecEmpty)
+        out.print("Empty");
+}
+
+// We don't expose this because we don't want anyone relying on the fact that this method currently
+// just returns string constants.
+static const char* speculationToAbbreviatedString(SpeculatedType prediction)
+{
+    if (isFinalObjectSpeculation(prediction))
+        return "<Final>";
+    if (isArraySpeculation(prediction))
+        return "<Array>";
+    if (isStringIdentSpeculation(prediction))
+        return "<StringIdent>";
+    if (isStringSpeculation(prediction))
+        return "<String>";
+    if (isFunctionSpeculation(prediction))
+        return "<Function>";
+    if (isInt8ArraySpeculation(prediction))
+        return "<Int8array>";
+    if (isInt16ArraySpeculation(prediction))
+        return "<Int16array>";
+    if (isInt32ArraySpeculation(prediction))
+        return "<Int32array>";
+    if (isUint8ArraySpeculation(prediction))
+        return "<Uint8array>";
+    if (isUint16ArraySpeculation(prediction))
+        return "<Uint16array>";
+    if (isUint32ArraySpeculation(prediction))
+        return "<Uint32array>";
+    if (isFloat32ArraySpeculation(prediction))
+        return "<Float32array>";
+    if (isFloat64ArraySpeculation(prediction))
+        return "<Float64array>";
+    if (isDirectArgumentsSpeculation(prediction))
+        return "<DirectArguments>";
+    if (isScopedArgumentsSpeculation(prediction))
+        return "<ScopedArguments>";
+    if (isStringObjectSpeculation(prediction))
+        return "<StringObject>";
+    if (isRegExpObjectSpeculation(prediction))
+        return "<RegExpObject>";
+    if (isStringOrStringObjectSpeculation(prediction))
+        return "<StringOrStringObject>";
+    if (isObjectSpeculation(prediction))
+        return "<Object>";
+    if (isCellSpeculation(prediction))
+        return "<Cell>";
+    if (isBoolInt32Speculation(prediction))
+        return "<BoolInt32>";
+    if (isInt32Speculation(prediction))
+        return "<Int32>";
+    if (isAnyIntAsDoubleSpeculation(prediction))
+        return "<AnyIntAsDouble>";
+    if (isInt52Speculation(prediction))
+        return "<Int52>";
+    if (isAnyIntSpeculation(prediction))
+        return "<AnyInt>";
+    if (isDoubleSpeculation(prediction))
+        return "<Double>";
+    if (isFullNumberSpeculation(prediction))
+        return "<Number>";
+    if (isBooleanSpeculation(prediction))
+        return "<Boolean>";
+    if (isOtherSpeculation(prediction))
+        return "<Other>";
+    if (isMiscSpeculation(prediction))
+        return "<Misc>";
+    return "";
+}
+
+void dumpSpeculationAbbreviated(PrintStream& out, SpeculatedType value)
+{
+    out.print(speculationToAbbreviatedString(value));
+}
+
+SpeculatedType speculationFromTypedArrayType(TypedArrayType type)
+{
+    switch (type) {
+    case TypeInt8:
+        return SpecInt8Array;
+    case TypeInt16:
+        return SpecInt16Array;
+    case TypeInt32:
+        return SpecInt32Array;
+    case TypeUint8:
+        return SpecUint8Array;
+    case TypeUint8Clamped:
+        return SpecUint8ClampedArray;
+    case TypeUint16:
+        return SpecUint16Array;
+    case TypeUint32:
+        return SpecUint32Array;
+    case TypeFloat32:
+        return SpecFloat32Array;
+    case TypeFloat64:
+        return SpecFloat64Array;
+    case NotTypedArray:
+    case TypeDataView:
+        break;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return SpecNone;
+}
+
+SpeculatedType speculationFromClassInfo(const ClassInfo* classInfo)
+{
+    if (classInfo == JSString::info())
+        return SpecString;
+
+    if (classInfo == Symbol::info())
+        return SpecSymbol;
+
+    if (classInfo == JSFinalObject::info())
+        return SpecFinalObject;
+    
+    if (classInfo == JSArray::info())
+        return SpecArray;
+    
+    if (classInfo == DirectArguments::info())
+        return SpecDirectArguments;
+    
+    if (classInfo == ScopedArguments::info())
+        return SpecScopedArguments;
+    
+    if (classInfo == StringObject::info())
+        return SpecStringObject;
+
+    if (classInfo == RegExpObject::info())
+        return SpecRegExpObject;
+
+    if (classInfo == JSMap::info())
+        return SpecMapObject;
+
+    if (classInfo == JSSet::info())
+        return SpecSetObject;
+
+    if (classInfo == ProxyObject::info())
+        return SpecProxyObject;
+    
+    if (classInfo->isSubClassOf(JSFunction::info()))
+        return SpecFunction;
+    
+    if (isTypedView(classInfo->typedArrayStorageType))
+        return speculationFromTypedArrayType(classInfo->typedArrayStorageType);
+
+    if (classInfo->isSubClassOf(JSArray::info()))
+        return SpecDerivedArray;
+    
+    if (classInfo->isSubClassOf(JSObject::info()))
+        return SpecObjectOther;
+    
+    return SpecCellOther;
+}
+
+SpeculatedType speculationFromStructure(Structure* structure)
+{
+    if (structure->typeInfo().type() == StringType)
+        return SpecString;
+    if (structure->typeInfo().type() == SymbolType)
+        return SpecSymbol;
+    if (structure->typeInfo().type() == DerivedArrayType)
+        return SpecDerivedArray;
+    return speculationFromClassInfo(structure->classInfo());
+}
+
+SpeculatedType speculationFromCell(JSCell* cell)
+{
+    if (JSString* string = jsDynamicCast<JSString*>(cell)) {
+        if (const StringImpl* impl = string->tryGetValueImpl()) {
+            if (impl->isAtomic())
+                return SpecStringIdent;
+        }
+        return SpecStringVar;
+    }
+    return speculationFromStructure(cell->structure());
+}
+
+SpeculatedType speculationFromValue(JSValue value)
+{
+    if (value.isEmpty())
+        return SpecEmpty;
+    if (value.isInt32()) {
+        if (value.asInt32() & ~1)
+            return SpecNonBoolInt32;
+        return SpecBoolInt32;
+    }
+    if (value.isDouble()) {
+        double number = value.asNumber();
+        if (number != number)
+            return SpecDoublePureNaN;
+        if (value.isAnyInt())
+            return SpecAnyIntAsDouble;
+        return SpecNonIntAsDouble;
+    }
+    if (value.isCell())
+        return speculationFromCell(value.asCell());
+    if (value.isBoolean())
+        return SpecBoolean;
+    ASSERT(value.isUndefinedOrNull());
+    return SpecOther;
+}
+
+TypedArrayType typedArrayTypeFromSpeculation(SpeculatedType type)
+{
+    if (isInt8ArraySpeculation(type))
+        return TypeInt8;
+        
+    if (isInt16ArraySpeculation(type))
+        return TypeInt16;
+        
+    if (isInt32ArraySpeculation(type))
+        return TypeInt32;
+        
+    if (isUint8ArraySpeculation(type))
+        return TypeUint8;
+        
+    if (isUint8ClampedArraySpeculation(type))
+        return TypeUint8Clamped;
+        
+    if (isUint16ArraySpeculation(type))
+        return TypeUint16;
+        
+    if (isUint32ArraySpeculation(type))
+        return TypeUint32;
+        
+    if (isFloat32ArraySpeculation(type))
+        return TypeFloat32;
+        
+    if (isFloat64ArraySpeculation(type))
+        return TypeFloat64;
+    
+    return NotTypedArray;
+}
+
+SpeculatedType speculationFromJSType(JSType type)
+{
+    switch (type) {
+    case StringType:
+        return SpecString;
+    case SymbolType:
+        return SpecSymbol;
+    case ArrayType:
+        return SpecArray;
+    case DerivedArrayType:
+        return SpecDerivedArray;
+    case RegExpObjectType:
+        return SpecRegExpObject;
+    case ProxyObjectType:
+        return SpecProxyObject;
+    case JSMapType:
+        return SpecMapObject;
+    case JSSetType:
+        return SpecSetObject;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    return SpecNone;
+}
+
+SpeculatedType leastUpperBoundOfStrictlyEquivalentSpeculations(SpeculatedType type)
+{
+    if (type & (SpecAnyInt | SpecAnyIntAsDouble))
+        type |= (SpecAnyInt | SpecAnyIntAsDouble);
+    if (type & SpecString)
+        type |= SpecString;
+    return type;
+}
+
+bool valuesCouldBeEqual(SpeculatedType a, SpeculatedType b)
+{
+    a = leastUpperBoundOfStrictlyEquivalentSpeculations(a);
+    b = leastUpperBoundOfStrictlyEquivalentSpeculations(b);
+    
+    // Anything could be equal to a string.
+    if (a & SpecString)
+        return true;
+    if (b & SpecString)
+        return true;
+    
+    // If both sides are definitely only objects, then equality is fairly sane.
+    if (isObjectSpeculation(a) && isObjectSpeculation(b))
+        return !!(a & b);
+    
+    // If either side could be an object or not, then we could call toString or
+    // valueOf, which could return anything.
+    if (a & SpecObject)
+        return true;
+    if (b & SpecObject)
+        return true;
+    
+    // Neither side is an object or string, so the world is relatively sane.
+    return !!(a & b);
+}
+
+SpeculatedType typeOfDoubleSum(SpeculatedType a, SpeculatedType b)
+{
+    SpeculatedType result = a | b;
+    // Impure NaN could become pure NaN during addition because addition may clear bits.
+    if (result & SpecDoubleImpureNaN)
+        result |= SpecDoublePureNaN;
+    // Values could overflow, or fractions could become integers.
+    if (result & SpecDoubleReal)
+        result |= SpecDoubleReal;
+    return result;
+}
+
+SpeculatedType typeOfDoubleDifference(SpeculatedType a, SpeculatedType b)
+{
+    return typeOfDoubleSum(a, b);
+}
+
+SpeculatedType typeOfDoubleProduct(SpeculatedType a, SpeculatedType b)
+{
+    return typeOfDoubleSum(a, b);
+}
+
+static SpeculatedType polluteDouble(SpeculatedType value)
+{
+    // Impure NaN could become pure NaN because the operation could clear some bits.
+    if (value & SpecDoubleImpureNaN)
+        value |= SpecDoubleNaN;
+    // Values could overflow, fractions could become integers, or an error could produce
+    // PureNaN.
+    if (value & SpecDoubleReal)
+        value |= SpecDoubleReal | SpecDoublePureNaN;
+    return value;
+}
+
+SpeculatedType typeOfDoubleQuotient(SpeculatedType a, SpeculatedType b)
+{
+    return polluteDouble(a | b);
+}
+
+SpeculatedType typeOfDoubleMinMax(SpeculatedType a, SpeculatedType b)
+{
+    SpeculatedType result = a | b;
+    // Impure NaN could become pure NaN during addition because addition may clear bits.
+    if (result & SpecDoubleImpureNaN)
+        result |= SpecDoublePureNaN;
+    return result;
+}
+
+SpeculatedType typeOfDoubleNegation(SpeculatedType value)
+{
+    // Changing bits can make pure NaN impure and vice versa:
+    // 0xefff000000000000 (pure) - 0xffff000000000000 (impure)
+    if (value & SpecDoubleNaN)
+        value |= SpecDoubleNaN;
+    // We could get negative zero, which mixes SpecAnyIntAsDouble and SpecNotIntAsDouble.
+    // We could also overflow a large negative int into something that is no longer
+    // representable as an int.
+    if (value & SpecDoubleReal)
+        value |= SpecDoubleReal;
+    return value;
+}
+
+SpeculatedType typeOfDoubleAbs(SpeculatedType value)
+{
+    return typeOfDoubleNegation(value);
+}
+
+SpeculatedType typeOfDoubleRounding(SpeculatedType value)
+{
+    // Double Pure NaN can becomes impure when converted back from Float.
+    // and vice versa.
+    if (value & SpecDoubleNaN)
+        value |= SpecDoubleNaN;
+    // We might lose bits, which leads to a value becoming integer-representable.
+    if (value & SpecNonIntAsDouble)
+        value |= SpecAnyIntAsDouble;
+    return value;
+}
+
+SpeculatedType typeOfDoublePow(SpeculatedType xValue, SpeculatedType yValue)
+{
+    // Math.pow() always return NaN if the exponent is NaN, unlike std::pow().
+    // We always set a pure NaN in that case.
+    if (yValue & SpecDoubleNaN)
+        xValue |= SpecDoublePureNaN;
+    return polluteDouble(xValue);
+}
+
+SpeculatedType typeOfDoubleBinaryOp(SpeculatedType a, SpeculatedType b)
+{
+    return polluteDouble(a | b);
+}
+
+SpeculatedType typeOfDoubleUnaryOp(SpeculatedType value)
+{
+    return polluteDouble(value);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/SpeculatedType.h b/bytecode/SpeculatedType.h
new file mode 100644
index 0000000..e23fd2c
--- /dev/null
+++ b/bytecode/SpeculatedType.h
@@ -0,0 +1,495 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "TypedArrayType.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class Structure;
+
+typedef uint64_t SpeculatedType;
+static const SpeculatedType SpecNone               = 0; // We don't know anything yet.
+static const SpeculatedType SpecFinalObject        = 1ull << 0; // It's definitely a JSFinalObject.
+static const SpeculatedType SpecArray              = 1ull << 1; // It's definitely a JSArray.
+static const SpeculatedType SpecFunction           = 1ull << 2; // It's definitely a JSFunction.
+static const SpeculatedType SpecInt8Array          = 1ull << 3; // It's definitely an Int8Array or one of its subclasses.
+static const SpeculatedType SpecInt16Array         = 1ull << 4; // It's definitely an Int16Array or one of its subclasses.
+static const SpeculatedType SpecInt32Array         = 1ull << 5; // It's definitely an Int32Array or one of its subclasses.
+static const SpeculatedType SpecUint8Array         = 1ull << 6; // It's definitely an Uint8Array or one of its subclasses.
+static const SpeculatedType SpecUint8ClampedArray  = 1ull << 7; // It's definitely an Uint8ClampedArray or one of its subclasses.
+static const SpeculatedType SpecUint16Array        = 1ull << 8; // It's definitely an Uint16Array or one of its subclasses.
+static const SpeculatedType SpecUint32Array        = 1ull << 9; // It's definitely an Uint32Array or one of its subclasses.
+static const SpeculatedType SpecFloat32Array       = 1ull << 10; // It's definitely an Uint16Array or one of its subclasses.
+static const SpeculatedType SpecFloat64Array       = 1ull << 11; // It's definitely an Uint16Array or one of its subclasses.
+static const SpeculatedType SpecTypedArrayView     = SpecInt8Array | SpecInt16Array | SpecInt32Array | SpecUint8Array | SpecUint8ClampedArray | SpecUint16Array | SpecUint32Array | SpecFloat32Array | SpecFloat64Array;
+static const SpeculatedType SpecDirectArguments    = 1ull << 12; // It's definitely a DirectArguments object.
+static const SpeculatedType SpecScopedArguments    = 1ull << 13; // It's definitely a ScopedArguments object.
+static const SpeculatedType SpecStringObject       = 1ull << 14; // It's definitely a StringObject.
+static const SpeculatedType SpecRegExpObject       = 1ull << 15; // It's definitely a RegExpObject (and not any subclass of RegExpObject).
+static const SpeculatedType SpecMapObject          = 1ull << 16; // It's definitely a Map object or one of its subclasses.
+static const SpeculatedType SpecSetObject          = 1ull << 17; // It's definitely a Set object or one of its subclasses.
+static const SpeculatedType SpecProxyObject        = 1ull << 18; // It's definitely a Proxy object or one of its subclasses.
+static const SpeculatedType SpecDerivedArray       = 1ull << 19; // It's definitely a DerivedArray object.
+static const SpeculatedType SpecObjectOther        = 1ull << 20; // It's definitely an object but not JSFinalObject, JSArray, or JSFunction.
+static const SpeculatedType SpecObject             = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecMapObject | SpecSetObject | SpecProxyObject | SpecDerivedArray | SpecObjectOther; // Bitmask used for testing for any kind of object prediction.
+static const SpeculatedType SpecStringIdent        = 1ull << 21; // It's definitely a JSString, and it's an identifier.
+static const SpeculatedType SpecStringVar          = 1ull << 22; // It's definitely a JSString, and it's not an identifier.
+static const SpeculatedType SpecString             = SpecStringIdent | SpecStringVar; // It's definitely a JSString.
+static const SpeculatedType SpecSymbol             = 1ull << 23; // It's definitely a Symbol.
+static const SpeculatedType SpecCellOther          = 1ull << 24; // It's definitely a JSCell but not a subclass of JSObject and definitely not a JSString or a Symbol. FIXME: This shouldn't be part of heap-top or bytecode-top. https://bugs.webkit.org/show_bug.cgi?id=133078
+static const SpeculatedType SpecCell               = SpecObject | SpecString | SpecSymbol | SpecCellOther; // It's definitely a JSCell.
+static const SpeculatedType SpecBoolInt32          = 1ull << 25; // It's definitely an Int32 with value 0 or 1.
+static const SpeculatedType SpecNonBoolInt32       = 1ull << 26; // It's definitely an Int32 with value other than 0 or 1.
+static const SpeculatedType SpecInt32Only          = SpecBoolInt32 | SpecNonBoolInt32; // It's definitely an Int32.
+static const SpeculatedType SpecInt52Only          = 1ull << 27; // It's definitely an Int52 and we intend it to unbox it. It's also definitely not an Int32.
+static const SpeculatedType SpecAnyInt             = SpecInt32Only | SpecInt52Only; // It's something that we can do machine int arithmetic on.
+static const SpeculatedType SpecAnyIntAsDouble     = 1ull << 28; // It's definitely an Int52 and it's inside a double.
+static const SpeculatedType SpecNonIntAsDouble     = 1ull << 29; // It's definitely not an Int52 but it's a real number and it's a double.
+static const SpeculatedType SpecDoubleReal         = SpecNonIntAsDouble | SpecAnyIntAsDouble; // It's definitely a non-NaN double.
+static const SpeculatedType SpecDoublePureNaN      = 1ull << 30; // It's definitely a NaN that is sae to tag (i.e. pure).
+static const SpeculatedType SpecDoubleImpureNaN    = 1ull << 31; // It's definitely a NaN that is unsafe to tag (i.e. impure).
+static const SpeculatedType SpecDoubleNaN          = SpecDoublePureNaN | SpecDoubleImpureNaN; // It's definitely some kind of NaN.
+static const SpeculatedType SpecBytecodeDouble     = SpecDoubleReal | SpecDoublePureNaN; // It's either a non-NaN or a NaN double, but it's definitely not impure NaN.
+static const SpeculatedType SpecFullDouble         = SpecDoubleReal | SpecDoubleNaN; // It's either a non-NaN or a NaN double.
+static const SpeculatedType SpecBytecodeRealNumber = SpecInt32Only | SpecDoubleReal; // It's either an Int32 or a DoubleReal.
+static const SpeculatedType SpecFullRealNumber     = SpecAnyInt | SpecDoubleReal; // It's either an Int32 or a DoubleReal, or a Int52.
+static const SpeculatedType SpecBytecodeNumber     = SpecInt32Only | SpecBytecodeDouble; // It's either an Int32 or a Double, and the Double cannot be an impure NaN.
+static const SpeculatedType SpecFullNumber         = SpecAnyInt | SpecFullDouble; // It's either an Int32, Int52, or a Double, and the Double can be impure NaN.
+static const SpeculatedType SpecBoolean            = 1ull << 32; // It's definitely a Boolean.
+static const SpeculatedType SpecOther              = 1ull << 33; // It's definitely either Null or Undefined.
+static const SpeculatedType SpecMisc               = SpecBoolean | SpecOther; // It's definitely either a boolean, Null, or Undefined.
+static const SpeculatedType SpecHeapTop            = SpecCell | SpecBytecodeNumber | SpecMisc; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN.
+static const SpeculatedType SpecPrimitive          = SpecString | SpecSymbol | SpecBytecodeNumber | SpecMisc; // It's any non-Object JSValue.
+static const SpeculatedType SpecEmpty              = 1ull << 34; // It's definitely an empty value marker.
+static const SpeculatedType SpecBytecodeTop        = SpecHeapTop | SpecEmpty; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN. Corresponds to what could be found in a bytecode local.
+static const SpeculatedType SpecFullTop            = SpecBytecodeTop | SpecFullNumber; // It can be anything that bytecode could see plus exotic encodings of numbers.
+
+typedef bool (*SpeculatedTypeChecker)(SpeculatedType);
+
+// Dummy prediction checker, only useful if someone insists on requiring a prediction checker.
+inline bool isAnySpeculation(SpeculatedType)
+{
+    return true;
+}
+
+inline bool isCellSpeculation(SpeculatedType value)
+{
+    return !!(value & SpecCell) && !(value & ~SpecCell);
+}
+
+inline bool isCellOrOtherSpeculation(SpeculatedType value)
+{
+    return !!value && !(value & ~(SpecCell | SpecOther));
+}
+
+inline bool isNotCellSpeculation(SpeculatedType value)
+{
+    return !(value & SpecCell) && value;
+}
+
+inline bool isObjectSpeculation(SpeculatedType value)
+{
+    return !!(value & SpecObject) && !(value & ~SpecObject);
+}
+
+inline bool isObjectOrOtherSpeculation(SpeculatedType value)
+{
+    return !!(value & (SpecObject | SpecOther)) && !(value & ~(SpecObject | SpecOther));
+}
+
+inline bool isFinalObjectSpeculation(SpeculatedType value)
+{
+    return value == SpecFinalObject;
+}
+
+inline bool isFinalObjectOrOtherSpeculation(SpeculatedType value)
+{
+    return !!(value & (SpecFinalObject | SpecOther)) && !(value & ~(SpecFinalObject | SpecOther));
+}
+
+inline bool isStringIdentSpeculation(SpeculatedType value)
+{
+    return value == SpecStringIdent;
+}
+
+inline bool isNotStringVarSpeculation(SpeculatedType value)
+{
+    return !(value & SpecStringVar);
+}
+
+inline bool isStringSpeculation(SpeculatedType value)
+{
+    return !!value && (value & SpecString) == value;
+}
+
+inline bool isNotStringSpeculation(SpeculatedType value)
+{
+    return value && !(value & SpecString);
+}
+
+inline bool isStringOrOtherSpeculation(SpeculatedType value)
+{
+    return !!value && (value & (SpecString | SpecOther)) == value;
+}
+
+inline bool isSymbolSpeculation(SpeculatedType value)
+{
+    return value == SpecSymbol;
+}
+
+inline bool isArraySpeculation(SpeculatedType value)
+{
+    return value == SpecArray;
+}
+
+inline bool isFunctionSpeculation(SpeculatedType value)
+{
+    return value == SpecFunction;
+}
+
+inline bool isProxyObjectSpeculation(SpeculatedType value)
+{
+    return value == SpecProxyObject;
+}
+
+inline bool isDerivedArraySpeculation(SpeculatedType value)
+{
+    return value == SpecDerivedArray;
+}
+
+inline bool isInt8ArraySpeculation(SpeculatedType value)
+{
+    return value == SpecInt8Array;
+}
+
+inline bool isInt16ArraySpeculation(SpeculatedType value)
+{
+    return value == SpecInt16Array;
+}
+
+inline bool isInt32ArraySpeculation(SpeculatedType value)
+{
+    return value == SpecInt32Array;
+}
+
+inline bool isUint8ArraySpeculation(SpeculatedType value)
+{
+    return value == SpecUint8Array;
+}
+
+inline bool isUint8ClampedArraySpeculation(SpeculatedType value)
+{
+    return value == SpecUint8ClampedArray;
+}
+
+inline bool isUint16ArraySpeculation(SpeculatedType value)
+{
+    return value == SpecUint16Array;
+}
+
+inline bool isUint32ArraySpeculation(SpeculatedType value)
+{
+    return value == SpecUint32Array;
+}
+
+inline bool isFloat32ArraySpeculation(SpeculatedType value)
+{
+    return value == SpecFloat32Array;
+}
+
+inline bool isFloat64ArraySpeculation(SpeculatedType value)
+{
+    return value == SpecFloat64Array;
+}
+
+inline bool isDirectArgumentsSpeculation(SpeculatedType value)
+{
+    return value == SpecDirectArguments;
+}
+
+inline bool isScopedArgumentsSpeculation(SpeculatedType value)
+{
+    return value == SpecScopedArguments;
+}
+
+inline bool isActionableIntMutableArraySpeculation(SpeculatedType value)
+{
+    return isInt8ArraySpeculation(value)
+        || isInt16ArraySpeculation(value)
+        || isInt32ArraySpeculation(value)
+        || isUint8ArraySpeculation(value)
+        || isUint8ClampedArraySpeculation(value)
+        || isUint16ArraySpeculation(value)
+        || isUint32ArraySpeculation(value);
+}
+
+inline bool isActionableFloatMutableArraySpeculation(SpeculatedType value)
+{
+    return isFloat32ArraySpeculation(value)
+        || isFloat64ArraySpeculation(value);
+}
+
+inline bool isActionableTypedMutableArraySpeculation(SpeculatedType value)
+{
+    return isActionableIntMutableArraySpeculation(value)
+        || isActionableFloatMutableArraySpeculation(value);
+}
+
+inline bool isActionableMutableArraySpeculation(SpeculatedType value)
+{
+    return isArraySpeculation(value)
+        || isActionableTypedMutableArraySpeculation(value);
+}
+
+inline bool isActionableArraySpeculation(SpeculatedType value)
+{
+    return isStringSpeculation(value)
+        || isDirectArgumentsSpeculation(value)
+        || isScopedArgumentsSpeculation(value)
+        || isActionableMutableArraySpeculation(value);
+}
+
+inline bool isArrayOrOtherSpeculation(SpeculatedType value)
+{
+    return !!(value & (SpecArray | SpecOther)) && !(value & ~(SpecArray | SpecOther));
+}
+
+inline bool isStringObjectSpeculation(SpeculatedType value)
+{
+    return value == SpecStringObject;
+}
+
+inline bool isStringOrStringObjectSpeculation(SpeculatedType value)
+{
+    return !!value && !(value & ~(SpecString | SpecStringObject));
+}
+
+inline bool isRegExpObjectSpeculation(SpeculatedType value)
+{
+    return value == SpecRegExpObject;
+}
+
+inline bool isBoolInt32Speculation(SpeculatedType value)
+{
+    return value == SpecBoolInt32;
+}
+
+inline bool isInt32Speculation(SpeculatedType value)
+{
+    return value && !(value & ~SpecInt32Only);
+}
+
+inline bool isNotInt32Speculation(SpeculatedType value)
+{
+    return value && !(value & SpecInt32Only);
+}
+
+inline bool isInt32OrBooleanSpeculation(SpeculatedType value)
+{
+    return value && !(value & ~(SpecBoolean | SpecInt32Only));
+}
+
+inline bool isInt32SpeculationForArithmetic(SpeculatedType value)
+{
+    return !(value & (SpecFullDouble | SpecInt52Only));
+}
+
+inline bool isInt32OrBooleanSpeculationForArithmetic(SpeculatedType value)
+{
+    return !(value & (SpecFullDouble | SpecInt52Only));
+}
+
+inline bool isInt32OrBooleanSpeculationExpectingDefined(SpeculatedType value)
+{
+    return isInt32OrBooleanSpeculation(value & ~SpecOther);
+}
+
+inline bool isInt52Speculation(SpeculatedType value)
+{
+    return value == SpecInt52Only;
+}
+
+inline bool isAnyIntSpeculation(SpeculatedType value)
+{
+    return !!value && (value & SpecAnyInt) == value;
+}
+
+inline bool isAnyIntAsDoubleSpeculation(SpeculatedType value)
+{
+    return value == SpecAnyIntAsDouble;
+}
+
+inline bool isDoubleRealSpeculation(SpeculatedType value)
+{
+    return !!value && (value & SpecDoubleReal) == value;
+}
+
+inline bool isDoubleSpeculation(SpeculatedType value)
+{
+    return !!value && (value & SpecFullDouble) == value;
+}
+
+inline bool isDoubleSpeculationForArithmetic(SpeculatedType value)
+{
+    return !!(value & SpecFullDouble);
+}
+
+inline bool isBytecodeRealNumberSpeculation(SpeculatedType value)
+{
+    return !!(value & SpecBytecodeRealNumber) && !(value & ~SpecBytecodeRealNumber);
+}
+
+inline bool isFullRealNumberSpeculation(SpeculatedType value)
+{
+    return !!(value & SpecFullRealNumber) && !(value & ~SpecFullRealNumber);
+}
+
+inline bool isBytecodeNumberSpeculation(SpeculatedType value)
+{
+    return !!(value & SpecBytecodeNumber) && !(value & ~SpecBytecodeNumber);
+}
+
+inline bool isFullNumberSpeculation(SpeculatedType value)
+{
+    return !!(value & SpecFullNumber) && !(value & ~SpecFullNumber);
+}
+
+inline bool isFullNumberOrBooleanSpeculation(SpeculatedType value)
+{
+    return value && !(value & ~(SpecFullNumber | SpecBoolean));
+}
+
+inline bool isFullNumberOrBooleanSpeculationExpectingDefined(SpeculatedType value)
+{
+    return isFullNumberOrBooleanSpeculation(value & ~SpecOther);
+}
+
+inline bool isBooleanSpeculation(SpeculatedType value)
+{
+    return value == SpecBoolean;
+}
+
+inline bool isNotBooleanSpeculation(SpeculatedType value)
+{
+    return value && !(value & SpecBoolean);
+}
+
+inline bool isOtherSpeculation(SpeculatedType value)
+{
+    return value == SpecOther;
+}
+
+inline bool isMiscSpeculation(SpeculatedType value)
+{
+    return !!value && !(value & ~SpecMisc);
+}
+
+inline bool isOtherOrEmptySpeculation(SpeculatedType value)
+{
+    return !value || value == SpecOther;
+}
+
+inline bool isEmptySpeculation(SpeculatedType value)
+{
+    return value == SpecEmpty;
+}
+
+inline bool isUntypedSpeculationForArithmetic(SpeculatedType value)
+{
+    return !!(value & ~(SpecFullNumber | SpecBoolean));
+}
+
+inline bool isUntypedSpeculationForBitOps(SpeculatedType value)
+{
+    return !!(value & ~(SpecFullNumber | SpecBoolean | SpecOther));
+}
+
+void dumpSpeculation(PrintStream&, SpeculatedType);
+void dumpSpeculationAbbreviated(PrintStream&, SpeculatedType);
+
+MAKE_PRINT_ADAPTOR(SpeculationDump, SpeculatedType, dumpSpeculation);
+MAKE_PRINT_ADAPTOR(AbbreviatedSpeculationDump, SpeculatedType, dumpSpeculationAbbreviated);
+
+// Merge two predictions. Note that currently this just does left | right. It may
+// seem tempting to do so directly, but you would be doing so at your own peril,
+// since the merging protocol SpeculatedType may change at any time (and has already
+// changed several times in its history).
+inline SpeculatedType mergeSpeculations(SpeculatedType left, SpeculatedType right)
+{
+    return left | right;
+}
+
+template<typename T>
+inline bool mergeSpeculation(T& left, SpeculatedType right)
+{
+    SpeculatedType newSpeculation = static_cast<T>(mergeSpeculations(static_cast<SpeculatedType>(left), right));
+    bool result = newSpeculation != static_cast<SpeculatedType>(left);
+    left = newSpeculation;
+    return result;
+}
+
+inline bool speculationChecked(SpeculatedType actual, SpeculatedType desired)
+{
+    return (actual | desired) == desired;
+}
+
+SpeculatedType speculationFromClassInfo(const ClassInfo*);
+SpeculatedType speculationFromStructure(Structure*);
+SpeculatedType speculationFromCell(JSCell*);
+SpeculatedType speculationFromValue(JSValue);
+SpeculatedType speculationFromJSType(JSType);
+
+SpeculatedType speculationFromTypedArrayType(TypedArrayType); // only valid for typed views.
+TypedArrayType typedArrayTypeFromSpeculation(SpeculatedType);
+
+SpeculatedType leastUpperBoundOfStrictlyEquivalentSpeculations(SpeculatedType);
+
+bool valuesCouldBeEqual(SpeculatedType, SpeculatedType);
+
+// Precise computation of the type of the result of a double computation after we
+// already know that the inputs are doubles and that the result must be a double. Use
+// the closest one of these that applies.
+SpeculatedType typeOfDoubleSum(SpeculatedType, SpeculatedType);
+SpeculatedType typeOfDoubleDifference(SpeculatedType, SpeculatedType);
+SpeculatedType typeOfDoubleProduct(SpeculatedType, SpeculatedType);
+SpeculatedType typeOfDoubleQuotient(SpeculatedType, SpeculatedType);
+SpeculatedType typeOfDoubleMinMax(SpeculatedType, SpeculatedType);
+SpeculatedType typeOfDoubleNegation(SpeculatedType);
+SpeculatedType typeOfDoubleAbs(SpeculatedType);
+SpeculatedType typeOfDoubleRounding(SpeculatedType);
+SpeculatedType typeOfDoublePow(SpeculatedType, SpeculatedType);
+
+// This conservatively models the behavior of arbitrary double operations.
+SpeculatedType typeOfDoubleBinaryOp(SpeculatedType, SpeculatedType);
+SpeculatedType typeOfDoubleUnaryOp(SpeculatedType);
+
+} // namespace JSC
diff --git a/bytecode/StructureSet.cpp b/bytecode/StructureSet.cpp
new file mode 100644
index 0000000..2ccb8f0
--- /dev/null
+++ b/bytecode/StructureSet.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "StructureSet.h"
+
+#include "TrackedReferences.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+void StructureSet::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    CommaPrinter comma;
+    out.print("[");
+    forEach([&] (Structure* structure) { out.print(comma, inContext(*structure, context)); });
+    out.print("]");
+}
+
+void StructureSet::dump(PrintStream& out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+} // namespace JSC
+
diff --git a/bytecode/StructureSet.h b/bytecode/StructureSet.h
new file mode 100644
index 0000000..8654ca5
--- /dev/null
+++ b/bytecode/StructureSet.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2011, 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayProfile.h"
+#include "DumpContext.h"
+#include "SpeculatedType.h"
+#include "Structure.h"
+#include <wtf/TinyPtrSet.h>
+
+namespace JSC {
+
+class TrackedReferences;
+
+class StructureSet : public TinyPtrSet<Structure*> {
+public:
+    // I really want to do this:
+    // using TinyPtrSet::TinyPtrSet;
+    //
+    // But I can't because Windows.
+    
+    StructureSet()
+    {
+    }
+    
+    StructureSet(Structure* structure)
+        : TinyPtrSet(structure)
+    {
+    }
+    
+    ALWAYS_INLINE StructureSet(const StructureSet& other)
+        : TinyPtrSet(other)
+    {
+    }
+    
+    Structure* onlyStructure() const
+    {
+        return onlyEntry();
+    }
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+};
+
+} // namespace JSC
diff --git a/bytecode/StructureStubClearingWatchpoint.cpp b/bytecode/StructureStubClearingWatchpoint.cpp
new file mode 100644
index 0000000..f27e507
--- /dev/null
+++ b/bytecode/StructureStubClearingWatchpoint.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2012, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "StructureStubClearingWatchpoint.h"
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+#include "StructureStubInfo.h"
+
+namespace JSC {
+
+StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint()
+{
+    for (auto current = WTFMove(m_next); current; current = WTFMove(current->m_next)) { }
+}
+
+StructureStubClearingWatchpoint* StructureStubClearingWatchpoint::push(
+    const ObjectPropertyCondition& key,
+    WatchpointsOnStructureStubInfo& holder,
+    std::unique_ptr<StructureStubClearingWatchpoint>& head)
+{
+    head = std::make_unique<StructureStubClearingWatchpoint>(key, holder, WTFMove(head));
+    return head.get();
+}
+
+void StructureStubClearingWatchpoint::fireInternal(const FireDetail&)
+{
+    if (!m_key || !m_key.isWatchable(PropertyCondition::EnsureWatchability)) {
+        // This will implicitly cause my own demise: stub reset removes all watchpoints.
+        // That works, because deleting a watchpoint removes it from the set's list, and
+        // the set's list traversal for firing is robust against the set changing.
+        ConcurrentJSLocker locker(m_holder.codeBlock()->m_lock);
+        m_holder.stubInfo()->reset(m_holder.codeBlock());
+        return;
+    }
+
+    if (m_key.kind() == PropertyCondition::Presence) {
+        // If this was a presence condition, let's watch the property for replacements. This is profitable
+        // for the DFG, which will want the replacement set to be valid in order to do constant folding.
+        VM& vm = *Heap::heap(m_key.object())->vm();
+        m_key.object()->structure()->startWatchingPropertyForReplacements(vm, m_key.offset());
+    }
+
+    m_key.object()->structure()->addTransitionWatchpoint(this);
+}
+
+WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo()
+{
+}
+
+StructureStubClearingWatchpoint* WatchpointsOnStructureStubInfo::addWatchpoint(const ObjectPropertyCondition& key)
+{
+    return StructureStubClearingWatchpoint::push(key, *this, m_head);
+}
+
+StructureStubClearingWatchpoint* WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint(
+    std::unique_ptr<WatchpointsOnStructureStubInfo>& holderRef, CodeBlock* codeBlock,
+    StructureStubInfo* stubInfo, const ObjectPropertyCondition& key)
+{
+    if (!holderRef)
+        holderRef = std::make_unique<WatchpointsOnStructureStubInfo>(codeBlock, stubInfo);
+    else {
+        ASSERT(holderRef->m_codeBlock == codeBlock);
+        ASSERT(holderRef->m_stubInfo == stubInfo);
+    }
+    
+    return holderRef->addWatchpoint(key);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/bytecode/StructureStubClearingWatchpoint.h b/bytecode/StructureStubClearingWatchpoint.h
new file mode 100644
index 0000000..665c56a
--- /dev/null
+++ b/bytecode/StructureStubClearingWatchpoint.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2012, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ObjectPropertyCondition.h"
+#include "Watchpoint.h"
+
+#if ENABLE(JIT)
+
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class CodeBlock;
+class StructureStubInfo;
+class WatchpointsOnStructureStubInfo;
+
+class StructureStubClearingWatchpoint : public Watchpoint {
+    WTF_MAKE_NONCOPYABLE(StructureStubClearingWatchpoint);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    StructureStubClearingWatchpoint(
+        const ObjectPropertyCondition& key,
+        WatchpointsOnStructureStubInfo& holder,
+        std::unique_ptr<StructureStubClearingWatchpoint> next)
+        : m_key(key)
+        , m_holder(holder)
+        , m_next(WTFMove(next))
+    {
+    }
+    
+    virtual ~StructureStubClearingWatchpoint();
+    
+    static StructureStubClearingWatchpoint* push(
+        const ObjectPropertyCondition& key,
+        WatchpointsOnStructureStubInfo& holder,
+        std::unique_ptr<StructureStubClearingWatchpoint>& head);
+
+protected:
+    void fireInternal(const FireDetail&) override;
+
+private:
+    ObjectPropertyCondition m_key;
+    WatchpointsOnStructureStubInfo& m_holder;
+    std::unique_ptr<StructureStubClearingWatchpoint> m_next;
+};
+
+class WatchpointsOnStructureStubInfo {
+    WTF_MAKE_NONCOPYABLE(WatchpointsOnStructureStubInfo);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    WatchpointsOnStructureStubInfo(CodeBlock* codeBlock, StructureStubInfo* stubInfo)
+        : m_codeBlock(codeBlock)
+        , m_stubInfo(stubInfo)
+    {
+    }
+    
+    ~WatchpointsOnStructureStubInfo();
+    
+    StructureStubClearingWatchpoint* addWatchpoint(const ObjectPropertyCondition& key);
+    
+    static StructureStubClearingWatchpoint* ensureReferenceAndAddWatchpoint(
+        std::unique_ptr<WatchpointsOnStructureStubInfo>& holderRef,
+        CodeBlock*, StructureStubInfo*, const ObjectPropertyCondition& key);
+    
+    CodeBlock* codeBlock() const { return m_codeBlock; }
+    StructureStubInfo* stubInfo() const { return m_stubInfo; }
+    
+private:
+    CodeBlock* m_codeBlock;
+    StructureStubInfo* m_stubInfo;
+    std::unique_ptr<StructureStubClearingWatchpoint> m_head;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/bytecode/StructureStubInfo.cpp b/bytecode/StructureStubInfo.cpp
new file mode 100644
index 0000000..38e5cef
--- /dev/null
+++ b/bytecode/StructureStubInfo.cpp
@@ -0,0 +1,290 @@
+/*
+ * Copyright (C) 2008, 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "StructureStubInfo.h"
+
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "PolymorphicAccess.h"
+#include "Repatch.h"
+
+namespace JSC {
+
+#if ENABLE(JIT)
+
+static const bool verbose = false;
+
+StructureStubInfo::StructureStubInfo(AccessType accessType)
+    : callSiteIndex(UINT_MAX)
+    , accessType(accessType)
+    , cacheType(CacheType::Unset)
+    , countdown(1) // For a totally clear stub, we'll patch it after the first execution.
+    , repatchCount(0)
+    , numberOfCoolDowns(0)
+    , bufferingCountdown(Options::repatchBufferingCountdown())
+    , resetByGC(false)
+    , tookSlowPath(false)
+    , everConsidered(false)
+{
+}
+
+StructureStubInfo::~StructureStubInfo()
+{
+}
+
+void StructureStubInfo::initGetByIdSelf(CodeBlock* codeBlock, Structure* baseObjectStructure, PropertyOffset offset)
+{
+    cacheType = CacheType::GetByIdSelf;
+    
+    u.byIdSelf.baseObjectStructure.set(
+        *codeBlock->vm(), codeBlock, baseObjectStructure);
+    u.byIdSelf.offset = offset;
+}
+
+void StructureStubInfo::initArrayLength()
+{
+    cacheType = CacheType::ArrayLength;
+}
+
+void StructureStubInfo::initPutByIdReplace(CodeBlock* codeBlock, Structure* baseObjectStructure, PropertyOffset offset)
+{
+    cacheType = CacheType::PutByIdReplace;
+    
+    u.byIdSelf.baseObjectStructure.set(
+        *codeBlock->vm(), codeBlock, baseObjectStructure);
+    u.byIdSelf.offset = offset;
+}
+
+void StructureStubInfo::initStub(CodeBlock*, std::unique_ptr<PolymorphicAccess> stub)
+{
+    cacheType = CacheType::Stub;
+    u.stub = stub.release();
+}
+
+void StructureStubInfo::deref()
+{
+    switch (cacheType) {
+    case CacheType::Stub:
+        delete u.stub;
+        return;
+    case CacheType::Unset:
+    case CacheType::GetByIdSelf:
+    case CacheType::PutByIdReplace:
+    case CacheType::ArrayLength:
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void StructureStubInfo::aboutToDie()
+{
+    switch (cacheType) {
+    case CacheType::Stub:
+        u.stub->aboutToDie();
+        return;
+    case CacheType::Unset:
+    case CacheType::GetByIdSelf:
+    case CacheType::PutByIdReplace:
+    case CacheType::ArrayLength:
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+AccessGenerationResult StructureStubInfo::addAccessCase(
+    CodeBlock* codeBlock, const Identifier& ident, std::unique_ptr<AccessCase> accessCase)
+{
+    VM& vm = *codeBlock->vm();
+    
+    if (verbose)
+        dataLog("Adding access case: ", accessCase, "\n");
+    
+    if (!accessCase)
+        return AccessGenerationResult::GaveUp;
+    
+    AccessGenerationResult result;
+    
+    if (cacheType == CacheType::Stub) {
+        result = u.stub->addCase(vm, codeBlock, *this, ident, WTFMove(accessCase));
+        
+        if (verbose)
+            dataLog("Had stub, result: ", result, "\n");
+
+        if (!result.buffered()) {
+            bufferedStructures.clear();
+            return result;
+        }
+    } else {
+        std::unique_ptr<PolymorphicAccess> access = std::make_unique<PolymorphicAccess>();
+        
+        Vector<std::unique_ptr<AccessCase>, 2> accessCases;
+        
+        std::unique_ptr<AccessCase> previousCase =
+            AccessCase::fromStructureStubInfo(vm, codeBlock, *this);
+        if (previousCase)
+            accessCases.append(WTFMove(previousCase));
+        
+        accessCases.append(WTFMove(accessCase));
+        
+        result = access->addCases(vm, codeBlock, *this, ident, WTFMove(accessCases));
+        
+        if (verbose)
+            dataLog("Created stub, result: ", result, "\n");
+
+        if (!result.buffered()) {
+            bufferedStructures.clear();
+            return result;
+        }
+        
+        initStub(codeBlock, WTFMove(access));
+    }
+    
+    RELEASE_ASSERT(!result.generatedSomeCode());
+    
+    // If we didn't buffer any cases then bail. If this made no changes then we'll just try again
+    // subject to cool-down.
+    if (!result.buffered()) {
+        if (verbose)
+            dataLog("Didn't buffer anything, bailing.\n");
+        bufferedStructures.clear();
+        return result;
+    }
+    
+    // The buffering countdown tells us if we should be repatching now.
+    if (bufferingCountdown) {
+        if (verbose)
+            dataLog("Countdown is too high: ", bufferingCountdown, ".\n");
+        return result;
+    }
+    
+    // Forget the buffered structures so that all future attempts to cache get fully handled by the
+    // PolymorphicAccess.
+    bufferedStructures.clear();
+    
+    result = u.stub->regenerate(vm, codeBlock, *this, ident);
+    
+    if (verbose)
+        dataLog("Regeneration result: ", result, "\n");
+    
+    RELEASE_ASSERT(!result.buffered());
+    
+    if (!result.generatedSomeCode())
+        return result;
+    
+    // If we generated some code then we don't want to attempt to repatch in the future until we
+    // gather enough cases.
+    bufferingCountdown = Options::repatchBufferingCountdown();
+    return result;
+}
+
+void StructureStubInfo::reset(CodeBlock* codeBlock)
+{
+    bufferedStructures.clear();
+    
+    if (cacheType == CacheType::Unset)
+        return;
+    
+    if (Options::verboseOSR()) {
+        // This can be called from GC destructor calls, so we don't try to do a full dump
+        // of the CodeBlock.
+        dataLog("Clearing structure cache (kind ", static_cast<int>(accessType), ") in ", RawPointer(codeBlock), ".\n");
+    }
+
+    switch (accessType) {
+    case AccessType::GetPure:
+        resetGetByID(codeBlock, *this, GetByIDKind::Pure);
+        break;
+    case AccessType::Get:
+        resetGetByID(codeBlock, *this, GetByIDKind::Normal);
+        break;
+    case AccessType::Put:
+        resetPutByID(codeBlock, *this);
+        break;
+    case AccessType::In:
+        resetIn(codeBlock, *this);
+        break;
+    }
+    
+    deref();
+    cacheType = CacheType::Unset;
+}
+
+void StructureStubInfo::visitWeakReferences(CodeBlock* codeBlock)
+{
+    VM& vm = *codeBlock->vm();
+    
+    bufferedStructures.genericFilter(
+        [&] (Structure* structure) -> bool {
+            return Heap::isMarked(structure);
+        });
+
+    switch (cacheType) {
+    case CacheType::GetByIdSelf:
+    case CacheType::PutByIdReplace:
+        if (Heap::isMarked(u.byIdSelf.baseObjectStructure.get()))
+            return;
+        break;
+    case CacheType::Stub:
+        if (u.stub->visitWeak(vm))
+            return;
+        break;
+    default:
+        return;
+    }
+
+    reset(codeBlock);
+    resetByGC = true;
+}
+
+bool StructureStubInfo::propagateTransitions(SlotVisitor& visitor)
+{
+    switch (cacheType) {
+    case CacheType::Unset:
+    case CacheType::ArrayLength:
+        return true;
+    case CacheType::GetByIdSelf:
+    case CacheType::PutByIdReplace:
+        return u.byIdSelf.baseObjectStructure->markIfCheap(visitor);
+    case CacheType::Stub:
+        return u.stub->propagateTransitions(visitor);
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return true;
+}
+
+bool StructureStubInfo::containsPC(void* pc) const
+{
+    if (cacheType != CacheType::Stub)
+        return false;
+    return u.stub->containsPC(pc);
+}
+
+#endif // ENABLE(JIT)
+
+} // namespace JSC
diff --git a/bytecode/StructureStubInfo.h b/bytecode/StructureStubInfo.h
new file mode 100644
index 0000000..39b721f
--- /dev/null
+++ b/bytecode/StructureStubInfo.h
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "CodeOrigin.h"
+#include "Instruction.h"
+#include "JITStubRoutine.h"
+#include "MacroAssembler.h"
+#include "ObjectPropertyConditionSet.h"
+#include "Options.h"
+#include "RegisterSet.h"
+#include "Structure.h"
+#include "StructureSet.h"
+#include "StructureStubClearingWatchpoint.h"
+
+namespace JSC {
+
+#if ENABLE(JIT)
+
+class AccessCase;
+class AccessGenerationResult;
+class PolymorphicAccess;
+
+enum class AccessType : int8_t {
+    Get,
+    GetPure,
+    Put,
+    In
+};
+
+enum class CacheType : int8_t {
+    Unset,
+    GetByIdSelf,
+    PutByIdReplace,
+    Stub,
+    ArrayLength
+};
+
+class StructureStubInfo {
+    WTF_MAKE_NONCOPYABLE(StructureStubInfo);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    StructureStubInfo(AccessType);
+    ~StructureStubInfo();
+
+    void initGetByIdSelf(CodeBlock*, Structure* baseObjectStructure, PropertyOffset);
+    void initArrayLength();
+    void initPutByIdReplace(CodeBlock*, Structure* baseObjectStructure, PropertyOffset);
+    void initStub(CodeBlock*, std::unique_ptr<PolymorphicAccess>);
+
+    AccessGenerationResult addAccessCase(CodeBlock*, const Identifier&, std::unique_ptr<AccessCase>);
+
+    void reset(CodeBlock*);
+
+    void deref();
+    void aboutToDie();
+
+    // Check if the stub has weak references that are dead. If it does, then it resets itself,
+    // either entirely or just enough to ensure that those dead pointers don't get used anymore.
+    void visitWeakReferences(CodeBlock*);
+    
+    // This returns true if it has marked everything that it will ever mark.
+    bool propagateTransitions(SlotVisitor&);
+        
+    ALWAYS_INLINE bool considerCaching(CodeBlock* codeBlock, Structure* structure)
+    {
+        // We never cache non-cells.
+        if (!structure)
+            return false;
+        
+        // This method is called from the Optimize variants of IC slow paths. The first part of this
+        // method tries to determine if the Optimize variant should really behave like the
+        // non-Optimize variant and leave the IC untouched.
+        //
+        // If we determine that we should do something to the IC then the next order of business is
+        // to determine if this Structure would impact the IC at all. We know that it won't, if we
+        // have already buffered something on its behalf. That's what the bufferedStructures set is
+        // for.
+        
+        everConsidered = true;
+        if (!countdown) {
+            // Check if we have been doing repatching too frequently. If so, then we should cool off
+            // for a while.
+            WTF::incrementWithSaturation(repatchCount);
+            if (repatchCount > Options::repatchCountForCoolDown()) {
+                // We've been repatching too much, so don't do it now.
+                repatchCount = 0;
+                // The amount of time we require for cool-down depends on the number of times we've
+                // had to cool down in the past. The relationship is exponential. The max value we
+                // allow here is 2^256 - 2, since the slow paths may increment the count to indicate
+                // that they'd like to temporarily skip patching just this once.
+                countdown = WTF::leftShiftWithSaturation(
+                    static_cast<uint8_t>(Options::initialCoolDownCount()),
+                    numberOfCoolDowns,
+                    static_cast<uint8_t>(std::numeric_limits<uint8_t>::max() - 1));
+                WTF::incrementWithSaturation(numberOfCoolDowns);
+                
+                // We may still have had something buffered. Trigger generation now.
+                bufferingCountdown = 0;
+                return true;
+            }
+            
+            // We don't want to return false due to buffering indefinitely.
+            if (!bufferingCountdown) {
+                // Note that when this returns true, it's possible that we will not even get an
+                // AccessCase because this may cause Repatch.cpp to simply do an in-place
+                // repatching.
+                return true;
+            }
+            
+            bufferingCountdown--;
+            
+            // Now protect the IC buffering. We want to proceed only if this is a structure that
+            // we don't already have a case buffered for. Note that if this returns true but the
+            // bufferingCountdown is not zero then we will buffer the access case for later without
+            // immediately generating code for it.
+            bool isNewlyAdded = bufferedStructures.add(structure);
+            if (isNewlyAdded) {
+                VM& vm = *codeBlock->vm();
+                vm.heap.writeBarrier(codeBlock);
+            }
+            return isNewlyAdded;
+        }
+        countdown--;
+        return false;
+    }
+
+    bool containsPC(void* pc) const;
+
+    CodeOrigin codeOrigin;
+    CallSiteIndex callSiteIndex;
+
+    union {
+        struct {
+            WriteBarrierBase<Structure> baseObjectStructure;
+            PropertyOffset offset;
+        } byIdSelf;
+        PolymorphicAccess* stub;
+    } u;
+    
+    // Represents those structures that already have buffered AccessCases in the PolymorphicAccess.
+    // Note that it's always safe to clear this. If we clear it prematurely, then if we see the same
+    // structure again during this buffering countdown, we will create an AccessCase object for it.
+    // That's not so bad - we'll get rid of the redundant ones once we regenerate.
+    StructureSet bufferedStructures;
+    
+    struct {
+        CodeLocationLabel start; // This is either the start of the inline IC for *byId caches, or the location of patchable jump for 'in' caches.
+        RegisterSet usedRegisters;
+        uint32_t inlineSize;
+        int32_t deltaFromStartToSlowPathCallLocation;
+        int32_t deltaFromStartToSlowPathStart;
+
+        int8_t baseGPR;
+        int8_t valueGPR;
+#if USE(JSVALUE32_64)
+        int8_t valueTagGPR;
+        int8_t baseTagGPR;
+#endif
+    } patch;
+
+    CodeLocationCall slowPathCallLocation() { return patch.start.callAtOffset(patch.deltaFromStartToSlowPathCallLocation); }
+    CodeLocationLabel doneLocation() { return patch.start.labelAtOffset(patch.inlineSize); }
+    CodeLocationLabel slowPathStartLocation() { return patch.start.labelAtOffset(patch.deltaFromStartToSlowPathStart); }
+    CodeLocationJump patchableJumpForIn()
+    { 
+        ASSERT(accessType == AccessType::In);
+        return patch.start.jumpAtOffset(0);
+    }
+
+    JSValueRegs valueRegs() const
+    {
+        return JSValueRegs(
+#if USE(JSVALUE32_64)
+            static_cast<GPRReg>(patch.valueTagGPR),
+#endif
+            static_cast<GPRReg>(patch.valueGPR));
+    }
+
+
+    AccessType accessType;
+    CacheType cacheType;
+    uint8_t countdown; // We repatch only when this is zero. If not zero, we decrement.
+    uint8_t repatchCount;
+    uint8_t numberOfCoolDowns;
+    uint8_t bufferingCountdown;
+    bool resetByGC : 1;
+    bool tookSlowPath : 1;
+    bool everConsidered : 1;
+};
+
+inline CodeOrigin getStructureStubInfoCodeOrigin(StructureStubInfo& structureStubInfo)
+{
+    return structureStubInfo.codeOrigin;
+}
+
+#else
+
+class StructureStubInfo;
+
+#endif // ENABLE(JIT)
+
+typedef HashMap<CodeOrigin, StructureStubInfo*, CodeOriginApproximateHash> StubInfoMap;
+
+} // namespace JSC
diff --git a/bytecode/SuperSampler.cpp b/bytecode/SuperSampler.cpp
new file mode 100644
index 0000000..a4e21f9
--- /dev/null
+++ b/bytecode/SuperSampler.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SuperSampler.h"
+
+#include "MacroAssembler.h"
+#include "Options.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/DataLog.h>
+#include <wtf/Lock.h>
+#include <wtf/Threading.h>
+
+namespace JSC {
+
+volatile uint32_t g_superSamplerCount;
+
+static StaticLock lock;
+static double in;
+static double out;
+
+void initializeSuperSampler()
+{
+    if (!Options::useSuperSampler())
+        return;
+
+    createThread(
+        "JSC Super Sampler",
+        [] () {
+            const int sleepQuantum = 10;
+            const int printingPeriod = 1000;
+            for (;;) {
+                for (int ms = 0; ms < printingPeriod; ms += sleepQuantum) {
+                    {
+                        LockHolder locker(lock);
+                        if (g_superSamplerCount)
+                            in++;
+                        else
+                            out++;
+                    }
+                    sleepMS(sleepQuantum);
+                }
+                printSuperSamplerState();
+                if (static_cast<int32_t>(g_superSamplerCount) < 0)
+                    dataLog("WARNING: Super sampler undercount detected!\n");
+            }
+        });
+}
+
+void resetSuperSamplerState()
+{
+    LockHolder locker(lock);
+    in = 0;
+    out = 0;
+}
+
+void printSuperSamplerState()
+{
+    if (!Options::useSuperSampler())
+        return;
+
+    LockHolder locker(lock);
+    double percentage = 100.0 * in / (in + out);
+    if (percentage != percentage)
+        percentage = 0.0;
+    dataLog("Percent time behind super sampler flag: ", percentage, "\n");
+}
+
+} // namespace JSC
+
diff --git a/bytecode/SuperSampler.h b/bytecode/SuperSampler.h
new file mode 100644
index 0000000..c90f6d4
--- /dev/null
+++ b/bytecode/SuperSampler.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+class MacroAssembler;
+
+extern volatile uint32_t g_superSamplerCount;
+
+void initializeSuperSampler();
+
+class SuperSamplerScope {
+public:
+    SuperSamplerScope(bool doSample = true)
+        : m_doSample(doSample)
+    {
+        if (m_doSample)
+            g_superSamplerCount++;
+    }
+
+    ~SuperSamplerScope()
+    {
+        if (m_doSample)
+            g_superSamplerCount--;
+    }
+
+private:
+    bool m_doSample;
+};
+
+JS_EXPORT_PRIVATE void resetSuperSamplerState();
+JS_EXPORT_PRIVATE void printSuperSamplerState();
+
+} // namespace JSC
diff --git a/bytecode/ToThisStatus.cpp b/bytecode/ToThisStatus.cpp
new file mode 100644
index 0000000..23d1e08
--- /dev/null
+++ b/bytecode/ToThisStatus.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ToThisStatus.h"
+
+namespace JSC {
+
+ToThisStatus merge(ToThisStatus a, ToThisStatus b)
+{
+    switch (a) {
+    case ToThisOK:
+        return b;
+    case ToThisConflicted:
+        return ToThisConflicted;
+    case ToThisClearedByGC:
+        if (b == ToThisConflicted)
+            return ToThisConflicted;
+        return ToThisClearedByGC;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return ToThisConflicted;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, ToThisStatus status)
+{
+    switch (status) {
+    case ToThisOK:
+        out.print("OK");
+        return;
+    case ToThisConflicted:
+        out.print("Conflicted");
+        return;
+    case ToThisClearedByGC:
+        out.print("ClearedByGC");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/bytecode/ToThisStatus.h b/bytecode/ToThisStatus.h
new file mode 100644
index 0000000..ded012a
--- /dev/null
+++ b/bytecode/ToThisStatus.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum ToThisStatus {
+    ToThisOK,
+    ToThisConflicted,
+    ToThisClearedByGC
+};
+
+ToThisStatus merge(ToThisStatus, ToThisStatus);
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::ToThisStatus);
+
+} // namespace WTF
diff --git a/bytecode/TrackedReferences.cpp b/bytecode/TrackedReferences.cpp
new file mode 100644
index 0000000..ae213d5
--- /dev/null
+++ b/bytecode/TrackedReferences.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TrackedReferences.h"
+
+#include "JSCInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+TrackedReferences::TrackedReferences()
+{
+}
+
+TrackedReferences::~TrackedReferences()
+{
+}
+
+void TrackedReferences::add(JSCell* cell)
+{
+    if (cell)
+        m_references.add(cell);
+}
+
+void TrackedReferences::add(JSValue value)
+{
+    if (value.isCell())
+        add(value.asCell());
+}
+
+void TrackedReferences::check(JSCell* cell) const
+{
+    if (!cell)
+        return;
+    
+    if (m_references.contains(cell))
+        return;
+    
+    dataLog("Found untracked reference: ", JSValue(cell), "\n");
+    dataLog("All tracked references: ", *this, "\n");
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void TrackedReferences::check(JSValue value) const
+{
+    if (value.isCell())
+        check(value.asCell());
+}
+
+void TrackedReferences::dump(PrintStream& out) const
+{
+    CommaPrinter comma;
+    for (JSCell* cell : m_references)
+        out.print(comma, RawPointer(cell));
+}
+
+} // namespace JSC
+
diff --git a/bytecode/TrackedReferences.h b/bytecode/TrackedReferences.h
new file mode 100644
index 0000000..a102167
--- /dev/null
+++ b/bytecode/TrackedReferences.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "JSCell.h"
+#include <wtf/HashSet.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class TrackedReferences {
+public:
+    TrackedReferences();
+    ~TrackedReferences();
+    
+    void add(JSCell*);
+    void add(JSValue);
+    
+    void check(JSCell*) const;
+    void check(JSValue) const;
+    
+    void dump(PrintStream&) const;
+    
+private:
+    HashSet<JSCell*> m_references;
+};
+
+} // namespace JSC
diff --git a/bytecode/TypeLocation.h b/bytecode/TypeLocation.h
new file mode 100644
index 0000000..bc75923
--- /dev/null
+++ b/bytecode/TypeLocation.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "TypeSet.h"
+
+namespace JSC {
+
+enum TypeProfilerGlobalIDFlags {
+    TypeProfilerNeedsUniqueIDGeneration = -1,
+    TypeProfilerNoGlobalIDExists = -2,
+    TypeProfilerReturnStatement = -3
+};
+
+typedef intptr_t GlobalVariableID;
+
+class TypeLocation {
+public:
+    TypeLocation()
+        : m_lastSeenType(TypeNothing)
+        , m_divotForFunctionOffsetIfReturnStatement(UINT_MAX)
+        , m_instructionTypeSet(TypeSet::create())
+        , m_globalTypeSet(nullptr)
+    {
+    }
+
+    GlobalVariableID m_globalVariableID;
+    RuntimeType m_lastSeenType;
+    intptr_t m_sourceID;
+    unsigned m_divotStart;
+    unsigned m_divotEnd;
+    unsigned m_divotForFunctionOffsetIfReturnStatement;
+    RefPtr<TypeSet> m_instructionTypeSet;
+    RefPtr<TypeSet> m_globalTypeSet;
+};
+
+} // namespace JSC
diff --git a/bytecode/UnlinkedCodeBlock.cpp b/bytecode/UnlinkedCodeBlock.cpp
new file mode 100644
index 0000000..53defbf
--- /dev/null
+++ b/bytecode/UnlinkedCodeBlock.cpp
@@ -0,0 +1,416 @@
+/*
+ * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "UnlinkedCodeBlock.h"
+
+#include "BytecodeGenerator.h"
+#include "BytecodeRewriter.h"
+#include "ClassInfo.h"
+#include "CodeCache.h"
+#include "ExecutableInfo.h"
+#include "FunctionOverrides.h"
+#include "JSCInlines.h"
+#include "JSString.h"
+#include "Parser.h"
+#include "PreciseJumpTargetsInlines.h"
+#include "SourceProvider.h"
+#include "Structure.h"
+#include "SymbolTable.h"
+#include "UnlinkedEvalCodeBlock.h"
+#include "UnlinkedFunctionCodeBlock.h"
+#include "UnlinkedInstructionStream.h"
+#include "UnlinkedModuleProgramCodeBlock.h"
+#include "UnlinkedProgramCodeBlock.h"
+#include <wtf/DataLog.h>
+
+namespace JSC {
+
+const ClassInfo UnlinkedCodeBlock::s_info = { "UnlinkedCodeBlock", 0, 0, CREATE_METHOD_TABLE(UnlinkedCodeBlock) };
+
+UnlinkedCodeBlock::UnlinkedCodeBlock(VM* vm, Structure* structure, CodeType codeType, const ExecutableInfo& info, DebuggerMode debuggerMode)
+    : Base(*vm, structure)
+    , m_numVars(0)
+    , m_numCalleeLocals(0)
+    , m_numParameters(0)
+    , m_globalObjectRegister(VirtualRegister())
+    , m_usesEval(info.usesEval())
+    , m_isStrictMode(info.isStrictMode())
+    , m_isConstructor(info.isConstructor())
+    , m_hasCapturedVariables(false)
+    , m_isBuiltinFunction(info.isBuiltinFunction())
+    , m_superBinding(static_cast<unsigned>(info.superBinding()))
+    , m_scriptMode(static_cast<unsigned>(info.scriptMode()))
+    , m_isArrowFunctionContext(info.isArrowFunctionContext())
+    , m_isClassContext(info.isClassContext())
+    , m_wasCompiledWithDebuggingOpcodes(debuggerMode == DebuggerMode::DebuggerOn || Options::forceDebuggerBytecodeGeneration())
+    , m_constructorKind(static_cast<unsigned>(info.constructorKind()))
+    , m_derivedContextType(static_cast<unsigned>(info.derivedContextType()))
+    , m_evalContextType(static_cast<unsigned>(info.evalContextType()))
+    , m_lineCount(0)
+    , m_endColumn(UINT_MAX)
+    , m_didOptimize(MixedTriState)
+    , m_parseMode(info.parseMode())
+    , m_features(0)
+    , m_codeType(codeType)
+    , m_arrayProfileCount(0)
+    , m_arrayAllocationProfileCount(0)
+    , m_objectAllocationProfileCount(0)
+    , m_valueProfileCount(0)
+    , m_llintCallLinkInfoCount(0)
+{
+    for (auto& constantRegisterIndex : m_linkTimeConstants)
+        constantRegisterIndex = 0;
+    ASSERT(m_constructorKind == static_cast<unsigned>(info.constructorKind()));
+}
+
+void UnlinkedCodeBlock::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    UnlinkedCodeBlock* thisObject = jsCast<UnlinkedCodeBlock*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    auto locker = holdLock(*thisObject);
+    for (FunctionExpressionVector::iterator ptr = thisObject->m_functionDecls.begin(), end = thisObject->m_functionDecls.end(); ptr != end; ++ptr)
+        visitor.append(*ptr);
+    for (FunctionExpressionVector::iterator ptr = thisObject->m_functionExprs.begin(), end = thisObject->m_functionExprs.end(); ptr != end; ++ptr)
+        visitor.append(*ptr);
+    visitor.appendValues(thisObject->m_constantRegisters.data(), thisObject->m_constantRegisters.size());
+    if (thisObject->m_unlinkedInstructions)
+        visitor.reportExtraMemoryVisited(thisObject->m_unlinkedInstructions->sizeInBytes());
+    if (thisObject->m_rareData) {
+        for (size_t i = 0, end = thisObject->m_rareData->m_regexps.size(); i != end; i++)
+            visitor.append(thisObject->m_rareData->m_regexps[i]);
+    }
+}
+
+size_t UnlinkedCodeBlock::estimatedSize(JSCell* cell)
+{
+    UnlinkedCodeBlock* thisObject = jsCast<UnlinkedCodeBlock*>(cell);
+    size_t extraSize = thisObject->m_unlinkedInstructions ? thisObject->m_unlinkedInstructions->sizeInBytes() : 0;
+    return Base::estimatedSize(cell) + extraSize;
+}
+
+int UnlinkedCodeBlock::lineNumberForBytecodeOffset(unsigned bytecodeOffset)
+{
+    ASSERT(bytecodeOffset < instructions().count());
+    int divot;
+    int startOffset;
+    int endOffset;
+    unsigned line;
+    unsigned column;
+    expressionRangeForBytecodeOffset(bytecodeOffset, divot, startOffset, endOffset, line, column);
+    return line;
+}
+
+inline void UnlinkedCodeBlock::getLineAndColumn(const ExpressionRangeInfo& info,
+    unsigned& line, unsigned& column) const
+{
+    switch (info.mode) {
+    case ExpressionRangeInfo::FatLineMode:
+        info.decodeFatLineMode(line, column);
+        break;
+    case ExpressionRangeInfo::FatColumnMode:
+        info.decodeFatColumnMode(line, column);
+        break;
+    case ExpressionRangeInfo::FatLineAndColumnMode: {
+        unsigned fatIndex = info.position;
+        ExpressionRangeInfo::FatPosition& fatPos = m_rareData->m_expressionInfoFatPositions[fatIndex];
+        line = fatPos.line;
+        column = fatPos.column;
+        break;
+    }
+    } // switch
+}
+
+#ifndef NDEBUG
+static void dumpLineColumnEntry(size_t index, const UnlinkedInstructionStream& instructionStream, unsigned instructionOffset, unsigned line, unsigned column)
+{
+    const auto& instructions = instructionStream.unpackForDebugging();
+    OpcodeID opcode = instructions[instructionOffset].u.opcode;
+    const char* event = "";
+    if (opcode == op_debug) {
+        switch (instructions[instructionOffset + 1].u.operand) {
+        case WillExecuteProgram: event = " WillExecuteProgram"; break;
+        case DidExecuteProgram: event = " DidExecuteProgram"; break;
+        case DidEnterCallFrame: event = " DidEnterCallFrame"; break;
+        case DidReachBreakpoint: event = " DidReachBreakpoint"; break;
+        case WillLeaveCallFrame: event = " WillLeaveCallFrame"; break;
+        case WillExecuteStatement: event = " WillExecuteStatement"; break;
+        case WillExecuteExpression: event = " WillExecuteExpression"; break;
+        }
+    }
+    dataLogF("  [%zu] pc %u @ line %u col %u : %s%s\n", index, instructionOffset, line, column, opcodeNames[opcode], event);
+}
+
+void UnlinkedCodeBlock::dumpExpressionRangeInfo()
+{
+    Vector<ExpressionRangeInfo>& expressionInfo = m_expressionInfo;
+
+    size_t size = m_expressionInfo.size();
+    dataLogF("UnlinkedCodeBlock %p expressionRangeInfo[%zu] {\n", this, size);
+    for (size_t i = 0; i < size; i++) {
+        ExpressionRangeInfo& info = expressionInfo[i];
+        unsigned line;
+        unsigned column;
+        getLineAndColumn(info, line, column);
+        dumpLineColumnEntry(i, instructions(), info.instructionOffset, line, column);
+    }
+    dataLog("}\n");
+}
+#endif
+
+void UnlinkedCodeBlock::expressionRangeForBytecodeOffset(unsigned bytecodeOffset,
+    int& divot, int& startOffset, int& endOffset, unsigned& line, unsigned& column) const
+{
+    ASSERT(bytecodeOffset < instructions().count());
+
+    if (!m_expressionInfo.size()) {
+        startOffset = 0;
+        endOffset = 0;
+        divot = 0;
+        line = 0;
+        column = 0;
+        return;
+    }
+
+    const Vector<ExpressionRangeInfo>& expressionInfo = m_expressionInfo;
+
+    int low = 0;
+    int high = expressionInfo.size();
+    while (low < high) {
+        int mid = low + (high - low) / 2;
+        if (expressionInfo[mid].instructionOffset <= bytecodeOffset)
+            low = mid + 1;
+        else
+            high = mid;
+    }
+
+    if (!low)
+        low = 1;
+
+    const ExpressionRangeInfo& info = expressionInfo[low - 1];
+    startOffset = info.startOffset;
+    endOffset = info.endOffset;
+    divot = info.divotPoint;
+    getLineAndColumn(info, line, column);
+}
+
+void UnlinkedCodeBlock::addExpressionInfo(unsigned instructionOffset,
+    int divot, int startOffset, int endOffset, unsigned line, unsigned column)
+{
+    if (divot > ExpressionRangeInfo::MaxDivot) {
+        // Overflow has occurred, we can only give line number info for errors for this region
+        divot = 0;
+        startOffset = 0;
+        endOffset = 0;
+    } else if (startOffset > ExpressionRangeInfo::MaxOffset) {
+        // If the start offset is out of bounds we clear both offsets
+        // so we only get the divot marker. Error message will have to be reduced
+        // to line and charPosition number.
+        startOffset = 0;
+        endOffset = 0;
+    } else if (endOffset > ExpressionRangeInfo::MaxOffset) {
+        // The end offset is only used for additional context, and is much more likely
+        // to overflow (eg. function call arguments) so we are willing to drop it without
+        // dropping the rest of the range.
+        endOffset = 0;
+    }
+
+    unsigned positionMode =
+        (line <= ExpressionRangeInfo::MaxFatLineModeLine && column <= ExpressionRangeInfo::MaxFatLineModeColumn) 
+        ? ExpressionRangeInfo::FatLineMode
+        : (line <= ExpressionRangeInfo::MaxFatColumnModeLine && column <= ExpressionRangeInfo::MaxFatColumnModeColumn)
+        ? ExpressionRangeInfo::FatColumnMode
+        : ExpressionRangeInfo::FatLineAndColumnMode;
+
+    ExpressionRangeInfo info;
+    info.instructionOffset = instructionOffset;
+    info.divotPoint = divot;
+    info.startOffset = startOffset;
+    info.endOffset = endOffset;
+
+    info.mode = positionMode;
+    switch (positionMode) {
+    case ExpressionRangeInfo::FatLineMode:
+        info.encodeFatLineMode(line, column);
+        break;
+    case ExpressionRangeInfo::FatColumnMode:
+        info.encodeFatColumnMode(line, column);
+        break;
+    case ExpressionRangeInfo::FatLineAndColumnMode: {
+        createRareDataIfNecessary();
+        unsigned fatIndex = m_rareData->m_expressionInfoFatPositions.size();
+        ExpressionRangeInfo::FatPosition fatPos = { line, column };
+        m_rareData->m_expressionInfoFatPositions.append(fatPos);
+        info.position = fatIndex;
+    }
+    } // switch
+
+    m_expressionInfo.append(info);
+}
+
+bool UnlinkedCodeBlock::typeProfilerExpressionInfoForBytecodeOffset(unsigned bytecodeOffset, unsigned& startDivot, unsigned& endDivot)
+{
+    static const bool verbose = false;
+    if (!m_rareData) {
+        if (verbose)
+            dataLogF("Don't have assignment info for offset:%u\n", bytecodeOffset);
+        startDivot = UINT_MAX;
+        endDivot = UINT_MAX;
+        return false;
+    }
+
+    auto iter = m_rareData->m_typeProfilerInfoMap.find(bytecodeOffset);
+    if (iter == m_rareData->m_typeProfilerInfoMap.end()) {
+        if (verbose)
+            dataLogF("Don't have assignment info for offset:%u\n", bytecodeOffset);
+        startDivot = UINT_MAX;
+        endDivot = UINT_MAX;
+        return false;
+    }
+    
+    RareData::TypeProfilerExpressionRange& range = iter->value;
+    startDivot = range.m_startDivot;
+    endDivot = range.m_endDivot;
+    return true;
+}
+
+void UnlinkedCodeBlock::addTypeProfilerExpressionInfo(unsigned instructionOffset, unsigned startDivot, unsigned endDivot)
+{
+    createRareDataIfNecessary();
+    RareData::TypeProfilerExpressionRange range;
+    range.m_startDivot = startDivot;
+    range.m_endDivot = endDivot;
+    m_rareData->m_typeProfilerInfoMap.set(instructionOffset, range);
+}
+
+UnlinkedCodeBlock::~UnlinkedCodeBlock()
+{
+}
+
+void UnlinkedCodeBlock::setInstructions(std::unique_ptr<UnlinkedInstructionStream> instructions)
+{
+    ASSERT(instructions);
+    {
+        auto locker = holdLock(*this);
+        m_unlinkedInstructions = WTFMove(instructions);
+    }
+    Heap::heap(this)->reportExtraMemoryAllocated(m_unlinkedInstructions->sizeInBytes());
+}
+
+const UnlinkedInstructionStream& UnlinkedCodeBlock::instructions() const
+{
+    ASSERT(m_unlinkedInstructions.get());
+    return *m_unlinkedInstructions;
+}
+
+UnlinkedHandlerInfo* UnlinkedCodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset, RequiredHandler requiredHandler)
+{
+    return handlerForIndex(bytecodeOffset, requiredHandler);
+}
+
+UnlinkedHandlerInfo* UnlinkedCodeBlock::handlerForIndex(unsigned index, RequiredHandler requiredHandler)
+{
+    if (!m_rareData)
+        return nullptr;
+    return UnlinkedHandlerInfo::handlerForIndex(m_rareData->m_exceptionHandlers, index, requiredHandler);
+}
+
+void UnlinkedCodeBlock::applyModification(BytecodeRewriter& rewriter)
+{
+    // Before applying the changes, we adjust the jumps based on the original bytecode offset, the offset to the jump target, and
+    // the insertion information.
+
+    BytecodeGraph<UnlinkedCodeBlock>& graph = rewriter.graph();
+    UnlinkedInstruction* instructionsBegin = graph.instructions().begin();
+
+    for (int bytecodeOffset = 0, instructionCount = graph.instructions().size(); bytecodeOffset < instructionCount;) {
+        UnlinkedInstruction* current = instructionsBegin + bytecodeOffset;
+        OpcodeID opcodeID = current[0].u.opcode;
+        extractStoredJumpTargetsForBytecodeOffset(this, vm()->interpreter, instructionsBegin, bytecodeOffset, [&](int32_t& relativeOffset) {
+            relativeOffset = rewriter.adjustJumpTarget(bytecodeOffset, bytecodeOffset + relativeOffset);
+        });
+        bytecodeOffset += opcodeLength(opcodeID);
+    }
+
+    // Then, exception handlers should be adjusted.
+    if (m_rareData) {
+        for (UnlinkedHandlerInfo& handler : m_rareData->m_exceptionHandlers) {
+            handler.target = rewriter.adjustAbsoluteOffset(handler.target);
+            handler.start = rewriter.adjustAbsoluteOffset(handler.start);
+            handler.end = rewriter.adjustAbsoluteOffset(handler.end);
+        }
+
+        for (size_t i = 0; i < m_rareData->m_opProfileControlFlowBytecodeOffsets.size(); ++i)
+            m_rareData->m_opProfileControlFlowBytecodeOffsets[i] = rewriter.adjustAbsoluteOffset(m_rareData->m_opProfileControlFlowBytecodeOffsets[i]);
+
+        if (!m_rareData->m_typeProfilerInfoMap.isEmpty()) {
+            HashMap<unsigned, RareData::TypeProfilerExpressionRange> adjustedTypeProfilerInfoMap;
+            for (auto& entry : m_rareData->m_typeProfilerInfoMap)
+                adjustedTypeProfilerInfoMap.set(rewriter.adjustAbsoluteOffset(entry.key), entry.value);
+            m_rareData->m_typeProfilerInfoMap.swap(adjustedTypeProfilerInfoMap);
+        }
+    }
+
+    for (size_t i = 0; i < m_propertyAccessInstructions.size(); ++i)
+        m_propertyAccessInstructions[i] = rewriter.adjustAbsoluteOffset(m_propertyAccessInstructions[i]);
+
+    for (size_t i = 0; i < m_expressionInfo.size(); ++i)
+        m_expressionInfo[i].instructionOffset = rewriter.adjustAbsoluteOffset(m_expressionInfo[i].instructionOffset);
+
+    // Then, modify the unlinked instructions.
+    rewriter.applyModification();
+
+    // And recompute the jump target based on the modified unlinked instructions.
+    m_jumpTargets.clear();
+    recomputePreciseJumpTargets(this, graph.instructions().begin(), graph.instructions().size(), m_jumpTargets);
+}
+
+void UnlinkedCodeBlock::shrinkToFit()
+{
+    auto locker = holdLock(*this);
+    
+    m_jumpTargets.shrinkToFit();
+    m_identifiers.shrinkToFit();
+    m_bitVectors.shrinkToFit();
+    m_constantRegisters.shrinkToFit();
+    m_constantsSourceCodeRepresentation.shrinkToFit();
+    m_functionDecls.shrinkToFit();
+    m_functionExprs.shrinkToFit();
+    m_propertyAccessInstructions.shrinkToFit();
+    m_expressionInfo.shrinkToFit();
+
+    if (m_rareData) {
+        m_rareData->m_exceptionHandlers.shrinkToFit();
+        m_rareData->m_regexps.shrinkToFit();
+        m_rareData->m_constantBuffers.shrinkToFit();
+        m_rareData->m_switchJumpTables.shrinkToFit();
+        m_rareData->m_stringSwitchJumpTables.shrinkToFit();
+        m_rareData->m_expressionInfoFatPositions.shrinkToFit();
+    }
+}
+
+} // namespace JSC
diff --git a/bytecode/UnlinkedCodeBlock.h b/bytecode/UnlinkedCodeBlock.h
new file mode 100644
index 0000000..f057497
--- /dev/null
+++ b/bytecode/UnlinkedCodeBlock.h
@@ -0,0 +1,496 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BytecodeConventions.h"
+#include "CodeSpecializationKind.h"
+#include "CodeType.h"
+#include "ConstructAbility.h"
+#include "ExpressionRangeInfo.h"
+#include "HandlerInfo.h"
+#include "Identifier.h"
+#include "JSCell.h"
+#include "JSString.h"
+#include "LockDuringMarking.h"
+#include "ParserModes.h"
+#include "RegExp.h"
+#include "SpecialPointer.h"
+#include "UnlinkedFunctionExecutable.h"
+#include "VariableEnvironment.h"
+#include "VirtualRegister.h"
+#include <wtf/BitVector.h>
+#include <wtf/TriState.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class BytecodeRewriter;
+class Debugger;
+class FunctionExecutable;
+class ParserError;
+class ScriptExecutable;
+class SourceCode;
+class SourceProvider;
+class UnlinkedCodeBlock;
+class UnlinkedFunctionCodeBlock;
+class UnlinkedFunctionExecutable;
+class UnlinkedInstructionStream;
+struct ExecutableInfo;
+
+typedef unsigned UnlinkedValueProfile;
+typedef unsigned UnlinkedArrayProfile;
+typedef unsigned UnlinkedArrayAllocationProfile;
+typedef unsigned UnlinkedObjectAllocationProfile;
+typedef unsigned UnlinkedLLIntCallLinkInfo;
+
+struct UnlinkedStringJumpTable {
+    struct OffsetLocation {
+        int32_t branchOffset;
+    };
+
+    typedef HashMap<RefPtr<StringImpl>, OffsetLocation> StringOffsetTable;
+    StringOffsetTable offsetTable;
+
+    inline int32_t offsetForValue(StringImpl* value, int32_t defaultOffset)
+    {
+        StringOffsetTable::const_iterator end = offsetTable.end();
+        StringOffsetTable::const_iterator loc = offsetTable.find(value);
+        if (loc == end)
+            return defaultOffset;
+        return loc->value.branchOffset;
+    }
+
+};
+
+struct UnlinkedSimpleJumpTable {
+    Vector<int32_t> branchOffsets;
+    int32_t min;
+
+    int32_t offsetForValue(int32_t value, int32_t defaultOffset);
+    void add(int32_t key, int32_t offset)
+    {
+        if (!branchOffsets[key])
+            branchOffsets[key] = offset;
+    }
+};
+
+struct UnlinkedInstruction {
+    UnlinkedInstruction() { u.operand = 0; }
+    UnlinkedInstruction(OpcodeID opcode) { u.opcode = opcode; }
+    UnlinkedInstruction(int operand) { u.operand = operand; }
+    union {
+        OpcodeID opcode;
+        int32_t operand;
+        unsigned index;
+    } u;
+};
+
+class UnlinkedCodeBlock : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static const bool needsDestruction = true;
+
+    enum { CallFunction, ApplyFunction };
+
+    typedef UnlinkedInstruction Instruction;
+    typedef Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow> UnpackedInstructions;
+
+    bool isConstructor() const { return m_isConstructor; }
+    bool isStrictMode() const { return m_isStrictMode; }
+    bool usesEval() const { return m_usesEval; }
+    SourceParseMode parseMode() const { return m_parseMode; }
+    bool isArrowFunction() const { return isArrowFunctionParseMode(parseMode()); }
+    DerivedContextType derivedContextType() const { return static_cast<DerivedContextType>(m_derivedContextType); }
+    EvalContextType evalContextType() const { return static_cast<EvalContextType>(m_evalContextType); }
+    bool isArrowFunctionContext() const { return m_isArrowFunctionContext; }
+    bool isClassContext() const { return m_isClassContext; }
+
+    void addExpressionInfo(unsigned instructionOffset, int divot,
+        int startOffset, int endOffset, unsigned line, unsigned column);
+
+    void addTypeProfilerExpressionInfo(unsigned instructionOffset, unsigned startDivot, unsigned endDivot);
+
+    bool hasExpressionInfo() { return m_expressionInfo.size(); }
+    const Vector<ExpressionRangeInfo>& expressionInfo() { return m_expressionInfo; }
+
+    // Special registers
+    void setThisRegister(VirtualRegister thisRegister) { m_thisRegister = thisRegister; }
+    void setScopeRegister(VirtualRegister scopeRegister) { m_scopeRegister = scopeRegister; }
+
+    bool usesGlobalObject() const { return m_globalObjectRegister.isValid(); }
+    void setGlobalObjectRegister(VirtualRegister globalObjectRegister) { m_globalObjectRegister = globalObjectRegister; }
+    VirtualRegister globalObjectRegister() const { return m_globalObjectRegister; }
+
+    // Parameter information
+    void setNumParameters(int newValue) { m_numParameters = newValue; }
+    void addParameter() { m_numParameters++; }
+    unsigned numParameters() const { return m_numParameters; }
+
+    unsigned addRegExp(RegExp* r)
+    {
+        createRareDataIfNecessary();
+        VM& vm = *this->vm();
+        auto locker = lockDuringMarking(vm.heap, *this);
+        unsigned size = m_rareData->m_regexps.size();
+        m_rareData->m_regexps.append(WriteBarrier<RegExp>(vm, this, r));
+        return size;
+    }
+    unsigned numberOfRegExps() const
+    {
+        if (!m_rareData)
+            return 0;
+        return m_rareData->m_regexps.size();
+    }
+    RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
+
+    // Constant Pools
+
+    size_t numberOfIdentifiers() const { return m_identifiers.size(); }
+    void addIdentifier(const Identifier& i) { return m_identifiers.append(i); }
+    const Identifier& identifier(int index) const { return m_identifiers[index]; }
+    const Vector<Identifier>& identifiers() const { return m_identifiers; }
+
+    const Vector<BitVector>& bitVectors() const { return m_bitVectors; }
+    BitVector& bitVector(size_t i) { return m_bitVectors[i]; }
+    unsigned addBitVector(BitVector&& bitVector)
+    {
+        m_bitVectors.append(WTFMove(bitVector));
+        return m_bitVectors.size() - 1;
+    }
+
+    unsigned addConstant(JSValue v, SourceCodeRepresentation sourceCodeRepresentation = SourceCodeRepresentation::Other)
+    {
+        VM& vm = *this->vm();
+        auto locker = lockDuringMarking(vm.heap, *this);
+        unsigned result = m_constantRegisters.size();
+        m_constantRegisters.append(WriteBarrier<Unknown>());
+        m_constantRegisters.last().set(vm, this, v);
+        m_constantsSourceCodeRepresentation.append(sourceCodeRepresentation);
+        return result;
+    }
+    unsigned addConstant(LinkTimeConstant type)
+    {
+        VM& vm = *this->vm();
+        auto locker = lockDuringMarking(vm.heap, *this);
+        unsigned result = m_constantRegisters.size();
+        ASSERT(result);
+        unsigned index = static_cast<unsigned>(type);
+        ASSERT(index < LinkTimeConstantCount);
+        m_linkTimeConstants[index] = result;
+        m_constantRegisters.append(WriteBarrier<Unknown>());
+        m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
+        return result;
+    }
+    unsigned registerIndexForLinkTimeConstant(LinkTimeConstant type)
+    {
+        unsigned index = static_cast<unsigned>(type);
+        ASSERT(index < LinkTimeConstantCount);
+        return m_linkTimeConstants[index];
+    }
+    const Vector<WriteBarrier<Unknown>>& constantRegisters() { return m_constantRegisters; }
+    const WriteBarrier<Unknown>& constantRegister(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
+    ALWAYS_INLINE bool isConstantRegisterIndex(int index) const { return index >= FirstConstantRegisterIndex; }
+    const Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation() { return m_constantsSourceCodeRepresentation; }
+
+    // Jumps
+    size_t numberOfJumpTargets() const { return m_jumpTargets.size(); }
+    void addJumpTarget(unsigned jumpTarget) { m_jumpTargets.append(jumpTarget); }
+    unsigned jumpTarget(int index) const { return m_jumpTargets[index]; }
+    unsigned lastJumpTarget() const { return m_jumpTargets.last(); }
+
+    UnlinkedHandlerInfo* handlerForBytecodeOffset(unsigned bytecodeOffset, RequiredHandler = RequiredHandler::AnyHandler);
+    UnlinkedHandlerInfo* handlerForIndex(unsigned, RequiredHandler = RequiredHandler::AnyHandler);
+
+    bool isBuiltinFunction() const { return m_isBuiltinFunction; }
+
+    ConstructorKind constructorKind() const { return static_cast<ConstructorKind>(m_constructorKind); }
+    SuperBinding superBinding() const { return static_cast<SuperBinding>(m_superBinding); }
+    JSParserScriptMode scriptMode() const { return static_cast<JSParserScriptMode>(m_scriptMode); }
+
+    void shrinkToFit();
+
+    void setInstructions(std::unique_ptr<UnlinkedInstructionStream>);
+    const UnlinkedInstructionStream& instructions() const;
+
+    int numCalleeLocals() const { return m_numCalleeLocals; }
+
+    int m_numVars;
+    int m_numCapturedVars;
+    int m_numCalleeLocals;
+
+    // Jump Tables
+
+    size_t numberOfSwitchJumpTables() const { return m_rareData ? m_rareData->m_switchJumpTables.size() : 0; }
+    UnlinkedSimpleJumpTable& addSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_switchJumpTables.append(UnlinkedSimpleJumpTable()); return m_rareData->m_switchJumpTables.last(); }
+    UnlinkedSimpleJumpTable& switchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_switchJumpTables[tableIndex]; }
+
+    size_t numberOfStringSwitchJumpTables() const { return m_rareData ? m_rareData->m_stringSwitchJumpTables.size() : 0; }
+    UnlinkedStringJumpTable& addStringSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_stringSwitchJumpTables.append(UnlinkedStringJumpTable()); return m_rareData->m_stringSwitchJumpTables.last(); }
+    UnlinkedStringJumpTable& stringSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
+
+    unsigned addFunctionDecl(UnlinkedFunctionExecutable* n)
+    {
+        VM& vm = *this->vm();
+        auto locker = lockDuringMarking(vm.heap, *this);
+        unsigned size = m_functionDecls.size();
+        m_functionDecls.append(WriteBarrier<UnlinkedFunctionExecutable>());
+        m_functionDecls.last().set(vm, this, n);
+        return size;
+    }
+    UnlinkedFunctionExecutable* functionDecl(int index) { return m_functionDecls[index].get(); }
+    size_t numberOfFunctionDecls() { return m_functionDecls.size(); }
+    unsigned addFunctionExpr(UnlinkedFunctionExecutable* n)
+    {
+        VM& vm = *this->vm();
+        auto locker = lockDuringMarking(vm.heap, *this);
+        unsigned size = m_functionExprs.size();
+        m_functionExprs.append(WriteBarrier<UnlinkedFunctionExecutable>());
+        m_functionExprs.last().set(vm, this, n);
+        return size;
+    }
+    UnlinkedFunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
+    size_t numberOfFunctionExprs() { return m_functionExprs.size(); }
+
+    // Exception handling support
+    size_t numberOfExceptionHandlers() const { return m_rareData ? m_rareData->m_exceptionHandlers.size() : 0; }
+    void addExceptionHandler(const UnlinkedHandlerInfo& handler) { createRareDataIfNecessary(); return m_rareData->m_exceptionHandlers.append(handler); }
+    UnlinkedHandlerInfo& exceptionHandler(int index) { ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
+
+    UnlinkedArrayProfile addArrayProfile() { return m_arrayProfileCount++; }
+    unsigned numberOfArrayProfiles() { return m_arrayProfileCount; }
+    UnlinkedArrayAllocationProfile addArrayAllocationProfile() { return m_arrayAllocationProfileCount++; }
+    unsigned numberOfArrayAllocationProfiles() { return m_arrayAllocationProfileCount; }
+    UnlinkedObjectAllocationProfile addObjectAllocationProfile() { return m_objectAllocationProfileCount++; }
+    unsigned numberOfObjectAllocationProfiles() { return m_objectAllocationProfileCount; }
+    UnlinkedValueProfile addValueProfile() { return m_valueProfileCount++; }
+    unsigned numberOfValueProfiles() { return m_valueProfileCount; }
+
+    UnlinkedLLIntCallLinkInfo addLLIntCallLinkInfo() { return m_llintCallLinkInfoCount++; }
+    unsigned numberOfLLintCallLinkInfos() { return m_llintCallLinkInfoCount; }
+
+    CodeType codeType() const { return m_codeType; }
+
+    VirtualRegister thisRegister() const { return m_thisRegister; }
+    VirtualRegister scopeRegister() const { return m_scopeRegister; }
+
+    void addPropertyAccessInstruction(unsigned propertyAccessInstruction)
+    {
+        m_propertyAccessInstructions.append(propertyAccessInstruction);
+    }
+
+    size_t numberOfPropertyAccessInstructions() const { return m_propertyAccessInstructions.size(); }
+    const Vector<unsigned>& propertyAccessInstructions() const { return m_propertyAccessInstructions; }
+
+    typedef Vector<JSValue> ConstantBuffer;
+
+    size_t constantBufferCount() { ASSERT(m_rareData); return m_rareData->m_constantBuffers.size(); }
+    unsigned addConstantBuffer(unsigned length)
+    {
+        createRareDataIfNecessary();
+        unsigned size = m_rareData->m_constantBuffers.size();
+        m_rareData->m_constantBuffers.append(Vector<JSValue>(length));
+        return size;
+    }
+
+    const ConstantBuffer& constantBuffer(unsigned index) const
+    {
+        ASSERT(m_rareData);
+        return m_rareData->m_constantBuffers[index];
+    }
+
+    ConstantBuffer& constantBuffer(unsigned index)
+    {
+        ASSERT(m_rareData);
+        return m_rareData->m_constantBuffers[index];
+    }
+
+    bool hasRareData() const { return m_rareData.get(); }
+
+    int lineNumberForBytecodeOffset(unsigned bytecodeOffset);
+
+    void expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot,
+        int& startOffset, int& endOffset, unsigned& line, unsigned& column) const;
+
+    bool typeProfilerExpressionInfoForBytecodeOffset(unsigned bytecodeOffset, unsigned& startDivot, unsigned& endDivot);
+
+    void recordParse(CodeFeatures features, bool hasCapturedVariables, unsigned lineCount, unsigned endColumn)
+    {
+        m_features = features;
+        m_hasCapturedVariables = hasCapturedVariables;
+        m_lineCount = lineCount;
+        // For the UnlinkedCodeBlock, startColumn is always 0.
+        m_endColumn = endColumn;
+    }
+
+    const String& sourceURLDirective() const { return m_sourceURLDirective; }
+    const String& sourceMappingURLDirective() const { return m_sourceMappingURLDirective; }
+    void setSourceURLDirective(const String& sourceURL) { m_sourceURLDirective = sourceURL; }
+    void setSourceMappingURLDirective(const String& sourceMappingURL) { m_sourceMappingURLDirective = sourceMappingURL; }
+
+    CodeFeatures codeFeatures() const { return m_features; }
+    bool hasCapturedVariables() const { return m_hasCapturedVariables; }
+    unsigned lineCount() const { return m_lineCount; }
+    ALWAYS_INLINE unsigned startColumn() const { return 0; }
+    unsigned endColumn() const { return m_endColumn; }
+
+    void addOpProfileControlFlowBytecodeOffset(size_t offset)
+    {
+        createRareDataIfNecessary();
+        m_rareData->m_opProfileControlFlowBytecodeOffsets.append(offset);
+    }
+    const Vector<size_t>& opProfileControlFlowBytecodeOffsets() const
+    {
+        ASSERT(m_rareData);
+        return m_rareData->m_opProfileControlFlowBytecodeOffsets;
+    }
+    bool hasOpProfileControlFlowBytecodeOffsets() const
+    {
+        return m_rareData && !m_rareData->m_opProfileControlFlowBytecodeOffsets.isEmpty();
+    }
+
+    void dumpExpressionRangeInfo(); // For debugging purpose only.
+
+    bool wasCompiledWithDebuggingOpcodes() const { return m_wasCompiledWithDebuggingOpcodes; }
+
+    TriState didOptimize() const { return m_didOptimize; }
+    void setDidOptimize(TriState didOptimize) { m_didOptimize = didOptimize; }
+
+protected:
+    UnlinkedCodeBlock(VM*, Structure*, CodeType, const ExecutableInfo&, DebuggerMode);
+    ~UnlinkedCodeBlock();
+
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+    }
+
+private:
+    friend class BytecodeRewriter;
+    void applyModification(BytecodeRewriter&);
+
+    void createRareDataIfNecessary()
+    {
+        if (!m_rareData) {
+            auto locker = lockDuringMarking(*heap(), *this);
+            m_rareData = std::make_unique<RareData>();
+        }
+    }
+
+    void getLineAndColumn(const ExpressionRangeInfo&, unsigned& line, unsigned& column) const;
+
+    int m_numParameters;
+
+    std::unique_ptr<UnlinkedInstructionStream> m_unlinkedInstructions;
+
+    VirtualRegister m_thisRegister;
+    VirtualRegister m_scopeRegister;
+    VirtualRegister m_globalObjectRegister;
+
+    String m_sourceURLDirective;
+    String m_sourceMappingURLDirective;
+
+    unsigned m_usesEval : 1;
+    unsigned m_isStrictMode : 1;
+    unsigned m_isConstructor : 1;
+    unsigned m_hasCapturedVariables : 1;
+    unsigned m_isBuiltinFunction : 1;
+    unsigned m_superBinding : 1;
+    unsigned m_scriptMode: 1;
+    unsigned m_isArrowFunctionContext : 1;
+    unsigned m_isClassContext : 1;
+    unsigned m_wasCompiledWithDebuggingOpcodes : 1;
+    unsigned m_constructorKind : 2;
+    unsigned m_derivedContextType : 2;
+    unsigned m_evalContextType : 2;
+    unsigned m_lineCount;
+    unsigned m_endColumn;
+
+    TriState m_didOptimize;
+    SourceParseMode m_parseMode;
+    CodeFeatures m_features;
+    CodeType m_codeType;
+
+    Vector<unsigned> m_jumpTargets;
+
+    Vector<unsigned> m_propertyAccessInstructions;
+
+    // Constant Pools
+    Vector<Identifier> m_identifiers;
+    Vector<BitVector> m_bitVectors;
+    Vector<WriteBarrier<Unknown>> m_constantRegisters;
+    Vector<SourceCodeRepresentation> m_constantsSourceCodeRepresentation;
+    typedef Vector<WriteBarrier<UnlinkedFunctionExecutable>> FunctionExpressionVector;
+    FunctionExpressionVector m_functionDecls;
+    FunctionExpressionVector m_functionExprs;
+    std::array<unsigned, LinkTimeConstantCount> m_linkTimeConstants;
+
+    unsigned m_arrayProfileCount;
+    unsigned m_arrayAllocationProfileCount;
+    unsigned m_objectAllocationProfileCount;
+    unsigned m_valueProfileCount;
+    unsigned m_llintCallLinkInfoCount;
+
+public:
+    struct RareData {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        Vector<UnlinkedHandlerInfo> m_exceptionHandlers;
+
+        // Rare Constants
+        Vector<WriteBarrier<RegExp>> m_regexps;
+
+        // Buffers used for large array literals
+        Vector<ConstantBuffer> m_constantBuffers;
+
+        // Jump Tables
+        Vector<UnlinkedSimpleJumpTable> m_switchJumpTables;
+        Vector<UnlinkedStringJumpTable> m_stringSwitchJumpTables;
+
+        Vector<ExpressionRangeInfo::FatPosition> m_expressionInfoFatPositions;
+
+        struct TypeProfilerExpressionRange {
+            unsigned m_startDivot;
+            unsigned m_endDivot;
+        };
+        HashMap<unsigned, TypeProfilerExpressionRange> m_typeProfilerInfoMap;
+        Vector<size_t> m_opProfileControlFlowBytecodeOffsets;
+    };
+
+private:
+    std::unique_ptr<RareData> m_rareData;
+    Vector<ExpressionRangeInfo> m_expressionInfo;
+
+protected:
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static size_t estimatedSize(JSCell*);
+
+public:
+    DECLARE_INFO;
+};
+
+}
diff --git a/bytecode/UnlinkedEvalCodeBlock.cpp b/bytecode/UnlinkedEvalCodeBlock.cpp
new file mode 100644
index 0000000..07f9916
--- /dev/null
+++ b/bytecode/UnlinkedEvalCodeBlock.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "UnlinkedEvalCodeBlock.h"
+
+#include "JSCellInlines.h"
+
+namespace JSC {
+
+const ClassInfo UnlinkedEvalCodeBlock::s_info = { "UnlinkedEvalCodeBlock", &Base::s_info, 0, CREATE_METHOD_TABLE(UnlinkedEvalCodeBlock) };
+
+void UnlinkedEvalCodeBlock::destroy(JSCell* cell)
+{
+    static_cast<UnlinkedEvalCodeBlock*>(cell)->~UnlinkedEvalCodeBlock();
+}
+
+}
diff --git a/bytecode/UnlinkedEvalCodeBlock.h b/bytecode/UnlinkedEvalCodeBlock.h
new file mode 100644
index 0000000..3130ea4
--- /dev/null
+++ b/bytecode/UnlinkedEvalCodeBlock.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "UnlinkedGlobalCodeBlock.h"
+
+namespace JSC {
+
+class UnlinkedEvalCodeBlock final : public UnlinkedGlobalCodeBlock {
+public:
+    typedef UnlinkedGlobalCodeBlock Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static UnlinkedEvalCodeBlock* create(VM* vm, const ExecutableInfo& info, DebuggerMode debuggerMode)
+    {
+        UnlinkedEvalCodeBlock* instance = new (NotNull, allocateCell<UnlinkedEvalCodeBlock>(vm->heap)) UnlinkedEvalCodeBlock(vm, vm->unlinkedEvalCodeBlockStructure.get(), info, debuggerMode);
+        instance->finishCreation(*vm);
+        return instance;
+    }
+
+    static void destroy(JSCell*);
+
+    const Identifier& variable(unsigned index) { return m_variables[index]; }
+    unsigned numVariables() { return m_variables.size(); }
+    void adoptVariables(Vector<Identifier, 0, UnsafeVectorOverflow>& variables)
+    {
+        ASSERT(m_variables.isEmpty());
+        m_variables.swap(variables);
+    }
+
+private:
+    UnlinkedEvalCodeBlock(VM* vm, Structure* structure, const ExecutableInfo& info, DebuggerMode debuggerMode)
+        : Base(vm, structure, EvalCode, info, debuggerMode)
+    {
+    }
+
+    Vector<Identifier, 0, UnsafeVectorOverflow> m_variables;
+
+public:
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(UnlinkedEvalCodeBlockType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+};
+
+}
diff --git a/bytecode/UnlinkedFunctionCodeBlock.cpp b/bytecode/UnlinkedFunctionCodeBlock.cpp
new file mode 100644
index 0000000..151d560
--- /dev/null
+++ b/bytecode/UnlinkedFunctionCodeBlock.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "UnlinkedFunctionCodeBlock.h"
+
+#include "JSCellInlines.h"
+
+namespace JSC {
+
+const ClassInfo UnlinkedFunctionCodeBlock::s_info = { "UnlinkedFunctionCodeBlock", &Base::s_info, 0, CREATE_METHOD_TABLE(UnlinkedFunctionCodeBlock) };
+
+void UnlinkedFunctionCodeBlock::destroy(JSCell* cell)
+{
+    static_cast<UnlinkedFunctionCodeBlock*>(cell)->~UnlinkedFunctionCodeBlock();
+}
+
+}
diff --git a/bytecode/UnlinkedFunctionCodeBlock.h b/bytecode/UnlinkedFunctionCodeBlock.h
new file mode 100644
index 0000000..b5482b6
--- /dev/null
+++ b/bytecode/UnlinkedFunctionCodeBlock.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "UnlinkedCodeBlock.h"
+
+namespace JSC {
+
+class UnlinkedFunctionCodeBlock final : public UnlinkedCodeBlock {
+public:
+    typedef UnlinkedCodeBlock Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static UnlinkedFunctionCodeBlock* create(VM* vm, CodeType codeType, const ExecutableInfo& info, DebuggerMode debuggerMode)
+    {
+        UnlinkedFunctionCodeBlock* instance = new (NotNull, allocateCell<UnlinkedFunctionCodeBlock>(vm->heap)) UnlinkedFunctionCodeBlock(vm, vm->unlinkedFunctionCodeBlockStructure.get(), codeType, info, debuggerMode);
+        instance->finishCreation(*vm);
+        return instance;
+    }
+
+    static void destroy(JSCell*);
+
+private:
+    UnlinkedFunctionCodeBlock(VM* vm, Structure* structure, CodeType codeType, const ExecutableInfo& info, DebuggerMode debuggerMode)
+        : Base(vm, structure, codeType, info, debuggerMode)
+    {
+    }
+    
+public:
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(UnlinkedFunctionCodeBlockType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+};
+
+}
diff --git a/bytecode/UnlinkedFunctionExecutable.cpp b/bytecode/UnlinkedFunctionExecutable.cpp
new file mode 100644
index 0000000..066bc67
--- /dev/null
+++ b/bytecode/UnlinkedFunctionExecutable.cpp
@@ -0,0 +1,235 @@
+/*
+ * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "UnlinkedFunctionExecutable.h"
+
+#include "BytecodeGenerator.h"
+#include "ClassInfo.h"
+#include "CodeCache.h"
+#include "Debugger.h"
+#include "ExecutableInfo.h"
+#include "FunctionOverrides.h"
+#include "JSCInlines.h"
+#include "Parser.h"
+#include "SourceProvider.h"
+#include "Structure.h"
+#include "UnlinkedFunctionCodeBlock.h"
+
+namespace JSC {
+
+static_assert(sizeof(UnlinkedFunctionExecutable) <= 256, "UnlinkedFunctionExecutable should fit in a 256-byte cell.");
+
+const ClassInfo UnlinkedFunctionExecutable::s_info = { "UnlinkedFunctionExecutable", 0, 0, CREATE_METHOD_TABLE(UnlinkedFunctionExecutable) };
+
+static UnlinkedFunctionCodeBlock* generateUnlinkedFunctionCodeBlock(
+    VM& vm, UnlinkedFunctionExecutable* executable, const SourceCode& source,
+    CodeSpecializationKind kind, DebuggerMode debuggerMode,
+    UnlinkedFunctionKind functionKind, ParserError& error, SourceParseMode parseMode)
+{
+    JSParserBuiltinMode builtinMode = executable->isBuiltinFunction() ? JSParserBuiltinMode::Builtin : JSParserBuiltinMode::NotBuiltin;
+    JSParserStrictMode strictMode = executable->isInStrictContext() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
+    JSParserScriptMode scriptMode = executable->scriptMode();
+    ASSERT(isFunctionParseMode(executable->parseMode()));
+    std::unique_ptr<FunctionNode> function = parse<FunctionNode>(
+        &vm, source, executable->name(), builtinMode, strictMode, scriptMode, executable->parseMode(), executable->superBinding(), error, nullptr);
+
+    if (!function) {
+        ASSERT(error.isValid());
+        return nullptr;
+    }
+
+    function->finishParsing(executable->name(), executable->functionMode());
+    executable->recordParse(function->features(), function->hasCapturedVariables());
+
+    bool isClassContext = executable->superBinding() == SuperBinding::Needed;
+
+    UnlinkedFunctionCodeBlock* result = UnlinkedFunctionCodeBlock::create(&vm, FunctionCode, ExecutableInfo(function->usesEval(), function->isStrictMode(), kind == CodeForConstruct, functionKind == UnlinkedBuiltinFunction, executable->constructorKind(), scriptMode, executable->superBinding(), parseMode, executable->derivedContextType(), false, isClassContext, EvalContextType::FunctionEvalContext), debuggerMode);
+
+    error = BytecodeGenerator::generate(vm, function.get(), result, debuggerMode, executable->parentScopeTDZVariables());
+
+    if (error.isValid())
+        return nullptr;
+    return result;
+}
+
+UnlinkedFunctionExecutable::UnlinkedFunctionExecutable(VM* vm, Structure* structure, const SourceCode& parentSource, SourceCode&& parentSourceOverride, FunctionMetadataNode* node, UnlinkedFunctionKind kind, ConstructAbility constructAbility, JSParserScriptMode scriptMode, VariableEnvironment& parentScopeTDZVariables, DerivedContextType derivedContextType)
+    : Base(*vm, structure)
+    , m_firstLineOffset(node->firstLine() - parentSource.firstLine().oneBasedInt())
+    , m_lineCount(node->lastLine() - node->firstLine())
+    , m_unlinkedFunctionNameStart(node->functionNameStart() - parentSource.startOffset())
+    , m_unlinkedBodyStartColumn(node->startColumn())
+    , m_unlinkedBodyEndColumn(m_lineCount ? node->endColumn() : node->endColumn() - node->startColumn())
+    , m_startOffset(node->source().startOffset() - parentSource.startOffset())
+    , m_sourceLength(node->source().length())
+    , m_parametersStartOffset(node->parametersStart())
+    , m_typeProfilingStartOffset(node->functionKeywordStart())
+    , m_typeProfilingEndOffset(node->startStartOffset() + node->source().length() - 1)
+    , m_parameterCount(node->parameterCount())
+    , m_functionLength(node->functionLength())
+    , m_features(0)
+    , m_sourceParseMode(node->parseMode())
+    , m_isInStrictContext(node->isInStrictContext())
+    , m_hasCapturedVariables(false)
+    , m_isBuiltinFunction(kind == UnlinkedBuiltinFunction)
+    , m_constructAbility(static_cast<unsigned>(constructAbility))
+    , m_constructorKind(static_cast<unsigned>(node->constructorKind()))
+    , m_functionMode(static_cast<unsigned>(node->functionMode()))
+    , m_scriptMode(static_cast<unsigned>(scriptMode))
+    , m_superBinding(static_cast<unsigned>(node->superBinding()))
+    , m_derivedContextType(static_cast<unsigned>(derivedContextType))
+    , m_name(node->ident())
+    , m_ecmaName(node->ecmaName())
+    , m_inferredName(node->inferredName())
+    , m_parentSourceOverride(WTFMove(parentSourceOverride))
+    , m_classSource(node->classSource())
+{
+    // Make sure these bitfields are adequately wide.
+    ASSERT(m_constructAbility == static_cast<unsigned>(constructAbility));
+    ASSERT(m_constructorKind == static_cast<unsigned>(node->constructorKind()));
+    ASSERT(m_functionMode == static_cast<unsigned>(node->functionMode()));
+    ASSERT(m_scriptMode == static_cast<unsigned>(scriptMode));
+    ASSERT(m_superBinding == static_cast<unsigned>(node->superBinding()));
+    ASSERT(m_derivedContextType == static_cast<unsigned>(derivedContextType));
+
+    m_parentScopeTDZVariables.swap(parentScopeTDZVariables);
+}
+
+void UnlinkedFunctionExecutable::destroy(JSCell* cell)
+{
+    static_cast<UnlinkedFunctionExecutable*>(cell)->~UnlinkedFunctionExecutable();
+}
+
+void UnlinkedFunctionExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    UnlinkedFunctionExecutable* thisObject = jsCast<UnlinkedFunctionExecutable*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_unlinkedCodeBlockForCall);
+    visitor.append(thisObject->m_unlinkedCodeBlockForConstruct);
+}
+
+FunctionExecutable* UnlinkedFunctionExecutable::link(VM& vm, const SourceCode& passedParentSource, std::optional<int> overrideLineNumber, Intrinsic intrinsic)
+{
+    const SourceCode& parentSource = m_parentSourceOverride.isNull() ? passedParentSource : m_parentSourceOverride;
+    unsigned firstLine = parentSource.firstLine().oneBasedInt() + m_firstLineOffset;
+    unsigned startOffset = parentSource.startOffset() + m_startOffset;
+    unsigned lineCount = m_lineCount;
+
+    unsigned startColumn = linkedStartColumn(parentSource.startColumn().oneBasedInt());
+    unsigned endColumn = linkedEndColumn(startColumn);
+
+    SourceCode source(parentSource.provider(), startOffset, startOffset + m_sourceLength, firstLine, startColumn);
+    FunctionOverrides::OverrideInfo overrideInfo;
+    bool hasFunctionOverride = false;
+
+    if (UNLIKELY(Options::functionOverrides())) {
+        hasFunctionOverride = FunctionOverrides::initializeOverrideFor(source, overrideInfo);
+        if (UNLIKELY(hasFunctionOverride)) {
+            firstLine = overrideInfo.firstLine;
+            lineCount = overrideInfo.lineCount;
+            startColumn = overrideInfo.startColumn;
+            endColumn = overrideInfo.endColumn;
+            source = overrideInfo.sourceCode;
+        }
+    }
+
+    FunctionExecutable* result = FunctionExecutable::create(vm, source, this, firstLine + lineCount, endColumn, intrinsic);
+    if (overrideLineNumber)
+        result->setOverrideLineNumber(*overrideLineNumber);
+
+    if (UNLIKELY(hasFunctionOverride)) {
+        result->overrideParameterAndTypeProfilingStartEndOffsets(
+            overrideInfo.parametersStartOffset,
+            overrideInfo.typeProfilingStartOffset,
+            overrideInfo.typeProfilingEndOffset);
+    }
+
+    return result;
+}
+
+UnlinkedFunctionExecutable* UnlinkedFunctionExecutable::fromGlobalCode(
+    const Identifier& name, ExecState& exec, const SourceCode& source, 
+    JSObject*& exception, int overrideLineNumber)
+{
+    ParserError error;
+    VM& vm = exec.vm();
+    auto& globalObject = *exec.lexicalGlobalObject();
+    CodeCache* codeCache = vm.codeCache();
+    DebuggerMode debuggerMode = globalObject.hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
+    UnlinkedFunctionExecutable* executable = codeCache->getUnlinkedGlobalFunctionExecutable(vm, name, source, debuggerMode, error);
+
+    if (globalObject.hasDebugger())
+        globalObject.debugger()->sourceParsed(&exec, source.provider(), error.line(), error.message());
+
+    if (error.isValid()) {
+        exception = error.toErrorObject(&globalObject, source, overrideLineNumber);
+        return nullptr;
+    }
+
+    return executable;
+}
+
+UnlinkedFunctionCodeBlock* UnlinkedFunctionExecutable::unlinkedCodeBlockFor(
+    VM& vm, const SourceCode& source, CodeSpecializationKind specializationKind, 
+    DebuggerMode debuggerMode, ParserError& error, SourceParseMode parseMode)
+{
+    switch (specializationKind) {
+    case CodeForCall:
+        if (UnlinkedFunctionCodeBlock* codeBlock = m_unlinkedCodeBlockForCall.get())
+            return codeBlock;
+        break;
+    case CodeForConstruct:
+        if (UnlinkedFunctionCodeBlock* codeBlock = m_unlinkedCodeBlockForConstruct.get())
+            return codeBlock;
+        break;
+    }
+
+    UnlinkedFunctionCodeBlock* result = generateUnlinkedFunctionCodeBlock(
+        vm, this, source, specializationKind, debuggerMode, 
+        isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction, 
+        error, parseMode);
+    
+    if (error.isValid())
+        return nullptr;
+
+    switch (specializationKind) {
+    case CodeForCall:
+        m_unlinkedCodeBlockForCall.set(vm, this, result);
+        break;
+    case CodeForConstruct:
+        m_unlinkedCodeBlockForConstruct.set(vm, this, result);
+        break;
+    }
+    return result;
+}
+
+void UnlinkedFunctionExecutable::setInvalidTypeProfilingOffsets()
+{
+    m_typeProfilingStartOffset = std::numeric_limits<unsigned>::max();
+    m_typeProfilingEndOffset = std::numeric_limits<unsigned>::max();
+}
+
+} // namespace JSC
diff --git a/bytecode/UnlinkedFunctionExecutable.h b/bytecode/UnlinkedFunctionExecutable.h
new file mode 100644
index 0000000..0879dfb
--- /dev/null
+++ b/bytecode/UnlinkedFunctionExecutable.h
@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BytecodeConventions.h"
+#include "CodeSpecializationKind.h"
+#include "CodeType.h"
+#include "ConstructAbility.h"
+#include "ExecutableInfo.h"
+#include "ExpressionRangeInfo.h"
+#include "HandlerInfo.h"
+#include "Identifier.h"
+#include "Intrinsic.h"
+#include "JSCell.h"
+#include "JSString.h"
+#include "ParserModes.h"
+#include "RegExp.h"
+#include "SpecialPointer.h"
+#include "VariableEnvironment.h"
+#include "VirtualRegister.h"
+
+namespace JSC {
+
+class FunctionMetadataNode;
+class FunctionExecutable;
+class ParserError;
+class SourceCode;
+class SourceProvider;
+class UnlinkedFunctionCodeBlock;
+
+enum UnlinkedFunctionKind {
+    UnlinkedNormalFunction,
+    UnlinkedBuiltinFunction,
+};
+
+class UnlinkedFunctionExecutable final : public JSCell {
+public:
+    friend class CodeCache;
+    friend class VM;
+
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static UnlinkedFunctionExecutable* create(VM* vm, const SourceCode& source, FunctionMetadataNode* node, UnlinkedFunctionKind unlinkedFunctionKind, ConstructAbility constructAbility, JSParserScriptMode scriptMode, VariableEnvironment& parentScopeTDZVariables, DerivedContextType derivedContextType, SourceCode&& parentSourceOverride = SourceCode())
+    {
+        UnlinkedFunctionExecutable* instance = new (NotNull, allocateCell<UnlinkedFunctionExecutable>(vm->heap))
+            UnlinkedFunctionExecutable(vm, vm->unlinkedFunctionExecutableStructure.get(), source, WTFMove(parentSourceOverride), node, unlinkedFunctionKind, constructAbility, scriptMode, parentScopeTDZVariables, derivedContextType);
+        instance->finishCreation(*vm);
+        return instance;
+    }
+
+    const Identifier& name() const { return m_name; }
+    const Identifier& ecmaName() const { return m_ecmaName; }
+    void setEcmaName(const Identifier& name) { m_ecmaName = name; }
+    const Identifier& inferredName() const { return m_inferredName; }
+    unsigned parameterCount() const { return m_parameterCount; }; // Excluding 'this'!
+    unsigned functionLength() const { return m_functionLength; }
+    SourceParseMode parseMode() const { return static_cast<SourceParseMode>(m_sourceParseMode); };
+
+    const SourceCode& classSource() const { return m_classSource; };
+    void setClassSource(const SourceCode& source) { m_classSource = source; };
+
+    bool isInStrictContext() const { return m_isInStrictContext; }
+    FunctionMode functionMode() const { return static_cast<FunctionMode>(m_functionMode); }
+    ConstructorKind constructorKind() const { return static_cast<ConstructorKind>(m_constructorKind); }
+    SuperBinding superBinding() const { return static_cast<SuperBinding>(m_superBinding); }
+
+    unsigned lineCount() const { return m_lineCount; }
+    unsigned linkedStartColumn(unsigned parentStartColumn) const { return m_unlinkedBodyStartColumn + (!m_firstLineOffset ? parentStartColumn : 1); }
+    unsigned linkedEndColumn(unsigned startColumn) const { return m_unlinkedBodyEndColumn + (!m_lineCount ? startColumn : 1); }
+
+    unsigned unlinkedFunctionNameStart() const { return m_unlinkedFunctionNameStart; }
+    unsigned unlinkedBodyStartColumn() const { return m_unlinkedBodyStartColumn; }
+    unsigned unlinkedBodyEndColumn() const { return m_unlinkedBodyEndColumn; }
+    unsigned startOffset() const { return m_startOffset; }
+    unsigned sourceLength() { return m_sourceLength; }
+    unsigned parametersStartOffset() const { return m_parametersStartOffset; }
+    unsigned typeProfilingStartOffset() const { return m_typeProfilingStartOffset; }
+    unsigned typeProfilingEndOffset() const { return m_typeProfilingEndOffset; }
+    void setInvalidTypeProfilingOffsets();
+
+    UnlinkedFunctionCodeBlock* unlinkedCodeBlockFor(
+        VM&, const SourceCode&, CodeSpecializationKind, DebuggerMode,
+        ParserError&, SourceParseMode);
+
+    static UnlinkedFunctionExecutable* fromGlobalCode(
+        const Identifier&, ExecState&, const SourceCode&, JSObject*& exception, 
+        int overrideLineNumber);
+
+    JS_EXPORT_PRIVATE FunctionExecutable* link(VM&, const SourceCode& parentSource, std::optional<int> overrideLineNumber = std::nullopt, Intrinsic = NoIntrinsic);
+
+    void clearCode()
+    {
+        m_unlinkedCodeBlockForCall.clear();
+        m_unlinkedCodeBlockForConstruct.clear();
+    }
+
+    void recordParse(CodeFeatures features, bool hasCapturedVariables)
+    {
+        m_features = features;
+        m_hasCapturedVariables = hasCapturedVariables;
+    }
+
+    CodeFeatures features() const { return m_features; }
+    bool hasCapturedVariables() const { return m_hasCapturedVariables; }
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    bool isBuiltinFunction() const { return m_isBuiltinFunction; }
+    ConstructAbility constructAbility() const { return static_cast<ConstructAbility>(m_constructAbility); }
+    JSParserScriptMode scriptMode() const { return static_cast<JSParserScriptMode>(m_scriptMode); }
+    bool isClassConstructorFunction() const { return constructorKind() != ConstructorKind::None; }
+    const VariableEnvironment* parentScopeTDZVariables() const { return &m_parentScopeTDZVariables; }
+    
+    bool isArrowFunction() const { return isArrowFunctionParseMode(parseMode()); }
+
+    JSC::DerivedContextType derivedContextType() const {return static_cast<JSC::DerivedContextType>(m_derivedContextType); }
+
+    const String& sourceURLDirective() const { return m_sourceURLDirective; }
+    const String& sourceMappingURLDirective() const { return m_sourceMappingURLDirective; }
+    void setSourceURLDirective(const String& sourceURL) { m_sourceURLDirective = sourceURL; }
+    void setSourceMappingURLDirective(const String& sourceMappingURL) { m_sourceMappingURLDirective = sourceMappingURL; }
+
+private:
+    UnlinkedFunctionExecutable(VM*, Structure*, const SourceCode&, SourceCode&& parentSourceOverride, FunctionMetadataNode*, UnlinkedFunctionKind, ConstructAbility, JSParserScriptMode, VariableEnvironment&,  JSC::DerivedContextType);
+
+    unsigned m_firstLineOffset;
+    unsigned m_lineCount;
+    unsigned m_unlinkedFunctionNameStart;
+    unsigned m_unlinkedBodyStartColumn;
+    unsigned m_unlinkedBodyEndColumn;
+    unsigned m_startOffset;
+    unsigned m_sourceLength;
+    unsigned m_parametersStartOffset;
+    unsigned m_typeProfilingStartOffset;
+    unsigned m_typeProfilingEndOffset;
+    unsigned m_parameterCount;
+    unsigned m_functionLength;
+    CodeFeatures m_features;
+    SourceParseMode m_sourceParseMode;
+    unsigned m_isInStrictContext : 1;
+    unsigned m_hasCapturedVariables : 1;
+    unsigned m_isBuiltinFunction : 1;
+    unsigned m_constructAbility: 1;
+    unsigned m_constructorKind : 2;
+    unsigned m_functionMode : 2; // FunctionMode
+    unsigned m_scriptMode: 1; // JSParserScriptMode
+    unsigned m_superBinding : 1;
+    unsigned m_derivedContextType: 2;
+
+    WriteBarrier<UnlinkedFunctionCodeBlock> m_unlinkedCodeBlockForCall;
+    WriteBarrier<UnlinkedFunctionCodeBlock> m_unlinkedCodeBlockForConstruct;
+
+    Identifier m_name;
+    Identifier m_ecmaName;
+    Identifier m_inferredName;
+    SourceCode m_parentSourceOverride;
+    SourceCode m_classSource;
+
+    String m_sourceURLDirective;
+    String m_sourceMappingURLDirective;
+
+    VariableEnvironment m_parentScopeTDZVariables;
+
+protected:
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+public:
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(UnlinkedFunctionExecutableType, StructureFlags), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+};
+
+} // namespace JSC
diff --git a/bytecode/UnlinkedGlobalCodeBlock.h b/bytecode/UnlinkedGlobalCodeBlock.h
new file mode 100644
index 0000000..343862e
--- /dev/null
+++ b/bytecode/UnlinkedGlobalCodeBlock.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "UnlinkedCodeBlock.h"
+
+namespace JSC {
+
+class UnlinkedGlobalCodeBlock : public UnlinkedCodeBlock {
+public:
+    typedef UnlinkedCodeBlock Base;
+
+protected:
+    UnlinkedGlobalCodeBlock(VM* vm, Structure* structure, CodeType codeType, const ExecutableInfo& info, DebuggerMode debuggerMode)
+        : Base(vm, structure, codeType, info, debuggerMode)
+    {
+    }
+};
+
+}
diff --git a/bytecode/UnlinkedInstructionStream.cpp b/bytecode/UnlinkedInstructionStream.cpp
new file mode 100644
index 0000000..e8762ff
--- /dev/null
+++ b/bytecode/UnlinkedInstructionStream.cpp
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "UnlinkedInstructionStream.h"
+
+#include "Opcode.h"
+
+namespace JSC {
+
+static void append8(unsigned char*& ptr, unsigned char value)
+{
+    *(ptr++) = value;
+}
+
+static void append32(unsigned char*& ptr, unsigned value)
+{
+    if (!(value & 0xffffffe0)) {
+        *(ptr++) = value;
+        return;
+    }
+
+    if ((value & 0xffffffe0) == 0xffffffe0) {
+        *(ptr++) = (Negative5Bit << 5) | (value & 0x1f);
+        return;
+    }
+
+    if ((value & 0xffffffe0) == 0x40000000) {
+        *(ptr++) = (ConstantRegister5Bit << 5) | (value & 0x1f);
+        return;
+    }
+
+    if (!(value & 0xffffe000)) {
+        *(ptr++) = (Positive13Bit << 5) | ((value >> 8) & 0x1f);
+        *(ptr++) = value & 0xff;
+        return;
+    }
+
+    if ((value & 0xffffe000) == 0xffffe000) {
+        *(ptr++) = (Negative13Bit << 5) | ((value >> 8) & 0x1f);
+        *(ptr++) = value & 0xff;
+        return;
+    }
+
+    if ((value & 0xffffe000) == 0x40000000) {
+        *(ptr++) = (ConstantRegister13Bit << 5) | ((value >> 8) & 0x1f);
+        *(ptr++) = value & 0xff;
+        return;
+    }
+
+    *(ptr++) = Full32Bit << 5;
+    *(ptr++) = value & 0xff;
+    *(ptr++) = (value >> 8) & 0xff;
+    *(ptr++) = (value >> 16) & 0xff;
+    *(ptr++) = (value >> 24) & 0xff;
+}
+
+UnlinkedInstructionStream::UnlinkedInstructionStream(const Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>& instructions)
+    : m_instructionCount(instructions.size())
+{
+    Vector<unsigned char> buffer;
+
+    // Reserve enough space up front so we never have to reallocate when appending.
+    buffer.resizeToFit(m_instructionCount * 5);
+    unsigned char* ptr = buffer.data();
+
+    const UnlinkedInstruction* instructionsData = instructions.data();
+    for (unsigned i = 0; i < m_instructionCount;) {
+        const UnlinkedInstruction* pc = &instructionsData[i];
+        OpcodeID opcode = pc[0].u.opcode;
+        append8(ptr, opcode);
+
+        unsigned opLength = opcodeLength(opcode);
+
+        for (unsigned j = 1; j < opLength; ++j)
+            append32(ptr, pc[j].u.index);
+
+        i += opLength;
+    }
+
+    buffer.shrink(ptr - buffer.data());
+    m_data = RefCountedArray<unsigned char>(buffer);
+}
+
+size_t UnlinkedInstructionStream::sizeInBytes() const
+{
+    return m_data.size() * sizeof(unsigned char);
+}
+
+#ifndef NDEBUG
+const RefCountedArray<UnlinkedInstruction>& UnlinkedInstructionStream::unpackForDebugging() const
+{
+    if (!m_unpackedInstructionsForDebugging.size()) {
+        m_unpackedInstructionsForDebugging = RefCountedArray<UnlinkedInstruction>(m_instructionCount);
+
+        Reader instructionReader(*this);
+        for (unsigned i = 0; !instructionReader.atEnd(); ) {
+            const UnlinkedInstruction* pc = instructionReader.next();
+            unsigned opLength = opcodeLength(pc[0].u.opcode);
+            for (unsigned j = 0; j < opLength; ++j)
+                m_unpackedInstructionsForDebugging[i++] = pc[j];
+        }
+    }
+
+    return m_unpackedInstructionsForDebugging;
+}
+#endif
+
+}
+
diff --git a/bytecode/UnlinkedInstructionStream.h b/bytecode/UnlinkedInstructionStream.h
new file mode 100644
index 0000000..ef139ad
--- /dev/null
+++ b/bytecode/UnlinkedInstructionStream.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#pragma once
+
+#include "Opcode.h"
+#include "UnlinkedCodeBlock.h"
+#include <wtf/RefCountedArray.h>
+
+namespace JSC {
+
+class UnlinkedInstructionStream {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    explicit UnlinkedInstructionStream(const Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>&);
+
+    unsigned count() const { return m_instructionCount; }
+    size_t sizeInBytes() const;
+
+    class Reader {
+    public:
+        explicit Reader(const UnlinkedInstructionStream&);
+
+        const UnlinkedInstruction* next();
+        bool atEnd() const { return m_index == m_stream.m_data.size(); }
+
+    private:
+        unsigned char read8();
+        unsigned read32();
+
+        const UnlinkedInstructionStream& m_stream;
+        UnlinkedInstruction m_unpackedBuffer[16];
+        unsigned m_index;
+    };
+
+#ifndef NDEBUG
+    const RefCountedArray<UnlinkedInstruction>& unpackForDebugging() const;
+#endif
+
+private:
+    friend class Reader;
+
+#ifndef NDEBUG
+    mutable RefCountedArray<UnlinkedInstruction> m_unpackedInstructionsForDebugging;
+#endif
+
+    RefCountedArray<unsigned char> m_data;
+    unsigned m_instructionCount;
+};
+
+// Unlinked instructions are packed in a simple stream format.
+//
+// The first byte is always the opcode.
+// It's followed by an opcode-dependent number of argument values.
+// The first 3 bits of each value determines the format:
+//
+//     5-bit positive integer (1 byte total)
+//     5-bit negative integer (1 byte total)
+//     13-bit positive integer (2 bytes total)
+//     13-bit negative integer (2 bytes total)
+//     5-bit constant register index, based at 0x40000000 (1 byte total)
+//     13-bit constant register index, based at 0x40000000 (2 bytes total)
+//     32-bit raw value (5 bytes total)
+
+enum PackedValueType {
+    Positive5Bit = 0,
+    Negative5Bit,
+    Positive13Bit,
+    Negative13Bit,
+    ConstantRegister5Bit,
+    ConstantRegister13Bit,
+    Full32Bit
+};
+
+ALWAYS_INLINE UnlinkedInstructionStream::Reader::Reader(const UnlinkedInstructionStream& stream)
+    : m_stream(stream)
+    , m_index(0)
+{
+}
+
+ALWAYS_INLINE unsigned char UnlinkedInstructionStream::Reader::read8()
+{
+    return m_stream.m_data.data()[m_index++];
+}
+
+ALWAYS_INLINE unsigned UnlinkedInstructionStream::Reader::read32()
+{
+    const unsigned char* data = &m_stream.m_data.data()[m_index];
+    unsigned char type = data[0] >> 5;
+
+    switch (type) {
+    case Positive5Bit:
+        m_index++;
+        return data[0];
+    case Negative5Bit:
+        m_index++;
+        return 0xffffffe0 | data[0];
+    case Positive13Bit:
+        m_index += 2;
+        return ((data[0] & 0x1F) << 8) | data[1];
+    case Negative13Bit:
+        m_index += 2;
+        return 0xffffe000 | ((data[0] & 0x1F) << 8) | data[1];
+    case ConstantRegister5Bit:
+        m_index++;
+        return 0x40000000 | (data[0] & 0x1F);
+    case ConstantRegister13Bit:
+        m_index += 2;
+        return 0x40000000 | ((data[0] & 0x1F) << 8) | data[1];
+    default:
+        ASSERT(type == Full32Bit);
+        m_index += 5;
+        return data[1] | data[2] << 8 | data[3] << 16 | data[4] << 24;
+    }
+}
+
+ALWAYS_INLINE const UnlinkedInstruction* UnlinkedInstructionStream::Reader::next()
+{
+    m_unpackedBuffer[0].u.opcode = static_cast<OpcodeID>(read8());
+    unsigned opLength = opcodeLength(m_unpackedBuffer[0].u.opcode);
+    for (unsigned i = 1; i < opLength; ++i)
+        m_unpackedBuffer[i].u.index = read32();
+    return m_unpackedBuffer;
+}
+
+} // namespace JSC
diff --git a/bytecode/UnlinkedModuleProgramCodeBlock.cpp b/bytecode/UnlinkedModuleProgramCodeBlock.cpp
new file mode 100644
index 0000000..00f36c0
--- /dev/null
+++ b/bytecode/UnlinkedModuleProgramCodeBlock.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "UnlinkedModuleProgramCodeBlock.h"
+
+#include "HeapInlines.h"
+#include "JSCellInlines.h"
+
+namespace JSC {
+
+const ClassInfo UnlinkedModuleProgramCodeBlock::s_info = { "UnlinkedModuleProgramCodeBlock", &Base::s_info, nullptr, CREATE_METHOD_TABLE(UnlinkedModuleProgramCodeBlock) };
+
+void UnlinkedModuleProgramCodeBlock::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    UnlinkedModuleProgramCodeBlock* thisObject = jsCast<UnlinkedModuleProgramCodeBlock*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+}
+
+void UnlinkedModuleProgramCodeBlock::destroy(JSCell* cell)
+{
+    static_cast<UnlinkedModuleProgramCodeBlock*>(cell)->~UnlinkedModuleProgramCodeBlock();
+}
+
+}
diff --git a/bytecode/UnlinkedModuleProgramCodeBlock.h b/bytecode/UnlinkedModuleProgramCodeBlock.h
new file mode 100644
index 0000000..8676a24
--- /dev/null
+++ b/bytecode/UnlinkedModuleProgramCodeBlock.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "UnlinkedGlobalCodeBlock.h"
+
+namespace JSC {
+
+class UnlinkedModuleProgramCodeBlock final : public UnlinkedGlobalCodeBlock {
+public:
+    typedef UnlinkedGlobalCodeBlock Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static UnlinkedModuleProgramCodeBlock* create(VM* vm, const ExecutableInfo& info, DebuggerMode debuggerMode)
+    {
+        UnlinkedModuleProgramCodeBlock* instance = new (NotNull, allocateCell<UnlinkedModuleProgramCodeBlock>(vm->heap)) UnlinkedModuleProgramCodeBlock(vm, vm->unlinkedModuleProgramCodeBlockStructure.get(), info, debuggerMode);
+        instance->finishCreation(*vm);
+        return instance;
+    }
+
+    static void destroy(JSCell*);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    // This offset represents the constant register offset to the stored symbol table that represents the layout of the
+    // module environment. This symbol table is created by the byte code generator since the module environment includes
+    // the top-most lexical captured variables inside the module code. This means that, once the module environment is
+    // allocated and instantiated from this symbol table, it is titely coupled with the specific unlinked module program
+    // code block and the stored symbol table. So before executing the module code, we should not clear the unlinked module
+    // program code block in the module executable. This requirement is met because the garbage collector only clears
+    // unlinked code in (1) unmarked executables and (2) function executables.
+    //
+    // Since the function code may be executed repeatedly and the environment of each function execution is different,
+    // the function code need to allocate and instantiate the environment in the prologue of the function code. On the
+    // other hand, the module code is executed only once. So we can instantiate the module environment outside the module
+    // code. At that time, we construct the module environment by using the symbol table that is held by the module executable.
+    // The symbol table held by the executable is the cloned one from one in the unlinked code block. Instantiating the module
+    // environment before executing and linking the module code is required to link the imported bindings between the modules.
+    //
+    // The unlinked module program code block only holds the pre-cloned symbol table in its constant register pool. It does
+    // not hold the instantiated module environment. So while the module environment requires the specific unlinked module
+    // program code block, the unlinked module code block can be used for the module environment instantiated from this
+    // unlinked code block. There is 1:N relation between the unlinked module code block and the module environments. So the
+    // unlinked module program code block can be cached.
+    //
+    // On the other hand, the linked code block for the module environment includes the resolved references to the imported
+    // bindings. The imported binding references the other module environment, so the linked code block is titly coupled
+    // with the specific set of the module environments. Thus, the linked code block should not be cached.
+    int moduleEnvironmentSymbolTableConstantRegisterOffset() { return m_moduleEnvironmentSymbolTableConstantRegisterOffset; }
+    void setModuleEnvironmentSymbolTableConstantRegisterOffset(int offset)
+    {
+        m_moduleEnvironmentSymbolTableConstantRegisterOffset = offset;
+    }
+
+private:
+    UnlinkedModuleProgramCodeBlock(VM* vm, Structure* structure, const ExecutableInfo& info, DebuggerMode debuggerMode)
+        : Base(vm, structure, ModuleCode, info, debuggerMode)
+    {
+    }
+
+    int m_moduleEnvironmentSymbolTableConstantRegisterOffset { 0 };
+
+public:
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(UnlinkedModuleProgramCodeBlockType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+};
+
+}
diff --git a/bytecode/UnlinkedProgramCodeBlock.cpp b/bytecode/UnlinkedProgramCodeBlock.cpp
new file mode 100644
index 0000000..95df299
--- /dev/null
+++ b/bytecode/UnlinkedProgramCodeBlock.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "UnlinkedProgramCodeBlock.h"
+
+#include "HeapInlines.h"
+#include "JSCellInlines.h"
+
+namespace JSC {
+
+const ClassInfo UnlinkedProgramCodeBlock::s_info = { "UnlinkedProgramCodeBlock", &Base::s_info, 0, CREATE_METHOD_TABLE(UnlinkedProgramCodeBlock) };
+
+void UnlinkedProgramCodeBlock::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    UnlinkedProgramCodeBlock* thisObject = jsCast<UnlinkedProgramCodeBlock*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+}
+
+void UnlinkedProgramCodeBlock::destroy(JSCell* cell)
+{
+    static_cast<UnlinkedProgramCodeBlock*>(cell)->~UnlinkedProgramCodeBlock();
+}
+
+}
diff --git a/bytecode/UnlinkedProgramCodeBlock.h b/bytecode/UnlinkedProgramCodeBlock.h
new file mode 100644
index 0000000..290eae4
--- /dev/null
+++ b/bytecode/UnlinkedProgramCodeBlock.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "UnlinkedGlobalCodeBlock.h"
+
+namespace JSC {
+
+class UnlinkedProgramCodeBlock final : public UnlinkedGlobalCodeBlock {
+public:
+    typedef UnlinkedGlobalCodeBlock Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static UnlinkedProgramCodeBlock* create(VM* vm, const ExecutableInfo& info, DebuggerMode debuggerMode)
+    {
+        UnlinkedProgramCodeBlock* instance = new (NotNull, allocateCell<UnlinkedProgramCodeBlock>(vm->heap)) UnlinkedProgramCodeBlock(vm, vm->unlinkedProgramCodeBlockStructure.get(), info, debuggerMode);
+        instance->finishCreation(*vm);
+        return instance;
+    }
+
+    static void destroy(JSCell*);
+
+    void setVariableDeclarations(const VariableEnvironment& environment) { m_varDeclarations = environment; }
+    const VariableEnvironment& variableDeclarations() const { return m_varDeclarations; }
+
+    void setLexicalDeclarations(const VariableEnvironment& environment) { m_lexicalDeclarations = environment; }
+    const VariableEnvironment& lexicalDeclarations() const { return m_lexicalDeclarations; }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    UnlinkedProgramCodeBlock(VM* vm, Structure* structure, const ExecutableInfo& info, DebuggerMode debuggerMode)
+        : Base(vm, structure, GlobalCode, info, debuggerMode)
+    {
+    }
+
+    VariableEnvironment m_varDeclarations;
+    VariableEnvironment m_lexicalDeclarations;
+
+public:
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(UnlinkedProgramCodeBlockType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+};
+
+}
diff --git a/bytecode/ValueProfile.h b/bytecode/ValueProfile.h
new file mode 100644
index 0000000..8724eb4
--- /dev/null
+++ b/bytecode/ValueProfile.h
@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2011-2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "Heap.h"
+#include "JSArray.h"
+#include "SpeculatedType.h"
+#include "Structure.h"
+#include "TagRegistersMode.h"
+#include "WriteBarrier.h"
+#include <wtf/PrintStream.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+template<unsigned numberOfBucketsArgument>
+struct ValueProfileBase {
+    static const unsigned numberOfBuckets = numberOfBucketsArgument;
+    static const unsigned numberOfSpecFailBuckets = 1;
+    static const unsigned bucketIndexMask = numberOfBuckets - 1;
+    static const unsigned totalNumberOfBuckets = numberOfBuckets + numberOfSpecFailBuckets;
+    
+    ValueProfileBase()
+        : m_bytecodeOffset(-1)
+        , m_prediction(SpecNone)
+        , m_numberOfSamplesInPrediction(0)
+    {
+        for (unsigned i = 0; i < totalNumberOfBuckets; ++i)
+            m_buckets[i] = JSValue::encode(JSValue());
+    }
+    
+    ValueProfileBase(int bytecodeOffset)
+        : m_bytecodeOffset(bytecodeOffset)
+        , m_prediction(SpecNone)
+        , m_numberOfSamplesInPrediction(0)
+    {
+        for (unsigned i = 0; i < totalNumberOfBuckets; ++i)
+            m_buckets[i] = JSValue::encode(JSValue());
+    }
+    
+    EncodedJSValue* specFailBucket(unsigned i)
+    {
+        ASSERT(numberOfBuckets + i < totalNumberOfBuckets);
+        return m_buckets + numberOfBuckets + i;
+    }
+    
+    const ClassInfo* classInfo(unsigned bucket) const
+    {
+        JSValue value = JSValue::decode(m_buckets[bucket]);
+        if (!!value) {
+            if (!value.isCell())
+                return 0;
+            return value.asCell()->structure()->classInfo();
+        }
+        return 0;
+    }
+    
+    unsigned numberOfSamples() const
+    {
+        unsigned result = 0;
+        for (unsigned i = 0; i < totalNumberOfBuckets; ++i) {
+            if (!!JSValue::decode(m_buckets[i]))
+                result++;
+        }
+        return result;
+    }
+    
+    unsigned totalNumberOfSamples() const
+    {
+        return numberOfSamples() + m_numberOfSamplesInPrediction;
+    }
+    
+    bool isLive() const
+    {
+        for (unsigned i = 0; i < totalNumberOfBuckets; ++i) {
+            if (!!JSValue::decode(m_buckets[i]))
+                return true;
+        }
+        return false;
+    }
+    
+    CString briefDescription(const ConcurrentJSLocker& locker)
+    {
+        computeUpdatedPrediction(locker);
+        
+        StringPrintStream out;
+        out.print("predicting ", SpeculationDump(m_prediction));
+        return out.toCString();
+    }
+    
+    void dump(PrintStream& out)
+    {
+        out.print("samples = ", totalNumberOfSamples(), " prediction = ", SpeculationDump(m_prediction));
+        bool first = true;
+        for (unsigned i = 0; i < totalNumberOfBuckets; ++i) {
+            JSValue value = JSValue::decode(m_buckets[i]);
+            if (!!value) {
+                if (first) {
+                    out.printf(": ");
+                    first = false;
+                } else
+                    out.printf(", ");
+                out.print(value);
+            }
+        }
+    }
+    
+    // Updates the prediction and returns the new one. Never call this from any thread
+    // that isn't executing the code.
+    SpeculatedType computeUpdatedPrediction(const ConcurrentJSLocker&)
+    {
+        for (unsigned i = 0; i < totalNumberOfBuckets; ++i) {
+            JSValue value = JSValue::decode(m_buckets[i]);
+            if (!value)
+                continue;
+            
+            m_numberOfSamplesInPrediction++;
+            mergeSpeculation(m_prediction, speculationFromValue(value));
+            
+            m_buckets[i] = JSValue::encode(JSValue());
+        }
+        
+        return m_prediction;
+    }
+    
+    int m_bytecodeOffset; // -1 for prologue
+    
+    SpeculatedType m_prediction;
+    unsigned m_numberOfSamplesInPrediction;
+    
+    EncodedJSValue m_buckets[totalNumberOfBuckets];
+};
+
+struct MinimalValueProfile : public ValueProfileBase<0> {
+    MinimalValueProfile(): ValueProfileBase<0>() { }
+    MinimalValueProfile(int bytecodeOffset): ValueProfileBase<0>(bytecodeOffset) { }
+};
+
+template<unsigned logNumberOfBucketsArgument>
+struct ValueProfileWithLogNumberOfBuckets : public ValueProfileBase<1 << logNumberOfBucketsArgument> {
+    static const unsigned logNumberOfBuckets = logNumberOfBucketsArgument;
+    
+    ValueProfileWithLogNumberOfBuckets()
+        : ValueProfileBase<1 << logNumberOfBucketsArgument>()
+    {
+    }
+    ValueProfileWithLogNumberOfBuckets(int bytecodeOffset)
+        : ValueProfileBase<1 << logNumberOfBucketsArgument>(bytecodeOffset)
+    {
+    }
+};
+
+struct ValueProfile : public ValueProfileWithLogNumberOfBuckets<0> {
+    ValueProfile(): ValueProfileWithLogNumberOfBuckets<0>() { }
+    ValueProfile(int bytecodeOffset): ValueProfileWithLogNumberOfBuckets<0>(bytecodeOffset) { }
+};
+
+template<typename T>
+inline int getValueProfileBytecodeOffset(T* valueProfile)
+{
+    return valueProfile->m_bytecodeOffset;
+}
+
+// This is a mini value profile to catch pathologies. It is a counter that gets
+// incremented when we take the slow path on any instruction.
+struct RareCaseProfile {
+    RareCaseProfile(int bytecodeOffset)
+        : m_bytecodeOffset(bytecodeOffset)
+        , m_counter(0)
+    {
+    }
+    
+    int m_bytecodeOffset;
+    uint32_t m_counter;
+};
+
+inline int getRareCaseProfileBytecodeOffset(RareCaseProfile* rareCaseProfile)
+{
+    return rareCaseProfile->m_bytecodeOffset;
+}
+
+} // namespace JSC
diff --git a/bytecode/ValueRecovery.cpp b/bytecode/ValueRecovery.cpp
new file mode 100644
index 0000000..9c083b0
--- /dev/null
+++ b/bytecode/ValueRecovery.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2011, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ValueRecovery.h"
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+JSValue ValueRecovery::recover(ExecState* exec) const
+{
+    switch (technique()) {
+    case DisplacedInJSStack:
+        return exec->r(virtualRegister().offset()).jsValue();
+    case Int32DisplacedInJSStack:
+        return jsNumber(exec->r(virtualRegister().offset()).unboxedInt32());
+    case Int52DisplacedInJSStack:
+        return jsNumber(exec->r(virtualRegister().offset()).unboxedInt52());
+    case StrictInt52DisplacedInJSStack:
+        return jsNumber(exec->r(virtualRegister().offset()).unboxedStrictInt52());
+    case DoubleDisplacedInJSStack:
+        return jsNumber(exec->r(virtualRegister().offset()).unboxedDouble());
+    case CellDisplacedInJSStack:
+        return exec->r(virtualRegister().offset()).unboxedCell();
+    case BooleanDisplacedInJSStack:
+#if USE(JSVALUE64)
+        return exec->r(virtualRegister().offset()).jsValue();
+#else
+        return jsBoolean(exec->r(virtualRegister().offset()).unboxedBoolean());
+#endif
+    case Constant:
+        return constant();
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return JSValue();
+    }
+}
+
+#if ENABLE(JIT)
+
+void ValueRecovery::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    switch (technique()) {
+    case InGPR:
+        out.print(gpr());
+        return;
+    case UnboxedInt32InGPR:
+        out.print("int32(", gpr(), ")");
+        return;
+    case UnboxedInt52InGPR:
+        out.print("int52(", gpr(), ")");
+        return;
+    case UnboxedStrictInt52InGPR:
+        out.print("strictInt52(", gpr(), ")");
+        return;
+    case UnboxedBooleanInGPR:
+        out.print("bool(", gpr(), ")");
+        return;
+    case UnboxedCellInGPR:
+        out.print("cell(", gpr(), ")");
+        return;
+    case InFPR:
+        out.print(fpr());
+        return;
+    case UnboxedDoubleInFPR:
+        out.print("double(", fpr(), ")");
+        return;
+#if USE(JSVALUE32_64)
+    case InPair:
+        out.print("pair(", tagGPR(), ", ", payloadGPR(), ")");
+        return;
+#endif
+    case DisplacedInJSStack:
+        out.print("*", virtualRegister());
+        return;
+    case Int32DisplacedInJSStack:
+        out.print("*int32(", virtualRegister(), ")");
+        return;
+    case Int52DisplacedInJSStack:
+        out.print("*int52(", virtualRegister(), ")");
+        return;
+    case StrictInt52DisplacedInJSStack:
+        out.print("*strictInt52(", virtualRegister(), ")");
+        return;
+    case DoubleDisplacedInJSStack:
+        out.print("*double(", virtualRegister(), ")");
+        return;
+    case CellDisplacedInJSStack:
+        out.print("*cell(", virtualRegister(), ")");
+        return;
+    case BooleanDisplacedInJSStack:
+        out.print("*bool(", virtualRegister(), ")");
+        return;
+    case DirectArgumentsThatWereNotCreated:
+        out.print("DirectArguments(", nodeID(), ")");
+        return;
+    case ClonedArgumentsThatWereNotCreated:
+        out.print("ClonedArguments(", nodeID(), ")");
+        return;
+    case Constant:
+        out.print("[", inContext(constant(), context), "]");
+        return;
+    case DontKnow:
+        out.printf("!");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ValueRecovery::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+#endif // ENABLE(JIT)
+
+} // namespace JSC
+
diff --git a/bytecode/ValueRecovery.h b/bytecode/ValueRecovery.h
new file mode 100644
index 0000000..c98fd20
--- /dev/null
+++ b/bytecode/ValueRecovery.h
@@ -0,0 +1,426 @@
+/*
+ * Copyright (C) 2011, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGMinifiedID.h"
+#include "DataFormat.h"
+#if ENABLE(JIT)
+#include "GPRInfo.h"
+#include "FPRInfo.h"
+#include "Reg.h"
+#endif
+#include "JSCJSValue.h"
+#include "MacroAssembler.h"
+#include "VirtualRegister.h"
+
+namespace JSC {
+
+struct DumpContext;
+struct InlineCallFrame;
+
+// Describes how to recover a given bytecode virtual register at a given
+// code point.
+enum ValueRecoveryTechnique {
+    // It's in a register.
+    InGPR,
+    UnboxedInt32InGPR,
+    UnboxedInt52InGPR,
+    UnboxedStrictInt52InGPR,
+    UnboxedBooleanInGPR,
+    UnboxedCellInGPR,
+#if USE(JSVALUE32_64)
+    InPair,
+#endif
+    InFPR,
+    UnboxedDoubleInFPR,
+    // It's in the stack, but at a different location.
+    DisplacedInJSStack,
+    // It's in the stack, at a different location, and it's unboxed.
+    Int32DisplacedInJSStack,
+    Int52DisplacedInJSStack,
+    StrictInt52DisplacedInJSStack,
+    DoubleDisplacedInJSStack,
+    CellDisplacedInJSStack,
+    BooleanDisplacedInJSStack,
+    // It's an Arguments object. This arises because of the simplified arguments simplification done by the DFG.
+    DirectArgumentsThatWereNotCreated,
+    ClonedArgumentsThatWereNotCreated,
+    // It's a constant.
+    Constant,
+    // Don't know how to recover it.
+    DontKnow
+};
+
+class ValueRecovery {
+public:
+    ValueRecovery()
+        : m_technique(DontKnow)
+    {
+    }
+    
+    bool isSet() const { return m_technique != DontKnow; }
+    bool operator!() const { return !isSet(); }
+
+#if ENABLE(JIT)
+    static ValueRecovery inRegister(Reg reg, DataFormat dataFormat)
+    {
+        if (reg.isGPR())
+            return inGPR(reg.gpr(), dataFormat);
+
+        ASSERT(reg.isFPR());
+        return inFPR(reg.fpr(), dataFormat);
+    }
+#endif
+
+    explicit operator bool() const { return isSet(); }
+    
+    static ValueRecovery inGPR(MacroAssembler::RegisterID gpr, DataFormat dataFormat)
+    {
+        ASSERT(dataFormat != DataFormatNone);
+#if USE(JSVALUE32_64)
+        ASSERT(dataFormat == DataFormatInt32 || dataFormat == DataFormatCell || dataFormat == DataFormatBoolean);
+#endif
+        ValueRecovery result;
+        if (dataFormat == DataFormatInt32)
+            result.m_technique = UnboxedInt32InGPR;
+        else if (dataFormat == DataFormatInt52)
+            result.m_technique = UnboxedInt52InGPR;
+        else if (dataFormat == DataFormatStrictInt52)
+            result.m_technique = UnboxedStrictInt52InGPR;
+        else if (dataFormat == DataFormatBoolean)
+            result.m_technique = UnboxedBooleanInGPR;
+        else if (dataFormat == DataFormatCell)
+            result.m_technique = UnboxedCellInGPR;
+        else
+            result.m_technique = InGPR;
+        result.m_source.gpr = gpr;
+        return result;
+    }
+    
+#if USE(JSVALUE32_64)
+    static ValueRecovery inPair(MacroAssembler::RegisterID tagGPR, MacroAssembler::RegisterID payloadGPR)
+    {
+        ValueRecovery result;
+        result.m_technique = InPair;
+        result.m_source.pair.tagGPR = tagGPR;
+        result.m_source.pair.payloadGPR = payloadGPR;
+        return result;
+    }
+#endif
+
+    static ValueRecovery inFPR(MacroAssembler::FPRegisterID fpr, DataFormat dataFormat)
+    {
+        ASSERT(dataFormat == DataFormatDouble || dataFormat & DataFormatJS);
+        ValueRecovery result;
+        if (dataFormat == DataFormatDouble)
+            result.m_technique = UnboxedDoubleInFPR;
+        else
+            result.m_technique = InFPR;
+        result.m_source.fpr = fpr;
+        return result;
+    }
+    
+    static ValueRecovery displacedInJSStack(VirtualRegister virtualReg, DataFormat dataFormat)
+    {
+        ValueRecovery result;
+        switch (dataFormat) {
+        case DataFormatInt32:
+            result.m_technique = Int32DisplacedInJSStack;
+            break;
+            
+        case DataFormatInt52:
+            result.m_technique = Int52DisplacedInJSStack;
+            break;
+            
+        case DataFormatStrictInt52:
+            result.m_technique = StrictInt52DisplacedInJSStack;
+            break;
+            
+        case DataFormatDouble:
+            result.m_technique = DoubleDisplacedInJSStack;
+            break;
+
+        case DataFormatCell:
+            result.m_technique = CellDisplacedInJSStack;
+            break;
+            
+        case DataFormatBoolean:
+            result.m_technique = BooleanDisplacedInJSStack;
+            break;
+            
+        default:
+            ASSERT(dataFormat != DataFormatNone && dataFormat != DataFormatStorage);
+            result.m_technique = DisplacedInJSStack;
+            break;
+        }
+        result.m_source.virtualReg = virtualReg.offset();
+        return result;
+    }
+    
+    static ValueRecovery constant(JSValue value)
+    {
+        ValueRecovery result;
+        result.m_technique = Constant;
+        result.m_source.constant = JSValue::encode(value);
+        return result;
+    }
+    
+    static ValueRecovery directArgumentsThatWereNotCreated(DFG::MinifiedID id)
+    {
+        ValueRecovery result;
+        result.m_technique = DirectArgumentsThatWereNotCreated;
+        result.m_source.nodeID = id.bits();
+        return result;
+    }
+    
+    static ValueRecovery clonedArgumentsThatWereNotCreated(DFG::MinifiedID id)
+    {
+        ValueRecovery result;
+        result.m_technique = ClonedArgumentsThatWereNotCreated;
+        result.m_source.nodeID = id.bits();
+        return result;
+    }
+
+    ValueRecoveryTechnique technique() const { return m_technique; }
+    
+    bool isConstant() const { return m_technique == Constant; }
+
+    bool isInGPR() const
+    {
+        switch (m_technique) {
+        case InGPR:
+        case UnboxedInt32InGPR:
+        case UnboxedBooleanInGPR:
+        case UnboxedCellInGPR:
+        case UnboxedInt52InGPR:
+        case UnboxedStrictInt52InGPR:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isInFPR() const
+    {
+        switch (m_technique) {
+        case InFPR:
+        case UnboxedDoubleInFPR:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isInRegisters() const
+    {
+        return isInJSValueRegs() || isInGPR() || isInFPR();
+    }
+
+    bool isInJSStack() const
+    {
+        switch (m_technique) {
+        case DisplacedInJSStack:
+        case Int32DisplacedInJSStack:
+        case Int52DisplacedInJSStack:
+        case StrictInt52DisplacedInJSStack:
+        case DoubleDisplacedInJSStack:
+        case CellDisplacedInJSStack:
+        case BooleanDisplacedInJSStack:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    DataFormat dataFormat() const
+    {
+        switch (m_technique) {
+        case InGPR:
+        case InFPR:
+        case DisplacedInJSStack:
+        case Constant:
+#if USE(JSVALUE32_64)
+        case InPair:
+#endif
+            return DataFormatJS;
+        case UnboxedInt32InGPR:
+        case Int32DisplacedInJSStack:
+            return DataFormatInt32;
+        case UnboxedInt52InGPR:
+        case Int52DisplacedInJSStack:
+            return DataFormatInt52;
+        case UnboxedStrictInt52InGPR:
+        case StrictInt52DisplacedInJSStack:
+            return DataFormatStrictInt52;
+        case UnboxedBooleanInGPR:
+        case BooleanDisplacedInJSStack:
+            return DataFormatBoolean;
+        case UnboxedCellInGPR:
+        case CellDisplacedInJSStack:
+            return DataFormatCell;
+        case UnboxedDoubleInFPR:
+        case DoubleDisplacedInJSStack:
+            return DataFormatDouble;
+        default:
+            return DataFormatNone;
+        }
+    }
+    
+    MacroAssembler::RegisterID gpr() const
+    {
+        ASSERT(isInGPR());
+        return m_source.gpr;
+    }
+    
+#if USE(JSVALUE32_64)
+    MacroAssembler::RegisterID tagGPR() const
+    {
+        ASSERT(m_technique == InPair);
+        return m_source.pair.tagGPR;
+    }
+    
+    MacroAssembler::RegisterID payloadGPR() const
+    {
+        ASSERT(m_technique == InPair);
+        return m_source.pair.payloadGPR;
+    }
+
+    bool isInJSValueRegs() const
+    {
+        return m_technique == InPair;
+    }
+
+#if ENABLE(JIT)
+    JSValueRegs jsValueRegs() const
+    {
+        ASSERT(isInJSValueRegs());
+        return JSValueRegs(tagGPR(), payloadGPR());
+    }
+#endif // ENABLE(JIT)
+#else
+    bool isInJSValueRegs() const
+    {
+        return isInGPR();
+    }
+#endif // USE(JSVALUE32_64)
+    
+    MacroAssembler::FPRegisterID fpr() const
+    {
+        ASSERT(isInFPR());
+        return m_source.fpr;
+    }
+    
+    VirtualRegister virtualRegister() const
+    {
+        ASSERT(isInJSStack());
+        return VirtualRegister(m_source.virtualReg);
+    }
+    
+    ValueRecovery withLocalsOffset(int offset) const
+    {
+        switch (m_technique) {
+        case DisplacedInJSStack:
+        case Int32DisplacedInJSStack:
+        case DoubleDisplacedInJSStack:
+        case CellDisplacedInJSStack:
+        case BooleanDisplacedInJSStack:
+        case Int52DisplacedInJSStack:
+        case StrictInt52DisplacedInJSStack: {
+            ValueRecovery result;
+            result.m_technique = m_technique;
+            result.m_source.virtualReg = m_source.virtualReg + offset;
+            return result;
+        }
+            
+        default:
+            return *this;
+        }
+    }
+    
+    JSValue constant() const
+    {
+        ASSERT(isConstant());
+        return JSValue::decode(m_source.constant);
+    }
+    
+    DFG::MinifiedID nodeID() const
+    {
+        ASSERT(m_technique == DirectArgumentsThatWereNotCreated || m_technique == ClonedArgumentsThatWereNotCreated);
+        return DFG::MinifiedID::fromBits(m_source.nodeID);
+    }
+    
+    JSValue recover(ExecState*) const;
+    
+#if ENABLE(JIT)
+    template<typename Func>
+    void forEachReg(const Func& func)
+    {
+        switch (m_technique) {
+        case InGPR:
+        case UnboxedInt32InGPR:
+        case UnboxedBooleanInGPR:
+        case UnboxedCellInGPR:
+        case UnboxedInt52InGPR:
+        case UnboxedStrictInt52InGPR:
+            func(gpr());
+            return;
+        case InFPR:
+        case UnboxedDoubleInFPR:
+            func(fpr());
+            return;
+#if USE(JSVALUE32_64)
+        case InPair:
+            func(jsValueRegs().payloadGPR());
+            func(jsValueRegs().tagGPR());
+            return;
+#endif
+        default:
+            return;
+        }
+    }
+    
+    void dumpInContext(PrintStream& out, DumpContext* context) const;
+    void dump(PrintStream& out) const;
+#endif
+
+private:
+    ValueRecoveryTechnique m_technique;
+    union {
+        MacroAssembler::RegisterID gpr;
+        MacroAssembler::FPRegisterID fpr;
+#if USE(JSVALUE32_64)
+        struct {
+            MacroAssembler::RegisterID tagGPR;
+            MacroAssembler::RegisterID payloadGPR;
+        } pair;
+#endif
+        int virtualReg;
+        EncodedJSValue constant;
+        uintptr_t nodeID;
+    } m_source;
+};
+
+} // namespace JSC
diff --git a/bytecode/VariableWriteFireDetail.cpp b/bytecode/VariableWriteFireDetail.cpp
new file mode 100644
index 0000000..ec61984
--- /dev/null
+++ b/bytecode/VariableWriteFireDetail.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "VariableWriteFireDetail.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+void VariableWriteFireDetail::dump(PrintStream& out) const
+{
+    out.print("Write to ", m_name, " in ", JSValue(m_object));
+}
+
+void VariableWriteFireDetail::touch(VM& vm, WatchpointSet* set, JSObject* object, const PropertyName& name)
+{
+    set->touch(vm, VariableWriteFireDetail(object, name));
+}
+
+} // namespace JSC
+
diff --git a/bytecode/VariableWriteFireDetail.h b/bytecode/VariableWriteFireDetail.h
new file mode 100644
index 0000000..42ffb1b
--- /dev/null
+++ b/bytecode/VariableWriteFireDetail.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Watchpoint.h"
+
+namespace JSC {
+
+class JSObject;
+class PropertyName;
+
+class VariableWriteFireDetail : public FireDetail {
+public:
+    VariableWriteFireDetail(JSObject* object, const PropertyName& name)
+        : m_object(object)
+        , m_name(name)
+    {
+    }
+    
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const override;
+    
+    JS_EXPORT_PRIVATE static void touch(VM&, WatchpointSet*, JSObject*, const PropertyName&);
+
+private:
+    JSObject* m_object;
+    const PropertyName& m_name;
+};
+
+} // namespace JSC
diff --git a/bytecode/VirtualRegister.cpp b/bytecode/VirtualRegister.cpp
new file mode 100644
index 0000000..57cdb62
--- /dev/null
+++ b/bytecode/VirtualRegister.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "VirtualRegister.h"
+
+namespace JSC {
+
+void VirtualRegister::dump(PrintStream& out) const
+{
+    if (!isValid()) {
+        out.print("<invalid>");
+        return;
+    }
+    
+    if (isHeader()) {
+        out.print("head", m_virtualRegister);
+        return;
+    }
+    
+    if (isConstant()) {
+        out.print("const", toConstantIndex());
+        return;
+    }
+    
+    if (isArgument()) {
+        if (!toArgument())
+            out.print("this");
+        else
+            out.print("arg", toArgument());
+        return;
+    }
+    
+    if (isLocal()) {
+        out.print("loc", toLocal());
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace JSC
+
diff --git a/bytecode/VirtualRegister.h b/bytecode/VirtualRegister.h
new file mode 100644
index 0000000..f32e8d2
--- /dev/null
+++ b/bytecode/VirtualRegister.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2011, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "BytecodeConventions.h"
+#include "CallFrame.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+inline bool operandIsLocal(int operand)
+{
+    return operand < 0;
+}
+
+inline bool operandIsArgument(int operand)
+{
+    return operand >= 0;
+}
+
+
+class VirtualRegister {
+public:
+    friend VirtualRegister virtualRegisterForLocal(int);
+    friend VirtualRegister virtualRegisterForArgument(int, int);
+
+    VirtualRegister()
+        : m_virtualRegister(s_invalidVirtualRegister)
+    { }
+
+    explicit VirtualRegister(int virtualRegister)
+        : m_virtualRegister(virtualRegister)
+    { }
+
+    bool isValid() const { return (m_virtualRegister != s_invalidVirtualRegister); }
+    bool isLocal() const { return operandIsLocal(m_virtualRegister); }
+    bool isArgument() const { return operandIsArgument(m_virtualRegister); }
+    bool isHeader() const { return m_virtualRegister >= 0 && m_virtualRegister < CallFrameSlot::thisArgument; }
+    bool isConstant() const { return m_virtualRegister >= s_firstConstantRegisterIndex; }
+    int toLocal() const { ASSERT(isLocal()); return operandToLocal(m_virtualRegister); }
+    int toArgument() const { ASSERT(isArgument()); return operandToArgument(m_virtualRegister); }
+    int toConstantIndex() const { ASSERT(isConstant()); return m_virtualRegister - s_firstConstantRegisterIndex; }
+    int offset() const { return m_virtualRegister; }
+    int offsetInBytes() const { return m_virtualRegister * sizeof(Register); }
+
+    bool operator==(VirtualRegister other) const { return m_virtualRegister == other.m_virtualRegister; }
+    bool operator!=(VirtualRegister other) const { return m_virtualRegister != other.m_virtualRegister; }
+    bool operator<(VirtualRegister other) const { return m_virtualRegister < other.m_virtualRegister; }
+    bool operator>(VirtualRegister other) const { return m_virtualRegister > other.m_virtualRegister; }
+    bool operator<=(VirtualRegister other) const { return m_virtualRegister <= other.m_virtualRegister; }
+    bool operator>=(VirtualRegister other) const { return m_virtualRegister >= other.m_virtualRegister; }
+    
+    VirtualRegister operator+(int value) const
+    {
+        return VirtualRegister(offset() + value);
+    }
+    VirtualRegister operator-(int value) const
+    {
+        return VirtualRegister(offset() - value);
+    }
+    VirtualRegister operator+(VirtualRegister value) const
+    {
+        return VirtualRegister(offset() + value.offset());
+    }
+    VirtualRegister operator-(VirtualRegister value) const
+    {
+        return VirtualRegister(offset() - value.offset());
+    }
+    VirtualRegister& operator+=(int value)
+    {
+        return *this = *this + value;
+    }
+    VirtualRegister& operator-=(int value)
+    {
+        return *this = *this - value;
+    }
+    
+    void dump(PrintStream& out) const;
+
+private:
+    static const int s_invalidVirtualRegister = 0x3fffffff;
+    static const int s_firstConstantRegisterIndex = FirstConstantRegisterIndex;
+
+    static int localToOperand(int local) { return -1 - local; }
+    static int operandToLocal(int operand) { return -1 - operand; }
+    static int operandToArgument(int operand) { return operand - CallFrame::thisArgumentOffset(); }
+    static int argumentToOperand(int argument) { return argument + CallFrame::thisArgumentOffset(); }
+
+    int m_virtualRegister;
+};
+
+COMPILE_ASSERT(sizeof(VirtualRegister) == sizeof(int), VirtualRegister_is_32bit);
+
+inline VirtualRegister virtualRegisterForLocal(int local)
+{
+    return VirtualRegister(VirtualRegister::localToOperand(local));
+}
+
+inline VirtualRegister virtualRegisterForArgument(int argument, int offset = 0)
+{
+    return VirtualRegister(VirtualRegister::argumentToOperand(argument) + offset);
+}
+
+} // namespace JSC
diff --git a/bytecode/Watchpoint.cpp b/bytecode/Watchpoint.cpp
new file mode 100644
index 0000000..fbe952d
--- /dev/null
+++ b/bytecode/Watchpoint.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Watchpoint.h"
+
+#include "HeapInlines.h"
+#include "VM.h"
+#include <wtf/CompilationThread.h>
+
+namespace JSC {
+
+void StringFireDetail::dump(PrintStream& out) const
+{
+    out.print(m_string);
+}
+
+Watchpoint::~Watchpoint()
+{
+    if (isOnList()) {
+        // This will happen if we get destroyed before the set fires. That's totally a valid
+        // possibility. For example:
+        //
+        // CodeBlock has a Watchpoint on transition from structure S1. The transition never
+        // happens, but the CodeBlock gets destroyed because of GC.
+        remove();
+    }
+}
+
+void Watchpoint::fire(const FireDetail& detail)
+{
+    RELEASE_ASSERT(!isOnList());
+    fireInternal(detail);
+}
+
+WatchpointSet::WatchpointSet(WatchpointState state)
+    : m_state(state)
+    , m_setIsNotEmpty(false)
+{
+}
+
+WatchpointSet::~WatchpointSet()
+{
+    // Remove all watchpoints, so that they don't try to remove themselves. Note that we
+    // don't fire watchpoints on deletion. We assume that any code that is interested in
+    // watchpoints already also separately has a mechanism to make sure that the code is
+    // either keeping the watchpoint set's owner alive, or does some weak reference thing.
+    while (!m_set.isEmpty())
+        m_set.begin()->remove();
+}
+
+void WatchpointSet::add(Watchpoint* watchpoint)
+{
+    ASSERT(!isCompilationThread());
+    ASSERT(state() != IsInvalidated);
+    if (!watchpoint)
+        return;
+    m_set.push(watchpoint);
+    m_setIsNotEmpty = true;
+    m_state = IsWatched;
+}
+
+void WatchpointSet::fireAllSlow(VM& vm, const FireDetail& detail)
+{
+    ASSERT(state() == IsWatched);
+    
+    WTF::storeStoreFence();
+    m_state = IsInvalidated; // Do this first. Needed for adaptive watchpoints.
+    fireAllWatchpoints(vm, detail);
+    WTF::storeStoreFence();
+}
+
+void WatchpointSet::fireAllSlow(VM& vm, const char* reason)
+{
+    fireAllSlow(vm, StringFireDetail(reason));
+}
+
+void WatchpointSet::fireAllWatchpoints(VM& vm, const FireDetail& detail)
+{
+    // In case there are any adaptive watchpoints, we need to make sure that they see that this
+    // watchpoint has been already invalidated.
+    RELEASE_ASSERT(hasBeenInvalidated());
+
+    // Firing a watchpoint may cause a GC to happen. This GC could destroy various
+    // Watchpoints themselves while they're in the process of firing. It's not safe
+    // for most Watchpoints to be destructed while they're in the middle of firing.
+    // This GC could also destroy us, and we're not in a safe state to be destroyed.
+    // The safest thing to do is to DeferGCForAWhile to prevent this GC from happening.
+    DeferGCForAWhile deferGC(vm.heap);
+    
+    while (!m_set.isEmpty()) {
+        Watchpoint* watchpoint = m_set.begin();
+        ASSERT(watchpoint->isOnList());
+        
+        // Removing the Watchpoint before firing it makes it possible to implement watchpoints
+        // that add themselves to a different set when they fire. This kind of "adaptive"
+        // watchpoint can be used to track some semantic property that is more fine-graiend than
+        // what the set can convey. For example, we might care if a singleton object ever has a
+        // property called "foo". We can watch for this by checking if its Structure has "foo" and
+        // then watching its transitions. But then the watchpoint fires if any property is added.
+        // So, before the watchpoint decides to invalidate any code, it can check if it is
+        // possible to add itself to the transition watchpoint set of the singleton object's new
+        // Structure.
+        watchpoint->remove();
+        ASSERT(m_set.begin() != watchpoint);
+        ASSERT(!watchpoint->isOnList());
+        
+        watchpoint->fire(detail);
+        // After we fire the watchpoint, the watchpoint pointer may be a dangling pointer. That's
+        // fine, because we have no use for the pointer anymore.
+    }
+}
+
+void InlineWatchpointSet::add(Watchpoint* watchpoint)
+{
+    inflate()->add(watchpoint);
+}
+
+void InlineWatchpointSet::fireAll(VM& vm, const char* reason)
+{
+    fireAll(vm, StringFireDetail(reason));
+}
+
+WatchpointSet* InlineWatchpointSet::inflateSlow()
+{
+    ASSERT(isThin());
+    ASSERT(!isCompilationThread());
+    WatchpointSet* fat = adoptRef(new WatchpointSet(decodeState(m_data))).leakRef();
+    WTF::storeStoreFence();
+    m_data = bitwise_cast<uintptr_t>(fat);
+    return fat;
+}
+
+void InlineWatchpointSet::freeFat()
+{
+    ASSERT(isFat());
+    fat()->deref();
+}
+
+} // namespace JSC
+
diff --git a/bytecode/Watchpoint.h b/bytecode/Watchpoint.h
new file mode 100644
index 0000000..69e393d
--- /dev/null
+++ b/bytecode/Watchpoint.h
@@ -0,0 +1,434 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/Atomics.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+#include <wtf/SentinelLinkedList.h>
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace JSC {
+
+class FireDetail {
+    void* operator new(size_t) = delete;
+    
+public:
+    FireDetail()
+    {
+    }
+    
+    virtual ~FireDetail()
+    {
+    }
+    
+    virtual void dump(PrintStream&) const = 0;
+};
+
+class StringFireDetail : public FireDetail {
+public:
+    StringFireDetail(const char* string)
+        : m_string(string)
+    {
+    }
+    
+    void dump(PrintStream& out) const override;
+
+private:
+    const char* m_string;
+};
+
+class WatchpointSet;
+
+class Watchpoint : public BasicRawSentinelNode<Watchpoint> {
+    WTF_MAKE_NONCOPYABLE(Watchpoint);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    Watchpoint()
+    {
+    }
+    
+    virtual ~Watchpoint();
+
+protected:
+    virtual void fireInternal(const FireDetail&) = 0;
+
+private:
+    friend class WatchpointSet;
+    void fire(const FireDetail&);
+};
+
+enum WatchpointState {
+    ClearWatchpoint,
+    IsWatched,
+    IsInvalidated
+};
+
+class InlineWatchpointSet;
+class VM;
+
+class WatchpointSet : public ThreadSafeRefCounted<WatchpointSet> {
+    friend class LLIntOffsetsExtractor;
+public:
+    JS_EXPORT_PRIVATE WatchpointSet(WatchpointState);
+    
+    // FIXME: In many cases, it would be amazing if this *did* fire the watchpoints. I suspect that
+    // this might be hard to get right, but still, it might be awesome.
+    JS_EXPORT_PRIVATE ~WatchpointSet(); // Note that this will not fire any of the watchpoints; if you need to know when a WatchpointSet dies then you need a separate mechanism for this.
+    
+    // Fast way of getting the state, which only works from the main thread.
+    WatchpointState stateOnJSThread() const
+    {
+        return static_cast<WatchpointState>(m_state);
+    }
+    
+    // It is safe to call this from another thread. It may return an old
+    // state. Guarantees that if *first* read the state() of the thing being
+    // watched and it returned IsWatched and *second* you actually read its
+    // value then it's safe to assume that if the state being watched changes
+    // then also the watchpoint state() will change to IsInvalidated.
+    WatchpointState state() const
+    {
+        WTF::loadLoadFence();
+        WatchpointState result = static_cast<WatchpointState>(m_state);
+        WTF::loadLoadFence();
+        return result;
+    }
+    
+    // It is safe to call this from another thread.  It may return true
+    // even if the set actually had been invalidated, but that ought to happen
+    // only in the case of races, and should be rare. Guarantees that if you
+    // call this after observing something that must imply that the set is
+    // invalidated, then you will see this return false. This is ensured by
+    // issuing a load-load fence prior to querying the state.
+    bool isStillValid() const
+    {
+        return state() != IsInvalidated;
+    }
+    // Like isStillValid(), may be called from another thread.
+    bool hasBeenInvalidated() const { return !isStillValid(); }
+    
+    // As a convenience, this will ignore 0. That's because code paths in the DFG
+    // that create speculation watchpoints may choose to bail out if speculation
+    // had already been terminated.
+    void add(Watchpoint*);
+    
+    // Force the watchpoint set to behave as if it was being watched even if no
+    // watchpoints have been installed. This will result in invalidation if the
+    // watchpoint would have fired. That's a pretty good indication that you
+    // probably don't want to set watchpoints, since we typically don't want to
+    // set watchpoints that we believe will actually be fired.
+    void startWatching()
+    {
+        ASSERT(m_state != IsInvalidated);
+        if (m_state == IsWatched)
+            return;
+        WTF::storeStoreFence();
+        m_state = IsWatched;
+        WTF::storeStoreFence();
+    }
+    
+    void fireAll(VM& vm, const FireDetail& detail)
+    {
+        if (LIKELY(m_state != IsWatched))
+            return;
+        fireAllSlow(vm, detail);
+    }
+    
+    void fireAll(VM& vm, const char* reason)
+    {
+        if (LIKELY(m_state != IsWatched))
+            return;
+        fireAllSlow(vm, reason);
+    }
+    
+    void touch(VM& vm, const FireDetail& detail)
+    {
+        if (state() == ClearWatchpoint)
+            startWatching();
+        else
+            fireAll(vm, detail);
+    }
+    
+    void touch(VM& vm, const char* reason)
+    {
+        touch(vm, StringFireDetail(reason));
+    }
+    
+    void invalidate(VM& vm, const FireDetail& detail)
+    {
+        if (state() == IsWatched)
+            fireAll(vm, detail);
+        m_state = IsInvalidated;
+    }
+    
+    void invalidate(VM& vm, const char* reason)
+    {
+        invalidate(vm, StringFireDetail(reason));
+    }
+    
+    bool isBeingWatched() const
+    {
+        return m_setIsNotEmpty;
+    }
+    
+    int8_t* addressOfState() { return &m_state; }
+    static ptrdiff_t offsetOfState() { return OBJECT_OFFSETOF(WatchpointSet, m_state); }
+    int8_t* addressOfSetIsNotEmpty() { return &m_setIsNotEmpty; }
+    
+    JS_EXPORT_PRIVATE void fireAllSlow(VM&, const FireDetail&); // Call only if you've checked isWatched.
+    JS_EXPORT_PRIVATE void fireAllSlow(VM&, const char* reason); // Ditto.
+    
+private:
+    void fireAllWatchpoints(VM&, const FireDetail&);
+    
+    friend class InlineWatchpointSet;
+
+    int8_t m_state;
+    int8_t m_setIsNotEmpty;
+
+    SentinelLinkedList<Watchpoint, BasicRawSentinelNode<Watchpoint>> m_set;
+};
+
+// InlineWatchpointSet is a low-overhead, non-copyable watchpoint set in which
+// it is not possible to quickly query whether it is being watched in a single
+// branch. There is a fairly simple tradeoff between WatchpointSet and
+// InlineWatchpointSet:
+//
+// Do you have to emit JIT code that rapidly tests whether the watchpoint set
+// is being watched?  If so, use WatchpointSet.
+//
+// Do you need multiple parties to have pointers to the same WatchpointSet?
+// If so, use WatchpointSet.
+//
+// Do you have to allocate a lot of watchpoint sets?  If so, use
+// InlineWatchpointSet unless you answered "yes" to the previous questions.
+//
+// InlineWatchpointSet will use just one pointer-width word of memory unless
+// you actually add watchpoints to it, in which case it internally inflates
+// to a pointer to a WatchpointSet, and transfers its state to the
+// WatchpointSet.
+
+class InlineWatchpointSet {
+    WTF_MAKE_NONCOPYABLE(InlineWatchpointSet);
+public:
+    InlineWatchpointSet(WatchpointState state)
+        : m_data(encodeState(state))
+    {
+    }
+    
+    ~InlineWatchpointSet()
+    {
+        if (isThin())
+            return;
+        freeFat();
+    }
+    
+    // Fast way of getting the state, which only works from the main thread.
+    WatchpointState stateOnJSThread() const
+    {
+        uintptr_t data = m_data;
+        if (isFat(data))
+            return fat(data)->stateOnJSThread();
+        return decodeState(data);
+    }
+
+    // It is safe to call this from another thread. It may return a prior state,
+    // but that should be fine since you should only perform actions based on the
+    // state if you also add a watchpoint.
+    WatchpointState state() const
+    {
+        WTF::loadLoadFence();
+        uintptr_t data = m_data;
+        WTF::loadLoadFence();
+        if (isFat(data))
+            return fat(data)->state();
+        return decodeState(data);
+    }
+    
+    // It is safe to call this from another thread.  It may return false
+    // even if the set actually had been invalidated, but that ought to happen
+    // only in the case of races, and should be rare.
+    bool hasBeenInvalidated() const
+    {
+        return state() == IsInvalidated;
+    }
+    
+    // Like hasBeenInvalidated(), may be called from another thread.
+    bool isStillValid() const
+    {
+        return !hasBeenInvalidated();
+    }
+    
+    void add(Watchpoint*);
+    
+    void startWatching()
+    {
+        if (isFat()) {
+            fat()->startWatching();
+            return;
+        }
+        ASSERT(decodeState(m_data) != IsInvalidated);
+        m_data = encodeState(IsWatched);
+    }
+    
+    void fireAll(VM& vm, const FireDetail& detail)
+    {
+        if (isFat()) {
+            fat()->fireAll(vm, detail);
+            return;
+        }
+        if (decodeState(m_data) == ClearWatchpoint)
+            return;
+        m_data = encodeState(IsInvalidated);
+        WTF::storeStoreFence();
+    }
+    
+    void invalidate(VM& vm, const FireDetail& detail)
+    {
+        if (isFat())
+            fat()->invalidate(vm, detail);
+        else
+            m_data = encodeState(IsInvalidated);
+    }
+    
+    JS_EXPORT_PRIVATE void fireAll(VM&, const char* reason);
+    
+    void touch(VM& vm, const FireDetail& detail)
+    {
+        if (isFat()) {
+            fat()->touch(vm, detail);
+            return;
+        }
+        uintptr_t data = m_data;
+        if (decodeState(data) == IsInvalidated)
+            return;
+        WTF::storeStoreFence();
+        if (decodeState(data) == ClearWatchpoint)
+            m_data = encodeState(IsWatched);
+        else
+            m_data = encodeState(IsInvalidated);
+        WTF::storeStoreFence();
+    }
+    
+    void touch(VM& vm, const char* reason)
+    {
+        touch(vm, StringFireDetail(reason));
+    }
+
+    // Note that for any watchpoint that is visible from the DFG, it would be incorrect to write code like:
+    //
+    // if (w.isBeingWatched())
+    //     w.fireAll()
+    //
+    // Concurrently to this, the DFG could do:
+    //
+    // if (w.isStillValid())
+    //     perform optimizations;
+    // if (!w.isStillValid())
+    //     retry compilation;
+    //
+    // Note that the DFG algorithm is widespread, and sound, because fireAll() and invalidate() will leave
+    // the watchpoint in a !isStillValid() state. Hence, if fireAll() or invalidate() interleaved between
+    // the first isStillValid() check and the second one, then it would simply cause the DFG to retry
+    // compilation later.
+    //
+    // But, if you change some piece of state that the DFG might optimize for, but invalidate the
+    // watchpoint by doing:
+    //
+    // if (w.isBeingWatched())
+    //     w.fireAll()
+    //
+    // then the DFG would never know that you invalidated state between the two checks.
+    //
+    // There are two ways to work around this:
+    //
+    // - Call fireAll() without a isBeingWatched() check. Then, the DFG will know that the watchpoint has
+    //   been invalidated when it does its second check.
+    //
+    // - Do not expose the watchpoint set to the DFG directly, and have your own way of validating whether
+    //   the assumptions that the DFG thread used are still valid when the DFG code is installed.
+    bool isBeingWatched() const
+    {
+        if (isFat())
+            return fat()->isBeingWatched();
+        return false;
+    }
+    
+private:
+    static const uintptr_t IsThinFlag        = 1;
+    static const uintptr_t StateMask         = 6;
+    static const uintptr_t StateShift        = 1;
+    
+    static bool isThin(uintptr_t data) { return data & IsThinFlag; }
+    static bool isFat(uintptr_t data) { return !isThin(data); }
+    
+    static WatchpointState decodeState(uintptr_t data)
+    {
+        ASSERT(isThin(data));
+        return static_cast<WatchpointState>((data & StateMask) >> StateShift);
+    }
+    
+    static uintptr_t encodeState(WatchpointState state)
+    {
+        return (static_cast<uintptr_t>(state) << StateShift) | IsThinFlag;
+    }
+    
+    bool isThin() const { return isThin(m_data); }
+    bool isFat() const { return isFat(m_data); };
+    
+    static WatchpointSet* fat(uintptr_t data)
+    {
+        return bitwise_cast<WatchpointSet*>(data);
+    }
+    
+    WatchpointSet* fat()
+    {
+        ASSERT(isFat());
+        return fat(m_data);
+    }
+    
+    const WatchpointSet* fat() const
+    {
+        ASSERT(isFat());
+        return fat(m_data);
+    }
+    
+    WatchpointSet* inflate()
+    {
+        if (LIKELY(isFat()))
+            return fat();
+        return inflateSlow();
+    }
+    
+    JS_EXPORT_PRIVATE WatchpointSet* inflateSlow();
+    JS_EXPORT_PRIVATE void freeFat();
+    
+    uintptr_t m_data;
+};
+
+} // namespace JSC
diff --git a/bytecompiler/BytecodeGenerator.cpp b/bytecompiler/BytecodeGenerator.cpp
new file mode 100644
index 0000000..ff782ef
--- /dev/null
+++ b/bytecompiler/BytecodeGenerator.cpp
@@ -0,0 +1,4955 @@
+/*
+ * Copyright (C) 2008-2009, 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ * Copyright (C) 2012 Igalia, S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BytecodeGenerator.h"
+
+#include "ArithProfile.h"
+#include "BuiltinExecutables.h"
+#include "BytecodeGeneratorification.h"
+#include "BytecodeLivenessAnalysis.h"
+#include "DefinePropertyAttributes.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGeneratorFunction.h"
+#include "JSLexicalEnvironment.h"
+#include "JSTemplateRegistryKey.h"
+#include "LowLevelInterpreter.h"
+#include "Options.h"
+#include "StackAlignment.h"
+#include "StrongInlines.h"
+#include "UnlinkedCodeBlock.h"
+#include "UnlinkedEvalCodeBlock.h"
+#include "UnlinkedFunctionCodeBlock.h"
+#include "UnlinkedInstructionStream.h"
+#include "UnlinkedModuleProgramCodeBlock.h"
+#include "UnlinkedProgramCodeBlock.h"
+#include <wtf/BitVector.h>
+#include <wtf/CommaPrinter.h>
+#include <wtf/SmallPtrSet.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/text/WTFString.h>
+
+using namespace std;
+
+namespace JSC {
+
+void Label::setLocation(unsigned location)
+{
+    m_location = location;
+    
+    unsigned size = m_unresolvedJumps.size();
+    for (unsigned i = 0; i < size; ++i)
+        m_generator.instructions()[m_unresolvedJumps[i].second].u.operand = m_location - m_unresolvedJumps[i].first;
+}
+
+void Variable::dump(PrintStream& out) const
+{
+    out.print(
+        "{ident = ", m_ident,
+        ", offset = ", m_offset,
+        ", local = ", RawPointer(m_local),
+        ", attributes = ", m_attributes,
+        ", kind = ", m_kind,
+        ", symbolTableConstantIndex = ", m_symbolTableConstantIndex,
+        ", isLexicallyScoped = ", m_isLexicallyScoped, "}");
+}
+
+ParserError BytecodeGenerator::generate()
+{
+    m_codeBlock->setThisRegister(m_thisRegister.virtualRegister());
+
+    emitLogShadowChickenPrologueIfNecessary();
+    
+    // If we have declared a variable named "arguments" and we are using arguments then we should
+    // perform that assignment now.
+    if (m_needToInitializeArguments)
+        initializeVariable(variable(propertyNames().arguments), m_argumentsRegister);
+
+    if (m_restParameter)
+        m_restParameter->emit(*this);
+
+    {
+        RefPtr<RegisterID> temp = newTemporary();
+        RefPtr<RegisterID> globalScope;
+        for (auto functionPair : m_functionsToInitialize) {
+            FunctionMetadataNode* metadata = functionPair.first;
+            FunctionVariableType functionType = functionPair.second;
+            emitNewFunction(temp.get(), metadata);
+            if (functionType == NormalFunctionVariable)
+                initializeVariable(variable(metadata->ident()), temp.get());
+            else if (functionType == GlobalFunctionVariable) {
+                if (!globalScope) {
+                    // We know this will resolve to the global object because our parser/global initialization code 
+                    // doesn't allow let/const/class variables to have the same names as functions.
+                    RefPtr<RegisterID> globalObjectScope = emitResolveScope(nullptr, Variable(metadata->ident())); 
+                    globalScope = newBlockScopeVariable(); 
+                    emitMove(globalScope.get(), globalObjectScope.get());
+                }
+                emitPutToScope(globalScope.get(), Variable(metadata->ident()), temp.get(), ThrowIfNotFound, InitializationMode::NotInitialization);
+            } else
+                RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    
+    bool callingClassConstructor = constructorKind() != ConstructorKind::None && !isConstructor();
+    if (!callingClassConstructor)
+        m_scopeNode->emitBytecode(*this);
+
+    m_staticPropertyAnalyzer.kill();
+
+    for (unsigned i = 0; i < m_tryRanges.size(); ++i) {
+        TryRange& range = m_tryRanges[i];
+        int start = range.start->bind();
+        int end = range.end->bind();
+        
+        // This will happen for empty try blocks and for some cases of finally blocks:
+        //
+        // try {
+        //    try {
+        //    } finally {
+        //        return 42;
+        //        // *HERE*
+        //    }
+        // } finally {
+        //    print("things");
+        // }
+        //
+        // The return will pop scopes to execute the outer finally block. But this includes
+        // popping the try context for the inner try. The try context is live in the fall-through
+        // part of the finally block not because we will emit a handler that overlaps the finally,
+        // but because we haven't yet had a chance to plant the catch target. Then when we finish
+        // emitting code for the outer finally block, we repush the try contex, this time with a
+        // new start index. But that means that the start index for the try range corresponding
+        // to the inner-finally-following-the-return (marked as "*HERE*" above) will be greater
+        // than the end index of the try block. This is harmless since end < start handlers will
+        // never get matched in our logic, but we do the runtime a favor and choose to not emit
+        // such handlers at all.
+        if (end <= start)
+            continue;
+        
+        ASSERT(range.tryData->handlerType != HandlerType::Illegal);
+        UnlinkedHandlerInfo info(static_cast<uint32_t>(start), static_cast<uint32_t>(end),
+            static_cast<uint32_t>(range.tryData->target->bind()), range.tryData->handlerType);
+        m_codeBlock->addExceptionHandler(info);
+    }
+    
+
+    if (isGeneratorOrAsyncFunctionBodyParseMode(m_codeBlock->parseMode()))
+        performGeneratorification(m_codeBlock.get(), m_instructions, m_generatorFrameSymbolTable.get(), m_generatorFrameSymbolTableIndex);
+
+    m_codeBlock->setInstructions(std::make_unique<UnlinkedInstructionStream>(m_instructions));
+
+    m_codeBlock->shrinkToFit();
+
+    if (m_expressionTooDeep)
+        return ParserError(ParserError::OutOfMemory);
+    return ParserError(ParserError::ErrorNone);
+}
+
+BytecodeGenerator::BytecodeGenerator(VM& vm, ProgramNode* programNode, UnlinkedProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, const VariableEnvironment* parentScopeTDZVariables)
+    : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
+    , m_scopeNode(programNode)
+    , m_codeBlock(vm, codeBlock)
+    , m_thisRegister(CallFrame::thisArgumentOffset())
+    , m_codeType(GlobalCode)
+    , m_vm(&vm)
+    , m_needsToUpdateArrowFunctionContext(programNode->usesArrowFunction() || programNode->usesEval())
+{
+    ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables->size());
+
+    for (auto& constantRegister : m_linkTimeConstantRegisters)
+        constantRegister = nullptr;
+
+    allocateCalleeSaveSpace();
+
+    m_codeBlock->setNumParameters(1); // Allocate space for "this"
+
+    emitEnter();
+
+    allocateAndEmitScope();
+
+    emitWatchdog();
+
+    const FunctionStack& functionStack = programNode->functionStack();
+
+    for (size_t i = 0; i < functionStack.size(); ++i) {
+        FunctionMetadataNode* function = functionStack[i];
+        m_functionsToInitialize.append(std::make_pair(function, GlobalFunctionVariable));
+    }
+    if (Options::validateBytecode()) {
+        for (auto& entry : programNode->varDeclarations())
+            RELEASE_ASSERT(entry.value.isVar());
+    }
+    codeBlock->setVariableDeclarations(programNode->varDeclarations());
+    codeBlock->setLexicalDeclarations(programNode->lexicalVariables());
+    // Even though this program may have lexical variables that go under TDZ, when linking the get_from_scope/put_to_scope
+    // operations we emit we will have ResolveTypes that implictly do TDZ checks. Therefore, we don't need
+    // additional TDZ checks on top of those. This is why we can omit pushing programNode->lexicalVariables()
+    // to the TDZ stack.
+    
+    if (needsToUpdateArrowFunctionContext()) {
+        initializeArrowFunctionContextScopeIfNeeded();
+        emitPutThisToArrowFunctionContextScope();
+    }
+}
+
+BytecodeGenerator::BytecodeGenerator(VM& vm, FunctionNode* functionNode, UnlinkedFunctionCodeBlock* codeBlock, DebuggerMode debuggerMode, const VariableEnvironment* parentScopeTDZVariables)
+    : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
+    , m_scopeNode(functionNode)
+    , m_codeBlock(vm, codeBlock)
+    , m_codeType(FunctionCode)
+    , m_vm(&vm)
+    , m_isBuiltinFunction(codeBlock->isBuiltinFunction())
+    , m_usesNonStrictEval(codeBlock->usesEval() && !codeBlock->isStrictMode())
+    // FIXME: We should be able to have tail call elimination with the profiler
+    // enabled. This is currently not possible because the profiler expects
+    // op_will_call / op_did_call pairs before and after a call, which are not
+    // compatible with tail calls (we have no way of emitting op_did_call).
+    // https://bugs.webkit.org/show_bug.cgi?id=148819
+    , m_inTailPosition(Options::useTailCalls() && !isConstructor() && constructorKind() == ConstructorKind::None && isStrictMode())
+    , m_needsToUpdateArrowFunctionContext(functionNode->usesArrowFunction() || functionNode->usesEval())
+    , m_derivedContextType(codeBlock->derivedContextType())
+{
+    for (auto& constantRegister : m_linkTimeConstantRegisters)
+        constantRegister = nullptr;
+
+    if (m_isBuiltinFunction)
+        m_shouldEmitDebugHooks = false;
+
+    allocateCalleeSaveSpace();
+    
+    SymbolTable* functionSymbolTable = SymbolTable::create(*m_vm);
+    functionSymbolTable->setUsesNonStrictEval(m_usesNonStrictEval);
+    int symbolTableConstantIndex = 0;
+
+    FunctionParameters& parameters = *functionNode->parameters(); 
+    // http://www.ecma-international.org/ecma-262/6.0/index.html#sec-functiondeclarationinstantiation
+    // This implements IsSimpleParameterList in the Ecma 2015 spec.
+    // If IsSimpleParameterList is false, we will create a strict-mode like arguments object.
+    // IsSimpleParameterList is false if the argument list contains any default parameter values,
+    // a rest parameter, or any destructuring patterns.
+    bool isSimpleParameterList = true;
+    // If we do have default parameters, destructuring parameters, or a rest parameter, our parameters will be allocated in a different scope.
+    for (size_t i = 0; i < parameters.size(); i++) {
+        std::pair<DestructuringPatternNode*, ExpressionNode*> parameter = parameters.at(i);
+        bool hasDefaultParameterValue = !!parameter.second;
+        auto pattern = parameter.first;
+        bool isSimpleParameter = !hasDefaultParameterValue && pattern->isBindingNode();
+        isSimpleParameterList &= isSimpleParameter;
+    }
+
+    SourceParseMode parseMode = codeBlock->parseMode();
+
+    bool containsArrowOrEvalButNotInArrowBlock = ((functionNode->usesArrowFunction() && functionNode->doAnyInnerArrowFunctionsUseAnyFeature()) || functionNode->usesEval()) && !m_codeBlock->isArrowFunction();
+    bool shouldCaptureSomeOfTheThings = m_shouldEmitDebugHooks || functionNode->needsActivation() || containsArrowOrEvalButNotInArrowBlock;
+
+    bool shouldCaptureAllOfTheThings = m_shouldEmitDebugHooks || codeBlock->usesEval();
+    bool needsArguments = (functionNode->usesArguments() || codeBlock->usesEval() || (functionNode->usesArrowFunction() && !codeBlock->isArrowFunction() && isArgumentsUsedInInnerArrowFunction()));
+
+    if (isGeneratorOrAsyncFunctionBodyParseMode(parseMode)) {
+        // Generator and AsyncFunction never provides "arguments". "arguments" reference will be resolved in an upper generator function scope.
+        needsArguments = false;
+
+        // Generator and AsyncFunction uses the var scope to save and resume its variables. So the lexical scope is always instantiated.
+        shouldCaptureSomeOfTheThings = true;
+    }
+
+    if (isGeneratorOrAsyncFunctionWrapperParseMode(parseMode) && needsArguments) {
+        // Generator does not provide "arguments". Instead, wrapping GeneratorFunction provides "arguments".
+        // This is because arguments of a generator should be evaluated before starting it.
+        // To workaround it, we evaluate these arguments as arguments of a wrapping generator function, and reference it from a generator.
+        //
+        //    function *gen(a, b = hello())
+        //    {
+        //        return {
+        //            @generatorNext: function (@generator, @generatorState, @generatorValue, @generatorResumeMode, @generatorFrame)
+        //            {
+        //                arguments;  // This `arguments` should reference to the gen's arguments.
+        //                ...
+        //            }
+        //        }
+        //    }
+        shouldCaptureSomeOfTheThings = true;
+    }
+
+    if (shouldCaptureAllOfTheThings)
+        functionNode->varDeclarations().markAllVariablesAsCaptured();
+    
+    auto captures = [&] (UniquedStringImpl* uid) -> bool {
+        if (!shouldCaptureSomeOfTheThings)
+            return false;
+        if (needsArguments && uid == propertyNames().arguments.impl()) {
+            // Actually, we only need to capture the arguments object when we "need full activation"
+            // because of name scopes. But historically we did it this way, so for now we just preserve
+            // the old behavior.
+            // FIXME: https://bugs.webkit.org/show_bug.cgi?id=143072
+            return true;
+        }
+        return functionNode->captures(uid);
+    };
+    auto varKind = [&] (UniquedStringImpl* uid) -> VarKind {
+        return captures(uid) ? VarKind::Scope : VarKind::Stack;
+    };
+
+    m_calleeRegister.setIndex(CallFrameSlot::callee);
+
+    initializeParameters(parameters);
+    ASSERT(!(isSimpleParameterList && m_restParameter));
+
+    emitEnter();
+
+    if (isGeneratorOrAsyncFunctionBodyParseMode(parseMode))
+        m_generatorRegister = &m_parameters[1];
+
+    allocateAndEmitScope();
+
+    emitWatchdog();
+    
+    if (functionNameIsInScope(functionNode->ident(), functionNode->functionMode())) {
+        ASSERT(parseMode != SourceParseMode::GeneratorBodyMode);
+        ASSERT(!isAsyncFunctionBodyParseMode(parseMode));
+        bool isDynamicScope = functionNameScopeIsDynamic(codeBlock->usesEval(), codeBlock->isStrictMode());
+        bool isFunctionNameCaptured = captures(functionNode->ident().impl());
+        bool markAsCaptured = isDynamicScope || isFunctionNameCaptured;
+        emitPushFunctionNameScope(functionNode->ident(), &m_calleeRegister, markAsCaptured);
+    }
+
+    if (shouldCaptureSomeOfTheThings)
+        m_lexicalEnvironmentRegister = addVar();
+
+    if (shouldCaptureSomeOfTheThings || vm.typeProfiler())
+        symbolTableConstantIndex = addConstantValue(functionSymbolTable)->index();
+
+    // We can allocate the "var" environment if we don't have default parameter expressions. If we have
+    // default parameter expressions, we have to hold off on allocating the "var" environment because
+    // the parent scope of the "var" environment is the parameter environment.
+    if (isSimpleParameterList)
+        initializeVarLexicalEnvironment(symbolTableConstantIndex, functionSymbolTable, shouldCaptureSomeOfTheThings);
+
+    // Figure out some interesting facts about our arguments.
+    bool capturesAnyArgumentByName = false;
+    if (functionNode->hasCapturedVariables()) {
+        FunctionParameters& parameters = *functionNode->parameters();
+        for (size_t i = 0; i < parameters.size(); ++i) {
+            auto pattern = parameters.at(i).first;
+            if (!pattern->isBindingNode())
+                continue;
+            const Identifier& ident = static_cast<const BindingNode*>(pattern)->boundProperty();
+            capturesAnyArgumentByName |= captures(ident.impl());
+        }
+    }
+    
+    if (capturesAnyArgumentByName)
+        ASSERT(m_lexicalEnvironmentRegister);
+
+    // Need to know what our functions are called. Parameters have some goofy behaviors when it
+    // comes to functions of the same name.
+    for (FunctionMetadataNode* function : functionNode->functionStack())
+        m_functions.add(function->ident().impl());
+    
+    if (needsArguments) {
+        // Create the arguments object now. We may put the arguments object into the activation if
+        // it is captured. Either way, we create two arguments object variables: one is our
+        // private variable that is immutable, and another that is the user-visible variable. The
+        // immutable one is only used here, or during formal parameter resolutions if we opt for
+        // DirectArguments.
+        
+        m_argumentsRegister = addVar();
+        m_argumentsRegister->ref();
+    }
+    
+    if (needsArguments && !codeBlock->isStrictMode() && isSimpleParameterList) {
+        // If we captured any formal parameter by name, then we use ScopedArguments. Otherwise we
+        // use DirectArguments. With ScopedArguments, we lift all of our arguments into the
+        // activation.
+        
+        if (capturesAnyArgumentByName) {
+            functionSymbolTable->setArgumentsLength(vm, parameters.size());
+            
+            // For each parameter, we have two possibilities:
+            // Either it's a binding node with no function overlap, in which case it gets a name
+            // in the symbol table - or it just gets space reserved in the symbol table. Either
+            // way we lift the value into the scope.
+            for (unsigned i = 0; i < parameters.size(); ++i) {
+                ScopeOffset offset = functionSymbolTable->takeNextScopeOffset(NoLockingNecessary);
+                functionSymbolTable->setArgumentOffset(vm, i, offset);
+                if (UniquedStringImpl* name = visibleNameForParameter(parameters.at(i).first)) {
+                    VarOffset varOffset(offset);
+                    SymbolTableEntry entry(varOffset);
+                    // Stores to these variables via the ScopedArguments object will not do
+                    // notifyWrite(), since that would be cumbersome. Also, watching formal
+                    // parameters when "arguments" is in play is unlikely to be super profitable.
+                    // So, we just disable it.
+                    entry.disableWatching(*m_vm);
+                    functionSymbolTable->set(NoLockingNecessary, name, entry);
+                }
+                emitOpcode(op_put_to_scope);
+                instructions().append(m_lexicalEnvironmentRegister->index());
+                instructions().append(UINT_MAX);
+                instructions().append(virtualRegisterForArgument(1 + i).offset());
+                instructions().append(GetPutInfo(ThrowIfNotFound, LocalClosureVar, InitializationMode::NotInitialization).operand());
+                instructions().append(symbolTableConstantIndex);
+                instructions().append(offset.offset());
+            }
+            
+            // This creates a scoped arguments object and copies the overflow arguments into the
+            // scope. It's the equivalent of calling ScopedArguments::createByCopying().
+            emitOpcode(op_create_scoped_arguments);
+            instructions().append(m_argumentsRegister->index());
+            instructions().append(m_lexicalEnvironmentRegister->index());
+        } else {
+            // We're going to put all parameters into the DirectArguments object. First ensure
+            // that the symbol table knows that this is happening.
+            for (unsigned i = 0; i < parameters.size(); ++i) {
+                if (UniquedStringImpl* name = visibleNameForParameter(parameters.at(i).first))
+                    functionSymbolTable->set(NoLockingNecessary, name, SymbolTableEntry(VarOffset(DirectArgumentsOffset(i))));
+            }
+            
+            emitOpcode(op_create_direct_arguments);
+            instructions().append(m_argumentsRegister->index());
+        }
+    } else if (isSimpleParameterList) {
+        // Create the formal parameters the normal way. Any of them could be captured, or not. If
+        // captured, lift them into the scope. We cannot do this if we have default parameter expressions
+        // because when default parameter expressions exist, they belong in their own lexical environment
+        // separate from the "var" lexical environment.
+        for (unsigned i = 0; i < parameters.size(); ++i) {
+            UniquedStringImpl* name = visibleNameForParameter(parameters.at(i).first);
+            if (!name)
+                continue;
+            
+            if (!captures(name)) {
+                // This is the easy case - just tell the symbol table about the argument. It will
+                // be accessed directly.
+                functionSymbolTable->set(NoLockingNecessary, name, SymbolTableEntry(VarOffset(virtualRegisterForArgument(1 + i))));
+                continue;
+            }
+            
+            ScopeOffset offset = functionSymbolTable->takeNextScopeOffset(NoLockingNecessary);
+            const Identifier& ident =
+                static_cast<const BindingNode*>(parameters.at(i).first)->boundProperty();
+            functionSymbolTable->set(NoLockingNecessary, name, SymbolTableEntry(VarOffset(offset)));
+            
+            emitOpcode(op_put_to_scope);
+            instructions().append(m_lexicalEnvironmentRegister->index());
+            instructions().append(addConstant(ident));
+            instructions().append(virtualRegisterForArgument(1 + i).offset());
+            instructions().append(GetPutInfo(ThrowIfNotFound, LocalClosureVar, InitializationMode::NotInitialization).operand());
+            instructions().append(symbolTableConstantIndex);
+            instructions().append(offset.offset());
+        }
+    }
+    
+    if (needsArguments && (codeBlock->isStrictMode() || !isSimpleParameterList)) {
+        // Allocate a cloned arguments object.
+        emitOpcode(op_create_cloned_arguments);
+        instructions().append(m_argumentsRegister->index());
+    }
+    
+    // There are some variables that need to be preinitialized to something other than Undefined:
+    //
+    // - "arguments": unless it's used as a function or parameter, this should refer to the
+    //   arguments object.
+    //
+    // - functions: these always override everything else.
+    //
+    // The most logical way to do all of this is to initialize none of the variables until now,
+    // and then initialize them in BytecodeGenerator::generate() in such an order that the rules
+    // for how these things override each other end up holding. We would initialize "arguments" first, 
+    // then all arguments, then the functions.
+    //
+    // But some arguments are already initialized by default, since if they aren't captured and we
+    // don't have "arguments" then we just point the symbol table at the stack slot of those
+    // arguments. We end up initializing the rest of the arguments that have an uncomplicated
+    // binding (i.e. don't involve destructuring) above when figuring out how to lay them out,
+    // because that's just the simplest thing. This means that when we initialize them, we have to
+    // watch out for the things that override arguments (namely, functions).
+    
+    // This is our final act of weirdness. "arguments" is overridden by everything except the
+    // callee. We add it to the symbol table if it's not already there and it's not an argument.
+    bool shouldCreateArgumentsVariableInParameterScope = false;
+    if (needsArguments) {
+        // If "arguments" is overridden by a function or destructuring parameter name, then it's
+        // OK for us to call createVariable() because it won't change anything. It's also OK for
+        // us to them tell BytecodeGenerator::generate() to write to it because it will do so
+        // before it initializes functions and destructuring parameters. But if "arguments" is
+        // overridden by a "simple" function parameter, then we have to bail: createVariable()
+        // would assert and BytecodeGenerator::generate() would write the "arguments" after the
+        // argument value had already been properly initialized.
+        
+        bool haveParameterNamedArguments = false;
+        for (unsigned i = 0; i < parameters.size(); ++i) {
+            UniquedStringImpl* name = visibleNameForParameter(parameters.at(i).first);
+            if (name == propertyNames().arguments.impl()) {
+                haveParameterNamedArguments = true;
+                break;
+            }
+        }
+
+        bool shouldCreateArgumensVariable = !haveParameterNamedArguments
+            && !SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(m_codeBlock->parseMode());
+        shouldCreateArgumentsVariableInParameterScope = shouldCreateArgumensVariable && !isSimpleParameterList;
+        // Do not create arguments variable in case of Arrow function. Value will be loaded from parent scope
+        if (shouldCreateArgumensVariable && !shouldCreateArgumentsVariableInParameterScope) {
+            createVariable(
+                propertyNames().arguments, varKind(propertyNames().arguments.impl()), functionSymbolTable);
+
+            m_needToInitializeArguments = true;
+        }
+    }
+
+    for (FunctionMetadataNode* function : functionNode->functionStack()) {
+        const Identifier& ident = function->ident();
+        createVariable(ident, varKind(ident.impl()), functionSymbolTable);
+        m_functionsToInitialize.append(std::make_pair(function, NormalFunctionVariable));
+    }
+    for (auto& entry : functionNode->varDeclarations()) {
+        ASSERT(!entry.value.isLet() && !entry.value.isConst());
+        if (!entry.value.isVar()) // This is either a parameter or callee.
+            continue;
+        if (shouldCreateArgumentsVariableInParameterScope && entry.key.get() == propertyNames().arguments.impl())
+            continue;
+        createVariable(Identifier::fromUid(m_vm, entry.key.get()), varKind(entry.key.get()), functionSymbolTable, IgnoreExisting);
+    }
+
+
+    m_newTargetRegister = addVar();
+    switch (parseMode) {
+    case SourceParseMode::GeneratorWrapperFunctionMode: {
+        m_generatorRegister = addVar();
+
+        // FIXME: Emit to_this only when Generator uses it.
+        // https://bugs.webkit.org/show_bug.cgi?id=151586
+        m_codeBlock->addPropertyAccessInstruction(instructions().size());
+        emitOpcode(op_to_this);
+        instructions().append(kill(&m_thisRegister));
+        instructions().append(0);
+        instructions().append(0);
+
+        emitMove(m_generatorRegister, &m_calleeRegister);
+        emitCreateThis(m_generatorRegister);
+        break;
+    }
+
+    case SourceParseMode::AsyncArrowFunctionMode:
+    case SourceParseMode::AsyncMethodMode:
+    case SourceParseMode::AsyncFunctionMode: {
+        ASSERT(!isConstructor());
+        ASSERT(constructorKind() == ConstructorKind::None);
+        m_generatorRegister = addVar();
+        m_promiseCapabilityRegister = addVar();
+
+        if (parseMode != SourceParseMode::AsyncArrowFunctionMode) {
+            // FIXME: Emit to_this only when AsyncFunctionBody uses it.
+            // https://bugs.webkit.org/show_bug.cgi?id=151586
+            m_codeBlock->addPropertyAccessInstruction(instructions().size());
+            emitOpcode(op_to_this);
+            instructions().append(kill(&m_thisRegister));
+            instructions().append(0);
+            instructions().append(0);
+        }
+
+        emitNewObject(m_generatorRegister);
+
+        // let promiseCapability be @newPromiseCapability(@Promise)
+        auto varNewPromiseCapability = variable(propertyNames().builtinNames().newPromiseCapabilityPrivateName());
+        RefPtr<RegisterID> scope = newTemporary();
+        moveToDestinationIfNeeded(scope.get(), emitResolveScope(scope.get(), varNewPromiseCapability));
+        RefPtr<RegisterID> newPromiseCapability = emitGetFromScope(newTemporary(), scope.get(), varNewPromiseCapability, ThrowIfNotFound);
+
+        CallArguments args(*this, nullptr, 1);
+        emitLoad(args.thisRegister(), jsUndefined());
+
+        auto varPromiseConstructor = variable(propertyNames().builtinNames().PromisePrivateName());
+        moveToDestinationIfNeeded(scope.get(), emitResolveScope(scope.get(), varPromiseConstructor));
+        emitGetFromScope(args.argumentRegister(0), scope.get(), varPromiseConstructor, ThrowIfNotFound);
+
+        // JSTextPosition(int _line, int _offset, int _lineStartOffset)
+        JSTextPosition divot(m_scopeNode->firstLine(), m_scopeNode->startOffset(), m_scopeNode->lineStartOffset());
+        emitCall(promiseCapabilityRegister(), newPromiseCapability.get(), NoExpectedFunction, args, divot, divot, divot, DebuggableCall::No);
+        break;
+    }
+
+    case SourceParseMode::AsyncFunctionBodyMode:
+    case SourceParseMode::AsyncArrowFunctionBodyMode:
+    case SourceParseMode::GeneratorBodyMode: {
+        // |this| is already filled correctly before here.
+        emitLoad(m_newTargetRegister, jsUndefined());
+        break;
+    }
+
+    default: {
+        if (SourceParseMode::ArrowFunctionMode != parseMode) {
+            if (isConstructor()) {
+                emitMove(m_newTargetRegister, &m_thisRegister);
+                if (constructorKind() == ConstructorKind::Extends) {
+                    RefPtr<Label> isDerived = newLabel();
+                    RefPtr<Label> done = newLabel();
+                    m_isDerivedConstuctor = addVar();
+                    emitGetById(m_isDerivedConstuctor, &m_calleeRegister, propertyNames().builtinNames().isDerivedConstructorPrivateName());
+                    emitJumpIfTrue(m_isDerivedConstuctor, isDerived.get());
+                    emitCreateThis(&m_thisRegister);
+                    emitJump(done.get());
+                    emitLabel(isDerived.get());
+                    emitMoveEmptyValue(&m_thisRegister);
+                    emitLabel(done.get());
+                } else
+                    emitCreateThis(&m_thisRegister);
+            } else if (constructorKind() != ConstructorKind::None)
+                emitThrowTypeError("Cannot call a class constructor without |new|");
+            else {
+                bool shouldEmitToThis = false;
+                if (functionNode->usesThis() || codeBlock->usesEval() || m_scopeNode->doAnyInnerArrowFunctionsUseThis() || m_scopeNode->doAnyInnerArrowFunctionsUseEval())
+                    shouldEmitToThis = true;
+                else if ((functionNode->usesSuperProperty() || m_scopeNode->doAnyInnerArrowFunctionsUseSuperProperty()) && !codeBlock->isStrictMode()) {
+                    // We must emit to_this when we're not in strict mode because we
+                    // will convert |this| to an object, and that object may be passed
+                    // to a strict function as |this|. This is observable because that
+                    // strict function's to_this will just return the object.
+                    //
+                    // We don't need to emit this for strict-mode code because
+                    // strict-mode code may call another strict function, which will
+                    // to_this if it directly uses this; this is OK, because we defer
+                    // to_this until |this| is used directly. Strict-mode code might
+                    // also call a sloppy mode function, and that will to_this, which
+                    // will defer the conversion, again, until necessary.
+                    shouldEmitToThis = true;
+                }
+
+                if (shouldEmitToThis) {
+                    m_codeBlock->addPropertyAccessInstruction(instructions().size());
+                    emitOpcode(op_to_this);
+                    instructions().append(kill(&m_thisRegister));
+                    instructions().append(0);
+                    instructions().append(0);
+                }
+            }
+        }
+        break;
+    }
+    }
+
+    // We need load |super| & |this| for arrow function before initializeDefaultParameterValuesAndSetupFunctionScopeStack
+    // if we have default parameter expression. Because |super| & |this| values can be used there
+    if ((SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(parseMode) && !isSimpleParameterList) || parseMode == SourceParseMode::AsyncArrowFunctionBodyMode) {
+        if (functionNode->usesThis() || functionNode->usesSuperProperty())
+            emitLoadThisFromArrowFunctionLexicalEnvironment();
+
+        if (m_scopeNode->usesNewTarget() || m_scopeNode->usesSuperCall())
+            emitLoadNewTargetFromArrowFunctionLexicalEnvironment();
+    }
+
+    if (needsToUpdateArrowFunctionContext() && !codeBlock->isArrowFunction()) {
+        bool canReuseLexicalEnvironment = isSimpleParameterList;
+        initializeArrowFunctionContextScopeIfNeeded(functionSymbolTable, canReuseLexicalEnvironment);
+        emitPutThisToArrowFunctionContextScope();
+        emitPutNewTargetToArrowFunctionContextScope();
+        emitPutDerivedConstructorToArrowFunctionContextScope();
+    }
+
+    // All "addVar()"s needs to happen before "initializeDefaultParameterValuesAndSetupFunctionScopeStack()" is called
+    // because a function's default parameter ExpressionNodes will use temporary registers.
+    pushTDZVariables(*parentScopeTDZVariables, TDZCheckOptimization::DoNotOptimize, TDZRequirement::UnderTDZ);
+
+    TryData* tryFormalParametersData = nullptr;
+    if (isAsyncFunctionWrapperParseMode(parseMode) && !isSimpleParameterList) {
+        RefPtr<Label> tryFormalParametersStart = emitLabel(newLabel().get());
+        tryFormalParametersData = pushTry(tryFormalParametersStart.get());
+    }
+
+    initializeDefaultParameterValuesAndSetupFunctionScopeStack(parameters, isSimpleParameterList, functionNode, functionSymbolTable, symbolTableConstantIndex, captures, shouldCreateArgumentsVariableInParameterScope);
+
+    if (isAsyncFunctionWrapperParseMode(parseMode) && !isSimpleParameterList) {
+        RefPtr<Label> didNotThrow = newLabel();
+        emitJump(didNotThrow.get());
+        RefPtr<RegisterID> exception = newTemporary();
+        RefPtr<RegisterID> thrownValue = newTemporary();
+        RefPtr<Label> catchHere = emitLabel(newLabel().get());
+        popTryAndEmitCatch(tryFormalParametersData, exception.get(), thrownValue.get(), catchHere.get(), HandlerType::Catch);
+
+        // return promiseCapability.@reject(thrownValue)
+        RefPtr<RegisterID> reject = emitGetById(newTemporary(), promiseCapabilityRegister(), m_vm->propertyNames->builtinNames().rejectPrivateName());
+
+        CallArguments args(*this, nullptr, 1);
+        emitLoad(args.thisRegister(), jsUndefined());
+        emitMove(args.argumentRegister(0), thrownValue.get());
+
+        JSTextPosition divot(functionNode->firstLine(), functionNode->startOffset(), functionNode->lineStartOffset());
+
+        RefPtr<RegisterID> result = emitCall(newTemporary(), reject.get(), NoExpectedFunction, args, divot, divot, divot, DebuggableCall::No);
+        emitReturn(emitGetById(newTemporary(), promiseCapabilityRegister(), m_vm->propertyNames->builtinNames().promisePrivateName()));
+
+        emitLabel(didNotThrow.get());
+    }
+
+    // If we don't have  default parameter expression, then loading |this| inside an arrow function must be done
+    // after initializeDefaultParameterValuesAndSetupFunctionScopeStack() because that function sets up the
+    // SymbolTable stack and emitLoadThisFromArrowFunctionLexicalEnvironment() consults the SymbolTable stack
+    if (SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(parseMode) && isSimpleParameterList) {
+        if (functionNode->usesThis() || functionNode->usesSuperProperty())
+            emitLoadThisFromArrowFunctionLexicalEnvironment();
+    
+        if (m_scopeNode->usesNewTarget() || m_scopeNode->usesSuperCall())
+            emitLoadNewTargetFromArrowFunctionLexicalEnvironment();
+    }
+    
+    // Set up the lexical environment scope as the generator frame. We store the saved and resumed generator registers into this scope with the symbol keys.
+    // Since they are symbol keyed, these variables cannot be reached from the usual code.
+    if (isGeneratorOrAsyncFunctionBodyParseMode(parseMode)) {
+        ASSERT(m_lexicalEnvironmentRegister);
+        m_generatorFrameSymbolTable.set(*m_vm, functionSymbolTable);
+        m_generatorFrameSymbolTableIndex = symbolTableConstantIndex;
+        emitMove(generatorFrameRegister(), m_lexicalEnvironmentRegister);
+        emitPutById(generatorRegister(), propertyNames().builtinNames().generatorFramePrivateName(), generatorFrameRegister());
+    }
+
+    bool shouldInitializeBlockScopedFunctions = false; // We generate top-level function declarations in ::generate().
+    pushLexicalScope(m_scopeNode, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, shouldInitializeBlockScopedFunctions);
+}
+
+BytecodeGenerator::BytecodeGenerator(VM& vm, EvalNode* evalNode, UnlinkedEvalCodeBlock* codeBlock, DebuggerMode debuggerMode, const VariableEnvironment* parentScopeTDZVariables)
+    : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
+    , m_scopeNode(evalNode)
+    , m_codeBlock(vm, codeBlock)
+    , m_thisRegister(CallFrame::thisArgumentOffset())
+    , m_codeType(EvalCode)
+    , m_vm(&vm)
+    , m_usesNonStrictEval(codeBlock->usesEval() && !codeBlock->isStrictMode())
+    , m_needsToUpdateArrowFunctionContext(evalNode->usesArrowFunction() || evalNode->usesEval())
+    , m_derivedContextType(codeBlock->derivedContextType())
+{
+    for (auto& constantRegister : m_linkTimeConstantRegisters)
+        constantRegister = nullptr;
+
+    allocateCalleeSaveSpace();
+
+    m_codeBlock->setNumParameters(1);
+
+    pushTDZVariables(*parentScopeTDZVariables, TDZCheckOptimization::DoNotOptimize, TDZRequirement::UnderTDZ);
+
+    emitEnter();
+
+    allocateAndEmitScope();
+
+    emitWatchdog();
+    
+    const DeclarationStacks::FunctionStack& functionStack = evalNode->functionStack();
+    for (size_t i = 0; i < functionStack.size(); ++i)
+        m_codeBlock->addFunctionDecl(makeFunction(functionStack[i]));
+
+    const VariableEnvironment& varDeclarations = evalNode->varDeclarations();
+    unsigned numVariables = varDeclarations.size();
+    Vector<Identifier, 0, UnsafeVectorOverflow> variables;
+    variables.reserveCapacity(numVariables);
+    for (auto& entry : varDeclarations) {
+        ASSERT(entry.value.isVar());
+        ASSERT(entry.key->isAtomic() || entry.key->isSymbol());
+        variables.append(Identifier::fromUid(m_vm, entry.key.get()));
+    }
+    codeBlock->adoptVariables(variables);
+    
+    if (evalNode->usesSuperCall() || evalNode->usesNewTarget())
+        m_newTargetRegister = addVar();
+
+    if (codeBlock->isArrowFunctionContext() && (evalNode->usesThis() || evalNode->usesSuperProperty()))
+        emitLoadThisFromArrowFunctionLexicalEnvironment();
+
+    if (evalNode->usesSuperCall() || evalNode->usesNewTarget())
+        emitLoadNewTargetFromArrowFunctionLexicalEnvironment();
+
+    if (needsToUpdateArrowFunctionContext() && !codeBlock->isArrowFunctionContext() && !isDerivedConstructorContext()) {
+        initializeArrowFunctionContextScopeIfNeeded();
+        emitPutThisToArrowFunctionContextScope();
+    }
+    
+    bool shouldInitializeBlockScopedFunctions = false; // We generate top-level function declarations in ::generate().
+    pushLexicalScope(m_scopeNode, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, shouldInitializeBlockScopedFunctions);
+}
+
+BytecodeGenerator::BytecodeGenerator(VM& vm, ModuleProgramNode* moduleProgramNode, UnlinkedModuleProgramCodeBlock* codeBlock, DebuggerMode debuggerMode, const VariableEnvironment* parentScopeTDZVariables)
+    : m_shouldEmitDebugHooks(Options::forceDebuggerBytecodeGeneration() || debuggerMode == DebuggerOn)
+    , m_scopeNode(moduleProgramNode)
+    , m_codeBlock(vm, codeBlock)
+    , m_thisRegister(CallFrame::thisArgumentOffset())
+    , m_codeType(ModuleCode)
+    , m_vm(&vm)
+    , m_usesNonStrictEval(false)
+    , m_needsToUpdateArrowFunctionContext(moduleProgramNode->usesArrowFunction() || moduleProgramNode->usesEval())
+{
+    ASSERT_UNUSED(parentScopeTDZVariables, !parentScopeTDZVariables->size());
+
+    for (auto& constantRegister : m_linkTimeConstantRegisters)
+        constantRegister = nullptr;
+
+    if (m_isBuiltinFunction)
+        m_shouldEmitDebugHooks = false;
+
+    allocateCalleeSaveSpace();
+
+    SymbolTable* moduleEnvironmentSymbolTable = SymbolTable::create(*m_vm);
+    moduleEnvironmentSymbolTable->setUsesNonStrictEval(m_usesNonStrictEval);
+    moduleEnvironmentSymbolTable->setScopeType(SymbolTable::ScopeType::LexicalScope);
+
+    bool shouldCaptureAllOfTheThings = m_shouldEmitDebugHooks || codeBlock->usesEval();
+    if (shouldCaptureAllOfTheThings)
+        moduleProgramNode->varDeclarations().markAllVariablesAsCaptured();
+
+    auto captures = [&] (UniquedStringImpl* uid) -> bool {
+        return moduleProgramNode->captures(uid);
+    };
+    auto lookUpVarKind = [&] (UniquedStringImpl* uid, const VariableEnvironmentEntry& entry) -> VarKind {
+        // Allocate the exported variables in the module environment.
+        if (entry.isExported())
+            return VarKind::Scope;
+
+        // Allocate the namespace variables in the module environment to instantiate
+        // it from the outside of the module code.
+        if (entry.isImportedNamespace())
+            return VarKind::Scope;
+
+        if (entry.isCaptured())
+            return VarKind::Scope;
+        return captures(uid) ? VarKind::Scope : VarKind::Stack;
+    };
+
+    emitEnter();
+
+    allocateAndEmitScope();
+
+    emitWatchdog();
+    
+    m_calleeRegister.setIndex(CallFrameSlot::callee);
+
+    m_codeBlock->setNumParameters(1); // Allocate space for "this"
+
+    // Now declare all variables.
+
+    for (auto& entry : moduleProgramNode->varDeclarations()) {
+        ASSERT(!entry.value.isLet() && !entry.value.isConst());
+        if (!entry.value.isVar()) // This is either a parameter or callee.
+            continue;
+        // Imported bindings are not allocated in the module environment as usual variables' way.
+        // These references remain the "Dynamic" in the unlinked code block. Later, when linking
+        // the code block, we resolve the reference to the "ModuleVar".
+        if (entry.value.isImported() && !entry.value.isImportedNamespace())
+            continue;
+        createVariable(Identifier::fromUid(m_vm, entry.key.get()), lookUpVarKind(entry.key.get(), entry.value), moduleEnvironmentSymbolTable, IgnoreExisting);
+    }
+
+    VariableEnvironment& lexicalVariables = moduleProgramNode->lexicalVariables();
+    instantiateLexicalVariables(lexicalVariables, moduleEnvironmentSymbolTable, ScopeRegisterType::Block, lookUpVarKind);
+
+    // We keep the symbol table in the constant pool.
+    RegisterID* constantSymbolTable = nullptr;
+    if (vm.typeProfiler())
+        constantSymbolTable = addConstantValue(moduleEnvironmentSymbolTable);
+    else
+        constantSymbolTable = addConstantValue(moduleEnvironmentSymbolTable->cloneScopePart(*m_vm));
+
+    pushTDZVariables(lexicalVariables, TDZCheckOptimization::Optimize, TDZRequirement::UnderTDZ);
+    bool isWithScope = false;
+    m_lexicalScopeStack.append({ moduleEnvironmentSymbolTable, m_topMostScope, isWithScope, constantSymbolTable->index() });
+    emitPrefillStackTDZVariables(lexicalVariables, moduleEnvironmentSymbolTable);
+
+    // makeFunction assumes that there's correct TDZ stack entries.
+    // So it should be called after putting our lexical environment to the TDZ stack correctly.
+
+    for (FunctionMetadataNode* function : moduleProgramNode->functionStack()) {
+        const auto& iterator = moduleProgramNode->varDeclarations().find(function->ident().impl());
+        RELEASE_ASSERT(iterator != moduleProgramNode->varDeclarations().end());
+        RELEASE_ASSERT(!iterator->value.isImported());
+
+        VarKind varKind = lookUpVarKind(iterator->key.get(), iterator->value);
+        if (varKind == VarKind::Scope) {
+            // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
+            // Section 15.2.1.16.4, step 16-a-iv-1.
+            // All heap allocated function declarations should be instantiated when the module environment
+            // is created. They include the exported function declarations and not-exported-but-heap-allocated
+            // function declarations. This is required because exported function should be instantiated before
+            // executing the any module in the dependency graph. This enables the modules to link the imported
+            // bindings before executing the any module code.
+            //
+            // And since function declarations are instantiated before executing the module body code, the spec
+            // allows the functions inside the module to be executed before its module body is executed under
+            // the circular dependencies. The following is the example.
+            //
+            // Module A (executed first):
+            //    import { b } from "B";
+            //    // Here, the module "B" is not executed yet, but the function declaration is already instantiated.
+            //    // So we can call the function exported from "B".
+            //    b();
+            //
+            //    export function a() {
+            //    }
+            //
+            // Module B (executed second):
+            //    import { a } from "A";
+            //
+            //    export function b() {
+            //        c();
+            //    }
+            //
+            //    // c is not exported, but since it is referenced from the b, we should instantiate it before
+            //    // executing the "B" module code.
+            //    function c() {
+            //        a();
+            //    }
+            //
+            // Module EntryPoint (executed last):
+            //    import "B";
+            //    import "A";
+            //
+            m_codeBlock->addFunctionDecl(makeFunction(function));
+        } else {
+            // Stack allocated functions can be allocated when executing the module's body.
+            m_functionsToInitialize.append(std::make_pair(function, NormalFunctionVariable));
+        }
+    }
+
+    // Remember the constant register offset to the top-most symbol table. This symbol table will be
+    // cloned in the code block linking. After that, to create the module environment, we retrieve
+    // the cloned symbol table from the linked code block by using this offset.
+    codeBlock->setModuleEnvironmentSymbolTableConstantRegisterOffset(constantSymbolTable->index());
+}
+
+BytecodeGenerator::~BytecodeGenerator()
+{
+}
+
+void BytecodeGenerator::initializeDefaultParameterValuesAndSetupFunctionScopeStack(
+    FunctionParameters& parameters, bool isSimpleParameterList, FunctionNode* functionNode, SymbolTable* functionSymbolTable, 
+    int symbolTableConstantIndex, const std::function<bool (UniquedStringImpl*)>& captures, bool shouldCreateArgumentsVariableInParameterScope)
+{
+    Vector<std::pair<Identifier, RefPtr<RegisterID>>> valuesToMoveIntoVars;
+    ASSERT(!(isSimpleParameterList && shouldCreateArgumentsVariableInParameterScope));
+    if (!isSimpleParameterList) {
+        // Refer to the ES6 spec section 9.2.12: http://www.ecma-international.org/ecma-262/6.0/index.html#sec-functiondeclarationinstantiation
+        // This implements step 21.
+        VariableEnvironment environment;
+        Vector<Identifier> allParameterNames; 
+        for (unsigned i = 0; i < parameters.size(); i++)
+            parameters.at(i).first->collectBoundIdentifiers(allParameterNames);
+        if (shouldCreateArgumentsVariableInParameterScope)
+            allParameterNames.append(propertyNames().arguments);
+        IdentifierSet parameterSet;
+        for (auto& ident : allParameterNames) {
+            parameterSet.add(ident.impl());
+            auto addResult = environment.add(ident);
+            addResult.iterator->value.setIsLet(); // When we have default parameter expressions, parameters act like "let" variables.
+            if (captures(ident.impl()))
+                addResult.iterator->value.setIsCaptured();
+        }
+        // This implements step 25 of section 9.2.12.
+        pushLexicalScopeInternal(environment, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, TDZRequirement::UnderTDZ, ScopeType::LetConstScope, ScopeRegisterType::Block);
+
+        if (shouldCreateArgumentsVariableInParameterScope) {
+            Variable argumentsVariable = variable(propertyNames().arguments); 
+            initializeVariable(argumentsVariable, m_argumentsRegister);
+            liftTDZCheckIfPossible(argumentsVariable);
+        }
+
+        RefPtr<RegisterID> temp = newTemporary();
+        for (unsigned i = 0; i < parameters.size(); i++) {
+            std::pair<DestructuringPatternNode*, ExpressionNode*> parameter = parameters.at(i);
+            if (parameter.first->isRestParameter())
+                continue;
+            RefPtr<RegisterID> parameterValue = &registerFor(virtualRegisterForArgument(1 + i));
+            emitMove(temp.get(), parameterValue.get());
+            if (parameter.second) {
+                RefPtr<RegisterID> condition = emitIsUndefined(newTemporary(), parameterValue.get());
+                RefPtr<Label> skipDefaultParameterBecauseNotUndefined = newLabel();
+                emitJumpIfFalse(condition.get(), skipDefaultParameterBecauseNotUndefined.get());
+                emitNode(temp.get(), parameter.second);
+                emitLabel(skipDefaultParameterBecauseNotUndefined.get());
+            }
+
+            parameter.first->bindValue(*this, temp.get());
+        }
+
+        // Final act of weirdness for default parameters. If a "var" also
+        // has the same name as a parameter, it should start out as the
+        // value of that parameter. Note, though, that they will be distinct
+        // bindings.
+        // This is step 28 of section 9.2.12. 
+        for (auto& entry : functionNode->varDeclarations()) {
+            if (!entry.value.isVar()) // This is either a parameter or callee.
+                continue;
+
+            if (parameterSet.contains(entry.key)) {
+                Identifier ident = Identifier::fromUid(m_vm, entry.key.get());
+                Variable var = variable(ident);
+                RegisterID* scope = emitResolveScope(nullptr, var);
+                RefPtr<RegisterID> value = emitGetFromScope(newTemporary(), scope, var, DoNotThrowIfNotFound);
+                valuesToMoveIntoVars.append(std::make_pair(ident, value));
+            }
+        }
+
+        // Functions with default parameter expressions must have a separate environment
+        // record for parameters and "var"s. The "var" environment record must have the
+        // parameter environment record as its parent.
+        // See step 28 of section 9.2.12.
+        bool hasCapturedVariables = !!m_lexicalEnvironmentRegister; 
+        initializeVarLexicalEnvironment(symbolTableConstantIndex, functionSymbolTable, hasCapturedVariables);
+    }
+
+    // This completes step 28 of section 9.2.12.
+    for (unsigned i = 0; i < valuesToMoveIntoVars.size(); i++) {
+        ASSERT(!isSimpleParameterList);
+        Variable var = variable(valuesToMoveIntoVars[i].first);
+        RegisterID* scope = emitResolveScope(nullptr, var);
+        emitPutToScope(scope, var, valuesToMoveIntoVars[i].second.get(), DoNotThrowIfNotFound, InitializationMode::NotInitialization);
+    }
+}
+
+void BytecodeGenerator::initializeArrowFunctionContextScopeIfNeeded(SymbolTable* functionSymbolTable, bool canReuseLexicalEnvironment)
+{
+    ASSERT(!m_arrowFunctionContextLexicalEnvironmentRegister);
+
+    if (canReuseLexicalEnvironment && m_lexicalEnvironmentRegister) {
+        RELEASE_ASSERT(!m_codeBlock->isArrowFunction());
+        RELEASE_ASSERT(functionSymbolTable);
+
+        m_arrowFunctionContextLexicalEnvironmentRegister = m_lexicalEnvironmentRegister;
+        
+        ScopeOffset offset;
+        
+        if (isThisUsedInInnerArrowFunction()) {
+            offset = functionSymbolTable->takeNextScopeOffset(NoLockingNecessary);
+            functionSymbolTable->set(NoLockingNecessary, propertyNames().thisIdentifier.impl(), SymbolTableEntry(VarOffset(offset)));
+        }
+
+        if (m_codeType == FunctionCode && isNewTargetUsedInInnerArrowFunction()) {
+            offset = functionSymbolTable->takeNextScopeOffset();
+            functionSymbolTable->set(NoLockingNecessary, propertyNames().builtinNames().newTargetLocalPrivateName().impl(), SymbolTableEntry(VarOffset(offset)));
+        }
+        
+        if (isConstructor() && constructorKind() == ConstructorKind::Extends && isSuperUsedInInnerArrowFunction()) {
+            offset = functionSymbolTable->takeNextScopeOffset(NoLockingNecessary);
+            functionSymbolTable->set(NoLockingNecessary, propertyNames().builtinNames().derivedConstructorPrivateName().impl(), SymbolTableEntry(VarOffset(offset)));
+        }
+
+        return;
+    }
+
+    VariableEnvironment environment;
+
+    if (isThisUsedInInnerArrowFunction()) {
+        auto addResult = environment.add(propertyNames().thisIdentifier);
+        addResult.iterator->value.setIsCaptured();
+        addResult.iterator->value.setIsLet();
+    }
+    
+    if (m_codeType == FunctionCode && isNewTargetUsedInInnerArrowFunction()) {
+        auto addTarget = environment.add(propertyNames().builtinNames().newTargetLocalPrivateName());
+        addTarget.iterator->value.setIsCaptured();
+        addTarget.iterator->value.setIsLet();
+    }
+
+    if (isConstructor() && constructorKind() == ConstructorKind::Extends && isSuperUsedInInnerArrowFunction()) {
+        auto derivedConstructor = environment.add(propertyNames().builtinNames().derivedConstructorPrivateName());
+        derivedConstructor.iterator->value.setIsCaptured();
+        derivedConstructor.iterator->value.setIsLet();
+    }
+
+    if (environment.size() > 0) {
+        size_t size = m_lexicalScopeStack.size();
+        pushLexicalScopeInternal(environment, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, TDZRequirement::UnderTDZ, ScopeType::LetConstScope, ScopeRegisterType::Block);
+
+        ASSERT_UNUSED(size, m_lexicalScopeStack.size() == size + 1);
+
+        m_arrowFunctionContextLexicalEnvironmentRegister = m_lexicalScopeStack.last().m_scope;
+    }
+}
+
+RegisterID* BytecodeGenerator::initializeNextParameter()
+{
+    VirtualRegister reg = virtualRegisterForArgument(m_codeBlock->numParameters());
+    RegisterID& parameter = registerFor(reg);
+    parameter.setIndex(reg.offset());
+    m_codeBlock->addParameter();
+    return &parameter;
+}
+
+void BytecodeGenerator::initializeParameters(FunctionParameters& parameters)
+{
+    // Make sure the code block knows about all of our parameters, and make sure that parameters
+    // needing destructuring are noted.
+    m_parameters.grow(parameters.size() + 1); // reserve space for "this"
+    m_thisRegister.setIndex(initializeNextParameter()->index()); // this
+    for (unsigned i = 0; i < parameters.size(); ++i) {
+        auto pattern = parameters.at(i).first;
+        if (pattern->isRestParameter()) {
+            RELEASE_ASSERT(!m_restParameter);
+            m_restParameter = static_cast<RestParameterNode*>(pattern);
+        } else
+            initializeNextParameter();
+    }
+}
+
+void BytecodeGenerator::initializeVarLexicalEnvironment(int symbolTableConstantIndex, SymbolTable* functionSymbolTable, bool hasCapturedVariables)
+{
+    if (hasCapturedVariables) {
+        RELEASE_ASSERT(m_lexicalEnvironmentRegister);
+        emitOpcode(op_create_lexical_environment);
+        instructions().append(m_lexicalEnvironmentRegister->index());
+        instructions().append(scopeRegister()->index());
+        instructions().append(symbolTableConstantIndex);
+        instructions().append(addConstantValue(jsUndefined())->index());
+
+        emitOpcode(op_mov);
+        instructions().append(scopeRegister()->index());
+        instructions().append(m_lexicalEnvironmentRegister->index());
+
+        pushLocalControlFlowScope();
+    }
+    bool isWithScope = false;
+    m_lexicalScopeStack.append({ functionSymbolTable, m_lexicalEnvironmentRegister, isWithScope, symbolTableConstantIndex });
+    m_varScopeLexicalScopeStackIndex = m_lexicalScopeStack.size() - 1;
+}
+
+UniquedStringImpl* BytecodeGenerator::visibleNameForParameter(DestructuringPatternNode* pattern)
+{
+    if (pattern->isBindingNode()) {
+        const Identifier& ident = static_cast<const BindingNode*>(pattern)->boundProperty();
+        if (!m_functions.contains(ident.impl()))
+            return ident.impl();
+    }
+    return nullptr;
+}
+
+RegisterID* BytecodeGenerator::newRegister()
+{
+    m_calleeLocals.append(virtualRegisterForLocal(m_calleeLocals.size()));
+    int numCalleeLocals = max<int>(m_codeBlock->m_numCalleeLocals, m_calleeLocals.size());
+    numCalleeLocals = WTF::roundUpToMultipleOf(stackAlignmentRegisters(), numCalleeLocals);
+    m_codeBlock->m_numCalleeLocals = numCalleeLocals;
+    return &m_calleeLocals.last();
+}
+
+void BytecodeGenerator::reclaimFreeRegisters()
+{
+    while (m_calleeLocals.size() && !m_calleeLocals.last().refCount())
+        m_calleeLocals.removeLast();
+}
+
+RegisterID* BytecodeGenerator::newBlockScopeVariable()
+{
+    reclaimFreeRegisters();
+
+    return newRegister();
+}
+
+RegisterID* BytecodeGenerator::newTemporary()
+{
+    reclaimFreeRegisters();
+
+    RegisterID* result = newRegister();
+    result->setTemporary();
+    return result;
+}
+
+LabelScopePtr BytecodeGenerator::newLabelScope(LabelScope::Type type, const Identifier* name)
+{
+    // Reclaim free label scopes.
+    while (m_labelScopes.size() && !m_labelScopes.last().refCount())
+        m_labelScopes.removeLast();
+
+    // Allocate new label scope.
+    LabelScope scope(type, name, labelScopeDepth(), newLabel(), type == LabelScope::Loop ? newLabel() : PassRefPtr<Label>()); // Only loops have continue targets.
+    m_labelScopes.append(scope);
+    return LabelScopePtr(m_labelScopes, m_labelScopes.size() - 1);
+}
+
+PassRefPtr<Label> BytecodeGenerator::newLabel()
+{
+    // Reclaim free label IDs.
+    while (m_labels.size() && !m_labels.last().refCount())
+        m_labels.removeLast();
+
+    // Allocate new label ID.
+    m_labels.append(*this);
+    return &m_labels.last();
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitLabel(Label* l0)
+{
+    unsigned newLabelIndex = instructions().size();
+    l0->setLocation(newLabelIndex);
+
+    if (m_codeBlock->numberOfJumpTargets()) {
+        unsigned lastLabelIndex = m_codeBlock->lastJumpTarget();
+        ASSERT(lastLabelIndex <= newLabelIndex);
+        if (newLabelIndex == lastLabelIndex) {
+            // Peephole optimizations have already been disabled by emitting the last label
+            return l0;
+        }
+    }
+
+    m_codeBlock->addJumpTarget(newLabelIndex);
+
+    // This disables peephole optimizations when an instruction is a jump target
+    m_lastOpcodeID = op_end;
+    return l0;
+}
+
+void BytecodeGenerator::emitOpcode(OpcodeID opcodeID)
+{
+#ifndef NDEBUG
+    size_t opcodePosition = instructions().size();
+    ASSERT(opcodePosition - m_lastOpcodePosition == opcodeLength(m_lastOpcodeID) || m_lastOpcodeID == op_end);
+    m_lastOpcodePosition = opcodePosition;
+#endif
+    instructions().append(opcodeID);
+    m_lastOpcodeID = opcodeID;
+}
+
+UnlinkedArrayProfile BytecodeGenerator::newArrayProfile()
+{
+    return m_codeBlock->addArrayProfile();
+}
+
+UnlinkedArrayAllocationProfile BytecodeGenerator::newArrayAllocationProfile()
+{
+    return m_codeBlock->addArrayAllocationProfile();
+}
+
+UnlinkedObjectAllocationProfile BytecodeGenerator::newObjectAllocationProfile()
+{
+    return m_codeBlock->addObjectAllocationProfile();
+}
+
+UnlinkedValueProfile BytecodeGenerator::emitProfiledOpcode(OpcodeID opcodeID)
+{
+    UnlinkedValueProfile result = m_codeBlock->addValueProfile();
+    emitOpcode(opcodeID);
+    return result;
+}
+
+void BytecodeGenerator::emitEnter()
+{
+    emitOpcode(op_enter);
+}
+
+void BytecodeGenerator::emitLoopHint()
+{
+    emitOpcode(op_loop_hint);
+    emitWatchdog();
+}
+
+void BytecodeGenerator::emitWatchdog()
+{
+    if (vm()->watchdog())
+        emitOpcode(op_watchdog);
+}
+
+void BytecodeGenerator::retrieveLastBinaryOp(int& dstIndex, int& src1Index, int& src2Index)
+{
+    ASSERT(instructions().size() >= 4);
+    size_t size = instructions().size();
+    dstIndex = instructions().at(size - 3).u.operand;
+    src1Index = instructions().at(size - 2).u.operand;
+    src2Index = instructions().at(size - 1).u.operand;
+}
+
+void BytecodeGenerator::retrieveLastUnaryOp(int& dstIndex, int& srcIndex)
+{
+    ASSERT(instructions().size() >= 3);
+    size_t size = instructions().size();
+    dstIndex = instructions().at(size - 2).u.operand;
+    srcIndex = instructions().at(size - 1).u.operand;
+}
+
+void ALWAYS_INLINE BytecodeGenerator::rewindBinaryOp()
+{
+    ASSERT(instructions().size() >= 4);
+    instructions().shrink(instructions().size() - 4);
+    m_lastOpcodeID = op_end;
+}
+
+void ALWAYS_INLINE BytecodeGenerator::rewindUnaryOp()
+{
+    ASSERT(instructions().size() >= 3);
+    instructions().shrink(instructions().size() - 3);
+    m_lastOpcodeID = op_end;
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitJump(Label* target)
+{
+    size_t begin = instructions().size();
+    emitOpcode(op_jmp);
+    instructions().append(target->bind(begin, instructions().size()));
+    return target;
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* target)
+{
+    if (m_lastOpcodeID == op_less) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jless);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_lesseq) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jlesseq);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_greater) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jgreater);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_greatereq) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jgreatereq);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
+        int dstIndex;
+        int srcIndex;
+
+        retrieveLastUnaryOp(dstIndex, srcIndex);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindUnaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jeq_null);
+            instructions().append(srcIndex);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
+        int dstIndex;
+        int srcIndex;
+
+        retrieveLastUnaryOp(dstIndex, srcIndex);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindUnaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jneq_null);
+            instructions().append(srcIndex);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    }
+
+    size_t begin = instructions().size();
+
+    emitOpcode(op_jtrue);
+    instructions().append(cond->index());
+    instructions().append(target->bind(begin, instructions().size()));
+    return target;
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* target)
+{
+    if (m_lastOpcodeID == op_less && target->isForward()) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jnless);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_lesseq && target->isForward()) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jnlesseq);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_greater && target->isForward()) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jngreater);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_greatereq && target->isForward()) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jngreatereq);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_not) {
+        int dstIndex;
+        int srcIndex;
+
+        retrieveLastUnaryOp(dstIndex, srcIndex);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindUnaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jtrue);
+            instructions().append(srcIndex);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
+        int dstIndex;
+        int srcIndex;
+
+        retrieveLastUnaryOp(dstIndex, srcIndex);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindUnaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jneq_null);
+            instructions().append(srcIndex);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
+        int dstIndex;
+        int srcIndex;
+
+        retrieveLastUnaryOp(dstIndex, srcIndex);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindUnaryOp();
+
+            size_t begin = instructions().size();
+            emitOpcode(op_jeq_null);
+            instructions().append(srcIndex);
+            instructions().append(target->bind(begin, instructions().size()));
+            return target;
+        }
+    }
+
+    size_t begin = instructions().size();
+    emitOpcode(op_jfalse);
+    instructions().append(cond->index());
+    instructions().append(target->bind(begin, instructions().size()));
+    return target;
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond, Label* target)
+{
+    size_t begin = instructions().size();
+
+    emitOpcode(op_jneq_ptr);
+    instructions().append(cond->index());
+    instructions().append(Special::CallFunction);
+    instructions().append(target->bind(begin, instructions().size()));
+    instructions().append(0);
+    return target;
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond, Label* target)
+{
+    size_t begin = instructions().size();
+
+    emitOpcode(op_jneq_ptr);
+    instructions().append(cond->index());
+    instructions().append(Special::ApplyFunction);
+    instructions().append(target->bind(begin, instructions().size()));
+    instructions().append(0);
+    return target;
+}
+
+bool BytecodeGenerator::hasConstant(const Identifier& ident) const
+{
+    UniquedStringImpl* rep = ident.impl();
+    return m_identifierMap.contains(rep);
+}
+
+unsigned BytecodeGenerator::addConstant(const Identifier& ident)
+{
+    UniquedStringImpl* rep = ident.impl();
+    IdentifierMap::AddResult result = m_identifierMap.add(rep, m_codeBlock->numberOfIdentifiers());
+    if (result.isNewEntry)
+        m_codeBlock->addIdentifier(ident);
+
+    return result.iterator->value;
+}
+
+// We can't hash JSValue(), so we use a dedicated data member to cache it.
+RegisterID* BytecodeGenerator::addConstantEmptyValue()
+{
+    if (!m_emptyValueRegister) {
+        int index = m_nextConstantOffset;
+        m_constantPoolRegisters.append(FirstConstantRegisterIndex + m_nextConstantOffset);
+        ++m_nextConstantOffset;
+        m_codeBlock->addConstant(JSValue());
+        m_emptyValueRegister = &m_constantPoolRegisters[index];
+    }
+
+    return m_emptyValueRegister;
+}
+
+RegisterID* BytecodeGenerator::addConstantValue(JSValue v, SourceCodeRepresentation sourceCodeRepresentation)
+{
+    if (!v)
+        return addConstantEmptyValue();
+
+    int index = m_nextConstantOffset;
+
+    if (sourceCodeRepresentation == SourceCodeRepresentation::Double && v.isInt32())
+        v = jsDoubleNumber(v.asNumber());
+    EncodedJSValueWithRepresentation valueMapKey { JSValue::encode(v), sourceCodeRepresentation };
+    JSValueMap::AddResult result = m_jsValueMap.add(valueMapKey, m_nextConstantOffset);
+    if (result.isNewEntry) {
+        m_constantPoolRegisters.append(FirstConstantRegisterIndex + m_nextConstantOffset);
+        ++m_nextConstantOffset;
+        m_codeBlock->addConstant(v, sourceCodeRepresentation);
+    } else
+        index = result.iterator->value;
+    return &m_constantPoolRegisters[index];
+}
+
+RegisterID* BytecodeGenerator::emitMoveLinkTimeConstant(RegisterID* dst, LinkTimeConstant type)
+{
+    unsigned constantIndex = static_cast<unsigned>(type);
+    if (!m_linkTimeConstantRegisters[constantIndex]) {
+        int index = m_nextConstantOffset;
+        m_constantPoolRegisters.append(FirstConstantRegisterIndex + m_nextConstantOffset);
+        ++m_nextConstantOffset;
+        m_codeBlock->addConstant(type);
+        m_linkTimeConstantRegisters[constantIndex] = &m_constantPoolRegisters[index];
+    }
+
+    if (!dst)
+        return m_linkTimeConstantRegisters[constantIndex];
+
+    emitOpcode(op_mov);
+    instructions().append(dst->index());
+    instructions().append(m_linkTimeConstantRegisters[constantIndex]->index());
+
+    return dst;
+}
+
+unsigned BytecodeGenerator::addRegExp(RegExp* r)
+{
+    return m_codeBlock->addRegExp(r);
+}
+
+RegisterID* BytecodeGenerator::emitMoveEmptyValue(RegisterID* dst)
+{
+    RefPtr<RegisterID> emptyValue = addConstantEmptyValue();
+
+    emitOpcode(op_mov);
+    instructions().append(dst->index());
+    instructions().append(emptyValue->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitMove(RegisterID* dst, RegisterID* src)
+{
+    ASSERT(src != m_emptyValueRegister);
+
+    m_staticPropertyAnalyzer.mov(dst->index(), src->index());
+    emitOpcode(op_mov);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitUnaryOp(OpcodeID opcodeID, RegisterID* dst, RegisterID* src)
+{
+    ASSERT_WITH_MESSAGE(op_to_number != opcodeID, "op_to_number has a Value Profile.");
+    ASSERT_WITH_MESSAGE(op_negate != opcodeID, "op_negate has an Arith Profile.");
+    emitOpcode(opcodeID);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitUnaryOp(OpcodeID opcodeID, RegisterID* dst, RegisterID* src, OperandTypes types)
+{
+    ASSERT_WITH_MESSAGE(op_to_number != opcodeID, "op_to_number has a Value Profile.");
+    emitOpcode(opcodeID);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+
+    if (opcodeID == op_negate)
+        instructions().append(ArithProfile(types.first()).bits());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitUnaryOpProfiled(OpcodeID opcodeID, RegisterID* dst, RegisterID* src)
+{
+    UnlinkedValueProfile profile = emitProfiledOpcode(opcodeID);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    instructions().append(profile);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitInc(RegisterID* srcDst)
+{
+    emitOpcode(op_inc);
+    instructions().append(srcDst->index());
+    return srcDst;
+}
+
+RegisterID* BytecodeGenerator::emitDec(RegisterID* srcDst)
+{
+    emitOpcode(op_dec);
+    instructions().append(srcDst->index());
+    return srcDst;
+}
+
+RegisterID* BytecodeGenerator::emitBinaryOp(OpcodeID opcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2, OperandTypes types)
+{
+    emitOpcode(opcodeID);
+    instructions().append(dst->index());
+    instructions().append(src1->index());
+    instructions().append(src2->index());
+
+    if (opcodeID == op_bitor || opcodeID == op_bitand || opcodeID == op_bitxor ||
+        opcodeID == op_add || opcodeID == op_mul || opcodeID == op_sub || opcodeID == op_div)
+        instructions().append(ArithProfile(types.first(), types.second()).bits());
+
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2)
+{
+    if (m_lastOpcodeID == op_typeof) {
+        int dstIndex;
+        int srcIndex;
+
+        retrieveLastUnaryOp(dstIndex, srcIndex);
+
+        if (src1->index() == dstIndex
+            && src1->isTemporary()
+            && m_codeBlock->isConstantRegisterIndex(src2->index())
+            && m_codeBlock->constantRegister(src2->index()).get().isString()) {
+            const String& value = asString(m_codeBlock->constantRegister(src2->index()).get())->tryGetValue();
+            if (value == "undefined") {
+                rewindUnaryOp();
+                emitOpcode(op_is_undefined);
+                instructions().append(dst->index());
+                instructions().append(srcIndex);
+                return dst;
+            }
+            if (value == "boolean") {
+                rewindUnaryOp();
+                emitOpcode(op_is_boolean);
+                instructions().append(dst->index());
+                instructions().append(srcIndex);
+                return dst;
+            }
+            if (value == "number") {
+                rewindUnaryOp();
+                emitOpcode(op_is_number);
+                instructions().append(dst->index());
+                instructions().append(srcIndex);
+                return dst;
+            }
+            if (value == "string") {
+                rewindUnaryOp();
+                emitOpcode(op_is_cell_with_type);
+                instructions().append(dst->index());
+                instructions().append(srcIndex);
+                instructions().append(StringType);
+                return dst;
+            }
+            if (value == "symbol") {
+                rewindUnaryOp();
+                emitOpcode(op_is_cell_with_type);
+                instructions().append(dst->index());
+                instructions().append(srcIndex);
+                instructions().append(SymbolType);
+                return dst;
+            }
+            if (value == "object") {
+                rewindUnaryOp();
+                emitOpcode(op_is_object_or_null);
+                instructions().append(dst->index());
+                instructions().append(srcIndex);
+                return dst;
+            }
+            if (value == "function") {
+                rewindUnaryOp();
+                emitOpcode(op_is_function);
+                instructions().append(dst->index());
+                instructions().append(srcIndex);
+                return dst;
+            }
+        }
+    }
+
+    emitOpcode(opcodeID);
+    instructions().append(dst->index());
+    instructions().append(src1->index());
+    instructions().append(src2->index());
+    return dst;
+}
+
+void BytecodeGenerator::emitTypeProfilerExpressionInfo(const JSTextPosition& startDivot, const JSTextPosition& endDivot)
+{
+    ASSERT(vm()->typeProfiler());
+
+    unsigned start = startDivot.offset; // Ranges are inclusive of their endpoints, AND 0 indexed.
+    unsigned end = endDivot.offset - 1; // End Ranges already go one past the inclusive range, so subtract 1.
+    unsigned instructionOffset = instructions().size() - 1;
+    m_codeBlock->addTypeProfilerExpressionInfo(instructionOffset, start, end);
+}
+
+void BytecodeGenerator::emitProfileType(RegisterID* registerToProfile, ProfileTypeBytecodeFlag flag)
+{
+    if (!vm()->typeProfiler())
+        return;
+
+    if (!registerToProfile)
+        return;
+
+    emitOpcode(op_profile_type);
+    instructions().append(registerToProfile->index());
+    instructions().append(0);
+    instructions().append(flag);
+    instructions().append(0);
+    instructions().append(resolveType());
+
+    // Don't emit expression info for this version of profile type. This generally means
+    // we're profiling information for something that isn't in the actual text of a JavaScript
+    // program. For example, implicit return undefined from a function call.
+}
+
+void BytecodeGenerator::emitProfileType(RegisterID* registerToProfile, const JSTextPosition& startDivot, const JSTextPosition& endDivot)
+{
+    emitProfileType(registerToProfile, ProfileTypeBytecodeDoesNotHaveGlobalID, startDivot, endDivot);
+}
+
+void BytecodeGenerator::emitProfileType(RegisterID* registerToProfile, ProfileTypeBytecodeFlag flag, const JSTextPosition& startDivot, const JSTextPosition& endDivot)
+{
+    if (!vm()->typeProfiler())
+        return;
+
+    if (!registerToProfile)
+        return;
+
+    // The format of this instruction is: op_profile_type regToProfile, TypeLocation*, flag, identifier?, resolveType?
+    emitOpcode(op_profile_type);
+    instructions().append(registerToProfile->index());
+    instructions().append(0);
+    instructions().append(flag);
+    instructions().append(0);
+    instructions().append(resolveType());
+
+    emitTypeProfilerExpressionInfo(startDivot, endDivot);
+}
+
+void BytecodeGenerator::emitProfileType(RegisterID* registerToProfile, const Variable& var, const JSTextPosition& startDivot, const JSTextPosition& endDivot)
+{
+    if (!vm()->typeProfiler())
+        return;
+
+    if (!registerToProfile)
+        return;
+
+    ProfileTypeBytecodeFlag flag;
+    int symbolTableOrScopeDepth;
+    if (var.local() || var.offset().isScope()) {
+        flag = ProfileTypeBytecodeLocallyResolved;
+        ASSERT(var.symbolTableConstantIndex());
+        symbolTableOrScopeDepth = var.symbolTableConstantIndex();
+    } else {
+        flag = ProfileTypeBytecodeClosureVar;
+        symbolTableOrScopeDepth = localScopeDepth();
+    }
+
+    // The format of this instruction is: op_profile_type regToProfile, TypeLocation*, flag, identifier?, resolveType?
+    emitOpcode(op_profile_type);
+    instructions().append(registerToProfile->index());
+    instructions().append(symbolTableOrScopeDepth);
+    instructions().append(flag);
+    instructions().append(addConstant(var.ident()));
+    instructions().append(resolveType());
+
+    emitTypeProfilerExpressionInfo(startDivot, endDivot);
+}
+
+void BytecodeGenerator::emitProfileControlFlow(int textOffset)
+{
+    if (vm()->controlFlowProfiler()) {
+        RELEASE_ASSERT(textOffset >= 0);
+        size_t bytecodeOffset = instructions().size();
+        m_codeBlock->addOpProfileControlFlowBytecodeOffset(bytecodeOffset);
+
+        emitOpcode(op_profile_control_flow);
+        instructions().append(textOffset);
+    }
+}
+
+RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, bool b)
+{
+    return emitLoad(dst, jsBoolean(b));
+}
+
+RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, const Identifier& identifier)
+{
+    ASSERT(!identifier.isSymbol());
+    JSString*& stringInMap = m_stringMap.add(identifier.impl(), nullptr).iterator->value;
+    if (!stringInMap)
+        stringInMap = jsOwnedString(vm(), identifier.string());
+
+    return emitLoad(dst, JSValue(stringInMap));
+}
+
+RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, JSValue v, SourceCodeRepresentation sourceCodeRepresentation)
+{
+    RegisterID* constantID = addConstantValue(v, sourceCodeRepresentation);
+    if (dst)
+        return emitMove(dst, constantID);
+    return constantID;
+}
+
+RegisterID* BytecodeGenerator::emitLoadGlobalObject(RegisterID* dst)
+{
+    if (!m_globalObjectRegister) {
+        int index = m_nextConstantOffset;
+        m_constantPoolRegisters.append(FirstConstantRegisterIndex + m_nextConstantOffset);
+        ++m_nextConstantOffset;
+        m_codeBlock->addConstant(JSValue());
+        m_globalObjectRegister = &m_constantPoolRegisters[index];
+        m_codeBlock->setGlobalObjectRegister(VirtualRegister(index));
+    }
+    if (dst)
+        emitMove(dst, m_globalObjectRegister);
+    return m_globalObjectRegister;
+}
+
+template<typename LookUpVarKindFunctor>
+bool BytecodeGenerator::instantiateLexicalVariables(const VariableEnvironment& lexicalVariables, SymbolTable* symbolTable, ScopeRegisterType scopeRegisterType, LookUpVarKindFunctor lookUpVarKind)
+{
+    bool hasCapturedVariables = false;
+    {
+        for (auto& entry : lexicalVariables) {
+            ASSERT(entry.value.isLet() || entry.value.isConst() || entry.value.isFunction());
+            ASSERT(!entry.value.isVar());
+            SymbolTableEntry symbolTableEntry = symbolTable->get(NoLockingNecessary, entry.key.get());
+            ASSERT(symbolTableEntry.isNull());
+
+            // Imported bindings which are not the namespace bindings are not allocated
+            // in the module environment as usual variables' way.
+            // And since these types of the variables only seen in the module environment,
+            // other lexical environment need not to take care this.
+            if (entry.value.isImported() && !entry.value.isImportedNamespace())
+                continue;
+
+            VarKind varKind = lookUpVarKind(entry.key.get(), entry.value);
+            VarOffset varOffset;
+            if (varKind == VarKind::Scope) {
+                varOffset = VarOffset(symbolTable->takeNextScopeOffset(NoLockingNecessary));
+                hasCapturedVariables = true;
+            } else {
+                ASSERT(varKind == VarKind::Stack);
+                RegisterID* local;
+                if (scopeRegisterType == ScopeRegisterType::Block) {
+                    local = newBlockScopeVariable();
+                    local->ref();
+                } else
+                    local = addVar();
+                varOffset = VarOffset(local->virtualRegister());
+            }
+
+            SymbolTableEntry newEntry(varOffset, entry.value.isConst() ? ReadOnly : 0);
+            symbolTable->add(NoLockingNecessary, entry.key.get(), newEntry);
+        }
+    }
+    return hasCapturedVariables;
+}
+
+void BytecodeGenerator::emitPrefillStackTDZVariables(const VariableEnvironment& lexicalVariables, SymbolTable* symbolTable)
+{
+    // Prefill stack variables with the TDZ empty value.
+    // Scope variables will be initialized to the TDZ empty value when JSLexicalEnvironment is allocated.
+    for (auto& entry : lexicalVariables) {
+        // Imported bindings which are not the namespace bindings are not allocated
+        // in the module environment as usual variables' way.
+        // And since these types of the variables only seen in the module environment,
+        // other lexical environment need not to take care this.
+        if (entry.value.isImported() && !entry.value.isImportedNamespace())
+            continue;
+
+        if (entry.value.isFunction())
+            continue;
+
+        SymbolTableEntry symbolTableEntry = symbolTable->get(NoLockingNecessary, entry.key.get());
+        ASSERT(!symbolTableEntry.isNull());
+        VarOffset offset = symbolTableEntry.varOffset();
+        if (offset.isScope())
+            continue;
+
+        ASSERT(offset.isStack());
+        emitMoveEmptyValue(&registerFor(offset.stackOffset()));
+    }
+}
+
+void BytecodeGenerator::pushLexicalScope(VariableEnvironmentNode* node, TDZCheckOptimization tdzCheckOptimization, NestedScopeType nestedScopeType, RegisterID** constantSymbolTableResult, bool shouldInitializeBlockScopedFunctions)
+{
+    VariableEnvironment& environment = node->lexicalVariables();
+    RegisterID* constantSymbolTableResultTemp = nullptr;
+    pushLexicalScopeInternal(environment, tdzCheckOptimization, nestedScopeType, &constantSymbolTableResultTemp, TDZRequirement::UnderTDZ, ScopeType::LetConstScope, ScopeRegisterType::Block);
+
+    if (shouldInitializeBlockScopedFunctions)
+        initializeBlockScopedFunctions(environment, node->functionStack(), constantSymbolTableResultTemp);
+
+    if (constantSymbolTableResult && constantSymbolTableResultTemp)
+        *constantSymbolTableResult = constantSymbolTableResultTemp;
+}
+
+void BytecodeGenerator::pushLexicalScopeInternal(VariableEnvironment& environment, TDZCheckOptimization tdzCheckOptimization, NestedScopeType nestedScopeType,
+    RegisterID** constantSymbolTableResult, TDZRequirement tdzRequirement, ScopeType scopeType, ScopeRegisterType scopeRegisterType)
+{
+    if (!environment.size())
+        return;
+
+    if (m_shouldEmitDebugHooks)
+        environment.markAllVariablesAsCaptured();
+
+    SymbolTable* symbolTable = SymbolTable::create(*m_vm);
+    switch (scopeType) {
+    case ScopeType::CatchScope:
+        symbolTable->setScopeType(SymbolTable::ScopeType::CatchScope);
+        break;
+    case ScopeType::LetConstScope:
+        symbolTable->setScopeType(SymbolTable::ScopeType::LexicalScope);
+        break;
+    case ScopeType::FunctionNameScope:
+        symbolTable->setScopeType(SymbolTable::ScopeType::FunctionNameScope);
+        break;
+    }
+
+    if (nestedScopeType == NestedScopeType::IsNested)
+        symbolTable->markIsNestedLexicalScope();
+
+    auto lookUpVarKind = [] (UniquedStringImpl*, const VariableEnvironmentEntry& entry) -> VarKind {
+        return entry.isCaptured() ? VarKind::Scope : VarKind::Stack;
+    };
+
+    bool hasCapturedVariables = instantiateLexicalVariables(environment, symbolTable, scopeRegisterType, lookUpVarKind);
+
+    RegisterID* newScope = nullptr;
+    RegisterID* constantSymbolTable = nullptr;
+    int symbolTableConstantIndex = 0;
+    if (vm()->typeProfiler()) {
+        constantSymbolTable = addConstantValue(symbolTable);
+        symbolTableConstantIndex = constantSymbolTable->index();
+    }
+    if (hasCapturedVariables) {
+        if (scopeRegisterType == ScopeRegisterType::Block) {
+            newScope = newBlockScopeVariable();
+            newScope->ref();
+        } else
+            newScope = addVar();
+        if (!constantSymbolTable) {
+            ASSERT(!vm()->typeProfiler());
+            constantSymbolTable = addConstantValue(symbolTable->cloneScopePart(*m_vm));
+            symbolTableConstantIndex = constantSymbolTable->index();
+        }
+        if (constantSymbolTableResult)
+            *constantSymbolTableResult = constantSymbolTable;
+
+        emitOpcode(op_create_lexical_environment);
+        instructions().append(newScope->index());
+        instructions().append(scopeRegister()->index());
+        instructions().append(constantSymbolTable->index());
+        instructions().append(addConstantValue(tdzRequirement == TDZRequirement::UnderTDZ ? jsTDZValue() : jsUndefined())->index());
+
+        emitMove(scopeRegister(), newScope);
+
+        pushLocalControlFlowScope();
+    }
+
+    bool isWithScope = false;
+    m_lexicalScopeStack.append({ symbolTable, newScope, isWithScope, symbolTableConstantIndex });
+    pushTDZVariables(environment, tdzCheckOptimization, tdzRequirement);
+
+    if (tdzRequirement == TDZRequirement::UnderTDZ)
+        emitPrefillStackTDZVariables(environment, symbolTable);
+}
+
+void BytecodeGenerator::initializeBlockScopedFunctions(VariableEnvironment& environment, FunctionStack& functionStack, RegisterID* constantSymbolTable)
+{
+    /*
+     * We must transform block scoped function declarations in strict mode like so:
+     *
+     * function foo() {
+     *     if (c) {
+     *           function foo() { ... }
+     *           if (bar) { ... }
+     *           else { ... }
+     *           function baz() { ... }
+     *     }
+     * }
+     *
+     * to:
+     *
+     * function foo() {
+     *     if (c) {
+     *         let foo = function foo() { ... }
+     *         let baz = function baz() { ... }
+     *         if (bar) { ... }
+     *         else { ... }
+     *     }
+     * }
+     * 
+     * But without the TDZ checks.
+    */
+
+    if (!environment.size()) {
+        RELEASE_ASSERT(!functionStack.size());
+        return;
+    }
+
+    if (!functionStack.size())
+        return;
+
+    SymbolTable* symbolTable = m_lexicalScopeStack.last().m_symbolTable;
+    RegisterID* scope = m_lexicalScopeStack.last().m_scope;
+    RefPtr<RegisterID> temp = newTemporary();
+    int symbolTableIndex = constantSymbolTable ? constantSymbolTable->index() : 0;
+    for (FunctionMetadataNode* function : functionStack) {
+        const Identifier& name = function->ident();
+        auto iter = environment.find(name.impl());
+        RELEASE_ASSERT(iter != environment.end());
+        RELEASE_ASSERT(iter->value.isFunction());
+        // We purposefully don't hold the symbol table lock around this loop because emitNewFunctionExpressionCommon may GC.
+        SymbolTableEntry entry = symbolTable->get(NoLockingNecessary, name.impl()); 
+        RELEASE_ASSERT(!entry.isNull());
+        emitNewFunctionExpressionCommon(temp.get(), function);
+        bool isLexicallyScoped = true;
+        emitPutToScope(scope, variableForLocalEntry(name, entry, symbolTableIndex, isLexicallyScoped), temp.get(), DoNotThrowIfNotFound, InitializationMode::Initialization);
+    }
+}
+
+void BytecodeGenerator::hoistSloppyModeFunctionIfNecessary(const Identifier& functionName)
+{
+    if (m_scopeNode->hasSloppyModeHoistedFunction(functionName.impl())) {
+        Variable currentFunctionVariable = variable(functionName);
+        RefPtr<RegisterID> currentValue;
+        if (RegisterID* local = currentFunctionVariable.local())
+            currentValue = local;
+        else {
+            RefPtr<RegisterID> scope = emitResolveScope(nullptr, currentFunctionVariable);
+            currentValue = emitGetFromScope(newTemporary(), scope.get(), currentFunctionVariable, DoNotThrowIfNotFound);
+        }
+        
+        ASSERT(m_varScopeLexicalScopeStackIndex);
+        ASSERT(*m_varScopeLexicalScopeStackIndex < m_lexicalScopeStack.size());
+        LexicalScopeStackEntry varScope = m_lexicalScopeStack[*m_varScopeLexicalScopeStackIndex];
+        SymbolTable* varSymbolTable = varScope.m_symbolTable;
+        ASSERT(varSymbolTable->scopeType() == SymbolTable::ScopeType::VarScope);
+        SymbolTableEntry entry = varSymbolTable->get(NoLockingNecessary, functionName.impl());
+        if (functionName == propertyNames().arguments && entry.isNull()) {
+            // "arguments" might be put in the parameter scope when we have a non-simple
+            // parameter list since "arguments" is visible to expressions inside the
+            // parameter evaluation list.
+            // e.g:
+            // function foo(x = arguments) { { function arguments() { } } }
+            RELEASE_ASSERT(*m_varScopeLexicalScopeStackIndex > 0);
+            varScope = m_lexicalScopeStack[*m_varScopeLexicalScopeStackIndex - 1];
+            SymbolTable* parameterSymbolTable = varScope.m_symbolTable;
+            entry = parameterSymbolTable->get(NoLockingNecessary, functionName.impl());
+        }
+        RELEASE_ASSERT(!entry.isNull());
+        bool isLexicallyScoped = false;
+        emitPutToScope(varScope.m_scope, variableForLocalEntry(functionName, entry, varScope.m_symbolTableConstantIndex, isLexicallyScoped), currentValue.get(), DoNotThrowIfNotFound, InitializationMode::NotInitialization);
+    }
+}
+
+void BytecodeGenerator::popLexicalScope(VariableEnvironmentNode* node)
+{
+    VariableEnvironment& environment = node->lexicalVariables();
+    popLexicalScopeInternal(environment);
+}
+
+void BytecodeGenerator::popLexicalScopeInternal(VariableEnvironment& environment)
+{
+    // NOTE: This function only makes sense for scopes that aren't ScopeRegisterType::Var (only function name scope right now is ScopeRegisterType::Var).
+    // This doesn't make sense for ScopeRegisterType::Var because we deref RegisterIDs here.
+    if (!environment.size())
+        return;
+
+    if (m_shouldEmitDebugHooks)
+        environment.markAllVariablesAsCaptured();
+
+    auto stackEntry = m_lexicalScopeStack.takeLast();
+    SymbolTable* symbolTable = stackEntry.m_symbolTable;
+    bool hasCapturedVariables = false;
+    for (auto& entry : environment) {
+        if (entry.value.isCaptured()) {
+            hasCapturedVariables = true;
+            continue;
+        }
+        SymbolTableEntry symbolTableEntry = symbolTable->get(NoLockingNecessary, entry.key.get());
+        ASSERT(!symbolTableEntry.isNull());
+        VarOffset offset = symbolTableEntry.varOffset();
+        ASSERT(offset.isStack());
+        RegisterID* local = &registerFor(offset.stackOffset());
+        local->deref();
+    }
+
+    if (hasCapturedVariables) {
+        RELEASE_ASSERT(stackEntry.m_scope);
+        emitPopScope(scopeRegister(), stackEntry.m_scope);
+        popLocalControlFlowScope();
+        stackEntry.m_scope->deref();
+    }
+
+    m_TDZStack.removeLast();
+}
+
+void BytecodeGenerator::prepareLexicalScopeForNextForLoopIteration(VariableEnvironmentNode* node, RegisterID* loopSymbolTable)
+{
+    VariableEnvironment& environment = node->lexicalVariables();
+    if (!environment.size())
+        return;
+    if (m_shouldEmitDebugHooks)
+        environment.markAllVariablesAsCaptured();
+    if (!environment.hasCapturedVariables())
+        return;
+
+    RELEASE_ASSERT(loopSymbolTable);
+
+    // This function needs to do setup for a for loop's activation if any of
+    // the for loop's lexically declared variables are captured (that is, variables
+    // declared in the loop header, not the loop body). This function needs to
+    // make a copy of the current activation and copy the values from the previous
+    // activation into the new activation because each iteration of a for loop
+    // gets a new activation.
+
+    auto stackEntry = m_lexicalScopeStack.last();
+    SymbolTable* symbolTable = stackEntry.m_symbolTable;
+    RegisterID* loopScope = stackEntry.m_scope;
+    ASSERT(symbolTable->scopeSize());
+    ASSERT(loopScope);
+    Vector<std::pair<RegisterID*, Identifier>> activationValuesToCopyOver;
+
+    {
+        activationValuesToCopyOver.reserveInitialCapacity(symbolTable->scopeSize());
+
+        for (auto end = symbolTable->end(NoLockingNecessary), ptr = symbolTable->begin(NoLockingNecessary); ptr != end; ++ptr) {
+            if (!ptr->value.varOffset().isScope())
+                continue;
+
+            RefPtr<UniquedStringImpl> ident = ptr->key;
+            Identifier identifier = Identifier::fromUid(m_vm, ident.get());
+
+            RegisterID* transitionValue = newBlockScopeVariable();
+            transitionValue->ref();
+            emitGetFromScope(transitionValue, loopScope, variableForLocalEntry(identifier, ptr->value, loopSymbolTable->index(), true), DoNotThrowIfNotFound);
+            activationValuesToCopyOver.uncheckedAppend(std::make_pair(transitionValue, identifier));
+        }
+    }
+
+    // We need this dynamic behavior of the executing code to ensure
+    // each loop iteration has a new activation object. (It's pretty ugly).
+    // Also, this new activation needs to be assigned to the same register
+    // as the previous scope because the loop body is compiled under
+    // the assumption that the scope's register index is constant even
+    // though the value in that register will change on each loop iteration.
+    RefPtr<RegisterID> parentScope = emitGetParentScope(newTemporary(), loopScope);
+    emitMove(scopeRegister(), parentScope.get());
+
+    emitOpcode(op_create_lexical_environment);
+    instructions().append(loopScope->index());
+    instructions().append(scopeRegister()->index());
+    instructions().append(loopSymbolTable->index());
+    instructions().append(addConstantValue(jsTDZValue())->index());
+
+    emitMove(scopeRegister(), loopScope);
+
+    {
+        for (auto pair : activationValuesToCopyOver) {
+            const Identifier& identifier = pair.second;
+            SymbolTableEntry entry = symbolTable->get(NoLockingNecessary, identifier.impl());
+            RELEASE_ASSERT(!entry.isNull());
+            RegisterID* transitionValue = pair.first;
+            emitPutToScope(loopScope, variableForLocalEntry(identifier, entry, loopSymbolTable->index(), true), transitionValue, DoNotThrowIfNotFound, InitializationMode::NotInitialization);
+            transitionValue->deref();
+        }
+    }
+}
+
+Variable BytecodeGenerator::variable(const Identifier& property, ThisResolutionType thisResolutionType)
+{
+    if (property == propertyNames().thisIdentifier && thisResolutionType == ThisResolutionType::Local) {
+        return Variable(property, VarOffset(thisRegister()->virtualRegister()), thisRegister(),
+            ReadOnly, Variable::SpecialVariable, 0, false);
+    }
+    
+    // We can optimize lookups if the lexical variable is found before a "with" or "catch"
+    // scope because we're guaranteed static resolution. If we have to pass through
+    // a "with" or "catch" scope we loose this guarantee.
+    // We can't optimize cases like this:
+    // {
+    //     let x = ...;
+    //     with (o) {
+    //         doSomethingWith(x);
+    //     }
+    // }
+    // Because we can't gaurantee static resolution on x.
+    // But, in this case, we are guaranteed static resolution:
+    // {
+    //     let x = ...;
+    //     with (o) {
+    //         let x = ...;
+    //         doSomethingWith(x);
+    //     }
+    // }
+    for (unsigned i = m_lexicalScopeStack.size(); i--; ) {
+        auto& stackEntry = m_lexicalScopeStack[i];
+        if (stackEntry.m_isWithScope)
+            return Variable(property);
+        SymbolTable* symbolTable = stackEntry.m_symbolTable;
+        SymbolTableEntry symbolTableEntry = symbolTable->get(NoLockingNecessary, property.impl());
+        if (symbolTableEntry.isNull())
+            continue;
+        bool resultIsCallee = false;
+        if (symbolTable->scopeType() == SymbolTable::ScopeType::FunctionNameScope) {
+            if (m_usesNonStrictEval) {
+                // We don't know if an eval has introduced a "var" named the same thing as the function name scope variable name.
+                // We resort to dynamic lookup to answer this question.
+                Variable result = Variable(property);
+                return result;
+            }
+            resultIsCallee = true;
+        }
+        Variable result = variableForLocalEntry(property, symbolTableEntry, stackEntry.m_symbolTableConstantIndex, symbolTable->scopeType() == SymbolTable::ScopeType::LexicalScope);
+        if (resultIsCallee)
+            result.setIsReadOnly();
+        return result;
+    }
+    
+    return Variable(property);
+}
+
+Variable BytecodeGenerator::variableForLocalEntry(
+    const Identifier& property, const SymbolTableEntry& entry, int symbolTableConstantIndex, bool isLexicallyScoped)
+{
+    VarOffset offset = entry.varOffset();
+    
+    RegisterID* local;
+    if (offset.isStack())
+        local = &registerFor(offset.stackOffset());
+    else
+        local = nullptr;
+    
+    return Variable(property, offset, local, entry.getAttributes(), Variable::NormalVariable, symbolTableConstantIndex, isLexicallyScoped);
+}
+
+void BytecodeGenerator::createVariable(
+    const Identifier& property, VarKind varKind, SymbolTable* symbolTable, ExistingVariableMode existingVariableMode)
+{
+    ASSERT(property != propertyNames().thisIdentifier);
+    SymbolTableEntry entry = symbolTable->get(NoLockingNecessary, property.impl());
+    
+    if (!entry.isNull()) {
+        if (existingVariableMode == IgnoreExisting)
+            return;
+        
+        // Do some checks to ensure that the variable we're being asked to create is sufficiently
+        // compatible with the one we have already created.
+
+        VarOffset offset = entry.varOffset();
+        
+        // We can't change our minds about whether it's captured.
+        if (offset.kind() != varKind) {
+            dataLog(
+                "Trying to add variable called ", property, " as ", varKind,
+                " but it was already added as ", offset, ".\n");
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        return;
+    }
+    
+    VarOffset varOffset;
+    if (varKind == VarKind::Scope)
+        varOffset = VarOffset(symbolTable->takeNextScopeOffset(NoLockingNecessary));
+    else {
+        ASSERT(varKind == VarKind::Stack);
+        varOffset = VarOffset(virtualRegisterForLocal(m_calleeLocals.size()));
+    }
+    SymbolTableEntry newEntry(varOffset, 0);
+    symbolTable->add(NoLockingNecessary, property.impl(), newEntry);
+    
+    if (varKind == VarKind::Stack) {
+        RegisterID* local = addVar();
+        RELEASE_ASSERT(local->index() == varOffset.stackOffset().offset());
+    }
+}
+
+RegisterID* BytecodeGenerator::emitOverridesHasInstance(RegisterID* dst, RegisterID* constructor, RegisterID* hasInstanceValue)
+{
+    emitOpcode(op_overrides_has_instance);
+    instructions().append(dst->index());
+    instructions().append(constructor->index());
+    instructions().append(hasInstanceValue->index());
+    return dst;
+}
+
+// Indicates the least upper bound of resolve type based on local scope. The bytecode linker
+// will start with this ResolveType and compute the least upper bound including intercepting scopes.
+ResolveType BytecodeGenerator::resolveType()
+{
+    for (unsigned i = m_lexicalScopeStack.size(); i--; ) {
+        if (m_lexicalScopeStack[i].m_isWithScope)
+            return Dynamic;
+        if (m_usesNonStrictEval && m_lexicalScopeStack[i].m_symbolTable->scopeType() == SymbolTable::ScopeType::FunctionNameScope) {
+            // We never want to assign to a FunctionNameScope. Returning Dynamic here achieves this goal.
+            // If we aren't in non-strict eval mode, then NodesCodeGen needs to take care not to emit
+            // a put_to_scope with the destination being the function name scope variable.
+            return Dynamic;
+        }
+    }
+
+    if (m_usesNonStrictEval)
+        return GlobalPropertyWithVarInjectionChecks;
+    return GlobalProperty;
+}
+
+RegisterID* BytecodeGenerator::emitResolveScope(RegisterID* dst, const Variable& variable)
+{
+    switch (variable.offset().kind()) {
+    case VarKind::Stack:
+        return nullptr;
+        
+    case VarKind::DirectArgument:
+        return argumentsRegister();
+        
+    case VarKind::Scope: {
+        // This always refers to the activation that *we* allocated, and not the current scope that code
+        // lives in. Note that this will change once we have proper support for block scoping. Once that
+        // changes, it will be correct for this code to return scopeRegister(). The only reason why we
+        // don't do that already is that m_lexicalEnvironment is required by ConstDeclNode. ConstDeclNode
+        // requires weird things because it is a shameful pile of nonsense, but block scoping would make
+        // that code sensible and obviate the need for us to do bad things.
+        for (unsigned i = m_lexicalScopeStack.size(); i--; ) {
+            auto& stackEntry = m_lexicalScopeStack[i];
+            // We should not resolve a variable to VarKind::Scope if a "with" scope lies in between the current
+            // scope and the resolved scope.
+            RELEASE_ASSERT(!stackEntry.m_isWithScope);
+
+            if (stackEntry.m_symbolTable->get(NoLockingNecessary, variable.ident().impl()).isNull())
+                continue;
+            
+            RegisterID* scope = stackEntry.m_scope;
+            RELEASE_ASSERT(scope);
+            return scope;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+        
+    }
+    case VarKind::Invalid:
+        // Indicates non-local resolution.
+        
+        m_codeBlock->addPropertyAccessInstruction(instructions().size());
+        
+        // resolve_scope dst, id, ResolveType, depth
+        dst = tempDestination(dst);
+        emitOpcode(op_resolve_scope);
+        instructions().append(kill(dst));
+        instructions().append(scopeRegister()->index());
+        instructions().append(addConstant(variable.ident()));
+        instructions().append(resolveType());
+        instructions().append(localScopeDepth());
+        instructions().append(0);
+        return dst;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+RegisterID* BytecodeGenerator::emitGetFromScope(RegisterID* dst, RegisterID* scope, const Variable& variable, ResolveMode resolveMode)
+{
+    switch (variable.offset().kind()) {
+    case VarKind::Stack:
+        return emitMove(dst, variable.local());
+        
+    case VarKind::DirectArgument: {
+        UnlinkedValueProfile profile = emitProfiledOpcode(op_get_from_arguments);
+        instructions().append(kill(dst));
+        instructions().append(scope->index());
+        instructions().append(variable.offset().capturedArgumentsOffset().offset());
+        instructions().append(profile);
+        return dst;
+    }
+        
+    case VarKind::Scope:
+    case VarKind::Invalid: {
+        m_codeBlock->addPropertyAccessInstruction(instructions().size());
+        
+        // get_from_scope dst, scope, id, GetPutInfo, Structure, Operand
+        UnlinkedValueProfile profile = emitProfiledOpcode(op_get_from_scope);
+        instructions().append(kill(dst));
+        instructions().append(scope->index());
+        instructions().append(addConstant(variable.ident()));
+        instructions().append(GetPutInfo(resolveMode, variable.offset().isScope() ? LocalClosureVar : resolveType(), InitializationMode::NotInitialization).operand());
+        instructions().append(localScopeDepth());
+        instructions().append(variable.offset().isScope() ? variable.offset().scopeOffset().offset() : 0);
+        instructions().append(profile);
+        return dst;
+    } }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+RegisterID* BytecodeGenerator::emitPutToScope(RegisterID* scope, const Variable& variable, RegisterID* value, ResolveMode resolveMode, InitializationMode initializationMode)
+{
+    switch (variable.offset().kind()) {
+    case VarKind::Stack:
+        emitMove(variable.local(), value);
+        return value;
+        
+    case VarKind::DirectArgument:
+        emitOpcode(op_put_to_arguments);
+        instructions().append(scope->index());
+        instructions().append(variable.offset().capturedArgumentsOffset().offset());
+        instructions().append(value->index());
+        return value;
+        
+    case VarKind::Scope:
+    case VarKind::Invalid: {
+        m_codeBlock->addPropertyAccessInstruction(instructions().size());
+        
+        // put_to_scope scope, id, value, GetPutInfo, Structure, Operand
+        emitOpcode(op_put_to_scope);
+        instructions().append(scope->index());
+        instructions().append(addConstant(variable.ident()));
+        instructions().append(value->index());
+        ScopeOffset offset;
+        if (variable.offset().isScope()) {
+            offset = variable.offset().scopeOffset();
+            instructions().append(GetPutInfo(resolveMode, LocalClosureVar, initializationMode).operand());
+            instructions().append(variable.symbolTableConstantIndex());
+        } else {
+            ASSERT(resolveType() != LocalClosureVar);
+            instructions().append(GetPutInfo(resolveMode, resolveType(), initializationMode).operand());
+            instructions().append(localScopeDepth());
+        }
+        instructions().append(!!offset ? offset.offset() : 0);
+        return value;
+    } }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+RegisterID* BytecodeGenerator::initializeVariable(const Variable& variable, RegisterID* value)
+{
+    RELEASE_ASSERT(variable.offset().kind() != VarKind::Invalid);
+    RegisterID* scope = emitResolveScope(nullptr, variable);
+    return emitPutToScope(scope, variable, value, ThrowIfNotFound, InitializationMode::NotInitialization);
+}
+
+RegisterID* BytecodeGenerator::emitInstanceOf(RegisterID* dst, RegisterID* value, RegisterID* basePrototype)
+{
+    emitOpcode(op_instanceof);
+    instructions().append(dst->index());
+    instructions().append(value->index());
+    instructions().append(basePrototype->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitInstanceOfCustom(RegisterID* dst, RegisterID* value, RegisterID* constructor, RegisterID* hasInstanceValue)
+{
+    emitOpcode(op_instanceof_custom);
+    instructions().append(dst->index());
+    instructions().append(value->index());
+    instructions().append(constructor->index());
+    instructions().append(hasInstanceValue->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitTryGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
+{
+    ASSERT_WITH_MESSAGE(!parseIndex(property), "Indexed properties are not supported with tryGetById.");
+
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_try_get_by_id);
+    instructions().append(kill(dst));
+    instructions().append(base->index());
+    instructions().append(addConstant(property));
+    instructions().append(profile);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
+{
+    ASSERT_WITH_MESSAGE(!parseIndex(property), "Indexed properties should be handled with get_by_val.");
+
+    m_codeBlock->addPropertyAccessInstruction(instructions().size());
+
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_by_id);
+    instructions().append(kill(dst));
+    instructions().append(base->index());
+    instructions().append(addConstant(property));
+    instructions().append(0);
+    instructions().append(0);
+    instructions().append(0);
+    instructions().append(Options::prototypeHitCountForLLIntCaching());
+    instructions().append(profile);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, RegisterID* thisVal, const Identifier& property)
+{
+    ASSERT_WITH_MESSAGE(!parseIndex(property), "Indexed properties should be handled with get_by_val.");
+
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_by_id_with_this);
+    instructions().append(kill(dst));
+    instructions().append(base->index());
+    instructions().append(thisVal->index());
+    instructions().append(addConstant(property));
+    instructions().append(profile);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitPutById(RegisterID* base, const Identifier& property, RegisterID* value)
+{
+    ASSERT_WITH_MESSAGE(!parseIndex(property), "Indexed properties should be handled with put_by_val.");
+
+    unsigned propertyIndex = addConstant(property);
+
+    m_staticPropertyAnalyzer.putById(base->index(), propertyIndex);
+
+    m_codeBlock->addPropertyAccessInstruction(instructions().size());
+
+    emitOpcode(op_put_by_id);
+    instructions().append(base->index());
+    instructions().append(propertyIndex);
+    instructions().append(value->index());
+    instructions().append(0); // old structure
+    instructions().append(0); // offset
+    instructions().append(0); // new structure
+    instructions().append(0); // structure chain
+    instructions().append(static_cast<int>(PutByIdNone)); // is not direct
+
+    return value;
+}
+
+RegisterID* BytecodeGenerator::emitPutById(RegisterID* base, RegisterID* thisValue, const Identifier& property, RegisterID* value)
+{
+    ASSERT_WITH_MESSAGE(!parseIndex(property), "Indexed properties should be handled with put_by_val.");
+
+    unsigned propertyIndex = addConstant(property);
+
+    emitOpcode(op_put_by_id_with_this);
+    instructions().append(base->index());
+    instructions().append(thisValue->index());
+    instructions().append(propertyIndex);
+    instructions().append(value->index());
+
+    return value;
+}
+
+RegisterID* BytecodeGenerator::emitDirectPutById(RegisterID* base, const Identifier& property, RegisterID* value, PropertyNode::PutType putType)
+{
+    ASSERT_WITH_MESSAGE(!parseIndex(property), "Indexed properties should be handled with put_by_val(direct).");
+
+    unsigned propertyIndex = addConstant(property);
+
+    m_staticPropertyAnalyzer.putById(base->index(), propertyIndex);
+
+    m_codeBlock->addPropertyAccessInstruction(instructions().size());
+    
+    emitOpcode(op_put_by_id);
+    instructions().append(base->index());
+    instructions().append(propertyIndex);
+    instructions().append(value->index());
+    instructions().append(0); // old structure
+    instructions().append(0); // offset
+    instructions().append(0); // new structure
+    instructions().append(0); // structure chain (unused if direct)
+    instructions().append(static_cast<int>((putType == PropertyNode::KnownDirect || property != m_vm->propertyNames->underscoreProto) ? PutByIdIsDirect : PutByIdNone));
+    return value;
+}
+
+void BytecodeGenerator::emitPutGetterById(RegisterID* base, const Identifier& property, unsigned attributes, RegisterID* getter)
+{
+    unsigned propertyIndex = addConstant(property);
+    m_staticPropertyAnalyzer.putById(base->index(), propertyIndex);
+
+    emitOpcode(op_put_getter_by_id);
+    instructions().append(base->index());
+    instructions().append(propertyIndex);
+    instructions().append(attributes);
+    instructions().append(getter->index());
+}
+
+void BytecodeGenerator::emitPutSetterById(RegisterID* base, const Identifier& property, unsigned attributes, RegisterID* setter)
+{
+    unsigned propertyIndex = addConstant(property);
+    m_staticPropertyAnalyzer.putById(base->index(), propertyIndex);
+
+    emitOpcode(op_put_setter_by_id);
+    instructions().append(base->index());
+    instructions().append(propertyIndex);
+    instructions().append(attributes);
+    instructions().append(setter->index());
+}
+
+void BytecodeGenerator::emitPutGetterSetter(RegisterID* base, const Identifier& property, unsigned attributes, RegisterID* getter, RegisterID* setter)
+{
+    unsigned propertyIndex = addConstant(property);
+
+    m_staticPropertyAnalyzer.putById(base->index(), propertyIndex);
+
+    emitOpcode(op_put_getter_setter_by_id);
+    instructions().append(base->index());
+    instructions().append(propertyIndex);
+    instructions().append(attributes);
+    instructions().append(getter->index());
+    instructions().append(setter->index());
+}
+
+void BytecodeGenerator::emitPutGetterByVal(RegisterID* base, RegisterID* property, unsigned attributes, RegisterID* getter)
+{
+    emitOpcode(op_put_getter_by_val);
+    instructions().append(base->index());
+    instructions().append(property->index());
+    instructions().append(attributes);
+    instructions().append(getter->index());
+}
+
+void BytecodeGenerator::emitPutSetterByVal(RegisterID* base, RegisterID* property, unsigned attributes, RegisterID* setter)
+{
+    emitOpcode(op_put_setter_by_val);
+    instructions().append(base->index());
+    instructions().append(property->index());
+    instructions().append(attributes);
+    instructions().append(setter->index());
+}
+
+void BytecodeGenerator::emitPutGeneratorFields(RegisterID* nextFunction)
+{
+    // FIXME: Currently, we just create an object and store generator related fields as its properties for ease.
+    // But to make it efficient, we will introduce JSGenerator class, add opcode new_generator and use its C++ fields instead of these private properties.
+    // https://bugs.webkit.org/show_bug.cgi?id=151545
+
+    emitDirectPutById(m_generatorRegister, propertyNames().builtinNames().generatorNextPrivateName(), nextFunction, PropertyNode::KnownDirect);
+
+    emitDirectPutById(m_generatorRegister, propertyNames().builtinNames().generatorThisPrivateName(), &m_thisRegister, PropertyNode::KnownDirect);
+
+    emitDirectPutById(m_generatorRegister, propertyNames().builtinNames().generatorStatePrivateName(), emitLoad(nullptr, jsNumber(0)), PropertyNode::KnownDirect);
+
+    emitDirectPutById(m_generatorRegister, propertyNames().builtinNames().generatorFramePrivateName(), emitLoad(nullptr, jsNull()), PropertyNode::KnownDirect);
+}
+
+RegisterID* BytecodeGenerator::emitDeleteById(RegisterID* dst, RegisterID* base, const Identifier& property)
+{
+    emitOpcode(op_del_by_id);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(addConstant(property));
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitGetByVal(RegisterID* dst, RegisterID* base, RegisterID* property)
+{
+    for (size_t i = m_forInContextStack.size(); i > 0; i--) {
+        ForInContext* context = m_forInContextStack[i - 1].get();
+        if (context->local() != property)
+            continue;
+
+        if (!context->isValid())
+            break;
+
+        if (context->type() == ForInContext::IndexedForInContextType) {
+            property = static_cast<IndexedForInContext*>(context)->index();
+            break;
+        }
+
+        ASSERT(context->type() == ForInContext::StructureForInContextType);
+        StructureForInContext* structureContext = static_cast<StructureForInContext*>(context);
+        UnlinkedValueProfile profile = emitProfiledOpcode(op_get_direct_pname);
+        instructions().append(kill(dst));
+        instructions().append(base->index());
+        instructions().append(property->index());
+        instructions().append(structureContext->index()->index());
+        instructions().append(structureContext->enumerator()->index());
+        instructions().append(profile);
+        return dst;
+    }
+
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_by_val);
+    instructions().append(kill(dst));
+    instructions().append(base->index());
+    instructions().append(property->index());
+    instructions().append(arrayProfile);
+    instructions().append(profile);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitGetByVal(RegisterID* dst, RegisterID* base, RegisterID* thisValue, RegisterID* property)
+{
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_by_val_with_this);
+    instructions().append(kill(dst));
+    instructions().append(base->index());
+    instructions().append(thisValue->index());
+    instructions().append(property->index());
+    instructions().append(profile);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitPutByVal(RegisterID* base, RegisterID* property, RegisterID* value)
+{
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
+    emitOpcode(op_put_by_val);
+    instructions().append(base->index());
+    instructions().append(property->index());
+    instructions().append(value->index());
+    instructions().append(arrayProfile);
+
+    return value;
+}
+
+RegisterID* BytecodeGenerator::emitPutByVal(RegisterID* base, RegisterID* thisValue, RegisterID* property, RegisterID* value)
+{
+    emitOpcode(op_put_by_val_with_this);
+    instructions().append(base->index());
+    instructions().append(thisValue->index());
+    instructions().append(property->index());
+    instructions().append(value->index());
+
+    return value;
+}
+
+RegisterID* BytecodeGenerator::emitDirectPutByVal(RegisterID* base, RegisterID* property, RegisterID* value)
+{
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
+    emitOpcode(op_put_by_val_direct);
+    instructions().append(base->index());
+    instructions().append(property->index());
+    instructions().append(value->index());
+    instructions().append(arrayProfile);
+    return value;
+}
+
+RegisterID* BytecodeGenerator::emitDeleteByVal(RegisterID* dst, RegisterID* base, RegisterID* property)
+{
+    emitOpcode(op_del_by_val);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(property->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitPutByIndex(RegisterID* base, unsigned index, RegisterID* value)
+{
+    emitOpcode(op_put_by_index);
+    instructions().append(base->index());
+    instructions().append(index);
+    instructions().append(value->index());
+    return value;
+}
+
+RegisterID* BytecodeGenerator::emitAssert(RegisterID* condition, int line)
+{
+    emitOpcode(op_assert);
+    instructions().append(condition->index());
+    instructions().append(line);
+    return condition;
+}
+
+RegisterID* BytecodeGenerator::emitGetArgument(RegisterID* dst, int32_t index)
+{
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_get_argument);
+    instructions().append(dst->index());
+    instructions().append(index + 1); // Including |this|.
+    instructions().append(profile);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitCreateThis(RegisterID* dst)
+{
+    size_t begin = instructions().size();
+    m_staticPropertyAnalyzer.createThis(dst->index(), begin + 3);
+
+    m_codeBlock->addPropertyAccessInstruction(instructions().size());
+    emitOpcode(op_create_this); 
+    instructions().append(dst->index());
+    instructions().append(dst->index());
+    instructions().append(0);
+    instructions().append(0);
+    return dst;
+}
+
+void BytecodeGenerator::emitTDZCheck(RegisterID* target)
+{
+    emitOpcode(op_check_tdz);
+    instructions().append(target->index());
+}
+
+bool BytecodeGenerator::needsTDZCheck(const Variable& variable)
+{
+    for (unsigned i = m_TDZStack.size(); i--;) {
+        auto iter = m_TDZStack[i].find(variable.ident().impl());
+        if (iter == m_TDZStack[i].end())
+            continue;
+        return iter->value != TDZNecessityLevel::NotNeeded;
+    }
+
+    return false;
+}
+
+void BytecodeGenerator::emitTDZCheckIfNecessary(const Variable& variable, RegisterID* target, RegisterID* scope)
+{
+    if (needsTDZCheck(variable)) {
+        if (target)
+            emitTDZCheck(target);
+        else {
+            RELEASE_ASSERT(!variable.isLocal() && scope);
+            RefPtr<RegisterID> result = emitGetFromScope(newTemporary(), scope, variable, DoNotThrowIfNotFound);
+            emitTDZCheck(result.get());
+        }
+    }
+}
+
+void BytecodeGenerator::liftTDZCheckIfPossible(const Variable& variable)
+{
+    RefPtr<UniquedStringImpl> identifier(variable.ident().impl());
+    for (unsigned i = m_TDZStack.size(); i--;) {
+        auto iter = m_TDZStack[i].find(identifier);
+        if (iter != m_TDZStack[i].end()) {
+            if (iter->value == TDZNecessityLevel::Optimize)
+                iter->value = TDZNecessityLevel::NotNeeded;
+            break;
+        }
+    }
+}
+
+void BytecodeGenerator::pushTDZVariables(const VariableEnvironment& environment, TDZCheckOptimization optimization, TDZRequirement requirement)
+{
+    if (!environment.size())
+        return;
+    
+    TDZNecessityLevel level;
+    if (requirement == TDZRequirement::UnderTDZ) {
+        if (optimization == TDZCheckOptimization::Optimize)
+            level = TDZNecessityLevel::Optimize;
+        else
+            level = TDZNecessityLevel::DoNotOptimize;
+    } else
+        level = TDZNecessityLevel::NotNeeded;
+    
+    TDZMap map;
+    for (const auto& entry : environment)
+        map.add(entry.key, entry.value.isFunction() ? TDZNecessityLevel::NotNeeded : level);
+
+    m_TDZStack.append(WTFMove(map));
+}
+
+void BytecodeGenerator::getVariablesUnderTDZ(VariableEnvironment& result)
+{
+    // We keep track of variablesThatDontNeedTDZ in this algorithm to prevent
+    // reporting that "x" is under TDZ if this function is called at "...".
+    //
+    //     {
+    //         {
+    //             let x;
+    //             ...
+    //         }
+    //         let x;
+    //     }
+    //
+    SmallPtrSet<UniquedStringImpl*, 16> variablesThatDontNeedTDZ;
+    for (unsigned i = m_TDZStack.size(); i--; ) {
+        auto& map = m_TDZStack[i];
+        for (auto& entry : map)  {
+            if (entry.value != TDZNecessityLevel::NotNeeded) {
+                if (!variablesThatDontNeedTDZ.contains(entry.key.get()))
+                    result.add(entry.key.get());
+            } else
+                variablesThatDontNeedTDZ.add(entry.key.get());
+        }
+    }
+}
+
+RegisterID* BytecodeGenerator::emitNewObject(RegisterID* dst)
+{
+    size_t begin = instructions().size();
+    m_staticPropertyAnalyzer.newObject(dst->index(), begin + 2);
+
+    emitOpcode(op_new_object);
+    instructions().append(dst->index());
+    instructions().append(0);
+    instructions().append(newObjectAllocationProfile());
+    return dst;
+}
+
+unsigned BytecodeGenerator::addConstantBuffer(unsigned length)
+{
+    return m_codeBlock->addConstantBuffer(length);
+}
+
+JSString* BytecodeGenerator::addStringConstant(const Identifier& identifier)
+{
+    JSString*& stringInMap = m_stringMap.add(identifier.impl(), nullptr).iterator->value;
+    if (!stringInMap) {
+        stringInMap = jsString(vm(), identifier.string());
+        addConstantValue(stringInMap);
+    }
+    return stringInMap;
+}
+
+JSTemplateRegistryKey* BytecodeGenerator::addTemplateRegistryKeyConstant(Ref<TemplateRegistryKey>&& templateRegistryKey)
+{
+    return m_templateRegistryKeyMap.ensure(templateRegistryKey.copyRef(), [&] {
+        auto* result = JSTemplateRegistryKey::create(*vm(), WTFMove(templateRegistryKey));
+        addConstantValue(result);
+        return result;
+    }).iterator->value;
+}
+
+RegisterID* BytecodeGenerator::emitNewArray(RegisterID* dst, ElementNode* elements, unsigned length)
+{
+#if !ASSERT_DISABLED
+    unsigned checkLength = 0;
+#endif
+    bool hadVariableExpression = false;
+    if (length) {
+        for (ElementNode* n = elements; n; n = n->next()) {
+            if (!n->value()->isConstant()) {
+                hadVariableExpression = true;
+                break;
+            }
+            if (n->elision())
+                break;
+#if !ASSERT_DISABLED
+            checkLength++;
+#endif
+        }
+        if (!hadVariableExpression) {
+            ASSERT(length == checkLength);
+            unsigned constantBufferIndex = addConstantBuffer(length);
+            JSValue* constantBuffer = m_codeBlock->constantBuffer(constantBufferIndex).data();
+            unsigned index = 0;
+            for (ElementNode* n = elements; index < length; n = n->next()) {
+                ASSERT(n->value()->isConstant());
+                constantBuffer[index++] = static_cast<ConstantNode*>(n->value())->jsValue(*this);
+            }
+            emitOpcode(op_new_array_buffer);
+            instructions().append(dst->index());
+            instructions().append(constantBufferIndex);
+            instructions().append(length);
+            instructions().append(newArrayAllocationProfile());
+            return dst;
+        }
+    }
+
+    Vector<RefPtr<RegisterID>, 16, UnsafeVectorOverflow> argv;
+    for (ElementNode* n = elements; n; n = n->next()) {
+        if (!length)
+            break;
+        length--;
+        ASSERT(!n->value()->isSpreadExpression());
+        argv.append(newTemporary());
+        // op_new_array requires the initial values to be a sequential range of registers
+        ASSERT(argv.size() == 1 || argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() - 1);
+        emitNode(argv.last().get(), n->value());
+    }
+    ASSERT(!length);
+    emitOpcode(op_new_array);
+    instructions().append(dst->index());
+    instructions().append(argv.size() ? argv[0]->index() : 0); // argv
+    instructions().append(argv.size()); // argc
+    instructions().append(newArrayAllocationProfile());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNewArrayWithSpread(RegisterID* dst, ElementNode* elements)
+{
+    BitVector bitVector;
+    Vector<RefPtr<RegisterID>, 16> argv;
+    for (ElementNode* node = elements; node; node = node->next()) {
+        bitVector.set(argv.size(), node->value()->isSpreadExpression());
+
+        argv.append(newTemporary());
+        // op_new_array_with_spread requires the initial values to be a sequential range of registers.
+        RELEASE_ASSERT(argv.size() == 1 || argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() - 1);
+    }
+
+    RELEASE_ASSERT(argv.size());
+
+    {
+        unsigned i = 0;
+        for (ElementNode* node = elements; node; node = node->next()) {
+            if (node->value()->isSpreadExpression()) {
+                ExpressionNode* expression = static_cast<SpreadExpressionNode*>(node->value())->expression();
+                RefPtr<RegisterID> tmp = newTemporary();
+                emitNode(tmp.get(), expression);
+
+                emitOpcode(op_spread);
+                instructions().append(argv[i].get()->index());
+                instructions().append(tmp.get()->index());
+            } else {
+                ExpressionNode* expression = node->value();
+                emitNode(argv[i].get(), expression);
+            }
+            i++;
+        }
+    }
+
+    unsigned bitVectorIndex = m_codeBlock->addBitVector(WTFMove(bitVector));
+    emitOpcode(op_new_array_with_spread);
+    instructions().append(dst->index());
+    instructions().append(argv[0]->index()); // argv
+    instructions().append(argv.size()); // argc
+    instructions().append(bitVectorIndex);
+
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNewArrayWithSize(RegisterID* dst, RegisterID* length)
+{
+    emitOpcode(op_new_array_with_size);
+    instructions().append(dst->index());
+    instructions().append(length->index());
+    instructions().append(newArrayAllocationProfile());
+
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, RegExp* regExp)
+{
+    emitOpcode(op_new_regexp);
+    instructions().append(dst->index());
+    instructions().append(addRegExp(regExp));
+    return dst;
+}
+
+void BytecodeGenerator::emitNewFunctionExpressionCommon(RegisterID* dst, FunctionMetadataNode* function)
+{
+    unsigned index = m_codeBlock->addFunctionExpr(makeFunction(function));
+
+    OpcodeID opcodeID = op_new_func_exp;
+    switch (function->parseMode()) {
+    case SourceParseMode::GeneratorWrapperFunctionMode:
+        opcodeID = op_new_generator_func_exp;
+        break;
+    case SourceParseMode::AsyncFunctionMode:
+    case SourceParseMode::AsyncMethodMode:
+    case SourceParseMode::AsyncArrowFunctionMode:
+        opcodeID = op_new_async_func_exp;
+        break;
+    default:
+        break;
+    }
+    
+    emitOpcode(opcodeID);
+    instructions().append(dst->index());
+    instructions().append(scopeRegister()->index());
+    instructions().append(index);
+}
+
+RegisterID* BytecodeGenerator::emitNewFunctionExpression(RegisterID* dst, FuncExprNode* func)
+{
+    emitNewFunctionExpressionCommon(dst, func->metadata());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNewArrowFunctionExpression(RegisterID* dst, ArrowFuncExprNode* func)
+{
+    ASSERT(SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(func->metadata()->parseMode()));
+    emitNewFunctionExpressionCommon(dst, func->metadata());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNewMethodDefinition(RegisterID* dst, MethodDefinitionNode* func)
+{
+    ASSERT(isMethodParseMode(func->metadata()->parseMode()));
+    emitNewFunctionExpressionCommon(dst, func->metadata());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNewDefaultConstructor(RegisterID* dst, ConstructorKind constructorKind, const Identifier& name,
+    const Identifier& ecmaName, const SourceCode& classSource)
+{
+    UnlinkedFunctionExecutable* executable = m_vm->builtinExecutables()->createDefaultConstructor(constructorKind, name);
+    executable->setInvalidTypeProfilingOffsets();
+    executable->setEcmaName(ecmaName);
+    executable->setClassSource(classSource);
+
+    unsigned index = m_codeBlock->addFunctionExpr(executable);
+
+    emitOpcode(op_new_func_exp);
+    instructions().append(dst->index());
+    instructions().append(scopeRegister()->index());
+    instructions().append(index);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FunctionMetadataNode* function)
+{
+    unsigned index = m_codeBlock->addFunctionDecl(makeFunction(function));
+    if (function->parseMode() == SourceParseMode::GeneratorWrapperFunctionMode)
+        emitOpcode(op_new_generator_func);
+    else if (function->parseMode() == SourceParseMode::AsyncFunctionMode)
+        emitOpcode(op_new_async_func);
+    else
+        emitOpcode(op_new_func);
+    instructions().append(dst->index());
+    instructions().append(scopeRegister()->index());
+    instructions().append(index);
+    return dst;
+}
+
+void BytecodeGenerator::emitSetFunctionNameIfNeeded(ExpressionNode* valueNode, RegisterID* value, RegisterID* name)
+{
+    if (valueNode->isBaseFuncExprNode()) {
+        FunctionMetadataNode* metadata = static_cast<BaseFuncExprNode*>(valueNode)->metadata();
+        if (!metadata->ecmaName().isNull())
+            return;
+    } else if (valueNode->isClassExprNode()) {
+        ClassExprNode* classExprNode = static_cast<ClassExprNode*>(valueNode);
+        if (!classExprNode->ecmaName().isNull())
+            return;
+        if (classExprNode->hasStaticProperty(m_vm->propertyNames->name))
+            return;
+    } else
+        return;
+
+    // FIXME: We should use an op_call to an internal function here instead.
+    // https://bugs.webkit.org/show_bug.cgi?id=155547
+    emitOpcode(op_set_function_name);
+    instructions().append(value->index());
+    instructions().append(name->index());
+}
+
+RegisterID* BytecodeGenerator::emitCall(RegisterID* dst, RegisterID* func, ExpectedFunction expectedFunction, CallArguments& callArguments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    return emitCall(op_call, dst, func, expectedFunction, callArguments, divot, divotStart, divotEnd, debuggableCall);
+}
+
+RegisterID* BytecodeGenerator::emitCallInTailPosition(RegisterID* dst, RegisterID* func, ExpectedFunction expectedFunction, CallArguments& callArguments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    return emitCall(m_inTailPosition ? op_tail_call : op_call, dst, func, expectedFunction, callArguments, divot, divotStart, divotEnd, debuggableCall);
+}
+
+RegisterID* BytecodeGenerator::emitCallEval(RegisterID* dst, RegisterID* func, CallArguments& callArguments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    return emitCall(op_call_eval, dst, func, NoExpectedFunction, callArguments, divot, divotStart, divotEnd, debuggableCall);
+}
+
+ExpectedFunction BytecodeGenerator::expectedFunctionForIdentifier(const Identifier& identifier)
+{
+    if (identifier == propertyNames().Object || identifier == propertyNames().builtinNames().ObjectPrivateName())
+        return ExpectObjectConstructor;
+    if (identifier == propertyNames().Array || identifier == propertyNames().builtinNames().ArrayPrivateName())
+        return ExpectArrayConstructor;
+    return NoExpectedFunction;
+}
+
+ExpectedFunction BytecodeGenerator::emitExpectedFunctionSnippet(RegisterID* dst, RegisterID* func, ExpectedFunction expectedFunction, CallArguments& callArguments, Label* done)
+{
+    RefPtr<Label> realCall = newLabel();
+    switch (expectedFunction) {
+    case ExpectObjectConstructor: {
+        // If the number of arguments is non-zero, then we can't do anything interesting.
+        if (callArguments.argumentCountIncludingThis() >= 2)
+            return NoExpectedFunction;
+        
+        size_t begin = instructions().size();
+        emitOpcode(op_jneq_ptr);
+        instructions().append(func->index());
+        instructions().append(Special::ObjectConstructor);
+        instructions().append(realCall->bind(begin, instructions().size()));
+        instructions().append(0);
+        
+        if (dst != ignoredResult())
+            emitNewObject(dst);
+        break;
+    }
+        
+    case ExpectArrayConstructor: {
+        // If you're doing anything other than "new Array()" or "new Array(foo)" then we
+        // don't do inline it, for now. The only reason is that call arguments are in
+        // the opposite order of what op_new_array expects, so we'd either need to change
+        // how op_new_array works or we'd need an op_new_array_reverse. Neither of these
+        // things sounds like it's worth it.
+        if (callArguments.argumentCountIncludingThis() > 2)
+            return NoExpectedFunction;
+        
+        size_t begin = instructions().size();
+        emitOpcode(op_jneq_ptr);
+        instructions().append(func->index());
+        instructions().append(Special::ArrayConstructor);
+        instructions().append(realCall->bind(begin, instructions().size()));
+        instructions().append(0);
+        
+        if (dst != ignoredResult()) {
+            if (callArguments.argumentCountIncludingThis() == 2)
+                emitNewArrayWithSize(dst, callArguments.argumentRegister(0));
+            else {
+                ASSERT(callArguments.argumentCountIncludingThis() == 1);
+                emitOpcode(op_new_array);
+                instructions().append(dst->index());
+                instructions().append(0);
+                instructions().append(0);
+                instructions().append(newArrayAllocationProfile());
+            }
+        }
+        break;
+    }
+        
+    default:
+        ASSERT(expectedFunction == NoExpectedFunction);
+        return NoExpectedFunction;
+    }
+    
+    size_t begin = instructions().size();
+    emitOpcode(op_jmp);
+    instructions().append(done->bind(begin, instructions().size()));
+    emitLabel(realCall.get());
+    
+    return expectedFunction;
+}
+
+RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, RegisterID* func, ExpectedFunction expectedFunction, CallArguments& callArguments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    ASSERT(opcodeID == op_call || opcodeID == op_call_eval || opcodeID == op_tail_call);
+    ASSERT(func->refCount());
+    
+    // Generate code for arguments.
+    unsigned argument = 0;
+    if (callArguments.argumentsNode()) {
+        ArgumentListNode* n = callArguments.argumentsNode()->m_listNode;
+        if (n && n->m_expr->isSpreadExpression()) {
+            RELEASE_ASSERT(!n->m_next);
+            auto expression = static_cast<SpreadExpressionNode*>(n->m_expr)->expression();
+            RefPtr<RegisterID> argumentRegister;
+            argumentRegister = expression->emitBytecode(*this, callArguments.argumentRegister(0));
+            RefPtr<RegisterID> thisRegister = emitMove(newTemporary(), callArguments.thisRegister());
+            return emitCallVarargs(opcodeID == op_tail_call ? op_tail_call_varargs : op_call_varargs, dst, func, callArguments.thisRegister(), argumentRegister.get(), newTemporary(), 0, divot, divotStart, divotEnd, debuggableCall);
+        }
+        for (; n; n = n->m_next)
+            emitNode(callArguments.argumentRegister(argument++), n);
+    }
+    
+    // Reserve space for call frame.
+    Vector<RefPtr<RegisterID>, CallFrame::headerSizeInRegisters, UnsafeVectorOverflow> callFrame;
+    for (int i = 0; i < CallFrame::headerSizeInRegisters; ++i)
+        callFrame.append(newTemporary());
+
+    if (m_shouldEmitDebugHooks && debuggableCall == DebuggableCall::Yes)
+        emitDebugHook(WillExecuteExpression, divotStart);
+
+    emitExpressionInfo(divot, divotStart, divotEnd);
+
+    RefPtr<Label> done = newLabel();
+    expectedFunction = emitExpectedFunctionSnippet(dst, func, expectedFunction, callArguments, done.get());
+    
+    if (opcodeID == op_tail_call)
+        emitLogShadowChickenTailIfNecessary();
+    
+    // Emit call.
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
+    UnlinkedValueProfile profile = emitProfiledOpcode(opcodeID);
+    ASSERT(dst);
+    ASSERT(dst != ignoredResult());
+    instructions().append(dst->index());
+    instructions().append(func->index());
+    instructions().append(callArguments.argumentCountIncludingThis());
+    instructions().append(callArguments.stackOffset());
+    instructions().append(m_codeBlock->addLLIntCallLinkInfo());
+    instructions().append(0);
+    instructions().append(arrayProfile);
+    instructions().append(profile);
+    
+    if (expectedFunction != NoExpectedFunction)
+        emitLabel(done.get());
+
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitCallVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    return emitCallVarargs(op_call_varargs, dst, func, thisRegister, arguments, firstFreeRegister, firstVarArgOffset, divot, divotStart, divotEnd, debuggableCall);
+}
+
+RegisterID* BytecodeGenerator::emitCallVarargsInTailPosition(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    return emitCallVarargs(m_inTailPosition ? op_tail_call_varargs : op_call_varargs, dst, func, thisRegister, arguments, firstFreeRegister, firstVarArgOffset, divot, divotStart, divotEnd, debuggableCall);
+}
+
+RegisterID* BytecodeGenerator::emitConstructVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    return emitCallVarargs(op_construct_varargs, dst, func, thisRegister, arguments, firstFreeRegister, firstVarArgOffset, divot, divotStart, divotEnd, debuggableCall);
+}
+
+RegisterID* BytecodeGenerator::emitCallForwardArgumentsInTailPosition(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    ASSERT(m_inTailPosition);
+    return emitCallVarargs(op_tail_call_forward_arguments, dst, func, thisRegister, nullptr, firstFreeRegister, firstVarArgOffset, divot, divotStart, divotEnd, debuggableCall);
+}
+    
+RegisterID* BytecodeGenerator::emitCallVarargs(OpcodeID opcode, RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall debuggableCall)
+{
+    if (m_shouldEmitDebugHooks && debuggableCall == DebuggableCall::Yes)
+        emitDebugHook(WillExecuteExpression, divotStart);
+
+    emitExpressionInfo(divot, divotStart, divotEnd);
+
+    if (opcode == op_tail_call_varargs)
+        emitLogShadowChickenTailIfNecessary();
+    
+    // Emit call.
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
+    UnlinkedValueProfile profile = emitProfiledOpcode(opcode);
+    ASSERT(dst != ignoredResult());
+    instructions().append(dst->index());
+    instructions().append(func->index());
+    instructions().append(thisRegister ? thisRegister->index() : 0);
+    instructions().append(arguments ? arguments->index() : 0);
+    instructions().append(firstFreeRegister->index());
+    instructions().append(firstVarArgOffset);
+    instructions().append(arrayProfile);
+    instructions().append(profile);
+    return dst;
+}
+
+void BytecodeGenerator::emitLogShadowChickenPrologueIfNecessary()
+{
+    if (!m_shouldEmitDebugHooks && !Options::alwaysUseShadowChicken())
+        return;
+    emitOpcode(op_log_shadow_chicken_prologue);
+    instructions().append(scopeRegister()->index());
+}
+
+void BytecodeGenerator::emitLogShadowChickenTailIfNecessary()
+{
+    if (!m_shouldEmitDebugHooks && !Options::alwaysUseShadowChicken())
+        return;
+    emitOpcode(op_log_shadow_chicken_tail);
+    instructions().append(thisRegister()->index());
+    instructions().append(scopeRegister()->index());
+}
+
+void BytecodeGenerator::emitCallDefineProperty(RegisterID* newObj, RegisterID* propertyNameRegister,
+    RegisterID* valueRegister, RegisterID* getterRegister, RegisterID* setterRegister, unsigned options, const JSTextPosition& position)
+{
+    DefinePropertyAttributes attributes;
+    if (options & PropertyConfigurable)
+        attributes.setConfigurable(true);
+
+    if (options & PropertyWritable)
+        attributes.setWritable(true);
+    else if (valueRegister)
+        attributes.setWritable(false);
+
+    if (options & PropertyEnumerable)
+        attributes.setEnumerable(true);
+
+    if (valueRegister)
+        attributes.setValue();
+    if (getterRegister)
+        attributes.setGet();
+    if (setterRegister)
+        attributes.setSet();
+
+    ASSERT(!valueRegister || (!getterRegister && !setterRegister));
+
+    emitExpressionInfo(position, position, position);
+
+    if (attributes.hasGet() || attributes.hasSet()) {
+        RefPtr<RegisterID> throwTypeErrorFunction;
+        if (!attributes.hasGet() || !attributes.hasSet())
+            throwTypeErrorFunction = emitMoveLinkTimeConstant(nullptr, LinkTimeConstant::ThrowTypeErrorFunction);
+
+        RefPtr<RegisterID> getter;
+        if (attributes.hasGet())
+            getter = getterRegister;
+        else
+            getter = throwTypeErrorFunction;
+
+        RefPtr<RegisterID> setter;
+        if (attributes.hasSet())
+            setter = setterRegister;
+        else
+            setter = throwTypeErrorFunction;
+
+        emitOpcode(op_define_accessor_property);
+        instructions().append(newObj->index());
+        instructions().append(propertyNameRegister->index());
+        instructions().append(getter->index());
+        instructions().append(setter->index());
+        instructions().append(emitLoad(nullptr, jsNumber(attributes.rawRepresentation()))->index());
+    } else {
+        emitOpcode(op_define_data_property);
+        instructions().append(newObj->index());
+        instructions().append(propertyNameRegister->index());
+        instructions().append(valueRegister->index());
+        instructions().append(emitLoad(nullptr, jsNumber(attributes.rawRepresentation()))->index());
+    }
+}
+
+RegisterID* BytecodeGenerator::emitReturn(RegisterID* src)
+{
+    if (isConstructor()) {
+        bool mightBeDerived = constructorKind() == ConstructorKind::Extends;
+        bool srcIsThis = src->index() == m_thisRegister.index();
+
+        if (mightBeDerived && srcIsThis)
+            emitTDZCheck(src);
+
+        if (!srcIsThis) {
+            RefPtr<Label> isObjectLabel = newLabel();
+            emitJumpIfTrue(emitIsObject(newTemporary(), src), isObjectLabel.get());
+
+            if (mightBeDerived) {
+                ASSERT(m_isDerivedConstuctor);
+                RefPtr<Label> returnThis = newLabel();
+                emitJumpIfFalse(m_isDerivedConstuctor, returnThis.get());
+                // Else, we're a derived constructor here.
+                RefPtr<Label> isUndefinedLabel = newLabel();
+                emitJumpIfTrue(emitIsUndefined(newTemporary(), src), isUndefinedLabel.get());
+                emitThrowTypeError("Cannot return a non-object type in the constructor of a derived class.");
+                emitLabel(isUndefinedLabel.get());
+                emitTDZCheck(&m_thisRegister);
+                emitLabel(returnThis.get());
+            }
+            emitUnaryNoDstOp(op_ret, &m_thisRegister);
+            emitLabel(isObjectLabel.get());
+        }
+    }
+
+    return emitUnaryNoDstOp(op_ret, src);
+}
+
+RegisterID* BytecodeGenerator::emitUnaryNoDstOp(OpcodeID opcodeID, RegisterID* src)
+{
+    emitOpcode(opcodeID);
+    instructions().append(src->index());
+    return src;
+}
+
+RegisterID* BytecodeGenerator::emitConstruct(RegisterID* dst, RegisterID* func, ExpectedFunction expectedFunction, CallArguments& callArguments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+{
+    ASSERT(func->refCount());
+
+    // Generate code for arguments.
+    unsigned argument = 0;
+    if (ArgumentsNode* argumentsNode = callArguments.argumentsNode()) {
+        
+        ArgumentListNode* n = callArguments.argumentsNode()->m_listNode;
+        if (n && n->m_expr->isSpreadExpression()) {
+            RELEASE_ASSERT(!n->m_next);
+            auto expression = static_cast<SpreadExpressionNode*>(n->m_expr)->expression();
+            RefPtr<RegisterID> argumentRegister;
+            argumentRegister = expression->emitBytecode(*this, callArguments.argumentRegister(0));
+            return emitConstructVarargs(dst, func, callArguments.thisRegister(), argumentRegister.get(), newTemporary(), 0, divot, divotStart, divotEnd, DebuggableCall::No);
+        }
+        
+        for (ArgumentListNode* n = argumentsNode->m_listNode; n; n = n->m_next)
+            emitNode(callArguments.argumentRegister(argument++), n);
+    }
+
+    // Reserve space for call frame.
+    Vector<RefPtr<RegisterID>, CallFrame::headerSizeInRegisters, UnsafeVectorOverflow> callFrame;
+    for (int i = 0; i < CallFrame::headerSizeInRegisters; ++i)
+        callFrame.append(newTemporary());
+
+    emitExpressionInfo(divot, divotStart, divotEnd);
+    
+    RefPtr<Label> done = newLabel();
+    expectedFunction = emitExpectedFunctionSnippet(dst, func, expectedFunction, callArguments, done.get());
+
+    UnlinkedValueProfile profile = emitProfiledOpcode(op_construct);
+    ASSERT(dst != ignoredResult());
+    instructions().append(dst->index());
+    instructions().append(func->index());
+    instructions().append(callArguments.argumentCountIncludingThis());
+    instructions().append(callArguments.stackOffset());
+    instructions().append(m_codeBlock->addLLIntCallLinkInfo());
+    instructions().append(0);
+    instructions().append(0);
+    instructions().append(profile);
+
+    if (expectedFunction != NoExpectedFunction)
+        emitLabel(done.get());
+
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitStrcat(RegisterID* dst, RegisterID* src, int count)
+{
+    emitOpcode(op_strcat);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    instructions().append(count);
+
+    return dst;
+}
+
+void BytecodeGenerator::emitToPrimitive(RegisterID* dst, RegisterID* src)
+{
+    emitOpcode(op_to_primitive);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+}
+
+void BytecodeGenerator::emitGetScope()
+{
+    emitOpcode(op_get_scope);
+    instructions().append(scopeRegister()->index());
+}
+
+RegisterID* BytecodeGenerator::emitPushWithScope(RegisterID* objectScope)
+{
+    pushLocalControlFlowScope();
+    RegisterID* newScope = newBlockScopeVariable();
+    newScope->ref();
+
+    emitOpcode(op_push_with_scope);
+    instructions().append(newScope->index());
+    instructions().append(objectScope->index());
+    instructions().append(scopeRegister()->index());
+
+    emitMove(scopeRegister(), newScope);
+    m_lexicalScopeStack.append({ nullptr, newScope, true, 0 });
+
+    return newScope;
+}
+
+RegisterID* BytecodeGenerator::emitGetParentScope(RegisterID* dst, RegisterID* scope)
+{
+    emitOpcode(op_get_parent_scope);
+    instructions().append(dst->index());
+    instructions().append(scope->index());
+    return dst;
+}
+
+void BytecodeGenerator::emitPopScope(RegisterID* dst, RegisterID* scope)
+{
+    RefPtr<RegisterID> parentScope = emitGetParentScope(newTemporary(), scope);
+    emitMove(dst, parentScope.get());
+}
+
+void BytecodeGenerator::emitPopWithScope()
+{
+    emitPopScope(scopeRegister(), scopeRegister());
+    popLocalControlFlowScope();
+    auto stackEntry = m_lexicalScopeStack.takeLast();
+    stackEntry.m_scope->deref();
+    RELEASE_ASSERT(stackEntry.m_isWithScope);
+}
+
+void BytecodeGenerator::emitDebugHook(DebugHookType debugHookType, const JSTextPosition& divot)
+{
+    if (!m_shouldEmitDebugHooks)
+        return;
+
+    emitExpressionInfo(divot, divot, divot);
+    emitOpcode(op_debug);
+    instructions().append(debugHookType);
+    instructions().append(false);
+}
+
+void BytecodeGenerator::emitDebugHook(DebugHookType debugHookType, unsigned line, unsigned charOffset, unsigned lineStart)
+{
+    emitDebugHook(debugHookType, JSTextPosition(line, charOffset, lineStart));
+}
+
+void BytecodeGenerator::emitDebugHook(StatementNode* statement)
+{
+    // DebuggerStatementNode will output its own special debug hook.
+    if (statement->isDebuggerStatement())
+        return;
+
+    emitDebugHook(WillExecuteStatement, statement->position());
+}
+
+void BytecodeGenerator::emitDebugHook(ExpressionNode* expr)
+{
+    emitDebugHook(WillExecuteStatement, expr->position());
+}
+
+void BytecodeGenerator::emitWillLeaveCallFrameDebugHook()
+{
+    RELEASE_ASSERT(m_scopeNode->isFunctionNode());
+    emitDebugHook(WillLeaveCallFrame, m_scopeNode->lastLine(), m_scopeNode->startOffset(), m_scopeNode->lineStartOffset());
+}
+
+void BytecodeGenerator::pushFinallyControlFlowScope(StatementNode* finallyBlock)
+{
+    // Reclaim free label scopes.
+    while (m_labelScopes.size() && !m_labelScopes.last().refCount())
+        m_labelScopes.removeLast();
+
+    ControlFlowScope scope;
+    scope.isFinallyBlock = true;
+    FinallyContext context = {
+        finallyBlock,
+        nullptr,
+        nullptr,
+        static_cast<unsigned>(m_controlFlowScopeStack.size()),
+        static_cast<unsigned>(m_switchContextStack.size()),
+        static_cast<unsigned>(m_forInContextStack.size()),
+        static_cast<unsigned>(m_tryContextStack.size()),
+        static_cast<unsigned>(m_labelScopes.size()),
+        static_cast<unsigned>(m_lexicalScopeStack.size()),
+        m_finallyDepth,
+        m_localScopeDepth
+    };
+    scope.finallyContext = context;
+    m_controlFlowScopeStack.append(scope);
+    m_finallyDepth++;
+}
+
+void BytecodeGenerator::pushIteratorCloseControlFlowScope(RegisterID* iterator, ThrowableExpressionData* node)
+{
+    // Reclaim free label scopes.
+    while (m_labelScopes.size() && !m_labelScopes.last().refCount())
+        m_labelScopes.removeLast();
+
+    ControlFlowScope scope;
+    scope.isFinallyBlock = true;
+    FinallyContext context = {
+        nullptr,
+        iterator,
+        node,
+        static_cast<unsigned>(m_controlFlowScopeStack.size()),
+        static_cast<unsigned>(m_switchContextStack.size()),
+        static_cast<unsigned>(m_forInContextStack.size()),
+        static_cast<unsigned>(m_tryContextStack.size()),
+        static_cast<unsigned>(m_labelScopes.size()),
+        static_cast<unsigned>(m_lexicalScopeStack.size()),
+        m_finallyDepth,
+        m_localScopeDepth
+    };
+    scope.finallyContext = context;
+    m_controlFlowScopeStack.append(scope);
+    m_finallyDepth++;
+}
+
+void BytecodeGenerator::popFinallyControlFlowScope()
+{
+    ASSERT(m_controlFlowScopeStack.size());
+    ASSERT(m_controlFlowScopeStack.last().isFinallyBlock);
+    ASSERT(m_controlFlowScopeStack.last().finallyContext.finallyBlock);
+    ASSERT(!m_controlFlowScopeStack.last().finallyContext.iterator);
+    ASSERT(!m_controlFlowScopeStack.last().finallyContext.enumerationNode);
+    ASSERT(m_finallyDepth > 0);
+    m_controlFlowScopeStack.removeLast();
+    m_finallyDepth--;
+}
+
+void BytecodeGenerator::popIteratorCloseControlFlowScope()
+{
+    ASSERT(m_controlFlowScopeStack.size());
+    ASSERT(m_controlFlowScopeStack.last().isFinallyBlock);
+    ASSERT(!m_controlFlowScopeStack.last().finallyContext.finallyBlock);
+    ASSERT(m_controlFlowScopeStack.last().finallyContext.iterator);
+    ASSERT(m_controlFlowScopeStack.last().finallyContext.enumerationNode);
+    ASSERT(m_finallyDepth > 0);
+    m_controlFlowScopeStack.removeLast();
+    m_finallyDepth--;
+}
+
+LabelScopePtr BytecodeGenerator::breakTarget(const Identifier& name)
+{
+    // Reclaim free label scopes.
+    //
+    // The condition was previously coded as 'm_labelScopes.size() && !m_labelScopes.last().refCount()',
+    // however sometimes this appears to lead to GCC going a little haywire and entering the loop with
+    // size 0, leading to segfaulty badness.  We are yet to identify a valid cause within our code to
+    // cause the GCC codegen to misbehave in this fashion, and as such the following refactoring of the
+    // loop condition is a workaround.
+    while (m_labelScopes.size()) {
+        if  (m_labelScopes.last().refCount())
+            break;
+        m_labelScopes.removeLast();
+    }
+
+    if (!m_labelScopes.size())
+        return LabelScopePtr::null();
+
+    // We special-case the following, which is a syntax error in Firefox:
+    // label:
+    //     break;
+    if (name.isEmpty()) {
+        for (int i = m_labelScopes.size() - 1; i >= 0; --i) {
+            LabelScope* scope = &m_labelScopes[i];
+            if (scope->type() != LabelScope::NamedLabel) {
+                ASSERT(scope->breakTarget());
+                return LabelScopePtr(m_labelScopes, i);
+            }
+        }
+        return LabelScopePtr::null();
+    }
+
+    for (int i = m_labelScopes.size() - 1; i >= 0; --i) {
+        LabelScope* scope = &m_labelScopes[i];
+        if (scope->name() && *scope->name() == name) {
+            ASSERT(scope->breakTarget());
+            return LabelScopePtr(m_labelScopes, i);
+        }
+    }
+    return LabelScopePtr::null();
+}
+
+LabelScopePtr BytecodeGenerator::continueTarget(const Identifier& name)
+{
+    // Reclaim free label scopes.
+    while (m_labelScopes.size() && !m_labelScopes.last().refCount())
+        m_labelScopes.removeLast();
+
+    if (!m_labelScopes.size())
+        return LabelScopePtr::null();
+
+    if (name.isEmpty()) {
+        for (int i = m_labelScopes.size() - 1; i >= 0; --i) {
+            LabelScope* scope = &m_labelScopes[i];
+            if (scope->type() == LabelScope::Loop) {
+                ASSERT(scope->continueTarget());
+                return LabelScopePtr(m_labelScopes, i);
+            }
+        }
+        return LabelScopePtr::null();
+    }
+
+    // Continue to the loop nested nearest to the label scope that matches
+    // 'name'.
+    LabelScopePtr result = LabelScopePtr::null();
+    for (int i = m_labelScopes.size() - 1; i >= 0; --i) {
+        LabelScope* scope = &m_labelScopes[i];
+        if (scope->type() == LabelScope::Loop) {
+            ASSERT(scope->continueTarget());
+            result = LabelScopePtr(m_labelScopes, i);
+        }
+        if (scope->name() && *scope->name() == name)
+            return result; // may be null.
+    }
+    return LabelScopePtr::null();
+}
+
+void BytecodeGenerator::allocateCalleeSaveSpace()
+{
+    size_t virtualRegisterCountForCalleeSaves = CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters();
+
+    for (size_t i = 0; i < virtualRegisterCountForCalleeSaves; i++) {
+        RegisterID* localRegister = addVar();
+        localRegister->ref();
+        m_localRegistersForCalleeSaveRegisters.append(localRegister);
+    }
+}
+
+void BytecodeGenerator::allocateAndEmitScope()
+{
+    m_scopeRegister = addVar();
+    m_scopeRegister->ref();
+    m_codeBlock->setScopeRegister(scopeRegister()->virtualRegister());
+    emitGetScope();
+    m_topMostScope = addVar();
+    emitMove(m_topMostScope, scopeRegister());
+}
+    
+void BytecodeGenerator::emitComplexPopScopes(RegisterID* scope, ControlFlowScope* topScope, ControlFlowScope* bottomScope)
+{
+    while (topScope > bottomScope) {
+        // First we count the number of dynamic scopes we need to remove to get
+        // to a finally block.
+        int numberOfNormalScopes = 0;
+        while (topScope > bottomScope) {
+            if (topScope->isFinallyBlock)
+                break;
+            ++numberOfNormalScopes;
+            --topScope;
+        }
+
+        if (numberOfNormalScopes) {
+            // We need to remove a number of dynamic scopes to get to the next
+            // finally block
+            RefPtr<RegisterID> parentScope = newTemporary();
+            while (numberOfNormalScopes--) {
+                parentScope = emitGetParentScope(parentScope.get(), scope);
+                emitMove(scope, parentScope.get());
+            }
+
+            // If topScope == bottomScope then there isn't a finally block left to emit.
+            if (topScope == bottomScope)
+                return;
+        }
+        
+        Vector<ControlFlowScope> savedControlFlowScopeStack;
+        Vector<SwitchInfo> savedSwitchContextStack;
+        Vector<RefPtr<ForInContext>> savedForInContextStack;
+        Vector<TryContext> poppedTryContexts;
+        Vector<LexicalScopeStackEntry> savedLexicalScopeStack;
+        LabelScopeStore savedLabelScopes;
+        while (topScope > bottomScope && topScope->isFinallyBlock) {
+            RefPtr<Label> beforeFinally = emitLabel(newLabel().get());
+            
+            // Save the current state of the world while instating the state of the world
+            // for the finally block.
+            FinallyContext finallyContext = topScope->finallyContext;
+            bool flipScopes = finallyContext.controlFlowScopeStackSize != m_controlFlowScopeStack.size();
+            bool flipSwitches = finallyContext.switchContextStackSize != m_switchContextStack.size();
+            bool flipForIns = finallyContext.forInContextStackSize != m_forInContextStack.size();
+            bool flipTries = finallyContext.tryContextStackSize != m_tryContextStack.size();
+            bool flipLabelScopes = finallyContext.labelScopesSize != m_labelScopes.size();
+            bool flipLexicalScopeStack = finallyContext.lexicalScopeStackSize != m_lexicalScopeStack.size();
+            int topScopeIndex = -1;
+            int bottomScopeIndex = -1;
+            if (flipScopes) {
+                topScopeIndex = topScope - m_controlFlowScopeStack.begin();
+                bottomScopeIndex = bottomScope - m_controlFlowScopeStack.begin();
+                savedControlFlowScopeStack = m_controlFlowScopeStack;
+                m_controlFlowScopeStack.shrink(finallyContext.controlFlowScopeStackSize);
+            }
+            if (flipSwitches) {
+                savedSwitchContextStack = m_switchContextStack;
+                m_switchContextStack.shrink(finallyContext.switchContextStackSize);
+            }
+            if (flipForIns) {
+                savedForInContextStack = m_forInContextStack;
+                m_forInContextStack.shrink(finallyContext.forInContextStackSize);
+            }
+            if (flipTries) {
+                while (m_tryContextStack.size() != finallyContext.tryContextStackSize) {
+                    ASSERT(m_tryContextStack.size() > finallyContext.tryContextStackSize);
+                    TryContext context = m_tryContextStack.takeLast();
+                    TryRange range;
+                    range.start = context.start;
+                    range.end = beforeFinally;
+                    range.tryData = context.tryData;
+                    m_tryRanges.append(range);
+                    poppedTryContexts.append(context);
+                }
+            }
+            if (flipLabelScopes) {
+                savedLabelScopes = m_labelScopes;
+                while (m_labelScopes.size() > finallyContext.labelScopesSize)
+                    m_labelScopes.removeLast();
+            }
+            if (flipLexicalScopeStack) {
+                savedLexicalScopeStack = m_lexicalScopeStack;
+                m_lexicalScopeStack.shrink(finallyContext.lexicalScopeStackSize);
+            }
+            int savedFinallyDepth = m_finallyDepth;
+            m_finallyDepth = finallyContext.finallyDepth;
+            int savedDynamicScopeDepth = m_localScopeDepth;
+            m_localScopeDepth = finallyContext.dynamicScopeDepth;
+            
+            if (finallyContext.finallyBlock) {
+                // Emit the finally block.
+                emitNode(finallyContext.finallyBlock);
+            } else {
+                // Emit the IteratorClose block.
+                ASSERT(finallyContext.iterator);
+                emitIteratorClose(finallyContext.iterator, finallyContext.enumerationNode);
+            }
+
+            RefPtr<Label> afterFinally = emitLabel(newLabel().get());
+            
+            // Restore the state of the world.
+            if (flipScopes) {
+                m_controlFlowScopeStack = savedControlFlowScopeStack;
+                topScope = &m_controlFlowScopeStack[topScopeIndex]; // assert it's within bounds
+                bottomScope = m_controlFlowScopeStack.begin() + bottomScopeIndex; // don't assert, since it the index might be -1.
+            }
+            if (flipSwitches)
+                m_switchContextStack = savedSwitchContextStack;
+            if (flipForIns)
+                m_forInContextStack = savedForInContextStack;
+            if (flipTries) {
+                ASSERT(m_tryContextStack.size() == finallyContext.tryContextStackSize);
+                for (unsigned i = poppedTryContexts.size(); i--;) {
+                    TryContext context = poppedTryContexts[i];
+                    context.start = afterFinally;
+                    m_tryContextStack.append(context);
+                }
+                poppedTryContexts.clear();
+            }
+            if (flipLabelScopes)
+                m_labelScopes = savedLabelScopes;
+            if (flipLexicalScopeStack)
+                m_lexicalScopeStack = savedLexicalScopeStack;
+            m_finallyDepth = savedFinallyDepth;
+            m_localScopeDepth = savedDynamicScopeDepth;
+            
+            --topScope;
+        }
+    }
+}
+
+void BytecodeGenerator::emitPopScopes(RegisterID* scope, int targetScopeDepth)
+{
+    ASSERT(labelScopeDepth() - targetScopeDepth >= 0);
+
+    size_t scopeDelta = labelScopeDepth() - targetScopeDepth;
+    ASSERT(scopeDelta <= m_controlFlowScopeStack.size());
+    if (!scopeDelta)
+        return;
+
+    if (!m_finallyDepth) {
+        RefPtr<RegisterID> parentScope = newTemporary();
+        while (scopeDelta--) {
+            parentScope = emitGetParentScope(parentScope.get(), scope);
+            emitMove(scope, parentScope.get());
+        }
+        return;
+    }
+
+    emitComplexPopScopes(scope, &m_controlFlowScopeStack.last(), &m_controlFlowScopeStack.last() - scopeDelta);
+}
+
+TryData* BytecodeGenerator::pushTry(Label* start)
+{
+    TryData tryData;
+    tryData.target = newLabel();
+    tryData.handlerType = HandlerType::Illegal;
+    m_tryData.append(tryData);
+    TryData* result = &m_tryData.last();
+    
+    TryContext tryContext;
+    tryContext.start = start;
+    tryContext.tryData = result;
+    
+    m_tryContextStack.append(tryContext);
+    
+    return result;
+}
+
+void BytecodeGenerator::popTryAndEmitCatch(TryData* tryData, RegisterID* exceptionRegister, RegisterID* thrownValueRegister, Label* end, HandlerType handlerType)
+{
+    m_usesExceptions = true;
+    
+    ASSERT_UNUSED(tryData, m_tryContextStack.last().tryData == tryData);
+    
+    TryRange tryRange;
+    tryRange.start = m_tryContextStack.last().start;
+    tryRange.end = end;
+    tryRange.tryData = m_tryContextStack.last().tryData;
+    m_tryRanges.append(tryRange);
+    m_tryContextStack.removeLast();
+    
+    emitLabel(tryRange.tryData->target.get());
+    tryRange.tryData->handlerType = handlerType;
+
+    emitOpcode(op_catch);
+    instructions().append(exceptionRegister->index());
+    instructions().append(thrownValueRegister->index());
+
+    bool foundLocalScope = false;
+    for (unsigned i = m_lexicalScopeStack.size(); i--; ) {
+        // Note that if we don't find a local scope in the current function/program, 
+        // we must grab the outer-most scope of this bytecode generation.
+        if (m_lexicalScopeStack[i].m_scope) {
+            foundLocalScope = true;
+            emitMove(scopeRegister(), m_lexicalScopeStack[i].m_scope);
+            break;
+        }
+    }
+    if (!foundLocalScope)
+        emitMove(scopeRegister(), m_topMostScope);
+}
+
+int BytecodeGenerator::localScopeDepth() const
+{
+    return m_localScopeDepth;
+}
+
+int BytecodeGenerator::labelScopeDepth() const
+{ 
+    return localScopeDepth() + m_finallyDepth;
+}
+
+void BytecodeGenerator::emitThrowStaticError(ErrorType errorType, RegisterID* raw)
+{
+    RefPtr<RegisterID> message = newTemporary();
+    emitToString(message.get(), raw);
+    emitOpcode(op_throw_static_error);
+    instructions().append(message->index());
+    instructions().append(static_cast<unsigned>(errorType));
+}
+
+void BytecodeGenerator::emitThrowStaticError(ErrorType errorType, const Identifier& message)
+{
+    emitOpcode(op_throw_static_error);
+    instructions().append(addConstantValue(addStringConstant(message))->index());
+    instructions().append(static_cast<unsigned>(errorType));
+}
+
+void BytecodeGenerator::emitThrowReferenceError(const String& message)
+{
+    emitThrowStaticError(ErrorType::ReferenceError, Identifier::fromString(m_vm, message));
+}
+
+void BytecodeGenerator::emitThrowTypeError(const String& message)
+{
+    emitThrowStaticError(ErrorType::TypeError, Identifier::fromString(m_vm, message));
+}
+
+void BytecodeGenerator::emitThrowTypeError(const Identifier& message)
+{
+    emitThrowStaticError(ErrorType::TypeError, message);
+}
+
+void BytecodeGenerator::emitThrowRangeError(const Identifier& message)
+{
+    emitThrowStaticError(ErrorType::RangeError, message);
+}
+
+void BytecodeGenerator::emitThrowOutOfMemoryError()
+{
+    emitThrowStaticError(ErrorType::Error, Identifier::fromString(m_vm, "Out of memory"));
+}
+
+void BytecodeGenerator::emitPushFunctionNameScope(const Identifier& property, RegisterID* callee, bool isCaptured)
+{
+    // There is some nuance here:
+    // If we're in strict mode code, the function name scope variable acts exactly like a "const" variable.
+    // If we're not in strict mode code, we want to allow bogus assignments to the name scoped variable.
+    // This means any assignment to the variable won't throw, but it won't actually assign a new value to it.
+    // To accomplish this, we don't report that this scope is a lexical scope. This will prevent
+    // any throws when trying to assign to the variable (while still ensuring it keeps its original
+    // value). There is some ugliness and exploitation of a leaky abstraction here, but it's better than 
+    // having a completely new op code and a class to handle name scopes which are so close in functionality
+    // to lexical environments.
+    VariableEnvironment nameScopeEnvironment;
+    auto addResult = nameScopeEnvironment.add(property);
+    if (isCaptured)
+        addResult.iterator->value.setIsCaptured();
+    addResult.iterator->value.setIsConst(); // The function name scope name acts like a const variable.
+    unsigned numVars = m_codeBlock->m_numVars;
+    pushLexicalScopeInternal(nameScopeEnvironment, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, TDZRequirement::NotUnderTDZ, ScopeType::FunctionNameScope, ScopeRegisterType::Var);
+    ASSERT_UNUSED(numVars, m_codeBlock->m_numVars == static_cast<int>(numVars + 1)); // Should have only created one new "var" for the function name scope.
+    bool shouldTreatAsLexicalVariable = isStrictMode();
+    Variable functionVar = variableForLocalEntry(property, m_lexicalScopeStack.last().m_symbolTable->get(NoLockingNecessary, property.impl()), m_lexicalScopeStack.last().m_symbolTableConstantIndex, shouldTreatAsLexicalVariable);
+    emitPutToScope(m_lexicalScopeStack.last().m_scope, functionVar, callee, ThrowIfNotFound, InitializationMode::NotInitialization);
+}
+
+void BytecodeGenerator::pushLocalControlFlowScope()
+{
+    ControlFlowScope scope;
+    scope.isFinallyBlock = false;
+    m_controlFlowScopeStack.append(scope);
+    m_localScopeDepth++;
+}
+
+void BytecodeGenerator::popLocalControlFlowScope()
+{
+    ASSERT(m_controlFlowScopeStack.size());
+    ASSERT(!m_controlFlowScopeStack.last().isFinallyBlock);
+    m_controlFlowScopeStack.removeLast();
+    m_localScopeDepth--;
+}
+
+void BytecodeGenerator::emitPushCatchScope(VariableEnvironment& environment)
+{
+    pushLexicalScopeInternal(environment, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, TDZRequirement::UnderTDZ, ScopeType::CatchScope, ScopeRegisterType::Block);
+}
+
+void BytecodeGenerator::emitPopCatchScope(VariableEnvironment& environment) 
+{
+    popLexicalScopeInternal(environment);
+}
+
+void BytecodeGenerator::beginSwitch(RegisterID* scrutineeRegister, SwitchInfo::SwitchType type)
+{
+    SwitchInfo info = { static_cast<uint32_t>(instructions().size()), type };
+    switch (type) {
+        case SwitchInfo::SwitchImmediate:
+            emitOpcode(op_switch_imm);
+            break;
+        case SwitchInfo::SwitchCharacter:
+            emitOpcode(op_switch_char);
+            break;
+        case SwitchInfo::SwitchString:
+            emitOpcode(op_switch_string);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    instructions().append(0); // place holder for table index
+    instructions().append(0); // place holder for default target    
+    instructions().append(scrutineeRegister->index());
+    m_switchContextStack.append(info);
+}
+
+static int32_t keyForImmediateSwitch(ExpressionNode* node, int32_t min, int32_t max)
+{
+    UNUSED_PARAM(max);
+    ASSERT(node->isNumber());
+    double value = static_cast<NumberNode*>(node)->value();
+    int32_t key = static_cast<int32_t>(value);
+    ASSERT(key == value);
+    ASSERT(key >= min);
+    ASSERT(key <= max);
+    return key - min;
+}
+
+static int32_t keyForCharacterSwitch(ExpressionNode* node, int32_t min, int32_t max)
+{
+    UNUSED_PARAM(max);
+    ASSERT(node->isString());
+    StringImpl* clause = static_cast<StringNode*>(node)->value().impl();
+    ASSERT(clause->length() == 1);
+    
+    int32_t key = (*clause)[0];
+    ASSERT(key >= min);
+    ASSERT(key <= max);
+    return key - min;
+}
+
+static void prepareJumpTableForSwitch(
+    UnlinkedSimpleJumpTable& jumpTable, int32_t switchAddress, uint32_t clauseCount,
+    RefPtr<Label>* labels, ExpressionNode** nodes, int32_t min, int32_t max,
+    int32_t (*keyGetter)(ExpressionNode*, int32_t min, int32_t max))
+{
+    jumpTable.min = min;
+    jumpTable.branchOffsets.resize(max - min + 1);
+    jumpTable.branchOffsets.fill(0);
+    for (uint32_t i = 0; i < clauseCount; ++i) {
+        // We're emitting this after the clause labels should have been fixed, so 
+        // the labels should not be "forward" references
+        ASSERT(!labels[i]->isForward());
+        jumpTable.add(keyGetter(nodes[i], min, max), labels[i]->bind(switchAddress, switchAddress + 3)); 
+    }
+}
+
+static void prepareJumpTableForStringSwitch(UnlinkedStringJumpTable& jumpTable, int32_t switchAddress, uint32_t clauseCount, RefPtr<Label>* labels, ExpressionNode** nodes)
+{
+    for (uint32_t i = 0; i < clauseCount; ++i) {
+        // We're emitting this after the clause labels should have been fixed, so 
+        // the labels should not be "forward" references
+        ASSERT(!labels[i]->isForward());
+        
+        ASSERT(nodes[i]->isString());
+        StringImpl* clause = static_cast<StringNode*>(nodes[i])->value().impl();
+        jumpTable.offsetTable.add(clause, UnlinkedStringJumpTable::OffsetLocation { labels[i]->bind(switchAddress, switchAddress + 3) });
+    }
+}
+
+void BytecodeGenerator::endSwitch(uint32_t clauseCount, RefPtr<Label>* labels, ExpressionNode** nodes, Label* defaultLabel, int32_t min, int32_t max)
+{
+    SwitchInfo switchInfo = m_switchContextStack.last();
+    m_switchContextStack.removeLast();
+    
+    switch (switchInfo.switchType) {
+    case SwitchInfo::SwitchImmediate:
+    case SwitchInfo::SwitchCharacter: {
+        instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfSwitchJumpTables();
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
+
+        UnlinkedSimpleJumpTable& jumpTable = m_codeBlock->addSwitchJumpTable();
+        prepareJumpTableForSwitch(
+            jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max,
+            switchInfo.switchType == SwitchInfo::SwitchImmediate
+                ? keyForImmediateSwitch
+                : keyForCharacterSwitch); 
+        break;
+    }
+        
+    case SwitchInfo::SwitchString: {
+        instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfStringSwitchJumpTables();
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
+
+        UnlinkedStringJumpTable& jumpTable = m_codeBlock->addStringSwitchJumpTable();
+        prepareJumpTableForStringSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes);
+        break;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+RegisterID* BytecodeGenerator::emitThrowExpressionTooDeepException()
+{
+    // It would be nice to do an even better job of identifying exactly where the expression is.
+    // And we could make the caller pass the node pointer in, if there was some way of getting
+    // that from an arbitrary node. However, calling emitExpressionInfo without any useful data
+    // is still good enough to get us an accurate line number.
+    m_expressionTooDeep = true;
+    return newTemporary();
+}
+
+bool BytecodeGenerator::isArgumentNumber(const Identifier& ident, int argumentNumber)
+{
+    RegisterID* registerID = variable(ident).local();
+    if (!registerID)
+        return false;
+    return registerID->index() == CallFrame::argumentOffset(argumentNumber);
+}
+
+bool BytecodeGenerator::emitReadOnlyExceptionIfNeeded(const Variable& variable)
+{
+    // If we're in strict mode, we always throw.
+    // If we're not in strict mode, we throw for "const" variables but not the function callee.
+    if (isStrictMode() || variable.isConst()) {
+        emitThrowTypeError(Identifier::fromString(m_vm, ReadonlyPropertyWriteError));
+        return true;
+    }
+    return false;
+}
+    
+void BytecodeGenerator::emitEnumeration(ThrowableExpressionData* node, ExpressionNode* subjectNode, const std::function<void(BytecodeGenerator&, RegisterID*)>& callBack, ForOfNode* forLoopNode, RegisterID* forLoopSymbolTable)
+{
+    RefPtr<RegisterID> subject = newTemporary();
+    emitNode(subject.get(), subjectNode);
+    RefPtr<RegisterID> iterator = emitGetById(newTemporary(), subject.get(), propertyNames().iteratorSymbol);
+    {
+        CallArguments args(*this, nullptr);
+        emitMove(args.thisRegister(), subject.get());
+        emitCall(iterator.get(), iterator.get(), NoExpectedFunction, args, node->divot(), node->divotStart(), node->divotEnd(), DebuggableCall::No);
+    }
+
+    RefPtr<Label> loopDone = newLabel();
+    // RefPtr<Register> iterator's lifetime must be longer than IteratorCloseContext.
+    pushIteratorCloseControlFlowScope(iterator.get(), node);
+    {
+        LabelScopePtr scope = newLabelScope(LabelScope::Loop);
+        RefPtr<RegisterID> value = newTemporary();
+        emitLoad(value.get(), jsUndefined());
+
+        emitJump(scope->continueTarget());
+
+        RefPtr<Label> loopStart = newLabel();
+        emitLabel(loopStart.get());
+        emitLoopHint();
+
+        RefPtr<Label> tryStartLabel = newLabel();
+        emitLabel(tryStartLabel.get());
+        TryData* tryData = pushTry(tryStartLabel.get());
+        callBack(*this, value.get());
+        emitJump(scope->continueTarget());
+
+        // IteratorClose sequence for throw-ed control flow.
+        {
+            RefPtr<Label> catchHere = emitLabel(newLabel().get());
+            RefPtr<RegisterID> exceptionRegister = newTemporary();
+            RefPtr<RegisterID> thrownValueRegister = newTemporary();
+            popTryAndEmitCatch(tryData, exceptionRegister.get(),
+                thrownValueRegister.get(), catchHere.get(), HandlerType::SynthesizedFinally);
+
+            RefPtr<Label> catchDone = newLabel();
+
+            RefPtr<RegisterID> returnMethod = emitGetById(newTemporary(), iterator.get(), propertyNames().returnKeyword);
+            emitJumpIfTrue(emitIsUndefined(newTemporary(), returnMethod.get()), catchDone.get());
+
+            RefPtr<Label> returnCallTryStart = newLabel();
+            emitLabel(returnCallTryStart.get());
+            TryData* returnCallTryData = pushTry(returnCallTryStart.get());
+
+            CallArguments returnArguments(*this, nullptr);
+            emitMove(returnArguments.thisRegister(), iterator.get());
+            emitCall(value.get(), returnMethod.get(), NoExpectedFunction, returnArguments, node->divot(), node->divotStart(), node->divotEnd(), DebuggableCall::No);
+
+            emitLabel(catchDone.get());
+            emitThrow(exceptionRegister.get());
+
+            // Absorb exception.
+            popTryAndEmitCatch(returnCallTryData, newTemporary(),
+                newTemporary(), catchDone.get(), HandlerType::SynthesizedFinally);
+            emitThrow(exceptionRegister.get());
+        }
+
+        emitLabel(scope->continueTarget());
+        if (forLoopNode) {
+            RELEASE_ASSERT(forLoopNode->isForOfNode());
+            prepareLexicalScopeForNextForLoopIteration(forLoopNode, forLoopSymbolTable);
+            emitDebugHook(forLoopNode->lexpr());
+        }
+
+        {
+            emitIteratorNext(value.get(), iterator.get(), node);
+            emitJumpIfTrue(emitGetById(newTemporary(), value.get(), propertyNames().done), loopDone.get());
+            emitGetById(value.get(), value.get(), propertyNames().value);
+            emitJump(loopStart.get());
+        }
+
+        emitLabel(scope->breakTarget());
+    }
+
+    // IteratorClose sequence for break-ed control flow.
+    popIteratorCloseControlFlowScope();
+    emitIteratorClose(iterator.get(), node);
+    emitLabel(loopDone.get());
+}
+
+RegisterID* BytecodeGenerator::emitGetTemplateObject(RegisterID* dst, TaggedTemplateNode* taggedTemplate)
+{
+    TemplateRegistryKey::StringVector rawStrings;
+    TemplateRegistryKey::StringVector cookedStrings;
+
+    TemplateStringListNode* templateString = taggedTemplate->templateLiteral()->templateStrings();
+    for (; templateString; templateString = templateString->next()) {
+        rawStrings.append(templateString->value()->raw().impl());
+        cookedStrings.append(templateString->value()->cooked().impl());
+    }
+
+    RefPtr<RegisterID> getTemplateObject = nullptr;
+    Variable var = variable(propertyNames().builtinNames().getTemplateObjectPrivateName());
+    if (RegisterID* local = var.local())
+        getTemplateObject = emitMove(newTemporary(), local);
+    else {
+        getTemplateObject = newTemporary();
+        RefPtr<RegisterID> scope = newTemporary();
+        moveToDestinationIfNeeded(scope.get(), emitResolveScope(scope.get(), var));
+        emitGetFromScope(getTemplateObject.get(), scope.get(), var, ThrowIfNotFound);
+    }
+
+    CallArguments arguments(*this, nullptr);
+    emitLoad(arguments.thisRegister(), JSValue(addTemplateRegistryKeyConstant(m_vm->templateRegistryKeyTable().createKey(rawStrings, cookedStrings))));
+    return emitCall(dst, getTemplateObject.get(), NoExpectedFunction, arguments, taggedTemplate->divot(), taggedTemplate->divotStart(), taggedTemplate->divotEnd(), DebuggableCall::No);
+}
+
+RegisterID* BytecodeGenerator::emitGetEnumerableLength(RegisterID* dst, RegisterID* base)
+{
+    emitOpcode(op_get_enumerable_length);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitHasGenericProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName)
+{
+    emitOpcode(op_has_generic_property);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(propertyName->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitHasIndexedProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName)
+{
+    UnlinkedArrayProfile arrayProfile = newArrayProfile();
+    emitOpcode(op_has_indexed_property);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(propertyName->index());
+    instructions().append(arrayProfile);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitHasStructureProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName, RegisterID* enumerator)
+{
+    emitOpcode(op_has_structure_property);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(propertyName->index());
+    instructions().append(enumerator->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitGetPropertyEnumerator(RegisterID* dst, RegisterID* base)
+{
+    emitOpcode(op_get_property_enumerator);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitEnumeratorStructurePropertyName(RegisterID* dst, RegisterID* enumerator, RegisterID* index)
+{
+    emitOpcode(op_enumerator_structure_pname);
+    instructions().append(dst->index());
+    instructions().append(enumerator->index());
+    instructions().append(index->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitEnumeratorGenericPropertyName(RegisterID* dst, RegisterID* enumerator, RegisterID* index)
+{
+    emitOpcode(op_enumerator_generic_pname);
+    instructions().append(dst->index());
+    instructions().append(enumerator->index());
+    instructions().append(index->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitToIndexString(RegisterID* dst, RegisterID* index)
+{
+    emitOpcode(op_to_index_string);
+    instructions().append(dst->index());
+    instructions().append(index->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitIsCellWithType(RegisterID* dst, RegisterID* src, JSType type)
+{
+    emitOpcode(op_is_cell_with_type);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    instructions().append(type);
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitIsObject(RegisterID* dst, RegisterID* src)
+{
+    emitOpcode(op_is_object);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitIsUndefined(RegisterID* dst, RegisterID* src)
+{
+    emitOpcode(op_is_undefined);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitIsEmpty(RegisterID* dst, RegisterID* src)
+{
+    emitOpcode(op_is_empty);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    return dst;
+}
+    
+RegisterID* BytecodeGenerator::emitIteratorNext(RegisterID* dst, RegisterID* iterator, const ThrowableExpressionData* node)
+{
+    {
+        RefPtr<RegisterID> next = emitGetById(newTemporary(), iterator, propertyNames().next);
+        CallArguments nextArguments(*this, nullptr);
+        emitMove(nextArguments.thisRegister(), iterator);
+        emitCall(dst, next.get(), NoExpectedFunction, nextArguments, node->divot(), node->divotStart(), node->divotEnd(), DebuggableCall::No);
+    }
+    {
+        RefPtr<Label> typeIsObject = newLabel();
+        emitJumpIfTrue(emitIsObject(newTemporary(), dst), typeIsObject.get());
+        emitThrowTypeError(ASCIILiteral("Iterator result interface is not an object."));
+        emitLabel(typeIsObject.get());
+    }
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitIteratorNextWithValue(RegisterID* dst, RegisterID* iterator, RegisterID* value, const ThrowableExpressionData* node)
+{
+    {
+        RefPtr<RegisterID> next = emitGetById(newTemporary(), iterator, propertyNames().next);
+        CallArguments nextArguments(*this, nullptr, 1);
+        emitMove(nextArguments.thisRegister(), iterator);
+        emitMove(nextArguments.argumentRegister(0), value);
+        emitCall(dst, next.get(), NoExpectedFunction, nextArguments, node->divot(), node->divotStart(), node->divotEnd(), DebuggableCall::No);
+    }
+    {
+        RefPtr<Label> typeIsObject = newLabel();
+        emitJumpIfTrue(emitIsObject(newTemporary(), dst), typeIsObject.get());
+        emitThrowTypeError(ASCIILiteral("Iterator result interface is not an object."));
+        emitLabel(typeIsObject.get());
+    }
+    return dst;
+}
+
+void BytecodeGenerator::emitIteratorClose(RegisterID* iterator, const ThrowableExpressionData* node)
+{
+    RefPtr<Label> done = newLabel();
+    RefPtr<RegisterID> returnMethod = emitGetById(newTemporary(), iterator, propertyNames().returnKeyword);
+    emitJumpIfTrue(emitIsUndefined(newTemporary(), returnMethod.get()), done.get());
+
+    RefPtr<RegisterID> value = newTemporary();
+    CallArguments returnArguments(*this, nullptr);
+    emitMove(returnArguments.thisRegister(), iterator);
+    emitCall(value.get(), returnMethod.get(), NoExpectedFunction, returnArguments, node->divot(), node->divotStart(), node->divotEnd(), DebuggableCall::No);
+    emitJumpIfTrue(emitIsObject(newTemporary(), value.get()), done.get());
+    emitThrowTypeError(ASCIILiteral("Iterator result interface is not an object."));
+    emitLabel(done.get());
+}
+
+void BytecodeGenerator::pushIndexedForInScope(RegisterID* localRegister, RegisterID* indexRegister)
+{
+    if (!localRegister)
+        return;
+    m_forInContextStack.append(adoptRef(new IndexedForInContext(localRegister, indexRegister)));
+}
+
+void BytecodeGenerator::popIndexedForInScope(RegisterID* localRegister)
+{
+    if (!localRegister)
+        return;
+    m_forInContextStack.removeLast();
+}
+
+RegisterID* BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment(const Identifier& identifier)
+{
+    ASSERT(m_codeBlock->isArrowFunction() || m_codeBlock->isArrowFunctionContext() || constructorKind() == ConstructorKind::Extends || m_codeType == EvalCode);
+
+    return emitResolveScope(nullptr, variable(identifier, ThisResolutionType::Scoped));
+}
+
+void BytecodeGenerator::emitLoadThisFromArrowFunctionLexicalEnvironment()
+{
+    emitGetFromScope(thisRegister(), emitLoadArrowFunctionLexicalEnvironment(propertyNames().thisIdentifier), variable(propertyNames().thisIdentifier, ThisResolutionType::Scoped), DoNotThrowIfNotFound);
+}
+    
+RegisterID* BytecodeGenerator::emitLoadNewTargetFromArrowFunctionLexicalEnvironment()
+{
+    Variable newTargetVar = variable(propertyNames().builtinNames().newTargetLocalPrivateName());
+
+    return emitGetFromScope(m_newTargetRegister, emitLoadArrowFunctionLexicalEnvironment(propertyNames().builtinNames().newTargetLocalPrivateName()), newTargetVar, ThrowIfNotFound);
+    
+}
+
+RegisterID* BytecodeGenerator::emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment()
+{
+    Variable protoScopeVar = variable(propertyNames().builtinNames().derivedConstructorPrivateName());
+    return emitGetFromScope(newTemporary(), emitLoadArrowFunctionLexicalEnvironment(propertyNames().builtinNames().derivedConstructorPrivateName()), protoScopeVar, ThrowIfNotFound);
+}
+
+RegisterID* BytecodeGenerator::ensureThis()
+{
+    if (constructorKind() == ConstructorKind::Extends && needsToUpdateArrowFunctionContext() && isSuperCallUsedInInnerArrowFunction())
+        emitLoadThisFromArrowFunctionLexicalEnvironment();
+
+    if (constructorKind() == ConstructorKind::Extends || isDerivedConstructorContext())
+        emitTDZCheck(thisRegister());
+
+    return thisRegister();
+}
+    
+bool BytecodeGenerator::isThisUsedInInnerArrowFunction()
+{
+    return m_scopeNode->doAnyInnerArrowFunctionsUseThis() || m_scopeNode->doAnyInnerArrowFunctionsUseSuperProperty() || m_scopeNode->doAnyInnerArrowFunctionsUseSuperCall() || m_scopeNode->doAnyInnerArrowFunctionsUseEval() || m_codeBlock->usesEval();
+}
+    
+bool BytecodeGenerator::isArgumentsUsedInInnerArrowFunction()
+{
+    return m_scopeNode->doAnyInnerArrowFunctionsUseArguments() || m_scopeNode->doAnyInnerArrowFunctionsUseEval();
+}
+
+bool BytecodeGenerator::isNewTargetUsedInInnerArrowFunction()
+{
+    return m_scopeNode->doAnyInnerArrowFunctionsUseNewTarget() || m_scopeNode->doAnyInnerArrowFunctionsUseSuperCall() || m_scopeNode->doAnyInnerArrowFunctionsUseEval() || m_codeBlock->usesEval();
+}
+
+bool BytecodeGenerator::isSuperUsedInInnerArrowFunction()
+{
+    return m_scopeNode->doAnyInnerArrowFunctionsUseSuperCall() || m_scopeNode->doAnyInnerArrowFunctionsUseSuperProperty() || m_scopeNode->doAnyInnerArrowFunctionsUseEval() || m_codeBlock->usesEval();
+}
+
+bool BytecodeGenerator::isSuperCallUsedInInnerArrowFunction()
+{
+    return m_scopeNode->doAnyInnerArrowFunctionsUseSuperCall() || m_scopeNode->doAnyInnerArrowFunctionsUseEval() || m_codeBlock->usesEval();
+}
+    
+void BytecodeGenerator::emitPutNewTargetToArrowFunctionContextScope()
+{
+    if (isNewTargetUsedInInnerArrowFunction()) {
+        ASSERT(m_arrowFunctionContextLexicalEnvironmentRegister);
+        
+        Variable newTargetVar = variable(propertyNames().builtinNames().newTargetLocalPrivateName());
+        emitPutToScope(m_arrowFunctionContextLexicalEnvironmentRegister, newTargetVar, newTarget(), DoNotThrowIfNotFound, InitializationMode::Initialization);
+    }
+}
+    
+void BytecodeGenerator::emitPutDerivedConstructorToArrowFunctionContextScope()
+{
+    if ((isConstructor() && constructorKind() == ConstructorKind::Extends) || m_codeBlock->isClassContext()) {
+        if (isSuperUsedInInnerArrowFunction()) {
+            ASSERT(m_arrowFunctionContextLexicalEnvironmentRegister);
+            
+            Variable protoScope = variable(propertyNames().builtinNames().derivedConstructorPrivateName());
+            emitPutToScope(m_arrowFunctionContextLexicalEnvironmentRegister, protoScope, &m_calleeRegister, DoNotThrowIfNotFound, InitializationMode::Initialization);
+        }
+    }
+}
+
+void BytecodeGenerator::emitPutThisToArrowFunctionContextScope()
+{
+    if (isThisUsedInInnerArrowFunction() || (m_scopeNode->usesSuperCall() && m_codeType == EvalCode)) {
+        ASSERT(isDerivedConstructorContext() || m_arrowFunctionContextLexicalEnvironmentRegister != nullptr);
+
+        Variable thisVar = variable(propertyNames().thisIdentifier, ThisResolutionType::Scoped);
+        RegisterID* scope = isDerivedConstructorContext() ? emitLoadArrowFunctionLexicalEnvironment(propertyNames().thisIdentifier) : m_arrowFunctionContextLexicalEnvironmentRegister;
+    
+        emitPutToScope(scope, thisVar, thisRegister(), ThrowIfNotFound, InitializationMode::NotInitialization);
+    }
+}
+
+void BytecodeGenerator::pushStructureForInScope(RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
+{
+    if (!localRegister)
+        return;
+    m_forInContextStack.append(adoptRef(new StructureForInContext(localRegister, indexRegister, propertyRegister, enumeratorRegister)));
+}
+
+void BytecodeGenerator::popStructureForInScope(RegisterID* localRegister)
+{
+    if (!localRegister)
+        return;
+    m_forInContextStack.removeLast();
+}
+
+void BytecodeGenerator::invalidateForInContextForLocal(RegisterID* localRegister)
+{
+    // Lexically invalidating ForInContexts is kind of weak sauce, but it only occurs if 
+    // either of the following conditions is true:
+    // 
+    // (1) The loop iteration variable is re-assigned within the body of the loop.
+    // (2) The loop iteration variable is captured in the lexical scope of the function.
+    //
+    // These two situations occur sufficiently rarely that it's okay to use this style of 
+    // "analysis" to make iteration faster. If we didn't want to do this, we would either have 
+    // to perform some flow-sensitive analysis to see if/when the loop iteration variable was 
+    // reassigned, or we'd have to resort to runtime checks to see if the variable had been 
+    // reassigned from its original value.
+    for (size_t i = m_forInContextStack.size(); i > 0; i--) {
+        ForInContext* context = m_forInContextStack[i - 1].get();
+        if (context->local() != localRegister)
+            continue;
+        context->invalidate();
+        break;
+    }
+}
+
+RegisterID* BytecodeGenerator::emitRestParameter(RegisterID* result, unsigned numParametersToSkip)
+{
+    RefPtr<RegisterID> restArrayLength = newTemporary();
+    emitOpcode(op_get_rest_length);
+    instructions().append(restArrayLength->index());
+    instructions().append(numParametersToSkip);
+
+    emitOpcode(op_create_rest);
+    instructions().append(result->index());
+    instructions().append(restArrayLength->index());
+    instructions().append(numParametersToSkip);
+
+    return result;
+}
+
+void BytecodeGenerator::emitRequireObjectCoercible(RegisterID* value, const String& error)
+{
+    // FIXME: op_jneq_null treats "undetectable" objects as null/undefined. RequireObjectCoercible
+    // thus incorrectly throws a TypeError for interfaces like HTMLAllCollection.
+    RefPtr<Label> target = newLabel();
+    size_t begin = instructions().size();
+    emitOpcode(op_jneq_null);
+    instructions().append(value->index());
+    instructions().append(target->bind(begin, instructions().size()));
+    emitThrowTypeError(error);
+    emitLabel(target.get());
+}
+
+void BytecodeGenerator::emitYieldPoint(RegisterID* argument)
+{
+    RefPtr<Label> mergePoint = newLabel();
+    unsigned yieldPointIndex = m_yieldPoints++;
+    emitGeneratorStateChange(yieldPointIndex + 1);
+
+    // Split the try range here.
+    RefPtr<Label> savePoint = emitLabel(newLabel().get());
+    for (unsigned i = m_tryContextStack.size(); i--;) {
+        TryContext& context = m_tryContextStack[i];
+        TryRange range;
+        range.start = context.start;
+        range.end = savePoint;
+        range.tryData = context.tryData;
+        m_tryRanges.append(range);
+
+        // Try range will be restared at the merge point.
+        context.start = mergePoint;
+    }
+    Vector<TryContext> savedTryContextStack;
+    m_tryContextStack.swap(savedTryContextStack);
+
+    emitOpcode(op_yield);
+    instructions().append(generatorFrameRegister()->index());
+    instructions().append(yieldPointIndex);
+    instructions().append(argument->index());
+
+    // Restore the try contexts, which start offset is updated to the merge point.
+    m_tryContextStack.swap(savedTryContextStack);
+    emitLabel(mergePoint.get());
+}
+
+RegisterID* BytecodeGenerator::emitYield(RegisterID* argument)
+{
+    emitYieldPoint(argument);
+
+    RefPtr<Label> normalLabel = newLabel();
+    RefPtr<RegisterID> condition = newTemporary();
+    emitEqualityOp(op_stricteq, condition.get(), generatorResumeModeRegister(), emitLoad(nullptr, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::NormalMode))));
+    emitJumpIfTrue(condition.get(), normalLabel.get());
+
+    RefPtr<Label> throwLabel = newLabel();
+    emitEqualityOp(op_stricteq, condition.get(), generatorResumeModeRegister(), emitLoad(nullptr, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::ThrowMode))));
+    emitJumpIfTrue(condition.get(), throwLabel.get());
+    // Return.
+    {
+        RefPtr<RegisterID> returnRegister = generatorValueRegister();
+        if (isInFinallyBlock()) {
+            returnRegister = emitMove(newTemporary(), returnRegister.get());
+            emitPopScopes(scopeRegister(), 0);
+        }
+        emitReturn(returnRegister.get());
+    }
+
+    // Throw.
+    emitLabel(throwLabel.get());
+    emitThrow(generatorValueRegister());
+
+    // Normal.
+    emitLabel(normalLabel.get());
+    return generatorValueRegister();
+}
+
+RegisterID* BytecodeGenerator::emitDelegateYield(RegisterID* argument, ThrowableExpressionData* node)
+{
+    RefPtr<RegisterID> value = newTemporary();
+    {
+        RefPtr<RegisterID> iterator = emitGetById(newTemporary(), argument, propertyNames().iteratorSymbol);
+        {
+            CallArguments args(*this, nullptr);
+            emitMove(args.thisRegister(), argument);
+            emitCall(iterator.get(), iterator.get(), NoExpectedFunction, args, node->divot(), node->divotStart(), node->divotEnd(), DebuggableCall::No);
+        }
+
+        RefPtr<Label> loopDone = newLabel();
+        {
+            RefPtr<Label> nextElement = newLabel();
+            emitLoad(value.get(), jsUndefined());
+
+            emitJump(nextElement.get());
+
+            RefPtr<Label> loopStart = newLabel();
+            emitLabel(loopStart.get());
+            emitLoopHint();
+
+            RefPtr<Label> branchOnResult = newLabel();
+            {
+                emitYieldPoint(value.get());
+
+                RefPtr<Label> normalLabel = newLabel();
+                RefPtr<Label> returnLabel = newLabel();
+                {
+                    RefPtr<RegisterID> condition = newTemporary();
+                    emitEqualityOp(op_stricteq, condition.get(), generatorResumeModeRegister(), emitLoad(nullptr, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::NormalMode))));
+                    emitJumpIfTrue(condition.get(), normalLabel.get());
+
+                    emitEqualityOp(op_stricteq, condition.get(), generatorResumeModeRegister(), emitLoad(nullptr, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::ReturnMode))));
+                    emitJumpIfTrue(condition.get(), returnLabel.get());
+
+                    // Fallthrough to ThrowMode.
+                }
+
+                // Throw.
+                {
+                    RefPtr<Label> throwMethodFound = newLabel();
+                    RefPtr<RegisterID> throwMethod = emitGetById(newTemporary(), iterator.get(), propertyNames().throwKeyword);
+                    emitJumpIfFalse(emitIsUndefined(newTemporary(), throwMethod.get()), throwMethodFound.get());
+
+                    emitIteratorClose(iterator.get(), node);
+                    emitThrowTypeError(ASCIILiteral("Delegated generator does not have a 'throw' method."));
+
+                    emitLabel(throwMethodFound.get());
+                    CallArguments throwArguments(*this, nullptr, 1);
+                    emitMove(throwArguments.thisRegister(), iterator.get());
+                    emitMove(throwArguments.argumentRegister(0), generatorValueRegister());
+                    emitCall(value.get(), throwMethod.get(), NoExpectedFunction, throwArguments, node->divot(), node->divotStart(), node->divotEnd(), DebuggableCall::No);
+
+                    emitJumpIfTrue(emitIsObject(newTemporary(), value.get()), branchOnResult.get());
+                    emitThrowTypeError(ASCIILiteral("Iterator result interface is not an object."));
+                }
+
+                // Return.
+                emitLabel(returnLabel.get());
+                {
+                    RefPtr<Label> returnMethodFound = newLabel();
+                    RefPtr<RegisterID> returnMethod = emitGetById(newTemporary(), iterator.get(), propertyNames().returnKeyword);
+                    emitJumpIfFalse(emitIsUndefined(newTemporary(), returnMethod.get()), returnMethodFound.get());
+
+                    emitMove(value.get(), generatorValueRegister());
+
+                    RefPtr<Label> returnSequence = newLabel();
+                    emitJump(returnSequence.get());
+
+                    emitLabel(returnMethodFound.get());
+                    CallArguments returnArguments(*this, nullptr, 1);
+                    emitMove(returnArguments.thisRegister(), iterator.get());
+                    emitMove(returnArguments.argumentRegister(0), generatorValueRegister());
+                    emitCall(value.get(), returnMethod.get(), NoExpectedFunction, returnArguments, node->divot(), node->divotStart(), node->divotEnd(), DebuggableCall::No);
+
+                    RefPtr<Label> returnIteratorResultIsObject = newLabel();
+                    emitJumpIfTrue(emitIsObject(newTemporary(), value.get()), returnIteratorResultIsObject.get());
+                    emitThrowTypeError(ASCIILiteral("Iterator result interface is not an object."));
+
+                    emitLabel(returnIteratorResultIsObject.get());
+                    RefPtr<Label> returnFromGenerator = newLabel();
+                    emitJumpIfTrue(emitGetById(newTemporary(), value.get(), propertyNames().done), returnFromGenerator.get());
+
+                    emitGetById(value.get(), value.get(), propertyNames().value);
+                    emitJump(loopStart.get());
+
+                    emitLabel(returnFromGenerator.get());
+                    emitGetById(value.get(), value.get(), propertyNames().value);
+
+                    emitLabel(returnSequence.get());
+                    if (isInFinallyBlock())
+                        emitPopScopes(scopeRegister(), 0);
+                    emitReturn(value.get());
+                }
+
+                // Normal.
+                emitLabel(normalLabel.get());
+                emitMove(value.get(), generatorValueRegister());
+            }
+
+            emitLabel(nextElement.get());
+            emitIteratorNextWithValue(value.get(), iterator.get(), value.get(), node);
+
+            emitLabel(branchOnResult.get());
+            emitJumpIfTrue(emitGetById(newTemporary(), value.get(), propertyNames().done), loopDone.get());
+            emitGetById(value.get(), value.get(), propertyNames().value);
+            emitJump(loopStart.get());
+        }
+        emitLabel(loopDone.get());
+    }
+
+    emitGetById(value.get(), value.get(), propertyNames().value);
+    return value.get();
+}
+
+
+void BytecodeGenerator::emitGeneratorStateChange(int32_t state)
+{
+    RegisterID* completedState = emitLoad(nullptr, jsNumber(state));
+    emitPutById(generatorRegister(), propertyNames().builtinNames().generatorStatePrivateName(), completedState);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::Variable::VariableKind kind)
+{
+    switch (kind) {
+    case JSC::Variable::NormalVariable:
+        out.print("Normal");
+        return;
+    case JSC::Variable::SpecialVariable:
+        out.print("Special");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/bytecompiler/BytecodeGenerator.h b/bytecompiler/BytecodeGenerator.h
new file mode 100644
index 0000000..961af71
--- /dev/null
+++ b/bytecompiler/BytecodeGenerator.h
@@ -0,0 +1,1006 @@
+/*
+ * Copyright (C) 2008-2009, 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ * Copyright (C) 2012 Igalia, S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "Instruction.h"
+#include "Interpreter.h"
+#include "JSGeneratorFunction.h"
+#include "Label.h"
+#include "LabelScope.h"
+#include "Nodes.h"
+#include "ParserError.h"
+#include "RegisterID.h"
+#include "StaticPropertyAnalyzer.h"
+#include "SymbolTable.h"
+#include "TemplateRegistryKey.h"
+#include "UnlinkedCodeBlock.h"
+#include <functional>
+#include <wtf/HashTraits.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/SegmentedVector.h>
+#include <wtf/SetForScope.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+    class Identifier;
+    class JSTemplateRegistryKey;
+
+    enum ExpectedFunction {
+        NoExpectedFunction,
+        ExpectObjectConstructor,
+        ExpectArrayConstructor
+    };
+
+    enum class DebuggableCall { Yes, No };
+    enum class ThisResolutionType { Local, Scoped };
+    
+    class CallArguments {
+    public:
+        CallArguments(BytecodeGenerator&, ArgumentsNode*, unsigned additionalArguments = 0);
+
+        RegisterID* thisRegister() { return m_argv[0].get(); }
+        RegisterID* argumentRegister(unsigned i) { return m_argv[i + 1].get(); }
+        unsigned stackOffset() { return -m_argv[0]->index() + CallFrame::headerSizeInRegisters; }
+        unsigned argumentCountIncludingThis() { return m_argv.size() - m_padding; }
+        ArgumentsNode* argumentsNode() { return m_argumentsNode; }
+
+    private:
+        ArgumentsNode* m_argumentsNode;
+        Vector<RefPtr<RegisterID>, 8, UnsafeVectorOverflow> m_argv;
+        unsigned m_padding;
+    };
+
+    struct FinallyContext {
+        StatementNode* finallyBlock;
+        RegisterID* iterator;
+        ThrowableExpressionData* enumerationNode;
+        unsigned controlFlowScopeStackSize;
+        unsigned switchContextStackSize;
+        unsigned forInContextStackSize;
+        unsigned tryContextStackSize;
+        unsigned labelScopesSize;
+        unsigned lexicalScopeStackSize;
+        int finallyDepth;
+        int dynamicScopeDepth;
+    };
+
+    struct ControlFlowScope {
+        bool isFinallyBlock;
+        FinallyContext finallyContext;
+    };
+
+    class ForInContext : public RefCounted<ForInContext> {
+        WTF_MAKE_FAST_ALLOCATED;
+        WTF_MAKE_NONCOPYABLE(ForInContext);
+    public:
+        ForInContext(RegisterID* localRegister)
+            : m_localRegister(localRegister)
+            , m_isValid(true)
+        {
+        }
+
+        virtual ~ForInContext()
+        {
+        }
+
+        bool isValid() const { return m_isValid; }
+        void invalidate() { m_isValid = false; }
+
+        enum ForInContextType {
+            StructureForInContextType,
+            IndexedForInContextType
+        };
+        virtual ForInContextType type() const = 0;
+
+        RegisterID* local() const { return m_localRegister.get(); }
+
+    private:
+        RefPtr<RegisterID> m_localRegister;
+        bool m_isValid;
+    };
+
+    class StructureForInContext : public ForInContext {
+    public:
+        StructureForInContext(RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
+            : ForInContext(localRegister)
+            , m_indexRegister(indexRegister)
+            , m_propertyRegister(propertyRegister)
+            , m_enumeratorRegister(enumeratorRegister)
+        {
+        }
+
+        ForInContextType type() const override
+        {
+            return StructureForInContextType;
+        }
+
+        RegisterID* index() const { return m_indexRegister.get(); }
+        RegisterID* property() const { return m_propertyRegister.get(); }
+        RegisterID* enumerator() const { return m_enumeratorRegister.get(); }
+
+    private:
+        RefPtr<RegisterID> m_indexRegister;
+        RefPtr<RegisterID> m_propertyRegister;
+        RefPtr<RegisterID> m_enumeratorRegister;
+    };
+
+    class IndexedForInContext : public ForInContext {
+    public:
+        IndexedForInContext(RegisterID* localRegister, RegisterID* indexRegister)
+            : ForInContext(localRegister)
+            , m_indexRegister(indexRegister)
+        {
+        }
+
+        ForInContextType type() const override
+        {
+            return IndexedForInContextType;
+        }
+
+        RegisterID* index() const { return m_indexRegister.get(); }
+
+    private:
+        RefPtr<RegisterID> m_indexRegister;
+    };
+
+    struct TryData {
+        RefPtr<Label> target;
+        HandlerType handlerType;
+    };
+
+    struct TryContext {
+        RefPtr<Label> start;
+        TryData* tryData;
+    };
+
+    class Variable {
+    public:
+        enum VariableKind { NormalVariable, SpecialVariable };
+
+        Variable()
+            : m_offset()
+            , m_local(nullptr)
+            , m_attributes(0)
+            , m_kind(NormalVariable)
+            , m_symbolTableConstantIndex(0) // This is meaningless here for this kind of Variable.
+            , m_isLexicallyScoped(false)
+        {
+        }
+        
+        Variable(const Identifier& ident)
+            : m_ident(ident)
+            , m_local(nullptr)
+            , m_attributes(0)
+            , m_kind(NormalVariable) // This is somewhat meaningless here for this kind of Variable.
+            , m_symbolTableConstantIndex(0) // This is meaningless here for this kind of Variable.
+            , m_isLexicallyScoped(false)
+        {
+        }
+
+        Variable(const Identifier& ident, VarOffset offset, RegisterID* local, unsigned attributes, VariableKind kind, int symbolTableConstantIndex, bool isLexicallyScoped)
+            : m_ident(ident)
+            , m_offset(offset)
+            , m_local(local)
+            , m_attributes(attributes)
+            , m_kind(kind)
+            , m_symbolTableConstantIndex(symbolTableConstantIndex)
+            , m_isLexicallyScoped(isLexicallyScoped)
+        {
+        }
+
+        // If it's unset, then it is a non-locally-scoped variable. If it is set, then it could be
+        // a stack variable, a scoped variable in a local scope, or a variable captured in the
+        // direct arguments object.
+        bool isResolved() const { return !!m_offset; }
+        int symbolTableConstantIndex() const { ASSERT(isResolved() && !isSpecial()); return m_symbolTableConstantIndex; }
+        
+        const Identifier& ident() const { return m_ident; }
+        
+        VarOffset offset() const { return m_offset; }
+        bool isLocal() const { return m_offset.isStack(); }
+        RegisterID* local() const { return m_local; }
+
+        bool isReadOnly() const { return m_attributes & ReadOnly; }
+        bool isSpecial() const { return m_kind != NormalVariable; }
+        bool isConst() const { return isReadOnly() && m_isLexicallyScoped; }
+        void setIsReadOnly() { m_attributes |= ReadOnly; }
+
+        void dump(PrintStream&) const;
+
+    private:
+        Identifier m_ident;
+        VarOffset m_offset;
+        RegisterID* m_local;
+        unsigned m_attributes;
+        VariableKind m_kind;
+        int m_symbolTableConstantIndex;
+        bool m_isLexicallyScoped;
+    };
+
+    struct TryRange {
+        RefPtr<Label> start;
+        RefPtr<Label> end;
+        TryData* tryData;
+    };
+
+    enum ProfileTypeBytecodeFlag {
+        ProfileTypeBytecodeClosureVar,
+        ProfileTypeBytecodeLocallyResolved,
+        ProfileTypeBytecodeDoesNotHaveGlobalID,
+        ProfileTypeBytecodeFunctionArgument,
+        ProfileTypeBytecodeFunctionReturnStatement
+    };
+
+    class BytecodeGenerator {
+        WTF_MAKE_FAST_ALLOCATED;
+        WTF_MAKE_NONCOPYABLE(BytecodeGenerator);
+    public:
+        typedef DeclarationStacks::FunctionStack FunctionStack;
+
+        BytecodeGenerator(VM&, ProgramNode*, UnlinkedProgramCodeBlock*, DebuggerMode, const VariableEnvironment*);
+        BytecodeGenerator(VM&, FunctionNode*, UnlinkedFunctionCodeBlock*, DebuggerMode, const VariableEnvironment*);
+        BytecodeGenerator(VM&, EvalNode*, UnlinkedEvalCodeBlock*, DebuggerMode, const VariableEnvironment*);
+        BytecodeGenerator(VM&, ModuleProgramNode*, UnlinkedModuleProgramCodeBlock*, DebuggerMode, const VariableEnvironment*);
+
+        ~BytecodeGenerator();
+        
+        VM* vm() const { return m_vm; }
+        ParserArena& parserArena() const { return m_scopeNode->parserArena(); }
+        const CommonIdentifiers& propertyNames() const { return *m_vm->propertyNames; }
+
+        bool isConstructor() const { return m_codeBlock->isConstructor(); }
+        DerivedContextType derivedContextType() const { return m_derivedContextType; }
+        bool usesArrowFunction() const { return m_scopeNode->usesArrowFunction(); }
+        bool needsToUpdateArrowFunctionContext() const { return m_needsToUpdateArrowFunctionContext; }
+        bool usesEval() const { return m_scopeNode->usesEval(); }
+        bool usesThis() const { return m_scopeNode->usesThis(); }
+        ConstructorKind constructorKind() const { return m_codeBlock->constructorKind(); }
+        SuperBinding superBinding() const { return m_codeBlock->superBinding(); }
+        JSParserScriptMode scriptMode() const { return m_codeBlock->scriptMode(); }
+
+        template<typename... Args>
+        static ParserError generate(VM& vm, Args&& ...args)
+        {
+            DeferGC deferGC(vm.heap);
+            auto bytecodeGenerator = std::make_unique<BytecodeGenerator>(vm, std::forward<Args>(args)...);
+            return bytecodeGenerator->generate(); 
+        }
+
+        bool isArgumentNumber(const Identifier&, int);
+
+        Variable variable(const Identifier&, ThisResolutionType = ThisResolutionType::Local);
+        
+        enum ExistingVariableMode { VerifyExisting, IgnoreExisting };
+        void createVariable(const Identifier&, VarKind, SymbolTable*, ExistingVariableMode = VerifyExisting); // Creates the variable, or asserts that the already-created variable is sufficiently compatible.
+        
+        // Returns the register storing "this"
+        RegisterID* thisRegister() { return &m_thisRegister; }
+        RegisterID* argumentsRegister() { return m_argumentsRegister; }
+        RegisterID* newTarget()
+        {
+            return m_newTargetRegister;
+        }
+
+        RegisterID* scopeRegister() { return m_scopeRegister; }
+
+        RegisterID* generatorRegister() { return m_generatorRegister; }
+
+        RegisterID* promiseCapabilityRegister() { return m_promiseCapabilityRegister; }
+
+        // Returns the next available temporary register. Registers returned by
+        // newTemporary require a modified form of reference counting: any
+        // register with a refcount of 0 is considered "available", meaning that
+        // the next instruction may overwrite it.
+        RegisterID* newTemporary();
+
+        // The same as newTemporary(), but this function returns "suggestion" if
+        // "suggestion" is a temporary. This function is helpful in situations
+        // where you've put "suggestion" in a RefPtr, but you'd like to allow
+        // the next instruction to overwrite it anyway.
+        RegisterID* newTemporaryOr(RegisterID* suggestion) { return suggestion->isTemporary() ? suggestion : newTemporary(); }
+
+        // Functions for handling of dst register
+
+        RegisterID* ignoredResult() { return &m_ignoredResultRegister; }
+
+        // This will be allocated in the temporary region of registers, but it will
+        // not be marked as a temporary. This will ensure that finalDestination() does
+        // not overwrite a block scope variable that it mistakes as a temporary. These
+        // registers can be (and are) reclaimed when the lexical scope they belong to
+        // is no longer on the symbol table stack.
+        RegisterID* newBlockScopeVariable();
+
+        // Returns a place to write intermediate values of an operation
+        // which reuses dst if it is safe to do so.
+        RegisterID* tempDestination(RegisterID* dst)
+        {
+            return (dst && dst != ignoredResult() && dst->isTemporary()) ? dst : newTemporary();
+        }
+
+        // Returns the place to write the final output of an operation.
+        RegisterID* finalDestination(RegisterID* originalDst, RegisterID* tempDst = 0)
+        {
+            if (originalDst && originalDst != ignoredResult())
+                return originalDst;
+            ASSERT(tempDst != ignoredResult());
+            if (tempDst && tempDst->isTemporary())
+                return tempDst;
+            return newTemporary();
+        }
+
+        RegisterID* destinationForAssignResult(RegisterID* dst)
+        {
+            if (dst && dst != ignoredResult())
+                return dst->isTemporary() ? dst : newTemporary();
+            return 0;
+        }
+
+        // Moves src to dst if dst is not null and is different from src, otherwise just returns src.
+        RegisterID* moveToDestinationIfNeeded(RegisterID* dst, RegisterID* src)
+        {
+            return dst == ignoredResult() ? 0 : (dst && dst != src) ? emitMove(dst, src) : src;
+        }
+
+        LabelScopePtr newLabelScope(LabelScope::Type, const Identifier* = 0);
+        PassRefPtr<Label> newLabel();
+
+        void emitNode(RegisterID* dst, StatementNode* n)
+        {
+            SetForScope<bool> tailPositionPoisoner(m_inTailPosition, false);
+            return emitNodeInTailPosition(dst, n);
+        }
+
+        void emitNodeInTailPosition(RegisterID* dst, StatementNode* n)
+        {
+            // Node::emitCode assumes that dst, if provided, is either a local or a referenced temporary.
+            ASSERT(!dst || dst == ignoredResult() || !dst->isTemporary() || dst->refCount());
+            if (UNLIKELY(!m_vm->isSafeToRecurse())) {
+                emitThrowExpressionTooDeepException();
+                return;
+            }
+            if (UNLIKELY(n->needsDebugHook()))
+                emitDebugHook(n);
+            n->emitBytecode(*this, dst);
+        }
+
+        void emitNode(StatementNode* n)
+        {
+            emitNode(nullptr, n);
+        }
+
+        void emitNodeInTailPosition(StatementNode* n)
+        {
+            emitNodeInTailPosition(nullptr, n);
+        }
+
+        RegisterID* emitNode(RegisterID* dst, ExpressionNode* n)
+        {
+            SetForScope<bool> tailPositionPoisoner(m_inTailPosition, false);
+            return emitNodeInTailPosition(dst, n);
+        }
+
+        RegisterID* emitNodeInTailPosition(RegisterID* dst, ExpressionNode* n)
+        {
+            // Node::emitCode assumes that dst, if provided, is either a local or a referenced temporary.
+            ASSERT(!dst || dst == ignoredResult() || !dst->isTemporary() || dst->refCount());
+            if (UNLIKELY(!m_vm->isSafeToRecurse()))
+                return emitThrowExpressionTooDeepException();
+            if (UNLIKELY(n->needsDebugHook()))
+                emitDebugHook(n);
+            return n->emitBytecode(*this, dst);
+        }
+
+        RegisterID* emitNode(ExpressionNode* n)
+        {
+            return emitNode(nullptr, n);
+        }
+
+        RegisterID* emitNodeInTailPosition(ExpressionNode* n)
+        {
+            return emitNodeInTailPosition(nullptr, n);
+        }
+
+        void emitNodeInConditionContext(ExpressionNode* n, Label* trueTarget, Label* falseTarget, FallThroughMode fallThroughMode)
+        {
+            if (UNLIKELY(!m_vm->isSafeToRecurse())) {
+                emitThrowExpressionTooDeepException();
+                return;
+            }
+            n->emitBytecodeInConditionContext(*this, trueTarget, falseTarget, fallThroughMode);
+        }
+
+        void emitExpressionInfo(const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        {            
+            ASSERT(divot.offset >= divotStart.offset);
+            ASSERT(divotEnd.offset >= divot.offset);
+
+            int sourceOffset = m_scopeNode->source().startOffset();
+            unsigned firstLine = m_scopeNode->source().firstLine().oneBasedInt();
+
+            int divotOffset = divot.offset - sourceOffset;
+            int startOffset = divot.offset - divotStart.offset;
+            int endOffset = divotEnd.offset - divot.offset;
+
+            unsigned line = divot.line;
+            ASSERT(line >= firstLine);
+            line -= firstLine;
+
+            int lineStart = divot.lineStartOffset;
+            if (lineStart > sourceOffset)
+                lineStart -= sourceOffset;
+            else
+                lineStart = 0;
+
+            if (divotOffset < lineStart)
+                return;
+
+            unsigned column = divotOffset - lineStart;
+
+            unsigned instructionOffset = instructions().size();
+            if (!m_isBuiltinFunction)
+                m_codeBlock->addExpressionInfo(instructionOffset, divotOffset, startOffset, endOffset, line, column);
+        }
+
+
+        ALWAYS_INLINE bool leftHandSideNeedsCopy(bool rightHasAssignments, bool rightIsPure)
+        {
+            return (m_codeType != FunctionCode || rightHasAssignments) && !rightIsPure;
+        }
+
+        ALWAYS_INLINE PassRefPtr<RegisterID> emitNodeForLeftHandSide(ExpressionNode* n, bool rightHasAssignments, bool rightIsPure)
+        {
+            if (leftHandSideNeedsCopy(rightHasAssignments, rightIsPure)) {
+                PassRefPtr<RegisterID> dst = newTemporary();
+                emitNode(dst.get(), n);
+                return dst;
+            }
+
+            return emitNode(n);
+        }
+
+        void hoistSloppyModeFunctionIfNecessary(const Identifier& functionName);
+
+    private:
+        void emitTypeProfilerExpressionInfo(const JSTextPosition& startDivot, const JSTextPosition& endDivot);
+    public:
+
+        // This doesn't emit expression info. If using this, make sure you shouldn't be emitting text offset.
+        void emitProfileType(RegisterID* registerToProfile, ProfileTypeBytecodeFlag); 
+        // These variables are associated with variables in a program. They could be Locals, LocalClosureVar, or ClosureVar.
+        void emitProfileType(RegisterID* registerToProfile, const Variable&, const JSTextPosition& startDivot, const JSTextPosition& endDivot);
+
+        void emitProfileType(RegisterID* registerToProfile, ProfileTypeBytecodeFlag, const JSTextPosition& startDivot, const JSTextPosition& endDivot);
+        // These are not associated with variables and don't have a global id.
+        void emitProfileType(RegisterID* registerToProfile, const JSTextPosition& startDivot, const JSTextPosition& endDivot);
+
+        void emitProfileControlFlow(int);
+        
+        RegisterID* emitLoadArrowFunctionLexicalEnvironment(const Identifier&);
+        RegisterID* ensureThis();
+        void emitLoadThisFromArrowFunctionLexicalEnvironment();
+        RegisterID* emitLoadNewTargetFromArrowFunctionLexicalEnvironment();
+
+        RegisterID* emitLoad(RegisterID* dst, bool);
+        RegisterID* emitLoad(RegisterID* dst, const Identifier&);
+        RegisterID* emitLoad(RegisterID* dst, JSValue, SourceCodeRepresentation = SourceCodeRepresentation::Other);
+        RegisterID* emitLoadGlobalObject(RegisterID* dst);
+
+        RegisterID* emitUnaryOp(OpcodeID, RegisterID* dst, RegisterID* src);
+        RegisterID* emitUnaryOp(OpcodeID, RegisterID* dst, RegisterID* src, OperandTypes);
+        RegisterID* emitUnaryOpProfiled(OpcodeID, RegisterID* dst, RegisterID* src);
+        RegisterID* emitBinaryOp(OpcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2, OperandTypes);
+        RegisterID* emitEqualityOp(OpcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2);
+        RegisterID* emitUnaryNoDstOp(OpcodeID, RegisterID* src);
+
+        RegisterID* emitCreateThis(RegisterID* dst);
+        void emitTDZCheck(RegisterID* target);
+        bool needsTDZCheck(const Variable&);
+        void emitTDZCheckIfNecessary(const Variable&, RegisterID* target, RegisterID* scope);
+        void liftTDZCheckIfPossible(const Variable&);
+        RegisterID* emitNewObject(RegisterID* dst);
+        RegisterID* emitNewArray(RegisterID* dst, ElementNode*, unsigned length); // stops at first elision
+        RegisterID* emitNewArrayWithSpread(RegisterID* dst, ElementNode*);
+        RegisterID* emitNewArrayWithSize(RegisterID* dst, RegisterID* length);
+
+        RegisterID* emitNewFunction(RegisterID* dst, FunctionMetadataNode*);
+        RegisterID* emitNewFunctionExpression(RegisterID* dst, FuncExprNode*);
+        RegisterID* emitNewDefaultConstructor(RegisterID* dst, ConstructorKind, const Identifier& name, const Identifier& ecmaName, const SourceCode& classSource);
+        RegisterID* emitNewArrowFunctionExpression(RegisterID*, ArrowFuncExprNode*);
+        RegisterID* emitNewMethodDefinition(RegisterID* dst, MethodDefinitionNode*);
+        RegisterID* emitNewRegExp(RegisterID* dst, RegExp*);
+
+        void emitSetFunctionNameIfNeeded(ExpressionNode* valueNode, RegisterID* value, RegisterID* name);
+
+        RegisterID* emitMoveLinkTimeConstant(RegisterID* dst, LinkTimeConstant);
+        RegisterID* emitMoveEmptyValue(RegisterID* dst);
+        RegisterID* emitMove(RegisterID* dst, RegisterID* src);
+
+        RegisterID* emitToNumber(RegisterID* dst, RegisterID* src) { return emitUnaryOpProfiled(op_to_number, dst, src); }
+        RegisterID* emitToString(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_to_string, dst, src); }
+        RegisterID* emitInc(RegisterID* srcDst);
+        RegisterID* emitDec(RegisterID* srcDst);
+
+        RegisterID* emitOverridesHasInstance(RegisterID* dst, RegisterID* constructor, RegisterID* hasInstanceValue);
+        RegisterID* emitInstanceOf(RegisterID* dst, RegisterID* value, RegisterID* basePrototype);
+        RegisterID* emitInstanceOfCustom(RegisterID* dst, RegisterID* value, RegisterID* constructor, RegisterID* hasInstanceValue);
+        RegisterID* emitTypeOf(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_typeof, dst, src); }
+        RegisterID* emitIn(RegisterID* dst, RegisterID* property, RegisterID* base) { return emitBinaryOp(op_in, dst, property, base, OperandTypes()); }
+
+        RegisterID* emitTryGetById(RegisterID* dst, RegisterID* base, const Identifier& property);
+        RegisterID* emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property);
+        RegisterID* emitGetById(RegisterID* dst, RegisterID* base, RegisterID* thisVal, const Identifier& property);
+        RegisterID* emitPutById(RegisterID* base, const Identifier& property, RegisterID* value);
+        RegisterID* emitPutById(RegisterID* base, RegisterID* thisValue, const Identifier& property, RegisterID* value);
+        RegisterID* emitDirectPutById(RegisterID* base, const Identifier& property, RegisterID* value, PropertyNode::PutType);
+        RegisterID* emitDeleteById(RegisterID* dst, RegisterID* base, const Identifier&);
+        RegisterID* emitGetByVal(RegisterID* dst, RegisterID* base, RegisterID* property);
+        RegisterID* emitGetByVal(RegisterID* dst, RegisterID* base, RegisterID* thisValue, RegisterID* property);
+        RegisterID* emitGetArgumentByVal(RegisterID* dst, RegisterID* base, RegisterID* property);
+        RegisterID* emitPutByVal(RegisterID* base, RegisterID* property, RegisterID* value);
+        RegisterID* emitPutByVal(RegisterID* base, RegisterID* thisValue, RegisterID* property, RegisterID* value);
+        RegisterID* emitDirectPutByVal(RegisterID* base, RegisterID* property, RegisterID* value);
+        RegisterID* emitDeleteByVal(RegisterID* dst, RegisterID* base, RegisterID* property);
+        RegisterID* emitPutByIndex(RegisterID* base, unsigned index, RegisterID* value);
+
+        RegisterID* emitAssert(RegisterID* condition, int line);
+
+        void emitPutGetterById(RegisterID* base, const Identifier& property, unsigned propertyDescriptorOptions, RegisterID* getter);
+        void emitPutSetterById(RegisterID* base, const Identifier& property, unsigned propertyDescriptorOptions, RegisterID* setter);
+        void emitPutGetterSetter(RegisterID* base, const Identifier& property, unsigned attributes, RegisterID* getter, RegisterID* setter);
+        void emitPutGetterByVal(RegisterID* base, RegisterID* property, unsigned propertyDescriptorOptions, RegisterID* getter);
+        void emitPutSetterByVal(RegisterID* base, RegisterID* property, unsigned propertyDescriptorOptions, RegisterID* setter);
+
+        RegisterID* emitGetArgument(RegisterID* dst, int32_t index);
+
+        // Initialize object with generator fields (@generatorThis, @generatorNext, @generatorState, @generatorFrame)
+        void emitPutGeneratorFields(RegisterID* nextFunction);
+
+        ExpectedFunction expectedFunctionForIdentifier(const Identifier&);
+        RegisterID* emitCall(RegisterID* dst, RegisterID* func, ExpectedFunction, CallArguments&, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+        RegisterID* emitCallInTailPosition(RegisterID* dst, RegisterID* func, ExpectedFunction, CallArguments&, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+        RegisterID* emitCallEval(RegisterID* dst, RegisterID* func, CallArguments&, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+        RegisterID* emitCallVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+        RegisterID* emitCallVarargsInTailPosition(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+        RegisterID* emitCallForwardArgumentsInTailPosition(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+
+        enum PropertyDescriptorOption {
+            PropertyConfigurable = 1,
+            PropertyWritable     = 1 << 1,
+            PropertyEnumerable   = 1 << 2,
+        };
+        void emitCallDefineProperty(RegisterID* newObj, RegisterID* propertyNameRegister,
+            RegisterID* valueRegister, RegisterID* getterRegister, RegisterID* setterRegister, unsigned options, const JSTextPosition&);
+
+        void emitEnumeration(ThrowableExpressionData* enumerationNode, ExpressionNode* subjectNode, const std::function<void(BytecodeGenerator&, RegisterID*)>& callBack, ForOfNode* = nullptr, RegisterID* forLoopSymbolTable = nullptr);
+
+        RegisterID* emitGetTemplateObject(RegisterID* dst, TaggedTemplateNode*);
+
+        RegisterID* emitReturn(RegisterID* src);
+        RegisterID* emitEnd(RegisterID* src) { return emitUnaryNoDstOp(op_end, src); }
+
+        RegisterID* emitConstruct(RegisterID* dst, RegisterID* func, ExpectedFunction, CallArguments&, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+        RegisterID* emitStrcat(RegisterID* dst, RegisterID* src, int count);
+        void emitToPrimitive(RegisterID* dst, RegisterID* src);
+
+        ResolveType resolveType();
+        RegisterID* emitResolveConstantLocal(RegisterID* dst, const Variable&);
+        RegisterID* emitResolveScope(RegisterID* dst, const Variable&);
+        RegisterID* emitGetFromScope(RegisterID* dst, RegisterID* scope, const Variable&, ResolveMode);
+        RegisterID* emitPutToScope(RegisterID* scope, const Variable&, RegisterID* value, ResolveMode, InitializationMode);
+        RegisterID* initializeVariable(const Variable&, RegisterID* value);
+
+        PassRefPtr<Label> emitLabel(Label*);
+        void emitLoopHint();
+        PassRefPtr<Label> emitJump(Label* target);
+        PassRefPtr<Label> emitJumpIfTrue(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfFalse(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfNotFunctionCall(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfNotFunctionApply(RegisterID* cond, Label* target);
+        void emitPopScopes(RegisterID* srcDst, int targetScopeDepth);
+
+        void emitEnter();
+        void emitWatchdog();
+
+        RegisterID* emitHasIndexedProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName);
+        RegisterID* emitHasStructureProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName, RegisterID* enumerator);
+        RegisterID* emitHasGenericProperty(RegisterID* dst, RegisterID* base, RegisterID* propertyName);
+        RegisterID* emitGetPropertyEnumerator(RegisterID* dst, RegisterID* base);
+        RegisterID* emitGetEnumerableLength(RegisterID* dst, RegisterID* base);
+        RegisterID* emitGetStructurePropertyEnumerator(RegisterID* dst, RegisterID* base, RegisterID* length);
+        RegisterID* emitGetGenericPropertyEnumerator(RegisterID* dst, RegisterID* base, RegisterID* length, RegisterID* structureEnumerator);
+        RegisterID* emitEnumeratorStructurePropertyName(RegisterID* dst, RegisterID* enumerator, RegisterID* index);
+        RegisterID* emitEnumeratorGenericPropertyName(RegisterID* dst, RegisterID* enumerator, RegisterID* index);
+        RegisterID* emitToIndexString(RegisterID* dst, RegisterID* index);
+
+        RegisterID* emitIsCellWithType(RegisterID* dst, RegisterID* src, JSType);
+        RegisterID* emitIsJSArray(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, ArrayType); }
+        RegisterID* emitIsProxyObject(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, ProxyObjectType); }
+        RegisterID* emitIsRegExpObject(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, RegExpObjectType); }
+        RegisterID* emitIsMap(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, JSMapType); }
+        RegisterID* emitIsSet(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, JSSetType); }
+        RegisterID* emitIsObject(RegisterID* dst, RegisterID* src);
+        RegisterID* emitIsUndefined(RegisterID* dst, RegisterID* src);
+        RegisterID* emitIsEmpty(RegisterID* dst, RegisterID* src);
+        RegisterID* emitIsDerivedArray(RegisterID* dst, RegisterID* src) { return emitIsCellWithType(dst, src, DerivedArrayType); }
+        void emitRequireObjectCoercible(RegisterID* value, const String& error);
+
+        RegisterID* emitIteratorNext(RegisterID* dst, RegisterID* iterator, const ThrowableExpressionData* node);
+        RegisterID* emitIteratorNextWithValue(RegisterID* dst, RegisterID* iterator, RegisterID* value, const ThrowableExpressionData* node);
+        void emitIteratorClose(RegisterID* iterator, const ThrowableExpressionData* node);
+
+        RegisterID* emitRestParameter(RegisterID* result, unsigned numParametersToSkip);
+
+        bool emitReadOnlyExceptionIfNeeded(const Variable&);
+
+        // Start a try block. 'start' must have been emitted.
+        TryData* pushTry(Label* start);
+        // End a try block. 'end' must have been emitted.
+        void popTryAndEmitCatch(TryData*, RegisterID* exceptionRegister, RegisterID* thrownValueRegister, Label* end, HandlerType);
+
+        void emitThrow(RegisterID* exc)
+        { 
+            m_usesExceptions = true;
+            emitUnaryNoDstOp(op_throw, exc);
+        }
+
+        void emitThrowStaticError(ErrorType, RegisterID*);
+        void emitThrowStaticError(ErrorType, const Identifier& message);
+        void emitThrowReferenceError(const String& message);
+        void emitThrowTypeError(const String& message);
+        void emitThrowTypeError(const Identifier& message);
+        void emitThrowRangeError(const Identifier& message);
+        void emitThrowOutOfMemoryError();
+
+        void emitPushCatchScope(VariableEnvironment&);
+        void emitPopCatchScope(VariableEnvironment&);
+
+        void emitGetScope();
+        RegisterID* emitPushWithScope(RegisterID* objectScope);
+        void emitPopWithScope();
+        void emitPutThisToArrowFunctionContextScope();
+        void emitPutNewTargetToArrowFunctionContextScope();
+        void emitPutDerivedConstructorToArrowFunctionContextScope();
+        RegisterID* emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment();
+
+        void emitDebugHook(DebugHookType, const JSTextPosition&);
+        void emitDebugHook(DebugHookType, unsigned line, unsigned charOffset, unsigned lineStart);
+        void emitDebugHook(StatementNode*);
+        void emitDebugHook(ExpressionNode*);
+        void emitWillLeaveCallFrameDebugHook();
+
+        bool isInFinallyBlock() { return m_finallyDepth > 0; }
+
+        void pushFinallyControlFlowScope(StatementNode* finallyBlock);
+        void popFinallyControlFlowScope();
+        void pushIteratorCloseControlFlowScope(RegisterID* iterator, ThrowableExpressionData* enumerationNode);
+        void popIteratorCloseControlFlowScope();
+
+        void pushIndexedForInScope(RegisterID* local, RegisterID* index);
+        void popIndexedForInScope(RegisterID* local);
+        void pushStructureForInScope(RegisterID* local, RegisterID* index, RegisterID* property, RegisterID* enumerator);
+        void popStructureForInScope(RegisterID* local);
+        void invalidateForInContextForLocal(RegisterID* local);
+
+        LabelScopePtr breakTarget(const Identifier&);
+        LabelScopePtr continueTarget(const Identifier&);
+
+        void beginSwitch(RegisterID*, SwitchInfo::SwitchType);
+        void endSwitch(uint32_t clauseCount, RefPtr<Label>*, ExpressionNode**, Label* defaultLabel, int32_t min, int32_t range);
+
+        void emitYieldPoint(RegisterID*);
+
+        void emitGeneratorStateLabel();
+        void emitGeneratorStateChange(int32_t state);
+        RegisterID* emitYield(RegisterID* argument);
+        RegisterID* emitDelegateYield(RegisterID* argument, ThrowableExpressionData*);
+        RegisterID* generatorStateRegister() { return &m_parameters[static_cast<int32_t>(JSGeneratorFunction::GeneratorArgument::State)]; }
+        RegisterID* generatorValueRegister() { return &m_parameters[static_cast<int32_t>(JSGeneratorFunction::GeneratorArgument::Value)]; }
+        RegisterID* generatorResumeModeRegister() { return &m_parameters[static_cast<int32_t>(JSGeneratorFunction::GeneratorArgument::ResumeMode)]; }
+        RegisterID* generatorFrameRegister() { return &m_parameters[static_cast<int32_t>(JSGeneratorFunction::GeneratorArgument::Frame)]; }
+
+        CodeType codeType() const { return m_codeType; }
+
+        bool shouldEmitDebugHooks() { return m_shouldEmitDebugHooks; }
+        
+        bool isStrictMode() const { return m_codeBlock->isStrictMode(); }
+
+        SourceParseMode parseMode() const { return m_codeBlock->parseMode(); }
+        
+        bool isBuiltinFunction() const { return m_isBuiltinFunction; }
+
+        OpcodeID lastOpcodeID() const { return m_lastOpcodeID; }
+        
+        bool isDerivedConstructorContext() { return m_derivedContextType == DerivedContextType::DerivedConstructorContext; }
+        bool isDerivedClassContext() { return m_derivedContextType == DerivedContextType::DerivedMethodContext; }
+        bool isArrowFunction() { return m_codeBlock->isArrowFunction(); }
+
+        enum class TDZCheckOptimization { Optimize, DoNotOptimize };
+        enum class NestedScopeType { IsNested, IsNotNested };
+    private:
+        enum class TDZRequirement { UnderTDZ, NotUnderTDZ };
+        enum class ScopeType { CatchScope, LetConstScope, FunctionNameScope };
+        enum class ScopeRegisterType { Var, Block };
+        void pushLexicalScopeInternal(VariableEnvironment&, TDZCheckOptimization, NestedScopeType, RegisterID** constantSymbolTableResult, TDZRequirement, ScopeType, ScopeRegisterType);
+        void initializeBlockScopedFunctions(VariableEnvironment&, FunctionStack&, RegisterID* constantSymbolTable);
+        void popLexicalScopeInternal(VariableEnvironment&);
+        template<typename LookUpVarKindFunctor>
+        bool instantiateLexicalVariables(const VariableEnvironment&, SymbolTable*, ScopeRegisterType, LookUpVarKindFunctor);
+        void emitPrefillStackTDZVariables(const VariableEnvironment&, SymbolTable*);
+        void emitPopScope(RegisterID* dst, RegisterID* scope);
+        RegisterID* emitGetParentScope(RegisterID* dst, RegisterID* scope);
+        void emitPushFunctionNameScope(const Identifier& property, RegisterID* value, bool isCaptured);
+        void emitNewFunctionExpressionCommon(RegisterID*, FunctionMetadataNode*);
+        
+        bool isNewTargetUsedInInnerArrowFunction();
+        bool isSuperUsedInInnerArrowFunction();
+        bool isArgumentsUsedInInnerArrowFunction();
+
+    public:
+        bool isSuperCallUsedInInnerArrowFunction();
+        bool isThisUsedInInnerArrowFunction();
+        void pushLexicalScope(VariableEnvironmentNode*, TDZCheckOptimization, NestedScopeType = NestedScopeType::IsNotNested, RegisterID** constantSymbolTableResult = nullptr, bool shouldInitializeBlockScopedFunctions = true);
+        void popLexicalScope(VariableEnvironmentNode*);
+        void prepareLexicalScopeForNextForLoopIteration(VariableEnvironmentNode*, RegisterID* loopSymbolTable);
+        int labelScopeDepth() const;
+
+    private:
+        ParserError generate();
+        void reclaimFreeRegisters();
+        Variable variableForLocalEntry(const Identifier&, const SymbolTableEntry&, int symbolTableConstantIndex, bool isLexicallyScoped);
+
+        void emitOpcode(OpcodeID);
+        UnlinkedArrayAllocationProfile newArrayAllocationProfile();
+        UnlinkedObjectAllocationProfile newObjectAllocationProfile();
+        UnlinkedArrayProfile newArrayProfile();
+        UnlinkedValueProfile emitProfiledOpcode(OpcodeID);
+        int kill(RegisterID* dst)
+        {
+            int index = dst->index();
+            m_staticPropertyAnalyzer.kill(index);
+            return index;
+        }
+
+        void retrieveLastBinaryOp(int& dstIndex, int& src1Index, int& src2Index);
+        void retrieveLastUnaryOp(int& dstIndex, int& srcIndex);
+        ALWAYS_INLINE void rewindBinaryOp();
+        ALWAYS_INLINE void rewindUnaryOp();
+
+        void allocateCalleeSaveSpace();
+        void allocateAndEmitScope();
+        void emitComplexPopScopes(RegisterID*, ControlFlowScope* topScope, ControlFlowScope* bottomScope);
+
+        typedef HashMap<double, JSValue> NumberMap;
+        typedef HashMap<UniquedStringImpl*, JSString*, IdentifierRepHash> IdentifierStringMap;
+        typedef HashMap<Ref<TemplateRegistryKey>, JSTemplateRegistryKey*> TemplateRegistryKeyMap;
+        
+        // Helper for emitCall() and emitConstruct(). This works because the set of
+        // expected functions have identical behavior for both call and construct
+        // (i.e. "Object()" is identical to "new Object()").
+        ExpectedFunction emitExpectedFunctionSnippet(RegisterID* dst, RegisterID* func, ExpectedFunction, CallArguments&, Label* done);
+        
+        RegisterID* emitCall(OpcodeID, RegisterID* dst, RegisterID* func, ExpectedFunction, CallArguments&, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+
+        RegisterID* newRegister();
+
+        // Adds an anonymous local var slot. To give this slot a name, add it to symbolTable().
+        RegisterID* addVar()
+        {
+            ++m_codeBlock->m_numVars;
+            RegisterID* result = newRegister();
+            ASSERT(VirtualRegister(result->index()).toLocal() == m_codeBlock->m_numVars - 1);
+            result->ref(); // We should never free this slot.
+            return result;
+        }
+
+        // Initializes the stack form the parameter; does nothing for the symbol table.
+        RegisterID* initializeNextParameter();
+        UniquedStringImpl* visibleNameForParameter(DestructuringPatternNode*);
+        
+        RegisterID& registerFor(VirtualRegister reg)
+        {
+            if (reg.isLocal())
+                return m_calleeLocals[reg.toLocal()];
+
+            if (reg.offset() == CallFrameSlot::callee)
+                return m_calleeRegister;
+
+            ASSERT(m_parameters.size());
+            return m_parameters[reg.toArgument()];
+        }
+
+        bool hasConstant(const Identifier&) const;
+        unsigned addConstant(const Identifier&);
+        RegisterID* addConstantValue(JSValue, SourceCodeRepresentation = SourceCodeRepresentation::Other);
+        RegisterID* addConstantEmptyValue();
+        unsigned addRegExp(RegExp*);
+
+        unsigned addConstantBuffer(unsigned length);
+        
+        UnlinkedFunctionExecutable* makeFunction(FunctionMetadataNode* metadata)
+        {
+            DerivedContextType newDerivedContextType = DerivedContextType::None;
+
+            if (SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(metadata->parseMode())) {
+                if (constructorKind() == ConstructorKind::Extends || isDerivedConstructorContext())
+                    newDerivedContextType = DerivedContextType::DerivedConstructorContext;
+                else if (m_codeBlock->isClassContext() || isDerivedClassContext())
+                    newDerivedContextType = DerivedContextType::DerivedMethodContext;
+            }
+
+            VariableEnvironment variablesUnderTDZ;
+            getVariablesUnderTDZ(variablesUnderTDZ);
+
+            // FIXME: These flags, ParserModes and propagation to XXXCodeBlocks should be reorganized.
+            // https://bugs.webkit.org/show_bug.cgi?id=151547
+            SourceParseMode parseMode = metadata->parseMode();
+            ConstructAbility constructAbility = constructAbilityForParseMode(parseMode);
+            if (parseMode == SourceParseMode::MethodMode && metadata->constructorKind() != ConstructorKind::None)
+                constructAbility = ConstructAbility::CanConstruct;
+
+            return UnlinkedFunctionExecutable::create(m_vm, m_scopeNode->source(), metadata, isBuiltinFunction() ? UnlinkedBuiltinFunction : UnlinkedNormalFunction, constructAbility, scriptMode(), variablesUnderTDZ, newDerivedContextType);
+        }
+
+        void getVariablesUnderTDZ(VariableEnvironment&);
+
+        RegisterID* emitConstructVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+        RegisterID* emitCallVarargs(OpcodeID, RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* arguments, RegisterID* firstFreeRegister, int32_t firstVarArgOffset, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, DebuggableCall);
+        
+        void emitLogShadowChickenPrologueIfNecessary();
+        void emitLogShadowChickenTailIfNecessary();
+
+        void initializeParameters(FunctionParameters&);
+        void initializeVarLexicalEnvironment(int symbolTableConstantIndex, SymbolTable* functionSymbolTable, bool hasCapturedVariables);
+        void initializeDefaultParameterValuesAndSetupFunctionScopeStack(FunctionParameters&, bool isSimpleParameterList, FunctionNode*, SymbolTable*, int symbolTableConstantIndex, const std::function<bool (UniquedStringImpl*)>& captures, bool shouldCreateArgumentsVariableInParameterScope);
+        void initializeArrowFunctionContextScopeIfNeeded(SymbolTable* functionSymbolTable = nullptr, bool canReuseLexicalEnvironment = false);
+
+    public:
+        JSString* addStringConstant(const Identifier&);
+        JSTemplateRegistryKey* addTemplateRegistryKeyConstant(Ref<TemplateRegistryKey>&&);
+
+        Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>& instructions() { return m_instructions; }
+
+        RegisterID* emitThrowExpressionTooDeepException();
+
+    private:
+        Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow> m_instructions;
+
+        bool m_shouldEmitDebugHooks;
+
+        struct LexicalScopeStackEntry {
+            SymbolTable* m_symbolTable;
+            RegisterID* m_scope;
+            bool m_isWithScope;
+            int m_symbolTableConstantIndex;
+        };
+        Vector<LexicalScopeStackEntry> m_lexicalScopeStack;
+        enum class TDZNecessityLevel {
+            NotNeeded,
+            Optimize,
+            DoNotOptimize
+        };
+        typedef HashMap<RefPtr<UniquedStringImpl>, TDZNecessityLevel, IdentifierRepHash> TDZMap;
+        Vector<TDZMap> m_TDZStack;
+        std::optional<size_t> m_varScopeLexicalScopeStackIndex;
+        void pushTDZVariables(const VariableEnvironment&, TDZCheckOptimization, TDZRequirement);
+
+        ScopeNode* const m_scopeNode;
+        Strong<UnlinkedCodeBlock> m_codeBlock;
+
+        // Some of these objects keep pointers to one another. They are arranged
+        // to ensure a sane destruction order that avoids references to freed memory.
+        HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> m_functions;
+        RegisterID m_ignoredResultRegister;
+        RegisterID m_thisRegister;
+        RegisterID m_calleeRegister;
+        RegisterID* m_scopeRegister { nullptr };
+        RegisterID* m_topMostScope { nullptr };
+        RegisterID* m_argumentsRegister { nullptr };
+        RegisterID* m_lexicalEnvironmentRegister { nullptr };
+        RegisterID* m_generatorRegister { nullptr };
+        RegisterID* m_emptyValueRegister { nullptr };
+        RegisterID* m_globalObjectRegister { nullptr };
+        RegisterID* m_newTargetRegister { nullptr };
+        RegisterID* m_isDerivedConstuctor { nullptr };
+        RegisterID* m_linkTimeConstantRegisters[LinkTimeConstantCount];
+        RegisterID* m_arrowFunctionContextLexicalEnvironmentRegister { nullptr };
+        RegisterID* m_promiseCapabilityRegister { nullptr };
+
+        SegmentedVector<RegisterID*, 16> m_localRegistersForCalleeSaveRegisters;
+        SegmentedVector<RegisterID, 32> m_constantPoolRegisters;
+        SegmentedVector<RegisterID, 32> m_calleeLocals;
+        SegmentedVector<RegisterID, 32> m_parameters;
+        SegmentedVector<Label, 32> m_labels;
+        LabelScopeStore m_labelScopes;
+        int m_finallyDepth { 0 };
+        int m_localScopeDepth { 0 };
+        const CodeType m_codeType;
+
+        int localScopeDepth() const;
+        void pushLocalControlFlowScope();
+        void popLocalControlFlowScope();
+
+        Vector<ControlFlowScope, 0, UnsafeVectorOverflow> m_controlFlowScopeStack;
+        Vector<SwitchInfo> m_switchContextStack;
+        Vector<RefPtr<ForInContext>> m_forInContextStack;
+        Vector<TryContext> m_tryContextStack;
+        unsigned m_yieldPoints { 0 };
+
+        Strong<SymbolTable> m_generatorFrameSymbolTable;
+        int m_generatorFrameSymbolTableIndex { 0 };
+
+        enum FunctionVariableType : uint8_t { NormalFunctionVariable, GlobalFunctionVariable };
+        Vector<std::pair<FunctionMetadataNode*, FunctionVariableType>> m_functionsToInitialize;
+        bool m_needToInitializeArguments { false };
+        RestParameterNode* m_restParameter { nullptr };
+        
+        Vector<TryRange> m_tryRanges;
+        SegmentedVector<TryData, 8> m_tryData;
+
+        int m_nextConstantOffset { 0 };
+
+        typedef HashMap<FunctionMetadataNode*, unsigned> FunctionOffsetMap;
+        FunctionOffsetMap m_functionOffsets;
+        
+        // Constant pool
+        IdentifierMap m_identifierMap;
+
+        typedef HashMap<EncodedJSValueWithRepresentation, unsigned, EncodedJSValueWithRepresentationHash, EncodedJSValueWithRepresentationHashTraits> JSValueMap;
+        JSValueMap m_jsValueMap;
+        IdentifierStringMap m_stringMap;
+        TemplateRegistryKeyMap m_templateRegistryKeyMap;
+
+        StaticPropertyAnalyzer m_staticPropertyAnalyzer { &m_instructions };
+
+        VM* m_vm;
+
+        OpcodeID m_lastOpcodeID = op_end;
+#ifndef NDEBUG
+        size_t m_lastOpcodePosition { 0 };
+#endif
+
+        bool m_usesExceptions { false };
+        bool m_expressionTooDeep { false };
+        bool m_isBuiltinFunction { false };
+        bool m_usesNonStrictEval { false };
+        bool m_inTailPosition { false };
+        bool m_needsToUpdateArrowFunctionContext;
+        DerivedContextType m_derivedContextType { DerivedContextType::None };
+    };
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::Variable::VariableKind);
+
+} // namespace WTF
diff --git a/bytecompiler/Label.h b/bytecompiler/Label.h
new file mode 100644
index 0000000..8219588
--- /dev/null
+++ b/bytecompiler/Label.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "Instruction.h"
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+#include <limits.h>
+
+namespace JSC {
+
+    class BytecodeGenerator;
+
+    class Label {
+    public:
+        explicit Label(BytecodeGenerator& generator)
+            : m_refCount(0)
+            , m_location(invalidLocation)
+            , m_generator(generator)
+        {
+        }
+
+        void setLocation(unsigned);
+
+        int bind(int opcode, int offset) const
+        {
+            if (m_location == invalidLocation) {
+                m_unresolvedJumps.append(std::make_pair(opcode, offset));
+                return 0;
+            }
+            return m_location - opcode;
+        }
+
+        void ref() { ++m_refCount; }
+        void deref()
+        {
+            --m_refCount;
+            ASSERT(m_refCount >= 0);
+        }
+        int refCount() const { return m_refCount; }
+
+        bool isForward() const { return m_location == invalidLocation; }
+        
+        int bind()
+        {
+            ASSERT(!isForward());
+            return bind(0, 0);
+        }
+
+    private:
+        typedef Vector<std::pair<int, int>, 8> JumpVector;
+
+        static const unsigned invalidLocation = UINT_MAX;
+
+        int m_refCount;
+        unsigned m_location;
+        BytecodeGenerator& m_generator;
+        mutable JumpVector m_unresolvedJumps;
+    };
+
+} // namespace JSC
diff --git a/bytecompiler/LabelScope.h b/bytecompiler/LabelScope.h
new file mode 100644
index 0000000..02c4a24
--- /dev/null
+++ b/bytecompiler/LabelScope.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/PassRefPtr.h>
+#include "Label.h"
+
+namespace JSC {
+
+    class Identifier;
+
+    class LabelScope {
+    public:
+        enum Type { Loop, Switch, NamedLabel };
+
+        LabelScope(Type type, const Identifier* name, int scopeDepth, PassRefPtr<Label> breakTarget, PassRefPtr<Label> continueTarget)
+            : m_refCount(0)
+            , m_type(type)
+            , m_name(name)
+            , m_scopeDepth(scopeDepth)
+            , m_breakTarget(breakTarget)
+            , m_continueTarget(continueTarget)
+        {
+        }
+        int refCount() const { return m_refCount; }
+
+        Label* breakTarget() const { return m_breakTarget.get(); }
+        Label* continueTarget() const { return m_continueTarget.get(); }
+
+        Type type() const { return m_type; }
+        const Identifier* name() const { return m_name; }
+        int scopeDepth() const { return m_scopeDepth; }
+
+    private:
+        friend class LabelScopePtr;
+
+        void ref() { ++m_refCount; }
+        void deref()
+        {
+            --m_refCount;
+            ASSERT(m_refCount >= 0);
+        }
+
+        int m_refCount;
+        Type m_type;
+        const Identifier* m_name;
+        int m_scopeDepth;
+        RefPtr<Label> m_breakTarget;
+        RefPtr<Label> m_continueTarget;
+    };
+
+    typedef Vector<LabelScope, 8> LabelScopeStore;
+
+    class LabelScopePtr {
+    public:
+        LabelScopePtr()
+            : m_owner(0)
+            , m_index(0)
+        {
+        }
+        LabelScopePtr(LabelScopeStore& owner, size_t index)
+            : m_owner(&owner)
+            , m_index(index)
+        {
+            m_owner->at(index).ref();
+        }
+
+        LabelScopePtr(const LabelScopePtr& other)
+            : m_owner(other.m_owner)
+            , m_index(other.m_index)
+        {
+            if (m_owner)
+                m_owner->at(m_index).ref();
+        }
+
+        const LabelScopePtr& operator=(const LabelScopePtr& other)
+        {
+            if (other.m_owner)
+                other.m_owner->at(other.m_index).ref();
+            if (m_owner)
+                m_owner->at(m_index).deref();
+            m_owner = other.m_owner;
+            m_index = other.m_index;
+            return *this;
+        }
+
+        ~LabelScopePtr()
+        {
+            if (m_owner)
+                m_owner->at(m_index).deref();
+        }
+
+        bool operator!() const { return !m_owner; }
+
+        LabelScope& operator*() { ASSERT(m_owner); return m_owner->at(m_index); }
+        LabelScope* operator->() { ASSERT(m_owner); return &m_owner->at(m_index); }
+        const LabelScope& operator*() const { ASSERT(m_owner); return m_owner->at(m_index); }
+        const LabelScope* operator->() const { ASSERT(m_owner); return &m_owner->at(m_index); }
+
+        static LabelScopePtr null() { return LabelScopePtr(); }
+
+    private:
+        LabelScopeStore* m_owner;
+        size_t m_index;
+    };
+
+} // namespace JSC
diff --git a/bytecompiler/NodesCodegen.cpp b/bytecompiler/NodesCodegen.cpp
new file mode 100644
index 0000000..93f4bf6
--- /dev/null
+++ b/bytecompiler/NodesCodegen.cpp
@@ -0,0 +1,4134 @@
+/*
+*  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+*  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+*  Copyright (C) 2003-2009, 2012-2013, 2015-2016 Apple Inc. All rights reserved.
+*  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+*  Copyright (C) 2007 Maks Orlovich
+*  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2012 Igalia, S.L.
+*
+*  This library is free software; you can redistribute it and/or
+*  modify it under the terms of the GNU Library General Public
+*  License as published by the Free Software Foundation; either
+*  version 2 of the License, or (at your option) any later version.
+*
+*  This library is distributed in the hope that it will be useful,
+*  but WITHOUT ANY WARRANTY; without even the implied warranty of
+*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+*  Library General Public License for more details.
+*
+*  You should have received a copy of the GNU Library General Public License
+*  along with this library; see the file COPYING.LIB.  If not, write to
+*  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+*  Boston, MA 02110-1301, USA.
+*
+*/
+
+#include "config.h"
+#include "Nodes.h"
+#include "NodeConstructors.h"
+
+#include "BuiltinNames.h"
+#include "BytecodeGenerator.h"
+#include "CallFrame.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGeneratorFunction.h"
+#include "JSGlobalObject.h"
+#include "LabelScope.h"
+#include "Lexer.h"
+#include "Parser.h"
+#include "StackAlignment.h"
+#include <wtf/Assertions.h>
+#include <wtf/Threading.h>
+#include <wtf/text/StringBuilder.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+/*
+    Details of the emitBytecode function.
+
+    Return value: The register holding the production's value.
+             dst: An optional parameter specifying the most efficient destination at
+                  which to store the production's value. The callee must honor dst.
+
+    The dst argument provides for a crude form of copy propagation. For example,
+
+        x = 1
+
+    becomes
+    
+        load r[x], 1
+    
+    instead of 
+
+        load r0, 1
+        mov r[x], r0
+    
+    because the assignment node, "x =", passes r[x] as dst to the number node, "1".
+*/
+
+void ExpressionNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, FallThroughMode fallThroughMode)
+{
+    RegisterID* result = generator.emitNode(this);
+    if (fallThroughMode == FallThroughMeansTrue)
+        generator.emitJumpIfFalse(result, falseTarget);
+    else
+        generator.emitJumpIfTrue(result, trueTarget);
+}
+
+// ------------------------------ ThrowableExpressionData --------------------------------
+
+RegisterID* ThrowableExpressionData::emitThrowReferenceError(BytecodeGenerator& generator, const String& message)
+{
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitThrowReferenceError(message);
+    return generator.newTemporary();
+}
+
+// ------------------------------ ConstantNode ----------------------------------
+
+void ConstantNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, FallThroughMode fallThroughMode)
+{
+    TriState value = jsValue(generator).pureToBoolean();
+
+    if (UNLIKELY(needsDebugHook())) {
+        if (value != MixedTriState)
+            generator.emitDebugHook(this);
+    }
+
+    if (value == MixedTriState)
+        ExpressionNode::emitBytecodeInConditionContext(generator, trueTarget, falseTarget, fallThroughMode);
+    else if (value == TrueTriState && fallThroughMode == FallThroughMeansFalse)
+        generator.emitJump(trueTarget);
+    else if (value == FalseTriState && fallThroughMode == FallThroughMeansTrue)
+        generator.emitJump(falseTarget);
+
+    // All other cases are unconditional fall-throughs, like "if (true)".
+}
+
+RegisterID* ConstantNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitLoad(dst, jsValue(generator));
+}
+
+JSValue StringNode::jsValue(BytecodeGenerator& generator) const
+{
+    return generator.addStringConstant(m_value);
+}
+
+// ------------------------------ NumberNode ----------------------------------
+
+RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return nullptr;
+    return generator.emitLoad(dst, jsValue(generator), isIntegerNode() ? SourceCodeRepresentation::Integer : SourceCodeRepresentation::Double);
+}
+
+// ------------------------------ RegExpNode -----------------------------------
+
+RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitNewRegExp(generator.finalDestination(dst), RegExp::create(*generator.vm(), m_pattern.string(), regExpFlags(m_flags.string())));
+}
+
+// ------------------------------ ThisNode -------------------------------------
+
+RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.ensureThis();
+    if (dst == generator.ignoredResult())
+        return 0;
+
+    RegisterID* result = generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
+    static const unsigned thisLength = 4;
+    generator.emitProfileType(generator.thisRegister(), position(), JSTextPosition(-1, position().offset + thisLength, -1));
+    return result;
+}
+
+// ------------------------------ SuperNode -------------------------------------
+
+static RegisterID* emitHomeObjectForCallee(BytecodeGenerator& generator)
+{
+    if (generator.isDerivedClassContext() || generator.isDerivedConstructorContext()) {
+        RegisterID* derivedConstructor = generator.emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment();
+        return generator.emitGetById(generator.newTemporary(), derivedConstructor, generator.propertyNames().builtinNames().homeObjectPrivateName());
+    }
+
+    RegisterID callee;
+    callee.setIndex(CallFrameSlot::callee);
+    return generator.emitGetById(generator.newTemporary(), &callee, generator.propertyNames().builtinNames().homeObjectPrivateName());
+}
+
+static RegisterID* emitSuperBaseForCallee(BytecodeGenerator& generator)
+{
+    RefPtr<RegisterID> homeObject = emitHomeObjectForCallee(generator);
+    return generator.emitGetById(generator.newTemporary(), homeObject.get(), generator.propertyNames().underscoreProto);
+}
+
+static RegisterID* emitGetSuperFunctionForConstruct(BytecodeGenerator& generator)
+{
+    if (generator.isDerivedConstructorContext())
+        return generator.emitGetById(generator.newTemporary(), generator.emitLoadDerivedConstructorFromArrowFunctionLexicalEnvironment(), generator.propertyNames().underscoreProto);
+
+    RegisterID callee;
+    callee.setIndex(CallFrameSlot::callee);
+    return generator.emitGetById(generator.newTemporary(), &callee, generator.propertyNames().underscoreProto);
+}
+
+RegisterID* SuperNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RegisterID* result = emitSuperBaseForCallee(generator);
+    return generator.moveToDestinationIfNeeded(generator.finalDestination(dst), result);
+}
+
+// ------------------------------ NewTargetNode ----------------------------------
+
+RegisterID* NewTargetNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return nullptr;
+
+    return generator.moveToDestinationIfNeeded(dst, generator.newTarget());
+}
+
+// ------------------------------ ResolveNode ----------------------------------
+
+bool ResolveNode::isPure(BytecodeGenerator& generator) const
+{
+    return generator.variable(m_ident).offset().isStack();
+}
+
+RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    Variable var = generator.variable(m_ident);
+    if (RegisterID* local = var.local()) {
+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
+        if (dst == generator.ignoredResult())
+            return nullptr;
+
+        generator.emitProfileType(local, var, m_position, JSTextPosition(-1, m_position.offset + m_ident.length(), -1));
+        return generator.moveToDestinationIfNeeded(dst, local);
+    }
+    
+    JSTextPosition divot = m_start + m_ident.length();
+    generator.emitExpressionInfo(divot, m_start, divot);
+    RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
+    RegisterID* finalDest = generator.finalDestination(dst);
+    RegisterID* result = generator.emitGetFromScope(finalDest, scope.get(), var, ThrowIfNotFound);
+    generator.emitTDZCheckIfNecessary(var, finalDest, nullptr);
+    generator.emitProfileType(finalDest, var, m_position, JSTextPosition(-1, m_position.offset + m_ident.length(), -1));
+    return result;
+}
+
+// ------------------------------ TemplateStringNode -----------------------------------
+
+RegisterID* TemplateStringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return nullptr;
+    return generator.emitLoad(dst, JSValue(generator.addStringConstant(cooked())));
+}
+
+// ------------------------------ TemplateLiteralNode -----------------------------------
+
+RegisterID* TemplateLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (!m_templateExpressions) {
+        TemplateStringNode* templateString = m_templateStrings->value();
+        ASSERT_WITH_MESSAGE(!m_templateStrings->next(), "Only one template element exists because there's no expression in a given template literal.");
+        return generator.emitNode(dst, templateString);
+    }
+
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    TemplateStringListNode* templateString = m_templateStrings;
+    TemplateExpressionListNode* templateExpression = m_templateExpressions;
+    for (; templateExpression; templateExpression = templateExpression->next(), templateString = templateString->next()) {
+        // Evaluate TemplateString.
+        if (!templateString->value()->cooked().isEmpty()) {
+            temporaryRegisters.append(generator.newTemporary());
+            generator.emitNode(temporaryRegisters.last().get(), templateString->value());
+        }
+
+        // Evaluate Expression.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), templateExpression->value());
+        generator.emitToString(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+
+    // Evaluate tail TemplateString.
+    if (!templateString->value()->cooked().isEmpty()) {
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), templateString->value());
+    }
+
+    if (temporaryRegisters.size() == 1)
+        return generator.emitToString(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get());
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
+}
+
+// ------------------------------ TaggedTemplateNode -----------------------------------
+
+RegisterID* TaggedTemplateNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ExpectedFunction expectedFunction = NoExpectedFunction;
+    RefPtr<RegisterID> tag = nullptr;
+    RefPtr<RegisterID> base = nullptr;
+    if (!m_tag->isLocation()) {
+        tag = generator.newTemporary();
+        tag = generator.emitNode(tag.get(), m_tag);
+    } else if (m_tag->isResolveNode()) {
+        ResolveNode* resolve = static_cast<ResolveNode*>(m_tag);
+        const Identifier& identifier = resolve->identifier();
+        expectedFunction = generator.expectedFunctionForIdentifier(identifier);
+
+        Variable var = generator.variable(identifier);
+        if (RegisterID* local = var.local()) {
+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
+            tag = generator.emitMove(generator.newTemporary(), local);
+        } else {
+            tag = generator.newTemporary();
+            base = generator.newTemporary();
+
+            JSTextPosition newDivot = divotStart() + identifier.length();
+            generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
+            generator.moveToDestinationIfNeeded(base.get(), generator.emitResolveScope(base.get(), var));
+            generator.emitGetFromScope(tag.get(), base.get(), var, ThrowIfNotFound);
+            generator.emitTDZCheckIfNecessary(var, tag.get(), nullptr);
+        }
+    } else if (m_tag->isBracketAccessorNode()) {
+        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(m_tag);
+        base = generator.newTemporary();
+        base = generator.emitNode(base.get(), bracket->base());
+        RefPtr<RegisterID> property = generator.emitNode(bracket->subscript());
+        if (bracket->base()->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            tag = generator.emitGetByVal(generator.newTemporary(), base.get(), thisValue.get(), property.get());
+        } else
+            tag = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
+    } else {
+        ASSERT(m_tag->isDotAccessorNode());
+        DotAccessorNode* dot = static_cast<DotAccessorNode*>(m_tag);
+        base = generator.newTemporary();
+        base = generator.emitNode(base.get(), dot->base());
+        if (dot->base()->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            tag = generator.emitGetById(generator.newTemporary(), base.get(), thisValue.get(), dot->identifier());
+        } else
+            tag = generator.emitGetById(generator.newTemporary(), base.get(), dot->identifier());
+    }
+
+    RefPtr<RegisterID> templateObject = generator.emitGetTemplateObject(generator.newTemporary(), this);
+
+    unsigned expressionsCount = 0;
+    for (TemplateExpressionListNode* templateExpression = m_templateLiteral->templateExpressions(); templateExpression; templateExpression = templateExpression->next())
+        ++expressionsCount;
+
+    CallArguments callArguments(generator, nullptr, 1 + expressionsCount);
+    if (base)
+        generator.emitMove(callArguments.thisRegister(), base.get());
+    else
+        generator.emitLoad(callArguments.thisRegister(), jsUndefined());
+
+    unsigned argumentIndex = 0;
+    generator.emitMove(callArguments.argumentRegister(argumentIndex++), templateObject.get());
+    for (TemplateExpressionListNode* templateExpression = m_templateLiteral->templateExpressions(); templateExpression; templateExpression = templateExpression->next())
+        generator.emitNode(callArguments.argumentRegister(argumentIndex++), templateExpression->value());
+
+    return generator.emitCallInTailPosition(generator.finalDestination(dst, tag.get()), tag.get(), expectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+}
+
+// ------------------------------ ArrayNode ------------------------------------
+
+RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // FIXME: Should we put all of this code into emitNewArray?
+
+    unsigned length = 0;
+    ElementNode* firstPutElement;
+    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
+        if (firstPutElement->elision() || firstPutElement->value()->isSpreadExpression())
+            break;
+        ++length;
+    }
+
+    if (!firstPutElement && !m_elision)
+        return generator.emitNewArray(generator.finalDestination(dst), m_element, length);
+
+    if (firstPutElement && firstPutElement->value()->isSpreadExpression()) {
+        bool hasElision = false;
+        for (ElementNode* node = m_element; node; node = node->next()) {
+            if (!!node->elision()) {
+                hasElision = true;
+                break;
+            }
+        }
+        if (!!m_elision)
+            hasElision = true;
+
+        if (!hasElision)
+            return generator.emitNewArrayWithSpread(generator.finalDestination(dst), m_element);
+    }
+
+    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element, length);
+    ElementNode* n = firstPutElement;
+    for (; n; n = n->next()) {
+        if (n->value()->isSpreadExpression())
+            goto handleSpread;
+        RegisterID* value = generator.emitNode(n->value());
+        length += n->elision();
+        generator.emitPutByIndex(array.get(), length++, value);
+    }
+
+    if (m_elision) {
+        RegisterID* value = generator.emitLoad(0, jsNumber(m_elision + length));
+        generator.emitPutById(array.get(), generator.propertyNames().length, value);
+    }
+
+    return generator.moveToDestinationIfNeeded(dst, array.get());
+    
+handleSpread:
+    RefPtr<RegisterID> index = generator.emitLoad(generator.newTemporary(), jsNumber(length));
+    auto spreader = [this, array, index](BytecodeGenerator& generator, RegisterID* value)
+    {
+        generator.emitDirectPutByVal(array.get(), index.get(), value);
+        generator.emitInc(index.get());
+    };
+    for (; n; n = n->next()) {
+        if (n->elision())
+            generator.emitBinaryOp(op_add, index.get(), index.get(), generator.emitLoad(0, jsNumber(n->elision())), OperandTypes(ResultType::numberTypeIsInt32(), ResultType::numberTypeIsInt32()));
+        if (n->value()->isSpreadExpression()) {
+            SpreadExpressionNode* spread = static_cast<SpreadExpressionNode*>(n->value());
+            generator.emitEnumeration(spread, spread->expression(), spreader);
+        } else {
+            generator.emitDirectPutByVal(array.get(), index.get(), generator.emitNode(n->value()));
+            generator.emitInc(index.get());
+        }
+    }
+    
+    if (m_elision) {
+        generator.emitBinaryOp(op_add, index.get(), index.get(), generator.emitLoad(0, jsNumber(m_elision)), OperandTypes(ResultType::numberTypeIsInt32(), ResultType::numberTypeIsInt32()));
+        generator.emitPutById(array.get(), generator.propertyNames().length, index.get());
+    }
+    return generator.moveToDestinationIfNeeded(dst, array.get());
+}
+
+bool ArrayNode::isSimpleArray() const
+{
+    if (m_elision || m_optional)
+        return false;
+    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
+        if (ptr->elision())
+            return false;
+        if (ptr->value()->isSpreadExpression())
+            return false;
+    }
+    return true;
+}
+
+ArgumentListNode* ArrayNode::toArgumentList(ParserArena& parserArena, int lineNumber, int startPosition) const
+{
+    ASSERT(!m_elision && !m_optional);
+    ElementNode* ptr = m_element;
+    if (!ptr)
+        return 0;
+    JSTokenLocation location;
+    location.line = lineNumber;
+    location.startOffset = startPosition;
+    ArgumentListNode* head = new (parserArena) ArgumentListNode(location, ptr->value());
+    ArgumentListNode* tail = head;
+    ptr = ptr->next();
+    for (; ptr; ptr = ptr->next()) {
+        ASSERT(!ptr->elision());
+        tail = new (parserArena) ArgumentListNode(location, tail, ptr->value());
+    }
+    return head;
+}
+
+// ------------------------------ ObjectLiteralNode ----------------------------
+
+RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (!m_list) {
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.emitNewObject(generator.finalDestination(dst));
+    }
+    RefPtr<RegisterID> newObj = generator.emitNewObject(generator.tempDestination(dst));
+    generator.emitNode(newObj.get(), m_list);
+    return generator.moveToDestinationIfNeeded(dst, newObj.get());
+}
+
+// ------------------------------ PropertyListNode -----------------------------
+
+static inline void emitPutHomeObject(BytecodeGenerator& generator, RegisterID* function, RegisterID* homeObject)
+{
+    generator.emitPutById(function, generator.propertyNames().builtinNames().homeObjectPrivateName(), homeObject);
+}
+
+RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // Fast case: this loop just handles regular value properties.
+    PropertyListNode* p = this;
+    for (; p && (p->m_node->m_type & PropertyNode::Constant); p = p->m_next)
+        emitPutConstantProperty(generator, dst, *p->m_node);
+
+    // Were there any get/set properties?
+    if (p) {
+        // Build a list of getter/setter pairs to try to put them at the same time. If we encounter
+        // a computed property, just emit everything as that may override previous values.
+        bool hasComputedProperty = false;
+
+        typedef std::pair<PropertyNode*, PropertyNode*> GetterSetterPair;
+        typedef HashMap<UniquedStringImpl*, GetterSetterPair, IdentifierRepHash> GetterSetterMap;
+        GetterSetterMap map;
+
+        // Build a map, pairing get/set values together.
+        for (PropertyListNode* q = p; q; q = q->m_next) {
+            PropertyNode* node = q->m_node;
+            if (node->m_type & PropertyNode::Computed) {
+                hasComputedProperty = true;
+                break;
+            }
+            if (node->m_type & PropertyNode::Constant)
+                continue;
+
+            // Duplicates are possible.
+            GetterSetterPair pair(node, static_cast<PropertyNode*>(nullptr));
+            GetterSetterMap::AddResult result = map.add(node->name()->impl(), pair);
+            if (!result.isNewEntry) {
+                if (result.iterator->value.first->m_type == node->m_type)
+                    result.iterator->value.first = node;
+                else
+                    result.iterator->value.second = node;
+            }
+        }
+
+        // Iterate over the remaining properties in the list.
+        for (; p; p = p->m_next) {
+            PropertyNode* node = p->m_node;
+
+            // Handle regular values.
+            if (node->m_type & PropertyNode::Constant) {
+                emitPutConstantProperty(generator, dst, *node);
+                continue;
+            }
+
+            RefPtr<RegisterID> value = generator.emitNode(node->m_assign);
+            bool needsSuperBinding = node->needsSuperBinding();
+            if (needsSuperBinding)
+                emitPutHomeObject(generator, value.get(), dst);
+
+            unsigned attributes = node->isClassProperty() ? (Accessor | DontEnum) : Accessor;
+
+            ASSERT(node->m_type & (PropertyNode::Getter | PropertyNode::Setter));
+
+            // This is a get/set property which may be overridden by a computed property later.
+            if (hasComputedProperty) {
+                // Computed accessors.
+                if (node->m_type & PropertyNode::Computed) {
+                    RefPtr<RegisterID> propertyName = generator.emitNode(node->m_expression);
+                    generator.emitSetFunctionNameIfNeeded(node->m_assign, value.get(), propertyName.get());
+                    if (node->m_type & PropertyNode::Getter)
+                        generator.emitPutGetterByVal(dst, propertyName.get(), attributes, value.get());
+                    else
+                        generator.emitPutSetterByVal(dst, propertyName.get(), attributes, value.get());
+                    continue;
+                }
+
+                if (node->m_type & PropertyNode::Getter)
+                    generator.emitPutGetterById(dst, *node->name(), attributes, value.get());
+                else
+                    generator.emitPutSetterById(dst, *node->name(), attributes, value.get());
+                continue;
+            }
+
+            // This is a get/set property pair.
+            GetterSetterMap::iterator it = map.find(node->name()->impl());
+            ASSERT(it != map.end());
+            GetterSetterPair& pair = it->value;
+
+            // Was this already generated as a part of its partner?
+            if (pair.second == node)
+                continue;
+
+            // Generate the paired node now.
+            RefPtr<RegisterID> getterReg;
+            RefPtr<RegisterID> setterReg;
+            RegisterID* secondReg = nullptr;
+
+            if (node->m_type & PropertyNode::Getter) {
+                getterReg = value;
+                if (pair.second) {
+                    ASSERT(pair.second->m_type & PropertyNode::Setter);
+                    setterReg = generator.emitNode(pair.second->m_assign);
+                    secondReg = setterReg.get();
+                } else {
+                    setterReg = generator.newTemporary();
+                    generator.emitLoad(setterReg.get(), jsUndefined());
+                }
+            } else {
+                ASSERT(node->m_type & PropertyNode::Setter);
+                setterReg = value;
+                if (pair.second) {
+                    ASSERT(pair.second->m_type & PropertyNode::Getter);
+                    getterReg = generator.emitNode(pair.second->m_assign);
+                    secondReg = getterReg.get();
+                } else {
+                    getterReg = generator.newTemporary();
+                    generator.emitLoad(getterReg.get(), jsUndefined());
+                }
+            }
+
+            ASSERT(!pair.second || needsSuperBinding == pair.second->needsSuperBinding());
+            if (needsSuperBinding && pair.second)
+                emitPutHomeObject(generator, secondReg, dst);
+
+            generator.emitPutGetterSetter(dst, *node->name(), attributes, getterReg.get(), setterReg.get());
+        }
+    }
+
+    return dst;
+}
+
+void PropertyListNode::emitPutConstantProperty(BytecodeGenerator& generator, RegisterID* newObj, PropertyNode& node)
+{
+    RefPtr<RegisterID> value = generator.emitNode(node.m_assign);
+    if (node.needsSuperBinding())
+        emitPutHomeObject(generator, value.get(), newObj);
+
+    if (node.isClassProperty()) {
+        ASSERT(node.needsSuperBinding());
+        RefPtr<RegisterID> propertyNameRegister;
+        if (node.name())
+            propertyNameRegister = generator.emitLoad(nullptr, *node.name());
+        else
+            propertyNameRegister = generator.emitNode(node.m_expression);
+
+        generator.emitSetFunctionNameIfNeeded(node.m_assign, value.get(), propertyNameRegister.get());
+        generator.emitCallDefineProperty(newObj, propertyNameRegister.get(), value.get(), nullptr, nullptr, BytecodeGenerator::PropertyConfigurable | BytecodeGenerator::PropertyWritable, m_position);
+        return;
+    }
+    if (const auto* identifier = node.name()) {
+        std::optional<uint32_t> optionalIndex = parseIndex(*identifier);
+        if (!optionalIndex) {
+            generator.emitDirectPutById(newObj, *identifier, value.get(), node.putType());
+            return;
+        }
+
+        RefPtr<RegisterID> index = generator.emitLoad(nullptr, jsNumber(optionalIndex.value()));
+        generator.emitDirectPutByVal(newObj, index.get(), value.get());
+        return;
+    }
+    RefPtr<RegisterID> propertyName = generator.emitNode(node.m_expression);
+    generator.emitSetFunctionNameIfNeeded(node.m_assign, value.get(), propertyName.get());
+    generator.emitDirectPutByVal(newObj, propertyName.get(), value.get());
+}
+
+// ------------------------------ BracketAccessorNode --------------------------------
+
+static bool isNonIndexStringElement(ExpressionNode& element)
+{
+    return element.isString() && !parseIndex(static_cast<StringNode&>(element).value());
+}
+
+RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_base->isSuperNode()) {
+        RefPtr<RegisterID> finalDest = generator.finalDestination(dst);
+        RefPtr<RegisterID> thisValue = generator.ensureThis();
+        RefPtr<RegisterID> superBase = emitSuperBaseForCallee(generator);
+
+        if (isNonIndexStringElement(*m_subscript)) {
+            const Identifier& id = static_cast<StringNode*>(m_subscript)->value();
+            generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+            generator.emitGetById(finalDest.get(), superBase.get(), thisValue.get(), id);
+        } else  {
+            RefPtr<RegisterID> subscript = generator.emitNode(m_subscript);
+            generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+            generator.emitGetByVal(finalDest.get(), superBase.get(), thisValue.get(), subscript.get());
+        }
+
+        generator.emitProfileType(finalDest.get(), divotStart(), divotEnd());
+        return finalDest.get();
+    }
+
+    RegisterID* ret;
+    RefPtr<RegisterID> finalDest = generator.finalDestination(dst);
+
+    if (isNonIndexStringElement(*m_subscript)) {
+        RefPtr<RegisterID> base = generator.emitNode(m_base);
+        generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+        ret = generator.emitGetById(finalDest.get(), base.get(), static_cast<StringNode*>(m_subscript)->value());
+    } else {
+        RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+        RegisterID* property = generator.emitNode(m_subscript);
+        generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+        ret = generator.emitGetByVal(finalDest.get(), base.get(), property);
+    }
+
+    generator.emitProfileType(finalDest.get(), divotStart(), divotEnd());
+    return ret;
+}
+
+// ------------------------------ DotAccessorNode --------------------------------
+
+RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    bool baseIsSuper = m_base->isSuperNode();
+    RefPtr<RegisterID> base = baseIsSuper ? emitSuperBaseForCallee(generator) : generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RegisterID* finalDest = generator.finalDestination(dst);
+    RegisterID* ret;
+    if (baseIsSuper) {
+        RefPtr<RegisterID> thisValue = generator.ensureThis();
+        ret = generator.emitGetById(finalDest, base.get(), thisValue.get(), m_ident);
+    } else
+        ret = generator.emitGetById(finalDest, base.get(), m_ident);
+    generator.emitProfileType(finalDest, divotStart(), divotEnd());
+    return ret;
+}
+
+// ------------------------------ ArgumentListNode -----------------------------
+
+RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    return generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ NewExprNode ----------------------------------
+
+RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ExpectedFunction expectedFunction;
+    if (m_expr->isResolveNode())
+        expectedFunction = generator.expectedFunctionForIdentifier(static_cast<ResolveNode*>(m_expr)->identifier());
+    else
+        expectedFunction = NoExpectedFunction;
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    RefPtr<RegisterID> returnValue = generator.finalDestination(dst, func.get());
+    CallArguments callArguments(generator, m_args);
+    generator.emitMove(callArguments.thisRegister(), func.get());
+    return generator.emitConstruct(returnValue.get(), func.get(), expectedFunction, callArguments, divot(), divotStart(), divotEnd());
+}
+
+CallArguments::CallArguments(BytecodeGenerator& generator, ArgumentsNode* argumentsNode, unsigned additionalArguments)
+    : m_argumentsNode(argumentsNode)
+    , m_padding(0)
+{
+    size_t argumentCountIncludingThis = 1 + additionalArguments; // 'this' register.
+    if (argumentsNode) {
+        for (ArgumentListNode* node = argumentsNode->m_listNode; node; node = node->m_next)
+            ++argumentCountIncludingThis;
+    }
+
+    m_argv.grow(argumentCountIncludingThis);
+    for (int i = argumentCountIncludingThis - 1; i >= 0; --i) {
+        m_argv[i] = generator.newTemporary();
+        ASSERT(static_cast<size_t>(i) == m_argv.size() - 1 || m_argv[i]->index() == m_argv[i + 1]->index() - 1);
+    }
+
+    // We need to ensure that the frame size is stack-aligned
+    while ((CallFrame::headerSizeInRegisters + m_argv.size()) % stackAlignmentRegisters()) {
+        m_argv.insert(0, generator.newTemporary());
+        m_padding++;
+    }
+    
+    while (stackOffset() % stackAlignmentRegisters()) {
+        m_argv.insert(0, generator.newTemporary());
+        m_padding++;
+    }
+}
+
+// ------------------------------ EvalFunctionCallNode ----------------------------------
+
+RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // We need try to load 'this' before call eval in constructor, because 'this' can created by 'super' in some of the arrow function
+    // var A = class A {
+    //   constructor () { this.id = 'A'; }
+    // }
+    //
+    // var B = class B extend A {
+    //    constructor () {
+    //       var arrow = () => super();
+    //       arrow();
+    //       eval("this.id = 'B'");
+    //    }
+    // }
+    if (generator.constructorKind() == ConstructorKind::Extends && generator.needsToUpdateArrowFunctionContext() && generator.isThisUsedInInnerArrowFunction())
+        generator.emitLoadThisFromArrowFunctionLexicalEnvironment();
+
+    Variable var = generator.variable(generator.propertyNames().eval);
+    if (RegisterID* local = var.local()) {
+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
+        RefPtr<RegisterID> func = generator.emitMove(generator.tempDestination(dst), local);
+        CallArguments callArguments(generator, m_args);
+        generator.emitLoad(callArguments.thisRegister(), jsUndefined());
+        return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::No);
+    }
+
+    RefPtr<RegisterID> func = generator.newTemporary();
+    CallArguments callArguments(generator, m_args);
+    JSTextPosition newDivot = divotStart() + 4;
+    generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
+    generator.moveToDestinationIfNeeded(
+        callArguments.thisRegister(),
+        generator.emitResolveScope(callArguments.thisRegister(), var));
+    generator.emitGetFromScope(func.get(), callArguments.thisRegister(), var, ThrowIfNotFound);
+    generator.emitTDZCheckIfNecessary(var, func.get(), nullptr);
+    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::No);
+}
+
+// ------------------------------ FunctionCallValueNode ----------------------------------
+
+RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_expr->isSuperNode()) {
+        RefPtr<RegisterID> func = emitGetSuperFunctionForConstruct(generator);
+        RefPtr<RegisterID> returnValue = generator.finalDestination(dst, func.get());
+        CallArguments callArguments(generator, m_args);
+
+        ASSERT(generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext);
+        ASSERT(generator.constructorKind() == ConstructorKind::Extends || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext);
+        generator.emitMove(callArguments.thisRegister(), generator.newTarget());
+        RegisterID* ret = generator.emitConstruct(returnValue.get(), func.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd());
+
+        bool isConstructorKindDerived = generator.constructorKind() == ConstructorKind::Extends;
+        bool doWeUseArrowFunctionInConstructor = isConstructorKindDerived && generator.needsToUpdateArrowFunctionContext();
+
+        if (generator.isDerivedConstructorContext() || (doWeUseArrowFunctionInConstructor && generator.isSuperCallUsedInInnerArrowFunction()))
+            generator.emitLoadThisFromArrowFunctionLexicalEnvironment();
+        
+        RefPtr<Label> thisIsEmptyLabel = generator.newLabel();
+        generator.emitJumpIfTrue(generator.emitIsEmpty(generator.newTemporary(), generator.thisRegister()), thisIsEmptyLabel.get());
+        generator.emitThrowReferenceError(ASCIILiteral("'super()' can't be called more than once in a constructor."));
+        generator.emitLabel(thisIsEmptyLabel.get());
+
+        generator.emitMove(generator.thisRegister(), ret);
+        
+        if (generator.isDerivedConstructorContext() || doWeUseArrowFunctionInConstructor)
+            generator.emitPutThisToArrowFunctionContextScope();
+        
+        return ret;
+    }
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    RefPtr<RegisterID> returnValue = generator.finalDestination(dst, func.get());
+    CallArguments callArguments(generator, m_args);
+    generator.emitLoad(callArguments.thisRegister(), jsUndefined());
+    RegisterID* ret = generator.emitCallInTailPosition(returnValue.get(), func.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+    generator.emitProfileType(returnValue.get(), divotStart(), divotEnd());
+    return ret;
+}
+
+// ------------------------------ FunctionCallResolveNode ----------------------------------
+
+RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ExpectedFunction expectedFunction = generator.expectedFunctionForIdentifier(m_ident);
+
+    Variable var = generator.variable(m_ident);
+    if (RegisterID* local = var.local()) {
+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
+        RefPtr<RegisterID> func = generator.emitMove(generator.tempDestination(dst), local);
+        RefPtr<RegisterID> returnValue = generator.finalDestination(dst, func.get());
+        CallArguments callArguments(generator, m_args);
+        generator.emitLoad(callArguments.thisRegister(), jsUndefined());
+        // This passes NoExpectedFunction because we expect that if the function is in a
+        // local variable, then it's not one of our built-in constructors.
+        RegisterID* ret = generator.emitCallInTailPosition(returnValue.get(), func.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+        generator.emitProfileType(returnValue.get(), divotStart(), divotEnd());
+        return ret;
+    }
+
+    RefPtr<RegisterID> func = generator.newTemporary();
+    RefPtr<RegisterID> returnValue = generator.finalDestination(dst, func.get());
+    CallArguments callArguments(generator, m_args);
+
+    JSTextPosition newDivot = divotStart() + m_ident.length();
+    generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
+    generator.moveToDestinationIfNeeded(
+        callArguments.thisRegister(),
+        generator.emitResolveScope(callArguments.thisRegister(), var));
+    generator.emitGetFromScope(func.get(), callArguments.thisRegister(), var, ThrowIfNotFound);
+    generator.emitTDZCheckIfNecessary(var, func.get(), nullptr);
+    RegisterID* ret = generator.emitCallInTailPosition(returnValue.get(), func.get(), expectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+    generator.emitProfileType(returnValue.get(), divotStart(), divotEnd());
+    return ret;
+}
+
+// ------------------------------ BytecodeIntrinsicNode ----------------------------------
+
+RegisterID* BytecodeIntrinsicNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    return (this->*m_emitter)(generator, dst);
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_argument(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    ASSERT(node->m_expr->isNumber());
+    double value = static_cast<NumberNode*>(node->m_expr)->value();
+    int32_t index = static_cast<int32_t>(value);
+    ASSERT(value == index);
+    ASSERT(index >= 0);
+    ASSERT(!node->m_next);
+
+    // The body functions of generator and async have different mechanism for arguments.
+    ASSERT(generator.parseMode() != SourceParseMode::GeneratorBodyMode);
+    ASSERT(!isAsyncFunctionBodyParseMode(generator.parseMode()));
+
+    return generator.emitGetArgument(generator.finalDestination(dst), index);
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_argumentCount(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(!m_args->m_listNode);
+
+    return generator.emitUnaryNoDstOp(op_argument_count, generator.finalDestination(dst));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_assert(BytecodeGenerator& generator, RegisterID* dst)
+{
+#ifndef NDEBUG
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> condition = generator.emitNode(node);
+    generator.emitAssert(condition.get(), node->firstLine());
+    return dst;
+#else
+    UNUSED_PARAM(generator);
+    return dst;
+#endif
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_putByValDirect(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> base = generator.emitNode(node);
+    node = node->m_next;
+    RefPtr<RegisterID> index = generator.emitNode(node);
+    node = node->m_next;
+    RefPtr<RegisterID> value = generator.emitNode(node);
+
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitDirectPutByVal(base.get(), index.get(), value.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_tailCallForwardArguments(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> function = generator.emitNode(node);
+    node = node->m_next;
+    RefPtr<RegisterID> thisRegister = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    RefPtr<RegisterID> finalDst = generator.finalDestination(dst);
+    return generator.emitCallForwardArgumentsInTailPosition(finalDst.get(), function.get(), thisRegister.get(), generator.newTemporary(), 0, divot(), divotStart(), divotEnd(), DebuggableCall::No);
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_throwTypeError(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    ASSERT(!node->m_next);
+    if (node->m_expr->isString()) {
+        const Identifier& ident = static_cast<StringNode*>(node->m_expr)->value();
+        generator.emitThrowTypeError(ident);
+    } else {
+        RefPtr<RegisterID> message = generator.emitNode(node);
+        generator.emitThrowStaticError(ErrorType::TypeError, message.get());
+    }
+    return dst;
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_throwRangeError(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    ASSERT(!node->m_next);
+    if (node->m_expr->isString()) {
+        const Identifier& ident = static_cast<StringNode*>(node->m_expr)->value();
+        generator.emitThrowRangeError(ident);
+    } else {
+        RefPtr<RegisterID> message = generator.emitNode(node);
+        generator.emitThrowStaticError(ErrorType::RangeError, message.get());
+    }
+
+    return dst;
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_throwOutOfMemoryError(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(!m_args->m_listNode);
+
+    generator.emitThrowOutOfMemoryError();
+    return dst;
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_tryGetById(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> base = generator.emitNode(node);
+    node = node->m_next;
+
+    // Since this is a builtin we expect the creator to use a string literal as the second argument.
+    ASSERT(node->m_expr->isString());
+    const Identifier& ident = static_cast<StringNode*>(node->m_expr)->value();
+    ASSERT(!node->m_next);
+
+    RefPtr<RegisterID> finalDest = generator.finalDestination(dst);
+    return generator.emitTryGetById(finalDest.get(), base.get(), ident);
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_toNumber(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitToNumber(generator.tempDestination(dst), src.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_toString(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitToString(generator.tempDestination(dst), src.get()));
+}
+    
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_isJSArray(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitIsJSArray(generator.tempDestination(dst), src.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_isProxyObject(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitIsProxyObject(generator.tempDestination(dst), src.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_isRegExpObject(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitIsRegExpObject(generator.tempDestination(dst), src.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_isObject(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitIsObject(generator.tempDestination(dst), src.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_isDerivedArray(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitIsDerivedArray(generator.tempDestination(dst), src.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_isMap(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitIsMap(generator.tempDestination(dst), src.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_isSet(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> src = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    return generator.moveToDestinationIfNeeded(dst, generator.emitIsSet(generator.tempDestination(dst), src.get()));
+}
+
+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_newArrayWithSize(JSC::BytecodeGenerator& generator, JSC::RegisterID* dst)
+{
+    ArgumentListNode* node = m_args->m_listNode;
+    RefPtr<RegisterID> size = generator.emitNode(node);
+    ASSERT(!node->m_next);
+
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst);
+    generator.emitNewArrayWithSize(finalDestination.get(), size.get());
+    return finalDestination.get();
+}
+
+
+#define JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS(name) \
+    RegisterID* BytecodeIntrinsicNode::emit_intrinsic_##name(BytecodeGenerator& generator, RegisterID* dst) \
+    { \
+        ASSERT(!m_args); \
+        ASSERT(type() == Type::Constant); \
+        if (dst == generator.ignoredResult()) \
+            return nullptr; \
+        return generator.emitLoad(dst, generator.vm()->bytecodeIntrinsicRegistry().name##Value(generator)); \
+    }
+    JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS)
+#undef JSC_DECLARE_BYTECODE_INTRINSIC_CONSTANT_GENERATORS
+
+// ------------------------------ FunctionCallBracketNode ----------------------------------
+
+RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    bool baseIsSuper = m_base->isSuperNode();
+    bool subscriptIsNonIndexString = isNonIndexStringElement(*m_subscript);
+
+    RefPtr<RegisterID> base;
+    if (baseIsSuper)
+        base = emitSuperBaseForCallee(generator);
+    else {
+        if (subscriptIsNonIndexString)
+            base = generator.emitNode(m_base);
+        else
+            base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+    }
+
+    RefPtr<RegisterID> function;
+    RefPtr<RegisterID> thisRegister;
+    if (baseIsSuper) {
+        // Note that we only need to do this once because we either have a non-TDZ this or we throw. Once we have a non-TDZ this, we can't change its value back to TDZ.
+        thisRegister = generator.ensureThis();
+    }
+    if (subscriptIsNonIndexString) {
+        generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
+        if (baseIsSuper)
+            function = generator.emitGetById(generator.tempDestination(dst), base.get(), thisRegister.get(), static_cast<StringNode*>(m_subscript)->value());
+        else
+            function = generator.emitGetById(generator.tempDestination(dst), base.get(), static_cast<StringNode*>(m_subscript)->value());
+    } else {
+        RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+        generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
+        if (baseIsSuper)
+            function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), thisRegister.get(), property.get());
+        else
+            function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
+    }
+
+    RefPtr<RegisterID> returnValue = generator.finalDestination(dst, function.get());
+    CallArguments callArguments(generator, m_args);
+    if (baseIsSuper) {
+        generator.emitTDZCheck(generator.thisRegister());
+        generator.emitMove(callArguments.thisRegister(), thisRegister.get());
+    } else
+        generator.emitMove(callArguments.thisRegister(), base.get());
+    RegisterID* ret = generator.emitCallInTailPosition(returnValue.get(), function.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+    generator.emitProfileType(returnValue.get(), divotStart(), divotEnd());
+    return ret;
+}
+
+// ------------------------------ FunctionCallDotNode ----------------------------------
+
+RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> function = generator.tempDestination(dst);
+    RefPtr<RegisterID> returnValue = generator.finalDestination(dst, function.get());
+    CallArguments callArguments(generator, m_args);
+    bool baseIsSuper = m_base->isSuperNode();
+    if (baseIsSuper)
+        generator.emitMove(callArguments.thisRegister(), generator.ensureThis());
+    else
+        generator.emitNode(callArguments.thisRegister(), m_base);
+    generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
+    if (baseIsSuper) {
+        RefPtr<RegisterID> superBase = emitSuperBaseForCallee(generator);
+        generator.emitGetById(function.get(), superBase.get(), callArguments.thisRegister(), m_ident);
+    } else
+        generator.emitGetById(function.get(), callArguments.thisRegister(), m_ident);
+    RegisterID* ret = generator.emitCallInTailPosition(returnValue.get(), function.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+    generator.emitProfileType(returnValue.get(), divotStart(), divotEnd());
+    return ret;
+}
+
+RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
+    RefPtr<RegisterID> function;
+    bool emitCallCheck = !generator.isBuiltinFunction();
+    if (emitCallCheck) {
+        if (m_base->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            function = generator.emitGetById(generator.tempDestination(dst), base.get(), thisValue.get(), generator.propertyNames().builtinNames().callPublicName());
+        } else
+            function = generator.emitGetById(generator.tempDestination(dst), base.get(), generator.propertyNames().builtinNames().callPublicName());
+        generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
+    }
+    RefPtr<RegisterID> returnValue = generator.finalDestination(dst);
+    {
+        if (m_args->m_listNode && m_args->m_listNode->m_expr && m_args->m_listNode->m_expr->isSpreadExpression()) {
+            SpreadExpressionNode* spread = static_cast<SpreadExpressionNode*>(m_args->m_listNode->m_expr);
+            ExpressionNode* subject = spread->expression();
+            RefPtr<RegisterID> argumentsRegister;
+            argumentsRegister = generator.emitNode(subject);
+            generator.emitExpressionInfo(spread->divot(), spread->divotStart(), spread->divotEnd());
+            RefPtr<RegisterID> thisRegister = generator.emitGetByVal(generator.newTemporary(), argumentsRegister.get(), generator.emitLoad(0, jsNumber(0)));
+            generator.emitCallVarargsInTailPosition(returnValue.get(), base.get(), thisRegister.get(), argumentsRegister.get(), generator.newTemporary(), 1, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+        } else if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            ArgumentListNode* oldList = m_args->m_listNode;
+            m_args->m_listNode = m_args->m_listNode->m_next;
+
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            CallArguments callArguments(generator, m_args);
+            generator.emitNode(callArguments.thisRegister(), oldList->m_expr);
+            generator.emitCallInTailPosition(returnValue.get(), realFunction.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+            m_args->m_listNode = oldList;
+        } else {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            CallArguments callArguments(generator, m_args);
+            generator.emitLoad(callArguments.thisRegister(), jsUndefined());
+            generator.emitCallInTailPosition(returnValue.get(), realFunction.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+        }
+    }
+    if (emitCallCheck) {
+        generator.emitJump(end.get());
+        generator.emitLabel(realCall.get());
+        {
+            CallArguments callArguments(generator, m_args);
+            generator.emitMove(callArguments.thisRegister(), base.get());
+            generator.emitCallInTailPosition(returnValue.get(), function.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+        }
+        generator.emitLabel(end.get());
+    }
+    generator.emitProfileType(returnValue.get(), divotStart(), divotEnd());
+    return returnValue.get();
+}
+
+static bool areTrivialApplyArguments(ArgumentsNode* args)
+{
+    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
+        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
+}
+
+RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // A few simple cases can be trivially handled as ordinary function calls.
+    // function.apply(), function.apply(arg) -> identical to function.call
+    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
+    bool mayBeCall = areTrivialApplyArguments(m_args);
+
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
+    RefPtr<RegisterID> function;
+    RefPtr<RegisterID> returnValue = generator.finalDestination(dst, function.get());
+    bool emitCallCheck = !generator.isBuiltinFunction();
+    if (emitCallCheck) {
+        if (m_base->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            function = generator.emitGetById(generator.tempDestination(dst), base.get(), thisValue.get(), generator.propertyNames().builtinNames().applyPublicName());
+        } else
+            function = generator.emitGetById(generator.tempDestination(dst), base.get(), generator.propertyNames().builtinNames().applyPublicName());
+        generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
+    }
+    if (mayBeCall) {
+        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            ArgumentListNode* oldList = m_args->m_listNode;
+            if (m_args->m_listNode->m_expr->isSpreadExpression()) {
+                SpreadExpressionNode* spread = static_cast<SpreadExpressionNode*>(m_args->m_listNode->m_expr);
+                RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
+                RefPtr<RegisterID> index = generator.emitLoad(generator.newTemporary(), jsNumber(0));
+                RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsUndefined());
+                RefPtr<RegisterID> argumentsRegister = generator.emitLoad(generator.newTemporary(), jsUndefined());
+                
+                auto extractor = [&thisRegister, &argumentsRegister, &index](BytecodeGenerator& generator, RegisterID* value)
+                {
+                    RefPtr<Label> haveThis = generator.newLabel();
+                    RefPtr<Label> end = generator.newLabel();
+                    RefPtr<RegisterID> compareResult = generator.newTemporary();
+                    RefPtr<RegisterID> indexZeroCompareResult = generator.emitBinaryOp(op_eq, compareResult.get(), index.get(), generator.emitLoad(0, jsNumber(0)), OperandTypes(ResultType::numberTypeIsInt32(), ResultType::numberTypeIsInt32()));
+                    generator.emitJumpIfFalse(indexZeroCompareResult.get(), haveThis.get());
+                    generator.emitMove(thisRegister.get(), value);
+                    generator.emitLoad(index.get(), jsNumber(1));
+                    generator.emitJump(end.get());
+                    generator.emitLabel(haveThis.get());
+                    RefPtr<RegisterID> indexOneCompareResult = generator.emitBinaryOp(op_eq, compareResult.get(), index.get(), generator.emitLoad(0, jsNumber(1)), OperandTypes(ResultType::numberTypeIsInt32(), ResultType::numberTypeIsInt32()));
+                    generator.emitJumpIfFalse(indexOneCompareResult.get(), end.get());
+                    generator.emitMove(argumentsRegister.get(), value);
+                    generator.emitLoad(index.get(), jsNumber(2));
+                    generator.emitLabel(end.get());
+                };
+                generator.emitEnumeration(this, spread->expression(), extractor);
+                generator.emitCallVarargsInTailPosition(returnValue.get(), realFunction.get(), thisRegister.get(), argumentsRegister.get(), generator.newTemporary(), 0, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+            } else if (m_args->m_listNode->m_next) {
+                ASSERT(m_args->m_listNode->m_next->m_expr->isSimpleArray());
+                ASSERT(!m_args->m_listNode->m_next->m_next);
+                m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_next->m_expr)->toArgumentList(generator.parserArena(), 0, 0);
+                RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+                CallArguments callArguments(generator, m_args);
+                generator.emitNode(callArguments.thisRegister(), oldList->m_expr);
+                generator.emitCallInTailPosition(returnValue.get(), realFunction.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+            } else {
+                m_args->m_listNode = m_args->m_listNode->m_next;
+                RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+                CallArguments callArguments(generator, m_args);
+                generator.emitNode(callArguments.thisRegister(), oldList->m_expr);
+                generator.emitCallInTailPosition(returnValue.get(), realFunction.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+            }
+            m_args->m_listNode = oldList;
+        } else {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            CallArguments callArguments(generator, m_args);
+            generator.emitLoad(callArguments.thisRegister(), jsUndefined());
+            generator.emitCallInTailPosition(returnValue.get(), realFunction.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+        }
+    } else {
+        ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
+        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+        RefPtr<RegisterID> thisRegister = generator.emitNode(m_args->m_listNode->m_expr);
+        RefPtr<RegisterID> argsRegister;
+        ArgumentListNode* args = m_args->m_listNode->m_next;
+        argsRegister = generator.emitNode(args->m_expr);
+
+        // Function.prototype.apply ignores extra arguments, but we still
+        // need to evaluate them for side effects.
+        while ((args = args->m_next))
+            generator.emitNode(args->m_expr);
+
+        generator.emitCallVarargsInTailPosition(returnValue.get(), realFunction.get(), thisRegister.get(), argsRegister.get(), generator.newTemporary(), 0, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+    }
+    if (emitCallCheck) {
+        generator.emitJump(end.get());
+        generator.emitLabel(realCall.get());
+        CallArguments callArguments(generator, m_args);
+        generator.emitMove(callArguments.thisRegister(), base.get());
+        generator.emitCallInTailPosition(returnValue.get(), function.get(), NoExpectedFunction, callArguments, divot(), divotStart(), divotEnd(), DebuggableCall::Yes);
+        generator.emitLabel(end.get());
+    }
+    generator.emitProfileType(returnValue.get(), divotStart(), divotEnd());
+    return returnValue.get();
+}
+
+// ------------------------------ PostfixNode ----------------------------------
+
+static RegisterID* emitIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
+{
+    return (oper == OpPlusPlus) ? generator.emitInc(srcDst) : generator.emitDec(srcDst);
+}
+
+static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
+{
+    if (dst == srcDst)
+        return generator.emitToNumber(generator.finalDestination(dst), srcDst);
+    RefPtr<RegisterID> tmp = generator.emitToNumber(generator.tempDestination(dst), srcDst);
+    emitIncOrDec(generator, srcDst, oper);
+    return generator.moveToDestinationIfNeeded(dst, tmp.get());
+}
+
+RegisterID* PostfixNode::emitResolve(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return PrefixNode::emitResolve(generator, dst);
+
+    ASSERT(m_expr->isResolveNode());
+    ResolveNode* resolve = static_cast<ResolveNode*>(m_expr);
+    const Identifier& ident = resolve->identifier();
+
+    Variable var = generator.variable(ident);
+    if (RegisterID* local = var.local()) {
+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
+        RefPtr<RegisterID> localReg = local;
+        if (var.isReadOnly()) {
+            generator.emitReadOnlyExceptionIfNeeded(var);
+            localReg = generator.emitMove(generator.tempDestination(dst), local);
+        }
+        RefPtr<RegisterID> oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), localReg.get(), m_operator);
+        generator.emitProfileType(localReg.get(), var, divotStart(), divotEnd());
+        return oldValue.get();
+    }
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
+    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
+    generator.emitTDZCheckIfNecessary(var, value.get(), nullptr);
+    if (var.isReadOnly()) {
+        bool threwException = generator.emitReadOnlyExceptionIfNeeded(var);
+        if (threwException)
+            return value.get();
+    }
+    RefPtr<RegisterID> oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
+    if (!var.isReadOnly()) {
+        generator.emitPutToScope(scope.get(), var, value.get(), ThrowIfNotFound, InitializationMode::NotInitialization);
+        generator.emitProfileType(value.get(), var, divotStart(), divotEnd());
+    }
+
+    return oldValue.get();
+}
+
+RegisterID* PostfixNode::emitBracket(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return PrefixNode::emitBracket(generator, dst);
+
+    ASSERT(m_expr->isBracketAccessorNode());
+    BracketAccessorNode* bracketAccessor = static_cast<BracketAccessorNode*>(m_expr);
+    ExpressionNode* baseNode = bracketAccessor->base();
+    ExpressionNode* subscript = bracketAccessor->subscript();
+
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(baseNode, bracketAccessor->subscriptHasAssignments(), subscript->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNode(subscript);
+
+    generator.emitExpressionInfo(bracketAccessor->divot(), bracketAccessor->divotStart(), bracketAccessor->divotEnd());
+    RefPtr<RegisterID> value;
+    RefPtr<RegisterID> thisValue;
+    if (baseNode->isSuperNode()) {
+        thisValue = generator.ensureThis();
+        value = generator.emitGetByVal(generator.newTemporary(), base.get(), thisValue.get(), property.get());
+    } else
+        value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
+    RegisterID* oldValue = emitPostIncOrDec(generator, generator.tempDestination(dst), value.get(), m_operator);
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    if (baseNode->isSuperNode())
+        generator.emitPutByVal(base.get(), thisValue.get(), property.get(), value.get());
+    else
+        generator.emitPutByVal(base.get(), property.get(), value.get());
+    generator.emitProfileType(value.get(), divotStart(), divotEnd());
+    return generator.moveToDestinationIfNeeded(dst, oldValue);
+}
+
+RegisterID* PostfixNode::emitDot(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        return PrefixNode::emitDot(generator, dst);
+
+    ASSERT(m_expr->isDotAccessorNode());
+    DotAccessorNode* dotAccessor = static_cast<DotAccessorNode*>(m_expr);
+    ExpressionNode* baseNode = dotAccessor->base();
+    bool baseIsSuper = baseNode->isSuperNode();
+    const Identifier& ident = dotAccessor->identifier();
+
+    RefPtr<RegisterID> base = generator.emitNode(baseNode);
+
+    generator.emitExpressionInfo(dotAccessor->divot(), dotAccessor->divotStart(), dotAccessor->divotEnd());
+    RefPtr<RegisterID> value;
+    RefPtr<RegisterID> thisValue;
+    if (baseIsSuper) {
+        thisValue = generator.ensureThis();
+        value = generator.emitGetById(generator.newTemporary(), base.get(), thisValue.get(), ident);
+    } else
+        value = generator.emitGetById(generator.newTemporary(), base.get(), ident);
+    RegisterID* oldValue = emitPostIncOrDec(generator, generator.tempDestination(dst), value.get(), m_operator);
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    if (baseIsSuper)
+        generator.emitPutById(base.get(), thisValue.get(), ident, value.get());
+    else
+        generator.emitPutById(base.get(), ident, value.get());
+    generator.emitProfileType(value.get(), divotStart(), divotEnd());
+    return generator.moveToDestinationIfNeeded(dst, oldValue);
+}
+
+RegisterID* PostfixNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_expr->isResolveNode())
+        return emitResolve(generator, dst);
+
+    if (m_expr->isBracketAccessorNode())
+        return emitBracket(generator, dst);
+
+    if (m_expr->isDotAccessorNode())
+        return emitDot(generator, dst);
+
+    return emitThrowReferenceError(generator, m_operator == OpPlusPlus
+        ? ASCIILiteral("Postfix ++ operator applied to value that is not a reference.")
+        : ASCIILiteral("Postfix -- operator applied to value that is not a reference."));
+}
+
+// ------------------------------ DeleteResolveNode -----------------------------------
+
+RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    Variable var = generator.variable(m_ident);
+    if (var.local()) {
+        generator.emitTDZCheckIfNecessary(var, var.local(), nullptr);
+        return generator.emitLoad(generator.finalDestination(dst), false);
+    }
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RefPtr<RegisterID> base = generator.emitResolveScope(dst, var);
+    generator.emitTDZCheckIfNecessary(var, nullptr, base.get());
+    return generator.emitDeleteById(generator.finalDestination(dst, base.get()), base.get(), m_ident);
+}
+
+// ------------------------------ DeleteBracketNode -----------------------------------
+
+RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+    RefPtr<RegisterID> r1 = generator.emitNode(m_subscript);
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    if (m_base->isSuperNode())
+        return emitThrowReferenceError(generator, "Cannot delete a super property");
+    return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1.get());
+}
+
+// ------------------------------ DeleteDotNode -----------------------------------
+
+RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    if (m_base->isSuperNode())
+        return emitThrowReferenceError(generator, "Cannot delete a super property");
+    return generator.emitDeleteById(generator.finalDestination(dst), r0.get(), m_ident);
+}
+
+// ------------------------------ DeleteValueNode -----------------------------------
+
+RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitNode(generator.ignoredResult(), m_expr);
+
+    // delete on a non-location expression ignores the value and returns true
+    return generator.emitLoad(generator.finalDestination(dst), true);
+}
+
+// ------------------------------ VoidNode -------------------------------------
+
+RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+    return generator.emitLoad(dst, jsUndefined());
+}
+
+// ------------------------------ TypeOfResolveNode -----------------------------------
+
+RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    Variable var = generator.variable(m_ident);
+    if (RegisterID* local = var.local()) {
+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
+        if (dst == generator.ignoredResult())
+            return 0;
+        return generator.emitTypeOf(generator.finalDestination(dst), local);
+    }
+
+    RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
+    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
+    generator.emitTDZCheckIfNecessary(var, value.get(), nullptr);
+    if (dst == generator.ignoredResult())
+        return 0;
+    return generator.emitTypeOf(generator.finalDestination(dst, scope.get()), value.get());
+}
+
+// ------------------------------ TypeOfValueNode -----------------------------------
+
+RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr);
+        return 0;
+    }
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
+    return generator.emitTypeOf(generator.finalDestination(dst), src.get());
+}
+
+// ------------------------------ PrefixNode ----------------------------------
+
+RegisterID* PrefixNode::emitResolve(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr->isResolveNode());
+    ResolveNode* resolve = static_cast<ResolveNode*>(m_expr);
+    const Identifier& ident = resolve->identifier();
+
+    Variable var = generator.variable(ident);
+    if (RegisterID* local = var.local()) {
+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
+        RefPtr<RegisterID> localReg = local;
+        if (var.isReadOnly()) {
+            generator.emitReadOnlyExceptionIfNeeded(var);
+            localReg = generator.emitMove(generator.tempDestination(dst), localReg.get());
+        } else if (generator.vm()->typeProfiler()) {
+            RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
+            generator.emitMove(tempDst.get(), localReg.get());
+            emitIncOrDec(generator, tempDst.get(), m_operator);
+            generator.emitMove(localReg.get(), tempDst.get());
+            generator.emitProfileType(localReg.get(), var, divotStart(), divotEnd());
+            return generator.moveToDestinationIfNeeded(dst, tempDst.get());
+        }
+        emitIncOrDec(generator, localReg.get(), m_operator);
+        return generator.moveToDestinationIfNeeded(dst, localReg.get());
+    }
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RefPtr<RegisterID> scope = generator.emitResolveScope(dst, var);
+    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
+    generator.emitTDZCheckIfNecessary(var, value.get(), nullptr);
+    if (var.isReadOnly()) {
+        bool threwException = generator.emitReadOnlyExceptionIfNeeded(var);
+        if (threwException)
+            return value.get();
+    }
+
+    emitIncOrDec(generator, value.get(), m_operator);
+    if (!var.isReadOnly()) {
+        generator.emitPutToScope(scope.get(), var, value.get(), ThrowIfNotFound, InitializationMode::NotInitialization);
+        generator.emitProfileType(value.get(), var, divotStart(), divotEnd());
+    }
+    return generator.moveToDestinationIfNeeded(dst, value.get());
+}
+
+RegisterID* PrefixNode::emitBracket(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr->isBracketAccessorNode());
+    BracketAccessorNode* bracketAccessor = static_cast<BracketAccessorNode*>(m_expr);
+    ExpressionNode* baseNode = bracketAccessor->base();
+    ExpressionNode* subscript = bracketAccessor->subscript();
+
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(baseNode, bracketAccessor->subscriptHasAssignments(), subscript->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNode(subscript);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(bracketAccessor->divot(), bracketAccessor->divotStart(), bracketAccessor->divotEnd());
+    RegisterID* value;
+    RefPtr<RegisterID> thisValue;
+    if (baseNode->isSuperNode()) {
+        thisValue = generator.ensureThis();
+        value = generator.emitGetByVal(propDst.get(), base.get(), thisValue.get(), property.get());
+    } else
+        value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
+    emitIncOrDec(generator, value, m_operator);
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    if (baseNode->isSuperNode())
+        generator.emitPutByVal(base.get(), thisValue.get(), property.get(), value);
+    else
+        generator.emitPutByVal(base.get(), property.get(), value);
+    generator.emitProfileType(value, divotStart(), divotEnd());
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+RegisterID* PrefixNode::emitDot(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr->isDotAccessorNode());
+    DotAccessorNode* dotAccessor = static_cast<DotAccessorNode*>(m_expr);
+    ExpressionNode* baseNode = dotAccessor->base();
+    const Identifier& ident = dotAccessor->identifier();
+
+    RefPtr<RegisterID> base = generator.emitNode(baseNode);
+    RefPtr<RegisterID> propDst = generator.tempDestination(dst);
+
+    generator.emitExpressionInfo(dotAccessor->divot(), dotAccessor->divotStart(), dotAccessor->divotEnd());
+    RegisterID* value;
+    RefPtr<RegisterID> thisValue;
+    if (baseNode->isSuperNode()) {
+        thisValue = generator.ensureThis();
+        value = generator.emitGetById(propDst.get(), base.get(), thisValue.get(), ident);
+    } else
+        value = generator.emitGetById(propDst.get(), base.get(), ident);
+    emitIncOrDec(generator, value, m_operator);
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    if (baseNode->isSuperNode())
+        generator.emitPutById(base.get(), thisValue.get(), ident, value);
+    else
+        generator.emitPutById(base.get(), ident, value);
+    generator.emitProfileType(value, divotStart(), divotEnd());
+    return generator.moveToDestinationIfNeeded(dst, propDst.get());
+}
+
+RegisterID* PrefixNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_expr->isResolveNode())
+        return emitResolve(generator, dst);
+
+    if (m_expr->isBracketAccessorNode())
+        return emitBracket(generator, dst);
+
+    if (m_expr->isDotAccessorNode())
+        return emitDot(generator, dst);
+
+    return emitThrowReferenceError(generator, m_operator == OpPlusPlus
+        ? ASCIILiteral("Prefix ++ operator applied to value that is not a reference.")
+        : ASCIILiteral("Prefix -- operator applied to value that is not a reference."));
+}
+
+// ------------------------------ Unary Operation Nodes -----------------------------------
+
+RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
+    generator.emitExpressionInfo(position(), position(), position());
+    return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src.get(), OperandTypes(m_expr->resultDescriptor()));
+}
+
+// ------------------------------ UnaryPlusNode -----------------------------------
+
+RegisterID* UnaryPlusNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(opcodeID() == op_to_number);
+    RefPtr<RegisterID> src = generator.emitNode(expr());
+    generator.emitExpressionInfo(position(), position(), position());
+    return generator.emitToNumber(generator.finalDestination(dst), src.get());
+}
+
+// ------------------------------ BitwiseNotNode -----------------------------------
+ 
+RegisterID* BitwiseNotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src2 = generator.emitLoad(nullptr, jsNumber(-1));
+    RefPtr<RegisterID> src1 = generator.emitNode(m_expr);
+    return generator.emitBinaryOp(op_bitxor, generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), OperandTypes(m_expr->resultDescriptor(), ResultType::numberTypeIsInt32()));
+}
+ 
+// ------------------------------ LogicalNotNode -----------------------------------
+
+void LogicalNotNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, FallThroughMode fallThroughMode)
+{
+    if (UNLIKELY(needsDebugHook()))
+        generator.emitDebugHook(this);
+
+    // Reverse the true and false targets.
+    generator.emitNodeInConditionContext(expr(), falseTarget, trueTarget, invert(fallThroughMode));
+}
+
+
+// ------------------------------ Binary Operation Nodes -----------------------------------
+
+// BinaryOpNode::emitStrcat:
+//
+// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
+// more values, where we can determine a set of separate op_add operations would be operating on
+// string values.
+//
+// This function expects to be operating on a graph of AST nodes looking something like this:
+//
+//     (a)...     (b)
+//          \   /
+//           (+)     (c)
+//              \   /
+//      [d]     ((+))
+//         \    /
+//          [+=]
+//
+// The assignment operation is optional, if it exists the register holding the value on the
+// lefthand side of the assignment should be passing as the optional 'lhs' argument.
+//
+// The method should be called on the node at the root of the tree of regular binary add
+// operations (marked in the diagram with a double set of parentheses).  This node must
+// be performing a string concatenation (determined by statically detecting that at least
+// one child must be a string).  
+//
+// Since the minimum number of values being concatenated together is expected to be 3, if
+// a lhs to a concatenating assignment is not provided then the  root add should have at
+// least one left child that is also an add that can be determined to be operating on strings.
+//
+RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
+{
+    ASSERT(isAdd());
+    ASSERT(resultDescriptor().definitelyIsString());
+
+    // Create a list of expressions for all the adds in the tree of nodes we can convert into
+    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
+    // added first, and the leftmost child is never added, so the vector produced for the
+    // example above will be [ c, b ].
+    Vector<ExpressionNode*, 16> reverseExpressionList;
+    reverseExpressionList.append(m_expr2);
+
+    // Examine the left child of the add.  So long as this is a string add, add its right-child
+    // to the list, and keep processing along the left fork.
+    ExpressionNode* leftMostAddChild = m_expr1;
+    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
+        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
+        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
+    }
+
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
+    // We could possibly avoid this (the lhs is converted last anyway, we could let the
+    // op_strcat node handle its conversion if required).
+    if (lhs)
+        temporaryRegisters.append(generator.newTemporary());
+
+    // Emit code for the leftmost node ((a) in the example).
+    temporaryRegisters.append(generator.newTemporary());
+    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
+    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
+
+    // Note on ordering of conversions:
+    //
+    // We maintain the same ordering of conversions as we would see if the concatenations
+    // was performed as a sequence of adds (otherwise this optimization could change
+    // behaviour should an object have been provided a valueOf or toString method).
+    //
+    // Considering the above example, the sequnce of execution is:
+    //     * evaluate operand (a)
+    //     * evaluate operand (b)
+    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
+    //     * convert (b) to primitive   <-  (ditto)
+    //     * evaluate operand (c)
+    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
+    // And optionally, if there is an assignment:
+    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
+    //
+    // As such we do not plant an op to convert the leftmost child now.  Instead, use
+    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
+    // once the second node has been generated.  However, if the leftmost child is an
+    // immediate we can trivially determine that no conversion will be required.
+    // If this is the case
+    if (leftMostAddChild->isString())
+        leftMostAddChildTempRegister = 0;
+
+    while (reverseExpressionList.size()) {
+        ExpressionNode* node = reverseExpressionList.last();
+        reverseExpressionList.removeLast();
+
+        // Emit the code for the current node.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), node);
+
+        // On the first iteration of this loop, when we first reach this point we have just
+        // generated the second node, which means it is time to convert the leftmost operand.
+        if (leftMostAddChildTempRegister) {
+            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
+            leftMostAddChildTempRegister = 0; // Only do this once.
+        }
+        // Plant a conversion for this node, if necessary.
+        if (!node->isString())
+            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+    ASSERT(temporaryRegisters.size() >= 3);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->divotStart(), emitExpressionInfoForMe->divotEnd());
+    // If there is an assignment convert the lhs now.  This will also copy lhs to
+    // the temporary register we allocated for it.
+    if (lhs)
+        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
+}
+
+void BinaryOpNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, FallThroughMode fallThroughMode)
+{
+    TriState branchCondition;
+    ExpressionNode* branchExpression;
+    tryFoldToBranch(generator, branchCondition, branchExpression);
+
+    if (UNLIKELY(needsDebugHook())) {
+        if (branchCondition != MixedTriState)
+            generator.emitDebugHook(this);
+    }
+
+    if (branchCondition == MixedTriState)
+        ExpressionNode::emitBytecodeInConditionContext(generator, trueTarget, falseTarget, fallThroughMode);
+    else if (branchCondition == TrueTriState)
+        generator.emitNodeInConditionContext(branchExpression, trueTarget, falseTarget, fallThroughMode);
+    else
+        generator.emitNodeInConditionContext(branchExpression, falseTarget, trueTarget, invert(fallThroughMode));
+}
+
+static inline bool canFoldToBranch(OpcodeID opcodeID, ExpressionNode* branchExpression, JSValue constant)
+{
+    ResultType expressionType = branchExpression->resultDescriptor();
+
+    if (expressionType.definitelyIsBoolean() && constant.isBoolean())
+        return true;
+    else if (expressionType.definitelyIsBoolean() && constant.isInt32() && (constant.asInt32() == 0 || constant.asInt32() == 1))
+        return opcodeID == op_eq || opcodeID == op_neq; // Strict equality is false in the case of type mismatch.
+    else if (expressionType.isInt32() && constant.isInt32() && constant.asInt32() == 0)
+        return true;
+
+    return false;
+}
+
+void BinaryOpNode::tryFoldToBranch(BytecodeGenerator& generator, TriState& branchCondition, ExpressionNode*& branchExpression)
+{
+    branchCondition = MixedTriState;
+    branchExpression = 0;
+
+    ConstantNode* constant = 0;
+    if (m_expr1->isConstant()) {
+        constant = static_cast<ConstantNode*>(m_expr1);
+        branchExpression = m_expr2;
+    } else if (m_expr2->isConstant()) {
+        constant = static_cast<ConstantNode*>(m_expr2);
+        branchExpression = m_expr1;
+    }
+
+    if (!constant)
+        return;
+    ASSERT(branchExpression);
+
+    OpcodeID opcodeID = this->opcodeID();
+    JSValue value = constant->jsValue(generator);
+    bool canFoldToBranch = JSC::canFoldToBranch(opcodeID, branchExpression, value);
+    if (!canFoldToBranch)
+        return;
+
+    if (opcodeID == op_eq || opcodeID == op_stricteq)
+        branchCondition = triState(value.pureToBoolean());
+    else if (opcodeID == op_neq || opcodeID == op_nstricteq)
+        branchCondition = triState(!value.pureToBoolean());
+}
+
+RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    OpcodeID opcodeID = this->opcodeID();
+
+    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString()) {
+        generator.emitExpressionInfo(position(), position(), position());
+        return emitStrcat(generator, dst);
+    }
+
+    if (opcodeID == op_neq) {
+        if (m_expr1->isNull() || m_expr2->isNull()) {
+            RefPtr<RegisterID> src = generator.tempDestination(dst);
+            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+            return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
+        }
+    }
+
+    ExpressionNode* left = m_expr1;
+    ExpressionNode* right = m_expr2;
+    if (opcodeID == op_neq || opcodeID == op_nstricteq) {
+        if (left->isString())
+            std::swap(left, right);
+    }
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(left, m_rightHasAssignments, right->isPure(generator));
+    bool wasTypeof = generator.lastOpcodeID() == op_typeof;
+    RefPtr<RegisterID> src2 = generator.emitNode(right);
+    generator.emitExpressionInfo(position(), position(), position());
+    if (wasTypeof && (opcodeID == op_neq || opcodeID == op_nstricteq)) {
+        RefPtr<RegisterID> tmp = generator.tempDestination(dst);
+        if (opcodeID == op_neq)
+            generator.emitEqualityOp(op_eq, generator.finalDestination(tmp.get(), src1.get()), src1.get(), src2.get());
+        else if (opcodeID == op_nstricteq)
+            generator.emitEqualityOp(op_stricteq, generator.finalDestination(tmp.get(), src1.get()), src1.get(), src2.get());
+        else
+            RELEASE_ASSERT_NOT_REACHED();
+        return generator.emitUnaryOp(op_not, generator.finalDestination(dst, tmp.get()), tmp.get());
+    }
+    RegisterID* result = generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), OperandTypes(left->resultDescriptor(), right->resultDescriptor()));
+    if (opcodeID == op_urshift && dst != generator.ignoredResult())
+        return generator.emitUnaryOp(op_unsigned, result, result);
+    return result;
+}
+
+RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (m_expr1->isNull() || m_expr2->isNull()) {
+        RefPtr<RegisterID> src = generator.tempDestination(dst);
+        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
+        return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
+    }
+
+    ExpressionNode* left = m_expr1;
+    ExpressionNode* right = m_expr2;
+    if (left->isString())
+        std::swap(left, right);
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(left, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(right);
+    return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2.get());
+}
+
+RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ExpressionNode* left = m_expr1;
+    ExpressionNode* right = m_expr2;
+    if (left->isString())
+        std::swap(left, right);
+
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(left, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(right);
+    return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2.get());
+}
+
+RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
+}
+
+RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> hasInstanceValue = generator.newTemporary();
+    RefPtr<RegisterID> isObject = generator.newTemporary();
+    RefPtr<RegisterID> isCustom = generator.newTemporary();
+    RefPtr<RegisterID> prototype = generator.newTemporary();
+    RefPtr<RegisterID> value = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> constructor = generator.emitNode(m_expr2);
+    RefPtr<RegisterID> dstReg = generator.finalDestination(dst, value.get());
+    RefPtr<Label> custom = generator.newLabel();
+    RefPtr<Label> done = generator.newLabel();
+    RefPtr<Label> typeError = generator.newLabel();
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitIsObject(isObject.get(), constructor.get());
+    generator.emitJumpIfFalse(isObject.get(), typeError.get());
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitGetById(hasInstanceValue.get(), constructor.get(), generator.vm()->propertyNames->hasInstanceSymbol);
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitOverridesHasInstance(isCustom.get(), constructor.get(), hasInstanceValue.get());
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitJumpIfTrue(isCustom.get(), custom.get());
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitGetById(prototype.get(), constructor.get(), generator.vm()->propertyNames->prototype);
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitInstanceOf(dstReg.get(), value.get(), prototype.get());
+
+    generator.emitJump(done.get());
+
+    generator.emitLabel(typeError.get());
+    generator.emitThrowTypeError("Right hand side of instanceof is not an object");
+
+    generator.emitLabel(custom.get());
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitInstanceOfCustom(dstReg.get(), value.get(), constructor.get(), hasInstanceValue.get());
+
+    generator.emitLabel(done.get());
+
+    return dstReg.get();
+}
+
+// ------------------------------ LogicalOpNode ----------------------------
+
+RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> temp = generator.tempDestination(dst);
+    RefPtr<Label> target = generator.newLabel();
+    
+    generator.emitNode(temp.get(), m_expr1);
+    if (m_operator == OpLogicalAnd)
+        generator.emitJumpIfFalse(temp.get(), target.get());
+    else
+        generator.emitJumpIfTrue(temp.get(), target.get());
+    generator.emitNodeInTailPosition(temp.get(), m_expr2);
+    generator.emitLabel(target.get());
+
+    return generator.moveToDestinationIfNeeded(dst, temp.get());
+}
+
+void LogicalOpNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, FallThroughMode fallThroughMode)
+{
+    if (UNLIKELY(needsDebugHook()))
+        generator.emitDebugHook(this);
+
+    RefPtr<Label> afterExpr1 = generator.newLabel();
+    if (m_operator == OpLogicalAnd)
+        generator.emitNodeInConditionContext(m_expr1, afterExpr1.get(), falseTarget, FallThroughMeansTrue);
+    else 
+        generator.emitNodeInConditionContext(m_expr1, trueTarget, afterExpr1.get(), FallThroughMeansFalse);
+    generator.emitLabel(afterExpr1.get());
+
+    generator.emitNodeInConditionContext(m_expr2, trueTarget, falseTarget, fallThroughMode);
+}
+
+// ------------------------------ ConditionalNode ------------------------------
+
+RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> newDst = generator.finalDestination(dst);
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    RefPtr<Label> beforeThen = generator.newLabel();
+    generator.emitNodeInConditionContext(m_logical, beforeThen.get(), beforeElse.get(), FallThroughMeansTrue);
+    generator.emitLabel(beforeThen.get());
+
+    generator.emitProfileControlFlow(m_expr1->startOffset());
+    generator.emitNodeInTailPosition(newDst.get(), m_expr1);
+    generator.emitJump(afterElse.get());
+
+    generator.emitLabel(beforeElse.get());
+    generator.emitProfileControlFlow(m_expr1->endOffset() + 1);
+    generator.emitNodeInTailPosition(newDst.get(), m_expr2);
+
+    generator.emitLabel(afterElse.get());
+
+    generator.emitProfileControlFlow(m_expr2->endOffset() + 1);
+
+    return newDst.get();
+}
+
+// ------------------------------ ReadModifyResolveNode -----------------------------------
+
+// FIXME: should this be moved to be a method on BytecodeGenerator?
+static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
+{
+    OpcodeID opcodeID;
+    switch (oper) {
+        case OpMultEq:
+            opcodeID = op_mul;
+            break;
+        case OpDivEq:
+            opcodeID = op_div;
+            break;
+        case OpPlusEq:
+            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
+                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
+            opcodeID = op_add;
+            break;
+        case OpMinusEq:
+            opcodeID = op_sub;
+            break;
+        case OpLShift:
+            opcodeID = op_lshift;
+            break;
+        case OpRShift:
+            opcodeID = op_rshift;
+            break;
+        case OpURShift:
+            opcodeID = op_urshift;
+            break;
+        case OpAndEq:
+            opcodeID = op_bitand;
+            break;
+        case OpXOrEq:
+            opcodeID = op_bitxor;
+            break;
+        case OpOrEq:
+            opcodeID = op_bitor;
+            break;
+        case OpModEq:
+            opcodeID = op_mod;
+            break;
+        case OpPowEq:
+            opcodeID = op_pow;
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return dst;
+    }
+
+    RegisterID* src2 = generator.emitNode(m_right);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->divotStart(), emitExpressionInfoForMe->divotEnd());
+    RegisterID* result = generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
+    if (oper == OpURShift)
+        return generator.emitUnaryOp(op_unsigned, result, result);
+    return result;
+}
+
+RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    JSTextPosition newDivot = divotStart() + m_ident.length();
+    Variable var = generator.variable(m_ident);
+    if (RegisterID* local = var.local()) {
+        generator.emitTDZCheckIfNecessary(var, local, nullptr);
+        if (var.isReadOnly()) {
+            generator.emitReadOnlyExceptionIfNeeded(var);
+            RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+            generator.emitProfileType(result, divotStart(), divotEnd());
+            return result;
+        }
+        
+        if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
+            RefPtr<RegisterID> result = generator.newTemporary();
+            generator.emitMove(result.get(), local);
+            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+            generator.emitMove(local, result.get());
+            generator.invalidateForInContextForLocal(local);
+            generator.emitProfileType(local, divotStart(), divotEnd());
+            return generator.moveToDestinationIfNeeded(dst, result.get());
+        }
+        
+        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        generator.invalidateForInContextForLocal(local);
+        generator.emitProfileType(result, divotStart(), divotEnd());
+        return generator.moveToDestinationIfNeeded(dst, result);
+    }
+
+    generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
+    RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
+    RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
+    generator.emitTDZCheckIfNecessary(var, value.get(), nullptr);
+    if (var.isReadOnly()) {
+        bool threwException = generator.emitReadOnlyExceptionIfNeeded(var);
+        if (threwException)
+            return value.get();
+    }
+    RefPtr<RegisterID> result = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
+    RegisterID* returnResult = result.get();
+    if (!var.isReadOnly()) {
+        returnResult = generator.emitPutToScope(scope.get(), var, result.get(), ThrowIfNotFound, InitializationMode::NotInitialization);
+        generator.emitProfileType(result.get(), var, divotStart(), divotEnd());
+    }
+    return returnResult;
+}
+
+static InitializationMode initializationModeForAssignmentContext(AssignmentContext assignmentContext)
+{
+    switch (assignmentContext) {
+    case AssignmentContext::DeclarationStatement:
+        return InitializationMode::Initialization;
+    case AssignmentContext::ConstDeclarationStatement:
+        return InitializationMode::ConstInitialization;
+    case AssignmentContext::AssignmentExpression:
+        return InitializationMode::NotInitialization;
+    }
+
+    ASSERT_NOT_REACHED();
+    return InitializationMode::NotInitialization;
+}
+
+// ------------------------------ AssignResolveNode -----------------------------------
+
+RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    Variable var = generator.variable(m_ident);
+    bool isReadOnly = var.isReadOnly() && m_assignmentContext != AssignmentContext::ConstDeclarationStatement;
+    if (RegisterID* local = var.local()) {
+        RegisterID* result = nullptr;
+        if (m_assignmentContext == AssignmentContext::AssignmentExpression)
+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
+
+        if (isReadOnly) {
+            result = generator.emitNode(dst, m_right); // Execute side effects first.
+            generator.emitReadOnlyExceptionIfNeeded(var);
+            generator.emitProfileType(result, var, divotStart(), divotEnd());
+        } else if (var.isSpecial()) {
+            RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
+            generator.emitNode(tempDst.get(), m_right);
+            generator.emitMove(local, tempDst.get());
+            generator.emitProfileType(local, var, divotStart(), divotEnd());
+            generator.invalidateForInContextForLocal(local);
+            result = generator.moveToDestinationIfNeeded(dst, tempDst.get());
+        } else {
+            RegisterID* right = generator.emitNode(local, m_right);
+            generator.emitProfileType(right, var, divotStart(), divotEnd());
+            generator.invalidateForInContextForLocal(local);
+            result = generator.moveToDestinationIfNeeded(dst, right);
+        }
+
+        if (m_assignmentContext == AssignmentContext::DeclarationStatement || m_assignmentContext == AssignmentContext::ConstDeclarationStatement)
+            generator.liftTDZCheckIfPossible(var);
+        return result;
+    }
+
+    if (generator.isStrictMode())
+        generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
+    if (m_assignmentContext == AssignmentContext::AssignmentExpression)
+        generator.emitTDZCheckIfNecessary(var, nullptr, scope.get());
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_right);
+    if (isReadOnly) {
+        RegisterID* result = generator.emitNode(dst, m_right); // Execute side effects first.
+        bool threwException = generator.emitReadOnlyExceptionIfNeeded(var);
+        if (threwException)
+            return result;
+    }
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RegisterID* returnResult = result.get();
+    if (!isReadOnly) {
+        returnResult = generator.emitPutToScope(scope.get(), var, result.get(), generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound, initializationModeForAssignmentContext(m_assignmentContext));
+        generator.emitProfileType(result.get(), var, divotStart(), divotEnd());
+    }
+
+    if (m_assignmentContext == AssignmentContext::DeclarationStatement || m_assignmentContext == AssignmentContext::ConstDeclarationStatement)
+        generator.liftTDZCheckIfPossible(var);
+    return returnResult;
+}
+
+// ------------------------------ AssignDotNode -----------------------------------
+
+RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RefPtr<RegisterID> result = generator.emitNode(value.get(), m_right);
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RefPtr<RegisterID> forwardResult = (dst == generator.ignoredResult()) ? result.get() : generator.moveToDestinationIfNeeded(generator.tempDestination(result.get()), result.get());
+    if (m_base->isSuperNode()) {
+        RefPtr<RegisterID> thisValue = generator.ensureThis();
+        generator.emitPutById(base.get(), thisValue.get(), m_ident, forwardResult.get());
+    } else
+        generator.emitPutById(base.get(), m_ident, forwardResult.get());
+    generator.emitProfileType(forwardResult.get(), divotStart(), divotEnd());
+    return generator.moveToDestinationIfNeeded(dst, forwardResult.get());
+}
+
+// ------------------------------ ReadModifyDotNode -----------------------------------
+
+RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
+    RefPtr<RegisterID> value;
+    RefPtr<RegisterID> thisValue;
+    if (m_base->isSuperNode()) {
+        thisValue = generator.ensureThis();
+        value = generator.emitGetById(generator.tempDestination(dst), base.get(), thisValue.get(), m_ident);
+    } else
+        value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, static_cast<JSC::Operator>(m_operator), OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RegisterID* ret;
+    if (m_base->isSuperNode())
+        ret = generator.emitPutById(base.get(), thisValue.get(), m_ident, updatedValue);
+    else
+        ret = generator.emitPutById(base.get(), m_ident, updatedValue);
+    generator.emitProfileType(updatedValue, divotStart(), divotEnd());
+    return ret;
+}
+
+// ------------------------------ AssignErrorNode -----------------------------------
+
+RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    return emitThrowReferenceError(generator, ASCIILiteral("Left side of assignment is not a reference."));
+}
+
+// ------------------------------ AssignBracketNode -----------------------------------
+
+RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
+    RefPtr<RegisterID> result = generator.emitNode(value.get(), m_right);
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    RegisterID* forwardResult = (dst == generator.ignoredResult()) ? result.get() : generator.moveToDestinationIfNeeded(generator.tempDestination(result.get()), result.get());
+
+    if (isNonIndexStringElement(*m_subscript)) {
+        if (m_base->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            generator.emitPutById(base.get(), thisValue.get(), static_cast<StringNode*>(m_subscript)->value(), forwardResult);
+        } else
+            generator.emitPutById(base.get(), static_cast<StringNode*>(m_subscript)->value(), forwardResult);
+    } else {
+        if (m_base->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            generator.emitPutByVal(base.get(), thisValue.get(), property.get(), forwardResult);
+        } else
+            generator.emitPutByVal(base.get(), property.get(), forwardResult);
+    }
+
+    generator.emitProfileType(forwardResult, divotStart(), divotEnd());
+    return generator.moveToDestinationIfNeeded(dst, forwardResult);
+}
+
+// ------------------------------ ReadModifyBracketNode -----------------------------------
+
+RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
+
+    generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
+    RefPtr<RegisterID> value;
+    RefPtr<RegisterID> thisValue;
+    if (m_base->isSuperNode()) {
+        thisValue = generator.ensureThis();
+        value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), thisValue.get(), property.get());
+    } else
+        value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, static_cast<JSC::Operator>(m_operator), OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    if (m_base->isSuperNode())
+        generator.emitPutByVal(base.get(), thisValue.get(), property.get(), updatedValue);
+    else
+        generator.emitPutByVal(base.get(), property.get(), updatedValue);
+    generator.emitProfileType(updatedValue, divotStart(), divotEnd());
+
+    return updatedValue;
+}
+
+// ------------------------------ CommaNode ------------------------------------
+
+RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    CommaNode* node = this;
+    for (; node && node->next(); node = node->next())
+        generator.emitNode(generator.ignoredResult(), node->m_expr);
+    return generator.emitNodeInTailPosition(dst, node->m_expr);
+}
+
+// ------------------------------ SourceElements -------------------------------
+
+
+inline StatementNode* SourceElements::lastStatement() const
+{
+    return m_tail;
+}
+
+inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    for (StatementNode* statement = m_head; statement; statement = statement->next())
+        generator.emitNodeInTailPosition(dst, statement);
+}
+
+// ------------------------------ BlockNode ------------------------------------
+
+inline StatementNode* BlockNode::lastStatement() const
+{
+    return m_statements ? m_statements->lastStatement() : 0;
+}
+
+StatementNode* BlockNode::singleStatement() const
+{
+    return m_statements ? m_statements->singleStatement() : 0;
+}
+
+void BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (!m_statements)
+        return;
+    generator.pushLexicalScope(this, BytecodeGenerator::TDZCheckOptimization::Optimize, BytecodeGenerator::NestedScopeType::IsNested);
+    m_statements->emitBytecode(generator, dst);
+    generator.popLexicalScope(this);
+}
+
+// ------------------------------ EmptyStatementNode ---------------------------
+
+void EmptyStatementNode::emitBytecode(BytecodeGenerator&, RegisterID*)
+{
+    RELEASE_ASSERT(needsDebugHook());
+}
+
+// ------------------------------ DebuggerStatementNode ---------------------------
+
+void DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(DidReachBreakpoint, position());
+}
+
+// ------------------------------ ExprStatementNode ----------------------------
+
+void ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_expr);
+    generator.emitNode(dst, m_expr);
+}
+
+// ------------------------------ DeclarationStatement ----------------------------
+
+void DeclarationStatement::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    ASSERT(m_expr);
+    generator.emitNode(m_expr);
+}
+
+// ------------------------------ EmptyVarExpression ----------------------------
+
+RegisterID* EmptyVarExpression::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    // It's safe to return null here because this node will always be a child node of DeclarationStatement which ignores our return value.
+    if (!generator.vm()->typeProfiler())
+        return nullptr;
+
+    Variable var = generator.variable(m_ident);
+    if (RegisterID* local = var.local())
+        generator.emitProfileType(local, var, position(), JSTextPosition(-1, position().offset + m_ident.length(), -1));
+    else {
+        RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
+        RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, DoNotThrowIfNotFound);
+        generator.emitProfileType(value.get(), var, position(), JSTextPosition(-1, position().offset + m_ident.length(), -1));
+    }
+
+    return nullptr;
+}
+
+// ------------------------------ EmptyLetExpression ----------------------------
+
+RegisterID* EmptyLetExpression::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    // Lexical declarations like 'let' must move undefined into their variables so we don't
+    // get TDZ errors for situations like this: `let x; x;`
+    Variable var = generator.variable(m_ident);
+    if (RegisterID* local = var.local()) {
+        generator.emitLoad(local, jsUndefined());
+        generator.emitProfileType(local, var, position(), JSTextPosition(-1, position().offset + m_ident.length(), -1));
+    } else {
+        RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
+        RefPtr<RegisterID> value = generator.emitLoad(nullptr, jsUndefined());
+        generator.emitPutToScope(scope.get(), var, value.get(), generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound, InitializationMode::Initialization);
+        generator.emitProfileType(value.get(), var, position(), JSTextPosition(-1, position().offset + m_ident.length(), -1)); 
+    }
+
+    generator.liftTDZCheckIfPossible(var);
+
+    // It's safe to return null here because this node will always be a child node of DeclarationStatement which ignores our return value.
+    return nullptr;
+}
+
+// ------------------------------ IfElseNode ---------------------------------------
+
+static inline StatementNode* singleStatement(StatementNode* statementNode)
+{
+    if (statementNode->isBlock())
+        return static_cast<BlockNode*>(statementNode)->singleStatement();
+    return statementNode;
+}
+
+bool IfElseNode::tryFoldBreakAndContinue(BytecodeGenerator& generator, StatementNode* ifBlock,
+    Label*& trueTarget, FallThroughMode& fallThroughMode)
+{
+    StatementNode* singleStatement = JSC::singleStatement(ifBlock);
+    if (!singleStatement)
+        return false;
+
+    if (singleStatement->isBreak()) {
+        BreakNode* breakNode = static_cast<BreakNode*>(singleStatement);
+        Label* target = breakNode->trivialTarget(generator);
+        if (!target)
+            return false;
+        trueTarget = target;
+        fallThroughMode = FallThroughMeansFalse;
+        return true;
+    }
+
+    if (singleStatement->isContinue()) {
+        ContinueNode* continueNode = static_cast<ContinueNode*>(singleStatement);
+        Label* target = continueNode->trivialTarget(generator);
+        if (!target)
+            return false;
+        trueTarget = target;
+        fallThroughMode = FallThroughMeansFalse;
+        return true;
+    }
+
+    return false;
+}
+
+void IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> beforeThen = generator.newLabel();
+    RefPtr<Label> beforeElse = generator.newLabel();
+    RefPtr<Label> afterElse = generator.newLabel();
+
+    Label* trueTarget = beforeThen.get();
+    Label* falseTarget = beforeElse.get();
+    FallThroughMode fallThroughMode = FallThroughMeansTrue;
+    bool didFoldIfBlock = tryFoldBreakAndContinue(generator, m_ifBlock, trueTarget, fallThroughMode);
+
+    generator.emitNodeInConditionContext(m_condition, trueTarget, falseTarget, fallThroughMode);
+    generator.emitLabel(beforeThen.get());
+    generator.emitProfileControlFlow(m_ifBlock->startOffset());
+
+    if (!didFoldIfBlock) {
+        generator.emitNodeInTailPosition(dst, m_ifBlock);
+        if (m_elseBlock)
+            generator.emitJump(afterElse.get());
+    }
+
+    generator.emitLabel(beforeElse.get());
+
+    if (m_elseBlock) {
+        generator.emitProfileControlFlow(m_ifBlock->endOffset() + (m_ifBlock->isBlock() ? 1 : 0));
+        generator.emitNodeInTailPosition(dst, m_elseBlock);
+    }
+
+    generator.emitLabel(afterElse.get());
+    StatementNode* endingBlock = m_elseBlock ? m_elseBlock : m_ifBlock;
+    generator.emitProfileControlFlow(endingBlock->endOffset() + (endingBlock->isBlock() ? 1 : 0));
+}
+
+// ------------------------------ DoWhileNode ----------------------------------
+
+void DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    LabelScopePtr scope = generator.newLabelScope(LabelScope::Loop);
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    generator.emitLabel(topOfLoop.get());
+    generator.emitLoopHint();
+
+    generator.emitNodeInTailPosition(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), FallThroughMeansFalse);
+
+    generator.emitLabel(scope->breakTarget());
+}
+
+// ------------------------------ WhileNode ------------------------------------
+
+void WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    LabelScopePtr scope = generator.newLabelScope(LabelScope::Loop);
+    RefPtr<Label> topOfLoop = generator.newLabel();
+
+    generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), FallThroughMeansTrue);
+
+    generator.emitLabel(topOfLoop.get());
+    generator.emitLoopHint();
+    
+    generator.emitProfileControlFlow(m_statement->startOffset());
+    generator.emitNodeInTailPosition(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+
+    generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), FallThroughMeansFalse);
+
+    generator.emitLabel(scope->breakTarget());
+
+    generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
+}
+
+// ------------------------------ ForNode --------------------------------------
+
+void ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    LabelScopePtr scope = generator.newLabelScope(LabelScope::Loop);
+
+    RegisterID* forLoopSymbolTable = nullptr;
+    generator.pushLexicalScope(this, BytecodeGenerator::TDZCheckOptimization::Optimize, BytecodeGenerator::NestedScopeType::IsNested, &forLoopSymbolTable);
+
+    if (m_expr1)
+        generator.emitNode(generator.ignoredResult(), m_expr1);
+
+    RefPtr<Label> topOfLoop = generator.newLabel();
+    if (m_expr2)
+        generator.emitNodeInConditionContext(m_expr2, topOfLoop.get(), scope->breakTarget(), FallThroughMeansTrue);
+
+    generator.emitLabel(topOfLoop.get());
+    generator.emitLoopHint();
+    generator.emitProfileControlFlow(m_statement->startOffset());
+
+    generator.emitNodeInTailPosition(dst, m_statement);
+
+    generator.emitLabel(scope->continueTarget());
+    generator.prepareLexicalScopeForNextForLoopIteration(this, forLoopSymbolTable);
+    if (m_expr3)
+        generator.emitNode(generator.ignoredResult(), m_expr3);
+
+    if (m_expr2)
+        generator.emitNodeInConditionContext(m_expr2, topOfLoop.get(), scope->breakTarget(), FallThroughMeansFalse);
+    else
+        generator.emitJump(topOfLoop.get());
+
+    generator.emitLabel(scope->breakTarget());
+    generator.popLexicalScope(this);
+    generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
+}
+
+// ------------------------------ ForInNode ------------------------------------
+
+RegisterID* ForInNode::tryGetBoundLocal(BytecodeGenerator& generator)
+{
+    if (m_lexpr->isResolveNode()) {
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
+        return generator.variable(ident).local();
+    }
+
+    if (m_lexpr->isDestructuringNode()) {
+        DestructuringAssignmentNode* assignNode = static_cast<DestructuringAssignmentNode*>(m_lexpr);
+        auto binding = assignNode->bindings();
+        if (!binding->isBindingNode())
+            return nullptr;
+
+        auto simpleBinding = static_cast<BindingNode*>(binding);
+        const Identifier& ident = simpleBinding->boundProperty();
+        Variable var = generator.variable(ident);
+        if (var.isSpecial())
+            return nullptr;
+        return var.local();
+    }
+
+    return nullptr;
+}
+
+void ForInNode::emitLoopHeader(BytecodeGenerator& generator, RegisterID* propertyName)
+{
+    auto lambdaEmitResolveVariable = [&](const Identifier& ident)
+    {
+        Variable var = generator.variable(ident);
+        if (RegisterID* local = var.local()) {
+            if (var.isReadOnly())
+                generator.emitReadOnlyExceptionIfNeeded(var);
+            generator.emitMove(local, propertyName);
+        } else {
+            if (generator.isStrictMode())
+                generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+            if (var.isReadOnly())
+                generator.emitReadOnlyExceptionIfNeeded(var);
+            RegisterID* scope = generator.emitResolveScope(nullptr, var);
+            generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+            generator.emitPutToScope(scope, var, propertyName, generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound, InitializationMode::NotInitialization);
+        }
+        generator.emitProfileType(propertyName, var, m_lexpr->position(), JSTextPosition(-1, m_lexpr->position().offset + ident.length(), -1));
+    };
+
+    if (m_lexpr->isResolveNode()) {
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
+        lambdaEmitResolveVariable(ident);
+        return;
+    }
+
+    if (m_lexpr->isAssignResolveNode()) {
+        const Identifier& ident = static_cast<AssignResolveNode*>(m_lexpr)->identifier();
+        lambdaEmitResolveVariable(ident);
+        return;
+    }
+
+    if (m_lexpr->isDotAccessorNode()) {
+        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
+        const Identifier& ident = assignNode->identifier();
+        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->divotStart(), assignNode->divotEnd());
+        if (assignNode->base()->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            generator.emitPutById(base.get(), thisValue.get(), ident, propertyName);
+        } else
+            generator.emitPutById(base.get(), ident, propertyName);
+        generator.emitProfileType(propertyName, assignNode->divotStart(), assignNode->divotEnd());
+        return;
+    }
+    if (m_lexpr->isBracketAccessorNode()) {
+        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
+        RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
+        RefPtr<RegisterID> subscript = generator.emitNode(assignNode->subscript());
+        generator.emitExpressionInfo(assignNode->divot(), assignNode->divotStart(), assignNode->divotEnd());
+        if (assignNode->base()->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            generator.emitPutByVal(base.get(), thisValue.get(), subscript.get(), propertyName);
+        } else
+            generator.emitPutByVal(base.get(), subscript.get(), propertyName);
+        generator.emitProfileType(propertyName, assignNode->divotStart(), assignNode->divotEnd());
+        return;
+    }
+
+    if (m_lexpr->isDestructuringNode()) {
+        DestructuringAssignmentNode* assignNode = static_cast<DestructuringAssignmentNode*>(m_lexpr);
+        auto binding = assignNode->bindings();
+        if (!binding->isBindingNode()) {
+            assignNode->bindings()->bindValue(generator, propertyName);
+            return;
+        }
+
+        auto simpleBinding = static_cast<BindingNode*>(binding);
+        const Identifier& ident = simpleBinding->boundProperty();
+        Variable var = generator.variable(ident);
+        if (!var.local() || var.isSpecial()) {
+            assignNode->bindings()->bindValue(generator, propertyName);
+            return;
+        }
+        generator.emitMove(var.local(), propertyName);
+        generator.emitProfileType(propertyName, var, simpleBinding->divotStart(), simpleBinding->divotEnd());
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (!m_lexpr->isAssignResolveNode() && !m_lexpr->isAssignmentLocation()) {
+        emitThrowReferenceError(generator, ASCIILiteral("Left side of for-in statement is not a reference."));
+        return;
+    }
+
+    RefPtr<Label> end = generator.newLabel();
+
+    RegisterID* forLoopSymbolTable = nullptr;
+    generator.pushLexicalScope(this, BytecodeGenerator::TDZCheckOptimization::Optimize, BytecodeGenerator::NestedScopeType::IsNested, &forLoopSymbolTable);
+
+    if (m_lexpr->isAssignResolveNode())
+        generator.emitNode(generator.ignoredResult(), m_lexpr);
+
+    RefPtr<RegisterID> base = generator.newTemporary();
+    RefPtr<RegisterID> length;
+    RefPtr<RegisterID> enumerator;
+
+    generator.emitNode(base.get(), m_expr);
+    RefPtr<RegisterID> local = this->tryGetBoundLocal(generator);
+    RefPtr<RegisterID> enumeratorIndex;
+
+    // Pause at the assignment expression for each for..in iteration.
+    generator.emitDebugHook(m_lexpr);
+
+    int profilerStartOffset = m_statement->startOffset();
+    int profilerEndOffset = m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0);
+
+    enumerator = generator.emitGetPropertyEnumerator(generator.newTemporary(), base.get());
+
+    // Indexed property loop.
+    {
+        LabelScopePtr scope = generator.newLabelScope(LabelScope::Loop);
+        RefPtr<Label> loopStart = generator.newLabel();
+        RefPtr<Label> loopEnd = generator.newLabel();
+
+        length = generator.emitGetEnumerableLength(generator.newTemporary(), enumerator.get());
+        RefPtr<RegisterID> i = generator.emitLoad(generator.newTemporary(), jsNumber(0));
+        RefPtr<RegisterID> propertyName = generator.newTemporary();
+
+        generator.emitLabel(loopStart.get());
+        generator.emitLoopHint();
+
+        RefPtr<RegisterID> result = generator.emitEqualityOp(op_less, generator.newTemporary(), i.get(), length.get());
+        generator.emitJumpIfFalse(result.get(), loopEnd.get());
+        generator.emitHasIndexedProperty(result.get(), base.get(), i.get());
+        generator.emitJumpIfFalse(result.get(), scope->continueTarget());
+
+        generator.emitToIndexString(propertyName.get(), i.get());
+        this->emitLoopHeader(generator, propertyName.get());
+
+        generator.emitProfileControlFlow(profilerStartOffset);
+
+        generator.pushIndexedForInScope(local.get(), i.get());
+        generator.emitNode(dst, m_statement);
+        generator.popIndexedForInScope(local.get());
+
+        generator.emitProfileControlFlow(profilerEndOffset);
+
+        generator.emitLabel(scope->continueTarget());
+        generator.prepareLexicalScopeForNextForLoopIteration(this, forLoopSymbolTable);
+        generator.emitInc(i.get());
+        generator.emitDebugHook(m_lexpr); // Pause at the assignment expression for each for..in iteration.
+        generator.emitJump(loopStart.get());
+
+        generator.emitLabel(scope->breakTarget());
+        generator.emitJump(end.get());
+        generator.emitLabel(loopEnd.get());
+    }
+
+    // Structure property loop.
+    {
+        LabelScopePtr scope = generator.newLabelScope(LabelScope::Loop);
+        RefPtr<Label> loopStart = generator.newLabel();
+        RefPtr<Label> loopEnd = generator.newLabel();
+
+        enumeratorIndex = generator.emitLoad(generator.newTemporary(), jsNumber(0));
+        RefPtr<RegisterID> propertyName = generator.newTemporary();
+        generator.emitEnumeratorStructurePropertyName(propertyName.get(), enumerator.get(), enumeratorIndex.get());
+
+        generator.emitLabel(loopStart.get());
+        generator.emitLoopHint();
+
+        RefPtr<RegisterID> result = generator.emitUnaryOp(op_eq_null, generator.newTemporary(), propertyName.get());
+        generator.emitJumpIfTrue(result.get(), loopEnd.get());
+        generator.emitHasStructureProperty(result.get(), base.get(), propertyName.get(), enumerator.get());
+        generator.emitJumpIfFalse(result.get(), scope->continueTarget());
+
+        this->emitLoopHeader(generator, propertyName.get());
+
+        generator.emitProfileControlFlow(profilerStartOffset);
+
+        generator.pushStructureForInScope(local.get(), enumeratorIndex.get(), propertyName.get(), enumerator.get());
+        generator.emitNode(dst, m_statement);
+        generator.popStructureForInScope(local.get());
+
+        generator.emitProfileControlFlow(profilerEndOffset);
+
+        generator.emitLabel(scope->continueTarget());
+        generator.prepareLexicalScopeForNextForLoopIteration(this, forLoopSymbolTable);
+        generator.emitInc(enumeratorIndex.get());
+        generator.emitEnumeratorStructurePropertyName(propertyName.get(), enumerator.get(), enumeratorIndex.get());
+        generator.emitDebugHook(m_lexpr); // Pause at the assignment expression for each for..in iteration.
+        generator.emitJump(loopStart.get());
+        
+        generator.emitLabel(scope->breakTarget());
+        generator.emitJump(end.get());
+        generator.emitLabel(loopEnd.get());
+    }
+
+    // Generic property loop.
+    {
+        LabelScopePtr scope = generator.newLabelScope(LabelScope::Loop);
+        RefPtr<Label> loopStart = generator.newLabel();
+        RefPtr<Label> loopEnd = generator.newLabel();
+
+        RefPtr<RegisterID> propertyName = generator.newTemporary();
+
+        generator.emitEnumeratorGenericPropertyName(propertyName.get(), enumerator.get(), enumeratorIndex.get());
+
+        generator.emitLabel(loopStart.get());
+        generator.emitLoopHint();
+
+        RefPtr<RegisterID> result = generator.emitUnaryOp(op_eq_null, generator.newTemporary(), propertyName.get());
+        generator.emitJumpIfTrue(result.get(), loopEnd.get());
+
+        generator.emitHasGenericProperty(result.get(), base.get(), propertyName.get());
+        generator.emitJumpIfFalse(result.get(), scope->continueTarget());
+
+        this->emitLoopHeader(generator, propertyName.get());
+
+        generator.emitProfileControlFlow(profilerStartOffset);
+
+        generator.emitNode(dst, m_statement);
+
+        generator.emitLabel(scope->continueTarget());
+        generator.prepareLexicalScopeForNextForLoopIteration(this, forLoopSymbolTable);
+        generator.emitInc(enumeratorIndex.get());
+        generator.emitEnumeratorGenericPropertyName(propertyName.get(), enumerator.get(), enumeratorIndex.get());
+        generator.emitDebugHook(m_lexpr); // Pause at the assignment expression for each for..in iteration.
+        generator.emitJump(loopStart.get());
+
+        generator.emitLabel(scope->breakTarget());
+        generator.emitJump(end.get());
+        generator.emitLabel(loopEnd.get());
+    }
+
+    generator.emitLabel(end.get());
+    generator.popLexicalScope(this);
+    generator.emitProfileControlFlow(profilerEndOffset);
+}
+
+// ------------------------------ ForOfNode ------------------------------------
+void ForOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (!m_lexpr->isAssignmentLocation()) {
+        emitThrowReferenceError(generator, ASCIILiteral("Left side of for-of statement is not a reference."));
+        return;
+    }
+
+    RegisterID* forLoopSymbolTable = nullptr;
+    generator.pushLexicalScope(this, BytecodeGenerator::TDZCheckOptimization::Optimize, BytecodeGenerator::NestedScopeType::IsNested, &forLoopSymbolTable);
+    auto extractor = [this, dst](BytecodeGenerator& generator, RegisterID* value)
+    {
+        if (m_lexpr->isResolveNode()) {
+            const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
+            Variable var = generator.variable(ident);
+            if (RegisterID* local = var.local()) {
+                if (var.isReadOnly())
+                    generator.emitReadOnlyExceptionIfNeeded(var);
+                generator.emitMove(local, value);
+            } else {
+                if (generator.isStrictMode())
+                    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+                if (var.isReadOnly())
+                    generator.emitReadOnlyExceptionIfNeeded(var);
+                RegisterID* scope = generator.emitResolveScope(nullptr, var);
+                generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+                generator.emitPutToScope(scope, var, value, generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound, InitializationMode::NotInitialization);
+            }
+            generator.emitProfileType(value, var, m_lexpr->position(), JSTextPosition(-1, m_lexpr->position().offset + ident.length(), -1));
+        } else if (m_lexpr->isDotAccessorNode()) {
+            DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
+            const Identifier& ident = assignNode->identifier();
+            RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
+            
+            generator.emitExpressionInfo(assignNode->divot(), assignNode->divotStart(), assignNode->divotEnd());
+            if (assignNode->base()->isSuperNode()) {
+                RefPtr<RegisterID> thisValue = generator.ensureThis();
+                generator.emitPutById(base.get(), thisValue.get(), ident, value);
+            } else
+                generator.emitPutById(base.get(), ident, value);
+            generator.emitProfileType(value, assignNode->divotStart(), assignNode->divotEnd());
+        } else if (m_lexpr->isBracketAccessorNode()) {
+            BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
+            RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
+            RegisterID* subscript = generator.emitNode(assignNode->subscript());
+            
+            generator.emitExpressionInfo(assignNode->divot(), assignNode->divotStart(), assignNode->divotEnd());
+            if (assignNode->base()->isSuperNode()) {
+                RefPtr<RegisterID> thisValue = generator.ensureThis();
+                generator.emitPutByVal(base.get(), thisValue.get(), subscript, value);
+            } else
+                generator.emitPutByVal(base.get(), subscript, value);
+            generator.emitProfileType(value, assignNode->divotStart(), assignNode->divotEnd());
+        } else {
+            ASSERT(m_lexpr->isDestructuringNode());
+            DestructuringAssignmentNode* assignNode = static_cast<DestructuringAssignmentNode*>(m_lexpr);
+            assignNode->bindings()->bindValue(generator, value);
+        }
+        generator.emitProfileControlFlow(m_statement->startOffset());
+        generator.emitNode(dst, m_statement);
+    };
+    generator.emitEnumeration(this, m_expr, extractor, this, forLoopSymbolTable);
+    generator.popLexicalScope(this);
+    generator.emitProfileControlFlow(m_statement->endOffset() + (m_statement->isBlock() ? 1 : 0));
+}
+
+// ------------------------------ ContinueNode ---------------------------------
+
+Label* ContinueNode::trivialTarget(BytecodeGenerator& generator)
+{
+    if (generator.shouldEmitDebugHooks())
+        return 0;
+
+    LabelScopePtr scope = generator.continueTarget(m_ident);
+    ASSERT(scope);
+
+    if (generator.labelScopeDepth() != scope->scopeDepth())
+        return 0;
+
+    return scope->continueTarget();
+}
+
+void ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    LabelScopePtr scope = generator.continueTarget(m_ident);
+    ASSERT(scope);
+
+    generator.emitPopScopes(generator.scopeRegister(), scope->scopeDepth());
+    generator.emitJump(scope->continueTarget());
+
+    generator.emitProfileControlFlow(endOffset());
+}
+
+// ------------------------------ BreakNode ------------------------------------
+
+Label* BreakNode::trivialTarget(BytecodeGenerator& generator)
+{
+    if (generator.shouldEmitDebugHooks())
+        return 0;
+
+    LabelScopePtr scope = generator.breakTarget(m_ident);
+    ASSERT(scope);
+
+    if (generator.labelScopeDepth() != scope->scopeDepth())
+        return 0;
+
+    return scope->breakTarget();
+}
+
+void BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    LabelScopePtr scope = generator.breakTarget(m_ident);
+    ASSERT(scope);
+
+    generator.emitPopScopes(generator.scopeRegister(), scope->scopeDepth());
+    generator.emitJump(scope->breakTarget());
+
+    generator.emitProfileControlFlow(endOffset());
+}
+
+// ------------------------------ ReturnNode -----------------------------------
+
+void ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(generator.codeType() == FunctionCode);
+
+    if (dst == generator.ignoredResult())
+        dst = 0;
+
+    RefPtr<RegisterID> returnRegister = m_value ? generator.emitNodeInTailPosition(dst, m_value) : generator.emitLoad(dst, jsUndefined());
+
+    generator.emitProfileType(returnRegister.get(), ProfileTypeBytecodeFunctionReturnStatement, divotStart(), divotEnd());
+    if (generator.isInFinallyBlock()) {
+        returnRegister = generator.emitMove(generator.newTemporary(), returnRegister.get());
+        generator.emitPopScopes(generator.scopeRegister(), 0);
+    }
+
+    generator.emitWillLeaveCallFrameDebugHook();
+    generator.emitReturn(returnRegister.get());
+    generator.emitProfileControlFlow(endOffset()); 
+    // Emitting an unreachable return here is needed in case this op_profile_control_flow is the 
+    // last opcode in a CodeBlock because a CodeBlock's instructions must end with a terminal opcode.
+    if (generator.vm()->controlFlowProfiler())
+        generator.emitReturn(generator.emitLoad(nullptr, jsUndefined()));
+}
+
+// ------------------------------ WithNode -------------------------------------
+
+void WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> scope = generator.emitNode(m_expr);
+    generator.emitExpressionInfo(m_divot, m_divot - m_expressionLength, m_divot);
+    generator.emitPushWithScope(scope.get());
+    generator.emitNodeInTailPosition(dst, m_statement);
+    generator.emitPopWithScope();
+}
+
+// ------------------------------ CaseClauseNode --------------------------------
+
+inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitProfileControlFlow(m_startOffset);
+    if (!m_statements)
+        return;
+    m_statements->emitBytecode(generator, dst);
+}
+
+// ------------------------------ CaseBlockNode --------------------------------
+
+enum SwitchKind { 
+    SwitchUnset = 0,
+    SwitchNumber = 1, 
+    SwitchString = 2, 
+    SwitchNeither = 3 
+};
+
+static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
+{
+    for (; list; list = list->getNext()) {
+        ExpressionNode* clauseExpression = list->getClause()->expr();
+        literalVector.append(clauseExpression);
+        if (clauseExpression->isNumber()) {
+            double value = static_cast<NumberNode*>(clauseExpression)->value();
+            int32_t intVal = static_cast<int32_t>(value);
+            if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            if (intVal < min_num)
+                min_num = intVal;
+            if (intVal > max_num)
+                max_num = intVal;
+            typeForTable = SwitchNumber;
+            continue;
+        }
+        if (clauseExpression->isString()) {
+            if (typeForTable & ~SwitchString) {
+                typeForTable = SwitchNeither;
+                break;
+            }
+            const String& value = static_cast<StringNode*>(clauseExpression)->value().string();
+            if (singleCharacterSwitch &= value.length() == 1) {
+                int32_t intVal = value[0];
+                if (intVal < min_num)
+                    min_num = intVal;
+                if (intVal > max_num)
+                    max_num = intVal;
+            }
+            typeForTable = SwitchString;
+            continue;
+        }
+        typeForTable = SwitchNeither;
+        break;        
+    }
+}
+
+static inline size_t length(ClauseListNode* list1, ClauseListNode* list2)
+{
+    size_t length = 0;
+    for (ClauseListNode* node = list1; node; node = node->getNext())
+        ++length;
+    for (ClauseListNode* node = list2; node; node = node->getNext())
+        ++length;
+    return length;
+}
+
+SwitchInfo::SwitchType CaseBlockNode::tryTableSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
+{
+    if (length(m_list1, m_list2) < s_tableSwitchMinimum)
+        return SwitchInfo::SwitchNone;
+
+    SwitchKind typeForTable = SwitchUnset;
+    bool singleCharacterSwitch = true;
+    
+    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    
+    if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
+        return SwitchInfo::SwitchNone;
+    
+    if (typeForTable == SwitchNumber) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchImmediate;
+        return SwitchInfo::SwitchNone;
+    } 
+    
+    ASSERT(typeForTable == SwitchString);
+    
+    if (singleCharacterSwitch) {
+        int32_t range = max_num - min_num;
+        if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
+            return SwitchInfo::SwitchCharacter;
+    }
+
+    return SwitchInfo::SwitchString;
+}
+
+void CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
+{
+    RefPtr<Label> defaultLabel;
+    Vector<RefPtr<Label>, 8> labelVector;
+    Vector<ExpressionNode*, 8> literalVector;
+    int32_t min_num = std::numeric_limits<int32_t>::max();
+    int32_t max_num = std::numeric_limits<int32_t>::min();
+    SwitchInfo::SwitchType switchType = tryTableSwitch(literalVector, min_num, max_num);
+
+    if (switchType != SwitchInfo::SwitchNone) {
+        // Prepare the various labels
+        for (uint32_t i = 0; i < literalVector.size(); i++)
+            labelVector.append(generator.newLabel());
+        defaultLabel = generator.newLabel();
+        generator.beginSwitch(switchExpression, switchType);
+    } else {
+        // Setup jumps
+        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        
+        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+            RefPtr<RegisterID> clauseVal = generator.newTemporary();
+            generator.emitNode(clauseVal.get(), list->getClause()->expr());
+            generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
+            labelVector.append(generator.newLabel());
+            generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
+        }
+        defaultLabel = generator.newLabel();
+        generator.emitJump(defaultLabel.get());
+    }
+
+    size_t i = 0;
+    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+
+    if (m_defaultClause) {
+        generator.emitLabel(defaultLabel.get());
+        m_defaultClause->emitBytecode(generator, dst);
+    }
+
+    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
+        generator.emitLabel(labelVector[i++].get());
+        list->getClause()->emitBytecode(generator, dst);
+    }
+    if (!m_defaultClause)
+        generator.emitLabel(defaultLabel.get());
+
+    ASSERT(i == labelVector.size());
+    if (switchType != SwitchInfo::SwitchNone) {
+        ASSERT(labelVector.size() == literalVector.size());
+        generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
+    }
+}
+
+// ------------------------------ SwitchNode -----------------------------------
+
+void SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    LabelScopePtr scope = generator.newLabelScope(LabelScope::Switch);
+
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
+
+    generator.pushLexicalScope(this, BytecodeGenerator::TDZCheckOptimization::DoNotOptimize, BytecodeGenerator::NestedScopeType::IsNested);
+    m_block->emitBytecodeForBlock(generator, r0.get(), dst);
+    generator.popLexicalScope(this);
+
+    generator.emitLabel(scope->breakTarget());
+    generator.emitProfileControlFlow(endOffset());
+}
+
+// ------------------------------ LabelNode ------------------------------------
+
+void LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(!generator.breakTarget(m_name));
+
+    LabelScopePtr scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
+    generator.emitNodeInTailPosition(dst, m_statement);
+
+    generator.emitLabel(scope->breakTarget());
+}
+
+// ------------------------------ ThrowNode ------------------------------------
+
+void ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
+        dst = 0;
+    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
+    generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
+    generator.emitThrow(expr.get());
+
+    generator.emitProfileControlFlow(endOffset()); 
+}
+
+// ------------------------------ TryNode --------------------------------------
+
+void TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    // NOTE: The catch and finally blocks must be labeled explicitly, so the
+    // optimizer knows they may be jumped to from anywhere.
+
+    ASSERT(m_catchBlock || m_finallyBlock);
+
+    RefPtr<Label> tryStartLabel = generator.newLabel();
+    generator.emitLabel(tryStartLabel.get());
+    
+    if (m_finallyBlock)
+        generator.pushFinallyControlFlowScope(m_finallyBlock);
+    TryData* tryData = generator.pushTry(tryStartLabel.get());
+
+    generator.emitNode(dst, m_tryBlock);
+
+    if (m_catchBlock) {
+        RefPtr<Label> catchEndLabel = generator.newLabel();
+        
+        // Normal path: jump over the catch block.
+        generator.emitJump(catchEndLabel.get());
+
+        // Uncaught exception path: the catch block.
+        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
+        RefPtr<RegisterID> exceptionRegister = generator.newTemporary();
+        RefPtr<RegisterID> thrownValueRegister = generator.newTemporary();
+        generator.popTryAndEmitCatch(tryData, exceptionRegister.get(), thrownValueRegister.get(), here.get(), HandlerType::Catch);
+        
+        if (m_finallyBlock) {
+            // If the catch block throws an exception and we have a finally block, then the finally
+            // block should "catch" that exception.
+            tryData = generator.pushTry(here.get());
+        }
+
+        generator.emitPushCatchScope(m_lexicalVariables);
+        m_catchPattern->bindValue(generator, thrownValueRegister.get());
+        generator.emitProfileControlFlow(m_tryBlock->endOffset() + 1);
+        if (m_finallyBlock)
+            generator.emitNode(dst, m_catchBlock);
+        else
+            generator.emitNodeInTailPosition(dst, m_catchBlock);
+        generator.emitLoad(thrownValueRegister.get(), jsUndefined());
+        generator.emitPopCatchScope(m_lexicalVariables);
+        generator.emitLabel(catchEndLabel.get());
+    }
+
+    if (m_finallyBlock) {
+        RefPtr<Label> preFinallyLabel = generator.emitLabel(generator.newLabel().get());
+        
+        generator.popFinallyControlFlowScope();
+
+        RefPtr<Label> finallyEndLabel = generator.newLabel();
+
+        int finallyStartOffset = m_catchBlock ? m_catchBlock->endOffset() + 1 : m_tryBlock->endOffset() + 1;
+
+        // Normal path: run the finally code, and jump to the end.
+        generator.emitProfileControlFlow(finallyStartOffset);
+        generator.emitNodeInTailPosition(dst, m_finallyBlock);
+        generator.emitProfileControlFlow(m_finallyBlock->endOffset() + 1);
+        generator.emitJump(finallyEndLabel.get());
+
+        // Uncaught exception path: invoke the finally block, then re-throw the exception.
+        RefPtr<RegisterID> exceptionRegister = generator.newTemporary();
+        RefPtr<RegisterID> thrownValueRegister = generator.newTemporary();
+        generator.popTryAndEmitCatch(tryData, exceptionRegister.get(), thrownValueRegister.get(), preFinallyLabel.get(), HandlerType::Finally);
+        generator.emitProfileControlFlow(finallyStartOffset);
+        generator.emitNodeInTailPosition(dst, m_finallyBlock);
+        generator.emitThrow(exceptionRegister.get());
+
+        generator.emitLabel(finallyEndLabel.get());
+        generator.emitProfileControlFlow(m_finallyBlock->endOffset() + 1);
+    } else
+        generator.emitProfileControlFlow(m_catchBlock->endOffset() + 1);
+
+}
+
+// ------------------------------ ScopeNode -----------------------------
+
+inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (!m_statements)
+        return;
+    m_statements->emitBytecode(generator, dst);
+}
+
+static void emitProgramNodeBytecode(BytecodeGenerator& generator, ScopeNode& scopeNode)
+{
+    generator.emitDebugHook(WillExecuteProgram, scopeNode.startLine(), scopeNode.startStartOffset(), scopeNode.startLineStartOffset());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    generator.emitProfileControlFlow(scopeNode.startStartOffset());
+    scopeNode.emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, scopeNode.lastLine(), scopeNode.startOffset(), scopeNode.lineStartOffset());
+    generator.emitEnd(dstRegister.get());
+}
+
+// ------------------------------ ProgramNode -----------------------------
+
+void ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    emitProgramNodeBytecode(generator, *this);
+}
+
+// ------------------------------ ModuleProgramNode --------------------
+
+void ModuleProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    emitProgramNodeBytecode(generator, *this);
+}
+
+// ------------------------------ EvalNode -----------------------------
+
+void EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.emitDebugHook(WillExecuteProgram, startLine(), startStartOffset(), startLineStartOffset());
+
+    RefPtr<RegisterID> dstRegister = generator.newTemporary();
+    generator.emitLoad(dstRegister.get(), jsUndefined());
+    emitStatementsBytecode(generator, dstRegister.get());
+
+    generator.emitDebugHook(DidExecuteProgram, lastLine(), startOffset(), lineStartOffset());
+    generator.emitEnd(dstRegister.get());
+}
+
+// ------------------------------ FunctionNode -----------------------------
+
+void FunctionNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    if (generator.vm()->typeProfiler()) {
+        for (size_t i = 0; i < m_parameters->size(); i++) {
+            // Destructuring parameters are handled in destructuring nodes.
+            if (!m_parameters->at(i).first->isBindingNode())
+                continue;
+            BindingNode* parameter = static_cast<BindingNode*>(m_parameters->at(i).first);
+            RegisterID reg(CallFrame::argumentOffset(i));
+            generator.emitProfileType(&reg, ProfileTypeBytecodeFunctionArgument, parameter->divotStart(), parameter->divotEnd());
+        }
+    }
+
+    generator.emitProfileControlFlow(startStartOffset());
+    generator.emitDebugHook(DidEnterCallFrame, startLine(), startStartOffset(), startLineStartOffset());
+
+    switch (generator.parseMode()) {
+    case SourceParseMode::GeneratorWrapperFunctionMode: {
+        StatementNode* singleStatement = this->singleStatement();
+        ASSERT(singleStatement->isExprStatement());
+        ExprStatementNode* exprStatement = static_cast<ExprStatementNode*>(singleStatement);
+        ExpressionNode* expr = exprStatement->expr();
+        ASSERT(expr->isFuncExprNode());
+        FuncExprNode* funcExpr = static_cast<FuncExprNode*>(expr);
+
+        RefPtr<RegisterID> next = generator.newTemporary();
+        generator.emitNode(next.get(), funcExpr);
+
+        if (generator.superBinding() == SuperBinding::Needed) {
+            RefPtr<RegisterID> homeObject = emitHomeObjectForCallee(generator);
+            emitPutHomeObject(generator, next.get(), homeObject.get());
+        }
+
+        generator.emitPutGeneratorFields(next.get());
+
+        ASSERT(startOffset() >= lineStartOffset());
+        generator.emitDebugHook(WillLeaveCallFrame, lastLine(), startOffset(), lineStartOffset());
+        generator.emitReturn(generator.generatorRegister());
+        break;
+    }
+
+    case SourceParseMode::AsyncFunctionMode:
+    case SourceParseMode::AsyncMethodMode:
+    case SourceParseMode::AsyncArrowFunctionMode: {
+        StatementNode* singleStatement = this->singleStatement();
+        ASSERT(singleStatement->isExprStatement());
+        ExprStatementNode* exprStatement = static_cast<ExprStatementNode*>(singleStatement);
+        ExpressionNode* expr = exprStatement->expr();
+        ASSERT(expr->isFuncExprNode());
+        FuncExprNode* funcExpr = static_cast<FuncExprNode*>(expr);
+
+        RefPtr<RegisterID> next = generator.newTemporary();
+        generator.emitNode(next.get(), funcExpr);
+
+        if (generator.superBinding() == SuperBinding::Needed || generator.parseMode() == SourceParseMode::AsyncArrowFunctionMode) {
+            // FIXME: Don't always load home object for async arrows
+            RefPtr<RegisterID> homeObject = emitHomeObjectForCallee(generator);
+            emitPutHomeObject(generator, next.get(), homeObject.get());
+        }
+
+        generator.emitPutGeneratorFields(next.get());
+
+        ASSERT(startOffset() >= lineStartOffset());
+        generator.emitDebugHook(WillLeaveCallFrame, lastLine(), startOffset(), lineStartOffset());
+
+        // load and call @asyncFunctionResume
+        auto var = generator.variable(generator.propertyNames().builtinNames().asyncFunctionResumePrivateName());
+        RefPtr<RegisterID> scope = generator.newTemporary();
+        generator.moveToDestinationIfNeeded(scope.get(), generator.emitResolveScope(scope.get(), var));
+        RefPtr<RegisterID> asyncFunctionResume = generator.emitGetFromScope(generator.newTemporary(), scope.get(), var, ThrowIfNotFound);
+
+        CallArguments args(generator, nullptr, 4);
+        unsigned argumentCount = 0;
+        generator.emitLoad(args.thisRegister(), jsUndefined());
+        generator.emitMove(args.argumentRegister(argumentCount++), generator.generatorRegister());
+        generator.emitMove(args.argumentRegister(argumentCount++), generator.promiseCapabilityRegister());
+        generator.emitLoad(args.argumentRegister(argumentCount++), jsUndefined());
+        generator.emitLoad(args.argumentRegister(argumentCount++), jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::NormalMode)));
+        // JSTextPosition(int _line, int _offset, int _lineStartOffset)
+        JSTextPosition divot(firstLine(), startOffset(), lineStartOffset());
+
+        RefPtr<RegisterID> result = generator.newTemporary();
+        generator.emitCallInTailPosition(result.get(), asyncFunctionResume.get(), NoExpectedFunction, args, divot, divot, divot, DebuggableCall::No);
+        generator.emitReturn(result.get());
+        break;
+    }
+
+    case SourceParseMode::AsyncArrowFunctionBodyMode:
+    case SourceParseMode::AsyncFunctionBodyMode:
+    case SourceParseMode::GeneratorBodyMode: {
+        RefPtr<Label> generatorBodyLabel = generator.newLabel();
+        {
+            RefPtr<RegisterID> condition = generator.newTemporary();
+            generator.emitEqualityOp(op_stricteq, condition.get(), generator.generatorResumeModeRegister(), generator.emitLoad(nullptr, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::NormalMode))));
+            generator.emitJumpIfTrue(condition.get(), generatorBodyLabel.get());
+
+            RefPtr<Label> throwLabel = generator.newLabel();
+            generator.emitEqualityOp(op_stricteq, condition.get(), generator.generatorResumeModeRegister(), generator.emitLoad(nullptr, jsNumber(static_cast<int32_t>(JSGeneratorFunction::GeneratorResumeMode::ThrowMode))));
+            generator.emitJumpIfTrue(condition.get(), throwLabel.get());
+
+            generator.emitReturn(generator.generatorValueRegister());
+
+            generator.emitLabel(throwLabel.get());
+            generator.emitThrow(generator.generatorValueRegister());
+        }
+
+        generator.emitLabel(generatorBodyLabel.get());
+
+        emitStatementsBytecode(generator, generator.ignoredResult());
+
+        RefPtr<Label> done = generator.newLabel();
+        generator.emitLabel(done.get());
+        generator.emitReturn(generator.emitLoad(nullptr, jsUndefined()));
+        break;
+    }
+
+    default: {
+        emitStatementsBytecode(generator, generator.ignoredResult());
+
+        StatementNode* singleStatement = this->singleStatement();
+        ReturnNode* returnNode = 0;
+
+        // Check for a return statement at the end of a function composed of a single block.
+        if (singleStatement && singleStatement->isBlock()) {
+            StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
+            if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
+                returnNode = static_cast<ReturnNode*>(lastStatementInBlock);
+        }
+
+        // If there is no return we must automatically insert one.
+        if (!returnNode) {
+            if (generator.constructorKind() == ConstructorKind::Extends && generator.needsToUpdateArrowFunctionContext() && generator.isSuperCallUsedInInnerArrowFunction())
+                generator.emitLoadThisFromArrowFunctionLexicalEnvironment(); // Arrow function can invoke 'super' in constructor and before leave constructor we need load 'this' from lexical arrow function environment
+            
+            RegisterID* r0 = generator.isConstructor() ? generator.thisRegister() : generator.emitLoad(0, jsUndefined());
+            generator.emitProfileType(r0, ProfileTypeBytecodeFunctionReturnStatement); // Do not emit expression info for this profile because it's not in the user's source code.
+            ASSERT(startOffset() >= lineStartOffset());
+            generator.emitWillLeaveCallFrameDebugHook();
+            generator.emitReturn(r0);
+            return;
+        }
+        break;
+    }
+    }
+}
+
+// ------------------------------ FuncDeclNode ---------------------------------
+
+void FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+{
+    generator.hoistSloppyModeFunctionIfNecessary(metadata()->ident());
+}
+
+// ------------------------------ FuncExprNode ---------------------------------
+
+RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
+}
+
+// ------------------------------ ArrowFuncExprNode ---------------------------------
+
+RegisterID* ArrowFuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    return generator.emitNewArrowFunctionExpression(generator.finalDestination(dst), this);
+}
+
+// ------------------------------ MethodDefinitionNode ---------------------------------
+
+RegisterID* MethodDefinitionNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    return generator.emitNewMethodDefinition(generator.finalDestination(dst), this);
+}
+
+// ------------------------------ YieldExprNode --------------------------------
+
+RegisterID* YieldExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (!delegate()) {
+        RefPtr<RegisterID> arg = nullptr;
+        if (argument()) {
+            arg = generator.newTemporary();
+            generator.emitNode(arg.get(), argument());
+        } else
+            arg = generator.emitLoad(nullptr, jsUndefined());
+        RefPtr<RegisterID> value = generator.emitYield(arg.get());
+        if (dst == generator.ignoredResult())
+            return nullptr;
+        return generator.emitMove(generator.finalDestination(dst), value.get());
+    }
+    RefPtr<RegisterID> arg = generator.newTemporary();
+    generator.emitNode(arg.get(), argument());
+    RefPtr<RegisterID> value = generator.emitDelegateYield(arg.get(), this);
+    if (dst == generator.ignoredResult())
+        return nullptr;
+    return generator.emitMove(generator.finalDestination(dst), value.get());
+}
+
+// ------------------------------ AwaitExprNode --------------------------------
+
+RegisterID* AwaitExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<RegisterID> arg = generator.newTemporary();
+    generator.emitNode(arg.get(), argument());
+    RefPtr<RegisterID> value = generator.emitYield(arg.get());
+    if (dst == generator.ignoredResult())
+        return nullptr;
+    return generator.emitMove(generator.finalDestination(dst), value.get());
+}
+
+// ------------------------------ ClassDeclNode ---------------------------------
+
+void ClassDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    generator.emitNode(dst, m_classDeclaration);
+}
+
+// ------------------------------ ClassExprNode ---------------------------------
+
+RegisterID* ClassExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (!m_name.isNull())
+        generator.pushLexicalScope(this, BytecodeGenerator::TDZCheckOptimization::Optimize, BytecodeGenerator::NestedScopeType::IsNested);
+
+    RefPtr<RegisterID> superclass;
+    if (m_classHeritage) {
+        superclass = generator.newTemporary();
+        generator.emitNode(superclass.get(), m_classHeritage);
+    }
+
+    RefPtr<RegisterID> constructor;
+
+    // FIXME: Make the prototype non-configurable & non-writable.
+    if (m_constructorExpression) {
+        ASSERT(m_constructorExpression->isFuncExprNode());
+        FunctionMetadataNode* metadata = static_cast<FuncExprNode*>(m_constructorExpression)->metadata();
+        metadata->setEcmaName(ecmaName());
+        metadata->setClassSource(m_classSource);
+        constructor = generator.emitNode(dst, m_constructorExpression);
+        if (m_classHeritage) {
+            RefPtr<RegisterID> isDerivedConstructor = generator.newTemporary();
+            generator.emitUnaryOp(op_not, isDerivedConstructor.get(),
+                generator.emitUnaryOp(op_eq_null, isDerivedConstructor.get(), superclass.get()));
+            generator.emitDirectPutById(constructor.get(), generator.propertyNames().builtinNames().isDerivedConstructorPrivateName(), isDerivedConstructor.get(), PropertyNode::Unknown);
+        }
+    } else {
+        if (m_classHeritage) {
+            constructor = generator.finalDestination(dst);
+            RefPtr<RegisterID> tempRegister = generator.newTemporary();
+            RefPtr<Label> superclassIsNullLabel = generator.newLabel();
+            RefPtr<Label> done = generator.newLabel();
+
+            generator.emitJumpIfTrue(generator.emitUnaryOp(op_eq_null, tempRegister.get(), superclass.get()), superclassIsNullLabel.get());
+            generator.emitNewDefaultConstructor(constructor.get(), ConstructorKind::Extends, m_name, ecmaName(), m_classSource);
+            generator.emitLoad(tempRegister.get(), jsBoolean(true));
+            generator.emitJump(done.get());
+            generator.emitLabel(superclassIsNullLabel.get());
+            generator.emitNewDefaultConstructor(constructor.get(), ConstructorKind::Base, m_name, ecmaName(), m_classSource);
+            generator.emitLoad(tempRegister.get(), jsBoolean(false));
+            generator.emitLabel(done.get());
+            generator.emitDirectPutById(constructor.get(), generator.propertyNames().builtinNames().isDerivedConstructorPrivateName(), tempRegister.get(), PropertyNode::Unknown);
+        } else {
+            constructor = generator.emitNewDefaultConstructor(generator.finalDestination(dst),
+                ConstructorKind::Base, m_name, ecmaName(), m_classSource);
+        }
+    }
+
+    const auto& propertyNames = generator.propertyNames();
+    RefPtr<RegisterID> prototype = generator.emitNewObject(generator.newTemporary());
+
+    if (superclass) {
+        RefPtr<RegisterID> protoParent = generator.newTemporary();
+        generator.emitLoad(protoParent.get(), jsNull());
+
+        RefPtr<RegisterID> tempRegister = generator.newTemporary();
+
+        // FIXME: Throw TypeError if it's a generator function.
+        RefPtr<Label> superclassIsUndefinedLabel = generator.newLabel();
+        generator.emitJumpIfTrue(generator.emitIsUndefined(tempRegister.get(), superclass.get()), superclassIsUndefinedLabel.get());
+
+        RefPtr<Label> superclassIsNullLabel = generator.newLabel();
+        generator.emitJumpIfTrue(generator.emitUnaryOp(op_eq_null, tempRegister.get(), superclass.get()), superclassIsNullLabel.get());
+
+        RefPtr<Label> superclassIsObjectLabel = generator.newLabel();
+        generator.emitJumpIfTrue(generator.emitIsObject(tempRegister.get(), superclass.get()), superclassIsObjectLabel.get());
+        generator.emitLabel(superclassIsUndefinedLabel.get());
+        generator.emitThrowTypeError(ASCIILiteral("The superclass is not an object."));
+        generator.emitLabel(superclassIsObjectLabel.get());
+        generator.emitGetById(protoParent.get(), superclass.get(), generator.propertyNames().prototype);
+
+        RefPtr<Label> protoParentIsObjectOrNullLabel = generator.newLabel();
+        generator.emitJumpIfTrue(generator.emitUnaryOp(op_is_object_or_null, tempRegister.get(), protoParent.get()), protoParentIsObjectOrNullLabel.get());
+        generator.emitJumpIfTrue(generator.emitUnaryOp(op_is_function, tempRegister.get(), protoParent.get()), protoParentIsObjectOrNullLabel.get());
+        generator.emitThrowTypeError(ASCIILiteral("The value of the superclass's prototype property is not an object."));
+        generator.emitLabel(protoParentIsObjectOrNullLabel.get());
+
+        generator.emitDirectPutById(constructor.get(), generator.propertyNames().underscoreProto, superclass.get(), PropertyNode::Unknown);
+        generator.emitLabel(superclassIsNullLabel.get());
+        generator.emitDirectPutById(prototype.get(), generator.propertyNames().underscoreProto, protoParent.get(), PropertyNode::Unknown);
+
+        emitPutHomeObject(generator, constructor.get(), prototype.get());
+    }
+
+    RefPtr<RegisterID> constructorNameRegister = generator.emitLoad(nullptr, propertyNames.constructor);
+    generator.emitCallDefineProperty(prototype.get(), constructorNameRegister.get(), constructor.get(), nullptr, nullptr,
+        BytecodeGenerator::PropertyConfigurable | BytecodeGenerator::PropertyWritable, m_position);
+
+    RefPtr<RegisterID> prototypeNameRegister = generator.emitLoad(nullptr, propertyNames.prototype);
+    generator.emitCallDefineProperty(constructor.get(), prototypeNameRegister.get(), prototype.get(), nullptr, nullptr, 0, m_position);
+
+    if (m_staticMethods)
+        generator.emitNode(constructor.get(), m_staticMethods);
+
+    if (m_instanceMethods)
+        generator.emitNode(prototype.get(), m_instanceMethods);
+
+    if (!m_name.isNull()) {
+        Variable classNameVar = generator.variable(m_name);
+        RELEASE_ASSERT(classNameVar.isResolved());
+        RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, classNameVar);
+        generator.emitPutToScope(scope.get(), classNameVar, constructor.get(), ThrowIfNotFound, InitializationMode::Initialization);
+        generator.popLexicalScope(this);
+    }
+
+    return generator.moveToDestinationIfNeeded(dst, constructor.get());
+}
+
+// ------------------------------ ImportDeclarationNode -----------------------
+
+void ImportDeclarationNode::emitBytecode(BytecodeGenerator&, RegisterID*)
+{
+    // Do nothing at runtime.
+}
+
+// ------------------------------ ExportAllDeclarationNode --------------------
+
+void ExportAllDeclarationNode::emitBytecode(BytecodeGenerator&, RegisterID*)
+{
+    // Do nothing at runtime.
+}
+
+// ------------------------------ ExportDefaultDeclarationNode ----------------
+
+void ExportDefaultDeclarationNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_declaration);
+    generator.emitNode(dst, m_declaration);
+}
+
+// ------------------------------ ExportLocalDeclarationNode ------------------
+
+void ExportLocalDeclarationNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    ASSERT(m_declaration);
+    generator.emitNode(dst, m_declaration);
+}
+
+// ------------------------------ ExportNamedDeclarationNode ------------------
+
+void ExportNamedDeclarationNode::emitBytecode(BytecodeGenerator&, RegisterID*)
+{
+    // Do nothing at runtime.
+}
+
+// ------------------------------ DestructuringAssignmentNode -----------------
+RegisterID* DestructuringAssignmentNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (RegisterID* result = m_bindings->emitDirectBinding(generator, dst, m_initializer))
+        return result;
+    RefPtr<RegisterID> initializer = generator.tempDestination(dst);
+    generator.emitNode(initializer.get(), m_initializer);
+    m_bindings->bindValue(generator, initializer.get());
+    return generator.moveToDestinationIfNeeded(dst, initializer.get());
+}
+
+static void assignDefaultValueIfUndefined(BytecodeGenerator& generator, RegisterID* maybeUndefined, ExpressionNode* defaultValue)
+{
+    ASSERT(defaultValue);
+    RefPtr<Label> isNotUndefined = generator.newLabel();
+    generator.emitJumpIfFalse(generator.emitIsUndefined(generator.newTemporary(), maybeUndefined), isNotUndefined.get());
+    generator.emitNode(maybeUndefined, defaultValue);
+    generator.emitLabel(isNotUndefined.get());
+}
+
+void ArrayPatternNode::bindValue(BytecodeGenerator& generator, RegisterID* rhs) const
+{
+    RefPtr<RegisterID> iterator = generator.newTemporary();
+    {
+        generator.emitGetById(iterator.get(), rhs, generator.propertyNames().iteratorSymbol);
+        CallArguments args(generator, nullptr);
+        generator.emitMove(args.thisRegister(), rhs);
+        generator.emitCall(iterator.get(), iterator.get(), NoExpectedFunction, args, divot(), divotStart(), divotEnd(), DebuggableCall::No);
+    }
+
+    if (m_targetPatterns.isEmpty()) {
+        generator.emitIteratorClose(iterator.get(), this);
+        return;
+    }
+
+    RefPtr<RegisterID> done;
+    for (auto& target : m_targetPatterns) {
+        switch (target.bindingType) {
+        case BindingType::Elision:
+        case BindingType::Element: {
+            RefPtr<Label> iterationSkipped = generator.newLabel();
+            if (!done)
+                done = generator.newTemporary();
+            else
+                generator.emitJumpIfTrue(done.get(), iterationSkipped.get());
+
+            RefPtr<RegisterID> value = generator.newTemporary();
+            generator.emitIteratorNext(value.get(), iterator.get(), this);
+            generator.emitGetById(done.get(), value.get(), generator.propertyNames().done);
+            generator.emitJumpIfTrue(done.get(), iterationSkipped.get());
+            generator.emitGetById(value.get(), value.get(), generator.propertyNames().value);
+
+            {
+                RefPtr<Label> valueIsSet = generator.newLabel();
+                generator.emitJump(valueIsSet.get());
+                generator.emitLabel(iterationSkipped.get());
+                generator.emitLoad(value.get(), jsUndefined());
+                generator.emitLabel(valueIsSet.get());
+            }
+
+            if (target.bindingType == BindingType::Element) {
+                if (target.defaultValue)
+                    assignDefaultValueIfUndefined(generator, value.get(), target.defaultValue);
+                target.pattern->bindValue(generator, value.get());
+            }
+            break;
+        }
+
+        case BindingType::RestElement: {
+            RefPtr<RegisterID> array = generator.emitNewArray(generator.newTemporary(), 0, 0);
+
+            RefPtr<Label> iterationDone = generator.newLabel();
+            if (!done)
+                done = generator.newTemporary();
+            else
+                generator.emitJumpIfTrue(done.get(), iterationDone.get());
+
+            RefPtr<RegisterID> index = generator.newTemporary();
+            generator.emitLoad(index.get(), jsNumber(0));
+            RefPtr<Label> loopStart = generator.newLabel();
+            generator.emitLabel(loopStart.get());
+
+            RefPtr<RegisterID> value = generator.newTemporary();
+            generator.emitIteratorNext(value.get(), iterator.get(), this);
+            generator.emitGetById(done.get(), value.get(), generator.propertyNames().done);
+            generator.emitJumpIfTrue(done.get(), iterationDone.get());
+            generator.emitGetById(value.get(), value.get(), generator.propertyNames().value);
+
+            generator.emitDirectPutByVal(array.get(), index.get(), value.get());
+            generator.emitInc(index.get());
+            generator.emitJump(loopStart.get());
+
+            generator.emitLabel(iterationDone.get());
+            target.pattern->bindValue(generator, array.get());
+            break;
+        }
+        }
+    }
+
+    RefPtr<Label> iteratorClosed = generator.newLabel();
+    generator.emitJumpIfTrue(done.get(), iteratorClosed.get());
+    generator.emitIteratorClose(iterator.get(), this);
+    generator.emitLabel(iteratorClosed.get());
+}
+
+RegisterID* ArrayPatternNode::emitDirectBinding(BytecodeGenerator& generator, RegisterID* dst, ExpressionNode* rhs)
+{
+    if (!rhs->isSimpleArray())
+        return nullptr;
+
+    ElementNode* elementNodes = static_cast<ArrayNode*>(rhs)->elements();
+    Vector<ExpressionNode*> elements;
+    for (; elementNodes; elementNodes = elementNodes->next()) {
+        ExpressionNode* value = elementNodes->value();
+        if (value->isSpreadExpression())
+            return nullptr;
+        elements.append(value);
+    }
+
+    RefPtr<RegisterID> resultRegister;
+    if (dst && dst != generator.ignoredResult())
+        resultRegister = generator.emitNewArray(generator.newTemporary(), 0, 0);
+    if (m_targetPatterns.size() != elements.size())
+        return nullptr;
+    Vector<RefPtr<RegisterID>> registers;
+    registers.reserveCapacity(m_targetPatterns.size());
+    for (size_t i = 0; i < m_targetPatterns.size(); i++) {
+        registers.uncheckedAppend(generator.newTemporary());
+        generator.emitNode(registers.last().get(), elements[i]);
+        if (m_targetPatterns[i].defaultValue)
+            assignDefaultValueIfUndefined(generator, registers.last().get(), m_targetPatterns[i].defaultValue);
+        if (resultRegister)
+            generator.emitPutByIndex(resultRegister.get(), i, registers.last().get());
+    }
+    
+    for (size_t i = 0; i < m_targetPatterns.size(); i++) {
+        if (m_targetPatterns[i].pattern)
+            m_targetPatterns[i].pattern->bindValue(generator, registers[i].get());
+    }
+    if (resultRegister)
+        return generator.moveToDestinationIfNeeded(dst, resultRegister.get());
+    return generator.emitLoad(generator.finalDestination(dst), jsUndefined());
+}
+
+void ArrayPatternNode::toString(StringBuilder& builder) const
+{
+    builder.append('[');
+    for (size_t i = 0; i < m_targetPatterns.size(); i++) {
+        const auto& target = m_targetPatterns[i];
+
+        switch (target.bindingType) {
+        case BindingType::Elision:
+            builder.append(',');
+            break;
+
+        case BindingType::Element:
+            target.pattern->toString(builder);
+            if (i < m_targetPatterns.size() - 1)
+                builder.append(',');
+            break;
+
+        case BindingType::RestElement:
+            builder.appendLiteral("...");
+            target.pattern->toString(builder);
+            break;
+        }
+    }
+    builder.append(']');
+}
+
+void ArrayPatternNode::collectBoundIdentifiers(Vector<Identifier>& identifiers) const
+{
+    for (size_t i = 0; i < m_targetPatterns.size(); i++) {
+        if (DestructuringPatternNode* node = m_targetPatterns[i].pattern)
+            node->collectBoundIdentifiers(identifiers);
+    }
+}
+
+void ObjectPatternNode::toString(StringBuilder& builder) const
+{
+    builder.append('{');
+    for (size_t i = 0; i < m_targetPatterns.size(); i++) {
+        if (m_targetPatterns[i].wasString)
+            builder.appendQuotedJSONString(m_targetPatterns[i].propertyName.string());
+        else
+            builder.append(m_targetPatterns[i].propertyName.string());
+        builder.append(':');
+        m_targetPatterns[i].pattern->toString(builder);
+        if (i < m_targetPatterns.size() - 1)
+            builder.append(',');
+    }
+    builder.append('}');
+}
+    
+void ObjectPatternNode::bindValue(BytecodeGenerator& generator, RegisterID* rhs) const
+{
+    generator.emitRequireObjectCoercible(rhs, ASCIILiteral("Right side of assignment cannot be destructured"));
+    for (size_t i = 0; i < m_targetPatterns.size(); i++) {
+        auto& target = m_targetPatterns[i];
+        RefPtr<RegisterID> temp = generator.newTemporary();
+        if (!target.propertyExpression) {
+            // Should not emit get_by_id for indexed ones.
+            std::optional<uint32_t> optionalIndex = parseIndex(target.propertyName);
+            if (!optionalIndex)
+                generator.emitGetById(temp.get(), rhs, target.propertyName);
+            else {
+                RefPtr<RegisterID> index = generator.emitLoad(nullptr, jsNumber(optionalIndex.value()));
+                generator.emitGetByVal(temp.get(), rhs, index.get());
+            }
+        } else {
+            RefPtr<RegisterID> propertyName = generator.emitNode(target.propertyExpression);
+            generator.emitGetByVal(temp.get(), rhs, propertyName.get());
+        }
+
+        if (target.defaultValue)
+            assignDefaultValueIfUndefined(generator, temp.get(), target.defaultValue);
+        target.pattern->bindValue(generator, temp.get());
+    }
+}
+
+void ObjectPatternNode::collectBoundIdentifiers(Vector<Identifier>& identifiers) const
+{
+    for (size_t i = 0; i < m_targetPatterns.size(); i++)
+        m_targetPatterns[i].pattern->collectBoundIdentifiers(identifiers);
+}
+
+void BindingNode::bindValue(BytecodeGenerator& generator, RegisterID* value) const
+{
+    Variable var = generator.variable(m_boundProperty);
+    bool isReadOnly = var.isReadOnly() && m_bindingContext != AssignmentContext::ConstDeclarationStatement;
+    if (RegisterID* local = var.local()) {
+        if (m_bindingContext == AssignmentContext::AssignmentExpression)
+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
+        if (isReadOnly) {
+            generator.emitReadOnlyExceptionIfNeeded(var);
+            return;
+        }
+        generator.emitMove(local, value);
+        generator.emitProfileType(local, var, divotStart(), divotEnd());
+        if (m_bindingContext == AssignmentContext::DeclarationStatement || m_bindingContext == AssignmentContext::ConstDeclarationStatement)
+            generator.liftTDZCheckIfPossible(var);
+        return;
+    }
+    if (generator.isStrictMode())
+        generator.emitExpressionInfo(divotEnd(), divotStart(), divotEnd());
+    RegisterID* scope = generator.emitResolveScope(nullptr, var);
+    generator.emitExpressionInfo(divotEnd(), divotStart(), divotEnd());
+    if (m_bindingContext == AssignmentContext::AssignmentExpression)
+        generator.emitTDZCheckIfNecessary(var, nullptr, scope);
+    if (isReadOnly) {
+        generator.emitReadOnlyExceptionIfNeeded(var);
+        return;
+    }
+    generator.emitPutToScope(scope, var, value, generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound, initializationModeForAssignmentContext(m_bindingContext));
+    generator.emitProfileType(value, var, divotStart(), divotEnd());
+    if (m_bindingContext == AssignmentContext::DeclarationStatement || m_bindingContext == AssignmentContext::ConstDeclarationStatement)
+        generator.liftTDZCheckIfPossible(var);
+    return;
+}
+
+void BindingNode::toString(StringBuilder& builder) const
+{
+    builder.append(m_boundProperty.string());
+}
+
+void BindingNode::collectBoundIdentifiers(Vector<Identifier>& identifiers) const
+{
+    identifiers.append(m_boundProperty);
+}
+
+void AssignmentElementNode::collectBoundIdentifiers(Vector<Identifier>&) const
+{
+}
+
+void AssignmentElementNode::bindValue(BytecodeGenerator& generator, RegisterID* value) const
+{
+    if (m_assignmentTarget->isResolveNode()) {
+        ResolveNode* lhs = static_cast<ResolveNode*>(m_assignmentTarget);
+        Variable var = generator.variable(lhs->identifier());
+        bool isReadOnly = var.isReadOnly();
+        if (RegisterID* local = var.local()) {
+            generator.emitTDZCheckIfNecessary(var, local, nullptr);
+
+            if (isReadOnly)
+                generator.emitReadOnlyExceptionIfNeeded(var);
+            else {
+                generator.invalidateForInContextForLocal(local);
+                generator.moveToDestinationIfNeeded(local, value);
+                generator.emitProfileType(local, divotStart(), divotEnd());
+            }
+            return;
+        }
+        if (generator.isStrictMode())
+            generator.emitExpressionInfo(divotEnd(), divotStart(), divotEnd());
+        RefPtr<RegisterID> scope = generator.emitResolveScope(nullptr, var);
+        generator.emitTDZCheckIfNecessary(var, nullptr, scope.get());
+        if (isReadOnly) {
+            bool threwException = generator.emitReadOnlyExceptionIfNeeded(var);
+            if (threwException)
+                return;
+        }
+        generator.emitExpressionInfo(divotEnd(), divotStart(), divotEnd());
+        if (!isReadOnly) {
+            generator.emitPutToScope(scope.get(), var, value, generator.isStrictMode() ? ThrowIfNotFound : DoNotThrowIfNotFound, InitializationMode::NotInitialization);
+            generator.emitProfileType(value, var, divotStart(), divotEnd());
+        }
+    } else if (m_assignmentTarget->isDotAccessorNode()) {
+        DotAccessorNode* lhs = static_cast<DotAccessorNode*>(m_assignmentTarget);
+        RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(lhs->base(), true, false);
+        generator.emitExpressionInfo(divotEnd(), divotStart(), divotEnd());
+        if (lhs->base()->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            generator.emitPutById(base.get(), thisValue.get(), lhs->identifier(), value);
+        } else
+            generator.emitPutById(base.get(), lhs->identifier(), value);
+        generator.emitProfileType(value, divotStart(), divotEnd());
+    } else if (m_assignmentTarget->isBracketAccessorNode()) {
+        BracketAccessorNode* lhs = static_cast<BracketAccessorNode*>(m_assignmentTarget);
+        RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(lhs->base(), true, false);
+        RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(lhs->subscript(), true, false);
+        generator.emitExpressionInfo(divotEnd(), divotStart(), divotEnd());
+        if (lhs->base()->isSuperNode()) {
+            RefPtr<RegisterID> thisValue = generator.ensureThis();
+            generator.emitPutByVal(base.get(), thisValue.get(), property.get(), value);
+        } else
+            generator.emitPutByVal(base.get(), property.get(), value);
+        generator.emitProfileType(value, divotStart(), divotEnd());
+    }
+}
+
+void AssignmentElementNode::toString(StringBuilder& builder) const
+{
+    if (m_assignmentTarget->isResolveNode())
+        builder.append(static_cast<ResolveNode*>(m_assignmentTarget)->identifier().string());
+}
+
+void RestParameterNode::collectBoundIdentifiers(Vector<Identifier>& identifiers) const
+{
+    m_pattern->collectBoundIdentifiers(identifiers);
+}
+
+void RestParameterNode::toString(StringBuilder& builder) const
+{
+    builder.appendLiteral("...");
+    m_pattern->toString(builder);
+}
+
+void RestParameterNode::bindValue(BytecodeGenerator&, RegisterID*) const
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void RestParameterNode::emit(BytecodeGenerator& generator)
+{
+    RefPtr<RegisterID> temp = generator.newTemporary();
+    generator.emitRestParameter(temp.get(), m_numParametersToSkip);
+    m_pattern->bindValue(generator, temp.get());
+}
+
+
+RegisterID* SpreadExpressionNode::emitBytecode(BytecodeGenerator&, RegisterID*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+} // namespace JSC
diff --git a/bytecompiler/RegisterID.h b/bytecompiler/RegisterID.h
new file mode 100644
index 0000000..cc80f5e
--- /dev/null
+++ b/bytecompiler/RegisterID.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "VirtualRegister.h"
+
+#include <wtf/Assertions.h>
+#include <wtf/VectorTraits.h>
+
+namespace JSC {
+
+    class RegisterID {
+        WTF_MAKE_NONCOPYABLE(RegisterID);
+    public:
+        RegisterID()
+            : m_refCount(0)
+            , m_isTemporary(false)
+#ifndef NDEBUG
+            , m_didSetIndex(false)
+#endif
+        {
+        }
+
+        RegisterID(VirtualRegister virtualRegister)
+            : m_refCount(0)
+            , m_virtualRegister(virtualRegister)
+            , m_isTemporary(false)
+#ifndef NDEBUG
+            , m_didSetIndex(true)
+#endif
+        {
+        }
+        
+        explicit RegisterID(int index)
+            : m_refCount(0)
+            , m_virtualRegister(VirtualRegister(index))
+            , m_isTemporary(false)
+#ifndef NDEBUG
+            , m_didSetIndex(true)
+#endif
+        {
+        }
+
+        void setIndex(int index)
+        {
+#ifndef NDEBUG
+            m_didSetIndex = true;
+#endif
+            m_virtualRegister = VirtualRegister(index);
+        }
+
+        void setTemporary()
+        {
+            m_isTemporary = true;
+        }
+
+        int index() const
+        {
+            ASSERT(m_didSetIndex);
+            return m_virtualRegister.offset();
+        }
+
+        VirtualRegister virtualRegister() const
+        {
+            ASSERT(m_virtualRegister.isValid());
+            return m_virtualRegister;
+        }
+
+        bool isTemporary()
+        {
+            return m_isTemporary;
+        }
+
+        void ref()
+        {
+            ++m_refCount;
+        }
+
+        void deref()
+        {
+            --m_refCount;
+            ASSERT(m_refCount >= 0);
+        }
+
+        int refCount() const
+        {
+            return m_refCount;
+        }
+
+    private:
+
+        int m_refCount;
+        VirtualRegister m_virtualRegister;
+        bool m_isTemporary;
+#ifndef NDEBUG
+        bool m_didSetIndex;
+#endif
+    };
+
+} // namespace JSC
+
+namespace WTF {
+
+    template<> struct VectorTraits<JSC::RegisterID> : VectorTraitsBase<true, JSC::RegisterID> {
+        static const bool needsInitialization = true;
+        static const bool canInitializeWithMemset = true; // Default initialization just sets everything to 0 or false, so this is safe.
+    };
+
+} // namespace WTF
diff --git a/bytecompiler/StaticPropertyAnalysis.h b/bytecompiler/StaticPropertyAnalysis.h
new file mode 100644
index 0000000..d11be1a
--- /dev/null
+++ b/bytecompiler/StaticPropertyAnalysis.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSGlobalObject.h"
+#include <wtf/HashSet.h>
+
+namespace JSC {
+
+// Reference count indicates number of live registers that alias this object.
+class StaticPropertyAnalysis : public RefCounted<StaticPropertyAnalysis> {
+public:
+    static Ref<StaticPropertyAnalysis> create(Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>* instructions, unsigned target)
+    {
+        return adoptRef(*new StaticPropertyAnalysis(instructions, target)); 
+    }
+
+    void addPropertyIndex(unsigned propertyIndex) { m_propertyIndexes.add(propertyIndex); }
+
+    void record()
+    {
+        (*m_instructions)[m_target] = m_propertyIndexes.size();
+    }
+
+    int propertyIndexCount() { return m_propertyIndexes.size(); }
+
+private:
+    StaticPropertyAnalysis(Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>* instructions, unsigned target)
+        : m_instructions(instructions)
+        , m_target(target)
+    {
+    }
+
+    Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>* m_instructions;
+    unsigned m_target;
+    typedef HashSet<unsigned, WTF::IntHash<unsigned>, WTF::UnsignedWithZeroKeyHashTraits<unsigned>> PropertyIndexSet;
+    PropertyIndexSet m_propertyIndexes;
+};
+
+} // namespace JSC
diff --git a/bytecompiler/StaticPropertyAnalyzer.h b/bytecompiler/StaticPropertyAnalyzer.h
new file mode 100644
index 0000000..cc3b1e4
--- /dev/null
+++ b/bytecompiler/StaticPropertyAnalyzer.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "StaticPropertyAnalysis.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+// Used for flow-insensitive static analysis of the number of properties assigned to an object.
+// We use this analysis with other runtime data to produce an optimization guess. This analysis
+// is understood to be lossy, and it's OK if it turns out to be wrong sometimes.
+class StaticPropertyAnalyzer {
+public:
+    StaticPropertyAnalyzer(Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>*);
+
+    void createThis(int dst, unsigned offsetOfInlineCapacityOperand);
+    void newObject(int dst, unsigned offsetOfInlineCapacityOperand);
+    void putById(int dst, unsigned propertyIndex); // propertyIndex is an index into a uniqued set of strings.
+    void mov(int dst, int src);
+
+    void kill();
+    void kill(int dst);
+
+private:
+    void kill(StaticPropertyAnalysis*);
+
+    Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>* m_instructions;
+    typedef HashMap<int, RefPtr<StaticPropertyAnalysis>, WTF::IntHash<int>, WTF::UnsignedWithZeroKeyHashTraits<int>> AnalysisMap;
+    AnalysisMap m_analyses;
+};
+
+inline StaticPropertyAnalyzer::StaticPropertyAnalyzer(Vector<UnlinkedInstruction, 0, UnsafeVectorOverflow>* instructions)
+    : m_instructions(instructions)
+{
+}
+
+inline void StaticPropertyAnalyzer::createThis(int dst, unsigned offsetOfInlineCapacityOperand)
+{
+    AnalysisMap::AddResult addResult = m_analyses.add(
+        dst, StaticPropertyAnalysis::create(m_instructions, offsetOfInlineCapacityOperand));
+    ASSERT_UNUSED(addResult, addResult.isNewEntry); // Can't have two 'this' in the same constructor.
+}
+
+inline void StaticPropertyAnalyzer::newObject(int dst, unsigned offsetOfInlineCapacityOperand)
+{
+    RefPtr<StaticPropertyAnalysis> analysis = StaticPropertyAnalysis::create(m_instructions, offsetOfInlineCapacityOperand);
+    AnalysisMap::AddResult addResult = m_analyses.add(dst, analysis);
+    if (!addResult.isNewEntry) {
+        kill(addResult.iterator->value.get());
+        addResult.iterator->value = WTFMove(analysis);
+    }
+}
+
+inline void StaticPropertyAnalyzer::putById(int dst, unsigned propertyIndex)
+{
+    StaticPropertyAnalysis* analysis = m_analyses.get(dst);
+    if (!analysis)
+        return;
+    analysis->addPropertyIndex(propertyIndex);
+}
+
+inline void StaticPropertyAnalyzer::mov(int dst, int src)
+{
+    RefPtr<StaticPropertyAnalysis> analysis = m_analyses.get(src);
+    if (!analysis) {
+        kill(dst);
+        return;
+    }
+
+    AnalysisMap::AddResult addResult = m_analyses.add(dst, analysis);
+    if (!addResult.isNewEntry) {
+        kill(addResult.iterator->value.get());
+        addResult.iterator->value = WTFMove(analysis);
+    }
+}
+
+inline void StaticPropertyAnalyzer::kill(StaticPropertyAnalysis* analysis)
+{
+    if (!analysis)
+        return;
+    if (!analysis->hasOneRef()) // Aliases for this object still exist, so it might acquire more properties.
+        return;
+    analysis->record();
+}
+
+inline void StaticPropertyAnalyzer::kill(int dst)
+{
+    // We observe kills in order to avoid piling on properties to an object after
+    // its bytecode register has been recycled.
+
+    // Consider these cases:
+
+    // (1) Aliased temporary
+    // var o1 = { name: name };
+    // var o2 = { name: name };
+
+    // (2) Aliased local -- no control flow
+    // var local;
+    // local = new Object;
+    // local.name = name;
+    // ...
+
+    // local = lookup();
+    // local.didLookup = true;
+    // ...
+
+    // (3) Aliased local -- control flow
+    // var local;
+    // if (condition)
+    //     local = { };
+    // else {
+    //     local = new Object;
+    // }
+    // local.name = name;
+
+    // (Note: our default codegen for "new Object" looks like case (3).)
+
+    // Case (1) is easy because temporaries almost never survive across control flow.
+
+    // Cases (2) and (3) are hard. Case (2) should kill "local", while case (3) should
+    // not. There is no great way to solve these cases with simple static analysis.
+
+    // Since this is a simple static analysis, we just try to catch the simplest cases,
+    // so we accept kills to any registers except for registers that have no inferred
+    // properties yet.
+
+    AnalysisMap::iterator it = m_analyses.find(dst);
+    if (it == m_analyses.end())
+        return;
+    if (!it->value->propertyIndexCount())
+        return;
+
+    kill(it->value.get());
+    m_analyses.remove(it);
+}
+
+inline void StaticPropertyAnalyzer::kill()
+{
+    while (m_analyses.size())
+        kill(m_analyses.take(m_analyses.begin()->key).get());
+}
+
+} // namespace JSC
diff --git a/config.h b/config.h
new file mode 100644
index 0000000..bea1bf0
--- /dev/null
+++ b/config.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#if defined(HAVE_CONFIG_H) && HAVE_CONFIG_H && defined(BUILDING_WITH_CMAKE)
+#include "cmakeconfig.h"
+#endif
+
+#include <wtf/Platform.h>
+#include <wtf/ExportMacros.h>
+#if !defined(BUILDING_WTF)
+#include "JSExportMacros.h"
+#endif
+
+#if OS(WINDOWS)
+
+#ifndef _WIN32_WINNT
+#define _WIN32_WINNT 0x601
+#endif
+
+#ifndef WINVER
+#define WINVER 0x0601
+#endif
+
+#if !COMPILER(MSVC7_OR_LOWER)
+// We need to define this before the first #include of stdlib.h or it won't contain rand_s.
+#ifndef _CRT_RAND_S
+#define _CRT_RAND_S
+#endif
+#endif // !COMPILER(MSVC7_OR_LOWER
+
+#endif // OS(WINDOWS)
+
+#ifdef __cplusplus
+#undef new
+#undef delete
+#include <wtf/FastMalloc.h>
+#endif
+
+#include <wtf/DisallowCType.h>
+
+#if COMPILER(MSVC)
+#define SKIP_STATIC_CONSTRUCTORS_ON_MSVC 1
+#else
+#define SKIP_STATIC_CONSTRUCTORS_ON_GCC 1
+#endif
+
diff --git a/create_hash_table b/create_hash_table
new file mode 100755
index 0000000..28df6e7
--- /dev/null
+++ b/create_hash_table
@@ -0,0 +1,355 @@
+#! /usr/bin/perl -w
+#
+# Static Hashtable Generator
+#
+# (c) 2000-2002 by Harri Porten <porten@kde.org> and
+#                  David Faure <faure@kde.org>
+# Modified (c) 2004 by Nikolas Zimmermann <wildfox@kde.org>
+# Copyright (C) 2007, 2008, 2009, 2015-2016 Apple Inc. All rights reserved.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+#
+ 
+use strict;
+use Getopt::Long qw(:config pass_through);
+
+my $file = shift @ARGV or die("Must provide source file as final argument.");
+
+open(IN, $file) or die "No such file $file";
+
+my @keys = ();
+my @attrs = ();
+my @values = ();
+my @hashes = ();
+my @table = ();
+my @links = ();
+
+my $hasSetter = "false";
+
+my $includeBuiltin = 0;
+my $inside = 0;
+my $name;
+my $pefectHashSize;
+my $compactSize;
+my $compactHashSizeMask;
+my $banner = 0;
+sub calcPerfectHashSize();
+sub calcCompactHashSize();
+sub output();
+sub jsc_ucfirst($);
+sub hashValue($);
+
+while (<IN>) {
+    chomp;
+    s/^\s+//;
+    next if /^\#|^$/; # Comment or blank line. Do nothing.
+    if (/^\@begin/ && !$inside) {
+        if (/^\@begin\s*([:_\w]+)\s*\d*\s*$/) {
+            $inside = 1;
+            $name = $1;
+        } else {
+            print STDERR "WARNING: \@begin without table name, skipping $_\n";
+        }
+    } elsif (/^\@end\s*$/ && $inside) {
+        calcPerfectHashSize();
+        calcCompactHashSize();
+        output();
+
+        @keys = ();
+        @attrs = ();
+        @values = ();
+        @hashes = ();
+        @table = ();
+        @links = ();
+        $includeBuiltin = 0;
+
+        $inside = 0;
+    } elsif (/^(\S+)\s*(\S+)\s*([\w\|]*)\s*(\w*)\s*$/ && $inside) {
+        my $key = $1;
+        my $val = $2;
+        my $att = $3;
+        my $param = $4;
+
+        push(@keys, $key);
+        push(@attrs, length($att) > 0 ? $att : "0");
+
+        if ($val eq "JSBuiltin") {
+            $includeBuiltin = 1;
+        }
+
+        if ($att =~ m/Function/) {
+            push(@values, { "type" => "Function", "function" => $val, "params" => (length($param) ? $param : "") });
+            #printf STDERR "WARNING: Number of arguments missing for $key/$val\n" if (length($param) == 0);
+        } elsif ($att =~ m/Accessor/) {
+            my $get = $val;
+            my $put = "nullptr";
+            $hasSetter = "true";
+            push(@values, { "type" => "Accessor", "get" => $get, "put" => $put });
+        } elsif ($att =~ m/CellProperty/) {
+            my $property = $val;
+            push(@values, { "type" => "CellProperty", "property" => $property });
+        } elsif ($att =~ m/ClassStructure/) {
+            my $property = $val;
+            push(@values, { "type" => "ClassStructure", "property" => $property });
+        } elsif ($att =~ m/PropertyCallback/) {
+            my $cback = $val;
+            push(@values, { "type" => "PropertyCallback", "cback" => $cback });
+        } elsif (length($att)) {
+            my $get = $val;
+            my $put = "0";
+            if (!($att =~ m/ReadOnly/)) {
+                $put = "set" . jsc_ucfirst($val);
+            }
+            $hasSetter = "true";
+            push(@values, { "type" => "Property", "get" => $get, "put" => $put });
+        } else {
+            push(@values, { "type" => "Lexer", "value" => $val });        
+        }
+        push(@hashes, hashValue($key));
+    } elsif ($inside) {
+        die "invalid data {" . $_ . "}";
+    }
+}
+
+die "missing closing \@end" if ($inside);
+
+sub jsc_ucfirst($)
+{
+    my ($value) = @_;
+
+    if ($value =~ /js/) {
+        $value =~ s/js/JS/;
+        return $value;
+    }
+
+    return ucfirst($value);
+}
+
+
+sub ceilingToPowerOf2
+{
+    my ($pefectHashSize) = @_;
+
+    my $powerOf2 = 1;
+    while ($pefectHashSize > $powerOf2) {
+        $powerOf2 <<= 1;
+    }
+
+    return $powerOf2;
+}
+
+sub calcPerfectHashSize()
+{
+tableSizeLoop:
+    for ($pefectHashSize = ceilingToPowerOf2(scalar @keys); ; $pefectHashSize += $pefectHashSize) {
+        my @table = ();
+        foreach my $key (@keys) {
+            my $h = hashValue($key) % $pefectHashSize;
+            next tableSizeLoop if $table[$h];
+            $table[$h] = 1;
+        }
+        last;
+    }
+}
+
+sub leftShift($$) {
+    my ($value, $distance) = @_;
+    return (($value << $distance) & 0xFFFFFFFF);
+}
+
+sub calcCompactHashSize()
+{
+    my $compactHashSize = ceilingToPowerOf2(2 * @keys);
+    $compactHashSizeMask = $compactHashSize - 1;
+    $compactSize = $compactHashSize;
+    my $collisions = 0;
+    my $maxdepth = 0;
+    my $i = 0;
+    foreach my $key (@keys) {
+        my $depth = 0;
+        my $h = hashValue($key) % $compactHashSize;
+        while (defined($table[$h])) {
+            if (defined($links[$h])) {
+                $h = $links[$h];
+                $depth++;
+            } else {
+                $collisions++;
+                $links[$h] = $compactSize;
+                $h = $compactSize;
+                $compactSize++;
+            }
+        }
+        $table[$h] = $i;
+        $i++;
+        $maxdepth = $depth if ( $depth > $maxdepth);
+    }
+}
+
+# Paul Hsieh's SuperFastHash
+# http://www.azillionmonkeys.com/qed/hash.html
+sub hashValue($) {
+  my @chars = split(/ */, $_[0]);
+
+  # This hash is designed to work on 16-bit chunks at a time. But since the normal case
+  # (above) is to hash UTF-16 characters, we just treat the 8-bit chars as if they
+  # were 16-bit chunks, which should give matching results
+
+  my $EXP2_32 = 4294967296;
+
+  my $hash = 0x9e3779b9;
+  my $l    = scalar @chars; #I wish this was in Ruby --- Maks
+  my $rem  = $l & 1;
+  $l = $l >> 1;
+
+  my $s = 0;
+
+  # Main loop
+  for (; $l > 0; $l--) {
+    $hash   += ord($chars[$s]);
+    my $tmp = leftShift(ord($chars[$s+1]), 11) ^ $hash;
+    $hash   = (leftShift($hash, 16)% $EXP2_32) ^ $tmp;
+    $s += 2;
+    $hash += $hash >> 11;
+    $hash %= $EXP2_32;
+  }
+
+  # Handle end case
+  if ($rem != 0) {
+    $hash += ord($chars[$s]);
+    $hash ^= (leftShift($hash, 11)% $EXP2_32);
+    $hash += $hash >> 17;
+  }
+
+  # Force "avalanching" of final 127 bits
+  $hash ^= leftShift($hash, 3);
+  $hash += ($hash >> 5);
+  $hash = ($hash% $EXP2_32);
+  $hash ^= (leftShift($hash, 2)% $EXP2_32);
+  $hash += ($hash >> 15);
+  $hash = $hash% $EXP2_32;
+  $hash ^= (leftShift($hash, 10)% $EXP2_32);
+
+  # Save 8 bits for StringImpl to use as flags.
+  $hash &= 0xffffff;
+
+  # This avoids ever returning a hash code of 0, since that is used to
+  # signal "hash not computed yet". Setting the high bit maintains
+  # reasonable fidelity to a hash code of 0 because it is likely to yield
+  # exactly 0 when hash lookup masks out the high bits.
+  $hash = (0x80000000 >> 8) if ($hash == 0);
+
+  return $hash;
+}
+
+sub output() {
+    if (!$banner) {
+        $banner = 1;
+        print "// Automatically generated from $file using $0. DO NOT EDIT!\n";
+    }
+
+    my $nameEntries = "${name}Values";
+    $nameEntries =~ s/:/_/g;
+    my $nameIndex = "${name}Index";
+    $nameIndex =~ s/:/_/g;
+
+    print "\n";
+    print "#include \"JSCBuiltins.h\"\n" if ($includeBuiltin);
+    print "#include \"Lookup.h\"\n";
+    print "\n";
+    print "namespace JSC {\n";
+    print "\n";
+    if ($compactSize != 0) {
+        print "static const struct CompactHashIndex ${nameIndex}\[$compactSize\] = {\n";
+        for (my $i = 0; $i < $compactSize; $i++) {
+            my $T = -1;
+            if (defined($table[$i])) { $T = $table[$i]; }
+            my $L = -1;
+            if (defined($links[$i])) { $L = $links[$i]; }
+            print "    { $T, $L },\n";
+        }
+    } else {
+        # MSVC dislikes empty arrays.
+        print "static const struct CompactHashIndex ${nameIndex}\[1\] = {\n";
+        print "    { 0, 0 }\n";
+    }
+    print "};\n";
+    print "\n";
+
+    my $packedSize = scalar @keys;
+    if ($packedSize != 0) {
+        print "static const struct HashTableValue ${nameEntries}\[$packedSize\] = {\n";
+    } else {
+        # MSVC dislikes empty arrays.
+        print "static const struct HashTableValue ${nameEntries}\[1\] = {\n";
+        print "    { nullptr, 0, NoIntrinsic, { 0, 0 } }\n";
+    }
+    my $i = 0;
+    foreach my $key (@keys) {
+        my $firstValue = "";
+        my $secondValue = "";
+        my $firstCastStr = "";
+        my $secondCastStr = "";
+
+        if ($values[$i]{"type"} eq "Function") {
+            $firstCastStr = "static_cast<NativeFunction>";
+            $firstValue = $values[$i]{"function"};
+            $secondValue = $values[$i]{"params"};
+        } elsif ($values[$i]{"type"} eq "Accessor") {
+            $firstCastStr = "static_cast<NativeFunction>";
+            $secondCastStr = "static_cast<NativeFunction>";
+            $firstValue = $values[$i]{"get"};
+            $secondValue = $values[$i]{"put"};
+        } elsif ($values[$i]{"type"} eq "Property") {
+            $firstCastStr = "static_cast<PropertySlot::GetValueFunc>";
+            $secondCastStr = "static_cast<PutPropertySlot::PutValueFunc>";
+            $firstValue = $values[$i]{"get"};
+            $secondValue = $values[$i]{"put"};
+        } elsif ($values[$i]{"type"} eq "Lexer") {
+            $firstValue = $values[$i]{"value"};
+            $secondValue = "0";
+        } elsif ($values[$i]{"type"} eq "CellProperty" || $values[$i]{"type"} eq "ClassStructure") {
+            $values[$i]{"property"} =~ /\A([a-zA-Z0-9_]+)::(.*)\Z/ or die;
+            $firstValue = "OBJECT_OFFSETOF($1, $2)";
+            $secondValue = "0";
+        } elsif ($values[$i]{"type"} eq "PropertyCallback") {
+            $firstCastStr = "static_cast<LazyPropertyCallback>";
+            $firstValue = $values[$i]{"cback"};
+            $secondValue = "0";
+        }
+
+        my $intrinsic = "NoIntrinsic";
+        $intrinsic = "FromCharCodeIntrinsic" if ($key eq "fromCharCode");
+        if ($name eq "arrayPrototypeTable") {
+            $intrinsic = "ArrayPushIntrinsic" if ($key eq "push");
+            $intrinsic = "ArrayPopIntrinsic" if ($key eq "pop");
+        }
+
+        if ($values[$i]{"type"} eq "Function" && $firstValue eq "JSBuiltin")  {
+            my $tableHead = $name;
+            $tableHead =~ s/Table$//;
+            print "   { \"$key\", (($attrs[$i]) & ~Function) | Builtin, $intrinsic, { (intptr_t)static_cast<BuiltinGenerator>(" . $tableHead . ucfirst($key) . "CodeGenerator), (intptr_t)$secondValue } },\n";
+        }
+        else {
+            print "   { \"$key\", $attrs[$i], $intrinsic, { (intptr_t)" . $firstCastStr . "($firstValue), (intptr_t)" . $secondCastStr . "($secondValue) } },\n";
+        }
+        $i++;
+    }
+    print "};\n";
+    print "\n";
+    print "static const struct HashTable $name =\n";
+    print "    \{ $packedSize, $compactHashSizeMask, $hasSetter, $nameEntries, $nameIndex \};\n";
+    print "\n";
+    print "} // namespace JSC\n";
+}
diff --git a/create_regex_tables b/create_regex_tables
new file mode 100644
index 0000000..11a683a
--- /dev/null
+++ b/create_regex_tables
@@ -0,0 +1,123 @@
+# Copyright (C) 2010, 2013 Apple Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+# 
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+import sys
+
+types = {
+    "wordchar": { "UseTable" : True, "data": ['_', ('0','9'), ('A', 'Z'), ('a','z')]},
+    "wordUnicodeIgnoreCaseChar": { "UseTable" : False, "data": ['_', ('0', '9'), ('A', 'Z'), ('a', 'z'), 0x017f, 0x212a]},
+    "nonwordchar": { "UseTable" : True, "Inverse": "wordchar", "data": ['`', (0, ord('0') - 1), (ord('9') + 1, ord('A') - 1), (ord('Z') + 1, ord('_') - 1), (ord('z') + 1, 0x10ffff)]},
+    "nonwordUnicodeIgnoreCaseChar": { "UseTable" : False, "Inverse": "wordUnicodeIgnoreCaseChar", "data": ['`', (0, ord('0') - 1), (ord('9') + 1, ord('A') - 1), (ord('Z') + 1, ord('_') - 1), (ord('z') + 1, 0x017e), (0x0180, 0x2129), (0x212b, 0x10ffff)]},
+    "newline": { "UseTable" : False, "data": ['\n', '\r', 0x2028, 0x2029]},
+    "spaces": { "UseTable" : True, "data": [' ', ('\t', '\r'), 0xa0, 0x1680, 0x180e, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000, (0x2000, 0x200a), 0xfeff]},
+    "nonspaces": { "UseTable" : True, "Inverse": "spaces", "data": [(0, ord('\t') - 1), (ord('\r') + 1, ord(' ') - 1), (ord(' ') + 1, 0x009f), (0x00a1, 0x167f), (0x1681, 0x180d), (0x180f, 0x1fff), (0x200b, 0x2027), (0x202a, 0x202e), (0x2030, 0x205e), (0x2060, 0x2fff), (0x3001, 0xfefe), (0xff00, 0x10ffff)]},
+    "digits": { "UseTable" : False, "data": [('0', '9')]},
+    "nondigits": { "UseTable" : False, "Inverse": "digits", "data": [(0, ord('0') - 1), (ord('9') + 1, 0x10ffff)] }
+}
+entriesPerLine = 50
+arrays = "";
+functions = "";
+emitTables = (len(sys.argv) < 2 or sys.argv[1] != "--no-tables")
+
+for name, classes in types.items():
+    ranges = [];
+    size = 0;
+    for _class in classes["data"]:
+        if type(_class) == str:
+            ranges.append((ord(_class), ord(_class)))
+        elif type(_class) == int:
+            ranges.append((_class, _class))
+        else:
+            (min, max) = _class;
+            if type(min) == str:
+                min = ord(min)
+            if type(max) == str:
+                max = ord(max)
+            if max > 0x7f and min <= 0x7f:
+                ranges.append((min, 0x7f))
+                min = 0x80
+            ranges.append((min,max))
+    ranges.sort();
+    
+    if emitTables and classes["UseTable"] and (not "Inverse" in classes):
+        array = ("static const char _%sData[65536] = {\n" % name);
+        i = 0
+        for (min,max) in ranges:
+            while i < min:
+                i = i + 1
+                array += ('0,')
+                if (i % entriesPerLine == 0) and (i != 0):
+                    array += ('\n')
+            while i <= max:
+                i = i + 1
+                if (i == 65536):
+                    array += ("1")
+                else:
+                    array += ('1,')
+                if (i % entriesPerLine == 0) and (i != 0):
+                    array += ('\n')
+        while i < 0xffff:
+            array += ("0,")
+            i = i + 1;
+            if (i % entriesPerLine == 0) and (i != 0):
+                array += ('\n')
+        if i == 0xffff:
+            array += ("0")
+        array += ("\n};\n\n");
+        arrays += array
+    
+    # Generate createFunction:
+    function = "";
+    function += ("std::unique_ptr<CharacterClass> %sCreate()\n" % name)
+    function += ("{\n")
+    if emitTables and classes["UseTable"]:
+        if "Inverse" in classes:
+            function += ("    auto characterClass = std::make_unique<CharacterClass>(_%sData, true);\n" % (classes["Inverse"]))
+        else:
+            function += ("    auto characterClass = std::make_unique<CharacterClass>(_%sData, false);\n" % (name))
+    else:
+        function += ("    auto characterClass = std::make_unique<CharacterClass>();\n")
+    for (min, max) in ranges:
+        if (min == max):
+            if (min > 127):
+                function += ("    characterClass->m_matchesUnicode.append(0x%04x);\n" % min)
+            else:
+                function += ("    characterClass->m_matches.append(0x%02x);\n" % min)
+            continue
+        if (min > 127) or (max > 127):
+            function += ("    characterClass->m_rangesUnicode.append(CharacterRange(0x%04x, 0x%04x));\n" % (min, max))
+        else:
+            function += ("    characterClass->m_ranges.append(CharacterRange(0x%02x, 0x%02x));\n" % (min, max))
+    function += ("    return characterClass;\n")
+    function += ("}\n\n")
+    functions += function
+
+if (len(sys.argv) > 1):
+    f = open(sys.argv[-1], "w")
+    f.write(arrays)
+    f.write(functions)
+    f.close()
+else:
+    print(arrays)
+    print(functions)
+
diff --git a/debugger/Breakpoint.h b/debugger/Breakpoint.h
new file mode 100644
index 0000000..c1504a1
--- /dev/null
+++ b/debugger/Breakpoint.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DebuggerPrimitives.h"
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+struct Breakpoint : public DoublyLinkedListNode<Breakpoint> {
+    Breakpoint()
+    {
+    }
+
+    Breakpoint(SourceID sourceID, unsigned line, unsigned column, const String& condition, bool autoContinue, unsigned ignoreCount)
+        : sourceID(sourceID)
+        , line(line)
+        , column(column)
+        , condition(condition)
+        , autoContinue(autoContinue)
+        , ignoreCount(ignoreCount)
+    {
+    }
+
+    Breakpoint(const Breakpoint& other)
+        : id(other.id)
+        , sourceID(other.sourceID)
+        , line(other.line)
+        , column(other.column)
+        , condition(other.condition)
+        , autoContinue(other.autoContinue)
+        , ignoreCount(other.ignoreCount)
+        , hitCount(other.hitCount)
+        , resolved(other.resolved)
+    {
+    }
+
+    BreakpointID id { noBreakpointID };
+    SourceID sourceID { noSourceID };
+    unsigned line { 0 };
+    unsigned column { 0 };
+    String condition;
+    bool autoContinue { false };
+    unsigned ignoreCount { 0 };
+    unsigned hitCount { 0 };
+    bool resolved { false };
+
+    static const unsigned unspecifiedColumn = UINT_MAX;
+
+private:
+    Breakpoint* m_prev;
+    Breakpoint* m_next;
+
+    friend class WTF::DoublyLinkedListNode<Breakpoint>;
+};
+
+class BreakpointsList : public DoublyLinkedList<Breakpoint>,
+    public RefCounted<BreakpointsList> {
+public:
+    ~BreakpointsList()
+    {
+        Breakpoint* breakpoint;
+        while ((breakpoint = removeHead()))
+            delete breakpoint;
+        ASSERT(isEmpty());
+    }
+};
+
+} // namespace JSC
diff --git a/debugger/Debugger.cpp b/debugger/Debugger.cpp
new file mode 100644
index 0000000..30bba59
--- /dev/null
+++ b/debugger/Debugger.cpp
@@ -0,0 +1,932 @@
+/*
+ *  Copyright (C) 2008, 2013, 2014, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "Debugger.h"
+
+#include "CodeBlock.h"
+#include "DebuggerCallFrame.h"
+#include "Error.h"
+#include "HeapIterationScope.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSCJSValueInlines.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "MarkedSpaceInlines.h"
+#include "Parser.h"
+#include "Protect.h"
+
+namespace {
+
+using namespace JSC;
+
+struct GatherSourceProviders : public MarkedBlock::VoidFunctor {
+    // FIXME: This is a mutable field because this isn't a C++ lambda.
+    // https://bugs.webkit.org/show_bug.cgi?id=159644
+    mutable HashSet<SourceProvider*> sourceProviders;
+    JSGlobalObject* m_globalObject;
+
+    GatherSourceProviders(JSGlobalObject* globalObject)
+        : m_globalObject(globalObject) { }
+
+    IterationStatus operator()(HeapCell* heapCell, HeapCell::Kind kind) const
+    {
+        if (kind != HeapCell::JSCell)
+            return IterationStatus::Continue;
+        
+        JSCell* cell = static_cast<JSCell*>(heapCell);
+        
+        JSFunction* function = jsDynamicCast<JSFunction*>(cell);
+        if (!function)
+            return IterationStatus::Continue;
+
+        if (function->scope()->globalObject() != m_globalObject)
+            return IterationStatus::Continue;
+
+        if (!function->executable()->isFunctionExecutable())
+            return IterationStatus::Continue;
+
+        if (function->isHostOrBuiltinFunction())
+            return IterationStatus::Continue;
+
+        sourceProviders.add(
+            jsCast<FunctionExecutable*>(function->executable())->source().provider());
+        return IterationStatus::Continue;
+    }
+};
+
+} // namespace
+
+namespace JSC {
+
+class DebuggerPausedScope {
+public:
+    DebuggerPausedScope(Debugger& debugger)
+        : m_debugger(debugger)
+    {
+        ASSERT(!m_debugger.m_currentDebuggerCallFrame);
+    }
+
+    ~DebuggerPausedScope()
+    {
+        if (m_debugger.m_currentDebuggerCallFrame) {
+            m_debugger.m_currentDebuggerCallFrame->invalidate();
+            m_debugger.m_currentDebuggerCallFrame = nullptr;
+        }
+    }
+
+private:
+    Debugger& m_debugger;
+};
+
+// This is very similar to SetForScope<bool>, but that cannot be used
+// as the m_isPaused field uses only one bit.
+class TemporaryPausedState {
+public:
+    TemporaryPausedState(Debugger& debugger)
+        : m_debugger(debugger)
+    {
+        ASSERT(!m_debugger.m_isPaused);
+        m_debugger.m_isPaused = true;
+    }
+
+    ~TemporaryPausedState()
+    {
+        m_debugger.m_isPaused = false;
+    }
+
+private:
+    Debugger& m_debugger;
+};
+
+Debugger::Debugger(VM& vm)
+    : m_vm(vm)
+    , m_pauseOnExceptionsState(DontPauseOnExceptions)
+    , m_pauseAtNextOpportunity(false)
+    , m_pastFirstExpressionInStatement(false)
+    , m_isPaused(false)
+    , m_breakpointsActivated(false)
+    , m_hasHandlerForExceptionCallback(false)
+    , m_suppressAllPauses(false)
+    , m_steppingMode(SteppingModeDisabled)
+    , m_reasonForPause(NotPaused)
+    , m_lastExecutedLine(UINT_MAX)
+    , m_lastExecutedSourceID(noSourceID)
+    , m_topBreakpointID(noBreakpointID)
+    , m_pausingBreakpointID(noBreakpointID)
+{
+}
+
+Debugger::~Debugger()
+{
+    HashSet<JSGlobalObject*>::iterator end = m_globalObjects.end();
+    for (HashSet<JSGlobalObject*>::iterator it = m_globalObjects.begin(); it != end; ++it)
+        (*it)->setDebugger(nullptr);
+}
+
+void Debugger::attach(JSGlobalObject* globalObject)
+{
+    ASSERT(!globalObject->debugger());
+    globalObject->setDebugger(this);
+    m_globalObjects.add(globalObject);
+
+    m_vm.setShouldBuildPCToCodeOriginMapping();
+
+    // Call sourceParsed because it will execute JavaScript in the inspector.
+    GatherSourceProviders gatherSourceProviders(globalObject);
+    {
+        HeapIterationScope iterationScope(m_vm.heap);
+        m_vm.heap.objectSpace().forEachLiveCell(iterationScope, gatherSourceProviders);
+    }
+    for (auto* sourceProvider : gatherSourceProviders.sourceProviders)
+        sourceParsed(globalObject->globalExec(), sourceProvider, -1, String());
+}
+
+void Debugger::detach(JSGlobalObject* globalObject, ReasonForDetach reason)
+{
+    // If we're detaching from the currently executing global object, manually tear down our
+    // stack, since we won't get further debugger callbacks to do so. Also, resume execution,
+    // since there's no point in staying paused once a window closes.
+    if (m_isPaused && m_currentCallFrame && m_currentCallFrame->vmEntryGlobalObject() == globalObject) {
+        m_currentCallFrame = nullptr;
+        m_pauseOnCallFrame = nullptr;
+        continueProgram();
+    }
+
+    ASSERT(m_globalObjects.contains(globalObject));
+    m_globalObjects.remove(globalObject);
+
+    // If the globalObject is destructing, then its CodeBlocks will also be
+    // destructed. There is no need to do the debugger requests clean up, and
+    // it is not safe to access those CodeBlocks at this time anyway.
+    if (reason != GlobalObjectIsDestructing)
+        clearDebuggerRequests(globalObject);
+
+    globalObject->setDebugger(nullptr);
+
+    if (m_globalObjects.isEmpty())
+        clearParsedData();
+}
+
+bool Debugger::isAttached(JSGlobalObject* globalObject)
+{
+    return globalObject->debugger() == this;
+}
+
+class Debugger::SetSteppingModeFunctor {
+public:
+    SetSteppingModeFunctor(Debugger* debugger, SteppingMode mode)
+        : m_debugger(debugger)
+        , m_mode(mode)
+    {
+    }
+
+    bool operator()(CodeBlock* codeBlock) const
+    {
+        if (m_debugger == codeBlock->globalObject()->debugger()) {
+            if (m_mode == SteppingModeEnabled)
+                codeBlock->setSteppingMode(CodeBlock::SteppingModeEnabled);
+            else
+                codeBlock->setSteppingMode(CodeBlock::SteppingModeDisabled);
+        }
+        return false;
+    }
+
+private:
+    Debugger* m_debugger;
+    SteppingMode m_mode;
+};
+
+void Debugger::setSteppingMode(SteppingMode mode)
+{
+    if (mode == m_steppingMode)
+        return;
+
+    m_vm.heap.completeAllJITPlans();
+
+    m_steppingMode = mode;
+    SetSteppingModeFunctor functor(this, mode);
+    m_vm.heap.forEachCodeBlock(functor);
+}
+
+void Debugger::registerCodeBlock(CodeBlock* codeBlock)
+{
+    applyBreakpoints(codeBlock);
+    if (isStepping())
+        codeBlock->setSteppingMode(CodeBlock::SteppingModeEnabled);
+}
+
+void Debugger::setProfilingClient(ProfilingClient* client)
+{
+    ASSERT(!!m_profilingClient != !!client);
+    m_profilingClient = client;
+}
+
+double Debugger::willEvaluateScript()
+{
+    return m_profilingClient->willEvaluateScript();
+}
+
+void Debugger::didEvaluateScript(double startTime, ProfilingReason reason)
+{
+    m_profilingClient->didEvaluateScript(startTime, reason);
+}
+
+void Debugger::toggleBreakpoint(CodeBlock* codeBlock, Breakpoint& breakpoint, BreakpointState enabledOrNot)
+{
+    ASSERT(breakpoint.resolved);
+
+    ScriptExecutable* executable = codeBlock->ownerScriptExecutable();
+
+    SourceID sourceID = static_cast<SourceID>(executable->sourceID());
+    if (breakpoint.sourceID != sourceID)
+        return;
+
+    unsigned line = breakpoint.line;
+    unsigned column = breakpoint.column;
+
+    unsigned startLine = executable->firstLine();
+    unsigned startColumn = executable->startColumn();
+    unsigned endLine = executable->lastLine();
+    unsigned endColumn = executable->endColumn();
+
+    // Inspector breakpoint line and column values are zero-based but the executable
+    // and CodeBlock line and column values are one-based.
+    line += 1;
+    column = column ? column + 1 : Breakpoint::unspecifiedColumn;
+
+    if (line < startLine || line > endLine)
+        return;
+    if (column != Breakpoint::unspecifiedColumn) {
+        if (line == startLine && column < startColumn)
+            return;
+        if (line == endLine && column > endColumn)
+            return;
+    }
+
+    if (!codeBlock->hasOpDebugForLineAndColumn(line, column))
+        return;
+
+    if (enabledOrNot == BreakpointEnabled)
+        codeBlock->addBreakpoint(1);
+    else
+        codeBlock->removeBreakpoint(1);
+}
+
+void Debugger::applyBreakpoints(CodeBlock* codeBlock)
+{
+    BreakpointIDToBreakpointMap& breakpoints = m_breakpointIDToBreakpoint;
+    for (auto it = breakpoints.begin(); it != breakpoints.end(); ++it) {
+        Breakpoint& breakpoint = *it->value;
+        toggleBreakpoint(codeBlock, breakpoint, BreakpointEnabled);
+    }
+}
+
+class Debugger::ToggleBreakpointFunctor {
+public:
+    ToggleBreakpointFunctor(Debugger* debugger, Breakpoint& breakpoint, BreakpointState enabledOrNot)
+        : m_debugger(debugger)
+        , m_breakpoint(breakpoint)
+        , m_enabledOrNot(enabledOrNot)
+    {
+    }
+
+    bool operator()(CodeBlock* codeBlock) const
+    {
+        if (m_debugger == codeBlock->globalObject()->debugger())
+            m_debugger->toggleBreakpoint(codeBlock, m_breakpoint, m_enabledOrNot);
+        return false;
+    }
+
+private:
+    Debugger* m_debugger;
+    Breakpoint& m_breakpoint;
+    BreakpointState m_enabledOrNot;
+};
+
+void Debugger::toggleBreakpoint(Breakpoint& breakpoint, Debugger::BreakpointState enabledOrNot)
+{
+    m_vm.heap.completeAllJITPlans();
+
+    ToggleBreakpointFunctor functor(this, breakpoint, enabledOrNot);
+    m_vm.heap.forEachCodeBlock(functor);
+}
+
+void Debugger::recompileAllJSFunctions()
+{
+    m_vm.deleteAllCode(PreventCollectionAndDeleteAllCode);
+}
+
+DebuggerParseData& Debugger::debuggerParseData(SourceID sourceID, SourceProvider* provider)
+{
+    auto iter = m_parseDataMap.find(sourceID);
+    if (iter != m_parseDataMap.end())
+        return iter->value;
+
+    DebuggerParseData parseData;
+    gatherDebuggerParseDataForSource(m_vm, provider, parseData);
+    auto result = m_parseDataMap.add(sourceID, parseData);
+    return result.iterator->value;
+}
+
+void Debugger::resolveBreakpoint(Breakpoint& breakpoint, SourceProvider* sourceProvider)
+{
+    RELEASE_ASSERT(!breakpoint.resolved);
+    ASSERT(breakpoint.sourceID != noSourceID);
+
+    // FIXME: <https://webkit.org/b/162771> Web Inspector: Adopt TextPosition in Inspector to avoid oneBasedInt/zeroBasedInt ambiguity
+    // Inspector breakpoint line and column values are zero-based but the executable
+    // and CodeBlock line and column values are one-based.
+    unsigned line = breakpoint.line + 1;
+    unsigned column = breakpoint.column ? breakpoint.column : Breakpoint::unspecifiedColumn;
+
+    DebuggerParseData& parseData = debuggerParseData(breakpoint.sourceID, sourceProvider);
+    std::optional<JSTextPosition> resolvedPosition = parseData.pausePositions.breakpointLocationForLineColumn((int)line, (int)column);
+    if (!resolvedPosition)
+        return;
+
+    unsigned resolvedLine = resolvedPosition->line;
+    unsigned resolvedColumn = resolvedPosition->offset - resolvedPosition->lineStartOffset + 1;
+
+    breakpoint.line = resolvedLine - 1;
+    breakpoint.column = resolvedColumn - 1;
+    breakpoint.resolved = true;
+}
+
+BreakpointID Debugger::setBreakpoint(Breakpoint& breakpoint, bool& existing)
+{
+    ASSERT(breakpoint.resolved);
+    ASSERT(breakpoint.sourceID != noSourceID);
+
+    SourceID sourceID = breakpoint.sourceID;
+    unsigned line = breakpoint.line;
+    unsigned column = breakpoint.column;
+
+    SourceIDToBreakpointsMap::iterator it = m_sourceIDToBreakpoints.find(breakpoint.sourceID);
+    if (it == m_sourceIDToBreakpoints.end())
+        it = m_sourceIDToBreakpoints.set(sourceID, LineToBreakpointsMap()).iterator;
+
+    LineToBreakpointsMap::iterator breaksIt = it->value.find(line);
+    if (breaksIt == it->value.end())
+        breaksIt = it->value.set(line, adoptRef(new BreakpointsList)).iterator;
+
+    BreakpointsList& breakpoints = *breaksIt->value;
+    for (Breakpoint* current = breakpoints.head(); current; current = current->next()) {
+        if (current->column == column) {
+            // Found existing breakpoint. Do not create a duplicate at this location.
+            existing = true;
+            return current->id;
+        }
+    }
+
+    existing = false;
+    BreakpointID id = ++m_topBreakpointID;
+    RELEASE_ASSERT(id != noBreakpointID);
+
+    breakpoint.id = id;
+
+    Breakpoint* newBreakpoint = new Breakpoint(breakpoint);
+    breakpoints.append(newBreakpoint);
+    m_breakpointIDToBreakpoint.set(id, newBreakpoint);
+
+    toggleBreakpoint(*newBreakpoint, BreakpointEnabled);
+
+    return id;
+}
+
+void Debugger::removeBreakpoint(BreakpointID id)
+{
+    ASSERT(id != noBreakpointID);
+
+    BreakpointIDToBreakpointMap::iterator idIt = m_breakpointIDToBreakpoint.find(id);
+    ASSERT(idIt != m_breakpointIDToBreakpoint.end());
+    Breakpoint* breakpoint = idIt->value;
+
+    SourceID sourceID = breakpoint->sourceID;
+    ASSERT(sourceID);
+    SourceIDToBreakpointsMap::iterator it = m_sourceIDToBreakpoints.find(sourceID);
+    ASSERT(it != m_sourceIDToBreakpoints.end());
+    LineToBreakpointsMap::iterator breaksIt = it->value.find(breakpoint->line);
+    ASSERT(breaksIt != it->value.end());
+
+    toggleBreakpoint(*breakpoint, BreakpointDisabled);
+
+    BreakpointsList& breakpoints = *breaksIt->value;
+#if !ASSERT_DISABLED
+    bool found = false;
+    for (Breakpoint* current = breakpoints.head(); current && !found; current = current->next()) {
+        if (current->id == breakpoint->id)
+            found = true;
+    }
+    ASSERT(found);
+#endif
+
+    m_breakpointIDToBreakpoint.remove(idIt);
+    breakpoints.remove(breakpoint);
+    delete breakpoint;
+
+    if (breakpoints.isEmpty()) {
+        it->value.remove(breaksIt);
+        if (it->value.isEmpty())
+            m_sourceIDToBreakpoints.remove(it);
+    }
+}
+
+bool Debugger::hasBreakpoint(SourceID sourceID, const TextPosition& position, Breakpoint *hitBreakpoint)
+{
+    if (!m_breakpointsActivated)
+        return false;
+
+    SourceIDToBreakpointsMap::const_iterator it = m_sourceIDToBreakpoints.find(sourceID);
+    if (it == m_sourceIDToBreakpoints.end())
+        return false;
+
+    unsigned line = position.m_line.zeroBasedInt();
+    unsigned column = position.m_column.zeroBasedInt();
+    
+    LineToBreakpointsMap::const_iterator breaksIt = it->value.find(line);
+    if (breaksIt == it->value.end())
+        return false;
+
+    bool hit = false;
+    const BreakpointsList& breakpoints = *breaksIt->value;
+    Breakpoint* breakpoint;
+    for (breakpoint = breakpoints.head(); breakpoint; breakpoint = breakpoint->next()) {
+        unsigned breakLine = breakpoint->line;
+        unsigned breakColumn = breakpoint->column;
+        // Since frontend truncates the indent, the first statement in a line must match the breakpoint (line,0).
+        ASSERT(this == m_currentCallFrame->codeBlock()->globalObject()->debugger());
+        if ((line != m_lastExecutedLine && line == breakLine && !breakColumn)
+            || (line == breakLine && column == breakColumn)) {
+            hit = true;
+            break;
+        }
+    }
+    if (!hit)
+        return false;
+
+    if (hitBreakpoint)
+        *hitBreakpoint = *breakpoint;
+
+    breakpoint->hitCount++;
+    if (breakpoint->ignoreCount >= breakpoint->hitCount)
+        return false;
+
+    if (breakpoint->condition.isEmpty())
+        return true;
+
+    // We cannot stop in the debugger while executing condition code,
+    // so make it looks like the debugger is already paused.
+    TemporaryPausedState pausedState(*this);
+
+    NakedPtr<Exception> exception;
+    DebuggerCallFrame* debuggerCallFrame = currentDebuggerCallFrame();
+    JSObject* scopeExtensionObject = nullptr;
+    JSValue result = debuggerCallFrame->evaluateWithScopeExtension(breakpoint->condition, scopeExtensionObject, exception);
+
+    // We can lose the debugger while executing JavaScript.
+    if (!m_currentCallFrame)
+        return false;
+
+    if (exception) {
+        // An erroneous condition counts as "false".
+        handleExceptionInBreakpointCondition(m_currentCallFrame, exception);
+        return false;
+    }
+
+    return result.toBoolean(m_currentCallFrame);
+}
+
+class Debugger::ClearCodeBlockDebuggerRequestsFunctor {
+public:
+    ClearCodeBlockDebuggerRequestsFunctor(Debugger* debugger)
+        : m_debugger(debugger)
+    {
+    }
+
+    bool operator()(CodeBlock* codeBlock) const
+    {
+        if (codeBlock->hasDebuggerRequests() && m_debugger == codeBlock->globalObject()->debugger())
+            codeBlock->clearDebuggerRequests();
+        return false;
+    }
+
+private:
+    Debugger* m_debugger;
+};
+
+void Debugger::clearBreakpoints()
+{
+    m_vm.heap.completeAllJITPlans();
+
+    m_topBreakpointID = noBreakpointID;
+    m_breakpointIDToBreakpoint.clear();
+    m_sourceIDToBreakpoints.clear();
+
+    ClearCodeBlockDebuggerRequestsFunctor functor(this);
+    m_vm.heap.forEachCodeBlock(functor);
+}
+
+class Debugger::ClearDebuggerRequestsFunctor {
+public:
+    ClearDebuggerRequestsFunctor(JSGlobalObject* globalObject)
+        : m_globalObject(globalObject)
+    {
+    }
+
+    bool operator()(CodeBlock* codeBlock) const
+    {
+        if (codeBlock->hasDebuggerRequests() && m_globalObject == codeBlock->globalObject())
+            codeBlock->clearDebuggerRequests();
+        return false;
+    }
+
+private:
+    JSGlobalObject* m_globalObject;
+};
+
+void Debugger::clearDebuggerRequests(JSGlobalObject* globalObject)
+{
+    m_vm.heap.completeAllJITPlans();
+
+    ClearDebuggerRequestsFunctor functor(globalObject);
+    m_vm.heap.forEachCodeBlock(functor);
+}
+
+void Debugger::clearParsedData()
+{
+    m_parseDataMap.clear();
+}
+
+void Debugger::setBreakpointsActivated(bool activated)
+{
+    if (activated == m_breakpointsActivated)
+        return;
+
+    m_breakpointsActivated = activated;
+    recompileAllJSFunctions();
+}
+
+void Debugger::setPauseOnExceptionsState(PauseOnExceptionsState pause)
+{
+    m_pauseOnExceptionsState = pause;
+}
+
+void Debugger::setPauseOnNextStatement(bool pause)
+{
+    m_pauseAtNextOpportunity = pause;
+    if (pause)
+        setSteppingMode(SteppingModeEnabled);
+}
+
+void Debugger::breakProgram()
+{
+    if (m_isPaused)
+        return;
+
+    if (!m_vm.topCallFrame)
+        return;
+
+    m_pauseAtNextOpportunity = true;
+    setSteppingMode(SteppingModeEnabled);
+    m_currentCallFrame = m_vm.topCallFrame;
+    pauseIfNeeded(m_currentCallFrame);
+}
+
+void Debugger::continueProgram()
+{
+    if (!m_isPaused)
+        return;
+
+    m_pauseAtNextOpportunity = false;
+    notifyDoneProcessingDebuggerEvents();
+}
+
+void Debugger::stepIntoStatement()
+{
+    if (!m_isPaused)
+        return;
+
+    m_pauseAtNextOpportunity = true;
+    setSteppingMode(SteppingModeEnabled);
+    notifyDoneProcessingDebuggerEvents();
+}
+
+void Debugger::stepOverStatement()
+{
+    if (!m_isPaused)
+        return;
+
+    m_pauseOnCallFrame = m_currentCallFrame;
+    setSteppingMode(SteppingModeEnabled);
+    notifyDoneProcessingDebuggerEvents();
+}
+
+void Debugger::stepOutOfFunction()
+{
+    if (!m_isPaused)
+        return;
+
+    VMEntryFrame* topVMEntryFrame = m_vm.topVMEntryFrame;
+    m_pauseOnCallFrame = m_currentCallFrame ? m_currentCallFrame->callerFrame(topVMEntryFrame) : nullptr;
+    m_pauseOnStepOut = true;
+    setSteppingMode(SteppingModeEnabled);
+    notifyDoneProcessingDebuggerEvents();
+}
+
+void Debugger::updateCallFrame(CallFrame* callFrame, CallFrameUpdateAction action)
+{
+    if (!callFrame) {
+        m_currentCallFrame = nullptr;
+        return;
+    }
+
+    updateCallFrameInternal(callFrame);
+
+    if (action == AttemptPause)
+        pauseIfNeeded(callFrame);
+
+    if (!isStepping())
+        m_currentCallFrame = nullptr;
+}
+
+void Debugger::updateCallFrameInternal(CallFrame* callFrame)
+{
+    m_currentCallFrame = callFrame;
+    SourceID sourceID = DebuggerCallFrame::sourceIDForCallFrame(callFrame);
+    if (m_lastExecutedSourceID != sourceID) {
+        m_lastExecutedLine = UINT_MAX;
+        m_lastExecutedSourceID = sourceID;
+    }
+}
+
+void Debugger::pauseIfNeeded(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (m_isPaused)
+        return;
+
+    if (m_suppressAllPauses)
+        return;
+
+    intptr_t sourceID = DebuggerCallFrame::sourceIDForCallFrame(m_currentCallFrame);
+    if (isBlacklisted(sourceID))
+        return;
+
+    DebuggerPausedScope debuggerPausedScope(*this);
+
+    bool pauseNow = m_pauseAtNextOpportunity;
+    pauseNow |= (m_pauseOnCallFrame == m_currentCallFrame);
+
+    bool didPauseForStep = pauseNow;
+    bool didHitBreakpoint = false;
+
+    Breakpoint breakpoint;
+    TextPosition position = DebuggerCallFrame::positionForCallFrame(m_currentCallFrame);
+    pauseNow |= didHitBreakpoint = hasBreakpoint(sourceID, position, &breakpoint);
+    m_lastExecutedLine = position.m_line.zeroBasedInt();
+    if (!pauseNow)
+        return;
+
+    clearNextPauseState();
+
+    // Make sure we are not going to pause again on breakpoint actions by
+    // reseting the pause state before executing any breakpoint actions.
+    TemporaryPausedState pausedState(*this);
+
+    JSGlobalObject* vmEntryGlobalObject = callFrame->vmEntryGlobalObject();
+
+    if (didHitBreakpoint) {
+        handleBreakpointHit(vmEntryGlobalObject, breakpoint);
+        // Note that the actions can potentially stop the debugger, so we need to check that
+        // we still have a current call frame when we get back.
+        if (!m_currentCallFrame)
+            return;
+
+        if (breakpoint.autoContinue) {
+            if (!didPauseForStep)
+                return;
+            didHitBreakpoint = false;
+        } else
+            m_pausingBreakpointID = breakpoint.id;
+    }
+
+    {
+        PauseReasonDeclaration reason(*this, didHitBreakpoint ? PausedForBreakpoint : m_reasonForPause);
+        handlePause(vmEntryGlobalObject, m_reasonForPause);
+        RELEASE_ASSERT(!scope.exception());
+    }
+
+    m_pausingBreakpointID = noBreakpointID;
+
+    if (!m_pauseAtNextOpportunity && !m_pauseOnCallFrame) {
+        setSteppingMode(SteppingModeDisabled);
+        m_currentCallFrame = nullptr;
+    }
+}
+
+void Debugger::exception(CallFrame* callFrame, JSValue exception, bool hasCatchHandler)
+{
+    if (m_isPaused)
+        return;
+
+    PauseReasonDeclaration reason(*this, PausedForException);
+    if (m_pauseOnExceptionsState == PauseOnAllExceptions || (m_pauseOnExceptionsState == PauseOnUncaughtExceptions && !hasCatchHandler)) {
+        m_pauseAtNextOpportunity = true;
+        setSteppingMode(SteppingModeEnabled);
+    }
+
+    m_hasHandlerForExceptionCallback = true;
+    m_currentException = exception;
+    updateCallFrame(callFrame, AttemptPause);
+    m_currentException = JSValue();
+    m_hasHandlerForExceptionCallback = false;
+}
+
+void Debugger::atStatement(CallFrame* callFrame)
+{
+    if (m_isPaused)
+        return;
+
+    m_pastFirstExpressionInStatement = false;
+
+    PauseReasonDeclaration reason(*this, PausedAtStatement);
+    updateCallFrame(callFrame, AttemptPause);
+}
+
+void Debugger::atExpression(CallFrame* callFrame)
+{
+    if (m_isPaused)
+        return;
+
+    // If this is the first call in a statement, then we would have paused at the statement.
+    if (!m_pastFirstExpressionInStatement) {
+        m_pastFirstExpressionInStatement = true;
+        return;
+    }
+
+    // Only pause at the next expression with step-in and step-out, not step-over.
+    bool shouldAttemptPause = m_pauseAtNextOpportunity || m_pauseOnStepOut;
+
+    PauseReasonDeclaration reason(*this, PausedAtExpression);
+    updateCallFrame(callFrame, shouldAttemptPause ? AttemptPause : NoPause);
+}
+
+void Debugger::callEvent(CallFrame* callFrame)
+{
+    if (m_isPaused)
+        return;
+
+    updateCallFrame(callFrame, NoPause);
+}
+
+void Debugger::returnEvent(CallFrame* callFrame)
+{
+    if (m_isPaused)
+        return;
+
+    {
+        PauseReasonDeclaration reason(*this, PausedBeforeReturn);
+        updateCallFrame(callFrame, AttemptPause);
+    }
+
+    // Detach may have been called during pauseIfNeeded.
+    if (!m_currentCallFrame)
+        return;
+
+    VMEntryFrame* topVMEntryFrame = m_vm.topVMEntryFrame;
+    CallFrame* callerFrame = m_currentCallFrame->callerFrame(topVMEntryFrame);
+
+    // Returning from a call, there was at least one expression on the statement we are returning to.
+    m_pastFirstExpressionInStatement = true;
+
+    // Treat stepping over a return statement like a step-out.
+    if (m_currentCallFrame == m_pauseOnCallFrame) {
+        m_pauseOnCallFrame = callerFrame;
+        m_pauseOnStepOut = true;
+    }
+
+    updateCallFrame(callerFrame, NoPause);
+}
+
+void Debugger::unwindEvent(CallFrame* callFrame)
+{
+    if (m_isPaused)
+        return;
+
+    updateCallFrame(callFrame, NoPause);
+
+    if (!m_currentCallFrame)
+        return;
+
+    VMEntryFrame* topVMEntryFrame = m_vm.topVMEntryFrame;
+    CallFrame* callerFrame = m_currentCallFrame->callerFrame(topVMEntryFrame);
+
+    // Treat stepping over an exception location like a step-out.
+    if (m_currentCallFrame == m_pauseOnCallFrame)
+        m_pauseOnCallFrame = callerFrame;
+
+    updateCallFrame(callerFrame, NoPause);
+}
+
+void Debugger::willExecuteProgram(CallFrame* callFrame)
+{
+    if (m_isPaused)
+        return;
+
+    updateCallFrame(callFrame, NoPause);
+}
+
+void Debugger::didExecuteProgram(CallFrame* callFrame)
+{
+    if (m_isPaused)
+        return;
+
+    PauseReasonDeclaration reason(*this, PausedAtEndOfProgram);
+    updateCallFrame(callFrame, AttemptPause);
+
+    // Detach may have been called during pauseIfNeeded.
+    if (!m_currentCallFrame)
+        return;
+
+    VMEntryFrame* topVMEntryFrame = m_vm.topVMEntryFrame;
+    CallFrame* callerFrame = m_currentCallFrame->callerFrame(topVMEntryFrame);
+
+    // Returning from a program, could be eval(), there was at least one expression on the statement we are returning to.
+    m_pastFirstExpressionInStatement = true;
+
+    // Treat stepping over the end of a program like a step-out.
+    if (m_currentCallFrame == m_pauseOnCallFrame) {
+        m_pauseOnCallFrame = callerFrame;
+        m_pauseAtNextOpportunity = true;
+    }
+
+    updateCallFrame(callerFrame, NoPause);
+
+    // Do not continue stepping into an unknown future program.
+    if (!m_currentCallFrame)
+        clearNextPauseState();
+}
+
+void Debugger::clearNextPauseState()
+{
+    m_pauseOnCallFrame = nullptr;
+    m_pauseAtNextOpportunity = false;
+    m_pauseOnStepOut = false;
+}
+
+void Debugger::didReachBreakpoint(CallFrame* callFrame)
+{
+    if (m_isPaused)
+        return;
+
+    PauseReasonDeclaration reason(*this, PausedForDebuggerStatement);
+    m_pauseAtNextOpportunity = true;
+    setSteppingMode(SteppingModeEnabled);
+    updateCallFrame(callFrame, AttemptPause);
+}
+
+DebuggerCallFrame* Debugger::currentDebuggerCallFrame()
+{
+    if (!m_currentDebuggerCallFrame)
+        m_currentDebuggerCallFrame = DebuggerCallFrame::create(m_currentCallFrame);
+    return m_currentDebuggerCallFrame.get();
+}
+
+bool Debugger::isBlacklisted(SourceID sourceID) const
+{
+    return m_blacklistedScripts.contains(sourceID);
+}
+
+void Debugger::addToBlacklist(SourceID sourceID)
+{
+    m_blacklistedScripts.add(sourceID);
+}
+
+void Debugger::clearBlacklist()
+{
+    m_blacklistedScripts.clear();
+}
+
+} // namespace JSC
diff --git a/debugger/Debugger.h b/debugger/Debugger.h
new file mode 100644
index 0000000..72200a8
--- /dev/null
+++ b/debugger/Debugger.h
@@ -0,0 +1,257 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2008, 2009, 2013, 2014 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "Breakpoint.h"
+#include "CallData.h"
+#include "DebuggerCallFrame.h"
+#include "DebuggerParseData.h"
+#include "DebuggerPrimitives.h"
+#include "JSCJSValue.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/TextPosition.h>
+
+namespace JSC {
+
+class CodeBlock;
+class Exception;
+class ExecState;
+class JSGlobalObject;
+class SourceProvider;
+class VM;
+
+typedef ExecState CallFrame;
+
+class JS_EXPORT_PRIVATE Debugger {
+public:
+    Debugger(VM&);
+    virtual ~Debugger();
+
+    VM& vm() { return m_vm; }
+
+    JSC::DebuggerCallFrame* currentDebuggerCallFrame();
+    bool hasHandlerForExceptionCallback() const
+    {
+        ASSERT(m_reasonForPause == PausedForException);
+        return m_hasHandlerForExceptionCallback;
+    }
+    JSValue currentException()
+    {
+        ASSERT(m_reasonForPause == PausedForException);
+        return m_currentException;
+    }
+
+    bool needsExceptionCallbacks() const { return m_breakpointsActivated && m_pauseOnExceptionsState != DontPauseOnExceptions; }
+    bool isInteractivelyDebugging() const { return m_breakpointsActivated; }
+
+    enum ReasonForDetach {
+        TerminatingDebuggingSession,
+        GlobalObjectIsDestructing
+    };
+    void attach(JSGlobalObject*);
+    void detach(JSGlobalObject*, ReasonForDetach);
+    bool isAttached(JSGlobalObject*);
+
+    void resolveBreakpoint(Breakpoint&, SourceProvider*);
+    BreakpointID setBreakpoint(Breakpoint&, bool& existing);
+    void removeBreakpoint(BreakpointID);
+    void clearBreakpoints();
+
+    void activateBreakpoints() { setBreakpointsActivated(true); }
+    void deactivateBreakpoints() { setBreakpointsActivated(false); }
+    bool breakpointsActive() const { return m_breakpointsActivated; }
+
+    enum PauseOnExceptionsState {
+        DontPauseOnExceptions,
+        PauseOnAllExceptions,
+        PauseOnUncaughtExceptions
+    };
+    PauseOnExceptionsState pauseOnExceptionsState() const { return m_pauseOnExceptionsState; }
+    void setPauseOnExceptionsState(PauseOnExceptionsState);
+
+    enum ReasonForPause {
+        NotPaused,
+        PausedForException,
+        PausedAtStatement,
+        PausedAtExpression,
+        PausedBeforeReturn,
+        PausedAtEndOfProgram,
+        PausedForBreakpoint,
+        PausedForDebuggerStatement,
+    };
+    ReasonForPause reasonForPause() const { return m_reasonForPause; }
+    BreakpointID pausingBreakpointID() const { return m_pausingBreakpointID; }
+
+    void setPauseOnNextStatement(bool);
+    void breakProgram();
+    void continueProgram();
+    void stepIntoStatement();
+    void stepOverStatement();
+    void stepOutOfFunction();
+
+    bool isBlacklisted(SourceID) const;
+    void addToBlacklist(SourceID);
+    void clearBlacklist();
+
+    bool isPaused() const { return m_isPaused; }
+    bool isStepping() const { return m_steppingMode == SteppingModeEnabled; }
+
+    bool suppressAllPauses() const { return m_suppressAllPauses; }
+    void setSuppressAllPauses(bool suppress) { m_suppressAllPauses = suppress; }
+
+    virtual void sourceParsed(ExecState*, SourceProvider*, int errorLineNumber, const WTF::String& errorMessage) = 0;
+
+    void exception(CallFrame*, JSValue exceptionValue, bool hasCatchHandler);
+    void atStatement(CallFrame*);
+    void atExpression(CallFrame*);
+    void callEvent(CallFrame*);
+    void returnEvent(CallFrame*);
+    void unwindEvent(CallFrame*);
+    void willExecuteProgram(CallFrame*);
+    void didExecuteProgram(CallFrame*);
+    void didReachBreakpoint(CallFrame*);
+
+    virtual void recompileAllJSFunctions();
+
+    void registerCodeBlock(CodeBlock*);
+
+    class ProfilingClient {
+    public:
+        virtual ~ProfilingClient() { }
+        virtual bool isAlreadyProfiling() const = 0;
+        virtual double willEvaluateScript() = 0;
+        virtual void didEvaluateScript(double startTime, ProfilingReason) = 0;
+    };
+
+    void setProfilingClient(ProfilingClient*);
+    bool hasProfilingClient() const { return m_profilingClient != nullptr; }
+    bool isAlreadyProfiling() const { return m_profilingClient && m_profilingClient->isAlreadyProfiling(); }
+    double willEvaluateScript();
+    void didEvaluateScript(double startTime, ProfilingReason);
+
+protected:
+    virtual void handleBreakpointHit(JSGlobalObject*, const Breakpoint&) { }
+    virtual void handleExceptionInBreakpointCondition(ExecState*, Exception*) const { }
+    virtual void handlePause(JSGlobalObject*, ReasonForPause) { }
+    virtual void notifyDoneProcessingDebuggerEvents() { }
+
+private:
+    typedef HashMap<BreakpointID, Breakpoint*> BreakpointIDToBreakpointMap;
+
+    typedef HashMap<unsigned, RefPtr<BreakpointsList>, WTF::IntHash<int>, WTF::UnsignedWithZeroKeyHashTraits<int>> LineToBreakpointsMap;
+    typedef HashMap<SourceID, LineToBreakpointsMap, WTF::IntHash<SourceID>, WTF::UnsignedWithZeroKeyHashTraits<SourceID>> SourceIDToBreakpointsMap;
+
+    class ClearCodeBlockDebuggerRequestsFunctor;
+    class ClearDebuggerRequestsFunctor;
+    class SetSteppingModeFunctor;
+    class ToggleBreakpointFunctor;
+
+    class PauseReasonDeclaration {
+    public:
+        PauseReasonDeclaration(Debugger& debugger, ReasonForPause reason)
+            : m_debugger(debugger)
+        {
+            m_debugger.m_reasonForPause = reason;
+        }
+
+        ~PauseReasonDeclaration()
+        {
+            m_debugger.m_reasonForPause = NotPaused;
+        }
+    private:
+        Debugger& m_debugger;
+    };
+
+    bool hasBreakpoint(SourceID, const TextPosition&, Breakpoint* hitBreakpoint);
+
+    DebuggerParseData& debuggerParseData(SourceID, SourceProvider*);
+
+    void updateNeedForOpDebugCallbacks();
+
+    // These update functions are only needed because our current breakpoints are
+    // key'ed off the source position instead of the bytecode PC. This ensures
+    // that we don't break on the same line more than once. Once we switch to a
+    // bytecode PC key'ed breakpoint, we will not need these anymore and should
+    // be able to remove them.
+    enum CallFrameUpdateAction { AttemptPause, NoPause };
+    void updateCallFrame(JSC::CallFrame*, CallFrameUpdateAction);
+    void updateCallFrameInternal(JSC::CallFrame*);
+    void pauseIfNeeded(JSC::CallFrame*);
+    void clearNextPauseState();
+
+    enum SteppingMode {
+        SteppingModeDisabled,
+        SteppingModeEnabled
+    };
+    void setSteppingMode(SteppingMode);
+
+    enum BreakpointState {
+        BreakpointDisabled,
+        BreakpointEnabled
+    };
+    void setBreakpointsActivated(bool);
+    void toggleBreakpoint(CodeBlock*, Breakpoint&, BreakpointState);
+    void applyBreakpoints(CodeBlock*);
+    void toggleBreakpoint(Breakpoint&, BreakpointState);
+
+    void clearDebuggerRequests(JSGlobalObject*);
+    void clearParsedData();
+
+    VM& m_vm;
+    HashSet<JSGlobalObject*> m_globalObjects;
+    HashMap<SourceID, DebuggerParseData, WTF::IntHash<SourceID>, WTF::UnsignedWithZeroKeyHashTraits<SourceID>> m_parseDataMap;
+    HashSet<SourceID, WTF::IntHash<SourceID>, WTF::UnsignedWithZeroKeyHashTraits<SourceID>> m_blacklistedScripts;
+
+    PauseOnExceptionsState m_pauseOnExceptionsState;
+    bool m_pauseAtNextOpportunity : 1;
+    bool m_pauseOnStepOut : 1;
+    bool m_pastFirstExpressionInStatement : 1;
+    bool m_isPaused : 1;
+    bool m_breakpointsActivated : 1;
+    bool m_hasHandlerForExceptionCallback : 1;
+    bool m_suppressAllPauses : 1;
+    unsigned m_steppingMode : 1; // SteppingMode
+
+    ReasonForPause m_reasonForPause;
+    JSValue m_currentException;
+    CallFrame* m_pauseOnCallFrame { nullptr };
+    CallFrame* m_currentCallFrame { nullptr };
+    unsigned m_lastExecutedLine;
+    SourceID m_lastExecutedSourceID;
+
+    BreakpointID m_topBreakpointID;
+    BreakpointID m_pausingBreakpointID;
+    BreakpointIDToBreakpointMap m_breakpointIDToBreakpoint;
+    SourceIDToBreakpointsMap m_sourceIDToBreakpoints;
+
+    RefPtr<JSC::DebuggerCallFrame> m_currentDebuggerCallFrame;
+
+    ProfilingClient* m_profilingClient { nullptr };
+
+    friend class DebuggerPausedScope;
+    friend class TemporaryPausedState;
+    friend class LLIntOffsetsExtractor;
+};
+
+} // namespace JSC
diff --git a/debugger/DebuggerCallFrame.cpp b/debugger/DebuggerCallFrame.cpp
new file mode 100644
index 0000000..ff0241a
--- /dev/null
+++ b/debugger/DebuggerCallFrame.cpp
@@ -0,0 +1,318 @@
+/*
+ * Copyright (C) 2008, 2013-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DebuggerCallFrame.h"
+
+#include "CodeBlock.h"
+#include "DebuggerEvalEnabler.h"
+#include "DebuggerScope.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSLexicalEnvironment.h"
+#include "JSWithScope.h"
+#include "Parser.h"
+#include "ShadowChickenInlines.h"
+#include "StackVisitor.h"
+#include "StrongInlines.h"
+
+namespace JSC {
+
+class LineAndColumnFunctor {
+public:
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        visitor->computeLineAndColumn(m_line, m_column);
+        return StackVisitor::Done;
+    }
+
+    unsigned line() const { return m_line; }
+    unsigned column() const { return m_column; }
+
+private:
+    mutable unsigned m_line;
+    mutable unsigned m_column;
+};
+
+Ref<DebuggerCallFrame> DebuggerCallFrame::create(CallFrame* callFrame)
+{
+    if (UNLIKELY(callFrame == callFrame->lexicalGlobalObject()->globalExec())) {
+        ShadowChicken::Frame emptyFrame;
+        RELEASE_ASSERT(!emptyFrame.isTailDeleted);
+        return adoptRef(*new DebuggerCallFrame(callFrame, emptyFrame));
+    }
+
+    Vector<ShadowChicken::Frame> frames;
+    callFrame->vm().shadowChicken().iterate(callFrame->vm(), callFrame, [&] (const ShadowChicken::Frame& frame) -> bool {
+        frames.append(frame);
+        return true;
+    });
+
+    RELEASE_ASSERT(frames.size());
+    ASSERT(!frames[0].isTailDeleted); // The top frame should never be tail deleted.
+
+    RefPtr<DebuggerCallFrame> currentParent = nullptr;
+    ExecState* exec = callFrame->lexicalGlobalObject()->globalExec();
+    // This walks the stack from the entry stack frame to the top of the stack.
+    for (unsigned i = frames.size(); i--; ) {
+        const ShadowChicken::Frame& frame = frames[i];
+        if (!frame.isTailDeleted)
+            exec = frame.frame;
+        Ref<DebuggerCallFrame> currentFrame = adoptRef(*new DebuggerCallFrame(exec, frame));
+        currentFrame->m_caller = currentParent;
+        currentParent = WTFMove(currentFrame);
+    }
+    return *currentParent;
+}
+
+DebuggerCallFrame::DebuggerCallFrame(CallFrame* callFrame, const ShadowChicken::Frame& frame)
+    : m_validMachineFrame(callFrame)
+    , m_shadowChickenFrame(frame)
+{
+    m_position = currentPosition();
+}
+
+RefPtr<DebuggerCallFrame> DebuggerCallFrame::callerFrame()
+{
+    ASSERT(isValid());
+    if (!isValid())
+        return nullptr;
+
+    return m_caller;
+}
+
+ExecState* DebuggerCallFrame::globalExec()
+{
+    return scope()->globalObject()->globalExec();
+}
+
+JSC::JSGlobalObject* DebuggerCallFrame::vmEntryGlobalObject() const
+{
+    ASSERT(isValid());
+    if (!isValid())
+        return nullptr;
+    return m_validMachineFrame->vmEntryGlobalObject();
+}
+
+SourceID DebuggerCallFrame::sourceID() const
+{
+    ASSERT(isValid());
+    if (!isValid())
+        return noSourceID;
+    if (isTailDeleted())
+        return m_shadowChickenFrame.codeBlock->ownerScriptExecutable()->sourceID();
+    return sourceIDForCallFrame(m_validMachineFrame);
+}
+
+String DebuggerCallFrame::functionName() const
+{
+    ASSERT(isValid());
+    if (!isValid())
+        return String();
+
+    if (isTailDeleted()) {
+        if (JSFunction* func = jsDynamicCast<JSFunction*>(m_shadowChickenFrame.callee))
+            return func->calculatedDisplayName(m_validMachineFrame->vm());
+        return m_shadowChickenFrame.codeBlock->inferredName().data();
+    }
+
+    return m_validMachineFrame->friendlyFunctionName();
+}
+
+DebuggerScope* DebuggerCallFrame::scope()
+{
+    ASSERT(isValid());
+    if (!isValid())
+        return nullptr;
+
+    if (!m_scope) {
+        VM& vm = m_validMachineFrame->vm();
+        JSScope* scope;
+        CodeBlock* codeBlock = m_validMachineFrame->codeBlock();
+        if (isTailDeleted())
+            scope = m_shadowChickenFrame.scope;
+        else if (codeBlock && codeBlock->scopeRegister().isValid())
+            scope = m_validMachineFrame->scope(codeBlock->scopeRegister().offset());
+        else if (JSCallee* callee = jsDynamicCast<JSCallee*>(m_validMachineFrame->jsCallee()))
+            scope = callee->scope();
+        else
+            scope = m_validMachineFrame->lexicalGlobalObject()->globalLexicalEnvironment();
+
+        m_scope.set(vm, DebuggerScope::create(vm, scope));
+    }
+    return m_scope.get();
+}
+
+DebuggerCallFrame::Type DebuggerCallFrame::type() const
+{
+    ASSERT(isValid());
+    if (!isValid())
+        return ProgramType;
+
+    if (isTailDeleted())
+        return FunctionType;
+
+    if (jsDynamicCast<JSFunction*>(m_validMachineFrame->jsCallee()))
+        return FunctionType;
+
+    return ProgramType;
+}
+
+JSValue DebuggerCallFrame::thisValue() const
+{
+    ASSERT(isValid());
+    if (!isValid())
+        return jsUndefined();
+
+    CodeBlock* codeBlock = nullptr;
+    JSValue thisValue;
+    if (isTailDeleted()) {
+        thisValue = m_shadowChickenFrame.thisValue;
+        codeBlock = m_shadowChickenFrame.codeBlock;
+    } else {
+        thisValue = m_validMachineFrame->thisValue();
+        codeBlock = m_validMachineFrame->codeBlock();
+    }
+
+    if (!thisValue)
+        return jsUndefined();
+
+    ECMAMode ecmaMode = NotStrictMode;
+    if (codeBlock && codeBlock->isStrictMode())
+        ecmaMode = StrictMode;
+    return thisValue.toThis(m_validMachineFrame, ecmaMode);
+}
+
+// Evaluate some JavaScript code in the scope of this frame.
+JSValue DebuggerCallFrame::evaluateWithScopeExtension(const String& script, JSObject* scopeExtensionObject, NakedPtr<Exception>& exception)
+{
+    ASSERT(isValid());
+    CallFrame* callFrame = m_validMachineFrame;
+    if (!callFrame)
+        return jsUndefined();
+
+    VM& vm = callFrame->vm();
+    JSLockHolder lock(vm);
+    auto catchScope = DECLARE_CATCH_SCOPE(vm);
+
+    CodeBlock* codeBlock = nullptr;
+    if (isTailDeleted())
+        codeBlock = m_shadowChickenFrame.codeBlock;
+    else
+        codeBlock = callFrame->codeBlock();
+    if (!codeBlock)
+        return jsUndefined();
+    
+    DebuggerEvalEnabler evalEnabler(callFrame);
+
+    EvalContextType evalContextType;
+    
+    if (isFunctionParseMode(codeBlock->unlinkedCodeBlock()->parseMode()))
+        evalContextType = EvalContextType::FunctionEvalContext;
+    else if (codeBlock->unlinkedCodeBlock()->codeType() == EvalCode)
+        evalContextType = codeBlock->unlinkedCodeBlock()->evalContextType();
+    else 
+        evalContextType = EvalContextType::None;
+
+    VariableEnvironment variablesUnderTDZ;
+    JSScope::collectClosureVariablesUnderTDZ(scope()->jsScope(), variablesUnderTDZ);
+
+    EvalExecutable* eval = DirectEvalExecutable::create(callFrame, makeSource(script), codeBlock->isStrictMode(), codeBlock->unlinkedCodeBlock()->derivedContextType(), codeBlock->unlinkedCodeBlock()->isArrowFunction(), evalContextType, &variablesUnderTDZ);
+    if (UNLIKELY(catchScope.exception())) {
+        exception = catchScope.exception();
+        catchScope.clearException();
+        return jsUndefined();
+    }
+
+    JSGlobalObject* globalObject = callFrame->vmEntryGlobalObject();
+    if (scopeExtensionObject) {
+        JSScope* ignoredPreviousScope = globalObject->globalScope();
+        globalObject->setGlobalScopeExtension(JSWithScope::create(vm, globalObject, scopeExtensionObject, ignoredPreviousScope));
+    }
+
+    JSValue thisValue = this->thisValue();
+    JSValue result = vm.interpreter->execute(eval, callFrame, thisValue, scope()->jsScope());
+    if (UNLIKELY(catchScope.exception())) {
+        exception = catchScope.exception();
+        catchScope.clearException();
+    }
+
+    if (scopeExtensionObject)
+        globalObject->clearGlobalScopeExtension();
+
+    ASSERT(result);
+    return result;
+}
+
+void DebuggerCallFrame::invalidate()
+{
+    RefPtr<DebuggerCallFrame> frame = this;
+    while (frame) {
+        frame->m_validMachineFrame = nullptr;
+        if (frame->m_scope) {
+            frame->m_scope->invalidateChain();
+            frame->m_scope.clear();
+        }
+        frame = WTFMove(frame->m_caller);
+    }
+}
+
+TextPosition DebuggerCallFrame::currentPosition()
+{
+    if (!m_validMachineFrame)
+        return TextPosition();
+
+    if (isTailDeleted()) {
+        CodeBlock* codeBlock = m_shadowChickenFrame.codeBlock;
+        if (std::optional<unsigned> bytecodeOffset = codeBlock->bytecodeOffsetFromCallSiteIndex(m_shadowChickenFrame.callSiteIndex)) {
+            return TextPosition(OrdinalNumber::fromOneBasedInt(codeBlock->lineNumberForBytecodeOffset(*bytecodeOffset)),
+                OrdinalNumber::fromOneBasedInt(codeBlock->columnNumberForBytecodeOffset(*bytecodeOffset)));
+        }
+    }
+
+    return positionForCallFrame(m_validMachineFrame);
+}
+
+TextPosition DebuggerCallFrame::positionForCallFrame(CallFrame* callFrame)
+{
+    LineAndColumnFunctor functor;
+    callFrame->iterate(functor);
+    return TextPosition(OrdinalNumber::fromOneBasedInt(functor.line()), OrdinalNumber::fromOneBasedInt(functor.column()));
+}
+
+SourceID DebuggerCallFrame::sourceIDForCallFrame(CallFrame* callFrame)
+{
+    ASSERT(callFrame);
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    if (!codeBlock)
+        return noSourceID;
+    return codeBlock->ownerScriptExecutable()->sourceID();
+}
+
+} // namespace JSC
diff --git a/debugger/DebuggerCallFrame.h b/debugger/DebuggerCallFrame.h
new file mode 100644
index 0000000..4624658
--- /dev/null
+++ b/debugger/DebuggerCallFrame.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2008, 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#pragma once
+
+#include "CallFrame.h"
+#include "DebuggerPrimitives.h"
+#include "ShadowChicken.h"
+#include "Strong.h"
+#include <wtf/NakedPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/TextPosition.h>
+
+namespace JSC {
+
+class DebuggerScope;
+class Exception;
+
+class DebuggerCallFrame : public RefCounted<DebuggerCallFrame> {
+public:
+    enum Type { ProgramType, FunctionType };
+
+    static Ref<DebuggerCallFrame> create(CallFrame*);
+
+    JS_EXPORT_PRIVATE RefPtr<DebuggerCallFrame> callerFrame();
+    ExecState* globalExec();
+    JS_EXPORT_PRIVATE SourceID sourceID() const;
+
+    // line and column are in base 0 e.g. the first line is line 0.
+    int line() const { return m_position.m_line.zeroBasedInt(); }
+    int column() const { return m_position.m_column.zeroBasedInt(); }
+    JS_EXPORT_PRIVATE const TextPosition& position() const { return m_position; }
+
+    JS_EXPORT_PRIVATE JSGlobalObject* vmEntryGlobalObject() const;
+    JS_EXPORT_PRIVATE DebuggerScope* scope();
+    JS_EXPORT_PRIVATE String functionName() const;
+    JS_EXPORT_PRIVATE Type type() const;
+    JS_EXPORT_PRIVATE JSValue thisValue() const;
+    JSValue evaluateWithScopeExtension(const String&, JSObject* scopeExtensionObject, NakedPtr<Exception>&);
+
+    bool isValid() const { return !!m_validMachineFrame || isTailDeleted(); }
+    JS_EXPORT_PRIVATE void invalidate();
+
+    // The following are only public for the Debugger's use only. They will be
+    // made private soon. Other clients should not use these.
+
+    JS_EXPORT_PRIVATE TextPosition currentPosition();
+    JS_EXPORT_PRIVATE static TextPosition positionForCallFrame(CallFrame*);
+    JS_EXPORT_PRIVATE static SourceID sourceIDForCallFrame(CallFrame*);
+
+    bool isTailDeleted() const { return m_shadowChickenFrame.isTailDeleted; }
+
+private:
+    DebuggerCallFrame(CallFrame*, const ShadowChicken::Frame&);
+
+    CallFrame* m_validMachineFrame;
+    RefPtr<DebuggerCallFrame> m_caller;
+    TextPosition m_position;
+    // The DebuggerPausedScope is responsible for calling invalidate() which,
+    // in turn, will clear this strong ref.
+    Strong<DebuggerScope> m_scope;
+    ShadowChicken::Frame m_shadowChickenFrame;
+};
+
+} // namespace JSC
diff --git a/debugger/DebuggerEvalEnabler.h b/debugger/DebuggerEvalEnabler.h
new file mode 100644
index 0000000..0e4c4cf
--- /dev/null
+++ b/debugger/DebuggerEvalEnabler.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "JSGlobalObject.h"
+
+namespace JSC {
+
+class DebuggerEvalEnabler {
+public:
+    explicit DebuggerEvalEnabler(const ExecState* exec)
+        : m_exec(exec)
+        , m_evalWasDisabled(false)
+    {
+        if (exec) {
+            JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+            m_evalWasDisabled = !globalObject->evalEnabled();
+            if (m_evalWasDisabled)
+                globalObject->setEvalEnabled(true, globalObject->evalDisabledErrorMessage());
+        }
+    }
+
+    ~DebuggerEvalEnabler()
+    {
+        if (m_evalWasDisabled) {
+            JSGlobalObject* globalObject = m_exec->lexicalGlobalObject();
+            globalObject->setEvalEnabled(false, globalObject->evalDisabledErrorMessage());
+        }
+    }
+
+private:
+    const ExecState* m_exec;
+    bool m_evalWasDisabled;
+};
+
+} // namespace JSC
diff --git a/debugger/DebuggerLocation.cpp b/debugger/DebuggerLocation.cpp
new file mode 100644
index 0000000..b139720
--- /dev/null
+++ b/debugger/DebuggerLocation.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DebuggerLocation.h"
+
+#include "ScriptExecutable.h"
+
+namespace JSC {
+
+DebuggerLocation::DebuggerLocation(ScriptExecutable* executable)
+{
+    if (executable->isHostFunction())
+        return;
+
+    sourceID = executable->sourceID();
+    line = executable->firstLine();
+    column = executable->startColumn();
+    url = executable->sourceURL();
+    if (url.isEmpty())
+        url = executable->source().provider()->sourceURL();
+}
+
+} // namespace JSC
diff --git a/debugger/DebuggerLocation.h b/debugger/DebuggerLocation.h
new file mode 100644
index 0000000..3e1c416
--- /dev/null
+++ b/debugger/DebuggerLocation.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DebuggerPrimitives.h"
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class ScriptExecutable;
+
+struct DebuggerLocation {
+
+    DebuggerLocation() { }
+    DebuggerLocation(const String& url, intptr_t sourceID, unsigned line, unsigned column)
+        : url(url)
+        , sourceID(sourceID)
+        , line(line)
+        , column(column)
+    { }
+
+    DebuggerLocation(ScriptExecutable*);
+
+    String url;
+    intptr_t sourceID { noSourceID };
+    unsigned line { 0 };
+    unsigned column { 0 };
+};
+
+} // namespace JSC
diff --git a/debugger/DebuggerParseData.cpp b/debugger/DebuggerParseData.cpp
new file mode 100644
index 0000000..3b058ba
--- /dev/null
+++ b/debugger/DebuggerParseData.cpp
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DebuggerParseData.h"
+
+#include "Parser.h"
+
+namespace JSC {
+
+std::optional<JSTextPosition> DebuggerPausePositions::breakpointLocationForLineColumn(int line, int column)
+{
+    unsigned start = 0;
+    unsigned end = m_positions.size();
+    while (start != end) {
+        unsigned middle = start + ((end - start) / 2);
+        DebuggerPausePosition& pausePosition = m_positions[middle];
+        int pauseLine = pausePosition.position.line;
+        int pauseColumn = pausePosition.position.offset - pausePosition.position.lineStartOffset;
+
+        if (line < pauseLine) {
+            end = middle;
+            continue;
+        }
+        if (line > pauseLine) {
+            start = middle + 1;
+            continue;
+        }
+
+        if (column == pauseColumn) {
+            // Found an exact position match. Roll forward if this was a function Entry.
+            // We are guarenteed to have a Leave for an Entry so we don't need to bounds check.
+            while (true) {
+                if (pausePosition.type != DebuggerPausePositionType::Enter)
+                    return std::optional<JSTextPosition>(pausePosition.position);
+                pausePosition = m_positions[middle++];
+            }
+        }
+
+        if (column < pauseColumn)
+            end = middle;
+        else
+            start = middle + 1;
+    }
+
+    // Past the end, no possible pause locations.
+    if (start >= m_positions.size())
+        return std::nullopt;
+
+    // If the next location is a function Entry we will need to decide if we should go into
+    // the function or go past the function. We decide to go into the function if the
+    // input is on the same line as the function entry. For example:
+    //
+    //     1. x;
+    //     2.
+    //     3. function foo() {
+    //     4.     x;
+    //     5. }
+    //     6.
+    //     7. x;
+    //
+    // If the input was line 2, skip past functions to pause on line 7.
+    // If the input was line 3, go into the function to pause on line 4.
+
+    // Valid pause location. Use it.
+    DebuggerPausePosition& firstSlidePosition = m_positions[start];
+    if (firstSlidePosition.type != DebuggerPausePositionType::Enter)
+        return std::optional<JSTextPosition>(firstSlidePosition.position);
+
+    // Determine if we should enter this function or skip past it.
+    // If entryStackSize is > 0 we are skipping functions.
+    bool shouldEnterFunction = firstSlidePosition.position.line == line;
+    int entryStackSize = shouldEnterFunction ? 0 : 1;
+    for (unsigned i = start + 1; i < m_positions.size(); ++i) {
+        DebuggerPausePosition& slidePosition = m_positions[i];
+        ASSERT(entryStackSize >= 0);
+
+        // Already skipping functions.
+        if (entryStackSize) {
+            if (slidePosition.type == DebuggerPausePositionType::Enter)
+                entryStackSize++;
+            else if (slidePosition.type == DebuggerPausePositionType::Leave)
+                entryStackSize--;
+            continue;
+        }
+
+        // Start skipping functions.
+        if (slidePosition.type == DebuggerPausePositionType::Enter) {
+            entryStackSize++;
+            continue;
+        }
+
+        // Found pause position.
+        return std::optional<JSTextPosition>(slidePosition.position);
+    }
+
+    // No pause positions found.
+    return std::nullopt;
+}
+
+void DebuggerPausePositions::sort()
+{
+    std::sort(m_positions.begin(), m_positions.end(), [] (const DebuggerPausePosition& a, const DebuggerPausePosition& b) {
+        return a.position.offset < b.position.offset;
+    });
+}
+
+typedef enum { Program, Module } DebuggerParseInfoTag;
+template <DebuggerParseInfoTag T> struct DebuggerParseInfo { };
+
+template <> struct DebuggerParseInfo<Program> {
+    typedef JSC::ProgramNode RootNode;
+    static const SourceParseMode parseMode = SourceParseMode::ProgramMode;
+    static const JSParserStrictMode strictMode = JSParserStrictMode::NotStrict;
+    static const JSParserScriptMode scriptMode = JSParserScriptMode::Classic;
+};
+
+template <> struct DebuggerParseInfo<Module> {
+    typedef JSC::ModuleProgramNode RootNode;
+    static const SourceParseMode parseMode = SourceParseMode::ModuleEvaluateMode;
+    static const JSParserStrictMode strictMode = JSParserStrictMode::Strict;
+    static const JSParserScriptMode scriptMode = JSParserScriptMode::Module;
+};
+
+template <DebuggerParseInfoTag T>
+bool gatherDebuggerParseData(VM& vm, const SourceCode& source, DebuggerParseData& debuggerParseData)
+{
+    typedef typename DebuggerParseInfo<T>::RootNode RootNode;
+    SourceParseMode parseMode = DebuggerParseInfo<T>::parseMode;
+    JSParserStrictMode strictMode = DebuggerParseInfo<T>::strictMode;
+    JSParserScriptMode scriptMode = DebuggerParseInfo<T>::scriptMode;
+
+    ParserError error;
+    std::unique_ptr<RootNode> rootNode = parse<RootNode>(&vm, source, Identifier(),
+        JSParserBuiltinMode::NotBuiltin, strictMode, scriptMode, parseMode, SuperBinding::NotNeeded,
+        error, nullptr, ConstructorKind::None, DerivedContextType::None, EvalContextType::None,
+        &debuggerParseData);
+    if (!rootNode)
+        return false;
+
+    debuggerParseData.pausePositions.sort();
+
+    return true;
+}
+
+bool gatherDebuggerParseDataForSource(VM& vm, SourceProvider* provider, DebuggerParseData& debuggerParseData)
+{
+    int startLine = provider->startPosition().m_line.oneBasedInt();
+    int startColumn = provider->startPosition().m_column.oneBasedInt();
+    SourceCode completeSource(provider, startLine, startColumn);
+
+    switch (provider->sourceType()) {
+    case SourceProviderSourceType::Program:
+        return gatherDebuggerParseData<Program>(vm, completeSource, debuggerParseData);        
+    case SourceProviderSourceType::Module:
+        return gatherDebuggerParseData<Module>(vm, completeSource, debuggerParseData);
+    default:
+        return false;
+    }
+}
+
+} // namespace JSC
diff --git a/debugger/DebuggerParseData.h b/debugger/DebuggerParseData.h
new file mode 100644
index 0000000..ecc78d0
--- /dev/null
+++ b/debugger/DebuggerParseData.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ParserTokens.h"
+#include <wtf/Optional.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class SourceProvider;
+class VM;
+
+enum class DebuggerPausePositionType { Enter, Leave, Pause };
+struct DebuggerPausePosition {
+    DebuggerPausePositionType type;
+    JSTextPosition position;
+};
+
+class DebuggerPausePositions {
+public:
+    DebuggerPausePositions() { }
+    ~DebuggerPausePositions() { }
+
+    void appendPause(const JSTextPosition& position)
+    {
+        m_positions.append({ DebuggerPausePositionType::Pause, position });
+    }
+
+    void appendEntry(const JSTextPosition& position)
+    {
+        m_positions.append({ DebuggerPausePositionType::Enter, position });
+    }
+
+    void appendLeave(const JSTextPosition& position)
+    {
+        m_positions.append({ DebuggerPausePositionType::Leave, position });
+    }
+
+    std::optional<JSTextPosition> breakpointLocationForLineColumn(int line, int column);
+
+    void sort();
+
+private:
+    Vector<DebuggerPausePosition> m_positions;
+};
+
+
+struct DebuggerParseData {
+    DebuggerParseData() { }
+    ~DebuggerParseData() { }
+
+    DebuggerPausePositions pausePositions;
+};
+
+bool gatherDebuggerParseDataForSource(VM&, SourceProvider*, DebuggerParseData&);
+
+} // namespace JSC
diff --git a/debugger/DebuggerPrimitives.h b/debugger/DebuggerPrimitives.h
new file mode 100644
index 0000000..959f8bd
--- /dev/null
+++ b/debugger/DebuggerPrimitives.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <stddef.h>
+
+namespace JSC {
+
+typedef size_t SourceID;
+static const SourceID noSourceID = 0;
+
+typedef size_t BreakpointID;
+static const BreakpointID noBreakpointID = 0;
+
+} // namespace JSC
diff --git a/debugger/DebuggerScope.cpp b/debugger/DebuggerScope.cpp
new file mode 100644
index 0000000..49cfce6
--- /dev/null
+++ b/debugger/DebuggerScope.cpp
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2008-2009, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DebuggerScope.h"
+
+#include "JSLexicalEnvironment.h"
+#include "JSCInlines.h"
+#include "JSWithScope.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DebuggerScope);
+
+const ClassInfo DebuggerScope::s_info = { "DebuggerScope", &Base::s_info, 0, CREATE_METHOD_TABLE(DebuggerScope) };
+
+DebuggerScope* DebuggerScope::create(VM& vm, JSScope* scope)
+{
+    Structure* structure = scope->globalObject()->debuggerScopeStructure();
+    DebuggerScope* debuggerScope = new (NotNull, allocateCell<DebuggerScope>(vm.heap)) DebuggerScope(vm, structure, scope);
+    debuggerScope->finishCreation(vm);
+    return debuggerScope;
+}
+
+DebuggerScope::DebuggerScope(VM& vm, Structure* structure, JSScope* scope)
+    : JSNonFinalObject(vm, structure)
+{
+    ASSERT(scope);
+    m_scope.set(vm, this, scope);
+}
+
+void DebuggerScope::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+void DebuggerScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    DebuggerScope* thisObject = jsCast<DebuggerScope*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    JSObject::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_scope);
+    visitor.append(thisObject->m_next);
+}
+
+String DebuggerScope::className(const JSObject* object)
+{
+    const DebuggerScope* scope = jsCast<const DebuggerScope*>(object);
+    // We cannot assert that scope->isValid() because the TypeProfiler may encounter an invalidated
+    // DebuggerScope in its log entries. We just need to handle it appropriately as below.
+    if (!scope->isValid())
+        return String();
+    JSObject* thisObject = JSScope::objectAtScope(scope->jsScope());
+    return thisObject->methodTable()->className(thisObject);
+}
+
+bool DebuggerScope::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    DebuggerScope* scope = jsCast<DebuggerScope*>(object);
+    if (!scope->isValid())
+        return false;
+    JSObject* thisObject = JSScope::objectAtScope(scope->jsScope());
+    slot.setThisValue(JSValue(thisObject));
+
+    // By default, JSObject::getPropertySlot() will look in the DebuggerScope's prototype
+    // chain and not the wrapped scope, and JSObject::getPropertySlot() cannot be overridden
+    // to behave differently for the DebuggerScope.
+    //
+    // Instead, we'll treat all properties in the wrapped scope and its prototype chain as
+    // the own properties of the DebuggerScope. This is fine because the WebInspector
+    // does not presently need to distinguish between what's owned at each level in the
+    // prototype chain. Hence, we'll invoke getPropertySlot() on the wrapped scope here
+    // instead of getOwnPropertySlot().
+    bool result = thisObject->getPropertySlot(exec, propertyName, slot);
+    if (result && slot.isValue() && slot.getValue(exec, propertyName) == jsTDZValue()) {
+        // FIXME:
+        // We hit a scope property that has the TDZ empty value.
+        // Currently, we just lie to the inspector and claim that this property is undefined.
+        // This is not ideal and we should fix it.
+        // https://bugs.webkit.org/show_bug.cgi?id=144977
+        slot.setValue(slot.slotBase(), DontEnum, jsUndefined());
+        return true;
+    }
+    return result;
+}
+
+bool DebuggerScope::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    DebuggerScope* scope = jsCast<DebuggerScope*>(cell);
+    ASSERT(scope->isValid());
+    if (!scope->isValid())
+        return false;
+    JSObject* thisObject = JSScope::objectAtScope(scope->jsScope());
+    slot.setThisValue(JSValue(thisObject));
+    return thisObject->methodTable()->put(thisObject, exec, propertyName, value, slot);
+}
+
+bool DebuggerScope::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    DebuggerScope* scope = jsCast<DebuggerScope*>(cell);
+    ASSERT(scope->isValid());
+    if (!scope->isValid())
+        return false;
+    JSObject* thisObject = JSScope::objectAtScope(scope->jsScope());
+    return thisObject->methodTable()->deleteProperty(thisObject, exec, propertyName);
+}
+
+void DebuggerScope::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    DebuggerScope* scope = jsCast<DebuggerScope*>(object);
+    ASSERT(scope->isValid());
+    if (!scope->isValid())
+        return;
+    JSObject* thisObject = JSScope::objectAtScope(scope->jsScope());
+    thisObject->methodTable()->getPropertyNames(thisObject, exec, propertyNames, mode);
+}
+
+bool DebuggerScope::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    DebuggerScope* scope = jsCast<DebuggerScope*>(object);
+    ASSERT(scope->isValid());
+    if (!scope->isValid())
+        return false;
+    JSObject* thisObject = JSScope::objectAtScope(scope->jsScope());
+    return thisObject->methodTable()->defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+}
+
+DebuggerScope* DebuggerScope::next()
+{
+    ASSERT(isValid());
+    if (!m_next && m_scope->next()) {
+        VM& vm = *m_scope->vm();
+        DebuggerScope* nextScope = create(vm, m_scope->next());
+        m_next.set(vm, this, nextScope);
+    }
+    return m_next.get();
+}
+
+void DebuggerScope::invalidateChain()
+{
+    if (!isValid())
+        return;
+
+    DebuggerScope* scope = this;
+    while (scope) {
+        DebuggerScope* nextScope = scope->m_next.get();
+        scope->m_next.clear();
+        scope->m_scope.clear(); // This also marks this scope as invalid.
+        scope = nextScope;
+    }
+}
+
+bool DebuggerScope::isCatchScope() const
+{
+    return m_scope->isCatchScope();
+}
+
+bool DebuggerScope::isFunctionNameScope() const
+{
+    return m_scope->isFunctionNameScopeObject();
+}
+
+bool DebuggerScope::isWithScope() const
+{
+    return m_scope->isWithScope();
+}
+
+bool DebuggerScope::isGlobalScope() const
+{
+    return m_scope->isGlobalObject();
+}
+
+bool DebuggerScope::isGlobalLexicalEnvironment() const
+{
+    return m_scope->isGlobalLexicalEnvironment();
+}
+
+bool DebuggerScope::isClosureScope() const
+{
+    // In the current debugger implementation, every function or eval will create an
+    // lexical environment object. Hence, a lexical environment object implies a
+    // function or eval scope.
+    return m_scope->isVarScope() || m_scope->isLexicalScope();
+}
+
+bool DebuggerScope::isNestedLexicalScope() const
+{
+    return m_scope->isNestedLexicalScope();
+}
+
+String DebuggerScope::name() const
+{
+    SymbolTable* symbolTable = m_scope->symbolTable();
+    if (!symbolTable)
+        return String();
+
+    CodeBlock* codeBlock = symbolTable->rareDataCodeBlock();
+    if (!codeBlock)
+        return String();
+
+    return String::fromUTF8(codeBlock->inferredName());
+}
+
+DebuggerLocation DebuggerScope::location() const
+{
+    SymbolTable* symbolTable = m_scope->symbolTable();
+    if (!symbolTable)
+        return DebuggerLocation();
+
+    CodeBlock* codeBlock = symbolTable->rareDataCodeBlock();
+    if (!codeBlock)
+        return DebuggerLocation();
+
+    ScriptExecutable* executable = codeBlock->ownerScriptExecutable();
+    return DebuggerLocation(executable);
+}
+
+JSValue DebuggerScope::caughtValue(ExecState* exec) const
+{
+    ASSERT(isCatchScope());
+    JSLexicalEnvironment* catchEnvironment = jsCast<JSLexicalEnvironment*>(m_scope.get());
+    SymbolTable* catchSymbolTable = catchEnvironment->symbolTable();
+    RELEASE_ASSERT(catchSymbolTable->size() == 1);
+    PropertyName errorName(catchSymbolTable->begin(catchSymbolTable->m_lock)->key.get());
+    PropertySlot slot(m_scope.get(), PropertySlot::InternalMethodType::Get);
+    bool success = catchEnvironment->getOwnPropertySlot(catchEnvironment, exec, errorName, slot);
+    RELEASE_ASSERT(success && slot.isValue());
+    return slot.getValue(exec, errorName);
+}
+
+} // namespace JSC
diff --git a/debugger/DebuggerScope.h b/debugger/DebuggerScope.h
new file mode 100644
index 0000000..479b186
--- /dev/null
+++ b/debugger/DebuggerScope.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2008-2009, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DebuggerLocation.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class DebuggerCallFrame;
+class JSScope;
+
+class DebuggerScope : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
+
+    JS_EXPORT_PRIVATE static DebuggerScope* create(VM& vm, JSScope* scope);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static String className(const JSObject*);
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject) 
+    {
+        return Structure::create(vm, globalObject, jsNull(), TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+    class iterator {
+    public:
+        iterator(DebuggerScope* node)
+            : m_node(node)
+        {
+        }
+
+        DebuggerScope* get() { return m_node; }
+        iterator& operator++() { m_node = m_node->next(); return *this; }
+        // postfix ++ intentionally omitted
+
+        bool operator==(const iterator& other) const { return m_node == other.m_node; }
+        bool operator!=(const iterator& other) const { return m_node != other.m_node; }
+
+    private:
+        DebuggerScope* m_node;
+    };
+
+    iterator begin();
+    iterator end();
+    DebuggerScope* next();
+
+    void invalidateChain();
+    bool isValid() const { return !!m_scope; }
+
+    bool isCatchScope() const;
+    bool isFunctionNameScope() const;
+    bool isWithScope() const;
+    bool isGlobalScope() const;
+    bool isClosureScope() const;
+    bool isGlobalLexicalEnvironment() const;
+    bool isNestedLexicalScope() const;
+
+    String name() const;
+    DebuggerLocation location() const;
+
+    JSValue caughtValue(ExecState*) const;
+
+private:
+    DebuggerScope(VM&, Structure*, JSScope*);
+    void finishCreation(VM&);
+
+    JSScope* jsScope() const { return m_scope.get(); }
+
+    WriteBarrier<JSScope> m_scope;
+    WriteBarrier<DebuggerScope> m_next;
+
+    friend class DebuggerCallFrame;
+};
+
+inline DebuggerScope::iterator DebuggerScope::begin()
+{
+    return iterator(this); 
+}
+
+inline DebuggerScope::iterator DebuggerScope::end()
+{ 
+    return iterator(0); 
+}
+
+} // namespace JSC
diff --git a/debugger/ScriptProfilingScope.h b/debugger/ScriptProfilingScope.h
new file mode 100644
index 0000000..e40337f
--- /dev/null
+++ b/debugger/ScriptProfilingScope.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Debugger.h"
+#include "JSGlobalObject.h"
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+class ScriptProfilingScope {
+public:
+    ScriptProfilingScope(JSGlobalObject* globalObject, ProfilingReason reason)
+        : m_globalObject(globalObject)
+        , m_reason(reason)
+    {
+        if (shouldStartProfile())
+            m_startTime = m_globalObject->debugger()->willEvaluateScript();
+    }
+
+    ~ScriptProfilingScope()
+    {
+        if (shouldEndProfile())
+            m_globalObject->debugger()->didEvaluateScript(m_startTime.value(), m_reason);
+    }
+
+private:
+    bool shouldStartProfile() const
+    {
+        if (!m_globalObject)
+            return false;
+
+        if (!m_globalObject->hasDebugger())
+            return false;
+
+        if (!m_globalObject->debugger()->hasProfilingClient())
+            return false;
+
+        if (m_globalObject->debugger()->isAlreadyProfiling())
+            return false;
+
+        return true;
+    }
+
+    bool shouldEndProfile() const
+    {
+        // Did not start a profile.
+        if (!m_startTime)
+            return false;
+
+        // Debugger may have been removed.
+        if (!m_globalObject->hasDebugger())
+            return false;
+
+        // Profiling Client may have been removed.
+        if (!m_globalObject->debugger()->hasProfilingClient())
+            return false;
+
+        return true;
+    }
+
+    JSGlobalObject* m_globalObject { nullptr };
+    std::optional<double> m_startTime;
+    ProfilingReason m_reason;
+};
+
+} // namespace JSC
diff --git a/dfg/DFGAbstractHeap.cpp b/dfg/DFGAbstractHeap.cpp
new file mode 100644
index 0000000..cd694bb
--- /dev/null
+++ b/dfg/DFGAbstractHeap.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGAbstractHeap.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void AbstractHeap::Payload::dump(PrintStream& out) const
+{
+    if (isTop())
+        out.print("TOP");
+    else
+        out.print(value());
+}
+
+void AbstractHeap::dump(PrintStream& out) const
+{
+    out.print(kind());
+    if (kind() == InvalidAbstractHeap || kind() == World || kind() == Heap || payload().isTop())
+        return;
+    if (kind() == DOMState) {
+        out.print("(", DOMJIT::HeapRange::fromRaw(payload().value32()), ")");
+        return;
+    }
+    out.print("(", payload(), ")");
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, AbstractHeapKind kind)
+{
+    switch (kind) {
+#define ABSTRACT_HEAP_DUMP(name)            \
+    case name:                              \
+        out.print(#name);                   \
+        return;
+    FOR_EACH_ABSTRACT_HEAP_KIND(ABSTRACT_HEAP_DUMP)
+#undef ABSTRACT_HEAP_DUMP
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGAbstractHeap.h b/dfg/DFGAbstractHeap.h
new file mode 100644
index 0000000..97c3a34
--- /dev/null
+++ b/dfg/DFGAbstractHeap.h
@@ -0,0 +1,345 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DOMJITHeapRange.h"
+#include "VirtualRegister.h"
+#include <wtf/HashMap.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+// Implements a four-level type hierarchy:
+// - World is the supertype of all of the things.
+// - Stack with a TOP payload is a direct subtype of World
+// - Stack with a non-TOP payload is a direct subtype of Stack with a TOP payload.
+// - Heap is a direct subtype of World.
+// - SideState is a direct subtype of World.
+// - Any other kind with TOP payload is the direct subtype of Heap.
+// - Any other kind with non-TOP payload is the direct subtype of the same kind with a TOP payload.
+
+#define FOR_EACH_ABSTRACT_HEAP_KIND(macro) \
+    macro(InvalidAbstractHeap) \
+    macro(World) \
+    macro(Stack) \
+    macro(Heap) \
+    macro(Butterfly_publicLength) \
+    macro(Butterfly_vectorLength) \
+    macro(GetterSetter_getter) \
+    macro(GetterSetter_setter) \
+    macro(JSCell_cellState) \
+    macro(JSCell_indexingType) \
+    macro(JSCell_structureID) \
+    macro(JSCell_typeInfoFlags) \
+    macro(JSCell_typeInfoType) \
+    macro(JSObject_butterfly) \
+    macro(JSPropertyNameEnumerator_cachedPropertyNames) \
+    macro(RegExpObject_lastIndex) \
+    macro(NamedProperties) \
+    macro(IndexedInt32Properties) \
+    macro(IndexedDoubleProperties) \
+    macro(IndexedContiguousProperties) \
+    macro(IndexedArrayStorageProperties) \
+    macro(ArrayStorageProperties) \
+    macro(DirectArgumentsProperties) \
+    macro(ScopeProperties) \
+    macro(TypedArrayProperties) \
+    macro(HeapObjectCount) /* Used to reflect the fact that some allocations reveal object identity */\
+    macro(RegExpState) \
+    macro(MathDotRandomState) \
+    macro(InternalState) \
+    macro(Absolute) \
+    /* DOMJIT tells the heap range with the pair of integers. */\
+    macro(DOMState) \
+    /* Use this for writes only, to indicate that this may fire watchpoints. Usually this is never directly written but instead we test to see if a node clobbers this; it just so happens that you have to write world to clobber it. */\
+    macro(Watchpoint_fire) \
+    /* Use these for reads only, just to indicate that if the world got clobbered, then this operation will not work. */\
+    macro(MiscFields) \
+    /* Use this for writes only, just to indicate that hoisting the node is invalid. This works because we don't hoist anything that has any side effects at all. */\
+    macro(SideState)
+
+enum AbstractHeapKind {
+#define ABSTRACT_HEAP_DECLARATION(name) name,
+    FOR_EACH_ABSTRACT_HEAP_KIND(ABSTRACT_HEAP_DECLARATION)
+#undef ABSTRACT_HEAP_DECLARATION
+};
+
+class AbstractHeap {
+public:
+    class Payload {
+    public:
+        Payload()
+            : m_isTop(false)
+            , m_value(0)
+        {
+        }
+        
+        Payload(bool isTop, int64_t value)
+            : m_isTop(isTop)
+            , m_value(value)
+        {
+            ASSERT(!(isTop && value));
+        }
+        
+        Payload(int64_t value)
+            : m_isTop(false)
+            , m_value(value)
+        {
+        }
+        
+        Payload(const void* pointer)
+            : m_isTop(false)
+            , m_value(bitwise_cast<intptr_t>(pointer))
+        {
+        }
+        
+        Payload(VirtualRegister operand)
+            : m_isTop(false)
+            , m_value(operand.offset())
+        {
+        }
+        
+        static Payload top() { return Payload(true, 0); }
+        
+        bool isTop() const { return m_isTop; }
+        int64_t value() const
+        {
+            ASSERT(!isTop());
+            return valueImpl();
+        }
+        int64_t valueImpl() const
+        {
+            return m_value;
+        }
+        
+        int32_t value32() const
+        {
+            return static_cast<int32_t>(value());
+        }
+        
+        bool operator==(const Payload& other) const
+        {
+            return m_isTop == other.m_isTop
+                && m_value == other.m_value;
+        }
+        
+        bool operator!=(const Payload& other) const
+        {
+            return !(*this == other);
+        }
+        
+        bool operator<(const Payload& other) const
+        {
+            if (isTop())
+                return !other.isTop();
+            if (other.isTop())
+                return false;
+            return value() < other.value();
+        }
+        
+        bool isDisjoint(const Payload& other) const
+        {
+            if (isTop())
+                return false;
+            if (other.isTop())
+                return false;
+            return m_value != other.m_value;
+        }
+        
+        bool overlaps(const Payload& other) const
+        {
+            return !isDisjoint(other);
+        }
+        
+        void dump(PrintStream&) const;
+        
+    private:
+        bool m_isTop;
+        int64_t m_value;
+    };
+    
+    AbstractHeap()
+    {
+        m_value = encode(InvalidAbstractHeap, Payload());
+    }
+    
+    AbstractHeap(AbstractHeapKind kind)
+    {
+        ASSERT(kind != InvalidAbstractHeap);
+        m_value = encode(kind, Payload::top());
+    }
+    
+    AbstractHeap(AbstractHeapKind kind, Payload payload)
+    {
+        ASSERT(kind != InvalidAbstractHeap && kind != World && kind != Heap && kind != SideState);
+        m_value = encode(kind, payload);
+    }
+    
+    AbstractHeap(WTF::HashTableDeletedValueType)
+    {
+        m_value = encode(InvalidAbstractHeap, Payload::top());
+    }
+    
+    bool operator!() const { return kind() == InvalidAbstractHeap && !payloadImpl().isTop(); }
+    
+    AbstractHeapKind kind() const { return static_cast<AbstractHeapKind>(m_value & ((1 << topShift) - 1)); }
+    Payload payload() const
+    {
+        ASSERT(kind() != World && kind() != InvalidAbstractHeap);
+        return payloadImpl();
+    }
+    
+    AbstractHeap supertype() const
+    {
+        ASSERT(kind() != InvalidAbstractHeap);
+        switch (kind()) {
+        case World:
+            return AbstractHeap();
+        case Heap:
+        case SideState:
+            return World;
+        default:
+            if (payload().isTop()) {
+                if (kind() == Stack)
+                    return World;
+                return Heap;
+            }
+            return AbstractHeap(kind());
+        }
+    }
+    
+    bool isStrictSubtypeOf(const AbstractHeap& other) const
+    {
+        AbstractHeap current = *this;
+        if (current.kind() == DOMState && other.kind() == DOMState) {
+            Payload currentPayload = current.payload();
+            Payload otherPayload = other.payload();
+            if (currentPayload.isTop())
+                return false;
+            if (otherPayload.isTop())
+                return true;
+            return DOMJIT::HeapRange::fromRaw(currentPayload.value32()).isStrictSubtypeOf(DOMJIT::HeapRange::fromRaw(otherPayload.value32()));
+        }
+        while (current.kind() != World) {
+            current = current.supertype();
+            if (current == other)
+                return true;
+        }
+        return false;
+    }
+    
+    bool isSubtypeOf(const AbstractHeap& other) const
+    {
+        return *this == other || isStrictSubtypeOf(other);
+    }
+    
+    bool overlaps(const AbstractHeap& other) const
+    {
+        return *this == other || isStrictSubtypeOf(other) || other.isStrictSubtypeOf(*this);
+    }
+    
+    bool isDisjoint(const AbstractHeap& other) const
+    {
+        return !overlaps(other);
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::IntHash<int64_t>::hash(m_value);
+    }
+    
+    bool operator==(const AbstractHeap& other) const
+    {
+        return m_value == other.m_value;
+    }
+    
+    bool operator!=(const AbstractHeap& other) const
+    {
+        return !(*this == other);
+    }
+    
+    bool operator<(const AbstractHeap& other) const
+    {
+        if (kind() != other.kind())
+            return kind() < other.kind();
+        return payload() < other.payload();
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return kind() == InvalidAbstractHeap && payloadImpl().isTop();
+    }
+    
+    void dump(PrintStream& out) const;
+    
+private:
+    static const unsigned valueShift = 15;
+    static const unsigned topShift = 14;
+    
+    Payload payloadImpl() const
+    {
+        return Payload((m_value >> topShift) & 1, m_value >> valueShift);
+    }
+    
+    static int64_t encode(AbstractHeapKind kind, Payload payload)
+    {
+        int64_t kindAsInt = static_cast<int64_t>(kind);
+        ASSERT(kindAsInt < (1 << topShift));
+        return kindAsInt | (static_cast<uint64_t>(payload.isTop()) << topShift) | (bitwise_cast<uint64_t>(payload.valueImpl()) << valueShift);
+    }
+    
+    // The layout of the value is:
+    // Low 14 bits: the Kind
+    // 15th bit: whether or not the payload is TOP.
+    // The upper bits: the payload.value().
+    int64_t m_value;
+};
+
+struct AbstractHeapHash {
+    static unsigned hash(const AbstractHeap& key) { return key.hash(); }
+    static bool equal(const AbstractHeap& a, const AbstractHeap& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::AbstractHeapKind);
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::AbstractHeap> {
+    typedef JSC::DFG::AbstractHeapHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::AbstractHeap> : SimpleClassHashTraits<JSC::DFG::AbstractHeap> { };
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAbstractInterpreter.h b/dfg/DFGAbstractInterpreter.h
new file mode 100644
index 0000000..4c01471
--- /dev/null
+++ b/dfg/DFGAbstractInterpreter.h
@@ -0,0 +1,206 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractValue.h"
+#include "DFGBranchDirection.h"
+#include "DFGGraph.h"
+#include "DFGNode.h"
+#include "DFGNodeFlowProjection.h"
+#include "DFGPhiChildren.h"
+
+namespace JSC { namespace DFG {
+
+template<typename AbstractStateType>
+class AbstractInterpreter {
+public:
+    AbstractInterpreter(Graph&, AbstractStateType&);
+    ~AbstractInterpreter();
+    
+    AbstractValue& forNode(NodeFlowProjection node)
+    {
+        return m_state.forNode(node);
+    }
+    
+    AbstractValue& forNode(Edge edge)
+    {
+        return forNode(edge.node());
+    }
+    
+    Operands<AbstractValue>& variables()
+    {
+        return m_state.variables();
+    }
+    
+    bool needsTypeCheck(Node* node, SpeculatedType typesPassedThrough)
+    {
+        return !forNode(node).isType(typesPassedThrough);
+    }
+    
+    bool needsTypeCheck(Edge edge, SpeculatedType typesPassedThrough)
+    {
+        return needsTypeCheck(edge.node(), typesPassedThrough);
+    }
+    
+    bool needsTypeCheck(Edge edge)
+    {
+        return needsTypeCheck(edge, typeFilterFor(edge.useKind()));
+    }
+    
+    // Abstractly executes the given node. The new abstract state is stored into an
+    // abstract stack stored in *this. Loads of local variables (that span
+    // basic blocks) interrogate the basic block's notion of the state at the head.
+    // Stores to local variables are handled in endBasicBlock(). This returns true
+    // if execution should continue past this node. Notably, it will return true
+    // for block terminals, so long as those terminals are not Return or Unreachable.
+    //
+    // This is guaranteed to be equivalent to doing:
+    //
+    // state.startExecuting()
+    // state.executeEdges(node);
+    // result = state.executeEffects(index);
+    bool execute(unsigned indexInBlock);
+    bool execute(Node*);
+    
+    // Indicate the start of execution of a node. It resets any state in the node
+    // that is progressively built up by executeEdges() and executeEffects().
+    void startExecuting();
+    
+    // Abstractly execute the edges of the given node. This runs filterEdgeByUse()
+    // on all edges of the node. You can skip this step, if you have already used
+    // filterEdgeByUse() (or some equivalent) on each edge.
+    void executeEdges(Node*);
+
+    void executeKnownEdgeTypes(Node*);
+    
+    ALWAYS_INLINE void filterEdgeByUse(Edge& edge)
+    {
+        filterByType(edge, typeFilterFor(edge.useKind()));
+    }
+    
+    // Abstractly execute the effects of the given node. This changes the abstract
+    // state assuming that edges have already been filtered.
+    bool executeEffects(unsigned indexInBlock);
+    bool executeEffects(unsigned clobberLimit, Node*);
+    
+    void dump(PrintStream& out) const;
+    void dump(PrintStream& out);
+    
+    template<typename T>
+    FiltrationResult filter(T node, const RegisteredStructureSet& set, SpeculatedType admittedTypes = SpecNone)
+    {
+        return filter(forNode(node), set, admittedTypes);
+    }
+    
+    template<typename T>
+    FiltrationResult filterArrayModes(T node, ArrayModes arrayModes)
+    {
+        return filterArrayModes(forNode(node), arrayModes);
+    }
+    
+    template<typename T>
+    FiltrationResult filter(T node, SpeculatedType type)
+    {
+        return filter(forNode(node), type);
+    }
+    
+    template<typename T>
+    FiltrationResult filterByValue(T node, FrozenValue value)
+    {
+        return filterByValue(forNode(node), value);
+    }
+    
+    template<typename T>
+    FiltrationResult filterClassInfo(T node, const ClassInfo* classInfo)
+    {
+        return filterClassInfo(forNode(node), classInfo);
+    }
+
+    FiltrationResult filter(AbstractValue&, const RegisteredStructureSet&, SpeculatedType admittedTypes = SpecNone);
+    FiltrationResult filterArrayModes(AbstractValue&, ArrayModes);
+    FiltrationResult filter(AbstractValue&, SpeculatedType);
+    FiltrationResult filterByValue(AbstractValue&, FrozenValue);
+    FiltrationResult filterClassInfo(AbstractValue&, const ClassInfo*);
+    
+    PhiChildren* phiChildren() { return m_phiChildren.get(); }
+    
+private:
+    void clobberWorld(const CodeOrigin&, unsigned indexInBlock);
+    
+    template<typename Functor>
+    void forAllValues(unsigned indexInBlock, Functor&);
+    
+    void clobberStructures(unsigned indexInBlock);
+    void observeTransition(unsigned indexInBlock, RegisteredStructure from, RegisteredStructure to);
+    void observeTransitions(unsigned indexInBlock, const TransitionVector&);
+    void setDidClobber();
+    
+    enum BooleanResult {
+        UnknownBooleanResult,
+        DefinitelyFalse,
+        DefinitelyTrue
+    };
+    BooleanResult booleanResult(Node*, AbstractValue&);
+    
+    void setBuiltInConstant(Node* node, FrozenValue value)
+    {
+        AbstractValue& abstractValue = forNode(node);
+        abstractValue.set(m_graph, value, m_state.structureClobberState());
+        abstractValue.fixTypeForRepresentation(m_graph, node);
+    }
+    
+    void setConstant(Node* node, FrozenValue value)
+    {
+        setBuiltInConstant(node, value);
+        m_state.setFoundConstants(true);
+    }
+    
+    ALWAYS_INLINE void filterByType(Edge& edge, SpeculatedType type)
+    {
+        AbstractValue& value = forNode(edge);
+        if (!value.isType(type))
+            edge.setProofStatus(NeedsCheck);
+        else
+            edge.setProofStatus(IsProved);
+        
+        filter(value, type);
+    }
+    
+    void verifyEdge(Node*, Edge);
+    void verifyEdges(Node*);
+    void executeDoubleUnaryOpEffects(Node*, double(*equivalentFunction)(double));
+    
+    CodeBlock* m_codeBlock;
+    Graph& m_graph;
+    AbstractStateType& m_state;
+    std::unique_ptr<PhiChildren> m_phiChildren;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAbstractInterpreterInlines.h b/dfg/DFGAbstractInterpreterInlines.h
new file mode 100644
index 0000000..dfd268f
--- /dev/null
+++ b/dfg/DFGAbstractInterpreterInlines.h
@@ -0,0 +1,3200 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayConstructor.h"
+#include "DFGAbstractInterpreter.h"
+#include "DOMJITGetterSetter.h"
+#include "DOMJITSignature.h"
+#include "GetByIdStatus.h"
+#include "GetterSetter.h"
+#include "HashMapImpl.h"
+#include "JITOperations.h"
+#include "MathCommon.h"
+#include "Operations.h"
+#include "PutByIdStatus.h"
+#include "StringObject.h"
+
+namespace JSC { namespace DFG {
+
+template<typename AbstractStateType>
+AbstractInterpreter<AbstractStateType>::AbstractInterpreter(Graph& graph, AbstractStateType& state)
+    : m_codeBlock(graph.m_codeBlock)
+    , m_graph(graph)
+    , m_state(state)
+{
+    if (m_graph.m_form == SSA)
+        m_phiChildren = std::make_unique<PhiChildren>(m_graph);
+}
+
+template<typename AbstractStateType>
+AbstractInterpreter<AbstractStateType>::~AbstractInterpreter()
+{
+}
+
+template<typename AbstractStateType>
+typename AbstractInterpreter<AbstractStateType>::BooleanResult
+AbstractInterpreter<AbstractStateType>::booleanResult(
+    Node* node, AbstractValue& value)
+{
+    JSValue childConst = value.value();
+    if (childConst) {
+        if (childConst.toBoolean(m_codeBlock->globalObjectFor(node->origin.semantic)->globalExec()))
+            return DefinitelyTrue;
+        return DefinitelyFalse;
+    }
+
+    // Next check if we can fold because we know that the source is an object or string and does not equal undefined.
+    if (isCellSpeculation(value.m_type) && !value.m_structure.isTop()) {
+        bool allTrue = true;
+        for (unsigned i = value.m_structure.size(); i--;) {
+            RegisteredStructure structure = value.m_structure[i];
+            if (structure->masqueradesAsUndefined(m_codeBlock->globalObjectFor(node->origin.semantic))
+                || structure->typeInfo().type() == StringType) {
+                allTrue = false;
+                break;
+            }
+        }
+        if (allTrue)
+            return DefinitelyTrue;
+    }
+    
+    return UnknownBooleanResult;
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::startExecuting()
+{
+    ASSERT(m_state.block());
+    ASSERT(m_state.isValid());
+    
+    m_state.setDidClobber(false);
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::executeEdges(Node* node)
+{
+    m_graph.doToChildren(
+        node,
+        [&] (Edge& edge) {
+            filterEdgeByUse(edge);
+        });
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::executeKnownEdgeTypes(Node* node)
+{
+    // Some use kinds are required to not have checks, because we know somehow that the incoming
+    // value will already have the type we want. In those cases, AI may not be smart enough to
+    // prove that this is indeed the case. But the existance of the edge is enough to prove that
+    // it is indeed the case. Taking advantage of this is not optional, since otherwise the DFG
+    // and FTL backends may emit checks in a node that lacks a valid exit origin.
+    m_graph.doToChildren(
+        node,
+        [&] (Edge& edge) {
+            if (mayHaveTypeCheck(edge.useKind()))
+                return;
+            
+            filterEdgeByUse(edge);
+        });
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::verifyEdge(Node* node, Edge edge)
+{
+    if (!(forNode(edge).m_type & ~typeFilterFor(edge.useKind())))
+        return;
+    
+    DFG_CRASH(m_graph, node, toCString("Edge verification error: ", node, "->", edge, " was expected to have type ", SpeculationDump(typeFilterFor(edge.useKind())), " but has type ", SpeculationDump(forNode(edge).m_type), " (", forNode(edge).m_type, ")").data());
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::verifyEdges(Node* node)
+{
+    DFG_NODE_DO_TO_CHILDREN(m_graph, node, verifyEdge);
+}
+
+inline bool isToThisAnIdentity(bool isStrictMode, AbstractValue& valueForNode)
+{
+    // We look at the type first since that will cover most cases and does not require iterating all the structures.
+    if (isStrictMode) {
+        if (valueForNode.m_type && !(valueForNode.m_type & SpecObjectOther))
+            return true;
+    } else {
+        if (valueForNode.m_type && !(valueForNode.m_type & (~SpecObject | SpecObjectOther)))
+            return true;
+    }
+
+    if ((isStrictMode || (valueForNode.m_type && !(valueForNode.m_type & ~SpecObject))) && valueForNode.m_structure.isFinite()) {
+        bool overridesToThis = false;
+        valueForNode.m_structure.forEach([&](RegisteredStructure structure) {
+            TypeInfo type = structure->typeInfo();
+            ASSERT(type.isObject() || type.type() == StringType || type.type() == SymbolType);
+            if (!isStrictMode)
+                ASSERT(type.isObject());
+            // We don't need to worry about strings/symbols here since either:
+            // 1) We are in strict mode and strings/symbols are not wrapped
+            // 2) The AI has proven that the type of this is a subtype of object
+            if (type.isObject() && type.overridesToThis())
+                overridesToThis = true;
+        });
+        return !overridesToThis;
+    }
+
+    return false;
+}
+
+template<typename AbstractStateType>
+bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned clobberLimit, Node* node)
+{
+    if (!ASSERT_DISABLED)
+        verifyEdges(node);
+    
+    m_state.createValueForNode(node);
+    
+    switch (node->op()) {
+    case JSConstant:
+    case DoubleConstant:
+    case Int52Constant: {
+        setBuiltInConstant(node, *node->constant());
+        break;
+    }
+
+    case LazyJSConstant: {
+        LazyJSValue value = node->lazyJSValue();
+        switch (value.kind()) {
+        case LazyJSValue::KnownValue:
+            setConstant(node, value.value()->value());
+            break;
+        case LazyJSValue::SingleCharacterString:
+        case LazyJSValue::KnownStringImpl:
+        case LazyJSValue::NewStringImpl:
+            forNode(node).setType(m_graph, SpecString);
+            break;
+        }
+        break;
+    }
+        
+    case Identity: {
+        forNode(node) = forNode(node->child1());
+        if (forNode(node).value())
+            m_state.setFoundConstants(true);
+        break;
+    }
+        
+    case ExtractOSREntryLocal: {
+        forNode(node).makeBytecodeTop();
+        break;
+    }
+            
+    case GetLocal: {
+        VariableAccessData* variableAccessData = node->variableAccessData();
+        AbstractValue value = m_state.variables().operand(variableAccessData->local().offset());
+        // The value in the local should already be checked.
+        DFG_ASSERT(m_graph, node, value.isType(typeFilterFor(variableAccessData->flushFormat())));
+        if (value.value())
+            m_state.setFoundConstants(true);
+        forNode(node) = value;
+        break;
+    }
+        
+    case GetStack: {
+        StackAccessData* data = node->stackAccessData();
+        AbstractValue value = m_state.variables().operand(data->local);
+        // The value in the local should already be checked.
+        DFG_ASSERT(m_graph, node, value.isType(typeFilterFor(data->format)));
+        if (value.value())
+            m_state.setFoundConstants(true);
+        forNode(node) = value;
+        break;
+    }
+        
+    case GetLocalUnlinked: {
+        AbstractValue value = m_state.variables().operand(node->unlinkedLocal().offset());
+        if (value.value())
+            m_state.setFoundConstants(true);
+        forNode(node) = value;
+        break;
+    }
+        
+    case SetLocal: {
+        m_state.variables().operand(node->local()) = forNode(node->child1());
+        break;
+    }
+        
+    case PutStack: {
+        m_state.variables().operand(node->stackAccessData()->local) = forNode(node->child1());
+        break;
+    }
+        
+    case MovHint: {
+        // Don't need to do anything. A MovHint only informs us about what would have happened
+        // in bytecode, but this code is just concerned with what is actually happening during
+        // DFG execution.
+        break;
+    }
+        
+    case KillStack: {
+        // This is just a hint telling us that the OSR state of the local is no longer inside the
+        // flushed data.
+        break;
+    }
+        
+    case SetArgument:
+        // Assert that the state of arguments has been set. SetArgument means that someone set
+        // the argument values out-of-band, and currently this always means setting to a
+        // non-clear value.
+        ASSERT(!m_state.variables().operand(node->local()).isClear());
+        break;
+        
+    case LoadVarargs:
+    case ForwardVarargs: {
+        // FIXME: ForwardVarargs should check if the count becomes known, and if it does, it should turn
+        // itself into a straight-line sequence of GetStack/PutStack.
+        // https://bugs.webkit.org/show_bug.cgi?id=143071
+        clobberWorld(node->origin.semantic, clobberLimit);
+        LoadVarargsData* data = node->loadVarargsData();
+        m_state.variables().operand(data->count).setType(SpecInt32Only);
+        for (unsigned i = data->limit - 1; i--;)
+            m_state.variables().operand(data->start.offset() + i).makeHeapTop();
+        break;
+    }
+            
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case BitRShift:
+    case BitLShift:
+    case BitURShift: {
+        if (node->child1().useKind() == UntypedUse || node->child2().useKind() == UntypedUse) {
+            clobberWorld(node->origin.semantic, clobberLimit);
+            forNode(node).setType(m_graph, SpecInt32Only);
+            break;
+        }
+
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        if (left && right && left.isInt32() && right.isInt32()) {
+            int32_t a = left.asInt32();
+            int32_t b = right.asInt32();
+            switch (node->op()) {
+            case BitAnd:
+                setConstant(node, JSValue(a & b));
+                break;
+            case BitOr:
+                setConstant(node, JSValue(a | b));
+                break;
+            case BitXor:
+                setConstant(node, JSValue(a ^ b));
+                break;
+            case BitRShift:
+                setConstant(node, JSValue(a >> static_cast<uint32_t>(b)));
+                break;
+            case BitLShift:
+                setConstant(node, JSValue(a << static_cast<uint32_t>(b)));
+                break;
+            case BitURShift:
+                setConstant(node, JSValue(static_cast<uint32_t>(a) >> static_cast<uint32_t>(b)));
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            break;
+        }
+        
+        if (node->op() == BitAnd
+            && (isBoolInt32Speculation(forNode(node->child1()).m_type) ||
+                isBoolInt32Speculation(forNode(node->child2()).m_type))) {
+            forNode(node).setType(SpecBoolInt32);
+            break;
+        }
+        
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+        
+    case UInt32ToNumber: {
+        JSValue child = forNode(node->child1()).value();
+        if (doesOverflow(node->arithMode())) {
+            if (enableInt52()) {
+                if (child && child.isAnyInt()) {
+                    int64_t machineInt = child.asAnyInt();
+                    setConstant(node, jsNumber(static_cast<uint32_t>(machineInt)));
+                    break;
+                }
+                forNode(node).setType(SpecAnyInt);
+                break;
+            }
+            if (child && child.isInt32()) {
+                uint32_t value = child.asInt32();
+                setConstant(node, jsNumber(value));
+                break;
+            }
+            forNode(node).setType(SpecAnyIntAsDouble);
+            break;
+        }
+        if (child && child.isInt32()) {
+            int32_t value = child.asInt32();
+            if (value >= 0) {
+                setConstant(node, jsNumber(value));
+                break;
+            }
+        }
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+        
+    case BooleanToNumber: {
+        JSValue concreteValue = forNode(node->child1()).value();
+        if (concreteValue) {
+            if (concreteValue.isBoolean())
+                setConstant(node, jsNumber(concreteValue.asBoolean()));
+            else
+                setConstant(node, *m_graph.freeze(concreteValue));
+            break;
+        }
+        AbstractValue& value = forNode(node);
+        value = forNode(node->child1());
+        if (node->child1().useKind() == UntypedUse && !(value.m_type & ~SpecBoolean))
+            m_state.setFoundConstants(true);
+        if (value.m_type & SpecBoolean) {
+            value.merge(SpecBoolInt32);
+            value.filter(~SpecBoolean);
+        }
+        break;
+    }
+            
+    case DoubleAsInt32: {
+        JSValue child = forNode(node->child1()).value();
+        if (child && child.isNumber()) {
+            double asDouble = child.asNumber();
+            int32_t asInt = JSC::toInt32(asDouble);
+            if (bitwise_cast<int64_t>(static_cast<double>(asInt)) == bitwise_cast<int64_t>(asDouble)) {
+                setConstant(node, JSValue(asInt));
+                break;
+            }
+        }
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+            
+    case ValueToInt32: {
+        JSValue child = forNode(node->child1()).value();
+        if (child) {
+            if (child.isNumber()) {
+                if (child.isInt32())
+                    setConstant(node, child);
+                else
+                    setConstant(node, JSValue(JSC::toInt32(child.asDouble())));
+                break;
+            }
+            if (child.isBoolean()) {
+                setConstant(node, jsNumber(child.asBoolean()));
+                break;
+            }
+            if (child.isUndefinedOrNull()) {
+                setConstant(node, jsNumber(0));
+                break;
+            }
+        }
+        
+        if (isBooleanSpeculation(forNode(node->child1()).m_type)) {
+            forNode(node).setType(SpecBoolInt32);
+            break;
+        }
+        
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+        
+    case DoubleRep: {
+        JSValue child = forNode(node->child1()).value();
+        if (std::optional<double> number = child.toNumberFromPrimitive()) {
+            setConstant(node, jsDoubleNumber(*number));
+            break;
+        }
+
+        SpeculatedType type = forNode(node->child1()).m_type;
+        switch (node->child1().useKind()) {
+        case NotCellUse: {
+            if (type & SpecOther) {
+                type &= ~SpecOther;
+                type |= SpecDoublePureNaN | SpecBoolInt32; // Null becomes zero, undefined becomes NaN.
+            }
+            if (type & SpecBoolean) {
+                type &= ~SpecBoolean;
+                type |= SpecBoolInt32; // True becomes 1, false becomes 0.
+            }
+            type &= SpecBytecodeNumber;
+            break;
+        }
+
+        case Int52RepUse:
+        case NumberUse:
+        case RealNumberUse:
+            break;
+
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+        forNode(node).setType(type);
+        forNode(node).fixTypeForRepresentation(m_graph, node);
+        break;
+    }
+        
+    case Int52Rep: {
+        JSValue child = forNode(node->child1()).value();
+        if (child && child.isAnyInt()) {
+            setConstant(node, child);
+            break;
+        }
+        
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+        
+    case ValueRep: {
+        JSValue value = forNode(node->child1()).value();
+        if (value) {
+            setConstant(node, value);
+            break;
+        }
+        
+        forNode(node).setType(m_graph, forNode(node->child1()).m_type & ~SpecDoubleImpureNaN);
+        forNode(node).fixTypeForRepresentation(m_graph, node);
+        break;
+    }
+        
+    case ValueAdd: {
+        ASSERT(node->binaryUseKind() == UntypedUse);
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(m_graph, SpecString | SpecBytecodeNumber);
+        break;
+    }
+
+    case StrCat: {
+        forNode(node).setType(m_graph, SpecString);
+        break;
+    }
+        
+    case ArithAdd: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+            if (left && right && left.isInt32() && right.isInt32()) {
+                if (!shouldCheckOverflow(node->arithMode())) {
+                    setConstant(node, jsNumber(left.asInt32() + right.asInt32()));
+                    break;
+                }
+                JSValue result = jsNumber(left.asNumber() + right.asNumber());
+                if (result.isInt32()) {
+                    setConstant(node, result);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Int52RepUse:
+            if (left && right && left.isAnyInt() && right.isAnyInt()) {
+                JSValue result = jsNumber(left.asAnyInt() + right.asAnyInt());
+                if (result.isAnyInt()) {
+                    setConstant(node, result);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecAnyInt);
+            break;
+        case DoubleRepUse:
+            if (left && right && left.isNumber() && right.isNumber()) {
+                setConstant(node, jsDoubleNumber(left.asNumber() + right.asNumber()));
+                break;
+            }
+            forNode(node).setType(
+                typeOfDoubleSum(
+                    forNode(node->child1()).m_type, forNode(node->child2()).m_type));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+
+    case ArithClz32: {
+        JSValue operand = forNode(node->child1()).value();
+        if (std::optional<double> number = operand.toNumberFromPrimitive()) {
+            uint32_t value = toUInt32(*number);
+            setConstant(node, jsNumber(clz32(value)));
+            break;
+        }
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+
+    case MakeRope: {
+        forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());
+        break;
+    }
+            
+    case ArithSub: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+            if (left && right && left.isInt32() && right.isInt32()) {
+                if (!shouldCheckOverflow(node->arithMode())) {
+                    setConstant(node, jsNumber(left.asInt32() - right.asInt32()));
+                    break;
+                }
+                JSValue result = jsNumber(left.asNumber() - right.asNumber());
+                if (result.isInt32()) {
+                    setConstant(node, result);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Int52RepUse:
+            if (left && right && left.isAnyInt() && right.isAnyInt()) {
+                JSValue result = jsNumber(left.asAnyInt() - right.asAnyInt());
+                if (result.isAnyInt() || !shouldCheckOverflow(node->arithMode())) {
+                    setConstant(node, result);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecAnyInt);
+            break;
+        case DoubleRepUse:
+            if (left && right && left.isNumber() && right.isNumber()) {
+                setConstant(node, jsDoubleNumber(left.asNumber() - right.asNumber()));
+                break;
+            }
+            forNode(node).setType(
+                typeOfDoubleDifference(
+                    forNode(node->child1()).m_type, forNode(node->child2()).m_type));
+            break;
+        case UntypedUse:
+            clobberWorld(node->origin.semantic, clobberLimit);
+            forNode(node).setType(m_graph, SpecBytecodeNumber);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+        
+    case ArithNegate: {
+        JSValue child = forNode(node->child1()).value();
+        switch (node->child1().useKind()) {
+        case Int32Use:
+            if (child && child.isInt32()) {
+                if (!shouldCheckOverflow(node->arithMode())) {
+                    setConstant(node, jsNumber(-child.asInt32()));
+                    break;
+                }
+                double doubleResult;
+                if (shouldCheckNegativeZero(node->arithMode()))
+                    doubleResult = -child.asNumber();
+                else
+                    doubleResult = 0 - child.asNumber();
+                JSValue valueResult = jsNumber(doubleResult);
+                if (valueResult.isInt32()) {
+                    setConstant(node, valueResult);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Int52RepUse:
+            if (child && child.isAnyInt()) {
+                double doubleResult;
+                if (shouldCheckNegativeZero(node->arithMode()))
+                    doubleResult = -child.asNumber();
+                else
+                    doubleResult = 0 - child.asNumber();
+                JSValue valueResult = jsNumber(doubleResult);
+                if (valueResult.isAnyInt()) {
+                    setConstant(node, valueResult);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecAnyInt);
+            break;
+        case DoubleRepUse:
+            if (child && child.isNumber()) {
+                setConstant(node, jsDoubleNumber(-child.asNumber()));
+                break;
+            }
+            forNode(node).setType(
+                typeOfDoubleNegation(
+                    forNode(node->child1()).m_type));
+            break;
+        default:
+            DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse);
+            forNode(node).setType(SpecBytecodeNumber);
+            break;
+        }
+        break;
+    }
+        
+    case ArithMul: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+            if (left && right && left.isInt32() && right.isInt32()) {
+                if (!shouldCheckOverflow(node->arithMode())) {
+                    setConstant(node, jsNumber(left.asInt32() * right.asInt32()));
+                    break;
+                }
+                double doubleResult = left.asNumber() * right.asNumber();
+                if (!shouldCheckNegativeZero(node->arithMode()))
+                    doubleResult += 0; // Sanitizes zero.
+                JSValue valueResult = jsNumber(doubleResult);
+                if (valueResult.isInt32()) {
+                    setConstant(node, valueResult);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Int52RepUse:
+            if (left && right && left.isAnyInt() && right.isAnyInt()) {
+                double doubleResult = left.asNumber() * right.asNumber();
+                if (!shouldCheckNegativeZero(node->arithMode()))
+                    doubleResult += 0;
+                JSValue valueResult = jsNumber(doubleResult);
+                if (valueResult.isAnyInt()) {
+                    setConstant(node, valueResult);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecAnyInt);
+            break;
+        case DoubleRepUse:
+            if (left && right && left.isNumber() && right.isNumber()) {
+                setConstant(node, jsDoubleNumber(left.asNumber() * right.asNumber()));
+                break;
+            }
+            forNode(node).setType(
+                typeOfDoubleProduct(
+                    forNode(node->child1()).m_type, forNode(node->child2()).m_type));
+            break;
+        case UntypedUse:
+            clobberWorld(node->origin.semantic, clobberLimit);
+            forNode(node).setType(m_graph, SpecBytecodeNumber);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+        
+    case ArithDiv: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+            if (left && right && left.isInt32() && right.isInt32()) {
+                double doubleResult = left.asNumber() / right.asNumber();
+                if (!shouldCheckOverflow(node->arithMode()))
+                    doubleResult = toInt32(doubleResult);
+                else if (!shouldCheckNegativeZero(node->arithMode()))
+                    doubleResult += 0; // Sanitizes zero.
+                JSValue valueResult = jsNumber(doubleResult);
+                if (valueResult.isInt32()) {
+                    setConstant(node, valueResult);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case DoubleRepUse:
+            if (left && right && left.isNumber() && right.isNumber()) {
+                setConstant(node, jsDoubleNumber(left.asNumber() / right.asNumber()));
+                break;
+            }
+            forNode(node).setType(
+                typeOfDoubleQuotient(
+                    forNode(node->child1()).m_type, forNode(node->child2()).m_type));
+            break;
+        case UntypedUse:
+            clobberWorld(node->origin.semantic, clobberLimit);
+            forNode(node).setType(m_graph, SpecBytecodeNumber);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+
+    case ArithMod: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+            if (left && right && left.isInt32() && right.isInt32()) {
+                double doubleResult = fmod(left.asNumber(), right.asNumber());
+                if (!shouldCheckOverflow(node->arithMode()))
+                    doubleResult = toInt32(doubleResult);
+                else if (!shouldCheckNegativeZero(node->arithMode()))
+                    doubleResult += 0; // Sanitizes zero.
+                JSValue valueResult = jsNumber(doubleResult);
+                if (valueResult.isInt32()) {
+                    setConstant(node, valueResult);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case DoubleRepUse:
+            if (left && right && left.isNumber() && right.isNumber()) {
+                setConstant(node, jsDoubleNumber(fmod(left.asNumber(), right.asNumber())));
+                break;
+            }
+            forNode(node).setType(
+                typeOfDoubleBinaryOp(
+                    forNode(node->child1()).m_type, forNode(node->child2()).m_type));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+
+    case ArithMin: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+            if (left && right && left.isInt32() && right.isInt32()) {
+                setConstant(node, jsNumber(std::min(left.asInt32(), right.asInt32())));
+                break;
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case DoubleRepUse:
+            if (left && right && left.isNumber() && right.isNumber()) {
+                double a = left.asNumber();
+                double b = right.asNumber();
+                setConstant(node, jsDoubleNumber(a < b ? a : (b <= a ? b : a + b)));
+                break;
+            }
+            forNode(node).setType(
+                typeOfDoubleMinMax(
+                    forNode(node->child1()).m_type, forNode(node->child2()).m_type));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+            
+    case ArithMax: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+            if (left && right && left.isInt32() && right.isInt32()) {
+                setConstant(node, jsNumber(std::max(left.asInt32(), right.asInt32())));
+                break;
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case DoubleRepUse:
+            if (left && right && left.isNumber() && right.isNumber()) {
+                double a = left.asNumber();
+                double b = right.asNumber();
+                setConstant(node, jsDoubleNumber(a > b ? a : (b >= a ? b : a + b)));
+                break;
+            }
+            forNode(node).setType(
+                typeOfDoubleMinMax(
+                    forNode(node->child1()).m_type, forNode(node->child2()).m_type));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+            
+    case ArithAbs: {
+        JSValue child = forNode(node->child1()).value();
+        switch (node->child1().useKind()) {
+        case Int32Use:
+            if (std::optional<double> number = child.toNumberFromPrimitive()) {
+                JSValue result = jsNumber(fabs(*number));
+                if (result.isInt32()) {
+                    setConstant(node, result);
+                    break;
+                }
+            }
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case DoubleRepUse:
+            if (std::optional<double> number = child.toNumberFromPrimitive()) {
+                setConstant(node, jsDoubleNumber(fabs(*number)));
+                break;
+            }
+            forNode(node).setType(typeOfDoubleAbs(forNode(node->child1()).m_type));
+            break;
+        default:
+            DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse);
+            forNode(node).setType(SpecFullNumber);
+            break;
+        }
+        break;
+    }
+
+    case ArithPow: {
+        JSValue childY = forNode(node->child2()).value();
+        if (childY && childY.isNumber()) {
+            if (!childY.asNumber()) {
+                setConstant(node, jsDoubleNumber(1));
+                break;
+            }
+
+            JSValue childX = forNode(node->child1()).value();
+            if (childX && childX.isNumber()) {
+                setConstant(node, jsDoubleNumber(operationMathPow(childX.asNumber(), childY.asNumber())));
+                break;
+            }
+        }
+        forNode(node).setType(typeOfDoublePow(forNode(node->child1()).m_type, forNode(node->child2()).m_type));
+        break;
+    }
+
+    case ArithRandom: {
+        forNode(node).setType(m_graph, SpecDoubleReal);
+        break;
+    }
+
+    case ArithRound:
+    case ArithFloor:
+    case ArithCeil:
+    case ArithTrunc: {
+        JSValue operand = forNode(node->child1()).value();
+        if (std::optional<double> number = operand.toNumberFromPrimitive()) {
+            double roundedValue = 0;
+            if (node->op() == ArithRound)
+                roundedValue = jsRound(*number);
+            else if (node->op() == ArithFloor)
+                roundedValue = floor(*number);
+            else if (node->op() == ArithCeil)
+                roundedValue = ceil(*number);
+            else {
+                ASSERT(node->op() == ArithTrunc);
+                roundedValue = trunc(*number);
+            }
+
+            if (node->child1().useKind() == UntypedUse) {
+                setConstant(node, jsNumber(roundedValue));
+                break;
+            }
+            if (producesInteger(node->arithRoundingMode())) {
+                int32_t roundedValueAsInt32 = static_cast<int32_t>(roundedValue);
+                if (roundedValueAsInt32 == roundedValue) {
+                    if (shouldCheckNegativeZero(node->arithRoundingMode())) {
+                        if (roundedValueAsInt32 || !std::signbit(roundedValue)) {
+                            setConstant(node, jsNumber(roundedValueAsInt32));
+                            break;
+                        }
+                    } else {
+                        setConstant(node, jsNumber(roundedValueAsInt32));
+                        break;
+                    }
+                }
+            } else {
+                setConstant(node, jsDoubleNumber(roundedValue));
+                break;
+            }
+        }
+        if (node->child1().useKind() == DoubleRepUse) {
+            if (producesInteger(node->arithRoundingMode()))
+                forNode(node).setType(SpecInt32Only);
+            else if (node->child1().useKind() == DoubleRepUse)
+                forNode(node).setType(typeOfDoubleRounding(forNode(node->child1()).m_type));
+        } else {
+            DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse);
+            forNode(node).setType(SpecFullNumber);
+        }
+        break;
+    }
+            
+    case ArithSqrt:
+        executeDoubleUnaryOpEffects(node, sqrt);
+        break;
+
+    case ArithFRound:
+        executeDoubleUnaryOpEffects(node, [](double value) -> double { return static_cast<float>(value); });
+        break;
+        
+    case ArithSin:
+        executeDoubleUnaryOpEffects(node, sin);
+        break;
+    
+    case ArithCos:
+        executeDoubleUnaryOpEffects(node, cos);
+        break;
+
+    case ArithTan:
+        executeDoubleUnaryOpEffects(node, tan);
+        break;
+
+    case ArithLog:
+        executeDoubleUnaryOpEffects(node, log);
+        break;
+            
+    case LogicalNot: {
+        switch (booleanResult(node, forNode(node->child1()))) {
+        case DefinitelyTrue:
+            setConstant(node, jsBoolean(false));
+            break;
+        case DefinitelyFalse:
+            setConstant(node, jsBoolean(true));
+            break;
+        default:
+            forNode(node).setType(SpecBoolean);
+            break;
+        }
+        break;
+    }
+
+    case MapHash: {
+        if (JSValue key = forNode(node->child1()).value()) {
+            if (std::optional<uint32_t> hash = concurrentJSMapHash(key)) {
+                // Although C++ code uses uint32_t for the hash, the closest type in DFG IR is Int32
+                // and that's what MapHash returns. So, we have to cast to int32_t to avoid large
+                // unsigned values becoming doubles. This casting between signed and unsigned
+                // happens in the assembly code we emit when we don't constant fold this node.
+                setConstant(node, jsNumber(static_cast<int32_t>(*hash)));
+                break;
+            }
+        }
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+
+    case ToLowerCase: {
+        forNode(node).setType(m_graph, SpecString);
+        break;
+    }
+
+    case LoadFromJSMapBucket:
+        forNode(node).makeHeapTop();
+        break;
+
+    case GetMapBucket:
+        forNode(node).setType(m_graph, SpecCellOther);
+        break;
+
+    case IsNonEmptyMapBucket:
+        forNode(node).setType(SpecBoolean);
+        break;
+
+    case IsEmpty:
+    case IsUndefined:
+    case IsBoolean:
+    case IsNumber:
+    case IsObject:
+    case IsObjectOrNull:
+    case IsFunction:
+    case IsCellWithType:
+    case IsTypedArrayView: {
+        AbstractValue child = forNode(node->child1());
+        if (child.value()) {
+            bool constantWasSet = true;
+            switch (node->op()) {
+            case IsCellWithType:
+                setConstant(node, jsBoolean(child.value().isCell() && child.value().asCell()->type() == node->queriedType()));
+                break;
+            case IsUndefined:
+                setConstant(node, jsBoolean(
+                    child.value().isCell()
+                    ? child.value().asCell()->structure()->masqueradesAsUndefined(m_codeBlock->globalObjectFor(node->origin.semantic))
+                    : child.value().isUndefined()));
+                break;
+            case IsBoolean:
+                setConstant(node, jsBoolean(child.value().isBoolean()));
+                break;
+            case IsNumber:
+                setConstant(node, jsBoolean(child.value().isNumber()));
+                break;
+            case IsObject:
+                setConstant(node, jsBoolean(child.value().isObject()));
+                break;
+            case IsObjectOrNull:
+                if (child.value().isObject()) {
+                    JSObject* object = asObject(child.value());
+                    if (object->type() == JSFunctionType)
+                        setConstant(node, jsBoolean(false));
+                    else if (!(object->inlineTypeFlags() & TypeOfShouldCallGetCallData))
+                        setConstant(node, jsBoolean(!child.value().asCell()->structure()->masqueradesAsUndefined(m_codeBlock->globalObjectFor(node->origin.semantic))));
+                    else {
+                        // FIXME: This could just call getCallData.
+                        // https://bugs.webkit.org/show_bug.cgi?id=144457
+                        constantWasSet = false;
+                    }
+                } else
+                    setConstant(node, jsBoolean(child.value().isNull()));
+                break;
+            case IsFunction:
+                if (child.value().isObject()) {
+                    JSObject* object = asObject(child.value());
+                    if (object->type() == JSFunctionType)
+                        setConstant(node, jsBoolean(true));
+                    else if (!(object->inlineTypeFlags() & TypeOfShouldCallGetCallData))
+                        setConstant(node, jsBoolean(false));
+                    else {
+                        // FIXME: This could just call getCallData.
+                        // https://bugs.webkit.org/show_bug.cgi?id=144457
+                        constantWasSet = false;
+                    }
+                } else
+                    setConstant(node, jsBoolean(false));
+                break;
+            case IsEmpty:
+                setConstant(node, jsBoolean(child.value().isEmpty()));
+                break;
+            case IsTypedArrayView:
+                setConstant(node, jsBoolean(child.value().isObject() && isTypedView(child.value().getObject()->classInfo()->typedArrayStorageType)));
+                break;
+            default:
+                constantWasSet = false;
+                break;
+            }
+            if (constantWasSet)
+                break;
+        }
+        
+        // FIXME: This code should really use AbstractValue::isType() and
+        // AbstractValue::couldBeType().
+        // https://bugs.webkit.org/show_bug.cgi?id=146870
+        
+        bool constantWasSet = false;
+        switch (node->op()) {
+        case IsEmpty: {
+            if (child.m_type && !(child.m_type & SpecEmpty)) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+
+            if (child.m_type && !(child.m_type & ~SpecEmpty)) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+
+            break;
+        }
+        case IsUndefined:
+            // FIXME: Use the masquerades-as-undefined watchpoint thingy.
+            // https://bugs.webkit.org/show_bug.cgi?id=144456
+            
+            if (!(child.m_type & (SpecOther | SpecObjectOther))) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            
+            break;
+        case IsBoolean:
+            if (!(child.m_type & ~SpecBoolean)) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+            
+            if (!(child.m_type & SpecBoolean)) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            
+            break;
+        case IsNumber:
+            if (!(child.m_type & ~SpecFullNumber)) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+            
+            if (!(child.m_type & SpecFullNumber)) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            
+            break;
+        case IsObject:
+            if (!(child.m_type & ~SpecObject)) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+            
+            if (!(child.m_type & SpecObject)) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            
+            break;
+        case IsObjectOrNull:
+            // FIXME: Use the masquerades-as-undefined watchpoint thingy.
+            // https://bugs.webkit.org/show_bug.cgi?id=144456
+            
+            // These expressions are complicated to parse. A helpful way to parse this is that
+            // "!(T & ~S)" means "T is a subset of S". Conversely, "!(T & S)" means "T is a
+            // disjoint set from S". Things like "T - S" means that, provided that S is a
+            // subset of T, it's the "set of all things in T but not in S". Things like "T | S"
+            // mean the "union of T and S".
+            
+            // Is the child's type an object that isn't an other-object (i.e. object that could
+            // have masquaredes-as-undefined traps) and isn't a function?  Then: we should fold
+            // this to true.
+            if (!(child.m_type & ~(SpecObject - SpecObjectOther - SpecFunction))) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+            
+            // Is the child's type definitely not either of: an object that isn't a function,
+            // or either undefined or null?  Then: we should fold this to false.  This means
+            // for example that if it's any non-function object, including those that have
+            // masquerades-as-undefined traps, then we don't fold. It also means we won't fold
+            // if it's undefined-or-null, since the type bits don't distinguish between
+            // undefined (which should fold to false) and null (which should fold to true).
+            if (!(child.m_type & ((SpecObject - SpecFunction) | SpecOther))) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            
+            break;
+        case IsFunction:
+            if (!(child.m_type & ~SpecFunction)) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+            
+            if (!(child.m_type & (SpecFunction | SpecObjectOther | SpecProxyObject))) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            break;
+
+        case IsCellWithType:
+            if (!(child.m_type & ~node->speculatedTypeForQuery())) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+            if (!(child.m_type & node->speculatedTypeForQuery())) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            break;
+
+        case IsTypedArrayView:
+            if (!(child.m_type & ~SpecTypedArrayView)) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+            if (!(child.m_type & SpecTypedArrayView)) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            break;
+
+        default:
+            break;
+        }
+        if (constantWasSet)
+            break;
+        
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+
+    case TypeOf: {
+        VM* vm = m_codeBlock->vm();
+        JSValue child = forNode(node->child1()).value();
+        AbstractValue& abstractChild = forNode(node->child1());
+        if (child) {
+            JSValue typeString = jsTypeStringForValue(*vm, m_codeBlock->globalObjectFor(node->origin.semantic), child);
+            setConstant(node, *m_graph.freeze(typeString));
+            break;
+        }
+        
+        if (isFullNumberSpeculation(abstractChild.m_type)) {
+            setConstant(node, *m_graph.freeze(vm->smallStrings.numberString()));
+            break;
+        }
+        
+        if (isStringSpeculation(abstractChild.m_type)) {
+            setConstant(node, *m_graph.freeze(vm->smallStrings.stringString()));
+            break;
+        }
+
+        // FIXME: We could use the masquerades-as-undefined watchpoint here.
+        // https://bugs.webkit.org/show_bug.cgi?id=144456
+        if (!(abstractChild.m_type & ~(SpecObject - SpecObjectOther - SpecFunction))) {
+            setConstant(node, *m_graph.freeze(vm->smallStrings.objectString()));
+            break;
+        }
+        
+        if (isFunctionSpeculation(abstractChild.m_type)) {
+            setConstant(node, *m_graph.freeze(vm->smallStrings.functionString()));
+            break;
+        }
+        
+        if (isBooleanSpeculation(abstractChild.m_type)) {
+            setConstant(node, *m_graph.freeze(vm->smallStrings.booleanString()));
+            break;
+        }
+
+        if (isSymbolSpeculation(abstractChild.m_type)) {
+            setConstant(node, *m_graph.freeze(vm->smallStrings.symbolString()));
+            break;
+        }
+
+        forNode(node).setType(m_graph, SpecStringIdent);
+        break;
+    }
+            
+    case CompareLess:
+    case CompareLessEq:
+    case CompareGreater:
+    case CompareGreaterEq:
+    case CompareEq: {
+        JSValue leftConst = forNode(node->child1()).value();
+        JSValue rightConst = forNode(node->child2()).value();
+        if (leftConst && rightConst) {
+            if (leftConst.isNumber() && rightConst.isNumber()) {
+                double a = leftConst.asNumber();
+                double b = rightConst.asNumber();
+                switch (node->op()) {
+                case CompareLess:
+                    setConstant(node, jsBoolean(a < b));
+                    break;
+                case CompareLessEq:
+                    setConstant(node, jsBoolean(a <= b));
+                    break;
+                case CompareGreater:
+                    setConstant(node, jsBoolean(a > b));
+                    break;
+                case CompareGreaterEq:
+                    setConstant(node, jsBoolean(a >= b));
+                    break;
+                case CompareEq:
+                    setConstant(node, jsBoolean(a == b));
+                    break;
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                    break;
+                }
+                break;
+            }
+            
+            if (leftConst.isString() && rightConst.isString()) {
+                const StringImpl* a = asString(leftConst)->tryGetValueImpl();
+                const StringImpl* b = asString(rightConst)->tryGetValueImpl();
+                if (a && b) {
+                    bool result;
+                    if (node->op() == CompareEq)
+                        result = WTF::equal(a, b);
+                    else if (node->op() == CompareLess)
+                        result = codePointCompare(a, b) < 0;
+                    else if (node->op() == CompareLessEq)
+                        result = codePointCompare(a, b) <= 0;
+                    else if (node->op() == CompareGreater)
+                        result = codePointCompare(a, b) > 0;
+                    else if (node->op() == CompareGreaterEq)
+                        result = codePointCompare(a, b) >= 0;
+                    else
+                        RELEASE_ASSERT_NOT_REACHED();
+                    setConstant(node, jsBoolean(result));
+                    break;
+                }
+            }
+
+            if (node->op() == CompareEq && leftConst.isSymbol() && rightConst.isSymbol()) {
+                setConstant(node, jsBoolean(asSymbol(leftConst) == asSymbol(rightConst)));
+                break;
+            }
+        }
+        
+        if (node->op() == CompareEq) {
+            SpeculatedType leftType = forNode(node->child1()).m_type;
+            SpeculatedType rightType = forNode(node->child2()).m_type;
+            if (!valuesCouldBeEqual(leftType, rightType)) {
+                setConstant(node, jsBoolean(false));
+                break;
+            }
+
+            if (leftType == SpecOther)
+                std::swap(leftType, rightType);
+            if (rightType == SpecOther) {
+                // Undefined and Null are always equal when compared to eachother.
+                if (!(leftType & ~SpecOther)) {
+                    setConstant(node, jsBoolean(true));
+                    break;
+                }
+
+                // Any other type compared to Null or Undefined is always false
+                // as long as the MasqueradesAsUndefined watchpoint is valid.
+                //
+                // MasqueradesAsUndefined only matters for SpecObjectOther, other
+                // cases are always "false".
+                if (!(leftType & (SpecObjectOther | SpecOther))) {
+                    setConstant(node, jsBoolean(false));
+                    break;
+                }
+
+                if (!(leftType & SpecOther) && m_graph.masqueradesAsUndefinedWatchpointIsStillValid(node->origin.semantic)) {
+                    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
+                    m_graph.watchpoints().addLazily(globalObject->masqueradesAsUndefinedWatchpoint());
+                    setConstant(node, jsBoolean(false));
+                    break;
+                }
+            }
+        }
+        
+        if (node->child1() == node->child2()) {
+            if (node->isBinaryUseKind(Int32Use) ||
+                node->isBinaryUseKind(Int52RepUse) ||
+                node->isBinaryUseKind(StringUse) ||
+                node->isBinaryUseKind(BooleanUse) ||
+                node->isBinaryUseKind(SymbolUse) ||
+                node->isBinaryUseKind(StringIdentUse) ||
+                node->isBinaryUseKind(ObjectUse) ||
+                node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse) ||
+                node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse)) {
+                switch (node->op()) {
+                case CompareLess:
+                case CompareGreater:
+                    setConstant(node, jsBoolean(false));
+                    break;
+                case CompareLessEq:
+                case CompareGreaterEq:
+                case CompareEq:
+                    setConstant(node, jsBoolean(true));
+                    break;
+                default:
+                    DFG_CRASH(m_graph, node, "Unexpected node type");
+                    break;
+                }
+                break;
+            }
+        }
+        
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+            
+    case CompareStrictEq: {
+        Node* leftNode = node->child1().node();
+        Node* rightNode = node->child2().node();
+        JSValue left = forNode(leftNode).value();
+        JSValue right = forNode(rightNode).value();
+        if (left && right) {
+            if (left.isString() && right.isString()) {
+                // We need this case because JSValue::strictEqual is otherwise too racy for
+                // string comparisons.
+                const StringImpl* a = asString(left)->tryGetValueImpl();
+                const StringImpl* b = asString(right)->tryGetValueImpl();
+                if (a && b) {
+                    setConstant(node, jsBoolean(WTF::equal(a, b)));
+                    break;
+                }
+            } else {
+                setConstant(node, jsBoolean(JSValue::strictEqual(0, left, right)));
+                break;
+            }
+        }
+        
+        SpeculatedType leftLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(leftNode).m_type);
+        SpeculatedType rightLUB = leastUpperBoundOfStrictlyEquivalentSpeculations(forNode(rightNode).m_type);
+        if (!(leftLUB & rightLUB)) {
+            setConstant(node, jsBoolean(false));
+            break;
+        }
+        
+        if (node->child1() == node->child2()) {
+            if (node->isBinaryUseKind(BooleanUse) ||
+                node->isBinaryUseKind(Int32Use) ||
+                node->isBinaryUseKind(Int52RepUse) ||
+                node->isBinaryUseKind(StringUse) ||
+                node->isBinaryUseKind(StringIdentUse) ||
+                node->isBinaryUseKind(SymbolUse) ||
+                node->isBinaryUseKind(ObjectUse) ||
+                node->isBinaryUseKind(MiscUse, UntypedUse) ||
+                node->isBinaryUseKind(UntypedUse, MiscUse) ||
+                node->isBinaryUseKind(StringIdentUse, NotStringVarUse) ||
+                node->isBinaryUseKind(NotStringVarUse, StringIdentUse) ||
+                node->isBinaryUseKind(StringUse, UntypedUse) ||
+                node->isBinaryUseKind(UntypedUse, StringUse)) {
+                setConstant(node, jsBoolean(true));
+                break;
+            }
+        }
+
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+        
+    case CompareEqPtr: {
+        Node* childNode = node->child1().node();
+        JSValue childValue = forNode(childNode).value();
+        if (childValue) {
+            setConstant(node, jsBoolean(childValue.isCell() && childValue.asCell() == node->cellOperand()->cell()));
+            break;
+        }
+        
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+        
+    case StringCharCodeAt:
+        forNode(node).setType(SpecInt32Only);
+        break;
+        
+    case StringFromCharCode:
+        forNode(node).setType(m_graph, SpecString);
+        break;
+
+    case StringCharAt:
+        forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());
+        break;
+            
+    case GetByVal: {
+        switch (node->arrayMode().type()) {
+        case Array::SelectUsingPredictions:
+        case Array::Unprofiled:
+        case Array::SelectUsingArguments:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        case Array::ForceExit:
+            m_state.setIsValid(false);
+            break;
+        case Array::Undecided: {
+            JSValue index = forNode(node->child2()).value();
+            if (index && index.isInt32() && index.asInt32() >= 0) {
+                setConstant(node, jsUndefined());
+                break;
+            }
+            forNode(node).setType(SpecOther);
+            break;
+        }
+        case Array::Generic:
+            clobberWorld(node->origin.semantic, clobberLimit);
+            forNode(node).makeHeapTop();
+            break;
+        case Array::String:
+            if (node->arrayMode().isOutOfBounds()) {
+                // If the watchpoint was still valid we could totally set this to be
+                // SpecString | SpecOther. Except that we'd have to be careful. If we
+                // tested the watchpoint state here then it could change by the time
+                // we got to the backend. So to do this right, we'd have to get the
+                // fixup phase to check the watchpoint state and then bake into the
+                // GetByVal operation the fact that we're using a watchpoint, using
+                // something like Array::SaneChain (except not quite, because that
+                // implies an in-bounds access). None of this feels like it's worth it,
+                // so we're going with TOP for now. The same thing applies to
+                // clobbering the world.
+                clobberWorld(node->origin.semantic, clobberLimit);
+                forNode(node).makeHeapTop();
+            } else
+                forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());
+            break;
+        case Array::DirectArguments:
+        case Array::ScopedArguments:
+            forNode(node).makeHeapTop();
+            break;
+        case Array::Int32:
+            if (node->arrayMode().isOutOfBounds()) {
+                clobberWorld(node->origin.semantic, clobberLimit);
+                forNode(node).makeHeapTop();
+            } else
+                forNode(node).setType(SpecInt32Only);
+            break;
+        case Array::Double:
+            if (node->arrayMode().isOutOfBounds()) {
+                clobberWorld(node->origin.semantic, clobberLimit);
+                forNode(node).makeHeapTop();
+            } else if (node->arrayMode().isSaneChain())
+                forNode(node).setType(SpecBytecodeDouble);
+            else
+                forNode(node).setType(SpecDoubleReal);
+            break;
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            if (node->arrayMode().isOutOfBounds())
+                clobberWorld(node->origin.semantic, clobberLimit);
+            forNode(node).makeHeapTop();
+            break;
+        case Array::Int8Array:
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Array::Int16Array:
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Array::Int32Array:
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Array::Uint8Array:
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Array::Uint8ClampedArray:
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Array::Uint16Array:
+            forNode(node).setType(SpecInt32Only);
+            break;
+        case Array::Uint32Array:
+            if (node->shouldSpeculateInt32())
+                forNode(node).setType(SpecInt32Only);
+            else if (enableInt52() && node->shouldSpeculateAnyInt())
+                forNode(node).setType(SpecAnyInt);
+            else
+                forNode(node).setType(SpecAnyIntAsDouble);
+            break;
+        case Array::Float32Array:
+            forNode(node).setType(SpecFullDouble);
+            break;
+        case Array::Float64Array:
+            forNode(node).setType(SpecFullDouble);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+            
+    case PutByValDirect:
+    case PutByVal:
+    case PutByValAlias: {
+        switch (node->arrayMode().modeForPut().type()) {
+        case Array::ForceExit:
+            m_state.setIsValid(false);
+            break;
+        case Array::Generic:
+            clobberWorld(node->origin.semantic, clobberLimit);
+            break;
+        case Array::Int32:
+            if (node->arrayMode().isOutOfBounds())
+                clobberWorld(node->origin.semantic, clobberLimit);
+            break;
+        case Array::Double:
+            if (node->arrayMode().isOutOfBounds())
+                clobberWorld(node->origin.semantic, clobberLimit);
+            break;
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+            if (node->arrayMode().isOutOfBounds())
+                clobberWorld(node->origin.semantic, clobberLimit);
+            break;
+        case Array::SlowPutArrayStorage:
+            if (node->arrayMode().mayStoreToHole())
+                clobberWorld(node->origin.semantic, clobberLimit);
+            break;
+        default:
+            break;
+        }
+        break;
+    }
+            
+    case ArrayPush:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(SpecBytecodeNumber);
+        break;
+
+    case ArraySlice: {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
+
+        // FIXME: We could do better here if we prove that the
+        // incoming value has only a single structure.
+        RegisteredStructureSet structureSet;
+        structureSet.add(m_graph.registerStructure(globalObject->originalArrayStructureForIndexingType(ArrayWithInt32)));
+        structureSet.add(m_graph.registerStructure(globalObject->originalArrayStructureForIndexingType(ArrayWithContiguous)));
+        structureSet.add(m_graph.registerStructure(globalObject->originalArrayStructureForIndexingType(ArrayWithDouble)));
+
+        forNode(node).set(m_graph, structureSet);
+        break;
+    }
+            
+    case ArrayPop:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).makeHeapTop();
+        break;
+        
+    case GetMyArgumentByVal:
+    case GetMyArgumentByValOutOfBounds: {
+        JSValue index = forNode(node->child2()).m_value;
+        InlineCallFrame* inlineCallFrame = node->child1()->origin.semantic.inlineCallFrame;
+
+        if (index && index.isInt32()) {
+            // This pretends to return TOP for accesses that are actually proven out-of-bounds because
+            // that's the conservative thing to do. Otherwise we'd need to write more code to mark such
+            // paths as unreachable, or to return undefined. We could implement that eventually.
+            
+            unsigned argumentIndex = index.asUInt32() + node->numberOfArgumentsToSkip();
+            if (inlineCallFrame) {
+                if (argumentIndex < inlineCallFrame->arguments.size() - 1) {
+                    forNode(node) = m_state.variables().operand(
+                        virtualRegisterForArgument(argumentIndex + 1) + inlineCallFrame->stackOffset);
+                    m_state.setFoundConstants(true);
+                    break;
+                }
+            } else {
+                if (argumentIndex < m_state.variables().numberOfArguments() - 1) {
+                    forNode(node) = m_state.variables().argument(argumentIndex + 1);
+                    m_state.setFoundConstants(true);
+                    break;
+                }
+            }
+        }
+        
+        if (inlineCallFrame) {
+            // We have a bound on the types even though it's random access. Take advantage of this.
+            
+            AbstractValue result;
+            for (unsigned i = 1 + node->numberOfArgumentsToSkip(); i < inlineCallFrame->arguments.size(); ++i) {
+                result.merge(
+                    m_state.variables().operand(
+                        virtualRegisterForArgument(i) + inlineCallFrame->stackOffset));
+            }
+            
+            if (node->op() == GetMyArgumentByValOutOfBounds)
+                result.merge(SpecOther);
+            
+            if (result.value())
+                m_state.setFoundConstants(true);
+            
+            forNode(node) = result;
+            break;
+        }
+        
+        forNode(node).makeHeapTop();
+        break;
+    }
+            
+    case RegExpExec:
+        if (node->child2().useKind() == RegExpObjectUse
+            && node->child3().useKind() == StringUse) {
+            // This doesn't clobber the world since there are no conversions to perform.
+        } else
+            clobberWorld(node->origin.semantic, clobberLimit);
+        if (JSValue globalObjectValue = forNode(node->child1()).m_value) {
+            if (JSGlobalObject* globalObject = jsDynamicCast<JSGlobalObject*>(globalObjectValue)) {
+                if (!globalObject->isHavingABadTime()) {
+                    m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
+                    Structure* structure = globalObject->regExpMatchesArrayStructure();
+                    m_graph.registerStructure(structure);
+                    forNode(node).set(m_graph, structure);
+                    forNode(node).merge(SpecOther);
+                    break;
+                }
+            }
+        }
+        forNode(node).setType(m_graph, SpecOther | SpecArray);
+        break;
+
+    case RegExpTest:
+        if (node->child2().useKind() == RegExpObjectUse
+            && node->child3().useKind() == StringUse) {
+            // This doesn't clobber the world since there are no conversions to perform.
+        } else
+            clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(SpecBoolean);
+        break;
+            
+    case StringReplace:
+    case StringReplaceRegExp:
+        if (node->child1().useKind() == StringUse
+            && node->child2().useKind() == RegExpObjectUse
+            && node->child3().useKind() == StringUse) {
+            // This doesn't clobber the world. It just reads and writes regexp state.
+        } else
+            clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());
+        break;
+
+    case Jump:
+        break;
+            
+    case Branch: {
+        Node* child = node->child1().node();
+        BooleanResult result = booleanResult(node, forNode(child));
+        if (result == DefinitelyTrue) {
+            m_state.setBranchDirection(TakeTrue);
+            break;
+        }
+        if (result == DefinitelyFalse) {
+            m_state.setBranchDirection(TakeFalse);
+            break;
+        }
+        // FIXME: The above handles the trivial cases of sparse conditional
+        // constant propagation, but we can do better:
+        // We can specialize the source variable's value on each direction of
+        // the branch.
+        m_state.setBranchDirection(TakeBoth);
+        break;
+    }
+        
+    case Switch: {
+        // Nothing to do for now.
+        // FIXME: Do sparse conditional things.
+        break;
+    }
+            
+    case Return:
+        m_state.setIsValid(false);
+        break;
+
+    case TailCall:
+    case DirectTailCall:
+    case TailCallVarargs:
+    case TailCallForwardVarargs:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        m_state.setIsValid(false);
+        break;
+        
+    case Throw:
+    case ThrowStaticError:
+        m_state.setIsValid(false);
+        break;
+            
+    case ToPrimitive: {
+        JSValue childConst = forNode(node->child1()).value();
+        if (childConst && childConst.isNumber()) {
+            setConstant(node, childConst);
+            break;
+        }
+        
+        ASSERT(node->child1().useKind() == UntypedUse);
+        
+        if (!(forNode(node->child1()).m_type & ~(SpecFullNumber | SpecBoolean | SpecString | SpecSymbol))) {
+            m_state.setFoundConstants(true);
+            forNode(node) = forNode(node->child1());
+            break;
+        }
+        
+        clobberWorld(node->origin.semantic, clobberLimit);
+        
+        forNode(node).setType(m_graph, SpecHeapTop & ~SpecObject);
+        break;
+    }
+
+    case ToNumber: {
+        JSValue childConst = forNode(node->child1()).value();
+        if (childConst && childConst.isNumber()) {
+            setConstant(node, childConst);
+            break;
+        }
+
+        ASSERT(node->child1().useKind() == UntypedUse);
+
+        if (!(forNode(node->child1()).m_type & ~SpecBytecodeNumber)) {
+            m_state.setFoundConstants(true);
+            forNode(node) = forNode(node->child1());
+            break;
+        }
+
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(m_graph, SpecBytecodeNumber);
+        break;
+    }
+        
+    case ToString:
+    case CallStringConstructor: {
+        switch (node->child1().useKind()) {
+        case StringObjectUse:
+            // This also filters that the StringObject has the primordial StringObject
+            // structure.
+            filter(
+                node->child1(),
+                m_graph.registerStructure(m_graph.globalObjectFor(node->origin.semantic)->stringObjectStructure()));
+            break;
+        case StringOrStringObjectUse:
+            break;
+        case CellUse:
+        case UntypedUse:
+            clobberWorld(node->origin.semantic, clobberLimit);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());
+        break;
+    }
+        
+    case NewStringObject: {
+        ASSERT(node->structure()->classInfo() == StringObject::info());
+        forNode(node).set(m_graph, node->structure());
+        break;
+    }
+            
+    case NewArray:
+        forNode(node).set(
+            m_graph,
+            m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
+        break;
+
+    case NewArrayWithSpread:
+        if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
+            // We've compiled assuming we're not having a bad time, so to be consistent
+            // with StructureRegisterationPhase we must say we produce an original array
+            // allocation structure.
+            forNode(node).set(
+                m_graph,
+                m_graph.globalObjectFor(node->origin.semantic)->originalArrayStructureForIndexingType(ArrayWithContiguous));
+        } else {
+            forNode(node).set(
+                m_graph,
+                m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous));
+        }
+
+        break;
+
+    case Spread:
+        forNode(node).set(
+            m_graph, m_graph.m_vm.fixedArrayStructure.get());
+        break;
+        
+    case NewArrayBuffer:
+        forNode(node).set(
+            m_graph,
+            m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
+        break;
+
+    case NewArrayWithSize:
+        forNode(node).setType(m_graph, SpecArray);
+        break;
+        
+    case NewTypedArray:
+        switch (node->child1().useKind()) {
+        case Int32Use:
+            break;
+        case UntypedUse:
+            clobberWorld(node->origin.semantic, clobberLimit);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        forNode(node).set(
+            m_graph,
+            m_graph.globalObjectFor(node->origin.semantic)->typedArrayStructureConcurrently(
+                node->typedArrayType()));
+        break;
+        
+    case NewRegexp:
+        forNode(node).set(m_graph, m_graph.globalObjectFor(node->origin.semantic)->regExpStructure());
+        break;
+            
+    case ToThis: {
+        AbstractValue& source = forNode(node->child1());
+        AbstractValue& destination = forNode(node);
+        bool strictMode = m_graph.executableFor(node->origin.semantic)->isStrictMode();
+
+        if (isToThisAnIdentity(strictMode, source)) {
+            m_state.setFoundConstants(true);
+            destination = source;
+            break;
+        }
+
+        if (strictMode)
+            destination.makeHeapTop();
+        else {
+            destination = source;
+            destination.merge(SpecObject);
+        }
+        break;
+    }
+
+    case CreateThis: {
+        // FIXME: We can fold this to NewObject if the incoming callee is a constant.
+        forNode(node).setType(m_graph, SpecFinalObject);
+        break;
+    }
+        
+    case NewObject:
+        ASSERT(!!node->structure().get());
+        forNode(node).set(m_graph, node->structure());
+        break;
+
+    case CallObjectConstructor: {
+        AbstractValue& source = forNode(node->child1());
+        AbstractValue& destination = forNode(node);
+
+        if (!(source.m_type & ~SpecObject)) {
+            m_state.setFoundConstants(true);
+            destination = source;
+            break;
+        }
+
+        forNode(node).setType(m_graph, SpecObject);
+        break;
+    }
+
+    case PhantomNewObject:
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomCreateActivation:
+    case PhantomDirectArguments:
+    case PhantomClonedArguments:
+    case PhantomCreateRest:
+    case PhantomSpread:
+    case PhantomNewArrayWithSpread:
+    case BottomValue:
+        m_state.setDidClobber(true); // Prevent constant folding.
+        // This claims to return bottom.
+        break;
+        
+    case PutHint:
+        break;
+        
+    case MaterializeNewObject: {
+        forNode(node).set(m_graph, node->structureSet());
+        break;
+    }
+
+    case CreateActivation:
+    case MaterializeCreateActivation:
+        forNode(node).set(
+            m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->activationStructure());
+        break;
+        
+    case CreateDirectArguments:
+        forNode(node).set(m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->directArgumentsStructure());
+        break;
+        
+    case CreateScopedArguments:
+        forNode(node).set(m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->scopedArgumentsStructure());
+        break;
+        
+    case CreateClonedArguments:
+        if (!m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
+            forNode(node).setType(m_graph, SpecObject);
+            break;
+        }
+        forNode(node).set(m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->clonedArgumentsStructure());
+        break;
+
+    case NewGeneratorFunction:
+        forNode(node).set(
+            m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->generatorFunctionStructure());
+        break;
+
+    case NewAsyncFunction:
+        forNode(node).set(
+            m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->asyncFunctionStructure());
+        break;
+
+    case NewFunction:
+        forNode(node).set(
+            m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->functionStructure());
+        break;
+        
+    case GetCallee:
+        if (FunctionExecutable* executable = jsDynamicCast<FunctionExecutable*>(m_codeBlock->ownerExecutable())) {
+            InferredValue* singleton = executable->singletonFunction();
+            if (JSValue value = singleton->inferredValue()) {
+                m_graph.watchpoints().addLazily(singleton);
+                JSFunction* function = jsCast<JSFunction*>(value);
+                setConstant(node, *m_graph.freeze(function));
+                break;
+            }
+        }
+        forNode(node).setType(m_graph, SpecFunction);
+        break;
+        
+    case GetArgumentCountIncludingThis:
+        forNode(node).setType(SpecInt32Only);
+        break;
+        
+    case GetRestLength:
+        forNode(node).setType(SpecInt32Only);
+        break;
+        
+    case GetGetter: {
+        JSValue base = forNode(node->child1()).m_value;
+        if (base) {
+            GetterSetter* getterSetter = jsCast<GetterSetter*>(base);
+            if (!getterSetter->isGetterNull()) {
+                setConstant(node, *m_graph.freeze(getterSetter->getterConcurrently()));
+                break;
+            }
+        }
+        
+        forNode(node).setType(m_graph, SpecObject);
+        break;
+    }
+        
+    case GetSetter: {
+        JSValue base = forNode(node->child1()).m_value;
+        if (base) {
+            GetterSetter* getterSetter = jsCast<GetterSetter*>(base);
+            if (!getterSetter->isSetterNull()) {
+                setConstant(node, *m_graph.freeze(getterSetter->setterConcurrently()));
+                break;
+            }
+        }
+        
+        forNode(node).setType(m_graph, SpecObject);
+        break;
+    }
+        
+    case GetScope:
+        if (JSValue base = forNode(node->child1()).m_value) {
+            if (JSFunction* function = jsDynamicCast<JSFunction*>(base)) {
+                setConstant(node, *m_graph.freeze(function->scope()));
+                break;
+            }
+        }
+        forNode(node).setType(m_graph, SpecObjectOther);
+        break;
+
+    case SkipScope: {
+        JSValue child = forNode(node->child1()).value();
+        if (child) {
+            setConstant(node, *m_graph.freeze(JSValue(jsCast<JSScope*>(child.asCell())->next())));
+            break;
+        }
+        forNode(node).setType(m_graph, SpecObjectOther);
+        break;
+    }
+
+    case GetGlobalObject: {
+        JSValue child = forNode(node->child1()).value();
+        if (child) {
+            setConstant(node, *m_graph.freeze(JSValue(asObject(child)->globalObject())));
+            break;
+        }
+
+        if (forNode(node->child1()).m_structure.isFinite()) {
+            JSGlobalObject* globalObject = nullptr;
+            bool ok = true;
+            forNode(node->child1()).m_structure.forEach(
+                [&] (RegisteredStructure structure) {
+                    if (!globalObject)
+                        globalObject = structure->globalObject();
+                    else if (globalObject != structure->globalObject())
+                        ok = false;
+                });
+            if (globalObject && ok) {
+                setConstant(node, *m_graph.freeze(JSValue(globalObject)));
+                break;
+            }
+        }
+
+        forNode(node).setType(m_graph, SpecObjectOther);
+        break;
+    }
+
+    case GetClosureVar:
+        if (JSValue value = m_graph.tryGetConstantClosureVar(forNode(node->child1()), node->scopeOffset())) {
+            setConstant(node, *m_graph.freeze(value));
+            break;
+        }
+        forNode(node).makeBytecodeTop();
+        break;
+            
+    case PutClosureVar:
+        break;
+
+    case GetRegExpObjectLastIndex:
+        forNode(node).makeHeapTop();
+        break;
+
+    case SetRegExpObjectLastIndex:
+    case RecordRegExpCachedResult:
+        break;
+        
+    case GetFromArguments:
+        forNode(node).makeHeapTop();
+        break;
+        
+    case PutToArguments:
+        break;
+
+    case GetArgument:
+        forNode(node).makeHeapTop();
+        break;
+
+    case TryGetById:
+        // FIXME: This should constant fold at least as well as the normal GetById case.
+        // https://bugs.webkit.org/show_bug.cgi?id=156422
+        forNode(node).makeHeapTop();
+        break;
+
+    case GetById:
+    case GetByIdFlush: {
+        if (!node->prediction()) {
+            m_state.setIsValid(false);
+            break;
+        }
+        
+        AbstractValue& value = forNode(node->child1());
+        if (value.m_structure.isFinite()
+            && (node->child1().useKind() == CellUse || !(value.m_type & ~SpecCell))) {
+            UniquedStringImpl* uid = m_graph.identifiers()[node->identifierNumber()];
+            GetByIdStatus status = GetByIdStatus::computeFor(value.m_structure.toStructureSet(), uid);
+            if (status.isSimple()) {
+                // Figure out what the result is going to be - is it TOP, a constant, or maybe
+                // something more subtle?
+                AbstractValue result;
+                for (unsigned i = status.numVariants(); i--;) {
+                    // This thing won't give us a variant that involves prototypes. If it did, we'd
+                    // have more work to do here.
+                    DFG_ASSERT(m_graph, node, status[i].conditionSet().isEmpty());
+
+                    result.merge(
+                        m_graph.inferredValueForProperty(
+                            value, uid, status[i].offset(), m_state.structureClobberState()));
+                }
+                m_state.setFoundConstants(true);
+                forNode(node) = result;
+                break;
+            }
+        }
+
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).makeHeapTop();
+        break;
+    }
+
+    case GetByValWithThis:
+    case GetByIdWithThis:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).makeHeapTop();
+        break;
+            
+    case GetArrayLength: {
+        JSArrayBufferView* view = m_graph.tryGetFoldableView(
+            forNode(node->child1()).m_value, node->arrayMode());
+        if (view) {
+            setConstant(node, jsNumber(view->length()));
+            break;
+        }
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+
+    case DeleteById:
+    case DeleteByVal: {
+        // FIXME: This could decide if the delete will be successful based on the set of structures that
+        // we get from our base value. https://bugs.webkit.org/show_bug.cgi?id=156611
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+        
+    case CheckStructure: {
+        AbstractValue& value = forNode(node->child1());
+
+        const RegisteredStructureSet& set = node->structureSet();
+        
+        // It's interesting that we could have proven that the object has a larger structure set
+        // that includes the set we're testing. In that case we could make the structure check
+        // more efficient. We currently don't.
+        
+        if (value.m_structure.isSubsetOf(set))
+            m_state.setFoundConstants(true);
+
+        SpeculatedType admittedTypes = SpecNone;
+        switch (node->child1().useKind()) {
+        case CellUse:
+        case KnownCellUse:
+            admittedTypes = SpecNone;
+            break;
+        case CellOrOtherUse:
+            admittedTypes = SpecOther;
+            break;
+        default:
+            DFG_CRASH(m_graph, node, "Bad use kind");
+            break;
+        }
+        
+        filter(value, set, admittedTypes);
+        break;
+    }
+        
+    case CheckStructureImmediate: {
+        // FIXME: This currently can only reason about one structure at a time.
+        // https://bugs.webkit.org/show_bug.cgi?id=136988
+        
+        AbstractValue& value = forNode(node->child1());
+        const RegisteredStructureSet& set = node->structureSet();
+        
+        if (value.value()) {
+            if (Structure* structure = jsDynamicCast<Structure*>(value.value())) {
+                if (set.contains(m_graph.registerStructure(structure))) {
+                    m_state.setFoundConstants(true);
+                    break;
+                }
+            }
+            m_state.setIsValid(false);
+            break;
+        }
+        
+        if (m_phiChildren) {
+            bool allGood = true;
+            m_phiChildren->forAllTransitiveIncomingValues(
+                node,
+                [&] (Node* incoming) {
+                    if (Structure* structure = incoming->dynamicCastConstant<Structure*>()) {
+                        if (set.contains(m_graph.registerStructure(structure)))
+                            return;
+                    }
+                    allGood = false;
+                });
+            if (allGood) {
+                m_state.setFoundConstants(true);
+                break;
+            }
+        }
+            
+        if (RegisteredStructure structure = set.onlyStructure()) {
+            filterByValue(node->child1(), *m_graph.freeze(structure.get()));
+            break;
+        }
+        
+        // Aw shucks, we can't do anything!
+        break;
+    }
+        
+    case PutStructure:
+        if (!forNode(node->child1()).m_structure.isClear()) {
+            if (forNode(node->child1()).m_structure.onlyStructure() == node->transition()->next)
+                m_state.setFoundConstants(true);
+            else {
+                observeTransition(
+                    clobberLimit, node->transition()->previous, node->transition()->next);
+                forNode(node->child1()).changeStructure(m_graph, node->transition()->next);
+            }
+        }
+        break;
+    case GetButterfly:
+    case AllocatePropertyStorage:
+    case ReallocatePropertyStorage:
+    case NukeStructureAndSetButterfly:
+        // FIXME: We don't model the fact that the structureID is nuked, simply because currently
+        // nobody would currently benefit from having that information. But it's a bug nonetheless.
+        forNode(node).clear(); // The result is not a JS value.
+        break;
+    case CheckDOM: {
+        JSValue constant = forNode(node->child1()).value();
+        if (constant) {
+            if (constant.isCell() && constant.asCell()->inherits(node->classInfo())) {
+                m_state.setFoundConstants(true);
+                ASSERT(constant);
+                break;
+            }
+        }
+
+        AbstractValue& value = forNode(node->child1());
+
+        if (value.m_structure.isSubClassOf(node->classInfo()))
+            m_state.setFoundConstants(true);
+
+        filterClassInfo(value, node->classInfo());
+        break;
+    }
+    case CallDOMGetter: {
+        CallDOMGetterData* callDOMGetterData = node->callDOMGetterData();
+        DOMJIT::CallDOMGetterPatchpoint* patchpoint = callDOMGetterData->patchpoint;
+        if (patchpoint->effect.writes)
+            clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(m_graph, callDOMGetterData->domJIT->resultType());
+        break;
+    }
+    case CallDOM: {
+        const DOMJIT::Signature* signature = node->signature();
+        if (signature->effect.writes)
+            clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(m_graph, signature->result);
+        break;
+    }
+    case CheckArray: {
+        if (node->arrayMode().alreadyChecked(m_graph, node, forNode(node->child1()))) {
+            m_state.setFoundConstants(true);
+            break;
+        }
+        switch (node->arrayMode().type()) {
+        case Array::String:
+            filter(node->child1(), SpecString);
+            break;
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::Undecided:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            break;
+        case Array::DirectArguments:
+            filter(node->child1(), SpecDirectArguments);
+            break;
+        case Array::ScopedArguments:
+            filter(node->child1(), SpecScopedArguments);
+            break;
+        case Array::Int8Array:
+            filter(node->child1(), SpecInt8Array);
+            break;
+        case Array::Int16Array:
+            filter(node->child1(), SpecInt16Array);
+            break;
+        case Array::Int32Array:
+            filter(node->child1(), SpecInt32Array);
+            break;
+        case Array::Uint8Array:
+            filter(node->child1(), SpecUint8Array);
+            break;
+        case Array::Uint8ClampedArray:
+            filter(node->child1(), SpecUint8ClampedArray);
+            break;
+        case Array::Uint16Array:
+            filter(node->child1(), SpecUint16Array);
+            break;
+        case Array::Uint32Array:
+            filter(node->child1(), SpecUint32Array);
+            break;
+        case Array::Float32Array:
+            filter(node->child1(), SpecFloat32Array);
+            break;
+        case Array::Float64Array:
+            filter(node->child1(), SpecFloat64Array);
+            break;
+        case Array::AnyTypedArray:
+            filter(node->child1(), SpecTypedArrayView);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        filterArrayModes(node->child1(), node->arrayMode().arrayModesThatPassFiltering());
+        break;
+    }
+    case Arrayify: {
+        if (node->arrayMode().alreadyChecked(m_graph, node, forNode(node->child1()))) {
+            m_state.setFoundConstants(true);
+            break;
+        }
+        ASSERT(node->arrayMode().conversion() == Array::Convert);
+        clobberStructures(clobberLimit);
+        filterArrayModes(node->child1(), node->arrayMode().arrayModesThatPassFiltering());
+        break;
+    }
+    case ArrayifyToStructure: {
+        AbstractValue& value = forNode(node->child1());
+        if (value.m_structure.isSubsetOf(RegisteredStructureSet(node->structure())))
+            m_state.setFoundConstants(true);
+        clobberStructures(clobberLimit);
+        
+        // We have a bunch of options of how to express the abstract set at this point. Let set S
+        // be the set of structures that the value had before clobbering and assume that all of
+        // them are watchable. The new value should be the least expressible upper bound of the
+        // intersection of "values that currently have structure = node->structure()" and "values
+        // that have structure in S plus any structure transition-reachable from S". Assume that
+        // node->structure() is not in S but it is transition-reachable from S. Then we would
+        // like to say that the result is "values that have structure = node->structure() until
+        // we invalidate", but there is no way to express this using the AbstractValue syntax. So
+        // we must choose between:
+        //
+        // 1) "values that currently have structure = node->structure()". This is a valid
+        //    superset of the value that we really want, and it's specific enough to satisfy the
+        //    preconditions of the array access that this is guarding. It's also specific enough
+        //    to allow relevant optimizations in the case that we didn't have a contradiction
+        //    like in this example. Notice that in the abscence of any contradiction, this result
+        //    is precise rather than being a conservative LUB.
+        //
+        // 2) "values that currently hava structure in S plus any structure transition-reachable
+        //    from S". This is also a valid superset of the value that we really want, but it's
+        //    not specific enough to satisfy the preconditions of the array access that this is
+        //    guarding - so playing such shenanigans would preclude us from having assertions on
+        //    the typing preconditions of any array accesses. This would also not be a desirable
+        //    answer in the absence of a contradiction.
+        //
+        // Note that it's tempting to simply say that the resulting value is BOTTOM because of
+        // the contradiction. That would be wrong, since we haven't hit an invalidation point,
+        // yet.
+        value.set(m_graph, node->structure());
+        break;
+    }
+    case GetIndexedPropertyStorage: {
+        JSArrayBufferView* view = m_graph.tryGetFoldableView(
+            forNode(node->child1()).m_value, node->arrayMode());
+        if (view)
+            m_state.setFoundConstants(true);
+        forNode(node).clear();
+        break;
+    }
+    case ConstantStoragePointer: {
+        forNode(node).clear();
+        break; 
+    }
+        
+    case GetTypedArrayByteOffset: {
+        JSArrayBufferView* view = m_graph.tryGetFoldableView(forNode(node->child1()).m_value);
+        if (view) {
+            setConstant(node, jsNumber(view->byteOffset()));
+            break;
+        }
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+        
+    case GetByOffset: {
+        StorageAccessData& data = node->storageAccessData();
+        UniquedStringImpl* uid = m_graph.identifiers()[data.identifierNumber];
+
+        // FIXME: The part of this that handles inferred property types relies on AI knowing the structure
+        // right now. That's probably not optimal. In some cases, we may perform an optimization (usually
+        // by something other than AI, maybe by CSE for example) that obscures AI's view of the structure
+        // at the point where GetByOffset runs. Currently, when that happens, we'll have to rely entirely
+        // on the type that ByteCodeParser was able to prove.
+        AbstractValue value = m_graph.inferredValueForProperty(
+            forNode(node->child2()), uid, data.offset, m_state.structureClobberState());
+
+        // It's possible that the type that ByteCodeParser came up with is better.
+        AbstractValue typeFromParsing;
+        typeFromParsing.set(m_graph, data.inferredType, m_state.structureClobberState());
+        value.filter(typeFromParsing);
+
+        // If we decide that there does not exist any value that this can return, then it's probably
+        // because the compilation was already invalidated.
+        if (value.isClear())
+            m_state.setIsValid(false);
+
+        forNode(node) = value;
+        if (value.m_value)
+            m_state.setFoundConstants(true);
+        break;
+    }
+        
+    case GetGetterSetterByOffset: {
+        StorageAccessData& data = node->storageAccessData();
+        JSValue result = m_graph.tryGetConstantProperty(forNode(node->child2()), data.offset);
+        if (result && jsDynamicCast<GetterSetter*>(result)) {
+            setConstant(node, *m_graph.freeze(result));
+            break;
+        }
+        
+        forNode(node).set(m_graph, m_graph.globalObjectFor(node->origin.semantic)->getterSetterStructure());
+        break;
+    }
+        
+    case MultiGetByOffset: {
+        // This code will filter the base value in a manner that is possibly different (either more
+        // or less precise) than the way it would be filtered if this was strength-reduced to a
+        // CheckStructure. This is fine. It's legal for different passes over the code to prove
+        // different things about the code, so long as all of them are sound. That even includes
+        // one guy proving that code should never execute (due to a contradiction) and another guy
+        // not finding that contradiction. If someone ever proved that there would be a
+        // contradiction then there must always be a contradiction even if subsequent passes don't
+        // realize it. This is the case here.
+        
+        // Ordinarily you have to be careful with calling setFoundConstants()
+        // because of the effect on compile times, but this node is FTL-only.
+        m_state.setFoundConstants(true);
+        
+        UniquedStringImpl* uid = m_graph.identifiers()[node->multiGetByOffsetData().identifierNumber];
+
+        AbstractValue base = forNode(node->child1());
+        RegisteredStructureSet baseSet;
+        AbstractValue result;
+        for (const MultiGetByOffsetCase& getCase : node->multiGetByOffsetData().cases) {
+            RegisteredStructureSet set = getCase.set();
+            set.filter(base);
+            if (set.isEmpty())
+                continue;
+            baseSet.merge(set);
+
+            switch (getCase.method().kind()) {
+            case GetByOffsetMethod::Constant: {
+                AbstractValue thisResult;
+                thisResult.set(
+                    m_graph,
+                    *getCase.method().constant(),
+                    m_state.structureClobberState());
+                result.merge(thisResult);
+                break;
+            }
+
+            case GetByOffsetMethod::Load: {
+                result.merge(
+                    m_graph.inferredValueForProperty(
+                        set, uid, m_state.structureClobberState()));
+                break;
+            }
+
+            default: {
+                result.makeHeapTop();
+                break;
+            } }
+        }
+        
+        if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)
+            m_state.setIsValid(false);
+        
+        forNode(node) = result;
+        break;
+    }
+            
+    case PutByOffset: {
+        break;
+    }
+        
+    case MultiPutByOffset: {
+        RegisteredStructureSet newSet;
+        TransitionVector transitions;
+        
+        // Ordinarily you have to be careful with calling setFoundConstants()
+        // because of the effect on compile times, but this node is FTL-only.
+        m_state.setFoundConstants(true);
+        
+        AbstractValue base = forNode(node->child1());
+        AbstractValue originalValue = forNode(node->child2());
+        AbstractValue resultingValue;
+        
+        for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
+            const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
+            RegisteredStructureSet thisSet = *m_graph.addStructureSet(variant.oldStructure());
+            thisSet.filter(base);
+            if (thisSet.isEmpty())
+                continue;
+
+            AbstractValue thisValue = originalValue;
+            thisValue.filter(m_graph, variant.requiredType());
+            resultingValue.merge(thisValue);
+            
+            if (variant.kind() == PutByIdVariant::Transition) {
+                RegisteredStructure newStructure = m_graph.registerStructure(variant.newStructure());
+                if (thisSet.onlyStructure() != newStructure) {
+                    transitions.append(
+                        Transition(m_graph.registerStructure(variant.oldStructureForTransition()), newStructure));
+                } // else this is really a replace.
+                newSet.add(newStructure);
+            } else {
+                ASSERT(variant.kind() == PutByIdVariant::Replace);
+                newSet.merge(thisSet);
+            }
+        }
+        
+        observeTransitions(clobberLimit, transitions);
+        if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
+            m_state.setIsValid(false);
+        forNode(node->child2()) = resultingValue;
+        if (!!originalValue && !resultingValue)
+            m_state.setIsValid(false);
+        break;
+    }
+        
+    case GetExecutable: {
+        JSValue value = forNode(node->child1()).value();
+        if (value) {
+            JSFunction* function = jsDynamicCast<JSFunction*>(value);
+            if (function) {
+                setConstant(node, *m_graph.freeze(function->executable()));
+                break;
+            }
+        }
+        forNode(node).setType(m_graph, SpecCellOther);
+        break;
+    }
+    
+    case CheckCell: {
+        JSValue value = forNode(node->child1()).value();
+        if (value == node->cellOperand()->value()) {
+            m_state.setFoundConstants(true);
+            ASSERT(value);
+            break;
+        }
+        filterByValue(node->child1(), *node->cellOperand());
+        break;
+    }
+
+    case CheckNotEmpty: {
+        AbstractValue& value = forNode(node->child1());
+        if (!(value.m_type & SpecEmpty)) {
+            m_state.setFoundConstants(true);
+            break;
+        }
+        
+        filter(value, ~SpecEmpty);
+        break;
+    }
+
+    case CheckStringIdent: {
+        AbstractValue& value = forNode(node->child1());
+        UniquedStringImpl* uid = node->uidOperand();
+        ASSERT(!(value.m_type & ~SpecStringIdent)); // Edge filtering should have already ensured this.
+
+        JSValue childConstant = value.value();
+        if (childConstant) {
+            ASSERT(childConstant.isString());
+            if (asString(childConstant)->tryGetValueImpl() == uid) {
+                m_state.setFoundConstants(true);
+                break;
+            }
+        }
+
+        filter(value, SpecStringIdent);
+        break;
+    }
+
+    case CheckInBounds: {
+        JSValue left = forNode(node->child1()).value();
+        JSValue right = forNode(node->child2()).value();
+        if (left && right && left.isInt32() && right.isInt32()
+            && static_cast<uint32_t>(left.asInt32()) < static_cast<uint32_t>(right.asInt32())) {
+            m_state.setFoundConstants(true);
+            break;
+        }
+        break;
+    }
+        
+    case PutById:
+    case PutByIdFlush:
+    case PutByIdDirect: {
+        AbstractValue& value = forNode(node->child1());
+        if (value.m_structure.isFinite()) {
+            PutByIdStatus status = PutByIdStatus::computeFor(
+                m_graph.globalObjectFor(node->origin.semantic),
+                value.m_structure.toStructureSet(),
+                m_graph.identifiers()[node->identifierNumber()],
+                node->op() == PutByIdDirect);
+
+            if (status.isSimple()) {
+                RegisteredStructureSet newSet;
+                TransitionVector transitions;
+                
+                for (unsigned i = status.numVariants(); i--;) {
+                    const PutByIdVariant& variant = status[i];
+                    if (variant.kind() == PutByIdVariant::Transition) {
+                        RegisteredStructure newStructure = m_graph.registerStructure(variant.newStructure());
+                        transitions.append(
+                            Transition(
+                                m_graph.registerStructure(variant.oldStructureForTransition()), newStructure));
+                        newSet.add(newStructure);
+                    } else {
+                        ASSERT(variant.kind() == PutByIdVariant::Replace);
+                        newSet.merge(*m_graph.addStructureSet(variant.oldStructure()));
+                    }
+                }
+                
+                if (status.numVariants() == 1 || isFTL(m_graph.m_plan.mode))
+                    m_state.setFoundConstants(true);
+                
+                observeTransitions(clobberLimit, transitions);
+                if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
+                    m_state.setIsValid(false);
+                break;
+            }
+        }
+        
+        clobberWorld(node->origin.semantic, clobberLimit);
+        break;
+    }
+
+    case PutByValWithThis:
+    case PutByIdWithThis:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        break;
+
+    case PutGetterById:
+    case PutSetterById:
+    case PutGetterSetterById:
+    case PutGetterByVal:
+    case PutSetterByVal: {
+        clobberWorld(node->origin.semantic, clobberLimit);
+        break;
+    }
+
+    case DefineDataProperty:
+    case DefineAccessorProperty:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        break;
+        
+    case In: {
+        // FIXME: We can determine when the property definitely exists based on abstract
+        // value information.
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+
+    case HasOwnProperty: {
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+            
+    case GetEnumerableLength: {
+        forNode(node).setType(SpecInt32Only);
+        break;
+    }
+    case HasGenericProperty: {
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+    case HasStructureProperty: {
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+    case HasIndexedProperty: {
+        ArrayMode mode = node->arrayMode();
+        switch (mode.type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::ArrayStorage: {
+            break;
+        }
+        default: {
+            clobberWorld(node->origin.semantic, clobberLimit);
+            break;
+        }
+        }
+        forNode(node).setType(SpecBoolean);
+        break;
+    }
+    case GetDirectPname: {
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).makeHeapTop();
+        break;
+    }
+    case GetPropertyEnumerator: {
+        forNode(node).setType(m_graph, SpecCell);
+        break;
+    }
+    case GetEnumeratorStructurePname: {
+        forNode(node).setType(m_graph, SpecString | SpecOther);
+        break;
+    }
+    case GetEnumeratorGenericPname: {
+        forNode(node).setType(m_graph, SpecString | SpecOther);
+        break;
+    }
+    case ToIndexString: {
+        forNode(node).setType(m_graph, SpecString);
+        break;
+    }
+
+    case GetGlobalVar:
+        forNode(node).makeHeapTop();
+        break;
+
+    case GetGlobalLexicalVariable:
+        forNode(node).makeBytecodeTop();
+        break;
+
+    case GetDynamicVar:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).makeBytecodeTop();
+        break;
+
+    case PutDynamicVar:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        break;
+
+    case ResolveScope:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(m_graph, SpecObject);
+        break;
+        
+    case PutGlobalVariable:
+    case NotifyWrite:
+        break;
+            
+    case OverridesHasInstance:
+        forNode(node).setType(SpecBoolean);
+        break;
+            
+    case InstanceOf:
+        // Sadly, we don't propagate the fact that we've done InstanceOf
+        forNode(node).setType(SpecBoolean);
+        break;
+
+    case InstanceOfCustom:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).setType(SpecBoolean);
+        break;
+            
+    case Phi:
+        RELEASE_ASSERT(m_graph.m_form == SSA);
+        forNode(node) = forNode(NodeFlowProjection(node, NodeFlowProjection::Shadow));
+        // The state of this node would have already been decided, but it may have become a
+        // constant, in which case we'd like to know.
+        if (forNode(node).m_value)
+            m_state.setFoundConstants(true);
+        break;
+        
+    case Upsilon: {
+        NodeFlowProjection shadow(node->phi(), NodeFlowProjection::Shadow);
+        if (shadow.isStillValid()) {
+            m_state.createValueForNode(shadow);
+            forNode(shadow) = forNode(node->child1());
+        }
+        break;
+    }
+        
+    case Flush:
+    case PhantomLocal:
+        break;
+            
+    case Call:
+    case TailCallInlinedCaller:
+    case Construct:
+    case CallVarargs:
+    case CallForwardVarargs:
+    case TailCallVarargsInlinedCaller:
+    case ConstructVarargs:
+    case ConstructForwardVarargs:
+    case TailCallForwardVarargsInlinedCaller:
+    case CallEval:
+    case DirectCall:
+    case DirectConstruct:
+    case DirectTailCallInlinedCaller:
+        clobberWorld(node->origin.semantic, clobberLimit);
+        forNode(node).makeHeapTop();
+        break;
+
+    case ForceOSRExit:
+    case CheckBadCell:
+        m_state.setIsValid(false);
+        break;
+        
+    case InvalidationPoint:
+        forAllValues(clobberLimit, AbstractValue::observeInvalidationPointFor);
+        m_state.setStructureClobberState(StructuresAreWatched);
+        break;
+
+    case CheckWatchdogTimer:
+    case LogShadowChickenPrologue:
+    case LogShadowChickenTail:
+        break;
+
+    case ProfileType:
+    case ProfileControlFlow:
+    case Phantom:
+    case CountExecution:
+    case CheckTierUpInLoop:
+    case CheckTierUpAtReturn:
+    case CheckTypeInfoFlags:
+        break;
+
+    case CreateRest:
+        if (!m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
+            // This means we're already having a bad time.
+            clobberWorld(node->origin.semantic, clobberLimit);
+            forNode(node).setType(m_graph, SpecArray);
+            break;
+        }
+        forNode(node).set(
+            m_graph,
+            m_graph.globalObjectFor(node->origin.semantic)->restParameterStructure());
+        break;
+            
+    case Check: {
+        // Simplify out checks that don't actually do checking.
+        for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
+            Edge edge = node->children.child(i);
+            if (!edge)
+                break;
+            if (edge.isProved() || edge.willNotHaveCheck()) {
+                m_state.setFoundConstants(true);
+                break;
+            }
+        }
+        break;
+    }
+
+    case SetFunctionName: {
+        clobberWorld(node->origin.semantic, clobberLimit);
+        break;
+    }
+
+    case StoreBarrier:
+    case FencedStoreBarrier: {
+        filter(node->child1(), SpecCell);
+        break;
+    }
+        
+    case CheckTierUpAndOSREnter:
+    case LoopHint:
+    case ZombieHint:
+    case ExitOK:
+        break;
+
+    case Unreachable:
+        // It may be that during a previous run of AI we proved that something was unreachable, but
+        // during this run of AI we forget that it's unreachable. AI's proofs don't have to get
+        // monotonically stronger over time. So, we don't assert that AI doesn't reach the
+        // Unreachable. We have no choice but to take our past proof at face value. Otherwise we'll
+        // crash whenever AI fails to be as powerful on run K as it was on run K-1.
+        m_state.setIsValid(false);
+        break;
+        
+    case LastNodeType:
+    case ArithIMul:
+    case FiatInt52:
+        DFG_CRASH(m_graph, node, "Unexpected node type");
+        break;
+    }
+    
+    return m_state.isValid();
+}
+
+template<typename AbstractStateType>
+bool AbstractInterpreter<AbstractStateType>::executeEffects(unsigned indexInBlock)
+{
+    return executeEffects(indexInBlock, m_state.block()->at(indexInBlock));
+}
+
+template<typename AbstractStateType>
+bool AbstractInterpreter<AbstractStateType>::execute(unsigned indexInBlock)
+{
+    Node* node = m_state.block()->at(indexInBlock);
+
+    startExecuting();
+    executeEdges(node);
+    return executeEffects(indexInBlock, node);
+}
+
+template<typename AbstractStateType>
+bool AbstractInterpreter<AbstractStateType>::execute(Node* node)
+{
+    startExecuting();
+    executeEdges(node);
+    return executeEffects(UINT_MAX, node);
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::clobberWorld(
+    const CodeOrigin&, unsigned clobberLimit)
+{
+    clobberStructures(clobberLimit);
+}
+
+template<typename AbstractStateType>
+template<typename Functor>
+void AbstractInterpreter<AbstractStateType>::forAllValues(
+    unsigned clobberLimit, Functor& functor)
+{
+    if (clobberLimit >= m_state.block()->size())
+        clobberLimit = m_state.block()->size();
+    else
+        clobberLimit++;
+    ASSERT(clobberLimit <= m_state.block()->size());
+    for (size_t i = clobberLimit; i--;) {
+        NodeFlowProjection::forEach(
+            m_state.block()->at(i),
+            [&] (NodeFlowProjection nodeProjection) {
+                functor(forNode(nodeProjection));
+            });
+    }
+    if (m_graph.m_form == SSA) {
+        for (NodeFlowProjection node : m_state.block()->ssa->liveAtHead) {
+            if (node.isStillValid())
+                functor(forNode(node));
+        }
+    }
+    for (size_t i = m_state.variables().numberOfArguments(); i--;)
+        functor(m_state.variables().argument(i));
+    for (size_t i = m_state.variables().numberOfLocals(); i--;)
+        functor(m_state.variables().local(i));
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::clobberStructures(unsigned clobberLimit)
+{
+    forAllValues(clobberLimit, AbstractValue::clobberStructuresFor);
+    setDidClobber();
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::observeTransition(
+    unsigned clobberLimit, RegisteredStructure from, RegisteredStructure to)
+{
+    AbstractValue::TransitionObserver transitionObserver(from, to);
+    forAllValues(clobberLimit, transitionObserver);
+    
+    ASSERT(!from->dfgShouldWatch()); // We don't need to claim to be in a clobbered state because 'from' was never watchable (during the time we were compiling), hence no constants ever introduced into the DFG IR that ever had a watchable structure would ever have the same structure as from.
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::observeTransitions(
+    unsigned clobberLimit, const TransitionVector& vector)
+{
+    AbstractValue::TransitionsObserver transitionsObserver(vector);
+    forAllValues(clobberLimit, transitionsObserver);
+    
+    if (!ASSERT_DISABLED) {
+        // We don't need to claim to be in a clobbered state because none of the Transition::previous structures are watchable.
+        for (unsigned i = vector.size(); i--;)
+            ASSERT(!vector[i].previous->dfgShouldWatch());
+    }
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::setDidClobber()
+{
+    m_state.setDidClobber(true);
+    m_state.setStructureClobberState(StructuresAreClobbered);
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::dump(PrintStream& out) const
+{
+    const_cast<AbstractInterpreter<AbstractStateType>*>(this)->dump(out);
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::dump(PrintStream& out)
+{
+    CommaPrinter comma(" ");
+    HashSet<NodeFlowProjection> seen;
+    if (m_graph.m_form == SSA) {
+        for (NodeFlowProjection node : m_state.block()->ssa->liveAtHead) {
+            seen.add(node);
+            AbstractValue& value = forNode(node);
+            if (value.isClear())
+                continue;
+            out.print(comma, node, ":", value);
+        }
+    }
+    for (size_t i = 0; i < m_state.block()->size(); ++i) {
+        NodeFlowProjection::forEach(
+            m_state.block()->at(i), [&] (NodeFlowProjection nodeProjection) {
+                seen.add(nodeProjection);
+                AbstractValue& value = forNode(nodeProjection);
+                if (value.isClear())
+                    return;
+                out.print(comma, nodeProjection, ":", value);
+            });
+    }
+    if (m_graph.m_form == SSA) {
+        for (NodeFlowProjection node : m_state.block()->ssa->liveAtTail) {
+            if (seen.contains(node))
+                continue;
+            AbstractValue& value = forNode(node);
+            if (value.isClear())
+                continue;
+            out.print(comma, node, ":", value);
+        }
+    }
+}
+
+template<typename AbstractStateType>
+FiltrationResult AbstractInterpreter<AbstractStateType>::filter(
+    AbstractValue& value, const RegisteredStructureSet& set, SpeculatedType admittedTypes)
+{
+    if (value.filter(m_graph, set, admittedTypes) == FiltrationOK)
+        return FiltrationOK;
+    m_state.setIsValid(false);
+    return Contradiction;
+}
+
+template<typename AbstractStateType>
+FiltrationResult AbstractInterpreter<AbstractStateType>::filterArrayModes(
+    AbstractValue& value, ArrayModes arrayModes)
+{
+    if (value.filterArrayModes(arrayModes) == FiltrationOK)
+        return FiltrationOK;
+    m_state.setIsValid(false);
+    return Contradiction;
+}
+
+template<typename AbstractStateType>
+FiltrationResult AbstractInterpreter<AbstractStateType>::filter(
+    AbstractValue& value, SpeculatedType type)
+{
+    if (value.filter(type) == FiltrationOK)
+        return FiltrationOK;
+    m_state.setIsValid(false);
+    return Contradiction;
+}
+
+template<typename AbstractStateType>
+FiltrationResult AbstractInterpreter<AbstractStateType>::filterByValue(
+    AbstractValue& abstractValue, FrozenValue concreteValue)
+{
+    if (abstractValue.filterByValue(concreteValue) == FiltrationOK)
+        return FiltrationOK;
+    m_state.setIsValid(false);
+    return Contradiction;
+}
+
+template<typename AbstractStateType>
+FiltrationResult AbstractInterpreter<AbstractStateType>::filterClassInfo(
+    AbstractValue& value, const ClassInfo* classInfo)
+{
+    if (value.filterClassInfo(m_graph, classInfo) == FiltrationOK)
+        return FiltrationOK;
+    m_state.setIsValid(false);
+    return Contradiction;
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::executeDoubleUnaryOpEffects(Node* node, double(*equivalentFunction)(double))
+{
+    JSValue child = forNode(node->child1()).value();
+    if (std::optional<double> number = child.toNumberFromPrimitive()) {
+        setConstant(node, jsDoubleNumber(equivalentFunction(*number)));
+        return;
+    }
+    SpeculatedType type = SpecFullNumber;
+    if (node->child1().useKind() == DoubleRepUse)
+        type = typeOfDoubleUnaryOp(forNode(node->child1()).m_type);
+    forNode(node).setType(type);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAbstractValue.cpp b/dfg/DFGAbstractValue.cpp
new file mode 100644
index 0000000..4a7fe1b
--- /dev/null
+++ b/dfg/DFGAbstractValue.cpp
@@ -0,0 +1,577 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGAbstractValue.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "JSCInlines.h"
+#include "TrackedReferences.h"
+
+namespace JSC { namespace DFG {
+
+void AbstractValue::observeTransitions(const TransitionVector& vector)
+{
+    if (m_type & SpecCell) {
+        m_structure.observeTransitions(vector);
+        ArrayModes newModes = 0;
+        for (unsigned i = vector.size(); i--;) {
+            if (m_arrayModes & asArrayModes(vector[i].previous->indexingType()))
+                newModes |= asArrayModes(vector[i].next->indexingType());
+        }
+        m_arrayModes |= newModes;
+    }
+    checkConsistency();
+}
+
+void AbstractValue::set(Graph& graph, const FrozenValue& value, StructureClobberState clobberState)
+{
+    if (!!value && value.value().isCell()) {
+        Structure* structure = value.structure();
+        StructureRegistrationResult result;
+        RegisteredStructure RegisteredStructure = graph.registerStructure(structure, result);
+        if (result == StructureRegisteredAndWatched) {
+            m_structure = RegisteredStructure;
+            if (clobberState == StructuresAreClobbered) {
+                m_arrayModes = ALL_ARRAY_MODES;
+                m_structure.clobber();
+            } else
+                m_arrayModes = asArrayModes(structure->indexingType());
+        } else {
+            m_structure.makeTop();
+            m_arrayModes = ALL_ARRAY_MODES;
+        }
+    } else {
+        m_structure.clear();
+        m_arrayModes = 0;
+    }
+    
+    m_type = speculationFromValue(value.value());
+    m_value = value.value();
+    
+    checkConsistency();
+    assertIsRegistered(graph);
+}
+
+void AbstractValue::set(Graph& graph, Structure* structure)
+{
+    set(graph, graph.registerStructure(structure));
+}
+
+void AbstractValue::set(Graph& graph, RegisteredStructure structure)
+{
+    RELEASE_ASSERT(structure);
+    
+    m_structure = structure;
+    m_arrayModes = asArrayModes(structure->indexingType());
+    m_type = speculationFromStructure(structure.get());
+    m_value = JSValue();
+    
+    checkConsistency();
+    assertIsRegistered(graph);
+}
+
+void AbstractValue::set(Graph& graph, const RegisteredStructureSet& set)
+{
+    m_structure = set;
+    m_arrayModes = set.arrayModesFromStructures();
+    m_type = set.speculationFromStructures();
+    m_value = JSValue();
+    
+    checkConsistency();
+    assertIsRegistered(graph);
+}
+
+void AbstractValue::setType(Graph& graph, SpeculatedType type)
+{
+    SpeculatedType cellType = type & SpecCell;
+    if (cellType) {
+        if (!(cellType & ~SpecString))
+            m_structure = graph.stringStructure;
+        else if (isSymbolSpeculation(cellType))
+            m_structure = graph.symbolStructure;
+        else
+            m_structure.makeTop();
+        m_arrayModes = ALL_ARRAY_MODES;
+    } else {
+        m_structure.clear();
+        m_arrayModes = 0;
+    }
+    m_type = type;
+    m_value = JSValue();
+    checkConsistency();
+}
+
+void AbstractValue::set(Graph& graph, const InferredType::Descriptor& descriptor)
+{
+    switch (descriptor.kind()) {
+    case InferredType::Bottom:
+        clear();
+        return;
+    case InferredType::Boolean:
+        setType(SpecBoolean);
+        return;
+    case InferredType::Other:
+        setType(SpecOther);
+        return;
+    case InferredType::Int32:
+        setType(SpecInt32Only);
+        return;
+    case InferredType::Number:
+        setType(SpecBytecodeNumber);
+        return;
+    case InferredType::String:
+        set(graph, graph.m_vm.stringStructure.get());
+        return;
+    case InferredType::Symbol:
+        set(graph, graph.m_vm.symbolStructure.get());
+        return;
+    case InferredType::ObjectWithStructure:
+        set(graph, descriptor.structure());
+        return;
+    case InferredType::ObjectWithStructureOrOther:
+        set(graph, descriptor.structure());
+        merge(SpecOther);
+        return;
+    case InferredType::Object:
+        setType(graph, SpecObject);
+        return;
+    case InferredType::ObjectOrOther:
+        setType(graph, SpecObject | SpecOther);
+        return;
+    case InferredType::Top:
+        makeHeapTop();
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void AbstractValue::set(
+    Graph& graph, const InferredType::Descriptor& descriptor, StructureClobberState clobberState)
+{
+    set(graph, descriptor);
+    if (clobberState == StructuresAreClobbered)
+        clobberStructures();
+}
+
+void AbstractValue::fixTypeForRepresentation(Graph& graph, NodeFlags representation, Node* node)
+{
+    if (representation == NodeResultDouble) {
+        if (m_value) {
+            ASSERT(m_value.isNumber());
+            if (m_value.isInt32())
+                m_value = jsDoubleNumber(m_value.asNumber());
+        }
+        if (m_type & SpecAnyInt) {
+            m_type &= ~SpecAnyInt;
+            m_type |= SpecAnyIntAsDouble;
+        }
+        if (m_type & ~SpecFullDouble)
+            DFG_CRASH(graph, node, toCString("Abstract value ", *this, " for double node has type outside SpecFullDouble.\n").data());
+    } else if (representation == NodeResultInt52) {
+        if (m_type & SpecAnyIntAsDouble) {
+            m_type &= ~SpecAnyIntAsDouble;
+            m_type |= SpecInt52Only;
+        }
+        if (m_type & ~SpecAnyInt)
+            DFG_CRASH(graph, node, toCString("Abstract value ", *this, " for int52 node has type outside SpecAnyInt.\n").data());
+    } else {
+        if (m_type & SpecInt52Only) {
+            m_type &= ~SpecInt52Only;
+            m_type |= SpecAnyIntAsDouble;
+        }
+        if (m_type & ~SpecBytecodeTop)
+            DFG_CRASH(graph, node, toCString("Abstract value ", *this, " for value node has type outside SpecBytecodeTop.\n").data());
+    }
+    
+    checkConsistency();
+}
+
+void AbstractValue::fixTypeForRepresentation(Graph& graph, Node* node)
+{
+    fixTypeForRepresentation(graph, node->result(), node);
+}
+
+bool AbstractValue::mergeOSREntryValue(Graph& graph, JSValue value)
+{
+    AbstractValue oldMe = *this;
+    
+    if (isClear()) {
+        FrozenValue* frozenValue = graph.freeze(value);
+        if (frozenValue->pointsToHeap()) {
+            m_structure = graph.registerStructure(frozenValue->structure());
+            m_arrayModes = asArrayModes(frozenValue->structure()->indexingType());
+        } else {
+            m_structure.clear();
+            m_arrayModes = 0;
+        }
+        
+        m_type = speculationFromValue(value);
+        m_value = value;
+    } else {
+        mergeSpeculation(m_type, speculationFromValue(value));
+        if (!!value && value.isCell()) {
+            RegisteredStructure structure = graph.registerStructure(value.asCell()->structure());
+            mergeArrayModes(m_arrayModes, asArrayModes(structure->indexingType()));
+            m_structure.merge(RegisteredStructureSet(structure));
+        }
+        if (m_value != value)
+            m_value = JSValue();
+    }
+    
+    checkConsistency();
+    assertIsRegistered(graph);
+    
+    return oldMe != *this;
+}
+
+bool AbstractValue::isType(Graph& graph, const InferredType::Descriptor& inferredType) const
+{
+    AbstractValue typeValue;
+    typeValue.set(graph, inferredType);
+
+    AbstractValue mergedValue = *this;
+    mergedValue.merge(typeValue);
+
+    return mergedValue == typeValue;
+}
+
+FiltrationResult AbstractValue::filter(
+    Graph& graph, const RegisteredStructureSet& other, SpeculatedType admittedTypes)
+{
+    ASSERT(!(admittedTypes & SpecCell));
+    
+    if (isClear())
+        return FiltrationOK;
+    
+    // FIXME: This could be optimized for the common case of m_type not
+    // having structures, array modes, or a specific value.
+    // https://bugs.webkit.org/show_bug.cgi?id=109663
+    
+    m_type &= other.speculationFromStructures() | admittedTypes;
+    m_arrayModes &= other.arrayModesFromStructures();
+    m_structure.filter(other);
+    
+    // It's possible that prior to the above two statements we had (Foo, TOP), where
+    // Foo is a SpeculatedType that is disjoint with the passed RegisteredStructureSet. In that
+    // case, we will now have (None, [someStructure]). In general, we need to make
+    // sure that new information gleaned from the SpeculatedType needs to be fed back
+    // into the information gleaned from the RegisteredStructureSet.
+    m_structure.filter(m_type);
+    
+    filterArrayModesByType();
+    filterValueByType();
+    return normalizeClarity(graph);
+}
+
+FiltrationResult AbstractValue::changeStructure(Graph& graph, const RegisteredStructureSet& other)
+{
+    m_type &= other.speculationFromStructures();
+    m_arrayModes = other.arrayModesFromStructures();
+    m_structure = other;
+    
+    filterValueByType();
+    
+    return normalizeClarity(graph);
+}
+
+FiltrationResult AbstractValue::filterArrayModes(ArrayModes arrayModes)
+{
+    ASSERT(arrayModes);
+    
+    if (isClear())
+        return FiltrationOK;
+    
+    m_type &= SpecCell;
+    m_arrayModes &= arrayModes;
+    return normalizeClarity();
+}
+
+FiltrationResult AbstractValue::filterClassInfo(Graph& graph, const ClassInfo* classInfo)
+{
+    // FIXME: AI should track ClassInfo to leverage hierarchical class information.
+    // https://bugs.webkit.org/show_bug.cgi?id=162989
+    if (isClear())
+        return FiltrationOK;
+
+    m_type &= speculationFromClassInfo(classInfo);
+    m_structure.filterClassInfo(classInfo);
+
+    m_structure.filter(m_type);
+
+    filterArrayModesByType();
+    filterValueByType();
+    return normalizeClarity(graph);
+}
+
+FiltrationResult AbstractValue::filter(SpeculatedType type)
+{
+    if ((m_type & type) == m_type)
+        return FiltrationOK;
+    
+    // Fast path for the case that we don't even have a cell.
+    if (!(m_type & SpecCell)) {
+        m_type &= type;
+        FiltrationResult result;
+        if (m_type == SpecNone) {
+            clear();
+            result = Contradiction;
+        } else
+            result = FiltrationOK;
+        checkConsistency();
+        return result;
+    }
+    
+    m_type &= type;
+    
+    // It's possible that prior to this filter() call we had, say, (Final, TOP), and
+    // the passed type is Array. At this point we'll have (None, TOP). The best way
+    // to ensure that the structure filtering does the right thing is to filter on
+    // the new type (None) rather than the one passed (Array).
+    m_structure.filter(m_type);
+    filterArrayModesByType();
+    filterValueByType();
+    return normalizeClarity();
+}
+
+FiltrationResult AbstractValue::filterByValue(const FrozenValue& value)
+{
+    FiltrationResult result = filter(speculationFromValue(value.value()));
+    if (m_type)
+        m_value = value.value();
+    return result;
+}
+
+bool AbstractValue::contains(RegisteredStructure structure) const
+{
+    return couldBeType(speculationFromStructure(structure.get()))
+        && (m_arrayModes & arrayModeFromStructure(structure.get()))
+        && m_structure.contains(structure);
+}
+
+FiltrationResult AbstractValue::filter(const AbstractValue& other)
+{
+    m_type &= other.m_type;
+    m_structure.filter(other.m_structure);
+    m_arrayModes &= other.m_arrayModes;
+
+    m_structure.filter(m_type);
+    filterArrayModesByType();
+    filterValueByType();
+    
+    if (normalizeClarity() == Contradiction)
+        return Contradiction;
+    
+    if (m_value == other.m_value)
+        return FiltrationOK;
+    
+    // Neither of us are BOTTOM, so an empty value means TOP.
+    if (!m_value) {
+        // We previously didn't prove a value but now we have done so.
+        m_value = other.m_value; 
+        return FiltrationOK;
+    }
+    
+    if (!other.m_value) {
+        // We had proved a value but the other guy hadn't, so keep our proof.
+        return FiltrationOK;
+    }
+    
+    // We both proved there to be a specific value but they are different.
+    clear();
+    return Contradiction;
+}
+
+FiltrationResult AbstractValue::filter(Graph& graph, const InferredType::Descriptor& descriptor)
+{
+    AbstractValue filterValue;
+    filterValue.set(graph, descriptor);
+    return filter(filterValue);
+}
+
+void AbstractValue::filterValueByType()
+{
+    // We could go further, and ensure that if the futurePossibleStructure contravenes
+    // the value, then we could clear both of those things. But that's unlikely to help
+    // in any realistic scenario, so we don't do it. Simpler is better.
+
+    if (!!m_type) {
+        // The type is still non-empty. It may be that the new type renders
+        // the value empty because it contravenes the constant value we had.
+        if (m_value && !validateType(m_value))
+            clear();
+        return;
+    }
+    
+    // The type has been rendered empty. That means that the value must now be invalid,
+    // as well.
+    ASSERT(!m_value || !validateType(m_value));
+    m_value = JSValue();
+}
+
+void AbstractValue::filterArrayModesByType()
+{
+    if (!(m_type & SpecCell))
+        m_arrayModes = 0;
+    else if (!(m_type & ~SpecArray))
+        m_arrayModes &= ALL_ARRAY_ARRAY_MODES;
+    
+    // NOTE: If m_type doesn't have SpecArray set, that doesn't mean that the
+    // array modes have to be a subset of ALL_NON_ARRAY_ARRAY_MODES, since
+    // in the speculated type type-system, RegExpMatchesArry and ArrayPrototype
+    // are Otherobj (since they are not *exactly* JSArray) but in the ArrayModes
+    // type system they are arrays (since they expose the magical length
+    // property and are otherwise allocated using array allocation). Hence the
+    // following would be wrong:
+    //
+    // if (!(m_type & SpecArray))
+    //    m_arrayModes &= ALL_NON_ARRAY_ARRAY_MODES;
+}
+
+bool AbstractValue::shouldBeClear() const
+{
+    if (m_type == SpecNone)
+        return true;
+    
+    if (!(m_type & ~SpecCell)
+        && (!m_arrayModes || m_structure.isClear()))
+        return true;
+    
+    return false;
+}
+
+FiltrationResult AbstractValue::normalizeClarity()
+{
+    // It's useful to be able to quickly check if an abstract value is clear.
+    // This normalizes everything to make that easy.
+    
+    FiltrationResult result;
+    
+    if (shouldBeClear()) {
+        clear();
+        result = Contradiction;
+    } else
+        result = FiltrationOK;
+
+    checkConsistency();
+    
+    return result;
+}
+
+FiltrationResult AbstractValue::normalizeClarity(Graph& graph)
+{
+    FiltrationResult result = normalizeClarity();
+    assertIsRegistered(graph);
+    return result;
+}
+
+#if !ASSERT_DISABLED
+void AbstractValue::checkConsistency() const
+{
+    if (!(m_type & SpecCell)) {
+        ASSERT(m_structure.isClear());
+        ASSERT(!m_arrayModes);
+    }
+    
+    if (isClear())
+        ASSERT(!m_value);
+    
+    if (!!m_value) {
+        SpeculatedType type = m_type;
+        // This relaxes the assertion below a bit, since we don't know the representation of the
+        // node.
+        if (type & SpecInt52Only)
+            type |= SpecAnyIntAsDouble;
+        ASSERT(mergeSpeculations(type, speculationFromValue(m_value)) == type);
+    }
+    
+    // Note that it's possible for a prediction like (Final, []). This really means that
+    // the value is bottom and that any code that uses the value is unreachable. But
+    // we don't want to get pedantic about this as it would only increase the computational
+    // complexity of the code.
+}
+
+void AbstractValue::assertIsRegistered(Graph& graph) const
+{
+    m_structure.assertIsRegistered(graph);
+}
+#endif
+
+ResultType AbstractValue::resultType() const
+{
+    ASSERT(isType(SpecBytecodeTop));
+    if (isType(SpecBoolean))
+        return ResultType::booleanType();
+    if (isType(SpecInt32Only))
+        return ResultType::numberTypeIsInt32();
+    if (isType(SpecBytecodeNumber))
+        return ResultType::numberType();
+    if (isType(SpecString))
+        return ResultType::stringType();
+    if (isType(SpecString | SpecBytecodeNumber))
+        return ResultType::stringOrNumberType();
+    return ResultType::unknownType();
+}
+
+void AbstractValue::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+void AbstractValue::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    out.print("(", SpeculationDump(m_type));
+    if (m_type & SpecCell) {
+        out.print(
+            ", ", ArrayModesDump(m_arrayModes), ", ",
+            inContext(m_structure, context));
+    }
+    if (!!m_value)
+        out.print(", ", inContext(m_value, context));
+    out.print(")");
+}
+
+void AbstractValue::validateReferences(const TrackedReferences& trackedReferences)
+{
+    trackedReferences.check(m_value);
+    m_structure.validateReferences(trackedReferences);
+}
+
+#if USE(JSVALUE64) && !defined(NDEBUG)
+void AbstractValue::ensureCanInitializeWithZeros()
+{
+    std::aligned_storage<sizeof(AbstractValue), alignof(AbstractValue)>::type zeroFilledStorage;
+    memset(static_cast<void*>(&zeroFilledStorage), 0, sizeof(AbstractValue));
+    ASSERT(*this == *static_cast<AbstractValue*>(static_cast<void*>(&zeroFilledStorage)));
+}
+#endif
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGAbstractValue.h b/dfg/DFGAbstractValue.h
new file mode 100644
index 0000000..03a5056
--- /dev/null
+++ b/dfg/DFGAbstractValue.h
@@ -0,0 +1,486 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayProfile.h"
+#include "DFGFiltrationResult.h"
+#include "DFGFrozenValue.h"
+#include "DFGNodeFlags.h"
+#include "DFGStructureAbstractValue.h"
+#include "DFGStructureClobberState.h"
+#include "InferredType.h"
+#include "JSCell.h"
+#include "ResultType.h"
+#include "SpeculatedType.h"
+#include "DumpContext.h"
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace DFG {
+
+class Graph;
+struct Node;
+
+struct AbstractValue {
+    AbstractValue()
+        : m_type(SpecNone)
+        , m_arrayModes(0)
+    {
+#if USE(JSVALUE64) && !defined(NDEBUG)
+        // The WTF Traits for AbstractValue allow the initialization of values with bzero().
+        // We verify the correctness of this assumption here.
+        static bool needsDefaultConstructorCheck = true;
+        if (needsDefaultConstructorCheck) {
+            needsDefaultConstructorCheck = false;
+            ensureCanInitializeWithZeros();
+        }
+#endif
+    }
+    
+    void clear()
+    {
+        m_type = SpecNone;
+        m_arrayModes = 0;
+        m_structure.clear();
+        m_value = JSValue();
+        checkConsistency();
+    }
+    
+    bool isClear() const { return m_type == SpecNone; }
+    bool operator!() const { return isClear(); }
+    
+    void makeHeapTop()
+    {
+        makeTop(SpecHeapTop);
+    }
+    
+    void makeBytecodeTop()
+    {
+        makeTop(SpecBytecodeTop);
+    }
+    
+    void makeFullTop()
+    {
+        makeTop(SpecFullTop);
+    }
+    
+    void clobberStructures()
+    {
+        if (m_type & SpecCell) {
+            m_structure.clobber();
+            clobberArrayModes();
+        } else {
+            ASSERT(m_structure.isClear());
+            ASSERT(!m_arrayModes);
+        }
+        checkConsistency();
+    }
+    
+    static void clobberStructuresFor(AbstractValue& value)
+    {
+        value.clobberStructures();
+    }
+    
+    void observeInvalidationPoint()
+    {
+        m_structure.observeInvalidationPoint();
+        checkConsistency();
+    }
+    
+    static void observeInvalidationPointFor(AbstractValue& value)
+    {
+        value.observeInvalidationPoint();
+    }
+    
+    void observeTransition(RegisteredStructure from, RegisteredStructure to)
+    {
+        if (m_type & SpecCell) {
+            m_structure.observeTransition(from, to);
+            observeIndexingTypeTransition(from->indexingType(), to->indexingType());
+        }
+        checkConsistency();
+    }
+    
+    void observeTransitions(const TransitionVector& vector);
+    
+    class TransitionObserver {
+    public:
+        TransitionObserver(RegisteredStructure from, RegisteredStructure to)
+            : m_from(from)
+            , m_to(to)
+        {
+        }
+        
+        void operator()(AbstractValue& value)
+        {
+            value.observeTransition(m_from, m_to);
+        }
+    private:
+        RegisteredStructure m_from;
+        RegisteredStructure m_to;
+    };
+    
+    class TransitionsObserver {
+    public:
+        TransitionsObserver(const TransitionVector& vector)
+            : m_vector(vector)
+        {
+        }
+        
+        void operator()(AbstractValue& value)
+        {
+            value.observeTransitions(m_vector);
+        }
+    private:
+        const TransitionVector& m_vector;
+    };
+    
+    void clobberValue()
+    {
+        m_value = JSValue();
+    }
+    
+    bool isHeapTop() const
+    {
+        return (m_type | SpecHeapTop) == m_type
+            && m_structure.isTop()
+            && m_arrayModes == ALL_ARRAY_MODES
+            && !m_value;
+    }
+    
+    bool valueIsTop() const
+    {
+        return !m_value && m_type;
+    }
+    
+    JSValue value() const
+    {
+        return m_value;
+    }
+    
+    static AbstractValue heapTop()
+    {
+        AbstractValue result;
+        result.makeHeapTop();
+        return result;
+    }
+    
+    static AbstractValue bytecodeTop()
+    {
+        AbstractValue result;
+        result.makeBytecodeTop();
+        return result;
+    }
+    
+    static AbstractValue fullTop()
+    {
+        AbstractValue result;
+        result.makeFullTop();
+        return result;
+    }
+    
+    void set(Graph&, const FrozenValue&, StructureClobberState);
+    void set(Graph&, Structure*);
+    void set(Graph&, RegisteredStructure);
+    void set(Graph&, const RegisteredStructureSet&);
+    
+    // Set this value to represent the given set of types as precisely as possible.
+    void setType(Graph&, SpeculatedType);
+    
+    // As above, but only valid for non-cell types.
+    void setType(SpeculatedType type)
+    {
+        RELEASE_ASSERT(!(type & SpecCell));
+        m_structure.clear();
+        m_arrayModes = 0;
+        m_type = type;
+        m_value = JSValue();
+        checkConsistency();
+    }
+
+    void set(Graph&, const InferredType::Descriptor&);
+    void set(Graph&, const InferredType::Descriptor&, StructureClobberState);
+
+    void fixTypeForRepresentation(Graph&, NodeFlags representation, Node* = nullptr);
+    void fixTypeForRepresentation(Graph&, Node*);
+    
+    bool operator==(const AbstractValue& other) const
+    {
+        return m_type == other.m_type
+            && m_arrayModes == other.m_arrayModes
+            && m_structure == other.m_structure
+            && m_value == other.m_value;
+    }
+    bool operator!=(const AbstractValue& other) const
+    {
+        return !(*this == other);
+    }
+    
+    bool merge(const AbstractValue& other)
+    {
+        if (other.isClear())
+            return false;
+        
+#if !ASSERT_DISABLED
+        AbstractValue oldMe = *this;
+#endif
+        bool result = false;
+        if (isClear()) {
+            *this = other;
+            result = !other.isClear();
+        } else {
+            result |= mergeSpeculation(m_type, other.m_type);
+            result |= mergeArrayModes(m_arrayModes, other.m_arrayModes);
+            result |= m_structure.merge(other.m_structure);
+            if (m_value != other.m_value) {
+                result |= !!m_value;
+                m_value = JSValue();
+            }
+        }
+        checkConsistency();
+        ASSERT(result == (*this != oldMe));
+        return result;
+    }
+    
+    bool mergeOSREntryValue(Graph&, JSValue);
+    
+    void merge(SpeculatedType type)
+    {
+        mergeSpeculation(m_type, type);
+        
+        if (type & SpecCell) {
+            m_structure.makeTop();
+            m_arrayModes = ALL_ARRAY_MODES;
+        }
+        m_value = JSValue();
+
+        checkConsistency();
+    }
+    
+    bool couldBeType(SpeculatedType desiredType) const
+    {
+        return !!(m_type & desiredType);
+    }
+    
+    bool isType(SpeculatedType desiredType) const
+    {
+        return !(m_type & ~desiredType);
+    }
+
+    bool isType(Graph&, const InferredType::Descriptor&) const;
+
+    // Filters the value using the given structure set. If the admittedTypes argument is not passed, this
+    // implicitly filters by the types implied by the structure set, which are usually a subset of
+    // SpecCell. Hence, after this call, the value will no longer have any non-cell members. But, you can
+    // use admittedTypes to preserve some non-cell types. Note that it's wrong for admittedTypes to overlap
+    // with SpecCell.
+    FiltrationResult filter(Graph&, const RegisteredStructureSet&, SpeculatedType admittedTypes = SpecNone);
+    
+    FiltrationResult filterArrayModes(ArrayModes);
+    FiltrationResult filter(SpeculatedType);
+    FiltrationResult filterByValue(const FrozenValue& value);
+    FiltrationResult filter(const AbstractValue&);
+    FiltrationResult filterClassInfo(Graph&, const ClassInfo*);
+
+    FiltrationResult filter(Graph&, const InferredType::Descriptor&);
+    
+    FiltrationResult changeStructure(Graph&, const RegisteredStructureSet&);
+    
+    bool contains(RegisteredStructure) const;
+
+    bool validate(JSValue value) const
+    {
+        if (isHeapTop())
+            return true;
+        
+        if (!!m_value && m_value != value)
+            return false;
+        
+        if (mergeSpeculations(m_type, speculationFromValue(value)) != m_type)
+            return false;
+        
+        if (value.isEmpty()) {
+            ASSERT(m_type & SpecEmpty);
+            return true;
+        }
+        
+        if (!!value && value.isCell()) {
+            ASSERT(m_type & SpecCell);
+            Structure* structure = value.asCell()->structure();
+            return m_structure.contains(structure)
+                && (m_arrayModes & asArrayModes(structure->indexingType()));
+        }
+        
+        return true;
+    }
+    
+    bool hasClobberableState() const
+    {
+        return m_structure.isNeitherClearNorTop()
+            || !arrayModesAreClearOrTop(m_arrayModes);
+    }
+    
+#if ASSERT_DISABLED
+    void checkConsistency() const { }
+    void assertIsRegistered(Graph&) const { }
+#else
+    void checkConsistency() const;
+    void assertIsRegistered(Graph&) const;
+#endif
+
+    ResultType resultType() const;
+
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+    
+    void validateReferences(const TrackedReferences&);
+    
+    // This is a proven constraint on the structures that this value can have right
+    // now. The structure of the current value must belong to this set. The set may
+    // be TOP, indicating that it is the set of all possible structures, in which
+    // case the current value can have any structure. The set may be BOTTOM (empty)
+    // in which case this value cannot be a cell. This is all subject to change
+    // anytime a new value is assigned to this one, anytime there is a control flow
+    // merge, or most crucially, anytime a side-effect or structure check happens.
+    // In case of a side-effect, we must assume that any value with a structure that
+    // isn't being watched may have had its structure changed, hence contravening
+    // our proof. In such a case we make the proof valid again by switching this to
+    // TOP (i.e. claiming that we have proved that this value may have any
+    // structure).
+    StructureAbstractValue m_structure;
+    
+    // This is a proven constraint on the possible types that this value can have
+    // now or any time in the future, unless it is reassigned. This field is
+    // impervious to side-effects. The relationship between this field, and the
+    // structure fields above, is as follows. The fields above constraint the
+    // structures that a cell may have, but they say nothing about whether or not
+    // the value is known to be a cell. More formally, the m_structure is itself an
+    // abstract value that consists of the union of the set of all non-cell values
+    // and the set of cell values that have the given structure. This abstract
+    // value is then the intersection of the m_structure and the set of values
+    // whose type is m_type. So, for example if m_type is SpecFinal|SpecInt32Only and
+    // m_structure is [0x12345] then this abstract value corresponds to the set of
+    // all integers unified with the set of all objects with structure 0x12345.
+    SpeculatedType m_type;
+    
+    // This is a proven constraint on the possible indexing types that this value
+    // can have right now. It also implicitly constraints the set of structures
+    // that the value may have right now, since a structure has an immutable
+    // indexing type. This is subject to change upon reassignment, or any side
+    // effect that makes non-obvious changes to the heap.
+    ArrayModes m_arrayModes;
+    
+    // This is a proven constraint on the possible values that this value can
+    // have now or any time in the future, unless it is reassigned. Note that this
+    // implies nothing about the structure. Oddly, JSValue() (i.e. the empty value)
+    // means either BOTTOM or TOP depending on the state of m_type: if m_type is
+    // BOTTOM then JSValue() means BOTTOM; if m_type is not BOTTOM then JSValue()
+    // means TOP. Also note that this value isn't necessarily known to the GC
+    // (strongly or even weakly - it may be an "fragile" value, see
+    // DFGValueStrength.h). If you perform any optimization based on a cell m_value
+    // that requires that the value be kept alive, you must call freeze() on that
+    // value, which will turn it into a weak value.
+    JSValue m_value;
+
+private:
+    void clobberArrayModes()
+    {
+        // FIXME: We could make this try to predict the set of array modes that this object
+        // could have in the future. For now, just do the simple thing.
+        m_arrayModes = ALL_ARRAY_MODES;
+    }
+    
+    void observeIndexingTypeTransition(IndexingType from, IndexingType to)
+    {
+        if (m_arrayModes & asArrayModes(from))
+            m_arrayModes |= asArrayModes(to);
+    }
+    
+    bool validateType(JSValue value) const
+    {
+        if (isHeapTop())
+            return true;
+        
+        // Constant folding always represents Int52's in a double (i.e. AnyIntAsDouble).
+        // So speculationFromValue(value) for an Int52 value will return AnyIntAsDouble,
+        // and that's fine - the type validates just fine.
+        SpeculatedType type = m_type;
+        if (type & SpecInt52Only)
+            type |= SpecAnyIntAsDouble;
+        
+        if (mergeSpeculations(type, speculationFromValue(value)) != type)
+            return false;
+        
+        if (value.isEmpty()) {
+            ASSERT(m_type & SpecEmpty);
+            return true;
+        }
+        
+        return true;
+    }
+    
+    void makeTop(SpeculatedType top)
+    {
+        m_type |= top;
+        m_arrayModes = ALL_ARRAY_MODES;
+        m_structure.makeTop();
+        m_value = JSValue();
+        checkConsistency();
+    }
+    
+    void filterValueByType();
+    void filterArrayModesByType();
+
+#if USE(JSVALUE64) && !defined(NDEBUG)
+    void ensureCanInitializeWithZeros();
+#endif
+    
+    bool shouldBeClear() const;
+    FiltrationResult normalizeClarity();
+    FiltrationResult normalizeClarity(Graph&);
+};
+
+} } // namespace JSC::DFG
+
+#if USE(JSVALUE64)
+namespace WTF {
+template <>
+struct VectorTraits<JSC::DFG::AbstractValue> : VectorTraitsBase<false, JSC::DFG::AbstractValue> {
+    static const bool canInitializeWithMemset = true;
+};
+
+template <>
+struct HashTraits<JSC::DFG::AbstractValue> : GenericHashTraits<JSC::DFG::AbstractValue> {
+    static const bool emptyValueIsZero = true;
+};
+};
+#endif // USE(JSVALUE64)
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp b/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp
new file mode 100644
index 0000000..207b2fc
--- /dev/null
+++ b/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGAdaptiveInferredPropertyValueWatchpoint.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGCommon.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+AdaptiveInferredPropertyValueWatchpoint::AdaptiveInferredPropertyValueWatchpoint(const ObjectPropertyCondition& key, CodeBlock* codeBlock)
+    : Base(key)
+    , m_codeBlock(codeBlock)
+{
+}
+
+void AdaptiveInferredPropertyValueWatchpoint::handleFire(const FireDetail& detail)
+{
+    if (DFG::shouldDumpDisassembly())
+        dataLog("Firing watchpoint ", RawPointer(this), " (", key(), ") on ", *m_codeBlock, "\n");
+
+
+    StringPrintStream out;
+    out.print("Adaptation of ", key(), " failed: ", detail);
+
+    StringFireDetail stringDetail(out.toCString().data());
+
+    m_codeBlock->jettison(Profiler::JettisonDueToUnprofiledWatchpoint, CountReoptimization, &stringDetail);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h b/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h
new file mode 100644
index 0000000..089cca6
--- /dev/null
+++ b/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "AdaptiveInferredPropertyValueWatchpointBase.h"
+
+namespace JSC { namespace DFG {
+
+class AdaptiveInferredPropertyValueWatchpoint : public AdaptiveInferredPropertyValueWatchpointBase {
+public:
+    typedef AdaptiveInferredPropertyValueWatchpointBase Base;
+    AdaptiveInferredPropertyValueWatchpoint(const ObjectPropertyCondition&, CodeBlock*);
+
+private:
+    void handleFire(const FireDetail&) override;
+
+    CodeBlock* m_codeBlock;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAdaptiveStructureWatchpoint.cpp b/dfg/DFGAdaptiveStructureWatchpoint.cpp
new file mode 100644
index 0000000..0854c56
--- /dev/null
+++ b/dfg/DFGAdaptiveStructureWatchpoint.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGAdaptiveStructureWatchpoint.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+AdaptiveStructureWatchpoint::AdaptiveStructureWatchpoint(
+    const ObjectPropertyCondition& key,
+    CodeBlock* codeBlock)
+    : m_key(key)
+    , m_codeBlock(codeBlock)
+{
+    RELEASE_ASSERT(key.watchingRequiresStructureTransitionWatchpoint());
+    RELEASE_ASSERT(!key.watchingRequiresReplacementWatchpoint());
+}
+
+void AdaptiveStructureWatchpoint::install()
+{
+    RELEASE_ASSERT(m_key.isWatchable());
+    
+    m_key.object()->structure()->addTransitionWatchpoint(this);
+}
+
+void AdaptiveStructureWatchpoint::fireInternal(const FireDetail& detail)
+{
+    if (m_key.isWatchable(PropertyCondition::EnsureWatchability)) {
+        install();
+        return;
+    }
+    
+    if (DFG::shouldDumpDisassembly()) {
+        dataLog(
+            "Firing watchpoint ", RawPointer(this), " (", m_key, ") on ", *m_codeBlock, "\n");
+    }
+    
+    StringPrintStream out;
+    out.print("Adaptation of ", m_key, " failed: ", detail);
+    
+    StringFireDetail stringDetail(out.toCString().data());
+    
+    m_codeBlock->jettison(
+        Profiler::JettisonDueToUnprofiledWatchpoint, CountReoptimization, &stringDetail);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGAdaptiveStructureWatchpoint.h b/dfg/DFGAdaptiveStructureWatchpoint.h
new file mode 100644
index 0000000..40fcc10
--- /dev/null
+++ b/dfg/DFGAdaptiveStructureWatchpoint.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "ObjectPropertyCondition.h"
+#include "Watchpoint.h"
+
+namespace JSC { namespace DFG {
+
+class AdaptiveStructureWatchpoint : public Watchpoint {
+public:
+    AdaptiveStructureWatchpoint(const ObjectPropertyCondition&, CodeBlock*);
+    
+    const ObjectPropertyCondition& key() const { return m_key; }
+    
+    void install();
+
+protected:
+    void fireInternal(const FireDetail&) override;
+
+private:
+    ObjectPropertyCondition m_key;
+    CodeBlock* m_codeBlock;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAdjacencyList.h b/dfg/DFGAdjacencyList.h
new file mode 100644
index 0000000..4efbdeb
--- /dev/null
+++ b/dfg/DFGAdjacencyList.h
@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2011, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGEdge.h"
+
+namespace JSC { namespace DFG {
+
+class AdjacencyList {
+public:
+    enum Kind {
+        Fixed,
+        Variable
+    };
+    
+    enum { Size = 3 };
+    
+    AdjacencyList() { }
+    
+    AdjacencyList(Kind kind)
+    {
+        if (kind == Variable) {
+            m_words[0].m_encodedWord = UINT_MAX;
+            m_words[1].m_encodedWord = UINT_MAX;
+        }
+    }
+    
+    AdjacencyList(Kind kind, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())
+    {
+        ASSERT_UNUSED(kind, kind == Fixed);
+        initialize(child1, child2, child3);
+    }
+    
+    AdjacencyList(Kind kind, unsigned firstChild, unsigned numChildren)
+    {
+        ASSERT_UNUSED(kind, kind == Variable);
+        setFirstChild(firstChild);
+        setNumChildren(numChildren);
+    }
+    
+    bool isEmpty() const { return !child1(); }
+    
+    const Edge& child(unsigned i) const
+    {
+        ASSERT(i < Size);
+        return m_words[i];
+    }    
+    
+    Edge& child(unsigned i)
+    {
+        ASSERT(i < Size);
+        return m_words[i];
+    }
+    
+    void setChild(unsigned i, Edge nodeUse)
+    {
+        ASSERT(i < Size);
+        m_words[i] = nodeUse;
+    }
+    
+    Edge child1() const { return child(0); }
+    Edge child2() const { return child(1); }
+    Edge child3() const { return child(2); }
+
+    Edge& child1() { return child(0); }
+    Edge& child2() { return child(1); }
+    Edge& child3() { return child(2); }
+    
+    void setChild1(Edge nodeUse) { setChild(0, nodeUse); }
+    void setChild2(Edge nodeUse) { setChild(1, nodeUse); }
+    void setChild3(Edge nodeUse) { setChild(2, nodeUse); }
+    
+    Edge child1Unchecked() const { return m_words[0]; }
+    
+    Edge justOneChild() const
+    {
+        if (!!child1() && !child2()) {
+            ASSERT(!child3());
+            return child1();
+        }
+        return Edge();
+    }
+    
+    void initialize(Edge child1, Edge child2, Edge child3)
+    {
+        child(0) = child1;
+        child(1) = child2;
+        child(2) = child3;
+    }
+    
+    void initialize(Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)
+    {
+        initialize(Edge(child1), Edge(child2), Edge(child3));
+    }
+    
+    void reset()
+    {
+        initialize();
+    }
+    
+    // Call this if you wish to remove an edge and the node treats the list of children.
+    void removeEdge(unsigned edgeIndex)
+    {
+        for (unsigned i = edgeIndex; i < Size - 1; ++i)
+            setChild(i, child(i + 1));
+        setChild(Size - 1, Edge());
+    }
+    
+    unsigned firstChild() const
+    {
+        return m_words[0].m_encodedWord;
+    }
+    void setFirstChild(unsigned firstChild)
+    {
+        m_words[0].m_encodedWord = firstChild;
+    }
+    
+    unsigned numChildren() const
+    {
+        return m_words[1].m_encodedWord;
+    }
+    void setNumChildren(unsigned numChildren)
+    {
+        m_words[1].m_encodedWord = numChildren;
+    }
+    
+    AdjacencyList sanitized() const
+    {
+        return AdjacencyList(Fixed, child1().sanitized(), child2().sanitized(), child3().sanitized());
+    }
+    
+    AdjacencyList justChecks() const
+    {
+        AdjacencyList result(Fixed);
+        unsigned sourceIndex = 0;
+        unsigned targetIndex = 0;
+        while (sourceIndex < AdjacencyList::Size) {
+            Edge edge = child(sourceIndex++);
+            if (!edge)
+                break;
+            if (edge.willHaveCheck())
+                result.child(targetIndex++) = edge;
+        }
+        return result;
+    }
+    
+    unsigned hash() const
+    {
+        unsigned result = 0;
+        if (!child1())
+            return result;
+        
+        result += child1().hash();
+        
+        if (!child2())
+            return result;
+        
+        result *= 3;
+        result += child2().hash();
+        
+        if (!child3())
+            return result;
+        
+        result *= 3;
+        result += child3().hash();
+        
+        return result;
+    }
+    
+    bool operator==(const AdjacencyList& other) const
+    {
+        return child1() == other.child1()
+            && child2() == other.child2()
+            && child3() == other.child3();
+    }
+    
+private:
+    Edge m_words[Size];
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAllocator.h b/dfg/DFGAllocator.h
new file mode 100644
index 0000000..0a0e99e
--- /dev/null
+++ b/dfg/DFGAllocator.h
@@ -0,0 +1,235 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC { namespace DFG {
+
+// Custom pool allocator for exactly one type (type T). It has fast (O(1), only a few
+// instructions) allocator, and a similarly fast free(). Recycling works if either of
+// the following is true:
+// - T has a trivial destructor. In that case you don't have to ever call free() on
+//   anything. You can just call freeAll() instead.
+// - You call free() on all T's that you allocated, and never use freeAll().
+
+template<typename T>
+class Allocator {
+public:
+    Allocator();
+    ~Allocator();
+    
+    void* allocate(); // Use placement new to allocate, and avoid using this method.
+    void free(T*); // Call this method to delete; never use 'delete' directly.
+    
+    void freeAll(); // Only call this if you've either freed everything or if T has a trivial destructor.
+    void reset(); // Like freeAll(), but also returns all memory to the OS.
+    
+    unsigned indexOf(const T*);
+    
+    static Allocator* allocatorOf(const T*);
+    
+private:
+    void* bumpAllocate();
+    void* freeListAllocate();
+    void* allocateSlow();
+
+    struct Region {
+        static size_t size() { return 64 * KB; }
+        static size_t headerSize() { return std::max(sizeof(Region), sizeof(T)); }
+        static unsigned numberOfThingsPerRegion() { return (size() - headerSize()) / sizeof(T); }
+        T* data() { return bitwise_cast<T*>(bitwise_cast<char*>(this) + headerSize()); }
+        bool isInThisRegion(const T* pointer) { return static_cast<unsigned>(pointer - data()) < numberOfThingsPerRegion(); }
+        static Region* regionFor(const T* pointer) { return bitwise_cast<Region*>(bitwise_cast<uintptr_t>(pointer) & ~(size() - 1)); }
+        
+        void* m_allocation;
+        Allocator* m_allocator;
+        Region* m_next;
+    };
+    
+    void freeRegionsStartingAt(Region*);
+    void startBumpingIn(Region*);
+    
+    Region* m_regionHead;
+    void** m_freeListHead;
+    T* m_bumpEnd;
+    unsigned m_bumpRemaining;
+};
+
+template<typename T>
+inline Allocator<T>::Allocator()
+    : m_regionHead(0)
+    , m_freeListHead(0)
+    , m_bumpRemaining(0)
+{
+}
+
+template<typename T>
+inline Allocator<T>::~Allocator()
+{
+    reset();
+}
+
+template<typename T>
+ALWAYS_INLINE void* Allocator<T>::allocate()
+{
+    void* result = bumpAllocate();
+    if (LIKELY(!!result))
+        return result;
+    return freeListAllocate();
+}
+
+template<typename T>
+void Allocator<T>::free(T* object)
+{
+    object->~T();
+    
+    void** cell = bitwise_cast<void**>(object);
+    *cell = m_freeListHead;
+    m_freeListHead = cell;
+}
+
+template<typename T>
+void Allocator<T>::freeAll()
+{
+    if (!m_regionHead) {
+        ASSERT(!m_bumpRemaining);
+        ASSERT(!m_freeListHead);
+        return;
+    }
+    
+    // Since the caller is opting out of calling the destructor for any allocated thing,
+    // we have two choices, plus a continuum between: we can either just delete all regions
+    // (i.e. call reset()), or we can make all regions available for reuse. We do something
+    // that optimizes for (a) speed of freeAll(), (b) the assumption that if the user calls
+    // freeAll() then they will probably be calling allocate() in the near future. Namely,
+    // we free all but one region, and make the remaining region a bump allocation region.
+    
+    freeRegionsStartingAt(m_regionHead->m_next);
+    
+    m_regionHead->m_next = 0;
+    m_freeListHead = 0;
+    startBumpingIn(m_regionHead);
+}
+
+template<typename T>
+void Allocator<T>::reset()
+{
+    freeRegionsStartingAt(m_regionHead);
+    
+    m_regionHead = 0;
+    m_freeListHead = 0;
+    m_bumpRemaining = 0;
+}
+
+template<typename T>
+unsigned Allocator<T>::indexOf(const T* object)
+{
+    unsigned numRegions = 0;
+    for (Region* region = m_regionHead; region; region = region->m_next)
+        numRegions++;
+    unsigned regionIndex = 0;
+    for (Region* region = m_regionHead; region; region = region->m_next) {
+        if (region->isInThisRegion(object))
+            return (numRegions - 1 - regionIndex) * Region::numberOfThingsPerRegion() + (object - region->data());
+        regionIndex++;
+    }
+    CRASH();
+    return 0;
+}
+
+template<typename T>
+Allocator<T>* Allocator<T>::allocatorOf(const T* object)
+{
+    return Region::regionFor(object)->m_allocator;
+}
+
+template<typename T>
+ALWAYS_INLINE void* Allocator<T>::bumpAllocate()
+{
+    if (unsigned remaining = m_bumpRemaining) {
+        remaining--;
+        m_bumpRemaining = remaining;
+        return m_bumpEnd - (remaining + 1);
+    }
+    return 0;
+}
+
+template<typename T>
+void* Allocator<T>::freeListAllocate()
+{
+    void** result = m_freeListHead;
+    if (UNLIKELY(!result))
+        return allocateSlow();
+    m_freeListHead = bitwise_cast<void**>(*result);
+    return result;
+}
+
+template<typename T>
+void* Allocator<T>::allocateSlow()
+{
+    ASSERT(!m_freeListHead);
+    ASSERT(!m_bumpRemaining);
+    
+    if (logCompilationChanges())
+        dataLog("Allocating another allocator region.\n");
+
+    void* allocation = fastAlignedMalloc(Region::size(), Region::size());
+    Region* region = static_cast<Region*>(allocation);
+    region->m_allocation = allocation;
+    region->m_allocator = this;
+    startBumpingIn(region);
+    region->m_next = m_regionHead;
+    m_regionHead = region;
+    
+    void* result = bumpAllocate();
+    ASSERT(result);
+    return result;
+}
+
+template<typename T>
+void Allocator<T>::freeRegionsStartingAt(typename Allocator<T>::Region* region)
+{
+    while (region) {
+        Region* nextRegion = region->m_next;
+        fastAlignedFree(region->m_allocation);
+        region = nextRegion;
+    }
+}
+
+template<typename T>
+void Allocator<T>::startBumpingIn(typename Allocator<T>::Region* region)
+{
+    m_bumpEnd = region->data() + Region::numberOfThingsPerRegion();
+    m_bumpRemaining = Region::numberOfThingsPerRegion();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGArgumentPosition.h b/dfg/DFGArgumentPosition.h
new file mode 100644
index 0000000..d73247b
--- /dev/null
+++ b/dfg/DFGArgumentPosition.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2012, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGDoubleFormatState.h"
+#include "DFGVariableAccessData.h"
+#include "DFGVariableAccessDataDump.h"
+#include "SpeculatedType.h"
+
+namespace JSC { namespace DFG {
+
+class ArgumentPosition {
+public:
+    ArgumentPosition()
+        : m_prediction(SpecNone)
+        , m_doubleFormatState(EmptyDoubleFormatState)
+        , m_isProfitableToUnbox(false)
+        , m_shouldNeverUnbox(false)
+    {
+    }
+    
+    void addVariable(VariableAccessData* variable)
+    {
+        m_variables.append(variable);
+        
+        // We may set this early. Merging it here saves us time in prediction propagation.
+        variable->mergeShouldNeverUnbox(m_shouldNeverUnbox);
+    }
+    
+    VariableAccessData* someVariable() const
+    {
+        if (m_variables.isEmpty())
+            return 0;
+        return m_variables[0]->find();
+    }
+    
+    FlushFormat flushFormat() const
+    {
+        if (VariableAccessData* variable = someVariable())
+            return variable->flushFormat();
+        return DeadFlush;
+    }
+    
+    bool mergeShouldNeverUnbox(bool shouldNeverUnbox)
+    {
+        return checkAndSet(m_shouldNeverUnbox, m_shouldNeverUnbox || shouldNeverUnbox);
+    }
+    
+    bool mergeArgumentPredictionAwareness()
+    {
+        bool changed = false;
+        for (unsigned i = 0; i < m_variables.size(); ++i) {
+            VariableAccessData* variable = m_variables[i]->find();
+            changed |= mergeSpeculation(m_prediction, variable->argumentAwarePrediction());
+            changed |= mergeDoubleFormatState(m_doubleFormatState, variable->doubleFormatState());
+            changed |= mergeShouldNeverUnbox(variable->shouldNeverUnbox());
+        }
+        if (!changed)
+            return false;
+        changed = false;
+        for (unsigned i = 0; i < m_variables.size(); ++i) {
+            VariableAccessData* variable = m_variables[i]->find();
+            changed |= variable->mergeArgumentAwarePrediction(m_prediction);
+            changed |= variable->mergeDoubleFormatState(m_doubleFormatState);
+            changed |= variable->mergeShouldNeverUnbox(m_shouldNeverUnbox);
+        }
+        return changed;
+    }
+    
+    bool mergeArgumentUnboxingAwareness()
+    {
+        bool changed = false;
+        for (unsigned i = 0; i < m_variables.size(); ++i) {
+            VariableAccessData* variable = m_variables[i]->find();
+            changed |= checkAndSet(m_isProfitableToUnbox, m_isProfitableToUnbox || variable->isProfitableToUnbox());
+        }
+        if (!changed)
+            return false;
+        changed = false;
+        for (unsigned i = 0; i < m_variables.size(); ++i) {
+            VariableAccessData* variable = m_variables[i]->find();
+            changed |= variable->mergeIsProfitableToUnbox(m_isProfitableToUnbox);
+        }
+        return changed;
+    }
+    
+    bool shouldUnboxIfPossible() const { return m_isProfitableToUnbox && !m_shouldNeverUnbox; }
+    
+    SpeculatedType prediction() const { return m_prediction; }
+    DoubleFormatState doubleFormatState() const { return m_doubleFormatState; }
+    bool shouldUseDoubleFormat() const
+    {
+        return doubleFormatState() == UsingDoubleFormat && shouldUnboxIfPossible();
+    }
+    
+    void dump(PrintStream& out, Graph* graph)
+    {
+        for (unsigned i = 0; i < m_variables.size(); ++i) {
+            VariableAccessData* variable = m_variables[i]->find();
+            VirtualRegister operand = variable->local();
+
+            if (i)
+                out.print(" ");
+
+            out.print(operand, "(", VariableAccessDataDump(*graph, variable), ")");
+        }
+        out.print("\n");
+    }
+    
+private:
+    SpeculatedType m_prediction;
+    DoubleFormatState m_doubleFormatState;
+    bool m_isProfitableToUnbox;
+    bool m_shouldNeverUnbox;
+    
+    Vector<VariableAccessData*, 2> m_variables;
+};
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGArgumentsEliminationPhase.cpp b/dfg/DFGArgumentsEliminationPhase.cpp
new file mode 100644
index 0000000..b93be30
--- /dev/null
+++ b/dfg/DFGArgumentsEliminationPhase.cpp
@@ -0,0 +1,1087 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGArgumentsEliminationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayPrototype.h"
+#include "BytecodeLivenessAnalysisInlines.h"
+#include "ClonedArguments.h"
+#include "DFGArgumentsUtilities.h"
+#include "DFGBasicBlockInlines.h"
+#include "DFGBlockMapInlines.h"
+#include "DFGClobberize.h"
+#include "DFGCombinedLiveness.h"
+#include "DFGForAllKills.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGLivenessAnalysisPhase.h"
+#include "DFGOSRAvailabilityAnalysisPhase.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include <wtf/HashSet.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verbose = false;
+
+class ArgumentsEliminationPhase : public Phase {
+public:
+    ArgumentsEliminationPhase(Graph& graph)
+        : Phase(graph, "arguments elimination")
+    {
+    }
+    
+    bool run()
+    {
+        // For now this phase only works on SSA. This could be changed; we could have a block-local
+        // version over LoadStore.
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_form == SSA);
+        
+        if (verbose) {
+            dataLog("Graph before arguments elimination:\n");
+            m_graph.dump();
+        }
+        
+        identifyCandidates();
+        if (m_candidates.isEmpty())
+            return false;
+        
+        eliminateCandidatesThatEscape();
+        if (m_candidates.isEmpty())
+            return false;
+        
+        eliminateCandidatesThatInterfere();
+        if (m_candidates.isEmpty())
+            return false;
+        
+        transform();
+        
+        return true;
+    }
+
+private:
+    // Just finds nodes that we know how to work with.
+    void identifyCandidates()
+    {
+        for (BasicBlock* block : m_graph.blocksInPreOrder()) {
+            for (Node* node : *block) {
+                switch (node->op()) {
+                case CreateDirectArguments:
+                case CreateClonedArguments:
+                    m_candidates.add(node);
+                    break;
+
+                case CreateRest:
+                    if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
+                        // If we're watching the HavingABadTime watchpoint it means that we will be invalidated
+                        // when it fires (it may or may not have actually fired yet). We don't try to eliminate
+                        // this allocation when we're not watching the watchpoint because it could entail calling
+                        // indexed accessors (and probably more crazy things) on out of bound accesses to the
+                        // rest parameter. It's also much easier to reason about this way.
+                        m_candidates.add(node);
+                    }
+                    break;
+
+                case Spread:
+                    if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
+                        // We check ArrayUse here because ArrayUse indicates that the iterator
+                        // protocol for Arrays is non-observable by user code (e.g, it hasn't
+                        // been changed).
+                        if (node->child1().useKind() == ArrayUse && node->child1()->op() == CreateRest && m_candidates.contains(node->child1().node()))
+                            m_candidates.add(node);
+                    }
+                    break;
+
+                case NewArrayWithSpread: {
+                    if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
+                        BitVector* bitVector = node->bitVector();
+                        // We only allow for Spreads to be of rest nodes for now.
+                        bool isOK = true;
+                        for (unsigned i = 0; i < node->numChildren(); i++) {
+                            if (bitVector->get(i)) {
+                                Node* child = m_graph.varArgChild(node, i).node();
+                                isOK = child->op() == Spread && child->child1()->op() == CreateRest && m_candidates.contains(child);
+                                if (!isOK)
+                                    break;
+                            }
+                        }
+
+                        if (!isOK)
+                            break;
+
+                        m_candidates.add(node);
+                    }
+                    break;
+                }
+                    
+                case CreateScopedArguments:
+                    // FIXME: We could handle this if it wasn't for the fact that scoped arguments are
+                    // always stored into the activation.
+                    // https://bugs.webkit.org/show_bug.cgi?id=143072 and
+                    // https://bugs.webkit.org/show_bug.cgi?id=143073
+                    break;
+                    
+                default:
+                    break;
+                }
+            }
+        }
+        
+        if (verbose)
+            dataLog("Candidates: ", listDump(m_candidates), "\n");
+    }
+
+    bool isStillValidCandidate(Node* candidate)
+    {
+        switch (candidate->op()) {
+        case Spread:
+            return m_candidates.contains(candidate->child1().node());
+
+        case NewArrayWithSpread: {
+            BitVector* bitVector = candidate->bitVector();
+            for (unsigned i = 0; i < candidate->numChildren(); i++) {
+                if (bitVector->get(i)) {
+                    if (!m_candidates.contains(m_graph.varArgChild(candidate, i).node()))
+                        return false;
+                }
+            }
+            return true;
+        }
+
+        default:
+            return true;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    void removeInvalidCandidates()
+    {
+        bool changed;
+        do {
+            changed = false;
+            Vector<Node*, 1> toRemove;
+
+            for (Node* candidate : m_candidates) {
+                if (!isStillValidCandidate(candidate))
+                    toRemove.append(candidate);
+            }
+
+            if (toRemove.size()) {
+                changed = true;
+                for (Node* node : toRemove)
+                    m_candidates.remove(node);
+            }
+
+        } while (changed);
+    }
+
+    void transitivelyRemoveCandidate(Node* node, Node* source = nullptr)
+    {
+        bool removed = m_candidates.remove(node);
+        if (removed && verbose && source)
+            dataLog("eliminating candidate: ", node, " because it escapes from: ", source, "\n");
+
+        if (removed)
+            removeInvalidCandidates();
+    }
+    
+    // Look for escaping sites, and remove from the candidates set if we see an escape.
+    void eliminateCandidatesThatEscape()
+    {
+        auto escape = [&] (Edge edge, Node* source) {
+            if (!edge)
+                return;
+            transitivelyRemoveCandidate(edge.node(), source);
+        };
+        
+        auto escapeBasedOnArrayMode = [&] (ArrayMode mode, Edge edge, Node* source) {
+            switch (mode.type()) {
+            case Array::DirectArguments:
+                if (edge->op() != CreateDirectArguments)
+                    escape(edge, source);
+                break;
+            
+            case Array::Contiguous: {
+                if (edge->op() != CreateClonedArguments && edge->op() != CreateRest) {
+                    escape(edge, source);
+                    return;
+                }
+            
+                // Everything is fine if we're doing an in-bounds access.
+                if (mode.isInBounds())
+                    break;
+                
+                // If we're out-of-bounds then we proceed only if the prototype chain
+                // for the allocation is sane (i.e. doesn't have indexed properties).
+                JSGlobalObject* globalObject = m_graph.globalObjectFor(edge->origin.semantic);
+                InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
+                if (edge->op() == CreateRest) {
+                    InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
+                    if (arrayPrototypeTransition.isStillValid() 
+                        && objectPrototypeTransition.isStillValid() 
+                        && globalObject->arrayPrototypeChainIsSane()) {
+                        m_graph.watchpoints().addLazily(arrayPrototypeTransition);
+                        m_graph.watchpoints().addLazily(objectPrototypeTransition);
+                        break;
+                    }
+                } else {
+                    if (objectPrototypeTransition.isStillValid() 
+                        && globalObject->objectPrototypeIsSane()) {
+                        m_graph.watchpoints().addLazily(objectPrototypeTransition);
+                        break;
+                    }
+                }
+                escape(edge, source);
+                break;
+            }
+            
+            case Array::ForceExit:
+                break;
+            
+            default:
+                escape(edge, source);
+                break;
+            }
+        };
+
+        removeInvalidCandidates();
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            for (Node* node : *block) {
+                switch (node->op()) {
+                case GetFromArguments:
+                    break;
+                    
+                case GetByVal:
+                    escapeBasedOnArrayMode(node->arrayMode(), node->child1(), node);
+                    escape(node->child2(), node);
+                    escape(node->child3(), node);
+                    break;
+
+                case GetArrayLength:
+                    // FIXME: It would not be hard to support NewArrayWithSpread here if it is only over Spread(CreateRest) nodes.
+                    escape(node->child2(), node);
+                    break;
+                
+                case NewArrayWithSpread: {
+                    BitVector* bitVector = node->bitVector();
+                    bool isWatchingHavingABadTimeWatchpoint = m_graph.isWatchingHavingABadTimeWatchpoint(node); 
+                    for (unsigned i = 0; i < node->numChildren(); i++) {
+                        Edge child = m_graph.varArgChild(node, i);
+                        bool dontEscape;
+                        if (bitVector->get(i)) {
+                            dontEscape = child->op() == Spread
+                                && child->child1().useKind() == ArrayUse
+                                && child->child1()->op() == CreateRest
+                                && isWatchingHavingABadTimeWatchpoint;
+                        } else
+                            dontEscape = false;
+
+                        if (!dontEscape)
+                            escape(child, node);
+                    }
+
+                    break;
+                }
+
+                case Spread: {
+                    bool isOK = node->child1().useKind() == ArrayUse && node->child1()->op() == CreateRest;
+                    if (!isOK)
+                        escape(node->child1(), node);
+                    break;
+                }
+
+                    
+                case LoadVarargs:
+                    if (node->loadVarargsData()->offset && node->child1()->op() == NewArrayWithSpread)
+                        escape(node->child1(), node);
+                    break;
+                    
+                case CallVarargs:
+                case ConstructVarargs:
+                case TailCallVarargs:
+                case TailCallVarargsInlinedCaller:
+                    escape(node->child1(), node);
+                    escape(node->child2(), node);
+                    if (node->callVarargsData()->firstVarArgOffset && node->child3()->op() == NewArrayWithSpread)
+                        escape(node->child3(), node);
+                    break;
+
+                case Check:
+                    m_graph.doToChildren(
+                        node,
+                        [&] (Edge edge) {
+                            if (edge.willNotHaveCheck())
+                                return;
+                            
+                            if (alreadyChecked(edge.useKind(), SpecObject))
+                                return;
+                            
+                            escape(edge, node);
+                        });
+                    break;
+                    
+                case MovHint:
+                case PutHint:
+                    break;
+                    
+                case GetButterfly:
+                    // This barely works. The danger is that the GetButterfly is used by something that
+                    // does something escaping to a candidate. Fortunately, the only butterfly-using ops
+                    // that we exempt here also use the candidate directly. If there ever was a
+                    // butterfly-using op that we wanted to exempt, then we'd have to look at the
+                    // butterfly's child and check if it's a candidate.
+                    break;
+                    
+                case CheckArray:
+                    escapeBasedOnArrayMode(node->arrayMode(), node->child1(), node);
+                    break;
+
+                case CheckStructure: {
+                    if (!m_candidates.contains(node->child1().node()))
+                        break;
+
+                    Structure* structure = nullptr;
+                    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->child1().node()->origin.semantic);
+                    switch (node->child1().node()->op()) {
+                    case CreateDirectArguments:
+                        structure = globalObject->directArgumentsStructure();
+                        break;
+                    case CreateClonedArguments:
+                        structure = globalObject->clonedArgumentsStructure();
+                        break;
+                    case CreateRest:
+                        ASSERT(m_graph.isWatchingHavingABadTimeWatchpoint(node));
+                        structure = globalObject->restParameterStructure();
+                        break;
+                    case NewArrayWithSpread:
+                        ASSERT(m_graph.isWatchingHavingABadTimeWatchpoint(node));
+                        structure = globalObject->originalArrayStructureForIndexingType(ArrayWithContiguous);
+                        break;
+                    default:
+                        RELEASE_ASSERT_NOT_REACHED();
+                    }
+                    ASSERT(structure);
+
+                    if (!node->structureSet().contains(m_graph.registerStructure(structure)))
+                        escape(node->child1(), node);
+                    break;
+                }
+                    
+                // FIXME: We should be able to handle GetById/GetByOffset on callee.
+                // https://bugs.webkit.org/show_bug.cgi?id=143075
+
+                case GetByOffset:
+                    if (node->child2()->op() == CreateClonedArguments && node->storageAccessData().offset == clonedArgumentsLengthPropertyOffset)
+                        break;
+                    FALLTHROUGH;
+                default:
+                    m_graph.doToChildren(node, [&] (Edge edge) { return escape(edge, node); });
+                    break;
+                }
+            }
+        }
+
+        if (verbose)
+            dataLog("After escape analysis: ", listDump(m_candidates), "\n");
+    }
+
+    // Anywhere that a candidate is live (in bytecode or in DFG), check if there is a chance of
+    // interference between the stack area that the arguments object copies from and the arguments
+    // object's payload. Conservatively this means that the stack region doesn't get stored to.
+    void eliminateCandidatesThatInterfere()
+    {
+        performLivenessAnalysis(m_graph);
+        performOSRAvailabilityAnalysis(m_graph);
+        m_graph.initializeNodeOwners();
+        CombinedLiveness combinedLiveness(m_graph);
+        
+        BlockMap<Operands<bool>> clobberedByBlock(m_graph);
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            Operands<bool>& clobberedByThisBlock = clobberedByBlock[block];
+            clobberedByThisBlock = Operands<bool>(OperandsLike, m_graph.block(0)->variablesAtHead);
+            for (Node* node : *block) {
+                clobberize(
+                    m_graph, node, NoOpClobberize(),
+                    [&] (AbstractHeap heap) {
+                        if (heap.kind() != Stack) {
+                            ASSERT(!heap.overlaps(Stack));
+                            return;
+                        }
+                        ASSERT(!heap.payload().isTop());
+                        VirtualRegister reg(heap.payload().value32());
+                        clobberedByThisBlock.operand(reg) = true;
+                    },
+                    NoOpClobberize());
+            }
+        }
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            // Stop if we've already removed all candidates.
+            if (m_candidates.isEmpty())
+                return;
+            
+            // Ignore blocks that don't write to the stack.
+            bool writesToStack = false;
+            for (unsigned i = clobberedByBlock[block].size(); i--;) {
+                if (clobberedByBlock[block][i]) {
+                    writesToStack = true;
+                    break;
+                }
+            }
+            if (!writesToStack)
+                continue;
+            
+            forAllKillsInBlock(
+                m_graph, combinedLiveness, block,
+                [&] (unsigned nodeIndex, Node* candidate) {
+                    if (!m_candidates.contains(candidate))
+                        return;
+                    
+                    // Check if this block has any clobbers that affect this candidate. This is a fairly
+                    // fast check.
+                    bool isClobberedByBlock = false;
+                    Operands<bool>& clobberedByThisBlock = clobberedByBlock[block];
+                    
+                    if (InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame) {
+                        if (inlineCallFrame->isVarargs()) {
+                            isClobberedByBlock |= clobberedByThisBlock.operand(
+                                inlineCallFrame->stackOffset + CallFrameSlot::argumentCount);
+                        }
+                        
+                        if (!isClobberedByBlock || inlineCallFrame->isClosureCall) {
+                            isClobberedByBlock |= clobberedByThisBlock.operand(
+                                inlineCallFrame->stackOffset + CallFrameSlot::callee);
+                        }
+                        
+                        if (!isClobberedByBlock) {
+                            for (unsigned i = 0; i < inlineCallFrame->arguments.size() - 1; ++i) {
+                                VirtualRegister reg =
+                                    VirtualRegister(inlineCallFrame->stackOffset) +
+                                    CallFrame::argumentOffset(i);
+                                if (clobberedByThisBlock.operand(reg)) {
+                                    isClobberedByBlock = true;
+                                    break;
+                                }
+                            }
+                        }
+                    } else {
+                        // We don't include the ArgumentCount or Callee in this case because we can be
+                        // damn sure that this won't be clobbered.
+                        for (unsigned i = 1; i < static_cast<unsigned>(codeBlock()->numParameters()); ++i) {
+                            if (clobberedByThisBlock.argument(i)) {
+                                isClobberedByBlock = true;
+                                break;
+                            }
+                        }
+                    }
+                    
+                    if (!isClobberedByBlock)
+                        return;
+                    
+                    // Check if we can immediately eliminate this candidate. If the block has a clobber
+                    // for this arguments allocation, and we'd have to examine every node in the block,
+                    // then we can just eliminate the candidate.
+                    if (nodeIndex == block->size() && candidate->owner != block) {
+                        if (verbose)
+                            dataLog("eliminating candidate: ", candidate, " because it is clobbered by: ", block->at(nodeIndex), "\n");
+                        transitivelyRemoveCandidate(candidate);
+                        return;
+                    }
+                    
+                    // This loop considers all nodes up to the nodeIndex, excluding the nodeIndex.
+                    while (nodeIndex--) {
+                        Node* node = block->at(nodeIndex);
+                        if (node == candidate)
+                            break;
+                        
+                        bool found = false;
+                        clobberize(
+                            m_graph, node, NoOpClobberize(),
+                            [&] (AbstractHeap heap) {
+                                if (heap.kind() == Stack && !heap.payload().isTop()) {
+                                    if (argumentsInvolveStackSlot(candidate, VirtualRegister(heap.payload().value32())))
+                                        found = true;
+                                    return;
+                                }
+                                if (heap.overlaps(Stack))
+                                    found = true;
+                            },
+                            NoOpClobberize());
+                        
+                        if (found) {
+                            if (verbose)
+                                dataLog("eliminating candidate: ", candidate, " because it is clobbered by ", block->at(nodeIndex), "\n");
+                            transitivelyRemoveCandidate(candidate);
+                            return;
+                        }
+                    }
+                });
+        }
+        
+        // Q: How do we handle OSR exit with a live PhantomArguments at a point where the inline call
+        // frame is dead?  A: Naively we could say that PhantomArguments must escape the stack slots. But
+        // that would break PutStack sinking, which in turn would break object allocation sinking, in
+        // cases where we have a varargs call to an otherwise pure method. So, we need something smarter.
+        // For the outermost arguments, we just have a PhantomArguments that magically knows that it
+        // should load the arguments from the call frame. For the inline arguments, we have the heap map
+        // in the availabiltiy map track each possible inline argument as a promoted heap location. If the
+        // PutStacks for those arguments aren't sunk, those heap locations will map to very trivial
+        // availabilities (they will be flush availabilities). But if sinking happens then those
+        // availabilities may become whatever. OSR exit should be able to handle this quite naturally,
+        // since those availabilities speak of the stack before the optimizing compiler stack frame is
+        // torn down.
+
+        if (verbose)
+            dataLog("After interference analysis: ", listDump(m_candidates), "\n");
+    }
+    
+    void transform()
+    {
+        InsertionSet insertionSet(m_graph);
+        
+        for (BasicBlock* block : m_graph.blocksInPreOrder()) {
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                
+                auto getArrayLength = [&] (Node* candidate) -> Node* {
+                    return emitCodeToGetArgumentsArrayLength(
+                        insertionSet, candidate, nodeIndex, node->origin);
+                };
+
+                auto isEliminatedAllocation = [&] (Node* candidate) -> bool {
+                    if (!m_candidates.contains(candidate))
+                        return false;
+                    // We traverse in such a way that we are guaranteed to see a def before a use.
+                    // Therefore, we should have already transformed the allocation before the use
+                    // of an allocation.
+                    ASSERT(candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments
+                        || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread);
+                    return true;
+                };
+
+                switch (node->op()) {
+                case CreateDirectArguments:
+                    if (!m_candidates.contains(node))
+                        break;
+                    
+                    node->setOpAndDefaultFlags(PhantomDirectArguments);
+                    break;
+
+                case CreateRest:
+                    if (!m_candidates.contains(node))
+                        break;
+
+                    node->setOpAndDefaultFlags(PhantomCreateRest);
+                    // We don't need this parameter for OSR exit, we can find out all the information
+                    // we need via the static parameter count and the dynamic argument count.
+                    node->child1() = Edge(); 
+                    break;
+                    
+                case CreateClonedArguments:
+                    if (!m_candidates.contains(node))
+                        break;
+                    
+                    node->setOpAndDefaultFlags(PhantomClonedArguments);
+                    break;
+
+                case Spread:
+                    if (!m_candidates.contains(node))
+                        break;
+                    
+                    node->setOpAndDefaultFlags(PhantomSpread);
+                    break;
+
+                case NewArrayWithSpread:
+                    if (!m_candidates.contains(node))
+                        break;
+                    
+                    node->setOpAndDefaultFlags(PhantomNewArrayWithSpread);
+                    break;
+                    
+                case GetFromArguments: {
+                    Node* candidate = node->child1().node();
+                    if (!isEliminatedAllocation(candidate))
+                        break;
+                    
+                    DFG_ASSERT(
+                        m_graph, node, node->child1()->op() == PhantomDirectArguments);
+                    VirtualRegister reg =
+                        virtualRegisterForArgument(node->capturedArgumentsOffset().offset() + 1) +
+                        node->origin.semantic.stackOffset();
+                    StackAccessData* data = m_graph.m_stackAccessData.add(reg, FlushedJSValue);
+                    node->convertToGetStack(data);
+                    break;
+                }
+
+                case GetByOffset: {
+                    Node* candidate = node->child2().node();
+                    if (!isEliminatedAllocation(candidate))
+                        break;
+
+                    if (node->child2()->op() != PhantomClonedArguments)
+                        break;
+
+                    ASSERT(node->storageAccessData().offset == clonedArgumentsLengthPropertyOffset);
+
+                    // Meh, this is kind of hackish - we use an Identity so that we can reuse the
+                    // getArrayLength() helper.
+                    node->convertToIdentityOn(getArrayLength(candidate));
+                    break;
+                }
+                    
+                case GetArrayLength: {
+                    Node* candidate = node->child1().node();
+                    if (!isEliminatedAllocation(candidate))
+                        break;
+                    
+                    // Meh, this is kind of hackish - we use an Identity so that we can reuse the
+                    // getArrayLength() helper.
+                    node->convertToIdentityOn(getArrayLength(candidate));
+                    break;
+                }
+                    
+                case GetByVal: {
+                    // FIXME: For ClonedArguments, we would have already done a separate bounds check.
+                    // This code will cause us to have two bounds checks - the original one that we
+                    // already factored out in SSALoweringPhase, and the new one we insert here, which is
+                    // often implicitly part of GetMyArgumentByVal. B3 will probably eliminate the
+                    // second bounds check, but still - that's just silly.
+                    // https://bugs.webkit.org/show_bug.cgi?id=143076
+                    
+                    Node* candidate = node->child1().node();
+                    if (!isEliminatedAllocation(candidate))
+                        break;
+
+                    unsigned numberOfArgumentsToSkip = 0;
+                    if (candidate->op() == PhantomCreateRest)
+                        numberOfArgumentsToSkip = candidate->numberOfArgumentsToSkip();
+                    
+                    Node* result = nullptr;
+                    if (node->child2()->isInt32Constant()) {
+                        unsigned index = node->child2()->asUInt32();
+                        InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame;
+                        index += numberOfArgumentsToSkip;
+                        
+                        bool safeToGetStack;
+                        if (inlineCallFrame)
+                            safeToGetStack = index < inlineCallFrame->arguments.size() - 1;
+                        else {
+                            safeToGetStack =
+                                index < static_cast<unsigned>(codeBlock()->numParameters()) - 1;
+                        }
+                        if (safeToGetStack) {
+                            StackAccessData* data;
+                            VirtualRegister arg = virtualRegisterForArgument(index + 1);
+                            if (inlineCallFrame)
+                                arg += inlineCallFrame->stackOffset;
+                            data = m_graph.m_stackAccessData.add(arg, FlushedJSValue);
+                            
+                            if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
+                                insertionSet.insertNode(
+                                    nodeIndex, SpecNone, CheckInBounds, node->origin,
+                                    node->child2(), Edge(getArrayLength(candidate), Int32Use));
+                            }
+                            
+                            result = insertionSet.insertNode(
+                                nodeIndex, node->prediction(), GetStack, node->origin, OpInfo(data));
+                        }
+                    }
+                    
+                    if (!result) {
+                        NodeType op;
+                        if (node->arrayMode().isInBounds())
+                            op = GetMyArgumentByVal;
+                        else
+                            op = GetMyArgumentByValOutOfBounds;
+                        result = insertionSet.insertNode(
+                            nodeIndex, node->prediction(), op, node->origin, OpInfo(numberOfArgumentsToSkip),
+                            node->child1(), node->child2());
+                    }
+
+                    // Need to do this because we may have a data format conversion here.
+                    node->convertToIdentityOn(result);
+                    break;
+                }
+                    
+                case LoadVarargs: {
+                    Node* candidate = node->child1().node();
+                    if (!isEliminatedAllocation(candidate))
+                        break;
+                    
+                    // LoadVarargs can exit, so it better be exitOK.
+                    DFG_ASSERT(m_graph, node, node->origin.exitOK);
+                    bool canExit = true;
+                    LoadVarargsData* varargsData = node->loadVarargsData();
+
+                    auto storeArgumentCountIncludingThis = [&] (unsigned argumentCountIncludingThis) {
+                        Node* argumentCountIncludingThisNode = insertionSet.insertConstant(
+                            nodeIndex, node->origin.withExitOK(canExit),
+                            jsNumber(argumentCountIncludingThis));
+                        insertionSet.insertNode(
+                            nodeIndex, SpecNone, MovHint, node->origin.takeValidExit(canExit),
+                            OpInfo(varargsData->count.offset()), Edge(argumentCountIncludingThisNode));
+                        insertionSet.insertNode(
+                            nodeIndex, SpecNone, PutStack, node->origin.withExitOK(canExit),
+                            OpInfo(m_graph.m_stackAccessData.add(varargsData->count, FlushedInt32)),
+                            Edge(argumentCountIncludingThisNode, KnownInt32Use));
+                    };
+
+                    auto storeValue = [&] (Node* value, unsigned storeIndex) {
+                        VirtualRegister reg = varargsData->start + storeIndex;
+                        StackAccessData* data =
+                            m_graph.m_stackAccessData.add(reg, FlushedJSValue);
+                        
+                        insertionSet.insertNode(
+                            nodeIndex, SpecNone, MovHint, node->origin.takeValidExit(canExit),
+                            OpInfo(reg.offset()), Edge(value));
+                        insertionSet.insertNode(
+                            nodeIndex, SpecNone, PutStack, node->origin.withExitOK(canExit),
+                            OpInfo(data), Edge(value));
+                    };
+
+                    if (candidate->op() == PhantomNewArrayWithSpread) {
+                        bool canConvertToStaticLoadStores = true;
+                        BitVector* bitVector = candidate->bitVector();
+
+                        for (unsigned i = 0; i < candidate->numChildren(); i++) {
+                            if (bitVector->get(i)) {
+                                Node* child = m_graph.varArgChild(candidate, i).node();
+                                ASSERT(child->op() == PhantomSpread && child->child1()->op() == PhantomCreateRest);
+                                InlineCallFrame* inlineCallFrame = child->child1()->origin.semantic.inlineCallFrame;
+                                if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
+                                    canConvertToStaticLoadStores = false;
+                                    break;
+                                }
+                            }
+                        }
+
+                        if (canConvertToStaticLoadStores) {
+                            unsigned argumentCountIncludingThis = 1; // |this|
+                            for (unsigned i = 0; i < candidate->numChildren(); i++) {
+                                if (bitVector->get(i)) {
+                                    Node* child = m_graph.varArgChild(candidate, i).node();
+                                    ASSERT(child->op() == PhantomSpread && child->child1()->op() == PhantomCreateRest);
+                                    unsigned numberOfArgumentsToSkip = child->child1()->numberOfArgumentsToSkip();
+                                    InlineCallFrame* inlineCallFrame = child->child1()->origin.semantic.inlineCallFrame;
+                                    unsigned numberOfSpreadArguments;
+                                    unsigned frameArgumentCount = inlineCallFrame->arguments.size() - 1;
+                                    if (frameArgumentCount >= numberOfArgumentsToSkip)
+                                        numberOfSpreadArguments = frameArgumentCount - numberOfArgumentsToSkip;
+                                    else
+                                        numberOfSpreadArguments = 0;
+
+                                    argumentCountIncludingThis += numberOfSpreadArguments;
+                                } else
+                                    ++argumentCountIncludingThis;
+                            }
+
+                            if (argumentCountIncludingThis <= varargsData->limit) {
+                                storeArgumentCountIncludingThis(argumentCountIncludingThis);
+
+                                DFG_ASSERT(m_graph, node, varargsData->limit - 1 >= varargsData->mandatoryMinimum);
+                                // Define our limit to exclude "this", since that's a bit easier to reason about.
+                                unsigned limit = varargsData->limit - 1;
+                                unsigned storeIndex = 0;
+                                for (unsigned i = 0; i < candidate->numChildren(); i++) {
+                                    if (bitVector->get(i)) {
+                                        Node* child = m_graph.varArgChild(candidate, i).node();
+                                        ASSERT(child->op() == PhantomSpread && child->child1()->op() == PhantomCreateRest);
+                                        unsigned numberOfArgumentsToSkip = child->child1()->numberOfArgumentsToSkip();
+                                        InlineCallFrame* inlineCallFrame = child->child1()->origin.semantic.inlineCallFrame;
+                                        unsigned frameArgumentCount = inlineCallFrame->arguments.size() - 1;
+                                        for (unsigned loadIndex = numberOfArgumentsToSkip; loadIndex < frameArgumentCount; ++loadIndex) {
+                                            VirtualRegister reg = virtualRegisterForArgument(loadIndex + 1) + inlineCallFrame->stackOffset;
+                                            StackAccessData* data = m_graph.m_stackAccessData.add(reg, FlushedJSValue);
+                                            Node* value = insertionSet.insertNode(
+                                                nodeIndex, SpecNone, GetStack, node->origin.withExitOK(canExit),
+                                                OpInfo(data));
+                                            storeValue(value, storeIndex);
+                                            ++storeIndex;
+                                        }
+                                    } else {
+                                        Node* value = m_graph.varArgChild(candidate, i).node();
+                                        storeValue(value, storeIndex);
+                                        ++storeIndex;
+                                    }
+                                }
+
+                                RELEASE_ASSERT(storeIndex <= limit);
+                                Node* undefined = nullptr;
+                                for (; storeIndex < limit; ++storeIndex) {
+                                    if (!undefined) {
+                                        undefined = insertionSet.insertConstant(
+                                            nodeIndex, node->origin.withExitOK(canExit), jsUndefined());
+                                    }
+                                    storeValue(undefined, storeIndex);
+                                }
+                            }
+
+                            node->remove();
+                            node->origin.exitOK = canExit;
+                            break;
+                        }
+                    } else {
+                        unsigned numberOfArgumentsToSkip = 0;
+                        if (candidate->op() == PhantomCreateRest)
+                            numberOfArgumentsToSkip = candidate->numberOfArgumentsToSkip();
+                        varargsData->offset += numberOfArgumentsToSkip;
+
+                        InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame;
+
+                        if (inlineCallFrame
+                            && !inlineCallFrame->isVarargs()) {
+
+                            unsigned argumentCountIncludingThis = inlineCallFrame->arguments.size();
+                            if (argumentCountIncludingThis > varargsData->offset)
+                                argumentCountIncludingThis -= varargsData->offset;
+                            else
+                                argumentCountIncludingThis = 1;
+                            RELEASE_ASSERT(argumentCountIncludingThis >= 1);
+
+                            if (argumentCountIncludingThis <= varargsData->limit) {
+                                
+                                storeArgumentCountIncludingThis(argumentCountIncludingThis);
+
+                                DFG_ASSERT(m_graph, node, varargsData->limit - 1 >= varargsData->mandatoryMinimum);
+                                // Define our limit to exclude "this", since that's a bit easier to reason about.
+                                unsigned limit = varargsData->limit - 1;
+                                Node* undefined = nullptr;
+                                for (unsigned storeIndex = 0; storeIndex < limit; ++storeIndex) {
+                                    // First determine if we have an element we can load, and load it if
+                                    // possible.
+                                    
+                                    Node* value = nullptr;
+                                    unsigned loadIndex = storeIndex + varargsData->offset;
+
+                                    if (loadIndex + 1 < inlineCallFrame->arguments.size()) {
+                                        VirtualRegister reg = virtualRegisterForArgument(loadIndex + 1) + inlineCallFrame->stackOffset;
+                                        StackAccessData* data = m_graph.m_stackAccessData.add(
+                                            reg, FlushedJSValue);
+                                        
+                                        value = insertionSet.insertNode(
+                                            nodeIndex, SpecNone, GetStack, node->origin.withExitOK(canExit),
+                                            OpInfo(data));
+                                    } else {
+                                        // FIXME: We shouldn't have to store anything if
+                                        // storeIndex >= varargsData->mandatoryMinimum, but we will still
+                                        // have GetStacks in that range. So if we don't do the stores, we'll
+                                        // have degenerate IR: we'll have GetStacks of something that didn't
+                                        // have PutStacks.
+                                        // https://bugs.webkit.org/show_bug.cgi?id=147434
+                                        
+                                        if (!undefined) {
+                                            undefined = insertionSet.insertConstant(
+                                                nodeIndex, node->origin.withExitOK(canExit), jsUndefined());
+                                        }
+                                        value = undefined;
+                                    }
+                                    
+                                    // Now that we have a value, store it.
+                                    storeValue(value, storeIndex);
+                                }
+                                
+                                node->remove();
+                                node->origin.exitOK = canExit;
+                                break;
+                            }
+                        }
+                    }
+
+                    node->setOpAndDefaultFlags(ForwardVarargs);
+                    break;
+                }
+                    
+                case CallVarargs:
+                case ConstructVarargs:
+                case TailCallVarargs:
+                case TailCallVarargsInlinedCaller: {
+                    Node* candidate = node->child3().node();
+                    if (!isEliminatedAllocation(candidate))
+                        break;
+
+                    auto convertToStaticArgumentCountCall = [&] (const Vector<Node*>& arguments) {
+                        unsigned firstChild = m_graph.m_varArgChildren.size();
+                        m_graph.m_varArgChildren.append(node->child1());
+                        m_graph.m_varArgChildren.append(node->child2());
+                        for (Node* argument : arguments)
+                            m_graph.m_varArgChildren.append(Edge(argument));
+                        switch (node->op()) {
+                        case CallVarargs:
+                            node->setOpAndDefaultFlags(Call);
+                            break;
+                        case ConstructVarargs:
+                            node->setOpAndDefaultFlags(Construct);
+                            break;
+                        case TailCallVarargs:
+                            node->setOpAndDefaultFlags(TailCall);
+                            break;
+                        case TailCallVarargsInlinedCaller:
+                            node->setOpAndDefaultFlags(TailCallInlinedCaller);
+                            break;
+                        default:
+                            RELEASE_ASSERT_NOT_REACHED();
+                        }
+                        node->children = AdjacencyList(
+                            AdjacencyList::Variable,
+                            firstChild, m_graph.m_varArgChildren.size() - firstChild);
+                    };
+
+                    auto convertToForwardsCall = [&] () {
+                        switch (node->op()) {
+                        case CallVarargs:
+                            node->setOpAndDefaultFlags(CallForwardVarargs);
+                            break;
+                        case ConstructVarargs:
+                            node->setOpAndDefaultFlags(ConstructForwardVarargs);
+                            break;
+                        case TailCallVarargs:
+                            node->setOpAndDefaultFlags(TailCallForwardVarargs);
+                            break;
+                        case TailCallVarargsInlinedCaller:
+                            node->setOpAndDefaultFlags(TailCallForwardVarargsInlinedCaller);
+                            break;
+                        default:
+                            RELEASE_ASSERT_NOT_REACHED();
+                        }
+                    };
+                    
+                    if (candidate->op() == PhantomNewArrayWithSpread) {
+                        bool canTransformToStaticArgumentCountCall = true;
+                        BitVector* bitVector = candidate->bitVector();
+                        for (unsigned i = 0; i < candidate->numChildren(); i++) {
+                            if (bitVector->get(i)) {
+                                Node* node = m_graph.varArgChild(candidate, i).node();
+                                ASSERT(node->op() == PhantomSpread);
+                                ASSERT(node->child1()->op() == PhantomCreateRest);
+                                InlineCallFrame* inlineCallFrame = node->child1()->origin.semantic.inlineCallFrame;
+                                if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
+                                    canTransformToStaticArgumentCountCall = false;
+                                    break;
+                                }
+                            }
+                        }
+
+                        if (canTransformToStaticArgumentCountCall) {
+                            Vector<Node*> arguments;
+                            for (unsigned i = 0; i < candidate->numChildren(); i++) {
+                                Node* child = m_graph.varArgChild(candidate, i).node();
+                                if (bitVector->get(i)) {
+                                    ASSERT(child->op() == PhantomSpread);
+                                    ASSERT(child->child1()->op() == PhantomCreateRest);
+                                    InlineCallFrame* inlineCallFrame = child->child1()->origin.semantic.inlineCallFrame;
+                                    unsigned numberOfArgumentsToSkip = child->child1()->numberOfArgumentsToSkip();
+                                    for (unsigned i = 1 + numberOfArgumentsToSkip; i < inlineCallFrame->arguments.size(); ++i) {
+                                        StackAccessData* data = m_graph.m_stackAccessData.add(
+                                            virtualRegisterForArgument(i) + inlineCallFrame->stackOffset,
+                                            FlushedJSValue);
+                                        
+                                        Node* value = insertionSet.insertNode(
+                                            nodeIndex, SpecNone, GetStack, node->origin, OpInfo(data));
+                                        
+                                        arguments.append(value);
+                                    }
+                                } else
+                                    arguments.append(child);
+                            }
+
+                            convertToStaticArgumentCountCall(arguments);
+                        } else
+                            convertToForwardsCall();
+                    } else {
+                        unsigned numberOfArgumentsToSkip = 0;
+                        if (candidate->op() == PhantomCreateRest)
+                            numberOfArgumentsToSkip = candidate->numberOfArgumentsToSkip();
+                        CallVarargsData* varargsData = node->callVarargsData();
+                        varargsData->firstVarArgOffset += numberOfArgumentsToSkip;
+
+                        InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame;
+                        if (inlineCallFrame && !inlineCallFrame->isVarargs()) {
+                            Vector<Node*> arguments;
+                            for (unsigned i = 1 + varargsData->firstVarArgOffset; i < inlineCallFrame->arguments.size(); ++i) {
+                                StackAccessData* data = m_graph.m_stackAccessData.add(
+                                    virtualRegisterForArgument(i) + inlineCallFrame->stackOffset,
+                                    FlushedJSValue);
+                                
+                                Node* value = insertionSet.insertNode(
+                                    nodeIndex, SpecNone, GetStack, node->origin, OpInfo(data));
+                                
+                                arguments.append(value);
+                            }
+                            
+                            convertToStaticArgumentCountCall(arguments);
+                        } else
+                            convertToForwardsCall();
+                    }
+
+                    break;
+                }
+                    
+                case CheckArray:
+                case GetButterfly: {
+                    if (!isEliminatedAllocation(node->child1().node()))
+                        break;
+                    node->remove();
+                    break;
+                }
+
+                case CheckStructure:
+                    if (!isEliminatedAllocation(node->child1().node()))
+                        break;
+                    node->child1() = Edge(); // Remove the cell check since we've proven it's not needed and FTL lowering might botch this.
+                    node->remove();
+                    break;
+                    
+                default:
+                    break;
+                }
+            }
+            
+            insertionSet.execute(block);
+        }
+    }
+    
+    HashSet<Node*> m_candidates;
+};
+
+} // anonymous namespace
+
+bool performArgumentsElimination(Graph& graph)
+{
+    return runPhase<ArgumentsEliminationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGArgumentsEliminationPhase.h b/dfg/DFGArgumentsEliminationPhase.h
new file mode 100644
index 0000000..5458f1d
--- /dev/null
+++ b/dfg/DFGArgumentsEliminationPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Eliminates allocations of the Arguments-class objects when it can prove that the object doesn't escape
+// and none of the arguments are mutated (either via the object or via the stack).
+
+bool performArgumentsElimination(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGArgumentsUtilities.cpp b/dfg/DFGArgumentsUtilities.cpp
new file mode 100644
index 0000000..061a284
--- /dev/null
+++ b/dfg/DFGArgumentsUtilities.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGArgumentsUtilities.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+bool argumentsInvolveStackSlot(InlineCallFrame* inlineCallFrame, VirtualRegister reg)
+{
+    if (!inlineCallFrame)
+        return (reg.isArgument() && reg.toArgument()) || reg.isHeader();
+    
+    if (inlineCallFrame->isClosureCall
+        && reg == VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::callee))
+        return true;
+    
+    if (inlineCallFrame->isVarargs()
+        && reg == VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount))
+        return true;
+    
+    unsigned numArguments = inlineCallFrame->arguments.size() - 1;
+    VirtualRegister argumentStart =
+        VirtualRegister(inlineCallFrame->stackOffset) + CallFrame::argumentOffset(0);
+    return reg >= argumentStart && reg < argumentStart + numArguments;
+}
+
+bool argumentsInvolveStackSlot(Node* candidate, VirtualRegister reg)
+{
+    return argumentsInvolveStackSlot(candidate->origin.semantic.inlineCallFrame, reg);
+}
+
+Node* emitCodeToGetArgumentsArrayLength(
+    InsertionSet& insertionSet, Node* arguments, unsigned nodeIndex, NodeOrigin origin)
+{
+    Graph& graph = insertionSet.graph();
+
+    DFG_ASSERT(
+        graph, arguments,
+        arguments->op() == CreateDirectArguments || arguments->op() == CreateScopedArguments
+        || arguments->op() == CreateClonedArguments || arguments->op() == CreateRest
+        || arguments->op() == PhantomDirectArguments || arguments->op() == PhantomClonedArguments || arguments->op() == PhantomCreateRest);
+    
+    InlineCallFrame* inlineCallFrame = arguments->origin.semantic.inlineCallFrame;
+
+    unsigned numberOfArgumentsToSkip = 0;
+    if (arguments->op() == CreateRest || arguments->op() == PhantomCreateRest)
+        numberOfArgumentsToSkip = arguments->numberOfArgumentsToSkip();
+    
+    if (inlineCallFrame && !inlineCallFrame->isVarargs()) {
+        unsigned argumentsSize = inlineCallFrame->arguments.size() - 1;
+        if (argumentsSize >= numberOfArgumentsToSkip)
+            argumentsSize -= numberOfArgumentsToSkip;
+        else
+            argumentsSize = 0;
+        return insertionSet.insertConstant(
+            nodeIndex, origin, jsNumber(argumentsSize));
+    }
+    
+    Node* argumentCount;
+    if (!inlineCallFrame)
+        argumentCount = insertionSet.insertNode(nodeIndex, SpecInt32Only, GetArgumentCountIncludingThis, origin);
+    else {
+        VirtualRegister argumentCountRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount);
+        
+        argumentCount = insertionSet.insertNode(
+            nodeIndex, SpecInt32Only, GetStack, origin,
+            OpInfo(graph.m_stackAccessData.add(argumentCountRegister, FlushedInt32)));
+    }
+
+    Node* result = insertionSet.insertNode(
+        nodeIndex, SpecInt32Only, ArithSub, origin, OpInfo(Arith::Unchecked),
+        Edge(argumentCount, Int32Use),
+        insertionSet.insertConstantForUse(
+            nodeIndex, origin, jsNumber(1 + numberOfArgumentsToSkip), Int32Use));
+
+    if (numberOfArgumentsToSkip) {
+        // The above subtraction may produce a negative number if this number is non-zero. We correct that here.
+        result = insertionSet.insertNode(
+            nodeIndex, SpecInt32Only, ArithMax, origin, 
+            Edge(result, Int32Use), 
+            insertionSet.insertConstantForUse(nodeIndex, origin, jsNumber(0), Int32Use));
+        result->setResult(NodeResultInt32);
+    }
+
+    return result;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGArgumentsUtilities.h b/dfg/DFGArgumentsUtilities.h
new file mode 100644
index 0000000..14bd8b0
--- /dev/null
+++ b/dfg/DFGArgumentsUtilities.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+
+namespace JSC { namespace DFG {
+
+bool argumentsInvolveStackSlot(InlineCallFrame*, VirtualRegister);
+bool argumentsInvolveStackSlot(Node* candidate, VirtualRegister);
+
+Node* emitCodeToGetArgumentsArrayLength(
+    InsertionSet&, Node* arguments, unsigned nodeIndex, NodeOrigin);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGArithMode.cpp b/dfg/DFGArithMode.cpp
new file mode 100644
index 0000000..84ddae1
--- /dev/null
+++ b/dfg/DFGArithMode.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGArithMode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::DFG::Arith::Mode mode)
+{
+    switch (mode) {
+    case JSC::DFG::Arith::NotSet:
+        out.print("NotSet");
+        return;
+    case JSC::DFG::Arith::Unchecked:
+        out.print("Unchecked");
+        return;
+    case JSC::DFG::Arith::CheckOverflow:
+        out.print("CheckOverflow");
+        return;
+    case JSC::DFG::Arith::CheckOverflowAndNegativeZero:
+        out.print("CheckOverflowAndNegativeZero");
+        return;
+    case JSC::DFG::Arith::DoOverflow:
+        out.print("DoOverflow");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, JSC::DFG::Arith::RoundingMode mode)
+{
+    switch (mode) {
+    case JSC::DFG::Arith::RoundingMode::Int32:
+        out.print("Int32");
+        return;
+    case JSC::DFG::Arith::RoundingMode::Int32WithNegativeZeroCheck:
+        out.print("Int32WithNegativeZeroCheck");
+        return;
+    case JSC::DFG::Arith::RoundingMode::Double:
+        out.print("Double");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGArithMode.h b/dfg/DFGArithMode.h
new file mode 100644
index 0000000..24a7952
--- /dev/null
+++ b/dfg/DFGArithMode.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+// Arith::Mode describes the mode of an arithmetic operation that speculates integer.
+// Note that not all modes are valid for all operations.
+namespace Arith {
+enum Mode {
+    NotSet, // Arithmetic mode is either not relevant because we're using doubles anyway or we are at a phase in compilation where we don't know what we're doing, yet. Should never see this after FixupPhase except for nodes that take doubles as inputs already.
+    Unchecked, // Don't check anything and just do the direct hardware operation.
+    CheckOverflow, // Check for overflow but don't bother with negative zero.
+    CheckOverflowAndNegativeZero, // Check for both overflow and negative zero.
+    DoOverflow // Up-convert to the smallest type that soundly represents all possible results after input type speculation.
+};
+
+// Define the type of operation the rounding operation will perform.
+enum class RoundingMode {
+    Int32, // The round operation produces a integer and -0 is considered as 0.
+    Int32WithNegativeZeroCheck, // The round operation produces a integer and checks for -0.
+    Double // The round operation produce a double. The result can be -0, NaN or (+/-)Infinity.
+};
+
+} // namespace Arith
+
+inline bool doesOverflow(Arith::Mode mode)
+{
+    switch (mode) {
+    case Arith::NotSet:
+        ASSERT_NOT_REACHED();
+#if ASSERT_DISABLED
+        FALLTHROUGH;
+#endif
+    case Arith::Unchecked:
+    case Arith::CheckOverflow:
+    case Arith::CheckOverflowAndNegativeZero:
+        return false;
+    case Arith::DoOverflow:
+        return true;
+    }
+    ASSERT_NOT_REACHED();
+    return true;
+}
+
+// It's only valid to call this once you've determined that you don't need to *do*
+// overflow. For most nodes, that's implicit.
+inline bool shouldCheckOverflow(Arith::Mode mode)
+{
+    switch (mode) {
+    case Arith::NotSet:
+    case Arith::DoOverflow:
+        ASSERT_NOT_REACHED();
+        return true;
+    case Arith::Unchecked:
+        return false;
+    case Arith::CheckOverflow:
+    case Arith::CheckOverflowAndNegativeZero:
+        return true;
+    }
+    ASSERT_NOT_REACHED();
+    return true;
+}
+
+inline bool shouldCheckNegativeZero(Arith::Mode mode)
+{
+    switch (mode) {
+    case Arith::NotSet:
+    case Arith::DoOverflow:
+        ASSERT_NOT_REACHED();
+        return true;
+    case Arith::Unchecked:
+    case Arith::CheckOverflow:
+        return false;
+    case Arith::CheckOverflowAndNegativeZero:
+        return true;
+    }
+    ASSERT_NOT_REACHED();
+    return true;
+}
+
+inline bool subsumes(Arith::Mode earlier, Arith::Mode later)
+{
+    switch (earlier) {
+    case Arith::CheckOverflow:
+        switch (later) {
+        case Arith::Unchecked:
+        case Arith::CheckOverflow:
+            return true;
+        default:
+            return false;
+        }
+    case Arith::CheckOverflowAndNegativeZero:
+        switch (later) {
+        case Arith::Unchecked:
+        case Arith::CheckOverflow:
+        case Arith::CheckOverflowAndNegativeZero:
+            return true;
+        default:
+            return false;
+        }
+    default:
+        return earlier == later;
+    }
+}
+
+inline bool producesInteger(Arith::RoundingMode mode)
+{
+    return mode == Arith::RoundingMode::Int32WithNegativeZeroCheck || mode == Arith::RoundingMode::Int32;
+}
+
+inline bool shouldCheckNegativeZero(Arith::RoundingMode mode)
+{
+    return mode == Arith::RoundingMode::Int32WithNegativeZeroCheck;
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::DFG::Arith::Mode);
+void printInternal(PrintStream&, JSC::DFG::Arith::RoundingMode);
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGArrayMode.cpp b/dfg/DFGArrayMode.cpp
new file mode 100644
index 0000000..a26530e
--- /dev/null
+++ b/dfg/DFGArrayMode.cpp
@@ -0,0 +1,766 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGArrayMode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayPrototype.h"
+#include "DFGAbstractValue.h"
+#include "DFGGraph.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+ArrayMode ArrayMode::fromObserved(const ConcurrentJSLocker& locker, ArrayProfile* profile, Array::Action action, bool makeSafe)
+{
+    Array::Class nonArray;
+    if (profile->usesOriginalArrayStructures(locker))
+        nonArray = Array::OriginalNonArray;
+    else
+        nonArray = Array::NonArray;
+    
+    ArrayModes observed = profile->observedArrayModes(locker);
+    switch (observed) {
+    case 0:
+        return ArrayMode(Array::Unprofiled);
+    case asArrayModes(NonArray):
+        if (action == Array::Write && !profile->mayInterceptIndexedAccesses(locker))
+            return ArrayMode(Array::SelectUsingArguments, nonArray, Array::OutOfBounds, Array::Convert);
+        return ArrayMode(Array::SelectUsingPredictions, nonArray).withSpeculationFromProfile(locker, profile, makeSafe);
+
+    case asArrayModes(ArrayWithUndecided):
+        if (action == Array::Write)
+            return ArrayMode(Array::SelectUsingArguments, Array::Array, Array::OutOfBounds, Array::Convert);
+        return ArrayMode(Array::Undecided, Array::Array, Array::OutOfBounds, Array::AsIs).withProfile(locker, profile, makeSafe);
+        
+    case asArrayModes(NonArray) | asArrayModes(ArrayWithUndecided):
+        if (action == Array::Write && !profile->mayInterceptIndexedAccesses(locker))
+            return ArrayMode(Array::SelectUsingArguments, Array::PossiblyArray, Array::OutOfBounds, Array::Convert);
+        return ArrayMode(Array::SelectUsingPredictions).withSpeculationFromProfile(locker, profile, makeSafe);
+
+    case asArrayModes(NonArrayWithInt32):
+        return ArrayMode(Array::Int32, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(ArrayWithInt32):
+        return ArrayMode(Array::Int32, Array::Array, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(NonArrayWithInt32) | asArrayModes(ArrayWithInt32):
+        return ArrayMode(Array::Int32, Array::PossiblyArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+
+    case asArrayModes(NonArrayWithDouble):
+        return ArrayMode(Array::Double, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(ArrayWithDouble):
+        return ArrayMode(Array::Double, Array::Array, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(NonArrayWithDouble) | asArrayModes(ArrayWithDouble):
+        return ArrayMode(Array::Double, Array::PossiblyArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+
+    case asArrayModes(NonArrayWithContiguous):
+        return ArrayMode(Array::Contiguous, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(ArrayWithContiguous):
+        return ArrayMode(Array::Contiguous, Array::Array, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(NonArrayWithContiguous) | asArrayModes(ArrayWithContiguous):
+        return ArrayMode(Array::Contiguous, Array::PossiblyArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+
+    case asArrayModes(NonArrayWithArrayStorage):
+        return ArrayMode(Array::ArrayStorage, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(NonArrayWithSlowPutArrayStorage):
+    case asArrayModes(NonArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage):
+        return ArrayMode(Array::SlowPutArrayStorage, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(ArrayWithArrayStorage):
+        return ArrayMode(Array::ArrayStorage, Array::Array, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(ArrayWithSlowPutArrayStorage):
+    case asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage):
+        return ArrayMode(Array::SlowPutArrayStorage, Array::Array, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage):
+        return ArrayMode(Array::ArrayStorage, Array::PossiblyArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case asArrayModes(NonArrayWithSlowPutArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage):
+    case asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage):
+        return ArrayMode(Array::SlowPutArrayStorage, Array::PossiblyArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Int8ArrayMode:
+        return ArrayMode(Array::Int8Array, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Int16ArrayMode:
+        return ArrayMode(Array::Int16Array, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Int32ArrayMode:
+        return ArrayMode(Array::Int32Array, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Uint8ArrayMode:
+        return ArrayMode(Array::Uint8Array, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Uint8ClampedArrayMode:
+        return ArrayMode(Array::Uint8ClampedArray, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Uint16ArrayMode:
+        return ArrayMode(Array::Uint16Array, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Uint32ArrayMode:
+        return ArrayMode(Array::Uint32Array, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Float32ArrayMode:
+        return ArrayMode(Array::Float32Array, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+    case Float64ArrayMode:
+        return ArrayMode(Array::Float64Array, nonArray, Array::AsIs).withProfile(locker, profile, makeSafe);
+
+    default:
+        if ((observed & asArrayModes(NonArray)) && profile->mayInterceptIndexedAccesses(locker))
+            return ArrayMode(Array::SelectUsingPredictions).withSpeculationFromProfile(locker, profile, makeSafe);
+        
+        Array::Type type;
+        Array::Class arrayClass;
+        
+        if (shouldUseSlowPutArrayStorage(observed))
+            type = Array::SlowPutArrayStorage;
+        else if (shouldUseFastArrayStorage(observed))
+            type = Array::ArrayStorage;
+        else if (shouldUseContiguous(observed))
+            type = Array::Contiguous;
+        else if (shouldUseDouble(observed))
+            type = Array::Double;
+        else if (shouldUseInt32(observed))
+            type = Array::Int32;
+        else
+            type = Array::SelectUsingArguments;
+        
+        if (hasSeenArray(observed) && hasSeenNonArray(observed))
+            arrayClass = Array::PossiblyArray;
+        else if (hasSeenArray(observed))
+            arrayClass = Array::Array;
+        else if (hasSeenNonArray(observed))
+            arrayClass = nonArray;
+        else
+            arrayClass = Array::PossiblyArray;
+        
+        return ArrayMode(type, arrayClass, Array::Convert).withProfile(locker, profile, makeSafe);
+    }
+}
+
+static bool canBecomeGetArrayLength(Graph& graph, Node* node)
+{
+    if (node->op() != GetById)
+        return false;
+    auto uid = graph.identifiers()[node->identifierNumber()];
+    return uid == graph.m_vm.propertyNames->length.impl();
+}
+
+ArrayMode ArrayMode::refine(
+    Graph& graph, Node* node,
+    SpeculatedType base, SpeculatedType index, SpeculatedType value) const
+{
+    if (!base || !index) {
+        // It can be that we had a legitimate arrayMode but no incoming predictions. That'll
+        // happen if we inlined code based on, say, a global variable watchpoint, but later
+        // realized that the callsite could not have possibly executed. It may be worthwhile
+        // to fix that, but for now I'm leaving it as-is.
+        return ArrayMode(Array::ForceExit);
+    }
+    
+    if (!isInt32Speculation(index))
+        return ArrayMode(Array::Generic);
+    
+    // If we had exited because of an exotic object behavior, then don't try to specialize.
+    if (graph.hasExitSite(node->origin.semantic, ExoticObjectMode))
+        return ArrayMode(Array::Generic);
+    
+    // Note: our profiling currently doesn't give us good information in case we have
+    // an unlikely control flow path that sets the base to a non-cell value. Value
+    // profiling and prediction propagation will probably tell us that the value is
+    // either a cell or not, but that doesn't tell us which is more likely: that this
+    // is an array access on a cell (what we want and can optimize) or that the user is
+    // doing a crazy by-val access on a primitive (we can't easily optimize this and
+    // don't want to). So, for now, we assume that if the base is not a cell according
+    // to value profiling, but the array profile tells us something else, then we
+    // should just trust the array profile.
+    
+    switch (type()) {
+    case Array::SelectUsingArguments:
+        if (!value)
+            return withType(Array::ForceExit);
+        if (isInt32Speculation(value))
+            return withTypeAndConversion(Array::Int32, Array::Convert);
+        if (isFullNumberSpeculation(value))
+            return withTypeAndConversion(Array::Double, Array::Convert);
+        return withTypeAndConversion(Array::Contiguous, Array::Convert);
+    case Array::Undecided: {
+        // If we have an OriginalArray and the JSArray prototype chain is sane,
+        // any indexed access always return undefined. We have a fast path for that.
+        JSGlobalObject* globalObject = graph.globalObjectFor(node->origin.semantic);
+        if ((node->op() == GetByVal || canBecomeGetArrayLength(graph, node))
+            && arrayClass() == Array::OriginalArray
+            && globalObject->arrayPrototypeChainIsSane()
+            && !graph.hasExitSite(node->origin.semantic, OutOfBounds)) {
+            graph.watchpoints().addLazily(globalObject->arrayPrototype()->structure()->transitionWatchpointSet());
+            graph.watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
+            if (globalObject->arrayPrototypeChainIsSane())
+                return withSpeculation(Array::SaneChain);
+        }
+        return ArrayMode(Array::Generic);
+    }
+    case Array::Int32:
+        if (!value || isInt32Speculation(value))
+            return *this;
+        if (isFullNumberSpeculation(value))
+            return withTypeAndConversion(Array::Double, Array::Convert);
+        return withTypeAndConversion(Array::Contiguous, Array::Convert);
+        
+    case Array::Double:
+        if (!value || isFullNumberSpeculation(value))
+            return *this;
+        return withTypeAndConversion(Array::Contiguous, Array::Convert);
+        
+    case Array::Contiguous:
+        return *this;
+
+    case Array::Int8Array:
+    case Array::Int16Array:
+    case Array::Int32Array:
+    case Array::Uint8Array:
+    case Array::Uint8ClampedArray:
+    case Array::Uint16Array:
+    case Array::Uint32Array:
+    case Array::Float32Array:
+    case Array::Float64Array:
+        switch (node->op()) {
+        case PutByVal:
+            if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds())
+                return withSpeculation(Array::OutOfBounds);
+            return withSpeculation(Array::InBounds);
+        default:
+            return withSpeculation(Array::InBounds);
+        }
+        return *this;
+    case Array::Unprofiled:
+    case Array::SelectUsingPredictions: {
+        base &= ~SpecOther;
+        
+        if (isStringSpeculation(base))
+            return withType(Array::String);
+        
+        if (isDirectArgumentsSpeculation(base) || isScopedArgumentsSpeculation(base)) {
+            // Handle out-of-bounds accesses as generic accesses.
+            if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds())
+                return ArrayMode(Array::Generic);
+            
+            if (isDirectArgumentsSpeculation(base))
+                return withType(Array::DirectArguments);
+            return withType(Array::ScopedArguments);
+        }
+        
+        ArrayMode result;
+        switch (node->op()) {
+        case PutByVal:
+            if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds())
+                result = withSpeculation(Array::OutOfBounds);
+            else
+                result = withSpeculation(Array::InBounds);
+            break;
+            
+        default:
+            result = withSpeculation(Array::InBounds);
+            break;
+        }
+        
+        if (isInt8ArraySpeculation(base))
+            return result.withType(Array::Int8Array);
+        
+        if (isInt16ArraySpeculation(base))
+            return result.withType(Array::Int16Array);
+        
+        if (isInt32ArraySpeculation(base))
+            return result.withType(Array::Int32Array);
+        
+        if (isUint8ArraySpeculation(base))
+            return result.withType(Array::Uint8Array);
+        
+        if (isUint8ClampedArraySpeculation(base))
+            return result.withType(Array::Uint8ClampedArray);
+        
+        if (isUint16ArraySpeculation(base))
+            return result.withType(Array::Uint16Array);
+        
+        if (isUint32ArraySpeculation(base))
+            return result.withType(Array::Uint32Array);
+        
+        if (isFloat32ArraySpeculation(base))
+            return result.withType(Array::Float32Array);
+        
+        if (isFloat64ArraySpeculation(base))
+            return result.withType(Array::Float64Array);
+
+        if (type() == Array::Unprofiled)
+            return ArrayMode(Array::ForceExit);
+        return ArrayMode(Array::Generic);
+    }
+
+    default:
+        return *this;
+    }
+}
+
+Structure* ArrayMode::originalArrayStructure(Graph& graph, const CodeOrigin& codeOrigin) const
+{
+    JSGlobalObject* globalObject = graph.globalObjectFor(codeOrigin);
+    
+    switch (arrayClass()) {
+    case Array::OriginalArray: {
+        switch (type()) {
+        case Array::Int32:
+            return globalObject->originalArrayStructureForIndexingType(ArrayWithInt32);
+        case Array::Double:
+            return globalObject->originalArrayStructureForIndexingType(ArrayWithDouble);
+        case Array::Contiguous:
+            return globalObject->originalArrayStructureForIndexingType(ArrayWithContiguous);
+        case Array::Undecided:
+            return globalObject->originalArrayStructureForIndexingType(ArrayWithUndecided);
+        case Array::ArrayStorage:
+            return globalObject->originalArrayStructureForIndexingType(ArrayWithArrayStorage);
+        default:
+            CRASH();
+            return nullptr;
+        }
+    }
+        
+    case Array::OriginalNonArray: {
+        TypedArrayType type = typedArrayType();
+        if (type == NotTypedArray)
+            return nullptr;
+        
+        return globalObject->typedArrayStructureConcurrently(type);
+    }
+        
+    default:
+        return nullptr;
+    }
+}
+
+Structure* ArrayMode::originalArrayStructure(Graph& graph, Node* node) const
+{
+    return originalArrayStructure(graph, node->origin.semantic);
+}
+
+bool ArrayMode::alreadyChecked(Graph& graph, Node* node, const AbstractValue& value, IndexingType shape) const
+{
+    switch (arrayClass()) {
+    case Array::OriginalArray: {
+        if (value.m_structure.isTop())
+            return false;
+        for (unsigned i = value.m_structure.size(); i--;) {
+            RegisteredStructure structure = value.m_structure[i];
+            if ((structure->indexingType() & IndexingShapeMask) != shape)
+                return false;
+            if (!(structure->indexingType() & IsArray))
+                return false;
+            if (!graph.globalObjectFor(node->origin.semantic)->isOriginalArrayStructure(structure.get()))
+                return false;
+        }
+        return true;
+    }
+        
+    case Array::Array: {
+        if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(shape | IsArray)))
+            return true;
+        if (value.m_structure.isTop())
+            return false;
+        for (unsigned i = value.m_structure.size(); i--;) {
+            RegisteredStructure structure = value.m_structure[i];
+            if ((structure->indexingType() & IndexingShapeMask) != shape)
+                return false;
+            if (!(structure->indexingType() & IsArray))
+                return false;
+        }
+        return true;
+    }
+        
+    default: {
+        if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(shape) | asArrayModes(shape | IsArray)))
+            return true;
+        if (value.m_structure.isTop())
+            return false;
+        for (unsigned i = value.m_structure.size(); i--;) {
+            RegisteredStructure structure = value.m_structure[i];
+            if ((structure->indexingType() & IndexingShapeMask) != shape)
+                return false;
+        }
+        return true;
+    } }
+}
+
+bool ArrayMode::alreadyChecked(Graph& graph, Node* node, const AbstractValue& value) const
+{
+    switch (type()) {
+    case Array::Generic:
+        return true;
+        
+    case Array::ForceExit:
+        return false;
+        
+    case Array::String:
+        return speculationChecked(value.m_type, SpecString);
+        
+    case Array::Int32:
+        return alreadyChecked(graph, node, value, Int32Shape);
+        
+    case Array::Double:
+        return alreadyChecked(graph, node, value, DoubleShape);
+        
+    case Array::Contiguous:
+        return alreadyChecked(graph, node, value, ContiguousShape);
+        
+    case Array::ArrayStorage:
+        return alreadyChecked(graph, node, value, ArrayStorageShape);
+
+    case Array::Undecided:
+        return alreadyChecked(graph, node, value, UndecidedShape);
+        
+    case Array::SlowPutArrayStorage:
+        switch (arrayClass()) {
+        case Array::OriginalArray: {
+            CRASH();
+            return false;
+        }
+        
+        case Array::Array: {
+            if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage)))
+                return true;
+            if (value.m_structure.isTop())
+                return false;
+            for (unsigned i = value.m_structure.size(); i--;) {
+                RegisteredStructure structure = value.m_structure[i];
+                if (!hasAnyArrayStorage(structure->indexingType()))
+                    return false;
+                if (!(structure->indexingType() & IsArray))
+                    return false;
+            }
+            return true;
+        }
+        
+        default: {
+            if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage)))
+                return true;
+            if (value.m_structure.isTop())
+                return false;
+            for (unsigned i = value.m_structure.size(); i--;) {
+                RegisteredStructure structure = value.m_structure[i];
+                if (!hasAnyArrayStorage(structure->indexingType()))
+                    return false;
+            }
+            return true;
+        } }
+        
+    case Array::DirectArguments:
+        return speculationChecked(value.m_type, SpecDirectArguments);
+        
+    case Array::ScopedArguments:
+        return speculationChecked(value.m_type, SpecScopedArguments);
+        
+    case Array::Int8Array:
+        return speculationChecked(value.m_type, SpecInt8Array);
+        
+    case Array::Int16Array:
+        return speculationChecked(value.m_type, SpecInt16Array);
+        
+    case Array::Int32Array:
+        return speculationChecked(value.m_type, SpecInt32Array);
+        
+    case Array::Uint8Array:
+        return speculationChecked(value.m_type, SpecUint8Array);
+        
+    case Array::Uint8ClampedArray:
+        return speculationChecked(value.m_type, SpecUint8ClampedArray);
+        
+    case Array::Uint16Array:
+        return speculationChecked(value.m_type, SpecUint16Array);
+        
+    case Array::Uint32Array:
+        return speculationChecked(value.m_type, SpecUint32Array);
+
+    case Array::Float32Array:
+        return speculationChecked(value.m_type, SpecFloat32Array);
+
+    case Array::Float64Array:
+        return speculationChecked(value.m_type, SpecFloat64Array);
+
+    case Array::AnyTypedArray:
+        return speculationChecked(value.m_type, SpecTypedArrayView);
+
+    case Array::SelectUsingPredictions:
+    case Array::Unprofiled:
+    case Array::SelectUsingArguments:
+        break;
+    }
+    
+    CRASH();
+    return false;
+}
+
+const char* arrayTypeToString(Array::Type type)
+{
+    switch (type) {
+    case Array::SelectUsingPredictions:
+        return "SelectUsingPredictions";
+    case Array::SelectUsingArguments:
+        return "SelectUsingArguments";
+    case Array::Unprofiled:
+        return "Unprofiled";
+    case Array::Generic:
+        return "Generic";
+    case Array::ForceExit:
+        return "ForceExit";
+    case Array::String:
+        return "String";
+    case Array::Undecided:
+        return "Undecided";
+    case Array::Int32:
+        return "Int32";
+    case Array::Double:
+        return "Double";
+    case Array::Contiguous:
+        return "Contiguous";
+    case Array::ArrayStorage:
+        return "ArrayStorage";
+    case Array::SlowPutArrayStorage:
+        return "SlowPutArrayStorage";
+    case Array::DirectArguments:
+        return "DirectArguments";
+    case Array::ScopedArguments:
+        return "ScopedArguments";
+    case Array::Int8Array:
+        return "Int8Array";
+    case Array::Int16Array:
+        return "Int16Array";
+    case Array::Int32Array:
+        return "Int32Array";
+    case Array::Uint8Array:
+        return "Uint8Array";
+    case Array::Uint8ClampedArray:
+        return "Uint8ClampedArray";
+    case Array::Uint16Array:
+        return "Uint16Array";
+    case Array::Uint32Array:
+        return "Uint32Array";
+    case Array::Float32Array:
+        return "Float32Array";
+    case Array::Float64Array:
+        return "Float64Array";
+    case Array::AnyTypedArray:
+        return "AnyTypedArray";
+    default:
+        // Better to return something then it is to crash. Remember, this method
+        // is being called from our main diagnostic tool, the IR dumper. It's like
+        // a stack trace. So if we get here then probably something has already
+        // gone wrong.
+        return "Unknown!";
+    }
+}
+
+const char* arrayClassToString(Array::Class arrayClass)
+{
+    switch (arrayClass) {
+    case Array::Array:
+        return "Array";
+    case Array::OriginalArray:
+        return "OriginalArray";
+    case Array::NonArray:
+        return "NonArray";
+    case Array::OriginalNonArray:
+        return "OriginalNonArray";
+    case Array::PossiblyArray:
+        return "PossiblyArray";
+    default:
+        return "Unknown!";
+    }
+}
+
+const char* arraySpeculationToString(Array::Speculation speculation)
+{
+    switch (speculation) {
+    case Array::SaneChain:
+        return "SaneChain";
+    case Array::InBounds:
+        return "InBounds";
+    case Array::ToHole:
+        return "ToHole";
+    case Array::OutOfBounds:
+        return "OutOfBounds";
+    default:
+        return "Unknown!";
+    }
+}
+
+const char* arrayConversionToString(Array::Conversion conversion)
+{
+    switch (conversion) {
+    case Array::AsIs:
+        return "AsIs";
+    case Array::Convert:
+        return "Convert";
+    default:
+        return "Unknown!";
+    }
+}
+
+IndexingType toIndexingShape(Array::Type type)
+{
+    switch (type) {
+    case Array::Int32:
+        return Int32Shape;
+    case Array::Double:
+        return DoubleShape;
+    case Array::Contiguous:
+        return ContiguousShape;
+    case Array::ArrayStorage:
+        return ArrayStorageShape;
+    case Array::SlowPutArrayStorage:
+        return SlowPutArrayStorageShape;
+    default:
+        return NoIndexingShape;
+    }
+}
+
+TypedArrayType toTypedArrayType(Array::Type type)
+{
+    switch (type) {
+    case Array::Int8Array:
+        return TypeInt8;
+    case Array::Int16Array:
+        return TypeInt16;
+    case Array::Int32Array:
+        return TypeInt32;
+    case Array::Uint8Array:
+        return TypeUint8;
+    case Array::Uint8ClampedArray:
+        return TypeUint8Clamped;
+    case Array::Uint16Array:
+        return TypeUint16;
+    case Array::Uint32Array:
+        return TypeUint32;
+    case Array::Float32Array:
+        return TypeFloat32;
+    case Array::Float64Array:
+        return TypeFloat64;
+    case Array::AnyTypedArray:
+        RELEASE_ASSERT_NOT_REACHED();
+        return NotTypedArray;
+    default:
+        return NotTypedArray;
+    }
+}
+
+Array::Type toArrayType(TypedArrayType type)
+{
+    switch (type) {
+    case TypeInt8:
+        return Array::Int8Array;
+    case TypeInt16:
+        return Array::Int16Array;
+    case TypeInt32:
+        return Array::Int32Array;
+    case TypeUint8:
+        return Array::Uint8Array;
+    case TypeUint8Clamped:
+        return Array::Uint8ClampedArray;
+    case TypeUint16:
+        return Array::Uint16Array;
+    case TypeUint32:
+        return Array::Uint32Array;
+    case TypeFloat32:
+        return Array::Float32Array;
+    case TypeFloat64:
+        return Array::Float64Array;
+    default:
+        return Array::Generic;
+    }
+}
+
+Array::Type refineTypedArrayType(Array::Type oldType, TypedArrayType newType)
+{
+    if (oldType == Array::Generic)
+        return oldType;
+    Array::Type newArrayType = toArrayType(newType);
+    if (newArrayType == Array::Generic)
+        return newArrayType;
+
+    if (oldType != newArrayType)
+        return Array::AnyTypedArray;
+    return oldType;
+}
+
+bool permitsBoundsCheckLowering(Array::Type type)
+{
+    switch (type) {
+    case Array::Int32:
+    case Array::Double:
+    case Array::Contiguous:
+    case Array::Int8Array:
+    case Array::Int16Array:
+    case Array::Int32Array:
+    case Array::Uint8Array:
+    case Array::Uint8ClampedArray:
+    case Array::Uint16Array:
+    case Array::Uint32Array:
+    case Array::Float32Array:
+    case Array::Float64Array:
+    case Array::AnyTypedArray:
+        return true;
+    default:
+        // These don't allow for bounds check lowering either because the bounds
+        // check involves something other than GetArrayLength (like ArrayStorage),
+        // or because the bounds check isn't a speculation (like String, sort of),
+        // or because the type implies an impure access.
+        return false;
+    }
+}
+
+bool ArrayMode::permitsBoundsCheckLowering() const
+{
+    return DFG::permitsBoundsCheckLowering(type()) && isInBounds();
+}
+
+void ArrayMode::dump(PrintStream& out) const
+{
+    out.print(type(), "+", arrayClass(), "+", speculation(), "+", conversion());
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::DFG::Array::Type type)
+{
+    out.print(JSC::DFG::arrayTypeToString(type));
+}
+
+void printInternal(PrintStream& out, JSC::DFG::Array::Class arrayClass)
+{
+    out.print(JSC::DFG::arrayClassToString(arrayClass));
+}
+
+void printInternal(PrintStream& out, JSC::DFG::Array::Speculation speculation)
+{
+    out.print(JSC::DFG::arraySpeculationToString(speculation));
+}
+
+void printInternal(PrintStream& out, JSC::DFG::Array::Conversion conversion)
+{
+    out.print(JSC::DFG::arrayConversionToString(conversion));
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGArrayMode.h b/dfg/DFGArrayMode.h
new file mode 100644
index 0000000..45e1d5a
--- /dev/null
+++ b/dfg/DFGArrayMode.h
@@ -0,0 +1,534 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayProfile.h"
+#include "DFGNodeFlags.h"
+#include "SpeculatedType.h"
+
+namespace JSC {
+
+struct CodeOrigin;
+
+namespace DFG {
+
+class Graph;
+struct AbstractValue;
+struct Node;
+
+// Use a namespace + enum instead of enum alone to avoid the namespace collision
+// that would otherwise occur, since we say things like "Int8Array" and "JSArray"
+// in lots of other places, to mean subtly different things.
+namespace Array {
+enum Action {
+    Read,
+    Write
+};
+
+enum Type {
+    SelectUsingPredictions, // Implies that we need predictions to decide. We will never get to the backend in this mode.
+    SelectUsingArguments, // Implies that we use the Node's arguments to decide. We will never get to the backend in this mode.
+    Unprofiled, // Implies that array profiling didn't see anything. But that could be because the operands didn't comply with basic type assumptions (base is cell, property is int). This either becomes Generic or ForceExit depending on value profiling.
+    ForceExit, // Implies that we have no idea how to execute this operation, so we should just give up.
+    Generic,
+    String,
+
+    Undecided,
+    Int32,
+    Double,
+    Contiguous,
+    ArrayStorage,
+    SlowPutArrayStorage,
+    
+    DirectArguments,
+    ScopedArguments,
+    
+    Int8Array,
+    Int16Array,
+    Int32Array,
+    Uint8Array,
+    Uint8ClampedArray,
+    Uint16Array,
+    Uint32Array,
+    Float32Array,
+    Float64Array,
+    AnyTypedArray
+};
+
+enum Class {
+    NonArray, // Definitely some object that is not a JSArray.
+    OriginalNonArray, // Definitely some object that is not a JSArray, but that object has the original structure.
+    Array, // Definitely a JSArray, and may or may not have custom properties or have undergone some other bizarre transitions.
+    OriginalArray, // Definitely a JSArray, and still has one of the primordial JSArray structures for the global object that this code block (possibly inlined code block) belongs to.
+    PossiblyArray // Some object that may or may not be a JSArray.
+};
+
+enum Speculation {
+    SaneChain, // In bounds and the array prototype chain is still intact, i.e. loading a hole doesn't require special treatment.
+    
+    InBounds, // In bounds and not loading a hole.
+    ToHole, // Potentially storing to a hole.
+    OutOfBounds // Out-of-bounds access and anything can happen.
+};
+enum Conversion {
+    AsIs,
+    Convert
+};
+} // namespace Array
+
+const char* arrayTypeToString(Array::Type);
+const char* arrayClassToString(Array::Class);
+const char* arraySpeculationToString(Array::Speculation);
+const char* arrayConversionToString(Array::Conversion);
+
+IndexingType toIndexingShape(Array::Type);
+
+TypedArrayType toTypedArrayType(Array::Type);
+Array::Type toArrayType(TypedArrayType);
+Array::Type refineTypedArrayType(Array::Type, TypedArrayType);
+
+bool permitsBoundsCheckLowering(Array::Type);
+
+class ArrayMode {
+public:
+    ArrayMode()
+    {
+        u.asBytes.type = Array::SelectUsingPredictions;
+        u.asBytes.arrayClass = Array::NonArray;
+        u.asBytes.speculation = Array::InBounds;
+        u.asBytes.conversion = Array::AsIs;
+    }
+    
+    explicit ArrayMode(Array::Type type)
+    {
+        u.asBytes.type = type;
+        u.asBytes.arrayClass = Array::NonArray;
+        u.asBytes.speculation = Array::InBounds;
+        u.asBytes.conversion = Array::AsIs;
+    }
+    
+    ArrayMode(Array::Type type, Array::Class arrayClass)
+    {
+        u.asBytes.type = type;
+        u.asBytes.arrayClass = arrayClass;
+        u.asBytes.speculation = Array::InBounds;
+        u.asBytes.conversion = Array::AsIs;
+    }
+    
+    ArrayMode(Array::Type type, Array::Class arrayClass, Array::Speculation speculation, Array::Conversion conversion)
+    {
+        u.asBytes.type = type;
+        u.asBytes.arrayClass = arrayClass;
+        u.asBytes.speculation = speculation;
+        u.asBytes.conversion = conversion;
+    }
+    
+    ArrayMode(Array::Type type, Array::Class arrayClass, Array::Conversion conversion)
+    {
+        u.asBytes.type = type;
+        u.asBytes.arrayClass = arrayClass;
+        u.asBytes.speculation = Array::InBounds;
+        u.asBytes.conversion = conversion;
+    }
+    
+    Array::Type type() const { return static_cast<Array::Type>(u.asBytes.type); }
+    Array::Class arrayClass() const { return static_cast<Array::Class>(u.asBytes.arrayClass); }
+    Array::Speculation speculation() const { return static_cast<Array::Speculation>(u.asBytes.speculation); }
+    Array::Conversion conversion() const { return static_cast<Array::Conversion>(u.asBytes.conversion); }
+    
+    unsigned asWord() const { return u.asWord; }
+    
+    static ArrayMode fromWord(unsigned word)
+    {
+        return ArrayMode(word);
+    }
+    
+    static ArrayMode fromObserved(const ConcurrentJSLocker&, ArrayProfile*, Array::Action, bool makeSafe);
+    
+    ArrayMode withSpeculation(Array::Speculation speculation) const
+    {
+        return ArrayMode(type(), arrayClass(), speculation, conversion());
+    }
+    
+    ArrayMode withArrayClass(Array::Class arrayClass) const
+    {
+        return ArrayMode(type(), arrayClass, speculation(), conversion());
+    }
+    
+    ArrayMode withSpeculationFromProfile(const ConcurrentJSLocker& locker, ArrayProfile* profile, bool makeSafe) const
+    {
+        Array::Speculation mySpeculation;
+
+        if (makeSafe)
+            mySpeculation = Array::OutOfBounds;
+        else if (profile->mayStoreToHole(locker))
+            mySpeculation = Array::ToHole;
+        else
+            mySpeculation = Array::InBounds;
+        
+        return withSpeculation(mySpeculation);
+    }
+    
+    ArrayMode withProfile(const ConcurrentJSLocker& locker, ArrayProfile* profile, bool makeSafe) const
+    {
+        Array::Class myArrayClass;
+
+        if (isJSArray()) {
+            if (profile->usesOriginalArrayStructures(locker) && benefitsFromOriginalArray())
+                myArrayClass = Array::OriginalArray;
+            else
+                myArrayClass = Array::Array;
+        } else
+            myArrayClass = arrayClass();
+        
+        return withArrayClass(myArrayClass).withSpeculationFromProfile(locker, profile, makeSafe);
+    }
+    
+    ArrayMode withType(Array::Type type) const
+    {
+        return ArrayMode(type, arrayClass(), speculation(), conversion());
+    }
+    
+    ArrayMode withConversion(Array::Conversion conversion) const
+    {
+        return ArrayMode(type(), arrayClass(), speculation(), conversion);
+    }
+    
+    ArrayMode withTypeAndConversion(Array::Type type, Array::Conversion conversion) const
+    {
+        return ArrayMode(type, arrayClass(), speculation(), conversion);
+    }
+    
+    ArrayMode refine(Graph&, Node*, SpeculatedType base, SpeculatedType index, SpeculatedType value = SpecNone) const;
+    
+    bool alreadyChecked(Graph&, Node*, const AbstractValue&) const;
+    
+    void dump(PrintStream&) const;
+    
+    bool usesButterfly() const
+    {
+        switch (type()) {
+        case Array::Undecided:
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool isJSArray() const
+    {
+        switch (arrayClass()) {
+        case Array::Array:
+        case Array::OriginalArray:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool isJSArrayWithOriginalStructure() const
+    {
+        return arrayClass() == Array::OriginalArray;
+    }
+    
+    bool isSaneChain() const
+    {
+        return speculation() == Array::SaneChain;
+    }
+    
+    bool isInBounds() const
+    {
+        switch (speculation()) {
+        case Array::SaneChain:
+        case Array::InBounds:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool mayStoreToHole() const
+    {
+        return !isInBounds();
+    }
+    
+    bool isOutOfBounds() const
+    {
+        return speculation() == Array::OutOfBounds;
+    }
+    
+    bool isSlowPut() const
+    {
+        return type() == Array::SlowPutArrayStorage;
+    }
+    
+    bool canCSEStorage() const
+    {
+        switch (type()) {
+        case Array::SelectUsingPredictions:
+        case Array::SelectUsingArguments:
+        case Array::Unprofiled:
+        case Array::Undecided:
+        case Array::ForceExit:
+        case Array::Generic:
+        case Array::DirectArguments:
+        case Array::ScopedArguments:
+            return false;
+        default:
+            return true;
+        }
+    }
+    
+    bool lengthNeedsStorage() const
+    {
+        switch (type()) {
+        case Array::Undecided:
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    ArrayMode modeForPut() const
+    {
+        switch (type()) {
+        case Array::String:
+        case Array::DirectArguments:
+        case Array::ScopedArguments:
+            return ArrayMode(Array::Generic);
+        default:
+            return *this;
+        }
+    }
+    
+    bool isSpecific() const
+    {
+        switch (type()) {
+        case Array::SelectUsingPredictions:
+        case Array::SelectUsingArguments:
+        case Array::Unprofiled:
+        case Array::ForceExit:
+        case Array::Generic:
+            return false;
+        default:
+            return true;
+        }
+    }
+    
+    bool supportsSelfLength() const
+    {
+        switch (type()) {
+        case Array::SelectUsingPredictions:
+        case Array::Unprofiled:
+        case Array::ForceExit:
+        case Array::Generic:
+        // TypedArrays do not have a self length property as of ES6.
+        case Array::Int8Array:
+        case Array::Int16Array:
+        case Array::Int32Array:
+        case Array::Uint8Array:
+        case Array::Uint8ClampedArray:
+        case Array::Uint16Array:
+        case Array::Uint32Array:
+        case Array::Float32Array:
+        case Array::Float64Array:
+            return false;
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            return isJSArray();
+        default:
+            return true;
+        }
+    }
+    
+    bool permitsBoundsCheckLowering() const;
+    
+    bool benefitsFromOriginalArray() const
+    {
+        switch (type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::Undecided:
+        case Array::ArrayStorage:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    // Returns 0 if this is not OriginalArray.
+    Structure* originalArrayStructure(Graph&, const CodeOrigin&) const;
+    Structure* originalArrayStructure(Graph&, Node*) const;
+    
+    bool doesConversion() const
+    {
+        return conversion() != Array::AsIs;
+    }
+
+    bool structureWouldPassArrayModeFiltering(Structure* structure)
+    {
+        return arrayModesAlreadyChecked(arrayModeFromStructure(structure), arrayModesThatPassFiltering());
+    }
+    
+    ArrayModes arrayModesThatPassFiltering() const
+    {
+        switch (type()) {
+        case Array::Generic:
+            return ALL_ARRAY_MODES;
+        case Array::Int32:
+            return arrayModesWithIndexingShape(Int32Shape);
+        case Array::Double:
+            return arrayModesWithIndexingShape(DoubleShape);
+        case Array::Contiguous:
+            return arrayModesWithIndexingShape(ContiguousShape);
+        case Array::ArrayStorage:
+            return arrayModesWithIndexingShape(ArrayStorageShape);
+        case Array::SlowPutArrayStorage:
+            return arrayModesWithIndexingShapes(SlowPutArrayStorageShape, ArrayStorageShape);
+        default:
+            return asArrayModes(NonArray);
+        }
+    }
+    
+    bool getIndexedPropertyStorageMayTriggerGC() const
+    {
+        return type() == Array::String;
+    }
+    
+    IndexingType shapeMask() const
+    {
+        return toIndexingShape(type());
+    }
+    
+    TypedArrayType typedArrayType() const
+    {
+        return toTypedArrayType(type());
+    }
+
+    bool isSomeTypedArrayView() const
+    {
+        return type() == Array::AnyTypedArray || isTypedView(typedArrayType());
+    }
+    
+    bool operator==(const ArrayMode& other) const
+    {
+        return type() == other.type()
+            && arrayClass() == other.arrayClass()
+            && speculation() == other.speculation()
+            && conversion() == other.conversion();
+    }
+    
+    bool operator!=(const ArrayMode& other) const
+    {
+        return !(*this == other);
+    }
+private:
+    explicit ArrayMode(unsigned word)
+    {
+        u.asWord = word;
+    }
+    
+    ArrayModes arrayModesWithIndexingShape(IndexingType shape) const
+    {
+        switch (arrayClass()) {
+        case Array::NonArray:
+        case Array::OriginalNonArray:
+            return asArrayModes(shape);
+        case Array::Array:
+        case Array::OriginalArray:
+            return asArrayModes(shape | IsArray);
+        case Array::PossiblyArray:
+            return asArrayModes(shape) | asArrayModes(shape | IsArray);
+        default:
+            // This is only necessary for C++ compilers that don't understand enums.
+            return 0;
+        }
+    }
+    
+    ArrayModes arrayModesWithIndexingShapes(IndexingType shape1, IndexingType shape2) const
+    {
+        ArrayModes arrayMode1 = arrayModesWithIndexingShape(shape1);
+        ArrayModes arrayMode2 = arrayModesWithIndexingShape(shape2);
+        return arrayMode1 | arrayMode2;
+    }
+
+    bool alreadyChecked(Graph&, Node*, const AbstractValue&, IndexingType shape) const;
+    
+    union {
+        struct {
+            uint8_t type;
+            uint8_t arrayClass;
+            uint8_t speculation;
+            uint8_t conversion;
+        } asBytes;
+        unsigned asWord;
+    } u;
+};
+
+static inline bool canCSEStorage(const ArrayMode& arrayMode)
+{
+    return arrayMode.canCSEStorage();
+}
+
+static inline bool lengthNeedsStorage(const ArrayMode& arrayMode)
+{
+    return arrayMode.lengthNeedsStorage();
+}
+
+static inline bool neverNeedsStorage(const ArrayMode&)
+{
+    return false;
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::DFG::Array::Type);
+void printInternal(PrintStream&, JSC::DFG::Array::Class);
+void printInternal(PrintStream&, JSC::DFG::Array::Speculation);
+void printInternal(PrintStream&, JSC::DFG::Array::Conversion);
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGArrayifySlowPathGenerator.h b/dfg/DFGArrayifySlowPathGenerator.h
new file mode 100644
index 0000000..ba4d5fe
--- /dev/null
+++ b/dfg/DFGArrayifySlowPathGenerator.h
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGArrayMode.h"
+#include "DFGCommon.h"
+#include "DFGOSRExitJumpPlaceholder.h"
+#include "DFGOperations.h"
+#include "DFGSlowPathGenerator.h"
+#include "DFGSpeculativeJIT.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class ArrayifySlowPathGenerator : public JumpingSlowPathGenerator<MacroAssembler::JumpList> {
+public:
+    ArrayifySlowPathGenerator(
+        const MacroAssembler::JumpList& from, SpeculativeJIT* jit, Node* node, GPRReg baseGPR,
+        GPRReg propertyGPR, GPRReg tempGPR, GPRReg structureGPR)
+        : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
+        , m_op(node->op())
+        , m_arrayMode(node->arrayMode())
+        , m_structure(node->op() == ArrayifyToStructure ? node->structure() : RegisteredStructure())
+        , m_baseGPR(baseGPR)
+        , m_propertyGPR(propertyGPR)
+        , m_tempGPR(tempGPR)
+        , m_structureGPR(structureGPR)
+    {
+        ASSERT(m_op == Arrayify || m_op == ArrayifyToStructure);
+        
+        jit->silentSpillAllRegistersImpl(false, m_plans, InvalidGPRReg);
+        
+        if (m_propertyGPR != InvalidGPRReg) {
+            switch (m_arrayMode.type()) {
+            case Array::Int32:
+            case Array::Double:
+            case Array::Contiguous:
+                m_badPropertyJump = jit->speculationCheck(Uncountable, JSValueRegs(), 0);
+                break;
+            default:
+                break;
+            }
+        }
+        m_badIndexingTypeJump = jit->speculationCheck(BadIndexingType, JSValueSource::unboxedCell(m_baseGPR), 0);
+    }
+    
+protected:
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        linkFrom(jit);
+        
+        ASSERT(m_op == Arrayify || m_op == ArrayifyToStructure);
+        
+        if (m_propertyGPR != InvalidGPRReg) {
+            switch (m_arrayMode.type()) {
+            case Array::Int32:
+            case Array::Double:
+            case Array::Contiguous:
+                m_badPropertyJump.fill(jit, jit->m_jit.branch32(
+                    MacroAssembler::AboveOrEqual, m_propertyGPR,
+                    MacroAssembler::TrustedImm32(MIN_SPARSE_ARRAY_INDEX)));
+                break;
+            default:
+                break;
+            }
+        }
+        
+        for (unsigned i = 0; i < m_plans.size(); ++i)
+            jit->silentSpill(m_plans[i]);
+        switch (m_arrayMode.type()) {
+        case Array::Int32:
+            jit->callOperation(operationEnsureInt32, m_tempGPR, m_baseGPR);
+            break;
+        case Array::Double:
+            jit->callOperation(operationEnsureDouble, m_tempGPR, m_baseGPR);
+            break;
+        case Array::Contiguous:
+            jit->callOperation(operationEnsureContiguous, m_tempGPR, m_baseGPR);
+            break;
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            jit->callOperation(operationEnsureArrayStorage, m_tempGPR, m_baseGPR);
+            break;
+        default:
+            CRASH();
+            break;
+        }
+        for (unsigned i = m_plans.size(); i--;)
+            jit->silentFill(m_plans[i], GPRInfo::regT0);
+        jit->m_jit.exceptionCheck();
+        
+        if (m_op == ArrayifyToStructure) {
+            ASSERT(m_structure.get());
+            m_badIndexingTypeJump.fill(
+                jit, jit->m_jit.branchWeakStructure(MacroAssembler::NotEqual, MacroAssembler::Address(m_baseGPR, JSCell::structureIDOffset()), m_structure));
+        } else {
+            // Finally, check that we have the kind of array storage that we wanted to get.
+            // Note that this is a backwards speculation check, which will result in the 
+            // bytecode operation corresponding to this arrayification being reexecuted.
+            // That's fine, since arrayification is not user-visible.
+            jit->m_jit.load8(
+                MacroAssembler::Address(m_baseGPR, JSCell::indexingTypeAndMiscOffset()),
+                m_structureGPR);
+            m_badIndexingTypeJump.fill(
+                jit, jit->jumpSlowForUnwantedArrayMode(m_structureGPR, m_arrayMode));
+        }
+        
+        jumpTo(jit);
+    }
+    
+private:
+    NodeType m_op;
+    ArrayMode m_arrayMode;
+    RegisteredStructure m_structure;
+    GPRReg m_baseGPR;
+    GPRReg m_propertyGPR;
+    GPRReg m_tempGPR;
+    GPRReg m_structureGPR;
+    OSRExitJumpPlaceholder m_badPropertyJump;
+    OSRExitJumpPlaceholder m_badIndexingTypeJump;
+    Vector<SilentRegisterSavePlan, 2> m_plans;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAtTailAbstractState.cpp b/dfg/DFGAtTailAbstractState.cpp
new file mode 100644
index 0000000..8d14c9c
--- /dev/null
+++ b/dfg/DFGAtTailAbstractState.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGAtTailAbstractState.h"
+#include "DFGBlockMapInlines.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+AtTailAbstractState::AtTailAbstractState(Graph& graph)
+    : m_graph(graph)
+    , m_valuesAtTailMap(m_graph)
+{
+    for (BasicBlock* block : graph.blocksInNaturalOrder()) {
+        auto& valuesAtTail = m_valuesAtTailMap.at(block);
+        valuesAtTail.clear();
+        for (auto& valueAtTailPair : block->ssa->valuesAtTail)
+            valuesAtTail.add(valueAtTailPair.node, valueAtTailPair.value);
+    }
+}
+
+AtTailAbstractState::~AtTailAbstractState() { }
+
+void AtTailAbstractState::createValueForNode(NodeFlowProjection node)
+{
+    m_valuesAtTailMap.at(m_block).add(node, AbstractValue());
+}
+
+AbstractValue& AtTailAbstractState::forNode(NodeFlowProjection node)
+{
+    auto& valuesAtTail = m_valuesAtTailMap.at(m_block);
+    HashMap<NodeFlowProjection, AbstractValue>::iterator iter = valuesAtTail.find(node);
+    DFG_ASSERT(m_graph, node.node(), iter != valuesAtTail.end());
+    return iter->value;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGAtTailAbstractState.h b/dfg/DFGAtTailAbstractState.h
new file mode 100644
index 0000000..8f043b7
--- /dev/null
+++ b/dfg/DFGAtTailAbstractState.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractValue.h"
+#include "DFGBasicBlock.h"
+#include "DFGBlockMap.h"
+#include "DFGGraph.h"
+#include "DFGNodeFlowProjection.h"
+
+namespace JSC { namespace DFG { 
+
+class AtTailAbstractState {
+public:
+    AtTailAbstractState(Graph&);
+    
+    ~AtTailAbstractState();
+    
+    explicit operator bool() const { return true; }
+    
+    void initializeTo(BasicBlock* block)
+    {
+        m_block = block;
+    }
+    
+    void createValueForNode(NodeFlowProjection);
+    AbstractValue& forNode(NodeFlowProjection);
+    AbstractValue& forNode(Edge edge) { return forNode(edge.node()); }
+    Operands<AbstractValue>& variables() { return m_block->valuesAtTail; }
+    
+    BasicBlock* block() const { return m_block; }
+    
+    bool isValid() { return m_block->cfaDidFinish; }
+    
+    StructureClobberState structureClobberState() const { return m_block->cfaStructureClobberStateAtTail; }
+    
+    void setDidClobber(bool) { }
+    void setStructureClobberState(StructureClobberState state) { RELEASE_ASSERT(state == m_block->cfaStructureClobberStateAtTail); }
+    void setIsValid(bool isValid) { m_block->cfaDidFinish = isValid; }
+    void setBranchDirection(BranchDirection) { }
+    void setFoundConstants(bool) { }
+
+private:
+    Graph& m_graph;
+    BlockMap<HashMap<NodeFlowProjection, AbstractValue>> m_valuesAtTailMap;
+    BasicBlock* m_block { nullptr };
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAvailability.cpp b/dfg/DFGAvailability.cpp
new file mode 100644
index 0000000..0d998ab
--- /dev/null
+++ b/dfg/DFGAvailability.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGAvailability.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNode.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void Availability::dump(PrintStream& out) const
+{
+    out.print(m_flushedAt, "/");
+    
+    if (nodeIsUndecided()) {
+        out.print("Undecided");
+        return;
+    }
+    
+    if (nodeIsUnavailable()) {
+        out.print("Unavailable");
+        return;
+    }
+    
+    out.print(node());
+}
+
+void Availability::dumpInContext(PrintStream& out, DumpContext*) const
+{
+    dump(out);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGAvailability.h b/dfg/DFGAvailability.h
new file mode 100644
index 0000000..6d157f5
--- /dev/null
+++ b/dfg/DFGAvailability.h
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGFlushedAt.h"
+#include "DFGVariableAccessData.h"
+
+namespace JSC { namespace DFG {
+
+struct Node;
+
+class Availability {
+public:
+    Availability()
+        : m_node(0)
+        , m_flushedAt(DeadFlush)
+    {
+    }
+    
+    explicit Availability(Node* node)
+        : m_node(node)
+        , m_flushedAt(ConflictingFlush)
+    {
+    }
+    
+    explicit Availability(FlushedAt flushedAt)
+        : m_node(unavailableMarker())
+        , m_flushedAt(flushedAt)
+    {
+    }
+    
+    Availability(Node* node, FlushedAt flushedAt)
+        : m_node(node)
+        , m_flushedAt(flushedAt)
+    {
+    }
+    
+    static Availability unavailable()
+    {
+        return Availability(unavailableMarker(), FlushedAt(ConflictingFlush));
+    }
+    
+    Availability withFlush(FlushedAt flush) const
+    {
+        return Availability(m_node, flush);
+    }
+    
+    Availability withNode(Node* node) const
+    {
+        return Availability(node, m_flushedAt);
+    }
+    
+    Availability withUnavailableNode() const
+    {
+        return withNode(unavailableMarker());
+    }
+    
+    void setFlush(FlushedAt flushedAt)
+    {
+        m_flushedAt = flushedAt;
+    }
+    
+    void setNode(Node* node)
+    {
+        m_node = node;
+    }
+    
+    void setNodeUnavailable()
+    {
+        m_node = unavailableMarker();
+    }
+    
+    bool nodeIsUndecided() const { return !m_node; }
+    bool nodeIsUnavailable() const { return m_node == unavailableMarker(); }
+    
+    bool hasNode() const { return !nodeIsUndecided() && !nodeIsUnavailable(); }
+    bool shouldUseNode() const { return !isFlushUseful() && hasNode(); }
+    
+    Node* node() const
+    {
+        ASSERT(!nodeIsUndecided());
+        ASSERT(!nodeIsUnavailable());
+        return m_node;
+    }
+    
+    FlushedAt flushedAt() const { return m_flushedAt; }
+    bool isFlushUseful() const
+    {
+        return flushedAt().format() != DeadFlush && flushedAt().format() != ConflictingFlush;
+    }
+    
+    bool isDead() const { return !isFlushUseful() && !hasNode(); }
+    
+    bool operator!() const { return nodeIsUnavailable() && flushedAt().format() == ConflictingFlush; }
+
+    bool operator==(const Availability& other) const
+    {
+        return m_node == other.m_node
+            && m_flushedAt == other.m_flushedAt;
+    }
+    
+    bool operator!=(const Availability& other) const
+    {
+        return !(*this == other);
+    }
+    
+    Availability merge(const Availability& other) const
+    {
+        return Availability(
+            mergeNodes(m_node, other.m_node),
+            m_flushedAt.merge(other.m_flushedAt));
+    }
+    
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+
+private:
+    static Node* mergeNodes(Node* a, Node* b)
+    {
+        if (!a)
+            return b;
+        if (!b)
+            return a;
+        if (a == b)
+            return a;
+        return unavailableMarker();
+    }
+    
+    static Node* unavailableMarker()
+    {
+        return bitwise_cast<Node*>(static_cast<intptr_t>(1));
+    }
+    
+    Node* m_node;
+    FlushedAt m_flushedAt;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGAvailabilityMap.cpp b/dfg/DFGAvailabilityMap.cpp
new file mode 100644
index 0000000..e319dc6
--- /dev/null
+++ b/dfg/DFGAvailabilityMap.cpp
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGAvailabilityMap.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "JSCInlines.h"
+#include "OperandsInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace DFG {
+
+void AvailabilityMap::pruneHeap()
+{
+    if (m_heap.isEmpty())
+        return;
+    
+    HashSet<Node*> possibleNodes;
+    
+    for (unsigned i = m_locals.size(); i--;) {
+        if (m_locals[i].hasNode())
+            possibleNodes.add(m_locals[i].node());
+    }
+
+    closeOverNodes(
+        [&] (Node* node) -> bool {
+            return possibleNodes.contains(node);
+        },
+        [&] (Node* node) -> bool {
+            return possibleNodes.add(node).isNewEntry;
+        });
+    
+    HashMap<PromotedHeapLocation, Availability> newHeap;
+    for (auto pair : m_heap) {
+        if (possibleNodes.contains(pair.key.base()))
+            newHeap.add(pair.key, pair.value);
+    }
+    m_heap = newHeap;
+}
+
+void AvailabilityMap::pruneByLiveness(Graph& graph, CodeOrigin where)
+{
+    Operands<Availability> localsCopy(OperandsLike, m_locals);
+    graph.forAllLiveInBytecode(
+        where,
+        [&] (VirtualRegister reg) {
+            localsCopy.operand(reg) = m_locals.operand(reg);
+        });
+    m_locals = localsCopy;
+    pruneHeap();
+}
+
+void AvailabilityMap::clear()
+{
+    m_locals.fill(Availability());
+    m_heap.clear();
+}
+
+void AvailabilityMap::dump(PrintStream& out) const
+{
+    out.print("{locals = ", m_locals, "; heap = ", mapDump(m_heap), "}");
+}
+
+bool AvailabilityMap::operator==(const AvailabilityMap& other) const
+{
+    return m_locals == other.m_locals
+        && m_heap == other.m_heap;
+}
+
+void AvailabilityMap::merge(const AvailabilityMap& other)
+{
+    for (unsigned i = other.m_locals.size(); i--;)
+        m_locals[i] = other.m_locals[i].merge(m_locals[i]);
+    
+    for (auto pair : other.m_heap) {
+        auto result = m_heap.add(pair.key, Availability());
+        result.iterator->value = pair.value.merge(result.iterator->value);
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGAvailabilityMap.h b/dfg/DFGAvailabilityMap.h
new file mode 100644
index 0000000..5355256
--- /dev/null
+++ b/dfg/DFGAvailabilityMap.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAvailability.h"
+#include "DFGPromotedHeapLocation.h"
+
+namespace JSC { namespace DFG {
+
+struct AvailabilityMap {
+    void pruneHeap();
+    void pruneByLiveness(Graph&, CodeOrigin);
+    void clear();
+    
+    void dump(PrintStream& out) const;
+    
+    bool operator==(const AvailabilityMap& other) const;
+    
+    void merge(const AvailabilityMap& other);
+    
+    template<typename Functor>
+    void forEachAvailability(const Functor& functor)
+    {
+        for (unsigned i = m_locals.size(); i--;)
+            functor(m_locals[i]);
+        for (auto pair : m_heap)
+            functor(pair.value);
+    }
+    
+    template<typename HasFunctor, typename AddFunctor>
+    void closeOverNodes(const HasFunctor& has, const AddFunctor& add)
+    {
+        bool changed;
+        do {
+            changed = false;
+            for (auto pair : m_heap) {
+                if (pair.value.hasNode() && has(pair.key.base()))
+                    changed |= add(pair.value.node());
+            }
+        } while (changed);
+    }
+    
+    template<typename HasFunctor, typename AddFunctor>
+    void closeStartingWithLocal(VirtualRegister reg, const HasFunctor& has, const AddFunctor& add)
+    {
+        Availability availability = m_locals.operand(reg);
+        if (!availability.hasNode())
+            return;
+        
+        if (!add(availability.node()))
+            return;
+        
+        closeOverNodes(has, add);
+    }
+    
+    Operands<Availability> m_locals;
+    HashMap<PromotedHeapLocation, Availability> m_heap;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBackwardsCFG.h b/dfg/DFGBackwardsCFG.h
new file mode 100644
index 0000000..903685a
--- /dev/null
+++ b/dfg/DFGBackwardsCFG.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCFG.h"
+#include <wtf/BackwardsGraph.h>
+
+namespace JSC { namespace DFG {
+
+class BackwardsCFG : public BackwardsGraph<CFG> {
+    WTF_MAKE_NONCOPYABLE(BackwardsCFG);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    BackwardsCFG(Graph& graph)
+        : BackwardsGraph<CFG>(*graph.m_cfg)
+    {
+    }
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBackwardsDominators.h b/dfg/DFGBackwardsDominators.h
new file mode 100644
index 0000000..62d5c87
--- /dev/null
+++ b/dfg/DFGBackwardsDominators.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBackwardsCFG.h"
+#include <wtf/Dominators.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace DFG {
+
+class BackwardsDominators : public WTF::Dominators<BackwardsCFG> {
+    WTF_MAKE_NONCOPYABLE(BackwardsDominators);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    BackwardsDominators(Graph& graph)
+        : WTF::Dominators<BackwardsCFG>(graph.ensureBackwardsCFG())
+    {
+    }
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBackwardsPropagationPhase.cpp b/dfg/DFGBackwardsPropagationPhase.cpp
new file mode 100644
index 0000000..8c10303
--- /dev/null
+++ b/dfg/DFGBackwardsPropagationPhase.cpp
@@ -0,0 +1,438 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGBackwardsPropagationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class BackwardsPropagationPhase : public Phase {
+public:
+    BackwardsPropagationPhase(Graph& graph)
+        : Phase(graph, "backwards propagation")
+    {
+    }
+    
+    bool run()
+    {
+        m_changed = true;
+        while (m_changed) {
+            m_changed = false;
+            for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+                BasicBlock* block = m_graph.block(blockIndex);
+                if (!block)
+                    continue;
+            
+                // Prevent a tower of overflowing additions from creating a value that is out of the
+                // safe 2^48 range.
+                m_allowNestedOverflowingAdditions = block->size() < (1 << 16);
+            
+                for (unsigned indexInBlock = block->size(); indexInBlock--;)
+                    propagate(block->at(indexInBlock));
+            }
+        }
+        
+        return true;
+    }
+
+private:
+    bool isNotNegZero(Node* node)
+    {
+        if (!node->isNumberConstant())
+            return false;
+        double value = node->asNumber();
+        return (value || 1.0 / value > 0.0);
+    }
+    
+    bool isNotPosZero(Node* node)
+    {
+        if (!node->isNumberConstant())
+            return false;
+        double value = node->asNumber();
+        return (value || 1.0 / value < 0.0);
+    }
+
+    // Tests if the absolute value is strictly less than the power of two.
+    template<int power>
+    bool isWithinPowerOfTwoForConstant(Node* node)
+    {
+        JSValue immediateValue = node->asJSValue();
+        if (!immediateValue.isNumber())
+            return false;
+        double immediate = immediateValue.asNumber();
+        return immediate > -(static_cast<int64_t>(1) << power) && immediate < (static_cast<int64_t>(1) << power);
+    }
+    
+    template<int power>
+    bool isWithinPowerOfTwoNonRecursive(Node* node)
+    {
+        if (!node->isNumberConstant())
+            return false;
+        return isWithinPowerOfTwoForConstant<power>(node);
+    }
+    
+    template<int power>
+    bool isWithinPowerOfTwo(Node* node)
+    {
+        switch (node->op()) {
+        case DoubleConstant:
+        case JSConstant:
+        case Int52Constant: {
+            return isWithinPowerOfTwoForConstant<power>(node);
+        }
+            
+        case BitAnd: {
+            if (power > 31)
+                return true;
+            
+            return isWithinPowerOfTwoNonRecursive<power>(node->child1().node())
+                || isWithinPowerOfTwoNonRecursive<power>(node->child2().node());
+        }
+            
+        case BitOr:
+        case BitXor:
+        case BitLShift: {
+            return power > 31;
+        }
+            
+        case BitRShift:
+        case BitURShift: {
+            if (power > 31)
+                return true;
+            
+            Node* shiftAmount = node->child2().node();
+            if (!node->isNumberConstant())
+                return false;
+            JSValue immediateValue = shiftAmount->asJSValue();
+            if (!immediateValue.isInt32())
+                return false;
+            return immediateValue.asInt32() > 32 - power;
+        }
+            
+        default:
+            return false;
+        }
+    }
+
+    template<int power>
+    bool isWithinPowerOfTwo(Edge edge)
+    {
+        return isWithinPowerOfTwo<power>(edge.node());
+    }
+
+    bool mergeDefaultFlags(Node* node)
+    {
+        bool changed = false;
+        if (node->flags() & NodeHasVarArgs) {
+            for (unsigned childIdx = node->firstChild();
+                childIdx < node->firstChild() + node->numChildren();
+                childIdx++) {
+                if (!!m_graph.m_varArgChildren[childIdx])
+                    changed |= m_graph.m_varArgChildren[childIdx]->mergeFlags(NodeBytecodeUsesAsValue);
+            }
+        } else {
+            if (!node->child1())
+                return changed;
+            changed |= node->child1()->mergeFlags(NodeBytecodeUsesAsValue);
+            if (!node->child2())
+                return changed;
+            changed |= node->child2()->mergeFlags(NodeBytecodeUsesAsValue);
+            if (!node->child3())
+                return changed;
+            changed |= node->child3()->mergeFlags(NodeBytecodeUsesAsValue);
+        }
+        return changed;
+    }
+    
+    void propagate(Node* node)
+    {
+        NodeFlags flags = node->flags() & NodeBytecodeBackPropMask;
+        
+        switch (node->op()) {
+        case GetLocal: {
+            VariableAccessData* variableAccessData = node->variableAccessData();
+            flags &= ~NodeBytecodeUsesAsInt; // We don't care about cross-block uses-as-int.
+            m_changed |= variableAccessData->mergeFlags(flags);
+            break;
+        }
+            
+        case SetLocal: {
+            VariableAccessData* variableAccessData = node->variableAccessData();
+            if (!variableAccessData->isLoadedFrom())
+                break;
+            flags = variableAccessData->flags();
+            RELEASE_ASSERT(!(flags & ~NodeBytecodeBackPropMask));
+            flags |= NodeBytecodeUsesAsNumber; // Account for the fact that control flow may cause overflows that our modeling can't handle.
+            node->child1()->mergeFlags(flags);
+            break;
+        }
+            
+        case Flush: {
+            VariableAccessData* variableAccessData = node->variableAccessData();
+            m_changed |= variableAccessData->mergeFlags(NodeBytecodeUsesAsValue);
+            break;
+        }
+            
+        case MovHint:
+        case Check:
+            break;
+            
+        case BitAnd:
+        case BitOr:
+        case BitXor:
+        case BitRShift:
+        case BitLShift:
+        case BitURShift:
+        case ArithIMul: {
+            flags |= NodeBytecodeUsesAsInt;
+            flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther);
+            flags &= ~NodeBytecodeUsesAsArrayIndex;
+            node->child1()->mergeFlags(flags);
+            node->child2()->mergeFlags(flags);
+            break;
+        }
+            
+        case StringCharCodeAt: {
+            node->child1()->mergeFlags(NodeBytecodeUsesAsValue);
+            node->child2()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
+            break;
+        }
+            
+        case UInt32ToNumber: {
+            node->child1()->mergeFlags(flags);
+            break;
+        }
+
+        case ValueAdd: {
+            if (isNotNegZero(node->child1().node()) || isNotNegZero(node->child2().node()))
+                flags &= ~NodeBytecodeNeedsNegZero;
+            if (node->child1()->hasNumberResult() || node->child2()->hasNumberResult())
+                flags &= ~NodeBytecodeUsesAsOther;
+            if (!isWithinPowerOfTwo<32>(node->child1()) && !isWithinPowerOfTwo<32>(node->child2()))
+                flags |= NodeBytecodeUsesAsNumber;
+            if (!m_allowNestedOverflowingAdditions)
+                flags |= NodeBytecodeUsesAsNumber;
+            
+            node->child1()->mergeFlags(flags);
+            node->child2()->mergeFlags(flags);
+            break;
+        }
+
+        case ArithAdd: {
+            flags &= ~NodeBytecodeUsesAsOther;
+            if (isNotNegZero(node->child1().node()) || isNotNegZero(node->child2().node()))
+                flags &= ~NodeBytecodeNeedsNegZero;
+            if (!isWithinPowerOfTwo<32>(node->child1()) && !isWithinPowerOfTwo<32>(node->child2()))
+                flags |= NodeBytecodeUsesAsNumber;
+            if (!m_allowNestedOverflowingAdditions)
+                flags |= NodeBytecodeUsesAsNumber;
+            
+            node->child1()->mergeFlags(flags);
+            node->child2()->mergeFlags(flags);
+            break;
+        }
+
+        case ArithClz32: {
+            flags &= ~(NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther | ~NodeBytecodeUsesAsArrayIndex);
+            flags |= NodeBytecodeUsesAsInt;
+            node->child1()->mergeFlags(flags);
+            break;
+        }
+
+        case ArithSub: {
+            flags &= ~NodeBytecodeUsesAsOther;
+            if (isNotNegZero(node->child1().node()) || isNotPosZero(node->child2().node()))
+                flags &= ~NodeBytecodeNeedsNegZero;
+            if (!isWithinPowerOfTwo<32>(node->child1()) && !isWithinPowerOfTwo<32>(node->child2()))
+                flags |= NodeBytecodeUsesAsNumber;
+            if (!m_allowNestedOverflowingAdditions)
+                flags |= NodeBytecodeUsesAsNumber;
+            
+            node->child1()->mergeFlags(flags);
+            node->child2()->mergeFlags(flags);
+            break;
+        }
+            
+        case ArithNegate: {
+            flags &= ~NodeBytecodeUsesAsOther;
+
+            node->child1()->mergeFlags(flags);
+            break;
+        }
+            
+        case ArithMul: {
+            // As soon as a multiply happens, we can easily end up in the part
+            // of the double domain where the point at which you do truncation
+            // can change the outcome. So, ArithMul always forces its inputs to
+            // check for overflow. Additionally, it will have to check for overflow
+            // itself unless we can prove that there is no way for the values
+            // produced to cause double rounding.
+            
+            if (!isWithinPowerOfTwo<22>(node->child1().node())
+                && !isWithinPowerOfTwo<22>(node->child2().node()))
+                flags |= NodeBytecodeUsesAsNumber;
+            
+            node->mergeFlags(flags);
+            
+            flags |= NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero;
+            flags &= ~NodeBytecodeUsesAsOther;
+
+            node->child1()->mergeFlags(flags);
+            node->child2()->mergeFlags(flags);
+            break;
+        }
+            
+        case ArithDiv: {
+            flags |= NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero;
+            flags &= ~NodeBytecodeUsesAsOther;
+
+            node->child1()->mergeFlags(flags);
+            node->child2()->mergeFlags(flags);
+            break;
+        }
+            
+        case ArithMod: {
+            flags |= NodeBytecodeUsesAsNumber;
+            flags &= ~NodeBytecodeUsesAsOther;
+
+            node->child1()->mergeFlags(flags);
+            node->child2()->mergeFlags(flags & ~NodeBytecodeNeedsNegZero);
+            break;
+        }
+            
+        case GetByVal: {
+            node->child1()->mergeFlags(NodeBytecodeUsesAsValue);
+            node->child2()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
+            break;
+        }
+            
+        case NewArrayWithSize: {
+            node->child1()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
+            break;
+        }
+            
+        case NewTypedArray: {
+            // Negative zero is not observable. NaN versus undefined are only observable
+            // in that you would get a different exception message. So, like, whatever: we
+            // claim here that NaN v. undefined is observable.
+            node->child1()->mergeFlags(NodeBytecodeUsesAsInt | NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsArrayIndex);
+            break;
+        }
+            
+        case StringCharAt: {
+            node->child1()->mergeFlags(NodeBytecodeUsesAsValue);
+            node->child2()->mergeFlags(NodeBytecodeUsesAsValue | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
+            break;
+        }
+            
+        case ToString:
+        case CallStringConstructor: {
+            node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther);
+            break;
+        }
+            
+        case ToPrimitive:
+        case ToNumber: {
+            node->child1()->mergeFlags(flags);
+            break;
+        }
+
+        case PutByValDirect:
+        case PutByVal: {
+            m_graph.varArgChild(node, 0)->mergeFlags(NodeBytecodeUsesAsValue);
+            m_graph.varArgChild(node, 1)->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther | NodeBytecodeUsesAsInt | NodeBytecodeUsesAsArrayIndex);
+            m_graph.varArgChild(node, 2)->mergeFlags(NodeBytecodeUsesAsValue);
+            break;
+        }
+            
+        case Switch: {
+            SwitchData* data = node->switchData();
+            switch (data->kind) {
+            case SwitchImm:
+                // We don't need NodeBytecodeNeedsNegZero because if the cases are all integers
+                // then -0 and 0 are treated the same.  We don't need NodeBytecodeUsesAsOther
+                // because if all of the cases are integers then NaN and undefined are
+                // treated the same (i.e. they will take default).
+                node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsInt);
+                break;
+            case SwitchChar: {
+                // We don't need NodeBytecodeNeedsNegZero because if the cases are all strings
+                // then -0 and 0 are treated the same.  We don't need NodeBytecodeUsesAsOther
+                // because if all of the cases are single-character strings then NaN
+                // and undefined are treated the same (i.e. they will take default).
+                node->child1()->mergeFlags(NodeBytecodeUsesAsNumber);
+                break;
+            }
+            case SwitchString:
+                // We don't need NodeBytecodeNeedsNegZero because if the cases are all strings
+                // then -0 and 0 are treated the same.
+                node->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsOther);
+                break;
+            case SwitchCell:
+                // There is currently no point to being clever here since this is used for switching
+                // on objects.
+                mergeDefaultFlags(node);
+                break;
+            }
+            break;
+        }
+
+        case Identity: 
+            // This would be trivial to handle but we just assert that we cannot see these yet.
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+            
+        // Note: ArithSqrt, ArithSin, and ArithCos and other math intrinsics don't have special
+        // rules in here because they are always followed by Phantoms to signify that if the
+        // method call speculation fails, the bytecode may use the arguments in arbitrary ways.
+        // This corresponds to that possibility of someone doing something like:
+        // Math.sin = function(x) { doArbitraryThingsTo(x); }
+            
+        default:
+            mergeDefaultFlags(node);
+            break;
+        }
+    }
+    
+    bool m_allowNestedOverflowingAdditions;
+    bool m_changed;
+};
+
+bool performBackwardsPropagation(Graph& graph)
+{
+    return runPhase<BackwardsPropagationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGBackwardsPropagationPhase.h b/dfg/DFGBackwardsPropagationPhase.h
new file mode 100644
index 0000000..75c28e8
--- /dev/null
+++ b/dfg/DFGBackwardsPropagationPhase.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Infer basic information about how nodes are used by doing a block-local
+// backwards flow analysis.
+
+bool performBackwardsPropagation(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBasicBlock.cpp b/dfg/DFGBasicBlock.cpp
new file mode 100644
index 0000000..383ee4b
--- /dev/null
+++ b/dfg/DFGBasicBlock.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGBasicBlock.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+BasicBlock::BasicBlock(
+    unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals, float executionCount)
+    : bytecodeBegin(bytecodeBegin)
+    , index(NoBlock)
+    , isOSRTarget(false)
+    , cfaHasVisited(false)
+    , cfaShouldRevisit(false)
+    , cfaFoundConstants(false)
+    , cfaDidFinish(true)
+    , cfaStructureClobberStateAtHead(StructuresAreWatched)
+    , cfaStructureClobberStateAtTail(StructuresAreWatched)
+    , cfaBranchDirection(InvalidBranchDirection)
+#if !ASSERT_DISABLED
+    , isLinked(false)
+#endif
+    , isReachable(false)
+    , variablesAtHead(numArguments, numLocals)
+    , variablesAtTail(numArguments, numLocals)
+    , valuesAtHead(numArguments, numLocals)
+    , valuesAtTail(numArguments, numLocals)
+    , intersectionOfPastValuesAtHead(numArguments, numLocals, AbstractValue::fullTop())
+    , intersectionOfCFAHasVisited(true)
+    , executionCount(executionCount)
+{
+}
+
+BasicBlock::~BasicBlock()
+{
+}
+
+void BasicBlock::ensureLocals(unsigned newNumLocals)
+{
+    variablesAtHead.ensureLocals(newNumLocals);
+    variablesAtTail.ensureLocals(newNumLocals);
+    valuesAtHead.ensureLocals(newNumLocals);
+    valuesAtTail.ensureLocals(newNumLocals);
+    intersectionOfPastValuesAtHead.ensureLocals(newNumLocals, AbstractValue::fullTop());
+}
+
+void BasicBlock::replaceTerminal(Node* node)
+{
+    NodeAndIndex result = findTerminal();
+    if (!result)
+        append(node);
+    else {
+        m_nodes.insert(result.index + 1, node);
+        result.node->remove();
+    }
+    
+    ASSERT(terminal());
+}
+
+bool BasicBlock::isInPhis(Node* node) const
+{
+    for (size_t i = 0; i < phis.size(); ++i) {
+        if (phis[i] == node)
+            return true;
+    }
+    return false;
+}
+
+bool BasicBlock::isInBlock(Node* myNode) const
+{
+    for (size_t i = 0; i < numNodes(); ++i) {
+        if (node(i) == myNode)
+            return true;
+    }
+    return false;
+}
+
+void BasicBlock::removePredecessor(BasicBlock* block)
+{
+    for (unsigned i = 0; i < predecessors.size(); ++i) {
+        if (predecessors[i] != block)
+            continue;
+        predecessors[i] = predecessors.last();
+        predecessors.removeLast();
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void BasicBlock::replacePredecessor(BasicBlock* from, BasicBlock* to)
+{
+    for (unsigned i = predecessors.size(); i--;) {
+        if (predecessors[i] != from)
+            continue;
+        predecessors[i] = to;
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void BasicBlock::dump(PrintStream& out) const
+{
+    out.print("#", index);
+}
+
+BasicBlock::SSAData::SSAData(BasicBlock* block)
+{
+    availabilityAtHead.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
+    availabilityAtTail.m_locals = Operands<Availability>(OperandsLike, block->variablesAtHead);
+}
+
+BasicBlock::SSAData::~SSAData() { }
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGBasicBlock.h b/dfg/DFGBasicBlock.h
new file mode 100644
index 0000000..0aef108
--- /dev/null
+++ b/dfg/DFGBasicBlock.h
@@ -0,0 +1,296 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractValue.h"
+#include "DFGAvailability.h"
+#include "DFGAvailabilityMap.h"
+#include "DFGBranchDirection.h"
+#include "DFGFlushedAt.h"
+#include "DFGNode.h"
+#include "DFGNodeAbstractValuePair.h"
+#include "DFGNodeOrigin.h"
+#include "DFGStructureClobberState.h"
+#include "Operands.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class Graph;
+class InsertionSet;
+
+typedef Vector<BasicBlock*, 2> PredecessorList;
+typedef Vector<Node*, 8> BlockNodeList;
+
+struct BasicBlock : RefCounted<BasicBlock> {
+    BasicBlock(
+        unsigned bytecodeBegin, unsigned numArguments, unsigned numLocals,
+        float executionCount);
+    ~BasicBlock();
+    
+    void ensureLocals(unsigned newNumLocals);
+    
+    size_t size() const { return m_nodes.size(); }
+    bool isEmpty() const { return !size(); }
+    Node*& at(size_t i) { return m_nodes[i]; }
+    Node* at(size_t i) const { return m_nodes[i]; }
+    Node* tryAt(size_t i) const
+    {
+        if (i >= size())
+            return nullptr;
+        return at(i);
+    }
+    Node*& operator[](size_t i) { return at(i); }
+    Node* operator[](size_t i) const { return at(i); }
+    
+    // Use this to find both the index of the terminal and the terminal itself in one go. May
+    // return a clear NodeAndIndex if the basic block currently lacks a terminal. That may happen
+    // in the middle of IR transformations within a phase but should never be the case in between
+    // phases.
+    //
+    // The reason why this is more than just "at(size() - 1)" is that we may place non-terminal
+    // liveness marking instructions after the terminal. This is supposed to happen infrequently
+    // but some basic blocks - most notably return blocks - will have liveness markers for all of
+    // the flushed variables right after the return.
+    //
+    // It turns out that doing this linear search is basically perf-neutral, so long as we force
+    // the method to be inlined. Hence the ALWAYS_INLINE.
+    ALWAYS_INLINE NodeAndIndex findTerminal() const
+    {
+        size_t i = size();
+        while (i--) {
+            Node* node = at(i);
+            switch (node->op()) {
+            case Jump:
+            case Branch:
+            case Switch:
+            case Return:
+            case TailCall:
+            case DirectTailCall:
+            case TailCallVarargs:
+            case TailCallForwardVarargs:
+            case Unreachable:
+                return NodeAndIndex(node, i);
+            // The bitter end can contain Phantoms and the like. There will probably only be one or two nodes after the terminal. They are all no-ops and will not have any checked children.
+            case Check: // This is here because it's our universal no-op.
+            case Phantom:
+            case PhantomLocal:
+            case Flush:
+                break;
+            default:
+                return NodeAndIndex();
+            }
+        }
+        return NodeAndIndex();
+    }
+    
+    ALWAYS_INLINE Node* terminal() const
+    {
+        return findTerminal().node;
+    }
+    
+    void resize(size_t size) { m_nodes.resize(size); }
+    void grow(size_t size) { m_nodes.grow(size); }
+    
+    void append(Node* node) { m_nodes.append(node); }
+    void insertBeforeTerminal(Node* node)
+    {
+        NodeAndIndex result = findTerminal();
+        if (!result)
+            append(node);
+        else
+            m_nodes.insert(result.index, node);
+    }
+    
+    void replaceTerminal(Node*);
+    
+    size_t numNodes() const { return phis.size() + size(); }
+    Node* node(size_t i) const
+    {
+        if (i < phis.size())
+            return phis[i];
+        return at(i - phis.size());
+    }
+    bool isPhiIndex(size_t i) const { return i < phis.size(); }
+    
+    bool isInPhis(Node* node) const;
+    bool isInBlock(Node* myNode) const;
+    
+    BlockNodeList::iterator begin() { return m_nodes.begin(); }
+    BlockNodeList::iterator end() { return m_nodes.end(); }
+
+    unsigned numSuccessors() { return terminal()->numSuccessors(); }
+    
+    BasicBlock*& successor(unsigned index)
+    {
+        return terminal()->successor(index);
+    }
+    BasicBlock*& successorForCondition(bool condition)
+    {
+        return terminal()->successorForCondition(condition);
+    }
+
+    Node::SuccessorsIterable successors()
+    {
+        return terminal()->successors();
+    }
+    
+    void removePredecessor(BasicBlock* block);
+    void replacePredecessor(BasicBlock* from, BasicBlock* to);
+
+    template<typename... Params>
+    Node* appendNode(Graph&, SpeculatedType, Params...);
+    
+    template<typename... Params>
+    Node* appendNonTerminal(Graph&, SpeculatedType, Params...);
+    
+    template<typename... Params>
+    Node* replaceTerminal(Graph&, SpeculatedType, Params...);
+    
+    void dump(PrintStream& out) const;
+    
+    void didLink()
+    {
+#if !ASSERT_DISABLED
+        isLinked = true;
+#endif
+    }
+    
+    // This value is used internally for block linking and OSR entry. It is mostly meaningless
+    // for other purposes due to inlining.
+    unsigned bytecodeBegin;
+    
+    BlockIndex index;
+    
+    bool isOSRTarget;
+    bool cfaHasVisited;
+    bool cfaShouldRevisit;
+    bool cfaFoundConstants;
+    bool cfaDidFinish;
+    StructureClobberState cfaStructureClobberStateAtHead;
+    StructureClobberState cfaStructureClobberStateAtTail;
+    BranchDirection cfaBranchDirection;
+#if !ASSERT_DISABLED
+    bool isLinked;
+#endif
+    bool isReachable;
+    
+    Vector<Node*> phis;
+    PredecessorList predecessors;
+    
+    Operands<Node*> variablesAtHead;
+    Operands<Node*> variablesAtTail;
+    
+    Operands<AbstractValue> valuesAtHead;
+    Operands<AbstractValue> valuesAtTail;
+    
+    // The intersection of assumptions we have made previously at the head of this block. Note
+    // that under normal circumstances, each time we run the CFA, we will get strictly more precise
+    // results. But we don't actually require this to be the case. It's fine for the CFA to loosen
+    // up for any odd reason. It's fine when this happens, because anything that the CFA proves
+    // must be true from that point forward, except if some registered watchpoint fires, in which
+    // case the code won't ever run. So, the CFA proving something less precise later on is just an
+    // outcome of the CFA being imperfect; the more precise thing that it had proved earlier is no
+    // less true.
+    //
+    // But for the purpose of OSR entry, we need to make sure that we remember what assumptions we
+    // had used for optimizing any given basic block. That's what this is for.
+    //
+    // It's interesting that we could use this to make the CFA more precise: all future CFAs could
+    // filter their results with this thing to sort of maintain maximal precision. Because we
+    // expect CFA to usually be monotonically more precise each time we run it to fixpoint, this
+    // would not be a productive optimization: it would make setting up a basic block more
+    // expensive and would only benefit bizarre pathological cases.
+    Operands<AbstractValue> intersectionOfPastValuesAtHead;
+    bool intersectionOfCFAHasVisited;
+    
+    float executionCount;
+    
+    // These fields are reserved for NaturalLoops.
+    static const unsigned numberOfInnerMostLoopIndices = 2;
+    unsigned innerMostLoopIndices[numberOfInnerMostLoopIndices];
+
+    struct SSAData {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        void invalidate()
+        {
+            liveAtTail.clear();
+            liveAtHead.clear();
+            valuesAtHead.clear();
+            valuesAtTail.clear();
+        }
+
+        AvailabilityMap availabilityAtHead;
+        AvailabilityMap availabilityAtTail;
+
+        Vector<NodeFlowProjection> liveAtHead;
+        Vector<NodeFlowProjection> liveAtTail;
+        Vector<NodeAbstractValuePair> valuesAtHead;
+        Vector<NodeAbstractValuePair> valuesAtTail;
+        
+        SSAData(BasicBlock*);
+        ~SSAData();
+    };
+    std::unique_ptr<SSAData> ssa;
+    
+private:
+    friend class InsertionSet;
+    BlockNodeList m_nodes;
+};
+
+typedef Vector<BasicBlock*, 5> BlockList;
+
+struct UnlinkedBlock {
+    BasicBlock* m_block;
+    bool m_needsNormalLinking;
+    bool m_needsEarlyReturnLinking;
+    
+    UnlinkedBlock() { }
+    
+    explicit UnlinkedBlock(BasicBlock* block)
+        : m_block(block)
+        , m_needsNormalLinking(true)
+        , m_needsEarlyReturnLinking(false)
+    {
+    }
+};
+    
+static inline unsigned getBytecodeBeginForBlock(BasicBlock** basicBlock)
+{
+    return (*basicBlock)->bytecodeBegin;
+}
+
+static inline BasicBlock* blockForBytecodeOffset(Vector<BasicBlock*>& linkingTargets, unsigned bytecodeBegin)
+{
+    return *binarySearch<BasicBlock*, unsigned>(linkingTargets, linkingTargets.size(), bytecodeBegin, getBytecodeBeginForBlock);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBasicBlockInlines.h b/dfg/DFGBasicBlockInlines.h
new file mode 100644
index 0000000..b01fb72
--- /dev/null
+++ b/dfg/DFGBasicBlockInlines.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGBasicBlock.h"
+#include "DFGGraph.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+template<typename... Params>
+Node* BasicBlock::appendNode(Graph& graph, SpeculatedType type, Params... params)
+{
+    Node* result = graph.addNode(type, params...);
+    append(result);
+    return result;
+}
+
+template<typename... Params>
+Node* BasicBlock::appendNonTerminal(Graph& graph, SpeculatedType type, Params... params)
+{
+    Node* result = graph.addNode(type, params...);
+    insertBeforeTerminal(result);
+    return result;
+}
+
+template<typename... Params>
+Node* BasicBlock::replaceTerminal(Graph& graph, SpeculatedType type, Params... params)
+{
+    Node* result = graph.addNode(type, params...);
+    replaceTerminal(result);
+    return result;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBlockInsertionSet.cpp b/dfg/DFGBlockInsertionSet.cpp
new file mode 100644
index 0000000..d57c01c
--- /dev/null
+++ b/dfg/DFGBlockInsertionSet.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGBlockInsertionSet.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+BlockInsertionSet::BlockInsertionSet(Graph& graph)
+    : m_graph(graph)
+{
+}
+
+BlockInsertionSet::~BlockInsertionSet() { }
+
+void BlockInsertionSet::insert(const BlockInsertion& insertion)
+{
+    m_insertions.append(insertion);
+}
+
+void BlockInsertionSet::insert(size_t index, PassRefPtr<BasicBlock> block)
+{
+    insert(BlockInsertion(index, block));
+}
+
+BasicBlock* BlockInsertionSet::insert(size_t index, float executionCount)
+{
+    RefPtr<BasicBlock> block = adoptRef(new BasicBlock(
+        UINT_MAX,
+        m_graph.block(0)->variablesAtHead.numberOfArguments(),
+        m_graph.block(0)->variablesAtHead.numberOfLocals(),
+        executionCount));
+    block->isReachable = true;
+    insert(index, block);
+    return block.get();
+}
+
+BasicBlock* BlockInsertionSet::insertBefore(BasicBlock* before, float executionCount)
+{
+    return insert(before->index, executionCount);
+}
+
+bool BlockInsertionSet::execute()
+{
+    if (m_insertions.isEmpty())
+        return false;
+    
+    // We allow insertions to be given to us in any order. So, we need to sort them before
+    // running WTF::executeInsertions. Also, we don't really care if the sort is stable since
+    // basic block order doesn't have semantics - it's just to make code easier to read.
+    std::sort(m_insertions.begin(), m_insertions.end());
+
+    executeInsertions(m_graph.m_blocks, m_insertions);
+    
+    // Prune out empty entries. This isn't strictly necessary but it's
+    // healthy to keep the block list from growing.
+    unsigned targetIndex = 0;
+    for (unsigned sourceIndex = 0; sourceIndex < m_graph.m_blocks.size();) {
+        RefPtr<BasicBlock> block = m_graph.m_blocks[sourceIndex++];
+        if (!block)
+            continue;
+        m_graph.m_blocks[targetIndex++] = block;
+    }
+    m_graph.m_blocks.resize(targetIndex);
+    
+    // Make sure that the blocks know their new indices.
+    for (unsigned i = 0; i < m_graph.m_blocks.size(); ++i)
+        m_graph.m_blocks[i]->index = i;
+    
+    // And finally, invalidate all analyses that rely on the CFG.
+    m_graph.invalidateCFG();
+    m_graph.dethread();
+    
+    return true;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGBlockInsertionSet.h b/dfg/DFGBlockInsertionSet.h
new file mode 100644
index 0000000..eecc447
--- /dev/null
+++ b/dfg/DFGBlockInsertionSet.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include <wtf/Insertion.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+typedef WTF::Insertion<RefPtr<BasicBlock>> BlockInsertion;
+
+class BlockInsertionSet {
+public:
+    BlockInsertionSet(Graph&);
+    ~BlockInsertionSet();
+    
+    void insert(const BlockInsertion&);
+    void insert(size_t index, PassRefPtr<BasicBlock>);
+    BasicBlock* insert(size_t index, float executionCount);
+    BasicBlock* insertBefore(BasicBlock* before, float executionCount);
+
+    bool execute();
+
+private:
+    Graph& m_graph;
+    Vector<BlockInsertion, 8> m_insertions;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBlockMap.h b/dfg/DFGBlockMap.h
new file mode 100644
index 0000000..51ad20d
--- /dev/null
+++ b/dfg/DFGBlockMap.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+template<typename T>
+class BlockMap {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    BlockMap()
+    {
+    }
+    
+    BlockMap(Graph&);
+    
+    BlockIndex size() const
+    {
+        return m_vector.size();
+    }
+    
+    T& atIndex(BlockIndex blockIndex)
+    {
+        return m_vector[blockIndex];
+    }
+    
+    const T& atIndex(BlockIndex blockIndex) const
+    {
+        return m_vector[blockIndex];
+    }
+    
+    T& at(BlockIndex blockIndex)
+    {
+        return m_vector[blockIndex];
+    }
+    
+    const T& at(BlockIndex blockIndex) const
+    {
+        return m_vector[blockIndex];
+    }
+    
+    T& at(BasicBlock* block)
+    {
+        return m_vector[block->index];
+    }
+    
+    const T& at(BasicBlock* block) const
+    {
+        return m_vector[block->index];
+    }
+
+    T& operator[](BlockIndex blockIndex)
+    {
+        return m_vector[blockIndex];
+    }
+    
+    const T& operator[](BlockIndex blockIndex) const
+    {
+        return m_vector[blockIndex];
+    }
+    
+    T& operator[](BasicBlock* block)
+    {
+        return m_vector[block->index];
+    }
+    
+    const T& operator[](BasicBlock* block) const
+    {
+        return m_vector[block->index];
+    }
+
+private:
+    Vector<T> m_vector;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBlockMapInlines.h b/dfg/DFGBlockMapInlines.h
new file mode 100644
index 0000000..9b577c6
--- /dev/null
+++ b/dfg/DFGBlockMapInlines.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockMap.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+template<typename T>
+BlockMap<T>::BlockMap(Graph& graph)
+{
+    m_vector.resize(graph.numBlocks());
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBlockSet.cpp b/dfg/DFGBlockSet.cpp
new file mode 100644
index 0000000..790e380
--- /dev/null
+++ b/dfg/DFGBlockSet.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGBlockSet.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void BlockSet::dump(PrintStream& out) const
+{
+    CommaPrinter comma(" ");
+    for (BlockIndex blockIndex = m_set.findBit(0, true); blockIndex < m_set.size(); blockIndex = m_set.findBit(blockIndex + 1, true))
+        out.print(comma, "#", blockIndex);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGBlockSet.h b/dfg/DFGBlockSet.h
new file mode 100644
index 0000000..7024ee4
--- /dev/null
+++ b/dfg/DFGBlockSet.h
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include <wtf/BitVector.h>
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+class BlockSet {
+public:
+    BlockSet() { }
+    
+    // Return true if the block was added, false if it was already present.
+    bool add(BasicBlock* block)
+    {
+        return !m_set.set(block->index);
+    }
+    
+    bool contains(BasicBlock* block) const
+    {
+        if (!block)
+            return false;
+        return m_set.get(block->index);
+    }
+    
+    class iterator {
+    public:
+        iterator()
+            : m_graph(nullptr)
+            , m_set(nullptr)
+            , m_index(0)
+        {
+        }
+        
+        iterator& operator++()
+        {
+            m_index = m_set->m_set.findBit(m_index + 1, true);
+            return *this;
+        }
+        
+        BasicBlock* operator*() const;
+        
+        bool operator==(const iterator& other) const
+        {
+            return m_index == other.m_index;
+        }
+        
+        bool operator!=(const iterator& other) const
+        {
+            return !(*this == other);
+        }
+        
+    private:
+        friend class BlockSet;
+        
+        Graph* m_graph;
+        const BlockSet* m_set;
+        size_t m_index;
+    };
+    
+    class Iterable {
+    public:
+        Iterable(Graph& graph, const BlockSet& set)
+            : m_graph(graph)
+            , m_set(set)
+        {
+        }
+        
+        iterator begin() const
+        {
+            iterator result;
+            result.m_graph = &m_graph;
+            result.m_set = &m_set;
+            result.m_index = m_set.m_set.findBit(0, true);
+            return result;
+        }
+        
+        iterator end() const
+        {
+            iterator result;
+            result.m_graph = &m_graph;
+            result.m_set = &m_set;
+            result.m_index = m_set.m_set.size();
+            return result;
+        }
+        
+    private:
+        Graph& m_graph;
+        const BlockSet& m_set;
+    };
+    
+    Iterable iterable(Graph& graph) const
+    {
+        return Iterable(graph, *this);
+    }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    BitVector m_set;
+};
+
+class BlockAdder {
+public:
+    BlockAdder(BlockSet& set)
+        : m_set(set)
+    {
+    }
+    
+    bool operator()(BasicBlock* block) const
+    {
+        return m_set.add(block);
+    }
+private:
+    BlockSet& m_set;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBlockSetInlines.h b/dfg/DFGBlockSetInlines.h
new file mode 100644
index 0000000..23783b5
--- /dev/null
+++ b/dfg/DFGBlockSetInlines.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockSet.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+inline BasicBlock* BlockSet::iterator::operator*() const
+{
+    return m_graph->block(m_index);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBlockWorklist.h b/dfg/DFGBlockWorklist.h
new file mode 100644
index 0000000..3ec5141
--- /dev/null
+++ b/dfg/DFGBlockWorklist.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include "DFGBlockSet.h"
+#include <wtf/GraphNodeWorklist.h>
+
+namespace JSC { namespace DFG {
+
+struct BasicBlock;
+
+typedef GraphNodeWorklist<BasicBlock*, BlockSet> BlockWorklist;
+
+// When you say BlockWith<int> you should read it as "block with an int".
+template<typename T> using BlockWith = GraphNodeWith<BasicBlock*, T>;
+
+// Extended block worklist is useful for enqueueing some meta-data along with the block. It also
+// permits forcibly enqueueing things even if the block has already been seen. It's useful for
+// things like building a spanning tree, in which case T (the auxiliary payload) would be the
+// successor index.
+template<typename T> using ExtendedBlockWorklist = ExtendedGraphNodeWorklist<BasicBlock*, T, BlockSet>;
+
+typedef GraphVisitOrder VisitOrder;
+
+typedef GraphNodeWithOrder<BasicBlock*> BlockWithOrder;
+
+typedef PostOrderGraphNodeWorklist<BasicBlock*, BlockSet> PostOrderBlockWorklist;
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGBranchDirection.h b/dfg/DFGBranchDirection.h
new file mode 100644
index 0000000..f904a6b
--- /dev/null
+++ b/dfg/DFGBranchDirection.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+enum BranchDirection {
+    // This is not a branch and so there is no branch direction, or
+    // the branch direction has yet to be set.
+    InvalidBranchDirection,
+        
+    // The branch takes the true case.
+    TakeTrue,
+        
+    // The branch takes the false case.
+    TakeFalse,
+        
+    // For all we know, the branch could go either direction, so we
+    // have to assume the worst.
+    TakeBoth
+};
+    
+static inline const char* branchDirectionToString(BranchDirection branchDirection)
+{
+    switch (branchDirection) {
+    case InvalidBranchDirection:
+        return "InvalidBranchDirection";
+    case TakeTrue:
+        return "TakeTrue";
+    case TakeFalse:
+        return "TakeFalse";
+    case TakeBoth:
+        return "TakeBoth";
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return "InvalidBranchDirection";
+}
+    
+static inline bool isKnownDirection(BranchDirection branchDirection)
+{
+    switch (branchDirection) {
+    case TakeTrue:
+    case TakeFalse:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static inline bool branchCondition(BranchDirection branchDirection)
+{
+    if (branchDirection == TakeTrue)
+        return true;
+    ASSERT(branchDirection == TakeFalse);
+    return false;
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::DFG::BranchDirection direction)
+{
+    out.print(JSC::DFG::branchDirectionToString(direction));
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGByteCodeParser.cpp b/dfg/DFGByteCodeParser.cpp
new file mode 100644
index 0000000..353c096
--- /dev/null
+++ b/dfg/DFGByteCodeParser.cpp
@@ -0,0 +1,5922 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGByteCodeParser.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArithProfile.h"
+#include "ArrayConstructor.h"
+#include "BasicBlockLocation.h"
+#include "CallLinkStatus.h"
+#include "CodeBlock.h"
+#include "CodeBlockWithJITType.h"
+#include "DFGAbstractHeap.h"
+#include "DFGArrayMode.h"
+#include "DFGCapabilities.h"
+#include "DFGClobberize.h"
+#include "DFGClobbersExitState.h"
+#include "DFGGraph.h"
+#include "DFGJITCode.h"
+#include "FunctionCodeBlock.h"
+#include "GetByIdStatus.h"
+#include "Heap.h"
+#include "JSCInlines.h"
+#include "JSModuleEnvironment.h"
+#include "NumberConstructor.h"
+#include "ObjectConstructor.h"
+#include "PreciseJumpTargets.h"
+#include "PutByIdFlags.h"
+#include "PutByIdStatus.h"
+#include "RegExpPrototype.h"
+#include "StackAlignment.h"
+#include "StringConstructor.h"
+#include "StructureStubInfo.h"
+#include "Watchdog.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/HashMap.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC { namespace DFG {
+
+static const bool verbose = false;
+
+class ConstantBufferKey {
+public:
+    ConstantBufferKey()
+        : m_codeBlock(0)
+        , m_index(0)
+    {
+    }
+    
+    ConstantBufferKey(WTF::HashTableDeletedValueType)
+        : m_codeBlock(0)
+        , m_index(1)
+    {
+    }
+    
+    ConstantBufferKey(CodeBlock* codeBlock, unsigned index)
+        : m_codeBlock(codeBlock)
+        , m_index(index)
+    {
+    }
+    
+    bool operator==(const ConstantBufferKey& other) const
+    {
+        return m_codeBlock == other.m_codeBlock
+            && m_index == other.m_index;
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::PtrHash<CodeBlock*>::hash(m_codeBlock) ^ m_index;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return !m_codeBlock && m_index;
+    }
+    
+    CodeBlock* codeBlock() const { return m_codeBlock; }
+    unsigned index() const { return m_index; }
+    
+private:
+    CodeBlock* m_codeBlock;
+    unsigned m_index;
+};
+
+struct ConstantBufferKeyHash {
+    static unsigned hash(const ConstantBufferKey& key) { return key.hash(); }
+    static bool equal(const ConstantBufferKey& a, const ConstantBufferKey& b)
+    {
+        return a == b;
+    }
+    
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::ConstantBufferKey> {
+    typedef JSC::DFG::ConstantBufferKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::ConstantBufferKey> : SimpleClassHashTraits<JSC::DFG::ConstantBufferKey> { };
+
+} // namespace WTF
+
+namespace JSC { namespace DFG {
+
+// === ByteCodeParser ===
+//
+// This class is used to compile the dataflow graph from a CodeBlock.
+class ByteCodeParser {
+public:
+    ByteCodeParser(Graph& graph)
+        : m_vm(&graph.m_vm)
+        , m_codeBlock(graph.m_codeBlock)
+        , m_profiledBlock(graph.m_profiledBlock)
+        , m_graph(graph)
+        , m_currentBlock(0)
+        , m_currentIndex(0)
+        , m_constantUndefined(graph.freeze(jsUndefined()))
+        , m_constantNull(graph.freeze(jsNull()))
+        , m_constantNaN(graph.freeze(jsNumber(PNaN)))
+        , m_constantOne(graph.freeze(jsNumber(1)))
+        , m_numArguments(m_codeBlock->numParameters())
+        , m_numLocals(m_codeBlock->m_numCalleeLocals)
+        , m_parameterSlots(0)
+        , m_numPassedVarArgs(0)
+        , m_inlineStackTop(0)
+        , m_currentInstruction(0)
+        , m_hasDebuggerEnabled(graph.hasDebuggerEnabled())
+    {
+        ASSERT(m_profiledBlock);
+    }
+    
+    // Parse a full CodeBlock of bytecode.
+    bool parse();
+    
+private:
+    struct InlineStackEntry;
+
+    // Just parse from m_currentIndex to the end of the current CodeBlock.
+    void parseCodeBlock();
+    
+    void ensureLocals(unsigned newNumLocals)
+    {
+        if (newNumLocals <= m_numLocals)
+            return;
+        m_numLocals = newNumLocals;
+        for (size_t i = 0; i < m_graph.numBlocks(); ++i)
+            m_graph.block(i)->ensureLocals(newNumLocals);
+    }
+
+    // Helper for min and max.
+    template<typename ChecksFunctor>
+    bool handleMinMax(int resultOperand, NodeType op, int registerOffset, int argumentCountIncludingThis, const ChecksFunctor& insertChecks);
+
+    void refineStatically(CallLinkStatus&, Node* callTarget);
+    // Handle calls. This resolves issues surrounding inlining and intrinsics.
+    enum Terminality { Terminal, NonTerminal };
+    Terminality handleCall(
+        int result, NodeType op, InlineCallFrame::Kind, unsigned instructionSize,
+        Node* callTarget, int argCount, int registerOffset, CallLinkStatus,
+        SpeculatedType prediction);
+    Terminality handleCall(
+        int result, NodeType op, CallMode, unsigned instructionSize,
+        Node* callTarget, int argCount, int registerOffset, CallLinkStatus);
+    Terminality handleCall(int result, NodeType op, CallMode, unsigned instructionSize, int callee, int argCount, int registerOffset);
+    Terminality handleCall(Instruction* pc, NodeType op, CallMode);
+    Terminality handleVarargsCall(Instruction* pc, NodeType op, CallMode);
+    void emitFunctionChecks(CallVariant, Node* callTarget, VirtualRegister thisArgumnt);
+    void emitArgumentPhantoms(int registerOffset, int argumentCountIncludingThis);
+    Node* getArgumentCount();
+    unsigned inliningCost(CallVariant, int argumentCountIncludingThis, CallMode); // Return UINT_MAX if it's not an inlining candidate. By convention, intrinsics have a cost of 1.
+    // Handle inlining. Return true if it succeeded, false if we need to plant a call.
+    bool handleInlining(Node* callTargetNode, int resultOperand, const CallLinkStatus&, int registerOffset, VirtualRegister thisArgument, VirtualRegister argumentsArgument, unsigned argumentsOffset, int argumentCountIncludingThis, unsigned nextOffset, NodeType callOp, InlineCallFrame::Kind, SpeculatedType prediction);
+    enum CallerLinkability { CallerDoesNormalLinking, CallerLinksManually };
+    template<typename ChecksFunctor>
+    bool attemptToInlineCall(Node* callTargetNode, int resultOperand, CallVariant, int registerOffset, int argumentCountIncludingThis, unsigned nextOffset, InlineCallFrame::Kind, CallerLinkability, SpeculatedType prediction, unsigned& inliningBalance, const ChecksFunctor& insertChecks);
+    template<typename ChecksFunctor>
+    void inlineCall(Node* callTargetNode, int resultOperand, CallVariant, int registerOffset, int argumentCountIncludingThis, unsigned nextOffset, InlineCallFrame::Kind, CallerLinkability, const ChecksFunctor& insertChecks);
+    void cancelLinkingForBlock(InlineStackEntry*, BasicBlock*); // Only works when the given block is the last one to have been added for that inline stack entry.
+    // Handle intrinsic functions. Return true if it succeeded, false if we need to plant a call.
+    template<typename ChecksFunctor>
+    bool handleIntrinsicCall(Node* callee, int resultOperand, Intrinsic, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, const ChecksFunctor& insertChecks);
+    template<typename ChecksFunctor>
+    bool handleDOMJITCall(Node* callee, int resultOperand, const DOMJIT::Signature*, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, const ChecksFunctor& insertChecks);
+    template<typename ChecksFunctor>
+    bool handleIntrinsicGetter(int resultOperand, const GetByIdVariant& intrinsicVariant, Node* thisNode, const ChecksFunctor& insertChecks);
+    template<typename ChecksFunctor>
+    bool handleTypedArrayConstructor(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType, const ChecksFunctor& insertChecks);
+    template<typename ChecksFunctor>
+    bool handleConstantInternalFunction(Node* callTargetNode, int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind, SpeculatedType, const ChecksFunctor& insertChecks);
+    Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, const InferredType::Descriptor&, Node* value);
+    Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset, const InferredType::Descriptor&, NodeType = GetByOffset);
+    bool handleDOMJITGetter(int resultOperand, const GetByIdVariant&, Node* thisNode, unsigned identifierNumber, SpeculatedType prediction);
+
+    // Create a presence ObjectPropertyCondition based on some known offset and structure set. Does not
+    // check the validity of the condition, but it may return a null one if it encounters a contradiction.
+    ObjectPropertyCondition presenceLike(
+        JSObject* knownBase, UniquedStringImpl*, PropertyOffset, const StructureSet&);
+    
+    // Attempt to watch the presence of a property. It will watch that the property is present in the same
+    // way as in all of the structures in the set. It may emit code instead of just setting a watchpoint.
+    // Returns true if this all works out.
+    bool checkPresenceLike(JSObject* knownBase, UniquedStringImpl*, PropertyOffset, const StructureSet&);
+    void checkPresenceLike(Node* base, UniquedStringImpl*, PropertyOffset, const StructureSet&);
+    
+    // Works with both GetByIdVariant and the setter form of PutByIdVariant.
+    template<typename VariantType>
+    Node* load(SpeculatedType, Node* base, unsigned identifierNumber, const VariantType&);
+
+    Node* store(Node* base, unsigned identifier, const PutByIdVariant&, Node* value);
+
+    void handleGetById(
+        int destinationOperand, SpeculatedType, Node* base, unsigned identifierNumber, GetByIdStatus, AccessType, unsigned instructionSize);
+    void emitPutById(
+        Node* base, unsigned identifierNumber, Node* value,  const PutByIdStatus&, bool isDirect);
+    void handlePutById(
+        Node* base, unsigned identifierNumber, Node* value, const PutByIdStatus&,
+        bool isDirect);
+    
+    // Either register a watchpoint or emit a check for this condition. Returns false if the
+    // condition no longer holds, and therefore no reasonable check can be emitted.
+    bool check(const ObjectPropertyCondition&);
+    
+    GetByOffsetMethod promoteToConstant(GetByOffsetMethod);
+    
+    // Either register a watchpoint or emit a check for this condition. It must be a Presence
+    // condition. It will attempt to promote a Presence condition to an Equivalence condition.
+    // Emits code for the loaded value that the condition guards, and returns a node containing
+    // the loaded value. Returns null if the condition no longer holds.
+    GetByOffsetMethod planLoad(const ObjectPropertyCondition&);
+    Node* load(SpeculatedType, unsigned identifierNumber, const GetByOffsetMethod&, NodeType = GetByOffset);
+    Node* load(SpeculatedType, const ObjectPropertyCondition&, NodeType = GetByOffset);
+    
+    // Calls check() for each condition in the set: that is, it either emits checks or registers
+    // watchpoints (or a combination of the two) to make the conditions hold. If any of those
+    // conditions are no longer checkable, returns false.
+    bool check(const ObjectPropertyConditionSet&);
+    
+    // Calls check() for those conditions that aren't the slot base, and calls load() for the slot
+    // base. Does a combination of watchpoint registration and check emission to guard the
+    // conditions, and emits code to load the value from the slot base. Returns a node containing
+    // the loaded value. Returns null if any of the conditions were no longer checkable.
+    GetByOffsetMethod planLoad(const ObjectPropertyConditionSet&);
+    Node* load(SpeculatedType, const ObjectPropertyConditionSet&, NodeType = GetByOffset);
+
+    void prepareToParseBlock();
+    void clearCaches();
+
+    // Parse a single basic block of bytecode instructions.
+    bool parseBlock(unsigned limit);
+    // Link block successors.
+    void linkBlock(BasicBlock*, Vector<BasicBlock*>& possibleTargets);
+    void linkBlocks(Vector<UnlinkedBlock>& unlinkedBlocks, Vector<BasicBlock*>& possibleTargets);
+    
+    VariableAccessData* newVariableAccessData(VirtualRegister operand)
+    {
+        ASSERT(!operand.isConstant());
+        
+        m_graph.m_variableAccessData.append(VariableAccessData(operand));
+        return &m_graph.m_variableAccessData.last();
+    }
+    
+    // Get/Set the operands/result of a bytecode instruction.
+    Node* getDirect(VirtualRegister operand)
+    {
+        ASSERT(!operand.isConstant());
+
+        // Is this an argument?
+        if (operand.isArgument())
+            return getArgument(operand);
+
+        // Must be a local.
+        return getLocal(operand);
+    }
+
+    Node* get(VirtualRegister operand)
+    {
+        if (operand.isConstant()) {
+            unsigned constantIndex = operand.toConstantIndex();
+            unsigned oldSize = m_constants.size();
+            if (constantIndex >= oldSize || !m_constants[constantIndex]) {
+                const CodeBlock& codeBlock = *m_inlineStackTop->m_codeBlock;
+                JSValue value = codeBlock.getConstant(operand.offset());
+                SourceCodeRepresentation sourceCodeRepresentation = codeBlock.constantSourceCodeRepresentation(operand.offset());
+                if (constantIndex >= oldSize) {
+                    m_constants.grow(constantIndex + 1);
+                    for (unsigned i = oldSize; i < m_constants.size(); ++i)
+                        m_constants[i] = nullptr;
+                }
+
+                Node* constantNode = nullptr;
+                if (sourceCodeRepresentation == SourceCodeRepresentation::Double)
+                    constantNode = addToGraph(DoubleConstant, OpInfo(m_graph.freezeStrong(jsDoubleNumber(value.asNumber()))));
+                else
+                    constantNode = addToGraph(JSConstant, OpInfo(m_graph.freezeStrong(value)));
+                m_constants[constantIndex] = constantNode;
+            }
+            ASSERT(m_constants[constantIndex]);
+            return m_constants[constantIndex];
+        }
+        
+        if (inlineCallFrame()) {
+            if (!inlineCallFrame()->isClosureCall) {
+                JSFunction* callee = inlineCallFrame()->calleeConstant();
+                if (operand.offset() == CallFrameSlot::callee)
+                    return weakJSConstant(callee);
+            }
+        } else if (operand.offset() == CallFrameSlot::callee) {
+            // We have to do some constant-folding here because this enables CreateThis folding. Note
+            // that we don't have such watchpoint-based folding for inlined uses of Callee, since in that
+            // case if the function is a singleton then we already know it.
+            if (FunctionExecutable* executable = jsDynamicCast<FunctionExecutable*>(m_codeBlock->ownerExecutable())) {
+                InferredValue* singleton = executable->singletonFunction();
+                if (JSValue value = singleton->inferredValue()) {
+                    m_graph.watchpoints().addLazily(singleton);
+                    JSFunction* function = jsCast<JSFunction*>(value);
+                    return weakJSConstant(function);
+                }
+            }
+            return addToGraph(GetCallee);
+        }
+        
+        return getDirect(m_inlineStackTop->remapOperand(operand));
+    }
+    
+    enum SetMode {
+        // A normal set which follows a two-phase commit that spans code origins. During
+        // the current code origin it issues a MovHint, and at the start of the next
+        // code origin there will be a SetLocal. If the local needs flushing, the second
+        // SetLocal will be preceded with a Flush.
+        NormalSet,
+        
+        // A set where the SetLocal happens immediately and there is still a Flush. This
+        // is relevant when assigning to a local in tricky situations for the delayed
+        // SetLocal logic but where we know that we have not performed any side effects
+        // within this code origin. This is a safe replacement for NormalSet anytime we
+        // know that we have not yet performed side effects in this code origin.
+        ImmediateSetWithFlush,
+        
+        // A set where the SetLocal happens immediately and we do not Flush it even if
+        // this is a local that is marked as needing it. This is relevant when
+        // initializing locals at the top of a function.
+        ImmediateNakedSet
+    };
+    Node* setDirect(VirtualRegister operand, Node* value, SetMode setMode = NormalSet)
+    {
+        addToGraph(MovHint, OpInfo(operand.offset()), value);
+
+        // We can't exit anymore because our OSR exit state has changed.
+        m_exitOK = false;
+
+        DelayedSetLocal delayed(currentCodeOrigin(), operand, value);
+        
+        if (setMode == NormalSet) {
+            m_setLocalQueue.append(delayed);
+            return 0;
+        }
+        
+        return delayed.execute(this, setMode);
+    }
+    
+    void processSetLocalQueue()
+    {
+        for (unsigned i = 0; i < m_setLocalQueue.size(); ++i)
+            m_setLocalQueue[i].execute(this);
+        m_setLocalQueue.resize(0);
+    }
+
+    Node* set(VirtualRegister operand, Node* value, SetMode setMode = NormalSet)
+    {
+        return setDirect(m_inlineStackTop->remapOperand(operand), value, setMode);
+    }
+    
+    Node* injectLazyOperandSpeculation(Node* node)
+    {
+        ASSERT(node->op() == GetLocal);
+        ASSERT(node->origin.semantic.bytecodeIndex == m_currentIndex);
+        ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
+        LazyOperandValueProfileKey key(m_currentIndex, node->local());
+        SpeculatedType prediction = m_inlineStackTop->m_lazyOperands.prediction(locker, key);
+        node->variableAccessData()->predict(prediction);
+        return node;
+    }
+
+    // Used in implementing get/set, above, where the operand is a local variable.
+    Node* getLocal(VirtualRegister operand)
+    {
+        unsigned local = operand.toLocal();
+
+        Node* node = m_currentBlock->variablesAtTail.local(local);
+        
+        // This has two goals: 1) link together variable access datas, and 2)
+        // try to avoid creating redundant GetLocals. (1) is required for
+        // correctness - no other phase will ensure that block-local variable
+        // access data unification is done correctly. (2) is purely opportunistic
+        // and is meant as an compile-time optimization only.
+        
+        VariableAccessData* variable;
+        
+        if (node) {
+            variable = node->variableAccessData();
+            
+            switch (node->op()) {
+            case GetLocal:
+                return node;
+            case SetLocal:
+                return node->child1().node();
+            default:
+                break;
+            }
+        } else
+            variable = newVariableAccessData(operand);
+        
+        node = injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(variable)));
+        m_currentBlock->variablesAtTail.local(local) = node;
+        return node;
+    }
+    Node* setLocal(const CodeOrigin& semanticOrigin, VirtualRegister operand, Node* value, SetMode setMode = NormalSet)
+    {
+        CodeOrigin oldSemanticOrigin = m_currentSemanticOrigin;
+        m_currentSemanticOrigin = semanticOrigin;
+
+        unsigned local = operand.toLocal();
+        
+        if (setMode != ImmediateNakedSet) {
+            ArgumentPosition* argumentPosition = findArgumentPositionForLocal(operand);
+            if (argumentPosition)
+                flushDirect(operand, argumentPosition);
+            else if (m_graph.needsScopeRegister() && operand == m_codeBlock->scopeRegister())
+                flush(operand);
+        }
+
+        VariableAccessData* variableAccessData = newVariableAccessData(operand);
+        variableAccessData->mergeStructureCheckHoistingFailed(
+            m_inlineStackTop->m_exitProfile.hasExitSite(semanticOrigin.bytecodeIndex, BadCache));
+        variableAccessData->mergeCheckArrayHoistingFailed(
+            m_inlineStackTop->m_exitProfile.hasExitSite(semanticOrigin.bytecodeIndex, BadIndexingType));
+        Node* node = addToGraph(SetLocal, OpInfo(variableAccessData), value);
+        m_currentBlock->variablesAtTail.local(local) = node;
+
+        m_currentSemanticOrigin = oldSemanticOrigin;
+        return node;
+    }
+
+    // Used in implementing get/set, above, where the operand is an argument.
+    Node* getArgument(VirtualRegister operand)
+    {
+        unsigned argument = operand.toArgument();
+        ASSERT(argument < m_numArguments);
+        
+        Node* node = m_currentBlock->variablesAtTail.argument(argument);
+
+        VariableAccessData* variable;
+        
+        if (node) {
+            variable = node->variableAccessData();
+            
+            switch (node->op()) {
+            case GetLocal:
+                return node;
+            case SetLocal:
+                return node->child1().node();
+            default:
+                break;
+            }
+        } else
+            variable = newVariableAccessData(operand);
+        
+        node = injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(variable)));
+        m_currentBlock->variablesAtTail.argument(argument) = node;
+        return node;
+    }
+    Node* setArgument(const CodeOrigin& semanticOrigin, VirtualRegister operand, Node* value, SetMode setMode = NormalSet)
+    {
+        CodeOrigin oldSemanticOrigin = m_currentSemanticOrigin;
+        m_currentSemanticOrigin = semanticOrigin;
+
+        unsigned argument = operand.toArgument();
+        ASSERT(argument < m_numArguments);
+        
+        VariableAccessData* variableAccessData = newVariableAccessData(operand);
+
+        // Always flush arguments, except for 'this'. If 'this' is created by us,
+        // then make sure that it's never unboxed.
+        if (argument || m_graph.needsFlushedThis()) {
+            if (setMode != ImmediateNakedSet)
+                flushDirect(operand);
+        }
+        
+        if (!argument && m_codeBlock->specializationKind() == CodeForConstruct)
+            variableAccessData->mergeShouldNeverUnbox(true);
+        
+        variableAccessData->mergeStructureCheckHoistingFailed(
+            m_inlineStackTop->m_exitProfile.hasExitSite(semanticOrigin.bytecodeIndex, BadCache));
+        variableAccessData->mergeCheckArrayHoistingFailed(
+            m_inlineStackTop->m_exitProfile.hasExitSite(semanticOrigin.bytecodeIndex, BadIndexingType));
+        Node* node = addToGraph(SetLocal, OpInfo(variableAccessData), value);
+        m_currentBlock->variablesAtTail.argument(argument) = node;
+
+        m_currentSemanticOrigin = oldSemanticOrigin;
+        return node;
+    }
+    
+    ArgumentPosition* findArgumentPositionForArgument(int argument)
+    {
+        InlineStackEntry* stack = m_inlineStackTop;
+        while (stack->m_inlineCallFrame)
+            stack = stack->m_caller;
+        return stack->m_argumentPositions[argument];
+    }
+    
+    ArgumentPosition* findArgumentPositionForLocal(VirtualRegister operand)
+    {
+        for (InlineStackEntry* stack = m_inlineStackTop; ; stack = stack->m_caller) {
+            InlineCallFrame* inlineCallFrame = stack->m_inlineCallFrame;
+            if (!inlineCallFrame)
+                break;
+            if (operand.offset() < static_cast<int>(inlineCallFrame->stackOffset + CallFrame::headerSizeInRegisters))
+                continue;
+            if (operand.offset() == inlineCallFrame->stackOffset + CallFrame::thisArgumentOffset())
+                continue;
+            if (operand.offset() >= static_cast<int>(inlineCallFrame->stackOffset + CallFrame::thisArgumentOffset() + inlineCallFrame->arguments.size()))
+                continue;
+            int argument = VirtualRegister(operand.offset() - inlineCallFrame->stackOffset).toArgument();
+            return stack->m_argumentPositions[argument];
+        }
+        return 0;
+    }
+    
+    ArgumentPosition* findArgumentPosition(VirtualRegister operand)
+    {
+        if (operand.isArgument())
+            return findArgumentPositionForArgument(operand.toArgument());
+        return findArgumentPositionForLocal(operand);
+    }
+
+    void flush(VirtualRegister operand)
+    {
+        flushDirect(m_inlineStackTop->remapOperand(operand));
+    }
+    
+    void flushDirect(VirtualRegister operand)
+    {
+        flushDirect(operand, findArgumentPosition(operand));
+    }
+
+    void flushDirect(VirtualRegister operand, ArgumentPosition* argumentPosition)
+    {
+        addFlushOrPhantomLocal<Flush>(operand, argumentPosition);
+    }
+
+    template<NodeType nodeType>
+    void addFlushOrPhantomLocal(VirtualRegister operand, ArgumentPosition* argumentPosition)
+    {
+        ASSERT(!operand.isConstant());
+        
+        Node* node = m_currentBlock->variablesAtTail.operand(operand);
+        
+        VariableAccessData* variable;
+        
+        if (node)
+            variable = node->variableAccessData();
+        else
+            variable = newVariableAccessData(operand);
+        
+        node = addToGraph(nodeType, OpInfo(variable));
+        m_currentBlock->variablesAtTail.operand(operand) = node;
+        if (argumentPosition)
+            argumentPosition->addVariable(variable);
+    }
+
+    void phantomLocalDirect(VirtualRegister operand)
+    {
+        addFlushOrPhantomLocal<PhantomLocal>(operand, findArgumentPosition(operand));
+    }
+
+    void flush(InlineStackEntry* inlineStackEntry)
+    {
+        int numArguments;
+        if (InlineCallFrame* inlineCallFrame = inlineStackEntry->m_inlineCallFrame) {
+            ASSERT(!m_hasDebuggerEnabled);
+            numArguments = inlineCallFrame->arguments.size();
+            if (inlineCallFrame->isClosureCall)
+                flushDirect(inlineStackEntry->remapOperand(VirtualRegister(CallFrameSlot::callee)));
+            if (inlineCallFrame->isVarargs())
+                flushDirect(inlineStackEntry->remapOperand(VirtualRegister(CallFrameSlot::argumentCount)));
+        } else
+            numArguments = inlineStackEntry->m_codeBlock->numParameters();
+        for (unsigned argument = numArguments; argument-- > 1;)
+            flushDirect(inlineStackEntry->remapOperand(virtualRegisterForArgument(argument)));
+        if (!inlineStackEntry->m_inlineCallFrame && m_graph.needsFlushedThis())
+            flushDirect(virtualRegisterForArgument(0));
+        if (m_graph.needsScopeRegister())
+            flush(m_codeBlock->scopeRegister());
+    }
+
+    void flushForTerminal()
+    {
+        CodeOrigin origin = currentCodeOrigin();
+        unsigned bytecodeIndex = origin.bytecodeIndex;
+
+        for (InlineStackEntry* inlineStackEntry = m_inlineStackTop; inlineStackEntry; inlineStackEntry = inlineStackEntry->m_caller) {
+            flush(inlineStackEntry);
+
+            ASSERT(origin.inlineCallFrame == inlineStackEntry->m_inlineCallFrame);
+            InlineCallFrame* inlineCallFrame = inlineStackEntry->m_inlineCallFrame;
+            CodeBlock* codeBlock = m_graph.baselineCodeBlockFor(inlineCallFrame);
+            FullBytecodeLiveness& fullLiveness = m_graph.livenessFor(codeBlock);
+            const FastBitVector& livenessAtBytecode = fullLiveness.getLiveness(bytecodeIndex);
+
+            for (unsigned local = codeBlock->m_numCalleeLocals; local--;) {
+                if (livenessAtBytecode[local]) {
+                    VirtualRegister reg = virtualRegisterForLocal(local);
+                    if (inlineCallFrame)
+                        reg = inlineStackEntry->remapOperand(reg);
+                    phantomLocalDirect(reg);
+                }
+            }
+
+            if (inlineCallFrame) {
+                bytecodeIndex = inlineCallFrame->directCaller.bytecodeIndex;
+                origin = inlineCallFrame->directCaller;
+            }
+        }
+    }
+
+    void flushForReturn()
+    {
+        flush(m_inlineStackTop);
+    }
+    
+    void flushIfTerminal(SwitchData& data)
+    {
+        if (data.fallThrough.bytecodeIndex() > m_currentIndex)
+            return;
+        
+        for (unsigned i = data.cases.size(); i--;) {
+            if (data.cases[i].target.bytecodeIndex() > m_currentIndex)
+                return;
+        }
+        
+        flushForTerminal();
+    }
+
+    // Assumes that the constant should be strongly marked.
+    Node* jsConstant(JSValue constantValue)
+    {
+        return addToGraph(JSConstant, OpInfo(m_graph.freezeStrong(constantValue)));
+    }
+
+    Node* weakJSConstant(JSValue constantValue)
+    {
+        return addToGraph(JSConstant, OpInfo(m_graph.freeze(constantValue)));
+    }
+
+    // Helper functions to get/set the this value.
+    Node* getThis()
+    {
+        return get(m_inlineStackTop->m_codeBlock->thisRegister());
+    }
+
+    void setThis(Node* value)
+    {
+        set(m_inlineStackTop->m_codeBlock->thisRegister(), value);
+    }
+
+    InlineCallFrame* inlineCallFrame()
+    {
+        return m_inlineStackTop->m_inlineCallFrame;
+    }
+
+    bool allInlineFramesAreTailCalls()
+    {
+        return !inlineCallFrame() || !inlineCallFrame()->getCallerSkippingTailCalls();
+    }
+
+    CodeOrigin currentCodeOrigin()
+    {
+        return CodeOrigin(m_currentIndex, inlineCallFrame());
+    }
+
+    NodeOrigin currentNodeOrigin()
+    {
+        CodeOrigin semantic;
+        CodeOrigin forExit;
+
+        if (m_currentSemanticOrigin.isSet())
+            semantic = m_currentSemanticOrigin;
+        else
+            semantic = currentCodeOrigin();
+
+        forExit = currentCodeOrigin();
+
+        return NodeOrigin(semantic, forExit, m_exitOK);
+    }
+    
+    BranchData* branchData(unsigned taken, unsigned notTaken)
+    {
+        // We assume that branches originating from bytecode always have a fall-through. We
+        // use this assumption to avoid checking for the creation of terminal blocks.
+        ASSERT((taken > m_currentIndex) || (notTaken > m_currentIndex));
+        BranchData* data = m_graph.m_branchData.add();
+        *data = BranchData::withBytecodeIndices(taken, notTaken);
+        return data;
+    }
+    
+    Node* addToGraph(Node* node)
+    {
+        if (Options::verboseDFGByteCodeParsing())
+            dataLog("        appended ", node, " ", Graph::opName(node->op()), "\n");
+        m_currentBlock->append(node);
+        if (clobbersExitState(m_graph, node))
+            m_exitOK = false;
+        return node;
+    }
+    
+    Node* addToGraph(NodeType op, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)
+    {
+        Node* result = m_graph.addNode(
+            op, currentNodeOrigin(), Edge(child1), Edge(child2),
+            Edge(child3));
+        return addToGraph(result);
+    }
+    Node* addToGraph(NodeType op, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())
+    {
+        Node* result = m_graph.addNode(
+            op, currentNodeOrigin(), child1, child2, child3);
+        return addToGraph(result);
+    }
+    Node* addToGraph(NodeType op, OpInfo info, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)
+    {
+        Node* result = m_graph.addNode(
+            op, currentNodeOrigin(), info, Edge(child1), Edge(child2),
+            Edge(child3));
+        return addToGraph(result);
+    }
+    Node* addToGraph(NodeType op, OpInfo info, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())
+    {
+        Node* result = m_graph.addNode(op, currentNodeOrigin(), info, child1, child2, child3);
+        return addToGraph(result);
+    }
+    Node* addToGraph(NodeType op, OpInfo info1, OpInfo info2, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)
+    {
+        Node* result = m_graph.addNode(
+            op, currentNodeOrigin(), info1, info2,
+            Edge(child1), Edge(child2), Edge(child3));
+        return addToGraph(result);
+    }
+    Node* addToGraph(NodeType op, OpInfo info1, OpInfo info2, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())
+    {
+        Node* result = m_graph.addNode(
+            op, currentNodeOrigin(), info1, info2, child1, child2, child3);
+        return addToGraph(result);
+    }
+    
+    Node* addToGraph(Node::VarArgTag, NodeType op, OpInfo info1, OpInfo info2 = OpInfo())
+    {
+        Node* result = m_graph.addNode(
+            Node::VarArg, op, currentNodeOrigin(), info1, info2,
+            m_graph.m_varArgChildren.size() - m_numPassedVarArgs, m_numPassedVarArgs);
+        addToGraph(result);
+        
+        m_numPassedVarArgs = 0;
+        
+        return result;
+    }
+    
+    void addVarArgChild(Node* child)
+    {
+        m_graph.m_varArgChildren.append(Edge(child));
+        m_numPassedVarArgs++;
+    }
+    
+    Node* addCallWithoutSettingResult(
+        NodeType op, OpInfo opInfo, Node* callee, int argCount, int registerOffset,
+        OpInfo prediction)
+    {
+        addVarArgChild(callee);
+        size_t parameterSlots = Graph::parameterSlotsForArgCount(argCount);
+
+        if (parameterSlots > m_parameterSlots)
+            m_parameterSlots = parameterSlots;
+
+        for (int i = 0; i < argCount; ++i)
+            addVarArgChild(get(virtualRegisterForArgument(i, registerOffset)));
+
+        return addToGraph(Node::VarArg, op, opInfo, prediction);
+    }
+    
+    Node* addCall(
+        int result, NodeType op, const DOMJIT::Signature* signature, Node* callee, int argCount, int registerOffset,
+        SpeculatedType prediction)
+    {
+        if (op == TailCall) {
+            if (allInlineFramesAreTailCalls())
+                return addCallWithoutSettingResult(op, OpInfo(signature), callee, argCount, registerOffset, OpInfo());
+            op = TailCallInlinedCaller;
+        }
+
+
+        Node* call = addCallWithoutSettingResult(
+            op, OpInfo(signature), callee, argCount, registerOffset, OpInfo(prediction));
+        VirtualRegister resultReg(result);
+        if (resultReg.isValid())
+            set(resultReg, call);
+        return call;
+    }
+    
+    Node* cellConstantWithStructureCheck(JSCell* object, Structure* structure)
+    {
+        // FIXME: This should route to emitPropertyCheck, not the other way around. But currently,
+        // this gets no profit from using emitPropertyCheck() since we'll non-adaptively watch the
+        // object's structure as soon as we make it a weakJSCosntant.
+        Node* objectNode = weakJSConstant(object);
+        addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(structure)), objectNode);
+        return objectNode;
+    }
+    
+    SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)
+    {
+        SpeculatedType prediction;
+        {
+            ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
+            prediction = m_inlineStackTop->m_profiledBlock->valueProfilePredictionForBytecodeOffset(locker, bytecodeIndex);
+        }
+
+        if (prediction != SpecNone)
+            return prediction;
+
+        // If we have no information about the values this
+        // node generates, we check if by any chance it is
+        // a tail call opcode. In that case, we walk up the
+        // inline frames to find a call higher in the call
+        // chain and use its prediction. If we only have
+        // inlined tail call frames, we use SpecFullTop
+        // to avoid a spurious OSR exit.
+        Instruction* instruction = m_inlineStackTop->m_profiledBlock->instructions().begin() + bytecodeIndex;
+        OpcodeID opcodeID = m_vm->interpreter->getOpcodeID(instruction->u.opcode);
+
+        switch (opcodeID) {
+        case op_tail_call:
+        case op_tail_call_varargs:
+        case op_tail_call_forward_arguments: {
+            // Things should be more permissive to us returning BOTTOM instead of TOP here.
+            // Currently, this will cause us to Force OSR exit. This is bad because returning
+            // TOP will cause anything that transitively touches this speculated type to
+            // also become TOP during prediction propagation.
+            // https://bugs.webkit.org/show_bug.cgi?id=164337
+            if (!inlineCallFrame())
+                return SpecFullTop;
+
+            CodeOrigin* codeOrigin = inlineCallFrame()->getCallerSkippingTailCalls();
+            if (!codeOrigin)
+                return SpecFullTop;
+
+            InlineStackEntry* stack = m_inlineStackTop;
+            while (stack->m_inlineCallFrame != codeOrigin->inlineCallFrame)
+                stack = stack->m_caller;
+
+            bytecodeIndex = codeOrigin->bytecodeIndex;
+            CodeBlock* profiledBlock = stack->m_profiledBlock;
+            ConcurrentJSLocker locker(profiledBlock->m_lock);
+            return profiledBlock->valueProfilePredictionForBytecodeOffset(locker, bytecodeIndex);
+        }
+
+        default:
+            return SpecNone;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return SpecNone;
+    }
+
+    SpeculatedType getPrediction(unsigned bytecodeIndex)
+    {
+        SpeculatedType prediction = getPredictionWithoutOSRExit(bytecodeIndex);
+
+        if (prediction == SpecNone) {
+            // We have no information about what values this node generates. Give up
+            // on executing this code, since we're likely to do more damage than good.
+            addToGraph(ForceOSRExit);
+        }
+        
+        return prediction;
+    }
+    
+    SpeculatedType getPredictionWithoutOSRExit()
+    {
+        return getPredictionWithoutOSRExit(m_currentIndex);
+    }
+    
+    SpeculatedType getPrediction()
+    {
+        return getPrediction(m_currentIndex);
+    }
+    
+    ArrayMode getArrayMode(ArrayProfile* profile, Array::Action action)
+    {
+        ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
+        profile->computeUpdatedPrediction(locker, m_inlineStackTop->m_profiledBlock);
+        bool makeSafe = profile->outOfBounds(locker);
+        return ArrayMode::fromObserved(locker, profile, action, makeSafe);
+    }
+    
+    ArrayMode getArrayMode(ArrayProfile* profile)
+    {
+        return getArrayMode(profile, Array::Read);
+    }
+    
+    Node* makeSafe(Node* node)
+    {
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))
+            node->mergeFlags(NodeMayOverflowInt32InDFG);
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))
+            node->mergeFlags(NodeMayNegZeroInDFG);
+        
+        if (!isX86() && node->op() == ArithMod)
+            return node;
+
+        {
+            ArithProfile* arithProfile = m_inlineStackTop->m_profiledBlock->arithProfileForBytecodeOffset(m_currentIndex);
+            if (arithProfile) {
+                switch (node->op()) {
+                case ArithAdd:
+                case ArithSub:
+                case ValueAdd:
+                    if (arithProfile->didObserveDouble())
+                        node->mergeFlags(NodeMayHaveDoubleResult);
+                    if (arithProfile->didObserveNonNumber())
+                        node->mergeFlags(NodeMayHaveNonNumberResult);
+                    break;
+                
+                case ArithMul: {
+                    if (arithProfile->didObserveInt52Overflow())
+                        node->mergeFlags(NodeMayOverflowInt52);
+                    if (arithProfile->didObserveInt32Overflow() || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))
+                        node->mergeFlags(NodeMayOverflowInt32InBaseline);
+                    if (arithProfile->didObserveNegZeroDouble() || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))
+                        node->mergeFlags(NodeMayNegZeroInBaseline);
+                    if (arithProfile->didObserveDouble())
+                        node->mergeFlags(NodeMayHaveDoubleResult);
+                    if (arithProfile->didObserveNonNumber())
+                        node->mergeFlags(NodeMayHaveNonNumberResult);
+                    break;
+                }
+                case ArithNegate: {
+                    ASSERT_WITH_MESSAGE(!arithProfile->didObserveNonNumber(), "op_negate starts with a toNumber() on the argument, it should only produce numbers.");
+
+                    if (arithProfile->lhsObservedType().sawNumber() || arithProfile->didObserveDouble())
+                        node->mergeFlags(NodeMayHaveDoubleResult);
+                    if (arithProfile->didObserveNegZeroDouble() || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))
+                        node->mergeFlags(NodeMayNegZeroInBaseline);
+                    if (arithProfile->didObserveInt32Overflow() || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))
+                        node->mergeFlags(NodeMayOverflowInt32InBaseline);
+                    break;
+                }
+                
+                default:
+                    break;
+                }
+            }
+        }
+        
+        if (m_inlineStackTop->m_profiledBlock->likelyToTakeSlowCase(m_currentIndex)) {
+            switch (node->op()) {
+            case UInt32ToNumber:
+            case ArithAdd:
+            case ArithSub:
+            case ValueAdd:
+            case ArithMod: // for ArithMod "MayOverflow" means we tried to divide by zero, or we saw double.
+                node->mergeFlags(NodeMayOverflowInt32InBaseline);
+                break;
+                
+            default:
+                break;
+            }
+        }
+        
+        return node;
+    }
+    
+    Node* makeDivSafe(Node* node)
+    {
+        ASSERT(node->op() == ArithDiv);
+        
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))
+            node->mergeFlags(NodeMayOverflowInt32InDFG);
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))
+            node->mergeFlags(NodeMayNegZeroInDFG);
+        
+        // The main slow case counter for op_div in the old JIT counts only when
+        // the operands are not numbers. We don't care about that since we already
+        // have speculations in place that take care of that separately. We only
+        // care about when the outcome of the division is not an integer, which
+        // is what the special fast case counter tells us.
+        
+        if (!m_inlineStackTop->m_profiledBlock->couldTakeSpecialFastCase(m_currentIndex))
+            return node;
+        
+        // FIXME: It might be possible to make this more granular.
+        node->mergeFlags(NodeMayOverflowInt32InBaseline | NodeMayNegZeroInBaseline);
+        
+        return node;
+    }
+    
+    void noticeArgumentsUse()
+    {
+        // All of the arguments in this function need to be formatted as JSValues because we will
+        // load from them in a random-access fashion and we don't want to have to switch on
+        // format.
+        
+        for (ArgumentPosition* argument : m_inlineStackTop->m_argumentPositions)
+            argument->mergeShouldNeverUnbox(true);
+    }
+
+    bool needsDynamicLookup(ResolveType, OpcodeID);
+    
+    VM* m_vm;
+    CodeBlock* m_codeBlock;
+    CodeBlock* m_profiledBlock;
+    Graph& m_graph;
+
+    // The current block being generated.
+    BasicBlock* m_currentBlock;
+    // The bytecode index of the current instruction being generated.
+    unsigned m_currentIndex;
+    // The semantic origin of the current node if different from the current Index.
+    CodeOrigin m_currentSemanticOrigin;
+    // True if it's OK to OSR exit right now.
+    bool m_exitOK { false };
+
+    FrozenValue* m_constantUndefined;
+    FrozenValue* m_constantNull;
+    FrozenValue* m_constantNaN;
+    FrozenValue* m_constantOne;
+    Vector<Node*, 16> m_constants;
+
+    // The number of arguments passed to the function.
+    unsigned m_numArguments;
+    // The number of locals (vars + temporaries) used in the function.
+    unsigned m_numLocals;
+    // The number of slots (in units of sizeof(Register)) that we need to
+    // preallocate for arguments to outgoing calls from this frame. This
+    // number includes the CallFrame slots that we initialize for the callee
+    // (but not the callee-initialized CallerFrame and ReturnPC slots).
+    // This number is 0 if and only if this function is a leaf.
+    unsigned m_parameterSlots;
+    // The number of var args passed to the next var arg node.
+    unsigned m_numPassedVarArgs;
+
+    HashMap<ConstantBufferKey, unsigned> m_constantBufferCache;
+    
+    struct InlineStackEntry {
+        ByteCodeParser* m_byteCodeParser;
+        
+        CodeBlock* m_codeBlock;
+        CodeBlock* m_profiledBlock;
+        InlineCallFrame* m_inlineCallFrame;
+        
+        ScriptExecutable* executable() { return m_codeBlock->ownerScriptExecutable(); }
+        
+        QueryableExitProfile m_exitProfile;
+        
+        // Remapping of identifier and constant numbers from the code block being
+        // inlined (inline callee) to the code block that we're inlining into
+        // (the machine code block, which is the transitive, though not necessarily
+        // direct, caller).
+        Vector<unsigned> m_identifierRemap;
+        Vector<unsigned> m_constantBufferRemap;
+        Vector<unsigned> m_switchRemap;
+        
+        // Blocks introduced by this code block, which need successor linking.
+        // May include up to one basic block that includes the continuation after
+        // the callsite in the caller. These must be appended in the order that they
+        // are created, but their bytecodeBegin values need not be in order as they
+        // are ignored.
+        Vector<UnlinkedBlock> m_unlinkedBlocks;
+        
+        // Potential block linking targets. Must be sorted by bytecodeBegin, and
+        // cannot have two blocks that have the same bytecodeBegin.
+        Vector<BasicBlock*> m_blockLinkingTargets;
+        
+        // If the callsite's basic block was split into two, then this will be
+        // the head of the callsite block. It needs its successors linked to the
+        // m_unlinkedBlocks, but not the other way around: there's no way for
+        // any blocks in m_unlinkedBlocks to jump back into this block.
+        BasicBlock* m_callsiteBlockHead;
+        
+        // Does the callsite block head need linking? This is typically true
+        // but will be false for the machine code block's inline stack entry
+        // (since that one is not inlined) and for cases where an inline callee
+        // did the linking for us.
+        bool m_callsiteBlockHeadNeedsLinking;
+        
+        VirtualRegister m_returnValue;
+        
+        // Speculations about variable types collected from the profiled code block,
+        // which are based on OSR exit profiles that past DFG compilatins of this
+        // code block had gathered.
+        LazyOperandValueProfileParser m_lazyOperands;
+        
+        CallLinkInfoMap m_callLinkInfos;
+        StubInfoMap m_stubInfos;
+        ByValInfoMap m_byValInfos;
+        
+        // Did we see any returns? We need to handle the (uncommon but necessary)
+        // case where a procedure that does not return was inlined.
+        bool m_didReturn;
+        
+        // Did we have any early returns?
+        bool m_didEarlyReturn;
+        
+        // Pointers to the argument position trackers for this slice of code.
+        Vector<ArgumentPosition*> m_argumentPositions;
+        
+        InlineStackEntry* m_caller;
+        
+        InlineStackEntry(
+            ByteCodeParser*,
+            CodeBlock*,
+            CodeBlock* profiledBlock,
+            BasicBlock* callsiteBlockHead,
+            JSFunction* callee, // Null if this is a closure call.
+            VirtualRegister returnValueVR,
+            VirtualRegister inlineCallFrameStart,
+            int argumentCountIncludingThis,
+            InlineCallFrame::Kind);
+        
+        ~InlineStackEntry()
+        {
+            m_byteCodeParser->m_inlineStackTop = m_caller;
+        }
+        
+        VirtualRegister remapOperand(VirtualRegister operand) const
+        {
+            if (!m_inlineCallFrame)
+                return operand;
+            
+            ASSERT(!operand.isConstant());
+
+            return VirtualRegister(operand.offset() + m_inlineCallFrame->stackOffset);
+        }
+    };
+    
+    InlineStackEntry* m_inlineStackTop;
+    
+    struct DelayedSetLocal {
+        CodeOrigin m_origin;
+        VirtualRegister m_operand;
+        Node* m_value;
+        
+        DelayedSetLocal() { }
+        DelayedSetLocal(const CodeOrigin& origin, VirtualRegister operand, Node* value)
+            : m_origin(origin)
+            , m_operand(operand)
+            , m_value(value)
+        {
+        }
+        
+        Node* execute(ByteCodeParser* parser, SetMode setMode = NormalSet)
+        {
+            if (m_operand.isArgument())
+                return parser->setArgument(m_origin, m_operand, m_value, setMode);
+            return parser->setLocal(m_origin, m_operand, m_value, setMode);
+        }
+    };
+    
+    Vector<DelayedSetLocal, 2> m_setLocalQueue;
+
+    CodeBlock* m_dfgCodeBlock;
+    CallLinkStatus::ContextMap m_callContextMap;
+    StubInfoMap m_dfgStubInfos;
+    
+    Instruction* m_currentInstruction;
+    bool m_hasDebuggerEnabled;
+};
+
+// The idiom:
+//     if (true) { ...; goto label; } else label: continue
+// Allows using NEXT_OPCODE as a statement, even in unbraced if+else, while containing a `continue`.
+// The more common idiom:
+//     do { ...; } while (false)
+// Doesn't allow using `continue`.
+#define NEXT_OPCODE(name) \
+    if (true) { \
+        m_currentIndex += OPCODE_LENGTH(name); \
+        goto WTF_CONCAT(NEXT_OPCODE_, __LINE__); /* Need a unique label: usable more than once per function. */ \
+    } else \
+    WTF_CONCAT(NEXT_OPCODE_, __LINE__): \
+        continue
+
+// Chain expressions with comma-operator so LAST_OPCODE can be used as a statement.
+#define LAST_OPCODE(name) \
+    return \
+        m_currentIndex += OPCODE_LENGTH(name), \
+        m_exitOK = false, \
+        shouldContinueParsing
+
+ByteCodeParser::Terminality ByteCodeParser::handleCall(Instruction* pc, NodeType op, CallMode callMode)
+{
+    ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_construct));
+    ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_tail_call));
+    return handleCall(
+        pc[1].u.operand, op, callMode, OPCODE_LENGTH(op_call),
+        pc[2].u.operand, pc[3].u.operand, -pc[4].u.operand);
+}
+
+ByteCodeParser::Terminality ByteCodeParser::handleCall(
+    int result, NodeType op, CallMode callMode, unsigned instructionSize,
+    int callee, int argumentCountIncludingThis, int registerOffset)
+{
+    Node* callTarget = get(VirtualRegister(callee));
+    
+    CallLinkStatus callLinkStatus = CallLinkStatus::computeFor(
+        m_inlineStackTop->m_profiledBlock, currentCodeOrigin(),
+        m_inlineStackTop->m_callLinkInfos, m_callContextMap);
+    
+    return handleCall(
+        result, op, callMode, instructionSize, callTarget,
+        argumentCountIncludingThis, registerOffset, callLinkStatus);
+}
+    
+ByteCodeParser::Terminality ByteCodeParser::handleCall(
+    int result, NodeType op, CallMode callMode, unsigned instructionSize,
+    Node* callTarget, int argumentCountIncludingThis, int registerOffset,
+    CallLinkStatus callLinkStatus)
+{
+    return handleCall(
+        result, op, InlineCallFrame::kindFor(callMode), instructionSize, callTarget, argumentCountIncludingThis,
+        registerOffset, callLinkStatus, getPrediction());
+}
+
+void ByteCodeParser::refineStatically(CallLinkStatus& callLinkStatus, Node* callTarget)
+{
+    if (callTarget->isCellConstant()) {
+        callLinkStatus.setProvenConstantCallee(CallVariant(callTarget->asCell()));
+        return;
+    }
+}
+
+ByteCodeParser::Terminality ByteCodeParser::handleCall(
+    int result, NodeType op, InlineCallFrame::Kind kind, unsigned instructionSize,
+    Node* callTarget, int argumentCountIncludingThis, int registerOffset,
+    CallLinkStatus callLinkStatus, SpeculatedType prediction)
+{
+    ASSERT(registerOffset <= 0);
+
+    refineStatically(callLinkStatus, callTarget);
+    
+    if (Options::verboseDFGByteCodeParsing())
+        dataLog("    Handling call at ", currentCodeOrigin(), ": ", callLinkStatus, "\n");
+    
+    if (!callLinkStatus.canOptimize()) {
+        // Oddly, this conflates calls that haven't executed with calls that behaved sufficiently polymorphically
+        // that we cannot optimize them.
+
+        Node* callNode = addCall(result, op, nullptr, callTarget, argumentCountIncludingThis, registerOffset, prediction);
+        if (callNode->op() == TailCall)
+            return Terminal;
+        ASSERT(callNode->op() != TailCallVarargs && callNode->op() != TailCallForwardVarargs);
+        return NonTerminal;
+    }
+    
+    unsigned nextOffset = m_currentIndex + instructionSize;
+    
+    if (handleInlining(callTarget, result, callLinkStatus, registerOffset, virtualRegisterForArgument(0, registerOffset), VirtualRegister(), 0, argumentCountIncludingThis, nextOffset, op, kind, prediction)) {
+        if (m_graph.compilation())
+            m_graph.compilation()->noticeInlinedCall();
+        return NonTerminal;
+    }
+    
+    Node* callNode = addCall(result, op, nullptr, callTarget, argumentCountIncludingThis, registerOffset, prediction);
+    if (callNode->op() == TailCall)
+        return Terminal;
+    ASSERT(callNode->op() != TailCallVarargs && callNode->op() != TailCallForwardVarargs);
+    return NonTerminal;
+}
+
+ByteCodeParser::Terminality ByteCodeParser::handleVarargsCall(Instruction* pc, NodeType op, CallMode callMode)
+{
+    ASSERT(OPCODE_LENGTH(op_call_varargs) == OPCODE_LENGTH(op_construct_varargs));
+    ASSERT(OPCODE_LENGTH(op_call_varargs) == OPCODE_LENGTH(op_tail_call_varargs));
+
+    int result = pc[1].u.operand;
+    int callee = pc[2].u.operand;
+    int thisReg = pc[3].u.operand;
+    int arguments = pc[4].u.operand;
+    int firstFreeReg = pc[5].u.operand;
+    int firstVarArgOffset = pc[6].u.operand;
+    
+    SpeculatedType prediction = getPrediction();
+    
+    Node* callTarget = get(VirtualRegister(callee));
+    
+    CallLinkStatus callLinkStatus = CallLinkStatus::computeFor(
+        m_inlineStackTop->m_profiledBlock, currentCodeOrigin(),
+        m_inlineStackTop->m_callLinkInfos, m_callContextMap);
+    refineStatically(callLinkStatus, callTarget);
+    
+    if (Options::verboseDFGByteCodeParsing())
+        dataLog("    Varargs call link status at ", currentCodeOrigin(), ": ", callLinkStatus, "\n");
+    
+    if (callLinkStatus.canOptimize()
+        && handleInlining(callTarget, result, callLinkStatus, firstFreeReg, VirtualRegister(thisReg), VirtualRegister(arguments), firstVarArgOffset, 0, m_currentIndex + OPCODE_LENGTH(op_call_varargs), op, InlineCallFrame::varargsKindFor(callMode), prediction)) {
+        if (m_graph.compilation())
+            m_graph.compilation()->noticeInlinedCall();
+        return NonTerminal;
+    }
+    
+    CallVarargsData* data = m_graph.m_callVarargsData.add();
+    data->firstVarArgOffset = firstVarArgOffset;
+    
+    Node* thisChild = get(VirtualRegister(thisReg));
+    Node* argumentsChild = nullptr;
+    if (op != TailCallForwardVarargs)
+        argumentsChild = get(VirtualRegister(arguments));
+
+    if (op == TailCallVarargs || op == TailCallForwardVarargs) {
+        if (allInlineFramesAreTailCalls()) {
+            addToGraph(op, OpInfo(data), OpInfo(), callTarget, thisChild, argumentsChild);
+            return Terminal;
+        }
+        op = op == TailCallVarargs ? TailCallVarargsInlinedCaller : TailCallForwardVarargsInlinedCaller;
+    }
+
+    Node* call = addToGraph(op, OpInfo(data), OpInfo(prediction), callTarget, thisChild, argumentsChild);
+    VirtualRegister resultReg(result);
+    if (resultReg.isValid())
+        set(resultReg, call);
+    return NonTerminal;
+}
+
+void ByteCodeParser::emitFunctionChecks(CallVariant callee, Node* callTarget, VirtualRegister thisArgumentReg)
+{
+    Node* thisArgument;
+    if (thisArgumentReg.isValid())
+        thisArgument = get(thisArgumentReg);
+    else
+        thisArgument = 0;
+
+    JSCell* calleeCell;
+    Node* callTargetForCheck;
+    if (callee.isClosureCall()) {
+        calleeCell = callee.executable();
+        callTargetForCheck = addToGraph(GetExecutable, callTarget);
+    } else {
+        calleeCell = callee.nonExecutableCallee();
+        callTargetForCheck = callTarget;
+    }
+    
+    ASSERT(calleeCell);
+    addToGraph(CheckCell, OpInfo(m_graph.freeze(calleeCell)), callTargetForCheck, thisArgument);
+}
+
+Node* ByteCodeParser::getArgumentCount()
+{
+    Node* argumentCount;
+    if (m_inlineStackTop->m_inlineCallFrame) {
+        if (m_inlineStackTop->m_inlineCallFrame->isVarargs())
+            argumentCount = get(VirtualRegister(CallFrameSlot::argumentCount));
+        else
+            argumentCount = jsConstant(m_graph.freeze(jsNumber(m_inlineStackTop->m_inlineCallFrame->arguments.size()))->value());
+    } else
+        argumentCount = addToGraph(GetArgumentCountIncludingThis, OpInfo(0), OpInfo(SpecInt32Only));
+    return argumentCount;
+}
+
+void ByteCodeParser::emitArgumentPhantoms(int registerOffset, int argumentCountIncludingThis)
+{
+    for (int i = 0; i < argumentCountIncludingThis; ++i)
+        addToGraph(Phantom, get(virtualRegisterForArgument(i, registerOffset)));
+}
+
+unsigned ByteCodeParser::inliningCost(CallVariant callee, int argumentCountIncludingThis, CallMode callMode)
+{
+    CodeSpecializationKind kind = specializationKindFor(callMode);
+    if (verbose)
+        dataLog("Considering inlining ", callee, " into ", currentCodeOrigin(), "\n");
+    
+    if (m_hasDebuggerEnabled) {
+        if (verbose)
+            dataLog("    Failing because the debugger is in use.\n");
+        return UINT_MAX;
+    }
+
+    FunctionExecutable* executable = callee.functionExecutable();
+    if (!executable) {
+        if (verbose)
+            dataLog("    Failing because there is no function executable.\n");
+        return UINT_MAX;
+    }
+    
+    // Does the number of arguments we're passing match the arity of the target? We currently
+    // inline only if the number of arguments passed is greater than or equal to the number
+    // arguments expected.
+    if (static_cast<int>(executable->parameterCount()) + 1 > argumentCountIncludingThis) {
+        if (verbose)
+            dataLog("    Failing because of arity mismatch.\n");
+        return UINT_MAX;
+    }
+    
+    // Do we have a code block, and does the code block's size match the heuristics/requirements for
+    // being an inline candidate? We might not have a code block (1) if code was thrown away,
+    // (2) if we simply hadn't actually made this call yet or (3) code is a builtin function and
+    // specialization kind is construct. In the former 2 cases, we could still theoretically attempt
+    // to inline it if we had a static proof of what was being called; this might happen for example
+    // if you call a global function, where watchpointing gives us static information. Overall,
+    // it's a rare case because we expect that any hot callees would have already been compiled.
+    CodeBlock* codeBlock = executable->baselineCodeBlockFor(kind);
+    if (!codeBlock) {
+        if (verbose)
+            dataLog("    Failing because no code block available.\n");
+        return UINT_MAX;
+    }
+    CapabilityLevel capabilityLevel = inlineFunctionForCapabilityLevel(
+        codeBlock, kind, callee.isClosureCall());
+    if (verbose) {
+        dataLog("    Call mode: ", callMode, "\n");
+        dataLog("    Is closure call: ", callee.isClosureCall(), "\n");
+        dataLog("    Capability level: ", capabilityLevel, "\n");
+        dataLog("    Might inline function: ", mightInlineFunctionFor(codeBlock, kind), "\n");
+        dataLog("    Might compile function: ", mightCompileFunctionFor(codeBlock, kind), "\n");
+        dataLog("    Is supported for inlining: ", isSupportedForInlining(codeBlock), "\n");
+        dataLog("    Is inlining candidate: ", codeBlock->ownerScriptExecutable()->isInliningCandidate(), "\n");
+    }
+    if (!canInline(capabilityLevel)) {
+        if (verbose)
+            dataLog("    Failing because the function is not inlineable.\n");
+        return UINT_MAX;
+    }
+    
+    // Check if the caller is already too large. We do this check here because that's just
+    // where we happen to also have the callee's code block, and we want that for the
+    // purpose of unsetting SABI.
+    if (!isSmallEnoughToInlineCodeInto(m_codeBlock)) {
+        codeBlock->m_shouldAlwaysBeInlined = false;
+        if (verbose)
+            dataLog("    Failing because the caller is too large.\n");
+        return UINT_MAX;
+    }
+    
+    // FIXME: this should be better at predicting how much bloat we will introduce by inlining
+    // this function.
+    // https://bugs.webkit.org/show_bug.cgi?id=127627
+    
+    // FIXME: We currently inline functions that have run in LLInt but not in Baseline. These
+    // functions have very low fidelity profiling, and presumably they weren't very hot if they
+    // haven't gotten to Baseline yet. Consider not inlining these functions.
+    // https://bugs.webkit.org/show_bug.cgi?id=145503
+    
+    // Have we exceeded inline stack depth, or are we trying to inline a recursive call to
+    // too many levels? If either of these are detected, then don't inline. We adjust our
+    // heuristics if we are dealing with a function that cannot otherwise be compiled.
+    
+    unsigned depth = 0;
+    unsigned recursion = 0;
+    
+    for (InlineStackEntry* entry = m_inlineStackTop; entry; entry = entry->m_caller) {
+        ++depth;
+        if (depth >= Options::maximumInliningDepth()) {
+            if (verbose)
+                dataLog("    Failing because depth exceeded.\n");
+            return UINT_MAX;
+        }
+        
+        if (entry->executable() == executable) {
+            ++recursion;
+            if (recursion >= Options::maximumInliningRecursion()) {
+                if (verbose)
+                    dataLog("    Failing because recursion detected.\n");
+                return UINT_MAX;
+            }
+        }
+    }
+    
+    if (verbose)
+        dataLog("    Inlining should be possible.\n");
+    
+    // It might be possible to inline.
+    return codeBlock->instructionCount();
+}
+
+template<typename ChecksFunctor>
+void ByteCodeParser::inlineCall(Node* callTargetNode, int resultOperand, CallVariant callee, int registerOffset, int argumentCountIncludingThis, unsigned nextOffset, InlineCallFrame::Kind kind, CallerLinkability callerLinkability, const ChecksFunctor& insertChecks)
+{
+    CodeSpecializationKind specializationKind = InlineCallFrame::specializationKindFor(kind);
+    
+    ASSERT(inliningCost(callee, argumentCountIncludingThis, InlineCallFrame::callModeFor(kind)) != UINT_MAX);
+    
+    CodeBlock* codeBlock = callee.functionExecutable()->baselineCodeBlockFor(specializationKind);
+    insertChecks(codeBlock);
+
+    // FIXME: Don't flush constants!
+    
+    int inlineCallFrameStart = m_inlineStackTop->remapOperand(VirtualRegister(registerOffset)).offset() + CallFrame::headerSizeInRegisters;
+    
+    ensureLocals(
+        VirtualRegister(inlineCallFrameStart).toLocal() + 1 +
+        CallFrame::headerSizeInRegisters + codeBlock->m_numCalleeLocals);
+    
+    size_t argumentPositionStart = m_graph.m_argumentPositions.size();
+
+    VirtualRegister resultReg(resultOperand);
+    if (resultReg.isValid())
+        resultReg = m_inlineStackTop->remapOperand(resultReg);
+
+    VariableAccessData* calleeVariable = nullptr;
+    if (callee.isClosureCall()) {
+        Node* calleeSet = set(
+            VirtualRegister(registerOffset + CallFrameSlot::callee), callTargetNode, ImmediateNakedSet);
+        
+        calleeVariable = calleeSet->variableAccessData();
+        calleeVariable->mergeShouldNeverUnbox(true);
+    }
+    
+    InlineStackEntry inlineStackEntry(
+        this, codeBlock, codeBlock, m_graph.lastBlock(), callee.function(), resultReg,
+        (VirtualRegister)inlineCallFrameStart, argumentCountIncludingThis, kind);
+    
+    // This is where the actual inlining really happens.
+    unsigned oldIndex = m_currentIndex;
+    m_currentIndex = 0;
+
+    // At this point, it's again OK to OSR exit.
+    m_exitOK = true;
+
+    InlineVariableData inlineVariableData;
+    inlineVariableData.inlineCallFrame = m_inlineStackTop->m_inlineCallFrame;
+    inlineVariableData.argumentPositionStart = argumentPositionStart;
+    inlineVariableData.calleeVariable = 0;
+    
+    RELEASE_ASSERT(
+        m_inlineStackTop->m_inlineCallFrame->isClosureCall
+        == callee.isClosureCall());
+    if (callee.isClosureCall()) {
+        RELEASE_ASSERT(calleeVariable);
+        inlineVariableData.calleeVariable = calleeVariable;
+    }
+    
+    m_graph.m_inlineVariableData.append(inlineVariableData);
+
+    parseCodeBlock();
+    clearCaches(); // Reset our state now that we're back to the outer code.
+    
+    m_currentIndex = oldIndex;
+    m_exitOK = false;
+    
+    // If the inlined code created some new basic blocks, then we have linking to do.
+    if (inlineStackEntry.m_callsiteBlockHead != m_graph.lastBlock()) {
+        
+        ASSERT(!inlineStackEntry.m_unlinkedBlocks.isEmpty());
+        if (inlineStackEntry.m_callsiteBlockHeadNeedsLinking)
+            linkBlock(inlineStackEntry.m_callsiteBlockHead, inlineStackEntry.m_blockLinkingTargets);
+        else
+            ASSERT(inlineStackEntry.m_callsiteBlockHead->isLinked);
+        
+        if (callerLinkability == CallerDoesNormalLinking)
+            cancelLinkingForBlock(inlineStackEntry.m_caller, inlineStackEntry.m_callsiteBlockHead);
+        
+        linkBlocks(inlineStackEntry.m_unlinkedBlocks, inlineStackEntry.m_blockLinkingTargets);
+    } else
+        ASSERT(inlineStackEntry.m_unlinkedBlocks.isEmpty());
+    
+    BasicBlock* lastBlock = m_graph.lastBlock();
+    // If there was a return, but no early returns, then we're done. We allow parsing of
+    // the caller to continue in whatever basic block we're in right now.
+    if (!inlineStackEntry.m_didEarlyReturn && inlineStackEntry.m_didReturn) {
+        if (Options::verboseDFGByteCodeParsing())
+            dataLog("    Allowing parsing to continue in last inlined block.\n");
+        
+        ASSERT(lastBlock->isEmpty() || !lastBlock->terminal());
+        
+        // If we created new blocks then the last block needs linking, but in the
+        // caller. It doesn't need to be linked to, but it needs outgoing links.
+        if (!inlineStackEntry.m_unlinkedBlocks.isEmpty()) {
+            // For debugging purposes, set the bytecodeBegin. Note that this doesn't matter
+            // for release builds because this block will never serve as a potential target
+            // in the linker's binary search.
+            if (Options::verboseDFGByteCodeParsing())
+                dataLog("        Repurposing last block from ", lastBlock->bytecodeBegin, " to ", m_currentIndex, "\n");
+            lastBlock->bytecodeBegin = m_currentIndex;
+            if (callerLinkability == CallerDoesNormalLinking) {
+                if (verbose)
+                    dataLog("Adding unlinked block ", RawPointer(m_graph.lastBlock()), " (one return)\n");
+                m_inlineStackTop->m_caller->m_unlinkedBlocks.append(UnlinkedBlock(m_graph.lastBlock()));
+            }
+        }
+        
+        m_currentBlock = m_graph.lastBlock();
+        return;
+    }
+
+    if (Options::verboseDFGByteCodeParsing())
+        dataLog("    Creating new block after inlining.\n");
+
+    // If we get to this point then all blocks must end in some sort of terminals.
+    ASSERT(lastBlock->terminal());
+
+    // Need to create a new basic block for the continuation at the caller.
+    RefPtr<BasicBlock> block = adoptRef(new BasicBlock(nextOffset, m_numArguments, m_numLocals, 1));
+
+    // Link the early returns to the basic block we're about to create.
+    for (size_t i = 0; i < inlineStackEntry.m_unlinkedBlocks.size(); ++i) {
+        if (!inlineStackEntry.m_unlinkedBlocks[i].m_needsEarlyReturnLinking)
+            continue;
+        BasicBlock* blockToLink = inlineStackEntry.m_unlinkedBlocks[i].m_block;
+        ASSERT(!blockToLink->isLinked);
+        Node* node = blockToLink->terminal();
+        ASSERT(node->op() == Jump);
+        ASSERT(!node->targetBlock());
+        node->targetBlock() = block.get();
+        inlineStackEntry.m_unlinkedBlocks[i].m_needsEarlyReturnLinking = false;
+        if (verbose)
+            dataLog("Marking ", RawPointer(blockToLink), " as linked (jumps to return)\n");
+        blockToLink->didLink();
+    }
+    
+    m_currentBlock = block.get();
+    ASSERT(m_inlineStackTop->m_caller->m_blockLinkingTargets.isEmpty() || m_inlineStackTop->m_caller->m_blockLinkingTargets.last()->bytecodeBegin < nextOffset);
+    if (verbose)
+        dataLog("Adding unlinked block ", RawPointer(block.get()), " (many returns)\n");
+    if (callerLinkability == CallerDoesNormalLinking) {
+        m_inlineStackTop->m_caller->m_unlinkedBlocks.append(UnlinkedBlock(block.get()));
+        m_inlineStackTop->m_caller->m_blockLinkingTargets.append(block.get());
+    }
+    m_graph.appendBlock(block);
+    prepareToParseBlock();
+}
+
+void ByteCodeParser::cancelLinkingForBlock(InlineStackEntry* inlineStackEntry, BasicBlock* block)
+{
+    // It's possible that the callsite block head is not owned by the caller.
+    if (!inlineStackEntry->m_unlinkedBlocks.isEmpty()) {
+        // It's definitely owned by the caller, because the caller created new blocks.
+        // Assert that this all adds up.
+        ASSERT_UNUSED(block, inlineStackEntry->m_unlinkedBlocks.last().m_block == block);
+        ASSERT(inlineStackEntry->m_unlinkedBlocks.last().m_needsNormalLinking);
+        inlineStackEntry->m_unlinkedBlocks.last().m_needsNormalLinking = false;
+    } else {
+        // It's definitely not owned by the caller. Tell the caller that he does not
+        // need to link his callsite block head, because we did it for him.
+        ASSERT(inlineStackEntry->m_callsiteBlockHeadNeedsLinking);
+        ASSERT_UNUSED(block, inlineStackEntry->m_callsiteBlockHead == block);
+        inlineStackEntry->m_callsiteBlockHeadNeedsLinking = false;
+    }
+}
+
+template<typename ChecksFunctor>
+bool ByteCodeParser::attemptToInlineCall(Node* callTargetNode, int resultOperand, CallVariant callee, int registerOffset, int argumentCountIncludingThis, unsigned nextOffset, InlineCallFrame::Kind kind, CallerLinkability callerLinkability, SpeculatedType prediction, unsigned& inliningBalance, const ChecksFunctor& insertChecks)
+{
+    CodeSpecializationKind specializationKind = InlineCallFrame::specializationKindFor(kind);
+    
+    if (!inliningBalance)
+        return false;
+    
+    if (verbose)
+        dataLog("    Considering callee ", callee, "\n");
+    
+    // Intrinsics and internal functions can only be inlined if we're not doing varargs. This is because
+    // we currently don't have any way of getting profiling information for arguments to non-JS varargs
+    // calls. The prediction propagator won't be of any help because LoadVarargs obscures the data flow,
+    // and there are no callsite value profiles and native function won't have callee value profiles for
+    // those arguments. Even worse, if the intrinsic decides to exit, it won't really have anywhere to
+    // exit to: LoadVarargs is effectful and it's part of the op_call_varargs, so we can't exit without
+    // calling LoadVarargs twice.
+    if (!InlineCallFrame::isVarargs(kind)) {
+
+        bool didInsertChecks = false;
+        auto insertChecksWithAccounting = [&] () {
+            insertChecks(nullptr);
+            didInsertChecks = true;
+        };
+    
+        if (InternalFunction* function = callee.internalFunction()) {
+            if (handleConstantInternalFunction(callTargetNode, resultOperand, function, registerOffset, argumentCountIncludingThis, specializationKind, prediction, insertChecksWithAccounting)) {
+                RELEASE_ASSERT(didInsertChecks);
+                addToGraph(Phantom, callTargetNode);
+                emitArgumentPhantoms(registerOffset, argumentCountIncludingThis);
+                inliningBalance--;
+                return true;
+            }
+            RELEASE_ASSERT(!didInsertChecks);
+            return false;
+        }
+    
+        Intrinsic intrinsic = callee.intrinsicFor(specializationKind);
+        if (intrinsic != NoIntrinsic) {
+            if (handleIntrinsicCall(callTargetNode, resultOperand, intrinsic, registerOffset, argumentCountIncludingThis, prediction, insertChecksWithAccounting)) {
+                RELEASE_ASSERT(didInsertChecks);
+                addToGraph(Phantom, callTargetNode);
+                emitArgumentPhantoms(registerOffset, argumentCountIncludingThis);
+                inliningBalance--;
+                return true;
+            }
+
+            RELEASE_ASSERT(!didInsertChecks);
+            // We might still try to inline the Intrinsic because it might be a builtin JS function.
+        }
+
+        if (Options::useDOMJIT()) {
+            if (const DOMJIT::Signature* signature = callee.signatureFor(specializationKind)) {
+                if (handleDOMJITCall(callTargetNode, resultOperand, signature, registerOffset, argumentCountIncludingThis, prediction, insertChecksWithAccounting)) {
+                    RELEASE_ASSERT(didInsertChecks);
+                    addToGraph(Phantom, callTargetNode);
+                    emitArgumentPhantoms(registerOffset, argumentCountIncludingThis);
+                    inliningBalance--;
+                    return true;
+                }
+                RELEASE_ASSERT(!didInsertChecks);
+            }
+        }
+    }
+    
+    unsigned myInliningCost = inliningCost(callee, argumentCountIncludingThis, InlineCallFrame::callModeFor(kind));
+    if (myInliningCost > inliningBalance)
+        return false;
+
+    Instruction* savedCurrentInstruction = m_currentInstruction;
+    inlineCall(callTargetNode, resultOperand, callee, registerOffset, argumentCountIncludingThis, nextOffset, kind, callerLinkability, insertChecks);
+    inliningBalance -= myInliningCost;
+    m_currentInstruction = savedCurrentInstruction;
+    return true;
+}
+
+bool ByteCodeParser::handleInlining(
+    Node* callTargetNode, int resultOperand, const CallLinkStatus& callLinkStatus,
+    int registerOffsetOrFirstFreeReg, VirtualRegister thisArgument,
+    VirtualRegister argumentsArgument, unsigned argumentsOffset, int argumentCountIncludingThis,
+    unsigned nextOffset, NodeType callOp, InlineCallFrame::Kind kind, SpeculatedType prediction)
+{
+    if (verbose) {
+        dataLog("Handling inlining...\n");
+        dataLog("Stack: ", currentCodeOrigin(), "\n");
+    }
+    CodeSpecializationKind specializationKind = InlineCallFrame::specializationKindFor(kind);
+    
+    if (!callLinkStatus.size()) {
+        if (verbose)
+            dataLog("Bailing inlining.\n");
+        return false;
+    }
+    
+    if (InlineCallFrame::isVarargs(kind)
+        && callLinkStatus.maxNumArguments() > Options::maximumVarargsForInlining()) {
+        if (verbose)
+            dataLog("Bailing inlining because of varargs.\n");
+        return false;
+    }
+        
+    unsigned inliningBalance = Options::maximumFunctionForCallInlineCandidateInstructionCount();
+    if (specializationKind == CodeForConstruct)
+        inliningBalance = std::min(inliningBalance, Options::maximumFunctionForConstructInlineCandidateInstructionCount());
+    if (callLinkStatus.isClosureCall())
+        inliningBalance = std::min(inliningBalance, Options::maximumFunctionForClosureCallInlineCandidateInstructionCount());
+    
+    // First check if we can avoid creating control flow. Our inliner does some CFG
+    // simplification on the fly and this helps reduce compile times, but we can only leverage
+    // this in cases where we don't need control flow diamonds to check the callee.
+    if (!callLinkStatus.couldTakeSlowPath() && callLinkStatus.size() == 1) {
+        int registerOffset;
+        
+        // Only used for varargs calls.
+        unsigned mandatoryMinimum = 0;
+        unsigned maxNumArguments = 0;
+
+        if (InlineCallFrame::isVarargs(kind)) {
+            if (FunctionExecutable* functionExecutable = callLinkStatus[0].functionExecutable())
+                mandatoryMinimum = functionExecutable->parameterCount();
+            else
+                mandatoryMinimum = 0;
+            
+            // includes "this"
+            maxNumArguments = std::max(
+                callLinkStatus.maxNumArguments(),
+                mandatoryMinimum + 1);
+            
+            // We sort of pretend that this *is* the number of arguments that were passed.
+            argumentCountIncludingThis = maxNumArguments;
+            
+            registerOffset = registerOffsetOrFirstFreeReg + 1;
+            registerOffset -= maxNumArguments; // includes "this"
+            registerOffset -= CallFrame::headerSizeInRegisters;
+            registerOffset = -WTF::roundUpToMultipleOf(
+                stackAlignmentRegisters(),
+                -registerOffset);
+        } else
+            registerOffset = registerOffsetOrFirstFreeReg;
+        
+        bool result = attemptToInlineCall(
+            callTargetNode, resultOperand, callLinkStatus[0], registerOffset,
+            argumentCountIncludingThis, nextOffset, kind, CallerDoesNormalLinking, prediction,
+            inliningBalance, [&] (CodeBlock* codeBlock) {
+                emitFunctionChecks(callLinkStatus[0], callTargetNode, thisArgument);
+
+                // If we have a varargs call, we want to extract the arguments right now.
+                if (InlineCallFrame::isVarargs(kind)) {
+                    int remappedRegisterOffset =
+                        m_inlineStackTop->remapOperand(VirtualRegister(registerOffset)).offset();
+                    
+                    ensureLocals(VirtualRegister(remappedRegisterOffset).toLocal());
+                    
+                    int argumentStart = registerOffset + CallFrame::headerSizeInRegisters;
+                    int remappedArgumentStart =
+                        m_inlineStackTop->remapOperand(VirtualRegister(argumentStart)).offset();
+
+                    LoadVarargsData* data = m_graph.m_loadVarargsData.add();
+                    data->start = VirtualRegister(remappedArgumentStart + 1);
+                    data->count = VirtualRegister(remappedRegisterOffset + CallFrameSlot::argumentCount);
+                    data->offset = argumentsOffset;
+                    data->limit = maxNumArguments;
+                    data->mandatoryMinimum = mandatoryMinimum;
+
+                    if (callOp == TailCallForwardVarargs)
+                        addToGraph(ForwardVarargs, OpInfo(data));
+                    else
+                        addToGraph(LoadVarargs, OpInfo(data), get(argumentsArgument));
+
+                    // LoadVarargs may OSR exit. Hence, we need to keep alive callTargetNode, thisArgument
+                    // and argumentsArgument for the baseline JIT. However, we only need a Phantom for
+                    // callTargetNode because the other 2 are still in use and alive at this point.
+                    addToGraph(Phantom, callTargetNode);
+
+                    // In DFG IR before SSA, we cannot insert control flow between after the
+                    // LoadVarargs and the last SetArgument. This isn't a problem once we get to DFG
+                    // SSA. Fortunately, we also have other reasons for not inserting control flow
+                    // before SSA.
+            
+                    VariableAccessData* countVariable = newVariableAccessData(
+                        VirtualRegister(remappedRegisterOffset + CallFrameSlot::argumentCount));
+                    // This is pretty lame, but it will force the count to be flushed as an int. This doesn't
+                    // matter very much, since our use of a SetArgument and Flushes for this local slot is
+                    // mostly just a formality.
+                    countVariable->predict(SpecInt32Only);
+                    countVariable->mergeIsProfitableToUnbox(true);
+                    Node* setArgumentCount = addToGraph(SetArgument, OpInfo(countVariable));
+                    m_currentBlock->variablesAtTail.setOperand(countVariable->local(), setArgumentCount);
+
+                    set(VirtualRegister(argumentStart), get(thisArgument), ImmediateNakedSet);
+                    for (unsigned argument = 1; argument < maxNumArguments; ++argument) {
+                        VariableAccessData* variable = newVariableAccessData(
+                            VirtualRegister(remappedArgumentStart + argument));
+                        variable->mergeShouldNeverUnbox(true); // We currently have nowhere to put the type check on the LoadVarargs. LoadVarargs is effectful, so after it finishes, we cannot exit.
+                        
+                        // For a while it had been my intention to do things like this inside the
+                        // prediction injection phase. But in this case it's really best to do it here,
+                        // because it's here that we have access to the variable access datas for the
+                        // inlining we're about to do.
+                        //
+                        // Something else that's interesting here is that we'd really love to get
+                        // predictions from the arguments loaded at the callsite, rather than the
+                        // arguments received inside the callee. But that probably won't matter for most
+                        // calls.
+                        if (codeBlock && argument < static_cast<unsigned>(codeBlock->numParameters())) {
+                            ConcurrentJSLocker locker(codeBlock->m_lock);
+                            if (ValueProfile* profile = codeBlock->valueProfileForArgument(argument))
+                                variable->predict(profile->computeUpdatedPrediction(locker));
+                        }
+                        
+                        Node* setArgument = addToGraph(SetArgument, OpInfo(variable));
+                        m_currentBlock->variablesAtTail.setOperand(variable->local(), setArgument);
+                    }
+                }
+            });
+        if (verbose) {
+            dataLog("Done inlining (simple).\n");
+            dataLog("Stack: ", currentCodeOrigin(), "\n");
+            dataLog("Result: ", result, "\n");
+        }
+        return result;
+    }
+    
+    // We need to create some kind of switch over callee. For now we only do this if we believe that
+    // we're in the top tier. We have two reasons for this: first, it provides us an opportunity to
+    // do more detailed polyvariant/polymorphic profiling; and second, it reduces compile times in
+    // the DFG. And by polyvariant profiling we mean polyvariant profiling of *this* call. Note that
+    // we could improve that aspect of this by doing polymorphic inlining but having the profiling
+    // also.
+    if (!isFTL(m_graph.m_plan.mode) || !Options::usePolymorphicCallInlining()
+        || InlineCallFrame::isVarargs(kind)) {
+        if (verbose) {
+            dataLog("Bailing inlining (hard).\n");
+            dataLog("Stack: ", currentCodeOrigin(), "\n");
+        }
+        return false;
+    }
+    
+    // If the claim is that this did not originate from a stub, then we don't want to emit a switch
+    // statement. Whenever the non-stub profiling says that it could take slow path, it really means that
+    // it has no idea.
+    if (!Options::usePolymorphicCallInliningForNonStubStatus()
+        && !callLinkStatus.isBasedOnStub()) {
+        if (verbose) {
+            dataLog("Bailing inlining (non-stub polymorphism).\n");
+            dataLog("Stack: ", currentCodeOrigin(), "\n");
+        }
+        return false;
+    }
+    
+    unsigned oldOffset = m_currentIndex;
+    
+    bool allAreClosureCalls = true;
+    bool allAreDirectCalls = true;
+    for (unsigned i = callLinkStatus.size(); i--;) {
+        if (callLinkStatus[i].isClosureCall())
+            allAreDirectCalls = false;
+        else
+            allAreClosureCalls = false;
+    }
+    
+    Node* thingToSwitchOn;
+    if (allAreDirectCalls)
+        thingToSwitchOn = callTargetNode;
+    else if (allAreClosureCalls)
+        thingToSwitchOn = addToGraph(GetExecutable, callTargetNode);
+    else {
+        // FIXME: We should be able to handle this case, but it's tricky and we don't know of cases
+        // where it would be beneficial. It might be best to handle these cases as if all calls were
+        // closure calls.
+        // https://bugs.webkit.org/show_bug.cgi?id=136020
+        if (verbose) {
+            dataLog("Bailing inlining (mix).\n");
+            dataLog("Stack: ", currentCodeOrigin(), "\n");
+        }
+        return false;
+    }
+    
+    if (verbose) {
+        dataLog("Doing hard inlining...\n");
+        dataLog("Stack: ", currentCodeOrigin(), "\n");
+    }
+    
+    int registerOffset = registerOffsetOrFirstFreeReg;
+    
+    // This makes me wish that we were in SSA all the time. We need to pick a variable into which to
+    // store the callee so that it will be accessible to all of the blocks we're about to create. We
+    // get away with doing an immediate-set here because we wouldn't have performed any side effects
+    // yet.
+    if (verbose)
+        dataLog("Register offset: ", registerOffset);
+    VirtualRegister calleeReg(registerOffset + CallFrameSlot::callee);
+    calleeReg = m_inlineStackTop->remapOperand(calleeReg);
+    if (verbose)
+        dataLog("Callee is going to be ", calleeReg, "\n");
+    setDirect(calleeReg, callTargetNode, ImmediateSetWithFlush);
+
+    // It's OK to exit right now, even though we set some locals. That's because those locals are not
+    // user-visible.
+    m_exitOK = true;
+    addToGraph(ExitOK);
+    
+    SwitchData& data = *m_graph.m_switchData.add();
+    data.kind = SwitchCell;
+    addToGraph(Switch, OpInfo(&data), thingToSwitchOn);
+    
+    BasicBlock* originBlock = m_currentBlock;
+    if (verbose)
+        dataLog("Marking ", RawPointer(originBlock), " as linked (origin of poly inline)\n");
+    originBlock->didLink();
+    cancelLinkingForBlock(m_inlineStackTop, originBlock);
+    
+    // Each inlined callee will have a landing block that it returns at. They should all have jumps
+    // to the continuation block, which we create last.
+    Vector<BasicBlock*> landingBlocks;
+    
+    // We may force this true if we give up on inlining any of the edges.
+    bool couldTakeSlowPath = callLinkStatus.couldTakeSlowPath();
+    
+    if (verbose)
+        dataLog("About to loop over functions at ", currentCodeOrigin(), ".\n");
+    
+    for (unsigned i = 0; i < callLinkStatus.size(); ++i) {
+        m_currentIndex = oldOffset;
+        RefPtr<BasicBlock> block = adoptRef(new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
+        m_currentBlock = block.get();
+        m_graph.appendBlock(block);
+        prepareToParseBlock();
+        
+        Node* myCallTargetNode = getDirect(calleeReg);
+        
+        bool inliningResult = attemptToInlineCall(
+            myCallTargetNode, resultOperand, callLinkStatus[i], registerOffset,
+            argumentCountIncludingThis, nextOffset, kind, CallerLinksManually, prediction,
+            inliningBalance, [&] (CodeBlock*) { });
+        
+        if (!inliningResult) {
+            // That failed so we let the block die. Nothing interesting should have been added to
+            // the block. We also give up on inlining any of the (less frequent) callees.
+            ASSERT(m_currentBlock == block.get());
+            ASSERT(m_graph.m_blocks.last() == block);
+            m_graph.killBlockAndItsContents(block.get());
+            m_graph.m_blocks.removeLast();
+            
+            // The fact that inlining failed means we need a slow path.
+            couldTakeSlowPath = true;
+            break;
+        }
+        
+        JSCell* thingToCaseOn;
+        if (allAreDirectCalls)
+            thingToCaseOn = callLinkStatus[i].nonExecutableCallee();
+        else {
+            ASSERT(allAreClosureCalls);
+            thingToCaseOn = callLinkStatus[i].executable();
+        }
+        data.cases.append(SwitchCase(m_graph.freeze(thingToCaseOn), block.get()));
+        m_currentIndex = nextOffset;
+        m_exitOK = true;
+        processSetLocalQueue(); // This only comes into play for intrinsics, since normal inlined code will leave an empty queue.
+        if (Node* terminal = m_currentBlock->terminal())
+            ASSERT_UNUSED(terminal, terminal->op() == TailCall || terminal->op() == TailCallVarargs || terminal->op() == TailCallForwardVarargs);
+        else {
+            addToGraph(Jump);
+            landingBlocks.append(m_currentBlock);
+        }
+        if (verbose)
+            dataLog("Marking ", RawPointer(m_currentBlock), " as linked (tail of poly inlinee)\n");
+        m_currentBlock->didLink();
+
+        if (verbose)
+            dataLog("Finished inlining ", callLinkStatus[i], " at ", currentCodeOrigin(), ".\n");
+    }
+    
+    RefPtr<BasicBlock> slowPathBlock = adoptRef(
+        new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
+    m_currentIndex = oldOffset;
+    m_exitOK = true;
+    data.fallThrough = BranchTarget(slowPathBlock.get());
+    m_graph.appendBlock(slowPathBlock);
+    if (verbose)
+        dataLog("Marking ", RawPointer(slowPathBlock.get()), " as linked (slow path block)\n");
+    slowPathBlock->didLink();
+    prepareToParseBlock();
+    m_currentBlock = slowPathBlock.get();
+    Node* myCallTargetNode = getDirect(calleeReg);
+    if (couldTakeSlowPath) {
+        addCall(
+            resultOperand, callOp, nullptr, myCallTargetNode, argumentCountIncludingThis,
+            registerOffset, prediction);
+    } else {
+        addToGraph(CheckBadCell);
+        addToGraph(Phantom, myCallTargetNode);
+        emitArgumentPhantoms(registerOffset, argumentCountIncludingThis);
+        
+        set(VirtualRegister(resultOperand), addToGraph(BottomValue));
+    }
+
+    m_currentIndex = nextOffset;
+    m_exitOK = true; // Origin changed, so it's fine to exit again.
+    processSetLocalQueue();
+    if (Node* terminal = m_currentBlock->terminal())
+        ASSERT_UNUSED(terminal, terminal->op() == TailCall || terminal->op() == TailCallVarargs || terminal->op() == TailCallForwardVarargs);
+    else {
+        addToGraph(Jump);
+        landingBlocks.append(m_currentBlock);
+    }
+    
+    RefPtr<BasicBlock> continuationBlock = adoptRef(
+        new BasicBlock(UINT_MAX, m_numArguments, m_numLocals, 1));
+    m_graph.appendBlock(continuationBlock);
+    if (verbose)
+        dataLog("Adding unlinked block ", RawPointer(continuationBlock.get()), " (continuation)\n");
+    m_inlineStackTop->m_unlinkedBlocks.append(UnlinkedBlock(continuationBlock.get()));
+    prepareToParseBlock();
+    m_currentBlock = continuationBlock.get();
+    
+    for (unsigned i = landingBlocks.size(); i--;)
+        landingBlocks[i]->terminal()->targetBlock() = continuationBlock.get();
+    
+    m_currentIndex = oldOffset;
+    m_exitOK = true;
+    
+    if (verbose) {
+        dataLog("Done inlining (hard).\n");
+        dataLog("Stack: ", currentCodeOrigin(), "\n");
+    }
+    return true;
+}
+
+template<typename ChecksFunctor>
+bool ByteCodeParser::handleMinMax(int resultOperand, NodeType op, int registerOffset, int argumentCountIncludingThis, const ChecksFunctor& insertChecks)
+{
+    ASSERT(op == ArithMin || op == ArithMax);
+
+    if (argumentCountIncludingThis == 1) {
+        insertChecks();
+        double result = op == ArithMax ? -std::numeric_limits<double>::infinity() : +std::numeric_limits<double>::infinity();
+        set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_graph.freeze(jsDoubleNumber(result)))));
+        return true;
+    }
+     
+    if (argumentCountIncludingThis == 2) {
+        insertChecks();
+        Node* result = get(VirtualRegister(virtualRegisterForArgument(1, registerOffset)));
+        addToGraph(Phantom, Edge(result, NumberUse));
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+    
+    if (argumentCountIncludingThis == 3) {
+        insertChecks();
+        set(VirtualRegister(resultOperand), addToGraph(op, get(virtualRegisterForArgument(1, registerOffset)), get(virtualRegisterForArgument(2, registerOffset))));
+        return true;
+    }
+    
+    // Don't handle >=3 arguments for now.
+    return false;
+}
+
+template<typename ChecksFunctor>
+bool ByteCodeParser::handleIntrinsicCall(Node* callee, int resultOperand, Intrinsic intrinsic, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, const ChecksFunctor& insertChecks)
+{
+    switch (intrinsic) {
+
+    // Intrinsic Functions:
+
+    case AbsIntrinsic: {
+        if (argumentCountIncludingThis == 1) { // Math.abs()
+            insertChecks();
+            set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_constantNaN)));
+            return true;
+        }
+
+        if (!MacroAssembler::supportsFloatingPointAbs())
+            return false;
+
+        insertChecks();
+        Node* node = addToGraph(ArithAbs, get(virtualRegisterForArgument(1, registerOffset)));
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))
+            node->mergeFlags(NodeMayOverflowInt32InDFG);
+        set(VirtualRegister(resultOperand), node);
+        return true;
+    }
+
+    case MinIntrinsic:
+        return handleMinMax(resultOperand, ArithMin, registerOffset, argumentCountIncludingThis, insertChecks);
+        
+    case MaxIntrinsic:
+        return handleMinMax(resultOperand, ArithMax, registerOffset, argumentCountIncludingThis, insertChecks);
+
+    case CosIntrinsic:
+    case FRoundIntrinsic:
+    case LogIntrinsic:
+    case SinIntrinsic:
+    case SqrtIntrinsic:
+    case TanIntrinsic: {
+        if (argumentCountIncludingThis == 1) {
+            insertChecks();
+            set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_constantNaN)));
+            return true;
+        }
+
+        NodeType nodeType = Unreachable;
+        switch (intrinsic) {
+        case CosIntrinsic:
+            nodeType = ArithCos;
+            break;
+        case FRoundIntrinsic:
+            nodeType = ArithFRound;
+            break;
+        case LogIntrinsic:
+            nodeType = ArithLog;
+            break;
+        case SinIntrinsic:
+            nodeType = ArithSin;
+            break;
+        case SqrtIntrinsic:
+            nodeType = ArithSqrt;
+            break;
+        case TanIntrinsic:
+            nodeType = ArithTan;
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+        insertChecks();
+        set(VirtualRegister(resultOperand), addToGraph(nodeType, get(virtualRegisterForArgument(1, registerOffset))));
+        return true;
+    }
+
+    case PowIntrinsic: {
+        if (argumentCountIncludingThis < 3) {
+            // Math.pow() and Math.pow(x) return NaN.
+            insertChecks();
+            set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_constantNaN)));
+            return true;
+        }
+        insertChecks();
+        VirtualRegister xOperand = virtualRegisterForArgument(1, registerOffset);
+        VirtualRegister yOperand = virtualRegisterForArgument(2, registerOffset);
+        set(VirtualRegister(resultOperand), addToGraph(ArithPow, get(xOperand), get(yOperand)));
+        return true;
+    }
+        
+    case ArrayPushIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+        
+        ArrayMode arrayMode = getArrayMode(m_currentInstruction[OPCODE_LENGTH(op_call) - 2].u.arrayProfile);
+        if (!arrayMode.isJSArray())
+            return false;
+        switch (arrayMode.type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::ArrayStorage: {
+            insertChecks();
+            Node* arrayPush = addToGraph(ArrayPush, OpInfo(arrayMode.asWord()), OpInfo(prediction), get(virtualRegisterForArgument(0, registerOffset)), get(virtualRegisterForArgument(1, registerOffset)));
+            set(VirtualRegister(resultOperand), arrayPush);
+            
+            return true;
+        }
+            
+        default:
+            return false;
+        }
+    }
+
+    case ArraySliceIntrinsic: {
+#if USE(JSVALUE32_64)
+        if (isX86()) {
+            // There aren't enough registers for this to be done easily.
+            return false;
+        }
+#endif
+        if (argumentCountIncludingThis < 2)
+            return false;
+
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadConstantCache)
+            || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache))
+            return false;
+
+        ArrayMode arrayMode = getArrayMode(m_currentInstruction[OPCODE_LENGTH(op_call) - 2].u.arrayProfile);
+        if (!arrayMode.isJSArray())
+            return false;
+
+        if (arrayMode.arrayClass() != Array::OriginalArray)
+            return false;
+
+        switch (arrayMode.type()) {
+        case Array::Double:
+        case Array::Int32:
+        case Array::Contiguous: {
+            JSGlobalObject* globalObject = m_graph.globalObjectFor(currentNodeOrigin().semantic);
+
+            InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
+            InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
+
+            // FIXME: We could easily relax the Array/Object.prototype transition as long as we OSR exitted if we saw a hole.
+            if (globalObject->arraySpeciesWatchpoint().state() == IsWatched
+                && globalObject->havingABadTimeWatchpoint()->isStillValid()
+                && arrayPrototypeTransition.isStillValid()
+                && objectPrototypeTransition.isStillValid()
+                && globalObject->arrayPrototypeChainIsSane()) {
+
+                m_graph.watchpoints().addLazily(globalObject->arraySpeciesWatchpoint());
+                m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
+                m_graph.watchpoints().addLazily(arrayPrototypeTransition);
+                m_graph.watchpoints().addLazily(objectPrototypeTransition);
+
+                insertChecks();
+
+                Node* array = get(virtualRegisterForArgument(0, registerOffset));
+                // We do a few things here to prove that we aren't skipping doing side-effects in an observable way:
+                // 1. We ensure that the "constructor" property hasn't been changed (because the observable
+                // effects of slice require that we perform a Get(array, "constructor") and we can skip
+                // that if we're an original array structure. (We can relax this in the future by using
+                // TryGetById and CheckCell).
+                //
+                // 2. We check that the array we're calling slice on has the same global object as the lexical
+                // global object that this code is running in. This requirement is necessary because we setup the
+                // watchpoints above on the lexical global object. This means that code that calls slice on
+                // arrays produced by other global objects won't get this optimization. We could relax this
+                // requirement in the future by checking that the watchpoint hasn't fired at runtime in the code
+                // we generate instead of registering it as a watchpoint that would invalidate the compilation.
+                //
+                // 3. By proving we're an original array structure, we guarantee that the incoming array
+                // isn't a subclass of Array.
+
+                StructureSet structureSet;
+                structureSet.add(globalObject->originalArrayStructureForIndexingType(ArrayWithInt32));
+                structureSet.add(globalObject->originalArrayStructureForIndexingType(ArrayWithContiguous));
+                structureSet.add(globalObject->originalArrayStructureForIndexingType(ArrayWithDouble));
+                addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(structureSet)), array);
+
+                addVarArgChild(array);
+                addVarArgChild(get(virtualRegisterForArgument(1, registerOffset))); // Start index.
+                if (argumentCountIncludingThis >= 3)
+                    addVarArgChild(get(virtualRegisterForArgument(2, registerOffset))); // End index.
+                addVarArgChild(addToGraph(GetButterfly, array));
+
+                Node* arraySlice = addToGraph(Node::VarArg, ArraySlice, OpInfo(), OpInfo());
+                set(VirtualRegister(resultOperand), arraySlice);
+                return true;
+            }
+
+            return false;
+        }
+        default:
+            return false;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+        
+    case ArrayPopIntrinsic: {
+        if (argumentCountIncludingThis != 1)
+            return false;
+        
+        ArrayMode arrayMode = getArrayMode(m_currentInstruction[OPCODE_LENGTH(op_call) - 2].u.arrayProfile);
+        if (!arrayMode.isJSArray())
+            return false;
+        switch (arrayMode.type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::ArrayStorage: {
+            insertChecks();
+            Node* arrayPop = addToGraph(ArrayPop, OpInfo(arrayMode.asWord()), OpInfo(prediction), get(virtualRegisterForArgument(0, registerOffset)));
+            set(VirtualRegister(resultOperand), arrayPop);
+            return true;
+        }
+            
+        default:
+            return false;
+        }
+    }
+
+    case CharCodeAtIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+
+        insertChecks();
+        VirtualRegister thisOperand = virtualRegisterForArgument(0, registerOffset);
+        VirtualRegister indexOperand = virtualRegisterForArgument(1, registerOffset);
+        Node* charCode = addToGraph(StringCharCodeAt, OpInfo(ArrayMode(Array::String).asWord()), get(thisOperand), get(indexOperand));
+
+        set(VirtualRegister(resultOperand), charCode);
+        return true;
+    }
+
+    case CharAtIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+
+        insertChecks();
+        VirtualRegister thisOperand = virtualRegisterForArgument(0, registerOffset);
+        VirtualRegister indexOperand = virtualRegisterForArgument(1, registerOffset);
+        Node* charCode = addToGraph(StringCharAt, OpInfo(ArrayMode(Array::String).asWord()), get(thisOperand), get(indexOperand));
+
+        set(VirtualRegister(resultOperand), charCode);
+        return true;
+    }
+    case Clz32Intrinsic: {
+        insertChecks();
+        if (argumentCountIncludingThis == 1)
+            set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_graph.freeze(jsNumber(32)))));
+        else {
+            Node* operand = get(virtualRegisterForArgument(1, registerOffset));
+            set(VirtualRegister(resultOperand), addToGraph(ArithClz32, operand));
+        }
+        return true;
+    }
+    case FromCharCodeIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+
+        insertChecks();
+        VirtualRegister indexOperand = virtualRegisterForArgument(1, registerOffset);
+        Node* charCode = addToGraph(StringFromCharCode, get(indexOperand));
+
+        set(VirtualRegister(resultOperand), charCode);
+
+        return true;
+    }
+
+    case RegExpExecIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+        
+        insertChecks();
+        Node* regExpExec = addToGraph(RegExpExec, OpInfo(0), OpInfo(prediction), addToGraph(GetGlobalObject, callee), get(virtualRegisterForArgument(0, registerOffset)), get(virtualRegisterForArgument(1, registerOffset)));
+        set(VirtualRegister(resultOperand), regExpExec);
+        
+        return true;
+    }
+        
+    case RegExpTestIntrinsic:
+    case RegExpTestFastIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+
+        if (intrinsic == RegExpTestIntrinsic) {
+            // Don't inline intrinsic if we exited due to one of the primordial RegExp checks failing.
+            if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCell))
+                return false;
+
+            JSGlobalObject* globalObject = m_inlineStackTop->m_codeBlock->globalObject();
+            Structure* regExpStructure = globalObject->regExpStructure();
+            m_graph.registerStructure(regExpStructure);
+            ASSERT(regExpStructure->storedPrototype().isObject());
+            ASSERT(regExpStructure->storedPrototype().asCell()->classInfo() == RegExpPrototype::info());
+
+            FrozenValue* regExpPrototypeObjectValue = m_graph.freeze(regExpStructure->storedPrototype());
+            Structure* regExpPrototypeStructure = regExpPrototypeObjectValue->structure();
+
+            auto isRegExpPropertySame = [&] (JSValue primordialProperty, UniquedStringImpl* propertyUID) {
+                JSValue currentProperty;
+                if (!m_graph.getRegExpPrototypeProperty(regExpStructure->storedPrototypeObject(), regExpPrototypeStructure, propertyUID, currentProperty))
+                    return false;
+                
+                return currentProperty == primordialProperty;
+            };
+
+            // Check that RegExp.exec is still the primordial RegExp.prototype.exec
+            if (!isRegExpPropertySame(globalObject->regExpProtoExecFunction(), m_vm->propertyNames->exec.impl()))
+                return false;
+
+            // Check that regExpObject is actually a RegExp object.
+            Node* regExpObject = get(virtualRegisterForArgument(0, registerOffset));
+            addToGraph(Check, Edge(regExpObject, RegExpObjectUse));
+
+            // Check that regExpObject's exec is actually the primodial RegExp.prototype.exec.
+            UniquedStringImpl* execPropertyID = m_vm->propertyNames->exec.impl();
+            unsigned execIndex = m_graph.identifiers().ensure(execPropertyID);
+            Node* actualProperty = addToGraph(TryGetById, OpInfo(execIndex), OpInfo(SpecFunction), Edge(regExpObject, CellUse));
+            FrozenValue* regExpPrototypeExec = m_graph.freeze(globalObject->regExpProtoExecFunction());
+            addToGraph(CheckCell, OpInfo(regExpPrototypeExec), Edge(actualProperty, CellUse));
+        }
+
+        insertChecks();
+        Node* regExpObject = get(virtualRegisterForArgument(0, registerOffset));
+        Node* regExpExec = addToGraph(RegExpTest, OpInfo(0), OpInfo(prediction), addToGraph(GetGlobalObject, callee), regExpObject, get(virtualRegisterForArgument(1, registerOffset)));
+        set(VirtualRegister(resultOperand), regExpExec);
+        
+        return true;
+    }
+
+    case IsTypedArrayViewIntrinsic: {
+        ASSERT(argumentCountIncludingThis == 2);
+
+        insertChecks();
+        set(VirtualRegister(resultOperand), addToGraph(IsTypedArrayView, OpInfo(prediction), get(virtualRegisterForArgument(1, registerOffset))));
+        return true;
+    }
+
+    case StringPrototypeReplaceIntrinsic: {
+        if (argumentCountIncludingThis != 3)
+            return false;
+
+        // Don't inline intrinsic if we exited due to "search" not being a RegExp or String object.
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadType))
+            return false;
+
+        // Don't inline intrinsic if we exited due to one of the primordial RegExp checks failing.
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCell))
+            return false;
+
+        JSGlobalObject* globalObject = m_inlineStackTop->m_codeBlock->globalObject();
+        Structure* regExpStructure = globalObject->regExpStructure();
+        m_graph.registerStructure(regExpStructure);
+        ASSERT(regExpStructure->storedPrototype().isObject());
+        ASSERT(regExpStructure->storedPrototype().asCell()->classInfo() == RegExpPrototype::info());
+
+        FrozenValue* regExpPrototypeObjectValue = m_graph.freeze(regExpStructure->storedPrototype());
+        Structure* regExpPrototypeStructure = regExpPrototypeObjectValue->structure();
+
+        auto isRegExpPropertySame = [&] (JSValue primordialProperty, UniquedStringImpl* propertyUID) {
+            JSValue currentProperty;
+            if (!m_graph.getRegExpPrototypeProperty(regExpStructure->storedPrototypeObject(), regExpPrototypeStructure, propertyUID, currentProperty))
+                return false;
+
+            return currentProperty == primordialProperty;
+        };
+
+        // Check that searchRegExp.exec is still the primordial RegExp.prototype.exec
+        if (!isRegExpPropertySame(globalObject->regExpProtoExecFunction(), m_vm->propertyNames->exec.impl()))
+            return false;
+
+        // Check that searchRegExp.global is still the primordial RegExp.prototype.global
+        if (!isRegExpPropertySame(globalObject->regExpProtoGlobalGetter(), m_vm->propertyNames->global.impl()))
+            return false;
+
+        // Check that searchRegExp.unicode is still the primordial RegExp.prototype.unicode
+        if (!isRegExpPropertySame(globalObject->regExpProtoUnicodeGetter(), m_vm->propertyNames->unicode.impl()))
+            return false;
+
+        // Check that searchRegExp[Symbol.match] is still the primordial RegExp.prototype[Symbol.replace]
+        if (!isRegExpPropertySame(globalObject->regExpProtoSymbolReplaceFunction(), m_vm->propertyNames->replaceSymbol.impl()))
+            return false;
+
+        insertChecks();
+
+        Node* result = addToGraph(StringReplace, OpInfo(0), OpInfo(prediction), get(virtualRegisterForArgument(0, registerOffset)), get(virtualRegisterForArgument(1, registerOffset)), get(virtualRegisterForArgument(2, registerOffset)));
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+        
+    case StringPrototypeReplaceRegExpIntrinsic: {
+        if (argumentCountIncludingThis != 3)
+            return false;
+        
+        insertChecks();
+        Node* result = addToGraph(StringReplaceRegExp, OpInfo(0), OpInfo(prediction), get(virtualRegisterForArgument(0, registerOffset)), get(virtualRegisterForArgument(1, registerOffset)), get(virtualRegisterForArgument(2, registerOffset)));
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+        
+    case RoundIntrinsic:
+    case FloorIntrinsic:
+    case CeilIntrinsic:
+    case TruncIntrinsic: {
+        if (argumentCountIncludingThis == 1) {
+            insertChecks();
+            set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_constantNaN)));
+            return true;
+        }
+        insertChecks();
+        Node* operand = get(virtualRegisterForArgument(1, registerOffset));
+        NodeType op;
+        if (intrinsic == RoundIntrinsic)
+            op = ArithRound;
+        else if (intrinsic == FloorIntrinsic)
+            op = ArithFloor;
+        else if (intrinsic == CeilIntrinsic)
+            op = ArithCeil;
+        else {
+            ASSERT(intrinsic == TruncIntrinsic);
+            op = ArithTrunc;
+        }
+        Node* roundNode = addToGraph(op, OpInfo(0), OpInfo(prediction), operand);
+        set(VirtualRegister(resultOperand), roundNode);
+        return true;
+    }
+    case IMulIntrinsic: {
+        if (argumentCountIncludingThis != 3)
+            return false;
+        insertChecks();
+        VirtualRegister leftOperand = virtualRegisterForArgument(1, registerOffset);
+        VirtualRegister rightOperand = virtualRegisterForArgument(2, registerOffset);
+        Node* left = get(leftOperand);
+        Node* right = get(rightOperand);
+        set(VirtualRegister(resultOperand), addToGraph(ArithIMul, left, right));
+        return true;
+    }
+
+    case RandomIntrinsic: {
+        if (argumentCountIncludingThis != 1)
+            return false;
+        insertChecks();
+        set(VirtualRegister(resultOperand), addToGraph(ArithRandom));
+        return true;
+    }
+        
+    case DFGTrueIntrinsic: {
+        insertChecks();
+        set(VirtualRegister(resultOperand), jsConstant(jsBoolean(true)));
+        return true;
+    }
+        
+    case OSRExitIntrinsic: {
+        insertChecks();
+        addToGraph(ForceOSRExit);
+        set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_constantUndefined)));
+        return true;
+    }
+        
+    case IsFinalTierIntrinsic: {
+        insertChecks();
+        set(VirtualRegister(resultOperand),
+            jsConstant(jsBoolean(Options::useFTLJIT() ? isFTL(m_graph.m_plan.mode) : true)));
+        return true;
+    }
+        
+    case SetInt32HeapPredictionIntrinsic: {
+        insertChecks();
+        for (int i = 1; i < argumentCountIncludingThis; ++i) {
+            Node* node = get(virtualRegisterForArgument(i, registerOffset));
+            if (node->hasHeapPrediction())
+                node->setHeapPrediction(SpecInt32Only);
+        }
+        set(VirtualRegister(resultOperand), addToGraph(JSConstant, OpInfo(m_constantUndefined)));
+        return true;
+    }
+        
+    case CheckInt32Intrinsic: {
+        insertChecks();
+        for (int i = 1; i < argumentCountIncludingThis; ++i) {
+            Node* node = get(virtualRegisterForArgument(i, registerOffset));
+            addToGraph(Phantom, Edge(node, Int32Use));
+        }
+        set(VirtualRegister(resultOperand), jsConstant(jsBoolean(true)));
+        return true;
+    }
+        
+    case FiatInt52Intrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+        insertChecks();
+        VirtualRegister operand = virtualRegisterForArgument(1, registerOffset);
+        if (enableInt52())
+            set(VirtualRegister(resultOperand), addToGraph(FiatInt52, get(operand)));
+        else
+            set(VirtualRegister(resultOperand), get(operand));
+        return true;
+    }
+
+    case JSMapGetIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+
+        insertChecks();
+        Node* map = get(virtualRegisterForArgument(0, registerOffset));
+        Node* key = get(virtualRegisterForArgument(1, registerOffset));
+        Node* hash = addToGraph(MapHash, key);
+        Node* bucket = addToGraph(GetMapBucket, Edge(map, MapObjectUse), Edge(key), Edge(hash));
+        Node* result = addToGraph(LoadFromJSMapBucket, OpInfo(), OpInfo(prediction), bucket);
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+
+    case JSSetHasIntrinsic:
+    case JSMapHasIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+
+        insertChecks();
+        Node* mapOrSet = get(virtualRegisterForArgument(0, registerOffset));
+        Node* key = get(virtualRegisterForArgument(1, registerOffset));
+        Node* hash = addToGraph(MapHash, key);
+        UseKind useKind = intrinsic == JSSetHasIntrinsic ? SetObjectUse : MapObjectUse;
+        Node* bucket = addToGraph(GetMapBucket, OpInfo(0), Edge(mapOrSet, useKind), Edge(key), Edge(hash));
+        Node* result = addToGraph(IsNonEmptyMapBucket, bucket);
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+
+    case HasOwnPropertyIntrinsic: {
+        if (argumentCountIncludingThis != 2)
+            return false;
+
+        // This can be racy, that's fine. We know that once we observe that this is created,
+        // that it will never be destroyed until the VM is destroyed. It's unlikely that
+        // we'd ever get to the point where we inline this as an intrinsic without the
+        // cache being created, however, it's possible if we always throw exceptions inside
+        // hasOwnProperty.
+        if (!m_vm->hasOwnPropertyCache())
+            return false;
+
+        insertChecks();
+        Node* object = get(virtualRegisterForArgument(0, registerOffset));
+        Node* key = get(virtualRegisterForArgument(1, registerOffset));
+        Node* result = addToGraph(HasOwnProperty, object, key);
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+
+    case ToLowerCaseIntrinsic: {
+        if (argumentCountIncludingThis != 1)
+            return false;
+
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadType))
+            return false;
+
+        insertChecks();
+        Node* thisString = get(virtualRegisterForArgument(0, registerOffset));
+        Node* result = addToGraph(ToLowerCase, thisString);
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+
+    default:
+        return false;
+    }
+}
+
+template<typename ChecksFunctor>
+bool ByteCodeParser::handleDOMJITCall(Node* callTarget, int resultOperand, const DOMJIT::Signature* signature, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, const ChecksFunctor& insertChecks)
+{
+    if (argumentCountIncludingThis != static_cast<int>(1 + signature->argumentCount))
+        return false;
+    if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadType))
+        return false;
+
+    // FIXME: Currently, we only support functions which arguments are up to 2.
+    // Eventually, we should extend this. But possibly, 2 or 3 can cover typical use cases.
+    // https://bugs.webkit.org/show_bug.cgi?id=164346
+    ASSERT_WITH_MESSAGE(argumentCountIncludingThis <= JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS_INCLUDING_THIS, "Currently CallDOM does not support an arbitrary length arguments.");
+
+    insertChecks();
+    addCall(resultOperand, Call, signature, callTarget, argumentCountIncludingThis, registerOffset, prediction);
+    return true;
+}
+
+
+template<typename ChecksFunctor>
+bool ByteCodeParser::handleIntrinsicGetter(int resultOperand, const GetByIdVariant& variant, Node* thisNode, const ChecksFunctor& insertChecks)
+{
+    switch (variant.intrinsic()) {
+    case TypedArrayByteLengthIntrinsic: {
+        insertChecks();
+
+        TypedArrayType type = (*variant.structureSet().begin())->classInfo()->typedArrayStorageType;
+        Array::Type arrayType = toArrayType(type);
+        size_t logSize = logElementSize(type);
+
+        variant.structureSet().forEach([&] (Structure* structure) {
+            TypedArrayType curType = structure->classInfo()->typedArrayStorageType;
+            ASSERT(logSize == logElementSize(curType));
+            arrayType = refineTypedArrayType(arrayType, curType);
+            ASSERT(arrayType != Array::Generic);
+        });
+
+        Node* lengthNode = addToGraph(GetArrayLength, OpInfo(ArrayMode(arrayType).asWord()), thisNode);
+
+        if (!logSize) {
+            set(VirtualRegister(resultOperand), lengthNode);
+            return true;
+        }
+
+        // We can use a BitLShift here because typed arrays will never have a byteLength
+        // that overflows int32.
+        Node* shiftNode = jsConstant(jsNumber(logSize));
+        set(VirtualRegister(resultOperand), addToGraph(BitLShift, lengthNode, shiftNode));
+
+        return true;
+    }
+
+    case TypedArrayLengthIntrinsic: {
+        insertChecks();
+
+        TypedArrayType type = (*variant.structureSet().begin())->classInfo()->typedArrayStorageType;
+        Array::Type arrayType = toArrayType(type);
+
+        variant.structureSet().forEach([&] (Structure* structure) {
+            TypedArrayType curType = structure->classInfo()->typedArrayStorageType;
+            arrayType = refineTypedArrayType(arrayType, curType);
+            ASSERT(arrayType != Array::Generic);
+        });
+
+        set(VirtualRegister(resultOperand), addToGraph(GetArrayLength, OpInfo(ArrayMode(arrayType).asWord()), thisNode));
+
+        return true;
+
+    }
+
+    case TypedArrayByteOffsetIntrinsic: {
+        insertChecks();
+
+        TypedArrayType type = (*variant.structureSet().begin())->classInfo()->typedArrayStorageType;
+        Array::Type arrayType = toArrayType(type);
+
+        variant.structureSet().forEach([&] (Structure* structure) {
+            TypedArrayType curType = structure->classInfo()->typedArrayStorageType;
+            arrayType = refineTypedArrayType(arrayType, curType);
+            ASSERT(arrayType != Array::Generic);
+        });
+
+        set(VirtualRegister(resultOperand), addToGraph(GetTypedArrayByteOffset, OpInfo(ArrayMode(arrayType).asWord()), thisNode));
+
+        return true;
+    }
+
+    default:
+        return false;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+static void blessCallDOMGetter(Node* node)
+{
+    DOMJIT::CallDOMGetterPatchpoint* patchpoint = node->callDOMGetterData()->patchpoint;
+    if (!patchpoint->effect.mustGenerate())
+        node->clearFlags(NodeMustGenerate);
+}
+
+bool ByteCodeParser::handleDOMJITGetter(int resultOperand, const GetByIdVariant& variant, Node* thisNode, unsigned identifierNumber, SpeculatedType prediction)
+{
+    if (!variant.domJIT())
+        return false;
+
+    DOMJIT::GetterSetter* domJIT = variant.domJIT();
+
+    // We do not need to actually look up CustomGetterSetter here. Checking Structures or registering watchpoints are enough,
+    // since replacement of CustomGetterSetter always incurs Structure transition.
+    if (!check(variant.conditionSet()))
+        return false;
+    addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.structureSet())), thisNode);
+
+    Ref<DOMJIT::Patchpoint> checkDOMPatchpoint = domJIT->checkDOM();
+    m_graph.m_domJITPatchpoints.append(checkDOMPatchpoint.ptr());
+    // We do not need to emit CheckCell thingy here. When the custom accessor is replaced to different one, Structure transition occurs.
+    addToGraph(CheckDOM, OpInfo(checkDOMPatchpoint.ptr()), OpInfo(domJIT->thisClassInfo()), thisNode);
+
+    CallDOMGetterData* callDOMGetterData = m_graph.m_callDOMGetterData.add();
+    Ref<DOMJIT::CallDOMGetterPatchpoint> callDOMGetterPatchpoint = domJIT->callDOMGetter();
+    m_graph.m_domJITPatchpoints.append(callDOMGetterPatchpoint.ptr());
+
+    callDOMGetterData->domJIT = domJIT;
+    callDOMGetterData->patchpoint = callDOMGetterPatchpoint.ptr();
+    callDOMGetterData->identifierNumber = identifierNumber;
+
+    Node* callDOMGetterNode = nullptr;
+    // GlobalObject of thisNode is always used to create a DOMWrapper.
+    if (callDOMGetterPatchpoint->requireGlobalObject) {
+        Node* globalObject = addToGraph(GetGlobalObject, thisNode);
+        callDOMGetterNode = addToGraph(CallDOMGetter, OpInfo(callDOMGetterData), OpInfo(prediction), thisNode, globalObject);
+    } else
+        callDOMGetterNode = addToGraph(CallDOMGetter, OpInfo(callDOMGetterData), OpInfo(prediction), thisNode);
+    blessCallDOMGetter(callDOMGetterNode);
+    set(VirtualRegister(resultOperand), callDOMGetterNode);
+    return true;
+}
+
+template<typename ChecksFunctor>
+bool ByteCodeParser::handleTypedArrayConstructor(
+    int resultOperand, InternalFunction* function, int registerOffset,
+    int argumentCountIncludingThis, TypedArrayType type, const ChecksFunctor& insertChecks)
+{
+    if (!isTypedView(type))
+        return false;
+    
+    if (function->classInfo() != constructorClassInfoForType(type))
+        return false;
+    
+    if (function->globalObject() != m_inlineStackTop->m_codeBlock->globalObject())
+        return false;
+    
+    // We only have an intrinsic for the case where you say:
+    //
+    // new FooArray(blah);
+    //
+    // Of course, 'blah' could be any of the following:
+    //
+    // - Integer, indicating that you want to allocate an array of that length.
+    //   This is the thing we're hoping for, and what we can actually do meaningful
+    //   optimizations for.
+    //
+    // - Array buffer, indicating that you want to create a view onto that _entire_
+    //   buffer.
+    //
+    // - Non-buffer object, indicating that you want to create a copy of that
+    //   object by pretending that it quacks like an array.
+    //
+    // - Anything else, indicating that you want to have an exception thrown at
+    //   you.
+    //
+    // The intrinsic, NewTypedArray, will behave as if it could do any of these
+    // things up until we do Fixup. Thereafter, if child1 (i.e. 'blah') is
+    // predicted Int32, then we lock it in as a normal typed array allocation.
+    // Otherwise, NewTypedArray turns into a totally opaque function call that
+    // may clobber the world - by virtue of it accessing properties on what could
+    // be an object.
+    //
+    // Note that although the generic form of NewTypedArray sounds sort of awful,
+    // it is actually quite likely to be more efficient than a fully generic
+    // Construct. So, we might want to think about making NewTypedArray variadic,
+    // or else making Construct not super slow.
+    
+    if (argumentCountIncludingThis != 2)
+        return false;
+    
+    if (!function->globalObject()->typedArrayStructureConcurrently(type))
+        return false;
+
+    insertChecks();
+    set(VirtualRegister(resultOperand),
+        addToGraph(NewTypedArray, OpInfo(type), get(virtualRegisterForArgument(1, registerOffset))));
+    return true;
+}
+
+template<typename ChecksFunctor>
+bool ByteCodeParser::handleConstantInternalFunction(
+    Node* callTargetNode, int resultOperand, InternalFunction* function, int registerOffset,
+    int argumentCountIncludingThis, CodeSpecializationKind kind, SpeculatedType prediction, const ChecksFunctor& insertChecks)
+{
+    if (verbose)
+        dataLog("    Handling constant internal function ", JSValue(function), "\n");
+
+    if (kind == CodeForConstruct) {
+        Node* newTargetNode = get(virtualRegisterForArgument(0, registerOffset));
+        // We cannot handle the case where new.target != callee (i.e. a construct from a super call) because we
+        // don't know what the prototype of the constructed object will be.
+        // FIXME: If we have inlined super calls up to the call site, however, we should be able to figure out the structure. https://bugs.webkit.org/show_bug.cgi?id=152700
+        if (newTargetNode != callTargetNode)
+            return false;
+    }
+
+    if (function->classInfo() == ArrayConstructor::info()) {
+        if (function->globalObject() != m_inlineStackTop->m_codeBlock->globalObject())
+            return false;
+        
+        insertChecks();
+        if (argumentCountIncludingThis == 2) {
+            set(VirtualRegister(resultOperand),
+                addToGraph(NewArrayWithSize, OpInfo(ArrayWithUndecided), get(virtualRegisterForArgument(1, registerOffset))));
+            return true;
+        }
+        
+        for (int i = 1; i < argumentCountIncludingThis; ++i)
+            addVarArgChild(get(virtualRegisterForArgument(i, registerOffset)));
+        set(VirtualRegister(resultOperand),
+            addToGraph(Node::VarArg, NewArray, OpInfo(ArrayWithUndecided), OpInfo(0)));
+        return true;
+    }
+
+    if (function->classInfo() == NumberConstructor::info()) {
+        if (kind == CodeForConstruct)
+            return false;
+
+        insertChecks();
+        if (argumentCountIncludingThis <= 1)
+            set(VirtualRegister(resultOperand), jsConstant(jsNumber(0)));
+        else
+            set(VirtualRegister(resultOperand), addToGraph(ToNumber, OpInfo(0), OpInfo(prediction), get(virtualRegisterForArgument(1, registerOffset))));
+
+        return true;
+    }
+    
+    if (function->classInfo() == StringConstructor::info()) {
+        insertChecks();
+        
+        Node* result;
+        
+        if (argumentCountIncludingThis <= 1)
+            result = jsConstant(m_vm->smallStrings.emptyString());
+        else
+            result = addToGraph(CallStringConstructor, get(virtualRegisterForArgument(1, registerOffset)));
+        
+        if (kind == CodeForConstruct)
+            result = addToGraph(NewStringObject, OpInfo(m_graph.registerStructure(function->globalObject()->stringObjectStructure())), result);
+        
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+
+    // FIXME: This should handle construction as well. https://bugs.webkit.org/show_bug.cgi?id=155591
+    if (function->classInfo() == ObjectConstructor::info() && kind == CodeForCall) {
+        insertChecks();
+
+        Node* result;
+        if (argumentCountIncludingThis <= 1)
+            result = addToGraph(NewObject, OpInfo(m_graph.registerStructure(function->globalObject()->objectStructureForObjectConstructor())));
+        else
+            result = addToGraph(CallObjectConstructor, get(virtualRegisterForArgument(1, registerOffset)));
+        set(VirtualRegister(resultOperand), result);
+        return true;
+    }
+
+    for (unsigned typeIndex = 0; typeIndex < NUMBER_OF_TYPED_ARRAY_TYPES; ++typeIndex) {
+        bool result = handleTypedArrayConstructor(
+            resultOperand, function, registerOffset, argumentCountIncludingThis,
+            indexToTypedArrayType(typeIndex), insertChecks);
+        if (result)
+            return true;
+    }
+    
+    return false;
+}
+
+Node* ByteCodeParser::handleGetByOffset(
+    SpeculatedType prediction, Node* base, unsigned identifierNumber, PropertyOffset offset,
+    const InferredType::Descriptor& inferredType, NodeType op)
+{
+    Node* propertyStorage;
+    if (isInlineOffset(offset))
+        propertyStorage = base;
+    else
+        propertyStorage = addToGraph(GetButterfly, base);
+    
+    StorageAccessData* data = m_graph.m_storageAccessData.add();
+    data->offset = offset;
+    data->identifierNumber = identifierNumber;
+    data->inferredType = inferredType;
+    m_graph.registerInferredType(inferredType);
+    
+    Node* getByOffset = addToGraph(op, OpInfo(data), OpInfo(prediction), propertyStorage, base);
+
+    return getByOffset;
+}
+
+Node* ByteCodeParser::handlePutByOffset(
+    Node* base, unsigned identifier, PropertyOffset offset, const InferredType::Descriptor& inferredType,
+    Node* value)
+{
+    Node* propertyStorage;
+    if (isInlineOffset(offset))
+        propertyStorage = base;
+    else
+        propertyStorage = addToGraph(GetButterfly, base);
+    
+    StorageAccessData* data = m_graph.m_storageAccessData.add();
+    data->offset = offset;
+    data->identifierNumber = identifier;
+    data->inferredType = inferredType;
+    m_graph.registerInferredType(inferredType);
+    
+    Node* result = addToGraph(PutByOffset, OpInfo(data), propertyStorage, base, value);
+    
+    return result;
+}
+
+bool ByteCodeParser::check(const ObjectPropertyCondition& condition)
+{
+    if (!condition)
+        return false;
+    
+    if (m_graph.watchCondition(condition))
+        return true;
+    
+    Structure* structure = condition.object()->structure();
+    if (!condition.structureEnsuresValidity(structure))
+        return false;
+    
+    addToGraph(
+        CheckStructure,
+        OpInfo(m_graph.addStructureSet(structure)),
+        weakJSConstant(condition.object()));
+    return true;
+}
+
+GetByOffsetMethod ByteCodeParser::promoteToConstant(GetByOffsetMethod method)
+{
+    if (method.kind() == GetByOffsetMethod::LoadFromPrototype
+        && method.prototype()->structure()->dfgShouldWatch()) {
+        if (JSValue constant = m_graph.tryGetConstantProperty(method.prototype()->value(), method.prototype()->structure(), method.offset()))
+            return GetByOffsetMethod::constant(m_graph.freeze(constant));
+    }
+    
+    return method;
+}
+
+bool ByteCodeParser::needsDynamicLookup(ResolveType type, OpcodeID opcode)
+{
+    ASSERT(opcode == op_resolve_scope || opcode == op_get_from_scope || opcode == op_put_to_scope);
+
+    JSGlobalObject* globalObject = m_inlineStackTop->m_codeBlock->globalObject();
+    if (needsVarInjectionChecks(type) && globalObject->varInjectionWatchpoint()->hasBeenInvalidated())
+        return true;
+
+    switch (type) {
+    case GlobalProperty:
+    case GlobalVar:
+    case GlobalLexicalVar:
+    case ClosureVar:
+    case LocalClosureVar:
+    case ModuleVar:
+        return false;
+
+    case UnresolvedProperty:
+    case UnresolvedPropertyWithVarInjectionChecks: {
+        // The heuristic for UnresolvedProperty scope accesses is we will ForceOSRExit if we
+        // haven't exited from from this access before to let the baseline JIT try to better
+        // cache the access. If we've already exited from this operation, it's unlikely that
+        // the baseline will come up with a better ResolveType and instead we will compile
+        // this as a dynamic scope access.
+
+        // We only track our heuristic through resolve_scope since resolve_scope will
+        // dominate unresolved gets/puts on that scope.
+        if (opcode != op_resolve_scope)
+            return true;
+
+        if (m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, InadequateCoverage)) {
+            // We've already exited so give up on getting better ResolveType information.
+            return true;
+        }
+
+        // We have not exited yet, so let's have the baseline get better ResolveType information for us.
+        // This type of code is often seen when we tier up in a loop but haven't executed the part
+        // of a function that comes after the loop.
+        return false;
+    }
+
+    case Dynamic:
+        return true;
+
+    case GlobalPropertyWithVarInjectionChecks:
+    case GlobalVarWithVarInjectionChecks:
+    case GlobalLexicalVarWithVarInjectionChecks:
+    case ClosureVarWithVarInjectionChecks:
+        return false;
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+GetByOffsetMethod ByteCodeParser::planLoad(const ObjectPropertyCondition& condition)
+{
+    if (verbose)
+        dataLog("Planning a load: ", condition, "\n");
+    
+    // We might promote this to Equivalence, and a later DFG pass might also do such promotion
+    // even if we fail, but for simplicity this cannot be asked to load an equivalence condition.
+    // None of the clients of this method will request a load of an Equivalence condition anyway,
+    // and supporting it would complicate the heuristics below.
+    RELEASE_ASSERT(condition.kind() == PropertyCondition::Presence);
+    
+    // Here's the ranking of how to handle this, from most preferred to least preferred:
+    //
+    // 1) Watchpoint on an equivalence condition and return a constant node for the loaded value.
+    //    No other code is emitted, and the structure of the base object is never registered.
+    //    Hence this results in zero code and we won't jettison this compilation if the object
+    //    transitions, even if the structure is watchable right now.
+    //
+    // 2) Need to emit a load, and the current structure of the base is going to be watched by the
+    //    DFG anyway (i.e. dfgShouldWatch). Watch the structure and emit the load. Don't watch the
+    //    condition, since the act of turning the base into a constant in IR will cause the DFG to
+    //    watch the structure anyway and doing so would subsume watching the condition.
+    //
+    // 3) Need to emit a load, and the current structure of the base is watchable but not by the
+    //    DFG (i.e. transitionWatchpointSetIsStillValid() and !dfgShouldWatchIfPossible()). Watch
+    //    the condition, and emit a load.
+    //
+    // 4) Need to emit a load, and the current structure of the base is not watchable. Emit a
+    //    structure check, and emit a load.
+    //
+    // 5) The condition does not hold. Give up and return null.
+    
+    // First, try to promote Presence to Equivalence. We do this before doing anything else
+    // because it's the most profitable. Also, there are cases where the presence is watchable but
+    // we don't want to watch it unless it became an equivalence (see the relationship between
+    // (1), (2), and (3) above).
+    ObjectPropertyCondition equivalenceCondition = condition.attemptToMakeEquivalenceWithoutBarrier();
+    if (m_graph.watchCondition(equivalenceCondition))
+        return GetByOffsetMethod::constant(m_graph.freeze(equivalenceCondition.requiredValue()));
+    
+    // At this point, we'll have to materialize the condition's base as a constant in DFG IR. Once
+    // we do this, the frozen value will have its own idea of what the structure is. Use that from
+    // now on just because it's less confusing.
+    FrozenValue* base = m_graph.freeze(condition.object());
+    Structure* structure = base->structure();
+    
+    // Check if the structure that we've registered makes the condition hold. If not, just give
+    // up. This is case (5) above.
+    if (!condition.structureEnsuresValidity(structure))
+        return GetByOffsetMethod();
+    
+    // If the structure is watched by the DFG already, then just use this fact to emit the load.
+    // This is case (2) above.
+    if (structure->dfgShouldWatch())
+        return promoteToConstant(GetByOffsetMethod::loadFromPrototype(base, condition.offset()));
+    
+    // If we can watch the condition right now, then we can emit the load after watching it. This
+    // is case (3) above.
+    if (m_graph.watchCondition(condition))
+        return promoteToConstant(GetByOffsetMethod::loadFromPrototype(base, condition.offset()));
+    
+    // We can't watch anything but we know that the current structure satisfies the condition. So,
+    // check for that structure and then emit the load.
+    addToGraph(
+        CheckStructure, 
+        OpInfo(m_graph.addStructureSet(structure)),
+        addToGraph(JSConstant, OpInfo(base)));
+    return promoteToConstant(GetByOffsetMethod::loadFromPrototype(base, condition.offset()));
+}
+
+Node* ByteCodeParser::load(
+    SpeculatedType prediction, unsigned identifierNumber, const GetByOffsetMethod& method,
+    NodeType op)
+{
+    switch (method.kind()) {
+    case GetByOffsetMethod::Invalid:
+        return nullptr;
+    case GetByOffsetMethod::Constant:
+        return addToGraph(JSConstant, OpInfo(method.constant()));
+    case GetByOffsetMethod::LoadFromPrototype: {
+        Node* baseNode = addToGraph(JSConstant, OpInfo(method.prototype()));
+        return handleGetByOffset(
+            prediction, baseNode, identifierNumber, method.offset(), InferredType::Top, op);
+    }
+    case GetByOffsetMethod::Load:
+        // Will never see this from planLoad().
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+Node* ByteCodeParser::load(
+    SpeculatedType prediction, const ObjectPropertyCondition& condition, NodeType op)
+{
+    GetByOffsetMethod method = planLoad(condition);
+    return load(prediction, m_graph.identifiers().ensure(condition.uid()), method, op);
+}
+
+bool ByteCodeParser::check(const ObjectPropertyConditionSet& conditionSet)
+{
+    for (const ObjectPropertyCondition condition : conditionSet) {
+        if (!check(condition))
+            return false;
+    }
+    return true;
+}
+
+GetByOffsetMethod ByteCodeParser::planLoad(const ObjectPropertyConditionSet& conditionSet)
+{
+    if (verbose)
+        dataLog("conditionSet = ", conditionSet, "\n");
+    
+    GetByOffsetMethod result;
+    for (const ObjectPropertyCondition condition : conditionSet) {
+        switch (condition.kind()) {
+        case PropertyCondition::Presence:
+            RELEASE_ASSERT(!result); // Should only see exactly one of these.
+            result = planLoad(condition);
+            if (!result)
+                return GetByOffsetMethod();
+            break;
+        default:
+            if (!check(condition))
+                return GetByOffsetMethod();
+            break;
+        }
+    }
+    if (!result) {
+        // We have a unset property.
+        ASSERT(!conditionSet.numberOfConditionsWithKind(PropertyCondition::Presence));
+        return GetByOffsetMethod::constant(m_constantUndefined);
+    }
+    return result;
+}
+
+Node* ByteCodeParser::load(
+    SpeculatedType prediction, const ObjectPropertyConditionSet& conditionSet, NodeType op)
+{
+    GetByOffsetMethod method = planLoad(conditionSet);
+    return load(
+        prediction,
+        m_graph.identifiers().ensure(conditionSet.slotBaseCondition().uid()),
+        method, op);
+}
+
+ObjectPropertyCondition ByteCodeParser::presenceLike(
+    JSObject* knownBase, UniquedStringImpl* uid, PropertyOffset offset, const StructureSet& set)
+{
+    if (set.isEmpty())
+        return ObjectPropertyCondition();
+    unsigned attributes;
+    PropertyOffset firstOffset = set[0]->getConcurrently(uid, attributes);
+    if (firstOffset != offset)
+        return ObjectPropertyCondition();
+    for (unsigned i = 1; i < set.size(); ++i) {
+        unsigned otherAttributes;
+        PropertyOffset otherOffset = set[i]->getConcurrently(uid, otherAttributes);
+        if (otherOffset != offset || otherAttributes != attributes)
+            return ObjectPropertyCondition();
+    }
+    return ObjectPropertyCondition::presenceWithoutBarrier(knownBase, uid, offset, attributes);
+}
+
+bool ByteCodeParser::checkPresenceLike(
+    JSObject* knownBase, UniquedStringImpl* uid, PropertyOffset offset, const StructureSet& set)
+{
+    return check(presenceLike(knownBase, uid, offset, set));
+}
+
+void ByteCodeParser::checkPresenceLike(
+    Node* base, UniquedStringImpl* uid, PropertyOffset offset, const StructureSet& set)
+{
+    if (JSObject* knownBase = base->dynamicCastConstant<JSObject*>()) {
+        if (checkPresenceLike(knownBase, uid, offset, set))
+            return;
+    }
+
+    addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(set)), base);
+}
+
+template<typename VariantType>
+Node* ByteCodeParser::load(
+    SpeculatedType prediction, Node* base, unsigned identifierNumber, const VariantType& variant)
+{
+    // Make sure backwards propagation knows that we've used base.
+    addToGraph(Phantom, base);
+    
+    bool needStructureCheck = true;
+    
+    UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
+    
+    if (JSObject* knownBase = base->dynamicCastConstant<JSObject*>()) {
+        // Try to optimize away the structure check. Note that it's not worth doing anything about this
+        // if the base's structure is watched.
+        Structure* structure = base->constant()->structure();
+        if (!structure->dfgShouldWatch()) {
+            if (!variant.conditionSet().isEmpty()) {
+                // This means that we're loading from a prototype or we have a property miss. We expect
+                // the base not to have the property. We can only use ObjectPropertyCondition if all of
+                // the structures in the variant.structureSet() agree on the prototype (it would be
+                // hilariously rare if they didn't). Note that we are relying on structureSet() having
+                // at least one element. That will always be true here because of how GetByIdStatus/PutByIdStatus work.
+                JSObject* prototype = variant.structureSet()[0]->storedPrototypeObject();
+                bool allAgree = true;
+                for (unsigned i = 1; i < variant.structureSet().size(); ++i) {
+                    if (variant.structureSet()[i]->storedPrototypeObject() != prototype) {
+                        allAgree = false;
+                        break;
+                    }
+                }
+                if (allAgree) {
+                    ObjectPropertyCondition condition = ObjectPropertyCondition::absenceWithoutBarrier(
+                        knownBase, uid, prototype);
+                    if (check(condition))
+                        needStructureCheck = false;
+                }
+            } else {
+                // This means we're loading directly from base. We can avoid all of the code that follows
+                // if we can prove that the property is a constant. Otherwise, we try to prove that the
+                // property is watchably present, in which case we get rid of the structure check.
+
+                ObjectPropertyCondition presenceCondition =
+                    presenceLike(knownBase, uid, variant.offset(), variant.structureSet());
+                if (presenceCondition) {
+                    ObjectPropertyCondition equivalenceCondition =
+                        presenceCondition.attemptToMakeEquivalenceWithoutBarrier();
+                    if (m_graph.watchCondition(equivalenceCondition))
+                        return weakJSConstant(equivalenceCondition.requiredValue());
+                    
+                    if (check(presenceCondition))
+                        needStructureCheck = false;
+                }
+            }
+        }
+    }
+
+    if (needStructureCheck)
+        addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.structureSet())), base);
+
+    if (variant.isPropertyUnset()) {
+        if (m_graph.watchConditions(variant.conditionSet()))
+            return jsConstant(jsUndefined());
+        return nullptr;
+    }
+
+    SpeculatedType loadPrediction;
+    NodeType loadOp;
+    if (variant.callLinkStatus() || variant.intrinsic() != NoIntrinsic) {
+        loadPrediction = SpecCellOther;
+        loadOp = GetGetterSetterByOffset;
+    } else {
+        loadPrediction = prediction;
+        loadOp = GetByOffset;
+    }
+    
+    Node* loadedValue;
+    if (!variant.conditionSet().isEmpty())
+        loadedValue = load(loadPrediction, variant.conditionSet(), loadOp);
+    else {
+        if (needStructureCheck && base->hasConstant()) {
+            // We did emit a structure check. That means that we have an opportunity to do constant folding
+            // here, since we didn't do it above.
+            JSValue constant = m_graph.tryGetConstantProperty(
+                base->asJSValue(), *m_graph.addStructureSet(variant.structureSet()), variant.offset());
+            if (constant)
+                return weakJSConstant(constant);
+        }
+
+        InferredType::Descriptor inferredType;
+        if (needStructureCheck) {
+            for (Structure* structure : variant.structureSet()) {
+                InferredType::Descriptor thisType = m_graph.inferredTypeForProperty(structure, uid);
+                inferredType.merge(thisType);
+            }
+        } else
+            inferredType = InferredType::Top;
+        
+        loadedValue = handleGetByOffset(
+            loadPrediction, base, identifierNumber, variant.offset(), inferredType, loadOp);
+    }
+
+    return loadedValue;
+}
+
+Node* ByteCodeParser::store(Node* base, unsigned identifier, const PutByIdVariant& variant, Node* value)
+{
+    RELEASE_ASSERT(variant.kind() == PutByIdVariant::Replace);
+
+    checkPresenceLike(base, m_graph.identifiers()[identifier], variant.offset(), variant.structure());
+    return handlePutByOffset(base, identifier, variant.offset(), variant.requiredType(), value);
+}
+
+void ByteCodeParser::handleGetById(
+    int destinationOperand, SpeculatedType prediction, Node* base, unsigned identifierNumber,
+    GetByIdStatus getByIdStatus, AccessType type, unsigned instructionSize)
+{
+    // Attempt to reduce the set of things in the GetByIdStatus.
+    if (base->op() == NewObject) {
+        bool ok = true;
+        for (unsigned i = m_currentBlock->size(); i--;) {
+            Node* node = m_currentBlock->at(i);
+            if (node == base)
+                break;
+            if (writesOverlap(m_graph, node, JSCell_structureID)) {
+                ok = false;
+                break;
+            }
+        }
+        if (ok)
+            getByIdStatus.filter(base->structure().get());
+    }
+    
+    NodeType getById;
+    if (type == AccessType::Get)
+        getById = getByIdStatus.makesCalls() ? GetByIdFlush : GetById;
+    else
+        getById = TryGetById;
+
+    // Special path for custom accessors since custom's offset does not have any meanings.
+    // So, this is completely different from Simple one. But we have a chance to optimize it when we use DOMJIT.
+    if (Options::useDOMJIT() && getByIdStatus.isCustom()) {
+        ASSERT(getByIdStatus.numVariants() == 1);
+        ASSERT(!getByIdStatus.makesCalls());
+        GetByIdVariant variant = getByIdStatus[0];
+        ASSERT(variant.domJIT());
+        if (handleDOMJITGetter(destinationOperand, variant, base, identifierNumber, prediction)) {
+            if (m_graph.compilation())
+                m_graph.compilation()->noticeInlinedGetById();
+            return;
+        }
+    }
+
+    ASSERT(type == AccessType::Get || !getByIdStatus.makesCalls());
+    if (!getByIdStatus.isSimple() || !getByIdStatus.numVariants() || !Options::useAccessInlining()) {
+        set(VirtualRegister(destinationOperand),
+            addToGraph(getById, OpInfo(identifierNumber), OpInfo(prediction), base));
+        return;
+    }
+    
+    if (getByIdStatus.numVariants() > 1) {
+        if (getByIdStatus.makesCalls() || !isFTL(m_graph.m_plan.mode)
+            || !Options::usePolymorphicAccessInlining()) {
+            set(VirtualRegister(destinationOperand),
+                addToGraph(getById, OpInfo(identifierNumber), OpInfo(prediction), base));
+            return;
+        }
+        
+        Vector<MultiGetByOffsetCase, 2> cases;
+        
+        // 1) Emit prototype structure checks for all chains. This could sort of maybe not be
+        //    optimal, if there is some rarely executed case in the chain that requires a lot
+        //    of checks and those checks are not watchpointable.
+        for (const GetByIdVariant& variant : getByIdStatus.variants()) {
+            if (variant.intrinsic() != NoIntrinsic) {
+                set(VirtualRegister(destinationOperand),
+                    addToGraph(getById, OpInfo(identifierNumber), OpInfo(prediction), base));
+                return;
+            }
+
+            if (variant.conditionSet().isEmpty()) {
+                cases.append(
+                    MultiGetByOffsetCase(
+                        *m_graph.addStructureSet(variant.structureSet()),
+                        GetByOffsetMethod::load(variant.offset())));
+                continue;
+            }
+
+            GetByOffsetMethod method = planLoad(variant.conditionSet());
+            if (!method) {
+                set(VirtualRegister(destinationOperand),
+                    addToGraph(getById, OpInfo(identifierNumber), OpInfo(prediction), base));
+                return;
+            }
+            
+            cases.append(MultiGetByOffsetCase(*m_graph.addStructureSet(variant.structureSet()), method));
+        }
+
+        if (m_graph.compilation())
+            m_graph.compilation()->noticeInlinedGetById();
+    
+        // 2) Emit a MultiGetByOffset
+        MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();
+        data->cases = cases;
+        data->identifierNumber = identifierNumber;
+        set(VirtualRegister(destinationOperand),
+            addToGraph(MultiGetByOffset, OpInfo(data), OpInfo(prediction), base));
+        return;
+    }
+    
+    ASSERT(getByIdStatus.numVariants() == 1);
+    GetByIdVariant variant = getByIdStatus[0];
+                
+    Node* loadedValue = load(prediction, base, identifierNumber, variant);
+    if (!loadedValue) {
+        set(VirtualRegister(destinationOperand),
+            addToGraph(getById, OpInfo(identifierNumber), OpInfo(prediction), base));
+        return;
+    }
+
+    if (m_graph.compilation())
+        m_graph.compilation()->noticeInlinedGetById();
+
+    ASSERT(type == AccessType::Get || !variant.callLinkStatus());
+    if (!variant.callLinkStatus() && variant.intrinsic() == NoIntrinsic) {
+        set(VirtualRegister(destinationOperand), loadedValue);
+        return;
+    }
+    
+    Node* getter = addToGraph(GetGetter, loadedValue);
+
+    if (handleIntrinsicGetter(destinationOperand, variant, base,
+            [&] () {
+                addToGraph(CheckCell, OpInfo(m_graph.freeze(variant.intrinsicFunction())), getter, base);
+            })) {
+        addToGraph(Phantom, getter);
+        return;
+    }
+
+    ASSERT(variant.intrinsic() == NoIntrinsic);
+
+    // Make a call. We don't try to get fancy with using the smallest operand number because
+    // the stack layout phase should compress the stack anyway.
+    
+    unsigned numberOfParameters = 0;
+    numberOfParameters++; // The 'this' argument.
+    numberOfParameters++; // True return PC.
+    
+    // Start with a register offset that corresponds to the last in-use register.
+    int registerOffset = virtualRegisterForLocal(
+        m_inlineStackTop->m_profiledBlock->m_numCalleeLocals - 1).offset();
+    registerOffset -= numberOfParameters;
+    registerOffset -= CallFrame::headerSizeInRegisters;
+    
+    // Get the alignment right.
+    registerOffset = -WTF::roundUpToMultipleOf(
+        stackAlignmentRegisters(),
+        -registerOffset);
+    
+    ensureLocals(
+        m_inlineStackTop->remapOperand(
+            VirtualRegister(registerOffset)).toLocal());
+    
+    // Issue SetLocals. This has two effects:
+    // 1) That's how handleCall() sees the arguments.
+    // 2) If we inline then this ensures that the arguments are flushed so that if you use
+    //    the dreaded arguments object on the getter, the right things happen. Well, sort of -
+    //    since we only really care about 'this' in this case. But we're not going to take that
+    //    shortcut.
+    int nextRegister = registerOffset + CallFrame::headerSizeInRegisters;
+    set(VirtualRegister(nextRegister++), base, ImmediateNakedSet);
+
+    // We've set some locals, but they are not user-visible. It's still OK to exit from here.
+    m_exitOK = true;
+    addToGraph(ExitOK);
+    
+    handleCall(
+        destinationOperand, Call, InlineCallFrame::GetterCall, instructionSize,
+        getter, numberOfParameters - 1, registerOffset, *variant.callLinkStatus(), prediction);
+}
+
+void ByteCodeParser::emitPutById(
+    Node* base, unsigned identifierNumber, Node* value, const PutByIdStatus& putByIdStatus, bool isDirect)
+{
+    if (isDirect)
+        addToGraph(PutByIdDirect, OpInfo(identifierNumber), base, value);
+    else
+        addToGraph(putByIdStatus.makesCalls() ? PutByIdFlush : PutById, OpInfo(identifierNumber), base, value);
+}
+
+void ByteCodeParser::handlePutById(
+    Node* base, unsigned identifierNumber, Node* value,
+    const PutByIdStatus& putByIdStatus, bool isDirect)
+{
+    if (!putByIdStatus.isSimple() || !putByIdStatus.numVariants() || !Options::useAccessInlining()) {
+        if (!putByIdStatus.isSet())
+            addToGraph(ForceOSRExit);
+        emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
+        return;
+    }
+    
+    if (putByIdStatus.numVariants() > 1) {
+        if (!isFTL(m_graph.m_plan.mode) || putByIdStatus.makesCalls()
+            || !Options::usePolymorphicAccessInlining()) {
+            emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
+            return;
+        }
+        
+        if (!isDirect) {
+            for (unsigned variantIndex = putByIdStatus.numVariants(); variantIndex--;) {
+                if (putByIdStatus[variantIndex].kind() != PutByIdVariant::Transition)
+                    continue;
+                if (!check(putByIdStatus[variantIndex].conditionSet())) {
+                    emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
+                    return;
+                }
+            }
+        }
+        
+        if (m_graph.compilation())
+            m_graph.compilation()->noticeInlinedPutById();
+
+        for (const PutByIdVariant& variant : putByIdStatus.variants()) {
+            m_graph.registerInferredType(variant.requiredType());
+            for (Structure* structure : variant.oldStructure())
+                m_graph.registerStructure(structure);
+            if (variant.kind() == PutByIdVariant::Transition)
+                m_graph.registerStructure(variant.newStructure());
+        }
+        
+        MultiPutByOffsetData* data = m_graph.m_multiPutByOffsetData.add();
+        data->variants = putByIdStatus.variants();
+        data->identifierNumber = identifierNumber;
+        addToGraph(MultiPutByOffset, OpInfo(data), base, value);
+        return;
+    }
+    
+    ASSERT(putByIdStatus.numVariants() == 1);
+    const PutByIdVariant& variant = putByIdStatus[0];
+    
+    switch (variant.kind()) {
+    case PutByIdVariant::Replace: {
+        store(base, identifierNumber, variant, value);
+        if (m_graph.compilation())
+            m_graph.compilation()->noticeInlinedPutById();
+        return;
+    }
+    
+    case PutByIdVariant::Transition: {
+        addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.oldStructure())), base);
+        if (!check(variant.conditionSet())) {
+            emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
+            return;
+        }
+
+        ASSERT(variant.oldStructureForTransition()->transitionWatchpointSetHasBeenInvalidated());
+    
+        Node* propertyStorage;
+        Transition* transition = m_graph.m_transitions.add(
+            m_graph.registerStructure(variant.oldStructureForTransition()), m_graph.registerStructure(variant.newStructure()));
+
+        if (variant.reallocatesStorage()) {
+
+            // If we're growing the property storage then it must be because we're
+            // storing into the out-of-line storage.
+            ASSERT(!isInlineOffset(variant.offset()));
+
+            if (!variant.oldStructureForTransition()->outOfLineCapacity()) {
+                propertyStorage = addToGraph(
+                    AllocatePropertyStorage, OpInfo(transition), base);
+            } else {
+                propertyStorage = addToGraph(
+                    ReallocatePropertyStorage, OpInfo(transition),
+                    base, addToGraph(GetButterfly, base));
+            }
+        } else {
+            if (isInlineOffset(variant.offset()))
+                propertyStorage = base;
+            else
+                propertyStorage = addToGraph(GetButterfly, base);
+        }
+
+        StorageAccessData* data = m_graph.m_storageAccessData.add();
+        data->offset = variant.offset();
+        data->identifierNumber = identifierNumber;
+        data->inferredType = variant.requiredType();
+        m_graph.registerInferredType(data->inferredType);
+        
+        // NOTE: We could GC at this point because someone could insert an operation that GCs.
+        // That's fine because:
+        // - Things already in the structure will get scanned because we haven't messed with
+        //   the object yet.
+        // - The value we are fixing to put is going to be kept live by OSR exit handling. So
+        //   if the GC does a conservative scan here it will see the new value.
+        
+        addToGraph(
+            PutByOffset,
+            OpInfo(data),
+            propertyStorage,
+            base,
+            value);
+        
+        if (variant.reallocatesStorage())
+            addToGraph(NukeStructureAndSetButterfly, base, propertyStorage);
+
+        // FIXME: PutStructure goes last until we fix either
+        // https://bugs.webkit.org/show_bug.cgi?id=142921 or
+        // https://bugs.webkit.org/show_bug.cgi?id=142924.
+        addToGraph(PutStructure, OpInfo(transition), base);
+
+        if (m_graph.compilation())
+            m_graph.compilation()->noticeInlinedPutById();
+        return;
+    }
+        
+    case PutByIdVariant::Setter: {
+        Node* loadedValue = load(SpecCellOther, base, identifierNumber, variant);
+        if (!loadedValue) {
+            emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
+            return;
+        }
+        
+        Node* setter = addToGraph(GetSetter, loadedValue);
+        
+        // Make a call. We don't try to get fancy with using the smallest operand number because
+        // the stack layout phase should compress the stack anyway.
+    
+        unsigned numberOfParameters = 0;
+        numberOfParameters++; // The 'this' argument.
+        numberOfParameters++; // The new value.
+        numberOfParameters++; // True return PC.
+    
+        // Start with a register offset that corresponds to the last in-use register.
+        int registerOffset = virtualRegisterForLocal(
+            m_inlineStackTop->m_profiledBlock->m_numCalleeLocals - 1).offset();
+        registerOffset -= numberOfParameters;
+        registerOffset -= CallFrame::headerSizeInRegisters;
+    
+        // Get the alignment right.
+        registerOffset = -WTF::roundUpToMultipleOf(
+            stackAlignmentRegisters(),
+            -registerOffset);
+    
+        ensureLocals(
+            m_inlineStackTop->remapOperand(
+                VirtualRegister(registerOffset)).toLocal());
+    
+        int nextRegister = registerOffset + CallFrame::headerSizeInRegisters;
+        set(VirtualRegister(nextRegister++), base, ImmediateNakedSet);
+        set(VirtualRegister(nextRegister++), value, ImmediateNakedSet);
+
+        // We've set some locals, but they are not user-visible. It's still OK to exit from here.
+        m_exitOK = true;
+        addToGraph(ExitOK);
+    
+        handleCall(
+            VirtualRegister().offset(), Call, InlineCallFrame::SetterCall,
+            OPCODE_LENGTH(op_put_by_id), setter, numberOfParameters - 1, registerOffset,
+            *variant.callLinkStatus(), SpecOther);
+        return;
+    }
+    
+    default: {
+        emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
+        return;
+    } }
+}
+
+void ByteCodeParser::prepareToParseBlock()
+{
+    clearCaches();
+    ASSERT(m_setLocalQueue.isEmpty());
+}
+
+void ByteCodeParser::clearCaches()
+{
+    m_constants.resize(0);
+}
+
+bool ByteCodeParser::parseBlock(unsigned limit)
+{
+    bool shouldContinueParsing = true;
+
+    Interpreter* interpreter = m_vm->interpreter;
+    Instruction* instructionsBegin = m_inlineStackTop->m_codeBlock->instructions().begin();
+    unsigned blockBegin = m_currentIndex;
+
+    // If we are the first basic block, introduce markers for arguments. This allows
+    // us to track if a use of an argument may use the actual argument passed, as
+    // opposed to using a value we set explicitly.
+    if (m_currentBlock == m_graph.block(0) && !inlineCallFrame()) {
+        m_graph.m_arguments.resize(m_numArguments);
+        // We will emit SetArgument nodes. They don't exit, but we're at the top of an op_enter so
+        // exitOK = true.
+        m_exitOK = true;
+        for (unsigned argument = 0; argument < m_numArguments; ++argument) {
+            VariableAccessData* variable = newVariableAccessData(
+                virtualRegisterForArgument(argument));
+            variable->mergeStructureCheckHoistingFailed(
+                m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));
+            variable->mergeCheckArrayHoistingFailed(
+                m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIndexingType));
+            
+            Node* setArgument = addToGraph(SetArgument, OpInfo(variable));
+            m_graph.m_arguments[argument] = setArgument;
+            m_currentBlock->variablesAtTail.setArgumentFirstTime(argument, setArgument);
+        }
+    }
+
+    while (true) {
+        // We're staring a new bytecode instruction. Hence, we once again have a place that we can exit
+        // to.
+        m_exitOK = true;
+        
+        processSetLocalQueue();
+        
+        // Don't extend over jump destinations.
+        if (m_currentIndex == limit) {
+            // Ordinarily we want to plant a jump. But refuse to do this if the block is
+            // empty. This is a special case for inlining, which might otherwise create
+            // some empty blocks in some cases. When parseBlock() returns with an empty
+            // block, it will get repurposed instead of creating a new one. Note that this
+            // logic relies on every bytecode resulting in one or more nodes, which would
+            // be true anyway except for op_loop_hint, which emits a Phantom to force this
+            // to be true.
+            // We also don't insert a jump if the block already has a terminal,
+            // which could happen after a tail call.
+            ASSERT(m_currentBlock->isEmpty() || !m_currentBlock->terminal());
+            if (!m_currentBlock->isEmpty())
+                addToGraph(Jump, OpInfo(m_currentIndex));
+            return shouldContinueParsing;
+        }
+        
+        // Switch on the current bytecode opcode.
+        Instruction* currentInstruction = instructionsBegin + m_currentIndex;
+        m_currentInstruction = currentInstruction; // Some methods want to use this, and we'd rather not thread it through calls.
+        OpcodeID opcodeID = interpreter->getOpcodeID(currentInstruction->u.opcode);
+        
+        if (Options::verboseDFGByteCodeParsing())
+            dataLog("    parsing ", currentCodeOrigin(), ": ", opcodeID, "\n");
+        
+        if (m_graph.compilation()) {
+            addToGraph(CountExecution, OpInfo(m_graph.compilation()->executionCounterFor(
+                Profiler::OriginStack(*m_vm->m_perBytecodeProfiler, m_codeBlock, currentCodeOrigin()))));
+        }
+        
+        switch (opcodeID) {
+
+        // === Function entry opcodes ===
+
+        case op_enter: {
+            Node* undefined = addToGraph(JSConstant, OpInfo(m_constantUndefined));
+            // Initialize all locals to undefined.
+            for (int i = 0; i < m_inlineStackTop->m_codeBlock->m_numVars; ++i)
+                set(virtualRegisterForLocal(i), undefined, ImmediateNakedSet);
+            NEXT_OPCODE(op_enter);
+        }
+            
+        case op_to_this: {
+            Node* op1 = getThis();
+            if (op1->op() != ToThis) {
+                Structure* cachedStructure = currentInstruction[2].u.structure.get();
+                if (currentInstruction[2].u.toThisStatus != ToThisOK
+                    || !cachedStructure
+                    || cachedStructure->classInfo()->methodTable.toThis != JSObject::info()->methodTable.toThis
+                    || m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
+                    || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)
+                    || (op1->op() == GetLocal && op1->variableAccessData()->structureCheckHoistingFailed())) {
+                    setThis(addToGraph(ToThis, op1));
+                } else {
+                    addToGraph(
+                        CheckStructure,
+                        OpInfo(m_graph.addStructureSet(cachedStructure)),
+                        op1);
+                }
+            }
+            NEXT_OPCODE(op_to_this);
+        }
+
+        case op_create_this: {
+            int calleeOperand = currentInstruction[2].u.operand;
+            Node* callee = get(VirtualRegister(calleeOperand));
+
+            JSFunction* function = callee->dynamicCastConstant<JSFunction*>();
+            if (!function) {
+                JSCell* cachedFunction = currentInstruction[4].u.jsCell.unvalidatedGet();
+                if (cachedFunction
+                    && cachedFunction != JSCell::seenMultipleCalleeObjects()
+                    && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCell)) {
+                    ASSERT(cachedFunction->inherits(JSFunction::info()));
+
+                    FrozenValue* frozen = m_graph.freeze(cachedFunction);
+                    addToGraph(CheckCell, OpInfo(frozen), callee);
+
+                    function = static_cast<JSFunction*>(cachedFunction);
+                }
+            }
+
+            bool alreadyEmitted = false;
+            if (function) {
+                if (FunctionRareData* rareData = function->rareData()) {
+                    if (Structure* structure = rareData->objectAllocationStructure()) {
+                        m_graph.freeze(rareData);
+                        m_graph.watchpoints().addLazily(rareData->allocationProfileWatchpointSet());
+                        // The callee is still live up to this point.
+                        addToGraph(Phantom, callee);
+                        set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(NewObject, OpInfo(m_graph.registerStructure(structure))));
+                        alreadyEmitted = true;
+                    }
+                }
+            }
+            if (!alreadyEmitted) {
+                set(VirtualRegister(currentInstruction[1].u.operand),
+                    addToGraph(CreateThis, OpInfo(currentInstruction[3].u.operand), callee));
+            }
+            NEXT_OPCODE(op_create_this);
+        }
+
+        case op_new_object: {
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(NewObject,
+                    OpInfo(m_graph.registerStructure(currentInstruction[3].u.objectAllocationProfile->structure()))));
+            NEXT_OPCODE(op_new_object);
+        }
+            
+        case op_new_array: {
+            int startOperand = currentInstruction[2].u.operand;
+            int numOperands = currentInstruction[3].u.operand;
+            ArrayAllocationProfile* profile = currentInstruction[4].u.arrayAllocationProfile;
+            for (int operandIdx = startOperand; operandIdx > startOperand - numOperands; --operandIdx)
+                addVarArgChild(get(VirtualRegister(operandIdx)));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(Node::VarArg, NewArray, OpInfo(profile->selectIndexingType()), OpInfo(0)));
+            NEXT_OPCODE(op_new_array);
+        }
+
+        case op_new_array_with_spread: {
+            int startOperand = currentInstruction[2].u.operand;
+            int numOperands = currentInstruction[3].u.operand;
+            const BitVector& bitVector = m_inlineStackTop->m_profiledBlock->unlinkedCodeBlock()->bitVector(currentInstruction[4].u.unsignedValue);
+            for (int operandIdx = startOperand; operandIdx > startOperand - numOperands; --operandIdx)
+                addVarArgChild(get(VirtualRegister(operandIdx)));
+
+            BitVector* copy = m_graph.m_bitVectors.add(bitVector);
+            ASSERT(*copy == bitVector);
+
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(Node::VarArg, NewArrayWithSpread, OpInfo(copy)));
+            NEXT_OPCODE(op_new_array_with_spread);
+        }
+
+        case op_spread: {
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(Spread, get(VirtualRegister(currentInstruction[2].u.operand))));
+            NEXT_OPCODE(op_spread);
+        }
+            
+        case op_new_array_with_size: {
+            int lengthOperand = currentInstruction[2].u.operand;
+            ArrayAllocationProfile* profile = currentInstruction[3].u.arrayAllocationProfile;
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(NewArrayWithSize, OpInfo(profile->selectIndexingType()), get(VirtualRegister(lengthOperand))));
+            NEXT_OPCODE(op_new_array_with_size);
+        }
+            
+        case op_new_array_buffer: {
+            int startConstant = currentInstruction[2].u.operand;
+            int numConstants = currentInstruction[3].u.operand;
+            ArrayAllocationProfile* profile = currentInstruction[4].u.arrayAllocationProfile;
+            NewArrayBufferData data;
+            data.startConstant = m_inlineStackTop->m_constantBufferRemap[startConstant];
+            data.numConstants = numConstants;
+            data.indexingType = profile->selectIndexingType();
+
+            // If this statement has never executed, we'll have the wrong indexing type in the profile.
+            for (int i = 0; i < numConstants; ++i) {
+                data.indexingType =
+                    leastUpperBoundOfIndexingTypeAndValue(
+                        data.indexingType,
+                        m_codeBlock->constantBuffer(data.startConstant)[i]);
+            }
+            
+            m_graph.m_newArrayBufferData.append(data);
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(NewArrayBuffer, OpInfo(&m_graph.m_newArrayBufferData.last())));
+            NEXT_OPCODE(op_new_array_buffer);
+        }
+            
+        case op_new_regexp: {
+            RegExp* regexp = m_inlineStackTop->m_codeBlock->regexp(currentInstruction[2].u.operand);
+            FrozenValue* frozen = m_graph.freezeStrong(regexp);
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(NewRegexp, OpInfo(frozen)));
+            NEXT_OPCODE(op_new_regexp);
+        }
+
+        case op_get_rest_length: {
+            InlineCallFrame* inlineCallFrame = this->inlineCallFrame();
+            Node* length;
+            if (inlineCallFrame && !inlineCallFrame->isVarargs()) {
+                unsigned argumentsLength = inlineCallFrame->arguments.size() - 1;
+                unsigned numParamsToSkip = currentInstruction[2].u.unsignedValue;
+                JSValue restLength;
+                if (argumentsLength <= numParamsToSkip)
+                    restLength = jsNumber(0);
+                else
+                    restLength = jsNumber(argumentsLength - numParamsToSkip);
+
+                length = jsConstant(restLength);
+            } else
+                length = addToGraph(GetRestLength, OpInfo(currentInstruction[2].u.unsignedValue));
+            set(VirtualRegister(currentInstruction[1].u.operand), length);
+            NEXT_OPCODE(op_get_rest_length);
+        }
+
+        case op_create_rest: {
+            noticeArgumentsUse();
+            Node* arrayLength = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(CreateRest, OpInfo(currentInstruction[3].u.unsignedValue), arrayLength));
+            NEXT_OPCODE(op_create_rest);
+        }
+            
+        // === Bitwise operations ===
+
+        case op_bitand: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(BitAnd, op1, op2));
+            NEXT_OPCODE(op_bitand);
+        }
+
+        case op_bitor: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(BitOr, op1, op2));
+            NEXT_OPCODE(op_bitor);
+        }
+
+        case op_bitxor: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(BitXor, op1, op2));
+            NEXT_OPCODE(op_bitxor);
+        }
+
+        case op_rshift: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(BitRShift, op1, op2));
+            NEXT_OPCODE(op_rshift);
+        }
+
+        case op_lshift: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(BitLShift, op1, op2));
+            NEXT_OPCODE(op_lshift);
+        }
+
+        case op_urshift: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(BitURShift, op1, op2));
+            NEXT_OPCODE(op_urshift);
+        }
+            
+        case op_unsigned: {
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                makeSafe(addToGraph(UInt32ToNumber, get(VirtualRegister(currentInstruction[2].u.operand)))));
+            NEXT_OPCODE(op_unsigned);
+        }
+
+        // === Increment/Decrement opcodes ===
+
+        case op_inc: {
+            int srcDst = currentInstruction[1].u.operand;
+            VirtualRegister srcDstVirtualRegister = VirtualRegister(srcDst);
+            Node* op = get(srcDstVirtualRegister);
+            set(srcDstVirtualRegister, makeSafe(addToGraph(ArithAdd, op, addToGraph(JSConstant, OpInfo(m_constantOne)))));
+            NEXT_OPCODE(op_inc);
+        }
+
+        case op_dec: {
+            int srcDst = currentInstruction[1].u.operand;
+            VirtualRegister srcDstVirtualRegister = VirtualRegister(srcDst);
+            Node* op = get(srcDstVirtualRegister);
+            set(srcDstVirtualRegister, makeSafe(addToGraph(ArithSub, op, addToGraph(JSConstant, OpInfo(m_constantOne)))));
+            NEXT_OPCODE(op_dec);
+        }
+
+        // === Arithmetic operations ===
+
+        case op_add: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            if (op1->hasNumberResult() && op2->hasNumberResult())
+                set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ArithAdd, op1, op2)));
+            else
+                set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ValueAdd, op1, op2)));
+            NEXT_OPCODE(op_add);
+        }
+
+        case op_sub: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ArithSub, op1, op2)));
+            NEXT_OPCODE(op_sub);
+        }
+
+        case op_negate: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ArithNegate, op1)));
+            NEXT_OPCODE(op_negate);
+        }
+
+        case op_mul: {
+            // Multiply requires that the inputs are not truncated, unfortunately.
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ArithMul, op1, op2)));
+            NEXT_OPCODE(op_mul);
+        }
+
+        case op_mod: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), makeSafe(addToGraph(ArithMod, op1, op2)));
+            NEXT_OPCODE(op_mod);
+        }
+
+        case op_pow: {
+            // FIXME: ArithPow(Untyped, Untyped) should be supported as the same to ArithMul, ArithSub etc.
+            // https://bugs.webkit.org/show_bug.cgi?id=160012
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(ArithPow, op1, op2));
+            NEXT_OPCODE(op_pow);
+        }
+
+        case op_div: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), makeDivSafe(addToGraph(ArithDiv, op1, op2)));
+            NEXT_OPCODE(op_div);
+        }
+
+        // === Misc operations ===
+
+        case op_debug: {
+            // This is a nop in the DFG/FTL because when we set a breakpoint in the debugger,
+            // we will jettison all optimized CodeBlocks that contains the breakpoint.
+            addToGraph(Check); // We add a nop here so that basic block linking doesn't break.
+            NEXT_OPCODE(op_debug);
+        }
+
+        case op_mov: {
+            Node* op = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), op);
+            NEXT_OPCODE(op_mov);
+        }
+
+        case op_check_tdz: {
+            addToGraph(CheckNotEmpty, get(VirtualRegister(currentInstruction[1].u.operand)));
+            NEXT_OPCODE(op_check_tdz);
+        }
+
+        case op_overrides_has_instance: {
+            JSFunction* defaultHasInstanceSymbolFunction = m_inlineStackTop->m_codeBlock->globalObjectFor(currentCodeOrigin())->functionProtoHasInstanceSymbolFunction();
+
+            Node* constructor = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* hasInstanceValue = get(VirtualRegister(currentInstruction[3].u.operand));
+
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(OverridesHasInstance, OpInfo(m_graph.freeze(defaultHasInstanceSymbolFunction)), constructor, hasInstanceValue));
+            NEXT_OPCODE(op_overrides_has_instance);
+        }
+
+        case op_instanceof: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* prototype = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(InstanceOf, value, prototype));
+            NEXT_OPCODE(op_instanceof);
+        }
+
+        case op_instanceof_custom: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* constructor = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* hasInstanceValue = get(VirtualRegister(currentInstruction[4].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(InstanceOfCustom, value, constructor, hasInstanceValue));
+            NEXT_OPCODE(op_instanceof_custom);
+        }
+        case op_is_empty: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsEmpty, value));
+            NEXT_OPCODE(op_is_empty);
+        }
+        case op_is_undefined: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsUndefined, value));
+            NEXT_OPCODE(op_is_undefined);
+        }
+
+        case op_is_boolean: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsBoolean, value));
+            NEXT_OPCODE(op_is_boolean);
+        }
+
+        case op_is_number: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsNumber, value));
+            NEXT_OPCODE(op_is_number);
+        }
+
+        case op_is_cell_with_type: {
+            JSType type = static_cast<JSType>(currentInstruction[3].u.operand);
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsCellWithType, OpInfo(type), value));
+            NEXT_OPCODE(op_is_cell_with_type);
+        }
+
+        case op_is_object: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsObject, value));
+            NEXT_OPCODE(op_is_object);
+        }
+
+        case op_is_object_or_null: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsObjectOrNull, value));
+            NEXT_OPCODE(op_is_object_or_null);
+        }
+
+        case op_is_function: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(IsFunction, value));
+            NEXT_OPCODE(op_is_function);
+        }
+
+        case op_not: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(LogicalNot, value));
+            NEXT_OPCODE(op_not);
+        }
+            
+        case op_to_primitive: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(ToPrimitive, value));
+            NEXT_OPCODE(op_to_primitive);
+        }
+            
+        case op_strcat: {
+            int startOperand = currentInstruction[2].u.operand;
+            int numOperands = currentInstruction[3].u.operand;
+#if CPU(X86)
+            // X86 doesn't have enough registers to compile MakeRope with three arguments. The
+            // StrCat we emit here may be turned into a MakeRope. Rather than try to be clever,
+            // we just make StrCat dumber on this processor.
+            const unsigned maxArguments = 2;
+#else
+            const unsigned maxArguments = 3;
+#endif
+            Node* operands[AdjacencyList::Size];
+            unsigned indexInOperands = 0;
+            for (unsigned i = 0; i < AdjacencyList::Size; ++i)
+                operands[i] = 0;
+            for (int operandIdx = 0; operandIdx < numOperands; ++operandIdx) {
+                if (indexInOperands == maxArguments) {
+                    operands[0] = addToGraph(StrCat, operands[0], operands[1], operands[2]);
+                    for (unsigned i = 1; i < AdjacencyList::Size; ++i)
+                        operands[i] = 0;
+                    indexInOperands = 1;
+                }
+                
+                ASSERT(indexInOperands < AdjacencyList::Size);
+                ASSERT(indexInOperands < maxArguments);
+                operands[indexInOperands++] = get(VirtualRegister(startOperand - operandIdx));
+            }
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(StrCat, operands[0], operands[1], operands[2]));
+            NEXT_OPCODE(op_strcat);
+        }
+
+        case op_less: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareLess, op1, op2));
+            NEXT_OPCODE(op_less);
+        }
+
+        case op_lesseq: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareLessEq, op1, op2));
+            NEXT_OPCODE(op_lesseq);
+        }
+
+        case op_greater: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareGreater, op1, op2));
+            NEXT_OPCODE(op_greater);
+        }
+
+        case op_greatereq: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareGreaterEq, op1, op2));
+            NEXT_OPCODE(op_greatereq);
+        }
+
+        case op_eq: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareEq, op1, op2));
+            NEXT_OPCODE(op_eq);
+        }
+
+        case op_eq_null: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* nullConstant = addToGraph(JSConstant, OpInfo(m_constantNull));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareEq, value, nullConstant));
+            NEXT_OPCODE(op_eq_null);
+        }
+
+        case op_stricteq: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(CompareStrictEq, op1, op2));
+            NEXT_OPCODE(op_stricteq);
+        }
+
+        case op_neq: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(LogicalNot, addToGraph(CompareEq, op1, op2)));
+            NEXT_OPCODE(op_neq);
+        }
+
+        case op_neq_null: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* nullConstant = addToGraph(JSConstant, OpInfo(m_constantNull));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(LogicalNot, addToGraph(CompareEq, value, nullConstant)));
+            NEXT_OPCODE(op_neq_null);
+        }
+
+        case op_nstricteq: {
+            Node* op1 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* invertedResult;
+            invertedResult = addToGraph(CompareStrictEq, op1, op2);
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(LogicalNot, invertedResult));
+            NEXT_OPCODE(op_nstricteq);
+        }
+
+        // === Property access operations ===
+
+        case op_get_by_val: {
+            SpeculatedType prediction = getPredictionWithoutOSRExit();
+
+            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* property = get(VirtualRegister(currentInstruction[3].u.operand));
+            bool compiledAsGetById = false;
+            GetByIdStatus getByIdStatus;
+            unsigned identifierNumber = 0;
+            {
+                ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
+                ByValInfo* byValInfo = m_inlineStackTop->m_byValInfos.get(CodeOrigin(currentCodeOrigin().bytecodeIndex));
+                // FIXME: When the bytecode is not compiled in the baseline JIT, byValInfo becomes null.
+                // At that time, there is no information.
+                if (byValInfo && byValInfo->stubInfo && !byValInfo->tookSlowPath && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIdent) && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCell)) {
+                    compiledAsGetById = true;
+                    identifierNumber = m_graph.identifiers().ensure(byValInfo->cachedId.impl());
+                    UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
+
+                    if (Symbol* symbol = byValInfo->cachedSymbol.get()) {
+                        FrozenValue* frozen = m_graph.freezeStrong(symbol);
+                        addToGraph(CheckCell, OpInfo(frozen), property);
+                    } else {
+                        ASSERT(!uid->isSymbol());
+                        addToGraph(CheckStringIdent, OpInfo(uid), property);
+                    }
+
+                    getByIdStatus = GetByIdStatus::computeForStubInfo(
+                        locker, m_inlineStackTop->m_profiledBlock,
+                        byValInfo->stubInfo, currentCodeOrigin(), uid);
+                }
+            }
+
+            if (compiledAsGetById)
+                handleGetById(currentInstruction[1].u.operand, prediction, base, identifierNumber, getByIdStatus, AccessType::Get, OPCODE_LENGTH(op_get_by_val));
+            else {
+                ArrayMode arrayMode = getArrayMode(currentInstruction[4].u.arrayProfile, Array::Read);
+                Node* getByVal = addToGraph(GetByVal, OpInfo(arrayMode.asWord()), OpInfo(prediction), base, property);
+                m_exitOK = false; // GetByVal must be treated as if it clobbers exit state, since FixupPhase may make it generic.
+                set(VirtualRegister(currentInstruction[1].u.operand), getByVal);
+            }
+
+            NEXT_OPCODE(op_get_by_val);
+        }
+
+        case op_get_by_val_with_this: {
+            SpeculatedType prediction = getPrediction();
+
+            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* thisValue = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* property = get(VirtualRegister(currentInstruction[4].u.operand));
+            Node* getByValWithThis = addToGraph(GetByValWithThis, OpInfo(), OpInfo(prediction), base, thisValue, property);
+            set(VirtualRegister(currentInstruction[1].u.operand), getByValWithThis);
+
+            NEXT_OPCODE(op_get_by_val_with_this);
+        }
+
+        case op_put_by_val_direct:
+        case op_put_by_val: {
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* property = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* value = get(VirtualRegister(currentInstruction[3].u.operand));
+            bool isDirect = opcodeID == op_put_by_val_direct;
+            bool compiledAsPutById = false;
+            {
+                unsigned identifierNumber = std::numeric_limits<unsigned>::max();
+                PutByIdStatus putByIdStatus;
+                {
+                    ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
+                    ByValInfo* byValInfo = m_inlineStackTop->m_byValInfos.get(CodeOrigin(currentCodeOrigin().bytecodeIndex));
+                    // FIXME: When the bytecode is not compiled in the baseline JIT, byValInfo becomes null.
+                    // At that time, there is no information.
+                    if (byValInfo 
+                        && byValInfo->stubInfo
+                        && !byValInfo->tookSlowPath
+                        && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIdent)
+                        && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadType)
+                        && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCell)) {
+                        compiledAsPutById = true;
+                        identifierNumber = m_graph.identifiers().ensure(byValInfo->cachedId.impl());
+                        UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
+
+                        if (Symbol* symbol = byValInfo->cachedSymbol.get()) {
+                            FrozenValue* frozen = m_graph.freezeStrong(symbol);
+                            addToGraph(CheckCell, OpInfo(frozen), property);
+                        } else {
+                            ASSERT(!uid->isSymbol());
+                            addToGraph(CheckStringIdent, OpInfo(uid), property);
+                        }
+
+                        putByIdStatus = PutByIdStatus::computeForStubInfo(
+                            locker, m_inlineStackTop->m_profiledBlock,
+                            byValInfo->stubInfo, currentCodeOrigin(), uid);
+
+                    }
+                }
+
+                if (compiledAsPutById)
+                    handlePutById(base, identifierNumber, value, putByIdStatus, isDirect);
+            }
+
+            if (!compiledAsPutById) {
+                ArrayMode arrayMode = getArrayMode(currentInstruction[4].u.arrayProfile, Array::Write);
+
+                addVarArgChild(base);
+                addVarArgChild(property);
+                addVarArgChild(value);
+                addVarArgChild(0); // Leave room for property storage.
+                addVarArgChild(0); // Leave room for length.
+                addToGraph(Node::VarArg, isDirect ? PutByValDirect : PutByVal, OpInfo(arrayMode.asWord()), OpInfo(0));
+            }
+
+            NEXT_OPCODE(op_put_by_val);
+        }
+
+        case op_put_by_val_with_this: {
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* thisValue = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* property = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* value = get(VirtualRegister(currentInstruction[4].u.operand));
+
+            addVarArgChild(base);
+            addVarArgChild(thisValue);
+            addVarArgChild(property);
+            addVarArgChild(value);
+            addToGraph(Node::VarArg, PutByValWithThis, OpInfo(0), OpInfo(0));
+
+            NEXT_OPCODE(op_put_by_val_with_this);
+        }
+
+        case op_define_data_property: {
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* property = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* value = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* attributes = get(VirtualRegister(currentInstruction[4].u.operand));
+
+            addVarArgChild(base);
+            addVarArgChild(property);
+            addVarArgChild(value);
+            addVarArgChild(attributes);
+            addToGraph(Node::VarArg, DefineDataProperty, OpInfo(0), OpInfo(0));
+
+            NEXT_OPCODE(op_define_data_property);
+        }
+
+        case op_define_accessor_property: {
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* property = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* getter = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* setter = get(VirtualRegister(currentInstruction[4].u.operand));
+            Node* attributes = get(VirtualRegister(currentInstruction[5].u.operand));
+
+            addVarArgChild(base);
+            addVarArgChild(property);
+            addVarArgChild(getter);
+            addVarArgChild(setter);
+            addVarArgChild(attributes);
+            addToGraph(Node::VarArg, DefineAccessorProperty, OpInfo(0), OpInfo(0));
+
+            NEXT_OPCODE(op_define_accessor_property);
+        }
+
+        case op_try_get_by_id:
+        case op_get_by_id:
+        case op_get_by_id_proto_load:
+        case op_get_by_id_unset:
+        case op_get_array_length: {
+            SpeculatedType prediction = getPrediction();
+            
+            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
+            
+            UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
+            GetByIdStatus getByIdStatus = GetByIdStatus::computeFor(
+                m_inlineStackTop->m_profiledBlock, m_dfgCodeBlock,
+                m_inlineStackTop->m_stubInfos, m_dfgStubInfos,
+                currentCodeOrigin(), uid);
+            AccessType type = op_try_get_by_id == opcodeID ? AccessType::GetPure : AccessType::Get;
+
+            unsigned opcodeLength = opcodeID == op_try_get_by_id ? OPCODE_LENGTH(op_try_get_by_id) : OPCODE_LENGTH(op_get_by_id);
+
+            handleGetById(
+                currentInstruction[1].u.operand, prediction, base, identifierNumber, getByIdStatus, type, opcodeLength);
+
+            if (op_try_get_by_id == opcodeID)
+                NEXT_OPCODE(op_try_get_by_id); // Opcode's length is different from others in this case.
+            else
+                NEXT_OPCODE(op_get_by_id);
+        }
+        case op_get_by_id_with_this: {
+            SpeculatedType prediction = getPrediction();
+
+            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* thisValue = get(VirtualRegister(currentInstruction[3].u.operand));
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[4].u.operand];
+
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(GetByIdWithThis, OpInfo(identifierNumber), OpInfo(prediction), base, thisValue));
+
+            NEXT_OPCODE(op_get_by_id_with_this);
+        }
+        case op_put_by_id: {
+            Node* value = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[2].u.operand];
+            bool direct = currentInstruction[8].u.putByIdFlags & PutByIdIsDirect;
+
+            PutByIdStatus putByIdStatus = PutByIdStatus::computeFor(
+                m_inlineStackTop->m_profiledBlock, m_dfgCodeBlock,
+                m_inlineStackTop->m_stubInfos, m_dfgStubInfos,
+                currentCodeOrigin(), m_graph.identifiers()[identifierNumber]);
+            
+            handlePutById(base, identifierNumber, value, putByIdStatus, direct);
+            NEXT_OPCODE(op_put_by_id);
+        }
+
+        case op_put_by_id_with_this: {
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* thisValue = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* value = get(VirtualRegister(currentInstruction[4].u.operand));
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
+
+            addToGraph(PutByIdWithThis, OpInfo(identifierNumber), base, thisValue, value);
+            NEXT_OPCODE(op_put_by_id_with_this);
+        }
+
+        case op_put_getter_by_id:
+        case op_put_setter_by_id: {
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[2].u.operand];
+            unsigned attributes = currentInstruction[3].u.operand;
+            Node* accessor = get(VirtualRegister(currentInstruction[4].u.operand));
+            NodeType op = (opcodeID == op_put_getter_by_id) ? PutGetterById : PutSetterById;
+            addToGraph(op, OpInfo(identifierNumber), OpInfo(attributes), base, accessor);
+            NEXT_OPCODE(op_put_getter_by_id);
+        }
+
+        case op_put_getter_setter_by_id: {
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[2].u.operand];
+            unsigned attributes = currentInstruction[3].u.operand;
+            Node* getter = get(VirtualRegister(currentInstruction[4].u.operand));
+            Node* setter = get(VirtualRegister(currentInstruction[5].u.operand));
+            addToGraph(PutGetterSetterById, OpInfo(identifierNumber), OpInfo(attributes), base, getter, setter);
+            NEXT_OPCODE(op_put_getter_setter_by_id);
+        }
+
+        case op_put_getter_by_val:
+        case op_put_setter_by_val: {
+            Node* base = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* subscript = get(VirtualRegister(currentInstruction[2].u.operand));
+            unsigned attributes = currentInstruction[3].u.operand;
+            Node* accessor = get(VirtualRegister(currentInstruction[4].u.operand));
+            NodeType op = (opcodeID == op_put_getter_by_val) ? PutGetterByVal : PutSetterByVal;
+            addToGraph(op, OpInfo(attributes), base, subscript, accessor);
+            NEXT_OPCODE(op_put_getter_by_val);
+        }
+
+        case op_del_by_id: {
+            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(DeleteById, OpInfo(identifierNumber), base));
+            NEXT_OPCODE(op_del_by_id);
+        }
+
+        case op_del_by_val: {
+            int dst = currentInstruction[1].u.operand;
+            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* key = get(VirtualRegister(currentInstruction[3].u.operand));
+            set(VirtualRegister(dst), addToGraph(DeleteByVal, base, key));
+            NEXT_OPCODE(op_del_by_val);
+        }
+
+        case op_profile_type: {
+            Node* valueToProfile = get(VirtualRegister(currentInstruction[1].u.operand));
+            addToGraph(ProfileType, OpInfo(currentInstruction[2].u.location), valueToProfile);
+            NEXT_OPCODE(op_profile_type);
+        }
+
+        case op_profile_control_flow: {
+            BasicBlockLocation* basicBlockLocation = currentInstruction[1].u.basicBlockLocation;
+            addToGraph(ProfileControlFlow, OpInfo(basicBlockLocation));
+            NEXT_OPCODE(op_profile_control_flow);
+        }
+
+        // === Block terminators. ===
+
+        case op_jmp: {
+            ASSERT(!m_currentBlock->terminal());
+            int relativeOffset = currentInstruction[1].u.operand;
+            addToGraph(Jump, OpInfo(m_currentIndex + relativeOffset));
+            if (relativeOffset <= 0)
+                flushForTerminal();
+            LAST_OPCODE(op_jmp);
+        }
+
+        case op_jtrue: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            Node* condition = get(VirtualRegister(currentInstruction[1].u.operand));
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + relativeOffset, m_currentIndex + OPCODE_LENGTH(op_jtrue))), condition);
+            LAST_OPCODE(op_jtrue);
+        }
+
+        case op_jfalse: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            Node* condition = get(VirtualRegister(currentInstruction[1].u.operand));
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + OPCODE_LENGTH(op_jfalse), m_currentIndex + relativeOffset)), condition);
+            LAST_OPCODE(op_jfalse);
+        }
+
+        case op_jeq_null: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            Node* value = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* nullConstant = addToGraph(JSConstant, OpInfo(m_constantNull));
+            Node* condition = addToGraph(CompareEq, value, nullConstant);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + relativeOffset, m_currentIndex + OPCODE_LENGTH(op_jeq_null))), condition);
+            LAST_OPCODE(op_jeq_null);
+        }
+
+        case op_jneq_null: {
+            unsigned relativeOffset = currentInstruction[2].u.operand;
+            Node* value = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* nullConstant = addToGraph(JSConstant, OpInfo(m_constantNull));
+            Node* condition = addToGraph(CompareEq, value, nullConstant);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + OPCODE_LENGTH(op_jneq_null), m_currentIndex + relativeOffset)), condition);
+            LAST_OPCODE(op_jneq_null);
+        }
+
+        case op_jless: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* op1 = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* condition = addToGraph(CompareLess, op1, op2);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + relativeOffset, m_currentIndex + OPCODE_LENGTH(op_jless))), condition);
+            LAST_OPCODE(op_jless);
+        }
+
+        case op_jlesseq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* op1 = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* condition = addToGraph(CompareLessEq, op1, op2);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + relativeOffset, m_currentIndex + OPCODE_LENGTH(op_jlesseq))), condition);
+            LAST_OPCODE(op_jlesseq);
+        }
+
+        case op_jgreater: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* op1 = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* condition = addToGraph(CompareGreater, op1, op2);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + relativeOffset, m_currentIndex + OPCODE_LENGTH(op_jgreater))), condition);
+            LAST_OPCODE(op_jgreater);
+        }
+
+        case op_jgreatereq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* op1 = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* condition = addToGraph(CompareGreaterEq, op1, op2);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + relativeOffset, m_currentIndex + OPCODE_LENGTH(op_jgreatereq))), condition);
+            LAST_OPCODE(op_jgreatereq);
+        }
+
+        case op_jnless: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* op1 = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* condition = addToGraph(CompareLess, op1, op2);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + OPCODE_LENGTH(op_jnless), m_currentIndex + relativeOffset)), condition);
+            LAST_OPCODE(op_jnless);
+        }
+
+        case op_jnlesseq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* op1 = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* condition = addToGraph(CompareLessEq, op1, op2);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + OPCODE_LENGTH(op_jnlesseq), m_currentIndex + relativeOffset)), condition);
+            LAST_OPCODE(op_jnlesseq);
+        }
+
+        case op_jngreater: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* op1 = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* condition = addToGraph(CompareGreater, op1, op2);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + OPCODE_LENGTH(op_jngreater), m_currentIndex + relativeOffset)), condition);
+            LAST_OPCODE(op_jngreater);
+        }
+
+        case op_jngreatereq: {
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* op1 = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* op2 = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* condition = addToGraph(CompareGreaterEq, op1, op2);
+            addToGraph(Branch, OpInfo(branchData(m_currentIndex + OPCODE_LENGTH(op_jngreatereq), m_currentIndex + relativeOffset)), condition);
+            LAST_OPCODE(op_jngreatereq);
+        }
+            
+        case op_switch_imm: {
+            SwitchData& data = *m_graph.m_switchData.add();
+            data.kind = SwitchImm;
+            data.switchTableIndex = m_inlineStackTop->m_switchRemap[currentInstruction[1].u.operand];
+            data.fallThrough.setBytecodeIndex(m_currentIndex + currentInstruction[2].u.operand);
+            SimpleJumpTable& table = m_codeBlock->switchJumpTable(data.switchTableIndex);
+            for (unsigned i = 0; i < table.branchOffsets.size(); ++i) {
+                if (!table.branchOffsets[i])
+                    continue;
+                unsigned target = m_currentIndex + table.branchOffsets[i];
+                if (target == data.fallThrough.bytecodeIndex())
+                    continue;
+                data.cases.append(SwitchCase::withBytecodeIndex(m_graph.freeze(jsNumber(static_cast<int32_t>(table.min + i))), target));
+            }
+            addToGraph(Switch, OpInfo(&data), get(VirtualRegister(currentInstruction[3].u.operand)));
+            flushIfTerminal(data);
+            LAST_OPCODE(op_switch_imm);
+        }
+            
+        case op_switch_char: {
+            SwitchData& data = *m_graph.m_switchData.add();
+            data.kind = SwitchChar;
+            data.switchTableIndex = m_inlineStackTop->m_switchRemap[currentInstruction[1].u.operand];
+            data.fallThrough.setBytecodeIndex(m_currentIndex + currentInstruction[2].u.operand);
+            SimpleJumpTable& table = m_codeBlock->switchJumpTable(data.switchTableIndex);
+            for (unsigned i = 0; i < table.branchOffsets.size(); ++i) {
+                if (!table.branchOffsets[i])
+                    continue;
+                unsigned target = m_currentIndex + table.branchOffsets[i];
+                if (target == data.fallThrough.bytecodeIndex())
+                    continue;
+                data.cases.append(
+                    SwitchCase::withBytecodeIndex(LazyJSValue::singleCharacterString(table.min + i), target));
+            }
+            addToGraph(Switch, OpInfo(&data), get(VirtualRegister(currentInstruction[3].u.operand)));
+            flushIfTerminal(data);
+            LAST_OPCODE(op_switch_char);
+        }
+
+        case op_switch_string: {
+            SwitchData& data = *m_graph.m_switchData.add();
+            data.kind = SwitchString;
+            data.switchTableIndex = currentInstruction[1].u.operand;
+            data.fallThrough.setBytecodeIndex(m_currentIndex + currentInstruction[2].u.operand);
+            StringJumpTable& table = m_codeBlock->stringSwitchJumpTable(data.switchTableIndex);
+            StringJumpTable::StringOffsetTable::iterator iter;
+            StringJumpTable::StringOffsetTable::iterator end = table.offsetTable.end();
+            for (iter = table.offsetTable.begin(); iter != end; ++iter) {
+                unsigned target = m_currentIndex + iter->value.branchOffset;
+                if (target == data.fallThrough.bytecodeIndex())
+                    continue;
+                data.cases.append(
+                    SwitchCase::withBytecodeIndex(LazyJSValue::knownStringImpl(iter->key.get()), target));
+            }
+            addToGraph(Switch, OpInfo(&data), get(VirtualRegister(currentInstruction[3].u.operand)));
+            flushIfTerminal(data);
+            LAST_OPCODE(op_switch_string);
+        }
+
+        case op_ret:
+            ASSERT(!m_currentBlock->terminal());
+            if (inlineCallFrame()) {
+                flushForReturn();
+                if (m_inlineStackTop->m_returnValue.isValid())
+                    setDirect(m_inlineStackTop->m_returnValue, get(VirtualRegister(currentInstruction[1].u.operand)), ImmediateSetWithFlush);
+                m_inlineStackTop->m_didReturn = true;
+                if (m_inlineStackTop->m_unlinkedBlocks.isEmpty()) {
+                    // If we're returning from the first block, then we're done parsing.
+                    ASSERT(m_inlineStackTop->m_callsiteBlockHead == m_graph.lastBlock());
+                    shouldContinueParsing = false;
+                    LAST_OPCODE(op_ret);
+                } else {
+                    // If inlining created blocks, and we're doing a return, then we need some
+                    // special linking.
+                    ASSERT(m_inlineStackTop->m_unlinkedBlocks.last().m_block == m_graph.lastBlock());
+                    m_inlineStackTop->m_unlinkedBlocks.last().m_needsNormalLinking = false;
+                }
+                if (m_currentIndex + OPCODE_LENGTH(op_ret) != m_inlineStackTop->m_codeBlock->instructions().size() || m_inlineStackTop->m_didEarlyReturn) {
+                    ASSERT(m_currentIndex + OPCODE_LENGTH(op_ret) <= m_inlineStackTop->m_codeBlock->instructions().size());
+                    addToGraph(Jump, OpInfo(0));
+                    m_inlineStackTop->m_unlinkedBlocks.last().m_needsEarlyReturnLinking = true;
+                    m_inlineStackTop->m_didEarlyReturn = true;
+                }
+                LAST_OPCODE(op_ret);
+            }
+            addToGraph(Return, get(VirtualRegister(currentInstruction[1].u.operand)));
+            flushForReturn();
+            LAST_OPCODE(op_ret);
+            
+        case op_end:
+            ASSERT(!inlineCallFrame());
+            addToGraph(Return, get(VirtualRegister(currentInstruction[1].u.operand)));
+            flushForReturn();
+            LAST_OPCODE(op_end);
+
+        case op_throw:
+            addToGraph(Throw, get(VirtualRegister(currentInstruction[1].u.operand)));
+            flushForTerminal();
+            addToGraph(Unreachable);
+            LAST_OPCODE(op_throw);
+            
+        case op_throw_static_error:
+            addToGraph(Phantom, get(VirtualRegister(currentInstruction[1].u.operand))); // Keep argument live.
+            addToGraph(ThrowStaticError);
+            flushForTerminal();
+            addToGraph(Unreachable);
+            LAST_OPCODE(op_throw_static_error);
+
+        case op_catch:
+            m_graph.m_hasExceptionHandlers = true;
+            NEXT_OPCODE(op_catch);
+            
+        case op_call:
+            handleCall(currentInstruction, Call, CallMode::Regular);
+            ASSERT_WITH_MESSAGE(m_currentInstruction == currentInstruction, "handleCall, which may have inlined the callee, trashed m_currentInstruction");
+            NEXT_OPCODE(op_call);
+
+        case op_tail_call: {
+            flushForReturn();
+            Terminality terminality = handleCall(currentInstruction, TailCall, CallMode::Tail);
+            ASSERT_WITH_MESSAGE(m_currentInstruction == currentInstruction, "handleCall, which may have inlined the callee, trashed m_currentInstruction");
+            // If the call is terminal then we should not parse any further bytecodes as the TailCall will exit the function.
+            // If the call is not terminal, however, then we want the subsequent op_ret/op_jump to update metadata and clean
+            // things up.
+            if (terminality == NonTerminal)
+                NEXT_OPCODE(op_tail_call);
+            else
+                LAST_OPCODE(op_tail_call);
+        }
+
+        case op_construct:
+            handleCall(currentInstruction, Construct, CallMode::Construct);
+            ASSERT_WITH_MESSAGE(m_currentInstruction == currentInstruction, "handleCall, which may have inlined the callee, trashed m_currentInstruction");
+            NEXT_OPCODE(op_construct);
+            
+        case op_call_varargs: {
+            handleVarargsCall(currentInstruction, CallVarargs, CallMode::Regular);
+            ASSERT_WITH_MESSAGE(m_currentInstruction == currentInstruction, "handleVarargsCall, which may have inlined the callee, trashed m_currentInstruction");
+            NEXT_OPCODE(op_call_varargs);
+        }
+
+        case op_tail_call_varargs: {
+            flushForReturn();
+            Terminality terminality = handleVarargsCall(currentInstruction, TailCallVarargs, CallMode::Tail);
+            ASSERT_WITH_MESSAGE(m_currentInstruction == currentInstruction, "handleVarargsCall, which may have inlined the callee, trashed m_currentInstruction");
+            // If the call is terminal then we should not parse any further bytecodes as the TailCall will exit the function.
+            // If the call is not terminal, however, then we want the subsequent op_ret/op_jump to update metadata and clean
+            // things up.
+            if (terminality == NonTerminal)
+                NEXT_OPCODE(op_tail_call_varargs);
+            else
+                LAST_OPCODE(op_tail_call_varargs);
+        }
+
+        case op_tail_call_forward_arguments: {
+            // We need to make sure that we don't unbox our arguments here since that won't be
+            // done by the arguments object creation node as that node may not exist.
+            noticeArgumentsUse();
+            flushForReturn();
+            Terminality terminality = handleVarargsCall(currentInstruction, TailCallForwardVarargs, CallMode::Tail);
+            ASSERT_WITH_MESSAGE(m_currentInstruction == currentInstruction, "handleVarargsCall, which may have inlined the callee, trashed m_currentInstruction");
+            // If the call is terminal then we should not parse any further bytecodes as the TailCall will exit the function.
+            // If the call is not terminal, however, then we want the subsequent op_ret/op_jump to update metadata and clean
+            // things up.
+            if (terminality == NonTerminal)
+                NEXT_OPCODE(op_tail_call);
+            else
+                LAST_OPCODE(op_tail_call);
+        }
+            
+        case op_construct_varargs: {
+            handleVarargsCall(currentInstruction, ConstructVarargs, CallMode::Construct);
+            ASSERT_WITH_MESSAGE(m_currentInstruction == currentInstruction, "handleVarargsCall, which may have inlined the callee, trashed m_currentInstruction");
+            NEXT_OPCODE(op_construct_varargs);
+        }
+            
+        case op_call_eval: {
+            int result = currentInstruction[1].u.operand;
+            int callee = currentInstruction[2].u.operand;
+            int argumentCountIncludingThis = currentInstruction[3].u.operand;
+            int registerOffset = -currentInstruction[4].u.operand;
+            addCall(result, CallEval, nullptr, get(VirtualRegister(callee)), argumentCountIncludingThis, registerOffset, getPrediction());
+            NEXT_OPCODE(op_call_eval);
+        }
+            
+        case op_jneq_ptr: {
+            Special::Pointer specialPointer = currentInstruction[2].u.specialPointer;
+            ASSERT(pointerIsCell(specialPointer));
+            JSCell* actualPointer = static_cast<JSCell*>(
+                actualPointerFor(m_inlineStackTop->m_codeBlock, specialPointer));
+            FrozenValue* frozenPointer = m_graph.freeze(actualPointer);
+            int operand = currentInstruction[1].u.operand;
+            unsigned relativeOffset = currentInstruction[3].u.operand;
+            Node* child = get(VirtualRegister(operand));
+            if (currentInstruction[4].u.operand) {
+                Node* condition = addToGraph(CompareEqPtr, OpInfo(frozenPointer), child);
+                addToGraph(Branch, OpInfo(branchData(m_currentIndex + OPCODE_LENGTH(op_jneq_ptr), m_currentIndex + relativeOffset)), condition);
+                LAST_OPCODE(op_jneq_ptr);
+            }
+            addToGraph(CheckCell, OpInfo(frozenPointer), child);
+            NEXT_OPCODE(op_jneq_ptr);
+        }
+
+        case op_resolve_scope: {
+            int dst = currentInstruction[1].u.operand;
+            ResolveType resolveType = static_cast<ResolveType>(currentInstruction[4].u.operand);
+            unsigned depth = currentInstruction[5].u.operand;
+            int scope = currentInstruction[2].u.operand;
+
+            if (needsDynamicLookup(resolveType, op_resolve_scope)) {
+                unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
+                set(VirtualRegister(dst), addToGraph(ResolveScope, OpInfo(identifierNumber), get(VirtualRegister(scope))));
+                NEXT_OPCODE(op_resolve_scope);
+            }
+
+            // get_from_scope and put_to_scope depend on this watchpoint forcing OSR exit, so they don't add their own watchpoints.
+            if (needsVarInjectionChecks(resolveType))
+                m_graph.watchpoints().addLazily(m_inlineStackTop->m_codeBlock->globalObject()->varInjectionWatchpoint());
+
+            switch (resolveType) {
+            case GlobalProperty:
+            case GlobalVar:
+            case GlobalPropertyWithVarInjectionChecks:
+            case GlobalVarWithVarInjectionChecks:
+            case GlobalLexicalVar:
+            case GlobalLexicalVarWithVarInjectionChecks: {
+                JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_inlineStackTop->m_codeBlock);
+                RELEASE_ASSERT(constantScope);
+                RELEASE_ASSERT(static_cast<JSScope*>(currentInstruction[6].u.pointer) == constantScope);
+                set(VirtualRegister(dst), weakJSConstant(constantScope));
+                addToGraph(Phantom, get(VirtualRegister(scope)));
+                break;
+            }
+            case ModuleVar: {
+                // Since the value of the "scope" virtual register is not used in LLInt / baseline op_resolve_scope with ModuleVar,
+                // we need not to keep it alive by the Phantom node.
+                JSModuleEnvironment* moduleEnvironment = jsCast<JSModuleEnvironment*>(currentInstruction[6].u.jsCell.get());
+                // Module environment is already strongly referenced by the CodeBlock.
+                set(VirtualRegister(dst), weakJSConstant(moduleEnvironment));
+                break;
+            }
+            case LocalClosureVar:
+            case ClosureVar:
+            case ClosureVarWithVarInjectionChecks: {
+                Node* localBase = get(VirtualRegister(scope));
+                addToGraph(Phantom, localBase); // OSR exit cannot handle resolve_scope on a DCE'd scope.
+                
+                // We have various forms of constant folding here. This is necessary to avoid
+                // spurious recompiles in dead-but-foldable code.
+                if (SymbolTable* symbolTable = currentInstruction[6].u.symbolTable.get()) {
+                    InferredValue* singleton = symbolTable->singletonScope();
+                    if (JSValue value = singleton->inferredValue()) {
+                        m_graph.watchpoints().addLazily(singleton);
+                        set(VirtualRegister(dst), weakJSConstant(value));
+                        break;
+                    }
+                }
+                if (JSScope* scope = localBase->dynamicCastConstant<JSScope*>()) {
+                    for (unsigned n = depth; n--;)
+                        scope = scope->next();
+                    set(VirtualRegister(dst), weakJSConstant(scope));
+                    break;
+                }
+                for (unsigned n = depth; n--;)
+                    localBase = addToGraph(SkipScope, localBase);
+                set(VirtualRegister(dst), localBase);
+                break;
+            }
+            case UnresolvedProperty:
+            case UnresolvedPropertyWithVarInjectionChecks: {
+                addToGraph(Phantom, get(VirtualRegister(scope)));
+                addToGraph(ForceOSRExit);
+                set(VirtualRegister(dst), addToGraph(JSConstant, OpInfo(m_constantNull)));
+                break;
+            }
+            case Dynamic:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            NEXT_OPCODE(op_resolve_scope);
+        }
+
+        case op_get_from_scope: {
+            int dst = currentInstruction[1].u.operand;
+            int scope = currentInstruction[2].u.operand;
+            unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
+            UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
+            ResolveType resolveType = GetPutInfo(currentInstruction[4].u.operand).resolveType();
+
+            Structure* structure = 0;
+            WatchpointSet* watchpoints = 0;
+            uintptr_t operand;
+            {
+                ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
+                if (resolveType == GlobalVar || resolveType == GlobalVarWithVarInjectionChecks || resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)
+                    watchpoints = currentInstruction[5].u.watchpointSet;
+                else if (resolveType != UnresolvedProperty && resolveType != UnresolvedPropertyWithVarInjectionChecks)
+                    structure = currentInstruction[5].u.structure.get();
+                operand = reinterpret_cast<uintptr_t>(currentInstruction[6].u.pointer);
+            }
+
+            if (needsDynamicLookup(resolveType, op_get_from_scope)) {
+                set(VirtualRegister(dst),
+                    addToGraph(GetDynamicVar, OpInfo(identifierNumber), OpInfo(currentInstruction[4].u.operand), get(VirtualRegister(scope))));
+                NEXT_OPCODE(op_get_from_scope);
+            }
+
+            UNUSED_PARAM(watchpoints); // We will use this in the future. For now we set it as a way of documenting the fact that that's what index 5 is in GlobalVar mode.
+
+            JSGlobalObject* globalObject = m_inlineStackTop->m_codeBlock->globalObject();
+
+            switch (resolveType) {
+            case GlobalProperty:
+            case GlobalPropertyWithVarInjectionChecks: {
+                SpeculatedType prediction = getPrediction();
+
+                GetByIdStatus status = GetByIdStatus::computeFor(structure, uid);
+                if (status.state() != GetByIdStatus::Simple
+                    || status.numVariants() != 1
+                    || status[0].structureSet().size() != 1) {
+                    set(VirtualRegister(dst), addToGraph(GetByIdFlush, OpInfo(identifierNumber), OpInfo(prediction), get(VirtualRegister(scope))));
+                    break;
+                }
+
+                Node* base = weakJSConstant(globalObject);
+                Node* result = load(prediction, base, identifierNumber, status[0]);
+                addToGraph(Phantom, get(VirtualRegister(scope)));
+                set(VirtualRegister(dst), result);
+                break;
+            }
+            case GlobalVar:
+            case GlobalVarWithVarInjectionChecks:
+            case GlobalLexicalVar:
+            case GlobalLexicalVarWithVarInjectionChecks: {
+                addToGraph(Phantom, get(VirtualRegister(scope)));
+                WatchpointSet* watchpointSet;
+                ScopeOffset offset;
+                JSSegmentedVariableObject* scopeObject = jsCast<JSSegmentedVariableObject*>(JSScope::constantScopeForCodeBlock(resolveType, m_inlineStackTop->m_codeBlock));
+                {
+                    ConcurrentJSLocker locker(scopeObject->symbolTable()->m_lock);
+                    SymbolTableEntry entry = scopeObject->symbolTable()->get(locker, uid);
+                    watchpointSet = entry.watchpointSet();
+                    offset = entry.scopeOffset();
+                }
+                if (watchpointSet && watchpointSet->state() == IsWatched) {
+                    // This has a fun concurrency story. There is the possibility of a race in two
+                    // directions:
+                    //
+                    // We see that the set IsWatched, but in the meantime it gets invalidated: this is
+                    // fine because if we saw that it IsWatched then we add a watchpoint. If it gets
+                    // invalidated, then this compilation is invalidated. Note that in the meantime we
+                    // may load an absurd value from the global object. It's fine to load an absurd
+                    // value if the compilation is invalidated anyway.
+                    //
+                    // We see that the set IsWatched, but the value isn't yet initialized: this isn't
+                    // possible because of the ordering of operations.
+                    //
+                    // Here's how we order operations:
+                    //
+                    // Main thread stores to the global object: always store a value first, and only
+                    // after that do we touch the watchpoint set. There is a fence in the touch, that
+                    // ensures that the store to the global object always happens before the touch on the
+                    // set.
+                    //
+                    // Compilation thread: always first load the state of the watchpoint set, and then
+                    // load the value. The WatchpointSet::state() method does fences for us to ensure
+                    // that the load of the state happens before our load of the value.
+                    //
+                    // Finalizing compilation: this happens on the main thread and synchronously checks
+                    // validity of all watchpoint sets.
+                    //
+                    // We will only perform optimizations if the load of the state yields IsWatched. That
+                    // means that at least one store would have happened to initialize the original value
+                    // of the variable (that is, the value we'd like to constant fold to). There may be
+                    // other stores that happen after that, but those stores will invalidate the
+                    // watchpoint set and also the compilation.
+                    
+                    // Note that we need to use the operand, which is a direct pointer at the global,
+                    // rather than looking up the global by doing variableAt(offset). That's because the
+                    // internal data structures of JSSegmentedVariableObject are not thread-safe even
+                    // though accessing the global itself is. The segmentation involves a vector spine
+                    // that resizes with malloc/free, so if new globals unrelated to the one we are
+                    // reading are added, we might access freed memory if we do variableAt().
+                    WriteBarrier<Unknown>* pointer = bitwise_cast<WriteBarrier<Unknown>*>(operand);
+                    
+                    ASSERT(scopeObject->findVariableIndex(pointer) == offset);
+                    
+                    JSValue value = pointer->get();
+                    if (value) {
+                        m_graph.watchpoints().addLazily(watchpointSet);
+                        set(VirtualRegister(dst), weakJSConstant(value));
+                        break;
+                    }
+                }
+                
+                SpeculatedType prediction = getPrediction();
+                NodeType nodeType;
+                if (resolveType == GlobalVar || resolveType == GlobalVarWithVarInjectionChecks)
+                    nodeType = GetGlobalVar;
+                else
+                    nodeType = GetGlobalLexicalVariable;
+                Node* value = addToGraph(nodeType, OpInfo(operand), OpInfo(prediction));
+                if (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)
+                    addToGraph(CheckNotEmpty, value);
+                set(VirtualRegister(dst), value);
+                break;
+            }
+            case LocalClosureVar:
+            case ClosureVar:
+            case ClosureVarWithVarInjectionChecks: {
+                Node* scopeNode = get(VirtualRegister(scope));
+                
+                // Ideally we wouldn't have to do this Phantom. But:
+                //
+                // For the constant case: we must do it because otherwise we would have no way of knowing
+                // that the scope is live at OSR here.
+                //
+                // For the non-constant case: GetClosureVar could be DCE'd, but baseline's implementation
+                // won't be able to handle an Undefined scope.
+                addToGraph(Phantom, scopeNode);
+                
+                // Constant folding in the bytecode parser is important for performance. This may not
+                // have executed yet. If it hasn't, then we won't have a prediction. Lacking a
+                // prediction, we'd otherwise think that it has to exit. Then when it did execute, we
+                // would recompile. But if we can fold it here, we avoid the exit.
+                if (JSValue value = m_graph.tryGetConstantClosureVar(scopeNode, ScopeOffset(operand))) {
+                    set(VirtualRegister(dst), weakJSConstant(value));
+                    break;
+                }
+                SpeculatedType prediction = getPrediction();
+                set(VirtualRegister(dst),
+                    addToGraph(GetClosureVar, OpInfo(operand), OpInfo(prediction), scopeNode));
+                break;
+            }
+            case UnresolvedProperty:
+            case UnresolvedPropertyWithVarInjectionChecks:
+            case ModuleVar:
+            case Dynamic:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            NEXT_OPCODE(op_get_from_scope);
+        }
+
+        case op_put_to_scope: {
+            unsigned scope = currentInstruction[1].u.operand;
+            unsigned identifierNumber = currentInstruction[2].u.operand;
+            if (identifierNumber != UINT_MAX)
+                identifierNumber = m_inlineStackTop->m_identifierRemap[identifierNumber];
+            unsigned value = currentInstruction[3].u.operand;
+            GetPutInfo getPutInfo = GetPutInfo(currentInstruction[4].u.operand);
+            ResolveType resolveType = getPutInfo.resolveType();
+            UniquedStringImpl* uid;
+            if (identifierNumber != UINT_MAX)
+                uid = m_graph.identifiers()[identifierNumber];
+            else
+                uid = nullptr;
+            
+            Structure* structure = nullptr;
+            WatchpointSet* watchpoints = nullptr;
+            uintptr_t operand;
+            {
+                ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
+                if (resolveType == GlobalVar || resolveType == GlobalVarWithVarInjectionChecks || resolveType == LocalClosureVar || resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)
+                    watchpoints = currentInstruction[5].u.watchpointSet;
+                else if (resolveType != UnresolvedProperty && resolveType != UnresolvedPropertyWithVarInjectionChecks)
+                    structure = currentInstruction[5].u.structure.get();
+                operand = reinterpret_cast<uintptr_t>(currentInstruction[6].u.pointer);
+            }
+
+            JSGlobalObject* globalObject = m_inlineStackTop->m_codeBlock->globalObject();
+
+            if (needsDynamicLookup(resolveType, op_put_to_scope)) {
+                ASSERT(identifierNumber != UINT_MAX);
+                addToGraph(PutDynamicVar, OpInfo(identifierNumber), OpInfo(currentInstruction[4].u.operand), get(VirtualRegister(scope)), get(VirtualRegister(value)));
+                NEXT_OPCODE(op_put_to_scope);
+            }
+
+            switch (resolveType) {
+            case GlobalProperty:
+            case GlobalPropertyWithVarInjectionChecks: {
+                PutByIdStatus status;
+                if (uid)
+                    status = PutByIdStatus::computeFor(globalObject, structure, uid, false);
+                else
+                    status = PutByIdStatus(PutByIdStatus::TakesSlowPath);
+                if (status.numVariants() != 1
+                    || status[0].kind() != PutByIdVariant::Replace
+                    || status[0].structure().size() != 1) {
+                    addToGraph(PutById, OpInfo(identifierNumber), get(VirtualRegister(scope)), get(VirtualRegister(value)));
+                    break;
+                }
+                Node* base = weakJSConstant(globalObject);
+                store(base, identifierNumber, status[0], get(VirtualRegister(value)));
+                // Keep scope alive until after put.
+                addToGraph(Phantom, get(VirtualRegister(scope)));
+                break;
+            }
+            case GlobalLexicalVar:
+            case GlobalLexicalVarWithVarInjectionChecks:
+            case GlobalVar:
+            case GlobalVarWithVarInjectionChecks: {
+                if (!isInitialization(getPutInfo.initializationMode()) && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) {
+                    SpeculatedType prediction = SpecEmpty;
+                    Node* value = addToGraph(GetGlobalLexicalVariable, OpInfo(operand), OpInfo(prediction));
+                    addToGraph(CheckNotEmpty, value);
+                }
+
+                JSSegmentedVariableObject* scopeObject = jsCast<JSSegmentedVariableObject*>(JSScope::constantScopeForCodeBlock(resolveType, m_inlineStackTop->m_codeBlock));
+                if (watchpoints) {
+                    SymbolTableEntry entry = scopeObject->symbolTable()->get(uid);
+                    ASSERT_UNUSED(entry, watchpoints == entry.watchpointSet());
+                }
+                Node* valueNode = get(VirtualRegister(value));
+                addToGraph(PutGlobalVariable, OpInfo(operand), weakJSConstant(scopeObject), valueNode);
+                if (watchpoints && watchpoints->state() != IsInvalidated) {
+                    // Must happen after the store. See comment for GetGlobalVar.
+                    addToGraph(NotifyWrite, OpInfo(watchpoints));
+                }
+                // Keep scope alive until after put.
+                addToGraph(Phantom, get(VirtualRegister(scope)));
+                break;
+            }
+            case LocalClosureVar:
+            case ClosureVar:
+            case ClosureVarWithVarInjectionChecks: {
+                Node* scopeNode = get(VirtualRegister(scope));
+                Node* valueNode = get(VirtualRegister(value));
+
+                addToGraph(PutClosureVar, OpInfo(operand), scopeNode, valueNode);
+
+                if (watchpoints && watchpoints->state() != IsInvalidated) {
+                    // Must happen after the store. See comment for GetGlobalVar.
+                    addToGraph(NotifyWrite, OpInfo(watchpoints));
+                }
+                break;
+            }
+
+            case ModuleVar:
+                // Need not to keep "scope" and "value" register values here by Phantom because
+                // they are not used in LLInt / baseline op_put_to_scope with ModuleVar.
+                addToGraph(ForceOSRExit);
+                break;
+
+            case Dynamic:
+            case UnresolvedProperty:
+            case UnresolvedPropertyWithVarInjectionChecks:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            NEXT_OPCODE(op_put_to_scope);
+        }
+
+        case op_loop_hint: {
+            // Baseline->DFG OSR jumps between loop hints. The DFG assumes that Baseline->DFG
+            // OSR can only happen at basic block boundaries. Assert that these two statements
+            // are compatible.
+            RELEASE_ASSERT(m_currentIndex == blockBegin);
+            
+            // We never do OSR into an inlined code block. That could not happen, since OSR
+            // looks up the code block that is the replacement for the baseline JIT code
+            // block. Hence, machine code block = true code block = not inline code block.
+            if (!m_inlineStackTop->m_caller)
+                m_currentBlock->isOSRTarget = true;
+
+            addToGraph(LoopHint);
+            NEXT_OPCODE(op_loop_hint);
+        }
+        
+        case op_watchdog: {
+            addToGraph(CheckWatchdogTimer);
+            NEXT_OPCODE(op_watchdog); 
+        }
+            
+        case op_create_lexical_environment: {
+            VirtualRegister symbolTableRegister(currentInstruction[3].u.operand);
+            VirtualRegister initialValueRegister(currentInstruction[4].u.operand);
+            ASSERT(symbolTableRegister.isConstant() && initialValueRegister.isConstant());
+            FrozenValue* symbolTable = m_graph.freezeStrong(m_inlineStackTop->m_codeBlock->getConstant(symbolTableRegister.offset()));
+            FrozenValue* initialValue = m_graph.freezeStrong(m_inlineStackTop->m_codeBlock->getConstant(initialValueRegister.offset()));
+            Node* scope = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* lexicalEnvironment = addToGraph(CreateActivation, OpInfo(symbolTable), OpInfo(initialValue), scope);
+            set(VirtualRegister(currentInstruction[1].u.operand), lexicalEnvironment);
+            NEXT_OPCODE(op_create_lexical_environment);
+        }
+
+        case op_get_parent_scope: {
+            Node* currentScope = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* newScope = addToGraph(SkipScope, currentScope);
+            set(VirtualRegister(currentInstruction[1].u.operand), newScope);
+            addToGraph(Phantom, currentScope);
+            NEXT_OPCODE(op_get_parent_scope);
+        }
+
+        case op_get_scope: {
+            // Help the later stages a bit by doing some small constant folding here. Note that this
+            // only helps for the first basic block. It's extremely important not to constant fold
+            // loads from the scope register later, as that would prevent the DFG from tracking the
+            // bytecode-level liveness of the scope register.
+            Node* callee = get(VirtualRegister(CallFrameSlot::callee));
+            Node* result;
+            if (JSFunction* function = callee->dynamicCastConstant<JSFunction*>())
+                result = weakJSConstant(function->scope());
+            else
+                result = addToGraph(GetScope, callee);
+            set(VirtualRegister(currentInstruction[1].u.operand), result);
+            NEXT_OPCODE(op_get_scope);
+        }
+
+        case op_argument_count: {
+            Node* sub = addToGraph(ArithSub, OpInfo(Arith::Unchecked), OpInfo(SpecInt32Only), getArgumentCount(), addToGraph(JSConstant, OpInfo(m_constantOne)));
+
+            set(VirtualRegister(currentInstruction[1].u.operand), sub);
+            NEXT_OPCODE(op_argument_count);
+        }
+
+        case op_create_direct_arguments: {
+            noticeArgumentsUse();
+            Node* createArguments = addToGraph(CreateDirectArguments);
+            set(VirtualRegister(currentInstruction[1].u.operand), createArguments);
+            NEXT_OPCODE(op_create_direct_arguments);
+        }
+            
+        case op_create_scoped_arguments: {
+            noticeArgumentsUse();
+            Node* createArguments = addToGraph(CreateScopedArguments, get(VirtualRegister(currentInstruction[2].u.operand)));
+            set(VirtualRegister(currentInstruction[1].u.operand), createArguments);
+            NEXT_OPCODE(op_create_scoped_arguments);
+        }
+
+        case op_create_cloned_arguments: {
+            noticeArgumentsUse();
+            Node* createArguments = addToGraph(CreateClonedArguments);
+            set(VirtualRegister(currentInstruction[1].u.operand), createArguments);
+            NEXT_OPCODE(op_create_cloned_arguments);
+        }
+            
+        case op_get_from_arguments: {
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(
+                    GetFromArguments,
+                    OpInfo(currentInstruction[3].u.operand),
+                    OpInfo(getPrediction()),
+                    get(VirtualRegister(currentInstruction[2].u.operand))));
+            NEXT_OPCODE(op_get_from_arguments);
+        }
+            
+        case op_put_to_arguments: {
+            addToGraph(
+                PutToArguments,
+                OpInfo(currentInstruction[2].u.operand),
+                get(VirtualRegister(currentInstruction[1].u.operand)),
+                get(VirtualRegister(currentInstruction[3].u.operand)));
+            NEXT_OPCODE(op_put_to_arguments);
+        }
+
+        case op_get_argument: {
+            InlineCallFrame* inlineCallFrame = this->inlineCallFrame();
+            Node* argument;
+            int32_t argumentIndexIncludingThis = currentInstruction[2].u.operand;
+            if (inlineCallFrame && !inlineCallFrame->isVarargs()) {
+                int32_t argumentCountIncludingThis = inlineCallFrame->arguments.size();
+                if (argumentIndexIncludingThis < argumentCountIncludingThis)
+                    argument = get(virtualRegisterForArgument(argumentIndexIncludingThis));
+                else
+                    argument = addToGraph(JSConstant, OpInfo(m_constantUndefined));
+            } else
+                argument = addToGraph(GetArgument, OpInfo(argumentIndexIncludingThis), OpInfo(getPrediction()));
+            set(VirtualRegister(currentInstruction[1].u.operand), argument);
+            NEXT_OPCODE(op_get_argument);
+        }
+            
+        case op_new_func:
+        case op_new_generator_func:
+        case op_new_async_func: {
+            FunctionExecutable* decl = m_inlineStackTop->m_profiledBlock->functionDecl(currentInstruction[3].u.operand);
+            FrozenValue* frozen = m_graph.freezeStrong(decl);
+            NodeType op = (opcodeID == op_new_generator_func) ? NewGeneratorFunction :
+                (opcodeID == op_new_async_func) ? NewAsyncFunction : NewFunction;
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(op, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
+            static_assert(OPCODE_LENGTH(op_new_func) == OPCODE_LENGTH(op_new_generator_func), "The length of op_new_func should eqaual to one of op_new_generator_func");
+            static_assert(OPCODE_LENGTH(op_new_func) == OPCODE_LENGTH(op_new_async_func), "The length of op_new_func should eqaual to one of op_new_async_func");
+            NEXT_OPCODE(op_new_func);
+        }
+
+        case op_new_func_exp:
+        case op_new_generator_func_exp:
+        case op_new_async_func_exp: {
+            FunctionExecutable* expr = m_inlineStackTop->m_profiledBlock->functionExpr(currentInstruction[3].u.operand);
+            FrozenValue* frozen = m_graph.freezeStrong(expr);
+            NodeType op = (opcodeID == op_new_generator_func_exp) ? NewGeneratorFunction :
+                (opcodeID == op_new_async_func_exp) ? NewAsyncFunction : NewFunction;
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(op, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
+    
+            static_assert(OPCODE_LENGTH(op_new_func_exp) == OPCODE_LENGTH(op_new_generator_func_exp), "The length of op_new_func_exp should eqaual to one of op_new_generator_func_exp");
+            static_assert(OPCODE_LENGTH(op_new_func_exp) == OPCODE_LENGTH(op_new_async_func_exp), "The length of op_new_func_exp should eqaual to one of op_new_async_func_exp");
+            NEXT_OPCODE(op_new_func_exp);
+        }
+
+        case op_set_function_name: {
+            Node* func = get(VirtualRegister(currentInstruction[1].u.operand));
+            Node* name = get(VirtualRegister(currentInstruction[2].u.operand));
+            addToGraph(SetFunctionName, func, name);
+            NEXT_OPCODE(op_set_function_name);
+        }
+
+        case op_typeof: {
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(TypeOf, get(VirtualRegister(currentInstruction[2].u.operand))));
+            NEXT_OPCODE(op_typeof);
+        }
+
+        case op_to_number: {
+            SpeculatedType prediction = getPrediction();
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(ToNumber, OpInfo(0), OpInfo(prediction), value));
+            NEXT_OPCODE(op_to_number);
+        }
+
+        case op_to_string: {
+            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(ToString, value));
+            NEXT_OPCODE(op_to_string);
+        }
+
+        case op_in: {
+            set(VirtualRegister(currentInstruction[1].u.operand),
+                addToGraph(In, get(VirtualRegister(currentInstruction[2].u.operand)), get(VirtualRegister(currentInstruction[3].u.operand))));
+            NEXT_OPCODE(op_in);
+        }
+
+        case op_get_enumerable_length: {
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(GetEnumerableLength, 
+                get(VirtualRegister(currentInstruction[2].u.operand))));
+            NEXT_OPCODE(op_get_enumerable_length);
+        }
+
+        case op_has_generic_property: {
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(HasGenericProperty, 
+                get(VirtualRegister(currentInstruction[2].u.operand)),
+                get(VirtualRegister(currentInstruction[3].u.operand))));
+            NEXT_OPCODE(op_has_generic_property);
+        }
+
+        case op_has_structure_property: {
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(HasStructureProperty, 
+                get(VirtualRegister(currentInstruction[2].u.operand)),
+                get(VirtualRegister(currentInstruction[3].u.operand)),
+                get(VirtualRegister(currentInstruction[4].u.operand))));
+            NEXT_OPCODE(op_has_structure_property);
+        }
+
+        case op_has_indexed_property: {
+            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
+            ArrayMode arrayMode = getArrayMode(currentInstruction[4].u.arrayProfile, Array::Read);
+            Node* property = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* hasIterableProperty = addToGraph(HasIndexedProperty, OpInfo(arrayMode.asWord()), base, property);
+            set(VirtualRegister(currentInstruction[1].u.operand), hasIterableProperty);
+            NEXT_OPCODE(op_has_indexed_property);
+        }
+
+        case op_get_direct_pname: {
+            SpeculatedType prediction = getPredictionWithoutOSRExit();
+            
+            Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
+            Node* property = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* index = get(VirtualRegister(currentInstruction[4].u.operand));
+            Node* enumerator = get(VirtualRegister(currentInstruction[5].u.operand));
+
+            addVarArgChild(base);
+            addVarArgChild(property);
+            addVarArgChild(index);
+            addVarArgChild(enumerator);
+            set(VirtualRegister(currentInstruction[1].u.operand), 
+                addToGraph(Node::VarArg, GetDirectPname, OpInfo(0), OpInfo(prediction)));
+
+            NEXT_OPCODE(op_get_direct_pname);
+        }
+
+        case op_get_property_enumerator: {
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(GetPropertyEnumerator, 
+                get(VirtualRegister(currentInstruction[2].u.operand))));
+            NEXT_OPCODE(op_get_property_enumerator);
+        }
+
+        case op_enumerator_structure_pname: {
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(GetEnumeratorStructurePname,
+                get(VirtualRegister(currentInstruction[2].u.operand)),
+                get(VirtualRegister(currentInstruction[3].u.operand))));
+            NEXT_OPCODE(op_enumerator_structure_pname);
+        }
+
+        case op_enumerator_generic_pname: {
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(GetEnumeratorGenericPname,
+                get(VirtualRegister(currentInstruction[2].u.operand)),
+                get(VirtualRegister(currentInstruction[3].u.operand))));
+            NEXT_OPCODE(op_enumerator_generic_pname);
+        }
+            
+        case op_to_index_string: {
+            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(ToIndexString, 
+                get(VirtualRegister(currentInstruction[2].u.operand))));
+            NEXT_OPCODE(op_to_index_string);
+        }
+            
+        case op_log_shadow_chicken_prologue: {
+            if (!m_inlineStackTop->m_inlineCallFrame)
+                addToGraph(LogShadowChickenPrologue, get(VirtualRegister(currentInstruction[1].u.operand)));
+            NEXT_OPCODE(op_log_shadow_chicken_prologue);
+        }
+
+        case op_log_shadow_chicken_tail: {
+            if (!m_inlineStackTop->m_inlineCallFrame) {
+                // FIXME: The right solution for inlining is to elide these whenever the tail call
+                // ends up being inlined.
+                // https://bugs.webkit.org/show_bug.cgi?id=155686
+                addToGraph(LogShadowChickenTail, get(VirtualRegister(currentInstruction[1].u.operand)), get(VirtualRegister(currentInstruction[2].u.operand)));
+            }
+            NEXT_OPCODE(op_log_shadow_chicken_tail);
+        }
+
+        default:
+            // Parse failed! This should not happen because the capabilities checker
+            // should have caught it.
+            RELEASE_ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+}
+
+void ByteCodeParser::linkBlock(BasicBlock* block, Vector<BasicBlock*>& possibleTargets)
+{
+    ASSERT(!block->isLinked);
+    ASSERT(!block->isEmpty());
+    Node* node = block->terminal();
+    ASSERT(node->isTerminal());
+    
+    switch (node->op()) {
+    case Jump:
+        node->targetBlock() = blockForBytecodeOffset(possibleTargets, node->targetBytecodeOffsetDuringParsing());
+        break;
+        
+    case Branch: {
+        BranchData* data = node->branchData();
+        data->taken.block = blockForBytecodeOffset(possibleTargets, data->takenBytecodeIndex());
+        data->notTaken.block = blockForBytecodeOffset(possibleTargets, data->notTakenBytecodeIndex());
+        break;
+    }
+        
+    case Switch: {
+        SwitchData* data = node->switchData();
+        for (unsigned i = node->switchData()->cases.size(); i--;)
+            data->cases[i].target.block = blockForBytecodeOffset(possibleTargets, data->cases[i].target.bytecodeIndex());
+        data->fallThrough.block = blockForBytecodeOffset(possibleTargets, data->fallThrough.bytecodeIndex());
+        break;
+    }
+        
+    default:
+        break;
+    }
+    
+    if (verbose)
+        dataLog("Marking ", RawPointer(block), " as linked (actually did linking)\n");
+    block->didLink();
+}
+
+void ByteCodeParser::linkBlocks(Vector<UnlinkedBlock>& unlinkedBlocks, Vector<BasicBlock*>& possibleTargets)
+{
+    for (size_t i = 0; i < unlinkedBlocks.size(); ++i) {
+        if (verbose)
+            dataLog("Attempting to link ", RawPointer(unlinkedBlocks[i].m_block), "\n");
+        if (unlinkedBlocks[i].m_needsNormalLinking) {
+            if (verbose)
+                dataLog("    Does need normal linking.\n");
+            linkBlock(unlinkedBlocks[i].m_block, possibleTargets);
+            unlinkedBlocks[i].m_needsNormalLinking = false;
+        }
+    }
+}
+
+ByteCodeParser::InlineStackEntry::InlineStackEntry(
+    ByteCodeParser* byteCodeParser,
+    CodeBlock* codeBlock,
+    CodeBlock* profiledBlock,
+    BasicBlock* callsiteBlockHead,
+    JSFunction* callee, // Null if this is a closure call.
+    VirtualRegister returnValueVR,
+    VirtualRegister inlineCallFrameStart,
+    int argumentCountIncludingThis,
+    InlineCallFrame::Kind kind)
+    : m_byteCodeParser(byteCodeParser)
+    , m_codeBlock(codeBlock)
+    , m_profiledBlock(profiledBlock)
+    , m_callsiteBlockHead(callsiteBlockHead)
+    , m_returnValue(returnValueVR)
+    , m_didReturn(false)
+    , m_didEarlyReturn(false)
+    , m_caller(byteCodeParser->m_inlineStackTop)
+{
+    {
+        ConcurrentJSLocker locker(m_profiledBlock->m_lock);
+        m_lazyOperands.initialize(locker, m_profiledBlock->lazyOperandValueProfiles());
+        m_exitProfile.initialize(locker, profiledBlock->exitProfile());
+        
+        // We do this while holding the lock because we want to encourage StructureStubInfo's
+        // to be potentially added to operations and because the profiled block could be in the
+        // middle of LLInt->JIT tier-up in which case we would be adding the info's right now.
+        if (m_profiledBlock->hasBaselineJITProfiling()) {
+            m_profiledBlock->getStubInfoMap(locker, m_stubInfos);
+            m_profiledBlock->getCallLinkInfoMap(locker, m_callLinkInfos);
+            m_profiledBlock->getByValInfoMap(locker, m_byValInfos);
+        }
+    }
+    
+    m_argumentPositions.resize(argumentCountIncludingThis);
+    for (int i = 0; i < argumentCountIncludingThis; ++i) {
+        byteCodeParser->m_graph.m_argumentPositions.append(ArgumentPosition());
+        ArgumentPosition* argumentPosition = &byteCodeParser->m_graph.m_argumentPositions.last();
+        m_argumentPositions[i] = argumentPosition;
+    }
+    
+    if (m_caller) {
+        // Inline case.
+        ASSERT(codeBlock != byteCodeParser->m_codeBlock);
+        ASSERT(inlineCallFrameStart.isValid());
+        ASSERT(callsiteBlockHead);
+        
+        m_inlineCallFrame = byteCodeParser->m_graph.m_plan.inlineCallFrames->add();
+
+        // The owner is the machine code block, and we already have a barrier on that when the
+        // plan finishes.
+        m_inlineCallFrame->baselineCodeBlock.setWithoutWriteBarrier(codeBlock->baselineVersion());
+        m_inlineCallFrame->setStackOffset(inlineCallFrameStart.offset() - CallFrame::headerSizeInRegisters);
+        if (callee) {
+            m_inlineCallFrame->calleeRecovery = ValueRecovery::constant(callee);
+            m_inlineCallFrame->isClosureCall = false;
+        } else
+            m_inlineCallFrame->isClosureCall = true;
+        m_inlineCallFrame->directCaller = byteCodeParser->currentCodeOrigin();
+        m_inlineCallFrame->arguments.resizeToFit(argumentCountIncludingThis); // Set the number of arguments including this, but don't configure the value recoveries, yet.
+        m_inlineCallFrame->kind = kind;
+        
+        m_identifierRemap.resize(codeBlock->numberOfIdentifiers());
+        m_constantBufferRemap.resize(codeBlock->numberOfConstantBuffers());
+        m_switchRemap.resize(codeBlock->numberOfSwitchJumpTables());
+
+        for (size_t i = 0; i < codeBlock->numberOfIdentifiers(); ++i) {
+            UniquedStringImpl* rep = codeBlock->identifier(i).impl();
+            unsigned index = byteCodeParser->m_graph.identifiers().ensure(rep);
+            m_identifierRemap[i] = index;
+        }
+        for (unsigned i = 0; i < codeBlock->numberOfConstantBuffers(); ++i) {
+            // If we inline the same code block multiple times, we don't want to needlessly
+            // duplicate its constant buffers.
+            HashMap<ConstantBufferKey, unsigned>::iterator iter =
+                byteCodeParser->m_constantBufferCache.find(ConstantBufferKey(codeBlock, i));
+            if (iter != byteCodeParser->m_constantBufferCache.end()) {
+                m_constantBufferRemap[i] = iter->value;
+                continue;
+            }
+            Vector<JSValue>& buffer = codeBlock->constantBufferAsVector(i);
+            unsigned newIndex = byteCodeParser->m_codeBlock->addConstantBuffer(buffer);
+            m_constantBufferRemap[i] = newIndex;
+            byteCodeParser->m_constantBufferCache.add(ConstantBufferKey(codeBlock, i), newIndex);
+        }
+        for (unsigned i = 0; i < codeBlock->numberOfSwitchJumpTables(); ++i) {
+            m_switchRemap[i] = byteCodeParser->m_codeBlock->numberOfSwitchJumpTables();
+            byteCodeParser->m_codeBlock->addSwitchJumpTable() = codeBlock->switchJumpTable(i);
+        }
+        m_callsiteBlockHeadNeedsLinking = true;
+    } else {
+        // Machine code block case.
+        ASSERT(codeBlock == byteCodeParser->m_codeBlock);
+        ASSERT(!callee);
+        ASSERT(!returnValueVR.isValid());
+        ASSERT(!inlineCallFrameStart.isValid());
+        ASSERT(!callsiteBlockHead);
+
+        m_inlineCallFrame = 0;
+
+        m_identifierRemap.resize(codeBlock->numberOfIdentifiers());
+        m_constantBufferRemap.resize(codeBlock->numberOfConstantBuffers());
+        m_switchRemap.resize(codeBlock->numberOfSwitchJumpTables());
+        for (size_t i = 0; i < codeBlock->numberOfIdentifiers(); ++i)
+            m_identifierRemap[i] = i;
+        for (size_t i = 0; i < codeBlock->numberOfConstantBuffers(); ++i)
+            m_constantBufferRemap[i] = i;
+        for (size_t i = 0; i < codeBlock->numberOfSwitchJumpTables(); ++i)
+            m_switchRemap[i] = i;
+        m_callsiteBlockHeadNeedsLinking = false;
+    }
+    
+    byteCodeParser->m_inlineStackTop = this;
+}
+
+void ByteCodeParser::parseCodeBlock()
+{
+    clearCaches();
+    
+    CodeBlock* codeBlock = m_inlineStackTop->m_codeBlock;
+    
+    if (m_graph.compilation()) {
+        m_graph.compilation()->addProfiledBytecodes(
+            *m_vm->m_perBytecodeProfiler, m_inlineStackTop->m_profiledBlock);
+    }
+    
+    if (UNLIKELY(Options::dumpSourceAtDFGTime())) {
+        Vector<DeferredSourceDump>& deferredSourceDump = m_graph.m_plan.callback->ensureDeferredSourceDump();
+        if (inlineCallFrame()) {
+            DeferredSourceDump dump(codeBlock->baselineVersion(), m_codeBlock, JITCode::DFGJIT, inlineCallFrame()->directCaller);
+            deferredSourceDump.append(dump);
+        } else
+            deferredSourceDump.append(DeferredSourceDump(codeBlock->baselineVersion()));
+    }
+
+    if (Options::dumpBytecodeAtDFGTime()) {
+        dataLog("Parsing ", *codeBlock);
+        if (inlineCallFrame()) {
+            dataLog(
+                " for inlining at ", CodeBlockWithJITType(m_codeBlock, JITCode::DFGJIT),
+                " ", inlineCallFrame()->directCaller);
+        }
+        dataLog(
+            ", isStrictMode = ", codeBlock->ownerScriptExecutable()->isStrictMode(), "\n");
+        codeBlock->baselineVersion()->dumpBytecode();
+    }
+    
+    Vector<unsigned, 32> jumpTargets;
+    computePreciseJumpTargets(codeBlock, jumpTargets);
+    if (Options::dumpBytecodeAtDFGTime()) {
+        dataLog("Jump targets: ");
+        CommaPrinter comma;
+        for (unsigned i = 0; i < jumpTargets.size(); ++i)
+            dataLog(comma, jumpTargets[i]);
+        dataLog("\n");
+    }
+    
+    for (unsigned jumpTargetIndex = 0; jumpTargetIndex <= jumpTargets.size(); ++jumpTargetIndex) {
+        // The maximum bytecode offset to go into the current basicblock is either the next jump target, or the end of the instructions.
+        unsigned limit = jumpTargetIndex < jumpTargets.size() ? jumpTargets[jumpTargetIndex] : codeBlock->instructions().size();
+        ASSERT(m_currentIndex < limit);
+
+        // Loop until we reach the current limit (i.e. next jump target).
+        do {
+            if (!m_currentBlock) {
+                // Check if we can use the last block.
+                if (m_graph.numBlocks() && m_graph.lastBlock()->isEmpty()) {
+                    // This must be a block belonging to us.
+                    ASSERT(m_inlineStackTop->m_unlinkedBlocks.last().m_block == m_graph.lastBlock());
+                    // Either the block is linkable or it isn't. If it's linkable then it's the last
+                    // block in the blockLinkingTargets list. If it's not then the last block will
+                    // have a lower bytecode index that the one we're about to give to this block.
+                    if (m_inlineStackTop->m_blockLinkingTargets.isEmpty() || m_inlineStackTop->m_blockLinkingTargets.last()->bytecodeBegin != m_currentIndex) {
+                        // Make the block linkable.
+                        ASSERT(m_inlineStackTop->m_blockLinkingTargets.isEmpty() || m_inlineStackTop->m_blockLinkingTargets.last()->bytecodeBegin < m_currentIndex);
+                        m_inlineStackTop->m_blockLinkingTargets.append(m_graph.lastBlock());
+                    }
+                    // Change its bytecode begin and continue.
+                    m_currentBlock = m_graph.lastBlock();
+                    m_currentBlock->bytecodeBegin = m_currentIndex;
+                } else {
+                    RefPtr<BasicBlock> block = adoptRef(new BasicBlock(m_currentIndex, m_numArguments, m_numLocals, 1));
+                    m_currentBlock = block.get();
+                    // This assertion checks two things:
+                    // 1) If the bytecodeBegin is greater than currentIndex, then something has gone
+                    //    horribly wrong. So, we're probably generating incorrect code.
+                    // 2) If the bytecodeBegin is equal to the currentIndex, then we failed to do
+                    //    a peephole coalescing of this block in the if statement above. So, we're
+                    //    generating suboptimal code and leaving more work for the CFG simplifier.
+                    if (!m_inlineStackTop->m_unlinkedBlocks.isEmpty()) {
+                        unsigned lastBegin =
+                            m_inlineStackTop->m_unlinkedBlocks.last().m_block->bytecodeBegin;
+                        ASSERT_UNUSED(
+                            lastBegin, lastBegin == UINT_MAX || lastBegin < m_currentIndex);
+                    }
+                    m_inlineStackTop->m_unlinkedBlocks.append(UnlinkedBlock(block.get()));
+                    m_inlineStackTop->m_blockLinkingTargets.append(block.get());
+                    // The first block is definitely an OSR target.
+                    if (!m_graph.numBlocks())
+                        block->isOSRTarget = true;
+                    m_graph.appendBlock(block);
+                    prepareToParseBlock();
+                }
+            }
+
+            bool shouldContinueParsing = parseBlock(limit);
+
+            // We should not have gone beyond the limit.
+            ASSERT(m_currentIndex <= limit);
+            
+            // We should have planted a terminal, or we just gave up because
+            // we realized that the jump target information is imprecise, or we
+            // are at the end of an inline function, or we realized that we
+            // should stop parsing because there was a return in the first
+            // basic block.
+            ASSERT(m_currentBlock->isEmpty() || m_currentBlock->terminal() || (m_currentIndex == codeBlock->instructions().size() && inlineCallFrame()) || !shouldContinueParsing);
+
+            if (!shouldContinueParsing) {
+                if (Options::verboseDFGByteCodeParsing())
+                    dataLog("Done parsing ", *codeBlock, "\n");
+                return;
+            }
+            
+            m_currentBlock = nullptr;
+        } while (m_currentIndex < limit);
+    }
+
+    // Should have reached the end of the instructions.
+    ASSERT(m_currentIndex == codeBlock->instructions().size());
+    
+    if (Options::verboseDFGByteCodeParsing())
+        dataLog("Done parsing ", *codeBlock, " (fell off end)\n");
+}
+
+bool ByteCodeParser::parse()
+{
+    // Set during construction.
+    ASSERT(!m_currentIndex);
+    
+    if (Options::verboseDFGByteCodeParsing())
+        dataLog("Parsing ", *m_codeBlock, "\n");
+    
+    m_dfgCodeBlock = m_graph.m_plan.profiledDFGCodeBlock;
+    if (isFTL(m_graph.m_plan.mode) && m_dfgCodeBlock
+        && Options::usePolyvariantDevirtualization()) {
+        if (Options::usePolyvariantCallInlining())
+            CallLinkStatus::computeDFGStatuses(m_dfgCodeBlock, m_callContextMap);
+        if (Options::usePolyvariantByIdInlining())
+            m_dfgCodeBlock->getStubInfoMap(m_dfgStubInfos);
+    }
+    
+    InlineStackEntry inlineStackEntry(
+        this, m_codeBlock, m_profiledBlock, 0, 0, VirtualRegister(), VirtualRegister(),
+        m_codeBlock->numParameters(), InlineCallFrame::Call);
+    
+    parseCodeBlock();
+
+    linkBlocks(inlineStackEntry.m_unlinkedBlocks, inlineStackEntry.m_blockLinkingTargets);
+    m_graph.determineReachability();
+    m_graph.killUnreachableBlocks();
+    
+    for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+        BasicBlock* block = m_graph.block(blockIndex);
+        if (!block)
+            continue;
+        ASSERT(block->variablesAtHead.numberOfLocals() == m_graph.block(0)->variablesAtHead.numberOfLocals());
+        ASSERT(block->variablesAtHead.numberOfArguments() == m_graph.block(0)->variablesAtHead.numberOfArguments());
+        ASSERT(block->variablesAtTail.numberOfLocals() == m_graph.block(0)->variablesAtHead.numberOfLocals());
+        ASSERT(block->variablesAtTail.numberOfArguments() == m_graph.block(0)->variablesAtHead.numberOfArguments());
+    }
+    
+    m_graph.m_localVars = m_numLocals;
+    m_graph.m_parameterSlots = m_parameterSlots;
+
+    return true;
+}
+
+bool parse(Graph& graph)
+{
+    return ByteCodeParser(graph).parse();
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGByteCodeParser.h b/dfg/DFGByteCodeParser.h
new file mode 100644
index 0000000..40d2abc
--- /dev/null
+++ b/dfg/DFGByteCodeParser.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+bool parse(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGCFAPhase.cpp b/dfg/DFGCFAPhase.cpp
new file mode 100644
index 0000000..83b047c
--- /dev/null
+++ b/dfg/DFGCFAPhase.cpp
@@ -0,0 +1,224 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCFAPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractInterpreterInlines.h"
+#include "DFGGraph.h"
+#include "DFGInPlaceAbstractState.h"
+#include "DFGPhase.h"
+#include "DFGSafeToExecute.h"
+#include "OperandsInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class CFAPhase : public Phase {
+public:
+    CFAPhase(Graph& graph)
+        : Phase(graph, "control flow analysis")
+        , m_state(graph)
+        , m_interpreter(graph, m_state)
+        , m_verbose(Options::verboseCFA())
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == ThreadedCPS || m_graph.m_form == SSA);
+        ASSERT(m_graph.m_unificationState == GloballyUnified);
+        ASSERT(m_graph.m_refCountState == EverythingIsLive);
+        
+        m_count = 0;
+        
+        if (m_verbose && !shouldDumpGraphAtEachPhase(m_graph.m_plan.mode)) {
+            dataLog("Graph before CFA:\n");
+            m_graph.dump();
+        }
+        
+        // This implements a pseudo-worklist-based forward CFA, except that the visit order
+        // of blocks is the bytecode program order (which is nearly topological), and
+        // instead of a worklist we just walk all basic blocks checking if cfaShouldRevisit
+        // is set to true. This is likely to balance the efficiency properties of both
+        // worklist-based and forward fixpoint-based approaches. Like a worklist-based
+        // approach, it won't visit code if it's meaningless to do so (nothing changed at
+        // the head of the block or the predecessors have not been visited). Like a forward
+        // fixpoint-based approach, it has a high probability of only visiting a block
+        // after all predecessors have been visited. Only loops will cause this analysis to
+        // revisit blocks, and the amount of revisiting is proportional to loop depth.
+        
+        m_state.initialize();
+        
+        do {
+            m_changed = false;
+            performForwardCFA();
+        } while (m_changed);
+        
+        if (m_graph.m_form != SSA) {
+            if (m_verbose)
+                dataLog("   Widening state at OSR entry block.\n");
+            
+            ASSERT(!m_changed);
+            
+            // Widen the abstract values at the block that serves as the must-handle OSR entry.
+            for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+                BasicBlock* block = m_graph.block(blockIndex);
+                if (!block)
+                    continue;
+                
+                if (!block->isOSRTarget)
+                    continue;
+                if (block->bytecodeBegin != m_graph.m_plan.osrEntryBytecodeIndex)
+                    continue;
+                
+                if (m_verbose)
+                    dataLog("   Found must-handle block: ", *block, "\n");
+                
+                bool changed = false;
+                for (size_t i = m_graph.m_plan.mustHandleValues.size(); i--;) {
+                    int operand = m_graph.m_plan.mustHandleValues.operandForIndex(i);
+                    JSValue value = m_graph.m_plan.mustHandleValues[i];
+                    Node* node = block->variablesAtHead.operand(operand);
+                    if (!node) {
+                        if (m_verbose)
+                            dataLog("   Not live: ", VirtualRegister(operand), "\n");
+                        continue;
+                    }
+                    
+                    if (m_verbose)
+                        dataLog("   Widening ", VirtualRegister(operand), " with ", value, "\n");
+
+                    AbstractValue& target = block->valuesAtHead.operand(operand);
+                    changed |= target.mergeOSREntryValue(m_graph, value);
+                    target.fixTypeForRepresentation(
+                        m_graph, resultFor(node->variableAccessData()->flushFormat()));
+                }
+                
+                if (changed || !block->cfaHasVisited) {
+                    m_changed = true;
+                    block->cfaShouldRevisit = true;
+                }
+            }
+
+            // Propagate any of the changes we just introduced.
+            while (m_changed) {
+                m_changed = false;
+                performForwardCFA();
+            }
+            
+            // Make sure we record the intersection of all proofs that we ever allowed the
+            // compiler to rely upon.
+            for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+                BasicBlock* block = m_graph.block(blockIndex);
+                if (!block)
+                    continue;
+                
+                block->intersectionOfCFAHasVisited &= block->cfaHasVisited;
+                for (unsigned i = block->intersectionOfPastValuesAtHead.size(); i--;)
+                    block->intersectionOfPastValuesAtHead[i].filter(block->valuesAtHead[i]);
+            }
+        }
+        
+        return true;
+    }
+    
+private:
+    void performBlockCFA(BasicBlock* block)
+    {
+        if (!block)
+            return;
+        if (!block->cfaShouldRevisit)
+            return;
+        if (m_verbose)
+            dataLog("   Block ", *block, ":\n");
+        m_state.beginBasicBlock(block);
+        if (m_verbose) {
+            dataLog("      head vars: ", block->valuesAtHead, "\n");
+            if (m_graph.m_form == SSA)
+                dataLog("      head regs: ", nodeValuePairListDump(block->ssa->valuesAtHead), "\n");
+        }
+        for (unsigned i = 0; i < block->size(); ++i) {
+            if (m_verbose) {
+                Node* node = block->at(i);
+                dataLogF("      %s @%u: ", Graph::opName(node->op()), node->index());
+                
+                if (!safeToExecute(m_state, m_graph, node))
+                    dataLog("(UNSAFE) ");
+                
+                dataLog(m_state.variables(), " ", m_interpreter);
+                
+                dataLogF("\n");
+            }
+            if (!m_interpreter.execute(i)) {
+                if (m_verbose)
+                    dataLogF("         Expect OSR exit.\n");
+                break;
+            }
+        }
+        if (m_verbose) {
+            dataLogF("      tail regs: ");
+            m_interpreter.dump(WTF::dataFile());
+            dataLogF("\n");
+        }
+        m_changed |= m_state.endBasicBlock();
+        
+        if (m_verbose) {
+            dataLog("      tail vars: ", block->valuesAtTail, "\n");
+            if (m_graph.m_form == SSA)
+                dataLog("      head regs: ", nodeValuePairListDump(block->ssa->valuesAtTail), "\n");
+        }
+    }
+    
+    void performForwardCFA()
+    {
+        ++m_count;
+        if (m_verbose)
+            dataLogF("CFA [%u]\n", ++m_count);
+        
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
+            performBlockCFA(m_graph.block(blockIndex));
+    }
+
+private:
+    InPlaceAbstractState m_state;
+    AbstractInterpreter<InPlaceAbstractState> m_interpreter;
+    
+    bool m_verbose;
+    
+    bool m_changed;
+    unsigned m_count;
+};
+
+bool performCFA(Graph& graph)
+{
+    return runPhase<CFAPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCFAPhase.h b/dfg/DFGCFAPhase.h
new file mode 100644
index 0000000..158f4a3
--- /dev/null
+++ b/dfg/DFGCFAPhase.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Global control flow analysis. This phase transforms the combination of type
+// predictions and type guards into type proofs, and flows them globally within
+// the code block. It's also responsible for identifying dead code, and in the
+// future should be used as a hook for constant propagation.
+
+bool performCFA(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCFG.h b/dfg/DFGCFG.h
new file mode 100644
index 0000000..3a1d778
--- /dev/null
+++ b/dfg/DFGCFG.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include "DFGBlockMapInlines.h"
+#include "DFGBlockSet.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+class CFG {
+    WTF_MAKE_NONCOPYABLE(CFG);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    typedef BasicBlock* Node;
+    typedef BlockSet Set;
+    template<typename T> using Map = BlockMap<T>;
+    typedef BlockList List;
+
+    CFG(Graph& graph)
+        : m_graph(graph)
+    {
+    }
+
+    Node root() { return m_graph.block(0); }
+
+    template<typename T>
+    Map<T> newMap() { return BlockMap<T>(m_graph); }
+
+    DFG::Node::SuccessorsIterable successors(Node node) { return node->successors(); }
+    PredecessorList& predecessors(Node node) { return node->predecessors; }
+
+    unsigned index(Node node) const { return node->index; }
+    Node node(unsigned index) const { return m_graph.block(index); }
+    unsigned numNodes() const { return m_graph.numBlocks(); }
+
+    PointerDump<BasicBlock> dump(Node node) const { return pointerDump(node); }
+
+    void dump(PrintStream& out) const
+    {
+        m_graph.dump(out);
+    }
+
+private:
+    Graph& m_graph;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCFGSimplificationPhase.cpp b/dfg/DFGCFGSimplificationPhase.cpp
new file mode 100644
index 0000000..01e0cde
--- /dev/null
+++ b/dfg/DFGCFGSimplificationPhase.cpp
@@ -0,0 +1,390 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCFGSimplificationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGValidate.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class CFGSimplificationPhase : public Phase {
+public:
+    CFGSimplificationPhase(Graph& graph)
+        : Phase(graph, "CFG simplification")
+    {
+    }
+    
+    bool run()
+    {
+        // FIXME: We should make this work in SSA. https://bugs.webkit.org/show_bug.cgi?id=148260
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_form != SSA);
+        
+        const bool extremeLogging = false;
+
+        bool outerChanged = false;
+        bool innerChanged;
+        
+        do {
+            innerChanged = false;
+            for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+                BasicBlock* block = m_graph.block(blockIndex);
+                if (!block)
+                    continue;
+                ASSERT(block->isReachable);
+            
+                switch (block->terminal()->op()) {
+                case Jump: {
+                    // Successor with one predecessor -> merge.
+                    if (block->successor(0)->predecessors.size() == 1) {
+                        ASSERT(block->successor(0)->predecessors[0] == block);
+                        if (extremeLogging)
+                            m_graph.dump();
+                        m_graph.dethread();
+                        mergeBlocks(block, block->successor(0), noBlocks());
+                        innerChanged = outerChanged = true;
+                        break;
+                    }
+                
+                    // FIXME: Block only has a jump -> remove. This is tricky though because of
+                    // liveness. What we really want is to slam in a phantom at the end of the
+                    // block, after the terminal. But we can't right now. :-(
+                    // Idea: what if I slam the ghosties into my successor? Nope, that's
+                    // suboptimal, because if my successor has multiple predecessors then we'll
+                    // be keeping alive things on other predecessor edges unnecessarily.
+                    // What we really need is the notion of end-of-block ghosties!
+                    // FIXME: Allow putting phantoms after terminals.
+                    // https://bugs.webkit.org/show_bug.cgi?id=126778
+                    break;
+                }
+                
+                case Branch: {
+                    // Branch on constant -> jettison the not-taken block and merge.
+                    if (isKnownDirection(block->cfaBranchDirection)) {
+                        bool condition = branchCondition(block->cfaBranchDirection);
+                        BasicBlock* targetBlock = block->successorForCondition(condition);
+                        BasicBlock* jettisonedBlock = block->successorForCondition(!condition);
+                        if (targetBlock->predecessors.size() == 1) {
+                            if (extremeLogging)
+                                m_graph.dump();
+                            m_graph.dethread();
+                            mergeBlocks(block, targetBlock, oneBlock(jettisonedBlock));
+                        } else {
+                            if (extremeLogging)
+                                m_graph.dump();
+                            m_graph.dethread();
+                            
+                            Node* terminal = block->terminal();
+                            ASSERT(terminal->isTerminal());
+                            NodeOrigin boundaryNodeOrigin = terminal->origin;
+
+                            jettisonBlock(block, jettisonedBlock, boundaryNodeOrigin);
+
+                            block->replaceTerminal(
+                                m_graph, SpecNone, Jump, boundaryNodeOrigin,
+                                OpInfo(targetBlock));
+                            
+                            ASSERT(block->terminal());
+                        
+                        }
+                        innerChanged = outerChanged = true;
+                        break;
+                    }
+                    
+                    if (block->successor(0) == block->successor(1)) {
+                        convertToJump(block, block->successor(0));
+                        innerChanged = outerChanged = true;
+                        break;
+                    }
+                    
+                    // Branch to same destination -> jump.
+                    // FIXME: this will currently not be hit because of the lack of jump-only
+                    // block simplification.
+                    
+                    break;
+                }
+                    
+                case Switch: {
+                    SwitchData* data = block->terminal()->switchData();
+                    
+                    // Prune out cases that end up jumping to default.
+                    for (unsigned i = 0; i < data->cases.size(); ++i) {
+                        if (data->cases[i].target.block == data->fallThrough.block) {
+                            data->fallThrough.count += data->cases[i].target.count;
+                            data->cases[i--] = data->cases.last();
+                            data->cases.removeLast();
+                        }
+                    }
+                    
+                    // If there are no cases other than default then this turns
+                    // into a jump.
+                    if (data->cases.isEmpty()) {
+                        convertToJump(block, data->fallThrough.block);
+                        innerChanged = outerChanged = true;
+                        break;
+                    }
+                    
+                    // Switch on constant -> jettison all other targets and merge.
+                    Node* terminal = block->terminal();
+                    if (terminal->child1()->hasConstant()) {
+                        FrozenValue* value = terminal->child1()->constant();
+                        TriState found = FalseTriState;
+                        BasicBlock* targetBlock = 0;
+                        for (unsigned i = data->cases.size(); found == FalseTriState && i--;) {
+                            found = data->cases[i].value.strictEqual(value);
+                            if (found == TrueTriState)
+                                targetBlock = data->cases[i].target.block;
+                        }
+                        
+                        if (found == MixedTriState)
+                            break;
+                        if (found == FalseTriState)
+                            targetBlock = data->fallThrough.block;
+                        ASSERT(targetBlock);
+                        
+                        Vector<BasicBlock*, 1> jettisonedBlocks;
+                        for (BasicBlock* successor : terminal->successors()) {
+                            if (successor != targetBlock)
+                                jettisonedBlocks.append(successor);
+                        }
+                        
+                        if (targetBlock->predecessors.size() == 1) {
+                            if (extremeLogging)
+                                m_graph.dump();
+                            m_graph.dethread();
+                            
+                            mergeBlocks(block, targetBlock, jettisonedBlocks);
+                        } else {
+                            if (extremeLogging)
+                                m_graph.dump();
+                            m_graph.dethread();
+                            
+                            NodeOrigin boundaryNodeOrigin = terminal->origin;
+
+                            for (unsigned i = jettisonedBlocks.size(); i--;)
+                                jettisonBlock(block, jettisonedBlocks[i], boundaryNodeOrigin);
+                            
+                            block->replaceTerminal(
+                                m_graph, SpecNone, Jump, boundaryNodeOrigin, OpInfo(targetBlock));
+                        }
+                        innerChanged = outerChanged = true;
+                        break;
+                    }
+                    break;
+                }
+                    
+                default:
+                    break;
+                }
+            }
+            
+            if (innerChanged) {
+                // Here's the reason for this pass:
+                // Blocks: A, B, C, D, E, F
+                // A -> B, C
+                // B -> F
+                // C -> D, E
+                // D -> F
+                // E -> F
+                //
+                // Assume that A's branch is determined to go to B. Then the rest of this phase
+                // is smart enough to simplify down to:
+                // A -> B
+                // B -> F
+                // C -> D, E
+                // D -> F
+                // E -> F
+                //
+                // We will also merge A and B. But then we don't have any other mechanism to
+                // remove D, E as predecessors for F. Worse, the rest of this phase does not
+                // know how to fix the Phi functions of F to ensure that they no longer refer
+                // to variables in D, E. In general, we need a way to handle Phi simplification
+                // upon:
+                // 1) Removal of a predecessor due to branch simplification. The branch
+                //    simplifier already does that.
+                // 2) Invalidation of a predecessor because said predecessor was rendered
+                //    unreachable. We do this here.
+                //
+                // This implies that when a block is unreachable, we must inspect its
+                // successors' Phi functions to remove any references from them into the
+                // removed block.
+                
+                m_graph.invalidateCFG();
+                m_graph.resetReachability();
+                m_graph.killUnreachableBlocks();
+            }
+            
+            if (Options::validateGraphAtEachPhase())
+                validate();
+        } while (innerChanged);
+        
+        return outerChanged;
+    }
+
+private:
+    void convertToJump(BasicBlock* block, BasicBlock* targetBlock)
+    {
+        ASSERT(targetBlock);
+        ASSERT(targetBlock->isReachable);
+        if (targetBlock->predecessors.size() == 1) {
+            m_graph.dethread();
+            mergeBlocks(block, targetBlock, noBlocks());
+        } else {
+            Node* branch = block->terminal();
+            ASSERT(branch->op() == Branch || branch->op() == Switch);
+
+            block->replaceTerminal(
+                m_graph, SpecNone, Jump, branch->origin, OpInfo(targetBlock));
+        }
+    }
+    
+    void keepOperandAlive(BasicBlock* block, BasicBlock* jettisonedBlock, NodeOrigin nodeOrigin, VirtualRegister operand)
+    {
+        Node* livenessNode = jettisonedBlock->variablesAtHead.operand(operand);
+        if (!livenessNode)
+            return;
+        NodeType nodeType;
+        if (livenessNode->flags() & NodeIsFlushed)
+            nodeType = Flush;
+        else {
+            // This seems like it shouldn't be necessary because we could just rematerialize
+            // PhantomLocals or something similar using bytecode liveness. However, in ThreadedCPS, it's
+            // worth the sanity to maintain this eagerly. See
+            // https://bugs.webkit.org/show_bug.cgi?id=144086
+            nodeType = PhantomLocal;
+        }
+        block->appendNode(
+            m_graph, SpecNone, nodeType, nodeOrigin, 
+            OpInfo(livenessNode->variableAccessData()));
+    }
+    
+    void jettisonBlock(BasicBlock* block, BasicBlock* jettisonedBlock, NodeOrigin boundaryNodeOrigin)
+    {
+        for (size_t i = 0; i < jettisonedBlock->variablesAtHead.numberOfArguments(); ++i)
+            keepOperandAlive(block, jettisonedBlock, boundaryNodeOrigin, virtualRegisterForArgument(i));
+        for (size_t i = 0; i < jettisonedBlock->variablesAtHead.numberOfLocals(); ++i)
+            keepOperandAlive(block, jettisonedBlock, boundaryNodeOrigin, virtualRegisterForLocal(i));
+        
+        fixJettisonedPredecessors(block, jettisonedBlock);
+    }
+    
+    void fixJettisonedPredecessors(BasicBlock* block, BasicBlock* jettisonedBlock)
+    {
+        jettisonedBlock->removePredecessor(block);
+    }
+
+    Vector<BasicBlock*, 1> noBlocks()
+    {
+        return Vector<BasicBlock*, 1>();
+    }
+    
+    Vector<BasicBlock*, 1> oneBlock(BasicBlock* block)
+    {
+        Vector<BasicBlock*, 1> result;
+        result.append(block);
+        return result;
+    }
+    
+    void mergeBlocks(
+        BasicBlock* firstBlock, BasicBlock* secondBlock,
+        Vector<BasicBlock*, 1> jettisonedBlocks)
+    {
+        // This will add all of the nodes in secondBlock to firstBlock, but in so doing
+        // it will also ensure that any GetLocals from the second block that refer to
+        // SetLocals in the first block are relinked. If jettisonedBlock is not NoBlock,
+        // then Phantoms are inserted for anything that the jettisonedBlock would have
+        // kept alive.
+        
+        // Remove the terminal of firstBlock since we don't need it anymore. Well, we don't
+        // really remove it; we actually turn it into a check.
+        Node* terminal = firstBlock->terminal();
+        ASSERT(terminal->isTerminal());
+        NodeOrigin boundaryNodeOrigin = terminal->origin;
+        terminal->remove();
+        ASSERT(terminal->refCount() == 1);
+        
+        for (unsigned i = jettisonedBlocks.size(); i--;) {
+            BasicBlock* jettisonedBlock = jettisonedBlocks[i];
+            
+            // Time to insert ghosties for things that need to be kept alive in case we OSR
+            // exit prior to hitting the firstBlock's terminal, and end up going down a
+            // different path than secondBlock.
+            
+            for (size_t i = 0; i < jettisonedBlock->variablesAtHead.numberOfArguments(); ++i)
+                keepOperandAlive(firstBlock, jettisonedBlock, boundaryNodeOrigin, virtualRegisterForArgument(i));
+            for (size_t i = 0; i < jettisonedBlock->variablesAtHead.numberOfLocals(); ++i)
+                keepOperandAlive(firstBlock, jettisonedBlock, boundaryNodeOrigin, virtualRegisterForLocal(i));
+        }
+        
+        for (size_t i = 0; i < secondBlock->phis.size(); ++i)
+            firstBlock->phis.append(secondBlock->phis[i]);
+
+        for (size_t i = 0; i < secondBlock->size(); ++i)
+            firstBlock->append(secondBlock->at(i));
+        
+        ASSERT(firstBlock->terminal()->isTerminal());
+        
+        // Fix the predecessors of my new successors. This is tricky, since we are going to reset
+        // all predecessors anyway due to reachability analysis. But we need to fix the
+        // predecessors eagerly to ensure that we know what they are in case the next block we
+        // consider in this phase wishes to query the predecessors of one of the blocks we
+        // affected.
+        for (unsigned i = firstBlock->numSuccessors(); i--;) {
+            BasicBlock* successor = firstBlock->successor(i);
+            for (unsigned j = 0; j < successor->predecessors.size(); ++j) {
+                if (successor->predecessors[j] == secondBlock)
+                    successor->predecessors[j] = firstBlock;
+            }
+        }
+        
+        // Fix the predecessors of my former successors. Again, we'd rather not do this, but it's
+        // an unfortunate necessity. See above comment.
+        for (unsigned i = jettisonedBlocks.size(); i--;)
+            fixJettisonedPredecessors(firstBlock, jettisonedBlocks[i]);
+        
+        firstBlock->valuesAtTail = secondBlock->valuesAtTail;
+        firstBlock->cfaBranchDirection = secondBlock->cfaBranchDirection;
+        
+        m_graph.killBlock(secondBlock);
+    }
+};
+
+bool performCFGSimplification(Graph& graph)
+{
+    return runPhase<CFGSimplificationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGCFGSimplificationPhase.h b/dfg/DFGCFGSimplificationPhase.h
new file mode 100644
index 0000000..9f3bca9
--- /dev/null
+++ b/dfg/DFGCFGSimplificationPhase.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// CFG simplification:
+//
+// jump to single predecessor -> merge blocks
+// branch on constant -> jump
+// branch to same blocks -> jump
+// jump-only block -> remove
+// kill dead code
+
+bool performCFGSimplification(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCPSRethreadingPhase.cpp b/dfg/DFGCPSRethreadingPhase.cpp
new file mode 100644
index 0000000..67b3574
--- /dev/null
+++ b/dfg/DFGCPSRethreadingPhase.cpp
@@ -0,0 +1,523 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCPSRethreadingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class CPSRethreadingPhase : public Phase {
+public:
+    CPSRethreadingPhase(Graph& graph)
+        : Phase(graph, "CPS rethreading")
+    {
+    }
+    
+    bool run()
+    {
+        RELEASE_ASSERT(m_graph.m_refCountState == EverythingIsLive);
+        
+        if (m_graph.m_form == ThreadedCPS)
+            return false;
+        
+        clearIsLoadedFrom();
+        freeUnnecessaryNodes();
+        m_graph.clearReplacements();
+        canonicalizeLocalsInBlocks();
+        specialCaseArguments();
+        propagatePhis<LocalOperand>();
+        propagatePhis<ArgumentOperand>();
+        computeIsFlushed();
+        
+        m_graph.m_form = ThreadedCPS;
+        return true;
+    }
+
+private:
+    
+    void clearIsLoadedFrom()
+    {
+        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i)
+            m_graph.m_variableAccessData[i].setIsLoadedFrom(false);
+    }
+    
+    void freeUnnecessaryNodes()
+    {
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            ASSERT(block->isReachable);
+            
+            unsigned fromIndex = 0;
+            unsigned toIndex = 0;
+            while (fromIndex < block->size()) {
+                Node* node = block->at(fromIndex++);
+                switch (node->op()) {
+                case GetLocal:
+                case Flush:
+                case PhantomLocal:
+                    node->children.setChild1(Edge());
+                    break;
+                case Phantom:
+                    if (!node->child1()) {
+                        m_graph.deleteNode(node);
+                        continue;
+                    }
+                    switch (node->child1()->op()) {
+                    case Phi:
+                    case SetArgument:
+                    case SetLocal:
+                        node->convertPhantomToPhantomLocal();
+                        break;
+                    default:
+                        ASSERT(node->child1()->hasResult());
+                        break;
+                    }
+                    break;
+                default:
+                    break;
+                }
+                block->at(toIndex++) = node;
+            }
+            block->resize(toIndex);
+            
+            for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+                m_graph.deleteNode(block->phis[phiIndex]);
+            block->phis.resize(0);
+        }
+    }
+    
+    template<OperandKind operandKind>
+    void clearVariables()
+    {
+        ASSERT(
+            m_block->variablesAtHead.sizeFor<operandKind>()
+            == m_block->variablesAtTail.sizeFor<operandKind>());
+        
+        for (unsigned i = m_block->variablesAtHead.sizeFor<operandKind>(); i--;) {
+            m_block->variablesAtHead.atFor<operandKind>(i) = nullptr;
+            m_block->variablesAtTail.atFor<operandKind>(i) = nullptr;
+        }
+    }
+    
+    ALWAYS_INLINE Node* addPhiSilently(BasicBlock* block, const NodeOrigin& origin, VariableAccessData* variable)
+    {
+        Node* result = m_graph.addNode(Phi, origin, OpInfo(variable));
+        block->phis.append(result);
+        return result;
+    }
+    
+    template<OperandKind operandKind>
+    ALWAYS_INLINE Node* addPhi(BasicBlock* block, const NodeOrigin& origin, VariableAccessData* variable, size_t index)
+    {
+        Node* result = addPhiSilently(block, origin, variable);
+        phiStackFor<operandKind>().append(PhiStackEntry(block, index, result));
+        return result;
+    }
+    
+    template<OperandKind operandKind>
+    ALWAYS_INLINE Node* addPhi(const NodeOrigin& origin, VariableAccessData* variable, size_t index)
+    {
+        return addPhi<operandKind>(m_block, origin, variable, index);
+    }
+    
+    template<OperandKind operandKind>
+    void canonicalizeGetLocalFor(Node* node, VariableAccessData* variable, size_t idx)
+    {
+        ASSERT(!node->child1());
+        
+        if (Node* otherNode = m_block->variablesAtTail.atFor<operandKind>(idx)) {
+            ASSERT(otherNode->variableAccessData() == variable);
+            
+            switch (otherNode->op()) {
+            case Flush:
+            case PhantomLocal:
+                otherNode = otherNode->child1().node();
+                if (otherNode->op() == Phi) {
+                    // We need to have a GetLocal, so this might as well be the one.
+                    node->children.setChild1(Edge(otherNode));
+                    m_block->variablesAtTail.atFor<operandKind>(idx) = node;
+                    return;
+                }
+                ASSERT(otherNode->op() == SetLocal || otherNode->op() == SetArgument);
+                break;
+            default:
+                break;
+            }
+            
+            ASSERT(otherNode->op() == SetLocal || otherNode->op() == SetArgument || otherNode->op() == GetLocal);
+            ASSERT(otherNode->variableAccessData() == variable);
+            
+            if (otherNode->op() == SetArgument) {
+                variable->setIsLoadedFrom(true);
+                node->children.setChild1(Edge(otherNode));
+                m_block->variablesAtTail.atFor<operandKind>(idx) = node;
+                return;
+            }
+            
+            if (otherNode->op() == GetLocal) {
+                // Replace all references to this GetLocal with otherNode.
+                node->replaceWith(otherNode);
+                return;
+            }
+            
+            ASSERT(otherNode->op() == SetLocal);
+            node->replaceWith(otherNode->child1().node());
+            return;
+        }
+        
+        variable->setIsLoadedFrom(true);
+        Node* phi = addPhi<operandKind>(node->origin, variable, idx);
+        node->children.setChild1(Edge(phi));
+        m_block->variablesAtHead.atFor<operandKind>(idx) = phi;
+        m_block->variablesAtTail.atFor<operandKind>(idx) = node;
+    }
+    
+    void canonicalizeGetLocal(Node* node)
+    {
+        VariableAccessData* variable = node->variableAccessData();
+        if (variable->local().isArgument())
+            canonicalizeGetLocalFor<ArgumentOperand>(node, variable, variable->local().toArgument());
+        else
+            canonicalizeGetLocalFor<LocalOperand>(node, variable, variable->local().toLocal());
+    }
+    
+    template<NodeType nodeType, OperandKind operandKind>
+    void canonicalizeFlushOrPhantomLocalFor(Node* node, VariableAccessData* variable, size_t idx)
+    {
+        ASSERT(!node->child1());
+        
+        if (Node* otherNode = m_block->variablesAtTail.atFor<operandKind>(idx)) {
+            ASSERT(otherNode->variableAccessData() == variable);
+            
+            switch (otherNode->op()) {
+            case Flush:
+            case PhantomLocal:
+            case GetLocal:
+                otherNode = otherNode->child1().node();
+                break;
+            default:
+                break;
+            }
+            
+            ASSERT(otherNode->op() == Phi || otherNode->op() == SetLocal || otherNode->op() == SetArgument);
+            
+            if (nodeType == PhantomLocal && otherNode->op() == SetLocal) {
+                // PhantomLocal(SetLocal) doesn't make sense. PhantomLocal means: at this
+                // point I know I would have been interested in the value of this variable
+                // for the purpose of OSR. PhantomLocal(SetLocal) means: at this point I
+                // know that I would have read the value written by that SetLocal. This is
+                // redundant and inefficient, since really it just means that we want to
+                // keep the last MovHinted value of that local alive.
+                
+                node->remove();
+                return;
+            }
+            
+            variable->setIsLoadedFrom(true);
+            // There is nothing wrong with having redundant Flush's. It just needs to
+            // be linked appropriately. Note that if there had already been a previous
+            // use at tail then we don't override it. It's fine for variablesAtTail to
+            // omit Flushes and PhantomLocals. On the other hand, having it refer to a
+            // Flush or a PhantomLocal if just before it the last use was a GetLocal would
+            // seriously confuse the CFA.
+            node->children.setChild1(Edge(otherNode));
+            return;
+        }
+        
+        variable->setIsLoadedFrom(true);
+        node->children.setChild1(Edge(addPhi<operandKind>(node->origin, variable, idx)));
+        m_block->variablesAtHead.atFor<operandKind>(idx) = node;
+        m_block->variablesAtTail.atFor<operandKind>(idx) = node;
+    }
+
+    template<NodeType nodeType>
+    void canonicalizeFlushOrPhantomLocal(Node* node)
+    {
+        VariableAccessData* variable = node->variableAccessData();
+        if (variable->local().isArgument())
+            canonicalizeFlushOrPhantomLocalFor<nodeType, ArgumentOperand>(node, variable, variable->local().toArgument());
+        else
+            canonicalizeFlushOrPhantomLocalFor<nodeType, LocalOperand>(node, variable, variable->local().toLocal());
+    }
+    
+    void canonicalizeSet(Node* node)
+    {
+        m_block->variablesAtTail.setOperand(node->local(), node);
+    }
+    
+    void canonicalizeLocalsInBlock()
+    {
+        if (!m_block)
+            return;
+        ASSERT(m_block->isReachable);
+        
+        clearVariables<ArgumentOperand>();
+        clearVariables<LocalOperand>();
+        
+        // Assumes that all phi references have been removed. Assumes that things that
+        // should be live have a non-zero ref count, but doesn't assume that the ref
+        // counts are correct beyond that (more formally !!logicalRefCount == !!actualRefCount
+        // but not logicalRefCount == actualRefCount). Assumes that it can break ref
+        // counts.
+        
+        for (unsigned nodeIndex = 0; nodeIndex < m_block->size(); ++nodeIndex) {
+            Node* node = m_block->at(nodeIndex);
+            
+            m_graph.performSubstitution(node);
+            
+            // The rules for threaded CPS form:
+            // 
+            // Head variable: describes what is live at the head of the basic block.
+            // Head variable links may refer to Flush, PhantomLocal, Phi, or SetArgument.
+            // SetArgument may only appear in the root block.
+            //
+            // Tail variable: the last thing that happened to the variable in the block.
+            // It may be a Flush, PhantomLocal, GetLocal, SetLocal, SetArgument, or Phi.
+            // SetArgument may only appear in the root block. Note that if there ever
+            // was a GetLocal to the variable, and it was followed by PhantomLocals and
+            // Flushes but not SetLocals, then the tail variable will be the GetLocal.
+            // This reflects the fact that you only care that the tail variable is a
+            // Flush or PhantomLocal if nothing else interesting happened. Likewise, if
+            // there ever was a SetLocal and it was followed by Flushes, then the tail
+            // variable will be a SetLocal and not those subsequent Flushes.
+            //
+            // Child of GetLocal: the operation that the GetLocal keeps alive. It may be
+            // a Phi from the current block. For arguments, it may be a SetArgument.
+            //
+            // Child of SetLocal: must be a value producing node.
+            //
+            // Child of Flush: it may be a Phi from the current block or a SetLocal. For
+            // arguments it may also be a SetArgument.
+            //
+            // Child of PhantomLocal: it may be a Phi from the current block. For
+            // arguments it may also be a SetArgument.
+            //
+            // Children of Phi: other Phis in the same basic block, or any of the
+            // following from predecessor blocks: SetLocal, Phi, or SetArgument. These
+            // are computed by looking at the tail variables of the predecessor  blocks
+            // and either using it directly (if it's a SetLocal, Phi, or SetArgument) or
+            // loading that nodes child (if it's a GetLocal, PhanomLocal, or Flush - all
+            // of these will have children that are SetLocal, Phi, or SetArgument).
+            
+            switch (node->op()) {
+            case GetLocal:
+                canonicalizeGetLocal(node);
+                break;
+                
+            case SetLocal:
+                canonicalizeSet(node);
+                break;
+                
+            case Flush:
+                canonicalizeFlushOrPhantomLocal<Flush>(node);
+                break;
+                
+            case PhantomLocal:
+                canonicalizeFlushOrPhantomLocal<PhantomLocal>(node);
+                break;
+                
+            case SetArgument:
+                canonicalizeSet(node);
+                break;
+                
+            default:
+                break;
+            }
+        }
+    }
+    
+    void canonicalizeLocalsInBlocks()
+    {
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            m_block = m_graph.block(blockIndex);
+            canonicalizeLocalsInBlock();
+        }
+    }
+    
+    void specialCaseArguments()
+    {
+        // Normally, a SetArgument denotes the start of a live range for a local's value on the stack.
+        // But those SetArguments used for the actual arguments to the machine CodeBlock get
+        // special-cased. We could have instead used two different node types - one for the arguments
+        // at the prologue case, and another for the other uses. But this seemed like IR overkill.
+        for (unsigned i = m_graph.m_arguments.size(); i--;)
+            m_graph.block(0)->variablesAtHead.setArgumentFirstTime(i, m_graph.m_arguments[i]);
+    }
+    
+    template<OperandKind operandKind>
+    void propagatePhis()
+    {
+        Vector<PhiStackEntry, 128>& phiStack = operandKind == ArgumentOperand ? m_argumentPhiStack : m_localPhiStack;
+        
+        // Ensure that attempts to use this fail instantly.
+        m_block = 0;
+        
+        while (!phiStack.isEmpty()) {
+            PhiStackEntry entry = phiStack.last();
+            phiStack.removeLast();
+            
+            BasicBlock* block = entry.m_block;
+            PredecessorList& predecessors = block->predecessors;
+            Node* currentPhi = entry.m_phi;
+            VariableAccessData* variable = currentPhi->variableAccessData();
+            size_t index = entry.m_index;
+            
+            for (size_t i = predecessors.size(); i--;) {
+                BasicBlock* predecessorBlock = predecessors[i];
+                
+                Node* variableInPrevious = predecessorBlock->variablesAtTail.atFor<operandKind>(index);
+                if (!variableInPrevious) {
+                    variableInPrevious = addPhi<operandKind>(predecessorBlock, currentPhi->origin, variable, index);
+                    predecessorBlock->variablesAtTail.atFor<operandKind>(index) = variableInPrevious;
+                    predecessorBlock->variablesAtHead.atFor<operandKind>(index) = variableInPrevious;
+                } else {
+                    switch (variableInPrevious->op()) {
+                    case GetLocal:
+                    case PhantomLocal:
+                    case Flush:
+                        ASSERT(variableInPrevious->variableAccessData() == variableInPrevious->child1()->variableAccessData());
+                        variableInPrevious = variableInPrevious->child1().node();
+                        break;
+                    default:
+                        break;
+                    }
+                }
+                
+                ASSERT(
+                    variableInPrevious->op() == SetLocal
+                    || variableInPrevious->op() == Phi
+                    || variableInPrevious->op() == SetArgument);
+          
+                if (!currentPhi->child1()) {
+                    currentPhi->children.setChild1(Edge(variableInPrevious));
+                    continue;
+                }
+                if (!currentPhi->child2()) {
+                    currentPhi->children.setChild2(Edge(variableInPrevious));
+                    continue;
+                }
+                if (!currentPhi->child3()) {
+                    currentPhi->children.setChild3(Edge(variableInPrevious));
+                    continue;
+                }
+                
+                Node* newPhi = addPhiSilently(block, currentPhi->origin, variable);
+                newPhi->children = currentPhi->children;
+                currentPhi->children.initialize(newPhi, variableInPrevious, 0);
+            }
+        }
+    }
+    
+    struct PhiStackEntry {
+        PhiStackEntry(BasicBlock* block, size_t index, Node* phi)
+            : m_block(block)
+            , m_index(index)
+            , m_phi(phi)
+        {
+        }
+        
+        BasicBlock* m_block;
+        size_t m_index;
+        Node* m_phi;
+    };
+    
+    template<OperandKind operandKind>
+    Vector<PhiStackEntry, 128>& phiStackFor()
+    {
+        if (operandKind == ArgumentOperand)
+            return m_argumentPhiStack;
+        return m_localPhiStack;
+    }
+    
+    void computeIsFlushed()
+    {
+        m_graph.clearFlagsOnAllNodes(NodeIsFlushed);
+        
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+                Node* node = block->at(nodeIndex);
+                if (node->op() != Flush)
+                    continue;
+                addFlushedLocalOp(node);
+            }
+        }
+        while (!m_flushedLocalOpWorklist.isEmpty()) {
+            Node* node = m_flushedLocalOpWorklist.takeLast();
+            switch (node->op()) {
+            case SetLocal:
+            case SetArgument:
+                break;
+                
+            case Flush:
+            case Phi:
+                ASSERT(node->flags() & NodeIsFlushed);
+                DFG_NODE_DO_TO_CHILDREN(m_graph, node, addFlushedLocalEdge);
+                break;
+
+            default:
+                DFG_CRASH(m_graph, node, "Invalid node in flush graph");
+                break;
+            }
+        }
+    }
+    
+    void addFlushedLocalOp(Node* node)
+    {
+        if (node->mergeFlags(NodeIsFlushed))
+            m_flushedLocalOpWorklist.append(node);
+    }
+
+    void addFlushedLocalEdge(Node*, Edge edge)
+    {
+        addFlushedLocalOp(edge.node());
+    }
+
+    BasicBlock* m_block;
+    Vector<PhiStackEntry, 128> m_argumentPhiStack;
+    Vector<PhiStackEntry, 128> m_localPhiStack;
+    Vector<Node*, 128> m_flushedLocalOpWorklist;
+};
+
+bool performCPSRethreading(Graph& graph)
+{
+    return runPhase<CPSRethreadingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGCPSRethreadingPhase.h b/dfg/DFGCPSRethreadingPhase.h
new file mode 100644
index 0000000..8aa2ac0
--- /dev/null
+++ b/dfg/DFGCPSRethreadingPhase.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// CPS Rethreading:
+//
+// Takes a graph in which there are arbitrary GetLocals/SetLocals with no connections
+// between them. Removes redundant ones in the case of uncaptured variables. Connects
+// all of them with Phi functions to represent live ranges.
+
+bool performCPSRethreading(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCSEPhase.cpp b/dfg/DFGCSEPhase.cpp
new file mode 100644
index 0000000..699049b
--- /dev/null
+++ b/dfg/DFGCSEPhase.cpp
@@ -0,0 +1,916 @@
+/*
+ * Copyright (C) 2011-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCSEPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractHeap.h"
+#include "DFGBlockMapInlines.h"
+#include "DFGClobberSet.h"
+#include "DFGClobberize.h"
+#include "DFGDominators.h"
+#include "DFGEdgeUsesStructure.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include <array>
+
+namespace JSC { namespace DFG {
+
+// This file contains two CSE implementations: local and global. LocalCSE typically runs when we're
+// in DFG mode, i.e. we want to compile quickly. LocalCSE contains a lot of optimizations for
+// compile time. GlobalCSE, on the other hand, is fairly straight-forward. It will find more
+// optimization opportunities by virtue of being global.
+
+namespace {
+
+const bool verbose = false;
+
+class ImpureDataSlot {
+    WTF_MAKE_NONCOPYABLE(ImpureDataSlot);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ImpureDataSlot(HeapLocation key, LazyNode value, unsigned hash)
+        : key(key), value(value), hash(hash)
+    { }
+
+    HeapLocation key;
+    LazyNode value;
+    unsigned hash;
+};
+
+struct ImpureDataSlotHash : public DefaultHash<std::unique_ptr<ImpureDataSlot>>::Hash {
+    static unsigned hash(const std::unique_ptr<ImpureDataSlot>& key)
+    {
+        return key->hash;
+    }
+
+    static bool equal(const std::unique_ptr<ImpureDataSlot>& a, const std::unique_ptr<ImpureDataSlot>& b)
+    {
+        // The ImpureDataSlot are unique per table per HeapLocation. This lets us compare the key
+        // by just comparing the pointers of the unique ImpureDataSlots.
+        ASSERT(a != b || a->key == b->key);
+        return a == b;
+    }
+};
+
+struct ImpureDataTranslator {
+    static unsigned hash(const HeapLocation& key)
+    {
+        return key.hash();
+    }
+
+    static bool equal(const std::unique_ptr<ImpureDataSlot>& slot, const HeapLocation& key)
+    {
+        if (!slot)
+            return false;
+        if (HashTraits<std::unique_ptr<ImpureDataSlot>>::isDeletedValue(slot))
+            return false;
+        return slot->key == key;
+    }
+
+    static void translate(std::unique_ptr<ImpureDataSlot>& slot, const HeapLocation& key, unsigned hashCode)
+    {
+        new (NotNull, std::addressof(slot)) std::unique_ptr<ImpureDataSlot>(new ImpureDataSlot {key, LazyNode(), hashCode});
+    }
+};
+
+class ImpureMap {
+    WTF_MAKE_FAST_ALLOCATED;
+    WTF_MAKE_NONCOPYABLE(ImpureMap);
+public:
+    ImpureMap() = default;
+
+    ImpureMap(ImpureMap&& other)
+    {
+        m_abstractHeapStackMap.swap(other.m_abstractHeapStackMap);
+        m_fallbackStackMap.swap(other.m_fallbackStackMap);
+        m_heapMap.swap(other.m_heapMap);
+#if !defined(NDEBUG)
+        m_debugImpureData.swap(other.m_debugImpureData);
+#endif
+    }
+
+    const ImpureDataSlot* add(const HeapLocation& location, const LazyNode& node)
+    {
+        const ImpureDataSlot* result = addImpl(location, node);
+
+#if !defined(NDEBUG)
+        auto addResult = m_debugImpureData.add(location, node);
+        ASSERT(!!result == !addResult.isNewEntry);
+#endif
+        return result;
+    }
+
+    LazyNode get(const HeapLocation& location) const
+    {
+        LazyNode result = getImpl(location);
+#if !defined(NDEBUG)
+        ASSERT(result == m_debugImpureData.get(location));
+#endif
+        return result;
+    }
+
+    void clobber(AbstractHeap heap)
+    {
+        switch (heap.kind()) {
+        case World: {
+            clear();
+            break;
+        }
+        case SideState:
+            break;
+        case Stack: {
+            ASSERT(!heap.payload().isTop());
+            ASSERT(heap.payload().value() == heap.payload().value32());
+            m_abstractHeapStackMap.remove(heap.payload().value32());
+            clobber(m_fallbackStackMap, heap);
+            break;
+        }
+        default:
+            clobber(m_heapMap, heap);
+            break;
+        }
+#if !defined(NDEBUG)
+        m_debugImpureData.removeIf([heap](const HashMap<HeapLocation, LazyNode>::KeyValuePairType& pair) -> bool {
+            return heap.overlaps(pair.key.heap());
+        });
+        ASSERT(m_debugImpureData.size()
+            == (m_heapMap.size()
+                + m_abstractHeapStackMap.size()
+                + m_fallbackStackMap.size()));
+
+        const bool verifyClobber = false;
+        if (verifyClobber) {
+            for (auto& pair : m_debugImpureData)
+                ASSERT(!!get(pair.key));
+        }
+#endif
+    }
+
+    void clear()
+    {
+        m_abstractHeapStackMap.clear();
+        m_fallbackStackMap.clear();
+        m_heapMap.clear();
+#if !defined(NDEBUG)
+        m_debugImpureData.clear();
+#endif
+    }
+
+private:
+    typedef HashSet<std::unique_ptr<ImpureDataSlot>, ImpureDataSlotHash> Map;
+
+    const ImpureDataSlot* addImpl(const HeapLocation& location, const LazyNode& node)
+    {
+        switch (location.heap().kind()) {
+        case World:
+        case SideState:
+            RELEASE_ASSERT_NOT_REACHED();
+        case Stack: {
+            AbstractHeap abstractHeap = location.heap();
+            if (abstractHeap.payload().isTop())
+                return add(m_fallbackStackMap, location, node);
+            ASSERT(abstractHeap.payload().value() == abstractHeap.payload().value32());
+            auto addResult = m_abstractHeapStackMap.add(abstractHeap.payload().value32(), nullptr);
+            if (addResult.isNewEntry) {
+                addResult.iterator->value.reset(new ImpureDataSlot {location, node, 0});
+                return nullptr;
+            }
+            if (addResult.iterator->value->key == location)
+                return addResult.iterator->value.get();
+            return add(m_fallbackStackMap, location, node);
+        }
+        default:
+            return add(m_heapMap, location, node);
+        }
+        return nullptr;
+    }
+
+    LazyNode getImpl(const HeapLocation& location) const
+    {
+        switch (location.heap().kind()) {
+        case World:
+        case SideState:
+            RELEASE_ASSERT_NOT_REACHED();
+        case Stack: {
+            ASSERT(location.heap().payload().value() == location.heap().payload().value32());
+            auto iterator = m_abstractHeapStackMap.find(location.heap().payload().value32());
+            if (iterator != m_abstractHeapStackMap.end()
+                && iterator->value->key == location)
+                return iterator->value->value;
+            return get(m_fallbackStackMap, location);
+        }
+        default:
+            return get(m_heapMap, location);
+        }
+        return LazyNode();
+    }
+
+    static const ImpureDataSlot* add(Map& map, const HeapLocation& location, const LazyNode& node)
+    {
+        auto result = map.add<ImpureDataTranslator>(location);
+        if (result.isNewEntry) {
+            (*result.iterator)->value = node;
+            return nullptr;
+        }
+        return result.iterator->get();
+    }
+
+    static LazyNode get(const Map& map, const HeapLocation& location)
+    {
+        auto iterator = map.find<ImpureDataTranslator>(location);
+        if (iterator != map.end())
+            return (*iterator)->value;
+        return LazyNode();
+    }
+
+    static void clobber(Map& map, AbstractHeap heap)
+    {
+        map.removeIf([heap](const std::unique_ptr<ImpureDataSlot>& slot) -> bool {
+            return heap.overlaps(slot->key.heap());
+        });
+    }
+
+    // The majority of Impure Stack Slotsare unique per value.
+    // This is very useful for fast clobber(), we can just remove the slot addressed by AbstractHeap
+    // in O(1).
+    //
+    // When there are conflict, any additional HeapLocation is added in the fallback map.
+    // This works well because fallbackStackMap remains tiny.
+    //
+    // One cannot assume a unique ImpureData is in m_abstractHeapStackMap. It may have been
+    // a duplicate in the past and now only live in m_fallbackStackMap.
+    //
+    // Obviously, TOP always goes into m_fallbackStackMap since it does not have a unique value.
+    HashMap<int32_t, std::unique_ptr<ImpureDataSlot>, DefaultHash<int32_t>::Hash, WTF::SignedWithZeroKeyHashTraits<int32_t>> m_abstractHeapStackMap;
+    Map m_fallbackStackMap;
+
+    Map m_heapMap;
+
+#if !defined(NDEBUG)
+    HashMap<HeapLocation, LazyNode> m_debugImpureData;
+#endif
+};
+
+class LocalCSEPhase : public Phase {
+public:
+    LocalCSEPhase(Graph& graph)
+        : Phase(graph, "local common subexpression elimination")
+        , m_smallBlock(graph)
+        , m_largeBlock(graph)
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_fixpointState == FixpointNotConverged);
+        ASSERT(m_graph.m_form == ThreadedCPS || m_graph.m_form == LoadStore);
+        
+        bool changed = false;
+        
+        m_graph.clearReplacements();
+        
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            if (block->size() <= SmallMaps::capacity)
+                changed |= m_smallBlock.run(block);
+            else
+                changed |= m_largeBlock.run(block);
+        }
+        
+        return changed;
+    }
+    
+private:
+    class SmallMaps {
+    public:
+        // This permits SmallMaps to be used for blocks that have up to 100 nodes. In practice,
+        // fewer than half of the nodes in a block have pure defs, and even fewer have impure defs.
+        // Thus, a capacity limit of 100 probably means that somewhere around ~40 things may end up
+        // in one of these "small" list-based maps. That number still seems largeish, except that
+        // the overhead of HashMaps can be quite high currently: clearing them, or even removing
+        // enough things from them, deletes (or resizes) their backing store eagerly. Hence
+        // HashMaps induce a lot of malloc traffic.
+        static const unsigned capacity = 100;
+    
+        SmallMaps()
+            : m_pureLength(0)
+            , m_impureLength(0)
+        {
+        }
+    
+        void clear()
+        {
+            m_pureLength = 0;
+            m_impureLength = 0;
+        }
+    
+        void write(AbstractHeap heap)
+        {
+            if (heap.kind() == SideState)
+                return;
+
+            for (unsigned i = 0; i < m_impureLength; ++i) {
+                if (heap.overlaps(m_impureMap[i].key.heap()))
+                    m_impureMap[i--] = m_impureMap[--m_impureLength];
+            }
+        }
+    
+        Node* addPure(PureValue value, Node* node)
+        {
+            for (unsigned i = m_pureLength; i--;) {
+                if (m_pureMap[i].key == value)
+                    return m_pureMap[i].value;
+            }
+        
+            ASSERT(m_pureLength < capacity);
+            m_pureMap[m_pureLength++] = WTF::KeyValuePair<PureValue, Node*>(value, node);
+            return nullptr;
+        }
+        
+        LazyNode findReplacement(HeapLocation location)
+        {
+            for (unsigned i = m_impureLength; i--;) {
+                if (m_impureMap[i].key == location)
+                    return m_impureMap[i].value;
+            }
+            return nullptr;
+        }
+    
+        LazyNode addImpure(HeapLocation location, LazyNode node)
+        {
+            // FIXME: If we are using small maps, we must not def() derived values.
+            // For now the only derived values we def() are constant-based.
+            if (location.index() && !location.index().isNode())
+                return nullptr;
+            if (LazyNode result = findReplacement(location))
+                return result;
+            ASSERT(m_impureLength < capacity);
+            m_impureMap[m_impureLength++] = WTF::KeyValuePair<HeapLocation, LazyNode>(location, node);
+            return nullptr;
+        }
+    
+    private:
+        WTF::KeyValuePair<PureValue, Node*> m_pureMap[capacity];
+        WTF::KeyValuePair<HeapLocation, LazyNode> m_impureMap[capacity];
+        unsigned m_pureLength;
+        unsigned m_impureLength;
+    };
+
+    class LargeMaps {
+    public:
+        LargeMaps()
+        {
+        }
+    
+        void clear()
+        {
+            m_pureMap.clear();
+            m_impureMap.clear();
+        }
+    
+        void write(AbstractHeap heap)
+        {
+            m_impureMap.clobber(heap);
+        }
+    
+        Node* addPure(PureValue value, Node* node)
+        {
+            auto result = m_pureMap.add(value, node);
+            if (result.isNewEntry)
+                return nullptr;
+            return result.iterator->value;
+        }
+        
+        LazyNode findReplacement(HeapLocation location)
+        {
+            return m_impureMap.get(location);
+        }
+    
+        LazyNode addImpure(const HeapLocation& location, const LazyNode& node)
+        {
+            if (const ImpureDataSlot* slot = m_impureMap.add(location, node))
+                return slot->value;
+            return LazyNode();
+        }
+
+    private:
+        HashMap<PureValue, Node*> m_pureMap;
+        ImpureMap m_impureMap;
+    };
+
+    template<typename Maps>
+    class BlockCSE {
+    public:
+        BlockCSE(Graph& graph)
+            : m_graph(graph)
+            , m_insertionSet(graph)
+        {
+        }
+    
+        bool run(BasicBlock* block)
+        {
+            m_maps.clear();
+            m_changed = false;
+            m_block = block;
+        
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                m_node = block->at(nodeIndex);
+                m_graph.performSubstitution(m_node);
+            
+                if (m_node->op() == Identity) {
+                    m_node->replaceWith(m_node->child1().node());
+                    m_changed = true;
+                } else {
+                    // This rule only makes sense for local CSE, since in SSA form we have already
+                    // factored the bounds check out of the PutByVal. It's kind of gross, but we
+                    // still have reason to believe that PutByValAlias is a good optimization and
+                    // that it's better to do it with a single node rather than separating out the
+                    // CheckInBounds.
+                    if (m_node->op() == PutByVal || m_node->op() == PutByValDirect) {
+                        HeapLocation heap;
+                        
+                        Node* base = m_graph.varArgChild(m_node, 0).node();
+                        Node* index = m_graph.varArgChild(m_node, 1).node();
+                        
+                        ArrayMode mode = m_node->arrayMode();
+                        switch (mode.type()) {
+                        case Array::Int32:
+                            if (!mode.isInBounds())
+                                break;
+                            heap = HeapLocation(
+                                IndexedPropertyLoc, IndexedInt32Properties, base, index);
+                            break;
+                            
+                        case Array::Double:
+                            if (!mode.isInBounds())
+                                break;
+                            heap = HeapLocation(
+                                IndexedPropertyLoc, IndexedDoubleProperties, base, index);
+                            break;
+                            
+                        case Array::Contiguous:
+                            if (!mode.isInBounds())
+                                break;
+                            heap = HeapLocation(
+                                IndexedPropertyLoc, IndexedContiguousProperties, base, index);
+                            break;
+                            
+                        case Array::Int8Array:
+                        case Array::Int16Array:
+                        case Array::Int32Array:
+                        case Array::Uint8Array:
+                        case Array::Uint8ClampedArray:
+                        case Array::Uint16Array:
+                        case Array::Uint32Array:
+                        case Array::Float32Array:
+                        case Array::Float64Array:
+                            if (!mode.isInBounds())
+                                break;
+                            heap = HeapLocation(
+                                IndexedPropertyLoc, TypedArrayProperties, base, index);
+                            break;
+                            
+                        default:
+                            break;
+                        }
+
+                        if (!!heap && m_maps.findReplacement(heap))
+                            m_node->setOp(PutByValAlias);
+                    }
+
+                    clobberize(m_graph, m_node, *this);
+                }
+            }
+
+            m_insertionSet.execute(block);
+        
+            return m_changed;
+        }
+    
+        void read(AbstractHeap) { }
+    
+        void write(AbstractHeap heap)
+        {
+            m_maps.write(heap);
+        }
+        
+        void def(PureValue value)
+        {
+            Node* match = m_maps.addPure(value, m_node);
+            if (!match)
+                return;
+
+            m_node->replaceWith(match);
+            m_changed = true;
+        }
+    
+        void def(const HeapLocation& location, const LazyNode& value)
+        {
+            LazyNode match = m_maps.addImpure(location, value);
+            if (!match)
+                return;
+        
+            if (m_node->op() == GetLocal) {
+                // Usually the CPS rethreading phase does this. But it's OK for us to mess with
+                // locals so long as:
+                // 
+                // - We dethread the graph. Any changes we make may invalidate the assumptions of
+                //   our CPS form, particularly if this GetLocal is linked to the variablesAtTail.
+                //
+                // - We don't introduce a Phantom for the child of the GetLocal. This wouldn't be
+                //   totally wrong but it would pessimize the code. Just because there is a
+                //   GetLocal doesn't mean that the child was live. Simply rerouting the all uses
+                //   of this GetLocal will preserve the live-at-exit information just fine.
+                //
+                // We accomplish the latter by just clearing the child; then the Phantom that we
+                // introduce won't have children and so it will eventually just be deleted.
+            
+                m_node->child1() = Edge();
+                m_graph.dethread();
+            }
+        
+            if (value.isNode() && value.asNode() == m_node) {
+                match.ensureIsNode(m_insertionSet, m_block, 0)->owner = m_block;
+                ASSERT(match.isNode());
+                m_node->replaceWith(match.asNode());
+                m_changed = true;
+            }
+        }
+    
+    private:
+        Graph& m_graph;
+        
+        bool m_changed;
+        Node* m_node;
+        BasicBlock* m_block;
+    
+        Maps m_maps;
+
+        InsertionSet m_insertionSet;
+    };
+
+    BlockCSE<SmallMaps> m_smallBlock;
+    BlockCSE<LargeMaps> m_largeBlock;
+};
+
+class GlobalCSEPhase : public Phase {
+public:
+    GlobalCSEPhase(Graph& graph)
+        : Phase(graph, "global common subexpression elimination")
+        , m_impureDataMap(graph)
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_fixpointState == FixpointNotConverged);
+        ASSERT(m_graph.m_form == SSA);
+        
+        m_graph.initializeNodeOwners();
+        m_graph.ensureDominators();
+        
+        m_preOrder = m_graph.blocksInPreOrder();
+        
+        // First figure out what gets clobbered by blocks. Node that this uses the preOrder list
+        // for convenience only.
+        for (unsigned i = m_preOrder.size(); i--;) {
+            m_block = m_preOrder[i];
+            m_impureData = &m_impureDataMap[m_block];
+            for (unsigned nodeIndex = m_block->size(); nodeIndex--;)
+                addWrites(m_graph, m_block->at(nodeIndex), m_impureData->writes);
+        }
+        
+        // Based on my experience doing this before, what follows might have to be made iterative.
+        // Right now it doesn't have to be iterative because everything is dominator-bsed. But when
+        // validation is enabled, we check if iterating would find new CSE opportunities.
+
+        bool changed = iterate();
+        
+        // FIXME: It should be possible to assert that CSE will not find any new opportunities if you
+        // run it a second time. Unfortunately, we cannot assert this right now. Note that if we did
+        // this, we'd have to first reset all of our state.
+        // https://bugs.webkit.org/show_bug.cgi?id=145853
+        
+        return changed;
+    }
+    
+    bool iterate()
+    {
+        if (verbose)
+            dataLog("Performing iteration.\n");
+        
+        m_changed = false;
+        m_graph.clearReplacements();
+        
+        for (unsigned i = 0; i < m_preOrder.size(); ++i) {
+            m_block = m_preOrder[i];
+            m_impureData = &m_impureDataMap[m_block];
+            m_writesSoFar.clear();
+            
+            if (verbose)
+                dataLog("Processing block ", *m_block, ":\n");
+
+            for (unsigned nodeIndex = 0; nodeIndex < m_block->size(); ++nodeIndex) {
+                m_nodeIndex = nodeIndex;
+                m_node = m_block->at(nodeIndex);
+                if (verbose)
+                    dataLog("  Looking at node ", m_node, ":\n");
+                
+                m_graph.performSubstitution(m_node);
+                
+                if (m_node->op() == Identity) {
+                    m_node->replaceWith(m_node->child1().node());
+                    m_changed = true;
+                } else
+                    clobberize(m_graph, m_node, *this);
+            }
+
+            m_insertionSet.execute(m_block);
+            
+            m_impureData->didVisit = true;
+        }
+        
+        return m_changed;
+    }
+
+    void read(AbstractHeap) { }
+    
+    void write(AbstractHeap heap)
+    {
+        m_impureData->availableAtTail.clobber(heap);
+        m_writesSoFar.add(heap);
+    }
+    
+    void def(PureValue value)
+    {
+        // With pure values we do not have to worry about the possibility of some control flow path
+        // clobbering the value. So, we just search for all of the like values that have been
+        // computed. We pick one that is in a block that dominates ours. Note that this means that
+        // a PureValue will map to a list of nodes, since there may be many places in the control
+        // flow graph that compute a value but only one of them that dominates us. We may build up
+        // a large list of nodes that compute some value in the case of gnarly control flow. This
+        // is probably OK.
+        
+        auto result = m_pureValues.add(value, Vector<Node*>());
+        if (result.isNewEntry) {
+            result.iterator->value.append(m_node);
+            return;
+        }
+        
+        for (unsigned i = result.iterator->value.size(); i--;) {
+            Node* candidate = result.iterator->value[i];
+            if (m_graph.m_dominators->dominates(candidate->owner, m_block)) {
+                m_node->replaceWith(candidate);
+                m_changed = true;
+                return;
+            }
+        }
+        
+        result.iterator->value.append(m_node);
+    }
+    
+    LazyNode findReplacement(HeapLocation location)
+    {
+        // At this instant, our "availableAtTail" reflects the set of things that are available in
+        // this block so far. We check this map to find block-local CSE opportunities before doing
+        // a global search.
+        LazyNode match = m_impureData->availableAtTail.get(location);
+        if (!!match) {
+            if (verbose)
+                dataLog("      Found local match: ", match, "\n");
+            return match;
+        }
+        
+        // If it's not available at this point in the block, and at some prior point in the block
+        // we have clobbered this heap location, then there is no point in doing a global search.
+        if (m_writesSoFar.overlaps(location.heap())) {
+            if (verbose)
+                dataLog("      Not looking globally because of local clobber: ", m_writesSoFar, "\n");
+            return nullptr;
+        }
+        
+        // This perfoms a backward search over the control flow graph to find some possible
+        // non-local def() that matches our heap location. Such a match is only valid if there does
+        // not exist any path from that def() to our block that contains a write() that overlaps
+        // our heap. This algorithm looks for both of these things (the matching def and the
+        // overlapping writes) in one backwards DFS pass.
+        //
+        // This starts by looking at the starting block's predecessors, and then it continues along
+        // their predecessors. As soon as this finds a possible def() - one that defines the heap
+        // location we want while dominating our starting block - it assumes that this one must be
+        // the match. It then lets the DFS over predecessors complete, but it doesn't add the
+        // def()'s predecessors; this ensures that any blocks we visit thereafter are on some path
+        // from the def() to us. As soon as the DFG finds a write() that overlaps the location's
+        // heap, it stops, assuming that there is no possible match. Note that the write() case may
+        // trigger before we find a def(), or after. Either way, the write() case causes this
+        // function to immediately return nullptr.
+        //
+        // If the write() is found before we find the def(), then we know that any def() we would
+        // find would have a path to us that trips over the write() and hence becomes invalid. This
+        // is just a direct outcome of us looking for a def() that dominates us. Given a block A
+        // that dominates block B - so that A is the one that would have the def() and B is our
+        // starting block - we know that any other block must either be on the path from A to B, or
+        // it must be on a path from the root to A, but not both. So, if we haven't found A yet but
+        // we already have found a block C that has a write(), then C must be on some path from A
+        // to B, which means that A's def() is invalid for our purposes. Hence, before we find the
+        // def(), stopping on write() is the right thing to do.
+        //
+        // Stopping on write() is also the right thing to do after we find the def(). After we find
+        // the def(), we don't add that block's predecessors to the search worklist. That means
+        // that henceforth the only blocks we will see in the search are blocks on the path from
+        // the def() to us. If any such block has a write() that clobbers our heap then we should
+        // give up.
+        //
+        // Hence this graph search algorithm ends up being deceptively simple: any overlapping
+        // write() causes us to immediately return nullptr, and a matching def() means that we just
+        // record it and neglect to visit its precessors.
+        
+        Vector<BasicBlock*, 8> worklist;
+        Vector<BasicBlock*, 8> seenList;
+        BitVector seen;
+        
+        for (unsigned i = m_block->predecessors.size(); i--;) {
+            BasicBlock* predecessor = m_block->predecessors[i];
+            if (!seen.get(predecessor->index)) {
+                worklist.append(predecessor);
+                seen.set(predecessor->index);
+            }
+        }
+        
+        while (!worklist.isEmpty()) {
+            BasicBlock* block = worklist.takeLast();
+            seenList.append(block);
+            
+            if (verbose)
+                dataLog("      Searching in block ", *block, "\n");
+            ImpureBlockData& data = m_impureDataMap[block];
+            
+            // We require strict domination because this would only see things in our own block if
+            // they came *after* our position in the block. Clearly, while our block dominates
+            // itself, the things in the block after us don't dominate us.
+            if (m_graph.m_dominators->strictlyDominates(block, m_block)) {
+                if (verbose)
+                    dataLog("        It strictly dominates.\n");
+                DFG_ASSERT(m_graph, m_node, data.didVisit);
+                DFG_ASSERT(m_graph, m_node, !match);
+                match = data.availableAtTail.get(location);
+                if (verbose)
+                    dataLog("        Availability: ", match, "\n");
+                if (!!match) {
+                    // Don't examine the predecessors of a match. At this point we just want to
+                    // establish that other blocks on the path from here to there don't clobber
+                    // the location we're interested in.
+                    continue;
+                }
+            }
+            
+            if (verbose)
+                dataLog("        Dealing with write set ", data.writes, "\n");
+            if (data.writes.overlaps(location.heap())) {
+                if (verbose)
+                    dataLog("        Clobbered.\n");
+                return nullptr;
+            }
+            
+            for (unsigned i = block->predecessors.size(); i--;) {
+                BasicBlock* predecessor = block->predecessors[i];
+                if (!seen.get(predecessor->index)) {
+                    worklist.append(predecessor);
+                    seen.set(predecessor->index);
+                }
+            }
+        }
+        
+        if (!match)
+            return nullptr;
+        
+        // Cache the results for next time. We cache them both for this block and for all of our
+        // predecessors, since even though we've already visited our predecessors, our predecessors
+        // probably have successors other than us.
+        // FIXME: Consider caching failed searches as well, when match is null. It's not clear that
+        // the reduction in compile time would warrant the increase in complexity, though.
+        // https://bugs.webkit.org/show_bug.cgi?id=134876
+        for (BasicBlock* block : seenList)
+            m_impureDataMap[block].availableAtTail.add(location, match);
+        m_impureData->availableAtTail.add(location, match);
+        
+        return match;
+    }
+    
+    void def(HeapLocation location, LazyNode value)
+    {
+        if (verbose)
+            dataLog("    Got heap location def: ", location, " -> ", value, "\n");
+        
+        LazyNode match = findReplacement(location);
+        
+        if (verbose)
+            dataLog("      Got match: ", match, "\n");
+        
+        if (!match) {
+            if (verbose)
+                dataLog("      Adding at-tail mapping: ", location, " -> ", value, "\n");
+            auto result = m_impureData->availableAtTail.add(location, value);
+            ASSERT_UNUSED(result, !result);
+            return;
+        }
+
+        if (value.isNode() && value.asNode() == m_node) {
+            if (!match.isNode()) {
+                // We need to properly record the constant in order to use an existing one if applicable.
+                // This ensures that re-running GCSE will not find new optimizations.
+                match.ensureIsNode(m_insertionSet, m_block, m_nodeIndex)->owner = m_block;
+                auto result = m_pureValues.add(PureValue(match.asNode(), match->constant()), Vector<Node*>());
+                bool replaced = false;
+                if (!result.isNewEntry) {
+                    for (unsigned i = result.iterator->value.size(); i--;) {
+                        Node* candidate = result.iterator->value[i];
+                        if (m_graph.m_dominators->dominates(candidate->owner, m_block)) {
+                            ASSERT(candidate);
+                            match->replaceWith(candidate);
+                            match.setNode(candidate);
+                            replaced = true;
+                            break;
+                        }
+                    }
+                }
+                if (!replaced)
+                    result.iterator->value.append(match.asNode());
+            }
+            ASSERT(match.asNode());
+            m_node->replaceWith(match.asNode());
+            m_changed = true;
+        }
+    }
+    
+    struct ImpureBlockData {
+        ImpureBlockData()
+            : didVisit(false)
+        {
+        }
+        
+        ClobberSet writes;
+        ImpureMap availableAtTail;
+        bool didVisit;
+    };
+    
+    Vector<BasicBlock*> m_preOrder;
+
+    PureMultiMap m_pureValues;
+    BlockMap<ImpureBlockData> m_impureDataMap;
+    
+    BasicBlock* m_block;
+    Node* m_node;
+    unsigned m_nodeIndex;
+    ImpureBlockData* m_impureData;
+    ClobberSet m_writesSoFar;
+    InsertionSet m_insertionSet;
+    
+    bool m_changed;
+};
+
+} // anonymous namespace
+
+bool performLocalCSE(Graph& graph)
+{
+    return runPhase<LocalCSEPhase>(graph);
+}
+
+bool performGlobalCSE(Graph& graph)
+{
+    return runPhase<GlobalCSEPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCSEPhase.h b/dfg/DFGCSEPhase.h
new file mode 100644
index 0000000..a8042ec
--- /dev/null
+++ b/dfg/DFGCSEPhase.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Block-local common subexpression elimination. It uses clobberize() for heap
+// modeling, which is quite precise. This phase is known to produce big wins on
+// a few benchmarks, and is relatively cheap to run.
+//
+// Note that this phase also gets rid of Identity nodes, which means that it's
+// currently not an optional phase. Basically, DFG IR doesn't have use-lists,
+// so there is no instantaneous replaceAllUsesWith operation. Instead, you turn
+// a node into an Identity and wait for CSE to clean it up.
+bool performLocalCSE(Graph&);
+
+// Same, but global. Only works for SSA. This will find common subexpressions
+// both in the same block and in any block that dominates the current block. It
+// has no limits on how far it will look for load-elimination opportunities.
+bool performGlobalCSE(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCallArrayAllocatorSlowPathGenerator.h b/dfg/DFGCallArrayAllocatorSlowPathGenerator.h
new file mode 100644
index 0000000..59c4092
--- /dev/null
+++ b/dfg/DFGCallArrayAllocatorSlowPathGenerator.h
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGSlowPathGenerator.h"
+#include "DFGSpeculativeJIT.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class CallArrayAllocatorSlowPathGenerator : public JumpingSlowPathGenerator<MacroAssembler::JumpList> {
+public:
+    CallArrayAllocatorSlowPathGenerator(
+        MacroAssembler::JumpList from, SpeculativeJIT* jit, P_JITOperation_EStZB function,
+        GPRReg resultGPR, GPRReg storageGPR, RegisteredStructure structure, size_t size)
+        : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
+        , m_function(function)
+        , m_resultGPR(resultGPR)
+        , m_storageGPR(storageGPR)
+        , m_structure(structure)
+        , m_size(size)
+    {
+        ASSERT(size < static_cast<size_t>(std::numeric_limits<int32_t>::max()));
+        jit->silentSpillAllRegistersImpl(false, m_plans, resultGPR);
+    }
+
+protected:
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        linkFrom(jit);
+        for (unsigned i = 0; i < m_plans.size(); ++i)
+            jit->silentSpill(m_plans[i]);
+        jit->callOperation(m_function, m_resultGPR, m_structure, m_size, m_storageGPR);
+        GPRReg canTrample = SpeculativeJIT::pickCanTrample(m_resultGPR);
+        for (unsigned i = m_plans.size(); i--;)
+            jit->silentFill(m_plans[i], canTrample);
+        jit->m_jit.exceptionCheck();
+        jit->m_jit.loadPtr(MacroAssembler::Address(m_resultGPR, JSObject::butterflyOffset()), m_storageGPR);
+        jumpTo(jit);
+    }
+    
+private:
+    P_JITOperation_EStZB m_function;
+    GPRReg m_resultGPR;
+    GPRReg m_storageGPR;
+    RegisteredStructure m_structure;
+    size_t m_size;
+    Vector<SilentRegisterSavePlan, 2> m_plans;
+};
+
+class CallArrayAllocatorWithVariableSizeSlowPathGenerator : public JumpingSlowPathGenerator<MacroAssembler::JumpList> {
+public:
+    CallArrayAllocatorWithVariableSizeSlowPathGenerator(
+        MacroAssembler::JumpList from, SpeculativeJIT* jit, P_JITOperation_EStZB function,
+        GPRReg resultGPR, RegisteredStructure contiguousStructure, RegisteredStructure arrayStorageStructure, GPRReg sizeGPR, GPRReg storageGPR)
+        : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
+        , m_function(function)
+        , m_resultGPR(resultGPR)
+        , m_contiguousStructure(contiguousStructure)
+        , m_arrayStorageOrContiguousStructure(arrayStorageStructure)
+        , m_sizeGPR(sizeGPR)
+        , m_storageGPR(storageGPR)
+    {
+        jit->silentSpillAllRegistersImpl(false, m_plans, resultGPR);
+    }
+
+protected:
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        linkFrom(jit);
+        for (unsigned i = 0; i < m_plans.size(); ++i)
+            jit->silentSpill(m_plans[i]);
+        GPRReg scratchGPR = AssemblyHelpers::selectScratchGPR(m_sizeGPR, m_storageGPR);
+        if (m_contiguousStructure.get() != m_arrayStorageOrContiguousStructure.get()) {
+            MacroAssembler::Jump bigLength = jit->m_jit.branch32(MacroAssembler::AboveOrEqual, m_sizeGPR, MacroAssembler::TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
+            jit->m_jit.move(SpeculativeJIT::TrustedImmPtr(m_contiguousStructure), scratchGPR);
+            MacroAssembler::Jump done = jit->m_jit.jump();
+            bigLength.link(&jit->m_jit);
+            jit->m_jit.move(SpeculativeJIT::TrustedImmPtr(m_arrayStorageOrContiguousStructure), scratchGPR);
+            done.link(&jit->m_jit);
+        } else
+            jit->m_jit.move(SpeculativeJIT::TrustedImmPtr(m_contiguousStructure), scratchGPR);
+        jit->callOperation(m_function, m_resultGPR, scratchGPR, m_sizeGPR, m_storageGPR);
+        GPRReg canTrample = SpeculativeJIT::pickCanTrample(m_resultGPR);
+        for (unsigned i = m_plans.size(); i--;)
+            jit->silentFill(m_plans[i], canTrample);
+        jit->m_jit.exceptionCheck();
+        jumpTo(jit);
+    }
+    
+private:
+    P_JITOperation_EStZB m_function;
+    GPRReg m_resultGPR;
+    RegisteredStructure m_contiguousStructure;
+    RegisteredStructure m_arrayStorageOrContiguousStructure;
+    GPRReg m_sizeGPR;
+    GPRReg m_storageGPR;
+    Vector<SilentRegisterSavePlan, 2> m_plans;
+};
+
+class CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator : public JumpingSlowPathGenerator<MacroAssembler::JumpList> {
+public:
+    CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator(
+        MacroAssembler::JumpList from, SpeculativeJIT* jit, P_JITOperation_EStZB function,
+        GPRReg resultGPR, GPRReg structureGPR, GPRReg sizeGPR, GPRReg storageGPR, GPRReg scratchGPR)
+        : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
+        , m_function(function)
+        , m_resultGPR(resultGPR)
+        , m_structureGPR(structureGPR)
+        , m_sizeGPR(sizeGPR)
+        , m_storageGPR(storageGPR)
+        , m_scratchGPR(scratchGPR)
+    {
+        jit->silentSpillAllRegistersImpl(false, m_plans, resultGPR, m_scratchGPR);
+    }
+
+protected:
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        linkFrom(jit);
+        for (unsigned i = 0; i < m_plans.size(); ++i)
+            jit->silentSpill(m_plans[i]);
+        jit->callOperation(m_function, m_resultGPR, m_structureGPR, m_sizeGPR, m_storageGPR);
+        for (unsigned i = m_plans.size(); i--;)
+            jit->silentFill(m_plans[i], m_scratchGPR);
+        jit->m_jit.exceptionCheck();
+        jumpTo(jit);
+    }
+    
+private:
+    P_JITOperation_EStZB m_function;
+    GPRReg m_resultGPR;
+    GPRReg m_structureGPR;
+    GPRReg m_sizeGPR;
+    GPRReg m_storageGPR;
+    GPRReg m_scratchGPR;
+    Vector<SilentRegisterSavePlan, 2> m_plans;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h b/dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h
new file mode 100644
index 0000000..feed81f
--- /dev/null
+++ b/dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGOperations.h"
+#include "DFGSlowPathGenerator.h"
+#include "DFGSpeculativeJIT.h"
+#include "DirectArguments.h"
+
+namespace JSC { namespace DFG {
+
+// This calls operationCreateDirectArguments but then restores the value of lengthGPR.
+class CallCreateDirectArgumentsSlowPathGenerator : public JumpingSlowPathGenerator<MacroAssembler::JumpList> {
+public:
+    CallCreateDirectArgumentsSlowPathGenerator(
+        MacroAssembler::JumpList from, SpeculativeJIT* jit, GPRReg resultGPR, RegisteredStructure structure,
+        GPRReg lengthGPR, unsigned minCapacity)
+        : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
+        , m_resultGPR(resultGPR)
+        , m_structure(structure)
+        , m_lengthGPR(lengthGPR)
+        , m_minCapacity(minCapacity)
+    {
+        jit->silentSpillAllRegistersImpl(false, m_plans, resultGPR);
+    }
+
+protected:
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        linkFrom(jit);
+        for (unsigned i = 0; i < m_plans.size(); ++i)
+            jit->silentSpill(m_plans[i]);
+        jit->callOperation(
+            operationCreateDirectArguments, m_resultGPR, m_structure, m_lengthGPR, m_minCapacity);
+        GPRReg canTrample = SpeculativeJIT::pickCanTrample(m_resultGPR);
+        for (unsigned i = m_plans.size(); i--;)
+            jit->silentFill(m_plans[i], canTrample);
+        jit->m_jit.exceptionCheck();
+        jit->m_jit.loadPtr(
+            MacroAssembler::Address(m_resultGPR, DirectArguments::offsetOfLength()), m_lengthGPR);
+        jumpTo(jit);
+    }
+    
+private:
+    GPRReg m_resultGPR;
+    RegisteredStructure m_structure;
+    GPRReg m_lengthGPR;
+    unsigned m_minCapacity;
+    Vector<SilentRegisterSavePlan, 2> m_plans;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCapabilities.cpp b/dfg/DFGCapabilities.cpp
new file mode 100644
index 0000000..b786d55
--- /dev/null
+++ b/dfg/DFGCapabilities.cpp
@@ -0,0 +1,294 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCapabilities.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGCommon.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "Options.h"
+
+namespace JSC { namespace DFG {
+
+bool isSupported()
+{
+    return Options::useDFGJIT()
+        && MacroAssembler::supportsFloatingPoint();
+}
+
+bool isSupportedForInlining(CodeBlock* codeBlock)
+{
+    return codeBlock->ownerScriptExecutable()->isInliningCandidate();
+}
+
+bool mightCompileEval(CodeBlock* codeBlock)
+{
+    return isSupported()
+        && codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount()
+        && codeBlock->ownerScriptExecutable()->isOkToOptimize();
+}
+bool mightCompileProgram(CodeBlock* codeBlock)
+{
+    return isSupported()
+        && codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount()
+        && codeBlock->ownerScriptExecutable()->isOkToOptimize();
+}
+bool mightCompileFunctionForCall(CodeBlock* codeBlock)
+{
+    return isSupported()
+        && codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount()
+        && codeBlock->ownerScriptExecutable()->isOkToOptimize();
+}
+bool mightCompileFunctionForConstruct(CodeBlock* codeBlock)
+{
+    return isSupported()
+        && codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount()
+        && codeBlock->ownerScriptExecutable()->isOkToOptimize();
+}
+
+bool mightInlineFunctionForCall(CodeBlock* codeBlock)
+{
+    return codeBlock->instructionCount() <= Options::maximumFunctionForCallInlineCandidateInstructionCount()
+        && isSupportedForInlining(codeBlock);
+}
+bool mightInlineFunctionForClosureCall(CodeBlock* codeBlock)
+{
+    return codeBlock->instructionCount() <= Options::maximumFunctionForClosureCallInlineCandidateInstructionCount()
+        && isSupportedForInlining(codeBlock);
+}
+bool mightInlineFunctionForConstruct(CodeBlock* codeBlock)
+{
+    return codeBlock->instructionCount() <= Options::maximumFunctionForConstructInlineCandidateInstructionCount()
+        && isSupportedForInlining(codeBlock);
+}
+bool canUseOSRExitFuzzing(CodeBlock* codeBlock)
+{
+    return codeBlock->ownerScriptExecutable()->canUseOSRExitFuzzing();
+}
+
+inline void debugFail(CodeBlock* codeBlock, OpcodeID opcodeID, CapabilityLevel result)
+{
+    if (Options::verboseCompilation() && !canCompile(result))
+        dataLog("Cannot compile code block ", *codeBlock, " because of opcode ", opcodeNames[opcodeID], "\n");
+}
+
+CapabilityLevel capabilityLevel(OpcodeID opcodeID, CodeBlock* codeBlock, Instruction* pc)
+{
+    UNUSED_PARAM(codeBlock); // This function does some bytecode parsing. Ordinarily bytecode parsing requires the owning CodeBlock. It's sort of strange that we don't use it here right now.
+    UNUSED_PARAM(pc);
+    
+    switch (opcodeID) {
+    case op_enter:
+    case op_to_this:
+    case op_argument_count:
+    case op_check_tdz:
+    case op_create_this:
+    case op_bitand:
+    case op_bitor:
+    case op_bitxor:
+    case op_rshift:
+    case op_lshift:
+    case op_urshift:
+    case op_unsigned:
+    case op_inc:
+    case op_dec:
+    case op_add:
+    case op_sub:
+    case op_negate:
+    case op_mul:
+    case op_mod:
+    case op_pow:
+    case op_div:
+    case op_debug:
+    case op_profile_type:
+    case op_profile_control_flow:
+    case op_mov:
+    case op_overrides_has_instance:
+    case op_instanceof:
+    case op_instanceof_custom:
+    case op_is_empty:
+    case op_is_undefined:
+    case op_is_boolean:
+    case op_is_number:
+    case op_is_object:
+    case op_is_object_or_null:
+    case op_is_cell_with_type:
+    case op_is_function:
+    case op_not:
+    case op_less:
+    case op_lesseq:
+    case op_greater:
+    case op_greatereq:
+    case op_eq:
+    case op_eq_null:
+    case op_stricteq:
+    case op_neq:
+    case op_neq_null:
+    case op_nstricteq:
+    case op_get_by_val:
+    case op_put_by_val:
+    case op_put_by_val_direct:
+    case op_try_get_by_id:
+    case op_get_by_id:
+    case op_get_by_id_proto_load:
+    case op_get_by_id_unset:
+    case op_get_by_id_with_this:
+    case op_get_by_val_with_this:
+    case op_get_array_length:
+    case op_put_by_id:
+    case op_put_by_id_with_this:
+    case op_put_by_val_with_this:
+    case op_put_getter_by_id:
+    case op_put_setter_by_id:
+    case op_put_getter_setter_by_id:
+    case op_put_getter_by_val:
+    case op_put_setter_by_val:
+    case op_define_data_property:
+    case op_define_accessor_property:
+    case op_del_by_id:
+    case op_del_by_val:
+    case op_jmp:
+    case op_jtrue:
+    case op_jfalse:
+    case op_jeq_null:
+    case op_jneq_null:
+    case op_jless:
+    case op_jlesseq:
+    case op_jgreater:
+    case op_jgreatereq:
+    case op_jnless:
+    case op_jnlesseq:
+    case op_jngreater:
+    case op_jngreatereq:
+    case op_loop_hint:
+    case op_watchdog:
+    case op_ret:
+    case op_end:
+    case op_new_object:
+    case op_new_array:
+    case op_new_array_with_size:
+    case op_new_array_buffer:
+    case op_new_array_with_spread:
+    case op_spread:
+    case op_strcat:
+    case op_to_primitive:
+    case op_throw:
+    case op_throw_static_error:
+    case op_call:
+    case op_tail_call:
+    case op_construct:
+    case op_call_varargs:
+    case op_tail_call_varargs:
+    case op_tail_call_forward_arguments:
+    case op_construct_varargs:
+    case op_create_direct_arguments:
+    case op_create_scoped_arguments:
+    case op_create_cloned_arguments:
+    case op_get_from_arguments:
+    case op_put_to_arguments:
+    case op_get_argument:
+    case op_jneq_ptr:
+    case op_typeof:
+    case op_to_number:
+    case op_to_string:
+    case op_switch_imm:
+    case op_switch_char:
+    case op_in:
+    case op_get_scope:
+    case op_get_from_scope:
+    case op_get_enumerable_length:
+    case op_has_generic_property:
+    case op_has_structure_property:
+    case op_has_indexed_property:
+    case op_get_direct_pname:
+    case op_get_property_enumerator:
+    case op_enumerator_structure_pname:
+    case op_enumerator_generic_pname:
+    case op_to_index_string:
+    case op_new_func:
+    case op_new_func_exp:
+    case op_new_generator_func:
+    case op_new_generator_func_exp:
+    case op_new_async_func:
+    case op_new_async_func_exp:
+    case op_set_function_name:
+    case op_create_lexical_environment:
+    case op_get_parent_scope:
+    case op_catch:
+    case op_create_rest:
+    case op_get_rest_length:
+    case op_log_shadow_chicken_prologue:
+    case op_log_shadow_chicken_tail:
+    case op_put_to_scope:
+    case op_resolve_scope:
+    case op_new_regexp:
+        return CanCompileAndInline;
+
+    case op_switch_string: // Don't inline because we don't want to copy string tables in the concurrent JIT.
+    case op_call_eval:
+        return CanCompile;
+
+    default:
+        return CannotCompile;
+    }
+}
+
+CapabilityLevel capabilityLevel(CodeBlock* codeBlock)
+{
+    Interpreter* interpreter = codeBlock->vm()->interpreter;
+    Instruction* instructionsBegin = codeBlock->instructions().begin();
+    unsigned instructionCount = codeBlock->instructions().size();
+    CapabilityLevel result = CanCompileAndInline;
+    
+    for (unsigned bytecodeOffset = 0; bytecodeOffset < instructionCount; ) {
+        switch (interpreter->getOpcodeID(instructionsBegin[bytecodeOffset].u.opcode)) {
+#define DEFINE_OP(opcode, length) \
+        case opcode: { \
+            CapabilityLevel newResult = leastUpperBound(result, capabilityLevel(opcode, codeBlock, instructionsBegin + bytecodeOffset)); \
+            if (newResult != result) { \
+                debugFail(codeBlock, opcode, newResult); \
+                result = newResult; \
+            } \
+            bytecodeOffset += length; \
+            break; \
+        }
+            FOR_EACH_OPCODE_ID(DEFINE_OP)
+#undef DEFINE_OP
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+    
+    return result;
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGCapabilities.h b/dfg/DFGCapabilities.h
new file mode 100644
index 0000000..dd4d06f
--- /dev/null
+++ b/dfg/DFGCapabilities.h
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2011-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "DFGCommon.h"
+#include "Interpreter.h"
+#include "Intrinsic.h"
+#include "Options.h"
+
+namespace JSC { namespace DFG {
+
+#if ENABLE(DFG_JIT)
+// Fast check functions; if they return true it is still necessary to
+// check opcodes.
+bool isSupported();
+bool isSupportedForInlining(CodeBlock*);
+bool mightCompileEval(CodeBlock*);
+bool mightCompileProgram(CodeBlock*);
+bool mightCompileFunctionForCall(CodeBlock*);
+bool mightCompileFunctionForConstruct(CodeBlock*);
+bool mightInlineFunctionForCall(CodeBlock*);
+bool mightInlineFunctionForClosureCall(CodeBlock*);
+bool mightInlineFunctionForConstruct(CodeBlock*);
+bool canUseOSRExitFuzzing(CodeBlock*);
+
+inline CapabilityLevel capabilityLevel(OpcodeID opcodeID, CodeBlock* codeBlock, Instruction* pc);
+
+CapabilityLevel capabilityLevel(CodeBlock*);
+#else // ENABLE(DFG_JIT)
+inline bool mightCompileEval(CodeBlock*) { return false; }
+inline bool mightCompileProgram(CodeBlock*) { return false; }
+inline bool mightCompileFunctionForCall(CodeBlock*) { return false; }
+inline bool mightCompileFunctionForConstruct(CodeBlock*) { return false; }
+inline bool mightInlineFunctionForCall(CodeBlock*) { return false; }
+inline bool mightInlineFunctionForClosureCall(CodeBlock*) { return false; }
+inline bool mightInlineFunctionForConstruct(CodeBlock*) { return false; }
+inline bool canUseOSRExitFuzzing(CodeBlock*) { return false; }
+
+inline CapabilityLevel capabilityLevel(OpcodeID, CodeBlock*, Instruction*) { return CannotCompile; }
+inline CapabilityLevel capabilityLevel(CodeBlock*) { return CannotCompile; }
+#endif // ENABLE(DFG_JIT)
+
+inline CapabilityLevel evalCapabilityLevel(CodeBlock* codeBlock)
+{
+    if (!mightCompileEval(codeBlock))
+        return CannotCompile;
+    
+    return capabilityLevel(codeBlock);
+}
+
+inline CapabilityLevel programCapabilityLevel(CodeBlock* codeBlock)
+{
+    if (!mightCompileProgram(codeBlock))
+        return CannotCompile;
+    
+    return capabilityLevel(codeBlock);
+}
+
+inline CapabilityLevel functionCapabilityLevel(bool mightCompile, bool mightInline, CapabilityLevel computedCapabilityLevel)
+{
+    if (mightCompile && mightInline)
+        return leastUpperBound(CanCompileAndInline, computedCapabilityLevel);
+    if (mightCompile && !mightInline)
+        return leastUpperBound(CanCompile, computedCapabilityLevel);
+    if (!mightCompile)
+        return CannotCompile;
+    RELEASE_ASSERT_NOT_REACHED();
+    return CannotCompile;
+}
+
+inline CapabilityLevel functionForCallCapabilityLevel(CodeBlock* codeBlock)
+{
+    return functionCapabilityLevel(
+        mightCompileFunctionForCall(codeBlock),
+        mightInlineFunctionForCall(codeBlock),
+        capabilityLevel(codeBlock));
+}
+
+inline CapabilityLevel functionForConstructCapabilityLevel(CodeBlock* codeBlock)
+{
+    return functionCapabilityLevel(
+        mightCompileFunctionForConstruct(codeBlock),
+        mightInlineFunctionForConstruct(codeBlock),
+        capabilityLevel(codeBlock));
+}
+
+inline CapabilityLevel inlineFunctionForCallCapabilityLevel(CodeBlock* codeBlock)
+{
+    if (!mightInlineFunctionForCall(codeBlock))
+        return CannotCompile;
+    
+    return capabilityLevel(codeBlock);
+}
+
+inline CapabilityLevel inlineFunctionForClosureCallCapabilityLevel(CodeBlock* codeBlock)
+{
+    if (!mightInlineFunctionForClosureCall(codeBlock))
+        return CannotCompile;
+    
+    return capabilityLevel(codeBlock);
+}
+
+inline CapabilityLevel inlineFunctionForConstructCapabilityLevel(CodeBlock* codeBlock)
+{
+    if (!mightInlineFunctionForConstruct(codeBlock))
+        return CannotCompile;
+    
+    return capabilityLevel(codeBlock);
+}
+
+inline bool mightInlineFunctionFor(CodeBlock* codeBlock, CodeSpecializationKind kind)
+{
+    if (kind == CodeForCall)
+        return mightInlineFunctionForCall(codeBlock);
+    ASSERT(kind == CodeForConstruct);
+    return mightInlineFunctionForConstruct(codeBlock);
+}
+
+inline bool mightCompileFunctionFor(CodeBlock* codeBlock, CodeSpecializationKind kind)
+{
+    if (kind == CodeForCall)
+        return mightCompileFunctionForCall(codeBlock);
+    ASSERT(kind == CodeForConstruct);
+    return mightCompileFunctionForConstruct(codeBlock);
+}
+
+inline bool mightInlineFunction(CodeBlock* codeBlock)
+{
+    return mightInlineFunctionFor(codeBlock, codeBlock->specializationKind());
+}
+
+inline CapabilityLevel inlineFunctionForCapabilityLevel(CodeBlock* codeBlock, CodeSpecializationKind kind, bool isClosureCall)
+{
+    if (isClosureCall) {
+        if (kind != CodeForCall)
+            return CannotCompile;
+        return inlineFunctionForClosureCallCapabilityLevel(codeBlock);
+    }
+    if (kind == CodeForCall)
+        return inlineFunctionForCallCapabilityLevel(codeBlock);
+    ASSERT(kind == CodeForConstruct);
+    return inlineFunctionForConstructCapabilityLevel(codeBlock);
+}
+
+inline bool isSmallEnoughToInlineCodeInto(CodeBlock* codeBlock)
+{
+    return codeBlock->instructionCount() <= Options::maximumInliningCallerSize();
+}
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGCleanUpPhase.cpp b/dfg/DFGCleanUpPhase.cpp
new file mode 100644
index 0000000..b0bb8cc
--- /dev/null
+++ b/dfg/DFGCleanUpPhase.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCleanUpPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class CleanUpPhase : public Phase {
+public:
+    CleanUpPhase(Graph& graph)
+        : Phase(graph, "clean up")
+    {
+    }
+    
+    bool run()
+    {
+        bool changed = false;
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            unsigned sourceIndex = 0;
+            unsigned targetIndex = 0;
+            while (sourceIndex < block->size()) {
+                Node* node = block->at(sourceIndex++);
+                bool kill = false;
+                
+                if (node->op() == Check)
+                    node->children = node->children.justChecks();
+                
+                switch (node->op()) {
+                case Phantom:
+                case Check:
+                    if (node->children.isEmpty())
+                        kill = true;
+                    break;
+                default:
+                    break;
+                }
+                
+                if (kill)
+                    m_graph.deleteNode(node);
+                else
+                    block->at(targetIndex++) = node;
+            }
+            block->resize(targetIndex);
+        }
+        
+        return changed;
+    }
+};
+    
+bool performCleanUp(Graph& graph)
+{
+    return runPhase<CleanUpPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGCleanUpPhase.h b/dfg/DFGCleanUpPhase.h
new file mode 100644
index 0000000..730987c
--- /dev/null
+++ b/dfg/DFGCleanUpPhase.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Cleans up unneeded nodes, like empty Checks and Phantoms.
+
+bool performCleanUp(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGClobberSet.cpp b/dfg/DFGClobberSet.cpp
new file mode 100644
index 0000000..ce3398e
--- /dev/null
+++ b/dfg/DFGClobberSet.cpp
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGClobberSet.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGClobberize.h"
+#include "JSCInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace DFG {
+
+ClobberSet::ClobberSet() { }
+ClobberSet::~ClobberSet() { }
+
+void ClobberSet::add(AbstractHeap heap)
+{
+    HashMap<AbstractHeap, bool>::AddResult result = m_clobbers.add(heap, true);
+    if (!result.isNewEntry) {
+        if (result.iterator->value)
+            return;
+        result.iterator->value = true;
+    }
+    while (heap.kind() != World) {
+        heap = heap.supertype();
+        if (!m_clobbers.add(heap, false).isNewEntry)
+            return;
+    }
+}
+
+void ClobberSet::addAll(const ClobberSet& other)
+{
+    // If the other set has a direct heap, we make sure we have it and we set its
+    // value to be true.
+    //
+    // If the other heap has a super heap, we make sure it's present but don't
+    // modify its value - so we had it directly already then this doesn't change.
+    
+    if (this == &other)
+        return;
+    
+    HashMap<AbstractHeap, bool>::const_iterator iter = other.m_clobbers.begin();
+    HashMap<AbstractHeap, bool>::const_iterator end = other.m_clobbers.end();
+    for (; iter != end; ++iter)
+        m_clobbers.add(iter->key, iter->value).iterator->value |= iter->value;
+}
+
+bool ClobberSet::contains(AbstractHeap heap) const
+{
+    HashMap<AbstractHeap, bool>::const_iterator iter = m_clobbers.find(heap);
+    if (iter == m_clobbers.end())
+        return false;
+    return iter->value;
+}
+
+bool ClobberSet::overlaps(AbstractHeap heap) const
+{
+    if (m_clobbers.find(heap) != m_clobbers.end())
+        return true;
+    if (heap.kind() == DOMState && !heap.payload().isTop()) {
+        // DOMState heap has its own hierarchy. For direct heap clobbers that payload is not Top,
+        // we should query whether the clobber overlaps with the given heap.
+        DOMJIT::HeapRange range = DOMJIT::HeapRange::fromRaw(heap.payload().value32());
+        for (auto pair : m_clobbers) {
+            bool direct = pair.value;
+            if (!direct)
+                continue;
+            AbstractHeap clobber = pair.key;
+            if (clobber.kind() != DOMState)
+                continue;
+            if (clobber.payload().isTop())
+                return true;
+            if (DOMJIT::HeapRange::fromRaw(clobber.payload().value32()).overlaps(range))
+                return true;
+        }
+    }
+    while (heap.kind() != World) {
+        heap = heap.supertype();
+        if (contains(heap))
+            return true;
+    }
+    return false;
+}
+
+void ClobberSet::clear()
+{
+    m_clobbers.clear();
+}
+
+HashSet<AbstractHeap> ClobberSet::direct() const
+{
+    return setOf(true);
+}
+
+HashSet<AbstractHeap> ClobberSet::super() const
+{
+    return setOf(false);
+}
+
+void ClobberSet::dump(PrintStream& out) const
+{
+    out.print("(Direct:[", sortedListDump(direct()), "], Super:[", sortedListDump(super()), "])");
+}
+
+HashSet<AbstractHeap> ClobberSet::setOf(bool direct) const
+{
+    HashSet<AbstractHeap> result;
+    for (HashMap<AbstractHeap, bool>::const_iterator iter = m_clobbers.begin(); iter != m_clobbers.end(); ++iter) {
+        if (iter->value == direct)
+            result.add(iter->key);
+    }
+    return result;
+}
+
+void addReads(Graph& graph, Node* node, ClobberSet& readSet)
+{
+    ClobberSetAdd addRead(readSet);
+    NoOpClobberize noOp;
+    clobberize(graph, node, addRead, noOp, noOp);
+}
+
+void addWrites(Graph& graph, Node* node, ClobberSet& writeSet)
+{
+    NoOpClobberize noOp;
+    ClobberSetAdd addWrite(writeSet);
+    clobberize(graph, node, noOp, addWrite, noOp);
+}
+
+void addReadsAndWrites(Graph& graph, Node* node, ClobberSet& readSet, ClobberSet& writeSet)
+{
+    ClobberSetAdd addRead(readSet);
+    ClobberSetAdd addWrite(writeSet);
+    NoOpClobberize noOp;
+    clobberize(graph, node, addRead, addWrite, noOp);
+}
+
+bool readsOverlap(Graph& graph, Node* node, ClobberSet& readSet)
+{
+    ClobberSetOverlaps addRead(readSet);
+    NoOpClobberize noOp;
+    clobberize(graph, node, addRead, noOp, noOp);
+    return addRead.result();
+}
+
+bool writesOverlap(Graph& graph, Node* node, ClobberSet& writeSet)
+{
+    NoOpClobberize noOp;
+    ClobberSetOverlaps addWrite(writeSet);
+    clobberize(graph, node, noOp, addWrite, noOp);
+    return addWrite.result();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGClobberSet.h b/dfg/DFGClobberSet.h
new file mode 100644
index 0000000..f93e27f
--- /dev/null
+++ b/dfg/DFGClobberSet.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractHeap.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+class Graph;
+struct Node;
+
+// FIXME: If we ever want to compare if two nodes clobber each other, we should
+// have a SmallClobberSet, which just keeps an array of the AbstractHeaps and
+// satisfies overlaps() requests by looping over all of them. This will probably
+// be faster than a full HashMap in a lot of cases. Or, maybe, we could have
+// ClobberSet be smart and use a vector so long as it was small.
+
+class ClobberSet {
+public:
+    ClobberSet();
+    ~ClobberSet();
+    
+    bool isEmpty() const { return m_clobbers.isEmpty(); }
+    
+    void add(AbstractHeap);
+    void addAll(const ClobberSet&);
+    bool overlaps(AbstractHeap) const;
+    void clear();
+    
+    // Calls useful for debugging the ClobberSet.
+    // Do not call for non debugging purpose. Otherwise, you must handle DOMState hierarchy carefully.
+    
+    HashSet<AbstractHeap> direct() const;
+    HashSet<AbstractHeap> super() const;
+    
+    void dump(PrintStream&) const;
+    
+private:
+    bool contains(AbstractHeap) const;
+
+    HashSet<AbstractHeap> setOf(bool direct) const;
+    
+    // Maps heap to:
+    // true --> it's a direct clobber
+    // false --> it's just a supertype of a direct clobber
+    HashMap<AbstractHeap, bool> m_clobbers;
+};
+
+class ClobberSetAdd {
+public:
+    ClobberSetAdd(ClobberSet& set)
+        : m_set(set)
+    {
+    }
+    
+    void operator()(AbstractHeap heap) const
+    {
+        m_set.add(heap);
+    }
+private:
+    ClobberSet& m_set;
+};
+
+class ClobberSetOverlaps {
+public:
+    ClobberSetOverlaps(const ClobberSet& set)
+        : m_set(set)
+        , m_result(false)
+    {
+    }
+    
+    void operator()(AbstractHeap heap) const
+    {
+        m_result |= m_set.overlaps(heap);
+    }
+    
+    bool result() const { return m_result; }
+    
+private:
+    const ClobberSet& m_set;
+    mutable bool m_result;
+};
+
+void addReads(Graph&, Node*, ClobberSet&);
+void addWrites(Graph&, Node*, ClobberSet&);
+void addReadsAndWrites(Graph&, Node*, ClobberSet& reads, ClobberSet& writes);
+
+bool readsOverlap(Graph&, Node*, ClobberSet&);
+bool writesOverlap(Graph&, Node*, ClobberSet&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGClobberize.cpp b/dfg/DFGClobberize.cpp
new file mode 100644
index 0000000..a693ba4
--- /dev/null
+++ b/dfg/DFGClobberize.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGClobberize.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+bool doesWrites(Graph& graph, Node* node)
+{
+    NoOpClobberize noOp;
+    CheckClobberize addWrite;
+    clobberize(graph, node, noOp, addWrite, noOp);
+    return addWrite.result();
+}
+
+bool accessesOverlap(Graph& graph, Node* node, AbstractHeap heap)
+{
+    NoOpClobberize noOp;
+    AbstractHeapOverlaps addAccess(heap);
+    clobberize(graph, node, addAccess, addAccess, noOp);
+    return addAccess.result();
+}
+
+bool writesOverlap(Graph& graph, Node* node, AbstractHeap heap)
+{
+    NoOpClobberize noOp;
+    AbstractHeapOverlaps addWrite(heap);
+    clobberize(graph, node, noOp, addWrite, noOp);
+    return addWrite.result();
+}
+
+bool clobbersHeap(Graph& graph, Node* node)
+{
+    bool result = false;
+    clobberize(
+        graph, node, NoOpClobberize(),
+        [&] (AbstractHeap heap) {
+            switch (heap.kind()) {
+            case World:
+            case Heap:
+                result = true;
+                break;
+            default:
+                break;
+            }
+        },
+        NoOpClobberize());
+    return result;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGClobberize.h b/dfg/DFGClobberize.h
new file mode 100644
index 0000000..619f274
--- /dev/null
+++ b/dfg/DFGClobberize.h
@@ -0,0 +1,1566 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractHeap.h"
+#include "DFGEdgeUsesStructure.h"
+#include "DFGGraph.h"
+#include "DFGHeapLocation.h"
+#include "DFGLazyNode.h"
+#include "DFGPureValue.h"
+#include "DOMJITCallDOMGetterPatchpoint.h"
+#include "DOMJITSignature.h"
+
+namespace JSC { namespace DFG {
+
+template<typename ReadFunctor, typename WriteFunctor, typename DefFunctor>
+void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFunctor& write, const DefFunctor& def)
+{
+    // Some notes:
+    //
+    // - The canonical way of clobbering the world is to read world and write
+    //   heap. This is because World subsumes Heap and Stack, and Stack can be
+    //   read by anyone but only written to by explicit stack writing operations.
+    //   Of course, claiming to also write World is not wrong; it'll just
+    //   pessimise some important optimizations.
+    //
+    // - We cannot hoist, or sink, anything that has effects. This means that the
+    //   easiest way of indicating that something cannot be hoisted is to claim
+    //   that it side-effects some miscellaneous thing.
+    //
+    // - We cannot hoist forward-exiting nodes without some additional effort. I
+    //   believe that what it comes down to is that forward-exiting generally have
+    //   their NodeExitsForward cleared upon hoist, except for forward-exiting
+    //   nodes that take bogus state as their input. Those are substantially
+    //   harder. We disable it for now. In the future we could enable it by having
+    //   versions of those nodes that backward-exit instead, but I'm not convinced
+    //   of the soundness.
+    //
+    // - Some nodes lie, and claim that they do not read the JSCell_structureID,
+    //   JSCell_typeInfoFlags, etc. These are nodes that use the structure in a way
+    //   that does not depend on things that change under structure transitions.
+    //
+    // - It's implicitly understood that OSR exits read the world. This is why we
+    //   generally don't move or eliminate stores. Every node can exit, so the
+    //   read set does not reflect things that would be read if we exited.
+    //   Instead, the read set reflects what the node will have to read if it
+    //   *doesn't* exit.
+    //
+    // - Broadly, we don't say that we're reading something if that something is
+    //   immutable.
+    //
+    // - We try to make this work even prior to type inference, just so that we
+    //   can use it for IR dumps. No promises on whether the answers are sound
+    //   prior to type inference - though they probably could be if we did some
+    //   small hacking.
+    //
+    // - If you do read(Stack) or read(World), then make sure that readTop() in
+    //   PreciseLocalClobberize is correct.
+    
+    // While read() and write() are fairly self-explanatory - they track what sorts of things the
+    // node may read or write - the def() functor is more tricky. It tells you the heap locations
+    // (not just abstract heaps) that are defined by a node. A heap location comprises an abstract
+    // heap, some nodes, and a LocationKind. Briefly, a location defined by a node is a location
+    // whose value can be deduced from looking at the node itself. The locations returned must obey
+    // the following properties:
+    //
+    // - If someone wants to CSE a load from the heap, then a HeapLocation object should be
+    //   sufficient to find a single matching node.
+    //
+    // - The abstract heap is the only abstract heap that could be clobbered to invalidate any such
+    //   CSE attempt. I.e. if clobberize() reports that on every path between some node and a node
+    //   that defines a HeapLocation that it wanted, there were no writes to any abstract heap that
+    //   overlap the location's heap, then we have a sound match. Effectively, the semantics of
+    //   write() and def() are intertwined such that for them to be sound they must agree on what
+    //   is CSEable.
+    //
+    // read(), write(), and def() for heap locations is enough to do GCSE on effectful things. To
+    // keep things simple, this code will also def() pure things. def() must be overloaded to also
+    // accept PureValue. This way, a client of clobberize() can implement GCSE entirely using the
+    // information that clobberize() passes to write() and def(). Other clients of clobberize() can
+    // just ignore def() by using a NoOpClobberize functor.
+
+    if (edgesUseStructure(graph, node))
+        read(JSCell_structureID);
+    
+    // We allow the runtime to perform a stack scan at any time. We don't model which nodes get implemented
+    // by calls into the runtime. For debugging we might replace the implementation of any node with a call
+    // to the runtime, and that call may walk stack. Therefore, each node must read() anything that a stack
+    // scan would read. That's what this does.
+    for (InlineCallFrame* inlineCallFrame = node->origin.semantic.inlineCallFrame; inlineCallFrame; inlineCallFrame = inlineCallFrame->directCaller.inlineCallFrame) {
+        if (inlineCallFrame->isClosureCall)
+            read(AbstractHeap(Stack, inlineCallFrame->stackOffset + CallFrameSlot::callee));
+        if (inlineCallFrame->isVarargs())
+            read(AbstractHeap(Stack, inlineCallFrame->stackOffset + CallFrameSlot::argumentCount));
+    }
+
+    // We don't want to specifically account which nodes can read from the scope
+    // when the debugger is enabled. It's helpful to just claim all nodes do.
+    // Specifically, if a node allocates, this may call into the debugger's machinery.
+    // The debugger's machinery is free to take a stack trace and try to read from
+    // a scope which is expected to be flushed to the stack.
+    if (graph.hasDebuggerEnabled()) {
+        ASSERT(!node->origin.semantic.inlineCallFrame);
+        read(AbstractHeap(Stack, graph.m_codeBlock->scopeRegister()));
+    }
+        
+    
+    switch (node->op()) {
+    case JSConstant:
+    case DoubleConstant:
+    case Int52Constant:
+        def(PureValue(node, node->constant()));
+        return;
+
+    case Identity:
+    case Phantom:
+    case Check:
+    case ExtractOSREntryLocal:
+    case CheckStructureImmediate:
+        return;
+        
+    case LazyJSConstant:
+        // We should enable CSE of LazyJSConstant. It's a little annoying since LazyJSValue has
+        // more bits than we currently have in PureValue.
+        return;
+        
+    case ArithIMul:
+    case ArithMin:
+    case ArithMax:
+    case ArithPow:
+    case GetScope:
+    case SkipScope:
+    case GetGlobalObject:
+    case StringCharCodeAt:
+    case CompareStrictEq:
+    case CompareEqPtr:
+    case IsEmpty:
+    case IsUndefined:
+    case IsBoolean:
+    case IsNumber:
+    case IsObject:
+    case IsTypedArrayView:
+    case LogicalNot:
+    case CheckInBounds:
+    case DoubleRep:
+    case ValueRep:
+    case Int52Rep:
+    case BooleanToNumber:
+    case FiatInt52:
+    case MakeRope:
+    case StrCat:
+    case ValueToInt32:
+    case GetExecutable:
+    case BottomValue:
+    case TypeOf:
+        def(PureValue(node));
+        return;
+
+    case ArithCos:
+    case ArithFRound:
+    case ArithLog:
+    case ArithSin:
+    case ArithSqrt:
+    case ArithTan:
+        if (node->child1().useKind() == DoubleRepUse)
+            def(PureValue(node));
+        else {
+            read(World);
+            write(Heap);
+        }
+        return;
+
+    case ArithAbs:
+        if (node->child1().useKind() == Int32Use || node->child1().useKind() == DoubleRepUse)
+            def(PureValue(node));
+        else {
+            read(World);
+            write(Heap);
+        }
+        return;
+
+    case ArithClz32:
+        if (node->child1().useKind() == Int32Use || node->child1().useKind() == KnownInt32Use)
+            def(PureValue(node));
+        else {
+            read(World);
+            write(Heap);
+        }
+        return;
+
+    case ArithNegate:
+        if (node->child1().useKind() == Int32Use
+            || node->child1().useKind() == DoubleRepUse
+            || node->child1().useKind() == Int52RepUse)
+            def(PureValue(node));
+        else {
+            read(World);
+            write(Heap);
+        }
+        return;
+
+    case IsCellWithType:
+        def(PureValue(node, node->queriedType()));
+        return;
+
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case BitLShift:
+    case BitRShift:
+    case BitURShift:
+        if (node->child1().useKind() == UntypedUse || node->child2().useKind() == UntypedUse) {
+            read(World);
+            write(Heap);
+            return;
+        }
+        def(PureValue(node));
+        return;
+
+    case ArithRandom:
+        read(MathDotRandomState);
+        write(MathDotRandomState);
+        return;
+
+    case HasGenericProperty:
+    case HasStructureProperty:
+    case GetEnumerableLength:
+    case GetPropertyEnumerator: {
+        read(Heap);
+        write(SideState);
+        return;
+    }
+
+    case GetDirectPname: {
+        // This reads and writes heap because it can end up calling a generic getByVal 
+        // if the Structure changed, which could in turn end up calling a getter.
+        read(World);
+        write(Heap);
+        return;
+    }
+
+    case ToIndexString:
+    case GetEnumeratorStructurePname:
+    case GetEnumeratorGenericPname: {
+        def(PureValue(node));
+        return;
+    }
+
+    case HasIndexedProperty: {
+        read(JSObject_butterfly);
+        ArrayMode mode = node->arrayMode();
+        switch (mode.type()) {
+        case Array::ForceExit: {
+            write(SideState);
+            return;
+        }
+        case Array::Int32: {
+            if (mode.isInBounds()) {
+                read(Butterfly_publicLength);
+                read(IndexedInt32Properties);
+                def(HeapLocation(HasIndexedPropertyLoc, IndexedInt32Properties, node->child1(), node->child2()), LazyNode(node));
+                return;
+            }
+            read(Heap);
+            return;
+        }
+            
+        case Array::Double: {
+            if (mode.isInBounds()) {
+                read(Butterfly_publicLength);
+                read(IndexedDoubleProperties);
+                def(HeapLocation(HasIndexedPropertyLoc, IndexedDoubleProperties, node->child1(), node->child2()), LazyNode(node));
+                return;
+            }
+            read(Heap);
+            return;
+        }
+            
+        case Array::Contiguous: {
+            if (mode.isInBounds()) {
+                read(Butterfly_publicLength);
+                read(IndexedContiguousProperties);
+                def(HeapLocation(HasIndexedPropertyLoc, IndexedContiguousProperties, node->child1(), node->child2()), LazyNode(node));
+                return;
+            }
+            read(Heap);
+            return;
+        }
+
+        case Array::ArrayStorage: {
+            if (mode.isInBounds()) {
+                read(Butterfly_vectorLength);
+                read(IndexedArrayStorageProperties);
+                return;
+            }
+            read(Heap);
+            return;
+        }
+
+        default: {
+            read(World);
+            write(Heap);
+            return;
+        }
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+
+    case StringFromCharCode:
+        switch (node->child1().useKind()) {
+        case Int32Use:
+            def(PureValue(node));
+            return;
+        case UntypedUse:
+            read(World);
+            write(Heap);
+            return;
+        default:
+            DFG_CRASH(graph, node, "Bad use kind");
+        }
+        return;
+
+    case ArithAdd:
+    case ArithMod:
+    case DoubleAsInt32:
+    case UInt32ToNumber:
+        def(PureValue(node, node->arithMode()));
+        return;
+
+    case ArithDiv:
+    case ArithMul:
+    case ArithSub:
+        switch (node->binaryUseKind()) {
+        case Int32Use:
+        case Int52RepUse:
+        case DoubleRepUse:
+            def(PureValue(node, node->arithMode()));
+            return;
+        case UntypedUse:
+            read(World);
+            write(Heap);
+            return;
+        default:
+            DFG_CRASH(graph, node, "Bad use kind");
+        }
+
+    case ArithRound:
+    case ArithFloor:
+    case ArithCeil:
+    case ArithTrunc:
+        if (node->child1().useKind() == DoubleRepUse)
+            def(PureValue(node, static_cast<uintptr_t>(node->arithRoundingMode())));
+        else {
+            read(World);
+            write(Heap);
+        }
+        return;
+
+    case CheckCell:
+        def(PureValue(CheckCell, AdjacencyList(AdjacencyList::Fixed, node->child1()), node->cellOperand()));
+        return;
+
+    case CheckNotEmpty:
+        def(PureValue(CheckNotEmpty, AdjacencyList(AdjacencyList::Fixed, node->child1())));
+        return;
+
+    case CheckStringIdent:
+        def(PureValue(CheckStringIdent, AdjacencyList(AdjacencyList::Fixed, node->child1()), node->uidOperand()));
+        return;
+
+    case ConstantStoragePointer:
+        def(PureValue(node, node->storagePointer()));
+        return;
+         
+    case MovHint:
+    case ZombieHint:
+    case ExitOK:
+    case KillStack:
+    case Upsilon:
+    case Phi:
+    case PhantomLocal:
+    case SetArgument:
+    case Jump:
+    case Branch:
+    case Switch:
+    case Throw:
+    case ForceOSRExit:
+    case CheckBadCell:
+    case Return:
+    case Unreachable:
+    case CheckTierUpInLoop:
+    case CheckTierUpAtReturn:
+    case CheckTierUpAndOSREnter:
+    case LoopHint:
+    case ProfileType:
+    case ProfileControlFlow:
+    case PutHint:
+        write(SideState);
+        return;
+        
+    case StoreBarrier:
+        read(JSCell_cellState);
+        write(JSCell_cellState);
+        return;
+        
+    case FencedStoreBarrier:
+        read(Heap);
+        write(JSCell_cellState);
+        return;
+
+    case InvalidationPoint:
+        write(SideState);
+        def(HeapLocation(InvalidationPointLoc, Watchpoint_fire), LazyNode(node));
+        return;
+
+    case Flush:
+        read(AbstractHeap(Stack, node->local()));
+        write(SideState);
+        return;
+
+    case NotifyWrite:
+        write(Watchpoint_fire);
+        write(SideState);
+        return;
+
+    case CreateActivation: {
+        SymbolTable* table = node->castOperand<SymbolTable*>();
+        if (table->singletonScope()->isStillValid())
+            write(Watchpoint_fire);
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+    }
+        
+    case CreateDirectArguments:
+    case CreateScopedArguments:
+    case CreateClonedArguments:
+        read(Stack);
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+
+    case PhantomDirectArguments:
+    case PhantomClonedArguments:
+        // DFG backend requires that the locals that this reads are flushed. FTL backend can handle those
+        // locals being promoted.
+        if (!isFTL(graph.m_plan.mode))
+            read(Stack);
+        
+        // Even though it's phantom, it still has the property that one can't be replaced with another.
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+
+    case PhantomSpread:
+    case PhantomNewArrayWithSpread:
+    case PhantomCreateRest:
+        // Even though it's phantom, it still has the property that one can't be replaced with another.
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+
+    case CallObjectConstructor:
+    case ToThis:
+    case CreateThis:
+        read(MiscFields);
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+
+    case IsObjectOrNull:
+        read(MiscFields);
+        def(HeapLocation(IsObjectOrNullLoc, MiscFields, node->child1()), LazyNode(node));
+        return;
+        
+    case IsFunction:
+        read(MiscFields);
+        def(HeapLocation(IsFunctionLoc, MiscFields, node->child1()), LazyNode(node));
+        return;
+
+    case ArraySlice:
+        read(MiscFields);
+        read(JSCell_indexingType);
+        read(JSCell_structureID);
+        read(JSObject_butterfly);
+        read(Butterfly_publicLength);
+        read(IndexedDoubleProperties);
+        read(IndexedInt32Properties);
+        read(IndexedContiguousProperties);
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+        
+    case GetById:
+    case GetByIdFlush:
+    case GetByIdWithThis:
+    case GetByValWithThis:
+    case PutById:
+    case PutByIdWithThis:
+    case PutByValWithThis:
+    case PutByIdFlush:
+    case PutByIdDirect:
+    case PutGetterById:
+    case PutSetterById:
+    case PutGetterSetterById:
+    case PutGetterByVal:
+    case PutSetterByVal:
+    case DefineDataProperty:
+    case DefineAccessorProperty:
+    case DeleteById:
+    case DeleteByVal:
+    case ArrayPush:
+    case ArrayPop:
+    case Call:
+    case DirectCall:
+    case TailCallInlinedCaller:
+    case DirectTailCallInlinedCaller:
+    case Construct:
+    case DirectConstruct:
+    case CallVarargs:
+    case CallForwardVarargs:
+    case TailCallVarargsInlinedCaller:
+    case TailCallForwardVarargsInlinedCaller:
+    case ConstructVarargs:
+    case ConstructForwardVarargs:
+    case ToPrimitive:
+    case In:
+    case HasOwnProperty:
+    case ValueAdd:
+    case SetFunctionName:
+    case GetDynamicVar:
+    case PutDynamicVar:
+    case ResolveScope:
+        read(World);
+        write(Heap);
+        return;
+
+    case CallEval:
+        ASSERT(!node->origin.semantic.inlineCallFrame);
+        read(AbstractHeap(Stack, graph.m_codeBlock->scopeRegister()));
+        read(AbstractHeap(Stack, virtualRegisterForArgument(0)));
+        read(World);
+        write(Heap);
+        return;
+
+    case TailCall:
+    case DirectTailCall:
+    case TailCallVarargs:
+    case TailCallForwardVarargs:
+        read(World);
+        write(SideState);
+        return;
+        
+    case GetGetter:
+        read(GetterSetter_getter);
+        def(HeapLocation(GetterLoc, GetterSetter_getter, node->child1()), LazyNode(node));
+        return;
+        
+    case GetSetter:
+        read(GetterSetter_setter);
+        def(HeapLocation(SetterLoc, GetterSetter_setter, node->child1()), LazyNode(node));
+        return;
+        
+    case GetCallee:
+        read(AbstractHeap(Stack, CallFrameSlot::callee));
+        def(HeapLocation(StackLoc, AbstractHeap(Stack, CallFrameSlot::callee)), LazyNode(node));
+        return;
+        
+    case GetArgumentCountIncludingThis:
+        read(AbstractHeap(Stack, CallFrameSlot::argumentCount));
+        def(HeapLocation(StackPayloadLoc, AbstractHeap(Stack, CallFrameSlot::argumentCount)), LazyNode(node));
+        return;
+
+    case GetRestLength:
+        read(Stack);
+        return;
+        
+    case GetLocal:
+        read(AbstractHeap(Stack, node->local()));
+        def(HeapLocation(StackLoc, AbstractHeap(Stack, node->local())), LazyNode(node));
+        return;
+        
+    case SetLocal:
+        write(AbstractHeap(Stack, node->local()));
+        def(HeapLocation(StackLoc, AbstractHeap(Stack, node->local())), LazyNode(node->child1().node()));
+        return;
+        
+    case GetStack: {
+        AbstractHeap heap(Stack, node->stackAccessData()->local);
+        read(heap);
+        def(HeapLocation(StackLoc, heap), LazyNode(node));
+        return;
+    }
+        
+    case PutStack: {
+        AbstractHeap heap(Stack, node->stackAccessData()->local);
+        write(heap);
+        def(HeapLocation(StackLoc, heap), LazyNode(node->child1().node()));
+        return;
+    }
+        
+    case LoadVarargs: {
+        read(World);
+        write(Heap);
+        LoadVarargsData* data = node->loadVarargsData();
+        write(AbstractHeap(Stack, data->count.offset()));
+        for (unsigned i = data->limit; i--;)
+            write(AbstractHeap(Stack, data->start.offset() + static_cast<int>(i)));
+        return;
+    }
+        
+    case ForwardVarargs: {
+        // We could be way more precise here.
+        read(Stack);
+        
+        LoadVarargsData* data = node->loadVarargsData();
+        write(AbstractHeap(Stack, data->count.offset()));
+        for (unsigned i = data->limit; i--;)
+            write(AbstractHeap(Stack, data->start.offset() + static_cast<int>(i)));
+        return;
+    }
+        
+    case GetLocalUnlinked:
+        read(AbstractHeap(Stack, node->unlinkedLocal()));
+        def(HeapLocation(StackLoc, AbstractHeap(Stack, node->unlinkedLocal())), LazyNode(node));
+        return;
+        
+    case GetByVal: {
+        ArrayMode mode = node->arrayMode();
+        switch (mode.type()) {
+        case Array::SelectUsingPredictions:
+        case Array::Unprofiled:
+        case Array::SelectUsingArguments:
+            // Assume the worst since we don't have profiling yet.
+            read(World);
+            write(Heap);
+            return;
+            
+        case Array::ForceExit:
+            write(SideState);
+            return;
+            
+        case Array::Generic:
+            read(World);
+            write(Heap);
+            return;
+            
+        case Array::String:
+            if (mode.isOutOfBounds()) {
+                read(World);
+                write(Heap);
+                return;
+            }
+            // This appears to read nothing because it's only reading immutable data.
+            def(PureValue(node, mode.asWord()));
+            return;
+            
+        case Array::DirectArguments:
+            read(DirectArgumentsProperties);
+            def(HeapLocation(IndexedPropertyLoc, DirectArgumentsProperties, node->child1(), node->child2()), LazyNode(node));
+            return;
+            
+        case Array::ScopedArguments:
+            read(ScopeProperties);
+            def(HeapLocation(IndexedPropertyLoc, ScopeProperties, node->child1(), node->child2()), LazyNode(node));
+            return;
+            
+        case Array::Int32:
+            if (mode.isInBounds()) {
+                read(Butterfly_publicLength);
+                read(IndexedInt32Properties);
+                def(HeapLocation(IndexedPropertyLoc, IndexedInt32Properties, node->child1(), node->child2()), LazyNode(node));
+                return;
+            }
+            read(World);
+            write(Heap);
+            return;
+            
+        case Array::Double:
+            if (mode.isInBounds()) {
+                read(Butterfly_publicLength);
+                read(IndexedDoubleProperties);
+                def(HeapLocation(IndexedPropertyLoc, IndexedDoubleProperties, node->child1(), node->child2()), LazyNode(node));
+                return;
+            }
+            read(World);
+            write(Heap);
+            return;
+            
+        case Array::Contiguous:
+            if (mode.isInBounds()) {
+                read(Butterfly_publicLength);
+                read(IndexedContiguousProperties);
+                def(HeapLocation(IndexedPropertyLoc, IndexedContiguousProperties, node->child1(), node->child2()), LazyNode(node));
+                return;
+            }
+            read(World);
+            write(Heap);
+            return;
+
+        case Array::Undecided:
+            def(PureValue(node));
+            return;
+            
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            if (mode.isInBounds()) {
+                read(Butterfly_vectorLength);
+                read(IndexedArrayStorageProperties);
+                return;
+            }
+            read(World);
+            write(Heap);
+            return;
+            
+        case Array::Int8Array:
+        case Array::Int16Array:
+        case Array::Int32Array:
+        case Array::Uint8Array:
+        case Array::Uint8ClampedArray:
+        case Array::Uint16Array:
+        case Array::Uint32Array:
+        case Array::Float32Array:
+        case Array::Float64Array:
+            read(TypedArrayProperties);
+            read(MiscFields);
+            def(HeapLocation(IndexedPropertyLoc, TypedArrayProperties, node->child1(), node->child2()), LazyNode(node));
+            return;
+        // We should not get an AnyTypedArray in a GetByVal as AnyTypedArray is only created from intrinsics, which
+        // are only added from Inline Caching a GetById.
+        case Array::AnyTypedArray:
+            DFG_CRASH(graph, node, "impossible array mode for get");
+            return;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+        
+    case GetMyArgumentByVal:
+    case GetMyArgumentByValOutOfBounds: {
+        read(Stack);
+        // FIXME: It would be trivial to have a def here.
+        // https://bugs.webkit.org/show_bug.cgi?id=143077
+        return;
+    }
+
+    case PutByValDirect:
+    case PutByVal:
+    case PutByValAlias: {
+        ArrayMode mode = node->arrayMode();
+        Node* base = graph.varArgChild(node, 0).node();
+        Node* index = graph.varArgChild(node, 1).node();
+        Node* value = graph.varArgChild(node, 2).node();
+        switch (mode.modeForPut().type()) {
+        case Array::SelectUsingPredictions:
+        case Array::SelectUsingArguments:
+        case Array::Unprofiled:
+        case Array::Undecided:
+            // Assume the worst since we don't have profiling yet.
+            read(World);
+            write(Heap);
+            return;
+            
+        case Array::ForceExit:
+            write(SideState);
+            return;
+            
+        case Array::Generic:
+            read(World);
+            write(Heap);
+            return;
+            
+        case Array::Int32:
+            if (node->arrayMode().isOutOfBounds()) {
+                read(World);
+                write(Heap);
+                return;
+            }
+            read(Butterfly_publicLength);
+            read(Butterfly_vectorLength);
+            read(IndexedInt32Properties);
+            write(IndexedInt32Properties);
+            if (node->arrayMode().mayStoreToHole())
+                write(Butterfly_publicLength);
+            def(HeapLocation(IndexedPropertyLoc, IndexedInt32Properties, base, index), LazyNode(value));
+            return;
+            
+        case Array::Double:
+            if (node->arrayMode().isOutOfBounds()) {
+                read(World);
+                write(Heap);
+                return;
+            }
+            read(Butterfly_publicLength);
+            read(Butterfly_vectorLength);
+            read(IndexedDoubleProperties);
+            write(IndexedDoubleProperties);
+            if (node->arrayMode().mayStoreToHole())
+                write(Butterfly_publicLength);
+            def(HeapLocation(IndexedPropertyLoc, IndexedDoubleProperties, base, index), LazyNode(value));
+            return;
+            
+        case Array::Contiguous:
+            if (node->arrayMode().isOutOfBounds()) {
+                read(World);
+                write(Heap);
+                return;
+            }
+            read(Butterfly_publicLength);
+            read(Butterfly_vectorLength);
+            read(IndexedContiguousProperties);
+            write(IndexedContiguousProperties);
+            if (node->arrayMode().mayStoreToHole())
+                write(Butterfly_publicLength);
+            def(HeapLocation(IndexedPropertyLoc, IndexedContiguousProperties, base, index), LazyNode(value));
+            return;
+            
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            // Give up on life for now.
+            read(World);
+            write(Heap);
+            return;
+
+        case Array::Int8Array:
+        case Array::Int16Array:
+        case Array::Int32Array:
+        case Array::Uint8Array:
+        case Array::Uint8ClampedArray:
+        case Array::Uint16Array:
+        case Array::Uint32Array:
+        case Array::Float32Array:
+        case Array::Float64Array:
+            read(MiscFields);
+            write(TypedArrayProperties);
+            // FIXME: We can't def() anything here because these operations truncate their inputs.
+            // https://bugs.webkit.org/show_bug.cgi?id=134737
+            return;
+        case Array::AnyTypedArray:
+        case Array::String:
+        case Array::DirectArguments:
+        case Array::ScopedArguments:
+            DFG_CRASH(graph, node, "impossible array mode for put");
+            return;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+        
+    case CheckStructure:
+        read(JSCell_structureID);
+        return;
+
+    case CheckArray:
+        read(JSCell_indexingType);
+        read(JSCell_typeInfoType);
+        read(JSCell_structureID);
+        return;
+
+    case CheckTypeInfoFlags:
+        read(JSCell_typeInfoFlags);
+        def(HeapLocation(CheckTypeInfoFlagsLoc, JSCell_typeInfoFlags, node->child1()), LazyNode(node));
+        return;
+
+    case OverridesHasInstance:
+        read(JSCell_typeInfoFlags);
+        def(HeapLocation(OverridesHasInstanceLoc, JSCell_typeInfoFlags, node->child1()), LazyNode(node));
+        return;
+
+    case InstanceOf:
+        read(JSCell_structureID);
+        def(HeapLocation(InstanceOfLoc, JSCell_structureID, node->child1(), node->child2()), LazyNode(node));
+        return;
+
+    case InstanceOfCustom:
+        read(World);
+        write(Heap);
+        return;
+
+    case PutStructure:
+        read(JSObject_butterfly);
+        write(JSCell_structureID);
+        write(JSCell_typeInfoType);
+        write(JSCell_typeInfoFlags);
+        write(JSCell_indexingType);
+        return;
+        
+    case AllocatePropertyStorage:
+    case ReallocatePropertyStorage:
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+        
+    case NukeStructureAndSetButterfly:
+        write(JSObject_butterfly);
+        write(JSCell_structureID);
+        def(HeapLocation(ButterflyLoc, JSObject_butterfly, node->child1()), LazyNode(node->child2().node()));
+        return;
+        
+    case GetButterfly:
+        read(JSObject_butterfly);
+        def(HeapLocation(ButterflyLoc, JSObject_butterfly, node->child1()), LazyNode(node));
+        return;
+
+    case CheckDOM:
+        def(PureValue(node, node->classInfo()));
+        return;
+
+    case CallDOMGetter: {
+        DOMJIT::CallDOMGetterPatchpoint* patchpoint = node->callDOMGetterData()->patchpoint;
+        DOMJIT::Effect effect = patchpoint->effect;
+        if (effect.reads) {
+            if (effect.reads == DOMJIT::HeapRange::top())
+                read(World);
+            else
+                read(AbstractHeap(DOMState, effect.reads.rawRepresentation()));
+        }
+        if (effect.writes) {
+            if (effect.writes == DOMJIT::HeapRange::top())
+                write(Heap);
+            else
+                write(AbstractHeap(DOMState, effect.writes.rawRepresentation()));
+        }
+        if (effect.def != DOMJIT::HeapRange::top()) {
+            DOMJIT::HeapRange range = effect.def;
+            if (range == DOMJIT::HeapRange::none())
+                def(PureValue(node, node->callDOMGetterData()->domJIT));
+            else {
+                // Def with heap location. We do not include "GlobalObject" for that since this information is included in the base node.
+                // We only see the DOMJIT getter here. So just including "base" is ok.
+                def(HeapLocation(DOMStateLoc, AbstractHeap(DOMState, range.rawRepresentation()), node->child1()), LazyNode(node));
+            }
+        }
+        return;
+    }
+
+    case CallDOM: {
+        const DOMJIT::Signature* signature = node->signature();
+        DOMJIT::Effect effect = signature->effect;
+        if (effect.reads) {
+            if (effect.reads == DOMJIT::HeapRange::top())
+                read(World);
+            else
+                read(AbstractHeap(DOMState, effect.reads.rawRepresentation()));
+        }
+        if (effect.writes) {
+            if (effect.writes == DOMJIT::HeapRange::top())
+                write(Heap);
+            else
+                write(AbstractHeap(DOMState, effect.writes.rawRepresentation()));
+        }
+        ASSERT_WITH_MESSAGE(effect.def == DOMJIT::HeapRange::top(), "Currently, we do not accept any def for CallDOM.");
+        return;
+    }
+
+    case Arrayify:
+    case ArrayifyToStructure:
+        read(JSCell_structureID);
+        read(JSCell_indexingType);
+        read(JSObject_butterfly);
+        write(JSCell_structureID);
+        write(JSCell_indexingType);
+        write(JSObject_butterfly);
+        write(Watchpoint_fire);
+        return;
+        
+    case GetIndexedPropertyStorage:
+        if (node->arrayMode().type() == Array::String) {
+            def(PureValue(node, node->arrayMode().asWord()));
+            return;
+        }
+        read(MiscFields);
+        def(HeapLocation(IndexedPropertyStorageLoc, MiscFields, node->child1()), LazyNode(node));
+        return;
+        
+    case GetTypedArrayByteOffset:
+        read(MiscFields);
+        def(HeapLocation(TypedArrayByteOffsetLoc, MiscFields, node->child1()), LazyNode(node));
+        return;
+        
+    case GetByOffset:
+    case GetGetterSetterByOffset: {
+        unsigned identifierNumber = node->storageAccessData().identifierNumber;
+        AbstractHeap heap(NamedProperties, identifierNumber);
+        read(heap);
+        def(HeapLocation(NamedPropertyLoc, heap, node->child2()), LazyNode(node));
+        return;
+    }
+
+    case TryGetById: {
+        read(Heap);
+        return;
+    }
+
+    case MultiGetByOffset: {
+        read(JSCell_structureID);
+        read(JSObject_butterfly);
+        AbstractHeap heap(NamedProperties, node->multiGetByOffsetData().identifierNumber);
+        read(heap);
+        // FIXME: We cannot def() for MultiGetByOffset because CSE is not smart enough to decay it
+        // to a CheckStructure.
+        // https://bugs.webkit.org/show_bug.cgi?id=159859
+        return;
+    }
+        
+    case MultiPutByOffset: {
+        read(JSCell_structureID);
+        read(JSObject_butterfly);
+        AbstractHeap heap(NamedProperties, node->multiPutByOffsetData().identifierNumber);
+        write(heap);
+        if (node->multiPutByOffsetData().writesStructures())
+            write(JSCell_structureID);
+        if (node->multiPutByOffsetData().reallocatesStorage())
+            write(JSObject_butterfly);
+        def(HeapLocation(NamedPropertyLoc, heap, node->child1()), LazyNode(node->child2().node()));
+        return;
+    }
+        
+    case PutByOffset: {
+        unsigned identifierNumber = node->storageAccessData().identifierNumber;
+        AbstractHeap heap(NamedProperties, identifierNumber);
+        write(heap);
+        def(HeapLocation(NamedPropertyLoc, heap, node->child2()), LazyNode(node->child3().node()));
+        return;
+    }
+        
+    case GetArrayLength: {
+        ArrayMode mode = node->arrayMode();
+        switch (mode.type()) {
+        case Array::Undecided:
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            read(Butterfly_publicLength);
+            def(HeapLocation(ArrayLengthLoc, Butterfly_publicLength, node->child1()), LazyNode(node));
+            return;
+            
+        case Array::String:
+            def(PureValue(node, mode.asWord()));
+            return;
+
+        case Array::DirectArguments:
+        case Array::ScopedArguments:
+            read(MiscFields);
+            def(HeapLocation(ArrayLengthLoc, MiscFields, node->child1()), LazyNode(node));
+            return;
+
+        default:
+            ASSERT(mode.isSomeTypedArrayView());
+            read(MiscFields);
+            def(HeapLocation(ArrayLengthLoc, MiscFields, node->child1()), LazyNode(node));
+            return;
+        }
+    }
+        
+    case GetClosureVar:
+        read(AbstractHeap(ScopeProperties, node->scopeOffset().offset()));
+        def(HeapLocation(ClosureVariableLoc, AbstractHeap(ScopeProperties, node->scopeOffset().offset()), node->child1()), LazyNode(node));
+        return;
+        
+    case PutClosureVar:
+        write(AbstractHeap(ScopeProperties, node->scopeOffset().offset()));
+        def(HeapLocation(ClosureVariableLoc, AbstractHeap(ScopeProperties, node->scopeOffset().offset()), node->child1()), LazyNode(node->child2().node()));
+        return;
+
+    case GetRegExpObjectLastIndex:
+        read(RegExpObject_lastIndex);
+        def(HeapLocation(RegExpObjectLastIndexLoc, RegExpObject_lastIndex, node->child1()), LazyNode(node));
+        return;
+
+    case SetRegExpObjectLastIndex:
+        write(RegExpObject_lastIndex);
+        def(HeapLocation(RegExpObjectLastIndexLoc, RegExpObject_lastIndex, node->child1()), LazyNode(node->child2().node()));
+        return;
+
+    case RecordRegExpCachedResult:
+        write(RegExpState);
+        return;
+        
+    case GetFromArguments: {
+        AbstractHeap heap(DirectArgumentsProperties, node->capturedArgumentsOffset().offset());
+        read(heap);
+        def(HeapLocation(DirectArgumentsLoc, heap, node->child1()), LazyNode(node));
+        return;
+    }
+        
+    case PutToArguments: {
+        AbstractHeap heap(DirectArgumentsProperties, node->capturedArgumentsOffset().offset());
+        write(heap);
+        def(HeapLocation(DirectArgumentsLoc, heap, node->child1()), LazyNode(node->child2().node()));
+        return;
+    }
+
+    case GetArgument: {
+        read(Stack);
+        // FIXME: It would be trivial to have a def here.
+        // https://bugs.webkit.org/show_bug.cgi?id=143077
+        return;
+    }
+        
+    case GetGlobalVar:
+    case GetGlobalLexicalVariable:
+        read(AbstractHeap(Absolute, node->variablePointer()));
+        def(HeapLocation(GlobalVariableLoc, AbstractHeap(Absolute, node->variablePointer())), LazyNode(node));
+        return;
+        
+    case PutGlobalVariable:
+        write(AbstractHeap(Absolute, node->variablePointer()));
+        def(HeapLocation(GlobalVariableLoc, AbstractHeap(Absolute, node->variablePointer())), LazyNode(node->child2().node()));
+        return;
+
+    case NewArrayWithSize:
+    case NewTypedArray:
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+
+    case NewArrayWithSpread: {
+        // This also reads from JSFixedArray's data store, but we don't have any way of describing that yet.
+        read(HeapObjectCount);
+        for (unsigned i = 0; i < node->numChildren(); i++) {
+            Node* child = graph.varArgChild(node, i).node();
+            if (child->op() == PhantomSpread) {
+                read(Stack);
+                break;
+            }
+        }
+        write(HeapObjectCount);
+        return;
+    }
+
+    case Spread: {
+        if (node->child1().useKind() == ArrayUse) {
+            // FIXME: We can probably CSE these together, but we need to construct the right rules
+            // to prove that nobody writes to child1() in between two Spreads: https://bugs.webkit.org/show_bug.cgi?id=164531
+            read(HeapObjectCount); 
+            read(JSCell_indexingType);
+            read(JSObject_butterfly);
+            read(Butterfly_publicLength);
+            read(IndexedDoubleProperties);
+            read(IndexedInt32Properties);
+            read(IndexedContiguousProperties);
+            read(IndexedArrayStorageProperties);
+
+            write(HeapObjectCount);
+            return;
+        }
+
+        read(World);
+        write(Heap);
+        return;
+    }
+
+    case NewArray: {
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+
+        unsigned numElements = node->numChildren();
+
+        def(HeapLocation(ArrayLengthLoc, Butterfly_publicLength, node),
+            LazyNode(graph.freeze(jsNumber(numElements))));
+
+        if (!numElements)
+            return;
+
+        AbstractHeap heap;
+        switch (node->indexingType()) {
+        case ALL_DOUBLE_INDEXING_TYPES:
+            heap = IndexedDoubleProperties;
+            break;
+
+        case ALL_INT32_INDEXING_TYPES:
+            heap = IndexedInt32Properties;
+            break;
+
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            heap = IndexedContiguousProperties;
+            break;
+
+        default:
+            return;
+        }
+
+        if (numElements < graph.m_uint32ValuesInUse.size()) {
+            for (unsigned operandIdx = 0; operandIdx < numElements; ++operandIdx) {
+                Edge use = graph.m_varArgChildren[node->firstChild() + operandIdx];
+                def(HeapLocation(IndexedPropertyLoc, heap, node, LazyNode(graph.freeze(jsNumber(operandIdx)))),
+                    LazyNode(use.node()));
+            }
+        } else {
+            for (uint32_t operandIdx : graph.m_uint32ValuesInUse) {
+                if (operandIdx >= numElements)
+                    continue;
+                Edge use = graph.m_varArgChildren[node->firstChild() + operandIdx];
+                // operandIdx comes from graph.m_uint32ValuesInUse and thus is guaranteed to be already frozen
+                def(HeapLocation(IndexedPropertyLoc, heap, node, LazyNode(graph.freeze(jsNumber(operandIdx)))),
+                    LazyNode(use.node()));
+            }
+        }
+        return;
+    }
+
+    case NewArrayBuffer: {
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+
+        unsigned numElements = node->numConstants();
+        def(HeapLocation(ArrayLengthLoc, Butterfly_publicLength, node),
+            LazyNode(graph.freeze(jsNumber(numElements))));
+
+        AbstractHeap heap;
+        NodeType op = JSConstant;
+        switch (node->indexingType()) {
+        case ALL_DOUBLE_INDEXING_TYPES:
+            heap = IndexedDoubleProperties;
+            op = DoubleConstant;
+            break;
+
+        case ALL_INT32_INDEXING_TYPES:
+            heap = IndexedInt32Properties;
+            break;
+
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            heap = IndexedContiguousProperties;
+            break;
+
+        default:
+            return;
+        }
+
+        JSValue* data = graph.m_codeBlock->constantBuffer(node->startConstant());
+        if (numElements < graph.m_uint32ValuesInUse.size()) {
+            for (unsigned index = 0; index < numElements; ++index) {
+                def(HeapLocation(IndexedPropertyLoc, heap, node, LazyNode(graph.freeze(jsNumber(index)))),
+                    LazyNode(graph.freeze(data[index]), op));
+            }
+        } else {
+            Vector<uint32_t> possibleIndices;
+            for (uint32_t index : graph.m_uint32ValuesInUse) {
+                if (index >= numElements)
+                    continue;
+                possibleIndices.append(index);
+            }
+            for (uint32_t index : possibleIndices) {
+                def(HeapLocation(IndexedPropertyLoc, heap, node, LazyNode(graph.freeze(jsNumber(index)))),
+                    LazyNode(graph.freeze(data[index]), op));
+            }
+        }
+        return;
+    }
+
+    case CreateRest: {
+        if (!graph.isWatchingHavingABadTimeWatchpoint(node)) {
+            // This means we're already having a bad time.
+            read(World);
+            write(Heap);
+            return;
+        }
+        read(Stack);
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+    }
+
+    case NewObject:
+    case NewRegexp:
+    case NewStringObject:
+    case PhantomNewObject:
+    case MaterializeNewObject:
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomCreateActivation:
+    case MaterializeCreateActivation:
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+
+    case NewFunction:
+    case NewGeneratorFunction:
+    case NewAsyncFunction:
+        if (node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid())
+            write(Watchpoint_fire);
+        read(HeapObjectCount);
+        write(HeapObjectCount);
+        return;
+
+    case RegExpExec:
+    case RegExpTest:
+        if (node->child2().useKind() == RegExpObjectUse
+            && node->child3().useKind() == StringUse) {
+            read(RegExpState);
+            read(RegExpObject_lastIndex);
+            write(RegExpState);
+            write(RegExpObject_lastIndex);
+            return;
+        }
+        read(World);
+        write(Heap);
+        return;
+
+    case StringReplace:
+    case StringReplaceRegExp:
+        if (node->child1().useKind() == StringUse
+            && node->child2().useKind() == RegExpObjectUse
+            && node->child3().useKind() == StringUse) {
+            read(RegExpState);
+            read(RegExpObject_lastIndex);
+            write(RegExpState);
+            write(RegExpObject_lastIndex);
+            return;
+        }
+        read(World);
+        write(Heap);
+        return;
+
+    case StringCharAt:
+        if (node->arrayMode().isOutOfBounds()) {
+            read(World);
+            write(Heap);
+            return;
+        }
+        def(PureValue(node));
+        return;
+        
+    case CompareEq:
+    case CompareLess:
+    case CompareLessEq:
+    case CompareGreater:
+    case CompareGreaterEq:
+        if (node->isBinaryUseKind(StringUse)) {
+            read(HeapObjectCount);
+            write(HeapObjectCount);
+            return;
+        }
+        if (!node->isBinaryUseKind(UntypedUse)) {
+            def(PureValue(node));
+            return;
+        }
+        read(World);
+        write(Heap);
+        return;
+
+    case ToNumber: {
+        read(World);
+        write(Heap);
+        return;
+    }
+        
+    case ToString:
+    case CallStringConstructor:
+        switch (node->child1().useKind()) {
+        case StringObjectUse:
+        case StringOrStringObjectUse:
+            // These don't def a pure value, unfortunately. I'll avoid load-eliminating these for
+            // now.
+            return;
+            
+        case CellUse:
+        case UntypedUse:
+            read(World);
+            write(Heap);
+            return;
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+        
+    case ThrowStaticError:
+        write(SideState);
+        return;
+        
+    case CountExecution:
+    case CheckWatchdogTimer:
+        read(InternalState);
+        write(InternalState);
+        return;
+        
+    case LogShadowChickenPrologue:
+    case LogShadowChickenTail:
+        write(SideState);
+        return;
+
+    case MapHash:
+        def(PureValue(node));
+        return;
+    case GetMapBucket: {
+        read(MiscFields);
+        Edge& mapEdge = node->child1();
+        Edge& keyEdge = node->child2();
+        def(HeapLocation(MapBucketLoc, MiscFields, mapEdge, keyEdge), LazyNode(node));
+        return;
+    }
+    case LoadFromJSMapBucket: {
+        read(MiscFields);
+        Edge& bucketEdge = node->child1();
+        def(HeapLocation(JSMapGetLoc, MiscFields, bucketEdge), LazyNode(node));
+        return;
+    }
+    case IsNonEmptyMapBucket:
+        read(MiscFields);
+        def(HeapLocation(MapHasLoc, MiscFields, node->child1()), LazyNode(node));
+        return;
+
+    case ToLowerCase:
+        def(PureValue(node));
+        return;
+        
+    case LastNodeType:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+    
+    DFG_CRASH(graph, node, toCString("Unrecognized node type: ", Graph::opName(node->op())).data());
+}
+
+class NoOpClobberize {
+public:
+    NoOpClobberize() { }
+    template<typename... T>
+    void operator()(T...) const { }
+};
+
+class CheckClobberize {
+public:
+    CheckClobberize()
+        : m_result(false)
+    {
+    }
+    
+    template<typename... T>
+    void operator()(T...) const { m_result = true; }
+    
+    bool result() const { return m_result; }
+    
+private:
+    mutable bool m_result;
+};
+
+bool doesWrites(Graph&, Node*);
+
+class AbstractHeapOverlaps {
+public:
+    AbstractHeapOverlaps(AbstractHeap heap)
+        : m_heap(heap)
+        , m_result(false)
+    {
+    }
+    
+    void operator()(AbstractHeap otherHeap) const
+    {
+        if (m_result)
+            return;
+        m_result = m_heap.overlaps(otherHeap);
+    }
+    
+    bool result() const { return m_result; }
+
+private:
+    AbstractHeap m_heap;
+    mutable bool m_result;
+};
+
+bool accessesOverlap(Graph&, Node*, AbstractHeap);
+bool writesOverlap(Graph&, Node*, AbstractHeap);
+
+bool clobbersHeap(Graph&, Node*);
+
+// We would have used bind() for these, but because of the overlaoding that we are doing,
+// it's quite a bit of clearer to just write this out the traditional way.
+
+template<typename T>
+class ReadMethodClobberize {
+public:
+    ReadMethodClobberize(T& value)
+        : m_value(value)
+    {
+    }
+    
+    void operator()(AbstractHeap heap) const
+    {
+        m_value.read(heap);
+    }
+private:
+    T& m_value;
+};
+
+template<typename T>
+class WriteMethodClobberize {
+public:
+    WriteMethodClobberize(T& value)
+        : m_value(value)
+    {
+    }
+    
+    void operator()(AbstractHeap heap) const
+    {
+        m_value.write(heap);
+    }
+private:
+    T& m_value;
+};
+
+template<typename T>
+class DefMethodClobberize {
+public:
+    DefMethodClobberize(T& value)
+        : m_value(value)
+    {
+    }
+    
+    void operator()(PureValue value) const
+    {
+        m_value.def(value);
+    }
+    
+    void operator()(HeapLocation location, LazyNode node) const
+    {
+        m_value.def(location, node);
+    }
+
+private:
+    T& m_value;
+};
+
+template<typename Adaptor>
+void clobberize(Graph& graph, Node* node, Adaptor& adaptor)
+{
+    ReadMethodClobberize<Adaptor> read(adaptor);
+    WriteMethodClobberize<Adaptor> write(adaptor);
+    DefMethodClobberize<Adaptor> def(adaptor);
+    clobberize(graph, node, read, write, def);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGClobbersExitState.cpp b/dfg/DFGClobbersExitState.cpp
new file mode 100644
index 0000000..d1a1395
--- /dev/null
+++ b/dfg/DFGClobbersExitState.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGClobbersExitState.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGClobberize.h"
+#include "DFGGraph.h"
+#include "DFGNode.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+bool clobbersExitState(Graph& graph, Node* node)
+{
+    // There are certain nodes whose effect on the exit state has nothing to do with what they
+    // normally clobber.
+    switch (node->op()) {
+    case MovHint:
+    case ZombieHint:
+    case PutHint:
+    case KillStack:
+        return true;
+
+    case SetLocal:
+    case PutStack:
+        // These nodes write to the stack, but they may only do so after we have already had a MovHint
+        // for the exact same value and the same stack location. Hence, they have no further effect on
+        // exit state.
+        return false;
+
+    case ArrayifyToStructure:
+    case Arrayify:
+    case NewObject:
+    case NewRegexp:
+    case NewStringObject:
+    case PhantomNewObject:
+    case MaterializeNewObject:
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomCreateActivation:
+    case MaterializeCreateActivation:
+    case CountExecution:
+    case StoreBarrier:
+    case FencedStoreBarrier:
+    case AllocatePropertyStorage:
+    case ReallocatePropertyStorage:
+        // These do clobber memory, but nothing that is observable. It may be nice to separate the
+        // heaps into those that are observable and those that aren't, but we don't do that right now.
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=148440
+        return false;
+
+    case CreateActivation:
+        // Like above, but with the activation allocation caveat.
+        return node->castOperand<SymbolTable*>()->singletonScope()->isStillValid();
+
+    case NewFunction:
+    case NewGeneratorFunction:
+    case NewAsyncFunction:
+        // Like above, but with the JSFunction allocation caveat.
+        return node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid();
+
+    default:
+        // For all other nodes, we just care about whether they write to something other than SideState.
+        bool result = false;
+        clobberize(
+            graph, node, NoOpClobberize(),
+            [&] (const AbstractHeap& heap) {
+                // There shouldn't be such a thing as a strict subtype of SideState. That's what allows
+                // us to use a fast != check, below.
+                ASSERT(!heap.isStrictSubtypeOf(SideState));
+
+                if (heap != SideState)
+                    result = true;
+            },
+            NoOpClobberize());
+        return result;
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGClobbersExitState.h b/dfg/DFGClobbersExitState.h
new file mode 100644
index 0000000..8e6c975
--- /dev/null
+++ b/dfg/DFGClobbersExitState.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+struct Node;
+
+// A conservative approximation of whether the node will perform the kind of effect that would prevent
+// subsequent nodes from exiting to this node's exit origin. Exiting after an effect to that effect's
+// exit origin would cause the effect to execute a second time. Two kinds of such effects can exist:
+//
+// Observable heap or stack effect: If we perform such an effect and then exit to the same origin, that
+// effect will be executed a second time, which is incorrect.
+//
+// OSR exit state update: This doesn't do any observable side-effect, but it tells OSR exit that it
+// should recover some value as if an effect had happened. For example, a MovHint will tell OSR exit
+// that some bytecode variable now has a new value. If we exit to the exit origin of a MovHint after we
+// "execute" the MovHint, then the bytecode state will look as if we had already executed that bytecode
+// instruction. This could cause issues for example for bytecode like:
+//
+//     op_add r1, r1, r2
+//
+// which will get lowered to something like:
+//
+//     a: ArithAdd(...)
+//     b: MovHint(@a, r1)
+//
+// If we exit to the op_add after executing the MovHint, then r1 will already contain the result of the
+// add. Then after exit we'll do the add again, and r1 will have the wrong value. Because of object
+// allocation elimination and PutStack sinking, we can also have other OSR exit updates, like
+// KillStack, PutHint, among others. They don't do anything so long as we stay in optimized code, but
+// they tell OSR exit how to reconstitute state.
+
+bool clobbersExitState(Graph&, Node*);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCombinedLiveness.cpp b/dfg/DFGCombinedLiveness.cpp
new file mode 100644
index 0000000..a3675f5
--- /dev/null
+++ b/dfg/DFGCombinedLiveness.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCombinedLiveness.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAvailabilityMap.h"
+#include "DFGBlockMapInlines.h"
+#include "FullBytecodeLiveness.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+HashSet<Node*> liveNodesAtHead(Graph& graph, BasicBlock* block)
+{
+    HashSet<Node*> seen;
+    for (NodeFlowProjection node : block->ssa->liveAtHead) {
+        if (node.kind() == NodeFlowProjection::Primary)
+            seen.add(node.node());
+    }
+    
+    AvailabilityMap& availabilityMap = block->ssa->availabilityAtHead;
+    graph.forAllLocalsLiveInBytecode(
+        block->at(0)->origin.forExit,
+        [&] (VirtualRegister reg) {
+            availabilityMap.closeStartingWithLocal(
+                reg,
+                [&] (Node* node) -> bool {
+                    return seen.contains(node);
+                },
+                [&] (Node* node) -> bool {
+                    return seen.add(node).isNewEntry;
+                });
+        });
+    
+    return seen;
+}
+
+CombinedLiveness::CombinedLiveness(Graph& graph)
+    : liveAtHead(graph)
+    , liveAtTail(graph)
+{
+    // First compute the liveAtHead for each block.
+    for (BasicBlock* block : graph.blocksInNaturalOrder())
+        liveAtHead[block] = liveNodesAtHead(graph, block);
+    
+    // Now compute the liveAtTail by unifying the liveAtHead of the successors.
+    for (BasicBlock* block : graph.blocksInNaturalOrder()) {
+        for (BasicBlock* successor : block->successors()) {
+            for (Node* node : liveAtHead[successor])
+                liveAtTail[block].add(node);
+        }
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGCombinedLiveness.h b/dfg/DFGCombinedLiveness.h
new file mode 100644
index 0000000..e50065a
--- /dev/null
+++ b/dfg/DFGCombinedLiveness.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockMap.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+// Returns the set of nodes live at tail, both due to due DFG and due to bytecode (i.e. OSR exit).
+HashSet<Node*> liveNodesAtHead(Graph&, BasicBlock*);
+
+// WARNING: This currently does not reason about the liveness of shadow values. The execution
+// semantics of DFG SSA are that an Upsilon stores to the shadow value of a Phi, and the Phi loads
+// from that shadow value. Hence, the shadow values are like variables, and have liveness. The normal
+// liveness analysis will tell you about the liveness of shadow values. It's OK to ignore shadow
+// values if you treat Upsilon as an opaque escape, and all of the clients of CombinedLiveness do so.
+struct CombinedLiveness {
+    CombinedLiveness() { }
+    
+    CombinedLiveness(Graph&);
+    
+    BlockMap<HashSet<Node*>> liveAtHead;
+    BlockMap<HashSet<Node*>> liveAtTail;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCommon.cpp b/dfg/DFGCommon.cpp
new file mode 100644
index 0000000..cd2a12c
--- /dev/null
+++ b/dfg/DFGCommon.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCommon.h"
+
+#include "DFGNode.h"
+#include "JSCInlines.h"
+#include <wtf/PrintStream.h>
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+static StaticLock crashLock;
+
+void startCrashing()
+{
+    crashLock.lock();
+}
+
+bool isCrashing()
+{
+    return crashLock.isLocked();
+}
+
+bool stringLessThan(StringImpl& a, StringImpl& b)
+{
+    unsigned minLength = std::min(a.length(), b.length());
+    for (unsigned i = 0; i < minLength; ++i) {
+        if (a[i] == b[i])
+            continue;
+        return a[i] < b[i];
+    }
+    return a.length() < b.length();
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, OptimizationFixpointState state)
+{
+    switch (state) {
+    case BeforeFixpoint:
+        out.print("BeforeFixpoint");
+        return;
+    case FixpointNotConverged:
+        out.print("FixpointNotConverged");
+        return;
+    case FixpointConverged:
+        out.print("FixpointConverged");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, GraphForm form)
+{
+    switch (form) {
+    case LoadStore:
+        out.print("LoadStore");
+        return;
+    case ThreadedCPS:
+        out.print("ThreadedCPS");
+        return;
+    case SSA:
+        out.print("SSA");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, UnificationState state)
+{
+    switch (state) {
+    case LocallyUnified:
+        out.print("LocallyUnified");
+        return;
+    case GloballyUnified:
+        out.print("GloballyUnified");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, RefCountState state)
+{
+    switch (state) {
+    case EverythingIsLive:
+        out.print("EverythingIsLive");
+        return;
+    case ExactRefCount:
+        out.print("ExactRefCount");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, ProofStatus status)
+{
+    switch (status) {
+    case IsProved:
+        out.print("IsProved");
+        return;
+    case NeedsCheck:
+        out.print("NeedsCheck");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, CapabilityLevel capabilityLevel)
+{
+    switch (capabilityLevel) {
+    case CannotCompile:
+        out.print("CannotCompile");
+        return;
+    case CanCompile:
+        out.print("CanCompile");
+        return;
+    case CanCompileAndInline:
+        out.print("CanCompileAndInline");
+        return;
+    case CapabilityLevelNotSet:
+        out.print("CapabilityLevelNotSet");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/dfg/DFGCommon.h b/dfg/DFGCommon.h
new file mode 100644
index 0000000..4104eb3
--- /dev/null
+++ b/dfg/DFGCommon.h
@@ -0,0 +1,375 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGCompilationMode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "Options.h"
+#include "VirtualRegister.h"
+
+namespace JSC { namespace DFG {
+
+struct Node;
+
+typedef uint32_t BlockIndex;
+static const BlockIndex NoBlock = UINT_MAX;
+
+// Use RefChildren if the child ref counts haven't already been adjusted using
+// other means and either of the following is true:
+// - The node you're creating is MustGenerate.
+// - The place where you're inserting a reference to the node you're creating
+//   will not also do RefChildren.
+enum RefChildrenMode {
+    RefChildren,
+    DontRefChildren
+};
+
+// Use RefNode if you know that the node will be used from another node, and you
+// will not already be ref'ing the node to account for that use.
+enum RefNodeMode {
+    RefNode,
+    DontRefNode
+};
+
+enum SwitchKind {
+    SwitchImm,
+    SwitchChar,
+    SwitchString,
+    SwitchCell
+};
+
+inline bool verboseCompilationEnabled(CompilationMode mode = DFGMode)
+{
+    return Options::verboseCompilation() || Options::dumpGraphAtEachPhase() || (isFTL(mode) && Options::verboseFTLCompilation());
+}
+
+inline bool logCompilationChanges(CompilationMode mode = DFGMode)
+{
+    return verboseCompilationEnabled(mode) || Options::logCompilationChanges();
+}
+
+inline bool shouldDumpGraphAtEachPhase(CompilationMode mode)
+{
+    if (isFTL(mode))
+        return Options::dumpGraphAtEachPhase() || Options::dumpDFGFTLGraphAtEachPhase();
+    return Options::dumpGraphAtEachPhase() || Options::dumpDFGGraphAtEachPhase();
+}
+
+inline bool validationEnabled()
+{
+#if !ASSERT_DISABLED
+    return true;
+#else
+    return Options::validateGraph() || Options::validateGraphAtEachPhase();
+#endif
+}
+
+inline bool enableInt52()
+{
+#if USE(JSVALUE64)
+    return true;
+#else
+    return false;
+#endif
+}
+
+// The prediction propagator effectively does four passes, with the last pass
+// being done by the separate FixuPhase.
+enum PredictionPass {
+    // We're converging in a straight-forward forward flow fixpoint. This is the
+    // most conventional part of the propagator - it makes only monotonic decisions
+    // based on value profiles and rare case profiles. It ignores baseline JIT rare
+    // case profiles. The goal here is to develop a good guess of which variables
+    // are likely to be purely numerical, which generally doesn't require knowing
+    // the rare case profiles.
+    PrimaryPass,
+    
+    // At this point we know what is numerical and what isn't. Non-numerical inputs
+    // to arithmetic operations will not have useful information in the Baseline JIT
+    // rare case profiles because Baseline may take slow path on non-numerical
+    // inputs even if the DFG could handle the input on the fast path. Boolean
+    // inputs are the most obvious example. This pass of prediction propagation will
+    // use Baseline rare case profiles for purely numerical operations and it will
+    // ignore them for everything else. The point of this pass is to develop a good
+    // guess of which variables are likely to be doubles.
+    //
+    // This pass is intentionally weird and goes against what is considered good
+    // form when writing a static analysis: a new data flow of booleans will cause
+    // us to ignore rare case profiles except that by then, we will have already
+    // propagated double types based on our prior assumption that we shouldn't
+    // ignore rare cases. This probably won't happen because the PrimaryPass is
+    // almost certainly going to establish what is and isn't numerical. But it's
+    // conceivable that during this pass we will discover a new boolean data flow.
+    // This ends up being sound because the prediction propagator could literally
+    // make any guesses it wants and still be sound (worst case, we OSR exit more
+    // often or use too general of types are run a bit slower). This will converge
+    // because we force monotonicity on the types of nodes and variables. So, the
+    // worst thing that can happen is that we violate basic laws of theoretical
+    // decency.
+    RareCasePass,
+    
+    // At this point we know what is numerical and what isn't, and we also know what
+    // is a double and what isn't. So, we start forcing variables to be double.
+    // Doing so may have a cascading effect so this is a fixpoint. It's monotonic
+    // in the sense that once a variable is forced double, it cannot be forced in
+    // the other direction.
+    DoubleVotingPass,
+    
+    // This pass occurs once we have converged. At this point we are just installing
+    // type checks based on the conclusions we have already reached. It's important
+    // for this pass to reach the same conclusions that DoubleVotingPass reached.
+    FixupPass
+};
+
+enum StructureRegistrationState { HaveNotStartedRegistering, AllStructuresAreRegistered };
+
+enum StructureRegistrationResult { StructureRegisteredNormally, StructureRegisteredAndWatched };
+
+enum OptimizationFixpointState { BeforeFixpoint, FixpointNotConverged, FixpointConverged };
+
+// Describes the form you can expect the entire graph to be in.
+enum GraphForm {
+    // LoadStore form means that basic blocks may freely use GetLocal, SetLocal,
+    // GetLocalUnlinked, and Flush for accessing local variables and indicating
+    // where their live ranges ought to be. Data flow between local accesses is
+    // implicit. Liveness is only explicit at block heads (variablesAtHead).
+    // This is only used by the DFG simplifier and is only preserved by same.
+    //
+    // For example, LoadStore form gives no easy way to determine which SetLocal's
+    // flow into a GetLocal. As well, LoadStore form implies no restrictions on
+    // redundancy: you can freely emit multiple GetLocals, or multiple SetLocals
+    // (or any combination thereof) to the same local in the same block. LoadStore
+    // form does not require basic blocks to declare how they affect or use locals,
+    // other than implicitly by using the local ops and by preserving
+    // variablesAtHead. Finally, LoadStore allows flexibility in how liveness of
+    // locals is extended; for example you can replace a GetLocal with a Phantom
+    // and so long as the Phantom retains the GetLocal's children (i.e. the Phi
+    // most likely) then it implies that the local is still live but that it need
+    // not be stored to the stack necessarily. This implies that Phantom can
+    // reference nodes that have no result, as long as those nodes are valid
+    // GetLocal children (i.e. Phi, SetLocal, SetArgument).
+    //
+    // LoadStore form also implies that Phis need not have children. By default,
+    // they end up having no children if you enter LoadStore using the canonical
+    // way (call Graph::dethread).
+    //
+    // LoadStore form is suitable for CFG transformations, as well as strength
+    // reduction, folding, and CSE.
+    LoadStore,
+    
+    // ThreadedCPS form means that basic blocks list up-front which locals they
+    // expect to be live at the head, and which locals they make available at the
+    // tail. ThreadedCPS form also implies that:
+    //
+    // - GetLocals and SetLocals are not redundant within a basic block.
+    //
+    // - All GetLocals and Flushes are linked directly to the last access point
+    //   of the variable, which must not be another GetLocal.
+    //
+    // - Phantom(Phi) is not legal, but PhantomLocal is.
+    //
+    // ThreadedCPS form is suitable for data flow analysis (CFA, prediction
+    // propagation), register allocation, and code generation.
+    ThreadedCPS,
+    
+    // SSA form. See DFGSSAConversionPhase.h for a description.
+    SSA
+};
+
+// Describes the state of the UnionFind structure of VariableAccessData's.
+enum UnificationState {
+    // BasicBlock-local accesses to variables are appropriately unified with each other.
+    LocallyUnified,
+    
+    // Unification has been performed globally.
+    GloballyUnified
+};
+
+// Describes how reference counts in the graph behave.
+enum RefCountState {
+    // Everything has refCount() == 1.
+    EverythingIsLive,
+
+    // Set after DCE has run.
+    ExactRefCount
+};
+
+enum OperandSpeculationMode { AutomaticOperandSpeculation, ManualOperandSpeculation };
+
+enum ProofStatus { NeedsCheck, IsProved };
+
+inline bool isProved(ProofStatus proofStatus)
+{
+    ASSERT(proofStatus == IsProved || proofStatus == NeedsCheck);
+    return proofStatus == IsProved;
+}
+
+inline ProofStatus proofStatusForIsProved(bool isProved)
+{
+    return isProved ? IsProved : NeedsCheck;
+}
+
+enum KillStatus { DoesNotKill, DoesKill };
+
+inline bool doesKill(KillStatus killStatus)
+{
+    ASSERT(killStatus == DoesNotKill || killStatus == DoesKill);
+    return killStatus == DoesKill;
+}
+
+inline KillStatus killStatusForDoesKill(bool doesKill)
+{
+    return doesKill ? DoesKill : DoesNotKill;
+}
+
+enum class PlanStage {
+    Initial,
+    AfterFixup
+};
+
+// If possible, this will acquire a lock to make sure that if multiple threads
+// start crashing at the same time, you get coherent dump output. Use this only
+// when you're forcing a crash with diagnostics.
+void startCrashing();
+
+JS_EXPORT_PRIVATE bool isCrashing();
+
+struct NodeAndIndex {
+    NodeAndIndex()
+        : node(nullptr)
+        , index(UINT_MAX)
+    {
+    }
+    
+    NodeAndIndex(Node* node, unsigned index)
+        : node(node)
+        , index(index)
+    {
+        ASSERT(!node == (index == UINT_MAX));
+    }
+    
+    bool operator!() const
+    {
+        return !node;
+    }
+    
+    Node* node;
+    unsigned index;
+};
+
+// A less-than operator for strings that is useful for generating string switches. Sorts by <
+// relation on characters. Ensures that if a is a prefix of b, then a < b.
+bool stringLessThan(StringImpl& a, StringImpl& b);
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::OptimizationFixpointState);
+void printInternal(PrintStream&, JSC::DFG::GraphForm);
+void printInternal(PrintStream&, JSC::DFG::UnificationState);
+void printInternal(PrintStream&, JSC::DFG::RefCountState);
+void printInternal(PrintStream&, JSC::DFG::ProofStatus);
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+// Put things here that must be defined even if ENABLE(DFG_JIT) is false.
+
+enum CapabilityLevel {
+    CannotCompile,
+    CanCompile,
+    CanCompileAndInline,
+    CapabilityLevelNotSet
+};
+
+inline bool canCompile(CapabilityLevel level)
+{
+    switch (level) {
+    case CanCompile:
+    case CanCompileAndInline:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool canInline(CapabilityLevel level)
+{
+    switch (level) {
+    case CanCompileAndInline:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline CapabilityLevel leastUpperBound(CapabilityLevel a, CapabilityLevel b)
+{
+    switch (a) {
+    case CannotCompile:
+        return CannotCompile;
+    case CanCompile:
+        switch (b) {
+        case CanCompile:
+        case CanCompileAndInline:
+            return CanCompile;
+        default:
+            return CannotCompile;
+        }
+    case CanCompileAndInline:
+        return b;
+    case CapabilityLevelNotSet:
+        ASSERT_NOT_REACHED();
+        return CannotCompile;
+    }
+    ASSERT_NOT_REACHED();
+    return CannotCompile;
+}
+
+// Unconditionally disable DFG disassembly support if the DFG is not compiled in.
+inline bool shouldDumpDisassembly(CompilationMode mode = DFGMode)
+{
+#if ENABLE(DFG_JIT)
+    return Options::dumpDisassembly() || Options::dumpDFGDisassembly() || (isFTL(mode) && Options::dumpFTLDisassembly());
+#else
+    UNUSED_PARAM(mode);
+    return false;
+#endif
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::CapabilityLevel);
+
+} // namespace WTF
diff --git a/dfg/DFGCommonData.cpp b/dfg/DFGCommonData.cpp
new file mode 100644
index 0000000..42dd381
--- /dev/null
+++ b/dfg/DFGCommonData.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCommonData.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGNode.h"
+#include "DFGPlan.h"
+#include "InlineCallFrame.h"
+#include "JSCInlines.h"
+#include "TrackedReferences.h"
+#include "VM.h"
+
+namespace JSC { namespace DFG {
+
+void CommonData::notifyCompilingStructureTransition(Plan& plan, CodeBlock* codeBlock, Node* node)
+{
+    plan.transitions.addLazily(
+        codeBlock,
+        node->origin.semantic.codeOriginOwner(),
+        node->transition()->previous.get(),
+        node->transition()->next.get());
+}
+
+CallSiteIndex CommonData::addCodeOrigin(CodeOrigin codeOrigin)
+{
+    if (codeOrigins.isEmpty()
+        || codeOrigins.last() != codeOrigin)
+        codeOrigins.append(codeOrigin);
+    unsigned index = codeOrigins.size() - 1;
+    ASSERT(codeOrigins[index] == codeOrigin);
+    return CallSiteIndex(index);
+}
+
+CallSiteIndex CommonData::addUniqueCallSiteIndex(CodeOrigin codeOrigin)
+{
+    if (callSiteIndexFreeList.size())
+        return CallSiteIndex(callSiteIndexFreeList.takeAny());
+
+    codeOrigins.append(codeOrigin);
+    unsigned index = codeOrigins.size() - 1;
+    ASSERT(codeOrigins[index] == codeOrigin);
+    return CallSiteIndex(index);
+}
+
+CallSiteIndex CommonData::lastCallSite() const
+{
+    RELEASE_ASSERT(codeOrigins.size());
+    return CallSiteIndex(codeOrigins.size() - 1);
+}
+
+void CommonData::removeCallSiteIndex(CallSiteIndex callSite)
+{
+    RELEASE_ASSERT(callSite.bits() < codeOrigins.size());
+    callSiteIndexFreeList.add(callSite.bits());
+}
+
+void CommonData::shrinkToFit()
+{
+    codeOrigins.shrinkToFit();
+    weakReferences.shrinkToFit();
+    transitions.shrinkToFit();
+}
+
+bool CommonData::invalidate()
+{
+    if (!isStillValid)
+        return false;
+    for (unsigned i = jumpReplacements.size(); i--;)
+        jumpReplacements[i].fire();
+    isStillValid = false;
+    return true;
+}
+
+void CommonData::validateReferences(const TrackedReferences& trackedReferences)
+{
+    if (InlineCallFrameSet* set = inlineCallFrames.get()) {
+        for (InlineCallFrame* inlineCallFrame : *set) {
+            for (ValueRecovery& recovery : inlineCallFrame->arguments) {
+                if (recovery.isConstant())
+                    trackedReferences.check(recovery.constant());
+            }
+            
+            if (CodeBlock* baselineCodeBlock = inlineCallFrame->baselineCodeBlock.get())
+                trackedReferences.check(baselineCodeBlock);
+            
+            if (inlineCallFrame->calleeRecovery.isConstant())
+                trackedReferences.check(inlineCallFrame->calleeRecovery.constant());
+        }
+    }
+    
+    for (AdaptiveStructureWatchpoint* watchpoint : adaptiveStructureWatchpoints)
+        watchpoint->key().validateReferences(trackedReferences);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGCommonData.h b/dfg/DFGCommonData.h
new file mode 100644
index 0000000..e58a2eb
--- /dev/null
+++ b/dfg/DFGCommonData.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlockJettisoningWatchpoint.h"
+#include "DFGAdaptiveInferredPropertyValueWatchpoint.h"
+#include "DFGAdaptiveStructureWatchpoint.h"
+#include "DFGJumpReplacement.h"
+#include "InlineCallFrameSet.h"
+#include "JSCell.h"
+#include "ProfilerCompilation.h"
+#include "SymbolTable.h"
+#include <wtf/Bag.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class CodeBlock;
+class Identifier;
+class TrackedReferences;
+
+namespace DFG {
+
+struct Node;
+struct Plan;
+
+// CommonData holds the set of data that both DFG and FTL code blocks need to know
+// about themselves.
+
+struct WeakReferenceTransition {
+    WeakReferenceTransition() { }
+    
+    WeakReferenceTransition(VM& vm, JSCell* owner, JSCell* codeOrigin, JSCell* from, JSCell* to)
+        : m_from(vm, owner, from)
+        , m_to(vm, owner, to)
+    {
+        if (!!codeOrigin)
+            m_codeOrigin.set(vm, owner, codeOrigin);
+    }
+    
+    WriteBarrier<JSCell> m_codeOrigin;
+    WriteBarrier<JSCell> m_from;
+    WriteBarrier<JSCell> m_to;
+};
+        
+class CommonData {
+    WTF_MAKE_NONCOPYABLE(CommonData);
+public:
+    CommonData()
+        : isStillValid(true)
+        , frameRegisterCount(std::numeric_limits<unsigned>::max())
+        , requiredRegisterCountForExit(std::numeric_limits<unsigned>::max())
+    { }
+    
+    void notifyCompilingStructureTransition(Plan&, CodeBlock*, Node*);
+    CallSiteIndex addCodeOrigin(CodeOrigin);
+    CallSiteIndex addUniqueCallSiteIndex(CodeOrigin);
+    CallSiteIndex lastCallSite() const;
+    void removeCallSiteIndex(CallSiteIndex);
+    
+    void shrinkToFit();
+    
+    bool invalidate(); // Returns true if we did invalidate, or false if the code block was already invalidated.
+    
+    unsigned requiredRegisterCountForExecutionAndExit() const
+    {
+        return std::max(frameRegisterCount, requiredRegisterCountForExit);
+    }
+    
+    void validateReferences(const TrackedReferences&);
+
+    static ptrdiff_t frameRegisterCountOffset() { return OBJECT_OFFSETOF(CommonData, frameRegisterCount); }
+
+    RefPtr<InlineCallFrameSet> inlineCallFrames;
+    Vector<CodeOrigin, 0, UnsafeVectorOverflow> codeOrigins;
+    
+    Vector<Identifier> dfgIdentifiers;
+    Vector<WeakReferenceTransition> transitions;
+    Vector<WriteBarrier<JSCell>> weakReferences;
+    Vector<WriteBarrier<Structure>> weakStructureReferences;
+    Bag<CodeBlockJettisoningWatchpoint> watchpoints;
+    Bag<AdaptiveStructureWatchpoint> adaptiveStructureWatchpoints;
+    Bag<AdaptiveInferredPropertyValueWatchpoint> adaptiveInferredPropertyValueWatchpoints;
+    Vector<JumpReplacement> jumpReplacements;
+    
+    RefPtr<Profiler::Compilation> compilation;
+    bool livenessHasBeenProved; // Initialized and used on every GC.
+    bool allTransitionsHaveBeenMarked; // Initialized and used on every GC.
+    bool isStillValid;
+    
+#if USE(JSVALUE32_64)
+    std::unique_ptr<Bag<double>> doubleConstants;
+#endif
+    
+    unsigned frameRegisterCount;
+    unsigned requiredRegisterCountForExit;
+
+private:
+    HashSet<unsigned, WTF::IntHash<unsigned>, WTF::UnsignedWithZeroKeyHashTraits<unsigned>> callSiteIndexFreeList;
+
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCompilationKey.cpp b/dfg/DFGCompilationKey.cpp
new file mode 100644
index 0000000..20ad082
--- /dev/null
+++ b/dfg/DFGCompilationKey.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCompilationKey.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "CodeBlockSet.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void CompilationKey::dump(PrintStream& out) const
+{
+    if (!*this) {
+        out.print("<empty>");
+        return;
+    }
+    out.print("(Compile of ", *m_profiledBlock, " with ", m_mode, ")");
+}
+
+} } // namespace JSC::DFG
+
+
+#endif
diff --git a/dfg/DFGCompilationKey.h b/dfg/DFGCompilationKey.h
new file mode 100644
index 0000000..1fc4c0b
--- /dev/null
+++ b/dfg/DFGCompilationKey.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGCompilationMode.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class CodeBlock;
+class CodeBlockSet;
+
+namespace DFG {
+
+class CompilationKey {
+public:
+    CompilationKey()
+        : m_profiledBlock(0)
+        , m_mode(InvalidCompilationMode)
+    {
+    }
+    
+    CompilationKey(WTF::HashTableDeletedValueType)
+        : m_profiledBlock(0)
+        , m_mode(DFGMode)
+    {
+    }
+    
+    CompilationKey(CodeBlock* profiledBlock, CompilationMode mode)
+        : m_profiledBlock(profiledBlock)
+        , m_mode(mode)
+    {
+    }
+    
+    bool operator!() const
+    {
+        return !m_profiledBlock && m_mode == InvalidCompilationMode;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return !m_profiledBlock && m_mode != InvalidCompilationMode;
+    }
+    
+    CodeBlock* profiledBlock() const { return m_profiledBlock; }
+    CompilationMode mode() const { return m_mode; }
+    
+    bool operator==(const CompilationKey& other) const
+    {
+        return m_profiledBlock == other.m_profiledBlock
+            && m_mode == other.m_mode;
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::pairIntHash(WTF::PtrHash<CodeBlock*>::hash(m_profiledBlock), m_mode);
+    }
+    
+    void dump(PrintStream&) const;
+
+private:
+    CodeBlock* m_profiledBlock;
+    CompilationMode m_mode;
+};
+
+struct CompilationKeyHash {
+    static unsigned hash(const CompilationKey& key) { return key.hash(); }
+    static bool equal(const CompilationKey& a, const CompilationKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::CompilationKey> {
+    typedef JSC::DFG::CompilationKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::CompilationKey> : SimpleClassHashTraits<JSC::DFG::CompilationKey> { };
+
+} // namespace WTF
diff --git a/dfg/DFGCompilationMode.cpp b/dfg/DFGCompilationMode.cpp
new file mode 100644
index 0000000..20de996
--- /dev/null
+++ b/dfg/DFGCompilationMode.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCompilationMode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, CompilationMode mode)
+{
+    switch (mode) {
+    case InvalidCompilationMode:
+        out.print("InvalidCompilationMode");
+        return;
+    case DFGMode:
+        out.print("DFGMode");
+        return;
+    case FTLMode:
+        out.print("FTLMode");
+        return;
+    case FTLForOSREntryMode:
+        out.print("FTLForOSREntryMode");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif
diff --git a/dfg/DFGCompilationMode.h b/dfg/DFGCompilationMode.h
new file mode 100644
index 0000000..4c8a839
--- /dev/null
+++ b/dfg/DFGCompilationMode.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+enum CompilationMode {
+    InvalidCompilationMode,
+    DFGMode,
+    FTLMode,
+    FTLForOSREntryMode
+};
+
+inline bool isFTL(CompilationMode mode)
+{
+    switch (mode) {
+    case FTLMode:
+    case FTLForOSREntryMode:
+        return true;
+    default:
+        return false;
+    }
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::CompilationMode);
+
+} // namespace WTF
diff --git a/dfg/DFGConstantFoldingPhase.cpp b/dfg/DFGConstantFoldingPhase.cpp
new file mode 100644
index 0000000..92a38ec
--- /dev/null
+++ b/dfg/DFGConstantFoldingPhase.cpp
@@ -0,0 +1,902 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGConstantFoldingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractInterpreterInlines.h"
+#include "DFGArgumentsUtilities.h"
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGInPlaceAbstractState.h"
+#include "DFGInferredTypeCheck.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "GetByIdStatus.h"
+#include "JSCInlines.h"
+#include "PutByIdStatus.h"
+
+namespace JSC { namespace DFG {
+
+class ConstantFoldingPhase : public Phase {
+public:
+    ConstantFoldingPhase(Graph& graph)
+        : Phase(graph, "constant folding")
+        , m_state(graph)
+        , m_interpreter(graph, m_state)
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        bool changed = false;
+
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            if (block->cfaFoundConstants)
+                changed |= foldConstants(block);
+        }
+        
+        if (changed && m_graph.m_form == SSA) {
+            // It's now possible that we have Upsilons pointed at JSConstants. Fix that.
+            for (BasicBlock* block : m_graph.blocksInNaturalOrder())
+                fixUpsilons(block);
+        }
+
+        if (m_graph.m_form == SSA) {
+            // It's now possible to simplify basic blocks by placing an Unreachable terminator right
+            // after anything that invalidates AI.
+            bool didClipBlock = false;
+            Vector<Node*> nodesToDelete;
+            for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+                m_state.beginBasicBlock(block);
+                for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                    if (block->at(nodeIndex)->isTerminal()) {
+                        // It's possible that we have something after the terminal. It could be a
+                        // no-op Check node, for example. We don't want the logic below to turn that
+                        // node into Unreachable, since then we'd have two terminators.
+                        break;
+                    }
+                    if (!m_state.isValid()) {
+                        NodeOrigin origin = block->at(nodeIndex)->origin;
+                        for (unsigned killIndex = nodeIndex; killIndex < block->size(); ++killIndex)
+                            nodesToDelete.append(block->at(killIndex));
+                        block->resize(nodeIndex);
+                        block->appendNode(m_graph, SpecNone, Unreachable, origin);
+                        didClipBlock = true;
+                        break;
+                    }
+                    m_interpreter.execute(nodeIndex);
+                }
+                m_state.reset();
+            }
+
+            if (didClipBlock) {
+                changed = true;
+
+                m_graph.invalidateNodeLiveness();
+
+                for (Node* node : nodesToDelete)
+                    m_graph.deleteNode(node);
+
+                m_graph.invalidateCFG();
+                m_graph.resetReachability();
+                m_graph.killUnreachableBlocks();
+            }
+        }
+         
+        return changed;
+    }
+
+private:
+    bool foldConstants(BasicBlock* block)
+    {
+        bool changed = false;
+        m_state.beginBasicBlock(block);
+        for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+            if (!m_state.isValid())
+                break;
+            
+            Node* node = block->at(indexInBlock);
+
+            bool alreadyHandled = false;
+            bool eliminated = false;
+                    
+            switch (node->op()) {
+            case BooleanToNumber: {
+                if (node->child1().useKind() == UntypedUse
+                    && !m_interpreter.needsTypeCheck(node->child1(), SpecBoolean))
+                    node->child1().setUseKind(BooleanUse);
+                break;
+            }
+
+            case CompareEq: {
+                if (!m_interpreter.needsTypeCheck(node->child1(), SpecOther))
+                    node->child1().setUseKind(OtherUse);
+                if (!m_interpreter.needsTypeCheck(node->child2(), SpecOther))
+                    node->child2().setUseKind(OtherUse);
+                break;
+            }
+                
+            case CheckStructure:
+            case ArrayifyToStructure: {
+                AbstractValue& value = m_state.forNode(node->child1());
+                RegisteredStructureSet set;
+                if (node->op() == ArrayifyToStructure)
+                    set = node->structure();
+                else
+                    set = node->structureSet();
+                if (value.m_structure.isSubsetOf(set)) {
+                    m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.
+                    node->remove();
+                    eliminated = true;
+                    break;
+                }
+                break;
+            }
+
+            case CheckDOM: {
+                JSValue constant = m_state.forNode(node->child1()).value();
+                if (constant) {
+                    if (constant.isCell() && constant.asCell()->inherits(node->classInfo())) {
+                        m_interpreter.execute(indexInBlock);
+                        node->remove();
+                        eliminated = true;
+                        break;
+                    }
+                }
+
+                AbstractValue& value = m_state.forNode(node->child1());
+
+                if (value.m_structure.isSubClassOf(node->classInfo())) {
+                    m_interpreter.execute(indexInBlock);
+                    node->remove();
+                    eliminated = true;
+                    break;
+                }
+                break;
+            }
+                
+            case GetIndexedPropertyStorage: {
+                JSArrayBufferView* view = m_graph.tryGetFoldableView(
+                    m_state.forNode(node->child1()).m_value, node->arrayMode());
+                if (!view)
+                    break;
+                
+                if (view->mode() == FastTypedArray) {
+                    // FIXME: It would be awesome to be able to fold the property storage for
+                    // these GC-allocated typed arrays. For now it doesn't matter because the
+                    // most common use-cases for constant typed arrays involve large arrays with
+                    // aliased buffer views.
+                    // https://bugs.webkit.org/show_bug.cgi?id=125425
+                    break;
+                }
+                
+                m_interpreter.execute(indexInBlock);
+                eliminated = true;
+                
+                m_insertionSet.insertCheck(indexInBlock, node->origin, node->children);
+                node->convertToConstantStoragePointer(view->vector());
+                break;
+            }
+                
+            case CheckStructureImmediate: {
+                AbstractValue& value = m_state.forNode(node->child1());
+                const RegisteredStructureSet& set = node->structureSet();
+                
+                if (value.value()) {
+                    if (Structure* structure = jsDynamicCast<Structure*>(value.value())) {
+                        if (set.contains(m_graph.registerStructure(structure))) {
+                            m_interpreter.execute(indexInBlock);
+                            node->remove();
+                            eliminated = true;
+                            break;
+                        }
+                    }
+                }
+                
+                if (PhiChildren* phiChildren = m_interpreter.phiChildren()) {
+                    bool allGood = true;
+                    phiChildren->forAllTransitiveIncomingValues(
+                        node,
+                        [&] (Node* incoming) {
+                            if (Structure* structure = incoming->dynamicCastConstant<Structure*>()) {
+                                if (set.contains(m_graph.registerStructure(structure)))
+                                    return;
+                            }
+                            allGood = false;
+                        });
+                    if (allGood) {
+                        m_interpreter.execute(indexInBlock);
+                        node->remove();
+                        eliminated = true;
+                        break;
+                    }
+                }
+                break;
+            }
+                
+            case CheckArray:
+            case Arrayify: {
+                if (!node->arrayMode().alreadyChecked(m_graph, node, m_state.forNode(node->child1())))
+                    break;
+                node->remove();
+                eliminated = true;
+                break;
+            }
+                
+            case PutStructure: {
+                if (m_state.forNode(node->child1()).m_structure.onlyStructure() != node->transition()->next)
+                    break;
+                
+                node->remove();
+                eliminated = true;
+                break;
+            }
+                
+            case CheckCell: {
+                if (m_state.forNode(node->child1()).value() != node->cellOperand()->value())
+                    break;
+                node->remove();
+                eliminated = true;
+                break;
+            }
+
+            case CheckNotEmpty: {
+                if (m_state.forNode(node->child1()).m_type & SpecEmpty)
+                    break;
+                node->remove();
+                eliminated = true;
+                break;
+            }
+
+            case CheckStringIdent: {
+                UniquedStringImpl* uid = node->uidOperand();
+                const UniquedStringImpl* constantUid = nullptr;
+
+                JSValue childConstant = m_state.forNode(node->child1()).value();
+                if (childConstant) {
+                    if (childConstant.isString()) {
+                        if (const auto* impl = asString(childConstant)->tryGetValueImpl()) {
+                            // Edge filtering requires that a value here should be StringIdent.
+                            // However, a constant value propagated in DFG is not filtered.
+                            // So here, we check the propagated value is actually an atomic string.
+                            // And if it's not, we just ignore.
+                            if (impl->isAtomic())
+                                constantUid = static_cast<const UniquedStringImpl*>(impl);
+                        }
+                    }
+                }
+
+                if (constantUid == uid) {
+                    node->remove();
+                    eliminated = true;
+                }
+                break;
+            }
+
+            case CheckInBounds: {
+                JSValue left = m_state.forNode(node->child1()).value();
+                JSValue right = m_state.forNode(node->child2()).value();
+                if (left && right && left.isInt32() && right.isInt32()
+                    && static_cast<uint32_t>(left.asInt32()) < static_cast<uint32_t>(right.asInt32())) {
+                    node->remove();
+                    eliminated = true;
+                    break;
+                }
+                
+                break;
+            }
+                
+            case GetMyArgumentByVal:
+            case GetMyArgumentByValOutOfBounds: {
+                JSValue indexValue = m_state.forNode(node->child2()).value();
+                if (!indexValue || !indexValue.isInt32())
+                    break;
+
+                unsigned index = indexValue.asUInt32() + node->numberOfArgumentsToSkip();
+                
+                Node* arguments = node->child1().node();
+                InlineCallFrame* inlineCallFrame = arguments->origin.semantic.inlineCallFrame;
+                
+                // Don't try to do anything if the index is known to be outside our static bounds. Note
+                // that our static bounds are usually strictly larger than the dynamic bounds. The
+                // exception is something like this, assuming foo() is not inlined:
+                //
+                // function foo() { return arguments[5]; }
+                //
+                // Here the static bound on number of arguments is 0, and we're accessing index 5. We
+                // will not strength-reduce this to GetStack because GetStack is otherwise assumed by the
+                // compiler to access those variables that are statically accounted for; for example if
+                // we emitted a GetStack on arg6 we would have out-of-bounds access crashes anywhere that
+                // uses an Operands<> map. There is not much cost to continuing to use a
+                // GetMyArgumentByVal in such statically-out-of-bounds accesses; we just lose CFA unless
+                // GCSE removes the access entirely.
+                if (inlineCallFrame) {
+                    if (index >= inlineCallFrame->arguments.size() - 1)
+                        break;
+                } else {
+                    if (index >= m_state.variables().numberOfArguments() - 1)
+                        break;
+                }
+                
+                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+                
+                StackAccessData* data;
+                if (inlineCallFrame) {
+                    data = m_graph.m_stackAccessData.add(
+                        VirtualRegister(
+                            inlineCallFrame->stackOffset +
+                            CallFrame::argumentOffset(index)),
+                        FlushedJSValue);
+                } else {
+                    data = m_graph.m_stackAccessData.add(
+                        virtualRegisterForArgument(index + 1), FlushedJSValue);
+                }
+                
+                if (inlineCallFrame && !inlineCallFrame->isVarargs() && index < inlineCallFrame->arguments.size() - 1) {
+                    node->convertToGetStack(data);
+                    eliminated = true;
+                    break;
+                }
+                
+                if (node->op() == GetMyArgumentByValOutOfBounds)
+                    break;
+                
+                Node* length = emitCodeToGetArgumentsArrayLength(
+                    m_insertionSet, arguments, indexInBlock, node->origin);
+                m_insertionSet.insertNode(
+                    indexInBlock, SpecNone, CheckInBounds, node->origin,
+                    node->child2(), Edge(length, Int32Use));
+                node->convertToGetStack(data);
+                eliminated = true;
+                break;
+            }
+                
+            case MultiGetByOffset: {
+                Edge baseEdge = node->child1();
+                Node* base = baseEdge.node();
+                MultiGetByOffsetData& data = node->multiGetByOffsetData();
+
+                // First prune the variants, then check if the MultiGetByOffset can be
+                // strength-reduced to a GetByOffset.
+                
+                AbstractValue baseValue = m_state.forNode(base);
+                
+                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+                alreadyHandled = true; // Don't allow the default constant folder to do things to this.
+                
+                for (unsigned i = 0; i < data.cases.size(); ++i) {
+                    MultiGetByOffsetCase& getCase = data.cases[i];
+                    getCase.set().filter(baseValue);
+                    if (getCase.set().isEmpty()) {
+                        data.cases[i--] = data.cases.last();
+                        data.cases.removeLast();
+                        changed = true;
+                    }
+                }
+                
+                if (data.cases.size() != 1)
+                    break;
+                
+                emitGetByOffset(indexInBlock, node, baseValue, data.cases[0], data.identifierNumber);
+                changed = true;
+                break;
+            }
+                
+            case MultiPutByOffset: {
+                Edge baseEdge = node->child1();
+                Node* base = baseEdge.node();
+                MultiPutByOffsetData& data = node->multiPutByOffsetData();
+                
+                AbstractValue baseValue = m_state.forNode(base);
+
+                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+                alreadyHandled = true; // Don't allow the default constant folder to do things to this.
+                
+
+                for (unsigned i = 0; i < data.variants.size(); ++i) {
+                    PutByIdVariant& variant = data.variants[i];
+                    variant.oldStructure().genericFilter([&] (Structure* structure) -> bool {
+                        return baseValue.contains(m_graph.registerStructure(structure));
+                    });
+                    
+                    if (variant.oldStructure().isEmpty()) {
+                        data.variants[i--] = data.variants.last();
+                        data.variants.removeLast();
+                        changed = true;
+                        continue;
+                    }
+                    
+                    if (variant.kind() == PutByIdVariant::Transition
+                        && variant.oldStructure().onlyStructure() == variant.newStructure()) {
+                        variant = PutByIdVariant::replace(
+                            variant.oldStructure(),
+                            variant.offset(),
+                            variant.requiredType());
+                        changed = true;
+                    }
+                }
+
+                if (data.variants.size() != 1)
+                    break;
+                
+                emitPutByOffset(
+                    indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
+                changed = true;
+                break;
+            }
+        
+            case GetById:
+            case GetByIdFlush: {
+                Edge childEdge = node->child1();
+                Node* child = childEdge.node();
+                unsigned identifierNumber = node->identifierNumber();
+                
+                AbstractValue baseValue = m_state.forNode(child);
+
+                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+                alreadyHandled = true; // Don't allow the default constant folder to do things to this.
+
+                if (!baseValue.m_structure.isFinite()
+                    || (node->child1().useKind() == UntypedUse || (baseValue.m_type & ~SpecCell)))
+                    break;
+                
+                GetByIdStatus status = GetByIdStatus::computeFor(
+                    baseValue.m_structure.toStructureSet(), m_graph.identifiers()[identifierNumber]);
+                if (!status.isSimple())
+                    break;
+                
+                for (unsigned i = status.numVariants(); i--;) {
+                    if (!status[i].conditionSet().isEmpty()) {
+                        // FIXME: We could handle prototype cases.
+                        // https://bugs.webkit.org/show_bug.cgi?id=110386
+                        break;
+                    }
+                }
+                
+                if (status.numVariants() == 1) {
+                    emitGetByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
+                    changed = true;
+                    break;
+                }
+                
+                if (!isFTL(m_graph.m_plan.mode))
+                    break;
+                
+                MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();
+                for (const GetByIdVariant& variant : status.variants()) {
+                    data->cases.append(
+                        MultiGetByOffsetCase(
+                            *m_graph.addStructureSet(variant.structureSet()),
+                            GetByOffsetMethod::load(variant.offset())));
+                }
+                data->identifierNumber = identifierNumber;
+                node->convertToMultiGetByOffset(data);
+                changed = true;
+                break;
+            }
+                
+            case PutById:
+            case PutByIdDirect:
+            case PutByIdFlush: {
+                NodeOrigin origin = node->origin;
+                Edge childEdge = node->child1();
+                Node* child = childEdge.node();
+                unsigned identifierNumber = node->identifierNumber();
+                
+                ASSERT(childEdge.useKind() == CellUse);
+                
+                AbstractValue baseValue = m_state.forNode(child);
+                AbstractValue valueValue = m_state.forNode(node->child2());
+
+                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+                alreadyHandled = true; // Don't allow the default constant folder to do things to this.
+
+                if (!baseValue.m_structure.isFinite())
+                    break;
+                
+                PutByIdStatus status = PutByIdStatus::computeFor(
+                    m_graph.globalObjectFor(origin.semantic),
+                    baseValue.m_structure.toStructureSet(),
+                    m_graph.identifiers()[identifierNumber],
+                    node->op() == PutByIdDirect);
+                
+                if (!status.isSimple())
+                    break;
+
+                ASSERT(status.numVariants());
+                
+                if (status.numVariants() > 1 && !isFTL(m_graph.m_plan.mode))
+                    break;
+                
+                changed = true;
+
+                bool allGood = true;
+                for (const PutByIdVariant& variant : status.variants()) {
+                    if (!allGood)
+                        break;
+                    for (const ObjectPropertyCondition& condition : variant.conditionSet()) {
+                        if (m_graph.watchCondition(condition))
+                            continue;
+
+                        Structure* structure = condition.object()->structure();
+                        if (!condition.structureEnsuresValidity(structure)) {
+                            allGood = false;
+                            break;
+                        }
+
+                        m_insertionSet.insertNode(
+                            indexInBlock, SpecNone, CheckStructure, node->origin,
+                            OpInfo(m_graph.addStructureSet(structure)),
+                            m_insertionSet.insertConstantForUse(
+                                indexInBlock, node->origin, condition.object(), KnownCellUse));
+                    }
+                }
+
+                if (!allGood)
+                    break;
+                
+                if (status.numVariants() == 1) {
+                    emitPutByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
+                    break;
+                }
+                
+                ASSERT(isFTL(m_graph.m_plan.mode));
+
+                MultiPutByOffsetData* data = m_graph.m_multiPutByOffsetData.add();
+                data->variants = status.variants();
+                data->identifierNumber = identifierNumber;
+                node->convertToMultiPutByOffset(data);
+                break;
+            }
+
+            case ToPrimitive: {
+                if (m_state.forNode(node->child1()).m_type & ~(SpecFullNumber | SpecBoolean | SpecString | SpecSymbol))
+                    break;
+                
+                node->convertToIdentity();
+                changed = true;
+                break;
+            }
+
+            case ToThis: {
+                if (!isToThisAnIdentity(m_graph.executableFor(node->origin.semantic)->isStrictMode(), m_state.forNode(node->child1())))
+                    break;
+
+                node->convertToIdentity();
+                changed = true;
+                break;
+            }
+
+            case ToNumber: {
+                if (m_state.forNode(node->child1()).m_type & ~SpecBytecodeNumber)
+                    break;
+
+                node->convertToIdentity();
+                changed = true;
+                break;
+            }
+
+            case Check: {
+                alreadyHandled = true;
+                m_interpreter.execute(indexInBlock);
+                for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
+                    Edge edge = node->children.child(i);
+                    if (!edge)
+                        break;
+                    if (edge.isProved() || edge.willNotHaveCheck()) {
+                        node->children.removeEdge(i--);
+                        changed = true;
+                    }
+                }
+                break;
+            }
+                
+            default:
+                break;
+            }
+            
+            if (eliminated) {
+                changed = true;
+                continue;
+            }
+                
+            if (alreadyHandled)
+                continue;
+            
+            m_interpreter.execute(indexInBlock);
+            if (!m_state.isValid()) {
+                // If we invalidated then we shouldn't attempt to constant-fold. Here's an
+                // example:
+                //
+                //     c: JSConstant(4.2)
+                //     x: ValueToInt32(Check:Int32:@const)
+                //
+                // It would be correct for an analysis to assume that execution cannot
+                // proceed past @x. Therefore, constant-folding @x could be rather bad. But,
+                // the CFA may report that it found a constant even though it also reported
+                // that everything has been invalidated. This will only happen in a couple of
+                // the constant folding cases; most of them are also separately defensive
+                // about such things.
+                break;
+            }
+            if (!node->shouldGenerate() || m_state.didClobber() || node->hasConstant())
+                continue;
+            
+            // Interesting fact: this freezing that we do right here may turn an fragile value into
+            // a weak value. See DFGValueStrength.h.
+            FrozenValue* value = m_graph.freeze(m_state.forNode(node).value());
+            if (!*value)
+                continue;
+            
+            if (node->op() == GetLocal) {
+                // Need to preserve bytecode liveness in ThreadedCPS form. This wouldn't be necessary
+                // if it wasn't for https://bugs.webkit.org/show_bug.cgi?id=144086.
+                m_insertionSet.insertNode(
+                    indexInBlock, SpecNone, PhantomLocal, node->origin,
+                    OpInfo(node->variableAccessData()));
+                m_graph.dethread();
+            } else
+                m_insertionSet.insertCheck(indexInBlock, node->origin, node->children);
+            m_graph.convertToConstant(node, value);
+            
+            changed = true;
+        }
+        m_state.reset();
+        m_insertionSet.execute(block);
+        
+        return changed;
+    }
+    
+    void emitGetByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const MultiGetByOffsetCase& getCase, unsigned identifierNumber)
+    {
+        // When we get to here we have already emitted all of the requisite checks for everything.
+        // So, we just need to emit what the method object tells us to emit.
+        
+        addBaseCheck(indexInBlock, node, baseValue, getCase.set());
+
+        GetByOffsetMethod method = getCase.method();
+        
+        switch (method.kind()) {
+        case GetByOffsetMethod::Invalid:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+            
+        case GetByOffsetMethod::Constant:
+            m_graph.convertToConstant(node, method.constant());
+            return;
+            
+        case GetByOffsetMethod::Load:
+            emitGetByOffset(indexInBlock, node, node->child1(), identifierNumber, method.offset());
+            return;
+            
+        case GetByOffsetMethod::LoadFromPrototype: {
+            Node* child = m_insertionSet.insertConstant(
+                indexInBlock, node->origin, method.prototype());
+            emitGetByOffset(
+                indexInBlock, node, Edge(child, KnownCellUse), identifierNumber, method.offset());
+            return;
+        } }
+        
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    void emitGetByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const GetByIdVariant& variant, unsigned identifierNumber)
+    {
+        Edge childEdge = node->child1();
+
+        addBaseCheck(indexInBlock, node, baseValue, variant.structureSet());
+        
+        // We aren't set up to handle prototype stuff.
+        DFG_ASSERT(m_graph, node, variant.conditionSet().isEmpty());
+
+        if (JSValue value = m_graph.tryGetConstantProperty(baseValue.m_value, *m_graph.addStructureSet(variant.structureSet()), variant.offset())) {
+            m_graph.convertToConstant(node, m_graph.freeze(value));
+            return;
+        }
+        
+        emitGetByOffset(indexInBlock, node, childEdge, identifierNumber, variant.offset());
+    }
+    
+    void emitGetByOffset(
+        unsigned indexInBlock, Node* node, Edge childEdge, unsigned identifierNumber,
+        PropertyOffset offset, const InferredType::Descriptor& inferredType = InferredType::Top)
+    {
+        childEdge.setUseKind(KnownCellUse);
+        
+        Edge propertyStorage;
+        
+        if (isInlineOffset(offset))
+            propertyStorage = childEdge;
+        else {
+            propertyStorage = Edge(m_insertionSet.insertNode(
+                indexInBlock, SpecNone, GetButterfly, node->origin, childEdge));
+        }
+        
+        StorageAccessData& data = *m_graph.m_storageAccessData.add();
+        data.offset = offset;
+        data.identifierNumber = identifierNumber;
+        data.inferredType = inferredType;
+        
+        node->convertToGetByOffset(data, propertyStorage, childEdge);
+    }
+
+    void emitPutByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const PutByIdVariant& variant, unsigned identifierNumber)
+    {
+        NodeOrigin origin = node->origin;
+        Edge childEdge = node->child1();
+
+        addBaseCheck(indexInBlock, node, baseValue, variant.oldStructure());
+        insertInferredTypeCheck(
+            m_insertionSet, indexInBlock, origin, node->child2().node(), variant.requiredType());
+
+        node->child1().setUseKind(KnownCellUse);
+        childEdge.setUseKind(KnownCellUse);
+
+        Transition* transition = 0;
+        if (variant.kind() == PutByIdVariant::Transition) {
+            transition = m_graph.m_transitions.add(
+                m_graph.registerStructure(variant.oldStructureForTransition()), m_graph.registerStructure(variant.newStructure()));
+        }
+
+        Edge propertyStorage;
+
+        DFG_ASSERT(m_graph, node, origin.exitOK);
+        bool canExit = true;
+        bool didAllocateStorage = false;
+
+        if (isInlineOffset(variant.offset()))
+            propertyStorage = childEdge;
+        else if (!variant.reallocatesStorage()) {
+            propertyStorage = Edge(m_insertionSet.insertNode(
+                indexInBlock, SpecNone, GetButterfly, origin, childEdge));
+        } else if (!variant.oldStructureForTransition()->outOfLineCapacity()) {
+            ASSERT(variant.newStructure()->outOfLineCapacity());
+            ASSERT(!isInlineOffset(variant.offset()));
+            Node* allocatePropertyStorage = m_insertionSet.insertNode(
+                indexInBlock, SpecNone, AllocatePropertyStorage,
+                origin, OpInfo(transition), childEdge);
+            propertyStorage = Edge(allocatePropertyStorage);
+            didAllocateStorage = true;
+        } else {
+            ASSERT(variant.oldStructureForTransition()->outOfLineCapacity());
+            ASSERT(variant.newStructure()->outOfLineCapacity() > variant.oldStructureForTransition()->outOfLineCapacity());
+            ASSERT(!isInlineOffset(variant.offset()));
+
+            Node* reallocatePropertyStorage = m_insertionSet.insertNode(
+                indexInBlock, SpecNone, ReallocatePropertyStorage, origin,
+                OpInfo(transition), childEdge,
+                Edge(m_insertionSet.insertNode(
+                    indexInBlock, SpecNone, GetButterfly, origin, childEdge)));
+            propertyStorage = Edge(reallocatePropertyStorage);
+            didAllocateStorage = true;
+        }
+
+        StorageAccessData& data = *m_graph.m_storageAccessData.add();
+        data.offset = variant.offset();
+        data.identifierNumber = identifierNumber;
+        
+        node->convertToPutByOffset(data, propertyStorage, childEdge);
+        node->origin.exitOK = canExit;
+
+        if (variant.kind() == PutByIdVariant::Transition) {
+            if (didAllocateStorage) {
+                m_insertionSet.insertNode(
+                    indexInBlock + 1, SpecNone, NukeStructureAndSetButterfly,
+                    origin.withInvalidExit(), childEdge, propertyStorage);
+            }
+            
+            // FIXME: PutStructure goes last until we fix either
+            // https://bugs.webkit.org/show_bug.cgi?id=142921 or
+            // https://bugs.webkit.org/show_bug.cgi?id=142924.
+            m_insertionSet.insertNode(
+                indexInBlock + 1, SpecNone, PutStructure, origin.withInvalidExit(), OpInfo(transition),
+                childEdge);
+        }
+    }
+    
+    void addBaseCheck(
+        unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const StructureSet& set)
+    {
+        addBaseCheck(indexInBlock, node, baseValue, *m_graph.addStructureSet(set));
+    }
+
+    void addBaseCheck(
+        unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const RegisteredStructureSet& set)
+    {
+        if (!baseValue.m_structure.isSubsetOf(set)) {
+            // Arises when we prune MultiGetByOffset. We could have a
+            // MultiGetByOffset with a single variant that checks for structure S,
+            // and the input has structures S and T, for example.
+            ASSERT(node->child1());
+            m_insertionSet.insertNode(
+                indexInBlock, SpecNone, CheckStructure, node->origin,
+                OpInfo(m_graph.addStructureSet(set.toStructureSet())), node->child1());
+            return;
+        }
+        
+        if (baseValue.m_type & ~SpecCell)
+            m_insertionSet.insertCheck(indexInBlock, node->origin, node->child1());
+    }
+    
+    void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell, Structure* structure)
+    {
+        {
+            StructureRegistrationResult result;
+            m_graph.registerStructure(cell->structure(), result);
+            if (result == StructureRegisteredAndWatched)
+                return;
+        }
+        
+        m_graph.registerStructure(structure);
+
+        Node* weakConstant = m_insertionSet.insertNode(
+            indexInBlock, speculationFromValue(cell), JSConstant, origin,
+            OpInfo(m_graph.freeze(cell)));
+        
+        m_insertionSet.insertNode(
+            indexInBlock, SpecNone, CheckStructure, origin,
+            OpInfo(m_graph.addStructureSet(structure)), Edge(weakConstant, CellUse));
+    }
+    
+    void fixUpsilons(BasicBlock* block)
+    {
+        for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+            Node* node = block->at(nodeIndex);
+            if (node->op() != Upsilon)
+                continue;
+            switch (node->phi()->op()) {
+            case Phi:
+                break;
+            case JSConstant:
+            case DoubleConstant:
+            case Int52Constant:
+                node->remove();
+                break;
+            default:
+                DFG_CRASH(m_graph, node, "Bad Upsilon phi() pointer");
+                break;
+            }
+        }
+    }
+    
+    InPlaceAbstractState m_state;
+    AbstractInterpreter<InPlaceAbstractState> m_interpreter;
+    InsertionSet m_insertionSet;
+};
+
+bool performConstantFolding(Graph& graph)
+{
+    return runPhase<ConstantFoldingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGConstantFoldingPhase.h b/dfg/DFGConstantFoldingPhase.h
new file mode 100644
index 0000000..fc67366
--- /dev/null
+++ b/dfg/DFGConstantFoldingPhase.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// CFA-based constant folding. Walks those blocks marked by the CFA as having
+// inferred constants, and replaces those nodes with constants whilst injecting
+// Phantom nodes to keep the children alive (which is necessary for OSR exit).
+
+bool performConstantFolding(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGConstantHoistingPhase.cpp b/dfg/DFGConstantHoistingPhase.cpp
new file mode 100644
index 0000000..8a45b34
--- /dev/null
+++ b/dfg/DFGConstantHoistingPhase.cpp
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGConstantHoistingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+class ConstantHoistingPhase : public Phase {
+public:
+    ConstantHoistingPhase(Graph& graph)
+        : Phase(graph, "constant hoisting")
+    {
+    }
+    
+    bool run()
+    {
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_form == SSA);
+        
+        m_graph.clearReplacements();
+        
+        HashMap<FrozenValue*, Node*> jsValues;
+        HashMap<FrozenValue*, Node*> doubleValues;
+        HashMap<FrozenValue*, Node*> int52Values;
+        
+        auto valuesFor = [&] (NodeType op) -> HashMap<FrozenValue*, Node*>& {
+            // Use a roundabout approach because clang thinks that this closure returning a
+            // reference to a stack-allocated value in outer scope is a bug. It's not.
+            HashMap<FrozenValue*, Node*>* result;
+            
+            switch (op) {
+            case JSConstant:
+                result = &jsValues;
+                break;
+            case DoubleConstant:
+                result = &doubleValues;
+                break;
+            case Int52Constant:
+                result = &int52Values;
+                break;
+            default:
+                DFG_CRASH(m_graph, nullptr, "Invalid node type in valuesFor()");
+                result = nullptr;
+                break;
+            }
+            
+            return *result;
+        };
+        
+        Vector<Node*> toFree;
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            unsigned sourceIndex = 0;
+            unsigned targetIndex = 0;
+            while (sourceIndex < block->size()) {
+                Node* node = block->at(sourceIndex++);
+                switch (node->op()) {
+                case JSConstant:
+                case DoubleConstant:
+                case Int52Constant: {
+                    HashMap<FrozenValue*, Node*>& values = valuesFor(node->op());
+                    auto result = values.add(node->constant(), node);
+                    if (result.isNewEntry)
+                        node->origin = m_graph.block(0)->at(0)->origin;
+                    else {
+                        node->setReplacement(result.iterator->value);
+                        toFree.append(node);
+                    }
+                    break;
+                }
+                default:
+                    block->at(targetIndex++) = node;
+                    break;
+                }
+            }
+            block->resize(targetIndex);
+        }
+        
+        // Insert the constants into the root block.
+        InsertionSet insertionSet(m_graph);
+        auto insertConstants = [&] (const HashMap<FrozenValue*, Node*>& values) {
+            for (auto& entry : values)
+                insertionSet.insert(0, entry.value);
+        };
+        insertConstants(jsValues);
+        insertConstants(doubleValues);
+        insertConstants(int52Values);
+        insertionSet.execute(m_graph.block(0));
+        
+        // Perform all of the substitutions. We want all instances of the removed constants to
+        // point at their replacements.
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            for (Node* node : *block)
+                m_graph.performSubstitution(node);
+        }
+        
+        // And finally free the constants that we removed.
+        m_graph.invalidateNodeLiveness();
+        for (Node* node : toFree)
+            m_graph.deleteNode(node);
+        
+        return true;
+    }
+};
+
+} // anonymous namespace
+    
+bool performConstantHoisting(Graph& graph)
+{
+    return runPhase<ConstantHoistingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGConstantHoistingPhase.h b/dfg/DFGConstantHoistingPhase.h
new file mode 100644
index 0000000..4a4e8bf
--- /dev/null
+++ b/dfg/DFGConstantHoistingPhase.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Hoists all constants to the top of the root block.
+
+bool performConstantHoisting(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGControlEquivalenceAnalysis.h b/dfg/DFGControlEquivalenceAnalysis.h
new file mode 100644
index 0000000..ba39ff9
--- /dev/null
+++ b/dfg/DFGControlEquivalenceAnalysis.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBackwardsDominators.h"
+#include "DFGDominators.h"
+
+namespace JSC { namespace DFG {
+
+class ControlEquivalenceAnalysis {
+    WTF_MAKE_NONCOPYABLE(ControlEquivalenceAnalysis);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ControlEquivalenceAnalysis(Graph& graph)
+        : m_dominators(graph.ensureDominators())
+        , m_backwardsDominators(graph.ensureBackwardsDominators())
+    {
+    }
+    
+    // This returns true iff:
+    //
+    // - If b executes then a must have executed before it (a dominates b).
+    // - If a executes then b will execute after it (b backwards-dominates a).
+    //
+    // Note that like Dominators and BackwardsDominators, this analysis ignores OSR:
+    //
+    // - This may return true even if we OSR enter in beteen a and b. OSR entry would mean that b
+    //   could execute even if a had not executed. This is impossible in DFG SSA but it's possible
+    //   in DFG CPS.
+    // - This may return true even if we OSR exit in between a and b. OSR exit would mean that a
+    //   could execute even though b will not execute. This is possible in all forms of DFG IR.
+    //
+    // In DFG SSA you only have to worry about the definition being weaked by exits. This is usually
+    // OK, since we use this analysis to determine the cost of moving exits from one block to
+    // another. If we move an exit from b to a and a equivalently dominates b then at worst we have
+    // made the exit happen sooner. If we move an exit from b to a and a dominates b but not
+    // equivalently then we've done something much worse: the program may now exit even if it would
+    // not have ever exited before.
+    bool dominatesEquivalently(BasicBlock* a, BasicBlock* b)
+    {
+        return m_dominators.dominates(a, b)
+            && m_backwardsDominators.dominates(b, a);
+    }
+    
+    // This returns true iff the execution of a implies that b also executes and vice-versa.
+    bool areEquivalent(BasicBlock* a, BasicBlock* b)
+    {
+        return dominatesEquivalently(a, b)
+            || dominatesEquivalently(b, a);
+    }
+
+private:
+    Dominators& m_dominators;
+    BackwardsDominators& m_backwardsDominators;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGCriticalEdgeBreakingPhase.cpp b/dfg/DFGCriticalEdgeBreakingPhase.cpp
new file mode 100644
index 0000000..e8df6c5
--- /dev/null
+++ b/dfg/DFGCriticalEdgeBreakingPhase.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGCriticalEdgeBreakingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGBlockInsertionSet.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class CriticalEdgeBreakingPhase : public Phase {
+public:
+    CriticalEdgeBreakingPhase(Graph& graph)
+        : Phase(graph, "critical edge breaking")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            // An edge A->B is critical if A has multiple successor and B has multiple
+            // predecessors. Thus we fail early if we don't have multiple successors.
+            
+            if (block->numSuccessors() <= 1)
+                continue;
+            
+            for (unsigned i = block->numSuccessors(); i--;) {
+                BasicBlock** successor = &block->successor(i);
+                if ((*successor)->predecessors.size() <= 1)
+                    continue;
+                
+                breakCriticalEdge(block, successor); 
+            }
+        }
+        
+        return m_insertionSet.execute();
+    }
+
+private:
+    void breakCriticalEdge(BasicBlock* predecessor, BasicBlock** successor)
+    {
+        BasicBlock* pad = m_insertionSet.insertBefore(*successor, (*successor)->executionCount);
+        pad->appendNode(
+            m_graph, SpecNone, Jump, (*successor)->at(0)->origin, OpInfo(*successor));
+        pad->predecessors.append(predecessor);
+        (*successor)->replacePredecessor(predecessor, pad);
+        
+        *successor = pad;
+    }
+    
+    BlockInsertionSet m_insertionSet;
+};
+
+bool performCriticalEdgeBreaking(Graph& graph)
+{
+    return runPhase<CriticalEdgeBreakingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGCriticalEdgeBreakingPhase.h b/dfg/DFGCriticalEdgeBreakingPhase.h
new file mode 100644
index 0000000..54fc869
--- /dev/null
+++ b/dfg/DFGCriticalEdgeBreakingPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Inserts dummy basic blocks to break critical edges. An edge A->B is
+// critical if A has multiple successors and B has multiple predessors.
+
+bool performCriticalEdgeBreaking(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDCEPhase.cpp b/dfg/DFGDCEPhase.cpp
new file mode 100644
index 0000000..a70a869
--- /dev/null
+++ b/dfg/DFGDCEPhase.cpp
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGDCEPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class DCEPhase : public Phase {
+public:
+    DCEPhase(Graph& graph)
+        : Phase(graph, "dead code elimination")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == ThreadedCPS || m_graph.m_form == SSA);
+        
+        m_graph.computeRefCounts();
+        
+        for (BasicBlock* block : m_graph.blocksInPreOrder())
+            fixupBlock(block);
+        
+        cleanVariables(m_graph.m_arguments);
+
+        // Just do a basic Phantom/Check clean-up.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            unsigned sourceIndex = 0;
+            unsigned targetIndex = 0;
+            while (sourceIndex < block->size()) {
+                Node* node = block->at(sourceIndex++);
+                switch (node->op()) {
+                case Check:
+                case Phantom:
+                    if (node->children.isEmpty())
+                        continue;
+                    break;
+                default:
+                    break;
+                }
+                block->at(targetIndex++) = node;
+            }
+            block->resize(targetIndex);
+        }
+        
+        m_graph.m_refCountState = ExactRefCount;
+        
+        return true;
+    }
+
+private:
+    void fixupBlock(BasicBlock* block)
+    {
+        if (!block)
+            return;
+
+        if (m_graph.m_form == ThreadedCPS) {
+            for (unsigned phiIndex = 0; phiIndex < block->phis.size(); ++phiIndex) {
+                Node* phi = block->phis[phiIndex];
+                if (!phi->shouldGenerate()) {
+                    m_graph.deleteNode(phi);
+                    block->phis[phiIndex--] = block->phis.last();
+                    block->phis.removeLast();
+                }
+            }
+            
+            cleanVariables(block->variablesAtHead);
+            cleanVariables(block->variablesAtTail);
+        }
+
+        // This has to be a forward loop because we are using the insertion set.
+        for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+            Node* node = block->at(indexInBlock);
+            if (node->shouldGenerate())
+                continue;
+                
+            if (node->flags() & NodeHasVarArgs) {
+                for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++) {
+                    Edge edge = m_graph.m_varArgChildren[childIdx];
+                    
+                    if (!edge || edge.willNotHaveCheck())
+                        continue;
+                    
+                    m_insertionSet.insertNode(indexInBlock, SpecNone, Check, node->origin, edge);
+                }
+                
+                node->setOpAndDefaultFlags(Check);
+                node->children.reset();
+                node->setRefCount(1);
+                continue;
+            }
+            
+            node->remove();
+            node->setRefCount(1);
+        }
+
+        m_insertionSet.execute(block);
+    }
+    
+    template<typename VariablesVectorType>
+    void cleanVariables(VariablesVectorType& variables)
+    {
+        for (unsigned i = variables.size(); i--;) {
+            Node* node = variables[i];
+            if (!node)
+                continue;
+            if (node->op() != Check && node->shouldGenerate())
+                continue;
+            variables[i] = nullptr;
+        }
+    }
+    
+    InsertionSet m_insertionSet;
+};
+
+bool performDCE(Graph& graph)
+{
+    return runPhase<DCEPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGDCEPhase.h b/dfg/DFGDCEPhase.h
new file mode 100644
index 0000000..b157009
--- /dev/null
+++ b/dfg/DFGDCEPhase.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Global dead code elimination. Eliminates any node that is not NodeMustGenerate,
+// not used by any other live node, and not subject to any type check.
+
+bool performDCE(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDOMJITPatchpointParams.cpp b/dfg/DFGDOMJITPatchpointParams.cpp
new file mode 100644
index 0000000..8ed77b5
--- /dev/null
+++ b/dfg/DFGDOMJITPatchpointParams.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGDOMJITPatchpointParams.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGSlowPathGenerator.h"
+#include "DFGSpeculativeJIT.h"
+
+namespace JSC { namespace DFG {
+
+template<typename OperationType, typename ResultType, typename Arguments, size_t... ArgumentsIndex>
+static void dispatch(SpeculativeJIT* jit, CCallHelpers::JumpList from, OperationType operation, ResultType result, Arguments arguments, std::index_sequence<ArgumentsIndex...>)
+{
+    jit->addSlowPathGenerator(slowPathCall(from, jit, operation, result, std::get<ArgumentsIndex>(arguments)...));
+}
+
+#define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) \
+    void DOMJITPatchpointParams::addSlowPathCallImpl(CCallHelpers::JumpList from, CCallHelpers&, OperationType operation, ResultType result, std::tuple<__VA_ARGS__> args) \
+    { \
+        dispatch(m_jit, from, operation, result, args, std::make_index_sequence<std::tuple_size<decltype(args)>::value>()); \
+    } \
+
+DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
+#undef JSC_DEFINE_CALL_OPERATIONS
+
+} }
+
+#endif
diff --git a/dfg/DFGDOMJITPatchpointParams.h b/dfg/DFGDOMJITPatchpointParams.h
new file mode 100644
index 0000000..fb6ab0b
--- /dev/null
+++ b/dfg/DFGDOMJITPatchpointParams.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DOMJITPatchpointParams.h"
+
+namespace JSC { namespace DFG {
+    
+class SpeculativeJIT;
+
+class DOMJITPatchpointParams : public DOMJIT::PatchpointParams {
+public:
+    DOMJITPatchpointParams(SpeculativeJIT* jit, Vector<DOMJIT::Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
+        : DOMJIT::PatchpointParams(WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch))
+        , m_jit(jit)
+    {
+    }
+
+private:
+#define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) void addSlowPathCallImpl(CCallHelpers::JumpList, CCallHelpers&, OperationType, ResultType, std::tuple<__VA_ARGS__> args) override;
+    DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
+#undef JSC_DEFINE_CALL_OPERATIONS
+
+    SpeculativeJIT* m_jit;
+};
+
+} }
+
+#endif
diff --git a/dfg/DFGDesiredIdentifiers.cpp b/dfg/DFGDesiredIdentifiers.cpp
new file mode 100644
index 0000000..48d77c3
--- /dev/null
+++ b/dfg/DFGDesiredIdentifiers.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGDesiredIdentifiers.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGCommonData.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+DesiredIdentifiers::DesiredIdentifiers()
+    : m_codeBlock(nullptr)
+    , m_didProcessIdentifiers(false)
+{
+}
+
+DesiredIdentifiers::DesiredIdentifiers(CodeBlock* codeBlock)
+    : m_codeBlock(codeBlock)
+    , m_didProcessIdentifiers(false)
+{
+}
+
+DesiredIdentifiers::~DesiredIdentifiers()
+{
+}
+
+unsigned DesiredIdentifiers::numberOfIdentifiers()
+{
+    return m_codeBlock->numberOfIdentifiers() + m_addedIdentifiers.size();
+}
+
+unsigned DesiredIdentifiers::ensure(UniquedStringImpl* rep)
+{
+    if (!m_didProcessIdentifiers) {
+        // Do this now instead of the constructor so that we don't pay the price on the main
+        // thread. Also, not all compilations need to call ensure().
+        for (unsigned index = m_codeBlock->numberOfIdentifiers(); index--;)
+            m_identifierNumberForName.add(m_codeBlock->identifier(index).impl(), index);
+        m_didProcessIdentifiers = true;
+    }
+
+    auto addResult = m_identifierNumberForName.add(rep, numberOfIdentifiers());
+    unsigned result = addResult.iterator->value;
+    if (addResult.isNewEntry) {
+        m_addedIdentifiers.append(rep);
+        ASSERT(at(result) == rep);
+    }
+    return result;
+}
+
+UniquedStringImpl* DesiredIdentifiers::at(unsigned index) const
+{
+    UniquedStringImpl* result;
+    if (index < m_codeBlock->numberOfIdentifiers())
+        result = m_codeBlock->identifier(index).impl();
+    else
+        result = m_addedIdentifiers[index - m_codeBlock->numberOfIdentifiers()];
+    ASSERT(result->hasAtLeastOneRef());
+    return result;
+}
+
+void DesiredIdentifiers::reallyAdd(VM& vm, CommonData* commonData)
+{
+    for (unsigned i = 0; i < m_addedIdentifiers.size(); ++i) {
+        auto rep = m_addedIdentifiers[i];
+        ASSERT(rep->hasAtLeastOneRef());
+        commonData->dfgIdentifiers.append(Identifier::fromUid(&vm, rep));
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGDesiredIdentifiers.h b/dfg/DFGDesiredIdentifiers.h
new file mode 100644
index 0000000..9d5f52b
--- /dev/null
+++ b/dfg/DFGDesiredIdentifiers.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "Identifier.h"
+
+namespace JSC {
+
+class CodeBlock;
+
+namespace DFG {
+
+class CommonData;
+
+class DesiredIdentifiers {
+public:
+    DesiredIdentifiers();
+    DesiredIdentifiers(CodeBlock*);
+    ~DesiredIdentifiers();
+    
+    unsigned numberOfIdentifiers();
+    unsigned ensure(UniquedStringImpl*);
+    
+    UniquedStringImpl* at(unsigned index) const;
+    
+    UniquedStringImpl* operator[](unsigned index) const { return at(index); }
+    
+    void reallyAdd(VM&, CommonData*);
+    
+private:
+    CodeBlock* m_codeBlock;
+    Vector<UniquedStringImpl*> m_addedIdentifiers;
+    HashMap<UniquedStringImpl*, unsigned> m_identifierNumberForName;
+    bool m_didProcessIdentifiers;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDesiredInferredType.h b/dfg/DFGDesiredInferredType.h
new file mode 100644
index 0000000..5d5af5a
--- /dev/null
+++ b/dfg/DFGDesiredInferredType.h
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "InferredType.h"
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace DFG {
+
+// This documents the DFG's expectation for an InferredType: specifically, that we want it to have a live
+// InferredType object and that this object has the type that we originally saw.
+
+class DesiredInferredType {
+public:
+    DesiredInferredType()
+        : m_object(nullptr)
+    {
+    }
+    
+    DesiredInferredType(InferredType* object, const InferredType::Descriptor& expected)
+        : m_object(object)
+        , m_expected(expected)
+    {
+    }
+
+    DesiredInferredType(WTF::HashTableDeletedValueType)
+        : m_object(nullptr)
+        , m_expected(InferredType::Top)
+    {
+    }
+
+    explicit operator bool() const { return m_object && m_expected; }
+
+    InferredType* object() const { return m_object; }
+    InferredType::Descriptor expected() const { return m_expected; }
+
+    bool isStillValid() const
+    {
+        return m_object->canWatch(m_expected);
+    }
+
+    void add(Watchpoint* watchpoint) const
+    {
+        m_object->addWatchpoint(watchpoint);
+    }
+
+    bool operator==(const DesiredInferredType& other) const
+    {
+        return m_object == other.m_object
+            && m_expected == other.m_expected;
+    }
+
+    bool operator!=(const DesiredInferredType& other) const
+    {
+        return !(*this == other);
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return !m_object && m_expected == InferredType::Top;
+    }
+
+    unsigned hash() const
+    {
+        return WTF::PtrHash<InferredType*>::hash(m_object) + m_expected.hash() * 7;
+    }
+
+    void dumpInContext(PrintStream& out, DumpContext* context) const
+    {
+        out.print(inContext(m_expected, context), " for ", RawPointer(m_object));
+    }
+
+    void dump(PrintStream& out) const
+    {
+        dumpInContext(out, nullptr);
+    }
+
+private:
+    InferredType* m_object;
+    InferredType::Descriptor m_expected;
+};
+
+struct DesiredInferredTypeHash {
+    static unsigned hash(const DesiredInferredType& key) { return key.hash(); }
+    static bool equal(const DesiredInferredType& a, const DesiredInferredType& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::DesiredInferredType> {
+    typedef JSC::DFG::DesiredInferredTypeHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::DesiredInferredType> : SimpleClassHashTraits<JSC::DFG::DesiredInferredType> { };
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDesiredTransitions.cpp b/dfg/DFGDesiredTransitions.cpp
new file mode 100644
index 0000000..4b82b03
--- /dev/null
+++ b/dfg/DFGDesiredTransitions.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGDesiredTransitions.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGCommonData.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+DesiredTransition::DesiredTransition(CodeBlock* codeBlock, CodeBlock* codeOriginOwner, Structure* oldStructure, Structure* newStructure)
+    : m_codeBlock(codeBlock)
+    , m_codeOriginOwner(codeOriginOwner)
+    , m_oldStructure(oldStructure)
+    , m_newStructure(newStructure)
+{
+}
+
+void DesiredTransition::reallyAdd(VM& vm, CommonData* common)
+{
+    common->transitions.append(
+        WeakReferenceTransition(
+            vm, m_codeBlock,
+            m_codeOriginOwner,
+            m_oldStructure, m_newStructure));
+}
+
+void DesiredTransition::visitChildren(SlotVisitor& visitor)
+{
+    visitor.appendUnbarriered(m_codeOriginOwner);
+    visitor.appendUnbarriered(m_oldStructure);
+    visitor.appendUnbarriered(m_newStructure);
+}
+
+DesiredTransitions::DesiredTransitions()
+{
+}
+
+DesiredTransitions::~DesiredTransitions()
+{
+}
+
+void DesiredTransitions::addLazily(CodeBlock* codeBlock, CodeBlock* codeOriginOwner, Structure* oldStructure, Structure* newStructure)
+{
+    m_transitions.append(DesiredTransition(codeBlock, codeOriginOwner, oldStructure, newStructure));
+}
+
+void DesiredTransitions::reallyAdd(VM& vm, CommonData* common)
+{
+    for (unsigned i = 0; i < m_transitions.size(); i++)
+        m_transitions[i].reallyAdd(vm, common);
+}
+
+void DesiredTransitions::visitChildren(SlotVisitor& visitor)
+{
+    for (unsigned i = 0; i < m_transitions.size(); i++)
+        m_transitions[i].visitChildren(visitor);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDesiredTransitions.h b/dfg/DFGDesiredTransitions.h
new file mode 100644
index 0000000..f3f483e
--- /dev/null
+++ b/dfg/DFGDesiredTransitions.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Vector.h>
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { 
+
+class CodeBlock;
+class ScriptExecutable;
+class SlotVisitor;
+class Structure;
+class VM;
+
+namespace DFG {
+
+class CommonData;
+
+class DesiredTransition {
+public:
+    DesiredTransition(CodeBlock*, CodeBlock* codeOriginOwner, Structure*, Structure*);
+
+    void reallyAdd(VM&, CommonData*);
+    
+    void visitChildren(SlotVisitor&);
+
+private:
+    CodeBlock* m_codeBlock;
+    CodeBlock* m_codeOriginOwner;
+    Structure* m_oldStructure;
+    Structure* m_newStructure;
+};
+
+class DesiredTransitions {
+public:
+    DesiredTransitions();
+    ~DesiredTransitions();
+
+    void addLazily(CodeBlock*, CodeBlock* codeOriginOwner, Structure*, Structure*);
+    void reallyAdd(VM&, CommonData*);
+    void visitChildren(SlotVisitor&);
+
+private:
+    Vector<DesiredTransition> m_transitions;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDesiredWatchpoints.cpp b/dfg/DFGDesiredWatchpoints.cpp
new file mode 100644
index 0000000..3cdc9bc
--- /dev/null
+++ b/dfg/DFGDesiredWatchpoints.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGDesiredWatchpoints.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayBufferNeuteringWatchpoint.h"
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void ArrayBufferViewWatchpointAdaptor::add(
+    CodeBlock* codeBlock, JSArrayBufferView* view, CommonData& common)
+{
+    Watchpoint* watchpoint = common.watchpoints.add(codeBlock);
+    ArrayBufferNeuteringWatchpoint* neuteringWatchpoint =
+        ArrayBufferNeuteringWatchpoint::create(*codeBlock->vm());
+    neuteringWatchpoint->set()->add(watchpoint);
+    codeBlock->addConstant(neuteringWatchpoint);
+    // FIXME: We don't need to set this watchpoint at all for shared buffers.
+    // https://bugs.webkit.org/show_bug.cgi?id=164108
+    codeBlock->vm()->heap.addReference(neuteringWatchpoint, view->possiblySharedBuffer());
+}
+
+void InferredValueAdaptor::add(
+    CodeBlock* codeBlock, InferredValue* inferredValue, CommonData& common)
+{
+    codeBlock->addConstant(inferredValue); // For common users, it doesn't really matter if it's weak or not. If references to it go away, we go away, too.
+    inferredValue->add(common.watchpoints.add(codeBlock));
+}
+
+void AdaptiveStructureWatchpointAdaptor::add(
+    CodeBlock* codeBlock, const ObjectPropertyCondition& key, CommonData& common)
+{
+    switch (key.kind()) {
+    case PropertyCondition::Equivalence:
+        common.adaptiveInferredPropertyValueWatchpoints.add(key, codeBlock)->install();
+        break;
+    default:
+        common.adaptiveStructureWatchpoints.add(key, codeBlock)->install();
+        break;
+    }
+}
+
+void InferredTypeAdaptor::add(CodeBlock* codeBlock, const DesiredInferredType& key, CommonData& common)
+{
+    key.add(common.watchpoints.add(codeBlock));
+}
+
+DesiredWatchpoints::DesiredWatchpoints() { }
+DesiredWatchpoints::~DesiredWatchpoints() { }
+
+void DesiredWatchpoints::addLazily(WatchpointSet* set)
+{
+    m_sets.addLazily(set);
+}
+
+void DesiredWatchpoints::addLazily(InlineWatchpointSet& set)
+{
+    m_inlineSets.addLazily(&set);
+}
+
+void DesiredWatchpoints::addLazily(InferredValue* inferredValue)
+{
+    m_inferredValues.addLazily(inferredValue);
+}
+
+void DesiredWatchpoints::addLazily(JSArrayBufferView* view)
+{
+    m_bufferViews.addLazily(view);
+}
+
+void DesiredWatchpoints::addLazily(const ObjectPropertyCondition& key)
+{
+    m_adaptiveStructureSets.addLazily(key);
+}
+
+void DesiredWatchpoints::addLazily(const DesiredInferredType& key)
+{
+    m_inferredTypes.addLazily(key);
+}
+
+bool DesiredWatchpoints::consider(Structure* structure)
+{
+    if (!structure->dfgShouldWatch())
+        return false;
+    addLazily(structure->transitionWatchpointSet());
+    return true;
+}
+
+void DesiredWatchpoints::reallyAdd(CodeBlock* codeBlock, CommonData& commonData)
+{
+    m_sets.reallyAdd(codeBlock, commonData);
+    m_inlineSets.reallyAdd(codeBlock, commonData);
+    m_inferredValues.reallyAdd(codeBlock, commonData);
+    m_bufferViews.reallyAdd(codeBlock, commonData);
+    m_adaptiveStructureSets.reallyAdd(codeBlock, commonData);
+    m_inferredTypes.reallyAdd(codeBlock, commonData);
+}
+
+bool DesiredWatchpoints::areStillValid() const
+{
+    return m_sets.areStillValid()
+        && m_inlineSets.areStillValid()
+        && m_inferredValues.areStillValid()
+        && m_bufferViews.areStillValid()
+        && m_adaptiveStructureSets.areStillValid()
+        && m_inferredTypes.areStillValid();
+}
+
+void DesiredWatchpoints::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    out.print("Desired watchpoints:\n");
+    out.print("    Watchpoint sets: ", inContext(m_sets, context), "\n");
+    out.print("    Inline watchpoint sets: ", inContext(m_inlineSets, context), "\n");
+    out.print("    Inferred values: ", inContext(m_inferredValues, context), "\n");
+    out.print("    Buffer views: ", inContext(m_bufferViews, context), "\n");
+    out.print("    Object property conditions: ", inContext(m_adaptiveStructureSets, context), "\n");
+    out.print("    Inferred types: ", inContext(m_inferredTypes, context), "\n");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGDesiredWatchpoints.h b/dfg/DFGDesiredWatchpoints.h
new file mode 100644
index 0000000..e94bfe0
--- /dev/null
+++ b/dfg/DFGDesiredWatchpoints.h
@@ -0,0 +1,224 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeOrigin.h"
+#include "DFGCommonData.h"
+#include "DFGDesiredInferredType.h"
+#include "InferredValue.h"
+#include "JSArrayBufferView.h"
+#include "ObjectPropertyCondition.h"
+#include "Watchpoint.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/HashSet.h>
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+template<typename T>
+struct SetPointerAdaptor {
+    static void add(CodeBlock* codeBlock, T set, CommonData& common)
+    {
+        return set->add(common.watchpoints.add(codeBlock));
+    }
+    static bool hasBeenInvalidated(T set) { return set->hasBeenInvalidated(); }
+    static void dumpInContext(PrintStream& out, T set, DumpContext*)
+    {
+        out.print(RawPointer(set));
+    }
+};
+
+struct InferredValueAdaptor {
+    static void add(CodeBlock*, InferredValue*, CommonData&);
+    static bool hasBeenInvalidated(InferredValue* inferredValue)
+    {
+        return inferredValue->hasBeenInvalidated();
+    }
+    static void dumpInContext(PrintStream& out, InferredValue* inferredValue, DumpContext*)
+    {
+        out.print(RawPointer(inferredValue));
+    }
+};
+
+struct ArrayBufferViewWatchpointAdaptor {
+    static void add(CodeBlock*, JSArrayBufferView*, CommonData&);
+    static bool hasBeenInvalidated(JSArrayBufferView* view)
+    {
+        return !view->length();
+    }
+    static void dumpInContext(PrintStream& out, JSArrayBufferView* view, DumpContext* context)
+    {
+        out.print(inContext(JSValue(view), context));
+    }
+};
+
+struct AdaptiveStructureWatchpointAdaptor {
+    static void add(CodeBlock*, const ObjectPropertyCondition&, CommonData&);
+    static bool hasBeenInvalidated(const ObjectPropertyCondition& key)
+    {
+        return !key.isWatchable();
+    }
+    static void dumpInContext(
+        PrintStream& out, const ObjectPropertyCondition& key, DumpContext* context)
+    {
+        out.print(inContext(key, context));
+    }
+};
+
+struct InferredTypeAdaptor {
+    static void add(CodeBlock*, const DesiredInferredType&, CommonData&);
+    static bool hasBeenInvalidated(const DesiredInferredType& key)
+    {
+        return !key.isStillValid();
+    }
+    static void dumpInContext(PrintStream& out, const DesiredInferredType& key, DumpContext* context)
+    {
+        out.print(inContext(key, context));
+    }
+};
+
+template<typename WatchpointSetType, typename Adaptor = SetPointerAdaptor<WatchpointSetType>>
+class GenericDesiredWatchpoints {
+#if !ASSERT_DISABLED
+    typedef HashMap<WatchpointSetType, bool> StateMap;
+#endif
+public:
+    GenericDesiredWatchpoints()
+        : m_reallyAdded(false)
+    {
+    }
+    
+    void addLazily(const WatchpointSetType& set)
+    {
+        m_sets.add(set);
+    }
+    
+    void reallyAdd(CodeBlock* codeBlock, CommonData& common)
+    {
+        RELEASE_ASSERT(!m_reallyAdded);
+        
+        for (auto& set : m_sets)
+            Adaptor::add(codeBlock, set, common);
+        
+        m_reallyAdded = true;
+    }
+    
+    bool areStillValid() const
+    {
+        for (auto& set : m_sets) {
+            if (Adaptor::hasBeenInvalidated(set))
+                return false;
+        }
+        
+        return true;
+    }
+    
+    bool isWatched(const WatchpointSetType& set) const
+    {
+        return m_sets.contains(set);
+    }
+
+    void dumpInContext(PrintStream& out, DumpContext* context) const
+    {
+        CommaPrinter comma;
+        for (const WatchpointSetType& entry : m_sets) {
+            out.print(comma);
+            Adaptor::dumpInContext(out, entry, context);
+        }
+    }
+
+private:
+    HashSet<WatchpointSetType> m_sets;
+    bool m_reallyAdded;
+};
+
+class DesiredWatchpoints {
+public:
+    DesiredWatchpoints();
+    ~DesiredWatchpoints();
+    
+    void addLazily(WatchpointSet*);
+    void addLazily(InlineWatchpointSet&);
+    void addLazily(InferredValue*);
+    void addLazily(JSArrayBufferView*);
+    
+    // It's recommended that you don't call this directly. Use Graph::watchCondition(), which does
+    // the required GC magic as well as some other bookkeeping.
+    void addLazily(const ObjectPropertyCondition&);
+
+    // It's recommended that you don't call this directly. Use Graph::inferredTypeFor(), which does
+    // the required GC magic.
+    void addLazily(const DesiredInferredType&);
+    
+    bool consider(Structure*);
+    
+    void reallyAdd(CodeBlock*, CommonData&);
+    
+    bool areStillValid() const;
+    
+    bool isWatched(WatchpointSet* set)
+    {
+        return m_sets.isWatched(set);
+    }
+    bool isWatched(InlineWatchpointSet& set)
+    {
+        return m_inlineSets.isWatched(&set);
+    }
+    bool isWatched(InferredValue* inferredValue)
+    {
+        return m_inferredValues.isWatched(inferredValue);
+    }
+    bool isWatched(JSArrayBufferView* view)
+    {
+        return m_bufferViews.isWatched(view);
+    }
+    bool isWatched(const ObjectPropertyCondition& key)
+    {
+        return m_adaptiveStructureSets.isWatched(key);
+    }
+    bool isWatched(const DesiredInferredType& key)
+    {
+        return m_inferredTypes.isWatched(key);
+    }
+
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+    
+private:
+    GenericDesiredWatchpoints<WatchpointSet*> m_sets;
+    GenericDesiredWatchpoints<InlineWatchpointSet*> m_inlineSets;
+    GenericDesiredWatchpoints<InferredValue*, InferredValueAdaptor> m_inferredValues;
+    GenericDesiredWatchpoints<JSArrayBufferView*, ArrayBufferViewWatchpointAdaptor> m_bufferViews;
+    GenericDesiredWatchpoints<ObjectPropertyCondition, AdaptiveStructureWatchpointAdaptor> m_adaptiveStructureSets;
+    GenericDesiredWatchpoints<DesiredInferredType, InferredTypeAdaptor> m_inferredTypes;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDesiredWeakReferences.cpp b/dfg/DFGDesiredWeakReferences.cpp
new file mode 100644
index 0000000..29daf4b
--- /dev/null
+++ b/dfg/DFGDesiredWeakReferences.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGDesiredWeakReferences.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGCommonData.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+DesiredWeakReferences::DesiredWeakReferences()
+    : m_codeBlock(nullptr)
+{
+}
+
+DesiredWeakReferences::DesiredWeakReferences(CodeBlock* codeBlock)
+    : m_codeBlock(codeBlock)
+{
+}
+
+DesiredWeakReferences::~DesiredWeakReferences()
+{
+}
+
+void DesiredWeakReferences::addLazily(JSCell* cell)
+{
+    if (cell)
+        m_references.add(cell);
+}
+
+void DesiredWeakReferences::addLazily(JSValue value)
+{
+    if (value.isCell())
+        addLazily(value.asCell());
+}
+
+bool DesiredWeakReferences::contains(JSCell* cell)
+{
+    return m_references.contains(cell);
+}
+
+void DesiredWeakReferences::reallyAdd(VM& vm, CommonData* common)
+{
+    for (JSCell* target : m_references) {
+        if (Structure* structure = jsDynamicCast<Structure*>(target)) {
+            common->weakStructureReferences.append(
+                WriteBarrier<Structure>(vm, m_codeBlock, structure));
+        } else {
+            // There are weird relationships in how optimized CodeBlocks
+            // point to other CodeBlocks. We don't want to have them be
+            // part of the weak pointer set. For example, an optimized CodeBlock
+            // having a weak pointer to itself will cause it to get collected.
+            RELEASE_ASSERT(!jsDynamicCast<CodeBlock*>(target));
+
+            common->weakReferences.append(
+                WriteBarrier<JSCell>(vm, m_codeBlock, target));
+        }
+    }
+}
+
+void DesiredWeakReferences::visitChildren(SlotVisitor& visitor)
+{
+    for (JSCell* target : m_references)
+        visitor.appendUnbarriered(target);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDesiredWeakReferences.h b/dfg/DFGDesiredWeakReferences.h
new file mode 100644
index 0000000..632735c
--- /dev/null
+++ b/dfg/DFGDesiredWeakReferences.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/HashSet.h>
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { 
+
+class CodeBlock;
+class JSCell;
+class JSValue;
+class SlotVisitor;
+class VM;
+
+namespace DFG {
+
+class CommonData;
+
+class DesiredWeakReferences {
+public:
+    DesiredWeakReferences();
+    DesiredWeakReferences(CodeBlock*);
+    ~DesiredWeakReferences();
+
+    void addLazily(JSCell*);
+    void addLazily(JSValue);
+    bool contains(JSCell*);
+    
+    void reallyAdd(VM&, CommonData*);
+    
+    void visitChildren(SlotVisitor&);
+
+private:
+    CodeBlock* m_codeBlock;
+    HashSet<JSCell*> m_references;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDisassembler.cpp b/dfg/DFGDisassembler.cpp
new file mode 100644
index 0000000..15cbea0
--- /dev/null
+++ b/dfg/DFGDisassembler.cpp
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGDisassembler.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlockWithJITType.h"
+#include "DFGGraph.h"
+#include "DFGJITCode.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "ProfilerDatabase.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC { namespace DFG {
+
+Disassembler::Disassembler(Graph& graph)
+    : m_graph(graph)
+{
+    m_dumpContext.graph = &m_graph;
+    m_labelForBlockIndex.resize(graph.numBlocks());
+}
+
+void Disassembler::dump(PrintStream& out, LinkBuffer& linkBuffer)
+{
+    Vector<DumpedOp> ops = createDumpList(linkBuffer);
+    for (unsigned i = 0; i < ops.size(); ++i)
+        out.print(ops[i].text);
+}
+
+void Disassembler::dump(LinkBuffer& linkBuffer)
+{
+    dump(WTF::dataFile(), linkBuffer);
+}
+
+void Disassembler::reportToProfiler(Profiler::Compilation* compilation, LinkBuffer& linkBuffer)
+{
+    Vector<DumpedOp> ops = createDumpList(linkBuffer);
+    
+    for (unsigned i = 0; i < ops.size(); ++i) {
+        Profiler::OriginStack stack;
+        
+        if (ops[i].codeOrigin.isSet())
+            stack = Profiler::OriginStack(*m_graph.m_vm.m_perBytecodeProfiler, m_graph.m_codeBlock, ops[i].codeOrigin);
+        
+        compilation->addDescription(Profiler::CompiledBytecode(stack, ops[i].text));
+    }
+}
+
+void Disassembler::dumpHeader(PrintStream& out, LinkBuffer& linkBuffer)
+{
+    out.print("Generated DFG JIT code for ", CodeBlockWithJITType(m_graph.m_codeBlock, JITCode::DFGJIT), ", instruction count = ", m_graph.m_codeBlock->instructionCount(), ":\n");
+    out.print("    Optimized with execution counter = ", m_graph.m_profiledBlock->jitExecuteCounter(), "\n");
+    out.print("    Code at [", RawPointer(linkBuffer.debugAddress()), ", ", RawPointer(static_cast<char*>(linkBuffer.debugAddress()) + linkBuffer.size()), "):\n");
+}
+
+void Disassembler::append(Vector<Disassembler::DumpedOp>& result, StringPrintStream& out, CodeOrigin& previousOrigin)
+{
+    result.append(DumpedOp(previousOrigin, out.toCString()));
+    previousOrigin = CodeOrigin();
+    out.reset();
+}
+
+Vector<Disassembler::DumpedOp> Disassembler::createDumpList(LinkBuffer& linkBuffer)
+{
+    StringPrintStream out;
+    Vector<DumpedOp> result;
+    
+    CodeOrigin previousOrigin = CodeOrigin();
+    dumpHeader(out, linkBuffer);
+    append(result, out, previousOrigin);
+    
+    m_graph.ensureDominators();
+    m_graph.ensureNaturalLoops();
+    
+    const char* prefix = "    ";
+    const char* disassemblyPrefix = "        ";
+    
+    Node* lastNode = 0;
+    MacroAssembler::Label previousLabel = m_startOfCode;
+    for (size_t blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+        BasicBlock* block = m_graph.block(blockIndex);
+        if (!block)
+            continue;
+        dumpDisassembly(out, disassemblyPrefix, linkBuffer, previousLabel, m_labelForBlockIndex[blockIndex], lastNode);
+        append(result, out, previousOrigin);
+        m_graph.dumpBlockHeader(out, prefix, block, Graph::DumpLivePhisOnly, &m_dumpContext);
+        append(result, out, previousOrigin);
+        Node* lastNodeForDisassembly = block->at(0);
+        for (size_t i = 0; i < block->size(); ++i) {
+            MacroAssembler::Label currentLabel;
+            HashMap<Node*, MacroAssembler::Label>::iterator iter = m_labelForNode.find(block->at(i));
+            if (iter != m_labelForNode.end())
+                currentLabel = iter->value;
+            else {
+                // Dump the last instruction by using the first label of the next block
+                // as the end point. This case is hit either during peephole compare
+                // optimizations (the Branch won't have its own label) or if we have a
+                // forced OSR exit.
+                if (blockIndex + 1 < m_graph.numBlocks())
+                    currentLabel = m_labelForBlockIndex[blockIndex + 1];
+                else
+                    currentLabel = m_endOfMainPath;
+            }
+            dumpDisassembly(out, disassemblyPrefix, linkBuffer, previousLabel, currentLabel, lastNodeForDisassembly);
+            append(result, out, previousOrigin);
+            previousOrigin = block->at(i)->origin.semantic;
+            if (m_graph.dumpCodeOrigin(out, prefix, lastNode, block->at(i), &m_dumpContext)) {
+                append(result, out, previousOrigin);
+                previousOrigin = block->at(i)->origin.semantic;
+            }
+            m_graph.dump(out, prefix, block->at(i), &m_dumpContext);
+            lastNode = block->at(i);
+            lastNodeForDisassembly = block->at(i);
+        }
+    }
+    dumpDisassembly(out, disassemblyPrefix, linkBuffer, previousLabel, m_endOfMainPath, lastNode);
+    append(result, out, previousOrigin);
+    out.print(prefix, "(End Of Main Path)\n");
+    append(result, out, previousOrigin);
+    dumpDisassembly(out, disassemblyPrefix, linkBuffer, previousLabel, m_endOfCode, 0);
+    append(result, out, previousOrigin);
+    m_dumpContext.dump(out, prefix);
+    append(result, out, previousOrigin);
+    
+    return result;
+}
+
+void Disassembler::dumpDisassembly(PrintStream& out, const char* prefix, LinkBuffer& linkBuffer, MacroAssembler::Label& previousLabel, MacroAssembler::Label currentLabel, Node* context)
+{
+    size_t prefixLength = strlen(prefix);
+    int amountOfNodeWhiteSpace;
+    if (!context)
+        amountOfNodeWhiteSpace = 0;
+    else
+        amountOfNodeWhiteSpace = Graph::amountOfNodeWhiteSpace(context);
+    auto prefixBuffer = std::make_unique<char[]>(prefixLength + amountOfNodeWhiteSpace + 1);
+    strcpy(prefixBuffer.get(), prefix);
+    for (int i = 0; i < amountOfNodeWhiteSpace; ++i)
+        prefixBuffer[i + prefixLength] = ' ';
+    prefixBuffer[prefixLength + amountOfNodeWhiteSpace] = 0;
+    
+    CodeLocationLabel start = linkBuffer.locationOf(previousLabel);
+    CodeLocationLabel end = linkBuffer.locationOf(currentLabel);
+    previousLabel = currentLabel;
+    ASSERT(bitwise_cast<uintptr_t>(end.executableAddress()) >= bitwise_cast<uintptr_t>(start.executableAddress()));
+    disassemble(start, bitwise_cast<uintptr_t>(end.executableAddress()) - bitwise_cast<uintptr_t>(start.executableAddress()), prefixBuffer.get(), out);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDisassembler.h b/dfg/DFGDisassembler.h
new file mode 100644
index 0000000..128ea11
--- /dev/null
+++ b/dfg/DFGDisassembler.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeOrigin.h"
+#include "DFGCommon.h"
+#include "DumpContext.h"
+#include "MacroAssembler.h"
+#include "ProfilerCompilation.h"
+#include <wtf/HashMap.h>
+#include <wtf/StringPrintStream.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class LinkBuffer;
+
+namespace DFG {
+
+class Graph;
+
+class Disassembler {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    Disassembler(Graph&);
+    
+    void setStartOfCode(MacroAssembler::Label label) { m_startOfCode = label; }
+    void setForBlockIndex(BlockIndex blockIndex, MacroAssembler::Label label)
+    {
+        m_labelForBlockIndex[blockIndex] = label;
+    }
+    void setForNode(Node* node, MacroAssembler::Label label)
+    {
+        ASSERT(label.isSet());
+        m_labelForNode.add(node, label);
+    }
+    void setEndOfMainPath(MacroAssembler::Label label)
+    {
+        m_endOfMainPath = label;
+    }
+    void setEndOfCode(MacroAssembler::Label label)
+    {
+        m_endOfCode = label;
+    }
+    
+    void dump(PrintStream&, LinkBuffer&);
+    void dump(LinkBuffer&);
+    void reportToProfiler(Profiler::Compilation*, LinkBuffer&);
+    
+private:
+    void dumpHeader(PrintStream&, LinkBuffer&);
+    
+    struct DumpedOp {
+        DumpedOp(CodeOrigin codeOrigin, CString text)
+            : codeOrigin(codeOrigin)
+            , text(text)
+        {
+        }
+        
+        CodeOrigin codeOrigin;
+        CString text;
+    };
+    void append(Vector<DumpedOp>&, StringPrintStream&, CodeOrigin&);
+    Vector<DumpedOp> createDumpList(LinkBuffer&);
+    
+    void dumpDisassembly(PrintStream&, const char* prefix, LinkBuffer&, MacroAssembler::Label& previousLabel, MacroAssembler::Label currentLabel, Node* context);
+    
+    Graph& m_graph;
+    DumpContext m_dumpContext;
+    MacroAssembler::Label m_startOfCode;
+    Vector<MacroAssembler::Label> m_labelForBlockIndex;
+    HashMap<Node*, MacroAssembler::Label> m_labelForNode;
+    MacroAssembler::Label m_endOfMainPath;
+    MacroAssembler::Label m_endOfCode;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDoesGC.cpp b/dfg/DFGDoesGC.cpp
new file mode 100644
index 0000000..cdc0406
--- /dev/null
+++ b/dfg/DFGDoesGC.cpp
@@ -0,0 +1,329 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGDoesGC.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGClobberize.h"
+#include "DFGGraph.h"
+#include "DFGNode.h"
+#include "Operations.h"
+
+namespace JSC { namespace DFG {
+
+bool doesGC(Graph& graph, Node* node)
+{
+    if (clobbersHeap(graph, node))
+        return true;
+    
+    // Now consider nodes that don't clobber the world but that still may GC. This includes all
+    // nodes. By convention we put world-clobbering nodes in the block of "false" cases but we can
+    // put them anywhere.
+    switch (node->op()) {
+    case JSConstant:
+    case DoubleConstant:
+    case Int52Constant:
+    case LazyJSConstant:
+    case Identity:
+    case GetCallee:
+    case GetArgumentCountIncludingThis:
+    case GetRestLength:
+    case GetLocal:
+    case SetLocal:
+    case MovHint:
+    case ZombieHint:
+    case ExitOK:
+    case Phantom:
+    case Upsilon:
+    case Phi:
+    case Flush:
+    case PhantomLocal:
+    case GetLocalUnlinked:
+    case SetArgument:
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case BitLShift:
+    case BitRShift:
+    case BitURShift:
+    case ValueToInt32:
+    case UInt32ToNumber:
+    case DoubleAsInt32:
+    case ArithAdd:
+    case ArithClz32:
+    case ArithSub:
+    case ArithNegate:
+    case ArithMul:
+    case ArithIMul:
+    case ArithDiv:
+    case ArithMod:
+    case ArithAbs:
+    case ArithMin:
+    case ArithMax:
+    case ArithPow:
+    case ArithSqrt:
+    case ArithRandom:
+    case ArithRound:
+    case ArithFloor:
+    case ArithCeil:
+    case ArithTrunc:
+    case ArithFRound:
+    case ArithSin:
+    case ArithCos:
+    case ArithTan:
+    case ArithLog:
+    case ValueAdd:
+    case TryGetById:
+    case GetById:
+    case GetByIdFlush:
+    case GetByIdWithThis:
+    case PutById:
+    case PutByIdFlush:
+    case PutByIdWithThis:
+    case PutByValWithThis:
+    case PutByIdDirect:
+    case PutGetterById:
+    case PutSetterById:
+    case PutGetterSetterById:
+    case PutGetterByVal:
+    case PutSetterByVal:
+    case DefineDataProperty:
+    case DefineAccessorProperty:
+    case DeleteById:
+    case DeleteByVal:
+    case CheckStructure:
+    case GetExecutable:
+    case GetButterfly:
+    case CheckDOM:
+    case CheckArray:
+    case GetScope:
+    case SkipScope:
+    case GetGlobalObject:
+    case GetClosureVar:
+    case PutClosureVar:
+    case GetRegExpObjectLastIndex:
+    case SetRegExpObjectLastIndex:
+    case RecordRegExpCachedResult:
+    case GetGlobalVar:
+    case GetGlobalLexicalVariable:
+    case PutGlobalVariable:
+    case CheckCell:
+    case CheckNotEmpty:
+    case CheckStringIdent:
+    case RegExpExec:
+    case RegExpTest:
+    case CompareLess:
+    case CompareLessEq:
+    case CompareGreater:
+    case CompareGreaterEq:
+    case CompareEq:
+    case CompareStrictEq:
+    case CompareEqPtr:
+    case Call:
+    case DirectCall:
+    case TailCallInlinedCaller:
+    case DirectTailCallInlinedCaller:
+    case Construct:
+    case DirectConstruct:
+    case CallVarargs:
+    case CallEval:
+    case TailCallVarargsInlinedCaller:
+    case ConstructVarargs:
+    case LoadVarargs:
+    case CallForwardVarargs:
+    case ConstructForwardVarargs:
+    case TailCallForwardVarargs:
+    case TailCallForwardVarargsInlinedCaller:
+    case ProfileType:
+    case ProfileControlFlow:
+    case OverridesHasInstance:
+    case InstanceOf:
+    case InstanceOfCustom:
+    case IsEmpty:
+    case IsUndefined:
+    case IsBoolean:
+    case IsNumber:
+    case IsObject:
+    case IsObjectOrNull:
+    case IsFunction:
+    case IsCellWithType:
+    case IsTypedArrayView:
+    case TypeOf:
+    case LogicalNot:
+    case ToPrimitive:
+    case ToNumber:
+    case ToString:
+    case CallStringConstructor:
+    case In:
+    case HasOwnProperty:
+    case Jump:
+    case Branch:
+    case Switch:
+    case Return:
+    case TailCall:
+    case DirectTailCall:
+    case TailCallVarargs:
+    case Throw:
+    case CountExecution:
+    case ForceOSRExit:
+    case CheckWatchdogTimer:
+    case StringFromCharCode:
+    case MapHash:
+    case GetMapBucket:
+    case LoadFromJSMapBucket:
+    case IsNonEmptyMapBucket:
+    case Unreachable:
+    case ExtractOSREntryLocal:
+    case CheckTierUpInLoop:
+    case CheckTierUpAtReturn:
+    case CheckTierUpAndOSREnter:
+    case LoopHint:
+    case StoreBarrier:
+    case FencedStoreBarrier:
+    case InvalidationPoint:
+    case NotifyWrite:
+    case CheckInBounds:
+    case ConstantStoragePointer:
+    case Check:
+    case CheckTypeInfoFlags:
+    case MultiGetByOffset:
+    case ValueRep:
+    case DoubleRep:
+    case Int52Rep:
+    case GetGetter:
+    case GetSetter:
+    case GetByVal:
+    case GetByValWithThis:
+    case GetIndexedPropertyStorage:
+    case GetArrayLength:
+    case ArrayPush:
+    case ArrayPop:
+    case StringCharAt:
+    case StringCharCodeAt:
+    case GetTypedArrayByteOffset:
+    case PutByValDirect:
+    case PutByVal:
+    case PutByValAlias:
+    case PutStructure:
+    case GetByOffset:
+    case GetGetterSetterByOffset:
+    case PutByOffset:
+    case GetEnumerableLength:
+    case HasGenericProperty:
+    case HasStructureProperty:
+    case HasIndexedProperty:
+    case GetDirectPname:
+    case FiatInt52:
+    case BooleanToNumber:
+    case CheckBadCell:
+    case BottomValue:
+    case PhantomNewObject:
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomCreateActivation:
+    case PhantomDirectArguments:
+    case PhantomCreateRest:
+    case PhantomNewArrayWithSpread:
+    case PhantomSpread:
+    case PhantomClonedArguments:
+    case GetMyArgumentByVal:
+    case GetMyArgumentByValOutOfBounds:
+    case ForwardVarargs:
+    case PutHint:
+    case CheckStructureImmediate:
+    case PutStack:
+    case KillStack:
+    case GetStack:
+    case GetFromArguments:
+    case PutToArguments:
+    case GetArgument:
+    case LogShadowChickenPrologue:
+    case LogShadowChickenTail:
+    case GetDynamicVar:
+    case PutDynamicVar:
+    case ResolveScope:
+    case NukeStructureAndSetButterfly:
+        return false;
+
+    case CreateActivation:
+    case CreateDirectArguments:
+    case CreateScopedArguments:
+    case CreateClonedArguments:
+    case CallObjectConstructor:
+    case ToThis:
+    case CreateThis:
+    case AllocatePropertyStorage:
+    case ReallocatePropertyStorage:
+    case Arrayify:
+    case ArrayifyToStructure:
+    case NewObject:
+    case NewArray:
+    case NewArrayWithSpread:
+    case Spread:
+    case NewArrayWithSize:
+    case NewArrayBuffer:
+    case NewRegexp:
+    case NewStringObject:
+    case MakeRope:
+    case NewFunction:
+    case NewGeneratorFunction:
+    case NewAsyncFunction:
+    case NewTypedArray:
+    case ThrowStaticError:
+    case GetPropertyEnumerator:
+    case GetEnumeratorStructurePname:
+    case GetEnumeratorGenericPname:
+    case ToIndexString:
+    case MaterializeNewObject:
+    case MaterializeCreateActivation:
+    case SetFunctionName:
+    case StrCat:
+    case StringReplace:
+    case StringReplaceRegExp:
+    case CreateRest:
+    case ToLowerCase:
+    case CallDOMGetter:
+    case CallDOM:
+    case ArraySlice:
+        return true;
+        
+    case MultiPutByOffset:
+        return node->multiPutByOffsetData().reallocatesStorage();
+
+    case LastNodeType:
+        RELEASE_ASSERT_NOT_REACHED();
+        return true;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return true;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDoesGC.h b/dfg/DFGDoesGC.h
new file mode 100644
index 0000000..7f3b311
--- /dev/null
+++ b/dfg/DFGDoesGC.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+struct Node;
+
+bool doesGC(Graph&, Node*);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDominators.h b/dfg/DFGDominators.h
new file mode 100644
index 0000000..5d266f5
--- /dev/null
+++ b/dfg/DFGDominators.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2011, 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include "DFGBlockMap.h"
+#include "DFGBlockSet.h"
+#include "DFGCFG.h"
+#include "DFGCommon.h"
+#include "DFGGraph.h"
+#include <wtf/Dominators.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace DFG {
+
+class Dominators : public WTF::Dominators<CFG> {
+    WTF_MAKE_NONCOPYABLE(Dominators);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    Dominators(Graph& graph)
+        : WTF::Dominators<CFG>(*graph.m_cfg)
+    {
+    }
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGDoubleFormatState.h b/dfg/DFGDoubleFormatState.h
new file mode 100644
index 0000000..be935a0
--- /dev/null
+++ b/dfg/DFGDoubleFormatState.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC { namespace DFG {
+
+enum DoubleFormatState {
+    EmptyDoubleFormatState, // bottom
+    UsingDoubleFormat,
+    NotUsingDoubleFormat,
+    CantUseDoubleFormat // top
+};
+
+inline DoubleFormatState mergeDoubleFormatStates(DoubleFormatState a, DoubleFormatState b)
+{
+    switch (a) {
+    case EmptyDoubleFormatState:
+        return b;
+    case UsingDoubleFormat:
+        switch (b) {
+        case EmptyDoubleFormatState:
+        case UsingDoubleFormat:
+            return UsingDoubleFormat;
+        case NotUsingDoubleFormat:
+        case CantUseDoubleFormat:
+            return CantUseDoubleFormat;
+        }
+    case NotUsingDoubleFormat:
+        switch (b) {
+        case EmptyDoubleFormatState:
+        case NotUsingDoubleFormat:
+            return NotUsingDoubleFormat;
+        case UsingDoubleFormat:
+        case CantUseDoubleFormat:
+            return CantUseDoubleFormat;
+        }
+    case CantUseDoubleFormat:
+        return CantUseDoubleFormat;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return CantUseDoubleFormat;
+}
+
+inline bool mergeDoubleFormatState(DoubleFormatState& dest, DoubleFormatState src)
+{
+    DoubleFormatState newState = mergeDoubleFormatStates(dest, src);
+    if (newState == dest)
+        return false;
+    dest = newState;
+    return true;
+}
+
+inline const char* doubleFormatStateToString(DoubleFormatState state)
+{
+    switch (state) {
+    case EmptyDoubleFormatState:
+        return "Empty";
+    case UsingDoubleFormat:
+        return "DoubleFormat";
+    case NotUsingDoubleFormat:
+        return "ValueFormat";
+    case CantUseDoubleFormat:
+        return "ForceValue";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGDriver.cpp b/dfg/DFGDriver.cpp
new file mode 100644
index 0000000..14cd0d0
--- /dev/null
+++ b/dfg/DFGDriver.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2011-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGDriver.h"
+
+#include "JSObject.h"
+#include "JSString.h"
+
+#include "CodeBlock.h"
+#include "DFGJITCode.h"
+#include "DFGPlan.h"
+#include "DFGThunks.h"
+#include "DFGWorklist.h"
+#include "FunctionWhitelist.h"
+#include "JITCode.h"
+#include "JSCInlines.h"
+#include "Options.h"
+#include "TypeProfilerLog.h"
+#include <wtf/Atomics.h>
+#include <wtf/NeverDestroyed.h>
+
+#if ENABLE(FTL_JIT)
+#include "FTLThunks.h"
+#endif
+
+namespace JSC { namespace DFG {
+
+static unsigned numCompilations;
+
+unsigned getNumCompilations()
+{
+    return numCompilations;
+}
+
+#if ENABLE(DFG_JIT)
+static FunctionWhitelist& ensureGlobalDFGWhitelist()
+{
+    static LazyNeverDestroyed<FunctionWhitelist> dfgWhitelist;
+    static std::once_flag initializeWhitelistFlag;
+    std::call_once(initializeWhitelistFlag, [] {
+        const char* functionWhitelistFile = Options::dfgWhitelist();
+        dfgWhitelist.construct(functionWhitelistFile);
+    });
+    return dfgWhitelist;
+}
+
+static CompilationResult compileImpl(
+    VM& vm, CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationMode mode,
+    unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues,
+    PassRefPtr<DeferredCompilationCallback> callback)
+{
+    if (!Options::bytecodeRangeToDFGCompile().isInRange(codeBlock->instructionCount())
+        || !ensureGlobalDFGWhitelist().contains(codeBlock))
+        return CompilationFailed;
+    
+    numCompilations++;
+    
+    ASSERT(codeBlock);
+    ASSERT(codeBlock->alternative());
+    ASSERT(codeBlock->alternative()->jitType() == JITCode::BaselineJIT);
+    ASSERT(!profiledDFGCodeBlock || profiledDFGCodeBlock->jitType() == JITCode::DFGJIT);
+    
+    if (logCompilationChanges(mode))
+        dataLog("DFG(Driver) compiling ", *codeBlock, " with ", mode, ", number of instructions = ", codeBlock->instructionCount(), "\n");
+    
+    // Make sure that any stubs that the DFG is going to use are initialized. We want to
+    // make sure that all JIT code generation does finalization on the main thread.
+    vm.getCTIStub(osrExitGenerationThunkGenerator);
+    vm.getCTIStub(throwExceptionFromCallSlowPathGenerator);
+    vm.getCTIStub(linkCallThunkGenerator);
+    vm.getCTIStub(linkPolymorphicCallThunkGenerator);
+    
+    if (vm.typeProfiler())
+        vm.typeProfilerLog()->processLogEntries(ASCIILiteral("Preparing for DFG compilation."));
+    
+    RefPtr<Plan> plan = adoptRef(
+        new Plan(codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues));
+    
+    plan->callback = callback;
+    if (Options::useConcurrentJIT()) {
+        Worklist& worklist = ensureGlobalWorklistFor(mode);
+        if (logCompilationChanges(mode))
+            dataLog("Deferring DFG compilation of ", *codeBlock, " with queue length ", worklist.queueLength(), ".\n");
+        worklist.enqueue(plan);
+        return CompilationDeferred;
+    }
+    
+    plan->compileInThread(*vm.dfgState, 0);
+    return plan->finalizeWithoutNotifyingCallback();
+}
+#else // ENABLE(DFG_JIT)
+static CompilationResult compileImpl(
+    VM&, CodeBlock*, CodeBlock*, CompilationMode, unsigned, const Operands<JSValue>&,
+    PassRefPtr<DeferredCompilationCallback>)
+{
+    return CompilationFailed;
+}
+#endif // ENABLE(DFG_JIT)
+
+CompilationResult compile(
+    VM& vm, CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationMode mode,
+    unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues,
+    PassRefPtr<DeferredCompilationCallback> passedCallback)
+{
+    RefPtr<DeferredCompilationCallback> callback = passedCallback;
+    CompilationResult result = compileImpl(
+        vm, codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues,
+        callback);
+    if (result != CompilationDeferred)
+        callback->compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
+    return result;
+}
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGDriver.h b/dfg/DFGDriver.h
new file mode 100644
index 0000000..1d58d1a
--- /dev/null
+++ b/dfg/DFGDriver.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "DFGCompilationMode.h"
+#include "DFGPlan.h"
+
+namespace JSC {
+
+class CodeBlock;
+class JITCode;
+class MacroAssemblerCodePtr;
+class VM;
+
+namespace DFG {
+
+JS_EXPORT_PRIVATE unsigned getNumCompilations();
+
+// If the worklist is non-null, we do a concurrent compile. Otherwise we do a synchronous
+// compile. Even if we do a synchronous compile, we call the callback with the result.
+CompilationResult compile(
+    VM&, CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationMode,
+    unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues,
+    PassRefPtr<DeferredCompilationCallback>);
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGEdge.cpp b/dfg/DFGEdge.cpp
new file mode 100644
index 0000000..f4843a2
--- /dev/null
+++ b/dfg/DFGEdge.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGEdge.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNode.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void Edge::dump(PrintStream& out) const
+{
+    if (!isProved())
+        out.print("Check:");
+    out.print(useKind(), ":");
+    if (DFG::doesKill(killStatusUnchecked()))
+        out.print("Kill:");
+    out.print(node());
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGEdge.h b/dfg/DFGEdge.h
new file mode 100644
index 0000000..31aa2d5
--- /dev/null
+++ b/dfg/DFGEdge.h
@@ -0,0 +1,249 @@
+/*
+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGUseKind.h"
+
+namespace JSC { namespace DFG {
+
+class AdjacencyList;
+
+class Edge {
+public:
+    explicit Edge(Node* node = 0, UseKind useKind = UntypedUse, ProofStatus proofStatus = NeedsCheck, KillStatus killStatus = DoesNotKill)
+#if USE(JSVALUE64)
+        : m_encodedWord(makeWord(node, useKind, proofStatus, killStatus))
+#else
+        : m_node(node)
+        , m_encodedWord(makeWord(useKind, proofStatus, killStatus))
+#endif
+    {
+    }
+    
+#if USE(JSVALUE64)
+    Node* node() const { return bitwise_cast<Node*>(m_encodedWord >> shift()); }
+#else
+    Node* node() const { return m_node; }
+#endif
+
+    Node& operator*() const { return *node(); }
+    Node* operator->() const { return node(); }
+    
+    void setNode(Node* node)
+    {
+#if USE(JSVALUE64)
+        m_encodedWord = makeWord(node, useKind(), proofStatus(), killStatus());
+#else
+        m_node = node;
+#endif
+    }
+    
+    UseKind useKindUnchecked() const
+    {
+#if USE(JSVALUE64)
+        unsigned masked = m_encodedWord & (((1 << shift()) - 1));
+        unsigned shifted = masked >> 2;
+#else
+        unsigned shifted = static_cast<UseKind>(m_encodedWord) >> 2;
+#endif
+        ASSERT(shifted < static_cast<unsigned>(LastUseKind));
+        UseKind result = static_cast<UseKind>(shifted);
+        ASSERT(node() || result == UntypedUse);
+        return result;
+    }
+    UseKind useKind() const
+    {
+        ASSERT(node());
+        return useKindUnchecked();
+    }
+    void setUseKind(UseKind useKind)
+    {
+        ASSERT(node());
+#if USE(JSVALUE64)
+        m_encodedWord = makeWord(node(), useKind, proofStatus(), killStatus());
+#else
+        m_encodedWord = makeWord(useKind, proofStatus(), killStatus());
+#endif
+    }
+    
+    ProofStatus proofStatusUnchecked() const
+    {
+        return proofStatusForIsProved(m_encodedWord & 1);
+    }
+    ProofStatus proofStatus() const
+    {
+        ASSERT(node());
+        return proofStatusUnchecked();
+    }
+    void setProofStatus(ProofStatus proofStatus)
+    {
+        ASSERT(node());
+#if USE(JSVALUE64)
+        m_encodedWord = makeWord(node(), useKind(), proofStatus, killStatus());
+#else
+        m_encodedWord = makeWord(useKind(), proofStatus, killStatus());
+#endif
+    }
+    bool isProved() const
+    {
+        return proofStatus() == IsProved;
+    }
+    
+    bool willNotHaveCheck() const
+    {
+        return isProved() || shouldNotHaveTypeCheck(useKind());
+    }
+    bool willHaveCheck() const
+    {
+        return !willNotHaveCheck();
+    }
+    
+    KillStatus killStatusUnchecked() const
+    {
+        return killStatusForDoesKill(m_encodedWord & 2);
+    }
+    KillStatus killStatus() const
+    {
+        ASSERT(node());
+        return killStatusUnchecked();
+    }
+    void setKillStatus(KillStatus killStatus)
+    {
+        ASSERT(node());
+#if USE(JSVALUE64)
+        m_encodedWord = makeWord(node(), useKind(), proofStatus(), killStatus);
+#else
+        m_encodedWord = makeWord(useKind(), proofStatus(), killStatus);
+#endif
+    }
+    bool doesKill() const { return DFG::doesKill(killStatus()); }
+
+    bool isSet() const { return !!node(); }
+
+    Edge sanitized() const
+    {
+        Edge result = *this;
+#if USE(JSVALUE64)
+        result.m_encodedWord = makeWord(node(), useKindUnchecked(), NeedsCheck, DoesNotKill);
+#else
+        result.m_encodedWord = makeWord(useKindUnchecked(), NeedsCheck, DoesNotKill);
+#endif
+        return result;
+    }
+
+    bool operator!() const { return !isSet(); }
+    explicit operator bool() const { return isSet(); }
+    
+    bool operator==(Edge other) const
+    {
+#if USE(JSVALUE64)
+        return m_encodedWord == other.m_encodedWord;
+#else
+        return m_node == other.m_node && m_encodedWord == other.m_encodedWord;
+#endif
+    }
+    bool operator!=(Edge other) const
+    {
+        return !(*this == other);
+    }
+    
+    void dump(PrintStream&) const;
+    
+    unsigned hash() const
+    {
+#if USE(JSVALUE64)
+        return IntHash<uintptr_t>::hash(m_encodedWord);
+#else
+        return PtrHash<Node*>::hash(m_node) + m_encodedWord;
+#endif
+    }
+
+private:
+    friend class AdjacencyList;
+    
+#if USE(JSVALUE64)
+    static constexpr uint32_t shift() { return 8; }
+    
+    static uintptr_t makeWord(Node* node, UseKind useKind, ProofStatus proofStatus, KillStatus killStatus)
+    {
+        ASSERT(sizeof(node) == 8);
+        uintptr_t shiftedValue = bitwise_cast<uintptr_t>(node) << shift();
+        ASSERT((shiftedValue >> shift()) == bitwise_cast<uintptr_t>(node));
+        ASSERT(useKind >= 0 && useKind < LastUseKind);
+        static_assert((static_cast<uintptr_t>(LastUseKind) << 2) < (static_cast<uintptr_t>(1) << shift()), "We rely on this being true to not clobber the node pointer.");
+        uintptr_t result = shiftedValue | (static_cast<uintptr_t>(useKind) << 2) | (DFG::doesKill(killStatus) << 1) | static_cast<uintptr_t>(DFG::isProved(proofStatus));
+        if (!ASSERT_DISABLED) {
+            union U {
+                U() { word = 0; }
+                uintptr_t word;
+                Edge edge;
+            } u;
+            u.word = result;
+            ASSERT(u.edge.useKindUnchecked() == useKind);
+            ASSERT(u.edge.node() == node);
+            ASSERT(u.edge.proofStatusUnchecked() == proofStatus);
+            ASSERT(u.edge.killStatusUnchecked() == killStatus);
+        }
+        return result;
+    }
+    
+#else
+    static uintptr_t makeWord(UseKind useKind, ProofStatus proofStatus, KillStatus killStatus)
+    {
+        return (static_cast<uintptr_t>(useKind) << 2) | (DFG::doesKill(killStatus) << 1) | static_cast<uintptr_t>(DFG::isProved(proofStatus));
+    }
+    
+    Node* m_node;
+#endif
+    // On 64-bit this holds both the pointer and the use kind, while on 32-bit
+    // this just holds the use kind. In both cases this may be hijacked by
+    // AdjacencyList for storing firstChild and numChildren.
+    uintptr_t m_encodedWord;
+};
+
+inline bool operator==(Edge edge, Node* node)
+{
+    return edge.node() == node;
+}
+inline bool operator==(Node* node, Edge edge)
+{
+    return edge.node() == node;
+}
+inline bool operator!=(Edge edge, Node* node)
+{
+    return edge.node() != node;
+}
+inline bool operator!=(Node* node, Edge edge)
+{
+    return edge.node() != node;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGEdgeDominates.h b/dfg/DFGEdgeDominates.h
new file mode 100644
index 0000000..f32560c
--- /dev/null
+++ b/dfg/DFGEdgeDominates.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGDominators.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+class EdgeDominates {
+    static const bool verbose = false;
+    
+public:
+    EdgeDominates(Graph& graph, BasicBlock* block)
+        : m_graph(graph)
+        , m_block(block)
+        , m_result(true)
+    {
+    }
+    
+    void operator()(Node*, Edge edge)
+    {
+        bool result = m_graph.m_dominators->dominates(edge.node()->owner, m_block);
+        if (verbose) {
+            dataLog(
+                "Checking if ", edge, " in ", *edge.node()->owner,
+                " dominates ", *m_block, ": ", result, "\n");
+        }
+        m_result &= result;
+    }
+    
+    bool result() const { return m_result; }
+
+private:
+    Graph& m_graph;
+    BasicBlock* m_block;
+    bool m_result;
+};
+
+inline bool edgesDominate(Graph& graph, Node* node, BasicBlock* block)
+{
+    EdgeDominates edgeDominates(graph, block);
+    DFG_NODE_DO_TO_CHILDREN(graph, node, edgeDominates);
+    return edgeDominates.result();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGEdgeUsesStructure.h b/dfg/DFGEdgeUsesStructure.h
new file mode 100644
index 0000000..7307512
--- /dev/null
+++ b/dfg/DFGEdgeUsesStructure.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+class EdgeUsesStructure {
+public:
+    EdgeUsesStructure()
+        : m_result(false)
+    {
+    }
+    
+    void operator()(Node*, Edge edge)
+    {
+        m_result |= usesStructure(edge.useKind());
+    }
+    
+    bool result() const { return m_result; }
+    
+private:
+    bool m_result;
+};
+
+inline bool edgesUseStructure(Graph& graph, Node* node)
+{
+    EdgeUsesStructure edgeUsesStructure;
+    DFG_NODE_DO_TO_CHILDREN(graph, node, edgeUsesStructure);
+    return edgeUsesStructure.result();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGEpoch.cpp b/dfg/DFGEpoch.cpp
new file mode 100644
index 0000000..7da1deb
--- /dev/null
+++ b/dfg/DFGEpoch.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGEpoch.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void Epoch::dump(PrintStream& out) const
+{
+    if (!*this)
+        out.print("none");
+    else
+        out.print(m_epoch);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGEpoch.h b/dfg/DFGEpoch.h
new file mode 100644
index 0000000..aab4906
--- /dev/null
+++ b/dfg/DFGEpoch.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+// Utility class for epoch-based analyses.
+
+class Epoch {
+public:
+    Epoch()
+        : m_epoch(s_none)
+    {
+    }
+    
+    static Epoch fromUnsigned(unsigned value)
+    {
+        Epoch result;
+        result.m_epoch = value;
+        return result;
+    }
+    
+    unsigned toUnsigned() const
+    {
+        return m_epoch;
+    }
+    
+    static Epoch first()
+    {
+        Epoch result;
+        result.m_epoch = s_first;
+        return result;
+    }
+    
+    bool operator!() const
+    {
+        return m_epoch == s_none;
+    }
+    
+    Epoch next() const
+    {
+        Epoch result;
+        result.m_epoch = m_epoch + 1;
+        return result;
+    }
+    
+    void bump()
+    {
+        *this = next();
+    }
+    
+    bool operator==(const Epoch& other) const
+    {
+        return m_epoch == other.m_epoch;
+    }
+    
+    bool operator!=(const Epoch& other) const
+    {
+        return !(*this == other);
+    }
+    
+    bool operator<(const Epoch& other) const
+    {
+        return m_epoch < other.m_epoch;
+    }
+    
+    bool operator>(const Epoch& other) const
+    {
+        return other < *this;
+    }
+    
+    bool operator<=(const Epoch& other) const
+    {
+        return !(*this > other);
+    }
+    
+    bool operator>=(const Epoch& other) const
+    {
+        return !(*this < other);
+    }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    static const unsigned s_none = 0;
+    static const unsigned s_first = 1;
+    
+    unsigned m_epoch;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGFailedFinalizer.cpp b/dfg/DFGFailedFinalizer.cpp
new file mode 100644
index 0000000..d2562a8
--- /dev/null
+++ b/dfg/DFGFailedFinalizer.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGFailedFinalizer.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+FailedFinalizer::FailedFinalizer(Plan& plan)
+    : Finalizer(plan)
+{
+}
+
+FailedFinalizer::~FailedFinalizer()
+{
+}
+
+size_t FailedFinalizer::codeSize()
+{
+    return 0;
+}
+
+bool FailedFinalizer::finalize()
+{
+    return false;
+}
+
+bool FailedFinalizer::finalizeFunction()
+{
+    return false;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGFailedFinalizer.h b/dfg/DFGFailedFinalizer.h
new file mode 100644
index 0000000..f143ccc
--- /dev/null
+++ b/dfg/DFGFailedFinalizer.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGFinalizer.h"
+
+namespace JSC { namespace DFG {
+
+class FailedFinalizer : public Finalizer {
+public:
+    FailedFinalizer(Plan&);
+    virtual ~FailedFinalizer();
+    
+    size_t codeSize() override;
+    bool finalize() override;
+    bool finalizeFunction() override;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGFiltrationResult.h b/dfg/DFGFiltrationResult.h
new file mode 100644
index 0000000..20d8195
--- /dev/null
+++ b/dfg/DFGFiltrationResult.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+// Tells you if an operation that filters type (i.e. does a type check/speculation) will always
+// exit. Formally, this means that the proven type of a value prior to the filter was not
+// bottom (i.e. not "clear" or "SpecEmpty") but becomes bottom as a result of executing the
+// filter.
+//
+// Note that per this definition, a filter will not return Contradiction if the node's proven
+// type was already bottom. This is necessary because we have this yucky convention of using
+// a proven type of bottom for nodes that don't hold JS values, like Phi nodes in ThreadedCPS
+// and storage nodes.
+enum FiltrationResult {
+    // Means that this operation may not always exit.
+    FiltrationOK,
+    
+    // Means that this operation will always exit.
+    Contradiction
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGFinalizer.cpp b/dfg/DFGFinalizer.cpp
new file mode 100644
index 0000000..4e74d7c
--- /dev/null
+++ b/dfg/DFGFinalizer.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGFinalizer.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGPlan.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+Finalizer::Finalizer(Plan& plan)
+    : m_plan(plan)
+{
+}
+
+Finalizer::~Finalizer()
+{
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGFinalizer.h b/dfg/DFGFinalizer.h
new file mode 100644
index 0000000..44a4c56
--- /dev/null
+++ b/dfg/DFGFinalizer.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "JITCode.h"
+#include "MacroAssemblerCodeRef.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+
+namespace JSC { namespace DFG {
+
+struct Plan;
+
+class Finalizer {
+    WTF_MAKE_NONCOPYABLE(Finalizer); WTF_MAKE_FAST_ALLOCATED;
+public:
+    Finalizer(Plan&);
+    virtual ~Finalizer();
+    
+    virtual size_t codeSize() = 0;
+    virtual bool finalize() = 0;
+    virtual bool finalizeFunction() = 0;
+
+protected:
+    Plan& m_plan;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGFixupPhase.cpp b/dfg/DFGFixupPhase.cpp
new file mode 100644
index 0000000..4b05bb3
--- /dev/null
+++ b/dfg/DFGFixupPhase.cpp
@@ -0,0 +1,3047 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGFixupPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayPrototype.h"
+#include "DFGGraph.h"
+#include "DFGInferredTypeCheck.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+#include "TypeLocation.h"
+
+namespace JSC { namespace DFG {
+
+class FixupPhase : public Phase {
+public:
+    FixupPhase(Graph& graph)
+        : Phase(graph, "fixup")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_fixpointState == BeforeFixpoint);
+        ASSERT(m_graph.m_form == ThreadedCPS);
+        
+        m_profitabilityChanged = false;
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
+            fixupBlock(m_graph.block(blockIndex));
+        
+        while (m_profitabilityChanged) {
+            m_profitabilityChanged = false;
+            
+            for (unsigned i = m_graph.m_argumentPositions.size(); i--;)
+                m_graph.m_argumentPositions[i].mergeArgumentUnboxingAwareness();
+            
+            for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
+                fixupGetAndSetLocalsInBlock(m_graph.block(blockIndex));
+        }
+        
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
+            fixupChecksInBlock(m_graph.block(blockIndex));
+
+        m_graph.m_planStage = PlanStage::AfterFixup;
+
+        return true;
+    }
+
+private:
+    void fixupBlock(BasicBlock* block)
+    {
+        if (!block)
+            return;
+        ASSERT(block->isReachable);
+        m_block = block;
+        for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
+            m_currentNode = block->at(m_indexInBlock);
+            fixupNode(m_currentNode);
+        }
+        m_insertionSet.execute(block);
+    }
+    
+    void fixupNode(Node* node)
+    {
+        NodeType op = node->op();
+
+        switch (op) {
+        case SetLocal: {
+            // This gets handled by fixupGetAndSetLocalsInBlock().
+            return;
+        }
+            
+        case BitAnd:
+        case BitOr:
+        case BitXor:
+        case BitRShift:
+        case BitLShift:
+        case BitURShift: {
+            if (Node::shouldSpeculateUntypedForBitOps(node->child1().node(), node->child2().node())) {
+                fixEdge<UntypedUse>(node->child1());
+                fixEdge<UntypedUse>(node->child2());
+                break;
+            }
+            fixIntConvertingEdge(node->child1());
+            fixIntConvertingEdge(node->child2());
+            break;
+        }
+
+        case ArithIMul: {
+            fixIntConvertingEdge(node->child1());
+            fixIntConvertingEdge(node->child2());
+            node->setOp(ArithMul);
+            node->setArithMode(Arith::Unchecked);
+            node->child1().setUseKind(Int32Use);
+            node->child2().setUseKind(Int32Use);
+            break;
+        }
+
+        case ArithClz32: {
+            if (node->child1()->shouldSpeculateNotCell()) {
+                fixIntConvertingEdge(node->child1());
+                node->clearFlags(NodeMustGenerate);
+            } else
+                fixEdge<UntypedUse>(node->child1());
+            break;
+        }
+            
+        case UInt32ToNumber: {
+            fixIntConvertingEdge(node->child1());
+            if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
+                node->convertToIdentity();
+            else if (node->canSpeculateInt32(FixupPass))
+                node->setArithMode(Arith::CheckOverflow);
+            else {
+                node->setArithMode(Arith::DoOverflow);
+                node->clearFlags(NodeMustGenerate);
+                node->setResult(enableInt52() ? NodeResultInt52 : NodeResultDouble);
+            }
+            break;
+        }
+            
+        case ValueAdd: {
+            if (attemptToMakeIntegerAdd(node)) {
+                node->setOp(ArithAdd);
+                break;
+            }
+            if (Node::shouldSpeculateNumberOrBooleanExpectingDefined(node->child1().node(), node->child2().node())) {
+                fixDoubleOrBooleanEdge(node->child1());
+                fixDoubleOrBooleanEdge(node->child2());
+                node->setOp(ArithAdd);
+                node->setResult(NodeResultDouble);
+                break;
+            }
+            
+            if (attemptToMakeFastStringAdd(node))
+                break;
+
+            fixEdge<UntypedUse>(node->child1());
+            fixEdge<UntypedUse>(node->child2());
+            node->setResult(NodeResultJS);
+            break;
+        }
+
+        case StrCat: {
+            if (attemptToMakeFastStringAdd(node))
+                break;
+
+            // FIXME: Remove empty string arguments and possibly turn this into a ToString operation. That
+            // would require a form of ToString that takes a KnownPrimitiveUse. This is necessary because
+            // the implementation of StrCat doesn't dynamically optimize for empty strings.
+            // https://bugs.webkit.org/show_bug.cgi?id=148540
+            m_graph.doToChildren(
+                node,
+                [&] (Edge& edge) {
+                    fixEdge<KnownPrimitiveUse>(edge);
+                });
+            break;
+        }
+            
+        case MakeRope: {
+            fixupMakeRope(node);
+            break;
+        }
+            
+        case ArithAdd:
+        case ArithSub: {
+            if (op == ArithSub
+                && Node::shouldSpeculateUntypedForArithmetic(node->child1().node(), node->child2().node())) {
+                fixEdge<UntypedUse>(node->child1());
+                fixEdge<UntypedUse>(node->child2());
+                node->setResult(NodeResultJS);
+                break;
+            }
+            if (attemptToMakeIntegerAdd(node))
+                break;
+            fixDoubleOrBooleanEdge(node->child1());
+            fixDoubleOrBooleanEdge(node->child2());
+            node->setResult(NodeResultDouble);
+            break;
+        }
+            
+        case ArithNegate: {
+            if (node->child1()->shouldSpeculateInt32OrBoolean() && node->canSpeculateInt32(FixupPass)) {
+                fixIntOrBooleanEdge(node->child1());
+                if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
+                    node->setArithMode(Arith::Unchecked);
+                else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
+                    node->setArithMode(Arith::CheckOverflow);
+                else
+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
+                node->setResult(NodeResultInt32);
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (m_graph.unaryArithShouldSpeculateAnyInt(node, FixupPass)) {
+                fixEdge<Int52RepUse>(node->child1());
+                if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
+                    node->setArithMode(Arith::CheckOverflow);
+                else
+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
+                node->setResult(NodeResultInt52);
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (node->child1()->shouldSpeculateNotCell()) {
+                fixDoubleOrBooleanEdge(node->child1());
+                node->setResult(NodeResultDouble);
+                node->clearFlags(NodeMustGenerate);
+            } else
+                fixEdge<UntypedUse>(node->child1());
+            break;
+        }
+            
+        case ArithMul: {
+            Edge& leftChild = node->child1();
+            Edge& rightChild = node->child2();
+            if (Node::shouldSpeculateUntypedForArithmetic(leftChild.node(), rightChild.node())) {
+                fixEdge<UntypedUse>(leftChild);
+                fixEdge<UntypedUse>(rightChild);
+                node->setResult(NodeResultJS);
+                break;
+            }
+            if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
+                fixIntOrBooleanEdge(leftChild);
+                fixIntOrBooleanEdge(rightChild);
+                if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
+                    node->setArithMode(Arith::Unchecked);
+                else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())
+                    || leftChild.node() == rightChild.node())
+                    node->setArithMode(Arith::CheckOverflow);
+                else
+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
+                break;
+            }
+            if (m_graph.binaryArithShouldSpeculateAnyInt(node, FixupPass)) {
+                fixEdge<Int52RepUse>(leftChild);
+                fixEdge<Int52RepUse>(rightChild);
+                if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())
+                    || leftChild.node() == rightChild.node())
+                    node->setArithMode(Arith::CheckOverflow);
+                else
+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
+                node->setResult(NodeResultInt52);
+                break;
+            }
+            fixDoubleOrBooleanEdge(leftChild);
+            fixDoubleOrBooleanEdge(rightChild);
+            node->setResult(NodeResultDouble);
+            break;
+        }
+
+        case ArithDiv:
+        case ArithMod: {
+            Edge& leftChild = node->child1();
+            Edge& rightChild = node->child2();
+            if (op == ArithDiv
+                && Node::shouldSpeculateUntypedForArithmetic(leftChild.node(), rightChild.node())
+                && m_graph.hasExitSite(node->origin.semantic, BadType)) {
+                fixEdge<UntypedUse>(leftChild);
+                fixEdge<UntypedUse>(rightChild);
+                node->setResult(NodeResultJS);
+                break;
+            }
+            if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
+                if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {
+                    fixIntOrBooleanEdge(leftChild);
+                    fixIntOrBooleanEdge(rightChild);
+                    if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
+                        node->setArithMode(Arith::Unchecked);
+                    else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
+                        node->setArithMode(Arith::CheckOverflow);
+                    else
+                        node->setArithMode(Arith::CheckOverflowAndNegativeZero);
+                    break;
+                }
+                
+                // This will cause conversion nodes to be inserted later.
+                fixDoubleOrBooleanEdge(leftChild);
+                fixDoubleOrBooleanEdge(rightChild);
+                
+                // We don't need to do ref'ing on the children because we're stealing them from
+                // the original division.
+                Node* newDivision = m_insertionSet.insertNode(
+                    m_indexInBlock, SpecBytecodeDouble, *node);
+                newDivision->setResult(NodeResultDouble);
+                
+                node->setOp(DoubleAsInt32);
+                node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
+                if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
+                    node->setArithMode(Arith::CheckOverflow);
+                else
+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
+                break;
+            }
+            fixDoubleOrBooleanEdge(leftChild);
+            fixDoubleOrBooleanEdge(rightChild);
+            node->setResult(NodeResultDouble);
+            break;
+        }
+            
+        case ArithMin:
+        case ArithMax: {
+            if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
+                fixIntOrBooleanEdge(node->child1());
+                fixIntOrBooleanEdge(node->child2());
+                break;
+            }
+            fixDoubleOrBooleanEdge(node->child1());
+            fixDoubleOrBooleanEdge(node->child2());
+            node->setResult(NodeResultDouble);
+            break;
+        }
+            
+        case ArithAbs: {
+            if (node->child1()->shouldSpeculateInt32OrBoolean()
+                && node->canSpeculateInt32(FixupPass)) {
+                fixIntOrBooleanEdge(node->child1());
+                if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
+                    node->setArithMode(Arith::Unchecked);
+                else
+                    node->setArithMode(Arith::CheckOverflow);
+                node->clearFlags(NodeMustGenerate);
+                node->setResult(NodeResultInt32);
+                break;
+            }
+
+            if (node->child1()->shouldSpeculateNotCell()) {
+                fixDoubleOrBooleanEdge(node->child1());
+                node->clearFlags(NodeMustGenerate);
+            } else
+                fixEdge<UntypedUse>(node->child1());
+            node->setResult(NodeResultDouble);
+            break;
+        }
+
+        case ArithPow: {
+            if (node->child2()->shouldSpeculateInt32OrBooleanForArithmetic()) {
+                fixDoubleOrBooleanEdge(node->child1());
+                fixIntOrBooleanEdge(node->child2());
+                break;
+            }
+
+            fixDoubleOrBooleanEdge(node->child1());
+            fixDoubleOrBooleanEdge(node->child2());
+            break;
+        }
+
+        case ArithRandom: {
+            node->setResult(NodeResultDouble);
+            break;
+        }
+
+        case ArithRound:
+        case ArithFloor:
+        case ArithCeil:
+        case ArithTrunc: {
+            if (node->child1()->shouldSpeculateInt32OrBoolean() && m_graph.roundShouldSpeculateInt32(node, FixupPass)) {
+                fixIntOrBooleanEdge(node->child1());
+                insertCheck<Int32Use>(node->child1().node());
+                node->convertToIdentity();
+                break;
+            }
+            if (node->child1()->shouldSpeculateNotCell()) {
+                fixDoubleOrBooleanEdge(node->child1());
+
+                if (isInt32OrBooleanSpeculation(node->getHeapPrediction()) && m_graph.roundShouldSpeculateInt32(node, FixupPass)) {
+                    node->setResult(NodeResultInt32);
+                    if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
+                        node->setArithRoundingMode(Arith::RoundingMode::Int32);
+                    else
+                        node->setArithRoundingMode(Arith::RoundingMode::Int32WithNegativeZeroCheck);
+                } else {
+                    node->setResult(NodeResultDouble);
+                    node->setArithRoundingMode(Arith::RoundingMode::Double);
+                }
+                node->clearFlags(NodeMustGenerate);
+            } else
+                fixEdge<UntypedUse>(node->child1());
+            break;
+        }
+
+        case ArithCos:
+        case ArithFRound:
+        case ArithLog:
+        case ArithSin:
+        case ArithSqrt:
+        case ArithTan: {
+            Edge& child1 = node->child1();
+            if (child1->shouldSpeculateNotCell()) {
+                fixDoubleOrBooleanEdge(child1);
+                node->clearFlags(NodeMustGenerate);
+            } else
+                fixEdge<UntypedUse>(child1);
+            break;
+        }
+            
+        case LogicalNot: {
+            if (node->child1()->shouldSpeculateBoolean()) {
+                if (node->child1()->result() == NodeResultBoolean) {
+                    // This is necessary in case we have a bytecode instruction implemented by:
+                    //
+                    // a: CompareEq(...)
+                    // b: LogicalNot(@a)
+                    //
+                    // In that case, CompareEq might have a side-effect. Then, we need to make
+                    // sure that we know that Branch does not exit.
+                    fixEdge<KnownBooleanUse>(node->child1());
+                } else
+                    fixEdge<BooleanUse>(node->child1());
+            } else if (node->child1()->shouldSpeculateObjectOrOther())
+                fixEdge<ObjectOrOtherUse>(node->child1());
+            else if (node->child1()->shouldSpeculateInt32OrBoolean())
+                fixIntOrBooleanEdge(node->child1());
+            else if (node->child1()->shouldSpeculateNumber())
+                fixEdge<DoubleRepUse>(node->child1());
+            else if (node->child1()->shouldSpeculateString())
+                fixEdge<StringUse>(node->child1());
+            else if (node->child1()->shouldSpeculateStringOrOther())
+                fixEdge<StringOrOtherUse>(node->child1());
+            else {
+                WatchpointSet* masqueradesAsUndefinedWatchpoint = m_graph.globalObjectFor(node->origin.semantic)->masqueradesAsUndefinedWatchpoint();
+                if (masqueradesAsUndefinedWatchpoint->isStillValid())
+                    m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);
+            }
+            break;
+        }
+
+        case CompareEq:
+        case CompareLess:
+        case CompareLessEq:
+        case CompareGreater:
+        case CompareGreaterEq: {
+            if (node->op() == CompareEq
+                && Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {
+                fixEdge<BooleanUse>(node->child1());
+                fixEdge<BooleanUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (Node::shouldSpeculateInt32OrBoolean(node->child1().node(), node->child2().node())) {
+                fixIntOrBooleanEdge(node->child1());
+                fixIntOrBooleanEdge(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (enableInt52()
+                && Node::shouldSpeculateAnyInt(node->child1().node(), node->child2().node())) {
+                fixEdge<Int52RepUse>(node->child1());
+                fixEdge<Int52RepUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (Node::shouldSpeculateNumberOrBoolean(node->child1().node(), node->child2().node())) {
+                fixDoubleOrBooleanEdge(node->child1());
+                fixDoubleOrBooleanEdge(node->child2());
+            }
+            if (node->op() != CompareEq
+                && node->child1()->shouldSpeculateNotCell()
+                && node->child2()->shouldSpeculateNotCell()) {
+                if (node->child1()->shouldSpeculateNumberOrBoolean())
+                    fixDoubleOrBooleanEdge(node->child1());
+                else
+                    fixEdge<DoubleRepUse>(node->child1());
+                if (node->child2()->shouldSpeculateNumberOrBoolean())
+                    fixDoubleOrBooleanEdge(node->child2());
+                else
+                    fixEdge<DoubleRepUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {
+                fixEdge<StringIdentUse>(node->child1());
+                fixEdge<StringIdentUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && GPRInfo::numberOfRegisters >= 7) {
+                fixEdge<StringUse>(node->child1());
+                fixEdge<StringUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+
+            if (node->op() != CompareEq)
+                break;
+            if (Node::shouldSpeculateSymbol(node->child1().node(), node->child2().node())) {
+                fixEdge<SymbolUse>(node->child1());
+                fixEdge<SymbolUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {
+                fixEdge<ObjectUse>(node->child1());
+                fixEdge<ObjectUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+
+            // If either child can be proved to be Null or Undefined, comparing them is greatly simplified.
+            bool oneArgumentIsUsedAsSpecOther = false;
+            if (node->child1()->isUndefinedOrNullConstant()) {
+                fixEdge<OtherUse>(node->child1());
+                oneArgumentIsUsedAsSpecOther = true;
+            } else if (node->child1()->shouldSpeculateOther()) {
+                m_insertionSet.insertNode(m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child1().node(), OtherUse));
+                fixEdge<OtherUse>(node->child1());
+                oneArgumentIsUsedAsSpecOther = true;
+            }
+            if (node->child2()->isUndefinedOrNullConstant()) {
+                fixEdge<OtherUse>(node->child2());
+                oneArgumentIsUsedAsSpecOther = true;
+            } else if (node->child2()->shouldSpeculateOther()) {
+                m_insertionSet.insertNode(m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child2().node(), OtherUse));
+                fixEdge<OtherUse>(node->child2());
+                oneArgumentIsUsedAsSpecOther = true;
+            }
+            if (oneArgumentIsUsedAsSpecOther) {
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+
+            if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther()) {
+                fixEdge<ObjectUse>(node->child1());
+                fixEdge<ObjectOrOtherUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            if (node->child1()->shouldSpeculateObjectOrOther() && node->child2()->shouldSpeculateObject()) {
+                fixEdge<ObjectOrOtherUse>(node->child1());
+                fixEdge<ObjectUse>(node->child2());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+
+            break;
+        }
+            
+        case CompareStrictEq: {
+            if (Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {
+                fixEdge<BooleanUse>(node->child1());
+                fixEdge<BooleanUse>(node->child2());
+                break;
+            }
+            if (Node::shouldSpeculateInt32(node->child1().node(), node->child2().node())) {
+                fixEdge<Int32Use>(node->child1());
+                fixEdge<Int32Use>(node->child2());
+                break;
+            }
+            if (enableInt52()
+                && Node::shouldSpeculateAnyInt(node->child1().node(), node->child2().node())) {
+                fixEdge<Int52RepUse>(node->child1());
+                fixEdge<Int52RepUse>(node->child2());
+                break;
+            }
+            if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {
+                fixEdge<DoubleRepUse>(node->child1());
+                fixEdge<DoubleRepUse>(node->child2());
+                break;
+            }
+            if (Node::shouldSpeculateSymbol(node->child1().node(), node->child2().node())) {
+                fixEdge<SymbolUse>(node->child1());
+                fixEdge<SymbolUse>(node->child2());
+                break;
+            }
+            if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {
+                fixEdge<StringIdentUse>(node->child1());
+                fixEdge<StringIdentUse>(node->child2());
+                break;
+            }
+            if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 7) || isFTL(m_graph.m_plan.mode))) {
+                fixEdge<StringUse>(node->child1());
+                fixEdge<StringUse>(node->child2());
+                break;
+            }
+            WatchpointSet* masqueradesAsUndefinedWatchpoint = m_graph.globalObjectFor(node->origin.semantic)->masqueradesAsUndefinedWatchpoint();
+            if (masqueradesAsUndefinedWatchpoint->isStillValid()) {
+                
+                if (node->child1()->shouldSpeculateObject()) {
+                    m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);
+                    fixEdge<ObjectUse>(node->child1());
+                    break;
+                }
+                if (node->child2()->shouldSpeculateObject()) {
+                    m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);
+                    fixEdge<ObjectUse>(node->child2());
+                    break;
+                }
+                
+            } else if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {
+                fixEdge<ObjectUse>(node->child1());
+                fixEdge<ObjectUse>(node->child2());
+                break;
+            }
+            if (node->child1()->shouldSpeculateSymbol()) {
+                fixEdge<SymbolUse>(node->child1());
+                break;
+            }
+            if (node->child2()->shouldSpeculateSymbol()) {
+                fixEdge<SymbolUse>(node->child2());
+                break;
+            }
+            if (node->child1()->shouldSpeculateMisc()) {
+                fixEdge<MiscUse>(node->child1());
+                break;
+            }
+            if (node->child2()->shouldSpeculateMisc()) {
+                fixEdge<MiscUse>(node->child2());
+                break;
+            }
+            if (node->child1()->shouldSpeculateStringIdent()
+                && node->child2()->shouldSpeculateNotStringVar()) {
+                fixEdge<StringIdentUse>(node->child1());
+                fixEdge<NotStringVarUse>(node->child2());
+                break;
+            }
+            if (node->child2()->shouldSpeculateStringIdent()
+                && node->child1()->shouldSpeculateNotStringVar()) {
+                fixEdge<StringIdentUse>(node->child2());
+                fixEdge<NotStringVarUse>(node->child1());
+                break;
+            }
+            if (node->child1()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 8) || isFTL(m_graph.m_plan.mode))) {
+                fixEdge<StringUse>(node->child1());
+                break;
+            }
+            if (node->child2()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 8) || isFTL(m_graph.m_plan.mode))) {
+                fixEdge<StringUse>(node->child2());
+                break;
+            }
+            break;
+        }
+            
+        case StringFromCharCode:
+            if (node->child1()->shouldSpeculateInt32())
+                fixEdge<Int32Use>(node->child1());
+            else
+                fixEdge<UntypedUse>(node->child1());
+            break;
+
+        case StringCharAt:
+        case StringCharCodeAt: {
+            // Currently we have no good way of refining these.
+            ASSERT(node->arrayMode() == ArrayMode(Array::String));
+            blessArrayOperation(node->child1(), node->child2(), node->child3());
+            fixEdge<KnownCellUse>(node->child1());
+            fixEdge<Int32Use>(node->child2());
+            break;
+        }
+
+        case GetByVal: {
+            if (!node->prediction()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, ForceOSRExit, node->origin);
+            }
+            
+            node->setArrayMode(
+                node->arrayMode().refine(
+                    m_graph, node,
+                    node->child1()->prediction(),
+                    node->child2()->prediction(),
+                    SpecNone));
+            
+            blessArrayOperation(node->child1(), node->child2(), node->child3());
+            
+            ArrayMode arrayMode = node->arrayMode();
+            switch (arrayMode.type()) {
+            case Array::Contiguous:
+            case Array::Double:
+                if (arrayMode.arrayClass() == Array::OriginalArray
+                    && arrayMode.speculation() == Array::InBounds) {
+                    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
+                    if (globalObject->arrayPrototypeChainIsSane()) {
+                        // Check if SaneChain will work on a per-type basis. Note that:
+                        //
+                        // 1) We don't want double arrays to sometimes return undefined, since
+                        // that would require a change to the return type and it would pessimise
+                        // things a lot. So, we'd only want to do that if we actually had
+                        // evidence that we could read from a hole. That's pretty annoying.
+                        // Likely the best way to handle that case is with an equivalent of
+                        // SaneChain for OutOfBounds. For now we just detect when Undefined and
+                        // NaN are indistinguishable according to backwards propagation, and just
+                        // use SaneChain in that case. This happens to catch a lot of cases.
+                        //
+                        // 2) We don't want int32 array loads to have to do a hole check just to
+                        // coerce to Undefined, since that would mean twice the checks.
+                        //
+                        // This has two implications. First, we have to do more checks than we'd
+                        // like. It's unfortunate that we have to do the hole check. Second,
+                        // some accesses that hit a hole will now need to take the full-blown
+                        // out-of-bounds slow path. We can fix that with:
+                        // https://bugs.webkit.org/show_bug.cgi?id=144668
+                        
+                        bool canDoSaneChain = false;
+                        switch (arrayMode.type()) {
+                        case Array::Contiguous:
+                            // This is happens to be entirely natural. We already would have
+                            // returned any JSValue, and now we'll return Undefined. We still do
+                            // the check but it doesn't require taking any kind of slow path.
+                            canDoSaneChain = true;
+                            break;
+                            
+                        case Array::Double:
+                            if (!(node->flags() & NodeBytecodeUsesAsOther)) {
+                                // Holes look like NaN already, so if the user doesn't care
+                                // about the difference between Undefined and NaN then we can
+                                // do this.
+                                canDoSaneChain = true;
+                            }
+                            break;
+                            
+                        default:
+                            break;
+                        }
+                        
+                        if (canDoSaneChain) {
+                            m_graph.watchpoints().addLazily(
+                                globalObject->arrayPrototype()->structure()->transitionWatchpointSet());
+                            m_graph.watchpoints().addLazily(
+                                globalObject->objectPrototype()->structure()->transitionWatchpointSet());
+                            if (globalObject->arrayPrototypeChainIsSane())
+                                node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));
+                        }
+                    }
+                }
+                break;
+                
+            case Array::String:
+                if ((node->prediction() & ~SpecString)
+                    || m_graph.hasExitSite(node->origin.semantic, OutOfBounds))
+                    node->setArrayMode(arrayMode.withSpeculation(Array::OutOfBounds));
+                break;
+                
+            default:
+                break;
+            }
+            
+            arrayMode = node->arrayMode();
+            switch (arrayMode.type()) {
+            case Array::SelectUsingPredictions:
+            case Array::Unprofiled:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            case Array::Generic:
+#if USE(JSVALUE32_64)
+                fixEdge<CellUse>(node->child1()); // Speculating cell due to register pressure on 32-bit.
+#endif
+                break;
+            case Array::ForceExit:
+                break;
+            default:
+                fixEdge<KnownCellUse>(node->child1());
+                fixEdge<Int32Use>(node->child2());
+                break;
+            }
+            
+            switch (arrayMode.type()) {
+            case Array::Double:
+                if (!arrayMode.isOutOfBounds())
+                    node->setResult(NodeResultDouble);
+                break;
+                
+            case Array::Float32Array:
+            case Array::Float64Array:
+                node->setResult(NodeResultDouble);
+                break;
+                
+            case Array::Uint32Array:
+                if (node->shouldSpeculateInt32())
+                    break;
+                if (node->shouldSpeculateAnyInt() && enableInt52())
+                    node->setResult(NodeResultInt52);
+                else
+                    node->setResult(NodeResultDouble);
+                break;
+                
+            default:
+                break;
+            }
+            
+            break;
+        }
+
+        case PutByValDirect:
+        case PutByVal:
+        case PutByValAlias: {
+            Edge& child1 = m_graph.varArgChild(node, 0);
+            Edge& child2 = m_graph.varArgChild(node, 1);
+            Edge& child3 = m_graph.varArgChild(node, 2);
+
+            node->setArrayMode(
+                node->arrayMode().refine(
+                    m_graph, node,
+                    child1->prediction(),
+                    child2->prediction(),
+                    child3->prediction()));
+            
+            blessArrayOperation(child1, child2, m_graph.varArgChild(node, 3));
+            
+            switch (node->arrayMode().modeForPut().type()) {
+            case Array::SelectUsingPredictions:
+            case Array::SelectUsingArguments:
+            case Array::Unprofiled:
+            case Array::Undecided:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            case Array::ForceExit:
+            case Array::Generic:
+#if USE(JSVALUE32_64)
+                // Due to register pressure on 32-bit, we speculate cell and
+                // ignore the base-is-not-cell case entirely by letting the
+                // baseline JIT handle it.
+                fixEdge<CellUse>(child1);
+#endif
+                break;
+            case Array::Int32:
+                fixEdge<KnownCellUse>(child1);
+                fixEdge<Int32Use>(child2);
+                fixEdge<Int32Use>(child3);
+                break;
+            case Array::Double:
+                fixEdge<KnownCellUse>(child1);
+                fixEdge<Int32Use>(child2);
+                fixEdge<DoubleRepRealUse>(child3);
+                break;
+            case Array::Int8Array:
+            case Array::Int16Array:
+            case Array::Int32Array:
+            case Array::Uint8Array:
+            case Array::Uint8ClampedArray:
+            case Array::Uint16Array:
+            case Array::Uint32Array:
+                fixEdge<KnownCellUse>(child1);
+                fixEdge<Int32Use>(child2);
+                if (child3->shouldSpeculateInt32())
+                    fixIntOrBooleanEdge(child3);
+                else if (child3->shouldSpeculateAnyInt())
+                    fixEdge<Int52RepUse>(child3);
+                else
+                    fixDoubleOrBooleanEdge(child3);
+                break;
+            case Array::Float32Array:
+            case Array::Float64Array:
+                fixEdge<KnownCellUse>(child1);
+                fixEdge<Int32Use>(child2);
+                fixDoubleOrBooleanEdge(child3);
+                break;
+            case Array::Contiguous:
+            case Array::ArrayStorage:
+            case Array::SlowPutArrayStorage:
+                fixEdge<KnownCellUse>(child1);
+                fixEdge<Int32Use>(child2);
+                speculateForBarrier(child3);
+                break;
+            default:
+                fixEdge<KnownCellUse>(child1);
+                fixEdge<Int32Use>(child2);
+                break;
+            }
+            break;
+        }
+            
+        case ArrayPush: {
+            // May need to refine the array mode in case the value prediction contravenes
+            // the array prediction. For example, we may have evidence showing that the
+            // array is in Int32 mode, but the value we're storing is likely to be a double.
+            // Then we should turn this into a conversion to Double array followed by the
+            // push. On the other hand, we absolutely don't want to refine based on the
+            // base prediction. If it has non-cell garbage in it, then we want that to be
+            // ignored. That's because ArrayPush can't handle any array modes that aren't
+            // array-related - so if refine() turned this into a "Generic" ArrayPush then
+            // that would break things.
+            node->setArrayMode(
+                node->arrayMode().refine(
+                    m_graph, node,
+                    node->child1()->prediction() & SpecCell,
+                    SpecInt32Only,
+                    node->child2()->prediction()));
+            blessArrayOperation(node->child1(), Edge(), node->child3());
+            fixEdge<KnownCellUse>(node->child1());
+            
+            switch (node->arrayMode().type()) {
+            case Array::Int32:
+                fixEdge<Int32Use>(node->child2());
+                break;
+            case Array::Double:
+                fixEdge<DoubleRepRealUse>(node->child2());
+                break;
+            case Array::Contiguous:
+            case Array::ArrayStorage:
+                speculateForBarrier(node->child2());
+                break;
+            default:
+                break;
+            }
+            break;
+        }
+            
+        case ArrayPop: {
+            blessArrayOperation(node->child1(), Edge(), node->child2());
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+
+        case ArraySlice: {
+            fixEdge<KnownCellUse>(m_graph.varArgChild(node, 0));
+            fixEdge<Int32Use>(m_graph.varArgChild(node, 1));
+            if (node->numChildren() == 4)
+                fixEdge<Int32Use>(m_graph.varArgChild(node, 2));
+            break;
+        }
+            
+        case RegExpExec:
+        case RegExpTest: {
+            fixEdge<KnownCellUse>(node->child1());
+            
+            if (node->child2()->shouldSpeculateRegExpObject()) {
+                fixEdge<RegExpObjectUse>(node->child2());
+
+                if (node->child3()->shouldSpeculateString())
+                    fixEdge<StringUse>(node->child3());
+            }
+            break;
+        }
+
+        case StringReplace:
+        case StringReplaceRegExp: {
+            if (node->child2()->shouldSpeculateString()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child2().node(), StringUse));
+                fixEdge<StringUse>(node->child2());
+            } else if (op == StringReplace) {
+                if (node->child2()->shouldSpeculateRegExpObject())
+                    addStringReplacePrimordialChecks(node->child2().node());
+                else 
+                    m_insertionSet.insertNode(
+                        m_indexInBlock, SpecNone, ForceOSRExit, node->origin);
+            }
+
+            if (node->child1()->shouldSpeculateString()
+                && node->child2()->shouldSpeculateRegExpObject()
+                && node->child3()->shouldSpeculateString()) {
+
+                fixEdge<StringUse>(node->child1());
+                fixEdge<RegExpObjectUse>(node->child2());
+                fixEdge<StringUse>(node->child3());
+                break;
+            }
+            break;
+        }
+            
+        case Branch: {
+            if (node->child1()->shouldSpeculateBoolean()) {
+                if (node->child1()->result() == NodeResultBoolean) {
+                    // This is necessary in case we have a bytecode instruction implemented by:
+                    //
+                    // a: CompareEq(...)
+                    // b: Branch(@a)
+                    //
+                    // In that case, CompareEq might have a side-effect. Then, we need to make
+                    // sure that we know that Branch does not exit.
+                    fixEdge<KnownBooleanUse>(node->child1());
+                } else
+                    fixEdge<BooleanUse>(node->child1());
+            } else if (node->child1()->shouldSpeculateObjectOrOther())
+                fixEdge<ObjectOrOtherUse>(node->child1());
+            else if (node->child1()->shouldSpeculateInt32OrBoolean())
+                fixIntOrBooleanEdge(node->child1());
+            else if (node->child1()->shouldSpeculateNumber())
+                fixEdge<DoubleRepUse>(node->child1());
+            else if (node->child1()->shouldSpeculateString())
+                fixEdge<StringUse>(node->child1());
+            else if (node->child1()->shouldSpeculateStringOrOther())
+                fixEdge<StringOrOtherUse>(node->child1());
+            else {
+                WatchpointSet* masqueradesAsUndefinedWatchpoint = m_graph.globalObjectFor(node->origin.semantic)->masqueradesAsUndefinedWatchpoint();
+                if (masqueradesAsUndefinedWatchpoint->isStillValid())
+                    m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);
+            }
+            break;
+        }
+            
+        case Switch: {
+            SwitchData* data = node->switchData();
+            switch (data->kind) {
+            case SwitchImm:
+                if (node->child1()->shouldSpeculateInt32())
+                    fixEdge<Int32Use>(node->child1());
+                break;
+            case SwitchChar:
+                if (node->child1()->shouldSpeculateString())
+                    fixEdge<StringUse>(node->child1());
+                break;
+            case SwitchString:
+                if (node->child1()->shouldSpeculateStringIdent())
+                    fixEdge<StringIdentUse>(node->child1());
+                else if (node->child1()->shouldSpeculateString())
+                    fixEdge<StringUse>(node->child1());
+                break;
+            case SwitchCell:
+                if (node->child1()->shouldSpeculateCell())
+                    fixEdge<CellUse>(node->child1());
+                // else it's fine for this to have UntypedUse; we will handle this by just making
+                // non-cells take the default case.
+                break;
+            }
+            break;
+        }
+            
+        case ToPrimitive: {
+            fixupToPrimitive(node);
+            break;
+        }
+
+        case ToNumber: {
+            fixupToNumber(node);
+            break;
+        }
+            
+        case ToString:
+        case CallStringConstructor: {
+            fixupToStringOrCallStringConstructor(node);
+            break;
+        }
+            
+        case NewStringObject: {
+            fixEdge<KnownStringUse>(node->child1());
+            break;
+        }
+
+        case NewArrayWithSpread: {
+            watchHavingABadTime(node);
+            
+            BitVector* bitVector = node->bitVector();
+            for (unsigned i = node->numChildren(); i--;) {
+                if (bitVector->get(i))
+                    fixEdge<KnownCellUse>(m_graph.m_varArgChildren[node->firstChild() + i]);
+                else
+                    fixEdge<UntypedUse>(m_graph.m_varArgChildren[node->firstChild() + i]);
+            }
+
+            break;
+        }
+
+        case Spread: {
+            // Note: We care about performing the protocol on our child's global object, not necessarily ours.
+            
+            watchHavingABadTime(node->child1().node());
+
+            JSGlobalObject* globalObject = m_graph.globalObjectFor(node->child1()->origin.semantic);
+            // When we go down the fast path, we don't consult the prototype chain, so we must prove
+            // that it doesn't contain any indexed properties, and that any holes will result in
+            // jsUndefined().
+            InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
+            InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
+            if (node->child1()->shouldSpeculateArray() 
+                && arrayPrototypeTransition.isStillValid() 
+                && objectPrototypeTransition.isStillValid() 
+                && globalObject->arrayPrototypeChainIsSane()
+                && m_graph.isWatchingArrayIteratorProtocolWatchpoint(node->child1().node())
+                && m_graph.isWatchingHavingABadTimeWatchpoint(node->child1().node())) {
+                m_graph.watchpoints().addLazily(objectPrototypeTransition);
+                m_graph.watchpoints().addLazily(arrayPrototypeTransition);
+                fixEdge<ArrayUse>(node->child1());
+            } else
+                fixEdge<CellUse>(node->child1());
+            break;
+        }
+            
+        case NewArray: {
+            watchHavingABadTime(node);
+            
+            for (unsigned i = m_graph.varArgNumChildren(node); i--;) {
+                node->setIndexingType(
+                    leastUpperBoundOfIndexingTypeAndType(
+                        node->indexingType(), m_graph.varArgChild(node, i)->prediction()));
+            }
+            switch (node->indexingType()) {
+            case ALL_BLANK_INDEXING_TYPES:
+                CRASH();
+                break;
+            case ALL_UNDECIDED_INDEXING_TYPES:
+                if (node->numChildren()) {
+                    // This will only happen if the children have no type predictions. We
+                    // would have already exited by now, but insert a forced exit just to
+                    // be safe.
+                    m_insertionSet.insertNode(
+                        m_indexInBlock, SpecNone, ForceOSRExit, node->origin);
+                }
+                break;
+            case ALL_INT32_INDEXING_TYPES:
+                for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)
+                    fixEdge<Int32Use>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);
+                break;
+            case ALL_DOUBLE_INDEXING_TYPES:
+                for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)
+                    fixEdge<DoubleRepRealUse>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);
+                break;
+            case ALL_CONTIGUOUS_INDEXING_TYPES:
+            case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+                break;
+            default:
+                CRASH();
+                break;
+            }
+            break;
+        }
+            
+        case NewTypedArray: {
+            watchHavingABadTime(node);
+            
+            if (node->child1()->shouldSpeculateInt32()) {
+                fixEdge<Int32Use>(node->child1());
+                node->clearFlags(NodeMustGenerate);
+                break;
+            }
+            break;
+        }
+            
+        case NewArrayWithSize: {
+            watchHavingABadTime(node);
+            fixEdge<Int32Use>(node->child1());
+            break;
+        }
+
+        case NewArrayBuffer: {
+            watchHavingABadTime(node);
+            break;
+        }
+
+        case CallObjectConstructor: {
+            if (node->child1()->shouldSpeculateObject()) {
+                fixEdge<ObjectUse>(node->child1());
+                node->convertToIdentity();
+                break;
+            }
+
+            fixEdge<UntypedUse>(node->child1());
+            break;
+        }
+
+        case ToThis: {
+            fixupToThis(node);
+            break;
+        }
+            
+        case PutStructure: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+            
+        case GetClosureVar:
+        case GetFromArguments: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+
+        case PutClosureVar:
+        case PutToArguments: {
+            fixEdge<KnownCellUse>(node->child1());
+            speculateForBarrier(node->child2());
+            break;
+        }
+
+        case SkipScope:
+        case GetScope:
+        case GetGetter:
+        case GetSetter:
+        case GetGlobalObject: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+            
+        case AllocatePropertyStorage:
+        case ReallocatePropertyStorage: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+            
+        case NukeStructureAndSetButterfly: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+
+        case TryGetById: {
+            if (node->child1()->shouldSpeculateCell())
+                fixEdge<CellUse>(node->child1());
+            break;
+        }
+
+        case GetById:
+        case GetByIdFlush: {
+            // FIXME: This should be done in the ByteCodeParser based on reading the
+            // PolymorphicAccess, which will surely tell us that this is a AccessCase::ArrayLength.
+            // https://bugs.webkit.org/show_bug.cgi?id=154990
+            if (node->child1()->shouldSpeculateCellOrOther()
+                && !m_graph.hasExitSite(node->origin.semantic, BadType)
+                && !m_graph.hasExitSite(node->origin.semantic, BadCache)
+                && !m_graph.hasExitSite(node->origin.semantic, BadIndexingType)
+                && !m_graph.hasExitSite(node->origin.semantic, ExoticObjectMode)) {
+                
+                auto uid = m_graph.identifiers()[node->identifierNumber()];
+                
+                if (uid == vm().propertyNames->length.impl()) {
+                    attemptToMakeGetArrayLength(node);
+                    break;
+                }
+
+                if (uid == vm().propertyNames->lastIndex.impl()
+                    && node->child1()->shouldSpeculateRegExpObject()) {
+                    node->setOp(GetRegExpObjectLastIndex);
+                    node->clearFlags(NodeMustGenerate);
+                    fixEdge<RegExpObjectUse>(node->child1());
+                    break;
+                }
+            }
+
+            if (node->child1()->shouldSpeculateCell())
+                fixEdge<CellUse>(node->child1());
+            break;
+        }
+
+        case PutById:
+        case PutByIdFlush:
+        case PutByIdDirect: {
+            if (node->child1()->shouldSpeculateCellOrOther()
+                && !m_graph.hasExitSite(node->origin.semantic, BadType)
+                && !m_graph.hasExitSite(node->origin.semantic, BadCache)
+                && !m_graph.hasExitSite(node->origin.semantic, BadIndexingType)
+                && !m_graph.hasExitSite(node->origin.semantic, ExoticObjectMode)) {
+                
+                auto uid = m_graph.identifiers()[node->identifierNumber()];
+                
+                if (uid == vm().propertyNames->lastIndex.impl()
+                    && node->child1()->shouldSpeculateRegExpObject()) {
+                    node->setOp(SetRegExpObjectLastIndex);
+                    fixEdge<RegExpObjectUse>(node->child1());
+                    speculateForBarrier(node->child2());
+                    break;
+                }
+            }
+            
+            fixEdge<CellUse>(node->child1());
+            break;
+        }
+
+        case PutGetterById:
+        case PutSetterById: {
+            fixEdge<KnownCellUse>(node->child1());
+            fixEdge<KnownCellUse>(node->child2());
+            break;
+        }
+
+        case PutGetterSetterById: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+
+        case PutGetterByVal:
+        case PutSetterByVal: {
+            fixEdge<KnownCellUse>(node->child1());
+            fixEdge<KnownCellUse>(node->child3());
+            break;
+        }
+
+        case GetExecutable: {
+            fixEdge<FunctionUse>(node->child1());
+            break;
+        }
+
+        case OverridesHasInstance:
+        case CheckStructure:
+        case CheckCell:
+        case CreateThis:
+        case GetButterfly: {
+            fixEdge<CellUse>(node->child1());
+            break;
+        }
+
+        case CheckStringIdent: {
+            fixEdge<StringIdentUse>(node->child1());
+            break;
+        }
+            
+        case Arrayify:
+        case ArrayifyToStructure: {
+            fixEdge<CellUse>(node->child1());
+            if (node->child2())
+                fixEdge<Int32Use>(node->child2());
+            break;
+        }
+            
+        case GetByOffset:
+        case GetGetterSetterByOffset: {
+            if (!node->child1()->hasStorageResult())
+                fixEdge<KnownCellUse>(node->child1());
+            fixEdge<KnownCellUse>(node->child2());
+            break;
+        }
+            
+        case MultiGetByOffset: {
+            fixEdge<CellUse>(node->child1());
+            break;
+        }
+            
+        case PutByOffset: {
+            if (!node->child1()->hasStorageResult())
+                fixEdge<KnownCellUse>(node->child1());
+            fixEdge<KnownCellUse>(node->child2());
+            unsigned index = indexForChecks();
+            insertInferredTypeCheck(
+                m_insertionSet, index, originForCheck(index), node->child3().node(),
+                node->storageAccessData().inferredType);
+            speculateForBarrier(node->child3());
+            break;
+        }
+            
+        case MultiPutByOffset: {
+            fixEdge<CellUse>(node->child1());
+            break;
+        }
+            
+        case InstanceOf: {
+            if (!(node->child1()->prediction() & ~SpecCell))
+                fixEdge<CellUse>(node->child1());
+            fixEdge<CellUse>(node->child2());
+            break;
+        }
+
+        case InstanceOfCustom:
+            fixEdge<CellUse>(node->child2());
+            break;
+
+        case In: {
+            // FIXME: We should at some point have array profiling on op_in, in which
+            // case we would be able to turn this into a kind of GetByVal.
+            
+            fixEdge<CellUse>(node->child2());
+            break;
+        }
+
+        case HasOwnProperty: {
+            fixEdge<ObjectUse>(node->child1());
+#if CPU(X86) && USE(JSVALUE32_64)
+            // We don't have enough registers to do anything interesting on x86.
+            fixEdge<UntypedUse>(node->child2());
+#else
+            if (node->child2()->shouldSpeculateString())
+                fixEdge<StringUse>(node->child2());
+            else if (node->child2()->shouldSpeculateSymbol())
+                fixEdge<SymbolUse>(node->child2());
+            else
+                fixEdge<UntypedUse>(node->child2());
+#endif
+            break;
+        }
+
+        case Check: {
+            m_graph.doToChildren(
+                node,
+                [&] (Edge& edge) {
+                    switch (edge.useKind()) {
+                    case NumberUse:
+                        if (edge->shouldSpeculateInt32ForArithmetic())
+                            edge.setUseKind(Int32Use);
+                        break;
+                    default:
+                        break;
+                    }
+                    observeUseKindOnEdge(edge);
+                });
+            break;
+        }
+
+        case Phantom:
+            // Phantoms are meaningless past Fixup. We recreate them on-demand in the backend.
+            node->remove();
+            break;
+
+        case FiatInt52: {
+            RELEASE_ASSERT(enableInt52());
+            node->convertToIdentity();
+            fixEdge<Int52RepUse>(node->child1());
+            node->setResult(NodeResultInt52);
+            break;
+        }
+
+        case GetArrayLength: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+
+        case GetTypedArrayByteOffset: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+
+        case Phi:
+        case Upsilon:
+        case GetIndexedPropertyStorage:
+        case LastNodeType:
+        case CheckTierUpInLoop:
+        case CheckTierUpAtReturn:
+        case CheckTierUpAndOSREnter:
+        case InvalidationPoint:
+        case CheckArray:
+        case CheckInBounds:
+        case ConstantStoragePointer:
+        case DoubleAsInt32:
+        case ValueToInt32:
+        case DoubleRep:
+        case ValueRep:
+        case Int52Rep:
+        case Int52Constant:
+        case Identity: // This should have been cleaned up.
+        case BooleanToNumber:
+        case PhantomNewObject:
+        case PhantomNewFunction:
+        case PhantomNewGeneratorFunction:
+        case PhantomNewAsyncFunction:
+        case PhantomCreateActivation:
+        case PhantomDirectArguments:
+        case PhantomCreateRest:
+        case PhantomSpread:
+        case PhantomNewArrayWithSpread:
+        case PhantomClonedArguments:
+        case GetMyArgumentByVal:
+        case GetMyArgumentByValOutOfBounds:
+        case PutHint:
+        case CheckStructureImmediate:
+        case MaterializeNewObject:
+        case MaterializeCreateActivation:
+        case PutStack:
+        case KillStack:
+        case GetStack:
+        case StoreBarrier:
+        case FencedStoreBarrier:
+        case GetRegExpObjectLastIndex:
+        case SetRegExpObjectLastIndex:
+        case RecordRegExpCachedResult:
+            // These are just nodes that we don't currently expect to see during fixup.
+            // If we ever wanted to insert them prior to fixup, then we just have to create
+            // fixup rules for them.
+            DFG_CRASH(m_graph, node, "Unexpected node during fixup");
+            break;
+        
+        case PutGlobalVariable: {
+            fixEdge<CellUse>(node->child1());
+            speculateForBarrier(node->child2());
+            break;
+        }
+
+        case IsObject:
+            if (node->child1()->shouldSpeculateObject()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child1().node(), ObjectUse));
+                m_graph.convertToConstant(node, jsBoolean(true));
+                observeUseKindOnNode<ObjectUse>(node);
+            }
+            break;
+
+        case IsCellWithType: {
+            fixupIsCellWithType(node);
+            break;
+        }
+
+        case GetEnumerableLength: {
+            fixEdge<CellUse>(node->child1());
+            break;
+        }
+        case HasGenericProperty: {
+            fixEdge<CellUse>(node->child2());
+            break;
+        }
+        case HasStructureProperty: {
+            fixEdge<StringUse>(node->child2());
+            fixEdge<KnownCellUse>(node->child3());
+            break;
+        }
+        case HasIndexedProperty: {
+            node->setArrayMode(
+                node->arrayMode().refine(
+                    m_graph, node,
+                    node->child1()->prediction(),
+                    node->child2()->prediction(),
+                    SpecNone));
+            
+            blessArrayOperation(node->child1(), node->child2(), node->child3());
+            fixEdge<CellUse>(node->child1());
+            fixEdge<KnownInt32Use>(node->child2());
+            break;
+        }
+        case GetDirectPname: {
+            Edge& base = m_graph.varArgChild(node, 0);
+            Edge& property = m_graph.varArgChild(node, 1);
+            Edge& index = m_graph.varArgChild(node, 2);
+            Edge& enumerator = m_graph.varArgChild(node, 3);
+            fixEdge<CellUse>(base);
+            fixEdge<KnownCellUse>(property);
+            fixEdge<KnownInt32Use>(index);
+            fixEdge<KnownCellUse>(enumerator);
+            break;
+        }
+        case GetPropertyEnumerator: {
+            fixEdge<CellUse>(node->child1());
+            break;
+        }
+        case GetEnumeratorStructurePname: {
+            fixEdge<KnownCellUse>(node->child1());
+            fixEdge<KnownInt32Use>(node->child2());
+            break;
+        }
+        case GetEnumeratorGenericPname: {
+            fixEdge<KnownCellUse>(node->child1());
+            fixEdge<KnownInt32Use>(node->child2());
+            break;
+        }
+        case ToIndexString: {
+            fixEdge<KnownInt32Use>(node->child1());
+            break;
+        }
+        case ProfileType: {
+            // We want to insert type checks based on the instructionTypeSet of the TypeLocation, not the globalTypeSet.
+            // Because the instructionTypeSet is contained in globalTypeSet, if we produce a type check for
+            // type T for the instructionTypeSet, the global type set must also have information for type T.
+            // So if it the type check succeeds for type T in the instructionTypeSet, a type check for type T 
+            // in the globalTypeSet would've also succeeded.
+            // (The other direction does not hold in general).
+
+            RefPtr<TypeSet> typeSet = node->typeLocation()->m_instructionTypeSet;
+            RuntimeTypeMask seenTypes = typeSet->seenTypes();
+            if (typeSet->doesTypeConformTo(TypeAnyInt)) {
+                if (node->child1()->shouldSpeculateInt32()) {
+                    fixEdge<Int32Use>(node->child1());
+                    node->remove();
+                    break;
+                }
+
+                if (enableInt52()) {
+                    fixEdge<AnyIntUse>(node->child1());
+                    node->remove();
+                    break;
+                }
+
+                // Must not perform fixEdge<NumberUse> here since the type set only includes TypeAnyInt. Double values should be logged.
+            }
+
+            if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) {
+                fixEdge<NumberUse>(node->child1());
+                node->remove();
+            } else if (typeSet->doesTypeConformTo(TypeString)) {
+                fixEdge<StringUse>(node->child1());
+                node->remove();
+            } else if (typeSet->doesTypeConformTo(TypeBoolean)) {
+                fixEdge<BooleanUse>(node->child1());
+                node->remove();
+            } else if (typeSet->doesTypeConformTo(TypeUndefined | TypeNull) && (seenTypes & TypeUndefined) && (seenTypes & TypeNull)) {
+                fixEdge<OtherUse>(node->child1());
+                node->remove();
+            } else if (typeSet->doesTypeConformTo(TypeObject)) {
+                StructureSet set;
+                {
+                    ConcurrentJSLocker locker(typeSet->m_lock);
+                    set = typeSet->structureSet(locker);
+                }
+                if (!set.isEmpty()) {
+                    fixEdge<CellUse>(node->child1());
+                    node->convertToCheckStructure(m_graph.addStructureSet(set));
+                }
+            }
+
+            break;
+        }
+
+        case CreateClonedArguments: {
+            watchHavingABadTime(node);
+            break;
+        }
+
+        case CreateScopedArguments:
+        case CreateActivation:
+        case NewFunction:
+        case NewGeneratorFunction:
+        case NewAsyncFunction: {
+            fixEdge<CellUse>(node->child1());
+            break;
+        }
+
+        case SetFunctionName: {
+            // The first child is guaranteed to be a cell because op_set_function_name is only used
+            // on a newly instantiated function object (the first child).
+            fixEdge<KnownCellUse>(node->child1());
+            fixEdge<UntypedUse>(node->child2());
+            break;
+        }
+
+        case CreateRest: {
+            watchHavingABadTime(node);
+            fixEdge<KnownInt32Use>(node->child1());
+            break;
+        }
+
+        case ResolveScope:
+        case GetDynamicVar:
+        case PutDynamicVar: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+
+        case LogShadowChickenPrologue: {
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+        }
+        case LogShadowChickenTail: {
+            fixEdge<UntypedUse>(node->child1());
+            fixEdge<KnownCellUse>(node->child2());
+            break;
+        }
+
+        case GetMapBucket:
+            if (node->child1().useKind() == MapObjectUse)
+                fixEdge<MapObjectUse>(node->child1());
+            else if (node->child1().useKind() == SetObjectUse)
+                fixEdge<SetObjectUse>(node->child1());
+            else
+                RELEASE_ASSERT_NOT_REACHED();
+
+#if USE(JSVALUE64)
+            if (node->child2()->shouldSpeculateBoolean())
+                fixEdge<BooleanUse>(node->child2());
+            else if (node->child2()->shouldSpeculateInt32())
+                fixEdge<Int32Use>(node->child2());
+            else if (node->child2()->shouldSpeculateSymbol())
+                fixEdge<SymbolUse>(node->child2());
+            else if (node->child2()->shouldSpeculateObject())
+                fixEdge<ObjectUse>(node->child2());
+            else if (node->child2()->shouldSpeculateString())
+                fixEdge<StringUse>(node->child2());
+            else if (node->child2()->shouldSpeculateCell())
+                fixEdge<CellUse>(node->child2());
+            else
+                fixEdge<UntypedUse>(node->child2());
+#else
+            fixEdge<UntypedUse>(node->child2());
+#endif // USE(JSVALUE64)
+
+            fixEdge<Int32Use>(node->child3());
+            break;
+
+        case LoadFromJSMapBucket:
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+
+        case IsNonEmptyMapBucket:
+            fixEdge<KnownCellUse>(node->child1());
+            break;
+
+        case MapHash: {
+#if USE(JSVALUE64)
+            if (node->child1()->shouldSpeculateBoolean()) {
+                fixEdge<BooleanUse>(node->child1());
+                break;
+            }
+
+            if (node->child1()->shouldSpeculateInt32()) {
+                fixEdge<Int32Use>(node->child1());
+                break;
+            }
+
+            if (node->child1()->shouldSpeculateSymbol()) {
+                fixEdge<SymbolUse>(node->child1());
+                break;
+            }
+
+            if (node->child1()->shouldSpeculateObject()) {
+                fixEdge<ObjectUse>(node->child1());
+                break;
+            }
+
+            if (node->child1()->shouldSpeculateString()) {
+                fixEdge<StringUse>(node->child1());
+                break;
+            }
+
+            if (node->child1()->shouldSpeculateCell()) {
+                fixEdge<CellUse>(node->child1());
+                break;
+            }
+
+            fixEdge<UntypedUse>(node->child1());
+#else
+            fixEdge<UntypedUse>(node->child1());
+#endif // USE(JSVALUE64)
+            break;
+        }
+
+        case DefineDataProperty: {
+            fixEdge<CellUse>(m_graph.varArgChild(node, 0));
+            Edge& propertyEdge = m_graph.varArgChild(node, 1);
+            if (propertyEdge->shouldSpeculateSymbol())
+                fixEdge<SymbolUse>(propertyEdge);
+            else if (propertyEdge->shouldSpeculateStringIdent())
+                fixEdge<StringIdentUse>(propertyEdge);
+            else if (propertyEdge->shouldSpeculateString())
+                fixEdge<StringUse>(propertyEdge);
+            else
+                fixEdge<UntypedUse>(propertyEdge);
+            fixEdge<UntypedUse>(m_graph.varArgChild(node, 2));
+            fixEdge<KnownInt32Use>(m_graph.varArgChild(node, 3));
+            break;
+        }
+
+        case ToLowerCase: {
+            // We currently only support StringUse since that will ensure that
+            // ToLowerCase is a pure operation. If we decide to update this with
+            // more types in the future, we need to ensure that the clobberize rules
+            // are correct.
+            fixEdge<StringUse>(node->child1());
+            break;
+        }
+
+        case DefineAccessorProperty: {
+            fixEdge<CellUse>(m_graph.varArgChild(node, 0));
+            Edge& propertyEdge = m_graph.varArgChild(node, 1);
+            if (propertyEdge->shouldSpeculateSymbol())
+                fixEdge<SymbolUse>(propertyEdge);
+            else if (propertyEdge->shouldSpeculateStringIdent())
+                fixEdge<StringIdentUse>(propertyEdge);
+            else if (propertyEdge->shouldSpeculateString())
+                fixEdge<StringUse>(propertyEdge);
+            else
+                fixEdge<UntypedUse>(propertyEdge);
+            fixEdge<CellUse>(m_graph.varArgChild(node, 2));
+            fixEdge<CellUse>(m_graph.varArgChild(node, 3));
+            fixEdge<KnownInt32Use>(m_graph.varArgChild(node, 4));
+            break;
+        }
+
+        case CheckDOM: {
+            fixupCheckDOM(node);
+            break;
+        }
+
+        case CallDOMGetter: {
+            DOMJIT::CallDOMGetterPatchpoint* patchpoint = node->callDOMGetterData()->patchpoint;
+            fixEdge<CellUse>(node->child1()); // DOM.
+            if (patchpoint->requireGlobalObject)
+                fixEdge<KnownCellUse>(node->child2()); // GlobalObject.
+            break;
+        }
+
+        case CallDOM: {
+            fixupCallDOM(node);
+            break;
+        }
+
+        case Call: {
+            attemptToMakeCallDOM(node);
+            break;
+        }
+
+#if !ASSERT_DISABLED
+        // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
+        case SetArgument:
+        case JSConstant:
+        case LazyJSConstant:
+        case DoubleConstant:
+        case GetLocal:
+        case GetCallee:
+        case GetArgumentCountIncludingThis:
+        case GetRestLength:
+        case GetArgument:
+        case Flush:
+        case PhantomLocal:
+        case GetLocalUnlinked:
+        case GetGlobalVar:
+        case GetGlobalLexicalVariable:
+        case NotifyWrite:
+        case DirectCall:
+        case CheckTypeInfoFlags:
+        case TailCallInlinedCaller:
+        case DirectTailCallInlinedCaller:
+        case Construct:
+        case DirectConstruct:
+        case CallVarargs:
+        case CallEval:
+        case TailCallVarargsInlinedCaller:
+        case ConstructVarargs:
+        case CallForwardVarargs:
+        case ConstructForwardVarargs:
+        case TailCallForwardVarargs:
+        case TailCallForwardVarargsInlinedCaller:
+        case LoadVarargs:
+        case ForwardVarargs:
+        case ProfileControlFlow:
+        case NewObject:
+        case NewRegexp:
+        case DeleteById:
+        case DeleteByVal:
+        case IsTypedArrayView:
+        case IsEmpty:
+        case IsUndefined:
+        case IsBoolean:
+        case IsNumber:
+        case IsObjectOrNull:
+        case IsFunction:
+        case CreateDirectArguments:
+        case Jump:
+        case Return:
+        case TailCall:
+        case DirectTailCall:
+        case TailCallVarargs:
+        case Throw:
+        case ThrowStaticError:
+        case CountExecution:
+        case ForceOSRExit:
+        case CheckBadCell:
+        case CheckNotEmpty:
+        case CheckWatchdogTimer:
+        case Unreachable:
+        case ExtractOSREntryLocal:
+        case LoopHint:
+        case MovHint:
+        case ZombieHint:
+        case ExitOK:
+        case BottomValue:
+        case TypeOf:
+        case GetByIdWithThis:
+        case PutByIdWithThis:
+        case PutByValWithThis:
+        case GetByValWithThis:
+        case CompareEqPtr:
+            break;
+#else
+        default:
+            break;
+#endif
+        }
+    }
+
+    void watchHavingABadTime(Node* node)
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
+
+        // If this global object is not having a bad time, watch it. We go down this path anytime the code
+        // does an array allocation. The types of array allocations may change if we start to have a bad
+        // time. It's easier to reason about this if we know that whenever the types change after we start
+        // optimizing, the code just gets thrown out. Doing this at FixupPhase is just early enough, since
+        // prior to this point nobody should have been doing optimizations based on the indexing type of
+        // the allocation.
+        if (!globalObject->isHavingABadTime()) {
+            m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
+            m_graph.freeze(globalObject);
+        }
+    }
+    
+    template<UseKind useKind>
+    void createToString(Node* node, Edge& edge)
+    {
+        edge.setNode(m_insertionSet.insertNode(
+            m_indexInBlock, SpecString, ToString, node->origin,
+            Edge(edge.node(), useKind)));
+    }
+    
+    template<UseKind useKind>
+    void attemptToForceStringArrayModeByToStringConversion(ArrayMode& arrayMode, Node* node)
+    {
+        ASSERT(arrayMode == ArrayMode(Array::Generic));
+        
+        if (!m_graph.canOptimizeStringObjectAccess(node->origin.semantic))
+            return;
+        
+        createToString<useKind>(node, node->child1());
+        arrayMode = ArrayMode(Array::String);
+    }
+    
+    template<UseKind useKind>
+    bool isStringObjectUse()
+    {
+        switch (useKind) {
+        case StringObjectUse:
+        case StringOrStringObjectUse:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    template<UseKind useKind>
+    void convertStringAddUse(Node* node, Edge& edge)
+    {
+        if (useKind == StringUse) {
+            observeUseKindOnNode<StringUse>(edge.node());
+            m_insertionSet.insertNode(
+                m_indexInBlock, SpecNone, Check, node->origin,
+                Edge(edge.node(), StringUse));
+            edge.setUseKind(KnownStringUse);
+            return;
+        }
+        
+        observeUseKindOnNode<useKind>(edge.node());
+        createToString<useKind>(node, edge);
+    }
+    
+    void convertToMakeRope(Node* node)
+    {
+        node->setOpAndDefaultFlags(MakeRope);
+        fixupMakeRope(node);
+    }
+    
+    void fixupMakeRope(Node* node)
+    {
+        for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
+            Edge& edge = node->children.child(i);
+            if (!edge)
+                break;
+            edge.setUseKind(KnownStringUse);
+            JSString* string = edge->dynamicCastConstant<JSString*>();
+            if (!string)
+                continue;
+            if (string->length())
+                continue;
+            
+            // Don't allow the MakeRope to have zero children.
+            if (!i && !node->child2())
+                break;
+            
+            node->children.removeEdge(i--);
+        }
+        
+        if (!node->child2()) {
+            ASSERT(!node->child3());
+            node->convertToIdentity();
+        }
+    }
+
+    void fixupIsCellWithType(Node* node)
+    {
+        switch (node->speculatedTypeForQuery()) {
+        case SpecString:
+            if (node->child1()->shouldSpeculateString()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child1().node(), StringUse));
+                m_graph.convertToConstant(node, jsBoolean(true));
+                observeUseKindOnNode<StringUse>(node);
+                return;
+            }
+            break;
+
+        case SpecProxyObject:
+            if (node->child1()->shouldSpeculateProxyObject()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child1().node(), ProxyObjectUse));
+                m_graph.convertToConstant(node, jsBoolean(true));
+                observeUseKindOnNode<ProxyObjectUse>(node);
+                return;
+            }
+            break;
+
+        case SpecRegExpObject:
+            if (node->child1()->shouldSpeculateRegExpObject()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child1().node(), RegExpObjectUse));
+                m_graph.convertToConstant(node, jsBoolean(true));
+                observeUseKindOnNode<RegExpObjectUse>(node);
+                return;
+            }
+            break;
+
+        case SpecArray:
+            if (node->child1()->shouldSpeculateArray()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child1().node(), ArrayUse));
+                m_graph.convertToConstant(node, jsBoolean(true));
+                observeUseKindOnNode<ArrayUse>(node);
+                return;
+            }
+            break;
+
+        case SpecDerivedArray:
+            if (node->child1()->shouldSpeculateDerivedArray()) {
+                m_insertionSet.insertNode(
+                    m_indexInBlock, SpecNone, Check, node->origin,
+                    Edge(node->child1().node(), DerivedArrayUse));
+                m_graph.convertToConstant(node, jsBoolean(true));
+                observeUseKindOnNode<DerivedArrayUse>(node);
+                return;
+            }
+            break;
+        }
+
+        if (node->child1()->shouldSpeculateCell()) {
+            fixEdge<CellUse>(node->child1());
+            return;
+        }
+
+        if (node->child1()->shouldSpeculateNotCell()) {
+            m_insertionSet.insertNode(
+                m_indexInBlock, SpecNone, Check, node->origin,
+                Edge(node->child1().node(), NotCellUse));
+            m_graph.convertToConstant(node, jsBoolean(false));
+            observeUseKindOnNode<NotCellUse>(node);
+            return;
+        }
+    }
+
+    void fixupToThis(Node* node)
+    {
+        ECMAMode ecmaMode = m_graph.executableFor(node->origin.semantic)->isStrictMode() ? StrictMode : NotStrictMode;
+
+        if (ecmaMode == StrictMode) {
+            if (node->child1()->shouldSpeculateBoolean()) {
+                fixEdge<BooleanUse>(node->child1());
+                node->convertToIdentity();
+                return;
+            }
+
+            if (node->child1()->shouldSpeculateInt32()) {
+                fixEdge<Int32Use>(node->child1());
+                node->convertToIdentity();
+                return;
+            }
+
+            if (enableInt52() && node->child1()->shouldSpeculateAnyInt()) {
+                fixEdge<Int52RepUse>(node->child1());
+                node->convertToIdentity();
+                node->setResult(NodeResultInt52);
+                return;
+            }
+
+            if (node->child1()->shouldSpeculateNumber()) {
+                fixEdge<DoubleRepUse>(node->child1());
+                node->convertToIdentity();
+                node->setResult(NodeResultDouble);
+                return;
+            }
+
+            if (node->child1()->shouldSpeculateSymbol()) {
+                fixEdge<SymbolUse>(node->child1());
+                node->convertToIdentity();
+                return;
+            }
+
+            if (node->child1()->shouldSpeculateStringIdent()) {
+                fixEdge<StringIdentUse>(node->child1());
+                node->convertToIdentity();
+                return;
+            }
+
+            if (node->child1()->shouldSpeculateString()) {
+                fixEdge<StringUse>(node->child1());
+                node->convertToIdentity();
+                return;
+            }
+        }
+
+        if (node->child1()->shouldSpeculateOther()) {
+            if (ecmaMode == StrictMode) {
+                fixEdge<OtherUse>(node->child1());
+                node->convertToIdentity();
+                return;
+            }
+
+            m_insertionSet.insertNode(
+                m_indexInBlock, SpecNone, Check, node->origin,
+                Edge(node->child1().node(), OtherUse));
+            observeUseKindOnNode<OtherUse>(node->child1().node());
+            m_graph.convertToConstant(
+                node, m_graph.globalThisObjectFor(node->origin.semantic));
+            return;
+        }
+
+        // FIXME: This should cover other use cases but we don't have use kinds for them. It's not critical,
+        // however, since we cover all the missing cases in constant folding.
+        // https://bugs.webkit.org/show_bug.cgi?id=157213
+        if (node->child1()->shouldSpeculateStringObject()) {
+            fixEdge<StringObjectUse>(node->child1());
+            node->convertToIdentity();
+            return;
+        }
+
+        if (isFinalObjectSpeculation(node->child1()->prediction())) {
+            fixEdge<FinalObjectUse>(node->child1());
+            node->convertToIdentity();
+            return;
+        }
+    }
+    
+    void fixupToPrimitive(Node* node)
+    {
+        if (node->child1()->shouldSpeculateInt32()) {
+            fixEdge<Int32Use>(node->child1());
+            node->convertToIdentity();
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateString()) {
+            fixEdge<StringUse>(node->child1());
+            node->convertToIdentity();
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateStringObject()
+            && m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
+            fixEdge<StringObjectUse>(node->child1());
+            node->convertToToString();
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateStringOrStringObject()
+            && m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
+            fixEdge<StringOrStringObjectUse>(node->child1());
+            node->convertToToString();
+            return;
+        }
+    }
+
+    void fixupToNumber(Node* node)
+    {
+        // If the prediction of the child is Number, we attempt to convert ToNumber to Identity.
+        if (node->child1()->shouldSpeculateNumber()) {
+            if (isInt32Speculation(node->getHeapPrediction())) {
+                // If the both predictions of this node and the child is Int32, we just convert ToNumber to Identity, that's simple.
+                if (node->child1()->shouldSpeculateInt32()) {
+                    fixEdge<Int32Use>(node->child1());
+                    node->convertToIdentity();
+                    return;
+                }
+
+                // The another case is that the predicted type of the child is Int32, but the heap prediction tell the users that this will produce non Int32 values.
+                // In that case, let's receive the child value as a Double value and convert it to Int32. This case happens in misc-bugs-847389-jpeg2000.
+                fixEdge<DoubleRepUse>(node->child1());
+                node->setOp(DoubleAsInt32);
+                if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
+                    node->setArithMode(Arith::CheckOverflow);
+                else
+                    node->setArithMode(Arith::CheckOverflowAndNegativeZero);
+                return;
+            }
+
+            fixEdge<DoubleRepUse>(node->child1());
+            node->convertToIdentity();
+            node->setResult(NodeResultDouble);
+            return;
+        }
+
+        fixEdge<UntypedUse>(node->child1());
+        node->setResult(NodeResultJS);
+    }
+    
+    void fixupToStringOrCallStringConstructor(Node* node)
+    {
+        if (node->child1()->shouldSpeculateString()) {
+            fixEdge<StringUse>(node->child1());
+            node->convertToIdentity();
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateStringObject()
+            && m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
+            fixEdge<StringObjectUse>(node->child1());
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateStringOrStringObject()
+            && m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
+            fixEdge<StringOrStringObjectUse>(node->child1());
+            return;
+        }
+        
+        if (node->child1()->shouldSpeculateCell()) {
+            fixEdge<CellUse>(node->child1());
+            return;
+        }
+    }
+
+    bool attemptToMakeFastStringAdd(Node* node)
+    {
+        bool goodToGo = true;
+        m_graph.doToChildren(
+            node,
+            [&] (Edge& edge) {
+                if (edge->shouldSpeculateString())
+                    return;
+                if (m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
+                    if (edge->shouldSpeculateStringObject())
+                        return;
+                    if (edge->shouldSpeculateStringOrStringObject())
+                        return;
+                }
+                goodToGo = false;
+            });
+        if (!goodToGo)
+            return false;
+
+        m_graph.doToChildren(
+            node,
+            [&] (Edge& edge) {
+                if (edge->shouldSpeculateString()) {
+                    convertStringAddUse<StringUse>(node, edge);
+                    return;
+                }
+                ASSERT(m_graph.canOptimizeStringObjectAccess(node->origin.semantic));
+                if (edge->shouldSpeculateStringObject()) {
+                    convertStringAddUse<StringObjectUse>(node, edge);
+                    return;
+                }
+                if (edge->shouldSpeculateStringOrStringObject()) {
+                    convertStringAddUse<StringOrStringObjectUse>(node, edge);
+                    return;
+                }
+                RELEASE_ASSERT_NOT_REACHED();
+            });
+        
+        convertToMakeRope(node);
+        return true;
+    }
+
+    void fixupGetAndSetLocalsInBlock(BasicBlock* block)
+    {
+        if (!block)
+            return;
+        ASSERT(block->isReachable);
+        m_block = block;
+        for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
+            Node* node = m_currentNode = block->at(m_indexInBlock);
+            if (node->op() != SetLocal && node->op() != GetLocal)
+                continue;
+            
+            VariableAccessData* variable = node->variableAccessData();
+            switch (node->op()) {
+            case GetLocal:
+                switch (variable->flushFormat()) {
+                case FlushedDouble:
+                    node->setResult(NodeResultDouble);
+                    break;
+                case FlushedInt52:
+                    node->setResult(NodeResultInt52);
+                    break;
+                default:
+                    break;
+                }
+                break;
+                
+            case SetLocal:
+                // NOTE: Any type checks we put here may get hoisted by fixupChecksInBlock(). So, if we
+                // add new type checking use kind for SetLocals, we need to modify that code as well.
+                
+                switch (variable->flushFormat()) {
+                case FlushedJSValue:
+                    break;
+                case FlushedDouble:
+                    fixEdge<DoubleRepUse>(node->child1());
+                    break;
+                case FlushedInt32:
+                    fixEdge<Int32Use>(node->child1());
+                    break;
+                case FlushedInt52:
+                    fixEdge<Int52RepUse>(node->child1());
+                    break;
+                case FlushedCell:
+                    fixEdge<CellUse>(node->child1());
+                    break;
+                case FlushedBoolean:
+                    fixEdge<BooleanUse>(node->child1());
+                    break;
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                    break;
+                }
+                break;
+                
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+        }
+        m_insertionSet.execute(block);
+    }
+    
+    void addStringReplacePrimordialChecks(Node* searchRegExp)
+    {
+        Node* node = m_currentNode;
+
+        // Check that structure of searchRegExp is RegExp object
+        m_insertionSet.insertNode(
+            m_indexInBlock, SpecNone, Check, node->origin,
+            Edge(searchRegExp, RegExpObjectUse));
+
+        auto emitPrimordialCheckFor = [&] (JSValue primordialProperty, UniquedStringImpl* propertyUID) {
+            unsigned index = m_graph.identifiers().ensure(propertyUID);
+
+            Node* actualProperty = m_insertionSet.insertNode(
+                m_indexInBlock, SpecNone, TryGetById, node->origin,
+                OpInfo(index), OpInfo(SpecFunction), Edge(searchRegExp, CellUse));
+
+            m_insertionSet.insertNode(
+                m_indexInBlock, SpecNone, CheckCell, node->origin,
+                OpInfo(m_graph.freeze(primordialProperty)), Edge(actualProperty, CellUse));
+        };
+
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
+
+        // Check that searchRegExp.exec is the primordial RegExp.prototype.exec
+        emitPrimordialCheckFor(globalObject->regExpProtoExecFunction(), vm().propertyNames->exec.impl());
+        // Check that searchRegExp.global is the primordial RegExp.prototype.global
+        emitPrimordialCheckFor(globalObject->regExpProtoGlobalGetter(), vm().propertyNames->global.impl());
+        // Check that searchRegExp.unicode is the primordial RegExp.prototype.unicode
+        emitPrimordialCheckFor(globalObject->regExpProtoUnicodeGetter(), vm().propertyNames->unicode.impl());
+        // Check that searchRegExp[Symbol.match] is the primordial RegExp.prototype[Symbol.replace]
+        emitPrimordialCheckFor(globalObject->regExpProtoSymbolReplaceFunction(), vm().propertyNames->replaceSymbol.impl());
+    }
+
+    Node* checkArray(ArrayMode arrayMode, const NodeOrigin& origin, Node* array, Node* index, bool (*storageCheck)(const ArrayMode&) = canCSEStorage)
+    {
+        ASSERT(arrayMode.isSpecific());
+        
+        if (arrayMode.type() == Array::String) {
+            m_insertionSet.insertNode(
+                m_indexInBlock, SpecNone, Check, origin, Edge(array, StringUse));
+        } else {
+            // Note that we only need to be using a structure check if we opt for SaneChain, since
+            // that needs to protect against JSArray's __proto__ being changed.
+            Structure* structure = arrayMode.originalArrayStructure(m_graph, origin.semantic);
+        
+            Edge indexEdge = index ? Edge(index, Int32Use) : Edge();
+            
+            if (arrayMode.doesConversion()) {
+                if (structure) {
+                    m_insertionSet.insertNode(
+                        m_indexInBlock, SpecNone, ArrayifyToStructure, origin,
+                        OpInfo(m_graph.registerStructure(structure)), OpInfo(arrayMode.asWord()), Edge(array, CellUse), indexEdge);
+                } else {
+                    m_insertionSet.insertNode(
+                        m_indexInBlock, SpecNone, Arrayify, origin,
+                        OpInfo(arrayMode.asWord()), Edge(array, CellUse), indexEdge);
+                }
+            } else {
+                if (structure) {
+                    m_insertionSet.insertNode(
+                        m_indexInBlock, SpecNone, CheckStructure, origin,
+                        OpInfo(m_graph.addStructureSet(structure)), Edge(array, CellUse));
+                } else {
+                    m_insertionSet.insertNode(
+                        m_indexInBlock, SpecNone, CheckArray, origin,
+                        OpInfo(arrayMode.asWord()), Edge(array, CellUse));
+                }
+            }
+        }
+        
+        if (!storageCheck(arrayMode))
+            return nullptr;
+        
+        if (arrayMode.usesButterfly()) {
+            return m_insertionSet.insertNode(
+                m_indexInBlock, SpecNone, GetButterfly, origin, Edge(array, CellUse));
+        }
+        
+        return m_insertionSet.insertNode(
+            m_indexInBlock, SpecNone, GetIndexedPropertyStorage, origin,
+            OpInfo(arrayMode.asWord()), Edge(array, KnownCellUse));
+    }
+    
+    void blessArrayOperation(Edge base, Edge index, Edge& storageChild)
+    {
+        Node* node = m_currentNode;
+        
+        switch (node->arrayMode().type()) {
+        case Array::ForceExit: {
+            m_insertionSet.insertNode(
+                m_indexInBlock, SpecNone, ForceOSRExit, node->origin);
+            return;
+        }
+            
+        case Array::SelectUsingPredictions:
+        case Array::Unprofiled:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+            
+        case Array::Generic:
+            return;
+            
+        default: {
+            Node* storage = checkArray(node->arrayMode(), node->origin, base.node(), index.node());
+            if (!storage)
+                return;
+            
+            storageChild = Edge(storage);
+            return;
+        } }
+    }
+    
+    bool alwaysUnboxSimplePrimitives()
+    {
+#if USE(JSVALUE64)
+        return false;
+#else
+        // Any boolean, int, or cell value is profitable to unbox on 32-bit because it
+        // reduces traffic.
+        return true;
+#endif
+    }
+
+    template<UseKind useKind>
+    void observeUseKindOnNode(Node* node)
+    {
+        if (useKind == UntypedUse)
+            return;
+        observeUseKindOnNode(node, useKind);
+    }
+
+    void observeUseKindOnEdge(Edge edge)
+    {
+        observeUseKindOnNode(edge.node(), edge.useKind());
+    }
+
+    void observeUseKindOnNode(Node* node, UseKind useKind)
+    {
+        if (node->op() != GetLocal)
+            return;
+        
+        // FIXME: The way this uses alwaysUnboxSimplePrimitives() is suspicious.
+        // https://bugs.webkit.org/show_bug.cgi?id=121518
+        
+        VariableAccessData* variable = node->variableAccessData();
+        switch (useKind) {
+        case Int32Use:
+        case KnownInt32Use:
+            if (alwaysUnboxSimplePrimitives()
+                || isInt32Speculation(variable->prediction()))
+                m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
+            break;
+        case NumberUse:
+        case RealNumberUse:
+        case DoubleRepUse:
+        case DoubleRepRealUse:
+            if (variable->doubleFormatState() == UsingDoubleFormat)
+                m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
+            break;
+        case BooleanUse:
+        case KnownBooleanUse:
+            if (alwaysUnboxSimplePrimitives()
+                || isBooleanSpeculation(variable->prediction()))
+                m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
+            break;
+        case Int52RepUse:
+            if (isAnyIntSpeculation(variable->prediction()))
+                m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
+            break;
+        case CellUse:
+        case KnownCellUse:
+        case ObjectUse:
+        case FunctionUse:
+        case StringUse:
+        case KnownStringUse:
+        case SymbolUse:
+        case StringObjectUse:
+        case StringOrStringObjectUse:
+            if (alwaysUnboxSimplePrimitives()
+                || isCellSpeculation(variable->prediction()))
+                m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
+            break;
+        default:
+            break;
+        }
+    }
+    
+    template<UseKind useKind>
+    void fixEdge(Edge& edge)
+    {
+        observeUseKindOnNode<useKind>(edge.node());
+        edge.setUseKind(useKind);
+    }
+    
+    unsigned indexForChecks()
+    {
+        unsigned index = m_indexInBlock;
+        while (!m_block->at(index)->origin.exitOK)
+            index--;
+        return index;
+    }
+    
+    NodeOrigin originForCheck(unsigned index)
+    {
+        return m_block->at(index)->origin.withSemantic(m_currentNode->origin.semantic);
+    }
+    
+    void speculateForBarrier(Edge value)
+    {
+        // Currently, the DFG won't take advantage of this speculation. But, we want to do it in
+        // the DFG anyway because if such a speculation would be wrong, we want to know before
+        // we do an expensive compile.
+        
+        if (value->shouldSpeculateInt32()) {
+            insertCheck<Int32Use>(value.node());
+            return;
+        }
+            
+        if (value->shouldSpeculateBoolean()) {
+            insertCheck<BooleanUse>(value.node());
+            return;
+        }
+            
+        if (value->shouldSpeculateOther()) {
+            insertCheck<OtherUse>(value.node());
+            return;
+        }
+            
+        if (value->shouldSpeculateNumber()) {
+            insertCheck<NumberUse>(value.node());
+            return;
+        }
+            
+        if (value->shouldSpeculateNotCell()) {
+            insertCheck<NotCellUse>(value.node());
+            return;
+        }
+    }
+    
+    template<UseKind useKind>
+    void insertCheck(Node* node)
+    {
+        observeUseKindOnNode<useKind>(node);
+        unsigned index = indexForChecks();
+        m_insertionSet.insertNode(index, SpecNone, Check, originForCheck(index), Edge(node, useKind));
+    }
+
+    void fixIntConvertingEdge(Edge& edge)
+    {
+        Node* node = edge.node();
+        if (node->shouldSpeculateInt32OrBoolean()) {
+            fixIntOrBooleanEdge(edge);
+            return;
+        }
+        
+        UseKind useKind;
+        if (node->shouldSpeculateAnyInt())
+            useKind = Int52RepUse;
+        else if (node->shouldSpeculateNumber())
+            useKind = DoubleRepUse;
+        else
+            useKind = NotCellUse;
+        Node* newNode = m_insertionSet.insertNode(
+            m_indexInBlock, SpecInt32Only, ValueToInt32, m_currentNode->origin,
+            Edge(node, useKind));
+        observeUseKindOnNode(node, useKind);
+        
+        edge = Edge(newNode, KnownInt32Use);
+    }
+    
+    void fixIntOrBooleanEdge(Edge& edge)
+    {
+        Node* node = edge.node();
+        if (!node->sawBooleans()) {
+            fixEdge<Int32Use>(edge);
+            return;
+        }
+        
+        UseKind useKind;
+        if (node->shouldSpeculateBoolean())
+            useKind = BooleanUse;
+        else
+            useKind = UntypedUse;
+        Node* newNode = m_insertionSet.insertNode(
+            m_indexInBlock, SpecInt32Only, BooleanToNumber, m_currentNode->origin,
+            Edge(node, useKind));
+        observeUseKindOnNode(node, useKind);
+        
+        edge = Edge(newNode, Int32Use);
+    }
+    
+    void fixDoubleOrBooleanEdge(Edge& edge)
+    {
+        Node* node = edge.node();
+        if (!node->sawBooleans()) {
+            fixEdge<DoubleRepUse>(edge);
+            return;
+        }
+        
+        UseKind useKind;
+        if (node->shouldSpeculateBoolean())
+            useKind = BooleanUse;
+        else
+            useKind = UntypedUse;
+        Node* newNode = m_insertionSet.insertNode(
+            m_indexInBlock, SpecInt32Only, BooleanToNumber, m_currentNode->origin,
+            Edge(node, useKind));
+        observeUseKindOnNode(node, useKind);
+        
+        edge = Edge(newNode, DoubleRepUse);
+    }
+    
+    void truncateConstantToInt32(Edge& edge)
+    {
+        Node* oldNode = edge.node();
+        
+        JSValue value = oldNode->asJSValue();
+        if (value.isInt32())
+            return;
+        
+        value = jsNumber(JSC::toInt32(value.asNumber()));
+        ASSERT(value.isInt32());
+        edge.setNode(m_insertionSet.insertNode(
+            m_indexInBlock, SpecInt32Only, JSConstant, m_currentNode->origin,
+            OpInfo(m_graph.freeze(value))));
+    }
+    
+    void truncateConstantsIfNecessary(Node* node, AddSpeculationMode mode)
+    {
+        if (mode != SpeculateInt32AndTruncateConstants)
+            return;
+        
+        ASSERT(node->child1()->hasConstant() || node->child2()->hasConstant());
+        if (node->child1()->hasConstant())
+            truncateConstantToInt32(node->child1());
+        else
+            truncateConstantToInt32(node->child2());
+    }
+    
+    bool attemptToMakeIntegerAdd(Node* node)
+    {
+        AddSpeculationMode mode = m_graph.addSpeculationMode(node, FixupPass);
+        if (mode != DontSpeculateInt32) {
+            truncateConstantsIfNecessary(node, mode);
+            fixIntOrBooleanEdge(node->child1());
+            fixIntOrBooleanEdge(node->child2());
+            if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
+                node->setArithMode(Arith::Unchecked);
+            else
+                node->setArithMode(Arith::CheckOverflow);
+            return true;
+        }
+        
+        if (m_graph.addShouldSpeculateAnyInt(node)) {
+            fixEdge<Int52RepUse>(node->child1());
+            fixEdge<Int52RepUse>(node->child2());
+            node->setArithMode(Arith::CheckOverflow);
+            node->setResult(NodeResultInt52);
+            return true;
+        }
+        
+        return false;
+    }
+    
+    bool attemptToMakeGetArrayLength(Node* node)
+    {
+        if (!isInt32Speculation(node->prediction()))
+            return false;
+        CodeBlock* profiledBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
+        ArrayProfile* arrayProfile = 
+            profiledBlock->getArrayProfile(node->origin.semantic.bytecodeIndex);
+        ArrayMode arrayMode = ArrayMode(Array::SelectUsingPredictions);
+        if (arrayProfile) {
+            ConcurrentJSLocker locker(profiledBlock->m_lock);
+            arrayProfile->computeUpdatedPrediction(locker, profiledBlock);
+            arrayMode = ArrayMode::fromObserved(locker, arrayProfile, Array::Read, false);
+            if (arrayMode.type() == Array::Unprofiled) {
+                // For normal array operations, it makes sense to treat Unprofiled
+                // accesses as ForceExit and get more data rather than using
+                // predictions and then possibly ending up with a Generic. But here,
+                // we treat anything that is Unprofiled as Generic and keep the
+                // GetById. I.e. ForceExit = Generic. So, there is no harm - and only
+                // profit - from treating the Unprofiled case as
+                // SelectUsingPredictions.
+                arrayMode = ArrayMode(Array::SelectUsingPredictions);
+            }
+        }
+            
+        arrayMode = arrayMode.refine(
+            m_graph, node, node->child1()->prediction(), node->prediction());
+            
+        if (arrayMode.type() == Array::Generic) {
+            // Check if the input is something that we can't get array length for, but for which we
+            // could insert some conversions in order to transform it into something that we can do it
+            // for.
+            if (node->child1()->shouldSpeculateStringObject())
+                attemptToForceStringArrayModeByToStringConversion<StringObjectUse>(arrayMode, node);
+            else if (node->child1()->shouldSpeculateStringOrStringObject())
+                attemptToForceStringArrayModeByToStringConversion<StringOrStringObjectUse>(arrayMode, node);
+        }
+            
+        if (!arrayMode.supportsSelfLength())
+            return false;
+        
+        convertToGetArrayLength(node, arrayMode);
+        return true;
+    }
+
+    void convertToGetArrayLength(Node* node, ArrayMode arrayMode)
+    {
+        node->setOp(GetArrayLength);
+        node->clearFlags(NodeMustGenerate);
+        fixEdge<KnownCellUse>(node->child1());
+        node->setArrayMode(arrayMode);
+            
+        Node* storage = checkArray(arrayMode, node->origin, node->child1().node(), 0, lengthNeedsStorage);
+        if (!storage)
+            return;
+            
+        node->child2() = Edge(storage);
+    }
+    
+    Node* prependGetArrayLength(NodeOrigin origin, Node* child, ArrayMode arrayMode)
+    {
+        Node* storage = checkArray(arrayMode, origin, child, 0, lengthNeedsStorage);
+        return m_insertionSet.insertNode(
+            m_indexInBlock, SpecInt32Only, GetArrayLength, origin,
+            OpInfo(arrayMode.asWord()), Edge(child, KnownCellUse), Edge(storage));
+    }
+    
+    bool attemptToMakeCallDOM(Node* node)
+    {
+        if (m_graph.hasExitSite(node->origin.semantic, BadType))
+            return false;
+
+        const DOMJIT::Signature* signature = node->signature();
+        if (!signature)
+            return false;
+
+        {
+            unsigned index = 0;
+            bool shouldConvertToCallDOM = true;
+            m_graph.doToChildren(node, [&](Edge& edge) {
+                // Callee. Ignore this. DFGByteCodeParser already emit appropriate checks.
+                if (!index)
+                    return;
+
+                if (index == 1) {
+                    // DOM node case.
+                    if (edge->shouldSpeculateNotCell())
+                        shouldConvertToCallDOM = false;
+                } else {
+                    switch (signature->arguments[index - 2]) {
+                    case SpecString:
+                        if (edge->shouldSpeculateNotString())
+                            shouldConvertToCallDOM = false;
+                        break;
+                    case SpecInt32Only:
+                        if (edge->shouldSpeculateNotInt32())
+                            shouldConvertToCallDOM = false;
+                        break;
+                    case SpecBoolean:
+                        if (edge->shouldSpeculateNotBoolean())
+                            shouldConvertToCallDOM = false;
+                        break;
+                    default:
+                        RELEASE_ASSERT_NOT_REACHED();
+                        break;
+                    }
+                }
+                ++index;
+            });
+            if (!shouldConvertToCallDOM)
+                return false;
+        }
+
+        Node* thisNode = m_graph.varArgChild(node, 1).node();
+        Ref<DOMJIT::Patchpoint> checkDOMPatchpoint = signature->checkDOM();
+        m_graph.m_domJITPatchpoints.append(checkDOMPatchpoint.ptr());
+        Node* checkDOM = m_insertionSet.insertNode(m_indexInBlock, SpecNone, CheckDOM, node->origin, OpInfo(checkDOMPatchpoint.ptr()), OpInfo(signature->classInfo), Edge(thisNode));
+        node->convertToCallDOM(m_graph);
+        fixupCheckDOM(checkDOM);
+        fixupCallDOM(node);
+        return true;
+    }
+
+    void fixupCheckDOM(Node* node)
+    {
+        fixEdge<CellUse>(node->child1());
+    }
+
+    void fixupCallDOM(Node* node)
+    {
+        const DOMJIT::Signature* signature = node->signature();
+        auto fixup = [&](Edge& edge, unsigned argumentIndex) {
+            if (!edge)
+                return;
+            switch (signature->arguments[argumentIndex]) {
+            case SpecString:
+                fixEdge<StringUse>(edge);
+                break;
+            case SpecInt32Only:
+                fixEdge<Int32Use>(edge);
+                break;
+            case SpecBoolean:
+                fixEdge<BooleanUse>(edge);
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+        };
+        fixEdge<CellUse>(node->child1()); // DOM.
+        fixup(node->child2(), 0);
+        fixup(node->child3(), 1);
+    }
+
+    void fixupChecksInBlock(BasicBlock* block)
+    {
+        if (!block)
+            return;
+        ASSERT(block->isReachable);
+        m_block = block;
+        unsigned indexForChecks = UINT_MAX;
+        NodeOrigin originForChecks;
+        for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+            Node* node = block->at(indexInBlock);
+
+            // If this is a node at which we could exit, then save its index. If nodes after this one
+            // cannot exit, then we will hoist checks to here.
+            if (node->origin.exitOK) {
+                indexForChecks = indexInBlock;
+                originForChecks = node->origin;
+            }
+
+            originForChecks = originForChecks.withSemantic(node->origin.semantic);
+            
+            // First, try to relax the representational demands of each node, in order to have
+            // fewer conversions.
+            switch (node->op()) {
+            case MovHint:
+            case Check:
+                m_graph.doToChildren(
+                    node,
+                    [&] (Edge& edge) {
+                        switch (edge.useKind()) {
+                        case DoubleRepUse:
+                        case DoubleRepRealUse:
+                            if (edge->hasDoubleResult())
+                                break;
+            
+                            if (edge->hasInt52Result())
+                                edge.setUseKind(Int52RepUse);
+                            else if (edge.useKind() == DoubleRepUse)
+                                edge.setUseKind(NumberUse);
+                            break;
+            
+                        case Int52RepUse:
+                            // Nothing we can really do.
+                            break;
+            
+                        case UntypedUse:
+                        case NumberUse:
+                            if (edge->hasDoubleResult())
+                                edge.setUseKind(DoubleRepUse);
+                            else if (edge->hasInt52Result())
+                                edge.setUseKind(Int52RepUse);
+                            break;
+            
+                        case RealNumberUse:
+                            if (edge->hasDoubleResult())
+                                edge.setUseKind(DoubleRepRealUse);
+                            else if (edge->hasInt52Result())
+                                edge.setUseKind(Int52RepUse);
+                            break;
+            
+                        default:
+                            break;
+                        }
+                    });
+                break;
+                
+            case ValueToInt32:
+                if (node->child1().useKind() == DoubleRepUse
+                    && !node->child1()->hasDoubleResult()) {
+                    node->child1().setUseKind(NumberUse);
+                    break;
+                }
+                break;
+                
+            default:
+                break;
+            }
+
+            // Now, insert type conversions if necessary.
+            m_graph.doToChildren(
+                node,
+                [&] (Edge& edge) {
+                    Node* result = nullptr;
+
+                    switch (edge.useKind()) {
+                    case DoubleRepUse:
+                    case DoubleRepRealUse:
+                    case DoubleRepAnyIntUse: {
+                        if (edge->hasDoubleResult())
+                            break;
+            
+                        if (edge->isNumberConstant()) {
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecBytecodeDouble, DoubleConstant, originForChecks,
+                                OpInfo(m_graph.freeze(jsDoubleNumber(edge->asNumber()))));
+                        } else if (edge->hasInt52Result()) {
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecAnyIntAsDouble, DoubleRep, originForChecks,
+                                Edge(edge.node(), Int52RepUse));
+                        } else {
+                            UseKind useKind;
+                            if (edge->shouldSpeculateDoubleReal())
+                                useKind = RealNumberUse;
+                            else if (edge->shouldSpeculateNumber())
+                                useKind = NumberUse;
+                            else
+                                useKind = NotCellUse;
+
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecBytecodeDouble, DoubleRep, originForChecks,
+                                Edge(edge.node(), useKind));
+                        }
+
+                        edge.setNode(result);
+                        break;
+                    }
+            
+                    case Int52RepUse: {
+                        if (edge->hasInt52Result())
+                            break;
+            
+                        if (edge->isAnyIntConstant()) {
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecAnyInt, Int52Constant, originForChecks,
+                                OpInfo(edge->constant()));
+                        } else if (edge->hasDoubleResult()) {
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecAnyInt, Int52Rep, originForChecks,
+                                Edge(edge.node(), DoubleRepAnyIntUse));
+                        } else if (edge->shouldSpeculateInt32ForArithmetic()) {
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecInt32Only, Int52Rep, originForChecks,
+                                Edge(edge.node(), Int32Use));
+                        } else {
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecAnyInt, Int52Rep, originForChecks,
+                                Edge(edge.node(), AnyIntUse));
+                        }
+
+                        edge.setNode(result);
+                        break;
+                    }
+
+                    default: {
+                        if (!edge->hasDoubleResult() && !edge->hasInt52Result())
+                            break;
+            
+                        if (edge->hasDoubleResult()) {
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecBytecodeDouble, ValueRep, originForChecks,
+                                Edge(edge.node(), DoubleRepUse));
+                        } else {
+                            result = m_insertionSet.insertNode(
+                                indexForChecks, SpecInt32Only | SpecAnyIntAsDouble, ValueRep,
+                                originForChecks, Edge(edge.node(), Int52RepUse));
+                        }
+
+                        edge.setNode(result);
+                        break;
+                    } }
+
+                    // It's remotely possible that this node cannot do type checks, but we now have a
+                    // type check on this node. We don't have to handle the general form of this
+                    // problem. It only arises when ByteCodeParser emits an immediate SetLocal, rather
+                    // than a delayed one. So, we only worry about those checks that we may have put on
+                    // a SetLocal. Note that "indexForChecks != indexInBlock" is just another way of
+                    // saying "!node->origin.exitOK".
+                    if (indexForChecks != indexInBlock && mayHaveTypeCheck(edge.useKind())) {
+                        UseKind knownUseKind;
+                        
+                        switch (edge.useKind()) {
+                        case Int32Use:
+                            knownUseKind = KnownInt32Use;
+                            break;
+                        case CellUse:
+                            knownUseKind = KnownCellUse;
+                            break;
+                        case BooleanUse:
+                            knownUseKind = KnownBooleanUse;
+                            break;
+                        default:
+                            // This can only arise if we have a Check node, and in that case, we can
+                            // just remove the original check.
+                            DFG_ASSERT(m_graph, node, node->op() == Check);
+                            knownUseKind = UntypedUse;
+                            break;
+                        }
+
+                        m_insertionSet.insertNode(
+                            indexForChecks, SpecNone, Check, originForChecks, edge);
+
+                        edge.setUseKind(knownUseKind);
+                    }
+                });
+        }
+        
+        m_insertionSet.execute(block);
+    }
+    
+    BasicBlock* m_block;
+    unsigned m_indexInBlock;
+    Node* m_currentNode;
+    InsertionSet m_insertionSet;
+    bool m_profitabilityChanged;
+};
+    
+bool performFixup(Graph& graph)
+{
+    return runPhase<FixupPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGFixupPhase.h b/dfg/DFGFixupPhase.h
new file mode 100644
index 0000000..67ff44b
--- /dev/null
+++ b/dfg/DFGFixupPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Fix portions of the graph that are inefficient given the predictions that
+// we have. This should run after prediction propagation but before CSE.
+
+bool performFixup(Graph&);
+
+} } // namespace JSC::DFG::Phase
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGFlowIndexing.cpp b/dfg/DFGFlowIndexing.cpp
new file mode 100644
index 0000000..73c1869
--- /dev/null
+++ b/dfg/DFGFlowIndexing.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGFlowIndexing.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+FlowIndexing::FlowIndexing(Graph& graph)
+    : m_graph(graph)
+    , m_numIndices(0)
+{
+    recompute();
+}
+
+FlowIndexing::~FlowIndexing()
+{
+}
+
+void FlowIndexing::recompute()
+{
+    unsigned numNodeIndices = m_graph.maxNodeCount();
+    
+    m_nodeIndexToShadowIndex.resize(numNodeIndices);
+    m_nodeIndexToShadowIndex.fill(UINT_MAX);
+    
+    m_shadowIndexToNodeIndex.resize(0);
+
+    m_numIndices = numNodeIndices;
+
+    for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+        for (Node* node : *block) {
+            if (node->op() != Phi)
+                continue;
+            
+            unsigned nodeIndex = node->index();
+            unsigned shadowIndex = m_numIndices++;
+            m_nodeIndexToShadowIndex[nodeIndex] = shadowIndex;
+            m_shadowIndexToNodeIndex.append(nodeIndex);
+            DFG_ASSERT(m_graph, nullptr, m_shadowIndexToNodeIndex.size() + numNodeIndices == m_numIndices);
+            DFG_ASSERT(m_graph, nullptr, m_shadowIndexToNodeIndex[shadowIndex - numNodeIndices] == nodeIndex);
+        }
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGFlowIndexing.h b/dfg/DFGFlowIndexing.h
new file mode 100644
index 0000000..2b60525
--- /dev/null
+++ b/dfg/DFGFlowIndexing.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGNodeFlowProjection.h"
+
+namespace JSC { namespace DFG {
+
+// This is a mapping from nodes to unique, dense indices that can be used for creating fast
+// Node-keyed maps. The special part is that it also allocated indices for the shadow values of Phi
+// nodes, which is needed for any flow-sensitive analysis.
+class FlowIndexing {
+public:
+    FlowIndexing(Graph&);
+    ~FlowIndexing();
+    
+    void recompute();
+    
+    Graph& graph() const { return m_graph; }
+    
+    unsigned numIndices() const { return m_numIndices; }
+    
+    unsigned index(unsigned nodeIndex) const { return nodeIndex; }
+    
+    unsigned index(Node* node) const { return index(node->index()); }
+    
+    unsigned shadowIndex(unsigned nodeIndex) const
+    {
+        return m_nodeIndexToShadowIndex[nodeIndex];
+    }
+    
+    unsigned shadowIndex(Node* node) const
+    {
+        DFG_ASSERT(m_graph, node, node->op() == Phi);
+        return shadowIndex(node->index());
+    }
+    
+    unsigned index(unsigned nodeIndex, NodeFlowProjection::Kind kind) const
+    {
+        switch (kind) {
+        case NodeFlowProjection::Primary:
+            return index(nodeIndex);
+        case NodeFlowProjection::Shadow:
+            return shadowIndex(nodeIndex);
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+    
+    unsigned index(Node *node, NodeFlowProjection::Kind kind) const
+    {
+        switch (kind) {
+        case NodeFlowProjection::Primary:
+            return index(node);
+        case NodeFlowProjection::Shadow:
+            return shadowIndex(node);
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+    
+    unsigned index(NodeFlowProjection projection) const
+    {
+        return index(projection.node(), projection.kind());
+    }
+    
+    NodeFlowProjection nodeProjection(unsigned index) const
+    {
+        if (index < m_nodeIndexToShadowIndex.size())
+            return NodeFlowProjection(m_graph.nodeAt(index));
+        return NodeFlowProjection(
+            m_graph.nodeAt(m_shadowIndexToNodeIndex[index - m_nodeIndexToShadowIndex.size()]),
+            NodeFlowProjection::Shadow);
+    }
+    
+private:
+    Graph& m_graph;
+    unsigned m_numIndices;
+    Vector<unsigned, 0, UnsafeVectorOverflow> m_nodeIndexToShadowIndex;
+    Vector<unsigned, 0, UnsafeVectorOverflow> m_shadowIndexToNodeIndex;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGFlowMap.h b/dfg/DFGFlowMap.h
new file mode 100644
index 0000000..7f3d121
--- /dev/null
+++ b/dfg/DFGFlowMap.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGFlowIndexing.h"
+#include "DFGGraph.h"
+#include "DFGNode.h"
+
+namespace JSC { namespace DFG {
+
+// This is a mapping from nodes to values that is useful for flow-sensitive analysis. In such an
+// analysis, at every point in the program we need to consider the values of nodes plus the shadow
+// values of Phis. This makes it easy to do both of those things.
+template<typename T>
+class FlowMap {
+public:
+    FlowMap(Graph& graph)
+        : m_graph(graph)
+    {
+        resize();
+    }
+    
+    // Call this if the number of nodes in the graph has changed. Note that this does not reset any
+    // entries.
+    void resize()
+    {
+        m_map.resize(m_graph.maxNodeCount());
+        m_shadowMap.resize(m_graph.maxNodeCount());
+    }
+    
+    Graph& graph() const { return m_graph; }
+    
+    T& at(unsigned nodeIndex)
+    {
+        return m_map[nodeIndex];
+    }
+    
+    T& at(Node* node)
+    {
+        return at(node->index());
+    }
+    
+    T& atShadow(unsigned nodeIndex)
+    {
+        return m_shadowMap[nodeIndex];
+    }
+    
+    T& atShadow(Node* node)
+    {
+        return atShadow(node->index());
+    }
+    
+    T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind)
+    {
+        switch (kind) {
+        case NodeFlowProjection::Primary:
+            return at(nodeIndex);
+        case NodeFlowProjection::Shadow:
+            return atShadow(nodeIndex);
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return *bitwise_cast<T*>(nullptr);
+    }
+    
+    T& at(Node* node, NodeFlowProjection::Kind kind)
+    {
+        return at(node->index(), kind);
+    }
+    
+    T& at(NodeFlowProjection projection)
+    {
+        return at(projection.node(), projection.kind());
+    }
+    
+    const T& at(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->at(nodeIndex); }
+    const T& at(Node* node) const { return const_cast<FlowMap*>(this)->at(node); }
+    const T& atShadow(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->atShadow(nodeIndex); }
+    const T& atShadow(Node* node) const { return const_cast<FlowMap*>(this)->atShadow(node); }
+    const T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(nodeIndex, kind); }
+    const T& at(Node* node, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(node, kind); }
+    const T& at(NodeFlowProjection projection) const { return const_cast<FlowMap*>(this)->at(projection); }
+    
+private:
+    Graph& m_graph;
+    Vector<T, 0, UnsafeVectorOverflow> m_map;
+    Vector<T, 0, UnsafeVectorOverflow> m_shadowMap;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T>
+void printInternal(PrintStream& out, const JSC::DFG::FlowMap<T>& map)
+{
+    CommaPrinter comma;
+    for (unsigned i = 0; i < map.graph().maxNodeCount(); ++i) {
+        if (JSC::DFG::Node* node = map.graph().nodeAt(i)) {
+            if (const T& value = map.at(node))
+                out.print(comma, node, "=>", value);
+        }
+    }
+    for (unsigned i = 0; i < map.graph().maxNodeCount(); ++i) {
+        if (JSC::DFG::Node* node = map.graph().nodeAt(i)) {
+            if (const T& value = map.atShadow(node))
+                out.print(comma, "shadow(", node, ")=>", value);
+        }
+    }
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGFlushFormat.cpp b/dfg/DFGFlushFormat.cpp
new file mode 100644
index 0000000..fa483ac
--- /dev/null
+++ b/dfg/DFGFlushFormat.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGFlushFormat.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, FlushFormat format)
+{
+    switch (format) {
+    case DeadFlush:
+        out.print("DeadFlush");
+        return;
+    case FlushedInt32:
+        out.print("FlushedInt32");
+        return;
+    case FlushedInt52:
+        out.print("FlushedInt52");
+        return;
+    case FlushedDouble:
+        out.print("FlushedDouble");
+        return;
+    case FlushedCell:
+        out.print("FlushedCell");
+        return;
+    case FlushedBoolean:
+        out.print("FlushedBoolean");
+        return;
+    case FlushedJSValue:
+        out.print("FlushedJSValue");
+        return;
+    case ConflictingFlush:
+        out.print("ConflictingFlush");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGFlushFormat.h b/dfg/DFGFlushFormat.h
new file mode 100644
index 0000000..f7084fb
--- /dev/null
+++ b/dfg/DFGFlushFormat.h
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNodeFlags.h"
+#include "DFGUseKind.h"
+#include "DataFormat.h"
+#include "DumpContext.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+enum FlushFormat {
+    DeadFlush,
+    FlushedInt32,
+    FlushedInt52,
+    FlushedDouble,
+    FlushedCell,
+    FlushedBoolean,
+    FlushedJSValue,
+    ConflictingFlush
+};
+
+inline NodeFlags resultFor(FlushFormat format)
+{
+    switch (format) {
+    case DeadFlush:
+    case FlushedJSValue:
+    case FlushedCell:
+    case ConflictingFlush:
+        return NodeResultJS;
+    case FlushedInt32:
+        return NodeResultInt32;
+    case FlushedInt52:
+        return NodeResultInt52;
+    case FlushedDouble:
+        return NodeResultDouble;
+    case FlushedBoolean:
+        return NodeResultBoolean;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+inline UseKind useKindFor(FlushFormat format)
+{
+    switch (format) {
+    case DeadFlush:
+    case FlushedJSValue:
+    case ConflictingFlush:
+        return UntypedUse;
+    case FlushedCell:
+        return CellUse;
+    case FlushedInt32:
+        return Int32Use;
+    case FlushedInt52:
+        return Int52RepUse;
+    case FlushedDouble:
+        return DoubleRepUse;
+    case FlushedBoolean:
+        return BooleanUse;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return UntypedUse;
+}
+
+inline UseKind uncheckedUseKindFor(FlushFormat format)
+{
+    switch (format) {
+    case DeadFlush:
+    case FlushedJSValue:
+    case ConflictingFlush:
+        return UntypedUse;
+    case FlushedCell:
+        return KnownCellUse;
+    case FlushedInt32:
+        return KnownInt32Use;
+    case FlushedInt52:
+        return Int52RepUse;
+    case FlushedDouble:
+        return DoubleRepUse;
+    case FlushedBoolean:
+        return KnownBooleanUse;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return UntypedUse;
+}
+
+inline SpeculatedType typeFilterFor(FlushFormat format)
+{
+    return typeFilterFor(useKindFor(format));
+}
+
+inline DataFormat dataFormatFor(FlushFormat format)
+{
+    switch (format) {
+    case DeadFlush:
+    case ConflictingFlush:
+        return DataFormatDead;
+    case FlushedJSValue:
+        return DataFormatJS;
+    case FlushedDouble:
+        return DataFormatDouble;
+    case FlushedInt32:
+        return DataFormatInt32;
+    case FlushedInt52:
+        return DataFormatInt52;
+    case FlushedCell:
+        return DataFormatCell;
+    case FlushedBoolean:
+        return DataFormatBoolean;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return DataFormatDead;
+}
+
+inline FlushFormat merge(FlushFormat a, FlushFormat b)
+{
+    if (a == DeadFlush)
+        return b;
+    if (b == DeadFlush)
+        return a;
+    if (a == b)
+        return a;
+    return ConflictingFlush;
+}
+
+inline bool isConcrete(FlushFormat format)
+{
+    return format != DeadFlush && format != ConflictingFlush;
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::FlushFormat);
+
+inline JSC::DFG::FlushFormat inContext(JSC::DFG::FlushFormat format, JSC::DumpContext*)
+{
+    return format;
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGFlushedAt.cpp b/dfg/DFGFlushedAt.cpp
new file mode 100644
index 0000000..c15a2e6
--- /dev/null
+++ b/dfg/DFGFlushedAt.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGFlushedAt.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void FlushedAt::dump(PrintStream& out) const
+{
+    if (m_format == DeadFlush || m_format == ConflictingFlush)
+        out.print(m_format);
+    else if (m_virtualRegister.isValid())
+        out.print(m_virtualRegister, ":", m_format);
+    else
+        out.print(m_format);
+}
+
+void FlushedAt::dumpInContext(PrintStream& out, DumpContext*) const
+{
+    dump(out);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGFlushedAt.h b/dfg/DFGFlushedAt.h
new file mode 100644
index 0000000..11ace45
--- /dev/null
+++ b/dfg/DFGFlushedAt.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGFlushFormat.h"
+#include "VirtualRegister.h"
+
+namespace JSC { namespace DFG {
+
+class FlushedAt {
+public:
+    FlushedAt()
+        : m_format(DeadFlush)
+    {
+    }
+    
+    explicit FlushedAt(FlushFormat format)
+        : m_format(format)
+    {
+        ASSERT(format == DeadFlush || format == ConflictingFlush);
+    }
+    
+    FlushedAt(FlushFormat format, VirtualRegister virtualRegister)
+        : m_format(format)
+        , m_virtualRegister(virtualRegister)
+    {
+        if (format == DeadFlush)
+            ASSERT(!virtualRegister.isValid());
+    }
+    
+    bool operator!() const { return m_format == DeadFlush; }
+    
+    FlushFormat format() const { return m_format; }
+    VirtualRegister virtualRegister() const { return m_virtualRegister; }
+    
+    bool operator==(const FlushedAt& other) const
+    {
+        return m_format == other.m_format
+            && m_virtualRegister == other.m_virtualRegister;
+    }
+    
+    bool operator!=(const FlushedAt& other) const { return !(*this == other); }
+    
+    FlushedAt merge(const FlushedAt& other) const
+    {
+        if (!*this)
+            return other;
+        if (!other)
+            return *this;
+        if (*this == other)
+            return *this;
+        return FlushedAt(ConflictingFlush);
+    }
+    
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    
+private:
+    FlushFormat m_format;
+    VirtualRegister m_virtualRegister;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGForAllKills.h b/dfg/DFGForAllKills.h
new file mode 100644
index 0000000..ac13301
--- /dev/null
+++ b/dfg/DFGForAllKills.h
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGCombinedLiveness.h"
+#include "DFGGraph.h"
+#include "DFGOSRAvailabilityAnalysisPhase.h"
+#include "FullBytecodeLiveness.h"
+
+namespace JSC { namespace DFG {
+
+// Utilities for finding the last points where a node is live in DFG SSA. This accounts for liveness due
+// to OSR exit. This is usually used for enumerating over all of the program points where a node is live,
+// by exploring all blocks where the node is live at tail and then exploring all program points where the
+// node is killed. A prerequisite to using these utilities is having liveness and OSR availability
+// computed.
+
+// This tells you those things that die on the boundary between nodeBefore and nodeAfter. It is
+// conservative in the sense that it might resort to telling you some things that are still live at
+// nodeAfter.
+template<typename Functor>
+void forAllKilledOperands(Graph& graph, Node* nodeBefore, Node* nodeAfter, const Functor& functor)
+{
+    CodeOrigin before = nodeBefore->origin.forExit;
+
+    if (!nodeAfter) {
+        graph.forAllLiveInBytecode(before, functor);
+        return;
+    }
+    
+    CodeOrigin after = nodeAfter->origin.forExit;
+    
+    VirtualRegister alreadyNoted;
+    // If we MovHint something that is live at the time, then we kill the old value.
+    if (nodeAfter->containsMovHint()) {
+        VirtualRegister reg = nodeAfter->unlinkedLocal();
+        if (graph.isLiveInBytecode(reg, after)) {
+            functor(reg);
+            alreadyNoted = reg;
+        }
+    }
+    
+    if (before == after)
+        return;
+    
+    // It's easier to do this if the inline call frames are the same. This is way faster than the
+    // other loop, below.
+    if (before.inlineCallFrame == after.inlineCallFrame) {
+        int stackOffset = before.inlineCallFrame ? before.inlineCallFrame->stackOffset : 0;
+        CodeBlock* codeBlock = graph.baselineCodeBlockFor(before.inlineCallFrame);
+        FullBytecodeLiveness& fullLiveness = graph.livenessFor(codeBlock);
+        const FastBitVector& liveBefore = fullLiveness.getLiveness(before.bytecodeIndex);
+        const FastBitVector& liveAfter = fullLiveness.getLiveness(after.bytecodeIndex);
+        
+        (liveBefore & ~liveAfter).forEachSetBit(
+            [&] (size_t relativeLocal) {
+                functor(virtualRegisterForLocal(relativeLocal) + stackOffset);
+            });
+        return;
+    }
+    
+    // Detect kills the super conservative way: it is killed if it was live before and dead after.
+    BitVector liveAfter = graph.localsLiveInBytecode(after);
+    graph.forAllLocalsLiveInBytecode(
+        before,
+        [&] (VirtualRegister reg) {
+            if (reg == alreadyNoted)
+                return;
+            if (liveAfter.get(reg.toLocal()))
+                return;
+            functor(reg);
+        });
+}
+    
+// Tells you all of the nodes that would no longer be live across the node at this nodeIndex.
+template<typename Functor>
+void forAllKilledNodesAtNodeIndex(
+    Graph& graph, AvailabilityMap& availabilityMap, BasicBlock* block, unsigned nodeIndex,
+    const Functor& functor)
+{
+    static const unsigned seenInClosureFlag = 1;
+    static const unsigned calledFunctorFlag = 2;
+    HashMap<Node*, unsigned> flags;
+    
+    Node* node = block->at(nodeIndex);
+    
+    graph.doToChildren(
+        node,
+        [&] (Edge edge) {
+            if (edge.doesKill()) {
+                auto& result = flags.add(edge.node(), 0).iterator->value;
+                if (!(result & calledFunctorFlag)) {
+                    functor(edge.node());
+                    result |= calledFunctorFlag;
+                }
+            }
+        });
+
+    Node* before = nullptr;
+    if (nodeIndex)
+        before = block->at(nodeIndex - 1);
+
+    forAllKilledOperands(
+        graph, before, node,
+        [&] (VirtualRegister reg) {
+            availabilityMap.closeStartingWithLocal(
+                reg,
+                [&] (Node* node) -> bool {
+                    return flags.get(node) & seenInClosureFlag;
+                },
+                [&] (Node* node) -> bool {
+                    auto& resultFlags = flags.add(node, 0).iterator->value;
+                    bool result = resultFlags & seenInClosureFlag;
+                    if (!(resultFlags & calledFunctorFlag))
+                        functor(node);
+                    resultFlags |= seenInClosureFlag | calledFunctorFlag;
+                    return result;
+                });
+        });
+}
+
+// Tells you all of the places to start searching from in a basic block. Gives you the node index at which
+// the value is either no longer live. This pretends that nodes are dead at the end of the block, so that
+// you can use this to do per-basic-block analyses.
+template<typename Functor>
+void forAllKillsInBlock(
+    Graph& graph, const CombinedLiveness& combinedLiveness, BasicBlock* block,
+    const Functor& functor)
+{
+    for (Node* node : combinedLiveness.liveAtTail[block])
+        functor(block->size(), node);
+    
+    LocalOSRAvailabilityCalculator localAvailability(graph);
+    localAvailability.beginBlock(block);
+    // Start at the second node, because the functor is expected to only inspect nodes from the start of
+    // the block up to nodeIndex (exclusive), so if nodeIndex is zero then the functor has nothing to do.
+    for (unsigned nodeIndex = 1; nodeIndex < block->size(); ++nodeIndex) {
+        forAllKilledNodesAtNodeIndex(
+            graph, localAvailability.m_availability, block, nodeIndex,
+            [&] (Node* node) {
+                functor(nodeIndex, node);
+            });
+        localAvailability.executeNode(block->at(nodeIndex));
+    }
+}
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGFrozenValue.cpp b/dfg/DFGFrozenValue.cpp
new file mode 100644
index 0000000..39c09ad
--- /dev/null
+++ b/dfg/DFGFrozenValue.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGFrozenValue.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGLazyJSValue.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+FrozenValue* FrozenValue::emptySingleton()
+{
+    static FrozenValue empty;
+    return &empty;
+}
+
+String FrozenValue::tryGetString(Graph& graph)
+{
+    return LazyJSValue(this).tryGetString(graph);
+}
+
+void FrozenValue::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    if (!!m_value && m_value.isCell())
+        out.print(m_strength, ":");
+    m_value.dumpInContextAssumingStructure(out, context, m_structure);
+}
+
+void FrozenValue::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGFrozenValue.h b/dfg/DFGFrozenValue.h
new file mode 100644
index 0000000..a1ef57f
--- /dev/null
+++ b/dfg/DFGFrozenValue.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGValueStrength.h"
+#include "JSCell.h"
+#include "JSCJSValue.h"
+#include "Structure.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+class FrozenValue {
+public:
+    FrozenValue()
+        : m_structure(nullptr)
+        , m_strength(WeakValue)
+    {
+    }
+    
+    FrozenValue(JSValue value)
+        : m_value(value)
+        , m_structure(nullptr)
+        , m_strength(WeakValue)
+    {
+        RELEASE_ASSERT(!value || !value.isCell());
+    }
+    
+    FrozenValue(JSValue value, Structure* structure, ValueStrength strength)
+        : m_value(value)
+        , m_structure(structure)
+        , m_strength(strength)
+    {
+        ASSERT((!!value && value.isCell()) == !!structure);
+        ASSERT(!value || !value.isCell() || value.asCell()->classInfo() == structure->classInfo());
+        ASSERT(!!structure || (strength == WeakValue));
+    }
+    
+    static FrozenValue* emptySingleton();
+    
+    bool operator!() const { return !m_value; }
+    
+    JSValue value() const { return m_value; }
+    JSCell* cell() const { return m_value.asCell(); }
+    
+    template<typename T>
+    T dynamicCast()
+    {
+        JSValue theValue = value();
+        if (!theValue)
+            return nullptr;
+        return jsDynamicCast<T>(theValue);
+    }
+    template<typename T>
+    T cast()
+    {
+        return jsCast<T>(value());
+    }
+    
+    Structure* structure() const { return m_structure; }
+    
+    void strengthenTo(ValueStrength strength)
+    {
+        if (!!m_value && m_value.isCell())
+            m_strength = merge(m_strength, strength);
+    }
+    
+    bool pointsToHeap() const { return !!value() && value().isCell(); }
+    
+    // The strength of the value itself. The structure is almost always weak.
+    ValueStrength strength() const { return m_strength; }
+
+    String tryGetString(Graph&);
+    
+    void dumpInContext(PrintStream& out, DumpContext* context) const;
+    void dump(PrintStream& out) const;
+    
+private:
+    friend class Graph;
+    
+    // This is a utility method for DFG::Graph::freeze(). You should almost always call
+    // Graph::freeze() directly. Calling this instead of Graph::freeze() can result in
+    // the same constant being viewed as having different structures during the course
+    // of compilation, which can sometimes cause bad things to happen. For example, we
+    // may observe that one version of the constant has an unwatchable structure but
+    // then a later version may start to have a watchable structure due to a transition.
+    // The point of freezing is to ensure that we generally only see one version of
+    // constants, but that requires freezing through the Graph.
+    static FrozenValue freeze(JSValue value)
+    {
+        return FrozenValue(
+            value,
+            (!!value && value.isCell()) ? value.asCell()->structure() : nullptr,
+            WeakValue);
+    }
+
+    JSValue m_value;
+    Structure* m_structure;
+    ValueStrength m_strength;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGGenerationInfo.h b/dfg/DFGGenerationInfo.h
new file mode 100644
index 0000000..e9df841
--- /dev/null
+++ b/dfg/DFGGenerationInfo.h
@@ -0,0 +1,453 @@
+/*
+ * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGJITCompiler.h"
+#include "DFGMinifiedID.h"
+#include "DFGVariableEvent.h"
+#include "DFGVariableEventStream.h"
+#include "DataFormat.h"
+
+namespace JSC { namespace DFG {
+
+// === GenerationInfo ===
+//
+// This class is used to track the current status of live values during code generation.
+// Can provide information as to whether a value is in machine registers, and if so which,
+// whether a value has been spilled to the RegisterFile, and if so may be able to provide
+// details of the format in memory (all values are spilled in a boxed form, but we may be
+// able to track the type of box), and tracks how many outstanding uses of a value remain,
+// so that we know when the value is dead and the machine registers associated with it
+// may be released.
+class GenerationInfo {
+public:
+    GenerationInfo()
+        : m_node(0)
+        , m_useCount(0)
+        , m_registerFormat(DataFormatNone)
+        , m_spillFormat(DataFormatNone)
+        , m_canFill(false)
+        , m_bornForOSR(false)
+        , m_isConstant(false)
+    {
+    }
+
+    void initConstant(Node* node, uint32_t useCount)
+    {
+        m_node = node;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = DataFormatNone;
+        m_canFill = true;
+        m_bornForOSR = false;
+        m_isConstant = true;
+        ASSERT(m_useCount);
+    }
+    void initGPR(Node* node, uint32_t useCount, GPRReg gpr, DataFormat format)
+    {
+        ASSERT(gpr != InvalidGPRReg);
+        m_node = node;
+        m_useCount = useCount;
+        m_registerFormat = format;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.gpr = gpr;
+        m_bornForOSR = false;
+        m_isConstant = false;
+        ASSERT(m_useCount);
+    }
+    void initInt32(Node* node, uint32_t useCount, GPRReg gpr)
+    {
+        initGPR(node, useCount, gpr, DataFormatInt32);
+    }
+    void initInt52(Node* node, uint32_t useCount, GPRReg reg, DataFormat format)
+    {
+        ASSERT(format == DataFormatInt52 || format == DataFormatStrictInt52);
+        initGPR(node, useCount, reg, format);
+    }
+    void initInt52(Node* node, uint32_t useCount, GPRReg reg)
+    {
+        initGPR(node, useCount, reg, DataFormatInt52);
+    }
+    void initStrictInt52(Node* node, uint32_t useCount, GPRReg reg)
+    {
+        initGPR(node, useCount, reg, DataFormatStrictInt52);
+    }
+#if USE(JSVALUE64)
+    void initJSValue(Node* node, uint32_t useCount, GPRReg gpr, DataFormat format = DataFormatJS)
+    {
+        ASSERT(format & DataFormatJS);
+        initGPR(node, useCount, gpr, format);
+    }
+#elif USE(JSVALUE32_64)
+    void initJSValue(Node* node, uint32_t useCount, GPRReg tagGPR, GPRReg payloadGPR, DataFormat format = DataFormatJS)
+    {
+        ASSERT(format & DataFormatJS);
+
+        m_node = node;
+        m_useCount = useCount;
+        m_registerFormat = format;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.v.tagGPR = tagGPR;
+        u.v.payloadGPR = payloadGPR;
+        m_bornForOSR = false;
+        m_isConstant = false;
+        ASSERT(m_useCount);
+    }
+#endif
+    void initCell(Node* node, uint32_t useCount, GPRReg gpr)
+    {
+        initGPR(node, useCount, gpr, DataFormatCell);
+    }
+    void initBoolean(Node* node, uint32_t useCount, GPRReg gpr)
+    {
+        initGPR(node, useCount, gpr, DataFormatBoolean);
+    }
+    void initDouble(Node* node, uint32_t useCount, FPRReg fpr)
+    {
+        ASSERT(fpr != InvalidFPRReg);
+        m_node = node;
+        m_useCount = useCount;
+        m_registerFormat = DataFormatDouble;
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+        u.fpr = fpr;
+        m_bornForOSR = false;
+        m_isConstant = false;
+        ASSERT(m_useCount);
+    }
+    void initStorage(Node* node, uint32_t useCount, GPRReg gpr)
+    {
+        initGPR(node, useCount, gpr, DataFormatStorage);
+    }
+
+    // Get the node that produced this value.
+    Node* node() { return m_node; }
+    
+    void noticeOSRBirth(VariableEventStream& stream, Node* node, VirtualRegister virtualRegister)
+    {
+        if (m_node != node)
+            return;
+        if (!alive())
+            return;
+        if (m_bornForOSR)
+            return;
+        
+        m_bornForOSR = true;
+        
+        if (m_isConstant)
+            appendBirth(stream);
+        else if (m_registerFormat != DataFormatNone)
+            appendFill(BirthToFill, stream);
+        else if (m_spillFormat != DataFormatNone)
+            appendSpill(BirthToSpill, stream, virtualRegister);
+    }
+
+    // Mark the value as having been used (decrement the useCount).
+    // Returns true if this was the last use of the value, and any
+    // associated machine registers may be freed.
+    bool use(VariableEventStream& stream)
+    {
+        ASSERT(m_useCount);
+        bool result = !--m_useCount;
+        
+        if (result && m_bornForOSR) {
+            ASSERT(m_node);
+            stream.appendAndLog(VariableEvent::death(MinifiedID(m_node)));
+        }
+        
+        return result;
+    }
+
+    // Used to check the operands of operations to see if they are on
+    // their last use; in some cases it may be safe to reuse the same
+    // machine register for the result of the operation.
+    uint32_t useCount()
+    {
+        ASSERT(m_useCount);
+        return m_useCount;
+    }
+
+    // Get the format of the value in machine registers (or 'none').
+    DataFormat registerFormat() { return m_registerFormat; }
+    // Get the format of the value as it is spilled in the JSStack (or 'none').
+    DataFormat spillFormat() { return m_spillFormat; }
+    
+    bool isFormat(DataFormat expectedFormat)
+    {
+        return registerFormat() == expectedFormat || spillFormat() == expectedFormat;
+    }
+    
+    bool isJSFormat(DataFormat expectedFormat)
+    {
+        return JSC::isJSFormat(registerFormat(), expectedFormat) || JSC::isJSFormat(spillFormat(), expectedFormat);
+    }
+    
+    bool isJSInt32()
+    {
+        return isJSFormat(DataFormatJSInt32);
+    }
+    
+    bool isInt52()
+    {
+        return isFormat(DataFormatInt52);
+    }
+    
+    bool isStrictInt52()
+    {
+        return isFormat(DataFormatStrictInt52);
+    }
+    
+    bool isJSDouble()
+    {
+        return isJSFormat(DataFormatJSDouble);
+    }
+    
+    bool isJSCell()
+    {
+        return isJSFormat(DataFormatJSCell);
+    }
+    
+    bool isJSBoolean()
+    {
+        return isJSFormat(DataFormatJSBoolean);
+    }
+    
+    bool isUnknownJS()
+    {
+        return spillFormat() == DataFormatNone
+            ? registerFormat() == DataFormatJS || registerFormat() == DataFormatNone
+            : spillFormat() == DataFormatJS;
+    }
+
+    // Get the machine resister currently holding the value.
+#if USE(JSVALUE64)
+    GPRReg gpr() { ASSERT(m_registerFormat && m_registerFormat != DataFormatDouble); return u.gpr; }
+    FPRReg fpr() { ASSERT(m_registerFormat == DataFormatDouble); return u.fpr; }
+    JSValueRegs jsValueRegs() { ASSERT(m_registerFormat & DataFormatJS); return JSValueRegs(u.gpr); }
+#elif USE(JSVALUE32_64)
+    GPRReg gpr() { ASSERT(!(m_registerFormat & DataFormatJS) && m_registerFormat != DataFormatDouble); return u.gpr; }
+    GPRReg tagGPR() { ASSERT(m_registerFormat & DataFormatJS); return u.v.tagGPR; }
+    GPRReg payloadGPR() { ASSERT(m_registerFormat & DataFormatJS); return u.v.payloadGPR; }
+    FPRReg fpr() { ASSERT(m_registerFormat == DataFormatDouble || m_registerFormat == DataFormatJSDouble); return u.fpr; }
+    JSValueRegs jsValueRegs() { ASSERT(m_registerFormat & DataFormatJS); return JSValueRegs(u.v.tagGPR, u.v.payloadGPR); }
+#endif
+
+    // Check whether a value needs spilling in order to free up any associated machine registers.
+    bool needsSpill()
+    {
+        // This should only be called on values that are currently in a register.
+        ASSERT(m_registerFormat != DataFormatNone);
+        // Constants do not need spilling, nor do values that have already been
+        // spilled to the JSStack.
+        return !m_canFill;
+    }
+
+    // Called when a VirtualRegister is being spilled to the JSStack for the first time.
+    void spill(VariableEventStream& stream, VirtualRegister virtualRegister, DataFormat spillFormat)
+    {
+        // We shouldn't be spill values that don't need spilling.
+        ASSERT(!m_canFill);
+        ASSERT(m_spillFormat == DataFormatNone);
+        // We should only be spilling values that are currently in machine registers.
+        ASSERT(m_registerFormat != DataFormatNone);
+
+        m_registerFormat = DataFormatNone;
+        m_spillFormat = spillFormat;
+        m_canFill = true;
+        
+        if (m_bornForOSR)
+            appendSpill(Spill, stream, virtualRegister);
+    }
+
+    // Called on values that don't need spilling (constants and values that have
+    // already been spilled), to mark them as no longer being in machine registers.
+    void setSpilled(VariableEventStream& stream, VirtualRegister virtualRegister)
+    {
+        // Should only be called on values that don't need spilling, and are currently in registers.
+        ASSERT(m_canFill && m_registerFormat != DataFormatNone);
+        m_registerFormat = DataFormatNone;
+        
+        if (m_bornForOSR)
+            appendSpill(Spill, stream, virtualRegister);
+    }
+    
+    void killSpilled()
+    {
+        m_spillFormat = DataFormatNone;
+        m_canFill = false;
+    }
+    
+    void fillGPR(VariableEventStream& stream, GPRReg gpr, DataFormat format)
+    {
+        ASSERT(gpr != InvalidGPRReg);
+        m_registerFormat = format;
+        u.gpr = gpr;
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
+    }
+
+    // Record that this value is filled into machine registers,
+    // tracking which registers, and what format the value has.
+#if USE(JSVALUE64)
+    void fillJSValue(VariableEventStream& stream, GPRReg gpr, DataFormat format = DataFormatJS)
+    {
+        ASSERT(format & DataFormatJS);
+        fillGPR(stream, gpr, format);
+    }
+#elif USE(JSVALUE32_64)
+    void fillJSValue(VariableEventStream& stream, GPRReg tagGPR, GPRReg payloadGPR, DataFormat format = DataFormatJS)
+    {
+        ASSERT(format & DataFormatJS);
+        m_registerFormat = format;
+        u.v.tagGPR = tagGPR; // FIXME: for JSValues with known type (boolean, integer, cell etc.) no tagGPR is needed?
+        u.v.payloadGPR = payloadGPR;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
+    }
+    void fillCell(VariableEventStream& stream, GPRReg gpr)
+    {
+        fillGPR(stream, gpr, DataFormatCell);
+    }
+#endif
+    void fillInt32(VariableEventStream& stream, GPRReg gpr)
+    {
+        fillGPR(stream, gpr, DataFormatInt32);
+    }
+    void fillInt52(VariableEventStream& stream, GPRReg gpr, DataFormat format)
+    {
+        ASSERT(format == DataFormatInt52 || format == DataFormatStrictInt52);
+        fillGPR(stream, gpr, format);
+    }
+    void fillInt52(VariableEventStream& stream, GPRReg gpr)
+    {
+        fillGPR(stream, gpr, DataFormatInt52);
+    }
+    void fillStrictInt52(VariableEventStream& stream, GPRReg gpr)
+    {
+        fillGPR(stream, gpr, DataFormatStrictInt52);
+    }
+    void fillBoolean(VariableEventStream& stream, GPRReg gpr)
+    {
+        fillGPR(stream, gpr, DataFormatBoolean);
+    }
+    void fillDouble(VariableEventStream& stream, FPRReg fpr)
+    {
+        ASSERT(fpr != InvalidFPRReg);
+        m_registerFormat = DataFormatDouble;
+        u.fpr = fpr;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
+    }
+    void fillStorage(VariableEventStream& stream, GPRReg gpr)
+    {
+        fillGPR(stream, gpr, DataFormatStorage);
+    }
+
+    bool alive()
+    {
+        return m_useCount;
+    }
+
+    ValueRecovery recovery(VirtualRegister spillSlot) const
+    {
+        if (m_isConstant)
+            return ValueRecovery::constant(m_node->constant()->value());
+
+        if (m_registerFormat == DataFormatDouble)
+            return ValueRecovery::inFPR(u.fpr, DataFormatDouble);
+
+#if USE(JSVALUE32_64)
+        if (m_registerFormat & DataFormatJS) {
+            if (m_registerFormat == DataFormatJS)
+                return ValueRecovery::inPair(u.v.tagGPR, u.v.payloadGPR);
+            return ValueRecovery::inGPR(u.v.payloadGPR, static_cast<DataFormat>(m_registerFormat & ~DataFormatJS));
+        }
+#endif
+        if (m_registerFormat)
+            return ValueRecovery::inGPR(u.gpr, m_registerFormat);
+
+        ASSERT(m_spillFormat);
+
+        return ValueRecovery::displacedInJSStack(spillSlot, m_spillFormat);
+    }
+
+private:
+    void appendBirth(VariableEventStream& stream)
+    {
+        stream.appendAndLog(VariableEvent::birth(MinifiedID(m_node)));
+    }
+    
+    void appendFill(VariableEventKind kind, VariableEventStream& stream)
+    {
+        ASSERT(m_bornForOSR);
+        
+        if (m_registerFormat == DataFormatDouble) {
+            stream.appendAndLog(VariableEvent::fillFPR(kind, MinifiedID(m_node), u.fpr));
+            return;
+        }
+#if USE(JSVALUE32_64)
+        if (m_registerFormat & DataFormatJS) {
+            stream.appendAndLog(VariableEvent::fillPair(kind, MinifiedID(m_node), u.v.tagGPR, u.v.payloadGPR));
+            return;
+        }
+#endif
+        stream.appendAndLog(VariableEvent::fillGPR(kind, MinifiedID(m_node), u.gpr, m_registerFormat));
+    }
+    
+    void appendSpill(VariableEventKind kind, VariableEventStream& stream, VirtualRegister virtualRegister)
+    {
+        stream.appendAndLog(VariableEvent::spill(kind, MinifiedID(m_node), virtualRegister, m_spillFormat));
+    }
+    
+    // The node whose result is stored in this virtual register.
+    Node* m_node;
+    uint32_t m_useCount;
+    DataFormat m_registerFormat;
+    DataFormat m_spillFormat;
+    bool m_canFill;
+    bool m_bornForOSR;
+    bool m_isConstant;
+    union {
+        GPRReg gpr;
+        FPRReg fpr;
+#if USE(JSVALUE32_64)
+        struct {
+            GPRReg tagGPR;
+            GPRReg payloadGPR;
+        } v;
+#endif
+    } u;
+};
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGGraph.cpp b/dfg/DFGGraph.cpp
new file mode 100644
index 0000000..4dd916a
--- /dev/null
+++ b/dfg/DFGGraph.cpp
@@ -0,0 +1,1728 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGGraph.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "BytecodeKills.h"
+#include "BytecodeLivenessAnalysisInlines.h"
+#include "CodeBlock.h"
+#include "CodeBlockWithJITType.h"
+#include "DFGBackwardsCFG.h"
+#include "DFGBackwardsDominators.h"
+#include "DFGBlockWorklist.h"
+#include "DFGCFG.h"
+#include "DFGClobberSet.h"
+#include "DFGClobbersExitState.h"
+#include "DFGControlEquivalenceAnalysis.h"
+#include "DFGDominators.h"
+#include "DFGFlowIndexing.h"
+#include "DFGFlowMap.h"
+#include "DFGJITCode.h"
+#include "DFGMayExit.h"
+#include "DFGNaturalLoops.h"
+#include "DFGPrePostNumbering.h"
+#include "DFGVariableAccessDataDump.h"
+#include "FullBytecodeLiveness.h"
+#include "FunctionExecutableDump.h"
+#include "GetterSetter.h"
+#include "JIT.h"
+#include "JSLexicalEnvironment.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "OperandsInlines.h"
+#include "JSCInlines.h"
+#include "StackAlignment.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace DFG {
+
+// Creates an array of stringized names.
+static const char* dfgOpNames[] = {
+#define STRINGIZE_DFG_OP_ENUM(opcode, flags) #opcode ,
+    FOR_EACH_DFG_OP(STRINGIZE_DFG_OP_ENUM)
+#undef STRINGIZE_DFG_OP_ENUM
+};
+
+Graph::Graph(VM& vm, Plan& plan, LongLivedState& longLivedState)
+    : m_vm(vm)
+    , m_plan(plan)
+    , m_codeBlock(m_plan.codeBlock)
+    , m_profiledBlock(m_codeBlock->alternative())
+    , m_allocator(longLivedState.m_allocator)
+    , m_cfg(std::make_unique<CFG>(*this))
+    , m_nextMachineLocal(0)
+    , m_fixpointState(BeforeFixpoint)
+    , m_structureRegistrationState(HaveNotStartedRegistering)
+    , m_form(LoadStore)
+    , m_unificationState(LocallyUnified)
+    , m_refCountState(EverythingIsLive)
+{
+    ASSERT(m_profiledBlock);
+    
+    m_hasDebuggerEnabled = m_profiledBlock->wasCompiledWithDebuggingOpcodes() || Options::forceDebuggerBytecodeGeneration();
+    
+    m_indexingCache = std::make_unique<FlowIndexing>(*this);
+    m_abstractValuesCache = std::make_unique<FlowMap<AbstractValue>>(*this);
+
+    registerStructure(vm.structureStructure.get());
+    this->stringStructure = registerStructure(vm.stringStructure.get());
+    this->symbolStructure = registerStructure(vm.symbolStructure.get());
+}
+
+Graph::~Graph()
+{
+    for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
+        BasicBlock* block = this->block(blockIndex);
+        if (!block)
+            continue;
+
+        for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+            m_allocator.free(block->phis[phiIndex]);
+        for (unsigned nodeIndex = block->size(); nodeIndex--;)
+            m_allocator.free(block->at(nodeIndex));
+    }
+    m_allocator.freeAll();
+}
+
+const char *Graph::opName(NodeType op)
+{
+    return dfgOpNames[op];
+}
+
+static void printWhiteSpace(PrintStream& out, unsigned amount)
+{
+    while (amount-- > 0)
+        out.print(" ");
+}
+
+bool Graph::dumpCodeOrigin(PrintStream& out, const char* prefix, Node*& previousNodeRef, Node* currentNode, DumpContext* context)
+{
+    if (!currentNode->origin.semantic)
+        return false;
+    
+    Node* previousNode = previousNodeRef;
+    previousNodeRef = currentNode;
+
+    if (!previousNode)
+        return false;
+    
+    if (previousNode->origin.semantic.inlineCallFrame == currentNode->origin.semantic.inlineCallFrame)
+        return false;
+    
+    Vector<CodeOrigin> previousInlineStack = previousNode->origin.semantic.inlineStack();
+    Vector<CodeOrigin> currentInlineStack = currentNode->origin.semantic.inlineStack();
+    unsigned commonSize = std::min(previousInlineStack.size(), currentInlineStack.size());
+    unsigned indexOfDivergence = commonSize;
+    for (unsigned i = 0; i < commonSize; ++i) {
+        if (previousInlineStack[i].inlineCallFrame != currentInlineStack[i].inlineCallFrame) {
+            indexOfDivergence = i;
+            break;
+        }
+    }
+    
+    bool hasPrinted = false;
+    
+    // Print the pops.
+    for (unsigned i = previousInlineStack.size(); i-- > indexOfDivergence;) {
+        out.print(prefix);
+        printWhiteSpace(out, i * 2);
+        out.print("<-- ", inContext(*previousInlineStack[i].inlineCallFrame, context), "\n");
+        hasPrinted = true;
+    }
+    
+    // Print the pushes.
+    for (unsigned i = indexOfDivergence; i < currentInlineStack.size(); ++i) {
+        out.print(prefix);
+        printWhiteSpace(out, i * 2);
+        out.print("--> ", inContext(*currentInlineStack[i].inlineCallFrame, context), "\n");
+        hasPrinted = true;
+    }
+    
+    return hasPrinted;
+}
+
+int Graph::amountOfNodeWhiteSpace(Node* node)
+{
+    return (node->origin.semantic.inlineDepth() - 1) * 2;
+}
+
+void Graph::printNodeWhiteSpace(PrintStream& out, Node* node)
+{
+    printWhiteSpace(out, amountOfNodeWhiteSpace(node));
+}
+
+void Graph::dump(PrintStream& out, const char* prefix, Node* node, DumpContext* context)
+{
+    NodeType op = node->op();
+
+    unsigned refCount = node->refCount();
+    bool mustGenerate = node->mustGenerate();
+    if (mustGenerate)
+        --refCount;
+
+    out.print(prefix);
+    printNodeWhiteSpace(out, node);
+
+    // Example/explanation of dataflow dump output
+    //
+    //   14:   <!2:7>  GetByVal(@3, @13)
+    //   ^1     ^2 ^3     ^4       ^5
+    //
+    // (1) The nodeIndex of this operation.
+    // (2) The reference count. The number printed is the 'real' count,
+    //     not including the 'mustGenerate' ref. If the node is
+    //     'mustGenerate' then the count it prefixed with '!'.
+    // (3) The virtual register slot assigned to this node.
+    // (4) The name of the operation.
+    // (5) The arguments to the operation. The may be of the form:
+    //         @#   - a NodeIndex referencing a prior node in the graph.
+    //         arg# - an argument number.
+    //         id#  - the index in the CodeBlock of an identifier { if codeBlock is passed to dump(), the string representation is displayed }.
+    //         var# - the index of a var on the global object, used by GetGlobalVar/GetGlobalLexicalVariable/PutGlobalVariable operations.
+    out.printf("% 4d:<%c%u:", (int)node->index(), mustGenerate ? '!' : ' ', refCount);
+    if (node->hasResult() && node->hasVirtualRegister() && node->virtualRegister().isValid())
+        out.print(node->virtualRegister());
+    else
+        out.print("-");
+    out.print(">\t", opName(op), "(");
+    CommaPrinter comma;
+    if (node->flags() & NodeHasVarArgs) {
+        for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++) {
+            if (!m_varArgChildren[childIdx])
+                continue;
+            out.print(comma, m_varArgChildren[childIdx]);
+        }
+    } else {
+        if (!!node->child1() || !!node->child2() || !!node->child3())
+            out.print(comma, node->child1());
+        if (!!node->child2() || !!node->child3())
+            out.print(comma, node->child2());
+        if (!!node->child3())
+            out.print(comma, node->child3());
+    }
+
+    if (toCString(NodeFlagsDump(node->flags())) != "<empty>")
+        out.print(comma, NodeFlagsDump(node->flags()));
+    if (node->prediction())
+        out.print(comma, SpeculationDump(node->prediction()));
+    if (node->hasArrayMode())
+        out.print(comma, node->arrayMode());
+    if (node->hasArithMode())
+        out.print(comma, node->arithMode());
+    if (node->hasArithRoundingMode())
+        out.print(comma, "Rounding:", node->arithRoundingMode());
+    if (node->hasScopeOffset())
+        out.print(comma, node->scopeOffset());
+    if (node->hasDirectArgumentsOffset())
+        out.print(comma, node->capturedArgumentsOffset());
+    if (node->hasArgumentIndex())
+        out.print(comma, node->argumentIndex());
+    if (node->hasRegisterPointer())
+        out.print(comma, "global", "(", RawPointer(node->variablePointer()), ")");
+    if (node->hasIdentifier())
+        out.print(comma, "id", node->identifierNumber(), "{", identifiers()[node->identifierNumber()], "}");
+    if (node->hasPromotedLocationDescriptor())
+        out.print(comma, node->promotedLocationDescriptor());
+    if (node->hasStructureSet())
+        out.print(comma, inContext(node->structureSet().toStructureSet(), context));
+    if (node->hasStructure())
+        out.print(comma, inContext(*node->structure().get(), context));
+    if (node->hasTransition()) {
+        out.print(comma, pointerDumpInContext(node->transition(), context));
+#if USE(JSVALUE64)
+        out.print(", ID:", node->transition()->next->id());
+#else
+        out.print(", ID:", RawPointer(node->transition()->next.get()));
+#endif
+    }
+    if (node->hasCellOperand()) {
+        if (!node->cellOperand()->value() || !node->cellOperand()->value().isCell())
+            out.print(comma, "invalid cell operand: ", node->cellOperand()->value());
+        else {
+            out.print(comma, pointerDump(node->cellOperand()->value().asCell()));
+            if (node->cellOperand()->value().isCell()) {
+                CallVariant variant(node->cellOperand()->value().asCell());
+                if (ExecutableBase* executable = variant.executable()) {
+                    if (executable->isHostFunction())
+                        out.print(comma, "<host function>");
+                    else if (FunctionExecutable* functionExecutable = jsDynamicCast<FunctionExecutable*>(executable))
+                        out.print(comma, FunctionExecutableDump(functionExecutable));
+                    else
+                        out.print(comma, "<non-function executable>");
+                }
+            }
+        }
+    }
+    if (node->hasSpeculatedTypeForQuery())
+        out.print(comma, SpeculationDump(node->speculatedTypeForQuery()));
+    if (node->hasStorageAccessData()) {
+        StorageAccessData& storageAccessData = node->storageAccessData();
+        out.print(comma, "id", storageAccessData.identifierNumber, "{", identifiers()[storageAccessData.identifierNumber], "}");
+        out.print(", ", static_cast<ptrdiff_t>(storageAccessData.offset));
+        out.print(", inferredType = ", inContext(storageAccessData.inferredType, context));
+    }
+    if (node->hasMultiGetByOffsetData()) {
+        MultiGetByOffsetData& data = node->multiGetByOffsetData();
+        out.print(comma, "id", data.identifierNumber, "{", identifiers()[data.identifierNumber], "}");
+        for (unsigned i = 0; i < data.cases.size(); ++i)
+            out.print(comma, inContext(data.cases[i], context));
+    }
+    if (node->hasMultiPutByOffsetData()) {
+        MultiPutByOffsetData& data = node->multiPutByOffsetData();
+        out.print(comma, "id", data.identifierNumber, "{", identifiers()[data.identifierNumber], "}");
+        for (unsigned i = 0; i < data.variants.size(); ++i)
+            out.print(comma, inContext(data.variants[i], context));
+    }
+    ASSERT(node->hasVariableAccessData(*this) == node->accessesStack(*this));
+    if (node->hasVariableAccessData(*this)) {
+        VariableAccessData* variableAccessData = node->tryGetVariableAccessData();
+        if (variableAccessData) {
+            VirtualRegister operand = variableAccessData->local();
+            out.print(comma, variableAccessData->local(), "(", VariableAccessDataDump(*this, variableAccessData), ")");
+            operand = variableAccessData->machineLocal();
+            if (operand.isValid())
+                out.print(comma, "machine:", operand);
+        }
+    }
+    if (node->hasStackAccessData()) {
+        StackAccessData* data = node->stackAccessData();
+        out.print(comma, data->local);
+        if (data->machineLocal.isValid())
+            out.print(comma, "machine:", data->machineLocal);
+        out.print(comma, data->format);
+    }
+    if (node->hasUnlinkedLocal()) 
+        out.print(comma, node->unlinkedLocal());
+    if (node->hasUnlinkedMachineLocal()) {
+        VirtualRegister operand = node->unlinkedMachineLocal();
+        if (operand.isValid())
+            out.print(comma, "machine:", operand);
+    }
+    if (node->hasConstantBuffer()) {
+        out.print(comma);
+        out.print(node->startConstant(), ":[");
+        CommaPrinter anotherComma;
+        for (unsigned i = 0; i < node->numConstants(); ++i)
+            out.print(anotherComma, pointerDumpInContext(freeze(m_codeBlock->constantBuffer(node->startConstant())[i]), context));
+        out.print("]");
+    }
+    if (node->hasLazyJSValue())
+        out.print(comma, node->lazyJSValue());
+    if (node->hasIndexingType())
+        out.print(comma, IndexingTypeDump(node->indexingType()));
+    if (node->hasTypedArrayType())
+        out.print(comma, node->typedArrayType());
+    if (node->hasPhi())
+        out.print(comma, "^", node->phi()->index());
+    if (node->hasExecutionCounter())
+        out.print(comma, RawPointer(node->executionCounter()));
+    if (node->hasWatchpointSet())
+        out.print(comma, RawPointer(node->watchpointSet()));
+    if (node->hasStoragePointer())
+        out.print(comma, RawPointer(node->storagePointer()));
+    if (node->hasObjectMaterializationData())
+        out.print(comma, node->objectMaterializationData());
+    if (node->hasCallVarargsData())
+        out.print(comma, "firstVarArgOffset = ", node->callVarargsData()->firstVarArgOffset);
+    if (node->hasLoadVarargsData()) {
+        LoadVarargsData* data = node->loadVarargsData();
+        out.print(comma, "start = ", data->start, ", count = ", data->count);
+        if (data->machineStart.isValid())
+            out.print(", machineStart = ", data->machineStart);
+        if (data->machineCount.isValid())
+            out.print(", machineCount = ", data->machineCount);
+        out.print(", offset = ", data->offset, ", mandatoryMinimum = ", data->mandatoryMinimum);
+        out.print(", limit = ", data->limit);
+    }
+    if (node->hasCallDOMGetterData()) {
+        CallDOMGetterData* data = node->callDOMGetterData();
+        out.print(comma, "id", data->identifierNumber, "{", identifiers()[data->identifierNumber], "}");
+        out.print(", domJIT = ", RawPointer(data->domJIT));
+    }
+    if (node->isConstant())
+        out.print(comma, pointerDumpInContext(node->constant(), context));
+    if (node->isJump())
+        out.print(comma, "T:", *node->targetBlock());
+    if (node->isBranch())
+        out.print(comma, "T:", node->branchData()->taken, ", F:", node->branchData()->notTaken);
+    if (node->isSwitch()) {
+        SwitchData* data = node->switchData();
+        out.print(comma, data->kind);
+        for (unsigned i = 0; i < data->cases.size(); ++i)
+            out.print(comma, inContext(data->cases[i].value, context), ":", data->cases[i].target);
+        out.print(comma, "default:", data->fallThrough);
+    }
+    ClobberSet reads;
+    ClobberSet writes;
+    addReadsAndWrites(*this, node, reads, writes);
+    if (!reads.isEmpty())
+        out.print(comma, "R:", sortedListDump(reads.direct(), ","));
+    if (!writes.isEmpty())
+        out.print(comma, "W:", sortedListDump(writes.direct(), ","));
+    ExitMode exitMode = mayExit(*this, node);
+    if (exitMode != DoesNotExit)
+        out.print(comma, exitMode);
+    if (clobbersExitState(*this, node))
+        out.print(comma, "ClobbersExit");
+    if (node->origin.isSet()) {
+        out.print(comma, "bc#", node->origin.semantic.bytecodeIndex);
+        if (node->origin.semantic != node->origin.forExit && node->origin.forExit.isSet())
+            out.print(comma, "exit: ", node->origin.forExit);
+    }
+    if (!node->origin.exitOK)
+        out.print(comma, "ExitInvalid");
+    if (node->origin.wasHoisted)
+        out.print(comma, "WasHoisted");
+    out.print(")");
+
+    if (node->accessesStack(*this) && node->tryGetVariableAccessData())
+        out.print("  predicting ", SpeculationDump(node->tryGetVariableAccessData()->prediction()));
+    else if (node->hasHeapPrediction())
+        out.print("  predicting ", SpeculationDump(node->getHeapPrediction()));
+    
+    out.print("\n");
+}
+
+bool Graph::terminalsAreValid()
+{
+    for (BasicBlock* block : blocksInNaturalOrder()) {
+        if (!block->terminal())
+            return false;
+    }
+    return true;
+}
+
+void Graph::dumpBlockHeader(PrintStream& out, const char* prefix, BasicBlock* block, PhiNodeDumpMode phiNodeDumpMode, DumpContext* context)
+{
+    out.print(prefix, "Block ", *block, " (", inContext(block->at(0)->origin.semantic, context), "):", block->isReachable ? "" : " (skipped)", block->isOSRTarget ? " (OSR target)" : "", "\n");
+    if (block->executionCount == block->executionCount)
+        out.print(prefix, "  Execution count: ", block->executionCount, "\n");
+    out.print(prefix, "  Predecessors:");
+    for (size_t i = 0; i < block->predecessors.size(); ++i)
+        out.print(" ", *block->predecessors[i]);
+    out.print("\n");
+    out.print(prefix, "  Successors:");
+    if (block->terminal()) {
+        for (BasicBlock* successor : block->successors()) {
+            out.print(" ", *successor);
+            if (m_prePostNumbering)
+                out.print(" (", m_prePostNumbering->edgeKind(block, successor), ")");
+        }
+    } else
+        out.print(" <invalid>");
+    out.print("\n");
+    if (m_dominators && terminalsAreValid()) {
+        out.print(prefix, "  Dominated by: ", m_dominators->dominatorsOf(block), "\n");
+        out.print(prefix, "  Dominates: ", m_dominators->blocksDominatedBy(block), "\n");
+        out.print(prefix, "  Dominance Frontier: ", m_dominators->dominanceFrontierOf(block), "\n");
+        out.print(prefix, "  Iterated Dominance Frontier: ", m_dominators->iteratedDominanceFrontierOf(BlockList(1, block)), "\n");
+    }
+    if (m_backwardsDominators && terminalsAreValid()) {
+        out.print(prefix, "  Backwards dominates by: ", m_backwardsDominators->dominatorsOf(block), "\n");
+        out.print(prefix, "  Backwards dominates: ", m_backwardsDominators->blocksDominatedBy(block), "\n");
+    }
+    if (m_controlEquivalenceAnalysis && terminalsAreValid()) {
+        out.print(prefix, "  Control equivalent to:");
+        for (BasicBlock* otherBlock : blocksInNaturalOrder()) {
+            if (m_controlEquivalenceAnalysis->areEquivalent(block, otherBlock))
+                out.print(" ", *otherBlock);
+        }
+        out.print("\n");
+    }
+    if (m_prePostNumbering)
+        out.print(prefix, "  Pre/Post Numbering: ", m_prePostNumbering->preNumber(block), "/", m_prePostNumbering->postNumber(block), "\n");
+    if (m_naturalLoops) {
+        if (const NaturalLoop* loop = m_naturalLoops->headerOf(block)) {
+            out.print(prefix, "  Loop header, contains:");
+            Vector<BlockIndex> sortedBlockList;
+            for (unsigned i = 0; i < loop->size(); ++i)
+                sortedBlockList.append(loop->at(i)->index);
+            std::sort(sortedBlockList.begin(), sortedBlockList.end());
+            for (unsigned i = 0; i < sortedBlockList.size(); ++i)
+                out.print(" #", sortedBlockList[i]);
+            out.print("\n");
+        }
+        
+        Vector<const NaturalLoop*> containingLoops =
+            m_naturalLoops->loopsOf(block);
+        if (!containingLoops.isEmpty()) {
+            out.print(prefix, "  Containing loop headers:");
+            for (unsigned i = 0; i < containingLoops.size(); ++i)
+                out.print(" ", *containingLoops[i]->header());
+            out.print("\n");
+        }
+    }
+    if (!block->phis.isEmpty()) {
+        out.print(prefix, "  Phi Nodes:");
+        for (size_t i = 0; i < block->phis.size(); ++i) {
+            Node* phiNode = block->phis[i];
+            if (!phiNode->shouldGenerate() && phiNodeDumpMode == DumpLivePhisOnly)
+                continue;
+            out.print(" @", phiNode->index(), "<", phiNode->local(), ",", phiNode->refCount(), ">->(");
+            if (phiNode->child1()) {
+                out.print("@", phiNode->child1()->index());
+                if (phiNode->child2()) {
+                    out.print(", @", phiNode->child2()->index());
+                    if (phiNode->child3())
+                        out.print(", @", phiNode->child3()->index());
+                }
+            }
+            out.print(")", i + 1 < block->phis.size() ? "," : "");
+        }
+        out.print("\n");
+    }
+}
+
+void Graph::dump(PrintStream& out, DumpContext* context)
+{
+    DumpContext myContext;
+    myContext.graph = this;
+    if (!context)
+        context = &myContext;
+    
+    out.print("\n");
+    out.print("DFG for ", CodeBlockWithJITType(m_codeBlock, JITCode::DFGJIT), ":\n");
+    out.print("  Fixpoint state: ", m_fixpointState, "; Form: ", m_form, "; Unification state: ", m_unificationState, "; Ref count state: ", m_refCountState, "\n");
+    if (m_form == SSA)
+        out.print("  Argument formats: ", listDump(m_argumentFormats), "\n");
+    else
+        out.print("  Arguments: ", listDump(m_arguments), "\n");
+    out.print("\n");
+    
+    Node* lastNode = nullptr;
+    for (size_t b = 0; b < m_blocks.size(); ++b) {
+        BasicBlock* block = m_blocks[b].get();
+        if (!block)
+            continue;
+        dumpBlockHeader(out, "", block, DumpAllPhis, context);
+        out.print("  States: ", block->cfaStructureClobberStateAtHead);
+        if (!block->cfaHasVisited)
+            out.print(", CurrentlyCFAUnreachable");
+        if (!block->intersectionOfCFAHasVisited)
+            out.print(", CFAUnreachable");
+        out.print("\n");
+        switch (m_form) {
+        case LoadStore:
+        case ThreadedCPS: {
+            out.print("  Vars Before: ");
+            if (block->cfaHasVisited)
+                out.print(inContext(block->valuesAtHead, context));
+            else
+                out.print("<empty>");
+            out.print("\n");
+            out.print("  Intersected Vars Before: ");
+            if (block->intersectionOfCFAHasVisited)
+                out.print(inContext(block->intersectionOfPastValuesAtHead, context));
+            else
+                out.print("<empty>");
+            out.print("\n");
+            out.print("  Var Links: ", block->variablesAtHead, "\n");
+            break;
+        }
+            
+        case SSA: {
+            RELEASE_ASSERT(block->ssa);
+            out.print("  Availability: ", block->ssa->availabilityAtHead, "\n");
+            out.print("  Live: ", nodeListDump(block->ssa->liveAtHead), "\n");
+            out.print("  Values: ", nodeValuePairListDump(block->ssa->valuesAtHead, context), "\n");
+            break;
+        } }
+        for (size_t i = 0; i < block->size(); ++i) {
+            dumpCodeOrigin(out, "", lastNode, block->at(i), context);
+            dump(out, "", block->at(i), context);
+        }
+        out.print("  States: ", block->cfaBranchDirection, ", ", block->cfaStructureClobberStateAtTail);
+        if (!block->cfaDidFinish)
+            out.print(", CFAInvalidated");
+        out.print("\n");
+        switch (m_form) {
+        case LoadStore:
+        case ThreadedCPS: {
+            out.print("  Vars After: ");
+            if (block->cfaHasVisited)
+                out.print(inContext(block->valuesAtTail, context));
+            else
+                out.print("<empty>");
+            out.print("\n");
+            out.print("  Var Links: ", block->variablesAtTail, "\n");
+            break;
+        }
+            
+        case SSA: {
+            RELEASE_ASSERT(block->ssa);
+            out.print("  Availability: ", block->ssa->availabilityAtTail, "\n");
+            out.print("  Live: ", nodeListDump(block->ssa->liveAtTail), "\n");
+            out.print("  Values: ", nodeValuePairListDump(block->ssa->valuesAtTail, context), "\n");
+            break;
+        } }
+        out.print("\n");
+    }
+    
+    out.print("GC Values:\n");
+    for (FrozenValue* value : m_frozenValues) {
+        if (value->pointsToHeap())
+            out.print("    ", inContext(*value, &myContext), "\n");
+    }
+
+    out.print(inContext(watchpoints(), &myContext));
+    
+    if (!myContext.isEmpty()) {
+        myContext.dump(out);
+        out.print("\n");
+    }
+}
+
+void Graph::addNodeToMapByIndex(Node* node)
+{
+    if (m_nodeIndexFreeList.isEmpty()) {
+        node->m_index = m_nodesByIndex.size();
+        m_nodesByIndex.append(node);
+        return;
+    }
+    unsigned index = m_nodeIndexFreeList.takeLast();
+    node->m_index = index;
+    ASSERT(!m_nodesByIndex[index]);
+    m_nodesByIndex[index] = node;
+}
+
+void Graph::deleteNode(Node* node)
+{
+    if (validationEnabled() && m_form == SSA) {
+        for (BasicBlock* block : blocksInNaturalOrder()) {
+            DFG_ASSERT(*this, node, !block->ssa->liveAtHead.contains(node));
+            DFG_ASSERT(*this, node, !block->ssa->liveAtTail.contains(node));
+        }
+    }
+
+    RELEASE_ASSERT(m_nodesByIndex[node->m_index] == node);
+    unsigned nodeIndex = node->m_index;
+    m_nodesByIndex[nodeIndex] = nullptr;
+    m_nodeIndexFreeList.append(nodeIndex);
+
+    m_allocator.free(node);
+}
+
+void Graph::packNodeIndices()
+{
+    if (m_nodeIndexFreeList.isEmpty())
+        return;
+
+    unsigned holeIndex = 0;
+    unsigned endIndex = m_nodesByIndex.size();
+
+    while (true) {
+        while (holeIndex < endIndex && m_nodesByIndex[holeIndex])
+            ++holeIndex;
+
+        if (holeIndex == endIndex)
+            break;
+        ASSERT(holeIndex < m_nodesByIndex.size());
+        ASSERT(!m_nodesByIndex[holeIndex]);
+
+        do {
+            --endIndex;
+        } while (!m_nodesByIndex[endIndex] && endIndex > holeIndex);
+
+        if (holeIndex == endIndex)
+            break;
+        ASSERT(endIndex > holeIndex);
+        ASSERT(m_nodesByIndex[endIndex]);
+
+        auto& value = m_nodesByIndex[endIndex];
+        value->m_index = holeIndex;
+        m_nodesByIndex[holeIndex] = WTFMove(value);
+        ++holeIndex;
+    }
+
+    m_nodeIndexFreeList.resize(0);
+    m_nodesByIndex.resize(endIndex);
+}
+
+void Graph::dethread()
+{
+    if (m_form == LoadStore || m_form == SSA)
+        return;
+    
+    if (logCompilationChanges())
+        dataLog("Dethreading DFG graph.\n");
+    
+    for (BlockIndex blockIndex = m_blocks.size(); blockIndex--;) {
+        BasicBlock* block = m_blocks[blockIndex].get();
+        if (!block)
+            continue;
+        for (unsigned phiIndex = block->phis.size(); phiIndex--;) {
+            Node* phi = block->phis[phiIndex];
+            phi->children.reset();
+        }
+    }
+    
+    m_form = LoadStore;
+}
+
+void Graph::handleSuccessor(Vector<BasicBlock*, 16>& worklist, BasicBlock* block, BasicBlock* successor)
+{
+    if (!successor->isReachable) {
+        successor->isReachable = true;
+        worklist.append(successor);
+    }
+    
+    successor->predecessors.append(block);
+}
+
+void Graph::determineReachability()
+{
+    Vector<BasicBlock*, 16> worklist;
+    worklist.append(block(0));
+    block(0)->isReachable = true;
+    while (!worklist.isEmpty()) {
+        BasicBlock* block = worklist.takeLast();
+        for (unsigned i = block->numSuccessors(); i--;)
+            handleSuccessor(worklist, block, block->successor(i));
+    }
+}
+
+void Graph::resetReachability()
+{
+    for (BlockIndex blockIndex = m_blocks.size(); blockIndex--;) {
+        BasicBlock* block = m_blocks[blockIndex].get();
+        if (!block)
+            continue;
+        block->isReachable = false;
+        block->predecessors.clear();
+    }
+    
+    determineReachability();
+}
+
+namespace {
+
+class RefCountCalculator {
+public:
+    RefCountCalculator(Graph& graph)
+        : m_graph(graph)
+    {
+    }
+    
+    void calculate()
+    {
+        // First reset the counts to 0 for all nodes.
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (unsigned indexInBlock = block->size(); indexInBlock--;)
+                block->at(indexInBlock)->setRefCount(0);
+            for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+                block->phis[phiIndex]->setRefCount(0);
+        }
+    
+        // Now find the roots:
+        // - Nodes that are must-generate.
+        // - Nodes that are reachable from type checks.
+        // Set their ref counts to 1 and put them on the worklist.
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (unsigned indexInBlock = block->size(); indexInBlock--;) {
+                Node* node = block->at(indexInBlock);
+                DFG_NODE_DO_TO_CHILDREN(m_graph, node, findTypeCheckRoot);
+                if (!(node->flags() & NodeMustGenerate))
+                    continue;
+                if (!node->postfixRef())
+                    m_worklist.append(node);
+            }
+        }
+        
+        while (!m_worklist.isEmpty()) {
+            while (!m_worklist.isEmpty()) {
+                Node* node = m_worklist.last();
+                m_worklist.removeLast();
+                ASSERT(node->shouldGenerate()); // It should not be on the worklist unless it's ref'ed.
+                DFG_NODE_DO_TO_CHILDREN(m_graph, node, countEdge);
+            }
+            
+            if (m_graph.m_form == SSA) {
+                // Find Phi->Upsilon edges, which are represented as meta-data in the
+                // Upsilon.
+                for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+                    BasicBlock* block = m_graph.block(blockIndex);
+                    if (!block)
+                        continue;
+                    for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+                        Node* node = block->at(nodeIndex);
+                        if (node->op() != Upsilon)
+                            continue;
+                        if (node->shouldGenerate())
+                            continue;
+                        if (node->phi()->shouldGenerate())
+                            countNode(node);
+                    }
+                }
+            }
+        }
+    }
+    
+private:
+    void findTypeCheckRoot(Node*, Edge edge)
+    {
+        // We may have an "unproved" untyped use for code that is unreachable. The CFA
+        // will just not have gotten around to it.
+        if (edge.isProved() || edge.willNotHaveCheck())
+            return;
+        if (!edge->postfixRef())
+            m_worklist.append(edge.node());
+    }
+    
+    void countNode(Node* node)
+    {
+        if (node->postfixRef())
+            return;
+        m_worklist.append(node);
+    }
+    
+    void countEdge(Node*, Edge edge)
+    {
+        // Don't count edges that are already counted for their type checks.
+        if (!(edge.isProved() || edge.willNotHaveCheck()))
+            return;
+        countNode(edge.node());
+    }
+    
+    Graph& m_graph;
+    Vector<Node*, 128> m_worklist;
+};
+
+} // anonymous namespace
+
+void Graph::computeRefCounts()
+{
+    RefCountCalculator calculator(*this);
+    calculator.calculate();
+}
+
+void Graph::killBlockAndItsContents(BasicBlock* block)
+{
+    if (auto& ssaData = block->ssa)
+        ssaData->invalidate();
+    for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+        deleteNode(block->phis[phiIndex]);
+    for (Node* node : *block)
+        deleteNode(node);
+    
+    killBlock(block);
+}
+
+void Graph::killUnreachableBlocks()
+{
+    invalidateNodeLiveness();
+
+    for (BlockIndex blockIndex = 0; blockIndex < numBlocks(); ++blockIndex) {
+        BasicBlock* block = this->block(blockIndex);
+        if (!block)
+            continue;
+        if (block->isReachable)
+            continue;
+        
+        killBlockAndItsContents(block);
+    }
+}
+
+void Graph::invalidateCFG()
+{
+    m_dominators = nullptr;
+    m_naturalLoops = nullptr;
+    m_prePostNumbering = nullptr;
+    m_controlEquivalenceAnalysis = nullptr;
+    m_backwardsDominators = nullptr;
+    m_backwardsCFG = nullptr;
+}
+
+void Graph::invalidateNodeLiveness()
+{
+    if (m_form != SSA)
+        return;
+
+    for (BasicBlock* block : blocksInNaturalOrder())
+        block->ssa->invalidate();
+}
+
+void Graph::substituteGetLocal(BasicBlock& block, unsigned startIndexInBlock, VariableAccessData* variableAccessData, Node* newGetLocal)
+{
+    for (unsigned indexInBlock = startIndexInBlock; indexInBlock < block.size(); ++indexInBlock) {
+        Node* node = block[indexInBlock];
+        bool shouldContinue = true;
+        switch (node->op()) {
+        case SetLocal: {
+            if (node->local() == variableAccessData->local())
+                shouldContinue = false;
+            break;
+        }
+                
+        case GetLocal: {
+            if (node->variableAccessData() != variableAccessData)
+                continue;
+            substitute(block, indexInBlock, node, newGetLocal);
+            Node* oldTailNode = block.variablesAtTail.operand(variableAccessData->local());
+            if (oldTailNode == node)
+                block.variablesAtTail.operand(variableAccessData->local()) = newGetLocal;
+            shouldContinue = false;
+            break;
+        }
+                
+        default:
+            break;
+        }
+        if (!shouldContinue)
+            break;
+    }
+}
+
+BlockList Graph::blocksInPreOrder()
+{
+    BlockList result;
+    BlockWorklist worklist;
+    worklist.push(block(0));
+    while (BasicBlock* block = worklist.pop()) {
+        result.append(block);
+        for (unsigned i = block->numSuccessors(); i--;)
+            worklist.push(block->successor(i));
+    }
+    return result;
+}
+
+BlockList Graph::blocksInPostOrder()
+{
+    BlockList result;
+    PostOrderBlockWorklist worklist;
+    worklist.push(block(0));
+    while (BlockWithOrder item = worklist.pop()) {
+        switch (item.order) {
+        case VisitOrder::Pre:
+            worklist.pushPost(item.node);
+            for (unsigned i = item.node->numSuccessors(); i--;)
+                worklist.push(item.node->successor(i));
+            break;
+        case VisitOrder::Post:
+            result.append(item.node);
+            break;
+        }
+    }
+    return result;
+}
+
+void Graph::clearReplacements()
+{
+    for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
+        BasicBlock* block = m_blocks[blockIndex].get();
+        if (!block)
+            continue;
+        for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+            block->phis[phiIndex]->setReplacement(nullptr);
+        for (unsigned nodeIndex = block->size(); nodeIndex--;)
+            block->at(nodeIndex)->setReplacement(nullptr);
+    }
+}
+
+void Graph::clearEpochs()
+{
+    for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
+        BasicBlock* block = m_blocks[blockIndex].get();
+        if (!block)
+            continue;
+        for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+            block->phis[phiIndex]->setEpoch(Epoch());
+        for (unsigned nodeIndex = block->size(); nodeIndex--;)
+            block->at(nodeIndex)->setEpoch(Epoch());
+    }
+}
+
+void Graph::initializeNodeOwners()
+{
+    for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
+        BasicBlock* block = m_blocks[blockIndex].get();
+        if (!block)
+            continue;
+        for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+            block->phis[phiIndex]->owner = block;
+        for (unsigned nodeIndex = block->size(); nodeIndex--;)
+            block->at(nodeIndex)->owner = block;
+    }
+}
+
+void Graph::clearFlagsOnAllNodes(NodeFlags flags)
+{
+    for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
+        BasicBlock* block = m_blocks[blockIndex].get();
+        if (!block)
+            continue;
+        for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+            block->phis[phiIndex]->clearFlags(flags);
+        for (unsigned nodeIndex = block->size(); nodeIndex--;)
+            block->at(nodeIndex)->clearFlags(flags);
+    }
+}
+
+bool Graph::watchCondition(const ObjectPropertyCondition& key)
+{
+    if (!key.isWatchable())
+        return false;
+    
+    m_plan.weakReferences.addLazily(key.object());
+    if (key.hasPrototype())
+        m_plan.weakReferences.addLazily(key.prototype());
+    if (key.hasRequiredValue())
+        m_plan.weakReferences.addLazily(key.requiredValue());
+    
+    m_plan.watchpoints.addLazily(key);
+
+    if (key.kind() == PropertyCondition::Presence)
+        m_safeToLoad.add(std::make_pair(key.object(), key.offset()));
+    
+    return true;
+}
+
+bool Graph::watchConditions(const ObjectPropertyConditionSet& keys)
+{
+    if (!keys.isValid())
+        return false;
+
+    for (const ObjectPropertyCondition& key : keys) {
+        if (!watchCondition(key))
+            return false;
+    }
+    return true;
+}
+
+bool Graph::isSafeToLoad(JSObject* base, PropertyOffset offset)
+{
+    return m_safeToLoad.contains(std::make_pair(base, offset));
+}
+
+InferredType::Descriptor Graph::inferredTypeFor(const PropertyTypeKey& key)
+{
+    assertIsRegistered(key.structure());
+    
+    auto iter = m_inferredTypes.find(key);
+    if (iter != m_inferredTypes.end())
+        return iter->value;
+
+    InferredType* typeObject = key.structure()->inferredTypeFor(key.uid());
+    if (!typeObject) {
+        m_inferredTypes.add(key, InferredType::Top);
+        return InferredType::Top;
+    }
+
+    InferredType::Descriptor typeDescriptor = typeObject->descriptor();
+    if (typeDescriptor.kind() == InferredType::Top) {
+        m_inferredTypes.add(key, InferredType::Top);
+        return InferredType::Top;
+    }
+    
+    m_inferredTypes.add(key, typeDescriptor);
+
+    m_plan.weakReferences.addLazily(typeObject);
+    registerInferredType(typeDescriptor);
+
+    // Note that we may already be watching this desired inferred type, because multiple structures may
+    // point to the same InferredType instance.
+    m_plan.watchpoints.addLazily(DesiredInferredType(typeObject, typeDescriptor));
+
+    return typeDescriptor;
+}
+
+FullBytecodeLiveness& Graph::livenessFor(CodeBlock* codeBlock)
+{
+    HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>>::iterator iter = m_bytecodeLiveness.find(codeBlock);
+    if (iter != m_bytecodeLiveness.end())
+        return *iter->value;
+    
+    std::unique_ptr<FullBytecodeLiveness> liveness = std::make_unique<FullBytecodeLiveness>();
+    codeBlock->livenessAnalysis().computeFullLiveness(*liveness);
+    FullBytecodeLiveness& result = *liveness;
+    m_bytecodeLiveness.add(codeBlock, WTFMove(liveness));
+    return result;
+}
+
+FullBytecodeLiveness& Graph::livenessFor(InlineCallFrame* inlineCallFrame)
+{
+    return livenessFor(baselineCodeBlockFor(inlineCallFrame));
+}
+
+BytecodeKills& Graph::killsFor(CodeBlock* codeBlock)
+{
+    HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>>::iterator iter = m_bytecodeKills.find(codeBlock);
+    if (iter != m_bytecodeKills.end())
+        return *iter->value;
+    
+    std::unique_ptr<BytecodeKills> kills = std::make_unique<BytecodeKills>();
+    codeBlock->livenessAnalysis().computeKills(*kills);
+    BytecodeKills& result = *kills;
+    m_bytecodeKills.add(codeBlock, WTFMove(kills));
+    return result;
+}
+
+BytecodeKills& Graph::killsFor(InlineCallFrame* inlineCallFrame)
+{
+    return killsFor(baselineCodeBlockFor(inlineCallFrame));
+}
+
+bool Graph::isLiveInBytecode(VirtualRegister operand, CodeOrigin codeOrigin)
+{
+    static const bool verbose = false;
+    
+    if (verbose)
+        dataLog("Checking of operand is live: ", operand, "\n");
+    CodeOrigin* codeOriginPtr = &codeOrigin;
+    for (;;) {
+        VirtualRegister reg = VirtualRegister(
+            operand.offset() - codeOriginPtr->stackOffset());
+        
+        if (verbose)
+            dataLog("reg = ", reg, "\n");
+        
+        if (operand.offset() < codeOriginPtr->stackOffset() + CallFrame::headerSizeInRegisters) {
+            if (reg.isArgument()) {
+                RELEASE_ASSERT(reg.offset() < CallFrame::headerSizeInRegisters);
+                
+                if (codeOriginPtr->inlineCallFrame->isClosureCall
+                    && reg.offset() == CallFrameSlot::callee) {
+                    if (verbose)
+                        dataLog("Looks like a callee.\n");
+                    return true;
+                }
+                
+                if (codeOriginPtr->inlineCallFrame->isVarargs()
+                    && reg.offset() == CallFrameSlot::argumentCount) {
+                    if (verbose)
+                        dataLog("Looks like the argument count.\n");
+                    return true;
+                }
+                
+                return false;
+            }
+
+            if (verbose)
+                dataLog("Asking the bytecode liveness.\n");
+            return livenessFor(codeOriginPtr->inlineCallFrame).operandIsLive(
+                reg.offset(), codeOriginPtr->bytecodeIndex);
+        }
+        
+        InlineCallFrame* inlineCallFrame = codeOriginPtr->inlineCallFrame;
+        if (!inlineCallFrame) {
+            if (verbose)
+                dataLog("Ran out of stack, returning true.\n");
+            return true;
+        }
+
+        // Arguments are always live. This would be redundant if it wasn't for our
+        // op_call_varargs inlining.
+        if (reg.isArgument()
+            && static_cast<size_t>(reg.toArgument()) < inlineCallFrame->arguments.size()) {
+            if (verbose)
+                dataLog("Argument is live.\n");
+            return true;
+        }
+        
+        codeOriginPtr = inlineCallFrame->getCallerSkippingTailCalls();
+
+        // The first inline call frame could be an inline tail call
+        if (!codeOriginPtr) {
+            if (verbose)
+                dataLog("Dead because of tail inlining.\n");
+            return false;
+        }
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+BitVector Graph::localsLiveInBytecode(CodeOrigin codeOrigin)
+{
+    BitVector result;
+    result.ensureSize(block(0)->variablesAtHead.numberOfLocals());
+    forAllLocalsLiveInBytecode(
+        codeOrigin,
+        [&] (VirtualRegister reg) {
+            ASSERT(reg.isLocal());
+            result.quickSet(reg.toLocal());
+        });
+    return result;
+}
+
+unsigned Graph::parameterSlotsForArgCount(unsigned argCount)
+{
+    size_t frameSize = CallFrame::headerSizeInRegisters + argCount;
+    size_t alignedFrameSize = WTF::roundUpToMultipleOf(stackAlignmentRegisters(), frameSize);
+    return alignedFrameSize - CallerFrameAndPC::sizeInRegisters;
+}
+
+unsigned Graph::frameRegisterCount()
+{
+    unsigned result = m_nextMachineLocal + std::max(m_parameterSlots, static_cast<unsigned>(maxFrameExtentForSlowPathCallInRegisters));
+    return roundLocalRegisterCountForFramePointerOffset(result);
+}
+
+unsigned Graph::stackPointerOffset()
+{
+    return virtualRegisterForLocal(frameRegisterCount() - 1).offset();
+}
+
+unsigned Graph::requiredRegisterCountForExit()
+{
+    unsigned count = JIT::frameRegisterCountFor(m_profiledBlock);
+    for (InlineCallFrameSet::iterator iter = m_plan.inlineCallFrames->begin(); !!iter; ++iter) {
+        InlineCallFrame* inlineCallFrame = *iter;
+        CodeBlock* codeBlock = baselineCodeBlockForInlineCallFrame(inlineCallFrame);
+        unsigned requiredCount = VirtualRegister(inlineCallFrame->stackOffset).toLocal() + 1 + JIT::frameRegisterCountFor(codeBlock);
+        count = std::max(count, requiredCount);
+    }
+    return count;
+}
+
+unsigned Graph::requiredRegisterCountForExecutionAndExit()
+{
+    return std::max(frameRegisterCount(), requiredRegisterCountForExit());
+}
+
+JSValue Graph::tryGetConstantProperty(
+    JSValue base, const RegisteredStructureSet& structureSet, PropertyOffset offset)
+{
+    if (!base || !base.isObject())
+        return JSValue();
+    
+    JSObject* object = asObject(base);
+    
+    for (unsigned i = structureSet.size(); i--;) {
+        RegisteredStructure structure = structureSet[i];
+        
+        WatchpointSet* set = structure->propertyReplacementWatchpointSet(offset);
+        if (!set || !set->isStillValid())
+            return JSValue();
+        
+        ASSERT(structure->isValidOffset(offset));
+        ASSERT(!structure->isUncacheableDictionary());
+        
+        watchpoints().addLazily(set);
+    }
+    
+    // What follows may require some extra thought. We need this load to load a valid JSValue. If
+    // our profiling makes sense and we're still on track to generate code that won't be
+    // invalidated, then we have nothing to worry about. We do, however, have to worry about
+    // loading - and then using - an invalid JSValue in the case that unbeknownst to us our code
+    // is doomed.
+    //
+    // One argument in favor of this code is that it should definitely work because the butterfly
+    // is always set before the structure. However, we don't currently have a fence between those
+    // stores. It's not clear if this matters, however. We don't ever shrink the property storage.
+    // So, for this to fail, you'd need an access on a constant object pointer such that the inline
+    // caches told us that the object had a structure that it did not *yet* have, and then later,
+    // the object transitioned to that structure that the inline caches had alraedy seen. And then
+    // the processor reordered the stores. Seems unlikely and difficult to test. I believe that
+    // this is worth revisiting but it isn't worth losing sleep over. Filed:
+    // https://bugs.webkit.org/show_bug.cgi?id=134641
+    //
+    // For now, we just do the minimal thing: defend against the structure right now being
+    // incompatible with the getDirect we're trying to do. The easiest way to do that is to
+    // determine if the structure belongs to the proven set.
+    
+    if (!structureSet.toStructureSet().contains(object->structure()))
+        return JSValue();
+    
+    return object->getDirect(offset);
+}
+
+JSValue Graph::tryGetConstantProperty(JSValue base, Structure* structure, PropertyOffset offset)
+{
+    return tryGetConstantProperty(base, RegisteredStructureSet(registerStructure(structure)), offset);
+}
+
+JSValue Graph::tryGetConstantProperty(
+    JSValue base, const StructureAbstractValue& structure, PropertyOffset offset)
+{
+    if (structure.isInfinite()) {
+        // FIXME: If we just converted the offset to a uid, we could do ObjectPropertyCondition
+        // watching to constant-fold the property.
+        // https://bugs.webkit.org/show_bug.cgi?id=147271
+        return JSValue();
+    }
+    
+    return tryGetConstantProperty(base, structure.set(), offset);
+}
+
+JSValue Graph::tryGetConstantProperty(const AbstractValue& base, PropertyOffset offset)
+{
+    return tryGetConstantProperty(base.m_value, base.m_structure, offset);
+}
+
+AbstractValue Graph::inferredValueForProperty(
+    const RegisteredStructureSet& base, UniquedStringImpl* uid, StructureClobberState clobberState)
+{
+    AbstractValue result;
+    base.forEach(
+        [&] (RegisteredStructure structure) {
+            AbstractValue value;
+            value.set(*this, inferredTypeForProperty(structure.get(), uid));
+            result.merge(value);
+        });
+    if (clobberState == StructuresAreClobbered)
+        result.clobberStructures();
+    return result;
+}
+
+AbstractValue Graph::inferredValueForProperty(
+    const AbstractValue& base, UniquedStringImpl* uid, PropertyOffset offset,
+    StructureClobberState clobberState)
+{
+    if (JSValue value = tryGetConstantProperty(base, offset)) {
+        AbstractValue result;
+        result.set(*this, *freeze(value), clobberState);
+        return result;
+    }
+
+    if (base.m_structure.isFinite())
+        return inferredValueForProperty(base.m_structure.set(), uid, clobberState);
+
+    return AbstractValue::heapTop();
+}
+
+JSValue Graph::tryGetConstantClosureVar(JSValue base, ScopeOffset offset)
+{
+    // This has an awesome concurrency story. See comment for GetGlobalVar in ByteCodeParser.
+    
+    if (!base)
+        return JSValue();
+    
+    JSLexicalEnvironment* activation = jsDynamicCast<JSLexicalEnvironment*>(base);
+    if (!activation)
+        return JSValue();
+    
+    SymbolTable* symbolTable = activation->symbolTable();
+    JSValue value;
+    WatchpointSet* set;
+    {
+        ConcurrentJSLocker locker(symbolTable->m_lock);
+        
+        SymbolTableEntry* entry = symbolTable->entryFor(locker, offset);
+        if (!entry)
+            return JSValue();
+        
+        set = entry->watchpointSet();
+        if (!set)
+            return JSValue();
+        
+        if (set->state() != IsWatched)
+            return JSValue();
+        
+        ASSERT(entry->scopeOffset() == offset);
+        value = activation->variableAt(offset).get();
+        if (!value)
+            return JSValue();
+    }
+    
+    watchpoints().addLazily(set);
+    
+    return value;
+}
+
+JSValue Graph::tryGetConstantClosureVar(const AbstractValue& value, ScopeOffset offset)
+{
+    return tryGetConstantClosureVar(value.m_value, offset);
+}
+
+JSValue Graph::tryGetConstantClosureVar(Node* node, ScopeOffset offset)
+{
+    if (!node->hasConstant())
+        return JSValue();
+    return tryGetConstantClosureVar(node->asJSValue(), offset);
+}
+
+JSArrayBufferView* Graph::tryGetFoldableView(JSValue value)
+{
+    if (!value)
+        return nullptr;
+    JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(value);
+    if (!value)
+        return nullptr;
+    if (!view->length())
+        return nullptr;
+    WTF::loadLoadFence();
+    watchpoints().addLazily(view);
+    return view;
+}
+
+JSArrayBufferView* Graph::tryGetFoldableView(JSValue value, ArrayMode arrayMode)
+{
+    if (arrayMode.type() != Array::AnyTypedArray && arrayMode.typedArrayType() == NotTypedArray)
+        return nullptr;
+    return tryGetFoldableView(value);
+}
+
+void Graph::registerFrozenValues()
+{
+    m_codeBlock->constants().resize(0);
+    m_codeBlock->constantsSourceCodeRepresentation().resize(0);
+    for (FrozenValue* value : m_frozenValues) {
+        if (!value->pointsToHeap())
+            continue;
+        
+        ASSERT(value->structure());
+        ASSERT(m_plan.weakReferences.contains(value->structure()));
+        
+        switch (value->strength()) {
+        case WeakValue: {
+            m_plan.weakReferences.addLazily(value->value().asCell());
+            break;
+        }
+        case StrongValue: {
+            unsigned constantIndex = m_codeBlock->addConstantLazily();
+            // We already have a barrier on the code block.
+            m_codeBlock->constants()[constantIndex].setWithoutWriteBarrier(value->value());
+            break;
+        } }
+    }
+    m_codeBlock->constants().shrinkToFit();
+    m_codeBlock->constantsSourceCodeRepresentation().shrinkToFit();
+}
+
+void Graph::visitChildren(SlotVisitor& visitor)
+{
+    for (FrozenValue* value : m_frozenValues) {
+        visitor.appendUnbarriered(value->value());
+        visitor.appendUnbarriered(value->structure());
+    }
+}
+
+FrozenValue* Graph::freeze(JSValue value)
+{
+    if (UNLIKELY(!value))
+        return FrozenValue::emptySingleton();
+
+    // There are weird relationships in how optimized CodeBlocks
+    // point to other CodeBlocks. We don't want to have them be
+    // part of the weak pointer set. For example, an optimized CodeBlock
+    // having a weak pointer to itself will cause it to get collected.
+    RELEASE_ASSERT(!jsDynamicCast<CodeBlock*>(value));
+    
+    auto result = m_frozenValueMap.add(JSValue::encode(value), nullptr);
+    if (LIKELY(!result.isNewEntry))
+        return result.iterator->value;
+
+    if (value.isUInt32())
+        m_uint32ValuesInUse.append(value.asUInt32());
+    
+    FrozenValue frozenValue = FrozenValue::freeze(value);
+    if (Structure* structure = frozenValue.structure())
+        registerStructure(structure);
+    
+    return result.iterator->value = m_frozenValues.add(frozenValue);
+}
+
+FrozenValue* Graph::freezeStrong(JSValue value)
+{
+    FrozenValue* result = freeze(value);
+    result->strengthenTo(StrongValue);
+    return result;
+}
+
+void Graph::convertToConstant(Node* node, FrozenValue* value)
+{
+    if (value->structure())
+        assertIsRegistered(value->structure());
+    node->convertToConstant(value);
+}
+
+void Graph::convertToConstant(Node* node, JSValue value)
+{
+    convertToConstant(node, freeze(value));
+}
+
+void Graph::convertToStrongConstant(Node* node, JSValue value)
+{
+    convertToConstant(node, freezeStrong(value));
+}
+
+RegisteredStructure Graph::registerStructure(Structure* structure, StructureRegistrationResult& result)
+{
+    m_plan.weakReferences.addLazily(structure);
+    if (m_plan.watchpoints.consider(structure))
+        result = StructureRegisteredAndWatched;
+    else
+        result = StructureRegisteredNormally;
+    return RegisteredStructure::createPrivate(structure);
+}
+
+void Graph::assertIsRegistered(Structure* structure)
+{
+    // It's convenient to be able to call this with a maybe-null structure.
+    if (!structure)
+        return;
+    
+    DFG_ASSERT(*this, nullptr, m_plan.weakReferences.contains(structure));
+    
+    if (!structure->dfgShouldWatch())
+        return;
+    if (watchpoints().isWatched(structure->transitionWatchpointSet()))
+        return;
+    
+    DFG_CRASH(*this, nullptr, toCString("Structure ", pointerDump(structure), " is watchable but isn't being watched.").data());
+}
+
+NO_RETURN_DUE_TO_CRASH static void crash(
+    Graph& graph, const CString& whileText, const char* file, int line, const char* function,
+    const char* assertion)
+{
+    startCrashing();
+    dataLog("DFG ASSERTION FAILED: ", assertion, "\n");
+    dataLog(file, "(", line, ") : ", function, "\n");
+    dataLog("\n");
+    dataLog(whileText);
+    dataLog("Graph at time of failure:\n");
+    graph.dump();
+    dataLog("\n");
+    dataLog("DFG ASSERTION FAILED: ", assertion, "\n");
+    dataLog(file, "(", line, ") : ", function, "\n");
+    CRASH_WITH_SECURITY_IMPLICATION();
+}
+
+void Graph::handleAssertionFailure(
+    std::nullptr_t, const char* file, int line, const char* function, const char* assertion)
+{
+    crash(*this, "", file, line, function, assertion);
+}
+
+void Graph::handleAssertionFailure(
+    Node* node, const char* file, int line, const char* function, const char* assertion)
+{
+    crash(*this, toCString("While handling node ", node, "\n\n"), file, line, function, assertion);
+}
+
+void Graph::handleAssertionFailure(
+    BasicBlock* block, const char* file, int line, const char* function, const char* assertion)
+{
+    crash(*this, toCString("While handling block ", pointerDump(block), "\n\n"), file, line, function, assertion);
+}
+
+Dominators& Graph::ensureDominators()
+{
+    if (!m_dominators)
+        m_dominators = std::make_unique<Dominators>(*this);
+    return *m_dominators;
+}
+
+PrePostNumbering& Graph::ensurePrePostNumbering()
+{
+    if (!m_prePostNumbering)
+        m_prePostNumbering = std::make_unique<PrePostNumbering>(*this);
+    return *m_prePostNumbering;
+}
+
+NaturalLoops& Graph::ensureNaturalLoops()
+{
+    ensureDominators();
+    if (!m_naturalLoops)
+        m_naturalLoops = std::make_unique<NaturalLoops>(*this);
+    return *m_naturalLoops;
+}
+
+BackwardsCFG& Graph::ensureBackwardsCFG()
+{
+    if (!m_backwardsCFG)
+        m_backwardsCFG = std::make_unique<BackwardsCFG>(*this);
+    return *m_backwardsCFG;
+}
+
+BackwardsDominators& Graph::ensureBackwardsDominators()
+{
+    if (!m_backwardsDominators)
+        m_backwardsDominators = std::make_unique<BackwardsDominators>(*this);
+    return *m_backwardsDominators;
+}
+
+ControlEquivalenceAnalysis& Graph::ensureControlEquivalenceAnalysis()
+{
+    if (!m_controlEquivalenceAnalysis)
+        m_controlEquivalenceAnalysis = std::make_unique<ControlEquivalenceAnalysis>(*this);
+    return *m_controlEquivalenceAnalysis;
+}
+
+MethodOfGettingAValueProfile Graph::methodOfGettingAValueProfileFor(Node* currentNode, Node* operandNode)
+{
+    for (Node* node = operandNode; node;) {
+        // currentNode is null when we're doing speculation checks for checkArgumentTypes().
+        if (!currentNode || node->origin != currentNode->origin) {
+            CodeBlock* profiledBlock = baselineCodeBlockFor(node->origin.semantic);
+
+            if (node->accessesStack(*this)) {
+                ValueProfile* result = [&] () -> ValueProfile* {
+                    if (!node->local().isArgument())
+                        return nullptr;
+                    int argument = node->local().toArgument();
+                    Node* argumentNode = m_arguments[argument];
+                    if (!argumentNode)
+                        return nullptr;
+                    if (node->variableAccessData() != argumentNode->variableAccessData())
+                        return nullptr;
+                    return profiledBlock->valueProfileForArgument(argument);
+                }();
+                if (result)
+                    return result;
+
+                if (node->op() == GetLocal) {
+                    return MethodOfGettingAValueProfile::fromLazyOperand(
+                        profiledBlock,
+                        LazyOperandValueProfileKey(
+                            node->origin.semantic.bytecodeIndex, node->local()));
+                }
+            }
+
+            if (node->hasHeapPrediction())
+                return profiledBlock->valueProfileForBytecodeOffset(node->origin.semantic.bytecodeIndex);
+
+            if (profiledBlock->hasBaselineJITProfiling()) {
+                if (ArithProfile* result = profiledBlock->arithProfileForBytecodeOffset(node->origin.semantic.bytecodeIndex))
+                    return result;
+            }
+        }
+
+        switch (node->op()) {
+        case BooleanToNumber:
+        case Identity:
+        case ValueRep:
+        case DoubleRep:
+        case Int52Rep:
+            node = node->child1().node();
+            break;
+        default:
+            node = nullptr;
+        }
+    }
+    
+    return MethodOfGettingAValueProfile();
+}
+
+bool Graph::getRegExpPrototypeProperty(JSObject* regExpPrototype, Structure* regExpPrototypeStructure, UniquedStringImpl* uid, JSValue& returnJSValue)
+{
+    unsigned attributesUnused;
+    PropertyOffset offset = regExpPrototypeStructure->getConcurrently(uid, attributesUnused);
+    if (!isValidOffset(offset))
+        return false;
+
+    JSValue value = tryGetConstantProperty(regExpPrototype, regExpPrototypeStructure, offset);
+    if (!value)
+        return false;
+
+    // We only care about functions and getters at this point. If you want to access other properties
+    // you'll have to add code for those types.
+    JSFunction* function = jsDynamicCast<JSFunction*>(value);
+    if (!function) {
+        GetterSetter* getterSetter = jsDynamicCast<GetterSetter*>(value);
+
+        if (!getterSetter)
+            return false;
+
+        returnJSValue = JSValue(getterSetter);
+        return true;
+    }
+
+    returnJSValue = value;
+    return true;
+}
+
+bool Graph::isStringPrototypeMethodSane(JSGlobalObject* globalObject, UniquedStringImpl* uid)
+{
+    ObjectPropertyConditionSet conditions = generateConditionsForPrototypeEquivalenceConcurrently(m_vm, globalObject, globalObject->stringObjectStructure(), globalObject->stringPrototype(), uid);
+
+    if (!conditions.isValid())
+        return false;
+
+    ObjectPropertyCondition equivalenceCondition = conditions.slotBaseCondition();
+    RELEASE_ASSERT(equivalenceCondition.hasRequiredValue());
+    JSFunction* function = jsDynamicCast<JSFunction*>(equivalenceCondition.condition().requiredValue());
+    if (!function)
+        return false;
+
+    if (function->executable()->intrinsicFor(CodeForCall) != StringPrototypeValueOfIntrinsic)
+        return false;
+    
+    return watchConditions(conditions);
+}
+
+
+bool Graph::canOptimizeStringObjectAccess(const CodeOrigin& codeOrigin)
+{
+    if (hasExitSite(codeOrigin, NotStringObject))
+        return false;
+
+    JSGlobalObject* globalObject = globalObjectFor(codeOrigin);
+    Structure* stringObjectStructure = globalObjectFor(codeOrigin)->stringObjectStructure();
+    registerStructure(stringObjectStructure);
+    ASSERT(stringObjectStructure->storedPrototype().isObject());
+    ASSERT(stringObjectStructure->storedPrototype().asCell()->classInfo() == StringPrototype::info());
+
+    if (!watchConditions(generateConditionsForPropertyMissConcurrently(m_vm, globalObject, stringObjectStructure, m_vm.propertyNames->toPrimitiveSymbol.impl())))
+        return false;
+
+    // We're being conservative here. We want DFG's ToString on StringObject to be
+    // used in both numeric contexts (that would call valueOf()) and string contexts
+    // (that would call toString()). We don't want the DFG to have to distinguish
+    // between the two, just because that seems like it would get confusing. So we
+    // just require both methods to be sane.
+    if (!isStringPrototypeMethodSane(globalObject, m_vm.propertyNames->valueOf.impl()))
+        return false;
+    return isStringPrototypeMethodSane(globalObject, m_vm.propertyNames->toString.impl());
+}
+
+bool Graph::willCatchExceptionInMachineFrame(CodeOrigin codeOrigin, CodeOrigin& opCatchOriginOut, HandlerInfo*& catchHandlerOut)
+{
+    if (!m_hasExceptionHandlers)
+        return false;
+
+    unsigned bytecodeIndexToCheck = codeOrigin.bytecodeIndex;
+    while (1) {
+        InlineCallFrame* inlineCallFrame = codeOrigin.inlineCallFrame;
+        CodeBlock* codeBlock = baselineCodeBlockFor(inlineCallFrame);
+        if (HandlerInfo* handler = codeBlock->handlerForBytecodeOffset(bytecodeIndexToCheck)) {
+            opCatchOriginOut = CodeOrigin(handler->target, inlineCallFrame);
+            catchHandlerOut = handler;
+            return true;
+        }
+
+        if (!inlineCallFrame)
+            return false;
+
+        bytecodeIndexToCheck = inlineCallFrame->directCaller.bytecodeIndex;
+        codeOrigin = codeOrigin.inlineCallFrame->directCaller;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGGraph.h b/dfg/DFGGraph.h
new file mode 100644
index 0000000..6d52469
--- /dev/null
+++ b/dfg/DFGGraph.h
@@ -0,0 +1,1026 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "AssemblyHelpers.h"
+#include "BytecodeLivenessAnalysisInlines.h"
+#include "CodeBlock.h"
+#include "DFGArgumentPosition.h"
+#include "DFGBasicBlock.h"
+#include "DFGFrozenValue.h"
+#include "DFGLongLivedState.h"
+#include "DFGNode.h"
+#include "DFGNodeAllocator.h"
+#include "DFGPlan.h"
+#include "DFGPropertyTypeKey.h"
+#include "DFGScannable.h"
+#include "FullBytecodeLiveness.h"
+#include "MethodOfGettingAValueProfile.h"
+#include <unordered_map>
+#include <wtf/BitVector.h>
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class CodeBlock;
+class ExecState;
+
+namespace DFG {
+
+class BackwardsCFG;
+class BackwardsDominators;
+class CFG;
+class ControlEquivalenceAnalysis;
+class Dominators;
+class FlowIndexing;
+class NaturalLoops;
+class PrePostNumbering;
+
+template<typename> class FlowMap;
+
+#define DFG_NODE_DO_TO_CHILDREN(graph, node, thingToDo) do {            \
+        Node* _node = (node);                                           \
+        if (_node->flags() & NodeHasVarArgs) {                          \
+            for (unsigned _childIdx = _node->firstChild();              \
+                _childIdx < _node->firstChild() + _node->numChildren(); \
+                _childIdx++) {                                          \
+                if (!!(graph).m_varArgChildren[_childIdx])              \
+                    thingToDo(_node, (graph).m_varArgChildren[_childIdx]); \
+            }                                                           \
+        } else {                                                        \
+            if (!_node->child1()) {                                     \
+                ASSERT(                                                 \
+                    !_node->child2()                                    \
+                    && !_node->child3());                               \
+                break;                                                  \
+            }                                                           \
+            thingToDo(_node, _node->child1());                          \
+                                                                        \
+            if (!_node->child2()) {                                     \
+                ASSERT(!_node->child3());                               \
+                break;                                                  \
+            }                                                           \
+            thingToDo(_node, _node->child2());                          \
+                                                                        \
+            if (!_node->child3())                                       \
+                break;                                                  \
+            thingToDo(_node, _node->child3());                          \
+        }                                                               \
+    } while (false)
+
+#define DFG_ASSERT(graph, node, assertion) do {                         \
+        if (!!(assertion))                                              \
+            break;                                                      \
+        (graph).handleAssertionFailure(                                 \
+            (node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, #assertion); \
+    } while (false)
+
+#define DFG_CRASH(graph, node, reason) do {                             \
+        (graph).handleAssertionFailure(                                 \
+            (node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, (reason)); \
+    } while (false)
+
+struct InlineVariableData {
+    InlineCallFrame* inlineCallFrame;
+    unsigned argumentPositionStart;
+    VariableAccessData* calleeVariable;
+};
+
+enum AddSpeculationMode {
+    DontSpeculateInt32,
+    SpeculateInt32AndTruncateConstants,
+    SpeculateInt32
+};
+
+//
+// === Graph ===
+//
+// The order may be significant for nodes with side-effects (property accesses, value conversions).
+// Nodes that are 'dead' remain in the vector with refCount 0.
+class Graph : public virtual Scannable {
+public:
+    Graph(VM&, Plan&, LongLivedState&);
+    ~Graph();
+    
+    void changeChild(Edge& edge, Node* newNode)
+    {
+        edge.setNode(newNode);
+    }
+    
+    void changeEdge(Edge& edge, Edge newEdge)
+    {
+        edge = newEdge;
+    }
+    
+    void compareAndSwap(Edge& edge, Node* oldNode, Node* newNode)
+    {
+        if (edge.node() != oldNode)
+            return;
+        changeChild(edge, newNode);
+    }
+    
+    void compareAndSwap(Edge& edge, Edge oldEdge, Edge newEdge)
+    {
+        if (edge != oldEdge)
+            return;
+        changeEdge(edge, newEdge);
+    }
+    
+    void performSubstitution(Node* node)
+    {
+        if (node->flags() & NodeHasVarArgs) {
+            for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++)
+                performSubstitutionForEdge(m_varArgChildren[childIdx]);
+        } else {
+            performSubstitutionForEdge(node->child1());
+            performSubstitutionForEdge(node->child2());
+            performSubstitutionForEdge(node->child3());
+        }
+    }
+    
+    void performSubstitutionForEdge(Edge& child)
+    {
+        // Check if this operand is actually unused.
+        if (!child)
+            return;
+        
+        // Check if there is any replacement.
+        Node* replacement = child->replacement();
+        if (!replacement)
+            return;
+        
+        child.setNode(replacement);
+        
+        // There is definitely a replacement. Assert that the replacement does not
+        // have a replacement.
+        ASSERT(!child->replacement());
+    }
+    
+    template<typename... Params>
+    Node* addNode(Params... params)
+    {
+        Node* node = new (m_allocator) Node(params...);
+        addNodeToMapByIndex(node);
+        return node;
+    }
+    template<typename... Params>
+    Node* addNode(SpeculatedType type, Params... params)
+    {
+        Node* node = new (m_allocator) Node(params...);
+        node->predict(type);
+        addNodeToMapByIndex(node);
+        return node;
+    }
+
+    void deleteNode(Node*);
+    unsigned maxNodeCount() const { return m_nodesByIndex.size(); }
+    Node* nodeAt(unsigned index) const { return m_nodesByIndex[index]; }
+    void packNodeIndices();
+
+    void dethread();
+    
+    FrozenValue* freeze(JSValue); // We use weak freezing by default.
+    FrozenValue* freezeStrong(JSValue); // Shorthand for freeze(value)->strengthenTo(StrongValue).
+    
+    void convertToConstant(Node* node, FrozenValue* value);
+    void convertToConstant(Node* node, JSValue value);
+    void convertToStrongConstant(Node* node, JSValue value);
+    
+    RegisteredStructure registerStructure(Structure* structure)
+    {
+        StructureRegistrationResult ignored;
+        return registerStructure(structure, ignored);
+    }
+    RegisteredStructure registerStructure(Structure*, StructureRegistrationResult&);
+    void assertIsRegistered(Structure* structure);
+    
+    // CodeBlock is optional, but may allow additional information to be dumped (e.g. Identifier names).
+    void dump(PrintStream& = WTF::dataFile(), DumpContext* = 0);
+    
+    bool terminalsAreValid();
+    
+    enum PhiNodeDumpMode { DumpLivePhisOnly, DumpAllPhis };
+    void dumpBlockHeader(PrintStream&, const char* prefix, BasicBlock*, PhiNodeDumpMode, DumpContext*);
+    void dump(PrintStream&, Edge);
+    void dump(PrintStream&, const char* prefix, Node*, DumpContext* = 0);
+    static int amountOfNodeWhiteSpace(Node*);
+    static void printNodeWhiteSpace(PrintStream&, Node*);
+
+    // Dump the code origin of the given node as a diff from the code origin of the
+    // preceding node. Returns true if anything was printed.
+    bool dumpCodeOrigin(PrintStream&, const char* prefix, Node*& previousNode, Node* currentNode, DumpContext*);
+
+    AddSpeculationMode addSpeculationMode(Node* add, bool leftShouldSpeculateInt32, bool rightShouldSpeculateInt32, PredictionPass pass)
+    {
+        ASSERT(add->op() == ValueAdd || add->op() == ArithAdd || add->op() == ArithSub);
+        
+        RareCaseProfilingSource source = add->sourceFor(pass);
+        
+        Node* left = add->child1().node();
+        Node* right = add->child2().node();
+        
+        if (left->hasConstant())
+            return addImmediateShouldSpeculateInt32(add, rightShouldSpeculateInt32, right, left, source);
+        if (right->hasConstant())
+            return addImmediateShouldSpeculateInt32(add, leftShouldSpeculateInt32, left, right, source);
+        
+        return (leftShouldSpeculateInt32 && rightShouldSpeculateInt32 && add->canSpeculateInt32(source)) ? SpeculateInt32 : DontSpeculateInt32;
+    }
+    
+    AddSpeculationMode valueAddSpeculationMode(Node* add, PredictionPass pass)
+    {
+        return addSpeculationMode(
+            add,
+            add->child1()->shouldSpeculateInt32OrBooleanExpectingDefined(),
+            add->child2()->shouldSpeculateInt32OrBooleanExpectingDefined(),
+            pass);
+    }
+    
+    AddSpeculationMode arithAddSpeculationMode(Node* add, PredictionPass pass)
+    {
+        return addSpeculationMode(
+            add,
+            add->child1()->shouldSpeculateInt32OrBooleanForArithmetic(),
+            add->child2()->shouldSpeculateInt32OrBooleanForArithmetic(),
+            pass);
+    }
+    
+    AddSpeculationMode addSpeculationMode(Node* add, PredictionPass pass)
+    {
+        if (add->op() == ValueAdd)
+            return valueAddSpeculationMode(add, pass);
+        
+        return arithAddSpeculationMode(add, pass);
+    }
+    
+    bool addShouldSpeculateInt32(Node* add, PredictionPass pass)
+    {
+        return addSpeculationMode(add, pass) != DontSpeculateInt32;
+    }
+    
+    bool addShouldSpeculateAnyInt(Node* add)
+    {
+        if (!enableInt52())
+            return false;
+        
+        Node* left = add->child1().node();
+        Node* right = add->child2().node();
+
+        bool speculation = Node::shouldSpeculateAnyInt(left, right);
+        return speculation && !hasExitSite(add, Int52Overflow);
+    }
+    
+    bool binaryArithShouldSpeculateInt32(Node* node, PredictionPass pass)
+    {
+        Node* left = node->child1().node();
+        Node* right = node->child2().node();
+        
+        return Node::shouldSpeculateInt32OrBooleanForArithmetic(left, right)
+            && node->canSpeculateInt32(node->sourceFor(pass));
+    }
+    
+    bool binaryArithShouldSpeculateAnyInt(Node* node, PredictionPass pass)
+    {
+        if (!enableInt52())
+            return false;
+        
+        Node* left = node->child1().node();
+        Node* right = node->child2().node();
+
+        return Node::shouldSpeculateAnyInt(left, right)
+            && node->canSpeculateInt52(pass)
+            && !hasExitSite(node, Int52Overflow);
+    }
+    
+    bool unaryArithShouldSpeculateInt32(Node* node, PredictionPass pass)
+    {
+        return node->child1()->shouldSpeculateInt32OrBooleanForArithmetic()
+            && node->canSpeculateInt32(pass);
+    }
+    
+    bool unaryArithShouldSpeculateAnyInt(Node* node, PredictionPass pass)
+    {
+        if (!enableInt52())
+            return false;
+        return node->child1()->shouldSpeculateAnyInt()
+            && node->canSpeculateInt52(pass)
+            && !hasExitSite(node, Int52Overflow);
+    }
+
+    bool canOptimizeStringObjectAccess(const CodeOrigin&);
+
+    bool getRegExpPrototypeProperty(JSObject* regExpPrototype, Structure* regExpPrototypeStructure, UniquedStringImpl* uid, JSValue& returnJSValue);
+
+    bool roundShouldSpeculateInt32(Node* arithRound, PredictionPass pass)
+    {
+        ASSERT(arithRound->op() == ArithRound || arithRound->op() == ArithFloor || arithRound->op() == ArithCeil || arithRound->op() == ArithTrunc);
+        return arithRound->canSpeculateInt32(pass) && !hasExitSite(arithRound->origin.semantic, Overflow) && !hasExitSite(arithRound->origin.semantic, NegativeZero);
+    }
+    
+    static const char *opName(NodeType);
+    
+    RegisteredStructureSet* addStructureSet(const StructureSet& structureSet)
+    {
+        m_structureSets.append();
+        RegisteredStructureSet* result = &m_structureSets.last();
+
+        for (Structure* structure : structureSet)
+            result->add(registerStructure(structure));
+
+        return result;
+    }
+
+    RegisteredStructureSet* addStructureSet(const RegisteredStructureSet& structureSet)
+    {
+        m_structureSets.append();
+        RegisteredStructureSet* result = &m_structureSets.last();
+
+        for (RegisteredStructure structure : structureSet)
+            result->add(structure);
+
+        return result;
+    }
+    
+    JSGlobalObject* globalObjectFor(CodeOrigin codeOrigin)
+    {
+        return m_codeBlock->globalObjectFor(codeOrigin);
+    }
+    
+    JSObject* globalThisObjectFor(CodeOrigin codeOrigin)
+    {
+        JSGlobalObject* object = globalObjectFor(codeOrigin);
+        return jsCast<JSObject*>(object->methodTable()->toThis(object, object->globalExec(), NotStrictMode));
+    }
+    
+    ScriptExecutable* executableFor(InlineCallFrame* inlineCallFrame)
+    {
+        if (!inlineCallFrame)
+            return m_codeBlock->ownerScriptExecutable();
+        
+        return inlineCallFrame->baselineCodeBlock->ownerScriptExecutable();
+    }
+    
+    ScriptExecutable* executableFor(const CodeOrigin& codeOrigin)
+    {
+        return executableFor(codeOrigin.inlineCallFrame);
+    }
+    
+    CodeBlock* baselineCodeBlockFor(InlineCallFrame* inlineCallFrame)
+    {
+        if (!inlineCallFrame)
+            return m_profiledBlock;
+        return baselineCodeBlockForInlineCallFrame(inlineCallFrame);
+    }
+    
+    CodeBlock* baselineCodeBlockFor(const CodeOrigin& codeOrigin)
+    {
+        return baselineCodeBlockForOriginAndBaselineCodeBlock(codeOrigin, m_profiledBlock);
+    }
+    
+    bool isStrictModeFor(CodeOrigin codeOrigin)
+    {
+        if (!codeOrigin.inlineCallFrame)
+            return m_codeBlock->isStrictMode();
+        return codeOrigin.inlineCallFrame->isStrictMode();
+    }
+    
+    ECMAMode ecmaModeFor(CodeOrigin codeOrigin)
+    {
+        return isStrictModeFor(codeOrigin) ? StrictMode : NotStrictMode;
+    }
+    
+    bool masqueradesAsUndefinedWatchpointIsStillValid(const CodeOrigin& codeOrigin)
+    {
+        return globalObjectFor(codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid();
+    }
+    
+    bool hasGlobalExitSite(const CodeOrigin& codeOrigin, ExitKind exitKind)
+    {
+        return baselineCodeBlockFor(codeOrigin)->hasExitSite(FrequentExitSite(exitKind));
+    }
+    
+    bool hasExitSite(const CodeOrigin& codeOrigin, ExitKind exitKind)
+    {
+        return baselineCodeBlockFor(codeOrigin)->hasExitSite(FrequentExitSite(codeOrigin.bytecodeIndex, exitKind));
+    }
+    
+    bool hasExitSite(Node* node, ExitKind exitKind)
+    {
+        return hasExitSite(node->origin.semantic, exitKind);
+    }
+    
+    MethodOfGettingAValueProfile methodOfGettingAValueProfileFor(Node* currentNode, Node* operandNode);
+    
+    BlockIndex numBlocks() const { return m_blocks.size(); }
+    BasicBlock* block(BlockIndex blockIndex) const { return m_blocks[blockIndex].get(); }
+    BasicBlock* lastBlock() const { return block(numBlocks() - 1); }
+
+    void appendBlock(PassRefPtr<BasicBlock> basicBlock)
+    {
+        basicBlock->index = m_blocks.size();
+        m_blocks.append(basicBlock);
+    }
+    
+    void killBlock(BlockIndex blockIndex)
+    {
+        m_blocks[blockIndex] = nullptr;
+    }
+    
+    void killBlock(BasicBlock* basicBlock)
+    {
+        killBlock(basicBlock->index);
+    }
+    
+    void killBlockAndItsContents(BasicBlock*);
+    
+    void killUnreachableBlocks();
+    
+    void determineReachability();
+    void resetReachability();
+    
+    void computeRefCounts();
+    
+    unsigned varArgNumChildren(Node* node)
+    {
+        ASSERT(node->flags() & NodeHasVarArgs);
+        return node->numChildren();
+    }
+    
+    unsigned numChildren(Node* node)
+    {
+        if (node->flags() & NodeHasVarArgs)
+            return varArgNumChildren(node);
+        return AdjacencyList::Size;
+    }
+    
+    Edge& varArgChild(Node* node, unsigned index)
+    {
+        ASSERT(node->flags() & NodeHasVarArgs);
+        return m_varArgChildren[node->firstChild() + index];
+    }
+    
+    Edge& child(Node* node, unsigned index)
+    {
+        if (node->flags() & NodeHasVarArgs)
+            return varArgChild(node, index);
+        return node->children.child(index);
+    }
+    
+    void voteNode(Node* node, unsigned ballot, float weight = 1)
+    {
+        switch (node->op()) {
+        case ValueToInt32:
+        case UInt32ToNumber:
+            node = node->child1().node();
+            break;
+        default:
+            break;
+        }
+        
+        if (node->op() == GetLocal)
+            node->variableAccessData()->vote(ballot, weight);
+    }
+    
+    void voteNode(Edge edge, unsigned ballot, float weight = 1)
+    {
+        voteNode(edge.node(), ballot, weight);
+    }
+    
+    void voteChildren(Node* node, unsigned ballot, float weight = 1)
+    {
+        if (node->flags() & NodeHasVarArgs) {
+            for (unsigned childIdx = node->firstChild();
+                childIdx < node->firstChild() + node->numChildren();
+                childIdx++) {
+                if (!!m_varArgChildren[childIdx])
+                    voteNode(m_varArgChildren[childIdx], ballot, weight);
+            }
+            return;
+        }
+        
+        if (!node->child1())
+            return;
+        voteNode(node->child1(), ballot, weight);
+        if (!node->child2())
+            return;
+        voteNode(node->child2(), ballot, weight);
+        if (!node->child3())
+            return;
+        voteNode(node->child3(), ballot, weight);
+    }
+    
+    template<typename T> // T = Node* or Edge
+    void substitute(BasicBlock& block, unsigned startIndexInBlock, T oldThing, T newThing)
+    {
+        for (unsigned indexInBlock = startIndexInBlock; indexInBlock < block.size(); ++indexInBlock) {
+            Node* node = block[indexInBlock];
+            if (node->flags() & NodeHasVarArgs) {
+                for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); ++childIdx) {
+                    if (!!m_varArgChildren[childIdx])
+                        compareAndSwap(m_varArgChildren[childIdx], oldThing, newThing);
+                }
+                continue;
+            }
+            if (!node->child1())
+                continue;
+            compareAndSwap(node->children.child1(), oldThing, newThing);
+            if (!node->child2())
+                continue;
+            compareAndSwap(node->children.child2(), oldThing, newThing);
+            if (!node->child3())
+                continue;
+            compareAndSwap(node->children.child3(), oldThing, newThing);
+        }
+    }
+    
+    // Use this if you introduce a new GetLocal and you know that you introduced it *before*
+    // any GetLocals in the basic block.
+    // FIXME: it may be appropriate, in the future, to generalize this to handle GetLocals
+    // introduced anywhere in the basic block.
+    void substituteGetLocal(BasicBlock& block, unsigned startIndexInBlock, VariableAccessData* variableAccessData, Node* newGetLocal);
+    
+    void invalidateCFG();
+    void invalidateNodeLiveness();
+    
+    void clearFlagsOnAllNodes(NodeFlags);
+    
+    void clearReplacements();
+    void clearEpochs();
+    void initializeNodeOwners();
+    
+    BlockList blocksInPreOrder();
+    BlockList blocksInPostOrder();
+    
+    class NaturalBlockIterable {
+    public:
+        NaturalBlockIterable()
+            : m_graph(nullptr)
+        {
+        }
+        
+        NaturalBlockIterable(Graph& graph)
+            : m_graph(&graph)
+        {
+        }
+        
+        class iterator {
+        public:
+            iterator()
+                : m_graph(nullptr)
+                , m_index(0)
+            {
+            }
+            
+            iterator(Graph& graph, BlockIndex index)
+                : m_graph(&graph)
+                , m_index(findNext(index))
+            {
+            }
+            
+            BasicBlock *operator*()
+            {
+                return m_graph->block(m_index);
+            }
+            
+            iterator& operator++()
+            {
+                m_index = findNext(m_index + 1);
+                return *this;
+            }
+            
+            bool operator==(const iterator& other) const
+            {
+                return m_index == other.m_index;
+            }
+            
+            bool operator!=(const iterator& other) const
+            {
+                return !(*this == other);
+            }
+            
+        private:
+            BlockIndex findNext(BlockIndex index)
+            {
+                while (index < m_graph->numBlocks() && !m_graph->block(index))
+                    index++;
+                return index;
+            }
+            
+            Graph* m_graph;
+            BlockIndex m_index;
+        };
+        
+        iterator begin()
+        {
+            return iterator(*m_graph, 0);
+        }
+        
+        iterator end()
+        {
+            return iterator(*m_graph, m_graph->numBlocks());
+        }
+        
+    private:
+        Graph* m_graph;
+    };
+    
+    NaturalBlockIterable blocksInNaturalOrder()
+    {
+        return NaturalBlockIterable(*this);
+    }
+    
+    template<typename ChildFunctor>
+    void doToChildrenWithNode(Node* node, const ChildFunctor& functor)
+    {
+        DFG_NODE_DO_TO_CHILDREN(*this, node, functor);
+    }
+    
+    template<typename ChildFunctor>
+    void doToChildren(Node* node, const ChildFunctor& functor)
+    {
+        doToChildrenWithNode(
+            node,
+            [&functor] (Node*, Edge& edge) {
+                functor(edge);
+            });
+    }
+    
+    bool uses(Node* node, Node* child)
+    {
+        bool result = false;
+        doToChildren(node, [&] (Edge edge) { result |= edge == child; });
+        return result;
+    }
+
+    bool isWatchingHavingABadTimeWatchpoint(Node* node)
+    {
+        JSGlobalObject* globalObject = globalObjectFor(node->origin.semantic);
+        return watchpoints().isWatched(globalObject->havingABadTimeWatchpoint());
+    }
+
+    bool isWatchingArrayIteratorProtocolWatchpoint(Node* node)
+    {
+        JSGlobalObject* globalObject = globalObjectFor(node->origin.semantic);
+        InlineWatchpointSet& set = globalObject->arrayIteratorProtocolWatchpoint();
+        if (watchpoints().isWatched(set))
+            return true;
+
+        if (set.isStillValid()) {
+            // Since the global object owns this watchpoint, we make ourselves have a weak pointer to it.
+            // If the global object got deallocated, it wouldn't fire the watchpoint. It's unlikely the
+            // global object would get deallocated without this code ever getting thrown away, however,
+            // it's more sound logically to depend on the global object lifetime weakly.
+            freeze(globalObject);
+            watchpoints().addLazily(set);
+            return true;
+        }
+
+        return false;
+    }
+    
+    Profiler::Compilation* compilation() { return m_plan.compilation.get(); }
+    
+    DesiredIdentifiers& identifiers() { return m_plan.identifiers; }
+    DesiredWatchpoints& watchpoints() { return m_plan.watchpoints; }
+    
+    // Returns false if the key is already invalid or unwatchable. If this is a Presence condition,
+    // this also makes it cheap to query if the condition holds. Also makes sure that the GC knows
+    // what's going on.
+    bool watchCondition(const ObjectPropertyCondition&);
+    bool watchConditions(const ObjectPropertyConditionSet&);
+
+    // Checks if it's known that loading from the given object at the given offset is fine. This is
+    // computed by tracking which conditions we track with watchCondition().
+    bool isSafeToLoad(JSObject* base, PropertyOffset);
+
+    void registerInferredType(const InferredType::Descriptor& type)
+    {
+        if (type.structure())
+            registerStructure(type.structure());
+    }
+
+    // Tells us what inferred type we are able to prove the property to have now and in the future.
+    InferredType::Descriptor inferredTypeFor(const PropertyTypeKey&);
+    InferredType::Descriptor inferredTypeForProperty(Structure* structure, UniquedStringImpl* uid)
+    {
+        return inferredTypeFor(PropertyTypeKey(structure, uid));
+    }
+
+    AbstractValue inferredValueForProperty(
+        const RegisteredStructureSet& base, UniquedStringImpl* uid, StructureClobberState = StructuresAreWatched);
+
+    // This uses either constant property inference or property type inference to derive a good abstract
+    // value for some property accessed with the given abstract value base.
+    AbstractValue inferredValueForProperty(
+        const AbstractValue& base, UniquedStringImpl* uid, PropertyOffset, StructureClobberState);
+    
+    FullBytecodeLiveness& livenessFor(CodeBlock*);
+    FullBytecodeLiveness& livenessFor(InlineCallFrame*);
+    
+    // Quickly query if a single local is live at the given point. This is faster than calling
+    // forAllLiveInBytecode() if you will only query one local. But, if you want to know all of the
+    // locals live, then calling this for each local is much slower than forAllLiveInBytecode().
+    bool isLiveInBytecode(VirtualRegister, CodeOrigin);
+    
+    // Quickly get all of the non-argument locals live at the given point. This doesn't give you
+    // any arguments because those are all presumed live. You can call forAllLiveInBytecode() to
+    // also get the arguments. This is much faster than calling isLiveInBytecode() for each local.
+    template<typename Functor>
+    void forAllLocalsLiveInBytecode(CodeOrigin codeOrigin, const Functor& functor)
+    {
+        // Support for not redundantly reporting arguments. Necessary because in case of a varargs
+        // call, only the callee knows that arguments are live while in the case of a non-varargs
+        // call, both callee and caller will see the variables live.
+        VirtualRegister exclusionStart;
+        VirtualRegister exclusionEnd;
+
+        CodeOrigin* codeOriginPtr = &codeOrigin;
+        
+        for (;;) {
+            InlineCallFrame* inlineCallFrame = codeOriginPtr->inlineCallFrame;
+            VirtualRegister stackOffset(inlineCallFrame ? inlineCallFrame->stackOffset : 0);
+            
+            if (inlineCallFrame) {
+                if (inlineCallFrame->isClosureCall)
+                    functor(stackOffset + CallFrameSlot::callee);
+                if (inlineCallFrame->isVarargs())
+                    functor(stackOffset + CallFrameSlot::argumentCount);
+            }
+            
+            CodeBlock* codeBlock = baselineCodeBlockFor(inlineCallFrame);
+            FullBytecodeLiveness& fullLiveness = livenessFor(codeBlock);
+            const FastBitVector& liveness = fullLiveness.getLiveness(codeOriginPtr->bytecodeIndex);
+            for (unsigned relativeLocal = codeBlock->m_numCalleeLocals; relativeLocal--;) {
+                VirtualRegister reg = stackOffset + virtualRegisterForLocal(relativeLocal);
+                
+                // Don't report if our callee already reported.
+                if (reg >= exclusionStart && reg < exclusionEnd)
+                    continue;
+                
+                if (liveness[relativeLocal])
+                    functor(reg);
+            }
+            
+            if (!inlineCallFrame)
+                break;
+
+            // Arguments are always live. This would be redundant if it wasn't for our
+            // op_call_varargs inlining. See the comment above.
+            exclusionStart = stackOffset + CallFrame::argumentOffsetIncludingThis(0);
+            exclusionEnd = stackOffset + CallFrame::argumentOffsetIncludingThis(inlineCallFrame->arguments.size());
+            
+            // We will always have a "this" argument and exclusionStart should be a smaller stack
+            // offset than exclusionEnd.
+            ASSERT(exclusionStart < exclusionEnd);
+
+            for (VirtualRegister reg = exclusionStart; reg < exclusionEnd; reg += 1)
+                functor(reg);
+            
+            codeOriginPtr = inlineCallFrame->getCallerSkippingTailCalls();
+
+            // The first inline call frame could be an inline tail call
+            if (!codeOriginPtr)
+                break;
+        }
+    }
+    
+    // Get a BitVector of all of the non-argument locals live right now. This is mostly useful if
+    // you want to compare two sets of live locals from two different CodeOrigins.
+    BitVector localsLiveInBytecode(CodeOrigin);
+    
+    // Tells you all of the arguments and locals live at the given CodeOrigin. This is a small
+    // extension to forAllLocalsLiveInBytecode(), since all arguments are always presumed live.
+    template<typename Functor>
+    void forAllLiveInBytecode(CodeOrigin codeOrigin, const Functor& functor)
+    {
+        forAllLocalsLiveInBytecode(codeOrigin, functor);
+        
+        // Report all arguments as being live.
+        for (unsigned argument = block(0)->variablesAtHead.numberOfArguments(); argument--;)
+            functor(virtualRegisterForArgument(argument));
+    }
+    
+    BytecodeKills& killsFor(CodeBlock*);
+    BytecodeKills& killsFor(InlineCallFrame*);
+    
+    static unsigned parameterSlotsForArgCount(unsigned);
+    
+    unsigned frameRegisterCount();
+    unsigned stackPointerOffset();
+    unsigned requiredRegisterCountForExit();
+    unsigned requiredRegisterCountForExecutionAndExit();
+    
+    JSValue tryGetConstantProperty(JSValue base, const RegisteredStructureSet&, PropertyOffset);
+    JSValue tryGetConstantProperty(JSValue base, Structure*, PropertyOffset);
+    JSValue tryGetConstantProperty(JSValue base, const StructureAbstractValue&, PropertyOffset);
+    JSValue tryGetConstantProperty(const AbstractValue&, PropertyOffset);
+    
+    JSValue tryGetConstantClosureVar(JSValue base, ScopeOffset);
+    JSValue tryGetConstantClosureVar(const AbstractValue&, ScopeOffset);
+    JSValue tryGetConstantClosureVar(Node*, ScopeOffset);
+    
+    JSArrayBufferView* tryGetFoldableView(JSValue);
+    JSArrayBufferView* tryGetFoldableView(JSValue, ArrayMode arrayMode);
+    
+    void registerFrozenValues();
+    
+    void visitChildren(SlotVisitor&) override;
+    
+    NO_RETURN_DUE_TO_CRASH void handleAssertionFailure(
+        std::nullptr_t, const char* file, int line, const char* function,
+        const char* assertion);
+    NO_RETURN_DUE_TO_CRASH void handleAssertionFailure(
+        Node*, const char* file, int line, const char* function,
+        const char* assertion);
+    NO_RETURN_DUE_TO_CRASH void handleAssertionFailure(
+        BasicBlock*, const char* file, int line, const char* function,
+        const char* assertion);
+
+    bool hasDebuggerEnabled() const { return m_hasDebuggerEnabled; }
+
+    Dominators& ensureDominators();
+    PrePostNumbering& ensurePrePostNumbering();
+    NaturalLoops& ensureNaturalLoops();
+    BackwardsCFG& ensureBackwardsCFG();
+    BackwardsDominators& ensureBackwardsDominators();
+    ControlEquivalenceAnalysis& ensureControlEquivalenceAnalysis();
+
+    // This function only makes sense to call after bytecode parsing
+    // because it queries the m_hasExceptionHandlers boolean whose value
+    // is only fully determined after bytcode parsing.
+    bool willCatchExceptionInMachineFrame(CodeOrigin, CodeOrigin& opCatchOriginOut, HandlerInfo*& catchHandlerOut);
+    
+    bool needsScopeRegister() const { return m_hasDebuggerEnabled || m_codeBlock->usesEval(); }
+    bool needsFlushedThis() const { return m_codeBlock->usesEval(); }
+
+    VM& m_vm;
+    Plan& m_plan;
+    CodeBlock* m_codeBlock;
+    CodeBlock* m_profiledBlock;
+    
+    NodeAllocator& m_allocator;
+
+    Vector< RefPtr<BasicBlock> , 8> m_blocks;
+    Vector<Edge, 16> m_varArgChildren;
+
+    HashMap<EncodedJSValue, FrozenValue*, EncodedJSValueHash, EncodedJSValueHashTraits> m_frozenValueMap;
+    Bag<FrozenValue> m_frozenValues;
+
+    Vector<uint32_t> m_uint32ValuesInUse;
+    
+    Bag<StorageAccessData> m_storageAccessData;
+    
+    // In CPS, this is all of the SetArgument nodes for the arguments in the machine code block
+    // that survived DCE. All of them except maybe "this" will survive DCE, because of the Flush
+    // nodes.
+    //
+    // In SSA, this is all of the GetStack nodes for the arguments in the machine code block that
+    // may have some speculation in the prologue and survived DCE. Note that to get the speculation
+    // for an argument in SSA, you must use m_argumentFormats, since we still have to speculate
+    // even if the argument got killed. For example:
+    //
+    //     function foo(x) {
+    //        var tmp = x + 1;
+    //     }
+    //
+    // Assume that x is always int during profiling. The ArithAdd for "x + 1" will be dead and will
+    // have a proven check for the edge to "x". So, we will not insert a Check node and we will
+    // kill the GetStack for "x". But, we must do the int check in the progolue, because that's the
+    // thing we used to allow DCE of ArithAdd. Otherwise the add could be impure:
+    //
+    //     var o = {
+    //         valueOf: function() { do side effects; }
+    //     };
+    //     foo(o);
+    //
+    // If we DCE the ArithAdd and we remove the int check on x, then this won't do the side
+    // effects.
+    Vector<Node*, 8> m_arguments;
+    
+    // In CPS, this is meaningless. In SSA, this is the argument speculation that we've locked in.
+    Vector<FlushFormat> m_argumentFormats;
+    
+    SegmentedVector<VariableAccessData, 16> m_variableAccessData;
+    SegmentedVector<ArgumentPosition, 8> m_argumentPositions;
+    Bag<Transition> m_transitions;
+    SegmentedVector<NewArrayBufferData, 4> m_newArrayBufferData;
+    Bag<BranchData> m_branchData;
+    Bag<SwitchData> m_switchData;
+    Bag<MultiGetByOffsetData> m_multiGetByOffsetData;
+    Bag<MultiPutByOffsetData> m_multiPutByOffsetData;
+    Bag<ObjectMaterializationData> m_objectMaterializationData;
+    Bag<CallVarargsData> m_callVarargsData;
+    Bag<LoadVarargsData> m_loadVarargsData;
+    Bag<StackAccessData> m_stackAccessData;
+    Bag<LazyJSValue> m_lazyJSValues;
+    Bag<CallDOMGetterData> m_callDOMGetterData;
+    Bag<BitVector> m_bitVectors;
+    Vector<InlineVariableData, 4> m_inlineVariableData;
+    HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
+    HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;
+    HashSet<std::pair<JSObject*, PropertyOffset>> m_safeToLoad;
+    HashMap<PropertyTypeKey, InferredType::Descriptor> m_inferredTypes;
+    Vector<RefPtr<DOMJIT::Patchpoint>> m_domJITPatchpoints;
+    std::unique_ptr<Dominators> m_dominators;
+    std::unique_ptr<PrePostNumbering> m_prePostNumbering;
+    std::unique_ptr<NaturalLoops> m_naturalLoops;
+    std::unique_ptr<CFG> m_cfg;
+    std::unique_ptr<BackwardsCFG> m_backwardsCFG;
+    std::unique_ptr<BackwardsDominators> m_backwardsDominators;
+    std::unique_ptr<ControlEquivalenceAnalysis> m_controlEquivalenceAnalysis;
+    unsigned m_localVars;
+    unsigned m_nextMachineLocal;
+    unsigned m_parameterSlots;
+    
+    HashSet<String> m_localStrings;
+    HashMap<const StringImpl*, String> m_copiedStrings;
+
+#if USE(JSVALUE32_64)
+    std::unordered_map<int64_t, double*> m_doubleConstantsMap;
+    std::unique_ptr<Bag<double>> m_doubleConstants;
+#endif
+    
+    OptimizationFixpointState m_fixpointState;
+    StructureRegistrationState m_structureRegistrationState;
+    GraphForm m_form;
+    UnificationState m_unificationState;
+    PlanStage m_planStage { PlanStage::Initial };
+    RefCountState m_refCountState;
+    bool m_hasDebuggerEnabled;
+    bool m_hasExceptionHandlers { false };
+    std::unique_ptr<FlowIndexing> m_indexingCache;
+    std::unique_ptr<FlowMap<AbstractValue>> m_abstractValuesCache;
+
+    RegisteredStructure stringStructure;
+    RegisteredStructure symbolStructure;
+
+private:
+    void addNodeToMapByIndex(Node*);
+
+    bool isStringPrototypeMethodSane(JSGlobalObject*, UniquedStringImpl*);
+
+    void handleSuccessor(Vector<BasicBlock*, 16>& worklist, BasicBlock*, BasicBlock* successor);
+    
+    AddSpeculationMode addImmediateShouldSpeculateInt32(Node* add, bool variableShouldSpeculateInt32, Node* operand, Node*immediate, RareCaseProfilingSource source)
+    {
+        ASSERT(immediate->hasConstant());
+        
+        JSValue immediateValue = immediate->asJSValue();
+        if (!immediateValue.isNumber() && !immediateValue.isBoolean())
+            return DontSpeculateInt32;
+        
+        if (!variableShouldSpeculateInt32)
+            return DontSpeculateInt32;
+
+        // Integer constants can be typed Double if they are written like a double in the source code (e.g. 42.0).
+        // In that case, we stay conservative unless the other operand was explicitly typed as integer.
+        NodeFlags operandResultType = operand->result();
+        if (operandResultType != NodeResultInt32 && immediateValue.isDouble())
+            return DontSpeculateInt32;
+        
+        if (immediateValue.isBoolean() || jsNumber(immediateValue.asNumber()).isInt32())
+            return add->canSpeculateInt32(source) ? SpeculateInt32 : DontSpeculateInt32;
+        
+        double doubleImmediate = immediateValue.asDouble();
+        const double twoToThe48 = 281474976710656.0;
+        if (doubleImmediate < -twoToThe48 || doubleImmediate > twoToThe48)
+            return DontSpeculateInt32;
+        
+        return bytecodeCanTruncateInteger(add->arithNodeFlags()) ? SpeculateInt32AndTruncateConstants : DontSpeculateInt32;
+    }
+
+    Vector<Node*, 0, UnsafeVectorOverflow> m_nodesByIndex;
+    Vector<unsigned, 0, UnsafeVectorOverflow> m_nodeIndexFreeList;
+    SegmentedVector<RegisteredStructureSet, 16> m_structureSets;
+};
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGGraphSafepoint.cpp b/dfg/DFGGraphSafepoint.cpp
new file mode 100644
index 0000000..e021e99
--- /dev/null
+++ b/dfg/DFGGraphSafepoint.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGGraphSafepoint.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+GraphSafepoint::GraphSafepoint(Graph& graph, Safepoint::Result& result)
+    : m_safepoint(graph.m_plan, result)
+{
+    m_safepoint.add(&graph);
+    m_safepoint.begin();
+}
+
+GraphSafepoint::~GraphSafepoint() { }
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGGraphSafepoint.h b/dfg/DFGGraphSafepoint.h
new file mode 100644
index 0000000..f57f246
--- /dev/null
+++ b/dfg/DFGGraphSafepoint.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGSafepoint.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+class GraphSafepoint {
+public:
+    GraphSafepoint(Graph&, Safepoint::Result&);
+    ~GraphSafepoint();
+    
+private:
+    Safepoint m_safepoint;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGHeapLocation.cpp b/dfg/DFGHeapLocation.cpp
new file mode 100644
index 0000000..9b2292d
--- /dev/null
+++ b/dfg/DFGHeapLocation.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGHeapLocation.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void HeapLocation::dump(PrintStream& out) const
+{
+    out.print(m_kind, ":", m_heap);
+    
+    if (!m_base)
+        return;
+    
+    out.print("[", m_base);
+    if (m_index)
+        out.print(", ", m_index);
+    out.print("]");
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, LocationKind kind)
+{
+    switch (kind) {
+    case InvalidLocationKind:
+        out.print("InvalidLocationKind");
+        return;
+        
+    case InvalidationPointLoc:
+        out.print("InvalidationPointLoc");
+        return;
+        
+    case IsObjectOrNullLoc:
+        out.print("IsObjectOrNullLoc");
+        return;
+
+    case IsFunctionLoc:
+        out.print("IsFunctionLoc");
+        return;
+        
+    case GetterLoc:
+        out.print("GetterLoc");
+        return;
+        
+    case SetterLoc:
+        out.print("SetterLoc");
+        return;
+        
+    case StackLoc:
+        out.print("StackLoc");
+        return;
+        
+    case StackPayloadLoc:
+        out.print("StackPayloadLoc");
+        return;
+        
+    case ArrayLengthLoc:
+        out.print("ArrayLengthLoc");
+        return;
+        
+    case ButterflyLoc:
+        out.print("ButterflyLoc");
+        return;
+        
+    case CheckTypeInfoFlagsLoc:
+        out.print("CheckTypeInfoFlagsLoc");
+        return;
+
+    case OverridesHasInstanceLoc:
+        out.print("OverridesHasInstanceLoc");
+        return;
+        
+    case ClosureVariableLoc:
+        out.print("ClosureVariableLoc");
+        return;
+        
+    case DirectArgumentsLoc:
+        out.print("DirectArgumentsLoc");
+        return;
+        
+    case GlobalVariableLoc:
+        out.print("GlobalVariableLoc");
+        return;
+        
+    case HasIndexedPropertyLoc:
+        out.print("HasIndexedPorpertyLoc");
+        return;
+        
+    case IndexedPropertyLoc:
+        out.print("IndexedPorpertyLoc");
+        return;
+        
+    case IndexedPropertyStorageLoc:
+        out.print("IndexedPropertyStorageLoc");
+        return;
+        
+    case InstanceOfLoc:
+        out.print("InstanceOfLoc");
+        return;
+        
+    case NamedPropertyLoc:
+        out.print("NamedPropertyLoc");
+        return;
+        
+    case TypedArrayByteOffsetLoc:
+        out.print("TypedArrayByteOffsetLoc");
+        return;
+        
+    case StructureLoc:
+        out.print("StructureLoc");
+        return;
+
+    case RegExpObjectLastIndexLoc:
+        out.print("RegExpObjectLastIndexLoc");
+        return;
+    case MapBucketLoc:
+        out.print("MapBucketLoc");
+        return;
+    case JSMapGetLoc:
+        out.print("JSMapGetLoc");
+        return;
+    case MapHasLoc:
+        out.print("MapHasLoc");
+        return;
+    case DOMStateLoc:
+        out.print("DOMStateLoc");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGHeapLocation.h b/dfg/DFGHeapLocation.h
new file mode 100644
index 0000000..6357be1
--- /dev/null
+++ b/dfg/DFGHeapLocation.h
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractHeap.h"
+#include "DFGLazyNode.h"
+#include "DFGNode.h"
+
+namespace JSC { namespace DFG {
+
+enum LocationKind {
+    InvalidLocationKind,
+    
+    ArrayLengthLoc,
+    ButterflyLoc,
+    CheckTypeInfoFlagsLoc,
+    OverridesHasInstanceLoc,
+    ClosureVariableLoc,
+    DirectArgumentsLoc,
+    GetterLoc,
+    GlobalVariableLoc,
+    HasIndexedPropertyLoc,
+    IndexedPropertyLoc,
+    IndexedPropertyStorageLoc,
+    InstanceOfLoc,
+    InvalidationPointLoc,
+    IsFunctionLoc,
+    IsObjectOrNullLoc,
+    NamedPropertyLoc,
+    RegExpObjectLastIndexLoc,
+    SetterLoc,
+    StructureLoc,
+    TypedArrayByteOffsetLoc,
+    StackLoc,
+    StackPayloadLoc,
+    MapBucketLoc,
+    JSMapGetLoc,
+    MapHasLoc,
+    DOMStateLoc,
+};
+
+class HeapLocation {
+public:
+    HeapLocation(
+        LocationKind kind = InvalidLocationKind,
+        AbstractHeap heap = AbstractHeap(),
+        Node* base = nullptr, LazyNode index = LazyNode())
+        : m_kind(kind)
+        , m_heap(heap)
+        , m_base(base)
+        , m_index(index)
+    {
+        ASSERT((kind == InvalidLocationKind) == !heap);
+        ASSERT(!!m_heap || !m_base);
+        ASSERT(m_base || !m_index);
+    }
+
+    HeapLocation(LocationKind kind, AbstractHeap heap, Node* base, Node* index)
+        : HeapLocation(kind, heap, base, LazyNode(index))
+    {
+    }
+    
+    HeapLocation(LocationKind kind, AbstractHeap heap, Edge base, Edge index = Edge())
+        : HeapLocation(kind, heap, base.node(), index.node())
+    {
+    }
+    
+    HeapLocation(WTF::HashTableDeletedValueType)
+        : m_kind(InvalidLocationKind)
+        , m_heap(WTF::HashTableDeletedValue)
+        , m_base(nullptr)
+        , m_index(nullptr)
+    {
+    }
+    
+    bool operator!() const { return !m_heap; }
+    
+    LocationKind kind() const { return m_kind; }
+    AbstractHeap heap() const { return m_heap; }
+    Node* base() const { return m_base; }
+    LazyNode index() const { return m_index; }
+    
+    unsigned hash() const
+    {
+        return m_kind + m_heap.hash() + m_index.hash() + m_kind;
+    }
+    
+    bool operator==(const HeapLocation& other) const
+    {
+        return m_kind == other.m_kind
+            && m_heap == other.m_heap
+            && m_base == other.m_base
+            && m_index == other.m_index;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return m_heap.isHashTableDeletedValue();
+    }
+    
+    void dump(PrintStream& out) const;
+    
+private:
+    LocationKind m_kind;
+    AbstractHeap m_heap;
+    Node* m_base;
+    LazyNode m_index;
+};
+
+struct HeapLocationHash {
+    static unsigned hash(const HeapLocation& key) { return key.hash(); }
+    static bool equal(const HeapLocation& a, const HeapLocation& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::LocationKind);
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::HeapLocation> {
+    typedef JSC::DFG::HeapLocationHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::HeapLocation> : SimpleClassHashTraits<JSC::DFG::HeapLocation> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGInPlaceAbstractState.cpp b/dfg/DFGInPlaceAbstractState.cpp
new file mode 100644
index 0000000..1d20d1d
--- /dev/null
+++ b/dfg/DFGInPlaceAbstractState.cpp
@@ -0,0 +1,398 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGInPlaceAbstractState.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGBasicBlock.h"
+#include "GetByIdStatus.h"
+#include "JSCInlines.h"
+#include "PutByIdStatus.h"
+#include "StringObject.h"
+
+namespace JSC { namespace DFG {
+
+static const bool verbose = false;
+
+InPlaceAbstractState::InPlaceAbstractState(Graph& graph)
+    : m_graph(graph)
+    , m_abstractValues(*graph.m_abstractValuesCache)
+    , m_variables(m_graph.m_codeBlock->numParameters(), graph.m_localVars)
+    , m_block(0)
+{
+}
+
+InPlaceAbstractState::~InPlaceAbstractState() { }
+
+void InPlaceAbstractState::beginBasicBlock(BasicBlock* basicBlock)
+{
+    ASSERT(!m_block);
+    
+    ASSERT(basicBlock->variablesAtHead.numberOfLocals() == basicBlock->valuesAtHead.numberOfLocals());
+    ASSERT(basicBlock->variablesAtTail.numberOfLocals() == basicBlock->valuesAtTail.numberOfLocals());
+    ASSERT(basicBlock->variablesAtHead.numberOfLocals() == basicBlock->variablesAtTail.numberOfLocals());
+
+    m_abstractValues.resize();
+    
+    for (size_t i = 0; i < basicBlock->size(); i++) {
+        NodeFlowProjection::forEach(
+            basicBlock->at(i), [&] (NodeFlowProjection nodeProjection) {
+                forNode(nodeProjection).clear();
+            });
+    }
+
+    m_variables = basicBlock->valuesAtHead;
+    
+    if (m_graph.m_form == SSA) {
+        for (NodeAbstractValuePair& entry : basicBlock->ssa->valuesAtHead) {
+            if (entry.node.isStillValid())
+                forNode(entry.node) = entry.value;
+        }
+    }
+    basicBlock->cfaShouldRevisit = false;
+    basicBlock->cfaHasVisited = true;
+    m_block = basicBlock;
+    m_isValid = true;
+    m_foundConstants = false;
+    m_branchDirection = InvalidBranchDirection;
+    m_structureClobberState = basicBlock->cfaStructureClobberStateAtHead;
+}
+
+static void setLiveValues(Vector<NodeAbstractValuePair>& values, const Vector<NodeFlowProjection>& live)
+{
+    values.resize(0);
+    values.reserveCapacity(live.size());
+    for (NodeFlowProjection node : live)
+        values.uncheckedAppend(NodeAbstractValuePair { node, AbstractValue() });
+}
+
+void InPlaceAbstractState::initialize()
+{
+    BasicBlock* root = m_graph.block(0);
+    root->cfaShouldRevisit = true;
+    root->cfaHasVisited = false;
+    root->cfaFoundConstants = false;
+    root->cfaStructureClobberStateAtHead = StructuresAreWatched;
+    root->cfaStructureClobberStateAtTail = StructuresAreWatched;
+    for (size_t i = 0; i < root->valuesAtHead.numberOfArguments(); ++i) {
+        root->valuesAtTail.argument(i).clear();
+
+        FlushFormat format;
+        if (m_graph.m_form == SSA)
+            format = m_graph.m_argumentFormats[i];
+        else {
+            Node* node = m_graph.m_arguments[i];
+            if (!node)
+                format = FlushedJSValue;
+            else {
+                ASSERT(node->op() == SetArgument);
+                format = node->variableAccessData()->flushFormat();
+            }
+        }
+        
+        switch (format) {
+        case FlushedInt32:
+            root->valuesAtHead.argument(i).setType(SpecInt32Only);
+            break;
+        case FlushedBoolean:
+            root->valuesAtHead.argument(i).setType(SpecBoolean);
+            break;
+        case FlushedCell:
+            root->valuesAtHead.argument(i).setType(m_graph, SpecCell);
+            break;
+        case FlushedJSValue:
+            root->valuesAtHead.argument(i).makeBytecodeTop();
+            break;
+        default:
+            DFG_CRASH(m_graph, nullptr, "Bad flush format for argument");
+            break;
+        }
+    }
+    for (size_t i = 0; i < root->valuesAtHead.numberOfLocals(); ++i) {
+        root->valuesAtHead.local(i).clear();
+        root->valuesAtTail.local(i).clear();
+    }
+    for (BlockIndex blockIndex = 1 ; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+        BasicBlock* block = m_graph.block(blockIndex);
+        if (!block)
+            continue;
+        ASSERT(block->isReachable);
+        block->cfaShouldRevisit = false;
+        block->cfaHasVisited = false;
+        block->cfaFoundConstants = false;
+        block->cfaStructureClobberStateAtHead = StructuresAreWatched;
+        block->cfaStructureClobberStateAtTail = StructuresAreWatched;
+        for (size_t i = 0; i < block->valuesAtHead.numberOfArguments(); ++i) {
+            block->valuesAtHead.argument(i).clear();
+            block->valuesAtTail.argument(i).clear();
+        }
+        for (size_t i = 0; i < block->valuesAtHead.numberOfLocals(); ++i) {
+            block->valuesAtHead.local(i).clear();
+            block->valuesAtTail.local(i).clear();
+        }
+    }
+    if (m_graph.m_form == SSA) {
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            setLiveValues(block->ssa->valuesAtHead, block->ssa->liveAtHead);
+            setLiveValues(block->ssa->valuesAtTail, block->ssa->liveAtTail);
+        }
+    }
+}
+
+bool InPlaceAbstractState::endBasicBlock()
+{
+    ASSERT(m_block);
+    
+    BasicBlock* block = m_block; // Save the block for successor merging.
+    
+    block->cfaFoundConstants = m_foundConstants;
+    block->cfaDidFinish = m_isValid;
+    block->cfaBranchDirection = m_branchDirection;
+    
+    if (!m_isValid) {
+        reset();
+        return false;
+    }
+
+    block->cfaStructureClobberStateAtTail = m_structureClobberState;
+
+    switch (m_graph.m_form) {
+    case ThreadedCPS: {
+        for (size_t argument = 0; argument < block->variablesAtTail.numberOfArguments(); ++argument) {
+            AbstractValue& destination = block->valuesAtTail.argument(argument);
+            mergeStateAtTail(destination, m_variables.argument(argument), block->variablesAtTail.argument(argument));
+        }
+
+        for (size_t local = 0; local < block->variablesAtTail.numberOfLocals(); ++local) {
+            AbstractValue& destination = block->valuesAtTail.local(local);
+            mergeStateAtTail(destination, m_variables.local(local), block->variablesAtTail.local(local));
+        }
+        break;
+    }
+
+    case SSA: {
+        for (size_t i = 0; i < block->valuesAtTail.size(); ++i)
+            block->valuesAtTail[i].merge(m_variables[i]);
+
+        for (NodeAbstractValuePair& valueAtTail : block->ssa->valuesAtTail) {
+            AbstractValue& valueAtNode = forNode(valueAtTail.node);
+            valueAtTail.value.merge(valueAtNode);
+            valueAtNode = valueAtTail.value;
+        }
+        break;
+    }
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    reset();
+    
+    return mergeToSuccessors(block);
+}
+
+void InPlaceAbstractState::reset()
+{
+    m_block = 0;
+    m_isValid = false;
+    m_branchDirection = InvalidBranchDirection;
+    m_structureClobberState = StructuresAreWatched;
+}
+
+void InPlaceAbstractState::mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, Node* node)
+{
+    if (!node)
+        return;
+
+    const AbstractValue* source = nullptr;
+    
+    switch (node->op()) {
+    case Phi:
+    case SetArgument:
+    case PhantomLocal:
+    case Flush:
+        // The block transfers the value from head to tail.
+        source = &inVariable;
+        break;
+            
+    case GetLocal:
+        // The block refines the value with additional speculations.
+        source = &forNode(node);
+        break;
+            
+    case SetLocal:
+        // The block sets the variable, and potentially refines it, both
+        // before and after setting it.
+        source = &forNode(node->child1());
+        if (node->variableAccessData()->flushFormat() == FlushedDouble)
+            RELEASE_ASSERT(!(source->m_type & ~SpecFullDouble));
+        break;
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    destination = *source;
+}
+
+bool InPlaceAbstractState::merge(BasicBlock* from, BasicBlock* to)
+{
+    if (verbose)
+        dataLog("   Merging from ", pointerDump(from), " to ", pointerDump(to), "\n");
+    ASSERT(from->variablesAtTail.numberOfArguments() == to->variablesAtHead.numberOfArguments());
+    ASSERT(from->variablesAtTail.numberOfLocals() == to->variablesAtHead.numberOfLocals());
+    
+    bool changed = false;
+    
+    changed |= checkAndSet(
+        to->cfaStructureClobberStateAtHead,
+        DFG::merge(from->cfaStructureClobberStateAtTail, to->cfaStructureClobberStateAtHead));
+    
+    switch (m_graph.m_form) {
+    case ThreadedCPS: {
+        for (size_t argument = 0; argument < from->variablesAtTail.numberOfArguments(); ++argument) {
+            AbstractValue& destination = to->valuesAtHead.argument(argument);
+            changed |= mergeVariableBetweenBlocks(destination, from->valuesAtTail.argument(argument), to->variablesAtHead.argument(argument), from->variablesAtTail.argument(argument));
+        }
+        
+        for (size_t local = 0; local < from->variablesAtTail.numberOfLocals(); ++local) {
+            AbstractValue& destination = to->valuesAtHead.local(local);
+            changed |= mergeVariableBetweenBlocks(destination, from->valuesAtTail.local(local), to->variablesAtHead.local(local), from->variablesAtTail.local(local));
+        }
+        break;
+    }
+        
+    case SSA: {
+        for (size_t i = from->valuesAtTail.size(); i--;)
+            changed |= to->valuesAtHead[i].merge(from->valuesAtTail[i]);
+
+        for (NodeAbstractValuePair& entry : to->ssa->valuesAtHead) {
+            NodeFlowProjection node = entry.node;
+            if (verbose)
+                dataLog("      Merging for ", node, ": from ", forNode(node), " to ", entry.value, "\n");
+#ifndef NDEBUG
+            unsigned valueCountInFromBlock = 0;
+            for (NodeAbstractValuePair& fromBlockValueAtTail : from->ssa->valuesAtTail) {
+                if (fromBlockValueAtTail.node == node) {
+                    ASSERT(fromBlockValueAtTail.value == forNode(node));
+                    ++valueCountInFromBlock;
+                }
+            }
+            ASSERT(valueCountInFromBlock == 1);
+#endif
+
+            changed |= entry.value.merge(forNode(node));
+
+            if (verbose)
+                dataLog("         Result: ", entry.value, "\n");
+        }
+        break;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+
+    if (!to->cfaHasVisited)
+        changed = true;
+    
+    if (verbose)
+        dataLog("      Will revisit: ", changed, "\n");
+    to->cfaShouldRevisit |= changed;
+    
+    return changed;
+}
+
+inline bool InPlaceAbstractState::mergeToSuccessors(BasicBlock* basicBlock)
+{
+    Node* terminal = basicBlock->terminal();
+    
+    ASSERT(terminal->isTerminal());
+    
+    switch (terminal->op()) {
+    case Jump: {
+        ASSERT(basicBlock->cfaBranchDirection == InvalidBranchDirection);
+        return merge(basicBlock, terminal->targetBlock());
+    }
+        
+    case Branch: {
+        ASSERT(basicBlock->cfaBranchDirection != InvalidBranchDirection);
+        bool changed = false;
+        if (basicBlock->cfaBranchDirection != TakeFalse)
+            changed |= merge(basicBlock, terminal->branchData()->taken.block);
+        if (basicBlock->cfaBranchDirection != TakeTrue)
+            changed |= merge(basicBlock, terminal->branchData()->notTaken.block);
+        return changed;
+    }
+        
+    case Switch: {
+        // FIXME: It would be cool to be sparse conditional for Switch's. Currently
+        // we're not. However I somehow doubt that this will ever be a big deal.
+        ASSERT(basicBlock->cfaBranchDirection == InvalidBranchDirection);
+        SwitchData* data = terminal->switchData();
+        bool changed = merge(basicBlock, data->fallThrough.block);
+        for (unsigned i = data->cases.size(); i--;)
+            changed |= merge(basicBlock, data->cases[i].target.block);
+        return changed;
+    }
+        
+    case Return:
+    case TailCall:
+    case DirectTailCall:
+    case TailCallVarargs:
+    case TailCallForwardVarargs:
+    case Unreachable:
+        ASSERT(basicBlock->cfaBranchDirection == InvalidBranchDirection);
+        return false;
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
+inline bool InPlaceAbstractState::mergeVariableBetweenBlocks(AbstractValue& destination, AbstractValue& source, Node* destinationNode, Node* sourceNode)
+{
+    if (!destinationNode)
+        return false;
+    
+    ASSERT_UNUSED(sourceNode, sourceNode);
+    
+    // FIXME: We could do some sparse conditional propagation here!
+    
+    return destination.merge(source);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGInPlaceAbstractState.h b/dfg/DFGInPlaceAbstractState.h
new file mode 100644
index 0000000..9f94cfe
--- /dev/null
+++ b/dfg/DFGInPlaceAbstractState.h
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractValue.h"
+#include "DFGBranchDirection.h"
+#include "DFGFlowMap.h"
+#include "DFGGraph.h"
+#include "DFGNode.h"
+
+namespace JSC { namespace DFG {
+
+class InPlaceAbstractState {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    InPlaceAbstractState(Graph&);
+    
+    ~InPlaceAbstractState();
+    
+    explicit operator bool() const { return true; }
+    
+    void createValueForNode(NodeFlowProjection) { }
+    
+    AbstractValue& forNode(NodeFlowProjection node)
+    {
+        return m_abstractValues.at(node);
+    }
+    
+    AbstractValue& forNode(Edge edge)
+    {
+        return forNode(edge.node());
+    }
+    
+    Operands<AbstractValue>& variables()
+    {
+        return m_variables;
+    }
+    
+    // Call this before beginning CFA to initialize the abstract values of
+    // arguments, and to indicate which blocks should be listed for CFA
+    // execution.
+    void initialize();
+
+    // Start abstractly executing the given basic block. Initializes the
+    // notion of abstract state to what we believe it to be at the head
+    // of the basic block, according to the basic block's data structures.
+    // This method also sets cfaShouldRevisit to false.
+    void beginBasicBlock(BasicBlock*);
+    
+    BasicBlock* block() const { return m_block; }
+    
+    // Finish abstractly executing a basic block. If MergeToTail or
+    // MergeToSuccessors is passed, then this merges everything we have
+    // learned about how the state changes during this block's execution into
+    // the block's data structures.
+    //
+    // Returns true if the state of the block at the tail was changed,
+    // and, if the state at the heads of successors was changed.
+    // A true return means that you must revisit (at least) the successor
+    // blocks. This also sets cfaShouldRevisit to true for basic blocks
+    // that must be visited next.
+    bool endBasicBlock();
+    
+    // Reset the AbstractState. This throws away any results, and at this point
+    // you can safely call beginBasicBlock() on any basic block.
+    void reset();
+    
+    // Did the last executed node clobber the world?
+    bool didClobber() const { return m_didClobber; }
+    
+    // Are structures currently clobbered?
+    StructureClobberState structureClobberState() const { return m_structureClobberState; }
+    
+    // Is the execution state still valid? This will be false if execute() has
+    // returned false previously.
+    bool isValid() const { return m_isValid; }
+    
+    // Merge the abstract state stored at the first block's tail into the second
+    // block's head. Returns true if the second block's state changed. If so,
+    // that block must be abstractly interpreted again. This also sets
+    // to->cfaShouldRevisit to true, if it returns true, or if to has not been
+    // visited yet.
+    bool merge(BasicBlock* from, BasicBlock* to);
+    
+    // Merge the abstract state stored at the block's tail into all of its
+    // successors. Returns true if any of the successors' states changed. Note
+    // that this is automatically called in endBasicBlock() if MergeMode is
+    // MergeToSuccessors.
+    bool mergeToSuccessors(BasicBlock*);
+    
+    // Methods intended to be called from AbstractInterpreter.
+    void setDidClobber(bool didClobber) { m_didClobber = didClobber; }
+    void setStructureClobberState(StructureClobberState value) { m_structureClobberState = value; }
+    void setIsValid(bool isValid) { m_isValid = isValid; }
+    void setBranchDirection(BranchDirection branchDirection) { m_branchDirection = branchDirection; }
+    
+    // This method is evil - it causes a huge maintenance headache and there is a gross amount of
+    // code devoted to it. It would be much nicer to just always run the constant folder on each
+    // block. But, the last time we did it, it was a 1% SunSpider regression:
+    // https://bugs.webkit.org/show_bug.cgi?id=133947
+    // So, we should probably keep this method.
+    void setFoundConstants(bool foundConstants) { m_foundConstants = foundConstants; }
+
+private:
+    void mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, Node*);
+
+    static bool mergeVariableBetweenBlocks(AbstractValue& destination, AbstractValue& source, Node* destinationNode, Node* sourceNode);
+    
+    Graph& m_graph;
+
+    FlowMap<AbstractValue>& m_abstractValues;
+    Operands<AbstractValue> m_variables;
+    BasicBlock* m_block;
+    
+    bool m_foundConstants;
+    
+    bool m_isValid;
+    bool m_didClobber;
+    StructureClobberState m_structureClobberState;
+    
+    BranchDirection m_branchDirection; // This is only set for blocks that end in Branch and that execute to completion (i.e. m_isValid == true).
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGInferredTypeCheck.cpp b/dfg/DFGInferredTypeCheck.cpp
new file mode 100644
index 0000000..1951c79
--- /dev/null
+++ b/dfg/DFGInferredTypeCheck.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGInferredTypeCheck.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void insertInferredTypeCheck(
+    InsertionSet& insertionSet, unsigned nodeIndex, NodeOrigin origin, Node* baseNode,
+    const InferredType::Descriptor& type)
+{
+    insertionSet.graph().registerInferredType(type);
+    
+    switch (type.kind()) {
+    case InferredType::Bottom:
+        insertionSet.insertNode(nodeIndex, SpecNone, ForceOSRExit, origin);
+        return;
+
+    case InferredType::Boolean:
+        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, BooleanUse));
+        return;
+
+    case InferredType::Other:
+        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, OtherUse));
+        return;
+
+    case InferredType::Int32:
+        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, Int32Use));
+        return;
+
+    case InferredType::Number:
+        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, NumberUse));
+        return;
+
+    case InferredType::String:
+        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, StringUse));
+        return;
+
+    case InferredType::Symbol:
+        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, SymbolUse));
+        return;
+
+    case InferredType::ObjectWithStructure:
+        insertionSet.insertNode(
+            nodeIndex, SpecNone, CheckStructure, origin,
+            OpInfo(insertionSet.graph().addStructureSet(type.structure())),
+            Edge(baseNode, CellUse));
+        return;
+
+    case InferredType::ObjectWithStructureOrOther:
+        insertionSet.insertNode(
+            nodeIndex, SpecNone, CheckStructure, origin,
+            OpInfo(insertionSet.graph().addStructureSet(type.structure())),
+            Edge(baseNode, CellOrOtherUse));
+        return;
+
+    case InferredType::Object:
+        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, ObjectUse));
+        return;
+
+    case InferredType::ObjectOrOther:
+        insertionSet.insertNode(nodeIndex, SpecNone, Check, origin, Edge(baseNode, ObjectOrOtherUse));
+        return;
+
+    case InferredType::Top:
+        return;
+    }
+
+    DFG_CRASH(insertionSet.graph(), baseNode, "Bad inferred type");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGInferredTypeCheck.h b/dfg/DFGInferredTypeCheck.h
new file mode 100644
index 0000000..7d08ad2
--- /dev/null
+++ b/dfg/DFGInferredTypeCheck.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGInsertionSet.h"
+#include "InferredType.h"
+
+namespace JSC { namespace DFG {
+
+// Inserts a type check that ensures that baseNode has the given inferred type.
+void insertInferredTypeCheck(
+    InsertionSet&, unsigned nodeIndex, NodeOrigin, Node* baseNode, const InferredType::Descriptor&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGInlineCacheWrapper.h b/dfg/DFGInlineCacheWrapper.h
new file mode 100644
index 0000000..a2e7596
--- /dev/null
+++ b/dfg/DFGInlineCacheWrapper.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "JITInlineCacheGenerator.h"
+
+namespace JSC { namespace DFG {
+
+class SlowPathGenerator;
+
+template<typename GeneratorType>
+struct InlineCacheWrapper {
+    InlineCacheWrapper() { }
+    
+    InlineCacheWrapper(const GeneratorType& generator, SlowPathGenerator* slowPath)
+        : m_generator(generator)
+        , m_slowPath(slowPath)
+    {
+    }
+    
+    void finalize(LinkBuffer&);
+    
+    GeneratorType m_generator;
+    SlowPathGenerator* m_slowPath;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGInlineCacheWrapperInlines.h b/dfg/DFGInlineCacheWrapperInlines.h
new file mode 100644
index 0000000..dcc33cb
--- /dev/null
+++ b/dfg/DFGInlineCacheWrapperInlines.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGInlineCacheWrapper.h"
+#include "DFGSlowPathGenerator.h"
+
+namespace JSC { namespace DFG {
+
+template<typename GeneratorType>
+void InlineCacheWrapper<GeneratorType>::finalize(LinkBuffer& linkBuffer)
+{
+    m_generator.reportSlowPathCall(m_slowPath->label(), m_slowPath->call());
+    m_generator.finalize(linkBuffer);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGInsertionSet.cpp b/dfg/DFGInsertionSet.cpp
new file mode 100644
index 0000000..1471250
--- /dev/null
+++ b/dfg/DFGInsertionSet.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGInsertionSet.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void InsertionSet::insertSlow(const Insertion& insertion)
+{
+    ASSERT(!m_insertions.isEmpty());
+    ASSERT(m_insertions.last().index() > insertion.index());
+    
+    for (size_t index = m_insertions.size() - 1; index--;) {
+        if (m_insertions[index].index() <= insertion.index()) {
+            m_insertions.insert(index + 1, insertion);
+            return;
+        }
+    }
+
+    m_insertions.insert(0, insertion);
+}
+
+size_t InsertionSet::execute(BasicBlock* block)
+{
+    return executeInsertions(*block, m_insertions);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGInsertionSet.h b/dfg/DFGInsertionSet.h
new file mode 100644
index 0000000..b815d49
--- /dev/null
+++ b/dfg/DFGInsertionSet.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include <wtf/Insertion.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+typedef WTF::Insertion<Node*> Insertion;
+
+class InsertionSet {
+public:
+    InsertionSet(Graph& graph)
+        : m_graph(graph)
+    {
+    }
+    
+    Graph& graph() { return m_graph; }
+
+    // Adds another code insertion. It's expected that you'll usually insert things in order. If
+    // you don't, this function will perform a linear search to find the largest insertion point
+    // at which insertion order would be preserved. This is essentially equivalent to if you did
+    // a stable sort on the insertions.
+    Node* insert(const Insertion& insertion)
+    {
+        if (LIKELY(!m_insertions.size() || m_insertions.last().index() <= insertion.index()))
+            m_insertions.append(insertion);
+        else
+            insertSlow(insertion);
+        return insertion.element();
+    }
+    
+    Node* insert(size_t index, Node* element)
+    {
+        return insert(Insertion(index, element));
+    }
+
+    template<typename... Params>
+    Node* insertNode(size_t index, SpeculatedType type, Params... params)
+    {
+        return insert(index, m_graph.addNode(type, params...));
+    }
+    
+    Node* insertConstant(
+        size_t index, NodeOrigin origin, FrozenValue* value,
+        NodeType op = JSConstant)
+    {
+        return insertNode(
+            index, speculationFromValue(value->value()), op, origin, OpInfo(value));
+    }
+    
+    Edge insertConstantForUse(
+        size_t index, NodeOrigin origin, FrozenValue* value, UseKind useKind)
+    {
+        NodeType op;
+        if (isDouble(useKind))
+            op = DoubleConstant;
+        else if (useKind == Int52RepUse)
+            op = Int52Constant;
+        else
+            op = JSConstant;
+        return Edge(insertConstant(index, origin, value, op), useKind);
+    }
+    
+    Node* insertConstant(size_t index, NodeOrigin origin, JSValue value, NodeType op = JSConstant)
+    {
+        return insertConstant(index, origin, m_graph.freeze(value), op);
+    }
+    
+    Edge insertConstantForUse(size_t index, NodeOrigin origin, JSValue value, UseKind useKind)
+    {
+        return insertConstantForUse(index, origin, m_graph.freeze(value), useKind);
+    }
+    
+    Edge insertBottomConstantForUse(size_t index, NodeOrigin origin, UseKind useKind)
+    {
+        if (isDouble(useKind))
+            return insertConstantForUse(index, origin, jsNumber(PNaN), useKind);
+        if (useKind == Int52RepUse)
+            return insertConstantForUse(index, origin, jsNumber(0), useKind);
+        return insertConstantForUse(index, origin, jsUndefined(), useKind);
+    }
+    
+    Node* insertCheck(size_t index, NodeOrigin origin, AdjacencyList children)
+    {
+        children = children.justChecks();
+        if (children.isEmpty())
+            return nullptr;
+        return insertNode(index, SpecNone, Check, origin, children);
+    }
+    
+    Node* insertCheck(size_t index, Node* node)
+    {
+        return insertCheck(index, node->origin, node->children);
+    }
+    
+    Node* insertCheck(size_t index, NodeOrigin origin, Edge edge)
+    {
+        if (edge.willHaveCheck())
+            return insertNode(index, SpecNone, Check, origin, edge);
+        return nullptr;
+    }
+    
+    size_t execute(BasicBlock* block);
+
+private:
+    void insertSlow(const Insertion&);
+    
+    Graph& m_graph;
+    Vector<Insertion, 8> m_insertions;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGIntegerCheckCombiningPhase.cpp b/dfg/DFGIntegerCheckCombiningPhase.cpp
new file mode 100644
index 0000000..189b6d7
--- /dev/null
+++ b/dfg/DFGIntegerCheckCombiningPhase.cpp
@@ -0,0 +1,400 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGIntegerCheckCombiningPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+#include <unordered_map>
+#include <wtf/HashMethod.h>
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+static const bool verbose = false;
+
+enum RangeKind {
+    InvalidRangeKind,
+    
+    // This means we did ArithAdd with CheckOverflow.
+    Addition,
+    
+    // This means we did CheckInBounds on some length.
+    ArrayBounds
+};
+
+struct RangeKey {
+    RangeKey()
+        : m_kind(InvalidRangeKind)
+        , m_key(nullptr)
+    {
+    }
+    
+    static RangeKey addition(Edge edge)
+    {
+        RangeKey result;
+        result.m_kind = Addition;
+        result.m_source = edge.sanitized();
+        result.m_key = 0;
+        return result;
+    }
+    
+    static RangeKey arrayBounds(Edge edge, Node* key)
+    {
+        RangeKey result;
+        result.m_kind = ArrayBounds;
+        result.m_source = edge.sanitized();
+        result.m_key = key;
+        return result;
+    }
+    
+    bool operator!() const { return m_kind == InvalidRangeKind; }
+    
+    unsigned hash() const
+    {
+        return m_kind + m_source.hash() + PtrHash<Node*>::hash(m_key);
+    }
+    
+    bool operator==(const RangeKey& other) const
+    {
+        return m_kind == other.m_kind
+            && m_source == other.m_source
+            && m_key == other.m_key;
+    }
+    
+    void dump(PrintStream& out) const
+    {
+        switch (m_kind) {
+        case InvalidRangeKind:
+            out.print("InvalidRangeKind(");
+            break;
+        case Addition:
+            out.print("Addition(");
+            break;
+        case ArrayBounds:
+            out.print("ArrayBounds(");
+            break;
+        }
+        out.print(m_source, ", ", m_key, ")");
+    }
+    
+    RangeKind m_kind;
+    Edge m_source;
+    Node* m_key;
+};
+
+struct RangeKeyAndAddend {
+    RangeKeyAndAddend()
+        : m_addend(0)
+    {
+    }
+    
+    RangeKeyAndAddend(RangeKey key, int32_t addend)
+        : m_key(key)
+        , m_addend(addend)
+    {
+    }
+    
+    bool operator!() const { return !m_key && !m_addend; }
+    
+    void dump(PrintStream& out) const
+    {
+        out.print(m_key, " + ", m_addend);
+    }
+    
+    RangeKey m_key;
+    int32_t m_addend;
+};
+
+struct Range {
+    Range()
+        : m_minBound(0)
+        , m_maxBound(0)
+        , m_count(0)
+        , m_hoisted(false)
+    {
+    }
+    
+    void dump(PrintStream& out) const
+    {
+        out.print("(", m_minBound, " @", m_minOrigin, ") .. (", m_maxBound, " @", m_maxOrigin, "), count = ", m_count, ", hoisted = ", m_hoisted);
+    }
+    
+    int32_t m_minBound;
+    CodeOrigin m_minOrigin;
+    int32_t m_maxBound;
+    CodeOrigin m_maxOrigin;
+    unsigned m_count; // If this is zero then the bounds won't necessarily make sense.
+    bool m_hoisted;
+};
+
+} // anonymous namespace
+
+class IntegerCheckCombiningPhase : public Phase {
+public:
+    IntegerCheckCombiningPhase(Graph& graph)
+        : Phase(graph, "integer check combining")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == SSA);
+        
+        m_changed = false;
+        
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;)
+            handleBlock(blockIndex);
+        
+        return m_changed;
+    }
+
+private:
+    void handleBlock(BlockIndex blockIndex)
+    {
+        BasicBlock* block = m_graph.block(blockIndex);
+        if (!block)
+            return;
+        
+        m_map.clear();
+        
+        // First we collect Ranges. If operations within the range have enough redundancy,
+        // we hoist. And then we remove additions and checks that fall within the max range.
+        
+        for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            RangeKeyAndAddend data = rangeKeyAndAddend(node);
+            if (verbose)
+                dataLog("For ", node, ": ", data, "\n");
+            if (!data)
+                continue;
+            
+            Range& range = m_map[data.m_key];
+            if (verbose)
+                dataLog("    Range: ", range, "\n");
+            if (range.m_count) {
+                if (data.m_addend > range.m_maxBound) {
+                    range.m_maxBound = data.m_addend;
+                    range.m_maxOrigin = node->origin.semantic;
+                } else if (data.m_addend < range.m_minBound) {
+                    range.m_minBound = data.m_addend;
+                    range.m_minOrigin = node->origin.semantic;
+                }
+            } else {
+                range.m_maxBound = data.m_addend;
+                range.m_minBound = data.m_addend;
+                range.m_minOrigin = node->origin.semantic;
+                range.m_maxOrigin = node->origin.semantic;
+            }
+            range.m_count++;
+            if (verbose)
+                dataLog("    New range: ", range, "\n");
+        }
+        
+        for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            RangeKeyAndAddend data = rangeKeyAndAddend(node);
+            if (!data)
+                continue;
+            Range range = m_map[data.m_key];
+            if (!isValid(data.m_key, range))
+                continue;
+            
+            // Do the hoisting.
+            if (!range.m_hoisted) {
+                NodeOrigin minOrigin = node->origin.withSemantic(range.m_minOrigin);
+                NodeOrigin maxOrigin = node->origin.withSemantic(range.m_maxOrigin);
+                
+                switch (data.m_key.m_kind) {
+                case Addition: {
+                    if (range.m_minBound < 0)
+                        insertAdd(nodeIndex, minOrigin, data.m_key.m_source, range.m_minBound);
+                    if (range.m_maxBound > 0)
+                        insertAdd(nodeIndex, maxOrigin, data.m_key.m_source, range.m_maxBound);
+                    break;
+                }
+                
+                case ArrayBounds: {
+                    Node* minNode;
+                    Node* maxNode;
+                    
+                    if (!data.m_key.m_source) {
+                        minNode = 0;
+                        maxNode = m_insertionSet.insertConstant(
+                            nodeIndex, maxOrigin, jsNumber(range.m_maxBound));
+                    } else {
+                        minNode = insertAdd(
+                            nodeIndex, minOrigin, data.m_key.m_source, range.m_minBound,
+                            Arith::Unchecked);
+                        maxNode = insertAdd(
+                            nodeIndex, maxOrigin, data.m_key.m_source, range.m_maxBound,
+                            Arith::Unchecked);
+                    }
+                    
+                    if (minNode) {
+                        m_insertionSet.insertNode(
+                            nodeIndex, SpecNone, CheckInBounds, node->origin,
+                            Edge(minNode, Int32Use), Edge(data.m_key.m_key, Int32Use));
+                    }
+                    m_insertionSet.insertNode(
+                        nodeIndex, SpecNone, CheckInBounds, node->origin,
+                        Edge(maxNode, Int32Use), Edge(data.m_key.m_key, Int32Use));
+                    break;
+                }
+                
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                }
+                
+                m_changed = true;
+                m_map[data.m_key].m_hoisted = true;
+            }
+            
+            // Do the elimination.
+            switch (data.m_key.m_kind) {
+            case Addition:
+                node->setArithMode(Arith::Unchecked);
+                m_changed = true;
+                break;
+                
+            case ArrayBounds:
+                node->remove();
+                m_changed = true;
+                break;
+                
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+        
+        m_insertionSet.execute(block);
+    }
+    
+    RangeKeyAndAddend rangeKeyAndAddend(Node* node)
+    {
+        switch (node->op()) {
+        case ArithAdd: {
+            if (node->arithMode() != Arith::CheckOverflow
+                && node->arithMode() != Arith::CheckOverflowAndNegativeZero)
+                break;
+            if (!node->child2()->isInt32Constant())
+                break;
+            return RangeKeyAndAddend(
+                RangeKey::addition(node->child1()),
+                node->child2()->asInt32());
+        }
+                
+        case CheckInBounds: {
+            Edge source;
+            int32_t addend;
+            Node* key = node->child2().node();
+            
+            Edge index = node->child1();
+            
+            if (index->isInt32Constant()) {
+                source = Edge();
+                addend = index->asInt32();
+            } else if (
+                index->op() == ArithAdd
+                && index->isBinaryUseKind(Int32Use)
+                && index->child2()->isInt32Constant()) {
+                source = index->child1();
+                addend = index->child2()->asInt32();
+            } else {
+                source = index;
+                addend = 0;
+            }
+            
+            return RangeKeyAndAddend(RangeKey::arrayBounds(source, key), addend);
+        }
+            
+        default:
+            break;
+        }
+        
+        return RangeKeyAndAddend();
+    }
+    
+    bool isValid(const RangeKey& key, const Range& range)
+    {
+        if (range.m_count < 2)
+            return false;
+        
+        switch (key.m_kind) {
+        case ArrayBounds: {
+            // Have to do this carefully because C++ compilers are too smart. But all we're really doing is detecting if
+            // the difference between the bounds is 2^31 or more. If it was, then we'd have to worry about wrap-around.
+            // The way we'd like to write this expression is (range.m_maxBound - range.m_minBound) >= 0, but that is a
+            // signed subtraction and compare, which allows the C++ compiler to do anything it wants in case of
+            // wrap-around.
+            uint32_t maxBound = range.m_maxBound;
+            uint32_t minBound = range.m_minBound;
+            uint32_t unsignedDifference = maxBound - minBound;
+            return !(unsignedDifference >> 31);
+        }
+            
+        default:
+            return true;
+        }
+    }
+    
+    Node* insertAdd(
+        unsigned nodeIndex, NodeOrigin origin, Edge source, int32_t addend,
+        Arith::Mode arithMode = Arith::CheckOverflow)
+    {
+        if (!addend)
+            return source.node();
+        return m_insertionSet.insertNode(
+            nodeIndex, source->prediction(), source->result(),
+            ArithAdd, origin, OpInfo(arithMode), source,
+            m_insertionSet.insertConstantForUse(
+                nodeIndex, origin, jsNumber(addend), source.useKind()));
+    }
+    
+    typedef std::unordered_map<RangeKey, Range, HashMethod<RangeKey>> RangeMap;
+    RangeMap m_map;
+    
+    InsertionSet m_insertionSet;
+    bool m_changed;
+};
+    
+bool performIntegerCheckCombining(Graph& graph)
+{
+    return runPhase<IntegerCheckCombiningPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGIntegerCheckCombiningPhase.h b/dfg/DFGIntegerCheckCombiningPhase.h
new file mode 100644
index 0000000..9556612
--- /dev/null
+++ b/dfg/DFGIntegerCheckCombiningPhase.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Removes overflow checks and out-of-bounds checks by hoisting them.
+
+bool performIntegerCheckCombining(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGIntegerRangeOptimizationPhase.cpp b/dfg/DFGIntegerRangeOptimizationPhase.cpp
new file mode 100644
index 0000000..76ff2dd
--- /dev/null
+++ b/dfg/DFGIntegerRangeOptimizationPhase.cpp
@@ -0,0 +1,1847 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGIntegerRangeOptimizationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockMapInlines.h"
+#include "DFGBlockSet.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGNodeFlowProjection.h"
+#include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+const bool verbose = false;
+const unsigned giveUpThreshold = 50;
+
+int64_t clampedSumImpl() { return 0; }
+
+template<typename... Args>
+int64_t clampedSumImpl(int left, Args... args)
+{
+    return static_cast<int64_t>(left) + clampedSumImpl(args...);
+}
+
+template<typename... Args>
+int clampedSum(Args... args)
+{
+    int64_t result = clampedSumImpl(args...);
+    return static_cast<int>(std::min(
+        static_cast<int64_t>(std::numeric_limits<int>::max()),
+        std::max(
+            static_cast<int64_t>(std::numeric_limits<int>::min()),
+            result)));
+}
+
+bool isGeneralOffset(int offset)
+{
+    return offset >= -1 && offset <= 1;
+}
+
+class Relationship {
+public:
+    enum Kind {
+        LessThan,
+        Equal,
+        NotEqual,
+        GreaterThan
+    };
+
+    // Some relationships provide more information than others. When a relationship provides more
+    // information, it is less vague.
+    static unsigned vagueness(Kind kind)
+    {
+        switch (kind) {
+        case Equal:
+            return 0;
+        case LessThan:
+        case GreaterThan:
+            return 1;
+        case NotEqual:
+            return 2;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+
+    static const unsigned minVagueness = 0;
+    static const unsigned maxVagueness = 2;
+    
+    static Kind flipped(Kind kind)
+    {
+        switch (kind) {
+        case LessThan:
+            return GreaterThan;
+        case Equal:
+            return Equal;
+        case NotEqual:
+            return NotEqual;
+        case GreaterThan:
+            return LessThan;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return kind;
+    }
+    
+    Relationship()
+        : m_left(nullptr)
+        , m_right(nullptr)
+        , m_kind(Equal)
+        , m_offset(0)
+    {
+    }
+    
+    Relationship(NodeFlowProjection left, NodeFlowProjection right, Kind kind, int offset = 0)
+        : m_left(left)
+        , m_right(right)
+        , m_kind(kind)
+        , m_offset(offset)
+    {
+        RELEASE_ASSERT(m_left);
+        RELEASE_ASSERT(m_right);
+        RELEASE_ASSERT(m_left != m_right);
+    }
+    
+    static Relationship safeCreate(NodeFlowProjection left, NodeFlowProjection right, Kind kind, int offset = 0)
+    {
+        if (!left.isStillValid() || !right.isStillValid() || left == right)
+            return Relationship();
+        return Relationship(left, right, kind, offset);
+    }
+
+    explicit operator bool() const { return !!m_left; }
+    
+    NodeFlowProjection left() const { return m_left; }
+    NodeFlowProjection right() const { return m_right; }
+    Kind kind() const { return m_kind; }
+    int offset() const { return m_offset; }
+
+    unsigned vagueness() const { return vagueness(kind()); }
+    
+    Relationship flipped() const
+    {
+        if (!*this)
+            return Relationship();
+        
+        // This should return Relationship() if -m_offset overflows. For example:
+        //
+        //     @a > @b - 2**31
+        //
+        // If we flip it we get:
+        //
+        //     @b < @a + 2**31
+        //
+        // Except that the sign gets flipped since it's INT_MIN:
+        //
+        //     @b < @a - 2**31
+        //
+        // And that makes no sense. To see how little sense it makes, consider:
+        //
+        //     @a > @zero - 2**31
+        //
+        // We would flip it to mean:
+        //
+        //     @zero < @a - 2**31
+        //
+        // Which is absurd.
+        
+        if (m_offset == std::numeric_limits<int>::min())
+            return Relationship();
+        
+        return Relationship(m_right, m_left, flipped(m_kind), -m_offset);
+    }
+    
+    Relationship inverse() const
+    {
+        if (!*this)
+            return *this;
+        
+        switch (m_kind) {
+        case Equal:
+            return Relationship(m_left, m_right, NotEqual, m_offset);
+        case NotEqual:
+            return Relationship(m_left, m_right, Equal, m_offset);
+        case LessThan:
+            if (sumOverflows<int>(m_offset, -1))
+                return Relationship();
+            return Relationship(m_left, m_right, GreaterThan, m_offset - 1);
+        case GreaterThan:
+            if (sumOverflows<int>(m_offset, 1))
+                return Relationship();
+            return Relationship(m_left, m_right, LessThan, m_offset + 1);
+        }
+        
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    bool isCanonical() const { return m_left < m_right; }
+    
+    Relationship canonical() const
+    {
+        if (isCanonical())
+            return *this;
+        return flipped();
+    }
+    
+    bool sameNodesAs(const Relationship& other) const
+    {
+        return m_left == other.m_left
+            && m_right == other.m_right;
+    }
+
+    bool isEquivalentTo(const Relationship& other) const
+    {
+        if (m_left != other.m_left || m_kind != other.m_kind)
+            return false;
+
+        if (*this == other)
+            return true;
+
+        if (m_right->isInt32Constant() && other.m_right->isInt32Constant())
+            return (m_right->asInt32() + m_offset) == (other.m_right->asInt32() + other.m_offset);
+        return false;
+    }
+    
+    bool operator==(const Relationship& other) const
+    {
+        return sameNodesAs(other)
+            && m_kind == other.m_kind
+            && m_offset == other.m_offset;
+    }
+    
+    bool operator!=(const Relationship& other) const
+    {
+        return !(*this == other);
+    }
+    
+    bool operator<(const Relationship& other) const
+    {
+        if (m_left != other.m_left)
+            return m_left < other.m_left;
+        if (m_right != other.m_right)
+            return m_right < other.m_right;
+        if (m_kind != other.m_kind)
+            return m_kind < other.m_kind;
+        return m_offset < other.m_offset;
+    }
+    
+    // If possible, returns a form of this relationship where the given node is the left
+    // side. Returns a null relationship if this relationship cannot say anything about this
+    // node.
+    Relationship forNode(NodeFlowProjection node) const
+    {
+        if (m_left == node)
+            return *this;
+        if (m_right == node)
+            return flipped();
+        return Relationship();
+    }
+    
+    void setLeft(NodeFlowProjection left)
+    {
+        RELEASE_ASSERT(left != m_right);
+        m_left = left;
+    }
+    bool addToOffset(int offset)
+    {
+        if (sumOverflows<int>(m_offset, offset))
+            return false;
+        m_offset += offset;
+        return true;
+    }
+
+    // Attempts to create relationships that summarize the union of this relationship and
+    // the other relationship. Relationships are returned by calling the functor with the newly
+    // created relationships. No relationships are created to indicate TOP. This is used
+    // for merging the current relationship-at-head for some pair of nodes and a new
+    // relationship-at-head being proposed by a predecessor. We wish to create a new
+    // relationship that is true whenever either of them are true, which ensuring that we don't
+    // do this forever. Anytime we create a relationship that is not equal to either of the
+    // previous ones, we will cause the analysis fixpoint to reexecute.
+    //
+    // If *this and other are identical, we just pass it to the functor.
+    //
+    // If they are different, we pick from a finite set of "general" relationships:
+    //
+    // Eq: this == other + C, where C is -1, 0, or 1.
+    // Lt: this < other + C, where C is -1, 0, or 1.
+    // Gt: this > other + C, where C is -1, 0, or 1.
+    // Ne: this != other + C, where C is -1, 0, or 1.
+    // TOP: the null relationship.
+    //
+    // Constraining C to -1,0,1 is necessary to ensure that the set of general relationships is
+    // finite. This finite set of relationships forms a pretty simple lattice where a
+    // relA->relB means "relB is more general than relA". For example, this<other+1 is more
+    // general than this==other. I'll leave it as an exercise for the reader to see that a
+    // graph between the 13 general relationships is indeed a lattice. The fact that the set of
+    // general relationships is a finite lattice ensures monotonicity of the fixpoint, since
+    // any merge over not-identical relationships returns a relationship that is closer to the
+    // TOP relationship than either of the original relationships. Here's how convergence is
+    // achieved for any pair of relationships over the same nodes:
+    //
+    // - If they are identical, then returning *this means that we won't be responsible for
+    //   causing another fixpoint iteration. Once all merges reach this point, we're done.
+    //
+    // - If they are different, then we pick the most constraining of the 13 general
+    //   relationships that is true if either *this or other are true. This means that if the
+    //   relationships are not identical, the merged relationship will be closer to TOP than
+    //   either of the originals. Returning a different relationship means that we will be
+    //   responsible for the fixpoint to reloop, but we can only do this at most 13 times since
+    //   that's how "deep" the general relationship lattice is.
+    //
+    // Note that C being constrained to -1,0,1 also ensures that we never have to return a
+    // combination of Lt and Gt, as in for example this<other+C && this>other-D. The only possible
+    // values of C and D where this would work are -1 and 1, but in that case we just say
+    // this==other. That said, the logic for merging two == relationships, like this==other+C ||
+    // this==other+D is to attempt to create these two relationships: this>other+min(C,D)-1 &&
+    // this<other+max(C,D)+1. But only one of these relationships will belong to the set of general
+    // relationships.
+    //
+    // Here's an example of this in action:
+    //
+    // for (var i = a; ; ++i) { }
+    //
+    // Without C being constrained to -1,0,1, we could end up looping forever: first we'd say
+    // that i==a, then we might say that i<a+2, then i<a+3, then i<a+4, etc. We won't do this
+    // because i<a+2 is not a valid general relationship: so when we merge i==a from the first
+    // iteration and i==a+1 from the second iteration, we create i>a-1 and i<a+2 but then
+    // realize that only i>a-1 is a valid general relationship. This gives us exactly what we
+    // want: a statement that i>=a.
+    //
+    // However, this may return a pair of relationships when merging relationships involving
+    // constants. For example, if given:
+    //
+    //     @x == @c
+    //     @x == @d
+    //
+    // where @c and @d are constants, then this may pass two relationships to the functor:
+    //
+    //     @x > min(@c, @d) - 1
+    //     @x < max(@c, @d) + 1
+    //
+    // This still allows for convergence, because just as when merging relationships over
+    // variables, this always picks from a set of general relationships. Hence although this may
+    // produce two relationships as a result of the merge, the total number of relationships that
+    // can be present at head of block is limited by O(graph.size^2).
+    template<typename Functor>
+    void merge(const Relationship& other, const Functor& functor) const
+    {
+        // Handle the super obvious case first.
+        if (*this == other) {
+            functor(*this);
+            return;
+        }
+        
+        if (m_left != other.m_left)
+            return;
+        
+        if (m_right != other.m_right) {
+            mergeConstantsImpl(other, functor);
+            return;
+        }
+        
+        ASSERT(sameNodesAs(other));
+        
+        // This does some interesting permutations to reduce the amount of duplicate code. For
+        // example:
+        //
+        // initially: @a != @b, @a > @b
+        //            @b != @a, @b < @a
+        //            @b < @a, @b != @a
+        //   finally: @b != a, @b < @a
+        //
+        // Another example:
+        //
+        // initially: @a < @b, @a != @b
+        //   finally: @a != @b, @a < @b
+
+        Relationship a = *this;
+        Relationship b = other;
+        bool needFlip = false;
+        
+        // Get rid of GreaterThan.
+        if (a.m_kind == GreaterThan || b.m_kind == GreaterThan) {
+            a = a.flipped();
+            b = b.flipped();
+            
+            // In rare cases, we might not be able to flip. Just give up on life in those
+            // cases.
+            if (!a || !b)
+                return;
+            
+            needFlip = true;
+            
+            // If we still have GreaterThan, then it means that we started with @a < @b and
+            // @a > @b. That's pretty much always a tautology; we don't attempt to do smart
+            // things for that case for now.
+            if (a.m_kind == GreaterThan || b.m_kind == GreaterThan)
+                return;
+        }
+        
+        // Make sure that if we have a LessThan, then it's first.
+        if (b.m_kind == LessThan)
+            std::swap(a, b);
+        
+        // Make sure that if we have a NotEqual, then it's first.
+        if (b.m_kind == NotEqual)
+            std::swap(a, b);
+        
+        Relationship result = a.mergeImpl(b);
+        if (!result)
+            return;
+        
+        if (needFlip)
+            result = result.flipped();
+        
+        functor(result);
+    }
+    
+    // Attempts to construct one Relationship that adequately summarizes the intersection of
+    // this and other. Returns a null relationship if the filtration should be expressed as two
+    // different relationships. Returning null is always safe because relationship lists in
+    // this phase always imply intersection. So, you could soundly skip calling this method and
+    // just put both relationships into the list. But, that could lead the fixpoint to diverge.
+    // Hence this will attempt to combine the two relationships into one as a convergence hack.
+    // In some cases, it will do something conservative. It's always safe for this to return
+    // *this, or to return other. It'll do that sometimes, mainly to accelerate convergence for
+    // things that we don't think are important enough to slow down the analysis.
+    Relationship filter(const Relationship& other) const
+    {
+        // We are only interested in merging relationships over the same nodes.
+        ASSERT(sameNodesAs(other));
+        
+        if (*this == other)
+            return *this;
+        
+        // From here we can assume that the two relationships are not identical. Usually we use
+        // this to assume that we have different offsets anytime that everything but the offset
+        // is identical.
+        
+        // We want equality to take precedent over everything else, and we don't want multiple
+        // independent claims of equality. That would just be a contradiction. When it does
+        // happen, we will be conservative in the sense that we will pick one.
+        if (m_kind == Equal)
+            return *this;
+        if (other.m_kind == Equal)
+            return other;
+        
+        // Useful helper for flipping.
+        auto filterFlipped = [&] () -> Relationship {
+            // If we cannot flip, then just conservatively return *this.
+            Relationship a = flipped();
+            Relationship b = other.flipped();
+            if (!a || !b)
+                return *this;
+            Relationship result = a.filter(b);
+            if (!result)
+                return Relationship();
+            result = result.flipped();
+            if (!result)
+                return *this;
+            return result;
+        };
+        
+        if (m_kind == NotEqual) {
+            if (other.m_kind == NotEqual) {
+                // We could do something smarter here. We could even keep both NotEqual's. We
+                // would need to make sure that we correctly collapsed them when merging. But
+                // for now, we just pick one of them and hope for the best.
+                return *this;
+            }
+            
+            if (other.m_kind == GreaterThan) {
+                // Implement this in terms of NotEqual.filter(LessThan). 
+                return filterFlipped();
+            }
+            
+            ASSERT(other.m_kind == LessThan);
+            // We have two claims:
+            //     @a != @b + C
+            //     @a  < @b + D
+            //
+            // If C >= D, then the NotEqual is redundant.
+            // If C < D - 1, then we could keep both, but for now we just keep the LessThan.
+            // If C == D - 1, then the LessThan can be turned into:
+            //
+            //     @a < @b + C
+            //
+            // Note that C == this.m_offset, D == other.m_offset.
+            
+            if (m_offset == other.m_offset - 1)
+                return Relationship(m_left, m_right, LessThan, m_offset);
+            
+            return other;
+        }
+        
+        if (other.m_kind == NotEqual)
+            return other.filter(*this);
+        
+        if (m_kind == LessThan) {
+            if (other.m_kind == LessThan) {
+                return Relationship(
+                    m_left, m_right, LessThan, std::min(m_offset, other.m_offset));
+            }
+            
+            ASSERT(other.m_kind == GreaterThan);
+            if (sumOverflows<int>(m_offset, -1))
+                return Relationship();
+            if (sumOverflows<int>(other.m_offset, 1))
+                return Relationship();
+            if (m_offset - 1 == other.m_offset + 1)
+                return Relationship(m_left, m_right, Equal, m_offset - 1);
+            
+            return Relationship();
+        }
+        
+        ASSERT(m_kind == GreaterThan);
+        return filterFlipped();
+    }
+
+    // Come up with a relationship that is the best description of this && other, provided that left() is
+    // the same and right() is a constant. Also requires that this is at least as vague as other. It may
+    // return this or it may return something else, but whatever it returns, it will have the same nodes as
+    // this. This is not automatically done by filter() because it currently only makes sense to call this
+    // during a very particular part of setOneSide().
+    Relationship filterConstant(const Relationship& other) const
+    {
+        ASSERT(m_left == other.m_left);
+        ASSERT(m_right->isInt32Constant());
+        ASSERT(other.m_right->isInt32Constant());
+        ASSERT(vagueness() >= other.vagueness());
+
+        if (vagueness() == other.vagueness())
+            return *this;
+
+        int thisRight = m_right->asInt32();
+        int otherRight = other.m_right->asInt32();
+        
+        // Ignore funny business.
+        if (sumOverflows<int>(otherRight, other.m_offset))
+            return *this;
+
+        int otherEffectiveRight = otherRight + other.m_offset;
+
+        switch (other.m_kind) {
+        case Equal:
+            // Return a version of *this that is Equal to other's constant.
+            return Relationship(m_left, m_right, Equal, otherEffectiveRight - thisRight);
+
+        case LessThan:
+        case GreaterThan:
+            ASSERT(m_kind == NotEqual);
+            // We could do smart things here. But we don't currently have an example of when it would be
+            // valuable. Note that you have to be careful. We could refine NotEqual to LessThan, but only
+            // if the LessThan subsumes the NotEqual.
+            return *this;
+            
+        case NotEqual:
+            RELEASE_ASSERT_NOT_REACHED();
+            return Relationship();
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return Relationship();
+    }
+    
+    int minValueOfLeft() const
+    {
+        if (m_left->isInt32Constant())
+            return m_left->asInt32();
+        
+        if (m_kind == LessThan || m_kind == NotEqual)
+            return std::numeric_limits<int>::min();
+        
+        int minRightValue = std::numeric_limits<int>::min();
+        if (m_right->isInt32Constant())
+            minRightValue = m_right->asInt32();
+        
+        if (m_kind == GreaterThan)
+            return clampedSum(minRightValue, m_offset, 1);
+        ASSERT(m_kind == Equal);
+        return clampedSum(minRightValue, m_offset);
+    }
+    
+    int maxValueOfLeft() const
+    {
+        if (m_left->isInt32Constant())
+            return m_left->asInt32();
+        
+        if (m_kind == GreaterThan || m_kind == NotEqual)
+            return std::numeric_limits<int>::max();
+        
+        int maxRightValue = std::numeric_limits<int>::max();
+        if (m_right->isInt32Constant())
+            maxRightValue = m_right->asInt32();
+        
+        if (m_kind == LessThan)
+            return clampedSum(maxRightValue, m_offset, -1);
+        ASSERT(m_kind == Equal);
+        return clampedSum(maxRightValue, m_offset);
+    }
+    
+    void dump(PrintStream& out) const
+    {
+        // This prints out the relationship without any whitespace, like @x<@y+42. This
+        // optimizes for the clarity of a list of relationships. It's easier to read something
+        // like [@1<@2+3, @4==@5-6] than it would be if there was whitespace inside the
+        // relationships.
+        
+        if (!*this) {
+            out.print("null");
+            return;
+        }
+        
+        out.print(m_left);
+        switch (m_kind) {
+        case LessThan:
+            out.print("<");
+            break;
+        case Equal:
+            out.print("==");
+            break;
+        case NotEqual:
+            out.print("!=");
+            break;
+        case GreaterThan:
+            out.print(">");
+            break;
+        }
+        out.print(m_right);
+        if (m_offset > 0)
+            out.print("+", m_offset);
+        else if (m_offset < 0)
+            out.print("-", -static_cast<int64_t>(m_offset));
+    }
+    
+private:
+    Relationship mergeImpl(const Relationship& other) const
+    {
+        ASSERT(sameNodesAs(other));
+        ASSERT(m_kind != GreaterThan);
+        ASSERT(other.m_kind != GreaterThan);
+        ASSERT(*this != other);
+        
+        // The purpose of this method is to guarantee that:
+        //
+        // - We avoid having more than one Relationship over the same two nodes. Therefore, if
+        //   the merge could be expressed as two Relationships, we prefer to instead pick the
+        //   less precise single Relationship form even if that means TOP.
+        //
+        // - If the difference between two Relationships is just the m_offset, then we create a
+        //   Relationship that has an offset of -1, 0, or 1. This is an essential convergence
+        //   hack. We need -1 and 1 to support <= and >=.
+        
+        // From here we can assume that the two relationships are not identical. Usually we use
+        // this to assume that we have different offsets anytime that everything but the offset
+        // is identical.
+        
+        if (m_kind == NotEqual) {
+            if (other.m_kind == NotEqual)
+                return Relationship(); // Different offsets, so tautology.
+            
+            if (other.m_kind == Equal) {
+                if (m_offset != other.m_offset) {
+                    // Saying that you might be B when you've already said that you're anything
+                    // but A, where A and B are different, is a tautology. You could just say
+                    // that you're anything but A. Adding "(a == b + 1)" to "(a != b + 5)" has
+                    // no value.
+                    return *this;
+                }
+                // Otherwise, same offsets: we're saying that you're either A or you're not
+                // equal to A.
+                
+                return Relationship();
+            }
+            
+            RELEASE_ASSERT(other.m_kind == LessThan);
+            // We have these claims, and we're merging them:
+            //     @a != @b + C
+            //     @a < @b + D
+            //
+            // If we have C == D, then the merge is clearly just the NotEqual.
+            // If we have C < D, then the merge is a tautology.
+            // If we have C > D, then we could keep both claims, but we are cheap, so we
+            // don't. We just use the NotEqual.
+            
+            if (m_offset < other.m_offset)
+                return Relationship();
+            
+            return *this;
+        }
+        
+        if (m_kind == LessThan) {
+            if (other.m_kind == LessThan) {
+                // Figure out what offset to select to merge them. The appropriate offsets are
+                // -1, 0, or 1.
+                
+                // First figure out what offset we'd like to use.
+                int bestOffset = std::max(m_offset, other.m_offset);
+                
+                // We have something like @a < @b + 2. We can't represent this under the
+                // -1,0,1 rule.
+                if (isGeneralOffset(bestOffset))
+                    return Relationship(m_left, m_right, LessThan, std::max(bestOffset, -1));
+                
+                return Relationship();
+            }
+            
+            // The only thing left is Equal. We would have eliminated the GreaterThan's, and
+            // if we merge LessThan and NotEqual, the NotEqual always comes first.
+            RELEASE_ASSERT(other.m_kind == Equal);
+            
+            // This is the really interesting case. We have:
+            //
+            //     @a < @b + C
+            //
+            // and:
+            //
+            //     @a == @b + D
+            //
+            // Therefore we'd like to return:
+            //
+            //     @a < @b + max(C, D + 1)
+            
+            int bestOffset = std::max(m_offset, other.m_offset + 1);
+            
+            // We have something like @a < @b + 2. We can't do it.
+            if (isGeneralOffset(bestOffset))
+                return Relationship(m_left, m_right, LessThan, std::max(bestOffset, -1));
+
+            return Relationship();
+        }
+        
+        // The only thing left is Equal, since we would have gotten rid of the GreaterThan's.
+        RELEASE_ASSERT(m_kind == Equal);
+        
+        // We would never see NotEqual, because those always come first. We would never
+        // see GreaterThan, because we would have eliminated those. We would never see
+        // LessThan, because those always come first.
+        
+        RELEASE_ASSERT(other.m_kind == Equal);
+        // We have @a == @b + C and @a == @b + D, where C != D. Turn this into some
+        // inequality that involves a constant that is -1,0,1. Note that we will never have
+        // lessThan and greaterThan because the constants are constrained to -1,0,1. The only
+        // way for both of them to be valid is a<b+1 and a>b-1, but then we would have said
+        // a==b.
+
+        Relationship lessThan;
+        Relationship greaterThan;
+        
+        int lessThanEqOffset = std::max(m_offset, other.m_offset);
+        if (lessThanEqOffset >= -2 && lessThanEqOffset <= 0) {
+            lessThan = Relationship(
+                m_left, other.m_right, LessThan, lessThanEqOffset + 1);
+            
+            ASSERT(isGeneralOffset(lessThan.offset()));
+        }
+        
+        int greaterThanEqOffset = std::min(m_offset, other.m_offset);
+        if (greaterThanEqOffset >= 0 && greaterThanEqOffset <= 2) {
+            greaterThan = Relationship(
+                m_left, other.m_right, GreaterThan, greaterThanEqOffset - 1);
+            
+            ASSERT(isGeneralOffset(greaterThan.offset()));
+        }
+        
+        if (lessThan) {
+            // Both relationships cannot be valid; see above.
+            RELEASE_ASSERT(!greaterThan);
+            
+            return lessThan;
+        }
+        
+        return greaterThan;
+    }
+
+    template<typename Functor>
+    void mergeConstantsImpl(const Relationship& other, const Functor& functor) const
+    {
+        ASSERT(m_left == other.m_left);
+
+        // Only deal with constant right.
+        if (!m_right->isInt32Constant() || !other.m_right->isInt32Constant())
+            return;
+
+        // What follows is a fairly conservative merge. We could tune this phase to come up with
+        // all possible inequalities between variables and constants, but we focus mainly on cheap
+        // cases for now.
+
+        // Here are some of the the arrangements we can merge usefully assuming @c < @d:
+        //
+        //     @x == @c || @x == @d   =>   @x >= c && @x <= @d
+        //     @x >= @c || @x <= @d   =>   TOP
+        //     @x == @c || @x != @d   =>   @x != @d
+
+        int thisRight = m_right->asInt32();
+        int otherRight = other.m_right->asInt32();
+
+        // Ignore funny business.
+        if (sumOverflows<int>(thisRight, m_offset))
+            return;
+        if (sumOverflows<int>(otherRight, other.m_offset))
+            return;
+
+        int thisEffectiveRight = thisRight + m_offset;
+        int otherEffectiveRight = otherRight + other.m_offset;
+
+        auto makeUpper = [&] (int64_t upper) {
+            if (upper <= thisRight) {
+                // We want m_right + offset to be equal to upper. Hence we want offset to cancel
+                // with m_right. But there's more to it, since we want +1 to turn the LessThan into
+                // a LessThanOrEqual, and we want to make sure we don't end up with non-general
+                // offsets. 
+                int offset = static_cast<int>(std::max(
+                    static_cast<int64_t>(1) + upper - static_cast<int64_t>(thisRight),
+                    static_cast<int64_t>(-1)));
+                functor(Relationship(m_left, m_right, LessThan, offset));
+            }
+            if (upper <= otherRight) {
+                int offset = static_cast<int>(std::max(
+                    static_cast<int64_t>(1) + upper - static_cast<int64_t>(otherRight),
+                    static_cast<int64_t>(-1)));
+                functor(Relationship(m_left, other.m_right, LessThan, offset));
+            }
+        };
+        auto makeLower = [&] (int64_t lower) {
+            if (lower >= thisRight) {
+                // We want m_right + offset to be equal to lower. Hence we want offset to cancel with
+                // m_right. But there's more to it, since we want -1 to turn the GreaterThan into a
+                // GreaterThanOrEqual, and we want to make sure we don't end up with non-general
+                // offsets.
+                int offset = static_cast<int>(std::min(
+                    static_cast<int64_t>(-1) + lower - static_cast<int64_t>(thisRight),
+                    static_cast<int64_t>(1)));
+                functor(Relationship(m_left, m_right, GreaterThan, offset));
+            }
+            if (lower >= otherRight) {
+                int offset = static_cast<int>(std::min(
+                    static_cast<int64_t>(-1) + lower - static_cast<int64_t>(otherRight),
+                    static_cast<int64_t>(1)));
+                functor(Relationship(m_left, other.m_right, GreaterThan, offset));
+            }
+        };
+
+        switch (m_kind) {
+        case Equal: {
+            switch (other.m_kind) {
+            case Equal: {
+                if (thisEffectiveRight == otherEffectiveRight) {
+                    // This probably won't arise often. We can keep whichever relationship is general.
+                    if (isGeneralOffset(m_offset))
+                        functor(*this);
+                    if (isGeneralOffset(other.m_offset))
+                        functor(other);
+                    return;
+                }
+
+                // What follows is the only case where a merge will create more rules than what it
+                // started with. This is fine for convergence because the LessThan/GreaterThan
+                // rules that this creates are general (i.e. have small offsets) and they never
+                // spawn more rules upon subsequent merging.
+
+                makeUpper(std::max(thisEffectiveRight, otherEffectiveRight));
+                makeLower(std::min(thisEffectiveRight, otherEffectiveRight));
+                return;
+            }
+
+            case LessThan: {
+                // Either the LessThan condition subsumes the equality, or the LessThan condition
+                // and equality merge together to create a looser LessThan condition.
+
+                // This is @x == thisEffectiveRight
+                // Other is: @x < otherEffectiveRight
+
+                // We want to create @x <= upper. Figure out the value of upper.
+                makeUpper(std::max(
+                    static_cast<int64_t>(thisEffectiveRight),
+                    static_cast<int64_t>(otherEffectiveRight) - 1));
+                return;
+            }
+
+            case GreaterThan: {
+                // Opposite of the LessThan case, above.
+
+                // This is: @x == thisEffectiveRight
+                // Other is: @x > otherEffectiveRight
+
+                makeLower(std::min(
+                    static_cast<int64_t>(thisEffectiveRight),
+                    static_cast<int64_t>(otherEffectiveRight) + 1));
+                return;
+            }
+
+            case NotEqual: {
+                // We keep the NotEqual so long as it doesn't contradict our Equal.
+                if (otherEffectiveRight == thisEffectiveRight)
+                    return;
+
+                // But, we only keep the NotEqual if it is general. This simplifies reasoning about
+                // convergence: merging never introduces a new rule unless that rule is general.
+                if (!isGeneralOffset(other.m_offset))
+                    return;
+                
+                functor(other);
+                return;
+            } }
+
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+
+        case LessThan: {
+            switch (other.m_kind) {
+            case Equal: {
+                other.mergeConstantsImpl(*this, functor);
+                return;
+            }
+
+            case LessThan: {
+                makeUpper(std::max(
+                    static_cast<int64_t>(thisEffectiveRight) - 1,
+                    static_cast<int64_t>(otherEffectiveRight) - 1));
+                return;
+            }
+
+            case GreaterThan: {
+                // We have a claim that @x > @c || @x < @d. If @d > @c, this is the tautology. If
+                // @d <= @c, it's sort of uninteresting. Just ignore this.
+                return;
+            }
+
+            case NotEqual: {
+                // We have a claim that @x < @c || @x != @d. This isn't interesting.
+                return;
+            } }
+            
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+
+        case GreaterThan: {
+            switch (other.m_kind) {
+            case Equal: {
+                other.mergeConstantsImpl(*this, functor);
+                return;
+            }
+
+            case LessThan: {
+                // Not interesting, see above.
+                return;
+            }
+
+            case GreaterThan: {
+                makeLower(std::min(
+                    static_cast<int64_t>(thisEffectiveRight) + 1,
+                    static_cast<int64_t>(otherEffectiveRight) + 1));
+                return;
+            }
+
+            case NotEqual: {
+                // Not interesting, see above.
+                return;
+            } }
+
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+
+        case NotEqual: {
+            if (other.m_kind == Equal)
+                other.mergeConstantsImpl(*this, functor);
+            return;
+        } }
+
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    NodeFlowProjection m_left;
+    NodeFlowProjection m_right;
+    Kind m_kind;
+    int m_offset; // This offset can be arbitrarily large.
+};
+
+typedef HashMap<NodeFlowProjection, Vector<Relationship>> RelationshipMap;
+
+class IntegerRangeOptimizationPhase : public Phase {
+public:
+    IntegerRangeOptimizationPhase(Graph& graph)
+        : Phase(graph, "integer range optimization")
+        , m_zero(nullptr)
+        , m_relationshipsAtHead(graph)
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == SSA);
+        
+        // Before we do anything, make sure that we have a zero constant at the top.
+        for (Node* node : *m_graph.block(0)) {
+            if (node->isInt32Constant() && !node->asInt32()) {
+                m_zero = node;
+                break;
+            }
+        }
+        if (!m_zero) {
+            m_zero = m_insertionSet.insertConstant(0, m_graph.block(0)->at(0)->origin, jsNumber(0));
+            m_insertionSet.execute(m_graph.block(0));
+        }
+        
+        if (verbose) {
+            dataLog("Graph before integer range optimization:\n");
+            m_graph.dump();
+        }
+        
+        // This performs a fixpoint over the blocks in reverse post-order. Logically, we
+        // maintain a list of relationships at each point in the program. The list should be
+        // read as an intersection. For example if we have {rel1, rel2, ..., relN}, you should
+        // read this as:
+        //
+        //     TOP && rel1 && rel2 && ... && relN
+        //
+        // This allows us to express things like:
+        //
+        //     @a > @b - 42 && @a < @b + 25
+        //
+        // But not things like:
+        //
+        //     @a < @b - 42 || @a > @b + 25
+        //
+        // We merge two lists by merging each relationship in one list with each relationship
+        // in the other list. Merging two relationships will yield a relationship list; as with
+        // all such lists it is an intersction. Merging relationships over different variables
+        // always yields the empty list (i.e. TOP). This merge style is sound because if we
+        // have:
+        //
+        //     (A && B && C) || (D && E && F)
+        //
+        // Then a valid merge is just one that will return true if A, B, C are all true, or
+        // that will return true if D, E, F are all true. Our merge style essentially does:
+        //
+        //     (A || D) && (A || E) && (A || F) && (B || D) && (B || E) && (B || F) &&
+        //         (C || D) && (C || E) && (C || F)
+        //
+        // If A && B && C is true, then this returns true. If D && E && F is true, this also
+        // returns true.
+        //
+        // While this appears at first like a kind of expression explosion, in practice it
+        // isn't. The code that handles this knows that the merge of two relationships over
+        // different variables is TOP (i.e. the empty list). For example if A above is @a < @b
+        // and B above is @c > @d, where @a, @b, @c, and @d are different nodes, the merge will
+        // yield nothing. In fact, the merge algorithm will skip such merges entirely because
+        // the relationship lists are actually keyed by node.
+        //
+        // Note that it's always safe to drop any of relationship from the relationship list.
+        // This merely increases the likelihood of the "expression" yielding true, i.e. being
+        // closer to TOP. Optimizations are only performed if we can establish that the
+        // expression implied by the relationship list is false for all of those cases where
+        // some check would have failed.
+        //
+        // There is no notion of BOTTOM because we treat blocks that haven't had their
+        // state-at-head set as a special case: we just transfer all live relationships to such
+        // a block. After the head of a block is set, we perform the merging as above. In all
+        // other places where we would ordinarily need BOTTOM, we approximate it by having some
+        // non-BOTTOM relationship.
+        
+        BlockList postOrder = m_graph.blocksInPostOrder();
+
+        // This loop analyzes the IR to give us m_relationshipsAtHead for each block. This
+        // may reexecute blocks many times, but it is guaranteed to converge. The state of
+        // the relationshipsAtHead over any pair of nodes converge monotonically towards the
+        // TOP relationship (i.e. no relationships in the relationship list). The merge rule
+        // when between the current relationshipsAtHead and the relationships being propagated
+        // from a predecessor ensures monotonicity by converting disagreements into one of a
+        // small set of "general" relationships. There are 12 such relationshis, plus TOP. See
+        // the comment above Relationship::merge() for details.
+        bool changed = true;
+        while (changed) {
+            ++m_iterations;
+            if (m_iterations >= giveUpThreshold) {
+                // This case is not necessarily wrong but it can be a sign that this phase
+                // does not converge.
+                // If you hit this assertion for a legitimate case, update the giveUpThreshold
+                // to the smallest values that converges.
+                ASSERT_NOT_REACHED();
+
+                // In release, do not risk holding the thread for too long since this phase
+                // is really slow.
+                return false;
+            }
+
+            changed = false;
+            for (unsigned postOrderIndex = postOrder.size(); postOrderIndex--;) {
+                BasicBlock* block = postOrder[postOrderIndex];
+                DFG_ASSERT(
+                    m_graph, nullptr,
+                    block == m_graph.block(0) || m_seenBlocks.contains(block));
+            
+                m_relationships = m_relationshipsAtHead[block];
+            
+                for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                    Node* node = block->at(nodeIndex);
+                    if (verbose)
+                        dataLog("Analysis: at ", node, ": ", listDump(sortedRelationships()), "\n");
+                    executeNode(node);
+                }
+                
+                // Now comes perhaps the most important piece of cleverness: if we Branch, and
+                // the predicate involves some relation over integers, we propagate different
+                // information to the taken and notTaken paths. This handles:
+                // - Branch on int32.
+                // - Branch on LogicalNot on int32.
+                // - Branch on compare on int32's.
+                // - Branch on LogicalNot of compare on int32's.
+                Node* terminal = block->terminal();
+                bool alreadyMerged = false;
+                if (terminal->op() == Branch) {
+                    Relationship relationshipForTrue;
+                    BranchData* branchData = terminal->branchData();
+                    
+                    bool invert = false;
+                    if (terminal->child1()->op() == LogicalNot) {
+                        terminal = terminal->child1().node();
+                        invert = true;
+                    }
+                    
+                    if (terminal->child1().useKind() == Int32Use) {
+                        relationshipForTrue = Relationship::safeCreate(
+                            terminal->child1().node(), m_zero, Relationship::NotEqual, 0);
+                    } else {
+                        Node* compare = terminal->child1().node();
+                        switch (compare->op()) {
+                        case CompareEq:
+                        case CompareStrictEq:
+                        case CompareLess:
+                        case CompareLessEq:
+                        case CompareGreater:
+                        case CompareGreaterEq: {
+                            if (!compare->isBinaryUseKind(Int32Use))
+                                break;
+                    
+                            switch (compare->op()) {
+                            case CompareEq:
+                            case CompareStrictEq:
+                                relationshipForTrue = Relationship::safeCreate(
+                                    compare->child1().node(), compare->child2().node(),
+                                    Relationship::Equal, 0);
+                                break;
+                            case CompareLess:
+                                relationshipForTrue = Relationship::safeCreate(
+                                    compare->child1().node(), compare->child2().node(),
+                                    Relationship::LessThan, 0);
+                                break;
+                            case CompareLessEq:
+                                relationshipForTrue = Relationship::safeCreate(
+                                    compare->child1().node(), compare->child2().node(),
+                                    Relationship::LessThan, 1);
+                                break;
+                            case CompareGreater:
+                                relationshipForTrue = Relationship::safeCreate(
+                                    compare->child1().node(), compare->child2().node(),
+                                    Relationship::GreaterThan, 0);
+                                break;
+                            case CompareGreaterEq:
+                                relationshipForTrue = Relationship::safeCreate(
+                                    compare->child1().node(), compare->child2().node(),
+                                    Relationship::GreaterThan, -1);
+                                break;
+                            default:
+                                DFG_CRASH(m_graph, compare, "Invalid comparison node type");
+                                break;
+                            }
+                            break;
+                        }
+                    
+                        default:
+                            break;
+                        }
+                    }
+                    
+                    if (invert)
+                        relationshipForTrue = relationshipForTrue.inverse();
+                    
+                    if (relationshipForTrue) {
+                        RelationshipMap forTrue = m_relationships;
+                        RelationshipMap forFalse = m_relationships;
+                        
+                        if (verbose)
+                            dataLog("Dealing with true:\n");
+                        setRelationship(forTrue, relationshipForTrue);
+                        if (Relationship relationshipForFalse = relationshipForTrue.inverse()) {
+                            if (verbose)
+                                dataLog("Dealing with false:\n");
+                            setRelationship(forFalse, relationshipForFalse);
+                        }
+                        
+                        changed |= mergeTo(forTrue, branchData->taken.block);
+                        changed |= mergeTo(forFalse, branchData->notTaken.block);
+                        alreadyMerged = true;
+                    }
+                }
+
+                if (!alreadyMerged) {
+                    for (BasicBlock* successor : block->successors())
+                        changed |= mergeTo(m_relationships, successor);
+                }
+            }
+        }
+        
+        // Now we transform the code based on the results computed in the previous loop.
+        changed = false;
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            m_relationships = m_relationshipsAtHead[block];
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                if (verbose)
+                    dataLog("Transformation: at ", node, ": ", listDump(sortedRelationships()), "\n");
+                
+                // This ends up being pretty awkward to write because we need to decide if we
+                // optimize by using the relationships before the operation, but we need to
+                // call executeNode() before we optimize.
+                switch (node->op()) {
+                case ArithAbs: {
+                    if (node->child1().useKind() != Int32Use)
+                        break;
+
+                    auto iter = m_relationships.find(node->child1().node());
+                    if (iter == m_relationships.end())
+                        break;
+
+                    int minValue = std::numeric_limits<int>::min();
+                    int maxValue = std::numeric_limits<int>::max();
+                    for (Relationship relationship : iter->value) {
+                        minValue = std::max(minValue, relationship.minValueOfLeft());
+                        maxValue = std::min(maxValue, relationship.maxValueOfLeft());
+                    }
+
+                    executeNode(block->at(nodeIndex));
+
+                    if (minValue >= 0) {
+                        node->convertToIdentityOn(node->child1().node());
+                        changed = true;
+                        break;
+                    }
+                    bool absIsUnchecked = !shouldCheckOverflow(node->arithMode());
+                    if (maxValue < 0 || (absIsUnchecked && maxValue <= 0)) {
+                        node->convertToArithNegate();
+                        if (absIsUnchecked || minValue > std::numeric_limits<int>::min())
+                            node->setArithMode(Arith::Unchecked);
+                        changed = true;
+                        break;
+                    }
+                    if (minValue > std::numeric_limits<int>::min()) {
+                        node->setArithMode(Arith::Unchecked);
+                        changed = true;
+                        break;
+                    }
+
+                    break;
+                }
+                case ArithAdd: {
+                    if (!node->isBinaryUseKind(Int32Use))
+                        break;
+                    if (node->arithMode() != Arith::CheckOverflow)
+                        break;
+                    if (!node->child2()->isInt32Constant())
+                        break;
+                    
+                    auto iter = m_relationships.find(node->child1().node());
+                    if (iter == m_relationships.end())
+                        break;
+                    
+                    int minValue = std::numeric_limits<int>::min();
+                    int maxValue = std::numeric_limits<int>::max();
+                    for (Relationship relationship : iter->value) {
+                        minValue = std::max(minValue, relationship.minValueOfLeft());
+                        maxValue = std::min(maxValue, relationship.maxValueOfLeft());
+                    }
+
+                    if (verbose)
+                        dataLog("    minValue = ", minValue, ", maxValue = ", maxValue, "\n");
+                    
+                    if (sumOverflows<int>(minValue, node->child2()->asInt32()) ||
+                        sumOverflows<int>(maxValue, node->child2()->asInt32()))
+                        break;
+
+                    if (verbose)
+                        dataLog("    It's in bounds.\n");
+                    
+                    executeNode(block->at(nodeIndex));
+                    node->setArithMode(Arith::Unchecked);
+                    changed = true;
+                    break;
+                }
+                    
+                case CheckInBounds: {
+                    auto iter = m_relationships.find(node->child1().node());
+                    if (iter == m_relationships.end())
+                        break;
+                    
+                    bool nonNegative = false;
+                    bool lessThanLength = false;
+                    for (Relationship relationship : iter->value) {
+                        if (relationship.minValueOfLeft() >= 0)
+                            nonNegative = true;
+                        
+                        if (relationship.right() == node->child2().node()) {
+                            if (relationship.kind() == Relationship::Equal
+                                && relationship.offset() < 0)
+                                lessThanLength = true;
+                            
+                            if (relationship.kind() == Relationship::LessThan
+                                && relationship.offset() <= 0)
+                                lessThanLength = true;
+                        }
+                    }
+                    
+                    if (nonNegative && lessThanLength) {
+                        executeNode(block->at(nodeIndex));
+                        node->remove();
+                        changed = true;
+                    }
+                    break;
+                }
+
+                case GetByVal: {
+                    if (node->arrayMode().type() != Array::Undecided)
+                        break;
+
+                    auto iter = m_relationships.find(node->child2().node());
+                    if (iter == m_relationships.end())
+                        break;
+
+                    int minValue = std::numeric_limits<int>::min();
+                    for (Relationship relationship : iter->value)
+                        minValue = std::max(minValue, relationship.minValueOfLeft());
+
+                    if (minValue < 0)
+                        break;
+
+                    executeNode(block->at(nodeIndex));
+                    m_graph.convertToConstant(node, jsUndefined());
+                    changed = true;
+                    break;
+                }
+
+                default:
+                    break;
+                }
+                
+                executeNode(block->at(nodeIndex));
+            }
+        }
+        
+        return changed;
+    }
+
+private:
+    void executeNode(Node* node)
+    {
+        switch (node->op()) {
+        case CheckInBounds: {
+            setRelationship(Relationship::safeCreate(node->child1().node(), node->child2().node(), Relationship::LessThan));
+            setRelationship(Relationship::safeCreate(node->child1().node(), m_zero, Relationship::GreaterThan, -1));
+            break;
+        }
+
+        case ArithAbs: {
+            if (node->child1().useKind() != Int32Use)
+                break;
+            setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
+            break;
+        }
+            
+        case ArithAdd: {
+            // We're only interested in int32 additions and we currently only know how to
+            // handle the non-wrapping ones.
+            if (!node->isBinaryUseKind(Int32Use))
+                break;
+            
+            // FIXME: We could handle the unchecked arithmetic case. We just do it don't right
+            // now.
+            if (node->arithMode() != Arith::CheckOverflow)
+                break;
+            
+            // Handle add: @value + constant.
+            if (!node->child2()->isInt32Constant())
+                break;
+            
+            int offset = node->child2()->asInt32();
+            
+            // We add a relationship for @add == @value + constant, and then we copy the
+            // relationships for @value. This gives us a one-deep view of @value's existing
+            // relationships, which matches the one-deep search in setRelationship().
+            
+            setRelationship(
+                Relationship(node, node->child1().node(), Relationship::Equal, offset));
+            
+            auto iter = m_relationships.find(node->child1().node());
+            if (iter != m_relationships.end()) {
+                Vector<Relationship> toAdd;
+                for (Relationship relationship : iter->value) {
+                    // We have:
+                    //     add: ArithAdd(@x, C)
+                    //     @x op @y + D
+                    //
+                    // The following certainly holds:
+                    //     @x == @add - C
+                    //
+                    // Which allows us to substitute:
+                    //     @add - C op @y + D
+                    //
+                    // And then carry the C over:
+                    //     @add op @y + D + C
+                    
+                    Relationship newRelationship = relationship;
+                    ASSERT(newRelationship.left() == node->child1().node());
+                    
+                    if (newRelationship.right() == node)
+                        continue;
+                    newRelationship.setLeft(node);
+                    if (newRelationship.addToOffset(offset))
+                        toAdd.append(newRelationship);
+                }
+                for (Relationship relationship : toAdd)
+                    setRelationship(relationship, 0);
+            }
+            
+            // Now we want to establish that both the input and the output of the addition are
+            // within a particular range of integers.
+            
+            if (offset > 0) {
+                // If we have "add: @value + 1" then we know that @value <= max - 1, i.e. that
+                // @value < max.
+                if (!sumOverflows<int>(std::numeric_limits<int>::max(), -offset, 1)) {
+                    setRelationship(
+                        Relationship::safeCreate(
+                            node->child1().node(), m_zero, Relationship::LessThan,
+                            std::numeric_limits<int>::max() - offset + 1),
+                        0);
+                }
+                    
+                // If we have "add: @value + 1" then we know that @add >= min + 1, i.e. that
+                // @add > min.
+                if (!sumOverflows<int>(std::numeric_limits<int>::min(), offset, -1)) {
+                    setRelationship(
+                        Relationship(
+                            node, m_zero, Relationship::GreaterThan,
+                            std::numeric_limits<int>::min() + offset - 1),
+                        0);
+                }
+            }
+            
+            if (offset < 0 && offset != std::numeric_limits<int>::min()) {
+                // If we have "add: @value - 1" then we know that @value >= min + 1, i.e. that
+                // @value > min.
+                if (!sumOverflows<int>(std::numeric_limits<int>::min(), offset, -1)) {
+                    setRelationship(
+                        Relationship::safeCreate(
+                            node->child1().node(), m_zero, Relationship::GreaterThan,
+                            std::numeric_limits<int>::min() + offset - 1),
+                        0);
+                }
+                
+                // If we have "add: @value + 1" then we know that @add <= max - 1, i.e. that
+                // @add < max.
+                if (!sumOverflows<int>(std::numeric_limits<int>::max(), -offset, 1)) {
+                    setRelationship(
+                        Relationship(
+                            node, m_zero, Relationship::LessThan,
+                            std::numeric_limits<int>::max() - offset + 1),
+                        0);
+                }
+            }
+            break;
+        }
+            
+        case GetArrayLength: {
+            setRelationship(Relationship(node, m_zero, Relationship::GreaterThan, -1));
+            break;
+        }
+            
+        case Upsilon: {
+            setEquivalence(
+                node->child1().node(),
+                NodeFlowProjection(node->phi(), NodeFlowProjection::Shadow));
+            break;
+        }
+            
+        case Phi: {
+            setEquivalence(
+                NodeFlowProjection(node, NodeFlowProjection::Shadow),
+                node);
+            break;
+        }
+            
+        default:
+            break;
+        }
+    }
+    
+    void setEquivalence(NodeFlowProjection oldNode, NodeFlowProjection newNode)
+    {
+        setRelationship(Relationship::safeCreate(oldNode, newNode, Relationship::Equal, 0));
+        
+        auto iter = m_relationships.find(oldNode);
+        if (iter != m_relationships.end()) {
+            Vector<Relationship> toAdd;
+            for (Relationship relationship : iter->value) {
+                Relationship newRelationship = relationship;
+                // Avoid creating any kind of self-relationship.
+                if (newNode.node() == newRelationship.right().node())
+                    continue;
+                newRelationship.setLeft(newNode);
+                toAdd.append(newRelationship);
+            }
+            for (Relationship relationship : toAdd)
+                setRelationship(relationship);
+        }
+    }
+            
+    void setRelationship(Relationship relationship, unsigned timeToLive = 1)
+    {
+        setRelationship(m_relationships, relationship, timeToLive);
+    }
+    
+    void setRelationship(
+        RelationshipMap& relationshipMap, Relationship relationship, unsigned timeToLive = 1)
+    {
+        setOneSide(relationshipMap, relationship, timeToLive);
+        setOneSide(relationshipMap, relationship.flipped(), timeToLive);
+    }
+    
+    void setOneSide(
+        RelationshipMap& relationshipMap, Relationship relationship, unsigned timeToLive = 1)
+    {
+        if (!relationship)
+            return;
+        
+        if (verbose)
+            dataLog("    Setting: ", relationship, " (ttl = ", timeToLive, ")\n");
+
+        auto result = relationshipMap.add(
+            relationship.left(), Vector<Relationship>());
+        Vector<Relationship>& relationships = result.iterator->value;
+
+        if (relationship.right()->isInt32Constant()) {
+            // We want to do some work to refine relationships over constants. This is necessary because
+            // when we introduce a constant into the IR, we don't automatically create relationships
+            // between that constant and the other constants. That means that when we do introduce
+            // relationships between a non-constant and a constant, we need to check the other
+            // relationships between that non-constant and other constants to see if we can make some
+            // refinements. Possible constant statement filtrations:
+            //
+            // - @x == @c and @x != @d, where @c > @d:
+            //       @x == @c and @x > @d
+            //
+            // but actually we are more aggressive:
+            //
+            // - @x == @c and @x op @d where @c == @d + k
+            //       @x == @c and @x == @d + k
+            //
+            // And this is also possible:
+            //
+            // - @x > @c and @x != @d where @c == @d + k and k >= 0
+            //
+            //       @x > @c and @x > @d + k
+            //
+            // So, here's what we should do depending on the kind of relationship we're introducing:
+            //
+            // Equal constant: Find all LessThan, NotEqual, and GreaterThan constant operations and refine
+            //     them to be Equal constant. Don't worry about contradictions.
+            //
+            // LessThan, GreaterThan constant: See if there is any Equal constant, and if so, refine to
+            //     that. Otherwise, find all NotEqual constant operations and refine them to be LessThan or
+            //     GreaterThan constant if possible.
+            //
+            // NotEqual constant: See if there is any Equal constant, and if so, refine to that. Otherwise,
+            //     see if there is any LessThan or GreaterThan constant operation, and if so, attempt to
+            //     refine to that.
+            //
+            // Seems that the key thing is to have a filterConstant() operation that returns a refined
+            // version of *this based on other. The code here accomplishes this by using the vagueness
+            // index (Relationship::vagueness()) to first find less vague relationships and refine this one
+            // using them, and then find more vague relationships and refine those to this.
+
+            if (relationship.vagueness() != Relationship::minVagueness) {
+                // We're not minimally vague (maximally specific), so try to refine ourselves based on what
+                // we already know.
+                for (Relationship& otherRelationship : relationships) {
+                    if (otherRelationship.vagueness() < relationship.vagueness()
+                        && otherRelationship.right()->isInt32Constant()) {
+                        Relationship newRelationship = relationship.filterConstant(otherRelationship);
+                        if (verbose && newRelationship != relationship)
+                            dataLog("      Refined to: ", newRelationship, " based on ", otherRelationship, "\n");
+                        relationship = newRelationship;
+                    }
+                }
+            }
+
+            if (relationship.vagueness() != Relationship::maxVagueness) {
+                // We're not maximally value (minimally specific), so try to refine other relationships
+                // based on this one.
+                for (Relationship& otherRelationship : relationships) {
+                    if (otherRelationship.vagueness() > relationship.vagueness()
+                        && otherRelationship.right()->isInt32Constant()) {
+                        Relationship newRelationship = otherRelationship.filterConstant(relationship);
+                        if (verbose && newRelationship != otherRelationship)
+                            dataLog("      Refined ", otherRelationship, " to: ", newRelationship, "\n");
+                        otherRelationship = newRelationship;
+                    }
+                }
+            }
+        }
+
+        Vector<Relationship> toAdd;
+        bool found = false;
+        for (Relationship& otherRelationship : relationships) {
+            if (otherRelationship.sameNodesAs(relationship)) {
+                if (Relationship filtered = otherRelationship.filter(relationship)) {
+                    ASSERT(filtered.left() == relationship.left());
+                    otherRelationship = filtered;
+                    found = true;
+                }
+            }
+
+            // FIXME: Also add filtration over statements about constants. For example, if we have
+            // @x == @c and @x != @d, where @d > @c, then we want to turn @x != @d into @x < @d.
+            
+            if (timeToLive && otherRelationship.kind() == Relationship::Equal) {
+                if (verbose)
+                    dataLog("      Considering: ", otherRelationship, "\n");
+                
+                // We have:
+                //     @a op @b + C
+                //     @a == @c + D
+                //
+                // This implies:
+                //     @c + D op @b + C
+                //     @c op @b + C - D
+                //
+                // Where: @a == relationship.left(), @b == relationship.right(),
+                // @a == otherRelationship.left(), @c == otherRelationship.right().
+                
+                if (otherRelationship.offset() != std::numeric_limits<int>::min()) {
+                    Relationship newRelationship = relationship;
+                    if (newRelationship.right() != otherRelationship.right()) {
+                        newRelationship.setLeft(otherRelationship.right());
+                        if (newRelationship.addToOffset(-otherRelationship.offset()))
+                            toAdd.append(newRelationship);
+                    }
+                }
+            }
+        }
+        
+        if (!found)
+            relationships.append(relationship);
+        
+        for (Relationship anotherRelationship : toAdd) {
+            ASSERT(timeToLive);
+            setOneSide(relationshipMap, anotherRelationship, timeToLive - 1);
+        }
+    }
+    
+    bool mergeTo(RelationshipMap& relationshipMap, BasicBlock* target)
+    {
+        if (verbose) {
+            dataLog("Merging to ", pointerDump(target), ":\n");
+            dataLog("    Incoming: ", listDump(sortedRelationships(relationshipMap)), "\n");
+            dataLog("    At head: ", listDump(sortedRelationships(m_relationshipsAtHead[target])), "\n");
+        }
+        
+        if (m_seenBlocks.add(target)) {
+            // This is a new block. We copy subject to liveness pruning.
+            auto isLive = [&] (NodeFlowProjection node) {
+                if (node == m_zero)
+                    return true;
+                return target->ssa->liveAtHead.contains(node);
+            };
+            
+            for (auto& entry : relationshipMap) {
+                if (!isLive(entry.key))
+                    continue;
+                
+                Vector<Relationship> values;
+                for (Relationship relationship : entry.value) {
+                    ASSERT(relationship.left() == entry.key);
+                    if (isLive(relationship.right())) {
+                        if (verbose)
+                            dataLog("  Propagating ", relationship, "\n");
+                        values.append(relationship);
+                    }
+                }
+                
+                std::sort(values.begin(), values.end());
+                m_relationshipsAtHead[target].add(entry.key, values);
+            }
+            return true;
+        }
+        
+        // Merge by intersecting. We have no notion of BOTTOM, so we use the omission of
+        // relationships for a pair of nodes to mean TOP. The reason why we don't need BOTTOM
+        // is (1) we just overapproximate contradictions and (2) a value never having been
+        // assigned would only happen if we have not processed the node's predecessor. We
+        // shouldn't process blocks until we have processed the block's predecessor because we
+        // are using reverse postorder.
+        Vector<NodeFlowProjection> toRemove;
+        bool changed = false;
+        for (auto& entry : m_relationshipsAtHead[target]) {
+            auto iter = relationshipMap.find(entry.key);
+            if (iter == relationshipMap.end()) {
+                toRemove.append(entry.key);
+                changed = true;
+                continue;
+            }
+
+            Vector<Relationship> constantRelationshipsAtHead;
+            for (Relationship& relationshipAtHead : entry.value) {
+                if (relationshipAtHead.right()->isInt32Constant())
+                    constantRelationshipsAtHead.append(relationshipAtHead);
+            }
+
+            Vector<Relationship> mergedRelationships;
+            for (Relationship targetRelationship : entry.value) {
+                for (Relationship sourceRelationship : iter->value) {
+                    if (verbose)
+                        dataLog("  Merging ", targetRelationship, " and ", sourceRelationship, ":\n");
+                    targetRelationship.merge(
+                        sourceRelationship,
+                        [&] (Relationship newRelationship) {
+                            if (verbose)
+                                dataLog("    Got ", newRelationship, "\n");
+
+                            if (newRelationship.right()->isInt32Constant()) {
+                                // We can produce a relationship with a constant equivalent to
+                                // an existing relationship yet of a different form. For example:
+                                //
+                                //     @a == @b(42) + 0
+                                //     @a == @c(41) + 1
+                                //
+                                // We do not want to perpetually switch between those two forms,
+                                // so we always prefer the one already at head.
+
+                                for (Relationship& existingRelationshipAtHead : constantRelationshipsAtHead) {
+                                    if (existingRelationshipAtHead.isEquivalentTo(newRelationship)) {
+                                        newRelationship = existingRelationshipAtHead;
+                                        break;
+                                    }
+                                }
+                            }
+                            
+                            // We need to filter() to avoid exponential explosion of identical
+                            // relationships. We do this here to avoid making setOneSide() do
+                            // more work, since we expect setOneSide() will be called more
+                            // frequently. Here's an example. At some point someone might start
+                            // with two relationships like @a > @b - C and @a < @b + D. Then
+                            // someone does a setRelationship() passing something that turns
+                            // both of these into @a == @b. Now we have @a == @b duplicated.
+                            // Let's say that this duplicate @a == @b ends up at the head of a
+                            // loop. If we didn't have this rule, then the loop would propagate
+                            // duplicate @a == @b's onto the existing duplicate @a == @b's.
+                            // There would be four pairs of @a == @b, each of which would
+                            // create a new @a == @b. Now we'd have four of these duplicates
+                            // and the next time around we'd have 8, then 16, etc. We avoid
+                            // this here by doing this filtration. That might be a bit of
+                            // overkill, since it's probably just the identical duplicate
+                            // relationship case we want' to avoid. But, I'll keep this until
+                            // we have evidence that this is a performance problem. Remember -
+                            // we are already dealing with a list that is pruned down to
+                            // relationships with identical left operand. It shouldn't be a
+                            // large list.
+                            bool found = false;
+                            for (Relationship& existingRelationship : mergedRelationships) {
+                                if (existingRelationship.sameNodesAs(newRelationship)) {
+                                    Relationship filtered =
+                                        existingRelationship.filter(newRelationship);
+                                    if (filtered) {
+                                        existingRelationship = filtered;
+                                        found = true;
+                                        break;
+                                    }
+                                }
+                            }
+                            
+                            if (!found)
+                                mergedRelationships.append(newRelationship);
+                        });
+                }
+            }
+            std::sort(mergedRelationships.begin(), mergedRelationships.end());
+            if (entry.value == mergedRelationships)
+                continue;
+            
+            entry.value = mergedRelationships;
+            changed = true;
+        }
+        for (NodeFlowProjection node : toRemove)
+            m_relationshipsAtHead[target].remove(node);
+        
+        return changed;
+    }
+        
+    Vector<Relationship> sortedRelationships(const RelationshipMap& relationships)
+    {
+        Vector<Relationship> result;
+        for (auto& entry : relationships)
+            result.appendVector(entry.value);
+        std::sort(result.begin(), result.end());
+        return result;
+    }
+    
+    Vector<Relationship> sortedRelationships()
+    {
+        return sortedRelationships(m_relationships);
+    }
+    
+    Node* m_zero;
+    RelationshipMap m_relationships;
+    BlockSet m_seenBlocks;
+    BlockMap<RelationshipMap> m_relationshipsAtHead;
+    InsertionSet m_insertionSet;
+
+    unsigned m_iterations { 0 };
+};
+    
+} // anonymous namespace
+
+bool performIntegerRangeOptimization(Graph& graph)
+{
+    return runPhase<IntegerRangeOptimizationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGIntegerRangeOptimizationPhase.h b/dfg/DFGIntegerRangeOptimizationPhase.h
new file mode 100644
index 0000000..10d78cc
--- /dev/null
+++ b/dfg/DFGIntegerRangeOptimizationPhase.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Removes overflow checks and out-of-bounds checks by doing a forward flow analysis to prove
+// inequalities. It will remove the overflow and bounds checks in loops like:
+//
+// for (var i = 0; i < array.length; ++i) array[i];
+
+bool performIntegerRangeOptimization(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGInvalidationPointInjectionPhase.cpp b/dfg/DFGInvalidationPointInjectionPhase.cpp
new file mode 100644
index 0000000..e9fbd35
--- /dev/null
+++ b/dfg/DFGInvalidationPointInjectionPhase.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGInvalidationPointInjectionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockSetInlines.h"
+#include "DFGClobberize.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class InvalidationPointInjectionPhase : public Phase {
+    static const bool verbose = false;
+    
+public:
+    InvalidationPointInjectionPhase(Graph& graph)
+        : Phase(graph, "invalidation point injection")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form != SSA);
+        
+        BlockSet blocksThatNeedInvalidationPoints;
+        
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            m_originThatHadFire = CodeOrigin();
+            
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex)
+                handle(nodeIndex, block->at(nodeIndex));
+            
+            // Note: this assumes that control flow occurs at bytecode instruction boundaries.
+            if (m_originThatHadFire.isSet()) {
+                for (unsigned i = block->numSuccessors(); i--;)
+                    blocksThatNeedInvalidationPoints.add(block->successor(i));
+            }
+            
+            m_insertionSet.execute(block);
+        }
+
+        for (BasicBlock* block : blocksThatNeedInvalidationPoints.iterable(m_graph)) {
+            insertInvalidationCheck(0, block->at(0));
+            m_insertionSet.execute(block);
+        }
+        
+        return true;
+    }
+
+private:
+    void handle(unsigned nodeIndex, Node* node)
+    {
+        if (m_originThatHadFire.isSet() && m_originThatHadFire != node->origin.forExit) {
+            insertInvalidationCheck(nodeIndex, node);
+            m_originThatHadFire = CodeOrigin();
+        }
+        
+        if (writesOverlap(m_graph, node, Watchpoint_fire))
+            m_originThatHadFire = node->origin.forExit;
+    }
+    
+    void insertInvalidationCheck(unsigned nodeIndex, Node* node)
+    {
+        m_insertionSet.insertNode(nodeIndex, SpecNone, InvalidationPoint, node->origin);
+    }
+    
+    CodeOrigin m_originThatHadFire;
+    InsertionSet m_insertionSet;
+};
+
+bool performInvalidationPointInjection(Graph& graph)
+{
+    return runPhase<InvalidationPointInjectionPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGInvalidationPointInjectionPhase.h b/dfg/DFGInvalidationPointInjectionPhase.h
new file mode 100644
index 0000000..8739c8d
--- /dev/null
+++ b/dfg/DFGInvalidationPointInjectionPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Inserts an invalidation check at the beginning of any CodeOrigin that follows a CodeOrigin
+// that had a call (clobbered World).
+
+bool performInvalidationPointInjection(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGJITCode.cpp b/dfg/DFGJITCode.cpp
new file mode 100644
index 0000000..7fb9f71
--- /dev/null
+++ b/dfg/DFGJITCode.cpp
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGJITCode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+#include "TrackedReferences.h"
+
+namespace JSC { namespace DFG {
+
+JITCode::JITCode()
+    : DirectJITCode(DFGJIT)
+#if ENABLE(FTL_JIT)
+    , osrEntryRetry(0)
+    , abandonOSREntry(false)
+#endif // ENABLE(FTL_JIT)
+{
+}
+
+JITCode::~JITCode()
+{
+}
+
+CommonData* JITCode::dfgCommon()
+{
+    return &common;
+}
+
+JITCode* JITCode::dfg()
+{
+    return this;
+}
+
+void JITCode::shrinkToFit()
+{
+    common.shrinkToFit();
+    osrEntry.shrinkToFit();
+    osrExit.shrinkToFit();
+    speculationRecovery.shrinkToFit();
+    minifiedDFG.prepareAndShrink();
+    variableEventStream.shrinkToFit();
+}
+
+void JITCode::reconstruct(
+    CodeBlock* codeBlock, CodeOrigin codeOrigin, unsigned streamIndex,
+    Operands<ValueRecovery>& result)
+{
+    variableEventStream.reconstruct(
+        codeBlock, codeOrigin, minifiedDFG, streamIndex, result);
+}
+
+void JITCode::reconstruct(
+    ExecState* exec, CodeBlock* codeBlock, CodeOrigin codeOrigin, unsigned streamIndex,
+    Operands<JSValue>& result)
+{
+    Operands<ValueRecovery> recoveries;
+    reconstruct(codeBlock, codeOrigin, streamIndex, recoveries);
+    
+    result = Operands<JSValue>(OperandsLike, recoveries);
+    for (size_t i = result.size(); i--;)
+        result[i] = recoveries[i].recover(exec);
+}
+
+RegisterSet JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite(CodeBlock* codeBlock, CallSiteIndex callSiteIndex)
+{
+    for (OSRExit& exit : osrExit) {
+        if (exit.isExceptionHandler() && exit.m_exceptionHandlerCallSiteIndex.bits() == callSiteIndex.bits()) {
+            Operands<ValueRecovery> valueRecoveries;
+            reconstruct(codeBlock, exit.m_codeOrigin, exit.m_streamIndex, valueRecoveries);
+            RegisterSet liveAtOSRExit;
+            for (size_t index = 0; index < valueRecoveries.size(); ++index) {
+                const ValueRecovery& recovery = valueRecoveries[index];
+                if (recovery.isInRegisters()) {
+                    if (recovery.isInGPR())
+                        liveAtOSRExit.set(recovery.gpr());
+                    else if (recovery.isInFPR())
+                        liveAtOSRExit.set(recovery.fpr());
+#if USE(JSVALUE32_64)
+                    else if (recovery.isInJSValueRegs()) {
+                        liveAtOSRExit.set(recovery.payloadGPR());
+                        liveAtOSRExit.set(recovery.tagGPR());
+                    }
+#endif
+                    else
+                        RELEASE_ASSERT_NOT_REACHED();
+                }
+            }
+
+            return liveAtOSRExit;
+        }
+    }
+
+    return RegisterSet();
+}
+
+#if ENABLE(FTL_JIT)
+bool JITCode::checkIfOptimizationThresholdReached(CodeBlock* codeBlock)
+{
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    return tierUpCounter.checkIfThresholdCrossedAndSet(codeBlock);
+}
+
+void JITCode::optimizeNextInvocation(CodeBlock* codeBlock)
+{
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    if (Options::verboseOSR())
+        dataLog(*codeBlock, ": FTL-optimizing next invocation.\n");
+    tierUpCounter.setNewThreshold(0, codeBlock);
+}
+
+void JITCode::dontOptimizeAnytimeSoon(CodeBlock* codeBlock)
+{
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    if (Options::verboseOSR())
+        dataLog(*codeBlock, ": Not FTL-optimizing anytime soon.\n");
+    tierUpCounter.deferIndefinitely();
+}
+
+void JITCode::optimizeAfterWarmUp(CodeBlock* codeBlock)
+{
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    if (Options::verboseOSR())
+        dataLog(*codeBlock, ": FTL-optimizing after warm-up.\n");
+    CodeBlock* baseline = codeBlock->baselineVersion();
+    tierUpCounter.setNewThreshold(
+        baseline->adjustedCounterValue(Options::thresholdForFTLOptimizeAfterWarmUp()),
+        baseline);
+}
+
+void JITCode::optimizeSoon(CodeBlock* codeBlock)
+{
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    if (Options::verboseOSR())
+        dataLog(*codeBlock, ": FTL-optimizing soon.\n");
+    CodeBlock* baseline = codeBlock->baselineVersion();
+    tierUpCounter.setNewThreshold(
+        baseline->adjustedCounterValue(Options::thresholdForFTLOptimizeSoon()),
+        codeBlock);
+}
+
+void JITCode::forceOptimizationSlowPathConcurrently(CodeBlock* codeBlock)
+{
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    if (Options::verboseOSR())
+        dataLog(*codeBlock, ": Forcing slow path concurrently for FTL entry.\n");
+    tierUpCounter.forceSlowPathConcurrently();
+}
+
+void JITCode::setOptimizationThresholdBasedOnCompilationResult(
+    CodeBlock* codeBlock, CompilationResult result)
+{
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    switch (result) {
+    case CompilationSuccessful:
+        optimizeNextInvocation(codeBlock);
+        codeBlock->baselineVersion()->m_hasBeenCompiledWithFTL = true;
+        return;
+    case CompilationFailed:
+        dontOptimizeAnytimeSoon(codeBlock);
+        codeBlock->baselineVersion()->m_didFailFTLCompilation = true;
+        return;
+    case CompilationDeferred:
+        optimizeAfterWarmUp(codeBlock);
+        return;
+    case CompilationInvalidated:
+        // This is weird - it will only happen in cases when the DFG code block (i.e.
+        // the code block that this JITCode belongs to) is also invalidated. So it
+        // doesn't really matter what we do. But, we do the right thing anyway. Note
+        // that us counting the reoptimization actually means that we might count it
+        // twice. But that's generally OK. It's better to overcount reoptimizations
+        // than it is to undercount them.
+        codeBlock->baselineVersion()->countReoptimization();
+        optimizeAfterWarmUp(codeBlock);
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+#endif // ENABLE(FTL_JIT)
+
+void JITCode::validateReferences(const TrackedReferences& trackedReferences)
+{
+    common.validateReferences(trackedReferences);
+    
+    for (OSREntryData& entry : osrEntry) {
+        for (unsigned i = entry.m_expectedValues.size(); i--;)
+            entry.m_expectedValues[i].validateReferences(trackedReferences);
+    }
+    
+    minifiedDFG.validateReferences(trackedReferences);
+}
+
+std::optional<CodeOrigin> JITCode::findPC(CodeBlock*, void* pc)
+{
+    for (OSRExit& exit : osrExit) {
+        if (ExecutableMemoryHandle* handle = exit.m_code.executableMemory()) {
+            if (handle->start() <= pc && pc < handle->end())
+                return std::optional<CodeOrigin>(exit.m_codeOriginForExitProfile);
+        }
+    }
+
+    return std::nullopt;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGJITCode.h b/dfg/DFGJITCode.h
new file mode 100644
index 0000000..e1f6c41
--- /dev/null
+++ b/dfg/DFGJITCode.h
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "CompilationResult.h"
+#include "DFGCommonData.h"
+#include "DFGMinifiedGraph.h"
+#include "DFGOSREntry.h"
+#include "DFGOSRExit.h"
+#include "DFGVariableEventStream.h"
+#include "ExecutionCounter.h"
+#include "JITCode.h"
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace DFG {
+
+class JITCompiler;
+
+class JITCode : public DirectJITCode {
+public:
+    JITCode();
+    virtual ~JITCode();
+    
+    CommonData* dfgCommon() override;
+    JITCode* dfg() override;
+    
+    OSREntryData* appendOSREntryData(unsigned bytecodeIndex, unsigned machineCodeOffset)
+    {
+        DFG::OSREntryData entry;
+        entry.m_bytecodeIndex = bytecodeIndex;
+        entry.m_machineCodeOffset = machineCodeOffset;
+        osrEntry.append(entry);
+        return &osrEntry.last();
+    }
+    
+    OSREntryData* osrEntryDataForBytecodeIndex(unsigned bytecodeIndex)
+    {
+        return tryBinarySearch<OSREntryData, unsigned>(
+            osrEntry, osrEntry.size(), bytecodeIndex,
+            getOSREntryDataBytecodeIndex);
+    }
+    
+    unsigned appendOSRExit(const OSRExit& exit)
+    {
+        unsigned result = osrExit.size();
+        osrExit.append(exit);
+        return result;
+    }
+    
+    OSRExit& lastOSRExit()
+    {
+        return osrExit.last();
+    }
+    
+    unsigned appendSpeculationRecovery(const SpeculationRecovery& recovery)
+    {
+        unsigned result = speculationRecovery.size();
+        speculationRecovery.append(recovery);
+        return result;
+    }
+    
+    void reconstruct(
+        CodeBlock*, CodeOrigin, unsigned streamIndex, Operands<ValueRecovery>& result);
+    
+    // This is only applicable if we're at a point where all values are spilled to the
+    // stack. Currently, it also has the restriction that the values must be in their
+    // bytecode-designated stack slots.
+    void reconstruct(
+        ExecState*, CodeBlock*, CodeOrigin, unsigned streamIndex, Operands<JSValue>& result);
+
+#if ENABLE(FTL_JIT)
+    // NB. All of these methods take CodeBlock* because they may want to use
+    // CodeBlock's logic about scaling thresholds. It should be a DFG CodeBlock.
+    
+    bool checkIfOptimizationThresholdReached(CodeBlock*);
+    void optimizeNextInvocation(CodeBlock*);
+    void dontOptimizeAnytimeSoon(CodeBlock*);
+    void optimizeAfterWarmUp(CodeBlock*);
+    void optimizeSoon(CodeBlock*);
+    void forceOptimizationSlowPathConcurrently(CodeBlock*);
+    void setOptimizationThresholdBasedOnCompilationResult(CodeBlock*, CompilationResult);
+#endif // ENABLE(FTL_JIT)
+    
+    void validateReferences(const TrackedReferences&) override;
+    
+    void shrinkToFit();
+
+    RegisterSet liveRegistersToPreserveAtExceptionHandlingCallSite(CodeBlock*, CallSiteIndex) override;
+#if ENABLE(FTL_JIT)
+    CodeBlock* osrEntryBlock() { return m_osrEntryBlock.get(); }
+    void setOSREntryBlock(VM& vm, const JSCell* owner, CodeBlock* osrEntryBlock) { m_osrEntryBlock.set(vm, owner, osrEntryBlock); }
+    void clearOSREntryBlock() { m_osrEntryBlock.clear(); }
+#endif
+
+    static ptrdiff_t commonDataOffset() { return OBJECT_OFFSETOF(JITCode, common); }
+
+    std::optional<CodeOrigin> findPC(CodeBlock*, void* pc) override;
+    
+private:
+    friend class JITCompiler; // Allow JITCompiler to call setCodeRef().
+
+public:
+    CommonData common;
+    Vector<DFG::OSREntryData> osrEntry;
+    SegmentedVector<DFG::OSRExit, 8> osrExit;
+    Vector<DFG::SpeculationRecovery> speculationRecovery;
+    DFG::VariableEventStream variableEventStream;
+    DFG::MinifiedGraph minifiedDFG;
+#if ENABLE(FTL_JIT)
+    uint8_t neverExecutedEntry { 1 };
+
+    UpperTierExecutionCounter tierUpCounter;
+
+    // For osrEntryPoint that are in inner loop, this maps their bytecode to the bytecode
+    // of the outerloop entry points in order (from innermost to outermost).
+    //
+    // The key may not always be a target for OSR Entry but the list in the value is guaranteed
+    // to be usable for OSR Entry.
+    HashMap<unsigned, Vector<unsigned>> tierUpInLoopHierarchy;
+
+    // Map each bytecode of CheckTierUpAndOSREnter to its stream index.
+    HashMap<unsigned, unsigned, WTF::IntHash<unsigned>, WTF::UnsignedWithZeroKeyHashTraits<unsigned>> bytecodeIndexToStreamIndex;
+
+    enum class TriggerReason : uint8_t {
+        DontTrigger,
+        CompilationDone,
+        StartCompilation,
+    };
+
+    // Map each bytecode of CheckTierUpAndOSREnter to its trigger forcing OSR Entry.
+    // This can never be modified after it has been initialized since the addresses of the triggers
+    // are used by the JIT.
+    HashMap<unsigned, TriggerReason> tierUpEntryTriggers;
+
+    // Set of bytecode that were the target of a TierUp operation.
+    HashSet<unsigned, WTF::IntHash<unsigned>, WTF::UnsignedWithZeroKeyHashTraits<unsigned>> tierUpEntrySeen;
+
+    WriteBarrier<CodeBlock> m_osrEntryBlock;
+    unsigned osrEntryRetry;
+    bool abandonOSREntry;
+#endif // ENABLE(FTL_JIT)
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGJITCompiler.cpp b/dfg/DFGJITCompiler.cpp
new file mode 100644
index 0000000..863d84a
--- /dev/null
+++ b/dfg/DFGJITCompiler.cpp
@@ -0,0 +1,662 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGJITCompiler.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGFailedFinalizer.h"
+#include "DFGInlineCacheWrapperInlines.h"
+#include "DFGJITCode.h"
+#include "DFGJITFinalizer.h"
+#include "DFGOSRExitCompiler.h"
+#include "DFGOperations.h"
+#include "DFGRegisterBank.h"
+#include "DFGSlowPathGenerator.h"
+#include "DFGSpeculativeJIT.h"
+#include "DFGThunks.h"
+#include "JSCInlines.h"
+#include "JSCJSValueInlines.h"
+#include "LinkBuffer.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "StructureStubInfo.h"
+#include "VM.h"
+
+namespace JSC { namespace DFG {
+
+JITCompiler::JITCompiler(Graph& dfg)
+    : CCallHelpers(&dfg.m_vm, dfg.m_codeBlock)
+    , m_graph(dfg)
+    , m_jitCode(adoptRef(new JITCode()))
+    , m_blockHeads(dfg.numBlocks())
+    , m_pcToCodeOriginMapBuilder(dfg.m_vm)
+{
+    if (shouldDumpDisassembly() || m_graph.m_vm.m_perBytecodeProfiler)
+        m_disassembler = std::make_unique<Disassembler>(dfg);
+#if ENABLE(FTL_JIT)
+    m_jitCode->tierUpInLoopHierarchy = WTFMove(m_graph.m_plan.tierUpInLoopHierarchy);
+    for (unsigned tierUpBytecode : m_graph.m_plan.tierUpAndOSREnterBytecodes)
+        m_jitCode->tierUpEntryTriggers.add(tierUpBytecode, JITCode::TriggerReason::DontTrigger);
+#endif
+}
+
+JITCompiler::~JITCompiler()
+{
+}
+
+void JITCompiler::linkOSRExits()
+{
+    ASSERT(m_jitCode->osrExit.size() == m_exitCompilationInfo.size());
+    if (m_graph.compilation()) {
+        for (unsigned i = 0; i < m_jitCode->osrExit.size(); ++i) {
+            OSRExitCompilationInfo& info = m_exitCompilationInfo[i];
+            Vector<Label> labels;
+            if (!info.m_failureJumps.empty()) {
+                for (unsigned j = 0; j < info.m_failureJumps.jumps().size(); ++j)
+                    labels.append(info.m_failureJumps.jumps()[j].label());
+            } else
+                labels.append(info.m_replacementSource);
+            m_exitSiteLabels.append(labels);
+        }
+    }
+    
+    for (unsigned i = 0; i < m_jitCode->osrExit.size(); ++i) {
+        OSRExit& exit = m_jitCode->osrExit[i];
+        OSRExitCompilationInfo& info = m_exitCompilationInfo[i];
+        JumpList& failureJumps = info.m_failureJumps;
+        if (!failureJumps.empty())
+            failureJumps.link(this);
+        else
+            info.m_replacementDestination = label();
+
+        jitAssertHasValidCallFrame();
+        store32(TrustedImm32(i), &vm()->osrExitIndex);
+        exit.setPatchableCodeOffset(patchableJump());
+    }
+}
+
+void JITCompiler::compileEntry()
+{
+    // This code currently matches the old JIT. In the function header we need to
+    // save return address and call frame via the prologue and perform a fast stack check.
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56292
+    // We'll need to convert the remaining cti_ style calls (specifically the stack
+    // check) which will be dependent on stack layout. (We'd need to account for this in
+    // both normal return code and when jumping to an exception handler).
+    emitFunctionPrologue();
+    emitPutToCallFrameHeader(m_codeBlock, CallFrameSlot::codeBlock);
+}
+
+void JITCompiler::compileSetupRegistersForEntry()
+{
+    emitSaveCalleeSaves();
+    emitMaterializeTagCheckRegisters();    
+}
+
+void JITCompiler::compileEntryExecutionFlag()
+{
+#if ENABLE(FTL_JIT)
+    if (m_graph.m_plan.canTierUpAndOSREnter())
+        store8(TrustedImm32(0), &m_jitCode->neverExecutedEntry);
+#endif // ENABLE(FTL_JIT)
+}
+
+void JITCompiler::compileBody()
+{
+    // We generate the speculative code path, followed by OSR exit code to return
+    // to the old JIT code if speculations fail.
+
+    bool compiledSpeculative = m_speculative->compile();
+    ASSERT_UNUSED(compiledSpeculative, compiledSpeculative);
+}
+
+void JITCompiler::compileExceptionHandlers()
+{
+    if (!m_exceptionChecksWithCallFrameRollback.empty()) {
+        m_exceptionChecksWithCallFrameRollback.link(this);
+
+        copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+
+        // lookupExceptionHandlerFromCallerFrame is passed two arguments, the VM and the exec (the CallFrame*).
+        move(TrustedImmPtr(vm()), GPRInfo::argumentGPR0);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+        addPtr(TrustedImm32(m_graph.stackPointerOffset() * sizeof(Register)), GPRInfo::callFrameRegister, stackPointerRegister);
+
+#if CPU(X86)
+        // FIXME: should use the call abstraction, but this is currently in the SpeculativeJIT layer!
+        poke(GPRInfo::argumentGPR0);
+        poke(GPRInfo::argumentGPR1, 1);
+#endif
+        m_calls.append(CallLinkRecord(call(), lookupExceptionHandlerFromCallerFrame));
+
+        jumpToExceptionHandler();
+    }
+
+    if (!m_exceptionChecks.empty()) {
+        m_exceptionChecks.link(this);
+
+        copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+
+        // lookupExceptionHandler is passed two arguments, the VM and the exec (the CallFrame*).
+        move(TrustedImmPtr(vm()), GPRInfo::argumentGPR0);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+
+#if CPU(X86)
+        // FIXME: should use the call abstraction, but this is currently in the SpeculativeJIT layer!
+        poke(GPRInfo::argumentGPR0);
+        poke(GPRInfo::argumentGPR1, 1);
+#endif
+        m_calls.append(CallLinkRecord(call(), lookupExceptionHandler));
+
+        jumpToExceptionHandler();
+    }
+}
+
+void JITCompiler::link(LinkBuffer& linkBuffer)
+{
+    // Link the code, populate data in CodeBlock data structures.
+    m_jitCode->common.frameRegisterCount = m_graph.frameRegisterCount();
+    m_jitCode->common.requiredRegisterCountForExit = m_graph.requiredRegisterCountForExit();
+
+    if (!m_graph.m_plan.inlineCallFrames->isEmpty())
+        m_jitCode->common.inlineCallFrames = m_graph.m_plan.inlineCallFrames;
+    
+#if USE(JSVALUE32_64)
+    m_jitCode->common.doubleConstants = WTFMove(m_graph.m_doubleConstants);
+#endif
+    
+    m_graph.registerFrozenValues();
+
+    BitVector usedJumpTables;
+    for (Bag<SwitchData>::iterator iter = m_graph.m_switchData.begin(); !!iter; ++iter) {
+        SwitchData& data = **iter;
+        if (!data.didUseJumpTable)
+            continue;
+        
+        if (data.kind == SwitchString)
+            continue;
+        
+        RELEASE_ASSERT(data.kind == SwitchImm || data.kind == SwitchChar);
+        
+        usedJumpTables.set(data.switchTableIndex);
+        SimpleJumpTable& table = m_codeBlock->switchJumpTable(data.switchTableIndex);
+        table.ctiDefault = linkBuffer.locationOf(m_blockHeads[data.fallThrough.block->index]);
+        table.ctiOffsets.grow(table.branchOffsets.size());
+        for (unsigned j = table.ctiOffsets.size(); j--;)
+            table.ctiOffsets[j] = table.ctiDefault;
+        for (unsigned j = data.cases.size(); j--;) {
+            SwitchCase& myCase = data.cases[j];
+            table.ctiOffsets[myCase.value.switchLookupValue(data.kind) - table.min] =
+                linkBuffer.locationOf(m_blockHeads[myCase.target.block->index]);
+        }
+    }
+    
+    for (unsigned i = m_codeBlock->numberOfSwitchJumpTables(); i--;) {
+        if (usedJumpTables.get(i))
+            continue;
+        
+        m_codeBlock->switchJumpTable(i).clear();
+    }
+
+    // NOTE: we cannot clear string switch tables because (1) we're running concurrently
+    // and we cannot deref StringImpl's and (2) it would be weird to deref those
+    // StringImpl's since we refer to them.
+    for (Bag<SwitchData>::iterator switchDataIter = m_graph.m_switchData.begin(); !!switchDataIter; ++switchDataIter) {
+        SwitchData& data = **switchDataIter;
+        if (!data.didUseJumpTable)
+            continue;
+        
+        if (data.kind != SwitchString)
+            continue;
+        
+        StringJumpTable& table = m_codeBlock->stringSwitchJumpTable(data.switchTableIndex);
+        table.ctiDefault = linkBuffer.locationOf(m_blockHeads[data.fallThrough.block->index]);
+        StringJumpTable::StringOffsetTable::iterator iter;
+        StringJumpTable::StringOffsetTable::iterator end = table.offsetTable.end();
+        for (iter = table.offsetTable.begin(); iter != end; ++iter)
+            iter->value.ctiOffset = table.ctiDefault;
+        for (unsigned j = data.cases.size(); j--;) {
+            SwitchCase& myCase = data.cases[j];
+            iter = table.offsetTable.find(myCase.value.stringImpl());
+            RELEASE_ASSERT(iter != end);
+            iter->value.ctiOffset = linkBuffer.locationOf(m_blockHeads[myCase.target.block->index]);
+        }
+    }
+
+    // Link all calls out from the JIT code to their respective functions.
+    for (unsigned i = 0; i < m_calls.size(); ++i)
+        linkBuffer.link(m_calls[i].m_call, m_calls[i].m_function);
+
+    for (unsigned i = m_getByIds.size(); i--;)
+        m_getByIds[i].finalize(linkBuffer);
+    for (unsigned i = m_putByIds.size(); i--;)
+        m_putByIds[i].finalize(linkBuffer);
+
+    for (unsigned i = 0; i < m_ins.size(); ++i) {
+        StructureStubInfo& info = *m_ins[i].m_stubInfo;
+
+        CodeLocationLabel start = linkBuffer.locationOf(m_ins[i].m_jump);
+        info.patch.start = start;
+
+        ptrdiff_t inlineSize = MacroAssembler::differenceBetweenCodePtr(
+            start, linkBuffer.locationOf(m_ins[i].m_done));
+        RELEASE_ASSERT(inlineSize >= 0);
+        info.patch.inlineSize = inlineSize;
+
+        info.patch.deltaFromStartToSlowPathCallLocation = MacroAssembler::differenceBetweenCodePtr(
+            start, linkBuffer.locationOf(m_ins[i].m_slowPathGenerator->call()));
+
+        info.patch.deltaFromStartToSlowPathStart = MacroAssembler::differenceBetweenCodePtr(
+            start, linkBuffer.locationOf(m_ins[i].m_slowPathGenerator->label()));
+    }
+    
+    for (unsigned i = 0; i < m_jsCalls.size(); ++i) {
+        JSCallRecord& record = m_jsCalls[i];
+        CallLinkInfo& info = *record.info;
+        linkBuffer.link(record.slowCall, FunctionPtr(m_vm->getCTIStub(linkCallThunkGenerator).code().executableAddress()));
+        info.setCallLocations(
+            CodeLocationLabel(linkBuffer.locationOfNearCall(record.slowCall)),
+            CodeLocationLabel(linkBuffer.locationOf(record.targetToCheck)),
+            linkBuffer.locationOfNearCall(record.fastCall));
+    }
+    
+    for (JSDirectCallRecord& record : m_jsDirectCalls) {
+        CallLinkInfo& info = *record.info;
+        linkBuffer.link(record.call, linkBuffer.locationOf(record.slowPath));
+        info.setCallLocations(
+            CodeLocationLabel(),
+            linkBuffer.locationOf(record.slowPath),
+            linkBuffer.locationOfNearCall(record.call));
+    }
+    
+    for (JSDirectTailCallRecord& record : m_jsDirectTailCalls) {
+        CallLinkInfo& info = *record.info;
+        info.setCallLocations(
+            linkBuffer.locationOf(record.patchableJump),
+            linkBuffer.locationOf(record.slowPath),
+            linkBuffer.locationOfNearCall(record.call));
+    }
+    
+    MacroAssemblerCodeRef osrExitThunk = vm()->getCTIStub(osrExitGenerationThunkGenerator);
+    CodeLocationLabel target = CodeLocationLabel(osrExitThunk.code());
+    for (unsigned i = 0; i < m_jitCode->osrExit.size(); ++i) {
+        OSRExit& exit = m_jitCode->osrExit[i];
+        OSRExitCompilationInfo& info = m_exitCompilationInfo[i];
+        linkBuffer.link(exit.getPatchableCodeOffsetAsJump(), target);
+        exit.correctJump(linkBuffer);
+        if (info.m_replacementSource.isSet()) {
+            m_jitCode->common.jumpReplacements.append(JumpReplacement(
+                linkBuffer.locationOf(info.m_replacementSource),
+                linkBuffer.locationOf(info.m_replacementDestination)));
+        }
+    }
+    
+    if (m_graph.compilation()) {
+        ASSERT(m_exitSiteLabels.size() == m_jitCode->osrExit.size());
+        for (unsigned i = 0; i < m_exitSiteLabels.size(); ++i) {
+            Vector<Label>& labels = m_exitSiteLabels[i];
+            Vector<const void*> addresses;
+            for (unsigned j = 0; j < labels.size(); ++j)
+                addresses.append(linkBuffer.locationOf(labels[j]).executableAddress());
+            m_graph.compilation()->addOSRExitSite(addresses);
+        }
+    } else
+        ASSERT(!m_exitSiteLabels.size());
+
+    m_jitCode->common.compilation = m_graph.compilation();
+    
+    // Link new DFG exception handlers and remove baseline JIT handlers.
+    m_codeBlock->clearExceptionHandlers();
+    for (unsigned  i = 0; i < m_exceptionHandlerOSRExitCallSites.size(); i++) {
+        OSRExitCompilationInfo& info = m_exceptionHandlerOSRExitCallSites[i].exitInfo;
+        if (info.m_replacementDestination.isSet()) {
+            // If this is is *not* set, it means that we already jumped to the OSR exit in pure generated control flow.
+            // i.e, we explicitly emitted an exceptionCheck that we know will be caught in this machine frame.
+            // If this *is set*, it means we will be landing at this code location from genericUnwind from an
+            // exception thrown in a child call frame.
+            CodeLocationLabel catchLabel = linkBuffer.locationOf(info.m_replacementDestination);
+            HandlerInfo newExceptionHandler = m_exceptionHandlerOSRExitCallSites[i].baselineExceptionHandler;
+            CallSiteIndex callSite = m_exceptionHandlerOSRExitCallSites[i].callSiteIndex;
+            newExceptionHandler.start = callSite.bits();
+            newExceptionHandler.end = callSite.bits() + 1;
+            newExceptionHandler.nativeCode = catchLabel;
+            m_codeBlock->appendExceptionHandler(newExceptionHandler);
+        }
+    }
+
+    if (m_pcToCodeOriginMapBuilder.didBuildMapping())
+        m_codeBlock->setPCToCodeOriginMap(std::make_unique<PCToCodeOriginMap>(WTFMove(m_pcToCodeOriginMapBuilder), linkBuffer));
+}
+
+void JITCompiler::compile()
+{
+    setStartOfCode();
+    compileEntry();
+    m_speculative = std::make_unique<SpeculativeJIT>(*this);
+
+    // Plant a check that sufficient space is available in the JSStack.
+    addPtr(TrustedImm32(virtualRegisterForLocal(m_graph.requiredRegisterCountForExecutionAndExit() - 1).offset() * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::regT1);
+    Jump stackOverflow = branchPtr(Above, AbsoluteAddress(m_vm->addressOfSoftStackLimit()), GPRInfo::regT1);
+
+    addPtr(TrustedImm32(m_graph.stackPointerOffset() * sizeof(Register)), GPRInfo::callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+    compileSetupRegistersForEntry();
+    compileEntryExecutionFlag();
+    compileBody();
+    setEndOfMainPath();
+
+    // === Footer code generation ===
+    //
+    // Generate the stack overflow handling; if the stack check in the entry head fails,
+    // we need to call out to a helper function to throw the StackOverflowError.
+    stackOverflow.link(this);
+
+    emitStoreCodeOrigin(CodeOrigin(0));
+
+    if (maxFrameExtentForSlowPathCall)
+        addPtr(TrustedImm32(-maxFrameExtentForSlowPathCall), stackPointerRegister);
+
+    m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, m_codeBlock);
+
+    // Generate slow path code.
+    m_speculative->runSlowPathGenerators(m_pcToCodeOriginMapBuilder);
+    m_pcToCodeOriginMapBuilder.appendItem(labelIgnoringWatchpoints(), PCToCodeOriginMapBuilder::defaultCodeOrigin());
+    
+    compileExceptionHandlers();
+    linkOSRExits();
+    
+    // Create OSR entry trampolines if necessary.
+    m_speculative->createOSREntries();
+    setEndOfCode();
+
+    auto linkBuffer = std::make_unique<LinkBuffer>(*m_vm, *this, m_codeBlock, JITCompilationCanFail);
+    if (linkBuffer->didFailToAllocate()) {
+        m_graph.m_plan.finalizer = std::make_unique<FailedFinalizer>(m_graph.m_plan);
+        return;
+    }
+    
+    link(*linkBuffer);
+    m_speculative->linkOSREntries(*linkBuffer);
+
+    m_jitCode->shrinkToFit();
+    codeBlock()->shrinkToFit(CodeBlock::LateShrink);
+
+    disassemble(*linkBuffer);
+    
+    m_graph.m_plan.finalizer = std::make_unique<JITFinalizer>(
+        m_graph.m_plan, WTFMove(m_jitCode), WTFMove(linkBuffer));
+}
+
+void JITCompiler::compileFunction()
+{
+    setStartOfCode();
+    compileEntry();
+
+    // === Function header code generation ===
+    // This is the main entry point, without performing an arity check.
+    // If we needed to perform an arity check we will already have moved the return address,
+    // so enter after this.
+    Label fromArityCheck(this);
+    // Plant a check that sufficient space is available in the JSStack.
+    addPtr(TrustedImm32(virtualRegisterForLocal(m_graph.requiredRegisterCountForExecutionAndExit() - 1).offset() * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::regT1);
+    Jump stackOverflow = branchPtr(Above, AbsoluteAddress(m_vm->addressOfSoftStackLimit()), GPRInfo::regT1);
+
+    // Move the stack pointer down to accommodate locals
+    addPtr(TrustedImm32(m_graph.stackPointerOffset() * sizeof(Register)), GPRInfo::callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    compileSetupRegistersForEntry();
+    compileEntryExecutionFlag();
+
+    // === Function body code generation ===
+    m_speculative = std::make_unique<SpeculativeJIT>(*this);
+    compileBody();
+    setEndOfMainPath();
+
+    // === Function footer code generation ===
+    //
+    // Generate code to perform the stack overflow handling (if the stack check in
+    // the function header fails), and generate the entry point with arity check.
+    //
+    // Generate the stack overflow handling; if the stack check in the function head fails,
+    // we need to call out to a helper function to throw the StackOverflowError.
+    stackOverflow.link(this);
+
+    emitStoreCodeOrigin(CodeOrigin(0));
+
+    if (maxFrameExtentForSlowPathCall)
+        addPtr(TrustedImm32(-maxFrameExtentForSlowPathCall), stackPointerRegister);
+
+    m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, m_codeBlock);
+    
+    // The fast entry point into a function does not check the correct number of arguments
+    // have been passed to the call (we only use the fast entry point where we can statically
+    // determine the correct number of arguments have been passed, or have already checked).
+    // In cases where an arity check is necessary, we enter here.
+    // FIXME: change this from a cti call to a DFG style operation (normal C calling conventions).
+    m_arityCheck = label();
+    compileEntry();
+
+    load32(AssemblyHelpers::payloadFor((VirtualRegister)CallFrameSlot::argumentCount), GPRInfo::regT1);
+    branch32(AboveOrEqual, GPRInfo::regT1, TrustedImm32(m_codeBlock->numParameters())).linkTo(fromArityCheck, this);
+    emitStoreCodeOrigin(CodeOrigin(0));
+    if (maxFrameExtentForSlowPathCall)
+        addPtr(TrustedImm32(-maxFrameExtentForSlowPathCall), stackPointerRegister);
+    m_speculative->callOperationWithCallFrameRollbackOnException(m_codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck, GPRInfo::regT0);
+    if (maxFrameExtentForSlowPathCall)
+        addPtr(TrustedImm32(maxFrameExtentForSlowPathCall), stackPointerRegister);
+    branchTest32(Zero, GPRInfo::returnValueGPR).linkTo(fromArityCheck, this);
+    emitStoreCodeOrigin(CodeOrigin(0));
+    move(GPRInfo::returnValueGPR, GPRInfo::argumentGPR0);
+    m_callArityFixup = call();
+    jump(fromArityCheck);
+    
+    // Generate slow path code.
+    m_speculative->runSlowPathGenerators(m_pcToCodeOriginMapBuilder);
+    m_pcToCodeOriginMapBuilder.appendItem(labelIgnoringWatchpoints(), PCToCodeOriginMapBuilder::defaultCodeOrigin());
+    
+    compileExceptionHandlers();
+    linkOSRExits();
+    
+    // Create OSR entry trampolines if necessary.
+    m_speculative->createOSREntries();
+    setEndOfCode();
+
+    // === Link ===
+    auto linkBuffer = std::make_unique<LinkBuffer>(*m_vm, *this, m_codeBlock, JITCompilationCanFail);
+    if (linkBuffer->didFailToAllocate()) {
+        m_graph.m_plan.finalizer = std::make_unique<FailedFinalizer>(m_graph.m_plan);
+        return;
+    }
+    link(*linkBuffer);
+    m_speculative->linkOSREntries(*linkBuffer);
+    
+    m_jitCode->shrinkToFit();
+    codeBlock()->shrinkToFit(CodeBlock::LateShrink);
+    
+    linkBuffer->link(m_callArityFixup, FunctionPtr((m_vm->getCTIStub(arityFixupGenerator)).code().executableAddress()));
+    
+    disassemble(*linkBuffer);
+
+    MacroAssemblerCodePtr withArityCheck = linkBuffer->locationOf(m_arityCheck);
+
+    m_graph.m_plan.finalizer = std::make_unique<JITFinalizer>(
+        m_graph.m_plan, WTFMove(m_jitCode), WTFMove(linkBuffer), withArityCheck);
+}
+
+void JITCompiler::disassemble(LinkBuffer& linkBuffer)
+{
+    if (shouldDumpDisassembly()) {
+        m_disassembler->dump(linkBuffer);
+        linkBuffer.didAlreadyDisassemble();
+    }
+    
+    if (m_graph.m_plan.compilation)
+        m_disassembler->reportToProfiler(m_graph.m_plan.compilation.get(), linkBuffer);
+}
+
+#if USE(JSVALUE32_64)
+void* JITCompiler::addressOfDoubleConstant(Node* node)
+{
+    double value = node->asNumber();
+    int64_t valueBits = bitwise_cast<int64_t>(value);
+    auto it = m_graph.m_doubleConstantsMap.find(valueBits);
+    if (it != m_graph.m_doubleConstantsMap.end())
+        return it->second;
+
+    if (!m_graph.m_doubleConstants)
+        m_graph.m_doubleConstants = std::make_unique<Bag<double>>();
+
+    double* addressInConstantPool = m_graph.m_doubleConstants->add();
+    *addressInConstantPool = value;
+    m_graph.m_doubleConstantsMap[valueBits] = addressInConstantPool;
+    return addressInConstantPool;
+}
+#endif
+
+void JITCompiler::noticeOSREntry(BasicBlock& basicBlock, JITCompiler::Label blockHead, LinkBuffer& linkBuffer)
+{
+    // OSR entry is not allowed into blocks deemed unreachable by control flow analysis.
+    if (!basicBlock.intersectionOfCFAHasVisited)
+        return;
+        
+    OSREntryData* entry = m_jitCode->appendOSREntryData(basicBlock.bytecodeBegin, linkBuffer.offsetOf(blockHead));
+    
+    entry->m_expectedValues = basicBlock.intersectionOfPastValuesAtHead;
+        
+    // Fix the expected values: in our protocol, a dead variable will have an expected
+    // value of (None, []). But the old JIT may stash some values there. So we really
+    // need (Top, TOP).
+    for (size_t argument = 0; argument < basicBlock.variablesAtHead.numberOfArguments(); ++argument) {
+        Node* node = basicBlock.variablesAtHead.argument(argument);
+        if (!node || !node->shouldGenerate())
+            entry->m_expectedValues.argument(argument).makeHeapTop();
+    }
+    for (size_t local = 0; local < basicBlock.variablesAtHead.numberOfLocals(); ++local) {
+        Node* node = basicBlock.variablesAtHead.local(local);
+        if (!node || !node->shouldGenerate())
+            entry->m_expectedValues.local(local).makeHeapTop();
+        else {
+            VariableAccessData* variable = node->variableAccessData();
+            entry->m_machineStackUsed.set(variable->machineLocal().toLocal());
+                
+            switch (variable->flushFormat()) {
+            case FlushedDouble:
+                entry->m_localsForcedDouble.set(local);
+                break;
+            case FlushedInt52:
+                entry->m_localsForcedAnyInt.set(local);
+                break;
+            default:
+                break;
+            }
+            
+            if (variable->local() != variable->machineLocal()) {
+                entry->m_reshufflings.append(
+                    OSREntryReshuffling(
+                        variable->local().offset(), variable->machineLocal().offset()));
+            }
+        }
+    }
+        
+    entry->m_reshufflings.shrinkToFit();
+}
+
+void JITCompiler::appendExceptionHandlingOSRExit(ExitKind kind, unsigned eventStreamIndex, CodeOrigin opCatchOrigin, HandlerInfo* exceptionHandler, CallSiteIndex callSite, MacroAssembler::JumpList jumpsToFail)
+{
+    OSRExit exit(kind, JSValueRegs(), MethodOfGettingAValueProfile(), m_speculative.get(), eventStreamIndex);
+    exit.m_codeOrigin = opCatchOrigin;
+    exit.m_exceptionHandlerCallSiteIndex = callSite;
+    OSRExitCompilationInfo& exitInfo = appendExitInfo(jumpsToFail);
+    jitCode()->appendOSRExit(exit);
+    m_exceptionHandlerOSRExitCallSites.append(ExceptionHandlingOSRExitInfo { exitInfo, *exceptionHandler, callSite });
+}
+
+void JITCompiler::exceptionCheck()
+{
+    // It's important that we use origin.forExit here. Consider if we hoist string
+    // addition outside a loop, and that we exit at the point of that concatenation
+    // from an out of memory exception.
+    // If the original loop had a try/catch around string concatenation, if we "catch"
+    // that exception inside the loop, then the loops induction variable will be undefined 
+    // in the OSR exit value recovery. It's more defensible for the string concatenation, 
+    // then, to not be caught by the for loops' try/catch.
+    // Here is the program I'm speaking about:
+    //
+    // >>>> lets presume "c = a + b" gets hoisted here.
+    // for (var i = 0; i < length; i++) {
+    //     try {
+    //         c = a + b
+    //     } catch(e) { 
+    //         If we threw an out of memory error, and we cought the exception
+    //         right here, then "i" would almost certainly be undefined, which
+    //         would make no sense.
+    //         ... 
+    //     }
+    // }
+    CodeOrigin opCatchOrigin;
+    HandlerInfo* exceptionHandler;
+    bool willCatchException = m_graph.willCatchExceptionInMachineFrame(m_speculative->m_currentNode->origin.forExit, opCatchOrigin, exceptionHandler); 
+    if (willCatchException) {
+        unsigned streamIndex = m_speculative->m_outOfLineStreamIndex ? *m_speculative->m_outOfLineStreamIndex : m_speculative->m_stream->size();
+        MacroAssembler::Jump hadException = emitNonPatchableExceptionCheck();
+        // We assume here that this is called after callOpeartion()/appendCall() is called.
+        appendExceptionHandlingOSRExit(ExceptionCheck, streamIndex, opCatchOrigin, exceptionHandler, m_jitCode->common.lastCallSite(), hadException);
+    } else
+        m_exceptionChecks.append(emitExceptionCheck());
+}
+
+CallSiteIndex JITCompiler::recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(const CodeOrigin& callSiteCodeOrigin, unsigned eventStreamIndex)
+{
+    CodeOrigin opCatchOrigin;
+    HandlerInfo* exceptionHandler;
+    bool willCatchException = m_graph.willCatchExceptionInMachineFrame(callSiteCodeOrigin, opCatchOrigin, exceptionHandler);
+    CallSiteIndex callSite = addCallSite(callSiteCodeOrigin);
+    if (willCatchException)
+        appendExceptionHandlingOSRExit(GenericUnwind, eventStreamIndex, opCatchOrigin, exceptionHandler, callSite);
+    return callSite;
+}
+
+void JITCompiler::setEndOfMainPath()
+{
+    m_pcToCodeOriginMapBuilder.appendItem(labelIgnoringWatchpoints(), m_speculative->m_origin.semantic);
+    if (LIKELY(!m_disassembler))
+        return;
+    m_disassembler->setEndOfMainPath(labelIgnoringWatchpoints());
+}
+
+void JITCompiler::setEndOfCode()
+{
+    m_pcToCodeOriginMapBuilder.appendItem(labelIgnoringWatchpoints(), PCToCodeOriginMapBuilder::defaultCodeOrigin());
+    if (LIKELY(!m_disassembler))
+        return;
+    m_disassembler->setEndOfCode(labelIgnoringWatchpoints());
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGJITCompiler.h b/dfg/DFGJITCompiler.h
new file mode 100644
index 0000000..d868012
--- /dev/null
+++ b/dfg/DFGJITCompiler.h
@@ -0,0 +1,365 @@
+/*
+ * Copyright (C) 2011, 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CCallHelpers.h"
+#include "CodeBlock.h"
+#include "DFGDisassembler.h"
+#include "DFGGraph.h"
+#include "DFGInlineCacheWrapper.h"
+#include "DFGJITCode.h"
+#include "DFGOSRExitCompilationInfo.h"
+#include "DFGRegisterBank.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "HandlerInfo.h"
+#include "JITCode.h"
+#include "JITInlineCacheGenerator.h"
+#include "LinkBuffer.h"
+#include "MacroAssembler.h"
+#include "PCToCodeOriginMap.h"
+#include "TempRegisterSet.h"
+
+namespace JSC {
+
+class AbstractSamplingCounter;
+class CodeBlock;
+class VM;
+
+namespace DFG {
+
+class JITCodeGenerator;
+class NodeToRegisterMap;
+class OSRExitJumpPlaceholder;
+class SlowPathGenerator;
+class SpeculativeJIT;
+class SpeculationRecovery;
+
+struct EntryLocation;
+struct OSRExit;
+
+// === CallLinkRecord ===
+//
+// A record of a call out from JIT code that needs linking to a helper function.
+// Every CallLinkRecord contains a reference to the call instruction & the function
+// that it needs to be linked to.
+struct CallLinkRecord {
+    CallLinkRecord(MacroAssembler::Call call, FunctionPtr function)
+        : m_call(call)
+        , m_function(function)
+    {
+    }
+
+    MacroAssembler::Call m_call;
+    FunctionPtr m_function;
+};
+
+struct InRecord {
+    InRecord(
+        MacroAssembler::PatchableJump jump, MacroAssembler::Label done,
+        SlowPathGenerator* slowPathGenerator, StructureStubInfo* stubInfo)
+        : m_jump(jump)
+        , m_done(done)
+        , m_slowPathGenerator(slowPathGenerator)
+        , m_stubInfo(stubInfo)
+    {
+    }
+    
+    MacroAssembler::PatchableJump m_jump;
+    MacroAssembler::Label m_done;
+    SlowPathGenerator* m_slowPathGenerator;
+    StructureStubInfo* m_stubInfo;
+};
+
+// === JITCompiler ===
+//
+// DFG::JITCompiler is responsible for generating JIT code from the dataflow graph.
+// It does so by delegating to the speculative & non-speculative JITs, which
+// generate to a MacroAssembler (which the JITCompiler owns through an inheritance
+// relationship). The JITCompiler holds references to information required during
+// compilation, and also records information used in linking (e.g. a list of all
+// call to be linked).
+class JITCompiler : public CCallHelpers {
+public:
+    JITCompiler(Graph& dfg);
+    ~JITCompiler();
+    
+    void compile();
+    void compileFunction();
+    
+    // Accessors for properties.
+    Graph& graph() { return m_graph; }
+    
+    // Methods to set labels for the disassembler.
+    void setStartOfCode()
+    {
+        m_pcToCodeOriginMapBuilder.appendItem(labelIgnoringWatchpoints(), CodeOrigin(0, nullptr));
+        if (LIKELY(!m_disassembler))
+            return;
+        m_disassembler->setStartOfCode(labelIgnoringWatchpoints());
+    }
+    
+    void setForBlockIndex(BlockIndex blockIndex)
+    {
+        if (LIKELY(!m_disassembler))
+            return;
+        m_disassembler->setForBlockIndex(blockIndex, labelIgnoringWatchpoints());
+    }
+    
+    void setForNode(Node* node)
+    {
+        if (LIKELY(!m_disassembler))
+            return;
+        m_disassembler->setForNode(node, labelIgnoringWatchpoints());
+    }
+    
+    void setEndOfMainPath();
+    void setEndOfCode();
+    
+    CallSiteIndex addCallSite(CodeOrigin codeOrigin)
+    {
+        return m_jitCode->common.addCodeOrigin(codeOrigin);
+    }
+
+    CallSiteIndex emitStoreCodeOrigin(CodeOrigin codeOrigin)
+    {
+        CallSiteIndex callSite = addCallSite(codeOrigin);
+        emitStoreCallSiteIndex(callSite);
+        return callSite;
+    }
+
+    void emitStoreCallSiteIndex(CallSiteIndex callSite)
+    {
+        store32(TrustedImm32(callSite.bits()), tagFor(static_cast<VirtualRegister>(CallFrameSlot::argumentCount)));
+    }
+
+    // Add a call out from JIT code, without an exception check.
+    Call appendCall(const FunctionPtr& function)
+    {
+        Call functionCall = call();
+        m_calls.append(CallLinkRecord(functionCall, function));
+        return functionCall;
+    }
+    
+    void exceptionCheck();
+
+    void exceptionCheckWithCallFrameRollback()
+    {
+        m_exceptionChecksWithCallFrameRollback.append(emitExceptionCheck());
+    }
+
+    // Add a call out from JIT code, with a fast exception check that tests if the return value is zero.
+    void fastExceptionCheck()
+    {
+        callExceptionFuzz();
+        m_exceptionChecks.append(branchTestPtr(Zero, GPRInfo::returnValueGPR));
+    }
+    
+    OSRExitCompilationInfo& appendExitInfo(MacroAssembler::JumpList jumpsToFail = MacroAssembler::JumpList())
+    {
+        OSRExitCompilationInfo info;
+        info.m_failureJumps = jumpsToFail;
+        m_exitCompilationInfo.append(info);
+        return m_exitCompilationInfo.last();
+    }
+
+#if USE(JSVALUE32_64)
+    void* addressOfDoubleConstant(Node*);
+#endif
+
+    void addGetById(const JITGetByIdGenerator& gen, SlowPathGenerator* slowPath)
+    {
+        m_getByIds.append(InlineCacheWrapper<JITGetByIdGenerator>(gen, slowPath));
+    }
+    
+    void addPutById(const JITPutByIdGenerator& gen, SlowPathGenerator* slowPath)
+    {
+        m_putByIds.append(InlineCacheWrapper<JITPutByIdGenerator>(gen, slowPath));
+    }
+
+    void addIn(const InRecord& record)
+    {
+        m_ins.append(record);
+    }
+    
+    void addJSCall(Call fastCall, Call slowCall, DataLabelPtr targetToCheck, CallLinkInfo* info)
+    {
+        m_jsCalls.append(JSCallRecord(fastCall, slowCall, targetToCheck, info));
+    }
+    
+    void addJSDirectCall(Call call, Label slowPath, CallLinkInfo* info)
+    {
+        m_jsDirectCalls.append(JSDirectCallRecord(call, slowPath, info));
+    }
+    
+    void addJSDirectTailCall(PatchableJump patchableJump, Call call, Label slowPath, CallLinkInfo* info)
+    {
+        m_jsDirectTailCalls.append(JSDirectTailCallRecord(patchableJump, call, slowPath, info));
+    }
+    
+    void addWeakReference(JSCell* target)
+    {
+        m_graph.m_plan.weakReferences.addLazily(target);
+    }
+    
+    void addWeakReferences(const StructureSet& structureSet)
+    {
+        for (unsigned i = structureSet.size(); i--;)
+            addWeakReference(structureSet[i]);
+    }
+    
+    template<typename T>
+    Jump branchWeakPtr(RelationalCondition cond, T left, JSCell* weakPtr)
+    {
+        Jump result = branchPtr(cond, left, TrustedImmPtr(weakPtr));
+        addWeakReference(weakPtr);
+        return result;
+    }
+
+    template<typename T>
+    Jump branchWeakStructure(RelationalCondition cond, T left, RegisteredStructure weakStructure)
+    {
+        Structure* structure = weakStructure.get();
+#if USE(JSVALUE64)
+        Jump result = branch32(cond, left, TrustedImm32(structure->id()));
+        return result;
+#else
+        return branchPtr(cond, left, TrustedImmPtr(structure));
+#endif
+    }
+
+    void noticeOSREntry(BasicBlock&, JITCompiler::Label blockHead, LinkBuffer&);
+    
+    RefPtr<JITCode> jitCode() { return m_jitCode; }
+    
+    Vector<Label>& blockHeads() { return m_blockHeads; }
+
+    CallSiteIndex recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(const CodeOrigin&, unsigned eventStreamIndex);
+
+    PCToCodeOriginMapBuilder& pcToCodeOriginMapBuilder() { return m_pcToCodeOriginMapBuilder; }
+
+private:
+    friend class OSRExitJumpPlaceholder;
+    
+    // Internal implementation to compile.
+    void compileEntry();
+    void compileSetupRegistersForEntry();
+    void compileEntryExecutionFlag();
+    void compileBody();
+    void link(LinkBuffer&);
+    
+    void exitSpeculativeWithOSR(const OSRExit&, SpeculationRecovery*);
+    void compileExceptionHandlers();
+    void linkOSRExits();
+    void disassemble(LinkBuffer&);
+
+    void appendExceptionHandlingOSRExit(ExitKind, unsigned eventStreamIndex, CodeOrigin, HandlerInfo* exceptionHandler, CallSiteIndex, MacroAssembler::JumpList jumpsToFail = MacroAssembler::JumpList());
+
+    // The dataflow graph currently being generated.
+    Graph& m_graph;
+
+    std::unique_ptr<Disassembler> m_disassembler;
+    
+    RefPtr<JITCode> m_jitCode;
+    
+    // Vector of calls out from JIT code, including exception handler information.
+    // Count of the number of CallRecords with exception handlers.
+    Vector<CallLinkRecord> m_calls;
+    JumpList m_exceptionChecks;
+    JumpList m_exceptionChecksWithCallFrameRollback;
+    
+    Vector<Label> m_blockHeads;
+
+    struct JSCallRecord {
+        JSCallRecord(Call fastCall, Call slowCall, DataLabelPtr targetToCheck, CallLinkInfo* info)
+            : fastCall(fastCall)
+            , slowCall(slowCall)
+            , targetToCheck(targetToCheck)
+            , info(info)
+        {
+        }
+        
+        Call fastCall;
+        Call slowCall;
+        DataLabelPtr targetToCheck;
+        CallLinkInfo* info;
+    };
+    
+    struct JSDirectCallRecord {
+        JSDirectCallRecord(Call call, Label slowPath, CallLinkInfo* info)
+            : call(call)
+            , slowPath(slowPath)
+            , info(info)
+        {
+        }
+        
+        Call call;
+        Label slowPath;
+        CallLinkInfo* info;
+    };
+    
+    struct JSDirectTailCallRecord {
+        JSDirectTailCallRecord(PatchableJump patchableJump, Call call, Label slowPath, CallLinkInfo* info)
+            : patchableJump(patchableJump)
+            , call(call)
+            , slowPath(slowPath)
+            , info(info)
+        {
+        }
+        
+        PatchableJump patchableJump;
+        Call call;
+        Label slowPath;
+        CallLinkInfo* info;
+    };
+    
+    Vector<InlineCacheWrapper<JITGetByIdGenerator>, 4> m_getByIds;
+    Vector<InlineCacheWrapper<JITPutByIdGenerator>, 4> m_putByIds;
+    Vector<InRecord, 4> m_ins;
+    Vector<JSCallRecord, 4> m_jsCalls;
+    Vector<JSDirectCallRecord, 4> m_jsDirectCalls;
+    Vector<JSDirectTailCallRecord, 4> m_jsDirectTailCalls;
+    SegmentedVector<OSRExitCompilationInfo, 4> m_exitCompilationInfo;
+    Vector<Vector<Label>> m_exitSiteLabels;
+    
+    struct ExceptionHandlingOSRExitInfo {
+        OSRExitCompilationInfo& exitInfo;
+        HandlerInfo baselineExceptionHandler;
+        CallSiteIndex callSiteIndex;
+    };
+    Vector<ExceptionHandlingOSRExitInfo> m_exceptionHandlerOSRExitCallSites;
+    
+    Call m_callArityFixup;
+    Label m_arityCheck;
+    std::unique_ptr<SpeculativeJIT> m_speculative;
+    PCToCodeOriginMapBuilder m_pcToCodeOriginMapBuilder;
+};
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGJITFinalizer.cpp b/dfg/DFGJITFinalizer.cpp
new file mode 100644
index 0000000..5391158
--- /dev/null
+++ b/dfg/DFGJITFinalizer.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGJITFinalizer.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "CodeBlockWithJITType.h"
+#include "DFGCommon.h"
+#include "DFGPlan.h"
+#include "JSCInlines.h"
+#include "ProfilerDatabase.h"
+
+namespace JSC { namespace DFG {
+
+JITFinalizer::JITFinalizer(Plan& plan, PassRefPtr<JITCode> jitCode, std::unique_ptr<LinkBuffer> linkBuffer, MacroAssemblerCodePtr withArityCheck)
+    : Finalizer(plan)
+    , m_jitCode(jitCode)
+    , m_linkBuffer(WTFMove(linkBuffer))
+    , m_withArityCheck(withArityCheck)
+{
+}
+
+JITFinalizer::~JITFinalizer()
+{
+}
+
+size_t JITFinalizer::codeSize()
+{
+    return m_linkBuffer->size();
+}
+
+bool JITFinalizer::finalize()
+{
+    m_jitCode->initializeCodeRef(
+        FINALIZE_DFG_CODE(*m_linkBuffer, ("DFG JIT code for %s", toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::DFGJIT)).data())),
+        MacroAssemblerCodePtr());
+    
+    m_plan.codeBlock->setJITCode(m_jitCode);
+    
+    finalizeCommon();
+    
+    return true;
+}
+
+bool JITFinalizer::finalizeFunction()
+{
+    RELEASE_ASSERT(!m_withArityCheck.isEmptyValue());
+    m_jitCode->initializeCodeRef(
+        FINALIZE_DFG_CODE(*m_linkBuffer, ("DFG JIT code for %s", toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::DFGJIT)).data())),
+        m_withArityCheck);
+    m_plan.codeBlock->setJITCode(m_jitCode);
+    
+    finalizeCommon();
+    
+    return true;
+}
+
+void JITFinalizer::finalizeCommon()
+{
+    // Some JIT finalizers may have added more constants. Shrink-to-fit those things now.
+    m_plan.codeBlock->constants().shrinkToFit();
+    m_plan.codeBlock->constantsSourceCodeRepresentation().shrinkToFit();
+    
+#if ENABLE(FTL_JIT)
+    m_jitCode->optimizeAfterWarmUp(m_plan.codeBlock);
+#endif // ENABLE(FTL_JIT)
+    
+    if (m_plan.compilation)
+        m_plan.vm->m_perBytecodeProfiler->addCompilation(m_plan.codeBlock, m_plan.compilation);
+    
+    if (!m_plan.willTryToTierUp)
+        m_plan.codeBlock->baselineVersion()->m_didFailFTLCompilation = true;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGJITFinalizer.h b/dfg/DFGJITFinalizer.h
new file mode 100644
index 0000000..1b21f8c
--- /dev/null
+++ b/dfg/DFGJITFinalizer.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGFinalizer.h"
+#include "DFGJITCode.h"
+#include "LinkBuffer.h"
+#include "MacroAssembler.h"
+
+namespace JSC { namespace DFG {
+
+class JITFinalizer : public Finalizer {
+public:
+    JITFinalizer(Plan&, PassRefPtr<JITCode>, std::unique_ptr<LinkBuffer>, MacroAssemblerCodePtr withArityCheck = MacroAssemblerCodePtr(MacroAssemblerCodePtr::EmptyValue));
+    virtual ~JITFinalizer();
+    
+    size_t codeSize() override;
+    bool finalize() override;
+    bool finalizeFunction() override;
+
+private:
+    void finalizeCommon();
+    
+    RefPtr<JITCode> m_jitCode;
+    std::unique_ptr<LinkBuffer> m_linkBuffer;
+    MacroAssemblerCodePtr m_withArityCheck;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGJumpReplacement.cpp b/dfg/DFGJumpReplacement.cpp
new file mode 100644
index 0000000..5337529
--- /dev/null
+++ b/dfg/DFGJumpReplacement.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGJumpReplacement.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "MacroAssembler.h"
+#include "JSCInlines.h"
+#include "Options.h"
+
+namespace JSC { namespace DFG {
+
+void JumpReplacement::fire()
+{
+    if (Options::dumpDisassembly())
+        dataLogF("Firing jump replacement watchpoint from %p, to %p.\n", m_source.dataLocation(), m_destination.dataLocation());
+    MacroAssembler::replaceWithJump(m_source, m_destination);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGJumpReplacement.h b/dfg/DFGJumpReplacement.h
new file mode 100644
index 0000000..4f9ce15
--- /dev/null
+++ b/dfg/DFGJumpReplacement.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeLocation.h"
+
+namespace JSC { namespace DFG {
+
+class JumpReplacement {
+public:
+    JumpReplacement(CodeLocationLabel source, CodeLocationLabel destination)
+        : m_source(source)
+        , m_destination(destination)
+    {
+    }
+    
+    void fire();
+
+private:
+    CodeLocationLabel m_source;
+    CodeLocationLabel m_destination;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLICMPhase.cpp b/dfg/DFGLICMPhase.cpp
new file mode 100644
index 0000000..e609764
--- /dev/null
+++ b/dfg/DFGLICMPhase.cpp
@@ -0,0 +1,362 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGLICMPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractInterpreterInlines.h"
+#include "DFGAtTailAbstractState.h"
+#include "DFGBasicBlockInlines.h"
+#include "DFGClobberSet.h"
+#include "DFGClobberize.h"
+#include "DFGControlEquivalenceAnalysis.h"
+#include "DFGEdgeDominates.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGMayExit.h"
+#include "DFGNaturalLoops.h"
+#include "DFGPhase.h"
+#include "DFGSafeToExecute.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+struct LoopData {
+    LoopData()
+        : preHeader(nullptr)
+    {
+    }
+    
+    ClobberSet writes;
+    BasicBlock* preHeader;
+};
+
+} // anonymous namespace
+
+class LICMPhase : public Phase {
+    static const bool verbose = false;
+    
+public:
+    LICMPhase(Graph& graph)
+        : Phase(graph, "LICM")
+        , m_state(graph)
+        , m_interpreter(graph, m_state)
+    {
+    }
+    
+    bool run()
+    {
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_form == SSA);
+        
+        m_graph.ensureDominators();
+        m_graph.ensureNaturalLoops();
+        m_graph.ensureControlEquivalenceAnalysis();
+
+        if (verbose) {
+            dataLog("Graph before LICM:\n");
+            m_graph.dump();
+        }
+        
+        m_data.resize(m_graph.m_naturalLoops->numLoops());
+        
+        // Figure out the set of things each loop writes to, not including blocks that
+        // belong to inner loops. We fix this later.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            // Skip blocks that are proved to not execute.
+            // FIXME: This shouldn't be needed.
+            // https://bugs.webkit.org/show_bug.cgi?id=128584
+            if (!block->cfaHasVisited)
+                continue;
+            
+            const NaturalLoop* loop = m_graph.m_naturalLoops->innerMostLoopOf(block);
+            if (!loop)
+                continue;
+            LoopData& data = m_data[loop->index()];
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                
+                // Don't look beyond parts of the code that definitely always exit.
+                // FIXME: This shouldn't be needed.
+                // https://bugs.webkit.org/show_bug.cgi?id=128584
+                if (node->op() == ForceOSRExit)
+                    break;
+
+                addWrites(m_graph, node, data.writes);
+            }
+        }
+        
+        // For each loop:
+        // - Identify its pre-header.
+        // - Make sure its outer loops know what it clobbers.
+        for (unsigned loopIndex = m_graph.m_naturalLoops->numLoops(); loopIndex--;) {
+            const NaturalLoop& loop = m_graph.m_naturalLoops->loop(loopIndex);
+            LoopData& data = m_data[loop.index()];
+            
+            for (
+                const NaturalLoop* outerLoop = m_graph.m_naturalLoops->innerMostOuterLoop(loop);
+                outerLoop;
+                outerLoop = m_graph.m_naturalLoops->innerMostOuterLoop(*outerLoop))
+                m_data[outerLoop->index()].writes.addAll(data.writes);
+            
+            BasicBlock* header = loop.header();
+            BasicBlock* preHeader = nullptr;
+            unsigned numberOfPreHeaders = 0; // We're cool if this is 1.
+
+            // This is guaranteed because we expect the CFG not to have unreachable code. Therefore, a
+            // loop header must have a predecessor. (Also, we don't allow the root block to be a loop,
+            // which cuts out the one other way of having a loop header with only one predecessor.)
+            DFG_ASSERT(m_graph, header->at(0), header->predecessors.size() > 1);
+            
+            for (unsigned i = header->predecessors.size(); i--;) {
+                BasicBlock* predecessor = header->predecessors[i];
+                if (m_graph.m_dominators->dominates(header, predecessor))
+                    continue;
+
+                preHeader = predecessor;
+                ++numberOfPreHeaders;
+            }
+
+            // We need to validate the pre-header. There are a bunch of things that could be wrong
+            // about it:
+            //
+            // - There might be more than one. This means that pre-header creation either did not run,
+            //   or some CFG transformation destroyed the pre-headers.
+            //
+            // - It may not be legal to exit at the pre-header. That would be a real bummer. Currently,
+            //   LICM assumes that it can always hoist checks. See
+            //   https://bugs.webkit.org/show_bug.cgi?id=148545. Though even with that fixed, we anyway
+            //   would need to check if it's OK to exit at the pre-header since if we can't then we
+            //   would have to restrict hoisting to non-exiting nodes.
+
+            if (numberOfPreHeaders != 1)
+                continue;
+
+            // This is guaranteed because the header has multiple predecessors and critical edges are
+            // broken. Therefore the predecessors must all have one successor, which implies that they
+            // must end in a Jump.
+            DFG_ASSERT(m_graph, preHeader->terminal(), preHeader->terminal()->op() == Jump);
+
+            if (!preHeader->terminal()->origin.exitOK)
+                continue;
+            
+            data.preHeader = preHeader;
+        }
+        
+        m_graph.initializeNodeOwners();
+        
+        // Walk all basic blocks that belong to loops, looking for hoisting opportunities.
+        // We try to hoist to the outer-most loop that permits it. Hoisting is valid if:
+        // - The node doesn't write anything.
+        // - The node doesn't read anything that the loop writes.
+        // - The preHeader is valid (i.e. it passed the validation above).
+        // - The preHeader's state at tail makes the node safe to execute.
+        // - The loop's children all belong to nodes that strictly dominate the loop header.
+        // - The preHeader's state at tail is still valid. This is mostly to save compile
+        //   time and preserve some kind of sanity, if we hoist something that must exit.
+        //
+        // Also, we need to remember to:
+        // - Update the state-at-tail with the node we hoisted, so future hoist candidates
+        //   know about any type checks we hoisted.
+        //
+        // For maximum profit, we walk blocks in DFS order to ensure that we generally
+        // tend to hoist dominators before dominatees.
+        Vector<const NaturalLoop*> loopStack;
+        bool changed = false;
+        for (BasicBlock* block : m_graph.blocksInPreOrder()) {
+            const NaturalLoop* loop = m_graph.m_naturalLoops->innerMostLoopOf(block);
+            if (!loop)
+                continue;
+            
+            loopStack.resize(0);
+            for (
+                const NaturalLoop* current = loop;
+                current;
+                current = m_graph.m_naturalLoops->innerMostOuterLoop(*current))
+                loopStack.append(current);
+            
+            // Remember: the loop stack has the inner-most loop at index 0, so if we want
+            // to bias hoisting to outer loops then we need to use a reverse loop.
+            
+            if (verbose) {
+                dataLog(
+                    "Attempting to hoist out of block ", *block, " in loops:\n");
+                for (unsigned stackIndex = loopStack.size(); stackIndex--;) {
+                    dataLog(
+                        "        ", *loopStack[stackIndex], ", which writes ",
+                        m_data[loopStack[stackIndex]->index()].writes, "\n");
+                }
+            }
+            
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node*& nodeRef = block->at(nodeIndex);
+                if (doesWrites(m_graph, nodeRef)) {
+                    if (verbose)
+                        dataLog("    Not hoisting ", nodeRef, " because it writes things.\n");
+                    continue;
+                }
+
+                for (unsigned stackIndex = loopStack.size(); stackIndex--;)
+                    changed |= attemptHoist(block, nodeRef, loopStack[stackIndex]);
+            }
+        }
+        
+        return changed;
+    }
+
+private:
+    bool attemptHoist(BasicBlock* fromBlock, Node*& nodeRef, const NaturalLoop* loop)
+    {
+        Node* node = nodeRef;
+        LoopData& data = m_data[loop->index()];
+
+        if (!data.preHeader) {
+            if (verbose)
+                dataLog("    Not hoisting ", node, " because the pre-header is invalid.\n");
+            return false;
+        }
+        
+        if (!data.preHeader->cfaDidFinish) {
+            if (verbose)
+                dataLog("    Not hoisting ", node, " because CFA is invalid.\n");
+            return false;
+        }
+        
+        if (!edgesDominate(m_graph, node, data.preHeader)) {
+            if (verbose) {
+                dataLog(
+                    "    Not hoisting ", node, " because it isn't loop invariant.\n");
+            }
+            return false;
+        }
+        
+        // FIXME: At this point if the hoisting of the full node fails but the node has type checks,
+        // we could still hoist just the checks.
+        // https://bugs.webkit.org/show_bug.cgi?id=144525
+        
+        if (readsOverlap(m_graph, node, data.writes)) {
+            if (verbose) {
+                dataLog(
+                    "    Not hoisting ", node,
+                    " because it reads things that the loop writes.\n");
+            }
+            return false;
+        }
+        
+        m_state.initializeTo(data.preHeader);
+        if (!safeToExecute(m_state, m_graph, node)) {
+            if (verbose) {
+                dataLog(
+                    "    Not hoisting ", node, " because it isn't safe to execute.\n");
+            }
+            return false;
+        }
+        
+        NodeOrigin originalOrigin = node->origin;
+
+        // NOTE: We could just use BackwardsDominators here directly, since we already know that the
+        // preHeader dominates fromBlock. But we wouldn't get anything from being so clever, since
+        // dominance checks are O(1) and only a few integer compares.
+        bool addsBlindSpeculation = mayExit(m_graph, node, m_state)
+            && !m_graph.m_controlEquivalenceAnalysis->dominatesEquivalently(data.preHeader, fromBlock);
+        
+        if (addsBlindSpeculation
+            && m_graph.baselineCodeBlockFor(originalOrigin.semantic)->hasExitSite(FrequentExitSite(HoistingFailed))) {
+            if (verbose) {
+                dataLog(
+                    "    Not hoisting ", node, " because it may exit and the pre-header (",
+                    *data.preHeader, ") is not control equivalent to the node's original block (",
+                    *fromBlock, ") and hoisting had previously failed.\n");
+            }
+            return false;
+        }
+        
+        if (verbose) {
+            dataLog(
+                "    Hoisting ", node, " from ", *fromBlock, " to ", *data.preHeader,
+                "\n");
+        }
+
+        // FIXME: We should adjust the Check: flags on the edges of node. There are phases that assume
+        // that those flags are correct even if AI is stale.
+        // https://bugs.webkit.org/show_bug.cgi?id=148544
+        data.preHeader->insertBeforeTerminal(node);
+        node->owner = data.preHeader;
+        NodeOrigin terminalOrigin = data.preHeader->terminal()->origin;
+        node->origin = terminalOrigin.withSemantic(node->origin.semantic);
+        node->origin.wasHoisted |= addsBlindSpeculation;
+        
+        // Modify the states at the end of the preHeader of the loop we hoisted to,
+        // and all pre-headers inside the loop. This isn't a stability bottleneck right now
+        // because most loops are small and most blocks belong to few loops.
+        for (unsigned bodyIndex = loop->size(); bodyIndex--;) {
+            BasicBlock* subBlock = loop->at(bodyIndex);
+            const NaturalLoop* subLoop = m_graph.m_naturalLoops->headerOf(subBlock);
+            if (!subLoop)
+                continue;
+            BasicBlock* subPreHeader = m_data[subLoop->index()].preHeader;
+            // We may not have given this loop a pre-header because either it didn't have exitOK
+            // or the header had multiple predecessors that it did not dominate. In that case the
+            // loop wouldn't be a hoisting candidate anyway, so we don't have to do anything.
+            if (!subPreHeader)
+                continue;
+            // The pre-header's tail may be unreachable, in which case we have nothing to do.
+            if (!subPreHeader->cfaDidFinish)
+                continue;
+            m_state.initializeTo(subPreHeader);
+            m_interpreter.execute(node);
+        }
+        
+        // It just so happens that all of the nodes we currently know how to hoist
+        // don't have var-arg children. That may change and then we can fix this
+        // code. But for now we just assert that's the case.
+        DFG_ASSERT(m_graph, node, !(node->flags() & NodeHasVarArgs));
+        
+        nodeRef = m_graph.addNode(Check, originalOrigin, node->children);
+        
+        return true;
+    }
+    
+    AtTailAbstractState m_state;
+    AbstractInterpreter<AtTailAbstractState> m_interpreter;
+    Vector<LoopData> m_data;
+};
+
+bool performLICM(Graph& graph)
+{
+    return runPhase<LICMPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGLICMPhase.h b/dfg/DFGLICMPhase.h
new file mode 100644
index 0000000..48b2682
--- /dev/null
+++ b/dfg/DFGLICMPhase.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Does loop-invariant code motion, or LICM for short. This only hoists code
+// and never sinks anything. A node is hoisted if it does no writes, and if
+// its reads don't overlap the loop's writes.
+
+bool performLICM(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLazyJSValue.cpp b/dfg/DFGLazyJSValue.cpp
new file mode 100644
index 0000000..54daf93
--- /dev/null
+++ b/dfg/DFGLazyJSValue.cpp
@@ -0,0 +1,273 @@
+/*
+ * Copyright (C) 2013, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGLazyJSValue.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CCallHelpers.h"
+#include "DFGGraph.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+
+namespace JSC { namespace DFG {
+
+LazyJSValue LazyJSValue::newString(Graph& graph, const String& string)
+{
+    LazyJSValue result;
+    result.m_kind = NewStringImpl;
+    result.u.stringImpl = graph.m_localStrings.add(string).iterator->impl();
+    return result;
+}
+
+JSValue LazyJSValue::getValue(VM& vm) const
+{
+    switch (m_kind) {
+    case KnownValue:
+        return value()->value();
+    case SingleCharacterString:
+        return jsSingleCharacterString(&vm, u.character);
+    case KnownStringImpl:
+        return jsString(&vm, u.stringImpl);
+    case NewStringImpl:
+        return jsString(&vm, AtomicStringImpl::add(u.stringImpl));
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return JSValue();
+}
+
+static TriState equalToSingleCharacter(JSValue value, UChar character)
+{
+    if (!value.isString())
+        return FalseTriState;
+    
+    JSString* jsString = asString(value);
+    if (jsString->length() != 1)
+        return FalseTriState;
+    
+    const StringImpl* string = jsString->tryGetValueImpl();
+    if (!string)
+        return MixedTriState;
+    
+    return triState(string->at(0) == character);
+}
+
+static TriState equalToStringImpl(JSValue value, StringImpl* stringImpl)
+{
+    if (!value.isString())
+        return FalseTriState;
+    
+    JSString* jsString = asString(value);
+    const StringImpl* string = jsString->tryGetValueImpl();
+    if (!string)
+        return MixedTriState;
+    
+    return triState(WTF::equal(stringImpl, string));
+}
+
+const StringImpl* LazyJSValue::tryGetStringImpl() const
+{
+    switch (m_kind) {
+    case KnownStringImpl:
+    case NewStringImpl:
+        return u.stringImpl;
+
+    case KnownValue:
+        if (JSString* string = value()->dynamicCast<JSString*>())
+            return string->tryGetValueImpl();
+        return nullptr;
+
+    default:
+        return nullptr;
+    }
+}
+
+String LazyJSValue::tryGetString(Graph& graph) const
+{
+    switch (m_kind) {
+    case NewStringImpl:
+        return u.stringImpl;
+
+    case SingleCharacterString:
+        return String(&u.character, 1);
+
+    default:
+        if (const StringImpl* string = tryGetStringImpl()) {
+            unsigned ginormousStringLength = 10000;
+            if (string->length() > ginormousStringLength)
+                return String();
+            
+            auto result = graph.m_copiedStrings.add(string, String());
+            if (result.isNewEntry)
+                result.iterator->value = string->isolatedCopy();
+            return result.iterator->value;
+        }
+        
+        return String();
+    }
+}
+
+TriState LazyJSValue::strictEqual(const LazyJSValue& other) const
+{
+    switch (m_kind) {
+    case KnownValue:
+        switch (other.m_kind) {
+        case KnownValue:
+            return JSValue::pureStrictEqual(value()->value(), other.value()->value());
+        case SingleCharacterString:
+            return equalToSingleCharacter(value()->value(), other.character());
+        case KnownStringImpl:
+        case NewStringImpl:
+            return equalToStringImpl(value()->value(), other.stringImpl());
+        }
+        break;
+    case SingleCharacterString:
+        switch (other.m_kind) {
+        case SingleCharacterString:
+            return triState(character() == other.character());
+        case KnownStringImpl:
+        case NewStringImpl:
+            if (other.stringImpl()->length() != 1)
+                return FalseTriState;
+            return triState(other.stringImpl()->at(0) == character());
+        default:
+            return other.strictEqual(*this);
+        }
+        break;
+    case KnownStringImpl:
+    case NewStringImpl:
+        switch (other.m_kind) {
+        case KnownStringImpl:
+        case NewStringImpl:
+            return triState(WTF::equal(stringImpl(), other.stringImpl()));
+        default:
+            return other.strictEqual(*this);
+        }
+        break;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return FalseTriState;
+}
+
+uintptr_t LazyJSValue::switchLookupValue(SwitchKind kind) const
+{
+    // NB. Not every kind of JSValue will be able to give you a switch lookup
+    // value, and this method will assert, or do bad things, if you use it
+    // for a kind of value that can't.
+    switch (m_kind) {
+    case KnownValue:
+        switch (kind) {
+        case SwitchImm:
+            return value()->value().asInt32();
+        case SwitchCell:
+            return bitwise_cast<uintptr_t>(value()->value().asCell());
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return 0;
+        }
+    case SingleCharacterString:
+        switch (kind) {
+        case SwitchChar:
+            return character();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return 0;
+        }
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+void LazyJSValue::emit(CCallHelpers& jit, JSValueRegs result) const
+{
+    if (m_kind == KnownValue) {
+        jit.moveValue(value()->value(), result);
+        return;
+    }
+
+    // It must be some kind of cell.
+#if USE(JSVALUE32_64)
+    jit.move(CCallHelpers::TrustedImm32(JSValue::CellTag), result.tagGPR());
+#endif
+    CCallHelpers::DataLabelPtr label = jit.moveWithPatch(
+        CCallHelpers::TrustedImmPtr(static_cast<size_t>(0xd1e7beeflu)),
+        result.payloadGPR());
+
+    LazyJSValue thisValue = *this;
+
+    // Once we do this, we're committed. Otherwise we leak memory. Note that we call ref/deref
+    // manually to ensure that there is no concurrency shadiness. We are doing something here
+    // that might be rather brutal: transfering ownership of this string.
+    if (m_kind == NewStringImpl)
+        thisValue.u.stringImpl->ref();
+
+    CodeBlock* codeBlock = jit.codeBlock();
+    
+    jit.addLinkTask(
+        [codeBlock, label, thisValue] (LinkBuffer& linkBuffer) {
+            JSValue realValue = thisValue.getValue(linkBuffer.vm());
+            RELEASE_ASSERT(realValue.isCell());
+
+            codeBlock->addConstant(realValue);
+            
+            if (thisValue.m_kind == NewStringImpl)
+                thisValue.u.stringImpl->deref();
+
+            linkBuffer.patch(label, realValue.asCell());
+        });
+}
+
+void LazyJSValue::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    switch (m_kind) {
+    case KnownValue:
+        value()->dumpInContext(out, context);
+        return;
+    case SingleCharacterString:
+        out.print("Lazy:SingleCharacterString(");
+        out.printf("%04X", static_cast<unsigned>(character()));
+        out.print(" / ", StringImpl::utf8ForCharacters(&u.character, 1), ")");
+        return;
+    case KnownStringImpl:
+        out.print("Lazy:KnownString(", stringImpl(), ")");
+        return;
+    case NewStringImpl:
+        out.print("Lazy:NewString(", stringImpl(), ")");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void LazyJSValue::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGLazyJSValue.h b/dfg/DFGLazyJSValue.h
new file mode 100644
index 0000000..37982bb
--- /dev/null
+++ b/dfg/DFGLazyJSValue.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2013, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGFrozenValue.h"
+#include <wtf/text/StringImpl.h>
+
+namespace JSC {
+
+class CCallHelpers;
+
+namespace DFG {
+
+class Graph;
+
+// Represents either a JSValue, or for JSValues that require allocation in the heap,
+// it tells you everything you'd need to know in order to allocate it.
+
+class LazyJSValue {
+public:
+    enum LazinessKind {
+        KnownValue,
+        SingleCharacterString,
+        KnownStringImpl,
+        NewStringImpl
+    };
+
+    LazyJSValue(FrozenValue* value = FrozenValue::emptySingleton())
+        : m_kind(KnownValue)
+    {
+        u.value = value;
+    }
+    
+    static LazyJSValue singleCharacterString(UChar character)
+    {
+        LazyJSValue result;
+        result.m_kind = SingleCharacterString;
+        result.u.character = character;
+        return result;
+    }
+    
+    static LazyJSValue knownStringImpl(StringImpl* string)
+    {
+        LazyJSValue result;
+        result.m_kind = KnownStringImpl;
+        result.u.stringImpl = string;
+        return result;
+    }
+
+    static LazyJSValue newString(Graph&, const String&);
+
+    LazinessKind kind() const { return m_kind; }
+    
+    FrozenValue* tryGetValue(Graph&) const
+    {
+        if (m_kind == KnownValue)
+            return value();
+        return nullptr;
+    }
+    
+    JSValue getValue(VM&) const;
+    
+    FrozenValue* value() const
+    {
+        ASSERT(m_kind == KnownValue);
+        return u.value;
+    }
+    
+    UChar character() const
+    {
+        ASSERT(m_kind == SingleCharacterString);
+        return u.character;
+    }
+
+    const StringImpl* tryGetStringImpl() const;
+    
+    String tryGetString(Graph&) const;
+    
+    StringImpl* stringImpl() const
+    {
+        ASSERT(m_kind == KnownStringImpl || m_kind == NewStringImpl);
+        return u.stringImpl;
+    }
+
+    TriState strictEqual(const LazyJSValue& other) const;
+    
+    uintptr_t switchLookupValue(SwitchKind) const;
+
+    void emit(CCallHelpers&, JSValueRegs) const;
+    
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    
+private:
+    union {
+        FrozenValue* value;
+        UChar character;
+        StringImpl* stringImpl;
+    } u;
+    LazinessKind m_kind;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLazyNode.cpp b/dfg/DFGLazyNode.cpp
new file mode 100644
index 0000000..c8d0940
--- /dev/null
+++ b/dfg/DFGLazyNode.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGLazyNode.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void LazyNode::dump(PrintStream& out) const
+{
+    if (!*this)
+        out.print("LazyNode:0");
+    else {
+        if (isNode())
+            out.print("LazyNode:@", asNode()->index());
+        else
+            out.print("LazyNode:FrozenValue(", Graph::opName(op()), ", ", pointerDump(asValue()), ")");
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLazyNode.h b/dfg/DFGLazyNode.h
new file mode 100644
index 0000000..1d8fa7a
--- /dev/null
+++ b/dfg/DFGLazyNode.h
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGInsertionSet.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+class LazyNode {
+public:
+    static const size_t jsConstantTag = 0;
+    static const size_t doubleConstantTag = 1;
+    static const size_t int52ConstantTag = 2;
+
+    static const uintptr_t tagMask = 0x3;
+    static const uintptr_t pointerMask = ~tagMask;
+
+    explicit LazyNode(Node* node = nullptr)
+        : m_node(node)
+        , m_value(reinterpret_cast<uintptr_t>(nullptr))
+    {
+        if (node && node->isConstant())
+            setFrozenValue(node->constant(), node->op());
+    }
+
+    explicit LazyNode(FrozenValue* value, NodeType op = JSConstant)
+        : m_node(nullptr)
+        , m_value(reinterpret_cast<uintptr_t>(nullptr))
+    {
+        setFrozenValue(value, op);
+    }
+
+    LazyNode(std::nullptr_t)
+        : m_node(nullptr)
+        , m_value(reinterpret_cast<uintptr_t>(nullptr))
+    {
+    }
+
+    LazyNode(WTF::HashTableDeletedValueType)
+        : m_node(reinterpret_cast<Node*>(-1))
+    {
+    }
+
+    void setNode(Node* node)
+    {
+        m_node = node;
+        if (node && node->isConstant())
+            setFrozenValue(node->constant(), node->op());
+    }
+
+    bool isHashTableDeletedValue() const { return m_node == reinterpret_cast<Node*>(-1); }
+
+    bool isNode() const { return m_node; }
+
+    NodeType op() const
+    {
+        if (m_node)
+            return m_node->op();
+
+        switch (m_value & tagMask) {
+        case jsConstantTag:
+            return JSConstant;
+        case doubleConstantTag:
+            return DoubleConstant;
+        case int52ConstantTag:
+            return Int52Constant;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    Node* asNode() const
+    {
+        ASSERT(m_node || !asValue());
+        return m_node;
+    }
+
+    FrozenValue* asValue() const
+    {
+        return reinterpret_cast<FrozenValue*>(m_value & pointerMask);
+    }
+
+    unsigned hash() const
+    {
+        void* toHash = m_node;
+        if (FrozenValue* value = asValue())
+            toHash = value;
+        return WTF::PtrHash<void*>::hash(toHash);
+    }
+
+    bool operator==(const LazyNode& other) const
+    {
+        if (asValue() || other.asValue())
+            return m_value == other.m_value;
+        return m_node == other.m_node;
+    }
+
+    bool operator!=(const LazyNode& other) const
+    {
+        return !(*this == other);
+    }
+
+    Node* ensureIsNode(InsertionSet& insertionSet, BasicBlock* block, unsigned nodeIndex)
+    {
+        if (!m_node)
+            m_node = insertionSet.insertConstant(nodeIndex, block->at(nodeIndex)->origin, asValue(), op());
+
+        return asNode();
+    }
+
+    Node* operator->() const { return asNode(); }
+
+    Node& operator*() const { return *asNode(); }
+
+    bool operator!() const { return !asValue() && !asNode(); }
+
+    explicit operator bool() const { return !!*this; }
+
+    void dump(PrintStream& out) const;
+
+private:
+    void setFrozenValue(FrozenValue* value, NodeType op)
+    {
+        ASSERT(value);
+        m_value = reinterpret_cast<uintptr_t>(value);
+        ASSERT(m_value == (m_value & pointerMask));
+        switch (op) {
+        case JSConstant:
+            m_value |= jsConstantTag;
+            break;
+        case DoubleConstant:
+            m_value |= doubleConstantTag;
+            break;
+        case Int52Constant:
+            m_value |= int52ConstantTag;
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+
+    Node* m_node;
+    uintptr_t m_value;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::LazyNode> : SimpleClassHashTraits<JSC::DFG::LazyNode> {
+    static const bool emptyValueIsZero = true;
+};
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLiveCatchVariablePreservationPhase.cpp b/dfg/DFGLiveCatchVariablePreservationPhase.cpp
new file mode 100644
index 0000000..db36999
--- /dev/null
+++ b/dfg/DFGLiveCatchVariablePreservationPhase.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGLiveCatchVariablePreservationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "FullBytecodeLiveness.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class LiveCatchVariablePreservationPhase : public Phase {
+public:
+    LiveCatchVariablePreservationPhase(Graph& graph)
+        : Phase(graph, "live catch variable preservation phase")
+    {
+    }
+
+    bool run()
+    {
+        if (!m_graph.m_hasExceptionHandlers)
+            return true;
+
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_form == LoadStore);
+
+        m_currentBlockLiveness.resize(m_graph.block(0)->variablesAtTail.numberOfLocals());
+
+        InsertionSet insertionSet(m_graph);
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            handleBlock(block, insertionSet);
+            insertionSet.execute(block);
+        }
+
+        return true;
+    }
+
+    bool willCatchException(CodeOrigin origin)
+    {
+        unsigned bytecodeIndexToCheck = origin.bytecodeIndex;
+        m_currentBlockLiveness.clearAll();
+
+        while (1) {
+            InlineCallFrame* inlineCallFrame = origin.inlineCallFrame;
+            CodeBlock* codeBlock = m_graph.baselineCodeBlockFor(inlineCallFrame);
+            if (HandlerInfo* handler = codeBlock->handlerForBytecodeOffset(bytecodeIndexToCheck)) {
+                unsigned catchBytecodeIndex = handler->target;
+                m_graph.forAllLocalsLiveInBytecode(CodeOrigin(catchBytecodeIndex, inlineCallFrame), [&] (VirtualRegister operand) {
+                    m_currentBlockLiveness[operand.toLocal()] = true;
+                });
+                return true;
+            }
+
+            if (!inlineCallFrame)
+                return false;
+
+            bytecodeIndexToCheck = inlineCallFrame->directCaller.bytecodeIndex;
+            origin = inlineCallFrame->directCaller;
+        }
+    }
+
+    void handleBlock(BasicBlock* block, InsertionSet& insertionSet)
+    {
+        // Because precise jump targets ensures that the start of a "try" block is its
+        // own basic block, we will never have two "try" statements in the same DFG
+        // basic block. Therefore, checking the first node in the block is sufficient 
+        // to checking if we're in a try block.
+        if (!willCatchException(block->at(0)->origin.semantic))
+            return;
+
+        Operands<VariableAccessData*> currentBlockAccessData(block->variablesAtTail.numberOfArguments(), block->variablesAtTail.numberOfLocals(), nullptr);
+        HashSet<InlineCallFrame*> seenInlineCallFrames;
+
+        {
+            for (unsigned i = 0; i < block->size(); i++) {
+                Node* node = block->at(i);
+                bool isPrimordialSetArgument = node->op() == SetArgument && node->local().isArgument() && node == m_graph.m_arguments[node->local().toArgument()];
+                InlineCallFrame* inlineCallFrame = node->origin.semantic.inlineCallFrame;
+                if (inlineCallFrame)
+                    seenInlineCallFrames.add(inlineCallFrame);
+
+                if (node->op() == SetLocal || (node->op() == SetArgument && !isPrimordialSetArgument)) {
+                    VirtualRegister operand = node->local();
+
+                    int stackOffset = inlineCallFrame ? inlineCallFrame->stackOffset : 0;
+                    if ((operand.isLocal() && m_currentBlockLiveness[operand.toLocal()])
+                        || (operand.offset() == stackOffset + CallFrame::thisArgumentOffset())) {
+
+                        VariableAccessData* variableAccessData = currentBlockAccessData.operand(operand);
+                        if (!variableAccessData)
+                            variableAccessData = newVariableAccessData(operand);
+
+                        insertionSet.insertNode(i, SpecNone, 
+                            Flush, node->origin, OpInfo(variableAccessData));
+                    }
+                }
+
+                if (node->accessesStack(m_graph))
+                    currentBlockAccessData.operand(node->local()) = node->variableAccessData();
+            }
+        }
+
+        // Insert Flush for everything at the end of the block.
+        {
+            NodeOrigin origin = block->at(block->size() - 1)->origin;
+            auto preserveLivenessAtEndOfBlock = [&] (VirtualRegister operand, bool alwaysInsert) {
+                if ((operand.isLocal() && m_currentBlockLiveness[operand.toLocal()]) 
+                    || operand.isArgument()
+                    || alwaysInsert) {
+                    VariableAccessData* accessData = currentBlockAccessData.operand(operand);
+                    if (!accessData)
+                        accessData = newVariableAccessData(operand);
+
+                    currentBlockAccessData.operand(operand) = accessData;
+
+                    insertionSet.insertNode(block->size(), SpecNone, 
+                        Flush, origin, OpInfo(accessData));
+                }
+            };
+            for (unsigned local = 0; local < block->variablesAtTail.numberOfLocals(); local++)
+                preserveLivenessAtEndOfBlock(virtualRegisterForLocal(local), false);
+            for (InlineCallFrame* inlineCallFrame : seenInlineCallFrames)
+                preserveLivenessAtEndOfBlock(VirtualRegister(inlineCallFrame->stackOffset + CallFrame::thisArgumentOffset()), true);
+            preserveLivenessAtEndOfBlock(VirtualRegister(CallFrame::thisArgumentOffset()), true);
+        }
+    }
+
+    VariableAccessData* newVariableAccessData(VirtualRegister operand)
+    {
+        ASSERT(!operand.isConstant());
+        
+        m_graph.m_variableAccessData.append(VariableAccessData(operand));
+        return &m_graph.m_variableAccessData.last();
+    }
+
+    FastBitVector m_currentBlockLiveness;
+};
+
+bool performLiveCatchVariablePreservationPhase(Graph& graph)
+{
+    return runPhase<LiveCatchVariablePreservationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLiveCatchVariablePreservationPhase.h b/dfg/DFGLiveCatchVariablePreservationPhase.h
new file mode 100644
index 0000000..24e75ca
--- /dev/null
+++ b/dfg/DFGLiveCatchVariablePreservationPhase.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// This phase ensures that we maintain liveness for locals
+// that are live in the "catch" block. Because a "catch"
+// block will not be in the control flow graph, we need to ensure
+// anything live inside the "catch" block in bytecode will maintain 
+// liveness inside the "try" block for an OSR exit from the "try" 
+// block into the "catch" block in the case of an exception being thrown.
+//
+// The mechanism currently used to demonstrate liveness to OSR exit
+// is ensuring all variables live in a "catch" are flushed to the
+// stack inside the "try" block.
+
+bool performLiveCatchVariablePreservationPhase(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLivenessAnalysisPhase.cpp b/dfg/DFGLivenessAnalysisPhase.cpp
new file mode 100644
index 0000000..a036820
--- /dev/null
+++ b/dfg/DFGLivenessAnalysisPhase.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGLivenessAnalysisPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGBlockMapInlines.h"
+#include "DFGFlowIndexing.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include <wtf/BitVector.h>
+#include <wtf/IndexSparseSet.h>
+
+namespace JSC { namespace DFG {
+
+class LivenessAnalysisPhase : public Phase {
+public:
+    LivenessAnalysisPhase(Graph& graph)
+        : Phase(graph, "liveness analysis")
+        , m_dirtyBlocks(m_graph.numBlocks())
+        , m_indexing(*m_graph.m_indexingCache)
+        , m_liveAtHead(m_graph)
+        , m_liveAtTail(m_graph)
+    {
+        m_graph.m_indexingCache->recompute();
+        m_workset = std::make_unique<IndexSparseSet<UnsafeVectorOverflow>>(m_graph.m_indexingCache->numIndices());
+    }
+
+    bool run()
+    {
+        // Start with all valid block dirty.
+        BlockIndex numBlock = m_graph.numBlocks();
+        m_dirtyBlocks.ensureSize(numBlock);
+        for (BlockIndex blockIndex = 0; blockIndex < numBlock; ++blockIndex) {
+            if (m_graph.block(blockIndex))
+                m_dirtyBlocks.quickSet(blockIndex);
+        }
+
+        // Fixpoint until we do not add any new live values at tail.
+        bool changed;
+        do {
+            changed = false;
+
+            for (BlockIndex blockIndex = numBlock; blockIndex--;) {
+                if (!m_dirtyBlocks.quickClear(blockIndex))
+                    continue;
+
+                changed |= processBlock(blockIndex);
+            }
+        } while (changed);
+
+        // Update the per-block node list for live and tail.
+        for (BlockIndex blockIndex = numBlock; blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+
+            {
+                const Vector<unsigned, 0, UnsafeVectorOverflow, 1>& liveAtHeadIndices = m_liveAtHead[blockIndex];
+                Vector<NodeFlowProjection>& liveAtHead = block->ssa->liveAtHead;
+                liveAtHead.resize(0);
+                liveAtHead.reserveCapacity(liveAtHeadIndices.size());
+                for (unsigned index : liveAtHeadIndices)
+                    liveAtHead.uncheckedAppend(m_indexing.nodeProjection(index));
+            }
+            {
+                const HashSet<unsigned, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned>>& liveAtTailIndices = m_liveAtTail[blockIndex];
+                Vector<NodeFlowProjection>& liveAtTail = block->ssa->liveAtTail;
+                liveAtTail.resize(0);
+                liveAtTail.reserveCapacity(liveAtTailIndices.size());
+                for (unsigned index : m_liveAtTail[blockIndex])
+                    liveAtTail.uncheckedAppend(m_indexing.nodeProjection(index));
+            }
+        }
+
+        return true;
+    }
+
+private:
+    bool processBlock(BlockIndex blockIndex)
+    {
+        BasicBlock* block = m_graph.block(blockIndex);
+        ASSERT_WITH_MESSAGE(block, "Only dirty blocks needs updates. A null block should never be dirty.");
+
+        m_workset->clear();
+        for (unsigned index : m_liveAtTail[blockIndex])
+            m_workset->add(index);
+
+        for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+            Node* node = block->at(nodeIndex);
+
+            auto handleEdge = [&] (Edge& edge) {
+                bool newEntry = m_workset->add(m_indexing.index(edge.node()));
+                edge.setKillStatus(newEntry ? DoesKill : DoesNotKill);
+            };
+            
+            switch (node->op()) {
+            case Upsilon: {
+                ASSERT_WITH_MESSAGE(!m_workset->contains(node->index()), "Upsilon should not be used as defs by other nodes.");
+
+                Node* phi = node->phi();
+                m_workset->remove(m_indexing.shadowIndex(phi));
+                handleEdge(node->child1());
+                break;
+            }
+            case Phi: {
+                m_workset->remove(m_indexing.index(node));
+                m_workset->add(m_indexing.shadowIndex(node));
+                break;
+            }
+            default:
+                m_workset->remove(m_indexing.index(node));
+                m_graph.doToChildren(node, handleEdge);
+                break;
+            }
+        }
+
+        // Update live at head.
+        Vector<unsigned, 0, UnsafeVectorOverflow, 1>& liveAtHead = m_liveAtHead[blockIndex];
+        if (m_workset->size() == liveAtHead.size())
+            return false;
+
+        for (unsigned liveIndexAtHead : liveAtHead)
+            m_workset->remove(liveIndexAtHead);
+        ASSERT(!m_workset->isEmpty());
+
+        liveAtHead.reserveCapacity(liveAtHead.size() + m_workset->size());
+        for (unsigned newValue : *m_workset)
+            liveAtHead.uncheckedAppend(newValue);
+
+        bool changedPredecessor = false;
+        for (BasicBlock* predecessor : block->predecessors) {
+            HashSet<unsigned, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned>>&
+                liveAtTail = m_liveAtTail[predecessor];
+            for (unsigned newValue : *m_workset) {
+                if (liveAtTail.add(newValue)) {
+                    if (!m_dirtyBlocks.quickSet(predecessor->index))
+                        changedPredecessor = true;
+                }
+            }
+        }
+        return changedPredecessor;
+    }
+
+    // Blocks with new live values at tail.
+    BitVector m_dirtyBlocks;
+    
+    FlowIndexing& m_indexing;
+
+    // Live values per block edge.
+    BlockMap<Vector<unsigned, 0, UnsafeVectorOverflow, 1>> m_liveAtHead;
+    BlockMap<HashSet<unsigned, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned>>> m_liveAtTail;
+
+    // Single sparse set allocated once and used by every basic block.
+    std::unique_ptr<IndexSparseSet<UnsafeVectorOverflow>> m_workset;
+};
+
+bool performLivenessAnalysis(Graph& graph)
+{
+    graph.packNodeIndices();
+
+    return runPhase<LivenessAnalysisPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGLivenessAnalysisPhase.h b/dfg/DFGLivenessAnalysisPhase.h
new file mode 100644
index 0000000..62f79f7
--- /dev/null
+++ b/dfg/DFGLivenessAnalysisPhase.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Computes BasicBlock::ssa->liveAtHead/liveAtTail.
+
+bool performLivenessAnalysis(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLongLivedState.cpp b/dfg/DFGLongLivedState.cpp
new file mode 100644
index 0000000..7a2f2f1
--- /dev/null
+++ b/dfg/DFGLongLivedState.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGLongLivedState.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+LongLivedState::LongLivedState()
+{
+}
+
+LongLivedState::~LongLivedState()
+{
+}
+
+void LongLivedState::shrinkToFit()
+{
+    m_allocator.reset();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGLongLivedState.h b/dfg/DFGLongLivedState.h
new file mode 100644
index 0000000..c5220f2
--- /dev/null
+++ b/dfg/DFGLongLivedState.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNodeAllocator.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace DFG {
+
+class LongLivedState {
+    WTF_MAKE_FAST_ALLOCATED; WTF_MAKE_NONCOPYABLE(LongLivedState);
+public:
+    LongLivedState();
+    ~LongLivedState();
+    
+    void shrinkToFit();
+    
+    NodeAllocator m_allocator;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGLoopPreHeaderCreationPhase.cpp b/dfg/DFGLoopPreHeaderCreationPhase.cpp
new file mode 100644
index 0000000..d0b3ad4
--- /dev/null
+++ b/dfg/DFGLoopPreHeaderCreationPhase.cpp
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGLoopPreHeaderCreationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGBlockInsertionSet.h"
+#include "DFGDominators.h"
+#include "DFGGraph.h"
+#include "DFGNaturalLoops.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace DFG {
+
+BasicBlock* createPreHeader(Graph& graph, BlockInsertionSet& insertionSet, BasicBlock* block)
+{
+    // FIXME: If we run this utility on SSA IR, then we may end up with a bizarre arrangement of
+    // Upsilons and Phis, like:
+    //
+    // BB#1:
+    //     Upsilon(@a, ^p)
+    //     Jump(#3)
+    //
+    // BB#2:
+    //     Upsilon(@b, ^p)
+    //     Jump(#3)
+    //
+    // BB#3:
+    //     Jump(#4)
+    //
+    // BB#4:
+    //     p: Phi()
+    //
+    // Notice how the Upsilons are not in the predecessor of the Phi anymore. It's not clear if this
+    // would be bad. Probably not, but it's weird anyway. We should add a validation rule, and we
+    // should implement a Upsilon/Phi canonicalization that handles this by calling into the
+    // SSACalculator and treating the Upsilons as Defs and rebuilding the Phis from scratch.
+    //
+    // https://bugs.webkit.org/show_bug.cgi?id=148587
+
+    // Determine a good frequency for the pre-header. It's definitely not the frequency of the loop body.
+    // Instead, we use the max of the frequencies of the loop body's non-loop predecessors.
+    float frequency = 0;
+    for (BasicBlock* predecessor : block->predecessors) {
+        if (graph.m_dominators->dominates(block, predecessor))
+            continue;
+        frequency = std::max(frequency, predecessor->executionCount);
+    }
+    BasicBlock* preHeader = insertionSet.insertBefore(block, frequency);
+
+    // FIXME: It would be great if we put some effort into enabling exitOK at this origin, if it
+    // happens to be unset. It might not be set because the loop header (i.e. "block") has Phis in it.
+    // Phis have to have exitOK=false. There are a few ways to try to set exitOK:
+    //
+    // - Regenerate an exit origin by proving that we are at an exit origin boundary. If all of the
+    //   predecessors' terminals have different exit origins than the exit origin of head of block,
+    //   then we can leverage the assumption that exit origin boundaries can always exit. We could
+    //   extend this further, and say that we will set exitOK even if a predecessor's terminal has the
+    //   same exit origin, but so long it hadn't done anything that clobbers exit since the start of
+    //   the origin.
+    //
+    // - Analyze the Phi's and MovHint's at the head of block. If prior to the ExitOK there are only
+    //   Phi's and MovHint's, we could "roll them back" by proving that for each of the MovHints, the
+    //   referenced Phi has a child that dominates the pre-header, and that child is the node that is
+    //   OSR-available at the local being MovHinted.
+    //
+    // Note that there are some obviously wrong ways to try to set exitOK. For example, we cannot
+    // simply use the origin of our predecessors, since in bytecode that could be *any* kind of
+    // instruction. It may not even be a control flow construct, if we had lowered some non-control
+    // bytecode operation into DFG IR that has control flow. Hence, we really do need to try to use the
+    // origin of the head of the loop header.
+    //
+    // https://bugs.webkit.org/show_bug.cgi?id=148586
+    preHeader->appendNode(
+        graph, SpecNone, Jump, block->at(0)->origin, OpInfo(block));
+    
+    for (unsigned predecessorIndex = 0; predecessorIndex < block->predecessors.size(); predecessorIndex++) {
+        BasicBlock* predecessor = block->predecessors[predecessorIndex];
+        if (graph.m_dominators->dominates(block, predecessor))
+            continue;
+        block->predecessors[predecessorIndex--] = block->predecessors.last();
+        block->predecessors.removeLast();
+        for (unsigned successorIndex = predecessor->numSuccessors(); successorIndex--;) {
+            BasicBlock*& successor = predecessor->successor(successorIndex);
+            if (successor != block)
+                continue;
+            successor = preHeader;
+            preHeader->predecessors.append(predecessor);
+        }
+    }
+    
+    block->predecessors.append(preHeader);
+    return preHeader;
+}
+
+class LoopPreHeaderCreationPhase : public Phase {
+public:
+    LoopPreHeaderCreationPhase(Graph& graph)
+        : Phase(graph, "loop pre-header creation")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        m_graph.ensureDominators();
+        m_graph.ensureNaturalLoops();
+        
+        for (unsigned loopIndex = m_graph.m_naturalLoops->numLoops(); loopIndex--;) {
+            const NaturalLoop& loop = m_graph.m_naturalLoops->loop(loopIndex);
+            BasicBlock* existingPreHeader = 0;
+            bool needsNewPreHeader = false;
+            for (unsigned predecessorIndex = loop.header()->predecessors.size(); predecessorIndex--;) {
+                BasicBlock* predecessor = loop.header()->predecessors[predecessorIndex];
+                if (m_graph.m_dominators->dominates(loop.header(), predecessor))
+                    continue;
+                if (!existingPreHeader) {
+                    existingPreHeader = predecessor;
+                    continue;
+                }
+                // We won't have duplicate entries in the predecessors list.
+                DFG_ASSERT(m_graph, nullptr, existingPreHeader != predecessor);
+                needsNewPreHeader = true;
+                break;
+            }
+            
+            // This phase should only be run on a DFG where unreachable blocks have been pruned.
+            // We also don't allow loops back to root. This means that every loop header has got
+            // to have a pre-header.
+            DFG_ASSERT(m_graph, nullptr, existingPreHeader);
+            
+            // We are looking at the predecessors of a loop header. A loop header has to have
+            // some predecessor other than the pre-header. We must have broken critical edges
+            // because that is the DFG SSA convention. Therefore, each predecessor of the loop
+            // header must have only one successor.
+            DFG_ASSERT(m_graph, nullptr, existingPreHeader->terminal()->op() == Jump);
+
+            // A pre-header is most useful if it's possible to exit from its terminal. Hence
+            // if the terminal of the existing pre-header doesn't allow for exit, but the first
+            // origin of the loop header does, then we should create a new pre-header.
+            if (!needsNewPreHeader && loop.header()->at(0)->origin.exitOK
+                && !existingPreHeader->terminal()->origin.exitOK)
+                needsNewPreHeader = true;
+            
+            if (!needsNewPreHeader)
+                continue;
+            
+            createPreHeader(m_graph, m_insertionSet, loop.header());
+        }
+        
+        return m_insertionSet.execute();
+    }
+
+    BlockInsertionSet m_insertionSet;
+};
+
+bool performLoopPreHeaderCreation(Graph& graph)
+{
+    return runPhase<LoopPreHeaderCreationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGLoopPreHeaderCreationPhase.h b/dfg/DFGLoopPreHeaderCreationPhase.h
new file mode 100644
index 0000000..b4bc120
--- /dev/null
+++ b/dfg/DFGLoopPreHeaderCreationPhase.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class BlockInsertionSet;
+class Graph;
+struct BasicBlock;
+
+// Inserts dummy basic blocks before any loop headers that don't already have
+// a single non-loop predecessor.
+
+bool performLoopPreHeaderCreation(Graph&);
+
+// Creates a new basic block (a pre-header) that jumps to the given block. All
+// predecessors of the given block that aren't dominated by it are rerouted to
+// the pre-header.
+//
+// This function is used internally and it's used in a surgical fashion by
+// OSREntrypointCreationPhase.
+//
+// Note that executing this function requires having an intact dominators
+// analysis. You should run that analysis before doing damage to the CFG, even
+// if said damage is done before you call this.
+BasicBlock* createPreHeader(Graph&, BlockInsertionSet&, BasicBlock*);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGMaximalFlushInsertionPhase.cpp b/dfg/DFGMaximalFlushInsertionPhase.cpp
new file mode 100644
index 0000000..3e04b0c
--- /dev/null
+++ b/dfg/DFGMaximalFlushInsertionPhase.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGMaximalFlushInsertionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class MaximalFlushInsertionPhase : public Phase {
+public:
+    MaximalFlushInsertionPhase(Graph& graph)
+        : Phase(graph, "maximal flush insertion phase")
+    {
+    }
+    
+    bool run()
+    {
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_form == LoadStore);
+
+        InsertionSet insertionSet(m_graph);
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            treatRegularBlock(block, insertionSet);
+            insertionSet.execute(block);
+        }
+
+        treatRootBlock(m_graph.block(0), insertionSet);
+        insertionSet.execute(m_graph.block(0));
+
+        return true;
+    }
+
+    void treatRegularBlock(BasicBlock* block, InsertionSet& insertionSet)
+    {
+        Operands<VariableAccessData*> currentBlockAccessData(block->variablesAtTail.numberOfArguments(), block->variablesAtTail.numberOfLocals(), nullptr);
+        // Insert a Flush before every SetLocal to properly pattern the graph such that 
+        // any range between SetLocal and Flush has access to the local on the stack.
+        {
+            for (unsigned i = 0; i < block->size(); i++) {
+                Node* node = block->at(i);
+                bool isPrimordialSetArgument = node->op() == SetArgument && node->local().isArgument() && node == m_graph.m_arguments[node->local().toArgument()];
+                if (node->op() == SetLocal || (node->op() == SetArgument && !isPrimordialSetArgument)) {
+                    VirtualRegister operand = node->local();
+                    VariableAccessData* flushAccessData = currentBlockAccessData.operand(operand);
+                    if (!flushAccessData)
+                        flushAccessData = newVariableAccessData(operand);
+
+                    insertionSet.insertNode(i, SpecNone, 
+                        Flush, node->origin, OpInfo(flushAccessData));
+                }
+
+                if (node->accessesStack(m_graph))
+                    currentBlockAccessData.operand(node->local()) = node->variableAccessData();
+            }
+        }
+
+        // Flush everything at the end of the block.
+        {
+            NodeOrigin origin = block->at(block->size() - 1)->origin;
+            auto insertFlushAtEnd = [&] (VirtualRegister operand) {
+                VariableAccessData* accessData = currentBlockAccessData.operand(operand);
+                if (!accessData)
+                    accessData = newVariableAccessData(operand);
+
+                currentBlockAccessData.operand(operand) = accessData;
+
+                insertionSet.insertNode(block->size(), SpecNone, 
+                    Flush, origin, OpInfo(accessData));
+            };
+
+            for (unsigned i = 0; i < block->variablesAtTail.numberOfLocals(); i++)
+                insertFlushAtEnd(virtualRegisterForLocal(i));
+            for (unsigned i = 0; i < block->variablesAtTail.numberOfArguments(); i++)
+                insertFlushAtEnd(virtualRegisterForArgument(i));
+        }
+    }
+
+    void treatRootBlock(BasicBlock* block, InsertionSet& insertionSet)
+    {
+        Operands<VariableAccessData*> initialAccessData(block->variablesAtTail.numberOfArguments(), block->variablesAtTail.numberOfLocals(), nullptr);
+        Operands<Node*> initialAccessNodes(block->variablesAtTail.numberOfArguments(), block->variablesAtTail.numberOfLocals(), nullptr);
+        for (unsigned i = 0; i < block->size(); i++) {
+            Node* node = block->at(i);
+            if (!node->accessesStack(m_graph))
+                continue;
+
+            VirtualRegister operand = node->local();
+            if (initialAccessData.operand(operand))
+                continue;
+
+            DFG_ASSERT(m_graph, node, node->op() != SetLocal); // We should have inserted a Flush before this!
+            initialAccessData.operand(operand) = node->variableAccessData();
+            initialAccessNodes.operand(operand) = node;
+        }
+
+        // We want every Flush to be able to reach backwards to
+        // a SetLocal. Doing this in the root block achieves this goal.
+        NodeOrigin origin = block->at(0)->origin;
+        Node* undefined = insertionSet.insertConstant(0, origin, jsUndefined());
+
+        for (unsigned i = 0; i < block->variablesAtTail.numberOfLocals(); i++) {
+            VirtualRegister operand = virtualRegisterForLocal(i);
+            VariableAccessData* accessData;
+            DFG_ASSERT(m_graph, nullptr, initialAccessNodes.operand(operand)->op() == Flush); // We should have inserted a Flush before any SetLocal/SetArgument for the local that we are analyzing now.
+            accessData = initialAccessData.operand(operand);
+            DFG_ASSERT(m_graph, nullptr, accessData);
+            insertionSet.insertNode(0, SpecNone, 
+                SetLocal, origin, OpInfo(accessData), Edge(undefined));
+        }
+    }
+
+
+    VariableAccessData* newVariableAccessData(VirtualRegister operand)
+    {
+        ASSERT(!operand.isConstant());
+        
+        m_graph.m_variableAccessData.append(VariableAccessData(operand));
+        return &m_graph.m_variableAccessData.last();
+    }
+};
+
+bool performMaximalFlushInsertion(Graph& graph)
+{
+    return runPhase<MaximalFlushInsertionPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGMaximalFlushInsertionPhase.h b/dfg/DFGMaximalFlushInsertionPhase.h
new file mode 100644
index 0000000..af310e9
--- /dev/null
+++ b/dfg/DFGMaximalFlushInsertionPhase.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// This phase ensures we keep all locals/arguments flushed.
+// What this means is: any node inbetween a SetLocal and a Flush should
+// be able to observe that particular local on the stack. This phase patterns
+// the graph by inserting a Flush before each SetLocal such that the Flush 
+// we inserted can do a backwards search through all paths in the CFG and 
+// reach a SetLocal.
+// ....
+// SetLocal(locX)
+// <
+// |
+// ... We ensure that locX is available on the stack to any nodes in this region that may ask for locX.
+// |
+// >
+// Flush(locX)
+// SetLocal(locX)
+
+bool performMaximalFlushInsertion(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGMayExit.cpp b/dfg/DFGMayExit.cpp
new file mode 100644
index 0000000..4627905
--- /dev/null
+++ b/dfg/DFGMayExit.cpp
@@ -0,0 +1,206 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGMayExit.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAtTailAbstractState.h"
+#include "DFGGraph.h"
+#include "DFGNode.h"
+#include "DFGNullAbstractState.h"
+#include "Operations.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+template<typename StateType>
+ExitMode mayExitImpl(Graph& graph, Node* node, StateType& state)
+{
+    ExitMode result = DoesNotExit;
+    
+    switch (node->op()) {
+    // This is a carefully curated list of nodes that definitely do not exit. We try to be very
+    // conservative when maintaining this list, because adding new node types to it doesn't
+    // generally make things a lot better but it might introduce subtle bugs.
+    case SetArgument:
+    case JSConstant:
+    case DoubleConstant:
+    case LazyJSConstant:
+    case Int52Constant:
+    case MovHint:
+    case SetLocal:
+    case Flush:
+    case Phantom:
+    case Check:
+    case Identity:
+    case GetLocal:
+    case LoopHint:
+    case Phi:
+    case Upsilon:
+    case ZombieHint:
+    case ExitOK:
+    case BottomValue:
+    case PutHint:
+    case PhantomNewObject:
+    case PutStack:
+    case KillStack:
+    case GetStack:
+    case GetCallee:
+    case GetArgumentCountIncludingThis:
+    case GetRestLength:
+    case GetScope:
+    case PhantomLocal:
+    case CountExecution:
+    case Jump:
+    case Branch:
+    case Unreachable:
+    case DoubleRep:
+    case Int52Rep:
+    case ValueRep:
+    case ExtractOSREntryLocal:
+    case LogicalNot:
+    case NotifyWrite:
+    case PutStructure:
+    case StoreBarrier:
+    case FencedStoreBarrier:
+    case PutByOffset:
+    case PutClosureVar:
+    case RecordRegExpCachedResult:
+    case NukeStructureAndSetButterfly:
+        break;
+
+    case StrCat:
+    case Call:
+    case Construct:
+    case CallVarargs:
+    case CallEval:
+    case ConstructVarargs:
+    case CallForwardVarargs:
+    case ConstructForwardVarargs:
+    case CreateActivation:
+    case MaterializeCreateActivation:
+    case MaterializeNewObject:
+    case NewFunction:
+    case NewGeneratorFunction:
+    case NewAsyncFunction:
+    case NewStringObject:
+    case ToNumber:
+        result = ExitsForExceptions;
+        break;
+
+    default:
+        // If in doubt, return true.
+        return Exits;
+    }
+    
+    graph.doToChildren(
+        node,
+        [&] (Edge& edge) {
+            if (state) {
+                // Ignore the Check flag on the edge. This is important because that flag answers
+                // the question: "would this edge have had a check if it executed wherever it
+                // currently resides in control flow?" But when a state is passed, we want to ask a
+                // different question: "would this edge have a check if it executed wherever this
+                // state is?" Using the Check flag for this purpose wouldn't even be conservatively
+                // correct. It would be wrong in both directions.
+                if (mayHaveTypeCheck(edge.useKind())
+                    && (state.forNode(edge).m_type & ~typeFilterFor(edge.useKind()))) {
+                    result = Exits;
+                    return;
+                }
+            } else {
+                // FIXME: Maybe this should call mayHaveTypeCheck(edge.useKind()) instead.
+                // https://bugs.webkit.org/show_bug.cgi?id=148545
+                if (edge.willHaveCheck()) {
+                    result = Exits;
+                    return;
+                }
+            }
+            
+            switch (edge.useKind()) {
+            // These are shady because nodes that have these use kinds will typically exit for
+            // unrelated reasons. For example CompareEq doesn't usually exit, but if it uses
+            // ObjectUse then it will.
+            case ObjectUse:
+            case ObjectOrOtherUse:
+                result = Exits;
+                break;
+                
+            // These are shady because they check the structure even if the type of the child node
+            // passes the StringObject type filter.
+            case StringObjectUse:
+            case StringOrStringObjectUse:
+                result = Exits;
+                break;
+                
+            default:
+                break;
+            }
+        });
+
+    return result;
+}
+
+} // anonymous namespace
+
+ExitMode mayExit(Graph& graph, Node* node)
+{
+    NullAbstractState state;
+    return mayExitImpl(graph, node, state);
+}
+
+ExitMode mayExit(Graph& graph, Node* node, AtTailAbstractState& state)
+{
+    return mayExitImpl(graph, node, state);
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, ExitMode mode)
+{
+    switch (mode) {
+    case DoesNotExit:
+        out.print("DoesNotExit");
+        return;
+    case ExitsForExceptions:
+        out.print("ExitsForExceptions");
+        return;
+    case Exits:
+        out.print("Exits");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGMayExit.h b/dfg/DFGMayExit.h
new file mode 100644
index 0000000..c605b26
--- /dev/null
+++ b/dfg/DFGMayExit.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class AtTailAbstractState;
+class Graph;
+struct Node;
+
+// A *very* conservative approximation of whether or not a node could possibly exit. Usually
+// returns true except in cases where we obviously don't expect an exit.
+
+enum ExitMode {
+    // The node does not exit at all. This means that it's legal to eliminate the first store in a
+    // program like:
+    //
+    // global = 1 // first store
+    // DoesNotExit(); // let's assume that this also doesn't read "global"
+    // global = 2 // second store
+    //
+    // It's legal to eliminate the first one since nobody will see it; the second store is always
+    // executed right after.
+    DoesNotExit,
+
+    // The node will exit, but only by properly throwing exceptions. A proper exception throw will
+    // divert execution to the matching op_catch and will not reexecute the exit origin. This means
+    // that the store elimination optimization above would be illegal, but the following would be OK:
+    //
+    // SideEffect(..., exit: bc#42)
+    // ExitsForExceptions(..., exit: #bc42, ExitInvalid)
+    //
+    // In particular, it's OK for a node that reports ExitsForExceptions to be executed in a context
+    // where !Node::origin.exitOK. That's because this node will not exit in a manner that could lead
+    // to the reexecution of SideEffect().
+    ExitsForExceptions,
+
+    // The node will exit to the exit origin. This means that we cannot do store elimination like for
+    // DoesNotExit and also we cannot place this node in an ExitInvalid context, since this will exit
+    // in a manner that will cause the reexecution of all previous operations within this exit origin.
+    Exits
+};
+
+// FIXME: This currently consumes the Check: flag produced by AI, and will claim that something doesn't
+// exit if the Check: flag was cleared. This makes it hard to use mayExit() for things like hoisting
+// (for example in LICM), since that wants to know if the node would exit if it was moved somewhere
+// else.
+// https://bugs.webkit.org/show_bug.cgi?id=148545
+
+ExitMode mayExit(Graph&, Node*);
+
+// Like mayExit(), but instead of using the Check: flag to determine if something exits, it
+// evaluates whether it will exit based on the tail state. This is useful for LICM. This *may* also
+// use the AtTailAbstractState to return more precise answers for other nodes.
+ExitMode mayExit(Graph&, Node*, AtTailAbstractState&);
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::DFG::ExitMode);
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGMinifiedGraph.cpp b/dfg/DFGMinifiedGraph.cpp
new file mode 100644
index 0000000..61f331f
--- /dev/null
+++ b/dfg/DFGMinifiedGraph.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGMinifiedGraph.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+#include "TrackedReferences.h"
+
+namespace JSC { namespace DFG {
+
+void MinifiedGraph::prepareAndShrink()
+{
+    std::sort(m_list.begin(), m_list.end(), MinifiedNode::compareByNodeIndex);
+    m_list.shrinkToFit();
+}
+
+void MinifiedGraph::validateReferences(const TrackedReferences& trackedReferences)
+{
+    for (MinifiedNode& node : m_list) {
+        if (node.hasConstant())
+            trackedReferences.check(node.constant());
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGMinifiedGraph.h b/dfg/DFGMinifiedGraph.h
new file mode 100644
index 0000000..6071460
--- /dev/null
+++ b/dfg/DFGMinifiedGraph.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGMinifiedNode.h"
+#include <algorithm>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace DFG {
+
+class MinifiedGraph {
+public:
+    MinifiedGraph() { }
+
+    MinifiedNode* at(MinifiedID id)
+    {
+        return tryBinarySearch<MinifiedNode, MinifiedID>(
+            m_list, m_list.size(), id, MinifiedNode::getID);
+    }
+    
+    void append(const MinifiedNode& node)
+    {
+        m_list.append(node);
+    }
+    
+    void prepareAndShrink();
+    
+    void validateReferences(const TrackedReferences&);
+    
+private:
+    Vector<MinifiedNode> m_list;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGMinifiedID.h b/dfg/DFGMinifiedID.h
new file mode 100644
index 0000000..f741e7e
--- /dev/null
+++ b/dfg/DFGMinifiedID.h
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGCommon.h"
+#include <wtf/HashMap.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+class Graph;
+class MinifiedNode;
+class ValueSource;
+struct Node;
+
+class MinifiedID {
+public:
+    MinifiedID() : m_id(invalidID()) { }
+    MinifiedID(WTF::HashTableDeletedValueType) : m_id(otherInvalidID()) { }
+    explicit MinifiedID(Node* node) : m_id(bitwise_cast<uintptr_t>(node)) { }
+    
+    bool operator!() const { return m_id == invalidID(); }
+    
+    // This takes Graph& to remind you, that you should only be calling this method
+    // when you're in the main compilation pass (i.e. you have a graph) and not later,
+    // like during OSR exit compilation.
+    Node* node(const Graph&) const { return bitwise_cast<Node*>(m_id); }
+    
+    bool operator==(const MinifiedID& other) const { return m_id == other.m_id; }
+    bool operator!=(const MinifiedID& other) const { return m_id != other.m_id; }
+    bool operator<(const MinifiedID& other) const { return m_id < other.m_id; }
+    bool operator>(const MinifiedID& other) const { return m_id > other.m_id; }
+    bool operator<=(const MinifiedID& other) const { return m_id <= other.m_id; }
+    bool operator>=(const MinifiedID& other) const { return m_id >= other.m_id; }
+    
+    unsigned hash() const { return WTF::IntHash<uintptr_t>::hash(m_id); }
+    
+    void dump(PrintStream& out) const { out.print(RawPointer(reinterpret_cast<void*>(m_id))); }
+    
+    bool isHashTableDeletedValue() const { return m_id == otherInvalidID(); }
+    
+    static MinifiedID fromBits(uintptr_t value)
+    {
+        MinifiedID result;
+        result.m_id = value;
+        return result;
+    }
+    
+    uintptr_t bits() const { return m_id; }
+
+private:
+    friend class MinifiedNode;
+    
+    static uintptr_t invalidID() { return static_cast<uintptr_t>(static_cast<intptr_t>(-1)); }
+    static uintptr_t otherInvalidID() { return static_cast<uintptr_t>(static_cast<intptr_t>(-2)); }
+    
+    uintptr_t m_id;
+};
+
+struct MinifiedIDHash {
+    static unsigned hash(const MinifiedID& key) { return key.hash(); }
+    static bool equal(const MinifiedID& a, const MinifiedID& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::MinifiedID> {
+    typedef JSC::DFG::MinifiedIDHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::MinifiedID> : SimpleClassHashTraits<JSC::DFG::MinifiedID> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
diff --git a/dfg/DFGMinifiedNode.cpp b/dfg/DFGMinifiedNode.cpp
new file mode 100644
index 0000000..80795c2
--- /dev/null
+++ b/dfg/DFGMinifiedNode.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGMinifiedNode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNode.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+MinifiedNode MinifiedNode::fromNode(Node* node)
+{
+    ASSERT(belongsInMinifiedGraph(node->op()));
+    MinifiedNode result;
+    result.m_id = MinifiedID(node);
+    result.m_op = node->op();
+    if (hasConstant(node->op()))
+        result.m_info = JSValue::encode(node->asJSValue());
+    else {
+        ASSERT(node->op() == PhantomDirectArguments || node->op() == PhantomClonedArguments);
+        result.m_info = bitwise_cast<uintptr_t>(node->origin.semantic.inlineCallFrame);
+    }
+    return result;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGMinifiedNode.h b/dfg/DFGMinifiedNode.h
new file mode 100644
index 0000000..29f6da3
--- /dev/null
+++ b/dfg/DFGMinifiedNode.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012, 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGMinifiedID.h"
+#include "DFGNodeType.h"
+
+namespace JSC { namespace DFG {
+
+struct Node;
+
+inline bool belongsInMinifiedGraph(NodeType type)
+{
+    switch (type) {
+    case JSConstant:
+    case Int52Constant:
+    case DoubleConstant:
+    case PhantomDirectArguments:
+    case PhantomClonedArguments:
+        return true;
+    default:
+        return false;
+    }
+}
+
+class MinifiedNode {
+public:
+    MinifiedNode() { }
+    
+    static MinifiedNode fromNode(Node*);
+    
+    MinifiedID id() const { return m_id; }
+    NodeType op() const { return m_op; }
+    
+    bool hasConstant() const { return hasConstant(m_op); }
+    
+    JSValue constant() const
+    {
+        return JSValue::decode(bitwise_cast<EncodedJSValue>(m_info));
+    }
+    
+    bool hasInlineCallFrame() const { return hasInlineCallFrame(m_op); }
+    
+    InlineCallFrame* inlineCallFrame() const
+    {
+        return bitwise_cast<InlineCallFrame*>(static_cast<uintptr_t>(m_info));
+    }
+    
+    static MinifiedID getID(MinifiedNode* node) { return node->id(); }
+    static bool compareByNodeIndex(const MinifiedNode& a, const MinifiedNode& b)
+    {
+        return a.m_id < b.m_id;
+    }
+    
+private:
+    static bool hasConstant(NodeType type)
+    {
+        return type == JSConstant || type == Int52Constant || type == DoubleConstant;
+    }
+    
+    static bool hasInlineCallFrame(NodeType type)
+    {
+        return type == PhantomDirectArguments || type == PhantomClonedArguments;
+    }
+    
+    MinifiedID m_id;
+    uint64_t m_info;
+    NodeType m_op;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGMovHintRemovalPhase.cpp b/dfg/DFGMovHintRemovalPhase.cpp
new file mode 100644
index 0000000..9f344b3
--- /dev/null
+++ b/dfg/DFGMovHintRemovalPhase.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGMovHintRemovalPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "BytecodeLivenessAnalysisInlines.h"
+#include "DFGEpoch.h"
+#include "DFGForAllKills.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGMayExit.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include "OperandsInlines.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verbose = false;
+
+class MovHintRemovalPhase : public Phase {
+public:
+    MovHintRemovalPhase(Graph& graph)
+        : Phase(graph, "MovHint removal")
+        , m_state(OperandsLike, graph.block(0)->variablesAtHead)
+        , m_changed(false)
+    {
+    }
+    
+    bool run()
+    {
+        if (verbose) {
+            dataLog("Graph before MovHint removal:\n");
+            m_graph.dump();
+        }
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder())
+            handleBlock(block);
+        
+        return m_changed;
+    }
+
+private:
+    void handleBlock(BasicBlock* block)
+    {
+        if (verbose)
+            dataLog("Handing block ", pointerDump(block), "\n");
+        
+        // A MovHint is unnecessary if the local dies before it is used. We answer this question by
+        // maintaining the current exit epoch, and associating an epoch with each local. When a
+        // local dies, it gets the current exit epoch. If a MovHint occurs in the same epoch as its
+        // local, then it means there was no exit between the local's death and the MovHint - i.e.
+        // the MovHint is unnecessary.
+        
+        Epoch currentEpoch = Epoch::first();
+        
+        m_state.fill(Epoch());
+        m_graph.forAllLiveInBytecode(
+            block->terminal()->origin.forExit,
+            [&] (VirtualRegister reg) {
+                m_state.operand(reg) = currentEpoch;
+            });
+        
+        if (verbose)
+            dataLog("    Locals: ", m_state, "\n");
+        
+        // Assume that blocks after us exit.
+        currentEpoch.bump();
+        
+        for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+            Node* node = block->at(nodeIndex);
+            
+            if (node->op() == MovHint) {
+                Epoch localEpoch = m_state.operand(node->unlinkedLocal());
+                if (verbose)
+                    dataLog("    At ", node, ": current = ", currentEpoch, ", local = ", localEpoch, "\n");
+                if (!localEpoch || localEpoch == currentEpoch) {
+                    node->setOpAndDefaultFlags(ZombieHint);
+                    node->child1() = Edge();
+                    m_changed = true;
+                }
+                m_state.operand(node->unlinkedLocal()) = Epoch();
+            }
+            
+            if (mayExit(m_graph, node) != DoesNotExit)
+                currentEpoch.bump();
+            
+            if (nodeIndex) {
+                forAllKilledOperands(
+                    m_graph, block->at(nodeIndex - 1), node,
+                    [&] (VirtualRegister reg) {
+                        // This function is a bit sloppy - it might claim to kill a local even if
+                        // it's still live after. We need to protect against that.
+                        if (!!m_state.operand(reg))
+                            return;
+                        
+                        if (verbose)
+                            dataLog("    Killed operand at ", node, ": ", reg, "\n");
+                        m_state.operand(reg) = currentEpoch;
+                    });
+            }
+        }
+    }
+    
+    Operands<Epoch> m_state;
+    bool m_changed;
+};
+
+} // anonymous namespace
+    
+bool performMovHintRemoval(Graph& graph)
+{
+    return runPhase<MovHintRemovalPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGMovHintRemovalPhase.h b/dfg/DFGMovHintRemovalPhase.h
new file mode 100644
index 0000000..f0faf84
--- /dev/null
+++ b/dfg/DFGMovHintRemovalPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Cleans up unnecessary MovHints. A MovHint is necessary if the variable dies before there is an
+// exit.
+
+bool performMovHintRemoval(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGMultiGetByOffsetData.cpp b/dfg/DFGMultiGetByOffsetData.cpp
new file mode 100644
index 0000000..4dcab5f
--- /dev/null
+++ b/dfg/DFGMultiGetByOffsetData.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGMultiGetByOffsetData.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGFrozenValue.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void GetByOffsetMethod::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    out.print(m_kind, ":");
+    switch (m_kind) {
+    case Invalid:
+        out.print("<none>");
+        return;
+    case Constant:
+        out.print(pointerDumpInContext(constant(), context));
+        return;
+    case Load:
+        out.print(offset());
+        return;
+    case LoadFromPrototype:
+        out.print(offset(), "@", pointerDumpInContext(prototype(), context));
+        return;
+    }
+}
+
+void GetByOffsetMethod::dump(PrintStream& out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+void MultiGetByOffsetCase::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    out.print(inContext(m_set.toStructureSet(), context), ":", inContext(m_method, context));
+}
+
+void MultiGetByOffsetCase::dump(PrintStream& out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, GetByOffsetMethod::Kind kind)
+{
+    switch (kind) {
+    case GetByOffsetMethod::Invalid:
+        out.print("Invalid");
+        return;
+    case GetByOffsetMethod::Constant:
+        out.print("Constant");
+        return;
+    case GetByOffsetMethod::Load:
+        out.print("Load");
+        return;
+    case GetByOffsetMethod::LoadFromPrototype:
+        out.print("LoadFromPrototype");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGMultiGetByOffsetData.h b/dfg/DFGMultiGetByOffsetData.h
new file mode 100644
index 0000000..d5ec0e0
--- /dev/null
+++ b/dfg/DFGMultiGetByOffsetData.h
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGRegisteredStructureSet.h"
+#include "DumpContext.h"
+#include "JSObject.h"
+#include "StructureSet.h"
+
+namespace JSC { namespace DFG {
+
+class FrozenValue;
+
+class GetByOffsetMethod {
+public:
+    enum Kind {
+        Invalid,
+        // Constant might mean either that we have some fixed property or that the
+        // property is unset and we know the result is undefined. We don't distingish
+        // between these cases because no one cares about this distintion yet.
+        Constant,
+        Load,
+        LoadFromPrototype
+    };
+    
+    GetByOffsetMethod()
+        : m_kind(Invalid)
+    {
+    }
+    
+    static GetByOffsetMethod constant(FrozenValue* value)
+    {
+        GetByOffsetMethod result;
+        result.m_kind = Constant;
+        result.u.constant = value;
+        return result;
+    }
+    
+    static GetByOffsetMethod load(PropertyOffset offset)
+    {
+        GetByOffsetMethod result;
+        result.m_kind = Load;
+        result.u.load.offset = offset;
+        return result;
+    }
+    
+    static GetByOffsetMethod loadFromPrototype(FrozenValue* prototype, PropertyOffset offset)
+    {
+        GetByOffsetMethod result;
+        result.m_kind = LoadFromPrototype;
+        result.u.load.prototype = prototype;
+        result.u.load.offset = offset;
+        return result;
+    }
+    
+    bool operator!() const { return m_kind == Invalid; }
+    
+    Kind kind() const { return m_kind; }
+    
+    FrozenValue* constant() const
+    {
+        ASSERT(kind() == Constant);
+        return u.constant;
+    }
+    
+    FrozenValue* prototype() const
+    {
+        ASSERT(kind() == LoadFromPrototype);
+        return u.load.prototype;
+    }
+    
+    PropertyOffset offset() const
+    {
+        ASSERT(kind() == Load || kind() == LoadFromPrototype);
+        return u.load.offset;
+    }
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+    
+private:
+    union {
+        FrozenValue* constant;
+        struct {
+            FrozenValue* prototype;
+            PropertyOffset offset;
+        } load;
+    } u;
+    Kind m_kind;
+};
+
+class MultiGetByOffsetCase {
+public:
+    MultiGetByOffsetCase()
+    {
+    }
+    
+    MultiGetByOffsetCase(const RegisteredStructureSet& set, const GetByOffsetMethod& method)
+        : m_set(set)
+        , m_method(method)
+    {
+    }
+    
+    RegisteredStructureSet& set() { return m_set; }
+    const RegisteredStructureSet& set() const { return m_set; }
+    const GetByOffsetMethod& method() const { return m_method; }
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+
+private:
+    RegisteredStructureSet m_set;
+    GetByOffsetMethod m_method;
+};
+
+struct MultiGetByOffsetData {
+    unsigned identifierNumber;
+    Vector<MultiGetByOffsetCase, 2> cases;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::GetByOffsetMethod::Kind);
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGNaturalLoops.cpp b/dfg/DFGNaturalLoops.cpp
new file mode 100644
index 0000000..1b74724
--- /dev/null
+++ b/dfg/DFGNaturalLoops.cpp
@@ -0,0 +1,218 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNaturalLoops.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "JSCInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC { namespace DFG {
+
+void NaturalLoop::dump(PrintStream& out) const
+{
+    out.print("[Header: ", *header(), ", Body:");
+    for (unsigned i = 0; i < m_body.size(); ++i)
+        out.print(" ", *m_body[i]);
+    out.print("]");
+}
+
+NaturalLoops::NaturalLoops(Graph& graph)
+{
+    ASSERT(graph.m_dominators);
+
+    // Implement the classic dominator-based natural loop finder. The first
+    // step is to find all control flow edges A -> B where B dominates A.
+    // Then B is a loop header and A is a backward branching block. We will
+    // then accumulate, for each loop header, multiple backward branching
+    // blocks. Then we backwards graph search from the backward branching
+    // blocks to their loop headers, which gives us all of the blocks in the
+    // loop body.
+    
+    static const bool verbose = false;
+    
+    if (verbose) {
+        dataLog("Dominators:\n");
+        graph.m_dominators->dump(WTF::dataFile());
+    }
+    
+    m_loops.resize(0);
+    
+    for (BlockIndex blockIndex = graph.numBlocks(); blockIndex--;) {
+        BasicBlock* block = graph.block(blockIndex);
+        if (!block)
+            continue;
+        
+        for (unsigned i = block->numSuccessors(); i--;) {
+            BasicBlock* successor = block->successor(i);
+            if (!graph.m_dominators->dominates(successor, block))
+                continue;
+            bool found = false;
+            for (unsigned j = m_loops.size(); j--;) {
+                if (m_loops[j].header() == successor) {
+                    m_loops[j].addBlock(block);
+                    found = true;
+                    break;
+                }
+            }
+            if (found)
+                continue;
+            NaturalLoop loop(successor, m_loops.size());
+            loop.addBlock(block);
+            m_loops.append(loop);
+        }
+    }
+    
+    if (verbose)
+        dataLog("After bootstrap: ", *this, "\n");
+    
+    FastBitVector seenBlocks;
+    Vector<BasicBlock*, 4> blockWorklist;
+    seenBlocks.resize(graph.numBlocks());
+    
+    for (unsigned i = m_loops.size(); i--;) {
+        NaturalLoop& loop = m_loops[i];
+        
+        seenBlocks.clearAll();
+        ASSERT(blockWorklist.isEmpty());
+        
+        if (verbose)
+            dataLog("Dealing with loop ", loop, "\n");
+        
+        for (unsigned j = loop.size(); j--;) {
+            seenBlocks[loop[j]->index] = true;
+            blockWorklist.append(loop[j]);
+        }
+        
+        while (!blockWorklist.isEmpty()) {
+            BasicBlock* block = blockWorklist.takeLast();
+            
+            if (verbose)
+                dataLog("    Dealing with ", *block, "\n");
+            
+            if (block == loop.header())
+                continue;
+            
+            for (unsigned j = block->predecessors.size(); j--;) {
+                BasicBlock* predecessor = block->predecessors[j];
+                if (seenBlocks[predecessor->index])
+                    continue;
+                
+                loop.addBlock(predecessor);
+                blockWorklist.append(predecessor);
+                seenBlocks[predecessor->index] = true;
+            }
+        }
+    }
+
+    // Figure out reverse mapping from blocks to loops.
+    for (BlockIndex blockIndex = graph.numBlocks(); blockIndex--;) {
+        BasicBlock* block = graph.block(blockIndex);
+        if (!block)
+            continue;
+        for (unsigned i = BasicBlock::numberOfInnerMostLoopIndices; i--;)
+            block->innerMostLoopIndices[i] = UINT_MAX;
+    }
+    for (unsigned loopIndex = m_loops.size(); loopIndex--;) {
+        NaturalLoop& loop = m_loops[loopIndex];
+        
+        for (unsigned blockIndexInLoop = loop.size(); blockIndexInLoop--;) {
+            BasicBlock* block = loop[blockIndexInLoop];
+            
+            for (unsigned i = 0; i < BasicBlock::numberOfInnerMostLoopIndices; ++i) {
+                unsigned thisIndex = block->innerMostLoopIndices[i];
+                if (thisIndex == UINT_MAX || loop.size() < m_loops[thisIndex].size()) {
+                    insertIntoBoundedVector(
+                        block->innerMostLoopIndices, BasicBlock::numberOfInnerMostLoopIndices,
+                        loopIndex, i);
+                    break;
+                }
+            }
+        }
+    }
+    
+    // Now each block knows its inner-most loop and its next-to-inner-most loop. Use
+    // this to figure out loop parenting.
+    for (unsigned i = m_loops.size(); i--;) {
+        NaturalLoop& loop = m_loops[i];
+        RELEASE_ASSERT(loop.header()->innerMostLoopIndices[0] == i);
+        
+        loop.m_outerLoopIndex = loop.header()->innerMostLoopIndices[1];
+    }
+    
+    if (validationEnabled()) {
+        // Do some self-verification that we've done some of this correctly.
+        
+        for (BlockIndex blockIndex = graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            Vector<const NaturalLoop*> simpleLoopsOf;
+            
+            for (unsigned i = m_loops.size(); i--;) {
+                if (m_loops[i].contains(block))
+                    simpleLoopsOf.append(&m_loops[i]);
+            }
+            
+            Vector<const NaturalLoop*> fancyLoopsOf = loopsOf(block);
+            
+            std::sort(simpleLoopsOf.begin(), simpleLoopsOf.end());
+            std::sort(fancyLoopsOf.begin(), fancyLoopsOf.end());
+            
+            RELEASE_ASSERT(simpleLoopsOf == fancyLoopsOf);
+        }
+    }
+    
+    if (verbose)
+        dataLog("Results: ", *this, "\n");
+}
+
+NaturalLoops::~NaturalLoops() { }
+
+Vector<const NaturalLoop*> NaturalLoops::loopsOf(BasicBlock* block) const
+{
+    Vector<const NaturalLoop*> result;
+    for (const NaturalLoop* loop = innerMostLoopOf(block); loop; loop = innerMostOuterLoop(*loop))
+        result.append(loop);
+    return result;
+}
+
+void NaturalLoops::dump(PrintStream& out) const
+{
+    out.print("NaturalLoops:{");
+    CommaPrinter comma;
+    for (unsigned i = 0; i < m_loops.size(); ++i)
+        out.print(comma, m_loops[i]);
+    out.print("}");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGNaturalLoops.h b/dfg/DFGNaturalLoops.h
new file mode 100644
index 0000000..3f5e580
--- /dev/null
+++ b/dfg/DFGNaturalLoops.h
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include "DFGCommon.h"
+#include "DFGDominators.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace DFG {
+
+class NaturalLoops;
+
+class NaturalLoop {
+public:
+    NaturalLoop()
+        : m_header(0)
+        , m_outerLoopIndex(UINT_MAX)
+    {
+    }
+    
+    NaturalLoop(BasicBlock* header, unsigned index)
+        : m_header(header)
+        , m_outerLoopIndex(UINT_MAX)
+        , m_index(index)
+    {
+    }
+    
+    BasicBlock* header() const { return m_header; }
+    
+    unsigned size() const { return m_body.size(); }
+    BasicBlock* at(unsigned i) const { return m_body[i]; }
+    BasicBlock* operator[](unsigned i) const { return at(i); }
+
+    // This is the slower, but simpler, way of asking if a block belongs to
+    // a natural loop. It's faster to call NaturalLoops::belongsTo(), which
+    // tries to be O(loop depth) rather than O(loop size). Loop depth is
+    // almost always smaller than loop size. A *lot* smaller.
+    bool contains(BasicBlock* block) const
+    {
+        for (unsigned i = m_body.size(); i--;) {
+            if (m_body[i] == block)
+                return true;
+        }
+        ASSERT(block != header()); // Header should be contained.
+        return false;
+    }
+
+    // The index of this loop in NaturalLoops.
+    unsigned index() const { return m_index; }
+    
+    bool isOuterMostLoop() const { return m_outerLoopIndex == UINT_MAX; }
+    
+    void dump(PrintStream&) const;
+private:
+    friend class NaturalLoops;
+    
+    void addBlock(BasicBlock* block) { m_body.append(block); }
+    
+    BasicBlock* m_header;
+    Vector<BasicBlock*, 4> m_body;
+    unsigned m_outerLoopIndex;
+    unsigned m_index;
+};
+
+class NaturalLoops {
+    WTF_MAKE_NONCOPYABLE(NaturalLoops);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    NaturalLoops(Graph&);
+    ~NaturalLoops();
+    
+    unsigned numLoops() const
+    {
+        return m_loops.size();
+    }
+    const NaturalLoop& loop(unsigned i) const
+    {
+        return m_loops[i];
+    }
+    
+    // Return either null if the block isn't a loop header, or the
+    // loop it belongs to.
+    const NaturalLoop* headerOf(BasicBlock* block) const
+    {
+        const NaturalLoop* loop = innerMostLoopOf(block);
+        if (!loop)
+            return 0;
+        if (loop->header() == block)
+            return loop;
+        if (!ASSERT_DISABLED) {
+            for (; loop; loop = innerMostOuterLoop(*loop))
+                ASSERT(loop->header() != block);
+        }
+        return 0;
+    }
+    
+    const NaturalLoop* innerMostLoopOf(BasicBlock* block) const
+    {
+        unsigned index = block->innerMostLoopIndices[0];
+        if (index == UINT_MAX)
+            return 0;
+        return &m_loops[index];
+    }
+    
+    const NaturalLoop* innerMostOuterLoop(const NaturalLoop& loop) const
+    {
+        if (loop.m_outerLoopIndex == UINT_MAX)
+            return 0;
+        return &m_loops[loop.m_outerLoopIndex];
+    }
+    
+    bool belongsTo(BasicBlock* block, const NaturalLoop& candidateLoop) const
+    {
+        // It's faster to do this test using the loop itself, if it's small.
+        if (candidateLoop.size() < 4)
+            return candidateLoop.contains(block);
+        
+        for (const NaturalLoop* loop = innerMostLoopOf(block); loop; loop = innerMostOuterLoop(*loop)) {
+            if (loop == &candidateLoop)
+                return true;
+        }
+        return false;
+    }
+    
+    unsigned loopDepth(BasicBlock* block) const
+    {
+        unsigned depth = 0;
+        for (const NaturalLoop* loop = innerMostLoopOf(block); loop; loop = innerMostOuterLoop(*loop))
+            depth++;
+        return depth;
+    }
+    
+    // Return the indices of all loops this belongs to.
+    Vector<const NaturalLoop*> loopsOf(BasicBlock*) const;
+
+    void dump(PrintStream&) const;
+private:
+    // If we ever had a scalability problem in our natural loop finder, we could
+    // use some HashMap's here. But it just feels a heck of a lot less convenient.
+    Vector<NaturalLoop, 4> m_loops;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGNode.cpp b/dfg/DFGNode.cpp
new file mode 100644
index 0000000..76cc0da
--- /dev/null
+++ b/dfg/DFGNode.cpp
@@ -0,0 +1,299 @@
+/*
+ * Copyright (C) 2013, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGPromotedHeapLocation.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+bool MultiPutByOffsetData::writesStructures() const
+{
+    for (unsigned i = variants.size(); i--;) {
+        if (variants[i].writesStructures())
+            return true;
+    }
+    return false;
+}
+
+bool MultiPutByOffsetData::reallocatesStorage() const
+{
+    for (unsigned i = variants.size(); i--;) {
+        if (variants[i].reallocatesStorage())
+            return true;
+    }
+    return false;
+}
+
+void BranchTarget::dump(PrintStream& out) const
+{
+    if (!block)
+        return;
+    
+    out.print(*block);
+    
+    if (count == count) // If the count is not NaN, then print it.
+        out.print("/w:", count);
+}
+
+bool Node::hasVariableAccessData(Graph& graph)
+{
+    switch (op()) {
+    case Phi:
+        return graph.m_form != SSA;
+    case GetLocal:
+    case SetLocal:
+    case SetArgument:
+    case Flush:
+    case PhantomLocal:
+        return true;
+    default:
+        return false;
+    }
+}
+
+void Node::remove()
+{
+    ASSERT(!(flags() & NodeHasVarArgs));
+    
+    children = children.justChecks();
+    
+    setOpAndDefaultFlags(Check);
+}
+
+void Node::convertToIdentity()
+{
+    RELEASE_ASSERT(child1());
+    RELEASE_ASSERT(!child2());
+    NodeFlags result = canonicalResultRepresentation(this->result());
+    setOpAndDefaultFlags(Identity);
+    setResult(result);
+}
+
+void Node::convertToIdentityOn(Node* child)
+{
+    children.reset();
+    child1() = child->defaultEdge();
+    NodeFlags output = canonicalResultRepresentation(this->result());
+    NodeFlags input = canonicalResultRepresentation(child->result());
+    if (output == input) {
+        setOpAndDefaultFlags(Identity);
+        setResult(output);
+        return;
+    }
+    switch (output) {
+    case NodeResultDouble:
+        setOpAndDefaultFlags(DoubleRep);
+        switch (input) {
+        case NodeResultInt52:
+            child1().setUseKind(Int52RepUse);
+            return;
+        case NodeResultJS:
+            child1().setUseKind(NumberUse);
+            return;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+    case NodeResultInt52:
+        setOpAndDefaultFlags(Int52Rep);
+        switch (input) {
+        case NodeResultDouble:
+            child1().setUseKind(DoubleRepAnyIntUse);
+            return;
+        case NodeResultJS:
+            child1().setUseKind(AnyIntUse);
+            return;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+    case NodeResultJS:
+        setOpAndDefaultFlags(ValueRep);
+        switch (input) {
+        case NodeResultDouble:
+            child1().setUseKind(DoubleRepUse);
+            return;
+        case NodeResultInt52:
+            child1().setUseKind(Int52RepUse);
+            return;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+}
+
+void Node::convertToLazyJSConstant(Graph& graph, LazyJSValue value)
+{
+    m_op = LazyJSConstant;
+    m_flags &= ~NodeMustGenerate;
+    m_opInfo = graph.m_lazyJSValues.add(value);
+    children.reset();
+}
+
+void Node::convertToPutHint(const PromotedLocationDescriptor& descriptor, Node* base, Node* value)
+{
+    m_op = PutHint;
+    m_opInfo = descriptor.imm1();
+    m_opInfo2 = descriptor.imm2();
+    child1() = base->defaultEdge();
+    child2() = value->defaultEdge();
+    child3() = Edge();
+}
+
+void Node::convertToPutStructureHint(Node* structure)
+{
+    ASSERT(m_op == PutStructure);
+    ASSERT(structure->castConstant<Structure*>() == transition()->next.get());
+    convertToPutHint(StructurePLoc, child1().node(), structure);
+}
+
+void Node::convertToPutByOffsetHint()
+{
+    ASSERT(m_op == PutByOffset);
+    convertToPutHint(
+        PromotedLocationDescriptor(NamedPropertyPLoc, storageAccessData().identifierNumber),
+        child2().node(), child3().node());
+}
+
+void Node::convertToPutClosureVarHint()
+{
+    ASSERT(m_op == PutClosureVar);
+    convertToPutHint(
+        PromotedLocationDescriptor(ClosureVarPLoc, scopeOffset().offset()),
+        child1().node(), child2().node());
+}
+
+void Node::convertToDirectCall(FrozenValue* executable)
+{
+    NodeType newOp = LastNodeType;
+    switch (op()) {
+    case Call:
+        newOp = DirectCall;
+        break;
+    case Construct:
+        newOp = DirectConstruct;
+        break;
+    case TailCallInlinedCaller:
+        newOp = DirectTailCallInlinedCaller;
+        break;
+    case TailCall:
+        newOp = DirectTailCall;
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    
+    m_op = newOp;
+    m_opInfo = executable;
+}
+
+void Node::convertToCallDOM(Graph& graph)
+{
+    ASSERT(op() == Call);
+    ASSERT(signature());
+
+    Edge edges[3];
+    // Skip the first one. This is callee.
+    RELEASE_ASSERT(numChildren() <= 4);
+    for (unsigned i = 1; i < numChildren(); ++i)
+        edges[i - 1] = graph.varArgChild(this, i);
+
+    setOpAndDefaultFlags(CallDOM);
+    children.setChild1(edges[0]);
+    children.setChild2(edges[1]);
+    children.setChild3(edges[2]);
+
+    if (!signature()->effect.mustGenerate())
+        clearFlags(NodeMustGenerate);
+}
+
+String Node::tryGetString(Graph& graph)
+{
+    if (hasConstant())
+        return constant()->tryGetString(graph);
+    if (hasLazyJSValue())
+        return lazyJSValue().tryGetString(graph);
+    return String();
+}
+
+PromotedLocationDescriptor Node::promotedLocationDescriptor()
+{
+    return PromotedLocationDescriptor(static_cast<PromotedLocationKind>(m_opInfo.as<uint32_t>()), m_opInfo2.as<uint32_t>());
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+using namespace JSC;
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, SwitchKind kind)
+{
+    switch (kind) {
+    case SwitchImm:
+        out.print("SwitchImm");
+        return;
+    case SwitchChar:
+        out.print("SwitchChar");
+        return;
+    case SwitchString:
+        out.print("SwitchString");
+        return;
+    case SwitchCell:
+        out.print("SwitchCell");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void printInternal(PrintStream& out, Node* node)
+{
+    if (!node) {
+        out.print("-");
+        return;
+    }
+    out.print("@", node->index());
+    if (node->hasDoubleResult())
+        out.print("<Double>");
+    else if (node->hasInt52Result())
+        out.print("<Int52>");
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGNode.h b/dfg/DFGNode.h
new file mode 100644
index 0000000..43c20f5
--- /dev/null
+++ b/dfg/DFGNode.h
@@ -0,0 +1,2671 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "BasicBlockLocation.h"
+#include "CodeBlock.h"
+#include "DFGAbstractValue.h"
+#include "DFGAdjacencyList.h"
+#include "DFGArithMode.h"
+#include "DFGArrayMode.h"
+#include "DFGCommon.h"
+#include "DFGEpoch.h"
+#include "DFGLazyJSValue.h"
+#include "DFGMultiGetByOffsetData.h"
+#include "DFGNodeFlags.h"
+#include "DFGNodeOrigin.h"
+#include "DFGNodeType.h"
+#include "DFGObjectMaterializationData.h"
+#include "DFGOpInfo.h"
+#include "DFGRegisteredStructure.h"
+#include "DFGRegisteredStructureSet.h"
+#include "DFGTransition.h"
+#include "DFGUseKind.h"
+#include "DFGVariableAccessData.h"
+#include "GetByIdVariant.h"
+#include "JSCJSValue.h"
+#include "Operands.h"
+#include "PutByIdVariant.h"
+#include "SpeculatedType.h"
+#include "StructureSet.h"
+#include "TypeLocation.h"
+#include "ValueProfile.h"
+#include <type_traits>
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+namespace DOMJIT {
+class GetterSetter;
+class Patchpoint;
+class CallDOMGetterPatchpoint;
+class Signature;
+}
+
+namespace Profiler {
+class ExecutionCounter;
+}
+
+namespace DFG {
+
+class Graph;
+class PromotedLocationDescriptor;
+struct BasicBlock;
+
+struct StorageAccessData {
+    PropertyOffset offset;
+    unsigned identifierNumber;
+
+    // This needs to know the inferred type. For puts, this is necessary because we need to remember
+    // what check is needed. For gets, this is necessary because otherwise AI might forget what type is
+    // guaranteed.
+    InferredType::Descriptor inferredType;
+};
+
+struct MultiPutByOffsetData {
+    unsigned identifierNumber;
+    Vector<PutByIdVariant, 2> variants;
+    
+    bool writesStructures() const;
+    bool reallocatesStorage() const;
+};
+
+struct NewArrayBufferData {
+    unsigned startConstant;
+    unsigned numConstants;
+    IndexingType indexingType;
+};
+
+struct BranchTarget {
+    BranchTarget()
+        : block(0)
+        , count(PNaN)
+    {
+    }
+    
+    explicit BranchTarget(BasicBlock* block)
+        : block(block)
+        , count(PNaN)
+    {
+    }
+    
+    void setBytecodeIndex(unsigned bytecodeIndex)
+    {
+        block = bitwise_cast<BasicBlock*>(static_cast<uintptr_t>(bytecodeIndex));
+    }
+    unsigned bytecodeIndex() const { return bitwise_cast<uintptr_t>(block); }
+    
+    void dump(PrintStream&) const;
+    
+    BasicBlock* block;
+    float count;
+};
+
+struct BranchData {
+    static BranchData withBytecodeIndices(
+        unsigned takenBytecodeIndex, unsigned notTakenBytecodeIndex)
+    {
+        BranchData result;
+        result.taken.block = bitwise_cast<BasicBlock*>(static_cast<uintptr_t>(takenBytecodeIndex));
+        result.notTaken.block = bitwise_cast<BasicBlock*>(static_cast<uintptr_t>(notTakenBytecodeIndex));
+        return result;
+    }
+    
+    unsigned takenBytecodeIndex() const { return taken.bytecodeIndex(); }
+    unsigned notTakenBytecodeIndex() const { return notTaken.bytecodeIndex(); }
+    
+    BasicBlock*& forCondition(bool condition)
+    {
+        if (condition)
+            return taken.block;
+        return notTaken.block;
+    }
+    
+    BranchTarget taken;
+    BranchTarget notTaken;
+};
+
+// The SwitchData and associated data structures duplicate the information in
+// JumpTable. The DFG may ultimately end up using the JumpTable, though it may
+// instead decide to do something different - this is entirely up to the DFG.
+// These data structures give the DFG a higher-level semantic description of
+// what is going on, which will allow it to make the right decision.
+//
+// Note that there will never be multiple SwitchCases in SwitchData::cases that
+// have the same SwitchCase::value, since the bytecode's JumpTables never have
+// duplicates - since the JumpTable maps a value to a target. It's a
+// one-to-many mapping. So we may have duplicate targets, but never duplicate
+// values.
+struct SwitchCase {
+    SwitchCase()
+    {
+    }
+    
+    SwitchCase(LazyJSValue value, BasicBlock* target)
+        : value(value)
+        , target(target)
+    {
+    }
+    
+    static SwitchCase withBytecodeIndex(LazyJSValue value, unsigned bytecodeIndex)
+    {
+        SwitchCase result;
+        result.value = value;
+        result.target.setBytecodeIndex(bytecodeIndex);
+        return result;
+    }
+    
+    LazyJSValue value;
+    BranchTarget target;
+};
+
+struct SwitchData {
+    // Initializes most fields to obviously invalid values. Anyone
+    // constructing this should make sure to initialize everything they
+    // care about manually.
+    SwitchData()
+        : kind(static_cast<SwitchKind>(-1))
+        , switchTableIndex(UINT_MAX)
+        , didUseJumpTable(false)
+    {
+    }
+    
+    Vector<SwitchCase> cases;
+    BranchTarget fallThrough;
+    SwitchKind kind;
+    unsigned switchTableIndex;
+    bool didUseJumpTable;
+};
+
+struct CallVarargsData {
+    int firstVarArgOffset;
+};
+
+struct LoadVarargsData {
+    VirtualRegister start; // Local for the first element. This is the first actual argument, not this.
+    VirtualRegister count; // Local for the count.
+    VirtualRegister machineStart;
+    VirtualRegister machineCount;
+    unsigned offset; // Which array element to start with. Usually this is 0.
+    unsigned mandatoryMinimum; // The number of elements on the stack that must be initialized; if the array is too short then the missing elements must get undefined. Does not include "this".
+    unsigned limit; // Maximum number of elements to load. Includes "this".
+};
+
+struct StackAccessData {
+    StackAccessData()
+        : format(DeadFlush)
+    {
+    }
+    
+    StackAccessData(VirtualRegister local, FlushFormat format)
+        : local(local)
+        , format(format)
+    {
+    }
+    
+    VirtualRegister local;
+    VirtualRegister machineLocal;
+    FlushFormat format;
+    
+    FlushedAt flushedAt() { return FlushedAt(format, machineLocal); }
+};
+
+struct CallDOMGetterData {
+    DOMJIT::GetterSetter* domJIT { nullptr };
+    DOMJIT::CallDOMGetterPatchpoint* patchpoint { nullptr };
+    unsigned identifierNumber { 0 };
+};
+
+// === Node ===
+//
+// Node represents a single operation in the data flow graph.
+struct Node {
+public:
+    enum VarArgTag { VarArg };
+    
+    Node() { }
+    
+    Node(NodeType op, NodeOrigin nodeOrigin, const AdjacencyList& children)
+        : origin(nodeOrigin)
+        , children(children)
+        , m_virtualRegister(VirtualRegister())
+        , m_refCount(1)
+        , m_prediction(SpecNone)
+        , owner(nullptr)
+    {
+        m_misc.replacement = nullptr;
+        setOpAndDefaultFlags(op);
+    }
+    
+    // Construct a node with up to 3 children, no immediate value.
+    Node(NodeType op, NodeOrigin nodeOrigin, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
+        : origin(nodeOrigin)
+        , children(AdjacencyList::Fixed, child1, child2, child3)
+        , m_virtualRegister(VirtualRegister())
+        , m_refCount(1)
+        , m_prediction(SpecNone)
+        , owner(nullptr)
+    {
+        m_misc.replacement = nullptr;
+        setOpAndDefaultFlags(op);
+        ASSERT(!(m_flags & NodeHasVarArgs));
+    }
+
+    // Construct a node with up to 3 children, no immediate value.
+    Node(NodeFlags result, NodeType op, NodeOrigin nodeOrigin, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
+        : origin(nodeOrigin)
+        , children(AdjacencyList::Fixed, child1, child2, child3)
+        , m_virtualRegister(VirtualRegister())
+        , m_refCount(1)
+        , m_prediction(SpecNone)
+        , owner(nullptr)
+    {
+        m_misc.replacement = nullptr;
+        setOpAndDefaultFlags(op);
+        setResult(result);
+        ASSERT(!(m_flags & NodeHasVarArgs));
+    }
+
+    // Construct a node with up to 3 children and an immediate value.
+    Node(NodeType op, NodeOrigin nodeOrigin, OpInfo imm, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
+        : origin(nodeOrigin)
+        , children(AdjacencyList::Fixed, child1, child2, child3)
+        , m_virtualRegister(VirtualRegister())
+        , m_refCount(1)
+        , m_prediction(SpecNone)
+        , m_opInfo(imm.m_value)
+        , owner(nullptr)
+    {
+        m_misc.replacement = nullptr;
+        setOpAndDefaultFlags(op);
+        ASSERT(!(m_flags & NodeHasVarArgs));
+    }
+
+    // Construct a node with up to 3 children and an immediate value.
+    Node(NodeFlags result, NodeType op, NodeOrigin nodeOrigin, OpInfo imm, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
+        : origin(nodeOrigin)
+        , children(AdjacencyList::Fixed, child1, child2, child3)
+        , m_virtualRegister(VirtualRegister())
+        , m_refCount(1)
+        , m_prediction(SpecNone)
+        , m_opInfo(imm.m_value)
+        , owner(nullptr)
+    {
+        m_misc.replacement = nullptr;
+        setOpAndDefaultFlags(op);
+        setResult(result);
+        ASSERT(!(m_flags & NodeHasVarArgs));
+    }
+
+    // Construct a node with up to 3 children and two immediate values.
+    Node(NodeType op, NodeOrigin nodeOrigin, OpInfo imm1, OpInfo imm2, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())
+        : origin(nodeOrigin)
+        , children(AdjacencyList::Fixed, child1, child2, child3)
+        , m_virtualRegister(VirtualRegister())
+        , m_refCount(1)
+        , m_prediction(SpecNone)
+        , m_opInfo(imm1.m_value)
+        , m_opInfo2(imm2.m_value)
+        , owner(nullptr)
+    {
+        m_misc.replacement = nullptr;
+        setOpAndDefaultFlags(op);
+        ASSERT(!(m_flags & NodeHasVarArgs));
+    }
+    
+    // Construct a node with a variable number of children and two immediate values.
+    Node(VarArgTag, NodeType op, NodeOrigin nodeOrigin, OpInfo imm1, OpInfo imm2, unsigned firstChild, unsigned numChildren)
+        : origin(nodeOrigin)
+        , children(AdjacencyList::Variable, firstChild, numChildren)
+        , m_virtualRegister(VirtualRegister())
+        , m_refCount(1)
+        , m_prediction(SpecNone)
+        , m_opInfo(imm1.m_value)
+        , m_opInfo2(imm2.m_value)
+        , owner(nullptr)
+    {
+        m_misc.replacement = nullptr;
+        setOpAndDefaultFlags(op);
+        ASSERT(m_flags & NodeHasVarArgs);
+    }
+    
+    NodeType op() const { return static_cast<NodeType>(m_op); }
+    NodeFlags flags() const { return m_flags; }
+
+    unsigned index() const { return m_index; }
+    
+    void setOp(NodeType op)
+    {
+        m_op = op;
+    }
+    
+    void setFlags(NodeFlags flags)
+    {
+        m_flags = flags;
+    }
+    
+    bool mergeFlags(NodeFlags flags)
+    {
+        NodeFlags newFlags = m_flags | flags;
+        if (newFlags == m_flags)
+            return false;
+        m_flags = newFlags;
+        return true;
+    }
+    
+    bool filterFlags(NodeFlags flags)
+    {
+        NodeFlags newFlags = m_flags & flags;
+        if (newFlags == m_flags)
+            return false;
+        m_flags = newFlags;
+        return true;
+    }
+    
+    bool clearFlags(NodeFlags flags)
+    {
+        return filterFlags(~flags);
+    }
+    
+    void setResult(NodeFlags result)
+    {
+        ASSERT(!(result & ~NodeResultMask));
+        clearFlags(NodeResultMask);
+        mergeFlags(result);
+    }
+    
+    NodeFlags result() const
+    {
+        return flags() & NodeResultMask;
+    }
+    
+    void setOpAndDefaultFlags(NodeType op)
+    {
+        m_op = op;
+        m_flags = defaultFlags(op);
+    }
+
+    void remove();
+
+    void convertToCheckStructure(RegisteredStructureSet* set)
+    {
+        setOpAndDefaultFlags(CheckStructure);
+        m_opInfo = set;
+    }
+
+    void convertToCheckStructureImmediate(Node* structure)
+    {
+        ASSERT(op() == CheckStructure);
+        m_op = CheckStructureImmediate;
+        children.setChild1(Edge(structure, CellUse));
+    }
+    
+    void replaceWith(Node* other)
+    {
+        remove();
+        setReplacement(other);
+    }
+
+    void convertToIdentity();
+    void convertToIdentityOn(Node*);
+
+    bool mustGenerate()
+    {
+        return m_flags & NodeMustGenerate;
+    }
+    
+    bool isConstant()
+    {
+        switch (op()) {
+        case JSConstant:
+        case DoubleConstant:
+        case Int52Constant:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool hasConstant()
+    {
+        switch (op()) {
+        case JSConstant:
+        case DoubleConstant:
+        case Int52Constant:
+            return true;
+            
+        case PhantomDirectArguments:
+        case PhantomClonedArguments:
+            // These pretend to be the empty value constant for the benefit of the DFG backend, which
+            // otherwise wouldn't take kindly to a node that doesn't compute a value.
+            return true;
+            
+        default:
+            return false;
+        }
+    }
+
+    FrozenValue* constant()
+    {
+        ASSERT(hasConstant());
+        
+        if (op() == PhantomDirectArguments || op() == PhantomClonedArguments) {
+            // These pretend to be the empty value constant for the benefit of the DFG backend, which
+            // otherwise wouldn't take kindly to a node that doesn't compute a value.
+            return FrozenValue::emptySingleton();
+        }
+        
+        return m_opInfo.as<FrozenValue*>();
+    }
+    
+    // Don't call this directly - use Graph::convertToConstant() instead!
+    void convertToConstant(FrozenValue* value)
+    {
+        if (hasDoubleResult())
+            m_op = DoubleConstant;
+        else if (hasInt52Result())
+            m_op = Int52Constant;
+        else
+            m_op = JSConstant;
+        m_flags &= ~NodeMustGenerate;
+        m_opInfo = value;
+        children.reset();
+    }
+
+    void convertToLazyJSConstant(Graph&, LazyJSValue);
+    
+    void convertToConstantStoragePointer(void* pointer)
+    {
+        ASSERT(op() == GetIndexedPropertyStorage);
+        m_op = ConstantStoragePointer;
+        m_opInfo = pointer;
+        children.reset();
+    }
+    
+    void convertToGetLocalUnlinked(VirtualRegister local)
+    {
+        m_op = GetLocalUnlinked;
+        m_flags &= ~NodeMustGenerate;
+        m_opInfo = local.offset();
+        m_opInfo2 = VirtualRegister().offset();
+        children.reset();
+    }
+    
+    void convertToPutStack(StackAccessData* data)
+    {
+        m_op = PutStack;
+        m_flags |= NodeMustGenerate;
+        m_opInfo = data;
+        m_opInfo2 = OpInfoWrapper();
+    }
+    
+    void convertToGetStack(StackAccessData* data)
+    {
+        m_op = GetStack;
+        m_flags &= ~NodeMustGenerate;
+        m_opInfo = data;
+        m_opInfo2 = OpInfoWrapper();
+        children.reset();
+    }
+    
+    void convertToGetByOffset(StorageAccessData& data, Edge storage, Edge base)
+    {
+        ASSERT(m_op == GetById || m_op == GetByIdFlush || m_op == MultiGetByOffset);
+        m_opInfo = &data;
+        children.setChild1(storage);
+        children.setChild2(base);
+        m_op = GetByOffset;
+        m_flags &= ~NodeMustGenerate;
+    }
+    
+    void convertToMultiGetByOffset(MultiGetByOffsetData* data)
+    {
+        ASSERT(m_op == GetById || m_op == GetByIdFlush);
+        m_opInfo = data;
+        child1().setUseKind(CellUse);
+        m_op = MultiGetByOffset;
+        ASSERT(m_flags & NodeMustGenerate);
+    }
+    
+    void convertToPutByOffset(StorageAccessData& data, Edge storage, Edge base)
+    {
+        ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == PutByIdFlush || m_op == MultiPutByOffset);
+        m_opInfo = &data;
+        children.setChild3(children.child2());
+        children.setChild2(base);
+        children.setChild1(storage);
+        m_op = PutByOffset;
+    }
+    
+    void convertToMultiPutByOffset(MultiPutByOffsetData* data)
+    {
+        ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == PutByIdFlush);
+        m_opInfo = data;
+        m_op = MultiPutByOffset;
+    }
+    
+    void convertToPutHint(const PromotedLocationDescriptor&, Node* base, Node* value);
+    
+    void convertToPutByOffsetHint();
+    void convertToPutStructureHint(Node* structure);
+    void convertToPutClosureVarHint();
+    
+    void convertToPhantomNewObject()
+    {
+        ASSERT(m_op == NewObject || m_op == MaterializeNewObject);
+        m_op = PhantomNewObject;
+        m_flags &= ~NodeHasVarArgs;
+        m_flags |= NodeMustGenerate;
+        m_opInfo = OpInfoWrapper();
+        m_opInfo2 = OpInfoWrapper();
+        children = AdjacencyList();
+    }
+
+    void convertToPhantomNewFunction()
+    {
+        ASSERT(m_op == NewFunction || m_op == NewGeneratorFunction || m_op == NewAsyncFunction);
+        m_op = PhantomNewFunction;
+        m_flags |= NodeMustGenerate;
+        m_opInfo = OpInfoWrapper();
+        m_opInfo2 = OpInfoWrapper();
+        children = AdjacencyList();
+    }
+
+    void convertToPhantomNewGeneratorFunction()
+    {
+        ASSERT(m_op == NewGeneratorFunction);
+        m_op = PhantomNewGeneratorFunction;
+        m_flags |= NodeMustGenerate;
+        m_opInfo = OpInfoWrapper();
+        m_opInfo2 = OpInfoWrapper();
+        children = AdjacencyList();
+    }
+
+    void convertToPhantomNewAsyncFunction()
+    {
+        ASSERT(m_op == NewAsyncFunction);
+        m_op = PhantomNewAsyncFunction;
+        m_flags |= NodeMustGenerate;
+        m_opInfo = OpInfoWrapper();
+        m_opInfo2 = OpInfoWrapper();
+        children = AdjacencyList();
+    }
+
+    void convertToPhantomCreateActivation()
+    {
+        ASSERT(m_op == CreateActivation || m_op == MaterializeCreateActivation);
+        m_op = PhantomCreateActivation;
+        m_flags &= ~NodeHasVarArgs;
+        m_flags |= NodeMustGenerate;
+        m_opInfo = OpInfoWrapper();
+        m_opInfo2 = OpInfoWrapper();
+        children = AdjacencyList();
+    }
+
+    void convertPhantomToPhantomLocal()
+    {
+        ASSERT(m_op == Phantom && (child1()->op() == Phi || child1()->op() == SetLocal || child1()->op() == SetArgument));
+        m_op = PhantomLocal;
+        m_opInfo = child1()->m_opInfo; // Copy the variableAccessData.
+        children.setChild1(Edge());
+    }
+    
+    void convertFlushToPhantomLocal()
+    {
+        ASSERT(m_op == Flush);
+        m_op = PhantomLocal;
+        children = AdjacencyList();
+    }
+    
+    void convertToGetLocal(VariableAccessData* variable, Node* phi)
+    {
+        ASSERT(m_op == GetLocalUnlinked);
+        m_op = GetLocal;
+        m_opInfo = variable;
+        m_opInfo2 = OpInfoWrapper();
+        children.setChild1(Edge(phi));
+    }
+    
+    void convertToToString()
+    {
+        ASSERT(m_op == ToPrimitive);
+        m_op = ToString;
+    }
+
+    void convertToArithNegate()
+    {
+        ASSERT(m_op == ArithAbs && child1().useKind() == Int32Use);
+        m_op = ArithNegate;
+    }
+    
+    void convertToDirectCall(FrozenValue*);
+
+    void convertToCallDOM(Graph&);
+    
+    JSValue asJSValue()
+    {
+        return constant()->value();
+    }
+     
+    bool isInt32Constant()
+    {
+        return isConstant() && constant()->value().isInt32();
+    }
+     
+    int32_t asInt32()
+    {
+        return asJSValue().asInt32();
+    }
+     
+    uint32_t asUInt32()
+    {
+        return asInt32();
+    }
+     
+    bool isDoubleConstant()
+    {
+        return isConstant() && constant()->value().isDouble();
+    }
+     
+    bool isNumberConstant()
+    {
+        return isConstant() && constant()->value().isNumber();
+    }
+    
+    double asNumber()
+    {
+        return asJSValue().asNumber();
+    }
+     
+    bool isAnyIntConstant()
+    {
+        return isConstant() && constant()->value().isAnyInt();
+    }
+     
+    int64_t asAnyInt()
+    {
+        return asJSValue().asAnyInt();
+    }
+     
+    bool isBooleanConstant()
+    {
+        return isConstant() && constant()->value().isBoolean();
+    }
+     
+    bool asBoolean()
+    {
+        return constant()->value().asBoolean();
+    }
+
+    bool isUndefinedOrNullConstant()
+    {
+        return isConstant() && constant()->value().isUndefinedOrNull();
+    }
+
+    bool isCellConstant()
+    {
+        return isConstant() && constant()->value() && constant()->value().isCell();
+    }
+     
+    JSCell* asCell()
+    {
+        return constant()->value().asCell();
+    }
+     
+    template<typename T>
+    T dynamicCastConstant()
+    {
+        if (!isCellConstant())
+            return nullptr;
+        return jsDynamicCast<T>(asCell());
+    }
+    
+    template<typename T>
+    T castConstant()
+    {
+        T result = dynamicCastConstant<T>();
+        RELEASE_ASSERT(result);
+        return result;
+    }
+
+    bool hasLazyJSValue()
+    {
+        return op() == LazyJSConstant;
+    }
+
+    LazyJSValue lazyJSValue()
+    {
+        ASSERT(hasLazyJSValue());
+        return *m_opInfo.as<LazyJSValue*>();
+    }
+
+    String tryGetString(Graph&);
+
+    JSValue initializationValueForActivation() const
+    {
+        ASSERT(op() == CreateActivation);
+        return m_opInfo2.as<FrozenValue*>()->value();
+    }
+
+    bool hasArgumentsChild()
+    {
+        switch (op()) {
+        case GetMyArgumentByVal:
+        case GetMyArgumentByValOutOfBounds:
+        case LoadVarargs:
+        case ForwardVarargs:
+        case CallVarargs:
+        case CallForwardVarargs:
+        case ConstructVarargs:
+        case ConstructForwardVarargs:
+        case TailCallVarargs:
+        case TailCallForwardVarargs:
+        case TailCallVarargsInlinedCaller:
+        case TailCallForwardVarargsInlinedCaller:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    Edge& argumentsChild()
+    {
+        switch (op()) {
+        case GetMyArgumentByVal:
+        case GetMyArgumentByValOutOfBounds:
+        case LoadVarargs:
+        case ForwardVarargs:
+            return child1();
+        case CallVarargs:
+        case CallForwardVarargs:
+        case ConstructVarargs:
+        case ConstructForwardVarargs:
+        case TailCallVarargs:
+        case TailCallForwardVarargs:
+        case TailCallVarargsInlinedCaller:
+        case TailCallForwardVarargsInlinedCaller:
+            return child3();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return child1();
+        }
+    }
+
+    bool containsMovHint()
+    {
+        switch (op()) {
+        case MovHint:
+        case ZombieHint:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool hasVariableAccessData(Graph&);
+    bool accessesStack(Graph& graph)
+    {
+        return hasVariableAccessData(graph);
+    }
+    
+    // This is useful for debugging code, where a node that should have a variable
+    // access data doesn't have one because it hasn't been initialized yet.
+    VariableAccessData* tryGetVariableAccessData()
+    {
+        VariableAccessData* result = m_opInfo.as<VariableAccessData*>();
+        if (!result)
+            return 0;
+        return result->find();
+    }
+    
+    VariableAccessData* variableAccessData()
+    {
+        return m_opInfo.as<VariableAccessData*>()->find();
+    }
+    
+    VirtualRegister local()
+    {
+        return variableAccessData()->local();
+    }
+    
+    VirtualRegister machineLocal()
+    {
+        return variableAccessData()->machineLocal();
+    }
+    
+    bool hasUnlinkedLocal()
+    {
+        switch (op()) {
+        case GetLocalUnlinked:
+        case ExtractOSREntryLocal:
+        case MovHint:
+        case ZombieHint:
+        case KillStack:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    VirtualRegister unlinkedLocal()
+    {
+        ASSERT(hasUnlinkedLocal());
+        return VirtualRegister(m_opInfo.as<int32_t>());
+    }
+    
+    bool hasUnlinkedMachineLocal()
+    {
+        return op() == GetLocalUnlinked;
+    }
+    
+    void setUnlinkedMachineLocal(VirtualRegister reg)
+    {
+        ASSERT(hasUnlinkedMachineLocal());
+        m_opInfo2 = reg.offset();
+    }
+    
+    VirtualRegister unlinkedMachineLocal()
+    {
+        ASSERT(hasUnlinkedMachineLocal());
+        return VirtualRegister(m_opInfo2.as<int32_t>());
+    }
+    
+    bool hasStackAccessData()
+    {
+        switch (op()) {
+        case PutStack:
+        case GetStack:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    StackAccessData* stackAccessData()
+    {
+        ASSERT(hasStackAccessData());
+        return m_opInfo.as<StackAccessData*>();
+    }
+    
+    bool hasPhi()
+    {
+        return op() == Upsilon;
+    }
+    
+    Node* phi()
+    {
+        ASSERT(hasPhi());
+        return m_opInfo.as<Node*>();
+    }
+
+    bool isStoreBarrier()
+    {
+        return op() == StoreBarrier || op() == FencedStoreBarrier;
+    }
+
+    bool hasIdentifier()
+    {
+        switch (op()) {
+        case TryGetById:
+        case GetById:
+        case GetByIdFlush:
+        case GetByIdWithThis:
+        case PutById:
+        case PutByIdFlush:
+        case PutByIdDirect:
+        case PutByIdWithThis:
+        case PutGetterById:
+        case PutSetterById:
+        case PutGetterSetterById:
+        case DeleteById:
+        case GetDynamicVar:
+        case PutDynamicVar:
+        case ResolveScope:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    unsigned identifierNumber()
+    {
+        ASSERT(hasIdentifier());
+        return m_opInfo.as<unsigned>();
+    }
+
+    bool hasGetPutInfo()
+    {
+        switch (op()) {
+        case GetDynamicVar:
+        case PutDynamicVar:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    unsigned getPutInfo()
+    {
+        ASSERT(hasGetPutInfo());
+        return m_opInfo2.as<unsigned>();
+    }
+
+    bool hasAccessorAttributes()
+    {
+        switch (op()) {
+        case PutGetterById:
+        case PutSetterById:
+        case PutGetterSetterById:
+        case PutGetterByVal:
+        case PutSetterByVal:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    int32_t accessorAttributes()
+    {
+        ASSERT(hasAccessorAttributes());
+        switch (op()) {
+        case PutGetterById:
+        case PutSetterById:
+        case PutGetterSetterById:
+            return m_opInfo2.as<int32_t>();
+        case PutGetterByVal:
+        case PutSetterByVal:
+            return m_opInfo.as<int32_t>();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return 0;
+        }
+    }
+    
+    bool hasPromotedLocationDescriptor()
+    {
+        return op() == PutHint;
+    }
+    
+    PromotedLocationDescriptor promotedLocationDescriptor();
+    
+    // This corrects the arithmetic node flags, so that irrelevant bits are
+    // ignored. In particular, anything other than ArithMul does not need
+    // to know if it can speculate on negative zero.
+    NodeFlags arithNodeFlags()
+    {
+        NodeFlags result = m_flags & NodeArithFlagsMask;
+        if (op() == ArithMul || op() == ArithDiv || op() == ArithMod || op() == ArithNegate || op() == ArithPow || op() == ArithRound || op() == ArithFloor || op() == ArithCeil || op() == ArithTrunc || op() == DoubleAsInt32)
+            return result;
+        return result & ~NodeBytecodeNeedsNegZero;
+    }
+
+    bool mayHaveNonIntResult()
+    {
+        return m_flags & NodeMayHaveNonIntResult;
+    }
+    
+    bool mayHaveDoubleResult()
+    {
+        return m_flags & NodeMayHaveDoubleResult;
+    }
+    
+    bool mayHaveNonNumberResult()
+    {
+        return m_flags & NodeMayHaveNonNumberResult;
+    }
+
+    bool hasConstantBuffer()
+    {
+        return op() == NewArrayBuffer;
+    }
+    
+    NewArrayBufferData* newArrayBufferData()
+    {
+        ASSERT(hasConstantBuffer());
+        return m_opInfo.as<NewArrayBufferData*>();
+    }
+    
+    unsigned startConstant()
+    {
+        return newArrayBufferData()->startConstant;
+    }
+    
+    unsigned numConstants()
+    {
+        return newArrayBufferData()->numConstants;
+    }
+    
+    bool hasIndexingType()
+    {
+        switch (op()) {
+        case NewArray:
+        case NewArrayWithSize:
+        case NewArrayBuffer:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    BitVector* bitVector()
+    {
+        ASSERT(op() == NewArrayWithSpread || op() == PhantomNewArrayWithSpread);
+        return m_opInfo.as<BitVector*>();
+    }
+
+    // Return the indexing type that an array allocation *wants* to use. It may end up using a different
+    // type if we're having a bad time. You can determine the actual indexing type by asking the global
+    // object:
+    //
+    //     m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())
+    //
+    // This will give you a Structure*, and that will have some indexing type that may be different from
+    // the this one.
+    IndexingType indexingType()
+    {
+        ASSERT(hasIndexingType());
+        if (op() == NewArrayBuffer)
+            return newArrayBufferData()->indexingType;
+        return static_cast<IndexingType>(m_opInfo.as<uint32_t>());
+    }
+    
+    bool hasTypedArrayType()
+    {
+        switch (op()) {
+        case NewTypedArray:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    TypedArrayType typedArrayType()
+    {
+        ASSERT(hasTypedArrayType());
+        TypedArrayType result = static_cast<TypedArrayType>(m_opInfo.as<uint32_t>());
+        ASSERT(isTypedView(result));
+        return result;
+    }
+    
+    bool hasInlineCapacity()
+    {
+        return op() == CreateThis;
+    }
+
+    unsigned inlineCapacity()
+    {
+        ASSERT(hasInlineCapacity());
+        return m_opInfo.as<unsigned>();
+    }
+
+    void setIndexingType(IndexingType indexingType)
+    {
+        ASSERT(hasIndexingType());
+        m_opInfo = indexingType;
+    }
+    
+    bool hasScopeOffset()
+    {
+        return op() == GetClosureVar || op() == PutClosureVar;
+    }
+
+    ScopeOffset scopeOffset()
+    {
+        ASSERT(hasScopeOffset());
+        return ScopeOffset(m_opInfo.as<uint32_t>());
+    }
+    
+    bool hasDirectArgumentsOffset()
+    {
+        return op() == GetFromArguments || op() == PutToArguments;
+    }
+    
+    DirectArgumentsOffset capturedArgumentsOffset()
+    {
+        ASSERT(hasDirectArgumentsOffset());
+        return DirectArgumentsOffset(m_opInfo.as<uint32_t>());
+    }
+    
+    bool hasRegisterPointer()
+    {
+        return op() == GetGlobalVar || op() == GetGlobalLexicalVariable || op() == PutGlobalVariable;
+    }
+    
+    WriteBarrier<Unknown>* variablePointer()
+    {
+        return m_opInfo.as<WriteBarrier<Unknown>*>();
+    }
+    
+    bool hasCallVarargsData()
+    {
+        switch (op()) {
+        case CallVarargs:
+        case CallForwardVarargs:
+        case TailCallVarargs:
+        case TailCallForwardVarargs:
+        case TailCallVarargsInlinedCaller:
+        case TailCallForwardVarargsInlinedCaller:
+        case ConstructVarargs:
+        case ConstructForwardVarargs:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    CallVarargsData* callVarargsData()
+    {
+        ASSERT(hasCallVarargsData());
+        return m_opInfo.as<CallVarargsData*>();
+    }
+    
+    bool hasLoadVarargsData()
+    {
+        return op() == LoadVarargs || op() == ForwardVarargs;
+    }
+    
+    LoadVarargsData* loadVarargsData()
+    {
+        ASSERT(hasLoadVarargsData());
+        return m_opInfo.as<LoadVarargsData*>();
+    }
+
+    bool hasQueriedType()
+    {
+        return op() == IsCellWithType;
+    }
+
+    JSType queriedType()
+    {
+        static_assert(std::is_same<uint8_t, std::underlying_type<JSType>::type>::value, "Ensure that uint8_t is the underlying type for JSType.");
+        return static_cast<JSType>(m_opInfo.as<uint32_t>());
+    }
+
+    bool hasSpeculatedTypeForQuery()
+    {
+        return op() == IsCellWithType;
+    }
+
+    SpeculatedType speculatedTypeForQuery()
+    {
+        return speculationFromJSType(queriedType());
+    }
+    
+    bool hasResult()
+    {
+        return !!result();
+    }
+    
+    bool hasInt52Result()
+    {
+        return result() == NodeResultInt52;
+    }
+    
+    bool hasNumberResult()
+    {
+        return result() == NodeResultNumber;
+    }
+    
+    bool hasDoubleResult()
+    {
+        return result() == NodeResultDouble;
+    }
+    
+    bool hasJSResult()
+    {
+        return result() == NodeResultJS;
+    }
+    
+    bool hasBooleanResult()
+    {
+        return result() == NodeResultBoolean;
+    }
+
+    bool hasStorageResult()
+    {
+        return result() == NodeResultStorage;
+    }
+    
+    UseKind defaultUseKind()
+    {
+        return useKindForResult(result());
+    }
+    
+    Edge defaultEdge()
+    {
+        return Edge(this, defaultUseKind());
+    }
+
+    bool isJump()
+    {
+        return op() == Jump;
+    }
+
+    bool isBranch()
+    {
+        return op() == Branch;
+    }
+    
+    bool isSwitch()
+    {
+        return op() == Switch;
+    }
+
+    bool isTerminal()
+    {
+        switch (op()) {
+        case Jump:
+        case Branch:
+        case Switch:
+        case Return:
+        case TailCall:
+        case DirectTailCall:
+        case TailCallVarargs:
+        case TailCallForwardVarargs:
+        case Unreachable:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isFunctionTerminal()
+    {
+        if (isTerminal() && !numSuccessors())
+            return true;
+
+        return false;
+    }
+
+    unsigned targetBytecodeOffsetDuringParsing()
+    {
+        ASSERT(isJump());
+        return m_opInfo.as<unsigned>();
+    }
+
+    BasicBlock*& targetBlock()
+    {
+        ASSERT(isJump());
+        return *bitwise_cast<BasicBlock**>(&m_opInfo.u.pointer);
+    }
+    
+    BranchData* branchData()
+    {
+        ASSERT(isBranch());
+        return m_opInfo.as<BranchData*>();
+    }
+    
+    SwitchData* switchData()
+    {
+        ASSERT(isSwitch());
+        return m_opInfo.as<SwitchData*>();
+    }
+    
+    unsigned numSuccessors()
+    {
+        switch (op()) {
+        case Jump:
+            return 1;
+        case Branch:
+            return 2;
+        case Switch:
+            return switchData()->cases.size() + 1;
+        default:
+            return 0;
+        }
+    }
+    
+    BasicBlock*& successor(unsigned index)
+    {
+        if (isSwitch()) {
+            if (index < switchData()->cases.size())
+                return switchData()->cases[index].target.block;
+            RELEASE_ASSERT(index == switchData()->cases.size());
+            return switchData()->fallThrough.block;
+        }
+        switch (index) {
+        case 0:
+            if (isJump())
+                return targetBlock();
+            return branchData()->taken.block;
+        case 1:
+            return branchData()->notTaken.block;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return targetBlock();
+        }
+    }
+    
+    class SuccessorsIterable {
+    public:
+        SuccessorsIterable()
+            : m_terminal(nullptr)
+        {
+        }
+        
+        SuccessorsIterable(Node* terminal)
+            : m_terminal(terminal)
+        {
+        }
+        
+        class iterator {
+        public:
+            iterator()
+                : m_terminal(nullptr)
+                , m_index(UINT_MAX)
+            {
+            }
+            
+            iterator(Node* terminal, unsigned index)
+                : m_terminal(terminal)
+                , m_index(index)
+            {
+            }
+            
+            BasicBlock* operator*()
+            {
+                return m_terminal->successor(m_index);
+            }
+            
+            iterator& operator++()
+            {
+                m_index++;
+                return *this;
+            }
+            
+            bool operator==(const iterator& other) const
+            {
+                return m_index == other.m_index;
+            }
+            
+            bool operator!=(const iterator& other) const
+            {
+                return !(*this == other);
+            }
+        private:
+            Node* m_terminal;
+            unsigned m_index;
+        };
+        
+        iterator begin()
+        {
+            return iterator(m_terminal, 0);
+        }
+        
+        iterator end()
+        {
+            return iterator(m_terminal, m_terminal->numSuccessors());
+        }
+
+        size_t size() const { return m_terminal->numSuccessors(); }
+        BasicBlock* at(size_t index) const { return m_terminal->successor(index); }
+        BasicBlock* operator[](size_t index) const { return at(index); }
+        
+    private:
+        Node* m_terminal;
+    };
+    
+    SuccessorsIterable successors()
+    {
+        return SuccessorsIterable(this);
+    }
+    
+    BasicBlock*& successorForCondition(bool condition)
+    {
+        return branchData()->forCondition(condition);
+    }
+    
+    bool hasHeapPrediction()
+    {
+        switch (op()) {
+        case ArithAbs:
+        case ArithRound:
+        case ArithFloor:
+        case ArithCeil:
+        case ArithTrunc:
+        case GetDirectPname:
+        case GetById:
+        case GetByIdFlush:
+        case GetByIdWithThis:
+        case TryGetById:
+        case GetByVal:
+        case GetByValWithThis:
+        case Call:
+        case DirectCall:
+        case TailCallInlinedCaller:
+        case DirectTailCallInlinedCaller:
+        case Construct:
+        case DirectConstruct:
+        case CallVarargs:
+        case CallEval:
+        case TailCallVarargsInlinedCaller:
+        case ConstructVarargs:
+        case CallForwardVarargs:
+        case TailCallForwardVarargsInlinedCaller:
+        case GetByOffset:
+        case MultiGetByOffset:
+        case GetClosureVar:
+        case GetFromArguments:
+        case GetArgument:
+        case ArrayPop:
+        case ArrayPush:
+        case RegExpExec:
+        case RegExpTest:
+        case GetGlobalVar:
+        case GetGlobalLexicalVariable:
+        case StringReplace:
+        case StringReplaceRegExp:
+        case ToNumber:
+        case LoadFromJSMapBucket:
+        case CallDOMGetter:
+        case CallDOM:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    SpeculatedType getHeapPrediction()
+    {
+        ASSERT(hasHeapPrediction());
+        return m_opInfo2.as<SpeculatedType>();
+    }
+
+    void setHeapPrediction(SpeculatedType prediction)
+    {
+        ASSERT(hasHeapPrediction());
+        m_opInfo2 = prediction;
+    }
+    
+    bool hasCellOperand()
+    {
+        switch (op()) {
+        case CheckCell:
+        case OverridesHasInstance:
+        case NewFunction:
+        case NewGeneratorFunction:
+        case NewAsyncFunction:
+        case CreateActivation:
+        case MaterializeCreateActivation:
+        case NewRegexp:
+        case CompareEqPtr:
+        case DirectCall:
+        case DirectTailCall:
+        case DirectConstruct:
+        case DirectTailCallInlinedCaller:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    FrozenValue* cellOperand()
+    {
+        ASSERT(hasCellOperand());
+        return m_opInfo.as<FrozenValue*>();
+    }
+    
+    template<typename T>
+    T castOperand()
+    {
+        return cellOperand()->cast<T>();
+    }
+    
+    void setCellOperand(FrozenValue* value)
+    {
+        ASSERT(hasCellOperand());
+        m_opInfo = value;
+    }
+    
+    bool hasWatchpointSet()
+    {
+        return op() == NotifyWrite;
+    }
+    
+    WatchpointSet* watchpointSet()
+    {
+        ASSERT(hasWatchpointSet());
+        return m_opInfo.as<WatchpointSet*>();
+    }
+    
+    bool hasStoragePointer()
+    {
+        return op() == ConstantStoragePointer;
+    }
+    
+    void* storagePointer()
+    {
+        ASSERT(hasStoragePointer());
+        return m_opInfo.as<void*>();
+    }
+
+    bool hasUidOperand()
+    {
+        return op() == CheckStringIdent;
+    }
+
+    UniquedStringImpl* uidOperand()
+    {
+        ASSERT(hasUidOperand());
+        return m_opInfo.as<UniquedStringImpl*>();
+    }
+
+    bool hasTypeInfoOperand()
+    {
+        return op() == CheckTypeInfoFlags;
+    }
+
+    unsigned typeInfoOperand()
+    {
+        ASSERT(hasTypeInfoOperand() && m_opInfo.as<uint32_t>() <= static_cast<uint32_t>(UCHAR_MAX));
+        return m_opInfo.as<uint32_t>();
+    }
+
+    bool hasTransition()
+    {
+        switch (op()) {
+        case PutStructure:
+        case AllocatePropertyStorage:
+        case ReallocatePropertyStorage:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    Transition* transition()
+    {
+        ASSERT(hasTransition());
+        return m_opInfo.as<Transition*>();
+    }
+    
+    bool hasStructureSet()
+    {
+        switch (op()) {
+        case CheckStructure:
+        case CheckStructureImmediate:
+        case MaterializeNewObject:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    const RegisteredStructureSet& structureSet()
+    {
+        ASSERT(hasStructureSet());
+        return *m_opInfo.as<RegisteredStructureSet*>();
+    }
+    
+    bool hasStructure()
+    {
+        switch (op()) {
+        case ArrayifyToStructure:
+        case NewObject:
+        case NewStringObject:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    RegisteredStructure structure()
+    {
+        ASSERT(hasStructure());
+        return m_opInfo.asRegisteredStructure();
+    }
+    
+    bool hasStorageAccessData()
+    {
+        switch (op()) {
+        case GetByOffset:
+        case PutByOffset:
+        case GetGetterSetterByOffset:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    StorageAccessData& storageAccessData()
+    {
+        ASSERT(hasStorageAccessData());
+        return *m_opInfo.as<StorageAccessData*>();
+    }
+    
+    bool hasMultiGetByOffsetData()
+    {
+        return op() == MultiGetByOffset;
+    }
+    
+    MultiGetByOffsetData& multiGetByOffsetData()
+    {
+        ASSERT(hasMultiGetByOffsetData());
+        return *m_opInfo.as<MultiGetByOffsetData*>();
+    }
+    
+    bool hasMultiPutByOffsetData()
+    {
+        return op() == MultiPutByOffset;
+    }
+    
+    MultiPutByOffsetData& multiPutByOffsetData()
+    {
+        ASSERT(hasMultiPutByOffsetData());
+        return *m_opInfo.as<MultiPutByOffsetData*>();
+    }
+    
+    bool hasObjectMaterializationData()
+    {
+        switch (op()) {
+        case MaterializeNewObject:
+        case MaterializeCreateActivation:
+            return true;
+
+        default:
+            return false;
+        }
+    }
+    
+    ObjectMaterializationData& objectMaterializationData()
+    {
+        ASSERT(hasObjectMaterializationData());
+        return *m_opInfo2.as<ObjectMaterializationData*>();
+    }
+
+    bool isObjectAllocation()
+    {
+        switch (op()) {
+        case NewObject:
+        case MaterializeNewObject:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool isPhantomObjectAllocation()
+    {
+        switch (op()) {
+        case PhantomNewObject:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool isActivationAllocation()
+    {
+        switch (op()) {
+        case CreateActivation:
+        case MaterializeCreateActivation:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isPhantomActivationAllocation()
+    {
+        switch (op()) {
+        case PhantomCreateActivation:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isFunctionAllocation()
+    {
+        switch (op()) {
+        case NewFunction:
+        case NewGeneratorFunction:
+        case NewAsyncFunction:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isPhantomFunctionAllocation()
+    {
+        switch (op()) {
+        case PhantomNewFunction:
+        case PhantomNewGeneratorFunction:
+        case PhantomNewAsyncFunction:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    bool isPhantomAllocation()
+    {
+        switch (op()) {
+        case PhantomNewObject:
+        case PhantomDirectArguments:
+        case PhantomCreateRest:
+        case PhantomSpread:
+        case PhantomNewArrayWithSpread:
+        case PhantomClonedArguments:
+        case PhantomNewFunction:
+        case PhantomNewGeneratorFunction:
+        case PhantomNewAsyncFunction:
+        case PhantomCreateActivation:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    bool hasArrayMode()
+    {
+        switch (op()) {
+        case GetIndexedPropertyStorage:
+        case GetArrayLength:
+        case PutByValDirect:
+        case PutByVal:
+        case PutByValAlias:
+        case GetByVal:
+        case StringCharAt:
+        case StringCharCodeAt:
+        case CheckArray:
+        case Arrayify:
+        case ArrayifyToStructure:
+        case ArrayPush:
+        case ArrayPop:
+        case HasIndexedProperty:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    ArrayMode arrayMode()
+    {
+        ASSERT(hasArrayMode());
+        if (op() == ArrayifyToStructure)
+            return ArrayMode::fromWord(m_opInfo2.as<uint32_t>());
+        return ArrayMode::fromWord(m_opInfo.as<uint32_t>());
+    }
+    
+    bool setArrayMode(ArrayMode arrayMode)
+    {
+        ASSERT(hasArrayMode());
+        if (this->arrayMode() == arrayMode)
+            return false;
+        m_opInfo = arrayMode.asWord();
+        return true;
+    }
+    
+    bool hasArithMode()
+    {
+        switch (op()) {
+        case ArithAbs:
+        case ArithAdd:
+        case ArithSub:
+        case ArithNegate:
+        case ArithMul:
+        case ArithDiv:
+        case ArithMod:
+        case UInt32ToNumber:
+        case DoubleAsInt32:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    Arith::Mode arithMode()
+    {
+        ASSERT(hasArithMode());
+        return static_cast<Arith::Mode>(m_opInfo.as<uint32_t>());
+    }
+    
+    void setArithMode(Arith::Mode mode)
+    {
+        m_opInfo = mode;
+    }
+
+    bool hasArithRoundingMode()
+    {
+        return op() == ArithRound || op() == ArithFloor || op() == ArithCeil || op() == ArithTrunc;
+    }
+
+    Arith::RoundingMode arithRoundingMode()
+    {
+        ASSERT(hasArithRoundingMode());
+        return static_cast<Arith::RoundingMode>(m_opInfo.as<uint32_t>());
+    }
+
+    void setArithRoundingMode(Arith::RoundingMode mode)
+    {
+        ASSERT(hasArithRoundingMode());
+        m_opInfo = static_cast<uint32_t>(mode);
+    }
+    
+    bool hasVirtualRegister()
+    {
+        return m_virtualRegister.isValid();
+    }
+    
+    VirtualRegister virtualRegister()
+    {
+        ASSERT(hasResult());
+        ASSERT(m_virtualRegister.isValid());
+        return m_virtualRegister;
+    }
+    
+    void setVirtualRegister(VirtualRegister virtualRegister)
+    {
+        ASSERT(hasResult());
+        ASSERT(!m_virtualRegister.isValid());
+        m_virtualRegister = virtualRegister;
+    }
+    
+    bool hasExecutionCounter()
+    {
+        return op() == CountExecution;
+    }
+    
+    Profiler::ExecutionCounter* executionCounter()
+    {
+        return m_opInfo.as<Profiler::ExecutionCounter*>();
+    }
+
+    bool shouldGenerate()
+    {
+        return m_refCount;
+    }
+    
+    bool isSemanticallySkippable()
+    {
+        return op() == CountExecution;
+    }
+
+    unsigned refCount()
+    {
+        return m_refCount;
+    }
+
+    unsigned postfixRef()
+    {
+        return m_refCount++;
+    }
+
+    unsigned adjustedRefCount()
+    {
+        return mustGenerate() ? m_refCount - 1 : m_refCount;
+    }
+    
+    void setRefCount(unsigned refCount)
+    {
+        m_refCount = refCount;
+    }
+    
+    Edge& child1()
+    {
+        ASSERT(!(m_flags & NodeHasVarArgs));
+        return children.child1();
+    }
+    
+    // This is useful if you want to do a fast check on the first child
+    // before also doing a check on the opcode. Use this with care and
+    // avoid it if possible.
+    Edge child1Unchecked()
+    {
+        return children.child1Unchecked();
+    }
+
+    Edge& child2()
+    {
+        ASSERT(!(m_flags & NodeHasVarArgs));
+        return children.child2();
+    }
+
+    Edge& child3()
+    {
+        ASSERT(!(m_flags & NodeHasVarArgs));
+        return children.child3();
+    }
+    
+    unsigned firstChild()
+    {
+        ASSERT(m_flags & NodeHasVarArgs);
+        return children.firstChild();
+    }
+    
+    unsigned numChildren()
+    {
+        ASSERT(m_flags & NodeHasVarArgs);
+        return children.numChildren();
+    }
+    
+    UseKind binaryUseKind()
+    {
+        ASSERT(child1().useKind() == child2().useKind());
+        return child1().useKind();
+    }
+    
+    bool isBinaryUseKind(UseKind left, UseKind right)
+    {
+        return child1().useKind() == left && child2().useKind() == right;
+    }
+    
+    bool isBinaryUseKind(UseKind useKind)
+    {
+        return isBinaryUseKind(useKind, useKind);
+    }
+    
+    Edge childFor(UseKind useKind)
+    {
+        if (child1().useKind() == useKind)
+            return child1();
+        if (child2().useKind() == useKind)
+            return child2();
+        if (child3().useKind() == useKind)
+            return child3();
+        return Edge();
+    }
+    
+    SpeculatedType prediction()
+    {
+        return m_prediction;
+    }
+    
+    bool predict(SpeculatedType prediction)
+    {
+        return mergeSpeculation(m_prediction, prediction);
+    }
+    
+    bool shouldSpeculateInt32()
+    {
+        return isInt32Speculation(prediction());
+    }
+
+    bool shouldSpeculateNotInt32()
+    {
+        return isNotInt32Speculation(prediction());
+    }
+    
+    bool sawBooleans()
+    {
+        return !!(prediction() & SpecBoolean);
+    }
+    
+    bool shouldSpeculateInt32OrBoolean()
+    {
+        return isInt32OrBooleanSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateInt32ForArithmetic()
+    {
+        return isInt32SpeculationForArithmetic(prediction());
+    }
+    
+    bool shouldSpeculateInt32OrBooleanForArithmetic()
+    {
+        return isInt32OrBooleanSpeculationForArithmetic(prediction());
+    }
+    
+    bool shouldSpeculateInt32OrBooleanExpectingDefined()
+    {
+        return isInt32OrBooleanSpeculationExpectingDefined(prediction());
+    }
+    
+    bool shouldSpeculateAnyInt()
+    {
+        return isAnyIntSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateDouble()
+    {
+        return isDoubleSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateDoubleReal()
+    {
+        return isDoubleRealSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateNumber()
+    {
+        return isFullNumberSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateNumberOrBoolean()
+    {
+        return isFullNumberOrBooleanSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateNumberOrBooleanExpectingDefined()
+    {
+        return isFullNumberOrBooleanSpeculationExpectingDefined(prediction());
+    }
+    
+    bool shouldSpeculateBoolean()
+    {
+        return isBooleanSpeculation(prediction());
+    }
+
+    bool shouldSpeculateNotBoolean()
+    {
+        return isNotBooleanSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateOther()
+    {
+        return isOtherSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateMisc()
+    {
+        return isMiscSpeculation(prediction());
+    }
+   
+    bool shouldSpeculateStringIdent()
+    {
+        return isStringIdentSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateNotStringVar()
+    {
+        return isNotStringVarSpeculation(prediction());
+    }
+ 
+    bool shouldSpeculateString()
+    {
+        return isStringSpeculation(prediction());
+    }
+
+    bool shouldSpeculateNotString()
+    {
+        return isNotStringSpeculation(prediction());
+    }
+ 
+    bool shouldSpeculateStringOrOther()
+    {
+        return isStringOrOtherSpeculation(prediction());
+    }
+ 
+    bool shouldSpeculateStringObject()
+    {
+        return isStringObjectSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateStringOrStringObject()
+    {
+        return isStringOrStringObjectSpeculation(prediction());
+    }
+
+    bool shouldSpeculateRegExpObject()
+    {
+        return isRegExpObjectSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateSymbol()
+    {
+        return isSymbolSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateFinalObject()
+    {
+        return isFinalObjectSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateFinalObjectOrOther()
+    {
+        return isFinalObjectOrOtherSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateArray()
+    {
+        return isArraySpeculation(prediction());
+    }
+
+    bool shouldSpeculateProxyObject()
+    {
+        return isProxyObjectSpeculation(prediction());
+    }
+
+    bool shouldSpeculateDerivedArray()
+    {
+        return isDerivedArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateDirectArguments()
+    {
+        return isDirectArgumentsSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateScopedArguments()
+    {
+        return isScopedArgumentsSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateInt8Array()
+    {
+        return isInt8ArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateInt16Array()
+    {
+        return isInt16ArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateInt32Array()
+    {
+        return isInt32ArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateUint8Array()
+    {
+        return isUint8ArraySpeculation(prediction());
+    }
+
+    bool shouldSpeculateUint8ClampedArray()
+    {
+        return isUint8ClampedArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateUint16Array()
+    {
+        return isUint16ArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateUint32Array()
+    {
+        return isUint32ArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateFloat32Array()
+    {
+        return isFloat32ArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateFloat64Array()
+    {
+        return isFloat64ArraySpeculation(prediction());
+    }
+    
+    bool shouldSpeculateArrayOrOther()
+    {
+        return isArrayOrOtherSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateObject()
+    {
+        return isObjectSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateObjectOrOther()
+    {
+        return isObjectOrOtherSpeculation(prediction());
+    }
+
+    bool shouldSpeculateCell()
+    {
+        return isCellSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateCellOrOther()
+    {
+        return isCellOrOtherSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateNotCell()
+    {
+        return isNotCellSpeculation(prediction());
+    }
+    
+    bool shouldSpeculateUntypedForArithmetic()
+    {
+        return isUntypedSpeculationForArithmetic(prediction());
+    }
+
+    static bool shouldSpeculateUntypedForArithmetic(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateUntypedForArithmetic() || op2->shouldSpeculateUntypedForArithmetic();
+    }
+    
+    bool shouldSpeculateUntypedForBitOps()
+    {
+        return isUntypedSpeculationForBitOps(prediction());
+    }
+    
+    static bool shouldSpeculateUntypedForBitOps(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateUntypedForBitOps() || op2->shouldSpeculateUntypedForBitOps();
+    }
+    
+    static bool shouldSpeculateBoolean(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateBoolean() && op2->shouldSpeculateBoolean();
+    }
+    
+    static bool shouldSpeculateInt32(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateInt32() && op2->shouldSpeculateInt32();
+    }
+    
+    static bool shouldSpeculateInt32OrBoolean(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateInt32OrBoolean()
+            && op2->shouldSpeculateInt32OrBoolean();
+    }
+    
+    static bool shouldSpeculateInt32OrBooleanForArithmetic(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateInt32OrBooleanForArithmetic()
+            && op2->shouldSpeculateInt32OrBooleanForArithmetic();
+    }
+    
+    static bool shouldSpeculateInt32OrBooleanExpectingDefined(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateInt32OrBooleanExpectingDefined()
+            && op2->shouldSpeculateInt32OrBooleanExpectingDefined();
+    }
+    
+    static bool shouldSpeculateAnyInt(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateAnyInt() && op2->shouldSpeculateAnyInt();
+    }
+    
+    static bool shouldSpeculateNumber(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateNumber() && op2->shouldSpeculateNumber();
+    }
+    
+    static bool shouldSpeculateNumberOrBoolean(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateNumberOrBoolean()
+            && op2->shouldSpeculateNumberOrBoolean();
+    }
+    
+    static bool shouldSpeculateNumberOrBooleanExpectingDefined(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateNumberOrBooleanExpectingDefined()
+            && op2->shouldSpeculateNumberOrBooleanExpectingDefined();
+    }
+
+    static bool shouldSpeculateSymbol(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateSymbol() && op2->shouldSpeculateSymbol();
+    }
+    
+    static bool shouldSpeculateFinalObject(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateFinalObject() && op2->shouldSpeculateFinalObject();
+    }
+
+    static bool shouldSpeculateArray(Node* op1, Node* op2)
+    {
+        return op1->shouldSpeculateArray() && op2->shouldSpeculateArray();
+    }
+    
+    bool canSpeculateInt32(RareCaseProfilingSource source)
+    {
+        return nodeCanSpeculateInt32(arithNodeFlags(), source);
+    }
+    
+    bool canSpeculateInt52(RareCaseProfilingSource source)
+    {
+        return nodeCanSpeculateInt52(arithNodeFlags(), source);
+    }
+    
+    RareCaseProfilingSource sourceFor(PredictionPass pass)
+    {
+        if (pass == PrimaryPass || child1()->sawBooleans() || (child2() && child2()->sawBooleans()))
+            return DFGRareCase;
+        return AllRareCases;
+    }
+    
+    bool canSpeculateInt32(PredictionPass pass)
+    {
+        return canSpeculateInt32(sourceFor(pass));
+    }
+    
+    bool canSpeculateInt52(PredictionPass pass)
+    {
+        return canSpeculateInt52(sourceFor(pass));
+    }
+
+    bool hasTypeLocation()
+    {
+        return op() == ProfileType;
+    }
+
+    TypeLocation* typeLocation()
+    {
+        ASSERT(hasTypeLocation());
+        return m_opInfo.as<TypeLocation*>();
+    }
+
+    bool hasBasicBlockLocation()
+    {
+        return op() == ProfileControlFlow;
+    }
+
+    BasicBlockLocation* basicBlockLocation()
+    {
+        ASSERT(hasBasicBlockLocation());
+        return m_opInfo.as<BasicBlockLocation*>();
+    }
+
+    bool hasCheckDOMPatchpoint() const
+    {
+        return op() == CheckDOM;
+    }
+
+    DOMJIT::Patchpoint* checkDOMPatchpoint()
+    {
+        ASSERT(hasCheckDOMPatchpoint());
+        return m_opInfo.as<DOMJIT::Patchpoint*>();
+    }
+
+    bool hasCallDOMGetterData() const
+    {
+        return op() == CallDOMGetter;
+    }
+
+    CallDOMGetterData* callDOMGetterData()
+    {
+        ASSERT(hasCallDOMGetterData());
+        return m_opInfo.as<CallDOMGetterData*>();
+    }
+
+    bool hasClassInfo() const
+    {
+        return op() == CheckDOM;
+    }
+
+    const ClassInfo* classInfo()
+    {
+        return m_opInfo2.as<const ClassInfo*>();
+    }
+
+    bool hasSignature() const
+    {
+        // Note that this does not include TailCall node types intentionally.
+        // CallDOM node types are always converted from Call.
+        return op() == Call || op() == CallDOM;
+    }
+
+    const DOMJIT::Signature* signature()
+    {
+        return m_opInfo.as<const DOMJIT::Signature*>();
+    }
+
+    Node* replacement() const
+    {
+        return m_misc.replacement;
+    }
+    
+    void setReplacement(Node* replacement)
+    {
+        m_misc.replacement = replacement;
+    }
+    
+    Epoch epoch() const
+    {
+        return Epoch::fromUnsigned(m_misc.epoch);
+    }
+    
+    void setEpoch(Epoch epoch)
+    {
+        m_misc.epoch = epoch.toUnsigned();
+    }
+
+    unsigned numberOfArgumentsToSkip()
+    {
+        ASSERT(op() == CreateRest || op() == PhantomCreateRest || op() == GetRestLength || op() == GetMyArgumentByVal || op() == GetMyArgumentByValOutOfBounds);
+        return m_opInfo.as<unsigned>();
+    }
+
+    bool hasArgumentIndex()
+    {
+        return op() == GetArgument;
+    }
+
+    unsigned argumentIndex()
+    {
+        ASSERT(hasArgumentIndex());
+        return m_opInfo.as<unsigned>();
+    }
+
+    void dumpChildren(PrintStream& out)
+    {
+        if (!child1())
+            return;
+        out.printf("@%u", child1()->index());
+        if (!child2())
+            return;
+        out.printf(", @%u", child2()->index());
+        if (!child3())
+            return;
+        out.printf(", @%u", child3()->index());
+    }
+    
+    // NB. This class must have a trivial destructor.
+
+    NodeOrigin origin;
+
+    // References to up to 3 children, or links to a variable length set of children.
+    AdjacencyList children;
+
+private:
+    friend class Graph;
+
+    unsigned m_index { std::numeric_limits<unsigned>::max() };
+    unsigned m_op : 10; // real type is NodeType
+    unsigned m_flags : 20;
+    // The virtual register number (spill location) associated with this .
+    VirtualRegister m_virtualRegister;
+    // The number of uses of the result of this operation (+1 for 'must generate' nodes, which have side-effects).
+    unsigned m_refCount;
+    // The prediction ascribed to this node after propagation.
+    SpeculatedType m_prediction { SpecNone };
+    // Immediate values, accesses type-checked via accessors above.
+    struct OpInfoWrapper {
+        OpInfoWrapper()
+        {
+            u.int64 = 0;
+        }
+        OpInfoWrapper(uint32_t intValue)
+        {
+            u.int64 = 0;
+            u.int32 = intValue;
+        }
+        OpInfoWrapper(uint64_t intValue)
+        {
+            u.int64 = intValue;
+        }
+        OpInfoWrapper(void* pointer)
+        {
+            u.int64 = 0;
+            u.pointer = pointer;
+        }
+        OpInfoWrapper(const void* constPointer)
+        {
+            u.int64 = 0;
+            u.constPointer = constPointer;
+        }
+        OpInfoWrapper(RegisteredStructure structure)
+        {
+            u.int64 = 0;
+            u.pointer = bitwise_cast<void*>(structure);
+        }
+        OpInfoWrapper& operator=(uint32_t int32)
+        {
+            u.int64 = 0;
+            u.int32 = int32;
+            return *this;
+        }
+        OpInfoWrapper& operator=(int32_t int32)
+        {
+            u.int64 = 0;
+            u.int32 = int32;
+            return *this;
+        }
+        OpInfoWrapper& operator=(uint64_t int64)
+        {
+            u.int64 = int64;
+            return *this;
+        }
+        OpInfoWrapper& operator=(void* pointer)
+        {
+            u.int64 = 0;
+            u.pointer = pointer;
+            return *this;
+        }
+        OpInfoWrapper& operator=(const void* constPointer)
+        {
+            u.int64 = 0;
+            u.constPointer = constPointer;
+            return *this;
+        }
+        OpInfoWrapper& operator=(RegisteredStructure structure)
+        {
+            u.int64 = 0;
+            u.pointer = bitwise_cast<void*>(structure);
+            return *this;
+        }
+        template <typename T>
+        ALWAYS_INLINE auto as() const -> typename std::enable_if<std::is_pointer<T>::value && !std::is_const<typename std::remove_pointer<T>::type>::value, T>::type
+        {
+            return static_cast<T>(u.pointer);
+        }
+        template <typename T>
+        ALWAYS_INLINE auto as() const -> typename std::enable_if<std::is_pointer<T>::value && std::is_const<typename std::remove_pointer<T>::type>::value, T>::type
+        {
+            return static_cast<T>(u.constPointer);
+        }
+        template <typename T>
+        ALWAYS_INLINE auto as() const -> typename std::enable_if<std::is_integral<T>::value && sizeof(T) == 4, T>::type
+        {
+            return u.int32;
+        }
+        template <typename T>
+        ALWAYS_INLINE auto as() const -> typename std::enable_if<std::is_integral<T>::value && sizeof(T) == 8, T>::type
+        {
+            return u.int64;
+        }
+        ALWAYS_INLINE RegisteredStructure asRegisteredStructure() const
+        {
+            return bitwise_cast<RegisteredStructure>(u.pointer);
+        }
+
+        union {
+            uint32_t int32;
+            uint64_t int64;
+            void* pointer;
+            const void* constPointer;
+        } u;
+    };
+    OpInfoWrapper m_opInfo;
+    OpInfoWrapper m_opInfo2;
+
+    // Miscellaneous data that is usually meaningless, but can hold some analysis results
+    // if you ask right. For example, if you do Graph::initializeNodeOwners(), Node::owner
+    // will tell you which basic block a node belongs to. You cannot rely on this persisting
+    // across transformations unless you do the maintenance work yourself. Other phases use
+    // Node::replacement, but they do so manually: first you do Graph::clearReplacements()
+    // and then you set, and use, replacement's yourself. Same thing for epoch.
+    //
+    // Bottom line: don't use these fields unless you initialize them yourself, or by
+    // calling some appropriate methods that initialize them the way you want. Otherwise,
+    // these fields are meaningless.
+private:
+    union {
+        Node* replacement;
+        unsigned epoch;
+    } m_misc;
+public:
+    BasicBlock* owner;
+};
+
+struct NodeComparator {
+    template<typename NodePtrType>
+    bool operator()(NodePtrType a, NodePtrType b) const
+    {
+        return a->index() < b->index();
+    }
+};
+
+template<typename T>
+CString nodeListDump(const T& nodeList)
+{
+    return sortedListDump(nodeList, NodeComparator());
+}
+
+template<typename T>
+CString nodeMapDump(const T& nodeMap, DumpContext* context = 0)
+{
+    Vector<typename T::KeyType> keys;
+    for (
+        typename T::const_iterator iter = nodeMap.begin();
+        iter != nodeMap.end(); ++iter)
+        keys.append(iter->key);
+    std::sort(keys.begin(), keys.end(), NodeComparator());
+    StringPrintStream out;
+    CommaPrinter comma;
+    for(unsigned i = 0; i < keys.size(); ++i)
+        out.print(comma, keys[i], "=>", inContext(nodeMap.get(keys[i]), context));
+    return out.toCString();
+}
+
+template<typename T>
+CString nodeValuePairListDump(const T& nodeValuePairList, DumpContext* context = 0)
+{
+    using V = typename T::ValueType;
+    T sortedList = nodeValuePairList;
+    std::sort(sortedList.begin(), sortedList.end(), [](const V& a, const V& b) {
+        return NodeComparator()(a.node, b.node);
+    });
+
+    StringPrintStream out;
+    CommaPrinter comma;
+    for (const auto& pair : sortedList)
+        out.print(comma, pair.node, "=>", inContext(pair.value, context));
+    return out.toCString();
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::SwitchKind);
+void printInternal(PrintStream&, JSC::DFG::Node*);
+
+inline JSC::DFG::Node* inContext(JSC::DFG::Node* node, JSC::DumpContext*) { return node; }
+
+} // namespace WTF
+
+using WTF::inContext;
+
+#endif
diff --git a/dfg/DFGNodeAbstractValuePair.cpp b/dfg/DFGNodeAbstractValuePair.cpp
new file mode 100644
index 0000000..bd6aef7
--- /dev/null
+++ b/dfg/DFGNodeAbstractValuePair.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNodeAbstractValuePair.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void NodeAbstractValuePair::dump(PrintStream& out) const
+{
+    out.print(node, "=>", value);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGNodeAbstractValuePair.h b/dfg/DFGNodeAbstractValuePair.h
new file mode 100644
index 0000000..8a719e6
--- /dev/null
+++ b/dfg/DFGNodeAbstractValuePair.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractValue.h"
+#include "DFGNodeFlowProjection.h"
+
+namespace JSC { namespace DFG {
+
+struct NodeAbstractValuePair {
+    NodeAbstractValuePair() { }
+    
+    NodeAbstractValuePair(NodeFlowProjection node, const AbstractValue& value)
+        : node(node)
+        , value(value)
+    {
+    }
+    
+    void dump(PrintStream& out) const;
+    
+    NodeFlowProjection node;
+    AbstractValue value;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGNodeAllocator.h b/dfg/DFGNodeAllocator.h
new file mode 100644
index 0000000..89388b5
--- /dev/null
+++ b/dfg/DFGNodeAllocator.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAllocator.h"
+#include "DFGNode.h"
+
+namespace JSC { namespace DFG {
+
+typedef Allocator<Node> NodeAllocator;
+
+} } // namespace JSC::DFG
+
+inline void* operator new (size_t size, JSC::DFG::NodeAllocator& allocator)
+{
+    ASSERT_UNUSED(size, size == sizeof(JSC::DFG::Node));
+    return allocator.allocate();
+}
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGNodeFlags.cpp b/dfg/DFGNodeFlags.cpp
new file mode 100644
index 0000000..3408421
--- /dev/null
+++ b/dfg/DFGNodeFlags.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNodeFlags.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace DFG {
+
+void dumpNodeFlags(PrintStream& actualOut, NodeFlags flags)
+{
+    StringPrintStream out;
+    CommaPrinter comma("|");
+    
+    if (flags & NodeResultMask) {
+        switch (flags & NodeResultMask) {
+        case NodeResultJS:
+            out.print(comma, "JS");
+            break;
+        case NodeResultNumber:
+            out.print(comma, "Number");
+            break;
+        case NodeResultDouble:
+            out.print(comma, "Double");
+            break;
+        case NodeResultInt32:
+            out.print(comma, "Int32");
+            break;
+        case NodeResultInt52:
+            out.print(comma, "Int52");
+            break;
+        case NodeResultBoolean:
+            out.print(comma, "Boolean");
+            break;
+        case NodeResultStorage:
+            out.print(comma, "Storage");
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+    
+    if (flags & NodeMustGenerate)
+        out.print(comma, "MustGen");
+    
+    if (flags & NodeHasVarArgs)
+        out.print(comma, "VarArgs");
+    
+    if (flags & NodeResultMask) {
+        if (!(flags & NodeBytecodeUsesAsNumber) && !(flags & NodeBytecodeNeedsNegZero))
+            out.print(comma, "PureInt");
+        else if (!(flags & NodeBytecodeUsesAsNumber))
+            out.print(comma, "PureInt(w/ neg zero)");
+        else if (!(flags & NodeBytecodeNeedsNegZero))
+            out.print(comma, "PureNum");
+        if (flags & NodeBytecodeUsesAsOther)
+            out.print(comma, "UseAsOther");
+    }
+
+    if (flags & NodeMayHaveDoubleResult)
+        out.print(comma, "MayHaveDoubleResult");
+
+    if (flags & NodeMayHaveNonNumberResult)
+        out.print(comma, "MayHaveNonNumberResult");
+
+    if (flags & NodeMayOverflowInt52)
+        out.print(comma, "MayOverflowInt52");
+
+    if (flags & NodeMayOverflowInt32InBaseline)
+        out.print(comma, "MayOverflowInt32InBaseline");
+
+    if (flags & NodeMayOverflowInt32InDFG)
+        out.print(comma, "MayOverflowInt32InDFG");
+
+    if (flags & NodeMayNegZeroInBaseline)
+        out.print(comma, "MayNegZeroInBaseline");
+    
+    if (flags & NodeMayNegZeroInDFG)
+        out.print(comma, "MayNegZeroInDFG");
+    
+    if (flags & NodeBytecodeUsesAsInt)
+        out.print(comma, "UseAsInt");
+
+    if (flags & NodeBytecodeUsesAsArrayIndex)
+        out.print(comma, "ReallyWantsInt");
+    
+    if (flags & NodeIsFlushed)
+        out.print(comma, "IsFlushed");
+    
+    CString string = out.toCString();
+    if (!string.length())
+        actualOut.print("<empty>");
+    else
+        actualOut.print(string);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGNodeFlags.h b/dfg/DFGNodeFlags.h
new file mode 100644
index 0000000..4abaddf
--- /dev/null
+++ b/dfg/DFGNodeFlags.h
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/PrintStream.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC { namespace DFG {
+
+// Entries in the NodeType enum (below) are composed of an id, a result type (possibly none)
+// and some additional informative flags (must generate, is constant, etc).
+#define NodeResultMask                   0x0007
+#define NodeResultJS                     0x0001
+#define NodeResultNumber                 0x0002
+#define NodeResultDouble                 0x0003
+#define NodeResultInt32                  0x0004
+#define NodeResultInt52                  0x0005
+#define NodeResultBoolean                0x0006
+#define NodeResultStorage                0x0007
+                                
+#define NodeMustGenerate                 0x0008 // set on nodes that have side effects, and may not trivially be removed by DCE.
+#define NodeHasVarArgs                   0x0010
+    
+#define NodeBehaviorMask                 0x07e0
+#define NodeMayHaveDoubleResult          0x0020
+#define NodeMayOverflowInt52             0x0040
+#define NodeMayOverflowInt32InBaseline   0x0080
+#define NodeMayOverflowInt32InDFG        0x0100
+#define NodeMayNegZeroInBaseline         0x0200
+#define NodeMayNegZeroInDFG              0x0400
+#define NodeMayHaveNonNumberResult       0x0800
+#define NodeMayHaveNonIntResult          (NodeMayHaveDoubleResult | NodeMayHaveNonNumberResult)
+                                
+#define NodeBytecodeBackPropMask        0x1f000
+#define NodeBytecodeUseBottom           0x00000
+#define NodeBytecodeUsesAsNumber        0x01000 // The result of this computation may be used in a context that observes fractional, or bigger-than-int32, results.
+#define NodeBytecodeNeedsNegZero        0x02000 // The result of this computation may be used in a context that observes -0.
+#define NodeBytecodeUsesAsOther         0x04000 // The result of this computation may be used in a context that distinguishes between NaN and other things (like undefined).
+#define NodeBytecodeUsesAsValue         (NodeBytecodeUsesAsNumber | NodeBytecodeNeedsNegZero | NodeBytecodeUsesAsOther)
+#define NodeBytecodeUsesAsInt           0x08000 // The result of this computation is known to be used in a context that prefers, but does not require, integer values.
+#define NodeBytecodeUsesAsArrayIndex    0x10000 // The result of this computation is known to be used in a context that strongly prefers integer values, to the point that we should avoid using doubles if at all possible.
+
+#define NodeArithFlagsMask               (NodeBehaviorMask | NodeBytecodeBackPropMask)
+
+#define NodeIsFlushed                   0x20000 // Computed by CPSRethreadingPhase, will tell you which local nodes are backwards-reachable from a Flush.
+
+#define NodeMiscFlag1                   0x40000
+#define NodeMiscFlag2                   0x80000
+
+typedef uint32_t NodeFlags;
+
+static inline bool bytecodeUsesAsNumber(NodeFlags flags)
+{
+    return !!(flags & NodeBytecodeUsesAsNumber);
+}
+
+static inline bool bytecodeCanTruncateInteger(NodeFlags flags)
+{
+    return !bytecodeUsesAsNumber(flags);
+}
+
+static inline bool bytecodeCanIgnoreNegativeZero(NodeFlags flags)
+{
+    return !(flags & NodeBytecodeNeedsNegZero);
+}
+
+enum RareCaseProfilingSource {
+    BaselineRareCase, // Comes from slow case counting in the baseline JIT.
+    DFGRareCase, // Comes from OSR exit profiles.
+    AllRareCases
+};
+
+static inline bool nodeMayOverflowInt52(NodeFlags flags, RareCaseProfilingSource)
+{
+    return !!(flags & NodeMayOverflowInt52);
+}
+
+static inline bool nodeMayOverflowInt32(NodeFlags flags, RareCaseProfilingSource source)
+{
+    NodeFlags mask = 0;
+    switch (source) {
+    case BaselineRareCase:
+        mask = NodeMayOverflowInt32InBaseline;
+        break;
+    case DFGRareCase:
+        mask = NodeMayOverflowInt32InDFG;
+        break;
+    case AllRareCases:
+        mask = NodeMayOverflowInt32InBaseline | NodeMayOverflowInt32InDFG;
+        break;
+    }
+    return !!(flags & mask);
+}
+
+static inline bool nodeMayNegZero(NodeFlags flags, RareCaseProfilingSource source)
+{
+    NodeFlags mask = 0;
+    switch (source) {
+    case BaselineRareCase:
+        mask = NodeMayNegZeroInBaseline;
+        break;
+    case DFGRareCase:
+        mask = NodeMayNegZeroInDFG;
+        break;
+    case AllRareCases:
+        mask = NodeMayNegZeroInBaseline | NodeMayNegZeroInDFG;
+        break;
+    }
+    return !!(flags & mask);
+}
+
+static inline bool nodeCanSpeculateInt32(NodeFlags flags, RareCaseProfilingSource source)
+{
+    if (nodeMayOverflowInt32(flags, source))
+        return !bytecodeUsesAsNumber(flags);
+    
+    if (nodeMayNegZero(flags, source))
+        return bytecodeCanIgnoreNegativeZero(flags);
+    
+    return true;
+}
+
+static inline bool nodeCanSpeculateInt52(NodeFlags flags, RareCaseProfilingSource source)
+{
+    if (nodeMayOverflowInt52(flags, source))
+        return false;
+
+    if (nodeMayNegZero(flags, source))
+        return bytecodeCanIgnoreNegativeZero(flags);
+    
+    return true;
+}
+
+// FIXME: Get rid of this.
+// https://bugs.webkit.org/show_bug.cgi?id=131689
+static inline NodeFlags canonicalResultRepresentation(NodeFlags flags)
+{
+    switch (flags) {
+    case NodeResultDouble:
+    case NodeResultInt52:
+    case NodeResultStorage:
+        return flags;
+    default:
+        return NodeResultJS;
+    }
+}
+
+void dumpNodeFlags(PrintStream&, NodeFlags);
+MAKE_PRINT_ADAPTOR(NodeFlagsDump, NodeFlags, dumpNodeFlags);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGNodeFlowProjection.cpp b/dfg/DFGNodeFlowProjection.cpp
new file mode 100644
index 0000000..38eebec
--- /dev/null
+++ b/dfg/DFGNodeFlowProjection.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNodeFlowProjection.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void NodeFlowProjection::dump(PrintStream& out) const
+{
+    if (!*this) {
+        out.print("-");
+        return;
+    }
+    if (kind() == Primary) {
+        out.print(node());
+        return;
+    }
+    out.print("shadow(", node(), ")");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGNodeFlowProjection.h b/dfg/DFGNodeFlowProjection.h
new file mode 100644
index 0000000..21722b2
--- /dev/null
+++ b/dfg/DFGNodeFlowProjection.h
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNode.h"
+#include <wtf/HashTable.h>
+
+namespace JSC { namespace DFG {
+
+class NodeFlowProjection {
+public:
+    enum Kind {
+        Primary,
+        Shadow
+    };
+    
+    NodeFlowProjection() { }
+    
+    NodeFlowProjection(Node* node)
+        : m_word(bitwise_cast<uintptr_t>(node))
+    {
+        ASSERT(kind() == Primary);
+    }
+    
+    NodeFlowProjection(Node* node, Kind kind)
+        : m_word(bitwise_cast<uintptr_t>(node) | (kind == Shadow ? shadowBit : 0))
+    {
+        ASSERT(this->kind() == kind);
+    }
+    
+    NodeFlowProjection(WTF::HashTableDeletedValueType)
+        : m_word(shadowBit)
+    {
+    }
+    
+    explicit operator bool() const { return !!m_word; }
+    
+    Kind kind() const { return (m_word & shadowBit) ? Shadow : Primary; }
+    
+    Node* node() const { return bitwise_cast<Node*>(m_word & ~shadowBit); }
+    
+    Node& operator*() const { return *node(); }
+    Node* operator->() const { return node(); }
+    
+    unsigned hash() const
+    {
+        return m_word;
+    }
+    
+    bool operator==(NodeFlowProjection other) const
+    {
+        return m_word == other.m_word;
+    }
+    
+    bool operator!=(NodeFlowProjection other) const
+    {
+        return !(*this == other);
+    }
+    
+    bool operator<(NodeFlowProjection other) const
+    {
+        if (kind() != other.kind())
+            return kind() < other.kind();
+        return node() < other.node();
+    }
+    
+    bool operator>(NodeFlowProjection other) const
+    {
+        return other < *this;
+    }
+    
+    bool operator<=(NodeFlowProjection other) const
+    {
+        return !(*this > other);
+    }
+    
+    bool operator>=(NodeFlowProjection other) const
+    {
+        return !(*this < other);
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return *this == NodeFlowProjection(WTF::HashTableDeletedValue);
+    }
+    
+    // Phi shadow projections can become invalid because the Phi might be folded to something else.
+    bool isStillValid() const
+    {
+        return *this && (kind() == Primary || node()->op() == Phi);
+    }
+    
+    void dump(PrintStream&) const;
+    
+    template<typename Func>
+    static void forEach(Node* node, const Func& func)
+    {
+        func(NodeFlowProjection(node));
+        if (node->op() == Phi)
+            func(NodeFlowProjection(node, Shadow));
+    }
+    
+public:
+    static const uintptr_t shadowBit = 1;
+    
+    uintptr_t m_word { 0 };
+};
+
+struct NodeFlowProjectionHash {
+    static unsigned hash(NodeFlowProjection key) { return key.hash(); }
+    static bool equal(NodeFlowProjection a, NodeFlowProjection b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::NodeFlowProjection> {
+    typedef JSC::DFG::NodeFlowProjectionHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::NodeFlowProjection> : SimpleClassHashTraits<JSC::DFG::NodeFlowProjection> { };
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGNodeOrigin.cpp b/dfg/DFGNodeOrigin.cpp
new file mode 100644
index 0000000..94b6715
--- /dev/null
+++ b/dfg/DFGNodeOrigin.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGNodeOrigin.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void NodeOrigin::dump(PrintStream& out) const
+{
+    out.print("{semantic: ", semantic, ", forExit: ", forExit, ", exitOK: ", exitOK, ", wasHoisted: ", wasHoisted, "}");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGNodeOrigin.h b/dfg/DFGNodeOrigin.h
new file mode 100644
index 0000000..76b747e
--- /dev/null
+++ b/dfg/DFGNodeOrigin.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeOrigin.h"
+#include "DFGClobbersExitState.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+struct Node;
+
+struct NodeOrigin {
+    NodeOrigin() { }
+    
+    NodeOrigin(CodeOrigin semantic, CodeOrigin forExit, bool exitOK)
+        : semantic(semantic)
+        , forExit(forExit)
+        , exitOK(exitOK)
+    {
+    }
+
+    bool isSet() const
+    {
+        ASSERT(semantic.isSet() == forExit.isSet());
+        return semantic.isSet();
+    }
+    
+    NodeOrigin withSemantic(CodeOrigin semantic) const
+    {
+        if (!isSet())
+            return NodeOrigin();
+        
+        NodeOrigin result = *this;
+        if (semantic.isSet())
+            result.semantic = semantic;
+        return result;
+    }
+
+    NodeOrigin withForExitAndExitOK(CodeOrigin forExit, bool exitOK) const
+    {
+        if (!isSet())
+            return NodeOrigin();
+        
+        NodeOrigin result = *this;
+        if (forExit.isSet())
+            result.forExit = forExit;
+        result.exitOK = exitOK;
+        return result;
+    }
+
+    NodeOrigin withExitOK(bool value) const
+    {
+        NodeOrigin result = *this;
+        result.exitOK = value;
+        return result;
+    }
+
+    NodeOrigin withInvalidExit() const
+    {
+        return withExitOK(false);
+    }
+
+    NodeOrigin takeValidExit(bool& canExit) const
+    {
+        return withExitOK(exitOK & std::exchange(canExit, false));
+    }
+    
+    NodeOrigin withWasHoisted() const
+    {
+        NodeOrigin result = *this;
+        result.wasHoisted = true;
+        return result;
+    }
+    
+    NodeOrigin forInsertingAfter(Graph& graph, Node* node) const
+    {
+        NodeOrigin result = *this;
+        if (exitOK && clobbersExitState(graph, node))
+            result.exitOK = false;
+        return result;
+    }
+
+    bool operator==(const NodeOrigin& other) const
+    {
+        return semantic == other.semantic
+            && forExit == other.forExit
+            && exitOK == other.exitOK;
+    }
+
+    bool operator!=(const NodeOrigin& other) const
+    {
+        return !(*this == other);
+    }
+
+    void dump(PrintStream&) const;
+
+    // Used for determining what bytecode this came from. This is important for
+    // debugging, exceptions, and even basic execution semantics.
+    CodeOrigin semantic;
+    // Code origin for where the node exits to.
+    CodeOrigin forExit;
+    // Whether or not it is legal to exit here.
+    bool exitOK { false };
+    // Whether or not the node has been hoisted.
+    bool wasHoisted { false };
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGNodeType.h b/dfg/DFGNodeType.h
new file mode 100644
index 0000000..6af4b35
--- /dev/null
+++ b/dfg/DFGNodeType.h
@@ -0,0 +1,445 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNodeFlags.h"
+
+namespace JSC { namespace DFG {
+
+// This macro defines a set of information about all known node types, used to populate NodeId, NodeType below.
+#define FOR_EACH_DFG_OP(macro) \
+    /* A constant in the CodeBlock's constant pool. */\
+    macro(JSConstant, NodeResultJS) \
+    \
+    /* Constants with specific representations. */\
+    macro(DoubleConstant, NodeResultDouble) \
+    macro(Int52Constant, NodeResultInt52) \
+    \
+    /* Lazy JSValue constant. We don't know the JSValue bits of it yet. */\
+    macro(LazyJSConstant, NodeResultJS) \
+    \
+    /* Marker to indicate that an operation was optimized entirely and all that is left */\
+    /* is to make one node alias another. CSE will later usually eliminate this node, */\
+    /* though it may choose not to if it would corrupt predictions (very rare). */\
+    macro(Identity, NodeResultJS) \
+    \
+    /* Nodes for handling functions (both as call and as construct). */\
+    macro(ToThis, NodeResultJS) \
+    macro(CreateThis, NodeResultJS) /* Note this is not MustGenerate since we're returning it anyway. */ \
+    macro(GetCallee, NodeResultJS) \
+    macro(GetArgumentCountIncludingThis, NodeResultInt32) \
+    \
+    /* Nodes for local variable access. These nodes are linked together using Phi nodes. */\
+    /* Any two nodes that are part of the same Phi graph will share the same */\
+    /* VariableAccessData, and thus will share predictions. FIXME: We should come up with */\
+    /* better names for a lot of these. https://bugs.webkit.org/show_bug.cgi?id=137307. */\
+    /* Note that GetLocal is MustGenerate because it's our only way of knowing that some other */\
+    /* basic block might have read a local variable in bytecode. We only remove GetLocals if it */\
+    /* is redundant because of an earlier GetLocal or SetLocal in the same block. We could make */\
+    /* these not MustGenerate and use a more sophisticated analysis to insert PhantomLocals in */\
+    /* the same way that we insert Phantoms. That's hard and probably not profitable. See */\
+    /* https://bugs.webkit.org/show_bug.cgi?id=144086 */\
+    macro(GetLocal, NodeResultJS | NodeMustGenerate) \
+    macro(SetLocal, 0) \
+    \
+    macro(PutStack, NodeMustGenerate) \
+    macro(KillStack, NodeMustGenerate) \
+    macro(GetStack, NodeResultJS) \
+    \
+    macro(MovHint, NodeMustGenerate) \
+    macro(ZombieHint, NodeMustGenerate) \
+    macro(ExitOK, NodeMustGenerate) /* Indicates that exit state is intact. */ \
+    macro(Phantom, NodeMustGenerate) \
+    macro(Check, NodeMustGenerate) /* Used if we want just a type check but not liveness. Non-checking uses will be removed. */\
+    macro(Upsilon, 0) \
+    macro(Phi, 0) \
+    macro(Flush, NodeMustGenerate) \
+    macro(PhantomLocal, NodeMustGenerate) \
+    \
+    /* Hint that this is where bytecode thinks is a good place to OSR. Note that this */\
+    /* will exist even in inlined loops. This has no execution semantics but it must */\
+    /* survive all DCE. We treat this as being a can-exit because tier-up to FTL may */\
+    /* want all state. */\
+    macro(LoopHint, NodeMustGenerate) \
+    \
+    /* Special node for OSR entry into the FTL. Indicates that we're loading a local */\
+    /* variable from the scratch buffer. */\
+    macro(ExtractOSREntryLocal, NodeResultJS) \
+    \
+    /* Tier-up checks from the DFG to the FTL. */\
+    macro(CheckTierUpInLoop, NodeMustGenerate) \
+    macro(CheckTierUpAndOSREnter, NodeMustGenerate) \
+    macro(CheckTierUpAtReturn, NodeMustGenerate) \
+    \
+    /* Get the value of a local variable, without linking into the VariableAccessData */\
+    /* network. This is only valid for variable accesses whose predictions originated */\
+    /* as something other than a local access, and thus had their own profiling. */\
+    macro(GetLocalUnlinked, NodeResultJS) \
+    \
+    /* Marker for an argument being set at the prologue of a function. */\
+    macro(SetArgument, 0) \
+    \
+    /* Marker of location in the IR where we may possibly perform jump replacement to */\
+    /* invalidate this code block. */\
+    macro(InvalidationPoint, NodeMustGenerate) \
+    \
+    /* Nodes for bitwise operations. */\
+    macro(BitAnd, NodeResultInt32) \
+    macro(BitOr, NodeResultInt32) \
+    macro(BitXor, NodeResultInt32) \
+    macro(BitLShift, NodeResultInt32) \
+    macro(BitRShift, NodeResultInt32) \
+    macro(BitURShift, NodeResultInt32) \
+    /* Bitwise operators call ToInt32 on their operands. */\
+    macro(ValueToInt32, NodeResultInt32) \
+    /* Used to box the result of URShift nodes (result has range 0..2^32-1). */\
+    macro(UInt32ToNumber, NodeResultNumber | NodeMustGenerate) \
+    /* Converts booleans to numbers but passes everything else through. */\
+    macro(BooleanToNumber, NodeResultJS) \
+    \
+    /* Attempt to truncate a double to int32; this will exit if it can't do it. */\
+    macro(DoubleAsInt32, NodeResultInt32) \
+    \
+    /* Change the representation of a value. */\
+    macro(DoubleRep, NodeResultDouble) \
+    macro(Int52Rep, NodeResultInt52) \
+    macro(ValueRep, NodeResultJS) \
+    \
+    /* Bogus type asserting node. Useful for testing, disappears during Fixup. */\
+    macro(FiatInt52, NodeResultJS) \
+    \
+    /* Nodes for arithmetic operations. Note that if they do checks other than just type checks, */\
+    /* then they are MustGenerate. This is probably stricter than it needs to be - for example */\
+    /* they won't do checks if they are speculated double. Also, we could kill these if we do it */\
+    /* before AI starts eliminating downstream operations based on proofs, for example in the */\
+    /* case of "var tmp = a + b; return (tmp | 0) == tmp;". If a, b are speculated integer then */\
+    /* this is only true if we do the overflow check - hence the need to keep it alive. More */\
+    /* generally, we need to keep alive any operation whose checks cause filtration in AI. */\
+    macro(ArithAdd, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithClz32, NodeResultInt32 | NodeMustGenerate) \
+    macro(ArithSub, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithNegate, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithMul, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithIMul, NodeResultInt32) \
+    macro(ArithDiv, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithMod, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithAbs, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithMin, NodeResultNumber) \
+    macro(ArithMax, NodeResultNumber) \
+    macro(ArithFRound, NodeResultDouble | NodeMustGenerate) \
+    macro(ArithPow, NodeResultDouble) \
+    macro(ArithRandom, NodeResultDouble | NodeMustGenerate) \
+    macro(ArithRound, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithFloor, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithCeil, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithTrunc, NodeResultNumber | NodeMustGenerate) \
+    macro(ArithSqrt, NodeResultDouble | NodeMustGenerate) \
+    macro(ArithSin, NodeResultDouble | NodeMustGenerate) \
+    macro(ArithCos, NodeResultDouble | NodeMustGenerate) \
+    macro(ArithTan, NodeResultDouble | NodeMustGenerate) \
+    macro(ArithLog, NodeResultDouble | NodeMustGenerate) \
+    \
+    /* Add of values may either be arithmetic, or result in string concatenation. */\
+    macro(ValueAdd, NodeResultJS | NodeMustGenerate) \
+    \
+    /* Add of values that always convers its inputs to strings. May have two or three kids. */\
+    macro(StrCat, NodeResultJS | NodeMustGenerate) \
+    \
+    /* Property access. */\
+    /* PutByValAlias indicates a 'put' aliases a prior write to the same property. */\
+    /* Since a put to 'length' may invalidate optimizations here, */\
+    /* this must be the directly subsequent property put. Note that PutByVal */\
+    /* opcodes use VarArgs beause they may have up to 4 children. */\
+    macro(GetByVal, NodeResultJS | NodeMustGenerate) \
+    macro(GetByValWithThis, NodeResultJS | NodeMustGenerate) \
+    macro(GetMyArgumentByVal, NodeResultJS | NodeMustGenerate) \
+    macro(GetMyArgumentByValOutOfBounds, NodeResultJS | NodeMustGenerate) \
+    macro(LoadVarargs, NodeMustGenerate) \
+    macro(ForwardVarargs, NodeMustGenerate) \
+    macro(PutByValDirect, NodeMustGenerate | NodeHasVarArgs) \
+    macro(PutByVal, NodeMustGenerate | NodeHasVarArgs) \
+    macro(PutByValAlias, NodeMustGenerate | NodeHasVarArgs) \
+    macro(TryGetById, NodeResultJS) \
+    macro(GetById, NodeResultJS | NodeMustGenerate) \
+    macro(GetByIdFlush, NodeResultJS | NodeMustGenerate) \
+    macro(GetByIdWithThis, NodeResultJS | NodeMustGenerate) \
+    macro(PutById, NodeMustGenerate) \
+    macro(PutByIdFlush, NodeMustGenerate) \
+    macro(PutByIdDirect, NodeMustGenerate) \
+    macro(PutByIdWithThis, NodeMustGenerate) \
+    macro(PutByValWithThis, NodeMustGenerate | NodeHasVarArgs) \
+    macro(PutGetterById, NodeMustGenerate) \
+    macro(PutSetterById, NodeMustGenerate) \
+    macro(PutGetterSetterById, NodeMustGenerate) \
+    macro(PutGetterByVal, NodeMustGenerate) \
+    macro(PutSetterByVal, NodeMustGenerate) \
+    macro(DefineDataProperty, NodeMustGenerate | NodeHasVarArgs) \
+    macro(DefineAccessorProperty, NodeMustGenerate | NodeHasVarArgs) \
+    macro(DeleteById, NodeResultBoolean | NodeMustGenerate) \
+    macro(DeleteByVal, NodeResultBoolean | NodeMustGenerate) \
+    macro(CheckStructure, NodeMustGenerate) \
+    macro(GetExecutable, NodeResultJS) \
+    macro(PutStructure, NodeMustGenerate) \
+    macro(AllocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
+    macro(ReallocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
+    macro(GetButterfly, NodeResultStorage) \
+    macro(NukeStructureAndSetButterfly, NodeMustGenerate) \
+    macro(CheckArray, NodeMustGenerate) \
+    macro(Arrayify, NodeMustGenerate) \
+    macro(ArrayifyToStructure, NodeMustGenerate) \
+    macro(GetIndexedPropertyStorage, NodeResultStorage) \
+    macro(ConstantStoragePointer, NodeResultStorage) \
+    macro(GetGetter, NodeResultJS) \
+    macro(GetSetter, NodeResultJS) \
+    macro(GetByOffset, NodeResultJS) \
+    macro(GetGetterSetterByOffset, NodeResultJS) \
+    macro(MultiGetByOffset, NodeResultJS | NodeMustGenerate) \
+    macro(PutByOffset, NodeMustGenerate) \
+    macro(MultiPutByOffset, NodeMustGenerate) \
+    macro(GetArrayLength, NodeResultInt32) \
+    macro(GetTypedArrayByteOffset, NodeResultInt32) \
+    macro(GetScope, NodeResultJS) \
+    macro(SkipScope, NodeResultJS) \
+    macro(ResolveScope, NodeResultJS | NodeMustGenerate) \
+    macro(GetGlobalObject, NodeResultJS) \
+    macro(GetClosureVar, NodeResultJS) \
+    macro(PutClosureVar, NodeMustGenerate) \
+    macro(GetGlobalVar, NodeResultJS) \
+    macro(GetGlobalLexicalVariable, NodeResultJS) \
+    macro(PutGlobalVariable, NodeMustGenerate) \
+    macro(GetDynamicVar, NodeResultJS | NodeMustGenerate) \
+    macro(PutDynamicVar, NodeMustGenerate) \
+    macro(NotifyWrite, NodeMustGenerate) \
+    macro(GetRegExpObjectLastIndex, NodeResultJS) \
+    macro(SetRegExpObjectLastIndex, NodeMustGenerate) \
+    macro(RecordRegExpCachedResult, NodeMustGenerate | NodeHasVarArgs) \
+    macro(CheckCell, NodeMustGenerate) \
+    macro(CheckNotEmpty, NodeMustGenerate) \
+    macro(CheckBadCell, NodeMustGenerate) \
+    macro(CheckInBounds, NodeMustGenerate) \
+    macro(CheckStringIdent, NodeMustGenerate) \
+    macro(CheckTypeInfoFlags, NodeMustGenerate) /* Takes an OpInfo with the flags you want to test are set */\
+    \
+    /* Optimizations for array mutation. */\
+    macro(ArrayPush, NodeResultJS | NodeMustGenerate) \
+    macro(ArrayPop, NodeResultJS | NodeMustGenerate) \
+    macro(ArraySlice, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    \
+    /* Optimizations for regular expression matching. */\
+    macro(RegExpExec, NodeResultJS | NodeMustGenerate) \
+    macro(RegExpTest, NodeResultJS | NodeMustGenerate) \
+    macro(StringReplace, NodeResultJS | NodeMustGenerate) \
+    macro(StringReplaceRegExp, NodeResultJS | NodeMustGenerate) \
+    \
+    /* Optimizations for string access */ \
+    macro(StringCharCodeAt, NodeResultInt32) \
+    macro(StringCharAt, NodeResultJS) \
+    macro(StringFromCharCode, NodeResultJS) \
+    \
+    /* Nodes for comparison operations. */\
+    macro(CompareLess, NodeResultBoolean | NodeMustGenerate) \
+    macro(CompareLessEq, NodeResultBoolean | NodeMustGenerate) \
+    macro(CompareGreater, NodeResultBoolean | NodeMustGenerate) \
+    macro(CompareGreaterEq, NodeResultBoolean | NodeMustGenerate) \
+    macro(CompareEq, NodeResultBoolean | NodeMustGenerate) \
+    macro(CompareStrictEq, NodeResultBoolean) \
+    macro(CompareEqPtr, NodeResultBoolean) \
+    \
+    /* Calls. */\
+    macro(Call, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    macro(DirectCall, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    macro(Construct, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    macro(DirectConstruct, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    macro(CallVarargs, NodeResultJS | NodeMustGenerate) \
+    macro(CallForwardVarargs, NodeResultJS | NodeMustGenerate) \
+    macro(ConstructVarargs, NodeResultJS | NodeMustGenerate) \
+    macro(ConstructForwardVarargs, NodeResultJS | NodeMustGenerate) \
+    macro(TailCallInlinedCaller, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    macro(DirectTailCallInlinedCaller, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    macro(TailCallVarargsInlinedCaller, NodeResultJS | NodeMustGenerate) \
+    macro(TailCallForwardVarargsInlinedCaller, NodeResultJS | NodeMustGenerate) \
+    macro(CallEval, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    \
+    /* Shadow Chicken */\
+    macro(LogShadowChickenPrologue, NodeMustGenerate) \
+    macro(LogShadowChickenTail, NodeMustGenerate) \
+    \
+    /* Allocations. */\
+    macro(NewObject, NodeResultJS) \
+    macro(NewArray, NodeResultJS | NodeHasVarArgs) \
+    macro(NewArrayWithSpread, NodeResultJS | NodeHasVarArgs) \
+    macro(NewArrayWithSize, NodeResultJS | NodeMustGenerate) \
+    macro(NewArrayBuffer, NodeResultJS) \
+    macro(NewTypedArray, NodeResultJS | NodeMustGenerate) \
+    macro(NewRegexp, NodeResultJS) \
+    /* Rest Parameter */\
+    macro(GetRestLength, NodeResultInt32) \
+    macro(CreateRest, NodeResultJS | NodeMustGenerate) \
+    \
+    macro(Spread, NodeResultJS | NodeMustGenerate) \
+    /* Support for allocation sinking. */\
+    macro(PhantomNewObject, NodeResultJS | NodeMustGenerate) \
+    macro(PutHint, NodeMustGenerate) \
+    macro(CheckStructureImmediate, NodeMustGenerate) \
+    macro(MaterializeNewObject, NodeResultJS | NodeHasVarArgs) \
+    macro(PhantomNewFunction, NodeResultJS | NodeMustGenerate) \
+    macro(PhantomNewGeneratorFunction, NodeResultJS | NodeMustGenerate) \
+    macro(PhantomNewAsyncFunction, NodeResultJS | NodeMustGenerate) \
+    macro(PhantomCreateActivation, NodeResultJS | NodeMustGenerate) \
+    macro(MaterializeCreateActivation, NodeResultJS | NodeHasVarArgs) \
+    \
+    /* Nodes for misc operations. */\
+    macro(OverridesHasInstance, NodeMustGenerate | NodeResultBoolean) \
+    macro(InstanceOf, NodeResultBoolean) \
+    macro(InstanceOfCustom, NodeMustGenerate | NodeResultBoolean) \
+    \
+    macro(IsCellWithType, NodeResultBoolean) \
+    macro(IsEmpty, NodeResultBoolean) \
+    macro(IsUndefined, NodeResultBoolean) \
+    macro(IsBoolean, NodeResultBoolean) \
+    macro(IsNumber, NodeResultBoolean) \
+    macro(IsObject, NodeResultBoolean) \
+    macro(IsObjectOrNull, NodeResultBoolean) \
+    macro(IsFunction, NodeResultBoolean) \
+    macro(IsTypedArrayView, NodeResultBoolean) \
+    macro(TypeOf, NodeResultJS) \
+    macro(LogicalNot, NodeResultBoolean) \
+    macro(ToPrimitive, NodeResultJS | NodeMustGenerate) \
+    macro(ToString, NodeResultJS | NodeMustGenerate) \
+    macro(ToNumber, NodeResultJS | NodeMustGenerate) \
+    macro(CallObjectConstructor, NodeResultJS) \
+    macro(CallStringConstructor, NodeResultJS | NodeMustGenerate) \
+    macro(NewStringObject, NodeResultJS) \
+    macro(MakeRope, NodeResultJS) \
+    macro(In, NodeResultBoolean | NodeMustGenerate) \
+    macro(ProfileType, NodeMustGenerate) \
+    macro(ProfileControlFlow, NodeMustGenerate) \
+    macro(SetFunctionName, NodeMustGenerate) \
+    macro(HasOwnProperty, NodeResultBoolean) \
+    \
+    macro(CreateActivation, NodeResultJS) \
+    \
+    macro(CreateDirectArguments, NodeResultJS) \
+    macro(PhantomDirectArguments, NodeResultJS | NodeMustGenerate) \
+    macro(PhantomCreateRest, NodeResultJS | NodeMustGenerate) \
+    macro(PhantomSpread, NodeResultJS | NodeMustGenerate) \
+    macro(PhantomNewArrayWithSpread, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
+    macro(CreateScopedArguments, NodeResultJS) \
+    macro(CreateClonedArguments, NodeResultJS) \
+    macro(PhantomClonedArguments, NodeResultJS | NodeMustGenerate) \
+    macro(GetFromArguments, NodeResultJS) \
+    macro(PutToArguments, NodeMustGenerate) \
+    macro(GetArgument, NodeResultJS) \
+    \
+    macro(NewFunction, NodeResultJS) \
+    \
+    macro(NewGeneratorFunction, NodeResultJS) \
+    \
+    macro(NewAsyncFunction, NodeResultJS) \
+    \
+    /* These aren't terminals but always exit */ \
+    macro(Throw, NodeMustGenerate) \
+    macro(ThrowStaticError, NodeMustGenerate) \
+    \
+    /* Block terminals. */\
+    macro(Jump, NodeMustGenerate) \
+    macro(Branch, NodeMustGenerate) \
+    macro(Switch, NodeMustGenerate) \
+    macro(Return, NodeMustGenerate) \
+    macro(TailCall, NodeMustGenerate | NodeHasVarArgs) \
+    macro(DirectTailCall, NodeMustGenerate | NodeHasVarArgs) \
+    macro(TailCallVarargs, NodeMustGenerate) \
+    macro(TailCallForwardVarargs, NodeMustGenerate) \
+    macro(Unreachable, NodeMustGenerate) \
+    \
+    /* Count execution. */\
+    macro(CountExecution, NodeMustGenerate) \
+    \
+    /* This is a pseudo-terminal. It means that execution should fall out of DFG at */\
+    /* this point, but execution does continue in the basic block - just in a */\
+    /* different compiler. */\
+    macro(ForceOSRExit, NodeMustGenerate) \
+    \
+    /* Vends a bottom JS value. It is invalid to ever execute this. Useful for cases */\
+    /* where we know that we would have exited but we'd like to still track the control */\
+    /* flow. */\
+    macro(BottomValue, NodeResultJS) \
+    \
+    /* Checks the watchdog timer. If the timer has fired, we call operation operationHandleWatchdogTimer*/ \
+    macro(CheckWatchdogTimer, NodeMustGenerate) \
+    /* Write barriers */\
+    macro(StoreBarrier, NodeMustGenerate) \
+    macro(FencedStoreBarrier, NodeMustGenerate) \
+    \
+    /* For-in enumeration opcodes */\
+    macro(GetEnumerableLength, NodeMustGenerate | NodeResultJS) \
+    macro(HasIndexedProperty, NodeResultBoolean) \
+    macro(HasStructureProperty, NodeResultBoolean) \
+    macro(HasGenericProperty, NodeResultBoolean) \
+    macro(GetDirectPname, NodeMustGenerate | NodeHasVarArgs | NodeResultJS) \
+    macro(GetPropertyEnumerator, NodeMustGenerate | NodeResultJS) \
+    macro(GetEnumeratorStructurePname, NodeMustGenerate | NodeResultJS) \
+    macro(GetEnumeratorGenericPname, NodeMustGenerate | NodeResultJS) \
+    macro(ToIndexString, NodeResultJS) \
+    /* Nodes for JSMap and JSSet */ \
+    macro(MapHash, NodeResultInt32) \
+    macro(GetMapBucket, NodeResultJS) \
+    macro(LoadFromJSMapBucket, NodeResultJS) \
+    macro(IsNonEmptyMapBucket, NodeResultBoolean) \
+    \
+    macro(ToLowerCase, NodeResultJS) \
+    /* Nodes for DOM JIT */\
+    macro(CheckDOM, NodeMustGenerate) \
+    macro(CallDOMGetter, NodeResultJS | NodeMustGenerate) \
+    macro(CallDOM, NodeResultJS | NodeMustGenerate) \
+
+// This enum generates a monotonically increasing id for all Node types,
+// and is used by the subsequent enum to fill out the id (as accessed via the NodeIdMask).
+enum NodeType {
+#define DFG_OP_ENUM(opcode, flags) opcode,
+    FOR_EACH_DFG_OP(DFG_OP_ENUM)
+#undef DFG_OP_ENUM
+    LastNodeType
+};
+
+// Specifies the default flags for each node.
+inline NodeFlags defaultFlags(NodeType op)
+{
+    switch (op) {
+#define DFG_OP_ENUM(opcode, flags) case opcode: return flags;
+    FOR_EACH_DFG_OP(DFG_OP_ENUM)
+#undef DFG_OP_ENUM
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGNullAbstractState.h b/dfg/DFGNullAbstractState.h
new file mode 100644
index 0000000..75b6325
--- /dev/null
+++ b/dfg/DFGNullAbstractState.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Edge;
+struct AbstractValue;
+struct Node;
+
+// Use this as a stub for things that can optionally take some kind of abstract state but you wish
+// to not pass any abstract state. This works if the templatized code also does a check (using the
+// operator bool) to see if the state is valid.
+class NullAbstractState {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    NullAbstractState() { }
+    
+    explicit operator bool() const { return false; }
+    
+    AbstractValue& forNode(Node*)
+    {
+        RELEASE_ASSERT_NOT_REACHED();
+        return *bitwise_cast<AbstractValue*>(static_cast<intptr_t>(0x1234));
+    }
+    
+    AbstractValue& forNode(Edge)
+    {
+        return forNode(nullptr);
+    }
+    
+    // It's valid to add more stub methods here as needed.
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRAvailabilityAnalysisPhase.cpp b/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
new file mode 100644
index 0000000..e8b45c4
--- /dev/null
+++ b/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
@@ -0,0 +1,278 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRAvailabilityAnalysisPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class OSRAvailabilityAnalysisPhase : public Phase {
+public:
+    OSRAvailabilityAnalysisPhase(Graph& graph)
+        : Phase(graph, "OSR availability analysis")
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == SSA);
+        
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            block->ssa->availabilityAtHead.clear();
+            block->ssa->availabilityAtTail.clear();
+        }
+        
+        BasicBlock* root = m_graph.block(0);
+        root->ssa->availabilityAtHead.m_locals.fill(Availability::unavailable());
+        for (unsigned argument = m_graph.m_argumentFormats.size(); argument--;) {
+            FlushedAt flushedAt = FlushedAt(
+                m_graph.m_argumentFormats[argument],
+                virtualRegisterForArgument(argument));
+            root->ssa->availabilityAtHead.m_locals.argument(argument) = Availability(flushedAt);
+        }
+
+        // This could be made more efficient by processing blocks in reverse postorder.
+        
+        LocalOSRAvailabilityCalculator calculator(m_graph);
+        bool changed;
+        do {
+            changed = false;
+            
+            for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+                BasicBlock* block = m_graph.block(blockIndex);
+                if (!block)
+                    continue;
+                
+                calculator.beginBlock(block);
+                
+                for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex)
+                    calculator.executeNode(block->at(nodeIndex));
+                
+                if (calculator.m_availability == block->ssa->availabilityAtTail)
+                    continue;
+                
+                block->ssa->availabilityAtTail = calculator.m_availability;
+                changed = true;
+                
+                for (unsigned successorIndex = block->numSuccessors(); successorIndex--;) {
+                    BasicBlock* successor = block->successor(successorIndex);
+                    successor->ssa->availabilityAtHead.merge(calculator.m_availability);
+                    successor->ssa->availabilityAtHead.pruneByLiveness(
+                        m_graph, successor->at(0)->origin.forExit);
+                }
+            }
+        } while (changed);
+
+        if (validationEnabled()) {
+
+            for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+                BasicBlock* block = m_graph.block(blockIndex);
+                if (!block)
+                    continue;
+                
+                calculator.beginBlock(block);
+                
+                for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                    if (block->at(nodeIndex)->origin.exitOK) {
+                        // If we're allowed to exit here, the heap must be in a state
+                        // where exiting wouldn't crash. These particular fields are
+                        // required for correctness because we use them during OSR exit
+                        // to do meaningful things. It would be wrong for any of them
+                        // to be dead.
+
+                        AvailabilityMap availabilityMap = calculator.m_availability;
+                        availabilityMap.pruneByLiveness(m_graph, block->at(nodeIndex)->origin.forExit);
+
+                        for (auto heapPair : availabilityMap.m_heap) {
+                            switch (heapPair.key.kind()) {
+                            case ActivationScopePLoc:
+                            case ActivationSymbolTablePLoc:
+                            case FunctionActivationPLoc:
+                            case FunctionExecutablePLoc:
+                            case StructurePLoc:
+                                if (heapPair.value.isDead()) {
+                                    dataLogLn("PromotedHeapLocation is dead, but should not be: ", heapPair.key);
+                                    availabilityMap.dump(WTF::dataFile());
+                                    CRASH();
+                                }
+                                break;
+
+                            default:
+                                break;
+                            }
+                        }
+                    }
+
+                    calculator.executeNode(block->at(nodeIndex));
+                }
+            }
+        }
+        
+        return true;
+    }
+
+};
+
+bool performOSRAvailabilityAnalysis(Graph& graph)
+{
+    return runPhase<OSRAvailabilityAnalysisPhase>(graph);
+}
+
+LocalOSRAvailabilityCalculator::LocalOSRAvailabilityCalculator(Graph& graph)
+    : m_graph(graph)
+{
+}
+
+LocalOSRAvailabilityCalculator::~LocalOSRAvailabilityCalculator()
+{
+}
+
+void LocalOSRAvailabilityCalculator::beginBlock(BasicBlock* block)
+{
+    m_availability = block->ssa->availabilityAtHead;
+}
+
+void LocalOSRAvailabilityCalculator::endBlock(BasicBlock* block)
+{
+    m_availability = block->ssa->availabilityAtTail;
+}
+
+void LocalOSRAvailabilityCalculator::executeNode(Node* node)
+{
+    switch (node->op()) {
+    case PutStack: {
+        StackAccessData* data = node->stackAccessData();
+        m_availability.m_locals.operand(data->local).setFlush(data->flushedAt());
+        break;
+    }
+        
+    case KillStack: {
+        m_availability.m_locals.operand(node->unlinkedLocal()).setFlush(FlushedAt(ConflictingFlush));
+        break;
+    }
+
+    case GetStack: {
+        StackAccessData* data = node->stackAccessData();
+        m_availability.m_locals.operand(data->local) = Availability(node, data->flushedAt());
+        break;
+    }
+
+    case MovHint: {
+        m_availability.m_locals.operand(node->unlinkedLocal()).setNode(node->child1().node());
+        break;
+    }
+
+    case ZombieHint: {
+        m_availability.m_locals.operand(node->unlinkedLocal()).setNodeUnavailable();
+        break;
+    }
+        
+    case LoadVarargs:
+    case ForwardVarargs: {
+        LoadVarargsData* data = node->loadVarargsData();
+        m_availability.m_locals.operand(data->count) =
+            Availability(FlushedAt(FlushedInt32, data->machineCount));
+        for (unsigned i = data->limit; i--;) {
+            m_availability.m_locals.operand(VirtualRegister(data->start.offset() + i)) =
+                Availability(FlushedAt(FlushedJSValue, VirtualRegister(data->machineStart.offset() + i)));
+        }
+        break;
+    }
+    
+    case PhantomCreateRest:
+    case PhantomDirectArguments:
+    case PhantomClonedArguments: {
+        InlineCallFrame* inlineCallFrame = node->origin.semantic.inlineCallFrame;
+        if (!inlineCallFrame) {
+            // We don't need to record anything about how the arguments are to be recovered. It's just a
+            // given that we can read them from the stack.
+            break;
+        }
+
+        unsigned numberOfArgumentsToSkip = 0;
+        if (node->op() == PhantomCreateRest)
+            numberOfArgumentsToSkip = node->numberOfArgumentsToSkip();
+        
+        if (inlineCallFrame->isVarargs()) {
+            // Record how to read each argument and the argument count.
+            Availability argumentCount =
+                m_availability.m_locals.operand(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount);
+            
+            m_availability.m_heap.set(PromotedHeapLocation(ArgumentCountPLoc, node), argumentCount);
+        }
+        
+        if (inlineCallFrame->isClosureCall) {
+            Availability callee = m_availability.m_locals.operand(
+                inlineCallFrame->stackOffset + CallFrameSlot::callee);
+            m_availability.m_heap.set(PromotedHeapLocation(ArgumentsCalleePLoc, node), callee);
+        }
+        
+        for (unsigned i = numberOfArgumentsToSkip; i < inlineCallFrame->arguments.size() - 1; ++i) {
+            Availability argument = m_availability.m_locals.operand(
+                inlineCallFrame->stackOffset + CallFrame::argumentOffset(i));
+            
+            m_availability.m_heap.set(PromotedHeapLocation(ArgumentPLoc, node, i), argument);
+        }
+        break;
+    }
+        
+    case PutHint: {
+        m_availability.m_heap.set(
+            PromotedHeapLocation(node->child1().node(), node->promotedLocationDescriptor()),
+            Availability(node->child2().node()));
+        break;
+    }
+
+    case PhantomSpread:
+        m_availability.m_heap.set(PromotedHeapLocation(SpreadPLoc, node), Availability(node->child1().node()));
+        break;
+
+    case PhantomNewArrayWithSpread:
+        for (unsigned i = 0; i < node->numChildren(); i++) {
+            Node* child = m_graph.varArgChild(node, i).node();
+            m_availability.m_heap.set(PromotedHeapLocation(NewArrayWithSpreadArgumentPLoc, node, i), Availability(child));
+        }
+        break;
+        
+    default:
+        break;
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGOSRAvailabilityAnalysisPhase.h b/dfg/DFGOSRAvailabilityAnalysisPhase.h
new file mode 100644
index 0000000..2433c04
--- /dev/null
+++ b/dfg/DFGOSRAvailabilityAnalysisPhase.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include "DFGCommon.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Computes BasicBlock::ssa->availabiltiyAtHead/Tail. This is a forward flow type inference
+// over MovHints and SetLocals. This analysis is run directly by the Plan for preparing for
+// lowering to B3 IR, but it can also be used as a utility. Note that if you run it before
+// stack layout, all of the flush availability will omit the virtual register - but it will
+// tell you the format.
+
+bool performOSRAvailabilityAnalysis(Graph&);
+
+// Local calculator for figuring out the availability at any node in a basic block. Requires
+// having run the availability analysis.
+class LocalOSRAvailabilityCalculator {
+public:
+    LocalOSRAvailabilityCalculator(Graph&);
+    ~LocalOSRAvailabilityCalculator();
+    
+    void beginBlock(BasicBlock*);
+    void endBlock(BasicBlock*); // Useful if you want to get data for the end of the block. You don't need to call this if you did beginBlock() and then executeNode() for every node.
+    void executeNode(Node*);
+    
+    AvailabilityMap m_availability;
+    Graph& m_graph;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSREntry.cpp b/dfg/DFGOSREntry.cpp
new file mode 100644
index 0000000..d3fe793
--- /dev/null
+++ b/dfg/DFGOSREntry.cpp
@@ -0,0 +1,341 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSREntry.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "DFGJITCode.h"
+#include "DFGNode.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "VMInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC { namespace DFG {
+
+void OSREntryData::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    out.print("bc#", m_bytecodeIndex, ", machine code offset = ", m_machineCodeOffset);
+    out.print(", stack rules = [");
+    
+    auto printOperand = [&] (VirtualRegister reg) {
+        out.print(inContext(m_expectedValues.operand(reg), context), " (");
+        VirtualRegister toReg;
+        bool overwritten = false;
+        for (OSREntryReshuffling reshuffling : m_reshufflings) {
+            if (reg == VirtualRegister(reshuffling.fromOffset)) {
+                toReg = VirtualRegister(reshuffling.toOffset);
+                break;
+            }
+            if (reg == VirtualRegister(reshuffling.toOffset))
+                overwritten = true;
+        }
+        if (!overwritten && !toReg.isValid())
+            toReg = reg;
+        if (toReg.isValid()) {
+            if (toReg.isLocal() && !m_machineStackUsed.get(toReg.toLocal()))
+                out.print("ignored");
+            else
+                out.print("maps to ", toReg);
+        } else
+            out.print("overwritten");
+        if (reg.isLocal() && m_localsForcedDouble.get(reg.toLocal()))
+            out.print(", forced double");
+        if (reg.isLocal() && m_localsForcedAnyInt.get(reg.toLocal()))
+            out.print(", forced machine int");
+        out.print(")");
+    };
+    
+    CommaPrinter comma;
+    for (size_t argumentIndex = m_expectedValues.numberOfArguments(); argumentIndex--;) {
+        out.print(comma, "arg", argumentIndex, ":");
+        printOperand(virtualRegisterForArgument(argumentIndex));
+    }
+    for (size_t localIndex = 0; localIndex < m_expectedValues.numberOfLocals(); ++localIndex) {
+        out.print(comma, "loc", localIndex, ":");
+        printOperand(virtualRegisterForLocal(localIndex));
+    }
+    
+    out.print("], machine stack used = ", m_machineStackUsed);
+}
+
+void OSREntryData::dump(PrintStream& out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+SUPPRESS_ASAN
+void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIndex)
+{
+    ASSERT(JITCode::isOptimizingJIT(codeBlock->jitType()));
+    ASSERT(codeBlock->alternative());
+    ASSERT(codeBlock->alternative()->jitType() == JITCode::BaselineJIT);
+    ASSERT(!codeBlock->jitCodeMap());
+
+    if (!Options::useOSREntryToDFG())
+        return 0;
+
+    if (Options::verboseOSR()) {
+        dataLog(
+            "DFG OSR in ", *codeBlock->alternative(), " -> ", *codeBlock,
+            " from bc#", bytecodeIndex, "\n");
+    }
+    
+    VM* vm = &exec->vm();
+
+    sanitizeStackForVM(vm);
+    
+    if (bytecodeIndex)
+        codeBlock->ownerScriptExecutable()->setDidTryToEnterInLoop(true);
+    
+    if (codeBlock->jitType() != JITCode::DFGJIT) {
+        RELEASE_ASSERT(codeBlock->jitType() == JITCode::FTLJIT);
+        
+        // When will this happen? We could have:
+        //
+        // - An exit from the FTL JIT into the baseline JIT followed by an attempt
+        //   to reenter. We're fine with allowing this to fail. If it happens
+        //   enough we'll just reoptimize. It basically means that the OSR exit cost
+        //   us dearly and so reoptimizing is the right thing to do.
+        //
+        // - We have recursive code with hot loops. Consider that foo has a hot loop
+        //   that calls itself. We have two foo's on the stack, lets call them foo1
+        //   and foo2, with foo1 having called foo2 from foo's hot loop. foo2 gets
+        //   optimized all the way into the FTL. Then it returns into foo1, and then
+        //   foo1 wants to get optimized. It might reach this conclusion from its
+        //   hot loop and attempt to OSR enter. And we'll tell it that it can't. It
+        //   might be worth addressing this case, but I just think this case will
+        //   be super rare. For now, if it does happen, it'll cause some compilation
+        //   thrashing.
+        
+        if (Options::verboseOSR())
+            dataLog("    OSR failed because the target code block is not DFG.\n");
+        return 0;
+    }
+    
+    JITCode* jitCode = codeBlock->jitCode()->dfg();
+    OSREntryData* entry = jitCode->osrEntryDataForBytecodeIndex(bytecodeIndex);
+    
+    if (!entry) {
+        if (Options::verboseOSR())
+            dataLogF("    OSR failed because the entrypoint was optimized out.\n");
+        return 0;
+    }
+    
+    ASSERT(entry->m_bytecodeIndex == bytecodeIndex);
+    
+    // The code below checks if it is safe to perform OSR entry. It may find
+    // that it is unsafe to do so, for any number of reasons, which are documented
+    // below. If the code decides not to OSR then it returns 0, and it's the caller's
+    // responsibility to patch up the state in such a way as to ensure that it's
+    // both safe and efficient to continue executing baseline code for now. This
+    // should almost certainly include calling either codeBlock->optimizeAfterWarmUp()
+    // or codeBlock->dontOptimizeAnytimeSoon().
+    
+    // 1) Verify predictions. If the predictions are inconsistent with the actual
+    //    values, then OSR entry is not possible at this time. It's tempting to
+    //    assume that we could somehow avoid this case. We can certainly avoid it
+    //    for first-time loop OSR - that is, OSR into a CodeBlock that we have just
+    //    compiled. Then we are almost guaranteed that all of the predictions will
+    //    check out. It would be pretty easy to make that a hard guarantee. But
+    //    then there would still be the case where two call frames with the same
+    //    baseline CodeBlock are on the stack at the same time. The top one
+    //    triggers compilation and OSR. In that case, we may no longer have
+    //    accurate value profiles for the one deeper in the stack. Hence, when we
+    //    pop into the CodeBlock that is deeper on the stack, we might OSR and
+    //    realize that the predictions are wrong. Probably, in most cases, this is
+    //    just an anomaly in the sense that the older CodeBlock simply went off
+    //    into a less-likely path. So, the wisest course of action is to simply not
+    //    OSR at this time.
+    
+    for (size_t argument = 0; argument < entry->m_expectedValues.numberOfArguments(); ++argument) {
+        if (argument >= exec->argumentCountIncludingThis()) {
+            if (Options::verboseOSR()) {
+                dataLogF("    OSR failed because argument %zu was not passed, expected ", argument);
+                entry->m_expectedValues.argument(argument).dump(WTF::dataFile());
+                dataLogF(".\n");
+            }
+            return 0;
+        }
+        
+        JSValue value;
+        if (!argument)
+            value = exec->thisValue();
+        else
+            value = exec->argument(argument - 1);
+        
+        if (!entry->m_expectedValues.argument(argument).validate(value)) {
+            if (Options::verboseOSR()) {
+                dataLog(
+                    "    OSR failed because argument ", argument, " is ", value,
+                    ", expected ", entry->m_expectedValues.argument(argument), ".\n");
+            }
+            return 0;
+        }
+    }
+    
+    for (size_t local = 0; local < entry->m_expectedValues.numberOfLocals(); ++local) {
+        int localOffset = virtualRegisterForLocal(local).offset();
+        if (entry->m_localsForcedDouble.get(local)) {
+            if (!exec->registers()[localOffset].asanUnsafeJSValue().isNumber()) {
+                if (Options::verboseOSR()) {
+                    dataLog(
+                        "    OSR failed because variable ", localOffset, " is ",
+                        exec->registers()[localOffset].asanUnsafeJSValue(), ", expected number.\n");
+                }
+                return 0;
+            }
+            continue;
+        }
+        if (entry->m_localsForcedAnyInt.get(local)) {
+            if (!exec->registers()[localOffset].asanUnsafeJSValue().isAnyInt()) {
+                if (Options::verboseOSR()) {
+                    dataLog(
+                        "    OSR failed because variable ", localOffset, " is ",
+                        exec->registers()[localOffset].asanUnsafeJSValue(), ", expected ",
+                        "machine int.\n");
+                }
+                return 0;
+            }
+            continue;
+        }
+        if (!entry->m_expectedValues.local(local).validate(exec->registers()[localOffset].asanUnsafeJSValue())) {
+            if (Options::verboseOSR()) {
+                dataLog(
+                    "    OSR failed because variable ", VirtualRegister(localOffset), " is ",
+                    exec->registers()[localOffset].asanUnsafeJSValue(), ", expected ",
+                    entry->m_expectedValues.local(local), ".\n");
+            }
+            return 0;
+        }
+    }
+
+    // 2) Check the stack height. The DFG JIT may require a taller stack than the
+    //    baseline JIT, in some cases. If we can't grow the stack, then don't do
+    //    OSR right now. That's the only option we have unless we want basic block
+    //    boundaries to start throwing RangeErrors. Although that would be possible,
+    //    it seems silly: you'd be diverting the program to error handling when it
+    //    would have otherwise just kept running albeit less quickly.
+    
+    unsigned frameSizeForCheck = jitCode->common.requiredRegisterCountForExecutionAndExit();
+    if (UNLIKELY(!vm->ensureStackCapacityFor(&exec->registers()[virtualRegisterForLocal(frameSizeForCheck - 1).offset()]))) {
+        if (Options::verboseOSR())
+            dataLogF("    OSR failed because stack growth failed.\n");
+        return 0;
+    }
+    
+    if (Options::verboseOSR())
+        dataLogF("    OSR should succeed.\n");
+
+    // At this point we're committed to entering. We will do some work to set things up,
+    // but we also rely on our caller recognizing that when we return a non-null pointer,
+    // that means that we're already past the point of no return and we must succeed at
+    // entering.
+    
+    // 3) Set up the data in the scratch buffer and perform data format conversions.
+
+    unsigned frameSize = jitCode->common.frameRegisterCount;
+    unsigned baselineFrameSize = entry->m_expectedValues.numberOfLocals();
+    unsigned maxFrameSize = std::max(frameSize, baselineFrameSize);
+
+    Register* scratch = bitwise_cast<Register*>(vm->scratchBufferForSize(sizeof(Register) * (2 + CallFrame::headerSizeInRegisters + maxFrameSize))->dataBuffer());
+    
+    *bitwise_cast<size_t*>(scratch + 0) = frameSize;
+    
+    void* targetPC = codeBlock->jitCode()->executableAddressAtOffset(entry->m_machineCodeOffset);
+    if (Options::verboseOSR())
+        dataLogF("    OSR using target PC %p.\n", targetPC);
+    RELEASE_ASSERT(targetPC);
+    *bitwise_cast<void**>(scratch + 1) = targetPC;
+    
+    Register* pivot = scratch + 2 + CallFrame::headerSizeInRegisters;
+    
+    for (int index = -CallFrame::headerSizeInRegisters; index < static_cast<int>(baselineFrameSize); ++index) {
+        VirtualRegister reg(-1 - index);
+        
+        if (reg.isLocal()) {
+            if (entry->m_localsForcedDouble.get(reg.toLocal())) {
+                *bitwise_cast<double*>(pivot + index) = exec->registers()[reg.offset()].asanUnsafeJSValue().asNumber();
+                continue;
+            }
+            
+            if (entry->m_localsForcedAnyInt.get(reg.toLocal())) {
+                *bitwise_cast<int64_t*>(pivot + index) = exec->registers()[reg.offset()].asanUnsafeJSValue().asAnyInt() << JSValue::int52ShiftAmount;
+                continue;
+            }
+        }
+        
+        pivot[index] = exec->registers()[reg.offset()].asanUnsafeJSValue();
+    }
+    
+    // 4) Reshuffle those registers that need reshuffling.
+    Vector<JSValue> temporaryLocals(entry->m_reshufflings.size());
+    for (unsigned i = entry->m_reshufflings.size(); i--;)
+        temporaryLocals[i] = pivot[VirtualRegister(entry->m_reshufflings[i].fromOffset).toLocal()].asanUnsafeJSValue();
+    for (unsigned i = entry->m_reshufflings.size(); i--;)
+        pivot[VirtualRegister(entry->m_reshufflings[i].toOffset).toLocal()] = temporaryLocals[i];
+    
+    // 5) Clear those parts of the call frame that the DFG ain't using. This helps GC on
+    //    some programs by eliminating some stale pointer pathologies.
+    for (unsigned i = frameSize; i--;) {
+        if (entry->m_machineStackUsed.get(i))
+            continue;
+        pivot[i] = JSValue();
+    }
+
+    // 6) Copy our callee saves to buffer.
+#if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+    RegisterAtOffsetList* registerSaveLocations = codeBlock->calleeSaveRegisters();
+    RegisterAtOffsetList* allCalleeSaves = vm->getAllCalleeSaveRegisterOffsets();
+    RegisterSet dontSaveRegisters = RegisterSet(RegisterSet::stackRegisters(), RegisterSet::allFPRs());
+
+    unsigned registerCount = registerSaveLocations->size();
+    VMEntryRecord* record = vmEntryRecord(vm->topVMEntryFrame);
+    for (unsigned i = 0; i < registerCount; i++) {
+        RegisterAtOffset currentEntry = registerSaveLocations->at(i);
+        if (dontSaveRegisters.get(currentEntry.reg()))
+            continue;
+        RegisterAtOffset* calleeSavesEntry = allCalleeSaves->find(currentEntry.reg());
+        
+        *(bitwise_cast<intptr_t*>(pivot - 1) - currentEntry.offsetAsIndex()) = record->calleeSaveRegistersBuffer[calleeSavesEntry->offsetAsIndex()];
+    }
+#endif
+    
+    // 7) Fix the call frame to have the right code block.
+    
+    *bitwise_cast<CodeBlock**>(pivot - 1 - CallFrameSlot::codeBlock) = codeBlock;
+    
+    if (Options::verboseOSR())
+        dataLogF("    OSR returning data buffer %p.\n", scratch);
+    return scratch;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSREntry.h b/dfg/DFGOSREntry.h
new file mode 100644
index 0000000..41a9330
--- /dev/null
+++ b/dfg/DFGOSREntry.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2011, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGAbstractValue.h"
+#include "Operands.h"
+#include <wtf/BitVector.h>
+
+namespace JSC {
+
+class ExecState;
+class CodeBlock;
+
+namespace DFG {
+
+#if ENABLE(DFG_JIT)
+struct OSREntryReshuffling {
+    OSREntryReshuffling() { }
+    
+    OSREntryReshuffling(int fromOffset, int toOffset)
+        : fromOffset(fromOffset)
+        , toOffset(toOffset)
+    {
+    }
+    
+    int fromOffset;
+    int toOffset;
+};
+
+struct OSREntryData {
+    unsigned m_bytecodeIndex;
+    unsigned m_machineCodeOffset;
+    Operands<AbstractValue> m_expectedValues;
+    // Use bitvectors here because they tend to only require one word.
+    BitVector m_localsForcedDouble;
+    BitVector m_localsForcedAnyInt;
+    Vector<OSREntryReshuffling> m_reshufflings;
+    BitVector m_machineStackUsed;
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+};
+
+inline unsigned getOSREntryDataBytecodeIndex(OSREntryData* osrEntryData)
+{
+    return osrEntryData->m_bytecodeIndex;
+}
+
+// Returns a pointer to a data buffer that the OSR entry thunk will recognize and
+// parse. If this returns null, it means 
+void* prepareOSREntry(ExecState*, CodeBlock*, unsigned bytecodeIndex);
+#else
+inline void* prepareOSREntry(ExecState*, CodeBlock*, unsigned) { return 0; }
+#endif
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGOSREntrypointCreationPhase.cpp b/dfg/DFGOSREntrypointCreationPhase.cpp
new file mode 100644
index 0000000..5d22edd
--- /dev/null
+++ b/dfg/DFGOSREntrypointCreationPhase.cpp
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSREntrypointCreationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGBlockInsertionSet.h"
+#include "DFGGraph.h"
+#include "DFGLoopPreHeaderCreationPhase.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class OSREntrypointCreationPhase : public Phase {
+public:
+    OSREntrypointCreationPhase(Graph& graph)
+        : Phase(graph, "OSR entrypoint creation")
+    {
+    }
+    
+    bool run()
+    {
+        RELEASE_ASSERT(m_graph.m_plan.mode == FTLForOSREntryMode);
+        RELEASE_ASSERT(m_graph.m_form == ThreadedCPS);
+        
+        unsigned bytecodeIndex = m_graph.m_plan.osrEntryBytecodeIndex;
+        RELEASE_ASSERT(bytecodeIndex);
+        RELEASE_ASSERT(bytecodeIndex != UINT_MAX);
+        
+        // Needed by createPreHeader().
+        m_graph.ensureDominators();
+        
+        CodeBlock* baseline = m_graph.m_profiledBlock;
+        
+        BasicBlock* target = 0;
+        for (unsigned blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            unsigned nodeIndex = 0;
+            Node* firstNode = block->at(0);
+            while (firstNode->isSemanticallySkippable())
+                firstNode = block->at(++nodeIndex);
+            if (firstNode->op() == LoopHint
+                && firstNode->origin.semantic == CodeOrigin(bytecodeIndex)) {
+                target = block;
+                break;
+            }
+        }
+
+        if (!target) {
+            // This is a terrible outcome. It shouldn't often happen but it might
+            // happen and so we should defend against it. If it happens, then this
+            // compilation is a failure.
+            return false;
+        }
+        
+        BlockInsertionSet insertionSet(m_graph);
+        
+        // We say that the execution count of the entry block is 1, because we know for sure
+        // that this must be the case. Under our definition of executionCount, "1" means "once
+        // per invocation". We could have said NaN here, since that would ask any clients of
+        // executionCount to use best judgement - but that seems unnecessary since we know for
+        // sure what the executionCount should be in this case.
+        BasicBlock* newRoot = insertionSet.insert(0, 1);
+
+        // We'd really like to use an unset origin, but ThreadedCPS won't allow that.
+        NodeOrigin origin = NodeOrigin(CodeOrigin(0), CodeOrigin(0), false);
+        
+        Vector<Node*> locals(baseline->m_numCalleeLocals);
+        for (int local = 0; local < baseline->m_numCalleeLocals; ++local) {
+            Node* previousHead = target->variablesAtHead.local(local);
+            if (!previousHead)
+                continue;
+            VariableAccessData* variable = previousHead->variableAccessData();
+            locals[local] = newRoot->appendNode(
+                m_graph, variable->prediction(), ExtractOSREntryLocal, origin,
+                OpInfo(variable->local().offset()));
+            
+            newRoot->appendNode(
+                m_graph, SpecNone, MovHint, origin, OpInfo(variable->local().offset()),
+                Edge(locals[local]));
+        }
+
+        // Now use the origin of the target, since it's not OK to exit, and we will probably hoist
+        // type checks to here.
+        origin = target->at(0)->origin;
+        
+        for (int argument = 0; argument < baseline->numParameters(); ++argument) {
+            Node* oldNode = target->variablesAtHead.argument(argument);
+            if (!oldNode) {
+                // Just for sanity, always have a SetArgument even if it's not needed.
+                oldNode = m_graph.m_arguments[argument];
+            }
+            Node* node = newRoot->appendNode(
+                m_graph, SpecNone, SetArgument, origin,
+                OpInfo(oldNode->variableAccessData()));
+            m_graph.m_arguments[argument] = node;
+        }
+
+        for (int local = 0; local < baseline->m_numCalleeLocals; ++local) {
+            Node* previousHead = target->variablesAtHead.local(local);
+            if (!previousHead)
+                continue;
+            VariableAccessData* variable = previousHead->variableAccessData();
+            Node* node = locals[local];
+            newRoot->appendNode(
+                m_graph, SpecNone, SetLocal, origin, OpInfo(variable), Edge(node));
+        }
+        
+        newRoot->appendNode(
+            m_graph, SpecNone, Jump, origin,
+            OpInfo(createPreHeader(m_graph, insertionSet, target)));
+        
+        insertionSet.execute();
+        m_graph.resetReachability();
+        m_graph.killUnreachableBlocks();
+        return true;
+    }
+};
+
+bool performOSREntrypointCreation(Graph& graph)
+{
+    return runPhase<OSREntrypointCreationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGOSREntrypointCreationPhase.h b/dfg/DFGOSREntrypointCreationPhase.h
new file mode 100644
index 0000000..a5c73fa
--- /dev/null
+++ b/dfg/DFGOSREntrypointCreationPhase.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// This phase is only for compilation pipelines that go through SSA, and that
+// do a specialized OSR entry compile. Currently that means FTL.
+//
+// Creates an OSR entrypoint that establishes all argument and local variable
+// values. This entrypoint only works for the Plan::osrEntryBytecodeIndex.
+// Unlike ordinary OSR entry into the DFG, this forces all variables slurped
+// in through OSR entry to appear TOP to the CFA. Hence this phase must be run
+// early - before doing any CFA. But this also does some additional hacks that
+// require this to run before unification.
+
+bool performOSREntrypointCreation(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExit.cpp b/dfg/DFGOSRExit.cpp
new file mode 100644
index 0000000..2c968c4
--- /dev/null
+++ b/dfg/DFGOSRExit.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExit.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "AssemblyHelpers.h"
+#include "DFGGraph.h"
+#include "DFGMayExit.h"
+#include "DFGSpeculativeJIT.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAValueProfile valueProfile, SpeculativeJIT* jit, unsigned streamIndex, unsigned recoveryIndex)
+    : OSRExitBase(kind, jit->m_origin.forExit, jit->m_origin.semantic, jit->m_origin.wasHoisted)
+    , m_jsValueSource(jsValueSource)
+    , m_valueProfile(valueProfile)
+    , m_recoveryIndex(recoveryIndex)
+    , m_streamIndex(streamIndex)
+{
+    bool canExit = jit->m_origin.exitOK;
+    if (!canExit && jit->m_currentNode) {
+        ExitMode exitMode = mayExit(jit->m_jit.graph(), jit->m_currentNode);
+        canExit = exitMode == ExitMode::Exits || exitMode == ExitMode::ExitsForExceptions;
+    }
+    DFG_ASSERT(jit->m_jit.graph(), jit->m_currentNode, canExit);
+}
+
+void OSRExit::setPatchableCodeOffset(MacroAssembler::PatchableJump check)
+{
+    m_patchableCodeOffset = check.m_jump.m_label.m_offset;
+}
+
+MacroAssembler::Jump OSRExit::getPatchableCodeOffsetAsJump() const
+{
+    return MacroAssembler::Jump(AssemblerLabel(m_patchableCodeOffset));
+}
+
+CodeLocationJump OSRExit::codeLocationForRepatch(CodeBlock* dfgCodeBlock) const
+{
+    return CodeLocationJump(dfgCodeBlock->jitCode()->dataAddressAtOffset(m_patchableCodeOffset));
+}
+
+void OSRExit::correctJump(LinkBuffer& linkBuffer)
+{
+    MacroAssembler::Label label;
+    label.m_label.m_offset = m_patchableCodeOffset;
+    m_patchableCodeOffset = linkBuffer.offsetOf(label);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExit.h b/dfg/DFGOSRExit.h
new file mode 100644
index 0000000..d355876
--- /dev/null
+++ b/dfg/DFGOSRExit.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeOrigin.h"
+#include "DFGCommon.h"
+#include "DFGExitProfile.h"
+#include "DFGOSRExitBase.h"
+#include "GPRInfo.h"
+#include "MacroAssembler.h"
+#include "MethodOfGettingAValueProfile.h"
+#include "Operands.h"
+#include "ValueProfile.h"
+#include "ValueRecovery.h"
+
+namespace JSC { namespace DFG {
+
+class SpeculativeJIT;
+struct BasicBlock;
+struct Node;
+
+// This enum describes the types of additional recovery that
+// may need be performed should a speculation check fail.
+enum SpeculationRecoveryType : uint8_t {
+    SpeculativeAdd,
+    SpeculativeAddImmediate,
+    BooleanSpeculationCheck
+};
+
+// === SpeculationRecovery ===
+//
+// This class provides additional information that may be associated with a
+// speculation check - for example 
+class SpeculationRecovery {
+public:
+    SpeculationRecovery(SpeculationRecoveryType type, GPRReg dest, GPRReg src)
+        : m_src(src)
+        , m_dest(dest)
+        , m_type(type)
+    {
+        ASSERT(m_type == SpeculativeAdd || m_type == BooleanSpeculationCheck);
+    }
+
+    SpeculationRecovery(SpeculationRecoveryType type, GPRReg dest, int32_t immediate)
+        : m_immediate(immediate)
+        , m_dest(dest)
+        , m_type(type)
+    {
+        ASSERT(m_type == SpeculativeAddImmediate);
+    }
+
+    SpeculationRecoveryType type() { return m_type; }
+    GPRReg dest() { return m_dest; }
+    GPRReg src() { return m_src; }
+    int32_t immediate() { return m_immediate; }
+
+private:
+    // different recovery types may required different additional information here.
+    union {
+        GPRReg m_src;
+        int32_t m_immediate;
+    };
+    GPRReg m_dest;
+
+    // Indicates the type of additional recovery to be performed.
+    SpeculationRecoveryType m_type;
+};
+
+// === OSRExit ===
+//
+// This structure describes how to exit the speculative path by
+// going into baseline code.
+struct OSRExit : public OSRExitBase {
+    OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, SpeculativeJIT*, unsigned streamIndex, unsigned recoveryIndex = UINT_MAX);
+
+    unsigned m_patchableCodeOffset { 0 };
+    
+    MacroAssemblerCodeRef m_code;
+    
+    JSValueSource m_jsValueSource;
+    MethodOfGettingAValueProfile m_valueProfile;
+    
+    unsigned m_recoveryIndex;
+
+    void setPatchableCodeOffset(MacroAssembler::PatchableJump);
+    MacroAssembler::Jump getPatchableCodeOffsetAsJump() const;
+    CodeLocationJump codeLocationForRepatch(CodeBlock*) const;
+    void correctJump(LinkBuffer&);
+
+    unsigned m_streamIndex;
+    void considerAddingAsFrequentExitSite(CodeBlock* profiledCodeBlock)
+    {
+        OSRExitBase::considerAddingAsFrequentExitSite(profiledCodeBlock, ExitFromDFG);
+    }
+};
+
+struct SpeculationFailureDebugInfo {
+    CodeBlock* codeBlock;
+    ExitKind kind;
+    unsigned bytecodeOffset;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExitBase.cpp b/dfg/DFGOSRExitBase.cpp
new file mode 100644
index 0000000..7bd5f04
--- /dev/null
+++ b/dfg/DFGOSRExitBase.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExitBase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGBasicBlock.h"
+#include "DFGNode.h"
+#include "InlineCallFrame.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void OSRExitBase::considerAddingAsFrequentExitSiteSlow(CodeBlock* profiledCodeBlock, ExitingJITType jitType)
+{
+    CodeBlock* sourceProfiledCodeBlock =
+        baselineCodeBlockForOriginAndBaselineCodeBlock(
+            m_codeOriginForExitProfile, profiledCodeBlock);
+    if (sourceProfiledCodeBlock) {
+        FrequentExitSite site;
+        if (m_wasHoisted)
+            site = FrequentExitSite(HoistingFailed, jitType);
+        else
+            site = FrequentExitSite(m_codeOriginForExitProfile.bytecodeIndex, m_kind, jitType);
+        sourceProfiledCodeBlock->addFrequentExitSite(site);
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGOSRExitBase.h b/dfg/DFGOSRExitBase.h
new file mode 100644
index 0000000..310963d
--- /dev/null
+++ b/dfg/DFGOSRExitBase.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeOrigin.h"
+#include "DFGExitProfile.h"
+
+namespace JSC { namespace DFG {
+
+struct BasicBlock;
+struct Node;
+
+// Provides for the OSR exit profiling functionality that is common between the DFG
+// and the FTL.
+
+struct OSRExitBase {
+    OSRExitBase(ExitKind kind, CodeOrigin origin, CodeOrigin originForProfile, bool wasHoisted)
+        : m_kind(kind)
+        , m_wasHoisted(wasHoisted)
+        , m_codeOrigin(origin)
+        , m_codeOriginForExitProfile(originForProfile)
+    {
+        ASSERT(m_codeOrigin.isSet());
+        ASSERT(m_codeOriginForExitProfile.isSet());
+    }
+
+    uint32_t m_count { 0 };
+    ExitKind m_kind;
+    bool m_wasHoisted;
+    
+    CodeOrigin m_codeOrigin;
+    CodeOrigin m_codeOriginForExitProfile;
+    CallSiteIndex m_exceptionHandlerCallSiteIndex;
+
+    ALWAYS_INLINE bool isExceptionHandler() const
+    {
+        return m_kind == ExceptionCheck || m_kind == GenericUnwind;
+    }
+
+    // True if this exit is used as an exception handler for unwinding. This happens to only be set when
+    // isExceptionHandler is true, but all this actually means is that the OSR exit will assume that the
+    // machine state is as it would be coming out of genericUnwind.
+    ALWAYS_INLINE bool isGenericUnwindHandler() const
+    {
+        return m_kind == GenericUnwind;
+    }
+
+protected:
+    void considerAddingAsFrequentExitSite(CodeBlock* profiledCodeBlock, ExitingJITType jitType)
+    {
+        if (m_count)
+            considerAddingAsFrequentExitSiteSlow(profiledCodeBlock, jitType);
+    }
+
+private:
+    void considerAddingAsFrequentExitSiteSlow(CodeBlock* profiledCodeBlock, ExitingJITType);
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExitCompilationInfo.h b/dfg/DFGOSRExitCompilationInfo.h
new file mode 100644
index 0000000..5338a34
--- /dev/null
+++ b/dfg/DFGOSRExitCompilationInfo.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeOrigin.h"
+#include "DFGCommon.h"
+#include "MacroAssembler.h"
+
+namespace JSC { namespace DFG {
+
+struct OSRExitCompilationInfo {
+    MacroAssembler::JumpList m_failureJumps;
+    MacroAssembler::Label m_replacementSource;
+    MacroAssembler::Label m_replacementDestination;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExitCompiler.cpp b/dfg/DFGOSRExitCompiler.cpp
new file mode 100644
index 0000000..1fa3c0a
--- /dev/null
+++ b/dfg/DFGOSRExitCompiler.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2011-2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExitCompiler.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CallFrame.h"
+#include "DFGCommon.h"
+#include "DFGJITCode.h"
+#include "DFGOSRExitPreparation.h"
+#include "LinkBuffer.h"
+#include "OperandsInlines.h"
+#include "JSCInlines.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace DFG {
+
+void OSRExitCompiler::emitRestoreArguments(const Operands<ValueRecovery>& operands)
+{
+    HashMap<MinifiedID, int> alreadyAllocatedArguments; // Maps phantom arguments node ID to operand.
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        int operand = operands.operandForIndex(index);
+        
+        if (recovery.technique() != DirectArgumentsThatWereNotCreated
+            && recovery.technique() != ClonedArgumentsThatWereNotCreated)
+            continue;
+        
+        MinifiedID id = recovery.nodeID();
+        auto iter = alreadyAllocatedArguments.find(id);
+        if (iter != alreadyAllocatedArguments.end()) {
+            JSValueRegs regs = JSValueRegs::withTwoAvailableRegs(GPRInfo::regT0, GPRInfo::regT1);
+            m_jit.loadValue(CCallHelpers::addressFor(iter->value), regs);
+            m_jit.storeValue(regs, CCallHelpers::addressFor(operand));
+            continue;
+        }
+        
+        InlineCallFrame* inlineCallFrame =
+            m_jit.codeBlock()->jitCode()->dfg()->minifiedDFG.at(id)->inlineCallFrame();
+
+        int stackOffset;
+        if (inlineCallFrame)
+            stackOffset = inlineCallFrame->stackOffset;
+        else
+            stackOffset = 0;
+        
+        if (!inlineCallFrame || inlineCallFrame->isClosureCall) {
+            m_jit.loadPtr(
+                AssemblyHelpers::addressFor(stackOffset + CallFrameSlot::callee),
+                GPRInfo::regT0);
+        } else {
+            m_jit.move(
+                AssemblyHelpers::TrustedImmPtr(inlineCallFrame->calleeRecovery.constant().asCell()),
+                GPRInfo::regT0);
+        }
+        
+        if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
+            m_jit.load32(
+                AssemblyHelpers::payloadFor(stackOffset + CallFrameSlot::argumentCount),
+                GPRInfo::regT1);
+        } else {
+            m_jit.move(
+                AssemblyHelpers::TrustedImm32(inlineCallFrame->arguments.size()),
+                GPRInfo::regT1);
+        }
+        
+        m_jit.setupArgumentsWithExecState(
+            AssemblyHelpers::TrustedImmPtr(inlineCallFrame), GPRInfo::regT0, GPRInfo::regT1);
+        switch (recovery.technique()) {
+        case DirectArgumentsThatWereNotCreated:
+            m_jit.move(AssemblyHelpers::TrustedImmPtr(bitwise_cast<void*>(operationCreateDirectArgumentsDuringExit)), GPRInfo::nonArgGPR0);
+            break;
+        case ClonedArgumentsThatWereNotCreated:
+            m_jit.move(AssemblyHelpers::TrustedImmPtr(bitwise_cast<void*>(operationCreateClonedArgumentsDuringExit)), GPRInfo::nonArgGPR0);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        m_jit.call(GPRInfo::nonArgGPR0);
+        m_jit.storeCell(GPRInfo::returnValueGPR, AssemblyHelpers::addressFor(operand));
+        
+        alreadyAllocatedArguments.add(id, operand);
+    }
+}
+
+extern "C" {
+
+void compileOSRExit(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    if (vm->callFrameForCatch)
+        RELEASE_ASSERT(vm->callFrameForCatch == exec);
+    
+    CodeBlock* codeBlock = exec->codeBlock();
+    ASSERT(codeBlock);
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    
+    // It's sort of preferable that we don't GC while in here. Anyways, doing so wouldn't
+    // really be profitable.
+    DeferGCForAWhile deferGC(vm->heap);
+
+    uint32_t exitIndex = vm->osrExitIndex;
+    OSRExit& exit = codeBlock->jitCode()->dfg()->osrExit[exitIndex];
+    
+    if (vm->callFrameForCatch)
+        ASSERT(exit.m_kind == GenericUnwind);
+    if (exit.isExceptionHandler())
+        ASSERT_UNUSED(scope, !!scope.exception());
+        
+    
+    prepareCodeOriginForOSRExit(exec, exit.m_codeOrigin);
+    
+    // Compute the value recoveries.
+    Operands<ValueRecovery> operands;
+    codeBlock->jitCode()->dfg()->variableEventStream.reconstruct(codeBlock, exit.m_codeOrigin, codeBlock->jitCode()->dfg()->minifiedDFG, exit.m_streamIndex, operands);
+    
+    SpeculationRecovery* recovery = 0;
+    if (exit.m_recoveryIndex != UINT_MAX)
+        recovery = &codeBlock->jitCode()->dfg()->speculationRecovery[exit.m_recoveryIndex];
+
+    {
+        CCallHelpers jit(vm, codeBlock);
+        OSRExitCompiler exitCompiler(jit);
+
+        if (exit.m_kind == GenericUnwind) {
+            // We are acting as a defacto op_catch because we arrive here from genericUnwind().
+            // So, we must restore our call frame and stack pointer.
+            jit.restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer();
+            jit.loadPtr(vm->addressOfCallFrameForCatch(), GPRInfo::callFrameRegister);
+        }
+        jit.addPtr(
+            CCallHelpers::TrustedImm32(codeBlock->stackPointerOffset() * sizeof(Register)),
+            GPRInfo::callFrameRegister, CCallHelpers::stackPointerRegister);
+
+        jit.jitAssertHasValidCallFrame();
+        
+        if (vm->m_perBytecodeProfiler && codeBlock->jitCode()->dfgCommon()->compilation) {
+            Profiler::Database& database = *vm->m_perBytecodeProfiler;
+            Profiler::Compilation* compilation = codeBlock->jitCode()->dfgCommon()->compilation.get();
+            
+            Profiler::OSRExit* profilerExit = compilation->addOSRExit(
+                exitIndex, Profiler::OriginStack(database, codeBlock, exit.m_codeOrigin),
+                exit.m_kind, exit.m_kind == UncountableInvalidation);
+            jit.add64(CCallHelpers::TrustedImm32(1), CCallHelpers::AbsoluteAddress(profilerExit->counterAddress()));
+        }
+
+        exitCompiler.compileExit(exit, operands, recovery);
+        
+        LinkBuffer patchBuffer(*vm, jit, codeBlock);
+        exit.m_code = FINALIZE_CODE_IF(
+            shouldDumpDisassembly() || Options::verboseOSR(),
+            patchBuffer,
+            ("DFG OSR exit #%u (%s, %s) from %s, with operands = %s",
+                exitIndex, toCString(exit.m_codeOrigin).data(),
+                exitKindToString(exit.m_kind), toCString(*codeBlock).data(),
+                toCString(ignoringContext<DumpContext>(operands)).data()));
+    }
+    
+    MacroAssembler::repatchJump(exit.codeLocationForRepatch(codeBlock), CodeLocationLabel(exit.m_code.code()));
+    
+    vm->osrExitJumpDestination = exit.m_code.code().executableAddress();
+}
+
+} // extern "C"
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExitCompiler.h b/dfg/DFGOSRExitCompiler.h
new file mode 100644
index 0000000..b94461f
--- /dev/null
+++ b/dfg/DFGOSRExitCompiler.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "AssemblyHelpers.h"
+#include "CCallHelpers.h"
+#include "DFGOSRExit.h"
+#include "DFGOperations.h"
+
+namespace JSC {
+
+class ExecState;
+
+namespace DFG {
+
+class OSRExitCompiler {
+public:
+    OSRExitCompiler(CCallHelpers& jit)
+        : m_jit(jit)
+    {
+    }
+    
+    void compileExit(const OSRExit&, const Operands<ValueRecovery>&, SpeculationRecovery*);
+
+private:
+    void emitRestoreArguments(const Operands<ValueRecovery>&);
+    
+    CCallHelpers& m_jit;
+};
+
+extern "C" {
+void JIT_OPERATION compileOSRExit(ExecState*) WTF_INTERNAL;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExitCompiler32_64.cpp b/dfg/DFGOSRExitCompiler32_64.cpp
new file mode 100644
index 0000000..79eff76
--- /dev/null
+++ b/dfg/DFGOSRExitCompiler32_64.cpp
@@ -0,0 +1,411 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExitCompiler.h"
+
+#if ENABLE(DFG_JIT) && USE(JSVALUE32_64)
+
+#include "DFGOperations.h"
+#include "DFGOSRExitCompilerCommon.h"
+#include "DFGSpeculativeJIT.h"
+#include "JSCInlines.h"
+#include <wtf/DataLog.h>
+
+namespace JSC { namespace DFG {
+
+void OSRExitCompiler::compileExit(const OSRExit& exit, const Operands<ValueRecovery>& operands, SpeculationRecovery* recovery)
+{
+    // Pro-forma stuff.
+    if (Options::printEachOSRExit()) {
+        SpeculationFailureDebugInfo* debugInfo = new SpeculationFailureDebugInfo;
+        debugInfo->codeBlock = m_jit.codeBlock();
+        debugInfo->kind = exit.m_kind;
+        debugInfo->bytecodeOffset = exit.m_codeOrigin.bytecodeIndex;
+        
+        m_jit.debugCall(debugOperationPrintSpeculationFailure, debugInfo);
+    }
+    
+    // Perform speculation recovery. This only comes into play when an operation
+    // starts mutating state before verifying the speculation it has already made.
+    
+    if (recovery) {
+        switch (recovery->type()) {
+        case SpeculativeAdd:
+            m_jit.sub32(recovery->src(), recovery->dest());
+            break;
+
+        case SpeculativeAddImmediate:
+            m_jit.sub32(AssemblyHelpers::Imm32(recovery->immediate()), recovery->dest());
+            break;
+            
+        case BooleanSpeculationCheck:
+            break;
+            
+        default:
+            break;
+        }
+    }
+
+    // Refine some value profile, if appropriate.
+    
+    if (!!exit.m_jsValueSource) {
+        if (exit.m_kind == BadCache || exit.m_kind == BadIndexingType) {
+            // If the instruction that this originated from has an array profile, then
+            // refine it. If it doesn't, then do nothing. The latter could happen for
+            // hoisted checks, or checks emitted for operations that didn't have array
+            // profiling - either ops that aren't array accesses at all, or weren't
+            // known to be array acceses in the bytecode. The latter case is a FIXME
+            // while the former case is an outcome of a CheckStructure not knowing why
+            // it was emitted (could be either due to an inline cache of a property
+            // property access, or due to an array profile).
+            
+            // Note: We are free to assume that the jsValueSource is already known to
+            // be a cell since both BadCache and BadIndexingType exits occur after
+            // the cell check would have already happened.
+            
+            CodeOrigin codeOrigin = exit.m_codeOriginForExitProfile;
+            if (ArrayProfile* arrayProfile = m_jit.baselineCodeBlockFor(codeOrigin)->getArrayProfile(codeOrigin.bytecodeIndex)) {
+                GPRReg usedRegister1;
+                GPRReg usedRegister2;
+                if (exit.m_jsValueSource.isAddress()) {
+                    usedRegister1 = exit.m_jsValueSource.base();
+                    usedRegister2 = InvalidGPRReg;
+                } else {
+                    usedRegister1 = exit.m_jsValueSource.payloadGPR();
+                    if (exit.m_jsValueSource.hasKnownTag())
+                        usedRegister2 = InvalidGPRReg;
+                    else
+                        usedRegister2 = exit.m_jsValueSource.tagGPR();
+                }
+                
+                GPRReg scratch1;
+                GPRReg scratch2;
+                scratch1 = AssemblyHelpers::selectScratchGPR(usedRegister1, usedRegister2);
+                scratch2 = AssemblyHelpers::selectScratchGPR(usedRegister1, usedRegister2, scratch1);
+                
+                m_jit.push(scratch1);
+                m_jit.push(scratch2);
+                
+                GPRReg value;
+                if (exit.m_jsValueSource.isAddress()) {
+                    value = scratch1;
+                    m_jit.loadPtr(AssemblyHelpers::Address(exit.m_jsValueSource.asAddress()), value);
+                } else
+                    value = exit.m_jsValueSource.payloadGPR();
+                
+                m_jit.loadPtr(AssemblyHelpers::Address(value, JSCell::structureIDOffset()), scratch1);
+                m_jit.storePtr(scratch1, arrayProfile->addressOfLastSeenStructureID());
+                m_jit.load8(AssemblyHelpers::Address(scratch1, Structure::indexingTypeIncludingHistoryOffset()), scratch1);
+                m_jit.move(AssemblyHelpers::TrustedImm32(1), scratch2);
+                m_jit.lshift32(scratch1, scratch2);
+                m_jit.or32(scratch2, AssemblyHelpers::AbsoluteAddress(arrayProfile->addressOfArrayModes()));
+                
+                m_jit.pop(scratch2);
+                m_jit.pop(scratch1);
+            }
+        }
+        
+        if (MethodOfGettingAValueProfile profile = exit.m_valueProfile) {
+            if (exit.m_jsValueSource.isAddress()) {
+                // Save a register so we can use it.
+                GPRReg scratchPayload = AssemblyHelpers::selectScratchGPR(exit.m_jsValueSource.base());
+                GPRReg scratchTag = AssemblyHelpers::selectScratchGPR(exit.m_jsValueSource.base(), scratchPayload);
+                m_jit.pushToSave(scratchPayload);
+                m_jit.pushToSave(scratchTag);
+
+                JSValueRegs scratch(scratchTag, scratchPayload);
+                
+                m_jit.loadValue(exit.m_jsValueSource.asAddress(), scratch);
+                profile.emitReportValue(m_jit, scratch);
+                
+                m_jit.popToRestore(scratchTag);
+                m_jit.popToRestore(scratchPayload);
+            } else if (exit.m_jsValueSource.hasKnownTag()) {
+                GPRReg scratchTag = AssemblyHelpers::selectScratchGPR(exit.m_jsValueSource.payloadGPR());
+                m_jit.pushToSave(scratchTag);
+                m_jit.move(AssemblyHelpers::TrustedImm32(exit.m_jsValueSource.tag()), scratchTag);
+                JSValueRegs value(scratchTag, exit.m_jsValueSource.payloadGPR());
+                profile.emitReportValue(m_jit, value);
+                m_jit.popToRestore(scratchTag);
+            } else
+                profile.emitReportValue(m_jit, exit.m_jsValueSource.regs());
+        }
+    }
+    
+    // Do a simplified OSR exit. See DFGOSRExitCompiler64.cpp's comment regarding how and wny we
+    // do this simple approach.
+
+    // Save all state from GPRs into the scratch buffer.
+    
+    ScratchBuffer* scratchBuffer = m_jit.vm()->scratchBufferForSize(sizeof(EncodedJSValue) * operands.size());
+    EncodedJSValue* scratch = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;
+    
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        
+        switch (recovery.technique()) {
+        case UnboxedInt32InGPR:
+        case UnboxedBooleanInGPR:
+        case UnboxedCellInGPR:
+            m_jit.store32(
+                recovery.gpr(),
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.payload);
+            break;
+            
+        case InPair:
+            m_jit.store32(
+                recovery.tagGPR(),
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.tag);
+            m_jit.store32(
+                recovery.payloadGPR(),
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.payload);
+            break;
+            
+        default:
+            break;
+        }
+    }
+    
+    // Now all GPRs are free to reuse.
+    
+    // Save all state from FPRs into the scratch buffer.
+    
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        
+        switch (recovery.technique()) {
+        case UnboxedDoubleInFPR:
+        case InFPR:
+            m_jit.move(AssemblyHelpers::TrustedImmPtr(scratch + index), GPRInfo::regT0);
+            m_jit.storeDouble(recovery.fpr(), MacroAssembler::Address(GPRInfo::regT0));
+            break;
+            
+        default:
+            break;
+        }
+    }
+    
+    // Now all FPRs are free to reuse.
+    
+    // Save all state from the stack into the scratch buffer. For simplicity we
+    // do this even for state that's already in the right place on the stack.
+    // It makes things simpler later.
+    
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        
+        switch (recovery.technique()) {
+        case DisplacedInJSStack:
+        case Int32DisplacedInJSStack:
+        case DoubleDisplacedInJSStack:
+        case CellDisplacedInJSStack:
+        case BooleanDisplacedInJSStack:
+            m_jit.load32(
+                AssemblyHelpers::tagFor(recovery.virtualRegister()),
+                GPRInfo::regT0);
+            m_jit.load32(
+                AssemblyHelpers::payloadFor(recovery.virtualRegister()),
+                GPRInfo::regT1);
+            m_jit.store32(
+                GPRInfo::regT0,
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.tag);
+            m_jit.store32(
+                GPRInfo::regT1,
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.payload);
+            break;
+            
+        default:
+            break;
+        }
+    }
+    
+    // Need to ensure that the stack pointer accounts for the worst-case stack usage at exit. This
+    // could toast some stack that the DFG used. We need to do it before storing to stack offsets
+    // used by baseline.
+    m_jit.addPtr(
+        CCallHelpers::TrustedImm32(
+            -m_jit.codeBlock()->jitCode()->dfgCommon()->requiredRegisterCountForExit * sizeof(Register)),
+        CCallHelpers::framePointerRegister, CCallHelpers::stackPointerRegister);
+    
+    // Restore the DFG callee saves and then save the ones the baseline JIT uses.
+    m_jit.emitRestoreCalleeSaves();
+    m_jit.emitSaveCalleeSavesFor(m_jit.baselineCodeBlock());
+
+    if (exit.isExceptionHandler())
+        m_jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+
+    // Do all data format conversions and store the results into the stack.
+    
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        VirtualRegister reg = operands.virtualRegisterForIndex(index);
+
+        if (reg.isLocal() && reg.toLocal() < static_cast<int>(m_jit.baselineCodeBlock()->calleeSaveSpaceAsVirtualRegisters()))
+            continue;
+
+        int operand = reg.offset();
+
+        switch (recovery.technique()) {
+        case InPair:
+        case DisplacedInJSStack:
+        case InFPR:
+            m_jit.load32(
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.tag,
+                GPRInfo::regT0);
+            m_jit.load32(
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.payload,
+                GPRInfo::regT1);
+            m_jit.store32(
+                GPRInfo::regT0,
+                AssemblyHelpers::tagFor(operand));
+            m_jit.store32(
+                GPRInfo::regT1,
+                AssemblyHelpers::payloadFor(operand));
+            break;
+            
+        case UnboxedDoubleInFPR:
+        case DoubleDisplacedInJSStack:
+            m_jit.move(AssemblyHelpers::TrustedImmPtr(scratch + index), GPRInfo::regT0);
+            m_jit.loadDouble(MacroAssembler::Address(GPRInfo::regT0), FPRInfo::fpRegT0);
+            m_jit.purifyNaN(FPRInfo::fpRegT0);
+            m_jit.storeDouble(FPRInfo::fpRegT0, AssemblyHelpers::addressFor(operand));
+            break;
+
+        case UnboxedInt32InGPR:
+        case Int32DisplacedInJSStack:
+            m_jit.load32(
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.payload,
+                GPRInfo::regT0);
+            m_jit.store32(
+                AssemblyHelpers::TrustedImm32(JSValue::Int32Tag),
+                AssemblyHelpers::tagFor(operand));
+            m_jit.store32(
+                GPRInfo::regT0,
+                AssemblyHelpers::payloadFor(operand));
+            break;
+            
+        case UnboxedCellInGPR:
+        case CellDisplacedInJSStack:
+            m_jit.load32(
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.payload,
+                GPRInfo::regT0);
+            m_jit.store32(
+                AssemblyHelpers::TrustedImm32(JSValue::CellTag),
+                AssemblyHelpers::tagFor(operand));
+            m_jit.store32(
+                GPRInfo::regT0,
+                AssemblyHelpers::payloadFor(operand));
+            break;
+            
+        case UnboxedBooleanInGPR:
+        case BooleanDisplacedInJSStack:
+            m_jit.load32(
+                &bitwise_cast<EncodedValueDescriptor*>(scratch + index)->asBits.payload,
+                GPRInfo::regT0);
+            m_jit.store32(
+                AssemblyHelpers::TrustedImm32(JSValue::BooleanTag),
+                AssemblyHelpers::tagFor(operand));
+            m_jit.store32(
+                GPRInfo::regT0,
+                AssemblyHelpers::payloadFor(operand));
+            break;
+            
+        case Constant:
+            m_jit.store32(
+                AssemblyHelpers::TrustedImm32(recovery.constant().tag()),
+                AssemblyHelpers::tagFor(operand));
+            m_jit.store32(
+                AssemblyHelpers::TrustedImm32(recovery.constant().payload()),
+                AssemblyHelpers::payloadFor(operand));
+            break;
+            
+        case DirectArgumentsThatWereNotCreated:
+        case ClonedArgumentsThatWereNotCreated:
+            // Don't do this, yet.
+            break;
+            
+        default:
+            break;
+        }
+    }
+    
+    // Now that things on the stack are recovered, do the arguments recovery. We assume that arguments
+    // recoveries don't recursively refer to each other. But, we don't try to assume that they only
+    // refer to certain ranges of locals. Hence why we need to do this here, once the stack is sensible.
+    // Note that we also roughly assume that the arguments might still be materialized outside of its
+    // inline call frame scope - but for now the DFG wouldn't do that.
+    
+    emitRestoreArguments(operands);
+
+    // Adjust the old JIT's execute counter. Since we are exiting OSR, we know
+    // that all new calls into this code will go to the new JIT, so the execute
+    // counter only affects call frames that performed OSR exit and call frames
+    // that were still executing the old JIT at the time of another call frame's
+    // OSR exit. We want to ensure that the following is true:
+    //
+    // (a) Code the performs an OSR exit gets a chance to reenter optimized
+    //     code eventually, since optimized code is faster. But we don't
+    //     want to do such reentery too aggressively (see (c) below).
+    //
+    // (b) If there is code on the call stack that is still running the old
+    //     JIT's code and has never OSR'd, then it should get a chance to
+    //     perform OSR entry despite the fact that we've exited.
+    //
+    // (c) Code the performs an OSR exit should not immediately retry OSR
+    //     entry, since both forms of OSR are expensive. OSR entry is
+    //     particularly expensive.
+    //
+    // (d) Frequent OSR failures, even those that do not result in the code
+    //     running in a hot loop, result in recompilation getting triggered.
+    //
+    // To ensure (c), we'd like to set the execute counter to
+    // counterValueForOptimizeAfterWarmUp(). This seems like it would endanger
+    // (a) and (b), since then every OSR exit would delay the opportunity for
+    // every call frame to perform OSR entry. Essentially, if OSR exit happens
+    // frequently and the function has few loops, then the counter will never
+    // become non-negative and OSR entry will never be triggered. OSR entry
+    // will only happen if a loop gets hot in the old JIT, which does a pretty
+    // good job of ensuring (a) and (b). But that doesn't take care of (d),
+    // since each speculation failure would reset the execute counter.
+    // So we check here if the number of speculation failures is significantly
+    // larger than the number of successes (we want 90% success rate), and if
+    // there have been a large enough number of failures. If so, we set the
+    // counter to 0; otherwise we set the counter to
+    // counterValueForOptimizeAfterWarmUp().
+    
+    handleExitCounts(m_jit, exit);
+    
+    // Reify inlined call frames.
+    
+    reifyInlinedCallFrames(m_jit, exit);
+    
+    // And finish.
+    adjustAndJumpToTarget(m_jit, exit);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT) && USE(JSVALUE32_64)
diff --git a/dfg/DFGOSRExitCompiler64.cpp b/dfg/DFGOSRExitCompiler64.cpp
new file mode 100644
index 0000000..2b7ac88
--- /dev/null
+++ b/dfg/DFGOSRExitCompiler64.cpp
@@ -0,0 +1,398 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExitCompiler.h"
+
+#if ENABLE(DFG_JIT) && USE(JSVALUE64)
+
+#include "DFGOperations.h"
+#include "DFGOSRExitCompilerCommon.h"
+#include "DFGSpeculativeJIT.h"
+#include "JSCInlines.h"
+#include "VirtualRegister.h"
+
+#include <wtf/DataLog.h>
+
+namespace JSC { namespace DFG {
+
+void OSRExitCompiler::compileExit(const OSRExit& exit, const Operands<ValueRecovery>& operands, SpeculationRecovery* recovery)
+{
+    m_jit.jitAssertTagsInPlace();
+
+    // Pro-forma stuff.
+    if (Options::printEachOSRExit()) {
+        SpeculationFailureDebugInfo* debugInfo = new SpeculationFailureDebugInfo;
+        debugInfo->codeBlock = m_jit.codeBlock();
+        debugInfo->kind = exit.m_kind;
+        debugInfo->bytecodeOffset = exit.m_codeOrigin.bytecodeIndex;
+        
+        m_jit.debugCall(debugOperationPrintSpeculationFailure, debugInfo);
+    }
+    
+    // Perform speculation recovery. This only comes into play when an operation
+    // starts mutating state before verifying the speculation it has already made.
+    
+    if (recovery) {
+        switch (recovery->type()) {
+        case SpeculativeAdd:
+            m_jit.sub32(recovery->src(), recovery->dest());
+            m_jit.or64(GPRInfo::tagTypeNumberRegister, recovery->dest());
+            break;
+
+        case SpeculativeAddImmediate:
+            m_jit.sub32(AssemblyHelpers::Imm32(recovery->immediate()), recovery->dest());
+            m_jit.or64(GPRInfo::tagTypeNumberRegister, recovery->dest());
+            break;
+            
+        case BooleanSpeculationCheck:
+            m_jit.xor64(AssemblyHelpers::TrustedImm32(static_cast<int32_t>(ValueFalse)), recovery->dest());
+            break;
+            
+        default:
+            break;
+        }
+    }
+
+    // Refine some array and/or value profile, if appropriate.
+    
+    if (!!exit.m_jsValueSource) {
+        if (exit.m_kind == BadCache || exit.m_kind == BadIndexingType) {
+            // If the instruction that this originated from has an array profile, then
+            // refine it. If it doesn't, then do nothing. The latter could happen for
+            // hoisted checks, or checks emitted for operations that didn't have array
+            // profiling - either ops that aren't array accesses at all, or weren't
+            // known to be array acceses in the bytecode. The latter case is a FIXME
+            // while the former case is an outcome of a CheckStructure not knowing why
+            // it was emitted (could be either due to an inline cache of a property
+            // property access, or due to an array profile).
+            
+            CodeOrigin codeOrigin = exit.m_codeOriginForExitProfile;
+            if (ArrayProfile* arrayProfile = m_jit.baselineCodeBlockFor(codeOrigin)->getArrayProfile(codeOrigin.bytecodeIndex)) {
+                GPRReg usedRegister;
+                if (exit.m_jsValueSource.isAddress())
+                    usedRegister = exit.m_jsValueSource.base();
+                else
+                    usedRegister = exit.m_jsValueSource.gpr();
+                
+                GPRReg scratch1;
+                GPRReg scratch2;
+                scratch1 = AssemblyHelpers::selectScratchGPR(usedRegister);
+                scratch2 = AssemblyHelpers::selectScratchGPR(usedRegister, scratch1);
+                
+                if (isARM64()) {
+                    m_jit.pushToSave(scratch1);
+                    m_jit.pushToSave(scratch2);
+                } else {
+                    m_jit.push(scratch1);
+                    m_jit.push(scratch2);
+                }
+                
+                GPRReg value;
+                if (exit.m_jsValueSource.isAddress()) {
+                    value = scratch1;
+                    m_jit.loadPtr(AssemblyHelpers::Address(exit.m_jsValueSource.asAddress()), value);
+                } else
+                    value = exit.m_jsValueSource.gpr();
+                
+                m_jit.load32(AssemblyHelpers::Address(value, JSCell::structureIDOffset()), scratch1);
+                m_jit.store32(scratch1, arrayProfile->addressOfLastSeenStructureID());
+                m_jit.load8(AssemblyHelpers::Address(value, JSCell::indexingTypeAndMiscOffset()), scratch1);
+                m_jit.move(AssemblyHelpers::TrustedImm32(1), scratch2);
+                m_jit.lshift32(scratch1, scratch2);
+                m_jit.or32(scratch2, AssemblyHelpers::AbsoluteAddress(arrayProfile->addressOfArrayModes()));
+                
+                if (isARM64()) {
+                    m_jit.popToRestore(scratch2);
+                    m_jit.popToRestore(scratch1);
+                } else {
+                    m_jit.pop(scratch2);
+                    m_jit.pop(scratch1);
+                }
+            }
+        }
+        
+        if (MethodOfGettingAValueProfile profile = exit.m_valueProfile) {
+            if (exit.m_jsValueSource.isAddress()) {
+                // We can't be sure that we have a spare register. So use the tagTypeNumberRegister,
+                // since we know how to restore it.
+                m_jit.load64(AssemblyHelpers::Address(exit.m_jsValueSource.asAddress()), GPRInfo::tagTypeNumberRegister);
+                profile.emitReportValue(m_jit, JSValueRegs(GPRInfo::tagTypeNumberRegister));
+                m_jit.move(AssemblyHelpers::TrustedImm64(TagTypeNumber), GPRInfo::tagTypeNumberRegister);
+            } else
+                profile.emitReportValue(m_jit, JSValueRegs(exit.m_jsValueSource.gpr()));
+        }
+    }
+    
+    // What follows is an intentionally simple OSR exit implementation that generates
+    // fairly poor code but is very easy to hack. In particular, it dumps all state that
+    // needs conversion into a scratch buffer so that in step 6, where we actually do the
+    // conversions, we know that all temp registers are free to use and the variable is
+    // definitely in a well-known spot in the scratch buffer regardless of whether it had
+    // originally been in a register or spilled. This allows us to decouple "where was
+    // the variable" from "how was it represented". Consider that the
+    // Int32DisplacedInJSStack recovery: it tells us that the value is in a
+    // particular place and that that place holds an unboxed int32. We have two different
+    // places that a value could be (displaced, register) and a bunch of different
+    // ways of representing a value. The number of recoveries is two * a bunch. The code
+    // below means that we have to have two + a bunch cases rather than two * a bunch.
+    // Once we have loaded the value from wherever it was, the reboxing is the same
+    // regardless of its location. Likewise, before we do the reboxing, the way we get to
+    // the value (i.e. where we load it from) is the same regardless of its type. Because
+    // the code below always dumps everything into a scratch buffer first, the two
+    // questions become orthogonal, which simplifies adding new types and adding new
+    // locations.
+    //
+    // This raises the question: does using such a suboptimal implementation of OSR exit,
+    // where we always emit code to dump all state into a scratch buffer only to then
+    // dump it right back into the stack, hurt us in any way? The asnwer is that OSR exits
+    // are rare. Our tiering strategy ensures this. This is because if an OSR exit is
+    // taken more than ~100 times, we jettison the DFG code block along with all of its
+    // exits. It is impossible for an OSR exit - i.e. the code we compile below - to
+    // execute frequently enough for the codegen to matter that much. It probably matters
+    // enough that we don't want to turn this into some super-slow function call, but so
+    // long as we're generating straight-line code, that code can be pretty bad. Also
+    // because we tend to exit only along one OSR exit from any DFG code block - that's an
+    // empirical result that we're extremely confident about - the code size of this
+    // doesn't matter much. Hence any attempt to optimize the codegen here is just purely
+    // harmful to the system: it probably won't reduce either net memory usage or net
+    // execution time. It will only prevent us from cleanly decoupling "where was the
+    // variable" from "how was it represented", which will make it more difficult to add
+    // features in the future and it will make it harder to reason about bugs.
+
+    // Save all state from GPRs into the scratch buffer.
+    
+    ScratchBuffer* scratchBuffer = m_jit.vm()->scratchBufferForSize(sizeof(EncodedJSValue) * operands.size());
+    EncodedJSValue* scratch = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;
+    
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        
+        switch (recovery.technique()) {
+        case InGPR:
+        case UnboxedInt32InGPR:
+        case UnboxedInt52InGPR:
+        case UnboxedStrictInt52InGPR:
+        case UnboxedCellInGPR:
+            m_jit.store64(recovery.gpr(), scratch + index);
+            break;
+            
+        default:
+            break;
+        }
+    }
+    
+    // And voila, all GPRs are free to reuse.
+
+    // Save all state from FPRs into the scratch buffer.
+    
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        
+        switch (recovery.technique()) {
+        case UnboxedDoubleInFPR:
+        case InFPR:
+            m_jit.move(AssemblyHelpers::TrustedImmPtr(scratch + index), GPRInfo::regT0);
+            m_jit.storeDouble(recovery.fpr(), MacroAssembler::Address(GPRInfo::regT0));
+            break;
+            
+        default:
+            break;
+        }
+    }
+    
+    // Now, all FPRs are also free.
+    
+    // Save all state from the stack into the scratch buffer. For simplicity we
+    // do this even for state that's already in the right place on the stack.
+    // It makes things simpler later.
+
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        
+        switch (recovery.technique()) {
+        case DisplacedInJSStack:
+        case CellDisplacedInJSStack:
+        case BooleanDisplacedInJSStack:
+        case Int32DisplacedInJSStack:
+        case DoubleDisplacedInJSStack:
+        case Int52DisplacedInJSStack:
+        case StrictInt52DisplacedInJSStack:
+            m_jit.load64(AssemblyHelpers::addressFor(recovery.virtualRegister()), GPRInfo::regT0);
+            m_jit.store64(GPRInfo::regT0, scratch + index);
+            break;
+            
+        default:
+            break;
+        }
+    }
+
+    // Need to ensure that the stack pointer accounts for the worst-case stack usage at exit. This
+    // could toast some stack that the DFG used. We need to do it before storing to stack offsets
+    // used by baseline.
+    m_jit.addPtr(
+        CCallHelpers::TrustedImm32(
+            -m_jit.codeBlock()->jitCode()->dfgCommon()->requiredRegisterCountForExit * sizeof(Register)),
+        CCallHelpers::framePointerRegister, CCallHelpers::stackPointerRegister);
+    
+    // Restore the DFG callee saves and then save the ones the baseline JIT uses.
+    m_jit.emitRestoreCalleeSaves();
+    m_jit.emitSaveCalleeSavesFor(m_jit.baselineCodeBlock());
+
+    // The tag registers are needed to materialize recoveries below.
+    m_jit.emitMaterializeTagCheckRegisters();
+
+    if (exit.isExceptionHandler())
+        m_jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+
+    // Do all data format conversions and store the results into the stack.
+    
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        VirtualRegister reg = operands.virtualRegisterForIndex(index);
+
+        if (reg.isLocal() && reg.toLocal() < static_cast<int>(m_jit.baselineCodeBlock()->calleeSaveSpaceAsVirtualRegisters()))
+            continue;
+
+        int operand = reg.offset();
+
+        switch (recovery.technique()) {
+        case InGPR:
+        case UnboxedCellInGPR:
+        case DisplacedInJSStack:
+        case CellDisplacedInJSStack:
+        case BooleanDisplacedInJSStack:
+        case InFPR:
+            m_jit.load64(scratch + index, GPRInfo::regT0);
+            m_jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(operand));
+            break;
+            
+        case UnboxedInt32InGPR:
+        case Int32DisplacedInJSStack:
+            m_jit.load64(scratch + index, GPRInfo::regT0);
+            m_jit.zeroExtend32ToPtr(GPRInfo::regT0, GPRInfo::regT0);
+            m_jit.or64(GPRInfo::tagTypeNumberRegister, GPRInfo::regT0);
+            m_jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(operand));
+            break;
+            
+        case UnboxedInt52InGPR:
+        case Int52DisplacedInJSStack:
+            m_jit.load64(scratch + index, GPRInfo::regT0);
+            m_jit.rshift64(
+                AssemblyHelpers::TrustedImm32(JSValue::int52ShiftAmount), GPRInfo::regT0);
+            m_jit.boxInt52(GPRInfo::regT0, GPRInfo::regT0, GPRInfo::regT1, FPRInfo::fpRegT0);
+            m_jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(operand));
+            break;
+            
+        case UnboxedStrictInt52InGPR:
+        case StrictInt52DisplacedInJSStack:
+            m_jit.load64(scratch + index, GPRInfo::regT0);
+            m_jit.boxInt52(GPRInfo::regT0, GPRInfo::regT0, GPRInfo::regT1, FPRInfo::fpRegT0);
+            m_jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(operand));
+            break;
+            
+        case UnboxedDoubleInFPR:
+        case DoubleDisplacedInJSStack:
+            m_jit.move(AssemblyHelpers::TrustedImmPtr(scratch + index), GPRInfo::regT0);
+            m_jit.loadDouble(MacroAssembler::Address(GPRInfo::regT0), FPRInfo::fpRegT0);
+            m_jit.purifyNaN(FPRInfo::fpRegT0);
+            m_jit.boxDouble(FPRInfo::fpRegT0, GPRInfo::regT0);
+            m_jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(operand));
+            break;
+            
+        case Constant:
+            m_jit.store64(
+                AssemblyHelpers::TrustedImm64(JSValue::encode(recovery.constant())),
+                AssemblyHelpers::addressFor(operand));
+            break;
+            
+        case DirectArgumentsThatWereNotCreated:
+        case ClonedArgumentsThatWereNotCreated:
+            // Don't do this, yet.
+            break;
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+
+    // Now that things on the stack are recovered, do the arguments recovery. We assume that arguments
+    // recoveries don't recursively refer to each other. But, we don't try to assume that they only
+    // refer to certain ranges of locals. Hence why we need to do this here, once the stack is sensible.
+    // Note that we also roughly assume that the arguments might still be materialized outside of its
+    // inline call frame scope - but for now the DFG wouldn't do that.
+    
+    emitRestoreArguments(operands);
+    
+    // Adjust the old JIT's execute counter. Since we are exiting OSR, we know
+    // that all new calls into this code will go to the new JIT, so the execute
+    // counter only affects call frames that performed OSR exit and call frames
+    // that were still executing the old JIT at the time of another call frame's
+    // OSR exit. We want to ensure that the following is true:
+    //
+    // (a) Code the performs an OSR exit gets a chance to reenter optimized
+    //     code eventually, since optimized code is faster. But we don't
+    //     want to do such reentery too aggressively (see (c) below).
+    //
+    // (b) If there is code on the call stack that is still running the old
+    //     JIT's code and has never OSR'd, then it should get a chance to
+    //     perform OSR entry despite the fact that we've exited.
+    //
+    // (c) Code the performs an OSR exit should not immediately retry OSR
+    //     entry, since both forms of OSR are expensive. OSR entry is
+    //     particularly expensive.
+    //
+    // (d) Frequent OSR failures, even those that do not result in the code
+    //     running in a hot loop, result in recompilation getting triggered.
+    //
+    // To ensure (c), we'd like to set the execute counter to
+    // counterValueForOptimizeAfterWarmUp(). This seems like it would endanger
+    // (a) and (b), since then every OSR exit would delay the opportunity for
+    // every call frame to perform OSR entry. Essentially, if OSR exit happens
+    // frequently and the function has few loops, then the counter will never
+    // become non-negative and OSR entry will never be triggered. OSR entry
+    // will only happen if a loop gets hot in the old JIT, which does a pretty
+    // good job of ensuring (a) and (b). But that doesn't take care of (d),
+    // since each speculation failure would reset the execute counter.
+    // So we check here if the number of speculation failures is significantly
+    // larger than the number of successes (we want 90% success rate), and if
+    // there have been a large enough number of failures. If so, we set the
+    // counter to 0; otherwise we set the counter to
+    // counterValueForOptimizeAfterWarmUp().
+    
+    handleExitCounts(m_jit, exit);
+    
+    // Reify inlined call frames.
+    
+    reifyInlinedCallFrames(m_jit, exit);
+
+    // And finish.
+    adjustAndJumpToTarget(m_jit, exit);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT) && USE(JSVALUE64)
diff --git a/dfg/DFGOSRExitCompilerCommon.cpp b/dfg/DFGOSRExitCompilerCommon.cpp
new file mode 100644
index 0000000..c63f53f
--- /dev/null
+++ b/dfg/DFGOSRExitCompilerCommon.cpp
@@ -0,0 +1,322 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExitCompilerCommon.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGJITCode.h"
+#include "DFGOperations.h"
+#include "JIT.h"
+#include "JSCJSValueInlines.h"
+#include "JSCInlines.h"
+#include "StructureStubInfo.h"
+
+namespace JSC { namespace DFG {
+
+void handleExitCounts(CCallHelpers& jit, const OSRExitBase& exit)
+{
+    jit.add32(AssemblyHelpers::TrustedImm32(1), AssemblyHelpers::AbsoluteAddress(&exit.m_count));
+
+    if (!exitKindMayJettison(exit.m_kind))
+        return;
+    
+    jit.move(AssemblyHelpers::TrustedImmPtr(jit.codeBlock()), GPRInfo::regT0);
+    
+    AssemblyHelpers::Jump tooFewFails;
+    
+    jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfOSRExitCounter()), GPRInfo::regT2);
+    jit.add32(AssemblyHelpers::TrustedImm32(1), GPRInfo::regT2);
+    jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfOSRExitCounter()));
+    
+    jit.move(AssemblyHelpers::TrustedImmPtr(jit.baselineCodeBlock()), GPRInfo::regT0);
+    AssemblyHelpers::Jump reoptimizeNow = jit.branch32(
+        AssemblyHelpers::GreaterThanOrEqual,
+        AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()),
+        AssemblyHelpers::TrustedImm32(0));
+    
+    // We want to figure out if there's a possibility that we're in a loop. For the outermost
+    // code block in the inline stack, we handle this appropriately by having the loop OSR trigger
+    // check the exit count of the replacement of the CodeBlock from which we are OSRing. The
+    // problem is the inlined functions, which might also have loops, but whose baseline versions
+    // don't know where to look for the exit count. Figure out if those loops are severe enough
+    // that we had tried to OSR enter. If so, then we should use the loop reoptimization trigger.
+    // Otherwise, we should use the normal reoptimization trigger.
+    
+    AssemblyHelpers::JumpList loopThreshold;
+    
+    for (InlineCallFrame* inlineCallFrame = exit.m_codeOrigin.inlineCallFrame; inlineCallFrame; inlineCallFrame = inlineCallFrame->directCaller.inlineCallFrame) {
+        loopThreshold.append(
+            jit.branchTest8(
+                AssemblyHelpers::NonZero,
+                AssemblyHelpers::AbsoluteAddress(
+                    inlineCallFrame->baselineCodeBlock->ownerScriptExecutable()->addressOfDidTryToEnterInLoop())));
+    }
+    
+    jit.move(
+        AssemblyHelpers::TrustedImm32(jit.codeBlock()->exitCountThresholdForReoptimization()),
+        GPRInfo::regT1);
+    
+    if (!loopThreshold.empty()) {
+        AssemblyHelpers::Jump done = jit.jump();
+
+        loopThreshold.link(&jit);
+        jit.move(
+            AssemblyHelpers::TrustedImm32(
+                jit.codeBlock()->exitCountThresholdForReoptimizationFromLoop()),
+            GPRInfo::regT1);
+        
+        done.link(&jit);
+    }
+    
+    tooFewFails = jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, GPRInfo::regT1);
+    
+    reoptimizeNow.link(&jit);
+    
+    // Reoptimize as soon as possible.
+#if !NUMBER_OF_ARGUMENT_REGISTERS
+    jit.poke(GPRInfo::regT0);
+    jit.poke(AssemblyHelpers::TrustedImmPtr(&exit), 1);
+#else
+    jit.move(GPRInfo::regT0, GPRInfo::argumentGPR0);
+    jit.move(AssemblyHelpers::TrustedImmPtr(&exit), GPRInfo::argumentGPR1);
+#endif
+    jit.move(AssemblyHelpers::TrustedImmPtr(bitwise_cast<void*>(triggerReoptimizationNow)), GPRInfo::nonArgGPR0);
+    jit.call(GPRInfo::nonArgGPR0);
+    AssemblyHelpers::Jump doneAdjusting = jit.jump();
+    
+    tooFewFails.link(&jit);
+    
+    // Adjust the execution counter such that the target is to only optimize after a while.
+    int32_t activeThreshold =
+        jit.baselineCodeBlock()->adjustedCounterValue(
+            Options::thresholdForOptimizeAfterLongWarmUp());
+    int32_t targetValue = applyMemoryUsageHeuristicsAndConvertToInt(
+        activeThreshold, jit.baselineCodeBlock());
+    int32_t clippedValue;
+    switch (jit.codeBlock()->jitType()) {
+    case JITCode::DFGJIT:
+        clippedValue = BaselineExecutionCounter::clippedThreshold(jit.codeBlock()->globalObject(), targetValue);
+        break;
+    case JITCode::FTLJIT:
+        clippedValue = UpperTierExecutionCounter::clippedThreshold(jit.codeBlock()->globalObject(), targetValue);
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+        clippedValue = 0; // Make some compilers, and mhahnenberg, happy.
+#endif
+        break;
+    }
+    jit.store32(AssemblyHelpers::TrustedImm32(-clippedValue), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    jit.store32(AssemblyHelpers::TrustedImm32(activeThreshold), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionActiveThreshold()));
+    jit.store32(AssemblyHelpers::TrustedImm32(formattedTotalExecutionCount(clippedValue)), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionTotalCount()));
+    
+    doneAdjusting.link(&jit);
+}
+
+void reifyInlinedCallFrames(CCallHelpers& jit, const OSRExitBase& exit)
+{
+    // FIXME: We shouldn't leave holes on the stack when performing an OSR exit
+    // in presence of inlined tail calls.
+    // https://bugs.webkit.org/show_bug.cgi?id=147511
+    ASSERT(jit.baselineCodeBlock()->jitType() == JITCode::BaselineJIT);
+    jit.storePtr(AssemblyHelpers::TrustedImmPtr(jit.baselineCodeBlock()), AssemblyHelpers::addressFor((VirtualRegister)CallFrameSlot::codeBlock));
+
+    const CodeOrigin* codeOrigin;
+    for (codeOrigin = &exit.m_codeOrigin; codeOrigin && codeOrigin->inlineCallFrame; codeOrigin = codeOrigin->inlineCallFrame->getCallerSkippingTailCalls()) {
+        InlineCallFrame* inlineCallFrame = codeOrigin->inlineCallFrame;
+        CodeBlock* baselineCodeBlock = jit.baselineCodeBlockFor(*codeOrigin);
+        InlineCallFrame::Kind trueCallerCallKind;
+        CodeOrigin* trueCaller = inlineCallFrame->getCallerSkippingTailCalls(&trueCallerCallKind);
+        GPRReg callerFrameGPR = GPRInfo::callFrameRegister;
+
+        if (!trueCaller) {
+            ASSERT(inlineCallFrame->isTail());
+            jit.loadPtr(AssemblyHelpers::Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()), GPRInfo::regT3);
+            jit.storePtr(GPRInfo::regT3, AssemblyHelpers::addressForByteOffset(inlineCallFrame->returnPCOffset()));
+            jit.loadPtr(AssemblyHelpers::Address(GPRInfo::callFrameRegister, CallFrame::callerFrameOffset()), GPRInfo::regT3);
+            callerFrameGPR = GPRInfo::regT3;
+        } else {
+            CodeBlock* baselineCodeBlockForCaller = jit.baselineCodeBlockFor(*trueCaller);
+            unsigned callBytecodeIndex = trueCaller->bytecodeIndex;
+            void* jumpTarget = nullptr;
+
+            switch (trueCallerCallKind) {
+            case InlineCallFrame::Call:
+            case InlineCallFrame::Construct:
+            case InlineCallFrame::CallVarargs:
+            case InlineCallFrame::ConstructVarargs:
+            case InlineCallFrame::TailCall:
+            case InlineCallFrame::TailCallVarargs: {
+                CallLinkInfo* callLinkInfo =
+                    baselineCodeBlockForCaller->getCallLinkInfoForBytecodeIndex(callBytecodeIndex);
+                RELEASE_ASSERT(callLinkInfo);
+
+                jumpTarget = callLinkInfo->callReturnLocation().executableAddress();
+                break;
+            }
+
+            case InlineCallFrame::GetterCall:
+            case InlineCallFrame::SetterCall: {
+                StructureStubInfo* stubInfo =
+                    baselineCodeBlockForCaller->findStubInfo(CodeOrigin(callBytecodeIndex));
+                RELEASE_ASSERT(stubInfo);
+
+                jumpTarget = stubInfo->doneLocation().executableAddress();
+                break;
+            }
+
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+
+            if (trueCaller->inlineCallFrame) {
+                jit.addPtr(
+                    AssemblyHelpers::TrustedImm32(trueCaller->inlineCallFrame->stackOffset * sizeof(EncodedJSValue)),
+                    GPRInfo::callFrameRegister,
+                    GPRInfo::regT3);
+                callerFrameGPR = GPRInfo::regT3;
+            }
+
+            jit.storePtr(AssemblyHelpers::TrustedImmPtr(jumpTarget), AssemblyHelpers::addressForByteOffset(inlineCallFrame->returnPCOffset()));
+        }
+
+        jit.storePtr(AssemblyHelpers::TrustedImmPtr(baselineCodeBlock), AssemblyHelpers::addressFor((VirtualRegister)(inlineCallFrame->stackOffset + CallFrameSlot::codeBlock)));
+
+        // Restore the inline call frame's callee save registers.
+        // If this inlined frame is a tail call that will return back to the original caller, we need to
+        // copy the prior contents of the tag registers already saved for the outer frame to this frame.
+        jit.emitSaveOrCopyCalleeSavesFor(
+            baselineCodeBlock,
+            static_cast<VirtualRegister>(inlineCallFrame->stackOffset),
+            trueCaller ? AssemblyHelpers::UseExistingTagRegisterContents : AssemblyHelpers::CopyBaselineCalleeSavedRegistersFromBaseFrame,
+            GPRInfo::regT2);
+
+        if (!inlineCallFrame->isVarargs())
+            jit.store32(AssemblyHelpers::TrustedImm32(inlineCallFrame->arguments.size()), AssemblyHelpers::payloadFor((VirtualRegister)(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount)));
+#if USE(JSVALUE64)
+        jit.store64(callerFrameGPR, AssemblyHelpers::addressForByteOffset(inlineCallFrame->callerFrameOffset()));
+        uint32_t locationBits = CallSiteIndex(codeOrigin->bytecodeIndex).bits();
+        jit.store32(AssemblyHelpers::TrustedImm32(locationBits), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount)));
+        if (!inlineCallFrame->isClosureCall)
+            jit.store64(AssemblyHelpers::TrustedImm64(JSValue::encode(JSValue(inlineCallFrame->calleeConstant()))), AssemblyHelpers::addressFor((VirtualRegister)(inlineCallFrame->stackOffset + CallFrameSlot::callee)));
+#else // USE(JSVALUE64) // so this is the 32-bit part
+        jit.storePtr(callerFrameGPR, AssemblyHelpers::addressForByteOffset(inlineCallFrame->callerFrameOffset()));
+        Instruction* instruction = baselineCodeBlock->instructions().begin() + codeOrigin->bytecodeIndex;
+        uint32_t locationBits = CallSiteIndex(instruction).bits();
+        jit.store32(AssemblyHelpers::TrustedImm32(locationBits), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount)));
+        jit.store32(AssemblyHelpers::TrustedImm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)(inlineCallFrame->stackOffset + CallFrameSlot::callee)));
+        if (!inlineCallFrame->isClosureCall)
+            jit.storePtr(AssemblyHelpers::TrustedImmPtr(inlineCallFrame->calleeConstant()), AssemblyHelpers::payloadFor((VirtualRegister)(inlineCallFrame->stackOffset + CallFrameSlot::callee)));
+#endif // USE(JSVALUE64) // ending the #else part, so directly above is the 32-bit part
+    }
+
+    // Don't need to set the toplevel code origin if we only did inline tail calls
+    if (codeOrigin) {
+#if USE(JSVALUE64)
+        uint32_t locationBits = CallSiteIndex(codeOrigin->bytecodeIndex).bits();
+#else
+        Instruction* instruction = jit.baselineCodeBlock()->instructions().begin() + codeOrigin->bytecodeIndex;
+        uint32_t locationBits = CallSiteIndex(instruction).bits();
+#endif
+        jit.store32(AssemblyHelpers::TrustedImm32(locationBits), AssemblyHelpers::tagFor((VirtualRegister)(CallFrameSlot::argumentCount)));
+    }
+}
+
+static void osrWriteBarrier(CCallHelpers& jit, GPRReg owner, GPRReg scratch)
+{
+    AssemblyHelpers::Jump ownerIsRememberedOrInEden = jit.barrierBranchWithoutFence(owner);
+
+    // We need these extra slots because setupArgumentsWithExecState will use poke on x86.
+#if CPU(X86)
+    jit.subPtr(MacroAssembler::TrustedImm32(sizeof(void*) * 3), MacroAssembler::stackPointerRegister);
+#endif
+
+    jit.setupArgumentsWithExecState(owner);
+    jit.move(MacroAssembler::TrustedImmPtr(reinterpret_cast<void*>(operationOSRWriteBarrier)), scratch);
+    jit.call(scratch);
+
+#if CPU(X86)
+    jit.addPtr(MacroAssembler::TrustedImm32(sizeof(void*) * 3), MacroAssembler::stackPointerRegister);
+#endif
+
+    ownerIsRememberedOrInEden.link(&jit);
+}
+
+void adjustAndJumpToTarget(CCallHelpers& jit, const OSRExitBase& exit)
+{
+    jit.memoryFence();
+    
+    jit.move(
+        AssemblyHelpers::TrustedImmPtr(
+            jit.codeBlock()->baselineAlternative()), GPRInfo::argumentGPR1);
+    osrWriteBarrier(jit, GPRInfo::argumentGPR1, GPRInfo::nonArgGPR0);
+
+    // We barrier all inlined frames -- and not just the current inline stack --
+    // because we don't know which inlined function owns the value profile that
+    // we'll update when we exit. In the case of "f() { a(); b(); }", if both
+    // a and b are inlined, we might exit inside b due to a bad value loaded
+    // from a.
+    // FIXME: MethodOfGettingAValueProfile should remember which CodeBlock owns
+    // the value profile.
+    InlineCallFrameSet* inlineCallFrames = jit.codeBlock()->jitCode()->dfgCommon()->inlineCallFrames.get();
+    if (inlineCallFrames) {
+        for (InlineCallFrame* inlineCallFrame : *inlineCallFrames) {
+            jit.move(
+                AssemblyHelpers::TrustedImmPtr(
+                    inlineCallFrame->baselineCodeBlock.get()), GPRInfo::argumentGPR1);
+            osrWriteBarrier(jit, GPRInfo::argumentGPR1, GPRInfo::nonArgGPR0);
+        }
+    }
+
+    if (exit.m_codeOrigin.inlineCallFrame)
+        jit.addPtr(AssemblyHelpers::TrustedImm32(exit.m_codeOrigin.inlineCallFrame->stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister);
+
+    CodeBlock* codeBlockForExit = jit.baselineCodeBlockFor(exit.m_codeOrigin);
+    Vector<BytecodeAndMachineOffset>& decodedCodeMap = jit.decodedCodeMapFor(codeBlockForExit);
+    
+    BytecodeAndMachineOffset* mapping = binarySearch<BytecodeAndMachineOffset, unsigned>(decodedCodeMap, decodedCodeMap.size(), exit.m_codeOrigin.bytecodeIndex, BytecodeAndMachineOffset::getBytecodeIndex);
+    
+    ASSERT(mapping);
+    ASSERT(mapping->m_bytecodeIndex == exit.m_codeOrigin.bytecodeIndex);
+    
+    void* jumpTarget = codeBlockForExit->jitCode()->executableAddressAtOffset(mapping->m_machineCodeOffset);
+
+    jit.addPtr(AssemblyHelpers::TrustedImm32(JIT::stackPointerOffsetFor(codeBlockForExit) * sizeof(Register)), GPRInfo::callFrameRegister, AssemblyHelpers::stackPointerRegister);
+    if (exit.isExceptionHandler()) {
+        // Since we're jumping to op_catch, we need to set callFrameForCatch.
+        jit.storePtr(GPRInfo::callFrameRegister, jit.vm()->addressOfCallFrameForCatch());
+    }
+    
+    jit.move(AssemblyHelpers::TrustedImmPtr(jumpTarget), GPRInfo::regT2);
+    jit.jump(GPRInfo::regT2);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGOSRExitCompilerCommon.h b/dfg/DFGOSRExitCompilerCommon.h
new file mode 100644
index 0000000..8d278ce
--- /dev/null
+++ b/dfg/DFGOSRExitCompilerCommon.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CCallHelpers.h"
+#include "DFGOSRExit.h"
+#include "DFGCommonData.h"
+#include "DFGJITCode.h"
+#include "FTLJITCode.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace DFG {
+
+void handleExitCounts(CCallHelpers&, const OSRExitBase&);
+void reifyInlinedCallFrames(CCallHelpers&, const OSRExitBase&);
+void adjustAndJumpToTarget(CCallHelpers&, const OSRExitBase&);
+
+template <typename JITCodeType>
+void adjustFrameAndStackInOSRExitCompilerThunk(MacroAssembler& jit, VM* vm, JITCode::JITType jitType)
+{
+    ASSERT(jitType == JITCode::DFGJIT || jitType == JITCode::FTLJIT);
+
+    bool isFTLOSRExit = jitType == JITCode::FTLJIT;
+    RegisterSet registersToPreserve;
+    registersToPreserve.set(GPRInfo::regT0);
+    if (isFTLOSRExit) {
+        // FTL can use the scratch registers for values. The code below uses
+        // the scratch registers. We need to preserve them before doing anything.
+        registersToPreserve.merge(RegisterSet::macroScratchRegisters());
+    }
+
+    size_t scratchSize = sizeof(void*) * registersToPreserve.numberOfSetGPRs();
+    if (isFTLOSRExit)
+        scratchSize += sizeof(void*);
+
+    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(scratchSize);
+    char* buffer = static_cast<char*>(scratchBuffer->dataBuffer());
+
+    jit.pushToSave(GPRInfo::regT1);
+    jit.move(MacroAssembler::TrustedImmPtr(buffer), GPRInfo::regT1);
+
+    unsigned storeOffset = 0;
+    registersToPreserve.forEach([&](Reg reg) {
+        jit.storePtr(reg.gpr(), MacroAssembler::Address(GPRInfo::regT1, storeOffset));
+        storeOffset += sizeof(void*);
+    });
+
+    if (isFTLOSRExit) {
+        // FTL OSRExits are entered via the code FTLExitThunkGenerator emits which does
+        // pushToSaveImmediateWithoutTouchRegisters with the OSR exit index. We need to load
+        // that top value and then push it back when we reset our SP.
+        jit.loadPtr(MacroAssembler::Address(MacroAssembler::stackPointerRegister, MacroAssembler::pushToSaveByteOffset()), GPRInfo::regT0);
+        jit.storePtr(GPRInfo::regT0, MacroAssembler::Address(GPRInfo::regT1, registersToPreserve.numberOfSetGPRs() * sizeof(void*)));
+    }
+    jit.popToRestore(GPRInfo::regT1);
+
+    // We need to reset FP in the case of an exception.
+    jit.loadPtr(vm->addressOfCallFrameForCatch(), GPRInfo::regT0);
+    MacroAssembler::Jump didNotHaveException = jit.branchTestPtr(MacroAssembler::Zero, GPRInfo::regT0);
+    jit.move(GPRInfo::regT0, GPRInfo::callFrameRegister);
+    didNotHaveException.link(&jit);
+    // We need to make sure SP is correct in case of an exception.
+    jit.loadPtr(MacroAssembler::Address(GPRInfo::callFrameRegister, CallFrameSlot::codeBlock * static_cast<int>(sizeof(Register))), GPRInfo::regT0);
+    jit.loadPtr(MacroAssembler::Address(GPRInfo::regT0, CodeBlock::jitCodeOffset()), GPRInfo::regT0);
+    jit.addPtr(MacroAssembler::TrustedImm32(JITCodeType::commonDataOffset()), GPRInfo::regT0);
+    jit.load32(MacroAssembler::Address(GPRInfo::regT0, CommonData::frameRegisterCountOffset()), GPRInfo::regT0);
+    // This does virtualRegisterForLocal(frameRegisterCount - 1)*sizeof(Register) where:
+    // virtualRegisterForLocal(frameRegisterCount - 1)
+    //     = VirtualRegister::localToOperand(frameRegisterCount - 1)
+    //     = -1 - (frameRegisterCount - 1)
+    //     = -frameRegisterCount
+    jit.neg32(GPRInfo::regT0);
+    jit.mul32(MacroAssembler::TrustedImm32(sizeof(Register)), GPRInfo::regT0, GPRInfo::regT0);
+#if USE(JSVALUE64)
+    jit.signExtend32ToPtr(GPRInfo::regT0, GPRInfo::regT0);
+#endif
+    jit.addPtr(GPRInfo::callFrameRegister, GPRInfo::regT0);
+    jit.move(GPRInfo::regT0, MacroAssembler::stackPointerRegister);
+
+    if (isFTLOSRExit) {
+        // Leave space for saving the OSR Exit Index.
+        jit.subPtr(MacroAssembler::TrustedImm32(MacroAssembler::pushToSaveByteOffset()), MacroAssembler::stackPointerRegister);
+    }
+    jit.pushToSave(GPRInfo::regT1);
+
+    jit.move(MacroAssembler::TrustedImmPtr(buffer), GPRInfo::regT1);
+    if (isFTLOSRExit) {
+        // FTL OSRExits are entered via FTLExitThunkGenerator code with does
+        // pushToSaveImmediateWithoutTouchRegisters. We need to load that top
+        // register and then store it back when we have our SP back to a safe value.
+        jit.loadPtr(MacroAssembler::Address(GPRInfo::regT1, registersToPreserve.numberOfSetGPRs() * sizeof(void*)), GPRInfo::regT0);
+        jit.storePtr(GPRInfo::regT0, MacroAssembler::Address(MacroAssembler::stackPointerRegister, MacroAssembler::pushToSaveByteOffset()));
+    }
+
+    unsigned loadOffset = 0;
+    registersToPreserve.forEach([&](Reg reg) {
+        jit.loadPtr(MacroAssembler::Address(GPRInfo::regT1, loadOffset), reg.gpr());
+        loadOffset += sizeof(void*);
+    });
+    jit.popToRestore(GPRInfo::regT1);
+}
+
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExitFuzz.cpp b/dfg/DFGOSRExitFuzz.cpp
new file mode 100644
index 0000000..570a6a0
--- /dev/null
+++ b/dfg/DFGOSRExitFuzz.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExitFuzz.h"
+
+#include "TestRunnerUtils.h"
+
+namespace JSC { namespace DFG {
+
+unsigned g_numberOfStaticOSRExitFuzzChecks;
+unsigned g_numberOfOSRExitFuzzChecks;
+
+} // namespace DFG
+
+unsigned numberOfStaticOSRExitFuzzChecks()
+{
+    return DFG::g_numberOfStaticOSRExitFuzzChecks;
+}
+
+unsigned numberOfOSRExitFuzzChecks()
+{
+    return DFG::g_numberOfOSRExitFuzzChecks;
+}
+
+} // namespace JSC
+
+
diff --git a/dfg/DFGOSRExitFuzz.h b/dfg/DFGOSRExitFuzz.h
new file mode 100644
index 0000000..99f82ce
--- /dev/null
+++ b/dfg/DFGOSRExitFuzz.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Options.h"
+
+namespace JSC { namespace DFG {
+
+extern unsigned g_numberOfStaticOSRExitFuzzChecks;
+
+inline bool doOSRExitFuzzing()
+{
+    ASSERT(Options::useOSRExitFuzz());
+
+    g_numberOfStaticOSRExitFuzzChecks++;
+    if (unsigned atStatic = Options::fireOSRExitFuzzAtStatic())
+        return atStatic == g_numberOfStaticOSRExitFuzzChecks;
+    
+    return true;
+}
+
+// DFG- and FTL-generated code will query this on every speculation.
+extern unsigned g_numberOfOSRExitFuzzChecks;
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGOSRExitJumpPlaceholder.cpp b/dfg/DFGOSRExitJumpPlaceholder.cpp
new file mode 100644
index 0000000..5978054
--- /dev/null
+++ b/dfg/DFGOSRExitJumpPlaceholder.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExitJumpPlaceholder.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGJITCompiler.h"
+#include "DFGSpeculativeJIT.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void OSRExitJumpPlaceholder::fill(JITCompiler& jit, const MacroAssembler::JumpList& jumps)
+{
+    if (!*this)
+        return;
+    jit.m_exitCompilationInfo[m_index].m_failureJumps = jumps;
+}
+
+void OSRExitJumpPlaceholder::fill(SpeculativeJIT* jit, const MacroAssembler::JumpList& jumps)
+{
+    fill(jit->m_jit, jumps);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGOSRExitJumpPlaceholder.h b/dfg/DFGOSRExitJumpPlaceholder.h
new file mode 100644
index 0000000..868a4fa
--- /dev/null
+++ b/dfg/DFGOSRExitJumpPlaceholder.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "MacroAssembler.h"
+
+namespace JSC { namespace DFG {
+
+class JITCompiler;
+class SpeculativeJIT;
+
+class OSRExitJumpPlaceholder {
+public:
+    OSRExitJumpPlaceholder()
+        : m_index(std::numeric_limits<unsigned>::max())
+    {
+    }
+
+private:
+    friend class SpeculativeJIT;
+    
+    OSRExitJumpPlaceholder(unsigned index)
+        : m_index(index)
+    {
+    }
+
+public:
+    bool operator!() const { return m_index == std::numeric_limits<unsigned>::max(); }
+    
+    void fill(JITCompiler&, const MacroAssembler::JumpList&);
+    void fill(SpeculativeJIT*, const MacroAssembler::JumpList&);
+    
+private:
+    unsigned m_index;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOSRExitPreparation.cpp b/dfg/DFGOSRExitPreparation.cpp
new file mode 100644
index 0000000..646c7e4
--- /dev/null
+++ b/dfg/DFGOSRExitPreparation.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOSRExitPreparation.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "JIT.h"
+#include "JITCode.h"
+#include "JITWorklist.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void prepareCodeOriginForOSRExit(ExecState* exec, CodeOrigin codeOrigin)
+{
+    VM& vm = exec->vm();
+    DeferGC deferGC(vm.heap);
+    
+    for (; codeOrigin.inlineCallFrame; codeOrigin = codeOrigin.inlineCallFrame->directCaller) {
+        CodeBlock* codeBlock = codeOrigin.inlineCallFrame->baselineCodeBlock.get();
+        JITWorklist::instance()->compileNow(codeBlock);
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGOSRExitPreparation.h b/dfg/DFGOSRExitPreparation.h
new file mode 100644
index 0000000..230386a
--- /dev/null
+++ b/dfg/DFGOSRExitPreparation.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "CallFrame.h"
+#include "CodeOrigin.h"
+
+namespace JSC { namespace DFG {
+
+// Make sure all code on our inline stack is JIT compiled. This is necessary since
+// we may opt to inline a code block even before it had ever been compiled by the
+// JIT, but our OSR exit infrastructure currently only works if the target of the
+// OSR exit is JIT code. This could be changed since there is nothing particularly
+// hard about doing an OSR exit into the interpreter, but for now this seems to make
+// sense in that if we're OSR exiting from inlined code of a DFG code block, then
+// probably it's a good sign that the thing we're exiting into is hot. Even more
+// interestingly, since the code was inlined, it may never otherwise get JIT
+// compiled since the act of inlining it may ensure that it otherwise never runs.
+void prepareCodeOriginForOSRExit(ExecState*, CodeOrigin);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGObjectAllocationSinkingPhase.cpp b/dfg/DFGObjectAllocationSinkingPhase.cpp
new file mode 100644
index 0000000..8aafdc4
--- /dev/null
+++ b/dfg/DFGObjectAllocationSinkingPhase.cpp
@@ -0,0 +1,2286 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGObjectAllocationSinkingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockMapInlines.h"
+#include "DFGClobbersExitState.h"
+#include "DFGCombinedLiveness.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGLazyNode.h"
+#include "DFGLivenessAnalysisPhase.h"
+#include "DFGOSRAvailabilityAnalysisPhase.h"
+#include "DFGPhase.h"
+#include "DFGPromotedHeapLocation.h"
+#include "DFGSSACalculator.h"
+#include "DFGValidate.h"
+#include "JSCInlines.h"
+
+#include <list>
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verbose = false;
+
+// In order to sink object cycles, we use a points-to analysis coupled
+// with an escape analysis. This analysis is actually similar to an
+// abstract interpreter focused on local allocations and ignoring
+// everything else.
+//
+// We represent the local heap using two mappings:
+//
+// - A set of the local allocations present in the function, where
+//   each of those have a further mapping from
+//   PromotedLocationDescriptor to local allocations they must point
+//   to.
+//
+// - A "pointer" mapping from nodes to local allocations, if they must
+//   be equal to said local allocation and are currently live. This
+//   can be because the node is the actual node that created the
+//   allocation, or any other node that must currently point to it -
+//   we don't make a difference.
+//
+// The following graph is a motivation for why we separate allocations
+// from pointers:
+//
+// Block #0
+//  0: NewObject({})
+//  1: NewObject({})
+//  -: PutByOffset(@0, @1, x)
+//  -: PutStructure(@0, {x:0})
+//  2: GetByOffset(@0, x)
+//  -: Jump(#1)
+//
+// Block #1
+//  -: Return(@2)
+//
+// Here, we need to remember in block #1 that @2 points to a local
+// allocation with appropriate fields and structures information
+// (because we should be able to place a materialization on top of
+// block #1 here), even though @1 is dead. We *could* just keep @1
+// artificially alive here, but there is no real reason to do it:
+// after all, by the end of block #0, @1 and @2 should be completely
+// interchangeable, and there is no reason for us to artificially make
+// @1 more important.
+//
+// An important point to consider to understand this separation is
+// that we should think of the local heap as follow: we have a
+// bunch of nodes that are pointers to "allocations" that live
+// someplace on the heap, and those allocations can have pointers in
+// between themselves as well. We shouldn't care about whatever
+// names we give to the allocations ; what matters when
+// comparing/merging two heaps is the isomorphism/comparison between
+// the allocation graphs as seen by the nodes.
+//
+// For instance, in the following graph:
+//
+// Block #0
+//  0: NewObject({})
+//  -: Branch(#1, #2)
+//
+// Block #1
+//  1: NewObject({})
+//  -: PutByOffset(@0, @1, x)
+//  -: PutStructure(@0, {x:0})
+//  -: Jump(#3)
+//
+// Block #2
+//  2: NewObject({})
+//  -: PutByOffset(@2, undefined, x)
+//  -: PutStructure(@2, {x:0})
+//  -: PutByOffset(@0, @2, x)
+//  -: PutStructure(@0, {x:0})
+//  -: Jump(#3)
+//
+// Block #3
+//  -: Return(@0)
+//
+// we should think of the heaps at tail of blocks #1 and #2 as being
+// exactly the same, even though one has @0.x pointing to @1 and the
+// other has @0.x pointing to @2, because in essence this should not
+// be different from the graph where we hoisted @1 and @2 into a
+// single allocation in block #0. We currently will not handle this
+// case, because we merge allocations based on the node they are
+// coming from, but this is only a technicality for the sake of
+// simplicity that shouldn't hide the deeper idea outlined here.
+
+class Allocation {
+public:
+    // We use Escaped as a special allocation kind because when we
+    // decide to sink an allocation, we still need to keep track of it
+    // once it is escaped if it still has pointers to it in order to
+    // replace any use of those pointers by the corresponding
+    // materialization
+    enum class Kind { Escaped, Object, Activation, Function, GeneratorFunction, AsyncFunction };
+
+    explicit Allocation(Node* identifier = nullptr, Kind kind = Kind::Escaped)
+        : m_identifier(identifier)
+        , m_kind(kind)
+    {
+    }
+
+
+    const HashMap<PromotedLocationDescriptor, Node*>& fields() const
+    {
+        return m_fields;
+    }
+
+    Node* get(PromotedLocationDescriptor descriptor)
+    {
+        return m_fields.get(descriptor);
+    }
+
+    Allocation& set(PromotedLocationDescriptor descriptor, Node* value)
+    {
+        // Pointing to anything else than an unescaped local
+        // allocation is represented by simply not having the
+        // field
+        if (value)
+            m_fields.set(descriptor, value);
+        else
+            m_fields.remove(descriptor);
+        return *this;
+    }
+
+    void remove(PromotedLocationDescriptor descriptor)
+    {
+        set(descriptor, nullptr);
+    }
+
+    bool hasStructures() const
+    {
+        switch (kind()) {
+        case Kind::Object:
+            return true;
+
+        default:
+            return false;
+        }
+    }
+
+    Allocation& setStructures(const RegisteredStructureSet& structures)
+    {
+        ASSERT(hasStructures() && !structures.isEmpty());
+        m_structures = structures;
+        return *this;
+    }
+
+    Allocation& mergeStructures(const RegisteredStructureSet& structures)
+    {
+        ASSERT(hasStructures() || structures.isEmpty());
+        m_structures.merge(structures);
+        return *this;
+    }
+
+    Allocation& filterStructures(const RegisteredStructureSet& structures)
+    {
+        ASSERT(hasStructures());
+        m_structures.filter(structures);
+        return *this;
+    }
+
+    const RegisteredStructureSet& structures() const
+    {
+        return m_structures;
+    }
+
+    Node* identifier() const { return m_identifier; }
+
+    Kind kind() const { return m_kind; }
+
+    bool isEscapedAllocation() const
+    {
+        return kind() == Kind::Escaped;
+    }
+
+    bool isObjectAllocation() const
+    {
+        return m_kind == Kind::Object;
+    }
+
+    bool isActivationAllocation() const
+    {
+        return m_kind == Kind::Activation;
+    }
+
+    bool isFunctionAllocation() const
+    {
+        return m_kind == Kind::Function || m_kind == Kind::GeneratorFunction || m_kind == Kind::AsyncFunction;
+    }
+
+    bool operator==(const Allocation& other) const
+    {
+        return m_identifier == other.m_identifier
+            && m_kind == other.m_kind
+            && m_fields == other.m_fields
+            && m_structures == other.m_structures;
+    }
+
+    bool operator!=(const Allocation& other) const
+    {
+        return !(*this == other);
+    }
+
+    void dump(PrintStream& out) const
+    {
+        dumpInContext(out, nullptr);
+    }
+
+    void dumpInContext(PrintStream& out, DumpContext* context) const
+    {
+        switch (m_kind) {
+        case Kind::Escaped:
+            out.print("Escaped");
+            break;
+
+        case Kind::Object:
+            out.print("Object");
+            break;
+
+        case Kind::Function:
+            out.print("Function");
+            break;
+
+        case Kind::GeneratorFunction:
+            out.print("GeneratorFunction");
+            break;
+
+        case Kind::AsyncFunction:
+            out.print("AsyncFunction");
+            break;
+
+        case Kind::Activation:
+            out.print("Activation");
+            break;
+        }
+        out.print("Allocation(");
+        if (!m_structures.isEmpty())
+            out.print(inContext(m_structures.toStructureSet(), context));
+        if (!m_fields.isEmpty()) {
+            if (!m_structures.isEmpty())
+                out.print(", ");
+            out.print(mapDump(m_fields, " => #", ", "));
+        }
+        out.print(")");
+    }
+
+private:
+    Node* m_identifier; // This is the actual node that created the allocation
+    Kind m_kind;
+    HashMap<PromotedLocationDescriptor, Node*> m_fields;
+    RegisteredStructureSet m_structures;
+};
+
+class LocalHeap {
+public:
+    Allocation& newAllocation(Node* node, Allocation::Kind kind)
+    {
+        ASSERT(!m_pointers.contains(node) && !isAllocation(node));
+        m_pointers.add(node, node);
+        return m_allocations.set(node, Allocation(node, kind)).iterator->value;
+    }
+
+    bool isAllocation(Node* identifier) const
+    {
+        return m_allocations.contains(identifier);
+    }
+
+    // Note that this is fundamentally different from
+    // onlyLocalAllocation() below. getAllocation() takes as argument
+    // a node-as-identifier, that is, an allocation node. This
+    // allocation node doesn't have to be alive; it may only be
+    // pointed to by other nodes or allocation fields.
+    // For instance, in the following graph:
+    //
+    // Block #0
+    //  0: NewObject({})
+    //  1: NewObject({})
+    //  -: PutByOffset(@0, @1, x)
+    //  -: PutStructure(@0, {x:0})
+    //  2: GetByOffset(@0, x)
+    //  -: Jump(#1)
+    //
+    // Block #1
+    //  -: Return(@2)
+    //
+    // At head of block #1, the only reachable allocation is #@1,
+    // which can be reached through node @2. Thus, getAllocation(#@1)
+    // contains the appropriate metadata for this allocation, but
+    // onlyLocalAllocation(@1) is null, as @1 is no longer a pointer
+    // to #@1 (since it is dead). Conversely, onlyLocalAllocation(@2)
+    // is the same as getAllocation(#@1), while getAllocation(#@2)
+    // does not make sense since @2 is not an allocation node.
+    //
+    // This is meant to be used when the node is already known to be
+    // an identifier (i.e. an allocation) - probably because it was
+    // found as value of a field or pointer in the current heap, or
+    // was the result of a call to follow(). In any other cases (such
+    // as when doing anything while traversing the graph), the
+    // appropriate function to call is probably onlyLocalAllocation.
+    Allocation& getAllocation(Node* identifier)
+    {
+        auto iter = m_allocations.find(identifier);
+        ASSERT(iter != m_allocations.end());
+        return iter->value;
+    }
+
+    void newPointer(Node* node, Node* identifier)
+    {
+        ASSERT(!m_allocations.contains(node) && !m_pointers.contains(node));
+        ASSERT(isAllocation(identifier));
+        m_pointers.add(node, identifier);
+    }
+
+    // follow solves the points-to problem. Given a live node, which
+    // may be either an allocation itself or a heap read (e.g. a
+    // GetByOffset node), it returns the corresponding allocation
+    // node, if there is one. If the argument node is neither an
+    // allocation or a heap read, or may point to different nodes,
+    // nullptr will be returned. Note that a node that points to
+    // different nodes can never point to an unescaped local
+    // allocation.
+    Node* follow(Node* node) const
+    {
+        auto iter = m_pointers.find(node);
+        ASSERT(iter == m_pointers.end() || m_allocations.contains(iter->value));
+        return iter == m_pointers.end() ? nullptr : iter->value;
+    }
+
+    Node* follow(PromotedHeapLocation location) const
+    {
+        const Allocation& base = m_allocations.find(location.base())->value;
+        auto iter = base.fields().find(location.descriptor());
+
+        if (iter == base.fields().end())
+            return nullptr;
+
+        return iter->value;
+    }
+
+    // onlyLocalAllocation find the corresponding allocation metadata
+    // for any live node. onlyLocalAllocation(node) is essentially
+    // getAllocation(follow(node)), with appropriate null handling.
+    Allocation* onlyLocalAllocation(Node* node)
+    {
+        Node* identifier = follow(node);
+        if (!identifier)
+            return nullptr;
+
+        return &getAllocation(identifier);
+    }
+
+    Allocation* onlyLocalAllocation(PromotedHeapLocation location)
+    {
+        Node* identifier = follow(location);
+        if (!identifier)
+            return nullptr;
+
+        return &getAllocation(identifier);
+    }
+
+    // This allows us to store the escapees only when necessary. If
+    // set, the current escapees can be retrieved at any time using
+    // takeEscapees(), which will clear the cached set of escapees;
+    // otherwise the heap won't remember escaping allocations.
+    void setWantEscapees()
+    {
+        m_wantEscapees = true;
+    }
+
+    HashMap<Node*, Allocation> takeEscapees()
+    {
+        return WTFMove(m_escapees);
+    }
+
+    void escape(Node* node)
+    {
+        Node* identifier = follow(node);
+        if (!identifier)
+            return;
+
+        escapeAllocation(identifier);
+    }
+
+    void merge(const LocalHeap& other)
+    {
+        assertIsValid();
+        other.assertIsValid();
+        ASSERT(!m_wantEscapees);
+
+        if (!reached()) {
+            ASSERT(other.reached());
+            *this = other;
+            return;
+        }
+
+        HashSet<Node*> toEscape;
+
+        for (auto& allocationEntry : other.m_allocations)
+            m_allocations.add(allocationEntry.key, allocationEntry.value);
+        for (auto& allocationEntry : m_allocations) {
+            auto allocationIter = other.m_allocations.find(allocationEntry.key);
+
+            // If we have it and they don't, it died for them but we
+            // are keeping it alive from another field somewhere.
+            // There is nothing to do - we will be escaped
+            // automatically when we handle that other field.
+            // This will also happen for allocation that we have and
+            // they don't, and all of those will get pruned.
+            if (allocationIter == other.m_allocations.end())
+                continue;
+
+            if (allocationEntry.value.kind() != allocationIter->value.kind()) {
+                toEscape.add(allocationEntry.key);
+                for (const auto& fieldEntry : allocationIter->value.fields())
+                    toEscape.add(fieldEntry.value);
+            } else {
+                mergePointerSets(
+                    allocationEntry.value.fields(), allocationIter->value.fields(),
+                    [&] (Node* identifier) {
+                        toEscape.add(identifier);
+                    },
+                    [&] (PromotedLocationDescriptor field) {
+                        allocationEntry.value.remove(field);
+                    });
+                allocationEntry.value.mergeStructures(allocationIter->value.structures());
+            }
+        }
+
+        mergePointerSets(m_pointers, other.m_pointers,
+            [&] (Node* identifier) {
+                toEscape.add(identifier);
+            },
+            [&] (Node* field) {
+                m_pointers.remove(field);
+            });
+
+        for (Node* identifier : toEscape)
+            escapeAllocation(identifier);
+
+        if (!ASSERT_DISABLED) {
+            for (const auto& entry : m_allocations)
+                ASSERT_UNUSED(entry, entry.value.isEscapedAllocation() || other.m_allocations.contains(entry.key));
+        }
+
+        // If there is no remaining pointer to an allocation, we can
+        // remove it. This should only happen for escaped allocations,
+        // because we only merge liveness-pruned heaps in the first
+        // place.
+        prune();
+
+        assertIsValid();
+    }
+
+    void pruneByLiveness(const HashSet<Node*>& live)
+    {
+        Vector<Node*> toRemove;
+        for (const auto& entry : m_pointers) {
+            if (!live.contains(entry.key))
+                toRemove.append(entry.key);
+        }
+        for (Node* node : toRemove)
+            m_pointers.remove(node);
+
+        prune();
+    }
+
+    void assertIsValid() const
+    {
+        if (ASSERT_DISABLED)
+            return;
+
+        // Pointers should point to an actual allocation
+        for (const auto& entry : m_pointers) {
+            ASSERT_UNUSED(entry, entry.value);
+            ASSERT(m_allocations.contains(entry.value));
+        }
+
+        for (const auto& allocationEntry : m_allocations) {
+            // Fields should point to an actual allocation
+            for (const auto& fieldEntry : allocationEntry.value.fields()) {
+                ASSERT_UNUSED(fieldEntry, fieldEntry.value);
+                ASSERT(m_allocations.contains(fieldEntry.value));
+            }
+        }
+    }
+
+    bool operator==(const LocalHeap& other) const
+    {
+        assertIsValid();
+        other.assertIsValid();
+        return m_allocations == other.m_allocations
+            && m_pointers == other.m_pointers;
+    }
+
+    bool operator!=(const LocalHeap& other) const
+    {
+        return !(*this == other);
+    }
+
+    const HashMap<Node*, Allocation>& allocations() const
+    {
+        return m_allocations;
+    }
+
+    const HashMap<Node*, Node*>& pointers() const
+    {
+        return m_pointers;
+    }
+
+    void dump(PrintStream& out) const
+    {
+        out.print("  Allocations:\n");
+        for (const auto& entry : m_allocations)
+            out.print("    #", entry.key, ": ", entry.value, "\n");
+        out.print("  Pointers:\n");
+        for (const auto& entry : m_pointers)
+            out.print("    ", entry.key, " => #", entry.value, "\n");
+    }
+
+    bool reached() const
+    {
+        return m_reached;
+    }
+
+    void setReached()
+    {
+        m_reached = true;
+    }
+
+private:
+    // When we merge two heaps, we escape all fields of allocations,
+    // unless they point to the same thing in both heaps.
+    // The reason for this is that it allows us not to do extra work
+    // for diamond graphs where we would otherwise have to check
+    // whether we have a single definition or not, which would be
+    // cumbersome.
+    //
+    // Note that we should try to unify nodes even when they are not
+    // from the same allocation; for instance we should be able to
+    // completely eliminate all allocations from the following graph:
+    //
+    // Block #0
+    //  0: NewObject({})
+    //  -: Branch(#1, #2)
+    //
+    // Block #1
+    //  1: NewObject({})
+    //  -: PutByOffset(@1, "left", val)
+    //  -: PutStructure(@1, {val:0})
+    //  -: PutByOffset(@0, @1, x)
+    //  -: PutStructure(@0, {x:0})
+    //  -: Jump(#3)
+    //
+    // Block #2
+    //  2: NewObject({})
+    //  -: PutByOffset(@2, "right", val)
+    //  -: PutStructure(@2, {val:0})
+    //  -: PutByOffset(@0, @2, x)
+    //  -: PutStructure(@0, {x:0})
+    //  -: Jump(#3)
+    //
+    // Block #3:
+    //  3: GetByOffset(@0, x)
+    //  4: GetByOffset(@3, val)
+    //  -: Return(@4)
+    template<typename Key, typename EscapeFunctor, typename RemoveFunctor>
+    void mergePointerSets(
+        const HashMap<Key, Node*>& my, const HashMap<Key, Node*>& their,
+        const EscapeFunctor& escape, const RemoveFunctor& remove)
+    {
+        Vector<Key> toRemove;
+        for (const auto& entry : my) {
+            auto iter = their.find(entry.key);
+            if (iter == their.end()) {
+                toRemove.append(entry.key);
+                escape(entry.value);
+            } else if (iter->value != entry.value) {
+                toRemove.append(entry.key);
+                escape(entry.value);
+                escape(iter->value);
+            }
+        }
+        for (const auto& entry : their) {
+            if (my.contains(entry.key))
+                continue;
+            escape(entry.value);
+        }
+        for (Key key : toRemove)
+            remove(key);
+    }
+
+    void escapeAllocation(Node* identifier)
+    {
+        Allocation& allocation = getAllocation(identifier);
+        if (allocation.isEscapedAllocation())
+            return;
+
+        Allocation unescaped = WTFMove(allocation);
+        allocation = Allocation(unescaped.identifier(), Allocation::Kind::Escaped);
+
+        for (const auto& entry : unescaped.fields())
+            escapeAllocation(entry.value);
+
+        if (m_wantEscapees)
+            m_escapees.add(unescaped.identifier(), WTFMove(unescaped));
+    }
+
+    void prune()
+    {
+        HashSet<Node*> reachable;
+        for (const auto& entry : m_pointers)
+            reachable.add(entry.value);
+
+        // Repeatedly mark as reachable allocations in fields of other
+        // reachable allocations
+        {
+            Vector<Node*> worklist;
+            worklist.appendRange(reachable.begin(), reachable.end());
+
+            while (!worklist.isEmpty()) {
+                Node* identifier = worklist.takeLast();
+                Allocation& allocation = m_allocations.find(identifier)->value;
+                for (const auto& entry : allocation.fields()) {
+                    if (reachable.add(entry.value).isNewEntry)
+                        worklist.append(entry.value);
+                }
+            }
+        }
+
+        // Remove unreachable allocations
+        {
+            Vector<Node*> toRemove;
+            for (const auto& entry : m_allocations) {
+                if (!reachable.contains(entry.key))
+                    toRemove.append(entry.key);
+            }
+            for (Node* identifier : toRemove)
+                m_allocations.remove(identifier);
+        }
+    }
+
+    bool m_reached = false;
+    HashMap<Node*, Node*> m_pointers;
+    HashMap<Node*, Allocation> m_allocations;
+
+    bool m_wantEscapees = false;
+    HashMap<Node*, Allocation> m_escapees;
+};
+
+class ObjectAllocationSinkingPhase : public Phase {
+public:
+    ObjectAllocationSinkingPhase(Graph& graph)
+        : Phase(graph, "object allocation elimination")
+        , m_pointerSSA(graph)
+        , m_allocationSSA(graph)
+        , m_insertionSet(graph)
+    {
+    }
+
+    bool run()
+    {
+        ASSERT(m_graph.m_form == SSA);
+        ASSERT(m_graph.m_fixpointState == FixpointNotConverged);
+
+        if (!performSinking())
+            return false;
+
+        if (verbose) {
+            dataLog("Graph after elimination:\n");
+            m_graph.dump();
+        }
+
+        return true;
+    }
+
+private:
+    bool performSinking()
+    {
+        m_graph.computeRefCounts();
+        m_graph.initializeNodeOwners();
+        m_graph.ensureDominators();
+        performLivenessAnalysis(m_graph);
+        performOSRAvailabilityAnalysis(m_graph);
+        m_combinedLiveness = CombinedLiveness(m_graph);
+
+        CString graphBeforeSinking;
+        if (Options::verboseValidationFailure() && Options::validateGraphAtEachPhase()) {
+            StringPrintStream out;
+            m_graph.dump(out);
+            graphBeforeSinking = out.toCString();
+        }
+
+        if (verbose) {
+            dataLog("Graph before elimination:\n");
+            m_graph.dump();
+        }
+
+        performAnalysis();
+
+        if (!determineSinkCandidates())
+            return false;
+
+        if (verbose) {
+            for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+                dataLog("Heap at head of ", *block, ": \n", m_heapAtHead[block]);
+                dataLog("Heap at tail of ", *block, ": \n", m_heapAtTail[block]);
+            }
+        }
+
+        promoteLocalHeap();
+
+        if (Options::validateGraphAtEachPhase())
+            DFG::validate(m_graph, DumpGraph, graphBeforeSinking);
+        return true;
+    }
+
+    void performAnalysis()
+    {
+        m_heapAtHead = BlockMap<LocalHeap>(m_graph);
+        m_heapAtTail = BlockMap<LocalHeap>(m_graph);
+
+        bool changed;
+        do {
+            if (verbose)
+                dataLog("Doing iteration of escape analysis.\n");
+            changed = false;
+
+            for (BasicBlock* block : m_graph.blocksInPreOrder()) {
+                m_heapAtHead[block].setReached();
+                m_heap = m_heapAtHead[block];
+
+                for (Node* node : *block) {
+                    handleNode(
+                        node,
+                        [] (PromotedHeapLocation, LazyNode) { },
+                        [&] (PromotedHeapLocation) -> Node* {
+                            return nullptr;
+                        });
+                }
+
+                if (m_heap == m_heapAtTail[block])
+                    continue;
+
+                m_heapAtTail[block] = m_heap;
+                changed = true;
+
+                m_heap.assertIsValid();
+
+                // We keep only pointers that are live, and only
+                // allocations that are either live, pointed to by a
+                // live pointer, or (recursively) stored in a field of
+                // a live allocation.
+                //
+                // This means we can accidentaly leak non-dominating
+                // nodes into the successor. However, due to the
+                // non-dominance property, we are guaranteed that the
+                // successor has at least one predecessor that is not
+                // dominated either: this means any reference to a
+                // non-dominating allocation in the successor will
+                // trigger an escape and get pruned during the merge.
+                m_heap.pruneByLiveness(m_combinedLiveness.liveAtTail[block]);
+
+                for (BasicBlock* successorBlock : block->successors())
+                    m_heapAtHead[successorBlock].merge(m_heap);
+            }
+        } while (changed);
+    }
+
+    template<typename WriteFunctor, typename ResolveFunctor>
+    void handleNode(
+        Node* node,
+        const WriteFunctor& heapWrite,
+        const ResolveFunctor& heapResolve)
+    {
+        m_heap.assertIsValid();
+        ASSERT(m_heap.takeEscapees().isEmpty());
+
+        Allocation* target = nullptr;
+        HashMap<PromotedLocationDescriptor, LazyNode> writes;
+        PromotedLocationDescriptor exactRead;
+
+        switch (node->op()) {
+        case NewObject:
+            target = &m_heap.newAllocation(node, Allocation::Kind::Object);
+            target->setStructures(node->structure());
+            writes.add(
+                StructurePLoc, LazyNode(m_graph.freeze(node->structure().get())));
+            break;
+
+        case NewFunction:
+        case NewGeneratorFunction:
+        case NewAsyncFunction: {
+            if (isStillValid(node->castOperand<FunctionExecutable*>()->singletonFunction())) {
+                m_heap.escape(node->child1().node());
+                break;
+            }
+
+            if (node->op() == NewGeneratorFunction)
+                target = &m_heap.newAllocation(node, Allocation::Kind::GeneratorFunction);
+            else if (node->op() == NewAsyncFunction)
+                target = &m_heap.newAllocation(node, Allocation::Kind::AsyncFunction);
+            else
+                target = &m_heap.newAllocation(node, Allocation::Kind::Function);
+
+            writes.add(FunctionExecutablePLoc, LazyNode(node->cellOperand()));
+            writes.add(FunctionActivationPLoc, LazyNode(node->child1().node()));
+            break;
+        }
+
+        case CreateActivation: {
+            if (isStillValid(node->castOperand<SymbolTable*>()->singletonScope())) {
+                m_heap.escape(node->child1().node());
+                break;
+            }
+            target = &m_heap.newAllocation(node, Allocation::Kind::Activation);
+            writes.add(ActivationSymbolTablePLoc, LazyNode(node->cellOperand()));
+            writes.add(ActivationScopePLoc, LazyNode(node->child1().node()));
+            {
+                SymbolTable* symbolTable = node->castOperand<SymbolTable*>();
+                ConcurrentJSLocker locker(symbolTable->m_lock);
+                LazyNode initialValue(m_graph.freeze(node->initializationValueForActivation()));
+                for (auto iter = symbolTable->begin(locker), end = symbolTable->end(locker); iter != end; ++iter) {
+                    writes.add(
+                        PromotedLocationDescriptor(ClosureVarPLoc, iter->value.scopeOffset().offset()),
+                        initialValue);
+                }
+            }
+            break;
+        }
+
+        case PutStructure:
+            target = m_heap.onlyLocalAllocation(node->child1().node());
+            if (target && target->isObjectAllocation()) {
+                writes.add(StructurePLoc, LazyNode(m_graph.freeze(JSValue(node->transition()->next.get()))));
+                target->setStructures(node->transition()->next);
+            } else
+                m_heap.escape(node->child1().node());
+            break;
+
+        case CheckStructure: {
+            Allocation* allocation = m_heap.onlyLocalAllocation(node->child1().node());
+            if (allocation && allocation->isObjectAllocation()) {
+                allocation->filterStructures(node->structureSet());
+                if (Node* value = heapResolve(PromotedHeapLocation(allocation->identifier(), StructurePLoc)))
+                    node->convertToCheckStructureImmediate(value);
+            } else
+                m_heap.escape(node->child1().node());
+            break;
+        }
+
+        case GetByOffset:
+        case GetGetterSetterByOffset:
+            target = m_heap.onlyLocalAllocation(node->child2().node());
+            if (target && target->isObjectAllocation()) {
+                unsigned identifierNumber = node->storageAccessData().identifierNumber;
+                exactRead = PromotedLocationDescriptor(NamedPropertyPLoc, identifierNumber);
+            } else {
+                m_heap.escape(node->child1().node());
+                m_heap.escape(node->child2().node());
+            }
+            break;
+
+        case MultiGetByOffset: {
+            Allocation* allocation = m_heap.onlyLocalAllocation(node->child1().node());
+            if (allocation && allocation->isObjectAllocation()) {
+                MultiGetByOffsetData& data = node->multiGetByOffsetData();
+                RegisteredStructureSet validStructures;
+                bool hasInvalidStructures = false;
+                for (const auto& multiGetByOffsetCase : data.cases) {
+                    if (!allocation->structures().overlaps(multiGetByOffsetCase.set()))
+                        continue;
+
+                    switch (multiGetByOffsetCase.method().kind()) {
+                    case GetByOffsetMethod::LoadFromPrototype: // We need to escape those
+                    case GetByOffsetMethod::Constant: // We don't really have a way of expressing this
+                        hasInvalidStructures = true;
+                        break;
+
+                    case GetByOffsetMethod::Load: // We're good
+                        validStructures.merge(multiGetByOffsetCase.set());
+                        break;
+
+                    default:
+                        RELEASE_ASSERT_NOT_REACHED();
+                    }
+                }
+                if (hasInvalidStructures) {
+                    m_heap.escape(node->child1().node());
+                    break;
+                }
+                unsigned identifierNumber = data.identifierNumber;
+                PromotedHeapLocation location(NamedPropertyPLoc, allocation->identifier(), identifierNumber);
+                if (Node* value = heapResolve(location)) {
+                    if (allocation->structures().isSubsetOf(validStructures))
+                        node->replaceWith(value);
+                    else {
+                        Node* structure = heapResolve(PromotedHeapLocation(allocation->identifier(), StructurePLoc));
+                        ASSERT(structure);
+                        allocation->filterStructures(validStructures);
+                        node->convertToCheckStructure(m_graph.addStructureSet(allocation->structures()));
+                        node->convertToCheckStructureImmediate(structure);
+                        node->setReplacement(value);
+                    }
+                } else if (!allocation->structures().isSubsetOf(validStructures)) {
+                    // Even though we don't need the result here, we still need
+                    // to make the call to tell our caller that we could need
+                    // the StructurePLoc.
+                    // The reason for this is that when we decide not to sink a
+                    // node, we will still lower any read to its fields before
+                    // it escapes (which are usually reads across a function
+                    // call that DFGClobberize can't handle) - but we only do
+                    // this for PromotedHeapLocations that we have seen read
+                    // during the analysis!
+                    heapResolve(PromotedHeapLocation(allocation->identifier(), StructurePLoc));
+                    allocation->filterStructures(validStructures);
+                }
+                Node* identifier = allocation->get(location.descriptor());
+                if (identifier)
+                    m_heap.newPointer(node, identifier);
+            } else
+                m_heap.escape(node->child1().node());
+            break;
+        }
+
+        case PutByOffset:
+            target = m_heap.onlyLocalAllocation(node->child2().node());
+            if (target && target->isObjectAllocation()) {
+                unsigned identifierNumber = node->storageAccessData().identifierNumber;
+                writes.add(
+                    PromotedLocationDescriptor(NamedPropertyPLoc, identifierNumber),
+                    LazyNode(node->child3().node()));
+            } else {
+                m_heap.escape(node->child1().node());
+                m_heap.escape(node->child2().node());
+                m_heap.escape(node->child3().node());
+            }
+            break;
+
+        case GetClosureVar:
+            target = m_heap.onlyLocalAllocation(node->child1().node());
+            if (target && target->isActivationAllocation()) {
+                exactRead =
+                    PromotedLocationDescriptor(ClosureVarPLoc, node->scopeOffset().offset());
+            } else
+                m_heap.escape(node->child1().node());
+            break;
+
+        case PutClosureVar:
+            target = m_heap.onlyLocalAllocation(node->child1().node());
+            if (target && target->isActivationAllocation()) {
+                writes.add(
+                    PromotedLocationDescriptor(ClosureVarPLoc, node->scopeOffset().offset()),
+                    LazyNode(node->child2().node()));
+            } else {
+                m_heap.escape(node->child1().node());
+                m_heap.escape(node->child2().node());
+            }
+            break;
+
+        case SkipScope:
+            target = m_heap.onlyLocalAllocation(node->child1().node());
+            if (target && target->isActivationAllocation())
+                exactRead = ActivationScopePLoc;
+            else
+                m_heap.escape(node->child1().node());
+            break;
+
+        case GetExecutable:
+            target = m_heap.onlyLocalAllocation(node->child1().node());
+            if (target && target->isFunctionAllocation())
+                exactRead = FunctionExecutablePLoc;
+            else
+                m_heap.escape(node->child1().node());
+            break;
+
+        case GetScope:
+            target = m_heap.onlyLocalAllocation(node->child1().node());
+            if (target && target->isFunctionAllocation())
+                exactRead = FunctionActivationPLoc;
+            else
+                m_heap.escape(node->child1().node());
+            break;
+
+        case Check:
+            m_graph.doToChildren(
+                node,
+                [&] (Edge edge) {
+                    if (edge.willNotHaveCheck())
+                        return;
+
+                    if (alreadyChecked(edge.useKind(), SpecObject))
+                        return;
+
+                    m_heap.escape(edge.node());
+                });
+            break;
+
+        case MovHint:
+        case PutHint:
+            // Handled by OSR availability analysis
+            break;
+
+        default:
+            m_graph.doToChildren(
+                node,
+                [&] (Edge edge) {
+                    m_heap.escape(edge.node());
+                });
+            break;
+        }
+
+        if (exactRead) {
+            ASSERT(target);
+            ASSERT(writes.isEmpty());
+            if (Node* value = heapResolve(PromotedHeapLocation(target->identifier(), exactRead))) {
+                ASSERT(!value->replacement());
+                node->replaceWith(value);
+            }
+            Node* identifier = target->get(exactRead);
+            if (identifier)
+                m_heap.newPointer(node, identifier);
+        }
+
+        for (auto entry : writes) {
+            ASSERT(target);
+            if (entry.value.isNode())
+                target->set(entry.key, m_heap.follow(entry.value.asNode()));
+            else
+                target->remove(entry.key);
+            heapWrite(PromotedHeapLocation(target->identifier(), entry.key), entry.value);
+        }
+
+        m_heap.assertIsValid();
+    }
+
+    bool determineSinkCandidates()
+    {
+        m_sinkCandidates.clear();
+        m_materializationToEscapee.clear();
+        m_materializationSiteToMaterializations.clear();
+        m_materializationSiteToRecoveries.clear();
+        m_materializationSiteToHints.clear();
+
+        // Logically we wish to consider every allocation and sink
+        // it. However, it is probably not profitable to sink an
+        // allocation that will always escape. So, we only sink an
+        // allocation if one of the following is true:
+        //
+        // 1) There exists a basic block with only backwards outgoing
+        //    edges (or no outgoing edges) in which the node wasn't
+        //    materialized. This is meant to catch
+        //    effectively-infinite loops in which we don't need to
+        //    have allocated the object.
+        //
+        // 2) There exists a basic block at the tail of which the node
+        //    is dead and not materialized.
+        //
+        // 3) The sum of execution counts of the materializations is
+        //    less than the sum of execution counts of the original
+        //    node.
+        //
+        // We currently implement only rule #2.
+        // FIXME: Implement the two other rules.
+        // https://bugs.webkit.org/show_bug.cgi?id=137073 (rule #1)
+        // https://bugs.webkit.org/show_bug.cgi?id=137074 (rule #3)
+        //
+        // However, these rules allow for a sunk object to be put into
+        // a non-sunk one, which we don't support. We could solve this
+        // by supporting PutHints on local allocations, making these
+        // objects only partially correct, and we would need to adapt
+        // the OSR availability analysis and OSR exit to handle
+        // this. This would be totally doable, but would create a
+        // super rare, and thus bug-prone, code path.
+        // So, instead, we need to implement one of the following
+        // closure rules:
+        //
+        // 1) If we put a sink candidate into a local allocation that
+        //    is not a sink candidate, change our minds and don't
+        //    actually sink the sink candidate.
+        //
+        // 2) If we put a sink candidate into a local allocation, that
+        //    allocation becomes a sink candidate as well.
+        //
+        // We currently choose to implement closure rule #2.
+        HashMap<Node*, Vector<Node*>> dependencies;
+        bool hasUnescapedReads = false;
+        for (BasicBlock* block : m_graph.blocksInPreOrder()) {
+            m_heap = m_heapAtHead[block];
+
+            for (Node* node : *block) {
+                handleNode(
+                    node,
+                    [&] (PromotedHeapLocation location, LazyNode value) {
+                        if (!value.isNode())
+                            return;
+
+                        Allocation* allocation = m_heap.onlyLocalAllocation(value.asNode());
+                        if (allocation && !allocation->isEscapedAllocation())
+                            dependencies.add(allocation->identifier(), Vector<Node*>()).iterator->value.append(location.base());
+                    },
+                    [&] (PromotedHeapLocation) -> Node* {
+                        hasUnescapedReads = true;
+                        return nullptr;
+                    });
+            }
+
+            // The sink candidates are initially the unescaped
+            // allocations dying at tail of blocks
+            HashSet<Node*> allocations;
+            for (const auto& entry : m_heap.allocations()) {
+                if (!entry.value.isEscapedAllocation())
+                    allocations.add(entry.key);
+            }
+
+            m_heap.pruneByLiveness(m_combinedLiveness.liveAtTail[block]);
+
+            for (Node* identifier : allocations) {
+                if (!m_heap.isAllocation(identifier))
+                    m_sinkCandidates.add(identifier);
+            }
+        }
+
+        // Ensure that the set of sink candidates is closed for put operations
+        Vector<Node*> worklist;
+        worklist.appendRange(m_sinkCandidates.begin(), m_sinkCandidates.end());
+
+        while (!worklist.isEmpty()) {
+            for (Node* identifier : dependencies.get(worklist.takeLast())) {
+                if (m_sinkCandidates.add(identifier).isNewEntry)
+                    worklist.append(identifier);
+            }
+        }
+
+        if (m_sinkCandidates.isEmpty())
+            return hasUnescapedReads;
+
+        if (verbose)
+            dataLog("Candidates: ", listDump(m_sinkCandidates), "\n");
+
+        // Create the materialization nodes
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            m_heap = m_heapAtHead[block];
+            m_heap.setWantEscapees();
+
+            for (Node* node : *block) {
+                handleNode(
+                    node,
+                    [] (PromotedHeapLocation, LazyNode) { },
+                    [] (PromotedHeapLocation) -> Node* {
+                        return nullptr;
+                    });
+                auto escapees = m_heap.takeEscapees();
+                if (!escapees.isEmpty())
+                    placeMaterializations(escapees, node);
+            }
+
+            m_heap.pruneByLiveness(m_combinedLiveness.liveAtTail[block]);
+
+            {
+                HashMap<Node*, Allocation> escapingOnEdge;
+                for (const auto& entry : m_heap.allocations()) {
+                    if (entry.value.isEscapedAllocation())
+                        continue;
+
+                    bool mustEscape = false;
+                    for (BasicBlock* successorBlock : block->successors()) {
+                        if (!m_heapAtHead[successorBlock].isAllocation(entry.key)
+                            || m_heapAtHead[successorBlock].getAllocation(entry.key).isEscapedAllocation())
+                            mustEscape = true;
+                    }
+
+                    if (mustEscape)
+                        escapingOnEdge.add(entry.key, entry.value);
+                }
+                placeMaterializations(WTFMove(escapingOnEdge), block->terminal());
+            }
+        }
+
+        return hasUnescapedReads || !m_sinkCandidates.isEmpty();
+    }
+
+    void placeMaterializations(HashMap<Node*, Allocation> escapees, Node* where)
+    {
+        // We don't create materializations if the escapee is not a
+        // sink candidate
+        Vector<Node*> toRemove;
+        for (const auto& entry : escapees) {
+            if (!m_sinkCandidates.contains(entry.key))
+                toRemove.append(entry.key);
+        }
+        for (Node* identifier : toRemove)
+            escapees.remove(identifier);
+
+        if (escapees.isEmpty())
+            return;
+
+        // First collect the hints that will be needed when the node
+        // we materialize is still stored into other unescaped sink candidates.
+        // The way to interpret this vector is:
+        //
+        // PromotedHeapLocation(NotEscapedAllocation, field) = identifierAllocation
+        //
+        // e.g:
+        // PromotedHeapLocation(@PhantomNewFunction, FunctionActivationPLoc) = IdentifierOf(@MaterializeCreateActivation)
+        // or:
+        // PromotedHeapLocation(@PhantomCreateActivation, ClosureVarPLoc(x)) = IdentifierOf(@NewFunction)
+        //
+        // When the rhs of the `=` is to be materialized at this `where` point in the program
+        // and IdentifierOf(Materialization) is the original sunken allocation of the materialization.
+        //
+        // The reason we need to collect all the `identifiers` here is that
+        // we may materialize multiple versions of the allocation along control
+        // flow edges. We will PutHint these values along those edges. However,
+        // we also need to PutHint them when we join and have a Phi of the allocations.
+        Vector<std::pair<PromotedHeapLocation, Node*>> hints;
+        for (const auto& entry : m_heap.allocations()) {
+            if (escapees.contains(entry.key))
+                continue;
+
+            for (const auto& field : entry.value.fields()) {
+                ASSERT(m_sinkCandidates.contains(entry.key) || !escapees.contains(field.value));
+                auto iter = escapees.find(field.value);
+                if (iter != escapees.end()) {
+                    ASSERT(m_sinkCandidates.contains(field.value));
+                    hints.append(std::make_pair(PromotedHeapLocation(entry.key, field.key), field.value));
+                }
+            }
+        }
+
+        // Now we need to order the materialization. Any order is
+        // valid (as long as we materialize a node first if it is
+        // needed for the materialization of another node, e.g. a
+        // function's activation must be materialized before the
+        // function itself), but we want to try minimizing the number
+        // of times we have to place Puts to close cycles after a
+        // materialization. In other words, we are trying to find the
+        // minimum number of materializations to remove from the
+        // materialization graph to make it a DAG, known as the
+        // (vertex) feedback set problem. Unfortunately, this is a
+        // NP-hard problem, which we don't want to solve exactly.
+        //
+        // Instead, we use a simple greedy procedure, that procedes as
+        // follow:
+        //  - While there is at least one node with no outgoing edge
+        //    amongst the remaining materializations, materialize it
+        //    first
+        //
+        //  - Similarily, while there is at least one node with no
+        //    incoming edge amongst the remaining materializations,
+        //    materialize it last.
+        //
+        //  - When both previous conditions are false, we have an
+        //    actual cycle, and we need to pick a node to
+        //    materialize. We try greedily to remove the "pressure" on
+        //    the remaining nodes by choosing the node with maximum
+        //    |incoming edges| * |outgoing edges| as a measure of how
+        //    "central" to the graph it is. We materialize it first,
+        //    so that all the recoveries will be Puts of things into
+        //    it (rather than Puts of the materialization into other
+        //    objects), which means we will have a single
+        //    StoreBarrier.
+
+
+        // Compute dependencies between materializations
+        HashMap<Node*, HashSet<Node*>> dependencies;
+        HashMap<Node*, HashSet<Node*>> reverseDependencies;
+        HashMap<Node*, HashSet<Node*>> forMaterialization;
+        for (const auto& entry : escapees) {
+            auto& myDependencies = dependencies.add(entry.key, HashSet<Node*>()).iterator->value;
+            auto& myDependenciesForMaterialization = forMaterialization.add(entry.key, HashSet<Node*>()).iterator->value;
+            reverseDependencies.add(entry.key, HashSet<Node*>());
+            for (const auto& field : entry.value.fields()) {
+                if (escapees.contains(field.value) && field.value != entry.key) {
+                    myDependencies.add(field.value);
+                    reverseDependencies.add(field.value, HashSet<Node*>()).iterator->value.add(entry.key);
+                    if (field.key.neededForMaterialization())
+                        myDependenciesForMaterialization.add(field.value);
+                }
+            }
+        }
+
+        // Helper function to update the materialized set and the
+        // dependencies
+        HashSet<Node*> materialized;
+        auto materialize = [&] (Node* identifier) {
+            materialized.add(identifier);
+            for (Node* dep : dependencies.get(identifier))
+                reverseDependencies.find(dep)->value.remove(identifier);
+            for (Node* rdep : reverseDependencies.get(identifier)) {
+                dependencies.find(rdep)->value.remove(identifier);
+                forMaterialization.find(rdep)->value.remove(identifier);
+            }
+            dependencies.remove(identifier);
+            reverseDependencies.remove(identifier);
+            forMaterialization.remove(identifier);
+        };
+
+        // Nodes without remaining unmaterialized fields will be
+        // materialized first - amongst the remaining unmaterialized
+        // nodes
+        std::list<Allocation> toMaterialize;
+        auto firstPos = toMaterialize.begin();
+        auto materializeFirst = [&] (Allocation&& allocation) {
+            materialize(allocation.identifier());
+            // We need to insert *after* the current position
+            if (firstPos != toMaterialize.end())
+                ++firstPos;
+            firstPos = toMaterialize.insert(firstPos, WTFMove(allocation));
+        };
+
+        // Nodes that no other unmaterialized node points to will be
+        // materialized last - amongst the remaining unmaterialized
+        // nodes
+        auto lastPos = toMaterialize.end();
+        auto materializeLast = [&] (Allocation&& allocation) {
+            materialize(allocation.identifier());
+            lastPos = toMaterialize.insert(lastPos, WTFMove(allocation));
+        };
+
+        // These are the promoted locations that contains some of the
+        // allocations we are currently escaping. If they are a location on
+        // some other allocation we are currently materializing, we will need
+        // to "recover" their value with a real put once the corresponding
+        // allocation is materialized; if they are a location on some other
+        // not-yet-materialized allocation, we will need a PutHint.
+        Vector<PromotedHeapLocation> toRecover;
+
+        // This loop does the actual cycle breaking
+        while (!escapees.isEmpty()) {
+            materialized.clear();
+
+            // Materialize nodes that won't require recoveries if we can
+            for (auto& entry : escapees) {
+                if (!forMaterialization.find(entry.key)->value.isEmpty())
+                    continue;
+
+                if (dependencies.find(entry.key)->value.isEmpty()) {
+                    materializeFirst(WTFMove(entry.value));
+                    continue;
+                }
+
+                if (reverseDependencies.find(entry.key)->value.isEmpty()) {
+                    materializeLast(WTFMove(entry.value));
+                    continue;
+                }
+            }
+
+            // We reach this only if there is an actual cycle that needs
+            // breaking. Because we do not want to solve a NP-hard problem
+            // here, we just heuristically pick a node and materialize it
+            // first.
+            if (materialized.isEmpty()) {
+                uint64_t maxEvaluation = 0;
+                Allocation* bestAllocation = nullptr;
+                for (auto& entry : escapees) {
+                    if (!forMaterialization.find(entry.key)->value.isEmpty())
+                        continue;
+
+                    uint64_t evaluation =
+                        static_cast<uint64_t>(dependencies.get(entry.key).size()) * reverseDependencies.get(entry.key).size();
+                    if (evaluation > maxEvaluation) {
+                        maxEvaluation = evaluation;
+                        bestAllocation = &entry.value;
+                    }
+                }
+                RELEASE_ASSERT(maxEvaluation > 0);
+
+                materializeFirst(WTFMove(*bestAllocation));
+            }
+            RELEASE_ASSERT(!materialized.isEmpty());
+
+            for (Node* identifier : materialized)
+                escapees.remove(identifier);
+        }
+
+        materialized.clear();
+
+        HashSet<Node*> escaped;
+        for (const Allocation& allocation : toMaterialize)
+            escaped.add(allocation.identifier());
+        for (const Allocation& allocation : toMaterialize) {
+            for (const auto& field : allocation.fields()) {
+                if (escaped.contains(field.value) && !materialized.contains(field.value))
+                    toRecover.append(PromotedHeapLocation(allocation.identifier(), field.key));
+            }
+            materialized.add(allocation.identifier());
+        }
+
+        Vector<Node*>& materializations = m_materializationSiteToMaterializations.add(
+            where, Vector<Node*>()).iterator->value;
+
+        for (const Allocation& allocation : toMaterialize) {
+            Node* materialization = createMaterialization(allocation, where);
+            materializations.append(materialization);
+            m_materializationToEscapee.add(materialization, allocation.identifier());
+        }
+
+        if (!toRecover.isEmpty()) {
+            m_materializationSiteToRecoveries.add(
+                where, Vector<PromotedHeapLocation>()).iterator->value.appendVector(toRecover);
+        }
+
+        // The hints need to be after the "real" recoveries so that we
+        // don't hint not-yet-complete objects
+        m_materializationSiteToHints.add(
+            where, Vector<std::pair<PromotedHeapLocation, Node*>>()).iterator->value.appendVector(hints);
+    }
+
+    Node* createMaterialization(const Allocation& allocation, Node* where)
+    {
+        // FIXME: This is the only place where we actually use the
+        // fact that an allocation's identifier is indeed the node
+        // that created the allocation.
+        switch (allocation.kind()) {
+        case Allocation::Kind::Object: {
+            ObjectMaterializationData* data = m_graph.m_objectMaterializationData.add();
+
+            return m_graph.addNode(
+                allocation.identifier()->prediction(), Node::VarArg, MaterializeNewObject,
+                where->origin.withSemantic(allocation.identifier()->origin.semantic),
+                OpInfo(m_graph.addStructureSet(allocation.structures())), OpInfo(data), 0, 0);
+        }
+
+        case Allocation::Kind::AsyncFunction:
+        case Allocation::Kind::GeneratorFunction:
+        case Allocation::Kind::Function: {
+            FrozenValue* executable = allocation.identifier()->cellOperand();
+            
+            NodeType nodeType =
+                allocation.kind() == Allocation::Kind::GeneratorFunction ? NewGeneratorFunction :
+                allocation.kind() == Allocation::Kind::AsyncFunction ? NewAsyncFunction : NewFunction;
+            
+            return m_graph.addNode(
+                allocation.identifier()->prediction(), nodeType,
+                where->origin.withSemantic(
+                    allocation.identifier()->origin.semantic),
+                OpInfo(executable));
+            break;
+        }
+
+        case Allocation::Kind::Activation: {
+            ObjectMaterializationData* data = m_graph.m_objectMaterializationData.add();
+            FrozenValue* symbolTable = allocation.identifier()->cellOperand();
+
+            return m_graph.addNode(
+                allocation.identifier()->prediction(), Node::VarArg, MaterializeCreateActivation,
+                where->origin.withSemantic(
+                    allocation.identifier()->origin.semantic),
+                OpInfo(symbolTable), OpInfo(data), 0, 0);
+        }
+
+        default:
+            DFG_CRASH(m_graph, allocation.identifier(), "Bad allocation kind");
+        }
+    }
+
+    void promoteLocalHeap()
+    {
+        // Collect the set of heap locations that we will be operating
+        // over.
+        HashSet<PromotedHeapLocation> locations;
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            m_heap = m_heapAtHead[block];
+
+            for (Node* node : *block) {
+                handleNode(
+                    node,
+                    [&] (PromotedHeapLocation location, LazyNode) {
+                        // If the location is not on a sink candidate,
+                        // we only sink it if it is read
+                        if (m_sinkCandidates.contains(location.base()))
+                            locations.add(location);
+                    },
+                    [&] (PromotedHeapLocation location) -> Node* {
+                        locations.add(location);
+                        return nullptr;
+                    });
+            }
+        }
+
+        // Figure out which locations belong to which allocations.
+        m_locationsForAllocation.clear();
+        for (PromotedHeapLocation location : locations) {
+            auto result = m_locationsForAllocation.add(
+                location.base(),
+                Vector<PromotedHeapLocation>());
+            ASSERT(!result.iterator->value.contains(location));
+            result.iterator->value.append(location);
+        }
+
+        m_pointerSSA.reset();
+        m_allocationSSA.reset();
+
+        // Collect the set of "variables" that we will be sinking.
+        m_locationToVariable.clear();
+        m_nodeToVariable.clear();
+        Vector<Node*> indexToNode;
+        Vector<PromotedHeapLocation> indexToLocation;
+
+        for (Node* index : m_sinkCandidates) {
+            SSACalculator::Variable* variable = m_allocationSSA.newVariable();
+            m_nodeToVariable.add(index, variable);
+            ASSERT(indexToNode.size() == variable->index());
+            indexToNode.append(index);
+        }
+
+        for (PromotedHeapLocation location : locations) {
+            SSACalculator::Variable* variable = m_pointerSSA.newVariable();
+            m_locationToVariable.add(location, variable);
+            ASSERT(indexToLocation.size() == variable->index());
+            indexToLocation.append(location);
+        }
+
+        // We insert all required constants at top of block 0 so that
+        // they are inserted only once and we don't clutter the graph
+        // with useless constants everywhere
+        HashMap<FrozenValue*, Node*> lazyMapping;
+        if (!m_bottom)
+            m_bottom = m_insertionSet.insertConstant(0, m_graph.block(0)->at(0)->origin, jsNumber(1927));
+
+        Vector<HashSet<PromotedHeapLocation>> hintsForPhi(m_sinkCandidates.size());
+
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            m_heap = m_heapAtHead[block];
+
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+
+                // Some named properties can be added conditionally,
+                // and that would necessitate bottoms
+                for (PromotedHeapLocation location : m_locationsForAllocation.get(node)) {
+                    if (location.kind() != NamedPropertyPLoc)
+                        continue;
+
+                    SSACalculator::Variable* variable = m_locationToVariable.get(location);
+                    m_pointerSSA.newDef(variable, block, m_bottom);
+                }
+
+                for (Node* materialization : m_materializationSiteToMaterializations.get(node)) {
+                    Node* escapee = m_materializationToEscapee.get(materialization);
+                    m_allocationSSA.newDef(m_nodeToVariable.get(escapee), block, materialization);
+                }
+
+                for (std::pair<PromotedHeapLocation, Node*> pair : m_materializationSiteToHints.get(node)) {
+                    PromotedHeapLocation location = pair.first;
+                    Node* identifier = pair.second;
+                    // We're materializing `identifier` at this point, and the unmaterialized
+                    // version is inside `location`. We track which SSA variable this belongs
+                    // to in case we also need a PutHint for the Phi.
+                    if (UNLIKELY(validationEnabled())) {
+                        RELEASE_ASSERT(m_sinkCandidates.contains(location.base()));
+                        RELEASE_ASSERT(m_sinkCandidates.contains(identifier));
+
+                        bool found = false;
+                        for (Node* materialization : m_materializationSiteToMaterializations.get(node)) {
+                            // We're materializing `identifier` here. This asserts that this is indeed the case.
+                            if (m_materializationToEscapee.get(materialization) == identifier) {
+                                found = true;
+                                break;
+                            }
+                        }
+                        RELEASE_ASSERT(found);
+                    }
+
+                    SSACalculator::Variable* variable = m_nodeToVariable.get(identifier);
+                    hintsForPhi[variable->index()].add(location);
+                }
+
+                if (m_sinkCandidates.contains(node))
+                    m_allocationSSA.newDef(m_nodeToVariable.get(node), block, node);
+
+                handleNode(
+                    node,
+                    [&] (PromotedHeapLocation location, LazyNode value) {
+                        if (!locations.contains(location))
+                            return;
+
+                        Node* nodeValue;
+                        if (value.isNode())
+                            nodeValue = value.asNode();
+                        else {
+                            auto iter = lazyMapping.find(value.asValue());
+                            if (iter != lazyMapping.end())
+                                nodeValue = iter->value;
+                            else {
+                                nodeValue = value.ensureIsNode(
+                                    m_insertionSet, m_graph.block(0), 0);
+                                lazyMapping.add(value.asValue(), nodeValue);
+                            }
+                        }
+
+                        SSACalculator::Variable* variable = m_locationToVariable.get(location);
+                        m_pointerSSA.newDef(variable, block, nodeValue);
+                    },
+                    [] (PromotedHeapLocation) -> Node* {
+                        return nullptr;
+                    });
+            }
+        }
+        m_insertionSet.execute(m_graph.block(0));
+
+        // Run the SSA calculators to create Phis
+        m_pointerSSA.computePhis(
+            [&] (SSACalculator::Variable* variable, BasicBlock* block) -> Node* {
+                PromotedHeapLocation location = indexToLocation[variable->index()];
+
+                // Don't create Phi nodes for fields of dead allocations
+                if (!m_heapAtHead[block].isAllocation(location.base()))
+                    return nullptr;
+
+                // Don't create Phi nodes once we are escaped
+                if (m_heapAtHead[block].getAllocation(location.base()).isEscapedAllocation())
+                    return nullptr;
+
+                // If we point to a single allocation, we will
+                // directly use its materialization
+                if (m_heapAtHead[block].follow(location))
+                    return nullptr;
+
+                Node* phiNode = m_graph.addNode(SpecHeapTop, Phi, block->at(0)->origin.withInvalidExit());
+                phiNode->mergeFlags(NodeResultJS);
+                return phiNode;
+            });
+
+        m_allocationSSA.computePhis(
+            [&] (SSACalculator::Variable* variable, BasicBlock* block) -> Node* {
+                Node* identifier = indexToNode[variable->index()];
+
+                // Don't create Phi nodes for dead allocations
+                if (!m_heapAtHead[block].isAllocation(identifier))
+                    return nullptr;
+
+                // Don't create Phi nodes until we are escaped
+                if (!m_heapAtHead[block].getAllocation(identifier).isEscapedAllocation())
+                    return nullptr;
+
+                Node* phiNode = m_graph.addNode(SpecHeapTop, Phi, block->at(0)->origin.withInvalidExit());
+                phiNode->mergeFlags(NodeResultJS);
+                return phiNode;
+            });
+
+        // Place Phis in the right places, replace all uses of any load with the appropriate
+        // value, and create the materialization nodes.
+        LocalOSRAvailabilityCalculator availabilityCalculator(m_graph);
+        m_graph.clearReplacements();
+        for (BasicBlock* block : m_graph.blocksInPreOrder()) {
+            m_heap = m_heapAtHead[block];
+            availabilityCalculator.beginBlock(block);
+
+            // These mapping tables are intended to be lazy. If
+            // something is omitted from the table, it means that
+            // there haven't been any local stores to the promoted
+            // heap location (or any local materialization).
+            m_localMapping.clear();
+            m_escapeeToMaterialization.clear();
+
+            // Insert the Phi functions that we had previously
+            // created.
+            for (SSACalculator::Def* phiDef : m_pointerSSA.phisForBlock(block)) {
+                SSACalculator::Variable* variable = phiDef->variable();
+                m_insertionSet.insert(0, phiDef->value());
+
+                PromotedHeapLocation location = indexToLocation[variable->index()];
+                m_localMapping.set(location, phiDef->value());
+
+                if (m_sinkCandidates.contains(location.base())) {
+                    m_insertionSet.insert(
+                        0,
+                        location.createHint(
+                            m_graph, block->at(0)->origin.withInvalidExit(), phiDef->value()));
+                }
+            }
+
+            for (SSACalculator::Def* phiDef : m_allocationSSA.phisForBlock(block)) {
+                SSACalculator::Variable* variable = phiDef->variable();
+                m_insertionSet.insert(0, phiDef->value());
+
+                Node* identifier = indexToNode[variable->index()];
+                m_escapeeToMaterialization.add(identifier, phiDef->value());
+                bool canExit = false;
+                insertOSRHintsForUpdate(
+                    0, block->at(0)->origin, canExit,
+                    availabilityCalculator.m_availability, identifier, phiDef->value());
+
+                for (PromotedHeapLocation location : hintsForPhi[variable->index()]) {
+                    m_insertionSet.insert(0,
+                        location.createHint(m_graph, block->at(0)->origin.withInvalidExit(), phiDef->value()));
+                    m_localMapping.set(location, phiDef->value());
+                }
+            }
+
+            if (verbose) {
+                dataLog("Local mapping at ", pointerDump(block), ": ", mapDump(m_localMapping), "\n");
+                dataLog("Local materializations at ", pointerDump(block), ": ", mapDump(m_escapeeToMaterialization), "\n");
+            }
+
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                bool canExit = true;
+                bool nextCanExit = node->origin.exitOK;
+                for (PromotedHeapLocation location : m_locationsForAllocation.get(node)) {
+                    if (location.kind() != NamedPropertyPLoc)
+                        continue;
+
+                    m_localMapping.set(location, m_bottom);
+
+                    if (m_sinkCandidates.contains(node)) {
+                        if (verbose)
+                            dataLog("For sink candidate ", node, " found location ", location, "\n");
+                        m_insertionSet.insert(
+                            nodeIndex + 1,
+                            location.createHint(
+                                m_graph, node->origin.takeValidExit(nextCanExit), m_bottom));
+                    }
+                }
+
+                for (Node* materialization : m_materializationSiteToMaterializations.get(node)) {
+                    materialization->origin.exitOK &= canExit;
+                    Node* escapee = m_materializationToEscapee.get(materialization);
+                    populateMaterialization(block, materialization, escapee);
+                    m_escapeeToMaterialization.set(escapee, materialization);
+                    m_insertionSet.insert(nodeIndex, materialization);
+                    if (verbose)
+                        dataLog("Materializing ", escapee, " => ", materialization, " at ", node, "\n");
+                }
+
+                for (PromotedHeapLocation location : m_materializationSiteToRecoveries.get(node))
+                    m_insertionSet.insert(nodeIndex, createRecovery(block, location, node, canExit));
+                for (std::pair<PromotedHeapLocation, Node*> pair : m_materializationSiteToHints.get(node))
+                    m_insertionSet.insert(nodeIndex, createRecovery(block, pair.first, node, canExit));
+
+                // We need to put the OSR hints after the recoveries,
+                // because we only want the hints once the object is
+                // complete
+                for (Node* materialization : m_materializationSiteToMaterializations.get(node)) {
+                    Node* escapee = m_materializationToEscapee.get(materialization);
+                    insertOSRHintsForUpdate(
+                        nodeIndex, node->origin, canExit,
+                        availabilityCalculator.m_availability, escapee, materialization);
+                }
+
+                if (node->origin.exitOK && !canExit) {
+                    // We indicate that the exit state is fine now. It is OK because we updated the
+                    // state above. We need to indicate this manually because the validation doesn't
+                    // have enough information to infer that the exit state is fine.
+                    m_insertionSet.insertNode(nodeIndex, SpecNone, ExitOK, node->origin);
+                }
+
+                if (m_sinkCandidates.contains(node))
+                    m_escapeeToMaterialization.set(node, node);
+
+                availabilityCalculator.executeNode(node);
+
+                bool desiredNextExitOK = node->origin.exitOK && !clobbersExitState(m_graph, node);
+
+                bool doLower = false;
+                handleNode(
+                    node,
+                    [&] (PromotedHeapLocation location, LazyNode value) {
+                        if (!locations.contains(location))
+                            return;
+
+                        Node* nodeValue;
+                        if (value.isNode())
+                            nodeValue = value.asNode();
+                        else
+                            nodeValue = lazyMapping.get(value.asValue());
+
+                        nodeValue = resolve(block, nodeValue);
+
+                        m_localMapping.set(location, nodeValue);
+
+                        if (!m_sinkCandidates.contains(location.base()))
+                            return;
+
+                        doLower = true;
+
+                        if (verbose)
+                            dataLog("Creating hint with value ", nodeValue, " before ", node, "\n");
+                        m_insertionSet.insert(
+                            nodeIndex + 1,
+                            location.createHint(
+                                m_graph, node->origin.takeValidExit(nextCanExit), nodeValue));
+                    },
+                    [&] (PromotedHeapLocation location) -> Node* {
+                        return resolve(block, location);
+                    });
+
+                if (!nextCanExit && desiredNextExitOK) {
+                    // We indicate that the exit state is fine now. We need to do this because we
+                    // emitted hints that appear to invalidate the exit state.
+                    m_insertionSet.insertNode(nodeIndex + 1, SpecNone, ExitOK, node->origin);
+                }
+
+                if (m_sinkCandidates.contains(node) || doLower) {
+                    switch (node->op()) {
+                    case NewObject:
+                        node->convertToPhantomNewObject();
+                        break;
+
+                    case NewFunction:
+                        node->convertToPhantomNewFunction();
+                        break;
+
+                    case NewGeneratorFunction:
+                        node->convertToPhantomNewGeneratorFunction();
+                        break;
+
+                    case NewAsyncFunction:
+                        node->convertToPhantomNewAsyncFunction();
+                        break;
+
+                    case CreateActivation:
+                        node->convertToPhantomCreateActivation();
+                        break;
+
+                    default:
+                        node->remove();
+                        break;
+                    }
+                }
+
+                m_graph.doToChildren(
+                    node,
+                    [&] (Edge& edge) {
+                        edge.setNode(resolve(block, edge.node()));
+                    });
+            }
+
+            // Gotta drop some Upsilons.
+            NodeAndIndex terminal = block->findTerminal();
+            size_t upsilonInsertionPoint = terminal.index;
+            NodeOrigin upsilonOrigin = terminal.node->origin;
+            for (BasicBlock* successorBlock : block->successors()) {
+                for (SSACalculator::Def* phiDef : m_pointerSSA.phisForBlock(successorBlock)) {
+                    Node* phiNode = phiDef->value();
+                    SSACalculator::Variable* variable = phiDef->variable();
+                    PromotedHeapLocation location = indexToLocation[variable->index()];
+                    Node* incoming = resolve(block, location);
+
+                    m_insertionSet.insertNode(
+                        upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,
+                        OpInfo(phiNode), incoming->defaultEdge());
+                }
+
+                for (SSACalculator::Def* phiDef : m_allocationSSA.phisForBlock(successorBlock)) {
+                    Node* phiNode = phiDef->value();
+                    SSACalculator::Variable* variable = phiDef->variable();
+                    Node* incoming = getMaterialization(block, indexToNode[variable->index()]);
+
+                    m_insertionSet.insertNode(
+                        upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,
+                        OpInfo(phiNode), incoming->defaultEdge());
+                }
+            }
+
+            m_insertionSet.execute(block);
+        }
+    }
+
+    Node* resolve(BasicBlock* block, PromotedHeapLocation location)
+    {
+        // If we are currently pointing to a single local allocation,
+        // simply return the associated materialization.
+        if (Node* identifier = m_heap.follow(location))
+            return getMaterialization(block, identifier);
+
+        if (Node* result = m_localMapping.get(location))
+            return result;
+
+        // This implies that there is no local mapping. Find a non-local mapping.
+        SSACalculator::Def* def = m_pointerSSA.nonLocalReachingDef(
+            block, m_locationToVariable.get(location));
+        ASSERT(def);
+        ASSERT(def->value());
+
+        Node* result = def->value();
+        if (result->replacement())
+            result = result->replacement();
+        ASSERT(!result->replacement());
+
+        m_localMapping.add(location, result);
+        return result;
+    }
+
+    Node* resolve(BasicBlock* block, Node* node)
+    {
+        // If we are currently pointing to a single local allocation,
+        // simply return the associated materialization.
+        if (Node* identifier = m_heap.follow(node))
+            return getMaterialization(block, identifier);
+
+        if (node->replacement())
+            node = node->replacement();
+        ASSERT(!node->replacement());
+
+        return node;
+    }
+
+    Node* getMaterialization(BasicBlock* block, Node* identifier)
+    {
+        ASSERT(m_heap.isAllocation(identifier));
+        if (!m_sinkCandidates.contains(identifier))
+            return identifier;
+
+        if (Node* materialization = m_escapeeToMaterialization.get(identifier))
+            return materialization;
+
+        SSACalculator::Def* def = m_allocationSSA.nonLocalReachingDef(
+            block, m_nodeToVariable.get(identifier));
+        ASSERT(def && def->value());
+        m_escapeeToMaterialization.add(identifier, def->value());
+        ASSERT(!def->value()->replacement());
+        return def->value();
+    }
+
+    void insertOSRHintsForUpdate(unsigned nodeIndex, NodeOrigin origin, bool& canExit, AvailabilityMap& availability, Node* escapee, Node* materialization)
+    {
+        if (verbose) {
+            dataLog("Inserting OSR hints at ", origin, ":\n");
+            dataLog("    Escapee: ", escapee, "\n");
+            dataLog("    Materialization: ", materialization, "\n");
+            dataLog("    Availability: ", availability, "\n");
+        }
+        
+        // We need to follow() the value in the heap.
+        // Consider the following graph:
+        //
+        // Block #0
+        //   0: NewObject({})
+        //   1: NewObject({})
+        //   -: PutByOffset(@0, @1, x:0)
+        //   -: PutStructure(@0, {x:0})
+        //   2: GetByOffset(@0, x:0)
+        //   -: MovHint(@2, loc1)
+        //   -: Branch(#1, #2)
+        //
+        // Block #1
+        //   3: Call(f, @1)
+        //   4: Return(@0)
+        //
+        // Block #2
+        //   -: Return(undefined)
+        //
+        // We need to materialize @1 at @3, and when doing so we need
+        // to insert a MovHint for the materialization into loc1 as
+        // well.
+        // In order to do this, we say that we need to insert an
+        // update hint for any availability whose node resolve()s to
+        // the materialization.
+        for (auto entry : availability.m_heap) {
+            if (!entry.value.hasNode())
+                continue;
+            if (m_heap.follow(entry.value.node()) != escapee)
+                continue;
+
+            m_insertionSet.insert(
+                nodeIndex,
+                entry.key.createHint(m_graph, origin.takeValidExit(canExit), materialization));
+        }
+
+        for (unsigned i = availability.m_locals.size(); i--;) {
+            if (!availability.m_locals[i].hasNode())
+                continue;
+            if (m_heap.follow(availability.m_locals[i].node()) != escapee)
+                continue;
+
+            int operand = availability.m_locals.operandForIndex(i);
+            m_insertionSet.insertNode(
+                nodeIndex, SpecNone, MovHint, origin.takeValidExit(canExit), OpInfo(operand),
+                materialization->defaultEdge());
+        }
+    }
+
+    void populateMaterialization(BasicBlock* block, Node* node, Node* escapee)
+    {
+        Allocation& allocation = m_heap.getAllocation(escapee);
+        switch (node->op()) {
+        case MaterializeNewObject: {
+            ObjectMaterializationData& data = node->objectMaterializationData();
+            unsigned firstChild = m_graph.m_varArgChildren.size();
+
+            Vector<PromotedHeapLocation> locations = m_locationsForAllocation.get(escapee);
+
+            PromotedHeapLocation structure(StructurePLoc, allocation.identifier());
+            ASSERT(locations.contains(structure));
+
+            m_graph.m_varArgChildren.append(Edge(resolve(block, structure), KnownCellUse));
+
+            for (PromotedHeapLocation location : locations) {
+                switch (location.kind()) {
+                case StructurePLoc:
+                    ASSERT(location == structure);
+                    break;
+
+                case NamedPropertyPLoc: {
+                    ASSERT(location.base() == allocation.identifier());
+                    data.m_properties.append(location.descriptor());
+                    Node* value = resolve(block, location);
+                    if (m_sinkCandidates.contains(value))
+                        m_graph.m_varArgChildren.append(m_bottom);
+                    else
+                        m_graph.m_varArgChildren.append(value);
+                    break;
+                }
+
+                default:
+                    DFG_CRASH(m_graph, node, "Bad location kind");
+                }
+            }
+
+            node->children = AdjacencyList(
+                AdjacencyList::Variable,
+                firstChild, m_graph.m_varArgChildren.size() - firstChild);
+            break;
+        }
+
+        case MaterializeCreateActivation: {
+            ObjectMaterializationData& data = node->objectMaterializationData();
+
+            unsigned firstChild = m_graph.m_varArgChildren.size();
+
+            Vector<PromotedHeapLocation> locations = m_locationsForAllocation.get(escapee);
+
+            PromotedHeapLocation symbolTable(ActivationSymbolTablePLoc, allocation.identifier());
+            ASSERT(locations.contains(symbolTable));
+            ASSERT(node->cellOperand() == resolve(block, symbolTable)->constant());
+            m_graph.m_varArgChildren.append(Edge(resolve(block, symbolTable), KnownCellUse));
+
+            PromotedHeapLocation scope(ActivationScopePLoc, allocation.identifier());
+            ASSERT(locations.contains(scope));
+            m_graph.m_varArgChildren.append(Edge(resolve(block, scope), KnownCellUse));
+
+            for (PromotedHeapLocation location : locations) {
+                switch (location.kind()) {
+                case ActivationScopePLoc: {
+                    ASSERT(location == scope);
+                    break;
+                }
+
+                case ActivationSymbolTablePLoc: {
+                    ASSERT(location == symbolTable);
+                    break;
+                }
+
+                case ClosureVarPLoc: {
+                    ASSERT(location.base() == allocation.identifier());
+                    data.m_properties.append(location.descriptor());
+                    Node* value = resolve(block, location);
+                    if (m_sinkCandidates.contains(value))
+                        m_graph.m_varArgChildren.append(m_bottom);
+                    else
+                        m_graph.m_varArgChildren.append(value);
+                    break;
+                }
+
+                default:
+                    DFG_CRASH(m_graph, node, "Bad location kind");
+                }
+            }
+
+            node->children = AdjacencyList(
+                AdjacencyList::Variable,
+                firstChild, m_graph.m_varArgChildren.size() - firstChild);
+            break;
+        }
+        
+        case NewFunction:
+        case NewGeneratorFunction:
+        case NewAsyncFunction: {
+            Vector<PromotedHeapLocation> locations = m_locationsForAllocation.get(escapee);
+            ASSERT(locations.size() == 2);
+                
+            PromotedHeapLocation executable(FunctionExecutablePLoc, allocation.identifier());
+            ASSERT_UNUSED(executable, locations.contains(executable));
+                
+            PromotedHeapLocation activation(FunctionActivationPLoc, allocation.identifier());
+            ASSERT(locations.contains(activation));
+
+            node->child1() = Edge(resolve(block, activation), KnownCellUse);
+            break;
+        }
+
+        default:
+            DFG_CRASH(m_graph, node, "Bad materialize op");
+        }
+    }
+
+    Node* createRecovery(BasicBlock* block, PromotedHeapLocation location, Node* where, bool& canExit)
+    {
+        if (verbose)
+            dataLog("Recovering ", location, " at ", where, "\n");
+        ASSERT(location.base()->isPhantomAllocation());
+        Node* base = getMaterialization(block, location.base());
+        Node* value = resolve(block, location);
+
+        NodeOrigin origin = where->origin.withSemantic(base->origin.semantic);
+
+        if (verbose)
+            dataLog("Base is ", base, " and value is ", value, "\n");
+
+        if (base->isPhantomAllocation()) {
+            return PromotedHeapLocation(base, location.descriptor()).createHint(
+                m_graph, origin.takeValidExit(canExit), value);
+        }
+
+        switch (location.kind()) {
+        case NamedPropertyPLoc: {
+            Allocation& allocation = m_heap.getAllocation(location.base());
+
+            Vector<RegisteredStructure> structures;
+            structures.appendRange(allocation.structures().begin(), allocation.structures().end());
+            unsigned identifierNumber = location.info();
+            UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
+
+            std::sort(
+                structures.begin(),
+                structures.end(),
+                [uid] (RegisteredStructure a, RegisteredStructure b) -> bool {
+                    return a->getConcurrently(uid) < b->getConcurrently(uid);
+                });
+
+            PropertyOffset firstOffset = structures[0]->getConcurrently(uid);
+
+            if (firstOffset == structures.last()->getConcurrently(uid)) {
+                Node* storage = base;
+                // FIXME: When we decide to sink objects with a
+                // property storage, we should handle non-inline offsets.
+                RELEASE_ASSERT(isInlineOffset(firstOffset));
+
+                StorageAccessData* data = m_graph.m_storageAccessData.add();
+                data->offset = firstOffset;
+                data->identifierNumber = identifierNumber;
+
+                return m_graph.addNode(
+                    PutByOffset,
+                    origin.takeValidExit(canExit),
+                    OpInfo(data),
+                    Edge(storage, KnownCellUse),
+                    Edge(base, KnownCellUse),
+                    value->defaultEdge());
+            }
+
+            MultiPutByOffsetData* data = m_graph.m_multiPutByOffsetData.add();
+            data->identifierNumber = identifierNumber;
+
+            {
+                PropertyOffset currentOffset = firstOffset;
+                StructureSet currentSet;
+                for (RegisteredStructure structure : structures) {
+                    PropertyOffset offset = structure->getConcurrently(uid);
+                    if (offset != currentOffset) {
+                        // Because our analysis treats MultiPutByOffset like an escape, we only have to
+                        // deal with storing results that would have been previously stored by PutByOffset
+                        // nodes. Those nodes were guarded by the appropriate type checks. This means that
+                        // at this point, we can simply trust that the incoming value has the right type
+                        // for whatever structure we are using.
+                        data->variants.append(
+                            PutByIdVariant::replace(currentSet, currentOffset, InferredType::Top));
+                        currentOffset = offset;
+                        currentSet.clear();
+                    }
+                    currentSet.add(structure.get());
+                }
+                data->variants.append(
+                    PutByIdVariant::replace(currentSet, currentOffset, InferredType::Top));
+            }
+
+            return m_graph.addNode(
+                MultiPutByOffset,
+                origin.takeValidExit(canExit),
+                OpInfo(data),
+                Edge(base, KnownCellUse),
+                value->defaultEdge());
+            break;
+        }
+
+        case ClosureVarPLoc: {
+            return m_graph.addNode(
+                PutClosureVar,
+                origin.takeValidExit(canExit),
+                OpInfo(location.info()),
+                Edge(base, KnownCellUse),
+                value->defaultEdge());
+            break;
+        }
+
+        default:
+            DFG_CRASH(m_graph, base, "Bad location kind");
+            break;
+        }
+    }
+
+    // This is a great way of asking value->isStillValid() without having to worry about getting
+    // different answers. It turns out that this analysis works OK regardless of what this
+    // returns but breaks badly if this changes its mind for any particular InferredValue. This
+    // method protects us from that.
+    bool isStillValid(InferredValue* value)
+    {
+        return m_validInferredValues.add(value, value->isStillValid()).iterator->value;
+    }
+
+    SSACalculator m_pointerSSA;
+    SSACalculator m_allocationSSA;
+    HashSet<Node*> m_sinkCandidates;
+    HashMap<PromotedHeapLocation, SSACalculator::Variable*> m_locationToVariable;
+    HashMap<Node*, SSACalculator::Variable*> m_nodeToVariable;
+    HashMap<PromotedHeapLocation, Node*> m_localMapping;
+    HashMap<Node*, Node*> m_escapeeToMaterialization;
+    InsertionSet m_insertionSet;
+    CombinedLiveness m_combinedLiveness;
+
+    HashMap<InferredValue*, bool> m_validInferredValues;
+
+    HashMap<Node*, Node*> m_materializationToEscapee;
+    HashMap<Node*, Vector<Node*>> m_materializationSiteToMaterializations;
+    HashMap<Node*, Vector<PromotedHeapLocation>> m_materializationSiteToRecoveries;
+    HashMap<Node*, Vector<std::pair<PromotedHeapLocation, Node*>>> m_materializationSiteToHints;
+
+    HashMap<Node*, Vector<PromotedHeapLocation>> m_locationsForAllocation;
+
+    BlockMap<LocalHeap> m_heapAtHead;
+    BlockMap<LocalHeap> m_heapAtTail;
+    LocalHeap m_heap;
+
+    Node* m_bottom = nullptr;
+};
+
+}
+
+bool performObjectAllocationSinking(Graph& graph)
+{
+    return runPhase<ObjectAllocationSinkingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGObjectAllocationSinkingPhase.h b/dfg/DFGObjectAllocationSinkingPhase.h
new file mode 100644
index 0000000..919642d
--- /dev/null
+++ b/dfg/DFGObjectAllocationSinkingPhase.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Eliminates allocations allocations that are never used except
+// locally. This will insert phantom allocations and store hints so
+// that OSR exit can materialize the objects. Replaces all uses of the
+// objects' fields with SSA data flow. This phase is able to handle cyclic allocation graphs.
+
+bool performObjectAllocationSinking(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGObjectMaterializationData.cpp b/dfg/DFGObjectMaterializationData.cpp
new file mode 100644
index 0000000..baf145e
--- /dev/null
+++ b/dfg/DFGObjectMaterializationData.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGObjectMaterializationData.h"
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace DFG {
+
+void ObjectMaterializationData::dump(PrintStream& out) const
+{
+    out.print("[", listDump(m_properties), "]");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGObjectMaterializationData.h b/dfg/DFGObjectMaterializationData.h
new file mode 100644
index 0000000..c76fccb
--- /dev/null
+++ b/dfg/DFGObjectMaterializationData.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGPromotedHeapLocation.h"
+#include <limits.h>
+#include <wtf/MathExtras.h>
+#include <wtf/PrintStream.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+struct ObjectMaterializationData {
+    // Determines the meaning of the passed nodes.
+    Vector<PromotedLocationDescriptor> m_properties;
+    
+    void dump(PrintStream&) const;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOpInfo.h b/dfg/DFGOpInfo.h
new file mode 100644
index 0000000..ddccfb1
--- /dev/null
+++ b/dfg/DFGOpInfo.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGRegisteredStructure.h"
+#include "HeapCell.h"
+#include <wtf/StdLibExtras.h>
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+// This type used in passing an immediate argument to Node constructor;
+// distinguishes an immediate value (typically an index into a CodeBlock data structure - 
+// a constant index, argument, or identifier) from a Node*.
+struct OpInfo {
+    OpInfo() : m_value(0) { }
+    explicit OpInfo(int32_t value) : m_value(static_cast<uint64_t>(value)) { }
+    explicit OpInfo(uint32_t value) : m_value(static_cast<uint64_t>(value)) { }
+    explicit OpInfo(uint64_t value) : m_value(static_cast<uint64_t>(value)) { }
+#if OS(DARWIN)
+    explicit OpInfo(uintptr_t value) : m_value(static_cast<uint64_t>(value)) { }
+#endif
+    explicit OpInfo(RegisteredStructure structure) : m_value(static_cast<uint64_t>(bitwise_cast<uintptr_t>(structure))) { }
+
+
+    template <typename T>
+    explicit OpInfo(T* ptr)
+    {
+        static_assert(!std::is_base_of<HeapCell, T>::value, "To make an OpInfo with a cell in it, the cell must be registered or frozen.");
+        static_assert(!std::is_base_of<StructureSet, T>::value, "To make an OpInfo with a structure set in, make sure to use RegisteredStructureSet.");
+        m_value = static_cast<uint64_t>(reinterpret_cast<uintptr_t>(ptr));
+    }
+
+    uint64_t m_value;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGOperations.cpp b/dfg/DFGOperations.cpp
new file mode 100644
index 0000000..bcea199
--- /dev/null
+++ b/dfg/DFGOperations.cpp
@@ -0,0 +1,2592 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGOperations.h"
+
+#include "ArrayConstructor.h"
+#include "ButterflyInlines.h"
+#include "ClonedArguments.h"
+#include "CodeBlock.h"
+#include "CommonSlowPaths.h"
+#include "DFGDriver.h"
+#include "DFGJITCode.h"
+#include "DFGOSRExit.h"
+#include "DFGThunks.h"
+#include "DFGToFTLDeferredCompilationCallback.h"
+#include "DFGToFTLForOSREntryDeferredCompilationCallback.h"
+#include "DFGWorklist.h"
+#include "DefinePropertyAttributes.h"
+#include "DirectArguments.h"
+#include "FTLForOSREntryJITCode.h"
+#include "FTLOSREntry.h"
+#include "HasOwnPropertyCache.h"
+#include "HostCallReturnValue.h"
+#include "Interpreter.h"
+#include "JIT.h"
+#include "JITExceptions.h"
+#include "JSArrayInlines.h"
+#include "JSCInlines.h"
+#include "JSFixedArray.h"
+#include "JSGenericTypedArrayViewConstructorInlines.h"
+#include "JSLexicalEnvironment.h"
+#include "JSMap.h"
+#include "JSSet.h"
+#include "ObjectConstructor.h"
+#include "Operations.h"
+#include "RegExpObject.h"
+#include "Repatch.h"
+#include "ScopedArguments.h"
+#include "StringConstructor.h"
+#include "SuperSampler.h"
+#include "Symbol.h"
+#include "TypeProfilerLog.h"
+#include "TypedArrayInlines.h"
+#include "VMInlines.h"
+#include <wtf/InlineASM.h>
+
+#if ENABLE(JIT)
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+template<bool strict, bool direct>
+static inline void putByVal(ExecState* exec, JSValue baseValue, uint32_t index, JSValue value)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    ASSERT(isIndex(index));
+    if (direct) {
+        RELEASE_ASSERT(baseValue.isObject());
+        asObject(baseValue)->putDirectIndex(exec, index, value, 0, strict ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+        return;
+    }
+    if (baseValue.isObject()) {
+        JSObject* object = asObject(baseValue);
+        if (object->canSetIndexQuickly(index)) {
+            object->setIndexQuickly(vm, index, value);
+            return;
+        }
+
+        object->methodTable(vm)->putByIndex(object, exec, index, value, strict);
+        return;
+    }
+
+    baseValue.putByIndex(exec, index, value, strict);
+}
+
+template<bool strict, bool direct>
+ALWAYS_INLINE static void JIT_OPERATION operationPutByValInternal(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    NativeCallFrameTracer tracer(vm, exec);
+
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue property = JSValue::decode(encodedProperty);
+    JSValue value = JSValue::decode(encodedValue);
+
+    if (LIKELY(property.isUInt32())) {
+        // Despite its name, JSValue::isUInt32 will return true only for positive boxed int32_t; all those values are valid array indices.
+        ASSERT(isIndex(property.asUInt32()));
+        scope.release();
+        putByVal<strict, direct>(exec, baseValue, property.asUInt32(), value);
+        return;
+    }
+
+    if (property.isDouble()) {
+        double propertyAsDouble = property.asDouble();
+        uint32_t propertyAsUInt32 = static_cast<uint32_t>(propertyAsDouble);
+        if (propertyAsDouble == propertyAsUInt32 && isIndex(propertyAsUInt32)) {
+            scope.release();
+            putByVal<strict, direct>(exec, baseValue, propertyAsUInt32, value);
+            return;
+        }
+    }
+
+    // Don't put to an object if toString throws an exception.
+    auto propertyName = property.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    PutPropertySlot slot(baseValue, strict);
+    if (direct) {
+        RELEASE_ASSERT(baseValue.isObject());
+        if (std::optional<uint32_t> index = parseIndex(propertyName)) {
+            scope.release();
+            asObject(baseValue)->putDirectIndex(exec, index.value(), value, 0, strict ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+            return;
+        }
+        asObject(baseValue)->putDirect(*vm, propertyName, value, slot);
+        return;
+    }
+    scope.release();
+    baseValue.put(exec, propertyName, value, slot);
+}
+
+template<typename ViewClass>
+char* newTypedArrayWithSize(ExecState* exec, Structure* structure, int32_t size, char* vector)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (size < 0) {
+        throwException(exec, scope, createRangeError(exec, ASCIILiteral("Requested length is negative")));
+        return 0;
+    }
+    
+    if (vector)
+        return bitwise_cast<char*>(ViewClass::createWithFastVector(exec, structure, size, vector));
+
+    scope.release();
+    return bitwise_cast<char*>(ViewClass::create(exec, structure, size));
+}
+
+template <bool strict>
+static ALWAYS_INLINE void putWithThis(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedThis, EncodedJSValue encodedValue, const Identifier& ident)
+{
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue thisVal = JSValue::decode(encodedThis);
+    JSValue putValue = JSValue::decode(encodedValue);
+    PutPropertySlot slot(thisVal, strict);
+    baseValue.putInline(exec, ident, putValue, slot);
+}
+
+extern "C" {
+
+EncodedJSValue JIT_OPERATION operationToThis(ExecState* exec, EncodedJSValue encodedOp)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return JSValue::encode(JSValue::decode(encodedOp).toThis(exec, NotStrictMode));
+}
+
+EncodedJSValue JIT_OPERATION operationToThisStrict(ExecState* exec, EncodedJSValue encodedOp)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return JSValue::encode(JSValue::decode(encodedOp).toThis(exec, StrictMode));
+}
+
+JSCell* JIT_OPERATION operationCreateThis(ExecState* exec, JSObject* constructor, int32_t inlineCapacity)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (constructor->type() == JSFunctionType) {
+        auto rareData = jsCast<JSFunction*>(constructor)->rareData(exec, inlineCapacity);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        return constructEmptyObject(exec, rareData->objectAllocationProfile()->structure());
+    }
+
+    JSValue proto = constructor->get(exec, exec->propertyNames().prototype);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (proto.isObject())
+        return constructEmptyObject(exec, asObject(proto));
+    return constructEmptyObject(exec);
+}
+
+JSCell* JIT_OPERATION operationObjectConstructor(ExecState* exec, JSGlobalObject* globalObject, EncodedJSValue encodedTarget)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    JSValue value = JSValue::decode(encodedTarget);
+    ASSERT(!value.isObject());
+
+    if (value.isUndefinedOrNull())
+        return constructEmptyObject(exec, globalObject->objectPrototype());
+    return value.toObject(exec, globalObject);
+}
+
+EncodedJSValue JIT_OPERATION operationValueBitAnd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    int32_t a = op1.toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    int32_t b = op2.toInt32(exec);
+    return JSValue::encode(jsNumber(a & b));
+}
+
+EncodedJSValue JIT_OPERATION operationValueBitOr(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    int32_t a = op1.toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    int32_t b = op2.toInt32(exec);
+    return JSValue::encode(jsNumber(a | b));
+}
+
+EncodedJSValue JIT_OPERATION operationValueBitXor(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    int32_t a = op1.toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    int32_t b = op2.toInt32(exec);
+    return JSValue::encode(jsNumber(a ^ b));
+}
+
+EncodedJSValue JIT_OPERATION operationValueBitLShift(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    int32_t a = op1.toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    uint32_t b = op2.toUInt32(exec);
+    return JSValue::encode(jsNumber(a << (b & 0x1f)));
+}
+
+EncodedJSValue JIT_OPERATION operationValueBitRShift(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    int32_t a = op1.toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    uint32_t b = op2.toUInt32(exec);
+    return JSValue::encode(jsNumber(a >> (b & 0x1f)));
+}
+
+EncodedJSValue JIT_OPERATION operationValueBitURShift(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    uint32_t a = op1.toUInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    uint32_t b = op2.toUInt32(exec);
+    return JSValue::encode(jsNumber(static_cast<int32_t>(a >> (b & 0x1f))));
+}
+
+EncodedJSValue JIT_OPERATION operationValueAddNotNumber(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+    
+    ASSERT(!op1.isNumber() || !op2.isNumber());
+    
+    if (op1.isString() && !op2.isObject())
+        return JSValue::encode(jsString(exec, asString(op1), op2.toString(exec)));
+
+    return JSValue::encode(jsAddSlowCase(exec, op1, op2));
+}
+
+EncodedJSValue JIT_OPERATION operationValueDiv(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    double b = op2.toNumber(exec);
+    return JSValue::encode(jsNumber(a / b));
+}
+
+double JIT_OPERATION operationArithAbs(ExecState* exec, EncodedJSValue encodedOp1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, PNaN);
+    return fabs(a);
+}
+
+int32_t JIT_OPERATION operationArithClz32(ExecState* exec, EncodedJSValue encodedOp1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    uint32_t value = op1.toUInt32(exec);
+    RETURN_IF_EXCEPTION(scope, 0);
+    return clz32(value);
+}
+
+double JIT_OPERATION operationArithCos(ExecState* exec, EncodedJSValue encodedOp1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return cos(a);
+}
+
+double JIT_OPERATION operationArithFRound(ExecState* exec, EncodedJSValue encodedOp1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, PNaN);
+    return static_cast<float>(a);
+}
+
+double JIT_OPERATION operationArithLog(ExecState* exec, EncodedJSValue encodedOp1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, PNaN);
+    return log(a);
+}
+
+double JIT_OPERATION operationArithSin(ExecState* exec, EncodedJSValue encodedOp1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, PNaN);
+    return sin(a);
+}
+
+double JIT_OPERATION operationArithSqrt(ExecState* exec, EncodedJSValue encodedOp1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, PNaN);
+    return sqrt(a);
+}
+
+double JIT_OPERATION operationArithTan(ExecState* exec, EncodedJSValue encodedOp1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return tan(a);
+}
+
+EncodedJSValue JIT_OPERATION operationArithRound(ExecState* exec, EncodedJSValue encodedArgument)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue argument = JSValue::decode(encodedArgument);
+    double valueOfArgument = argument.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsNumber(jsRound(valueOfArgument)));
+}
+
+EncodedJSValue JIT_OPERATION operationArithFloor(ExecState* exec, EncodedJSValue encodedArgument)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue argument = JSValue::decode(encodedArgument);
+    double valueOfArgument = argument.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsNumber(floor(valueOfArgument)));
+}
+
+EncodedJSValue JIT_OPERATION operationArithCeil(ExecState* exec, EncodedJSValue encodedArgument)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue argument = JSValue::decode(encodedArgument);
+    double valueOfArgument = argument.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsNumber(ceil(valueOfArgument)));
+}
+
+EncodedJSValue JIT_OPERATION operationArithTrunc(ExecState* exec, EncodedJSValue encodedArgument)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue argument = JSValue::decode(encodedArgument);
+    double truncatedValueOfArgument = argument.toIntegerPreserveNaN(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsNumber(truncatedValueOfArgument));
+}
+
+static ALWAYS_INLINE EncodedJSValue getByVal(ExecState* exec, JSCell* base, uint32_t index)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    if (base->isObject()) {
+        JSObject* object = asObject(base);
+        if (object->canGetIndexQuickly(index))
+            return JSValue::encode(object->getIndexQuickly(index));
+    }
+
+    if (isJSString(base) && asString(base)->canGetIndex(index))
+        return JSValue::encode(asString(base)->getIndex(exec, index));
+
+    return JSValue::encode(JSValue(base).get(exec, index));
+}
+
+EncodedJSValue JIT_OPERATION operationGetByVal(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue property = JSValue::decode(encodedProperty);
+
+    if (LIKELY(baseValue.isCell())) {
+        JSCell* base = baseValue.asCell();
+
+        if (property.isUInt32()) {
+            scope.release();
+            return getByVal(exec, base, property.asUInt32());
+        }
+        if (property.isDouble()) {
+            double propertyAsDouble = property.asDouble();
+            uint32_t propertyAsUInt32 = static_cast<uint32_t>(propertyAsDouble);
+            if (propertyAsUInt32 == propertyAsDouble && isIndex(propertyAsUInt32)) {
+                scope.release();
+                return getByVal(exec, base, propertyAsUInt32);
+            }
+        } else if (property.isString()) {
+            Structure& structure = *base->structure(vm);
+            if (JSCell::canUseFastGetOwnProperty(structure)) {
+                if (RefPtr<AtomicStringImpl> existingAtomicString = asString(property)->toExistingAtomicString(exec)) {
+                    if (JSValue result = base->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
+                        return JSValue::encode(result);
+                }
+            }
+        }
+    }
+
+    baseValue.requireObjectCoercible(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    auto propertyName = property.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(baseValue.get(exec, propertyName));
+}
+
+EncodedJSValue JIT_OPERATION operationGetByValCell(ExecState* exec, JSCell* base, EncodedJSValue encodedProperty)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue property = JSValue::decode(encodedProperty);
+
+    if (property.isUInt32())
+        return getByVal(exec, base, property.asUInt32());
+    if (property.isDouble()) {
+        double propertyAsDouble = property.asDouble();
+        uint32_t propertyAsUInt32 = static_cast<uint32_t>(propertyAsDouble);
+        if (propertyAsUInt32 == propertyAsDouble)
+            return getByVal(exec, base, propertyAsUInt32);
+    } else if (property.isString()) {
+        Structure& structure = *base->structure(vm);
+        if (JSCell::canUseFastGetOwnProperty(structure)) {
+            if (RefPtr<AtomicStringImpl> existingAtomicString = asString(property)->toExistingAtomicString(exec)) {
+                if (JSValue result = base->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
+                    return JSValue::encode(result);
+            }
+        }
+    }
+
+    auto propertyName = property.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(JSValue(base).get(exec, propertyName));
+}
+
+ALWAYS_INLINE EncodedJSValue getByValCellInt(ExecState* exec, JSCell* base, int32_t index)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    if (index < 0) {
+        // Go the slowest way possible becase negative indices don't use indexed storage.
+        return JSValue::encode(JSValue(base).get(exec, Identifier::from(exec, index)));
+    }
+
+    // Use this since we know that the value is out of bounds.
+    return JSValue::encode(JSValue(base).get(exec, static_cast<unsigned>(index)));
+}
+
+EncodedJSValue JIT_OPERATION operationGetByValArrayInt(ExecState* exec, JSArray* base, int32_t index)
+{
+    return getByValCellInt(exec, base, index);
+}
+
+EncodedJSValue JIT_OPERATION operationGetByValStringInt(ExecState* exec, JSString* base, int32_t index)
+{
+    return getByValCellInt(exec, base, index);
+}
+
+void JIT_OPERATION operationPutByValStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    operationPutByValInternal<true, false>(exec, encodedBase, encodedProperty, encodedValue);
+}
+
+void JIT_OPERATION operationPutByValNonStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    operationPutByValInternal<false, false>(exec, encodedBase, encodedProperty, encodedValue);
+}
+
+void JIT_OPERATION operationPutByValCellStrict(ExecState* exec, JSCell* cell, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    operationPutByValInternal<true, false>(exec, JSValue::encode(cell), encodedProperty, encodedValue);
+}
+
+void JIT_OPERATION operationPutByValCellNonStrict(ExecState* exec, JSCell* cell, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    operationPutByValInternal<false, false>(exec, JSValue::encode(cell), encodedProperty, encodedValue);
+}
+
+void JIT_OPERATION operationPutByValBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    if (index >= 0) {
+        array->putByIndexInline(exec, index, JSValue::decode(encodedValue), true);
+        return;
+    }
+    
+    PutPropertySlot slot(array, true);
+    array->methodTable()->put(
+        array, exec, Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
+}
+
+void JIT_OPERATION operationPutByValBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    if (index >= 0) {
+        array->putByIndexInline(exec, index, JSValue::decode(encodedValue), false);
+        return;
+    }
+    
+    PutPropertySlot slot(array, false);
+    array->methodTable()->put(
+        array, exec, Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
+}
+
+void JIT_OPERATION operationPutDoubleByValBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, double value)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue jsValue = JSValue(JSValue::EncodeAsDouble, value);
+    
+    if (index >= 0) {
+        array->putByIndexInline(exec, index, jsValue, true);
+        return;
+    }
+    
+    PutPropertySlot slot(array, true);
+    array->methodTable()->put(
+        array, exec, Identifier::from(exec, index), jsValue, slot);
+}
+
+void JIT_OPERATION operationPutDoubleByValBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, double value)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue jsValue = JSValue(JSValue::EncodeAsDouble, value);
+    
+    if (index >= 0) {
+        array->putByIndexInline(exec, index, jsValue, false);
+        return;
+    }
+    
+    PutPropertySlot slot(array, false);
+    array->methodTable()->put(
+        array, exec, Identifier::from(exec, index), jsValue, slot);
+}
+
+void JIT_OPERATION operationPutByValDirectStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    operationPutByValInternal<true, true>(exec, encodedBase, encodedProperty, encodedValue);
+}
+
+void JIT_OPERATION operationPutByValDirectNonStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    operationPutByValInternal<false, true>(exec, encodedBase, encodedProperty, encodedValue);
+}
+
+void JIT_OPERATION operationPutByValDirectCellStrict(ExecState* exec, JSCell* cell, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    operationPutByValInternal<true, true>(exec, JSValue::encode(cell), encodedProperty, encodedValue);
+}
+
+void JIT_OPERATION operationPutByValDirectCellNonStrict(ExecState* exec, JSCell* cell, EncodedJSValue encodedProperty, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    operationPutByValInternal<false, true>(exec, JSValue::encode(cell), encodedProperty, encodedValue);
+}
+
+void JIT_OPERATION operationPutByValDirectBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    if (index >= 0) {
+        array->putDirectIndex(exec, index, JSValue::decode(encodedValue), 0, PutDirectIndexShouldThrow);
+        return;
+    }
+    
+    PutPropertySlot slot(array, true);
+    array->putDirect(exec->vm(), Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
+}
+
+void JIT_OPERATION operationPutByValDirectBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    if (index >= 0) {
+        array->putDirectIndex(exec, index, JSValue::decode(encodedValue));
+        return;
+    }
+    
+    PutPropertySlot slot(array, false);
+    array->putDirect(exec->vm(), Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
+}
+
+EncodedJSValue JIT_OPERATION operationArrayPush(ExecState* exec, EncodedJSValue encodedValue, JSArray* array)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    array->push(exec, JSValue::decode(encodedValue));
+    return JSValue::encode(jsNumber(array->length()));
+}
+
+EncodedJSValue JIT_OPERATION operationArrayPushDouble(ExecState* exec, double value, JSArray* array)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    array->push(exec, JSValue(JSValue::EncodeAsDouble, value));
+    return JSValue::encode(jsNumber(array->length()));
+}
+
+EncodedJSValue JIT_OPERATION operationArrayPop(ExecState* exec, JSArray* array)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    return JSValue::encode(array->pop(exec));
+}
+        
+EncodedJSValue JIT_OPERATION operationArrayPopAndRecoverLength(ExecState* exec, JSArray* array)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    array->butterfly()->setPublicLength(array->butterfly()->publicLength() + 1);
+    
+    return JSValue::encode(array->pop(exec));
+}
+        
+EncodedJSValue JIT_OPERATION operationRegExpExecString(ExecState* exec, JSGlobalObject* globalObject, RegExpObject* regExpObject, JSString* argument)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM& vm = globalObject->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    return JSValue::encode(regExpObject->execInline(exec, globalObject, argument));
+}
+        
+EncodedJSValue JIT_OPERATION operationRegExpExec(ExecState* exec, JSGlobalObject* globalObject, RegExpObject* regExpObject, EncodedJSValue encodedArgument)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM& vm = globalObject->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    JSValue argument = JSValue::decode(encodedArgument);
+
+    JSString* input = argument.toStringOrNull(exec);
+    ASSERT(!!scope.exception() == !input);
+    if (!input)
+        return encodedJSValue();
+    scope.release();
+    return JSValue::encode(regExpObject->execInline(exec, globalObject, input));
+}
+        
+EncodedJSValue JIT_OPERATION operationRegExpExecGeneric(ExecState* exec, JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedArgument)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM& vm = globalObject->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue base = JSValue::decode(encodedBase);
+    JSValue argument = JSValue::decode(encodedArgument);
+    
+    if (!base.inherits(RegExpObject::info()))
+        return throwVMTypeError(exec, scope);
+
+    JSString* input = argument.toStringOrNull(exec);
+    ASSERT(!!scope.exception() == !input);
+    if (!input)
+        return JSValue::encode(jsUndefined());
+    scope.release();
+    return JSValue::encode(asRegExpObject(base)->exec(exec, globalObject, input));
+}
+        
+size_t JIT_OPERATION operationRegExpTestString(ExecState* exec, JSGlobalObject* globalObject, RegExpObject* regExpObject, JSString* input)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM& vm = globalObject->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return regExpObject->testInline(exec, globalObject, input);
+}
+
+size_t JIT_OPERATION operationRegExpTest(ExecState* exec, JSGlobalObject* globalObject, RegExpObject* regExpObject, EncodedJSValue encodedArgument)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM& vm = globalObject->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue argument = JSValue::decode(encodedArgument);
+
+    JSString* input = argument.toStringOrNull(exec);
+    if (!input)
+        return false;
+    return regExpObject->testInline(exec, globalObject, input);
+}
+
+size_t JIT_OPERATION operationRegExpTestGeneric(ExecState* exec, JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedArgument)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM& vm = globalObject->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue base = JSValue::decode(encodedBase);
+    JSValue argument = JSValue::decode(encodedArgument);
+
+    if (!base.inherits(RegExpObject::info())) {
+        throwTypeError(exec, scope);
+        return false;
+    }
+
+    JSString* input = argument.toStringOrNull(exec);
+    ASSERT(!!scope.exception() == !input);
+    if (!input)
+        return false;
+    scope.release();
+    return asRegExpObject(base)->test(exec, globalObject, input);
+}
+
+size_t JIT_OPERATION operationCompareStrictEqCell(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+    
+    ASSERT(op1.isCell());
+    ASSERT(op2.isCell());
+    
+    return JSValue::strictEqualSlowCaseInline(exec, op1, op2);
+}
+
+size_t JIT_OPERATION operationCompareStrictEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    JSValue src1 = JSValue::decode(encodedOp1);
+    JSValue src2 = JSValue::decode(encodedOp2);
+    
+    return JSValue::strictEqual(exec, src1, src2);
+}
+
+EncodedJSValue JIT_OPERATION operationToPrimitive(ExecState* exec, EncodedJSValue value)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    return JSValue::encode(JSValue::decode(value).toPrimitive(exec));
+}
+
+EncodedJSValue JIT_OPERATION operationToNumber(ExecState* exec, EncodedJSValue value)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return JSValue::encode(jsNumber(JSValue::decode(value).toNumber(exec)));
+}
+
+EncodedJSValue JIT_OPERATION operationGetByIdWithThis(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedThis, UniquedStringImpl* impl)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue thisVal = JSValue::decode(encodedThis);
+    PropertySlot slot(thisVal, PropertySlot::PropertySlot::InternalMethodType::Get);
+    JSValue result = baseValue.get(exec, Identifier::fromUid(exec, impl), slot);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationGetByValWithThis(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedThis, EncodedJSValue encodedSubscript)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue thisVal = JSValue::decode(encodedThis);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+
+    if (LIKELY(baseValue.isCell() && subscript.isString())) {
+        Structure& structure = *baseValue.asCell()->structure(vm);
+        if (JSCell::canUseFastGetOwnProperty(structure)) {
+            if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
+                if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
+                    return JSValue::encode(result);
+            }
+        }
+    }
+    
+    PropertySlot slot(thisVal, PropertySlot::PropertySlot::InternalMethodType::Get);
+    if (subscript.isUInt32()) {
+        uint32_t i = subscript.asUInt32();
+        if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
+            return JSValue::encode(asString(baseValue)->getIndex(exec, i));
+        
+        scope.release();
+        return JSValue::encode(baseValue.get(exec, i, slot));
+    }
+
+    baseValue.requireObjectCoercible(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    auto property = subscript.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(baseValue.get(exec, property, slot));
+}
+
+void JIT_OPERATION operationPutByIdWithThisStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedThis, EncodedJSValue encodedValue, UniquedStringImpl* impl)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    putWithThis<true>(exec, encodedBase, encodedThis, encodedValue, Identifier::fromUid(exec, impl));
+}
+
+void JIT_OPERATION operationPutByIdWithThis(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedThis, EncodedJSValue encodedValue, UniquedStringImpl* impl)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    putWithThis<false>(exec, encodedBase, encodedThis, encodedValue, Identifier::fromUid(exec, impl));
+}
+
+void JIT_OPERATION operationPutByValWithThisStrict(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedThis, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Identifier property = JSValue::decode(encodedSubscript).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    scope.release();
+    putWithThis<true>(exec, encodedBase, encodedThis, encodedValue, property);
+}
+
+void JIT_OPERATION operationPutByValWithThis(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedThis, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Identifier property = JSValue::decode(encodedSubscript).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    scope.release();
+    putWithThis<false>(exec, encodedBase, encodedThis, encodedValue, property);
+}
+
+ALWAYS_INLINE static void defineDataProperty(ExecState* exec, VM& vm, JSObject* base, const Identifier& propertyName, JSValue value, int32_t attributes)
+{
+    PropertyDescriptor descriptor = toPropertyDescriptor(value, jsUndefined(), jsUndefined(), DefinePropertyAttributes(attributes));
+    ASSERT((descriptor.attributes() & Accessor) || (!descriptor.isAccessorDescriptor()));
+    if (base->methodTable(vm)->defineOwnProperty == JSObject::defineOwnProperty)
+        JSObject::defineOwnProperty(base, exec, propertyName, descriptor, true);
+    else
+        base->methodTable(vm)->defineOwnProperty(base, exec, propertyName, descriptor, true);
+}
+
+void JIT_OPERATION operationDefineDataProperty(ExecState* exec, JSObject* base, EncodedJSValue encodedProperty, EncodedJSValue encodedValue, int32_t attributes)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Identifier propertyName = JSValue::decode(encodedProperty).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    scope.release();
+    defineDataProperty(exec, vm, base, propertyName, JSValue::decode(encodedValue), attributes);
+}
+
+void JIT_OPERATION operationDefineDataPropertyString(ExecState* exec, JSObject* base, JSString* property, EncodedJSValue encodedValue, int32_t attributes)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Identifier propertyName = property->toIdentifier(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    scope.release();
+    defineDataProperty(exec, vm, base, propertyName, JSValue::decode(encodedValue), attributes);
+}
+
+void JIT_OPERATION operationDefineDataPropertyStringIdent(ExecState* exec, JSObject* base, UniquedStringImpl* property, EncodedJSValue encodedValue, int32_t attributes)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    defineDataProperty(exec, vm, base, Identifier::fromUid(&vm, property), JSValue::decode(encodedValue), attributes);
+}
+
+void JIT_OPERATION operationDefineDataPropertySymbol(ExecState* exec, JSObject* base, Symbol* property, EncodedJSValue encodedValue, int32_t attributes)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    defineDataProperty(exec, vm, base, Identifier::fromUid(property->privateName()), JSValue::decode(encodedValue), attributes);
+}
+
+ALWAYS_INLINE static void defineAccessorProperty(ExecState* exec, VM& vm, JSObject* base, const Identifier& propertyName, JSObject* getter, JSObject* setter, int32_t attributes)
+{
+    PropertyDescriptor descriptor = toPropertyDescriptor(jsUndefined(), getter, setter, DefinePropertyAttributes(attributes));
+    ASSERT((descriptor.attributes() & Accessor) || (!descriptor.isAccessorDescriptor()));
+    if (base->methodTable(vm)->defineOwnProperty == JSObject::defineOwnProperty)
+        JSObject::defineOwnProperty(base, exec, propertyName, descriptor, true);
+    else
+        base->methodTable(vm)->defineOwnProperty(base, exec, propertyName, descriptor, true);
+}
+
+void JIT_OPERATION operationDefineAccessorProperty(ExecState* exec, JSObject* base, EncodedJSValue encodedProperty, JSObject* getter, JSObject* setter, int32_t attributes)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Identifier propertyName = JSValue::decode(encodedProperty).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    defineAccessorProperty(exec, vm, base, propertyName, getter, setter, attributes);
+}
+
+void JIT_OPERATION operationDefineAccessorPropertyString(ExecState* exec, JSObject* base, JSString* property, JSObject* getter, JSObject* setter, int32_t attributes)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Identifier propertyName = property->toIdentifier(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    defineAccessorProperty(exec, vm, base, propertyName, getter, setter, attributes);
+}
+
+void JIT_OPERATION operationDefineAccessorPropertyStringIdent(ExecState* exec, JSObject* base, UniquedStringImpl* property, JSObject* getter, JSObject* setter, int32_t attributes)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    defineAccessorProperty(exec, vm, base, Identifier::fromUid(&vm, property), getter, setter, attributes);
+}
+
+void JIT_OPERATION operationDefineAccessorPropertySymbol(ExecState* exec, JSObject* base, Symbol* property, JSObject* getter, JSObject* setter, int32_t attributes)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    defineAccessorProperty(exec, vm, base, Identifier::fromUid(property->privateName()), getter, setter, attributes);
+}
+
+char* JIT_OPERATION operationNewArray(ExecState* exec, Structure* arrayStructure, void* buffer, size_t size)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    return bitwise_cast<char*>(constructArray(exec, arrayStructure, static_cast<JSValue*>(buffer), size));
+}
+
+char* JIT_OPERATION operationNewEmptyArray(ExecState* exec, Structure* arrayStructure)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    return bitwise_cast<char*>(JSArray::create(*vm, arrayStructure));
+}
+
+char* JIT_OPERATION operationNewArrayWithSize(ExecState* exec, Structure* arrayStructure, int32_t size, Butterfly* butterfly)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (UNLIKELY(size < 0))
+        return bitwise_cast<char*>(throwException(exec, scope, createRangeError(exec, ASCIILiteral("Array size is not a small enough positive integer."))));
+
+    JSArray* result;
+    if (butterfly)
+        result = JSArray::createWithButterfly(vm, nullptr, arrayStructure, butterfly);
+    else
+        result = JSArray::create(vm, arrayStructure, size);
+    return bitwise_cast<char*>(result);
+}
+
+char* JIT_OPERATION operationNewArrayBuffer(ExecState* exec, Structure* arrayStructure, size_t start, size_t size)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return bitwise_cast<char*>(constructArray(exec, arrayStructure, exec->codeBlock()->constantBuffer(start), size));
+}
+
+char* JIT_OPERATION operationNewInt8ArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSInt8Array>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewInt8ArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSInt8Array>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+char* JIT_OPERATION operationNewInt16ArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSInt16Array>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewInt16ArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSInt16Array>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+char* JIT_OPERATION operationNewInt32ArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSInt32Array>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewInt32ArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSInt32Array>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+char* JIT_OPERATION operationNewUint8ArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSUint8Array>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewUint8ArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSUint8Array>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+char* JIT_OPERATION operationNewUint8ClampedArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSUint8ClampedArray>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewUint8ClampedArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSUint8ClampedArray>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+char* JIT_OPERATION operationNewUint16ArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSUint16Array>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewUint16ArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSUint16Array>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+char* JIT_OPERATION operationNewUint32ArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSUint32Array>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewUint32ArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSUint32Array>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+char* JIT_OPERATION operationNewFloat32ArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSFloat32Array>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewFloat32ArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSFloat32Array>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+char* JIT_OPERATION operationNewFloat64ArrayWithSize(
+    ExecState* exec, Structure* structure, int32_t length, char* vector)
+{
+    return newTypedArrayWithSize<JSFloat64Array>(exec, structure, length, vector);
+}
+
+char* JIT_OPERATION operationNewFloat64ArrayWithOneArgument(
+    ExecState* exec, Structure* structure, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return reinterpret_cast<char*>(constructGenericTypedArrayViewWithArguments<JSFloat64Array>(exec, structure, encodedValue, 0, std::nullopt));
+}
+
+JSCell* JIT_OPERATION operationCreateActivationDirect(ExecState* exec, Structure* structure, JSScope* scope, SymbolTable* table, EncodedJSValue initialValueEncoded)
+{
+    JSValue initialValue = JSValue::decode(initialValueEncoded);
+    ASSERT(initialValue == jsUndefined() || initialValue == jsTDZValue());
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return JSLexicalEnvironment::create(vm, structure, scope, table, initialValue);
+}
+
+JSCell* JIT_OPERATION operationCreateDirectArguments(ExecState* exec, Structure* structure, int32_t length, int32_t minCapacity)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer target(&vm, exec);
+    DirectArguments* result = DirectArguments::create(
+        vm, structure, length, std::max(length, minCapacity));
+    // The caller will store to this object without barriers. Most likely, at this point, this is
+    // still a young object and so no barriers are needed. But it's good to be careful anyway,
+    // since the GC should be allowed to do crazy (like pretenuring, for example).
+    vm.heap.writeBarrier(result);
+    return result;
+}
+
+JSCell* JIT_OPERATION operationCreateScopedArguments(ExecState* exec, Structure* structure, Register* argumentStart, int32_t length, JSFunction* callee, JSLexicalEnvironment* scope)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer target(&vm, exec);
+    
+    // We could pass the ScopedArgumentsTable* as an argument. We currently don't because I
+    // didn't feel like changing the max number of arguments for a slow path call from 6 to 7.
+    ScopedArgumentsTable* table = scope->symbolTable()->arguments();
+    
+    return ScopedArguments::createByCopyingFrom(
+        vm, structure, argumentStart, length, callee, table, scope);
+}
+
+JSCell* JIT_OPERATION operationCreateClonedArguments(ExecState* exec, Structure* structure, Register* argumentStart, int32_t length, JSFunction* callee)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer target(&vm, exec);
+    return ClonedArguments::createByCopyingFrom(
+        exec, structure, argumentStart, length, callee);
+}
+
+JSCell* JIT_OPERATION operationCreateDirectArgumentsDuringExit(ExecState* exec, InlineCallFrame* inlineCallFrame, JSFunction* callee, int32_t argumentCount)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer target(&vm, exec);
+    
+    DeferGCForAWhile deferGC(vm.heap);
+    
+    CodeBlock* codeBlock;
+    if (inlineCallFrame)
+        codeBlock = baselineCodeBlockForInlineCallFrame(inlineCallFrame);
+    else
+        codeBlock = exec->codeBlock();
+    
+    unsigned length = argumentCount - 1;
+    unsigned capacity = std::max(length, static_cast<unsigned>(codeBlock->numParameters() - 1));
+    DirectArguments* result = DirectArguments::create(
+        vm, codeBlock->globalObject()->directArgumentsStructure(), length, capacity);
+    
+    result->callee().set(vm, result, callee);
+    
+    Register* arguments =
+        exec->registers() + (inlineCallFrame ? inlineCallFrame->stackOffset : 0) +
+        CallFrame::argumentOffset(0);
+    for (unsigned i = length; i--;)
+        result->setIndexQuickly(vm, i, arguments[i].jsValue());
+    
+    return result;
+}
+
+JSCell* JIT_OPERATION operationCreateClonedArgumentsDuringExit(ExecState* exec, InlineCallFrame* inlineCallFrame, JSFunction* callee, int32_t argumentCount)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer target(&vm, exec);
+    
+    DeferGCForAWhile deferGC(vm.heap);
+    
+    CodeBlock* codeBlock;
+    if (inlineCallFrame)
+        codeBlock = baselineCodeBlockForInlineCallFrame(inlineCallFrame);
+    else
+        codeBlock = exec->codeBlock();
+    
+    unsigned length = argumentCount - 1;
+    ClonedArguments* result = ClonedArguments::createEmpty(
+        vm, codeBlock->globalObject()->clonedArgumentsStructure(), callee, length);
+    
+    Register* arguments =
+        exec->registers() + (inlineCallFrame ? inlineCallFrame->stackOffset : 0) +
+        CallFrame::argumentOffset(0);
+    for (unsigned i = length; i--;)
+        result->initializeIndex(vm, i, arguments[i].jsValue());
+
+    
+    return result;
+}
+
+JSCell* JIT_OPERATION operationCreateRest(ExecState* exec, Register* argumentStart, unsigned numberOfParamsToSkip, unsigned arraySize)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    Structure* structure = globalObject->restParameterStructure();
+    static_assert(sizeof(Register) == sizeof(JSValue), "This is a strong assumption here.");
+    JSValue* argumentsToCopyRegion = bitwise_cast<JSValue*>(argumentStart) + numberOfParamsToSkip;
+    return constructArray(exec, structure, argumentsToCopyRegion, arraySize);
+}
+
+size_t JIT_OPERATION operationObjectIsObject(ExecState* exec, JSGlobalObject* globalObject, JSCell* object)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(jsDynamicCast<JSObject*>(object));
+    
+    if (object->structure(vm)->masqueradesAsUndefined(globalObject))
+        return false;
+    if (object->type() == JSFunctionType)
+        return false;
+    if (object->inlineTypeFlags() & TypeOfShouldCallGetCallData) {
+        CallData callData;
+        if (object->methodTable(vm)->getCallData(object, callData) != CallType::None)
+            return false;
+    }
+    
+    return true;
+}
+
+size_t JIT_OPERATION operationObjectIsFunction(ExecState* exec, JSGlobalObject* globalObject, JSCell* object)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(jsDynamicCast<JSObject*>(object));
+    
+    if (object->structure(vm)->masqueradesAsUndefined(globalObject))
+        return false;
+    if (object->type() == JSFunctionType)
+        return true;
+    if (object->inlineTypeFlags() & TypeOfShouldCallGetCallData) {
+        CallData callData;
+        if (object->methodTable(vm)->getCallData(object, callData) != CallType::None)
+            return true;
+    }
+    
+    return false;
+}
+
+JSCell* JIT_OPERATION operationTypeOfObject(ExecState* exec, JSGlobalObject* globalObject, JSCell* object)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(jsDynamicCast<JSObject*>(object));
+    
+    if (object->structure(vm)->masqueradesAsUndefined(globalObject))
+        return vm.smallStrings.undefinedString();
+    if (object->type() == JSFunctionType)
+        return vm.smallStrings.functionString();
+    if (object->inlineTypeFlags() & TypeOfShouldCallGetCallData) {
+        CallData callData;
+        if (object->methodTable(vm)->getCallData(object, callData) != CallType::None)
+            return vm.smallStrings.functionString();
+    }
+    
+    return vm.smallStrings.objectString();
+}
+
+int32_t JIT_OPERATION operationTypeOfObjectAsTypeofType(ExecState* exec, JSGlobalObject* globalObject, JSCell* object)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(jsDynamicCast<JSObject*>(object));
+    
+    if (object->structure(vm)->masqueradesAsUndefined(globalObject))
+        return static_cast<int32_t>(TypeofType::Undefined);
+    if (object->type() == JSFunctionType)
+        return static_cast<int32_t>(TypeofType::Function);
+    if (object->inlineTypeFlags() & TypeOfShouldCallGetCallData) {
+        CallData callData;
+        if (object->methodTable(vm)->getCallData(object, callData) != CallType::None)
+            return static_cast<int32_t>(TypeofType::Function);
+    }
+    
+    return static_cast<int32_t>(TypeofType::Object);
+}
+
+char* JIT_OPERATION operationAllocateSimplePropertyStorageWithInitialCapacity(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return reinterpret_cast<char*>(
+        Butterfly::createUninitialized(vm, 0, 0, initialOutOfLineCapacity, false, 0));
+}
+
+char* JIT_OPERATION operationAllocateSimplePropertyStorage(ExecState* exec, size_t newSize)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return reinterpret_cast<char*>(
+        Butterfly::createUninitialized(vm, 0, 0, newSize, false, 0));
+}
+
+char* JIT_OPERATION operationAllocateComplexPropertyStorageWithInitialCapacity(ExecState* exec, JSObject* object)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(!object->structure()->outOfLineCapacity());
+    return reinterpret_cast<char*>(
+        object->allocateMoreOutOfLineStorage(vm, 0, initialOutOfLineCapacity));
+}
+
+char* JIT_OPERATION operationAllocateComplexPropertyStorage(ExecState* exec, JSObject* object, size_t newSize)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return reinterpret_cast<char*>(
+        object->allocateMoreOutOfLineStorage(vm, object->structure()->outOfLineCapacity(), newSize));
+}
+
+char* JIT_OPERATION operationEnsureInt32(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    if (!cell->isObject())
+        return 0;
+    
+    return reinterpret_cast<char*>(asObject(cell)->ensureInt32(vm).data());
+}
+
+char* JIT_OPERATION operationEnsureDouble(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    if (!cell->isObject())
+        return 0;
+    
+    return reinterpret_cast<char*>(asObject(cell)->ensureDouble(vm).data());
+}
+
+char* JIT_OPERATION operationEnsureContiguous(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    if (!cell->isObject())
+        return 0;
+    
+    return reinterpret_cast<char*>(asObject(cell)->ensureContiguous(vm).data());
+}
+
+char* JIT_OPERATION operationEnsureArrayStorage(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    if (!cell->isObject())
+        return 0;
+
+    return reinterpret_cast<char*>(asObject(cell)->ensureArrayStorage(vm));
+}
+
+StringImpl* JIT_OPERATION operationResolveRope(ExecState* exec, JSString* string)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return string->value(exec).impl();
+}
+
+JSString* JIT_OPERATION operationToLowerCase(ExecState* exec, JSString* string, uint32_t failingIndex)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    const String& inputString = string->value(exec);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!inputString.length())
+        return vm.smallStrings.emptyString();
+
+    String lowercasedString = inputString.is8Bit() ? inputString.convertToLowercaseWithoutLocaleStartingAtFailingIndex8Bit(failingIndex) : inputString.convertToLowercaseWithoutLocale();
+    if (lowercasedString.impl() == inputString.impl())
+        return string;
+    scope.release();
+    return jsString(exec, lowercasedString);
+}
+
+JSString* JIT_OPERATION operationSingleCharacterString(ExecState* exec, int32_t character)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    return jsSingleCharacterString(exec, static_cast<UChar>(character));
+}
+
+JSCell* JIT_OPERATION operationNewStringObject(ExecState* exec, JSString* string, Structure* structure)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    return StringObject::create(vm, structure, string);
+}
+
+JSCell* JIT_OPERATION operationToStringOnCell(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    return JSValue(cell).toString(exec);
+}
+
+JSCell* JIT_OPERATION operationToString(ExecState* exec, EncodedJSValue value)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return JSValue::decode(value).toString(exec);
+}
+
+JSCell* JIT_OPERATION operationCallStringConstructorOnCell(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return stringConstructor(exec, cell);
+}
+
+JSCell* JIT_OPERATION operationCallStringConstructor(ExecState* exec, EncodedJSValue value)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return stringConstructor(exec, JSValue::decode(value));
+}
+
+JSCell* JIT_OPERATION operationMakeRope2(ExecState* exec, JSString* left, JSString* right)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return jsString(exec, left, right);
+}
+
+JSCell* JIT_OPERATION operationMakeRope3(ExecState* exec, JSString* a, JSString* b, JSString* c)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return jsString(exec, a, b, c);
+}
+
+JSCell* JIT_OPERATION operationStrCat2(ExecState* exec, EncodedJSValue a, EncodedJSValue b)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSString* str1 = JSValue::decode(a).toString(exec);
+    ASSERT(!scope.exception()); // Impossible, since we must have been given primitives.
+    JSString* str2 = JSValue::decode(b).toString(exec);
+    ASSERT(!scope.exception());
+
+    scope.release();
+    return jsString(exec, str1, str2);
+}
+    
+JSCell* JIT_OPERATION operationStrCat3(ExecState* exec, EncodedJSValue a, EncodedJSValue b, EncodedJSValue c)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSString* str1 = JSValue::decode(a).toString(exec);
+    ASSERT(!scope.exception()); // Impossible, since we must have been given primitives.
+    JSString* str2 = JSValue::decode(b).toString(exec);
+    ASSERT(!scope.exception());
+    JSString* str3 = JSValue::decode(c).toString(exec);
+    ASSERT(!scope.exception());
+
+    scope.release();
+    return jsString(exec, str1, str2, str3);
+}
+
+char* JIT_OPERATION operationFindSwitchImmTargetForDouble(
+    ExecState* exec, EncodedJSValue encodedValue, size_t tableIndex)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    CodeBlock* codeBlock = exec->codeBlock();
+    SimpleJumpTable& table = codeBlock->switchJumpTable(tableIndex);
+    JSValue value = JSValue::decode(encodedValue);
+    ASSERT(value.isDouble());
+    double asDouble = value.asDouble();
+    int32_t asInt32 = static_cast<int32_t>(asDouble);
+    if (asDouble == asInt32)
+        return static_cast<char*>(table.ctiForValue(asInt32).executableAddress());
+    return static_cast<char*>(table.ctiDefault.executableAddress());
+}
+
+char* JIT_OPERATION operationSwitchString(ExecState* exec, size_t tableIndex, JSString* string)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return static_cast<char*>(exec->codeBlock()->stringSwitchJumpTable(tableIndex).ctiForValue(string->value(exec).impl()).executableAddress());
+}
+
+int32_t JIT_OPERATION operationSwitchStringAndGetBranchOffset(ExecState* exec, size_t tableIndex, JSString* string)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return exec->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(string->value(exec).impl(), std::numeric_limits<int32_t>::min());
+}
+
+uintptr_t JIT_OPERATION operationCompareStringImplLess(StringImpl* a, StringImpl* b)
+{
+    return codePointCompare(a, b) < 0;
+}
+
+uintptr_t JIT_OPERATION operationCompareStringImplLessEq(StringImpl* a, StringImpl* b)
+{
+    return codePointCompare(a, b) <= 0;
+}
+
+uintptr_t JIT_OPERATION operationCompareStringImplGreater(StringImpl* a, StringImpl* b)
+{
+    return codePointCompare(a, b) > 0;
+}
+
+uintptr_t JIT_OPERATION operationCompareStringImplGreaterEq(StringImpl* a, StringImpl* b)
+{
+    return codePointCompare(a, b) >= 0;
+}
+
+uintptr_t JIT_OPERATION operationCompareStringLess(ExecState* exec, JSString* a, JSString* b)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return codePointCompareLessThan(asString(a)->value(exec), asString(b)->value(exec));
+}
+
+uintptr_t JIT_OPERATION operationCompareStringLessEq(ExecState* exec, JSString* a, JSString* b)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return !codePointCompareLessThan(asString(b)->value(exec), asString(a)->value(exec));
+}
+
+uintptr_t JIT_OPERATION operationCompareStringGreater(ExecState* exec, JSString* a, JSString* b)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return codePointCompareLessThan(asString(b)->value(exec), asString(a)->value(exec));
+}
+
+uintptr_t JIT_OPERATION operationCompareStringGreaterEq(ExecState* exec, JSString* a, JSString* b)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return !codePointCompareLessThan(asString(a)->value(exec), asString(b)->value(exec));
+}
+
+void JIT_OPERATION operationNotifyWrite(ExecState* exec, WatchpointSet* set)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    set->touch(vm, "Executed NotifyWrite");
+}
+
+void JIT_OPERATION operationThrowStackOverflowForVarargs(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    throwStackOverflowError(exec, scope);
+}
+
+int32_t JIT_OPERATION operationSizeOfVarargs(ExecState* exec, EncodedJSValue encodedArguments, int32_t firstVarArgOffset)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue arguments = JSValue::decode(encodedArguments);
+    
+    return sizeOfVarargs(exec, arguments, firstVarArgOffset);
+}
+
+int32_t JIT_OPERATION operationHasOwnProperty(ExecState* exec, JSObject* thisObject, EncodedJSValue encodedKey)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue key = JSValue::decode(encodedKey);
+    Identifier propertyName = key.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
+    bool result = thisObject->hasOwnProperty(exec, propertyName.impl(), slot);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    HasOwnPropertyCache* hasOwnPropertyCache = vm.hasOwnPropertyCache();
+    ASSERT(hasOwnPropertyCache);
+    hasOwnPropertyCache->tryAdd(vm, slot, thisObject, propertyName.impl(), result);
+    return result;
+}
+
+void JIT_OPERATION operationLoadVarargs(ExecState* exec, int32_t firstElementDest, EncodedJSValue encodedArguments, int32_t offset, int32_t length, int32_t mandatoryMinimum)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue arguments = JSValue::decode(encodedArguments);
+    
+    loadVarargs(exec, VirtualRegister(firstElementDest), arguments, offset, length);
+    
+    for (int32_t i = length; i < mandatoryMinimum; ++i)
+        exec->r(firstElementDest + i) = jsUndefined();
+}
+
+double JIT_OPERATION operationFModOnInts(int32_t a, int32_t b)
+{
+    return fmod(a, b);
+}
+
+#if USE(JSVALUE32_64)
+double JIT_OPERATION operationRandom(JSGlobalObject* globalObject)
+{
+    return globalObject->weakRandomNumber();
+}
+#endif
+
+JSCell* JIT_OPERATION operationStringFromCharCode(ExecState* exec, int32_t op1)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    return JSC::stringFromCharCode(exec, op1);
+}
+
+EncodedJSValue JIT_OPERATION operationStringFromCharCodeUntyped(ExecState* exec, EncodedJSValue encodedValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    JSValue charValue = JSValue::decode(encodedValue);
+    int32_t chInt = charValue.toUInt32(exec);
+    return JSValue::encode(JSC::stringFromCharCode(exec, chInt));
+}
+
+int64_t JIT_OPERATION operationConvertBoxedDoubleToInt52(EncodedJSValue encodedValue)
+{
+    JSValue value = JSValue::decode(encodedValue);
+    if (!value.isDouble())
+        return JSValue::notInt52;
+    return tryConvertToInt52(value.asDouble());
+}
+
+int64_t JIT_OPERATION operationConvertDoubleToInt52(double value)
+{
+    return tryConvertToInt52(value);
+}
+
+size_t JIT_OPERATION operationDefaultHasInstance(ExecState* exec, JSCell* value, JSCell* proto) // Returns jsBoolean(True|False) on 64-bit.
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    if (JSObject::defaultHasInstance(exec, value, proto))
+        return 1;
+    return 0;
+}
+
+char* JIT_OPERATION operationNewRawObject(ExecState* exec, Structure* structure, int32_t length, Butterfly* butterfly)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    if (!butterfly
+        && (structure->outOfLineCapacity() || hasIndexedProperties(structure->indexingType()))) {
+        IndexingHeader header;
+        header.setVectorLength(length);
+        header.setPublicLength(0);
+        
+        butterfly = Butterfly::create(
+            vm, nullptr, 0, structure->outOfLineCapacity(),
+            hasIndexedProperties(structure->indexingType()), header,
+            length * sizeof(EncodedJSValue));
+    }
+
+    JSObject* result = JSObject::createRawObject(exec, structure, butterfly);
+    result->butterfly(); // Ensure that the butterfly is in to-space.
+    return bitwise_cast<char*>(result);
+}
+
+JSCell* JIT_OPERATION operationNewObjectWithButterfly(ExecState* exec, Structure* structure, Butterfly* butterfly)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    if (!butterfly) {
+        butterfly = Butterfly::create(
+            vm, nullptr, 0, structure->outOfLineCapacity(), false, IndexingHeader(), 0);
+    }
+    
+    JSObject* result = JSObject::createRawObject(exec, structure, butterfly);
+    result->butterfly(); // Ensure that the butterfly is in to-space.
+    return result;
+}
+
+JSCell* JIT_OPERATION operationNewObjectWithButterflyWithIndexingHeaderAndVectorLength(ExecState* exec, Structure* structure, unsigned length, Butterfly* butterfly)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    IndexingHeader header;
+    header.setVectorLength(length);
+    header.setPublicLength(0);
+    if (butterfly)
+        *butterfly->indexingHeader() = header;
+    else {
+        butterfly = Butterfly::create(
+            vm, nullptr, 0, structure->outOfLineCapacity(), true, header,
+            sizeof(EncodedJSValue) * length);
+    }
+    
+    // Paradoxically this may allocate a JSArray. That's totally cool.
+    JSObject* result = JSObject::createRawObject(exec, structure, butterfly);
+    result->butterfly(); // Ensure that the butterfly is in to-space.
+    return result;
+}
+
+JSCell* JIT_OPERATION operationNewArrayWithSpreadSlow(ExecState* exec, void* buffer, uint32_t numItems)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    EncodedJSValue* values = static_cast<EncodedJSValue*>(buffer);
+    unsigned length = 0;
+    for (unsigned i = 0; i < numItems; i++) {
+        JSValue value = JSValue::decode(values[i]);
+        if (JSFixedArray* array = jsDynamicCast<JSFixedArray*>(value))
+            length += array->size();
+        else
+            ++length;
+    }
+
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
+
+    JSArray* result = JSArray::tryCreateUninitialized(vm, structure, length);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    unsigned index = 0;
+    for (unsigned i = 0; i < numItems; i++) {
+        JSValue value = JSValue::decode(values[i]);
+        if (JSFixedArray* array = jsDynamicCast<JSFixedArray*>(value)) {
+            // We are spreading.
+            for (unsigned i = 0; i < array->size(); i++) {
+                result->initializeIndex(vm, index, array->get(i));
+                ++index;
+            }
+        } else {
+            // We are not spreading.
+            result->initializeIndex(vm, index, value);
+            ++index;
+        }
+    }
+
+    return result;
+}
+
+JSCell* JIT_OPERATION operationSpreadGeneric(ExecState* exec, JSCell* iterable)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    if (isJSArray(iterable)) {
+        JSArray* array = jsCast<JSArray*>(iterable);
+        if (array->isIteratorProtocolFastAndNonObservable()) {
+            throwScope.release();
+            return JSFixedArray::createFromArray(exec, vm, array);
+        }
+    }
+
+    // FIXME: we can probably make this path faster by having our caller JS code call directly into
+    // the iteration protocol builtin: https://bugs.webkit.org/show_bug.cgi?id=164520
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    JSArray* array;
+    {
+        JSFunction* iterationFunction = globalObject->iteratorProtocolFunction();
+        CallData callData;
+        CallType callType = JSC::getCallData(iterationFunction, callData);
+        ASSERT(callType != CallType::None);
+
+        MarkedArgumentBuffer arguments;
+        arguments.append(iterable);
+        JSValue arrayResult = call(exec, iterationFunction, callType, callData, jsNull(), arguments);
+        RETURN_IF_EXCEPTION(throwScope, nullptr);
+        array = jsCast<JSArray*>(arrayResult);
+    }
+
+    throwScope.release();
+    return JSFixedArray::createFromArray(exec, vm, array);
+}
+
+JSCell* JIT_OPERATION operationSpreadFastArray(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(isJSArray(cell));
+    JSArray* array = jsCast<JSArray*>(cell);
+    ASSERT(array->isIteratorProtocolFastAndNonObservable());
+
+    return JSFixedArray::createFromArray(exec, vm, array);
+}
+
+void JIT_OPERATION operationProcessTypeProfilerLogDFG(ExecState* exec) 
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    vm.typeProfilerLog()->processLogEntries(ASCIILiteral("Log Full, called from inside DFG."));
+}
+
+void JIT_OPERATION debugOperationPrintSpeculationFailure(ExecState* exec, void* debugInfoRaw, void* scratch)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    SpeculationFailureDebugInfo* debugInfo = static_cast<SpeculationFailureDebugInfo*>(debugInfoRaw);
+    CodeBlock* codeBlock = debugInfo->codeBlock;
+    CodeBlock* alternative = codeBlock->alternative();
+    dataLog("Speculation failure in ", *codeBlock);
+    dataLog(" @ exit #", vm->osrExitIndex, " (bc#", debugInfo->bytecodeOffset, ", ", exitKindToString(debugInfo->kind), ") with ");
+    if (alternative) {
+        dataLog(
+            "executeCounter = ", alternative->jitExecuteCounter(),
+            ", reoptimizationRetryCounter = ", alternative->reoptimizationRetryCounter(),
+            ", optimizationDelayCounter = ", alternative->optimizationDelayCounter());
+    } else
+        dataLog("no alternative code block (i.e. we've been jettisoned)");
+    dataLog(", osrExitCounter = ", codeBlock->osrExitCounter(), "\n");
+    dataLog("    GPRs at time of exit:");
+    char* scratchPointer = static_cast<char*>(scratch);
+    for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
+        GPRReg gpr = GPRInfo::toRegister(i);
+        dataLog(" ", GPRInfo::debugName(gpr), ":", RawPointer(*reinterpret_cast_ptr<void**>(scratchPointer)));
+        scratchPointer += sizeof(EncodedJSValue);
+    }
+    dataLog("\n");
+    dataLog("    FPRs at time of exit:");
+    for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
+        FPRReg fpr = FPRInfo::toRegister(i);
+        dataLog(" ", FPRInfo::debugName(fpr), ":");
+        uint64_t bits = *reinterpret_cast_ptr<uint64_t*>(scratchPointer);
+        double value = *reinterpret_cast_ptr<double*>(scratchPointer);
+        dataLogF("%llx:%lf", static_cast<long long>(bits), value);
+        scratchPointer += sizeof(EncodedJSValue);
+    }
+    dataLog("\n");
+}
+
+JSCell* JIT_OPERATION operationResolveScope(ExecState* exec, JSScope* scope, UniquedStringImpl* impl)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSObject* resolvedScope = JSScope::resolve(exec, scope, Identifier::fromUid(exec, impl));
+    return resolvedScope;
+}
+
+EncodedJSValue JIT_OPERATION operationGetDynamicVar(ExecState* exec, JSObject* scope, UniquedStringImpl* impl, unsigned getPutInfoBits)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    Identifier ident = Identifier::fromUid(exec, impl);
+    throwScope.release();
+    return JSValue::encode(scope->getPropertySlot(exec, ident, [&] (bool found, PropertySlot& slot) -> JSValue {
+        if (!found) {
+            GetPutInfo getPutInfo(getPutInfoBits);
+            if (getPutInfo.resolveMode() == ThrowIfNotFound)
+                throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
+            return jsUndefined();
+        }
+
+        if (scope->isGlobalLexicalEnvironment()) {
+            // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
+            JSValue result = slot.getValue(exec, ident);
+            if (result == jsTDZValue()) {
+                throwException(exec, throwScope, createTDZError(exec));
+                return jsUndefined();
+            }
+            return result;
+        }
+
+        return slot.getValue(exec, ident);
+    }));
+}
+
+void JIT_OPERATION operationPutDynamicVar(ExecState* exec, JSObject* scope, EncodedJSValue value, UniquedStringImpl* impl, unsigned getPutInfoBits)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    const Identifier& ident = Identifier::fromUid(exec, impl);
+    GetPutInfo getPutInfo(getPutInfoBits);
+    bool hasProperty = scope->hasProperty(exec, ident);
+    RETURN_IF_EXCEPTION(throwScope, void());
+    if (hasProperty
+        && scope->isGlobalLexicalEnvironment()
+        && !isInitialization(getPutInfo.initializationMode())) {
+        // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
+        PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
+        JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
+        if (slot.getValue(exec, ident) == jsTDZValue()) {
+            throwException(exec, throwScope, createTDZError(exec));
+            return;
+        }
+    }
+
+    if (getPutInfo.resolveMode() == ThrowIfNotFound && !hasProperty) {
+        throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
+        return;
+    }
+
+    CodeOrigin origin = exec->codeOrigin();
+    bool strictMode;
+    if (origin.inlineCallFrame)
+        strictMode = origin.inlineCallFrame->baselineCodeBlock->isStrictMode();
+    else
+        strictMode = exec->codeBlock()->isStrictMode();
+    PutPropertySlot slot(scope, strictMode, PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
+    throwScope.release();
+    scope->methodTable()->put(scope, exec, ident, JSValue::decode(value), slot);
+}
+
+int32_t JIT_OPERATION operationMapHash(ExecState* exec, EncodedJSValue input)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    return jsMapHash(exec, vm, normalizeMapKey(JSValue::decode(input)));
+}
+
+JSCell* JIT_OPERATION operationJSMapFindBucket(ExecState* exec, JSCell* map, EncodedJSValue key, int32_t hash)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSMap::BucketType** bucket = jsCast<JSMap*>(map)->findBucket(exec, normalizeMapKey(JSValue::decode(key)), hash);
+    if (!bucket)
+        return nullptr;
+    return *bucket;
+}
+
+JSCell* JIT_OPERATION operationJSSetFindBucket(ExecState* exec, JSCell* map, EncodedJSValue key, int32_t hash)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSSet::BucketType** bucket = jsCast<JSSet*>(map)->findBucket(exec, normalizeMapKey(JSValue::decode(key)), hash);
+    if (!bucket)
+        return nullptr;
+    return *bucket;
+}
+
+extern "C" void JIT_OPERATION triggerReoptimizationNow(CodeBlock* codeBlock, OSRExitBase* exit)
+{
+    // It's sort of preferable that we don't GC while in here. Anyways, doing so wouldn't
+    // really be profitable.
+    DeferGCForAWhile deferGC(codeBlock->vm()->heap);
+    
+    if (Options::verboseOSR())
+        dataLog(*codeBlock, ": Entered reoptimize\n");
+    // We must be called with the baseline code block.
+    ASSERT(JITCode::isBaselineCode(codeBlock->jitType()));
+
+    // If I am my own replacement, then reoptimization has already been triggered.
+    // This can happen in recursive functions.
+    if (codeBlock->replacement() == codeBlock) {
+        if (Options::verboseOSR())
+            dataLog(*codeBlock, ": Not reoptimizing because we've already been jettisoned.\n");
+        return;
+    }
+    
+    // Otherwise, the replacement must be optimized code. Use this as an opportunity
+    // to check our logic.
+    ASSERT(codeBlock->hasOptimizedReplacement());
+    CodeBlock* optimizedCodeBlock = codeBlock->replacement();
+    ASSERT(JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));
+    
+    bool didTryToEnterIntoInlinedLoops = false;
+    for (InlineCallFrame* inlineCallFrame = exit->m_codeOrigin.inlineCallFrame; inlineCallFrame; inlineCallFrame = inlineCallFrame->directCaller.inlineCallFrame) {
+        if (inlineCallFrame->baselineCodeBlock->ownerScriptExecutable()->didTryToEnterInLoop()) {
+            didTryToEnterIntoInlinedLoops = true;
+            break;
+        }
+    }
+
+    // In order to trigger reoptimization, one of two things must have happened:
+    // 1) We exited more than some number of times.
+    // 2) We exited and got stuck in a loop, and now we're exiting again.
+    bool didExitABunch = optimizedCodeBlock->shouldReoptimizeNow();
+    bool didGetStuckInLoop =
+        (codeBlock->checkIfOptimizationThresholdReached() || didTryToEnterIntoInlinedLoops)
+        && optimizedCodeBlock->shouldReoptimizeFromLoopNow();
+    
+    if (!didExitABunch && !didGetStuckInLoop) {
+        if (Options::verboseOSR())
+            dataLog(*codeBlock, ": Not reoptimizing ", *optimizedCodeBlock, " because it either didn't exit enough or didn't loop enough after exit.\n");
+        codeBlock->optimizeAfterLongWarmUp();
+        return;
+    }
+
+    optimizedCodeBlock->jettison(Profiler::JettisonDueToOSRExit, CountReoptimization);
+}
+
+#if ENABLE(FTL_JIT)
+static bool shouldTriggerFTLCompile(CodeBlock* codeBlock, JITCode* jitCode)
+{
+    if (codeBlock->baselineVersion()->m_didFailFTLCompilation) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "abortFTLCompile", ());
+        if (Options::verboseOSR())
+            dataLog("Deferring FTL-optimization of ", *codeBlock, " indefinitely because there was an FTL failure.\n");
+        jitCode->dontOptimizeAnytimeSoon(codeBlock);
+        return false;
+    }
+
+    if (!codeBlock->hasOptimizedReplacement()
+        && !jitCode->checkIfOptimizationThresholdReached(codeBlock)) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("counter = ", jitCode->tierUpCounter));
+        if (Options::verboseOSR())
+            dataLog("Choosing not to FTL-optimize ", *codeBlock, " yet.\n");
+        return false;
+    }
+    return true;
+}
+
+static void triggerFTLReplacementCompile(VM* vm, CodeBlock* codeBlock, JITCode* jitCode)
+{
+    Worklist::State worklistState;
+    if (Worklist* worklist = existingGlobalFTLWorklistOrNull()) {
+        worklistState = worklist->completeAllReadyPlansForVM(
+            *vm, CompilationKey(codeBlock->baselineVersion(), FTLMode));
+    } else
+        worklistState = Worklist::NotKnown;
+    
+    if (worklistState == Worklist::Compiling) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("still compiling"));
+        jitCode->setOptimizationThresholdBasedOnCompilationResult(
+            codeBlock, CompilationDeferred);
+        return;
+    }
+    
+    if (codeBlock->hasOptimizedReplacement()) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("has replacement"));
+        // That's great, we've compiled the code - next time we call this function,
+        // we'll enter that replacement.
+        jitCode->optimizeSoon(codeBlock);
+        return;
+    }
+    
+    if (worklistState == Worklist::Compiled) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("compiled and failed"));
+        // This means that we finished compiling, but failed somehow; in that case the
+        // thresholds will be set appropriately.
+        if (Options::verboseOSR())
+            dataLog("Code block ", *codeBlock, " was compiled but it doesn't have an optimized replacement.\n");
+        return;
+    }
+
+    CODEBLOCK_LOG_EVENT(codeBlock, "triggerFTLReplacement", ());
+    // We need to compile the code.
+    compile(
+        *vm, codeBlock->newReplacement(), codeBlock, FTLMode, UINT_MAX,
+        Operands<JSValue>(), ToFTLDeferredCompilationCallback::create());
+
+    // If we reached here, the counter has not be reset. Do that now.
+    jitCode->setOptimizationThresholdBasedOnCompilationResult(
+        codeBlock, CompilationDeferred);
+}
+
+void JIT_OPERATION triggerTierUpNow(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    DeferGCForAWhile deferGC(vm->heap);
+    CodeBlock* codeBlock = exec->codeBlock();
+    
+    if (codeBlock->jitType() != JITCode::DFGJIT) {
+        dataLog("Unexpected code block in DFG->FTL tier-up: ", *codeBlock, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    JITCode* jitCode = codeBlock->jitCode()->dfg();
+    
+    if (Options::verboseOSR()) {
+        dataLog(
+            *codeBlock, ": Entered triggerTierUpNow with executeCounter = ",
+            jitCode->tierUpCounter, "\n");
+    }
+
+    if (shouldTriggerFTLCompile(codeBlock, jitCode))
+        triggerFTLReplacementCompile(vm, codeBlock, jitCode);
+
+    if (codeBlock->hasOptimizedReplacement()) {
+        if (jitCode->tierUpEntryTriggers.isEmpty()) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("replacement in place, delaying indefinitely"));
+            // There is nothing more we can do, the only way this will be entered
+            // is through the function entry point.
+            jitCode->dontOptimizeAnytimeSoon(codeBlock);
+            return;
+        }
+        if (jitCode->osrEntryBlock() && jitCode->tierUpEntryTriggers.size() == 1) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("trigger in place, delaying indefinitely"));
+            // There is only one outer loop and its trigger must have been set
+            // when the plan completed.
+            // Exiting the inner loop is useless, we can ignore the counter and leave
+            // the trigger do its job.
+            jitCode->dontOptimizeAnytimeSoon(codeBlock);
+            return;
+        }
+    }
+}
+
+static char* tierUpCommon(ExecState* exec, unsigned originBytecodeIndex, unsigned osrEntryBytecodeIndex)
+{
+    VM* vm = &exec->vm();
+    CodeBlock* codeBlock = exec->codeBlock();
+
+    // Resolve any pending plan for OSR Enter on this function.
+    Worklist::State worklistState;
+    if (Worklist* worklist = existingGlobalFTLWorklistOrNull()) {
+        worklistState = worklist->completeAllReadyPlansForVM(
+            *vm, CompilationKey(codeBlock->baselineVersion(), FTLForOSREntryMode));
+    } else
+        worklistState = Worklist::NotKnown;
+
+    JITCode* jitCode = codeBlock->jitCode()->dfg();
+
+    // The following is only true for triggerTierUpNowInLoop, which can never
+    // be an OSR entry.
+    bool canOSRFromHere = originBytecodeIndex == osrEntryBytecodeIndex;
+
+    bool triggeredSlowPathToStartCompilation = false;
+    auto tierUpEntryTriggers = jitCode->tierUpEntryTriggers.find(originBytecodeIndex);
+    if (tierUpEntryTriggers != jitCode->tierUpEntryTriggers.end()) {
+        switch (tierUpEntryTriggers->value) {
+        case JITCode::TriggerReason::DontTrigger:
+            // The trigger isn't set, we entered because the counter reached its
+            // threshold.
+            break;
+
+        case JITCode::TriggerReason::CompilationDone:
+            // The trigger was set because compilation completed. Don't unset it
+            // so that further DFG executions OSR enters as well.
+            RELEASE_ASSERT(canOSRFromHere);
+            break;
+
+        case JITCode::TriggerReason::StartCompilation:
+            // We were asked to enter as soon as possible and start compiling an
+            // entry for the current bytecode location. Unset this trigger so we
+            // don't continually enter.
+            RELEASE_ASSERT(canOSRFromHere);
+            tierUpEntryTriggers->value = JITCode::TriggerReason::DontTrigger;
+            triggeredSlowPathToStartCompilation = true;
+            break;
+        }
+    }
+
+    if (worklistState == Worklist::Compiling) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("still compiling"));
+        jitCode->setOptimizationThresholdBasedOnCompilationResult(
+            codeBlock, CompilationDeferred);
+        return nullptr;
+    }
+
+    if (worklistState == Worklist::Compiled) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("compiled and failed"));
+        // This means that compilation failed and we already set the thresholds.
+        if (Options::verboseOSR())
+            dataLog("Code block ", *codeBlock, " was compiled but it doesn't have an optimized replacement.\n");
+        return nullptr;
+    }
+
+    // If we can OSR Enter, do it right away.
+    if (canOSRFromHere) {
+        unsigned streamIndex = jitCode->bytecodeIndexToStreamIndex.get(originBytecodeIndex);
+        if (CodeBlock* entryBlock = jitCode->osrEntryBlock()) {
+            if (void* address = FTL::prepareOSREntry(exec, codeBlock, entryBlock, originBytecodeIndex, streamIndex)) {
+                CODEBLOCK_LOG_EVENT(entryBlock, "osrEntry", ("at bc#", originBytecodeIndex));
+                return static_cast<char*>(address);
+            }
+        }
+    }
+
+    // - If we don't have an FTL code block, then try to compile one.
+    // - If we do have an FTL code block, then try to enter for a while.
+    // - If we couldn't enter for a while, then trigger OSR entry.
+
+    if (!shouldTriggerFTLCompile(codeBlock, jitCode) && !triggeredSlowPathToStartCompilation)
+        return nullptr;
+
+    if (!jitCode->neverExecutedEntry && !triggeredSlowPathToStartCompilation) {
+        triggerFTLReplacementCompile(vm, codeBlock, jitCode);
+
+        if (!codeBlock->hasOptimizedReplacement())
+            return nullptr;
+
+        if (jitCode->osrEntryRetry < Options::ftlOSREntryRetryThreshold()) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("avoiding OSR entry compile"));
+            jitCode->osrEntryRetry++;
+            return nullptr;
+        }
+    } else
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("avoiding replacement compile"));
+
+    // It's time to try to compile code for OSR entry.
+    if (CodeBlock* entryBlock = jitCode->osrEntryBlock()) {
+        if (jitCode->osrEntryRetry < Options::ftlOSREntryRetryThreshold()) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("OSR entry failed, OSR entry threshold not met"));
+            jitCode->osrEntryRetry++;
+            jitCode->setOptimizationThresholdBasedOnCompilationResult(
+                codeBlock, CompilationDeferred);
+            return nullptr;
+        }
+
+        FTL::ForOSREntryJITCode* entryCode = entryBlock->jitCode()->ftlForOSREntry();
+        entryCode->countEntryFailure();
+        if (entryCode->entryFailureCount() <
+            Options::ftlOSREntryFailureCountForReoptimization()) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("OSR entry failed"));
+            jitCode->setOptimizationThresholdBasedOnCompilationResult(
+                codeBlock, CompilationDeferred);
+            return nullptr;
+        }
+
+        // OSR entry failed. Oh no! This implies that we need to retry. We retry
+        // without exponential backoff and we only do this for the entry code block.
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("OSR entry failed too many times"));
+        unsigned osrEntryBytecode = entryBlock->jitCode()->ftlForOSREntry()->bytecodeIndex();
+        jitCode->clearOSREntryBlock();
+        jitCode->osrEntryRetry = 0;
+        jitCode->tierUpEntryTriggers.set(osrEntryBytecode, JITCode::TriggerReason::DontTrigger);
+        jitCode->setOptimizationThresholdBasedOnCompilationResult(
+            codeBlock, CompilationDeferred);
+        return nullptr;
+    }
+
+    if (!canOSRFromHere) {
+        // We can't OSR from here, or even start a compilation because doing so
+        // calls jitCode->reconstruct which would get the wrong state.
+        if (Options::verboseOSR())
+            dataLog("Non-OSR-able bc#", originBytecodeIndex, " in ", *codeBlock, " setting parent loop bc#", osrEntryBytecodeIndex, "'s trigger and backing off.\n");
+        jitCode->tierUpEntryTriggers.set(osrEntryBytecodeIndex, JITCode::TriggerReason::StartCompilation);
+        jitCode->setOptimizationThresholdBasedOnCompilationResult(codeBlock, CompilationDeferred);
+        return nullptr;
+    }
+
+    unsigned streamIndex = jitCode->bytecodeIndexToStreamIndex.get(osrEntryBytecodeIndex);
+
+    if (!triggeredSlowPathToStartCompilation) {
+        auto tierUpHierarchyEntry = jitCode->tierUpInLoopHierarchy.find(osrEntryBytecodeIndex);
+        if (tierUpHierarchyEntry != jitCode->tierUpInLoopHierarchy.end()) {
+            for (unsigned osrEntryCandidate : tierUpHierarchyEntry->value) {
+                if (jitCode->tierUpEntrySeen.contains(osrEntryCandidate)) {
+                    // Ask an enclosing loop to compile, instead of doing so here.
+                    if (Options::verboseOSR())
+                        dataLog("Inner-loop bc#", originBytecodeIndex, " in ", *codeBlock, " setting parent loop bc#", osrEntryCandidate, "'s trigger and backing off.\n");
+                    jitCode->tierUpEntryTriggers.set(osrEntryCandidate, JITCode::TriggerReason::StartCompilation);
+                    jitCode->setOptimizationThresholdBasedOnCompilationResult(codeBlock, CompilationDeferred);
+                    return nullptr;
+                }
+            }
+        }
+    }
+
+    // We aren't compiling and haven't compiled anything for OSR entry. So, try to compile
+    // something.
+    auto triggerIterator = jitCode->tierUpEntryTriggers.find(osrEntryBytecodeIndex);
+    RELEASE_ASSERT(triggerIterator != jitCode->tierUpEntryTriggers.end());
+    JITCode::TriggerReason* triggerAddress = &(triggerIterator->value);
+
+    Operands<JSValue> mustHandleValues;
+    jitCode->reconstruct(
+        exec, codeBlock, CodeOrigin(osrEntryBytecodeIndex), streamIndex, mustHandleValues);
+    CodeBlock* replacementCodeBlock = codeBlock->newReplacement();
+
+    CODEBLOCK_LOG_EVENT(codeBlock, "triggerFTLOSR", ());
+    CompilationResult forEntryResult = compile(
+        *vm, replacementCodeBlock, codeBlock, FTLForOSREntryMode, osrEntryBytecodeIndex,
+        mustHandleValues, ToFTLForOSREntryDeferredCompilationCallback::create(triggerAddress));
+
+    if (jitCode->neverExecutedEntry)
+        triggerFTLReplacementCompile(vm, codeBlock, jitCode);
+
+    if (forEntryResult != CompilationSuccessful) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("OSR ecompilation not successful"));
+        jitCode->setOptimizationThresholdBasedOnCompilationResult(
+            codeBlock, CompilationDeferred);
+        return nullptr;
+    }
+    
+    CODEBLOCK_LOG_EVENT(jitCode->osrEntryBlock(), "osrEntry", ("at bc#", originBytecodeIndex));
+    // It's possible that the for-entry compile already succeeded. In that case OSR
+    // entry will succeed unless we ran out of stack. It's not clear what we should do.
+    // We signal to try again after a while if that happens.
+    void* address = FTL::prepareOSREntry(
+        exec, codeBlock, jitCode->osrEntryBlock(), originBytecodeIndex, streamIndex);
+    return static_cast<char*>(address);
+}
+
+void JIT_OPERATION triggerTierUpNowInLoop(ExecState* exec, unsigned bytecodeIndex)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    DeferGCForAWhile deferGC(vm->heap);
+    CodeBlock* codeBlock = exec->codeBlock();
+
+    if (codeBlock->jitType() != JITCode::DFGJIT) {
+        dataLog("Unexpected code block in DFG->FTL tier-up: ", *codeBlock, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    JITCode* jitCode = codeBlock->jitCode()->dfg();
+
+    if (Options::verboseOSR()) {
+        dataLog(
+            *codeBlock, ": Entered triggerTierUpNowInLoop with executeCounter = ",
+            jitCode->tierUpCounter, "\n");
+    }
+
+    auto tierUpHierarchyEntry = jitCode->tierUpInLoopHierarchy.find(bytecodeIndex);
+    if (tierUpHierarchyEntry != jitCode->tierUpInLoopHierarchy.end()
+        && !tierUpHierarchyEntry->value.isEmpty()) {
+        tierUpCommon(exec, bytecodeIndex, tierUpHierarchyEntry->value.first());
+    } else if (shouldTriggerFTLCompile(codeBlock, jitCode))
+        triggerFTLReplacementCompile(vm, codeBlock, jitCode);
+
+    // Since we cannot OSR Enter here, the default "optimizeSoon()" is not useful.
+    if (codeBlock->hasOptimizedReplacement()) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayFTLCompile", ("OSR in loop failed, deferring"));
+        jitCode->setOptimizationThresholdBasedOnCompilationResult(codeBlock, CompilationDeferred);
+    }
+}
+
+char* JIT_OPERATION triggerOSREntryNow(ExecState* exec, unsigned bytecodeIndex)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    DeferGCForAWhile deferGC(vm->heap);
+    CodeBlock* codeBlock = exec->codeBlock();
+
+    if (codeBlock->jitType() != JITCode::DFGJIT) {
+        dataLog("Unexpected code block in DFG->FTL tier-up: ", *codeBlock, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    JITCode* jitCode = codeBlock->jitCode()->dfg();
+    jitCode->tierUpEntrySeen.add(bytecodeIndex);
+
+    if (Options::verboseOSR()) {
+        dataLog(
+            *codeBlock, ": Entered triggerOSREntryNow with executeCounter = ",
+            jitCode->tierUpCounter, "\n");
+    }
+
+    return tierUpCommon(exec, bytecodeIndex, bytecodeIndex);
+}
+
+#endif // ENABLE(FTL_JIT)
+
+} // extern "C"
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // ENABLE(JIT)
diff --git a/dfg/DFGOperations.h b/dfg/DFGOperations.h
new file mode 100644
index 0000000..0404c41
--- /dev/null
+++ b/dfg/DFGOperations.h
@@ -0,0 +1,288 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "JITOperations.h"
+#include "PutKind.h"
+
+namespace JSC { namespace DFG {
+
+struct OSRExitBase;
+
+extern "C" {
+
+JSCell* JIT_OPERATION operationStringFromCharCode(ExecState*, int32_t)  WTF_INTERNAL; 
+EncodedJSValue JIT_OPERATION operationStringFromCharCodeUntyped(ExecState*, EncodedJSValue)  WTF_INTERNAL;
+
+// These routines are provide callbacks out to C++ implementations of operations too complex to JIT.
+JSCell* JIT_OPERATION operationObjectConstructor(ExecState*, JSGlobalObject*, EncodedJSValue encodedTarget) WTF_INTERNAL;
+JSCell* JIT_OPERATION operationCreateThis(ExecState*, JSObject* constructor, int32_t inlineCapacity) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationToThis(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationToThisStrict(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueBitAnd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueBitOr(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueBitXor(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueBitLShift(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueBitRShift(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueBitURShift(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueAddNotNumber(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueDiv(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+double JIT_OPERATION operationArithAbs(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+int32_t JIT_OPERATION operationArithClz32(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+double JIT_OPERATION operationArithCos(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+double JIT_OPERATION operationArithTan(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+double JIT_OPERATION operationArithFRound(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+double JIT_OPERATION operationArithLog(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+double JIT_OPERATION operationArithSin(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+double JIT_OPERATION operationArithSqrt(ExecState*, EncodedJSValue encodedOp1) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArithRound(ExecState*, EncodedJSValue) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArithFloor(ExecState*, EncodedJSValue) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArithCeil(ExecState*, EncodedJSValue) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArithTrunc(ExecState*, EncodedJSValue) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByVal(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValCell(ExecState*, JSCell*, EncodedJSValue encodedProperty) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValArrayInt(ExecState*, JSArray*, int32_t) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValStringInt(ExecState*, JSString*, int32_t) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationToPrimitive(ExecState*, EncodedJSValue) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationToNumber(ExecState*, EncodedJSValue) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByIdWithThis(ExecState*, EncodedJSValue, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValWithThis(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewArray(ExecState*, Structure*, void*, size_t) WTF_INTERNAL;
+char* JIT_OPERATION operationNewArrayBuffer(ExecState*, Structure*, size_t, size_t) WTF_INTERNAL;
+char* JIT_OPERATION operationNewEmptyArray(ExecState*, Structure*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewArrayWithSize(ExecState*, Structure*, int32_t, Butterfly*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewInt8ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewInt8ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewInt16ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewInt16ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewInt32ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewInt32ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewUint8ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewUint8ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewUint8ClampedArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewUint8ClampedArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewUint16ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewUint16ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewUint32ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewUint32ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewFloat32ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewFloat32ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+char* JIT_OPERATION operationNewFloat64ArrayWithSize(ExecState*, Structure*, int32_t, char*) WTF_INTERNAL;
+char* JIT_OPERATION operationNewFloat64ArrayWithOneArgument(ExecState*, Structure*, EncodedJSValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValNonStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValCellStrict(ExecState*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValCellNonStrict(ExecState*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValBeyondArrayBoundsStrict(ExecState*, JSObject*, int32_t index, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValBeyondArrayBoundsNonStrict(ExecState*, JSObject*, int32_t index, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValDirectBeyondArrayBoundsNonStrict(ExecState*, JSObject*, int32_t index, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValDirectStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValDirectNonStrict(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValDirectCellStrict(ExecState*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValDirectCellNonStrict(ExecState*, JSCell*, EncodedJSValue encodedProperty, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValDirectBeyondArrayBoundsStrict(ExecState*, JSObject*, int32_t index, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValDirectBeyondArrayBoundsNonStrict(ExecState*, JSObject*, int32_t index, EncodedJSValue encodedValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutDoubleByValBeyondArrayBoundsStrict(ExecState*, JSObject*, int32_t index, double value) WTF_INTERNAL;
+void JIT_OPERATION operationPutDoubleByValBeyondArrayBoundsNonStrict(ExecState*, JSObject*, int32_t index, double value) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdWithThis(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdWithThisStrict(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValWithThis(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValWithThisStrict(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+void JIT_OPERATION operationDefineDataProperty(ExecState*, JSObject*, EncodedJSValue, EncodedJSValue, int32_t) WTF_INTERNAL;
+void JIT_OPERATION operationDefineDataPropertyString(ExecState*, JSObject*, JSString*, EncodedJSValue, int32_t) WTF_INTERNAL;
+void JIT_OPERATION operationDefineDataPropertyStringIdent(ExecState*, JSObject*, UniquedStringImpl*, EncodedJSValue, int32_t) WTF_INTERNAL;
+void JIT_OPERATION operationDefineDataPropertySymbol(ExecState*, JSObject*, Symbol*, EncodedJSValue, int32_t) WTF_INTERNAL;
+void JIT_OPERATION operationDefineAccessorProperty(ExecState*, JSObject*, EncodedJSValue, JSObject*, JSObject*, int32_t) WTF_INTERNAL;
+void JIT_OPERATION operationDefineAccessorPropertyString(ExecState*, JSObject*, JSString*, JSObject*, JSObject*, int32_t) WTF_INTERNAL;
+void JIT_OPERATION operationDefineAccessorPropertyStringIdent(ExecState*, JSObject*, UniquedStringImpl*, JSObject*, JSObject*, int32_t) WTF_INTERNAL;
+void JIT_OPERATION operationDefineAccessorPropertySymbol(ExecState*, JSObject*, Symbol*, JSObject*, JSObject*, int32_t) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArrayPush(ExecState*, EncodedJSValue encodedValue, JSArray*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArrayPushDouble(ExecState*, double value, JSArray*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArrayPop(ExecState*, JSArray*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArrayPopAndRecoverLength(ExecState*, JSArray*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationRegExpExecString(ExecState*, JSGlobalObject*, RegExpObject*, JSString*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationRegExpExec(ExecState*, JSGlobalObject*, RegExpObject*, EncodedJSValue) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationRegExpExecGeneric(ExecState*, JSGlobalObject*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+// These comparisons return a boolean within a size_t such that the value is zero extended to fill the register.
+size_t JIT_OPERATION operationRegExpTestString(ExecState*, JSGlobalObject*, RegExpObject*, JSString*) WTF_INTERNAL;
+size_t JIT_OPERATION operationRegExpTest(ExecState*, JSGlobalObject*, RegExpObject*, EncodedJSValue) WTF_INTERNAL;
+size_t JIT_OPERATION operationRegExpTestGeneric(ExecState*, JSGlobalObject*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+size_t JIT_OPERATION operationCompareStrictEqCell(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+size_t JIT_OPERATION operationCompareStrictEq(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+JSCell* JIT_OPERATION operationCreateActivationDirect(ExecState*, Structure*, JSScope*, SymbolTable*, EncodedJSValue);
+JSCell* JIT_OPERATION operationCreateDirectArguments(ExecState*, Structure*, int32_t length, int32_t minCapacity);
+JSCell* JIT_OPERATION operationCreateDirectArgumentsDuringExit(ExecState*, InlineCallFrame*, JSFunction*, int32_t argumentCount);
+JSCell* JIT_OPERATION operationCreateScopedArguments(ExecState*, Structure*, Register* argumentStart, int32_t length, JSFunction* callee, JSLexicalEnvironment*);
+JSCell* JIT_OPERATION operationCreateClonedArgumentsDuringExit(ExecState*, InlineCallFrame*, JSFunction*, int32_t argumentCount);
+JSCell* JIT_OPERATION operationCreateClonedArguments(ExecState*, Structure*, Register* argumentStart, int32_t length, JSFunction* callee);
+JSCell* JIT_OPERATION operationCreateRest(ExecState*, Register* argumentStart, unsigned numberOfArgumentsToSkip, unsigned arraySize);
+double JIT_OPERATION operationFModOnInts(int32_t, int32_t) WTF_INTERNAL;
+size_t JIT_OPERATION operationObjectIsObject(ExecState*, JSGlobalObject*, JSCell*) WTF_INTERNAL;
+size_t JIT_OPERATION operationObjectIsFunction(ExecState*, JSGlobalObject*, JSCell*) WTF_INTERNAL;
+JSCell* JIT_OPERATION operationTypeOfObject(ExecState*, JSGlobalObject*, JSCell*) WTF_INTERNAL;
+int32_t JIT_OPERATION operationTypeOfObjectAsTypeofType(ExecState*, JSGlobalObject*, JSCell*) WTF_INTERNAL;
+char* JIT_OPERATION operationAllocateSimplePropertyStorageWithInitialCapacity(ExecState*) WTF_INTERNAL;
+char* JIT_OPERATION operationAllocateSimplePropertyStorage(ExecState*, size_t newSize) WTF_INTERNAL;
+char* JIT_OPERATION operationAllocateComplexPropertyStorageWithInitialCapacity(ExecState*, JSObject*) WTF_INTERNAL;
+char* JIT_OPERATION operationAllocateComplexPropertyStorage(ExecState*, JSObject*, size_t newSize) WTF_INTERNAL;
+char* JIT_OPERATION operationEnsureInt32(ExecState*, JSCell*);
+char* JIT_OPERATION operationEnsureDouble(ExecState*, JSCell*);
+char* JIT_OPERATION operationEnsureContiguous(ExecState*, JSCell*);
+char* JIT_OPERATION operationEnsureArrayStorage(ExecState*, JSCell*);
+StringImpl* JIT_OPERATION operationResolveRope(ExecState*, JSString*);
+JSString* JIT_OPERATION operationSingleCharacterString(ExecState*, int32_t);
+
+JSString* JIT_OPERATION operationToLowerCase(ExecState*, JSString*, uint32_t);
+
+int32_t JIT_OPERATION operationMapHash(ExecState*, EncodedJSValue input);
+JSCell* JIT_OPERATION operationJSMapFindBucket(ExecState*, JSCell*, EncodedJSValue, int32_t);
+JSCell* JIT_OPERATION operationJSSetFindBucket(ExecState*, JSCell*, EncodedJSValue, int32_t);
+
+JSCell* JIT_OPERATION operationNewStringObject(ExecState*, JSString*, Structure*);
+JSCell* JIT_OPERATION operationToStringOnCell(ExecState*, JSCell*);
+JSCell* JIT_OPERATION operationToString(ExecState*, EncodedJSValue);
+JSCell* JIT_OPERATION operationCallStringConstructorOnCell(ExecState*, JSCell*);
+JSCell* JIT_OPERATION operationCallStringConstructor(ExecState*, EncodedJSValue);
+JSCell* JIT_OPERATION operationMakeRope2(ExecState*, JSString*, JSString*);
+JSCell* JIT_OPERATION operationMakeRope3(ExecState*, JSString*, JSString*, JSString*);
+JSCell* JIT_OPERATION operationStrCat2(ExecState*, EncodedJSValue, EncodedJSValue);
+JSCell* JIT_OPERATION operationStrCat3(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+char* JIT_OPERATION operationFindSwitchImmTargetForDouble(ExecState*, EncodedJSValue, size_t tableIndex);
+char* JIT_OPERATION operationSwitchString(ExecState*, size_t tableIndex, JSString*);
+int32_t JIT_OPERATION operationSwitchStringAndGetBranchOffset(ExecState*, size_t tableIndex, JSString*);
+uintptr_t JIT_OPERATION operationCompareStringImplLess(StringImpl*, StringImpl*);
+uintptr_t JIT_OPERATION operationCompareStringImplLessEq(StringImpl*, StringImpl*);
+uintptr_t JIT_OPERATION operationCompareStringImplGreater(StringImpl*, StringImpl*);
+uintptr_t JIT_OPERATION operationCompareStringImplGreaterEq(StringImpl*, StringImpl*);
+uintptr_t JIT_OPERATION operationCompareStringLess(ExecState*, JSString*, JSString*);
+uintptr_t JIT_OPERATION operationCompareStringLessEq(ExecState*, JSString*, JSString*);
+uintptr_t JIT_OPERATION operationCompareStringGreater(ExecState*, JSString*, JSString*);
+uintptr_t JIT_OPERATION operationCompareStringGreaterEq(ExecState*, JSString*, JSString*);
+void JIT_OPERATION operationNotifyWrite(ExecState*, WatchpointSet*);
+void JIT_OPERATION operationThrowStackOverflowForVarargs(ExecState*) WTF_INTERNAL;
+int32_t JIT_OPERATION operationSizeOfVarargs(ExecState*, EncodedJSValue arguments, int32_t firstVarArgOffset);
+void JIT_OPERATION operationLoadVarargs(ExecState*, int32_t firstElementDest, EncodedJSValue arguments, int32_t offset, int32_t length, int32_t mandatoryMinimum);
+
+int32_t JIT_OPERATION operationHasOwnProperty(ExecState*, JSObject*, EncodedJSValue);
+
+JSCell* JIT_OPERATION operationSpreadFastArray(ExecState*, JSCell*);
+JSCell* JIT_OPERATION operationSpreadGeneric(ExecState*, JSCell*);
+JSCell* JIT_OPERATION operationNewArrayWithSpreadSlow(ExecState*, void*, uint32_t);
+
+JSCell* JIT_OPERATION operationResolveScope(ExecState*, JSScope*, UniquedStringImpl*);
+EncodedJSValue JIT_OPERATION operationGetDynamicVar(ExecState*, JSObject* scope, UniquedStringImpl*, unsigned);
+void JIT_OPERATION operationPutDynamicVar(ExecState*, JSObject* scope, EncodedJSValue, UniquedStringImpl*, unsigned);
+
+int64_t JIT_OPERATION operationConvertBoxedDoubleToInt52(EncodedJSValue);
+int64_t JIT_OPERATION operationConvertDoubleToInt52(double);
+
+size_t JIT_OPERATION operationDefaultHasInstance(ExecState*, JSCell* value, JSCell* proto);
+
+char* JIT_OPERATION operationNewRawObject(ExecState*, Structure*, int32_t, Butterfly*) WTF_INTERNAL;
+JSCell* JIT_OPERATION operationNewObjectWithButterfly(ExecState*, Structure*, Butterfly*) WTF_INTERNAL;
+JSCell* JIT_OPERATION operationNewObjectWithButterflyWithIndexingHeaderAndVectorLength(ExecState*, Structure*, unsigned length, Butterfly*) WTF_INTERNAL;
+
+void JIT_OPERATION operationProcessTypeProfilerLogDFG(ExecState*) WTF_INTERNAL;
+
+void JIT_OPERATION debugOperationPrintSpeculationFailure(ExecState*, void*, void*) WTF_INTERNAL;
+
+void JIT_OPERATION triggerReoptimizationNow(CodeBlock*, OSRExitBase*) WTF_INTERNAL;
+
+#if USE(JSVALUE32_64)
+double JIT_OPERATION operationRandom(JSGlobalObject*);
+#endif
+
+#if ENABLE(FTL_JIT)
+void JIT_OPERATION triggerTierUpNow(ExecState*) WTF_INTERNAL;
+void JIT_OPERATION triggerTierUpNowInLoop(ExecState*, unsigned bytecodeIndex) WTF_INTERNAL;
+char* JIT_OPERATION triggerOSREntryNow(ExecState*, unsigned bytecodeIndex) WTF_INTERNAL;
+#endif // ENABLE(FTL_JIT)
+
+} // extern "C"
+
+inline P_JITOperation_EStZP operationNewTypedArrayWithSizeForType(TypedArrayType type)
+{
+    switch (type) {
+    case TypeInt8:
+        return operationNewInt8ArrayWithSize;
+    case TypeInt16:
+        return operationNewInt16ArrayWithSize;
+    case TypeInt32:
+        return operationNewInt32ArrayWithSize;
+    case TypeUint8:
+        return operationNewUint8ArrayWithSize;
+    case TypeUint8Clamped:
+        return operationNewUint8ClampedArrayWithSize;
+    case TypeUint16:
+        return operationNewUint16ArrayWithSize;
+    case TypeUint32:
+        return operationNewUint32ArrayWithSize;
+    case TypeFloat32:
+        return operationNewFloat32ArrayWithSize;
+    case TypeFloat64:
+        return operationNewFloat64ArrayWithSize;
+    case NotTypedArray:
+    case TypeDataView:
+        break;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+inline P_JITOperation_EStJ operationNewTypedArrayWithOneArgumentForType(TypedArrayType type)
+{
+    switch (type) {
+    case TypeInt8:
+        return operationNewInt8ArrayWithOneArgument;
+    case TypeInt16:
+        return operationNewInt16ArrayWithOneArgument;
+    case TypeInt32:
+        return operationNewInt32ArrayWithOneArgument;
+    case TypeUint8:
+        return operationNewUint8ArrayWithOneArgument;
+    case TypeUint8Clamped:
+        return operationNewUint8ClampedArrayWithOneArgument;
+    case TypeUint16:
+        return operationNewUint16ArrayWithOneArgument;
+    case TypeUint32:
+        return operationNewUint32ArrayWithOneArgument;
+    case TypeFloat32:
+        return operationNewFloat32ArrayWithOneArgument;
+    case TypeFloat64:
+        return operationNewFloat64ArrayWithOneArgument;
+    case NotTypedArray:
+    case TypeDataView:
+        break;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGPhantomInsertionPhase.cpp b/dfg/DFGPhantomInsertionPhase.cpp
new file mode 100644
index 0000000..dcc1c97
--- /dev/null
+++ b/dfg/DFGPhantomInsertionPhase.cpp
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPhantomInsertionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "BytecodeLivenessAnalysisInlines.h"
+#include "DFGForAllKills.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGMayExit.h"
+#include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+#include "OperandsInlines.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verbose = false;
+
+class PhantomInsertionPhase : public Phase {
+public:
+    PhantomInsertionPhase(Graph& graph)
+        : Phase(graph, "phantom insertion")
+        , m_insertionSet(graph)
+        , m_values(OperandsLike, graph.block(0)->variablesAtHead)
+    {
+    }
+    
+    bool run()
+    {
+        // We assume that DCE has already run. If we run before DCE then we think that all
+        // SetLocals execute, which is inaccurate. That causes us to insert too few Phantoms.
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_refCountState == ExactRefCount);
+        
+        if (verbose) {
+            dataLog("Graph before Phantom insertion:\n");
+            m_graph.dump();
+        }
+        
+        m_graph.clearEpochs();
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder())
+            handleBlock(block);
+        
+        if (verbose) {
+            dataLog("Graph after Phantom insertion:\n");
+            m_graph.dump();
+        }
+        
+        return true;
+    }
+
+private:
+    void handleBlock(BasicBlock* block)
+    {
+        // FIXME: For blocks that have low register pressure, it would make the most sense to
+        // simply insert Phantoms at the last point possible since that would obviate the need to
+        // query bytecode liveness:
+        //
+        // - If we MovHint @x into loc42 then put a Phantom on the last MovHinted value in loc42.
+        // - At the end of the block put Phantoms for each MovHinted value.
+        //
+        // This will definitely not work if there are any phantom allocations. For those blocks
+        // where this would be legal, it remains to be seen how profitable it would be even if there
+        // was high register pressure. After all, a Phantom would cause a spill but it wouldn't
+        // cause a fill.
+        //
+        // https://bugs.webkit.org/show_bug.cgi?id=144524
+        
+        m_values.fill(nullptr);
+
+        Epoch currentEpoch = Epoch::first();
+        unsigned lastExitingIndex = 0;
+        for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            if (verbose)
+                dataLog("Considering ", node, "\n");
+            
+            switch (node->op()) {
+            case MovHint:
+                m_values.operand(node->unlinkedLocal()) = node->child1().node();
+                break;
+                
+            case ZombieHint:
+                m_values.operand(node->unlinkedLocal()) = nullptr;
+                break;
+
+            case GetLocal:
+            case SetArgument:
+                m_values.operand(node->local()) = nullptr;
+                break;
+                
+            default:
+                break;
+            }
+
+            bool nodeMayExit = mayExit(m_graph, node) != DoesNotExit;
+            if (nodeMayExit) {
+                currentEpoch.bump();
+                lastExitingIndex = nodeIndex;
+            }
+            
+            m_graph.doToChildren(
+                node,
+                [&] (Edge edge) {
+                    edge->setEpoch(currentEpoch);
+                });
+            
+            node->setEpoch(currentEpoch);
+
+            VirtualRegister alreadyKilled;
+
+            auto processKilledOperand = [&] (VirtualRegister reg) {
+                if (verbose)
+                    dataLog("    Killed operand: ", reg, "\n");
+
+                // Already handled from SetLocal.
+                if (reg == alreadyKilled)
+                    return;
+                
+                Node* killedNode = m_values.operand(reg);
+                if (!killedNode)
+                    return;
+                
+                // We only need to insert a Phantom if the node hasn't been used since the last
+                // exit, and was born before the last exit.
+                if (killedNode->epoch() == currentEpoch)
+                    return;
+                
+                if (verbose) {
+                    dataLog(
+                        "    Inserting Phantom on ", killedNode, " after ",
+                        block->at(lastExitingIndex), "\n");
+                }
+                
+                // We have exact ref counts, so creating a new use means that we have to
+                // increment the ref count.
+                killedNode->postfixRef();
+
+                Node* lastExitingNode = block->at(lastExitingIndex);
+                
+                m_insertionSet.insertNode(
+                    lastExitingIndex + 1, SpecNone, Phantom,
+                    lastExitingNode->origin.forInsertingAfter(m_graph, lastExitingNode),
+                    killedNode->defaultEdge());
+            };
+
+            if (node->op() == SetLocal) {
+                VirtualRegister local = node->local();
+                if (nodeMayExit) {
+                    // If the SetLocal does exit, we need the MovHint of its local
+                    // to be live until the SetLocal is done.
+                    processKilledOperand(local);
+                    alreadyKilled = local;
+                }
+                m_values.operand(local) = nullptr;
+            }
+
+            forAllKilledOperands(m_graph, node, block->tryAt(nodeIndex + 1), processKilledOperand);
+        }
+        
+        m_insertionSet.execute(block);
+    }
+    
+    InsertionSet m_insertionSet;
+    Operands<Node*> m_values;
+};
+
+} // anonymous namespace
+    
+bool performPhantomInsertion(Graph& graph)
+{
+    return runPhase<PhantomInsertionPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPhantomInsertionPhase.h b/dfg/DFGPhantomInsertionPhase.h
new file mode 100644
index 0000000..0f6ba51
--- /dev/null
+++ b/dfg/DFGPhantomInsertionPhase.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Inserts Phantoms based on bytecode liveness.
+
+bool performPhantomInsertion(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPhase.cpp b/dfg/DFGPhase.cpp
new file mode 100644
index 0000000..b225531
--- /dev/null
+++ b/dfg/DFGPhase.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGValidate.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void Phase::validate()
+{
+    DFG::validate(m_graph, DumpGraph, m_graphDumpBeforePhase);
+}
+
+void Phase::beginPhase()
+{
+    if (Options::verboseValidationFailure()) {
+        StringPrintStream out;
+        m_graph.dump(out);
+        m_graphDumpBeforePhase = out.toCString();
+    }
+    
+    if (!shouldDumpGraphAtEachPhase(m_graph.m_plan.mode))
+        return;
+    
+    dataLog("Beginning DFG phase ", m_name, ".\n");
+    dataLog("Before ", m_name, ":\n");
+    m_graph.dump();
+}
+
+void Phase::endPhase()
+{
+    if (!Options::validateGraphAtEachPhase())
+        return;
+    validate();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPhase.h b/dfg/DFGPhase.h
new file mode 100644
index 0000000..0fcfc5f
--- /dev/null
+++ b/dfg/DFGPhase.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+class Phase {
+public:
+    Phase(Graph& graph, const char* name)
+        : m_graph(graph)
+        , m_name(name)
+    {
+        beginPhase();
+    }
+    
+    ~Phase()
+    {
+        endPhase();
+    }
+    
+    const char* name() const { return m_name; }
+    
+    Graph& graph() { return m_graph; }
+    
+    // Each phase must have a run() method.
+    
+protected:
+    // Things you need to have a DFG compiler phase.
+    Graph& m_graph;
+    
+    VM& vm() { return m_graph.m_vm; }
+    CodeBlock* codeBlock() { return m_graph.m_codeBlock; }
+    CodeBlock* profiledBlock() { return m_graph.m_profiledBlock; }
+
+    // This runs validation, and uses the graph dump before the phase if possible.
+    void validate();
+    
+    const char* m_name;
+    
+private:
+    // Call these hooks when starting and finishing.
+    void beginPhase();
+    void endPhase();
+    
+    CString m_graphDumpBeforePhase;
+};
+
+template<typename PhaseType>
+bool runAndLog(PhaseType& phase)
+{
+    double before = 0;
+
+    if (UNLIKELY(Options::reportDFGPhaseTimes()))
+        before = monotonicallyIncreasingTimeMS();
+
+    bool result = phase.run();
+
+    if (UNLIKELY(Options::reportDFGPhaseTimes())) {
+        double after = monotonicallyIncreasingTimeMS();
+        dataLogF("Phase %s took %.4f ms\n", phase.name(), after - before);
+    }
+    if (result && logCompilationChanges(phase.graph().m_plan.mode))
+        dataLogF("Phase %s changed the IR.\n", phase.name());
+    return result;
+}
+
+template<typename PhaseType>
+bool runPhase(Graph& graph)
+{
+    PhaseType phase(graph);
+    return runAndLog(phase);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPhiChildren.cpp b/dfg/DFGPhiChildren.cpp
new file mode 100644
index 0000000..de078d0
--- /dev/null
+++ b/dfg/DFGPhiChildren.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPhiChildren.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+PhiChildren::PhiChildren()
+{
+}
+
+PhiChildren::PhiChildren(Graph& graph)
+{
+    for (BasicBlock* block : graph.blocksInNaturalOrder()) {
+        for (Node* node : *block) {
+            if (node->op() != Upsilon)
+                continue;
+            
+            m_children.add(node->phi(), List()).iterator->value.append(node);
+        }
+    }
+}
+
+PhiChildren::~PhiChildren()
+{
+}
+
+const PhiChildren::List& PhiChildren::upsilonsOf(Node* node) const
+{
+    ASSERT(node->op() == Phi);
+    return m_children.find(node)->value;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPhiChildren.h b/dfg/DFGPhiChildren.h
new file mode 100644
index 0000000..34afe91
--- /dev/null
+++ b/dfg/DFGPhiChildren.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNode.h"
+#include <wtf/HashSet.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+class PhiChildren {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    typedef Vector<Node*, 3> List;
+    
+    PhiChildren();
+    PhiChildren(Graph&);
+    ~PhiChildren();
+    
+    // The list of Upsilons that point to the children of the Phi.
+    const List& upsilonsOf(Node*) const;
+    
+    template<typename Functor>
+    void forAllIncomingValues(Node* node, const Functor& functor)
+    {
+        for (Node* upsilon : upsilonsOf(node))
+            functor(upsilon->child1().node());
+    }
+    
+    // This walks the Phi graph.
+    template<typename Functor>
+    void forAllTransitiveIncomingValues(Node* node, const Functor& functor)
+    {
+        if (node->op() != Phi) {
+            functor(node);
+            return;
+        }
+        HashSet<Node*> seen;
+        Vector<Node*> worklist;
+        seen.add(node);
+        worklist.append(node);
+        while (!worklist.isEmpty()) {
+            Node* currentNode = worklist.takeLast();
+            forAllIncomingValues(
+                currentNode,
+                [&] (Node* incomingNode) {
+                    if (incomingNode->op() == Phi) {
+                        if (seen.add(incomingNode).isNewEntry)
+                            worklist.append(incomingNode);
+                    } else
+                        functor(incomingNode);
+                });
+        }
+    }
+    
+private:
+    HashMap<Node*, List> m_children;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPlan.cpp b/dfg/DFGPlan.cpp
new file mode 100644
index 0000000..0307dc6
--- /dev/null
+++ b/dfg/DFGPlan.cpp
@@ -0,0 +1,714 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPlan.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGArgumentsEliminationPhase.h"
+#include "DFGBackwardsPropagationPhase.h"
+#include "DFGByteCodeParser.h"
+#include "DFGCFAPhase.h"
+#include "DFGCFGSimplificationPhase.h"
+#include "DFGCPSRethreadingPhase.h"
+#include "DFGCSEPhase.h"
+#include "DFGCleanUpPhase.h"
+#include "DFGConstantFoldingPhase.h"
+#include "DFGConstantHoistingPhase.h"
+#include "DFGCriticalEdgeBreakingPhase.h"
+#include "DFGDCEPhase.h"
+#include "DFGFailedFinalizer.h"
+#include "DFGFixupPhase.h"
+#include "DFGGraphSafepoint.h"
+#include "DFGIntegerCheckCombiningPhase.h"
+#include "DFGIntegerRangeOptimizationPhase.h"
+#include "DFGInvalidationPointInjectionPhase.h"
+#include "DFGJITCompiler.h"
+#include "DFGLICMPhase.h"
+#include "DFGLiveCatchVariablePreservationPhase.h"
+#include "DFGLivenessAnalysisPhase.h"
+#include "DFGLoopPreHeaderCreationPhase.h"
+#include "DFGMaximalFlushInsertionPhase.h"
+#include "DFGMovHintRemovalPhase.h"
+#include "DFGOSRAvailabilityAnalysisPhase.h"
+#include "DFGOSREntrypointCreationPhase.h"
+#include "DFGObjectAllocationSinkingPhase.h"
+#include "DFGPhantomInsertionPhase.h"
+#include "DFGPredictionInjectionPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGPutStackSinkingPhase.h"
+#include "DFGSSAConversionPhase.h"
+#include "DFGSSALoweringPhase.h"
+#include "DFGStackLayoutPhase.h"
+#include "DFGStaticExecutionCountEstimationPhase.h"
+#include "DFGStoreBarrierClusteringPhase.h"
+#include "DFGStoreBarrierInsertionPhase.h"
+#include "DFGStrengthReductionPhase.h"
+#include "DFGTierUpCheckInjectionPhase.h"
+#include "DFGTypeCheckHoistingPhase.h"
+#include "DFGUnificationPhase.h"
+#include "DFGValidate.h"
+#include "DFGVarargsForwardingPhase.h"
+#include "DFGVirtualRegisterAllocationPhase.h"
+#include "DFGWatchpointCollectionPhase.h"
+#include "JSCInlines.h"
+#include "OperandsInlines.h"
+#include "ProfilerDatabase.h"
+#include "TrackedReferences.h"
+#include "VMInlines.h"
+#include <wtf/CurrentTime.h>
+
+#if ENABLE(FTL_JIT)
+#include "FTLCapabilities.h"
+#include "FTLCompile.h"
+#include "FTLFail.h"
+#include "FTLLink.h"
+#include "FTLLowerDFGToB3.h"
+#include "FTLState.h"
+#endif
+
+namespace JSC {
+
+extern double totalDFGCompileTime;
+extern double totalFTLCompileTime;
+extern double totalFTLDFGCompileTime;
+extern double totalFTLB3CompileTime;
+
+}
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+void dumpAndVerifyGraph(Graph& graph, const char* text, bool forceDump = false)
+{
+    GraphDumpMode modeForFinalValidate = DumpGraph;
+    if (verboseCompilationEnabled(graph.m_plan.mode) || forceDump) {
+        dataLog(text, "\n");
+        graph.dump();
+        modeForFinalValidate = DontDumpGraph;
+    }
+    if (validationEnabled())
+        validate(graph, modeForFinalValidate);
+}
+
+Profiler::CompilationKind profilerCompilationKindForMode(CompilationMode mode)
+{
+    switch (mode) {
+    case InvalidCompilationMode:
+        RELEASE_ASSERT_NOT_REACHED();
+        return Profiler::DFG;
+    case DFGMode:
+        return Profiler::DFG;
+    case FTLMode:
+        return Profiler::FTL;
+    case FTLForOSREntryMode:
+        return Profiler::FTLForOSREntry;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return Profiler::DFG;
+}
+
+} // anonymous namespace
+
+Plan::Plan(CodeBlock* passedCodeBlock, CodeBlock* profiledDFGCodeBlock,
+    CompilationMode mode, unsigned osrEntryBytecodeIndex,
+    const Operands<JSValue>& mustHandleValues)
+    : vm(passedCodeBlock->vm())
+    , codeBlock(passedCodeBlock)
+    , profiledDFGCodeBlock(profiledDFGCodeBlock)
+    , mode(mode)
+    , osrEntryBytecodeIndex(osrEntryBytecodeIndex)
+    , mustHandleValues(mustHandleValues)
+    , compilation(vm->m_perBytecodeProfiler ? adoptRef(new Profiler::Compilation(vm->m_perBytecodeProfiler->ensureBytecodesFor(codeBlock), profilerCompilationKindForMode(mode))) : 0)
+    , inlineCallFrames(adoptRef(new InlineCallFrameSet()))
+    , identifiers(codeBlock)
+    , weakReferences(codeBlock)
+    , stage(Preparing)
+{
+}
+
+Plan::~Plan()
+{
+}
+
+bool Plan::computeCompileTimes() const
+{
+    return reportCompileTimes()
+        || Options::reportTotalCompileTimes()
+        || (vm && vm->m_perBytecodeProfiler);
+}
+
+bool Plan::reportCompileTimes() const
+{
+    return Options::reportCompileTimes()
+        || Options::reportDFGCompileTimes()
+        || (Options::reportFTLCompileTimes() && isFTL(mode));
+}
+
+void Plan::compileInThread(LongLivedState& longLivedState, ThreadData* threadData)
+{
+    this->threadData = threadData;
+    
+    double before = 0;
+    CString codeBlockName;
+    if (UNLIKELY(computeCompileTimes()))
+        before = monotonicallyIncreasingTimeMS();
+    if (UNLIKELY(reportCompileTimes()))
+        codeBlockName = toCString(*codeBlock);
+    
+    CompilationScope compilationScope;
+
+    if (logCompilationChanges(mode) || Options::reportDFGPhaseTimes())
+        dataLog("DFG(Plan) compiling ", *codeBlock, " with ", mode, ", number of instructions = ", codeBlock->instructionCount(), "\n");
+
+    CompilationPath path = compileInThreadImpl(longLivedState);
+
+    RELEASE_ASSERT(path == CancelPath || finalizer);
+    RELEASE_ASSERT((path == CancelPath) == (stage == Cancelled));
+    
+    double after = 0;
+    if (UNLIKELY(computeCompileTimes())) {
+        after = monotonicallyIncreasingTimeMS();
+    
+        if (Options::reportTotalCompileTimes()) {
+            if (isFTL(mode)) {
+                totalFTLCompileTime += after - before;
+                totalFTLDFGCompileTime += m_timeBeforeFTL - before;
+                totalFTLB3CompileTime += after - m_timeBeforeFTL;
+            } else
+                totalDFGCompileTime += after - before;
+        }
+    }
+    const char* pathName = nullptr;
+    switch (path) {
+    case FailPath:
+        pathName = "N/A (fail)";
+        break;
+    case DFGPath:
+        pathName = "DFG";
+        break;
+    case FTLPath:
+        pathName = "FTL";
+        break;
+    case CancelPath:
+        pathName = "Cancelled";
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    if (codeBlock) { // codeBlock will be null if the compilation was cancelled.
+        if (path == FTLPath)
+            CODEBLOCK_LOG_EVENT(codeBlock, "ftlCompile", ("took ", after - before, " ms (DFG: ", m_timeBeforeFTL - before, ", B3: ", after - m_timeBeforeFTL, ") with ", pathName));
+        else
+            CODEBLOCK_LOG_EVENT(codeBlock, "dfgCompile", ("took ", after - before, " ms with ", pathName));
+    }
+    if (UNLIKELY(reportCompileTimes())) {
+        dataLog("Optimized ", codeBlockName, " using ", mode, " with ", pathName, " into ", finalizer ? finalizer->codeSize() : 0, " bytes in ", after - before, " ms");
+        if (path == FTLPath)
+            dataLog(" (DFG: ", m_timeBeforeFTL - before, ", B3: ", after - m_timeBeforeFTL, ")");
+        dataLog(".\n");
+    }
+}
+
+Plan::CompilationPath Plan::compileInThreadImpl(LongLivedState& longLivedState)
+{
+    cleanMustHandleValuesIfNecessary();
+    
+    if (verboseCompilationEnabled(mode) && osrEntryBytecodeIndex != UINT_MAX) {
+        dataLog("\n");
+        dataLog("Compiler must handle OSR entry from bc#", osrEntryBytecodeIndex, " with values: ", mustHandleValues, "\n");
+        dataLog("\n");
+    }
+    
+    Graph dfg(*vm, *this, longLivedState);
+    
+    if (!parse(dfg)) {
+        finalizer = std::make_unique<FailedFinalizer>(*this);
+        return FailPath;
+    }
+
+    codeBlock->setCalleeSaveRegisters(RegisterSet::dfgCalleeSaveRegisters());
+
+    bool changed = false;
+
+#define RUN_PHASE(phase)                                         \
+    do {                                                         \
+        if (Options::safepointBeforeEachPhase()) {               \
+            Safepoint::Result safepointResult;                   \
+            {                                                    \
+                GraphSafepoint safepoint(dfg, safepointResult);  \
+            }                                                    \
+            if (safepointResult.didGetCancelled())               \
+                return CancelPath;                               \
+        }                                                        \
+        changed |= phase(dfg);                                   \
+    } while (false);                                             \
+
+    
+    // By this point the DFG bytecode parser will have potentially mutated various tables
+    // in the CodeBlock. This is a good time to perform an early shrink, which is more
+    // powerful than a late one. It's safe to do so because we haven't generated any code
+    // that references any of the tables directly, yet.
+    codeBlock->shrinkToFit(CodeBlock::EarlyShrink);
+
+    if (validationEnabled())
+        validate(dfg);
+    
+    if (Options::dumpGraphAfterParsing()) {
+        dataLog("Graph after parsing:\n");
+        dfg.dump();
+    }
+
+    RUN_PHASE(performLiveCatchVariablePreservationPhase);
+
+    if (Options::useMaximalFlushInsertionPhase())
+        RUN_PHASE(performMaximalFlushInsertion);
+    
+    RUN_PHASE(performCPSRethreading);
+    RUN_PHASE(performUnification);
+    RUN_PHASE(performPredictionInjection);
+    
+    RUN_PHASE(performStaticExecutionCountEstimation);
+    
+    if (mode == FTLForOSREntryMode) {
+        bool result = performOSREntrypointCreation(dfg);
+        if (!result) {
+            finalizer = std::make_unique<FailedFinalizer>(*this);
+            return FailPath;
+        }
+        RUN_PHASE(performCPSRethreading);
+    }
+    
+    if (validationEnabled())
+        validate(dfg);
+    
+    RUN_PHASE(performBackwardsPropagation);
+    RUN_PHASE(performPredictionPropagation);
+    RUN_PHASE(performFixup);
+    RUN_PHASE(performInvalidationPointInjection);
+    RUN_PHASE(performTypeCheckHoisting);
+    
+    dfg.m_fixpointState = FixpointNotConverged;
+    
+    // For now we're back to avoiding a fixpoint. Note that we've ping-ponged on this decision
+    // many times. For maximum throughput, it's best to fixpoint. But the throughput benefit is
+    // small and not likely to show up in FTL anyway. On the other hand, not fixpointing means
+    // that the compiler compiles more quickly. We want the third tier to compile quickly, which
+    // not fixpointing accomplishes; and the fourth tier shouldn't need a fixpoint.
+    if (validationEnabled())
+        validate(dfg);
+        
+    RUN_PHASE(performStrengthReduction);
+    RUN_PHASE(performCPSRethreading);
+    RUN_PHASE(performCFA);
+    RUN_PHASE(performConstantFolding);
+    changed = false;
+    RUN_PHASE(performCFGSimplification);
+    RUN_PHASE(performLocalCSE);
+    
+    if (validationEnabled())
+        validate(dfg);
+    
+    RUN_PHASE(performCPSRethreading);
+    if (!isFTL(mode)) {
+        // Only run this if we're not FTLing, because currently for a LoadVarargs that is forwardable and
+        // in a non-varargs inlined call frame, this will generate ForwardVarargs while the FTL
+        // ArgumentsEliminationPhase will create a sequence of GetStack+PutStacks. The GetStack+PutStack
+        // sequence then gets sunk, eliminating anything that looks like an escape for subsequent phases,
+        // while the ForwardVarargs doesn't get simplified until later (or not at all) and looks like an
+        // escape for all of the arguments. This then disables object allocation sinking.
+        //
+        // So, for now, we just disable this phase for the FTL.
+        //
+        // If we wanted to enable it, we'd have to do any of the following:
+        // - Enable ForwardVarargs->GetStack+PutStack strength reduction, and have that run before
+        //   PutStack sinking and object allocation sinking.
+        // - Make VarargsForwarding emit a GetLocal+SetLocal sequence, that we can later turn into
+        //   GetStack+PutStack.
+        //
+        // But, it's not super valuable to enable those optimizations, since the FTL
+        // ArgumentsEliminationPhase does everything that this phase does, and it doesn't introduce this
+        // pathology.
+        
+        RUN_PHASE(performVarargsForwarding); // Do this after CFG simplification and CPS rethreading.
+    }
+    if (changed) {
+        RUN_PHASE(performCFA);
+        RUN_PHASE(performConstantFolding);
+    }
+    
+    // If we're doing validation, then run some analyses, to give them an opportunity
+    // to self-validate. Now is as good a time as any to do this.
+    if (validationEnabled()) {
+        dfg.ensureDominators();
+        dfg.ensureNaturalLoops();
+        dfg.ensurePrePostNumbering();
+    }
+
+    switch (mode) {
+    case DFGMode: {
+        dfg.m_fixpointState = FixpointConverged;
+    
+        RUN_PHASE(performTierUpCheckInjection);
+
+        RUN_PHASE(performFastStoreBarrierInsertion);
+        RUN_PHASE(performStoreBarrierClustering);
+        RUN_PHASE(performCleanUp);
+        RUN_PHASE(performCPSRethreading);
+        RUN_PHASE(performDCE);
+        RUN_PHASE(performPhantomInsertion);
+        RUN_PHASE(performStackLayout);
+        RUN_PHASE(performVirtualRegisterAllocation);
+        RUN_PHASE(performWatchpointCollection);
+        dumpAndVerifyGraph(dfg, "Graph after optimization:");
+        
+        JITCompiler dataFlowJIT(dfg);
+        if (codeBlock->codeType() == FunctionCode)
+            dataFlowJIT.compileFunction();
+        else
+            dataFlowJIT.compile();
+        
+        return DFGPath;
+    }
+    
+    case FTLMode:
+    case FTLForOSREntryMode: {
+#if ENABLE(FTL_JIT)
+        if (FTL::canCompile(dfg) == FTL::CannotCompile) {
+            finalizer = std::make_unique<FailedFinalizer>(*this);
+            return FailPath;
+        }
+        
+        RUN_PHASE(performCleanUp); // Reduce the graph size a bit.
+        RUN_PHASE(performCriticalEdgeBreaking);
+        if (Options::createPreHeaders())
+            RUN_PHASE(performLoopPreHeaderCreation);
+        RUN_PHASE(performCPSRethreading);
+        RUN_PHASE(performSSAConversion);
+        RUN_PHASE(performSSALowering);
+        
+        // Ideally, these would be run to fixpoint with the object allocation sinking phase.
+        RUN_PHASE(performArgumentsElimination);
+        if (Options::usePutStackSinking())
+            RUN_PHASE(performPutStackSinking);
+        
+        RUN_PHASE(performConstantHoisting);
+        RUN_PHASE(performGlobalCSE);
+        RUN_PHASE(performLivenessAnalysis);
+        RUN_PHASE(performCFA);
+        RUN_PHASE(performConstantFolding);
+        RUN_PHASE(performCleanUp); // Reduce the graph size a lot.
+        changed = false;
+        RUN_PHASE(performStrengthReduction);
+        if (Options::useObjectAllocationSinking()) {
+            RUN_PHASE(performCriticalEdgeBreaking);
+            RUN_PHASE(performObjectAllocationSinking);
+        }
+        if (changed) {
+            // State-at-tail and state-at-head will be invalid if we did strength reduction since
+            // it might increase live ranges.
+            RUN_PHASE(performLivenessAnalysis);
+            RUN_PHASE(performCFA);
+            RUN_PHASE(performConstantFolding);
+        }
+        
+        // Currently, this relies on pre-headers still being valid. That precludes running CFG
+        // simplification before it, unless we re-created the pre-headers. There wouldn't be anything
+        // wrong with running LICM earlier, if we wanted to put other CFG transforms above this point.
+        // Alternatively, we could run loop pre-header creation after SSA conversion - but if we did that
+        // then we'd need to do some simple SSA fix-up.
+        RUN_PHASE(performLivenessAnalysis);
+        RUN_PHASE(performCFA);
+        RUN_PHASE(performLICM);
+
+        // FIXME: Currently: IntegerRangeOptimization *must* be run after LICM.
+        //
+        // IntegerRangeOptimization makes changes on nodes based on preceding blocks
+        // and nodes. LICM moves nodes which can invalidates assumptions used
+        // by IntegerRangeOptimization.
+        //
+        // Ideally, the dependencies should be explicit. See https://bugs.webkit.org/show_bug.cgi?id=157534.
+        RUN_PHASE(performLivenessAnalysis);
+        RUN_PHASE(performIntegerRangeOptimization);
+        
+        RUN_PHASE(performCleanUp);
+        RUN_PHASE(performIntegerCheckCombining);
+        RUN_PHASE(performGlobalCSE);
+        
+        // At this point we're not allowed to do any further code motion because our reasoning
+        // about code motion assumes that it's OK to insert GC points in random places.
+        dfg.m_fixpointState = FixpointConverged;
+        
+        RUN_PHASE(performLivenessAnalysis);
+        RUN_PHASE(performCFA);
+        RUN_PHASE(performGlobalStoreBarrierInsertion);
+        RUN_PHASE(performStoreBarrierClustering);
+        if (Options::useMovHintRemoval())
+            RUN_PHASE(performMovHintRemoval);
+        RUN_PHASE(performCleanUp);
+        RUN_PHASE(performDCE); // We rely on this to kill dead code that won't be recognized as dead by B3.
+        RUN_PHASE(performStackLayout);
+        RUN_PHASE(performLivenessAnalysis);
+        RUN_PHASE(performOSRAvailabilityAnalysis);
+        RUN_PHASE(performWatchpointCollection);
+        
+        if (FTL::canCompile(dfg) == FTL::CannotCompile) {
+            finalizer = std::make_unique<FailedFinalizer>(*this);
+            return FailPath;
+        }
+
+        dumpAndVerifyGraph(dfg, "Graph just before FTL lowering:", shouldDumpDisassembly(mode));
+
+        // Flash a safepoint in case the GC wants some action.
+        Safepoint::Result safepointResult;
+        {
+            GraphSafepoint safepoint(dfg, safepointResult);
+        }
+        if (safepointResult.didGetCancelled())
+            return CancelPath;
+
+        FTL::State state(dfg);
+        FTL::lowerDFGToB3(state);
+        
+        if (UNLIKELY(computeCompileTimes()))
+            m_timeBeforeFTL = monotonicallyIncreasingTimeMS();
+        
+        if (Options::b3AlwaysFailsBeforeCompile()) {
+            FTL::fail(state);
+            return FTLPath;
+        }
+        
+        FTL::compile(state, safepointResult);
+        if (safepointResult.didGetCancelled())
+            return CancelPath;
+        
+        if (Options::b3AlwaysFailsBeforeLink()) {
+            FTL::fail(state);
+            return FTLPath;
+        }
+        
+        if (state.allocationFailed) {
+            FTL::fail(state);
+            return FTLPath;
+        }
+
+        FTL::link(state);
+        
+        if (state.allocationFailed) {
+            FTL::fail(state);
+            return FTLPath;
+        }
+        
+        return FTLPath;
+#else
+        RELEASE_ASSERT_NOT_REACHED();
+        return FailPath;
+#endif // ENABLE(FTL_JIT)
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return FailPath;
+    }
+
+#undef RUN_PHASE
+}
+
+bool Plan::isStillValid()
+{
+    CodeBlock* replacement = codeBlock->replacement();
+    if (!replacement)
+        return false;
+    // FIXME: This is almost certainly not necessary. There's no way for the baseline
+    // code to be replaced during a compilation, except if we delete the plan, in which
+    // case we wouldn't be here.
+    // https://bugs.webkit.org/show_bug.cgi?id=132707
+    if (codeBlock->alternative() != replacement->baselineVersion())
+        return false;
+    if (!watchpoints.areStillValid())
+        return false;
+    return true;
+}
+
+void Plan::reallyAdd(CommonData* commonData)
+{
+    watchpoints.reallyAdd(codeBlock, *commonData);
+    identifiers.reallyAdd(*vm, commonData);
+    weakReferences.reallyAdd(*vm, commonData);
+    transitions.reallyAdd(*vm, commonData);
+}
+
+void Plan::notifyCompiling()
+{
+    stage = Compiling;
+}
+
+void Plan::notifyReady()
+{
+    callback->compilationDidBecomeReadyAsynchronously(codeBlock, profiledDFGCodeBlock);
+    stage = Ready;
+}
+
+CompilationResult Plan::finalizeWithoutNotifyingCallback()
+{
+    // We will establish new references from the code block to things. So, we need a barrier.
+    vm->heap.writeBarrier(codeBlock);
+    
+    if (!isStillValid()) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "dfgFinalize", ("invalidated"));
+        return CompilationInvalidated;
+    }
+
+    bool result;
+    if (codeBlock->codeType() == FunctionCode)
+        result = finalizer->finalizeFunction();
+    else
+        result = finalizer->finalize();
+    
+    if (!result) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "dfgFinalize", ("failed"));
+        return CompilationFailed;
+    }
+    
+    reallyAdd(codeBlock->jitCode()->dfgCommon());
+    
+    if (validationEnabled()) {
+        TrackedReferences trackedReferences;
+        
+        for (WriteBarrier<JSCell>& reference : codeBlock->jitCode()->dfgCommon()->weakReferences)
+            trackedReferences.add(reference.get());
+        for (WriteBarrier<Structure>& reference : codeBlock->jitCode()->dfgCommon()->weakStructureReferences)
+            trackedReferences.add(reference.get());
+        for (WriteBarrier<Unknown>& constant : codeBlock->constants())
+            trackedReferences.add(constant.get());
+
+        for (auto* inlineCallFrame : *inlineCallFrames) {
+            ASSERT(inlineCallFrame->baselineCodeBlock.get());
+            trackedReferences.add(inlineCallFrame->baselineCodeBlock.get());
+        }
+        
+        // Check that any other references that we have anywhere in the JITCode are also
+        // tracked either strongly or weakly.
+        codeBlock->jitCode()->validateReferences(trackedReferences);
+    }
+    
+    CODEBLOCK_LOG_EVENT(codeBlock, "dfgFinalize", ("succeeded"));
+    return CompilationSuccessful;
+}
+
+void Plan::finalizeAndNotifyCallback()
+{
+    callback->compilationDidComplete(codeBlock, profiledDFGCodeBlock, finalizeWithoutNotifyingCallback());
+}
+
+CompilationKey Plan::key()
+{
+    return CompilationKey(codeBlock->alternative(), mode);
+}
+
+void Plan::checkLivenessAndVisitChildren(SlotVisitor& visitor)
+{
+    if (!isKnownToBeLiveDuringGC())
+        return;
+
+    cleanMustHandleValuesIfNecessary();
+    for (unsigned i = mustHandleValues.size(); i--;)
+        visitor.appendUnbarriered(mustHandleValues[i]);
+
+    visitor.appendUnbarriered(codeBlock);
+    visitor.appendUnbarriered(codeBlock->alternative());
+    visitor.appendUnbarriered(profiledDFGCodeBlock);
+
+    if (inlineCallFrames) {
+        for (auto* inlineCallFrame : *inlineCallFrames) {
+            ASSERT(inlineCallFrame->baselineCodeBlock.get());
+            visitor.appendUnbarriered(inlineCallFrame->baselineCodeBlock.get());
+        }
+    }
+
+    weakReferences.visitChildren(visitor);
+    transitions.visitChildren(visitor);
+}
+
+bool Plan::isKnownToBeLiveDuringGC()
+{
+    if (stage == Cancelled)
+        return false;
+    if (!Heap::isMarked(codeBlock->ownerExecutable()))
+        return false;
+    if (!Heap::isMarked(codeBlock->alternative()))
+        return false;
+    if (!!profiledDFGCodeBlock && !Heap::isMarked(profiledDFGCodeBlock))
+        return false;
+    return true;
+}
+
+void Plan::cancel()
+{
+    vm = nullptr;
+    codeBlock = nullptr;
+    profiledDFGCodeBlock = nullptr;
+    mustHandleValues.clear();
+    compilation = nullptr;
+    finalizer = nullptr;
+    inlineCallFrames = nullptr;
+    watchpoints = DesiredWatchpoints();
+    identifiers = DesiredIdentifiers();
+    weakReferences = DesiredWeakReferences();
+    transitions = DesiredTransitions();
+    callback = nullptr;
+    stage = Cancelled;
+}
+
+void Plan::cleanMustHandleValuesIfNecessary()
+{
+    LockHolder locker(mustHandleValueCleaningLock);
+    
+    if (!mustHandleValuesMayIncludeGarbage)
+        return;
+    
+    mustHandleValuesMayIncludeGarbage = false;
+    
+    if (!codeBlock)
+        return;
+    
+    if (!mustHandleValues.numberOfLocals())
+        return;
+    
+    FastBitVector liveness = codeBlock->alternative()->livenessAnalysis().getLivenessInfoAtBytecodeOffset(osrEntryBytecodeIndex);
+    
+    for (unsigned local = mustHandleValues.numberOfLocals(); local--;) {
+        if (!liveness[local])
+            mustHandleValues.local(local) = jsUndefined();
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPlan.h b/dfg/DFGPlan.h
new file mode 100644
index 0000000..4bff13c
--- /dev/null
+++ b/dfg/DFGPlan.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CompilationResult.h"
+#include "DFGCompilationKey.h"
+#include "DFGCompilationMode.h"
+#include "DFGDesiredIdentifiers.h"
+#include "DFGDesiredTransitions.h"
+#include "DFGDesiredWatchpoints.h"
+#include "DFGDesiredWeakReferences.h"
+#include "DFGFinalizer.h"
+#include "DeferredCompilationCallback.h"
+#include "Operands.h"
+#include "ProfilerCompilation.h"
+#include <wtf/HashMap.h>
+#include <wtf/ThreadSafeRefCounted.h>
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+class CodeBlock;
+class SlotVisitor;
+
+namespace DFG {
+
+class LongLivedState;
+class ThreadData;
+
+#if ENABLE(DFG_JIT)
+
+struct Plan : public ThreadSafeRefCounted<Plan> {
+    Plan(
+        CodeBlock* codeBlockToCompile, CodeBlock* profiledDFGCodeBlock,
+        CompilationMode, unsigned osrEntryBytecodeIndex,
+        const Operands<JSValue>& mustHandleValues);
+    ~Plan();
+
+    void compileInThread(LongLivedState&, ThreadData*);
+    
+    CompilationResult finalizeWithoutNotifyingCallback();
+    void finalizeAndNotifyCallback();
+    
+    void notifyCompiling();
+    void notifyReady();
+    
+    CompilationKey key();
+    
+    void markCodeBlocks(SlotVisitor&);
+    template<typename Func>
+    void iterateCodeBlocksForGC(const Func&);
+    void checkLivenessAndVisitChildren(SlotVisitor&);
+    bool isKnownToBeLiveDuringGC();
+    void cancel();
+
+    bool canTierUpAndOSREnter() const { return !tierUpAndOSREnterBytecodes.isEmpty(); }
+    
+    void cleanMustHandleValuesIfNecessary();
+    
+    // Warning: pretty much all of the pointer fields in this object get nulled by cancel(). So, if
+    // you're writing code that is callable on the cancel path, be sure to null check everything!
+    
+    VM* vm;
+
+    // These can be raw pointers because we visit them during every GC in checkLivenessAndVisitChildren.
+    CodeBlock* codeBlock;
+    CodeBlock* profiledDFGCodeBlock;
+
+    CompilationMode mode;
+    const unsigned osrEntryBytecodeIndex;
+    Operands<JSValue> mustHandleValues;
+    bool mustHandleValuesMayIncludeGarbage { true };
+    Lock mustHandleValueCleaningLock;
+    
+    ThreadData* threadData;
+
+    RefPtr<Profiler::Compilation> compilation;
+
+    std::unique_ptr<Finalizer> finalizer;
+    
+    RefPtr<InlineCallFrameSet> inlineCallFrames;
+    DesiredWatchpoints watchpoints;
+    DesiredIdentifiers identifiers;
+    DesiredWeakReferences weakReferences;
+    DesiredTransitions transitions;
+    
+    bool willTryToTierUp { false };
+
+    HashMap<unsigned, Vector<unsigned>> tierUpInLoopHierarchy;
+    Vector<unsigned> tierUpAndOSREnterBytecodes;
+
+    enum Stage { Preparing, Compiling, Ready, Cancelled };
+    Stage stage;
+
+    RefPtr<DeferredCompilationCallback> callback;
+
+private:
+    bool computeCompileTimes() const;
+    bool reportCompileTimes() const;
+    
+    enum CompilationPath { FailPath, DFGPath, FTLPath, CancelPath };
+    CompilationPath compileInThreadImpl(LongLivedState&);
+    
+    bool isStillValid();
+    void reallyAdd(CommonData*);
+
+    double m_timeBeforeFTL;
+};
+
+#endif // ENABLE(DFG_JIT)
+
+} } // namespace JSC::DFG
diff --git a/dfg/DFGPlanInlines.h b/dfg/DFGPlanInlines.h
new file mode 100644
index 0000000..151f089
--- /dev/null
+++ b/dfg/DFGPlanInlines.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGPlan.h"
+
+namespace JSC { namespace DFG {
+
+#if ENABLE(DFG_JIT)
+
+template<typename Func>
+void Plan::iterateCodeBlocksForGC(const Func& func)
+{
+    if (!isKnownToBeLiveDuringGC())
+        return;
+    
+    // Compilation writes lots of values to a CodeBlock without performing
+    // an explicit barrier. So, we need to be pessimistic and assume that
+    // all our CodeBlocks must be visited during GC.
+
+    func(codeBlock);
+    func(codeBlock->alternative());
+    if (profiledDFGCodeBlock)
+        func(profiledDFGCodeBlock);
+}
+
+#endif // ENABLE(DFG_JIT)
+
+} } // namespace JSC::DFG
+
diff --git a/dfg/DFGPrePostNumbering.cpp b/dfg/DFGPrePostNumbering.cpp
new file mode 100644
index 0000000..4b79231
--- /dev/null
+++ b/dfg/DFGPrePostNumbering.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPrePostNumbering.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockMapInlines.h"
+#include "DFGBlockWorklist.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+PrePostNumbering::PrePostNumbering(Graph& graph)
+{
+    m_map = BlockMap<Numbering>(graph);
+    
+    PostOrderBlockWorklist worklist;
+    worklist.push(graph.block(0));
+    unsigned nextPreNumber = 0;
+    unsigned nextPostNumber = 0;
+    while (BlockWithOrder item = worklist.pop()) {
+        switch (item.order) {
+        case VisitOrder::Pre:
+            m_map[item.node].m_preNumber = nextPreNumber++;
+            worklist.pushPost(item.node);
+            for (BasicBlock* successor : item.node->successors())
+                worklist.push(successor);
+            break;
+        case VisitOrder::Post:
+            m_map[item.node].m_postNumber = nextPostNumber++;
+            break;
+        }
+    }
+}
+
+PrePostNumbering::~PrePostNumbering() { }
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, EdgeKind kind)
+{
+    switch (kind) {
+    case ForwardEdge:
+        out.print("ForwardEdge");
+        return;
+    case CrossEdge:
+        out.print("CrossEdge");
+        return;
+    case BackEdge:
+        out.print("BackEdge");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPrePostNumbering.h b/dfg/DFGPrePostNumbering.h
new file mode 100644
index 0000000..64efdac
--- /dev/null
+++ b/dfg/DFGPrePostNumbering.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include "DFGBlockMap.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace DFG {
+
+enum EdgeKind {
+    ForwardEdge,
+    CrossEdge,
+    BackEdge
+};
+
+class PrePostNumbering {
+    WTF_MAKE_NONCOPYABLE(PrePostNumbering);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    PrePostNumbering(Graph&);
+    ~PrePostNumbering();
+
+    unsigned preNumber(BasicBlock* block) const { return m_map[block].m_preNumber; }
+    unsigned postNumber(BasicBlock* block) const { return m_map[block].m_postNumber; }
+    
+    // Is from a strict ancestor of to?
+    bool isStrictAncestorOf(BasicBlock* from, BasicBlock* to) const
+    {
+        return preNumber(from) < preNumber(to)
+            && postNumber(from) > postNumber(to);
+    }
+    
+    bool isAncestorOf(BasicBlock* from, BasicBlock* to) const
+    {
+        return from == to || isStrictAncestorOf(from, to);
+    }
+    
+    bool isStrictDescendantOf(BasicBlock* from, BasicBlock* to) const
+    {
+        return isStrictAncestorOf(to, from);
+    }
+    
+    bool isDescendantOf(BasicBlock* from, BasicBlock* to) const
+    {
+        return isAncestorOf(to, from);
+    }
+    
+    // This will give a bogus answer if there is actually no such edge. If you want to determine
+    // if there is any such edge, you have to do it yourself.
+    EdgeKind edgeKind(BasicBlock* from, BasicBlock* to) const
+    {
+        if (isStrictDescendantOf(to, from))
+            return ForwardEdge;
+        
+        if (isAncestorOf(to, from))
+            return BackEdge;
+        
+        return CrossEdge;
+    }
+    
+private:
+    struct Numbering {
+        unsigned m_preNumber;
+        unsigned m_postNumber;
+    };
+
+    BlockMap<Numbering> m_map;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::EdgeKind);
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPreciseLocalClobberize.h b/dfg/DFGPreciseLocalClobberize.h
new file mode 100644
index 0000000..baf0ad9
--- /dev/null
+++ b/dfg/DFGPreciseLocalClobberize.h
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGClobberize.h"
+#include "DFGMayExit.h"
+
+namespace JSC { namespace DFG {
+
+template<typename ReadFunctor, typename WriteFunctor, typename DefFunctor>
+class PreciseLocalClobberizeAdaptor {
+public:
+    PreciseLocalClobberizeAdaptor(
+        Graph& graph, Node* node,
+        const ReadFunctor& read, const WriteFunctor& write, const DefFunctor& def)
+        : m_graph(graph)
+        , m_node(node)
+        , m_read(read)
+        , m_unconditionalWrite(write)
+        , m_def(def)
+    {
+    }
+    
+    void read(AbstractHeap heap)
+    {
+        if (heap.kind() == Stack) {
+            if (heap.payload().isTop()) {
+                readTop();
+                return;
+            }
+            
+            callIfAppropriate(m_read, VirtualRegister(heap.payload().value32()));
+            return;
+        }
+        
+        if (heap.overlaps(Stack)) {
+            readTop();
+            return;
+        }
+    }
+    
+    void write(AbstractHeap heap)
+    {
+        // We expect stack writes to already be precisely characterized by DFG::clobberize().
+        if (heap.kind() == Stack) {
+            RELEASE_ASSERT(!heap.payload().isTop());
+            callIfAppropriate(m_unconditionalWrite, VirtualRegister(heap.payload().value32()));
+            return;
+        }
+        
+        RELEASE_ASSERT(!heap.overlaps(Stack));
+    }
+    
+    void def(PureValue)
+    {
+        // PureValue defs never have anything to do with locals, so ignore this.
+    }
+    
+    void def(HeapLocation location, LazyNode node)
+    {
+        if (location.kind() != StackLoc)
+            return;
+        
+        RELEASE_ASSERT(location.heap().kind() == Stack);
+        
+        m_def(VirtualRegister(location.heap().payload().value32()), node);
+    }
+    
+private:
+    template<typename Functor>
+    void callIfAppropriate(const Functor& functor, VirtualRegister operand)
+    {
+        if (operand.isLocal() && static_cast<unsigned>(operand.toLocal()) >= m_graph.block(0)->variablesAtHead.numberOfLocals())
+            return;
+        
+        if (operand.isArgument() && !operand.isHeader() && static_cast<unsigned>(operand.toArgument()) >= m_graph.block(0)->variablesAtHead.numberOfArguments())
+            return;
+        
+        functor(operand);
+    }
+    
+    void readTop()
+    {
+        auto readFrame = [&] (InlineCallFrame* inlineCallFrame, unsigned numberOfArgumentsToSkip) {
+            if (!inlineCallFrame) {
+                // Read the outermost arguments and argument count.
+                for (unsigned i = 1 + numberOfArgumentsToSkip; i < static_cast<unsigned>(m_graph.m_codeBlock->numParameters()); i++)
+                    m_read(virtualRegisterForArgument(i));
+                m_read(VirtualRegister(CallFrameSlot::argumentCount));
+                return;
+            }
+            
+            for (unsigned i = 1 + numberOfArgumentsToSkip; i < inlineCallFrame->arguments.size(); i++)
+                m_read(VirtualRegister(inlineCallFrame->stackOffset + virtualRegisterForArgument(i).offset()));
+            if (inlineCallFrame->isVarargs())
+                m_read(VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount));
+        };
+
+        auto readNewArrayWithSpreadNode = [&] (Node* arrayWithSpread) {
+            ASSERT(arrayWithSpread->op() == NewArrayWithSpread || arrayWithSpread->op() == PhantomNewArrayWithSpread);
+            BitVector* bitVector = arrayWithSpread->bitVector();
+            for (unsigned i = 0; i < arrayWithSpread->numChildren(); i++) {
+                if (bitVector->get(i)) {
+                    Node* child = m_graph.varArgChild(arrayWithSpread, i).node();
+                    if (child->op() == PhantomSpread) {
+                        ASSERT(child->child1()->op() == PhantomCreateRest);
+                        InlineCallFrame* inlineCallFrame = child->child1()->origin.semantic.inlineCallFrame;
+                        unsigned numberOfArgumentsToSkip = child->child1()->numberOfArgumentsToSkip();
+                        readFrame(inlineCallFrame, numberOfArgumentsToSkip);
+                    }
+                }
+            }
+        };
+
+        bool isForwardingNode = false;
+        switch (m_node->op()) {
+        case ForwardVarargs:
+        case CallForwardVarargs:
+        case ConstructForwardVarargs:
+        case TailCallForwardVarargs:
+        case TailCallForwardVarargsInlinedCaller:
+            isForwardingNode = true;
+            FALLTHROUGH;
+        case GetMyArgumentByVal:
+        case GetMyArgumentByValOutOfBounds: {
+
+            if (isForwardingNode && m_node->hasArgumentsChild() && m_node->argumentsChild() && m_node->argumentsChild()->op() == PhantomNewArrayWithSpread) {
+                Node* arrayWithSpread = m_node->argumentsChild().node();
+                readNewArrayWithSpreadNode(arrayWithSpread);
+            } else {
+                InlineCallFrame* inlineCallFrame;
+                if (m_node->hasArgumentsChild() && m_node->argumentsChild())
+                    inlineCallFrame = m_node->argumentsChild()->origin.semantic.inlineCallFrame;
+                else
+                    inlineCallFrame = m_node->origin.semantic.inlineCallFrame;
+
+                unsigned numberOfArgumentsToSkip = 0;
+                if (m_node->op() == GetMyArgumentByVal || m_node->op() == GetMyArgumentByValOutOfBounds) {
+                    // The value of numberOfArgumentsToSkip guarantees that GetMyArgumentByVal* will never
+                    // read any arguments below the number of arguments to skip. For example, if numberOfArgumentsToSkip is 2,
+                    // we will never read argument 0 or argument 1.
+                    numberOfArgumentsToSkip = m_node->numberOfArgumentsToSkip();
+                }
+
+                readFrame(inlineCallFrame, numberOfArgumentsToSkip);
+            }
+
+            break;
+        }
+        
+        case NewArrayWithSpread: {
+            readNewArrayWithSpreadNode(m_node);
+            break;
+        }
+
+        case GetArgument: {
+            InlineCallFrame* inlineCallFrame = m_node->origin.semantic.inlineCallFrame;
+            unsigned indexIncludingThis = m_node->argumentIndex();
+            if (!inlineCallFrame) {
+                if (indexIncludingThis < static_cast<unsigned>(m_graph.m_codeBlock->numParameters()))
+                    m_read(virtualRegisterForArgument(indexIncludingThis));
+                m_read(VirtualRegister(CallFrameSlot::argumentCount));
+                break;
+            }
+
+            ASSERT_WITH_MESSAGE(inlineCallFrame->isVarargs(), "GetArgument is only used for InlineCallFrame if the call frame is varargs.");
+            if (indexIncludingThis < inlineCallFrame->arguments.size())
+                m_read(VirtualRegister(inlineCallFrame->stackOffset + virtualRegisterForArgument(indexIncludingThis).offset()));
+            m_read(VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount));
+            break;
+        }
+
+            
+        default: {
+            // All of the outermost arguments, except this, are definitely read.
+            for (unsigned i = m_graph.m_codeBlock->numParameters(); i-- > 1;)
+                m_read(virtualRegisterForArgument(i));
+        
+            // The stack header is read.
+            for (unsigned i = 0; i < CallFrameSlot::thisArgument; ++i)
+                m_read(VirtualRegister(i));
+        
+            // Read all of the inline arguments and call frame headers that we didn't already capture.
+            for (InlineCallFrame* inlineCallFrame = m_node->origin.semantic.inlineCallFrame; inlineCallFrame; inlineCallFrame = inlineCallFrame->getCallerInlineFrameSkippingTailCalls()) {
+                for (unsigned i = inlineCallFrame->arguments.size(); i-- > 1;)
+                    m_read(VirtualRegister(inlineCallFrame->stackOffset + virtualRegisterForArgument(i).offset()));
+                if (inlineCallFrame->isClosureCall)
+                    m_read(VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::callee));
+                if (inlineCallFrame->isVarargs())
+                    m_read(VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount));
+            }
+            break;
+        } }
+    }
+    
+    Graph& m_graph;
+    Node* m_node;
+    const ReadFunctor& m_read;
+    const WriteFunctor& m_unconditionalWrite;
+    const DefFunctor& m_def;
+};
+
+template<typename ReadFunctor, typename WriteFunctor, typename DefFunctor>
+void preciseLocalClobberize(
+    Graph& graph, Node* node,
+    const ReadFunctor& read, const WriteFunctor& write, const DefFunctor& def)
+{
+    PreciseLocalClobberizeAdaptor<ReadFunctor, WriteFunctor, DefFunctor>
+        adaptor(graph, node, read, write, def);
+    clobberize(graph, node, adaptor);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPredictionInjectionPhase.cpp b/dfg/DFGPredictionInjectionPhase.cpp
new file mode 100644
index 0000000..27fb903
--- /dev/null
+++ b/dfg/DFGPredictionInjectionPhase.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPredictionInjectionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class PredictionInjectionPhase : public Phase {
+public:
+    PredictionInjectionPhase(Graph& graph)
+        : Phase(graph, "prediction injection")
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == ThreadedCPS);
+        ASSERT(m_graph.m_unificationState == GloballyUnified);
+        
+        ASSERT(codeBlock()->numParameters() >= 1);
+        {
+            ConcurrentJSLocker locker(profiledBlock()->m_lock);
+            
+            for (size_t arg = 0; arg < static_cast<size_t>(codeBlock()->numParameters()); ++arg) {
+                ValueProfile* profile = profiledBlock()->valueProfileForArgument(arg);
+                if (!profile)
+                    continue;
+            
+                m_graph.m_arguments[arg]->variableAccessData()->predict(
+                    profile->computeUpdatedPrediction(locker));
+            }
+        }
+        
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            if (!block->isOSRTarget)
+                continue;
+            if (block->bytecodeBegin != m_graph.m_plan.osrEntryBytecodeIndex)
+                continue;
+            for (size_t i = 0; i < m_graph.m_plan.mustHandleValues.size(); ++i) {
+                int operand = m_graph.m_plan.mustHandleValues.operandForIndex(i);
+                Node* node = block->variablesAtHead.operand(operand);
+                if (!node)
+                    continue;
+                ASSERT(node->accessesStack(m_graph));
+                node->variableAccessData()->predict(
+                    speculationFromValue(m_graph.m_plan.mustHandleValues[i]));
+            }
+        }
+        
+        return true;
+    }
+};
+
+bool performPredictionInjection(Graph& graph)
+{
+    return runPhase<PredictionInjectionPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPredictionInjectionPhase.h b/dfg/DFGPredictionInjectionPhase.h
new file mode 100644
index 0000000..dbed6f3
--- /dev/null
+++ b/dfg/DFGPredictionInjectionPhase.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Prediction Injection:
+//
+// Takes miscellaneous data about variable type predictions and injects them.
+// This includes argument predictions and OSR entry predictions.
+
+bool performPredictionInjection(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPredictionPropagationPhase.cpp b/dfg/DFGPredictionPropagationPhase.cpp
new file mode 100644
index 0000000..d0f4b47
--- /dev/null
+++ b/dfg/DFGPredictionPropagationPhase.cpp
@@ -0,0 +1,1166 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPredictionPropagationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verboseFixPointLoops = false;
+
+class PredictionPropagationPhase : public Phase {
+public:
+    PredictionPropagationPhase(Graph& graph)
+        : Phase(graph, "prediction propagation")
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == ThreadedCPS);
+        ASSERT(m_graph.m_unificationState == GloballyUnified);
+
+        propagateThroughArgumentPositions();
+
+        processInvariants();
+
+        m_pass = PrimaryPass;
+        propagateToFixpoint();
+        
+        m_pass = RareCasePass;
+        propagateToFixpoint();
+        
+        m_pass = DoubleVotingPass;
+        unsigned counter = 0;
+        do {
+            if (verboseFixPointLoops)
+                ++counter;
+
+            m_changed = false;
+            doRoundOfDoubleVoting();
+            if (!m_changed)
+                break;
+            m_changed = false;
+            propagateForward();
+        } while (m_changed);
+
+        if (verboseFixPointLoops)
+            dataLog("Iterated ", counter, " times in double voting fixpoint.\n");
+        
+        return true;
+    }
+    
+private:
+    void propagateToFixpoint()
+    {
+        unsigned counter = 0;
+        do {
+            if (verboseFixPointLoops)
+                ++counter;
+
+            m_changed = false;
+
+            // Forward propagation is near-optimal for both topologically-sorted and
+            // DFS-sorted code.
+            propagateForward();
+            if (!m_changed)
+                break;
+            
+            // Backward propagation reduces the likelihood that pathological code will
+            // cause slowness. Loops (especially nested ones) resemble backward flow.
+            // This pass captures two cases: (1) it detects if the forward fixpoint
+            // found a sound solution and (2) short-circuits backward flow.
+            m_changed = false;
+            propagateBackward();
+        } while (m_changed);
+
+        if (verboseFixPointLoops)
+            dataLog("Iterated ", counter, " times in propagateToFixpoint.\n");
+    }
+    
+    bool setPrediction(SpeculatedType prediction)
+    {
+        ASSERT(m_currentNode->hasResult());
+        
+        // setPrediction() is used when we know that there is no way that we can change
+        // our minds about what the prediction is going to be. There is no semantic
+        // difference between setPrediction() and mergeSpeculation() other than the
+        // increased checking to validate this property.
+        ASSERT(m_currentNode->prediction() == SpecNone || m_currentNode->prediction() == prediction);
+        
+        return m_currentNode->predict(prediction);
+    }
+    
+    bool mergePrediction(SpeculatedType prediction)
+    {
+        ASSERT(m_currentNode->hasResult());
+        
+        return m_currentNode->predict(prediction);
+    }
+    
+    SpeculatedType speculatedDoubleTypeForPrediction(SpeculatedType value)
+    {
+        SpeculatedType result = SpecDoubleReal;
+        if (value & SpecDoubleImpureNaN)
+            result |= SpecDoubleImpureNaN;
+        if (value & SpecDoublePureNaN)
+            result |= SpecDoublePureNaN;
+        if (!isFullNumberOrBooleanSpeculation(value))
+            result |= SpecDoublePureNaN;
+        return result;
+    }
+
+    SpeculatedType speculatedDoubleTypeForPredictions(SpeculatedType left, SpeculatedType right)
+    {
+        return speculatedDoubleTypeForPrediction(mergeSpeculations(left, right));
+    }
+
+    void propagate(Node* node)
+    {
+        NodeType op = node->op();
+
+        bool changed = false;
+        
+        switch (op) {
+        case GetLocal: {
+            VariableAccessData* variable = node->variableAccessData();
+            SpeculatedType prediction = variable->prediction();
+            if (!variable->couldRepresentInt52() && (prediction & SpecInt52Only))
+                prediction = (prediction | SpecAnyIntAsDouble) & ~SpecInt52Only;
+            if (prediction)
+                changed |= mergePrediction(prediction);
+            break;
+        }
+            
+        case SetLocal: {
+            VariableAccessData* variableAccessData = node->variableAccessData();
+            changed |= variableAccessData->predict(node->child1()->prediction());
+            break;
+        }
+
+        case UInt32ToNumber: {
+            if (node->canSpeculateInt32(m_pass))
+                changed |= mergePrediction(SpecInt32Only);
+            else if (enableInt52())
+                changed |= mergePrediction(SpecAnyInt);
+            else
+                changed |= mergePrediction(SpecBytecodeNumber);
+            break;
+        }
+
+        case ValueAdd: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+            
+            if (left && right) {
+                if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
+                    && isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
+                    if (m_graph.addSpeculationMode(node, m_pass) != DontSpeculateInt32)
+                        changed |= mergePrediction(SpecInt32Only);
+                    else if (m_graph.addShouldSpeculateAnyInt(node))
+                        changed |= mergePrediction(SpecInt52Only);
+                    else
+                        changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
+                } else if (isStringOrStringObjectSpeculation(left) && isStringOrStringObjectSpeculation(right)) {
+                    // left or right is definitely something other than a number.
+                    changed |= mergePrediction(SpecString);
+                } else {
+                    changed |= mergePrediction(SpecInt32Only);
+                    if (node->mayHaveDoubleResult())
+                        changed |= mergePrediction(SpecBytecodeDouble);
+                    if (node->mayHaveNonNumberResult())
+                        changed |= mergePrediction(SpecString);
+                }
+            }
+            break;
+        }
+
+        case ArithAdd: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+            
+            if (left && right) {
+                if (m_graph.addSpeculationMode(node, m_pass) != DontSpeculateInt32)
+                    changed |= mergePrediction(SpecInt32Only);
+                else if (m_graph.addShouldSpeculateAnyInt(node))
+                    changed |= mergePrediction(SpecInt52Only);
+                else if (isFullNumberOrBooleanSpeculation(left) && isFullNumberOrBooleanSpeculation(right))
+                    changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
+                else if (node->mayHaveNonIntResult() || (left & SpecBytecodeDouble) || (right & SpecBytecodeDouble))
+                    changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
+                else
+                    changed |= mergePrediction(SpecInt32Only);
+            }
+            break;
+        }
+            
+        case ArithSub: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+
+            if (left && right) {
+                if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
+                    && isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
+                    if (m_graph.addSpeculationMode(node, m_pass) != DontSpeculateInt32)
+                        changed |= mergePrediction(SpecInt32Only);
+                    else if (m_graph.addShouldSpeculateAnyInt(node))
+                        changed |= mergePrediction(SpecInt52Only);
+                    else
+                        changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
+                } else if (node->mayHaveNonIntResult() || (left & SpecBytecodeDouble) || (right & SpecBytecodeDouble))
+                    changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
+                else
+                    changed |= mergePrediction(SpecInt32Only);
+            }
+            break;
+        }
+
+        case ArithNegate: {
+            SpeculatedType prediction = node->child1()->prediction();
+            if (prediction) {
+                if (isInt32OrBooleanSpeculation(prediction) && node->canSpeculateInt32(m_pass))
+                    changed |= mergePrediction(SpecInt32Only);
+                else if (m_graph.unaryArithShouldSpeculateAnyInt(node, m_pass))
+                    changed |= mergePrediction(SpecInt52Only);
+                else if (isBytecodeNumberSpeculation(prediction))
+                    changed |= mergePrediction(speculatedDoubleTypeForPrediction(node->child1()->prediction()));
+                else {
+                    changed |= mergePrediction(SpecInt32Only);
+                    if (node->mayHaveDoubleResult())
+                        changed |= mergePrediction(SpecBytecodeDouble);
+                }
+            }
+            break;
+        }
+        case ArithMin:
+        case ArithMax: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+            
+            if (left && right) {
+                if (Node::shouldSpeculateInt32OrBooleanForArithmetic(node->child1().node(), node->child2().node())
+                    && node->canSpeculateInt32(m_pass))
+                    changed |= mergePrediction(SpecInt32Only);
+                else
+                    changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
+            }
+            break;
+        }
+
+        case ArithMul: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+            
+            if (left && right) {
+                // FIXME: We're currently relying on prediction propagation and backwards propagation
+                // whenever we can, and only falling back on result flags if that fails. And the result
+                // flags logic doesn't know how to use backwards propagation. We should get rid of the
+                // prediction propagation logic and rely solely on the result type.
+                if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
+                    && isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
+                    if (m_graph.binaryArithShouldSpeculateInt32(node, m_pass))
+                        changed |= mergePrediction(SpecInt32Only);
+                    else if (m_graph.binaryArithShouldSpeculateAnyInt(node, m_pass))
+                        changed |= mergePrediction(SpecInt52Only);
+                    else
+                        changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
+                } else {
+                    if (node->mayHaveNonIntResult()
+                        || (left & SpecBytecodeDouble)
+                        || (right & SpecBytecodeDouble))
+                        changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
+                    else
+                        changed |= mergePrediction(SpecInt32Only);
+                }
+            }
+            break;
+        }
+
+        case ArithDiv:
+        case ArithMod: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+            
+            if (left && right) {
+                if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
+                    && isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
+                    if (m_graph.binaryArithShouldSpeculateInt32(node, m_pass))
+                        changed |= mergePrediction(SpecInt32Only);
+                    else
+                        changed |= mergePrediction(SpecBytecodeDouble);
+                } else
+                    changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
+            }
+            break;
+        }
+
+        case ArithAbs: {
+            SpeculatedType childPrediction = node->child1()->prediction();
+            if (isInt32OrBooleanSpeculation(childPrediction)
+                && node->canSpeculateInt32(m_pass))
+                changed |= mergePrediction(SpecInt32Only);
+            else
+                changed |= mergePrediction(SpecBytecodeDouble);
+            break;
+        }
+
+        case GetByVal: {
+            if (!node->child1()->prediction())
+                break;
+            
+            ArrayMode arrayMode = node->arrayMode().refine(
+                m_graph, node,
+                node->child1()->prediction(),
+                node->child2()->prediction(),
+                SpecNone);
+            
+            switch (arrayMode.type()) {
+            case Array::Int32:
+                if (arrayMode.isOutOfBounds())
+                    changed |= mergePrediction(node->getHeapPrediction() | SpecInt32Only);
+                else
+                    changed |= mergePrediction(SpecInt32Only);
+                break;
+            case Array::Double:
+                if (arrayMode.isOutOfBounds())
+                    changed |= mergePrediction(node->getHeapPrediction() | SpecDoubleReal);
+                else
+                    changed |= mergePrediction(SpecDoubleReal);
+                break;
+            case Array::Float32Array:
+            case Array::Float64Array:
+                changed |= mergePrediction(SpecFullDouble);
+                break;
+            case Array::Uint32Array:
+                if (isInt32SpeculationForArithmetic(node->getHeapPrediction()))
+                    changed |= mergePrediction(SpecInt32Only);
+                else if (enableInt52())
+                    changed |= mergePrediction(SpecAnyInt);
+                else
+                    changed |= mergePrediction(SpecInt32Only | SpecAnyIntAsDouble);
+                break;
+            case Array::Int8Array:
+            case Array::Uint8Array:
+            case Array::Int16Array:
+            case Array::Uint16Array:
+            case Array::Int32Array:
+                changed |= mergePrediction(SpecInt32Only);
+                break;
+            default:
+                changed |= mergePrediction(node->getHeapPrediction());
+                break;
+            }
+            break;
+        }
+
+        case ToThis: {
+            // ToThis in methods for primitive types should speculate primitive types in strict mode.
+            ECMAMode ecmaMode = m_graph.executableFor(node->origin.semantic)->isStrictMode() ? StrictMode : NotStrictMode;
+            if (ecmaMode == StrictMode) {
+                if (node->child1()->shouldSpeculateBoolean()) {
+                    changed |= mergePrediction(SpecBoolean);
+                    break;
+                }
+
+                if (node->child1()->shouldSpeculateInt32()) {
+                    changed |= mergePrediction(SpecInt32Only);
+                    break;
+                }
+
+                if (enableInt52() && node->child1()->shouldSpeculateAnyInt()) {
+                    changed |= mergePrediction(SpecAnyInt);
+                    break;
+                }
+
+                if (node->child1()->shouldSpeculateNumber()) {
+                    changed |= mergePrediction(SpecAnyInt);
+                    break;
+                }
+
+                if (node->child1()->shouldSpeculateSymbol()) {
+                    changed |= mergePrediction(SpecSymbol);
+                    break;
+                }
+
+                if (node->child1()->shouldSpeculateStringIdent()) {
+                    changed |= mergePrediction(SpecStringIdent);
+                    break;
+                }
+
+                if (node->child1()->shouldSpeculateString()) {
+                    changed |= mergePrediction(SpecString);
+                    break;
+                }
+            } else {
+                if (node->child1()->shouldSpeculateString()) {
+                    changed |= mergePrediction(SpecStringObject);
+                    break;
+                }
+            }
+
+            SpeculatedType prediction = node->child1()->prediction();
+            if (prediction) {
+                if (prediction & ~SpecObject) {
+                    // Wrapper objects are created only in sloppy mode.
+                    if (ecmaMode != StrictMode) {
+                        prediction &= SpecObject;
+                        prediction = mergeSpeculations(prediction, SpecObjectOther);
+                    }
+                }
+                changed |= mergePrediction(prediction);
+            }
+            break;
+        }
+            
+        case ToPrimitive: {
+            SpeculatedType child = node->child1()->prediction();
+            if (child)
+                changed |= mergePrediction(resultOfToPrimitive(child));
+            break;
+        }
+
+        default:
+            break;
+        }
+
+        m_changed |= changed;
+    }
+        
+    void propagateForward()
+    {
+        for (Node* node : m_dependentNodes) {
+            m_currentNode = node;
+            propagate(m_currentNode);
+        }
+    }
+
+    void propagateBackward()
+    {
+        for (unsigned i = m_dependentNodes.size(); i--;) {
+            m_currentNode = m_dependentNodes[i];
+            propagate(m_currentNode);
+        }
+    }
+    
+    void doDoubleVoting(Node* node, float weight)
+    {
+        // Loop pre-headers created by OSR entrypoint creation may have NaN weight to indicate
+        // that we actually don't know they weight. Assume that they execute once. This turns
+        // out to be an OK assumption since the pre-header doesn't have any meaningful code.
+        if (weight != weight)
+            weight = 1;
+        
+        switch (node->op()) {
+        case ValueAdd:
+        case ArithAdd:
+        case ArithSub: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+                
+            DoubleBallot ballot;
+                
+            if (isFullNumberSpeculation(left)
+                && isFullNumberSpeculation(right)
+                && !m_graph.addShouldSpeculateInt32(node, m_pass)
+                && !m_graph.addShouldSpeculateAnyInt(node))
+                ballot = VoteDouble;
+            else
+                ballot = VoteValue;
+                
+            m_graph.voteNode(node->child1(), ballot, weight);
+            m_graph.voteNode(node->child2(), ballot, weight);
+            break;
+        }
+
+        case ArithMul: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+                
+            DoubleBallot ballot;
+                
+            if (isFullNumberSpeculation(left)
+                && isFullNumberSpeculation(right)
+                && !m_graph.binaryArithShouldSpeculateInt32(node, m_pass)
+                && !m_graph.binaryArithShouldSpeculateAnyInt(node, m_pass))
+                ballot = VoteDouble;
+            else
+                ballot = VoteValue;
+                
+            m_graph.voteNode(node->child1(), ballot, weight);
+            m_graph.voteNode(node->child2(), ballot, weight);
+            break;
+        }
+
+        case ArithMin:
+        case ArithMax:
+        case ArithMod:
+        case ArithDiv: {
+            SpeculatedType left = node->child1()->prediction();
+            SpeculatedType right = node->child2()->prediction();
+                
+            DoubleBallot ballot;
+                
+            if (isFullNumberSpeculation(left)
+                && isFullNumberSpeculation(right)
+                && !m_graph.binaryArithShouldSpeculateInt32(node, m_pass))
+                ballot = VoteDouble;
+            else
+                ballot = VoteValue;
+                
+            m_graph.voteNode(node->child1(), ballot, weight);
+            m_graph.voteNode(node->child2(), ballot, weight);
+            break;
+        }
+
+        case ArithAbs:
+            DoubleBallot ballot;
+            if (node->child1()->shouldSpeculateNumber()
+                && !m_graph.unaryArithShouldSpeculateInt32(node, m_pass))
+                ballot = VoteDouble;
+            else
+                ballot = VoteValue;
+                
+            m_graph.voteNode(node->child1(), ballot, weight);
+            break;
+                
+        case ArithSqrt:
+        case ArithCos:
+        case ArithSin:
+        case ArithTan:
+        case ArithLog:
+            if (node->child1()->shouldSpeculateNumber())
+                m_graph.voteNode(node->child1(), VoteDouble, weight);
+            else
+                m_graph.voteNode(node->child1(), VoteValue, weight);
+            break;
+                
+        case SetLocal: {
+            SpeculatedType prediction = node->child1()->prediction();
+            if (isDoubleSpeculation(prediction))
+                node->variableAccessData()->vote(VoteDouble, weight);
+            else if (!isFullNumberSpeculation(prediction)
+                || isInt32Speculation(prediction) || isAnyIntSpeculation(prediction))
+                node->variableAccessData()->vote(VoteValue, weight);
+            break;
+        }
+
+        case PutByValDirect:
+        case PutByVal:
+        case PutByValAlias: {
+            Edge child1 = m_graph.varArgChild(node, 0);
+            Edge child2 = m_graph.varArgChild(node, 1);
+            Edge child3 = m_graph.varArgChild(node, 2);
+            m_graph.voteNode(child1, VoteValue, weight);
+            m_graph.voteNode(child2, VoteValue, weight);
+            switch (node->arrayMode().type()) {
+            case Array::Double:
+                m_graph.voteNode(child3, VoteDouble, weight);
+                break;
+            default:
+                m_graph.voteNode(child3, VoteValue, weight);
+                break;
+            }
+            break;
+        }
+            
+        case MovHint:
+            // Ignore these since they have no effect on in-DFG execution.
+            break;
+            
+        default:
+            m_graph.voteChildren(node, VoteValue, weight);
+            break;
+        }
+    }
+    
+    void doRoundOfDoubleVoting()
+    {
+        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i)
+            m_graph.m_variableAccessData[i].find()->clearVotes();
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            ASSERT(block->isReachable);
+            for (unsigned i = 0; i < block->size(); ++i) {
+                m_currentNode = block->at(i);
+                doDoubleVoting(m_currentNode, block->executionCount);
+            }
+        }
+        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
+            VariableAccessData* variableAccessData = &m_graph.m_variableAccessData[i];
+            if (!variableAccessData->isRoot())
+                continue;
+            m_changed |= variableAccessData->tallyVotesForShouldUseDoubleFormat();
+        }
+        propagateThroughArgumentPositions();
+        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
+            VariableAccessData* variableAccessData = &m_graph.m_variableAccessData[i];
+            if (!variableAccessData->isRoot())
+                continue;
+            m_changed |= variableAccessData->makePredictionForDoubleFormat();
+        }
+    }
+    
+    void propagateThroughArgumentPositions()
+    {
+        for (unsigned i = 0; i < m_graph.m_argumentPositions.size(); ++i)
+            m_changed |= m_graph.m_argumentPositions[i].mergeArgumentPredictionAwareness();
+    }
+
+    // Sets any predictions that do not depends on other nodes.
+    void processInvariants()
+    {
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            for (Node* node : *block) {
+                m_currentNode = node;
+                processInvariantsForNode();
+            }
+        }
+    }
+
+    void processInvariantsForNode()
+    {
+        switch (m_currentNode->op()) {
+        case JSConstant: {
+            SpeculatedType type = speculationFromValue(m_currentNode->asJSValue());
+            if (type == SpecAnyIntAsDouble && enableInt52())
+                type = SpecInt52Only;
+            setPrediction(type);
+            break;
+        }
+        case DoubleConstant: {
+            SpeculatedType type = speculationFromValue(m_currentNode->asJSValue());
+            setPrediction(type);
+            break;
+        }
+        case BitAnd:
+        case BitOr:
+        case BitXor:
+        case BitRShift:
+        case BitLShift:
+        case BitURShift:
+        case ArithIMul:
+        case ArithClz32: {
+            setPrediction(SpecInt32Only);
+            break;
+        }
+
+        case ArrayPop:
+        case ArrayPush:
+        case RegExpExec:
+        case RegExpTest:
+        case StringReplace:
+        case StringReplaceRegExp:
+        case GetById:
+        case GetByIdFlush:
+        case GetByIdWithThis:
+        case TryGetById:
+        case GetByValWithThis:
+        case GetByOffset:
+        case MultiGetByOffset:
+        case GetDirectPname:
+        case Call:
+        case DirectCall:
+        case TailCallInlinedCaller:
+        case DirectTailCallInlinedCaller:
+        case Construct:
+        case DirectConstruct:
+        case CallVarargs:
+        case CallEval:
+        case TailCallVarargsInlinedCaller:
+        case ConstructVarargs:
+        case CallForwardVarargs:
+        case ConstructForwardVarargs:
+        case TailCallForwardVarargsInlinedCaller:
+        case GetGlobalVar:
+        case GetGlobalLexicalVariable:
+        case GetClosureVar:
+        case GetFromArguments:
+        case LoadFromJSMapBucket:
+        case ToNumber:
+        case GetArgument:
+        case CallDOMGetter: {
+            setPrediction(m_currentNode->getHeapPrediction());
+            break;
+        }
+
+        case GetDynamicVar: {
+            setPrediction(SpecBytecodeTop);
+            break;
+        }
+            
+        case GetGetterSetterByOffset:
+        case GetExecutable: {
+            setPrediction(SpecCellOther);
+            break;
+        }
+
+        case GetGetter:
+        case GetSetter:
+        case GetCallee:
+        case NewFunction:
+        case NewGeneratorFunction:
+        case NewAsyncFunction: {
+            setPrediction(SpecFunction);
+            break;
+        }
+            
+        case GetArgumentCountIncludingThis: {
+            setPrediction(SpecInt32Only);
+            break;
+        }
+
+        case MapHash:
+            setPrediction(SpecInt32Only);
+            break;
+        case GetMapBucket:
+            setPrediction(SpecCellOther);
+            break;
+        case IsNonEmptyMapBucket:
+            setPrediction(SpecBoolean);
+            break;
+
+        case GetRestLength: {
+            setPrediction(SpecInt32Only);
+            break;
+        }
+
+        case GetTypedArrayByteOffset:
+        case GetArrayLength: {
+            setPrediction(SpecInt32Only);
+            break;
+        }
+
+        case StringCharCodeAt: {
+            setPrediction(SpecInt32Only);
+            break;
+        }
+
+        case ToLowerCase:
+            setPrediction(SpecString);
+            break;
+
+        case ArithPow:
+        case ArithSqrt:
+        case ArithFRound:
+        case ArithSin:
+        case ArithCos:
+        case ArithTan:
+        case ArithLog: {
+            setPrediction(SpecBytecodeDouble);
+            break;
+        }
+
+        case ArithRound:
+        case ArithFloor:
+        case ArithCeil:
+        case ArithTrunc: {
+            if (isInt32OrBooleanSpeculation(m_currentNode->getHeapPrediction())
+                && m_graph.roundShouldSpeculateInt32(m_currentNode, m_pass))
+                setPrediction(SpecInt32Only);
+            else
+                setPrediction(SpecBytecodeDouble);
+            break;
+        }
+
+        case ArithRandom: {
+            setPrediction(SpecDoubleReal);
+            break;
+        }
+        case DeleteByVal:
+        case DeleteById:
+        case LogicalNot:
+        case CompareLess:
+        case CompareLessEq:
+        case CompareGreater:
+        case CompareGreaterEq:
+        case CompareEq:
+        case CompareStrictEq:
+        case CompareEqPtr:
+        case OverridesHasInstance:
+        case InstanceOf:
+        case InstanceOfCustom:
+        case IsEmpty:
+        case IsUndefined:
+        case IsBoolean:
+        case IsNumber:
+        case IsObject:
+        case IsObjectOrNull:
+        case IsFunction:
+        case IsCellWithType:
+        case IsTypedArrayView: {
+            setPrediction(SpecBoolean);
+            break;
+        }
+
+        case TypeOf: {
+            setPrediction(SpecStringIdent);
+            break;
+        }
+        case GetButterfly:
+        case GetIndexedPropertyStorage:
+        case AllocatePropertyStorage:
+        case ReallocatePropertyStorage: {
+            setPrediction(SpecOther);
+            break;
+        }
+
+        case CheckDOM:
+            break;
+
+        case CallObjectConstructor: {
+            setPrediction(SpecObject);
+            break;
+        }
+        case SkipScope:
+        case GetGlobalObject: {
+            setPrediction(SpecObjectOther);
+            break;
+        }
+
+        case ResolveScope: {
+            setPrediction(SpecObjectOther);
+            break;
+        }
+            
+        case CreateThis:
+        case NewObject: {
+            setPrediction(SpecFinalObject);
+            break;
+        }
+            
+        case ArraySlice:
+        case NewArrayWithSpread:
+        case NewArray:
+        case NewArrayWithSize:
+        case CreateRest:
+        case NewArrayBuffer: {
+            setPrediction(SpecArray);
+            break;
+        }
+
+        case Spread:
+            setPrediction(SpecCellOther);
+            break;
+            
+        case NewTypedArray: {
+            setPrediction(speculationFromTypedArrayType(m_currentNode->typedArrayType()));
+            break;
+        }
+            
+        case NewRegexp: {
+            setPrediction(SpecRegExpObject);
+            break;
+        }
+            
+        case CreateActivation: {
+            setPrediction(SpecObjectOther);
+            break;
+        }
+        
+        case StringFromCharCode: {
+            setPrediction(SpecString);
+            m_currentNode->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsInt);
+            break;
+        }
+        case StringCharAt:
+        case CallStringConstructor:
+        case ToString:
+        case MakeRope:
+        case StrCat: {
+            setPrediction(SpecString);
+            break;
+        }
+        case NewStringObject: {
+            setPrediction(SpecStringObject);
+            break;
+        }
+            
+        case CreateDirectArguments: {
+            setPrediction(SpecDirectArguments);
+            break;
+        }
+            
+        case CreateScopedArguments: {
+            setPrediction(SpecScopedArguments);
+            break;
+        }
+            
+        case CreateClonedArguments: {
+            setPrediction(SpecObjectOther);
+            break;
+        }
+            
+        case FiatInt52: {
+            RELEASE_ASSERT(enableInt52());
+            setPrediction(SpecAnyInt);
+            break;
+        }
+
+        case GetScope:
+            setPrediction(SpecObjectOther);
+            break;
+
+        case In:
+            setPrediction(SpecBoolean);
+            break;
+
+        case HasOwnProperty:
+            setPrediction(SpecBoolean);
+            break;
+
+        case GetEnumerableLength: {
+            setPrediction(SpecInt32Only);
+            break;
+        }
+        case HasGenericProperty:
+        case HasStructureProperty:
+        case HasIndexedProperty: {
+            setPrediction(SpecBoolean);
+            break;
+        }
+        case GetPropertyEnumerator: {
+            setPrediction(SpecCell);
+            break;
+        }
+        case GetEnumeratorStructurePname: {
+            setPrediction(SpecCell | SpecOther);
+            break;
+        }
+        case GetEnumeratorGenericPname: {
+            setPrediction(SpecCell | SpecOther);
+            break;
+        }
+        case ToIndexString: {
+            setPrediction(SpecString);
+            break;
+        }
+
+        case GetLocal:
+        case SetLocal:
+        case UInt32ToNumber:
+        case ValueAdd:
+        case ArithAdd:
+        case ArithSub:
+        case ArithNegate:
+        case ArithMin:
+        case ArithMax:
+        case ArithMul:
+        case ArithDiv:
+        case ArithMod:
+        case ArithAbs:
+        case GetByVal:
+        case ToThis:
+        case ToPrimitive: {
+            m_dependentNodes.append(m_currentNode);
+            break;
+        }
+
+        case PutByValAlias:
+        case DoubleAsInt32:
+        case GetLocalUnlinked:
+        case CheckArray:
+        case CheckTypeInfoFlags:
+        case Arrayify:
+        case ArrayifyToStructure:
+        case CheckTierUpInLoop:
+        case CheckTierUpAtReturn:
+        case CheckTierUpAndOSREnter:
+        case InvalidationPoint:
+        case CheckInBounds:
+        case ValueToInt32:
+        case DoubleRep:
+        case ValueRep:
+        case Int52Rep:
+        case Int52Constant:
+        case Identity:
+        case BooleanToNumber:
+        case PhantomNewObject:
+        case PhantomNewFunction:
+        case PhantomNewGeneratorFunction:
+        case PhantomNewAsyncFunction:
+        case PhantomCreateActivation:
+        case PhantomDirectArguments:
+        case PhantomCreateRest:
+        case PhantomSpread:
+        case PhantomNewArrayWithSpread:
+        case PhantomClonedArguments:
+        case GetMyArgumentByVal:
+        case GetMyArgumentByValOutOfBounds:
+        case PutHint:
+        case CheckStructureImmediate:
+        case MaterializeNewObject:
+        case MaterializeCreateActivation:
+        case PutStack:
+        case KillStack:
+        case StoreBarrier:
+        case FencedStoreBarrier:
+        case GetStack:
+        case GetRegExpObjectLastIndex:
+        case SetRegExpObjectLastIndex:
+        case RecordRegExpCachedResult:
+        case LazyJSConstant:
+        case CallDOM: {
+            // This node should never be visible at this stage of compilation. It is
+            // inserted by fixup(), which follows this phase.
+            DFG_CRASH(m_graph, m_currentNode, "Unexpected node during prediction propagation");
+            break;
+        }
+        
+        case Phi:
+            // Phis should not be visible here since we're iterating the all-but-Phi's
+            // part of basic blocks.
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+            
+        case Upsilon:
+            // These don't get inserted until we go into SSA.
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+
+#ifndef NDEBUG
+        // These get ignored because they don't return anything.
+        case PutByValDirect:
+        case PutByValWithThis:
+        case PutByIdWithThis:
+        case PutByVal:
+        case PutClosureVar:
+        case PutToArguments:
+        case Return:
+        case TailCall:
+        case DirectTailCall:
+        case TailCallVarargs:
+        case TailCallForwardVarargs:
+        case Throw:
+        case PutById:
+        case PutByIdFlush:
+        case PutByIdDirect:
+        case PutByOffset:
+        case MultiPutByOffset:
+        case PutGetterById:
+        case PutSetterById:
+        case PutGetterSetterById:
+        case PutGetterByVal:
+        case PutSetterByVal:
+        case DefineDataProperty:
+        case DefineAccessorProperty:
+        case DFG::Jump:
+        case Branch:
+        case Switch:
+        case ProfileType:
+        case ProfileControlFlow:
+        case ThrowStaticError:
+        case ForceOSRExit:
+        case SetArgument:
+        case SetFunctionName:
+        case CheckStructure:
+        case CheckCell:
+        case CheckNotEmpty:
+        case CheckStringIdent:
+        case CheckBadCell:
+        case PutStructure:
+        case Phantom:
+        case Check:
+        case PutGlobalVariable:
+        case CheckWatchdogTimer:
+        case LogShadowChickenPrologue:
+        case LogShadowChickenTail:
+        case Unreachable:
+        case LoopHint:
+        case NotifyWrite:
+        case ConstantStoragePointer:
+        case MovHint:
+        case ZombieHint:
+        case ExitOK:
+        case LoadVarargs:
+        case ForwardVarargs:
+        case PutDynamicVar:
+        case NukeStructureAndSetButterfly:
+            break;
+            
+        // This gets ignored because it only pretends to produce a value.
+        case BottomValue:
+            break;
+            
+        // This gets ignored because it already has a prediction.
+        case ExtractOSREntryLocal:
+            break;
+            
+        // These gets ignored because it doesn't do anything.
+        case CountExecution:
+        case PhantomLocal:
+        case Flush:
+            break;
+            
+        case LastNodeType:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+#else
+        default:
+            break;
+#endif
+        }
+    }
+
+    SpeculatedType resultOfToPrimitive(SpeculatedType type)
+    {
+        if (type & SpecObject) {
+            // We try to be optimistic here about StringObjects since it's unlikely that
+            // someone overrides the valueOf or toString methods.
+            if (type & SpecStringObject && m_graph.canOptimizeStringObjectAccess(m_currentNode->origin.semantic))
+                return mergeSpeculations(type & ~SpecObject, SpecString);
+
+            return mergeSpeculations(type & ~SpecObject, SpecPrimitive);
+        }
+
+        return type;
+    }
+
+    Vector<Node*> m_dependentNodes;
+    Node* m_currentNode;
+    bool m_changed;
+    PredictionPass m_pass; // We use different logic for considering predictions depending on how far along we are in propagation.
+};
+
+} // Anonymous namespace.
+    
+bool performPredictionPropagation(Graph& graph)
+{
+    return runPhase<PredictionPropagationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPredictionPropagationPhase.h b/dfg/DFGPredictionPropagationPhase.h
new file mode 100644
index 0000000..1561777
--- /dev/null
+++ b/dfg/DFGPredictionPropagationPhase.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "SpeculatedType.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Propagate predictions gathered at heap load sites by the value profiler, and
+// from slow path executions, to generate a prediction for each node in the graph.
+// This is a crucial phase of compilation, since before running this phase, we
+// have no idea what types any node (or most variables) could possibly have, unless
+// that node is either a heap load, a call, a GetLocal for an argument, or an
+// arithmetic op that had definitely taken slow path. Most nodes (even most
+// arithmetic nodes) do not qualify for any of these categories. But after running
+// this phase, we'll have full information for the expected type of each node.
+
+bool performPredictionPropagation(Graph&);
+
+// Helper used for FixupPhase for computing the predicted type of a ToPrimitive.
+SpeculatedType resultOfToPrimitive(SpeculatedType);
+
+} } // namespace JSC::DFG::Phase
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPromotedHeapLocation.cpp b/dfg/DFGPromotedHeapLocation.cpp
new file mode 100644
index 0000000..62dbb10
--- /dev/null
+++ b/dfg/DFGPromotedHeapLocation.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPromotedHeapLocation.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void PromotedLocationDescriptor::dump(PrintStream& out) const
+{
+    out.print(m_kind, "(", m_info, ")");
+}
+
+Node* PromotedHeapLocation::createHint(Graph& graph, NodeOrigin origin, Node* value)
+{
+    return graph.addNode(
+        SpecNone, PutHint, origin, OpInfo(descriptor().imm1()), OpInfo(descriptor().imm2()),
+        base()->defaultEdge(), value->defaultEdge());
+}
+
+void PromotedHeapLocation::dump(PrintStream& out) const
+{
+    out.print(kind(), "(", m_base, ", ", info(), ")");
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, PromotedLocationKind kind)
+{
+    switch (kind) {
+    case InvalidPromotedLocationKind:
+        out.print("InvalidPromotedLocationKind");
+        return;
+        
+    case StructurePLoc:
+        out.print("StructurePLoc");
+        return;
+
+    case ActivationSymbolTablePLoc:
+        out.print("ActivationSymbolTablePLoc");
+        return;
+        
+    case NamedPropertyPLoc:
+        out.print("NamedPropertyPLoc");
+        return;
+
+    case IndexedPropertyPLoc:
+        out.print("IndexedPropertyPLoc");
+        return;
+        
+    case ArgumentPLoc:
+        out.print("ArgumentPLoc");
+        return;
+        
+    case ArgumentCountPLoc:
+        out.print("ArgumentCountPLoc");
+        return;
+        
+    case ArgumentsCalleePLoc:
+        out.print("ArgumentsCalleePLoc");
+        return;
+
+    case FunctionExecutablePLoc:
+        out.print("FunctionExecutablePLoc");
+        return;
+
+    case FunctionActivationPLoc:
+        out.print("FunctionActivationPLoc");
+        return;
+
+    case ActivationScopePLoc:
+        out.print("ActivationScopePLoc");
+        return;
+
+    case ClosureVarPLoc:
+        out.print("ClosureVarPLoc");
+        return;
+
+    case PublicLengthPLoc:
+        out.print("PublicLengthPLoc");
+        return;
+
+    case VectorLengthPLoc:
+        out.print("VectorLengthPLoc");
+        return;
+
+    case SpreadPLoc:
+        out.print("SpreadPLoc");
+        return;
+
+    case NewArrayWithSpreadArgumentPLoc:
+        out.print("NewArrayWithSpreadArgumentPLoc");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF;
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPromotedHeapLocation.h b/dfg/DFGPromotedHeapLocation.h
new file mode 100644
index 0000000..c4707f4
--- /dev/null
+++ b/dfg/DFGPromotedHeapLocation.h
@@ -0,0 +1,234 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGEdge.h"
+#include "DFGNodeOrigin.h"
+#include "DFGOpInfo.h"
+#include <wtf/HashTable.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+struct Node;
+
+// Promoted locations are like heap locations but are meant to be more precise. A heap location is
+// applicable to CSE scenarios, where it makes sense to speak of a location very abstractly. A
+// promoted heap location is for cases where we speak of a specific object and the compiler knows
+// this object's identity - for example, the object allocation has been eliminated and we turned the
+// fields into local variables. Because these two cases have subtly different needs, we use subtly
+// different structures. One of the really significant differences is that promoted locations can be
+// spoken of using either a descriptor which does not refer to any Node*'s or with a heap location,
+// which is a descriptor with a Node* base.
+
+enum PromotedLocationKind {
+    InvalidPromotedLocationKind,
+    
+    ActivationScopePLoc,
+    ActivationSymbolTablePLoc,
+    ArgumentCountPLoc,
+    ArgumentPLoc,
+    ArgumentsCalleePLoc,
+    ClosureVarPLoc,
+    FunctionActivationPLoc,
+    FunctionExecutablePLoc,
+    IndexedPropertyPLoc,
+    NamedPropertyPLoc,
+    PublicLengthPLoc,
+    StructurePLoc,
+    VectorLengthPLoc,
+    SpreadPLoc,
+    NewArrayWithSpreadArgumentPLoc,
+};
+
+class PromotedLocationDescriptor {
+public:
+    PromotedLocationDescriptor(
+        PromotedLocationKind kind = InvalidPromotedLocationKind, unsigned info = 0)
+        : m_kind(kind)
+        , m_info(info)
+    {
+    }
+
+    PromotedLocationDescriptor(WTF::HashTableDeletedValueType)
+        : m_kind(InvalidPromotedLocationKind)
+        , m_info(1)
+    {
+    }
+
+    bool operator!() const { return m_kind == InvalidPromotedLocationKind; }
+
+    explicit operator bool() const { return !!*this; }
+    
+    PromotedLocationKind kind() const { return m_kind; }
+    unsigned info() const { return m_info; }
+    
+    unsigned imm1() const { return static_cast<uint32_t>(m_kind); }
+    unsigned imm2() const { return static_cast<uint32_t>(m_info); }
+    
+    unsigned hash() const
+    {
+        return m_kind + m_info;
+    }
+    
+    bool operator==(const PromotedLocationDescriptor& other) const
+    {
+        return m_kind == other.m_kind
+            && m_info == other.m_info;
+    }
+    
+    bool operator!=(const PromotedLocationDescriptor& other) const
+    {
+        return !(*this == other);
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return m_kind == InvalidPromotedLocationKind && m_info;
+    }
+
+    bool neededForMaterialization() const
+    {
+        switch (kind()) {
+        case NamedPropertyPLoc:
+        case ClosureVarPLoc:
+            return false;
+
+        default:
+            return true;
+        }
+    }
+    
+    void dump(PrintStream& out) const;
+
+private:
+    PromotedLocationKind m_kind;
+    unsigned m_info;
+};
+
+struct PromotedLocationDescriptorHash {
+    static unsigned hash(const PromotedLocationDescriptor& key) { return key.hash(); }
+    static bool equal(const PromotedLocationDescriptor& a, const PromotedLocationDescriptor& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+class PromotedHeapLocation {
+public:
+    PromotedHeapLocation(
+        PromotedLocationKind kind = InvalidPromotedLocationKind,
+        Node* base = nullptr, unsigned info = 0)
+        : m_base(base)
+        , m_meta(kind, info)
+    {
+    }
+    
+    PromotedHeapLocation(
+        PromotedLocationKind kind, Edge base, unsigned info = 0)
+        : PromotedHeapLocation(kind, base.node(), info)
+    {
+    }
+    
+    PromotedHeapLocation(Node* base, PromotedLocationDescriptor meta)
+        : m_base(base)
+        , m_meta(meta)
+    {
+    }
+    
+    PromotedHeapLocation(WTF::HashTableDeletedValueType)
+        : m_base(nullptr)
+        , m_meta(InvalidPromotedLocationKind, 1)
+    {
+    }
+    
+    Node* createHint(Graph&, NodeOrigin, Node* value);
+    
+    bool operator!() const { return kind() == InvalidPromotedLocationKind; }
+    
+    PromotedLocationKind kind() const { return m_meta.kind(); }
+    Node* base() const { return m_base; }
+    unsigned info() const { return m_meta.info(); }
+    PromotedLocationDescriptor descriptor() const { return m_meta; }
+    
+    unsigned hash() const
+    {
+        return m_meta.hash() + WTF::PtrHash<Node*>::hash(m_base);
+    }
+    
+    bool operator==(const PromotedHeapLocation& other) const
+    {
+        return m_base == other.m_base
+            && m_meta == other.m_meta;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return m_meta.isHashTableDeletedValue();
+    }
+    
+    void dump(PrintStream& out) const;
+    
+private:
+    Node* m_base;
+    PromotedLocationDescriptor m_meta;
+};
+
+struct PromotedHeapLocationHash {
+    static unsigned hash(const PromotedHeapLocation& key) { return key.hash(); }
+    static bool equal(const PromotedHeapLocation& a, const PromotedHeapLocation& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::PromotedLocationKind);
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::PromotedHeapLocation> {
+    typedef JSC::DFG::PromotedHeapLocationHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::PromotedHeapLocation> : SimpleClassHashTraits<JSC::DFG::PromotedHeapLocation> {
+    static const bool emptyValueIsZero = false;
+};
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::PromotedLocationDescriptor> {
+    typedef JSC::DFG::PromotedLocationDescriptorHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::PromotedLocationDescriptor> : SimpleClassHashTraits<JSC::DFG::PromotedLocationDescriptor> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPropertyTypeKey.h b/dfg/DFGPropertyTypeKey.h
new file mode 100644
index 0000000..c2adc8e
--- /dev/null
+++ b/dfg/DFGPropertyTypeKey.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "Structure.h"
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace DFG {
+
+// This object is a key for finding a property's type. It's a tuple of Structure* and UniquedStringImpl*.
+
+class PropertyTypeKey {
+public:
+    PropertyTypeKey()
+        : m_structure(nullptr)
+        , m_uid(nullptr)
+    {
+    }
+
+    PropertyTypeKey(Structure* structure, UniquedStringImpl* uid)
+        : m_structure(structure)
+        , m_uid(uid)
+    {
+    }
+
+    PropertyTypeKey(WTF::HashTableDeletedValueType)
+        : m_structure(nullptr)
+        , m_uid(deletedUID())
+    {
+    }
+
+    explicit operator bool() const { return m_structure && m_uid; }
+
+    Structure* structure() const { return m_structure; }
+    UniquedStringImpl* uid() const { return m_uid; }
+
+    bool operator==(const PropertyTypeKey& other) const
+    {
+        return m_structure == other.m_structure
+            && m_uid == other.m_uid;
+    }
+
+    bool operator!=(const PropertyTypeKey& other) const
+    {
+        return !(*this == other);
+    }
+
+    unsigned hash() const
+    {
+        return WTF::PtrHash<Structure*>::hash(m_structure) + WTF::PtrHash<UniquedStringImpl*>::hash(m_uid);
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+        return !m_structure && m_uid == deletedUID();
+    }
+
+    void dumpInContext(PrintStream& out, DumpContext* context) const
+    {
+        out.print(pointerDumpInContext(m_structure, context), "+", m_uid);
+    }
+
+    void dump(PrintStream& out) const
+    {
+        dumpInContext(out, nullptr);
+    }
+
+private:
+    static UniquedStringImpl* deletedUID()
+    {
+        return bitwise_cast<UniquedStringImpl*>(static_cast<intptr_t>(1));
+    }
+    
+    Structure* m_structure;
+    UniquedStringImpl* m_uid;
+};
+
+struct PropertyTypeKeyHash {
+    static unsigned hash(const PropertyTypeKey& key) { return key.hash(); }
+    static bool equal(const PropertyTypeKey& a, const PropertyTypeKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::PropertyTypeKey> {
+    typedef JSC::DFG::PropertyTypeKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::PropertyTypeKey> : SimpleClassHashTraits<JSC::DFG::PropertyTypeKey> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPureValue.cpp b/dfg/DFGPureValue.cpp
new file mode 100644
index 0000000..4c9f60c
--- /dev/null
+++ b/dfg/DFGPureValue.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPureValue.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+void PureValue::dump(PrintStream& out) const
+{
+    out.print(Graph::opName(op()));
+    out.print("(");
+    CommaPrinter comma;
+    for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
+        if (children().child(i))
+            out.print(comma, children().child(i));
+    }
+    if (m_info)
+        out.print(comma, m_info);
+    out.print(")");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPureValue.h b/dfg/DFGPureValue.h
new file mode 100644
index 0000000..2549c5d
--- /dev/null
+++ b/dfg/DFGPureValue.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNode.h"
+
+namespace JSC { namespace DFG {
+
+class PureValue {
+public:
+    PureValue()
+        : m_op(LastNodeType)
+        , m_info(0)
+    {
+    }
+    
+    PureValue(NodeType op, const AdjacencyList& children, uintptr_t info)
+        : m_op(op)
+        , m_children(children.sanitized())
+        , m_info(info)
+    {
+        ASSERT(!(defaultFlags(op) & NodeHasVarArgs));
+    }
+    
+    PureValue(NodeType op, const AdjacencyList& children, const void* ptr)
+        : PureValue(op, children, bitwise_cast<uintptr_t>(ptr))
+    {
+    }
+    
+    PureValue(NodeType op, const AdjacencyList& children)
+        : PureValue(op, children, static_cast<uintptr_t>(0))
+    {
+    }
+    
+    PureValue(Node* node, uintptr_t info)
+        : PureValue(node->op(), node->children, info)
+    {
+    }
+    
+    PureValue(Node* node, const void* ptr)
+        : PureValue(node->op(), node->children, ptr)
+    {
+    }
+    
+    PureValue(Node* node)
+        : PureValue(node->op(), node->children)
+    {
+    }
+    
+    PureValue(WTF::HashTableDeletedValueType)
+        : m_op(LastNodeType)
+        , m_info(1)
+    {
+    }
+    
+    bool operator!() const { return m_op == LastNodeType && !m_info; }
+    
+    NodeType op() const { return m_op; }
+    const AdjacencyList& children() const { return m_children; }
+    uintptr_t info() const { return m_info; }
+
+    unsigned hash() const
+    {
+        return WTF::IntHash<int>::hash(static_cast<int>(m_op)) + m_children.hash() + m_info;
+    }
+    
+    bool operator==(const PureValue& other) const
+    {
+        return m_op == other.m_op
+            && m_children == other.m_children
+            && m_info == other.m_info;
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return m_op == LastNodeType && m_info;
+    }
+    
+    void dump(PrintStream& out) const;
+    
+private:
+    NodeType m_op;
+    AdjacencyList m_children;
+    uintptr_t m_info;
+};
+
+struct PureValueHash {
+    static unsigned hash(const PureValue& key) { return key.hash(); }
+    static bool equal(const PureValue& a, const PureValue& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::DFG::PureValue> {
+    typedef JSC::DFG::PureValueHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::DFG::PureValue> : SimpleClassHashTraits<JSC::DFG::PureValue> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+namespace JSC { namespace DFG {
+
+typedef HashMap<PureValue, Node*> PureMap;
+typedef HashMap<PureValue, Vector<Node*>> PureMultiMap;
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGPutStackSinkingPhase.cpp b/dfg/DFGPutStackSinkingPhase.cpp
new file mode 100644
index 0000000..78162c7
--- /dev/null
+++ b/dfg/DFGPutStackSinkingPhase.cpp
@@ -0,0 +1,592 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGPutStackSinkingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockMapInlines.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGPreciseLocalClobberize.h"
+#include "DFGSSACalculator.h"
+#include "DFGValidate.h"
+#include "JSCInlines.h"
+#include "OperandsInlines.h"
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verbose = false;
+
+class PutStackSinkingPhase : public Phase {
+public:
+    PutStackSinkingPhase(Graph& graph)
+        : Phase(graph, "PutStack sinking")
+    {
+    }
+    
+    bool run()
+    {
+        // FIXME: One of the problems of this approach is that it will create a duplicate Phi graph
+        // for sunken PutStacks in the presence of interesting control flow merges, and where the
+        // value being PutStack'd is also otherwise live in the DFG code. We could work around this
+        // by doing the sinking over CPS, or maybe just by doing really smart hoisting. It's also
+        // possible that the duplicate Phi graph can be deduplicated by B3. It would be best if we
+        // could observe that there is already a Phi graph in place that does what we want. In
+        // principle if we have a request to place a Phi at a particular place, we could just check
+        // if there is already a Phi that does what we want. Because PutStackSinkingPhase runs just
+        // after SSA conversion, we have almost a guarantee that the Phi graph we produce here would
+        // be trivially redundant to the one we already have.
+        
+        // FIXME: This phase doesn't adequately use KillStacks. KillStack can be viewed as a def.
+        // This is mostly inconsequential; it would be a bug to have a local live at a KillStack.
+        // More important is that KillStack should swallow any deferral. After a KillStack, the
+        // local should behave like a TOP deferral because it would be invalid for anyone to trust
+        // the stack. It's not clear to me if this is important or not.
+        // https://bugs.webkit.org/show_bug.cgi?id=145296
+        
+        if (verbose) {
+            dataLog("Graph before PutStack sinking:\n");
+            m_graph.dump();
+        }
+
+        m_graph.ensureDominators();
+        
+        SSACalculator ssaCalculator(m_graph);
+        InsertionSet insertionSet(m_graph);
+        
+        // First figure out where various locals are live.
+        BlockMap<Operands<bool>> liveAtHead(m_graph);
+        BlockMap<Operands<bool>> liveAtTail(m_graph);
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            liveAtHead[block] = Operands<bool>(OperandsLike, block->variablesAtHead);
+            liveAtTail[block] = Operands<bool>(OperandsLike, block->variablesAtHead);
+            
+            liveAtHead[block].fill(false);
+            liveAtTail[block].fill(false);
+        }
+        
+        bool changed;
+        do {
+            changed = false;
+            
+            for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+                BasicBlock* block = m_graph.block(blockIndex);
+                if (!block)
+                    continue;
+                
+                Operands<bool> live = liveAtTail[block];
+                for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+                    Node* node = block->at(nodeIndex);
+                    if (verbose)
+                        dataLog("Live at ", node, ": ", live, "\n");
+                    
+                    Vector<VirtualRegister, 4> reads;
+                    Vector<VirtualRegister, 4> writes;
+                    auto escapeHandler = [&] (VirtualRegister operand) {
+                        if (operand.isHeader())
+                            return;
+                        if (verbose)
+                            dataLog("    ", operand, " is live at ", node, "\n");
+                        reads.append(operand);
+                    };
+
+                    auto writeHandler = [&] (VirtualRegister operand) {
+                        RELEASE_ASSERT(node->op() == PutStack || node->op() == LoadVarargs || node->op() == ForwardVarargs);
+                        writes.append(operand);
+                    };
+
+                    preciseLocalClobberize(
+                        m_graph, node, escapeHandler, writeHandler,
+                        [&] (VirtualRegister, LazyNode) { });
+
+                    for (VirtualRegister operand : writes)
+                        live.operand(operand) = false;
+                    for (VirtualRegister operand : reads)
+                        live.operand(operand) = true;
+                }
+                
+                if (live == liveAtHead[block])
+                    continue;
+                
+                liveAtHead[block] = live;
+                changed = true;
+                
+                for (BasicBlock* predecessor : block->predecessors) {
+                    for (size_t i = live.size(); i--;)
+                        liveAtTail[predecessor][i] |= live[i];
+                }
+            }
+            
+        } while (changed);
+        
+        // All of the arguments should be live at head of root. Note that we may find that some
+        // locals are live at head of root. This seems wrong but isn't. This will happen for example
+        // if the function accesses closure variable #42 for some other function and we either don't
+        // have variable #42 at all or we haven't set it at root, for whatever reason. Basically this
+        // arises since our aliasing for closure variables is conservatively based on variable number
+        // and ignores the owning symbol table. We should probably fix this eventually and make our
+        // aliasing more precise.
+        //
+        // For our purposes here, the imprecision in the aliasing is harmless. It just means that we
+        // may not do as much Phi pruning as we wanted.
+        for (size_t i = liveAtHead.atIndex(0).numberOfArguments(); i--;)
+            DFG_ASSERT(m_graph, nullptr, liveAtHead.atIndex(0).argument(i));
+        
+        // Next identify where we would want to sink PutStacks to. We say that there is a deferred
+        // flush if we had a PutStack with a given FlushFormat but it hasn't been materialized yet.
+        // Deferrals have the following lattice; but it's worth noting that the TOP part of the
+        // lattice serves an entirely different purpose than the rest of the lattice: it just means
+        // that we're in a region of code where nobody should have been relying on the value. The
+        // rest of the lattice means that we either have a PutStack that is deferred (i.e. still
+        // needs to be executed) or there isn't one (because we've alraedy executed it).
+        //
+        // Bottom:
+        //     Represented as DeadFlush. 
+        //     Means that all previous PutStacks have been executed so there is nothing deferred.
+        //     During merging this is subordinate to the other kinds of deferrals, because it
+        //     represents the fact that we've already executed all necessary PutStacks. This implies
+        //     that there *had* been some PutStacks that we should have executed.
+        //
+        // Top:
+        //     Represented as ConflictingFlush.
+        //     Represents the fact that we know, via forward flow, that there isn't any value in the
+        //     given local that anyone should have been relying on. This comes into play at the
+        //     prologue (because in SSA form at the prologue no local has any value) or when we merge
+        //     deferrals for different formats's. A lexical scope in which a local had some semantic
+        //     meaning will by this point share the same format; if we had stores from different
+        //     lexical scopes that got merged together then we may have a conflicting format. Hence
+        //     a conflicting format proves that we're no longer in an area in which the variable was
+        //     in scope. Note that this is all approximate and only precise enough to later answer
+        //     questions pertinent to sinking. For example, this doesn't always detect when a local
+        //     is no longer semantically relevant - we may well have a deferral from inside some
+        //     inlined call survive outside of that inlined code, and this is generally OK. In the
+        //     worst case it means that we might think that a deferral that is actually dead must
+        //     still be executed. But we usually catch that with liveness. Liveness usually catches
+        //     such cases, but that's not guaranteed since liveness is conservative.
+        //
+        //     What Top does give us is detects situations where we both don't need to care about a
+        //     deferral and there is no way that we could reason about it anyway. If we merged
+        //     deferrals for different formats then we wouldn't know the format to use. So, we use
+        //     Top in that case because that's also a case where we know that we can ignore the
+        //     deferral.
+        //
+        // Deferral with a concrete format:
+        //     Represented by format values other than DeadFlush or ConflictingFlush.
+        //     Represents the fact that the original code would have done a PutStack but we haven't
+        //     identified an operation that would have observed that PutStack.
+        //
+        // We need to be precise about liveness in this phase because not doing so
+        // could cause us to insert a PutStack before a node we thought may escape a 
+        // value that it doesn't really escape. Sinking this PutStack above such a node may
+        // cause us to insert a GetStack that we forward to the Phi we're feeding into the
+        // sunken PutStack. Inserting such a GetStack could cause us to load garbage and
+        // can confuse the AI to claim untrue things (like that the program will exit when
+        // it really won't).
+        BlockMap<Operands<FlushFormat>> deferredAtHead(m_graph);
+        BlockMap<Operands<FlushFormat>> deferredAtTail(m_graph);
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            deferredAtHead[block] =
+                Operands<FlushFormat>(OperandsLike, block->variablesAtHead);
+            deferredAtTail[block] =
+                Operands<FlushFormat>(OperandsLike, block->variablesAtHead);
+        }
+
+        for (unsigned local = deferredAtHead.atIndex(0).numberOfLocals(); local--;)
+            deferredAtHead.atIndex(0).local(local) = ConflictingFlush;
+        
+        do {
+            changed = false;
+            
+            for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+                Operands<FlushFormat> deferred = deferredAtHead[block];
+                
+                for (Node* node : *block) {
+                    if (verbose)
+                        dataLog("Deferred at ", node, ":", deferred, "\n");
+                    
+                    if (node->op() == GetStack) {
+                        // Handle the case that the input doesn't match our requirements. This is
+                        // really a bug, but it's a benign one if we simply don't run this phase.
+                        // It usually arises because of patterns like:
+                        //
+                        // if (thing)
+                        //     PutStack()
+                        // ...
+                        // if (thing)
+                        //     GetStack()
+                        //
+                        // Or:
+                        //
+                        // if (never happens)
+                        //     GetStack()
+                        //
+                        // Because this phase runs early in SSA, it should be sensible to enforce
+                        // that no such code pattern has arisen yet. So, when validation is
+                        // enabled, we assert that we aren't seeing this. But with validation
+                        // disabled we silently let this fly and we just abort this phase.
+                        // FIXME: Get rid of all remaining cases of conflicting GetStacks.
+                        // https://bugs.webkit.org/show_bug.cgi?id=150398
+
+                        bool isConflicting =
+                            deferred.operand(node->stackAccessData()->local) == ConflictingFlush;
+                        
+                        if (validationEnabled())
+                            DFG_ASSERT(m_graph, node, !isConflicting);
+
+                        if (isConflicting) {
+                            // Oh noes! Abort!!
+                            return false;
+                        }
+
+                        // A GetStack doesn't affect anything, since we know which local we are reading
+                        // from.
+                        continue;
+                    } else if (node->op() == PutStack) {
+                        VirtualRegister operand = node->stackAccessData()->local;
+                        deferred.operand(operand) = node->stackAccessData()->format;
+                        continue;
+                    }
+                    
+                    auto escapeHandler = [&] (VirtualRegister operand) {
+                        if (verbose)
+                            dataLog("For ", node, " escaping ", operand, "\n");
+                        if (operand.isHeader())
+                            return;
+                        // We will materialize just before any reads.
+                        deferred.operand(operand) = DeadFlush;
+                    };
+
+                    auto writeHandler = [&] (VirtualRegister operand) {
+                        RELEASE_ASSERT(node->op() == LoadVarargs || node->op() == ForwardVarargs);
+                        deferred.operand(operand) = DeadFlush;
+                    };
+                    
+                    preciseLocalClobberize(
+                        m_graph, node, escapeHandler, writeHandler,
+                        [&] (VirtualRegister, LazyNode) { });
+                }
+                
+                if (deferred == deferredAtTail[block])
+                    continue;
+                
+                deferredAtTail[block] = deferred;
+                changed = true;
+                
+                for (BasicBlock* successor : block->successors()) {
+                    for (size_t i = deferred.size(); i--;) {
+                        if (verbose)
+                            dataLog("Considering ", VirtualRegister(deferred.operandForIndex(i)), " at ", pointerDump(block), "->", pointerDump(successor), ": ", deferred[i], " and ", deferredAtHead[successor][i], " merges to ");
+
+                        deferredAtHead[successor][i] =
+                            merge(deferredAtHead[successor][i], deferred[i]);
+                        
+                        if (verbose)
+                            dataLog(deferredAtHead[successor][i], "\n");
+                    }
+                }
+            }
+            
+        } while (changed);
+        
+        // We wish to insert PutStacks at all of the materialization points, which are defined
+        // implicitly as the places where we set deferred to Dead while it was previously not Dead.
+        // To do this, we may need to build some Phi functions to handle stuff like this:
+        //
+        // Before:
+        //
+        //     if (p)
+        //         PutStack(r42, @x)
+        //     else
+        //         PutStack(r42, @y)
+        //
+        // After:
+        //
+        //     if (p)
+        //         Upsilon(@x, ^z)
+        //     else
+        //         Upsilon(@y, ^z)
+        //     z: Phi()
+        //     PutStack(r42, @z)
+        //
+        // This means that we have an SSACalculator::Variable for each local, and a Def is any
+        // PutStack in the original program. The original PutStacks will simply vanish.
+        
+        Operands<SSACalculator::Variable*> operandToVariable(
+            OperandsLike, m_graph.block(0)->variablesAtHead);
+        Vector<VirtualRegister> indexToOperand;
+        for (size_t i = m_graph.block(0)->variablesAtHead.size(); i--;) {
+            VirtualRegister operand(m_graph.block(0)->variablesAtHead.operandForIndex(i));
+            
+            SSACalculator::Variable* variable = ssaCalculator.newVariable();
+            operandToVariable.operand(operand) = variable;
+            ASSERT(indexToOperand.size() == variable->index());
+            indexToOperand.append(operand);
+        }
+        
+        HashSet<Node*> putStacksToSink;
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            for (Node* node : *block) {
+                switch (node->op()) {
+                case PutStack:
+                    putStacksToSink.add(node);
+                    ssaCalculator.newDef(
+                        operandToVariable.operand(node->stackAccessData()->local),
+                        block, node->child1().node());
+                    break;
+                case GetStack:
+                    ssaCalculator.newDef(
+                        operandToVariable.operand(node->stackAccessData()->local),
+                        block, node);
+                    break;
+                default:
+                    break;
+                }
+            }
+        }
+        
+        ssaCalculator.computePhis(
+            [&] (SSACalculator::Variable* variable, BasicBlock* block) -> Node* {
+                VirtualRegister operand = indexToOperand[variable->index()];
+                
+                if (!liveAtHead[block].operand(operand))
+                    return nullptr;
+                
+                FlushFormat format = deferredAtHead[block].operand(operand);
+
+                // We could have an invalid deferral because liveness is imprecise.
+                if (!isConcrete(format))
+                    return nullptr;
+
+                if (verbose)
+                    dataLog("Adding Phi for ", operand, " at ", pointerDump(block), "\n");
+                
+                Node* phiNode = m_graph.addNode(SpecHeapTop, Phi, block->at(0)->origin.withInvalidExit());
+                phiNode->mergeFlags(resultFor(format));
+                return phiNode;
+            });
+        
+        Operands<Node*> mapping(OperandsLike, m_graph.block(0)->variablesAtHead);
+        Operands<FlushFormat> deferred;
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            mapping.fill(nullptr);
+            
+            for (size_t i = mapping.size(); i--;) {
+                VirtualRegister operand(mapping.operandForIndex(i));
+                
+                SSACalculator::Variable* variable = operandToVariable.operand(operand);
+                SSACalculator::Def* def = ssaCalculator.reachingDefAtHead(block, variable);
+                if (!def)
+                    continue;
+                
+                mapping.operand(operand) = def->value();
+            }
+            
+            if (verbose)
+                dataLog("Mapping at top of ", pointerDump(block), ": ", mapping, "\n");
+            
+            for (SSACalculator::Def* phiDef : ssaCalculator.phisForBlock(block)) {
+                VirtualRegister operand = indexToOperand[phiDef->variable()->index()];
+                
+                insertionSet.insert(0, phiDef->value());
+                
+                if (verbose)
+                    dataLog("   Mapping ", operand, " to ", phiDef->value(), "\n");
+                mapping.operand(operand) = phiDef->value();
+            }
+            
+            deferred = deferredAtHead[block];
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                if (verbose)
+                    dataLog("Deferred at ", node, ":", deferred, "\n");
+                
+                switch (node->op()) {
+                case PutStack: {
+                    StackAccessData* data = node->stackAccessData();
+                    VirtualRegister operand = data->local;
+                    deferred.operand(operand) = data->format;
+                    if (verbose)
+                        dataLog("   Mapping ", operand, " to ", node->child1().node(), " at ", node, "\n");
+                    mapping.operand(operand) = node->child1().node();
+                    break;
+                }
+                    
+                case GetStack: {
+                    StackAccessData* data = node->stackAccessData();
+                    FlushFormat format = deferred.operand(data->local);
+                    if (!isConcrete(format)) {
+                        DFG_ASSERT(
+                            m_graph, node,
+                            deferred.operand(data->local) != ConflictingFlush);
+                        
+                        // This means there is no deferral. No deferral means that the most
+                        // authoritative value for this stack slot is what is stored in the stack. So,
+                        // keep the GetStack.
+                        mapping.operand(data->local) = node;
+                        break;
+                    }
+                    
+                    // We have a concrete deferral, which means a PutStack that hasn't executed yet. It
+                    // would have stored a value with a certain format. That format must match our
+                    // format. But more importantly, we can simply use the value that the PutStack would
+                    // have stored and get rid of the GetStack.
+                    DFG_ASSERT(m_graph, node, format == data->format);
+                    
+                    Node* incoming = mapping.operand(data->local);
+                    node->child1() = incoming->defaultEdge();
+                    node->convertToIdentity();
+                    break;
+                }
+                
+                default: {
+                    auto escapeHandler = [&] (VirtualRegister operand) {
+                        if (verbose)
+                            dataLog("For ", node, " escaping ", operand, "\n");
+
+                        if (operand.isHeader())
+                            return;
+                    
+                        FlushFormat format = deferred.operand(operand);
+                        if (!isConcrete(format)) {
+                            // It's dead now, rather than conflicting.
+                            deferred.operand(operand) = DeadFlush;
+                            return;
+                        }
+                    
+                        // Gotta insert a PutStack.
+                        if (verbose)
+                            dataLog("Inserting a PutStack for ", operand, " at ", node, "\n");
+
+                        Node* incoming = mapping.operand(operand);
+                        DFG_ASSERT(m_graph, node, incoming);
+                    
+                        insertionSet.insertNode(
+                            nodeIndex, SpecNone, PutStack, node->origin,
+                            OpInfo(m_graph.m_stackAccessData.add(operand, format)),
+                            Edge(incoming, uncheckedUseKindFor(format)));
+                    
+                        deferred.operand(operand) = DeadFlush;
+                    };
+
+                    auto writeHandler = [&] (VirtualRegister operand) {
+                        // LoadVarargs and ForwardVarargs are unconditional writes to the stack
+                        // locations they claim to write to. They do not read from the stack 
+                        // locations they write to. This makes those stack locations dead right 
+                        // before a LoadVarargs/ForwardVarargs. This means we should never sink
+                        // PutStacks right to this point.
+                        RELEASE_ASSERT(node->op() == LoadVarargs || node->op() == ForwardVarargs);
+                        deferred.operand(operand) = DeadFlush;
+                    };
+
+                    preciseLocalClobberize(
+                        m_graph, node, escapeHandler, writeHandler,
+                        [&] (VirtualRegister, LazyNode) { });
+                    break;
+                } }
+            }
+            
+            NodeAndIndex terminal = block->findTerminal();
+            size_t upsilonInsertionPoint = terminal.index;
+            NodeOrigin upsilonOrigin = terminal.node->origin;
+            for (BasicBlock* successorBlock : block->successors()) {
+                for (SSACalculator::Def* phiDef : ssaCalculator.phisForBlock(successorBlock)) {
+                    Node* phiNode = phiDef->value();
+                    SSACalculator::Variable* variable = phiDef->variable();
+                    VirtualRegister operand = indexToOperand[variable->index()];
+                    if (verbose)
+                        dataLog("Creating Upsilon for ", operand, " at ", pointerDump(block), "->", pointerDump(successorBlock), "\n");
+                    FlushFormat format = deferredAtHead[successorBlock].operand(operand);
+                    DFG_ASSERT(m_graph, nullptr, isConcrete(format));
+                    UseKind useKind = uncheckedUseKindFor(format);
+                    
+                    // We need to get a value for the stack slot. This phase doesn't really have a
+                    // good way of determining if a stack location got clobbered. It just knows if
+                    // there is a deferral. The lack of a deferral might mean that a PutStack or
+                    // GetStack had never happened, or it might mean that the value was read, or
+                    // that it was written. It's OK for us to make some bad decisions here, since
+                    // GCSE will clean it up anyway.
+                    Node* incoming;
+                    if (isConcrete(deferred.operand(operand))) {
+                        incoming = mapping.operand(operand);
+                        DFG_ASSERT(m_graph, phiNode, incoming);
+                    } else {
+                        // Issue a GetStack to get the value. This might introduce some redundancy
+                        // into the code, but if it's bad enough, GCSE will clean it up.
+                        incoming = insertionSet.insertNode(
+                            upsilonInsertionPoint, SpecNone, GetStack, upsilonOrigin,
+                            OpInfo(m_graph.m_stackAccessData.add(operand, format)));
+                        incoming->setResult(resultFor(format));
+                    }
+                    
+                    insertionSet.insertNode(
+                        upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,
+                        OpInfo(phiNode), Edge(incoming, useKind));
+                }
+            }
+            
+            insertionSet.execute(block);
+        }
+        
+        // Finally eliminate the sunken PutStacks by turning them into Checks. This keeps whatever
+        // type check they were doing.
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                
+                if (!putStacksToSink.contains(node))
+                    continue;
+                
+                node->remove();
+            }
+        }
+        
+        if (verbose) {
+            dataLog("Graph after PutStack sinking:\n");
+            m_graph.dump();
+        }
+        
+        return true;
+    }
+};
+
+} // anonymous namespace
+    
+bool performPutStackSinking(Graph& graph)
+{
+    return runPhase<PutStackSinkingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGPutStackSinkingPhase.h b/dfg/DFGPutStackSinkingPhase.h
new file mode 100644
index 0000000..67c9529
--- /dev/null
+++ b/dfg/DFGPutStackSinkingPhase.h
@@ -0,0 +1,42 @@
+ /*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Sinks PutStacks to the absolute latest point where they can possibly happen, which is usually
+// side-effects that may observe them. This eliminates PutStacks if it sinks them past the point of
+// their deaths.
+
+bool performPutStackSinking(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGRegisterBank.h b/dfg/DFGRegisterBank.h
new file mode 100644
index 0000000..a3323e6
--- /dev/null
+++ b/dfg/DFGRegisterBank.h
@@ -0,0 +1,365 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+
+namespace JSC { namespace DFG {
+
+// === RegisterBank ===
+//
+// This class is used to implement the GPR and FPR register banks.
+// All registers have two pieces of state associated with them:
+// a lock count (used to indicate this register is already in use
+// in code generation of the current node, and cannot be spilled or
+// allocated as a temporary), and VirtualRegister 'name', recording
+// which value (if any) a machine register currently holds.
+// Either or both of these pieces of information may be valid for a
+// given register. A register may be:
+//
+//  - unlocked, and unnamed: Available for allocation.
+//  - locked, but unnamed:   Already allocated as a temporary or
+//                           result for the current node.
+//  - unlocked, but named:   Contains the result of a prior operation,
+//                           not yet in use for this node,
+//  - locked, but named:     Contains the result of a prior operation,
+//                           already allocated as a operand to the
+//                           current operation.
+//
+// For every named register we also record a hint value indicating
+// the order in which registers should be selected to be spilled;
+// registers that can be more cheaply spilled and/or filled should
+// be selected first.
+//
+// Locking register is a strong retention mechanism; a locked register
+// will never be reallocated (this is used to ensure the operands to
+// the current node are in registers). Naming, conversely, in a weak
+// retention mechanism - allocating a register may force a named value
+// to be spilled.
+//
+// All named values must be given a hint that is greater than Min and
+// less than Max.
+template<class BankInfo>
+class RegisterBank {
+    typedef typename BankInfo::RegisterType RegID;
+    static const size_t NUM_REGS = BankInfo::numberOfRegisters;
+
+    typedef uint32_t SpillHint;
+    static const SpillHint SpillHintInvalid = 0xffffffff;
+
+public:
+    RegisterBank()
+    {
+    }
+
+    // Attempt to allocate a register - this function finds an unlocked
+    // register, locks it, and returns it. If none can be found, this
+    // returns -1 (InvalidGPRReg or InvalidFPRReg).
+    RegID tryAllocate()
+    {
+        VirtualRegister ignored = VirtualRegister();
+        
+        for (uint32_t i = 0; i < NUM_REGS; ++i) {
+            if (!m_data[i].lockCount && !m_data[i].name.isValid())
+                return allocateInternal(i, ignored);
+        }
+        
+        return (RegID)-1;
+    }
+
+    // Allocate a register - this function finds an unlocked register,
+    // locks it, and returns it. If any named registers exist, one
+    // of these should be selected to be allocated. If all unlocked
+    // registers are named, then one of the named registers will need
+    // to be spilled. In this case the register selected to be spilled
+    // will be one of the registers that has the lowest 'spillOrder'
+    // cost associated with it.
+    //
+    // This method select the register to be allocated, and calls the
+    // private 'allocateInternal' method to update internal data
+    // structures accordingly.
+    RegID allocate(VirtualRegister &spillMe)
+    {
+        uint32_t currentLowest = NUM_REGS;
+        SpillHint currentSpillOrder = SpillHintInvalid;
+
+        // This loop is broken into two halves, looping from the last allocated
+        // register (the register returned last time this method was called) to
+        // the maximum register value, then from 0 to the last allocated.
+        // This implements a simple round-robin like approach to try to reduce
+        // thrash, and minimize time spent scanning locked registers in allocation.
+        // If a unlocked and unnamed register is found return it immediately.
+        // Otherwise, find the first unlocked register with the lowest spillOrder.
+        for (uint32_t i = 0 ; i < NUM_REGS; ++i) {
+            // (1) If the current register is locked, it is not a candidate.
+            if (m_data[i].lockCount)
+                continue;
+            // (2) If the current register's spill order is 0, pick this! – unassigned registers have spill order 0.
+            SpillHint spillOrder = m_data[i].spillOrder;
+            if (spillOrder == SpillHintInvalid)
+                return allocateInternal(i, spillMe);
+            // If this register is better (has a lower spill order value) than any prior
+            // candidate, then record it.
+            if (spillOrder < currentSpillOrder) {
+                currentSpillOrder = spillOrder;
+                currentLowest = i;
+            }
+        }
+
+        // Deadlock check - this could only occur is all registers are locked!
+        ASSERT(currentLowest != NUM_REGS && currentSpillOrder != SpillHintInvalid);
+        // There were no available registers; currentLowest will need to be spilled.
+        return allocateInternal(currentLowest, spillMe);
+    }
+
+    // Allocates the given register, even if this will force a spill.
+    VirtualRegister allocateSpecific(RegID reg)
+    {
+        unsigned index = BankInfo::toIndex(reg);
+
+        ++m_data[index].lockCount;
+        VirtualRegister name = nameAtIndex(index);
+        if (name.isValid())
+            releaseAtIndex(index);
+        
+        return name;
+    }
+
+    // retain/release - these methods are used to associate/disassociate names
+    // with values in registers. retain should only be called on locked registers.
+    void retain(RegID reg, VirtualRegister name, SpillHint spillOrder)
+    {
+        unsigned index = BankInfo::toIndex(reg);
+
+        // SpillHint must be valid.
+        ASSERT(spillOrder != SpillHintInvalid);
+        // 'index' must be a valid, locked register.
+        ASSERT(index < NUM_REGS);
+        ASSERT(m_data[index].lockCount);
+        // 'index' should not currently be named, the new name must be valid.
+        ASSERT(!m_data[index].name.isValid());
+        ASSERT(name.isValid());
+        // 'index' should not currently have a spillOrder.
+        ASSERT(m_data[index].spillOrder == SpillHintInvalid);
+
+        m_data[index].name = name;
+        m_data[index].spillOrder = spillOrder;
+    }
+    void release(RegID reg)
+    {
+        releaseAtIndex(BankInfo::toIndex(reg));
+    }
+
+    // lock/unlock register, ensures that they are not spilled.
+    void lock(RegID reg)
+    {
+        unsigned index = BankInfo::toIndex(reg);
+
+        ASSERT(index < NUM_REGS);
+        ++m_data[index].lockCount;
+        ASSERT(m_data[index].lockCount);
+    }
+    void unlock(RegID reg)
+    {
+        unsigned index = BankInfo::toIndex(reg);
+
+        ASSERT(index < NUM_REGS);
+        ASSERT(m_data[index].lockCount);
+        --m_data[index].lockCount;
+    }
+    bool isLocked(RegID reg) const
+    {
+        return isLockedAtIndex(BankInfo::toIndex(reg));
+    }
+
+    // Get the name (VirtualRegister) associated with the
+    // given register (or default VirtualRegister() for none).
+    VirtualRegister name(RegID reg) const
+    {
+        return nameAtIndex(BankInfo::toIndex(reg));
+    }
+    
+    bool isInUse(RegID reg) const
+    {
+        return isLocked(reg) || name(reg).isValid();
+    }
+    
+    void dump()
+    {
+        // For each register, print the VirtualRegister 'name'.
+        for (uint32_t i =0; i < NUM_REGS; ++i) {
+            if (m_data[i].name.isValid())
+                dataLogF("[%02d]", m_data[i].name.offset());
+            else
+                dataLogF("[--]");
+        }
+        dataLogF("\n");
+    }
+
+    class iterator {
+    friend class RegisterBank<BankInfo>;
+    public:
+        VirtualRegister name() const
+        {
+            return m_bank->nameAtIndex(m_index);
+        }
+
+        bool isLocked() const
+        {
+            return m_bank->isLockedAtIndex(m_index);
+        }
+
+        void release() const
+        {
+            m_bank->releaseAtIndex(m_index);
+        }
+
+        RegID regID() const
+        {
+            return BankInfo::toRegister(m_index);
+        }
+
+#ifndef NDEBUG
+        const char* debugName() const
+        {
+            return BankInfo::debugName(regID());
+        }
+#endif
+
+        iterator& operator++()
+        {
+            ++m_index;
+            return *this;
+        }
+
+        bool operator!=(const iterator& other) const
+        {
+            ASSERT(m_bank == other.m_bank);
+            return m_index != other.m_index;
+        }
+
+        unsigned index() const
+        {
+            return m_index;
+        }
+
+    private:
+        iterator(RegisterBank<BankInfo>* bank, unsigned index)
+            : m_bank(bank)
+            , m_index(index)
+        {
+        }
+
+        RegisterBank<BankInfo>* m_bank;
+        unsigned m_index;
+    };
+
+    iterator begin()
+    {
+        return iterator(this, 0);
+    }
+
+    iterator end()
+    {
+        return iterator(this, NUM_REGS);
+    }
+
+private:
+    bool isLockedAtIndex(unsigned index) const
+    {
+        ASSERT(index < NUM_REGS);
+        return m_data[index].lockCount;
+    }
+
+    VirtualRegister nameAtIndex(unsigned index) const
+    {
+        ASSERT(index < NUM_REGS);
+        return m_data[index].name;
+    }
+
+    void releaseAtIndex(unsigned index)
+    {
+        // 'index' must be a valid register.
+        ASSERT(index < NUM_REGS);
+        // 'index' should currently be named.
+        ASSERT(m_data[index].name.isValid());
+        // 'index' should currently have a valid spill order.
+        ASSERT(m_data[index].spillOrder != SpillHintInvalid);
+
+        m_data[index].name = VirtualRegister();
+        m_data[index].spillOrder = SpillHintInvalid;
+    }
+
+    // Used by 'allocate', above, to update inforamtion in the map.
+    RegID allocateInternal(uint32_t i, VirtualRegister &spillMe)
+    {
+        // 'i' must be a valid, unlocked register.
+        ASSERT(i < NUM_REGS && !m_data[i].lockCount);
+
+        // Return the VirtualRegister of the named value currently stored in
+        // the register being returned - or default VirtualRegister() if none.
+        spillMe = m_data[i].name;
+
+        // Clear any name/spillOrder currently associated with the register,
+        m_data[i] = MapEntry();
+        // Mark the register as locked (with a lock count of 1).
+        m_data[i].lockCount = 1;
+
+        return BankInfo::toRegister(i);
+    }
+
+    // === MapEntry ===
+    //
+    // This structure provides information for an individual machine register
+    // being managed by the RegisterBank. For each register we track a lock
+    // count, name and spillOrder hint.
+    struct MapEntry {
+        MapEntry()
+            : name(VirtualRegister())
+            , spillOrder(SpillHintInvalid)
+            , lockCount(0)
+        {
+        }
+
+        VirtualRegister name;
+        SpillHint spillOrder;
+        uint32_t lockCount;
+    };
+
+    // Holds the current status of all registers.
+    MapEntry m_data[NUM_REGS];
+};
+
+typedef RegisterBank<GPRInfo>::iterator gpr_iterator;
+typedef RegisterBank<FPRInfo>::iterator fpr_iterator;
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGRegisteredStructure.h b/dfg/DFGRegisteredStructure.h
new file mode 100644
index 0000000..6b892a2
--- /dev/null
+++ b/dfg/DFGRegisteredStructure.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "Structure.h"
+#include "StructureSet.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+class RegisteredStructure {
+public:
+    RegisteredStructure() = default;
+
+    ALWAYS_INLINE Structure* get() const { return m_structure; }
+    Structure* operator->() const { return get(); }
+
+    bool operator==(const RegisteredStructure& other) const
+    {
+        return get() == other.get();
+    }
+
+    bool operator!=(const RegisteredStructure& other) const
+    {
+        return !(*this == other);
+    }
+
+    explicit operator bool() const
+    {
+        return !!get();
+    }
+
+private:
+    friend class Graph;
+
+    RegisteredStructure(Structure* structure)
+        : m_structure(structure)
+    {
+        ASSERT(structure);
+    }
+
+    static RegisteredStructure createPrivate(Structure* structure)
+    {
+        return RegisteredStructure(structure);
+    }
+
+    Structure* m_structure { nullptr };
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGRegisteredStructureSet.cpp b/dfg/DFGRegisteredStructureSet.cpp
new file mode 100644
index 0000000..e7a5891
--- /dev/null
+++ b/dfg/DFGRegisteredStructureSet.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGRegisteredStructureSet.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractValue.h"
+#include "TrackedReferences.h"
+
+namespace JSC { namespace DFG {
+
+void RegisteredStructureSet::filter(const DFG::StructureAbstractValue& other)
+{
+    genericFilter(
+        [&] (RegisteredStructure structure) -> bool {
+            return other.contains(structure); 
+        });
+}
+
+void RegisteredStructureSet::filter(SpeculatedType type)
+{
+    genericFilter(
+        [&] (RegisteredStructure structure) -> bool {
+            return type & speculationFromStructure(structure.get());
+        });
+}
+
+void RegisteredStructureSet::filterArrayModes(ArrayModes arrayModes)
+{
+    genericFilter(
+        [&] (RegisteredStructure structure) -> bool {
+            return arrayModes & arrayModeFromStructure(structure.get());
+        });
+}
+
+void RegisteredStructureSet::filter(const DFG::AbstractValue& other)
+{
+    filter(other.m_structure);
+    filter(other.m_type);
+    filterArrayModes(other.m_arrayModes);
+}
+
+SpeculatedType RegisteredStructureSet::speculationFromStructures() const
+{
+    SpeculatedType result = SpecNone;
+    forEach(
+        [&] (RegisteredStructure structure) {
+            mergeSpeculation(result, speculationFromStructure(structure.get()));
+        });
+    return result;
+}
+
+ArrayModes RegisteredStructureSet::arrayModesFromStructures() const
+{
+    ArrayModes result = 0;
+    forEach(
+        [&] (RegisteredStructure structure) {
+            mergeArrayModes(result, asArrayModes(structure->indexingType()));
+        });
+    return result;
+}
+
+void RegisteredStructureSet::validateReferences(const TrackedReferences& trackedReferences) const
+{
+    // The type system should help us here, but protect people from getting that wrong using bitwise_cast or something crazy.
+    forEach(
+        [&] (RegisteredStructure structure) {
+            trackedReferences.check(structure.get());
+        });
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGRegisteredStructureSet.h b/dfg/DFGRegisteredStructureSet.h
new file mode 100644
index 0000000..11ea39f
--- /dev/null
+++ b/dfg/DFGRegisteredStructureSet.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGRegisteredStructure.h"
+#include "StructureSet.h"
+#include <wtf/TinyPtrSet.h>
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace DFG {
+
+struct AbstractValue;
+class StructureAbstractValue;
+
+class RegisteredStructureSet : public TinyPtrSet<RegisteredStructure> {
+public:
+
+    RegisteredStructureSet()
+    { }
+    
+    RegisteredStructureSet(RegisteredStructure structure)
+        : TinyPtrSet(structure)
+    {
+    }
+    
+    ALWAYS_INLINE RegisteredStructureSet(const RegisteredStructureSet& other)
+        : TinyPtrSet(other)
+    {
+    }
+    
+    RegisteredStructure onlyStructure() const
+    {
+        return onlyEntry();
+    }
+
+    StructureSet toStructureSet() const
+    {
+        StructureSet result;
+        forEach([&] (RegisteredStructure structure) { result.add(structure.get()); });
+        return result;
+    }
+
+    void filter(const DFG::StructureAbstractValue&);
+    void filter(SpeculatedType);
+    void filterArrayModes(ArrayModes);
+    void filter(const DFG::AbstractValue&);
+    
+    SpeculatedType speculationFromStructures() const;
+    ArrayModes arrayModesFromStructures() const;
+
+    void validateReferences(const TrackedReferences&) const;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGSSACalculator.cpp b/dfg/DFGSSACalculator.cpp
new file mode 100644
index 0000000..899fa15
--- /dev/null
+++ b/dfg/DFGSSACalculator.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSSACalculator.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBlockMapInlines.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace DFG {
+
+void SSACalculator::Variable::dump(PrintStream& out) const
+{
+    out.print("var", m_index);
+}
+
+void SSACalculator::Variable::dumpVerbose(PrintStream& out) const
+{
+    dump(out);
+    if (!m_blocksWithDefs.isEmpty()) {
+        out.print("(defs: ");
+        CommaPrinter comma;
+        for (BasicBlock* block : m_blocksWithDefs)
+            out.print(comma, *block);
+        out.print(")");
+    }
+}
+
+void SSACalculator::Def::dump(PrintStream& out) const
+{
+    out.print("def(", *m_variable, ", ", *m_block, ", ", m_value, ")");
+}
+
+SSACalculator::SSACalculator(Graph& graph)
+    : m_data(graph)
+    , m_graph(graph)
+{
+}
+
+SSACalculator::~SSACalculator()
+{
+}
+
+void SSACalculator::reset()
+{
+    m_variables.clear();
+    m_defs.clear();
+    m_phis.clear();
+    for (BlockIndex blockIndex = m_data.size(); blockIndex--;) {
+        m_data[blockIndex].m_defs.clear();
+        m_data[blockIndex].m_phis.clear();
+    }
+}
+
+SSACalculator::Variable* SSACalculator::newVariable()
+{
+    return &m_variables.alloc(Variable(m_variables.size()));
+}
+
+SSACalculator::Def* SSACalculator::newDef(Variable* variable, BasicBlock* block, Node* value)
+{
+    Def* def = m_defs.add(Def(variable, block, value));
+    auto result = m_data[block].m_defs.add(variable, def);
+    if (result.isNewEntry)
+        variable->m_blocksWithDefs.append(block);
+    else
+        result.iterator->value = def;
+    return def;
+}
+
+SSACalculator::Def* SSACalculator::nonLocalReachingDef(BasicBlock* block, Variable* variable)
+{
+    return reachingDefAtTail(m_graph.m_dominators->idom(block), variable);
+}
+
+SSACalculator::Def* SSACalculator::reachingDefAtTail(BasicBlock* block, Variable* variable)
+{
+    for (; block; block = m_graph.m_dominators->idom(block)) {
+        if (Def* def = m_data[block].m_defs.get(variable))
+            return def;
+    }
+    return nullptr;
+}
+
+void SSACalculator::dump(PrintStream& out) const
+{
+    out.print("<Variables: [");
+    CommaPrinter comma;
+    for (unsigned i = 0; i < m_variables.size(); ++i) {
+        out.print(comma);
+        m_variables[i].dumpVerbose(out);
+    }
+    out.print("], Defs: [");
+    comma = CommaPrinter();
+    for (Def* def : const_cast<SSACalculator*>(this)->m_defs)
+        out.print(comma, *def);
+    out.print("], Phis: [");
+    comma = CommaPrinter();
+    for (Def* def : const_cast<SSACalculator*>(this)->m_phis)
+        out.print(comma, *def);
+    out.print("], Block data: [");
+    comma = CommaPrinter();
+    for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+        BasicBlock* block = m_graph.block(blockIndex);
+        if (!block)
+            continue;
+        
+        out.print(comma, *block, "=>(");
+        out.print("Defs: {");
+        CommaPrinter innerComma;
+        for (auto entry : m_data[block].m_defs)
+            out.print(innerComma, *entry.key, "->", *entry.value);
+        out.print("}, Phis: {");
+        innerComma = CommaPrinter();
+        for (Def* def : m_data[block].m_phis)
+            out.print(innerComma, *def);
+        out.print("})");
+    }
+    out.print("]>");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGSSACalculator.h b/dfg/DFGSSACalculator.h
new file mode 100644
index 0000000..1493b05
--- /dev/null
+++ b/dfg/DFGSSACalculator.h
@@ -0,0 +1,259 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGDominators.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+// SSACalculator provides a reusable tool for using the Cytron, Ferrante, Rosen, Wegman, and
+// Zadeck "Efficiently Computing Static Single Assignment Form and the Control Dependence Graph"
+// (TOPLAS'91) algorithm for computing SSA. SSACalculator doesn't magically do everything for you
+// but it maintains the major data structures and handles most of the non-local reasoning. Here's
+// the workflow of using SSACalculator to execute this algorithm:
+//
+// 0) Create a fresh SSACalculator instance. You will need this instance only for as long as
+//    you're not yet done computing SSA.
+//
+// 1) Create an SSACalculator::Variable for every variable that you want to do Phi insertion
+//    on. SSACalculator::Variable::index() is a dense indexing of the Variables that you
+//    created, so you can easily use a Vector to map the SSACalculator::Variables to your
+//    variables.
+//
+// 2) Create a SSACalculator::Def for every assignment to those variables. A Def knows about the
+//    variable, the block, and the DFG::Node* that has the value being put into the variable.
+//    Note that creating a Def in block B for variable V if block B already has a def for variable
+//    V will overwrite the previous Def's DFG::Node* value. This enables you to create Defs by
+//    processing basic blocks in forward order. If a block has multiple Defs of a variable, this
+//    "just works" because each block will then remember the last Def of each variable.
+//
+// 3) Call SSACalculator::computePhis(). This takes a functor that will create the Phi nodes. The
+//    functor returns either the Phi node it created, or nullptr, if it chooses to prune. (As an
+//    aside, it's always sound not to prune, and the safest reason for pruning is liveness.) The
+//    computePhis() code will record the created Phi nodes as Defs, and it will separately record
+//    the list of Phis inserted at each block. It's OK for the functor you pass here to modify the
+//    DFG::Graph on the fly, but the easiest way to write this is to just create the Phi nodes by
+//    doing Graph::addNode() and return them. It's then best to insert all Phi nodes for a block
+//    in bulk as part of the pass you do below, in step (4).
+//
+// 4) Modify the graph to create the SSA data flow. For each block, this should:
+//
+//    4.0) Compute the set of reaching defs (aka available values) for each variable by calling
+//         SSACalculator::reachingDefAtHead() for each variable. Record this in a local table that
+//         will be incrementally updated as you proceed through the block in forward order in the
+//         next steps:
+//
+//         FIXME: It might be better to compute reaching defs for all live variables in one go, to
+//         avoid doing repeated dom tree traversals.
+//         https://bugs.webkit.org/show_bug.cgi?id=136610
+//
+//    4.1) Insert all of the Phi nodes for the block by using SSACalculator::phisForBlock(), and
+//         record those Phi nodes as being available values.
+//
+//    4.2) Process the block in forward order. For each load from a variable, replace it with the
+//         available SSA value for that variable. For each store, delete it and record the stored
+//         value as being available.
+//
+//         Note that you have two options of how to replace loads with SSA values. You can replace
+//         the load with an Identity node; this will end up working fairly naturally so long as
+//         you run GCSE after your phase. Or, you can replace all uses of the load with the SSA
+//         value yourself (using the Graph::performSubstitution() idiom), but that requires that
+//         your loop over basic blocks proceeds in the appropriate graph order, for example
+//         preorder.
+//
+//         FIXME: Make it easier to do this, that doesn't involve rerunning GCSE.
+//         https://bugs.webkit.org/show_bug.cgi?id=136639
+//
+//    4.3) Insert Upsilons at the end of the current block for the corresponding Phis in each successor block. 
+//         Use the available values table to decide the source value for each Phi's variable. Note that 
+//         you could also use SSACalculator::reachingDefAtTail() instead of the available values table, 
+//         though your local available values table is likely to be more efficient.
+//
+// The most obvious use of SSACalculator is for the CPS->SSA conversion itself, but it's meant to
+// also be used for SSA update and for things like the promotion of heap fields to local SSA
+// variables.
+
+class SSACalculator {
+public:
+    SSACalculator(Graph&);
+    ~SSACalculator();
+    
+    void reset();
+    
+    class Variable {
+    public:
+        unsigned index() const { return m_index; }
+        
+        void dump(PrintStream&) const;
+        void dumpVerbose(PrintStream&) const;
+        
+    private:
+        friend class SSACalculator;
+        
+        Variable()
+            : m_index(UINT_MAX)
+        {
+        }
+        
+        Variable(unsigned index)
+            : m_index(index)
+        {
+        }
+
+        BlockList m_blocksWithDefs;
+        unsigned m_index;
+    };
+    
+    class Def {
+    public:
+        Variable* variable() const { return m_variable; }
+        BasicBlock* block() const { return m_block; }
+        
+        Node* value() const { return m_value; }
+        
+        void dump(PrintStream&) const;
+        
+    private:
+        friend class SSACalculator;
+        
+        Def()
+            : m_variable(nullptr)
+            , m_block(nullptr)
+            , m_value(nullptr)
+        {
+        }
+        
+        Def(Variable* variable, BasicBlock* block, Node* value)
+            : m_variable(variable)
+            , m_block(block)
+            , m_value(value)
+        {
+        }
+        
+        Variable* m_variable;
+        BasicBlock* m_block;
+        Node* m_value;
+    };
+    
+    Variable* newVariable();
+    Def* newDef(Variable*, BasicBlock*, Node*);
+    
+    Variable* variable(unsigned index) { return &m_variables[index]; }
+    
+    // The PhiInsertionFunctor takes a Variable and a BasicBlock and either inserts a Phi and
+    // returns the Node for that Phi, or it decides that it's not worth it to insert a Phi at that
+    // block because of some additional pruning condition (typically liveness) and returns
+    // nullptr. If a non-null Node* is returned, a new Def is created, so that
+    // nonLocalReachingDef() will find it later. Note that it is generally always sound to not
+    // prune any Phis (that is, to always have the functor insert a Phi and never return nullptr).
+    template<typename PhiInsertionFunctor>
+    void computePhis(const PhiInsertionFunctor& functor)
+    {
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_dominators);
+        
+        for (Variable& variable : m_variables) {
+            m_graph.m_dominators->forAllBlocksInPrunedIteratedDominanceFrontierOf(
+                variable.m_blocksWithDefs,
+                [&] (BasicBlock* block) -> bool {
+                    Node* phiNode = functor(&variable, block);
+                    if (!phiNode)
+                        return false;
+                    
+                    BlockData& data = m_data[block];
+                    Def* phiDef = m_phis.add(Def(&variable, block, phiNode));
+                    data.m_phis.append(phiDef);
+                    
+                    // Note that it's possible to have a block that looks like this before SSA
+                    // conversion:
+                    //
+                    // label:
+                    //     print(x);
+                    //     ...
+                    //     x = 42;
+                    //     goto label;
+                    //
+                    // And it may look like this after SSA conversion:
+                    //
+                    // label:
+                    //     x1: Phi()
+                    //     ...
+                    //     Upsilon(42, ^x1)
+                    //     goto label;
+                    //
+                    // In this case, we will want to insert a Phi in this block, and the block
+                    // will already have a Def for the variable. When this happens, we don't want
+                    // the Phi to override the original Def, since the Phi is at the top, the
+                    // original Def in the m_defs table would have been at the bottom, and we want
+                    // m_defs to tell us about defs at tail.
+                    //
+                    // So, we rely on the fact that HashMap::add() does nothing if the key was
+                    // already present.
+                    data.m_defs.add(&variable, phiDef);
+                    return true;
+                });
+        }
+    }
+    
+    const Vector<Def*>& phisForBlock(BasicBlock* block)
+    {
+        return m_data[block].m_phis;
+    }
+    
+    // Ignores defs within the given block; it assumes that you've taken care of those
+    // yourself.
+    Def* nonLocalReachingDef(BasicBlock*, Variable*);
+    Def* reachingDefAtHead(BasicBlock* block, Variable* variable)
+    {
+        return nonLocalReachingDef(block, variable);
+    }
+    
+    // Considers the def within the given block, but only works at the tail of the block.
+    Def* reachingDefAtTail(BasicBlock*, Variable*);
+    
+    void dump(PrintStream&) const;
+    
+private:
+    SegmentedVector<Variable> m_variables;
+    Bag<Def> m_defs;
+    
+    Bag<Def> m_phis;
+    
+    struct BlockData {
+        HashMap<Variable*, Def*> m_defs;
+        Vector<Def*> m_phis;
+    };
+    
+    BlockMap<BlockData> m_data;
+    
+    Graph& m_graph;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGSSAConversionPhase.cpp b/dfg/DFGSSAConversionPhase.cpp
new file mode 100644
index 0000000..cde0740
--- /dev/null
+++ b/dfg/DFGSSAConversionPhase.cpp
@@ -0,0 +1,425 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSSAConversionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGSSACalculator.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class SSAConversionPhase : public Phase {
+    static const bool verbose = false;
+    
+public:
+    SSAConversionPhase(Graph& graph)
+        : Phase(graph, "SSA conversion")
+        , m_calculator(graph)
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        RELEASE_ASSERT(m_graph.m_form == ThreadedCPS);
+        
+        m_graph.clearReplacements();
+        m_graph.ensureDominators();
+        
+        if (verbose) {
+            dataLog("Graph before SSA transformation:\n");
+            m_graph.dump();
+        }
+
+        // Create a SSACalculator::Variable for every root VariableAccessData.
+        for (VariableAccessData& variable : m_graph.m_variableAccessData) {
+            if (!variable.isRoot())
+                continue;
+            
+            SSACalculator::Variable* ssaVariable = m_calculator.newVariable();
+            ASSERT(ssaVariable->index() == m_variableForSSAIndex.size());
+            m_variableForSSAIndex.append(&variable);
+            m_ssaVariableForVariable.add(&variable, ssaVariable);
+        }
+        
+        // Find all SetLocals and create Defs for them. We handle SetArgument by creating a
+        // GetLocal, and recording the flush format.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            // Must process the block in forward direction because we want to see the last
+            // assignment for every local.
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                if (node->op() != SetLocal && node->op() != SetArgument)
+                    continue;
+                
+                VariableAccessData* variable = node->variableAccessData();
+                
+                Node* childNode;
+                if (node->op() == SetLocal)
+                    childNode = node->child1().node();
+                else {
+                    ASSERT(node->op() == SetArgument);
+                    childNode = m_insertionSet.insertNode(
+                        nodeIndex, node->variableAccessData()->prediction(),
+                        GetStack, node->origin,
+                        OpInfo(m_graph.m_stackAccessData.add(variable->local(), variable->flushFormat())));
+                    if (!ASSERT_DISABLED)
+                        m_argumentGetters.add(childNode);
+                    m_argumentMapping.add(node, childNode);
+                }
+                
+                m_calculator.newDef(
+                    m_ssaVariableForVariable.get(variable), block, childNode);
+            }
+            
+            m_insertionSet.execute(block);
+        }
+        
+        // Decide where Phis are to be inserted. This creates the Phi's but doesn't insert them
+        // yet. We will later know where to insert them because SSACalculator is such a bro.
+        m_calculator.computePhis(
+            [&] (SSACalculator::Variable* ssaVariable, BasicBlock* block) -> Node* {
+                VariableAccessData* variable = m_variableForSSAIndex[ssaVariable->index()];
+                
+                // Prune by liveness. This doesn't buy us much other than compile times.
+                Node* headNode = block->variablesAtHead.operand(variable->local());
+                if (!headNode)
+                    return nullptr;
+
+                // There is the possibiltiy of "rebirths". The SSA calculator will already prune
+                // rebirths for the same VariableAccessData. But it will not be able to prune
+                // rebirths that arose from the same local variable number but a different
+                // VariableAccessData. We do that pruning here.
+                //
+                // Here's an example of a rebirth that this would catch:
+                //
+                //     var x;
+                //     if (foo) {
+                //         if (bar) {
+                //             x = 42;
+                //         } else {
+                //             x = 43;
+                //         }
+                //         print(x);
+                //         x = 44;
+                //     } else {
+                //         x = 45;
+                //     }
+                //     print(x); // Without this check, we'd have a Phi for x = 42|43 here.
+                //
+                // FIXME: Consider feeding local variable numbers, not VariableAccessData*'s, as
+                // the "variables" for SSACalculator. That would allow us to eliminate this
+                // special case.
+                // https://bugs.webkit.org/show_bug.cgi?id=136641
+                if (headNode->variableAccessData() != variable)
+                    return nullptr;
+                
+                Node* phiNode = m_graph.addNode(
+                    variable->prediction(), Phi, block->at(0)->origin.withInvalidExit());
+                FlushFormat format = variable->flushFormat();
+                NodeFlags result = resultFor(format);
+                phiNode->mergeFlags(result);
+                return phiNode;
+            });
+        
+        if (verbose) {
+            dataLog("Computed Phis, about to transform the graph.\n");
+            dataLog("\n");
+            dataLog("Graph:\n");
+            m_graph.dump();
+            dataLog("\n");
+            dataLog("Mappings:\n");
+            for (unsigned i = 0; i < m_variableForSSAIndex.size(); ++i)
+                dataLog("    ", i, ": ", VariableAccessDataDump(m_graph, m_variableForSSAIndex[i]), "\n");
+            dataLog("\n");
+            dataLog("SSA calculator: ", m_calculator, "\n");
+        }
+        
+        // Do the bulk of the SSA conversion. For each block, this tracks the operand->Node
+        // mapping based on a combination of what the SSACalculator tells us, and us walking over
+        // the block in forward order. We use our own data structure, valueForOperand, for
+        // determining the local mapping, but we rely on SSACalculator for the non-local mapping.
+        //
+        // This does three things at once:
+        //
+        // - Inserts the Phis in all of the places where they need to go. We've already created
+        //   them and they are accounted for in the SSACalculator's data structures, but we
+        //   haven't inserted them yet, mostly because we want to insert all of a block's Phis in
+        //   one go to amortize the cost of node insertion.
+        //
+        // - Create and insert Upsilons.
+        //
+        // - Convert all of the preexisting SSA nodes (other than the old CPS Phi nodes) into SSA
+        //   form by replacing as follows:
+        //
+        //   - MovHint has KillLocal prepended to it.
+        //
+        //   - GetLocal die and get replaced with references to the node specified by
+        //     valueForOperand.
+        //
+        //   - SetLocal turns into PutStack if it's flushed, or turns into a Check otherwise.
+        //
+        //   - Flush loses its children and turns into a Phantom.
+        //
+        //   - PhantomLocal becomes Phantom, and its child is whatever is specified by
+        //     valueForOperand.
+        //
+        //   - SetArgument is removed. Note that GetStack nodes have already been inserted.
+        Operands<Node*> valueForOperand(OperandsLike, m_graph.block(0)->variablesAtHead);
+        for (BasicBlock* block : m_graph.blocksInPreOrder()) {
+            valueForOperand.clear();
+            
+            // CPS will claim that the root block has all arguments live. But we have already done
+            // the first step of SSA conversion: argument locals are no longer live at head;
+            // instead we have GetStack nodes for extracting the values of arguments. So, we
+            // skip the at-head available value calculation for the root block.
+            if (block != m_graph.block(0)) {
+                for (size_t i = valueForOperand.size(); i--;) {
+                    Node* nodeAtHead = block->variablesAtHead[i];
+                    if (!nodeAtHead)
+                        continue;
+                    
+                    VariableAccessData* variable = nodeAtHead->variableAccessData();
+                    
+                    if (verbose)
+                        dataLog("Considering live variable ", VariableAccessDataDump(m_graph, variable), " at head of block ", *block, "\n");
+                    
+                    SSACalculator::Variable* ssaVariable = m_ssaVariableForVariable.get(variable);
+                    SSACalculator::Def* def = m_calculator.reachingDefAtHead(block, ssaVariable);
+                    if (!def) {
+                        // If we are required to insert a Phi, then we won't have a reaching def
+                        // at head.
+                        continue;
+                    }
+                    
+                    Node* node = def->value();
+                    if (node->replacement()) {
+                        // This will occur when a SetLocal had a GetLocal as its source. The
+                        // GetLocal would get replaced with an actual SSA value by the time we get
+                        // here. Note that the SSA value with which the GetLocal got replaced
+                        // would not in turn have a replacement.
+                        node = node->replacement();
+                        ASSERT(!node->replacement());
+                    }
+                    if (verbose)
+                        dataLog("Mapping: ", VirtualRegister(valueForOperand.operandForIndex(i)), " -> ", node, "\n");
+                    valueForOperand[i] = node;
+                }
+            }
+            
+            // Insert Phis by asking the calculator what phis there are in this block. Also update
+            // valueForOperand with those Phis. For Phis associated with variables that are not
+            // flushed, we also insert a MovHint.
+            size_t phiInsertionPoint = 0;
+            for (SSACalculator::Def* phiDef : m_calculator.phisForBlock(block)) {
+                VariableAccessData* variable = m_variableForSSAIndex[phiDef->variable()->index()];
+                
+                m_insertionSet.insert(phiInsertionPoint, phiDef->value());
+                valueForOperand.operand(variable->local()) = phiDef->value();
+                
+                m_insertionSet.insertNode(
+                    phiInsertionPoint, SpecNone, MovHint, block->at(0)->origin.withInvalidExit(),
+                    OpInfo(variable->local().offset()), phiDef->value()->defaultEdge());
+            }
+
+            if (block->at(0)->origin.exitOK)
+                m_insertionSet.insertNode(phiInsertionPoint, SpecNone, ExitOK, block->at(0)->origin);
+            
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                
+                if (verbose) {
+                    dataLog("Processing node ", node, ":\n");
+                    m_graph.dump(WTF::dataFile(), "    ", node);
+                }
+                
+                m_graph.performSubstitution(node);
+                
+                switch (node->op()) {
+                case MovHint: {
+                    m_insertionSet.insertNode(
+                        nodeIndex, SpecNone, KillStack, node->origin,
+                        OpInfo(node->unlinkedLocal().offset()));
+                    node->origin.exitOK = false; // KillStack clobbers exit.
+                    break;
+                }
+                    
+                case SetLocal: {
+                    VariableAccessData* variable = node->variableAccessData();
+                    Node* child = node->child1().node();
+                    
+                    if (!!(node->flags() & NodeIsFlushed)) {
+                        node->convertToPutStack(
+                            m_graph.m_stackAccessData.add(
+                                variable->local(), variable->flushFormat()));
+                    } else
+                        node->remove();
+                    
+                    if (verbose)
+                        dataLog("Mapping: ", variable->local(), " -> ", child, "\n");
+                    valueForOperand.operand(variable->local()) = child;
+                    break;
+                }
+                    
+                case GetStack: {
+                    ASSERT(m_argumentGetters.contains(node));
+                    valueForOperand.operand(node->stackAccessData()->local) = node;
+                    break;
+                }
+                    
+                case GetLocal: {
+                    VariableAccessData* variable = node->variableAccessData();
+                    node->children.reset();
+                    
+                    node->remove();
+                    if (verbose)
+                        dataLog("Replacing node ", node, " with ", valueForOperand.operand(variable->local()), "\n");
+                    node->setReplacement(valueForOperand.operand(variable->local()));
+                    break;
+                }
+                    
+                case Flush: {
+                    node->children.reset();
+                    node->remove();
+                    break;
+                }
+                    
+                case PhantomLocal: {
+                    ASSERT(node->child1().useKind() == UntypedUse);
+                    VariableAccessData* variable = node->variableAccessData();
+                    node->child1() = valueForOperand.operand(variable->local())->defaultEdge();
+                    node->remove();
+                    break;
+                }
+                    
+                case SetArgument: {
+                    node->remove();
+                    break;
+                }
+                    
+                default:
+                    break;
+                }
+            }
+            
+            // We want to insert Upsilons just before the end of the block. On the surface this
+            // seems dangerous because the Upsilon will have a checking UseKind. But, we will not
+            // actually be performing the check at the point of the Upsilon; the check will
+            // already have been performed at the point where the original SetLocal was.
+            NodeAndIndex terminal = block->findTerminal();
+            size_t upsilonInsertionPoint = terminal.index;
+            NodeOrigin upsilonOrigin = terminal.node->origin;
+            for (unsigned successorIndex = block->numSuccessors(); successorIndex--;) {
+                BasicBlock* successorBlock = block->successor(successorIndex);
+                for (SSACalculator::Def* phiDef : m_calculator.phisForBlock(successorBlock)) {
+                    Node* phiNode = phiDef->value();
+                    SSACalculator::Variable* ssaVariable = phiDef->variable();
+                    VariableAccessData* variable = m_variableForSSAIndex[ssaVariable->index()];
+                    FlushFormat format = variable->flushFormat();
+
+                    // We can use an unchecked use kind because the SetLocal was turned into a Check.
+                    // We have to use an unchecked use because at least sometimes, the end of the block
+                    // is not exitOK.
+                    UseKind useKind = uncheckedUseKindFor(format);
+                    
+                    m_insertionSet.insertNode(
+                        upsilonInsertionPoint, SpecNone, Upsilon, upsilonOrigin,
+                        OpInfo(phiNode), Edge(
+                            valueForOperand.operand(variable->local()),
+                            useKind));
+                }
+            }
+            
+            m_insertionSet.execute(block);
+        }
+        
+        // Free all CPS phis and reset variables vectors.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+                m_graph.deleteNode(block->phis[phiIndex]);
+            block->phis.clear();
+            block->variablesAtHead.clear();
+            block->variablesAtTail.clear();
+            block->valuesAtHead.clear();
+            block->valuesAtHead.clear();
+            block->ssa = std::make_unique<BasicBlock::SSAData>(block);
+        }
+        
+        m_graph.m_argumentFormats.resize(m_graph.m_arguments.size());
+        for (unsigned i = m_graph.m_arguments.size(); i--;) {
+            FlushFormat format = FlushedJSValue;
+
+            Node* node = m_argumentMapping.get(m_graph.m_arguments[i]);
+            
+            RELEASE_ASSERT(node);
+            format = node->stackAccessData()->format;
+            
+            m_graph.m_argumentFormats[i] = format;
+            m_graph.m_arguments[i] = node; // Record the load that loads the arguments for the benefit of exit profiling.
+        }
+        
+        m_graph.m_form = SSA;
+
+        if (verbose) {
+            dataLog("Graph after SSA transformation:\n");
+            m_graph.dump();
+        }
+
+        return true;
+    }
+
+private:
+    SSACalculator m_calculator;
+    InsertionSet m_insertionSet;
+    HashMap<VariableAccessData*, SSACalculator::Variable*> m_ssaVariableForVariable;
+    HashMap<Node*, Node*> m_argumentMapping;
+    HashSet<Node*> m_argumentGetters;
+    Vector<VariableAccessData*> m_variableForSSAIndex;
+};
+
+bool performSSAConversion(Graph& graph)
+{
+    return runPhase<SSAConversionPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGSSAConversionPhase.h b/dfg/DFGSSAConversionPhase.h
new file mode 100644
index 0000000..0376689
--- /dev/null
+++ b/dfg/DFGSSAConversionPhase.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Convert ThreadedCPS form into SSA form. This results in a form that has:
+//
+// - Minimal Phi's. We use the the Cytron et al (TOPLAS'91) algorithm for
+//   Phi insertion. Most of the algorithm is implemented in SSACalculator
+//   and Dominators.
+//
+// - No uses of GetLocal/SetLocal except for captured variables and flushes.
+//   After this, any remaining SetLocal means Flush. PhantomLocals become
+//   Phantoms. Nodes may have children that are in another basic block.
+//
+// - MovHints are used for OSR information, and are themselves minimal.
+//   A MovHint will occur at some point after the assigning, and at Phi
+//   points.
+//
+// - Unlike conventional SSA in which Phi functions refer to predecessors
+//   and values, our SSA uses Upsilon functions to indicate values in
+//   predecessors. A merge will look like:
+//
+//   labelA:
+//       a: Thingy(...)
+//       b: Upsilon(^e, @a)
+//       Jump(labelC)
+//
+//   labelB:
+//       c: OtherThingy(...)
+//       d: Upsilon(^e, @c)
+//       Jump(labelC)
+//
+//   labelC:
+//       e: Phi()
+//
+//   Note that the Phi has no children, but the predecessors have Upsilons
+//   that have a weak reference to the Phi (^e instead of @e; we store it
+//   in the OpInfo rather than the AdjacencyList). Think of the Upsilon
+//   as "assigning" to the "variable" associated with the Phi, and that
+//   this is the one place in SSA form where you can have multiple
+//   assignments.
+//
+//   This implies some other loosenings of SSA. For example, an Upsilon
+//   may precede a Phi in the same basic block; this may arise after CFG
+//   simplification. Although it's profitable for CFG simplification (or
+//   some other phase) to remove these, it's not strictly necessary. As
+//   well, this form allows the Upsilon to be in any block that dominates
+//   the predecessor block of the Phi, which allows for block splitting to
+//   ignore the possibility of introducing an extra edge between the Phi
+//   and the predecessor (though normal SSA would allow this, also, with
+//   the caveat that the Phi predecessor block lists would have to be
+//   updated).
+//
+//   Fun fact: Upsilon is so named because it comes before Phi in the
+//   alphabet. It can be written as "Y".
+
+bool performSSAConversion(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGSSALoweringPhase.cpp b/dfg/DFGSSALoweringPhase.cpp
new file mode 100644
index 0000000..3214cff
--- /dev/null
+++ b/dfg/DFGSSALoweringPhase.cpp
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSSALoweringPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class SSALoweringPhase : public Phase {
+    static const bool verbose = false;
+    
+public:
+    SSALoweringPhase(Graph& graph)
+        : Phase(graph, "SSA lowering")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        RELEASE_ASSERT(m_graph.m_form == SSA);
+        
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            m_block = m_graph.block(blockIndex);
+            if (!m_block)
+                continue;
+            for (m_nodeIndex = 0; m_nodeIndex < m_block->size(); ++m_nodeIndex) {
+                m_node = m_block->at(m_nodeIndex);
+                handleNode();
+            }
+            m_insertionSet.execute(m_block);
+        }
+
+        return true;
+    }
+
+private:
+    void handleNode()
+    {
+        switch (m_node->op()) {
+        case GetByVal:
+        case HasIndexedProperty:
+            lowerBoundsCheck(m_node->child1(), m_node->child2(), m_node->child3());
+            break;
+            
+        case PutByVal:
+        case PutByValDirect: {
+            Edge base = m_graph.varArgChild(m_node, 0);
+            Edge index = m_graph.varArgChild(m_node, 1);
+            Edge storage = m_graph.varArgChild(m_node, 3);
+            if (lowerBoundsCheck(base, index, storage))
+                break;
+            
+            if (m_node->arrayMode().typedArrayType() != NotTypedArray && m_node->arrayMode().isOutOfBounds()) {
+                Node* length = m_insertionSet.insertNode(
+                    m_nodeIndex, SpecInt32Only, GetArrayLength, m_node->origin,
+                    OpInfo(m_node->arrayMode().asWord()), base, storage);
+                
+                m_graph.varArgChild(m_node, 4) = Edge(length, KnownInt32Use);
+                break;
+            }
+            break;
+        }
+            
+        default:
+            break;
+        }
+    }
+    
+    bool lowerBoundsCheck(Edge base, Edge index, Edge storage)
+    {
+        if (!m_node->arrayMode().permitsBoundsCheckLowering())
+            return false;
+        
+        if (!m_node->arrayMode().lengthNeedsStorage())
+            storage = Edge();
+        
+        Node* length = m_insertionSet.insertNode(
+            m_nodeIndex, SpecInt32Only, GetArrayLength, m_node->origin,
+            OpInfo(m_node->arrayMode().asWord()), base, storage);
+        m_insertionSet.insertNode(
+            m_nodeIndex, SpecInt32Only, CheckInBounds, m_node->origin,
+            index, Edge(length, KnownInt32Use));
+        return true;
+    }
+    
+    InsertionSet m_insertionSet;
+    BasicBlock* m_block;
+    unsigned m_nodeIndex;
+    Node* m_node;
+};
+
+bool performSSALowering(Graph& graph)
+{
+    return runPhase<SSALoweringPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGSSALoweringPhase.h b/dfg/DFGSSALoweringPhase.h
new file mode 100644
index 0000000..e1f43c8
--- /dev/null
+++ b/dfg/DFGSSALoweringPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Performs DFG->DFG lowerings that are only appropriate for SSA form and the FTL
+// backend. This is intended to be run after SSAConversionPhase.
+
+bool performSSALowering(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGSafeToExecute.h b/dfg/DFGSafeToExecute.h
new file mode 100644
index 0000000..6b57579
--- /dev/null
+++ b/dfg/DFGSafeToExecute.h
@@ -0,0 +1,491 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+template<typename AbstractStateType>
+class SafeToExecuteEdge {
+public:
+    SafeToExecuteEdge(AbstractStateType& state)
+        : m_state(state)
+        , m_result(true)
+    {
+    }
+    
+    void operator()(Node*, Edge edge)
+    {
+        switch (edge.useKind()) {
+        case UntypedUse:
+        case Int32Use:
+        case DoubleRepUse:
+        case DoubleRepRealUse:
+        case Int52RepUse:
+        case NumberUse:
+        case RealNumberUse:
+        case BooleanUse:
+        case CellUse:
+        case CellOrOtherUse:
+        case ObjectUse:
+        case ArrayUse:
+        case FunctionUse:
+        case FinalObjectUse:
+        case RegExpObjectUse:
+        case ProxyObjectUse:
+        case DerivedArrayUse:
+        case MapObjectUse:
+        case SetObjectUse:
+        case ObjectOrOtherUse:
+        case StringIdentUse:
+        case StringUse:
+        case StringOrOtherUse:
+        case SymbolUse:
+        case StringObjectUse:
+        case StringOrStringObjectUse:
+        case NotStringVarUse:
+        case NotCellUse:
+        case OtherUse:
+        case MiscUse:
+        case AnyIntUse:
+        case DoubleRepAnyIntUse:
+            return;
+            
+        case KnownInt32Use:
+            if (m_state.forNode(edge).m_type & ~SpecInt32Only)
+                m_result = false;
+            return;
+
+        case KnownBooleanUse:
+            if (m_state.forNode(edge).m_type & ~SpecBoolean)
+                m_result = false;
+            return;
+            
+        case KnownCellUse:
+            if (m_state.forNode(edge).m_type & ~SpecCell)
+                m_result = false;
+            return;
+            
+        case KnownStringUse:
+            if (m_state.forNode(edge).m_type & ~SpecString)
+                m_result = false;
+            return;
+
+        case KnownPrimitiveUse:
+            if (m_state.forNode(edge).m_type & ~(SpecHeapTop & ~SpecObject))
+                m_result = false;
+            return;
+            
+        case LastUseKind:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    bool result() const { return m_result; }
+private:
+    AbstractStateType& m_state;
+    bool m_result;
+};
+
+// Determines if it's safe to execute a node within the given abstract state. This may
+// return false conservatively. If it returns true, then you can hoist the given node
+// up to the given point and expect that it will not crash. It also guarantees that the
+// node will not produce a malformed JSValue or object pointer when executed in the
+// given state. But this doesn't guarantee that the node will produce the result you
+// wanted. For example, you may have a GetByOffset from a prototype that only makes
+// semantic sense if you've also checked that some nearer prototype doesn't also have
+// a property of the same name. This could still return true even if that check hadn't
+// been performed in the given abstract state. That's fine though: the load can still
+// safely execute before that check, so long as that check continues to guard any
+// user-observable things done to the loaded value.
+template<typename AbstractStateType>
+bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
+{
+    SafeToExecuteEdge<AbstractStateType> safeToExecuteEdge(state);
+    DFG_NODE_DO_TO_CHILDREN(graph, node, safeToExecuteEdge);
+    if (!safeToExecuteEdge.result())
+        return false;
+
+    // NOTE: This tends to lie when it comes to effectful nodes, because it knows that they aren't going to
+    // get hoisted anyway.
+
+    switch (node->op()) {
+    case JSConstant:
+    case DoubleConstant:
+    case Int52Constant:
+    case LazyJSConstant:
+    case Identity:
+    case ToThis:
+    case CreateThis:
+    case GetCallee:
+    case GetArgumentCountIncludingThis:
+    case GetRestLength:
+    case GetLocal:
+    case SetLocal:
+    case PutStack:
+    case KillStack:
+    case GetStack:
+    case MovHint:
+    case ZombieHint:
+    case ExitOK:
+    case Phantom:
+    case Upsilon:
+    case Phi:
+    case Flush:
+    case PhantomLocal:
+    case GetLocalUnlinked:
+    case SetArgument:
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case BitLShift:
+    case BitRShift:
+    case BitURShift:
+    case ValueToInt32:
+    case UInt32ToNumber:
+    case DoubleAsInt32:
+    case ArithAdd:
+    case ArithClz32:
+    case ArithSub:
+    case ArithNegate:
+    case ArithMul:
+    case ArithIMul:
+    case ArithDiv:
+    case ArithMod:
+    case ArithAbs:
+    case ArithMin:
+    case ArithMax:
+    case ArithPow:
+    case ArithRandom:
+    case ArithSqrt:
+    case ArithFRound:
+    case ArithRound:
+    case ArithFloor:
+    case ArithCeil:
+    case ArithTrunc:
+    case ArithSin:
+    case ArithCos:
+    case ArithTan:
+    case ArithLog:
+    case ValueAdd:
+    case TryGetById:
+    case DeleteById:
+    case DeleteByVal:
+    case GetById:
+    case GetByIdWithThis:
+    case GetByValWithThis:
+    case GetByIdFlush:
+    case PutById:
+    case PutByIdFlush:
+    case PutByIdWithThis:
+    case PutByValWithThis:
+    case PutByIdDirect:
+    case PutGetterById:
+    case PutSetterById:
+    case PutGetterSetterById:
+    case PutGetterByVal:
+    case PutSetterByVal:
+    case DefineDataProperty:
+    case DefineAccessorProperty:
+    case CheckStructure:
+    case GetExecutable:
+    case GetButterfly:
+    case CallDOMGetter:
+    case CallDOM:
+    case CheckDOM:
+    case CheckArray:
+    case Arrayify:
+    case ArrayifyToStructure:
+    case GetScope:
+    case SkipScope:
+    case GetGlobalObject:
+    case GetClosureVar:
+    case PutClosureVar:
+    case GetGlobalVar:
+    case GetGlobalLexicalVariable:
+    case PutGlobalVariable:
+    case CheckCell:
+    case CheckBadCell:
+    case CheckNotEmpty:
+    case CheckStringIdent:
+    case RegExpExec:
+    case RegExpTest:
+    case CompareLess:
+    case CompareLessEq:
+    case CompareGreater:
+    case CompareGreaterEq:
+    case CompareEq:
+    case CompareStrictEq:
+    case CompareEqPtr:
+    case Call:
+    case DirectCall:
+    case TailCallInlinedCaller:
+    case DirectTailCallInlinedCaller:
+    case Construct:
+    case DirectConstruct:
+    case CallVarargs:
+    case CallEval:
+    case TailCallVarargsInlinedCaller:
+    case TailCallForwardVarargsInlinedCaller:
+    case ConstructVarargs:
+    case LoadVarargs:
+    case CallForwardVarargs:
+    case ConstructForwardVarargs:
+    case NewObject:
+    case NewArray:
+    case NewArrayWithSize:
+    case NewArrayBuffer:
+    case NewArrayWithSpread:
+    case Spread:
+    case NewRegexp:
+    case ProfileType:
+    case ProfileControlFlow:
+    case CheckTypeInfoFlags:
+    case OverridesHasInstance:
+    case InstanceOf:
+    case InstanceOfCustom:
+    case IsEmpty:
+    case IsUndefined:
+    case IsBoolean:
+    case IsNumber:
+    case IsObject:
+    case IsObjectOrNull:
+    case IsFunction:
+    case IsCellWithType:
+    case IsTypedArrayView:
+    case TypeOf:
+    case LogicalNot:
+    case CallObjectConstructor:
+    case ToPrimitive:
+    case ToString:
+    case ToNumber:
+    case SetFunctionName:
+    case StrCat:
+    case CallStringConstructor:
+    case NewStringObject:
+    case MakeRope:
+    case In:
+    case HasOwnProperty:
+    case CreateActivation:
+    case CreateDirectArguments:
+    case CreateScopedArguments:
+    case CreateClonedArguments:
+    case GetFromArguments:
+    case GetArgument:
+    case PutToArguments:
+    case NewFunction:
+    case NewGeneratorFunction:
+    case NewAsyncFunction:
+    case Jump:
+    case Branch:
+    case Switch:
+    case Return:
+    case TailCall:
+    case DirectTailCall:
+    case TailCallVarargs:
+    case TailCallForwardVarargs:
+    case Throw:
+    case ThrowStaticError:
+    case CountExecution:
+    case ForceOSRExit:
+    case CheckWatchdogTimer:
+    case LogShadowChickenPrologue:
+    case LogShadowChickenTail:
+    case StringFromCharCode:
+    case NewTypedArray:
+    case Unreachable:
+    case ExtractOSREntryLocal:
+    case CheckTierUpInLoop:
+    case CheckTierUpAtReturn:
+    case CheckTierUpAndOSREnter:
+    case LoopHint:
+    case InvalidationPoint:
+    case NotifyWrite:
+    case CheckInBounds:
+    case ConstantStoragePointer:
+    case Check:
+    case MultiPutByOffset:
+    case ValueRep:
+    case DoubleRep:
+    case Int52Rep:
+    case BooleanToNumber:
+    case FiatInt52:
+    case GetGetter:
+    case GetSetter:
+    case GetEnumerableLength:
+    case HasGenericProperty:
+    case HasStructureProperty:
+    case HasIndexedProperty:
+    case GetDirectPname:
+    case GetPropertyEnumerator:
+    case GetEnumeratorStructurePname:
+    case GetEnumeratorGenericPname:
+    case ToIndexString:
+    case PhantomNewObject:
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomCreateActivation:
+    case PutHint:
+    case CheckStructureImmediate:
+    case MaterializeNewObject:
+    case MaterializeCreateActivation:
+    case PhantomDirectArguments:
+    case PhantomCreateRest:
+    case PhantomSpread:
+    case PhantomNewArrayWithSpread:
+    case PhantomClonedArguments:
+    case GetMyArgumentByVal:
+    case GetMyArgumentByValOutOfBounds:
+    case ForwardVarargs:
+    case CreateRest:
+    case StringReplace:
+    case StringReplaceRegExp:
+    case GetRegExpObjectLastIndex:
+    case SetRegExpObjectLastIndex:
+    case RecordRegExpCachedResult:
+    case GetDynamicVar:
+    case PutDynamicVar:
+    case ResolveScope:
+    case MapHash:
+    case ToLowerCase:
+    case GetMapBucket:
+    case LoadFromJSMapBucket:
+    case IsNonEmptyMapBucket:
+        return true;
+
+    case ArraySlice: {
+        // You could plausibly move this code around as long as you proved the
+        // incoming array base structure is an original array at the hoisted location.
+        // Instead of doing that extra work, we just conservatively return false.
+        return false;
+    }
+
+    case BottomValue:
+        // If in doubt, assume that this isn't safe to execute, just because we have no way of
+        // compiling this node.
+        return false;
+
+    case StoreBarrier:
+    case FencedStoreBarrier:
+    case PutStructure:
+    case NukeStructureAndSetButterfly:
+        // We conservatively assume that these cannot be put anywhere, which forces the compiler to
+        // keep them exactly where they were. This is sort of overkill since the clobberize effects
+        // already force these things to be ordered precisely. I'm just not confident enough in my
+        // effect based memory model to rely solely on that right now.
+        return false;
+
+    case GetByVal:
+    case GetIndexedPropertyStorage:
+    case GetArrayLength:
+    case ArrayPush:
+    case ArrayPop:
+    case StringCharAt:
+    case StringCharCodeAt:
+        return node->arrayMode().alreadyChecked(graph, node, state.forNode(node->child1()));
+        
+    case GetTypedArrayByteOffset:
+        return !(state.forNode(node->child1()).m_type & ~(SpecTypedArrayView));
+            
+    case PutByValDirect:
+    case PutByVal:
+    case PutByValAlias:
+        return node->arrayMode().modeForPut().alreadyChecked(
+            graph, node, state.forNode(graph.varArgChild(node, 0)));
+
+    case AllocatePropertyStorage:
+    case ReallocatePropertyStorage:
+        return state.forNode(node->child1()).m_structure.isSubsetOf(
+            RegisteredStructureSet(node->transition()->previous));
+        
+    case GetByOffset:
+    case GetGetterSetterByOffset:
+    case PutByOffset: {
+        PropertyOffset offset = node->storageAccessData().offset;
+
+        if (state.structureClobberState() == StructuresAreWatched) {
+            if (JSObject* knownBase = node->child1()->dynamicCastConstant<JSObject*>()) {
+                if (graph.isSafeToLoad(knownBase, offset))
+                    return true;
+            }
+        }
+        
+        StructureAbstractValue& value = state.forNode(node->child1()).m_structure;
+        if (value.isInfinite())
+            return false;
+        for (unsigned i = value.size(); i--;) {
+            if (!value[i]->isValidOffset(offset))
+                return false;
+        }
+        return true;
+    }
+        
+    case MultiGetByOffset: {
+        // We can't always guarantee that the MultiGetByOffset is safe to execute if it
+        // contains loads from prototypes. If the load requires a check in IR, which is rare, then
+        // we currently claim that we don't know if it's safe to execute because finding that
+        // check in the abstract state would be hard. If the load requires watchpoints, we just
+        // check if we're not in a clobbered state (i.e. in between a side effect and an
+        // invalidation point).
+        for (const MultiGetByOffsetCase& getCase : node->multiGetByOffsetData().cases) {
+            GetByOffsetMethod method = getCase.method();
+            switch (method.kind()) {
+            case GetByOffsetMethod::Invalid:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            case GetByOffsetMethod::Constant: // OK because constants are always safe to execute.
+            case GetByOffsetMethod::Load: // OK because the MultiGetByOffset has its own checks for loading from self.
+                break;
+            case GetByOffsetMethod::LoadFromPrototype:
+                // Only OK if the state isn't clobbered. That's almost always the case.
+                if (state.structureClobberState() != StructuresAreWatched)
+                    return false;
+                if (!graph.isSafeToLoad(method.prototype()->cast<JSObject*>(), method.offset()))
+                    return false;
+                break;
+            }
+        }
+        return true;
+    }
+
+    case LastNodeType:
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGSafepoint.cpp b/dfg/DFGSafepoint.cpp
new file mode 100644
index 0000000..948c057
--- /dev/null
+++ b/dfg/DFGSafepoint.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSafepoint.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGPlan.h"
+#include "DFGScannable.h"
+#include "DFGThreadData.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+Safepoint::Result::~Result()
+{
+    RELEASE_ASSERT(m_wasChecked);
+}
+
+bool Safepoint::Result::didGetCancelled()
+{
+    m_wasChecked = true;
+    return m_didGetCancelled;
+}
+
+Safepoint::Safepoint(Plan& plan, Result& result)
+    : m_vm(plan.vm)
+    , m_plan(plan)
+    , m_didCallBegin(false)
+    , m_result(result)
+{
+    RELEASE_ASSERT(result.m_wasChecked);
+    result.m_wasChecked = false;
+    result.m_didGetCancelled = false;
+}
+
+Safepoint::~Safepoint()
+{
+    RELEASE_ASSERT(m_didCallBegin);
+    if (ThreadData* data = m_plan.threadData) {
+        RELEASE_ASSERT(data->m_safepoint == this);
+        data->m_rightToRun.lock();
+        data->m_safepoint = nullptr;
+    }
+}
+
+void Safepoint::add(Scannable* scannable)
+{
+    RELEASE_ASSERT(!m_didCallBegin);
+    m_scannables.append(scannable);
+}
+
+void Safepoint::begin()
+{
+    RELEASE_ASSERT(!m_didCallBegin);
+    m_didCallBegin = true;
+    if (ThreadData* data = m_plan.threadData) {
+        RELEASE_ASSERT(!data->m_safepoint);
+        data->m_safepoint = this;
+        data->m_rightToRun.unlockFairly();
+    }
+}
+
+void Safepoint::checkLivenessAndVisitChildren(SlotVisitor& visitor)
+{
+    RELEASE_ASSERT(m_didCallBegin);
+
+    if (m_result.m_didGetCancelled)
+        return; // We were cancelled during a previous GC!
+    
+    if (!isKnownToBeLiveDuringGC())
+        return;
+    
+    for (unsigned i = m_scannables.size(); i--;)
+        m_scannables[i]->visitChildren(visitor);
+}
+
+bool Safepoint::isKnownToBeLiveDuringGC()
+{
+    RELEASE_ASSERT(m_didCallBegin);
+    
+    if (m_result.m_didGetCancelled)
+        return true; // We were cancelled during a previous GC, so let's not mess with it this time around - pretend it's live and move on.
+    
+    return m_plan.isKnownToBeLiveDuringGC();
+}
+
+void Safepoint::cancel()
+{
+    RELEASE_ASSERT(m_didCallBegin);
+    RELEASE_ASSERT(!m_result.m_didGetCancelled); // We cannot get cancelled twice because subsequent GCs will think that we're alive and they will not do anything to us.
+    
+    m_plan.cancel();
+    m_result.m_didGetCancelled = true;
+    m_vm = nullptr;
+}
+
+VM* Safepoint::vm() const
+{
+    return m_vm;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGSafepoint.h b/dfg/DFGSafepoint.h
new file mode 100644
index 0000000..f46ccfd
--- /dev/null
+++ b/dfg/DFGSafepoint.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class SlotVisitor;
+class VM;
+
+namespace DFG {
+
+class Scannable;
+struct Plan;
+
+class Safepoint {
+public:
+    class Result {
+    public:
+        Result()
+            : m_didGetCancelled(false)
+            , m_wasChecked(true)
+        {
+        }
+        
+        ~Result();
+        
+        bool didGetCancelled();
+        
+    private:
+        friend class Safepoint;
+        
+        bool m_didGetCancelled;
+        bool m_wasChecked;
+    };
+    
+    Safepoint(Plan&, Result&);
+    ~Safepoint();
+    
+    void add(Scannable*);
+    
+    void begin();
+    
+    void checkLivenessAndVisitChildren(SlotVisitor&);
+    bool isKnownToBeLiveDuringGC();
+    void cancel();
+    
+    VM* vm() const; // May return null if we've been cancelled.
+
+private:
+    VM* m_vm;
+    Plan& m_plan;
+    Vector<Scannable*> m_scannables;
+    bool m_didCallBegin;
+    Result& m_result;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGSaneStringGetByValSlowPathGenerator.h b/dfg/DFGSaneStringGetByValSlowPathGenerator.h
new file mode 100644
index 0000000..1386b7c
--- /dev/null
+++ b/dfg/DFGSaneStringGetByValSlowPathGenerator.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGOperations.h"
+#include "DFGSlowPathGenerator.h"
+#include "DFGSpeculativeJIT.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class SaneStringGetByValSlowPathGenerator : public JumpingSlowPathGenerator<MacroAssembler::Jump> {
+public:
+    SaneStringGetByValSlowPathGenerator(
+        const MacroAssembler::Jump& from, SpeculativeJIT* jit, JSValueRegs resultRegs,
+        GPRReg baseReg, GPRReg propertyReg)
+        : JumpingSlowPathGenerator<MacroAssembler::Jump>(from, jit)
+        , m_resultRegs(resultRegs)
+        , m_baseReg(baseReg)
+        , m_propertyReg(propertyReg)
+    {
+        jit->silentSpillAllRegistersImpl(false, m_plans, extractResult(resultRegs));
+    }
+    
+protected:
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        linkFrom(jit);
+        
+        MacroAssembler::Jump isNeg = jit->m_jit.branch32(
+            MacroAssembler::LessThan, m_propertyReg, MacroAssembler::TrustedImm32(0));
+        
+#if USE(JSVALUE64)
+        jit->m_jit.move(
+            MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), m_resultRegs.gpr());
+#else
+        jit->m_jit.move(
+            MacroAssembler::TrustedImm32(JSValue::UndefinedTag), m_resultRegs.tagGPR());
+        jit->m_jit.move(
+            MacroAssembler::TrustedImm32(0), m_resultRegs.payloadGPR());
+#endif
+        jumpTo(jit);
+        
+        isNeg.link(&jit->m_jit);
+
+        for (unsigned i = 0; i < m_plans.size(); ++i)
+            jit->silentSpill(m_plans[i]);
+        jit->callOperation(operationGetByValStringInt, extractResult(m_resultRegs), m_baseReg, m_propertyReg);
+        GPRReg canTrample = SpeculativeJIT::pickCanTrample(extractResult(m_resultRegs));
+        for (unsigned i = m_plans.size(); i--;)
+            jit->silentFill(m_plans[i], canTrample);
+        jit->m_jit.exceptionCheck();
+        
+        jumpTo(jit);
+    }
+    
+private:
+    JSValueRegs m_resultRegs;
+    GPRReg m_baseReg;
+    GPRReg m_propertyReg;
+    Vector<SilentRegisterSavePlan, 2> m_plans;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGScannable.h b/dfg/DFGScannable.h
new file mode 100644
index 0000000..7d97a72
--- /dev/null
+++ b/dfg/DFGScannable.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC {
+
+class SlotVisitor;
+
+namespace DFG {
+
+class Scannable {
+public:
+    Scannable() { }
+    virtual ~Scannable() { }
+    
+    virtual void visitChildren(SlotVisitor&) = 0;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGScoreBoard.h b/dfg/DFGScoreBoard.h
new file mode 100644
index 0000000..d362a1b
--- /dev/null
+++ b/dfg/DFGScoreBoard.h
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+// === ScoreBoard ===
+//
+// This class is used in performing a virtual register allocation over the graph.
+// VirtualRegisters are allocated to nodes, with a used count for each virtual
+// register tracking the lifespan of the value; after the final use of a node
+// the VirtualRegister associated is freed such that it can be reused for
+// another node.
+class ScoreBoard {
+public:
+    ScoreBoard(unsigned nextMachineLocal)
+        : m_highWatermark(nextMachineLocal + 1)
+    {
+        m_used.fill(max(), nextMachineLocal);
+        m_free.reserveCapacity(nextMachineLocal);
+    }
+
+    ~ScoreBoard()
+    {
+        assertClear();
+    }
+    
+    void sortFree()
+    {
+        std::sort(m_free.begin(), m_free.end());
+    }
+    
+    void assertClear()
+    {
+        if (ASSERT_DISABLED)
+            return;
+        
+        // For every entry in the used list the use count of the virtual register should be zero, or max, due to it being a preserved local.
+        for (size_t i = 0; i < m_used.size(); ++i)
+            RELEASE_ASSERT(!m_used[i] || m_used[i] == max());
+        // For every entry in the free list, the use count should be zero.
+        for (size_t i = 0; i < m_free.size(); ++i)
+            RELEASE_ASSERT(!m_used[m_free[i]]);
+        // There must not be duplicates in the free list.
+        for (size_t i = 0; i < m_free.size(); ++i) {
+            for (size_t j = i + 1; j < m_free.size(); ++j)
+                RELEASE_ASSERT(m_free[i] != m_free[j]);
+        }
+    }
+
+    VirtualRegister allocate()
+    {
+        // Do we have any VirtualRegsiters in the free list, that were used by
+        // prior nodes, but are now available?
+        if (!m_free.isEmpty()) {
+            uint32_t index = m_free.last();
+            m_free.removeLast();
+            // Use count must have hit zero for it to have been added to the free list!
+            ASSERT(!m_used[index]);
+            m_highWatermark = std::max(m_highWatermark, static_cast<unsigned>(index) + 1);
+            return virtualRegisterForLocal(index);
+        }
+
+        // Allocate a new VirtualRegister, and add a corresponding entry to m_used.
+        size_t next = m_used.size();
+        m_used.append(0);
+        m_highWatermark = std::max(m_highWatermark, static_cast<unsigned>(next) + 1);
+        return virtualRegisterForLocal(next);
+    }
+
+    // Increment the usecount for the VirtualRegister associated with 'child',
+    // if it reaches the node's refcount, free the VirtualRegister.
+    void use(Node* child)
+    {
+        if (!child)
+            return;
+
+        // Find the virtual register number for this child, increment its use count.
+        uint32_t index = child->virtualRegister().toLocal();
+        ASSERT(m_used[index] != max());
+        if (child->refCount() == ++m_used[index]) {
+            // If the use count in the scoreboard reaches the use count for the node,
+            // then this was its last use; the virtual register is now free.
+            // Clear the use count & add to the free list.
+            m_used[index] = 0;
+            m_free.append(index);
+        }
+    }
+    void use(Edge child)
+    {
+        use(child.node());
+    }
+    
+    void useIfHasResult(Edge child)
+    {
+        if (!child)
+            return;
+        if (!child->hasResult())
+            return;
+        use(child);
+    }
+
+    unsigned highWatermark()
+    {
+        return m_highWatermark;
+    }
+    
+#ifndef NDEBUG
+    void dump()
+    {
+        dataLogF("    USED: [ ");
+        for (unsigned i = 0; i < m_used.size(); ++i) {
+            if (!m_free.contains(i)) {
+                dataLogF("%d:", i);
+                if (m_used[i] == max())
+                    dataLogF("local ");
+                else
+                    dataLogF("%d ", m_used[i]);
+            }
+        }
+        dataLogF("]\n");
+
+        dataLogF("    FREE: [ ");
+        for (unsigned i = 0; i < m_used.size(); ++i) {
+            if (m_free.contains(i) && m_used[i] != max()) {
+                ASSERT(!m_used[i]);
+                dataLogF("%d ", i);
+            }
+        }
+        dataLogF("]\n");
+    }
+
+#endif
+
+private:
+    static uint32_t max() { return std::numeric_limits<uint32_t>::max(); }
+    
+    // The size of the span of virtual registers that this code block will use.
+    unsigned m_highWatermark;
+    
+    // For every virtual register that has been allocated (either currently alive, or in
+    // the free list), we keep a count of the number of remaining uses until it is dead
+    // (0, in the case of entries in the free list). Since there is an entry for every
+    // allocated VirtualRegister, the length of this array conveniently provides the
+    // next available VirtualRegister number.
+    Vector<uint32_t, 64> m_used;
+    // A free list of VirtualRegsiters no longer alive.
+    Vector<uint32_t, 64> m_free;
+};
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGSilentRegisterSavePlan.h b/dfg/DFGSilentRegisterSavePlan.h
new file mode 100644
index 0000000..800b573
--- /dev/null
+++ b/dfg/DFGSilentRegisterSavePlan.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+
+namespace JSC { namespace DFG {
+
+enum SilentSpillAction {
+    DoNothingForSpill,
+    Store32Tag,
+    Store32Payload,
+    StorePtr,
+    Store64,
+    StoreDouble
+};
+
+enum SilentFillAction {
+    DoNothingForFill,
+    SetInt32Constant,
+    SetInt52Constant,
+    SetStrictInt52Constant,
+    SetBooleanConstant,
+    SetCellConstant,
+    SetTrustedJSConstant,
+    SetJSConstant,
+    SetJSConstantTag,
+    SetJSConstantPayload,
+    SetInt32Tag,
+    SetCellTag,
+    SetBooleanTag,
+    SetDoubleConstant,
+    Load32Tag,
+    Load32Payload,
+    Load32PayloadBoxInt,
+    Load32PayloadConvertToInt52,
+    Load32PayloadSignExtend,
+    LoadPtr,
+    Load64,
+    Load64ShiftInt52Right,
+    Load64ShiftInt52Left,
+    LoadDouble,
+    LoadDoubleBoxDouble,
+    LoadJSUnboxDouble
+};
+
+class SilentRegisterSavePlan {
+public:
+    SilentRegisterSavePlan()
+        : m_spillAction(DoNothingForSpill)
+        , m_fillAction(DoNothingForFill)
+        , m_register(-1)
+        , m_node(0)
+    {
+    }
+    
+    SilentRegisterSavePlan(
+        SilentSpillAction spillAction,
+        SilentFillAction fillAction,
+        Node* node,
+        GPRReg gpr)
+        : m_spillAction(spillAction)
+        , m_fillAction(fillAction)
+        , m_register(gpr)
+        , m_node(node)
+    {
+    }
+    
+    SilentRegisterSavePlan(
+        SilentSpillAction spillAction,
+        SilentFillAction fillAction,
+        Node* node,
+        FPRReg fpr)
+        : m_spillAction(spillAction)
+        , m_fillAction(fillAction)
+        , m_register(fpr)
+        , m_node(node)
+    {
+    }
+    
+    SilentSpillAction spillAction() const { return static_cast<SilentSpillAction>(m_spillAction); }
+    SilentFillAction fillAction() const { return static_cast<SilentFillAction>(m_fillAction); }
+    
+    Node* node() const { return m_node; }
+    
+    GPRReg gpr() const { return static_cast<GPRReg>(m_register); }
+    FPRReg fpr() const { return static_cast<FPRReg>(m_register); }
+    
+private:
+    int8_t m_spillAction;
+    int8_t m_fillAction;
+    int8_t m_register;
+    Node* m_node;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGSlowPathGenerator.h b/dfg/DFGSlowPathGenerator.h
new file mode 100644
index 0000000..67aba80
--- /dev/null
+++ b/dfg/DFGSlowPathGenerator.h
@@ -0,0 +1,269 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGSilentRegisterSavePlan.h"
+#include "DFGSpeculativeJIT.h"
+#include <wtf/FastMalloc.h>
+
+namespace JSC { namespace DFG {
+
+class SlowPathGenerator {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    SlowPathGenerator(SpeculativeJIT* jit)
+        : m_currentNode(jit->m_currentNode)
+        , m_streamIndex(jit->m_stream->size())
+        , m_origin(jit->m_origin) 
+    {
+    }
+    virtual ~SlowPathGenerator() { }
+    void generate(SpeculativeJIT* jit)
+    {
+        m_label = jit->m_jit.label();
+        jit->m_currentNode = m_currentNode;
+        jit->m_outOfLineStreamIndex = m_streamIndex;
+        jit->m_origin = m_origin;
+        generateInternal(jit);
+        jit->m_outOfLineStreamIndex = std::nullopt;
+        if (!ASSERT_DISABLED)
+            jit->m_jit.abortWithReason(DFGSlowPathGeneratorFellThrough);
+    }
+    MacroAssembler::Label label() const { return m_label; }
+    virtual MacroAssembler::Call call() const
+    {
+        RELEASE_ASSERT_NOT_REACHED(); // By default slow path generators don't have a call.
+        return MacroAssembler::Call();
+    }
+
+    const NodeOrigin& origin() const  { return m_origin; }
+
+protected:
+    virtual void generateInternal(SpeculativeJIT*) = 0;
+    MacroAssembler::Label m_label;
+    Node* m_currentNode;
+    unsigned m_streamIndex;
+    NodeOrigin m_origin;
+};
+
+template<typename JumpType>
+class JumpingSlowPathGenerator : public SlowPathGenerator {
+public:
+    JumpingSlowPathGenerator(JumpType from, SpeculativeJIT* jit)
+        : SlowPathGenerator(jit)
+        , m_from(from)
+        , m_to(jit->m_jit.label())
+    {
+    }
+    
+protected:
+    void linkFrom(SpeculativeJIT* jit)
+    {
+        m_from.link(&jit->m_jit);
+    }
+    
+    void jumpTo(SpeculativeJIT* jit)
+    {
+        jit->m_jit.jump().linkTo(m_to, &jit->m_jit);
+    }
+
+    JumpType m_from;
+    MacroAssembler::Label m_to;
+};
+
+enum class ExceptionCheckRequirement {
+    CheckNeeded,
+    CheckNotNeeded
+};
+
+template<typename JumpType, typename FunctionType, typename ResultType>
+class CallSlowPathGenerator : public JumpingSlowPathGenerator<JumpType> {
+public:
+    CallSlowPathGenerator(
+        JumpType from, SpeculativeJIT* jit, FunctionType function,
+        SpillRegistersMode spillMode, ExceptionCheckRequirement requirement, ResultType result)
+        : JumpingSlowPathGenerator<JumpType>(from, jit)
+        , m_function(function)
+        , m_spillMode(spillMode)
+        , m_exceptionCheckRequirement(requirement)
+        , m_result(result)
+    {
+        if (m_spillMode == NeedToSpill)
+            jit->silentSpillAllRegistersImpl(false, m_plans, extractResult(result));
+    }
+    
+    MacroAssembler::Call call() const override
+    {
+        return m_call;
+    }
+    
+protected:
+    void setUp(SpeculativeJIT* jit)
+    {
+        this->linkFrom(jit);
+        if (m_spillMode == NeedToSpill) {
+            for (unsigned i = 0; i < m_plans.size(); ++i)
+                jit->silentSpill(m_plans[i]);
+        }
+    }
+    
+    void recordCall(MacroAssembler::Call call)
+    {
+        m_call = call;
+    }
+    
+    void tearDown(SpeculativeJIT* jit)
+    {
+        if (m_spillMode == NeedToSpill) {
+            GPRReg canTrample = SpeculativeJIT::pickCanTrample(extractResult(m_result));
+            for (unsigned i = m_plans.size(); i--;)
+                jit->silentFill(m_plans[i], canTrample);
+        }
+        if (m_exceptionCheckRequirement == ExceptionCheckRequirement::CheckNeeded)
+            jit->m_jit.exceptionCheck();
+        this->jumpTo(jit);
+    }
+
+    FunctionType m_function;
+    SpillRegistersMode m_spillMode;
+    ExceptionCheckRequirement m_exceptionCheckRequirement;
+    ResultType m_result;
+    MacroAssembler::Call m_call;
+    Vector<SilentRegisterSavePlan, 2> m_plans;
+};
+
+template<typename JumpType, typename FunctionType, typename ResultType, typename... Arguments>
+class CallResultAndArgumentsSlowPathGenerator
+    : public CallSlowPathGenerator<JumpType, FunctionType, ResultType> {
+public:
+    CallResultAndArgumentsSlowPathGenerator(
+        JumpType from, SpeculativeJIT* jit, FunctionType function,
+        SpillRegistersMode spillMode, ExceptionCheckRequirement requirement, ResultType result, Arguments... arguments)
+        : CallSlowPathGenerator<JumpType, FunctionType, ResultType>(
+            from, jit, function, spillMode, requirement, result)
+        , m_arguments(std::forward<Arguments>(arguments)...)
+    {
+    }
+
+protected:
+    template<size_t... ArgumentsIndex>
+    void unpackAndGenerate(SpeculativeJIT* jit, std::index_sequence<ArgumentsIndex...>)
+    {
+        this->setUp(jit);
+        this->recordCall(jit->callOperation(this->m_function, extractResult(this->m_result), std::get<ArgumentsIndex>(m_arguments)...));
+        this->tearDown(jit);
+    }
+
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        unpackAndGenerate(jit, std::make_index_sequence<std::tuple_size<std::tuple<Arguments...>>::value>());
+    }
+
+    std::tuple<Arguments...> m_arguments;
+};
+
+template<typename JumpType, typename FunctionType, typename ResultType, typename... Arguments>
+inline std::unique_ptr<SlowPathGenerator> slowPathCall(
+    JumpType from, SpeculativeJIT* jit, FunctionType function,
+    SpillRegistersMode spillMode, ExceptionCheckRequirement requirement,
+    ResultType result, Arguments... arguments)
+{
+    return std::make_unique<CallResultAndArgumentsSlowPathGenerator<JumpType, FunctionType, ResultType, Arguments...>>(
+        from, jit, function, spillMode, requirement, result, arguments...);
+}
+
+template<typename JumpType, typename FunctionType, typename ResultType, typename... Arguments>
+inline std::unique_ptr<SlowPathGenerator> slowPathCall(
+    JumpType from, SpeculativeJIT* jit, FunctionType function,
+    ResultType result, Arguments... arguments)
+{
+    return slowPathCall(
+        from, jit, function, NeedToSpill, ExceptionCheckRequirement::CheckNeeded, result, arguments...);
+}
+
+template<typename JumpType, typename DestinationType, typename SourceType, unsigned numberOfAssignments>
+class AssigningSlowPathGenerator : public JumpingSlowPathGenerator<JumpType> {
+public:
+    AssigningSlowPathGenerator(
+        JumpType from, SpeculativeJIT* jit,
+        DestinationType destination[numberOfAssignments],
+        SourceType source[numberOfAssignments])
+        : JumpingSlowPathGenerator<JumpType>(from, jit)
+    {
+        for (unsigned i = numberOfAssignments; i--;) {
+            m_destination[i] = destination[i];
+            m_source[i] = source[i];
+        }
+    }
+
+protected:
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        this->linkFrom(jit);
+        for (unsigned i = numberOfAssignments; i--;)
+            jit->m_jit.move(m_source[i], m_destination[i]);
+        this->jumpTo(jit);
+    }
+
+private:
+    DestinationType m_destination[numberOfAssignments];
+    SourceType m_source[numberOfAssignments];
+};
+
+template<typename JumpType, typename DestinationType, typename SourceType, unsigned numberOfAssignments>
+inline std::unique_ptr<SlowPathGenerator> slowPathMove(
+    JumpType from, SpeculativeJIT* jit, SourceType source[numberOfAssignments], DestinationType destination[numberOfAssignments])
+{
+    return std::make_unique<AssigningSlowPathGenerator<JumpType, DestinationType, SourceType, numberOfAssignments>>(
+        from, jit, destination, source);
+}
+
+template<typename JumpType, typename DestinationType, typename SourceType>
+inline std::unique_ptr<SlowPathGenerator> slowPathMove(
+    JumpType from, SpeculativeJIT* jit, SourceType source, DestinationType destination)
+{
+    SourceType sourceArray[1] = { source };
+    DestinationType destinationArray[1] = { destination };
+    return std::make_unique<AssigningSlowPathGenerator<JumpType, DestinationType, SourceType, 1>>(
+        from, jit, destinationArray, sourceArray);
+}
+
+template<typename JumpType, typename DestinationType, typename SourceType>
+inline std::unique_ptr<SlowPathGenerator> slowPathMove(
+    JumpType from, SpeculativeJIT* jit, SourceType source1, DestinationType destination1, SourceType source2, DestinationType destination2)
+{
+    SourceType sourceArray[2] = { source1, source2 };
+    DestinationType destinationArray[2] = { destination1, destination2 };
+    return std::make_unique<AssigningSlowPathGenerator<JumpType, DestinationType, SourceType, 2>>(
+        from, jit, destinationArray, sourceArray);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLD(DFG_JIT)
diff --git a/dfg/DFGSpeculativeJIT.cpp b/dfg/DFGSpeculativeJIT.cpp
new file mode 100644
index 0000000..c3700b2
--- /dev/null
+++ b/dfg/DFGSpeculativeJIT.cpp
@@ -0,0 +1,9578 @@
+/*
+ * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSpeculativeJIT.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "BinarySwitch.h"
+#include "DFGAbstractInterpreterInlines.h"
+#include "DFGArrayifySlowPathGenerator.h"
+#include "DFGCallArrayAllocatorSlowPathGenerator.h"
+#include "DFGCallCreateDirectArgumentsSlowPathGenerator.h"
+#include "DFGCapabilities.h"
+#include "DFGDOMJITPatchpointParams.h"
+#include "DFGMayExit.h"
+#include "DFGOSRExitFuzz.h"
+#include "DFGSaneStringGetByValSlowPathGenerator.h"
+#include "DFGSlowPathGenerator.h"
+#include "DOMJITPatchpoint.h"
+#include "DirectArguments.h"
+#include "JITAddGenerator.h"
+#include "JITBitAndGenerator.h"
+#include "JITBitOrGenerator.h"
+#include "JITBitXorGenerator.h"
+#include "JITDivGenerator.h"
+#include "JITLeftShiftGenerator.h"
+#include "JITMulGenerator.h"
+#include "JITRightShiftGenerator.h"
+#include "JITSubGenerator.h"
+#include "JSAsyncFunction.h"
+#include "JSCInlines.h"
+#include "JSEnvironmentRecord.h"
+#include "JSFixedArray.h"
+#include "JSGeneratorFunction.h"
+#include "JSLexicalEnvironment.h"
+#include "LinkBuffer.h"
+#include "RegExpConstructor.h"
+#include "ScopedArguments.h"
+#include "ScratchRegisterAllocator.h"
+#include <wtf/BitVector.h>
+#include <wtf/Box.h>
+#include <wtf/MathExtras.h>
+
+namespace JSC { namespace DFG {
+
+SpeculativeJIT::SpeculativeJIT(JITCompiler& jit)
+    : m_compileOkay(true)
+    , m_jit(jit)
+    , m_currentNode(0)
+    , m_lastGeneratedNode(LastNodeType)
+    , m_indexInBlock(0)
+    , m_generationInfo(m_jit.graph().frameRegisterCount())
+    , m_state(m_jit.graph())
+    , m_interpreter(m_jit.graph(), m_state)
+    , m_stream(&jit.jitCode()->variableEventStream)
+    , m_minifiedGraph(&jit.jitCode()->minifiedDFG)
+{
+}
+
+SpeculativeJIT::~SpeculativeJIT()
+{
+}
+
+void SpeculativeJIT::emitAllocateRawObject(GPRReg resultGPR, RegisteredStructure structure, GPRReg storageGPR, unsigned numElements, unsigned vectorLength)
+{
+    IndexingType indexingType = structure->indexingType();
+    bool hasIndexingHeader = hasIndexedProperties(indexingType);
+
+    unsigned inlineCapacity = structure->inlineCapacity();
+    unsigned outOfLineCapacity = structure->outOfLineCapacity();
+    
+    GPRTemporary scratch(this);
+    GPRTemporary scratch2(this);
+    GPRReg scratchGPR = scratch.gpr();
+    GPRReg scratch2GPR = scratch2.gpr();
+
+    ASSERT(vectorLength >= numElements);
+    vectorLength = Butterfly::optimalContiguousVectorLength(structure.get(), vectorLength);
+    
+    JITCompiler::JumpList slowCases;
+
+    size_t size = 0;
+    if (hasIndexingHeader)
+        size += vectorLength * sizeof(JSValue) + sizeof(IndexingHeader);
+    size += outOfLineCapacity * sizeof(JSValue);
+
+    m_jit.move(TrustedImmPtr(0), storageGPR);
+    
+    if (size) {
+        if (MarkedAllocator* allocator = m_jit.vm()->auxiliarySpace.allocatorFor(size)) {
+            m_jit.move(TrustedImmPtr(allocator), scratchGPR);
+            m_jit.emitAllocate(storageGPR, allocator, scratchGPR, scratch2GPR, slowCases);
+            
+            m_jit.addPtr(
+                TrustedImm32(outOfLineCapacity * sizeof(JSValue) + sizeof(IndexingHeader)),
+                storageGPR);
+            
+            if (hasIndexingHeader)
+                m_jit.store32(TrustedImm32(vectorLength), MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
+        } else
+            slowCases.append(m_jit.jump());
+    }
+
+    size_t allocationSize = JSFinalObject::allocationSize(inlineCapacity);
+    MarkedAllocator* allocatorPtr = subspaceFor<JSFinalObject>(*m_jit.vm())->allocatorFor(allocationSize);
+    if (allocatorPtr) {
+        m_jit.move(TrustedImmPtr(allocatorPtr), scratchGPR);
+        emitAllocateJSObject(resultGPR, allocatorPtr, scratchGPR, TrustedImmPtr(structure), storageGPR, scratch2GPR, slowCases);
+        m_jit.emitInitializeInlineStorage(resultGPR, structure->inlineCapacity());
+    } else
+        slowCases.append(m_jit.jump());
+
+    // I want a slow path that also loads out the storage pointer, and that's
+    // what this custom CallArrayAllocatorSlowPathGenerator gives me. It's a lot
+    // of work for a very small piece of functionality. :-/
+    addSlowPathGenerator(std::make_unique<CallArrayAllocatorSlowPathGenerator>(
+        slowCases, this, operationNewRawObject, resultGPR, storageGPR,
+        structure, vectorLength));
+
+    if (numElements < vectorLength) {
+#if USE(JSVALUE64)
+        if (hasDouble(structure->indexingType()))
+            m_jit.move(TrustedImm64(bitwise_cast<int64_t>(PNaN)), scratchGPR);
+        else
+            m_jit.move(TrustedImm64(JSValue::encode(JSValue())), scratchGPR);
+        for (unsigned i = numElements; i < vectorLength; ++i)
+            m_jit.store64(scratchGPR, MacroAssembler::Address(storageGPR, sizeof(double) * i));
+#else
+        EncodedValueDescriptor value;
+        if (hasDouble(structure->indexingType()))
+            value.asInt64 = JSValue::encode(JSValue(JSValue::EncodeAsDouble, PNaN));
+        else
+            value.asInt64 = JSValue::encode(JSValue());
+        for (unsigned i = numElements; i < vectorLength; ++i) {
+            m_jit.store32(TrustedImm32(value.asBits.tag), MacroAssembler::Address(storageGPR, sizeof(double) * i + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(TrustedImm32(value.asBits.payload), MacroAssembler::Address(storageGPR, sizeof(double) * i + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+        }
+#endif
+    }
+    
+    if (hasIndexingHeader)
+        m_jit.store32(TrustedImm32(numElements), MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+    
+    m_jit.emitInitializeOutOfLineStorage(storageGPR, structure->outOfLineCapacity());
+    
+    m_jit.mutatorFence();
+}
+
+void SpeculativeJIT::emitGetLength(InlineCallFrame* inlineCallFrame, GPRReg lengthGPR, bool includeThis)
+{
+    if (inlineCallFrame && !inlineCallFrame->isVarargs())
+        m_jit.move(TrustedImm32(inlineCallFrame->arguments.size() - !includeThis), lengthGPR);
+    else {
+        VirtualRegister argumentCountRegister = m_jit.argumentCount(inlineCallFrame);
+        m_jit.load32(JITCompiler::payloadFor(argumentCountRegister), lengthGPR);
+        if (!includeThis)
+            m_jit.sub32(TrustedImm32(1), lengthGPR);
+    }
+}
+
+void SpeculativeJIT::emitGetLength(CodeOrigin origin, GPRReg lengthGPR, bool includeThis)
+{
+    emitGetLength(origin.inlineCallFrame, lengthGPR, includeThis);
+}
+
+void SpeculativeJIT::emitGetCallee(CodeOrigin origin, GPRReg calleeGPR)
+{
+    if (origin.inlineCallFrame) {
+        if (origin.inlineCallFrame->isClosureCall) {
+            m_jit.loadPtr(
+                JITCompiler::addressFor(origin.inlineCallFrame->calleeRecovery.virtualRegister()),
+                calleeGPR);
+        } else {
+            m_jit.move(
+                TrustedImmPtr::weakPointer(m_jit.graph(), origin.inlineCallFrame->calleeRecovery.constant().asCell()),
+                calleeGPR);
+        }
+    } else
+        m_jit.loadPtr(JITCompiler::addressFor(CallFrameSlot::callee), calleeGPR);
+}
+
+void SpeculativeJIT::emitGetArgumentStart(CodeOrigin origin, GPRReg startGPR)
+{
+    m_jit.addPtr(
+        TrustedImm32(
+            JITCompiler::argumentsStart(origin).offset() * static_cast<int>(sizeof(Register))),
+        GPRInfo::callFrameRegister, startGPR);
+}
+
+MacroAssembler::Jump SpeculativeJIT::emitOSRExitFuzzCheck()
+{
+    if (!Options::useOSRExitFuzz()
+        || !canUseOSRExitFuzzing(m_jit.graph().baselineCodeBlockFor(m_origin.semantic))
+        || !doOSRExitFuzzing())
+        return MacroAssembler::Jump();
+    
+    MacroAssembler::Jump result;
+    
+    m_jit.pushToSave(GPRInfo::regT0);
+    m_jit.load32(&g_numberOfOSRExitFuzzChecks, GPRInfo::regT0);
+    m_jit.add32(TrustedImm32(1), GPRInfo::regT0);
+    m_jit.store32(GPRInfo::regT0, &g_numberOfOSRExitFuzzChecks);
+    unsigned atOrAfter = Options::fireOSRExitFuzzAtOrAfter();
+    unsigned at = Options::fireOSRExitFuzzAt();
+    if (at || atOrAfter) {
+        unsigned threshold;
+        MacroAssembler::RelationalCondition condition;
+        if (atOrAfter) {
+            threshold = atOrAfter;
+            condition = MacroAssembler::Below;
+        } else {
+            threshold = at;
+            condition = MacroAssembler::NotEqual;
+        }
+        MacroAssembler::Jump ok = m_jit.branch32(
+            condition, GPRInfo::regT0, MacroAssembler::TrustedImm32(threshold));
+        m_jit.popToRestore(GPRInfo::regT0);
+        result = m_jit.jump();
+        ok.link(&m_jit);
+    }
+    m_jit.popToRestore(GPRInfo::regT0);
+    
+    return result;
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Node* node, MacroAssembler::Jump jumpToFail)
+{
+    if (!m_compileOkay)
+        return;
+    JITCompiler::Jump fuzzJump = emitOSRExitFuzzCheck();
+    if (fuzzJump.isSet()) {
+        JITCompiler::JumpList jumpsToFail;
+        jumpsToFail.append(fuzzJump);
+        jumpsToFail.append(jumpToFail);
+        m_jit.appendExitInfo(jumpsToFail);
+    } else
+        m_jit.appendExitInfo(jumpToFail);
+    m_jit.jitCode()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Node* node, const MacroAssembler::JumpList& jumpsToFail)
+{
+    if (!m_compileOkay)
+        return;
+    JITCompiler::Jump fuzzJump = emitOSRExitFuzzCheck();
+    if (fuzzJump.isSet()) {
+        JITCompiler::JumpList myJumpsToFail;
+        myJumpsToFail.append(jumpsToFail);
+        myJumpsToFail.append(fuzzJump);
+        m_jit.appendExitInfo(myJumpsToFail);
+    } else
+        m_jit.appendExitInfo(jumpsToFail);
+    m_jit.jitCode()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
+}
+
+OSRExitJumpPlaceholder SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Node* node)
+{
+    if (!m_compileOkay)
+        return OSRExitJumpPlaceholder();
+    unsigned index = m_jit.jitCode()->osrExit.size();
+    m_jit.appendExitInfo();
+    m_jit.jitCode()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
+    return OSRExitJumpPlaceholder(index);
+}
+
+OSRExitJumpPlaceholder SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse)
+{
+    return speculationCheck(kind, jsValueSource, nodeUse.node());
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail)
+{
+    speculationCheck(kind, jsValueSource, nodeUse.node(), jumpToFail);
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, const MacroAssembler::JumpList& jumpsToFail)
+{
+    speculationCheck(kind, jsValueSource, nodeUse.node(), jumpsToFail);
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Node* node, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
+{
+    if (!m_compileOkay)
+        return;
+    unsigned recoveryIndex = m_jit.jitCode()->appendSpeculationRecovery(recovery);
+    m_jit.appendExitInfo(jumpToFail);
+    m_jit.jitCode()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size(), recoveryIndex));
+}
+
+void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
+{
+    speculationCheck(kind, jsValueSource, nodeUse.node(), jumpToFail, recovery);
+}
+
+void SpeculativeJIT::emitInvalidationPoint(Node* node)
+{
+    if (!m_compileOkay)
+        return;
+    OSRExitCompilationInfo& info = m_jit.appendExitInfo(JITCompiler::JumpList());
+    m_jit.jitCode()->appendOSRExit(OSRExit(
+        UncountableInvalidation, JSValueSource(), MethodOfGettingAValueProfile(),
+        this, m_stream->size()));
+    info.m_replacementSource = m_jit.watchpointLabel();
+    ASSERT(info.m_replacementSource.isSet());
+    noResult(node);
+}
+
+void SpeculativeJIT::unreachable(Node* node)
+{
+    m_compileOkay = false;
+    m_jit.abortWithReason(DFGUnreachableNode, node->op());
+}
+
+void SpeculativeJIT::terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, Node* node)
+{
+    if (!m_compileOkay)
+        return;
+    speculationCheck(kind, jsValueRegs, node, m_jit.jump());
+    m_compileOkay = false;
+    if (verboseCompilationEnabled())
+        dataLog("Bailing compilation.\n");
+}
+
+void SpeculativeJIT::terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, Edge nodeUse)
+{
+    terminateSpeculativeExecution(kind, jsValueRegs, nodeUse.node());
+}
+
+void SpeculativeJIT::typeCheck(JSValueSource source, Edge edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail, ExitKind exitKind)
+{
+    ASSERT(needsTypeCheck(edge, typesPassedThrough));
+    m_interpreter.filter(edge, typesPassedThrough);
+    speculationCheck(exitKind, source, edge.node(), jumpToFail);
+}
+
+RegisterSet SpeculativeJIT::usedRegisters()
+{
+    RegisterSet result;
+    
+    for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
+        GPRReg gpr = GPRInfo::toRegister(i);
+        if (m_gprs.isInUse(gpr))
+            result.set(gpr);
+    }
+    for (unsigned i = FPRInfo::numberOfRegisters; i--;) {
+        FPRReg fpr = FPRInfo::toRegister(i);
+        if (m_fprs.isInUse(fpr))
+            result.set(fpr);
+    }
+    
+    result.merge(RegisterSet::stubUnavailableRegisters());
+    
+    return result;
+}
+
+void SpeculativeJIT::addSlowPathGenerator(std::unique_ptr<SlowPathGenerator> slowPathGenerator)
+{
+    m_slowPathGenerators.append(WTFMove(slowPathGenerator));
+}
+
+void SpeculativeJIT::addSlowPathGenerator(std::function<void()> lambda)
+{
+    m_slowPathLambdas.append(SlowPathLambda{ lambda, m_currentNode, static_cast<unsigned>(m_stream->size()) });
+}
+
+void SpeculativeJIT::runSlowPathGenerators(PCToCodeOriginMapBuilder& pcToCodeOriginMapBuilder)
+{
+    for (auto& slowPathGenerator : m_slowPathGenerators) {
+        pcToCodeOriginMapBuilder.appendItem(m_jit.labelIgnoringWatchpoints(), slowPathGenerator->origin().semantic);
+        slowPathGenerator->generate(this);
+    }
+    for (auto& slowPathLambda : m_slowPathLambdas) {
+        Node* currentNode = slowPathLambda.currentNode;
+        m_currentNode = currentNode;
+        m_outOfLineStreamIndex = slowPathLambda.streamIndex;
+        pcToCodeOriginMapBuilder.appendItem(m_jit.labelIgnoringWatchpoints(), currentNode->origin.semantic);
+        slowPathLambda.generator();
+        m_outOfLineStreamIndex = std::nullopt;
+    }
+}
+
+void SpeculativeJIT::clearGenerationInfo()
+{
+    for (unsigned i = 0; i < m_generationInfo.size(); ++i)
+        m_generationInfo[i] = GenerationInfo();
+    m_gprs = RegisterBank<GPRInfo>();
+    m_fprs = RegisterBank<FPRInfo>();
+}
+
+SilentRegisterSavePlan SpeculativeJIT::silentSavePlanForGPR(VirtualRegister spillMe, GPRReg source)
+{
+    GenerationInfo& info = generationInfoFromVirtualRegister(spillMe);
+    Node* node = info.node();
+    DataFormat registerFormat = info.registerFormat();
+    ASSERT(registerFormat != DataFormatNone);
+    ASSERT(registerFormat != DataFormatDouble);
+        
+    SilentSpillAction spillAction;
+    SilentFillAction fillAction;
+        
+    if (!info.needsSpill())
+        spillAction = DoNothingForSpill;
+    else {
+#if USE(JSVALUE64)
+        ASSERT(info.gpr() == source);
+        if (registerFormat == DataFormatInt32)
+            spillAction = Store32Payload;
+        else if (registerFormat == DataFormatCell || registerFormat == DataFormatStorage)
+            spillAction = StorePtr;
+        else if (registerFormat == DataFormatInt52 || registerFormat == DataFormatStrictInt52)
+            spillAction = Store64;
+        else {
+            ASSERT(registerFormat & DataFormatJS);
+            spillAction = Store64;
+        }
+#elif USE(JSVALUE32_64)
+        if (registerFormat & DataFormatJS) {
+            ASSERT(info.tagGPR() == source || info.payloadGPR() == source);
+            spillAction = source == info.tagGPR() ? Store32Tag : Store32Payload;
+        } else {
+            ASSERT(info.gpr() == source);
+            spillAction = Store32Payload;
+        }
+#endif
+    }
+        
+    if (registerFormat == DataFormatInt32) {
+        ASSERT(info.gpr() == source);
+        ASSERT(isJSInt32(info.registerFormat()));
+        if (node->hasConstant()) {
+            ASSERT(node->isInt32Constant());
+            fillAction = SetInt32Constant;
+        } else
+            fillAction = Load32Payload;
+    } else if (registerFormat == DataFormatBoolean) {
+#if USE(JSVALUE64)
+        RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+        fillAction = DoNothingForFill;
+#endif
+#elif USE(JSVALUE32_64)
+        ASSERT(info.gpr() == source);
+        if (node->hasConstant()) {
+            ASSERT(node->isBooleanConstant());
+            fillAction = SetBooleanConstant;
+        } else
+            fillAction = Load32Payload;
+#endif
+    } else if (registerFormat == DataFormatCell) {
+        ASSERT(info.gpr() == source);
+        if (node->hasConstant()) {
+            DFG_ASSERT(m_jit.graph(), m_currentNode, node->isCellConstant());
+            node->asCell(); // To get the assertion.
+            fillAction = SetCellConstant;
+        } else {
+#if USE(JSVALUE64)
+            fillAction = LoadPtr;
+#else
+            fillAction = Load32Payload;
+#endif
+        }
+    } else if (registerFormat == DataFormatStorage) {
+        ASSERT(info.gpr() == source);
+        fillAction = LoadPtr;
+    } else if (registerFormat == DataFormatInt52) {
+        if (node->hasConstant())
+            fillAction = SetInt52Constant;
+        else if (info.spillFormat() == DataFormatInt52)
+            fillAction = Load64;
+        else if (info.spillFormat() == DataFormatStrictInt52)
+            fillAction = Load64ShiftInt52Left;
+        else if (info.spillFormat() == DataFormatNone)
+            fillAction = Load64;
+        else {
+            RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+            fillAction = Load64; // Make GCC happy.
+#endif
+        }
+    } else if (registerFormat == DataFormatStrictInt52) {
+        if (node->hasConstant())
+            fillAction = SetStrictInt52Constant;
+        else if (info.spillFormat() == DataFormatInt52)
+            fillAction = Load64ShiftInt52Right;
+        else if (info.spillFormat() == DataFormatStrictInt52)
+            fillAction = Load64;
+        else if (info.spillFormat() == DataFormatNone)
+            fillAction = Load64;
+        else {
+            RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+            fillAction = Load64; // Make GCC happy.
+#endif
+        }
+    } else {
+        ASSERT(registerFormat & DataFormatJS);
+#if USE(JSVALUE64)
+        ASSERT(info.gpr() == source);
+        if (node->hasConstant()) {
+            if (node->isCellConstant())
+                fillAction = SetTrustedJSConstant;
+            else
+                fillAction = SetJSConstant;
+        } else if (info.spillFormat() == DataFormatInt32) {
+            ASSERT(registerFormat == DataFormatJSInt32);
+            fillAction = Load32PayloadBoxInt;
+        } else
+            fillAction = Load64;
+#else
+        ASSERT(info.tagGPR() == source || info.payloadGPR() == source);
+        if (node->hasConstant())
+            fillAction = info.tagGPR() == source ? SetJSConstantTag : SetJSConstantPayload;
+        else if (info.payloadGPR() == source)
+            fillAction = Load32Payload;
+        else { // Fill the Tag
+            switch (info.spillFormat()) {
+            case DataFormatInt32:
+                ASSERT(registerFormat == DataFormatJSInt32);
+                fillAction = SetInt32Tag;
+                break;
+            case DataFormatCell:
+                ASSERT(registerFormat == DataFormatJSCell);
+                fillAction = SetCellTag;
+                break;
+            case DataFormatBoolean:
+                ASSERT(registerFormat == DataFormatJSBoolean);
+                fillAction = SetBooleanTag;
+                break;
+            default:
+                fillAction = Load32Tag;
+                break;
+            }
+        }
+#endif
+    }
+        
+    return SilentRegisterSavePlan(spillAction, fillAction, node, source);
+}
+    
+SilentRegisterSavePlan SpeculativeJIT::silentSavePlanForFPR(VirtualRegister spillMe, FPRReg source)
+{
+    GenerationInfo& info = generationInfoFromVirtualRegister(spillMe);
+    Node* node = info.node();
+    ASSERT(info.registerFormat() == DataFormatDouble);
+
+    SilentSpillAction spillAction;
+    SilentFillAction fillAction;
+        
+    if (!info.needsSpill())
+        spillAction = DoNothingForSpill;
+    else {
+        ASSERT(!node->hasConstant());
+        ASSERT(info.spillFormat() == DataFormatNone);
+        ASSERT(info.fpr() == source);
+        spillAction = StoreDouble;
+    }
+        
+#if USE(JSVALUE64)
+    if (node->hasConstant()) {
+        node->asNumber(); // To get the assertion.
+        fillAction = SetDoubleConstant;
+    } else {
+        ASSERT(info.spillFormat() == DataFormatNone || info.spillFormat() == DataFormatDouble);
+        fillAction = LoadDouble;
+    }
+#elif USE(JSVALUE32_64)
+    ASSERT(info.registerFormat() == DataFormatDouble);
+    if (node->hasConstant()) {
+        node->asNumber(); // To get the assertion.
+        fillAction = SetDoubleConstant;
+    } else
+        fillAction = LoadDouble;
+#endif
+
+    return SilentRegisterSavePlan(spillAction, fillAction, node, source);
+}
+    
+void SpeculativeJIT::silentSpill(const SilentRegisterSavePlan& plan)
+{
+    switch (plan.spillAction()) {
+    case DoNothingForSpill:
+        break;
+    case Store32Tag:
+        m_jit.store32(plan.gpr(), JITCompiler::tagFor(plan.node()->virtualRegister()));
+        break;
+    case Store32Payload:
+        m_jit.store32(plan.gpr(), JITCompiler::payloadFor(plan.node()->virtualRegister()));
+        break;
+    case StorePtr:
+        m_jit.storePtr(plan.gpr(), JITCompiler::addressFor(plan.node()->virtualRegister()));
+        break;
+#if USE(JSVALUE64)
+    case Store64:
+        m_jit.store64(plan.gpr(), JITCompiler::addressFor(plan.node()->virtualRegister()));
+        break;
+#endif
+    case StoreDouble:
+        m_jit.storeDouble(plan.fpr(), JITCompiler::addressFor(plan.node()->virtualRegister()));
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+    
+void SpeculativeJIT::silentFill(const SilentRegisterSavePlan& plan, GPRReg canTrample)
+{
+#if USE(JSVALUE32_64)
+    UNUSED_PARAM(canTrample);
+#endif
+    switch (plan.fillAction()) {
+    case DoNothingForFill:
+        break;
+    case SetInt32Constant:
+        m_jit.move(Imm32(plan.node()->asInt32()), plan.gpr());
+        break;
+#if USE(JSVALUE64)
+    case SetInt52Constant:
+        m_jit.move(Imm64(plan.node()->asAnyInt() << JSValue::int52ShiftAmount), plan.gpr());
+        break;
+    case SetStrictInt52Constant:
+        m_jit.move(Imm64(plan.node()->asAnyInt()), plan.gpr());
+        break;
+#endif // USE(JSVALUE64)
+    case SetBooleanConstant:
+        m_jit.move(TrustedImm32(plan.node()->asBoolean()), plan.gpr());
+        break;
+    case SetCellConstant:
+        ASSERT(plan.node()->constant()->value().isCell());
+        m_jit.move(TrustedImmPtr(plan.node()->constant()), plan.gpr());
+        break;
+#if USE(JSVALUE64)
+    case SetTrustedJSConstant:
+        m_jit.move(valueOfJSConstantAsImm64(plan.node()).asTrustedImm64(), plan.gpr());
+        break;
+    case SetJSConstant:
+        m_jit.move(valueOfJSConstantAsImm64(plan.node()), plan.gpr());
+        break;
+    case SetDoubleConstant:
+        m_jit.move(Imm64(reinterpretDoubleToInt64(plan.node()->asNumber())), canTrample);
+        m_jit.move64ToDouble(canTrample, plan.fpr());
+        break;
+    case Load32PayloadBoxInt:
+        m_jit.load32(JITCompiler::payloadFor(plan.node()->virtualRegister()), plan.gpr());
+        m_jit.or64(GPRInfo::tagTypeNumberRegister, plan.gpr());
+        break;
+    case Load32PayloadConvertToInt52:
+        m_jit.load32(JITCompiler::payloadFor(plan.node()->virtualRegister()), plan.gpr());
+        m_jit.signExtend32ToPtr(plan.gpr(), plan.gpr());
+        m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), plan.gpr());
+        break;
+    case Load32PayloadSignExtend:
+        m_jit.load32(JITCompiler::payloadFor(plan.node()->virtualRegister()), plan.gpr());
+        m_jit.signExtend32ToPtr(plan.gpr(), plan.gpr());
+        break;
+#else
+    case SetJSConstantTag:
+        m_jit.move(Imm32(plan.node()->asJSValue().tag()), plan.gpr());
+        break;
+    case SetJSConstantPayload:
+        m_jit.move(Imm32(plan.node()->asJSValue().payload()), plan.gpr());
+        break;
+    case SetInt32Tag:
+        m_jit.move(TrustedImm32(JSValue::Int32Tag), plan.gpr());
+        break;
+    case SetCellTag:
+        m_jit.move(TrustedImm32(JSValue::CellTag), plan.gpr());
+        break;
+    case SetBooleanTag:
+        m_jit.move(TrustedImm32(JSValue::BooleanTag), plan.gpr());
+        break;
+    case SetDoubleConstant:
+        m_jit.loadDouble(TrustedImmPtr(m_jit.addressOfDoubleConstant(plan.node())), plan.fpr());
+        break;
+#endif
+    case Load32Tag:
+        m_jit.load32(JITCompiler::tagFor(plan.node()->virtualRegister()), plan.gpr());
+        break;
+    case Load32Payload:
+        m_jit.load32(JITCompiler::payloadFor(plan.node()->virtualRegister()), plan.gpr());
+        break;
+    case LoadPtr:
+        m_jit.loadPtr(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
+        break;
+#if USE(JSVALUE64)
+    case Load64:
+        m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
+        break;
+    case Load64ShiftInt52Right:
+        m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
+        m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), plan.gpr());
+        break;
+    case Load64ShiftInt52Left:
+        m_jit.load64(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.gpr());
+        m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), plan.gpr());
+        break;
+#endif
+    case LoadDouble:
+        m_jit.loadDouble(JITCompiler::addressFor(plan.node()->virtualRegister()), plan.fpr());
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+    
+JITCompiler::Jump SpeculativeJIT::jumpSlowForUnwantedArrayMode(GPRReg tempGPR, ArrayMode arrayMode, IndexingType shape)
+{
+    switch (arrayMode.arrayClass()) {
+    case Array::OriginalArray: {
+        CRASH();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+        JITCompiler::Jump result; // I already know that VC++ takes unkindly to the expression "return Jump()", so I'm doing it this way in anticipation of someone eventually using VC++ to compile the DFG.
+        return result;
+#endif
+    }
+        
+    case Array::Array:
+        m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
+        return m_jit.branch32(
+            MacroAssembler::NotEqual, tempGPR, TrustedImm32(IsArray | shape));
+        
+    case Array::NonArray:
+    case Array::OriginalNonArray:
+        m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
+        return m_jit.branch32(
+            MacroAssembler::NotEqual, tempGPR, TrustedImm32(shape));
+        
+    case Array::PossiblyArray:
+        m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
+        return m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(shape));
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return JITCompiler::Jump();
+}
+
+JITCompiler::JumpList SpeculativeJIT::jumpSlowForUnwantedArrayMode(GPRReg tempGPR, ArrayMode arrayMode)
+{
+    JITCompiler::JumpList result;
+    
+    switch (arrayMode.type()) {
+    case Array::Int32:
+        return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, Int32Shape);
+
+    case Array::Double:
+        return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, DoubleShape);
+
+    case Array::Contiguous:
+        return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, ContiguousShape);
+
+    case Array::Undecided:
+        return jumpSlowForUnwantedArrayMode(tempGPR, arrayMode, UndecidedShape);
+
+    case Array::ArrayStorage:
+    case Array::SlowPutArrayStorage: {
+        ASSERT(!arrayMode.isJSArrayWithOriginalStructure());
+        
+        if (arrayMode.isJSArray()) {
+            if (arrayMode.isSlowPut()) {
+                result.append(
+                    m_jit.branchTest32(
+                        MacroAssembler::Zero, tempGPR, MacroAssembler::TrustedImm32(IsArray)));
+                m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
+                m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
+                result.append(
+                    m_jit.branch32(
+                        MacroAssembler::Above, tempGPR,
+                        TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
+                break;
+            }
+            m_jit.and32(TrustedImm32(IsArray | IndexingShapeMask), tempGPR);
+            result.append(
+                m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(IsArray | ArrayStorageShape)));
+            break;
+        }
+        m_jit.and32(TrustedImm32(IndexingShapeMask), tempGPR);
+        if (arrayMode.isSlowPut()) {
+            m_jit.sub32(TrustedImm32(ArrayStorageShape), tempGPR);
+            result.append(
+                m_jit.branch32(
+                    MacroAssembler::Above, tempGPR,
+                    TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape)));
+            break;
+        }
+        result.append(
+            m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(ArrayStorageShape)));
+        break;
+    }
+    default:
+        CRASH();
+        break;
+    }
+    
+    return result;
+}
+
+void SpeculativeJIT::checkArray(Node* node)
+{
+    ASSERT(node->arrayMode().isSpecific());
+    ASSERT(!node->arrayMode().doesConversion());
+    
+    SpeculateCellOperand base(this, node->child1());
+    GPRReg baseReg = base.gpr();
+    
+    if (node->arrayMode().alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1()))) {
+        noResult(m_currentNode);
+        return;
+    }
+    
+    const ClassInfo* expectedClassInfo = 0;
+    
+    switch (node->arrayMode().type()) {
+    case Array::AnyTypedArray:
+    case Array::String:
+        RELEASE_ASSERT_NOT_REACHED(); // Should have been a Phantom(String:)
+        break;
+    case Array::Int32:
+    case Array::Double:
+    case Array::Contiguous:
+    case Array::Undecided:
+    case Array::ArrayStorage:
+    case Array::SlowPutArrayStorage: {
+        GPRTemporary temp(this);
+        GPRReg tempGPR = temp.gpr();
+        m_jit.load8(MacroAssembler::Address(baseReg, JSCell::indexingTypeAndMiscOffset()), tempGPR);
+        speculationCheck(
+            BadIndexingType, JSValueSource::unboxedCell(baseReg), 0,
+            jumpSlowForUnwantedArrayMode(tempGPR, node->arrayMode()));
+        
+        noResult(m_currentNode);
+        return;
+    }
+    case Array::DirectArguments:
+        speculateCellTypeWithoutTypeFiltering(node->child1(), baseReg, DirectArgumentsType);
+        noResult(m_currentNode);
+        return;
+    case Array::ScopedArguments:
+        speculateCellTypeWithoutTypeFiltering(node->child1(), baseReg, ScopedArgumentsType);
+        noResult(m_currentNode);
+        return;
+    default:
+        speculateCellTypeWithoutTypeFiltering(
+            node->child1(), baseReg,
+            typeForTypedArrayType(node->arrayMode().typedArrayType()));
+        noResult(m_currentNode);
+        return;
+    }
+    
+    RELEASE_ASSERT(expectedClassInfo);
+    
+    GPRTemporary temp(this);
+    GPRTemporary temp2(this);
+    m_jit.emitLoadStructure(baseReg, temp.gpr(), temp2.gpr());
+    speculationCheck(
+        BadType, JSValueSource::unboxedCell(baseReg), node,
+        m_jit.branchPtr(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(temp.gpr(), Structure::classInfoOffset()),
+            TrustedImmPtr(expectedClassInfo)));
+    
+    noResult(m_currentNode);
+}
+
+void SpeculativeJIT::arrayify(Node* node, GPRReg baseReg, GPRReg propertyReg)
+{
+    ASSERT(node->arrayMode().doesConversion());
+    
+    GPRTemporary temp(this);
+    GPRTemporary structure;
+    GPRReg tempGPR = temp.gpr();
+    GPRReg structureGPR = InvalidGPRReg;
+    
+    if (node->op() != ArrayifyToStructure) {
+        GPRTemporary realStructure(this);
+        structure.adopt(realStructure);
+        structureGPR = structure.gpr();
+    }
+        
+    // We can skip all that comes next if we already have array storage.
+    MacroAssembler::JumpList slowPath;
+    
+    if (node->op() == ArrayifyToStructure) {
+        slowPath.append(m_jit.branchWeakStructure(
+            JITCompiler::NotEqual,
+            JITCompiler::Address(baseReg, JSCell::structureIDOffset()),
+            node->structure()));
+    } else {
+        m_jit.load8(
+            MacroAssembler::Address(baseReg, JSCell::indexingTypeAndMiscOffset()), tempGPR);
+        
+        slowPath.append(jumpSlowForUnwantedArrayMode(tempGPR, node->arrayMode()));
+    }
+    
+    addSlowPathGenerator(std::make_unique<ArrayifySlowPathGenerator>(
+        slowPath, this, node, baseReg, propertyReg, tempGPR, structureGPR));
+    
+    noResult(m_currentNode);
+}
+
+void SpeculativeJIT::arrayify(Node* node)
+{
+    ASSERT(node->arrayMode().isSpecific());
+    
+    SpeculateCellOperand base(this, node->child1());
+    
+    if (!node->child2()) {
+        arrayify(node, base.gpr(), InvalidGPRReg);
+        return;
+    }
+    
+    SpeculateInt32Operand property(this, node->child2());
+    
+    arrayify(node, base.gpr(), property.gpr());
+}
+
+GPRReg SpeculativeJIT::fillStorage(Edge edge)
+{
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+    
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        if (info.spillFormat() == DataFormatStorage) {
+            GPRReg gpr = allocate();
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
+            info.fillStorage(*m_stream, gpr);
+            return gpr;
+        }
+        
+        // Must be a cell; fill it as a cell and then return the pointer.
+        return fillSpeculateCell(edge);
+    }
+        
+    case DataFormatStorage: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+        
+    default:
+        return fillSpeculateCell(edge);
+    }
+}
+
+void SpeculativeJIT::useChildren(Node* node)
+{
+    if (node->flags() & NodeHasVarArgs) {
+        for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++) {
+            if (!!m_jit.graph().m_varArgChildren[childIdx])
+                use(m_jit.graph().m_varArgChildren[childIdx]);
+        }
+    } else {
+        Edge child1 = node->child1();
+        if (!child1) {
+            ASSERT(!node->child2() && !node->child3());
+            return;
+        }
+        use(child1);
+        
+        Edge child2 = node->child2();
+        if (!child2) {
+            ASSERT(!node->child3());
+            return;
+        }
+        use(child2);
+        
+        Edge child3 = node->child3();
+        if (!child3)
+            return;
+        use(child3);
+    }
+}
+
+void SpeculativeJIT::compileTryGetById(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case CellUse: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueRegsTemporary result(this, Reuse, base);
+
+        JSValueRegs baseRegs = JSValueRegs::payloadOnly(base.gpr());
+        JSValueRegs resultRegs = result.regs();
+
+        base.use();
+
+        cachedGetById(node->origin.semantic, baseRegs, resultRegs, node->identifierNumber(), JITCompiler::Jump(), NeedToSpill, AccessType::GetPure);
+
+        jsValueResult(resultRegs, node, DataFormatJS, UseChildrenCalledExplicitly);
+        break;
+    }
+
+    case UntypedUse: {
+        JSValueOperand base(this, node->child1());
+        JSValueRegsTemporary result(this, Reuse, base);
+
+        JSValueRegs baseRegs = base.jsValueRegs();
+        JSValueRegs resultRegs = result.regs();
+
+        base.use();
+
+        JITCompiler::Jump notCell = m_jit.branchIfNotCell(baseRegs);
+
+        cachedGetById(node->origin.semantic, baseRegs, resultRegs, node->identifierNumber(), notCell, NeedToSpill, AccessType::GetPure);
+
+        jsValueResult(resultRegs, node, DataFormatJS, UseChildrenCalledExplicitly);
+        break;
+    }
+
+    default:
+        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        break;
+    } 
+}
+
+void SpeculativeJIT::compileIn(Node* node)
+{
+    SpeculateCellOperand base(this, node->child2());
+    GPRReg baseGPR = base.gpr();
+    
+    if (JSString* string = node->child1()->dynamicCastConstant<JSString*>()) {
+        if (string->tryGetValueImpl() && string->tryGetValueImpl()->isAtomic()) {
+            StructureStubInfo* stubInfo = m_jit.codeBlock()->addStubInfo(AccessType::In);
+            
+            GPRTemporary result(this);
+            GPRReg resultGPR = result.gpr();
+
+            use(node->child1());
+            
+            MacroAssembler::PatchableJump jump = m_jit.patchableJump();
+            MacroAssembler::Label done = m_jit.label();
+            
+            // Since this block is executed only when the result of string->tryGetValueImpl() is atomic,
+            // we can cast it to const AtomicStringImpl* safely.
+            auto slowPath = slowPathCall(
+                jump.m_jump, this, operationInOptimize,
+                JSValueRegs::payloadOnly(resultGPR), stubInfo, baseGPR,
+                static_cast<const AtomicStringImpl*>(string->tryGetValueImpl()));
+            
+            stubInfo->callSiteIndex = m_jit.addCallSite(node->origin.semantic);
+            stubInfo->codeOrigin = node->origin.semantic;
+            stubInfo->patch.baseGPR = static_cast<int8_t>(baseGPR);
+            stubInfo->patch.valueGPR = static_cast<int8_t>(resultGPR);
+#if USE(JSVALUE32_64)
+            stubInfo->patch.valueTagGPR = static_cast<int8_t>(InvalidGPRReg);
+            stubInfo->patch.baseTagGPR = static_cast<int8_t>(InvalidGPRReg);
+#endif
+            stubInfo->patch.usedRegisters = usedRegisters();
+
+            m_jit.addIn(InRecord(jump, done, slowPath.get(), stubInfo));
+            addSlowPathGenerator(WTFMove(slowPath));
+
+            base.use();
+
+            blessedBooleanResult(resultGPR, node, UseChildrenCalledExplicitly);
+            return;
+        }
+    }
+
+    JSValueOperand key(this, node->child1());
+    JSValueRegs regs = key.jsValueRegs();
+        
+    GPRFlushedCallResult result(this);
+    GPRReg resultGPR = result.gpr();
+        
+    base.use();
+    key.use();
+        
+    flushRegisters();
+    callOperation(
+        operationGenericIn, extractResult(JSValueRegs::payloadOnly(resultGPR)),
+        baseGPR, regs);
+    m_jit.exceptionCheck();
+    blessedBooleanResult(resultGPR, node, UseChildrenCalledExplicitly);
+}
+
+void SpeculativeJIT::compileDeleteById(Node* node)
+{
+    JSValueOperand value(this, node->child1());
+    GPRFlushedCallResult result(this);
+
+    JSValueRegs valueRegs = value.jsValueRegs();
+    GPRReg resultGPR = result.gpr();
+
+    value.use();
+
+    flushRegisters();
+    callOperation(operationDeleteById, resultGPR, valueRegs, identifierUID(node->identifierNumber()));
+    m_jit.exceptionCheck();
+
+    unblessedBooleanResult(resultGPR, node, UseChildrenCalledExplicitly);
+}
+
+void SpeculativeJIT::compileDeleteByVal(Node* node)
+{
+    JSValueOperand base(this, node->child1());
+    JSValueOperand key(this, node->child2());
+    GPRFlushedCallResult result(this);
+
+    JSValueRegs baseRegs = base.jsValueRegs();
+    JSValueRegs keyRegs = key.jsValueRegs();
+    GPRReg resultGPR = result.gpr();
+
+    base.use();
+    key.use();
+
+    flushRegisters();
+    callOperation(operationDeleteByVal, resultGPR, baseRegs, keyRegs);
+    m_jit.exceptionCheck();
+
+    unblessedBooleanResult(resultGPR, node, UseChildrenCalledExplicitly);
+}
+
+bool SpeculativeJIT::nonSpeculativeCompare(Node* node, MacroAssembler::RelationalCondition cond, S_JITOperation_EJJ helperFunction)
+{
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        Node* branchNode = m_block->at(branchIndexInBlock);
+
+        ASSERT(node->adjustedRefCount() == 1);
+        
+        nonSpeculativePeepholeBranch(node, branchNode, cond, helperFunction);
+    
+        m_indexInBlock = branchIndexInBlock;
+        m_currentNode = branchNode;
+        
+        return true;
+    }
+    
+    nonSpeculativeNonPeepholeCompare(node, cond, helperFunction);
+    
+    return false;
+}
+
+bool SpeculativeJIT::nonSpeculativeStrictEq(Node* node, bool invert)
+{
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        Node* branchNode = m_block->at(branchIndexInBlock);
+
+        ASSERT(node->adjustedRefCount() == 1);
+        
+        nonSpeculativePeepholeStrictEq(node, branchNode, invert);
+    
+        m_indexInBlock = branchIndexInBlock;
+        m_currentNode = branchNode;
+        
+        return true;
+    }
+    
+    nonSpeculativeNonPeepholeStrictEq(node, invert);
+    
+    return false;
+}
+
+static const char* dataFormatString(DataFormat format)
+{
+    // These values correspond to the DataFormat enum.
+    const char* strings[] = {
+        "[  ]",
+        "[ i]",
+        "[ d]",
+        "[ c]",
+        "Err!",
+        "Err!",
+        "Err!",
+        "Err!",
+        "[J ]",
+        "[Ji]",
+        "[Jd]",
+        "[Jc]",
+        "Err!",
+        "Err!",
+        "Err!",
+        "Err!",
+    };
+    return strings[format];
+}
+
+void SpeculativeJIT::dump(const char* label)
+{
+    if (label)
+        dataLogF("<%s>\n", label);
+
+    dataLogF("  gprs:\n");
+    m_gprs.dump();
+    dataLogF("  fprs:\n");
+    m_fprs.dump();
+    dataLogF("  VirtualRegisters:\n");
+    for (unsigned i = 0; i < m_generationInfo.size(); ++i) {
+        GenerationInfo& info = m_generationInfo[i];
+        if (info.alive())
+            dataLogF("    % 3d:%s%s", i, dataFormatString(info.registerFormat()), dataFormatString(info.spillFormat()));
+        else
+            dataLogF("    % 3d:[__][__]", i);
+        if (info.registerFormat() == DataFormatDouble)
+            dataLogF(":fpr%d\n", info.fpr());
+        else if (info.registerFormat() != DataFormatNone
+#if USE(JSVALUE32_64)
+            && !(info.registerFormat() & DataFormatJS)
+#endif
+            ) {
+            ASSERT(info.gpr() != InvalidGPRReg);
+            dataLogF(":%s\n", GPRInfo::debugName(info.gpr()));
+        } else
+            dataLogF("\n");
+    }
+    if (label)
+        dataLogF("</%s>\n", label);
+}
+
+GPRTemporary::GPRTemporary()
+    : m_jit(0)
+    , m_gpr(InvalidGPRReg)
+{
+}
+
+GPRTemporary::GPRTemporary(SpeculativeJIT* jit)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    m_gpr = m_jit->allocate();
+}
+
+GPRTemporary::GPRTemporary(SpeculativeJIT* jit, GPRReg specific)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    m_gpr = m_jit->allocate(specific);
+}
+
+#if USE(JSVALUE32_64)
+GPRTemporary::GPRTemporary(
+    SpeculativeJIT* jit, ReuseTag, JSValueOperand& op1, WhichValueWord which)
+    : m_jit(jit)
+    , m_gpr(InvalidGPRReg)
+{
+    if (!op1.isDouble() && m_jit->canReuse(op1.node()))
+        m_gpr = m_jit->reuse(op1.gpr(which));
+    else
+        m_gpr = m_jit->allocate();
+}
+#endif // USE(JSVALUE32_64)
+
+JSValueRegsTemporary::JSValueRegsTemporary() { }
+
+JSValueRegsTemporary::JSValueRegsTemporary(SpeculativeJIT* jit)
+#if USE(JSVALUE64)
+    : m_gpr(jit)
+#else
+    : m_payloadGPR(jit)
+    , m_tagGPR(jit)
+#endif
+{
+}
+
+#if USE(JSVALUE64)
+template<typename T>
+JSValueRegsTemporary::JSValueRegsTemporary(SpeculativeJIT* jit, ReuseTag, T& operand, WhichValueWord)
+    : m_gpr(jit, Reuse, operand)
+{
+}
+#else
+template<typename T>
+JSValueRegsTemporary::JSValueRegsTemporary(SpeculativeJIT* jit, ReuseTag, T& operand, WhichValueWord resultWord)
+{
+    if (resultWord == PayloadWord) {
+        m_payloadGPR = GPRTemporary(jit, Reuse, operand);
+        m_tagGPR = GPRTemporary(jit);
+    } else {
+        m_payloadGPR = GPRTemporary(jit);
+        m_tagGPR = GPRTemporary(jit, Reuse, operand);
+    }
+}
+#endif
+
+#if USE(JSVALUE64)
+JSValueRegsTemporary::JSValueRegsTemporary(SpeculativeJIT* jit, ReuseTag, JSValueOperand& operand)
+{
+    m_gpr = GPRTemporary(jit, Reuse, operand);
+}
+#else
+JSValueRegsTemporary::JSValueRegsTemporary(SpeculativeJIT* jit, ReuseTag, JSValueOperand& operand)
+{
+    if (jit->canReuse(operand.node())) {
+        m_payloadGPR = GPRTemporary(jit, Reuse, operand, PayloadWord);
+        m_tagGPR = GPRTemporary(jit, Reuse, operand, TagWord);
+    } else {
+        m_payloadGPR = GPRTemporary(jit);
+        m_tagGPR = GPRTemporary(jit);
+    }
+}
+#endif
+
+JSValueRegsTemporary::~JSValueRegsTemporary() { }
+
+JSValueRegs JSValueRegsTemporary::regs()
+{
+#if USE(JSVALUE64)
+    return JSValueRegs(m_gpr.gpr());
+#else
+    return JSValueRegs(m_tagGPR.gpr(), m_payloadGPR.gpr());
+#endif
+}
+
+void GPRTemporary::adopt(GPRTemporary& other)
+{
+    ASSERT(!m_jit);
+    ASSERT(m_gpr == InvalidGPRReg);
+    ASSERT(other.m_jit);
+    ASSERT(other.m_gpr != InvalidGPRReg);
+    m_jit = other.m_jit;
+    m_gpr = other.m_gpr;
+    other.m_jit = 0;
+    other.m_gpr = InvalidGPRReg;
+}
+
+FPRTemporary::FPRTemporary(FPRTemporary&& other)
+{
+    ASSERT(other.m_jit);
+    ASSERT(other.m_fpr != InvalidFPRReg);
+    m_jit = other.m_jit;
+    m_fpr = other.m_fpr;
+
+    other.m_jit = nullptr;
+}
+
+FPRTemporary::FPRTemporary(SpeculativeJIT* jit)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    m_fpr = m_jit->fprAllocate();
+}
+
+FPRTemporary::FPRTemporary(SpeculativeJIT* jit, SpeculateDoubleOperand& op1)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    if (m_jit->canReuse(op1.node()))
+        m_fpr = m_jit->reuse(op1.fpr());
+    else
+        m_fpr = m_jit->fprAllocate();
+}
+
+FPRTemporary::FPRTemporary(SpeculativeJIT* jit, SpeculateDoubleOperand& op1, SpeculateDoubleOperand& op2)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    if (m_jit->canReuse(op1.node()))
+        m_fpr = m_jit->reuse(op1.fpr());
+    else if (m_jit->canReuse(op2.node()))
+        m_fpr = m_jit->reuse(op2.fpr());
+    else if (m_jit->canReuse(op1.node(), op2.node()) && op1.fpr() == op2.fpr())
+        m_fpr = m_jit->reuse(op1.fpr());
+    else
+        m_fpr = m_jit->fprAllocate();
+}
+
+#if USE(JSVALUE32_64)
+FPRTemporary::FPRTemporary(SpeculativeJIT* jit, JSValueOperand& op1)
+    : m_jit(jit)
+    , m_fpr(InvalidFPRReg)
+{
+    if (op1.isDouble() && m_jit->canReuse(op1.node()))
+        m_fpr = m_jit->reuse(op1.fpr());
+    else
+        m_fpr = m_jit->fprAllocate();
+}
+#endif
+
+void SpeculativeJIT::compilePeepHoleDoubleBranch(Node* node, Node* branchNode, JITCompiler::DoubleCondition condition)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    if (taken == nextBlock()) {
+        condition = MacroAssembler::invert(condition);
+        std::swap(taken, notTaken);
+    }
+
+    SpeculateDoubleOperand op1(this, node->child1());
+    SpeculateDoubleOperand op2(this, node->child2());
+    
+    branchDouble(condition, op1.fpr(), op2.fpr(), taken);
+    jump(notTaken);
+}
+
+void SpeculativeJIT::compilePeepHoleObjectEquality(Node* node, Node* branchNode)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    MacroAssembler::RelationalCondition condition = MacroAssembler::Equal;
+    
+    if (taken == nextBlock()) {
+        condition = MacroAssembler::NotEqual;
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+
+    SpeculateCellOperand op1(this, node->child1());
+    SpeculateCellOperand op2(this, node->child2());
+    
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.gpr();
+    
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        if (m_state.forNode(node->child1()).m_type & ~SpecObject) {
+            speculationCheck(
+                BadType, JSValueSource::unboxedCell(op1GPR), node->child1(), m_jit.branchIfNotObject(op1GPR));
+        }
+        if (m_state.forNode(node->child2()).m_type & ~SpecObject) {
+            speculationCheck(
+                BadType, JSValueSource::unboxedCell(op2GPR), node->child2(), m_jit.branchIfNotObject(op2GPR));
+        }
+    } else {
+        if (m_state.forNode(node->child1()).m_type & ~SpecObject) {
+            speculationCheck(
+                BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+                m_jit.branchIfNotObject(op1GPR));
+        }
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+        if (m_state.forNode(node->child2()).m_type & ~SpecObject) {
+            speculationCheck(
+                BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+                m_jit.branchIfNotObject(op2GPR));
+        }
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op2GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+
+    branchPtr(condition, op1GPR, op2GPR, taken);
+    jump(notTaken);
+}
+
+void SpeculativeJIT::compilePeepHoleBooleanBranch(Node* node, Node* branchNode, JITCompiler::RelationalCondition condition)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    // The branch instruction will branch to the taken block.
+    // If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
+    if (taken == nextBlock()) {
+        condition = JITCompiler::invert(condition);
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+
+    if (node->child1()->isInt32Constant()) {
+        int32_t imm = node->child1()->asInt32();
+        SpeculateBooleanOperand op2(this, node->child2());
+        branch32(condition, JITCompiler::Imm32(imm), op2.gpr(), taken);
+    } else if (node->child2()->isInt32Constant()) {
+        SpeculateBooleanOperand op1(this, node->child1());
+        int32_t imm = node->child2()->asInt32();
+        branch32(condition, op1.gpr(), JITCompiler::Imm32(imm), taken);
+    } else {
+        SpeculateBooleanOperand op1(this, node->child1());
+        SpeculateBooleanOperand op2(this, node->child2());
+        branch32(condition, op1.gpr(), op2.gpr(), taken);
+    }
+
+    jump(notTaken);
+}
+
+void SpeculativeJIT::compileToLowerCase(Node* node)
+{
+    ASSERT(node->op() == ToLowerCase);
+    SpeculateCellOperand string(this, node->child1());
+    GPRTemporary temp(this);
+    GPRTemporary index(this);
+    GPRTemporary charReg(this);
+    GPRTemporary length(this);
+
+    GPRReg stringGPR = string.gpr();
+    GPRReg tempGPR = temp.gpr();
+    GPRReg indexGPR = index.gpr();
+    GPRReg charGPR = charReg.gpr();
+    GPRReg lengthGPR = length.gpr();
+
+    speculateString(node->child1(), stringGPR);
+
+    CCallHelpers::JumpList slowPath;
+
+    m_jit.move(TrustedImmPtr(0), indexGPR);
+
+    m_jit.loadPtr(MacroAssembler::Address(stringGPR, JSString::offsetOfValue()), tempGPR);
+    slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, tempGPR));
+
+    slowPath.append(m_jit.branchTest32(
+        MacroAssembler::Zero, MacroAssembler::Address(tempGPR, StringImpl::flagsOffset()),
+        MacroAssembler::TrustedImm32(StringImpl::flagIs8Bit())));
+    m_jit.load32(MacroAssembler::Address(tempGPR, StringImpl::lengthMemoryOffset()), lengthGPR);
+    m_jit.loadPtr(MacroAssembler::Address(tempGPR, StringImpl::dataOffset()), tempGPR);
+
+    auto loopStart = m_jit.label();
+    auto loopDone = m_jit.branch32(CCallHelpers::AboveOrEqual, indexGPR, lengthGPR);
+    m_jit.load8(MacroAssembler::BaseIndex(tempGPR, indexGPR, MacroAssembler::TimesOne), charGPR);
+    slowPath.append(m_jit.branchTest32(CCallHelpers::NonZero, charGPR, TrustedImm32(~0x7F)));
+    m_jit.sub32(TrustedImm32('A'), charGPR);
+    slowPath.append(m_jit.branch32(CCallHelpers::BelowOrEqual, charGPR, TrustedImm32('Z' - 'A')));
+
+    m_jit.add32(TrustedImm32(1), indexGPR);
+    m_jit.jump().linkTo(loopStart, &m_jit);
+    
+    slowPath.link(&m_jit);
+    silentSpillAllRegisters(lengthGPR);
+    callOperation(operationToLowerCase, lengthGPR, stringGPR, indexGPR);
+    silentFillAllRegisters(lengthGPR);
+    m_jit.exceptionCheck();
+    auto done = m_jit.jump();
+
+    loopDone.link(&m_jit);
+    m_jit.move(stringGPR, lengthGPR);
+
+    done.link(&m_jit);
+    cellResult(lengthGPR, node);
+}
+
+void SpeculativeJIT::compilePeepHoleInt32Branch(Node* node, Node* branchNode, JITCompiler::RelationalCondition condition)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    // The branch instruction will branch to the taken block.
+    // If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
+    if (taken == nextBlock()) {
+        condition = JITCompiler::invert(condition);
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+
+    if (node->child1()->isInt32Constant()) {
+        int32_t imm = node->child1()->asInt32();
+        SpeculateInt32Operand op2(this, node->child2());
+        branch32(condition, JITCompiler::Imm32(imm), op2.gpr(), taken);
+    } else if (node->child2()->isInt32Constant()) {
+        SpeculateInt32Operand op1(this, node->child1());
+        int32_t imm = node->child2()->asInt32();
+        branch32(condition, op1.gpr(), JITCompiler::Imm32(imm), taken);
+    } else {
+        SpeculateInt32Operand op1(this, node->child1());
+        SpeculateInt32Operand op2(this, node->child2());
+        branch32(condition, op1.gpr(), op2.gpr(), taken);
+    }
+
+    jump(notTaken);
+}
+
+// Returns true if the compare is fused with a subsequent branch.
+bool SpeculativeJIT::compilePeepHoleBranch(Node* node, MacroAssembler::RelationalCondition condition, MacroAssembler::DoubleCondition doubleCondition, S_JITOperation_EJJ operation)
+{
+    // Fused compare & branch.
+    unsigned branchIndexInBlock = detectPeepHoleBranch();
+    if (branchIndexInBlock != UINT_MAX) {
+        Node* branchNode = m_block->at(branchIndexInBlock);
+
+        // detectPeepHoleBranch currently only permits the branch to be the very next node,
+        // so can be no intervening nodes to also reference the compare. 
+        ASSERT(node->adjustedRefCount() == 1);
+
+        if (node->isBinaryUseKind(Int32Use))
+            compilePeepHoleInt32Branch(node, branchNode, condition);
+#if USE(JSVALUE64)
+        else if (node->isBinaryUseKind(Int52RepUse))
+            compilePeepHoleInt52Branch(node, branchNode, condition);
+#endif // USE(JSVALUE64)
+        else if (node->isBinaryUseKind(StringUse) || node->isBinaryUseKind(StringIdentUse)) {
+            // Use non-peephole comparison, for now.
+            return false;
+        } else if (node->isBinaryUseKind(DoubleRepUse))
+            compilePeepHoleDoubleBranch(node, branchNode, doubleCondition);
+        else if (node->op() == CompareEq) {
+            if (node->isBinaryUseKind(BooleanUse))
+                compilePeepHoleBooleanBranch(node, branchNode, condition);
+            else if (node->isBinaryUseKind(SymbolUse))
+                compilePeepHoleSymbolEquality(node, branchNode);
+            else if (node->isBinaryUseKind(ObjectUse))
+                compilePeepHoleObjectEquality(node, branchNode);
+            else if (node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse))
+                compilePeepHoleObjectToObjectOrOtherEquality(node->child1(), node->child2(), branchNode);
+            else if (node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse))
+                compilePeepHoleObjectToObjectOrOtherEquality(node->child2(), node->child1(), branchNode);
+            else if (!needsTypeCheck(node->child1(), SpecOther))
+                nonSpeculativePeepholeBranchNullOrUndefined(node->child2(), branchNode);
+            else if (!needsTypeCheck(node->child2(), SpecOther))
+                nonSpeculativePeepholeBranchNullOrUndefined(node->child1(), branchNode);
+            else {
+                nonSpeculativePeepholeBranch(node, branchNode, condition, operation);
+                return true;
+            }
+        } else {
+            nonSpeculativePeepholeBranch(node, branchNode, condition, operation);
+            return true;
+        }
+
+        use(node->child1());
+        use(node->child2());
+        m_indexInBlock = branchIndexInBlock;
+        m_currentNode = branchNode;
+        return true;
+    }
+    return false;
+}
+
+void SpeculativeJIT::noticeOSRBirth(Node* node)
+{
+    if (!node->hasVirtualRegister())
+        return;
+    
+    VirtualRegister virtualRegister = node->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+    
+    info.noticeOSRBirth(*m_stream, node, virtualRegister);
+}
+
+void SpeculativeJIT::compileMovHint(Node* node)
+{
+    ASSERT(node->containsMovHint() && node->op() != ZombieHint);
+    
+    Node* child = node->child1().node();
+    noticeOSRBirth(child);
+    
+    m_stream->appendAndLog(VariableEvent::movHint(MinifiedID(child), node->unlinkedLocal()));
+}
+
+void SpeculativeJIT::bail(AbortReason reason)
+{
+    if (verboseCompilationEnabled())
+        dataLog("Bailing compilation.\n");
+    m_compileOkay = true;
+    m_jit.abortWithReason(reason, m_lastGeneratedNode);
+    clearGenerationInfo();
+}
+
+void SpeculativeJIT::compileCurrentBlock()
+{
+    ASSERT(m_compileOkay);
+    
+    if (!m_block)
+        return;
+    
+    ASSERT(m_block->isReachable);
+    
+    m_jit.blockHeads()[m_block->index] = m_jit.label();
+
+    if (!m_block->intersectionOfCFAHasVisited) {
+        // Don't generate code for basic blocks that are unreachable according to CFA.
+        // But to be sure that nobody has generated a jump to this block, drop in a
+        // breakpoint here.
+        m_jit.abortWithReason(DFGUnreachableBasicBlock);
+        return;
+    }
+
+    m_stream->appendAndLog(VariableEvent::reset());
+    
+    m_jit.jitAssertHasValidCallFrame();
+    m_jit.jitAssertTagsInPlace();
+    m_jit.jitAssertArgumentCountSane();
+
+    m_state.reset();
+    m_state.beginBasicBlock(m_block);
+    
+    for (size_t i = m_block->variablesAtHead.size(); i--;) {
+        int operand = m_block->variablesAtHead.operandForIndex(i);
+        Node* node = m_block->variablesAtHead[i];
+        if (!node)
+            continue; // No need to record dead SetLocal's.
+        
+        VariableAccessData* variable = node->variableAccessData();
+        DataFormat format;
+        if (!node->refCount())
+            continue; // No need to record dead SetLocal's.
+        format = dataFormatFor(variable->flushFormat());
+        m_stream->appendAndLog(
+            VariableEvent::setLocal(
+                VirtualRegister(operand),
+                variable->machineLocal(),
+                format));
+    }
+
+    m_origin = NodeOrigin();
+    
+    for (m_indexInBlock = 0; m_indexInBlock < m_block->size(); ++m_indexInBlock) {
+        m_currentNode = m_block->at(m_indexInBlock);
+        
+        // We may have hit a contradiction that the CFA was aware of but that the JIT
+        // didn't cause directly.
+        if (!m_state.isValid()) {
+            bail(DFGBailedAtTopOfBlock);
+            return;
+        }
+
+        m_interpreter.startExecuting();
+        m_interpreter.executeKnownEdgeTypes(m_currentNode);
+        m_jit.setForNode(m_currentNode);
+        m_origin = m_currentNode->origin;
+        if (validationEnabled())
+            m_origin.exitOK &= mayExit(m_jit.graph(), m_currentNode) == Exits;
+        m_lastGeneratedNode = m_currentNode->op();
+        
+        ASSERT(m_currentNode->shouldGenerate());
+        
+        if (verboseCompilationEnabled()) {
+            dataLogF(
+                "SpeculativeJIT generating Node @%d (bc#%u) at JIT offset 0x%x",
+                (int)m_currentNode->index(),
+                m_currentNode->origin.semantic.bytecodeIndex, m_jit.debugOffset());
+            dataLog("\n");
+        }
+
+        if (Options::validateDFGExceptionHandling() && (mayExit(m_jit.graph(), m_currentNode) != DoesNotExit || m_currentNode->isTerminal()))
+            m_jit.jitReleaseAssertNoException();
+
+        m_jit.pcToCodeOriginMapBuilder().appendItem(m_jit.labelIgnoringWatchpoints(), m_origin.semantic);
+
+        compile(m_currentNode);
+        
+        if (belongsInMinifiedGraph(m_currentNode->op()))
+            m_minifiedGraph->append(MinifiedNode::fromNode(m_currentNode));
+        
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+        m_jit.clearRegisterAllocationOffsets();
+#endif
+        
+        if (!m_compileOkay) {
+            bail(DFGBailedAtEndOfNode);
+            return;
+        }
+        
+        // Make sure that the abstract state is rematerialized for the next node.
+        m_interpreter.executeEffects(m_indexInBlock);
+    }
+    
+    // Perform the most basic verification that children have been used correctly.
+    if (!ASSERT_DISABLED) {
+        for (unsigned index = 0; index < m_generationInfo.size(); ++index) {
+            GenerationInfo& info = m_generationInfo[index];
+            RELEASE_ASSERT(!info.alive());
+        }
+    }
+}
+
+// If we are making type predictions about our arguments then
+// we need to check that they are correct on function entry.
+void SpeculativeJIT::checkArgumentTypes()
+{
+    ASSERT(!m_currentNode);
+    m_origin = NodeOrigin(CodeOrigin(0), CodeOrigin(0), true);
+
+    for (int i = 0; i < m_jit.codeBlock()->numParameters(); ++i) {
+        Node* node = m_jit.graph().m_arguments[i];
+        if (!node) {
+            // The argument is dead. We don't do any checks for such arguments.
+            continue;
+        }
+        
+        ASSERT(node->op() == SetArgument);
+        ASSERT(node->shouldGenerate());
+
+        VariableAccessData* variableAccessData = node->variableAccessData();
+        FlushFormat format = variableAccessData->flushFormat();
+        
+        if (format == FlushedJSValue)
+            continue;
+        
+        VirtualRegister virtualRegister = variableAccessData->local();
+
+        JSValueSource valueSource = JSValueSource(JITCompiler::addressFor(virtualRegister));
+        
+#if USE(JSVALUE64)
+        switch (format) {
+        case FlushedInt32: {
+            speculationCheck(BadType, valueSource, node, m_jit.branch64(MacroAssembler::Below, JITCompiler::addressFor(virtualRegister), GPRInfo::tagTypeNumberRegister));
+            break;
+        }
+        case FlushedBoolean: {
+            GPRTemporary temp(this);
+            m_jit.load64(JITCompiler::addressFor(virtualRegister), temp.gpr());
+            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), temp.gpr());
+            speculationCheck(BadType, valueSource, node, m_jit.branchTest64(MacroAssembler::NonZero, temp.gpr(), TrustedImm32(static_cast<int32_t>(~1))));
+            break;
+        }
+        case FlushedCell: {
+            speculationCheck(BadType, valueSource, node, m_jit.branchTest64(MacroAssembler::NonZero, JITCompiler::addressFor(virtualRegister), GPRInfo::tagMaskRegister));
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+#else
+        switch (format) {
+        case FlushedInt32: {
+            speculationCheck(BadType, valueSource, node, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag)));
+            break;
+        }
+        case FlushedBoolean: {
+            speculationCheck(BadType, valueSource, node, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::BooleanTag)));
+            break;
+        }
+        case FlushedCell: {
+            speculationCheck(BadType, valueSource, node, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::CellTag)));
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+#endif
+    }
+
+    m_origin = NodeOrigin();
+}
+
+bool SpeculativeJIT::compile()
+{
+    checkArgumentTypes();
+    
+    ASSERT(!m_currentNode);
+    for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().numBlocks(); ++blockIndex) {
+        m_jit.setForBlockIndex(blockIndex);
+        m_block = m_jit.graph().block(blockIndex);
+        compileCurrentBlock();
+    }
+    linkBranches();
+    return true;
+}
+
+void SpeculativeJIT::createOSREntries()
+{
+    for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().numBlocks(); ++blockIndex) {
+        BasicBlock* block = m_jit.graph().block(blockIndex);
+        if (!block)
+            continue;
+        if (!block->isOSRTarget)
+            continue;
+        
+        // Currently we don't have OSR entry trampolines. We could add them
+        // here if need be.
+        m_osrEntryHeads.append(m_jit.blockHeads()[blockIndex]);
+    }
+}
+
+void SpeculativeJIT::linkOSREntries(LinkBuffer& linkBuffer)
+{
+    unsigned osrEntryIndex = 0;
+    for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().numBlocks(); ++blockIndex) {
+        BasicBlock* block = m_jit.graph().block(blockIndex);
+        if (!block)
+            continue;
+        if (!block->isOSRTarget)
+            continue;
+        m_jit.noticeOSREntry(*block, m_osrEntryHeads[osrEntryIndex++], linkBuffer);
+    }
+    ASSERT(osrEntryIndex == m_osrEntryHeads.size());
+    
+    if (verboseCompilationEnabled()) {
+        DumpContext dumpContext;
+        dataLog("OSR Entries:\n");
+        for (OSREntryData& entryData : m_jit.jitCode()->osrEntry)
+            dataLog("    ", inContext(entryData, &dumpContext), "\n");
+        if (!dumpContext.isEmpty())
+            dumpContext.dump(WTF::dataFile());
+    }
+}
+
+void SpeculativeJIT::compileDoublePutByVal(Node* node, SpeculateCellOperand& base, SpeculateStrictInt32Operand& property)
+{
+    Edge child3 = m_jit.graph().varArgChild(node, 2);
+    Edge child4 = m_jit.graph().varArgChild(node, 3);
+
+    ArrayMode arrayMode = node->arrayMode();
+    
+    GPRReg baseReg = base.gpr();
+    GPRReg propertyReg = property.gpr();
+    
+    SpeculateDoubleOperand value(this, child3);
+
+    FPRReg valueReg = value.fpr();
+    
+    DFG_TYPE_CHECK(
+        JSValueRegs(), child3, SpecFullRealNumber,
+        m_jit.branchDouble(
+            MacroAssembler::DoubleNotEqualOrUnordered, valueReg, valueReg));
+    
+    if (!m_compileOkay)
+        return;
+    
+    StorageOperand storage(this, child4);
+    GPRReg storageReg = storage.gpr();
+
+    if (node->op() == PutByValAlias) {
+        // Store the value to the array.
+        GPRReg propertyReg = property.gpr();
+        FPRReg valueReg = value.fpr();
+        m_jit.storeDouble(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
+        
+        noResult(m_currentNode);
+        return;
+    }
+    
+    GPRTemporary temporary;
+    GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node);
+
+    MacroAssembler::Jump slowCase;
+    
+    if (arrayMode.isInBounds()) {
+        speculationCheck(
+            OutOfBounds, JSValueRegs(), 0,
+            m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+    } else {
+        MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+        
+        slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength()));
+        
+        if (!arrayMode.isOutOfBounds())
+            speculationCheck(OutOfBounds, JSValueRegs(), 0, slowCase);
+        
+        m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg);
+        m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+        
+        inBounds.link(&m_jit);
+    }
+    
+    m_jit.storeDouble(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
+
+    base.use();
+    property.use();
+    value.use();
+    storage.use();
+    
+    if (arrayMode.isOutOfBounds()) {
+        addSlowPathGenerator(
+            slowPathCall(
+                slowCase, this,
+                m_jit.codeBlock()->isStrictMode() ? operationPutDoubleByValBeyondArrayBoundsStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict,
+                NoResult, baseReg, propertyReg, valueReg));
+    }
+
+    noResult(m_currentNode, UseChildrenCalledExplicitly);
+}
+
+void SpeculativeJIT::compileGetCharCodeAt(Node* node)
+{
+    SpeculateCellOperand string(this, node->child1());
+    SpeculateStrictInt32Operand index(this, node->child2());
+    StorageOperand storage(this, node->child3());
+
+    GPRReg stringReg = string.gpr();
+    GPRReg indexReg = index.gpr();
+    GPRReg storageReg = storage.gpr();
+    
+    ASSERT(speculationChecked(m_state.forNode(node->child1()).m_type, SpecString));
+
+    // unsigned comparison so we can filter out negative indices and indices that are too large
+    speculationCheck(Uncountable, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, indexReg, MacroAssembler::Address(stringReg, JSString::offsetOfLength())));
+
+    GPRTemporary scratch(this);
+    GPRReg scratchReg = scratch.gpr();
+
+    m_jit.loadPtr(MacroAssembler::Address(stringReg, JSString::offsetOfValue()), scratchReg);
+
+    // Load the character into scratchReg
+    JITCompiler::Jump is16Bit = m_jit.branchTest32(MacroAssembler::Zero, MacroAssembler::Address(scratchReg, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIs8Bit()));
+
+    m_jit.load8(MacroAssembler::BaseIndex(storageReg, indexReg, MacroAssembler::TimesOne, 0), scratchReg);
+    JITCompiler::Jump cont8Bit = m_jit.jump();
+
+    is16Bit.link(&m_jit);
+
+    m_jit.load16(MacroAssembler::BaseIndex(storageReg, indexReg, MacroAssembler::TimesTwo, 0), scratchReg);
+
+    cont8Bit.link(&m_jit);
+
+    int32Result(scratchReg, m_currentNode);
+}
+
+void SpeculativeJIT::compileGetByValOnString(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    SpeculateStrictInt32Operand property(this, node->child2());
+    StorageOperand storage(this, node->child3());
+    GPRReg baseReg = base.gpr();
+    GPRReg propertyReg = property.gpr();
+    GPRReg storageReg = storage.gpr();
+
+    GPRTemporary scratch(this);
+    GPRReg scratchReg = scratch.gpr();
+#if USE(JSVALUE32_64)
+    GPRTemporary resultTag;
+    GPRReg resultTagReg = InvalidGPRReg;
+    if (node->arrayMode().isOutOfBounds()) {
+        GPRTemporary realResultTag(this);
+        resultTag.adopt(realResultTag);
+        resultTagReg = resultTag.gpr();
+    }
+#endif
+
+    ASSERT(ArrayMode(Array::String).alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1())));
+
+    // unsigned comparison so we can filter out negative indices and indices that are too large
+    JITCompiler::Jump outOfBounds = m_jit.branch32(
+        MacroAssembler::AboveOrEqual, propertyReg,
+        MacroAssembler::Address(baseReg, JSString::offsetOfLength()));
+    if (node->arrayMode().isInBounds())
+        speculationCheck(OutOfBounds, JSValueRegs(), 0, outOfBounds);
+
+    m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), scratchReg);
+
+    // Load the character into scratchReg
+    JITCompiler::Jump is16Bit = m_jit.branchTest32(MacroAssembler::Zero, MacroAssembler::Address(scratchReg, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIs8Bit()));
+
+    m_jit.load8(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesOne, 0), scratchReg);
+    JITCompiler::Jump cont8Bit = m_jit.jump();
+
+    is16Bit.link(&m_jit);
+
+    m_jit.load16(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesTwo, 0), scratchReg);
+
+    JITCompiler::Jump bigCharacter =
+        m_jit.branch32(MacroAssembler::AboveOrEqual, scratchReg, TrustedImm32(0x100));
+
+    // 8 bit string values don't need the isASCII check.
+    cont8Bit.link(&m_jit);
+
+    m_jit.lshift32(MacroAssembler::TrustedImm32(sizeof(void*) == 4 ? 2 : 3), scratchReg);
+    m_jit.addPtr(TrustedImmPtr(m_jit.vm()->smallStrings.singleCharacterStrings()), scratchReg);
+    m_jit.loadPtr(scratchReg, scratchReg);
+
+    addSlowPathGenerator(
+        slowPathCall(
+            bigCharacter, this, operationSingleCharacterString, scratchReg, scratchReg));
+
+    if (node->arrayMode().isOutOfBounds()) {
+#if USE(JSVALUE32_64)
+        m_jit.move(TrustedImm32(JSValue::CellTag), resultTagReg);
+#endif
+
+        JSGlobalObject* globalObject = m_jit.globalObjectFor(node->origin.semantic);
+        bool prototypeChainIsSane = false;
+        if (globalObject->stringPrototypeChainIsSane()) {
+            // FIXME: This could be captured using a Speculation mode that means "out-of-bounds
+            // loads return a trivial value". Something like SaneChainOutOfBounds. This should
+            // speculate that we don't take negative out-of-bounds, or better yet, it should rely
+            // on a stringPrototypeChainIsSane() guaranteeing that the prototypes have no negative
+            // indexed properties either.
+            // https://bugs.webkit.org/show_bug.cgi?id=144668
+            m_jit.graph().watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
+            m_jit.graph().watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
+            prototypeChainIsSane = globalObject->stringPrototypeChainIsSane();
+        }
+        if (prototypeChainIsSane) {
+            m_jit.graph().watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
+            m_jit.graph().watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
+            
+#if USE(JSVALUE64)
+            addSlowPathGenerator(std::make_unique<SaneStringGetByValSlowPathGenerator>(
+                outOfBounds, this, JSValueRegs(scratchReg), baseReg, propertyReg));
+#else
+            addSlowPathGenerator(std::make_unique<SaneStringGetByValSlowPathGenerator>(
+                outOfBounds, this, JSValueRegs(resultTagReg, scratchReg),
+                baseReg, propertyReg));
+#endif
+        } else {
+#if USE(JSVALUE64)
+            addSlowPathGenerator(
+                slowPathCall(
+                    outOfBounds, this, operationGetByValStringInt,
+                    scratchReg, baseReg, propertyReg));
+#else
+            addSlowPathGenerator(
+                slowPathCall(
+                    outOfBounds, this, operationGetByValStringInt,
+                    JSValueRegs(resultTagReg, scratchReg), baseReg, propertyReg));
+#endif
+        }
+        
+#if USE(JSVALUE64)
+        jsValueResult(scratchReg, m_currentNode);
+#else
+        jsValueResult(resultTagReg, scratchReg, m_currentNode);
+#endif
+    } else
+        cellResult(scratchReg, m_currentNode);
+}
+
+void SpeculativeJIT::compileFromCharCode(Node* node)
+{
+    Edge& child = node->child1();
+    if (child.useKind() == UntypedUse) {
+        JSValueOperand opr(this, child);
+        JSValueRegs oprRegs = opr.jsValueRegs();
+#if USE(JSVALUE64)
+        GPRTemporary result(this);
+        JSValueRegs resultRegs = JSValueRegs(result.gpr());
+#else
+        GPRTemporary resultTag(this);
+        GPRTemporary resultPayload(this);
+        JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+#endif
+        flushRegisters();
+        callOperation(operationStringFromCharCodeUntyped, resultRegs, oprRegs);
+        m_jit.exceptionCheck();
+        
+        jsValueResult(resultRegs, node);
+        return;
+    }
+
+    SpeculateStrictInt32Operand property(this, child);
+    GPRReg propertyReg = property.gpr();
+    GPRTemporary smallStrings(this);
+    GPRTemporary scratch(this);
+    GPRReg scratchReg = scratch.gpr();
+    GPRReg smallStringsReg = smallStrings.gpr();
+
+    JITCompiler::JumpList slowCases;
+    slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, TrustedImm32(0xff)));
+    m_jit.move(TrustedImmPtr(m_jit.vm()->smallStrings.singleCharacterStrings()), smallStringsReg);
+    m_jit.loadPtr(MacroAssembler::BaseIndex(smallStringsReg, propertyReg, MacroAssembler::ScalePtr, 0), scratchReg);
+
+    slowCases.append(m_jit.branchTest32(MacroAssembler::Zero, scratchReg));
+    addSlowPathGenerator(slowPathCall(slowCases, this, operationStringFromCharCode, scratchReg, propertyReg));
+    cellResult(scratchReg, m_currentNode);
+}
+
+GeneratedOperandType SpeculativeJIT::checkGeneratedTypeForToInt32(Node* node)
+{
+    VirtualRegister virtualRegister = node->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatStorage:
+        RELEASE_ASSERT_NOT_REACHED();
+
+    case DataFormatBoolean:
+    case DataFormatCell:
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        return GeneratedOperandTypeUnknown;
+
+    case DataFormatNone:
+    case DataFormatJSCell:
+    case DataFormatJS:
+    case DataFormatJSBoolean:
+    case DataFormatJSDouble:
+        return GeneratedOperandJSValue;
+
+    case DataFormatJSInt32:
+    case DataFormatInt32:
+        return GeneratedOperandInteger;
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return GeneratedOperandTypeUnknown;
+    }
+}
+
+void SpeculativeJIT::compileValueToInt32(Node* node)
+{
+    switch (node->child1().useKind()) {
+#if USE(JSVALUE64)
+    case Int52RepUse: {
+        SpeculateStrictInt52Operand op1(this, node->child1());
+        GPRTemporary result(this, Reuse, op1);
+        GPRReg op1GPR = op1.gpr();
+        GPRReg resultGPR = result.gpr();
+        m_jit.zeroExtend32ToPtr(op1GPR, resultGPR);
+        int32Result(resultGPR, node, DataFormatInt32);
+        return;
+    }
+#endif // USE(JSVALUE64)
+        
+    case DoubleRepUse: {
+        GPRTemporary result(this);
+        SpeculateDoubleOperand op1(this, node->child1());
+        FPRReg fpr = op1.fpr();
+        GPRReg gpr = result.gpr();
+        JITCompiler::Jump notTruncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpr, gpr, JITCompiler::BranchIfTruncateFailed);
+        
+        addSlowPathGenerator(slowPathCall(notTruncatedToInteger, this, operationToInt32, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, gpr, fpr));
+        
+        int32Result(gpr, node);
+        return;
+    }
+    
+    case NumberUse:
+    case NotCellUse: {
+        switch (checkGeneratedTypeForToInt32(node->child1().node())) {
+        case GeneratedOperandInteger: {
+            SpeculateInt32Operand op1(this, node->child1(), ManualOperandSpeculation);
+            GPRTemporary result(this, Reuse, op1);
+            m_jit.move(op1.gpr(), result.gpr());
+            int32Result(result.gpr(), node, op1.format());
+            return;
+        }
+        case GeneratedOperandJSValue: {
+            GPRTemporary result(this);
+#if USE(JSVALUE64)
+            JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+
+            GPRReg gpr = op1.gpr();
+            GPRReg resultGpr = result.gpr();
+            FPRTemporary tempFpr(this);
+            FPRReg fpr = tempFpr.fpr();
+
+            JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, gpr, GPRInfo::tagTypeNumberRegister);
+            JITCompiler::JumpList converted;
+
+            if (node->child1().useKind() == NumberUse) {
+                DFG_TYPE_CHECK(
+                    JSValueRegs(gpr), node->child1(), SpecBytecodeNumber,
+                    m_jit.branchTest64(
+                        MacroAssembler::Zero, gpr, GPRInfo::tagTypeNumberRegister));
+            } else {
+                JITCompiler::Jump isNumber = m_jit.branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagTypeNumberRegister);
+                
+                DFG_TYPE_CHECK(
+                    JSValueRegs(gpr), node->child1(), ~SpecCell, m_jit.branchIfCell(JSValueRegs(gpr)));
+                
+                // It's not a cell: so true turns into 1 and all else turns into 0.
+                m_jit.compare64(JITCompiler::Equal, gpr, TrustedImm32(ValueTrue), resultGpr);
+                converted.append(m_jit.jump());
+                
+                isNumber.link(&m_jit);
+            }
+
+            // First, if we get here we have a double encoded as a JSValue
+            unboxDouble(gpr, resultGpr, fpr);
+
+            silentSpillAllRegisters(resultGpr);
+            callOperation(operationToInt32, resultGpr, fpr);
+            silentFillAllRegisters(resultGpr);
+
+            converted.append(m_jit.jump());
+
+            isInteger.link(&m_jit);
+            m_jit.zeroExtend32ToPtr(gpr, resultGpr);
+
+            converted.link(&m_jit);
+#else
+            Node* childNode = node->child1().node();
+            VirtualRegister virtualRegister = childNode->virtualRegister();
+            GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+            JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+
+            GPRReg payloadGPR = op1.payloadGPR();
+            GPRReg resultGpr = result.gpr();
+        
+            JITCompiler::JumpList converted;
+
+            if (info.registerFormat() == DataFormatJSInt32)
+                m_jit.move(payloadGPR, resultGpr);
+            else {
+                GPRReg tagGPR = op1.tagGPR();
+                FPRTemporary tempFpr(this);
+                FPRReg fpr = tempFpr.fpr();
+                FPRTemporary scratch(this);
+
+                JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));
+
+                if (node->child1().useKind() == NumberUse) {
+                    DFG_TYPE_CHECK(
+                        op1.jsValueRegs(), node->child1(), SpecBytecodeNumber,
+                        m_jit.branch32(
+                            MacroAssembler::AboveOrEqual, tagGPR,
+                            TrustedImm32(JSValue::LowestTag)));
+                } else {
+                    JITCompiler::Jump isNumber = m_jit.branch32(MacroAssembler::Below, tagGPR, TrustedImm32(JSValue::LowestTag));
+                    
+                    DFG_TYPE_CHECK(
+                        op1.jsValueRegs(), node->child1(), ~SpecCell,
+                        m_jit.branchIfCell(op1.jsValueRegs()));
+                    
+                    // It's not a cell: so true turns into 1 and all else turns into 0.
+                    JITCompiler::Jump isBoolean = m_jit.branch32(JITCompiler::Equal, tagGPR, TrustedImm32(JSValue::BooleanTag));
+                    m_jit.move(TrustedImm32(0), resultGpr);
+                    converted.append(m_jit.jump());
+                    
+                    isBoolean.link(&m_jit);
+                    m_jit.move(payloadGPR, resultGpr);
+                    converted.append(m_jit.jump());
+                    
+                    isNumber.link(&m_jit);
+                }
+
+                unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());
+
+                silentSpillAllRegisters(resultGpr);
+                callOperation(operationToInt32, resultGpr, fpr);
+                silentFillAllRegisters(resultGpr);
+
+                converted.append(m_jit.jump());
+
+                isInteger.link(&m_jit);
+                m_jit.move(payloadGPR, resultGpr);
+
+                converted.link(&m_jit);
+            }
+#endif
+            int32Result(resultGpr, node);
+            return;
+        }
+        case GeneratedOperandTypeUnknown:
+            RELEASE_ASSERT(!m_compileOkay);
+            return;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+    
+    default:
+        ASSERT(!m_compileOkay);
+        return;
+    }
+}
+
+void SpeculativeJIT::compileUInt32ToNumber(Node* node)
+{
+    if (doesOverflow(node->arithMode())) {
+        if (enableInt52()) {
+            SpeculateInt32Operand op1(this, node->child1());
+            GPRTemporary result(this, Reuse, op1);
+            m_jit.zeroExtend32ToPtr(op1.gpr(), result.gpr());
+            strictInt52Result(result.gpr(), node);
+            return;
+        }
+        SpeculateInt32Operand op1(this, node->child1());
+        FPRTemporary result(this);
+            
+        GPRReg inputGPR = op1.gpr();
+        FPRReg outputFPR = result.fpr();
+            
+        m_jit.convertInt32ToDouble(inputGPR, outputFPR);
+            
+        JITCompiler::Jump positive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, inputGPR, TrustedImm32(0));
+        m_jit.addDouble(JITCompiler::AbsoluteAddress(&AssemblyHelpers::twoToThe32), outputFPR);
+        positive.link(&m_jit);
+            
+        doubleResult(outputFPR, node);
+        return;
+    }
+    
+    RELEASE_ASSERT(node->arithMode() == Arith::CheckOverflow);
+
+    SpeculateInt32Operand op1(this, node->child1());
+    GPRTemporary result(this);
+
+    m_jit.move(op1.gpr(), result.gpr());
+
+    speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::LessThan, result.gpr(), TrustedImm32(0)));
+
+    int32Result(result.gpr(), node, op1.format());
+}
+
+void SpeculativeJIT::compileDoubleAsInt32(Node* node)
+{
+    SpeculateDoubleOperand op1(this, node->child1());
+    FPRTemporary scratch(this);
+    GPRTemporary result(this);
+    
+    FPRReg valueFPR = op1.fpr();
+    FPRReg scratchFPR = scratch.fpr();
+    GPRReg resultGPR = result.gpr();
+
+    JITCompiler::JumpList failureCases;
+    RELEASE_ASSERT(shouldCheckOverflow(node->arithMode()));
+    m_jit.branchConvertDoubleToInt32(
+        valueFPR, resultGPR, failureCases, scratchFPR,
+        shouldCheckNegativeZero(node->arithMode()));
+    speculationCheck(Overflow, JSValueRegs(), 0, failureCases);
+
+    int32Result(resultGPR, node);
+}
+
+void SpeculativeJIT::compileDoubleRep(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case RealNumberUse: {
+        JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+        FPRTemporary result(this);
+        
+        JSValueRegs op1Regs = op1.jsValueRegs();
+        FPRReg resultFPR = result.fpr();
+        
+#if USE(JSVALUE64)
+        GPRTemporary temp(this);
+        GPRReg tempGPR = temp.gpr();
+        m_jit.unboxDoubleWithoutAssertions(op1Regs.gpr(), tempGPR, resultFPR);
+#else
+        FPRTemporary temp(this);
+        FPRReg tempFPR = temp.fpr();
+        unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR, tempFPR);
+#endif
+        
+        JITCompiler::Jump done = m_jit.branchDouble(
+            JITCompiler::DoubleEqual, resultFPR, resultFPR);
+        
+        DFG_TYPE_CHECK(
+            op1Regs, node->child1(), SpecBytecodeRealNumber, m_jit.branchIfNotInt32(op1Regs));
+        m_jit.convertInt32ToDouble(op1Regs.payloadGPR(), resultFPR);
+        
+        done.link(&m_jit);
+        
+        doubleResult(resultFPR, node);
+        return;
+    }
+    
+    case NotCellUse:
+    case NumberUse: {
+        ASSERT(!node->child1()->isNumberConstant()); // This should have been constant folded.
+
+        SpeculatedType possibleTypes = m_state.forNode(node->child1()).m_type;
+        if (isInt32Speculation(possibleTypes)) {
+            SpeculateInt32Operand op1(this, node->child1(), ManualOperandSpeculation);
+            FPRTemporary result(this);
+            m_jit.convertInt32ToDouble(op1.gpr(), result.fpr());
+            doubleResult(result.fpr(), node);
+            return;
+        }
+
+        JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+        FPRTemporary result(this);
+
+#if USE(JSVALUE64)
+        GPRTemporary temp(this);
+
+        GPRReg op1GPR = op1.gpr();
+        GPRReg tempGPR = temp.gpr();
+        FPRReg resultFPR = result.fpr();
+        JITCompiler::JumpList done;
+
+        JITCompiler::Jump isInteger = m_jit.branch64(
+            MacroAssembler::AboveOrEqual, op1GPR, GPRInfo::tagTypeNumberRegister);
+
+        if (node->child1().useKind() == NotCellUse) {
+            JITCompiler::Jump isNumber = m_jit.branchTest64(MacroAssembler::NonZero, op1GPR, GPRInfo::tagTypeNumberRegister);
+            JITCompiler::Jump isUndefined = m_jit.branch64(JITCompiler::Equal, op1GPR, TrustedImm64(ValueUndefined));
+
+            static const double zero = 0;
+            m_jit.loadDouble(TrustedImmPtr(&zero), resultFPR);
+
+            JITCompiler::Jump isNull = m_jit.branch64(JITCompiler::Equal, op1GPR, TrustedImm64(ValueNull));
+            done.append(isNull);
+
+            DFG_TYPE_CHECK(JSValueRegs(op1GPR), node->child1(), ~SpecCell,
+                m_jit.branchTest64(JITCompiler::Zero, op1GPR, TrustedImm32(static_cast<int32_t>(TagBitBool))));
+
+            JITCompiler::Jump isFalse = m_jit.branch64(JITCompiler::Equal, op1GPR, TrustedImm64(ValueFalse));
+            static const double one = 1;
+            m_jit.loadDouble(TrustedImmPtr(&one), resultFPR);
+            done.append(m_jit.jump());
+            done.append(isFalse);
+
+            isUndefined.link(&m_jit);
+            static const double NaN = PNaN;
+            m_jit.loadDouble(TrustedImmPtr(&NaN), resultFPR);
+            done.append(m_jit.jump());
+
+            isNumber.link(&m_jit);
+        } else if (needsTypeCheck(node->child1(), SpecBytecodeNumber)) {
+            typeCheck(
+                JSValueRegs(op1GPR), node->child1(), SpecBytecodeNumber,
+                m_jit.branchTest64(MacroAssembler::Zero, op1GPR, GPRInfo::tagTypeNumberRegister));
+        }
+
+        unboxDouble(op1GPR, tempGPR, resultFPR);
+        done.append(m_jit.jump());
+    
+        isInteger.link(&m_jit);
+        m_jit.convertInt32ToDouble(op1GPR, resultFPR);
+        done.link(&m_jit);
+#else // USE(JSVALUE64) -> this is the 32_64 case
+        FPRTemporary temp(this);
+    
+        GPRReg op1TagGPR = op1.tagGPR();
+        GPRReg op1PayloadGPR = op1.payloadGPR();
+        FPRReg tempFPR = temp.fpr();
+        FPRReg resultFPR = result.fpr();
+        JITCompiler::JumpList done;
+    
+        JITCompiler::Jump isInteger = m_jit.branch32(
+            MacroAssembler::Equal, op1TagGPR, TrustedImm32(JSValue::Int32Tag));
+
+        if (node->child1().useKind() == NotCellUse) {
+            JITCompiler::Jump isNumber = m_jit.branch32(JITCompiler::Below, op1TagGPR, JITCompiler::TrustedImm32(JSValue::LowestTag + 1));
+            JITCompiler::Jump isUndefined = m_jit.branch32(JITCompiler::Equal, op1TagGPR, TrustedImm32(JSValue::UndefinedTag));
+
+            static const double zero = 0;
+            m_jit.loadDouble(TrustedImmPtr(&zero), resultFPR);
+
+            JITCompiler::Jump isNull = m_jit.branch32(JITCompiler::Equal, op1TagGPR, TrustedImm32(JSValue::NullTag));
+            done.append(isNull);
+
+            DFG_TYPE_CHECK(JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), ~SpecCell, m_jit.branch32(JITCompiler::NotEqual, op1TagGPR, TrustedImm32(JSValue::BooleanTag)));
+
+            JITCompiler::Jump isFalse = m_jit.branchTest32(JITCompiler::Zero, op1PayloadGPR, TrustedImm32(1));
+            static const double one = 1;
+            m_jit.loadDouble(TrustedImmPtr(&one), resultFPR);
+            done.append(m_jit.jump());
+            done.append(isFalse);
+
+            isUndefined.link(&m_jit);
+            static const double NaN = PNaN;
+            m_jit.loadDouble(TrustedImmPtr(&NaN), resultFPR);
+            done.append(m_jit.jump());
+
+            isNumber.link(&m_jit);
+        } else if (needsTypeCheck(node->child1(), SpecBytecodeNumber)) {
+            typeCheck(
+                JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecBytecodeNumber,
+                m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)));
+        }
+
+        unboxDouble(op1TagGPR, op1PayloadGPR, resultFPR, tempFPR);
+        done.append(m_jit.jump());
+    
+        isInteger.link(&m_jit);
+        m_jit.convertInt32ToDouble(op1PayloadGPR, resultFPR);
+        done.link(&m_jit);
+#endif // USE(JSVALUE64)
+    
+        doubleResult(resultFPR, node);
+        return;
+    }
+        
+#if USE(JSVALUE64)
+    case Int52RepUse: {
+        SpeculateStrictInt52Operand value(this, node->child1());
+        FPRTemporary result(this);
+        
+        GPRReg valueGPR = value.gpr();
+        FPRReg resultFPR = result.fpr();
+
+        m_jit.convertInt64ToDouble(valueGPR, resultFPR);
+        
+        doubleResult(resultFPR, node);
+        return;
+    }
+#endif // USE(JSVALUE64)
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+}
+
+void SpeculativeJIT::compileValueRep(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case DoubleRepUse: {
+        SpeculateDoubleOperand value(this, node->child1());
+        JSValueRegsTemporary result(this);
+        
+        FPRReg valueFPR = value.fpr();
+        JSValueRegs resultRegs = result.regs();
+        
+        // It's very tempting to in-place filter the value to indicate that it's not impure NaN
+        // anymore. Unfortunately, this would be unsound. If it's a GetLocal or if the value was
+        // subject to a prior SetLocal, filtering the value would imply that the corresponding
+        // local was purified.
+        if (needsTypeCheck(node->child1(), ~SpecDoubleImpureNaN))
+            m_jit.purifyNaN(valueFPR);
+
+        boxDouble(valueFPR, resultRegs);
+        
+        jsValueResult(resultRegs, node);
+        return;
+    }
+        
+#if USE(JSVALUE64)
+    case Int52RepUse: {
+        SpeculateStrictInt52Operand value(this, node->child1());
+        GPRTemporary result(this);
+        
+        GPRReg valueGPR = value.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        boxInt52(valueGPR, resultGPR, DataFormatStrictInt52);
+        
+        jsValueResult(resultGPR, node);
+        return;
+    }
+#endif // USE(JSVALUE64)
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+}
+
+static double clampDoubleToByte(double d)
+{
+    d += 0.5;
+    if (!(d > 0))
+        d = 0;
+    else if (d > 255)
+        d = 255;
+    return d;
+}
+
+static void compileClampIntegerToByte(JITCompiler& jit, GPRReg result)
+{
+    MacroAssembler::Jump inBounds = jit.branch32(MacroAssembler::BelowOrEqual, result, JITCompiler::TrustedImm32(0xff));
+    MacroAssembler::Jump tooBig = jit.branch32(MacroAssembler::GreaterThan, result, JITCompiler::TrustedImm32(0xff));
+    jit.xorPtr(result, result);
+    MacroAssembler::Jump clamped = jit.jump();
+    tooBig.link(&jit);
+    jit.move(JITCompiler::TrustedImm32(255), result);
+    clamped.link(&jit);
+    inBounds.link(&jit);
+}
+
+static void compileClampDoubleToByte(JITCompiler& jit, GPRReg result, FPRReg source, FPRReg scratch)
+{
+    // Unordered compare so we pick up NaN
+    static const double zero = 0;
+    static const double byteMax = 255;
+    static const double half = 0.5;
+    jit.loadDouble(JITCompiler::TrustedImmPtr(&zero), scratch);
+    MacroAssembler::Jump tooSmall = jit.branchDouble(MacroAssembler::DoubleLessThanOrEqualOrUnordered, source, scratch);
+    jit.loadDouble(JITCompiler::TrustedImmPtr(&byteMax), scratch);
+    MacroAssembler::Jump tooBig = jit.branchDouble(MacroAssembler::DoubleGreaterThan, source, scratch);
+    
+    jit.loadDouble(JITCompiler::TrustedImmPtr(&half), scratch);
+    // FIXME: This should probably just use a floating point round!
+    // https://bugs.webkit.org/show_bug.cgi?id=72054
+    jit.addDouble(source, scratch);
+    jit.truncateDoubleToInt32(scratch, result);   
+    MacroAssembler::Jump truncatedInt = jit.jump();
+    
+    tooSmall.link(&jit);
+    jit.xorPtr(result, result);
+    MacroAssembler::Jump zeroed = jit.jump();
+    
+    tooBig.link(&jit);
+    jit.move(JITCompiler::TrustedImm32(255), result);
+    
+    truncatedInt.link(&jit);
+    zeroed.link(&jit);
+
+}
+
+JITCompiler::Jump SpeculativeJIT::jumpForTypedArrayOutOfBounds(Node* node, GPRReg baseGPR, GPRReg indexGPR)
+{
+    if (node->op() == PutByValAlias)
+        return JITCompiler::Jump();
+    JSArrayBufferView* view = m_jit.graph().tryGetFoldableView(
+        m_state.forNode(m_jit.graph().child(node, 0)).m_value, node->arrayMode());
+    if (view) {
+        uint32_t length = view->length();
+        Node* indexNode = m_jit.graph().child(node, 1).node();
+        if (indexNode->isInt32Constant() && indexNode->asUInt32() < length)
+            return JITCompiler::Jump();
+        return m_jit.branch32(
+            MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Imm32(length));
+    }
+    return m_jit.branch32(
+        MacroAssembler::AboveOrEqual, indexGPR,
+        MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfLength()));
+}
+
+void SpeculativeJIT::emitTypedArrayBoundsCheck(Node* node, GPRReg baseGPR, GPRReg indexGPR)
+{
+    JITCompiler::Jump jump = jumpForTypedArrayOutOfBounds(node, baseGPR, indexGPR);
+    if (!jump.isSet())
+        return;
+    speculationCheck(OutOfBounds, JSValueRegs(), 0, jump);
+}
+
+JITCompiler::Jump SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds(Node* node, GPRReg base, JITCompiler::Jump outOfBounds)
+{
+    JITCompiler::Jump done;
+    if (outOfBounds.isSet()) {
+        done = m_jit.jump();
+        if (node->arrayMode().isInBounds())
+            speculationCheck(OutOfBounds, JSValueSource(), 0, outOfBounds);
+        else {
+            outOfBounds.link(&m_jit);
+
+            JITCompiler::Jump notWasteful = m_jit.branch32(
+                MacroAssembler::NotEqual,
+                MacroAssembler::Address(base, JSArrayBufferView::offsetOfMode()),
+                TrustedImm32(WastefulTypedArray));
+
+            JITCompiler::Jump hasNullVector = m_jit.branchTestPtr(
+                MacroAssembler::Zero,
+                MacroAssembler::Address(base, JSArrayBufferView::offsetOfVector()));
+            speculationCheck(Uncountable, JSValueSource(), node, hasNullVector);
+            notWasteful.link(&m_jit);
+        }
+    }
+    return done;
+}
+
+void SpeculativeJIT::compileGetByValOnIntTypedArray(Node* node, TypedArrayType type)
+{
+    ASSERT(isInt(type));
+    
+    SpeculateCellOperand base(this, node->child1());
+    SpeculateStrictInt32Operand property(this, node->child2());
+    StorageOperand storage(this, node->child3());
+
+    GPRReg baseReg = base.gpr();
+    GPRReg propertyReg = property.gpr();
+    GPRReg storageReg = storage.gpr();
+
+    GPRTemporary result(this);
+    GPRReg resultReg = result.gpr();
+
+    ASSERT(node->arrayMode().alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1())));
+
+    emitTypedArrayBoundsCheck(node, baseReg, propertyReg);
+    switch (elementSize(type)) {
+    case 1:
+        if (isSigned(type))
+            m_jit.load8SignedExtendTo32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesOne), resultReg);
+        else
+            m_jit.load8(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesOne), resultReg);
+        break;
+    case 2:
+        if (isSigned(type))
+            m_jit.load16SignedExtendTo32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesTwo), resultReg);
+        else
+            m_jit.load16(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesTwo), resultReg);
+        break;
+    case 4:
+        m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour), resultReg);
+        break;
+    default:
+        CRASH();
+    }
+    if (elementSize(type) < 4 || isSigned(type)) {
+        int32Result(resultReg, node);
+        return;
+    }
+    
+    ASSERT(elementSize(type) == 4 && !isSigned(type));
+    if (node->shouldSpeculateInt32()) {
+        speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::LessThan, resultReg, TrustedImm32(0)));
+        int32Result(resultReg, node);
+        return;
+    }
+    
+#if USE(JSVALUE64)
+    if (node->shouldSpeculateAnyInt()) {
+        m_jit.zeroExtend32ToPtr(resultReg, resultReg);
+        strictInt52Result(resultReg, node);
+        return;
+    }
+#endif
+    
+    FPRTemporary fresult(this);
+    m_jit.convertInt32ToDouble(resultReg, fresult.fpr());
+    JITCompiler::Jump positive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, resultReg, TrustedImm32(0));
+    m_jit.addDouble(JITCompiler::AbsoluteAddress(&AssemblyHelpers::twoToThe32), fresult.fpr());
+    positive.link(&m_jit);
+    doubleResult(fresult.fpr(), node);
+}
+
+void SpeculativeJIT::compilePutByValForIntTypedArray(GPRReg base, GPRReg property, Node* node, TypedArrayType type)
+{
+    ASSERT(isInt(type));
+    
+    StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
+    GPRReg storageReg = storage.gpr();
+    
+    Edge valueUse = m_jit.graph().varArgChild(node, 2);
+    
+    GPRTemporary value;
+#if USE(JSVALUE32_64)
+    GPRTemporary propertyTag;
+    GPRTemporary valueTag;
+#endif
+
+    GPRReg valueGPR = InvalidGPRReg;
+#if USE(JSVALUE32_64)
+    GPRReg propertyTagGPR = InvalidGPRReg;
+    GPRReg valueTagGPR = InvalidGPRReg;
+#endif
+
+    JITCompiler::JumpList slowPathCases;
+
+    if (valueUse->isConstant()) {
+        JSValue jsValue = valueUse->asJSValue();
+        if (!jsValue.isNumber()) {
+            terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+            noResult(node);
+            return;
+        }
+        double d = jsValue.asNumber();
+        if (isClamped(type)) {
+            ASSERT(elementSize(type) == 1);
+            d = clampDoubleToByte(d);
+        }
+        GPRTemporary scratch(this);
+        GPRReg scratchReg = scratch.gpr();
+        m_jit.move(Imm32(toInt32(d)), scratchReg);
+        value.adopt(scratch);
+        valueGPR = scratchReg;
+    } else {
+        switch (valueUse.useKind()) {
+        case Int32Use: {
+            SpeculateInt32Operand valueOp(this, valueUse);
+            GPRTemporary scratch(this);
+            GPRReg scratchReg = scratch.gpr();
+            m_jit.move(valueOp.gpr(), scratchReg);
+            if (isClamped(type)) {
+                ASSERT(elementSize(type) == 1);
+                compileClampIntegerToByte(m_jit, scratchReg);
+            }
+            value.adopt(scratch);
+            valueGPR = scratchReg;
+            break;
+        }
+            
+#if USE(JSVALUE64)
+        case Int52RepUse: {
+            SpeculateStrictInt52Operand valueOp(this, valueUse);
+            GPRTemporary scratch(this);
+            GPRReg scratchReg = scratch.gpr();
+            m_jit.move(valueOp.gpr(), scratchReg);
+            if (isClamped(type)) {
+                ASSERT(elementSize(type) == 1);
+                MacroAssembler::Jump inBounds = m_jit.branch64(
+                    MacroAssembler::BelowOrEqual, scratchReg, JITCompiler::TrustedImm64(0xff));
+                MacroAssembler::Jump tooBig = m_jit.branch64(
+                    MacroAssembler::GreaterThan, scratchReg, JITCompiler::TrustedImm64(0xff));
+                m_jit.move(TrustedImm32(0), scratchReg);
+                MacroAssembler::Jump clamped = m_jit.jump();
+                tooBig.link(&m_jit);
+                m_jit.move(JITCompiler::TrustedImm32(255), scratchReg);
+                clamped.link(&m_jit);
+                inBounds.link(&m_jit);
+            }
+            value.adopt(scratch);
+            valueGPR = scratchReg;
+            break;
+        }
+#endif // USE(JSVALUE64)
+            
+        case DoubleRepUse: {
+            if (isClamped(type)) {
+                ASSERT(elementSize(type) == 1);
+                SpeculateDoubleOperand valueOp(this, valueUse);
+                GPRTemporary result(this);
+                FPRTemporary floatScratch(this);
+                FPRReg fpr = valueOp.fpr();
+                GPRReg gpr = result.gpr();
+                compileClampDoubleToByte(m_jit, gpr, fpr, floatScratch.fpr());
+                value.adopt(result);
+                valueGPR = gpr;
+            } else {
+#if USE(JSVALUE32_64)
+                GPRTemporary realPropertyTag(this);
+                propertyTag.adopt(realPropertyTag);
+                propertyTagGPR = propertyTag.gpr();
+
+                GPRTemporary realValueTag(this);
+                valueTag.adopt(realValueTag);
+                valueTagGPR = valueTag.gpr();
+#endif
+                SpeculateDoubleOperand valueOp(this, valueUse);
+                GPRTemporary result(this);
+                FPRReg fpr = valueOp.fpr();
+                GPRReg gpr = result.gpr();
+                MacroAssembler::Jump notNaN = m_jit.branchDouble(MacroAssembler::DoubleEqual, fpr, fpr);
+                m_jit.xorPtr(gpr, gpr);
+                MacroAssembler::JumpList fixed(m_jit.jump());
+                notNaN.link(&m_jit);
+
+                fixed.append(m_jit.branchTruncateDoubleToInt32(
+                    fpr, gpr, MacroAssembler::BranchIfTruncateSuccessful));
+
+#if USE(JSVALUE64)
+                m_jit.or64(GPRInfo::tagTypeNumberRegister, property);
+                boxDouble(fpr, gpr);
+#else
+                m_jit.move(TrustedImm32(JSValue::Int32Tag), propertyTagGPR);
+                boxDouble(fpr, valueTagGPR, gpr);
+#endif
+                slowPathCases.append(m_jit.jump());
+
+                fixed.link(&m_jit);
+                value.adopt(result);
+                valueGPR = gpr;
+            }
+            break;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+    
+    ASSERT_UNUSED(valueGPR, valueGPR != property);
+    ASSERT(valueGPR != base);
+    ASSERT(valueGPR != storageReg);
+    JITCompiler::Jump outOfBounds = jumpForTypedArrayOutOfBounds(node, base, property);
+
+    switch (elementSize(type)) {
+    case 1:
+        m_jit.store8(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesOne));
+        break;
+    case 2:
+        m_jit.store16(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesTwo));
+        break;
+    case 4:
+        m_jit.store32(value.gpr(), MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesFour));
+        break;
+    default:
+        CRASH();
+    }
+
+    JITCompiler::Jump done = jumpForTypedArrayIsNeuteredIfOutOfBounds(node, base, outOfBounds);
+    if (done.isSet())
+        done.link(&m_jit);
+
+    if (!slowPathCases.empty()) {
+#if USE(JSVALUE64)
+        if (node->op() == PutByValDirect) {
+            addSlowPathGenerator(slowPathCall(
+                slowPathCases, this,
+                m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByValDirectStrict : operationPutByValDirectNonStrict,
+                NoResult, base, property, valueGPR));
+        } else {
+            addSlowPathGenerator(slowPathCall(
+                slowPathCases, this,
+                m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByValStrict : operationPutByValNonStrict,
+                NoResult, base, property, valueGPR));
+        }
+#else // not USE(JSVALUE64)
+        if (node->op() == PutByValDirect) {
+            addSlowPathGenerator(slowPathCall(
+                slowPathCases, this,
+                m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectCellStrict : operationPutByValDirectCellNonStrict,
+                NoResult, base, JSValueRegs(propertyTagGPR, property), JSValueRegs(valueTagGPR, valueGPR)));
+        } else {
+            addSlowPathGenerator(slowPathCall(
+                slowPathCases, this,
+                m_jit.codeBlock()->isStrictMode() ? operationPutByValCellStrict : operationPutByValCellNonStrict,
+                NoResult, base, JSValueRegs(propertyTagGPR, property), JSValueRegs(valueTagGPR, valueGPR)));
+        }
+#endif
+    }
+    noResult(node);
+}
+
+void SpeculativeJIT::compileGetByValOnFloatTypedArray(Node* node, TypedArrayType type)
+{
+    ASSERT(isFloat(type));
+    
+    SpeculateCellOperand base(this, node->child1());
+    SpeculateStrictInt32Operand property(this, node->child2());
+    StorageOperand storage(this, node->child3());
+
+    GPRReg baseReg = base.gpr();
+    GPRReg propertyReg = property.gpr();
+    GPRReg storageReg = storage.gpr();
+
+    ASSERT(node->arrayMode().alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1())));
+
+    FPRTemporary result(this);
+    FPRReg resultReg = result.fpr();
+    emitTypedArrayBoundsCheck(node, baseReg, propertyReg);
+    switch (elementSize(type)) {
+    case 4:
+        m_jit.loadFloat(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesFour), resultReg);
+        m_jit.convertFloatToDouble(resultReg, resultReg);
+        break;
+    case 8: {
+        m_jit.loadDouble(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), resultReg);
+        break;
+    }
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    doubleResult(resultReg, node);
+}
+
+void SpeculativeJIT::compilePutByValForFloatTypedArray(GPRReg base, GPRReg property, Node* node, TypedArrayType type)
+{
+    ASSERT(isFloat(type));
+    
+    StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
+    GPRReg storageReg = storage.gpr();
+    
+    Edge baseUse = m_jit.graph().varArgChild(node, 0);
+    Edge valueUse = m_jit.graph().varArgChild(node, 2);
+
+    SpeculateDoubleOperand valueOp(this, valueUse);
+    FPRTemporary scratch(this);
+    FPRReg valueFPR = valueOp.fpr();
+    FPRReg scratchFPR = scratch.fpr();
+
+    ASSERT_UNUSED(baseUse, node->arrayMode().alreadyChecked(m_jit.graph(), node, m_state.forNode(baseUse)));
+    
+    MacroAssembler::Jump outOfBounds = jumpForTypedArrayOutOfBounds(node, base, property);
+    
+    switch (elementSize(type)) {
+    case 4: {
+        m_jit.moveDouble(valueFPR, scratchFPR);
+        m_jit.convertDoubleToFloat(valueFPR, scratchFPR);
+        m_jit.storeFloat(scratchFPR, MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesFour));
+        break;
+    }
+    case 8:
+        m_jit.storeDouble(valueFPR, MacroAssembler::BaseIndex(storageReg, property, MacroAssembler::TimesEight));
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    JITCompiler::Jump done = jumpForTypedArrayIsNeuteredIfOutOfBounds(node, base, outOfBounds);
+    if (done.isSet())
+        done.link(&m_jit);
+    noResult(node);
+}
+
+void SpeculativeJIT::compileInstanceOfForObject(Node*, GPRReg valueReg, GPRReg prototypeReg, GPRReg scratchReg, GPRReg scratch2Reg)
+{
+    // Check that prototype is an object.
+    speculationCheck(BadType, JSValueRegs(), 0, m_jit.branchIfNotObject(prototypeReg));
+    
+    // Initialize scratchReg with the value being checked.
+    m_jit.move(valueReg, scratchReg);
+    
+    // Walk up the prototype chain of the value (in scratchReg), comparing to prototypeReg.
+    MacroAssembler::Label loop(&m_jit);
+    MacroAssembler::Jump performDefaultHasInstance = m_jit.branch8(MacroAssembler::Equal,
+        MacroAssembler::Address(scratchReg, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType));
+    m_jit.emitLoadStructure(scratchReg, scratchReg, scratch2Reg);
+    m_jit.loadPtr(MacroAssembler::Address(scratchReg, Structure::prototypeOffset() + CellPayloadOffset), scratchReg);
+    MacroAssembler::Jump isInstance = m_jit.branchPtr(MacroAssembler::Equal, scratchReg, prototypeReg);
+#if USE(JSVALUE64)
+    m_jit.branchIfCell(JSValueRegs(scratchReg)).linkTo(loop, &m_jit);
+#else
+    m_jit.branchTestPtr(MacroAssembler::NonZero, scratchReg).linkTo(loop, &m_jit);
+#endif
+    
+    // No match - result is false.
+#if USE(JSVALUE64)
+    m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(false))), scratchReg);
+#else
+    m_jit.move(MacroAssembler::TrustedImm32(0), scratchReg);
+#endif
+    MacroAssembler::JumpList doneJumps; 
+    doneJumps.append(m_jit.jump());
+
+    performDefaultHasInstance.link(&m_jit);
+    silentSpillAllRegisters(scratchReg);
+    callOperation(operationDefaultHasInstance, scratchReg, valueReg, prototypeReg); 
+    silentFillAllRegisters(scratchReg);
+    m_jit.exceptionCheck();
+#if USE(JSVALUE64)
+    m_jit.or32(TrustedImm32(ValueFalse), scratchReg);
+#endif
+    doneJumps.append(m_jit.jump());
+    
+    isInstance.link(&m_jit);
+#if USE(JSVALUE64)
+    m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(true))), scratchReg);
+#else
+    m_jit.move(MacroAssembler::TrustedImm32(1), scratchReg);
+#endif
+    
+    doneJumps.link(&m_jit);
+}
+
+void SpeculativeJIT::compileCheckTypeInfoFlags(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+
+    GPRReg baseGPR = base.gpr();
+
+    speculationCheck(BadTypeInfoFlags, JSValueRegs(), 0, m_jit.branchTest8(MacroAssembler::Zero, MacroAssembler::Address(baseGPR, JSCell::typeInfoFlagsOffset()), MacroAssembler::TrustedImm32(node->typeInfoOperand())));
+
+    noResult(node);
+}
+
+void SpeculativeJIT::compileInstanceOf(Node* node)
+{
+    if (node->child1().useKind() == UntypedUse) {
+        // It might not be a cell. Speculate less aggressively.
+        // Or: it might only be used once (i.e. by us), so we get zero benefit
+        // from speculating any more aggressively than we absolutely need to.
+        
+        JSValueOperand value(this, node->child1());
+        SpeculateCellOperand prototype(this, node->child2());
+        GPRTemporary scratch(this);
+        GPRTemporary scratch2(this);
+        
+        GPRReg prototypeReg = prototype.gpr();
+        GPRReg scratchReg = scratch.gpr();
+        GPRReg scratch2Reg = scratch2.gpr();
+        
+        MacroAssembler::Jump isCell = m_jit.branchIfCell(value.jsValueRegs());
+        GPRReg valueReg = value.jsValueRegs().payloadGPR();
+        moveFalseTo(scratchReg);
+
+        MacroAssembler::Jump done = m_jit.jump();
+        
+        isCell.link(&m_jit);
+        
+        compileInstanceOfForObject(node, valueReg, prototypeReg, scratchReg, scratch2Reg);
+        
+        done.link(&m_jit);
+
+        blessedBooleanResult(scratchReg, node);
+        return;
+    }
+    
+    SpeculateCellOperand value(this, node->child1());
+    SpeculateCellOperand prototype(this, node->child2());
+    
+    GPRTemporary scratch(this);
+    GPRTemporary scratch2(this);
+    
+    GPRReg valueReg = value.gpr();
+    GPRReg prototypeReg = prototype.gpr();
+    GPRReg scratchReg = scratch.gpr();
+    GPRReg scratch2Reg = scratch2.gpr();
+    
+    compileInstanceOfForObject(node, valueReg, prototypeReg, scratchReg, scratch2Reg);
+
+    blessedBooleanResult(scratchReg, node);
+}
+
+template<typename SnippetGenerator, J_JITOperation_EJJ snippetSlowPathFunction>
+void SpeculativeJIT::emitUntypedBitOp(Node* node)
+{
+    Edge& leftChild = node->child1();
+    Edge& rightChild = node->child2();
+
+    if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
+        JSValueOperand left(this, leftChild);
+        JSValueOperand right(this, rightChild);
+        JSValueRegs leftRegs = left.jsValueRegs();
+        JSValueRegs rightRegs = right.jsValueRegs();
+#if USE(JSVALUE64)
+        GPRTemporary result(this);
+        JSValueRegs resultRegs = JSValueRegs(result.gpr());
+#else
+        GPRTemporary resultTag(this);
+        GPRTemporary resultPayload(this);
+        JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+#endif
+        flushRegisters();
+        callOperation(snippetSlowPathFunction, resultRegs, leftRegs, rightRegs);
+        m_jit.exceptionCheck();
+
+        jsValueResult(resultRegs, node);
+        return;
+    }
+
+    std::optional<JSValueOperand> left;
+    std::optional<JSValueOperand> right;
+
+    JSValueRegs leftRegs;
+    JSValueRegs rightRegs;
+
+#if USE(JSVALUE64)
+    GPRTemporary result(this);
+    JSValueRegs resultRegs = JSValueRegs(result.gpr());
+    GPRTemporary scratch(this);
+    GPRReg scratchGPR = scratch.gpr();
+#else
+    GPRTemporary resultTag(this);
+    GPRTemporary resultPayload(this);
+    JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+    GPRReg scratchGPR = resultTag.gpr();
+#endif
+
+    SnippetOperand leftOperand;
+    SnippetOperand rightOperand;
+
+    // The snippet generator does not support both operands being constant. If the left
+    // operand is already const, we'll ignore the right operand's constness.
+    if (leftChild->isInt32Constant())
+        leftOperand.setConstInt32(leftChild->asInt32());
+    else if (rightChild->isInt32Constant())
+        rightOperand.setConstInt32(rightChild->asInt32());
+
+    RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
+
+    if (!leftOperand.isConst()) {
+        left.emplace(this, leftChild);
+        leftRegs = left->jsValueRegs();
+    }
+    if (!rightOperand.isConst()) {
+        right.emplace(this, rightChild);
+        rightRegs = right->jsValueRegs();
+    }
+
+    SnippetGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, scratchGPR);
+    gen.generateFastPath(m_jit);
+
+    ASSERT(gen.didEmitFastPath());
+    gen.endJumpList().append(m_jit.jump());
+
+    gen.slowPathJumpList().link(&m_jit);
+    silentSpillAllRegisters(resultRegs);
+
+    if (leftOperand.isConst()) {
+        leftRegs = resultRegs;
+        m_jit.moveValue(leftChild->asJSValue(), leftRegs);
+    } else if (rightOperand.isConst()) {
+        rightRegs = resultRegs;
+        m_jit.moveValue(rightChild->asJSValue(), rightRegs);
+    }
+
+    callOperation(snippetSlowPathFunction, resultRegs, leftRegs, rightRegs);
+
+    silentFillAllRegisters(resultRegs);
+    m_jit.exceptionCheck();
+
+    gen.endJumpList().link(&m_jit);
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compileBitwiseOp(Node* node)
+{
+    NodeType op = node->op();
+    Edge& leftChild = node->child1();
+    Edge& rightChild = node->child2();
+
+    if (leftChild.useKind() == UntypedUse || rightChild.useKind() == UntypedUse) {
+        switch (op) {
+        case BitAnd:
+            emitUntypedBitOp<JITBitAndGenerator, operationValueBitAnd>(node);
+            return;
+        case BitOr:
+            emitUntypedBitOp<JITBitOrGenerator, operationValueBitOr>(node);
+            return;
+        case BitXor:
+            emitUntypedBitOp<JITBitXorGenerator, operationValueBitXor>(node);
+            return;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    if (leftChild->isInt32Constant()) {
+        SpeculateInt32Operand op2(this, rightChild);
+        GPRTemporary result(this, Reuse, op2);
+
+        bitOp(op, leftChild->asInt32(), op2.gpr(), result.gpr());
+
+        int32Result(result.gpr(), node);
+
+    } else if (rightChild->isInt32Constant()) {
+        SpeculateInt32Operand op1(this, leftChild);
+        GPRTemporary result(this, Reuse, op1);
+
+        bitOp(op, rightChild->asInt32(), op1.gpr(), result.gpr());
+
+        int32Result(result.gpr(), node);
+
+    } else {
+        SpeculateInt32Operand op1(this, leftChild);
+        SpeculateInt32Operand op2(this, rightChild);
+        GPRTemporary result(this, Reuse, op1, op2);
+        
+        GPRReg reg1 = op1.gpr();
+        GPRReg reg2 = op2.gpr();
+        bitOp(op, reg1, reg2, result.gpr());
+        
+        int32Result(result.gpr(), node);
+    }
+}
+
+void SpeculativeJIT::emitUntypedRightShiftBitOp(Node* node)
+{
+    J_JITOperation_EJJ snippetSlowPathFunction = node->op() == BitRShift
+        ? operationValueBitRShift : operationValueBitURShift;
+    JITRightShiftGenerator::ShiftType shiftType = node->op() == BitRShift
+        ? JITRightShiftGenerator::SignedShift : JITRightShiftGenerator::UnsignedShift;
+
+    Edge& leftChild = node->child1();
+    Edge& rightChild = node->child2();
+
+    if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
+        JSValueOperand left(this, leftChild);
+        JSValueOperand right(this, rightChild);
+        JSValueRegs leftRegs = left.jsValueRegs();
+        JSValueRegs rightRegs = right.jsValueRegs();
+#if USE(JSVALUE64)
+        GPRTemporary result(this);
+        JSValueRegs resultRegs = JSValueRegs(result.gpr());
+#else
+        GPRTemporary resultTag(this);
+        GPRTemporary resultPayload(this);
+        JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+#endif
+        flushRegisters();
+        callOperation(snippetSlowPathFunction, resultRegs, leftRegs, rightRegs);
+        m_jit.exceptionCheck();
+
+        jsValueResult(resultRegs, node);
+        return;
+    }
+
+    std::optional<JSValueOperand> left;
+    std::optional<JSValueOperand> right;
+
+    JSValueRegs leftRegs;
+    JSValueRegs rightRegs;
+
+    FPRTemporary leftNumber(this);
+    FPRReg leftFPR = leftNumber.fpr();
+
+#if USE(JSVALUE64)
+    GPRTemporary result(this);
+    JSValueRegs resultRegs = JSValueRegs(result.gpr());
+    GPRTemporary scratch(this);
+    GPRReg scratchGPR = scratch.gpr();
+    FPRReg scratchFPR = InvalidFPRReg;
+#else
+    GPRTemporary resultTag(this);
+    GPRTemporary resultPayload(this);
+    JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+    GPRReg scratchGPR = resultTag.gpr();
+    FPRTemporary fprScratch(this);
+    FPRReg scratchFPR = fprScratch.fpr();
+#endif
+
+    SnippetOperand leftOperand;
+    SnippetOperand rightOperand;
+
+    // The snippet generator does not support both operands being constant. If the left
+    // operand is already const, we'll ignore the right operand's constness.
+    if (leftChild->isInt32Constant())
+        leftOperand.setConstInt32(leftChild->asInt32());
+    else if (rightChild->isInt32Constant())
+        rightOperand.setConstInt32(rightChild->asInt32());
+
+    RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
+
+    if (!leftOperand.isConst()) {
+        left.emplace(this, leftChild);
+        leftRegs = left->jsValueRegs();
+    }
+    if (!rightOperand.isConst()) {
+        right.emplace(this, rightChild);
+        rightRegs = right->jsValueRegs();
+    }
+
+    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
+        leftFPR, scratchGPR, scratchFPR, shiftType);
+    gen.generateFastPath(m_jit);
+
+    ASSERT(gen.didEmitFastPath());
+    gen.endJumpList().append(m_jit.jump());
+
+    gen.slowPathJumpList().link(&m_jit);
+    silentSpillAllRegisters(resultRegs);
+
+    if (leftOperand.isConst()) {
+        leftRegs = resultRegs;
+        m_jit.moveValue(leftChild->asJSValue(), leftRegs);
+    } else if (rightOperand.isConst()) {
+        rightRegs = resultRegs;
+        m_jit.moveValue(rightChild->asJSValue(), rightRegs);
+    }
+
+    callOperation(snippetSlowPathFunction, resultRegs, leftRegs, rightRegs);
+
+    silentFillAllRegisters(resultRegs);
+    m_jit.exceptionCheck();
+
+    gen.endJumpList().link(&m_jit);
+    jsValueResult(resultRegs, node);
+    return;
+}
+
+void SpeculativeJIT::compileShiftOp(Node* node)
+{
+    NodeType op = node->op();
+    Edge& leftChild = node->child1();
+    Edge& rightChild = node->child2();
+
+    if (leftChild.useKind() == UntypedUse || rightChild.useKind() == UntypedUse) {
+        switch (op) {
+        case BitLShift:
+            emitUntypedBitOp<JITLeftShiftGenerator, operationValueBitLShift>(node);
+            return;
+        case BitRShift:
+        case BitURShift:
+            emitUntypedRightShiftBitOp(node);
+            return;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    if (rightChild->isInt32Constant()) {
+        SpeculateInt32Operand op1(this, leftChild);
+        GPRTemporary result(this, Reuse, op1);
+
+        shiftOp(op, op1.gpr(), rightChild->asInt32() & 0x1f, result.gpr());
+
+        int32Result(result.gpr(), node);
+    } else {
+        // Do not allow shift amount to be used as the result, MacroAssembler does not permit this.
+        SpeculateInt32Operand op1(this, leftChild);
+        SpeculateInt32Operand op2(this, rightChild);
+        GPRTemporary result(this, Reuse, op1);
+
+        GPRReg reg1 = op1.gpr();
+        GPRReg reg2 = op2.gpr();
+        shiftOp(op, reg1, reg2, result.gpr());
+
+        int32Result(result.gpr(), node);
+    }
+}
+
+void SpeculativeJIT::compileValueAdd(Node* node)
+{
+    Edge& leftChild = node->child1();
+    Edge& rightChild = node->child2();
+
+    if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
+        JSValueOperand left(this, leftChild);
+        JSValueOperand right(this, rightChild);
+        JSValueRegs leftRegs = left.jsValueRegs();
+        JSValueRegs rightRegs = right.jsValueRegs();
+#if USE(JSVALUE64)
+        GPRTemporary result(this);
+        JSValueRegs resultRegs = JSValueRegs(result.gpr());
+#else
+        GPRTemporary resultTag(this);
+        GPRTemporary resultPayload(this);
+        JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+#endif
+        flushRegisters();
+        callOperation(operationValueAddNotNumber, resultRegs, leftRegs, rightRegs);
+        m_jit.exceptionCheck();
+    
+        jsValueResult(resultRegs, node);
+        return;
+    }
+
+#if USE(JSVALUE64)
+    bool needsScratchGPRReg = true;
+    bool needsScratchFPRReg = false;
+#else
+    bool needsScratchGPRReg = true;
+    bool needsScratchFPRReg = true;
+#endif
+
+    ArithProfile* arithProfile = m_jit.graph().baselineCodeBlockFor(node->origin.semantic)->arithProfileForBytecodeOffset(node->origin.semantic.bytecodeIndex);
+    JITAddIC* addIC = m_jit.codeBlock()->addJITAddIC(arithProfile);
+    auto repatchingFunction = operationValueAddOptimize;
+    auto nonRepatchingFunction = operationValueAdd;
+    
+    compileMathIC(node, addIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
+}
+
+template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
+void SpeculativeJIT::compileMathIC(Node* node, JITBinaryMathIC<Generator>* mathIC, bool needsScratchGPRReg, bool needsScratchFPRReg, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
+{
+    Edge& leftChild = node->child1();
+    Edge& rightChild = node->child2();
+
+    std::optional<JSValueOperand> left;
+    std::optional<JSValueOperand> right;
+
+    JSValueRegs leftRegs;
+    JSValueRegs rightRegs;
+
+    FPRTemporary leftNumber(this);
+    FPRTemporary rightNumber(this);
+    FPRReg leftFPR = leftNumber.fpr();
+    FPRReg rightFPR = rightNumber.fpr();
+
+    GPRReg scratchGPR = InvalidGPRReg;
+    FPRReg scratchFPR = InvalidFPRReg;
+
+    std::optional<FPRTemporary> fprScratch;
+    if (needsScratchFPRReg) {
+        fprScratch.emplace(this);
+        scratchFPR = fprScratch->fpr();
+    }
+
+#if USE(JSVALUE64)
+    std::optional<GPRTemporary> gprScratch;
+    if (needsScratchGPRReg) {
+        gprScratch.emplace(this);
+        scratchGPR = gprScratch->gpr();
+    }
+    GPRTemporary result(this);
+    JSValueRegs resultRegs = JSValueRegs(result.gpr());
+#else
+    GPRTemporary resultTag(this);
+    GPRTemporary resultPayload(this);
+    JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+    if (needsScratchGPRReg)
+        scratchGPR = resultRegs.tagGPR();
+#endif
+
+    SnippetOperand leftOperand(m_state.forNode(leftChild).resultType());
+    SnippetOperand rightOperand(m_state.forNode(rightChild).resultType());
+
+    // The snippet generator does not support both operands being constant. If the left
+    // operand is already const, we'll ignore the right operand's constness.
+    if (leftChild->isInt32Constant())
+        leftOperand.setConstInt32(leftChild->asInt32());
+    else if (rightChild->isInt32Constant())
+        rightOperand.setConstInt32(rightChild->asInt32());
+
+    ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
+    ASSERT(!(Generator::isLeftOperandValidConstant(leftOperand) && Generator::isRightOperandValidConstant(rightOperand)));
+
+    if (!Generator::isLeftOperandValidConstant(leftOperand)) {
+        left.emplace(this, leftChild);
+        leftRegs = left->jsValueRegs();
+    }
+    if (!Generator::isRightOperandValidConstant(rightOperand)) {
+        right.emplace(this, rightChild);
+        rightRegs = right->jsValueRegs();
+    }
+
+#if ENABLE(MATH_IC_STATS)
+    auto inlineStart = m_jit.label();
+#endif
+
+    Box<MathICGenerationState> addICGenerationState = Box<MathICGenerationState>::create();
+    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, leftFPR, rightFPR, scratchGPR, scratchFPR);
+
+    bool shouldEmitProfiling = false;
+    bool generatedInline = mathIC->generateInline(m_jit, *addICGenerationState, shouldEmitProfiling);
+
+    if (generatedInline) {
+        ASSERT(!addICGenerationState->slowPathJumps.empty());
+
+        Vector<SilentRegisterSavePlan> savePlans;
+        silentSpillAllRegistersImpl(false, savePlans, resultRegs);
+
+        auto done = m_jit.label();
+
+        addSlowPathGenerator([=, savePlans = WTFMove(savePlans)] () {
+            addICGenerationState->slowPathJumps.link(&m_jit);
+            addICGenerationState->slowPathStart = m_jit.label();
+#if ENABLE(MATH_IC_STATS)
+            auto slowPathStart = m_jit.label();
+#endif
+
+            silentSpill(savePlans);
+
+            auto innerLeftRegs = leftRegs;
+            auto innerRightRegs = rightRegs;
+            if (Generator::isLeftOperandValidConstant(leftOperand)) {
+                innerLeftRegs = resultRegs;
+                m_jit.moveValue(leftChild->asJSValue(), innerLeftRegs);
+            } else if (Generator::isRightOperandValidConstant(rightOperand)) {
+                innerRightRegs = resultRegs;
+                m_jit.moveValue(rightChild->asJSValue(), innerRightRegs);
+            }
+
+            if (addICGenerationState->shouldSlowPathRepatch)
+                addICGenerationState->slowPathCall = callOperation(bitwise_cast<J_JITOperation_EJJMic>(repatchingFunction), resultRegs, innerLeftRegs, innerRightRegs, TrustedImmPtr(mathIC));
+            else
+                addICGenerationState->slowPathCall = callOperation(nonRepatchingFunction, resultRegs, innerLeftRegs, innerRightRegs);
+
+            silentFill(savePlans);
+            m_jit.exceptionCheck();
+            m_jit.jump().linkTo(done, &m_jit);
+
+            m_jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                mathIC->finalizeInlineCode(*addICGenerationState, linkBuffer);
+            });
+
+#if ENABLE(MATH_IC_STATS)
+            auto slowPathEnd = m_jit.label();
+            m_jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                size_t size = static_cast<char*>(linkBuffer.locationOf(slowPathEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(slowPathStart).executableAddress());
+                mathIC->m_generatedCodeSize += size;
+            });
+#endif
+
+        });
+    } else {
+        if (Generator::isLeftOperandValidConstant(leftOperand)) {
+            left.emplace(this, leftChild);
+            leftRegs = left->jsValueRegs();
+        } else if (Generator::isRightOperandValidConstant(rightOperand)) {
+            right.emplace(this, rightChild);
+            rightRegs = right->jsValueRegs();
+        }
+
+        flushRegisters();
+        callOperation(nonRepatchingFunction, resultRegs, leftRegs, rightRegs);
+        m_jit.exceptionCheck();
+    }
+
+#if ENABLE(MATH_IC_STATS)
+    auto inlineEnd = m_jit.label();
+    m_jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+        size_t size = static_cast<char*>(linkBuffer.locationOf(inlineEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(inlineStart).executableAddress());
+        mathIC->m_generatedCodeSize += size;
+    });
+#endif
+
+    jsValueResult(resultRegs, node);
+    return;
+}
+
+void SpeculativeJIT::compileInstanceOfCustom(Node* node)
+{
+    // We could do something smarter here but this case is currently super rare and unless
+    // Symbol.hasInstance becomes popular will likely remain that way.
+
+    JSValueOperand value(this, node->child1());
+    SpeculateCellOperand constructor(this, node->child2());
+    JSValueOperand hasInstanceValue(this, node->child3());
+    GPRTemporary result(this);
+
+    JSValueRegs valueRegs = value.jsValueRegs();
+    GPRReg constructorGPR = constructor.gpr();
+    JSValueRegs hasInstanceRegs = hasInstanceValue.jsValueRegs();
+    GPRReg resultGPR = result.gpr();
+
+    MacroAssembler::Jump slowCase = m_jit.jump();
+
+    addSlowPathGenerator(slowPathCall(slowCase, this, operationInstanceOfCustom, resultGPR, valueRegs, constructorGPR, hasInstanceRegs));
+
+    unblessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileIsCellWithType(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case UntypedUse: {
+        JSValueOperand value(this, node->child1());
+#if USE(JSVALUE64)
+        GPRTemporary result(this, Reuse, value);
+#else
+        GPRTemporary result(this, Reuse, value, PayloadWord);
+#endif
+
+        JSValueRegs valueRegs = value.jsValueRegs();
+        GPRReg resultGPR = result.gpr();
+
+        JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(valueRegs);
+
+        m_jit.compare8(JITCompiler::Equal,
+            JITCompiler::Address(valueRegs.payloadGPR(), JSCell::typeInfoTypeOffset()),
+            TrustedImm32(node->queriedType()),
+            resultGPR);
+        blessBoolean(resultGPR);
+        JITCompiler::Jump done = m_jit.jump();
+
+        isNotCell.link(&m_jit);
+        moveFalseTo(resultGPR);
+
+        done.link(&m_jit);
+        blessedBooleanResult(resultGPR, node);
+        return;
+    }
+
+    case CellUse: {
+        SpeculateCellOperand cell(this, node->child1());
+        GPRTemporary result(this, Reuse, cell);
+
+        GPRReg cellGPR = cell.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        m_jit.compare8(JITCompiler::Equal,
+            JITCompiler::Address(cellGPR, JSCell::typeInfoTypeOffset()),
+            TrustedImm32(node->queriedType()),
+            resultGPR);
+        blessBoolean(resultGPR);
+        blessedBooleanResult(resultGPR, node);
+        return;
+    }
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void SpeculativeJIT::compileIsTypedArrayView(Node* node)
+{
+    JSValueOperand value(this, node->child1());
+#if USE(JSVALUE64)
+    GPRTemporary result(this, Reuse, value);
+#else
+    GPRTemporary result(this, Reuse, value, PayloadWord);
+#endif
+
+    JSValueRegs valueRegs = value.jsValueRegs();
+    GPRReg resultGPR = result.gpr();
+
+    JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(valueRegs);
+
+    m_jit.load8(JITCompiler::Address(valueRegs.payloadGPR(), JSCell::typeInfoTypeOffset()), resultGPR);
+    m_jit.sub32(TrustedImm32(Int8ArrayType), resultGPR);
+    m_jit.compare32(JITCompiler::BelowOrEqual,
+        resultGPR,
+        TrustedImm32(Float64ArrayType - Int8ArrayType),
+        resultGPR);
+    blessBoolean(resultGPR);
+    JITCompiler::Jump done = m_jit.jump();
+
+    isNotCell.link(&m_jit);
+    moveFalseTo(resultGPR);
+
+    done.link(&m_jit);
+    blessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileCallObjectConstructor(Node* node)
+{
+    RELEASE_ASSERT(node->child1().useKind() == UntypedUse);
+    JSValueOperand value(this, node->child1());
+#if USE(JSVALUE64)
+    GPRTemporary result(this, Reuse, value);
+#else
+    GPRTemporary result(this, Reuse, value, PayloadWord);
+#endif
+
+    JSValueRegs valueRegs = value.jsValueRegs();
+    GPRReg resultGPR = result.gpr();
+
+    MacroAssembler::JumpList slowCases;
+    slowCases.append(m_jit.branchIfNotCell(valueRegs));
+    slowCases.append(m_jit.branchIfNotObject(valueRegs.payloadGPR()));
+    m_jit.move(valueRegs.payloadGPR(), resultGPR);
+
+    addSlowPathGenerator(slowPathCall(slowCases, this, operationObjectConstructor, resultGPR, m_jit.globalObjectFor(node->origin.semantic), valueRegs));
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileArithAdd(Node* node)
+{
+    switch (node->binaryUseKind()) {
+    case Int32Use: {
+        ASSERT(!shouldCheckNegativeZero(node->arithMode()));
+
+        if (node->child2()->isInt32Constant()) {
+            SpeculateInt32Operand op1(this, node->child1());
+            GPRTemporary result(this, Reuse, op1);
+
+            GPRReg gpr1 = op1.gpr();
+            int32_t imm2 = node->child2()->asInt32();
+            GPRReg gprResult = result.gpr();
+
+            if (!shouldCheckOverflow(node->arithMode())) {
+                m_jit.add32(Imm32(imm2), gpr1, gprResult);
+                int32Result(gprResult, node);
+                return;
+            }
+
+            MacroAssembler::Jump check = m_jit.branchAdd32(MacroAssembler::Overflow, gpr1, Imm32(imm2), gprResult);
+            if (gpr1 == gprResult) {
+                speculationCheck(Overflow, JSValueRegs(), 0, check,
+                    SpeculationRecovery(SpeculativeAddImmediate, gpr1, imm2));
+            } else
+                speculationCheck(Overflow, JSValueRegs(), 0, check);
+
+            int32Result(gprResult, node);
+            return;
+        }
+                
+        SpeculateInt32Operand op1(this, node->child1());
+        SpeculateInt32Operand op2(this, node->child2());
+        GPRTemporary result(this, Reuse, op1, op2);
+
+        GPRReg gpr1 = op1.gpr();
+        GPRReg gpr2 = op2.gpr();
+        GPRReg gprResult = result.gpr();
+
+        if (!shouldCheckOverflow(node->arithMode()))
+            m_jit.add32(gpr1, gpr2, gprResult);
+        else {
+            MacroAssembler::Jump check = m_jit.branchAdd32(MacroAssembler::Overflow, gpr1, gpr2, gprResult);
+                
+            if (gpr1 == gprResult)
+                speculationCheck(Overflow, JSValueRegs(), 0, check, SpeculationRecovery(SpeculativeAdd, gprResult, gpr2));
+            else if (gpr2 == gprResult)
+                speculationCheck(Overflow, JSValueRegs(), 0, check, SpeculationRecovery(SpeculativeAdd, gprResult, gpr1));
+            else
+                speculationCheck(Overflow, JSValueRegs(), 0, check);
+        }
+
+        int32Result(gprResult, node);
+        return;
+    }
+        
+#if USE(JSVALUE64)
+    case Int52RepUse: {
+        ASSERT(shouldCheckOverflow(node->arithMode()));
+        ASSERT(!shouldCheckNegativeZero(node->arithMode()));
+
+        // Will we need an overflow check? If we can prove that neither input can be
+        // Int52 then the overflow check will not be necessary.
+        if (!m_state.forNode(node->child1()).couldBeType(SpecInt52Only)
+            && !m_state.forNode(node->child2()).couldBeType(SpecInt52Only)) {
+            SpeculateWhicheverInt52Operand op1(this, node->child1());
+            SpeculateWhicheverInt52Operand op2(this, node->child2(), op1);
+            GPRTemporary result(this, Reuse, op1);
+            m_jit.add64(op1.gpr(), op2.gpr(), result.gpr());
+            int52Result(result.gpr(), node, op1.format());
+            return;
+        }
+        
+        SpeculateInt52Operand op1(this, node->child1());
+        SpeculateInt52Operand op2(this, node->child2());
+        GPRTemporary result(this);
+        m_jit.move(op1.gpr(), result.gpr());
+        speculationCheck(
+            Int52Overflow, JSValueRegs(), 0,
+            m_jit.branchAdd64(MacroAssembler::Overflow, op2.gpr(), result.gpr()));
+        int52Result(result.gpr(), node);
+        return;
+    }
+#endif // USE(JSVALUE64)
+    
+    case DoubleRepUse: {
+        SpeculateDoubleOperand op1(this, node->child1());
+        SpeculateDoubleOperand op2(this, node->child2());
+        FPRTemporary result(this, op1, op2);
+
+        FPRReg reg1 = op1.fpr();
+        FPRReg reg2 = op2.fpr();
+        m_jit.addDouble(reg1, reg2, result.fpr());
+
+        doubleResult(result.fpr(), node);
+        return;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void SpeculativeJIT::compileMakeRope(Node* node)
+{
+    ASSERT(node->child1().useKind() == KnownStringUse);
+    ASSERT(node->child2().useKind() == KnownStringUse);
+    ASSERT(!node->child3() || node->child3().useKind() == KnownStringUse);
+    
+    SpeculateCellOperand op1(this, node->child1());
+    SpeculateCellOperand op2(this, node->child2());
+    SpeculateCellOperand op3(this, node->child3());
+    GPRTemporary result(this);
+    GPRTemporary allocator(this);
+    GPRTemporary scratch(this);
+    
+    GPRReg opGPRs[3];
+    unsigned numOpGPRs;
+    opGPRs[0] = op1.gpr();
+    opGPRs[1] = op2.gpr();
+    if (node->child3()) {
+        opGPRs[2] = op3.gpr();
+        numOpGPRs = 3;
+    } else {
+        opGPRs[2] = InvalidGPRReg;
+        numOpGPRs = 2;
+    }
+    GPRReg resultGPR = result.gpr();
+    GPRReg allocatorGPR = allocator.gpr();
+    GPRReg scratchGPR = scratch.gpr();
+    
+    JITCompiler::JumpList slowPath;
+    MarkedAllocator* markedAllocator = subspaceFor<JSString>(*m_jit.vm())->allocatorFor(sizeof(JSRopeString));
+    RELEASE_ASSERT(markedAllocator);
+    m_jit.move(TrustedImmPtr(markedAllocator), allocatorGPR);
+    emitAllocateJSCell(resultGPR, markedAllocator, allocatorGPR, TrustedImmPtr(m_jit.graph().registerStructure(m_jit.vm()->stringStructure.get())), scratchGPR, slowPath);
+        
+    m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(resultGPR, JSString::offsetOfValue()));
+    for (unsigned i = 0; i < numOpGPRs; ++i)
+        m_jit.storePtr(opGPRs[i], JITCompiler::Address(resultGPR, JSRopeString::offsetOfFibers() + sizeof(WriteBarrier<JSString>) * i));
+    for (unsigned i = numOpGPRs; i < JSRopeString::s_maxInternalRopeLength; ++i)
+        m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(resultGPR, JSRopeString::offsetOfFibers() + sizeof(WriteBarrier<JSString>) * i));
+    m_jit.load32(JITCompiler::Address(opGPRs[0], JSString::offsetOfFlags()), scratchGPR);
+    m_jit.load32(JITCompiler::Address(opGPRs[0], JSString::offsetOfLength()), allocatorGPR);
+    if (!ASSERT_DISABLED) {
+        JITCompiler::Jump ok = m_jit.branch32(
+            JITCompiler::GreaterThanOrEqual, allocatorGPR, TrustedImm32(0));
+        m_jit.abortWithReason(DFGNegativeStringLength);
+        ok.link(&m_jit);
+    }
+    for (unsigned i = 1; i < numOpGPRs; ++i) {
+        m_jit.and32(JITCompiler::Address(opGPRs[i], JSString::offsetOfFlags()), scratchGPR);
+        speculationCheck(
+            Uncountable, JSValueSource(), nullptr,
+            m_jit.branchAdd32(
+                JITCompiler::Overflow,
+                JITCompiler::Address(opGPRs[i], JSString::offsetOfLength()), allocatorGPR));
+    }
+    m_jit.and32(JITCompiler::TrustedImm32(JSString::Is8Bit), scratchGPR);
+    m_jit.store32(scratchGPR, JITCompiler::Address(resultGPR, JSString::offsetOfFlags()));
+    if (!ASSERT_DISABLED) {
+        JITCompiler::Jump ok = m_jit.branch32(
+            JITCompiler::GreaterThanOrEqual, allocatorGPR, TrustedImm32(0));
+        m_jit.abortWithReason(DFGNegativeStringLength);
+        ok.link(&m_jit);
+    }
+    m_jit.store32(allocatorGPR, JITCompiler::Address(resultGPR, JSString::offsetOfLength()));
+    
+    m_jit.mutatorFence();
+    
+    switch (numOpGPRs) {
+    case 2:
+        addSlowPathGenerator(slowPathCall(
+            slowPath, this, operationMakeRope2, resultGPR, opGPRs[0], opGPRs[1]));
+        break;
+    case 3:
+        addSlowPathGenerator(slowPathCall(
+            slowPath, this, operationMakeRope3, resultGPR, opGPRs[0], opGPRs[1], opGPRs[2]));
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileArithAbs(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case Int32Use: {
+        SpeculateStrictInt32Operand op1(this, node->child1());
+        GPRTemporary result(this, Reuse, op1);
+        GPRTemporary scratch(this);
+
+        m_jit.move(op1.gpr(), result.gpr());
+        m_jit.rshift32(result.gpr(), MacroAssembler::TrustedImm32(31), scratch.gpr());
+        m_jit.add32(scratch.gpr(), result.gpr());
+        m_jit.xor32(scratch.gpr(), result.gpr());
+        if (shouldCheckOverflow(node->arithMode()))
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(MacroAssembler::Signed, result.gpr()));
+        int32Result(result.gpr(), node);
+        break;
+    }
+
+    case DoubleRepUse: {
+        SpeculateDoubleOperand op1(this, node->child1());
+        FPRTemporary result(this);
+
+        m_jit.absDouble(op1.fpr(), result.fpr());
+        doubleResult(result.fpr(), node);
+        break;
+    }
+
+    default: {
+        DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse);
+        JSValueOperand op1(this, node->child1());
+        JSValueRegs op1Regs = op1.jsValueRegs();
+        flushRegisters();
+        FPRResult result(this);
+        callOperation(operationArithAbs, result.fpr(), op1Regs);
+        m_jit.exceptionCheck();
+        doubleResult(result.fpr(), node);
+        break;
+    }
+    }
+}
+
+void SpeculativeJIT::compileArithClz32(Node* node)
+{
+    if (node->child1().useKind() == Int32Use || node->child1().useKind() == KnownInt32Use) {
+        SpeculateInt32Operand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value);
+        GPRReg valueReg = value.gpr();
+        GPRReg resultReg = result.gpr();
+        m_jit.countLeadingZeros32(valueReg, resultReg);
+        int32Result(resultReg, node);
+        return;
+    }
+    JSValueOperand op1(this, node->child1());
+    JSValueRegs op1Regs = op1.jsValueRegs();
+    GPRTemporary result(this);
+    GPRReg resultReg = result.gpr();
+    flushRegisters();
+    callOperation(operationArithClz32, resultReg, op1Regs);
+    m_jit.exceptionCheck();
+    int32Result(resultReg, node);
+}
+
+void SpeculativeJIT::compileArithDoubleUnaryOp(Node* node, double (*doubleFunction)(double), double (*operation)(ExecState*, EncodedJSValue))
+{
+    if (node->child1().useKind() == DoubleRepUse) {
+        SpeculateDoubleOperand op1(this, node->child1());
+        FPRReg op1FPR = op1.fpr();
+
+        flushRegisters();
+
+        FPRResult result(this);
+        callOperation(doubleFunction, result.fpr(), op1FPR);
+        doubleResult(result.fpr(), node);
+        return;
+    }
+
+    JSValueOperand op1(this, node->child1());
+    JSValueRegs op1Regs = op1.jsValueRegs();
+    flushRegisters();
+    FPRResult result(this);
+    callOperation(operation, result.fpr(), op1Regs);
+    m_jit.exceptionCheck();
+    doubleResult(result.fpr(), node);
+}
+
+void SpeculativeJIT::compileArithCos(Node* node)
+{
+    compileArithDoubleUnaryOp(node, cos, operationArithCos);
+}
+
+void SpeculativeJIT::compileArithTan(Node* node)
+{
+    compileArithDoubleUnaryOp(node, tan, operationArithTan);
+}
+
+void SpeculativeJIT::compileArithSub(Node* node)
+{
+    switch (node->binaryUseKind()) {
+    case Int32Use: {
+        ASSERT(!shouldCheckNegativeZero(node->arithMode()));
+        
+        if (node->child2()->isInt32Constant()) {
+            SpeculateInt32Operand op1(this, node->child1());
+            int32_t imm2 = node->child2()->asInt32();
+            GPRTemporary result(this);
+
+            if (!shouldCheckOverflow(node->arithMode())) {
+                m_jit.move(op1.gpr(), result.gpr());
+                m_jit.sub32(Imm32(imm2), result.gpr());
+            } else {
+                GPRTemporary scratch(this);
+                speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchSub32(MacroAssembler::Overflow, op1.gpr(), Imm32(imm2), result.gpr(), scratch.gpr()));
+            }
+
+            int32Result(result.gpr(), node);
+            return;
+        }
+            
+        if (node->child1()->isInt32Constant()) {
+            int32_t imm1 = node->child1()->asInt32();
+            SpeculateInt32Operand op2(this, node->child2());
+            GPRTemporary result(this);
+                
+            m_jit.move(Imm32(imm1), result.gpr());
+            if (!shouldCheckOverflow(node->arithMode()))
+                m_jit.sub32(op2.gpr(), result.gpr());
+            else
+                speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchSub32(MacroAssembler::Overflow, op2.gpr(), result.gpr()));
+                
+            int32Result(result.gpr(), node);
+            return;
+        }
+            
+        SpeculateInt32Operand op1(this, node->child1());
+        SpeculateInt32Operand op2(this, node->child2());
+        GPRTemporary result(this);
+
+        if (!shouldCheckOverflow(node->arithMode())) {
+            m_jit.move(op1.gpr(), result.gpr());
+            m_jit.sub32(op2.gpr(), result.gpr());
+        } else
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchSub32(MacroAssembler::Overflow, op1.gpr(), op2.gpr(), result.gpr()));
+
+        int32Result(result.gpr(), node);
+        return;
+    }
+        
+#if USE(JSVALUE64)
+    case Int52RepUse: {
+        ASSERT(shouldCheckOverflow(node->arithMode()));
+        ASSERT(!shouldCheckNegativeZero(node->arithMode()));
+
+        // Will we need an overflow check? If we can prove that neither input can be
+        // Int52 then the overflow check will not be necessary.
+        if (!m_state.forNode(node->child1()).couldBeType(SpecInt52Only)
+            && !m_state.forNode(node->child2()).couldBeType(SpecInt52Only)) {
+            SpeculateWhicheverInt52Operand op1(this, node->child1());
+            SpeculateWhicheverInt52Operand op2(this, node->child2(), op1);
+            GPRTemporary result(this, Reuse, op1);
+            m_jit.move(op1.gpr(), result.gpr());
+            m_jit.sub64(op2.gpr(), result.gpr());
+            int52Result(result.gpr(), node, op1.format());
+            return;
+        }
+        
+        SpeculateInt52Operand op1(this, node->child1());
+        SpeculateInt52Operand op2(this, node->child2());
+        GPRTemporary result(this);
+        m_jit.move(op1.gpr(), result.gpr());
+        speculationCheck(
+            Int52Overflow, JSValueRegs(), 0,
+            m_jit.branchSub64(MacroAssembler::Overflow, op2.gpr(), result.gpr()));
+        int52Result(result.gpr(), node);
+        return;
+    }
+#endif // USE(JSVALUE64)
+
+    case DoubleRepUse: {
+        SpeculateDoubleOperand op1(this, node->child1());
+        SpeculateDoubleOperand op2(this, node->child2());
+        FPRTemporary result(this, op1);
+
+        FPRReg reg1 = op1.fpr();
+        FPRReg reg2 = op2.fpr();
+        m_jit.subDouble(reg1, reg2, result.fpr());
+
+        doubleResult(result.fpr(), node);
+        return;
+    }
+
+    case UntypedUse: {
+#if USE(JSVALUE64)
+        bool needsScratchGPRReg = true;
+        bool needsScratchFPRReg = false;
+#else
+        bool needsScratchGPRReg = true;
+        bool needsScratchFPRReg = true;
+#endif
+
+        ArithProfile* arithProfile = m_jit.graph().baselineCodeBlockFor(node->origin.semantic)->arithProfileForBytecodeOffset(node->origin.semantic.bytecodeIndex);
+        JITSubIC* subIC = m_jit.codeBlock()->addJITSubIC(arithProfile);
+        auto repatchingFunction = operationValueSubOptimize;
+        auto nonRepatchingFunction = operationValueSub;
+        
+        compileMathIC(node, subIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
+        return;
+    }
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+}
+
+void SpeculativeJIT::compileArithNegate(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case Int32Use: {
+        SpeculateInt32Operand op1(this, node->child1());
+        GPRTemporary result(this);
+
+        m_jit.move(op1.gpr(), result.gpr());
+
+        // Note: there is no notion of being not used as a number, but someone
+        // caring about negative zero.
+        
+        if (!shouldCheckOverflow(node->arithMode()))
+            m_jit.neg32(result.gpr());
+        else if (!shouldCheckNegativeZero(node->arithMode()))
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchNeg32(MacroAssembler::Overflow, result.gpr()));
+        else {
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(MacroAssembler::Zero, result.gpr(), TrustedImm32(0x7fffffff)));
+            m_jit.neg32(result.gpr());
+        }
+
+        int32Result(result.gpr(), node);
+        return;
+    }
+
+#if USE(JSVALUE64)
+    case Int52RepUse: {
+        ASSERT(shouldCheckOverflow(node->arithMode()));
+        
+        if (!m_state.forNode(node->child1()).couldBeType(SpecInt52Only)) {
+            SpeculateWhicheverInt52Operand op1(this, node->child1());
+            GPRTemporary result(this);
+            GPRReg op1GPR = op1.gpr();
+            GPRReg resultGPR = result.gpr();
+            m_jit.move(op1GPR, resultGPR);
+            m_jit.neg64(resultGPR);
+            if (shouldCheckNegativeZero(node->arithMode())) {
+                speculationCheck(
+                    NegativeZero, JSValueRegs(), 0,
+                    m_jit.branchTest64(MacroAssembler::Zero, resultGPR));
+            }
+            int52Result(resultGPR, node, op1.format());
+            return;
+        }
+        
+        SpeculateInt52Operand op1(this, node->child1());
+        GPRTemporary result(this);
+        GPRReg op1GPR = op1.gpr();
+        GPRReg resultGPR = result.gpr();
+        m_jit.move(op1GPR, resultGPR);
+        speculationCheck(
+            Int52Overflow, JSValueRegs(), 0,
+            m_jit.branchNeg64(MacroAssembler::Overflow, resultGPR));
+        if (shouldCheckNegativeZero(node->arithMode())) {
+            speculationCheck(
+                NegativeZero, JSValueRegs(), 0,
+                m_jit.branchTest64(MacroAssembler::Zero, resultGPR));
+        }
+        int52Result(resultGPR, node);
+        return;
+    }
+#endif // USE(JSVALUE64)
+        
+    case DoubleRepUse: {
+        SpeculateDoubleOperand op1(this, node->child1());
+        FPRTemporary result(this);
+        
+        m_jit.negateDouble(op1.fpr(), result.fpr());
+        
+        doubleResult(result.fpr(), node);
+        return;
+    }
+        
+    default: {
+        ArithProfile* arithProfile = m_jit.graph().baselineCodeBlockFor(node->origin.semantic)->arithProfileForBytecodeOffset(node->origin.semantic.bytecodeIndex);
+        JITNegIC* negIC = m_jit.codeBlock()->addJITNegIC(arithProfile);
+        auto repatchingFunction = operationArithNegateOptimize;
+        auto nonRepatchingFunction = operationArithNegate;
+        bool needsScratchGPRReg = true;
+        compileMathIC(node, negIC, needsScratchGPRReg, repatchingFunction, nonRepatchingFunction);
+        return;
+    }
+    }
+}
+
+template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
+void SpeculativeJIT::compileMathIC(Node* node, JITUnaryMathIC<Generator>* mathIC, bool needsScratchGPRReg, RepatchingFunction repatchingFunction, NonRepatchingFunction nonRepatchingFunction)
+{
+    GPRReg scratchGPR = InvalidGPRReg;
+    std::optional<GPRTemporary> gprScratch;
+    if (needsScratchGPRReg) {
+        gprScratch.emplace(this);
+        scratchGPR = gprScratch->gpr();
+    }
+    JSValueOperand childOperand(this, node->child1());
+    JSValueRegs childRegs = childOperand.jsValueRegs();
+#if USE(JSVALUE64)
+    GPRTemporary result(this, Reuse, childOperand);
+    JSValueRegs resultRegs(result.gpr());
+#else
+    GPRTemporary resultTag(this);
+    GPRTemporary resultPayload(this);
+    JSValueRegs resultRegs(resultPayload.gpr(), resultTag.gpr());
+#endif
+
+#if ENABLE(MATH_IC_STATS)
+    auto inlineStart = m_jit.label();
+#endif
+
+    Box<MathICGenerationState> icGenerationState = Box<MathICGenerationState>::create();
+    mathIC->m_generator = Generator(resultRegs, childRegs, scratchGPR);
+
+    bool shouldEmitProfiling = false;
+    bool generatedInline = mathIC->generateInline(m_jit, *icGenerationState, shouldEmitProfiling);
+
+    if (generatedInline) {
+        ASSERT(!icGenerationState->slowPathJumps.empty());
+
+        Vector<SilentRegisterSavePlan> savePlans;
+        silentSpillAllRegistersImpl(false, savePlans, resultRegs);
+
+        auto done = m_jit.label();
+
+        addSlowPathGenerator([=, savePlans = WTFMove(savePlans)] () {
+            icGenerationState->slowPathJumps.link(&m_jit);
+            icGenerationState->slowPathStart = m_jit.label();
+#if ENABLE(MATH_IC_STATS)
+            auto slowPathStart = m_jit.label();
+#endif
+
+            silentSpill(savePlans);
+
+            if (icGenerationState->shouldSlowPathRepatch)
+                icGenerationState->slowPathCall = callOperation(bitwise_cast<J_JITOperation_EJMic>(repatchingFunction), resultRegs, childRegs, TrustedImmPtr(mathIC));
+            else
+                icGenerationState->slowPathCall = callOperation(nonRepatchingFunction, resultRegs, childRegs);
+
+            silentFill(savePlans);
+            m_jit.exceptionCheck();
+            m_jit.jump().linkTo(done, &m_jit);
+
+            m_jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                mathIC->finalizeInlineCode(*icGenerationState, linkBuffer);
+            });
+
+#if ENABLE(MATH_IC_STATS)
+            auto slowPathEnd = m_jit.label();
+            m_jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                size_t size = static_cast<char*>(linkBuffer.locationOf(slowPathEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(slowPathStart).executableAddress());
+                mathIC->m_generatedCodeSize += size;
+            });
+#endif
+
+        });
+    } else {
+        flushRegisters();
+        callOperation(nonRepatchingFunction, resultRegs, childRegs);
+        m_jit.exceptionCheck();
+    }
+
+#if ENABLE(MATH_IC_STATS)
+    auto inlineEnd = m_jit.label();
+    m_jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+        size_t size = static_cast<char*>(linkBuffer.locationOf(inlineEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(inlineStart).executableAddress());
+        mathIC->m_generatedCodeSize += size;
+    });
+#endif
+
+    jsValueResult(resultRegs, node);
+    return;
+}
+
+
+void SpeculativeJIT::compileArithMul(Node* node)
+{
+    switch (node->binaryUseKind()) {
+    case Int32Use: {
+        if (node->child2()->isInt32Constant()) {
+            SpeculateInt32Operand op1(this, node->child1());
+            GPRTemporary result(this);
+
+            int32_t imm = node->child2()->asInt32();
+            GPRReg op1GPR = op1.gpr();
+            GPRReg resultGPR = result.gpr();
+
+            if (!shouldCheckOverflow(node->arithMode()))
+                m_jit.mul32(Imm32(imm), op1GPR, resultGPR);
+            else {
+                speculationCheck(Overflow, JSValueRegs(), 0,
+                    m_jit.branchMul32(MacroAssembler::Overflow, op1GPR, Imm32(imm), resultGPR));
+            }
+
+            // The only way to create negative zero with a constant is:
+            // -negative-op1 * 0.
+            // -zero-op1 * negative constant.
+            if (shouldCheckNegativeZero(node->arithMode())) {
+                if (!imm)
+                    speculationCheck(NegativeZero, JSValueRegs(), 0, m_jit.branchTest32(MacroAssembler::Signed, op1GPR));
+                else if (imm < 0) {
+                    if (shouldCheckOverflow(node->arithMode()))
+                        speculationCheck(NegativeZero, JSValueRegs(), 0, m_jit.branchTest32(MacroAssembler::Zero, resultGPR));
+                    else
+                        speculationCheck(NegativeZero, JSValueRegs(), 0, m_jit.branchTest32(MacroAssembler::Zero, op1GPR));
+                }
+            }
+
+            int32Result(resultGPR, node);
+            return;
+        }
+        SpeculateInt32Operand op1(this, node->child1());
+        SpeculateInt32Operand op2(this, node->child2());
+        GPRTemporary result(this);
+
+        GPRReg reg1 = op1.gpr();
+        GPRReg reg2 = op2.gpr();
+
+        // We can perform truncated multiplications if we get to this point, because if the
+        // fixup phase could not prove that it would be safe, it would have turned us into
+        // a double multiplication.
+        if (!shouldCheckOverflow(node->arithMode()))
+            m_jit.mul32(reg1, reg2, result.gpr());
+        else {
+            speculationCheck(
+                Overflow, JSValueRegs(), 0,
+                m_jit.branchMul32(MacroAssembler::Overflow, reg1, reg2, result.gpr()));
+        }
+            
+        // Check for negative zero, if the users of this node care about such things.
+        if (shouldCheckNegativeZero(node->arithMode())) {
+            MacroAssembler::Jump resultNonZero = m_jit.branchTest32(MacroAssembler::NonZero, result.gpr());
+            speculationCheck(NegativeZero, JSValueRegs(), 0, m_jit.branchTest32(MacroAssembler::Signed, reg1));
+            speculationCheck(NegativeZero, JSValueRegs(), 0, m_jit.branchTest32(MacroAssembler::Signed, reg2));
+            resultNonZero.link(&m_jit);
+        }
+
+        int32Result(result.gpr(), node);
+        return;
+    }
+
+#if USE(JSVALUE64)
+    case Int52RepUse: {
+        ASSERT(shouldCheckOverflow(node->arithMode()));
+        
+        // This is super clever. We want to do an int52 multiplication and check the
+        // int52 overflow bit. There is no direct hardware support for this, but we do
+        // have the ability to do an int64 multiplication and check the int64 overflow
+        // bit. We leverage that. Consider that a, b are int52 numbers inside int64
+        // registers, with the high 12 bits being sign-extended. We can do:
+        //
+        //     (a * (b << 12))
+        //
+        // This will give us a left-shifted int52 (value is in high 52 bits, low 16
+        // bits are zero) plus the int52 overflow bit. I.e. whether this 64-bit
+        // multiplication overflows is identical to whether the 'a * b' 52-bit
+        // multiplication overflows.
+        //
+        // In our nomenclature, this is:
+        //
+        //     strictInt52(a) * int52(b) => int52
+        //
+        // That is "strictInt52" means unshifted and "int52" means left-shifted by 16
+        // bits.
+        //
+        // We don't care which of op1 or op2 serves as the left-shifted operand, so
+        // we just do whatever is more convenient for op1 and have op2 do the
+        // opposite. This ensures that we do at most one shift.
+
+        SpeculateWhicheverInt52Operand op1(this, node->child1());
+        SpeculateWhicheverInt52Operand op2(this, node->child2(), OppositeShift, op1);
+        GPRTemporary result(this);
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg op2GPR = op2.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.move(op1GPR, resultGPR);
+        speculationCheck(
+            Int52Overflow, JSValueRegs(), 0,
+            m_jit.branchMul64(MacroAssembler::Overflow, op2GPR, resultGPR));
+        
+        if (shouldCheckNegativeZero(node->arithMode())) {
+            MacroAssembler::Jump resultNonZero = m_jit.branchTest64(
+                MacroAssembler::NonZero, resultGPR);
+            speculationCheck(
+                NegativeZero, JSValueRegs(), 0,
+                m_jit.branch64(MacroAssembler::LessThan, op1GPR, TrustedImm32(0)));
+            speculationCheck(
+                NegativeZero, JSValueRegs(), 0,
+                m_jit.branch64(MacroAssembler::LessThan, op2GPR, TrustedImm32(0)));
+            resultNonZero.link(&m_jit);
+        }
+        
+        int52Result(resultGPR, node);
+        return;
+    }
+#endif // USE(JSVALUE64)
+        
+    case DoubleRepUse: {
+        SpeculateDoubleOperand op1(this, node->child1());
+        SpeculateDoubleOperand op2(this, node->child2());
+        FPRTemporary result(this, op1, op2);
+        
+        FPRReg reg1 = op1.fpr();
+        FPRReg reg2 = op2.fpr();
+        
+        m_jit.mulDouble(reg1, reg2, result.fpr());
+        
+        doubleResult(result.fpr(), node);
+        return;
+    }
+
+    case UntypedUse: {
+        Edge& leftChild = node->child1();
+        Edge& rightChild = node->child2();
+
+        if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
+            JSValueOperand left(this, leftChild);
+            JSValueOperand right(this, rightChild);
+            JSValueRegs leftRegs = left.jsValueRegs();
+            JSValueRegs rightRegs = right.jsValueRegs();
+#if USE(JSVALUE64)
+            GPRTemporary result(this);
+            JSValueRegs resultRegs = JSValueRegs(result.gpr());
+#else
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this);
+            JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+#endif
+            flushRegisters();
+            callOperation(operationValueMul, resultRegs, leftRegs, rightRegs);
+            m_jit.exceptionCheck();
+
+            jsValueResult(resultRegs, node);
+            return;
+        }
+
+#if USE(JSVALUE64)
+        bool needsScratchGPRReg = true;
+        bool needsScratchFPRReg = false;
+#else
+        bool needsScratchGPRReg = true;
+        bool needsScratchFPRReg = true;
+#endif
+
+        ArithProfile* arithProfile = m_jit.graph().baselineCodeBlockFor(node->origin.semantic)->arithProfileForBytecodeOffset(node->origin.semantic.bytecodeIndex);
+        JITMulIC* mulIC = m_jit.codeBlock()->addJITMulIC(arithProfile);
+        auto repatchingFunction = operationValueMulOptimize;
+        auto nonRepatchingFunction = operationValueMul;
+        
+        compileMathIC(node, mulIC, needsScratchGPRReg, needsScratchFPRReg, repatchingFunction, nonRepatchingFunction);
+        return;
+    }
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+}
+
+void SpeculativeJIT::compileArithDiv(Node* node)
+{
+    switch (node->binaryUseKind()) {
+    case Int32Use: {
+#if CPU(X86) || CPU(X86_64)
+        SpeculateInt32Operand op1(this, node->child1());
+        SpeculateInt32Operand op2(this, node->child2());
+        GPRTemporary eax(this, X86Registers::eax);
+        GPRTemporary edx(this, X86Registers::edx);
+        GPRReg op1GPR = op1.gpr();
+        GPRReg op2GPR = op2.gpr();
+    
+        GPRReg op2TempGPR;
+        GPRReg temp;
+        if (op2GPR == X86Registers::eax || op2GPR == X86Registers::edx) {
+            op2TempGPR = allocate();
+            temp = op2TempGPR;
+        } else {
+            op2TempGPR = InvalidGPRReg;
+            if (op1GPR == X86Registers::eax)
+                temp = X86Registers::edx;
+            else
+                temp = X86Registers::eax;
+        }
+    
+        ASSERT(temp != op1GPR);
+        ASSERT(temp != op2GPR);
+    
+        m_jit.add32(JITCompiler::TrustedImm32(1), op2GPR, temp);
+    
+        JITCompiler::Jump safeDenominator = m_jit.branch32(JITCompiler::Above, temp, JITCompiler::TrustedImm32(1));
+    
+        JITCompiler::JumpList done;
+        if (shouldCheckOverflow(node->arithMode())) {
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, op2GPR));
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1)));
+        } else {
+            // This is the case where we convert the result to an int after we're done, and we
+            // already know that the denominator is either -1 or 0. So, if the denominator is
+            // zero, then the result should be zero. If the denominator is not zero (i.e. it's
+            // -1) and the numerator is -2^31 then the result should be -2^31. Otherwise we
+            // are happy to fall through to a normal division, since we're just dividing
+            // something by negative 1.
+        
+            JITCompiler::Jump notZero = m_jit.branchTest32(JITCompiler::NonZero, op2GPR);
+            m_jit.move(TrustedImm32(0), eax.gpr());
+            done.append(m_jit.jump());
+        
+            notZero.link(&m_jit);
+            JITCompiler::Jump notNeg2ToThe31 =
+                m_jit.branch32(JITCompiler::NotEqual, op1GPR, TrustedImm32(-2147483647-1));
+            m_jit.zeroExtend32ToPtr(op1GPR, eax.gpr());
+            done.append(m_jit.jump());
+        
+            notNeg2ToThe31.link(&m_jit);
+        }
+    
+        safeDenominator.link(&m_jit);
+    
+        // If the user cares about negative zero, then speculate that we're not about
+        // to produce negative zero.
+        if (shouldCheckNegativeZero(node->arithMode())) {
+            MacroAssembler::Jump numeratorNonZero = m_jit.branchTest32(MacroAssembler::NonZero, op1GPR);
+            speculationCheck(NegativeZero, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::LessThan, op2GPR, TrustedImm32(0)));
+            numeratorNonZero.link(&m_jit);
+        }
+    
+        if (op2TempGPR != InvalidGPRReg) {
+            m_jit.move(op2GPR, op2TempGPR);
+            op2GPR = op2TempGPR;
+        }
+            
+        m_jit.move(op1GPR, eax.gpr());
+        m_jit.x86ConvertToDoubleWord32();
+        m_jit.x86Div32(op2GPR);
+            
+        if (op2TempGPR != InvalidGPRReg)
+            unlock(op2TempGPR);
+
+        // Check that there was no remainder. If there had been, then we'd be obligated to
+        // produce a double result instead.
+        if (shouldCheckOverflow(node->arithMode()))
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::NonZero, edx.gpr()));
+        
+        done.link(&m_jit);
+        int32Result(eax.gpr(), node);
+#elif HAVE(ARM_IDIV_INSTRUCTIONS) || CPU(ARM64)
+        SpeculateInt32Operand op1(this, node->child1());
+        SpeculateInt32Operand op2(this, node->child2());
+        GPRReg op1GPR = op1.gpr();
+        GPRReg op2GPR = op2.gpr();
+        GPRTemporary quotient(this);
+        GPRTemporary multiplyAnswer(this);
+
+        // If the user cares about negative zero, then speculate that we're not about
+        // to produce negative zero.
+        if (shouldCheckNegativeZero(node->arithMode())) {
+            MacroAssembler::Jump numeratorNonZero = m_jit.branchTest32(MacroAssembler::NonZero, op1GPR);
+            speculationCheck(NegativeZero, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::LessThan, op2GPR, TrustedImm32(0)));
+            numeratorNonZero.link(&m_jit);
+        }
+
+        if (shouldCheckOverflow(node->arithMode()))
+            speculationCheck(Overflow, JSValueRegs(), nullptr, m_jit.branchTest32(MacroAssembler::Zero, op2GPR));
+
+        m_jit.assembler().sdiv<32>(quotient.gpr(), op1GPR, op2GPR);
+
+        // Check that there was no remainder. If there had been, then we'd be obligated to
+        // produce a double result instead.
+        if (shouldCheckOverflow(node->arithMode())) {
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchMul32(JITCompiler::Overflow, quotient.gpr(), op2GPR, multiplyAnswer.gpr()));
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branch32(JITCompiler::NotEqual, multiplyAnswer.gpr(), op1GPR));
+        }
+
+        int32Result(quotient.gpr(), node);
+#else
+        RELEASE_ASSERT_NOT_REACHED();
+#endif
+        break;
+    }
+        
+    case DoubleRepUse: {
+        SpeculateDoubleOperand op1(this, node->child1());
+        SpeculateDoubleOperand op2(this, node->child2());
+        FPRTemporary result(this, op1);
+        
+        FPRReg reg1 = op1.fpr();
+        FPRReg reg2 = op2.fpr();
+        m_jit.divDouble(reg1, reg2, result.fpr());
+        
+        doubleResult(result.fpr(), node);
+        break;
+    }
+
+    case UntypedUse: {
+        Edge& leftChild = node->child1();
+        Edge& rightChild = node->child2();
+
+        if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
+            JSValueOperand left(this, leftChild);
+            JSValueOperand right(this, rightChild);
+            JSValueRegs leftRegs = left.jsValueRegs();
+            JSValueRegs rightRegs = right.jsValueRegs();
+#if USE(JSVALUE64)
+            GPRTemporary result(this);
+            JSValueRegs resultRegs = JSValueRegs(result.gpr());
+#else
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this);
+            JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+#endif
+            flushRegisters();
+            callOperation(operationValueDiv, resultRegs, leftRegs, rightRegs);
+            m_jit.exceptionCheck();
+
+            jsValueResult(resultRegs, node);
+            return;
+        }
+
+        std::optional<JSValueOperand> left;
+        std::optional<JSValueOperand> right;
+
+        JSValueRegs leftRegs;
+        JSValueRegs rightRegs;
+
+        FPRTemporary leftNumber(this);
+        FPRTemporary rightNumber(this);
+        FPRReg leftFPR = leftNumber.fpr();
+        FPRReg rightFPR = rightNumber.fpr();
+        FPRTemporary fprScratch(this);
+        FPRReg scratchFPR = fprScratch.fpr();
+
+#if USE(JSVALUE64)
+        GPRTemporary result(this);
+        JSValueRegs resultRegs = JSValueRegs(result.gpr());
+        GPRTemporary scratch(this);
+        GPRReg scratchGPR = scratch.gpr();
+#else
+        GPRTemporary resultTag(this);
+        GPRTemporary resultPayload(this);
+        JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+        GPRReg scratchGPR = resultTag.gpr();
+#endif
+
+        SnippetOperand leftOperand(m_state.forNode(leftChild).resultType());
+        SnippetOperand rightOperand(m_state.forNode(rightChild).resultType());
+
+        if (leftChild->isInt32Constant())
+            leftOperand.setConstInt32(leftChild->asInt32());
+#if USE(JSVALUE64)
+        else if (leftChild->isDoubleConstant())
+            leftOperand.setConstDouble(leftChild->asNumber());
+#endif
+
+        if (leftOperand.isConst()) {
+            // The snippet generator only supports 1 argument as a constant.
+            // Ignore the rightChild's const-ness.
+        } else if (rightChild->isInt32Constant())
+            rightOperand.setConstInt32(rightChild->asInt32());
+#if USE(JSVALUE64)
+        else if (rightChild->isDoubleConstant())
+            rightOperand.setConstDouble(rightChild->asNumber());
+#endif
+
+        RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
+
+        if (!leftOperand.isConst()) {
+            left.emplace(this, leftChild);
+            leftRegs = left->jsValueRegs();
+        }
+        if (!rightOperand.isConst()) {
+            right.emplace(this, rightChild);
+            rightRegs = right->jsValueRegs();
+        }
+
+        JITDivGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
+            leftFPR, rightFPR, scratchGPR, scratchFPR);
+        gen.generateFastPath(m_jit);
+
+        ASSERT(gen.didEmitFastPath());
+        gen.endJumpList().append(m_jit.jump());
+
+        gen.slowPathJumpList().link(&m_jit);
+        silentSpillAllRegisters(resultRegs);
+
+        if (leftOperand.isConst()) {
+            leftRegs = resultRegs;
+            m_jit.moveValue(leftChild->asJSValue(), leftRegs);
+        }
+        if (rightOperand.isConst()) {
+            rightRegs = resultRegs;
+            m_jit.moveValue(rightChild->asJSValue(), rightRegs);
+        }
+
+        callOperation(operationValueDiv, resultRegs, leftRegs, rightRegs);
+
+        silentFillAllRegisters(resultRegs);
+        m_jit.exceptionCheck();
+
+        gen.endJumpList().link(&m_jit);
+        jsValueResult(resultRegs, node);
+        return;
+    }
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void SpeculativeJIT::compileArithFRound(Node* node)
+{
+    if (node->child1().useKind() == DoubleRepUse) {
+        SpeculateDoubleOperand op1(this, node->child1());
+        FPRTemporary result(this, op1);
+        m_jit.convertDoubleToFloat(op1.fpr(), result.fpr());
+        m_jit.convertFloatToDouble(result.fpr(), result.fpr());
+        doubleResult(result.fpr(), node);
+        return;
+    }
+
+    JSValueOperand op1(this, node->child1());
+    JSValueRegs op1Regs = op1.jsValueRegs();
+    flushRegisters();
+    FPRResult result(this);
+    callOperation(operationArithFRound, result.fpr(), op1Regs);
+    m_jit.exceptionCheck();
+    doubleResult(result.fpr(), node);
+}
+
+void SpeculativeJIT::compileArithMod(Node* node)
+{
+    switch (node->binaryUseKind()) {
+    case Int32Use: {
+        // In the fast path, the dividend value could be the final result
+        // (in case of |dividend| < |divisor|), so we speculate it as strict int32.
+        SpeculateStrictInt32Operand op1(this, node->child1());
+        
+        if (node->child2()->isInt32Constant()) {
+            int32_t divisor = node->child2()->asInt32();
+            if (divisor > 1 && hasOneBitSet(divisor)) {
+                unsigned logarithm = WTF::fastLog2(static_cast<uint32_t>(divisor));
+                GPRReg dividendGPR = op1.gpr();
+                GPRTemporary result(this);
+                GPRReg resultGPR = result.gpr();
+
+                // This is what LLVM generates. It's pretty crazy. Here's my
+                // attempt at understanding it.
+                
+                // First, compute either divisor - 1, or 0, depending on whether
+                // the dividend is negative:
+                //
+                // If dividend < 0:  resultGPR = divisor - 1
+                // If dividend >= 0: resultGPR = 0
+                m_jit.move(dividendGPR, resultGPR);
+                m_jit.rshift32(TrustedImm32(31), resultGPR);
+                m_jit.urshift32(TrustedImm32(32 - logarithm), resultGPR);
+                
+                // Add in the dividend, so that:
+                //
+                // If dividend < 0:  resultGPR = dividend + divisor - 1
+                // If dividend >= 0: resultGPR = dividend
+                m_jit.add32(dividendGPR, resultGPR);
+                
+                // Mask so as to only get the *high* bits. This rounds down
+                // (towards negative infinity) resultGPR to the nearest multiple
+                // of divisor, so that:
+                //
+                // If dividend < 0:  resultGPR = floor((dividend + divisor - 1) / divisor)
+                // If dividend >= 0: resultGPR = floor(dividend / divisor)
+                //
+                // Note that this can be simplified to:
+                //
+                // If dividend < 0:  resultGPR = ceil(dividend / divisor)
+                // If dividend >= 0: resultGPR = floor(dividend / divisor)
+                //
+                // Note that if the dividend is negative, resultGPR will also be negative.
+                // Regardless of the sign of dividend, resultGPR will be rounded towards
+                // zero, because of how things are conditionalized.
+                m_jit.and32(TrustedImm32(-divisor), resultGPR);
+                
+                // Subtract resultGPR from dividendGPR, which yields the remainder:
+                //
+                // resultGPR = dividendGPR - resultGPR
+                m_jit.neg32(resultGPR);
+                m_jit.add32(dividendGPR, resultGPR);
+                
+                if (shouldCheckNegativeZero(node->arithMode())) {
+                    // Check that we're not about to create negative zero.
+                    JITCompiler::Jump numeratorPositive = m_jit.branch32(JITCompiler::GreaterThanOrEqual, dividendGPR, TrustedImm32(0));
+                    speculationCheck(NegativeZero, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, resultGPR));
+                    numeratorPositive.link(&m_jit);
+                }
+
+                int32Result(resultGPR, node);
+                return;
+            }
+        }
+        
+#if CPU(X86) || CPU(X86_64)
+        if (node->child2()->isInt32Constant()) {
+            int32_t divisor = node->child2()->asInt32();
+            if (divisor && divisor != -1) {
+                GPRReg op1Gpr = op1.gpr();
+
+                GPRTemporary eax(this, X86Registers::eax);
+                GPRTemporary edx(this, X86Registers::edx);
+                GPRTemporary scratch(this);
+                GPRReg scratchGPR = scratch.gpr();
+
+                GPRReg op1SaveGPR;
+                if (op1Gpr == X86Registers::eax || op1Gpr == X86Registers::edx) {
+                    op1SaveGPR = allocate();
+                    ASSERT(op1Gpr != op1SaveGPR);
+                    m_jit.move(op1Gpr, op1SaveGPR);
+                } else
+                    op1SaveGPR = op1Gpr;
+                ASSERT(op1SaveGPR != X86Registers::eax);
+                ASSERT(op1SaveGPR != X86Registers::edx);
+
+                m_jit.move(op1Gpr, eax.gpr());
+                m_jit.move(TrustedImm32(divisor), scratchGPR);
+                m_jit.x86ConvertToDoubleWord32();
+                m_jit.x86Div32(scratchGPR);
+                if (shouldCheckNegativeZero(node->arithMode())) {
+                    JITCompiler::Jump numeratorPositive = m_jit.branch32(JITCompiler::GreaterThanOrEqual, op1SaveGPR, TrustedImm32(0));
+                    speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, edx.gpr()));
+                    numeratorPositive.link(&m_jit);
+                }
+            
+                if (op1SaveGPR != op1Gpr)
+                    unlock(op1SaveGPR);
+
+                int32Result(edx.gpr(), node);
+                return;
+            }
+        }
+#endif
+
+        SpeculateInt32Operand op2(this, node->child2());
+#if CPU(X86) || CPU(X86_64)
+        GPRTemporary eax(this, X86Registers::eax);
+        GPRTemporary edx(this, X86Registers::edx);
+        GPRReg op1GPR = op1.gpr();
+        GPRReg op2GPR = op2.gpr();
+    
+        GPRReg op2TempGPR;
+        GPRReg temp;
+        GPRReg op1SaveGPR;
+    
+        if (op2GPR == X86Registers::eax || op2GPR == X86Registers::edx) {
+            op2TempGPR = allocate();
+            temp = op2TempGPR;
+        } else {
+            op2TempGPR = InvalidGPRReg;
+            if (op1GPR == X86Registers::eax)
+                temp = X86Registers::edx;
+            else
+                temp = X86Registers::eax;
+        }
+    
+        if (op1GPR == X86Registers::eax || op1GPR == X86Registers::edx) {
+            op1SaveGPR = allocate();
+            ASSERT(op1GPR != op1SaveGPR);
+            m_jit.move(op1GPR, op1SaveGPR);
+        } else
+            op1SaveGPR = op1GPR;
+    
+        ASSERT(temp != op1GPR);
+        ASSERT(temp != op2GPR);
+        ASSERT(op1SaveGPR != X86Registers::eax);
+        ASSERT(op1SaveGPR != X86Registers::edx);
+    
+        m_jit.add32(JITCompiler::TrustedImm32(1), op2GPR, temp);
+    
+        JITCompiler::Jump safeDenominator = m_jit.branch32(JITCompiler::Above, temp, JITCompiler::TrustedImm32(1));
+    
+        JITCompiler::JumpList done;
+        
+        // FIXME: -2^31 / -1 will actually yield negative zero, so we could have a
+        // separate case for that. But it probably doesn't matter so much.
+        if (shouldCheckOverflow(node->arithMode())) {
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, op2GPR));
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branch32(JITCompiler::Equal, op1GPR, TrustedImm32(-2147483647-1)));
+        } else {
+            // This is the case where we convert the result to an int after we're done, and we
+            // already know that the denominator is either -1 or 0. So, if the denominator is
+            // zero, then the result should be zero. If the denominator is not zero (i.e. it's
+            // -1) and the numerator is -2^31 then the result should be 0. Otherwise we are
+            // happy to fall through to a normal division, since we're just dividing something
+            // by negative 1.
+        
+            JITCompiler::Jump notZero = m_jit.branchTest32(JITCompiler::NonZero, op2GPR);
+            m_jit.move(TrustedImm32(0), edx.gpr());
+            done.append(m_jit.jump());
+        
+            notZero.link(&m_jit);
+            JITCompiler::Jump notNeg2ToThe31 =
+                m_jit.branch32(JITCompiler::NotEqual, op1GPR, TrustedImm32(-2147483647-1));
+            m_jit.move(TrustedImm32(0), edx.gpr());
+            done.append(m_jit.jump());
+        
+            notNeg2ToThe31.link(&m_jit);
+        }
+        
+        safeDenominator.link(&m_jit);
+            
+        if (op2TempGPR != InvalidGPRReg) {
+            m_jit.move(op2GPR, op2TempGPR);
+            op2GPR = op2TempGPR;
+        }
+            
+        m_jit.move(op1GPR, eax.gpr());
+        m_jit.x86ConvertToDoubleWord32();
+        m_jit.x86Div32(op2GPR);
+            
+        if (op2TempGPR != InvalidGPRReg)
+            unlock(op2TempGPR);
+
+        // Check that we're not about to create negative zero.
+        if (shouldCheckNegativeZero(node->arithMode())) {
+            JITCompiler::Jump numeratorPositive = m_jit.branch32(JITCompiler::GreaterThanOrEqual, op1SaveGPR, TrustedImm32(0));
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, edx.gpr()));
+            numeratorPositive.link(&m_jit);
+        }
+    
+        if (op1SaveGPR != op1GPR)
+            unlock(op1SaveGPR);
+            
+        done.link(&m_jit);
+        int32Result(edx.gpr(), node);
+
+#elif HAVE(ARM_IDIV_INSTRUCTIONS) || CPU(ARM64)
+        GPRTemporary temp(this);
+        GPRTemporary quotientThenRemainder(this);
+        GPRTemporary multiplyAnswer(this);
+        GPRReg dividendGPR = op1.gpr();
+        GPRReg divisorGPR = op2.gpr();
+        GPRReg quotientThenRemainderGPR = quotientThenRemainder.gpr();
+        GPRReg multiplyAnswerGPR = multiplyAnswer.gpr();
+
+        JITCompiler::JumpList done;
+    
+        if (shouldCheckOverflow(node->arithMode()))
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, divisorGPR));
+        else {
+            JITCompiler::Jump denominatorNotZero = m_jit.branchTest32(JITCompiler::NonZero, divisorGPR);
+            m_jit.move(divisorGPR, quotientThenRemainderGPR);
+            done.append(m_jit.jump());
+            denominatorNotZero.link(&m_jit);
+        }
+
+        m_jit.assembler().sdiv<32>(quotientThenRemainderGPR, dividendGPR, divisorGPR);
+        // FIXME: It seems like there are cases where we don't need this? What if we have
+        // arithMode() == Arith::Unchecked?
+        // https://bugs.webkit.org/show_bug.cgi?id=126444
+        speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchMul32(JITCompiler::Overflow, quotientThenRemainderGPR, divisorGPR, multiplyAnswerGPR));
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+        m_jit.assembler().sub(quotientThenRemainderGPR, dividendGPR, multiplyAnswerGPR);
+#else
+        m_jit.assembler().sub<32>(quotientThenRemainderGPR, dividendGPR, multiplyAnswerGPR);
+#endif
+
+        // If the user cares about negative zero, then speculate that we're not about
+        // to produce negative zero.
+        if (shouldCheckNegativeZero(node->arithMode())) {
+            // Check that we're not about to create negative zero.
+            JITCompiler::Jump numeratorPositive = m_jit.branch32(JITCompiler::GreaterThanOrEqual, dividendGPR, TrustedImm32(0));
+            speculationCheck(Overflow, JSValueRegs(), 0, m_jit.branchTest32(JITCompiler::Zero, quotientThenRemainderGPR));
+            numeratorPositive.link(&m_jit);
+        }
+
+        done.link(&m_jit);
+
+        int32Result(quotientThenRemainderGPR, node);
+#else // not architecture that can do integer division
+        RELEASE_ASSERT_NOT_REACHED();
+#endif
+        return;
+    }
+        
+    case DoubleRepUse: {
+        SpeculateDoubleOperand op1(this, node->child1());
+        SpeculateDoubleOperand op2(this, node->child2());
+        
+        FPRReg op1FPR = op1.fpr();
+        FPRReg op2FPR = op2.fpr();
+        
+        flushRegisters();
+        
+        FPRResult result(this);
+        
+        callOperation(jsMod, result.fpr(), op1FPR, op2FPR);
+        
+        doubleResult(result.fpr(), node);
+        return;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+}
+
+void SpeculativeJIT::compileArithRounding(Node* node)
+{
+    if (node->child1().useKind() == DoubleRepUse) {
+        SpeculateDoubleOperand value(this, node->child1());
+        FPRReg valueFPR = value.fpr();
+
+        auto setResult = [&] (FPRReg resultFPR) {
+            if (producesInteger(node->arithRoundingMode())) {
+                GPRTemporary roundedResultAsInt32(this);
+                FPRTemporary scratch(this);
+                FPRReg scratchFPR = scratch.fpr();
+                GPRReg resultGPR = roundedResultAsInt32.gpr();
+                JITCompiler::JumpList failureCases;
+                m_jit.branchConvertDoubleToInt32(resultFPR, resultGPR, failureCases, scratchFPR, shouldCheckNegativeZero(node->arithRoundingMode()));
+                speculationCheck(Overflow, JSValueRegs(), node, failureCases);
+
+                int32Result(resultGPR, node);
+            } else
+                doubleResult(resultFPR, node);
+        };
+
+        if (m_jit.supportsFloatingPointRounding()) {
+            switch (node->op()) {
+            case ArithRound: {
+                FPRTemporary result(this);
+                FPRReg resultFPR = result.fpr();
+                if (producesInteger(node->arithRoundingMode()) && !shouldCheckNegativeZero(node->arithRoundingMode())) {
+                    static const double halfConstant = 0.5;
+                    m_jit.loadDouble(TrustedImmPtr(&halfConstant), resultFPR);
+                    m_jit.addDouble(valueFPR, resultFPR);
+                    m_jit.floorDouble(resultFPR, resultFPR);
+                } else {
+                    m_jit.ceilDouble(valueFPR, resultFPR);
+                    FPRTemporary realPart(this);
+                    FPRReg realPartFPR = realPart.fpr();
+                    m_jit.subDouble(resultFPR, valueFPR, realPartFPR);
+
+                    FPRTemporary scratch(this);
+                    FPRReg scratchFPR = scratch.fpr();
+                    static const double halfConstant = 0.5;
+                    m_jit.loadDouble(TrustedImmPtr(&halfConstant), scratchFPR);
+
+                    JITCompiler::Jump shouldUseCeiled = m_jit.branchDouble(JITCompiler::DoubleLessThanOrEqual, realPartFPR, scratchFPR);
+                    static const double oneConstant = -1.0;
+                    m_jit.loadDouble(TrustedImmPtr(&oneConstant), scratchFPR);
+                    m_jit.addDouble(scratchFPR, resultFPR);
+                    shouldUseCeiled.link(&m_jit);
+                }
+                setResult(resultFPR);
+                return;
+            }
+
+            case ArithFloor: {
+                FPRTemporary rounded(this);
+                FPRReg resultFPR = rounded.fpr();
+                m_jit.floorDouble(valueFPR, resultFPR);
+                setResult(resultFPR);
+                return;
+            }
+
+            case ArithCeil: {
+                FPRTemporary rounded(this);
+                FPRReg resultFPR = rounded.fpr();
+                m_jit.ceilDouble(valueFPR, resultFPR);
+                setResult(resultFPR);
+                return;
+            }
+
+            case ArithTrunc: {
+                FPRTemporary rounded(this);
+                FPRReg resultFPR = rounded.fpr();
+                m_jit.roundTowardZeroDouble(valueFPR, resultFPR);
+                setResult(resultFPR);
+                return;
+            }
+
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        } else {
+            flushRegisters();
+            FPRResult roundedResultAsDouble(this);
+            FPRReg resultFPR = roundedResultAsDouble.fpr();
+            if (node->op() == ArithRound)
+                callOperation(jsRound, resultFPR, valueFPR);
+            else if (node->op() == ArithFloor)
+                callOperation(floor, resultFPR, valueFPR);
+            else if (node->op() == ArithCeil)
+                callOperation(ceil, resultFPR, valueFPR);
+            else {
+                ASSERT(node->op() == ArithTrunc);
+                callOperation(trunc, resultFPR, valueFPR);
+            }
+            setResult(resultFPR);
+        }
+        return;
+    }
+
+    DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse);
+
+    JSValueOperand argument(this, node->child1());
+    JSValueRegs argumentRegs = argument.jsValueRegs();
+#if USE(JSVALUE64)
+    GPRTemporary result(this);
+    JSValueRegs resultRegs = JSValueRegs(result.gpr());
+#else
+    GPRTemporary resultTag(this);
+    GPRTemporary resultPayload(this);
+    JSValueRegs resultRegs = JSValueRegs(resultPayload.gpr(), resultTag.gpr());
+#endif
+    flushRegisters();
+    J_JITOperation_EJ operation = nullptr;
+    if (node->op() == ArithRound)
+        operation = operationArithRound;
+    else if (node->op() == ArithFloor)
+        operation = operationArithFloor;
+    else if (node->op() == ArithCeil)
+        operation = operationArithCeil;
+    else {
+        ASSERT(node->op() == ArithTrunc);
+        operation = operationArithTrunc;
+    }
+    callOperation(operation, resultRegs, argumentRegs);
+    m_jit.exceptionCheck();
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compileArithSin(Node* node)
+{
+    compileArithDoubleUnaryOp(node, sin, operationArithSin);
+}
+
+void SpeculativeJIT::compileArithSqrt(Node* node)
+{
+    if (node->child1().useKind() == DoubleRepUse) {
+        SpeculateDoubleOperand op1(this, node->child1());
+        FPRReg op1FPR = op1.fpr();
+
+        if (!MacroAssembler::supportsFloatingPointSqrt() || !Options::useArchitectureSpecificOptimizations()) {
+            flushRegisters();
+            FPRResult result(this);
+            callOperation(sqrt, result.fpr(), op1FPR);
+            doubleResult(result.fpr(), node);
+        } else {
+            FPRTemporary result(this, op1);
+            m_jit.sqrtDouble(op1.fpr(), result.fpr());
+            doubleResult(result.fpr(), node);
+        }
+        return;
+    }
+
+    JSValueOperand op1(this, node->child1());
+    JSValueRegs op1Regs = op1.jsValueRegs();
+    flushRegisters();
+    FPRResult result(this);
+    callOperation(operationArithSqrt, result.fpr(), op1Regs);
+    m_jit.exceptionCheck();
+    doubleResult(result.fpr(), node);
+}
+
+// For small positive integers , it is worth doing a tiny inline loop to exponentiate the base.
+// Every register is clobbered by this helper.
+static MacroAssembler::Jump compileArithPowIntegerFastPath(JITCompiler& assembler, FPRReg xOperand, GPRReg yOperand, FPRReg result)
+{
+    MacroAssembler::JumpList skipFastPath;
+    skipFastPath.append(assembler.branch32(MacroAssembler::Above, yOperand, MacroAssembler::TrustedImm32(maxExponentForIntegerMathPow)));
+
+    static const double oneConstant = 1.0;
+    assembler.loadDouble(MacroAssembler::TrustedImmPtr(&oneConstant), result);
+
+    MacroAssembler::Label startLoop(assembler.label());
+    MacroAssembler::Jump exponentIsEven = assembler.branchTest32(MacroAssembler::Zero, yOperand, MacroAssembler::TrustedImm32(1));
+    assembler.mulDouble(xOperand, result);
+    exponentIsEven.link(&assembler);
+    assembler.mulDouble(xOperand, xOperand);
+    assembler.rshift32(MacroAssembler::TrustedImm32(1), yOperand);
+    assembler.branchTest32(MacroAssembler::NonZero, yOperand).linkTo(startLoop, &assembler);
+
+    MacroAssembler::Jump skipSlowPath = assembler.jump();
+    skipFastPath.link(&assembler);
+
+    return skipSlowPath;
+}
+
+void SpeculativeJIT::compileArithPow(Node* node)
+{
+    if (node->child2().useKind() == Int32Use) {
+        SpeculateDoubleOperand xOperand(this, node->child1());
+        SpeculateInt32Operand yOperand(this, node->child2());
+        FPRReg xOperandfpr = xOperand.fpr();
+        GPRReg yOperandGpr = yOperand.gpr();
+        FPRTemporary yOperandfpr(this);
+
+        flushRegisters();
+
+        FPRResult result(this);
+        FPRReg resultFpr = result.fpr();
+
+        FPRTemporary xOperandCopy(this);
+        FPRReg xOperandCopyFpr = xOperandCopy.fpr();
+        m_jit.moveDouble(xOperandfpr, xOperandCopyFpr);
+
+        GPRTemporary counter(this);
+        GPRReg counterGpr = counter.gpr();
+        m_jit.move(yOperandGpr, counterGpr);
+
+        MacroAssembler::Jump skipFallback = compileArithPowIntegerFastPath(m_jit, xOperandCopyFpr, counterGpr, resultFpr);
+        m_jit.convertInt32ToDouble(yOperandGpr, yOperandfpr.fpr());
+        callOperation(operationMathPow, resultFpr, xOperandfpr, yOperandfpr.fpr());
+
+        skipFallback.link(&m_jit);
+        doubleResult(resultFpr, node);
+        return;
+    }
+
+    if (node->child2()->isDoubleConstant()) {
+        double exponent = node->child2()->asNumber();
+        static const double infinityConstant = std::numeric_limits<double>::infinity();
+        static const double minusInfinityConstant = -std::numeric_limits<double>::infinity();
+        if (exponent == 0.5) {
+            SpeculateDoubleOperand xOperand(this, node->child1());
+            FPRTemporary result(this);
+            FPRReg xOperandFpr = xOperand.fpr();
+            FPRReg resultFpr = result.fpr();
+
+            m_jit.moveZeroToDouble(resultFpr);
+            MacroAssembler::Jump xIsZeroOrNegativeZero = m_jit.branchDouble(MacroAssembler::DoubleEqual, xOperandFpr, resultFpr);
+
+            m_jit.loadDouble(TrustedImmPtr(&minusInfinityConstant), resultFpr);
+            MacroAssembler::Jump xIsMinusInfinity = m_jit.branchDouble(MacroAssembler::DoubleEqual, xOperandFpr, resultFpr);
+            m_jit.sqrtDouble(xOperandFpr, resultFpr);
+            MacroAssembler::Jump doneWithSqrt = m_jit.jump();
+
+            xIsMinusInfinity.link(&m_jit);
+            if (isX86())
+                m_jit.loadDouble(TrustedImmPtr(&infinityConstant), resultFpr);
+            else
+                m_jit.absDouble(resultFpr, resultFpr);
+
+            xIsZeroOrNegativeZero.link(&m_jit);
+            doneWithSqrt.link(&m_jit);
+            doubleResult(resultFpr, node);
+            return;
+        }
+        if (exponent == -0.5) {
+            SpeculateDoubleOperand xOperand(this, node->child1());
+            FPRTemporary scratch(this);
+            FPRTemporary result(this);
+            FPRReg xOperandFpr = xOperand.fpr();
+            FPRReg scratchFPR = scratch.fpr();
+            FPRReg resultFpr = result.fpr();
+
+            m_jit.moveZeroToDouble(resultFpr);
+            MacroAssembler::Jump xIsZeroOrNegativeZero = m_jit.branchDouble(MacroAssembler::DoubleEqual, xOperandFpr, resultFpr);
+
+            m_jit.loadDouble(TrustedImmPtr(&minusInfinityConstant), resultFpr);
+            MacroAssembler::Jump xIsMinusInfinity = m_jit.branchDouble(MacroAssembler::DoubleEqual, xOperandFpr, resultFpr);
+
+            static const double oneConstant = 1.;
+            m_jit.loadDouble(TrustedImmPtr(&oneConstant), resultFpr);
+            m_jit.sqrtDouble(xOperandFpr, scratchFPR);
+            m_jit.divDouble(resultFpr, scratchFPR, resultFpr);
+            MacroAssembler::Jump doneWithSqrt = m_jit.jump();
+
+            xIsZeroOrNegativeZero.link(&m_jit);
+            m_jit.loadDouble(TrustedImmPtr(&infinityConstant), resultFpr);
+            MacroAssembler::Jump doneWithBaseZero = m_jit.jump();
+
+            xIsMinusInfinity.link(&m_jit);
+            m_jit.moveZeroToDouble(resultFpr);
+
+            doneWithBaseZero.link(&m_jit);
+            doneWithSqrt.link(&m_jit);
+            doubleResult(resultFpr, node);
+            return;
+        }
+    }
+
+    SpeculateDoubleOperand xOperand(this, node->child1());
+    SpeculateDoubleOperand yOperand(this, node->child2());
+    FPRReg xOperandfpr = xOperand.fpr();
+    FPRReg yOperandfpr = yOperand.fpr();
+
+    flushRegisters();
+
+    FPRResult result(this);
+    FPRReg resultFpr = result.fpr();
+
+    FPRTemporary xOperandCopy(this);
+    FPRReg xOperandCopyFpr = xOperandCopy.fpr();
+
+    FPRTemporary scratch(this);
+    FPRReg scratchFpr = scratch.fpr();
+
+    GPRTemporary yOperandInteger(this);
+    GPRReg yOperandIntegerGpr = yOperandInteger.gpr();
+    MacroAssembler::JumpList failedExponentConversionToInteger;
+    m_jit.branchConvertDoubleToInt32(yOperandfpr, yOperandIntegerGpr, failedExponentConversionToInteger, scratchFpr, false);
+
+    m_jit.moveDouble(xOperandfpr, xOperandCopyFpr);
+    MacroAssembler::Jump skipFallback = compileArithPowIntegerFastPath(m_jit, xOperandCopyFpr, yOperandInteger.gpr(), resultFpr);
+    failedExponentConversionToInteger.link(&m_jit);
+
+    callOperation(operationMathPow, resultFpr, xOperandfpr, yOperandfpr);
+    skipFallback.link(&m_jit);
+    doubleResult(resultFpr, node);
+}
+
+void SpeculativeJIT::compileArithLog(Node* node)
+{
+    compileArithDoubleUnaryOp(node, log, operationArithLog);
+}
+
+// Returns true if the compare is fused with a subsequent branch.
+bool SpeculativeJIT::compare(Node* node, MacroAssembler::RelationalCondition condition, MacroAssembler::DoubleCondition doubleCondition, S_JITOperation_EJJ operation)
+{
+    if (compilePeepHoleBranch(node, condition, doubleCondition, operation))
+        return true;
+
+    if (node->isBinaryUseKind(Int32Use)) {
+        compileInt32Compare(node, condition);
+        return false;
+    }
+    
+#if USE(JSVALUE64)
+    if (node->isBinaryUseKind(Int52RepUse)) {
+        compileInt52Compare(node, condition);
+        return false;
+    }
+#endif // USE(JSVALUE64)
+    
+    if (node->isBinaryUseKind(DoubleRepUse)) {
+        compileDoubleCompare(node, doubleCondition);
+        return false;
+    }
+
+    if (node->isBinaryUseKind(StringUse)) {
+        if (node->op() == CompareEq)
+            compileStringEquality(node);
+        else
+            compileStringCompare(node, condition);
+        return false;
+    }
+
+    if (node->isBinaryUseKind(StringIdentUse)) {
+        if (node->op() == CompareEq)
+            compileStringIdentEquality(node);
+        else
+            compileStringIdentCompare(node, condition);
+        return false;
+    }
+
+    if (node->op() == CompareEq) {
+        if (node->isBinaryUseKind(BooleanUse)) {
+            compileBooleanCompare(node, condition);
+            return false;
+        }
+
+        if (node->isBinaryUseKind(SymbolUse)) {
+            compileSymbolEquality(node);
+            return false;
+        }
+        
+        if (node->isBinaryUseKind(ObjectUse)) {
+            compileObjectEquality(node);
+            return false;
+        }
+        
+        if (node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse)) {
+            compileObjectToObjectOrOtherEquality(node->child1(), node->child2());
+            return false;
+        }
+        
+        if (node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse)) {
+            compileObjectToObjectOrOtherEquality(node->child2(), node->child1());
+            return false;
+        }
+
+        if (!needsTypeCheck(node->child1(), SpecOther)) {
+            nonSpeculativeNonPeepholeCompareNullOrUndefined(node->child2());
+            return false;
+        }
+
+        if (!needsTypeCheck(node->child2(), SpecOther)) {
+            nonSpeculativeNonPeepholeCompareNullOrUndefined(node->child1());
+            return false;
+        }
+    }
+
+    nonSpeculativeNonPeepholeCompare(node, condition, operation);
+    return false;
+}
+
+bool SpeculativeJIT::compileStrictEq(Node* node)
+{
+    // FIXME: Currently, we have op_jless, op_jgreater etc. But we don't have op_jeq, op_jstricteq etc.
+    // `==` and `===` operations with branching will be compiled to op_{eq,stricteq} and op_{jfalse,jtrue}.
+    // In DFG bytecodes, between op_eq and op_jfalse, we have MovHint to store the result of op_eq.
+    // As a result, detectPeepHoleBranch() never detects peep hole for that case.
+    // https://bugs.webkit.org/show_bug.cgi?id=149713
+
+    if (node->isBinaryUseKind(BooleanUse)) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            Node* branchNode = m_block->at(branchIndexInBlock);
+            compilePeepHoleBooleanBranch(node, branchNode, MacroAssembler::Equal);
+            use(node->child1());
+            use(node->child2());
+            m_indexInBlock = branchIndexInBlock;
+            m_currentNode = branchNode;
+            return true;
+        }
+        compileBooleanCompare(node, MacroAssembler::Equal);
+        return false;
+    }
+
+    if (node->isBinaryUseKind(Int32Use)) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            Node* branchNode = m_block->at(branchIndexInBlock);
+            compilePeepHoleInt32Branch(node, branchNode, MacroAssembler::Equal);
+            use(node->child1());
+            use(node->child2());
+            m_indexInBlock = branchIndexInBlock;
+            m_currentNode = branchNode;
+            return true;
+        }
+        compileInt32Compare(node, MacroAssembler::Equal);
+        return false;
+    }
+    
+#if USE(JSVALUE64)   
+    if (node->isBinaryUseKind(Int52RepUse)) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            Node* branchNode = m_block->at(branchIndexInBlock);
+            compilePeepHoleInt52Branch(node, branchNode, MacroAssembler::Equal);
+            use(node->child1());
+            use(node->child2());
+            m_indexInBlock = branchIndexInBlock;
+            m_currentNode = branchNode;
+            return true;
+        }
+        compileInt52Compare(node, MacroAssembler::Equal);
+        return false;
+    }
+#endif // USE(JSVALUE64)
+
+    if (node->isBinaryUseKind(DoubleRepUse)) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            Node* branchNode = m_block->at(branchIndexInBlock);
+            compilePeepHoleDoubleBranch(node, branchNode, MacroAssembler::DoubleEqual);
+            use(node->child1());
+            use(node->child2());
+            m_indexInBlock = branchIndexInBlock;
+            m_currentNode = branchNode;
+            return true;
+        }
+        compileDoubleCompare(node, MacroAssembler::DoubleEqual);
+        return false;
+    }
+
+    if (node->isBinaryUseKind(SymbolUse)) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            Node* branchNode = m_block->at(branchIndexInBlock);
+            compilePeepHoleSymbolEquality(node, branchNode);
+            use(node->child1());
+            use(node->child2());
+            m_indexInBlock = branchIndexInBlock;
+            m_currentNode = branchNode;
+            return true;
+        }
+        compileSymbolEquality(node);
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(SymbolUse, UntypedUse)) {
+        compileSymbolUntypedEquality(node, node->child1(), node->child2());
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(UntypedUse, SymbolUse)) {
+        compileSymbolUntypedEquality(node, node->child2(), node->child1());
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(StringUse)) {
+        compileStringEquality(node);
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(StringIdentUse)) {
+        compileStringIdentEquality(node);
+        return false;
+    }
+
+    if (node->isBinaryUseKind(ObjectUse, UntypedUse)) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            Node* branchNode = m_block->at(branchIndexInBlock);
+            compilePeepHoleObjectStrictEquality(node->child1(), node->child2(), branchNode);
+            use(node->child1());
+            use(node->child2());
+            m_indexInBlock = branchIndexInBlock;
+            m_currentNode = branchNode;
+            return true;
+        }
+        compileObjectStrictEquality(node->child1(), node->child2());
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(UntypedUse, ObjectUse)) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            Node* branchNode = m_block->at(branchIndexInBlock);
+            compilePeepHoleObjectStrictEquality(node->child2(), node->child1(), branchNode);
+            use(node->child1());
+            use(node->child2());
+            m_indexInBlock = branchIndexInBlock;
+            m_currentNode = branchNode;
+            return true;
+        }
+        compileObjectStrictEquality(node->child2(), node->child1());
+        return false;
+    }
+
+    if (node->isBinaryUseKind(ObjectUse)) {
+        unsigned branchIndexInBlock = detectPeepHoleBranch();
+        if (branchIndexInBlock != UINT_MAX) {
+            Node* branchNode = m_block->at(branchIndexInBlock);
+            compilePeepHoleObjectEquality(node, branchNode);
+            use(node->child1());
+            use(node->child2());
+            m_indexInBlock = branchIndexInBlock;
+            m_currentNode = branchNode;
+            return true;
+        }
+        compileObjectEquality(node);
+        return false;
+    }
+
+    if (node->isBinaryUseKind(MiscUse, UntypedUse)
+        || node->isBinaryUseKind(UntypedUse, MiscUse)) {
+        compileMiscStrictEq(node);
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(StringIdentUse, NotStringVarUse)) {
+        compileStringIdentToNotStringVarEquality(node, node->child1(), node->child2());
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(NotStringVarUse, StringIdentUse)) {
+        compileStringIdentToNotStringVarEquality(node, node->child2(), node->child1());
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(StringUse, UntypedUse)) {
+        compileStringToUntypedEquality(node, node->child1(), node->child2());
+        return false;
+    }
+    
+    if (node->isBinaryUseKind(UntypedUse, StringUse)) {
+        compileStringToUntypedEquality(node, node->child2(), node->child1());
+        return false;
+    }
+    
+    RELEASE_ASSERT(node->isBinaryUseKind(UntypedUse));
+    return nonSpeculativeStrictEq(node);
+}
+
+void SpeculativeJIT::compileBooleanCompare(Node* node, MacroAssembler::RelationalCondition condition)
+{
+    SpeculateBooleanOperand op1(this, node->child1());
+    SpeculateBooleanOperand op2(this, node->child2());
+    GPRTemporary result(this);
+    
+    m_jit.compare32(condition, op1.gpr(), op2.gpr(), result.gpr());
+    
+    unblessedBooleanResult(result.gpr(), node);
+}
+
+void SpeculativeJIT::compileSymbolEquality(Node* node)
+{
+    SpeculateCellOperand left(this, node->child1());
+    SpeculateCellOperand right(this, node->child2());
+    GPRTemporary result(this, Reuse, left, right);
+
+    GPRReg leftGPR = left.gpr();
+    GPRReg rightGPR = right.gpr();
+    GPRReg resultGPR = result.gpr();
+
+    speculateSymbol(node->child1(), leftGPR);
+    speculateSymbol(node->child2(), rightGPR);
+
+    m_jit.comparePtr(JITCompiler::Equal, leftGPR, rightGPR, resultGPR);
+    unblessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compilePeepHoleSymbolEquality(Node* node, Node* branchNode)
+{
+    SpeculateCellOperand left(this, node->child1());
+    SpeculateCellOperand right(this, node->child2());
+
+    GPRReg leftGPR = left.gpr();
+    GPRReg rightGPR = right.gpr();
+
+    speculateSymbol(node->child1(), leftGPR);
+    speculateSymbol(node->child2(), rightGPR);
+
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    if (taken == nextBlock()) {
+        branchPtr(JITCompiler::NotEqual, leftGPR, rightGPR, notTaken);
+        jump(taken);
+    } else {
+        branchPtr(JITCompiler::Equal, leftGPR, rightGPR, taken);
+        jump(notTaken);
+    }
+}
+
+void SpeculativeJIT::compileStringEquality(
+    Node* node, GPRReg leftGPR, GPRReg rightGPR, GPRReg lengthGPR, GPRReg leftTempGPR,
+    GPRReg rightTempGPR, GPRReg leftTemp2GPR, GPRReg rightTemp2GPR,
+    JITCompiler::JumpList fastTrue, JITCompiler::JumpList fastFalse)
+{
+    JITCompiler::JumpList trueCase;
+    JITCompiler::JumpList falseCase;
+    JITCompiler::JumpList slowCase;
+    
+    trueCase.append(fastTrue);
+    falseCase.append(fastFalse);
+
+    m_jit.load32(MacroAssembler::Address(leftGPR, JSString::offsetOfLength()), lengthGPR);
+    
+    falseCase.append(m_jit.branch32(
+        MacroAssembler::NotEqual,
+        MacroAssembler::Address(rightGPR, JSString::offsetOfLength()),
+        lengthGPR));
+    
+    trueCase.append(m_jit.branchTest32(MacroAssembler::Zero, lengthGPR));
+    
+    m_jit.loadPtr(MacroAssembler::Address(leftGPR, JSString::offsetOfValue()), leftTempGPR);
+    m_jit.loadPtr(MacroAssembler::Address(rightGPR, JSString::offsetOfValue()), rightTempGPR);
+    
+    slowCase.append(m_jit.branchTestPtr(MacroAssembler::Zero, leftTempGPR));
+    slowCase.append(m_jit.branchTestPtr(MacroAssembler::Zero, rightTempGPR));
+    
+    slowCase.append(m_jit.branchTest32(
+        MacroAssembler::Zero,
+        MacroAssembler::Address(leftTempGPR, StringImpl::flagsOffset()),
+        TrustedImm32(StringImpl::flagIs8Bit())));
+    slowCase.append(m_jit.branchTest32(
+        MacroAssembler::Zero,
+        MacroAssembler::Address(rightTempGPR, StringImpl::flagsOffset()),
+        TrustedImm32(StringImpl::flagIs8Bit())));
+    
+    m_jit.loadPtr(MacroAssembler::Address(leftTempGPR, StringImpl::dataOffset()), leftTempGPR);
+    m_jit.loadPtr(MacroAssembler::Address(rightTempGPR, StringImpl::dataOffset()), rightTempGPR);
+    
+    MacroAssembler::Label loop = m_jit.label();
+    
+    m_jit.sub32(TrustedImm32(1), lengthGPR);
+
+    // This isn't going to generate the best code on x86. But that's OK, it's still better
+    // than not inlining.
+    m_jit.load8(MacroAssembler::BaseIndex(leftTempGPR, lengthGPR, MacroAssembler::TimesOne), leftTemp2GPR);
+    m_jit.load8(MacroAssembler::BaseIndex(rightTempGPR, lengthGPR, MacroAssembler::TimesOne), rightTemp2GPR);
+    falseCase.append(m_jit.branch32(MacroAssembler::NotEqual, leftTemp2GPR, rightTemp2GPR));
+    
+    m_jit.branchTest32(MacroAssembler::NonZero, lengthGPR).linkTo(loop, &m_jit);
+    
+    trueCase.link(&m_jit);
+    moveTrueTo(leftTempGPR);
+    
+    JITCompiler::Jump done = m_jit.jump();
+
+    falseCase.link(&m_jit);
+    moveFalseTo(leftTempGPR);
+    
+    done.link(&m_jit);
+    addSlowPathGenerator(
+        slowPathCall(
+            slowCase, this, operationCompareStringEq, leftTempGPR, leftGPR, rightGPR));
+    
+    blessedBooleanResult(leftTempGPR, node);
+}
+
+void SpeculativeJIT::compileStringEquality(Node* node)
+{
+    SpeculateCellOperand left(this, node->child1());
+    SpeculateCellOperand right(this, node->child2());
+    GPRTemporary length(this);
+    GPRTemporary leftTemp(this);
+    GPRTemporary rightTemp(this);
+    GPRTemporary leftTemp2(this, Reuse, left);
+    GPRTemporary rightTemp2(this, Reuse, right);
+    
+    GPRReg leftGPR = left.gpr();
+    GPRReg rightGPR = right.gpr();
+    GPRReg lengthGPR = length.gpr();
+    GPRReg leftTempGPR = leftTemp.gpr();
+    GPRReg rightTempGPR = rightTemp.gpr();
+    GPRReg leftTemp2GPR = leftTemp2.gpr();
+    GPRReg rightTemp2GPR = rightTemp2.gpr();
+    
+    speculateString(node->child1(), leftGPR);
+    
+    // It's safe to branch around the type check below, since proving that the values are
+    // equal does indeed prove that the right value is a string.
+    JITCompiler::Jump fastTrue = m_jit.branchPtr(MacroAssembler::Equal, leftGPR, rightGPR);
+    
+    speculateString(node->child2(), rightGPR);
+    
+    compileStringEquality(
+        node, leftGPR, rightGPR, lengthGPR, leftTempGPR, rightTempGPR, leftTemp2GPR,
+        rightTemp2GPR, fastTrue, JITCompiler::Jump());
+}
+
+void SpeculativeJIT::compileStringToUntypedEquality(Node* node, Edge stringEdge, Edge untypedEdge)
+{
+    SpeculateCellOperand left(this, stringEdge);
+    JSValueOperand right(this, untypedEdge, ManualOperandSpeculation);
+    GPRTemporary length(this);
+    GPRTemporary leftTemp(this);
+    GPRTemporary rightTemp(this);
+    GPRTemporary leftTemp2(this, Reuse, left);
+    GPRTemporary rightTemp2(this);
+    
+    GPRReg leftGPR = left.gpr();
+    JSValueRegs rightRegs = right.jsValueRegs();
+    GPRReg lengthGPR = length.gpr();
+    GPRReg leftTempGPR = leftTemp.gpr();
+    GPRReg rightTempGPR = rightTemp.gpr();
+    GPRReg leftTemp2GPR = leftTemp2.gpr();
+    GPRReg rightTemp2GPR = rightTemp2.gpr();
+    
+    speculateString(stringEdge, leftGPR);
+    
+    JITCompiler::JumpList fastTrue;
+    JITCompiler::JumpList fastFalse;
+    
+    fastFalse.append(m_jit.branchIfNotCell(rightRegs));
+    
+    // It's safe to branch around the type check below, since proving that the values are
+    // equal does indeed prove that the right value is a string.
+    fastTrue.append(m_jit.branchPtr(
+        MacroAssembler::Equal, leftGPR, rightRegs.payloadGPR()));
+    
+    fastFalse.append(m_jit.branchIfNotString(rightRegs.payloadGPR()));
+    
+    compileStringEquality(
+        node, leftGPR, rightRegs.payloadGPR(), lengthGPR, leftTempGPR, rightTempGPR, leftTemp2GPR,
+        rightTemp2GPR, fastTrue, fastFalse);
+}
+
+void SpeculativeJIT::compileStringIdentEquality(Node* node)
+{
+    SpeculateCellOperand left(this, node->child1());
+    SpeculateCellOperand right(this, node->child2());
+    GPRTemporary leftTemp(this);
+    GPRTemporary rightTemp(this);
+    
+    GPRReg leftGPR = left.gpr();
+    GPRReg rightGPR = right.gpr();
+    GPRReg leftTempGPR = leftTemp.gpr();
+    GPRReg rightTempGPR = rightTemp.gpr();
+
+    speculateString(node->child1(), leftGPR);
+    speculateString(node->child2(), rightGPR);
+    
+    speculateStringIdentAndLoadStorage(node->child1(), leftGPR, leftTempGPR);
+    speculateStringIdentAndLoadStorage(node->child2(), rightGPR, rightTempGPR);
+    
+    m_jit.comparePtr(MacroAssembler::Equal, leftTempGPR, rightTempGPR, leftTempGPR);
+    
+    unblessedBooleanResult(leftTempGPR, node);
+}
+
+void SpeculativeJIT::compileStringIdentToNotStringVarEquality(
+    Node* node, Edge stringEdge, Edge notStringVarEdge)
+{
+    SpeculateCellOperand left(this, stringEdge);
+    JSValueOperand right(this, notStringVarEdge, ManualOperandSpeculation);
+    GPRTemporary leftTemp(this);
+    GPRTemporary rightTemp(this);
+    GPRReg leftTempGPR = leftTemp.gpr();
+    GPRReg rightTempGPR = rightTemp.gpr();
+    GPRReg leftGPR = left.gpr();
+    JSValueRegs rightRegs = right.jsValueRegs();
+    
+    speculateString(stringEdge, leftGPR);
+    speculateStringIdentAndLoadStorage(stringEdge, leftGPR, leftTempGPR);
+
+    moveFalseTo(rightTempGPR);
+    JITCompiler::JumpList notString;
+    notString.append(m_jit.branchIfNotCell(rightRegs));
+    notString.append(m_jit.branchIfNotString(rightRegs.payloadGPR()));
+    
+    speculateStringIdentAndLoadStorage(notStringVarEdge, rightRegs.payloadGPR(), rightTempGPR);
+    
+    m_jit.comparePtr(MacroAssembler::Equal, leftTempGPR, rightTempGPR, rightTempGPR);
+    notString.link(&m_jit);
+    
+    unblessedBooleanResult(rightTempGPR, node);
+}
+
+void SpeculativeJIT::compileStringCompare(Node* node, MacroAssembler::RelationalCondition condition)
+{
+    SpeculateCellOperand left(this, node->child1());
+    SpeculateCellOperand right(this, node->child2());
+    GPRReg leftGPR = left.gpr();
+    GPRReg rightGPR = right.gpr();
+
+    speculateString(node->child1(), leftGPR);
+    speculateString(node->child2(), rightGPR);
+
+    C_JITOperation_B_EJssJss compareFunction = nullptr;
+    if (condition == MacroAssembler::LessThan)
+        compareFunction = operationCompareStringLess;
+    else if (condition == MacroAssembler::LessThanOrEqual)
+        compareFunction = operationCompareStringLessEq;
+    else if (condition == MacroAssembler::GreaterThan)
+        compareFunction = operationCompareStringGreater;
+    else if (condition == MacroAssembler::GreaterThanOrEqual)
+        compareFunction = operationCompareStringGreaterEq;
+    else
+        RELEASE_ASSERT_NOT_REACHED();
+
+    GPRFlushedCallResult result(this);
+    GPRReg resultGPR = result.gpr();
+
+    flushRegisters();
+    callOperation(compareFunction, resultGPR, leftGPR, rightGPR);
+    m_jit.exceptionCheck();
+
+    unblessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileStringIdentCompare(Node* node, MacroAssembler::RelationalCondition condition)
+{
+    SpeculateCellOperand left(this, node->child1());
+    SpeculateCellOperand right(this, node->child2());
+    GPRFlushedCallResult result(this);
+    GPRTemporary leftTemp(this);
+    GPRTemporary rightTemp(this);
+
+    GPRReg leftGPR = left.gpr();
+    GPRReg rightGPR = right.gpr();
+    GPRReg resultGPR = result.gpr();
+    GPRReg leftTempGPR = leftTemp.gpr();
+    GPRReg rightTempGPR = rightTemp.gpr();
+
+    speculateString(node->child1(), leftGPR);
+    speculateString(node->child2(), rightGPR);
+
+    C_JITOperation_TT compareFunction = nullptr;
+    if (condition == MacroAssembler::LessThan)
+        compareFunction = operationCompareStringImplLess;
+    else if (condition == MacroAssembler::LessThanOrEqual)
+        compareFunction = operationCompareStringImplLessEq;
+    else if (condition == MacroAssembler::GreaterThan)
+        compareFunction = operationCompareStringImplGreater;
+    else if (condition == MacroAssembler::GreaterThanOrEqual)
+        compareFunction = operationCompareStringImplGreaterEq;
+    else
+        RELEASE_ASSERT_NOT_REACHED();
+
+    speculateStringIdentAndLoadStorage(node->child1(), leftGPR, leftTempGPR);
+    speculateStringIdentAndLoadStorage(node->child2(), rightGPR, rightTempGPR);
+
+    flushRegisters();
+    callOperation(compareFunction, resultGPR, leftTempGPR, rightTempGPR);
+
+    unblessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileStringZeroLength(Node* node)
+{
+    SpeculateCellOperand str(this, node->child1());
+    GPRReg strGPR = str.gpr();
+
+    // Make sure that this is a string.
+    speculateString(node->child1(), strGPR);
+
+    GPRTemporary eq(this);
+    GPRReg eqGPR = eq.gpr();
+
+    // Fetch the length field from the string object.
+    m_jit.test32(MacroAssembler::Zero, MacroAssembler::Address(strGPR, JSString::offsetOfLength()), MacroAssembler::TrustedImm32(-1), eqGPR);
+
+    unblessedBooleanResult(eqGPR, node);
+}
+
+void SpeculativeJIT::compileLogicalNotStringOrOther(Node* node)
+{
+    JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
+    GPRTemporary temp(this);
+    JSValueRegs valueRegs = value.jsValueRegs();
+    GPRReg tempGPR = temp.gpr();
+
+    JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
+    GPRReg cellGPR = valueRegs.payloadGPR();
+    DFG_TYPE_CHECK(
+        valueRegs, node->child1(), (~SpecCell) | SpecString, m_jit.branchIfNotString(cellGPR));
+    m_jit.test32(
+        JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
+        JITCompiler::TrustedImm32(-1), tempGPR);
+    JITCompiler::Jump done = m_jit.jump();
+    notCell.link(&m_jit);
+    DFG_TYPE_CHECK(
+        valueRegs, node->child1(), SpecCell | SpecOther, m_jit.branchIfNotOther(valueRegs, tempGPR));
+    m_jit.move(TrustedImm32(1), tempGPR);
+    done.link(&m_jit);
+
+    unblessedBooleanResult(tempGPR, node);
+}
+
+void SpeculativeJIT::emitStringBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
+{
+    SpeculateCellOperand str(this, nodeUse);
+    speculateString(nodeUse, str.gpr());
+    branchTest32(JITCompiler::NonZero, MacroAssembler::Address(str.gpr(), JSString::offsetOfLength()), taken);
+    jump(notTaken);
+    noResult(m_currentNode);
+}
+
+void SpeculativeJIT::emitStringOrOtherBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
+{
+    JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
+    GPRTemporary temp(this);
+    JSValueRegs valueRegs = value.jsValueRegs();
+    GPRReg tempGPR = temp.gpr();
+    
+    JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
+    GPRReg cellGPR = valueRegs.payloadGPR();
+    DFG_TYPE_CHECK(valueRegs, nodeUse, (~SpecCell) | SpecString, m_jit.branchIfNotString(cellGPR));
+    branchTest32(
+        JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
+        JITCompiler::TrustedImm32(-1), notTaken);
+    jump(taken, ForceJump);
+    notCell.link(&m_jit);
+    DFG_TYPE_CHECK(
+        valueRegs, nodeUse, SpecCell | SpecOther, m_jit.branchIfNotOther(valueRegs, tempGPR));
+    jump(notTaken);
+    noResult(m_currentNode);
+}
+
+void SpeculativeJIT::compileConstantStoragePointer(Node* node)
+{
+    GPRTemporary storage(this);
+    GPRReg storageGPR = storage.gpr();
+    m_jit.move(TrustedImmPtr(node->storagePointer()), storageGPR);
+    storageResult(storageGPR, node);
+}
+
+void SpeculativeJIT::compileGetIndexedPropertyStorage(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    GPRReg baseReg = base.gpr();
+    
+    GPRTemporary storage(this);
+    GPRReg storageReg = storage.gpr();
+    
+    switch (node->arrayMode().type()) {
+    case Array::String:
+        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), storageReg);
+        
+        addSlowPathGenerator(
+            slowPathCall(
+                m_jit.branchTest32(MacroAssembler::Zero, storageReg),
+                this, operationResolveRope, storageReg, baseReg));
+
+        m_jit.loadPtr(MacroAssembler::Address(storageReg, StringImpl::dataOffset()), storageReg);
+        break;
+        
+    default:
+        ASSERT(isTypedView(node->arrayMode().typedArrayType()));
+
+        m_jit.loadPtr(JITCompiler::Address(baseReg, JSArrayBufferView::offsetOfVector()), storageReg);
+        break;
+    }
+    
+    storageResult(storageReg, node);
+}
+
+void SpeculativeJIT::compileGetTypedArrayByteOffset(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    GPRTemporary vector(this);
+    GPRTemporary data(this);
+    
+    GPRReg baseGPR = base.gpr();
+    GPRReg vectorGPR = vector.gpr();
+    GPRReg dataGPR = data.gpr();
+    
+    JITCompiler::Jump emptyByteOffset = m_jit.branch32(
+        MacroAssembler::NotEqual,
+        MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfMode()),
+        TrustedImm32(WastefulTypedArray));
+
+    m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), dataGPR);
+    m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfVector()), vectorGPR);
+    m_jit.loadPtr(MacroAssembler::Address(dataGPR, Butterfly::offsetOfArrayBuffer()), dataGPR);
+    m_jit.loadPtr(MacroAssembler::Address(dataGPR, ArrayBuffer::offsetOfData()), dataGPR);
+    m_jit.subPtr(dataGPR, vectorGPR);
+    
+    JITCompiler::Jump done = m_jit.jump();
+    
+    emptyByteOffset.link(&m_jit);
+    m_jit.move(TrustedImmPtr(0), vectorGPR);
+    
+    done.link(&m_jit);
+
+    int32Result(vectorGPR, node);
+}
+
+void SpeculativeJIT::compileGetByValOnDirectArguments(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    SpeculateStrictInt32Operand property(this, node->child2());
+    GPRTemporary result(this);
+#if USE(JSVALUE32_64)
+    GPRTemporary resultTag(this);
+#endif
+    
+    GPRReg baseReg = base.gpr();
+    GPRReg propertyReg = property.gpr();
+    GPRReg resultReg = result.gpr();
+#if USE(JSVALUE32_64)
+    GPRReg resultTagReg = resultTag.gpr();
+    JSValueRegs resultRegs = JSValueRegs(resultTagReg, resultReg);
+#else
+    JSValueRegs resultRegs = JSValueRegs(resultReg);
+#endif
+    
+    if (!m_compileOkay)
+        return;
+    
+    ASSERT(ArrayMode(Array::DirectArguments).alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1())));
+    
+    speculationCheck(
+        ExoticObjectMode, JSValueSource(), 0,
+        m_jit.branchTestPtr(
+            MacroAssembler::NonZero,
+            MacroAssembler::Address(baseReg, DirectArguments::offsetOfOverrides())));
+    speculationCheck(
+        ExoticObjectMode, JSValueSource(), 0,
+        m_jit.branch32(
+            MacroAssembler::AboveOrEqual, propertyReg,
+            MacroAssembler::Address(baseReg, DirectArguments::offsetOfLength())));
+    
+    m_jit.loadValue(
+        MacroAssembler::BaseIndex(
+            baseReg, propertyReg, MacroAssembler::TimesEight, DirectArguments::storageOffset()),
+        resultRegs);
+    
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compileGetByValOnScopedArguments(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    SpeculateStrictInt32Operand property(this, node->child2());
+    GPRTemporary result(this);
+#if USE(JSVALUE32_64)
+    GPRTemporary resultTag(this);
+#endif
+    GPRTemporary scratch(this);
+    GPRTemporary scratch2(this);
+    
+    GPRReg baseReg = base.gpr();
+    GPRReg propertyReg = property.gpr();
+    GPRReg resultReg = result.gpr();
+#if USE(JSVALUE32_64)
+    GPRReg resultTagReg = resultTag.gpr();
+    JSValueRegs resultRegs = JSValueRegs(resultTagReg, resultReg);
+#else
+    JSValueRegs resultRegs = JSValueRegs(resultReg);
+#endif
+    GPRReg scratchReg = scratch.gpr();
+    GPRReg scratch2Reg = scratch2.gpr();
+    
+    if (!m_compileOkay)
+        return;
+    
+    ASSERT(ArrayMode(Array::ScopedArguments).alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1())));
+    
+    speculationCheck(
+        ExoticObjectMode, JSValueSource(), nullptr,
+        m_jit.branch32(
+            MacroAssembler::AboveOrEqual, propertyReg,
+            MacroAssembler::Address(baseReg, ScopedArguments::offsetOfTotalLength())));
+    
+    m_jit.loadPtr(MacroAssembler::Address(baseReg, ScopedArguments::offsetOfTable()), scratchReg);
+    m_jit.load32(
+        MacroAssembler::Address(scratchReg, ScopedArgumentsTable::offsetOfLength()), scratch2Reg);
+    
+    MacroAssembler::Jump overflowArgument = m_jit.branch32(
+        MacroAssembler::AboveOrEqual, propertyReg, scratch2Reg);
+    
+    m_jit.loadPtr(MacroAssembler::Address(baseReg, ScopedArguments::offsetOfScope()), scratch2Reg);
+
+    m_jit.loadPtr(
+        MacroAssembler::Address(scratchReg, ScopedArgumentsTable::offsetOfArguments()),
+        scratchReg);
+    m_jit.load32(
+        MacroAssembler::BaseIndex(scratchReg, propertyReg, MacroAssembler::TimesFour),
+        scratchReg);
+    
+    speculationCheck(
+        ExoticObjectMode, JSValueSource(), nullptr,
+        m_jit.branch32(
+            MacroAssembler::Equal, scratchReg, TrustedImm32(ScopeOffset::invalidOffset)));
+    
+    m_jit.loadValue(
+        MacroAssembler::BaseIndex(
+            scratch2Reg, propertyReg, MacroAssembler::TimesEight,
+            JSEnvironmentRecord::offsetOfVariables()),
+        resultRegs);
+    
+    MacroAssembler::Jump done = m_jit.jump();
+    overflowArgument.link(&m_jit);
+    
+    m_jit.sub32(propertyReg, scratch2Reg);
+    m_jit.neg32(scratch2Reg);
+    
+    m_jit.loadValue(
+        MacroAssembler::BaseIndex(
+            baseReg, scratch2Reg, MacroAssembler::TimesEight,
+            ScopedArguments::overflowStorageOffset()),
+        resultRegs);
+    speculationCheck(ExoticObjectMode, JSValueSource(), nullptr, m_jit.branchIfEmpty(resultRegs));
+    
+    done.link(&m_jit);
+    
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compileGetScope(Node* node)
+{
+    SpeculateCellOperand function(this, node->child1());
+    GPRTemporary result(this, Reuse, function);
+    m_jit.loadPtr(JITCompiler::Address(function.gpr(), JSFunction::offsetOfScopeChain()), result.gpr());
+    cellResult(result.gpr(), node);
+}
+    
+void SpeculativeJIT::compileSkipScope(Node* node)
+{
+    SpeculateCellOperand scope(this, node->child1());
+    GPRTemporary result(this, Reuse, scope);
+    m_jit.loadPtr(JITCompiler::Address(scope.gpr(), JSScope::offsetOfNext()), result.gpr());
+    cellResult(result.gpr(), node);
+}
+
+void SpeculativeJIT::compileGetGlobalObject(Node* node)
+{
+    SpeculateCellOperand object(this, node->child1());
+    GPRTemporary result(this);
+    GPRTemporary scratch(this);
+    m_jit.emitLoadStructure(object.gpr(), result.gpr(), scratch.gpr());
+    m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), result.gpr());
+    cellResult(result.gpr(), node);
+}
+
+void SpeculativeJIT::compileGetArrayLength(Node* node)
+{
+    switch (node->arrayMode().type()) {
+    case Array::Undecided:
+    case Array::Int32:
+    case Array::Double:
+    case Array::Contiguous: {
+        StorageOperand storage(this, node->child2());
+        GPRTemporary result(this, Reuse, storage);
+        GPRReg storageReg = storage.gpr();
+        GPRReg resultReg = result.gpr();
+        m_jit.load32(MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()), resultReg);
+            
+        int32Result(resultReg, node);
+        break;
+    }
+    case Array::ArrayStorage:
+    case Array::SlowPutArrayStorage: {
+        StorageOperand storage(this, node->child2());
+        GPRTemporary result(this, Reuse, storage);
+        GPRReg storageReg = storage.gpr();
+        GPRReg resultReg = result.gpr();
+        m_jit.load32(MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()), resultReg);
+            
+        speculationCheck(Uncountable, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::LessThan, resultReg, MacroAssembler::TrustedImm32(0)));
+            
+        int32Result(resultReg, node);
+        break;
+    }
+    case Array::String: {
+        SpeculateCellOperand base(this, node->child1());
+        GPRTemporary result(this, Reuse, base);
+        GPRReg baseGPR = base.gpr();
+        GPRReg resultGPR = result.gpr();
+        m_jit.load32(MacroAssembler::Address(baseGPR, JSString::offsetOfLength()), resultGPR);
+        int32Result(resultGPR, node);
+        break;
+    }
+    case Array::DirectArguments: {
+        SpeculateCellOperand base(this, node->child1());
+        GPRTemporary result(this, Reuse, base);
+        
+        GPRReg baseReg = base.gpr();
+        GPRReg resultReg = result.gpr();
+        
+        if (!m_compileOkay)
+            return;
+        
+        ASSERT(ArrayMode(Array::DirectArguments).alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1())));
+        
+        speculationCheck(
+            ExoticObjectMode, JSValueSource(), 0,
+            m_jit.branchTestPtr(
+                MacroAssembler::NonZero,
+                MacroAssembler::Address(baseReg, DirectArguments::offsetOfOverrides())));
+        
+        m_jit.load32(
+            MacroAssembler::Address(baseReg, DirectArguments::offsetOfLength()), resultReg);
+        
+        int32Result(resultReg, node);
+        break;
+    }
+    case Array::ScopedArguments: {
+        SpeculateCellOperand base(this, node->child1());
+        GPRTemporary result(this, Reuse, base);
+        
+        GPRReg baseReg = base.gpr();
+        GPRReg resultReg = result.gpr();
+        
+        if (!m_compileOkay)
+            return;
+        
+        ASSERT(ArrayMode(Array::ScopedArguments).alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1())));
+        
+        speculationCheck(
+            ExoticObjectMode, JSValueSource(), 0,
+            m_jit.branchTest8(
+                MacroAssembler::NonZero,
+                MacroAssembler::Address(baseReg, ScopedArguments::offsetOfOverrodeThings())));
+        
+        m_jit.load32(
+            MacroAssembler::Address(baseReg, ScopedArguments::offsetOfTotalLength()), resultReg);
+        
+        int32Result(resultReg, node);
+        break;
+    }
+    default: {
+        ASSERT(node->arrayMode().isSomeTypedArrayView());
+        SpeculateCellOperand base(this, node->child1());
+        GPRTemporary result(this, Reuse, base);
+        GPRReg baseGPR = base.gpr();
+        GPRReg resultGPR = result.gpr();
+        m_jit.load32(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfLength()), resultGPR);
+        int32Result(resultGPR, node);
+        break;
+    } }
+}
+
+void SpeculativeJIT::compileCheckStringIdent(Node* node)
+{
+    SpeculateCellOperand string(this, node->child1());
+    GPRTemporary storage(this);
+
+    GPRReg stringGPR = string.gpr();
+    GPRReg storageGPR = storage.gpr();
+
+    speculateString(node->child1(), stringGPR);
+    speculateStringIdentAndLoadStorage(node->child1(), stringGPR, storageGPR);
+
+    UniquedStringImpl* uid = node->uidOperand();
+    speculationCheck(
+        BadIdent, JSValueSource(), nullptr,
+        m_jit.branchPtr(JITCompiler::NotEqual, storageGPR, TrustedImmPtr(uid)));
+    noResult(node);
+}
+
+template <typename ClassType> void SpeculativeJIT::compileNewFunctionCommon(GPRReg resultGPR, RegisteredStructure structure, GPRReg scratch1GPR, GPRReg scratch2GPR, GPRReg scopeGPR, MacroAssembler::JumpList& slowPath, size_t size, FunctionExecutable* executable, ptrdiff_t offsetOfScopeChain, ptrdiff_t offsetOfExecutable, ptrdiff_t offsetOfRareData)
+{
+    emitAllocateJSObjectWithKnownSize<ClassType>(resultGPR, TrustedImmPtr(structure), TrustedImmPtr(0), scratch1GPR, scratch2GPR, slowPath, size);
+    
+    m_jit.storePtr(scopeGPR, JITCompiler::Address(resultGPR, offsetOfScopeChain));
+    m_jit.storePtr(TrustedImmPtr::weakPointer(m_jit.graph(), executable), JITCompiler::Address(resultGPR, offsetOfExecutable));
+    m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(resultGPR, offsetOfRareData));
+    
+    m_jit.mutatorFence();
+}
+
+void SpeculativeJIT::compileNewFunction(Node* node)
+{
+    NodeType nodeType = node->op();
+    ASSERT(nodeType == NewFunction || nodeType == NewGeneratorFunction || nodeType == NewAsyncFunction);
+    
+    SpeculateCellOperand scope(this, node->child1());
+    GPRReg scopeGPR = scope.gpr();
+
+    FunctionExecutable* executable = node->castOperand<FunctionExecutable*>();
+
+    if (executable->singletonFunction()->isStillValid()) {
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+        
+        flushRegisters();
+
+        if (nodeType == NewGeneratorFunction)
+            callOperation(operationNewGeneratorFunction, resultGPR, scopeGPR, executable);
+        else if (nodeType == NewAsyncFunction)
+            callOperation(operationNewAsyncFunction, resultGPR, scopeGPR, executable);
+        else
+            callOperation(operationNewFunction, resultGPR, scopeGPR, executable);
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        return;
+    }
+
+    RegisteredStructure structure = m_jit.graph().registerStructure(
+        nodeType == NewGeneratorFunction ? m_jit.graph().globalObjectFor(node->origin.semantic)->generatorFunctionStructure() :
+        nodeType == NewAsyncFunction ? m_jit.graph().globalObjectFor(node->origin.semantic)->asyncFunctionStructure() :
+        m_jit.graph().globalObjectFor(node->origin.semantic)->functionStructure());
+    
+    GPRTemporary result(this);
+    GPRTemporary scratch1(this);
+    GPRTemporary scratch2(this);
+    
+    GPRReg resultGPR = result.gpr();
+    GPRReg scratch1GPR = scratch1.gpr();
+    GPRReg scratch2GPR = scratch2.gpr();
+    
+    JITCompiler::JumpList slowPath;
+    
+    if (nodeType == NewFunction) {
+        compileNewFunctionCommon<JSFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSFunction::allocationSize(0), executable, JSFunction::offsetOfScopeChain(), JSFunction::offsetOfExecutable(), JSFunction::offsetOfRareData());
+            
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
+    }
+
+    if (nodeType == NewGeneratorFunction) {
+        compileNewFunctionCommon<JSGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSGeneratorFunction::allocationSize(0), executable, JSGeneratorFunction::offsetOfScopeChain(), JSGeneratorFunction::offsetOfExecutable(), JSGeneratorFunction::offsetOfRareData());
+
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
+    }
+
+    if (nodeType == NewAsyncFunction) {
+        compileNewFunctionCommon<JSAsyncFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSAsyncFunction::allocationSize(0), executable, JSAsyncFunction::offsetOfScopeChain(), JSAsyncFunction::offsetOfExecutable(), JSAsyncFunction::offsetOfRareData());
+
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
+    }
+
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileSetFunctionName(Node* node)
+{
+    SpeculateCellOperand func(this, node->child1());
+    GPRReg funcGPR = func.gpr();
+    JSValueOperand nameValue(this, node->child2());
+    JSValueRegs nameValueRegs = nameValue.jsValueRegs();
+
+    flushRegisters();
+    callOperation(operationSetFunctionName, funcGPR, nameValueRegs);
+    m_jit.exceptionCheck();
+
+    noResult(node);
+}
+
+void SpeculativeJIT::compileForwardVarargs(Node* node)
+{
+    LoadVarargsData* data = node->loadVarargsData();
+    InlineCallFrame* inlineCallFrame;
+    if (node->child1())
+        inlineCallFrame = node->child1()->origin.semantic.inlineCallFrame;
+    else
+        inlineCallFrame = node->origin.semantic.inlineCallFrame;
+
+    GPRTemporary length(this);
+    JSValueRegsTemporary temp(this);
+    GPRReg lengthGPR = length.gpr();
+    JSValueRegs tempRegs = temp.regs();
+        
+    emitGetLength(inlineCallFrame, lengthGPR, /* includeThis = */ true);
+    if (data->offset)
+        m_jit.sub32(TrustedImm32(data->offset), lengthGPR);
+        
+    speculationCheck(
+        VarargsOverflow, JSValueSource(), Edge(), m_jit.branch32(
+            MacroAssembler::Above,
+            lengthGPR, TrustedImm32(data->limit)));
+        
+    m_jit.store32(lengthGPR, JITCompiler::payloadFor(data->machineCount));
+        
+    VirtualRegister sourceStart = JITCompiler::argumentsStart(inlineCallFrame) + data->offset;
+    VirtualRegister targetStart = data->machineStart;
+
+    m_jit.sub32(TrustedImm32(1), lengthGPR);
+        
+    // First have a loop that fills in the undefined slots in case of an arity check failure.
+    m_jit.move(TrustedImm32(data->mandatoryMinimum), tempRegs.payloadGPR());
+    JITCompiler::Jump done = m_jit.branch32(JITCompiler::BelowOrEqual, tempRegs.payloadGPR(), lengthGPR);
+        
+    JITCompiler::Label loop = m_jit.label();
+    m_jit.sub32(TrustedImm32(1), tempRegs.payloadGPR());
+    m_jit.storeTrustedValue(
+        jsUndefined(),
+        JITCompiler::BaseIndex(
+            GPRInfo::callFrameRegister, tempRegs.payloadGPR(), JITCompiler::TimesEight,
+            targetStart.offset() * sizeof(EncodedJSValue)));
+    m_jit.branch32(JITCompiler::Above, tempRegs.payloadGPR(), lengthGPR).linkTo(loop, &m_jit);
+    done.link(&m_jit);
+        
+    // And then fill in the actual argument values.
+    done = m_jit.branchTest32(JITCompiler::Zero, lengthGPR);
+        
+    loop = m_jit.label();
+    m_jit.sub32(TrustedImm32(1), lengthGPR);
+    m_jit.loadValue(
+        JITCompiler::BaseIndex(
+            GPRInfo::callFrameRegister, lengthGPR, JITCompiler::TimesEight,
+            sourceStart.offset() * sizeof(EncodedJSValue)),
+        tempRegs);
+    m_jit.storeValue(
+        tempRegs,
+        JITCompiler::BaseIndex(
+            GPRInfo::callFrameRegister, lengthGPR, JITCompiler::TimesEight,
+            targetStart.offset() * sizeof(EncodedJSValue)));
+    m_jit.branchTest32(JITCompiler::NonZero, lengthGPR).linkTo(loop, &m_jit);
+        
+    done.link(&m_jit);
+        
+    noResult(node);
+}
+
+void SpeculativeJIT::compileCreateActivation(Node* node)
+{
+    SymbolTable* table = node->castOperand<SymbolTable*>();
+    RegisteredStructure structure = m_jit.graph().registerStructure(m_jit.graph().globalObjectFor(
+        node->origin.semantic)->activationStructure());
+        
+    SpeculateCellOperand scope(this, node->child1());
+    GPRReg scopeGPR = scope.gpr();
+    JSValue initializationValue = node->initializationValueForActivation();
+    ASSERT(initializationValue == jsUndefined() || initializationValue == jsTDZValue());
+    
+    if (table->singletonScope()->isStillValid()) {
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+        
+        flushRegisters();
+        
+#if USE(JSVALUE64)
+        callOperation(operationCreateActivationDirect,
+            resultGPR, structure, scopeGPR, table, TrustedImm64(JSValue::encode(initializationValue)));
+#else
+        callOperation(operationCreateActivationDirect,
+            resultGPR, structure, scopeGPR, table, TrustedImm32(initializationValue.tag()), TrustedImm32(initializationValue.payload()));
+#endif
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        return;
+    }
+    
+    GPRTemporary result(this);
+    GPRTemporary scratch1(this);
+    GPRTemporary scratch2(this);
+    GPRReg resultGPR = result.gpr();
+    GPRReg scratch1GPR = scratch1.gpr();
+    GPRReg scratch2GPR = scratch2.gpr();
+        
+    JITCompiler::JumpList slowPath;
+    emitAllocateJSObjectWithKnownSize<JSLexicalEnvironment>(
+        resultGPR, TrustedImmPtr(structure), TrustedImmPtr(0), scratch1GPR, scratch2GPR,
+        slowPath, JSLexicalEnvironment::allocationSize(table));
+        
+    // Don't need a memory barriers since we just fast-created the activation, so the
+    // activation must be young.
+    m_jit.storePtr(scopeGPR, JITCompiler::Address(resultGPR, JSScope::offsetOfNext()));
+    m_jit.storePtr(
+        TrustedImmPtr(node->cellOperand()),
+        JITCompiler::Address(resultGPR, JSLexicalEnvironment::offsetOfSymbolTable()));
+        
+    // Must initialize all members to undefined or the TDZ empty value.
+    for (unsigned i = 0; i < table->scopeSize(); ++i) {
+        m_jit.storeTrustedValue(
+            initializationValue,
+            JITCompiler::Address(
+                resultGPR, JSLexicalEnvironment::offsetOfVariable(ScopeOffset(i))));
+    }
+    
+    m_jit.mutatorFence();
+
+#if USE(JSVALUE64)
+    addSlowPathGenerator(
+        slowPathCall(
+            slowPath, this, operationCreateActivationDirect, resultGPR, structure, scopeGPR, table, TrustedImm64(JSValue::encode(initializationValue))));
+#else
+    addSlowPathGenerator(
+        slowPathCall(
+            slowPath, this, operationCreateActivationDirect, resultGPR, structure, scopeGPR, table, TrustedImm32(initializationValue.tag()), TrustedImm32(initializationValue.payload())));
+#endif
+
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileCreateDirectArguments(Node* node)
+{
+    // FIXME: A more effective way of dealing with the argument count and callee is to have
+    // them be explicit arguments to this node.
+    // https://bugs.webkit.org/show_bug.cgi?id=142207
+    
+    GPRTemporary result(this);
+    GPRTemporary scratch1(this);
+    GPRTemporary scratch2(this);
+    GPRTemporary length;
+    GPRReg resultGPR = result.gpr();
+    GPRReg scratch1GPR = scratch1.gpr();
+    GPRReg scratch2GPR = scratch2.gpr();
+    GPRReg lengthGPR = InvalidGPRReg;
+    JSValueRegs valueRegs = JSValueRegs::withTwoAvailableRegs(scratch1GPR, scratch2GPR);
+        
+    unsigned minCapacity = m_jit.graph().baselineCodeBlockFor(node->origin.semantic)->numParameters() - 1;
+        
+    unsigned knownLength;
+    bool lengthIsKnown; // if false, lengthGPR will have the length.
+    if (node->origin.semantic.inlineCallFrame
+        && !node->origin.semantic.inlineCallFrame->isVarargs()) {
+        knownLength = node->origin.semantic.inlineCallFrame->arguments.size() - 1;
+        lengthIsKnown = true;
+    } else {
+        knownLength = UINT_MAX;
+        lengthIsKnown = false;
+            
+        GPRTemporary realLength(this);
+        length.adopt(realLength);
+        lengthGPR = length.gpr();
+
+        VirtualRegister argumentCountRegister = m_jit.argumentCount(node->origin.semantic);
+        m_jit.load32(JITCompiler::payloadFor(argumentCountRegister), lengthGPR);
+        m_jit.sub32(TrustedImm32(1), lengthGPR);
+    }
+        
+    RegisteredStructure structure =
+        m_jit.graph().registerStructure(m_jit.graph().globalObjectFor(node->origin.semantic)->directArgumentsStructure());
+        
+    // Use a different strategy for allocating the object depending on whether we know its
+    // size statically.
+    JITCompiler::JumpList slowPath;
+    if (lengthIsKnown) {
+        emitAllocateJSObjectWithKnownSize<DirectArguments>(
+            resultGPR, TrustedImmPtr(structure), TrustedImmPtr(0), scratch1GPR, scratch2GPR,
+            slowPath, DirectArguments::allocationSize(std::max(knownLength, minCapacity)));
+            
+        m_jit.store32(
+            TrustedImm32(knownLength),
+            JITCompiler::Address(resultGPR, DirectArguments::offsetOfLength()));
+    } else {
+        JITCompiler::Jump tooFewArguments;
+        if (minCapacity) {
+            tooFewArguments =
+                m_jit.branch32(JITCompiler::Below, lengthGPR, TrustedImm32(minCapacity));
+        }
+        m_jit.lshift32(lengthGPR, TrustedImm32(3), scratch1GPR);
+        m_jit.add32(TrustedImm32(DirectArguments::storageOffset()), scratch1GPR);
+        if (minCapacity) {
+            JITCompiler::Jump done = m_jit.jump();
+            tooFewArguments.link(&m_jit);
+            m_jit.move(TrustedImm32(DirectArguments::allocationSize(minCapacity)), scratch1GPR);
+            done.link(&m_jit);
+        }
+        
+        emitAllocateVariableSizedJSObject<DirectArguments>(
+            resultGPR, TrustedImmPtr(structure), scratch1GPR, scratch1GPR, scratch2GPR,
+            slowPath);
+            
+        m_jit.store32(
+            lengthGPR, JITCompiler::Address(resultGPR, DirectArguments::offsetOfLength()));
+    }
+        
+    m_jit.store32(
+        TrustedImm32(minCapacity),
+        JITCompiler::Address(resultGPR, DirectArguments::offsetOfMinCapacity()));
+        
+    m_jit.storePtr(
+        TrustedImmPtr(0), JITCompiler::Address(resultGPR, DirectArguments::offsetOfOverrides()));
+    
+    if (lengthIsKnown) {
+        addSlowPathGenerator(
+            slowPathCall(
+                slowPath, this, operationCreateDirectArguments, resultGPR, structure,
+                knownLength, minCapacity));
+    } else {
+        auto generator = std::make_unique<CallCreateDirectArgumentsSlowPathGenerator>(
+            slowPath, this, resultGPR, structure, lengthGPR, minCapacity);
+        addSlowPathGenerator(WTFMove(generator));
+    }
+        
+    if (node->origin.semantic.inlineCallFrame) {
+        if (node->origin.semantic.inlineCallFrame->isClosureCall) {
+            m_jit.loadPtr(
+                JITCompiler::addressFor(
+                    node->origin.semantic.inlineCallFrame->calleeRecovery.virtualRegister()),
+                scratch1GPR);
+        } else {
+            m_jit.move(
+                TrustedImmPtr::weakPointer(
+                    m_jit.graph(), node->origin.semantic.inlineCallFrame->calleeRecovery.constant().asCell()),
+                scratch1GPR);
+        }
+    } else
+        m_jit.loadPtr(JITCompiler::addressFor(CallFrameSlot::callee), scratch1GPR);
+
+    // Don't need a memory barriers since we just fast-created the activation, so the
+    // activation must be young.
+    m_jit.storePtr(
+        scratch1GPR, JITCompiler::Address(resultGPR, DirectArguments::offsetOfCallee()));
+        
+    VirtualRegister start = m_jit.argumentsStart(node->origin.semantic);
+    if (lengthIsKnown) {
+        for (unsigned i = 0; i < std::max(knownLength, minCapacity); ++i) {
+            m_jit.loadValue(JITCompiler::addressFor(start + i), valueRegs);
+            m_jit.storeValue(
+                valueRegs, JITCompiler::Address(resultGPR, DirectArguments::offsetOfSlot(i)));
+        }
+    } else {
+        JITCompiler::Jump done;
+        if (minCapacity) {
+            JITCompiler::Jump startLoop = m_jit.branch32(
+                JITCompiler::AboveOrEqual, lengthGPR, TrustedImm32(minCapacity));
+            m_jit.move(TrustedImm32(minCapacity), lengthGPR);
+            startLoop.link(&m_jit);
+        } else
+            done = m_jit.branchTest32(MacroAssembler::Zero, lengthGPR);
+        JITCompiler::Label loop = m_jit.label();
+        m_jit.sub32(TrustedImm32(1), lengthGPR);
+        m_jit.loadValue(
+            JITCompiler::BaseIndex(
+                GPRInfo::callFrameRegister, lengthGPR, JITCompiler::TimesEight,
+                start.offset() * static_cast<int>(sizeof(Register))),
+            valueRegs);
+        m_jit.storeValue(
+            valueRegs,
+            JITCompiler::BaseIndex(
+                resultGPR, lengthGPR, JITCompiler::TimesEight,
+                DirectArguments::storageOffset()));
+        m_jit.branchTest32(MacroAssembler::NonZero, lengthGPR).linkTo(loop, &m_jit);
+        if (done.isSet())
+            done.link(&m_jit);
+    }
+        
+    m_jit.mutatorFence();
+        
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileGetFromArguments(Node* node)
+{
+    SpeculateCellOperand arguments(this, node->child1());
+    JSValueRegsTemporary result(this);
+    
+    GPRReg argumentsGPR = arguments.gpr();
+    JSValueRegs resultRegs = result.regs();
+    
+    m_jit.loadValue(JITCompiler::Address(argumentsGPR, DirectArguments::offsetOfSlot(node->capturedArgumentsOffset().offset())), resultRegs);
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compilePutToArguments(Node* node)
+{
+    SpeculateCellOperand arguments(this, node->child1());
+    JSValueOperand value(this, node->child2());
+    
+    GPRReg argumentsGPR = arguments.gpr();
+    JSValueRegs valueRegs = value.jsValueRegs();
+    
+    m_jit.storeValue(valueRegs, JITCompiler::Address(argumentsGPR, DirectArguments::offsetOfSlot(node->capturedArgumentsOffset().offset())));
+    noResult(node);
+}
+
+void SpeculativeJIT::compileGetArgument(Node* node)
+{
+    GPRTemporary argumentCount(this);
+    JSValueRegsTemporary result(this);
+    GPRReg argumentCountGPR = argumentCount.gpr();
+    JSValueRegs resultRegs = result.regs();
+    m_jit.load32(CCallHelpers::payloadFor(m_jit.argumentCount(node->origin.semantic)), argumentCountGPR);
+    auto argumentOutOfBounds = m_jit.branch32(CCallHelpers::LessThanOrEqual, argumentCountGPR, CCallHelpers::TrustedImm32(node->argumentIndex()));
+    m_jit.loadValue(CCallHelpers::addressFor(CCallHelpers::argumentsStart(node->origin.semantic) + node->argumentIndex() - 1), resultRegs);
+    auto done = m_jit.jump();
+
+    argumentOutOfBounds.link(&m_jit);
+    m_jit.moveValue(jsUndefined(), resultRegs);
+
+    done.link(&m_jit);
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compileCreateScopedArguments(Node* node)
+{
+    SpeculateCellOperand scope(this, node->child1());
+    GPRReg scopeGPR = scope.gpr();
+    
+    GPRFlushedCallResult result(this);
+    GPRReg resultGPR = result.gpr();
+    flushRegisters();
+    
+    // We set up the arguments ourselves, because we have the whole register file and we can
+    // set them up directly into the argument registers. This also means that we don't have to
+    // invent a four-argument-register shuffle.
+    
+    // Arguments: 0:exec, 1:structure, 2:start, 3:length, 4:callee, 5:scope
+    
+    // Do the scopeGPR first, since it might alias an argument register.
+    m_jit.setupArgument(5, [&] (GPRReg destGPR) { m_jit.move(scopeGPR, destGPR); });
+    
+    // These other things could be done in any order.
+    m_jit.setupArgument(4, [&] (GPRReg destGPR) { emitGetCallee(node->origin.semantic, destGPR); });
+    m_jit.setupArgument(3, [&] (GPRReg destGPR) { emitGetLength(node->origin.semantic, destGPR); });
+    m_jit.setupArgument(2, [&] (GPRReg destGPR) { emitGetArgumentStart(node->origin.semantic, destGPR); });
+    m_jit.setupArgument(
+        1, [&] (GPRReg destGPR) {
+            m_jit.move(
+                TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.globalObjectFor(node->origin.semantic)->scopedArgumentsStructure()),
+                destGPR);
+        });
+    m_jit.setupArgument(0, [&] (GPRReg destGPR) { m_jit.move(GPRInfo::callFrameRegister, destGPR); });
+    
+    appendCallSetResult(operationCreateScopedArguments, resultGPR);
+    m_jit.exceptionCheck();
+    
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileCreateClonedArguments(Node* node)
+{
+    GPRFlushedCallResult result(this);
+    GPRReg resultGPR = result.gpr();
+    flushRegisters();
+    
+    // We set up the arguments ourselves, because we have the whole register file and we can
+    // set them up directly into the argument registers.
+    
+    // Arguments: 0:exec, 1:structure, 2:start, 3:length, 4:callee
+    m_jit.setupArgument(4, [&] (GPRReg destGPR) { emitGetCallee(node->origin.semantic, destGPR); });
+    m_jit.setupArgument(3, [&] (GPRReg destGPR) { emitGetLength(node->origin.semantic, destGPR); });
+    m_jit.setupArgument(2, [&] (GPRReg destGPR) { emitGetArgumentStart(node->origin.semantic, destGPR); });
+    m_jit.setupArgument(
+        1, [&] (GPRReg destGPR) {
+            m_jit.move(
+                TrustedImmPtr::weakPointer(
+                    m_jit.graph(), m_jit.globalObjectFor(node->origin.semantic)->clonedArgumentsStructure()),
+                destGPR);
+        });
+    m_jit.setupArgument(0, [&] (GPRReg destGPR) { m_jit.move(GPRInfo::callFrameRegister, destGPR); });
+    
+    appendCallSetResult(operationCreateClonedArguments, resultGPR);
+    m_jit.exceptionCheck();
+    
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileCreateRest(Node* node)
+{
+    ASSERT(node->op() == CreateRest);
+
+#if !CPU(X86)
+    if (m_jit.graph().isWatchingHavingABadTimeWatchpoint(node)) {
+        SpeculateStrictInt32Operand arrayLength(this, node->child1());
+        GPRTemporary arrayResult(this);
+
+        GPRReg arrayLengthGPR = arrayLength.gpr();
+        GPRReg arrayResultGPR = arrayResult.gpr();
+
+        bool shouldAllowForArrayStorageStructureForLargeArrays = false;
+        ASSERT(m_jit.graph().globalObjectFor(node->origin.semantic)->restParameterStructure()->indexingType() == ArrayWithContiguous);
+        compileAllocateNewArrayWithSize(m_jit.graph().globalObjectFor(node->origin.semantic), arrayResultGPR, arrayLengthGPR, ArrayWithContiguous, shouldAllowForArrayStorageStructureForLargeArrays);
+
+        GPRTemporary argumentsStart(this);
+        GPRReg argumentsStartGPR = argumentsStart.gpr();
+
+        emitGetArgumentStart(node->origin.semantic, argumentsStartGPR);
+
+        GPRTemporary butterfly(this);
+        GPRTemporary currentLength(this);
+#if USE(JSVALUE64)
+        GPRTemporary value(this);
+        JSValueRegs valueRegs = JSValueRegs(value.gpr());
+#else
+        GPRTemporary valueTag(this);
+        GPRTemporary valuePayload(this);
+        JSValueRegs valueRegs = JSValueRegs(valueTag.gpr(), valuePayload.gpr());
+#endif
+
+        GPRReg currentLengthGPR = currentLength.gpr();
+        GPRReg butterflyGPR = butterfly.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(arrayResultGPR, JSObject::butterflyOffset()), butterflyGPR);
+
+        CCallHelpers::Jump skipLoop = m_jit.branch32(MacroAssembler::Equal, arrayLengthGPR, TrustedImm32(0));
+        m_jit.zeroExtend32ToPtr(arrayLengthGPR, currentLengthGPR);
+        m_jit.addPtr(Imm32(sizeof(Register) * node->numberOfArgumentsToSkip()), argumentsStartGPR);
+
+        auto loop = m_jit.label();
+        m_jit.sub32(TrustedImm32(1), currentLengthGPR);
+        m_jit.loadValue(JITCompiler::BaseIndex(argumentsStartGPR, currentLengthGPR, MacroAssembler::TimesEight), valueRegs);
+        m_jit.storeValue(valueRegs, MacroAssembler::BaseIndex(butterflyGPR, currentLengthGPR, MacroAssembler::TimesEight));
+        m_jit.branch32(MacroAssembler::NotEqual, currentLengthGPR, TrustedImm32(0)).linkTo(loop, &m_jit);
+
+        skipLoop.link(&m_jit);
+        cellResult(arrayResultGPR, node);
+        return;
+    }
+#endif // !CPU(X86)
+
+    SpeculateStrictInt32Operand arrayLength(this, node->child1());
+    GPRTemporary argumentsStart(this);
+    GPRTemporary numberOfArgumentsToSkip(this);
+
+    GPRReg arrayLengthGPR = arrayLength.gpr();
+    GPRReg argumentsStartGPR = argumentsStart.gpr();
+
+    emitGetArgumentStart(node->origin.semantic, argumentsStartGPR);
+
+    flushRegisters();
+
+    GPRFlushedCallResult result(this);
+    GPRReg resultGPR = result.gpr();
+    callOperation(operationCreateRest, resultGPR, argumentsStartGPR, Imm32(node->numberOfArgumentsToSkip()), arrayLengthGPR);
+    m_jit.exceptionCheck();
+
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileSpread(Node* node)
+{
+    ASSERT(node->op() == Spread);
+
+    SpeculateCellOperand operand(this, node->child1());
+    GPRReg argument = operand.gpr();
+
+    if (node->child1().useKind() == ArrayUse) {
+        // Note: we only speculate on ArrayUse when we've set up the necessary watchpoints
+        // to prove that the iteration protocol is non-observable.
+        speculateArray(node->child1(), argument);
+
+#if USE(JSVALUE64)
+        GPRTemporary result(this);
+        GPRTemporary scratch1(this);
+        GPRTemporary scratch2(this);
+        GPRTemporary length(this);
+        FPRTemporary doubleRegister(this);
+
+        GPRReg resultGPR = result.gpr();
+        GPRReg scratch1GPR = scratch1.gpr();
+        GPRReg scratch2GPR = scratch2.gpr();
+        GPRReg lengthGPR = length.gpr();
+        FPRReg doubleFPR = doubleRegister.fpr();
+
+        MacroAssembler::JumpList slowPath;
+
+        m_jit.load8(MacroAssembler::Address(argument, JSCell::indexingTypeAndMiscOffset()), scratch1GPR);
+        m_jit.and32(TrustedImm32(IndexingShapeMask), scratch1GPR);
+        m_jit.sub32(TrustedImm32(Int32Shape), scratch1GPR);
+
+        slowPath.append(m_jit.branch32(MacroAssembler::Above, scratch1GPR, TrustedImm32(ContiguousShape - Int32Shape)));
+
+        m_jit.loadPtr(MacroAssembler::Address(argument, JSObject::butterflyOffset()), lengthGPR);
+        m_jit.load32(MacroAssembler::Address(lengthGPR, Butterfly::offsetOfPublicLength()), lengthGPR);
+        static_assert(sizeof(JSValue) == 8 && 1 << 3 == 8, "This is strongly assumed in the code below.");
+        m_jit.move(lengthGPR, scratch1GPR);
+        m_jit.lshift32(TrustedImm32(3), scratch1GPR);
+        m_jit.add32(TrustedImm32(JSFixedArray::offsetOfData()), scratch1GPR);
+
+        m_jit.emitAllocateVariableSizedCell<JSFixedArray>(resultGPR, TrustedImmPtr(m_jit.graph().registerStructure(m_jit.graph().m_vm.fixedArrayStructure.get())), scratch1GPR, scratch1GPR, scratch2GPR, slowPath);
+        m_jit.store32(lengthGPR, MacroAssembler::Address(resultGPR, JSFixedArray::offsetOfSize()));
+
+        m_jit.loadPtr(MacroAssembler::Address(argument, JSObject::butterflyOffset()), scratch1GPR);
+
+        MacroAssembler::JumpList done;
+
+        m_jit.load8(MacroAssembler::Address(argument, JSCell::indexingTypeAndMiscOffset()), scratch2GPR);
+        m_jit.and32(TrustedImm32(IndexingShapeMask), scratch2GPR);
+        auto isDoubleArray = m_jit.branch32(MacroAssembler::Equal, scratch2GPR, TrustedImm32(DoubleShape));
+
+        {
+            done.append(m_jit.branchTest32(MacroAssembler::Zero, lengthGPR));
+            auto loopStart = m_jit.label();
+            m_jit.sub32(TrustedImm32(1), lengthGPR);
+            m_jit.load64(MacroAssembler::BaseIndex(scratch1GPR, lengthGPR, MacroAssembler::TimesEight), scratch2GPR);
+            auto notEmpty = m_jit.branchTest64(MacroAssembler::NonZero, scratch2GPR);
+            m_jit.move(TrustedImm64(JSValue::encode(jsUndefined())), scratch2GPR);
+            notEmpty.link(&m_jit);
+            m_jit.store64(scratch2GPR, MacroAssembler::BaseIndex(resultGPR, lengthGPR, MacroAssembler::TimesEight, JSFixedArray::offsetOfData()));
+            m_jit.branchTest32(MacroAssembler::NonZero, lengthGPR).linkTo(loopStart, &m_jit);
+            done.append(m_jit.jump());
+        }
+
+        isDoubleArray.link(&m_jit);
+        {
+
+            done.append(m_jit.branchTest32(MacroAssembler::Zero, lengthGPR));
+            auto loopStart = m_jit.label();
+            m_jit.sub32(TrustedImm32(1), lengthGPR);
+            m_jit.loadDouble(MacroAssembler::BaseIndex(scratch1GPR, lengthGPR, MacroAssembler::TimesEight), doubleFPR);
+            auto notEmpty = m_jit.branchDouble(JITCompiler::DoubleEqual, doubleFPR, doubleFPR);
+            m_jit.move(TrustedImm64(JSValue::encode(jsUndefined())), scratch2GPR);
+            auto doStore = m_jit.jump();
+            notEmpty.link(&m_jit);
+            m_jit.boxDouble(doubleFPR, scratch2GPR);
+            doStore.link(&m_jit);
+            m_jit.store64(scratch2GPR, MacroAssembler::BaseIndex(resultGPR, lengthGPR, MacroAssembler::TimesEight, JSFixedArray::offsetOfData()));
+            m_jit.branchTest32(MacroAssembler::NonZero, lengthGPR).linkTo(loopStart, &m_jit);
+            done.append(m_jit.jump());
+        }
+        
+        m_jit.mutatorFence();
+
+        slowPath.link(&m_jit);
+        addSlowPathGenerator(slowPathCall(m_jit.jump(), this, operationSpreadFastArray, resultGPR, argument));
+
+        done.link(&m_jit);
+        cellResult(resultGPR, node);
+#else
+        flushRegisters();
+
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+        callOperation(operationSpreadFastArray, resultGPR, argument);
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+#endif // USE(JSVALUE64)
+    } else {
+        flushRegisters();
+
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+        callOperation(operationSpreadGeneric, resultGPR, argument);
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+    }
+}
+
+void SpeculativeJIT::compileNewArrayWithSpread(Node* node)
+{
+    ASSERT(node->op() == NewArrayWithSpread);
+
+#if USE(JSVALUE64)
+    if (m_jit.graph().isWatchingHavingABadTimeWatchpoint(node)) {
+        GPRTemporary result(this);
+        GPRReg resultGPR = result.gpr();
+
+        BitVector* bitVector = node->bitVector();
+        {
+            unsigned startLength = 0;
+            for (unsigned i = 0; i < node->numChildren(); ++i) {
+                if (!bitVector->get(i))
+                    ++startLength;
+            }
+
+            GPRTemporary length(this);
+            GPRReg lengthGPR = length.gpr();
+            m_jit.move(TrustedImm32(startLength), lengthGPR);
+
+            for (unsigned i = 0; i < node->numChildren(); ++i) {
+                if (bitVector->get(i)) {
+                    Edge use = m_jit.graph().varArgChild(node, i);
+                    SpeculateCellOperand fixedArray(this, use);
+                    GPRReg fixedArrayGPR = fixedArray.gpr();
+                    m_jit.add32(MacroAssembler::Address(fixedArrayGPR, JSFixedArray::offsetOfSize()), lengthGPR);
+                }
+            }
+
+
+            bool shouldAllowForArrayStorageStructureForLargeArrays = false;
+            ASSERT(m_jit.graph().globalObjectFor(node->origin.semantic)->restParameterStructure()->indexingType() == ArrayWithContiguous);
+            compileAllocateNewArrayWithSize(m_jit.graph().globalObjectFor(node->origin.semantic), resultGPR, lengthGPR, ArrayWithContiguous, shouldAllowForArrayStorageStructureForLargeArrays);
+        }
+
+        GPRTemporary index(this);
+        GPRReg indexGPR = index.gpr();
+
+        GPRTemporary storage(this);
+        GPRReg storageGPR = storage.gpr();
+
+        m_jit.move(TrustedImm32(0), indexGPR);
+        m_jit.loadPtr(MacroAssembler::Address(resultGPR, JSObject::butterflyOffset()), storageGPR);
+
+        for (unsigned i = 0; i < node->numChildren(); ++i) {
+            Edge use = m_jit.graph().varArgChild(node, i);
+            if (bitVector->get(i)) {
+                SpeculateCellOperand fixedArray(this, use);
+                GPRReg fixedArrayGPR = fixedArray.gpr();
+
+                GPRTemporary fixedIndex(this);
+                GPRReg fixedIndexGPR = fixedIndex.gpr();
+
+                GPRTemporary item(this);
+                GPRReg itemGPR = item.gpr();
+
+                GPRTemporary fixedLength(this);
+                GPRReg fixedLengthGPR = fixedLength.gpr();
+
+                m_jit.load32(MacroAssembler::Address(fixedArrayGPR, JSFixedArray::offsetOfSize()), fixedLengthGPR);
+                m_jit.move(TrustedImm32(0), fixedIndexGPR);
+                auto done = m_jit.branchPtr(MacroAssembler::AboveOrEqual, fixedIndexGPR, fixedLengthGPR);
+                auto loopStart = m_jit.label();
+                m_jit.load64(
+                    MacroAssembler::BaseIndex(fixedArrayGPR, fixedIndexGPR, MacroAssembler::TimesEight, JSFixedArray::offsetOfData()),
+                    itemGPR);
+
+                m_jit.store64(itemGPR, MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight));
+                m_jit.addPtr(TrustedImm32(1), fixedIndexGPR);
+                m_jit.addPtr(TrustedImm32(1), indexGPR);
+                m_jit.branchPtr(MacroAssembler::Below, fixedIndexGPR, fixedLengthGPR).linkTo(loopStart, &m_jit);
+
+                done.link(&m_jit);
+            } else {
+                JSValueOperand item(this, use);
+                GPRReg itemGPR = item.gpr();
+                m_jit.store64(itemGPR, MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight));
+                m_jit.addPtr(TrustedImm32(1), indexGPR);
+            }
+        }
+
+        cellResult(resultGPR, node);
+        return;
+    }
+#endif // USE(JSVALUE64)
+
+    ASSERT(node->numChildren());
+    size_t scratchSize = sizeof(EncodedJSValue) * node->numChildren();
+    ScratchBuffer* scratchBuffer = m_jit.vm()->scratchBufferForSize(scratchSize);
+    EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
+
+    BitVector* bitVector = node->bitVector();
+    for (unsigned i = 0; i < node->numChildren(); ++i) {
+        Edge use = m_jit.graph().m_varArgChildren[node->firstChild() + i];
+        if (bitVector->get(i)) {
+            SpeculateCellOperand fixedArray(this, use);
+            GPRReg arrayGPR = fixedArray.gpr();
+#if USE(JSVALUE64)
+            m_jit.store64(arrayGPR, &buffer[i]);
+#else
+            char* pointer = static_cast<char*>(static_cast<void*>(&buffer[i]));
+            m_jit.store32(arrayGPR, pointer + PayloadOffset);
+            m_jit.store32(TrustedImm32(JSValue::CellTag), pointer + TagOffset);
+#endif
+        } else {
+            JSValueOperand input(this, use);
+            JSValueRegs inputRegs = input.jsValueRegs();
+            m_jit.storeValue(inputRegs, &buffer[i]);
+        }
+    }
+
+    {
+        GPRTemporary scratch(this);
+        m_jit.move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratch.gpr());
+        m_jit.storePtr(TrustedImmPtr(scratchSize), MacroAssembler::Address(scratch.gpr()));
+    }
+
+    flushRegisters();
+
+    GPRFlushedCallResult result(this);
+    GPRReg resultGPR = result.gpr();
+
+    callOperation(operationNewArrayWithSpreadSlow, resultGPR, buffer, node->numChildren());
+    m_jit.exceptionCheck();
+    {
+        GPRTemporary scratch(this);
+        m_jit.move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratch.gpr());
+        m_jit.storePtr(TrustedImmPtr(0), MacroAssembler::Address(scratch.gpr()));
+    }
+
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileGetRestLength(Node* node)
+{
+    ASSERT(node->op() == GetRestLength);
+
+    GPRTemporary result(this);
+    GPRReg resultGPR = result.gpr();
+
+    emitGetLength(node->origin.semantic, resultGPR);
+    CCallHelpers::Jump hasNonZeroLength = m_jit.branch32(MacroAssembler::Above, resultGPR, Imm32(node->numberOfArgumentsToSkip()));
+    m_jit.move(TrustedImm32(0), resultGPR);
+    CCallHelpers::Jump done = m_jit.jump();
+    hasNonZeroLength.link(&m_jit);
+    if (node->numberOfArgumentsToSkip())
+        m_jit.sub32(TrustedImm32(node->numberOfArgumentsToSkip()), resultGPR);
+    done.link(&m_jit);
+    int32Result(resultGPR, node);
+}
+
+void SpeculativeJIT::compileArraySlice(Node* node)
+{
+    ASSERT(node->op() == ArraySlice);
+
+    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+
+    GPRTemporary temp(this);
+    StorageOperand storage(this, node->numChildren() == 3 ? m_jit.graph().varArgChild(node, 2) : m_jit.graph().varArgChild(node, 3));
+    GPRTemporary result(this);
+    
+    GPRReg storageGPR = storage.gpr();
+    GPRReg resultGPR = result.gpr();
+    GPRReg tempGPR = temp.gpr();
+
+    auto populateIndex = [&] (unsigned childIndex, GPRReg length, GPRReg result) {
+        SpeculateInt32Operand index(this, m_jit.graph().varArgChild(node, childIndex));
+        GPRReg indexGPR = index.gpr();
+        MacroAssembler::JumpList done;
+        auto isPositive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, indexGPR, TrustedImm32(0));
+        m_jit.move(length, result);
+        done.append(m_jit.branchAdd32(MacroAssembler::PositiveOrZero, indexGPR, result));
+        m_jit.move(TrustedImm32(0), result);
+        done.append(m_jit.jump());
+
+        isPositive.link(&m_jit);
+        m_jit.move(indexGPR, result);
+        done.append(m_jit.branch32(MacroAssembler::BelowOrEqual, result, length));
+        m_jit.move(length, result);
+
+        done.link(&m_jit);
+    };
+
+    {
+        GPRTemporary tempLength(this);
+        GPRReg lengthGPR = tempLength.gpr();
+        m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), lengthGPR);
+
+        if (node->numChildren() == 4)
+            populateIndex(2, lengthGPR, tempGPR);
+        else
+            m_jit.move(lengthGPR, tempGPR);
+
+        GPRTemporary tempStartIndex(this);
+        GPRReg startGPR = tempStartIndex.gpr();
+        populateIndex(1, lengthGPR, startGPR);
+
+        auto tooBig = m_jit.branch32(MacroAssembler::Above, startGPR, tempGPR);
+        m_jit.sub32(startGPR, tempGPR); // the size of the array we'll make.
+        auto done = m_jit.jump();
+
+        tooBig.link(&m_jit);
+        m_jit.move(TrustedImm32(0), tempGPR);
+        done.link(&m_jit);
+    }
+
+
+    GPRTemporary temp3(this);
+    GPRReg tempValue = temp3.gpr();
+    {
+        SpeculateCellOperand cell(this, m_jit.graph().varArgChild(node, 0));
+        m_jit.load8(MacroAssembler::Address(cell.gpr(), JSCell::indexingTypeAndMiscOffset()), tempValue);
+        m_jit.and32(TrustedImm32(AllArrayTypesAndHistory), tempValue);
+    }
+
+    {
+#if USE(JSVALUE64)
+        GPRTemporary emptyValue(this);
+        JSValueRegs emptyValueRegs = JSValueRegs(emptyValue.gpr());
+#else
+        GPRTemporary emptyValuePayload(this);
+        GPRTemporary emptyValueTag(this);
+        JSValueRegs emptyValueRegs(emptyValueTag.gpr(), emptyValuePayload.gpr());
+#endif
+
+        GPRTemporary storage(this);
+        GPRReg storageResultGPR = storage.gpr();
+
+        GPRReg sizeGPR = tempGPR; 
+
+        CCallHelpers::JumpList done;
+
+        auto emitMoveEmptyValue = [&] (JSValue v) {
+#if USE(JSVALUE64)
+            m_jit.move(TrustedImm64(JSValue::encode(v)), emptyValueRegs.gpr());
+#else
+            m_jit.move(TrustedImm32(v.tag()), emptyValueRegs.tagGPR());
+            m_jit.move(TrustedImm32(v.payload()), emptyValueRegs.payloadGPR());
+#endif
+        };
+
+        auto isContiguous = m_jit.branch32(MacroAssembler::Equal, tempValue, TrustedImm32(ArrayWithContiguous));
+        auto isInt32 = m_jit.branch32(MacroAssembler::Equal, tempValue, TrustedImm32(ArrayWithInt32));
+        // When we emit an ArraySlice, we dominate the use of the array by a CheckStructure
+        // to ensure the incoming array is one to be one of the original array structures
+        // with one of the following indexing shapes: Int32, Contiguous, Double. Therefore,
+        // we're a double array here.
+        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithDouble))), tempValue);
+        emitMoveEmptyValue(jsNaN());
+        done.append(m_jit.jump());
+
+        isContiguous.link(&m_jit);
+        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous))), tempValue);
+        emitMoveEmptyValue(JSValue());
+        done.append(m_jit.jump());
+
+        isInt32.link(&m_jit);
+        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithInt32))), tempValue);
+        emitMoveEmptyValue(JSValue());
+
+        done.link(&m_jit);
+
+        {
+            GPRTemporary scratch(this);
+            GPRTemporary scratch2(this);
+            GPRReg scratchGPR = scratch.gpr();
+            GPRReg scratch2GPR = scratch2.gpr();
+
+            MacroAssembler::JumpList slowCases;
+            m_jit.move(TrustedImmPtr(0), storageResultGPR);
+
+            emitAllocateButterfly(storageResultGPR, sizeGPR, scratchGPR, scratch2GPR, resultGPR, slowCases);
+            emitInitializeButterfly(storageResultGPR, sizeGPR, emptyValueRegs, scratchGPR);
+            emitAllocateJSObject<JSArray>(resultGPR, tempValue, storageResultGPR, scratchGPR, scratch2GPR, slowCases);
+            m_jit.mutatorFence();
+
+            addSlowPathGenerator(std::make_unique<CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator>(
+                slowCases, this, operationNewArrayWithSize, resultGPR, tempValue, sizeGPR, storageResultGPR, scratchGPR));
+        }
+    }
+
+    GPRTemporary temp4(this);
+    GPRReg loadIndex = temp4.gpr();
+
+    m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), tempValue);
+    if (node->numChildren() == 4)
+        populateIndex(2, tempValue, tempGPR);
+    else
+        m_jit.move(tempValue, tempGPR);
+    populateIndex(1, tempValue, loadIndex);
+
+    GPRTemporary temp5(this);
+    GPRReg storeIndex = temp5.gpr();
+    m_jit.move(TrustedImmPtr(0), storeIndex);
+
+    GPRTemporary temp2(this);
+    GPRReg resultButterfly = temp2.gpr();
+
+    m_jit.loadPtr(MacroAssembler::Address(resultGPR, JSObject::butterflyOffset()), resultButterfly);
+    m_jit.zeroExtend32ToPtr(tempGPR, tempGPR);
+    m_jit.zeroExtend32ToPtr(loadIndex, loadIndex);
+    auto done = m_jit.branchPtr(MacroAssembler::AboveOrEqual, loadIndex, tempGPR);
+
+    auto loop = m_jit.label();
+#if USE(JSVALUE64)
+    m_jit.load64(
+        MacroAssembler::BaseIndex(storageGPR, loadIndex, MacroAssembler::TimesEight), tempValue);
+    m_jit.store64(
+        tempValue, MacroAssembler::BaseIndex(resultButterfly, storeIndex, MacroAssembler::TimesEight));
+#else
+    m_jit.load32(
+        MacroAssembler::BaseIndex(storageGPR, loadIndex, MacroAssembler::TimesEight, PayloadOffset), tempValue);
+    m_jit.store32(
+        tempValue, MacroAssembler::BaseIndex(resultButterfly, storeIndex, MacroAssembler::TimesEight, PayloadOffset));
+    m_jit.load32(
+        MacroAssembler::BaseIndex(storageGPR, loadIndex, MacroAssembler::TimesEight, TagOffset), tempValue);
+    m_jit.store32(
+        tempValue, MacroAssembler::BaseIndex(resultButterfly, storeIndex, MacroAssembler::TimesEight, TagOffset));
+#endif // USE(JSVALUE64)
+    m_jit.addPtr(TrustedImm32(1), loadIndex);
+    m_jit.addPtr(TrustedImm32(1), storeIndex);
+    m_jit.branchPtr(MacroAssembler::Below, loadIndex, tempGPR).linkTo(loop, &m_jit);
+
+    done.link(&m_jit);
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileNotifyWrite(Node* node)
+{
+    WatchpointSet* set = node->watchpointSet();
+    
+    JITCompiler::Jump slowCase = m_jit.branch8(
+        JITCompiler::NotEqual,
+        JITCompiler::AbsoluteAddress(set->addressOfState()),
+        TrustedImm32(IsInvalidated));
+    
+    addSlowPathGenerator(
+        slowPathCall(slowCase, this, operationNotifyWrite, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, NoResult, set));
+    
+    noResult(node);
+}
+
+void SpeculativeJIT::compileIsObjectOrNull(Node* node)
+{
+    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    
+    JSValueOperand value(this, node->child1());
+    JSValueRegs valueRegs = value.jsValueRegs();
+    
+    GPRTemporary result(this);
+    GPRReg resultGPR = result.gpr();
+    
+    JITCompiler::Jump isCell = m_jit.branchIfCell(valueRegs);
+    
+    JITCompiler::Jump isNull = m_jit.branchIfEqual(valueRegs, jsNull());
+    JITCompiler::Jump isNonNullNonCell = m_jit.jump();
+    
+    isCell.link(&m_jit);
+    JITCompiler::Jump isFunction = m_jit.branchIfFunction(valueRegs.payloadGPR());
+    JITCompiler::Jump notObject = m_jit.branchIfNotObject(valueRegs.payloadGPR());
+    
+    JITCompiler::Jump slowPath = m_jit.branchTest8(
+        JITCompiler::NonZero,
+        JITCompiler::Address(valueRegs.payloadGPR(), JSCell::typeInfoFlagsOffset()),
+        TrustedImm32(MasqueradesAsUndefined | TypeOfShouldCallGetCallData));
+    
+    isNull.link(&m_jit);
+    m_jit.move(TrustedImm32(1), resultGPR);
+    JITCompiler::Jump done = m_jit.jump();
+    
+    isNonNullNonCell.link(&m_jit);
+    isFunction.link(&m_jit);
+    notObject.link(&m_jit);
+    m_jit.move(TrustedImm32(0), resultGPR);
+    
+    addSlowPathGenerator(
+        slowPathCall(
+            slowPath, this, operationObjectIsObject, resultGPR, globalObject,
+            valueRegs.payloadGPR()));
+    
+    done.link(&m_jit);
+    
+    unblessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileIsFunction(Node* node)
+{
+    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    
+    JSValueOperand value(this, node->child1());
+    JSValueRegs valueRegs = value.jsValueRegs();
+    
+    GPRTemporary result(this);
+    GPRReg resultGPR = result.gpr();
+    
+    JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
+    JITCompiler::Jump isFunction = m_jit.branchIfFunction(valueRegs.payloadGPR());
+    JITCompiler::Jump notObject = m_jit.branchIfNotObject(valueRegs.payloadGPR());
+    
+    JITCompiler::Jump slowPath = m_jit.branchTest8(
+        JITCompiler::NonZero,
+        JITCompiler::Address(valueRegs.payloadGPR(), JSCell::typeInfoFlagsOffset()),
+        TrustedImm32(MasqueradesAsUndefined | TypeOfShouldCallGetCallData));
+    
+    notCell.link(&m_jit);
+    notObject.link(&m_jit);
+    m_jit.move(TrustedImm32(0), resultGPR);
+    JITCompiler::Jump done = m_jit.jump();
+    
+    isFunction.link(&m_jit);
+    m_jit.move(TrustedImm32(1), resultGPR);
+    
+    addSlowPathGenerator(
+        slowPathCall(
+            slowPath, this, operationObjectIsFunction, resultGPR, globalObject,
+            valueRegs.payloadGPR()));
+    
+    done.link(&m_jit);
+    
+    unblessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileTypeOf(Node* node)
+{
+    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    
+    JSValueOperand value(this, node->child1());
+    JSValueRegs valueRegs = value.jsValueRegs();
+    
+    GPRTemporary result(this);
+    GPRReg resultGPR = result.gpr();
+    
+    JITCompiler::JumpList done;
+    JITCompiler::Jump slowPath;
+    m_jit.emitTypeOf(
+        valueRegs, resultGPR,
+        [&] (TypeofType type, bool fallsThrough) {
+            m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.vm()->smallStrings.typeString(type)), resultGPR);
+            if (!fallsThrough)
+                done.append(m_jit.jump());
+        },
+        [&] (JITCompiler::Jump theSlowPath) {
+            slowPath = theSlowPath;
+        });
+    done.link(&m_jit);
+
+    addSlowPathGenerator(
+        slowPathCall(
+            slowPath, this, operationTypeOfObject, resultGPR, globalObject,
+            valueRegs.payloadGPR()));
+    
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileCheckStructure(Node* node, GPRReg cellGPR, GPRReg tempGPR)
+{
+    ASSERT(node->structureSet().size());
+    
+    if (node->structureSet().size() == 1) {
+        speculationCheck(
+            BadCache, JSValueSource::unboxedCell(cellGPR), 0,
+            m_jit.branchWeakStructure(
+                JITCompiler::NotEqual,
+                JITCompiler::Address(cellGPR, JSCell::structureIDOffset()),
+                node->structureSet()[0]));
+    } else {
+        std::unique_ptr<GPRTemporary> structure;
+        GPRReg structureGPR;
+        
+        if (tempGPR == InvalidGPRReg) {
+            structure = std::make_unique<GPRTemporary>(this);
+            structureGPR = structure->gpr();
+        } else
+            structureGPR = tempGPR;
+        
+        m_jit.load32(JITCompiler::Address(cellGPR, JSCell::structureIDOffset()), structureGPR);
+        
+        JITCompiler::JumpList done;
+        
+        for (size_t i = 0; i < node->structureSet().size() - 1; ++i) {
+            done.append(
+                m_jit.branchWeakStructure(JITCompiler::Equal, structureGPR, node->structureSet()[i]));
+        }
+        
+        speculationCheck(
+            BadCache, JSValueSource::unboxedCell(cellGPR), 0,
+            m_jit.branchWeakStructure(
+                JITCompiler::NotEqual, structureGPR, node->structureSet().last()));
+        
+        done.link(&m_jit);
+    }
+}
+
+void SpeculativeJIT::compileCheckStructure(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case CellUse:
+    case KnownCellUse: {
+        SpeculateCellOperand cell(this, node->child1());
+        compileCheckStructure(node, cell.gpr(), InvalidGPRReg);
+        noResult(node);
+        return;
+    }
+
+    case CellOrOtherUse: {
+        JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
+        GPRTemporary temp(this);
+
+        JSValueRegs valueRegs = value.jsValueRegs();
+        GPRReg tempGPR = temp.gpr();
+
+        JITCompiler::Jump cell = m_jit.branchIfCell(valueRegs);
+        DFG_TYPE_CHECK(
+            valueRegs, node->child1(), SpecCell | SpecOther,
+            m_jit.branchIfNotOther(valueRegs, tempGPR));
+        JITCompiler::Jump done = m_jit.jump();
+        cell.link(&m_jit);
+        compileCheckStructure(node, valueRegs.payloadGPR(), tempGPR);
+        done.link(&m_jit);
+        noResult(node);
+        return;
+    }
+
+    default:
+        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        return;
+    }
+}
+
+void SpeculativeJIT::compileAllocatePropertyStorage(Node* node)
+{
+    ASSERT(!node->transition()->previous->outOfLineCapacity());
+    ASSERT(initialOutOfLineCapacity == node->transition()->next->outOfLineCapacity());
+    
+    size_t size = initialOutOfLineCapacity * sizeof(JSValue);
+
+    MarkedAllocator* allocator = m_jit.vm()->auxiliarySpace.allocatorFor(size);
+
+    if (!allocator || node->transition()->previous->couldHaveIndexingHeader()) {
+        SpeculateCellOperand base(this, node->child1());
+        
+        GPRReg baseGPR = base.gpr();
+        
+        flushRegisters();
+
+        GPRFlushedCallResult result(this);
+        callOperation(operationAllocateComplexPropertyStorageWithInitialCapacity, result.gpr(), baseGPR);
+        m_jit.exceptionCheck();
+        
+        storageResult(result.gpr(), node);
+        return;
+    }
+    
+    GPRTemporary scratch1(this);
+    GPRTemporary scratch2(this);
+    GPRTemporary scratch3(this);
+        
+    GPRReg scratchGPR1 = scratch1.gpr();
+    GPRReg scratchGPR2 = scratch2.gpr();
+    GPRReg scratchGPR3 = scratch3.gpr();
+        
+    m_jit.move(TrustedImmPtr(allocator), scratchGPR2);
+    JITCompiler::JumpList slowPath;
+    m_jit.emitAllocate(scratchGPR1, allocator, scratchGPR2, scratchGPR3, slowPath);
+    m_jit.addPtr(JITCompiler::TrustedImm32(size + sizeof(IndexingHeader)), scratchGPR1);
+    
+    for (ptrdiff_t offset = 0; offset < static_cast<ptrdiff_t>(size); offset += sizeof(void*))
+        m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(scratchGPR1, -(offset + sizeof(JSValue) + sizeof(void*))));
+        
+    addSlowPathGenerator(
+        slowPathCall(slowPath, this, operationAllocateSimplePropertyStorageWithInitialCapacity, scratchGPR1));
+
+    storageResult(scratchGPR1, node);
+}
+
+void SpeculativeJIT::compileReallocatePropertyStorage(Node* node)
+{
+    size_t oldSize = node->transition()->previous->outOfLineCapacity() * sizeof(JSValue);
+    size_t newSize = oldSize * outOfLineGrowthFactor;
+    ASSERT(newSize == node->transition()->next->outOfLineCapacity() * sizeof(JSValue));
+    
+    MarkedAllocator* allocator = m_jit.vm()->auxiliarySpace.allocatorFor(newSize);
+
+    if (!allocator || node->transition()->previous->couldHaveIndexingHeader()) {
+        SpeculateCellOperand base(this, node->child1());
+        
+        GPRReg baseGPR = base.gpr();
+        
+        flushRegisters();
+
+        GPRFlushedCallResult result(this);
+        callOperation(operationAllocateComplexPropertyStorage, result.gpr(), baseGPR, newSize / sizeof(JSValue));
+        m_jit.exceptionCheck();
+
+        storageResult(result.gpr(), node);
+        return;
+    }
+    
+    StorageOperand oldStorage(this, node->child2());
+    GPRTemporary scratch1(this);
+    GPRTemporary scratch2(this);
+    GPRTemporary scratch3(this);
+        
+    GPRReg oldStorageGPR = oldStorage.gpr();
+    GPRReg scratchGPR1 = scratch1.gpr();
+    GPRReg scratchGPR2 = scratch2.gpr();
+    GPRReg scratchGPR3 = scratch3.gpr();
+    
+    JITCompiler::JumpList slowPath;
+    m_jit.move(TrustedImmPtr(allocator), scratchGPR2);
+    m_jit.emitAllocate(scratchGPR1, allocator, scratchGPR2, scratchGPR3, slowPath);
+    
+    m_jit.addPtr(JITCompiler::TrustedImm32(newSize + sizeof(IndexingHeader)), scratchGPR1);
+        
+    for (ptrdiff_t offset = oldSize; offset < static_cast<ptrdiff_t>(newSize); offset += sizeof(void*))
+        m_jit.storePtr(TrustedImmPtr(0), JITCompiler::Address(scratchGPR1, -(offset + sizeof(JSValue) + sizeof(void*))));
+
+    addSlowPathGenerator(
+        slowPathCall(slowPath, this, operationAllocateSimplePropertyStorage, scratchGPR1, newSize / sizeof(JSValue)));
+
+    // We have scratchGPR1 = new storage, scratchGPR2 = scratch
+    for (ptrdiff_t offset = 0; offset < static_cast<ptrdiff_t>(oldSize); offset += sizeof(void*)) {
+        m_jit.loadPtr(JITCompiler::Address(oldStorageGPR, -(offset + sizeof(JSValue) + sizeof(void*))), scratchGPR2);
+        m_jit.storePtr(scratchGPR2, JITCompiler::Address(scratchGPR1, -(offset + sizeof(JSValue) + sizeof(void*))));
+    }
+        
+    storageResult(scratchGPR1, node);
+}
+
+void SpeculativeJIT::compileNukeStructureAndSetButterfly(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    StorageOperand storage(this, node->child2());
+    
+    GPRReg baseGPR = base.gpr();
+    GPRReg storageGPR = storage.gpr();
+    
+    m_jit.nukeStructureAndStoreButterfly(storageGPR, baseGPR);
+    
+    noResult(node);
+}
+
+void SpeculativeJIT::compileGetButterfly(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    GPRTemporary result(this, Reuse, base);
+    
+    GPRReg baseGPR = base.gpr();
+    GPRReg resultGPR = result.gpr();
+    
+    m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::butterflyOffset()), resultGPR);
+
+    storageResult(resultGPR, node);
+}
+
+static void allocateTemporaryRegistersForPatchpoint(SpeculativeJIT* jit, Vector<GPRTemporary>& gpHolders, Vector<FPRTemporary>& fpHolders, Vector<GPRReg>& gpScratch, Vector<FPRReg>& fpScratch, DOMJIT::Patchpoint& patchpoint)
+{
+    for (unsigned i = 0; i < patchpoint.numGPScratchRegisters; ++i) {
+        GPRTemporary temporary(jit);
+        gpScratch.append(temporary.gpr());
+        gpHolders.append(WTFMove(temporary));
+    }
+
+    for (unsigned i = 0; i < patchpoint.numFPScratchRegisters; ++i) {
+        FPRTemporary temporary(jit);
+        fpScratch.append(temporary.fpr());
+        fpHolders.append(WTFMove(temporary));
+    }
+}
+
+void SpeculativeJIT::compileCallDOM(Node* node)
+{
+    const DOMJIT::Signature* signature = node->signature();
+
+    // FIXME: We should have a way to call functions with the vector of registers.
+    // https://bugs.webkit.org/show_bug.cgi?id=163099
+    Vector<Variant<SpeculateCellOperand, SpeculateInt32Operand, SpeculateBooleanOperand>, JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS_INCLUDING_THIS> operands;
+    Vector<GPRReg, JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS_INCLUDING_THIS> regs;
+
+    auto appendCell = [&](Edge& edge) {
+        SpeculateCellOperand operand(this, edge);
+        regs.append(operand.gpr());
+        operands.append(WTFMove(operand));
+    };
+
+    auto appendString = [&](Edge& edge) {
+        SpeculateCellOperand operand(this, edge);
+        GPRReg gpr = operand.gpr();
+        regs.append(gpr);
+        speculateString(edge, gpr);
+        operands.append(WTFMove(operand));
+    };
+
+    auto appendInt32 = [&](Edge& edge) {
+        SpeculateInt32Operand operand(this, edge);
+        regs.append(operand.gpr());
+        operands.append(WTFMove(operand));
+    };
+
+    auto appendBoolean = [&](Edge& edge) {
+        SpeculateBooleanOperand operand(this, edge);
+        regs.append(operand.gpr());
+        operands.append(WTFMove(operand));
+    };
+
+    unsigned index = 0;
+    m_jit.graph().doToChildren(node, [&](Edge edge) {
+        if (!index)
+            appendCell(edge);
+        else {
+            switch (signature->arguments[index - 1]) {
+            case SpecString:
+                appendString(edge);
+                break;
+            case SpecInt32Only:
+                appendInt32(edge);
+                break;
+            case SpecBoolean:
+                appendBoolean(edge);
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+        }
+        ++index;
+    });
+
+    JSValueRegsTemporary result(this);
+    JSValueRegs resultRegs = result.regs();
+
+    flushRegisters();
+    unsigned argumentCountIncludingThis = signature->argumentCount + 1;
+    switch (argumentCountIncludingThis) {
+    case 1:
+        callOperation(reinterpret_cast<J_JITOperation_EP>(signature->unsafeFunction), extractResult(resultRegs), regs[0]);
+        break;
+    case 2:
+        callOperation(reinterpret_cast<J_JITOperation_EPP>(signature->unsafeFunction), extractResult(resultRegs), regs[0], regs[1]);
+        break;
+    case 3:
+        callOperation(reinterpret_cast<J_JITOperation_EPPP>(signature->unsafeFunction), extractResult(resultRegs), regs[0], regs[1], regs[2]);
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+
+    m_jit.exceptionCheck();
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compileCallDOMGetter(Node* node)
+{
+    DOMJIT::CallDOMGetterPatchpoint* patchpoint = node->callDOMGetterData()->patchpoint;
+
+    Vector<GPRReg> gpScratch;
+    Vector<FPRReg> fpScratch;
+    Vector<DOMJIT::Value> regs;
+
+    JSValueRegsTemporary result(this);
+    regs.append(result.regs());
+
+    Edge& baseEdge = node->child1();
+    SpeculateCellOperand base(this, baseEdge);
+    regs.append(DOMJIT::Value(base.gpr(), m_state.forNode(baseEdge).value()));
+
+    std::optional<SpeculateCellOperand> globalObject;
+    if (patchpoint->requireGlobalObject) {
+        Edge& globalObjectEdge = node->child2();
+        globalObject.emplace(this, globalObjectEdge);
+        regs.append(DOMJIT::Value(globalObject->gpr(), m_state.forNode(globalObjectEdge).value()));
+    }
+
+    Vector<GPRTemporary> gpTempraries;
+    Vector<FPRTemporary> fpTempraries;
+    allocateTemporaryRegistersForPatchpoint(this, gpTempraries, fpTempraries, gpScratch, fpScratch, *patchpoint);
+    DOMJITPatchpointParams params(this, WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
+    patchpoint->generator()->run(m_jit, params);
+    jsValueResult(result.regs(), node);
+}
+
+void SpeculativeJIT::compileCheckDOM(Node* node)
+{
+    // FIXME: We can add the fallback implementation that inlines jsDynamicCast things here.
+    DOMJIT::Patchpoint* patchpoint = node->checkDOMPatchpoint();
+
+    Vector<GPRReg> gpScratch;
+    Vector<FPRReg> fpScratch;
+    Vector<DOMJIT::Value> regs;
+
+    SpeculateCellOperand base(this, node->child1());
+    GPRReg baseGPR = base.gpr();
+    regs.append(DOMJIT::Value(baseGPR, m_state.forNode(node->child1()).value()));
+
+    Vector<GPRTemporary> gpTempraries;
+    Vector<FPRTemporary> fpTempraries;
+    allocateTemporaryRegistersForPatchpoint(this, gpTempraries, fpTempraries, gpScratch, fpScratch, *patchpoint);
+
+    DOMJITPatchpointParams params(this, WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
+    CCallHelpers::JumpList failureCases = patchpoint->generator()->run(m_jit, params);
+    speculationCheck(BadType, JSValueSource::unboxedCell(baseGPR), node->child1(), failureCases);
+    noResult(node);
+}
+
+GPRReg SpeculativeJIT::temporaryRegisterForPutByVal(GPRTemporary& temporary, ArrayMode arrayMode)
+{
+    if (!putByValWillNeedExtraRegister(arrayMode))
+        return InvalidGPRReg;
+    
+    GPRTemporary realTemporary(this);
+    temporary.adopt(realTemporary);
+    return temporary.gpr();
+}
+
+void SpeculativeJIT::compileToStringOrCallStringConstructorOnCell(Node* node)
+{
+    SpeculateCellOperand op1(this, node->child1());
+    GPRReg op1GPR = op1.gpr();
+    
+    switch (node->child1().useKind()) {
+    case StringObjectUse: {
+        GPRTemporary result(this);
+        GPRReg resultGPR = result.gpr();
+        
+        speculateStringObject(node->child1(), op1GPR);
+        m_interpreter.filter(node->child1(), SpecStringObject);
+
+        m_jit.loadPtr(JITCompiler::Address(op1GPR, JSWrapperObject::internalValueCellOffset()), resultGPR);
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case StringOrStringObjectUse: {
+        GPRTemporary result(this);
+        GPRReg resultGPR = result.gpr();
+
+        m_jit.load32(JITCompiler::Address(op1GPR, JSCell::structureIDOffset()), resultGPR);
+        JITCompiler::Jump isString = m_jit.branchWeakStructure(
+            JITCompiler::Equal,
+            resultGPR,
+            m_jit.graph().registerStructure(m_jit.vm()->stringStructure.get()));
+
+        speculateStringObjectForStructure(node->child1(), resultGPR);
+        
+        m_jit.loadPtr(JITCompiler::Address(op1GPR, JSWrapperObject::internalValueCellOffset()), resultGPR);
+        
+        JITCompiler::Jump done = m_jit.jump();
+        isString.link(&m_jit);
+        m_jit.move(op1GPR, resultGPR);
+        done.link(&m_jit);
+        
+        m_interpreter.filter(node->child1(), SpecString | SpecStringObject);
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case CellUse: {
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+        
+        // We flush registers instead of silent spill/fill because in this mode we
+        // believe that most likely the input is not a string, and we need to take
+        // slow path.
+        flushRegisters();
+        JITCompiler::Jump done;
+        if (node->child1()->prediction() & SpecString) {
+            JITCompiler::Jump needCall = m_jit.branchIfNotString(op1GPR);
+            m_jit.move(op1GPR, resultGPR);
+            done = m_jit.jump();
+            needCall.link(&m_jit);
+        }
+        if (node->op() == ToString)
+            callOperation(operationToStringOnCell, resultGPR, op1GPR);
+        else {
+            ASSERT(node->op() == CallStringConstructor);
+            callOperation(operationCallStringConstructorOnCell, resultGPR, op1GPR);
+        }
+        m_jit.exceptionCheck();
+        if (done.isSet())
+            done.link(&m_jit);
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+
+void SpeculativeJIT::compileNewStringObject(Node* node)
+{
+    SpeculateCellOperand operand(this, node->child1());
+    
+    GPRTemporary result(this);
+    GPRTemporary scratch1(this);
+    GPRTemporary scratch2(this);
+
+    GPRReg operandGPR = operand.gpr();
+    GPRReg resultGPR = result.gpr();
+    GPRReg scratch1GPR = scratch1.gpr();
+    GPRReg scratch2GPR = scratch2.gpr();
+    
+    JITCompiler::JumpList slowPath;
+    
+    emitAllocateJSObject<StringObject>(
+        resultGPR, TrustedImmPtr(node->structure()), TrustedImmPtr(0), scratch1GPR, scratch2GPR,
+        slowPath);
+    
+    m_jit.storePtr(
+        TrustedImmPtr(StringObject::info()),
+        JITCompiler::Address(resultGPR, JSDestructibleObject::classInfoOffset()));
+#if USE(JSVALUE64)
+    m_jit.store64(
+        operandGPR, JITCompiler::Address(resultGPR, JSWrapperObject::internalValueOffset()));
+#else
+    m_jit.store32(
+        TrustedImm32(JSValue::CellTag),
+        JITCompiler::Address(resultGPR, JSWrapperObject::internalValueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+    m_jit.store32(
+        operandGPR,
+        JITCompiler::Address(resultGPR, JSWrapperObject::internalValueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+#endif
+    
+    m_jit.mutatorFence();
+    
+    addSlowPathGenerator(slowPathCall(
+        slowPath, this, operationNewStringObject, resultGPR, operandGPR, node->structure()));
+    
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileNewTypedArray(Node* node)
+{
+    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    TypedArrayType type = node->typedArrayType();
+    RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(type));
+    RELEASE_ASSERT(structure.get());
+    
+    SpeculateInt32Operand size(this, node->child1());
+    GPRReg sizeGPR = size.gpr();
+    
+    GPRTemporary result(this);
+    GPRTemporary storage(this);
+    GPRTemporary scratch(this);
+    GPRTemporary scratch2(this);
+    GPRReg resultGPR = result.gpr();
+    GPRReg storageGPR = storage.gpr();
+    GPRReg scratchGPR = scratch.gpr();
+    GPRReg scratchGPR2 = scratch2.gpr();
+    
+    JITCompiler::JumpList slowCases;
+    
+    m_jit.move(TrustedImmPtr(0), storageGPR);
+
+    slowCases.append(m_jit.branch32(
+        MacroAssembler::Above, sizeGPR, TrustedImm32(JSArrayBufferView::fastSizeLimit)));
+    slowCases.append(m_jit.branchTest32(MacroAssembler::Zero, sizeGPR));
+    
+    m_jit.move(sizeGPR, scratchGPR);
+    m_jit.lshift32(TrustedImm32(logElementSize(type)), scratchGPR);
+    if (elementSize(type) < 8) {
+        m_jit.add32(TrustedImm32(7), scratchGPR);
+        m_jit.and32(TrustedImm32(~7), scratchGPR);
+    }
+    m_jit.emitAllocateVariableSized(
+        storageGPR, m_jit.vm()->auxiliarySpace, scratchGPR, scratchGPR,
+        scratchGPR2, slowCases);
+    
+    MacroAssembler::Jump done = m_jit.branchTest32(MacroAssembler::Zero, sizeGPR);
+    m_jit.move(sizeGPR, scratchGPR);
+    if (elementSize(type) != 4) {
+        if (elementSize(type) > 4)
+            m_jit.lshift32(TrustedImm32(logElementSize(type) - 2), scratchGPR);
+        else {
+            if (elementSize(type) > 1)
+                m_jit.lshift32(TrustedImm32(logElementSize(type)), scratchGPR);
+            m_jit.add32(TrustedImm32(3), scratchGPR);
+            m_jit.urshift32(TrustedImm32(2), scratchGPR);
+        }
+    }
+    MacroAssembler::Label loop = m_jit.label();
+    m_jit.sub32(TrustedImm32(1), scratchGPR);
+    m_jit.store32(
+        TrustedImm32(0),
+        MacroAssembler::BaseIndex(storageGPR, scratchGPR, MacroAssembler::TimesFour));
+    m_jit.branchTest32(MacroAssembler::NonZero, scratchGPR).linkTo(loop, &m_jit);
+    done.link(&m_jit);
+    
+    emitAllocateJSObject<JSArrayBufferView>(
+        resultGPR, TrustedImmPtr(structure), TrustedImmPtr(0), scratchGPR, scratchGPR2,
+        slowCases);
+    
+    m_jit.storePtr(
+        storageGPR,
+        MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfVector()));
+    m_jit.store32(
+        sizeGPR,
+        MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfLength()));
+    m_jit.store32(
+        TrustedImm32(FastTypedArray),
+        MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfMode()));
+    
+    m_jit.mutatorFence();
+    
+    addSlowPathGenerator(slowPathCall(
+        slowCases, this, operationNewTypedArrayWithSizeForType(type),
+        resultGPR, structure, sizeGPR, storageGPR));
+    
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::speculateCellTypeWithoutTypeFiltering(
+    Edge edge, GPRReg cellGPR, JSType jsType)
+{
+    speculationCheck(
+        BadType, JSValueSource::unboxedCell(cellGPR), edge,
+        m_jit.branch8(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(cellGPR, JSCell::typeInfoTypeOffset()),
+            MacroAssembler::TrustedImm32(jsType)));
+}
+
+void SpeculativeJIT::speculateCellType(
+    Edge edge, GPRReg cellGPR, SpeculatedType specType, JSType jsType)
+{
+    DFG_TYPE_CHECK(
+        JSValueSource::unboxedCell(cellGPR), edge, specType,
+        m_jit.branch8(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(cellGPR, JSCell::typeInfoTypeOffset()),
+            TrustedImm32(jsType)));
+}
+
+void SpeculativeJIT::speculateInt32(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecInt32Only))
+        return;
+    
+    (SpeculateInt32Operand(this, edge)).gpr();
+}
+
+void SpeculativeJIT::speculateNumber(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecBytecodeNumber))
+        return;
+    
+    JSValueOperand value(this, edge, ManualOperandSpeculation);
+#if USE(JSVALUE64)
+    GPRReg gpr = value.gpr();
+    typeCheck(
+        JSValueRegs(gpr), edge, SpecBytecodeNumber,
+        m_jit.branchTest64(MacroAssembler::Zero, gpr, GPRInfo::tagTypeNumberRegister));
+#else
+    GPRReg tagGPR = value.tagGPR();
+    DFG_TYPE_CHECK(
+        value.jsValueRegs(), edge, ~SpecInt32Only,
+        m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag)));
+    DFG_TYPE_CHECK(
+        value.jsValueRegs(), edge, SpecBytecodeNumber,
+        m_jit.branch32(MacroAssembler::AboveOrEqual, tagGPR, TrustedImm32(JSValue::LowestTag)));
+#endif
+}
+
+void SpeculativeJIT::speculateRealNumber(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecBytecodeRealNumber))
+        return;
+    
+    JSValueOperand op1(this, edge, ManualOperandSpeculation);
+    FPRTemporary result(this);
+    
+    JSValueRegs op1Regs = op1.jsValueRegs();
+    FPRReg resultFPR = result.fpr();
+    
+#if USE(JSVALUE64)
+    GPRTemporary temp(this);
+    GPRReg tempGPR = temp.gpr();
+    m_jit.unboxDoubleWithoutAssertions(op1Regs.gpr(), tempGPR, resultFPR);
+#else
+    FPRTemporary temp(this);
+    FPRReg tempFPR = temp.fpr();
+    unboxDouble(op1Regs.tagGPR(), op1Regs.payloadGPR(), resultFPR, tempFPR);
+#endif
+    
+    JITCompiler::Jump done = m_jit.branchDouble(
+        JITCompiler::DoubleEqual, resultFPR, resultFPR);
+
+    typeCheck(op1Regs, edge, SpecBytecodeRealNumber, m_jit.branchIfNotInt32(op1Regs));
+    
+    done.link(&m_jit);
+}
+
+void SpeculativeJIT::speculateDoubleRepReal(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecDoubleReal))
+        return;
+    
+    SpeculateDoubleOperand operand(this, edge);
+    FPRReg fpr = operand.fpr();
+    typeCheck(
+        JSValueRegs(), edge, SpecDoubleReal,
+        m_jit.branchDouble(
+            MacroAssembler::DoubleNotEqualOrUnordered, fpr, fpr));
+}
+
+void SpeculativeJIT::speculateBoolean(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecBoolean))
+        return;
+    
+    (SpeculateBooleanOperand(this, edge)).gpr();
+}
+
+void SpeculativeJIT::speculateCell(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecCell))
+        return;
+    
+    (SpeculateCellOperand(this, edge)).gpr();
+}
+
+void SpeculativeJIT::speculateCellOrOther(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecCell | SpecOther))
+        return;
+    
+    JSValueOperand operand(this, edge, ManualOperandSpeculation);
+    GPRTemporary temp(this);
+    GPRReg tempGPR = temp.gpr();
+
+    MacroAssembler::Jump ok = m_jit.branchIfCell(operand.jsValueRegs());
+    DFG_TYPE_CHECK(
+        operand.jsValueRegs(), edge, SpecCell | SpecOther,
+        m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
+    ok.link(&m_jit);
+}
+
+void SpeculativeJIT::speculateObject(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecObject))
+        return;
+    
+    SpeculateCellOperand operand(this, edge);
+    GPRReg gpr = operand.gpr();
+    DFG_TYPE_CHECK(
+        JSValueSource::unboxedCell(gpr), edge, SpecObject, m_jit.branchIfNotObject(gpr));
+}
+
+void SpeculativeJIT::speculateFunction(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecFunction))
+        return;
+    
+    SpeculateCellOperand operand(this, edge);
+    speculateCellType(edge, operand.gpr(), SpecFunction, JSFunctionType);
+}
+
+void SpeculativeJIT::speculateFinalObject(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecFinalObject))
+        return;
+    
+    SpeculateCellOperand operand(this, edge);
+    speculateCellType(edge, operand.gpr(), SpecFinalObject, FinalObjectType);
+}
+
+void SpeculativeJIT::speculateRegExpObject(Edge edge, GPRReg cell)
+{
+    speculateCellType(edge, cell, SpecRegExpObject, RegExpObjectType);
+}
+
+void SpeculativeJIT::speculateRegExpObject(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecRegExpObject))
+        return;
+    
+    SpeculateCellOperand operand(this, edge);
+    speculateRegExpObject(edge, operand.gpr());
+}
+
+void SpeculativeJIT::speculateArray(Edge edge, GPRReg cell)
+{
+    speculateCellType(edge, cell, SpecArray, ArrayType);
+}
+
+void SpeculativeJIT::speculateArray(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecArray))
+        return;
+
+    SpeculateCellOperand operand(this, edge);
+    speculateArray(edge, operand.gpr());
+}
+
+void SpeculativeJIT::speculateProxyObject(Edge edge, GPRReg cell)
+{
+    speculateCellType(edge, cell, SpecProxyObject, ProxyObjectType);
+}
+
+void SpeculativeJIT::speculateProxyObject(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecProxyObject))
+        return;
+
+    SpeculateCellOperand operand(this, edge);
+    speculateProxyObject(edge, operand.gpr());
+}
+
+void SpeculativeJIT::speculateDerivedArray(Edge edge, GPRReg cell)
+{
+    speculateCellType(edge, cell, SpecDerivedArray, DerivedArrayType);
+}
+
+void SpeculativeJIT::speculateDerivedArray(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecDerivedArray))
+        return;
+
+    SpeculateCellOperand operand(this, edge);
+    speculateDerivedArray(edge, operand.gpr());
+}
+
+void SpeculativeJIT::speculateMapObject(Edge edge, GPRReg cell)
+{
+    speculateCellType(edge, cell, SpecMapObject, JSMapType);
+}
+
+void SpeculativeJIT::speculateMapObject(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecMapObject))
+        return;
+
+    SpeculateCellOperand operand(this, edge);
+    speculateMapObject(edge, operand.gpr());
+}
+
+void SpeculativeJIT::speculateSetObject(Edge edge, GPRReg cell)
+{
+    speculateCellType(edge, cell, SpecSetObject, JSSetType);
+}
+
+void SpeculativeJIT::speculateSetObject(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecSetObject))
+        return;
+
+    SpeculateCellOperand operand(this, edge);
+    speculateSetObject(edge, operand.gpr());
+}
+
+void SpeculativeJIT::speculateObjectOrOther(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecObject | SpecOther))
+        return;
+    
+    JSValueOperand operand(this, edge, ManualOperandSpeculation);
+    GPRTemporary temp(this);
+    GPRReg tempGPR = temp.gpr();
+    MacroAssembler::Jump notCell = m_jit.branchIfNotCell(operand.jsValueRegs());
+    GPRReg gpr = operand.jsValueRegs().payloadGPR();
+    DFG_TYPE_CHECK(
+        operand.jsValueRegs(), edge, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(gpr));
+    MacroAssembler::Jump done = m_jit.jump();
+    notCell.link(&m_jit);
+    DFG_TYPE_CHECK(
+        operand.jsValueRegs(), edge, SpecCell | SpecOther,
+        m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
+    done.link(&m_jit);
+}
+
+void SpeculativeJIT::speculateString(Edge edge, GPRReg cell)
+{
+    DFG_TYPE_CHECK(
+        JSValueSource::unboxedCell(cell), edge, SpecString | ~SpecCell, m_jit.branchIfNotString(cell));
+}
+
+void SpeculativeJIT::speculateStringOrOther(Edge edge, JSValueRegs regs, GPRReg scratch)
+{
+    JITCompiler::Jump notCell = m_jit.branchIfNotCell(regs);
+    GPRReg cell = regs.payloadGPR();
+    DFG_TYPE_CHECK(regs, edge, (~SpecCell) | SpecString, m_jit.branchIfNotString(cell));
+    JITCompiler::Jump done = m_jit.jump();
+    notCell.link(&m_jit);
+    DFG_TYPE_CHECK(regs, edge, SpecCell | SpecOther, m_jit.branchIfNotOther(regs, scratch));
+    done.link(&m_jit);
+}
+
+void SpeculativeJIT::speculateStringOrOther(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecString | SpecOther))
+        return;
+
+    JSValueOperand operand(this, edge, ManualOperandSpeculation);
+    GPRTemporary temp(this);
+    JSValueRegs regs = operand.jsValueRegs();
+    GPRReg tempGPR = temp.gpr();
+    speculateStringOrOther(edge, regs, tempGPR);
+}
+
+void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage)
+{
+    m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), storage);
+    
+    if (!needsTypeCheck(edge, SpecStringIdent | ~SpecString))
+        return;
+
+    speculationCheck(
+        BadType, JSValueSource::unboxedCell(string), edge,
+        m_jit.branchTestPtr(MacroAssembler::Zero, storage));
+    speculationCheck(
+        BadType, JSValueSource::unboxedCell(string), edge, m_jit.branchTest32(
+            MacroAssembler::Zero,
+            MacroAssembler::Address(storage, StringImpl::flagsOffset()),
+            MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic())));
+    
+    m_interpreter.filter(edge, SpecStringIdent | ~SpecString);
+}
+
+void SpeculativeJIT::speculateStringIdent(Edge edge, GPRReg string)
+{
+    if (!needsTypeCheck(edge, SpecStringIdent))
+        return;
+
+    GPRTemporary temp(this);
+    speculateStringIdentAndLoadStorage(edge, string, temp.gpr());
+}
+
+void SpeculativeJIT::speculateStringIdent(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecStringIdent))
+        return;
+    
+    SpeculateCellOperand operand(this, edge);
+    GPRReg gpr = operand.gpr();
+    speculateString(edge, gpr);
+    speculateStringIdent(edge, gpr);
+}
+
+void SpeculativeJIT::speculateString(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecString))
+        return;
+    
+    SpeculateCellOperand operand(this, edge);
+    speculateString(edge, operand.gpr());
+}
+
+void SpeculativeJIT::speculateStringObject(Edge edge, GPRReg gpr)
+{
+    speculateStringObjectForStructure(edge, JITCompiler::Address(gpr, JSCell::structureIDOffset()));
+}
+
+void SpeculativeJIT::speculateStringObject(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecStringObject))
+        return;
+    
+    SpeculateCellOperand operand(this, edge);
+    GPRReg gpr = operand.gpr();
+    if (!needsTypeCheck(edge, SpecStringObject))
+        return;
+    
+    speculateStringObject(edge, gpr);
+    m_interpreter.filter(edge, SpecStringObject);
+}
+
+void SpeculativeJIT::speculateStringOrStringObject(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecString | SpecStringObject))
+        return;
+    
+    SpeculateCellOperand operand(this, edge);
+    GPRReg gpr = operand.gpr();
+    if (!needsTypeCheck(edge, SpecString | SpecStringObject))
+        return;
+
+    GPRTemporary structureID(this);
+    GPRReg structureIDGPR = structureID.gpr();
+
+    m_jit.load32(JITCompiler::Address(gpr, JSCell::structureIDOffset()), structureIDGPR); 
+    JITCompiler::Jump isString = m_jit.branchWeakStructure(
+        JITCompiler::Equal,
+        structureIDGPR, 
+        m_jit.graph().registerStructure(m_jit.vm()->stringStructure.get()));
+    
+    speculateStringObjectForStructure(edge, structureIDGPR);
+    
+    isString.link(&m_jit);
+    
+    m_interpreter.filter(edge, SpecString | SpecStringObject);
+}
+
+void SpeculativeJIT::speculateNotStringVar(Edge edge)
+{
+    JSValueOperand operand(this, edge, ManualOperandSpeculation);
+    GPRTemporary temp(this);
+    GPRReg tempGPR = temp.gpr();
+    
+    JITCompiler::Jump notCell = m_jit.branchIfNotCell(operand.jsValueRegs());
+    GPRReg cell = operand.jsValueRegs().payloadGPR();
+    
+    JITCompiler::Jump notString = m_jit.branchIfNotString(cell);
+    
+    speculateStringIdentAndLoadStorage(edge, cell, tempGPR);
+    
+    notString.link(&m_jit);
+    notCell.link(&m_jit);
+}
+
+void SpeculativeJIT::speculateSymbol(Edge edge, GPRReg cell)
+{
+    DFG_TYPE_CHECK(JSValueSource::unboxedCell(cell), edge, SpecSymbol, m_jit.branchIfNotSymbol(cell));
+}
+
+void SpeculativeJIT::speculateSymbol(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecSymbol))
+        return;
+
+    SpeculateCellOperand operand(this, edge);
+    speculateSymbol(edge, operand.gpr());
+}
+
+void SpeculativeJIT::speculateNotCell(Edge edge)
+{
+    if (!needsTypeCheck(edge, ~SpecCell))
+        return;
+    
+    JSValueOperand operand(this, edge, ManualOperandSpeculation); 
+    typeCheck(operand.jsValueRegs(), edge, ~SpecCell, m_jit.branchIfCell(operand.jsValueRegs()));
+}
+
+void SpeculativeJIT::speculateOther(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecOther))
+        return;
+    
+    JSValueOperand operand(this, edge, ManualOperandSpeculation);
+    GPRTemporary temp(this);
+    GPRReg tempGPR = temp.gpr();
+    typeCheck(
+        operand.jsValueRegs(), edge, SpecOther,
+        m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
+}
+
+void SpeculativeJIT::speculateMisc(Edge edge, JSValueRegs regs)
+{
+#if USE(JSVALUE64)
+    DFG_TYPE_CHECK(
+        regs, edge, SpecMisc,
+        m_jit.branch64(MacroAssembler::Above, regs.gpr(), MacroAssembler::TrustedImm64(TagBitTypeOther | TagBitBool | TagBitUndefined)));
+#else
+    DFG_TYPE_CHECK(
+        regs, edge, ~SpecInt32Only,
+        m_jit.branch32(MacroAssembler::Equal, regs.tagGPR(), MacroAssembler::TrustedImm32(JSValue::Int32Tag)));
+    DFG_TYPE_CHECK(
+        regs, edge, SpecMisc,
+        m_jit.branch32(MacroAssembler::Below, regs.tagGPR(), MacroAssembler::TrustedImm32(JSValue::UndefinedTag)));
+#endif
+}
+
+void SpeculativeJIT::speculateMisc(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecMisc))
+        return;
+    
+    JSValueOperand operand(this, edge, ManualOperandSpeculation);
+    speculateMisc(edge, operand.jsValueRegs());
+}
+
+void SpeculativeJIT::speculate(Node*, Edge edge)
+{
+    switch (edge.useKind()) {
+    case UntypedUse:
+        break;
+    case KnownInt32Use:
+        ASSERT(!needsTypeCheck(edge, SpecInt32Only));
+        break;
+    case DoubleRepUse:
+        ASSERT(!needsTypeCheck(edge, SpecFullDouble));
+        break;
+    case Int52RepUse:
+        ASSERT(!needsTypeCheck(edge, SpecAnyInt));
+        break;
+    case KnownCellUse:
+        ASSERT(!needsTypeCheck(edge, SpecCell));
+        break;
+    case KnownStringUse:
+        ASSERT(!needsTypeCheck(edge, SpecString));
+        break;
+    case KnownPrimitiveUse:
+        ASSERT(!needsTypeCheck(edge, SpecHeapTop & ~SpecObject));
+        break;
+    case Int32Use:
+        speculateInt32(edge);
+        break;
+    case NumberUse:
+        speculateNumber(edge);
+        break;
+    case RealNumberUse:
+        speculateRealNumber(edge);
+        break;
+    case DoubleRepRealUse:
+        speculateDoubleRepReal(edge);
+        break;
+#if USE(JSVALUE64)
+    case AnyIntUse:
+        speculateAnyInt(edge);
+        break;
+    case DoubleRepAnyIntUse:
+        speculateDoubleRepAnyInt(edge);
+        break;
+#endif
+    case BooleanUse:
+        speculateBoolean(edge);
+        break;
+    case KnownBooleanUse:
+        ASSERT(!needsTypeCheck(edge, SpecBoolean));
+        break;
+    case CellUse:
+        speculateCell(edge);
+        break;
+    case CellOrOtherUse:
+        speculateCellOrOther(edge);
+        break;
+    case ObjectUse:
+        speculateObject(edge);
+        break;
+    case FunctionUse:
+        speculateFunction(edge);
+        break;
+    case ArrayUse:
+        speculateArray(edge);
+        break;
+    case FinalObjectUse:
+        speculateFinalObject(edge);
+        break;
+    case RegExpObjectUse:
+        speculateRegExpObject(edge);
+        break;
+    case ProxyObjectUse:
+        speculateProxyObject(edge);
+        break;
+    case DerivedArrayUse:
+        speculateDerivedArray(edge);
+        break;
+    case MapObjectUse:
+        speculateMapObject(edge);
+        break;
+    case SetObjectUse:
+        speculateSetObject(edge);
+        break;
+    case ObjectOrOtherUse:
+        speculateObjectOrOther(edge);
+        break;
+    case StringIdentUse:
+        speculateStringIdent(edge);
+        break;
+    case StringUse:
+        speculateString(edge);
+        break;
+    case StringOrOtherUse:
+        speculateStringOrOther(edge);
+        break;
+    case SymbolUse:
+        speculateSymbol(edge);
+        break;
+    case StringObjectUse:
+        speculateStringObject(edge);
+        break;
+    case StringOrStringObjectUse:
+        speculateStringOrStringObject(edge);
+        break;
+    case NotStringVarUse:
+        speculateNotStringVar(edge);
+        break;
+    case NotCellUse:
+        speculateNotCell(edge);
+        break;
+    case OtherUse:
+        speculateOther(edge);
+        break;
+    case MiscUse:
+        speculateMisc(edge);
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void SpeculativeJIT::emitSwitchIntJump(
+    SwitchData* data, GPRReg value, GPRReg scratch)
+{
+    SimpleJumpTable& table = m_jit.codeBlock()->switchJumpTable(data->switchTableIndex);
+    table.ensureCTITable();
+    m_jit.sub32(Imm32(table.min), value);
+    addBranch(
+        m_jit.branch32(JITCompiler::AboveOrEqual, value, Imm32(table.ctiOffsets.size())),
+        data->fallThrough.block);
+    m_jit.move(TrustedImmPtr(table.ctiOffsets.begin()), scratch);
+    m_jit.loadPtr(JITCompiler::BaseIndex(scratch, value, JITCompiler::timesPtr()), scratch);
+    m_jit.jump(scratch);
+    data->didUseJumpTable = true;
+}
+
+void SpeculativeJIT::emitSwitchImm(Node* node, SwitchData* data)
+{
+    switch (node->child1().useKind()) {
+    case Int32Use: {
+        SpeculateInt32Operand value(this, node->child1());
+        GPRTemporary temp(this);
+        emitSwitchIntJump(data, value.gpr(), temp.gpr());
+        noResult(node);
+        break;
+    }
+        
+    case UntypedUse: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary temp(this);
+        JSValueRegs valueRegs = value.jsValueRegs();
+        GPRReg scratch = temp.gpr();
+        
+        value.use();
+        
+#if USE(JSVALUE64)
+        JITCompiler::Jump notInt = m_jit.branch64(
+            JITCompiler::Below, valueRegs.gpr(), GPRInfo::tagTypeNumberRegister);
+        emitSwitchIntJump(data, valueRegs.gpr(), scratch);
+        notInt.link(&m_jit);
+        addBranch(
+            m_jit.branchTest64(
+                JITCompiler::Zero, valueRegs.gpr(), GPRInfo::tagTypeNumberRegister),
+            data->fallThrough.block);
+        silentSpillAllRegisters(scratch);
+        callOperation(operationFindSwitchImmTargetForDouble, scratch, valueRegs.gpr(), data->switchTableIndex);
+        silentFillAllRegisters(scratch);
+        m_jit.jump(scratch);
+#else
+        JITCompiler::Jump notInt = m_jit.branch32(
+            JITCompiler::NotEqual, valueRegs.tagGPR(), TrustedImm32(JSValue::Int32Tag));
+        emitSwitchIntJump(data, valueRegs.payloadGPR(), scratch);
+        notInt.link(&m_jit);
+        addBranch(
+            m_jit.branch32(
+                JITCompiler::AboveOrEqual, valueRegs.tagGPR(),
+                TrustedImm32(JSValue::LowestTag)),
+            data->fallThrough.block);
+        silentSpillAllRegisters(scratch);
+        callOperation(operationFindSwitchImmTargetForDouble, scratch, valueRegs, data->switchTableIndex);
+        silentFillAllRegisters(scratch);
+
+        m_jit.jump(scratch);
+#endif
+        noResult(node, UseChildrenCalledExplicitly);
+        break;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void SpeculativeJIT::emitSwitchCharStringJump(
+    SwitchData* data, GPRReg value, GPRReg scratch)
+{
+    addBranch(
+        m_jit.branch32(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(value, JSString::offsetOfLength()),
+            TrustedImm32(1)),
+        data->fallThrough.block);
+    
+    m_jit.loadPtr(MacroAssembler::Address(value, JSString::offsetOfValue()), scratch);
+    
+    addSlowPathGenerator(
+        slowPathCall(
+            m_jit.branchTestPtr(MacroAssembler::Zero, scratch),
+            this, operationResolveRope, scratch, value));
+    
+    m_jit.loadPtr(MacroAssembler::Address(scratch, StringImpl::dataOffset()), value);
+    
+    JITCompiler::Jump is8Bit = m_jit.branchTest32(
+        MacroAssembler::NonZero,
+        MacroAssembler::Address(scratch, StringImpl::flagsOffset()),
+        TrustedImm32(StringImpl::flagIs8Bit()));
+    
+    m_jit.load16(MacroAssembler::Address(value), scratch);
+    
+    JITCompiler::Jump ready = m_jit.jump();
+    
+    is8Bit.link(&m_jit);
+    m_jit.load8(MacroAssembler::Address(value), scratch);
+    
+    ready.link(&m_jit);
+    emitSwitchIntJump(data, scratch, value);
+}
+
+void SpeculativeJIT::emitSwitchChar(Node* node, SwitchData* data)
+{
+    switch (node->child1().useKind()) {
+    case StringUse: {
+        SpeculateCellOperand op1(this, node->child1());
+        GPRTemporary temp(this);
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg tempGPR = temp.gpr();
+        
+        op1.use();
+
+        speculateString(node->child1(), op1GPR);
+        emitSwitchCharStringJump(data, op1GPR, tempGPR);
+        noResult(node, UseChildrenCalledExplicitly);
+        break;
+    }
+        
+    case UntypedUse: {
+        JSValueOperand op1(this, node->child1());
+        GPRTemporary temp(this);
+        
+        JSValueRegs op1Regs = op1.jsValueRegs();
+        GPRReg tempGPR = temp.gpr();
+        
+        op1.use();
+        
+        addBranch(m_jit.branchIfNotCell(op1Regs), data->fallThrough.block);
+        
+        addBranch(m_jit.branchIfNotString(op1Regs.payloadGPR()), data->fallThrough.block);
+        
+        emitSwitchCharStringJump(data, op1Regs.payloadGPR(), tempGPR);
+        noResult(node, UseChildrenCalledExplicitly);
+        break;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+namespace {
+
+struct CharacterCase {
+    bool operator<(const CharacterCase& other) const
+    {
+        return character < other.character;
+    }
+    
+    LChar character;
+    unsigned begin;
+    unsigned end;
+};
+
+} // anonymous namespace
+
+void SpeculativeJIT::emitBinarySwitchStringRecurse(
+    SwitchData* data, const Vector<SpeculativeJIT::StringSwitchCase>& cases,
+    unsigned numChecked, unsigned begin, unsigned end, GPRReg buffer, GPRReg length,
+    GPRReg temp, unsigned alreadyCheckedLength, bool checkedExactLength)
+{
+    static const bool verbose = false;
+    
+    if (verbose) {
+        dataLog("We're down to the following cases, alreadyCheckedLength = ", alreadyCheckedLength, ":\n");
+        for (unsigned i = begin; i < end; ++i) {
+            dataLog("    ", cases[i].string, "\n");
+        }
+    }
+    
+    if (begin == end) {
+        jump(data->fallThrough.block, ForceJump);
+        return;
+    }
+    
+    unsigned minLength = cases[begin].string->length();
+    unsigned commonChars = minLength;
+    bool allLengthsEqual = true;
+    for (unsigned i = begin + 1; i < end; ++i) {
+        unsigned myCommonChars = numChecked;
+        for (unsigned j = numChecked;
+            j < std::min(cases[begin].string->length(), cases[i].string->length());
+            ++j) {
+            if (cases[begin].string->at(j) != cases[i].string->at(j)) {
+                if (verbose)
+                    dataLog("string(", cases[i].string, ")[", j, "] != string(", cases[begin].string, ")[", j, "]\n");
+                break;
+            }
+            myCommonChars++;
+        }
+        commonChars = std::min(commonChars, myCommonChars);
+        if (minLength != cases[i].string->length())
+            allLengthsEqual = false;
+        minLength = std::min(minLength, cases[i].string->length());
+    }
+    
+    if (checkedExactLength) {
+        RELEASE_ASSERT(alreadyCheckedLength == minLength);
+        RELEASE_ASSERT(allLengthsEqual);
+    }
+    
+    RELEASE_ASSERT(minLength >= commonChars);
+    
+    if (verbose)
+        dataLog("length = ", minLength, ", commonChars = ", commonChars, ", allLengthsEqual = ", allLengthsEqual, "\n");
+    
+    if (!allLengthsEqual && alreadyCheckedLength < minLength)
+        branch32(MacroAssembler::Below, length, Imm32(minLength), data->fallThrough.block);
+    if (allLengthsEqual && (alreadyCheckedLength < minLength || !checkedExactLength))
+        branch32(MacroAssembler::NotEqual, length, Imm32(minLength), data->fallThrough.block);
+    
+    for (unsigned i = numChecked; i < commonChars; ++i) {
+        branch8(
+            MacroAssembler::NotEqual, MacroAssembler::Address(buffer, i),
+            TrustedImm32(cases[begin].string->at(i)), data->fallThrough.block);
+    }
+    
+    if (minLength == commonChars) {
+        // This is the case where one of the cases is a prefix of all of the other cases.
+        // We've already checked that the input string is a prefix of all of the cases,
+        // so we just check length to jump to that case.
+        
+        if (!ASSERT_DISABLED) {
+            ASSERT(cases[begin].string->length() == commonChars);
+            for (unsigned i = begin + 1; i < end; ++i)
+                ASSERT(cases[i].string->length() > commonChars);
+        }
+        
+        if (allLengthsEqual) {
+            RELEASE_ASSERT(end == begin + 1);
+            jump(cases[begin].target, ForceJump);
+            return;
+        }
+        
+        branch32(MacroAssembler::Equal, length, Imm32(commonChars), cases[begin].target);
+        
+        // We've checked if the length is >= minLength, and then we checked if the
+        // length is == commonChars. We get to this point if it is >= minLength but not
+        // == commonChars. Hence we know that it now must be > minLength, i.e., that
+        // it's >= minLength + 1.
+        emitBinarySwitchStringRecurse(
+            data, cases, commonChars, begin + 1, end, buffer, length, temp, minLength + 1, false);
+        return;
+    }
+    
+    // At this point we know that the string is longer than commonChars, and we've only
+    // verified commonChars. Use a binary switch on the next unchecked character, i.e.
+    // string[commonChars].
+    
+    RELEASE_ASSERT(end >= begin + 2);
+    
+    m_jit.load8(MacroAssembler::Address(buffer, commonChars), temp);
+    
+    Vector<CharacterCase> characterCases;
+    CharacterCase currentCase;
+    currentCase.character = cases[begin].string->at(commonChars);
+    currentCase.begin = begin;
+    currentCase.end = begin + 1;
+    for (unsigned i = begin + 1; i < end; ++i) {
+        if (cases[i].string->at(commonChars) != currentCase.character) {
+            if (verbose)
+                dataLog("string(", cases[i].string, ")[", commonChars, "] != string(", cases[begin].string, ")[", commonChars, "]\n");
+            currentCase.end = i;
+            characterCases.append(currentCase);
+            currentCase.character = cases[i].string->at(commonChars);
+            currentCase.begin = i;
+            currentCase.end = i + 1;
+        } else
+            currentCase.end = i + 1;
+    }
+    characterCases.append(currentCase);
+    
+    Vector<int64_t> characterCaseValues;
+    for (unsigned i = 0; i < characterCases.size(); ++i)
+        characterCaseValues.append(characterCases[i].character);
+    
+    BinarySwitch binarySwitch(temp, characterCaseValues, BinarySwitch::Int32);
+    while (binarySwitch.advance(m_jit)) {
+        const CharacterCase& myCase = characterCases[binarySwitch.caseIndex()];
+        emitBinarySwitchStringRecurse(
+            data, cases, commonChars + 1, myCase.begin, myCase.end, buffer, length,
+            temp, minLength, allLengthsEqual);
+    }
+    
+    addBranch(binarySwitch.fallThrough(), data->fallThrough.block);
+}
+
+void SpeculativeJIT::emitSwitchStringOnString(SwitchData* data, GPRReg string)
+{
+    data->didUseJumpTable = true;
+    
+    bool canDoBinarySwitch = true;
+    unsigned totalLength = 0;
+    
+    for (unsigned i = data->cases.size(); i--;) {
+        StringImpl* string = data->cases[i].value.stringImpl();
+        if (!string->is8Bit()) {
+            canDoBinarySwitch = false;
+            break;
+        }
+        if (string->length() > Options::maximumBinaryStringSwitchCaseLength()) {
+            canDoBinarySwitch = false;
+            break;
+        }
+        totalLength += string->length();
+    }
+    
+    if (!canDoBinarySwitch || totalLength > Options::maximumBinaryStringSwitchTotalLength()) {
+        flushRegisters();
+        callOperation(
+            operationSwitchString, string, data->switchTableIndex, string);
+        m_jit.exceptionCheck();
+        m_jit.jump(string);
+        return;
+    }
+    
+    GPRTemporary length(this);
+    GPRTemporary temp(this);
+    
+    GPRReg lengthGPR = length.gpr();
+    GPRReg tempGPR = temp.gpr();
+    
+    m_jit.load32(MacroAssembler::Address(string, JSString::offsetOfLength()), lengthGPR);
+    m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), tempGPR);
+    
+    MacroAssembler::JumpList slowCases;
+    slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, tempGPR));
+    slowCases.append(m_jit.branchTest32(
+        MacroAssembler::Zero,
+        MacroAssembler::Address(tempGPR, StringImpl::flagsOffset()),
+        TrustedImm32(StringImpl::flagIs8Bit())));
+    
+    m_jit.loadPtr(MacroAssembler::Address(tempGPR, StringImpl::dataOffset()), string);
+    
+    Vector<StringSwitchCase> cases;
+    for (unsigned i = 0; i < data->cases.size(); ++i) {
+        cases.append(
+            StringSwitchCase(data->cases[i].value.stringImpl(), data->cases[i].target.block));
+    }
+    
+    std::sort(cases.begin(), cases.end());
+    
+    emitBinarySwitchStringRecurse(
+        data, cases, 0, 0, cases.size(), string, lengthGPR, tempGPR, 0, false);
+    
+    slowCases.link(&m_jit);
+    silentSpillAllRegisters(string);
+    callOperation(operationSwitchString, string, data->switchTableIndex, string);
+    silentFillAllRegisters(string);
+    m_jit.exceptionCheck();
+    m_jit.jump(string);
+}
+
+void SpeculativeJIT::emitSwitchString(Node* node, SwitchData* data)
+{
+    switch (node->child1().useKind()) {
+    case StringIdentUse: {
+        SpeculateCellOperand op1(this, node->child1());
+        GPRTemporary temp(this);
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg tempGPR = temp.gpr();
+        
+        speculateString(node->child1(), op1GPR);
+        speculateStringIdentAndLoadStorage(node->child1(), op1GPR, tempGPR);
+        
+        Vector<int64_t> identifierCaseValues;
+        for (unsigned i = 0; i < data->cases.size(); ++i) {
+            identifierCaseValues.append(
+                static_cast<int64_t>(bitwise_cast<intptr_t>(data->cases[i].value.stringImpl())));
+        }
+        
+        BinarySwitch binarySwitch(tempGPR, identifierCaseValues, BinarySwitch::IntPtr);
+        while (binarySwitch.advance(m_jit))
+            jump(data->cases[binarySwitch.caseIndex()].target.block, ForceJump);
+        addBranch(binarySwitch.fallThrough(), data->fallThrough.block);
+        
+        noResult(node);
+        break;
+    }
+        
+    case StringUse: {
+        SpeculateCellOperand op1(this, node->child1());
+        
+        GPRReg op1GPR = op1.gpr();
+        
+        op1.use();
+
+        speculateString(node->child1(), op1GPR);
+        emitSwitchStringOnString(data, op1GPR);
+        noResult(node, UseChildrenCalledExplicitly);
+        break;
+    }
+        
+    case UntypedUse: {
+        JSValueOperand op1(this, node->child1());
+        
+        JSValueRegs op1Regs = op1.jsValueRegs();
+        
+        op1.use();
+        
+        addBranch(m_jit.branchIfNotCell(op1Regs), data->fallThrough.block);
+        
+        addBranch(m_jit.branchIfNotString(op1Regs.payloadGPR()), data->fallThrough.block);
+        
+        emitSwitchStringOnString(data, op1Regs.payloadGPR());
+        noResult(node, UseChildrenCalledExplicitly);
+        break;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void SpeculativeJIT::emitSwitch(Node* node)
+{
+    SwitchData* data = node->switchData();
+    switch (data->kind) {
+    case SwitchImm: {
+        emitSwitchImm(node, data);
+        return;
+    }
+    case SwitchChar: {
+        emitSwitchChar(node, data);
+        return;
+    }
+    case SwitchString: {
+        emitSwitchString(node, data);
+        return;
+    }
+    case SwitchCell: {
+        DFG_CRASH(m_jit.graph(), node, "Bad switch kind");
+        return;
+    } }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void SpeculativeJIT::addBranch(const MacroAssembler::JumpList& jump, BasicBlock* destination)
+{
+    for (unsigned i = jump.jumps().size(); i--;)
+        addBranch(jump.jumps()[i], destination);
+}
+
+void SpeculativeJIT::linkBranches()
+{
+    for (size_t i = 0; i < m_branches.size(); ++i) {
+        BranchRecord& branch = m_branches[i];
+        branch.jump.linkTo(m_jit.blockHeads()[branch.destination->index], &m_jit);
+    }
+}
+
+void SpeculativeJIT::compileStoreBarrier(Node* node)
+{
+    ASSERT(node->op() == StoreBarrier || node->op() == FencedStoreBarrier);
+    
+    bool isFenced = node->op() == FencedStoreBarrier;
+    
+    SpeculateCellOperand base(this, node->child1());
+    GPRTemporary scratch1(this);
+    
+    GPRReg baseGPR = base.gpr();
+    GPRReg scratch1GPR = scratch1.gpr();
+    
+    JITCompiler::JumpList ok;
+    
+    if (isFenced) {
+        ok.append(m_jit.barrierBranch(baseGPR, scratch1GPR));
+        
+        JITCompiler::Jump noFence = m_jit.jumpIfMutatorFenceNotNeeded();
+        m_jit.memoryFence();
+        ok.append(m_jit.barrierBranchWithoutFence(baseGPR));
+        noFence.link(&m_jit);
+    } else
+        ok.append(m_jit.barrierBranchWithoutFence(baseGPR));
+
+    silentSpillAllRegisters(InvalidGPRReg);
+    callOperation(operationWriteBarrierSlowPath, baseGPR);
+    silentFillAllRegisters(InvalidGPRReg);
+
+    ok.link(&m_jit);
+
+    noResult(node);
+}
+
+void SpeculativeJIT::compilePutAccessorById(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    SpeculateCellOperand accessor(this, node->child2());
+
+    GPRReg baseGPR = base.gpr();
+    GPRReg accessorGPR = accessor.gpr();
+
+    flushRegisters();
+    callOperation(node->op() == PutGetterById ? operationPutGetterById : operationPutSetterById, NoResult, baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), accessorGPR);
+    m_jit.exceptionCheck();
+
+    noResult(node);
+}
+
+void SpeculativeJIT::compilePutGetterSetterById(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    JSValueOperand getter(this, node->child2());
+    JSValueOperand setter(this, node->child3());
+
+#if USE(JSVALUE64)
+    GPRReg baseGPR = base.gpr();
+    GPRReg getterGPR = getter.gpr();
+    GPRReg setterGPR = setter.gpr();
+
+    flushRegisters();
+    callOperation(operationPutGetterSetter, NoResult, baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), getterGPR, setterGPR);
+#else
+    // These JSValues may be JSUndefined OR JSFunction*.
+    // At that time,
+    // 1. If the JSValue is JSUndefined, its payload becomes nullptr.
+    // 2. If the JSValue is JSFunction*, its payload becomes JSFunction*.
+    // So extract payload and pass it to operationPutGetterSetter. This hack is used as the same way in baseline JIT.
+    GPRReg baseGPR = base.gpr();
+    JSValueRegs getterRegs = getter.jsValueRegs();
+    JSValueRegs setterRegs = setter.jsValueRegs();
+
+    flushRegisters();
+    callOperation(operationPutGetterSetter, NoResult, baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), getterRegs.payloadGPR(), setterRegs.payloadGPR());
+#endif
+    m_jit.exceptionCheck();
+
+    noResult(node);
+}
+
+void SpeculativeJIT::compileResolveScope(Node* node)
+{
+    SpeculateCellOperand scope(this, node->child1());
+    GPRReg scopeGPR = scope.gpr();
+    GPRFlushedCallResult result(this);
+    GPRReg resultGPR = result.gpr();
+    flushRegisters();
+    callOperation(operationResolveScope, resultGPR, scopeGPR, identifierUID(node->identifierNumber()));
+    m_jit.exceptionCheck();
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileGetDynamicVar(Node* node)
+{
+    SpeculateCellOperand scope(this, node->child1());
+    GPRReg scopeGPR = scope.gpr();
+#if USE(JSVALUE64)
+    flushRegisters();
+    GPRFlushedCallResult result(this);
+    callOperation(operationGetDynamicVar, result.gpr(), scopeGPR, identifierUID(node->identifierNumber()), node->getPutInfo());
+    m_jit.exceptionCheck();
+    jsValueResult(result.gpr(), node);
+#else
+    flushRegisters();
+    GPRFlushedCallResult2 resultTag(this);
+    GPRFlushedCallResult resultPayload(this);
+    callOperation(operationGetDynamicVar, JSValueRegs(resultTag.gpr(), resultPayload.gpr()), scopeGPR, identifierUID(node->identifierNumber()), node->getPutInfo());
+    m_jit.exceptionCheck();
+    jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+#endif
+}
+
+void SpeculativeJIT::compilePutDynamicVar(Node* node)
+{
+    SpeculateCellOperand scope(this, node->child1());
+    GPRReg scopeGPR = scope.gpr();
+    JSValueOperand value(this, node->child2());
+
+#if USE(JSVALUE64)
+    GPRReg valueGPR = value.gpr();
+    flushRegisters();
+    callOperation(operationPutDynamicVar, NoResult, scopeGPR, valueGPR, identifierUID(node->identifierNumber()), node->getPutInfo());
+#else
+    GPRReg tag = value.tagGPR();
+    GPRReg payload = value.payloadGPR();
+    flushRegisters();
+    callOperation(operationPutDynamicVar, NoResult, scopeGPR, JSValueRegs(tag, payload), identifierUID(node->identifierNumber()), node->getPutInfo());
+#endif
+    m_jit.exceptionCheck();
+    noResult(node);
+}
+
+void SpeculativeJIT::compilePutAccessorByVal(Node* node)
+{
+    SpeculateCellOperand base(this, node->child1());
+    JSValueOperand subscript(this, node->child2());
+    SpeculateCellOperand accessor(this, node->child3());
+
+    auto operation = node->op() == PutGetterByVal ? operationPutGetterByVal : operationPutSetterByVal;
+#if USE(JSVALUE64)
+    GPRReg baseGPR = base.gpr();
+    GPRReg subscriptGPR = subscript.gpr();
+    GPRReg accessorGPR = accessor.gpr();
+
+    flushRegisters();
+    callOperation(operation, NoResult, baseGPR, subscriptGPR, node->accessorAttributes(), accessorGPR);
+#else
+    GPRReg baseGPR = base.gpr();
+    JSValueRegs subscriptRegs = subscript.jsValueRegs();
+    GPRReg accessorGPR = accessor.gpr();
+
+    flushRegisters();
+    callOperation(operation, NoResult, baseGPR, subscriptRegs, node->accessorAttributes(), accessorGPR);
+#endif
+    m_jit.exceptionCheck();
+
+    noResult(node);
+}
+
+void SpeculativeJIT::compileGetRegExpObjectLastIndex(Node* node)
+{
+    SpeculateCellOperand regExp(this, node->child1());
+    JSValueRegsTemporary result(this);
+    GPRReg regExpGPR = regExp.gpr();
+    JSValueRegs resultRegs = result.regs();
+    speculateRegExpObject(node->child1(), regExpGPR);
+    m_jit.loadValue(JITCompiler::Address(regExpGPR, RegExpObject::offsetOfLastIndex()), resultRegs);
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compileSetRegExpObjectLastIndex(Node* node)
+{
+    SpeculateCellOperand regExp(this, node->child1());
+    JSValueOperand value(this, node->child2());
+    GPRReg regExpGPR = regExp.gpr();
+    JSValueRegs valueRegs = value.jsValueRegs();
+    speculateRegExpObject(node->child1(), regExpGPR);
+    speculationCheck(
+        ExoticObjectMode, JSValueRegs(), nullptr,
+        m_jit.branchTest8(
+            JITCompiler::Zero,
+            JITCompiler::Address(regExpGPR, RegExpObject::offsetOfLastIndexIsWritable())));
+    m_jit.storeValue(valueRegs, JITCompiler::Address(regExpGPR, RegExpObject::offsetOfLastIndex()));
+    noResult(node);
+}
+
+void SpeculativeJIT::compileLazyJSConstant(Node* node)
+{
+    JSValueRegsTemporary result(this);
+    JSValueRegs resultRegs = result.regs();
+    node->lazyJSValue().emit(m_jit, resultRegs);
+    jsValueResult(resultRegs, node);
+}
+
+void SpeculativeJIT::compileMaterializeNewObject(Node* node)
+{
+    RegisteredStructure structure = node->structureSet().at(0);
+    ASSERT(m_jit.graph().varArgChild(node, 0)->dynamicCastConstant<Structure*>() == structure.get());
+
+    ObjectMaterializationData& data = node->objectMaterializationData();
+        
+    IndexingType indexingType = structure->indexingType();
+    bool hasIndexingHeader = hasIndexedProperties(indexingType);
+    int32_t publicLength = 0;
+    int32_t vectorLength = 0;
+
+    if (hasIndexingHeader) {
+        for (unsigned i = data.m_properties.size(); i--;) {
+            Edge edge = m_jit.graph().varArgChild(node, 1 + i);
+            switch (data.m_properties[i].kind()) {
+            case PublicLengthPLoc:
+                publicLength = edge->asInt32();
+                break;
+            case VectorLengthPLoc:
+                vectorLength = edge->asInt32();
+                break;
+            default:
+                break;
+            }
+        }
+    }
+
+    GPRTemporary result(this);
+    GPRTemporary storage(this);
+    GPRReg resultGPR = result.gpr();
+    GPRReg storageGPR = storage.gpr();
+    
+    emitAllocateRawObject(resultGPR, structure, storageGPR, 0, vectorLength);
+    
+    m_jit.store32(
+        JITCompiler::TrustedImm32(publicLength),
+        JITCompiler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+
+    for (unsigned i = data.m_properties.size(); i--;) {
+        Edge edge = m_jit.graph().varArgChild(node, 1 + i);
+        PromotedLocationDescriptor descriptor = data.m_properties[i];
+        switch (descriptor.kind()) {
+        case IndexedPropertyPLoc: {
+            JSValueOperand value(this, edge);
+            m_jit.storeValue(
+                value.jsValueRegs(),
+                JITCompiler::Address(storageGPR, sizeof(EncodedJSValue) * descriptor.info()));
+            break;
+        }
+
+        case NamedPropertyPLoc: {
+            StringImpl* uid = m_jit.graph().identifiers()[descriptor.info()];
+            for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
+                if (uid != entry.key)
+                    continue;
+
+                JSValueOperand value(this, edge);
+                GPRReg baseGPR = isInlineOffset(entry.offset) ? resultGPR : storageGPR;
+                m_jit.storeValue(
+                    value.jsValueRegs(),
+                    JITCompiler::Address(baseGPR, offsetRelativeToBase(entry.offset)));
+            }
+            break;
+        }
+            
+        default:
+            break;
+        }
+    }
+
+    cellResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileRecordRegExpCachedResult(Node* node)
+{
+    Edge constructorEdge = m_jit.graph().varArgChild(node, 0);
+    Edge regExpEdge = m_jit.graph().varArgChild(node, 1);
+    Edge stringEdge = m_jit.graph().varArgChild(node, 2);
+    Edge startEdge = m_jit.graph().varArgChild(node, 3);
+    Edge endEdge = m_jit.graph().varArgChild(node, 4);
+
+    SpeculateCellOperand constructor(this, constructorEdge);
+    SpeculateCellOperand regExp(this, regExpEdge);
+    SpeculateCellOperand string(this, stringEdge);
+    SpeculateInt32Operand start(this, startEdge);
+    SpeculateInt32Operand end(this, endEdge);
+
+    GPRReg constructorGPR = constructor.gpr();
+    GPRReg regExpGPR = regExp.gpr();
+    GPRReg stringGPR = string.gpr();
+    GPRReg startGPR = start.gpr();
+    GPRReg endGPR = end.gpr();
+
+    ptrdiff_t offset = RegExpConstructor::offsetOfCachedResult();
+
+    m_jit.storePtr(
+        regExpGPR,
+        JITCompiler::Address(constructorGPR, offset + RegExpCachedResult::offsetOfLastRegExp()));
+    m_jit.storePtr(
+        stringGPR,
+        JITCompiler::Address(constructorGPR, offset + RegExpCachedResult::offsetOfLastInput()));
+    m_jit.store32(
+        startGPR,
+        JITCompiler::Address(
+            constructorGPR,
+            offset + RegExpCachedResult::offsetOfResult() + OBJECT_OFFSETOF(MatchResult, start)));
+    m_jit.store32(
+        endGPR,
+        JITCompiler::Address(
+            constructorGPR,
+            offset + RegExpCachedResult::offsetOfResult() + OBJECT_OFFSETOF(MatchResult, end)));
+    m_jit.store8(
+        TrustedImm32(0),
+        JITCompiler::Address(constructorGPR, offset + RegExpCachedResult::offsetOfReified()));
+
+    noResult(node);
+}
+
+void SpeculativeJIT::compileCompareEqPtr(Node* node)
+{
+    JSValueOperand operand(this, node->child1());
+    GPRTemporary result(this);
+    JSValueRegs regs = operand.jsValueRegs();
+    GPRReg resultGPR = result.gpr();
+    m_jit.boxBooleanPayload(false, resultGPR);
+    JITCompiler::JumpList notEqual = m_jit.branchIfNotEqual(regs, node->cellOperand()->value());
+    m_jit.boxBooleanPayload(true, resultGPR);
+    notEqual.link(&m_jit);
+    blessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileDefineDataProperty(Node* node)
+{
+#if USE(JSVALUE64)
+    static_assert(GPRInfo::numberOfRegisters >= 5, "We are assuming we have enough registers to make this call without incrementally setting up the arguments.");
+#else
+    static_assert(GPRInfo::numberOfRegisters >= 6, "We are assuming we have enough registers to make this call without incrementally setting up the arguments.");
+#endif
+
+    SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
+    GPRReg baseGPR = base.gpr();
+
+    JSValueOperand value(this, m_jit.graph().varArgChild(node, 2));
+    JSValueRegs valueRegs = value.jsValueRegs();
+
+    SpeculateInt32Operand attributes(this, m_jit.graph().varArgChild(node, 3));
+    GPRReg attributesGPR = attributes.gpr();
+
+    Edge& propertyEdge = m_jit.graph().varArgChild(node, 1);
+    switch (propertyEdge.useKind()) {
+    case StringUse: {
+        SpeculateCellOperand property(this, propertyEdge);
+        GPRReg propertyGPR = property.gpr();
+        speculateString(propertyEdge, propertyGPR);
+
+        useChildren(node);
+
+        flushRegisters();
+        callOperation(operationDefineDataPropertyString, NoResult, baseGPR, propertyGPR, valueRegs, attributesGPR);
+        m_jit.exceptionCheck();
+        break;
+    }
+    case StringIdentUse: {
+        SpeculateCellOperand property(this, propertyEdge);
+        GPRTemporary ident(this);
+
+        GPRReg propertyGPR = property.gpr();
+        GPRReg identGPR = ident.gpr();
+
+        speculateString(propertyEdge, propertyGPR);
+        speculateStringIdentAndLoadStorage(propertyEdge, propertyGPR, identGPR);
+
+        useChildren(node);
+
+        flushRegisters();
+        callOperation(operationDefineDataPropertyStringIdent, NoResult, baseGPR, identGPR, valueRegs, attributesGPR);
+        m_jit.exceptionCheck();
+        break;
+    }
+    case SymbolUse: {
+        SpeculateCellOperand property(this, propertyEdge);
+        GPRReg propertyGPR = property.gpr();
+        speculateSymbol(propertyEdge, propertyGPR);
+
+        useChildren(node);
+
+        flushRegisters();
+        callOperation(operationDefineDataPropertySymbol, NoResult, baseGPR, propertyGPR, valueRegs, attributesGPR);
+        m_jit.exceptionCheck();
+        break;
+    }
+    case UntypedUse: {
+        JSValueOperand property(this, propertyEdge);
+        JSValueRegs propertyRegs = property.jsValueRegs();
+
+        useChildren(node);
+
+        flushRegisters();
+        callOperation(operationDefineDataProperty, NoResult, baseGPR, propertyRegs, valueRegs, attributesGPR);
+        m_jit.exceptionCheck();
+        break;
+    }
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    noResult(node, UseChildrenCalledExplicitly);
+}
+
+void SpeculativeJIT::compileDefineAccessorProperty(Node* node)
+{
+#if USE(JSVALUE64)
+    static_assert(GPRInfo::numberOfRegisters >= 5, "We are assuming we have enough registers to make this call without incrementally setting up the arguments.");
+#else
+    static_assert(GPRInfo::numberOfRegisters >= 6, "We are assuming we have enough registers to make this call without incrementally setting up the arguments.");
+#endif
+
+    SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
+    GPRReg baseGPR = base.gpr();
+
+    SpeculateCellOperand getter(this, m_jit.graph().varArgChild(node, 2));
+    GPRReg getterGPR = getter.gpr();
+
+    SpeculateCellOperand setter(this, m_jit.graph().varArgChild(node, 3));
+    GPRReg setterGPR = setter.gpr();
+
+    SpeculateInt32Operand attributes(this, m_jit.graph().varArgChild(node, 4));
+    GPRReg attributesGPR = attributes.gpr();
+
+    Edge& propertyEdge = m_jit.graph().varArgChild(node, 1);
+    switch (propertyEdge.useKind()) {
+    case StringUse: {
+        SpeculateCellOperand property(this, propertyEdge);
+        GPRReg propertyGPR = property.gpr();
+        speculateString(propertyEdge, propertyGPR);
+
+        useChildren(node);
+
+        flushRegisters();
+        callOperation(operationDefineAccessorPropertyString, NoResult, baseGPR, propertyGPR, getterGPR, setterGPR, attributesGPR);
+        m_jit.exceptionCheck();
+        break;
+    }
+    case StringIdentUse: {
+        SpeculateCellOperand property(this, propertyEdge);
+        GPRTemporary ident(this);
+
+        GPRReg propertyGPR = property.gpr();
+        GPRReg identGPR = ident.gpr();
+
+        speculateString(propertyEdge, propertyGPR);
+        speculateStringIdentAndLoadStorage(propertyEdge, propertyGPR, identGPR);
+
+        useChildren(node);
+
+        flushRegisters();
+        callOperation(operationDefineAccessorPropertyStringIdent, NoResult, baseGPR, identGPR, getterGPR, setterGPR, attributesGPR);
+        m_jit.exceptionCheck();
+        break;
+    }
+    case SymbolUse: {
+        SpeculateCellOperand property(this, propertyEdge);
+        GPRReg propertyGPR = property.gpr();
+        speculateSymbol(propertyEdge, propertyGPR);
+
+        useChildren(node);
+
+        flushRegisters();
+        callOperation(operationDefineAccessorPropertySymbol, NoResult, baseGPR, propertyGPR, getterGPR, setterGPR, attributesGPR);
+        m_jit.exceptionCheck();
+        break;
+    }
+    case UntypedUse: {
+        JSValueOperand property(this, propertyEdge);
+        JSValueRegs propertyRegs = property.jsValueRegs();
+
+        useChildren(node);
+
+        flushRegisters();
+        callOperation(operationDefineAccessorProperty, NoResult, baseGPR, propertyRegs, getterGPR, setterGPR, attributesGPR);
+        m_jit.exceptionCheck();
+        break;
+    }
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    noResult(node, UseChildrenCalledExplicitly);
+}
+
+void SpeculativeJIT::emitAllocateButterfly(GPRReg storageResultGPR, GPRReg sizeGPR, GPRReg scratch1, GPRReg scratch2, GPRReg scratch3, MacroAssembler::JumpList& slowCases)
+{
+    RELEASE_ASSERT(RegisterSet(storageResultGPR, sizeGPR, scratch1, scratch2, scratch3).numberOfSetGPRs() == 5);
+    ASSERT((1 << 3) == sizeof(JSValue));
+    m_jit.zeroExtend32ToPtr(sizeGPR, scratch1);
+    m_jit.lshift32(TrustedImm32(3), scratch1);
+    m_jit.add32(TrustedImm32(sizeof(IndexingHeader)), scratch1, scratch2);
+    m_jit.emitAllocateVariableSized(
+        storageResultGPR, m_jit.vm()->auxiliarySpace, scratch2, scratch1, scratch3, slowCases);
+    m_jit.addPtr(TrustedImm32(sizeof(IndexingHeader)), storageResultGPR);
+
+    m_jit.store32(sizeGPR, MacroAssembler::Address(storageResultGPR, Butterfly::offsetOfPublicLength()));
+    m_jit.store32(sizeGPR, MacroAssembler::Address(storageResultGPR, Butterfly::offsetOfVectorLength()));
+}
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGSpeculativeJIT.h b/dfg/DFGSpeculativeJIT.h
new file mode 100644
index 0000000..113defa
--- /dev/null
+++ b/dfg/DFGSpeculativeJIT.h
@@ -0,0 +1,3859 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractInterpreter.h"
+#include "DFGGenerationInfo.h"
+#include "DFGInPlaceAbstractState.h"
+#include "DFGJITCompiler.h"
+#include "DFGOSRExit.h"
+#include "DFGOSRExitJumpPlaceholder.h"
+#include "DFGSilentRegisterSavePlan.h"
+#include "DFGValueSource.h"
+#include "JITMathIC.h"
+#include "JITOperations.h"
+#include "MarkedAllocator.h"
+#include "PutKind.h"
+#include "SpillRegistersMode.h"
+#include "StructureStubInfo.h"
+#include "ValueRecovery.h"
+#include "VirtualRegister.h"
+
+namespace JSC { namespace DFG {
+
+class GPRTemporary;
+class JSValueOperand;
+class SlowPathGenerator;
+class SpeculativeJIT;
+class SpeculateInt32Operand;
+class SpeculateStrictInt32Operand;
+class SpeculateDoubleOperand;
+class SpeculateCellOperand;
+class SpeculateBooleanOperand;
+
+enum GeneratedOperandType { GeneratedOperandTypeUnknown, GeneratedOperandInteger, GeneratedOperandJSValue};
+
+// === SpeculativeJIT ===
+//
+// The SpeculativeJIT is used to generate a fast, but potentially
+// incomplete code path for the dataflow. When code generating
+// we may make assumptions about operand types, dynamically check,
+// and bail-out to an alternate code path if these checks fail.
+// Importantly, the speculative code path cannot be reentered once
+// a speculative check has failed. This allows the SpeculativeJIT
+// to propagate type information (including information that has
+// only speculatively been asserted) through the dataflow.
+class SpeculativeJIT {
+    WTF_MAKE_FAST_ALLOCATED;
+
+    friend struct OSRExit;
+private:
+    typedef JITCompiler::TrustedImm32 TrustedImm32;
+    typedef JITCompiler::Imm32 Imm32;
+    typedef JITCompiler::ImmPtr ImmPtr;
+    typedef JITCompiler::TrustedImm64 TrustedImm64;
+    typedef JITCompiler::Imm64 Imm64;
+
+    // These constants are used to set priorities for spill order for
+    // the register allocator.
+#if USE(JSVALUE64)
+    enum SpillOrder {
+        SpillOrderConstant = 1, // no spill, and cheap fill
+        SpillOrderSpilled  = 2, // no spill
+        SpillOrderJS       = 4, // needs spill
+        SpillOrderCell     = 4, // needs spill
+        SpillOrderStorage  = 4, // needs spill
+        SpillOrderInteger  = 5, // needs spill and box
+        SpillOrderBoolean  = 5, // needs spill and box
+        SpillOrderDouble   = 6, // needs spill and convert
+    };
+#elif USE(JSVALUE32_64)
+    enum SpillOrder {
+        SpillOrderConstant = 1, // no spill, and cheap fill
+        SpillOrderSpilled  = 2, // no spill
+        SpillOrderJS       = 4, // needs spill
+        SpillOrderStorage  = 4, // needs spill
+        SpillOrderDouble   = 4, // needs spill
+        SpillOrderInteger  = 5, // needs spill and box
+        SpillOrderCell     = 5, // needs spill and box
+        SpillOrderBoolean  = 5, // needs spill and box
+    };
+#endif
+
+    enum UseChildrenMode { CallUseChildren, UseChildrenCalledExplicitly };
+    
+public:
+    SpeculativeJIT(JITCompiler&);
+    ~SpeculativeJIT();
+
+    struct TrustedImmPtr {
+        template <typename T>
+        explicit TrustedImmPtr(T* value)
+            : m_value(value)
+        {
+            static_assert(!std::is_base_of<HeapCell, T>::value, "To use a GC pointer, the graph must be aware of it. Use SpeculativeJIT::TrustedImmPtr::weakPointer instead.");
+        }
+
+        explicit TrustedImmPtr(RegisteredStructure structure)
+            : m_value(structure.get())
+        { }
+        
+        // This is only here so that TrustedImmPtr(0) does not confuse the C++
+        // overload handling rules.
+        explicit TrustedImmPtr(int value)
+            : m_value(value)
+        {
+            ASSERT(!value);
+        }
+
+        explicit TrustedImmPtr(std::nullptr_t)
+            : m_value(0)
+        { }
+
+        explicit TrustedImmPtr(FrozenValue* value)
+        {
+            RELEASE_ASSERT(value->value().isCell());
+            m_value = MacroAssembler::TrustedImmPtr(value->cell());
+        }
+
+        explicit TrustedImmPtr(size_t value)
+            : m_value(bitwise_cast<void*>(value))
+        {
+        }
+
+        static TrustedImmPtr weakPointer(Graph& graph, JSCell* cell)
+        {     
+            // There are weird relationships in how optimized CodeBlocks
+            // point to other CodeBlocks. We don't want to have them be
+            // part of the weak pointer set. For example, an optimized CodeBlock
+            // having a weak pointer to itself will cause it to get collected.
+            ASSERT(!jsDynamicCast<CodeBlock*>(cell));
+
+            graph.m_plan.weakReferences.addLazily(cell);
+            return TrustedImmPtr(bitwise_cast<size_t>(cell));
+        }
+
+        operator MacroAssembler::TrustedImmPtr() const { return m_value; }
+
+        intptr_t asIntptr()
+        {
+            return m_value.asIntptr();
+        }
+
+    private:
+        MacroAssembler::TrustedImmPtr m_value;
+    };
+
+    bool compile();
+    
+    void createOSREntries();
+    void linkOSREntries(LinkBuffer&);
+
+    BasicBlock* nextBlock()
+    {
+        for (BlockIndex resultIndex = m_block->index + 1; ; resultIndex++) {
+            if (resultIndex >= m_jit.graph().numBlocks())
+                return 0;
+            if (BasicBlock* result = m_jit.graph().block(resultIndex))
+                return result;
+        }
+    }
+    
+#if USE(JSVALUE64)
+    GPRReg fillJSValue(Edge);
+#elif USE(JSVALUE32_64)
+    bool fillJSValue(Edge, GPRReg&, GPRReg&, FPRReg&);
+#endif
+    GPRReg fillStorage(Edge);
+
+    // lock and unlock GPR & FPR registers.
+    void lock(GPRReg reg)
+    {
+        m_gprs.lock(reg);
+    }
+    void lock(FPRReg reg)
+    {
+        m_fprs.lock(reg);
+    }
+    void unlock(GPRReg reg)
+    {
+        m_gprs.unlock(reg);
+    }
+    void unlock(FPRReg reg)
+    {
+        m_fprs.unlock(reg);
+    }
+
+    // Used to check whether a child node is on its last use,
+    // and its machine registers may be reused.
+    bool canReuse(Node* node)
+    {
+        return generationInfo(node).useCount() == 1;
+    }
+    bool canReuse(Node* nodeA, Node* nodeB)
+    {
+        return nodeA == nodeB && generationInfo(nodeA).useCount() == 2;
+    }
+    bool canReuse(Edge nodeUse)
+    {
+        return canReuse(nodeUse.node());
+    }
+    GPRReg reuse(GPRReg reg)
+    {
+        m_gprs.lock(reg);
+        return reg;
+    }
+    FPRReg reuse(FPRReg reg)
+    {
+        m_fprs.lock(reg);
+        return reg;
+    }
+
+    // Allocate a gpr/fpr.
+    GPRReg allocate()
+    {
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+        m_jit.addRegisterAllocationAtOffset(m_jit.debugOffset());
+#endif
+        VirtualRegister spillMe;
+        GPRReg gpr = m_gprs.allocate(spillMe);
+        if (spillMe.isValid()) {
+#if USE(JSVALUE32_64)
+            GenerationInfo& info = generationInfoFromVirtualRegister(spillMe);
+            if ((info.registerFormat() & DataFormatJS))
+                m_gprs.release(info.tagGPR() == gpr ? info.payloadGPR() : info.tagGPR());
+#endif
+            spill(spillMe);
+        }
+        return gpr;
+    }
+    GPRReg allocate(GPRReg specific)
+    {
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+        m_jit.addRegisterAllocationAtOffset(m_jit.debugOffset());
+#endif
+        VirtualRegister spillMe = m_gprs.allocateSpecific(specific);
+        if (spillMe.isValid()) {
+#if USE(JSVALUE32_64)
+            GenerationInfo& info = generationInfoFromVirtualRegister(spillMe);
+            RELEASE_ASSERT(info.registerFormat() != DataFormatJSDouble);
+            if ((info.registerFormat() & DataFormatJS))
+                m_gprs.release(info.tagGPR() == specific ? info.payloadGPR() : info.tagGPR());
+#endif
+            spill(spillMe);
+        }
+        return specific;
+    }
+    GPRReg tryAllocate()
+    {
+        return m_gprs.tryAllocate();
+    }
+    FPRReg fprAllocate()
+    {
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+        m_jit.addRegisterAllocationAtOffset(m_jit.debugOffset());
+#endif
+        VirtualRegister spillMe;
+        FPRReg fpr = m_fprs.allocate(spillMe);
+        if (spillMe.isValid())
+            spill(spillMe);
+        return fpr;
+    }
+
+    // Check whether a VirtualRegsiter is currently in a machine register.
+    // We use this when filling operands to fill those that are already in
+    // machine registers first (by locking VirtualRegsiters that are already
+    // in machine register before filling those that are not we attempt to
+    // avoid spilling values we will need immediately).
+    bool isFilled(Node* node)
+    {
+        return generationInfo(node).registerFormat() != DataFormatNone;
+    }
+    bool isFilledDouble(Node* node)
+    {
+        return generationInfo(node).registerFormat() == DataFormatDouble;
+    }
+
+    // Called on an operand once it has been consumed by a parent node.
+    void use(Node* node)
+    {
+        if (!node->hasResult())
+            return;
+        GenerationInfo& info = generationInfo(node);
+
+        // use() returns true when the value becomes dead, and any
+        // associated resources may be freed.
+        if (!info.use(*m_stream))
+            return;
+
+        // Release the associated machine registers.
+        DataFormat registerFormat = info.registerFormat();
+#if USE(JSVALUE64)
+        if (registerFormat == DataFormatDouble)
+            m_fprs.release(info.fpr());
+        else if (registerFormat != DataFormatNone)
+            m_gprs.release(info.gpr());
+#elif USE(JSVALUE32_64)
+        if (registerFormat == DataFormatDouble)
+            m_fprs.release(info.fpr());
+        else if (registerFormat & DataFormatJS) {
+            m_gprs.release(info.tagGPR());
+            m_gprs.release(info.payloadGPR());
+        } else if (registerFormat != DataFormatNone)
+            m_gprs.release(info.gpr());
+#endif
+    }
+    void use(Edge nodeUse)
+    {
+        use(nodeUse.node());
+    }
+    
+    RegisterSet usedRegisters();
+    
+    bool masqueradesAsUndefinedWatchpointIsStillValid(const CodeOrigin& codeOrigin)
+    {
+        return m_jit.graph().masqueradesAsUndefinedWatchpointIsStillValid(codeOrigin);
+    }
+    bool masqueradesAsUndefinedWatchpointIsStillValid()
+    {
+        return masqueradesAsUndefinedWatchpointIsStillValid(m_currentNode->origin.semantic);
+    }
+
+    void compileStoreBarrier(Node*);
+
+    static GPRReg selectScratchGPR(GPRReg preserve1 = InvalidGPRReg, GPRReg preserve2 = InvalidGPRReg, GPRReg preserve3 = InvalidGPRReg, GPRReg preserve4 = InvalidGPRReg)
+    {
+        return AssemblyHelpers::selectScratchGPR(preserve1, preserve2, preserve3, preserve4);
+    }
+
+    // Called by the speculative operand types, below, to fill operand to
+    // machine registers, implicitly generating speculation checks as needed.
+    GPRReg fillSpeculateInt32(Edge, DataFormat& returnFormat);
+    GPRReg fillSpeculateInt32Strict(Edge);
+    GPRReg fillSpeculateInt52(Edge, DataFormat desiredFormat);
+    FPRReg fillSpeculateDouble(Edge);
+    GPRReg fillSpeculateCell(Edge);
+    GPRReg fillSpeculateBoolean(Edge);
+    GeneratedOperandType checkGeneratedTypeForToInt32(Node*);
+
+    void addSlowPathGenerator(std::unique_ptr<SlowPathGenerator>);
+    void addSlowPathGenerator(std::function<void()>);
+    void runSlowPathGenerators(PCToCodeOriginMapBuilder&);
+    
+    void compile(Node*);
+    void noticeOSRBirth(Node*);
+    void bail(AbortReason);
+    void compileCurrentBlock();
+
+    void checkArgumentTypes();
+
+    void clearGenerationInfo();
+
+    // These methods are used when generating 'unexpected'
+    // calls out from JIT code to C++ helper routines -
+    // they spill all live values to the appropriate
+    // slots in the JSStack without changing any state
+    // in the GenerationInfo.
+    SilentRegisterSavePlan silentSavePlanForGPR(VirtualRegister spillMe, GPRReg source);
+    SilentRegisterSavePlan silentSavePlanForFPR(VirtualRegister spillMe, FPRReg source);
+    void silentSpill(const SilentRegisterSavePlan&);
+    void silentFill(const SilentRegisterSavePlan&, GPRReg canTrample);
+
+    template<typename CollectionType>
+    void silentSpill(const CollectionType& savePlans)
+    {
+        for (unsigned i = 0; i < savePlans.size(); ++i)
+            silentSpill(savePlans[i]);
+    }
+
+    template<typename CollectionType>
+    void silentFill(const CollectionType& savePlans, GPRReg exclude = InvalidGPRReg)
+    {
+        GPRReg canTrample = SpeculativeJIT::pickCanTrample(exclude);
+        for (unsigned i = savePlans.size(); i--;)
+            silentFill(savePlans[i], canTrample);
+    }
+
+    template<typename CollectionType>
+    void silentSpillAllRegistersImpl(bool doSpill, CollectionType& plans, GPRReg exclude, GPRReg exclude2 = InvalidGPRReg, FPRReg fprExclude = InvalidFPRReg)
+    {
+        ASSERT(plans.isEmpty());
+        for (gpr_iterator iter = m_gprs.begin(); iter != m_gprs.end(); ++iter) {
+            GPRReg gpr = iter.regID();
+            if (iter.name().isValid() && gpr != exclude && gpr != exclude2) {
+                SilentRegisterSavePlan plan = silentSavePlanForGPR(iter.name(), gpr);
+                if (doSpill)
+                    silentSpill(plan);
+                plans.append(plan);
+            }
+        }
+        for (fpr_iterator iter = m_fprs.begin(); iter != m_fprs.end(); ++iter) {
+            if (iter.name().isValid() && iter.regID() != fprExclude) {
+                SilentRegisterSavePlan plan = silentSavePlanForFPR(iter.name(), iter.regID());
+                if (doSpill)
+                    silentSpill(plan);
+                plans.append(plan);
+            }
+        }
+    }
+    template<typename CollectionType>
+    void silentSpillAllRegistersImpl(bool doSpill, CollectionType& plans, NoResultTag)
+    {
+        silentSpillAllRegistersImpl(doSpill, plans, InvalidGPRReg, InvalidGPRReg, InvalidFPRReg);
+    }
+    template<typename CollectionType>
+    void silentSpillAllRegistersImpl(bool doSpill, CollectionType& plans, FPRReg exclude)
+    {
+        silentSpillAllRegistersImpl(doSpill, plans, InvalidGPRReg, InvalidGPRReg, exclude);
+    }
+    template<typename CollectionType>
+    void silentSpillAllRegistersImpl(bool doSpill, CollectionType& plans, JSValueRegs exclude)
+    {
+#if USE(JSVALUE32_64)
+        silentSpillAllRegistersImpl(doSpill, plans, exclude.tagGPR(), exclude.payloadGPR());
+#else
+        silentSpillAllRegistersImpl(doSpill, plans, exclude.gpr());
+#endif
+    }
+    
+    void silentSpillAllRegisters(GPRReg exclude, GPRReg exclude2 = InvalidGPRReg, FPRReg fprExclude = InvalidFPRReg)
+    {
+        silentSpillAllRegistersImpl(true, m_plans, exclude, exclude2, fprExclude);
+    }
+    void silentSpillAllRegisters(FPRReg exclude)
+    {
+        silentSpillAllRegisters(InvalidGPRReg, InvalidGPRReg, exclude);
+    }
+    void silentSpillAllRegisters(JSValueRegs exclude)
+    {
+#if USE(JSVALUE64)
+        silentSpillAllRegisters(exclude.payloadGPR());
+#else
+        silentSpillAllRegisters(exclude.payloadGPR(), exclude.tagGPR());
+#endif
+    }
+    
+    static GPRReg pickCanTrample(GPRReg exclude)
+    {
+        GPRReg result = GPRInfo::regT0;
+        if (result == exclude)
+            result = GPRInfo::regT1;
+        return result;
+    }
+    static GPRReg pickCanTrample(FPRReg)
+    {
+        return GPRInfo::regT0;
+    }
+    static GPRReg pickCanTrample(NoResultTag)
+    {
+        return GPRInfo::regT0;
+    }
+
+#if USE(JSVALUE64)
+    static GPRReg pickCanTrample(JSValueRegs exclude)
+    {
+        return pickCanTrample(exclude.payloadGPR());
+    }
+#else
+    static GPRReg pickCanTrample(JSValueRegs exclude)
+    {
+        GPRReg result = GPRInfo::regT0;
+        if (result == exclude.tagGPR()) {
+            result = GPRInfo::regT1;
+            if (result == exclude.payloadGPR())
+                result = GPRInfo::regT2;
+        } else if (result == exclude.payloadGPR()) {
+            result = GPRInfo::regT1;
+            if (result == exclude.tagGPR())
+                result = GPRInfo::regT2;
+        }
+        return result;
+    }
+#endif
+    
+    template<typename RegisterType>
+    void silentFillAllRegisters(RegisterType exclude)
+    {
+        GPRReg canTrample = pickCanTrample(exclude);
+        
+        while (!m_plans.isEmpty()) {
+            SilentRegisterSavePlan& plan = m_plans.last();
+            silentFill(plan, canTrample);
+            m_plans.removeLast();
+        }
+    }
+
+    // These methods convert between doubles, and doubles boxed and JSValues.
+#if USE(JSVALUE64)
+    GPRReg boxDouble(FPRReg fpr, GPRReg gpr)
+    {
+        return m_jit.boxDouble(fpr, gpr);
+    }
+    FPRReg unboxDouble(GPRReg gpr, GPRReg resultGPR, FPRReg fpr)
+    {
+        return m_jit.unboxDouble(gpr, resultGPR, fpr);
+    }
+    GPRReg boxDouble(FPRReg fpr)
+    {
+        return boxDouble(fpr, allocate());
+    }
+    
+    void boxInt52(GPRReg sourceGPR, GPRReg targetGPR, DataFormat);
+#elif USE(JSVALUE32_64)
+    void boxDouble(FPRReg fpr, GPRReg tagGPR, GPRReg payloadGPR)
+    {
+        m_jit.boxDouble(fpr, tagGPR, payloadGPR);
+    }
+    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr, FPRReg scratchFPR)
+    {
+        m_jit.unboxDouble(tagGPR, payloadGPR, fpr, scratchFPR);
+    }
+#endif
+    void boxDouble(FPRReg fpr, JSValueRegs regs)
+    {
+        m_jit.boxDouble(fpr, regs);
+    }
+
+    // Spill a VirtualRegister to the JSStack.
+    void spill(VirtualRegister spillMe)
+    {
+        GenerationInfo& info = generationInfoFromVirtualRegister(spillMe);
+
+#if USE(JSVALUE32_64)
+        if (info.registerFormat() == DataFormatNone) // it has been spilled. JS values which have two GPRs can reach here
+            return;
+#endif
+        // Check the GenerationInfo to see if this value need writing
+        // to the JSStack - if not, mark it as spilled & return.
+        if (!info.needsSpill()) {
+            info.setSpilled(*m_stream, spillMe);
+            return;
+        }
+
+        DataFormat spillFormat = info.registerFormat();
+        switch (spillFormat) {
+        case DataFormatStorage: {
+            // This is special, since it's not a JS value - as in it's not visible to JS
+            // code.
+            m_jit.storePtr(info.gpr(), JITCompiler::addressFor(spillMe));
+            info.spill(*m_stream, spillMe, DataFormatStorage);
+            return;
+        }
+
+        case DataFormatInt32: {
+            m_jit.store32(info.gpr(), JITCompiler::payloadFor(spillMe));
+            info.spill(*m_stream, spillMe, DataFormatInt32);
+            return;
+        }
+
+#if USE(JSVALUE64)
+        case DataFormatDouble: {
+            m_jit.storeDouble(info.fpr(), JITCompiler::addressFor(spillMe));
+            info.spill(*m_stream, spillMe, DataFormatDouble);
+            return;
+        }
+
+        case DataFormatInt52:
+        case DataFormatStrictInt52: {
+            m_jit.store64(info.gpr(), JITCompiler::addressFor(spillMe));
+            info.spill(*m_stream, spillMe, spillFormat);
+            return;
+        }
+            
+        default:
+            // The following code handles JSValues, int32s, and cells.
+            RELEASE_ASSERT(spillFormat == DataFormatCell || spillFormat & DataFormatJS);
+            
+            GPRReg reg = info.gpr();
+            // We need to box int32 and cell values ...
+            // but on JSVALUE64 boxing a cell is a no-op!
+            if (spillFormat == DataFormatInt32)
+                m_jit.or64(GPRInfo::tagTypeNumberRegister, reg);
+            
+            // Spill the value, and record it as spilled in its boxed form.
+            m_jit.store64(reg, JITCompiler::addressFor(spillMe));
+            info.spill(*m_stream, spillMe, (DataFormat)(spillFormat | DataFormatJS));
+            return;
+#elif USE(JSVALUE32_64)
+        case DataFormatCell:
+        case DataFormatBoolean: {
+            m_jit.store32(info.gpr(), JITCompiler::payloadFor(spillMe));
+            info.spill(*m_stream, spillMe, spillFormat);
+            return;
+        }
+
+        case DataFormatDouble: {
+            // On JSVALUE32_64 boxing a double is a no-op.
+            m_jit.storeDouble(info.fpr(), JITCompiler::addressFor(spillMe));
+            info.spill(*m_stream, spillMe, DataFormatDouble);
+            return;
+        }
+
+        default:
+            // The following code handles JSValues.
+            RELEASE_ASSERT(spillFormat & DataFormatJS);
+            m_jit.store32(info.tagGPR(), JITCompiler::tagFor(spillMe));
+            m_jit.store32(info.payloadGPR(), JITCompiler::payloadFor(spillMe));
+            info.spill(*m_stream, spillMe, spillFormat);
+            return;
+#endif
+        }
+    }
+    
+    bool isKnownInteger(Node* node) { return m_state.forNode(node).isType(SpecInt32Only); }
+    bool isKnownCell(Node* node) { return m_state.forNode(node).isType(SpecCell); }
+    
+    bool isKnownNotInteger(Node* node) { return !(m_state.forNode(node).m_type & SpecInt32Only); }
+    bool isKnownNotNumber(Node* node) { return !(m_state.forNode(node).m_type & SpecFullNumber); }
+    bool isKnownNotCell(Node* node) { return !(m_state.forNode(node).m_type & SpecCell); }
+    bool isKnownNotOther(Node* node) { return !(m_state.forNode(node).m_type & SpecOther); }
+    
+    UniquedStringImpl* identifierUID(unsigned index)
+    {
+        return m_jit.graph().identifiers()[index];
+    }
+
+    // Spill all VirtualRegisters back to the JSStack.
+    void flushRegisters()
+    {
+        for (gpr_iterator iter = m_gprs.begin(); iter != m_gprs.end(); ++iter) {
+            if (iter.name().isValid()) {
+                spill(iter.name());
+                iter.release();
+            }
+        }
+        for (fpr_iterator iter = m_fprs.begin(); iter != m_fprs.end(); ++iter) {
+            if (iter.name().isValid()) {
+                spill(iter.name());
+                iter.release();
+            }
+        }
+    }
+
+    // Used to ASSERT flushRegisters() has been called prior to
+    // calling out from JIT code to a C helper function.
+    bool isFlushed()
+    {
+        for (gpr_iterator iter = m_gprs.begin(); iter != m_gprs.end(); ++iter) {
+            if (iter.name().isValid())
+                return false;
+        }
+        for (fpr_iterator iter = m_fprs.begin(); iter != m_fprs.end(); ++iter) {
+            if (iter.name().isValid())
+                return false;
+        }
+        return true;
+    }
+
+#if USE(JSVALUE64)
+    static MacroAssembler::Imm64 valueOfJSConstantAsImm64(Node* node)
+    {
+        return MacroAssembler::Imm64(JSValue::encode(node->asJSValue()));
+    }
+#endif
+
+    // Helper functions to enable code sharing in implementations of bit/shift ops.
+    void bitOp(NodeType op, int32_t imm, GPRReg op1, GPRReg result)
+    {
+        switch (op) {
+        case BitAnd:
+            m_jit.and32(Imm32(imm), op1, result);
+            break;
+        case BitOr:
+            m_jit.or32(Imm32(imm), op1, result);
+            break;
+        case BitXor:
+            m_jit.xor32(Imm32(imm), op1, result);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    void bitOp(NodeType op, GPRReg op1, GPRReg op2, GPRReg result)
+    {
+        switch (op) {
+        case BitAnd:
+            m_jit.and32(op1, op2, result);
+            break;
+        case BitOr:
+            m_jit.or32(op1, op2, result);
+            break;
+        case BitXor:
+            m_jit.xor32(op1, op2, result);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    void shiftOp(NodeType op, GPRReg op1, int32_t shiftAmount, GPRReg result)
+    {
+        switch (op) {
+        case BitRShift:
+            m_jit.rshift32(op1, Imm32(shiftAmount), result);
+            break;
+        case BitLShift:
+            m_jit.lshift32(op1, Imm32(shiftAmount), result);
+            break;
+        case BitURShift:
+            m_jit.urshift32(op1, Imm32(shiftAmount), result);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    void shiftOp(NodeType op, GPRReg op1, GPRReg shiftAmount, GPRReg result)
+    {
+        switch (op) {
+        case BitRShift:
+            m_jit.rshift32(op1, shiftAmount, result);
+            break;
+        case BitLShift:
+            m_jit.lshift32(op1, shiftAmount, result);
+            break;
+        case BitURShift:
+            m_jit.urshift32(op1, shiftAmount, result);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    
+    // Returns the index of the branch node if peephole is okay, UINT_MAX otherwise.
+    unsigned detectPeepHoleBranch()
+    {
+        // Check that no intervening nodes will be generated.
+        for (unsigned index = m_indexInBlock + 1; index < m_block->size() - 1; ++index) {
+            Node* node = m_block->at(index);
+            if (!node->shouldGenerate())
+                continue;
+            // Check if it's a Phantom that can be safely ignored.
+            if (node->op() == Phantom && !node->child1())
+                continue;
+            return UINT_MAX;
+        }
+
+        // Check if the lastNode is a branch on this node.
+        Node* lastNode = m_block->terminal();
+        return lastNode->op() == Branch && lastNode->child1() == m_currentNode ? m_block->size() - 1 : UINT_MAX;
+    }
+    
+    void compileMovHint(Node*);
+    void compileMovHintAndCheck(Node*);
+
+    void cachedGetById(CodeOrigin, JSValueRegs base, JSValueRegs result, unsigned identifierNumber, JITCompiler::Jump slowPathTarget = JITCompiler::Jump(), SpillRegistersMode = NeedToSpill, AccessType = AccessType::Get);
+
+#if USE(JSVALUE64)
+    void cachedGetById(CodeOrigin, GPRReg baseGPR, GPRReg resultGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget = JITCompiler::Jump(), SpillRegistersMode = NeedToSpill, AccessType = AccessType::Get);
+    void cachedPutById(CodeOrigin, GPRReg base, GPRReg value, GPRReg scratchGPR, unsigned identifierNumber, PutKind, JITCompiler::Jump slowPathTarget = JITCompiler::Jump(), SpillRegistersMode = NeedToSpill);
+#elif USE(JSVALUE32_64)
+    void cachedGetById(CodeOrigin, GPRReg baseTagGPROrNone, GPRReg basePayloadGPR, GPRReg resultTagGPR, GPRReg resultPayloadGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget = JITCompiler::Jump(), SpillRegistersMode = NeedToSpill, AccessType = AccessType::Get);
+    void cachedPutById(CodeOrigin, GPRReg basePayloadGPR, GPRReg valueTagGPR, GPRReg valuePayloadGPR, GPRReg scratchGPR, unsigned identifierNumber, PutKind, JITCompiler::Jump slowPathTarget = JITCompiler::Jump(), SpillRegistersMode = NeedToSpill);
+#endif
+
+    void compileDeleteById(Node*);
+    void compileDeleteByVal(Node*);
+    void compileTryGetById(Node*);
+    void compileIn(Node*);
+    
+    void nonSpeculativeNonPeepholeCompareNullOrUndefined(Edge operand);
+    void nonSpeculativePeepholeBranchNullOrUndefined(Edge operand, Node* branchNode);
+    
+    void nonSpeculativePeepholeBranch(Node*, Node* branchNode, MacroAssembler::RelationalCondition, S_JITOperation_EJJ helperFunction);
+    void nonSpeculativeNonPeepholeCompare(Node*, MacroAssembler::RelationalCondition, S_JITOperation_EJJ helperFunction);
+    bool nonSpeculativeCompare(Node*, MacroAssembler::RelationalCondition, S_JITOperation_EJJ helperFunction);
+    
+    void nonSpeculativePeepholeStrictEq(Node*, Node* branchNode, bool invert = false);
+    void nonSpeculativeNonPeepholeStrictEq(Node*, bool invert = false);
+    bool nonSpeculativeStrictEq(Node*, bool invert = false);
+    
+    void compileInstanceOfForObject(Node*, GPRReg valueReg, GPRReg prototypeReg, GPRReg scratchAndResultReg, GPRReg scratch2Reg);
+    void compileInstanceOf(Node*);
+    void compileInstanceOfCustom(Node*);
+
+    void compileIsCellWithType(Node*);
+    void compileIsTypedArrayView(Node*);
+
+    void emitCall(Node*);
+
+    void emitAllocateButterfly(GPRReg storageGPR, GPRReg sizeGPR, GPRReg scratch1, GPRReg scratch2, GPRReg scratch3, MacroAssembler::JumpList& slowCases);
+    void emitInitializeButterfly(GPRReg storageGPR, GPRReg sizeGPR, JSValueRegs emptyValueRegs, GPRReg scratchGPR);
+    void compileAllocateNewArrayWithSize(JSGlobalObject*, GPRReg resultGPR, GPRReg sizeGPR, IndexingType, bool shouldConvertLargeSizeToArrayStorage = true);
+    
+    // Called once a node has completed code generation but prior to setting
+    // its result, to free up its children. (This must happen prior to setting
+    // the nodes result, since the node may have the same VirtualRegister as
+    // a child, and as such will use the same GeneratioInfo).
+    void useChildren(Node*);
+
+    // These method called to initialize the the GenerationInfo
+    // to describe the result of an operation.
+    void int32Result(GPRReg reg, Node* node, DataFormat format = DataFormatInt32, UseChildrenMode mode = CallUseChildren)
+    {
+        if (mode == CallUseChildren)
+            useChildren(node);
+
+        VirtualRegister virtualRegister = node->virtualRegister();
+        GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+        if (format == DataFormatInt32) {
+            m_jit.jitAssertIsInt32(reg);
+            m_gprs.retain(reg, virtualRegister, SpillOrderInteger);
+            info.initInt32(node, node->refCount(), reg);
+        } else {
+#if USE(JSVALUE64)
+            RELEASE_ASSERT(format == DataFormatJSInt32);
+            m_jit.jitAssertIsJSInt32(reg);
+            m_gprs.retain(reg, virtualRegister, SpillOrderJS);
+            info.initJSValue(node, node->refCount(), reg, format);
+#elif USE(JSVALUE32_64)
+            RELEASE_ASSERT_NOT_REACHED();
+#endif
+        }
+    }
+    void int32Result(GPRReg reg, Node* node, UseChildrenMode mode)
+    {
+        int32Result(reg, node, DataFormatInt32, mode);
+    }
+    void int52Result(GPRReg reg, Node* node, DataFormat format, UseChildrenMode mode = CallUseChildren)
+    {
+        if (mode == CallUseChildren)
+            useChildren(node);
+
+        VirtualRegister virtualRegister = node->virtualRegister();
+        GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+        m_gprs.retain(reg, virtualRegister, SpillOrderJS);
+        info.initInt52(node, node->refCount(), reg, format);
+    }
+    void int52Result(GPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+        int52Result(reg, node, DataFormatInt52, mode);
+    }
+    void strictInt52Result(GPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+        int52Result(reg, node, DataFormatStrictInt52, mode);
+    }
+    void noResult(Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+        if (mode == UseChildrenCalledExplicitly)
+            return;
+        useChildren(node);
+    }
+    void cellResult(GPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+        if (mode == CallUseChildren)
+            useChildren(node);
+
+        VirtualRegister virtualRegister = node->virtualRegister();
+        m_gprs.retain(reg, virtualRegister, SpillOrderCell);
+        GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+        info.initCell(node, node->refCount(), reg);
+    }
+    void blessedBooleanResult(GPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+#if USE(JSVALUE64)
+        jsValueResult(reg, node, DataFormatJSBoolean, mode);
+#else
+        booleanResult(reg, node, mode);
+#endif
+    }
+    void unblessedBooleanResult(GPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+#if USE(JSVALUE64)
+        blessBoolean(reg);
+#endif
+        blessedBooleanResult(reg, node, mode);
+    }
+#if USE(JSVALUE64)
+    void jsValueResult(GPRReg reg, Node* node, DataFormat format = DataFormatJS, UseChildrenMode mode = CallUseChildren)
+    {
+        if (format == DataFormatJSInt32)
+            m_jit.jitAssertIsJSInt32(reg);
+        
+        if (mode == CallUseChildren)
+            useChildren(node);
+
+        VirtualRegister virtualRegister = node->virtualRegister();
+        m_gprs.retain(reg, virtualRegister, SpillOrderJS);
+        GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+        info.initJSValue(node, node->refCount(), reg, format);
+    }
+    void jsValueResult(GPRReg reg, Node* node, UseChildrenMode mode)
+    {
+        jsValueResult(reg, node, DataFormatJS, mode);
+    }
+#elif USE(JSVALUE32_64)
+    void booleanResult(GPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+        if (mode == CallUseChildren)
+            useChildren(node);
+
+        VirtualRegister virtualRegister = node->virtualRegister();
+        m_gprs.retain(reg, virtualRegister, SpillOrderBoolean);
+        GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+        info.initBoolean(node, node->refCount(), reg);
+    }
+    void jsValueResult(GPRReg tag, GPRReg payload, Node* node, DataFormat format = DataFormatJS, UseChildrenMode mode = CallUseChildren)
+    {
+        if (mode == CallUseChildren)
+            useChildren(node);
+
+        VirtualRegister virtualRegister = node->virtualRegister();
+        m_gprs.retain(tag, virtualRegister, SpillOrderJS);
+        m_gprs.retain(payload, virtualRegister, SpillOrderJS);
+        GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+        info.initJSValue(node, node->refCount(), tag, payload, format);
+    }
+    void jsValueResult(GPRReg tag, GPRReg payload, Node* node, UseChildrenMode mode)
+    {
+        jsValueResult(tag, payload, node, DataFormatJS, mode);
+    }
+#endif
+    void jsValueResult(JSValueRegs regs, Node* node, DataFormat format = DataFormatJS, UseChildrenMode mode = CallUseChildren)
+    {
+#if USE(JSVALUE64)
+        jsValueResult(regs.gpr(), node, format, mode);
+#else
+        jsValueResult(regs.tagGPR(), regs.payloadGPR(), node, format, mode);
+#endif
+    }
+    void storageResult(GPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+        if (mode == CallUseChildren)
+            useChildren(node);
+        
+        VirtualRegister virtualRegister = node->virtualRegister();
+        m_gprs.retain(reg, virtualRegister, SpillOrderStorage);
+        GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+        info.initStorage(node, node->refCount(), reg);
+    }
+    void doubleResult(FPRReg reg, Node* node, UseChildrenMode mode = CallUseChildren)
+    {
+        if (mode == CallUseChildren)
+            useChildren(node);
+
+        VirtualRegister virtualRegister = node->virtualRegister();
+        m_fprs.retain(reg, virtualRegister, SpillOrderDouble);
+        GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+        info.initDouble(node, node->refCount(), reg);
+    }
+    void initConstantInfo(Node* node)
+    {
+        ASSERT(node->hasConstant());
+        generationInfo(node).initConstant(node, node->refCount());
+    }
+    
+    // These methods add calls to C++ helper functions.
+    // These methods are broadly value representation specific (i.e.
+    // deal with the fact that a JSValue may be passed in one or two
+    // machine registers, and delegate the calling convention specific
+    // decision as to how to fill the regsiters to setupArguments* methods.
+
+    JITCompiler::Call callOperation(V_JITOperation_E operation)
+    {
+        m_jit.setupArgumentsExecState();
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_E operation, GPRReg result)
+    {
+        m_jit.setupArgumentsExecState();
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EC operation, GPRReg result, GPRReg cell)
+    {
+        m_jit.setupArgumentsWithExecState(cell);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Jss_JITOperation_EJssUi operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EO operation, GPRReg result, GPRReg object)
+    {
+        m_jit.setupArgumentsWithExecState(object);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EOS operation, GPRReg result, GPRReg object, size_t size)
+    {
+        m_jit.setupArgumentsWithExecState(object, TrustedImmPtr(size));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EOZ operation, GPRReg result, GPRReg object, int32_t size)
+    {
+        m_jit.setupArgumentsWithExecState(object, TrustedImmPtr(size));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EOZ operation, GPRReg result, GPRReg object, int32_t size)
+    {
+        m_jit.setupArgumentsWithExecState(object, TrustedImmPtr(static_cast<size_t>(size)));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EPS operation, GPRReg result, GPRReg old, size_t size)
+    {
+        m_jit.setupArgumentsWithExecState(old, TrustedImmPtr(size));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EPUi operation, GPRReg result, void* arg1, uint32_t arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(arg1), TrustedImm32(arg2));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_ES operation, GPRReg result, size_t size)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(size));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_ESJss operation, GPRReg result, size_t index, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(index), arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Z_JITOperation_EOI operation, GPRReg result, GPRReg obj, GPRReg impl)
+    {
+        m_jit.setupArgumentsWithExecState(obj, impl);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_ESt operation, GPRReg result, RegisteredStructure structure)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStZP operation, GPRReg result, RegisteredStructure structure, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStZP operation, GPRReg result, RegisteredStructure structure, size_t arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), TrustedImm32(arg2), arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStZP operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStZB operation, GPRReg result, RegisteredStructure structure, GPRReg arg2, GPRReg butterfly)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), arg2, butterfly);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStZB operation, GPRReg result, RegisteredStructure structure, size_t arg2, GPRReg butterfly)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), TrustedImm32(arg2), butterfly);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStZB operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg butterfly)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, butterfly);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStZB operation, GPRReg result, GPRReg arg1, GPRReg arg2, Butterfly* butterfly)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(butterfly));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStPS operation, GPRReg result, RegisteredStructure structure, void* pointer, size_t size)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), TrustedImmPtr(pointer), TrustedImmPtr(size));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(P_JITOperation_EStSS operation, GPRReg result, RegisteredStructure structure, size_t index, size_t size)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), TrustedImmPtr(index), TrustedImmPtr(size));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_E operation, GPRReg result)
+    {
+        m_jit.setupArgumentsExecState();
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EC operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EC operation, GPRReg result, JSCell* cell)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), cell));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_ECZ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_ECZC operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJscC operation, GPRReg result, GPRReg arg1, JSCell* cell)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr::weakPointer(m_jit.graph(), cell));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EIcf operation, GPRReg result, InlineCallFrame* inlineCallFrame)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(inlineCallFrame));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_ESt operation, GPRReg result, RegisteredStructure structure)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure));
+        return appendCallSetResult(operation, result);
+    }
+
+#if USE(JSVALUE64)
+    JITCompiler::Call callOperation(C_JITOperation_EStJscSymtabJ operation, GPRReg result, RegisteredStructure structure, GPRReg scope, SymbolTable* table, TrustedImm64 initialValue)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), scope, TrustedImmPtr::weakPointer(m_jit.graph(), table), initialValue);
+        return appendCallSetResult(operation, result);
+    }
+#else
+    JITCompiler::Call callOperation(C_JITOperation_EStJscSymtabJ operation, GPRReg result, RegisteredStructure structure, GPRReg scope, SymbolTable* table, TrustedImm32 tag, TrustedImm32 payload)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), scope, TrustedImmPtr::weakPointer(m_jit.graph(), table), payload, tag);
+        return appendCallSetResult(operation, result);
+    }
+#endif
+    JITCompiler::Call callOperation(C_JITOperation_EStZ operation, GPRReg result, RegisteredStructure structure, unsigned knownLength)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), TrustedImm32(knownLength));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EStZZ operation, GPRReg result, RegisteredStructure structure, unsigned knownLength, unsigned minCapacity)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), TrustedImm32(knownLength), TrustedImm32(minCapacity));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EStZ operation, GPRReg result, RegisteredStructure structure, GPRReg length)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), length);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EStZZ operation, GPRReg result, RegisteredStructure structure, GPRReg length, unsigned minCapacity)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), length, TrustedImm32(minCapacity));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJssSt operation, GPRReg result, GPRReg arg1, RegisteredStructure structure)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(structure));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJssJss operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_B_EJssJss operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_TT operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArguments(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJssJssJss operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(S_JITOperation_ECC operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(S_JITOperation_EGC operation, GPRReg result, JSGlobalObject* globalObject, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), arg2);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EGC operation, GPRReg result, JSGlobalObject* globalObject, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), arg2);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(Jss_JITOperation_EZ operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EC operation, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_ECliJsf operation, CallLinkInfo* callLinkInfo, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(callLinkInfo), arg1);
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EC operation, JSCell* arg1)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), arg1));
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_ECIcf operation, GPRReg arg1, InlineCallFrame* inlineCallFrame)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(inlineCallFrame));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECCIcf operation, GPRReg arg1, GPRReg arg2, InlineCallFrame* inlineCallFrame)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(inlineCallFrame));
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_ECZ operation, GPRReg arg1, int arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImm32(arg2));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECC operation, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECC operation, GPRReg arg1, JSCell* arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr::weakPointer(m_jit.graph(), arg2));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECC operation, JSCell* arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), arg1), arg2);
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperationWithCallFrameRollbackOnException(V_JITOperation_ECb operation, void* pointer)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(pointer));
+        return appendCallWithCallFrameRollbackOnException(operation);
+    }
+
+    JITCompiler::Call callOperationWithCallFrameRollbackOnException(Z_JITOperation_E operation, GPRReg result)
+    {
+        m_jit.setupArgumentsExecState();
+        return appendCallWithCallFrameRollbackOnExceptionSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Z_JITOperation_EC operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_ECIZC operation, GPRReg regOp1, UniquedStringImpl* identOp2, int32_t op3, GPRReg regOp4)
+    {
+        m_jit.setupArgumentsWithExecState(regOp1, TrustedImmPtr(identOp2), TrustedImm32(op3), regOp4);
+        return appendCall(operation);
+    }
+
+    template<typename FunctionType, typename... Args>
+    JITCompiler::Call callOperation(FunctionType operation, NoResultTag, Args... args)
+    {
+        return callOperation(operation, args...);
+    }
+
+    JITCompiler::Call callOperation(D_JITOperation_ZZ operation, FPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArguments(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(D_JITOperation_D operation, FPRReg result, FPRReg arg1)
+    {
+        m_jit.setupArguments(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(D_JITOperation_DD operation, FPRReg result, FPRReg arg1, FPRReg arg2)
+    {
+        m_jit.setupArguments(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(T_JITOperation_EJss operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJscZ operation, GPRReg result, GPRReg arg1, int32_t arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImm32(arg2));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EZ operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EZ operation, GPRReg result, int32_t arg1)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1));
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(J_JITOperation_EJscC operation, GPRReg result, GPRReg arg1, JSCell* cell)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr::weakPointer(m_jit.graph(), cell));
+        return appendCallSetResult(operation, result);
+    }
+    
+    JITCompiler::Call callOperation(J_JITOperation_EJscCJ operation, GPRReg result, GPRReg arg1, JSCell* cell, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr::weakPointer(m_jit.graph(), cell), arg2);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(J_JITOperation_EGReoJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(J_JITOperation_EGReoJss operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EWs operation, WatchpointSet* watchpointSet)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(watchpointSet));
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_ERUiUi operation, GPRReg result, GPRReg arg1, Imm32 arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.asTrustedImm32(), arg3);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EJscI operation, GPRReg result, GPRReg arg1, UniquedStringImpl* impl)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(impl));
+        return appendCallSetResult(operation, result);
+    }
+
+
+#if USE(JSVALUE64)
+    JITCompiler::Call callOperation(Z_JITOperation_EOJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_ECJZ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJMic operation, JSValueRegs result, JSValueRegs arg, TrustedImmPtr mathIC)
+    {
+        m_jit.setupArgumentsWithExecState(arg.gpr(), mathIC);
+        return appendCallSetResult(operation, result.gpr());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJMic operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr mathIC)
+    {
+        m_jit.setupArgumentsWithExecState(arg1.gpr(), arg2.gpr(), mathIC);
+        return appendCallSetResult(operation, result.gpr());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJI operation, GPRReg result, GPRReg arg1, GPRReg arg2, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EJJJI operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, TrustedImmPtr(uid));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EJJJJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJJZ operation, GPRReg arg1, JSValueRegs arg2, JSValueRegs arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg3.payloadGPR(), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJssJZ operation, GPRReg arg1, GPRReg arg2, JSValueRegs arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3.payloadGPR(), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOIJZ operation, GPRReg arg1, GPRReg arg2, JSValueRegs arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3.payloadGPR(), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOSymJZ operation, GPRReg arg1, GPRReg arg2, JSValueRegs arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3.payloadGPR(), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJOOZ operation, GPRReg arg1, JSValueRegs arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg3, arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJssOOZ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOIOOZ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOSymOOZ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJIUi operation, GPRReg arg1, GPRReg arg2, UniquedStringImpl* impl, unsigned value)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(impl), TrustedImm32(value));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EOIUi operation, GPRReg result, GPRReg arg1, UniquedStringImpl* impl, unsigned value)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(impl), TrustedImm32(value));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_E operation, GPRReg result)
+    {
+        m_jit.setupArgumentsExecState();
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EP operation, GPRReg result, void* pointer)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(pointer));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Z_JITOperation_D operation, GPRReg result, FPRReg arg1)
+    {
+        m_jit.setupArguments(arg1);
+        JITCompiler::Call call = m_jit.appendCall(operation);
+        m_jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, result);
+        return call;
+    }
+    JITCompiler::Call callOperation(Q_JITOperation_J operation, GPRReg result, GPRReg value)
+    {
+        m_jit.setupArguments(value);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Q_JITOperation_D operation, GPRReg result, FPRReg value)
+    {
+        m_jit.setupArguments(value);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EI operation, GPRReg result, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EA operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EAZ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJssReo operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJssReoJss operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJssZ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EPS operation, GPRReg result, void* pointer, size_t size)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(pointer), TrustedImmPtr(size));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ESS operation, GPRReg result, int startConstant, int numConstants)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(startConstant), TrustedImm32(numConstants));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EPP operation, GPRReg result, GPRReg arg1, void* pointer)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(pointer));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EC operation, GPRReg result, JSCell* cell)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), cell));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ECZ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ESsiCI operation, GPRReg result, StructureStubInfo* stubInfo, GPRReg arg1, const UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ESsiJI operation, GPRReg result, StructureStubInfo* stubInfo, GPRReg arg1, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EDA operation, GPRReg result, FPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJC operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJZ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJA operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EP operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EZ operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EZ operation, GPRReg result, int32_t arg1)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EZZ operation, GPRReg result, int32_t arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1), arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EZIcfZ operation, GPRReg result, int32_t arg1, InlineCallFrame* inlineCallFrame, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1), TrustedImmPtr(inlineCallFrame), arg2);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(P_JITOperation_EJS operation, GPRReg result, GPRReg value, size_t index)
+    {
+        m_jit.setupArgumentsWithExecState(value, TrustedImmPtr(index));
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(P_JITOperation_EStJ operation, GPRReg result, RegisteredStructure structure, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), arg2);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EGJ operation, GPRReg result, JSGlobalObject* globalObject, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), arg1);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EGJ operation, GPRReg result, JSGlobalObject* globalObject, JSValueRegs arg1)
+    {
+        return callOperation(operation, result, globalObject, arg1.gpr());
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EJ operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJJC operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJZ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_EJZC operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_J operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArguments(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EJ operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EJ operation, GPRReg result, JSValueRegs arg1)
+    {
+        return callOperation(operation, result, arg1.gpr());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJ operation, JSValueRegs result, JSValueRegs arg1)
+    {
+        return callOperation(operation, result.payloadGPR(), arg1.payloadGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJ operation, GPRReg result, JSValueRegs arg1)
+    {
+        return callOperation(operation, result, arg1.payloadGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJ operation, GPRReg result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EJI operation, GPRReg result, GPRReg arg1, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EJI operation, GPRReg result, JSValueRegs arg1, UniquedStringImpl* uid)
+    {
+        return callOperation(operation, result, arg1.gpr(), uid);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EJJ operation, GPRReg result,  JSValueRegs arg1, JSValueRegs arg2)
+    {
+        return callOperation(operation, result, arg1.gpr(), arg2.gpr());
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EGJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EGReoJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EGReoJss operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(J_JITOperation_EPP operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EPPP operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EGP operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EGJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJ operation, GPRReg result, GPRReg arg1, int32_t imm)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(imm))));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJ operation, GPRReg result, int32_t imm, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(imm))), arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJ operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2)
+    {
+        return callOperation(operation, result.payloadGPR(), arg1.payloadGPR(), arg2.payloadGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ECC operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ECJ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ECJ operation, GPRReg result, GPRReg arg1, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.gpr());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EOZD operation, GPRReg arg1, GPRReg arg2, FPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EJ operation, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EJPP operation, GPRReg arg1, GPRReg arg2, void* pointer)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(pointer));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ESsiJJI operation, StructureStubInfo* stubInfo, GPRReg arg1, GPRReg arg2, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, arg2, TrustedImmPtr(uid));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EJJJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EPZJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EOZJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECJ operation, GPRReg arg1, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR());
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECJJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(Z_JITOperation_EJ operation, GPRReg result, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1.payloadGPR());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(Z_JITOperation_EJZZ operation, GPRReg result, GPRReg arg1, unsigned arg2, unsigned arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImm32(arg2), TrustedImm32(arg3));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(F_JITOperation_EFJZZ operation, GPRReg result, GPRReg arg1, GPRReg arg2, unsigned arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, TrustedImm32(arg3), arg4);
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(Z_JITOperation_EJOJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Z_JITOperation_EJOJ operation, GPRReg result, JSValueRegs arg1, GPRReg arg2, JSValueRegs arg3)
+    {
+        return callOperation(operation, result, arg1.payloadGPR(), arg2, arg3.payloadGPR());
+    }
+
+    JITCompiler::Call callOperation(Z_JITOperation_EJZ operation, GPRReg result, GPRReg arg1, unsigned arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImm32(arg2));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EZJZZZ operation, unsigned arg1, GPRReg arg2, unsigned arg3, GPRReg arg4, unsigned arg5)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1), arg2, TrustedImm32(arg3), arg4, TrustedImm32(arg5));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECJZC operation, GPRReg regOp1, GPRReg regOp2, int32_t op3, GPRReg regOp4)
+    {
+        m_jit.setupArgumentsWithExecState(regOp1, regOp2, TrustedImm32(op3), regOp4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECIZJJ operation, GPRReg regOp1, UniquedStringImpl* identOp2, int32_t op3, GPRReg regOp4, GPRReg regOp5)
+    {
+        m_jit.setupArgumentsWithExecState(regOp1, TrustedImmPtr(identOp2), TrustedImm32(op3), regOp4, regOp5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(D_JITOperation_EJ operation, FPRReg result, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1.gpr());
+        return appendCallSetResult(operation, result);
+    }
+#else // USE(JSVALUE32_64)
+    JITCompiler::Call callOperation(Z_JITOperation_EOJ operation, GPRReg result, GPRReg arg1, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(C_JITOperation_ECJZ operation, GPRReg result, GPRReg arg1, JSValueRegs arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJMic operation, JSValueRegs result, JSValueRegs arg, TrustedImmPtr mathIC)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg.payloadGPR(), arg.tagGPR(), mathIC);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJMic operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr mathIC)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR(), mathIC);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+
+    JITCompiler::Call callOperation(J_JITOperation_EJJI operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR(), TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EJJJI operation, JSValueRegs arg1, JSValueRegs arg2, JSValueRegs arg3, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR(), arg3.payloadGPR(), arg3.tagGPR(), TrustedImmPtr(uid));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EJJJJ operation, JSValueRegs arg1, JSValueRegs arg2, JSValueRegs arg3, JSValueRegs arg4)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR(), arg3.payloadGPR(), arg3.tagGPR(), arg4.payloadGPR(), arg4.tagGPR());
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJJZ operation, GPRReg arg1, JSValueRegs arg2, JSValueRegs arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), arg3.payloadGPR(), arg3.tagGPR(), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJssJZ operation, GPRReg arg1, GPRReg arg2, JSValueRegs arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR(), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOIJZ operation, GPRReg arg1, GPRReg arg2, JSValueRegs arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR(), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOSymJZ operation, GPRReg arg1, GPRReg arg2, JSValueRegs arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR(), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJOOZ operation, GPRReg arg1, JSValueRegs arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), arg3, arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJssOOZ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOIOOZ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOSymOOZ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3, arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOJIUi operation, GPRReg arg1, JSValueRegs arg2, UniquedStringImpl* impl, unsigned value)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), TrustedImmPtr(impl), TrustedImm32(value));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EOIUi operation, JSValueRegs result, GPRReg arg1, UniquedStringImpl* impl, unsigned value)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(impl), TrustedImm32(value));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(D_JITOperation_G operation, FPRReg result, JSGlobalObject* globalObject)
+    {
+        m_jit.setupArguments(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Z_JITOperation_D operation, GPRReg result, FPRReg arg1)
+    {
+        prepareForExternalCall();
+        m_jit.setupArguments(arg1);
+        JITCompiler::Call call = m_jit.appendCall(operation);
+        m_jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, result);
+        return call;
+    }
+    JITCompiler::Call callOperation(J_JITOperation_E operation, JSValueRegs result)
+    {
+        m_jit.setupArgumentsExecState();
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EP operation, JSValueRegs result, void* pointer)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(pointer));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EPP operation, JSValueRegs result, GPRReg arg1, void* pointer)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(pointer));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EPP operation, JSValueRegs result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EPPP operation, JSValueRegs result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EGP operation, JSValueRegs result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EP operation, JSValueRegs result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EI operation, JSValueRegs result, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EA operation, JSValueRegs result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EAZ operation, JSValueRegs result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJ operation, JSValueRegs result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJC operation, JSValueRegs result, JSValueRegs arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJssZ operation, JSValueRegs result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJssReo operation, JSValueRegs result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJssReoJss operation, JSValueRegs result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EPS operation, JSValueRegs result, void* pointer, size_t size)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(pointer), TrustedImmPtr(size));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ESS operation, JSValueRegs result, int startConstant, int numConstants)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(startConstant), TrustedImm32(numConstants));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJP operation, JSValueRegs result, JSValueRegs arg1, void* pointer)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), TrustedImmPtr(pointer));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJP operation, JSValueRegs result, JSValueRegs arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+
+    JITCompiler::Call callOperation(J_JITOperation_EC operation, JSValueRegs result, JSCell* cell)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), cell));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ECZ operation, JSValueRegs result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJscC operation, JSValueRegs result, GPRReg arg1, JSCell* cell)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr::weakPointer(m_jit.graph(), cell));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJscCJ operation, GPRReg result, GPRReg arg1, JSCell* cell, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr::weakPointer(m_jit.graph(), cell), EABI_32BIT_DUMMY_ARG arg2.payloadGPR(), arg2.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EGReoJ operation, JSValueRegs result, GPRReg arg1, GPRReg arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR());
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EGReoJss operation, JSValueRegs result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ESsiCI operation, JSValueRegs result, StructureStubInfo* stubInfo, GPRReg arg1, const UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ESsiJI operation, JSValueRegs result, StructureStubInfo* stubInfo, JSValueRegs arg1, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1.payloadGPR(), arg1.tagGPR(), TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ESsiJI operation, JSValueRegs result, StructureStubInfo* stubInfo, int32_t arg1Tag, GPRReg arg1Payload, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1Payload, TrustedImm32(arg1Tag), TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ESsiJI operation, JSValueRegs result, StructureStubInfo* stubInfo, GPRReg arg1Tag, GPRReg arg1Payload, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1Payload, arg1Tag, TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EDA operation, JSValueRegs result, FPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJA operation, JSValueRegs result, JSValueRegs arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJA operation, JSValueRegs result, TrustedImm32 arg1Tag, GPRReg arg1Payload, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJA operation, JSValueRegs result, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJ operation, JSValueRegs result, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR());
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EZ operation, JSValueRegs result, GPRReg arg1)
+    {
+        m_jit.setupArgumentsWithExecState(arg1);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EZ operation, JSValueRegs result, int32_t arg1)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EZIcfZ operation, JSValueRegs result, int32_t arg1, InlineCallFrame* inlineCallFrame, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1), TrustedImmPtr(inlineCallFrame), arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EZZ operation, JSValueRegs result, int32_t arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1), arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+
+    JITCompiler::Call callOperation(P_JITOperation_EJS operation, GPRReg result, JSValueRegs value, size_t index)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG value.payloadGPR(), value.tagGPR(), TrustedImmPtr(index));
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(P_JITOperation_EStJ operation, GPRReg result, RegisteredStructure structure, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure), arg2.payloadGPR(), arg2.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EGJ operation, GPRReg result, JSGlobalObject* globalObject, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), arg1.payloadGPR(), arg1.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EJ operation, GPRReg result, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EJJ operation, GPRReg result, JSValueRegs arg1, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(C_JITOperation_EJJJ operation, GPRReg result, JSValueRegs arg1, JSValueRegs arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR(), arg3.payloadGPR(), arg3.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(S_JITOperation_EJ operation, GPRReg result, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(S_JITOperation_EJI operation, GPRReg result, JSValueRegs arg1, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), TrustedImmPtr(uid));
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(S_JITOperation_EJJ operation, GPRReg result, JSValueRegs arg1, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), SH4_32BIT_DUMMY_ARG arg2.payloadGPR(), arg2.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+
+    JITCompiler::Call callOperation(S_JITOperation_EGJJ operation, GPRReg result, GPRReg arg1, JSValueRegs arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), SH4_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EGReoJ operation, GPRReg result, GPRReg arg1, GPRReg arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(S_JITOperation_EGReoJss operation, GPRReg result, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, arg3);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJ operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), SH4_32BIT_DUMMY_ARG arg2.payloadGPR(), arg2.tagGPR());
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EGJJ operation, JSValueRegs result, GPRReg arg1, JSValueRegs arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), SH4_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR());
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJ operation, JSValueRegs result, JSValueRegs arg1, MacroAssembler::TrustedImm32 imm)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), SH4_32BIT_DUMMY_ARG imm, TrustedImm32(JSValue::Int32Tag));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJ operation, JSValueRegs result, MacroAssembler::TrustedImm32 imm, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG imm, TrustedImm32(JSValue::Int32Tag), SH4_32BIT_DUMMY_ARG arg2.payloadGPR(), arg2.tagGPR());
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_EJJJ operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR(), arg3.payloadGPR(), arg3.tagGPR());
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+
+    JITCompiler::Call callOperation(J_JITOperation_ECJ operation, JSValueRegs result, GPRReg arg1, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR());
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ECJ operation, JSValueRegs result, GPRReg arg1, GPRReg arg2Payload)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2Payload, MacroAssembler::TrustedImm32(JSValue::CellTag));
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+    JITCompiler::Call callOperation(J_JITOperation_ECC operation, JSValueRegs result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallSetResult(operation, result.payloadGPR(), result.tagGPR());
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EOZD operation, GPRReg arg1, GPRReg arg2, FPRReg arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG arg3);
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EJ operation, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR());
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EJPP operation, JSValueRegs arg1, GPRReg arg2, void* pointer)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2, TrustedImmPtr(pointer));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ESsiJJI operation, StructureStubInfo* stubInfo, JSValueRegs arg1, GPRReg arg2Payload, UniquedStringImpl* uid)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1.payloadGPR(), arg1.tagGPR(), arg2Payload, TrustedImm32(JSValue::CellTag), TrustedImmPtr(uid));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECJ operation, GPRReg arg1, JSValueRegs arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR());
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECJJ operation, GPRReg arg1, JSValueRegs arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), arg3.payloadGPR(), arg3.tagGPR());
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EPZJ operation, GPRReg arg1, GPRReg arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG SH4_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR());
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(V_JITOperation_EOZJ operation, GPRReg arg1, GPRReg arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG SH4_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR());
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOZJ operation, GPRReg arg1, GPRReg arg2, TrustedImm32 arg3Tag, GPRReg arg3Payload)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG SH4_32BIT_DUMMY_ARG arg3Payload, arg3Tag);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EOZJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3Tag, GPRReg arg3Payload)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2, EABI_32BIT_DUMMY_ARG SH4_32BIT_DUMMY_ARG arg3Payload, arg3Tag);
+        return appendCall(operation);
+    }
+
+    JITCompiler::Call callOperation(Z_JITOperation_EJOJ operation, GPRReg result, JSValueRegs arg1, GPRReg arg2, JSValueRegs arg3)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2, EABI_32BIT_DUMMY_ARG arg3.payloadGPR(), arg3.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Z_JITOperation_EJ operation, GPRReg result, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG  arg1.payloadGPR(), arg1.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Z_JITOperation_EJZZ operation, GPRReg result, JSValueRegs arg1, unsigned arg2, unsigned arg3)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG  arg1.payloadGPR(), arg1.tagGPR(), TrustedImm32(arg2), TrustedImm32(arg3));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(F_JITOperation_EFJZZ operation, GPRReg result, GPRReg arg1, JSValueRegs arg2, unsigned arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), TrustedImm32(arg3), arg4);
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(Z_JITOperation_EJZ operation, GPRReg result, JSValueRegs arg1, unsigned arg2)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), TrustedImm32(arg2));
+        return appendCallSetResult(operation, result);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_EZJZZZ operation, unsigned arg1, JSValueRegs arg2, unsigned arg3, GPRReg arg4, unsigned arg5)
+    {
+        m_jit.setupArgumentsWithExecState(TrustedImm32(arg1), arg2.payloadGPR(), arg2.tagGPR(), TrustedImm32(arg3), arg4, TrustedImm32(arg5));
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECJZC operation, GPRReg arg1, JSValueRegs arg2, int32_t arg3, GPRReg arg4)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2.payloadGPR(), arg2.tagGPR(), TrustedImm32(arg3), arg4);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(V_JITOperation_ECIZCC operation, GPRReg arg1, UniquedStringImpl* identOp2, int32_t op3, GPRReg arg4, GPRReg arg5)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, TrustedImmPtr(identOp2), TrustedImm32(op3), arg4, arg5);
+        return appendCall(operation);
+    }
+    JITCompiler::Call callOperation(D_JITOperation_EJ operation, FPRReg result, JSValueRegs arg1)
+    {
+        m_jit.setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR());
+        return appendCallSetResult(operation, result);
+    }
+#endif // USE(JSVALUE32_64)
+    
+#if !defined(NDEBUG) && !CPU(ARM) && !CPU(MIPS) && !CPU(SH4)
+    void prepareForExternalCall()
+    {
+        // We're about to call out to a "native" helper function. The helper
+        // function is expected to set topCallFrame itself with the ExecState
+        // that is passed to it.
+        //
+        // We explicitly trash topCallFrame here so that we'll know if some of
+        // the helper functions are not setting topCallFrame when they should
+        // be doing so. Note: the previous value in topcallFrame was not valid
+        // anyway since it was not being updated by JIT'ed code by design.
+
+        for (unsigned i = 0; i < sizeof(void*) / 4; i++)
+            m_jit.store32(TrustedImm32(0xbadbeef), reinterpret_cast<char*>(&m_jit.vm()->topCallFrame) + i * 4);
+    }
+#else
+    void prepareForExternalCall() { }
+#endif
+
+    // These methods add call instructions, optionally setting results, and optionally rolling back the call frame on an exception.
+    JITCompiler::Call appendCall(const FunctionPtr& function)
+    {
+        prepareForExternalCall();
+        m_jit.emitStoreCodeOrigin(m_currentNode->origin.semantic);
+        return m_jit.appendCall(function);
+    }
+    JITCompiler::Call appendCallWithCallFrameRollbackOnException(const FunctionPtr& function)
+    {
+        JITCompiler::Call call = appendCall(function);
+        m_jit.exceptionCheckWithCallFrameRollback();
+        return call;
+    }
+    JITCompiler::Call appendCallWithCallFrameRollbackOnExceptionSetResult(const FunctionPtr& function, GPRReg result)
+    {
+        JITCompiler::Call call = appendCallWithCallFrameRollbackOnException(function);
+        if ((result != InvalidGPRReg) && (result != GPRInfo::returnValueGPR))
+            m_jit.move(GPRInfo::returnValueGPR, result);
+        return call;
+    }
+    JITCompiler::Call appendCallSetResult(const FunctionPtr& function, GPRReg result)
+    {
+        JITCompiler::Call call = appendCall(function);
+        if (result != InvalidGPRReg)
+            m_jit.move(GPRInfo::returnValueGPR, result);
+        return call;
+    }
+    JITCompiler::Call appendCallSetResult(const FunctionPtr& function, GPRReg result1, GPRReg result2)
+    {
+        JITCompiler::Call call = appendCall(function);
+        m_jit.setupResults(result1, result2);
+        return call;
+    }
+#if CPU(X86)
+    JITCompiler::Call appendCallSetResult(const FunctionPtr& function, FPRReg result)
+    {
+        JITCompiler::Call call = appendCall(function);
+        if (result != InvalidFPRReg) {
+            m_jit.assembler().fstpl(0, JITCompiler::stackPointerRegister);
+            m_jit.loadDouble(JITCompiler::stackPointerRegister, result);
+        }
+        return call;
+    }
+#elif CPU(ARM) && !CPU(ARM_HARDFP)
+    JITCompiler::Call appendCallSetResult(const FunctionPtr& function, FPRReg result)
+    {
+        JITCompiler::Call call = appendCall(function);
+        if (result != InvalidFPRReg)
+            m_jit.assembler().vmov(result, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        return call;
+    }
+#else // CPU(X86_64) || (CPU(ARM) && CPU(ARM_HARDFP)) || CPU(ARM64) || CPU(MIPS) || CPU(SH4)
+    JITCompiler::Call appendCallSetResult(const FunctionPtr& function, FPRReg result)
+    {
+        JITCompiler::Call call = appendCall(function);
+        if (result != InvalidFPRReg)
+            m_jit.moveDouble(FPRInfo::returnValueFPR, result);
+        return call;
+    }
+#endif
+    
+    void branchDouble(JITCompiler::DoubleCondition cond, FPRReg left, FPRReg right, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchDouble(cond, left, right), destination);
+    }
+    
+    void branchDoubleNonZero(FPRReg value, FPRReg scratch, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchDoubleNonZero(value, scratch), destination);
+    }
+    
+    template<typename T, typename U>
+    void branch32(JITCompiler::RelationalCondition cond, T left, U right, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branch32(cond, left, right), destination);
+    }
+    
+    template<typename T, typename U>
+    void branchTest32(JITCompiler::ResultCondition cond, T value, U mask, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchTest32(cond, value, mask), destination);
+    }
+    
+    template<typename T>
+    void branchTest32(JITCompiler::ResultCondition cond, T value, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchTest32(cond, value), destination);
+    }
+    
+#if USE(JSVALUE64)
+    template<typename T, typename U>
+    void branch64(JITCompiler::RelationalCondition cond, T left, U right, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branch64(cond, left, right), destination);
+    }
+#endif
+    
+    template<typename T, typename U>
+    void branch8(JITCompiler::RelationalCondition cond, T left, U right, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branch8(cond, left, right), destination);
+    }
+    
+    template<typename T, typename U>
+    void branchPtr(JITCompiler::RelationalCondition cond, T left, U right, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchPtr(cond, left, right), destination);
+    }
+    
+    template<typename T, typename U>
+    void branchTestPtr(JITCompiler::ResultCondition cond, T value, U mask, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchTestPtr(cond, value, mask), destination);
+    }
+    
+    template<typename T>
+    void branchTestPtr(JITCompiler::ResultCondition cond, T value, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchTestPtr(cond, value), destination);
+    }
+    
+    template<typename T, typename U>
+    void branchTest8(JITCompiler::ResultCondition cond, T value, U mask, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchTest8(cond, value, mask), destination);
+    }
+    
+    template<typename T>
+    void branchTest8(JITCompiler::ResultCondition cond, T value, BasicBlock* destination)
+    {
+        return addBranch(m_jit.branchTest8(cond, value), destination);
+    }
+    
+    enum FallThroughMode {
+        AtFallThroughPoint,
+        ForceJump
+    };
+    void jump(BasicBlock* destination, FallThroughMode fallThroughMode = AtFallThroughPoint)
+    {
+        if (destination == nextBlock()
+            && fallThroughMode == AtFallThroughPoint)
+            return;
+        addBranch(m_jit.jump(), destination);
+    }
+    
+    void addBranch(const MacroAssembler::Jump& jump, BasicBlock* destination)
+    {
+        m_branches.append(BranchRecord(jump, destination));
+    }
+    void addBranch(const MacroAssembler::JumpList& jump, BasicBlock* destination);
+
+    void linkBranches();
+
+    void dump(const char* label = 0);
+
+    bool betterUseStrictInt52(Node* node)
+    {
+        return !generationInfo(node).isInt52();
+    }
+    bool betterUseStrictInt52(Edge edge)
+    {
+        return betterUseStrictInt52(edge.node());
+    }
+    
+    bool compare(Node*, MacroAssembler::RelationalCondition, MacroAssembler::DoubleCondition, S_JITOperation_EJJ);
+    bool compilePeepHoleBranch(Node*, MacroAssembler::RelationalCondition, MacroAssembler::DoubleCondition, S_JITOperation_EJJ);
+    void compilePeepHoleInt32Branch(Node*, Node* branchNode, JITCompiler::RelationalCondition);
+    void compilePeepHoleInt52Branch(Node*, Node* branchNode, JITCompiler::RelationalCondition);
+    void compilePeepHoleBooleanBranch(Node*, Node* branchNode, JITCompiler::RelationalCondition);
+    void compilePeepHoleDoubleBranch(Node*, Node* branchNode, JITCompiler::DoubleCondition);
+    void compilePeepHoleObjectEquality(Node*, Node* branchNode);
+    void compilePeepHoleObjectStrictEquality(Edge objectChild, Edge otherChild, Node* branchNode);
+    void compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, Node* branchNode);
+    void compileObjectEquality(Node*);
+    void compileObjectStrictEquality(Edge objectChild, Edge otherChild);
+    void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);
+    void compileObjectOrOtherLogicalNot(Edge value);
+    void compileLogicalNot(Node*);
+    void compileLogicalNotStringOrOther(Node*);
+    void compileStringEquality(
+        Node*, GPRReg leftGPR, GPRReg rightGPR, GPRReg lengthGPR,
+        GPRReg leftTempGPR, GPRReg rightTempGPR, GPRReg leftTemp2GPR,
+        GPRReg rightTemp2GPR, JITCompiler::JumpList fastTrue,
+        JITCompiler::JumpList fastSlow);
+    void compileStringEquality(Node*);
+    void compileStringIdentEquality(Node*);
+    void compileStringToUntypedEquality(Node*, Edge stringEdge, Edge untypedEdge);
+    void compileStringIdentToNotStringVarEquality(Node*, Edge stringEdge, Edge notStringVarEdge);
+    void compileStringZeroLength(Node*);
+    void compileMiscStrictEq(Node*);
+
+    void compileSymbolEquality(Node*);
+    void compilePeepHoleSymbolEquality(Node*, Node* branchNode);
+    void compileSymbolUntypedEquality(Node*, Edge symbolEdge, Edge untypedEdge);
+
+    void emitObjectOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
+    void emitStringBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
+    void emitStringOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
+    void emitBranch(Node*);
+    
+    struct StringSwitchCase {
+        StringSwitchCase() { }
+        
+        StringSwitchCase(StringImpl* string, BasicBlock* target)
+            : string(string)
+            , target(target)
+        {
+        }
+        
+        bool operator<(const StringSwitchCase& other) const
+        {
+            return stringLessThan(*string, *other.string);
+        }
+        
+        StringImpl* string;
+        BasicBlock* target;
+    };
+    
+    void emitSwitchIntJump(SwitchData*, GPRReg value, GPRReg scratch);
+    void emitSwitchImm(Node*, SwitchData*);
+    void emitSwitchCharStringJump(SwitchData*, GPRReg value, GPRReg scratch);
+    void emitSwitchChar(Node*, SwitchData*);
+    void emitBinarySwitchStringRecurse(
+        SwitchData*, const Vector<StringSwitchCase>&, unsigned numChecked,
+        unsigned begin, unsigned end, GPRReg buffer, GPRReg length, GPRReg temp,
+        unsigned alreadyCheckedLength, bool checkedExactLength);
+    void emitSwitchStringOnString(SwitchData*, GPRReg string);
+    void emitSwitchString(Node*, SwitchData*);
+    void emitSwitch(Node*);
+    
+    void compileToStringOrCallStringConstructorOnCell(Node*);
+    void compileNewStringObject(Node*);
+    
+    void compileNewTypedArray(Node*);
+    
+    void compileInt32Compare(Node*, MacroAssembler::RelationalCondition);
+    void compileInt52Compare(Node*, MacroAssembler::RelationalCondition);
+    void compileBooleanCompare(Node*, MacroAssembler::RelationalCondition);
+    void compileDoubleCompare(Node*, MacroAssembler::DoubleCondition);
+    void compileStringCompare(Node*, MacroAssembler::RelationalCondition);
+    void compileStringIdentCompare(Node*, MacroAssembler::RelationalCondition);
+    
+    bool compileStrictEq(Node*);
+    
+    void compileAllocatePropertyStorage(Node*);
+    void compileReallocatePropertyStorage(Node*);
+    void compileNukeStructureAndSetButterfly(Node*);
+    void compileGetButterfly(Node*);
+    void compileCallDOMGetter(Node*);
+    void compileCallDOM(Node*);
+    void compileCheckDOM(Node*);
+    
+#if USE(JSVALUE32_64)
+    template<typename BaseOperandType, typename PropertyOperandType, typename ValueOperandType, typename TagType>
+    void compileContiguousPutByVal(Node*, BaseOperandType&, PropertyOperandType&, ValueOperandType&, GPRReg valuePayloadReg, TagType valueTag);
+#endif
+    void compileDoublePutByVal(Node*, SpeculateCellOperand& base, SpeculateStrictInt32Operand& property);
+    bool putByValWillNeedExtraRegister(ArrayMode arrayMode)
+    {
+        return arrayMode.mayStoreToHole();
+    }
+    GPRReg temporaryRegisterForPutByVal(GPRTemporary&, ArrayMode);
+    GPRReg temporaryRegisterForPutByVal(GPRTemporary& temporary, Node* node)
+    {
+        return temporaryRegisterForPutByVal(temporary, node->arrayMode());
+    }
+    
+    void compileGetCharCodeAt(Node*);
+    void compileGetByValOnString(Node*);
+    void compileFromCharCode(Node*); 
+
+    void compileGetByValOnDirectArguments(Node*);
+    void compileGetByValOnScopedArguments(Node*);
+    
+    void compileGetScope(Node*);
+    void compileSkipScope(Node*);
+    void compileGetGlobalObject(Node*);
+
+    void compileGetArrayLength(Node*);
+
+    void compileCheckTypeInfoFlags(Node*);
+    void compileCheckStringIdent(Node*);
+    
+    void compileValueRep(Node*);
+    void compileDoubleRep(Node*);
+    
+    void compileValueToInt32(Node*);
+    void compileUInt32ToNumber(Node*);
+    void compileDoubleAsInt32(Node*);
+
+    template<typename SnippetGenerator, J_JITOperation_EJJ slowPathFunction>
+    void emitUntypedBitOp(Node*);
+    void compileBitwiseOp(Node*);
+
+    void emitUntypedRightShiftBitOp(Node*);
+    void compileShiftOp(Node*);
+
+    template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
+    void compileMathIC(Node*, JITBinaryMathIC<Generator>*, bool needsScratchGPRReg, bool needsScratchFPRReg, RepatchingFunction, NonRepatchingFunction);
+    template <typename Generator, typename RepatchingFunction, typename NonRepatchingFunction>
+    void compileMathIC(Node*, JITUnaryMathIC<Generator>*, bool needsScratchGPRReg, RepatchingFunction, NonRepatchingFunction);
+
+    void compileArithDoubleUnaryOp(Node*, double (*doubleFunction)(double), double (*operation)(ExecState*, EncodedJSValue));
+    void compileValueAdd(Node*);
+    void compileArithAdd(Node*);
+    void compileMakeRope(Node*);
+    void compileArithAbs(Node*);
+    void compileArithClz32(Node*);
+    void compileArithCos(Node*);
+    void compileArithTan(Node*);
+    void compileArithSub(Node*);
+    void compileArithNegate(Node*);
+    void compileArithMul(Node*);
+    void compileArithDiv(Node*);
+    void compileArithFRound(Node*);
+    void compileArithMod(Node*);
+    void compileArithPow(Node*);
+    void compileArithRounding(Node*);
+    void compileArithRandom(Node*);
+    void compileArithSin(Node*);
+    void compileArithSqrt(Node*);
+    void compileArithLog(Node*);
+    void compileConstantStoragePointer(Node*);
+    void compileGetIndexedPropertyStorage(Node*);
+    JITCompiler::Jump jumpForTypedArrayOutOfBounds(Node*, GPRReg baseGPR, GPRReg indexGPR);
+    JITCompiler::Jump jumpForTypedArrayIsNeuteredIfOutOfBounds(Node*, GPRReg baseGPR, JITCompiler::Jump outOfBounds);
+    void emitTypedArrayBoundsCheck(Node*, GPRReg baseGPR, GPRReg indexGPR);
+    void compileGetTypedArrayByteOffset(Node*);
+    void compileGetByValOnIntTypedArray(Node*, TypedArrayType);
+    void compilePutByValForIntTypedArray(GPRReg base, GPRReg property, Node*, TypedArrayType);
+    void compileGetByValOnFloatTypedArray(Node*, TypedArrayType);
+    void compilePutByValForFloatTypedArray(GPRReg base, GPRReg property, Node*, TypedArrayType);
+    template <typename ClassType> void compileNewFunctionCommon(GPRReg, RegisteredStructure, GPRReg, GPRReg, GPRReg, MacroAssembler::JumpList&, size_t, FunctionExecutable*, ptrdiff_t, ptrdiff_t, ptrdiff_t);
+    void compileNewFunction(Node*);
+    void compileSetFunctionName(Node*);
+    void compileForwardVarargs(Node*);
+    void compileCreateActivation(Node*);
+    void compileCreateDirectArguments(Node*);
+    void compileGetFromArguments(Node*);
+    void compilePutToArguments(Node*);
+    void compileGetArgument(Node*);
+    void compileCreateScopedArguments(Node*);
+    void compileCreateClonedArguments(Node*);
+    void compileCreateRest(Node*);
+    void compileSpread(Node*);
+    void compileNewArrayWithSpread(Node*);
+    void compileGetRestLength(Node*);
+    void compileArraySlice(Node*);
+    void compileNotifyWrite(Node*);
+    bool compileRegExpExec(Node*);
+    void compileIsObjectOrNull(Node*);
+    void compileIsFunction(Node*);
+    void compileTypeOf(Node*);
+    void compileCheckStructure(Node*, GPRReg cellGPR, GPRReg tempGPR);
+    void compileCheckStructure(Node*);
+    void compilePutAccessorById(Node*);
+    void compilePutGetterSetterById(Node*);
+    void compilePutAccessorByVal(Node*);
+    void compileGetRegExpObjectLastIndex(Node*);
+    void compileSetRegExpObjectLastIndex(Node*);
+    void compileLazyJSConstant(Node*);
+    void compileMaterializeNewObject(Node*);
+    void compileRecordRegExpCachedResult(Node*);
+    void compileCallObjectConstructor(Node*);
+    void compileResolveScope(Node*);
+    void compileGetDynamicVar(Node*);
+    void compilePutDynamicVar(Node*);
+    void compileCompareEqPtr(Node*);
+    void compileDefineDataProperty(Node*);
+    void compileDefineAccessorProperty(Node*);
+    void compileToLowerCase(Node*);
+
+    void moveTrueTo(GPRReg);
+    void moveFalseTo(GPRReg);
+    void blessBoolean(GPRReg);
+    
+    // Allocator for a cell of a specific size.
+    template <typename StructureType> // StructureType can be GPR or ImmPtr.
+    void emitAllocateJSCell(
+        GPRReg resultGPR, MarkedAllocator* allocator, GPRReg allocatorGPR, StructureType structure,
+        GPRReg scratchGPR, MacroAssembler::JumpList& slowPath)
+    {
+        m_jit.emitAllocateJSCell(resultGPR, allocator, allocatorGPR, structure, scratchGPR, slowPath);
+    }
+
+    // Allocator for an object of a specific size.
+    template <typename StructureType, typename StorageType> // StructureType and StorageType can be GPR or ImmPtr.
+    void emitAllocateJSObject(
+        GPRReg resultGPR, MarkedAllocator* allocator, GPRReg allocatorGPR, StructureType structure,
+        StorageType storage, GPRReg scratchGPR, MacroAssembler::JumpList& slowPath)
+    {
+        m_jit.emitAllocateJSObject(
+            resultGPR, allocator, allocatorGPR, structure, storage, scratchGPR, slowPath);
+    }
+
+    template <typename ClassType, typename StructureType, typename StorageType> // StructureType and StorageType can be GPR or ImmPtr.
+    void emitAllocateJSObjectWithKnownSize(
+        GPRReg resultGPR, StructureType structure, StorageType storage, GPRReg scratchGPR1,
+        GPRReg scratchGPR2, MacroAssembler::JumpList& slowPath, size_t size)
+    {
+        m_jit.emitAllocateJSObjectWithKnownSize<ClassType>(resultGPR, structure, storage, scratchGPR1, scratchGPR2, slowPath, size);
+    }
+
+    // Convenience allocator for a built-in object.
+    template <typename ClassType, typename StructureType, typename StorageType> // StructureType and StorageType can be GPR or ImmPtr.
+    void emitAllocateJSObject(GPRReg resultGPR, StructureType structure, StorageType storage,
+        GPRReg scratchGPR1, GPRReg scratchGPR2, MacroAssembler::JumpList& slowPath)
+    {
+        m_jit.emitAllocateJSObject<ClassType>(resultGPR, structure, storage, scratchGPR1, scratchGPR2, slowPath);
+    }
+
+    template <typename ClassType, typename StructureType> // StructureType and StorageType can be GPR or ImmPtr.
+    void emitAllocateVariableSizedJSObject(GPRReg resultGPR, StructureType structure, GPRReg allocationSize, GPRReg scratchGPR1, GPRReg scratchGPR2, MacroAssembler::JumpList& slowPath)
+    {
+        m_jit.emitAllocateVariableSizedJSObject<ClassType>(resultGPR, structure, allocationSize, scratchGPR1, scratchGPR2, slowPath);
+    }
+
+    template<typename ClassType>
+    void emitAllocateDestructibleObject(GPRReg resultGPR, RegisteredStructure structure, 
+        GPRReg scratchGPR1, GPRReg scratchGPR2, MacroAssembler::JumpList& slowPath)
+    {
+        m_jit.emitAllocateDestructibleObject<ClassType>(resultGPR, structure.get(), scratchGPR1, scratchGPR2, slowPath);
+    }
+
+    void emitAllocateRawObject(GPRReg resultGPR, RegisteredStructure, GPRReg storageGPR, unsigned numElements, unsigned vectorLength);
+    
+    void emitGetLength(InlineCallFrame*, GPRReg lengthGPR, bool includeThis = false);
+    void emitGetLength(CodeOrigin, GPRReg lengthGPR, bool includeThis = false);
+    void emitGetCallee(CodeOrigin, GPRReg calleeGPR);
+    void emitGetArgumentStart(CodeOrigin, GPRReg startGPR);
+    
+    // Generate an OSR exit fuzz check. Returns Jump() if OSR exit fuzz is not enabled, or if
+    // it's in training mode.
+    MacroAssembler::Jump emitOSRExitFuzzCheck();
+    
+    // Add a speculation check.
+    void speculationCheck(ExitKind, JSValueSource, Node*, MacroAssembler::Jump jumpToFail);
+    void speculationCheck(ExitKind, JSValueSource, Node*, const MacroAssembler::JumpList& jumpsToFail);
+
+    // Add a speculation check without additional recovery, and with a promise to supply a jump later.
+    OSRExitJumpPlaceholder speculationCheck(ExitKind, JSValueSource, Node*);
+    OSRExitJumpPlaceholder speculationCheck(ExitKind, JSValueSource, Edge);
+    void speculationCheck(ExitKind, JSValueSource, Edge, MacroAssembler::Jump jumpToFail);
+    void speculationCheck(ExitKind, JSValueSource, Edge, const MacroAssembler::JumpList& jumpsToFail);
+    // Add a speculation check with additional recovery.
+    void speculationCheck(ExitKind, JSValueSource, Node*, MacroAssembler::Jump jumpToFail, const SpeculationRecovery&);
+    void speculationCheck(ExitKind, JSValueSource, Edge, MacroAssembler::Jump jumpToFail, const SpeculationRecovery&);
+    
+    void emitInvalidationPoint(Node*);
+    
+    void unreachable(Node*);
+    
+    // Called when we statically determine that a speculation will fail.
+    void terminateSpeculativeExecution(ExitKind, JSValueRegs, Node*);
+    void terminateSpeculativeExecution(ExitKind, JSValueRegs, Edge);
+    
+    // Helpers for performing type checks on an edge stored in the given registers.
+    bool needsTypeCheck(Edge edge, SpeculatedType typesPassedThrough) { return m_interpreter.needsTypeCheck(edge, typesPassedThrough); }
+    void typeCheck(JSValueSource, Edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail, ExitKind = BadType);
+    
+    void speculateCellTypeWithoutTypeFiltering(Edge, GPRReg cellGPR, JSType);
+    void speculateCellType(Edge, GPRReg cellGPR, SpeculatedType, JSType);
+    
+    void speculateInt32(Edge);
+#if USE(JSVALUE64)
+    void convertAnyInt(Edge, GPRReg resultGPR);
+    void speculateAnyInt(Edge);
+    void speculateDoubleRepAnyInt(Edge);
+#endif // USE(JSVALUE64)
+    void speculateNumber(Edge);
+    void speculateRealNumber(Edge);
+    void speculateDoubleRepReal(Edge);
+    void speculateBoolean(Edge);
+    void speculateCell(Edge);
+    void speculateCellOrOther(Edge);
+    void speculateObject(Edge);
+    void speculateArray(Edge, GPRReg cell);
+    void speculateArray(Edge);
+    void speculateFunction(Edge);
+    void speculateFinalObject(Edge);
+    void speculateRegExpObject(Edge, GPRReg cell);
+    void speculateRegExpObject(Edge);
+    void speculateProxyObject(Edge, GPRReg cell);
+    void speculateProxyObject(Edge);
+    void speculateDerivedArray(Edge, GPRReg cell);
+    void speculateDerivedArray(Edge);
+    void speculateMapObject(Edge);
+    void speculateMapObject(Edge, GPRReg cell);
+    void speculateSetObject(Edge);
+    void speculateSetObject(Edge, GPRReg cell);
+    void speculateObjectOrOther(Edge);
+    void speculateString(Edge edge, GPRReg cell);
+    void speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage);
+    void speculateStringIdent(Edge edge, GPRReg string);
+    void speculateStringIdent(Edge);
+    void speculateString(Edge);
+    void speculateStringOrOther(Edge, JSValueRegs, GPRReg scratch);
+    void speculateStringOrOther(Edge);
+    void speculateNotStringVar(Edge);
+    template<typename StructureLocationType>
+    void speculateStringObjectForStructure(Edge, StructureLocationType);
+    void speculateStringObject(Edge, GPRReg);
+    void speculateStringObject(Edge);
+    void speculateStringOrStringObject(Edge);
+    void speculateSymbol(Edge, GPRReg cell);
+    void speculateSymbol(Edge);
+    void speculateNotCell(Edge);
+    void speculateOther(Edge);
+    void speculateMisc(Edge, JSValueRegs);
+    void speculateMisc(Edge);
+    void speculate(Node*, Edge);
+    
+    JITCompiler::Jump jumpSlowForUnwantedArrayMode(GPRReg tempWithIndexingTypeReg, ArrayMode, IndexingType);
+    JITCompiler::JumpList jumpSlowForUnwantedArrayMode(GPRReg tempWithIndexingTypeReg, ArrayMode);
+    void checkArray(Node*);
+    void arrayify(Node*, GPRReg baseReg, GPRReg propertyReg);
+    void arrayify(Node*);
+    
+    template<bool strict>
+    GPRReg fillSpeculateInt32Internal(Edge, DataFormat& returnFormat);
+    
+    // It is possible, during speculative generation, to reach a situation in which we
+    // can statically determine a speculation will fail (for example, when two nodes
+    // will make conflicting speculations about the same operand). In such cases this
+    // flag is cleared, indicating no further code generation should take place.
+    bool m_compileOkay;
+    
+    void recordSetLocal(
+        VirtualRegister bytecodeReg, VirtualRegister machineReg, DataFormat format)
+    {
+        m_stream->appendAndLog(VariableEvent::setLocal(bytecodeReg, machineReg, format));
+    }
+    
+    void recordSetLocal(DataFormat format)
+    {
+        VariableAccessData* variable = m_currentNode->variableAccessData();
+        recordSetLocal(variable->local(), variable->machineLocal(), format);
+    }
+
+    GenerationInfo& generationInfoFromVirtualRegister(VirtualRegister virtualRegister)
+    {
+        return m_generationInfo[virtualRegister.toLocal()];
+    }
+    
+    GenerationInfo& generationInfo(Node* node)
+    {
+        return generationInfoFromVirtualRegister(node->virtualRegister());
+    }
+    
+    GenerationInfo& generationInfo(Edge edge)
+    {
+        return generationInfo(edge.node());
+    }
+
+    // The JIT, while also provides MacroAssembler functionality.
+    JITCompiler& m_jit;
+
+    // The current node being generated.
+    BasicBlock* m_block;
+    Node* m_currentNode;
+    NodeType m_lastGeneratedNode;
+    unsigned m_indexInBlock;
+    // Virtual and physical register maps.
+    Vector<GenerationInfo, 32> m_generationInfo;
+    RegisterBank<GPRInfo> m_gprs;
+    RegisterBank<FPRInfo> m_fprs;
+
+    Vector<MacroAssembler::Label> m_osrEntryHeads;
+    
+    struct BranchRecord {
+        BranchRecord(MacroAssembler::Jump jump, BasicBlock* destination)
+            : jump(jump)
+            , destination(destination)
+        {
+        }
+
+        MacroAssembler::Jump jump;
+        BasicBlock* destination;
+    };
+    Vector<BranchRecord, 8> m_branches;
+
+    NodeOrigin m_origin;
+    
+    InPlaceAbstractState m_state;
+    AbstractInterpreter<InPlaceAbstractState> m_interpreter;
+    
+    VariableEventStream* m_stream;
+    MinifiedGraph* m_minifiedGraph;
+    
+    Vector<std::unique_ptr<SlowPathGenerator>, 8> m_slowPathGenerators;
+    struct SlowPathLambda {
+        std::function<void()> generator;
+        Node* currentNode;
+        unsigned streamIndex;
+    };
+    Vector<SlowPathLambda> m_slowPathLambdas;
+    Vector<SilentRegisterSavePlan> m_plans;
+    std::optional<unsigned> m_outOfLineStreamIndex;
+};
+
+
+// === Operand types ===
+//
+// These classes are used to lock the operands to a node into machine
+// registers. These classes implement of pattern of locking a value
+// into register at the point of construction only if it is already in
+// registers, and otherwise loading it lazily at the point it is first
+// used. We do so in order to attempt to avoid spilling one operand
+// in order to make space available for another.
+
+class JSValueOperand {
+public:
+    explicit JSValueOperand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+        : m_jit(jit)
+        , m_edge(edge)
+#if USE(JSVALUE64)
+        , m_gprOrInvalid(InvalidGPRReg)
+#elif USE(JSVALUE32_64)
+        , m_isDouble(false)
+#endif
+    {
+        ASSERT(m_jit);
+        if (!edge)
+            return;
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == UntypedUse);
+#if USE(JSVALUE64)
+        if (jit->isFilled(node()))
+            gpr();
+#elif USE(JSVALUE32_64)
+        m_register.pair.tagGPR = InvalidGPRReg;
+        m_register.pair.payloadGPR = InvalidGPRReg;
+        if (jit->isFilled(node()))
+            fill();
+#endif
+    }
+
+    explicit JSValueOperand(JSValueOperand&& other)
+        : m_jit(other.m_jit)
+        , m_edge(other.m_edge)
+    {
+#if USE(JSVALUE64)
+        m_gprOrInvalid = other.m_gprOrInvalid;
+#elif USE(JSVALUE32_64)
+        m_register.pair.tagGPR = InvalidGPRReg;
+        m_register.pair.payloadGPR = InvalidGPRReg;
+        m_isDouble = other.m_isDouble;
+
+        if (m_edge) {
+            if (m_isDouble)
+                m_register.fpr = other.m_register.fpr;
+            else
+                m_register.pair = other.m_register.pair;
+        }
+#endif
+        other.m_edge = Edge();
+#if USE(JSVALUE64)
+        other.m_gprOrInvalid = InvalidGPRReg;
+#elif USE(JSVALUE32_64)
+        other.m_isDouble = false;
+#endif
+    }
+
+    ~JSValueOperand()
+    {
+        if (!m_edge)
+            return;
+#if USE(JSVALUE64)
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+#elif USE(JSVALUE32_64)
+        if (m_isDouble) {
+            ASSERT(m_register.fpr != InvalidFPRReg);
+            m_jit->unlock(m_register.fpr);
+        } else {
+            ASSERT(m_register.pair.tagGPR != InvalidGPRReg && m_register.pair.payloadGPR != InvalidGPRReg);
+            m_jit->unlock(m_register.pair.tagGPR);
+            m_jit->unlock(m_register.pair.payloadGPR);
+        }
+#endif
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+
+    Node* node() const
+    {
+        return edge().node();
+    }
+
+#if USE(JSVALUE64)
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillJSValue(m_edge);
+        return m_gprOrInvalid;
+    }
+    JSValueRegs jsValueRegs()
+    {
+        return JSValueRegs(gpr());
+    }
+#elif USE(JSVALUE32_64)
+    bool isDouble() { return m_isDouble; }
+
+    void fill()
+    {
+        if (m_register.pair.tagGPR == InvalidGPRReg && m_register.pair.payloadGPR == InvalidGPRReg)
+            m_isDouble = !m_jit->fillJSValue(m_edge, m_register.pair.tagGPR, m_register.pair.payloadGPR, m_register.fpr);
+    }
+
+    GPRReg tagGPR()
+    {
+        fill();
+        ASSERT(!m_isDouble);
+        return m_register.pair.tagGPR;
+    } 
+
+    GPRReg payloadGPR()
+    {
+        fill();
+        ASSERT(!m_isDouble);
+        return m_register.pair.payloadGPR;
+    }
+    
+    JSValueRegs jsValueRegs()
+    {
+        return JSValueRegs(tagGPR(), payloadGPR());
+    }
+
+    GPRReg gpr(WhichValueWord which)
+    {
+        return jsValueRegs().gpr(which);
+    }
+
+    FPRReg fpr()
+    {
+        fill();
+        ASSERT(m_isDouble);
+        return m_register.fpr;
+    }
+#endif
+
+    void use()
+    {
+        m_jit->use(node());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+#if USE(JSVALUE64)
+    GPRReg m_gprOrInvalid;
+#elif USE(JSVALUE32_64)
+    union {
+        struct {
+            GPRReg tagGPR;
+            GPRReg payloadGPR;
+        } pair;
+        FPRReg fpr;
+    } m_register;
+    bool m_isDouble;
+#endif
+};
+
+class StorageOperand {
+public:
+    explicit StorageOperand(SpeculativeJIT* jit, Edge edge)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        ASSERT(edge.useKind() == UntypedUse || edge.useKind() == KnownCellUse);
+        if (jit->isFilled(node()))
+            gpr();
+    }
+    
+    ~StorageOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+    
+    Node* node() const
+    {
+        return edge().node();
+    }
+    
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillStorage(edge());
+        return m_gprOrInvalid;
+    }
+    
+    void use()
+    {
+        m_jit->use(node());
+    }
+    
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    GPRReg m_gprOrInvalid;
+};
+
+
+// === Temporaries ===
+//
+// These classes are used to allocate temporary registers.
+// A mechanism is provided to attempt to reuse the registers
+// currently allocated to child nodes whose value is consumed
+// by, and not live after, this operation.
+
+enum ReuseTag { Reuse };
+
+class GPRTemporary {
+public:
+    GPRTemporary();
+    GPRTemporary(SpeculativeJIT*);
+    GPRTemporary(SpeculativeJIT*, GPRReg specific);
+    template<typename T>
+    GPRTemporary(SpeculativeJIT* jit, ReuseTag, T& operand)
+        : m_jit(jit)
+        , m_gpr(InvalidGPRReg)
+    {
+        if (m_jit->canReuse(operand.node()))
+            m_gpr = m_jit->reuse(operand.gpr());
+        else
+            m_gpr = m_jit->allocate();
+    }
+    template<typename T1, typename T2>
+    GPRTemporary(SpeculativeJIT* jit, ReuseTag, T1& op1, T2& op2)
+        : m_jit(jit)
+        , m_gpr(InvalidGPRReg)
+    {
+        if (m_jit->canReuse(op1.node()))
+            m_gpr = m_jit->reuse(op1.gpr());
+        else if (m_jit->canReuse(op2.node()))
+            m_gpr = m_jit->reuse(op2.gpr());
+        else if (m_jit->canReuse(op1.node(), op2.node()) && op1.gpr() == op2.gpr())
+            m_gpr = m_jit->reuse(op1.gpr());
+        else
+            m_gpr = m_jit->allocate();
+    }
+#if USE(JSVALUE32_64)
+    GPRTemporary(SpeculativeJIT*, ReuseTag, JSValueOperand&, WhichValueWord);
+#endif
+
+    GPRTemporary(GPRTemporary& other) = delete;
+
+    GPRTemporary(GPRTemporary&& other)
+    {
+        ASSERT(other.m_jit);
+        ASSERT(other.m_gpr != InvalidGPRReg);
+        m_jit = other.m_jit;
+        m_gpr = other.m_gpr;
+        other.m_jit = nullptr;
+        other.m_gpr = InvalidGPRReg;
+    }
+
+    GPRTemporary& operator=(GPRTemporary&& other)
+    {
+        ASSERT(!m_jit);
+        ASSERT(m_gpr == InvalidGPRReg);
+        std::swap(m_jit, other.m_jit);
+        std::swap(m_gpr, other.m_gpr);
+        return *this;
+    }
+
+    void adopt(GPRTemporary&);
+
+    ~GPRTemporary()
+    {
+        if (m_jit && m_gpr != InvalidGPRReg)
+            m_jit->unlock(gpr());
+    }
+
+    GPRReg gpr()
+    {
+        return m_gpr;
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    GPRReg m_gpr;
+};
+
+class JSValueRegsTemporary {
+public:
+    JSValueRegsTemporary();
+    JSValueRegsTemporary(SpeculativeJIT*);
+    template<typename T>
+    JSValueRegsTemporary(SpeculativeJIT*, ReuseTag, T& operand, WhichValueWord resultRegWord = PayloadWord);
+    JSValueRegsTemporary(SpeculativeJIT*, ReuseTag, JSValueOperand&);
+    ~JSValueRegsTemporary();
+    
+    JSValueRegs regs();
+
+private:
+#if USE(JSVALUE64)
+    GPRTemporary m_gpr;
+#else
+    GPRTemporary m_payloadGPR;
+    GPRTemporary m_tagGPR;
+#endif
+};
+
+class FPRTemporary {
+    WTF_MAKE_NONCOPYABLE(FPRTemporary);
+public:
+    FPRTemporary(FPRTemporary&&);
+    FPRTemporary(SpeculativeJIT*);
+    FPRTemporary(SpeculativeJIT*, SpeculateDoubleOperand&);
+    FPRTemporary(SpeculativeJIT*, SpeculateDoubleOperand&, SpeculateDoubleOperand&);
+#if USE(JSVALUE32_64)
+    FPRTemporary(SpeculativeJIT*, JSValueOperand&);
+#endif
+
+    ~FPRTemporary()
+    {
+        if (LIKELY(m_jit))
+            m_jit->unlock(fpr());
+    }
+
+    FPRReg fpr() const
+    {
+        ASSERT(m_jit);
+        ASSERT(m_fpr != InvalidFPRReg);
+        return m_fpr;
+    }
+
+protected:
+    FPRTemporary(SpeculativeJIT* jit, FPRReg lockedFPR)
+        : m_jit(jit)
+        , m_fpr(lockedFPR)
+    {
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    FPRReg m_fpr;
+};
+
+
+// === Results ===
+//
+// These classes lock the result of a call to a C++ helper function.
+
+class GPRFlushedCallResult : public GPRTemporary {
+public:
+    GPRFlushedCallResult(SpeculativeJIT* jit)
+        : GPRTemporary(jit, GPRInfo::returnValueGPR)
+    {
+    }
+};
+
+#if USE(JSVALUE32_64)
+class GPRFlushedCallResult2 : public GPRTemporary {
+public:
+    GPRFlushedCallResult2(SpeculativeJIT* jit)
+        : GPRTemporary(jit, GPRInfo::returnValueGPR2)
+    {
+    }
+};
+#endif
+
+class FPRResult : public FPRTemporary {
+public:
+    FPRResult(SpeculativeJIT* jit)
+        : FPRTemporary(jit, lockedResult(jit))
+    {
+    }
+
+private:
+    static FPRReg lockedResult(SpeculativeJIT* jit)
+    {
+        jit->lock(FPRInfo::returnValueFPR);
+        return FPRInfo::returnValueFPR;
+    }
+};
+
+
+// === Speculative Operand types ===
+//
+// SpeculateInt32Operand, SpeculateStrictInt32Operand and SpeculateCellOperand.
+//
+// These are used to lock the operands to a node into machine registers within the
+// SpeculativeJIT. The classes operate like those above, however these will
+// perform a speculative check for a more restrictive type than we can statically
+// determine the operand to have. If the operand does not have the requested type,
+// a bail-out to the non-speculative path will be taken.
+
+class SpeculateInt32Operand {
+public:
+    explicit SpeculateInt32Operand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+#ifndef NDEBUG
+        , m_format(DataFormatNone)
+#endif
+    {
+        ASSERT(m_jit);
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || (edge.useKind() == Int32Use || edge.useKind() == KnownInt32Use));
+        if (jit->isFilled(node()))
+            gpr();
+    }
+
+    ~SpeculateInt32Operand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+
+    Node* node() const
+    {
+        return edge().node();
+    }
+
+    DataFormat format()
+    {
+        gpr(); // m_format is set when m_gpr is locked.
+        ASSERT(m_format == DataFormatInt32 || m_format == DataFormatJSInt32);
+        return m_format;
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateInt32(edge(), m_format);
+        return m_gprOrInvalid;
+    }
+    
+    void use()
+    {
+        m_jit->use(node());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    GPRReg m_gprOrInvalid;
+    DataFormat m_format;
+};
+
+class SpeculateStrictInt32Operand {
+public:
+    explicit SpeculateStrictInt32Operand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || (edge.useKind() == Int32Use || edge.useKind() == KnownInt32Use));
+        if (jit->isFilled(node()))
+            gpr();
+    }
+
+    ~SpeculateStrictInt32Operand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+
+    Node* node() const
+    {
+        return edge().node();
+    }
+
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateInt32Strict(edge());
+        return m_gprOrInvalid;
+    }
+    
+    void use()
+    {
+        m_jit->use(node());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    GPRReg m_gprOrInvalid;
+};
+
+// Gives you a canonical Int52 (i.e. it's left-shifted by 16, low bits zero).
+class SpeculateInt52Operand {
+public:
+    explicit SpeculateInt52Operand(SpeculativeJIT* jit, Edge edge)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        RELEASE_ASSERT(edge.useKind() == Int52RepUse);
+        if (jit->isFilled(node()))
+            gpr();
+    }
+    
+    ~SpeculateInt52Operand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+    
+    Node* node() const
+    {
+        return edge().node();
+    }
+    
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateInt52(edge(), DataFormatInt52);
+        return m_gprOrInvalid;
+    }
+    
+    void use()
+    {
+        m_jit->use(node());
+    }
+    
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    GPRReg m_gprOrInvalid;
+};
+
+// Gives you a strict Int52 (i.e. the payload is in the low 48 bits, high 16 bits are sign-extended).
+class SpeculateStrictInt52Operand {
+public:
+    explicit SpeculateStrictInt52Operand(SpeculativeJIT* jit, Edge edge)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        RELEASE_ASSERT(edge.useKind() == Int52RepUse);
+        if (jit->isFilled(node()))
+            gpr();
+    }
+    
+    ~SpeculateStrictInt52Operand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+    
+    Node* node() const
+    {
+        return edge().node();
+    }
+    
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateInt52(edge(), DataFormatStrictInt52);
+        return m_gprOrInvalid;
+    }
+    
+    void use()
+    {
+        m_jit->use(node());
+    }
+    
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    GPRReg m_gprOrInvalid;
+};
+
+enum OppositeShiftTag { OppositeShift };
+
+class SpeculateWhicheverInt52Operand {
+public:
+    explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+        , m_strict(jit->betterUseStrictInt52(edge))
+    {
+        RELEASE_ASSERT(edge.useKind() == Int52RepUse);
+        if (jit->isFilled(node()))
+            gpr();
+    }
+    
+    explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge, const SpeculateWhicheverInt52Operand& other)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+        , m_strict(other.m_strict)
+    {
+        RELEASE_ASSERT(edge.useKind() == Int52RepUse);
+        if (jit->isFilled(node()))
+            gpr();
+    }
+    
+    explicit SpeculateWhicheverInt52Operand(SpeculativeJIT* jit, Edge edge, OppositeShiftTag, const SpeculateWhicheverInt52Operand& other)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+        , m_strict(!other.m_strict)
+    {
+        RELEASE_ASSERT(edge.useKind() == Int52RepUse);
+        if (jit->isFilled(node()))
+            gpr();
+    }
+    
+    ~SpeculateWhicheverInt52Operand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+    
+    Node* node() const
+    {
+        return edge().node();
+    }
+    
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg) {
+            m_gprOrInvalid = m_jit->fillSpeculateInt52(
+                edge(), m_strict ? DataFormatStrictInt52 : DataFormatInt52);
+        }
+        return m_gprOrInvalid;
+    }
+    
+    void use()
+    {
+        m_jit->use(node());
+    }
+    
+    DataFormat format() const
+    {
+        return m_strict ? DataFormatStrictInt52 : DataFormatInt52;
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    GPRReg m_gprOrInvalid;
+    bool m_strict;
+};
+
+class SpeculateDoubleOperand {
+public:
+    explicit SpeculateDoubleOperand(SpeculativeJIT* jit, Edge edge)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_fprOrInvalid(InvalidFPRReg)
+    {
+        ASSERT(m_jit);
+        RELEASE_ASSERT(isDouble(edge.useKind()));
+        if (jit->isFilled(node()))
+            fpr();
+    }
+
+    ~SpeculateDoubleOperand()
+    {
+        ASSERT(m_fprOrInvalid != InvalidFPRReg);
+        m_jit->unlock(m_fprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+
+    Node* node() const
+    {
+        return edge().node();
+    }
+
+    FPRReg fpr()
+    {
+        if (m_fprOrInvalid == InvalidFPRReg)
+            m_fprOrInvalid = m_jit->fillSpeculateDouble(edge());
+        return m_fprOrInvalid;
+    }
+    
+    void use()
+    {
+        m_jit->use(node());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    FPRReg m_fprOrInvalid;
+};
+
+class SpeculateCellOperand {
+    WTF_MAKE_NONCOPYABLE(SpeculateCellOperand);
+
+public:
+    explicit SpeculateCellOperand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        if (!edge)
+            return;
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || isCell(edge.useKind()));
+        if (jit->isFilled(node()))
+            gpr();
+    }
+
+    explicit SpeculateCellOperand(SpeculateCellOperand&& other)
+    {
+        m_jit = other.m_jit;
+        m_edge = other.m_edge;
+        m_gprOrInvalid = other.m_gprOrInvalid;
+
+        other.m_gprOrInvalid = InvalidGPRReg;
+        other.m_edge = Edge();
+    }
+
+    ~SpeculateCellOperand()
+    {
+        if (!m_edge)
+            return;
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+
+    Node* node() const
+    {
+        return edge().node();
+    }
+
+    GPRReg gpr()
+    {
+        ASSERT(m_edge);
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateCell(edge());
+        return m_gprOrInvalid;
+    }
+    
+    void use()
+    {
+        ASSERT(m_edge);
+        m_jit->use(node());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    GPRReg m_gprOrInvalid;
+};
+
+class SpeculateBooleanOperand {
+public:
+    explicit SpeculateBooleanOperand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+        : m_jit(jit)
+        , m_edge(edge)
+        , m_gprOrInvalid(InvalidGPRReg)
+    {
+        ASSERT(m_jit);
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse || edge.useKind() == KnownBooleanUse);
+        if (jit->isFilled(node()))
+            gpr();
+    }
+    
+    ~SpeculateBooleanOperand()
+    {
+        ASSERT(m_gprOrInvalid != InvalidGPRReg);
+        m_jit->unlock(m_gprOrInvalid);
+    }
+    
+    Edge edge() const
+    {
+        return m_edge;
+    }
+    
+    Node* node() const
+    {
+        return edge().node();
+    }
+    
+    GPRReg gpr()
+    {
+        if (m_gprOrInvalid == InvalidGPRReg)
+            m_gprOrInvalid = m_jit->fillSpeculateBoolean(edge());
+        return m_gprOrInvalid;
+    }
+    
+    void use()
+    {
+        m_jit->use(node());
+    }
+
+private:
+    SpeculativeJIT* m_jit;
+    Edge m_edge;
+    GPRReg m_gprOrInvalid;
+};
+
+template<typename StructureLocationType>
+void SpeculativeJIT::speculateStringObjectForStructure(Edge edge, StructureLocationType structureLocation)
+{
+    RegisteredStructure stringObjectStructure =
+        m_jit.graph().registerStructure(m_jit.globalObjectFor(m_currentNode->origin.semantic)->stringObjectStructure());
+    
+    if (!m_state.forNode(edge).m_structure.isSubsetOf(RegisteredStructureSet(stringObjectStructure))) {
+        speculationCheck(
+            NotStringObject, JSValueRegs(), 0,
+            m_jit.branchWeakStructure(
+                JITCompiler::NotEqual, structureLocation, stringObjectStructure));
+    }
+}
+
+#define DFG_TYPE_CHECK_WITH_EXIT_KIND(exitKind, source, edge, typesPassedThrough, jumpToFail) do { \
+        JSValueSource _dtc_source = (source);                           \
+        Edge _dtc_edge = (edge);                                        \
+        SpeculatedType _dtc_typesPassedThrough = typesPassedThrough;    \
+        if (!needsTypeCheck(_dtc_edge, _dtc_typesPassedThrough))        \
+            break;                                                      \
+        typeCheck(_dtc_source, _dtc_edge, _dtc_typesPassedThrough, (jumpToFail), exitKind); \
+    } while (0)
+
+#define DFG_TYPE_CHECK(source, edge, typesPassedThrough, jumpToFail) \
+    DFG_TYPE_CHECK_WITH_EXIT_KIND(BadType, source, edge, typesPassedThrough, jumpToFail)
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGSpeculativeJIT32_64.cpp b/dfg/DFGSpeculativeJIT32_64.cpp
new file mode 100644
index 0000000..e3fc88e
--- /dev/null
+++ b/dfg/DFGSpeculativeJIT32_64.cpp
@@ -0,0 +1,5729 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSpeculativeJIT.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayPrototype.h"
+#include "CallFrameShuffler.h"
+#include "DFGAbstractInterpreterInlines.h"
+#include "DFGCallArrayAllocatorSlowPathGenerator.h"
+#include "DFGOperations.h"
+#include "DFGSlowPathGenerator.h"
+#include "DirectArguments.h"
+#include "GetterSetter.h"
+#include "HasOwnPropertyCache.h"
+#include "HashMapImpl.h"
+#include "JSEnvironmentRecord.h"
+#include "JSPropertyNameEnumerator.h"
+#include "ObjectPrototype.h"
+#include "JSCInlines.h"
+#include "SetupVarargsFrame.h"
+#include "TypeProfilerLog.h"
+#include "Watchdog.h"
+
+namespace JSC { namespace DFG {
+
+#if USE(JSVALUE32_64)
+
+bool SpeculativeJIT::fillJSValue(Edge edge, GPRReg& tagGPR, GPRReg& payloadGPR, FPRReg& fpr)
+{
+    // FIXME: For double we could fill with a FPR.
+    UNUSED_PARAM(fpr);
+
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+
+        if (edge->hasConstant()) {
+            tagGPR = allocate();
+            payloadGPR = allocate();
+            JSValue value = edge->asJSValue();
+            m_jit.move(Imm32(value.tag()), tagGPR);
+            m_jit.move(Imm32(value.payload()), payloadGPR);
+            m_gprs.retain(tagGPR, virtualRegister, SpillOrderConstant);
+            m_gprs.retain(payloadGPR, virtualRegister, SpillOrderConstant);
+            info.fillJSValue(*m_stream, tagGPR, payloadGPR, DataFormatJS);
+        } else {
+            DataFormat spillFormat = info.spillFormat();
+            ASSERT(spillFormat != DataFormatNone && spillFormat != DataFormatStorage);
+            tagGPR = allocate();
+            payloadGPR = allocate();
+            switch (spillFormat) {
+            case DataFormatInt32:
+                m_jit.move(TrustedImm32(JSValue::Int32Tag), tagGPR);
+                spillFormat = DataFormatJSInt32; // This will be used as the new register format.
+                break;
+            case DataFormatCell:
+                m_jit.move(TrustedImm32(JSValue::CellTag), tagGPR);
+                spillFormat = DataFormatJSCell; // This will be used as the new register format.
+                break;
+            case DataFormatBoolean:
+                m_jit.move(TrustedImm32(JSValue::BooleanTag), tagGPR);
+                spillFormat = DataFormatJSBoolean; // This will be used as the new register format.
+                break;
+            default:
+                m_jit.load32(JITCompiler::tagFor(virtualRegister), tagGPR);
+                break;
+            }
+            m_jit.load32(JITCompiler::payloadFor(virtualRegister), payloadGPR);
+            m_gprs.retain(tagGPR, virtualRegister, SpillOrderSpilled);
+            m_gprs.retain(payloadGPR, virtualRegister, SpillOrderSpilled);
+            info.fillJSValue(*m_stream, tagGPR, payloadGPR, spillFormat == DataFormatJSDouble ? DataFormatJS : spillFormat);
+        }
+
+        return true;
+    }
+
+    case DataFormatInt32:
+    case DataFormatCell:
+    case DataFormatBoolean: {
+        GPRReg gpr = info.gpr();
+        // If the register has already been locked we need to take a copy.
+        if (m_gprs.isLocked(gpr)) {
+            payloadGPR = allocate();
+            m_jit.move(gpr, payloadGPR);
+        } else {
+            payloadGPR = gpr;
+            m_gprs.lock(gpr);
+        }
+        tagGPR = allocate();
+        int32_t tag = JSValue::EmptyValueTag;
+        DataFormat fillFormat = DataFormatJS;
+        switch (info.registerFormat()) {
+        case DataFormatInt32:
+            tag = JSValue::Int32Tag;
+            fillFormat = DataFormatJSInt32;
+            break;
+        case DataFormatCell:
+            tag = JSValue::CellTag;
+            fillFormat = DataFormatJSCell;
+            break;
+        case DataFormatBoolean:
+            tag = JSValue::BooleanTag;
+            fillFormat = DataFormatJSBoolean;
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        m_jit.move(TrustedImm32(tag), tagGPR);
+        m_gprs.release(gpr);
+        m_gprs.retain(tagGPR, virtualRegister, SpillOrderJS);
+        m_gprs.retain(payloadGPR, virtualRegister, SpillOrderJS);
+        info.fillJSValue(*m_stream, tagGPR, payloadGPR, fillFormat);
+        return true;
+    }
+
+    case DataFormatJSDouble:
+    case DataFormatJS:
+    case DataFormatJSInt32:
+    case DataFormatJSCell:
+    case DataFormatJSBoolean: {
+        tagGPR = info.tagGPR();
+        payloadGPR = info.payloadGPR();
+        m_gprs.lock(tagGPR);
+        m_gprs.lock(payloadGPR);
+        return true;
+    }
+        
+    case DataFormatStorage:
+    case DataFormatDouble:
+        // this type currently never occurs
+        RELEASE_ASSERT_NOT_REACHED();
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return true;
+    }
+}
+
+void SpeculativeJIT::cachedGetById(CodeOrigin origin, JSValueRegs base, JSValueRegs result, unsigned identifierNumber, JITCompiler::Jump slowPathTarget , SpillRegistersMode mode, AccessType type)
+{
+    cachedGetById(origin, base.tagGPR(), base.payloadGPR(), result.tagGPR(), result.payloadGPR(), identifierNumber, slowPathTarget, mode, type);
+}
+
+void SpeculativeJIT::cachedGetById(
+    CodeOrigin codeOrigin, GPRReg baseTagGPROrNone, GPRReg basePayloadGPR, GPRReg resultTagGPR, GPRReg resultPayloadGPR,
+    unsigned identifierNumber, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode, AccessType type)
+{
+    // This is a hacky fix for when the register allocator decides to alias the base payload with the result tag. This only happens
+    // in the case of GetByIdFlush, which has a relatively expensive register allocation story already so we probably don't need to
+    // trip over one move instruction.
+    if (basePayloadGPR == resultTagGPR) {
+        RELEASE_ASSERT(basePayloadGPR != resultPayloadGPR);
+        
+        if (baseTagGPROrNone == resultPayloadGPR) {
+            m_jit.swap(basePayloadGPR, baseTagGPROrNone);
+            baseTagGPROrNone = resultTagGPR;
+        } else
+            m_jit.move(basePayloadGPR, resultPayloadGPR);
+        basePayloadGPR = resultPayloadGPR;
+    }
+    
+    RegisterSet usedRegisters = this->usedRegisters();
+    if (spillMode == DontSpill) {
+        // We've already flushed registers to the stack, we don't need to spill these.
+        usedRegisters.set(JSValueRegs(baseTagGPROrNone, basePayloadGPR), false);
+        usedRegisters.set(JSValueRegs(resultTagGPR, resultPayloadGPR), false);
+    }
+    
+    CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size());
+    JITGetByIdGenerator gen(
+        m_jit.codeBlock(), codeOrigin, callSite, usedRegisters, identifierUID(identifierNumber),
+        JSValueRegs(baseTagGPROrNone, basePayloadGPR), JSValueRegs(resultTagGPR, resultPayloadGPR), type);
+    
+    gen.generateFastPath(m_jit);
+    
+    JITCompiler::JumpList slowCases;
+    if (slowPathTarget.isSet())
+        slowCases.append(slowPathTarget);
+    slowCases.append(gen.slowPathJump());
+
+    J_JITOperation_ESsiJI getByIdFunction;
+    if (type == AccessType::Get)
+        getByIdFunction = operationGetByIdOptimize;
+    else
+        getByIdFunction = operationTryGetByIdOptimize;
+
+    std::unique_ptr<SlowPathGenerator> slowPath;
+    if (baseTagGPROrNone == InvalidGPRReg) {
+        slowPath = slowPathCall(
+            slowCases, this, getByIdFunction,
+            JSValueRegs(resultTagGPR, resultPayloadGPR), gen.stubInfo(),
+            static_cast<int32_t>(JSValue::CellTag), basePayloadGPR,
+            identifierUID(identifierNumber));
+    } else {
+        slowPath = slowPathCall(
+            slowCases, this, getByIdFunction,
+            JSValueRegs(resultTagGPR, resultPayloadGPR), gen.stubInfo(), JSValueRegs(baseTagGPROrNone, basePayloadGPR), identifierUID(identifierNumber));
+    }
+
+    m_jit.addGetById(gen, slowPath.get());
+    addSlowPathGenerator(WTFMove(slowPath));
+}
+
+void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg basePayloadGPR, GPRReg valueTagGPR, GPRReg valuePayloadGPR, GPRReg scratchGPR, unsigned identifierNumber, PutKind putKind, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)
+{
+    RegisterSet usedRegisters = this->usedRegisters();
+    if (spillMode == DontSpill) {
+        // We've already flushed registers to the stack, we don't need to spill these.
+        usedRegisters.set(basePayloadGPR, false);
+        usedRegisters.set(JSValueRegs(valueTagGPR, valuePayloadGPR), false);
+    }
+    CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size());
+    JITPutByIdGenerator gen(
+        m_jit.codeBlock(), codeOrigin, callSite, usedRegisters,
+        JSValueRegs::payloadOnly(basePayloadGPR), JSValueRegs(valueTagGPR, valuePayloadGPR),
+        scratchGPR, m_jit.ecmaModeFor(codeOrigin), putKind);
+    
+    gen.generateFastPath(m_jit);
+    
+    JITCompiler::JumpList slowCases;
+    if (slowPathTarget.isSet())
+        slowCases.append(slowPathTarget);
+    slowCases.append(gen.slowPathJump());
+
+    auto slowPath = slowPathCall(
+        slowCases, this, gen.slowPathFunction(), NoResult, gen.stubInfo(), JSValueRegs(valueTagGPR, valuePayloadGPR),
+        basePayloadGPR, identifierUID(identifierNumber));
+
+    m_jit.addPutById(gen, slowPath.get());
+    addSlowPathGenerator(WTFMove(slowPath));
+}
+
+void SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined(Edge operand)
+{
+    JSValueOperand arg(this, operand, ManualOperandSpeculation);
+    GPRReg argTagGPR = arg.tagGPR();
+    GPRReg argPayloadGPR = arg.payloadGPR();
+
+    GPRTemporary resultPayload(this, Reuse, arg, PayloadWord);
+    GPRReg resultPayloadGPR = resultPayload.gpr();
+
+    JITCompiler::Jump notCell;
+    JITCompiler::Jump notMasqueradesAsUndefined;   
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        if (!isKnownCell(operand.node()))
+            notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
+        
+        m_jit.move(TrustedImm32(0), resultPayloadGPR);
+        notMasqueradesAsUndefined = m_jit.jump();
+    } else {
+        GPRTemporary localGlobalObject(this);
+        GPRTemporary remoteGlobalObject(this);
+
+        if (!isKnownCell(operand.node()))
+            notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
+        
+        JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(
+            JITCompiler::NonZero, 
+            JITCompiler::Address(argPayloadGPR, JSCell::typeInfoFlagsOffset()), 
+            JITCompiler::TrustedImm32(MasqueradesAsUndefined));
+        
+        m_jit.move(TrustedImm32(0), resultPayloadGPR);
+        notMasqueradesAsUndefined = m_jit.jump();
+
+        isMasqueradesAsUndefined.link(&m_jit);
+        GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
+        GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
+        m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
+        m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureIDOffset()), resultPayloadGPR);
+        m_jit.loadPtr(JITCompiler::Address(resultPayloadGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
+        m_jit.compare32(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, resultPayloadGPR);
+    }
+ 
+    if (!isKnownCell(operand.node())) {
+        JITCompiler::Jump done = m_jit.jump();
+        
+        notCell.link(&m_jit);
+        // null or undefined?
+        COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
+        m_jit.or32(TrustedImm32(1), argTagGPR, resultPayloadGPR);
+        m_jit.compare32(JITCompiler::Equal, resultPayloadGPR, TrustedImm32(JSValue::NullTag), resultPayloadGPR);
+
+        done.link(&m_jit);
+    }
+    
+    notMasqueradesAsUndefined.link(&m_jit);
+ 
+    booleanResult(resultPayloadGPR, m_currentNode);
+}
+
+void SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined(Edge operand, Node* branchNode)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    bool invert = false;
+    if (taken == nextBlock()) {
+        invert = !invert;
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+
+    JSValueOperand arg(this, operand, ManualOperandSpeculation);
+    GPRReg argTagGPR = arg.tagGPR();
+    GPRReg argPayloadGPR = arg.payloadGPR();
+    
+    GPRTemporary result(this, Reuse, arg, TagWord);
+    GPRReg resultGPR = result.gpr();
+
+    JITCompiler::Jump notCell;
+
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        if (!isKnownCell(operand.node()))
+            notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
+        
+        jump(invert ? taken : notTaken, ForceJump);
+    } else {
+        GPRTemporary localGlobalObject(this);
+        GPRTemporary remoteGlobalObject(this);
+
+        if (!isKnownCell(operand.node()))
+            notCell = m_jit.branchIfNotCell(arg.jsValueRegs());
+        
+        branchTest8(JITCompiler::Zero, 
+            JITCompiler::Address(argPayloadGPR, JSCell::typeInfoFlagsOffset()), 
+            JITCompiler::TrustedImm32(MasqueradesAsUndefined), 
+            invert ? taken : notTaken);
+   
+        GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
+        GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
+        m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
+        m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureIDOffset()), resultGPR);
+        m_jit.loadPtr(JITCompiler::Address(resultGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
+        branchPtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, invert ? notTaken : taken);
+    }
+ 
+    if (!isKnownCell(operand.node())) {
+        jump(notTaken, ForceJump);
+        
+        notCell.link(&m_jit);
+        // null or undefined?
+        COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
+        m_jit.or32(TrustedImm32(1), argTagGPR, resultGPR);
+        branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImm32(JSValue::NullTag), taken);
+    }
+    
+    jump(notTaken);
+}
+
+void SpeculativeJIT::nonSpeculativePeepholeBranch(Node* node, Node* branchNode, MacroAssembler::RelationalCondition cond, S_JITOperation_EJJ helperFunction)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    JITCompiler::ResultCondition callResultCondition = JITCompiler::NonZero;
+
+    // The branch instruction will branch to the taken block.
+    // If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
+    if (taken == nextBlock()) {
+        cond = JITCompiler::invert(cond);
+        callResultCondition = JITCompiler::Zero;
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+
+    JSValueOperand arg1(this, node->child1());
+    JSValueOperand arg2(this, node->child2());
+    JSValueRegs arg1Regs = arg1.jsValueRegs();
+    JSValueRegs arg2Regs = arg2.jsValueRegs();
+    GPRReg arg1TagGPR = arg1.tagGPR();
+    GPRReg arg1PayloadGPR = arg1.payloadGPR();
+    GPRReg arg2TagGPR = arg2.tagGPR();
+    GPRReg arg2PayloadGPR = arg2.payloadGPR();
+    
+    JITCompiler::JumpList slowPath;
+    
+    if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        arg1.use();
+        arg2.use();
+
+        flushRegisters();
+        callOperation(helperFunction, resultGPR, arg1Regs, arg2Regs);
+        m_jit.exceptionCheck();
+
+        branchTest32(callResultCondition, resultGPR, taken);
+    } else {
+        GPRTemporary result(this);
+        GPRReg resultGPR = result.gpr();
+    
+        arg1.use();
+        arg2.use();
+
+        if (!isKnownInteger(node->child1().node()))
+            slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg1TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));
+        if (!isKnownInteger(node->child2().node()))
+            slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg2TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));
+    
+        branch32(cond, arg1PayloadGPR, arg2PayloadGPR, taken);
+    
+        if (!isKnownInteger(node->child1().node()) || !isKnownInteger(node->child2().node())) {
+            jump(notTaken, ForceJump);
+    
+            slowPath.link(&m_jit);
+    
+            silentSpillAllRegisters(resultGPR);
+            callOperation(helperFunction, resultGPR, arg1Regs, arg2Regs);
+            m_jit.exceptionCheck();
+            silentFillAllRegisters(resultGPR);
+        
+            branchTest32(callResultCondition, resultGPR, taken);
+        }
+    }
+
+    jump(notTaken);
+    
+    m_indexInBlock = m_block->size() - 1;
+    m_currentNode = branchNode;
+}
+
+template<typename JumpType>
+class CompareAndBoxBooleanSlowPathGenerator
+    : public CallSlowPathGenerator<JumpType, S_JITOperation_EJJ, GPRReg> {
+public:
+    CompareAndBoxBooleanSlowPathGenerator(
+        JumpType from, SpeculativeJIT* jit,
+        S_JITOperation_EJJ function, GPRReg result, GPRReg arg1Tag, GPRReg arg1Payload,
+        GPRReg arg2Tag, GPRReg arg2Payload)
+        : CallSlowPathGenerator<JumpType, S_JITOperation_EJJ, GPRReg>(
+            from, jit, function, NeedToSpill, ExceptionCheckRequirement::CheckNeeded, result)
+        , m_arg1Tag(arg1Tag)
+        , m_arg1Payload(arg1Payload)
+        , m_arg2Tag(arg2Tag)
+        , m_arg2Payload(arg2Payload)
+    {
+    }
+    
+protected:
+    virtual void generateInternal(SpeculativeJIT* jit)
+    {
+        this->setUp(jit);
+        this->recordCall(
+            jit->callOperation(
+                this->m_function, this->m_result, JSValueRegs(m_arg1Tag, m_arg1Payload), JSValueRegs(m_arg2Tag, m_arg2Payload)));
+        jit->m_jit.and32(JITCompiler::TrustedImm32(1), this->m_result);
+        this->tearDown(jit);
+    }
+   
+private:
+    GPRReg m_arg1Tag;
+    GPRReg m_arg1Payload;
+    GPRReg m_arg2Tag;
+    GPRReg m_arg2Payload;
+};
+
+void SpeculativeJIT::nonSpeculativeNonPeepholeCompare(Node* node, MacroAssembler::RelationalCondition cond, S_JITOperation_EJJ helperFunction)
+{
+    JSValueOperand arg1(this, node->child1());
+    JSValueOperand arg2(this, node->child2());
+    GPRReg arg1TagGPR = arg1.tagGPR();
+    GPRReg arg1PayloadGPR = arg1.payloadGPR();
+    GPRReg arg2TagGPR = arg2.tagGPR();
+    GPRReg arg2PayloadGPR = arg2.payloadGPR();
+    
+    JITCompiler::JumpList slowPath;
+    
+    if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
+        GPRFlushedCallResult result(this);
+        GPRReg resultPayloadGPR = result.gpr();
+    
+        arg1.use();
+        arg2.use();
+
+        flushRegisters();
+        callOperation(helperFunction, resultPayloadGPR, arg1.jsValueRegs(), arg2.jsValueRegs());
+        m_jit.exceptionCheck();
+        
+        booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);
+    } else {
+        GPRTemporary resultPayload(this, Reuse, arg1, PayloadWord);
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+
+        arg1.use();
+        arg2.use();
+    
+        if (!isKnownInteger(node->child1().node()))
+            slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg1TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));
+        if (!isKnownInteger(node->child2().node()))
+            slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg2TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));
+
+        m_jit.compare32(cond, arg1PayloadGPR, arg2PayloadGPR, resultPayloadGPR);
+    
+        if (!isKnownInteger(node->child1().node()) || !isKnownInteger(node->child2().node())) {
+            addSlowPathGenerator(std::make_unique<CompareAndBoxBooleanSlowPathGenerator<JITCompiler::JumpList>>(
+                    slowPath, this, helperFunction, resultPayloadGPR, arg1TagGPR,
+                    arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR));
+        }
+        
+        booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);
+    }
+}
+
+void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node* node, Node* branchNode, bool invert)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    // The branch instruction will branch to the taken block.
+    // If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
+    if (taken == nextBlock()) {
+        invert = !invert;
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+    
+    JSValueOperand arg1(this, node->child1());
+    JSValueOperand arg2(this, node->child2());
+    GPRReg arg1PayloadGPR = arg1.payloadGPR();
+    GPRReg arg2PayloadGPR = arg2.payloadGPR();
+    JSValueRegs arg1Regs = arg1.jsValueRegs();
+    JSValueRegs arg2Regs = arg2.jsValueRegs();
+    
+    GPRTemporary resultPayload(this, Reuse, arg1, PayloadWord);
+    GPRReg resultPayloadGPR = resultPayload.gpr();
+    
+    arg1.use();
+    arg2.use();
+    
+    if (isKnownCell(node->child1().node()) && isKnownCell(node->child2().node())) {
+        // see if we get lucky: if the arguments are cells and they reference the same
+        // cell, then they must be strictly equal.
+        branchPtr(JITCompiler::Equal, arg1PayloadGPR, arg2PayloadGPR, invert ? notTaken : taken);
+        
+        silentSpillAllRegisters(resultPayloadGPR);
+        callOperation(operationCompareStrictEqCell, resultPayloadGPR, arg1Regs, arg2Regs);
+        m_jit.exceptionCheck();
+        silentFillAllRegisters(resultPayloadGPR);
+        
+        branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultPayloadGPR, taken);
+    } else {
+        // FIXME: Add fast paths for twoCells, number etc.
+
+        silentSpillAllRegisters(resultPayloadGPR);
+        callOperation(operationCompareStrictEq, resultPayloadGPR, arg1Regs, arg2Regs);
+        m_jit.exceptionCheck();
+        silentFillAllRegisters(resultPayloadGPR);
+        
+        branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultPayloadGPR, taken);
+    }
+    
+    jump(notTaken);
+}
+
+void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node* node, bool invert)
+{
+    JSValueOperand arg1(this, node->child1());
+    JSValueOperand arg2(this, node->child2());
+    GPRReg arg1PayloadGPR = arg1.payloadGPR();
+    GPRReg arg2PayloadGPR = arg2.payloadGPR();
+    JSValueRegs arg1Regs = arg1.jsValueRegs();
+    JSValueRegs arg2Regs = arg2.jsValueRegs();
+    
+    GPRTemporary resultPayload(this, Reuse, arg1, PayloadWord);
+    GPRReg resultPayloadGPR = resultPayload.gpr();
+    
+    arg1.use();
+    arg2.use();
+    
+    if (isKnownCell(node->child1().node()) && isKnownCell(node->child2().node())) {
+        // see if we get lucky: if the arguments are cells and they reference the same
+        // cell, then they must be strictly equal.
+        // FIXME: this should flush registers instead of silent spill/fill.
+        JITCompiler::Jump notEqualCase = m_jit.branchPtr(JITCompiler::NotEqual, arg1PayloadGPR, arg2PayloadGPR);
+        
+        m_jit.move(JITCompiler::TrustedImm32(!invert), resultPayloadGPR);
+        JITCompiler::Jump done = m_jit.jump();
+
+        notEqualCase.link(&m_jit);
+        
+        silentSpillAllRegisters(resultPayloadGPR);
+        callOperation(operationCompareStrictEqCell, resultPayloadGPR, arg1Regs, arg2Regs);
+        m_jit.exceptionCheck();
+        silentFillAllRegisters(resultPayloadGPR);
+        
+        m_jit.andPtr(JITCompiler::TrustedImm32(1), resultPayloadGPR);
+        
+        done.link(&m_jit);
+    } else {
+        // FIXME: Add fast paths.
+
+        silentSpillAllRegisters(resultPayloadGPR);
+        callOperation(operationCompareStrictEq, resultPayloadGPR, arg1Regs, arg2Regs);
+        silentFillAllRegisters(resultPayloadGPR);
+        m_jit.exceptionCheck();
+        
+        m_jit.andPtr(JITCompiler::TrustedImm32(1), resultPayloadGPR);
+    }
+
+    booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);
+}
+
+void SpeculativeJIT::compileMiscStrictEq(Node* node)
+{
+    JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+    JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
+    GPRTemporary result(this);
+    
+    if (node->child1().useKind() == MiscUse)
+        speculateMisc(node->child1(), op1.jsValueRegs());
+    if (node->child2().useKind() == MiscUse)
+        speculateMisc(node->child2(), op2.jsValueRegs());
+    
+    m_jit.move(TrustedImm32(0), result.gpr());
+    JITCompiler::Jump notEqual = m_jit.branch32(JITCompiler::NotEqual, op1.tagGPR(), op2.tagGPR());
+    m_jit.compare32(JITCompiler::Equal, op1.payloadGPR(), op2.payloadGPR(), result.gpr());
+    notEqual.link(&m_jit);
+    booleanResult(result.gpr(), node);
+}
+
+void SpeculativeJIT::emitCall(Node* node)
+{
+    CallLinkInfo::CallType callType;
+    bool isVarargs = false;
+    bool isForwardVarargs = false;
+    bool isTail = false;
+    bool isDirect = false;
+    bool isEmulatedTail = false;
+    switch (node->op()) {
+    case Call:
+    case CallEval:
+        callType = CallLinkInfo::Call;
+        break;
+    case TailCall:
+        callType = CallLinkInfo::TailCall;
+        isTail = true;
+        break;
+    case TailCallInlinedCaller:
+        callType = CallLinkInfo::Call;
+        isEmulatedTail = true;
+        break;
+    case Construct:
+        callType = CallLinkInfo::Construct;
+        break;
+    case CallVarargs:
+        callType = CallLinkInfo::CallVarargs;
+        isVarargs = true;
+        break;
+    case TailCallVarargs:
+        callType = CallLinkInfo::TailCallVarargs;
+        isVarargs = true;
+        isTail = true;
+        break;
+    case TailCallVarargsInlinedCaller:
+        callType = CallLinkInfo::CallVarargs;
+        isVarargs = true;
+        isEmulatedTail = true;
+        break;
+    case ConstructVarargs:
+        callType = CallLinkInfo::ConstructVarargs;
+        isVarargs = true;
+        break;
+    case CallForwardVarargs:
+        callType = CallLinkInfo::CallVarargs;
+        isForwardVarargs = true;
+        break;
+    case TailCallForwardVarargs:
+        callType = CallLinkInfo::TailCallVarargs;
+        isTail = true;
+        isForwardVarargs = true;
+        break;
+    case TailCallForwardVarargsInlinedCaller:
+        callType = CallLinkInfo::CallVarargs;
+        isEmulatedTail = true;
+        isForwardVarargs = true;
+        break;
+    case ConstructForwardVarargs:
+        callType = CallLinkInfo::ConstructVarargs;
+        isForwardVarargs = true;
+        break;
+    case DirectCall:
+        callType = CallLinkInfo::DirectCall;
+        isDirect = true;
+        break;
+    case DirectConstruct:
+        callType = CallLinkInfo::DirectConstruct;
+        isDirect = true;
+        break;
+    case DirectTailCall:
+        callType = CallLinkInfo::DirectTailCall;
+        isTail = true;
+        isDirect = true;
+        break;
+    case DirectTailCallInlinedCaller:
+        callType = CallLinkInfo::DirectCall;
+        isEmulatedTail = true;
+        isDirect = true;
+        break;
+    default:
+        DFG_CRASH(m_jit.graph(), node, "bad node type");
+        break;
+    }
+
+    Edge calleeEdge = m_jit.graph().child(node, 0);
+    GPRReg calleeTagGPR = InvalidGPRReg;
+    GPRReg calleePayloadGPR = InvalidGPRReg;
+    CallFrameShuffleData shuffleData;
+    
+    ExecutableBase* executable = nullptr;
+    FunctionExecutable* functionExecutable = nullptr;
+    if (isDirect) {
+        executable = node->castOperand<ExecutableBase*>();
+        functionExecutable = jsDynamicCast<FunctionExecutable*>(executable);
+    }
+    
+    unsigned numPassedArgs = 0;
+    unsigned numAllocatedArgs = 0;
+    
+    // Gotta load the arguments somehow. Varargs is trickier.
+    if (isVarargs || isForwardVarargs) {
+        RELEASE_ASSERT(!isDirect);
+        CallVarargsData* data = node->callVarargsData();
+
+        GPRReg resultGPR;
+        unsigned numUsedStackSlots = m_jit.graph().m_nextMachineLocal;
+        
+        if (isForwardVarargs) {
+            flushRegisters();
+            if (node->child3())
+                use(node->child3());
+            
+            GPRReg scratchGPR1;
+            GPRReg scratchGPR2;
+            GPRReg scratchGPR3;
+            
+            scratchGPR1 = JITCompiler::selectScratchGPR();
+            scratchGPR2 = JITCompiler::selectScratchGPR(scratchGPR1);
+            scratchGPR3 = JITCompiler::selectScratchGPR(scratchGPR1, scratchGPR2);
+            
+            m_jit.move(TrustedImm32(numUsedStackSlots), scratchGPR2);
+            JITCompiler::JumpList slowCase;
+            InlineCallFrame* inlineCallFrame;
+            if (node->child3())
+                inlineCallFrame = node->child3()->origin.semantic.inlineCallFrame;
+            else
+                inlineCallFrame = node->origin.semantic.inlineCallFrame;
+            emitSetupVarargsFrameFastCase(m_jit, scratchGPR2, scratchGPR1, scratchGPR2, scratchGPR3, inlineCallFrame, data->firstVarArgOffset, slowCase);
+            JITCompiler::Jump done = m_jit.jump();
+            slowCase.link(&m_jit);
+            callOperation(operationThrowStackOverflowForVarargs);
+            m_jit.exceptionCheck();
+            m_jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
+            done.link(&m_jit);
+            resultGPR = scratchGPR2;
+        } else {
+            GPRReg argumentsPayloadGPR;
+            GPRReg argumentsTagGPR;
+            GPRReg scratchGPR1;
+            GPRReg scratchGPR2;
+            GPRReg scratchGPR3;
+        
+            auto loadArgumentsGPR = [&] (GPRReg reservedGPR) {
+                if (reservedGPR != InvalidGPRReg)
+                    lock(reservedGPR);
+                JSValueOperand arguments(this, node->child3());
+                argumentsTagGPR = arguments.tagGPR();
+                argumentsPayloadGPR = arguments.payloadGPR();
+                if (reservedGPR != InvalidGPRReg)
+                    unlock(reservedGPR);
+                flushRegisters();
+                
+                scratchGPR1 = JITCompiler::selectScratchGPR(argumentsPayloadGPR, argumentsTagGPR, reservedGPR);
+                scratchGPR2 = JITCompiler::selectScratchGPR(argumentsPayloadGPR, argumentsTagGPR, scratchGPR1, reservedGPR);
+                scratchGPR3 = JITCompiler::selectScratchGPR(argumentsPayloadGPR, argumentsTagGPR, scratchGPR1, scratchGPR2, reservedGPR);
+            };
+            
+            loadArgumentsGPR(InvalidGPRReg);
+        
+            DFG_ASSERT(m_jit.graph(), node, isFlushed());
+
+            // Right now, arguments is in argumentsTagGPR/argumentsPayloadGPR and the register file is
+            // flushed.
+            callOperation(operationSizeFrameForVarargs, GPRInfo::returnValueGPR, JSValueRegs(argumentsTagGPR, argumentsPayloadGPR), numUsedStackSlots, data->firstVarArgOffset);
+            m_jit.exceptionCheck();
+            
+            // Now we have the argument count of the callee frame, but we've lost the arguments operand.
+            // Reconstruct the arguments operand while preserving the callee frame.
+            loadArgumentsGPR(GPRInfo::returnValueGPR);
+            m_jit.move(TrustedImm32(numUsedStackSlots), scratchGPR1);
+            emitSetVarargsFrame(m_jit, GPRInfo::returnValueGPR, false, scratchGPR1, scratchGPR1);
+            m_jit.addPtr(TrustedImm32(-(sizeof(CallerFrameAndPC) + WTF::roundUpToMultipleOf(stackAlignmentBytes(), 6 * sizeof(void*)))), scratchGPR1, JITCompiler::stackPointerRegister);
+            
+            callOperation(operationSetupVarargsFrame, GPRInfo::returnValueGPR, scratchGPR1, JSValueRegs(argumentsTagGPR, argumentsPayloadGPR), data->firstVarArgOffset, GPRInfo::returnValueGPR);
+            m_jit.exceptionCheck();
+            resultGPR = GPRInfo::returnValueGPR;
+        }
+            
+        m_jit.addPtr(TrustedImm32(sizeof(CallerFrameAndPC)), resultGPR, JITCompiler::stackPointerRegister);
+        
+        DFG_ASSERT(m_jit.graph(), node, isFlushed());
+        
+        // We don't need the arguments array anymore.
+        if (isVarargs)
+            use(node->child3());
+
+        // Now set up the "this" argument.
+        JSValueOperand thisArgument(this, node->child2());
+        GPRReg thisArgumentTagGPR = thisArgument.tagGPR();
+        GPRReg thisArgumentPayloadGPR = thisArgument.payloadGPR();
+        thisArgument.use();
+        
+        m_jit.store32(thisArgumentTagGPR, JITCompiler::calleeArgumentTagSlot(0));
+        m_jit.store32(thisArgumentPayloadGPR, JITCompiler::calleeArgumentPayloadSlot(0));
+    } else {        
+        // The call instruction's first child is either the function (normal call) or the
+        // receiver (method call). subsequent children are the arguments.
+        numPassedArgs = node->numChildren() - 1;
+        numAllocatedArgs = numPassedArgs;
+        
+        if (functionExecutable) {
+            // Allocate more args if this would let us avoid arity checks. This is throttled by
+            // CallLinkInfo's limit. It's probably good to throttle it - if the callee wants a
+            // ginormous amount of argument space then it's better for them to do it so that when we
+            // make calls to other things, we don't waste space.
+            unsigned desiredNumAllocatedArgs = static_cast<unsigned>(functionExecutable->parameterCount()) + 1;
+            if (desiredNumAllocatedArgs <= Options::maximumDirectCallStackSize()) {
+                numAllocatedArgs = std::max(numAllocatedArgs, desiredNumAllocatedArgs);
+                
+                // Whoever converts to DirectCall should do this adjustment. It's too late for us to
+                // do this adjustment now since we will have already emitted code that relied on the
+                // value of m_parameterSlots.
+                DFG_ASSERT(
+                    m_jit.graph(), node,
+                    Graph::parameterSlotsForArgCount(numAllocatedArgs)
+                    <= m_jit.graph().m_parameterSlots);
+            }
+        }
+
+        if (isTail) {
+            JSValueOperand callee(this, calleeEdge);
+            calleeTagGPR = callee.tagGPR();
+            calleePayloadGPR = callee.payloadGPR();
+            if (!isDirect)
+                use(calleeEdge);
+
+            shuffleData.numLocals = m_jit.graph().frameRegisterCount();
+            shuffleData.callee = ValueRecovery::inPair(calleeTagGPR, calleePayloadGPR);
+            shuffleData.args.resize(numAllocatedArgs);
+            shuffleData.numPassedArgs = numPassedArgs;
+
+            for (unsigned i = 0; i < numPassedArgs; ++i) {
+                Edge argEdge = m_jit.graph().varArgChild(node, i + 1);
+                GenerationInfo& info = generationInfo(argEdge.node());
+                if (!isDirect)
+                    use(argEdge);
+                shuffleData.args[i] = info.recovery(argEdge->virtualRegister());
+            }
+            
+            for (unsigned i = numPassedArgs; i < numAllocatedArgs; ++i)
+                shuffleData.args[i] = ValueRecovery::constant(jsUndefined());
+        } else {
+            m_jit.store32(MacroAssembler::TrustedImm32(numPassedArgs), m_jit.calleeFramePayloadSlot(CallFrameSlot::argumentCount));
+        
+            for (unsigned i = 0; i < numPassedArgs; i++) {
+                Edge argEdge = m_jit.graph().m_varArgChildren[node->firstChild() + 1 + i];
+                JSValueOperand arg(this, argEdge);
+                GPRReg argTagGPR = arg.tagGPR();
+                GPRReg argPayloadGPR = arg.payloadGPR();
+                use(argEdge);
+            
+                m_jit.store32(argTagGPR, m_jit.calleeArgumentTagSlot(i));
+                m_jit.store32(argPayloadGPR, m_jit.calleeArgumentPayloadSlot(i));
+            }
+            
+            for (unsigned i = numPassedArgs; i < numAllocatedArgs; ++i)
+                m_jit.storeTrustedValue(jsUndefined(), JITCompiler::calleeArgumentSlot(i));
+        }
+    }
+
+    if (!isTail || isVarargs || isForwardVarargs) {
+        JSValueOperand callee(this, calleeEdge);
+        calleeTagGPR = callee.tagGPR();
+        calleePayloadGPR = callee.payloadGPR();
+        use(calleeEdge);
+        m_jit.store32(calleePayloadGPR, m_jit.calleeFramePayloadSlot(CallFrameSlot::callee));
+        m_jit.store32(calleeTagGPR, m_jit.calleeFrameTagSlot(CallFrameSlot::callee));
+
+        if (!isTail)
+            flushRegisters();
+    }
+
+    JITCompiler::DataLabelPtr targetToCheck;
+    JITCompiler::JumpList slowPath;
+
+    CodeOrigin staticOrigin = node->origin.semantic;
+    ASSERT(!isTail || !staticOrigin.inlineCallFrame || !staticOrigin.inlineCallFrame->getCallerSkippingTailCalls());
+    ASSERT(!isEmulatedTail || (staticOrigin.inlineCallFrame && staticOrigin.inlineCallFrame->getCallerSkippingTailCalls()));
+    CodeOrigin dynamicOrigin =
+        isEmulatedTail ? *staticOrigin.inlineCallFrame->getCallerSkippingTailCalls() : staticOrigin;
+    CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(dynamicOrigin, m_stream->size());
+    
+    CallLinkInfo* info = m_jit.codeBlock()->addCallLinkInfo();
+    info->setUpCall(callType, node->origin.semantic, calleePayloadGPR);
+    
+    auto setResultAndResetStack = [&] () {
+        GPRFlushedCallResult resultPayload(this);
+        GPRFlushedCallResult2 resultTag(this);
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+        
+        m_jit.setupResults(resultPayloadGPR, resultTagGPR);
+
+        jsValueResult(resultTagGPR, resultPayloadGPR, node, DataFormatJS, UseChildrenCalledExplicitly);
+        // After the calls are done, we need to reestablish our stack
+        // pointer. We rely on this for varargs calls, calls with arity
+        // mismatch (the callframe is slided) and tail calls.
+        m_jit.addPtr(TrustedImm32(m_jit.graph().stackPointerOffset() * sizeof(Register)), GPRInfo::callFrameRegister, JITCompiler::stackPointerRegister);
+    };
+    
+    if (node->op() == CallEval) {
+        // We want to call operationCallEval but we don't want to overwrite the parameter area in
+        // which we have created a prototypical eval call frame. This means that we have to
+        // subtract stack to make room for the call. Lucky for us, at this point we have the whole
+        // register file to ourselves.
+        
+        m_jit.emitStoreCallSiteIndex(callSite);
+        m_jit.addPtr(TrustedImm32(-static_cast<ptrdiff_t>(sizeof(CallerFrameAndPC))), JITCompiler::stackPointerRegister, GPRInfo::regT0);
+        m_jit.storePtr(GPRInfo::callFrameRegister, JITCompiler::Address(GPRInfo::regT0, CallFrame::callerFrameOffset()));
+        
+        // Now we need to make room for:
+        // - The caller frame and PC of a call to operationCallEval.
+        // - Potentially two arguments on the stack.
+        unsigned requiredBytes = sizeof(CallerFrameAndPC) + sizeof(ExecState*) * 2;
+        requiredBytes = WTF::roundUpToMultipleOf(stackAlignmentBytes(), requiredBytes);
+        m_jit.subPtr(TrustedImm32(requiredBytes), JITCompiler::stackPointerRegister);
+        m_jit.setupArgumentsWithExecState(GPRInfo::regT0);
+        prepareForExternalCall();
+        m_jit.appendCall(operationCallEval);
+        m_jit.exceptionCheck();
+        JITCompiler::Jump done = m_jit.branch32(JITCompiler::NotEqual, GPRInfo::returnValueGPR2, TrustedImm32(JSValue::EmptyValueTag));
+        
+        // This is the part where we meant to make a normal call. Oops.
+        m_jit.addPtr(TrustedImm32(requiredBytes), JITCompiler::stackPointerRegister);
+        m_jit.load32(JITCompiler::calleeFrameSlot(CallFrameSlot::callee).withOffset(PayloadOffset), GPRInfo::regT0);
+        m_jit.load32(JITCompiler::calleeFrameSlot(CallFrameSlot::callee).withOffset(TagOffset), GPRInfo::regT1);
+        m_jit.emitDumbVirtualCall(info);
+        
+        done.link(&m_jit);
+        setResultAndResetStack();
+        return;
+    }
+
+    if (isDirect) {
+        info->setExecutableDuringCompilation(executable);
+        info->setMaxNumArguments(numAllocatedArgs);
+
+        if (isTail) {
+            RELEASE_ASSERT(node->op() == DirectTailCall);
+            
+            JITCompiler::PatchableJump patchableJump = m_jit.patchableJump();
+            JITCompiler::Label mainPath = m_jit.label();
+            
+            m_jit.emitStoreCallSiteIndex(callSite);
+            
+            info->setFrameShuffleData(shuffleData);
+            CallFrameShuffler(m_jit, shuffleData).prepareForTailCall();
+            
+            JITCompiler::Call call = m_jit.nearTailCall();
+            
+            JITCompiler::Label slowPath = m_jit.label();
+            patchableJump.m_jump.linkTo(slowPath, &m_jit);
+            
+            silentSpillAllRegisters(InvalidGPRReg);
+            callOperation(operationLinkDirectCall, info, calleePayloadGPR);
+            silentFillAllRegisters(InvalidGPRReg);
+            m_jit.exceptionCheck();
+            m_jit.jump().linkTo(mainPath, &m_jit);
+            
+            useChildren(node);
+            
+            m_jit.addJSDirectTailCall(patchableJump, call, slowPath, info);
+            return;
+        }
+        
+        JITCompiler::Label mainPath = m_jit.label();
+        
+        m_jit.emitStoreCallSiteIndex(callSite);
+        
+        JITCompiler::Call call = m_jit.nearCall();
+        JITCompiler::Jump done = m_jit.jump();
+        
+        JITCompiler::Label slowPath = m_jit.label();
+        if (isX86())
+            m_jit.pop(JITCompiler::selectScratchGPR(calleePayloadGPR));
+
+        callOperation(operationLinkDirectCall, info, calleePayloadGPR);
+        m_jit.exceptionCheck();
+        m_jit.jump().linkTo(mainPath, &m_jit);
+        
+        done.link(&m_jit);
+        
+        setResultAndResetStack();
+        
+        m_jit.addJSDirectCall(call, slowPath, info);
+        return;
+    }
+    
+    m_jit.emitStoreCallSiteIndex(callSite);
+    
+    slowPath.append(m_jit.branchIfNotCell(JSValueRegs(calleeTagGPR, calleePayloadGPR)));
+    slowPath.append(m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck));
+
+    if (isTail) {
+        if (node->op() == TailCall) {
+            info->setFrameShuffleData(shuffleData);
+            CallFrameShuffler(m_jit, shuffleData).prepareForTailCall();
+        } else {
+            m_jit.emitRestoreCalleeSaves();
+            m_jit.prepareForTailCallSlow();
+        }
+    }
+
+    JITCompiler::Call fastCall = isTail ? m_jit.nearTailCall() : m_jit.nearCall();
+
+    JITCompiler::Jump done = m_jit.jump();
+
+    slowPath.link(&m_jit);
+
+    if (node->op() == TailCall) {
+        CallFrameShuffler callFrameShuffler(m_jit, shuffleData);
+        callFrameShuffler.setCalleeJSValueRegs(JSValueRegs(
+            GPRInfo::regT1, GPRInfo::regT0));
+        callFrameShuffler.prepareForSlowPath();
+    } else {
+        // Callee payload needs to be in regT0, tag in regT1
+        if (calleeTagGPR == GPRInfo::regT0) {
+            if (calleePayloadGPR == GPRInfo::regT1)
+                m_jit.swap(GPRInfo::regT1, GPRInfo::regT0);
+            else {
+                m_jit.move(calleeTagGPR, GPRInfo::regT1);
+                m_jit.move(calleePayloadGPR, GPRInfo::regT0);
+            }
+        } else {
+            m_jit.move(calleePayloadGPR, GPRInfo::regT0);
+            m_jit.move(calleeTagGPR, GPRInfo::regT1);
+        }
+
+        if (isTail)
+            m_jit.emitRestoreCalleeSaves();
+    }
+
+    m_jit.move(TrustedImmPtr(info), GPRInfo::regT2);
+    JITCompiler::Call slowCall = m_jit.nearCall();
+
+    done.link(&m_jit);
+
+    if (isTail)
+        m_jit.abortWithReason(JITDidReturnFromTailCall);
+    else
+        setResultAndResetStack();
+
+    m_jit.addJSCall(fastCall, slowCall, targetToCheck, info);
+}
+
+template<bool strict>
+GPRReg SpeculativeJIT::fillSpeculateInt32Internal(Edge edge, DataFormat& returnFormat)
+{
+    AbstractValue& value = m_state.forNode(edge);
+    SpeculatedType type = value.m_type;
+    ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32Only));
+
+    m_interpreter.filter(value, SpecInt32Only);
+    if (value.isClear()) {
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        returnFormat = DataFormatInt32;
+        return allocate();
+    }
+
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        if (edge->hasConstant()) {
+            ASSERT(edge->isInt32Constant());
+            GPRReg gpr = allocate();
+            m_jit.move(MacroAssembler::Imm32(edge->asInt32()), gpr);
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            info.fillInt32(*m_stream, gpr);
+            returnFormat = DataFormatInt32;
+            return gpr;
+        }
+
+        DataFormat spillFormat = info.spillFormat();
+
+        ASSERT_UNUSED(spillFormat, (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
+
+        // If we know this was spilled as an integer we can fill without checking.
+        if (type & ~SpecInt32Only)
+            speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag)));
+
+        GPRReg gpr = allocate();
+        m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        info.fillInt32(*m_stream, gpr);
+        returnFormat = DataFormatInt32;
+        return gpr;
+    }
+
+    case DataFormatJSInt32:
+    case DataFormatJS: {
+        // Check the value is an integer.
+        GPRReg tagGPR = info.tagGPR();
+        GPRReg payloadGPR = info.payloadGPR();
+        m_gprs.lock(tagGPR);
+        m_gprs.lock(payloadGPR);
+        if (type & ~SpecInt32Only)
+            speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::Int32Tag)));
+        m_gprs.unlock(tagGPR);
+        m_gprs.release(tagGPR);
+        m_gprs.release(payloadGPR);
+        m_gprs.retain(payloadGPR, virtualRegister, SpillOrderInteger);
+        info.fillInt32(*m_stream, payloadGPR);
+        // If !strict we're done, return.
+        returnFormat = DataFormatInt32;
+        return payloadGPR;
+    }
+
+    case DataFormatInt32: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        returnFormat = DataFormatInt32;
+        return gpr;
+    }
+
+    case DataFormatCell:
+    case DataFormatBoolean:
+    case DataFormatJSDouble:
+    case DataFormatJSCell:
+    case DataFormatJSBoolean:
+    case DataFormatDouble:
+    case DataFormatStorage:
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
+    }
+}
+
+GPRReg SpeculativeJIT::fillSpeculateInt32(Edge edge, DataFormat& returnFormat)
+{
+    return fillSpeculateInt32Internal<false>(edge, returnFormat);
+}
+
+GPRReg SpeculativeJIT::fillSpeculateInt32Strict(Edge edge)
+{
+    DataFormat mustBeDataFormatInt32;
+    GPRReg result = fillSpeculateInt32Internal<true>(edge, mustBeDataFormatInt32);
+    ASSERT(mustBeDataFormatInt32 == DataFormatInt32);
+    return result;
+}
+
+FPRReg SpeculativeJIT::fillSpeculateDouble(Edge edge)
+{
+    ASSERT(isDouble(edge.useKind()));
+    ASSERT(edge->hasDoubleResult());
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    if (info.registerFormat() == DataFormatNone) {
+
+        if (edge->hasConstant()) {
+            RELEASE_ASSERT(edge->isNumberConstant());
+            FPRReg fpr = fprAllocate();
+            m_jit.loadDouble(TrustedImmPtr(m_jit.addressOfDoubleConstant(edge.node())), fpr);
+            m_fprs.retain(fpr, virtualRegister, SpillOrderConstant);
+            info.fillDouble(*m_stream, fpr);
+            return fpr;
+        }
+        
+        RELEASE_ASSERT(info.spillFormat() == DataFormatDouble);
+        FPRReg fpr = fprAllocate();
+        m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
+        m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
+        info.fillDouble(*m_stream, fpr);
+        return fpr;
+    }
+
+    RELEASE_ASSERT(info.registerFormat() == DataFormatDouble);
+    FPRReg fpr = info.fpr();
+    m_fprs.lock(fpr);
+    return fpr;
+}
+
+GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge)
+{
+    AbstractValue& value = m_state.forNode(edge);
+    SpeculatedType type = value.m_type;
+    ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
+
+    m_interpreter.filter(value, SpecCell);
+    if (value.isClear()) {
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        return allocate();
+    }
+
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        if (edge->hasConstant()) {
+            GPRReg gpr = allocate();
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            m_jit.move(TrustedImmPtr(edge->constant()), gpr);
+            info.fillCell(*m_stream, gpr);
+            return gpr;
+        }
+
+        ASSERT((info.spillFormat() & DataFormatJS) || info.spillFormat() == DataFormatCell);
+        if (type & ~SpecCell) {
+            speculationCheck(
+                BadType,
+                JSValueSource(JITCompiler::addressFor(virtualRegister)),
+                edge,
+                m_jit.branch32(
+                    MacroAssembler::NotEqual,
+                    JITCompiler::tagFor(virtualRegister),
+                    TrustedImm32(JSValue::CellTag)));
+        }
+        GPRReg gpr = allocate();
+        m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        info.fillCell(*m_stream, gpr);
+        return gpr;
+    }
+
+    case DataFormatCell: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+
+    case DataFormatJSCell:
+    case DataFormatJS: {
+        GPRReg tagGPR = info.tagGPR();
+        GPRReg payloadGPR = info.payloadGPR();
+        m_gprs.lock(tagGPR);
+        m_gprs.lock(payloadGPR);
+        if (type & ~SpecCell) {
+            speculationCheck(
+                BadType, JSValueRegs(tagGPR, payloadGPR), edge,
+                m_jit.branchIfNotCell(info.jsValueRegs()));
+        }
+        m_gprs.unlock(tagGPR);
+        m_gprs.release(tagGPR);
+        m_gprs.release(payloadGPR);
+        m_gprs.retain(payloadGPR, virtualRegister, SpillOrderCell);
+        info.fillCell(*m_stream, payloadGPR);
+        return payloadGPR;
+    }
+
+    case DataFormatJSInt32:
+    case DataFormatInt32:
+    case DataFormatJSDouble:
+    case DataFormatJSBoolean:
+    case DataFormatBoolean:
+    case DataFormatDouble:
+    case DataFormatStorage:
+        RELEASE_ASSERT_NOT_REACHED();
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
+    }
+}
+
+GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge)
+{
+    AbstractValue& value = m_state.forNode(edge);
+    SpeculatedType type = value.m_type;
+    ASSERT(edge.useKind() != KnownBooleanUse || !(value.m_type & ~SpecBoolean));
+
+    m_interpreter.filter(value, SpecBoolean);
+    if (value.isClear()) {
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        return allocate();
+    }
+
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        if (edge->hasConstant()) {
+            JSValue jsValue = edge->asJSValue();
+            GPRReg gpr = allocate();
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            m_jit.move(MacroAssembler::TrustedImm32(jsValue.asBoolean()), gpr);
+            info.fillBoolean(*m_stream, gpr);
+            return gpr;
+        }
+
+        ASSERT((info.spillFormat() & DataFormatJS) || info.spillFormat() == DataFormatBoolean);
+
+        if (type & ~SpecBoolean)
+            speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::BooleanTag)));
+
+        GPRReg gpr = allocate();
+        m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        info.fillBoolean(*m_stream, gpr);
+        return gpr;
+    }
+
+    case DataFormatBoolean: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+
+    case DataFormatJSBoolean:
+    case DataFormatJS: {
+        GPRReg tagGPR = info.tagGPR();
+        GPRReg payloadGPR = info.payloadGPR();
+        m_gprs.lock(tagGPR);
+        m_gprs.lock(payloadGPR);
+        if (type & ~SpecBoolean)
+            speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::BooleanTag)));
+
+        m_gprs.unlock(tagGPR);
+        m_gprs.release(tagGPR);
+        m_gprs.release(payloadGPR);
+        m_gprs.retain(payloadGPR, virtualRegister, SpillOrderBoolean);
+        info.fillBoolean(*m_stream, payloadGPR);
+        return payloadGPR;
+    }
+
+    case DataFormatJSInt32:
+    case DataFormatInt32:
+    case DataFormatJSDouble:
+    case DataFormatJSCell:
+    case DataFormatCell:
+    case DataFormatDouble:
+    case DataFormatStorage:
+        RELEASE_ASSERT_NOT_REACHED();
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
+    }
+}
+
+void SpeculativeJIT::compileObjectEquality(Node* node)
+{
+    SpeculateCellOperand op1(this, node->child1());
+    SpeculateCellOperand op2(this, node->child2());
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.gpr();
+    
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()),
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+            m_jit.branchTest8(
+                MacroAssembler::NonZero,
+                MacroAssembler::Address(op2GPR, JSCell::typeInfoFlagsOffset()),
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+    
+    GPRTemporary resultPayload(this, Reuse, op2);
+    GPRReg resultPayloadGPR = resultPayload.gpr();
+    
+    MacroAssembler::Jump falseCase = m_jit.branchPtr(MacroAssembler::NotEqual, op1GPR, op2GPR);
+    m_jit.move(TrustedImm32(1), resultPayloadGPR);
+    MacroAssembler::Jump done = m_jit.jump();
+    falseCase.link(&m_jit);
+    m_jit.move(TrustedImm32(0), resultPayloadGPR);
+    done.link(&m_jit);
+
+    booleanResult(resultPayloadGPR, node);
+}
+
+void SpeculativeJIT::compileObjectStrictEquality(Edge objectChild, Edge otherChild)
+{
+    SpeculateCellOperand op1(this, objectChild);
+    JSValueOperand op2(this, otherChild);
+
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.payloadGPR();
+
+    DFG_TYPE_CHECK(JSValueSource::unboxedCell(op1GPR), objectChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+
+    GPRTemporary resultPayload(this, Reuse, op1);
+    GPRReg resultPayloadGPR = resultPayload.gpr();
+    
+    MacroAssembler::Jump op2CellJump = m_jit.branchIfCell(op2.jsValueRegs());
+    
+    m_jit.move(TrustedImm32(0), resultPayloadGPR);
+    MacroAssembler::Jump op2NotCellJump = m_jit.jump();
+    
+    // At this point we know that we can perform a straight-forward equality comparison on pointer
+    // values because we are doing strict equality.
+    op2CellJump.link(&m_jit);
+    m_jit.compare32(MacroAssembler::Equal, op1GPR, op2GPR, resultPayloadGPR);
+    
+    op2NotCellJump.link(&m_jit);
+    booleanResult(resultPayloadGPR, m_currentNode);
+}
+    
+void SpeculativeJIT::compilePeepHoleObjectStrictEquality(Edge objectChild, Edge otherChild, Node* branchNode)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    SpeculateCellOperand op1(this, objectChild);
+    JSValueOperand op2(this, otherChild);
+    
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.payloadGPR();
+
+    DFG_TYPE_CHECK(JSValueSource::unboxedCell(op1GPR), objectChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+
+    branch32(MacroAssembler::NotEqual, op2.tagGPR(), TrustedImm32(JSValue::CellTag), notTaken);
+    
+    if (taken == nextBlock()) {
+        branch32(MacroAssembler::NotEqual, op1GPR, op2GPR, notTaken);
+        jump(taken);
+    } else {
+        branch32(MacroAssembler::Equal, op1GPR, op2GPR, taken);
+        jump(notTaken);
+    }
+}
+
+void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)
+{
+    SpeculateCellOperand op1(this, leftChild);
+    JSValueOperand op2(this, rightChild, ManualOperandSpeculation);
+    GPRTemporary result(this);
+    
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2TagGPR = op2.tagGPR();
+    GPRReg op2PayloadGPR = op2.payloadGPR();
+    GPRReg resultGPR = result.gpr();
+
+    bool masqueradesAsUndefinedWatchpointValid =
+        masqueradesAsUndefinedWatchpointIsStillValid();
+
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+    
+    
+    // It seems that most of the time when programs do a == b where b may be either null/undefined
+    // or an object, b is usually an object. Balance the branches to make that case fast.
+    MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(op2.jsValueRegs());
+    
+    // We know that within this branch, rightChild must be a cell.
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2PayloadGPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2PayloadGPR));
+        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op2PayloadGPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+    
+    // At this point we know that we can perform a straight-forward equality comparison on pointer
+    // values because both left and right are pointers to objects that have no special equality
+    // protocols.
+    MacroAssembler::Jump falseCase = m_jit.branchPtr(MacroAssembler::NotEqual, op1GPR, op2PayloadGPR);
+    MacroAssembler::Jump trueCase = m_jit.jump();
+    
+    rightNotCell.link(&m_jit);
+    
+    // We know that within this branch, rightChild must not be a cell. Check if that is enough to
+    // prove that it is either null or undefined.
+    if (needsTypeCheck(rightChild, SpecCell | SpecOther)) {
+        m_jit.or32(TrustedImm32(1), op2TagGPR, resultGPR);
+        
+        typeCheck(
+            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, SpecCell | SpecOther,
+            m_jit.branch32(
+                MacroAssembler::NotEqual, resultGPR,
+                MacroAssembler::TrustedImm32(JSValue::NullTag)));
+    }
+    
+    falseCase.link(&m_jit);
+    m_jit.move(TrustedImm32(0), resultGPR);
+    MacroAssembler::Jump done = m_jit.jump();
+    trueCase.link(&m_jit);
+    m_jit.move(TrustedImm32(1), resultGPR);
+    done.link(&m_jit);
+    
+    booleanResult(resultGPR, m_currentNode);
+}
+
+void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, Node* branchNode)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+    
+    SpeculateCellOperand op1(this, leftChild);
+    JSValueOperand op2(this, rightChild, ManualOperandSpeculation);
+    GPRTemporary result(this);
+    
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2TagGPR = op2.tagGPR();
+    GPRReg op2PayloadGPR = op2.payloadGPR();
+    GPRReg resultGPR = result.gpr();
+
+    bool masqueradesAsUndefinedWatchpointValid =
+        masqueradesAsUndefinedWatchpointIsStillValid();
+
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+    
+    // It seems that most of the time when programs do a == b where b may be either null/undefined
+    // or an object, b is usually an object. Balance the branches to make that case fast.
+    MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(op2.jsValueRegs());
+    
+    // We know that within this branch, rightChild must be a cell.
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,
+            m_jit.branchIfNotObject(op2PayloadGPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,
+            m_jit.branchIfNotObject(op2PayloadGPR));
+        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op2PayloadGPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+    
+    // At this point we know that we can perform a straight-forward equality comparison on pointer
+    // values because both left and right are pointers to objects that have no special equality
+    // protocols.
+    branch32(MacroAssembler::Equal, op1GPR, op2PayloadGPR, taken);
+    
+    // We know that within this branch, rightChild must not be a cell. Check if that is enough to
+    // prove that it is either null or undefined.
+    if (!needsTypeCheck(rightChild, SpecCell | SpecOther))
+        rightNotCell.link(&m_jit);
+    else {
+        jump(notTaken, ForceJump);
+        
+        rightNotCell.link(&m_jit);
+        m_jit.or32(TrustedImm32(1), op2TagGPR, resultGPR);
+        
+        typeCheck(
+            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, SpecCell | SpecOther,
+            m_jit.branch32(
+                MacroAssembler::NotEqual, resultGPR,
+                MacroAssembler::TrustedImm32(JSValue::NullTag)));
+    }
+    
+    jump(notTaken);
+}
+
+void SpeculativeJIT::compileSymbolUntypedEquality(Node* node, Edge symbolEdge, Edge untypedEdge)
+{
+    SpeculateCellOperand symbol(this, symbolEdge);
+    JSValueOperand untyped(this, untypedEdge);
+
+    GPRReg symbolGPR = symbol.gpr();
+    GPRReg untypedGPR = untyped.payloadGPR();
+
+    speculateSymbol(symbolEdge, symbolGPR);
+
+    GPRTemporary resultPayload(this, Reuse, symbol);
+    GPRReg resultPayloadGPR = resultPayload.gpr();
+
+    MacroAssembler::Jump untypedCellJump = m_jit.branchIfCell(untyped.jsValueRegs());
+
+    m_jit.move(TrustedImm32(0), resultPayloadGPR);
+    MacroAssembler::Jump untypedNotCellJump = m_jit.jump();
+
+    // At this point we know that we can perform a straight-forward equality comparison on pointer
+    // values because we are doing strict equality.
+    untypedCellJump.link(&m_jit);
+    m_jit.compare32(MacroAssembler::Equal, symbolGPR, untypedGPR, resultPayloadGPR);
+
+    untypedNotCellJump.link(&m_jit);
+    booleanResult(resultPayloadGPR, node);
+}
+
+void SpeculativeJIT::compileInt32Compare(Node* node, MacroAssembler::RelationalCondition condition)
+{
+    SpeculateInt32Operand op1(this, node->child1());
+    SpeculateInt32Operand op2(this, node->child2());
+    GPRTemporary resultPayload(this);
+    
+    m_jit.compare32(condition, op1.gpr(), op2.gpr(), resultPayload.gpr());
+    
+    // If we add a DataFormatBool, we should use it here.
+    booleanResult(resultPayload.gpr(), node);
+}
+
+void SpeculativeJIT::compileDoubleCompare(Node* node, MacroAssembler::DoubleCondition condition)
+{
+    SpeculateDoubleOperand op1(this, node->child1());
+    SpeculateDoubleOperand op2(this, node->child2());
+    GPRTemporary resultPayload(this);
+    
+    m_jit.move(TrustedImm32(1), resultPayload.gpr());
+    MacroAssembler::Jump trueCase = m_jit.branchDouble(condition, op1.fpr(), op2.fpr());
+    m_jit.move(TrustedImm32(0), resultPayload.gpr());
+    trueCase.link(&m_jit);
+    
+    booleanResult(resultPayload.gpr(), node);
+}
+
+void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse)
+{
+    JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
+    GPRTemporary resultPayload(this);
+    GPRReg valueTagGPR = value.tagGPR();
+    GPRReg valuePayloadGPR = value.payloadGPR();
+    GPRReg resultPayloadGPR = resultPayload.gpr();
+    GPRTemporary structure;
+    GPRReg structureGPR = InvalidGPRReg;
+
+    bool masqueradesAsUndefinedWatchpointValid =
+        masqueradesAsUndefinedWatchpointIsStillValid();
+
+    if (!masqueradesAsUndefinedWatchpointValid) {
+        // The masquerades as undefined case will use the structure register, so allocate it here.
+        // Do this at the top of the function to avoid branching around a register allocation.
+        GPRTemporary realStructure(this);
+        structure.adopt(realStructure);
+        structureGPR = structure.gpr();
+    }
+
+    MacroAssembler::Jump notCell = m_jit.branchIfNotCell(value.jsValueRegs());
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
+            m_jit.branchIfNotObject(valuePayloadGPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
+            m_jit.branchIfNotObject(valuePayloadGPR));
+
+        MacroAssembler::Jump isNotMasqueradesAsUndefined = 
+            m_jit.branchTest8(
+                MacroAssembler::Zero, 
+                MacroAssembler::Address(valuePayloadGPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined));
+
+        m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureIDOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(structureGPR, Structure::globalObjectOffset()), 
+                TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic))));
+
+        isNotMasqueradesAsUndefined.link(&m_jit);
+    }
+    m_jit.move(TrustedImm32(0), resultPayloadGPR);
+    MacroAssembler::Jump done = m_jit.jump();
+    
+    notCell.link(&m_jit);
+ 
+    COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
+    if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {
+        m_jit.or32(TrustedImm32(1), valueTagGPR, resultPayloadGPR);
+        typeCheck(
+            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, SpecCell | SpecOther,
+            m_jit.branch32(
+                MacroAssembler::NotEqual, 
+                resultPayloadGPR, 
+                TrustedImm32(JSValue::NullTag)));
+    }
+    m_jit.move(TrustedImm32(1), resultPayloadGPR);
+    
+    done.link(&m_jit);
+    
+    booleanResult(resultPayloadGPR, m_currentNode);
+}
+
+void SpeculativeJIT::compileLogicalNot(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case BooleanUse:
+    case KnownBooleanUse: {
+        SpeculateBooleanOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value);
+        m_jit.xor32(TrustedImm32(1), value.gpr(), result.gpr());
+        booleanResult(result.gpr(), node);
+        return;
+    }
+        
+    case ObjectOrOtherUse: {
+        compileObjectOrOtherLogicalNot(node->child1());
+        return;
+    }
+        
+    case Int32Use: {
+        SpeculateInt32Operand value(this, node->child1());
+        GPRTemporary resultPayload(this, Reuse, value);
+        m_jit.compare32(MacroAssembler::Equal, value.gpr(), MacroAssembler::TrustedImm32(0), resultPayload.gpr());
+        booleanResult(resultPayload.gpr(), node);
+        return;
+    }
+        
+    case DoubleRepUse: {
+        SpeculateDoubleOperand value(this, node->child1());
+        FPRTemporary scratch(this);
+        GPRTemporary resultPayload(this);
+        m_jit.move(TrustedImm32(0), resultPayload.gpr());
+        MacroAssembler::Jump nonZero = m_jit.branchDoubleNonZero(value.fpr(), scratch.fpr());
+        m_jit.move(TrustedImm32(1), resultPayload.gpr());
+        nonZero.link(&m_jit);
+        booleanResult(resultPayload.gpr(), node);
+        return;
+    }
+
+    case UntypedUse: {
+        JSValueOperand arg1(this, node->child1());
+        GPRTemporary result(this);
+        GPRTemporary temp(this);
+        FPRTemporary valueFPR(this);
+        FPRTemporary tempFPR(this);
+
+        GPRReg resultGPR = result.gpr();
+
+        bool shouldCheckMasqueradesAsUndefined = !masqueradesAsUndefinedWatchpointIsStillValid();
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        bool negateResult = true;
+        m_jit.emitConvertValueToBoolean(arg1.jsValueRegs(), resultGPR, temp.gpr(), valueFPR.fpr(), tempFPR.fpr(), shouldCheckMasqueradesAsUndefined, globalObject, negateResult);
+        booleanResult(resultGPR, node);
+        return;
+    }
+    case StringUse:
+        return compileStringZeroLength(node);
+
+    case StringOrOtherUse:
+        return compileLogicalNotStringOrOther(node);
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
+{
+    JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
+    GPRTemporary scratch(this);
+    GPRReg valueTagGPR = value.tagGPR();
+    GPRReg valuePayloadGPR = value.payloadGPR();
+    GPRReg scratchGPR = scratch.gpr();
+    
+    MacroAssembler::Jump notCell = m_jit.branchIfNotCell(value.jsValueRegs());
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        DFG_TYPE_CHECK(
+            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
+            m_jit.branchIfNotObject(valuePayloadGPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,
+            m_jit.branchIfNotObject(valuePayloadGPR));
+
+        JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(
+            JITCompiler::Zero, 
+            MacroAssembler::Address(valuePayloadGPR, JSCell::typeInfoFlagsOffset()), 
+            TrustedImm32(MasqueradesAsUndefined));
+
+        m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureIDOffset()), scratchGPR);
+        speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(scratchGPR, Structure::globalObjectOffset()), 
+                TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic))));
+
+        isNotMasqueradesAsUndefined.link(&m_jit);
+    }
+    jump(taken, ForceJump);
+    
+    notCell.link(&m_jit);
+    
+    COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);
+    if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {
+        m_jit.or32(TrustedImm32(1), valueTagGPR, scratchGPR);
+        typeCheck(
+            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, SpecCell | SpecOther,
+            m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::NullTag)));
+    }
+
+    jump(notTaken);
+    
+    noResult(m_currentNode);
+}
+
+void SpeculativeJIT::emitBranch(Node* node)
+{
+    BasicBlock* taken = node->branchData()->taken.block;
+    BasicBlock* notTaken = node->branchData()->notTaken.block;
+
+    switch (node->child1().useKind()) {
+    case BooleanUse:
+    case KnownBooleanUse: {
+        SpeculateBooleanOperand value(this, node->child1());
+        MacroAssembler::ResultCondition condition = MacroAssembler::NonZero;
+
+        if (taken == nextBlock()) {
+            condition = MacroAssembler::Zero;
+            BasicBlock* tmp = taken;
+            taken = notTaken;
+            notTaken = tmp;
+        }
+
+        branchTest32(condition, value.gpr(), TrustedImm32(1), taken);
+        jump(notTaken);
+
+        noResult(node);
+        return;
+    }
+    
+    case ObjectOrOtherUse: {
+        emitObjectOrOtherBranch(node->child1(), taken, notTaken);
+        return;
+    }
+
+    case StringUse: {
+        emitStringBranch(node->child1(), taken, notTaken);
+        return;
+    }
+
+    case StringOrOtherUse: {
+        emitStringOrOtherBranch(node->child1(), taken, notTaken);
+        return;
+    }
+
+    case DoubleRepUse:
+    case Int32Use: {
+        if (node->child1().useKind() == Int32Use) {
+            bool invert = false;
+            
+            if (taken == nextBlock()) {
+                invert = true;
+                BasicBlock* tmp = taken;
+                taken = notTaken;
+                notTaken = tmp;
+            }
+
+            SpeculateInt32Operand value(this, node->child1());
+            branchTest32(invert ? MacroAssembler::Zero : MacroAssembler::NonZero, value.gpr(), taken);
+        } else {
+            SpeculateDoubleOperand value(this, node->child1());
+            FPRTemporary scratch(this);
+            branchDoubleNonZero(value.fpr(), scratch.fpr(), taken);
+        }
+        
+        jump(notTaken);
+        
+        noResult(node);
+        return;
+    }
+    
+    case UntypedUse: {
+        JSValueOperand value(this, node->child1());
+        FPRTemporary valueFPR(this);
+        FPRTemporary tempFPR(this);
+        GPRTemporary result(this);
+        GPRTemporary temp(this);
+
+        JSValueRegs valueRegs = value.jsValueRegs();
+        GPRReg resultGPR = result.gpr();
+    
+        use(node->child1());
+
+        bool shouldCheckMasqueradesAsUndefined = !masqueradesAsUndefinedWatchpointIsStillValid();
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        m_jit.emitConvertValueToBoolean(valueRegs, resultGPR, temp.gpr(), valueFPR.fpr(), tempFPR.fpr(), shouldCheckMasqueradesAsUndefined, globalObject);
+        branchTest32(JITCompiler::Zero, resultGPR, notTaken);
+        jump(taken, ForceJump);
+
+        noResult(node, UseChildrenCalledExplicitly);
+        return;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+template<typename BaseOperandType, typename PropertyOperandType, typename ValueOperandType, typename TagType>
+void SpeculativeJIT::compileContiguousPutByVal(Node* node, BaseOperandType& base, PropertyOperandType& property, ValueOperandType& value, GPRReg valuePayloadReg, TagType valueTag)
+{
+    Edge child4 = m_jit.graph().varArgChild(node, 3);
+
+    ArrayMode arrayMode = node->arrayMode();
+    
+    GPRReg baseReg = base.gpr();
+    GPRReg propertyReg = property.gpr();
+    
+    StorageOperand storage(this, child4);
+    GPRReg storageReg = storage.gpr();
+
+    if (node->op() == PutByValAlias) {
+        // Store the value to the array.
+        GPRReg propertyReg = property.gpr();
+        m_jit.store32(valueTag, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+        m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+        
+        noResult(node);
+        return;
+    }
+    
+    MacroAssembler::Jump slowCase;
+
+    if (arrayMode.isInBounds()) {
+        speculationCheck(
+            OutOfBounds, JSValueRegs(), 0,
+            m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+    } else {
+        MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+        
+        slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength()));
+        
+        if (!arrayMode.isOutOfBounds())
+            speculationCheck(OutOfBounds, JSValueRegs(), 0, slowCase);
+        
+        m_jit.add32(TrustedImm32(1), propertyReg);
+        m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+        m_jit.sub32(TrustedImm32(1), propertyReg);
+        
+        inBounds.link(&m_jit);
+    }
+    
+    m_jit.store32(valueTag, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+    m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+    
+    base.use();
+    property.use();
+    value.use();
+    storage.use();
+    
+    if (arrayMode.isOutOfBounds()) {
+        if (node->op() == PutByValDirect) {
+            addSlowPathGenerator(slowPathCall(
+                slowCase, this,
+                m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValDirectBeyondArrayBoundsNonStrict,
+                NoResult, baseReg, propertyReg, valueTag, valuePayloadReg));
+        } else {
+            addSlowPathGenerator(slowPathCall(
+                slowCase, this,
+                m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
+                NoResult, baseReg, propertyReg, valueTag, valuePayloadReg));
+        }
+    }
+
+    noResult(node, UseChildrenCalledExplicitly);    
+}
+
+void SpeculativeJIT::compile(Node* node)
+{
+    NodeType op = node->op();
+
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+    m_jit.clearRegisterAllocationOffsets();
+#endif
+
+    switch (op) {
+    case JSConstant:
+    case DoubleConstant:
+    case PhantomDirectArguments:
+    case PhantomClonedArguments:
+        initConstantInfo(node);
+        break;
+
+    case LazyJSConstant:
+        compileLazyJSConstant(node);
+        break;
+
+    case Identity: {
+        speculate(node, node->child1());
+        switch (node->child1().useKind()) {
+        case DoubleRepUse:
+        case DoubleRepRealUse: {
+            SpeculateDoubleOperand op(this, node->child1());
+            doubleResult(op.fpr(), node);
+            break;
+        }
+        case Int52RepUse: 
+        case AnyIntUse:
+        case DoubleRepAnyIntUse: {
+            RELEASE_ASSERT_NOT_REACHED();   
+            break;
+        }
+        default: {
+            JSValueOperand op(this, node->child1());
+            GPRTemporary resultTag(this, Reuse, op, TagWord);
+            GPRTemporary resultPayload(this, Reuse, op, PayloadWord);
+            GPRReg sourceTag = op.tagGPR();
+            GPRReg sourcePayload = op.payloadGPR();
+            GPRReg resultTagGPR = resultTag.gpr();
+            GPRReg resultPayloadGPR = resultPayload.gpr();
+            m_jit.move(sourceTag, resultTagGPR);
+            m_jit.move(sourcePayload, resultPayloadGPR);
+            jsValueResult(resultTagGPR, resultPayloadGPR, node);
+            break;
+        }
+        } // switch
+        break;
+    }
+
+    case GetLocal: {
+        AbstractValue& value = m_state.variables().operand(node->local());
+
+        // If the CFA is tracking this variable and it found that the variable
+        // cannot have been assigned, then don't attempt to proceed.
+        if (value.isClear()) {
+            m_compileOkay = false;
+            break;
+        }
+        
+        switch (node->variableAccessData()->flushFormat()) {
+        case FlushedDouble: {
+            FPRTemporary result(this);
+            m_jit.loadDouble(JITCompiler::addressFor(node->machineLocal()), result.fpr());
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_fprs.retain(result.fpr(), virtualRegister, SpillOrderDouble);
+            generationInfoFromVirtualRegister(virtualRegister).initDouble(node, node->refCount(), result.fpr());
+            break;
+        }
+        
+        case FlushedInt32: {
+            GPRTemporary result(this);
+            m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
+            
+            // Like int32Result, but don't useChildren - our children are phi nodes,
+            // and don't represent values within this dataflow with virtual registers.
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderInteger);
+            generationInfoFromVirtualRegister(virtualRegister).initInt32(node, node->refCount(), result.gpr());
+            break;
+        }
+        
+        case FlushedCell: {
+            GPRTemporary result(this);
+            m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
+            
+            // Like cellResult, but don't useChildren - our children are phi nodes,
+            // and don't represent values within this dataflow with virtual registers.
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderCell);
+            generationInfoFromVirtualRegister(virtualRegister).initCell(node, node->refCount(), result.gpr());
+            break;
+        }
+            
+        case FlushedBoolean: {
+            GPRTemporary result(this);
+            m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
+            
+            // Like booleanResult, but don't useChildren - our children are phi nodes,
+            // and don't represent values within this dataflow with virtual registers.
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderBoolean);
+            generationInfoFromVirtualRegister(virtualRegister).initBoolean(node, node->refCount(), result.gpr());
+            break;
+        }
+            
+        case FlushedJSValue: {
+            GPRTemporary result(this);
+            GPRTemporary tag(this);
+            m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
+            m_jit.load32(JITCompiler::tagFor(node->machineLocal()), tag.gpr());
+            
+            // Like jsValueResult, but don't useChildren - our children are phi nodes,
+            // and don't represent values within this dataflow with virtual registers.
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderJS);
+            m_gprs.retain(tag.gpr(), virtualRegister, SpillOrderJS);
+            
+            generationInfoFromVirtualRegister(virtualRegister).initJSValue(node, node->refCount(), tag.gpr(), result.gpr(), DataFormatJS);
+            break;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+        break;
+    }
+        
+    case GetLocalUnlinked: {
+        GPRTemporary payload(this);
+        GPRTemporary tag(this);
+        m_jit.load32(JITCompiler::payloadFor(node->unlinkedMachineLocal()), payload.gpr());
+        m_jit.load32(JITCompiler::tagFor(node->unlinkedMachineLocal()), tag.gpr());
+        jsValueResult(tag.gpr(), payload.gpr(), node);
+        break;
+    }
+
+    case MovHint: {
+        compileMovHint(m_currentNode);
+        noResult(node);
+        break;
+    }
+        
+    case ZombieHint: {
+        recordSetLocal(m_currentNode->unlinkedLocal(), VirtualRegister(), DataFormatDead);
+        noResult(node);
+        break;
+    }
+
+    case ExitOK: {
+        noResult(node);
+        break;
+    }
+        
+    case SetLocal: {
+        switch (node->variableAccessData()->flushFormat()) {
+        case FlushedDouble: {
+            SpeculateDoubleOperand value(this, node->child1());
+            m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node->machineLocal()));
+            noResult(node);
+            // Indicate that it's no longer necessary to retrieve the value of
+            // this bytecode variable from registers or other locations in the stack,
+            // but that it is stored as a double.
+            recordSetLocal(DataFormatDouble);
+            break;
+        }
+            
+        case FlushedInt32: {
+            SpeculateInt32Operand value(this, node->child1());
+            m_jit.store32(value.gpr(), JITCompiler::payloadFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(DataFormatInt32);
+            break;
+        }
+            
+        case FlushedCell: {
+            SpeculateCellOperand cell(this, node->child1());
+            GPRReg cellGPR = cell.gpr();
+            m_jit.storePtr(cellGPR, JITCompiler::payloadFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(DataFormatCell);
+            break;
+        }
+            
+        case FlushedBoolean: {
+            SpeculateBooleanOperand value(this, node->child1());
+            m_jit.store32(value.gpr(), JITCompiler::payloadFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(DataFormatBoolean);
+            break;
+        }
+            
+        case FlushedJSValue: {
+            JSValueOperand value(this, node->child1());
+            m_jit.store32(value.payloadGPR(), JITCompiler::payloadFor(node->machineLocal()));
+            m_jit.store32(value.tagGPR(), JITCompiler::tagFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(dataFormatFor(node->variableAccessData()->flushFormat()));
+            break;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+
+    case SetArgument:
+        // This is a no-op; it just marks the fact that the argument is being used.
+        // But it may be profitable to use this as a hook to run speculation checks
+        // on arguments, thereby allowing us to trivially eliminate such checks if
+        // the argument is not used.
+        recordSetLocal(dataFormatFor(node->variableAccessData()->flushFormat()));
+        break;
+
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+        compileBitwiseOp(node);
+        break;
+
+    case BitRShift:
+    case BitLShift:
+    case BitURShift:
+        compileShiftOp(node);
+        break;
+
+    case UInt32ToNumber: {
+        compileUInt32ToNumber(node);
+        break;
+    }
+        
+    case DoubleAsInt32: {
+        compileDoubleAsInt32(node);
+        break;
+    }
+
+    case ValueToInt32: {
+        compileValueToInt32(node);
+        break;
+    }
+        
+    case DoubleRep: {
+        compileDoubleRep(node);
+        break;
+    }
+        
+    case ValueRep: {
+        compileValueRep(node);
+        break;
+    }
+
+    case ValueAdd:
+        compileValueAdd(node);
+        break;
+
+    case StrCat: {
+        JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+        JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
+        JSValueOperand op3(this, node->child3(), ManualOperandSpeculation);
+        
+        JSValueRegs op1Regs = op1.jsValueRegs();
+        JSValueRegs op2Regs = op2.jsValueRegs();
+        JSValueRegs op3Regs;
+
+        if (node->child3())
+            op3Regs = op3.jsValueRegs();
+        
+        flushRegisters();
+
+        GPRFlushedCallResult result(this);
+        if (node->child3())
+            callOperation(operationStrCat3, result.gpr(), op1Regs, op2Regs, op3Regs);
+        else
+            callOperation(operationStrCat2, result.gpr(), op1Regs, op2Regs);
+        m_jit.exceptionCheck();
+        
+        cellResult(result.gpr(), node);
+        break;
+    }
+
+    case ArithAdd:
+        compileArithAdd(node);
+        break;
+
+    case ArithClz32:
+        compileArithClz32(node);
+        break;
+
+    case MakeRope:
+        compileMakeRope(node);
+        break;
+
+    case ArithSub:
+        compileArithSub(node);
+        break;
+
+    case ArithNegate:
+        compileArithNegate(node);
+        break;
+
+    case ArithMul:
+        compileArithMul(node);
+        break;
+
+    case ArithDiv: {
+        compileArithDiv(node);
+        break;
+    }
+
+    case ArithMod: {
+        compileArithMod(node);
+        break;
+    }
+
+    case ArithPow: {
+        compileArithPow(node);
+        break;
+    }
+
+    case ArithAbs:
+        compileArithAbs(node);
+        break;
+
+    case ArithMin:
+    case ArithMax: {
+        switch (node->binaryUseKind()) {
+        case Int32Use: {
+            SpeculateStrictInt32Operand op1(this, node->child1());
+            SpeculateStrictInt32Operand op2(this, node->child2());
+            GPRTemporary result(this, Reuse, op1);
+
+            GPRReg op1GPR = op1.gpr();
+            GPRReg op2GPR = op2.gpr();
+            GPRReg resultGPR = result.gpr();
+
+            MacroAssembler::Jump op1Less = m_jit.branch32(op == ArithMin ? MacroAssembler::LessThan : MacroAssembler::GreaterThan, op1GPR, op2GPR);
+            m_jit.move(op2GPR, resultGPR);
+            if (op1GPR != resultGPR) {
+                MacroAssembler::Jump done = m_jit.jump();
+                op1Less.link(&m_jit);
+                m_jit.move(op1GPR, resultGPR);
+                done.link(&m_jit);
+            } else
+                op1Less.link(&m_jit);
+            
+            int32Result(resultGPR, node);
+            break;
+        }
+        
+        case DoubleRepUse: {
+            SpeculateDoubleOperand op1(this, node->child1());
+            SpeculateDoubleOperand op2(this, node->child2());
+            FPRTemporary result(this, op1);
+
+            FPRReg op1FPR = op1.fpr();
+            FPRReg op2FPR = op2.fpr();
+            FPRReg resultFPR = result.fpr();
+
+            MacroAssembler::JumpList done;
+        
+            MacroAssembler::Jump op1Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleLessThan : MacroAssembler::DoubleGreaterThan, op1FPR, op2FPR);
+        
+            // op2 is eather the lesser one or one of then is NaN
+            MacroAssembler::Jump op2Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleGreaterThanOrEqual : MacroAssembler::DoubleLessThanOrEqual, op1FPR, op2FPR);
+        
+            // Unordered case. We don't know which of op1, op2 is NaN. Manufacture NaN by adding 
+            // op1 + op2 and putting it into result.
+            m_jit.addDouble(op1FPR, op2FPR, resultFPR);
+            done.append(m_jit.jump());
+        
+            op2Less.link(&m_jit);
+            m_jit.moveDouble(op2FPR, resultFPR);
+        
+            if (op1FPR != resultFPR) {
+                done.append(m_jit.jump());
+            
+                op1Less.link(&m_jit);
+                m_jit.moveDouble(op1FPR, resultFPR);
+            } else
+                op1Less.link(&m_jit);
+        
+            done.link(&m_jit);
+        
+            doubleResult(resultFPR, node);
+            break;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+
+    case ArithSqrt:
+        compileArithSqrt(node);
+        break;
+
+    case ArithFRound:
+        compileArithFRound(node);
+        break;
+
+    case ArithRandom:
+        compileArithRandom(node);
+        break;
+
+    case ArithRound:
+    case ArithFloor:
+    case ArithCeil:
+    case ArithTrunc:
+        compileArithRounding(node);
+        break;
+
+    case ArithSin:
+        compileArithSin(node);
+        break;
+
+    case ArithCos:
+        compileArithCos(node);
+        break;
+
+    case ArithTan:
+        compileArithTan(node);
+        break;
+
+    case ArithLog:
+        compileArithLog(node);
+        break;
+
+    case LogicalNot:
+        compileLogicalNot(node);
+        break;
+
+    case CompareLess:
+        if (compare(node, JITCompiler::LessThan, JITCompiler::DoubleLessThan, operationCompareLess))
+            return;
+        break;
+
+    case CompareLessEq:
+        if (compare(node, JITCompiler::LessThanOrEqual, JITCompiler::DoubleLessThanOrEqual, operationCompareLessEq))
+            return;
+        break;
+
+    case CompareGreater:
+        if (compare(node, JITCompiler::GreaterThan, JITCompiler::DoubleGreaterThan, operationCompareGreater))
+            return;
+        break;
+
+    case CompareGreaterEq:
+        if (compare(node, JITCompiler::GreaterThanOrEqual, JITCompiler::DoubleGreaterThanOrEqual, operationCompareGreaterEq))
+            return;
+        break;
+
+    case CompareEq:
+        if (compare(node, JITCompiler::Equal, JITCompiler::DoubleEqual, operationCompareEq))
+            return;
+        break;
+
+    case CompareStrictEq:
+        if (compileStrictEq(node))
+            return;
+        break;
+        
+    case CompareEqPtr:
+        compileCompareEqPtr(node);
+        break;
+
+    case StringCharCodeAt: {
+        compileGetCharCodeAt(node);
+        break;
+    }
+
+    case StringCharAt: {
+        // Relies on StringCharAt node having same basic layout as GetByVal
+        compileGetByValOnString(node);
+        break;
+    }
+
+    case StringFromCharCode: {
+        compileFromCharCode(node);
+        break;
+    }
+        
+    case CheckArray: {
+        checkArray(node);
+        break;
+    }
+        
+    case Arrayify:
+    case ArrayifyToStructure: {
+        arrayify(node);
+        break;
+    }
+
+    case GetByVal: {
+        switch (node->arrayMode().type()) {
+        case Array::SelectUsingPredictions:
+        case Array::ForceExit:
+            RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+#endif
+            break;
+        case Array::Undecided: {
+            SpeculateStrictInt32Operand index(this, node->child2());
+            GPRTemporary resultTag(this, Reuse, index);
+            GPRTemporary resultPayload(this);
+
+            GPRReg indexGPR = index.gpr();
+            GPRReg resultTagGPR = resultTag.gpr();
+            GPRReg resultPayloadGPR = resultPayload.gpr();
+
+            speculationCheck(OutOfBounds, JSValueRegs(), node,
+                m_jit.branch32(MacroAssembler::LessThan, indexGPR, MacroAssembler::TrustedImm32(0)));
+
+            use(node->child1());
+            index.use();
+
+            m_jit.move(MacroAssembler::TrustedImm32(JSValue::UndefinedTag), resultTagGPR);
+            m_jit.move(MacroAssembler::TrustedImm32(0), resultPayloadGPR);
+            jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+        case Array::Generic: {
+            SpeculateCellOperand base(this, node->child1()); // Save a register, speculate cell. We'll probably be right.
+            JSValueOperand property(this, node->child2());
+            GPRReg baseGPR = base.gpr();
+            JSValueRegs propertyRegs = property.jsValueRegs();
+            
+            flushRegisters();
+            GPRFlushedCallResult2 resultTag(this);
+            GPRFlushedCallResult resultPayload(this);
+            callOperation(operationGetByValCell, JSValueRegs(resultTag.gpr(), resultPayload.gpr()), baseGPR, propertyRegs);
+            m_jit.exceptionCheck();
+            
+            jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+            break;
+        }
+        case Array::Int32:
+        case Array::Contiguous: {
+            if (node->arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node->child2());
+                StorageOperand storage(this, node->child3());
+            
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
+            
+                if (!m_compileOkay)
+                    return;
+            
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+                GPRTemporary resultPayload(this);
+                if (node->arrayMode().type() == Array::Int32) {
+                    ASSERT(!node->arrayMode().isSaneChain());
+                    
+                    speculationCheck(
+                        OutOfBounds, JSValueRegs(), 0,
+                        m_jit.branch32(
+                            MacroAssembler::Equal,
+                            MacroAssembler::BaseIndex(
+                                storageReg, propertyReg, MacroAssembler::TimesEight, TagOffset),
+                            TrustedImm32(JSValue::EmptyValueTag)));
+                    m_jit.load32(
+                        MacroAssembler::BaseIndex(
+                            storageReg, propertyReg, MacroAssembler::TimesEight, PayloadOffset),
+                        resultPayload.gpr());
+                    int32Result(resultPayload.gpr(), node);
+                    break;
+                }
+                
+                GPRTemporary resultTag(this);
+                m_jit.load32(
+                    MacroAssembler::BaseIndex(
+                        storageReg, propertyReg, MacroAssembler::TimesEight, TagOffset),
+                    resultTag.gpr());
+                m_jit.load32(
+                    MacroAssembler::BaseIndex(
+                        storageReg, propertyReg, MacroAssembler::TimesEight, PayloadOffset),
+                    resultPayload.gpr());
+                if (node->arrayMode().isSaneChain()) {
+                    JITCompiler::Jump notHole = m_jit.branch32(
+                        MacroAssembler::NotEqual, resultTag.gpr(),
+                        TrustedImm32(JSValue::EmptyValueTag));
+                    m_jit.move(TrustedImm32(JSValue::UndefinedTag), resultTag.gpr());
+                    m_jit.move(TrustedImm32(0), resultPayload.gpr());
+                    notHole.link(&m_jit);
+                } else {
+                    speculationCheck(
+                        LoadFromHole, JSValueRegs(), 0,
+                        m_jit.branch32(
+                            MacroAssembler::Equal, resultTag.gpr(),
+                            TrustedImm32(JSValue::EmptyValueTag)));
+                }
+                jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+                break;
+            }
+
+            SpeculateCellOperand base(this, node->child1());
+            SpeculateStrictInt32Operand property(this, node->child2());
+            StorageOperand storage(this, node->child3());
+            
+            GPRReg baseReg = base.gpr();
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
+            
+            if (!m_compileOkay)
+                return;
+            
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this);
+            GPRReg resultTagReg = resultTag.gpr();
+            GPRReg resultPayloadReg = resultPayload.gpr();
+            
+            MacroAssembler::JumpList slowCases;
+
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagReg);
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadReg);
+            slowCases.append(m_jit.branch32(MacroAssembler::Equal, resultTagReg, TrustedImm32(JSValue::EmptyValueTag)));
+            
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCases, this, operationGetByValArrayInt,
+                    JSValueRegs(resultTagReg, resultPayloadReg), baseReg, propertyReg));
+            
+            jsValueResult(resultTagReg, resultPayloadReg, node);
+            break;
+        }
+        case Array::Double: {
+            if (node->arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node->child2());
+                StorageOperand storage(this, node->child3());
+            
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
+            
+                if (!m_compileOkay)
+                    return;
+            
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+                FPRTemporary result(this);
+                m_jit.loadDouble(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), result.fpr());
+                if (!node->arrayMode().isSaneChain())
+                    speculationCheck(LoadFromHole, JSValueRegs(), 0, m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, result.fpr(), result.fpr()));
+                doubleResult(result.fpr(), node);
+                break;
+            }
+
+            SpeculateCellOperand base(this, node->child1());
+            SpeculateStrictInt32Operand property(this, node->child2());
+            StorageOperand storage(this, node->child3());
+            
+            GPRReg baseReg = base.gpr();
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
+            
+            if (!m_compileOkay)
+                return;
+            
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this);
+            FPRTemporary temp(this);
+            GPRReg resultTagReg = resultTag.gpr();
+            GPRReg resultPayloadReg = resultPayload.gpr();
+            FPRReg tempReg = temp.fpr();
+            
+            MacroAssembler::JumpList slowCases;
+            
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+            m_jit.loadDouble(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), tempReg);
+            slowCases.append(m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, tempReg, tempReg));
+            boxDouble(tempReg, resultTagReg, resultPayloadReg);
+
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCases, this, operationGetByValArrayInt,
+                    JSValueRegs(resultTagReg, resultPayloadReg), baseReg, propertyReg));
+            
+            jsValueResult(resultTagReg, resultPayloadReg, node);
+            break;
+        }
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage: {
+            if (node->arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node->child2());
+                StorageOperand storage(this, node->child3());
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
+        
+                if (!m_compileOkay)
+                    return;
+
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())));
+
+                GPRTemporary resultTag(this);
+                GPRTemporary resultPayload(this);
+
+                m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
+                speculationCheck(LoadFromHole, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
+                m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
+            
+                jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+                break;
+            }
+
+            SpeculateCellOperand base(this, node->child1());
+            SpeculateStrictInt32Operand property(this, node->child2());
+            StorageOperand storage(this, node->child3());
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
+            GPRReg baseReg = base.gpr();
+
+            if (!m_compileOkay)
+                return;
+
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this);
+            GPRReg resultTagReg = resultTag.gpr();
+            GPRReg resultPayloadReg = resultPayload.gpr();
+
+            JITCompiler::Jump outOfBounds = m_jit.branch32(
+                MacroAssembler::AboveOrEqual, propertyReg,
+                MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
+
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagReg);
+            JITCompiler::Jump hole = m_jit.branch32(
+                MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag));
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadReg);
+            
+            JITCompiler::JumpList slowCases;
+            slowCases.append(outOfBounds);
+            slowCases.append(hole);
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCases, this, operationGetByValArrayInt,
+                    JSValueRegs(resultTagReg, resultPayloadReg),
+                    baseReg, propertyReg));
+
+            jsValueResult(resultTagReg, resultPayloadReg, node);
+            break;
+        }
+        case Array::String:
+            compileGetByValOnString(node);
+            break;
+        case Array::DirectArguments:
+            compileGetByValOnDirectArguments(node);
+            break;
+        case Array::ScopedArguments:
+            compileGetByValOnScopedArguments(node);
+            break;
+        default: {
+            TypedArrayType type = node->arrayMode().typedArrayType();
+            if (isInt(type))
+                compileGetByValOnIntTypedArray(node, type);
+            else
+                compileGetByValOnFloatTypedArray(node, type);
+        } }
+        break;
+    }
+    
+    case ToLowerCase: {
+        compileToLowerCase(node);
+        break;
+    }
+
+    case GetByValWithThis: {
+        JSValueOperand base(this, node->child1());
+        JSValueRegs baseRegs = base.jsValueRegs();
+        JSValueOperand thisValue(this, node->child2());
+        JSValueRegs thisValueRegs = thisValue.jsValueRegs();
+        JSValueOperand subscript(this, node->child3());
+        JSValueRegs subscriptRegs = subscript.jsValueRegs();
+
+        GPRFlushedCallResult resultPayload(this);
+        GPRFlushedCallResult2 resultTag(this);
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+
+        flushRegisters();
+        callOperation(operationGetByValWithThis, JSValueRegs(resultTagGPR, resultPayloadGPR), baseRegs, thisValueRegs, subscriptRegs);
+        m_jit.exceptionCheck();
+
+        jsValueResult(resultTagGPR, resultPayloadGPR, node);
+        break;
+    }
+
+    case PutByValDirect:
+    case PutByVal:
+    case PutByValAlias: {
+        Edge child1 = m_jit.graph().varArgChild(node, 0);
+        Edge child2 = m_jit.graph().varArgChild(node, 1);
+        Edge child3 = m_jit.graph().varArgChild(node, 2);
+        Edge child4 = m_jit.graph().varArgChild(node, 3);
+        
+        ArrayMode arrayMode = node->arrayMode().modeForPut();
+        bool alreadyHandled = false;
+        
+        switch (arrayMode.type()) {
+        case Array::SelectUsingPredictions:
+        case Array::ForceExit:
+            RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+            alreadyHandled = true;
+#endif
+            break;
+        case Array::Generic: {
+            ASSERT(node->op() == PutByVal || node->op() == PutByValDirect);
+            
+            SpeculateCellOperand base(this, child1); // Save a register, speculate cell. We'll probably be right.
+            JSValueOperand property(this, child2);
+            JSValueOperand value(this, child3);
+            GPRReg baseGPR = base.gpr();
+            JSValueRegs propertyRegs = property.jsValueRegs();
+            JSValueRegs valueRegs = value.jsValueRegs();
+            
+            flushRegisters();
+            if (node->op() == PutByValDirect)
+                callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectCellStrict : operationPutByValDirectCellNonStrict, baseGPR, propertyRegs, valueRegs);
+            else
+                callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValCellStrict : operationPutByValCellNonStrict, baseGPR, propertyRegs, valueRegs);
+            m_jit.exceptionCheck();
+            
+            noResult(node);
+            alreadyHandled = true;
+            break;
+        }
+        default:
+            break;
+        }
+        
+        if (alreadyHandled)
+            break;
+        
+        SpeculateCellOperand base(this, child1);
+        SpeculateStrictInt32Operand property(this, child2);
+        
+        GPRReg baseReg = base.gpr();
+        GPRReg propertyReg = property.gpr();
+
+        switch (arrayMode.type()) {
+        case Array::Int32: {
+            SpeculateInt32Operand value(this, child3);
+
+            GPRReg valuePayloadReg = value.gpr();
+        
+            if (!m_compileOkay)
+                return;
+            
+            compileContiguousPutByVal(node, base, property, value, valuePayloadReg, TrustedImm32(JSValue::Int32Tag));
+            break;
+        }
+        case Array::Contiguous: {
+            JSValueOperand value(this, child3);
+
+            GPRReg valueTagReg = value.tagGPR();
+            GPRReg valuePayloadReg = value.payloadGPR();
+        
+            if (!m_compileOkay)
+                return;
+
+            compileContiguousPutByVal(node, base, property, value, valuePayloadReg, valueTagReg);
+            break;
+        }
+        case Array::Double: {
+            compileDoublePutByVal(node, base, property);
+            break;
+        }
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage: {
+            JSValueOperand value(this, child3);
+
+            GPRReg valueTagReg = value.tagGPR();
+            GPRReg valuePayloadReg = value.payloadGPR();
+            
+            if (!m_compileOkay)
+                return;
+
+            StorageOperand storage(this, child4);
+            GPRReg storageReg = storage.gpr();
+
+            if (node->op() == PutByValAlias) {
+                // Store the value to the array.
+                GPRReg propertyReg = property.gpr();
+                m_jit.store32(value.tagGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+                m_jit.store32(value.payloadGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+                
+                noResult(node);
+                break;
+            }
+
+            MacroAssembler::JumpList slowCases;
+
+            MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
+            if (!arrayMode.isOutOfBounds())
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, beyondArrayBounds);
+            else
+                slowCases.append(beyondArrayBounds);
+
+            // Check if we're writing to a hole; if so increment m_numValuesInVector.
+            if (arrayMode.isInBounds()) {
+                speculationCheck(
+                    StoreToHole, JSValueRegs(), 0,
+                    m_jit.branch32(MacroAssembler::Equal, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag)));
+            } else {
+                MacroAssembler::Jump notHoleValue = m_jit.branch32(MacroAssembler::NotEqual, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
+                if (arrayMode.isSlowPut()) {
+                    // This is sort of strange. If we wanted to optimize this code path, we would invert
+                    // the above branch. But it's simply not worth it since this only happens if we're
+                    // already having a bad time.
+                    slowCases.append(m_jit.jump());
+                } else {
+                    m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset()));
+                
+                    // If we're writing to a hole we might be growing the array; 
+                    MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
+                    m_jit.add32(TrustedImm32(1), propertyReg);
+                    m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
+                    m_jit.sub32(TrustedImm32(1), propertyReg);
+                
+                    lengthDoesNotNeedUpdate.link(&m_jit);
+                }
+                notHoleValue.link(&m_jit);
+            }
+    
+            // Store the value to the array.
+            m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+
+            base.use();
+            property.use();
+            value.use();
+            storage.use();
+            
+            if (!slowCases.empty()) {
+                if (node->op() == PutByValDirect) {
+                    addSlowPathGenerator(slowPathCall(
+                        slowCases, this,
+                        m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValDirectBeyondArrayBoundsNonStrict,
+                        NoResult, baseReg, propertyReg, JSValueRegs(valueTagReg, valuePayloadReg)));
+                } else {
+                    addSlowPathGenerator(slowPathCall(
+                        slowCases, this,
+                        m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
+                        NoResult, baseReg, propertyReg, JSValueRegs(valueTagReg, valuePayloadReg)));
+                }
+            }
+
+            noResult(node, UseChildrenCalledExplicitly);
+            break;
+        }
+            
+        default: {
+            TypedArrayType type = arrayMode.typedArrayType();
+            if (isInt(type))
+                compilePutByValForIntTypedArray(base.gpr(), property.gpr(), node, type);
+            else
+                compilePutByValForFloatTypedArray(base.gpr(), property.gpr(), node, type);
+        } }
+        break;
+    }
+
+    case PutByValWithThis: {
+#if CPU(X86)
+        // We don't have enough registers on X86 to do this
+        // without setting up the call frame incrementally.
+        unsigned index = 0;
+        m_jit.poke(GPRInfo::callFrameRegister, index++);
+
+        {
+            JSValueOperand base(this, m_jit.graph().varArgChild(node, 0));
+            GPRReg baseTag = base.tagGPR();
+            GPRReg basePayload = base.payloadGPR();
+
+            JSValueOperand thisValue(this, m_jit.graph().varArgChild(node, 1));
+            GPRReg thisValueTag = thisValue.tagGPR();
+            GPRReg thisValuePayload = thisValue.payloadGPR();
+
+            JSValueOperand property(this, m_jit.graph().varArgChild(node, 2));
+            GPRReg propertyTag = property.tagGPR();
+            GPRReg propertyPayload = property.payloadGPR();
+
+            m_jit.poke(basePayload, index++);
+            m_jit.poke(baseTag, index++);
+
+            m_jit.poke(thisValuePayload, index++);
+            m_jit.poke(thisValueTag, index++);
+
+            m_jit.poke(propertyPayload, index++);
+            m_jit.poke(propertyTag, index++);
+
+            flushRegisters();
+        }
+
+        JSValueOperand value(this, m_jit.graph().varArgChild(node, 3));
+        GPRReg valueTag = value.tagGPR();
+        GPRReg valuePayload = value.payloadGPR();
+        m_jit.poke(valuePayload, index++);
+        m_jit.poke(valueTag, index++);
+
+        flushRegisters();
+        appendCall(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByValWithThisStrict : operationPutByValWithThis);
+        m_jit.exceptionCheck();
+#elif CPU(MIPS)
+        // We don't have enough registers on MIPS either but the ABI is a little different.
+        unsigned index = 4;
+        m_jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+        {
+            JSValueOperand base(this, m_jit.graph().varArgChild(node, 0));
+            GPRReg baseTag = base.tagGPR();
+            GPRReg basePayload = base.payloadGPR();
+
+            JSValueOperand thisValue(this, m_jit.graph().varArgChild(node, 1));
+            GPRReg thisValueTag = thisValue.tagGPR();
+            GPRReg thisValuePayload = thisValue.payloadGPR();
+
+            JSValueOperand property(this, m_jit.graph().varArgChild(node, 2));
+            GPRReg propertyTag = property.tagGPR();
+            GPRReg propertyPayload = property.payloadGPR();
+
+            // for operationPutByValWithThis[Strict](), base is a 64 bits
+            // argument, so it should be double word aligned on the stack.
+            // This requirement still applies when it's in argument registers
+            // instead of on the stack.
+            m_jit.move(basePayload, GPRInfo::argumentGPR2);
+            m_jit.move(baseTag, GPRInfo::argumentGPR3);
+
+            m_jit.poke(thisValuePayload, index++);
+            m_jit.poke(thisValueTag, index++);
+
+            m_jit.poke(propertyPayload, index++);
+            m_jit.poke(propertyTag, index++);
+
+            flushRegisters();
+        }
+
+        JSValueOperand value(this, m_jit.graph().varArgChild(node, 3));
+        GPRReg valueTag = value.tagGPR();
+        GPRReg valuePayload = value.payloadGPR();
+        m_jit.poke(valuePayload, index++);
+        m_jit.poke(valueTag, index++);
+
+        flushRegisters();
+        appendCall(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByValWithThisStrict : operationPutByValWithThis);
+        m_jit.exceptionCheck();
+#else
+        static_assert(GPRInfo::numberOfRegisters >= 8, "We are assuming we have enough registers to make this call without incrementally setting up the arguments.");
+
+        JSValueOperand base(this, m_jit.graph().varArgChild(node, 0));
+        JSValueRegs baseRegs = base.jsValueRegs();
+
+        JSValueOperand thisValue(this, m_jit.graph().varArgChild(node, 1));
+        JSValueRegs thisRegs = thisValue.jsValueRegs();
+
+        JSValueOperand property(this, m_jit.graph().varArgChild(node, 2));
+        JSValueRegs propertyRegs = property.jsValueRegs();
+
+        JSValueOperand value(this, m_jit.graph().varArgChild(node, 3));
+        JSValueRegs valueRegs = value.jsValueRegs();
+
+        flushRegisters();
+        callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByValWithThisStrict : operationPutByValWithThis,
+            NoResult, baseRegs, thisRegs, propertyRegs, valueRegs);
+        m_jit.exceptionCheck();
+#endif // CPU(X86)
+
+        noResult(node);
+        break;
+    }
+
+    case RegExpExec: {
+        SpeculateCellOperand globalObject(this, node->child1());
+        GPRReg globalObjectGPR = globalObject.gpr();
+        
+        if (node->child2().useKind() == RegExpObjectUse) {
+            if (node->child3().useKind() == StringUse) {
+                SpeculateCellOperand base(this, node->child2());
+                SpeculateCellOperand argument(this, node->child3());
+                GPRReg baseGPR = base.gpr();
+                GPRReg argumentGPR = argument.gpr();
+                speculateRegExpObject(node->child2(), baseGPR);
+                speculateString(node->child3(), argumentGPR);
+                
+                flushRegisters();
+                GPRFlushedCallResult2 resultTag(this);
+                GPRFlushedCallResult resultPayload(this);
+                callOperation(
+                    operationRegExpExecString, JSValueRegs(resultTag.gpr(), resultPayload.gpr()),
+                    globalObjectGPR, baseGPR, argumentGPR);
+                m_jit.exceptionCheck();
+                
+                jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+                break;
+            }
+            
+            SpeculateCellOperand base(this, node->child2());
+            JSValueOperand argument(this, node->child3());
+            GPRReg baseGPR = base.gpr();
+            JSValueRegs argumentRegs = argument.jsValueRegs();
+            speculateRegExpObject(node->child2(), baseGPR);
+        
+            flushRegisters();
+            GPRFlushedCallResult2 resultTag(this);
+            GPRFlushedCallResult resultPayload(this);
+            callOperation(
+                operationRegExpExec, JSValueRegs(resultTag.gpr(), resultPayload.gpr()), globalObjectGPR, baseGPR, argumentRegs);
+            m_jit.exceptionCheck();
+        
+            jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+            break;
+        }
+        
+        JSValueOperand base(this, node->child2());
+        JSValueOperand argument(this, node->child3());
+        JSValueRegs baseRegs = base.jsValueRegs();
+        JSValueRegs argumentRegs = argument.jsValueRegs();
+        
+        flushRegisters();
+        GPRFlushedCallResult2 resultTag(this);
+        GPRFlushedCallResult resultPayload(this);
+        callOperation(
+            operationRegExpExecGeneric, JSValueRegs(resultTag.gpr(), resultPayload.gpr()), globalObjectGPR, baseRegs, argumentRegs);
+        m_jit.exceptionCheck();
+        
+        jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+        break;
+    }
+        
+    case RegExpTest: {
+        SpeculateCellOperand globalObject(this, node->child1());
+        GPRReg globalObjectGPR = globalObject.gpr();
+        
+        if (node->child2().useKind() == RegExpObjectUse) {
+            if (node->child3().useKind() == StringUse) {
+                SpeculateCellOperand base(this, node->child2());
+                SpeculateCellOperand argument(this, node->child3());
+                GPRReg baseGPR = base.gpr();
+                GPRReg argumentGPR = argument.gpr();
+                speculateRegExpObject(node->child2(), baseGPR);
+                speculateString(node->child3(), argumentGPR);
+                
+                flushRegisters();
+                GPRFlushedCallResult result(this);
+                callOperation(
+                    operationRegExpTestString, result.gpr(), globalObjectGPR, baseGPR, argumentGPR);
+                m_jit.exceptionCheck();
+                
+                booleanResult(result.gpr(), node);
+                break;
+            }
+            
+            SpeculateCellOperand base(this, node->child2());
+            JSValueOperand argument(this, node->child3());
+            GPRReg baseGPR = base.gpr();
+            JSValueRegs argumentRegs = argument.jsValueRegs();
+            speculateRegExpObject(node->child2(), baseGPR);
+        
+            flushRegisters();
+            GPRFlushedCallResult result(this);
+            callOperation(
+                operationRegExpTest, result.gpr(), globalObjectGPR, baseGPR, argumentRegs);
+            m_jit.exceptionCheck();
+        
+            booleanResult(result.gpr(), node);
+            break;
+        }
+        
+        JSValueOperand base(this, node->child2());
+        JSValueOperand argument(this, node->child3());
+        JSValueRegs baseRegs = base.jsValueRegs();
+        JSValueRegs argumentRegs = argument.jsValueRegs();
+
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        callOperation(
+            operationRegExpTestGeneric, result.gpr(), globalObjectGPR, baseRegs, argumentRegs);
+        m_jit.exceptionCheck();
+        
+        booleanResult(result.gpr(), node);
+        break;
+    }
+
+    case StringReplace:
+    case StringReplaceRegExp: {
+        if (node->child1().useKind() == StringUse
+            && node->child2().useKind() == RegExpObjectUse
+            && node->child3().useKind() == StringUse) {
+            if (JSString* replace = node->child3()->dynamicCastConstant<JSString*>()) {
+                if (!replace->length()) {
+                    SpeculateCellOperand string(this, node->child1());
+                    SpeculateCellOperand regExp(this, node->child2());
+                    GPRReg stringGPR = string.gpr();
+                    GPRReg regExpGPR = regExp.gpr();
+                    speculateString(node->child1(), stringGPR);
+                    speculateRegExpObject(node->child2(), regExpGPR);
+
+                    flushRegisters();
+                    GPRFlushedCallResult2 resultTag(this);
+                    GPRFlushedCallResult resultPayload(this);
+                    callOperation(
+                        operationStringProtoFuncReplaceRegExpEmptyStr, JSValueRegs(resultTag.gpr(), resultPayload.gpr()), stringGPR, regExpGPR);
+                    m_jit.exceptionCheck();
+                    cellResult(resultPayload.gpr(), node);
+                    break;
+                }
+            }
+            
+            SpeculateCellOperand string(this, node->child1());
+            SpeculateCellOperand regExp(this, node->child2());
+            SpeculateCellOperand replace(this, node->child3());
+            GPRReg stringGPR = string.gpr();
+            GPRReg regExpGPR = regExp.gpr();
+            GPRReg replaceGPR = replace.gpr();
+            speculateString(node->child1(), stringGPR);
+            speculateRegExpObject(node->child2(), regExpGPR);
+            speculateString(node->child3(), replaceGPR);
+            
+            flushRegisters();
+            GPRFlushedCallResult2 resultTag(this);
+            GPRFlushedCallResult resultPayload(this);
+            callOperation(
+                operationStringProtoFuncReplaceRegExpString, JSValueRegs(resultTag.gpr(), resultPayload.gpr()),
+                stringGPR, regExpGPR, replaceGPR);
+            m_jit.exceptionCheck();
+            cellResult(resultPayload.gpr(), node);
+            break;
+        }
+
+        // If we fixed up the edge of child2, we inserted a Check(@child2, String).
+        OperandSpeculationMode child2SpeculationMode = AutomaticOperandSpeculation;
+        if (node->child2().useKind() == StringUse)
+            child2SpeculationMode = ManualOperandSpeculation;
+        
+        JSValueOperand string(this, node->child1());
+        JSValueOperand search(this, node->child2(), child2SpeculationMode);
+        JSValueOperand replace(this, node->child3());
+        JSValueRegs stringRegs = string.jsValueRegs();
+        JSValueRegs searchRegs = search.jsValueRegs();
+        JSValueRegs replaceRegs = replace.jsValueRegs();
+        
+        flushRegisters();
+        GPRFlushedCallResult2 resultTag(this);
+        GPRFlushedCallResult resultPayload(this);
+        callOperation(
+            operationStringProtoFuncReplaceGeneric, JSValueRegs(resultTag.gpr(), resultPayload.gpr()),
+            stringRegs, searchRegs, replaceRegs); 
+        m_jit.exceptionCheck();
+        cellResult(resultPayload.gpr(), node);
+        break;
+    }
+
+    case GetRegExpObjectLastIndex: {
+        compileGetRegExpObjectLastIndex(node);
+        break;
+    }
+        
+    case SetRegExpObjectLastIndex: {
+        compileSetRegExpObjectLastIndex(node);
+        break;
+    }
+        
+    case RecordRegExpCachedResult: {
+        compileRecordRegExpCachedResult(node);
+        break;
+    }
+        
+    case ArrayPush: {
+        ASSERT(node->arrayMode().isJSArray());
+        
+        SpeculateCellOperand base(this, node->child1());
+        GPRTemporary storageLength(this);
+        
+        GPRReg baseGPR = base.gpr();
+        GPRReg storageLengthGPR = storageLength.gpr();
+        
+        StorageOperand storage(this, node->child3());
+        GPRReg storageGPR = storage.gpr();
+        
+        switch (node->arrayMode().type()) {
+        case Array::Int32: {
+            SpeculateInt32Operand value(this, node->child2());
+            GPRReg valuePayloadGPR = value.gpr();
+            
+            m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
+            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
+            m_jit.store32(TrustedImm32(JSValue::Int32Tag), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(valuePayloadGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+            m_jit.add32(TrustedImm32(1), storageLengthGPR);
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            m_jit.move(TrustedImm32(JSValue::Int32Tag), storageGPR);
+            
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowPath, this, operationArrayPush,
+                    JSValueRegs(storageGPR, storageLengthGPR),
+                    TrustedImm32(JSValue::Int32Tag), valuePayloadGPR, baseGPR));
+        
+            jsValueResult(storageGPR, storageLengthGPR, node);
+            break;
+        }
+            
+        case Array::Contiguous: {
+            JSValueOperand value(this, node->child2());
+            GPRReg valueTagGPR = value.tagGPR();
+            GPRReg valuePayloadGPR = value.payloadGPR();
+
+            m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
+            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
+            m_jit.store32(valueTagGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(valuePayloadGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+            m_jit.add32(TrustedImm32(1), storageLengthGPR);
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            m_jit.move(TrustedImm32(JSValue::Int32Tag), storageGPR);
+            
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowPath, this, operationArrayPush,
+                    JSValueRegs(storageGPR, storageLengthGPR),
+                    JSValueRegs(valueTagGPR, valuePayloadGPR), baseGPR));
+        
+            jsValueResult(storageGPR, storageLengthGPR, node);
+            break;
+        }
+            
+        case Array::Double: {
+            SpeculateDoubleOperand value(this, node->child2());
+            FPRReg valueFPR = value.fpr();
+
+            DFG_TYPE_CHECK(
+                JSValueRegs(), node->child2(), SpecDoubleReal,
+                m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, valueFPR, valueFPR));
+            
+            m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
+            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
+            m_jit.storeDouble(valueFPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight));
+            m_jit.add32(TrustedImm32(1), storageLengthGPR);
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            m_jit.move(TrustedImm32(JSValue::Int32Tag), storageGPR);
+            
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowPath, this, operationArrayPushDouble,
+                    JSValueRegs(storageGPR, storageLengthGPR),
+                    valueFPR, baseGPR));
+        
+            jsValueResult(storageGPR, storageLengthGPR, node);
+            break;
+        }
+            
+        case Array::ArrayStorage: {
+            JSValueOperand value(this, node->child2());
+            GPRReg valueTagGPR = value.tagGPR();
+            GPRReg valuePayloadGPR = value.payloadGPR();
+
+            m_jit.load32(MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()), storageLengthGPR);
+        
+            // Refuse to handle bizarre lengths.
+            speculationCheck(Uncountable, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::Above, storageLengthGPR, TrustedImm32(0x7ffffffe)));
+        
+            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, ArrayStorage::vectorLengthOffset()));
+        
+            m_jit.store32(valueTagGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(valuePayloadGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+        
+            m_jit.add32(TrustedImm32(1), storageLengthGPR);
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()));
+            m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+            m_jit.move(TrustedImm32(JSValue::Int32Tag), storageGPR);
+        
+            addSlowPathGenerator(slowPathCall(slowPath, this, operationArrayPush, JSValueRegs(storageGPR, storageLengthGPR),
+                JSValueRegs(valueTagGPR, valuePayloadGPR), baseGPR));
+        
+            jsValueResult(storageGPR, storageLengthGPR, node);
+            break;
+        }
+            
+        default:
+            CRASH();
+            break;
+        }
+        break;
+    }
+        
+    case ArrayPop: {
+        ASSERT(node->arrayMode().isJSArray());
+        
+        SpeculateCellOperand base(this, node->child1());
+        StorageOperand storage(this, node->child2());
+        GPRTemporary valueTag(this);
+        GPRTemporary valuePayload(this);
+        
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueTagGPR = valueTag.gpr();
+        GPRReg valuePayloadGPR = valuePayload.gpr();
+        GPRReg storageGPR = storage.gpr();
+        
+        switch (node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Contiguous: {
+            m_jit.load32(
+                MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), valuePayloadGPR);
+            MacroAssembler::Jump undefinedCase =
+                m_jit.branchTest32(MacroAssembler::Zero, valuePayloadGPR);
+            m_jit.sub32(TrustedImm32(1), valuePayloadGPR);
+            m_jit.store32(
+                valuePayloadGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            m_jit.load32(
+                MacroAssembler::BaseIndex(storageGPR, valuePayloadGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)),
+                valueTagGPR);
+            MacroAssembler::Jump slowCase = m_jit.branch32(MacroAssembler::Equal, valueTagGPR, TrustedImm32(JSValue::EmptyValueTag));
+            m_jit.store32(
+                MacroAssembler::TrustedImm32(JSValue::EmptyValueTag),
+                MacroAssembler::BaseIndex(storageGPR, valuePayloadGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.load32(
+                MacroAssembler::BaseIndex(storageGPR, valuePayloadGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)),
+                valuePayloadGPR);
+
+            addSlowPathGenerator(
+                slowPathMove(
+                    undefinedCase, this,
+                    MacroAssembler::TrustedImm32(jsUndefined().tag()), valueTagGPR,
+                    MacroAssembler::TrustedImm32(jsUndefined().payload()), valuePayloadGPR));
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCase, this, operationArrayPopAndRecoverLength,
+                    JSValueRegs(valueTagGPR, valuePayloadGPR), baseGPR));
+            
+            jsValueResult(valueTagGPR, valuePayloadGPR, node);
+            break;
+        }
+            
+        case Array::Double: {
+            FPRTemporary temp(this);
+            FPRReg tempFPR = temp.fpr();
+            
+            m_jit.load32(
+                MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), valuePayloadGPR);
+            MacroAssembler::Jump undefinedCase =
+                m_jit.branchTest32(MacroAssembler::Zero, valuePayloadGPR);
+            m_jit.sub32(TrustedImm32(1), valuePayloadGPR);
+            m_jit.store32(
+                valuePayloadGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            m_jit.loadDouble(
+                MacroAssembler::BaseIndex(storageGPR, valuePayloadGPR, MacroAssembler::TimesEight),
+                tempFPR);
+            MacroAssembler::Jump slowCase = m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, tempFPR, tempFPR);
+            JSValue nan = JSValue(JSValue::EncodeAsDouble, PNaN);
+            m_jit.store32(
+                MacroAssembler::TrustedImm32(nan.u.asBits.tag),
+                MacroAssembler::BaseIndex(storageGPR, valuePayloadGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(
+                MacroAssembler::TrustedImm32(nan.u.asBits.payload),
+                MacroAssembler::BaseIndex(storageGPR, valuePayloadGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+            boxDouble(tempFPR, valueTagGPR, valuePayloadGPR);
+
+            addSlowPathGenerator(
+                slowPathMove(
+                    undefinedCase, this,
+                    MacroAssembler::TrustedImm32(jsUndefined().tag()), valueTagGPR,
+                    MacroAssembler::TrustedImm32(jsUndefined().payload()), valuePayloadGPR));
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCase, this, operationArrayPopAndRecoverLength,
+                    JSValueRegs(valueTagGPR, valuePayloadGPR), baseGPR));
+            
+            jsValueResult(valueTagGPR, valuePayloadGPR, node);
+            break;
+        }
+
+        case Array::ArrayStorage: {
+            GPRTemporary storageLength(this);
+            GPRReg storageLengthGPR = storageLength.gpr();
+
+            m_jit.load32(MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()), storageLengthGPR);
+        
+            JITCompiler::JumpList setUndefinedCases;
+            setUndefinedCases.append(m_jit.branchTest32(MacroAssembler::Zero, storageLengthGPR));
+        
+            m_jit.sub32(TrustedImm32(1), storageLengthGPR);
+        
+            MacroAssembler::Jump slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, ArrayStorage::vectorLengthOffset()));
+        
+            m_jit.load32(MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), valueTagGPR);
+            m_jit.load32(MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), valuePayloadGPR);
+        
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()));
+
+            setUndefinedCases.append(m_jit.branch32(MacroAssembler::Equal, TrustedImm32(JSValue::EmptyValueTag), valueTagGPR));
+        
+            m_jit.store32(TrustedImm32(JSValue::EmptyValueTag), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+
+            m_jit.sub32(TrustedImm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+        
+            addSlowPathGenerator(
+                slowPathMove(
+                    setUndefinedCases, this,
+                    MacroAssembler::TrustedImm32(jsUndefined().tag()), valueTagGPR,
+                    MacroAssembler::TrustedImm32(jsUndefined().payload()), valuePayloadGPR));
+        
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCase, this, operationArrayPop,
+                    JSValueRegs(valueTagGPR, valuePayloadGPR), baseGPR));
+
+            jsValueResult(valueTagGPR, valuePayloadGPR, node);
+            break;
+        }
+            
+        default:
+            CRASH();
+            break;
+        }
+        break;
+    }
+
+    case ArraySlice: {
+        compileArraySlice(node);
+        break;
+    }
+
+    case DFG::Jump: {
+        jump(node->targetBlock());
+        noResult(node);
+        break;
+    }
+
+    case Branch:
+        emitBranch(node);
+        break;
+        
+    case Switch:
+        emitSwitch(node);
+        break;
+
+    case Return: {
+        ASSERT(GPRInfo::callFrameRegister != GPRInfo::regT2);
+        ASSERT(GPRInfo::regT1 != GPRInfo::returnValueGPR);
+        ASSERT(GPRInfo::returnValueGPR != GPRInfo::callFrameRegister);
+
+        // Return the result in returnValueGPR.
+        JSValueOperand op1(this, node->child1());
+        op1.fill();
+        if (op1.isDouble())
+            boxDouble(op1.fpr(), GPRInfo::returnValueGPR2, GPRInfo::returnValueGPR);
+        else {
+            if (op1.payloadGPR() == GPRInfo::returnValueGPR2 && op1.tagGPR() == GPRInfo::returnValueGPR)
+                m_jit.swap(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+            else if (op1.payloadGPR() == GPRInfo::returnValueGPR2) {
+                m_jit.move(op1.payloadGPR(), GPRInfo::returnValueGPR);
+                m_jit.move(op1.tagGPR(), GPRInfo::returnValueGPR2);
+            } else {
+                m_jit.move(op1.tagGPR(), GPRInfo::returnValueGPR2);
+                m_jit.move(op1.payloadGPR(), GPRInfo::returnValueGPR);
+            }
+        }
+
+        m_jit.emitRestoreCalleeSaves();
+        m_jit.emitFunctionEpilogue();
+        m_jit.ret();
+        
+        noResult(node);
+        break;
+    }
+        
+    case Throw:
+    case ThrowStaticError: {
+        // We expect that throw statements are rare and are intended to exit the code block
+        // anyway, so we just OSR back to the old JIT for now.
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        break;
+    }
+        
+    case BooleanToNumber: {
+        switch (node->child1().useKind()) {
+        case BooleanUse: {
+            SpeculateBooleanOperand value(this, node->child1());
+            GPRTemporary result(this); // FIXME: We could reuse, but on speculation fail would need recovery to restore tag (akin to add).
+            
+            m_jit.move(value.gpr(), result.gpr());
+
+            int32Result(result.gpr(), node);
+            break;
+        }
+            
+        case UntypedUse: {
+            JSValueOperand value(this, node->child1());
+            
+            if (!m_interpreter.needsTypeCheck(node->child1(), SpecBoolInt32 | SpecBoolean)) {
+                GPRTemporary result(this);
+                
+                GPRReg valueGPR = value.payloadGPR();
+                GPRReg resultGPR = result.gpr();
+                
+                m_jit.move(valueGPR, resultGPR);
+                int32Result(result.gpr(), node);
+                break;
+            }
+            
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this);
+            
+            GPRReg valueTagGPR = value.tagGPR();
+            GPRReg valuePayloadGPR = value.payloadGPR();
+            GPRReg resultTagGPR = resultTag.gpr();
+            GPRReg resultPayloadGPR = resultPayload.gpr();
+            
+            m_jit.move(valuePayloadGPR, resultPayloadGPR);
+            JITCompiler::Jump isBoolean = m_jit.branch32(
+                JITCompiler::Equal, valueTagGPR, TrustedImm32(JSValue::BooleanTag));
+            m_jit.move(valueTagGPR, resultTagGPR);
+            JITCompiler::Jump done = m_jit.jump();
+            isBoolean.link(&m_jit);
+            m_jit.move(TrustedImm32(JSValue::Int32Tag), resultTagGPR);
+            done.link(&m_jit);
+            
+            jsValueResult(resultTagGPR, resultPayloadGPR, node);
+            break;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+        
+    case ToPrimitive: {
+        RELEASE_ASSERT(node->child1().useKind() == UntypedUse);
+        JSValueOperand argument(this, node->child1());
+        GPRTemporary resultTag(this, Reuse, argument, TagWord);
+        GPRTemporary resultPayload(this, Reuse, argument, PayloadWord);
+        
+        GPRReg argumentTagGPR = argument.tagGPR();
+        GPRReg argumentPayloadGPR = argument.payloadGPR();
+        GPRReg resultTagGPR = resultTag.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        
+        argument.use();
+        
+        MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(argument.jsValueRegs());
+        MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(argumentPayloadGPR);
+        
+        alreadyPrimitive.link(&m_jit);
+        m_jit.move(argumentTagGPR, resultTagGPR);
+        m_jit.move(argumentPayloadGPR, resultPayloadGPR);
+        
+        addSlowPathGenerator(
+            slowPathCall(
+                notPrimitive, this, operationToPrimitive,
+                JSValueRegs(resultTagGPR, resultPayloadGPR), JSValueRegs(argumentTagGPR, argumentPayloadGPR)));
+        
+        jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
+        break;
+    }
+
+    case ToNumber: {
+        JSValueOperand argument(this, node->child1());
+        GPRTemporary resultTag(this, Reuse, argument, TagWord);
+        GPRTemporary resultPayload(this, Reuse, argument, PayloadWord);
+
+        GPRReg argumentPayloadGPR = argument.payloadGPR();
+        GPRReg argumentTagGPR = argument.tagGPR();
+        JSValueRegs argumentRegs = argument.jsValueRegs();
+        JSValueRegs resultRegs(resultTag.gpr(), resultPayload.gpr());
+
+        argument.use();
+
+        // We have several attempts to remove ToNumber. But ToNumber still exists.
+        // It means that converting non-numbers to numbers by this ToNumber is not rare.
+        // Instead of the slow path generator, we emit callOperation here.
+        if (!(m_state.forNode(node->child1()).m_type & SpecBytecodeNumber)) {
+            flushRegisters();
+            callOperation(operationToNumber, resultRegs, argumentRegs);
+            m_jit.exceptionCheck();
+        } else {
+            MacroAssembler::Jump notNumber;
+            {
+                GPRTemporary scratch(this);
+                notNumber = m_jit.branchIfNotNumber(argument.jsValueRegs(), scratch.gpr());
+            }
+            m_jit.move(argumentTagGPR, resultRegs.tagGPR());
+            m_jit.move(argumentPayloadGPR, resultRegs.payloadGPR());
+            MacroAssembler::Jump done = m_jit.jump();
+
+            notNumber.link(&m_jit);
+            silentSpillAllRegisters(resultRegs);
+            callOperation(operationToNumber, resultRegs, argumentRegs);
+            silentFillAllRegisters(resultRegs);
+            m_jit.exceptionCheck();
+
+            done.link(&m_jit);
+        }
+
+        jsValueResult(resultRegs.tagGPR(), resultRegs.payloadGPR(), node, UseChildrenCalledExplicitly);
+        break;
+    }
+        
+    case ToString:
+    case CallStringConstructor: {
+        if (node->child1().useKind() == UntypedUse) {
+            JSValueOperand op1(this, node->child1());
+            GPRReg op1PayloadGPR = op1.payloadGPR();
+            JSValueRegs op1Regs = op1.jsValueRegs();
+            
+            GPRFlushedCallResult result(this);
+            GPRReg resultGPR = result.gpr();
+            
+            flushRegisters();
+            
+            JITCompiler::Jump done;
+            if (node->child1()->prediction() & SpecString) {
+                JITCompiler::Jump slowPath1 = m_jit.branchIfNotCell(op1.jsValueRegs());
+                JITCompiler::Jump slowPath2 = m_jit.branchIfNotString(op1PayloadGPR);
+                m_jit.move(op1PayloadGPR, resultGPR);
+                done = m_jit.jump();
+                slowPath1.link(&m_jit);
+                slowPath2.link(&m_jit);
+            }
+            if (op == ToString)
+                callOperation(operationToString, resultGPR, op1Regs);
+            else {
+                ASSERT(op == CallStringConstructor);
+                callOperation(operationCallStringConstructor, resultGPR, op1Regs);
+            }
+            m_jit.exceptionCheck();
+            if (done.isSet())
+                done.link(&m_jit);
+            cellResult(resultGPR, node);
+            break;
+        }
+        
+        compileToStringOrCallStringConstructorOnCell(node);
+        break;
+    }
+        
+    case NewStringObject: {
+        compileNewStringObject(node);
+        break;
+    }
+        
+    case NewArray: {
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
+            RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
+            ASSERT(structure->indexingType() == node->indexingType());
+            ASSERT(
+                hasUndecided(structure->indexingType())
+                || hasInt32(structure->indexingType())
+                || hasDouble(structure->indexingType())
+                || hasContiguous(structure->indexingType()));
+
+            unsigned numElements = node->numChildren();
+            
+            GPRTemporary result(this);
+            GPRTemporary storage(this);
+            
+            GPRReg resultGPR = result.gpr();
+            GPRReg storageGPR = storage.gpr();
+
+            emitAllocateRawObject(resultGPR, structure, storageGPR, numElements, numElements);
+            
+            // At this point, one way or another, resultGPR and storageGPR have pointers to
+            // the JSArray and the Butterfly, respectively.
+            
+            ASSERT(!hasUndecided(structure->indexingType()) || !node->numChildren());
+            
+            for (unsigned operandIdx = 0; operandIdx < node->numChildren(); ++operandIdx) {
+                Edge use = m_jit.graph().m_varArgChildren[node->firstChild() + operandIdx];
+                switch (node->indexingType()) {
+                case ALL_BLANK_INDEXING_TYPES:
+                case ALL_UNDECIDED_INDEXING_TYPES:
+                    CRASH();
+                    break;
+                case ALL_DOUBLE_INDEXING_TYPES: {
+                    SpeculateDoubleOperand operand(this, use);
+                    FPRReg opFPR = operand.fpr();
+                    DFG_TYPE_CHECK(
+                        JSValueRegs(), use, SpecDoubleReal,
+                        m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));
+        
+                    m_jit.storeDouble(opFPR, MacroAssembler::Address(storageGPR, sizeof(double) * operandIdx));
+                    break;
+                }
+                case ALL_INT32_INDEXING_TYPES: {
+                    SpeculateInt32Operand operand(this, use);
+                    m_jit.store32(TrustedImm32(JSValue::Int32Tag), MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+                    m_jit.store32(operand.gpr(), MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+                    break;
+                }
+                case ALL_CONTIGUOUS_INDEXING_TYPES: {
+                    JSValueOperand operand(this, m_jit.graph().m_varArgChildren[node->firstChild() + operandIdx]);
+                    GPRReg opTagGPR = operand.tagGPR();
+                    GPRReg opPayloadGPR = operand.payloadGPR();
+                    m_jit.store32(opTagGPR, MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+                    m_jit.store32(opPayloadGPR, MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+                    break;
+                }
+                default:
+                    CRASH();
+                    break;
+                }
+            }
+            
+            // Yuck, we should *really* have a way of also returning the storageGPR. But
+            // that's the least of what's wrong with this code. We really shouldn't be
+            // allocating the array after having computed - and probably spilled to the
+            // stack - all of the things that will go into the array. The solution to that
+            // bigger problem will also likely fix the redundancy in reloading the storage
+            // pointer that we currently have.
+            
+            cellResult(resultGPR, node);
+            break;
+        }
+        
+        if (!node->numChildren()) {
+            flushRegisters();
+            GPRFlushedCallResult result(this);
+            callOperation(
+                operationNewEmptyArray, result.gpr(), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())));
+            m_jit.exceptionCheck();
+            cellResult(result.gpr(), node);
+            break;
+        }
+        
+        size_t scratchSize = sizeof(EncodedJSValue) * node->numChildren();
+        ScratchBuffer* scratchBuffer = m_jit.vm()->scratchBufferForSize(scratchSize);
+        EncodedJSValue* buffer = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;
+        
+        for (unsigned operandIdx = 0; operandIdx < node->numChildren(); ++operandIdx) {
+            // Need to perform the speculations that this node promises to perform. If we're
+            // emitting code here and the indexing type is not array storage then there is
+            // probably something hilarious going on and we're already failing at all the
+            // things, but at least we're going to be sound.
+            Edge use = m_jit.graph().m_varArgChildren[node->firstChild() + operandIdx];
+            switch (node->indexingType()) {
+            case ALL_BLANK_INDEXING_TYPES:
+            case ALL_UNDECIDED_INDEXING_TYPES:
+                CRASH();
+                break;
+            case ALL_DOUBLE_INDEXING_TYPES: {
+                SpeculateDoubleOperand operand(this, use);
+                FPRReg opFPR = operand.fpr();
+                DFG_TYPE_CHECK(
+                    JSValueRegs(), use, SpecFullRealNumber,
+                    m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));
+                
+                m_jit.storeDouble(opFPR, TrustedImmPtr(reinterpret_cast<char*>(buffer + operandIdx)));
+                break;
+            }
+            case ALL_INT32_INDEXING_TYPES: {
+                SpeculateInt32Operand operand(this, use);
+                GPRReg opGPR = operand.gpr();
+                m_jit.store32(TrustedImm32(JSValue::Int32Tag), reinterpret_cast<char*>(buffer + operandIdx) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+                m_jit.store32(opGPR, reinterpret_cast<char*>(buffer + operandIdx) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+                break;
+            }
+            case ALL_CONTIGUOUS_INDEXING_TYPES:
+            case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+                JSValueOperand operand(this, m_jit.graph().m_varArgChildren[node->firstChild() + operandIdx]);
+                GPRReg opTagGPR = operand.tagGPR();
+                GPRReg opPayloadGPR = operand.payloadGPR();
+                
+                m_jit.store32(opTagGPR, reinterpret_cast<char*>(buffer + operandIdx) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+                m_jit.store32(opPayloadGPR, reinterpret_cast<char*>(buffer + operandIdx) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+                operand.use();
+                break;
+            }
+            default:
+                CRASH();
+                break;
+            }
+        }
+        
+        switch (node->indexingType()) {
+        case ALL_DOUBLE_INDEXING_TYPES:
+        case ALL_INT32_INDEXING_TYPES:
+            useChildren(node);
+            break;
+        default:
+            break;
+        }
+        
+        flushRegisters();
+
+        if (scratchSize) {
+            GPRTemporary scratch(this);
+
+            // Tell GC mark phase how much of the scratch buffer is active during call.
+            m_jit.move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratch.gpr());
+            m_jit.storePtr(TrustedImmPtr(scratchSize), scratch.gpr());
+        }
+
+        GPRFlushedCallResult result(this);
+        
+        callOperation(
+            operationNewArray, result.gpr(), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())),
+            static_cast<void*>(buffer), node->numChildren());
+        m_jit.exceptionCheck();
+
+        if (scratchSize) {
+            GPRTemporary scratch(this);
+
+            m_jit.move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratch.gpr());
+            m_jit.storePtr(TrustedImmPtr(0), scratch.gpr());
+        }
+
+        cellResult(result.gpr(), node, UseChildrenCalledExplicitly);
+        break;
+    }
+
+    case NewArrayWithSpread: {
+        compileNewArrayWithSpread(node);
+        break;
+    }
+
+    case Spread: {
+        compileSpread(node);
+        break;
+    }
+
+    case NewArrayWithSize: {
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
+            SpeculateStrictInt32Operand size(this, node->child1());
+            GPRTemporary result(this);
+
+            GPRReg sizeGPR = size.gpr();
+            GPRReg resultGPR = result.gpr();
+
+            compileAllocateNewArrayWithSize(globalObject, resultGPR, sizeGPR, node->indexingType());
+            cellResult(resultGPR, node);
+            break;
+        }
+        
+        SpeculateStrictInt32Operand size(this, node->child1());
+        GPRReg sizeGPR = size.gpr();
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+        GPRReg structureGPR = selectScratchGPR(sizeGPR);
+        MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
+        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()))), structureGPR);
+        MacroAssembler::Jump done = m_jit.jump();
+        bigLength.link(&m_jit);
+        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))), structureGPR);
+        done.link(&m_jit);
+        callOperation(operationNewArrayWithSize, resultGPR, structureGPR, sizeGPR, nullptr);
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case NewArrayBuffer: {
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        IndexingType indexingType = node->indexingType();
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(indexingType)) {
+            unsigned numElements = node->numConstants();
+            
+            GPRTemporary result(this);
+            GPRTemporary storage(this);
+            
+            GPRReg resultGPR = result.gpr();
+            GPRReg storageGPR = storage.gpr();
+
+            emitAllocateRawObject(resultGPR, m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), storageGPR, numElements, numElements);
+            
+            if (node->indexingType() == ArrayWithDouble) {
+                JSValue* data = m_jit.codeBlock()->constantBuffer(node->startConstant());
+                for (unsigned index = 0; index < node->numConstants(); ++index) {
+                    union {
+                        int32_t halves[2];
+                        double value;
+                    } u;
+                    u.value = data[index].asNumber();
+                    m_jit.store32(Imm32(u.halves[0]), MacroAssembler::Address(storageGPR, sizeof(double) * index));
+                    m_jit.store32(Imm32(u.halves[1]), MacroAssembler::Address(storageGPR, sizeof(double) * index + sizeof(int32_t)));
+                }
+            } else {
+                int32_t* data = bitwise_cast<int32_t*>(m_jit.codeBlock()->constantBuffer(node->startConstant()));
+                for (unsigned index = 0; index < node->numConstants() * 2; ++index) {
+                    m_jit.store32(
+                        Imm32(data[index]), MacroAssembler::Address(storageGPR, sizeof(int32_t) * index));
+                }
+            }
+            
+            cellResult(resultGPR, node);
+            break;
+        }
+        
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        
+        callOperation(operationNewArrayBuffer, result.gpr(), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())), node->startConstant(), node->numConstants());
+        m_jit.exceptionCheck();
+        
+        cellResult(result.gpr(), node);
+        break;
+    }
+        
+    case NewTypedArray: {
+        switch (node->child1().useKind()) {
+        case Int32Use:
+            compileNewTypedArray(node);
+            break;
+        case UntypedUse: {
+            JSValueOperand argument(this, node->child1());
+            JSValueRegs argumentRegs = argument.jsValueRegs();
+            
+            flushRegisters();
+            
+            GPRFlushedCallResult result(this);
+            GPRReg resultGPR = result.gpr();
+            
+            JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+            callOperation(
+                operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
+                resultGPR, m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())), argumentRegs);
+            m_jit.exceptionCheck();
+            
+            cellResult(resultGPR, node);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+        
+    case NewRegexp: {
+        flushRegisters();
+        GPRFlushedCallResult resultPayload(this);
+        GPRFlushedCallResult2 resultTag(this);
+        
+        RegExp* regexp = node->castOperand<RegExp*>();
+        callOperation(operationNewRegexp, JSValueRegs(resultTag.gpr(), resultPayload.gpr()), regexp);
+        m_jit.exceptionCheck();
+        
+        // FIXME: make the callOperation above explicitly return a cell result, or jitAssert the tag is a cell tag.
+        cellResult(resultPayload.gpr(), node);
+        break;
+    }
+
+    case CallObjectConstructor: {
+        compileCallObjectConstructor(node);
+        break;
+    }
+        
+    case ToThis: {
+        ASSERT(node->child1().useKind() == UntypedUse);
+        JSValueOperand thisValue(this, node->child1());
+        GPRTemporary temp(this);
+        GPRTemporary tempTag(this);
+        GPRReg thisValuePayloadGPR = thisValue.payloadGPR();
+        GPRReg thisValueTagGPR = thisValue.tagGPR();
+        GPRReg tempGPR = temp.gpr();
+        GPRReg tempTagGPR = tempTag.gpr();
+        
+        MacroAssembler::JumpList slowCases;
+        slowCases.append(m_jit.branchIfNotCell(thisValue.jsValueRegs()));
+        slowCases.append(
+            m_jit.branchTest8(                             
+                MacroAssembler::NonZero,
+                MacroAssembler::Address(thisValuePayloadGPR, JSCell::typeInfoFlagsOffset()),
+                MacroAssembler::TrustedImm32(OverridesToThis)));
+        m_jit.move(thisValuePayloadGPR, tempGPR);
+        m_jit.move(thisValueTagGPR, tempTagGPR);
+        J_JITOperation_EJ function;
+        if (m_jit.graph().executableFor(node->origin.semantic)->isStrictMode())
+            function = operationToThisStrict;
+        else
+            function = operationToThis;
+        addSlowPathGenerator(
+            slowPathCall(
+                slowCases, this, function,
+                JSValueRegs(tempTagGPR, tempGPR), JSValueRegs(thisValueTagGPR, thisValuePayloadGPR)));
+
+        jsValueResult(tempTagGPR, tempGPR, node);
+        break;
+    }
+
+    case CreateThis: {
+        // Note that there is not so much profit to speculate here. The only things we
+        // speculate on are (1) that it's a cell, since that eliminates cell checks
+        // later if the proto is reused, and (2) if we have a FinalObject prediction
+        // then we speculate because we want to get recompiled if it isn't (since
+        // otherwise we'd start taking slow path a lot).
+        
+        SpeculateCellOperand callee(this, node->child1());
+        GPRTemporary result(this);
+        GPRTemporary allocator(this);
+        GPRTemporary structure(this);
+        GPRTemporary scratch(this);
+        
+        GPRReg calleeGPR = callee.gpr();
+        GPRReg resultGPR = result.gpr();
+        GPRReg allocatorGPR = allocator.gpr();
+        GPRReg structureGPR = structure.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+        // Rare data is only used to access the allocator & structure
+        // We can avoid using an additional GPR this way
+        GPRReg rareDataGPR = structureGPR;
+        GPRReg inlineCapacityGPR = rareDataGPR;
+        
+        MacroAssembler::JumpList slowPath;
+
+        slowPath.append(m_jit.branch8(JITCompiler::NotEqual,
+            JITCompiler::Address(calleeGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(JSFunctionType)));
+        m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
+        slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR));
+        m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorGPR);
+        m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureGPR);
+        slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, allocatorGPR));
+        emitAllocateJSObject(resultGPR, nullptr, allocatorGPR, structureGPR, TrustedImmPtr(0), scratchGPR, slowPath);
+
+        m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
+        m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfInlineCapacity()), inlineCapacityGPR);
+        m_jit.emitInitializeInlineStorage(resultGPR, inlineCapacityGPR);
+
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, calleeGPR, node->inlineCapacity()));
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+
+    case NewObject: {
+        GPRTemporary result(this);
+        GPRTemporary allocator(this);
+        GPRTemporary scratch(this);
+        
+        GPRReg resultGPR = result.gpr();
+        GPRReg allocatorGPR = allocator.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+        
+        MacroAssembler::JumpList slowPath;
+        
+        RegisteredStructure structure = node->structure();
+        size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
+        MarkedAllocator* allocatorPtr = subspaceFor<JSFinalObject>(*m_jit.vm())->allocatorFor(allocationSize);
+
+        m_jit.move(TrustedImmPtr(allocatorPtr), allocatorGPR);
+        emitAllocateJSObject(resultGPR, allocatorPtr, allocatorGPR, TrustedImmPtr(structure), TrustedImmPtr(0), scratchGPR, slowPath);
+        m_jit.emitInitializeInlineStorage(resultGPR, structure->inlineCapacity());
+
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewObject, resultGPR, structure));
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+
+    case GetCallee: {
+        GPRTemporary result(this);
+        m_jit.loadPtr(JITCompiler::payloadFor(CallFrameSlot::callee), result.gpr());
+        cellResult(result.gpr(), node);
+        break;
+    }
+        
+    case GetArgumentCountIncludingThis: {
+        GPRTemporary result(this);
+        m_jit.load32(JITCompiler::payloadFor(CallFrameSlot::argumentCount), result.gpr());
+        int32Result(result.gpr(), node);
+        break;
+    }
+        
+    case GetScope:
+        compileGetScope(node);
+        break;
+            
+    case SkipScope:
+        compileSkipScope(node);
+        break;
+        
+    case GetGlobalObject:
+        compileGetGlobalObject(node);
+        break;
+        
+    case GetClosureVar: {
+        SpeculateCellOperand base(this, node->child1());
+        GPRTemporary resultTag(this);
+        GPRTemporary resultPayload(this);
+        GPRReg baseGPR = base.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        m_jit.load32(JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset()) + TagOffset), resultTagGPR);
+        m_jit.load32(JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset()) + PayloadOffset), resultPayloadGPR);
+        jsValueResult(resultTagGPR, resultPayloadGPR, node);
+        break;
+    }
+    
+    case PutClosureVar: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand value(this, node->child2());
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueTagGPR = value.tagGPR();
+        GPRReg valuePayloadGPR = value.payloadGPR();
+
+        m_jit.store32(valueTagGPR, JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset()) + TagOffset));
+        m_jit.store32(valuePayloadGPR, JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset()) + PayloadOffset));
+        noResult(node);
+        break;
+    }
+
+    case TryGetById: {
+        compileTryGetById(node);
+        break;
+    }
+
+    case GetById: {
+        // FIXME https://bugs.webkit.org/show_bug.cgi?id=161158
+        // dedup with SpeculativeJIT::compileTryGetById and 64-bit version of this.
+        switch (node->child1().useKind()) {
+        case CellUse: {
+            SpeculateCellOperand base(this, node->child1());
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this, Reuse, base);
+            
+            GPRReg baseGPR = base.gpr();
+            GPRReg resultTagGPR = resultTag.gpr();
+            GPRReg resultPayloadGPR = resultPayload.gpr();
+
+            base.use();
+            
+            cachedGetById(node->origin.semantic, InvalidGPRReg, baseGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber());
+            
+            jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+        
+        case UntypedUse: {
+            JSValueOperand base(this, node->child1());
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this, Reuse, base, TagWord);
+        
+            GPRReg baseTagGPR = base.tagGPR();
+            GPRReg basePayloadGPR = base.payloadGPR();
+            GPRReg resultTagGPR = resultTag.gpr();
+            GPRReg resultPayloadGPR = resultPayload.gpr();
+        
+            base.use();
+        
+            JITCompiler::Jump notCell = m_jit.branchIfNotCell(base.jsValueRegs());
+        
+            cachedGetById(node->origin.semantic, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell);
+        
+            jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+
+    case GetByIdWithThis: {
+        JSValueOperand base(this, node->child1());
+        JSValueRegs baseRegs = base.jsValueRegs();
+        JSValueOperand thisValue(this, node->child2());
+        JSValueRegs thisRegs = thisValue.jsValueRegs();
+
+        GPRFlushedCallResult resultPayload(this);
+        GPRFlushedCallResult2 resultTag(this);
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+
+        flushRegisters();
+        callOperation(operationGetByIdWithThis, JSValueRegs(resultTagGPR, resultPayloadGPR), baseRegs, thisRegs, identifierUID(node->identifierNumber()));
+        m_jit.exceptionCheck();
+
+        jsValueResult(resultTagGPR, resultPayloadGPR, node);
+        break;
+    }
+
+    case GetByIdFlush: {
+        if (!node->prediction()) {
+            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+            break;
+        }
+        
+        switch (node->child1().useKind()) {
+        case CellUse: {
+            SpeculateCellOperand base(this, node->child1());
+            
+            GPRReg baseGPR = base.gpr();
+
+            GPRFlushedCallResult resultPayload(this);
+            GPRFlushedCallResult2 resultTag(this);
+            GPRReg resultPayloadGPR = resultPayload.gpr();
+            GPRReg resultTagGPR = resultTag.gpr();
+
+            base.use();
+            
+            flushRegisters();
+            
+            cachedGetById(node->origin.semantic, InvalidGPRReg, baseGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), JITCompiler::Jump(), DontSpill);
+            
+            jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+        
+        case UntypedUse: {
+            JSValueOperand base(this, node->child1());
+            GPRReg baseTagGPR = base.tagGPR();
+            GPRReg basePayloadGPR = base.payloadGPR();
+
+            GPRFlushedCallResult resultPayload(this);
+            GPRFlushedCallResult2 resultTag(this);
+            GPRReg resultPayloadGPR = resultPayload.gpr();
+            GPRReg resultTagGPR = resultTag.gpr();
+
+            base.use();
+        
+            flushRegisters();
+        
+            JITCompiler::Jump notCell = m_jit.branchIfNotCell(base.jsValueRegs());
+        
+            cachedGetById(node->origin.semantic, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell, DontSpill);
+        
+            jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+    }
+
+    case GetArrayLength:
+        compileGetArrayLength(node);
+        break;
+
+    case DeleteById: {
+        compileDeleteById(node);
+        break;
+    }
+
+    case DeleteByVal: {
+        compileDeleteByVal(node);
+        break;
+    }
+        
+    case CheckCell: {
+        SpeculateCellOperand cell(this, node->child1());
+        speculationCheck(BadCell, JSValueSource::unboxedCell(cell.gpr()), node->child1(), m_jit.branchWeakPtr(JITCompiler::NotEqual, cell.gpr(), node->cellOperand()->cell()));
+        noResult(node);
+        break;
+    }
+
+    case CheckNotEmpty: {
+        JSValueOperand operand(this, node->child1());
+        GPRReg tagGPR = operand.tagGPR();
+        speculationCheck(TDZFailure, JSValueSource(), nullptr, m_jit.branch32(JITCompiler::Equal, tagGPR, TrustedImm32(JSValue::EmptyValueTag)));
+        noResult(node);
+        break;
+    }
+
+    case CheckStringIdent:
+        compileCheckStringIdent(node);
+        break;
+
+    case GetExecutable: {
+        SpeculateCellOperand function(this, node->child1());
+        GPRTemporary result(this, Reuse, function);
+        GPRReg functionGPR = function.gpr();
+        GPRReg resultGPR = result.gpr();
+        speculateCellType(node->child1(), functionGPR, SpecFunction, JSFunctionType);
+        m_jit.loadPtr(JITCompiler::Address(functionGPR, JSFunction::offsetOfExecutable()), resultGPR);
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case CheckStructure: {
+        compileCheckStructure(node);
+        break;
+    }
+        
+    case PutStructure: {
+        RegisteredStructure oldStructure = node->transition()->previous;
+        RegisteredStructure newStructure = node->transition()->next;
+
+        m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
+
+        SpeculateCellOperand base(this, node->child1());
+        GPRReg baseGPR = base.gpr();
+        
+        ASSERT_UNUSED(oldStructure, oldStructure->indexingType() == newStructure->indexingType());
+        ASSERT(oldStructure->typeInfo().type() == newStructure->typeInfo().type());
+        ASSERT(oldStructure->typeInfo().inlineTypeFlags() == newStructure->typeInfo().inlineTypeFlags());
+        m_jit.storePtr(TrustedImmPtr(newStructure), MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()));
+        
+        noResult(node);
+        break;
+    }
+        
+    case AllocatePropertyStorage:
+        compileAllocatePropertyStorage(node);
+        break;
+        
+    case ReallocatePropertyStorage:
+        compileReallocatePropertyStorage(node);
+        break;
+        
+    case NukeStructureAndSetButterfly:
+        compileNukeStructureAndSetButterfly(node);
+        break;
+        
+    case GetButterfly:
+        compileGetButterfly(node);
+        break;
+
+    case GetIndexedPropertyStorage: {
+        compileGetIndexedPropertyStorage(node);
+        break;
+    }
+
+    case ConstantStoragePointer: {
+        compileConstantStoragePointer(node);
+        break;
+    }
+        
+    case GetTypedArrayByteOffset: {
+        compileGetTypedArrayByteOffset(node);
+        break;
+    }
+        
+    case GetByOffset: {
+        StorageOperand storage(this, node->child1());
+        GPRTemporary resultTag(this, Reuse, storage);
+        GPRTemporary resultPayload(this);
+        
+        GPRReg storageGPR = storage.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        
+        StorageAccessData& storageAccessData = node->storageAccessData();
+        
+        m_jit.load32(JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
+        m_jit.load32(JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
+        
+        jsValueResult(resultTagGPR, resultPayloadGPR, node);
+        break;
+    }
+        
+    case GetGetterSetterByOffset: {
+        StorageOperand storage(this, node->child1());
+        GPRTemporary resultPayload(this);
+        
+        GPRReg storageGPR = storage.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        
+        StorageAccessData& storageAccessData = node->storageAccessData();
+        
+        m_jit.load32(JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
+        
+        cellResult(resultPayloadGPR, node);
+        break;
+    }
+        
+    case GetGetter: {
+        SpeculateCellOperand op1(this, node->child1());
+        GPRTemporary result(this, Reuse, op1);
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfGetter()), resultGPR);
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case GetSetter: {
+        SpeculateCellOperand op1(this, node->child1());
+        GPRTemporary result(this, Reuse, op1);
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfSetter()), resultGPR);
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case PutByOffset: {
+        StorageOperand storage(this, node->child1());
+        JSValueOperand value(this, node->child3());
+
+        GPRReg storageGPR = storage.gpr();
+        GPRReg valueTagGPR = value.tagGPR();
+        GPRReg valuePayloadGPR = value.payloadGPR();
+
+        speculate(node, node->child2());
+
+        StorageAccessData& storageAccessData = node->storageAccessData();
+        
+        m_jit.storePtr(valueTagGPR, JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+        m_jit.storePtr(valuePayloadGPR, JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        
+        noResult(node);
+        break;
+    }
+
+    case PutByIdFlush: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand value(this, node->child2());
+        GPRTemporary scratch(this);
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueTagGPR = value.tagGPR();
+        GPRReg valuePayloadGPR = value.payloadGPR();
+        GPRReg scratchGPR = scratch.gpr();
+        flushRegisters();
+
+        cachedPutById(node->origin.semantic, baseGPR, valueTagGPR, valuePayloadGPR, scratchGPR, node->identifierNumber(), NotDirect, MacroAssembler::Jump(), DontSpill);
+
+        noResult(node);
+        break;
+    }
+        
+    case PutById: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand value(this, node->child2());
+        GPRTemporary scratch(this);
+        
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueTagGPR = value.tagGPR();
+        GPRReg valuePayloadGPR = value.payloadGPR();
+        GPRReg scratchGPR = scratch.gpr();
+        
+        cachedPutById(node->origin.semantic, baseGPR, valueTagGPR, valuePayloadGPR, scratchGPR, node->identifierNumber(), NotDirect);
+        
+        noResult(node);
+        break;
+    }
+
+    case PutByIdDirect: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand value(this, node->child2());
+        GPRTemporary scratch(this);
+        
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueTagGPR = value.tagGPR();
+        GPRReg valuePayloadGPR = value.payloadGPR();
+        GPRReg scratchGPR = scratch.gpr();
+        
+        cachedPutById(node->origin.semantic, baseGPR, valueTagGPR, valuePayloadGPR, scratchGPR, node->identifierNumber(), Direct);
+
+        noResult(node);
+        break;
+    }
+
+    case PutByIdWithThis: {
+        JSValueOperand base(this, node->child1());
+        JSValueRegs baseRegs = base.jsValueRegs();
+        JSValueOperand thisValue(this, node->child2());
+        JSValueRegs thisRegs = thisValue.jsValueRegs();
+        JSValueOperand value(this, node->child3());
+        JSValueRegs valueRegs = value.jsValueRegs();
+
+        flushRegisters();
+        callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByIdWithThisStrict : operationPutByIdWithThis,
+            NoResult, baseRegs, thisRegs, valueRegs, identifierUID(node->identifierNumber()));
+        m_jit.exceptionCheck();
+
+        noResult(node);
+        break;
+    }
+
+    case PutGetterById:
+    case PutSetterById: {
+        compilePutAccessorById(node);
+        break;
+    }
+
+    case PutGetterSetterById: {
+        compilePutGetterSetterById(node);
+        break;
+    }
+
+    case PutGetterByVal:
+    case PutSetterByVal: {
+        compilePutAccessorByVal(node);
+        break;
+    }
+
+    case DefineDataProperty: {
+        compileDefineDataProperty(node);
+        break;
+    }
+
+    case DefineAccessorProperty: {
+        compileDefineAccessorProperty(node);
+        break;
+    }
+
+    case GetGlobalLexicalVariable:
+    case GetGlobalVar: {
+        GPRTemporary resultPayload(this);
+        GPRTemporary resultTag(this);
+
+        m_jit.move(TrustedImmPtr(node->variablePointer()), resultPayload.gpr());
+        m_jit.load32(JITCompiler::Address(resultPayload.gpr(), OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTag.gpr());
+        m_jit.load32(JITCompiler::Address(resultPayload.gpr(), OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayload.gpr());
+
+        jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);
+        break;
+    }
+
+    case PutGlobalVariable: {
+        JSValueOperand value(this, node->child2());
+
+        // FIXME: if we happen to have a spare register - and _ONLY_ if we happen to have
+        // a spare register - a good optimization would be to put the register pointer into
+        // a register and then do a zero offset store followed by a four-offset store (or
+        // vice-versa depending on endianness).
+        m_jit.store32(value.tagGPR(), node->variablePointer()->tagPointer());
+        m_jit.store32(value.payloadGPR(), node->variablePointer()->payloadPointer());
+
+        noResult(node);
+        break;
+    }
+
+    case NotifyWrite: {
+        compileNotifyWrite(node);
+        break;
+    }
+
+    case CheckTypeInfoFlags: {
+        compileCheckTypeInfoFlags(node);
+        break;
+    }
+
+    case OverridesHasInstance: {
+
+        Node* hasInstanceValueNode = node->child2().node();
+        JSFunction* defaultHasInstanceFunction = jsCast<JSFunction*>(node->cellOperand()->value());
+
+        MacroAssembler::JumpList notDefaultHasInstanceValue;
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand hasInstanceValue(this, node->child2());
+        GPRTemporary result(this);
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        // It would be great if constant folding handled automatically the case where we knew the hasInstance function
+        // was a constant. Unfortunately, the folding rule for OverridesHasInstance is in the strength reduction phase
+        // since it relies on OSR information. https://bugs.webkit.org/show_bug.cgi?id=154832
+        if (!hasInstanceValueNode->isCellConstant() || defaultHasInstanceFunction != hasInstanceValueNode->asCell()) {
+            JSValueRegs hasInstanceValueRegs = hasInstanceValue.jsValueRegs();
+            notDefaultHasInstanceValue.append(m_jit.branchIfNotCell(hasInstanceValueRegs));
+            notDefaultHasInstanceValue.append(m_jit.branchPtr(MacroAssembler::NotEqual, hasInstanceValueRegs.payloadGPR(), TrustedImmPtr(node->cellOperand())));
+        }
+
+        // Check that constructor 'ImplementsDefaultHasInstance'.
+        m_jit.test8(MacroAssembler::Zero, MacroAssembler::Address(baseGPR, JSCell::typeInfoFlagsOffset()), MacroAssembler::TrustedImm32(ImplementsDefaultHasInstance), resultGPR);
+        MacroAssembler::Jump done = m_jit.jump();
+
+        if (!notDefaultHasInstanceValue.empty()) {
+            notDefaultHasInstanceValue.link(&m_jit);
+            moveTrueTo(resultGPR);
+        }
+
+        done.link(&m_jit);
+        booleanResult(resultGPR, node);
+        break;
+    }
+
+    case InstanceOf: {
+        compileInstanceOf(node);
+        break;
+    }
+
+    case InstanceOfCustom: {
+        compileInstanceOfCustom(node);
+        break;
+    }
+
+    case IsEmpty: {        
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value, TagWord);
+        m_jit.comparePtr(JITCompiler::Equal, value.tagGPR(), TrustedImm32(JSValue::EmptyValueTag), result.gpr());
+        booleanResult(result.gpr(), node);
+        break;
+    }
+
+    case IsUndefined: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this);
+        GPRTemporary localGlobalObject(this);
+        GPRTemporary remoteGlobalObject(this);
+
+        JITCompiler::Jump isCell = m_jit.branchIfCell(value.jsValueRegs());
+        
+        m_jit.compare32(JITCompiler::Equal, value.tagGPR(), TrustedImm32(JSValue::UndefinedTag), result.gpr());
+        JITCompiler::Jump done = m_jit.jump();
+        
+        isCell.link(&m_jit);
+        JITCompiler::Jump notMasqueradesAsUndefined;
+        if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+            m_jit.move(TrustedImm32(0), result.gpr());
+            notMasqueradesAsUndefined = m_jit.jump();
+        } else {
+            JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(
+                JITCompiler::NonZero, 
+                JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), 
+                TrustedImm32(MasqueradesAsUndefined));
+            m_jit.move(TrustedImm32(0), result.gpr());
+            notMasqueradesAsUndefined = m_jit.jump();
+            
+            isMasqueradesAsUndefined.link(&m_jit);
+            GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
+            GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
+            m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.globalObjectFor(node->origin.semantic)), localGlobalObjectGPR);
+            m_jit.loadPtr(JITCompiler::Address(value.payloadGPR(), JSCell::structureIDOffset()), result.gpr());
+            m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), remoteGlobalObjectGPR); 
+            m_jit.compare32(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, result.gpr());
+        }
+
+        notMasqueradesAsUndefined.link(&m_jit);
+        done.link(&m_jit);
+        booleanResult(result.gpr(), node);
+        break;
+    }
+
+    case IsBoolean: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value, TagWord);
+        
+        m_jit.compare32(JITCompiler::Equal, value.tagGPR(), JITCompiler::TrustedImm32(JSValue::BooleanTag), result.gpr());
+        booleanResult(result.gpr(), node);
+        break;
+    }
+
+    case IsNumber: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value, TagWord);
+        
+        m_jit.add32(TrustedImm32(1), value.tagGPR(), result.gpr());
+        m_jit.compare32(JITCompiler::Below, result.gpr(), JITCompiler::TrustedImm32(JSValue::LowestTag + 1), result.gpr());
+        booleanResult(result.gpr(), node);
+        break;
+    }
+
+    case IsObject: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value, TagWord);
+
+        JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
+
+        m_jit.compare8(JITCompiler::AboveOrEqual,
+            JITCompiler::Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()),
+            TrustedImm32(ObjectType),
+            result.gpr());
+        JITCompiler::Jump done = m_jit.jump();
+
+        isNotCell.link(&m_jit);
+        m_jit.move(TrustedImm32(0), result.gpr());
+
+        done.link(&m_jit);
+        booleanResult(result.gpr(), node);
+        break;
+    }
+
+    case IsObjectOrNull: {
+        compileIsObjectOrNull(node);
+        break;
+    }
+
+    case IsFunction: {
+        compileIsFunction(node);
+        break;
+    }
+
+    case IsCellWithType: {
+        compileIsCellWithType(node);
+        break;
+    }
+
+    case IsTypedArrayView: {
+        compileIsTypedArrayView(node);
+        break;
+    }
+
+    case TypeOf: {
+        compileTypeOf(node);
+        break;
+    }
+
+    case MapHash: {
+        JSValueOperand input(this, node->child1());
+
+        JSValueRegs inputRegs = input.jsValueRegs();
+
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        flushRegisters();
+        callOperation(operationMapHash, resultGPR, inputRegs);
+        m_jit.exceptionCheck();
+        int32Result(resultGPR, node);
+        break;
+    }
+
+    case GetMapBucket: {
+        SpeculateCellOperand map(this, node->child1());
+        JSValueOperand key(this, node->child2());
+        SpeculateInt32Operand hash(this, node->child3());
+        GPRFlushedCallResult result(this);
+
+        GPRReg mapGPR = map.gpr();
+        JSValueRegs keyRegs = key.jsValueRegs();
+        GPRReg hashGPR = hash.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        if (node->child1().useKind() == MapObjectUse)
+            speculateMapObject(node->child1(), mapGPR);
+        else if (node->child1().useKind() == SetObjectUse)
+            speculateSetObject(node->child1(), mapGPR);
+        else
+            RELEASE_ASSERT_NOT_REACHED();
+
+        flushRegisters();
+        if (node->child1().useKind() == MapObjectUse)
+            callOperation(operationJSMapFindBucket, resultGPR, mapGPR, keyRegs, hashGPR);
+        else
+            callOperation(operationJSSetFindBucket, resultGPR, mapGPR, keyRegs, hashGPR);
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        break;
+    }
+
+    case LoadFromJSMapBucket: {
+        SpeculateCellOperand bucket(this, node->child1());
+        GPRTemporary resultPayload(this);
+        GPRTemporary resultTag(this);
+
+        GPRReg bucketGPR = bucket.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+
+        auto notBucket = m_jit.branchTestPtr(MacroAssembler::Zero, bucketGPR);
+        m_jit.loadValue(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()), JSValueRegs(resultTagGPR, resultPayloadGPR));
+        auto done = m_jit.jump();
+
+        notBucket.link(&m_jit);
+        m_jit.move(TrustedImm32(JSValue::UndefinedTag), resultTagGPR);
+        m_jit.move(TrustedImm32(0), resultPayloadGPR);
+        done.link(&m_jit);
+        jsValueResult(resultTagGPR, resultPayloadGPR, node);
+        break;
+    }
+
+    case IsNonEmptyMapBucket: {
+        SpeculateCellOperand bucket(this, node->child1());
+        GPRTemporary result(this);
+
+        GPRReg bucketGPR = bucket.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        m_jit.comparePtr(MacroAssembler::NotEqual, bucketGPR, TrustedImm32(0), resultGPR);
+        booleanResult(resultGPR, node);
+        break;
+    }
+
+    case Flush:
+        break;
+
+    case Call:
+    case TailCall:
+    case TailCallInlinedCaller:
+    case Construct:
+    case CallVarargs:
+    case TailCallVarargs:
+    case TailCallVarargsInlinedCaller:
+    case ConstructVarargs:
+    case CallForwardVarargs:
+    case TailCallForwardVarargs:
+    case TailCallForwardVarargsInlinedCaller:
+    case ConstructForwardVarargs:
+    case CallEval:
+    case DirectCall:
+    case DirectConstruct:
+    case DirectTailCall:
+    case DirectTailCallInlinedCaller:
+        emitCall(node);
+        break;
+
+    case LoadVarargs: {
+        LoadVarargsData* data = node->loadVarargsData();
+        
+        GPRReg argumentsTagGPR;
+        GPRReg argumentsPayloadGPR;
+        JSValueRegs argumentsRegs;
+        {
+            JSValueOperand arguments(this, node->child1());
+            argumentsRegs = arguments.jsValueRegs();
+            flushRegisters();
+        }
+        
+        callOperation(operationSizeOfVarargs, GPRInfo::returnValueGPR, argumentsRegs, data->offset);
+        m_jit.exceptionCheck();
+        
+        lock(GPRInfo::returnValueGPR);
+        {
+            JSValueOperand arguments(this, node->child1());
+            argumentsTagGPR = arguments.tagGPR();
+            argumentsPayloadGPR = arguments.payloadGPR();
+            argumentsRegs = arguments.jsValueRegs();
+            flushRegisters();
+        }
+        unlock(GPRInfo::returnValueGPR);
+        
+        // FIXME: There is a chance that we will call an effectful length property twice. This is safe
+        // from the standpoint of the VM's integrity, but it's subtly wrong from a spec compliance
+        // standpoint. The best solution would be one where we can exit *into* the op_call_varargs right
+        // past the sizing.
+        // https://bugs.webkit.org/show_bug.cgi?id=141448
+
+        GPRReg argCountIncludingThisGPR =
+            JITCompiler::selectScratchGPR(GPRInfo::returnValueGPR, argumentsTagGPR, argumentsPayloadGPR);
+        
+        m_jit.add32(TrustedImm32(1), GPRInfo::returnValueGPR, argCountIncludingThisGPR);
+        speculationCheck(
+            VarargsOverflow, JSValueSource(), Edge(), m_jit.branch32(
+                MacroAssembler::Above,
+                argCountIncludingThisGPR,
+                TrustedImm32(data->limit)));
+        
+        m_jit.store32(argCountIncludingThisGPR, JITCompiler::payloadFor(data->machineCount));
+        
+        callOperation(operationLoadVarargs, data->machineStart.offset(), argumentsRegs, data->offset, GPRInfo::returnValueGPR, data->mandatoryMinimum);
+        m_jit.exceptionCheck();
+        
+        noResult(node);
+        break;
+    }
+        
+    case ForwardVarargs: {
+        compileForwardVarargs(node);
+        break;
+    }
+        
+    case CreateActivation: {
+        compileCreateActivation(node);
+        break;
+    }
+        
+    case CreateDirectArguments: {
+        compileCreateDirectArguments(node);
+        break;
+    }
+        
+    case GetFromArguments: {
+        compileGetFromArguments(node);
+        break;
+    }
+        
+    case PutToArguments: {
+        compilePutToArguments(node);
+        break;
+    }
+
+    case GetArgument: {
+        compileGetArgument(node);
+        break;
+    }
+        
+    case CreateScopedArguments: {
+        compileCreateScopedArguments(node);
+        break;
+    }
+        
+    case CreateClonedArguments: {
+        compileCreateClonedArguments(node);
+        break;
+    }
+
+    case CreateRest: {
+        compileCreateRest(node);
+        break;
+    }
+
+    case GetRestLength: {
+        compileGetRestLength(node);
+        break;
+    }
+
+    case NewFunction:
+    case NewGeneratorFunction:
+    case NewAsyncFunction:
+        compileNewFunction(node);
+        break;
+
+    case SetFunctionName:
+        compileSetFunctionName(node);
+        break;
+
+    case In:
+        compileIn(node);
+        break;
+
+    case HasOwnProperty: {
+#if CPU(X86)
+        ASSERT(node->child2().useKind() == UntypedUse);
+        SpeculateCellOperand object(this, node->child1());
+        JSValueOperand key(this, node->child2());
+        GPRTemporary result(this, Reuse, object);
+
+        JSValueRegs keyRegs = key.jsValueRegs();
+        GPRReg objectGPR = object.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        speculateObject(node->child1());
+
+        flushRegisters();
+        callOperation(operationHasOwnProperty, resultGPR, objectGPR, keyRegs);
+        booleanResult(resultGPR, node);
+#else
+        SpeculateCellOperand object(this, node->child1());
+        GPRTemporary uniquedStringImpl(this);
+        GPRTemporary temp(this);
+        GPRTemporary hash(this);
+        GPRTemporary structureID(this);
+        GPRTemporary result(this);
+
+        std::optional<SpeculateCellOperand> keyAsCell;
+        std::optional<JSValueOperand> keyAsValue;
+        JSValueRegs keyRegs;
+        if (node->child2().useKind() == UntypedUse) {
+            keyAsValue.emplace(this, node->child2());
+            keyRegs = keyAsValue->jsValueRegs();
+        } else {
+            ASSERT(node->child2().useKind() == StringUse || node->child2().useKind() == SymbolUse);
+            keyAsCell.emplace(this, node->child2());
+            keyRegs = JSValueRegs::payloadOnly(keyAsCell->gpr());
+        }
+
+        GPRReg objectGPR = object.gpr();
+        GPRReg implGPR = uniquedStringImpl.gpr();
+        GPRReg tempGPR = temp.gpr();
+        GPRReg hashGPR = hash.gpr();
+        GPRReg structureIDGPR = structureID.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        speculateObject(node->child1());
+
+        MacroAssembler::JumpList slowPath;
+        switch (node->child2().useKind()) {
+        case SymbolUse: {
+            speculateSymbol(node->child2(), keyRegs.payloadGPR());
+            m_jit.loadPtr(MacroAssembler::Address(keyRegs.payloadGPR(), Symbol::offsetOfSymbolImpl()), implGPR);
+            break;
+        }
+        case StringUse: {
+            speculateString(node->child2(), keyRegs.payloadGPR());
+            m_jit.loadPtr(MacroAssembler::Address(keyRegs.payloadGPR(), JSString::offsetOfValue()), implGPR);
+            slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, implGPR));
+            slowPath.append(m_jit.branchTest32(
+                MacroAssembler::Zero, MacroAssembler::Address(implGPR, StringImpl::flagsOffset()),
+                MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic())));
+            break;
+        }
+        case UntypedUse: {
+            slowPath.append(m_jit.branchIfNotCell(keyRegs));
+            auto isNotString = m_jit.branchIfNotString(keyRegs.payloadGPR());
+            m_jit.loadPtr(MacroAssembler::Address(keyRegs.payloadGPR(), JSString::offsetOfValue()), implGPR);
+            slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, implGPR));
+            slowPath.append(m_jit.branchTest32(
+                MacroAssembler::Zero, MacroAssembler::Address(implGPR, StringImpl::flagsOffset()),
+                MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic())));
+            auto hasUniquedImpl = m_jit.jump();
+
+            isNotString.link(&m_jit);
+            slowPath.append(m_jit.branchIfNotSymbol(keyRegs.payloadGPR()));
+            m_jit.loadPtr(MacroAssembler::Address(keyRegs.payloadGPR(), Symbol::offsetOfSymbolImpl()), implGPR);
+
+            hasUniquedImpl.link(&m_jit);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        // Note that we don't test if the hash is zero here. AtomicStringImpl's can't have a zero
+        // hash, however, a SymbolImpl may. But, because this is a cache, we don't care. We only
+        // ever load the result from the cache if the cache entry matches what we are querying for.
+        // So we either get super lucky and use zero for the hash and somehow collide with the entity
+        // we're looking for, or we realize we're comparing against another entity, and go to the
+        // slow path anyways.
+        m_jit.load32(MacroAssembler::Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
+        m_jit.urshift32(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), hashGPR);
+        m_jit.load32(MacroAssembler::Address(objectGPR, JSCell::structureIDOffset()), structureIDGPR);
+        m_jit.add32(structureIDGPR, hashGPR);
+        m_jit.and32(TrustedImm32(HasOwnPropertyCache::mask), hashGPR);
+        m_jit.mul32(TrustedImm32(sizeof(HasOwnPropertyCache::Entry)), hashGPR, hashGPR);
+        ASSERT(m_jit.vm()->hasOwnPropertyCache());
+        m_jit.move(TrustedImmPtr(m_jit.vm()->hasOwnPropertyCache()), tempGPR);
+        slowPath.append(m_jit.branchPtr(MacroAssembler::NotEqual, 
+            MacroAssembler::BaseIndex(tempGPR, hashGPR, MacroAssembler::TimesOne, HasOwnPropertyCache::Entry::offsetOfImpl()), implGPR));
+        m_jit.load8(MacroAssembler::BaseIndex(tempGPR, hashGPR, MacroAssembler::TimesOne, HasOwnPropertyCache::Entry::offsetOfResult()), resultGPR);
+        m_jit.load32(MacroAssembler::BaseIndex(tempGPR, hashGPR, MacroAssembler::TimesOne, HasOwnPropertyCache::Entry::offsetOfStructureID()), tempGPR);
+        slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, tempGPR, structureIDGPR));
+        auto done = m_jit.jump();
+
+        slowPath.link(&m_jit);
+        silentSpillAllRegisters(resultGPR);
+        if (node->child2().useKind() != UntypedUse) {
+            m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), tempGPR);
+            keyRegs = JSValueRegs(tempGPR, keyRegs.payloadGPR());
+        }
+        callOperation(operationHasOwnProperty, resultGPR, objectGPR, keyRegs);
+        silentFillAllRegisters(resultGPR);
+        m_jit.exceptionCheck();
+
+        done.link(&m_jit);
+        booleanResult(resultGPR, node);
+#endif // CPU(X86)
+        break;
+    }
+
+    case StoreBarrier:
+    case FencedStoreBarrier: {
+        compileStoreBarrier(node);
+        break;
+    }
+
+    case GetEnumerableLength: {
+        SpeculateCellOperand enumerator(this, node->child1());
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        m_jit.load32(MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::indexedLengthOffset()), resultGPR);
+        int32Result(resultGPR, node);
+        break;
+    }
+    case HasGenericProperty: {
+        JSValueOperand base(this, node->child1());
+        SpeculateCellOperand property(this, node->child2());
+        GPRFlushedCallResult resultPayload(this);
+        GPRFlushedCallResult2 resultTag(this);
+        JSValueRegs baseRegs = base.jsValueRegs();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+
+        flushRegisters();
+        callOperation(operationHasGenericProperty, JSValueRegs(resultTagGPR, resultPayloadGPR), baseRegs, property.gpr());
+        m_jit.exceptionCheck();
+        booleanResult(resultPayloadGPR, node);
+        break;
+    }
+    case HasStructureProperty: {
+        JSValueOperand base(this, node->child1());
+        SpeculateCellOperand property(this, node->child2());
+        SpeculateCellOperand enumerator(this, node->child3());
+        GPRTemporary resultPayload(this);
+        GPRTemporary resultTag(this);
+
+        GPRReg baseTagGPR = base.tagGPR();
+        GPRReg basePayloadGPR = base.payloadGPR();
+        GPRReg propertyGPR = property.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+
+        m_jit.load32(MacroAssembler::Address(basePayloadGPR, JSCell::structureIDOffset()), resultTagGPR);
+        MacroAssembler::Jump wrongStructure = m_jit.branch32(MacroAssembler::NotEqual, 
+            resultTagGPR,
+            MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::cachedStructureIDOffset()));
+
+        moveTrueTo(resultPayloadGPR);
+        MacroAssembler::Jump done = m_jit.jump();
+
+        done.link(&m_jit);
+
+        addSlowPathGenerator(slowPathCall(wrongStructure, this, operationHasGenericProperty, 
+            JSValueRegs(resultTagGPR, resultPayloadGPR), JSValueRegs(baseTagGPR, basePayloadGPR), propertyGPR));
+        booleanResult(resultPayloadGPR, node);
+        break;
+    }
+    case HasIndexedProperty: {
+        SpeculateCellOperand base(this, node->child1());
+        SpeculateInt32Operand index(this, node->child2());
+        GPRTemporary resultPayload(this);
+        GPRTemporary resultTag(this);
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg indexGPR = index.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+
+        MacroAssembler::JumpList slowCases;
+        ArrayMode mode = node->arrayMode();
+        switch (mode.type()) {
+        case Array::Int32:
+        case Array::Contiguous: {
+            ASSERT(!!node->child3());
+            StorageOperand storage(this, node->child3());
+            GPRTemporary scratch(this);
+            
+            GPRReg storageGPR = storage.gpr();
+            GPRReg scratchGPR = scratch.gpr();
+
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength())));
+            m_jit.load32(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), scratchGPR);
+            slowCases.append(m_jit.branch32(MacroAssembler::Equal, scratchGPR, TrustedImm32(JSValue::EmptyValueTag)));
+            break;
+        }
+        case Array::Double: {
+            ASSERT(!!node->child3());
+            StorageOperand storage(this, node->child3());
+            FPRTemporary scratch(this);
+            FPRReg scratchFPR = scratch.fpr();
+            GPRReg storageGPR = storage.gpr();
+
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength())));
+            m_jit.loadDouble(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight), scratchFPR);
+            slowCases.append(m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, scratchFPR, scratchFPR));
+            break;
+        }
+        case Array::ArrayStorage: {
+            ASSERT(!!node->child3());
+            StorageOperand storage(this, node->child3());
+            GPRTemporary scratch(this);
+
+            GPRReg storageGPR = storage.gpr();
+            GPRReg scratchGPR = scratch.gpr();
+
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, ArrayStorage::vectorLengthOffset())));
+            m_jit.load32(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight, ArrayStorage::vectorOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), scratchGPR);
+            slowCases.append(m_jit.branch32(MacroAssembler::Equal, scratchGPR, TrustedImm32(JSValue::EmptyValueTag)));
+            break;
+        }
+        default: {
+            slowCases.append(m_jit.jump());
+            break;
+        }
+        }
+
+        moveTrueTo(resultPayloadGPR);
+        MacroAssembler::Jump done = m_jit.jump();
+
+        addSlowPathGenerator(slowPathCall(slowCases, this, operationHasIndexedProperty, JSValueRegs(resultTagGPR, resultPayloadGPR), baseGPR, indexGPR));
+        
+        done.link(&m_jit);
+        booleanResult(resultPayloadGPR, node);
+        break;
+    }
+    case GetDirectPname: {
+        Edge& baseEdge = m_jit.graph().varArgChild(node, 0);
+        Edge& propertyEdge = m_jit.graph().varArgChild(node, 1);
+
+        SpeculateCellOperand base(this, baseEdge);
+        SpeculateCellOperand property(this, propertyEdge);
+        GPRReg baseGPR = base.gpr();
+        GPRReg propertyGPR = property.gpr();
+
+#if CPU(X86)
+        GPRFlushedCallResult resultPayload(this);
+        GPRFlushedCallResult2 resultTag(this);
+        GPRTemporary scratch(this);
+
+        GPRReg resultTagGPR = resultTag.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+
+        // Not enough registers on X86 for this code, so always use the slow path.
+        flushRegisters();
+        m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), scratchGPR);
+        callOperation(operationGetByValCell, JSValueRegs(resultTagGPR, resultPayloadGPR), baseGPR, JSValueRegs(scratchGPR, propertyGPR));
+        m_jit.exceptionCheck();
+#else
+        GPRTemporary resultPayload(this);
+        GPRTemporary resultTag(this);
+        GPRTemporary scratch(this);
+
+        GPRReg resultTagGPR = resultTag.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+
+        Edge& indexEdge = m_jit.graph().varArgChild(node, 2);
+        Edge& enumeratorEdge = m_jit.graph().varArgChild(node, 3);
+
+        SpeculateInt32Operand index(this, indexEdge);
+        SpeculateCellOperand enumerator(this, enumeratorEdge);
+
+        GPRReg indexGPR = index.gpr();
+        GPRReg enumeratorGPR = enumerator.gpr();
+
+        MacroAssembler::JumpList slowPath;
+
+        // Check the structure
+        m_jit.load32(MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()), scratchGPR);
+        slowPath.append(
+            m_jit.branch32(
+                MacroAssembler::NotEqual, 
+                scratchGPR,
+                MacroAssembler::Address(
+                    enumeratorGPR, JSPropertyNameEnumerator::cachedStructureIDOffset())));
+        
+        // Compute the offset
+        // If index is less than the enumerator's cached inline storage, then it's an inline access
+        MacroAssembler::Jump outOfLineAccess = m_jit.branch32(MacroAssembler::AboveOrEqual, 
+            indexGPR, MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()));
+
+        m_jit.move(indexGPR, scratchGPR);
+        m_jit.signExtend32ToPtr(scratchGPR, scratchGPR);
+        m_jit.load32(MacroAssembler::BaseIndex(baseGPR, scratchGPR, MacroAssembler::TimesEight, JSObject::offsetOfInlineStorage() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagGPR);
+        m_jit.load32(MacroAssembler::BaseIndex(baseGPR, scratchGPR, MacroAssembler::TimesEight, JSObject::offsetOfInlineStorage() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadGPR);
+
+        MacroAssembler::Jump done = m_jit.jump();
+        
+        // Otherwise it's out of line
+        outOfLineAccess.link(&m_jit);
+        m_jit.move(indexGPR, scratchGPR);
+        m_jit.sub32(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), scratchGPR);
+        m_jit.neg32(scratchGPR);
+        m_jit.signExtend32ToPtr(scratchGPR, scratchGPR);
+        // We use resultPayloadGPR as a temporary here. We have to make sure clobber it after getting the 
+        // value out of indexGPR and enumeratorGPR because resultPayloadGPR could reuse either of those registers.
+        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), resultPayloadGPR);
+        int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
+        m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagGPR);
+        m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadGPR);
+
+        done.link(&m_jit);
+
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationGetByValCell, JSValueRegs(resultTagGPR, resultPayloadGPR), baseGPR, propertyGPR));
+#endif
+
+        jsValueResult(resultTagGPR, resultPayloadGPR, node);
+        break;
+    }
+    case GetPropertyEnumerator: {
+        SpeculateCellOperand base(this, node->child1());
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        flushRegisters();
+        callOperation(operationGetPropertyEnumerator, resultGPR, base.gpr());
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        break;
+    }
+    case GetEnumeratorStructurePname:
+    case GetEnumeratorGenericPname: {
+        SpeculateCellOperand enumerator(this, node->child1());
+        SpeculateInt32Operand index(this, node->child2());
+        GPRTemporary scratch(this);
+        GPRTemporary resultPayload(this);
+        GPRTemporary resultTag(this);
+
+        GPRReg enumeratorGPR = enumerator.gpr();
+        GPRReg indexGPR = index.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+        GPRReg resultTagGPR = resultTag.gpr();
+        GPRReg resultPayloadGPR = resultPayload.gpr();
+
+        MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, indexGPR,
+            MacroAssembler::Address(enumeratorGPR, (op == GetEnumeratorStructurePname)
+                ? JSPropertyNameEnumerator::endStructurePropertyIndexOffset()
+                : JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
+
+        m_jit.move(MacroAssembler::TrustedImm32(JSValue::NullTag), resultTagGPR);
+        m_jit.move(MacroAssembler::TrustedImm32(0), resultPayloadGPR);
+
+        MacroAssembler::Jump done = m_jit.jump();
+        inBounds.link(&m_jit);
+
+        m_jit.loadPtr(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), scratchGPR);
+        m_jit.loadPtr(MacroAssembler::BaseIndex(scratchGPR, indexGPR, MacroAssembler::ScalePtr), resultPayloadGPR);
+        m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag), resultTagGPR);
+
+        done.link(&m_jit);
+        jsValueResult(resultTagGPR, resultPayloadGPR, node);
+        break;
+    }
+    case ToIndexString: {
+        SpeculateInt32Operand index(this, node->child1());
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        flushRegisters();
+        callOperation(operationToIndexString, resultGPR, index.gpr());
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        break;
+    }
+    case ProfileType: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary scratch1(this);
+        GPRTemporary scratch2(this);
+        GPRTemporary scratch3(this);
+
+        GPRReg scratch1GPR = scratch1.gpr();
+        GPRReg scratch2GPR = scratch2.gpr();
+        GPRReg scratch3GPR = scratch3.gpr();
+
+        JITCompiler::Jump isTDZValue = m_jit.branch32(JITCompiler::Equal, value.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));
+
+        // Load the TypeProfilerLog into Scratch2.
+        TypeProfilerLog* cachedTypeProfilerLog = m_jit.vm()->typeProfilerLog();
+        m_jit.move(TrustedImmPtr(cachedTypeProfilerLog), scratch2GPR);
+
+        // Load the next LogEntry into Scratch1.
+        m_jit.loadPtr(MacroAssembler::Address(scratch2GPR, TypeProfilerLog::currentLogEntryOffset()), scratch1GPR);
+
+        // Store the JSValue onto the log entry.
+        m_jit.store32(value.tagGPR(), MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+        m_jit.store32(value.payloadGPR(), MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+
+        // Store the structureID of the cell if valueGPR is a cell, otherwise, store 0 on the log entry.
+        MacroAssembler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
+        m_jit.load32(MacroAssembler::Address(value.payloadGPR(), JSCell::structureIDOffset()), scratch3GPR);
+        m_jit.store32(scratch3GPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::structureIDOffset()));
+        MacroAssembler::Jump skipIsCell = m_jit.jump();
+        isNotCell.link(&m_jit);
+        m_jit.store32(TrustedImm32(0), MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::structureIDOffset()));
+        skipIsCell.link(&m_jit);
+
+        // Store the typeLocation on the log entry.
+        TypeLocation* cachedTypeLocation = node->typeLocation();
+        m_jit.move(TrustedImmPtr(cachedTypeLocation), scratch3GPR);
+        m_jit.storePtr(scratch3GPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::locationOffset()));
+
+        // Increment the current log entry.
+        m_jit.addPtr(TrustedImm32(sizeof(TypeProfilerLog::LogEntry)), scratch1GPR);
+        m_jit.storePtr(scratch1GPR, MacroAssembler::Address(scratch2GPR, TypeProfilerLog::currentLogEntryOffset()));
+        MacroAssembler::Jump clearLog = m_jit.branchPtr(MacroAssembler::Equal, scratch1GPR, TrustedImmPtr(cachedTypeProfilerLog->logEndPtr()));
+        addSlowPathGenerator(
+            slowPathCall(clearLog, this, operationProcessTypeProfilerLogDFG, NoResult));
+
+        isTDZValue.link(&m_jit);
+
+        noResult(node);
+        break;
+    }
+    case ProfileControlFlow: {
+        GPRTemporary scratch1(this);
+        BasicBlockLocation* basicBlockLocation = node->basicBlockLocation();
+        basicBlockLocation->emitExecuteCode(m_jit, scratch1.gpr());
+        noResult(node);
+        break;
+    }
+
+    case LogShadowChickenPrologue: {
+        flushRegisters();
+        prepareForExternalCall();
+        m_jit.emitStoreCodeOrigin(node->origin.semantic);
+
+        GPRTemporary scratch1(this, GPRInfo::nonArgGPR0); // This must be a non-argument GPR.
+        GPRReg scratch1Reg = scratch1.gpr();
+        GPRTemporary shadowPacket(this);
+        GPRReg shadowPacketReg = shadowPacket.gpr();
+        GPRTemporary scratch2(this);
+        GPRReg scratch2Reg = scratch2.gpr();
+
+        m_jit.ensureShadowChickenPacket(shadowPacketReg, scratch1Reg, scratch2Reg);
+
+        SpeculateCellOperand scope(this, node->child1());
+        GPRReg scopeReg = scope.gpr();
+
+        m_jit.logShadowChickenProloguePacket(shadowPacketReg, scratch1Reg, scopeReg);
+        noResult(node);
+        break;
+    }
+
+    case LogShadowChickenTail: {
+        flushRegisters();
+        prepareForExternalCall();
+        CallSiteIndex callSiteIndex = m_jit.emitStoreCodeOrigin(node->origin.semantic);
+
+        GPRTemporary scratch1(this, GPRInfo::nonArgGPR0); // This must be a non-argument GPR.
+        GPRReg scratch1Reg = scratch1.gpr();
+        GPRTemporary shadowPacket(this);
+        GPRReg shadowPacketReg = shadowPacket.gpr();
+        GPRTemporary scratch2(this);
+        GPRReg scratch2Reg = scratch2.gpr();
+
+        m_jit.ensureShadowChickenPacket(shadowPacketReg, scratch1Reg, scratch2Reg);
+
+        JSValueOperand thisValue(this, node->child1());
+        JSValueRegs thisRegs = thisValue.jsValueRegs();
+        SpeculateCellOperand scope(this, node->child2());
+        GPRReg scopeReg = scope.gpr();
+
+        m_jit.logShadowChickenTailPacket(shadowPacketReg, thisRegs, scopeReg, m_jit.codeBlock(), callSiteIndex);
+        noResult(node);
+        break;
+    }
+
+    case ForceOSRExit: {
+        terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+        break;
+    }
+
+    case InvalidationPoint:
+        emitInvalidationPoint(node);
+        break;
+
+    case CheckWatchdogTimer: {
+        ASSERT(m_jit.vm()->watchdog());
+        GPRTemporary unused(this);
+        GPRReg unusedGPR = unused.gpr();
+        
+        JITCompiler::Jump timerDidFire = m_jit.branchTest8(JITCompiler::NonZero,
+            JITCompiler::AbsoluteAddress(m_jit.vm()->watchdog()->timerDidFireAddress()));
+        
+        addSlowPathGenerator(slowPathCall(timerDidFire, this, operationHandleWatchdogTimer, unusedGPR));
+        break;
+    }
+
+    case CountExecution:
+        m_jit.add64(TrustedImm32(1), MacroAssembler::AbsoluteAddress(node->executionCounter()->address()));
+        break;
+
+    case Phantom:
+    case Check:
+        DFG_NODE_DO_TO_CHILDREN(m_jit.graph(), node, speculate);
+        noResult(node);
+        break;
+
+    case PhantomLocal:
+    case LoopHint:
+        // This is a no-op.
+        noResult(node);
+        break;
+        
+    case MaterializeNewObject:
+        compileMaterializeNewObject(node);
+        break;
+
+    case PutDynamicVar: {
+        compilePutDynamicVar(node);
+        break;
+    }
+
+    case GetDynamicVar: {
+        compileGetDynamicVar(node);
+        break;
+    }
+
+    case ResolveScope: {
+        compileResolveScope(node);
+        break;
+    }
+
+    case CallDOM:
+        compileCallDOM(node);
+        break;
+
+    case CallDOMGetter:
+        compileCallDOMGetter(node);
+        break;
+
+    case CheckDOM:
+        compileCheckDOM(node);
+        break;
+
+    case Unreachable:
+        unreachable(node);
+        break;
+
+    case LastNodeType:
+    case Phi:
+    case Upsilon:
+    case ExtractOSREntryLocal:
+    case CheckTierUpInLoop:
+    case CheckTierUpAtReturn:
+    case CheckTierUpAndOSREnter:
+    case Int52Rep:
+    case FiatInt52:
+    case Int52Constant:
+    case CheckInBounds:
+    case ArithIMul:
+    case MultiGetByOffset:
+    case MultiPutByOffset:
+    case CheckBadCell:
+    case BottomValue:
+    case PhantomNewObject:
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomCreateActivation:
+    case PutHint:
+    case CheckStructureImmediate:
+    case MaterializeCreateActivation:
+    case PutStack:
+    case KillStack:
+    case GetStack:
+    case GetMyArgumentByVal:
+    case GetMyArgumentByValOutOfBounds:
+    case PhantomCreateRest:
+    case PhantomSpread:
+    case PhantomNewArrayWithSpread:
+        DFG_CRASH(m_jit.graph(), node, "unexpected node in DFG backend");
+        break;
+    }
+
+    if (!m_compileOkay)
+        return;
+    
+    if (node->hasResult() && node->mustGenerate())
+        use(node);
+}
+
+void SpeculativeJIT::moveTrueTo(GPRReg gpr)
+{
+    m_jit.move(TrustedImm32(1), gpr);
+}
+
+void SpeculativeJIT::moveFalseTo(GPRReg gpr)
+{
+    m_jit.move(TrustedImm32(0), gpr);
+}
+
+void SpeculativeJIT::blessBoolean(GPRReg)
+{
+}
+
+void SpeculativeJIT::compileArithRandom(Node* node)
+{
+    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+
+    flushRegisters();
+
+    FPRResult result(this);
+    callOperation(operationRandom, result.fpr(), globalObject);
+    // operationRandom does not raise any exception.
+    doubleResult(result.fpr(), node);
+}
+
+void SpeculativeJIT::emitInitializeButterfly(GPRReg storageGPR, GPRReg sizeGPR, JSValueRegs emptyValueRegs, GPRReg scratchGPR)
+{
+    m_jit.move(sizeGPR, scratchGPR);
+    MacroAssembler::Jump done = m_jit.branchTest32(MacroAssembler::Zero, scratchGPR);
+    MacroAssembler::Label loop = m_jit.label();
+    m_jit.sub32(TrustedImm32(1), scratchGPR);
+    m_jit.store32(emptyValueRegs.tagGPR(), MacroAssembler::BaseIndex(storageGPR, scratchGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+    m_jit.store32(emptyValueRegs.payloadGPR(), MacroAssembler::BaseIndex(storageGPR, scratchGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+    m_jit.branchTest32(MacroAssembler::NonZero, scratchGPR).linkTo(loop, &m_jit);
+    done.link(&m_jit);
+}
+
+void SpeculativeJIT::compileAllocateNewArrayWithSize(JSGlobalObject* globalObject, GPRReg resultGPR, GPRReg sizeGPR, IndexingType indexingType, bool shouldConvertLargeSizeToArrayStorage)
+{
+    GPRTemporary storage(this);
+    GPRTemporary scratch(this);
+    GPRTemporary scratch2(this);
+    
+    GPRReg storageGPR = storage.gpr();
+    GPRReg scratchGPR = scratch.gpr();
+    GPRReg scratch2GPR = scratch2.gpr();
+    
+    m_jit.move(TrustedImmPtr(0), storageGPR);
+            
+    MacroAssembler::JumpList slowCases;
+    if (shouldConvertLargeSizeToArrayStorage)
+        slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)));
+
+    // We can use result as a scratch for this.
+    emitAllocateButterfly(storageGPR, sizeGPR, scratchGPR, scratch2GPR, resultGPR, slowCases);
+
+    JSValue hole;
+    if (hasDouble(indexingType))
+        hole = JSValue(JSValue::EncodeAsDouble, PNaN);
+    else
+        hole = JSValue();
+    JSValueRegs emptyValueRegs(scratchGPR, scratch2GPR);
+    m_jit.move(TrustedImm32(hole.tag()), emptyValueRegs.tagGPR());
+    m_jit.move(TrustedImm32(hole.payload()), emptyValueRegs.payloadGPR());
+    // We can use result as a scratch for this.
+    emitInitializeButterfly(storageGPR, sizeGPR, emptyValueRegs, resultGPR);
+            
+    RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType));
+    emitAllocateJSObject<JSArray>(resultGPR, TrustedImmPtr(structure), storageGPR, scratchGPR, scratch2GPR, slowCases);
+            
+    addSlowPathGenerator(std::make_unique<CallArrayAllocatorWithVariableSizeSlowPathGenerator>(
+        slowCases, this, operationNewArrayWithSize, resultGPR,
+        structure,
+        shouldConvertLargeSizeToArrayStorage ? m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage)) : structure,
+        sizeGPR, storageGPR));
+}
+
+#endif
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGSpeculativeJIT64.cpp b/dfg/DFGSpeculativeJIT64.cpp
new file mode 100644
index 0000000..987c0ba
--- /dev/null
+++ b/dfg/DFGSpeculativeJIT64.cpp
@@ -0,0 +1,6002 @@
+/*
+ * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGSpeculativeJIT.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayPrototype.h"
+#include "CallFrameShuffler.h"
+#include "DFGAbstractInterpreterInlines.h"
+#include "DFGCallArrayAllocatorSlowPathGenerator.h"
+#include "DFGOperations.h"
+#include "DFGSlowPathGenerator.h"
+#include "DirectArguments.h"
+#include "GetterSetter.h"
+#include "HasOwnPropertyCache.h"
+#include "JSCInlines.h"
+#include "JSEnvironmentRecord.h"
+#include "JSLexicalEnvironment.h"
+#include "JSMap.h"
+#include "JSPropertyNameEnumerator.h"
+#include "JSSet.h"
+#include "ObjectPrototype.h"
+#include "SetupVarargsFrame.h"
+#include "SpillRegistersMode.h"
+#include "StringPrototype.h"
+#include "TypeProfilerLog.h"
+#include "Watchdog.h"
+
+namespace JSC { namespace DFG {
+
+#if USE(JSVALUE64)
+
+void SpeculativeJIT::boxInt52(GPRReg sourceGPR, GPRReg targetGPR, DataFormat format)
+{
+    GPRReg tempGPR;
+    if (sourceGPR == targetGPR)
+        tempGPR = allocate();
+    else
+        tempGPR = targetGPR;
+    
+    FPRReg fpr = fprAllocate();
+
+    if (format == DataFormatInt52)
+        m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), sourceGPR);
+    else
+        ASSERT(format == DataFormatStrictInt52);
+    
+    m_jit.boxInt52(sourceGPR, targetGPR, tempGPR, fpr);
+    
+    if (format == DataFormatInt52 && sourceGPR != targetGPR)
+        m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), sourceGPR);
+    
+    if (tempGPR != targetGPR)
+        unlock(tempGPR);
+    
+    unlock(fpr);
+}
+
+GPRReg SpeculativeJIT::fillJSValue(Edge edge)
+{
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+    
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+
+        if (edge->hasConstant()) {
+            JSValue jsValue = edge->asJSValue();
+            m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
+            info.fillJSValue(*m_stream, gpr, DataFormatJS);
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+        } else {
+            DataFormat spillFormat = info.spillFormat();
+            m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+            switch (spillFormat) {
+            case DataFormatInt32: {
+                m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
+                m_jit.or64(GPRInfo::tagTypeNumberRegister, gpr);
+                spillFormat = DataFormatJSInt32;
+                break;
+            }
+                
+            default:
+                m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
+                DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat & DataFormatJS);
+                break;
+            }
+            info.fillJSValue(*m_stream, gpr, spillFormat);
+        }
+        return gpr;
+    }
+
+    case DataFormatInt32: {
+        GPRReg gpr = info.gpr();
+        // If the register has already been locked we need to take a copy.
+        // If not, we'll zero extend in place, so mark on the info that this is now type DataFormatInt32, not DataFormatJSInt32.
+        if (m_gprs.isLocked(gpr)) {
+            GPRReg result = allocate();
+            m_jit.or64(GPRInfo::tagTypeNumberRegister, gpr, result);
+            return result;
+        }
+        m_gprs.lock(gpr);
+        m_jit.or64(GPRInfo::tagTypeNumberRegister, gpr);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSInt32);
+        return gpr;
+    }
+
+    case DataFormatCell:
+        // No retag required on JSVALUE64!
+    case DataFormatJS:
+    case DataFormatJSInt32:
+    case DataFormatJSDouble:
+    case DataFormatJSCell:
+    case DataFormatJSBoolean: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+        
+    case DataFormatBoolean:
+    case DataFormatStorage:
+    case DataFormatDouble:
+    case DataFormatInt52:
+        // this type currently never occurs
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
+        
+    default:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
+        return InvalidGPRReg;
+    }
+}
+
+void SpeculativeJIT::cachedGetById(CodeOrigin origin, JSValueRegs base, JSValueRegs result, unsigned identifierNumber, JITCompiler::Jump slowPathTarget , SpillRegistersMode mode, AccessType type)
+{
+    cachedGetById(origin, base.gpr(), result.gpr(), identifierNumber, slowPathTarget, mode, type);
+}
+
+void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg resultGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode, AccessType type)
+{
+    CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size());
+    RegisterSet usedRegisters = this->usedRegisters();
+    if (spillMode == DontSpill) {
+        // We've already flushed registers to the stack, we don't need to spill these.
+        usedRegisters.set(baseGPR, false);
+        usedRegisters.set(resultGPR, false);
+    }
+    JITGetByIdGenerator gen(
+        m_jit.codeBlock(), codeOrigin, callSite, usedRegisters, identifierUID(identifierNumber),
+        JSValueRegs(baseGPR), JSValueRegs(resultGPR), type);
+    gen.generateFastPath(m_jit);
+    
+    JITCompiler::JumpList slowCases;
+    if (slowPathTarget.isSet())
+        slowCases.append(slowPathTarget);
+    slowCases.append(gen.slowPathJump());
+    
+    auto slowPath = slowPathCall(
+        slowCases, this, type == AccessType::Get ? operationGetByIdOptimize : operationTryGetByIdOptimize,
+        spillMode, ExceptionCheckRequirement::CheckNeeded,
+        resultGPR, gen.stubInfo(), baseGPR, identifierUID(identifierNumber));
+    
+    m_jit.addGetById(gen, slowPath.get());
+    addSlowPathGenerator(WTFMove(slowPath));
+}
+
+void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg valueGPR, GPRReg scratchGPR, unsigned identifierNumber, PutKind putKind, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)
+{
+    CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(codeOrigin, m_stream->size());
+    RegisterSet usedRegisters = this->usedRegisters();
+    if (spillMode == DontSpill) {
+        // We've already flushed registers to the stack, we don't need to spill these.
+        usedRegisters.set(baseGPR, false);
+        usedRegisters.set(valueGPR, false);
+    }
+
+    JITPutByIdGenerator gen(
+        m_jit.codeBlock(), codeOrigin, callSite, usedRegisters, JSValueRegs(baseGPR),
+        JSValueRegs(valueGPR), scratchGPR, m_jit.ecmaModeFor(codeOrigin), putKind);
+
+    gen.generateFastPath(m_jit);
+    
+    JITCompiler::JumpList slowCases;
+    if (slowPathTarget.isSet())
+        slowCases.append(slowPathTarget);
+    slowCases.append(gen.slowPathJump());
+    
+    auto slowPath = slowPathCall(
+        slowCases, this, gen.slowPathFunction(), NoResult, gen.stubInfo(), valueGPR, baseGPR,
+        identifierUID(identifierNumber));
+
+    m_jit.addPutById(gen, slowPath.get());
+    addSlowPathGenerator(WTFMove(slowPath));
+}
+
+void SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined(Edge operand)
+{
+    ASSERT_WITH_MESSAGE(!masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node()), "The Compare should have been eliminated, it is known to be always false.");
+
+    JSValueOperand arg(this, operand, ManualOperandSpeculation);
+    GPRReg argGPR = arg.gpr();
+    
+    GPRTemporary result(this);
+    GPRReg resultGPR = result.gpr();
+
+    m_jit.move(TrustedImm32(0), resultGPR);
+
+    JITCompiler::JumpList done;
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        if (!isKnownNotCell(operand.node()))
+            done.append(m_jit.branchIfCell(JSValueRegs(argGPR)));
+    } else {
+        GPRTemporary localGlobalObject(this);
+        GPRTemporary remoteGlobalObject(this);
+        GPRTemporary scratch(this);
+
+        JITCompiler::Jump notCell;
+        if (!isKnownCell(operand.node()))
+            notCell = m_jit.branchIfNotCell(JSValueRegs(argGPR));
+        
+        JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(
+            JITCompiler::Zero,
+            JITCompiler::Address(argGPR, JSCell::typeInfoFlagsOffset()), 
+            JITCompiler::TrustedImm32(MasqueradesAsUndefined));
+        done.append(isNotMasqueradesAsUndefined);
+
+        GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
+        GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
+        m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
+        m_jit.emitLoadStructure(argGPR, resultGPR, scratch.gpr());
+        m_jit.loadPtr(JITCompiler::Address(resultGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
+        m_jit.comparePtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, resultGPR);
+        done.append(m_jit.jump());
+        if (!isKnownCell(operand.node()))
+            notCell.link(&m_jit);
+    }
+ 
+    if (!isKnownNotOther(operand.node())) {
+        m_jit.move(argGPR, resultGPR);
+        m_jit.and64(JITCompiler::TrustedImm32(~TagBitUndefined), resultGPR);
+        m_jit.compare64(JITCompiler::Equal, resultGPR, JITCompiler::TrustedImm32(ValueNull), resultGPR);
+    }
+
+    done.link(&m_jit);
+ 
+    m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+    jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean);
+}
+
+void SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined(Edge operand, Node* branchNode)
+{
+    ASSERT_WITH_MESSAGE(!masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node()), "The Compare should have been eliminated, it is known to be always false.");
+
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    JSValueOperand arg(this, operand, ManualOperandSpeculation);
+    GPRReg argGPR = arg.gpr();
+    
+    GPRTemporary result(this, Reuse, arg);
+    GPRReg resultGPR = result.gpr();
+
+    // First, handle the case where "operand" is a cell.
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        if (!isKnownNotCell(operand.node())) {
+            JITCompiler::Jump isCell = m_jit.branchIfCell(JSValueRegs(argGPR));
+            addBranch(isCell, notTaken);
+        }
+    } else {
+        GPRTemporary localGlobalObject(this);
+        GPRTemporary remoteGlobalObject(this);
+        GPRTemporary scratch(this);
+
+        JITCompiler::Jump notCell;
+        if (!isKnownCell(operand.node()))
+            notCell = m_jit.branchIfNotCell(JSValueRegs(argGPR));
+        
+        branchTest8(JITCompiler::Zero, 
+            JITCompiler::Address(argGPR, JSCell::typeInfoFlagsOffset()), 
+            JITCompiler::TrustedImm32(MasqueradesAsUndefined), notTaken);
+
+        GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
+        GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
+        m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
+        m_jit.emitLoadStructure(argGPR, resultGPR, scratch.gpr());
+        m_jit.loadPtr(JITCompiler::Address(resultGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
+        branchPtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, taken);
+
+        if (!isKnownCell(operand.node())) {
+            jump(notTaken, ForceJump);
+            notCell.link(&m_jit);
+        }
+    }
+
+    if (isKnownNotOther(operand.node()))
+        jump(notTaken);
+    else {
+        JITCompiler::RelationalCondition condition = JITCompiler::Equal;
+        if (taken == nextBlock()) {
+            condition = JITCompiler::NotEqual;
+            std::swap(taken, notTaken);
+        }
+        m_jit.move(argGPR, resultGPR);
+        m_jit.and64(JITCompiler::TrustedImm32(~TagBitUndefined), resultGPR);
+        branch64(condition, resultGPR, JITCompiler::TrustedImm64(ValueNull), taken);
+        jump(notTaken);
+    }
+}
+
+void SpeculativeJIT::nonSpeculativePeepholeBranch(Node* node, Node* branchNode, MacroAssembler::RelationalCondition cond, S_JITOperation_EJJ helperFunction)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    JITCompiler::ResultCondition callResultCondition = JITCompiler::NonZero;
+
+    // The branch instruction will branch to the taken block.
+    // If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
+    if (taken == nextBlock()) {
+        cond = JITCompiler::invert(cond);
+        callResultCondition = JITCompiler::Zero;
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+
+    JSValueOperand arg1(this, node->child1());
+    JSValueOperand arg2(this, node->child2());
+    GPRReg arg1GPR = arg1.gpr();
+    GPRReg arg2GPR = arg2.gpr();
+    
+    JITCompiler::JumpList slowPath;
+    
+    if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+    
+        arg1.use();
+        arg2.use();
+    
+        flushRegisters();
+        callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);
+        m_jit.exceptionCheck();
+
+        branchTest32(callResultCondition, resultGPR, taken);
+    } else {
+        GPRTemporary result(this, Reuse, arg2);
+        GPRReg resultGPR = result.gpr();
+    
+        arg1.use();
+        arg2.use();
+    
+        if (!isKnownInteger(node->child1().node()))
+            slowPath.append(m_jit.branch64(MacroAssembler::Below, arg1GPR, GPRInfo::tagTypeNumberRegister));
+        if (!isKnownInteger(node->child2().node()))
+            slowPath.append(m_jit.branch64(MacroAssembler::Below, arg2GPR, GPRInfo::tagTypeNumberRegister));
+    
+        branch32(cond, arg1GPR, arg2GPR, taken);
+    
+        if (!isKnownInteger(node->child1().node()) || !isKnownInteger(node->child2().node())) {
+            jump(notTaken, ForceJump);
+    
+            slowPath.link(&m_jit);
+    
+            silentSpillAllRegisters(resultGPR);
+            callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);
+            silentFillAllRegisters(resultGPR);
+            m_jit.exceptionCheck();
+        
+            branchTest32(callResultCondition, resultGPR, taken);
+        }
+    }
+
+    jump(notTaken);
+
+    m_indexInBlock = m_block->size() - 1;
+    m_currentNode = branchNode;
+}
+
+template<typename JumpType>
+class CompareAndBoxBooleanSlowPathGenerator
+    : public CallSlowPathGenerator<JumpType, S_JITOperation_EJJ, GPRReg> {
+public:
+    CompareAndBoxBooleanSlowPathGenerator(
+        JumpType from, SpeculativeJIT* jit,
+        S_JITOperation_EJJ function, GPRReg result, GPRReg arg1, GPRReg arg2)
+        : CallSlowPathGenerator<JumpType, S_JITOperation_EJJ, GPRReg>(
+            from, jit, function, NeedToSpill, ExceptionCheckRequirement::CheckNeeded, result)
+        , m_arg1(arg1)
+        , m_arg2(arg2)
+    {
+    }
+    
+protected:
+    void generateInternal(SpeculativeJIT* jit) override
+    {
+        this->setUp(jit);
+        this->recordCall(jit->callOperation(this->m_function, this->m_result, m_arg1, m_arg2));
+        jit->m_jit.and32(JITCompiler::TrustedImm32(1), this->m_result);
+        jit->m_jit.or32(JITCompiler::TrustedImm32(ValueFalse), this->m_result);
+        this->tearDown(jit);
+    }
+   
+private:
+    GPRReg m_arg1;
+    GPRReg m_arg2;
+};
+
+void SpeculativeJIT::nonSpeculativeNonPeepholeCompare(Node* node, MacroAssembler::RelationalCondition cond, S_JITOperation_EJJ helperFunction)
+{
+    ASSERT(node->isBinaryUseKind(UntypedUse));
+    JSValueOperand arg1(this, node->child1());
+    JSValueOperand arg2(this, node->child2());
+    GPRReg arg1GPR = arg1.gpr();
+    GPRReg arg2GPR = arg2.gpr();
+    
+    JITCompiler::JumpList slowPath;
+    
+    if (isKnownNotInteger(node->child1().node()) || isKnownNotInteger(node->child2().node())) {
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+    
+        arg1.use();
+        arg2.use();
+    
+        flushRegisters();
+        callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);
+        m_jit.exceptionCheck();
+        
+        m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+        jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean, UseChildrenCalledExplicitly);
+    } else {
+        GPRTemporary result(this, Reuse, arg2);
+        GPRReg resultGPR = result.gpr();
+
+        arg1.use();
+        arg2.use();
+    
+        if (!isKnownInteger(node->child1().node()))
+            slowPath.append(m_jit.branch64(MacroAssembler::Below, arg1GPR, GPRInfo::tagTypeNumberRegister));
+        if (!isKnownInteger(node->child2().node()))
+            slowPath.append(m_jit.branch64(MacroAssembler::Below, arg2GPR, GPRInfo::tagTypeNumberRegister));
+    
+        m_jit.compare32(cond, arg1GPR, arg2GPR, resultGPR);
+        m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+        
+        if (!isKnownInteger(node->child1().node()) || !isKnownInteger(node->child2().node())) {
+            addSlowPathGenerator(std::make_unique<CompareAndBoxBooleanSlowPathGenerator<JITCompiler::JumpList>>(
+                slowPath, this, helperFunction, resultGPR, arg1GPR, arg2GPR));
+        }
+
+        jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean, UseChildrenCalledExplicitly);
+    }
+}
+
+void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node* node, Node* branchNode, bool invert)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    // The branch instruction will branch to the taken block.
+    // If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
+    if (taken == nextBlock()) {
+        invert = !invert;
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+    
+    JSValueOperand arg1(this, node->child1());
+    JSValueOperand arg2(this, node->child2());
+    GPRReg arg1GPR = arg1.gpr();
+    GPRReg arg2GPR = arg2.gpr();
+    
+    GPRTemporary result(this);
+    GPRReg resultGPR = result.gpr();
+    
+    arg1.use();
+    arg2.use();
+    
+    if (isKnownCell(node->child1().node()) && isKnownCell(node->child2().node())) {
+        // see if we get lucky: if the arguments are cells and they reference the same
+        // cell, then they must be strictly equal.
+        branch64(JITCompiler::Equal, arg1GPR, arg2GPR, invert ? notTaken : taken);
+        
+        silentSpillAllRegisters(resultGPR);
+        callOperation(operationCompareStrictEqCell, resultGPR, arg1GPR, arg2GPR);
+        silentFillAllRegisters(resultGPR);
+        m_jit.exceptionCheck();
+        
+        branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR, taken);
+    } else {
+        m_jit.or64(arg1GPR, arg2GPR, resultGPR);
+        
+        JITCompiler::Jump twoCellsCase = m_jit.branchTest64(JITCompiler::Zero, resultGPR, GPRInfo::tagMaskRegister);
+        
+        JITCompiler::Jump leftOK = m_jit.branch64(JITCompiler::AboveOrEqual, arg1GPR, GPRInfo::tagTypeNumberRegister);
+        JITCompiler::Jump leftDouble = m_jit.branchTest64(JITCompiler::NonZero, arg1GPR, GPRInfo::tagTypeNumberRegister);
+        leftOK.link(&m_jit);
+        JITCompiler::Jump rightOK = m_jit.branch64(JITCompiler::AboveOrEqual, arg2GPR, GPRInfo::tagTypeNumberRegister);
+        JITCompiler::Jump rightDouble = m_jit.branchTest64(JITCompiler::NonZero, arg2GPR, GPRInfo::tagTypeNumberRegister);
+        rightOK.link(&m_jit);
+        
+        branch64(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, taken);
+        jump(notTaken, ForceJump);
+        
+        twoCellsCase.link(&m_jit);
+        branch64(JITCompiler::Equal, arg1GPR, arg2GPR, invert ? notTaken : taken);
+        
+        leftDouble.link(&m_jit);
+        rightDouble.link(&m_jit);
+        
+        silentSpillAllRegisters(resultGPR);
+        callOperation(operationCompareStrictEq, resultGPR, arg1GPR, arg2GPR);
+        silentFillAllRegisters(resultGPR);
+        m_jit.exceptionCheck();
+        
+        branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR, taken);
+    }
+    
+    jump(notTaken);
+}
+
+void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node* node, bool invert)
+{
+    JSValueOperand arg1(this, node->child1());
+    JSValueOperand arg2(this, node->child2());
+    GPRReg arg1GPR = arg1.gpr();
+    GPRReg arg2GPR = arg2.gpr();
+    
+    GPRTemporary result(this);
+    GPRReg resultGPR = result.gpr();
+    
+    arg1.use();
+    arg2.use();
+    
+    if (isKnownCell(node->child1().node()) && isKnownCell(node->child2().node())) {
+        // see if we get lucky: if the arguments are cells and they reference the same
+        // cell, then they must be strictly equal.
+        // FIXME: this should flush registers instead of silent spill/fill.
+        JITCompiler::Jump notEqualCase = m_jit.branch64(JITCompiler::NotEqual, arg1GPR, arg2GPR);
+        
+        m_jit.move(JITCompiler::TrustedImm64(JSValue::encode(jsBoolean(!invert))), resultGPR);
+        
+        JITCompiler::Jump done = m_jit.jump();
+
+        notEqualCase.link(&m_jit);
+        
+        silentSpillAllRegisters(resultGPR);
+        callOperation(operationCompareStrictEqCell, resultGPR, arg1GPR, arg2GPR);
+        silentFillAllRegisters(resultGPR);
+        m_jit.exceptionCheck();
+        
+        m_jit.and64(JITCompiler::TrustedImm32(1), resultGPR);
+        m_jit.or32(JITCompiler::TrustedImm32(ValueFalse), resultGPR);
+        
+        done.link(&m_jit);
+    } else {
+        m_jit.or64(arg1GPR, arg2GPR, resultGPR);
+        
+        JITCompiler::JumpList slowPathCases;
+        
+        JITCompiler::Jump twoCellsCase = m_jit.branchTest64(JITCompiler::Zero, resultGPR, GPRInfo::tagMaskRegister);
+        
+        JITCompiler::Jump leftOK = m_jit.branch64(JITCompiler::AboveOrEqual, arg1GPR, GPRInfo::tagTypeNumberRegister);
+        slowPathCases.append(m_jit.branchTest64(JITCompiler::NonZero, arg1GPR, GPRInfo::tagTypeNumberRegister));
+        leftOK.link(&m_jit);
+        JITCompiler::Jump rightOK = m_jit.branch64(JITCompiler::AboveOrEqual, arg2GPR, GPRInfo::tagTypeNumberRegister);
+        slowPathCases.append(m_jit.branchTest64(JITCompiler::NonZero, arg2GPR, GPRInfo::tagTypeNumberRegister));
+        rightOK.link(&m_jit);
+        
+        m_jit.compare64(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, resultGPR);
+        m_jit.or32(JITCompiler::TrustedImm32(ValueFalse), resultGPR);
+        
+        JITCompiler::Jump done = m_jit.jump();
+        
+        twoCellsCase.link(&m_jit);
+        slowPathCases.append(m_jit.branch64(JITCompiler::NotEqual, arg1GPR, arg2GPR));
+        
+        m_jit.move(JITCompiler::TrustedImm64(JSValue::encode(jsBoolean(!invert))), resultGPR);
+        
+        addSlowPathGenerator(std::make_unique<CompareAndBoxBooleanSlowPathGenerator<MacroAssembler::JumpList>>(
+                    slowPathCases, this, operationCompareStrictEq, resultGPR, arg1GPR,
+                    arg2GPR));
+        
+        done.link(&m_jit);
+    }
+    
+    jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean, UseChildrenCalledExplicitly);
+}
+
+void SpeculativeJIT::compileMiscStrictEq(Node* node)
+{
+    JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+    JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
+    GPRTemporary result(this);
+    
+    if (node->child1().useKind() == MiscUse)
+        speculateMisc(node->child1(), op1.jsValueRegs());
+    if (node->child2().useKind() == MiscUse)
+        speculateMisc(node->child2(), op2.jsValueRegs());
+    
+    m_jit.compare64(JITCompiler::Equal, op1.gpr(), op2.gpr(), result.gpr());
+    m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+    jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+}
+
+void SpeculativeJIT::emitCall(Node* node)
+{
+    CallLinkInfo::CallType callType;
+    bool isVarargs = false;
+    bool isForwardVarargs = false;
+    bool isTail = false;
+    bool isEmulatedTail = false;
+    bool isDirect = false;
+    switch (node->op()) {
+    case Call:
+    case CallEval:
+        callType = CallLinkInfo::Call;
+        break;
+    case TailCall:
+        callType = CallLinkInfo::TailCall;
+        isTail = true;
+        break;
+    case TailCallInlinedCaller:
+        callType = CallLinkInfo::Call;
+        isEmulatedTail = true;
+        break;
+    case Construct:
+        callType = CallLinkInfo::Construct;
+        break;
+    case CallVarargs:
+        callType = CallLinkInfo::CallVarargs;
+        isVarargs = true;
+        break;
+    case TailCallVarargs:
+        callType = CallLinkInfo::TailCallVarargs;
+        isVarargs = true;
+        isTail = true;
+        break;
+    case TailCallVarargsInlinedCaller:
+        callType = CallLinkInfo::CallVarargs;
+        isVarargs = true;
+        isEmulatedTail = true;
+        break;
+    case ConstructVarargs:
+        callType = CallLinkInfo::ConstructVarargs;
+        isVarargs = true;
+        break;
+    case CallForwardVarargs:
+        callType = CallLinkInfo::CallVarargs;
+        isForwardVarargs = true;
+        break;
+    case ConstructForwardVarargs:
+        callType = CallLinkInfo::ConstructVarargs;
+        isForwardVarargs = true;
+        break;
+    case TailCallForwardVarargs:
+        callType = CallLinkInfo::TailCallVarargs;
+        isTail = true;
+        isForwardVarargs = true;
+        break;
+    case TailCallForwardVarargsInlinedCaller:
+        callType = CallLinkInfo::CallVarargs;
+        isEmulatedTail = true;
+        isForwardVarargs = true;
+        break;
+    case DirectCall:
+        callType = CallLinkInfo::DirectCall;
+        isDirect = true;
+        break;
+    case DirectConstruct:
+        callType = CallLinkInfo::DirectConstruct;
+        isDirect = true;
+        break;
+    case DirectTailCall:
+        callType = CallLinkInfo::DirectTailCall;
+        isTail = true;
+        isDirect = true;
+        break;
+    case DirectTailCallInlinedCaller:
+        callType = CallLinkInfo::DirectCall;
+        isEmulatedTail = true;
+        isDirect = true;
+        break;
+    default:
+        DFG_CRASH(m_jit.graph(), node, "bad node type");
+        break;
+    }
+
+    GPRReg calleeGPR = InvalidGPRReg;
+    CallFrameShuffleData shuffleData;
+    
+    ExecutableBase* executable = nullptr;
+    FunctionExecutable* functionExecutable = nullptr;
+    if (isDirect) {
+        executable = node->castOperand<ExecutableBase*>();
+        functionExecutable = jsDynamicCast<FunctionExecutable*>(executable);
+    }
+    
+    unsigned numPassedArgs = 0;
+    unsigned numAllocatedArgs = 0;
+    
+    // Gotta load the arguments somehow. Varargs is trickier.
+    if (isVarargs || isForwardVarargs) {
+        RELEASE_ASSERT(!isDirect);
+        CallVarargsData* data = node->callVarargsData();
+
+        GPRReg resultGPR;
+        unsigned numUsedStackSlots = m_jit.graph().m_nextMachineLocal;
+        
+        if (isForwardVarargs) {
+            flushRegisters();
+            if (node->child3())
+                use(node->child3());
+            
+            GPRReg scratchGPR1;
+            GPRReg scratchGPR2;
+            GPRReg scratchGPR3;
+            
+            scratchGPR1 = JITCompiler::selectScratchGPR();
+            scratchGPR2 = JITCompiler::selectScratchGPR(scratchGPR1);
+            scratchGPR3 = JITCompiler::selectScratchGPR(scratchGPR1, scratchGPR2);
+            
+            m_jit.move(TrustedImm32(numUsedStackSlots), scratchGPR2);
+            JITCompiler::JumpList slowCase;
+            InlineCallFrame* inlineCallFrame;
+            if (node->child3())
+                inlineCallFrame = node->child3()->origin.semantic.inlineCallFrame;
+            else
+                inlineCallFrame = node->origin.semantic.inlineCallFrame;
+            emitSetupVarargsFrameFastCase(m_jit, scratchGPR2, scratchGPR1, scratchGPR2, scratchGPR3, inlineCallFrame, data->firstVarArgOffset, slowCase);
+            JITCompiler::Jump done = m_jit.jump();
+            slowCase.link(&m_jit);
+            callOperation(operationThrowStackOverflowForVarargs);
+            m_jit.exceptionCheck();
+            m_jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
+            done.link(&m_jit);
+            resultGPR = scratchGPR2;
+        } else {
+            GPRReg argumentsGPR;
+            GPRReg scratchGPR1;
+            GPRReg scratchGPR2;
+            GPRReg scratchGPR3;
+            
+            auto loadArgumentsGPR = [&] (GPRReg reservedGPR) {
+                if (reservedGPR != InvalidGPRReg)
+                    lock(reservedGPR);
+                JSValueOperand arguments(this, node->child3());
+                argumentsGPR = arguments.gpr();
+                if (reservedGPR != InvalidGPRReg)
+                    unlock(reservedGPR);
+                flushRegisters();
+                
+                scratchGPR1 = JITCompiler::selectScratchGPR(argumentsGPR, reservedGPR);
+                scratchGPR2 = JITCompiler::selectScratchGPR(argumentsGPR, scratchGPR1, reservedGPR);
+                scratchGPR3 = JITCompiler::selectScratchGPR(argumentsGPR, scratchGPR1, scratchGPR2, reservedGPR);
+            };
+            
+            loadArgumentsGPR(InvalidGPRReg);
+            
+            DFG_ASSERT(m_jit.graph(), node, isFlushed());
+            
+            // Right now, arguments is in argumentsGPR and the register file is flushed.
+            callOperation(operationSizeFrameForVarargs, GPRInfo::returnValueGPR, argumentsGPR, numUsedStackSlots, data->firstVarArgOffset);
+            m_jit.exceptionCheck();
+            
+            // Now we have the argument count of the callee frame, but we've lost the arguments operand.
+            // Reconstruct the arguments operand while preserving the callee frame.
+            loadArgumentsGPR(GPRInfo::returnValueGPR);
+            m_jit.move(TrustedImm32(numUsedStackSlots), scratchGPR1);
+            emitSetVarargsFrame(m_jit, GPRInfo::returnValueGPR, false, scratchGPR1, scratchGPR1);
+            m_jit.addPtr(TrustedImm32(-(sizeof(CallerFrameAndPC) + WTF::roundUpToMultipleOf(stackAlignmentBytes(), 5 * sizeof(void*)))), scratchGPR1, JITCompiler::stackPointerRegister);
+            
+            callOperation(operationSetupVarargsFrame, GPRInfo::returnValueGPR, scratchGPR1, argumentsGPR, data->firstVarArgOffset, GPRInfo::returnValueGPR);
+            m_jit.exceptionCheck();
+            resultGPR = GPRInfo::returnValueGPR;
+        }
+        
+        m_jit.addPtr(TrustedImm32(sizeof(CallerFrameAndPC)), resultGPR, JITCompiler::stackPointerRegister);
+        
+        DFG_ASSERT(m_jit.graph(), node, isFlushed());
+        
+        // We don't need the arguments array anymore.
+        if (isVarargs)
+            use(node->child3());
+
+        // Now set up the "this" argument.
+        JSValueOperand thisArgument(this, node->child2());
+        GPRReg thisArgumentGPR = thisArgument.gpr();
+        thisArgument.use();
+        
+        m_jit.store64(thisArgumentGPR, JITCompiler::calleeArgumentSlot(0));
+    } else {
+        // The call instruction's first child is the function; the subsequent children are the
+        // arguments.
+        numPassedArgs = node->numChildren() - 1;
+        numAllocatedArgs = numPassedArgs;
+        
+        if (functionExecutable) {
+            // Allocate more args if this would let us avoid arity checks. This is throttled by
+            // CallLinkInfo's limit. It's probably good to throttle it - if the callee wants a
+            // ginormous amount of argument space then it's better for them to do it so that when we
+            // make calls to other things, we don't waste space.
+            unsigned desiredNumAllocatedArgs = static_cast<unsigned>(functionExecutable->parameterCount()) + 1;
+            if (desiredNumAllocatedArgs <= Options::maximumDirectCallStackSize()) {
+                numAllocatedArgs = std::max(numAllocatedArgs, desiredNumAllocatedArgs);
+                
+                // Whoever converts to DirectCall should do this adjustment. It's too late for us to
+                // do this adjustment now since we will have already emitted code that relied on the
+                // value of m_parameterSlots.
+                DFG_ASSERT(
+                    m_jit.graph(), node,
+                    Graph::parameterSlotsForArgCount(numAllocatedArgs)
+                    <= m_jit.graph().m_parameterSlots);
+            }
+        }
+
+        if (isTail) {
+            Edge calleeEdge = m_jit.graph().child(node, 0);
+            JSValueOperand callee(this, calleeEdge);
+            calleeGPR = callee.gpr();
+            if (!isDirect)
+                callee.use();
+
+            shuffleData.tagTypeNumber = GPRInfo::tagTypeNumberRegister;
+            shuffleData.numLocals = m_jit.graph().frameRegisterCount();
+            shuffleData.callee = ValueRecovery::inGPR(calleeGPR, DataFormatJS);
+            shuffleData.args.resize(numAllocatedArgs);
+            shuffleData.numPassedArgs = numPassedArgs;
+            
+            for (unsigned i = 0; i < numPassedArgs; ++i) {
+                Edge argEdge = m_jit.graph().varArgChild(node, i + 1);
+                GenerationInfo& info = generationInfo(argEdge.node());
+                if (!isDirect)
+                    use(argEdge);
+                shuffleData.args[i] = info.recovery(argEdge->virtualRegister());
+            }
+            
+            for (unsigned i = numPassedArgs; i < numAllocatedArgs; ++i)
+                shuffleData.args[i] = ValueRecovery::constant(jsUndefined());
+
+            shuffleData.setupCalleeSaveRegisters(m_jit.codeBlock());
+        } else {
+            m_jit.store32(MacroAssembler::TrustedImm32(numPassedArgs), JITCompiler::calleeFramePayloadSlot(CallFrameSlot::argumentCount));
+
+            for (unsigned i = 0; i < numPassedArgs; i++) {
+                Edge argEdge = m_jit.graph().m_varArgChildren[node->firstChild() + 1 + i];
+                JSValueOperand arg(this, argEdge);
+                GPRReg argGPR = arg.gpr();
+                use(argEdge);
+                
+                m_jit.store64(argGPR, JITCompiler::calleeArgumentSlot(i));
+            }
+            
+            for (unsigned i = numPassedArgs; i < numAllocatedArgs; ++i)
+                m_jit.storeTrustedValue(jsUndefined(), JITCompiler::calleeArgumentSlot(i));
+        }
+    }
+    
+    if (!isTail || isVarargs || isForwardVarargs) {
+        Edge calleeEdge = m_jit.graph().child(node, 0);
+        JSValueOperand callee(this, calleeEdge);
+        calleeGPR = callee.gpr();
+        callee.use();
+        m_jit.store64(calleeGPR, JITCompiler::calleeFrameSlot(CallFrameSlot::callee));
+
+        flushRegisters();
+    }
+
+    CodeOrigin staticOrigin = node->origin.semantic;
+    ASSERT(!isTail || !staticOrigin.inlineCallFrame || !staticOrigin.inlineCallFrame->getCallerSkippingTailCalls());
+    ASSERT(!isEmulatedTail || (staticOrigin.inlineCallFrame && staticOrigin.inlineCallFrame->getCallerSkippingTailCalls()));
+    CodeOrigin dynamicOrigin =
+        isEmulatedTail ? *staticOrigin.inlineCallFrame->getCallerSkippingTailCalls() : staticOrigin;
+
+    CallSiteIndex callSite = m_jit.recordCallSiteAndGenerateExceptionHandlingOSRExitIfNeeded(dynamicOrigin, m_stream->size());
+    
+    auto setResultAndResetStack = [&] () {
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+        m_jit.move(GPRInfo::returnValueGPR, resultGPR);
+
+        jsValueResult(resultGPR, m_currentNode, DataFormatJS, UseChildrenCalledExplicitly);
+
+        // After the calls are done, we need to reestablish our stack
+        // pointer. We rely on this for varargs calls, calls with arity
+        // mismatch (the callframe is slided) and tail calls.
+        m_jit.addPtr(TrustedImm32(m_jit.graph().stackPointerOffset() * sizeof(Register)), GPRInfo::callFrameRegister, JITCompiler::stackPointerRegister);
+    };
+    
+    CallLinkInfo* callLinkInfo = m_jit.codeBlock()->addCallLinkInfo();
+    callLinkInfo->setUpCall(callType, m_currentNode->origin.semantic, calleeGPR);
+
+    if (node->op() == CallEval) {
+        // We want to call operationCallEval but we don't want to overwrite the parameter area in
+        // which we have created a prototypical eval call frame. This means that we have to
+        // subtract stack to make room for the call. Lucky for us, at this point we have the whole
+        // register file to ourselves.
+        
+        m_jit.emitStoreCallSiteIndex(callSite);
+        m_jit.addPtr(TrustedImm32(-static_cast<ptrdiff_t>(sizeof(CallerFrameAndPC))), JITCompiler::stackPointerRegister, GPRInfo::regT0);
+        m_jit.storePtr(GPRInfo::callFrameRegister, JITCompiler::Address(GPRInfo::regT0, CallFrame::callerFrameOffset()));
+        
+        // Now we need to make room for:
+        // - The caller frame and PC of a call to operationCallEval.
+        // - Potentially two arguments on the stack.
+        unsigned requiredBytes = sizeof(CallerFrameAndPC) + sizeof(ExecState*) * 2;
+        requiredBytes = WTF::roundUpToMultipleOf(stackAlignmentBytes(), requiredBytes);
+        m_jit.subPtr(TrustedImm32(requiredBytes), JITCompiler::stackPointerRegister);
+        m_jit.setupArgumentsWithExecState(GPRInfo::regT0);
+        prepareForExternalCall();
+        m_jit.appendCall(operationCallEval);
+        m_jit.exceptionCheck();
+        JITCompiler::Jump done = m_jit.branchTest64(JITCompiler::NonZero, GPRInfo::returnValueGPR);
+        
+        // This is the part where we meant to make a normal call. Oops.
+        m_jit.addPtr(TrustedImm32(requiredBytes), JITCompiler::stackPointerRegister);
+        m_jit.load64(JITCompiler::calleeFrameSlot(CallFrameSlot::callee), GPRInfo::regT0);
+        m_jit.emitDumbVirtualCall(callLinkInfo);
+        
+        done.link(&m_jit);
+        setResultAndResetStack();
+        return;
+    }
+    
+    if (isDirect) {
+        callLinkInfo->setExecutableDuringCompilation(executable);
+        callLinkInfo->setMaxNumArguments(numAllocatedArgs);
+
+        if (isTail) {
+            RELEASE_ASSERT(node->op() == DirectTailCall);
+            
+            JITCompiler::PatchableJump patchableJump = m_jit.patchableJump();
+            JITCompiler::Label mainPath = m_jit.label();
+            
+            m_jit.emitStoreCallSiteIndex(callSite);
+            
+            callLinkInfo->setFrameShuffleData(shuffleData);
+            CallFrameShuffler(m_jit, shuffleData).prepareForTailCall();
+            
+            JITCompiler::Call call = m_jit.nearTailCall();
+            
+            JITCompiler::Label slowPath = m_jit.label();
+            patchableJump.m_jump.linkTo(slowPath, &m_jit);
+            
+            silentSpillAllRegisters(InvalidGPRReg);
+            callOperation(operationLinkDirectCall, callLinkInfo, calleeGPR);
+            silentFillAllRegisters(InvalidGPRReg);
+            m_jit.exceptionCheck();
+            m_jit.jump().linkTo(mainPath, &m_jit);
+            
+            useChildren(node);
+            
+            m_jit.addJSDirectTailCall(patchableJump, call, slowPath, callLinkInfo);
+            return;
+        }
+        
+        JITCompiler::Label mainPath = m_jit.label();
+        
+        m_jit.emitStoreCallSiteIndex(callSite);
+        
+        JITCompiler::Call call = m_jit.nearCall();
+        JITCompiler::Jump done = m_jit.jump();
+        
+        JITCompiler::Label slowPath = m_jit.label();
+        if (isX86())
+            m_jit.pop(JITCompiler::selectScratchGPR(calleeGPR));
+
+        callOperation(operationLinkDirectCall, callLinkInfo, calleeGPR);
+        m_jit.exceptionCheck();
+        m_jit.jump().linkTo(mainPath, &m_jit);
+        
+        done.link(&m_jit);
+        
+        setResultAndResetStack();
+        
+        m_jit.addJSDirectCall(call, slowPath, callLinkInfo);
+        return;
+    }
+    
+    m_jit.emitStoreCallSiteIndex(callSite);
+    
+    JITCompiler::DataLabelPtr targetToCheck;
+    JITCompiler::Jump slowPath = m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleeGPR, targetToCheck, TrustedImmPtr(0));
+
+    if (isTail) {
+        if (node->op() == TailCall) {
+            callLinkInfo->setFrameShuffleData(shuffleData);
+            CallFrameShuffler(m_jit, shuffleData).prepareForTailCall();
+        } else {
+            m_jit.emitRestoreCalleeSaves();
+            m_jit.prepareForTailCallSlow();
+        }
+    }
+
+    JITCompiler::Call fastCall = isTail ? m_jit.nearTailCall() : m_jit.nearCall();
+
+    JITCompiler::Jump done = m_jit.jump();
+
+    slowPath.link(&m_jit);
+
+    if (node->op() == TailCall) {
+        CallFrameShuffler callFrameShuffler(m_jit, shuffleData);
+        callFrameShuffler.setCalleeJSValueRegs(JSValueRegs(GPRInfo::regT0));
+        callFrameShuffler.prepareForSlowPath();
+    } else {
+        m_jit.move(calleeGPR, GPRInfo::regT0); // Callee needs to be in regT0
+
+        if (isTail)
+            m_jit.emitRestoreCalleeSaves(); // This needs to happen after we moved calleeGPR to regT0
+    }
+
+    m_jit.move(TrustedImmPtr(callLinkInfo), GPRInfo::regT2); // Link info needs to be in regT2
+    JITCompiler::Call slowCall = m_jit.nearCall();
+
+    done.link(&m_jit);
+
+    if (isTail)
+        m_jit.abortWithReason(JITDidReturnFromTailCall);
+    else
+        setResultAndResetStack();
+
+    m_jit.addJSCall(fastCall, slowCall, targetToCheck, callLinkInfo);
+}
+
+// Clang should allow unreachable [[clang::fallthrough]] in template functions if any template expansion uses it
+// http://llvm.org/bugs/show_bug.cgi?id=18619
+#if COMPILER(CLANG) && defined(__has_warning)
+#pragma clang diagnostic push
+#if __has_warning("-Wimplicit-fallthrough")
+#pragma clang diagnostic ignored "-Wimplicit-fallthrough"
+#endif
+#endif
+template<bool strict>
+GPRReg SpeculativeJIT::fillSpeculateInt32Internal(Edge edge, DataFormat& returnFormat)
+{
+    AbstractValue& value = m_state.forNode(edge);
+    SpeculatedType type = value.m_type;
+    ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32Only));
+
+    m_interpreter.filter(value, SpecInt32Only);
+    if (value.isClear()) {
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        returnFormat = DataFormatInt32;
+        return allocate();
+    }
+
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+
+        if (edge->hasConstant()) {
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            ASSERT(edge->isInt32Constant());
+            m_jit.move(MacroAssembler::Imm32(edge->asInt32()), gpr);
+            info.fillInt32(*m_stream, gpr);
+            returnFormat = DataFormatInt32;
+            return gpr;
+        }
+        
+        DataFormat spillFormat = info.spillFormat();
+        
+        DFG_ASSERT(m_jit.graph(), m_currentNode, (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
+        
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        
+        if (spillFormat == DataFormatJSInt32 || spillFormat == DataFormatInt32) {
+            // If we know this was spilled as an integer we can fill without checking.
+            if (strict) {
+                m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
+                info.fillInt32(*m_stream, gpr);
+                returnFormat = DataFormatInt32;
+                return gpr;
+            }
+            if (spillFormat == DataFormatInt32) {
+                m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
+                info.fillInt32(*m_stream, gpr);
+                returnFormat = DataFormatInt32;
+            } else {
+                m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
+                info.fillJSValue(*m_stream, gpr, DataFormatJSInt32);
+                returnFormat = DataFormatJSInt32;
+            }
+            return gpr;
+        }
+        m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
+
+        // Fill as JSValue, and fall through.
+        info.fillJSValue(*m_stream, gpr, DataFormatJSInt32);
+        m_gprs.unlock(gpr);
+        FALLTHROUGH;
+    }
+
+    case DataFormatJS: {
+        DFG_ASSERT(m_jit.graph(), m_currentNode, !(type & SpecInt52Only));
+        // Check the value is an integer.
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        if (type & ~SpecInt32Only)
+            speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branch64(MacroAssembler::Below, gpr, GPRInfo::tagTypeNumberRegister));
+        info.fillJSValue(*m_stream, gpr, DataFormatJSInt32);
+        // If !strict we're done, return.
+        if (!strict) {
+            returnFormat = DataFormatJSInt32;
+            return gpr;
+        }
+        // else fall through & handle as DataFormatJSInt32.
+        m_gprs.unlock(gpr);
+        FALLTHROUGH;
+    }
+
+    case DataFormatJSInt32: {
+        // In a strict fill we need to strip off the value tag.
+        if (strict) {
+            GPRReg gpr = info.gpr();
+            GPRReg result;
+            // If the register has already been locked we need to take a copy.
+            // If not, we'll zero extend in place, so mark on the info that this is now type DataFormatInt32, not DataFormatJSInt32.
+            if (m_gprs.isLocked(gpr))
+                result = allocate();
+            else {
+                m_gprs.lock(gpr);
+                info.fillInt32(*m_stream, gpr);
+                result = gpr;
+            }
+            m_jit.zeroExtend32ToPtr(gpr, result);
+            returnFormat = DataFormatInt32;
+            return result;
+        }
+
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        returnFormat = DataFormatJSInt32;
+        return gpr;
+    }
+
+    case DataFormatInt32: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        returnFormat = DataFormatInt32;
+        return gpr;
+    }
+        
+    case DataFormatJSDouble:
+    case DataFormatCell:
+    case DataFormatBoolean:
+    case DataFormatJSCell:
+    case DataFormatJSBoolean:
+    case DataFormatDouble:
+    case DataFormatStorage:
+    case DataFormatInt52:
+    case DataFormatStrictInt52:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
+        
+    default:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
+        return InvalidGPRReg;
+    }
+}
+#if COMPILER(CLANG) && defined(__has_warning)
+#pragma clang diagnostic pop
+#endif
+
+GPRReg SpeculativeJIT::fillSpeculateInt32(Edge edge, DataFormat& returnFormat)
+{
+    return fillSpeculateInt32Internal<false>(edge, returnFormat);
+}
+
+GPRReg SpeculativeJIT::fillSpeculateInt32Strict(Edge edge)
+{
+    DataFormat mustBeDataFormatInt32;
+    GPRReg result = fillSpeculateInt32Internal<true>(edge, mustBeDataFormatInt32);
+    DFG_ASSERT(m_jit.graph(), m_currentNode, mustBeDataFormatInt32 == DataFormatInt32);
+    return result;
+}
+
+GPRReg SpeculativeJIT::fillSpeculateInt52(Edge edge, DataFormat desiredFormat)
+{
+    ASSERT(desiredFormat == DataFormatInt52 || desiredFormat == DataFormatStrictInt52);
+    AbstractValue& value = m_state.forNode(edge);
+
+    m_interpreter.filter(value, SpecAnyInt);
+    if (value.isClear()) {
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        return allocate();
+    }
+
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+
+        if (edge->hasConstant()) {
+            JSValue jsValue = edge->asJSValue();
+            ASSERT(jsValue.isAnyInt());
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            int64_t value = jsValue.asAnyInt();
+            if (desiredFormat == DataFormatInt52)
+                value = value << JSValue::int52ShiftAmount;
+            m_jit.move(MacroAssembler::Imm64(value), gpr);
+            info.fillGPR(*m_stream, gpr, desiredFormat);
+            return gpr;
+        }
+        
+        DataFormat spillFormat = info.spillFormat();
+        
+        DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
+        
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        
+        m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
+        if (desiredFormat == DataFormatStrictInt52) {
+            if (spillFormat == DataFormatInt52)
+                m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
+            info.fillStrictInt52(*m_stream, gpr);
+            return gpr;
+        }
+        if (spillFormat == DataFormatStrictInt52)
+            m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
+        info.fillInt52(*m_stream, gpr);
+        return gpr;
+    }
+
+    case DataFormatStrictInt52: {
+        GPRReg gpr = info.gpr();
+        bool wasLocked = m_gprs.isLocked(gpr);
+        lock(gpr);
+        if (desiredFormat == DataFormatStrictInt52)
+            return gpr;
+        if (wasLocked) {
+            GPRReg result = allocate();
+            m_jit.move(gpr, result);
+            unlock(gpr);
+            gpr = result;
+        } else
+            info.fillInt52(*m_stream, gpr);
+        m_jit.lshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
+        return gpr;
+    }
+        
+    case DataFormatInt52: {
+        GPRReg gpr = info.gpr();
+        bool wasLocked = m_gprs.isLocked(gpr);
+        lock(gpr);
+        if (desiredFormat == DataFormatInt52)
+            return gpr;
+        if (wasLocked) {
+            GPRReg result = allocate();
+            m_jit.move(gpr, result);
+            unlock(gpr);
+            gpr = result;
+        } else
+            info.fillStrictInt52(*m_stream, gpr);
+        m_jit.rshift64(TrustedImm32(JSValue::int52ShiftAmount), gpr);
+        return gpr;
+    }
+
+    default:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
+        return InvalidGPRReg;
+    }
+}
+
+FPRReg SpeculativeJIT::fillSpeculateDouble(Edge edge)
+{
+    ASSERT(edge.useKind() == DoubleRepUse || edge.useKind() == DoubleRepRealUse || edge.useKind() == DoubleRepAnyIntUse);
+    ASSERT(edge->hasDoubleResult());
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    if (info.registerFormat() == DataFormatNone) {
+        if (edge->hasConstant()) {
+            if (edge->isNumberConstant()) {
+                FPRReg fpr = fprAllocate();
+                int64_t doubleAsInt = reinterpretDoubleToInt64(edge->asNumber());
+                if (!doubleAsInt)
+                    m_jit.moveZeroToDouble(fpr);
+                else {
+                    GPRReg gpr = allocate();
+                    m_jit.move(MacroAssembler::Imm64(doubleAsInt), gpr);
+                    m_jit.move64ToDouble(gpr, fpr);
+                    unlock(gpr);
+                }
+
+                m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+                info.fillDouble(*m_stream, fpr);
+                return fpr;
+            }
+            terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+            return fprAllocate();
+        }
+        
+        DataFormat spillFormat = info.spillFormat();
+        if (spillFormat != DataFormatDouble) {
+            DFG_CRASH(
+                m_jit.graph(), m_currentNode, toCString(
+                    "Expected ", edge, " to have double format but instead it is spilled as ",
+                    dataFormatToString(spillFormat)).data());
+        }
+        DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatDouble);
+        FPRReg fpr = fprAllocate();
+        m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
+        m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
+        info.fillDouble(*m_stream, fpr);
+        return fpr;
+    }
+
+    DFG_ASSERT(m_jit.graph(), m_currentNode, info.registerFormat() == DataFormatDouble);
+    FPRReg fpr = info.fpr();
+    m_fprs.lock(fpr);
+    return fpr;
+}
+
+GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge)
+{
+    AbstractValue& value = m_state.forNode(edge);
+    SpeculatedType type = value.m_type;
+    ASSERT((edge.useKind() != KnownCellUse && edge.useKind() != KnownStringUse) || !(value.m_type & ~SpecCell));
+
+    m_interpreter.filter(value, SpecCell);
+    if (value.isClear()) {
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        return allocate();
+    }
+
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+
+        if (edge->hasConstant()) {
+            JSValue jsValue = edge->asJSValue();
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
+            info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
+            return gpr;
+        }
+
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
+
+        info.fillJSValue(*m_stream, gpr, DataFormatJS);
+        if (type & ~SpecCell)
+            speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchIfNotCell(JSValueRegs(gpr)));
+        info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
+        return gpr;
+    }
+
+    case DataFormatCell:
+    case DataFormatJSCell: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        if (!ASSERT_DISABLED) {
+            MacroAssembler::Jump checkCell = m_jit.branchIfCell(JSValueRegs(gpr));
+            m_jit.abortWithReason(DFGIsNotCell);
+            checkCell.link(&m_jit);
+        }
+        return gpr;
+    }
+
+    case DataFormatJS: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        if (type & ~SpecCell)
+            speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchIfNotCell(JSValueRegs(gpr)));
+        info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
+        return gpr;
+    }
+
+    case DataFormatJSInt32:
+    case DataFormatInt32:
+    case DataFormatJSDouble:
+    case DataFormatJSBoolean:
+    case DataFormatBoolean:
+    case DataFormatDouble:
+    case DataFormatStorage:
+    case DataFormatInt52:
+    case DataFormatStrictInt52:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
+        
+    default:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
+        return InvalidGPRReg;
+    }
+}
+
+GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge)
+{
+    AbstractValue& value = m_state.forNode(edge);
+    SpeculatedType type = value.m_type;
+    ASSERT(edge.useKind() != KnownBooleanUse || !(value.m_type & ~SpecBoolean));
+
+    m_interpreter.filter(value, SpecBoolean);
+    if (value.isClear()) {
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        return allocate();
+    }
+
+    VirtualRegister virtualRegister = edge->virtualRegister();
+    GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
+
+    switch (info.registerFormat()) {
+    case DataFormatNone: {
+        GPRReg gpr = allocate();
+
+        if (edge->hasConstant()) {
+            JSValue jsValue = edge->asJSValue();
+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
+            info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
+            return gpr;
+        }
+        DFG_ASSERT(m_jit.graph(), m_currentNode, info.spillFormat() & DataFormatJS);
+        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
+        m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
+
+        info.fillJSValue(*m_stream, gpr, DataFormatJS);
+        if (type & ~SpecBoolean) {
+            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);
+            speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchTest64(MacroAssembler::NonZero, gpr, TrustedImm32(static_cast<int32_t>(~1))), SpeculationRecovery(BooleanSpeculationCheck, gpr, InvalidGPRReg));
+            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);
+        }
+        info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
+        return gpr;
+    }
+
+    case DataFormatBoolean:
+    case DataFormatJSBoolean: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        return gpr;
+    }
+
+    case DataFormatJS: {
+        GPRReg gpr = info.gpr();
+        m_gprs.lock(gpr);
+        if (type & ~SpecBoolean) {
+            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);
+            speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchTest64(MacroAssembler::NonZero, gpr, TrustedImm32(static_cast<int32_t>(~1))), SpeculationRecovery(BooleanSpeculationCheck, gpr, InvalidGPRReg));
+            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);
+        }
+        info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
+        return gpr;
+    }
+
+    case DataFormatJSInt32:
+    case DataFormatInt32:
+    case DataFormatJSDouble:
+    case DataFormatJSCell:
+    case DataFormatCell:
+    case DataFormatDouble:
+    case DataFormatStorage:
+    case DataFormatInt52:
+    case DataFormatStrictInt52:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
+        
+    default:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
+        return InvalidGPRReg;
+    }
+}
+
+void SpeculativeJIT::compileObjectEquality(Node* node)
+{
+    SpeculateCellOperand op1(this, node->child1());
+    SpeculateCellOperand op2(this, node->child2());
+    GPRTemporary result(this, Reuse, op1);
+    
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.gpr();
+    GPRReg resultGPR = result.gpr();
+   
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchIfNotObject(op1GPR));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchIfNotObject(op2GPR));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op2GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+
+    m_jit.compare64(MacroAssembler::Equal, op1GPR, op2GPR, resultGPR);
+    m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+    jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean);
+}
+
+void SpeculativeJIT::compileObjectStrictEquality(Edge objectChild, Edge otherChild)
+{
+    SpeculateCellOperand op1(this, objectChild);
+    JSValueOperand op2(this, otherChild);
+    GPRTemporary result(this);
+
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.gpr();
+    GPRReg resultGPR = result.gpr();
+
+    DFG_TYPE_CHECK(JSValueSource::unboxedCell(op1GPR), objectChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+
+    // At this point we know that we can perform a straight-forward equality comparison on pointer
+    // values because we are doing strict equality.
+    m_jit.compare64(MacroAssembler::Equal, op1GPR, op2GPR, resultGPR);
+    m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+    jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean);
+}
+    
+void SpeculativeJIT::compilePeepHoleObjectStrictEquality(Edge objectChild, Edge otherChild, Node* branchNode)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+    
+    SpeculateCellOperand op1(this, objectChild);
+    JSValueOperand op2(this, otherChild);
+    
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.gpr();
+    
+    DFG_TYPE_CHECK(JSValueSource::unboxedCell(op1GPR), objectChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+
+    if (taken == nextBlock()) {
+        branchPtr(MacroAssembler::NotEqual, op1GPR, op2GPR, notTaken);
+        jump(taken);
+    } else {
+        branchPtr(MacroAssembler::Equal, op1GPR, op2GPR, taken);
+        jump(notTaken);
+    }
+}
+
+void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)
+{
+    SpeculateCellOperand op1(this, leftChild);
+    JSValueOperand op2(this, rightChild, ManualOperandSpeculation);
+    GPRTemporary result(this);
+    
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.gpr();
+    GPRReg resultGPR = result.gpr();
+
+    bool masqueradesAsUndefinedWatchpointValid =
+        masqueradesAsUndefinedWatchpointIsStillValid();
+
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+    
+    // It seems that most of the time when programs do a == b where b may be either null/undefined
+    // or an object, b is usually an object. Balance the branches to make that case fast.
+    MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(JSValueRegs(op2GPR));
+    
+    // We know that within this branch, rightChild must be a cell. 
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2GPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2GPR));
+        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op2GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+    
+    // At this point we know that we can perform a straight-forward equality comparison on pointer
+    // values because both left and right are pointers to objects that have no special equality
+    // protocols.
+    m_jit.compare64(MacroAssembler::Equal, op1GPR, op2GPR, resultGPR);
+    MacroAssembler::Jump done = m_jit.jump();
+    
+    rightNotCell.link(&m_jit);
+    
+    // We know that within this branch, rightChild must not be a cell. Check if that is enough to
+    // prove that it is either null or undefined.
+    if (needsTypeCheck(rightChild, SpecCell | SpecOther)) {
+        m_jit.move(op2GPR, resultGPR);
+        m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);
+        
+        typeCheck(
+            JSValueRegs(op2GPR), rightChild, SpecCell | SpecOther,
+            m_jit.branch64(
+                MacroAssembler::NotEqual, resultGPR,
+                MacroAssembler::TrustedImm64(ValueNull)));
+    }
+    m_jit.move(TrustedImm32(0), result.gpr());
+
+    done.link(&m_jit);
+    m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+    jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean);
+}
+
+void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, Node* branchNode)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+    
+    SpeculateCellOperand op1(this, leftChild);
+    JSValueOperand op2(this, rightChild, ManualOperandSpeculation);
+    GPRTemporary result(this);
+    
+    GPRReg op1GPR = op1.gpr();
+    GPRReg op2GPR = op2.gpr();
+    GPRReg resultGPR = result.gpr();
+    
+    bool masqueradesAsUndefinedWatchpointValid = 
+        masqueradesAsUndefinedWatchpointIsStillValid();
+
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchIfNotObject(op1GPR));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op1GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+
+    // It seems that most of the time when programs do a == b where b may be either null/undefined
+    // or an object, b is usually an object. Balance the branches to make that case fast.
+    MacroAssembler::Jump rightNotCell = m_jit.branchIfNotCell(JSValueRegs(op2GPR));
+    
+    // We know that within this branch, rightChild must be a cell. 
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2GPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(op2GPR));
+        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(op2GPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+    
+    // At this point we know that we can perform a straight-forward equality comparison on pointer
+    // values because both left and right are pointers to objects that have no special equality
+    // protocols.
+    branch64(MacroAssembler::Equal, op1GPR, op2GPR, taken);
+    
+    // We know that within this branch, rightChild must not be a cell. Check if that is enough to
+    // prove that it is either null or undefined.
+    if (!needsTypeCheck(rightChild, SpecCell | SpecOther))
+        rightNotCell.link(&m_jit);
+    else {
+        jump(notTaken, ForceJump);
+        
+        rightNotCell.link(&m_jit);
+        m_jit.move(op2GPR, resultGPR);
+        m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);
+        
+        typeCheck(
+            JSValueRegs(op2GPR), rightChild, SpecCell | SpecOther, m_jit.branch64(
+                MacroAssembler::NotEqual, resultGPR,
+                MacroAssembler::TrustedImm64(ValueNull)));
+    }
+    
+    jump(notTaken);
+}
+
+void SpeculativeJIT::compileSymbolUntypedEquality(Node* node, Edge symbolEdge, Edge untypedEdge)
+{
+    SpeculateCellOperand symbol(this, symbolEdge);
+    JSValueOperand untyped(this, untypedEdge);
+    GPRTemporary result(this, Reuse, symbol, untyped);
+
+    GPRReg symbolGPR = symbol.gpr();
+    GPRReg untypedGPR = untyped.gpr();
+    GPRReg resultGPR = result.gpr();
+
+    speculateSymbol(symbolEdge, symbolGPR);
+
+    // At this point we know that we can perform a straight-forward equality comparison on pointer
+    // values because we are doing strict equality.
+    m_jit.compare64(MacroAssembler::Equal, symbolGPR, untypedGPR, resultGPR);
+    unblessedBooleanResult(resultGPR, node);
+}
+
+void SpeculativeJIT::compileInt32Compare(Node* node, MacroAssembler::RelationalCondition condition)
+{
+    if (node->child1()->isInt32Constant()) {
+        SpeculateInt32Operand op2(this, node->child2());
+        GPRTemporary result(this, Reuse, op2);
+        int32_t imm = node->child1()->asInt32();
+        m_jit.compare32(condition, JITCompiler::Imm32(imm), op2.gpr(), result.gpr());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), m_currentNode, DataFormatJSBoolean);
+    } else if (node->child2()->isInt32Constant()) {
+        SpeculateInt32Operand op1(this, node->child1());
+        GPRTemporary result(this, Reuse, op1);
+        int32_t imm = node->child2()->asInt32();
+        m_jit.compare32(condition, op1.gpr(), JITCompiler::Imm32(imm), result.gpr());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), m_currentNode, DataFormatJSBoolean);
+    } else {
+        SpeculateInt32Operand op1(this, node->child1());
+        SpeculateInt32Operand op2(this, node->child2());
+        GPRTemporary result(this, Reuse, op1, op2);
+        m_jit.compare32(condition, op1.gpr(), op2.gpr(), result.gpr());
+
+        // If we add a DataFormatBool, we should use it here.
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), m_currentNode, DataFormatJSBoolean);
+    }
+}
+
+void SpeculativeJIT::compileInt52Compare(Node* node, MacroAssembler::RelationalCondition condition)
+{
+    SpeculateWhicheverInt52Operand op1(this, node->child1());
+    SpeculateWhicheverInt52Operand op2(this, node->child2(), op1);
+    GPRTemporary result(this, Reuse, op1, op2);
+    
+    m_jit.compare64(condition, op1.gpr(), op2.gpr(), result.gpr());
+    
+    // If we add a DataFormatBool, we should use it here.
+    m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+    jsValueResult(result.gpr(), m_currentNode, DataFormatJSBoolean);
+}
+
+void SpeculativeJIT::compilePeepHoleInt52Branch(Node* node, Node* branchNode, JITCompiler::RelationalCondition condition)
+{
+    BasicBlock* taken = branchNode->branchData()->taken.block;
+    BasicBlock* notTaken = branchNode->branchData()->notTaken.block;
+
+    // The branch instruction will branch to the taken block.
+    // If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.
+    if (taken == nextBlock()) {
+        condition = JITCompiler::invert(condition);
+        BasicBlock* tmp = taken;
+        taken = notTaken;
+        notTaken = tmp;
+    }
+    
+    SpeculateWhicheverInt52Operand op1(this, node->child1());
+    SpeculateWhicheverInt52Operand op2(this, node->child2(), op1);
+    
+    branch64(condition, op1.gpr(), op2.gpr(), taken);
+    jump(notTaken);
+}
+
+void SpeculativeJIT::compileDoubleCompare(Node* node, MacroAssembler::DoubleCondition condition)
+{
+    SpeculateDoubleOperand op1(this, node->child1());
+    SpeculateDoubleOperand op2(this, node->child2());
+    GPRTemporary result(this);
+    
+    m_jit.move(TrustedImm32(ValueTrue), result.gpr());
+    MacroAssembler::Jump trueCase = m_jit.branchDouble(condition, op1.fpr(), op2.fpr());
+    m_jit.xor64(TrustedImm32(true), result.gpr());
+    trueCase.link(&m_jit);
+    
+    jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+}
+
+void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse)
+{
+    JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
+    GPRTemporary result(this);
+    GPRReg valueGPR = value.gpr();
+    GPRReg resultGPR = result.gpr();
+    GPRTemporary structure;
+    GPRReg structureGPR = InvalidGPRReg;
+    GPRTemporary scratch;
+    GPRReg scratchGPR = InvalidGPRReg;
+
+    bool masqueradesAsUndefinedWatchpointValid =
+        masqueradesAsUndefinedWatchpointIsStillValid();
+
+    if (!masqueradesAsUndefinedWatchpointValid) {
+        // The masquerades as undefined case will use the structure register, so allocate it here.
+        // Do this at the top of the function to avoid branching around a register allocation.
+        GPRTemporary realStructure(this);
+        GPRTemporary realScratch(this);
+        structure.adopt(realStructure);
+        scratch.adopt(realScratch);
+        structureGPR = structure.gpr();
+        scratchGPR = scratch.gpr();
+    }
+
+    MacroAssembler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
+    if (masqueradesAsUndefinedWatchpointValid) {
+        DFG_TYPE_CHECK(
+            JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(valueGPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(valueGPR));
+
+        MacroAssembler::Jump isNotMasqueradesAsUndefined = 
+            m_jit.branchTest8(
+                MacroAssembler::Zero, 
+                MacroAssembler::Address(valueGPR, JSCell::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined));
+
+        m_jit.emitLoadStructure(valueGPR, structureGPR, scratchGPR);
+        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(structureGPR, Structure::globalObjectOffset()), 
+                TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic))));
+
+        isNotMasqueradesAsUndefined.link(&m_jit);
+    }
+    m_jit.move(TrustedImm32(ValueFalse), resultGPR);
+    MacroAssembler::Jump done = m_jit.jump();
+    
+    notCell.link(&m_jit);
+
+    if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {
+        m_jit.move(valueGPR, resultGPR);
+        m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);
+        typeCheck(
+            JSValueRegs(valueGPR), nodeUse, SpecCell | SpecOther, m_jit.branch64(
+                MacroAssembler::NotEqual, 
+                resultGPR, 
+                MacroAssembler::TrustedImm64(ValueNull)));
+    }
+    m_jit.move(TrustedImm32(ValueTrue), resultGPR);
+    
+    done.link(&m_jit);
+    
+    jsValueResult(resultGPR, m_currentNode, DataFormatJSBoolean);
+}
+
+void SpeculativeJIT::compileLogicalNot(Node* node)
+{
+    switch (node->child1().useKind()) {
+    case ObjectOrOtherUse: {
+        compileObjectOrOtherLogicalNot(node->child1());
+        return;
+    }
+        
+    case Int32Use: {
+        SpeculateInt32Operand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value);
+        m_jit.compare32(MacroAssembler::Equal, value.gpr(), MacroAssembler::TrustedImm32(0), result.gpr());
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        return;
+    }
+        
+    case DoubleRepUse: {
+        SpeculateDoubleOperand value(this, node->child1());
+        FPRTemporary scratch(this);
+        GPRTemporary result(this);
+        m_jit.move(TrustedImm32(ValueFalse), result.gpr());
+        MacroAssembler::Jump nonZero = m_jit.branchDoubleNonZero(value.fpr(), scratch.fpr());
+        m_jit.xor32(TrustedImm32(true), result.gpr());
+        nonZero.link(&m_jit);
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        return;
+    }
+    
+    case BooleanUse:
+    case KnownBooleanUse: {
+        if (!needsTypeCheck(node->child1(), SpecBoolean)) {
+            SpeculateBooleanOperand value(this, node->child1());
+            GPRTemporary result(this, Reuse, value);
+            
+            m_jit.move(value.gpr(), result.gpr());
+            m_jit.xor64(TrustedImm32(true), result.gpr());
+            
+            jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+            return;
+        }
+        
+        JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
+        GPRTemporary result(this); // FIXME: We could reuse, but on speculation fail would need recovery to restore tag (akin to add).
+        
+        m_jit.move(value.gpr(), result.gpr());
+        m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), result.gpr());
+        typeCheck(
+            JSValueRegs(value.gpr()), node->child1(), SpecBoolean, m_jit.branchTest64(
+                JITCompiler::NonZero, result.gpr(), TrustedImm32(static_cast<int32_t>(~1))));
+        m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueTrue)), result.gpr());
+        
+        // If we add a DataFormatBool, we should use it here.
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        return;
+    }
+        
+    case UntypedUse: {
+        JSValueOperand arg1(this, node->child1());
+        GPRTemporary result(this);
+    
+        GPRReg arg1GPR = arg1.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        FPRTemporary valueFPR(this);
+        FPRTemporary tempFPR(this);
+
+        bool shouldCheckMasqueradesAsUndefined = !masqueradesAsUndefinedWatchpointIsStillValid();
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        std::optional<GPRTemporary> scratch;
+        GPRReg scratchGPR = InvalidGPRReg;
+        if (shouldCheckMasqueradesAsUndefined) {
+            scratch.emplace(this);
+            scratchGPR = scratch->gpr();
+        }
+        bool negateResult = true;
+        m_jit.emitConvertValueToBoolean(JSValueRegs(arg1GPR), resultGPR, scratchGPR, valueFPR.fpr(), tempFPR.fpr(), shouldCheckMasqueradesAsUndefined, globalObject, negateResult);
+        m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+        jsValueResult(resultGPR, node, DataFormatJSBoolean);
+        return;
+    }
+    case StringUse:
+        return compileStringZeroLength(node);
+
+    case StringOrOtherUse:
+        return compileLogicalNotStringOrOther(node);
+
+    default:
+        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        break;
+    }
+}
+
+void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
+{
+    JSValueOperand value(this, nodeUse, ManualOperandSpeculation);
+    GPRTemporary scratch(this);
+    GPRTemporary structure;
+    GPRReg valueGPR = value.gpr();
+    GPRReg scratchGPR = scratch.gpr();
+    GPRReg structureGPR = InvalidGPRReg;
+
+    if (!masqueradesAsUndefinedWatchpointIsStillValid()) {
+        GPRTemporary realStructure(this);
+        structure.adopt(realStructure);
+        structureGPR = structure.gpr();
+    }
+
+    MacroAssembler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
+    if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+        DFG_TYPE_CHECK(
+            JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(valueGPR));
+    } else {
+        DFG_TYPE_CHECK(
+            JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(valueGPR));
+
+        JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(
+            JITCompiler::Zero, 
+            MacroAssembler::Address(valueGPR, JSCell::typeInfoFlagsOffset()), 
+            TrustedImm32(MasqueradesAsUndefined));
+
+        m_jit.emitLoadStructure(valueGPR, structureGPR, scratchGPR);
+        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(structureGPR, Structure::globalObjectOffset()), 
+                TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic))));
+
+        isNotMasqueradesAsUndefined.link(&m_jit);
+    }
+    jump(taken, ForceJump);
+    
+    notCell.link(&m_jit);
+    
+    if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {
+        m_jit.move(valueGPR, scratchGPR);
+        m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), scratchGPR);
+        typeCheck(
+            JSValueRegs(valueGPR), nodeUse, SpecCell | SpecOther, m_jit.branch64(
+                MacroAssembler::NotEqual, scratchGPR, MacroAssembler::TrustedImm64(ValueNull)));
+    }
+    jump(notTaken);
+    
+    noResult(m_currentNode);
+}
+
+void SpeculativeJIT::emitBranch(Node* node)
+{
+    BasicBlock* taken = node->branchData()->taken.block;
+    BasicBlock* notTaken = node->branchData()->notTaken.block;
+    
+    switch (node->child1().useKind()) {
+    case ObjectOrOtherUse: {
+        emitObjectOrOtherBranch(node->child1(), taken, notTaken);
+        return;
+    }
+        
+    case Int32Use:
+    case DoubleRepUse: {
+        if (node->child1().useKind() == Int32Use) {
+            bool invert = false;
+            
+            if (taken == nextBlock()) {
+                invert = true;
+                BasicBlock* tmp = taken;
+                taken = notTaken;
+                notTaken = tmp;
+            }
+
+            SpeculateInt32Operand value(this, node->child1());
+            branchTest32(invert ? MacroAssembler::Zero : MacroAssembler::NonZero, value.gpr(), taken);
+        } else {
+            SpeculateDoubleOperand value(this, node->child1());
+            FPRTemporary scratch(this);
+            branchDoubleNonZero(value.fpr(), scratch.fpr(), taken);
+        }
+        
+        jump(notTaken);
+        
+        noResult(node);
+        return;
+    }
+
+    case StringUse: {
+        emitStringBranch(node->child1(), taken, notTaken);
+        return;
+    }
+
+    case StringOrOtherUse: {
+        emitStringOrOtherBranch(node->child1(), taken, notTaken);
+        return;
+    }
+
+    case UntypedUse:
+    case BooleanUse:
+    case KnownBooleanUse: {
+        JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
+        GPRReg valueGPR = value.gpr();
+        
+        if (node->child1().useKind() == BooleanUse || node->child1().useKind() == KnownBooleanUse) {
+            if (!needsTypeCheck(node->child1(), SpecBoolean)) {
+                MacroAssembler::ResultCondition condition = MacroAssembler::NonZero;
+                
+                if (taken == nextBlock()) {
+                    condition = MacroAssembler::Zero;
+                    BasicBlock* tmp = taken;
+                    taken = notTaken;
+                    notTaken = tmp;
+                }
+                
+                branchTest32(condition, valueGPR, TrustedImm32(true), taken);
+                jump(notTaken);
+            } else {
+                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(false))), notTaken);
+                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(true))), taken);
+                
+                typeCheck(JSValueRegs(valueGPR), node->child1(), SpecBoolean, m_jit.jump());
+            }
+            value.use();
+        } else {
+            GPRTemporary result(this);
+            FPRTemporary fprValue(this);
+            FPRTemporary fprTemp(this);
+            std::optional<GPRTemporary> scratch;
+
+            GPRReg scratchGPR = InvalidGPRReg;
+            bool shouldCheckMasqueradesAsUndefined = !masqueradesAsUndefinedWatchpointIsStillValid();
+            if (shouldCheckMasqueradesAsUndefined) {
+                scratch.emplace(this);
+                scratchGPR = scratch->gpr();
+            }
+
+            GPRReg resultGPR = result.gpr();
+            FPRReg valueFPR = fprValue.fpr();
+            FPRReg tempFPR = fprTemp.fpr();
+            
+            if (node->child1()->prediction() & SpecInt32Only) {
+                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(0))), notTaken);
+                branch64(MacroAssembler::AboveOrEqual, valueGPR, GPRInfo::tagTypeNumberRegister, taken);
+            }
+    
+            if (node->child1()->prediction() & SpecBoolean) {
+                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(false))), notTaken);
+                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(true))), taken);
+            }
+    
+            value.use();
+
+            JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+            m_jit.emitConvertValueToBoolean(JSValueRegs(valueGPR), resultGPR, scratchGPR, valueFPR, tempFPR, shouldCheckMasqueradesAsUndefined, globalObject);
+    
+            branchTest32(MacroAssembler::NonZero, resultGPR, taken);
+            jump(notTaken);
+        }
+        
+        noResult(node, UseChildrenCalledExplicitly);
+        return;
+    }
+        
+    default:
+        DFG_CRASH(m_jit.graph(), m_currentNode, "Bad use kind");
+    }
+}
+
+void SpeculativeJIT::compile(Node* node)
+{
+    NodeType op = node->op();
+    
+#if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION)
+    m_jit.clearRegisterAllocationOffsets();
+#endif
+
+    switch (op) {
+    case JSConstant:
+    case DoubleConstant:
+    case Int52Constant:
+    case PhantomDirectArguments:
+    case PhantomClonedArguments:
+        initConstantInfo(node);
+        break;
+
+    case LazyJSConstant:
+        compileLazyJSConstant(node);
+        break;
+
+    case Identity: {
+        speculate(node, node->child1());
+        switch (node->child1().useKind()) {
+        case DoubleRepUse:
+        case DoubleRepRealUse:
+        case DoubleRepAnyIntUse: {
+            SpeculateDoubleOperand op(this, node->child1());
+            FPRTemporary scratch(this, op);
+            m_jit.moveDouble(op.fpr(), scratch.fpr());
+            doubleResult(scratch.fpr(), node);
+            break;
+        }
+        case Int52RepUse: {
+            SpeculateInt52Operand op(this, node->child1());
+            GPRTemporary result(this, Reuse, op);
+            m_jit.move(op.gpr(), result.gpr());
+            int52Result(result.gpr(), node);
+            break;
+        }
+        default: {
+            JSValueOperand op(this, node->child1());
+            GPRTemporary result(this, Reuse, op);
+            m_jit.move(op.gpr(), result.gpr());
+            jsValueResult(result.gpr(), node);
+            break;
+        }
+        } // switch
+        break;
+    }
+
+    case GetLocal: {
+        AbstractValue& value = m_state.variables().operand(node->local());
+
+        // If the CFA is tracking this variable and it found that the variable
+        // cannot have been assigned, then don't attempt to proceed.
+        if (value.isClear()) {
+            m_compileOkay = false;
+            break;
+        }
+        
+        switch (node->variableAccessData()->flushFormat()) {
+        case FlushedDouble: {
+            FPRTemporary result(this);
+            m_jit.loadDouble(JITCompiler::addressFor(node->machineLocal()), result.fpr());
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_fprs.retain(result.fpr(), virtualRegister, SpillOrderDouble);
+            generationInfoFromVirtualRegister(virtualRegister).initDouble(node, node->refCount(), result.fpr());
+            break;
+        }
+        
+        case FlushedInt32: {
+            GPRTemporary result(this);
+            m_jit.load32(JITCompiler::payloadFor(node->machineLocal()), result.gpr());
+            
+            // Like int32Result, but don't useChildren - our children are phi nodes,
+            // and don't represent values within this dataflow with virtual registers.
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderInteger);
+            generationInfoFromVirtualRegister(virtualRegister).initInt32(node, node->refCount(), result.gpr());
+            break;
+        }
+            
+        case FlushedInt52: {
+            GPRTemporary result(this);
+            m_jit.load64(JITCompiler::addressFor(node->machineLocal()), result.gpr());
+            
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderJS);
+            generationInfoFromVirtualRegister(virtualRegister).initInt52(node, node->refCount(), result.gpr());
+            break;
+        }
+            
+        default:
+            GPRTemporary result(this);
+            m_jit.load64(JITCompiler::addressFor(node->machineLocal()), result.gpr());
+            
+            // Like jsValueResult, but don't useChildren - our children are phi nodes,
+            // and don't represent values within this dataflow with virtual registers.
+            VirtualRegister virtualRegister = node->virtualRegister();
+            m_gprs.retain(result.gpr(), virtualRegister, SpillOrderJS);
+            
+            DataFormat format;
+            if (isCellSpeculation(value.m_type))
+                format = DataFormatJSCell;
+            else if (isBooleanSpeculation(value.m_type))
+                format = DataFormatJSBoolean;
+            else
+                format = DataFormatJS;
+            
+            generationInfoFromVirtualRegister(virtualRegister).initJSValue(node, node->refCount(), result.gpr(), format);
+            break;
+        }
+        break;
+    }
+
+    case GetLocalUnlinked: {
+        GPRTemporary result(this);
+        
+        m_jit.load64(JITCompiler::addressFor(node->unlinkedMachineLocal()), result.gpr());
+        
+        jsValueResult(result.gpr(), node);
+        break;
+    }
+        
+    case MovHint: {
+        compileMovHint(m_currentNode);
+        noResult(node);
+        break;
+    }
+        
+    case ZombieHint: {
+        recordSetLocal(m_currentNode->unlinkedLocal(), VirtualRegister(), DataFormatDead);
+        noResult(node);
+        break;
+    }
+        
+    case ExitOK: {
+        noResult(node);
+        break;
+    }
+        
+    case SetLocal: {
+        switch (node->variableAccessData()->flushFormat()) {
+        case FlushedDouble: {
+            SpeculateDoubleOperand value(this, node->child1());
+            m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node->machineLocal()));
+            noResult(node);
+            // Indicate that it's no longer necessary to retrieve the value of
+            // this bytecode variable from registers or other locations in the stack,
+            // but that it is stored as a double.
+            recordSetLocal(DataFormatDouble);
+            break;
+        }
+            
+        case FlushedInt32: {
+            SpeculateInt32Operand value(this, node->child1());
+            m_jit.store32(value.gpr(), JITCompiler::payloadFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(DataFormatInt32);
+            break;
+        }
+            
+        case FlushedInt52: {
+            SpeculateInt52Operand value(this, node->child1());
+            m_jit.store64(value.gpr(), JITCompiler::addressFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(DataFormatInt52);
+            break;
+        }
+            
+        case FlushedCell: {
+            SpeculateCellOperand cell(this, node->child1());
+            GPRReg cellGPR = cell.gpr();
+            m_jit.store64(cellGPR, JITCompiler::addressFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(DataFormatCell);
+            break;
+        }
+            
+        case FlushedBoolean: {
+            SpeculateBooleanOperand boolean(this, node->child1());
+            m_jit.store64(boolean.gpr(), JITCompiler::addressFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(DataFormatBoolean);
+            break;
+        }
+            
+        case FlushedJSValue: {
+            JSValueOperand value(this, node->child1());
+            m_jit.store64(value.gpr(), JITCompiler::addressFor(node->machineLocal()));
+            noResult(node);
+            recordSetLocal(dataFormatFor(node->variableAccessData()->flushFormat()));
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_jit.graph(), node, "Bad flush format");
+            break;
+        }
+
+        break;
+    }
+
+    case SetArgument:
+        // This is a no-op; it just marks the fact that the argument is being used.
+        // But it may be profitable to use this as a hook to run speculation checks
+        // on arguments, thereby allowing us to trivially eliminate such checks if
+        // the argument is not used.
+        recordSetLocal(dataFormatFor(node->variableAccessData()->flushFormat()));
+        break;
+
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+        compileBitwiseOp(node);
+        break;
+
+    case BitRShift:
+    case BitLShift:
+    case BitURShift:
+        compileShiftOp(node);
+        break;
+
+    case UInt32ToNumber: {
+        compileUInt32ToNumber(node);
+        break;
+    }
+
+    case DoubleAsInt32: {
+        compileDoubleAsInt32(node);
+        break;
+    }
+
+    case ValueToInt32: {
+        compileValueToInt32(node);
+        break;
+    }
+        
+    case DoubleRep: {
+        compileDoubleRep(node);
+        break;
+    }
+        
+    case ValueRep: {
+        compileValueRep(node);
+        break;
+    }
+        
+    case Int52Rep: {
+        switch (node->child1().useKind()) {
+        case Int32Use: {
+            SpeculateInt32Operand operand(this, node->child1());
+            GPRTemporary result(this, Reuse, operand);
+            
+            m_jit.signExtend32ToPtr(operand.gpr(), result.gpr());
+            
+            strictInt52Result(result.gpr(), node);
+            break;
+        }
+            
+        case AnyIntUse: {
+            GPRTemporary result(this);
+            GPRReg resultGPR = result.gpr();
+            
+            convertAnyInt(node->child1(), resultGPR);
+            
+            strictInt52Result(resultGPR, node);
+            break;
+        }
+            
+        case DoubleRepAnyIntUse: {
+            SpeculateDoubleOperand value(this, node->child1());
+            FPRReg valueFPR = value.fpr();
+            
+            GPRFlushedCallResult result(this);
+            GPRReg resultGPR = result.gpr();
+            
+            flushRegisters();
+            
+            callOperation(operationConvertDoubleToInt52, resultGPR, valueFPR);
+            
+            DFG_TYPE_CHECK_WITH_EXIT_KIND(Int52Overflow,
+                JSValueRegs(), node->child1(), SpecAnyIntAsDouble,
+                m_jit.branch64(
+                    JITCompiler::Equal, resultGPR,
+                    JITCompiler::TrustedImm64(JSValue::notInt52)));
+            
+            strictInt52Result(resultGPR, node);
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        }
+        break;
+    }
+
+    case ValueAdd:
+        compileValueAdd(node);
+        break;
+
+    case StrCat: {
+        JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);
+        JSValueOperand op2(this, node->child2(), ManualOperandSpeculation);
+        JSValueOperand op3(this, node->child3(), ManualOperandSpeculation);
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg op2GPR = op2.gpr();
+        GPRReg op3GPR;
+        if (node->child3())
+            op3GPR = op3.gpr();
+        else
+            op3GPR = InvalidGPRReg;
+        
+        flushRegisters();
+
+        GPRFlushedCallResult result(this);
+        if (node->child3())
+            callOperation(operationStrCat3, result.gpr(), op1GPR, op2GPR, op3GPR);
+        else
+            callOperation(operationStrCat2, result.gpr(), op1GPR, op2GPR);
+        m_jit.exceptionCheck();
+        
+        cellResult(result.gpr(), node);
+        break;
+    }
+
+    case ArithAdd:
+        compileArithAdd(node);
+        break;
+
+    case ArithClz32:
+        compileArithClz32(node);
+        break;
+        
+    case MakeRope:
+        compileMakeRope(node);
+        break;
+
+    case ArithSub:
+        compileArithSub(node);
+        break;
+
+    case ArithNegate:
+        compileArithNegate(node);
+        break;
+
+    case ArithMul:
+        compileArithMul(node);
+        break;
+
+    case ArithDiv: {
+        compileArithDiv(node);
+        break;
+    }
+
+    case ArithMod: {
+        compileArithMod(node);
+        break;
+    }
+
+    case ArithAbs:
+        compileArithAbs(node);
+        break;
+        
+    case ArithMin:
+    case ArithMax: {
+        switch (node->binaryUseKind()) {
+        case Int32Use: {
+            SpeculateStrictInt32Operand op1(this, node->child1());
+            SpeculateStrictInt32Operand op2(this, node->child2());
+            GPRTemporary result(this, Reuse, op1);
+            
+            MacroAssembler::Jump op1Less = m_jit.branch32(op == ArithMin ? MacroAssembler::LessThan : MacroAssembler::GreaterThan, op1.gpr(), op2.gpr());
+            m_jit.move(op2.gpr(), result.gpr());
+            if (op1.gpr() != result.gpr()) {
+                MacroAssembler::Jump done = m_jit.jump();
+                op1Less.link(&m_jit);
+                m_jit.move(op1.gpr(), result.gpr());
+                done.link(&m_jit);
+            } else
+                op1Less.link(&m_jit);
+            
+            int32Result(result.gpr(), node);
+            break;
+        }
+        
+        case DoubleRepUse: {
+            SpeculateDoubleOperand op1(this, node->child1());
+            SpeculateDoubleOperand op2(this, node->child2());
+            FPRTemporary result(this, op1);
+            
+            FPRReg op1FPR = op1.fpr();
+            FPRReg op2FPR = op2.fpr();
+            FPRReg resultFPR = result.fpr();
+        
+            MacroAssembler::JumpList done;
+        
+            MacroAssembler::Jump op1Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleLessThan : MacroAssembler::DoubleGreaterThan, op1FPR, op2FPR);
+        
+            // op2 is eather the lesser one or one of then is NaN
+            MacroAssembler::Jump op2Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleGreaterThanOrEqual : MacroAssembler::DoubleLessThanOrEqual, op1FPR, op2FPR);
+        
+            // Unordered case. We don't know which of op1, op2 is NaN. Manufacture NaN by adding 
+            // op1 + op2 and putting it into result.
+            m_jit.addDouble(op1FPR, op2FPR, resultFPR);
+            done.append(m_jit.jump());
+        
+            op2Less.link(&m_jit);
+            m_jit.moveDouble(op2FPR, resultFPR);
+        
+            if (op1FPR != resultFPR) {
+                done.append(m_jit.jump());
+            
+                op1Less.link(&m_jit);
+                m_jit.moveDouble(op1FPR, resultFPR);
+            } else
+                op1Less.link(&m_jit);
+        
+            done.link(&m_jit);
+        
+            doubleResult(resultFPR, node);
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+            break;
+        }
+        break;
+    }
+
+    case ArithPow:
+        compileArithPow(node);
+        break;
+
+    case ArithSqrt:
+        compileArithSqrt(node);
+        break;
+
+    case ArithFRound:
+        compileArithFRound(node);
+        break;
+
+    case ArithRandom:
+        compileArithRandom(node);
+        break;
+
+    case ArithRound:
+    case ArithFloor:
+    case ArithCeil:
+    case ArithTrunc:
+        compileArithRounding(node);
+        break;
+
+    case ArithSin:
+        compileArithSin(node);
+        break;
+
+    case ArithCos:
+        compileArithCos(node);
+        break;
+
+    case ArithTan:
+        compileArithTan(node);
+        break;
+
+    case ArithLog:
+        compileArithLog(node);
+        break;
+
+    case LogicalNot:
+        compileLogicalNot(node);
+        break;
+
+    case CompareLess:
+        if (compare(node, JITCompiler::LessThan, JITCompiler::DoubleLessThan, operationCompareLess))
+            return;
+        break;
+
+    case CompareLessEq:
+        if (compare(node, JITCompiler::LessThanOrEqual, JITCompiler::DoubleLessThanOrEqual, operationCompareLessEq))
+            return;
+        break;
+
+    case CompareGreater:
+        if (compare(node, JITCompiler::GreaterThan, JITCompiler::DoubleGreaterThan, operationCompareGreater))
+            return;
+        break;
+
+    case CompareGreaterEq:
+        if (compare(node, JITCompiler::GreaterThanOrEqual, JITCompiler::DoubleGreaterThanOrEqual, operationCompareGreaterEq))
+            return;
+        break;
+
+    case CompareEq:
+        if (compare(node, JITCompiler::Equal, JITCompiler::DoubleEqual, operationCompareEq))
+            return;
+        break;
+
+    case CompareStrictEq:
+        if (compileStrictEq(node))
+            return;
+        break;
+        
+    case CompareEqPtr:
+        compileCompareEqPtr(node);
+        break;
+
+    case StringCharCodeAt: {
+        compileGetCharCodeAt(node);
+        break;
+    }
+
+    case StringCharAt: {
+        // Relies on StringCharAt node having same basic layout as GetByVal
+        compileGetByValOnString(node);
+        break;
+    }
+
+    case StringFromCharCode: {
+        compileFromCharCode(node);
+        break;
+    }
+        
+    case CheckArray: {
+        checkArray(node);
+        break;
+    }
+        
+    case Arrayify:
+    case ArrayifyToStructure: {
+        arrayify(node);
+        break;
+    }
+
+    case GetByVal: {
+        switch (node->arrayMode().type()) {
+        case Array::SelectUsingPredictions:
+        case Array::ForceExit:
+            DFG_CRASH(m_jit.graph(), node, "Bad array mode type");
+            break;
+        case Array::Undecided: {
+            SpeculateStrictInt32Operand index(this, node->child2());
+            GPRTemporary result(this, Reuse, index);
+            GPRReg indexGPR = index.gpr();
+            GPRReg resultGPR = result.gpr();
+
+            speculationCheck(OutOfBounds, JSValueRegs(), node,
+                m_jit.branch32(MacroAssembler::LessThan, indexGPR, MacroAssembler::TrustedImm32(0)));
+
+            use(node->child1());
+            index.use();
+
+            m_jit.move(MacroAssembler::TrustedImm64(ValueUndefined), resultGPR);
+            jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+        case Array::Generic: {
+            JSValueOperand base(this, node->child1());
+            JSValueOperand property(this, node->child2());
+            GPRReg baseGPR = base.gpr();
+            GPRReg propertyGPR = property.gpr();
+            
+            flushRegisters();
+            GPRFlushedCallResult result(this);
+            callOperation(operationGetByVal, result.gpr(), baseGPR, propertyGPR);
+            m_jit.exceptionCheck();
+            
+            jsValueResult(result.gpr(), node);
+            break;
+        }
+        case Array::Int32:
+        case Array::Contiguous: {
+            if (node->arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node->child2());
+                StorageOperand storage(this, node->child3());
+                
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
+                
+                if (!m_compileOkay)
+                    return;
+                
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+                
+                GPRTemporary result(this);
+                m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), result.gpr());
+                if (node->arrayMode().isSaneChain()) {
+                    ASSERT(node->arrayMode().type() == Array::Contiguous);
+                    JITCompiler::Jump notHole = m_jit.branchTest64(
+                        MacroAssembler::NonZero, result.gpr());
+                    m_jit.move(TrustedImm64(JSValue::encode(jsUndefined())), result.gpr());
+                    notHole.link(&m_jit);
+                } else {
+                    speculationCheck(
+                        LoadFromHole, JSValueRegs(), 0,
+                        m_jit.branchTest64(MacroAssembler::Zero, result.gpr()));
+                }
+                jsValueResult(result.gpr(), node, node->arrayMode().type() == Array::Int32 ? DataFormatJSInt32 : DataFormatJS);
+                break;
+            }
+            
+            SpeculateCellOperand base(this, node->child1());
+            SpeculateStrictInt32Operand property(this, node->child2());
+            StorageOperand storage(this, node->child3());
+            
+            GPRReg baseReg = base.gpr();
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
+            
+            if (!m_compileOkay)
+                return;
+            
+            GPRTemporary result(this);
+            GPRReg resultReg = result.gpr();
+            
+            MacroAssembler::JumpList slowCases;
+            
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+            m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), resultReg);
+            slowCases.append(m_jit.branchTest64(MacroAssembler::Zero, resultReg));
+            
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCases, this, operationGetByValArrayInt,
+                    result.gpr(), baseReg, propertyReg));
+            
+            jsValueResult(resultReg, node);
+            break;
+        }
+
+        case Array::Double: {
+            if (node->arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node->child2());
+                StorageOperand storage(this, node->child3());
+            
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
+            
+                if (!m_compileOkay)
+                    return;
+            
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+                FPRTemporary result(this);
+                m_jit.loadDouble(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), result.fpr());
+                if (!node->arrayMode().isSaneChain())
+                    speculationCheck(LoadFromHole, JSValueRegs(), 0, m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, result.fpr(), result.fpr()));
+                doubleResult(result.fpr(), node);
+                break;
+            }
+
+            SpeculateCellOperand base(this, node->child1());
+            SpeculateStrictInt32Operand property(this, node->child2());
+            StorageOperand storage(this, node->child3());
+            
+            GPRReg baseReg = base.gpr();
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
+            
+            if (!m_compileOkay)
+                return;
+            
+            GPRTemporary result(this);
+            FPRTemporary temp(this);
+            GPRReg resultReg = result.gpr();
+            FPRReg tempReg = temp.fpr();
+            
+            MacroAssembler::JumpList slowCases;
+            
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            
+            m_jit.loadDouble(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight), tempReg);
+            slowCases.append(m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, tempReg, tempReg));
+            boxDouble(tempReg, resultReg);
+            
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCases, this, operationGetByValArrayInt,
+                    result.gpr(), baseReg, propertyReg));
+            
+            jsValueResult(resultReg, node);
+            break;
+        }
+
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage: {
+            if (node->arrayMode().isInBounds()) {
+                SpeculateStrictInt32Operand property(this, node->child2());
+                StorageOperand storage(this, node->child3());
+            
+                GPRReg propertyReg = property.gpr();
+                GPRReg storageReg = storage.gpr();
+            
+                if (!m_compileOkay)
+                    return;
+            
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())));
+            
+                GPRTemporary result(this);
+                m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), result.gpr());
+                speculationCheck(LoadFromHole, JSValueRegs(), 0, m_jit.branchTest64(MacroAssembler::Zero, result.gpr()));
+            
+                jsValueResult(result.gpr(), node);
+                break;
+            }
+
+            SpeculateCellOperand base(this, node->child1());
+            SpeculateStrictInt32Operand property(this, node->child2());
+            StorageOperand storage(this, node->child3());
+            
+            GPRReg baseReg = base.gpr();
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
+            
+            if (!m_compileOkay)
+                return;
+            
+            GPRTemporary result(this);
+            GPRReg resultReg = result.gpr();
+            
+            MacroAssembler::JumpList slowCases;
+            
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset())));
+    
+            m_jit.load64(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), resultReg);
+            slowCases.append(m_jit.branchTest64(MacroAssembler::Zero, resultReg));
+    
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCases, this, operationGetByValArrayInt,
+                    result.gpr(), baseReg, propertyReg));
+            
+            jsValueResult(resultReg, node);
+            break;
+        }
+        case Array::String:
+            compileGetByValOnString(node);
+            break;
+        case Array::DirectArguments:
+            compileGetByValOnDirectArguments(node);
+            break;
+        case Array::ScopedArguments:
+            compileGetByValOnScopedArguments(node);
+            break;
+        default: {
+            TypedArrayType type = node->arrayMode().typedArrayType();
+            if (isInt(type))
+                compileGetByValOnIntTypedArray(node, type);
+            else
+                compileGetByValOnFloatTypedArray(node, type);
+        } }
+        break;
+    }
+
+    case GetByValWithThis: {
+        JSValueOperand base(this, node->child1());
+        GPRReg baseGPR = base.gpr();
+        JSValueOperand thisValue(this, node->child2());
+        GPRReg thisValueGPR = thisValue.gpr();
+        JSValueOperand subscript(this, node->child3());
+        GPRReg subscriptGPR = subscript.gpr();
+
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        flushRegisters();
+        callOperation(operationGetByValWithThis, resultGPR, baseGPR, thisValueGPR, subscriptGPR);
+        m_jit.exceptionCheck();
+
+        jsValueResult(resultGPR, node);
+        break;
+    }
+
+    case PutByValDirect:
+    case PutByVal:
+    case PutByValAlias: {
+        Edge child1 = m_jit.graph().varArgChild(node, 0);
+        Edge child2 = m_jit.graph().varArgChild(node, 1);
+        Edge child3 = m_jit.graph().varArgChild(node, 2);
+        Edge child4 = m_jit.graph().varArgChild(node, 3);
+        
+        ArrayMode arrayMode = node->arrayMode().modeForPut();
+        bool alreadyHandled = false;
+        
+        switch (arrayMode.type()) {
+        case Array::SelectUsingPredictions:
+        case Array::ForceExit:
+            DFG_CRASH(m_jit.graph(), node, "Bad array mode type");
+            break;
+        case Array::Generic: {
+            DFG_ASSERT(m_jit.graph(), node, node->op() == PutByVal || node->op() == PutByValDirect);
+            
+            JSValueOperand arg1(this, child1);
+            JSValueOperand arg2(this, child2);
+            JSValueOperand arg3(this, child3);
+            GPRReg arg1GPR = arg1.gpr();
+            GPRReg arg2GPR = arg2.gpr();
+            GPRReg arg3GPR = arg3.gpr();
+            flushRegisters();
+            if (node->op() == PutByValDirect)
+                callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, arg1GPR, arg2GPR, arg3GPR);
+            else
+                callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByValStrict : operationPutByValNonStrict, arg1GPR, arg2GPR, arg3GPR);
+            m_jit.exceptionCheck();
+            
+            noResult(node);
+            alreadyHandled = true;
+            break;
+        }
+        default:
+            break;
+        }
+        
+        if (alreadyHandled)
+            break;
+        
+        // FIXME: the base may not be necessary for some array access modes. But we have to
+        // keep it alive to this point, so it's likely to be in a register anyway. Likely
+        // no harm in locking it here.
+        SpeculateCellOperand base(this, child1);
+        SpeculateStrictInt32Operand property(this, child2);
+        
+        GPRReg baseReg = base.gpr();
+        GPRReg propertyReg = property.gpr();
+
+        switch (arrayMode.type()) {
+        case Array::Int32:
+        case Array::Contiguous: {
+            JSValueOperand value(this, child3, ManualOperandSpeculation);
+
+            GPRReg valueReg = value.gpr();
+        
+            if (!m_compileOkay)
+                return;
+            
+            if (arrayMode.type() == Array::Int32) {
+                DFG_TYPE_CHECK(
+                    JSValueRegs(valueReg), child3, SpecInt32Only,
+                    m_jit.branch64(
+                        MacroAssembler::Below, valueReg, GPRInfo::tagTypeNumberRegister));
+            }
+
+            StorageOperand storage(this, child4);
+            GPRReg storageReg = storage.gpr();
+
+            if (node->op() == PutByValAlias) {
+                // Store the value to the array.
+                GPRReg propertyReg = property.gpr();
+                GPRReg valueReg = value.gpr();
+                m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
+                
+                noResult(node);
+                break;
+            }
+            
+            GPRTemporary temporary;
+            GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node);
+
+            MacroAssembler::Jump slowCase;
+            
+            if (arrayMode.isInBounds()) {
+                speculationCheck(
+                    OutOfBounds, JSValueRegs(), 0,
+                    m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength())));
+            } else {
+                MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+                
+                slowCase = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfVectorLength()));
+                
+                if (!arrayMode.isOutOfBounds())
+                    speculationCheck(OutOfBounds, JSValueRegs(), 0, slowCase);
+                
+                m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg);
+                m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, Butterfly::offsetOfPublicLength()));
+                
+                inBounds.link(&m_jit);
+            }
+            
+            m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight));
+
+            base.use();
+            property.use();
+            value.use();
+            storage.use();
+            
+            if (arrayMode.isOutOfBounds()) {
+                if (node->op() == PutByValDirect) {
+                    addSlowPathGenerator(slowPathCall(
+                        slowCase, this,
+                        m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValDirectBeyondArrayBoundsNonStrict,
+                        NoResult, baseReg, propertyReg, valueReg));
+                } else {
+                    addSlowPathGenerator(slowPathCall(
+                        slowCase, this,
+                        m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
+                        NoResult, baseReg, propertyReg, valueReg));
+                }
+            }
+
+            noResult(node, UseChildrenCalledExplicitly);
+            break;
+        }
+            
+        case Array::Double: {
+            compileDoublePutByVal(node, base, property);
+            break;
+        }
+            
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage: {
+            JSValueOperand value(this, child3);
+
+            GPRReg valueReg = value.gpr();
+        
+            if (!m_compileOkay)
+                return;
+
+            StorageOperand storage(this, child4);
+            GPRReg storageReg = storage.gpr();
+
+            if (node->op() == PutByValAlias) {
+                // Store the value to the array.
+                GPRReg propertyReg = property.gpr();
+                GPRReg valueReg = value.gpr();
+                m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+                
+                noResult(node);
+                break;
+            }
+            
+            GPRTemporary temporary;
+            GPRReg temporaryReg = temporaryRegisterForPutByVal(temporary, node);
+
+            MacroAssembler::JumpList slowCases;
+
+            MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::vectorLengthOffset()));
+            if (!arrayMode.isOutOfBounds())
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, beyondArrayBounds);
+            else
+                slowCases.append(beyondArrayBounds);
+
+            // Check if we're writing to a hole; if so increment m_numValuesInVector.
+            if (arrayMode.isInBounds()) {
+                speculationCheck(
+                    StoreToHole, JSValueRegs(), 0,
+                    m_jit.branchTest64(MacroAssembler::Zero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))));
+            } else {
+                MacroAssembler::Jump notHoleValue = m_jit.branchTest64(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+                if (arrayMode.isSlowPut()) {
+                    // This is sort of strange. If we wanted to optimize this code path, we would invert
+                    // the above branch. But it's simply not worth it since this only happens if we're
+                    // already having a bad time.
+                    slowCases.append(m_jit.jump());
+                } else {
+                    m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, ArrayStorage::numValuesInVectorOffset()));
+                
+                    // If we're writing to a hole we might be growing the array; 
+                    MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
+                    m_jit.add32(TrustedImm32(1), propertyReg, temporaryReg);
+                    m_jit.store32(temporaryReg, MacroAssembler::Address(storageReg, ArrayStorage::lengthOffset()));
+                
+                    lengthDoesNotNeedUpdate.link(&m_jit);
+                }
+                notHoleValue.link(&m_jit);
+            }
+    
+            // Store the value to the array.
+            m_jit.store64(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+
+            base.use();
+            property.use();
+            value.use();
+            storage.use();
+            
+            if (!slowCases.empty()) {
+                if (node->op() == PutByValDirect) {
+                    addSlowPathGenerator(slowPathCall(
+                        slowCases, this,
+                        m_jit.codeBlock()->isStrictMode() ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValDirectBeyondArrayBoundsNonStrict,
+                        NoResult, baseReg, propertyReg, valueReg));
+                } else {
+                    addSlowPathGenerator(slowPathCall(
+                        slowCases, this,
+                        m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
+                        NoResult, baseReg, propertyReg, valueReg));
+                }
+            }
+
+            noResult(node, UseChildrenCalledExplicitly);
+            break;
+        }
+            
+        default: {
+            TypedArrayType type = arrayMode.typedArrayType();
+            if (isInt(type))
+                compilePutByValForIntTypedArray(base.gpr(), property.gpr(), node, type);
+            else
+                compilePutByValForFloatTypedArray(base.gpr(), property.gpr(), node, type);
+        } }
+
+        break;
+    }
+
+    case RegExpExec: {
+        bool sample = false;
+
+        if (sample)
+            m_jit.incrementSuperSamplerCount();
+        
+        SpeculateCellOperand globalObject(this, node->child1());
+        GPRReg globalObjectGPR = globalObject.gpr();
+        
+        if (node->child2().useKind() == RegExpObjectUse) {
+            if (node->child3().useKind() == StringUse) {
+                SpeculateCellOperand base(this, node->child2());
+                SpeculateCellOperand argument(this, node->child3());
+                GPRReg baseGPR = base.gpr();
+                GPRReg argumentGPR = argument.gpr();
+                speculateRegExpObject(node->child2(), baseGPR);
+                speculateString(node->child3(), argumentGPR);
+                
+                flushRegisters();
+                GPRFlushedCallResult result(this);
+                callOperation(operationRegExpExecString, result.gpr(), globalObjectGPR, baseGPR, argumentGPR);
+                m_jit.exceptionCheck();
+                
+                jsValueResult(result.gpr(), node);
+
+                if (sample)
+                    m_jit.decrementSuperSamplerCount();
+                break;
+            }
+            
+            SpeculateCellOperand base(this, node->child2());
+            JSValueOperand argument(this, node->child3());
+            GPRReg baseGPR = base.gpr();
+            GPRReg argumentGPR = argument.gpr();
+            speculateRegExpObject(node->child2(), baseGPR);
+        
+            flushRegisters();
+            GPRFlushedCallResult result(this);
+            callOperation(operationRegExpExec, result.gpr(), globalObjectGPR, baseGPR, argumentGPR);
+            m_jit.exceptionCheck();
+        
+            jsValueResult(result.gpr(), node);
+
+            if (sample)
+                m_jit.decrementSuperSamplerCount();
+            break;
+        }
+        
+        JSValueOperand base(this, node->child2());
+        JSValueOperand argument(this, node->child3());
+        GPRReg baseGPR = base.gpr();
+        GPRReg argumentGPR = argument.gpr();
+        
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        callOperation(operationRegExpExecGeneric, result.gpr(), globalObjectGPR, baseGPR, argumentGPR);
+        m_jit.exceptionCheck();
+        
+        jsValueResult(result.gpr(), node);
+
+        if (sample)
+            m_jit.decrementSuperSamplerCount();
+        break;
+    }
+
+    case RegExpTest: {
+        SpeculateCellOperand globalObject(this, node->child1());
+        GPRReg globalObjectGPR = globalObject.gpr();
+        
+        if (node->child2().useKind() == RegExpObjectUse) {
+            if (node->child3().useKind() == StringUse) {
+                SpeculateCellOperand base(this, node->child2());
+                SpeculateCellOperand argument(this, node->child3());
+                GPRReg baseGPR = base.gpr();
+                GPRReg argumentGPR = argument.gpr();
+                speculateRegExpObject(node->child2(), baseGPR);
+                speculateString(node->child3(), argumentGPR);
+                
+                flushRegisters();
+                GPRFlushedCallResult result(this);
+                callOperation(operationRegExpTestString, result.gpr(), globalObjectGPR, baseGPR, argumentGPR);
+                m_jit.exceptionCheck();
+                
+                m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+                jsValueResult(result.gpr(), node);
+                break;
+            }
+            
+            SpeculateCellOperand base(this, node->child2());
+            JSValueOperand argument(this, node->child3());
+            GPRReg baseGPR = base.gpr();
+            GPRReg argumentGPR = argument.gpr();
+            speculateRegExpObject(node->child2(), baseGPR);
+        
+            flushRegisters();
+            GPRFlushedCallResult result(this);
+            callOperation(operationRegExpTest, result.gpr(), globalObjectGPR, baseGPR, argumentGPR);
+            m_jit.exceptionCheck();
+        
+            m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+            jsValueResult(result.gpr(), node);
+            break;
+        }
+        
+        JSValueOperand base(this, node->child2());
+        JSValueOperand argument(this, node->child3());
+        GPRReg baseGPR = base.gpr();
+        GPRReg argumentGPR = argument.gpr();
+        
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        callOperation(operationRegExpTestGeneric, result.gpr(), globalObjectGPR, baseGPR, argumentGPR);
+        m_jit.exceptionCheck();
+        
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        break;
+    }
+
+    case StringReplace:
+    case StringReplaceRegExp: {
+        bool sample = false;
+
+        if (sample)
+            m_jit.incrementSuperSamplerCount();
+        
+        if (node->child1().useKind() == StringUse
+            && node->child2().useKind() == RegExpObjectUse
+            && node->child3().useKind() == StringUse) {
+            if (JSString* replace = node->child3()->dynamicCastConstant<JSString*>()) {
+                if (!replace->length()) {
+                    SpeculateCellOperand string(this, node->child1());
+                    SpeculateCellOperand regExp(this, node->child2());
+                    GPRReg stringGPR = string.gpr();
+                    GPRReg regExpGPR = regExp.gpr();
+                    speculateString(node->child1(), stringGPR);
+                    speculateRegExpObject(node->child2(), regExpGPR);
+
+                    flushRegisters();
+                    GPRFlushedCallResult result(this);
+                    callOperation(
+                        operationStringProtoFuncReplaceRegExpEmptyStr, result.gpr(), stringGPR,
+                        regExpGPR);
+                    m_jit.exceptionCheck();
+                    cellResult(result.gpr(), node);
+                    if (sample)
+                        m_jit.decrementSuperSamplerCount();
+                    break;
+                }
+            }
+            
+            SpeculateCellOperand string(this, node->child1());
+            SpeculateCellOperand regExp(this, node->child2());
+            SpeculateCellOperand replace(this, node->child3());
+            GPRReg stringGPR = string.gpr();
+            GPRReg regExpGPR = regExp.gpr();
+            GPRReg replaceGPR = replace.gpr();
+            speculateString(node->child1(), stringGPR);
+            speculateRegExpObject(node->child2(), regExpGPR);
+            speculateString(node->child3(), replaceGPR);
+            
+            flushRegisters();
+            GPRFlushedCallResult result(this);
+            callOperation(
+                operationStringProtoFuncReplaceRegExpString, result.gpr(), stringGPR, regExpGPR,
+                replaceGPR);
+            m_jit.exceptionCheck();
+            cellResult(result.gpr(), node);
+            if (sample)
+                m_jit.decrementSuperSamplerCount();
+            break;
+        }
+
+        // If we fixed up the edge of child2, we inserted a Check(@child2, String).
+        OperandSpeculationMode child2SpeculationMode = AutomaticOperandSpeculation;
+        if (node->child2().useKind() == StringUse)
+            child2SpeculationMode = ManualOperandSpeculation;
+
+        JSValueOperand string(this, node->child1());
+        JSValueOperand search(this, node->child2(), child2SpeculationMode);
+        JSValueOperand replace(this, node->child3());
+        GPRReg stringGPR = string.gpr();
+        GPRReg searchGPR = search.gpr();
+        GPRReg replaceGPR = replace.gpr();
+        
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        callOperation(
+            operationStringProtoFuncReplaceGeneric, result.gpr(), stringGPR, searchGPR,
+            replaceGPR);
+        m_jit.exceptionCheck();
+        cellResult(result.gpr(), node);
+        if (sample)
+            m_jit.decrementSuperSamplerCount();
+        break;
+    }
+        
+    case GetRegExpObjectLastIndex: {
+        compileGetRegExpObjectLastIndex(node);
+        break;
+    }
+        
+    case SetRegExpObjectLastIndex: {
+        compileSetRegExpObjectLastIndex(node);
+        break;
+    }
+
+    case RecordRegExpCachedResult: {
+        compileRecordRegExpCachedResult(node);
+        break;
+    }
+        
+    case ArrayPush: {
+        ASSERT(node->arrayMode().isJSArray());
+        
+        SpeculateCellOperand base(this, node->child1());
+        GPRTemporary storageLength(this);
+        
+        GPRReg baseGPR = base.gpr();
+        GPRReg storageLengthGPR = storageLength.gpr();
+        
+        StorageOperand storage(this, node->child3());
+        GPRReg storageGPR = storage.gpr();
+
+        switch (node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Contiguous: {
+            JSValueOperand value(this, node->child2(), ManualOperandSpeculation);
+            GPRReg valueGPR = value.gpr();
+
+            if (node->arrayMode().type() == Array::Int32) {
+                DFG_TYPE_CHECK(
+                    JSValueRegs(valueGPR), node->child2(), SpecInt32Only,
+                    m_jit.branch64(
+                        MacroAssembler::Below, valueGPR, GPRInfo::tagTypeNumberRegister));
+            }
+
+            m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
+            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
+            m_jit.store64(valueGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight));
+            m_jit.add32(TrustedImm32(1), storageLengthGPR);
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            m_jit.or64(GPRInfo::tagTypeNumberRegister, storageLengthGPR);
+            
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowPath, this, operationArrayPush, storageLengthGPR,
+                    valueGPR, baseGPR));
+        
+            jsValueResult(storageLengthGPR, node);
+            break;
+        }
+            
+        case Array::Double: {
+            SpeculateDoubleOperand value(this, node->child2());
+            FPRReg valueFPR = value.fpr();
+
+            DFG_TYPE_CHECK(
+                JSValueRegs(), node->child2(), SpecDoubleReal,
+                m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, valueFPR, valueFPR));
+            
+            m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
+            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));
+            m_jit.storeDouble(valueFPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight));
+            m_jit.add32(TrustedImm32(1), storageLengthGPR);
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            m_jit.or64(GPRInfo::tagTypeNumberRegister, storageLengthGPR);
+            
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowPath, this, operationArrayPushDouble, storageLengthGPR,
+                    valueFPR, baseGPR));
+        
+            jsValueResult(storageLengthGPR, node);
+            break;
+        }
+            
+        case Array::ArrayStorage: {
+            JSValueOperand value(this, node->child2());
+            GPRReg valueGPR = value.gpr();
+
+            m_jit.load32(MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()), storageLengthGPR);
+        
+            // Refuse to handle bizarre lengths.
+            speculationCheck(Uncountable, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::Above, storageLengthGPR, TrustedImm32(0x7ffffffe)));
+        
+            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, ArrayStorage::vectorLengthOffset()));
+        
+            m_jit.store64(valueGPR, MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+        
+            m_jit.add32(TrustedImm32(1), storageLengthGPR);
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()));
+            m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+            m_jit.or64(GPRInfo::tagTypeNumberRegister, storageLengthGPR);
+        
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowPath, this, operationArrayPush, NoResult, storageLengthGPR,
+                    valueGPR, baseGPR));
+        
+            jsValueResult(storageLengthGPR, node);
+            break;
+        }
+            
+        default:
+            CRASH();
+            break;
+        }
+        break;
+    }
+
+    case ArraySlice: {
+        compileArraySlice(node);
+        break;
+    }
+        
+    case ArrayPop: {
+        ASSERT(node->arrayMode().isJSArray());
+
+        SpeculateCellOperand base(this, node->child1());
+        StorageOperand storage(this, node->child2());
+        GPRTemporary value(this);
+        GPRTemporary storageLength(this);
+        FPRTemporary temp(this); // This is kind of lame, since we don't always need it. I'm relying on the fact that we don't have FPR pressure, especially in code that uses pop().
+        
+        GPRReg baseGPR = base.gpr();
+        GPRReg storageGPR = storage.gpr();
+        GPRReg valueGPR = value.gpr();
+        GPRReg storageLengthGPR = storageLength.gpr();
+        FPRReg tempFPR = temp.fpr();
+        
+        switch (node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous: {
+            m_jit.load32(
+                MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);
+            MacroAssembler::Jump undefinedCase =
+                m_jit.branchTest32(MacroAssembler::Zero, storageLengthGPR);
+            m_jit.sub32(TrustedImm32(1), storageLengthGPR);
+            m_jit.store32(
+                storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            MacroAssembler::Jump slowCase;
+            if (node->arrayMode().type() == Array::Double) {
+                m_jit.loadDouble(
+                    MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight),
+                    tempFPR);
+                // FIXME: This would not have to be here if changing the publicLength also zeroed the values between the old
+                // length and the new length.
+                m_jit.store64(
+                    MacroAssembler::TrustedImm64(bitwise_cast<int64_t>(PNaN)), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight));
+                slowCase = m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, tempFPR, tempFPR);
+                boxDouble(tempFPR, valueGPR);
+            } else {
+                m_jit.load64(
+                    MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight),
+                    valueGPR);
+                // FIXME: This would not have to be here if changing the publicLength also zeroed the values between the old
+                // length and the new length.
+                m_jit.store64(
+                MacroAssembler::TrustedImm64((int64_t)0), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight));
+                slowCase = m_jit.branchTest64(MacroAssembler::Zero, valueGPR);
+            }
+
+            addSlowPathGenerator(
+                slowPathMove(
+                    undefinedCase, this,
+                    MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), valueGPR));
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCase, this, operationArrayPopAndRecoverLength, valueGPR, baseGPR));
+            
+            // We can't know for sure that the result is an int because of the slow paths. :-/
+            jsValueResult(valueGPR, node);
+            break;
+        }
+            
+        case Array::ArrayStorage: {
+            m_jit.load32(MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()), storageLengthGPR);
+        
+            JITCompiler::Jump undefinedCase =
+                m_jit.branchTest32(MacroAssembler::Zero, storageLengthGPR);
+        
+            m_jit.sub32(TrustedImm32(1), storageLengthGPR);
+        
+            JITCompiler::JumpList slowCases;
+            slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, ArrayStorage::vectorLengthOffset())));
+        
+            m_jit.load64(MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), valueGPR);
+            slowCases.append(m_jit.branchTest64(MacroAssembler::Zero, valueGPR));
+        
+            m_jit.store32(storageLengthGPR, MacroAssembler::Address(storageGPR, ArrayStorage::lengthOffset()));
+        
+            m_jit.store64(MacroAssembler::TrustedImm64((int64_t)0), MacroAssembler::BaseIndex(storageGPR, storageLengthGPR, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+            m_jit.sub32(MacroAssembler::TrustedImm32(1), MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+        
+            addSlowPathGenerator(
+                slowPathMove(
+                    undefinedCase, this,
+                    MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), valueGPR));
+        
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCases, this, operationArrayPop, valueGPR, baseGPR));
+
+            jsValueResult(valueGPR, node);
+            break;
+        }
+            
+        default:
+            CRASH();
+            break;
+        }
+        break;
+    }
+
+    case DFG::Jump: {
+        jump(node->targetBlock());
+        noResult(node);
+        break;
+    }
+
+    case Branch:
+        emitBranch(node);
+        break;
+        
+    case Switch:
+        emitSwitch(node);
+        break;
+
+    case Return: {
+        ASSERT(GPRInfo::callFrameRegister != GPRInfo::regT1);
+        ASSERT(GPRInfo::regT1 != GPRInfo::returnValueGPR);
+        ASSERT(GPRInfo::returnValueGPR != GPRInfo::callFrameRegister);
+
+        // Return the result in returnValueGPR.
+        JSValueOperand op1(this, node->child1());
+        m_jit.move(op1.gpr(), GPRInfo::returnValueGPR);
+
+        m_jit.emitRestoreCalleeSaves();
+        m_jit.emitFunctionEpilogue();
+        m_jit.ret();
+        
+        noResult(node);
+        break;
+    }
+        
+    case Throw:
+    case ThrowStaticError: {
+        // We expect that throw statements are rare and are intended to exit the code block
+        // anyway, so we just OSR back to the old JIT for now.
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        break;
+    }
+        
+    case BooleanToNumber: {
+        switch (node->child1().useKind()) {
+        case BooleanUse: {
+            JSValueOperand value(this, node->child1(), ManualOperandSpeculation);
+            GPRTemporary result(this); // FIXME: We could reuse, but on speculation fail would need recovery to restore tag (akin to add).
+            
+            m_jit.move(value.gpr(), result.gpr());
+            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), result.gpr());
+            DFG_TYPE_CHECK(
+                JSValueRegs(value.gpr()), node->child1(), SpecBoolean, m_jit.branchTest64(
+                    JITCompiler::NonZero, result.gpr(), TrustedImm32(static_cast<int32_t>(~1))));
+
+            int32Result(result.gpr(), node);
+            break;
+        }
+            
+        case UntypedUse: {
+            JSValueOperand value(this, node->child1());
+            GPRTemporary result(this);
+            
+            if (!m_interpreter.needsTypeCheck(node->child1(), SpecBoolInt32 | SpecBoolean)) {
+                m_jit.move(value.gpr(), result.gpr());
+                m_jit.and32(TrustedImm32(1), result.gpr());
+                int32Result(result.gpr(), node);
+                break;
+            }
+            
+            m_jit.move(value.gpr(), result.gpr());
+            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), result.gpr());
+            JITCompiler::Jump isBoolean = m_jit.branchTest64(
+                JITCompiler::Zero, result.gpr(), TrustedImm32(static_cast<int32_t>(~1)));
+            m_jit.move(value.gpr(), result.gpr());
+            JITCompiler::Jump done = m_jit.jump();
+            isBoolean.link(&m_jit);
+            m_jit.or64(GPRInfo::tagTypeNumberRegister, result.gpr());
+            done.link(&m_jit);
+            
+            jsValueResult(result.gpr(), node);
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+            break;
+        }
+        break;
+    }
+        
+    case ToPrimitive: {
+        DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse);
+        JSValueOperand argument(this, node->child1());
+        GPRTemporary result(this, Reuse, argument);
+        
+        GPRReg argumentGPR = argument.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        argument.use();
+        
+        MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(JSValueRegs(argumentGPR));
+        MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(argumentGPR);
+        
+        alreadyPrimitive.link(&m_jit);
+        m_jit.move(argumentGPR, resultGPR);
+        
+        addSlowPathGenerator(
+            slowPathCall(notPrimitive, this, operationToPrimitive, resultGPR, argumentGPR));
+        
+        jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
+        break;
+    }
+
+    case ToNumber: {
+        JSValueOperand argument(this, node->child1());
+        GPRTemporary result(this, Reuse, argument);
+
+        GPRReg argumentGPR = argument.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        argument.use();
+
+        // We have several attempts to remove ToNumber. But ToNumber still exists.
+        // It means that converting non-numbers to numbers by this ToNumber is not rare.
+        // Instead of the slow path generator, we emit callOperation here.
+        if (!(m_state.forNode(node->child1()).m_type & SpecBytecodeNumber)) {
+            flushRegisters();
+            callOperation(operationToNumber, resultGPR, argumentGPR);
+            m_jit.exceptionCheck();
+        } else {
+            MacroAssembler::Jump notNumber = m_jit.branchIfNotNumber(argumentGPR);
+            m_jit.move(argumentGPR, resultGPR);
+            MacroAssembler::Jump done = m_jit.jump();
+
+            notNumber.link(&m_jit);
+            silentSpillAllRegisters(resultGPR);
+            callOperation(operationToNumber, resultGPR, argumentGPR);
+            silentFillAllRegisters(resultGPR);
+            m_jit.exceptionCheck();
+
+            done.link(&m_jit);
+        }
+
+        jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
+        break;
+    }
+        
+    case ToString:
+    case CallStringConstructor: {
+        if (node->child1().useKind() == UntypedUse) {
+            JSValueOperand op1(this, node->child1());
+            GPRReg op1GPR = op1.gpr();
+            
+            GPRFlushedCallResult result(this);
+            GPRReg resultGPR = result.gpr();
+            
+            flushRegisters();
+            
+            JITCompiler::Jump done;
+            if (node->child1()->prediction() & SpecString) {
+                JITCompiler::Jump slowPath1 = m_jit.branchIfNotCell(JSValueRegs(op1GPR));
+                JITCompiler::Jump slowPath2 = m_jit.branchIfNotString(op1GPR);
+                m_jit.move(op1GPR, resultGPR);
+                done = m_jit.jump();
+                slowPath1.link(&m_jit);
+                slowPath2.link(&m_jit);
+            }
+            if (op == ToString)
+                callOperation(operationToString, resultGPR, op1GPR);
+            else {
+                ASSERT(op == CallStringConstructor);
+                callOperation(operationCallStringConstructor, resultGPR, op1GPR);
+            }
+            m_jit.exceptionCheck();
+            if (done.isSet())
+                done.link(&m_jit);
+            cellResult(resultGPR, node);
+            break;
+        }
+        
+        compileToStringOrCallStringConstructorOnCell(node);
+        break;
+    }
+        
+    case NewStringObject: {
+        compileNewStringObject(node);
+        break;
+    }
+        
+    case NewArray: {
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
+            RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
+            DFG_ASSERT(m_jit.graph(), node, structure->indexingType() == node->indexingType());
+            ASSERT(
+                hasUndecided(structure->indexingType())
+                || hasInt32(structure->indexingType())
+                || hasDouble(structure->indexingType())
+                || hasContiguous(structure->indexingType()));
+            
+            unsigned numElements = node->numChildren();
+            
+            GPRTemporary result(this);
+            GPRTemporary storage(this);
+            
+            GPRReg resultGPR = result.gpr();
+            GPRReg storageGPR = storage.gpr();
+
+            emitAllocateRawObject(resultGPR, structure, storageGPR, numElements, numElements);
+            
+            // At this point, one way or another, resultGPR and storageGPR have pointers to
+            // the JSArray and the Butterfly, respectively.
+            
+            ASSERT(!hasUndecided(structure->indexingType()) || !node->numChildren());
+            
+            for (unsigned operandIdx = 0; operandIdx < node->numChildren(); ++operandIdx) {
+                Edge use = m_jit.graph().m_varArgChildren[node->firstChild() + operandIdx];
+                switch (node->indexingType()) {
+                case ALL_BLANK_INDEXING_TYPES:
+                case ALL_UNDECIDED_INDEXING_TYPES:
+                    CRASH();
+                    break;
+                case ALL_DOUBLE_INDEXING_TYPES: {
+                    SpeculateDoubleOperand operand(this, use);
+                    FPRReg opFPR = operand.fpr();
+                    DFG_TYPE_CHECK(
+                        JSValueRegs(), use, SpecDoubleReal,
+                        m_jit.branchDouble(
+                            MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));
+                    m_jit.storeDouble(opFPR, MacroAssembler::Address(storageGPR, sizeof(double) * operandIdx));
+                    break;
+                }
+                case ALL_INT32_INDEXING_TYPES:
+                case ALL_CONTIGUOUS_INDEXING_TYPES: {
+                    JSValueOperand operand(this, use, ManualOperandSpeculation);
+                    GPRReg opGPR = operand.gpr();
+                    if (hasInt32(node->indexingType())) {
+                        DFG_TYPE_CHECK(
+                            JSValueRegs(opGPR), use, SpecInt32Only,
+                            m_jit.branch64(
+                                MacroAssembler::Below, opGPR, GPRInfo::tagTypeNumberRegister));
+                    }
+                    m_jit.store64(opGPR, MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx));
+                    break;
+                }
+                default:
+                    CRASH();
+                    break;
+                }
+            }
+            
+            // Yuck, we should *really* have a way of also returning the storageGPR. But
+            // that's the least of what's wrong with this code. We really shouldn't be
+            // allocating the array after having computed - and probably spilled to the
+            // stack - all of the things that will go into the array. The solution to that
+            // bigger problem will also likely fix the redundancy in reloading the storage
+            // pointer that we currently have.
+            
+            cellResult(resultGPR, node);
+            break;
+        }
+        
+        if (!node->numChildren()) {
+            flushRegisters();
+            GPRFlushedCallResult result(this);
+            callOperation(operationNewEmptyArray, result.gpr(), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())));
+            m_jit.exceptionCheck();
+            cellResult(result.gpr(), node);
+            break;
+        }
+        
+        size_t scratchSize = sizeof(EncodedJSValue) * node->numChildren();
+        ScratchBuffer* scratchBuffer = m_jit.vm()->scratchBufferForSize(scratchSize);
+        EncodedJSValue* buffer = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;
+        
+        for (unsigned operandIdx = 0; operandIdx < node->numChildren(); ++operandIdx) {
+            // Need to perform the speculations that this node promises to perform. If we're
+            // emitting code here and the indexing type is not array storage then there is
+            // probably something hilarious going on and we're already failing at all the
+            // things, but at least we're going to be sound.
+            Edge use = m_jit.graph().m_varArgChildren[node->firstChild() + operandIdx];
+            switch (node->indexingType()) {
+            case ALL_BLANK_INDEXING_TYPES:
+            case ALL_UNDECIDED_INDEXING_TYPES:
+                CRASH();
+                break;
+            case ALL_DOUBLE_INDEXING_TYPES: {
+                SpeculateDoubleOperand operand(this, use);
+                GPRTemporary scratch(this);
+                FPRReg opFPR = operand.fpr();
+                GPRReg scratchGPR = scratch.gpr();
+                DFG_TYPE_CHECK(
+                    JSValueRegs(), use, SpecDoubleReal,
+                    m_jit.branchDouble(
+                        MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));
+                m_jit.boxDouble(opFPR, scratchGPR);
+                m_jit.store64(scratchGPR, buffer + operandIdx);
+                break;
+            }
+            case ALL_INT32_INDEXING_TYPES: {
+                JSValueOperand operand(this, use, ManualOperandSpeculation);
+                GPRReg opGPR = operand.gpr();
+                if (hasInt32(node->indexingType())) {
+                    DFG_TYPE_CHECK(
+                        JSValueRegs(opGPR), use, SpecInt32Only,
+                        m_jit.branch64(
+                            MacroAssembler::Below, opGPR, GPRInfo::tagTypeNumberRegister));
+                }
+                m_jit.store64(opGPR, buffer + operandIdx);
+                break;
+            }
+            case ALL_CONTIGUOUS_INDEXING_TYPES:
+            case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+                JSValueOperand operand(this, use);
+                GPRReg opGPR = operand.gpr();
+                m_jit.store64(opGPR, buffer + operandIdx);
+                operand.use();
+                break;
+            }
+            default:
+                CRASH();
+                break;
+            }
+        }
+        
+        switch (node->indexingType()) {
+        case ALL_DOUBLE_INDEXING_TYPES:
+        case ALL_INT32_INDEXING_TYPES:
+            useChildren(node);
+            break;
+        default:
+            break;
+        }
+        
+        flushRegisters();
+
+        if (scratchSize) {
+            GPRTemporary scratch(this);
+
+            // Tell GC mark phase how much of the scratch buffer is active during call.
+            m_jit.move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratch.gpr());
+            m_jit.storePtr(TrustedImmPtr(scratchSize), scratch.gpr());
+        }
+
+        GPRFlushedCallResult result(this);
+        
+        callOperation(
+            operationNewArray, result.gpr(), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())),
+            static_cast<void*>(buffer), node->numChildren());
+        m_jit.exceptionCheck();
+
+        if (scratchSize) {
+            GPRTemporary scratch(this);
+
+            m_jit.move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratch.gpr());
+            m_jit.storePtr(TrustedImmPtr(0), scratch.gpr());
+        }
+
+        cellResult(result.gpr(), node, UseChildrenCalledExplicitly);
+        break;
+    }
+
+    case NewArrayWithSpread: {
+        compileNewArrayWithSpread(node);
+        break;
+    }
+
+    case Spread: {
+        compileSpread(node);
+        break;
+    }
+        
+    case NewArrayWithSize: {
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
+            SpeculateStrictInt32Operand size(this, node->child1());
+            GPRTemporary result(this);
+            GPRReg sizeGPR = size.gpr();
+            GPRReg resultGPR = result.gpr();
+            compileAllocateNewArrayWithSize(globalObject, resultGPR, sizeGPR, node->indexingType());
+            cellResult(resultGPR, node);
+            break;
+        }
+        
+        SpeculateStrictInt32Operand size(this, node->child1());
+        GPRReg sizeGPR = size.gpr();
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+        GPRReg structureGPR = selectScratchGPR(sizeGPR);
+        MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
+        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()))), structureGPR);
+        MacroAssembler::Jump done = m_jit.jump();
+        bigLength.link(&m_jit);
+        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))), structureGPR);
+        done.link(&m_jit);
+        callOperation(operationNewArrayWithSize, resultGPR, structureGPR, sizeGPR, nullptr);
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case NewArrayBuffer: {
+        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        IndexingType indexingType = node->indexingType();
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(indexingType)) {
+            unsigned numElements = node->numConstants();
+            
+            GPRTemporary result(this);
+            GPRTemporary storage(this);
+            
+            GPRReg resultGPR = result.gpr();
+            GPRReg storageGPR = storage.gpr();
+
+            emitAllocateRawObject(resultGPR, m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), storageGPR, numElements, numElements);
+            
+            DFG_ASSERT(m_jit.graph(), node, indexingType & IsArray);
+            JSValue* data = m_jit.codeBlock()->constantBuffer(node->startConstant());
+            if (indexingType == ArrayWithDouble) {
+                for (unsigned index = 0; index < node->numConstants(); ++index) {
+                    double value = data[index].asNumber();
+                    m_jit.store64(
+                        Imm64(bitwise_cast<int64_t>(value)),
+                        MacroAssembler::Address(storageGPR, sizeof(double) * index));
+                }
+            } else {
+                for (unsigned index = 0; index < node->numConstants(); ++index) {
+                    m_jit.store64(
+                        Imm64(JSValue::encode(data[index])),
+                        MacroAssembler::Address(storageGPR, sizeof(JSValue) * index));
+                }
+            }
+            
+            cellResult(resultGPR, node);
+            break;
+        }
+        
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        
+        callOperation(operationNewArrayBuffer, result.gpr(), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())), node->startConstant(), node->numConstants());
+        m_jit.exceptionCheck();
+        
+        cellResult(result.gpr(), node);
+        break;
+    }
+        
+    case NewTypedArray: {
+        switch (node->child1().useKind()) {
+        case Int32Use:
+            compileNewTypedArray(node);
+            break;
+        case UntypedUse: {
+            JSValueOperand argument(this, node->child1());
+            GPRReg argumentGPR = argument.gpr();
+            
+            flushRegisters();
+            
+            GPRFlushedCallResult result(this);
+            GPRReg resultGPR = result.gpr();
+            
+            JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+            callOperation(
+                operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
+                resultGPR, m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())),
+                argumentGPR);
+            m_jit.exceptionCheck();
+            
+            cellResult(resultGPR, node);
+            break;
+        }
+        default:
+            DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+            break;
+        }
+        break;
+    }
+        
+    case NewRegexp: {
+        flushRegisters();
+        GPRFlushedCallResult result(this);
+        
+        RegExp* regexp = node->castOperand<RegExp*>();
+        callOperation(operationNewRegexp, result.gpr(), regexp);
+        m_jit.exceptionCheck();
+        
+        cellResult(result.gpr(), node);
+        break;
+    }
+
+    case CallObjectConstructor: {
+        compileCallObjectConstructor(node);
+        break;
+    }
+
+    case ToThis: {
+        ASSERT(node->child1().useKind() == UntypedUse);
+        JSValueOperand thisValue(this, node->child1());
+        GPRTemporary temp(this);
+        GPRReg thisValueGPR = thisValue.gpr();
+        GPRReg tempGPR = temp.gpr();
+        
+        MacroAssembler::JumpList slowCases;
+        slowCases.append(m_jit.branchIfNotCell(JSValueRegs(thisValueGPR)));
+        slowCases.append(
+            m_jit.branchTest8(                             
+                MacroAssembler::NonZero,
+                MacroAssembler::Address(thisValueGPR, JSCell::typeInfoFlagsOffset()),
+                MacroAssembler::TrustedImm32(OverridesToThis)));
+        m_jit.move(thisValueGPR, tempGPR);
+        J_JITOperation_EJ function;
+        if (m_jit.graph().executableFor(node->origin.semantic)->isStrictMode())
+            function = operationToThisStrict;
+        else
+            function = operationToThis;
+        addSlowPathGenerator(
+            slowPathCall(slowCases, this, function, tempGPR, thisValueGPR));
+
+        jsValueResult(tempGPR, node);
+        break;
+    }
+
+    case CreateThis: {
+        // Note that there is not so much profit to speculate here. The only things we
+        // speculate on are (1) that it's a cell, since that eliminates cell checks
+        // later if the proto is reused, and (2) if we have a FinalObject prediction
+        // then we speculate because we want to get recompiled if it isn't (since
+        // otherwise we'd start taking slow path a lot).
+        
+        SpeculateCellOperand callee(this, node->child1());
+        GPRTemporary result(this);
+        GPRTemporary allocator(this);
+        GPRTemporary structure(this);
+        GPRTemporary scratch(this);
+        
+        GPRReg calleeGPR = callee.gpr();
+        GPRReg resultGPR = result.gpr();
+        GPRReg allocatorGPR = allocator.gpr();
+        GPRReg structureGPR = structure.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+        // Rare data is only used to access the allocator & structure
+        // We can avoid using an additional GPR this way
+        GPRReg rareDataGPR = structureGPR;
+        GPRReg inlineCapacityGPR = rareDataGPR;
+
+        MacroAssembler::JumpList slowPath;
+
+        slowPath.append(m_jit.branch8(JITCompiler::NotEqual,
+            JITCompiler::Address(calleeGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(JSFunctionType)));
+        m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
+        slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR));
+        m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorGPR);
+        m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureGPR);
+        slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, allocatorGPR));
+        emitAllocateJSObject(resultGPR, nullptr, allocatorGPR, structureGPR, TrustedImmPtr(0), scratchGPR, slowPath);
+        
+        m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfRareData()), rareDataGPR);
+        m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfInlineCapacity()), inlineCapacityGPR);
+        m_jit.emitInitializeInlineStorage(resultGPR, inlineCapacityGPR);
+        m_jit.mutatorFence();
+
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, calleeGPR, node->inlineCapacity()));
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case NewObject: {
+        GPRTemporary result(this);
+        GPRTemporary allocator(this);
+        GPRTemporary scratch(this);
+        
+        GPRReg resultGPR = result.gpr();
+        GPRReg allocatorGPR = allocator.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+        
+        MacroAssembler::JumpList slowPath;
+
+        RegisteredStructure structure = node->structure();
+        size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
+        MarkedAllocator* allocatorPtr = subspaceFor<JSFinalObject>(*m_jit.vm())->allocatorFor(allocationSize);
+
+        m_jit.move(TrustedImmPtr(allocatorPtr), allocatorGPR);
+        emitAllocateJSObject(resultGPR, allocatorPtr, allocatorGPR, TrustedImmPtr(structure), TrustedImmPtr(0), scratchGPR, slowPath);
+        m_jit.emitInitializeInlineStorage(resultGPR, structure->inlineCapacity());
+        m_jit.mutatorFence();
+
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewObject, resultGPR, structure));
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+
+    case GetCallee: {
+        GPRTemporary result(this);
+        m_jit.loadPtr(JITCompiler::addressFor(CallFrameSlot::callee), result.gpr());
+        cellResult(result.gpr(), node);
+        break;
+    }
+        
+    case GetArgumentCountIncludingThis: {
+        GPRTemporary result(this);
+        m_jit.load32(JITCompiler::payloadFor(CallFrameSlot::argumentCount), result.gpr());
+        int32Result(result.gpr(), node);
+        break;
+    }
+
+    case GetRestLength: {
+        compileGetRestLength(node);
+        break;
+    }
+        
+    case GetScope:
+        compileGetScope(node);
+        break;
+            
+    case SkipScope:
+        compileSkipScope(node);
+        break;
+
+    case GetGlobalObject:
+        compileGetGlobalObject(node);
+        break;
+        
+    case GetClosureVar: {
+        SpeculateCellOperand base(this, node->child1());
+        GPRTemporary result(this);
+        GPRReg baseGPR = base.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        m_jit.load64(JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset())), resultGPR);
+        jsValueResult(resultGPR, node);
+        break;
+    }
+    case PutClosureVar: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand value(this, node->child2());
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueGPR = value.gpr();
+
+        m_jit.store64(valueGPR, JITCompiler::Address(baseGPR, JSEnvironmentRecord::offsetOfVariable(node->scopeOffset())));
+        noResult(node);
+        break;
+    }
+
+    case TryGetById: {
+        compileTryGetById(node);
+        break;
+    }
+
+    case GetById: {
+        // FIXME https://bugs.webkit.org/show_bug.cgi?id=161158
+        // dedup with SpeculativeJIT::compileTryGetById and 32-bit version of this.
+        switch (node->child1().useKind()) {
+        case CellUse: {
+            SpeculateCellOperand base(this, node->child1());
+            GPRTemporary result(this, Reuse, base);
+            
+            GPRReg baseGPR = base.gpr();
+            GPRReg resultGPR = result.gpr();
+            
+            base.use();
+            
+            cachedGetById(node->origin.semantic, baseGPR, resultGPR, node->identifierNumber());
+            
+            jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+        
+        case UntypedUse: {
+            JSValueOperand base(this, node->child1());
+            GPRTemporary result(this, Reuse, base);
+        
+            GPRReg baseGPR = base.gpr();
+            GPRReg resultGPR = result.gpr();
+        
+            base.use();
+        
+            JITCompiler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(baseGPR));
+        
+            cachedGetById(node->origin.semantic, baseGPR, resultGPR, node->identifierNumber(), notCell);
+        
+            jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+            break;
+        }
+        break;
+    }
+
+    case GetByIdFlush: {
+        if (!node->prediction()) {
+            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+            break;
+        }
+
+        switch (node->child1().useKind()) {
+        case CellUse: {
+            SpeculateCellOperand base(this, node->child1());
+            GPRReg baseGPR = base.gpr();
+
+            GPRFlushedCallResult result(this);
+            
+            GPRReg resultGPR = result.gpr();
+            
+            base.use();
+            
+            flushRegisters();
+            
+            cachedGetById(node->origin.semantic, baseGPR, resultGPR, node->identifierNumber(), JITCompiler::Jump(), DontSpill);
+            
+            jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+        
+        case UntypedUse: {
+            JSValueOperand base(this, node->child1());
+            GPRReg baseGPR = base.gpr();
+
+            GPRFlushedCallResult result(this);
+            GPRReg resultGPR = result.gpr();
+        
+            base.use();
+            flushRegisters();
+        
+            JITCompiler::Jump notCell = m_jit.branchIfNotCell(JSValueRegs(baseGPR));
+        
+            cachedGetById(node->origin.semantic, baseGPR, resultGPR, node->identifierNumber(), notCell, DontSpill);
+        
+            jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+            break;
+        }
+        break;
+    }
+
+    case GetByIdWithThis: {
+        JSValueOperand base(this, node->child1());
+        GPRReg baseGPR = base.gpr();
+        JSValueOperand thisValue(this, node->child2());
+        GPRReg thisValueGPR = thisValue.gpr();
+
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        flushRegisters();
+        callOperation(operationGetByIdWithThis, resultGPR, baseGPR, thisValueGPR, identifierUID(node->identifierNumber()));
+        m_jit.exceptionCheck();
+
+        jsValueResult(resultGPR, node);
+        break;
+    }
+
+    case GetArrayLength:
+        compileGetArrayLength(node);
+        break;
+
+    case DeleteById: {
+        compileDeleteById(node);
+        break;
+    }
+
+    case DeleteByVal: {
+        compileDeleteByVal(node);
+        break;
+    }
+        
+    case CheckCell: {
+        SpeculateCellOperand cell(this, node->child1());
+        speculationCheck(BadCell, JSValueSource::unboxedCell(cell.gpr()), node->child1(), m_jit.branchWeakPtr(JITCompiler::NotEqual, cell.gpr(), node->cellOperand()->cell()));
+        noResult(node);
+        break;
+    }
+
+    case CheckNotEmpty: {
+        JSValueOperand operand(this, node->child1());
+        GPRReg gpr = operand.gpr();
+        speculationCheck(TDZFailure, JSValueSource(), nullptr, m_jit.branchTest64(JITCompiler::Zero, gpr));
+        noResult(node);
+        break;
+    }
+
+    case CheckStringIdent:
+        compileCheckStringIdent(node);
+        break;
+
+    case GetExecutable: {
+        SpeculateCellOperand function(this, node->child1());
+        GPRTemporary result(this, Reuse, function);
+        GPRReg functionGPR = function.gpr();
+        GPRReg resultGPR = result.gpr();
+        speculateCellType(node->child1(), functionGPR, SpecFunction, JSFunctionType);
+        m_jit.loadPtr(JITCompiler::Address(functionGPR, JSFunction::offsetOfExecutable()), resultGPR);
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case CheckStructure: {
+        compileCheckStructure(node);
+        break;
+    }
+        
+    case PutStructure: {
+        RegisteredStructure oldStructure = node->transition()->previous;
+        RegisteredStructure newStructure = node->transition()->next;
+
+        m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
+
+        SpeculateCellOperand base(this, node->child1());
+        GPRReg baseGPR = base.gpr();
+        
+        ASSERT_UNUSED(oldStructure, oldStructure->indexingType() == newStructure->indexingType());
+        ASSERT(oldStructure->typeInfo().type() == newStructure->typeInfo().type());
+        ASSERT(oldStructure->typeInfo().inlineTypeFlags() == newStructure->typeInfo().inlineTypeFlags());
+        m_jit.store32(MacroAssembler::TrustedImm32(newStructure->id()), MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()));
+        
+        noResult(node);
+        break;
+    }
+        
+    case AllocatePropertyStorage:
+        compileAllocatePropertyStorage(node);
+        break;
+        
+    case ReallocatePropertyStorage:
+        compileReallocatePropertyStorage(node);
+        break;
+        
+    case NukeStructureAndSetButterfly:
+        compileNukeStructureAndSetButterfly(node);
+        break;
+        
+    case GetButterfly:
+        compileGetButterfly(node);
+        break;
+
+    case GetIndexedPropertyStorage: {
+        compileGetIndexedPropertyStorage(node);
+        break;
+    }
+        
+    case ConstantStoragePointer: {
+        compileConstantStoragePointer(node);
+        break;
+    }
+        
+    case GetTypedArrayByteOffset: {
+        compileGetTypedArrayByteOffset(node);
+        break;
+    }
+        
+    case GetByOffset:
+    case GetGetterSetterByOffset: {
+        StorageOperand storage(this, node->child1());
+        GPRTemporary result(this, Reuse, storage);
+        
+        GPRReg storageGPR = storage.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        StorageAccessData& storageAccessData = node->storageAccessData();
+        
+        m_jit.load64(JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset)), resultGPR);
+        
+        jsValueResult(resultGPR, node);
+        break;
+    }
+        
+    case GetGetter: {
+        SpeculateCellOperand op1(this, node->child1());
+        GPRTemporary result(this, Reuse, op1);
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfGetter()), resultGPR);
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case GetSetter: {
+        SpeculateCellOperand op1(this, node->child1());
+        GPRTemporary result(this, Reuse, op1);
+        
+        GPRReg op1GPR = op1.gpr();
+        GPRReg resultGPR = result.gpr();
+        
+        m_jit.loadPtr(JITCompiler::Address(op1GPR, GetterSetter::offsetOfSetter()), resultGPR);
+        
+        cellResult(resultGPR, node);
+        break;
+    }
+        
+    case PutByOffset: {
+        StorageOperand storage(this, node->child1());
+        JSValueOperand value(this, node->child3());
+
+        GPRReg storageGPR = storage.gpr();
+        GPRReg valueGPR = value.gpr();
+
+        speculate(node, node->child2());
+
+        StorageAccessData& storageAccessData = node->storageAccessData();
+        
+        m_jit.store64(valueGPR, JITCompiler::Address(storageGPR, offsetRelativeToBase(storageAccessData.offset)));
+
+        noResult(node);
+        break;
+    }
+
+    case PutByIdFlush: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand value(this, node->child2());
+        GPRTemporary scratch(this);
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueGPR = value.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+        flushRegisters();
+
+        cachedPutById(node->origin.semantic, baseGPR, valueGPR, scratchGPR, node->identifierNumber(), NotDirect, MacroAssembler::Jump(), DontSpill);
+
+        noResult(node);
+        break;
+    }
+        
+    case PutById: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand value(this, node->child2());
+        GPRTemporary scratch(this);
+        
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueGPR = value.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+        
+        cachedPutById(node->origin.semantic, baseGPR, valueGPR, scratchGPR, node->identifierNumber(), NotDirect);
+
+        noResult(node);
+        break;
+    }
+
+    case PutByIdWithThis: {
+        JSValueOperand base(this, node->child1());
+        GPRReg baseGPR = base.gpr();
+        JSValueOperand thisValue(this, node->child2());
+        GPRReg thisValueGPR = thisValue.gpr();
+        JSValueOperand value(this, node->child3());
+        GPRReg valueGPR = value.gpr();
+
+        flushRegisters();
+        callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByIdWithThisStrict : operationPutByIdWithThis, NoResult, baseGPR, thisValueGPR, valueGPR, identifierUID(node->identifierNumber()));
+        m_jit.exceptionCheck();
+
+        noResult(node);
+        break;
+    }
+
+    case PutByValWithThis: {
+        JSValueOperand base(this, m_jit.graph().varArgChild(node, 0));
+        GPRReg baseGPR = base.gpr();
+        JSValueOperand thisValue(this, m_jit.graph().varArgChild(node, 1));
+        GPRReg thisValueGPR = thisValue.gpr();
+        JSValueOperand property(this, m_jit.graph().varArgChild(node, 2));
+        GPRReg propertyGPR = property.gpr();
+        JSValueOperand value(this, m_jit.graph().varArgChild(node, 3));
+        GPRReg valueGPR = value.gpr();
+
+        flushRegisters();
+        callOperation(m_jit.isStrictModeFor(node->origin.semantic) ? operationPutByValWithThisStrict : operationPutByValWithThis, NoResult, baseGPR, thisValueGPR, propertyGPR, valueGPR);
+        m_jit.exceptionCheck();
+
+        noResult(node);
+        break;
+    }
+
+    case PutByIdDirect: {
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand value(this, node->child2());
+        GPRTemporary scratch(this);
+        
+        GPRReg baseGPR = base.gpr();
+        GPRReg valueGPR = value.gpr();
+        GPRReg scratchGPR = scratch.gpr();
+        
+        cachedPutById(node->origin.semantic, baseGPR, valueGPR, scratchGPR, node->identifierNumber(), Direct);
+
+        noResult(node);
+        break;
+    }
+
+    case PutGetterById:
+    case PutSetterById: {
+        compilePutAccessorById(node);
+        break;
+    }
+
+    case PutGetterSetterById: {
+        compilePutGetterSetterById(node);
+        break;
+    }
+
+    case PutGetterByVal:
+    case PutSetterByVal: {
+        compilePutAccessorByVal(node);
+        break;
+    }
+
+    case DefineDataProperty: {
+        compileDefineDataProperty(node);
+        break;
+    }
+
+    case DefineAccessorProperty: {
+        compileDefineAccessorProperty(node);
+        break;
+    }
+
+    case GetGlobalLexicalVariable:
+    case GetGlobalVar: {
+        GPRTemporary result(this);
+
+        m_jit.load64(node->variablePointer(), result.gpr());
+
+        jsValueResult(result.gpr(), node);
+        break;
+    }
+
+    case PutGlobalVariable: {
+        JSValueOperand value(this, node->child2());
+
+        m_jit.store64(value.gpr(), node->variablePointer());
+
+        noResult(node);
+        break;
+    }
+
+    case PutDynamicVar: {
+        compilePutDynamicVar(node);
+        break;
+    }
+
+    case GetDynamicVar: {
+        compileGetDynamicVar(node);
+        break;
+    }
+
+    case ResolveScope: {
+        compileResolveScope(node);
+        break;
+    }
+
+    case NotifyWrite: {
+        compileNotifyWrite(node);
+        break;
+    }
+
+    case CheckTypeInfoFlags: {
+        compileCheckTypeInfoFlags(node);
+        break;
+    }
+
+    case OverridesHasInstance: {
+
+        Node* hasInstanceValueNode = node->child2().node();
+        JSFunction* defaultHasInstanceFunction = jsCast<JSFunction*>(node->cellOperand()->value());
+
+        MacroAssembler::Jump notDefault;
+        SpeculateCellOperand base(this, node->child1());
+        JSValueOperand hasInstanceValue(this, node->child2());
+        GPRTemporary result(this);
+
+        GPRReg resultGPR = result.gpr();
+        GPRReg baseGPR = base.gpr();
+
+        // It would be great if constant folding handled automatically the case where we knew the hasInstance function
+        // was a constant. Unfortunately, the folding rule for OverridesHasInstance is in the strength reduction phase
+        // since it relies on OSR information. https://bugs.webkit.org/show_bug.cgi?id=154832
+        if (!hasInstanceValueNode->isCellConstant() || defaultHasInstanceFunction != hasInstanceValueNode->asCell()) {
+            GPRReg hasInstanceValueGPR = hasInstanceValue.gpr();
+            notDefault = m_jit.branchPtr(MacroAssembler::NotEqual, hasInstanceValueGPR, TrustedImmPtr(node->cellOperand()));
+        }
+
+        // Check that base 'ImplementsDefaultHasInstance'.
+        m_jit.test8(MacroAssembler::Zero, MacroAssembler::Address(baseGPR, JSCell::typeInfoFlagsOffset()), MacroAssembler::TrustedImm32(ImplementsDefaultHasInstance), resultGPR);
+        m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+        MacroAssembler::Jump done = m_jit.jump();
+
+        if (notDefault.isSet()) {
+            notDefault.link(&m_jit);
+            moveTrueTo(resultGPR);
+        }
+
+        done.link(&m_jit);
+        jsValueResult(resultGPR, node, DataFormatJSBoolean);
+        break;
+    }
+
+    case InstanceOf: {
+        compileInstanceOf(node);
+        break;
+    }
+
+    case InstanceOfCustom: {
+        compileInstanceOfCustom(node);
+        break;
+    }
+
+    case IsEmpty: {        
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value);
+
+        m_jit.comparePtr(JITCompiler::Equal, value.gpr(), TrustedImm32(JSValue::encode(JSValue())), result.gpr());
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        break;
+    }
+        
+    case IsUndefined: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this);
+        GPRTemporary localGlobalObject(this);
+        GPRTemporary remoteGlobalObject(this);
+        GPRTemporary scratch(this);
+
+        JITCompiler::Jump isCell = m_jit.branchIfCell(value.jsValueRegs());
+
+        m_jit.compare64(JITCompiler::Equal, value.gpr(), TrustedImm32(ValueUndefined), result.gpr());
+        JITCompiler::Jump done = m_jit.jump();
+        
+        isCell.link(&m_jit);
+        JITCompiler::Jump notMasqueradesAsUndefined;
+        if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+            m_jit.move(TrustedImm32(0), result.gpr());
+            notMasqueradesAsUndefined = m_jit.jump();
+        } else {
+            JITCompiler::Jump isMasqueradesAsUndefined = m_jit.branchTest8(
+                JITCompiler::NonZero, 
+                JITCompiler::Address(value.gpr(), JSCell::typeInfoFlagsOffset()), 
+                TrustedImm32(MasqueradesAsUndefined));
+            m_jit.move(TrustedImm32(0), result.gpr());
+            notMasqueradesAsUndefined = m_jit.jump();
+
+            isMasqueradesAsUndefined.link(&m_jit);
+            GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
+            GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
+            m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.globalObjectFor(node->origin.semantic)), localGlobalObjectGPR);
+            m_jit.emitLoadStructure(value.gpr(), result.gpr(), scratch.gpr());
+            m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), remoteGlobalObjectGPR); 
+            m_jit.comparePtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, result.gpr());
+        }
+
+        notMasqueradesAsUndefined.link(&m_jit);
+        done.link(&m_jit);
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        break;
+    }
+        
+    case IsBoolean: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value);
+        
+        m_jit.move(value.gpr(), result.gpr());
+        m_jit.xor64(JITCompiler::TrustedImm32(ValueFalse), result.gpr());
+        m_jit.test64(JITCompiler::Zero, result.gpr(), JITCompiler::TrustedImm32(static_cast<int32_t>(~1)), result.gpr());
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        break;
+    }
+        
+    case IsNumber: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value);
+        
+        m_jit.test64(JITCompiler::NonZero, value.gpr(), GPRInfo::tagTypeNumberRegister, result.gpr());
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        break;
+    }
+        
+    case MapHash: {
+        switch (node->child1().useKind()) {
+        case BooleanUse:
+        case Int32Use:
+        case SymbolUse:
+        case ObjectUse: {
+            JSValueOperand input(this, node->child1(), ManualOperandSpeculation);
+            GPRTemporary result(this, Reuse, input);
+            GPRTemporary temp(this);
+
+            GPRReg inputGPR = input.gpr();
+            GPRReg resultGPR = result.gpr();
+            GPRReg tempGPR = temp.gpr();
+
+            speculate(node, node->child1());
+
+            m_jit.move(inputGPR, resultGPR);
+            m_jit.wangsInt64Hash(resultGPR, tempGPR);
+            int32Result(resultGPR, node);
+            break;
+        }
+        case CellUse:
+        case StringUse: {
+            SpeculateCellOperand input(this, node->child1());
+            GPRTemporary result(this);
+            std::optional<GPRTemporary> temp;
+
+            GPRReg tempGPR = InvalidGPRReg;
+            if (node->child1().useKind() == CellUse) {
+                temp.emplace(this);
+                tempGPR = temp->gpr();
+            }
+
+            GPRReg inputGPR = input.gpr();
+            GPRReg resultGPR = result.gpr();
+
+            MacroAssembler::JumpList slowPath;
+            MacroAssembler::JumpList done;
+
+            if (node->child1().useKind() == StringUse)
+                speculateString(node->child1(), inputGPR);
+            else {
+                auto isString = m_jit.branch8(MacroAssembler::Equal, MacroAssembler::Address(inputGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType));
+                m_jit.move(inputGPR, resultGPR);
+                m_jit.wangsInt64Hash(resultGPR, tempGPR);
+                done.append(m_jit.jump());
+                isString.link(&m_jit);
+            }
+
+            m_jit.loadPtr(MacroAssembler::Address(inputGPR, JSString::offsetOfValue()), resultGPR);
+            slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR));
+            m_jit.load32(MacroAssembler::Address(resultGPR, StringImpl::flagsOffset()), resultGPR);
+            m_jit.urshift32(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), resultGPR);
+            slowPath.append(m_jit.branchTest32(MacroAssembler::Zero, resultGPR));
+            done.append(m_jit.jump());
+
+            slowPath.link(&m_jit);
+            silentSpillAllRegisters(resultGPR);
+            callOperation(operationMapHash, resultGPR, JSValueRegs(inputGPR));
+            silentFillAllRegisters(resultGPR);
+            m_jit.exceptionCheck();
+
+            done.link(&m_jit);
+            int32Result(resultGPR, node);
+            break;
+        }
+        default:
+            RELEASE_ASSERT(node->child1().useKind() == UntypedUse);
+            break;
+        }
+        
+        if (node->child1().useKind() != UntypedUse)
+            break;
+
+        JSValueOperand input(this, node->child1());
+        GPRTemporary temp(this);
+        GPRTemporary result(this);
+
+        GPRReg inputGPR = input.gpr();
+        GPRReg resultGPR = result.gpr();
+        GPRReg tempGPR = temp.gpr();
+
+        MacroAssembler::JumpList straightHash;
+        MacroAssembler::JumpList done;
+        auto isNotCell = m_jit.branchIfNotCell(inputGPR);
+        MacroAssembler::JumpList slowPath;
+        straightHash.append(m_jit.branch8(MacroAssembler::NotEqual, MacroAssembler::Address(inputGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+        m_jit.loadPtr(MacroAssembler::Address(inputGPR, JSString::offsetOfValue()), resultGPR);
+        slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, resultGPR));
+        m_jit.load32(MacroAssembler::Address(resultGPR, StringImpl::flagsOffset()), resultGPR);
+        m_jit.urshift32(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), resultGPR);
+        slowPath.append(m_jit.branchTest32(MacroAssembler::Zero, resultGPR));
+        done.append(m_jit.jump());
+
+        isNotCell.link(&m_jit);
+        straightHash.append(m_jit.branchIfNotNumber(inputGPR));
+        straightHash.append(m_jit.branchIfInt32(JSValueRegs(inputGPR)));
+        slowPath.append(m_jit.jump());
+
+        straightHash.link(&m_jit);
+        m_jit.move(inputGPR, resultGPR);
+        m_jit.wangsInt64Hash(resultGPR, tempGPR);
+        done.append(m_jit.jump());
+
+        slowPath.link(&m_jit);
+        silentSpillAllRegisters(resultGPR);
+        callOperation(operationMapHash, resultGPR, JSValueRegs(inputGPR));
+        silentFillAllRegisters(resultGPR);
+        m_jit.exceptionCheck();
+
+        done.link(&m_jit);
+        int32Result(resultGPR, node);
+        break;
+    }
+    case GetMapBucket: {
+        SpeculateCellOperand map(this, node->child1());
+        JSValueOperand key(this, node->child2(), ManualOperandSpeculation);
+        SpeculateInt32Operand hash(this, node->child3());
+        GPRTemporary mask(this);
+        GPRTemporary index(this);
+        GPRTemporary buffer(this);
+        GPRTemporary bucket(this);
+        GPRTemporary result(this);
+
+        GPRReg hashGPR = hash.gpr();
+        GPRReg mapGPR = map.gpr();
+        GPRReg maskGPR = mask.gpr();
+        GPRReg indexGPR = index.gpr();
+        GPRReg bufferGPR = buffer.gpr();
+        GPRReg bucketGPR = bucket.gpr();
+        GPRReg keyGPR = key.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        if (node->child1().useKind() == MapObjectUse)
+            speculateMapObject(node->child1(), mapGPR);
+        else if (node->child1().useKind() == SetObjectUse)
+            speculateSetObject(node->child1(), mapGPR);
+        else
+            RELEASE_ASSERT_NOT_REACHED();
+
+        if (node->child2().useKind() != UntypedUse)
+            speculate(node, node->child2());
+
+        m_jit.loadPtr(MacroAssembler::Address(mapGPR, node->child1().useKind() == MapObjectUse ? JSMap::offsetOfHashMapImpl() : JSSet::offsetOfHashMapImpl()), bufferGPR);
+        m_jit.load32(MacroAssembler::Address(bufferGPR, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfCapacity()), maskGPR);
+        m_jit.loadPtr(MacroAssembler::Address(bufferGPR, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfBuffer()), bufferGPR);
+        m_jit.sub32(TrustedImm32(1), maskGPR);
+        m_jit.move(hashGPR, indexGPR);
+
+        MacroAssembler::Label loop = m_jit.label();
+        MacroAssembler::JumpList done;
+        MacroAssembler::JumpList slowPathCases;
+        MacroAssembler::JumpList loopAround;
+
+        m_jit.and32(maskGPR, indexGPR);
+        m_jit.loadPtr(MacroAssembler::BaseIndex(bufferGPR, indexGPR, MacroAssembler::TimesEight), bucketGPR);
+        m_jit.move(bucketGPR, resultGPR);
+        auto notPresentInTable = m_jit.branchPtr(MacroAssembler::Equal, 
+            bucketGPR, TrustedImmPtr(bitwise_cast<size_t>(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::emptyValue())));
+        loopAround.append(m_jit.branchPtr(MacroAssembler::Equal, 
+            bucketGPR, TrustedImmPtr(bitwise_cast<size_t>(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::deletedValue()))));
+
+        m_jit.load64(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKey>::offsetOfKey()), bucketGPR);
+
+        // Perform Object.is()
+        switch (node->child2().useKind()) {
+        case BooleanUse:
+        case Int32Use:
+        case SymbolUse:
+        case ObjectUse: {
+            done.append(m_jit.branch64(MacroAssembler::Equal, bucketGPR, keyGPR)); // They're definitely the same value, we found the bucket we were looking for!
+            // Otherwise, loop around.
+            break;
+        }
+        case CellUse: {
+            done.append(m_jit.branch64(MacroAssembler::Equal, bucketGPR, keyGPR));
+            loopAround.append(m_jit.branchIfNotCell(JSValueRegs(bucketGPR)));
+            loopAround.append(m_jit.branch8(JITCompiler::NotEqual,
+                JITCompiler::Address(bucketGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+            loopAround.append(m_jit.branch8(JITCompiler::NotEqual,
+                JITCompiler::Address(keyGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+            // They're both strings.
+            slowPathCases.append(m_jit.jump());
+            break;
+        }
+        case StringUse: {
+            done.append(m_jit.branch64(MacroAssembler::Equal, bucketGPR, keyGPR)); // They're definitely the same value, we found the bucket we were looking for!
+            loopAround.append(m_jit.branchIfNotCell(JSValueRegs(bucketGPR)));
+            loopAround.append(m_jit.branch8(JITCompiler::NotEqual,
+                JITCompiler::Address(bucketGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+            slowPathCases.append(m_jit.jump());
+            break;
+        }
+        case UntypedUse: { 
+            done.append(m_jit.branch64(MacroAssembler::Equal, bucketGPR, keyGPR)); // They're definitely the same value, we found the bucket we were looking for!
+            auto oneIsntCell = m_jit.branchIfNotCell(JSValueRegs(bucketGPR));
+            // first is a cell here.
+            loopAround.append(m_jit.branchIfNotCell(JSValueRegs(keyGPR)));
+            // Both are cells here.
+            loopAround.append(m_jit.branch8(JITCompiler::NotEqual,
+                JITCompiler::Address(bucketGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+            // The first is a string here.
+            slowPathCases.append(m_jit.branch8(JITCompiler::Equal,
+                JITCompiler::Address(keyGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+            // The first is a string, but the second is not, we continue to loop around.
+            loopAround.append(m_jit.jump());
+
+            oneIsntCell.link(&m_jit);
+            // We've already done a 64-bit compare at this point, so if one is not a number, they're definitely not equal.
+            loopAround.append(m_jit.branchIfNotNumber(bucketGPR));
+            loopAround.append(m_jit.branchIfNotNumber(keyGPR));
+            // Both are definitely numbers. If we see a double, we go to the slow path.
+            slowPathCases.append(m_jit.branchIfNotInt32(bucketGPR));
+            slowPathCases.append(m_jit.branchIfNotInt32(keyGPR));
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+            
+        if (!loopAround.empty())
+            loopAround.link(&m_jit);
+
+        m_jit.add32(TrustedImm32(1), indexGPR);
+        m_jit.jump().linkTo(loop, &m_jit);
+
+        if (!slowPathCases.empty()) {
+            slowPathCases.link(&m_jit);
+            silentSpillAllRegisters(indexGPR);
+            if (node->child1().useKind() == MapObjectUse)
+                callOperation(operationJSMapFindBucket, resultGPR, mapGPR, keyGPR, hashGPR);
+            else
+                callOperation(operationJSSetFindBucket, resultGPR, mapGPR, keyGPR, hashGPR);
+            silentFillAllRegisters(indexGPR);
+            m_jit.exceptionCheck();
+            done.append(m_jit.jump());
+        }
+
+        notPresentInTable.link(&m_jit);
+        m_jit.move(TrustedImmPtr(nullptr), resultGPR);
+        done.link(&m_jit);
+        cellResult(resultGPR, node);
+        break;
+    }
+
+    case LoadFromJSMapBucket: {
+        SpeculateCellOperand bucket(this, node->child1());
+        GPRTemporary result(this);
+
+        GPRReg bucketGPR = bucket.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        auto notBucket = m_jit.branchTestPtr(MacroAssembler::Zero, bucketGPR);
+        m_jit.load64(MacroAssembler::Address(bucketGPR, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()), resultGPR);
+        auto done = m_jit.jump();
+
+        notBucket.link(&m_jit);
+        m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), resultGPR);
+        done.link(&m_jit);
+        jsValueResult(resultGPR, node);
+        break;
+    }
+
+    case IsNonEmptyMapBucket: {
+        SpeculateCellOperand bucket(this, node->child1());
+        GPRTemporary result(this);
+
+        GPRReg bucketGPR = bucket.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        m_jit.comparePtr(MacroAssembler::NotEqual, bucketGPR, TrustedImm32(0), resultGPR);
+        m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+        jsValueResult(resultGPR, node, DataFormatJSBoolean);
+        break;
+    }
+
+    case ToLowerCase: {
+        compileToLowerCase(node);
+        break;
+    }
+
+    case IsObject: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary result(this, Reuse, value);
+
+        JITCompiler::Jump isNotCell = m_jit.branchIfNotCell(value.jsValueRegs());
+
+        m_jit.compare8(JITCompiler::AboveOrEqual,
+            JITCompiler::Address(value.gpr(), JSCell::typeInfoTypeOffset()),
+            TrustedImm32(ObjectType),
+            result.gpr());
+        m_jit.or32(TrustedImm32(ValueFalse), result.gpr());
+        JITCompiler::Jump done = m_jit.jump();
+
+        isNotCell.link(&m_jit);
+        m_jit.move(TrustedImm32(ValueFalse), result.gpr());
+
+        done.link(&m_jit);
+        jsValueResult(result.gpr(), node, DataFormatJSBoolean);
+        break;
+    }
+
+    case IsObjectOrNull: {
+        compileIsObjectOrNull(node);
+        break;
+    }
+
+    case IsFunction: {
+        compileIsFunction(node);
+        break;
+    }
+
+    case IsCellWithType: {
+        compileIsCellWithType(node);
+        break;
+    }
+
+    case IsTypedArrayView: {
+        compileIsTypedArrayView(node);
+        break;
+    }
+
+    case TypeOf: {
+        compileTypeOf(node);
+        break;
+    }
+
+    case Flush:
+        break;
+
+    case Call:
+    case TailCall:
+    case TailCallInlinedCaller:
+    case Construct:
+    case CallVarargs:
+    case TailCallVarargs:
+    case TailCallVarargsInlinedCaller:
+    case CallForwardVarargs:
+    case ConstructVarargs:
+    case ConstructForwardVarargs:
+    case TailCallForwardVarargs:
+    case TailCallForwardVarargsInlinedCaller:
+    case CallEval:
+    case DirectCall:
+    case DirectConstruct:
+    case DirectTailCall:
+    case DirectTailCallInlinedCaller:
+        emitCall(node);
+        break;
+
+    case LoadVarargs: {
+        LoadVarargsData* data = node->loadVarargsData();
+        
+        GPRReg argumentsGPR;
+        {
+            JSValueOperand arguments(this, node->child1());
+            argumentsGPR = arguments.gpr();
+            flushRegisters();
+        }
+        
+        callOperation(operationSizeOfVarargs, GPRInfo::returnValueGPR, argumentsGPR, data->offset);
+        m_jit.exceptionCheck();
+        
+        lock(GPRInfo::returnValueGPR);
+        {
+            JSValueOperand arguments(this, node->child1());
+            argumentsGPR = arguments.gpr();
+            flushRegisters();
+        }
+        unlock(GPRInfo::returnValueGPR);
+        
+        // FIXME: There is a chance that we will call an effectful length property twice. This is safe
+        // from the standpoint of the VM's integrity, but it's subtly wrong from a spec compliance
+        // standpoint. The best solution would be one where we can exit *into* the op_call_varargs right
+        // past the sizing.
+        // https://bugs.webkit.org/show_bug.cgi?id=141448
+
+        GPRReg argCountIncludingThisGPR =
+            JITCompiler::selectScratchGPR(GPRInfo::returnValueGPR, argumentsGPR);
+        
+        m_jit.add32(TrustedImm32(1), GPRInfo::returnValueGPR, argCountIncludingThisGPR);
+        speculationCheck(
+            VarargsOverflow, JSValueSource(), Edge(), m_jit.branch32(
+                MacroAssembler::Above,
+                argCountIncludingThisGPR,
+                TrustedImm32(data->limit)));
+        
+        m_jit.store32(argCountIncludingThisGPR, JITCompiler::payloadFor(data->machineCount));
+        
+        callOperation(operationLoadVarargs, data->machineStart.offset(), argumentsGPR, data->offset, GPRInfo::returnValueGPR, data->mandatoryMinimum);
+        m_jit.exceptionCheck();
+        
+        noResult(node);
+        break;
+    }
+        
+    case ForwardVarargs: {
+        compileForwardVarargs(node);
+        break;
+    }
+        
+    case CreateActivation: {
+        compileCreateActivation(node);
+        break;
+    }
+        
+    case CreateDirectArguments: {
+        compileCreateDirectArguments(node);
+        break;
+    }
+        
+    case GetFromArguments: {
+        compileGetFromArguments(node);
+        break;
+    }
+        
+    case PutToArguments: {
+        compilePutToArguments(node);
+        break;
+    }
+
+    case GetArgument: {
+        compileGetArgument(node);
+        break;
+    }
+        
+    case CreateScopedArguments: {
+        compileCreateScopedArguments(node);
+        break;
+    }
+        
+    case CreateClonedArguments: {
+        compileCreateClonedArguments(node);
+        break;
+    }
+    case CreateRest: {
+        compileCreateRest(node);
+        break;
+    }
+
+    case NewFunction:
+    case NewGeneratorFunction:
+    case NewAsyncFunction:
+        compileNewFunction(node);
+        break;
+
+    case SetFunctionName:
+        compileSetFunctionName(node);
+        break;
+
+    case In:
+        compileIn(node);
+        break;
+
+    case HasOwnProperty: {
+        SpeculateCellOperand object(this, node->child1());
+        GPRTemporary uniquedStringImpl(this);
+        GPRTemporary temp(this);
+        GPRTemporary hash(this);
+        GPRTemporary structureID(this);
+        GPRTemporary result(this);
+
+        std::optional<SpeculateCellOperand> keyAsCell;
+        std::optional<JSValueOperand> keyAsValue;
+        GPRReg keyGPR;
+        if (node->child2().useKind() == UntypedUse) {
+            keyAsValue.emplace(this, node->child2());
+            keyGPR = keyAsValue->gpr();
+        } else {
+            ASSERT(node->child2().useKind() == StringUse || node->child2().useKind() == SymbolUse);
+            keyAsCell.emplace(this, node->child2());
+            keyGPR = keyAsCell->gpr();
+        }
+
+        GPRReg objectGPR = object.gpr();
+        GPRReg implGPR = uniquedStringImpl.gpr();
+        GPRReg tempGPR = temp.gpr();
+        GPRReg hashGPR = hash.gpr();
+        GPRReg structureIDGPR = structureID.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        speculateObject(node->child1());
+
+        MacroAssembler::JumpList slowPath;
+        switch (node->child2().useKind()) {
+        case SymbolUse: {
+            speculateSymbol(node->child2(), keyGPR);
+            m_jit.loadPtr(MacroAssembler::Address(keyGPR, Symbol::offsetOfSymbolImpl()), implGPR);
+            break;
+        }
+        case StringUse: {
+            speculateString(node->child2(), keyGPR);
+            m_jit.loadPtr(MacroAssembler::Address(keyGPR, JSString::offsetOfValue()), implGPR);
+            slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, implGPR));
+            slowPath.append(m_jit.branchTest32(
+                MacroAssembler::Zero, MacroAssembler::Address(implGPR, StringImpl::flagsOffset()),
+                MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic())));
+            break;
+        }
+        case UntypedUse: {
+            slowPath.append(m_jit.branchIfNotCell(JSValueRegs(keyGPR)));
+            auto isNotString = m_jit.branchIfNotString(keyGPR);
+            m_jit.loadPtr(MacroAssembler::Address(keyGPR, JSString::offsetOfValue()), implGPR);
+            slowPath.append(m_jit.branchTestPtr(MacroAssembler::Zero, implGPR));
+            slowPath.append(m_jit.branchTest32(
+                MacroAssembler::Zero, MacroAssembler::Address(implGPR, StringImpl::flagsOffset()),
+                MacroAssembler::TrustedImm32(StringImpl::flagIsAtomic())));
+            auto hasUniquedImpl = m_jit.jump();
+
+            isNotString.link(&m_jit);
+            slowPath.append(m_jit.branchIfNotSymbol(keyGPR));
+            m_jit.loadPtr(MacroAssembler::Address(keyGPR, Symbol::offsetOfSymbolImpl()), implGPR);
+
+            hasUniquedImpl.link(&m_jit);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        // Note that we don't test if the hash is zero here. AtomicStringImpl's can't have a zero
+        // hash, however, a SymbolImpl may. But, because this is a cache, we don't care. We only
+        // ever load the result from the cache if the cache entry matches what we are querying for.
+        // So we either get super lucky and use zero for the hash and somehow collide with the entity
+        // we're looking for, or we realize we're comparing against another entity, and go to the
+        // slow path anyways.
+        m_jit.load32(MacroAssembler::Address(implGPR, UniquedStringImpl::flagsOffset()), hashGPR);
+        m_jit.urshift32(MacroAssembler::TrustedImm32(StringImpl::s_flagCount), hashGPR);
+        m_jit.load32(MacroAssembler::Address(objectGPR, JSCell::structureIDOffset()), structureIDGPR);
+        m_jit.add32(structureIDGPR, hashGPR);
+        m_jit.and32(TrustedImm32(HasOwnPropertyCache::mask), hashGPR);
+        static_assert(sizeof(HasOwnPropertyCache::Entry) == 16, "Strong assumption of that here.");
+        m_jit.lshift32(TrustedImm32(4), hashGPR);
+        ASSERT(m_jit.vm()->hasOwnPropertyCache());
+        m_jit.move(TrustedImmPtr(m_jit.vm()->hasOwnPropertyCache()), tempGPR);
+        slowPath.append(m_jit.branchPtr(MacroAssembler::NotEqual, 
+            MacroAssembler::BaseIndex(tempGPR, hashGPR, MacroAssembler::TimesOne, HasOwnPropertyCache::Entry::offsetOfImpl()), implGPR));
+        m_jit.load8(MacroAssembler::BaseIndex(tempGPR, hashGPR, MacroAssembler::TimesOne, HasOwnPropertyCache::Entry::offsetOfResult()), resultGPR);
+        m_jit.load32(MacroAssembler::BaseIndex(tempGPR, hashGPR, MacroAssembler::TimesOne, HasOwnPropertyCache::Entry::offsetOfStructureID()), tempGPR);
+        slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, tempGPR, structureIDGPR));
+        auto done = m_jit.jump();
+
+        slowPath.link(&m_jit);
+        silentSpillAllRegisters(resultGPR);
+        callOperation(operationHasOwnProperty, resultGPR, objectGPR, keyGPR);
+        silentFillAllRegisters(resultGPR);
+        m_jit.exceptionCheck();
+
+        done.link(&m_jit);
+        m_jit.or32(TrustedImm32(ValueFalse), resultGPR);
+        jsValueResult(resultGPR, node, DataFormatJSBoolean);
+        break;
+    }
+        
+    case CountExecution:
+        m_jit.add64(TrustedImm32(1), MacroAssembler::AbsoluteAddress(node->executionCounter()->address()));
+        break;
+
+    case ForceOSRExit: {
+        terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+        break;
+    }
+        
+    case InvalidationPoint:
+        emitInvalidationPoint(node);
+        break;
+
+    case CheckWatchdogTimer: {
+        ASSERT(m_jit.vm()->watchdog());
+        GPRTemporary unused(this);
+        GPRReg unusedGPR = unused.gpr();
+
+        JITCompiler::Jump timerDidFire = m_jit.branchTest8(JITCompiler::NonZero,
+            JITCompiler::AbsoluteAddress(m_jit.vm()->watchdog()->timerDidFireAddress()));
+
+        addSlowPathGenerator(slowPathCall(timerDidFire, this, operationHandleWatchdogTimer, unusedGPR));
+        break;
+    }
+
+    case Phantom:
+    case Check:
+        DFG_NODE_DO_TO_CHILDREN(m_jit.graph(), node, speculate);
+        noResult(node);
+        break;
+        
+    case PhantomLocal:
+    case LoopHint:
+        // This is a no-op.
+        noResult(node);
+        break;
+
+    case Unreachable:
+        unreachable(node);
+        break;
+
+    case StoreBarrier:
+    case FencedStoreBarrier: {
+        compileStoreBarrier(node);
+        break;
+    }
+        
+    case GetEnumerableLength: {
+        SpeculateCellOperand enumerator(this, node->child1());
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        m_jit.load32(MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::indexedLengthOffset()), resultGPR);
+        int32Result(resultGPR, node);
+        break;
+    }
+    case HasGenericProperty: {
+        JSValueOperand base(this, node->child1());
+        SpeculateCellOperand property(this, node->child2());
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        flushRegisters();
+        callOperation(operationHasGenericProperty, resultGPR, base.gpr(), property.gpr());
+        m_jit.exceptionCheck();
+        jsValueResult(resultGPR, node, DataFormatJSBoolean);
+        break;
+    }
+    case HasStructureProperty: {
+        JSValueOperand base(this, node->child1());
+        SpeculateCellOperand property(this, node->child2());
+        SpeculateCellOperand enumerator(this, node->child3());
+        GPRTemporary result(this);
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg propertyGPR = property.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        m_jit.load32(MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()), resultGPR);
+        MacroAssembler::Jump wrongStructure = m_jit.branch32(MacroAssembler::NotEqual, 
+            resultGPR, 
+            MacroAssembler::Address(enumerator.gpr(), JSPropertyNameEnumerator::cachedStructureIDOffset()));
+
+        moveTrueTo(resultGPR);
+        MacroAssembler::Jump done = m_jit.jump();
+
+        done.link(&m_jit);
+
+        addSlowPathGenerator(slowPathCall(wrongStructure, this, operationHasGenericProperty, resultGPR, baseGPR, propertyGPR));
+        jsValueResult(resultGPR, node, DataFormatJSBoolean);
+        break;
+    }
+    case HasIndexedProperty: {
+        SpeculateCellOperand base(this, node->child1());
+        SpeculateStrictInt32Operand index(this, node->child2());
+        GPRTemporary result(this);
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg indexGPR = index.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        MacroAssembler::JumpList slowCases;
+        ArrayMode mode = node->arrayMode();
+        switch (mode.type()) {
+        case Array::Int32:
+        case Array::Contiguous: {
+            ASSERT(!!node->child3());
+            StorageOperand storage(this, node->child3());
+            GPRTemporary scratch(this);
+            
+            GPRReg storageGPR = storage.gpr();
+            GPRReg scratchGPR = scratch.gpr();
+
+            MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            if (mode.isInBounds())
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, outOfBounds);
+            else
+                slowCases.append(outOfBounds);
+
+            m_jit.load64(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight), scratchGPR);
+            slowCases.append(m_jit.branchTest64(MacroAssembler::Zero, scratchGPR));
+            moveTrueTo(resultGPR);
+            break;
+        }
+        case Array::Double: {
+            ASSERT(!!node->child3());
+            StorageOperand storage(this, node->child3());
+            FPRTemporary scratch(this);
+            FPRReg scratchFPR = scratch.fpr();
+            GPRReg storageGPR = storage.gpr();
+
+            MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()));
+            if (mode.isInBounds())
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, outOfBounds);
+            else
+                slowCases.append(outOfBounds);
+
+            m_jit.loadDouble(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight), scratchFPR);
+            slowCases.append(m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, scratchFPR, scratchFPR));
+            moveTrueTo(resultGPR);
+            break;
+        }
+        case Array::ArrayStorage: {
+            ASSERT(!!node->child3());
+            StorageOperand storage(this, node->child3());
+            GPRTemporary scratch(this);
+
+            GPRReg storageGPR = storage.gpr();
+            GPRReg scratchGPR = scratch.gpr();
+
+            MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, indexGPR, MacroAssembler::Address(storageGPR, ArrayStorage::vectorLengthOffset()));
+            if (mode.isInBounds())
+                speculationCheck(OutOfBounds, JSValueRegs(), 0, outOfBounds);
+            else    
+                slowCases.append(outOfBounds);
+
+            m_jit.load64(MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight, ArrayStorage::vectorOffset()), scratchGPR);
+            slowCases.append(m_jit.branchTest64(MacroAssembler::Zero, scratchGPR));
+            moveTrueTo(resultGPR);
+            break;
+        }
+        default: {
+            slowCases.append(m_jit.jump());
+            break;
+        }
+        }
+
+        addSlowPathGenerator(slowPathCall(slowCases, this, operationHasIndexedProperty, resultGPR, baseGPR, indexGPR));
+        
+        jsValueResult(resultGPR, node, DataFormatJSBoolean);
+        break;
+    }
+    case GetDirectPname: {
+        Edge& baseEdge = m_jit.graph().varArgChild(node, 0);
+        Edge& propertyEdge = m_jit.graph().varArgChild(node, 1);
+        Edge& indexEdge = m_jit.graph().varArgChild(node, 2);
+        Edge& enumeratorEdge = m_jit.graph().varArgChild(node, 3);
+
+        SpeculateCellOperand base(this, baseEdge);
+        SpeculateCellOperand property(this, propertyEdge);
+        SpeculateStrictInt32Operand index(this, indexEdge);
+        SpeculateCellOperand enumerator(this, enumeratorEdge);
+        GPRTemporary result(this);
+        GPRTemporary scratch1(this);
+        GPRTemporary scratch2(this);
+
+        GPRReg baseGPR = base.gpr();
+        GPRReg propertyGPR = property.gpr();
+        GPRReg indexGPR = index.gpr();
+        GPRReg enumeratorGPR = enumerator.gpr();
+        GPRReg resultGPR = result.gpr();
+        GPRReg scratch1GPR = scratch1.gpr();
+        GPRReg scratch2GPR = scratch2.gpr();
+
+        MacroAssembler::JumpList slowPath;
+
+        // Check the structure
+        m_jit.load32(MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
+        slowPath.append(
+            m_jit.branch32(
+                MacroAssembler::NotEqual, 
+                scratch1GPR,
+                MacroAssembler::Address(
+                    enumeratorGPR, JSPropertyNameEnumerator::cachedStructureIDOffset())));
+        
+        // Compute the offset
+        // If index is less than the enumerator's cached inline storage, then it's an inline access
+        MacroAssembler::Jump outOfLineAccess = m_jit.branch32(MacroAssembler::AboveOrEqual, 
+            indexGPR, MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()));
+
+        m_jit.load64(MacroAssembler::BaseIndex(baseGPR, indexGPR, MacroAssembler::TimesEight, JSObject::offsetOfInlineStorage()), resultGPR);
+
+        MacroAssembler::Jump done = m_jit.jump();
+        
+        // Otherwise it's out of line
+        outOfLineAccess.link(&m_jit);
+        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), scratch2GPR);
+        m_jit.move(indexGPR, scratch1GPR);
+        m_jit.sub32(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), scratch1GPR);
+        m_jit.neg32(scratch1GPR);
+        m_jit.signExtend32ToPtr(scratch1GPR, scratch1GPR);
+        int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
+        m_jit.load64(MacroAssembler::BaseIndex(scratch2GPR, scratch1GPR, MacroAssembler::TimesEight, offsetOfFirstProperty), resultGPR);
+
+        done.link(&m_jit);
+
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationGetByVal, resultGPR, baseGPR, propertyGPR));
+
+        jsValueResult(resultGPR, node);
+        break;
+    }
+    case GetPropertyEnumerator: {
+        SpeculateCellOperand base(this, node->child1());
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        flushRegisters();
+        callOperation(operationGetPropertyEnumerator, resultGPR, base.gpr());
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        break;
+    }
+    case GetEnumeratorStructurePname:
+    case GetEnumeratorGenericPname: {
+        SpeculateCellOperand enumerator(this, node->child1());
+        SpeculateStrictInt32Operand index(this, node->child2());
+        GPRTemporary scratch1(this);
+        GPRTemporary result(this);
+
+        GPRReg enumeratorGPR = enumerator.gpr();
+        GPRReg indexGPR = index.gpr();
+        GPRReg scratch1GPR = scratch1.gpr();
+        GPRReg resultGPR = result.gpr();
+
+        MacroAssembler::Jump inBounds = m_jit.branch32(MacroAssembler::Below, indexGPR,
+            MacroAssembler::Address(enumeratorGPR, (op == GetEnumeratorStructurePname)
+                ? JSPropertyNameEnumerator::endStructurePropertyIndexOffset()
+                : JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
+
+        m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsNull())), resultGPR);
+
+        MacroAssembler::Jump done = m_jit.jump();
+        inBounds.link(&m_jit);
+
+        m_jit.loadPtr(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), scratch1GPR);
+        m_jit.load64(MacroAssembler::BaseIndex(scratch1GPR, indexGPR, MacroAssembler::TimesEight), resultGPR);
+
+        done.link(&m_jit);
+        jsValueResult(resultGPR, node);
+        break;
+    }
+    case ToIndexString: {
+        SpeculateInt32Operand index(this, node->child1());
+        GPRFlushedCallResult result(this);
+        GPRReg resultGPR = result.gpr();
+
+        flushRegisters();
+        callOperation(operationToIndexString, resultGPR, index.gpr());
+        m_jit.exceptionCheck();
+        cellResult(resultGPR, node);
+        break;
+    }
+    case ProfileType: {
+        JSValueOperand value(this, node->child1());
+        GPRTemporary scratch1(this);
+        GPRTemporary scratch2(this);
+        GPRTemporary scratch3(this);
+
+        GPRReg scratch1GPR = scratch1.gpr();
+        GPRReg scratch2GPR = scratch2.gpr();
+        GPRReg scratch3GPR = scratch3.gpr();
+        GPRReg valueGPR = value.gpr();
+
+        MacroAssembler::JumpList jumpToEnd;
+
+        jumpToEnd.append(m_jit.branchTest64(JITCompiler::Zero, valueGPR));
+
+        TypeLocation* cachedTypeLocation = node->typeLocation();
+        // Compile in a predictive type check, if possible, to see if we can skip writing to the log.
+        // These typechecks are inlined to match those of the 64-bit JSValue type checks.
+        if (cachedTypeLocation->m_lastSeenType == TypeUndefined)
+            jumpToEnd.append(m_jit.branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined()))));
+        else if (cachedTypeLocation->m_lastSeenType == TypeNull)
+            jumpToEnd.append(m_jit.branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsNull()))));
+        else if (cachedTypeLocation->m_lastSeenType == TypeBoolean) {
+            m_jit.move(valueGPR, scratch2GPR);
+            m_jit.and64(TrustedImm32(~1), scratch2GPR);
+            jumpToEnd.append(m_jit.branch64(MacroAssembler::Equal, scratch2GPR, MacroAssembler::TrustedImm64(ValueFalse)));
+        } else if (cachedTypeLocation->m_lastSeenType == TypeAnyInt)
+            jumpToEnd.append(m_jit.branch64(MacroAssembler::AboveOrEqual, valueGPR, GPRInfo::tagTypeNumberRegister));
+        else if (cachedTypeLocation->m_lastSeenType == TypeNumber)
+            jumpToEnd.append(m_jit.branchTest64(MacroAssembler::NonZero, valueGPR, GPRInfo::tagTypeNumberRegister));
+        else if (cachedTypeLocation->m_lastSeenType == TypeString) {
+            MacroAssembler::Jump isNotCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
+            jumpToEnd.append(m_jit.branchIfString(valueGPR));
+            isNotCell.link(&m_jit);
+        }
+
+        // Load the TypeProfilerLog into Scratch2.
+        TypeProfilerLog* cachedTypeProfilerLog = m_jit.vm()->typeProfilerLog();
+        m_jit.move(TrustedImmPtr(cachedTypeProfilerLog), scratch2GPR);
+
+        // Load the next LogEntry into Scratch1.
+        m_jit.loadPtr(MacroAssembler::Address(scratch2GPR, TypeProfilerLog::currentLogEntryOffset()), scratch1GPR);
+
+        // Store the JSValue onto the log entry.
+        m_jit.store64(valueGPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::valueOffset()));
+
+        // Store the structureID of the cell if valueGPR is a cell, otherwise, store 0 on the log entry.
+        MacroAssembler::Jump isNotCell = m_jit.branchIfNotCell(JSValueRegs(valueGPR));
+        m_jit.load32(MacroAssembler::Address(valueGPR, JSCell::structureIDOffset()), scratch3GPR);
+        m_jit.store32(scratch3GPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::structureIDOffset()));
+        MacroAssembler::Jump skipIsCell = m_jit.jump();
+        isNotCell.link(&m_jit);
+        m_jit.store32(TrustedImm32(0), MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::structureIDOffset()));
+        skipIsCell.link(&m_jit);
+
+        // Store the typeLocation on the log entry.
+        m_jit.move(TrustedImmPtr(cachedTypeLocation), scratch3GPR);
+        m_jit.storePtr(scratch3GPR, MacroAssembler::Address(scratch1GPR, TypeProfilerLog::LogEntry::locationOffset()));
+
+        // Increment the current log entry.
+        m_jit.addPtr(TrustedImm32(sizeof(TypeProfilerLog::LogEntry)), scratch1GPR);
+        m_jit.storePtr(scratch1GPR, MacroAssembler::Address(scratch2GPR, TypeProfilerLog::currentLogEntryOffset()));
+        MacroAssembler::Jump clearLog = m_jit.branchPtr(MacroAssembler::Equal, scratch1GPR, TrustedImmPtr(cachedTypeProfilerLog->logEndPtr()));
+        addSlowPathGenerator(
+            slowPathCall(clearLog, this, operationProcessTypeProfilerLogDFG, NoResult));
+
+        jumpToEnd.link(&m_jit);
+
+        noResult(node);
+        break;
+    }
+    case ProfileControlFlow: {
+        BasicBlockLocation* basicBlockLocation = node->basicBlockLocation();
+        basicBlockLocation->emitExecuteCode(m_jit);
+        noResult(node);
+        break;
+    }
+        
+    case LogShadowChickenPrologue: {
+        flushRegisters();
+        prepareForExternalCall();
+        m_jit.emitStoreCodeOrigin(node->origin.semantic);
+
+        GPRTemporary scratch1(this, GPRInfo::nonArgGPR0); // This must be a non-argument GPR.
+        GPRReg scratch1Reg = scratch1.gpr();
+        GPRTemporary scratch2(this);
+        GPRReg scratch2Reg = scratch2.gpr();
+        GPRTemporary shadowPacket(this);
+        GPRReg shadowPacketReg = shadowPacket.gpr();
+
+        m_jit.ensureShadowChickenPacket(shadowPacketReg, scratch1Reg, scratch2Reg);
+
+        SpeculateCellOperand scope(this, node->child1());
+        GPRReg scopeReg = scope.gpr();
+
+        m_jit.logShadowChickenProloguePacket(shadowPacketReg, scratch1Reg, scopeReg);
+        noResult(node);
+        break;
+    }
+
+    case LogShadowChickenTail: {
+        flushRegisters();
+        prepareForExternalCall();
+        CallSiteIndex callSiteIndex = m_jit.emitStoreCodeOrigin(node->origin.semantic);
+
+        GPRTemporary scratch1(this, GPRInfo::nonArgGPR0); // This must be a non-argument GPR.
+        GPRReg scratch1Reg = scratch1.gpr();
+        GPRTemporary scratch2(this);
+        GPRReg scratch2Reg = scratch2.gpr();
+        GPRTemporary shadowPacket(this);
+        GPRReg shadowPacketReg = shadowPacket.gpr();
+
+        m_jit.ensureShadowChickenPacket(shadowPacketReg, scratch1Reg, scratch2Reg);
+
+        JSValueOperand thisValue(this, node->child1());
+        JSValueRegs thisRegs = JSValueRegs(thisValue.gpr());
+        SpeculateCellOperand scope(this, node->child2());
+        GPRReg scopeReg = scope.gpr();
+
+        m_jit.logShadowChickenTailPacket(shadowPacketReg, thisRegs, scopeReg, m_jit.codeBlock(), callSiteIndex);
+        noResult(node);
+        break;
+    }
+
+    case MaterializeNewObject:
+        compileMaterializeNewObject(node);
+        break;
+
+    case CallDOM:
+        compileCallDOM(node);
+        break;
+
+    case CallDOMGetter:
+        compileCallDOMGetter(node);
+        break;
+
+    case CheckDOM:
+        compileCheckDOM(node);
+        break;
+
+#if ENABLE(FTL_JIT)        
+    case CheckTierUpInLoop: {
+        MacroAssembler::Jump callTierUp = m_jit.branchAdd32(
+            MacroAssembler::PositiveOrZero,
+            TrustedImm32(Options::ftlTierUpCounterIncrementForLoop()),
+            MacroAssembler::AbsoluteAddress(&m_jit.jitCode()->tierUpCounter.m_counter));
+
+        MacroAssembler::Label toNextOperation = m_jit.label();
+
+        Vector<SilentRegisterSavePlan> savePlans;
+        silentSpillAllRegistersImpl(false, savePlans, InvalidGPRReg);
+        unsigned bytecodeIndex = node->origin.semantic.bytecodeIndex;
+
+        addSlowPathGenerator([=]() {
+            callTierUp.link(&m_jit);
+
+            silentSpill(savePlans);
+            m_jit.setupArgumentsWithExecState(TrustedImm32(bytecodeIndex));
+            appendCall(triggerTierUpNowInLoop);
+            silentFill(savePlans);
+
+            m_jit.jump().linkTo(toNextOperation, &m_jit);
+        });
+        break;
+    }
+        
+    case CheckTierUpAtReturn: {
+        MacroAssembler::Jump done = m_jit.branchAdd32(
+            MacroAssembler::Signed,
+            TrustedImm32(Options::ftlTierUpCounterIncrementForReturn()),
+            MacroAssembler::AbsoluteAddress(&m_jit.jitCode()->tierUpCounter.m_counter));
+        
+        silentSpillAllRegisters(InvalidGPRReg);
+        m_jit.setupArgumentsExecState();
+        appendCall(triggerTierUpNow);
+        silentFillAllRegisters(InvalidGPRReg);
+        
+        done.link(&m_jit);
+        break;
+    }
+        
+    case CheckTierUpAndOSREnter: {
+        ASSERT(!node->origin.semantic.inlineCallFrame);
+
+        GPRTemporary temp(this);
+        GPRReg tempGPR = temp.gpr();
+
+        unsigned bytecodeIndex = node->origin.semantic.bytecodeIndex;
+        auto triggerIterator = m_jit.jitCode()->tierUpEntryTriggers.find(bytecodeIndex);
+        DFG_ASSERT(m_jit.graph(), node, triggerIterator != m_jit.jitCode()->tierUpEntryTriggers.end());
+        JITCode::TriggerReason* forceEntryTrigger = &(m_jit.jitCode()->tierUpEntryTriggers.find(bytecodeIndex)->value);
+        static_assert(!static_cast<uint8_t>(JITCode::TriggerReason::DontTrigger), "the JIT code assumes non-zero means 'enter'");
+        static_assert(sizeof(JITCode::TriggerReason) == 1, "branchTest8 assumes this size");
+
+        MacroAssembler::Jump forceOSREntry = m_jit.branchTest8(MacroAssembler::NonZero, MacroAssembler::AbsoluteAddress(forceEntryTrigger));
+        MacroAssembler::Jump overflowedCounter = m_jit.branchAdd32(
+            MacroAssembler::PositiveOrZero,
+            TrustedImm32(Options::ftlTierUpCounterIncrementForLoop()),
+            MacroAssembler::AbsoluteAddress(&m_jit.jitCode()->tierUpCounter.m_counter));
+        MacroAssembler::Label toNextOperation = m_jit.label();
+
+        Vector<SilentRegisterSavePlan> savePlans;
+        silentSpillAllRegistersImpl(false, savePlans, tempGPR);
+
+        unsigned streamIndex = m_stream->size();
+        m_jit.jitCode()->bytecodeIndexToStreamIndex.add(bytecodeIndex, streamIndex);
+
+        addSlowPathGenerator([=]() {
+            forceOSREntry.link(&m_jit);
+            overflowedCounter.link(&m_jit);
+
+            silentSpill(savePlans);
+            m_jit.setupArgumentsWithExecState(TrustedImm32(bytecodeIndex));
+            appendCallSetResult(triggerOSREntryNow, tempGPR);
+
+            if (savePlans.isEmpty())
+                m_jit.branchTestPtr(MacroAssembler::Zero, tempGPR).linkTo(toNextOperation, &m_jit);
+            else {
+                MacroAssembler::Jump osrEnter = m_jit.branchTestPtr(MacroAssembler::NonZero, tempGPR);
+                silentFill(savePlans);
+                m_jit.jump().linkTo(toNextOperation, &m_jit);
+                osrEnter.link(&m_jit);
+            }
+            m_jit.emitRestoreCalleeSaves();
+            m_jit.jump(tempGPR);
+        });
+        break;
+    }
+#else // ENABLE(FTL_JIT)
+    case CheckTierUpInLoop:
+    case CheckTierUpAtReturn:
+    case CheckTierUpAndOSREnter:
+        DFG_CRASH(m_jit.graph(), node, "Unexpected tier-up node");
+        break;
+#endif // ENABLE(FTL_JIT)
+
+    case LastNodeType:
+    case Phi:
+    case Upsilon:
+    case ExtractOSREntryLocal:
+    case CheckInBounds:
+    case ArithIMul:
+    case MultiGetByOffset:
+    case MultiPutByOffset:
+    case FiatInt52:
+    case CheckBadCell:
+    case BottomValue:
+    case PhantomNewObject:
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomCreateActivation:
+    case GetMyArgumentByVal:
+    case GetMyArgumentByValOutOfBounds:
+    case PutHint:
+    case CheckStructureImmediate:
+    case MaterializeCreateActivation:
+    case PutStack:
+    case KillStack:
+    case GetStack:
+    case PhantomCreateRest:
+    case PhantomSpread:
+    case PhantomNewArrayWithSpread:
+        DFG_CRASH(m_jit.graph(), node, "Unexpected node");
+        break;
+    }
+
+    if (!m_compileOkay)
+        return;
+    
+    if (node->hasResult() && node->mustGenerate())
+        use(node);
+}
+
+void SpeculativeJIT::moveTrueTo(GPRReg gpr)
+{
+    m_jit.move(TrustedImm32(ValueTrue), gpr);
+}
+
+void SpeculativeJIT::moveFalseTo(GPRReg gpr)
+{
+    m_jit.move(TrustedImm32(ValueFalse), gpr);
+}
+
+void SpeculativeJIT::blessBoolean(GPRReg gpr)
+{
+    m_jit.or32(TrustedImm32(ValueFalse), gpr);
+}
+
+void SpeculativeJIT::convertAnyInt(Edge valueEdge, GPRReg resultGPR)
+{
+    JSValueOperand value(this, valueEdge, ManualOperandSpeculation);
+    GPRReg valueGPR = value.gpr();
+    
+    JITCompiler::Jump notInt32 =
+        m_jit.branch64(JITCompiler::Below, valueGPR, GPRInfo::tagTypeNumberRegister);
+    
+    m_jit.signExtend32ToPtr(valueGPR, resultGPR);
+    JITCompiler::Jump done = m_jit.jump();
+    
+    notInt32.link(&m_jit);
+    silentSpillAllRegisters(resultGPR);
+    callOperation(operationConvertBoxedDoubleToInt52, resultGPR, valueGPR);
+    silentFillAllRegisters(resultGPR);
+
+    DFG_TYPE_CHECK(
+        JSValueRegs(valueGPR), valueEdge, SpecInt32Only | SpecAnyIntAsDouble,
+        m_jit.branch64(
+            JITCompiler::Equal, resultGPR,
+            JITCompiler::TrustedImm64(JSValue::notInt52)));
+    done.link(&m_jit);
+}
+
+void SpeculativeJIT::speculateAnyInt(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecInt32Only | SpecAnyIntAsDouble))
+        return;
+    
+    GPRTemporary temp(this);
+    convertAnyInt(edge, temp.gpr());
+}
+
+void SpeculativeJIT::speculateDoubleRepAnyInt(Edge edge)
+{
+    if (!needsTypeCheck(edge, SpecAnyIntAsDouble))
+        return;
+    
+    SpeculateDoubleOperand value(this, edge);
+    FPRReg valueFPR = value.fpr();
+    
+    GPRFlushedCallResult result(this);
+    GPRReg resultGPR = result.gpr();
+    
+    flushRegisters();
+    
+    callOperation(operationConvertDoubleToInt52, resultGPR, valueFPR);
+    
+    DFG_TYPE_CHECK(
+        JSValueRegs(), edge, SpecAnyIntAsDouble,
+        m_jit.branch64(
+            JITCompiler::Equal, resultGPR,
+            JITCompiler::TrustedImm64(JSValue::notInt52)));
+}
+
+void SpeculativeJIT::compileArithRandom(Node* node)
+{
+    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    GPRTemporary temp1(this);
+    GPRTemporary temp2(this);
+    GPRTemporary temp3(this);
+    FPRTemporary result(this);
+    m_jit.emitRandomThunk(globalObject, temp1.gpr(), temp2.gpr(), temp3.gpr(), result.fpr());
+    doubleResult(result.fpr(), node);
+}
+
+void SpeculativeJIT::emitInitializeButterfly(GPRReg storageGPR, GPRReg sizeGPR, JSValueRegs emptyValueRegs, GPRReg scratchGPR)
+{
+    m_jit.zeroExtend32ToPtr(sizeGPR, scratchGPR);
+    MacroAssembler::Jump done = m_jit.branchTest32(MacroAssembler::Zero, scratchGPR);
+    MacroAssembler::Label loop = m_jit.label();
+    m_jit.sub32(TrustedImm32(1), scratchGPR);
+    m_jit.store64(emptyValueRegs.gpr(), MacroAssembler::BaseIndex(storageGPR, scratchGPR, MacroAssembler::TimesEight));
+    m_jit.branchTest32(MacroAssembler::NonZero, scratchGPR).linkTo(loop, &m_jit);
+    done.link(&m_jit);
+}
+
+void SpeculativeJIT::compileAllocateNewArrayWithSize(JSGlobalObject* globalObject, GPRReg resultGPR, GPRReg sizeGPR, IndexingType indexingType, bool shouldConvertLargeSizeToArrayStorage)
+{
+    GPRTemporary storage(this);
+    GPRTemporary scratch(this);
+    GPRTemporary scratch2(this);
+    
+    GPRReg storageGPR = storage.gpr();
+    GPRReg scratchGPR = scratch.gpr();
+    GPRReg scratch2GPR = scratch2.gpr();
+    
+    m_jit.move(TrustedImmPtr(0), storageGPR);
+    
+    MacroAssembler::JumpList slowCases;
+    if (shouldConvertLargeSizeToArrayStorage)
+        slowCases.append(m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)));
+            
+    // We can use resultGPR as a scratch right now.
+    emitAllocateButterfly(storageGPR, sizeGPR, resultGPR, scratchGPR, scratch2GPR, slowCases);
+
+    if (hasDouble(indexingType))
+        m_jit.move(TrustedImm64(bitwise_cast<int64_t>(PNaN)), scratchGPR);
+    else
+        m_jit.move(TrustedImm64(JSValue::encode(JSValue())), scratchGPR);
+    emitInitializeButterfly(storageGPR, sizeGPR, JSValueRegs(scratchGPR), scratch2GPR);
+
+    RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType));
+    
+    emitAllocateJSObject<JSArray>(resultGPR, TrustedImmPtr(structure), storageGPR, scratchGPR, scratch2GPR, slowCases);
+    
+    m_jit.mutatorFence();
+    
+    addSlowPathGenerator(std::make_unique<CallArrayAllocatorWithVariableSizeSlowPathGenerator>(
+        slowCases, this, operationNewArrayWithSize, resultGPR,
+        structure,
+        shouldConvertLargeSizeToArrayStorage ? m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage)) : structure,
+        sizeGPR, storageGPR));
+}
+
+#endif
+
+} } // namespace JSC::DFG
+
+#endif
diff --git a/dfg/DFGStackLayoutPhase.cpp b/dfg/DFGStackLayoutPhase.cpp
new file mode 100644
index 0000000..03c502f
--- /dev/null
+++ b/dfg/DFGStackLayoutPhase.cpp
@@ -0,0 +1,270 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGStackLayoutPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "DFGValueSource.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class StackLayoutPhase : public Phase {
+    static const bool verbose = false;
+    
+public:
+    StackLayoutPhase(Graph& graph)
+        : Phase(graph, "stack layout")
+    {
+    }
+    
+    bool run()
+    {
+        // This enumerates the locals that we actually care about and packs them. So for example
+        // if we use local 1, 3, 4, 5, 7, then we remap them: 1->0, 3->1, 4->2, 5->3, 7->4. We
+        // treat a variable as being "used" if there exists an access to it (SetLocal, GetLocal,
+        // Flush, PhantomLocal).
+        
+        BitVector usedLocals;
+        
+        // Collect those variables that are used from IR.
+        bool hasNodesThatNeedFixup = false;
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+                Node* node = block->at(nodeIndex);
+                switch (node->op()) {
+                case GetLocal:
+                case SetLocal:
+                case Flush:
+                case PhantomLocal: {
+                    VariableAccessData* variable = node->variableAccessData();
+                    if (variable->local().isArgument())
+                        break;
+                    usedLocals.set(variable->local().toLocal());
+                    break;
+                }
+                    
+                case GetLocalUnlinked: {
+                    VirtualRegister operand = node->unlinkedLocal();
+                    if (operand.isArgument())
+                        break;
+                    usedLocals.set(operand.toLocal());
+                    hasNodesThatNeedFixup = true;
+                    break;
+                }
+                    
+                case LoadVarargs:
+                case ForwardVarargs: {
+                    LoadVarargsData* data = node->loadVarargsData();
+                    if (data->count.isLocal())
+                        usedLocals.set(data->count.toLocal());
+                    if (data->start.isLocal()) {
+                        // This part really relies on the contiguity of stack layout
+                        // assignments.
+                        ASSERT(VirtualRegister(data->start.offset() + data->limit - 1).isLocal());
+                        for (unsigned i = data->limit; i--;) 
+                            usedLocals.set(VirtualRegister(data->start.offset() + i).toLocal());
+                    } // the else case shouldn't happen.
+                    hasNodesThatNeedFixup = true;
+                    break;
+                }
+                    
+                case PutStack:
+                case GetStack: {
+                    StackAccessData* stack = node->stackAccessData();
+                    if (stack->local.isArgument())
+                        break;
+                    usedLocals.set(stack->local.toLocal());
+                    break;
+                }
+                    
+                default:
+                    break;
+                }
+            }
+        }
+        
+        for (InlineCallFrameSet::iterator iter = m_graph.m_plan.inlineCallFrames->begin(); !!iter; ++iter) {
+            InlineCallFrame* inlineCallFrame = *iter;
+            
+            if (inlineCallFrame->isVarargs()) {
+                usedLocals.set(VirtualRegister(
+                    CallFrameSlot::argumentCount + inlineCallFrame->stackOffset).toLocal());
+            }
+            
+            for (unsigned argument = inlineCallFrame->arguments.size(); argument-- > 1;) {
+                usedLocals.set(VirtualRegister(
+                    virtualRegisterForArgument(argument).offset() +
+                    inlineCallFrame->stackOffset).toLocal());
+            }
+        }
+        
+        Vector<unsigned> allocation(usedLocals.size());
+        m_graph.m_nextMachineLocal = codeBlock()->calleeSaveSpaceAsVirtualRegisters();
+        for (unsigned i = 0; i < usedLocals.size(); ++i) {
+            if (!usedLocals.get(i)) {
+                allocation[i] = UINT_MAX;
+                continue;
+            }
+            
+            allocation[i] = m_graph.m_nextMachineLocal++;
+        }
+        
+        for (unsigned i = m_graph.m_variableAccessData.size(); i--;) {
+            VariableAccessData* variable = &m_graph.m_variableAccessData[i];
+            if (!variable->isRoot())
+                continue;
+            
+            if (variable->local().isArgument()) {
+                variable->machineLocal() = variable->local();
+                continue;
+            }
+            
+            size_t local = variable->local().toLocal();
+            if (local >= allocation.size())
+                continue;
+            
+            if (allocation[local] == UINT_MAX)
+                continue;
+            
+            variable->machineLocal() = assign(allocation, variable->local());
+        }
+        
+        for (StackAccessData* data : m_graph.m_stackAccessData) {
+            if (!data->local.isLocal()) {
+                data->machineLocal = data->local;
+                continue;
+            }
+            
+            if (static_cast<size_t>(data->local.toLocal()) >= allocation.size())
+                continue;
+            if (allocation[data->local.toLocal()] == UINT_MAX)
+                continue;
+            
+            data->machineLocal = assign(allocation, data->local);
+        }
+        
+        if (!m_graph.needsScopeRegister())
+            codeBlock()->setScopeRegister(VirtualRegister());
+        else
+            codeBlock()->setScopeRegister(assign(allocation, codeBlock()->scopeRegister()));
+
+        for (unsigned i = m_graph.m_inlineVariableData.size(); i--;) {
+            InlineVariableData data = m_graph.m_inlineVariableData[i];
+            InlineCallFrame* inlineCallFrame = data.inlineCallFrame;
+            
+            if (inlineCallFrame->isVarargs()) {
+                inlineCallFrame->argumentCountRegister = assign(
+                    allocation, VirtualRegister(inlineCallFrame->stackOffset + CallFrameSlot::argumentCount));
+            }
+            
+            for (unsigned argument = inlineCallFrame->arguments.size(); argument-- > 1;) {
+                ArgumentPosition& position = m_graph.m_argumentPositions[
+                    data.argumentPositionStart + argument];
+                VariableAccessData* variable = position.someVariable();
+                ValueSource source;
+                if (!variable)
+                    source = ValueSource(SourceIsDead);
+                else {
+                    source = ValueSource::forFlushFormat(
+                        variable->machineLocal(), variable->flushFormat());
+                }
+                inlineCallFrame->arguments[argument] = source.valueRecovery();
+            }
+            
+            RELEASE_ASSERT(inlineCallFrame->isClosureCall == !!data.calleeVariable);
+            if (inlineCallFrame->isClosureCall) {
+                VariableAccessData* variable = data.calleeVariable->find();
+                ValueSource source = ValueSource::forFlushFormat(
+                    variable->machineLocal(),
+                    variable->flushFormat());
+                inlineCallFrame->calleeRecovery = source.valueRecovery();
+            } else
+                RELEASE_ASSERT(inlineCallFrame->calleeRecovery.isConstant());
+        }
+        
+        // Fix GetLocalUnlinked's variable references.
+        if (hasNodesThatNeedFixup) {
+            for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+                BasicBlock* block = m_graph.block(blockIndex);
+                if (!block)
+                    continue;
+                for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+                    Node* node = block->at(nodeIndex);
+                    switch (node->op()) {
+                    case GetLocalUnlinked: {
+                        node->setUnlinkedMachineLocal(assign(allocation, node->unlinkedLocal()));
+                        break;
+                    }
+                        
+                    case LoadVarargs:
+                    case ForwardVarargs: {
+                        LoadVarargsData* data = node->loadVarargsData();
+                        data->machineCount = assign(allocation, data->count);
+                        data->machineStart = assign(allocation, data->start);
+                        break;
+                    }
+                        
+                    default:
+                        break;
+                    }
+                }
+            }
+        }
+        
+        return true;
+    }
+
+private:
+    VirtualRegister assign(const Vector<unsigned>& allocation, VirtualRegister src)
+    {
+        VirtualRegister result = src;
+        if (result.isLocal()) {
+            unsigned myAllocation = allocation[result.toLocal()];
+            if (myAllocation == UINT_MAX)
+                result = VirtualRegister();
+            else
+                result = virtualRegisterForLocal(myAllocation);
+        }
+        return result;
+    }
+};
+
+bool performStackLayout(Graph& graph)
+{
+    return runPhase<StackLayoutPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGStackLayoutPhase.h b/dfg/DFGStackLayoutPhase.h
new file mode 100644
index 0000000..5935f99
--- /dev/null
+++ b/dfg/DFGStackLayoutPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Figures out the stack layout of VariableAccessData's. Aims to ensure that there aren't any
+// holes in the stack.
+
+bool performStackLayout(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGStaticExecutionCountEstimationPhase.cpp b/dfg/DFGStaticExecutionCountEstimationPhase.cpp
new file mode 100644
index 0000000..b6e35cf
--- /dev/null
+++ b/dfg/DFGStaticExecutionCountEstimationPhase.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGStaticExecutionCountEstimationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGNaturalLoops.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class StaticExecutionCountEstimationPhase : public Phase {
+public:
+    StaticExecutionCountEstimationPhase(Graph& graph)
+        : Phase(graph, "static execution count estimation")
+    {
+    }
+    
+    bool run()
+    {
+        m_graph.ensureNaturalLoops();
+        
+        // Estimate basic block execution counts based on loop depth.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+
+            block->executionCount = pow(10, m_graph.m_naturalLoops->loopDepth(block));
+        }
+        
+        // Estimate branch weights based on execution counts. This isn't quite correct. It'll
+        // assume that each block's conditional successor only has that block as its
+        // predecessor.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            Node* terminal = block->terminal();
+            switch (terminal->op()) {
+            case Branch: {
+                BranchData* data = terminal->branchData();
+                applyCounts(data->taken);
+                applyCounts(data->notTaken);
+                break;
+            }
+                
+            case Switch: {
+                SwitchData* data = terminal->switchData();
+                for (unsigned i = data->cases.size(); i--;)
+                    applyCounts(data->cases[i].target);
+                applyCounts(data->fallThrough);
+                break;
+            }
+                
+            default:
+                break;
+            }
+        }
+        
+        return true;
+    }
+
+private:
+    void applyCounts(BranchTarget& target)
+    {
+        target.count = target.block->executionCount;
+    }
+};
+
+bool performStaticExecutionCountEstimation(Graph& graph)
+{
+    return runPhase<StaticExecutionCountEstimationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGStaticExecutionCountEstimationPhase.h b/dfg/DFGStaticExecutionCountEstimationPhase.h
new file mode 100644
index 0000000..df0c36e
--- /dev/null
+++ b/dfg/DFGStaticExecutionCountEstimationPhase.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Estimate execution counts (branch execution counts, in particular) based on
+// presently available static information. This phase is important because
+// subsequent CFG transformations, such as OSR entrypoint creation, perturb our
+// ability to do accurate static estimations. Hence we lock in the estimates early.
+// Ideally, we would have dynamic information, but we don't right now, so this is as
+// good as it gets.
+
+bool performStaticExecutionCountEstimation(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGStoreBarrierClusteringPhase.cpp b/dfg/DFGStoreBarrierClusteringPhase.cpp
new file mode 100644
index 0000000..101c6b0
--- /dev/null
+++ b/dfg/DFGStoreBarrierClusteringPhase.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGStoreBarrierClusteringPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGDoesGC.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGMayExit.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include <wtf/FastBitVector.h>
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+class StoreBarrierClusteringPhase : public Phase {
+public:
+    StoreBarrierClusteringPhase(Graph& graph)
+        : Phase(graph, "store barrier fencing")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        size_t maxSize = 0;
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder())
+            maxSize = std::max(maxSize, block->size());
+        m_barrierPoints.resize(maxSize);
+        
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            size_t blockSize = block->size();
+            doBlock(block);
+            m_barrierPoints.clearRange(0, blockSize);
+        }
+        
+        return true;
+    }
+
+private:
+    // This summarizes everything we need to remember about a barrier.
+    struct ChildAndOrigin {
+        ChildAndOrigin() { }
+        
+        ChildAndOrigin(Node* child, CodeOrigin semanticOrigin)
+            : child(child)
+            , semanticOrigin(semanticOrigin)
+        {
+        }
+        
+        Node* child { nullptr };
+        CodeOrigin semanticOrigin;
+    };
+    
+    void doBlock(BasicBlock* block)
+    {
+        ASSERT(m_barrierPoints.isEmpty());
+        
+        // First identify the places where we would want to place all of the barriers based on a
+        // backwards analysis. We use the futureGC flag to tell us if we had seen a GC. Since this
+        // is a backwards analysis, when we get to a node, futureGC tells us if a GC will happen
+        // in the future after that node.
+        bool futureGC = true;
+        for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+            Node* node = block->at(nodeIndex);
+            
+            // This is a backwards analysis, so exits require conservatism. If we exit, then there
+            // probably will be a GC in the future! If we needed to then we could lift that
+            // requirement by either (1) having a StoreBarrierHint that tells OSR exit to barrier that
+            // value or (2) automatically barriering any DFG-live Node on OSR exit. Either way, it
+            // would be weird because it would create a new root for OSR availability analysis. I
+            // don't have evidence that it would be worth it.
+            if (doesGC(m_graph, node) || mayExit(m_graph, node) != DoesNotExit) {
+                futureGC = true;
+                continue;
+            }
+            
+            if (node->isStoreBarrier() && futureGC) {
+                m_barrierPoints[nodeIndex] = true;
+                futureGC = false;
+            }
+        }
+        
+        // Now we run forward and collect the barriers. When we hit a barrier point, insert all of
+        // them with a fence.
+        for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            if (!node->isStoreBarrier())
+                continue;
+            
+            DFG_ASSERT(m_graph, node, !node->origin.wasHoisted);
+            DFG_ASSERT(m_graph, node, node->child1().useKind() == KnownCellUse);
+            
+            NodeOrigin origin = node->origin;
+            m_neededBarriers.append(ChildAndOrigin(node->child1().node(), origin.semantic));
+            node->remove();
+            
+            if (!m_barrierPoints[nodeIndex])
+                continue;
+            
+            std::sort(
+                m_neededBarriers.begin(), m_neededBarriers.end(),
+                [&] (const ChildAndOrigin& a, const ChildAndOrigin& b) -> bool {
+                    return a.child < b.child;
+                });
+            auto end = std::unique(
+                m_neededBarriers.begin(), m_neededBarriers.end(),
+                [&] (const ChildAndOrigin& a, const ChildAndOrigin& b) -> bool{
+                    return a.child == b.child;
+                });
+            for (auto iter = m_neededBarriers.begin(); iter != end; ++iter) {
+                Node* child = iter->child;
+                CodeOrigin semanticOrigin = iter->semanticOrigin;
+                
+                NodeType type;
+                if (Options::useConcurrentBarriers() && iter == m_neededBarriers.begin())
+                    type = FencedStoreBarrier;
+                else
+                    type = StoreBarrier;
+                
+                m_insertionSet.insertNode(
+                    nodeIndex, SpecNone, type, origin.withSemantic(semanticOrigin),
+                    Edge(child, KnownCellUse));
+            }
+            m_neededBarriers.resize(0);
+        }
+        
+        m_insertionSet.execute(block);
+    }
+    
+    InsertionSet m_insertionSet;
+    FastBitVector m_barrierPoints;
+    Vector<ChildAndOrigin> m_neededBarriers;
+};
+
+} // anonymous namespace
+
+bool performStoreBarrierClustering(Graph& graph)
+{
+    return runPhase<StoreBarrierClusteringPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGStoreBarrierClusteringPhase.h b/dfg/DFGStoreBarrierClusteringPhase.h
new file mode 100644
index 0000000..c1111b1
--- /dev/null
+++ b/dfg/DFGStoreBarrierClusteringPhase.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Picks up groups of barriers that could be executed in any order with respect to each other and
+// places then at the earliest point in the program where the cluster would be correct. This phase
+// makes only the first of the cluster be a FencedStoreBarrier while the rest are normal
+// StoreBarriers. This phase also removes redundant barriers - for example, the cluster may end up
+// with two or more barriers on the same object, in which case it is totally safe for us to drop
+// one of them. The reason why this is sound hinges on the "earliest point where the cluster would
+// be correct" property. For example, take this input:
+//
+//     a: Call()
+//     b: PutByOffset(@o, @o, @x)
+//     c: FencedStoreBarrier(@o)
+//     d: PutByOffset(@o, @o, @y)
+//     e: FencedStoreBarrier(@o)
+//     f: PutByOffset(@p, @p, @z)
+//     g: FencedStoreBarrier(@p)
+//     h: GetByOffset(@q)
+//     i: Call()
+//
+// The cluster of barriers is @c, @e, and @g. All of the barriers are between two doesGC effects:
+// the calls at @a and @i. Because there are no doesGC effects between @a and @i and there is no
+// possible control flow entry into this sequence between @ and @i, we could could just execute all
+// of the barriers just before @i in any order. The earliest point where the cluster would be
+// correct is just after @f, since that's the last operation that needs a barrier. We use the
+// earliest to reduce register pressure. When the barriers are clustered just after @f, we get:
+//
+//     a: Call()
+//     b: PutByOffset(@o, @o, @x)
+//     d: PutByOffset(@o, @o, @y)
+//     f: PutByOffset(@p, @p, @z)
+//     c: FencedStoreBarrier(@o)
+//     e: FencedStoreBarrier(@o)
+//     g: FencedStoreBarrier(@p)
+//     h: GetByOffset(@q)
+//     i: Call()
+//
+// This phase does more. It takes advantage of the clustering to remove fences and remove redundant
+// barriers. So this phase will output this:
+//
+//     a: Call()
+//     b: PutByOffset(@o, @o, @x)
+//     d: PutByOffset(@o, @o, @y)
+//     f: PutByOffset(@p, @p, @z)
+//     c: FencedStoreBarrier(@o)
+//     g: StoreBarrier(@p)
+//     h: GetByOffset(@q)
+//     i: Call()
+//
+// This optimization improves both overall throughput and the throughput while the concurrent GC is
+// running. In the former, we are simplifying instruction selection for all but the first fence. In
+// the latter, we are reducing the cost of all but the first barrier. The first barrier will awlays
+// take slow path when there is concurrent GC activity, since the slow path contains the fence. But
+// all of the other barriers will only take slow path if they really need to remember the object.
+bool performStoreBarrierClustering(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGStoreBarrierInsertionPhase.cpp b/dfg/DFGStoreBarrierInsertionPhase.cpp
new file mode 100644
index 0000000..4fab6f5
--- /dev/null
+++ b/dfg/DFGStoreBarrierInsertionPhase.cpp
@@ -0,0 +1,512 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGStoreBarrierInsertionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractInterpreterInlines.h"
+#include "DFGBlockMapInlines.h"
+#include "DFGDoesGC.h"
+#include "DFGGraph.h"
+#include "DFGInPlaceAbstractState.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/HashSet.h>
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verbose = false;
+
+enum class PhaseMode {
+    // Does only a local analysis for store barrier insertion and assumes that pointers live
+    // from predecessor blocks may need barriers. Assumes CPS conventions. Does not use AI for
+    // eliminating store barriers, but does a best effort to eliminate barriers when you're
+    // storing a non-cell value by using Node::result() and by looking at constants. The local
+    // analysis is based on GC epochs, so it will eliminate a lot of locally redundant barriers.
+    Fast,
+        
+    // Does a global analysis for store barrier insertion. Reuses the GC-epoch-based analysis
+    // used by Fast, but adds a conservative merge rule for propagating information from one
+    // block to the next. This will ensure for example that if a value V coming from multiple
+    // predecessors in B didn't need any more barriers at the end of each predecessor (either
+    // because it was the last allocated object in that predecessor or because it just had a
+    // barrier executed), then until we hit another GC point in B, we won't need another barrier
+    // on V. Uses AI for eliminating barriers when we know that the value being stored is not a
+    // cell. Assumes SSA conventions.
+    Global
+};
+
+template<PhaseMode mode>
+class StoreBarrierInsertionPhase : public Phase {
+public:
+    StoreBarrierInsertionPhase(Graph& graph)
+        : Phase(graph, mode == PhaseMode::Fast ? "fast store barrier insertion" : "global store barrier insertion")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        if (verbose) {
+            dataLog("Starting store barrier insertion:\n");
+            m_graph.dump();
+        }
+        
+        switch (mode) {
+        case PhaseMode::Fast: {
+            DFG_ASSERT(m_graph, nullptr, m_graph.m_form != SSA);
+            
+            m_graph.clearEpochs();
+            for (BasicBlock* block : m_graph.blocksInNaturalOrder())
+                handleBlock(block);
+            return true;
+        }
+            
+        case PhaseMode::Global: {
+            DFG_ASSERT(m_graph, nullptr, m_graph.m_form == SSA);
+
+            m_state = std::make_unique<InPlaceAbstractState>(m_graph);
+            m_interpreter = std::make_unique<AbstractInterpreter<InPlaceAbstractState>>(m_graph, *m_state);
+            
+            m_isConverged = false;
+            
+            // First run the analysis. Inside basic blocks we use an epoch-based analysis that
+            // is very precise. At block boundaries, we just propagate which nodes may need a
+            // barrier. This gives us a very nice bottom->top fixpoint: we start out assuming
+            // that no node needs any barriers at block boundaries, and then we converge
+            // towards believing that all nodes need barriers. "Needing a barrier" is like
+            // saying that the node is in a past epoch. "Not needing a barrier" is like saying
+            // that the node is in the current epoch.
+            m_stateAtHead = std::make_unique<BlockMap<HashSet<Node*>>>(m_graph);
+            m_stateAtTail = std::make_unique<BlockMap<HashSet<Node*>>>(m_graph);
+            
+            BlockList postOrder = m_graph.blocksInPostOrder();
+            
+            bool changed = true;
+            while (changed) {
+                changed = false;
+                
+                // Intentional backwards loop because we are using RPO.
+                for (unsigned blockIndex = postOrder.size(); blockIndex--;) {
+                    BasicBlock* block = postOrder[blockIndex];
+                    
+                    if (!handleBlock(block)) {
+                        // If the block didn't finish, then it cannot affect the fixpoint.
+                        continue;
+                    }
+                    
+                    // Construct the state-at-tail based on the epochs of live nodes and the
+                    // current epoch. We grow state-at-tail monotonically to ensure convergence.
+                    bool thisBlockChanged = false;
+                    for (NodeFlowProjection node : block->ssa->liveAtTail) {
+                        if (node.kind() == NodeFlowProjection::Shadow)
+                            continue;
+                        if (node->epoch() != m_currentEpoch) {
+                            // If the node is older than the current epoch, then we may need to
+                            // run a barrier on it in the future. So, add it to the state.
+                            thisBlockChanged |= m_stateAtTail->at(block).add(node.node()).isNewEntry;
+                        }
+                    }
+                    
+                    if (!thisBlockChanged) {
+                        // This iteration didn't learn anything new about this block.
+                        continue;
+                    }
+                    
+                    // Changed things. Make sure that we loop one more time.
+                    changed = true;
+                    
+                    for (BasicBlock* successor : block->successors()) {
+                        for (Node* node : m_stateAtTail->at(block))
+                            m_stateAtHead->at(successor).add(node);
+                    }
+                }
+            }
+            
+            // Tell handleBlock() that it's time to actually insert barriers for real.
+            m_isConverged = true;
+            
+            for (BasicBlock* block : m_graph.blocksInNaturalOrder())
+                handleBlock(block);
+            
+            return true;
+        } }
+        
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+
+private:
+    bool handleBlock(BasicBlock* block)
+    {
+        if (verbose) {
+            dataLog("Dealing with block ", pointerDump(block), "\n");
+            if (reallyInsertBarriers())
+                dataLog("    Really inserting barriers.\n");
+        }
+        
+        m_currentEpoch = Epoch::first();
+        
+        if (mode == PhaseMode::Global) {
+            if (!block->cfaHasVisited)
+                return false;
+            m_state->beginBasicBlock(block);
+            
+            for (NodeFlowProjection node : block->ssa->liveAtHead) {
+                if (node.kind() == NodeFlowProjection::Shadow)
+                    continue;
+                if (m_stateAtHead->at(block).contains(node.node())) {
+                    // If previous blocks tell us that this node may need a barrier in the
+                    // future, then put it in the ancient primordial epoch. This forces us to
+                    // emit a barrier on any possibly-cell store, regardless of the epoch of the
+                    // stored value.
+                    node->setEpoch(Epoch());
+                } else {
+                    // If previous blocks aren't requiring us to run a barrier on this node,
+                    // then put it in the current epoch. This means that we will skip barriers
+                    // on this node so long as we don't allocate. It also means that we won't
+                    // run barriers on stores to on one such node into another such node. That's
+                    // fine, because nodes would be excluded from the state set if at the tails
+                    // of all predecessors they always had the current epoch.
+                    node->setEpoch(m_currentEpoch);
+                }
+            }
+        }
+
+        bool result = true;
+        
+        for (m_nodeIndex = 0; m_nodeIndex < block->size(); ++m_nodeIndex) {
+            m_node = block->at(m_nodeIndex);
+            
+            if (verbose) {
+                dataLog(
+                    "    ", m_currentEpoch, ": Looking at node ", m_node, " with children: ");
+                CommaPrinter comma;
+                m_graph.doToChildren(
+                    m_node,
+                    [&] (Edge edge) {
+                        dataLog(comma, edge, " (", edge->epoch(), ")");
+                    });
+                dataLog("\n");
+            }
+            
+            if (mode == PhaseMode::Global) {
+                // Execute edges separately because we don't want to insert barriers if the
+                // operation doing the store does a check that ensures that the child is not
+                // a cell.
+                m_interpreter->startExecuting();
+                m_interpreter->executeEdges(m_node);
+            }
+            
+            switch (m_node->op()) {
+            case PutByValDirect:
+            case PutByVal:
+            case PutByValAlias: {
+                switch (m_node->arrayMode().modeForPut().type()) {
+                case Array::Contiguous:
+                case Array::ArrayStorage:
+                case Array::SlowPutArrayStorage: {
+                    Edge child1 = m_graph.varArgChild(m_node, 0);
+                    Edge child3 = m_graph.varArgChild(m_node, 2);
+                    considerBarrier(child1, child3);
+                    break;
+                }
+                default:
+                    break;
+                }
+                break;
+            }
+                
+            case ArrayPush: {
+                switch (m_node->arrayMode().type()) {
+                case Array::Contiguous:
+                case Array::ArrayStorage:
+                    considerBarrier(m_node->child1(), m_node->child2());
+                    break;
+                default:
+                    break;
+                }
+                break;
+            }
+                
+            case PutById:
+            case PutByIdFlush:
+            case PutByIdDirect:
+            case PutStructure: {
+                considerBarrier(m_node->child1());
+                break;
+            }
+
+            case RecordRegExpCachedResult: {
+                considerBarrier(m_graph.varArgChild(m_node, 0));
+                break;
+            }
+
+            case PutClosureVar:
+            case PutToArguments:
+            case SetRegExpObjectLastIndex: {
+                considerBarrier(m_node->child1(), m_node->child2());
+                break;
+            }
+                
+            case MultiPutByOffset: {
+                considerBarrier(m_node->child1());
+                break;
+            }
+                
+            case PutByOffset: {
+                considerBarrier(m_node->child2(), m_node->child3());
+                break;
+            }
+                
+            case PutGlobalVariable: {
+                considerBarrier(m_node->child1(), m_node->child2());
+                break;
+            }
+                
+            case SetFunctionName: {
+                considerBarrier(m_node->child1(), m_node->child2());
+                break;
+            }
+                
+            case NukeStructureAndSetButterfly: {
+                considerBarrier(m_node->child1());
+                break;
+            }
+
+            default:
+                break;
+            }
+            
+            if (doesGC(m_graph, m_node))
+                m_currentEpoch.bump();
+            
+            switch (m_node->op()) {
+            case NewObject:
+            case NewArray:
+            case NewArrayWithSize:
+            case NewArrayBuffer:
+            case NewTypedArray:
+            case NewRegexp:
+            case MaterializeNewObject:
+            case MaterializeCreateActivation:
+            case NewStringObject:
+            case MakeRope:
+            case CreateActivation:
+            case CreateDirectArguments:
+            case CreateScopedArguments:
+            case CreateClonedArguments:
+            case NewFunction:
+            case NewGeneratorFunction:
+            case NewAsyncFunction:
+            case AllocatePropertyStorage:
+            case ReallocatePropertyStorage:
+                // Nodes that allocate get to set their epoch because for those nodes we know
+                // that they will be the newest object in the heap.
+                m_node->setEpoch(m_currentEpoch);
+                break;
+                
+            case Upsilon:
+                // Assume the worst for Phis so that we don't have to worry about Phi shadows.
+                m_node->phi()->setEpoch(Epoch());
+                m_node->setEpoch(Epoch());
+                break;
+                
+            default:
+                // For nodes that aren't guaranteed to allocate, we say that their return value
+                // (if there is one) could be arbitrarily old.
+                m_node->setEpoch(Epoch());
+                break;
+            }
+            
+            if (verbose) {
+                dataLog(
+                    "    ", m_currentEpoch, ": Done with node ", m_node, " (", m_node->epoch(),
+                    ") with children: ");
+                CommaPrinter comma;
+                m_graph.doToChildren(
+                    m_node,
+                    [&] (Edge edge) {
+                        dataLog(comma, edge, " (", edge->epoch(), ")");
+                    });
+                dataLog("\n");
+            }
+            
+            if (mode == PhaseMode::Global) {
+                if (!m_interpreter->executeEffects(m_nodeIndex, m_node)) {
+                    result = false;
+                    break;
+                }
+            }
+        }
+        
+        if (mode == PhaseMode::Global)
+            m_state->reset();
+
+        if (reallyInsertBarriers())
+            m_insertionSet.execute(block);
+        
+        return result;
+    }
+    
+    void considerBarrier(Edge base, Edge child)
+    {
+        if (verbose)
+            dataLog("        Considering adding barrier ", base, " => ", child, "\n");
+        
+        // We don't need a store barrier if the child is guaranteed to not be a cell.
+        switch (mode) {
+        case PhaseMode::Fast: {
+            // Don't try too hard because it's too expensive to run AI.
+            if (child->hasConstant()) {
+                if (!child->asJSValue().isCell()) {
+                    if (verbose)
+                        dataLog("            Rejecting because of constant type.\n");
+                    return;
+                }
+            } else {
+                switch (child->result()) {
+                case NodeResultNumber:
+                case NodeResultDouble:
+                case NodeResultInt32:
+                case NodeResultInt52:
+                case NodeResultBoolean:
+                    if (verbose)
+                        dataLog("            Rejecting because of result type.\n");
+                    return;
+                default:
+                    break;
+                }
+            }
+            break;
+        }
+            
+        case PhaseMode::Global: {
+            // Go into rage mode to eliminate any chance of a barrier with a non-cell child. We
+            // can afford to keep around AI in Global mode.
+            if (!m_interpreter->needsTypeCheck(child, ~SpecCell)) {
+                if (verbose)
+                    dataLog("            Rejecting because of AI type.\n");
+                return;
+            }
+            break;
+        } }
+        
+        considerBarrier(base);
+    }
+    
+    void considerBarrier(Edge base)
+    {
+        if (verbose)
+            dataLog("        Considering adding barrier on ", base, "\n");
+        
+        // We don't need a store barrier if the epoch of the base is identical to the current
+        // epoch. That means that we either just allocated the object and so it's guaranteed to
+        // be in newgen, or we just ran a barrier on it so it's guaranteed to be remembered
+        // already.
+        if (base->epoch() == m_currentEpoch) {
+            if (verbose)
+                dataLog("            Rejecting because it's in the current epoch.\n");
+            return;
+        }
+        
+        if (verbose)
+            dataLog("            Inserting barrier.\n");
+        insertBarrier(m_nodeIndex + 1, base);
+    }
+
+    void insertBarrier(unsigned nodeIndex, Edge base)
+    {
+        // This is just our way of saying that barriers are not redundant with each other according
+        // to forward analysis: if we proved one time that a barrier was necessary then it'll for
+        // sure be necessary next time.
+        base->setEpoch(Epoch());
+
+        // If we're in global mode, we should only insert the barriers once we have converged.
+        if (!reallyInsertBarriers())
+            return;
+        
+        // FIXME: We could support StoreBarrier(UntypedUse:). That would be sort of cool.
+        // But right now we don't need it.
+
+        DFG_ASSERT(m_graph, m_node, isCell(base.useKind()));
+        
+        // Barriers are always inserted after the node that they service. Therefore, we always know
+        // that the thing is a cell now.
+        base.setUseKind(KnownCellUse);
+        
+        NodeOrigin origin = m_node->origin;
+        if (clobbersExitState(m_graph, m_node))
+            origin = origin.withInvalidExit();
+        
+        NodeType type;
+        if (Options::useConcurrentBarriers())
+            type = FencedStoreBarrier;
+        else
+            type = StoreBarrier;
+        
+        m_insertionSet.insertNode(nodeIndex, SpecNone, type, origin, base);
+    }
+    
+    bool reallyInsertBarriers()
+    {
+        return mode == PhaseMode::Fast || m_isConverged;
+    }
+    
+    InsertionSet m_insertionSet;
+    Epoch m_currentEpoch;
+    unsigned m_nodeIndex;
+    Node* m_node;
+    
+    // Things we only use in Global mode.
+    std::unique_ptr<InPlaceAbstractState> m_state;
+    std::unique_ptr<AbstractInterpreter<InPlaceAbstractState>> m_interpreter;
+    std::unique_ptr<BlockMap<HashSet<Node*>>> m_stateAtHead;
+    std::unique_ptr<BlockMap<HashSet<Node*>>> m_stateAtTail;
+    bool m_isConverged;
+};
+
+} // anonymous namespace
+
+bool performFastStoreBarrierInsertion(Graph& graph)
+{
+    return runPhase<StoreBarrierInsertionPhase<PhaseMode::Fast>>(graph);
+}
+
+bool performGlobalStoreBarrierInsertion(Graph& graph)
+{
+    return runPhase<StoreBarrierInsertionPhase<PhaseMode::Global>>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGStoreBarrierInsertionPhase.h b/dfg/DFGStoreBarrierInsertionPhase.h
new file mode 100644
index 0000000..730352c
--- /dev/null
+++ b/dfg/DFGStoreBarrierInsertionPhase.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Inserts store barriers in a block-local manner without consulting the abstract interpreter.
+// Uses a simple epoch-based analysis to avoid inserting barriers on newly allocated objects. This
+// phase requires that we are not in SSA.
+bool performFastStoreBarrierInsertion(Graph&);
+
+// Inserts store barriers using a global analysis and consults the abstract interpreter. Uses a
+// simple epoch-based analysis to avoid inserting barriers on newly allocated objects. This phase
+// requires SSA. This phase also requires having valid AI and liveness.
+bool performGlobalStoreBarrierInsertion(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGStrengthReductionPhase.cpp b/dfg/DFGStrengthReductionPhase.cpp
new file mode 100644
index 0000000..31d8609
--- /dev/null
+++ b/dfg/DFGStrengthReductionPhase.cpp
@@ -0,0 +1,866 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGStrengthReductionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractHeap.h"
+#include "DFGClobberize.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGPredictionPropagationPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+#include "MathCommon.h"
+#include "RegExpConstructor.h"
+#include "StringPrototype.h"
+#include <cstdlib>
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC { namespace DFG {
+
+class StrengthReductionPhase : public Phase {
+    static const bool verbose = false;
+    
+public:
+    StrengthReductionPhase(Graph& graph)
+        : Phase(graph, "strength reduction")
+        , m_insertionSet(graph)
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_fixpointState == FixpointNotConverged);
+        
+        m_changed = false;
+        
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            m_block = m_graph.block(blockIndex);
+            if (!m_block)
+                continue;
+            for (m_nodeIndex = 0; m_nodeIndex < m_block->size(); ++m_nodeIndex) {
+                m_node = m_block->at(m_nodeIndex);
+                handleNode();
+            }
+            m_insertionSet.execute(m_block);
+        }
+        
+        return m_changed;
+    }
+
+private:
+    void handleNode()
+    {
+        switch (m_node->op()) {
+        case BitOr:
+            handleCommutativity();
+
+            if (m_node->child1().useKind() != UntypedUse && m_node->child2()->isInt32Constant() && !m_node->child2()->asInt32()) {
+                convertToIdentityOverChild1();
+                break;
+            }
+            break;
+            
+        case BitXor:
+        case BitAnd:
+            handleCommutativity();
+            break;
+            
+        case BitLShift:
+        case BitRShift:
+        case BitURShift:
+            if (m_node->child1().useKind() != UntypedUse && m_node->child2()->isInt32Constant() && !(m_node->child2()->asInt32() & 0x1f)) {
+                convertToIdentityOverChild1();
+                break;
+            }
+            break;
+            
+        case UInt32ToNumber:
+            if (m_node->child1()->op() == BitURShift
+                && m_node->child1()->child2()->isInt32Constant()
+                && (m_node->child1()->child2()->asInt32() & 0x1f)
+                && m_node->arithMode() != Arith::DoOverflow) {
+                m_node->convertToIdentity();
+                m_changed = true;
+                break;
+            }
+            break;
+            
+        case ArithAdd:
+            handleCommutativity();
+            
+            if (m_node->child2()->isInt32Constant() && !m_node->child2()->asInt32()) {
+                convertToIdentityOverChild1();
+                break;
+            }
+            break;
+            
+        case ArithMul: {
+            handleCommutativity();
+            Edge& child2 = m_node->child2();
+            if (child2->isNumberConstant() && child2->asNumber() == 2) {
+                switch (m_node->binaryUseKind()) {
+                case DoubleRepUse:
+                    // It is always valuable to get rid of a double multiplication by 2.
+                    // We won't have half-register dependencies issues on x86 and we won't have to load the constants.
+                    m_node->setOp(ArithAdd);
+                    child2.setNode(m_node->child1().node());
+                    m_changed = true;
+                    break;
+#if USE(JSVALUE64)
+                case Int52RepUse:
+#endif
+                case Int32Use:
+                    // For integers, we can only convert compatible modes.
+                    // ArithAdd does handle do negative zero check for example.
+                    if (m_node->arithMode() == Arith::CheckOverflow || m_node->arithMode() == Arith::Unchecked) {
+                        m_node->setOp(ArithAdd);
+                        child2.setNode(m_node->child1().node());
+                        m_changed = true;
+                    }
+                    break;
+                default:
+                    break;
+                }
+            }
+            break;
+        }
+        case ArithSub:
+            if (m_node->child2()->isInt32Constant()
+                && m_node->isBinaryUseKind(Int32Use)) {
+                int32_t value = m_node->child2()->asInt32();
+                if (-value != value) {
+                    m_node->setOp(ArithAdd);
+                    m_node->child2().setNode(
+                        m_insertionSet.insertConstant(
+                            m_nodeIndex, m_node->origin, jsNumber(-value)));
+                    m_changed = true;
+                    break;
+                }
+            }
+            break;
+
+        case ArithPow:
+            if (m_node->child2()->isNumberConstant()) {
+                double yOperandValue = m_node->child2()->asNumber();
+                if (yOperandValue == 1) {
+                    convertToIdentityOverChild1();
+                    m_changed = true;
+                } else if (yOperandValue == 2) {
+                    m_node->setOp(ArithMul);
+                    m_node->child2() = m_node->child1();
+                    m_changed = true;
+                }
+            }
+            break;
+
+        case ArithMod:
+            // On Integers
+            // In: ArithMod(ArithMod(x, const1), const2)
+            // Out: Identity(ArithMod(x, const1))
+            //     if const1 <= const2.
+            if (m_node->binaryUseKind() == Int32Use
+                && m_node->child2()->isInt32Constant()
+                && m_node->child1()->op() == ArithMod
+                && m_node->child1()->binaryUseKind() == Int32Use
+                && m_node->child1()->child2()->isInt32Constant()
+                && std::abs(m_node->child1()->child2()->asInt32()) <= std::abs(m_node->child2()->asInt32())) {
+                    convertToIdentityOverChild1();
+            }
+            break;
+
+        case ArithDiv:
+            // Transform
+            //    ArithDiv(x, constant)
+            // Into
+            //    ArithMul(x, 1 / constant)
+            // if the operation has the same result.
+            if (m_node->isBinaryUseKind(DoubleRepUse)
+                && m_node->child2()->isNumberConstant()) {
+
+                if (std::optional<double> reciprocal = safeReciprocalForDivByConst(m_node->child2()->asNumber())) {
+                    Node* reciprocalNode = m_insertionSet.insertConstant(m_nodeIndex, m_node->origin, jsDoubleNumber(*reciprocal), DoubleConstant);
+                    m_node->setOp(ArithMul);
+                    m_node->child2() = Edge(reciprocalNode, DoubleRepUse);
+                    m_changed = true;
+                    break;
+                }
+            }
+            break;
+
+        case ValueRep:
+        case Int52Rep:
+        case DoubleRep: {
+            // This short-circuits circuitous conversions, like ValueRep(DoubleRep(value)) or
+            // even more complicated things. Like, it can handle a beast like
+            // ValueRep(DoubleRep(Int52Rep(value))).
+            
+            // The only speculation that we would do beyond validating that we have a type that
+            // can be represented a certain way is an Int32 check that would appear on Int52Rep
+            // nodes. For now, if we see this and the final type we want is an Int52, we use it
+            // as an excuse not to fold. The only thing we would need is a Int52RepInt32Use kind.
+            bool hadInt32Check = false;
+            if (m_node->op() == Int52Rep) {
+                if (m_node->child1().useKind() != Int32Use)
+                    break;
+                hadInt32Check = true;
+            }
+            for (Node* node = m_node->child1().node(); ; node = node->child1().node()) {
+                if (canonicalResultRepresentation(node->result()) ==
+                    canonicalResultRepresentation(m_node->result())) {
+                    m_insertionSet.insertCheck(m_nodeIndex, m_node);
+                    if (hadInt32Check) {
+                        // FIXME: Consider adding Int52RepInt32Use or even DoubleRepInt32Use,
+                        // which would be super weird. The latter would only arise in some
+                        // seriously circuitous conversions.
+                        if (canonicalResultRepresentation(node->result()) != NodeResultJS)
+                            break;
+                        
+                        m_insertionSet.insertCheck(
+                            m_nodeIndex, m_node->origin, Edge(node, Int32Use));
+                    }
+                    m_node->child1() = node->defaultEdge();
+                    m_node->convertToIdentity();
+                    m_changed = true;
+                    break;
+                }
+                
+                switch (node->op()) {
+                case Int52Rep:
+                    if (node->child1().useKind() != Int32Use)
+                        break;
+                    hadInt32Check = true;
+                    continue;
+                    
+                case DoubleRep:
+                case ValueRep:
+                    continue;
+                    
+                default:
+                    break;
+                }
+                break;
+            }
+            break;
+        }
+            
+        case Flush: {
+            ASSERT(m_graph.m_form != SSA);
+            
+            Node* setLocal = nullptr;
+            VirtualRegister local = m_node->local();
+            
+            for (unsigned i = m_nodeIndex; i--;) {
+                Node* node = m_block->at(i);
+                if (node->op() == SetLocal && node->local() == local) {
+                    setLocal = node;
+                    break;
+                }
+                if (accessesOverlap(m_graph, node, AbstractHeap(Stack, local)))
+                    break;
+            }
+            
+            if (!setLocal)
+                break;
+            
+            // The Flush should become a PhantomLocal at this point. This means that we want the
+            // local's value during OSR, but we don't care if the value is stored to the stack. CPS
+            // rethreading can canonicalize PhantomLocals for us.
+            m_node->convertFlushToPhantomLocal();
+            m_graph.dethread();
+            m_changed = true;
+            break;
+        }
+
+        // FIXME: we should probably do this in constant folding but this currently relies on an OSR exit rule.
+        // https://bugs.webkit.org/show_bug.cgi?id=154832
+        case OverridesHasInstance: {
+            if (!m_node->child2().node()->isCellConstant())
+                break;
+
+            if (m_node->child2().node()->asCell() != m_graph.globalObjectFor(m_node->origin.semantic)->functionProtoHasInstanceSymbolFunction()) {
+                m_graph.convertToConstant(m_node, jsBoolean(true));
+                m_changed = true;
+
+            } else if (!m_graph.hasExitSite(m_node->origin.semantic, BadTypeInfoFlags)) {
+                // We optimistically assume that we will not see a function that has a custom instanceof operation as they should be rare.
+                m_insertionSet.insertNode(m_nodeIndex, SpecNone, CheckTypeInfoFlags, m_node->origin, OpInfo(ImplementsDefaultHasInstance), Edge(m_node->child1().node(), CellUse));
+                m_graph.convertToConstant(m_node, jsBoolean(false));
+                m_changed = true;
+            }
+
+            break;
+        }
+
+        // FIXME: We have a lot of string constant-folding rules here. It would be great to
+        // move these to the abstract interpreter once AbstractValue can support LazyJSValue.
+        // https://bugs.webkit.org/show_bug.cgi?id=155204
+
+        case ValueAdd: {
+            if (m_node->child1()->isConstant()
+                && m_node->child2()->isConstant()
+                && (!!m_node->child1()->tryGetString(m_graph) || !!m_node->child2()->tryGetString(m_graph))) {
+                auto tryGetConstantString = [&] (Node* node) -> String {
+                    String string = node->tryGetString(m_graph);
+                    if (!string.isEmpty())
+                        return string;
+                    JSValue value = node->constant()->value();
+                    if (!value)
+                        return String();
+                    if (value.isInt32())
+                        return String::number(value.asInt32());
+                    if (value.isNumber())
+                        return String::numberToStringECMAScript(value.asNumber());
+                    if (value.isBoolean())
+                        return value.asBoolean() ? ASCIILiteral("true") : ASCIILiteral("false");
+                    if (value.isNull())
+                        return ASCIILiteral("null");
+                    if (value.isUndefined())
+                        return ASCIILiteral("undefined");
+                    return String();
+                };
+
+                String leftString = tryGetConstantString(m_node->child1().node());
+                if (!leftString)
+                    break;
+                String rightString = tryGetConstantString(m_node->child2().node());
+                if (!rightString)
+                    break;
+
+                StringBuilder builder;
+                builder.append(leftString);
+                builder.append(rightString);
+                m_node->convertToLazyJSConstant(
+                    m_graph, LazyJSValue::newString(m_graph, builder.toString()));
+                m_changed = true;
+            }
+            break;
+        }
+
+        case MakeRope:
+        case StrCat: {
+            String leftString = m_node->child1()->tryGetString(m_graph);
+            if (!leftString)
+                break;
+            String rightString = m_node->child2()->tryGetString(m_graph);
+            if (!rightString)
+                break;
+            String extraString;
+            if (m_node->child3()) {
+                extraString = m_node->child3()->tryGetString(m_graph);
+                if (!extraString)
+                    break;
+            }
+
+            StringBuilder builder;
+            builder.append(leftString);
+            builder.append(rightString);
+            if (!!extraString)
+                builder.append(extraString);
+
+            m_node->convertToLazyJSConstant(
+                m_graph, LazyJSValue::newString(m_graph, builder.toString()));
+            m_changed = true;
+            break;
+        }
+
+        case GetArrayLength: {
+            if (m_node->arrayMode().type() == Array::Generic
+                || m_node->arrayMode().type() == Array::String) {
+                String string = m_node->child1()->tryGetString(m_graph);
+                if (!!string) {
+                    m_graph.convertToConstant(m_node, jsNumber(string.length()));
+                    m_changed = true;
+                    break;
+                }
+            }
+            break;
+        }
+
+        case GetGlobalObject: {
+            if (JSObject* object = m_node->child1()->dynamicCastConstant<JSObject*>()) {
+                m_graph.convertToConstant(m_node, object->globalObject());
+                m_changed = true;
+                break;
+            }
+            break;
+        }
+
+        case RegExpExec:
+        case RegExpTest: {
+            JSGlobalObject* globalObject = m_node->child1()->dynamicCastConstant<JSGlobalObject*>();
+            if (!globalObject) {
+                if (verbose)
+                    dataLog("Giving up because no global object.\n");
+                break;
+            }
+
+            if (globalObject->isHavingABadTime()) {
+                if (verbose)
+                    dataLog("Giving up because bad time.\n");
+                break;
+            }
+
+            Node* regExpObjectNode = m_node->child2().node();
+            RegExp* regExp;
+            if (RegExpObject* regExpObject = regExpObjectNode->dynamicCastConstant<RegExpObject*>())
+                regExp = regExpObject->regExp();
+            else if (regExpObjectNode->op() == NewRegexp)
+                regExp = regExpObjectNode->castOperand<RegExp*>();
+            else {
+                if (verbose)
+                    dataLog("Giving up because the regexp is unknown.\n");
+                break;
+            }
+
+            Node* stringNode = m_node->child3().node();
+            
+            // NOTE: This mostly already protects us from having the compiler execute a regexp
+            // operation on a ginormous string by preventing us from getting our hands on ginormous
+            // strings in the first place.
+            String string = m_node->child3()->tryGetString(m_graph);
+            if (!string) {
+                if (verbose)
+                    dataLog("Giving up because the string is unknown.\n");
+                break;
+            }
+
+            FrozenValue* regExpFrozenValue = m_graph.freeze(regExp);
+
+            // Refuse to do things with regular expressions that have a ginormous number of
+            // subpatterns.
+            unsigned ginormousNumberOfSubPatterns = 1000;
+            if (regExp->numSubpatterns() > ginormousNumberOfSubPatterns) {
+                if (verbose)
+                    dataLog("Giving up because of pattern limit.\n");
+                break;
+            }
+            
+            unsigned lastIndex;
+            if (regExp->globalOrSticky()) {
+                // This will only work if we can prove what the value of lastIndex is. To do this
+                // safely, we need to execute the insertion set so that we see any previous strength
+                // reductions. This is needed for soundness since otherwise the effectfulness of any
+                // previous strength reductions would be invisible to us.
+                executeInsertionSet();
+                lastIndex = UINT_MAX;
+                for (unsigned otherNodeIndex = m_nodeIndex; otherNodeIndex--;) {
+                    Node* otherNode = m_block->at(otherNodeIndex);
+                    if (otherNode == regExpObjectNode) {
+                        lastIndex = 0;
+                        break;
+                    }
+                    if (otherNode->op() == SetRegExpObjectLastIndex
+                        && otherNode->child1() == regExpObjectNode
+                        && otherNode->child2()->isInt32Constant()
+                        && otherNode->child2()->asInt32() >= 0) {
+                        lastIndex = static_cast<unsigned>(otherNode->child2()->asInt32());
+                        break;
+                    }
+                    if (writesOverlap(m_graph, otherNode, RegExpObject_lastIndex))
+                        break;
+                }
+                if (lastIndex == UINT_MAX) {
+                    if (verbose)
+                        dataLog("Giving up because the last index is not known.\n");
+                    break;
+                }
+            } else
+                lastIndex = 0;
+
+            m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
+            
+            Structure* structure = globalObject->regExpMatchesArrayStructure();
+            if (structure->indexingType() != ArrayWithContiguous) {
+                // This is further protection against a race with haveABadTime.
+                if (verbose)
+                    dataLog("Giving up because the structure has the wrong indexing type.\n");
+                break;
+            }
+            m_graph.registerStructure(structure);
+
+            RegExpConstructor* constructor = globalObject->regExpConstructor();
+            FrozenValue* constructorFrozenValue = m_graph.freeze(constructor);
+
+            MatchResult result;
+            Vector<int> ovector;
+            // We have to call the kind of match function that the main thread would have called.
+            // Otherwise, we might not have the desired Yarr code compiled, and the match will fail.
+            if (m_node->op() == RegExpExec) {
+                int position;
+                if (!regExp->matchConcurrently(vm(), string, lastIndex, position, ovector)) {
+                    if (verbose)
+                        dataLog("Giving up because match failed.\n");
+                    break;
+                }
+                result.start = position;
+                result.end = ovector[1];
+            } else {
+                if (!regExp->matchConcurrently(vm(), string, lastIndex, result)) {
+                    if (verbose)
+                        dataLog("Giving up because match failed.\n");
+                    break;
+                }
+            }
+
+            // We've constant-folded the regexp. Now we're committed to replacing RegExpExec/Test.
+
+            m_changed = true;
+
+            NodeOrigin origin = m_node->origin;
+
+            m_insertionSet.insertNode(
+                m_nodeIndex, SpecNone, Check, origin, m_node->children.justChecks());
+
+            if (m_node->op() == RegExpExec) {
+                if (result) {
+                    RegisteredStructureSet* structureSet = m_graph.addStructureSet(structure);
+
+                    // Create an array modeling the JS array that we will try to allocate. This is
+                    // basically createRegExpMatchesArray but over C++ strings instead of JSStrings.
+                    Vector<String> resultArray;
+                    resultArray.append(string.substring(result.start, result.end - result.start));
+                    for (unsigned i = 1; i <= regExp->numSubpatterns(); ++i) {
+                        int start = ovector[2 * i];
+                        if (start >= 0)
+                            resultArray.append(string.substring(start, ovector[2 * i + 1] - start));
+                        else
+                            resultArray.append(String());
+                    }
+
+                    unsigned publicLength = resultArray.size();
+                    unsigned vectorLength =
+                        Butterfly::optimalContiguousVectorLength(structure, publicLength);
+
+                    UniquedStringImpl* indexUID = vm().propertyNames->index.impl();
+                    UniquedStringImpl* inputUID = vm().propertyNames->input.impl();
+                    unsigned indexIndex = m_graph.identifiers().ensure(indexUID);
+                    unsigned inputIndex = m_graph.identifiers().ensure(inputUID);
+
+                    unsigned firstChild = m_graph.m_varArgChildren.size();
+                    m_graph.m_varArgChildren.append(
+                        m_insertionSet.insertConstantForUse(
+                            m_nodeIndex, origin, structure, KnownCellUse));
+                    ObjectMaterializationData* data = m_graph.m_objectMaterializationData.add();
+            
+                    m_graph.m_varArgChildren.append(
+                        m_insertionSet.insertConstantForUse(
+                            m_nodeIndex, origin, jsNumber(publicLength), KnownInt32Use));
+                    data->m_properties.append(PublicLengthPLoc);
+            
+                    m_graph.m_varArgChildren.append(
+                        m_insertionSet.insertConstantForUse(
+                            m_nodeIndex, origin, jsNumber(vectorLength), KnownInt32Use));
+                    data->m_properties.append(VectorLengthPLoc);
+
+                    m_graph.m_varArgChildren.append(
+                        m_insertionSet.insertConstantForUse(
+                            m_nodeIndex, origin, jsNumber(result.start), UntypedUse));
+                    data->m_properties.append(
+                        PromotedLocationDescriptor(NamedPropertyPLoc, indexIndex));
+
+                    m_graph.m_varArgChildren.append(Edge(stringNode, UntypedUse));
+                    data->m_properties.append(
+                        PromotedLocationDescriptor(NamedPropertyPLoc, inputIndex));
+
+                    auto materializeString = [&] (const String& string) -> Node* {
+                        if (string.isNull())
+                            return nullptr;
+                        if (string.isEmpty()) {
+                            return m_insertionSet.insertConstant(
+                                m_nodeIndex, origin, vm().smallStrings.emptyString());
+                        }
+                        LazyJSValue value = LazyJSValue::newString(m_graph, string);
+                        return m_insertionSet.insertNode(
+                            m_nodeIndex, SpecNone, LazyJSConstant, origin,
+                            OpInfo(m_graph.m_lazyJSValues.add(value)));
+                    };
+
+                    for (unsigned i = 0; i < resultArray.size(); ++i) {
+                        if (Node* node = materializeString(resultArray[i])) {
+                            m_graph.m_varArgChildren.append(Edge(node, UntypedUse));
+                            data->m_properties.append(
+                                PromotedLocationDescriptor(IndexedPropertyPLoc, i));
+                        }
+                    }
+            
+                    Node* resultNode = m_insertionSet.insertNode(
+                        m_nodeIndex, SpecArray, Node::VarArg, MaterializeNewObject, origin,
+                        OpInfo(structureSet), OpInfo(data), firstChild,
+                        m_graph.m_varArgChildren.size() - firstChild);
+                
+                    m_node->convertToIdentityOn(resultNode);
+                } else
+                    m_graph.convertToConstant(m_node, jsNull());
+            } else
+                m_graph.convertToConstant(m_node, jsBoolean(!!result));
+
+            // Whether it's Exec or Test, we need to tell the constructor and RegExpObject what's up.
+            // Because SetRegExpObjectLastIndex may exit and it clobbers exit state, we do that
+            // first.
+            
+            if (regExp->globalOrSticky()) {
+                m_insertionSet.insertNode(
+                    m_nodeIndex, SpecNone, SetRegExpObjectLastIndex, origin,
+                    Edge(regExpObjectNode, RegExpObjectUse),
+                    m_insertionSet.insertConstantForUse(
+                        m_nodeIndex, origin, jsNumber(result ? result.end : 0), UntypedUse));
+                
+                origin = origin.withInvalidExit();
+            }
+
+            if (result) {
+                unsigned firstChild = m_graph.m_varArgChildren.size();
+                m_graph.m_varArgChildren.append(
+                    m_insertionSet.insertConstantForUse(
+                        m_nodeIndex, origin, constructorFrozenValue, KnownCellUse));
+                m_graph.m_varArgChildren.append(
+                    m_insertionSet.insertConstantForUse(
+                        m_nodeIndex, origin, regExpFrozenValue, KnownCellUse));
+                m_graph.m_varArgChildren.append(Edge(stringNode, KnownCellUse));
+                m_graph.m_varArgChildren.append(
+                    m_insertionSet.insertConstantForUse(
+                        m_nodeIndex, origin, jsNumber(result.start), KnownInt32Use));
+                m_graph.m_varArgChildren.append(
+                    m_insertionSet.insertConstantForUse(
+                        m_nodeIndex, origin, jsNumber(result.end), KnownInt32Use));
+                m_insertionSet.insertNode(
+                    m_nodeIndex, SpecNone, Node::VarArg, RecordRegExpCachedResult, origin,
+                    OpInfo(), OpInfo(), firstChild, m_graph.m_varArgChildren.size() - firstChild);
+
+                origin = origin.withInvalidExit();
+            }
+            
+            m_node->origin = origin;
+            break;
+        }
+
+        case StringReplace:
+        case StringReplaceRegExp: {
+            Node* stringNode = m_node->child1().node();
+            String string = stringNode->tryGetString(m_graph);
+            if (!string)
+                break;
+            
+            Node* regExpObjectNode = m_node->child2().node();
+            RegExp* regExp;
+            if (RegExpObject* regExpObject = regExpObjectNode->dynamicCastConstant<RegExpObject*>())
+                regExp = regExpObject->regExp();
+            else if (regExpObjectNode->op() == NewRegexp)
+                regExp = regExpObjectNode->castOperand<RegExp*>();
+            else {
+                if (verbose)
+                    dataLog("Giving up because the regexp is unknown.\n");
+                break;
+            }
+
+            String replace = m_node->child3()->tryGetString(m_graph);
+            if (!replace)
+                break;
+
+            StringBuilder builder;
+
+            unsigned lastIndex = 0;
+            unsigned startPosition = 0;
+            bool ok = true;
+            do {
+                MatchResult result;
+                Vector<int> ovector;
+                // Model which version of match() is called by the main thread.
+                if (replace.isEmpty() && regExp->global()) {
+                    if (!regExp->matchConcurrently(vm(), string, startPosition, result)) {
+                        ok = false;
+                        break;
+                    }
+                } else {
+                    int position;
+                    if (!regExp->matchConcurrently(vm(), string, startPosition, position, ovector)) {
+                        ok = false;
+                        break;
+                    }
+                    
+                    result.start = position;
+                    result.end = ovector[1];
+                }
+                
+                if (!result)
+                    break;
+
+                unsigned replLen = replace.length();
+                if (lastIndex < result.start || replLen) {
+                    builder.append(string, lastIndex, result.start - lastIndex);
+                    if (replLen)
+                        builder.append(substituteBackreferences(replace, string, ovector.data(), regExp));
+                }
+
+                lastIndex = result.end;
+                startPosition = lastIndex;
+
+                // special case of empty match
+                if (result.empty()) {
+                    startPosition++;
+                    if (startPosition > string.length())
+                        break;
+                }
+            } while (regExp->global());
+            if (!ok)
+                break;
+
+            // We are committed at this point.
+            m_changed = true;
+
+            NodeOrigin origin = m_node->origin;
+
+            if (regExp->global()) {
+                m_insertionSet.insertNode(
+                    m_nodeIndex, SpecNone, SetRegExpObjectLastIndex, origin,
+                    Edge(regExpObjectNode, RegExpObjectUse),
+                    m_insertionSet.insertConstantForUse(
+                        m_nodeIndex, origin, jsNumber(0), UntypedUse));
+                
+                origin = origin.withInvalidExit();
+            }
+
+            if (!lastIndex && builder.isEmpty())
+                m_node->convertToIdentityOn(stringNode);
+            else {
+                if (lastIndex < string.length())
+                    builder.append(string, lastIndex, string.length() - lastIndex);
+                
+                m_node->convertToLazyJSConstant(
+                    m_graph, LazyJSValue::newString(m_graph, builder.toString()));
+            }
+
+            m_node->origin = origin;
+            break;
+        }
+            
+        case Call:
+        case Construct:
+        case TailCallInlinedCaller:
+        case TailCall: {
+            ExecutableBase* executable = nullptr;
+            Edge callee = m_graph.varArgChild(m_node, 0);
+            if (JSFunction* function = callee->dynamicCastConstant<JSFunction*>())
+                executable = function->executable();
+            else if (callee->isFunctionAllocation())
+                executable = callee->castOperand<FunctionExecutable*>();
+            
+            if (!executable)
+                break;
+            
+            if (FunctionExecutable* functionExecutable = jsDynamicCast<FunctionExecutable*>(executable)) {
+                // We need to update m_parameterSlots before we get to the backend, but we don't
+                // want to do too much of this.
+                unsigned numAllocatedArgs =
+                    static_cast<unsigned>(functionExecutable->parameterCount()) + 1;
+                
+                if (numAllocatedArgs <= Options::maximumDirectCallStackSize()) {
+                    m_graph.m_parameterSlots = std::max(
+                        m_graph.m_parameterSlots,
+                        Graph::parameterSlotsForArgCount(numAllocatedArgs));
+                }
+            }
+            
+            m_node->convertToDirectCall(m_graph.freeze(executable));
+            m_changed = true;
+            break;
+        }
+
+        default:
+            break;
+        }
+    }
+            
+    void convertToIdentityOverChild(unsigned childIndex)
+    {
+        m_insertionSet.insertCheck(m_nodeIndex, m_node);
+        m_node->children.removeEdge(childIndex ^ 1);
+        m_node->convertToIdentity();
+        m_changed = true;
+    }
+    
+    void convertToIdentityOverChild1()
+    {
+        convertToIdentityOverChild(0);
+    }
+    
+    void convertToIdentityOverChild2()
+    {
+        convertToIdentityOverChild(1);
+    }
+    
+    void handleCommutativity()
+    {
+        // It's definitely not sound to swap the lhs and rhs when we may be performing effectful
+        // calls on the lhs/rhs for valueOf.
+        if (m_node->child1().useKind() == UntypedUse || m_node->child2().useKind() == UntypedUse)
+            return;
+
+        // If the right side is a constant then there is nothing left to do.
+        if (m_node->child2()->hasConstant())
+            return;
+        
+        // This case ensures that optimizations that look for x + const don't also have
+        // to look for const + x.
+        if (m_node->child1()->hasConstant() && !m_node->child1()->asJSValue().isCell()) {
+            std::swap(m_node->child1(), m_node->child2());
+            m_changed = true;
+            return;
+        }
+        
+        // This case ensures that CSE is commutativity-aware.
+        if (m_node->child1().node() > m_node->child2().node()) {
+            std::swap(m_node->child1(), m_node->child2());
+            m_changed = true;
+            return;
+        }
+    }
+
+    void executeInsertionSet()
+    {
+        m_nodeIndex += m_insertionSet.execute(m_block);
+    }
+    
+    InsertionSet m_insertionSet;
+    BasicBlock* m_block;
+    unsigned m_nodeIndex;
+    Node* m_node;
+    bool m_changed;
+};
+    
+bool performStrengthReduction(Graph& graph)
+{
+    return runPhase<StrengthReductionPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGStrengthReductionPhase.h b/dfg/DFGStrengthReductionPhase.h
new file mode 100644
index 0000000..8ce90d6
--- /dev/null
+++ b/dfg/DFGStrengthReductionPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Performs simplifications that don't depend on CFA or CSE but that should be
+// fixpointed with CFA and CSE.
+
+bool performStrengthReduction(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGStructureAbstractValue.cpp b/dfg/DFGStructureAbstractValue.cpp
new file mode 100644
index 0000000..d9d9c6c
--- /dev/null
+++ b/dfg/DFGStructureAbstractValue.cpp
@@ -0,0 +1,388 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGStructureAbstractValue.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+#if !ASSERT_DISABLED
+void StructureAbstractValue::assertIsRegistered(Graph& graph) const
+{
+    if (isTop())
+        return;
+    
+    for (unsigned i = size(); i--;)
+        graph.assertIsRegistered(at(i).get());
+}
+#endif // !ASSERT_DISABLED
+
+void StructureAbstractValue::clobber()
+{
+    // The premise of this approach to clobbering is that anytime we introduce
+    // a watchable structure into an abstract value, we watchpoint it. You can assert
+    // that this holds by calling assertIsWatched().
+        
+    if (isTop())
+        return;
+
+    setClobbered(true);
+        
+    if (m_set.isThin()) {
+        if (!m_set.singleEntry())
+            return;
+        if (!m_set.singleEntry()->dfgShouldWatch())
+            makeTopWhenThin();
+        return;
+    }
+    
+    RegisteredStructureSet::OutOfLineList* list = m_set.list();
+    for (unsigned i = list->m_length; i--;) {
+        if (!list->list()[i]->dfgShouldWatch()) {
+            makeTop();
+            return;
+        }
+    }
+}
+
+void StructureAbstractValue::observeTransition(RegisteredStructure from, RegisteredStructure to)
+{
+    ASSERT(!from->dfgShouldWatch());
+
+    if (isTop())
+        return;
+    
+    if (!m_set.contains(from))
+        return;
+    
+    if (!m_set.add(to))
+        return;
+    
+    if (m_set.size() > polymorphismLimit)
+        makeTop();
+}
+
+void StructureAbstractValue::observeTransitions(const TransitionVector& vector)
+{
+    if (isTop())
+        return;
+    
+    RegisteredStructureSet newStructures;
+    for (unsigned i = vector.size(); i--;) {
+        ASSERT(!vector[i].previous->dfgShouldWatch());
+
+        if (!m_set.contains(vector[i].previous))
+            continue;
+        
+        newStructures.add(vector[i].next);
+    }
+    
+    if (!m_set.merge(newStructures))
+        return;
+    
+    if (m_set.size() > polymorphismLimit)
+        makeTop();
+}
+
+bool StructureAbstractValue::add(RegisteredStructure structure)
+{
+    if (isTop())
+        return false;
+    
+    if (!m_set.add(structure))
+        return false;
+    
+    if (m_set.size() > polymorphismLimit)
+        makeTop();
+    
+    return true;
+}
+
+bool StructureAbstractValue::merge(const RegisteredStructureSet& other)
+{
+    if (isTop())
+        return false;
+    
+    return mergeNotTop(other);
+}
+
+bool StructureAbstractValue::mergeSlow(const StructureAbstractValue& other)
+{
+    // It isn't immediately obvious that the code below is doing the right thing, so let's go
+    // through it.
+    //
+    // This not clobbered, other not clobbered: Clearly, we don't want to make anything clobbered
+    // since we just have two sets and we are merging them. mergeNotTop() can handle this just
+    // fine.
+    //
+    // This clobbered, other clobbered: Clobbered means that we have a set of things, plus we
+    // temporarily have the set of all things but the latter will go away once we hit the next
+    // invalidation point. This allows us to merge two clobbered sets the natural way. For now
+    // the set will still be TOP (and so we keep the clobbered bit set), but we know that after
+    // invalidation, we will have the union of the this and other.
+    //
+    // This clobbered, other not clobbered: It's safe to merge in other for both before and after
+    // invalidation, so long as we leave the clobbered bit set. Before invalidation this has no
+    // effect since the set will still appear to have all things in it. The way to think about
+    // what invalidation would do is imagine if we had a set A that was clobbered and a set B
+    // that wasn't and we considered the following two cases. Note that we expect A to be the
+    // same at the end in both cases:
+    //
+    //            A.merge(B)                             InvalidationPoint
+    //            InvalidationPoint                      A.merge(B)
+    //
+    // The fact that we expect A to be the same in both cases means that we want to merge other
+    // into this but keep the clobbered bit.
+    //
+    // This not clobbered, other clobbered: This is just the converse of the previous case. We
+    // want to merge other into this and set the clobbered bit.
+    
+    bool changed = false;
+    
+    if (!isClobbered() && other.isClobbered()) {
+        setClobbered(true);
+        changed = true;
+    }
+    
+    changed |= mergeNotTop(other.m_set);
+    
+    return changed;
+}
+
+bool StructureAbstractValue::mergeNotTop(const RegisteredStructureSet& other)
+{
+    if (!m_set.merge(other))
+        return false;
+    
+    if (m_set.size() > polymorphismLimit)
+        makeTop();
+    
+    return true;
+}
+
+void StructureAbstractValue::filter(const RegisteredStructureSet& other)
+{
+    if (isTop()) {
+        m_set = other;
+        return;
+    }
+    
+    if (isClobbered()) {
+        // We have two choices here:
+        //
+        // Do nothing: It's legal to keep our set intact, which would essentially mean that for
+        // now, our set would behave like TOP but after the next invalidation point it wold be
+        // a finite set again. This may be a good choice if 'other' is much bigger than our
+        // m_set.
+        //
+        // Replace m_set with other and clear the clobber bit: This is also legal, and means that
+        // we're no longer clobbered. This is usually better because it immediately gives us a
+        // smaller set.
+        //
+        // This scenario should come up rarely. We usually don't do anything to an abstract value
+        // after it is clobbered. But we apply some heuristics.
+        
+        if (other.size() > m_set.size() + clobberedSupremacyThreshold)
+            return; // Keep the clobbered set.
+        
+        m_set = other;
+        setClobbered(false);
+        return;
+    }
+    
+    m_set.filter(other);
+}
+
+void StructureAbstractValue::filter(const StructureAbstractValue& other)
+{
+    if (other.isTop())
+        return;
+    
+    if (other.isClobbered()) {
+        if (isTop())
+            return;
+        
+        if (!isClobbered()) {
+            // See justification in filter(const RegisteredStructureSet&), above. An unclobbered set is
+            // almost always better.
+            if (m_set.size() > other.m_set.size() + clobberedSupremacyThreshold)
+                *this = other; // Keep the clobbered set.
+            return;
+        }
+
+        m_set.filter(other.m_set);
+        return;
+    }
+    
+    filter(other.m_set);
+}
+
+void StructureAbstractValue::filterSlow(SpeculatedType type)
+{
+    if (!(type & SpecCell)) {
+        clear();
+        return;
+    }
+    
+    ASSERT(!isTop());
+    
+    m_set.genericFilter(
+        [&] (RegisteredStructure structure) {
+            return !!(speculationFromStructure(structure.get()) & type);
+        });
+}
+
+void StructureAbstractValue::filterClassInfoSlow(const ClassInfo* classInfo)
+{
+    ASSERT(!isTop());
+    m_set.genericFilter(
+        [&] (RegisteredStructure structure) {
+            return structure->classInfo()->isSubClassOf(classInfo);
+        });
+}
+
+bool StructureAbstractValue::contains(RegisteredStructure structure) const
+{
+    if (isInfinite())
+        return true;
+    
+    return m_set.contains(structure);
+}
+
+bool StructureAbstractValue::contains(Structure* structure) const
+{
+    if (isInfinite())
+        return true;
+    
+    return m_set.toStructureSet().contains(structure);
+}
+
+bool StructureAbstractValue::isSubsetOf(const RegisteredStructureSet& other) const
+{
+    if (isInfinite())
+        return false;
+    
+    return m_set.isSubsetOf(other);
+}
+
+bool StructureAbstractValue::isSubsetOf(const StructureAbstractValue& other) const
+{
+    if (isTop())
+        return false;
+    
+    if (other.isTop())
+        return true;
+    
+    if (isClobbered() == other.isClobbered())
+        return m_set.isSubsetOf(other.m_set);
+    
+    // Here it gets tricky. If in doubt, return false!
+    
+    if (isClobbered())
+        return false; // A clobbered set is never a subset of an unclobbered set.
+    
+    // An unclobbered set is currently a subset of a clobbered set, but it may not be so after
+    // invalidation.
+    return m_set.isSubsetOf(other.m_set);
+}
+
+bool StructureAbstractValue::isSupersetOf(const RegisteredStructureSet& other) const
+{
+    if (isInfinite())
+        return true;
+    
+    return m_set.isSupersetOf(other);
+}
+
+bool StructureAbstractValue::overlaps(const RegisteredStructureSet& other) const
+{
+    if (isInfinite())
+        return true;
+    
+    return m_set.overlaps(other);
+}
+
+bool StructureAbstractValue::overlaps(const StructureAbstractValue& other) const
+{
+    if (other.isInfinite())
+        return true;
+    
+    return overlaps(other.m_set);
+}
+
+bool StructureAbstractValue::isSubClassOf(const ClassInfo* classInfo) const
+{
+    if (isInfinite())
+        return false;
+
+    // Note taht this function returns true if the structure set is empty.
+    for (const RegisteredStructure structure : m_set) {
+        if (!structure->classInfo()->isSubClassOf(classInfo))
+            return false;
+    }
+    return true;
+}
+
+bool StructureAbstractValue::equalsSlow(const StructureAbstractValue& other) const
+{
+    ASSERT(m_set.m_pointer != other.m_set.m_pointer);
+    ASSERT(!isTop());
+    ASSERT(!other.isTop());
+    
+    return m_set == other.m_set
+        && isClobbered() == other.isClobbered();
+}
+
+void StructureAbstractValue::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    if (isClobbered())
+        out.print("Clobbered:");
+    
+    if (isTop())
+        out.print("TOP");
+    else
+        out.print(inContext(m_set.toStructureSet(), context));
+}
+
+void StructureAbstractValue::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+void StructureAbstractValue::validateReferences(const TrackedReferences& trackedReferences) const
+{
+    if (isTop())
+        return;
+    m_set.validateReferences(trackedReferences);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGStructureAbstractValue.h b/dfg/DFGStructureAbstractValue.h
new file mode 100644
index 0000000..5c6adc7
--- /dev/null
+++ b/dfg/DFGStructureAbstractValue.h
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) 2011-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGRegisteredStructureSet.h"
+#include "DFGTransition.h"
+#include "DumpContext.h"
+#include "JSCell.h"
+#include "SpeculatedType.h"
+#include "StructureSet.h"
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace DFG {
+
+class StructureAbstractValue {
+public:
+    StructureAbstractValue() { }
+    StructureAbstractValue(RegisteredStructure structure)
+        : m_set(structure)
+    {
+        setClobbered(false);
+    }
+    StructureAbstractValue(const RegisteredStructureSet& other)
+        : m_set(other)
+    {
+        setClobbered(false);
+    }
+    ALWAYS_INLINE StructureAbstractValue(const StructureAbstractValue& other)
+        : m_set(other.m_set)
+    {
+        setClobbered(other.isClobbered());
+    }
+    
+    ALWAYS_INLINE StructureAbstractValue& operator=(RegisteredStructure structure)
+    {
+        m_set = RegisteredStructureSet(structure);
+        setClobbered(false);
+        return *this;
+    }
+    ALWAYS_INLINE StructureAbstractValue& operator=(const RegisteredStructureSet& other)
+    {
+        m_set = other;
+        setClobbered(false);
+        return *this;
+    }
+    ALWAYS_INLINE StructureAbstractValue& operator=(const StructureAbstractValue& other)
+    {
+        m_set = other.m_set;
+        setClobbered(other.isClobbered());
+        return *this;
+    }
+    
+    void clear()
+    {
+        m_set.clear();
+        setClobbered(false);
+    }
+    
+    void makeTop()
+    {
+        m_set.deleteListIfNecessary();
+        m_set.m_pointer = topValue;
+    }
+    
+#if ASSERT_DISABLED
+    void assertIsRegistered(Graph&) const { }
+#else
+    void assertIsRegistered(Graph&) const;
+#endif
+    
+    void clobber();
+    void observeInvalidationPoint() { setClobbered(false); }
+    
+    void observeTransition(RegisteredStructure from, RegisteredStructure to);
+    void observeTransitions(const TransitionVector&);
+    
+    static StructureAbstractValue top()
+    {
+        StructureAbstractValue result;
+        result.m_set.m_pointer = topValue;
+        return result;
+    }
+    
+    bool isClear() const { return m_set.isEmpty(); }
+    bool isTop() const { return m_set.m_pointer == topValue; }
+    bool isNeitherClearNorTop() const { return !isClear() && !isTop(); }
+    
+    // A clobbered abstract value means that the set currently contains the m_set set of
+    // structures plus TOP, except that the "plus TOP" will go away at the next invalidation
+    // point. Note that it's tempting to think of this as "the set of structures in m_set plus
+    // the set of structures transition-reachable from m_set" - but this isn't really correct,
+    // since if we add an unwatchable structure after clobbering, the two definitions are not
+    // equivalent. If we do this, the new unwatchable structure will be added to m_set.
+    // Invalidation points do not try to "clip" the set of transition-reachable structures from
+    // m_set by looking at reachability as this would mean that the new set is TOP. Instead they
+    // literally assume that the set is just m_set rather than m_set plus TOP.
+    bool isClobbered() const { return m_set.getReservedFlag(); }
+
+    // A finite structure abstract value is one where enumerating over it will yield all
+    // of the structures that the value may have right now. This is true so long as we're
+    // neither top nor clobbered.
+    bool isFinite() const { return !isTop() && !isClobbered(); }
+
+    // An infinite structure abstract value may currently have any structure.
+    bool isInfinite() const { return !isFinite(); }
+    
+    bool add(RegisteredStructure);
+    
+    bool merge(const RegisteredStructureSet& other);
+    
+    ALWAYS_INLINE bool merge(const StructureAbstractValue& other)
+    {
+        if (other.isClear())
+            return false;
+        
+        if (isTop())
+            return false;
+        
+        if (other.isTop()) {
+            makeTop();
+            return true;
+        }
+        
+        return mergeSlow(other);
+    }
+    
+    void filter(const RegisteredStructureSet& other);
+    void filter(const StructureAbstractValue& other);
+    
+    ALWAYS_INLINE void filter(SpeculatedType type)
+    {
+        if (!(type & SpecCell)) {
+            clear();
+            return;
+        }
+        if (isNeitherClearNorTop())
+            filterSlow(type);
+    }
+
+    ALWAYS_INLINE void filterClassInfo(const ClassInfo* classInfo)
+    {
+        if (isNeitherClearNorTop())
+            filterClassInfoSlow(classInfo);
+    }
+    
+    ALWAYS_INLINE bool operator==(const StructureAbstractValue& other) const
+    {
+        if ((m_set.isThin() && other.m_set.isThin()) || isTop() || other.isTop())
+            return m_set.m_pointer == other.m_set.m_pointer;
+        
+        return equalsSlow(other);
+    }
+    
+    const RegisteredStructureSet& set() const
+    {
+        ASSERT(!isTop());
+        return m_set;
+    }
+
+    StructureSet toStructureSet() const
+    {
+        RELEASE_ASSERT(isFinite());
+        return m_set.toStructureSet();
+    }
+    
+    size_t size() const
+    {
+        ASSERT(!isTop());
+        return m_set.size();
+    }
+    
+    RegisteredStructure at(size_t i) const
+    {
+        ASSERT(!isTop());
+        return m_set.at(i);
+    }
+    
+    RegisteredStructure operator[](size_t i) const { return at(i); }
+
+    // In most cases, what you really want to do is verify whether the set is top or clobbered, and
+    // if not, enumerate the set of structures. Use this only in cases where the singleton case is
+    // meaningfully special, like for transitions.
+    RegisteredStructure onlyStructure() const
+    {
+        if (isInfinite())
+            return RegisteredStructure();
+        return m_set.onlyStructure();
+    }
+
+    template<typename Functor>
+    void forEach(const Functor& functor) const
+    {
+        ASSERT(!isTop());
+        m_set.forEach(functor);
+    }
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+    
+    // The methods below are all conservative and err on the side of making 'this' appear bigger
+    // than it is. For example, contains() may return true if the set is clobbered or TOP.
+    // isSubsetOf() may return false in case of ambiguities. Therefore you should only perform
+    // optimizations as a consequence of the "this is smaller" return value - so false for
+    // contains(), true for isSubsetOf(), false for isSupersetOf(), and false for overlaps().
+
+    bool contains(RegisteredStructure) const;
+    bool contains(Structure* structure) const;
+    
+    bool isSubsetOf(const RegisteredStructureSet& other) const;
+    bool isSubsetOf(const StructureAbstractValue& other) const;
+    
+    bool isSupersetOf(const RegisteredStructureSet& other) const;
+    bool isSupersetOf(const StructureAbstractValue& other) const
+    {
+        return other.isSubsetOf(*this);
+    }
+    
+    bool overlaps(const RegisteredStructureSet& other) const;
+    bool overlaps(const StructureAbstractValue& other) const;
+
+    bool isSubClassOf(const ClassInfo*) const;
+    
+    void validateReferences(const TrackedReferences&) const;
+    
+private:
+    static const uintptr_t clobberedFlag = RegisteredStructureSet::reservedFlag;
+    static const uintptr_t topValue = RegisteredStructureSet::reservedValue;
+    static const unsigned polymorphismLimit = 10;
+    static const unsigned clobberedSupremacyThreshold = 2;
+    
+    void filterSlow(SpeculatedType type);
+    void filterClassInfoSlow(const ClassInfo*);
+    bool mergeSlow(const StructureAbstractValue& other);
+    
+    bool equalsSlow(const StructureAbstractValue& other) const;
+    
+    void makeTopWhenThin()
+    {
+        ASSERT(m_set.isThin());
+        m_set.m_pointer = topValue;
+    }
+    
+    bool mergeNotTop(const RegisteredStructureSet& other);
+    
+    void setClobbered(bool clobbered)
+    {
+        ASSERT(!isTop() || !clobbered);
+        m_set.setReservedFlag(clobbered);
+    }
+    
+    RegisteredStructureSet m_set;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGStructureClobberState.h b/dfg/DFGStructureClobberState.h
new file mode 100644
index 0000000..ea8f51b
--- /dev/null
+++ b/dfg/DFGStructureClobberState.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+enum StructureClobberState {
+    StructuresAreWatched, // Constants with watchable structures must have those structures.
+    StructuresAreClobbered // Constants with watchable structures could have any structure.
+};
+
+inline StructureClobberState merge(StructureClobberState a, StructureClobberState b)
+{
+    switch (a) {
+    case StructuresAreWatched:
+        return b;
+    case StructuresAreClobbered:
+        return StructuresAreClobbered;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return StructuresAreClobbered;
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::DFG::StructureClobberState state)
+{
+    switch (state) {
+    case JSC::DFG::StructuresAreWatched:
+        out.print("StructuresAreWatched");
+        return;
+    case JSC::DFG::StructuresAreClobbered:
+        out.print("StructuresAreClobbered");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGThreadData.cpp b/dfg/DFGThreadData.cpp
new file mode 100644
index 0000000..3d75570
--- /dev/null
+++ b/dfg/DFGThreadData.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGThreadData.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+ThreadData::ThreadData(Worklist* worklist)
+    : m_worklist(worklist)
+    , m_safepoint(nullptr)
+{
+}
+
+ThreadData::~ThreadData()
+{
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGThreadData.h b/dfg/DFGThreadData.h
new file mode 100644
index 0000000..37df9bd
--- /dev/null
+++ b/dfg/DFGThreadData.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/AutomaticThread.h>
+#include <wtf/Lock.h>
+
+namespace JSC { namespace DFG {
+
+class Safepoint;
+class Worklist;
+
+class ThreadData {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ThreadData(Worklist*);
+    ~ThreadData();
+    
+private:
+    friend class Safepoint;
+    friend class Worklist;
+    
+    Worklist* m_worklist;
+    RefPtr<AutomaticThread> m_thread;
+    Lock m_rightToRun;
+    Safepoint* m_safepoint;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGThunks.cpp b/dfg/DFGThunks.cpp
new file mode 100644
index 0000000..38bdd11
--- /dev/null
+++ b/dfg/DFGThunks.cpp
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2011, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGThunks.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CCallHelpers.h"
+#include "DFGOSRExitCompiler.h"
+#include "DFGJITCode.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "LinkBuffer.h"
+#include "MacroAssembler.h"
+#include "JSCInlines.h"
+#include "DFGOSRExitCompilerCommon.h"
+
+namespace JSC { namespace DFG {
+
+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM* vm)
+{
+    MacroAssembler jit;
+
+    // This needs to happen before we use the scratch buffer because this function also uses the scratch buffer.
+    adjustFrameAndStackInOSRExitCompilerThunk<DFG::JITCode>(jit, vm, JITCode::DFGJIT);
+    
+    size_t scratchSize = sizeof(EncodedJSValue) * (GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters);
+    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(scratchSize);
+    EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
+    
+    for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
+#if USE(JSVALUE64)
+        jit.store64(GPRInfo::toRegister(i), buffer + i);
+#else
+        jit.store32(GPRInfo::toRegister(i), buffer + i);
+#endif
+    }
+    for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
+        jit.move(MacroAssembler::TrustedImmPtr(buffer + GPRInfo::numberOfRegisters + i), GPRInfo::regT0);
+        jit.storeDouble(FPRInfo::toRegister(i), MacroAssembler::Address(GPRInfo::regT0));
+    }
+    
+    // Tell GC mark phase how much of the scratch buffer is active during call.
+    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT0);
+    jit.storePtr(MacroAssembler::TrustedImmPtr(scratchSize), MacroAssembler::Address(GPRInfo::regT0));
+
+    // Set up one argument.
+#if CPU(X86)
+    jit.poke(GPRInfo::callFrameRegister, 0);
+#else
+    jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+#endif
+
+    MacroAssembler::Call functionCall = jit.call();
+
+    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT0);
+    jit.storePtr(MacroAssembler::TrustedImmPtr(0), MacroAssembler::Address(GPRInfo::regT0));
+
+    for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
+        jit.move(MacroAssembler::TrustedImmPtr(buffer + GPRInfo::numberOfRegisters + i), GPRInfo::regT0);
+        jit.loadDouble(MacroAssembler::Address(GPRInfo::regT0), FPRInfo::toRegister(i));
+    }
+    for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
+#if USE(JSVALUE64)
+        jit.load64(buffer + i, GPRInfo::toRegister(i));
+#else
+        jit.load32(buffer + i, GPRInfo::toRegister(i));
+#endif
+    }
+    
+    jit.jump(MacroAssembler::AbsoluteAddress(&vm->osrExitJumpDestination));
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    
+    patchBuffer.link(functionCall, compileOSRExit);
+    
+    return FINALIZE_CODE(patchBuffer, ("DFG OSR exit generation thunk"));
+}
+
+MacroAssemblerCodeRef osrEntryThunkGenerator(VM* vm)
+{
+    AssemblyHelpers jit(vm, nullptr);
+
+    // We get passed the address of a scratch buffer. The first 8-byte slot of the buffer
+    // is the frame size. The second 8-byte slot is the pointer to where we are supposed to
+    // jump. The remaining bytes are the new call frame header followed by the locals.
+    
+    ptrdiff_t offsetOfFrameSize = 0; // This is the DFG frame count.
+    ptrdiff_t offsetOfTargetPC = offsetOfFrameSize + sizeof(EncodedJSValue);
+    ptrdiff_t offsetOfPayload = offsetOfTargetPC + sizeof(EncodedJSValue);
+    ptrdiff_t offsetOfLocals = offsetOfPayload + sizeof(Register) * CallFrame::headerSizeInRegisters;
+    
+    jit.move(GPRInfo::returnValueGPR2, GPRInfo::regT0);
+    jit.loadPtr(MacroAssembler::Address(GPRInfo::regT0, offsetOfFrameSize), GPRInfo::regT1); // Load the frame size.
+    jit.move(GPRInfo::regT1, GPRInfo::regT2);
+    jit.lshiftPtr(MacroAssembler::Imm32(3), GPRInfo::regT2);
+    jit.move(GPRInfo::callFrameRegister, MacroAssembler::stackPointerRegister);
+    jit.subPtr(GPRInfo::regT2, MacroAssembler::stackPointerRegister);
+    
+    MacroAssembler::Label loop = jit.label();
+    jit.subPtr(MacroAssembler::TrustedImm32(1), GPRInfo::regT1);
+    jit.move(GPRInfo::regT1, GPRInfo::regT4);
+    jit.negPtr(GPRInfo::regT4);
+    jit.load32(MacroAssembler::BaseIndex(GPRInfo::regT0, GPRInfo::regT1, MacroAssembler::TimesEight, offsetOfLocals), GPRInfo::regT2);
+    jit.load32(MacroAssembler::BaseIndex(GPRInfo::regT0, GPRInfo::regT1, MacroAssembler::TimesEight, offsetOfLocals + sizeof(int32_t)), GPRInfo::regT3);
+    jit.store32(GPRInfo::regT2, MacroAssembler::BaseIndex(GPRInfo::callFrameRegister, GPRInfo::regT4, MacroAssembler::TimesEight, -static_cast<intptr_t>(sizeof(Register))));
+    jit.store32(GPRInfo::regT3, MacroAssembler::BaseIndex(GPRInfo::callFrameRegister, GPRInfo::regT4, MacroAssembler::TimesEight, -static_cast<intptr_t>(sizeof(Register)) + static_cast<intptr_t>(sizeof(int32_t))));
+    jit.branchPtr(MacroAssembler::NotEqual, GPRInfo::regT1, MacroAssembler::TrustedImmPtr(bitwise_cast<void*>(-static_cast<intptr_t>(CallFrame::headerSizeInRegisters)))).linkTo(loop, &jit);
+    
+    jit.loadPtr(MacroAssembler::Address(GPRInfo::regT0, offsetOfTargetPC), GPRInfo::regT1);
+    MacroAssembler::Jump ok = jit.branchPtr(MacroAssembler::Above, GPRInfo::regT1, MacroAssembler::TrustedImmPtr(bitwise_cast<void*>(static_cast<intptr_t>(1000))));
+    jit.abortWithReason(DFGUnreasonableOSREntryJumpDestination);
+
+    ok.link(&jit);
+    jit.restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer();
+    jit.emitMaterializeTagCheckRegisters();
+
+    jit.jump(GPRInfo::regT1);
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("DFG OSR entry thunk"));
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGThunks.h b/dfg/DFGThunks.h
new file mode 100644
index 0000000..58a33da
--- /dev/null
+++ b/dfg/DFGThunks.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+class VM;
+
+namespace DFG {
+
+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM*);
+MacroAssemblerCodeRef osrEntryThunkGenerator(VM*);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGTierUpCheckInjectionPhase.cpp b/dfg/DFGTierUpCheckInjectionPhase.cpp
new file mode 100644
index 0000000..cf88283
--- /dev/null
+++ b/dfg/DFGTierUpCheckInjectionPhase.cpp
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGTierUpCheckInjectionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGNaturalLoops.h"
+#include "DFGPhase.h"
+#include "FTLCapabilities.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class TierUpCheckInjectionPhase : public Phase {
+public:
+    TierUpCheckInjectionPhase(Graph& graph)
+        : Phase(graph, "tier-up check injection")
+    {
+    }
+    
+    bool run()
+    {
+        RELEASE_ASSERT(m_graph.m_plan.mode == DFGMode);
+        
+        if (!Options::useFTLJIT())
+            return false;
+        
+        if (m_graph.m_profiledBlock->m_didFailFTLCompilation)
+            return false;
+
+        if (!Options::bytecodeRangeToFTLCompile().isInRange(m_graph.m_profiledBlock->instructionCount()))
+            return false;
+
+#if ENABLE(FTL_JIT)
+        FTL::CapabilityLevel level = FTL::canCompile(m_graph);
+        if (level == FTL::CannotCompile)
+            return false;
+        
+        if (!Options::useOSREntryToFTL())
+            level = FTL::CanCompile;
+        
+        m_graph.ensureNaturalLoops();
+        NaturalLoops& naturalLoops = *m_graph.m_naturalLoops;
+        HashMap<const NaturalLoop*, unsigned> naturalLoopToLoopHint = buildNaturalLoopToLoopHintMap(naturalLoops);
+
+        HashMap<unsigned, LoopHintDescriptor> tierUpHierarchy;
+
+        InsertionSet insertionSet(m_graph);
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                if (node->op() != LoopHint)
+                    continue;
+
+                NodeOrigin origin = node->origin;
+                bool canOSREnter = canOSREnterAtLoopHint(level, block, nodeIndex);
+
+                NodeType tierUpType = CheckTierUpAndOSREnter;
+                if (!canOSREnter)
+                    tierUpType = CheckTierUpInLoop;
+                insertionSet.insertNode(nodeIndex + 1, SpecNone, tierUpType, origin);
+
+                unsigned bytecodeIndex = origin.semantic.bytecodeIndex;
+                if (canOSREnter)
+                    m_graph.m_plan.tierUpAndOSREnterBytecodes.append(bytecodeIndex);
+
+                if (const NaturalLoop* loop = naturalLoops.innerMostLoopOf(block)) {
+                    LoopHintDescriptor descriptor;
+                    descriptor.canOSREnter = canOSREnter;
+
+                    const NaturalLoop* outerLoop = loop;
+                    while ((outerLoop = naturalLoops.innerMostOuterLoop(*outerLoop))) {
+                        auto it = naturalLoopToLoopHint.find(outerLoop);
+                        if (it != naturalLoopToLoopHint.end())
+                            descriptor.osrEntryCandidates.append(it->value);
+                    }
+                    if (!descriptor.osrEntryCandidates.isEmpty())
+                        tierUpHierarchy.add(bytecodeIndex, WTFMove(descriptor));
+                }
+                break;
+            }
+
+            NodeAndIndex terminal = block->findTerminal();
+            if (terminal.node->isFunctionTerminal()) {
+                insertionSet.insertNode(
+                    terminal.index, SpecNone, CheckTierUpAtReturn, terminal.node->origin);
+            }
+
+            insertionSet.execute(block);
+        }
+
+        // Add all the candidates that can be OSR Entered.
+        for (auto entry : tierUpHierarchy) {
+            Vector<unsigned> tierUpCandidates;
+            for (unsigned bytecodeIndex : entry.value.osrEntryCandidates) {
+                auto descriptorIt = tierUpHierarchy.find(bytecodeIndex);
+                if (descriptorIt != tierUpHierarchy.end()
+                    && descriptorIt->value.canOSREnter)
+                    tierUpCandidates.append(bytecodeIndex);
+            }
+
+            if (!tierUpCandidates.isEmpty())
+                m_graph.m_plan.tierUpInLoopHierarchy.add(entry.key, WTFMove(tierUpCandidates));
+        }
+        m_graph.m_plan.willTryToTierUp = true;
+        return true;
+#else // ENABLE(FTL_JIT)
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+#endif // ENABLE(FTL_JIT)
+    }
+
+private:
+#if ENABLE(FTL_JIT)
+    struct LoopHintDescriptor {
+        Vector<unsigned> osrEntryCandidates;
+        bool canOSREnter;
+    };
+
+    bool canOSREnterAtLoopHint(FTL::CapabilityLevel level, const BasicBlock* block, unsigned nodeIndex)
+    {
+        Node* node = block->at(nodeIndex);
+        ASSERT(node->op() == LoopHint);
+
+        NodeOrigin origin = node->origin;
+        if (level != FTL::CanCompileAndOSREnter || origin.semantic.inlineCallFrame)
+            return false;
+
+        // We only put OSR checks for the first LoopHint in the block. Note that
+        // more than one LoopHint could happen in cases where we did a lot of CFG
+        // simplification in the bytecode parser, but it should be very rare.
+        for (unsigned subNodeIndex = nodeIndex; subNodeIndex--;) {
+            if (!block->at(subNodeIndex)->isSemanticallySkippable())
+                return false;
+        }
+        return true;
+    }
+
+    HashMap<const NaturalLoop*, unsigned> buildNaturalLoopToLoopHintMap(const NaturalLoops& naturalLoops)
+    {
+        HashMap<const NaturalLoop*, unsigned> naturalLoopsToLoopHint;
+
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                if (node->op() != LoopHint)
+                    continue;
+
+                if (const NaturalLoop* loop = naturalLoops.innerMostLoopOf(block)) {
+                    unsigned bytecodeIndex = node->origin.semantic.bytecodeIndex;
+                    naturalLoopsToLoopHint.add(loop, bytecodeIndex);
+                }
+                break;
+            }
+        }
+        return naturalLoopsToLoopHint;
+    }
+#endif
+};
+
+bool performTierUpCheckInjection(Graph& graph)
+{
+    return runPhase<TierUpCheckInjectionPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGTierUpCheckInjectionPhase.h b/dfg/DFGTierUpCheckInjectionPhase.h
new file mode 100644
index 0000000..7e1e6cb
--- /dev/null
+++ b/dfg/DFGTierUpCheckInjectionPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// This phase checks if the this code block could be recompiled with the FTL,
+// and if so, it injects tier-up checks.
+
+bool performTierUpCheckInjection(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGToFTLDeferredCompilationCallback.cpp b/dfg/DFGToFTLDeferredCompilationCallback.cpp
new file mode 100644
index 0000000..10815fe
--- /dev/null
+++ b/dfg/DFGToFTLDeferredCompilationCallback.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGToFTLDeferredCompilationCallback.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "CodeBlock.h"
+#include "DFGJITCode.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+ToFTLDeferredCompilationCallback::ToFTLDeferredCompilationCallback()
+{
+}
+
+ToFTLDeferredCompilationCallback::~ToFTLDeferredCompilationCallback() { }
+
+Ref<ToFTLDeferredCompilationCallback> ToFTLDeferredCompilationCallback::create()
+{
+    return adoptRef(*new ToFTLDeferredCompilationCallback());
+}
+
+void ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously(
+    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock)
+{
+    if (Options::verboseOSR()) {
+        dataLog(
+            "Optimizing compilation of ", *codeBlock, " (for ", *profiledDFGCodeBlock,
+            ") did become ready.\n");
+    }
+    
+    profiledDFGCodeBlock->jitCode()->dfg()->forceOptimizationSlowPathConcurrently(
+        profiledDFGCodeBlock);
+}
+
+void ToFTLDeferredCompilationCallback::compilationDidComplete(
+    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationResult result)
+{
+    if (Options::verboseOSR()) {
+        dataLog(
+            "Optimizing compilation of ", *codeBlock, " (for ", *profiledDFGCodeBlock,
+            ") result: ", result, "\n");
+    }
+    
+    if (profiledDFGCodeBlock->replacement() != profiledDFGCodeBlock) {
+        if (Options::verboseOSR()) {
+            dataLog(
+                "Dropping FTL code block ", *codeBlock, " on the floor because the "
+                "DFG code block ", *profiledDFGCodeBlock, " was jettisoned.\n");
+        }
+        return;
+    }
+    
+    if (result == CompilationSuccessful)
+        codeBlock->ownerScriptExecutable()->installCode(codeBlock);
+    
+    profiledDFGCodeBlock->jitCode()->dfg()->setOptimizationThresholdBasedOnCompilationResult(
+        profiledDFGCodeBlock, result);
+
+    DeferredCompilationCallback::compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
+}
+
+} } // JSC::DFG
+
+#endif // ENABLE(FTL_JIT)
diff --git a/dfg/DFGToFTLDeferredCompilationCallback.h b/dfg/DFGToFTLDeferredCompilationCallback.h
new file mode 100644
index 0000000..aa2dc07
--- /dev/null
+++ b/dfg/DFGToFTLDeferredCompilationCallback.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DeferredCompilationCallback.h"
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+class ScriptExecutable;
+
+namespace DFG {
+
+class ToFTLDeferredCompilationCallback : public DeferredCompilationCallback {
+protected:
+    ToFTLDeferredCompilationCallback();
+
+public:
+    virtual ~ToFTLDeferredCompilationCallback();
+
+    static Ref<ToFTLDeferredCompilationCallback> create();
+    
+    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*, CodeBlock* profiledDFGCodeBlock);
+    virtual void compilationDidComplete(CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationResult);
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(FTL_JIT)
diff --git a/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp b/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp
new file mode 100644
index 0000000..ae81542
--- /dev/null
+++ b/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGToFTLForOSREntryDeferredCompilationCallback.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "CodeBlock.h"
+#include "DFGJITCode.h"
+#include "FTLForOSREntryJITCode.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback(JITCode::TriggerReason* forcedOSREntryTrigger)
+    : m_forcedOSREntryTrigger(forcedOSREntryTrigger)
+{
+}
+
+ToFTLForOSREntryDeferredCompilationCallback::~ToFTLForOSREntryDeferredCompilationCallback()
+{
+}
+
+Ref<ToFTLForOSREntryDeferredCompilationCallback>ToFTLForOSREntryDeferredCompilationCallback::create(JITCode::TriggerReason* forcedOSREntryTrigger)
+{
+    return adoptRef(*new ToFTLForOSREntryDeferredCompilationCallback(forcedOSREntryTrigger));
+}
+
+void ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously(
+    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock)
+{
+    if (Options::verboseOSR()) {
+        dataLog(
+            "Optimizing compilation of ", *codeBlock, " (for ", *profiledDFGCodeBlock,
+            ") did become ready.\n");
+    }
+
+    *m_forcedOSREntryTrigger = JITCode::TriggerReason::CompilationDone;
+}
+
+void ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete(
+    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationResult result)
+{
+    if (Options::verboseOSR()) {
+        dataLog(
+            "Optimizing compilation of ", *codeBlock, " (for ", *profiledDFGCodeBlock,
+            ") result: ", result, "\n");
+    }
+    
+    JITCode* jitCode = profiledDFGCodeBlock->jitCode()->dfg();
+        
+    switch (result) {
+    case CompilationSuccessful: {
+        jitCode->setOSREntryBlock(*codeBlock->vm(), profiledDFGCodeBlock, codeBlock);
+        unsigned osrEntryBytecode = codeBlock->jitCode()->ftlForOSREntry()->bytecodeIndex();
+        jitCode->tierUpEntryTriggers.set(osrEntryBytecode, JITCode::TriggerReason::CompilationDone);
+        break;
+    }
+    case CompilationFailed:
+        jitCode->osrEntryRetry = 0;
+        jitCode->abandonOSREntry = true;
+        profiledDFGCodeBlock->jitCode()->dfg()->setOptimizationThresholdBasedOnCompilationResult(
+            profiledDFGCodeBlock, result);
+        break;
+    case CompilationDeferred:
+        RELEASE_ASSERT_NOT_REACHED();
+    case CompilationInvalidated:
+        jitCode->osrEntryRetry = 0;
+        break;
+    }
+    
+    DeferredCompilationCallback::compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
+}
+
+} } // JSC::DFG
+
+#endif // ENABLE(FTL_JIT)
diff --git a/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h b/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h
new file mode 100644
index 0000000..ffac65b
--- /dev/null
+++ b/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGJITCode.h"
+#include "DeferredCompilationCallback.h"
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+class ScriptExecutable;
+
+namespace DFG {
+
+class ToFTLForOSREntryDeferredCompilationCallback : public DeferredCompilationCallback {
+protected:
+    ToFTLForOSREntryDeferredCompilationCallback(JITCode::TriggerReason* forcedOSREntryTrigger);
+
+public:
+    virtual ~ToFTLForOSREntryDeferredCompilationCallback();
+
+    static Ref<ToFTLForOSREntryDeferredCompilationCallback> create(JITCode::TriggerReason* forcedOSREntryTrigger);
+    
+    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*, CodeBlock* profiledDFGCodeBlock);
+    virtual void compilationDidComplete(CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationResult);
+
+private:
+    JITCode::TriggerReason* m_forcedOSREntryTrigger;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(FTL_JIT)
diff --git a/dfg/DFGTransition.cpp b/dfg/DFGTransition.cpp
new file mode 100644
index 0000000..a54ec34
--- /dev/null
+++ b/dfg/DFGTransition.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGTransition.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void Transition::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    out.print(pointerDumpInContext(previous.get(), context), " -> ", pointerDumpInContext(next.get(), context));
+}
+
+void Transition::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGTransition.h b/dfg/DFGTransition.h
new file mode 100644
index 0000000..8d01e11
--- /dev/null
+++ b/dfg/DFGTransition.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGRegisteredStructure.h"
+#include <wtf/PrintStream.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class Structure;
+struct DumpContext;
+
+namespace DFG {
+
+struct Transition {
+    RegisteredStructure previous;
+    RegisteredStructure next;
+    
+    Transition() = default;
+    
+    Transition(RegisteredStructure previous, RegisteredStructure next)
+        : previous(previous)
+        , next(next)
+    {
+    }
+    
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dump(PrintStream&) const;
+};
+
+typedef Vector<Transition, 3> TransitionVector;
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGTypeCheckHoistingPhase.cpp b/dfg/DFGTypeCheckHoistingPhase.cpp
new file mode 100644
index 0000000..9b222dd
--- /dev/null
+++ b/dfg/DFGTypeCheckHoistingPhase.cpp
@@ -0,0 +1,593 @@
+/*
+ * Copyright (C) 2012, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGTypeCheckHoistingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlock.h"
+#include "DFGGraph.h"
+#include "DFGInsertionSet.h"
+#include "DFGPhase.h"
+#include "DFGVariableAccessDataDump.h"
+#include "JSCInlines.h"
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace DFG {
+
+enum CheckBallot { VoteOther, VoteStructureCheck = 1, VoteCheckArray = 1 };
+
+struct ArrayTypeCheck;
+struct StructureTypeCheck;
+
+struct CheckData {
+    Structure* m_structure;
+    ArrayMode m_arrayMode;
+    bool m_arrayModeIsValid;
+    bool m_arrayModeHoistingOkay;
+    
+    CheckData()
+        : m_structure(0)
+        , m_arrayModeIsValid(false)
+        , m_arrayModeHoistingOkay(false)
+    {
+    }
+    
+    CheckData(Structure* structure)
+        : m_structure(structure)
+        , m_arrayModeIsValid(false)
+        , m_arrayModeHoistingOkay(true)
+    {
+    }
+
+    CheckData(ArrayMode arrayMode)
+        : m_structure(0)
+        , m_arrayMode(arrayMode)
+        , m_arrayModeIsValid(true)
+        , m_arrayModeHoistingOkay(true)
+    {
+    }
+
+    void disableCheckArrayHoisting()
+    {
+        m_arrayModeIsValid = false;
+        m_arrayModeHoistingOkay = false;
+    }
+};
+    
+class TypeCheckHoistingPhase : public Phase {
+public:
+    TypeCheckHoistingPhase(Graph& graph)
+        : Phase(graph, "structure check hoisting")
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == ThreadedCPS);
+        
+        clearVariableVotes();
+        identifyRedundantStructureChecks();
+        disableHoistingForVariablesWithInsufficientVotes<StructureTypeCheck>();
+
+        clearVariableVotes();
+        identifyRedundantArrayChecks();
+        disableHoistingForVariablesWithInsufficientVotes<ArrayTypeCheck>();
+
+        disableHoistingAcrossOSREntries<StructureTypeCheck>();
+        disableHoistingAcrossOSREntries<ArrayTypeCheck>();
+
+        bool changed = false;
+
+        // Place CheckStructure's at SetLocal sites.
+        InsertionSet insertionSet(m_graph);
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            unsigned indexForChecks = UINT_MAX;
+            NodeOrigin originForChecks;
+            for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+                Node* node = block->at(indexInBlock);
+                
+                if (node->origin.exitOK) {
+                    indexForChecks = indexInBlock;
+                    originForChecks = node->origin;
+                }
+                
+                // Be careful not to use 'node' after appending to the graph. In those switch
+                // cases where we need to append, we first carefully extract everything we need
+                // from the node, before doing any appending.
+                switch (node->op()) {
+                case SetArgument: {
+                    // Insert a GetLocal and a CheckStructure immediately following this
+                    // SetArgument, if the variable was a candidate for structure hoisting.
+                    // If the basic block previously only had the SetArgument as its
+                    // variable-at-tail, then replace it with this GetLocal.
+                    VariableAccessData* variable = node->variableAccessData();
+                    HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+                    if (iter == m_map.end())
+                        break;
+                    if (!iter->value.m_structure && !iter->value.m_arrayModeIsValid)
+                        break;
+
+                    // Currently we should only be doing this hoisting for SetArguments at the prologue.
+                    ASSERT(!blockIndex);
+
+                    NodeOrigin origin = node->origin;
+                    
+                    Node* getLocal = insertionSet.insertNode(
+                        indexInBlock + 1, variable->prediction(), GetLocal, origin,
+                        OpInfo(variable), Edge(node));
+                    if (iter->value.m_structure) {
+                        insertionSet.insertNode(
+                            indexInBlock + 1, SpecNone, CheckStructure, origin,
+                            OpInfo(m_graph.addStructureSet(iter->value.m_structure)),
+                            Edge(getLocal, CellUse));
+                    } else if (iter->value.m_arrayModeIsValid) {
+                        ASSERT(iter->value.m_arrayModeHoistingOkay);
+                        insertionSet.insertNode(
+                            indexInBlock + 1, SpecNone, CheckArray, origin,
+                            OpInfo(iter->value.m_arrayMode.asWord()),
+                            Edge(getLocal, CellUse));
+                    } else
+                        RELEASE_ASSERT_NOT_REACHED();
+
+                    if (block->variablesAtTail.operand(variable->local()) == node)
+                        block->variablesAtTail.operand(variable->local()) = getLocal;
+                    
+                    m_graph.substituteGetLocal(*block, indexInBlock, variable, getLocal);
+                    
+                    changed = true;
+                    break;
+                }
+                    
+                case SetLocal: {
+                    VariableAccessData* variable = node->variableAccessData();
+                    HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+                    if (iter == m_map.end())
+                        break;
+                    if (!iter->value.m_structure && !iter->value.m_arrayModeIsValid)
+                        break;
+
+                    NodeOrigin origin = node->origin;
+                    Edge child1 = node->child1();
+                    
+                    if (iter->value.m_structure) {
+                        insertionSet.insertNode(
+                            indexForChecks, SpecNone, CheckStructure,
+                            originForChecks.withSemantic(origin.semantic),
+                            OpInfo(m_graph.addStructureSet(iter->value.m_structure)),
+                            Edge(child1.node(), CellUse));
+                    } else if (iter->value.m_arrayModeIsValid) {
+                        ASSERT(iter->value.m_arrayModeHoistingOkay);
+                        insertionSet.insertNode(
+                            indexForChecks, SpecNone, CheckArray,
+                            originForChecks.withSemantic(origin.semantic),
+                            OpInfo(iter->value.m_arrayMode.asWord()),
+                            Edge(child1.node(), CellUse));
+                    } else
+                        RELEASE_ASSERT_NOT_REACHED();
+                    changed = true;
+                    break;
+                }
+                    
+                default:
+                    break;
+                }
+            }
+            insertionSet.execute(block);
+        }
+        
+        return changed;
+    }
+
+private:
+    void clearVariableVotes()
+    { 
+        for (unsigned i = m_graph.m_variableAccessData.size(); i--;) {
+            VariableAccessData* variable = &m_graph.m_variableAccessData[i];
+            if (!variable->isRoot())
+                continue;
+            variable->clearVotes();
+        }
+    }
+        
+    // Identify the set of variables that are always subject to the same structure
+    // checks. For now, only consider monomorphic structure checks (one structure).
+    void identifyRedundantStructureChecks()
+    {    
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+                Node* node = block->at(indexInBlock);
+                switch (node->op()) {
+                case CheckStructure: {
+                    Node* child = node->child1().node();
+                    if (child->op() != GetLocal)
+                        break;
+                    VariableAccessData* variable = child->variableAccessData();
+                    variable->vote(VoteStructureCheck);
+                    if (!shouldConsiderForHoisting<StructureTypeCheck>(variable))
+                        break;
+                    noticeStructureCheck(variable, node->structureSet());
+                    break;
+                }
+
+                case ArrayifyToStructure:
+                case Arrayify:
+                case GetByOffset:
+                case PutByOffset:
+                case PutStructure:
+                case AllocatePropertyStorage:
+                case ReallocatePropertyStorage:
+                case NukeStructureAndSetButterfly:
+                case GetButterfly:
+                case GetByVal:
+                case PutByValDirect:
+                case PutByVal:
+                case PutByValAlias:
+                case GetArrayLength:
+                case CheckArray:
+                case GetIndexedPropertyStorage:
+                case GetTypedArrayByteOffset:
+                case Phantom:
+                case MovHint:
+                case MultiGetByOffset:
+                case MultiPutByOffset:
+                    // Don't count these uses.
+                    break;
+                    
+                case SetLocal: {
+                    // Find all uses of the source of the SetLocal. If any of them are a
+                    // kind of CheckStructure, then we should notice them to ensure that
+                    // we're not hoisting a check that would contravene checks that are
+                    // already being performed.
+                    VariableAccessData* variable = node->variableAccessData();
+                    if (!shouldConsiderForHoisting<StructureTypeCheck>(variable))
+                        break;
+                    Node* source = node->child1().node();
+                    for (unsigned subIndexInBlock = 0; subIndexInBlock < block->size(); ++subIndexInBlock) {
+                        Node* subNode = block->at(subIndexInBlock);
+                        switch (subNode->op()) {
+                        case CheckStructure: {
+                            if (subNode->child1() != source)
+                                break;
+                            
+                            noticeStructureCheck(variable, subNode->structureSet());
+                            break;
+                        }
+                        default:
+                            break;
+                        }
+                    }
+                    
+                    m_graph.voteChildren(node, VoteOther);
+                    break;
+                }
+                    
+                default:
+                    m_graph.voteChildren(node, VoteOther);
+                    break;
+                }
+            }
+        }
+    }
+        
+    void identifyRedundantArrayChecks()
+    {
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+                Node* node = block->at(indexInBlock);
+                switch (node->op()) {
+                case CheckArray: {
+                    Node* child = node->child1().node();
+                    if (child->op() != GetLocal)
+                        break;
+                    VariableAccessData* variable = child->variableAccessData();
+                    variable->vote(VoteCheckArray);
+                    if (!shouldConsiderForHoisting<ArrayTypeCheck>(variable))
+                        break;
+                    noticeCheckArray(variable, node->arrayMode());
+                    break;
+                }
+
+                case CheckStructure:
+                case GetByOffset:
+                case PutByOffset:
+                case PutStructure:
+                case ReallocatePropertyStorage:
+                case GetButterfly:
+                case GetByVal:
+                case PutByValDirect:
+                case PutByVal:
+                case PutByValAlias:
+                case GetArrayLength:
+                case GetIndexedPropertyStorage:
+                case Phantom:
+                case MovHint:
+                case MultiGetByOffset:
+                case MultiPutByOffset:
+                    // Don't count these uses.
+                    break;
+                    
+                case AllocatePropertyStorage:
+                case ArrayifyToStructure:
+                case Arrayify: {
+                    // Any Arrayify could change our indexing type, so disable
+                    // all CheckArray hoisting.
+                    Node* child = node->child1().node();
+                    if (child->op() != GetLocal)
+                        break;
+                    VariableAccessData* variable = child->variableAccessData();
+                    variable->vote(VoteOther);
+                    if (!shouldConsiderForHoisting<ArrayTypeCheck>(variable))
+                        break;
+                    disableCheckArrayHoisting(variable);
+                    break;
+                }
+                    
+                case SetLocal: {
+                    // Find all uses of the source of the SetLocal. If any of them are a
+                    // kind of CheckStructure, then we should notice them to ensure that
+                    // we're not hoisting a check that would contravene checks that are
+                    // already being performed.
+                    VariableAccessData* variable = node->variableAccessData();
+                    if (!shouldConsiderForHoisting<ArrayTypeCheck>(variable))
+                        break;
+                    Node* source = node->child1().node();
+                    for (unsigned subIndexInBlock = 0; subIndexInBlock < block->size(); ++subIndexInBlock) {
+                        Node* subNode = block->at(subIndexInBlock);
+                        switch (subNode->op()) {
+                        case CheckStructure: {
+                            if (subNode->child1() != source)
+                                break;
+                            
+                            noticeStructureCheckAccountingForArrayMode(variable, subNode->structureSet());
+                            break;
+                        }
+                        case CheckArray: {
+                            if (subNode->child1() != source)
+                                break;
+                            noticeCheckArray(variable, subNode->arrayMode());
+                            break;
+                        }
+                        default:
+                            break;
+                        }
+                    }
+                    
+                    m_graph.voteChildren(node, VoteOther);
+                    break;
+                }
+                    
+                default:
+                    m_graph.voteChildren(node, VoteOther);
+                    break;
+                }
+            }
+        }
+    }
+
+    // Disable hoisting on variables that appear to mostly be used in
+    // contexts where it doesn't make sense.
+    template <typename TypeCheck>
+    void disableHoistingForVariablesWithInsufficientVotes()
+    {    
+        for (unsigned i = m_graph.m_variableAccessData.size(); i--;) {
+            VariableAccessData* variable = &m_graph.m_variableAccessData[i];
+            if (!variable->isRoot())
+                continue;
+            if (TypeCheck::hasEnoughVotesToHoist(variable))
+                continue;
+            HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+            if (iter == m_map.end())
+                continue;
+            TypeCheck::disableHoisting(iter->value);
+        }
+    }
+
+    // Disable check hoisting for variables that cross the OSR entry that
+    // we're currently taking, and where the value currently does not have the
+    // particular form we want (e.g. a contradictory ArrayMode or Struture).
+    template <typename TypeCheck>
+    void disableHoistingAcrossOSREntries()
+    {
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            ASSERT(block->isReachable);
+            if (!block->isOSRTarget)
+                continue;
+            if (block->bytecodeBegin != m_graph.m_plan.osrEntryBytecodeIndex)
+                continue;
+            for (size_t i = 0; i < m_graph.m_plan.mustHandleValues.size(); ++i) {
+                int operand = m_graph.m_plan.mustHandleValues.operandForIndex(i);
+                Node* node = block->variablesAtHead.operand(operand);
+                if (!node)
+                    continue;
+                VariableAccessData* variable = node->variableAccessData();
+                HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+                if (iter == m_map.end())
+                    continue;
+                if (!TypeCheck::isValidToHoist(iter->value))
+                    continue;
+                JSValue value = m_graph.m_plan.mustHandleValues[i];
+                if (!value || !value.isCell() || TypeCheck::isContravenedByValue(iter->value, value)) {
+                    TypeCheck::disableHoisting(iter->value);
+                    continue;
+                }
+            }
+        }
+    }
+
+    void disableCheckArrayHoisting(VariableAccessData* variable)
+    {
+        HashMap<VariableAccessData*, CheckData>::AddResult result = m_map.add(variable, CheckData());
+        result.iterator->value.disableCheckArrayHoisting();
+    }
+
+    template <typename TypeCheck>
+    bool shouldConsiderForHoisting(VariableAccessData* variable)
+    {
+        if (!variable->shouldUnboxIfPossible())
+            return false;
+        if (TypeCheck::hoistingPreviouslyFailed(variable))
+            return false;
+        if (!isCellSpeculation(variable->prediction()))
+            return false;
+        return true;
+    }
+    
+    void noticeStructureCheck(VariableAccessData* variable, RegisteredStructure structure)
+    {
+        HashMap<VariableAccessData*, CheckData>::AddResult result = m_map.add(variable, CheckData(structure.get()));
+        if (result.isNewEntry)
+            return;
+        if (result.iterator->value.m_structure == structure.get())
+            return;
+        result.iterator->value.m_structure = 0;
+    }
+    
+    void noticeStructureCheck(VariableAccessData* variable, RegisteredStructureSet set)
+    {
+        if (set.size() != 1) {
+            noticeStructureCheck(variable, RegisteredStructure());
+            return;
+        }
+        noticeStructureCheck(variable, set.at(0));
+    }
+
+    void noticeCheckArray(VariableAccessData* variable, ArrayMode arrayMode)
+    {
+        HashMap<VariableAccessData*, CheckData>::AddResult result = m_map.add(variable, CheckData(arrayMode));
+        if (result.isNewEntry)
+            return;
+        if (!result.iterator->value.m_arrayModeHoistingOkay)
+            return;
+        if (result.iterator->value.m_arrayMode == arrayMode)
+            return;
+        if (!result.iterator->value.m_arrayModeIsValid) {
+            result.iterator->value.m_arrayMode = arrayMode;
+            result.iterator->value.m_arrayModeIsValid = true;
+            return;
+        }
+        result.iterator->value.disableCheckArrayHoisting();
+    }
+
+    void noticeStructureCheckAccountingForArrayMode(VariableAccessData* variable, RegisteredStructure structure)
+    {
+        HashMap<VariableAccessData*, CheckData>::iterator result = m_map.find(variable);
+        if (result == m_map.end())
+            return;
+        if (!result->value.m_arrayModeHoistingOkay || !result->value.m_arrayModeIsValid)
+            return;
+        if (result->value.m_arrayMode.structureWouldPassArrayModeFiltering(structure.get()))
+            return;
+        result->value.disableCheckArrayHoisting();
+    }
+
+    void noticeStructureCheckAccountingForArrayMode(VariableAccessData* variable, RegisteredStructureSet set)
+    {
+        for (unsigned i = 0; i < set.size(); i++)
+            noticeStructureCheckAccountingForArrayMode(variable, set.at(i));
+    }
+
+    HashMap<VariableAccessData*, CheckData> m_map;
+};
+
+bool performTypeCheckHoisting(Graph& graph)
+{
+    return runPhase<TypeCheckHoistingPhase>(graph);
+}
+
+struct ArrayTypeCheck {
+    static bool isValidToHoist(CheckData& checkData)
+    {
+        return checkData.m_arrayModeIsValid;
+    }
+
+    static void disableHoisting(CheckData& checkData)
+    {
+        checkData.disableCheckArrayHoisting();
+    }
+
+    static bool isContravenedByValue(CheckData& checkData, JSValue value)
+    {
+        ASSERT(value.isCell());
+        return !checkData.m_arrayMode.structureWouldPassArrayModeFiltering(value.asCell()->structure());
+    }
+
+    static bool hasEnoughVotesToHoist(VariableAccessData* variable)
+    {
+        return variable->voteRatio() >= Options::checkArrayVoteRatioForHoisting();
+    }
+
+    static bool hoistingPreviouslyFailed(VariableAccessData* variable)
+    {
+        return variable->checkArrayHoistingFailed();
+    }
+};
+
+struct StructureTypeCheck {
+    static bool isValidToHoist(CheckData& checkData)
+    {
+        return checkData.m_structure;
+    }
+
+    static void disableHoisting(CheckData& checkData)
+    {
+        checkData.m_structure = 0;
+    }
+
+    static bool isContravenedByValue(CheckData& checkData, JSValue value)
+    {
+        ASSERT(value.isCell());
+        return checkData.m_structure != value.asCell()->structure();
+    }
+
+    static bool hasEnoughVotesToHoist(VariableAccessData* variable)
+    {
+        return variable->voteRatio() >= Options::structureCheckVoteRatioForHoisting();
+    }
+
+    static bool hoistingPreviouslyFailed(VariableAccessData* variable)
+    {
+        return variable->structureCheckHoistingFailed();
+    }
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGTypeCheckHoistingPhase.h b/dfg/DFGTypeCheckHoistingPhase.h
new file mode 100644
index 0000000..4629eb8
--- /dev/null
+++ b/dfg/DFGTypeCheckHoistingPhase.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Hoists CheckStructure on variables to assignments to those variables, if either of
+// the following is true:
+// A) The structure's transition watchpoint set is valid.
+// B) The span of code within which the variable is live has no effects that might
+//    clobber the structure.
+
+bool performTypeCheckHoisting(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGUnificationPhase.cpp b/dfg/DFGUnificationPhase.cpp
new file mode 100644
index 0000000..74ddd4f
--- /dev/null
+++ b/dfg/DFGUnificationPhase.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGUnificationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class UnificationPhase : public Phase {
+public:
+    UnificationPhase(Graph& graph)
+        : Phase(graph, "unification")
+    {
+    }
+    
+    bool run()
+    {
+        ASSERT(m_graph.m_form == ThreadedCPS);
+        ASSERT(m_graph.m_unificationState == LocallyUnified);
+        
+        // Ensure that all Phi functions are unified.
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            ASSERT(block->isReachable);
+            
+            for (unsigned phiIndex = block->phis.size(); phiIndex--;) {
+                Node* phi = block->phis[phiIndex];
+                for (unsigned childIdx = 0; childIdx < AdjacencyList::Size; ++childIdx) {
+                    if (!phi->children.child(childIdx))
+                        break;
+
+                    // FIXME: Consider reversing the order of this unification, since the other
+                    // order will reveal more bugs. https://bugs.webkit.org/show_bug.cgi?id=154368
+                    phi->variableAccessData()->unify(phi->children.child(childIdx)->variableAccessData());
+                }
+            }
+        }
+        
+        // Ensure that all predictions are fixed up based on the unification.
+        for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
+            VariableAccessData* data = &m_graph.m_variableAccessData[i];
+            data->find()->predict(data->nonUnifiedPrediction());
+            data->find()->mergeStructureCheckHoistingFailed(data->structureCheckHoistingFailed());
+            data->find()->mergeCheckArrayHoistingFailed(data->checkArrayHoistingFailed());
+            data->find()->mergeShouldNeverUnbox(data->shouldNeverUnbox());
+            data->find()->mergeIsLoadedFrom(data->isLoadedFrom());
+            data->find()->mergeIsProfitableToUnbox(data->isProfitableToUnbox());
+        }
+        
+        m_graph.m_unificationState = GloballyUnified;
+        return true;
+    }
+};
+
+bool performUnification(Graph& graph)
+{
+    return runPhase<UnificationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGUnificationPhase.h b/dfg/DFGUnificationPhase.h
new file mode 100644
index 0000000..7c0b410
--- /dev/null
+++ b/dfg/DFGUnificationPhase.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Unification:
+//
+// Examines all Phi functions and ensures that the variable access datas are
+// unified. This creates our "live-range split" view of variables.
+
+bool performUnification(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGUseKind.cpp b/dfg/DFGUseKind.cpp
new file mode 100644
index 0000000..e83829b
--- /dev/null
+++ b/dfg/DFGUseKind.cpp
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGUseKind.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, UseKind useKind)
+{
+    switch (useKind) {
+    case UntypedUse:
+        out.print("Untyped");
+        return;
+    case Int32Use:
+        out.print("Int32");
+        return;
+    case KnownInt32Use:
+        out.print("KnownInt32");
+        return;
+    case Int52RepUse:
+        out.print("Int52Rep");
+        return;
+    case AnyIntUse:
+        out.print("AnyInt");
+        return;
+    case NumberUse:
+        out.print("Number");
+        return;
+    case RealNumberUse:
+        out.print("RealNumber");
+        return;
+    case DoubleRepUse:
+        out.print("DoubleRep");
+        return;
+    case DoubleRepRealUse:
+        out.print("DoubleRepReal");
+        return;
+    case DoubleRepAnyIntUse:
+        out.print("DoubleRepAnyInt");
+        return;
+    case BooleanUse:
+        out.print("Boolean");
+        return;
+    case KnownBooleanUse:
+        out.print("KnownBoolean");
+        return;
+    case CellUse:
+        out.print("Cell");
+        return;
+    case KnownCellUse:
+        out.print("KnownCell");
+        return;
+    case CellOrOtherUse:
+        out.print("CellOrOther");
+        return;
+    case ObjectUse:
+        out.print("Object");
+        return;
+    case ArrayUse:
+        out.print("Array");
+        return;
+    case FunctionUse:
+        out.print("Function");
+        return;
+    case FinalObjectUse:
+        out.print("FinalObject");
+        return;
+    case RegExpObjectUse:
+        out.print("RegExpObject");
+        return;
+    case ProxyObjectUse:
+        out.print("ProxyObject");
+        return;
+    case DerivedArrayUse:
+        out.print("DerivedArray");
+        return;
+    case MapObjectUse:
+        out.print("MapObjectUse");
+        return;
+    case SetObjectUse:
+        out.print("SetObjectUse");
+        return;
+    case ObjectOrOtherUse:
+        out.print("ObjectOrOther");
+        return;
+    case StringIdentUse:
+        out.print("StringIdent");
+        return;
+    case StringUse:
+        out.print("String");
+        return;
+    case StringOrOtherUse:
+        out.print("StringOrOther");
+        return;
+    case KnownStringUse:
+        out.print("KnownString");
+        return;
+    case KnownPrimitiveUse:
+        out.print("KnownPrimitive");
+        return;
+    case SymbolUse:
+        out.print("Symbol");
+        return;
+    case StringObjectUse:
+        out.print("StringObject");
+        return;
+    case StringOrStringObjectUse:
+        out.print("StringOrStringObject");
+        return;
+    case NotStringVarUse:
+        out.print("NotStringVar");
+        return;
+    case NotCellUse:
+        out.print("NotCell");
+        return;
+    case OtherUse:
+        out.print("Other");
+        return;
+    case MiscUse:
+        out.print("Misc");
+        return;
+    case LastUseKind:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGUseKind.h b/dfg/DFGUseKind.h
new file mode 100644
index 0000000..8f633a1
--- /dev/null
+++ b/dfg/DFGUseKind.h
@@ -0,0 +1,294 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNodeFlags.h"
+#include "SpeculatedType.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+enum UseKind {
+    // The DFG has 3 representations of values used:
+
+    // 1. The JSValue representation for a JSValue that must be stored in a GP
+    //    register (or a GP register pair), and follows rules for boxing and unboxing
+    //    that allow the JSValue to be stored as either fully boxed JSValues, or
+    //    unboxed Int32, Booleans, Cells, etc. in 32-bit as appropriate.
+    UntypedUse, // UntypedUse must come first (value 0).
+    Int32Use,
+    KnownInt32Use,
+    AnyIntUse,
+    NumberUse,
+    RealNumberUse,
+    BooleanUse,
+    KnownBooleanUse,
+    CellUse,
+    KnownCellUse,
+    CellOrOtherUse,
+    ObjectUse,
+    ArrayUse,
+    FunctionUse,
+    FinalObjectUse,
+    RegExpObjectUse,
+    ProxyObjectUse,
+    DerivedArrayUse,
+    ObjectOrOtherUse,
+    StringIdentUse,
+    StringUse,
+    StringOrOtherUse,
+    KnownStringUse,
+    KnownPrimitiveUse, // This bizarre type arises for op_strcat, which has a bytecode guarantee that it will only see primitives (i.e. not objects).
+    SymbolUse,
+    MapObjectUse,
+    SetObjectUse,
+    StringObjectUse,
+    StringOrStringObjectUse,
+    NotStringVarUse,
+    NotCellUse,
+    OtherUse,
+    MiscUse,
+
+    // 2. The Double representation for an unboxed double value that must be stored
+    //    in an FP register.
+    DoubleRepUse,
+    DoubleRepRealUse,
+    DoubleRepAnyIntUse,
+
+    // 3. The Int52 representation for an unboxed integer value that must be stored
+    //    in a GP register.
+    Int52RepUse,
+
+    LastUseKind // Must always be the last entry in the enum, as it is used to denote the number of enum elements.
+};
+
+inline SpeculatedType typeFilterFor(UseKind useKind)
+{
+    switch (useKind) {
+    case UntypedUse:
+        return SpecBytecodeTop;
+    case Int32Use:
+    case KnownInt32Use:
+        return SpecInt32Only;
+    case Int52RepUse:
+        return SpecAnyInt;
+    case AnyIntUse:
+        return SpecInt32Only | SpecAnyIntAsDouble;
+    case NumberUse:
+        return SpecBytecodeNumber;
+    case RealNumberUse:
+        return SpecBytecodeRealNumber;
+    case DoubleRepUse:
+        return SpecFullDouble;
+    case DoubleRepRealUse:
+        return SpecDoubleReal;
+    case DoubleRepAnyIntUse:
+        return SpecAnyIntAsDouble;
+    case BooleanUse:
+    case KnownBooleanUse:
+        return SpecBoolean;
+    case CellUse:
+    case KnownCellUse:
+        return SpecCell;
+    case CellOrOtherUse:
+        return SpecCell | SpecOther;
+    case ObjectUse:
+        return SpecObject;
+    case ArrayUse:
+        return SpecArray;
+    case FunctionUse:
+        return SpecFunction;
+    case FinalObjectUse:
+        return SpecFinalObject;
+    case RegExpObjectUse:
+        return SpecRegExpObject;
+    case ProxyObjectUse:
+        return SpecProxyObject;
+    case DerivedArrayUse:
+        return SpecDerivedArray;
+    case ObjectOrOtherUse:
+        return SpecObject | SpecOther;
+    case StringIdentUse:
+        return SpecStringIdent;
+    case StringUse:
+    case KnownStringUse:
+        return SpecString;
+    case StringOrOtherUse:
+        return SpecString | SpecOther;
+    case KnownPrimitiveUse:
+        return SpecHeapTop & ~SpecObject;
+    case SymbolUse:
+        return SpecSymbol;
+    case MapObjectUse:
+        return SpecMapObject;
+    case SetObjectUse:
+        return SpecSetObject;
+    case StringObjectUse:
+        return SpecStringObject;
+    case StringOrStringObjectUse:
+        return SpecString | SpecStringObject;
+    case NotStringVarUse:
+        return ~SpecStringVar;
+    case NotCellUse:
+        return ~SpecCell;
+    case OtherUse:
+        return SpecOther;
+    case MiscUse:
+        return SpecMisc;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return SpecFullTop;
+    }
+}
+
+inline bool shouldNotHaveTypeCheck(UseKind kind)
+{
+    switch (kind) {
+    case UntypedUse:
+    case KnownInt32Use:
+    case KnownCellUse:
+    case KnownStringUse:
+    case KnownPrimitiveUse:
+    case KnownBooleanUse:
+    case Int52RepUse:
+    case DoubleRepUse:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool mayHaveTypeCheck(UseKind kind)
+{
+    return !shouldNotHaveTypeCheck(kind);
+}
+
+inline bool isNumerical(UseKind kind)
+{
+    switch (kind) {
+    case Int32Use:
+    case KnownInt32Use:
+    case NumberUse:
+    case RealNumberUse:
+    case Int52RepUse:
+    case DoubleRepUse:
+    case DoubleRepRealUse:
+    case AnyIntUse:
+    case DoubleRepAnyIntUse:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool isDouble(UseKind kind)
+{
+    switch (kind) {
+    case DoubleRepUse:
+    case DoubleRepRealUse:
+    case DoubleRepAnyIntUse:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// Returns true if the use kind only admits cells, and is therefore appropriate for
+// SpeculateCellOperand in the DFG or lowCell() in the FTL.
+inline bool isCell(UseKind kind)
+{
+    switch (kind) {
+    case CellUse:
+    case KnownCellUse:
+    case ObjectUse:
+    case ArrayUse:
+    case FunctionUse:
+    case FinalObjectUse:
+    case RegExpObjectUse:
+    case ProxyObjectUse:
+    case DerivedArrayUse:
+    case StringIdentUse:
+    case StringUse:
+    case KnownStringUse:
+    case SymbolUse:
+    case StringObjectUse:
+    case StringOrStringObjectUse:
+    case MapObjectUse:
+    case SetObjectUse:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// Returns true if it uses structure in a way that could be clobbered by
+// things that change the structure.
+inline bool usesStructure(UseKind kind)
+{
+    switch (kind) {
+    case StringObjectUse:
+    case StringOrStringObjectUse:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// Returns true if we've already guaranteed the type 
+inline bool alreadyChecked(UseKind kind, SpeculatedType type)
+{
+    // If the check involves the structure then we need to know more than just the type to be sure
+    // that the check is done.
+    if (usesStructure(kind))
+        return false;
+    
+    return !(type & ~typeFilterFor(kind));
+}
+
+inline UseKind useKindForResult(NodeFlags result)
+{
+    ASSERT(!(result & ~NodeResultMask));
+    switch (result) {
+    case NodeResultInt52:
+        return Int52RepUse;
+    case NodeResultDouble:
+        return DoubleRepUse;
+    default:
+        return UntypedUse;
+    }
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::UseKind);
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGValidate.cpp b/dfg/DFGValidate.cpp
new file mode 100644
index 0000000..ca5bbfa
--- /dev/null
+++ b/dfg/DFGValidate.cpp
@@ -0,0 +1,846 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGValidate.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlockWithJITType.h"
+#include "DFGClobberize.h"
+#include "DFGClobbersExitState.h"
+#include "DFGMayExit.h"
+#include "JSCInlines.h"
+#include <wtf/Assertions.h>
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+class Validate {
+public:
+    Validate(Graph& graph, GraphDumpMode graphDumpMode, CString graphDumpBeforePhase)
+        : m_graph(graph)
+        , m_graphDumpMode(graphDumpMode)
+        , m_graphDumpBeforePhase(graphDumpBeforePhase)
+    {
+    }
+    
+    #define VALIDATE(context, assertion) do { \
+        if (!(assertion)) { \
+            startCrashing(); \
+            dataLogF("\n\n\nAt "); \
+            reportValidationContext context; \
+            dataLogF(": validation failed: %s (%s:%d).\n", #assertion, __FILE__, __LINE__); \
+            dumpGraphIfAppropriate(); \
+            WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, #assertion); \
+            CRASH(); \
+        } \
+    } while (0)
+    
+    #define V_EQUAL(context, left, right) do { \
+        if (left != right) { \
+            startCrashing(); \
+            dataLogF("\n\n\nAt "); \
+            reportValidationContext context; \
+            dataLogF(": validation failed: (%s = ", #left); \
+            dataLog(left); \
+            dataLogF(") == (%s = ", #right); \
+            dataLog(right); \
+            dataLogF(") (%s:%d).\n", __FILE__, __LINE__); \
+            dumpGraphIfAppropriate(); \
+            WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, #left " == " #right); \
+            CRASH(); \
+        } \
+    } while (0)
+
+    #define notSet (static_cast<size_t>(-1))
+        
+    void validate()
+    {
+        // NB. This code is not written for performance, since it is not intended to run
+        // in release builds.
+
+        // Validate that all local variables at the head of the root block are dead.
+        BasicBlock* root = m_graph.block(0);
+        for (unsigned i = 0; i < root->variablesAtHead.numberOfLocals(); ++i)
+            V_EQUAL((virtualRegisterForLocal(i), root), static_cast<Node*>(0), root->variablesAtHead.local(i));
+        
+        // Validate ref counts and uses.
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            VALIDATE((block), block->isReachable);
+            for (size_t i = 0; i < block->numNodes(); ++i)
+                m_myRefCounts.add(block->node(i), 0);
+        }
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (size_t i = 0; i < block->numNodes(); ++i) {
+                Node* node = block->node(i);
+                m_acceptableNodes.add(node);
+                if (!node->shouldGenerate())
+                    continue;
+                if (node->op() == Upsilon) {
+                    VALIDATE((node), m_graph.m_form == SSA);
+                    if (node->phi()->shouldGenerate())
+                        m_myRefCounts.find(node)->value++;
+                }
+                for (unsigned j = 0; j < m_graph.numChildren(node); ++j) {
+                    // Phi children in LoadStore form are invalid.
+                    if (m_graph.m_form == LoadStore && block->isPhiIndex(i))
+                        continue;
+                    
+                    Edge edge = m_graph.child(node, j);
+                    if (!edge)
+                        continue;
+                    
+                    m_myRefCounts.find(edge.node())->value++;
+
+                    validateEdgeWithDoubleResultIfNecessary(node, edge);
+                    VALIDATE((node, edge), edge->hasInt52Result() == (edge.useKind() == Int52RepUse));
+                    
+                    if (m_graph.m_form == SSA) {
+                        // In SSA, all edges must hasResult().
+                        VALIDATE((node, edge), edge->hasResult());
+                        continue;
+                    }
+                    
+                    // Unless I'm a Flush, Phantom, GetLocal, or Phi, my children should hasResult().
+                    switch (node->op()) {
+                    case Flush:
+                    case GetLocal:
+                        VALIDATE((node, edge), edge->hasVariableAccessData(m_graph));
+                        VALIDATE((node, edge), edge->variableAccessData() == node->variableAccessData());
+                        break;
+                    case PhantomLocal:
+                        VALIDATE((node, edge), edge->hasVariableAccessData(m_graph));
+                        VALIDATE((node, edge), edge->variableAccessData() == node->variableAccessData());
+                        VALIDATE((node, edge), edge->op() != SetLocal);
+                        break;
+                    case Phi:
+                        VALIDATE((node, edge), edge->hasVariableAccessData(m_graph));
+                        if (m_graph.m_unificationState == LocallyUnified)
+                            break;
+                        VALIDATE((node, edge), edge->variableAccessData() == node->variableAccessData());
+                        break;
+                    default:
+                        VALIDATE((node, edge), edge->hasResult());
+                        break;
+                    }
+                }
+            }
+        }
+        
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (size_t i = 0; i < block->numNodes(); ++i) {
+                Node* node = block->node(i);
+                if (m_graph.m_refCountState == ExactRefCount)
+                    V_EQUAL((node), m_myRefCounts.get(node), node->adjustedRefCount());
+            }
+            
+            bool foundTerminal = false;
+            for (size_t i = 0 ; i < block->size(); ++i) {
+                Node* node = block->at(i);
+                if (node->isTerminal()) {
+                    foundTerminal = true;
+                    for (size_t j = i + 1; j < block->size(); ++j) {
+                        node = block->at(j);
+                        VALIDATE((node), node->op() == Phantom || node->op() == PhantomLocal || node->op() == Flush || node->op() == Check);
+                        m_graph.doToChildren(
+                            node,
+                            [&] (Edge edge) {
+                                VALIDATE((node, edge), shouldNotHaveTypeCheck(edge.useKind()));
+                            });
+                    }
+                    break;
+                }
+            }
+            VALIDATE((block), foundTerminal);
+            
+            for (size_t i = 0; i < block->size(); ++i) {
+                Node* node = block->at(i);
+
+                VALIDATE((node), node->origin.isSet());
+                VALIDATE((node), node->origin.semantic.isSet() == node->origin.forExit.isSet());
+                VALIDATE((node), !(!node->origin.forExit.isSet() && node->origin.exitOK));
+                VALIDATE((node), !(mayExit(m_graph, node) == Exits && !node->origin.exitOK));
+
+                if (i) {
+                    Node* previousNode = block->at(i - 1);
+                    VALIDATE(
+                        (node),
+                        !clobbersExitState(m_graph, previousNode)
+                        || !node->origin.exitOK
+                        || node->op() == ExitOK
+                        || node->origin.forExit != previousNode->origin.forExit);
+                    VALIDATE(
+                        (node),
+                        !(!previousNode->origin.exitOK && node->origin.exitOK)
+                        || node->op() == ExitOK
+                        || node->origin.forExit != previousNode->origin.forExit);
+                }
+                
+                VALIDATE((node), !node->hasStructure() || !!node->structure().get());
+                VALIDATE((node), !node->hasCellOperand() || node->cellOperand()->value().isCell());
+                VALIDATE((node), !node->hasCellOperand() || !!node->cellOperand()->value());
+                
+                if (!(node->flags() & NodeHasVarArgs)) {
+                    if (!node->child2())
+                        VALIDATE((node), !node->child3());
+                    if (!node->child1())
+                        VALIDATE((node), !node->child2());
+                }
+                 
+                switch (node->op()) {
+                case Identity:
+                    VALIDATE((node), canonicalResultRepresentation(node->result()) == canonicalResultRepresentation(node->child1()->result()));
+                    break;
+                case SetLocal:
+                case PutStack:
+                case Upsilon:
+                    VALIDATE((node), !!node->child1());
+                    switch (node->child1().useKind()) {
+                    case UntypedUse:
+                    case CellUse:
+                    case KnownCellUse:
+                    case Int32Use:
+                    case KnownInt32Use:
+                    case Int52RepUse:
+                    case DoubleRepUse:
+                    case BooleanUse:
+                    case KnownBooleanUse:
+                        break;
+                    default:
+                        VALIDATE((node), !"Bad use kind");
+                        break;
+                    }
+                    break;
+                case MakeRope:
+                case ValueAdd:
+                case ArithAdd:
+                case ArithSub:
+                case ArithMul:
+                case ArithIMul:
+                case ArithDiv:
+                case ArithMod:
+                case ArithMin:
+                case ArithMax:
+                case ArithPow:
+                case CompareLess:
+                case CompareLessEq:
+                case CompareGreater:
+                case CompareGreaterEq:
+                case CompareEq:
+                case CompareStrictEq:
+                case StrCat:
+                    VALIDATE((node), !!node->child1());
+                    VALIDATE((node), !!node->child2());
+                    break;
+                case CompareEqPtr:
+                    VALIDATE((node), !!node->child1());
+                    VALIDATE((node), !!node->cellOperand()->value() && node->cellOperand()->value().isCell());
+                    break;
+                case CheckStructure:
+                case StringFromCharCode:
+                    VALIDATE((node), !!node->child1());
+                    break;
+                case PutStructure:
+                    VALIDATE((node), !node->transition()->previous->dfgShouldWatch());
+                    break;
+                case MultiPutByOffset:
+                    for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
+                        const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
+                        if (variant.kind() != PutByIdVariant::Transition)
+                            continue;
+                        VALIDATE((node), !variant.oldStructureForTransition()->dfgShouldWatch());
+                    }
+                    break;
+                case MaterializeNewObject:
+                    for (RegisteredStructure structure : node->structureSet()) {
+                        // This only supports structures that are JSFinalObject or JSArray.
+                        VALIDATE(
+                            (node),
+                            structure->classInfo() == JSFinalObject::info()
+                            || structure->classInfo() == JSArray::info());
+
+                        // We only support certain indexing shapes.
+                        VALIDATE((node), !hasAnyArrayStorage(structure->indexingType()));
+                    }
+                    break;
+                case DoubleConstant:
+                case Int52Constant:
+                    VALIDATE((node), node->isNumberConstant());
+                    break;
+                case GetByOffset:
+                case PutByOffset:
+                    // FIXME: We should be able to validate that GetByOffset and PutByOffset are
+                    // using the same object for storage and base. I think this means finally
+                    // splitting these nodes into two node types, one for inline and one for
+                    // out-of-line. The out-of-line one will require that the first node is storage,
+                    // while the inline one will not take a storage child at all.
+                    // https://bugs.webkit.org/show_bug.cgi?id=159602
+                    break;
+                case HasOwnProperty: {
+                    VALIDATE((node), !!m_graph.m_vm.hasOwnPropertyCache());
+                    break;
+                }
+                default:
+                    break;
+                }
+            }
+        }
+        
+        switch (m_graph.m_form) {
+        case LoadStore:
+        case ThreadedCPS:
+            validateCPS();
+            break;
+            
+        case SSA:
+            validateSSA();
+            break;
+        }
+
+        // Validate clobbered states.
+        struct DefLambdaAdaptor {
+            std::function<void(PureValue)> pureValue;
+            std::function<void(HeapLocation, LazyNode)> locationAndNode;
+
+            void operator()(PureValue value) const
+            {
+                pureValue(value);
+            }
+
+            void operator()(HeapLocation location, LazyNode node) const
+            {
+                locationAndNode(location, node);
+            }
+        };
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
+            for (Node* node : *block) {
+                clobberize(m_graph, node,
+                    [&] (AbstractHeap) { },
+                    [&] (AbstractHeap heap)
+                    {
+                        // CSE assumes that HEAP TOP is never written.
+                        // If this assumption is weakened, you need to update clobbering
+                        // in CSE accordingly.
+                        if (heap.kind() == Stack)
+                            VALIDATE((node), !heap.payload().isTop());
+                    },
+                    DefLambdaAdaptor {
+                        [&] (PureValue) { },
+                        [&] (HeapLocation location, LazyNode)
+                        {
+                            VALIDATE((node), location.heap().kind() != SideState);
+
+                            // More specific kinds should be used instead.
+                            VALIDATE((node), location.heap().kind() != World);
+                            VALIDATE((node), location.heap().kind() != Heap);
+                        }
+                });
+            }
+        }
+    }
+    
+private:
+    Graph& m_graph;
+    GraphDumpMode m_graphDumpMode;
+    CString m_graphDumpBeforePhase;
+    
+    HashMap<Node*, unsigned> m_myRefCounts;
+    HashSet<Node*> m_acceptableNodes;
+    
+    void validateCPS()
+    {
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            HashSet<Node*> phisInThisBlock;
+            HashSet<Node*> nodesInThisBlock;
+            
+            for (size_t i = 0; i < block->numNodes(); ++i) {
+                Node* node = block->node(i);
+                nodesInThisBlock.add(node);
+                if (block->isPhiIndex(i))
+                    phisInThisBlock.add(node);
+                for (unsigned j = 0; j < m_graph.numChildren(node); ++j) {
+                    Edge edge = m_graph.child(node, j);
+                    if (!edge)
+                        continue;
+                    VALIDATE((node, edge), m_acceptableNodes.contains(edge.node()));
+                }
+            }
+            
+            for (size_t i = 0; i < block->phis.size(); ++i) {
+                Node* node = block->phis[i];
+                ASSERT(phisInThisBlock.contains(node));
+                VALIDATE((node), node->op() == Phi);
+                VirtualRegister local = node->local();
+                for (unsigned j = 0; j < m_graph.numChildren(node); ++j) {
+                    // Phi children in LoadStore form are invalid.
+                    if (m_graph.m_form == LoadStore && block->isPhiIndex(i))
+                        continue;
+                    
+                    Edge edge = m_graph.child(node, j);
+                    if (!edge)
+                        continue;
+                    
+                    VALIDATE(
+                        (node, edge),
+                        edge->op() == SetLocal
+                        || edge->op() == SetArgument
+                        || edge->op() == Flush
+                        || edge->op() == Phi);
+                    
+                    if (phisInThisBlock.contains(edge.node()))
+                        continue;
+                    
+                    if (nodesInThisBlock.contains(edge.node())) {
+                        VALIDATE(
+                            (node, edge),
+                            edge->op() == SetLocal
+                            || edge->op() == SetArgument
+                            || edge->op() == Flush);
+                        
+                        continue;
+                    }
+                    
+                    // There must exist a predecessor block that has this node index in
+                    // its tail variables.
+                    bool found = false;
+                    for (unsigned k = 0; k < block->predecessors.size(); ++k) {
+                        BasicBlock* prevBlock = block->predecessors[k];
+                        VALIDATE((block->predecessors[k]), prevBlock);
+                        Node* prevNode = prevBlock->variablesAtTail.operand(local);
+                        // If we have a Phi that is not referring to *this* block then all predecessors
+                        // must have that local available.
+                        VALIDATE((local, block, block->predecessors[k]), prevNode);
+                        switch (prevNode->op()) {
+                        case GetLocal:
+                        case Flush:
+                        case PhantomLocal:
+                            prevNode = prevNode->child1().node();
+                            break;
+                        default:
+                            break;
+                        }
+                        if (node->shouldGenerate()) {
+                            VALIDATE((local, block->predecessors[k], prevNode),
+                                     prevNode->shouldGenerate());
+                        }
+                        VALIDATE(
+                            (local, block->predecessors[k], prevNode),
+                            prevNode->op() == SetLocal
+                            || prevNode->op() == SetArgument
+                            || prevNode->op() == Phi);
+                        if (prevNode == edge.node()) {
+                            found = true;
+                            break;
+                        }
+                        // At this point it cannot refer into this block.
+                        VALIDATE((local, block->predecessors[k], prevNode), !prevBlock->isInBlock(edge.node()));
+                    }
+                    
+                    VALIDATE((node, edge), found);
+                }
+            }
+            
+            Operands<size_t> getLocalPositions(
+                block->variablesAtHead.numberOfArguments(),
+                block->variablesAtHead.numberOfLocals());
+            Operands<size_t> setLocalPositions(
+                block->variablesAtHead.numberOfArguments(),
+                block->variablesAtHead.numberOfLocals());
+            
+            for (size_t i = 0; i < block->variablesAtHead.numberOfArguments(); ++i) {
+                VALIDATE((virtualRegisterForArgument(i), block), !block->variablesAtHead.argument(i) || block->variablesAtHead.argument(i)->accessesStack(m_graph));
+                if (m_graph.m_form == ThreadedCPS)
+                    VALIDATE((virtualRegisterForArgument(i), block), !block->variablesAtTail.argument(i) || block->variablesAtTail.argument(i)->accessesStack(m_graph));
+                
+                getLocalPositions.argument(i) = notSet;
+                setLocalPositions.argument(i) = notSet;
+            }
+            for (size_t i = 0; i < block->variablesAtHead.numberOfLocals(); ++i) {
+                VALIDATE((virtualRegisterForLocal(i), block), !block->variablesAtHead.local(i) || block->variablesAtHead.local(i)->accessesStack(m_graph));
+                if (m_graph.m_form == ThreadedCPS)
+                    VALIDATE((virtualRegisterForLocal(i), block), !block->variablesAtTail.local(i) || block->variablesAtTail.local(i)->accessesStack(m_graph));
+
+                getLocalPositions.local(i) = notSet;
+                setLocalPositions.local(i) = notSet;
+            }
+            
+            for (size_t i = 0; i < block->size(); ++i) {
+                Node* node = block->at(i);
+                ASSERT(nodesInThisBlock.contains(node));
+                VALIDATE((node), node->op() != Phi);
+                VALIDATE((node), node->origin.forExit.isSet());
+                for (unsigned j = 0; j < m_graph.numChildren(node); ++j) {
+                    Edge edge = m_graph.child(node, j);
+                    if (!edge)
+                        continue;
+                    VALIDATE((node, edge), nodesInThisBlock.contains(edge.node()));
+                    switch (node->op()) {
+                    case PhantomLocal:
+                    case GetLocal:
+                    case Flush:
+                        break;
+                    default:
+                        VALIDATE((node, edge), !phisInThisBlock.contains(edge.node()));
+                        break;
+                    }
+                }
+                
+                switch (node->op()) {
+                case Phi:
+                case Upsilon:
+                case CheckInBounds:
+                case PhantomNewObject:
+                case PhantomNewFunction:
+                case PhantomNewGeneratorFunction:
+                case PhantomNewAsyncFunction:
+                case PhantomCreateActivation:
+                case GetMyArgumentByVal:
+                case GetMyArgumentByValOutOfBounds:
+                case PutHint:
+                case CheckStructureImmediate:
+                case MaterializeCreateActivation:
+                case PutStack:
+                case KillStack:
+                case GetStack:
+                    VALIDATE((node), !"unexpected node type in CPS");
+                    break;
+                case MaterializeNewObject: {
+                    // CPS only allows array lengths to be constant. This constraint only exists
+                    // because we don't have DFG support for anything more and we don't need any
+                    // other kind of support for now.
+                    ObjectMaterializationData& data = node->objectMaterializationData();
+                    for (unsigned i = data.m_properties.size(); i--;) {
+                        PromotedLocationDescriptor descriptor = data.m_properties[i];
+                        Edge edge = m_graph.varArgChild(node, 1 + i);
+                        switch (descriptor.kind()) {
+                        case PublicLengthPLoc:
+                        case VectorLengthPLoc:
+                            VALIDATE((node, edge), edge->isInt32Constant());
+                            break;
+                        default:
+                            break;
+                        }
+                    }
+
+                    // CPS only allows one structure.
+                    VALIDATE((node), node->structureSet().size() == 1);
+
+                    // CPS disallows int32 and double arrays. Those require weird type checks and
+                    // conversions. They are not needed in the DFG right now. We should add support
+                    // for these if the DFG ever needs it.
+                    for (RegisteredStructure structure : node->structureSet()) {
+                        VALIDATE((node), !hasInt32(structure->indexingType()));
+                        VALIDATE((node), !hasDouble(structure->indexingType()));
+                    }
+                    break;
+                }
+                case Phantom:
+                    VALIDATE((node), m_graph.m_fixpointState != FixpointNotConverged);
+                    break;
+                default:
+                    break;
+                }
+                
+                if (!node->shouldGenerate())
+                    continue;
+                switch (node->op()) {
+                case GetLocal:
+                    // Ignore GetLocal's that we know to be dead, but that the graph
+                    // doesn't yet know to be dead.
+                    if (!m_myRefCounts.get(node))
+                        break;
+                    if (m_graph.m_form == ThreadedCPS) {
+                        VALIDATE((node, block), getLocalPositions.operand(node->local()) == notSet);
+                        VALIDATE((node, block), !!node->child1());
+                    }
+                    getLocalPositions.operand(node->local()) = i;
+                    break;
+                case SetLocal:
+                    // Only record the first SetLocal. There may be multiple SetLocals
+                    // because of flushing.
+                    if (setLocalPositions.operand(node->local()) != notSet)
+                        break;
+                    setLocalPositions.operand(node->local()) = i;
+                    break;
+                case SetArgument:
+                    // This acts like a reset. It's ok to have a second GetLocal for a local in the same
+                    // block if we had a SetArgument for that local.
+                    getLocalPositions.operand(node->local()) = notSet;
+                    setLocalPositions.operand(node->local()) = notSet;
+                    break;
+                default:
+                    break;
+                }
+            }
+            
+            if (m_graph.m_form == LoadStore)
+                continue;
+            
+            for (size_t i = 0; i < block->variablesAtHead.numberOfArguments(); ++i) {
+                checkOperand(
+                    block, getLocalPositions, setLocalPositions, virtualRegisterForArgument(i));
+            }
+            for (size_t i = 0; i < block->variablesAtHead.numberOfLocals(); ++i) {
+                checkOperand(
+                    block, getLocalPositions, setLocalPositions, virtualRegisterForLocal(i));
+            }
+        }
+    }
+    
+    void validateSSA()
+    {
+        // FIXME: Add more things here.
+        // https://bugs.webkit.org/show_bug.cgi?id=123471
+        
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            VALIDATE((block), block->phis.isEmpty());
+
+            bool didSeeExitOK = false;
+            
+            for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                didSeeExitOK |= node->origin.exitOK;
+                switch (node->op()) {
+                case Phi:
+                    // Phi cannot exit, and it would be wrong to hoist anything to the Phi that could
+                    // exit.
+                    VALIDATE((node), !node->origin.exitOK);
+
+                    // It never makes sense to have exitOK anywhere in the block before a Phi. It's only
+                    // OK to exit after all Phis are done.
+                    VALIDATE((node), !didSeeExitOK);
+                    break;
+                    
+                case GetLocal:
+                case SetLocal:
+                case GetLocalUnlinked:
+                case SetArgument:
+                case Phantom:
+                    VALIDATE((node), !"bad node type for SSA");
+                    break;
+
+                default:
+                    // FIXME: Add more things here.
+                    // https://bugs.webkit.org/show_bug.cgi?id=123471
+                    break;
+                }
+                switch (node->op()) {
+                case PhantomNewObject:
+                case PhantomNewFunction:
+                case PhantomNewGeneratorFunction:
+                case PhantomNewAsyncFunction:
+                case PhantomCreateActivation:
+                case PhantomDirectArguments:
+                case PhantomCreateRest:
+                case PhantomClonedArguments:
+                case MovHint:
+                case Upsilon:
+                case ForwardVarargs:
+                case CallForwardVarargs:
+                case TailCallForwardVarargs:
+                case TailCallForwardVarargsInlinedCaller:
+                case ConstructForwardVarargs:
+                case GetMyArgumentByVal:
+                case GetMyArgumentByValOutOfBounds:
+                    break;
+
+                case Check:
+                    // FIXME: This is probably not correct.
+                    break;
+
+                case PutHint:
+                    VALIDATE((node), node->child1()->isPhantomAllocation());
+                    break;
+
+                case PhantomSpread:
+                    VALIDATE((node), m_graph.m_form == SSA);
+                    // We currently only support PhantomSpread over PhantomCreateRest.
+                    VALIDATE((node), node->child1()->op() == PhantomCreateRest);
+                    break;
+
+                case PhantomNewArrayWithSpread: {
+                    VALIDATE((node), m_graph.m_form == SSA);
+                    BitVector* bitVector = node->bitVector();
+                    for (unsigned i = 0; i < node->numChildren(); i++) {
+                        Node* child = m_graph.varArgChild(node, i).node();
+                        if (bitVector->get(i)) {
+                            // We currently only support PhantomSpread over PhantomCreateRest.
+                            VALIDATE((node), child->op() == PhantomSpread);
+                        } else
+                            VALIDATE((node), !child->isPhantomAllocation());
+                    }
+                    break;
+                }
+
+                case NewArrayWithSpread: {
+                    BitVector* bitVector = node->bitVector();
+                    for (unsigned i = 0; i < node->numChildren(); i++) {
+                        Node* child = m_graph.varArgChild(node, i).node();
+                        if (child->isPhantomAllocation()) {
+                            VALIDATE((node), bitVector->get(i));
+                            VALIDATE((node), m_graph.m_form == SSA);
+                            VALIDATE((node), child->op() == PhantomSpread);
+                        }
+                    }
+                    break;
+                }
+
+                default:
+                    m_graph.doToChildren(
+                        node,
+                        [&] (const Edge& edge) {
+                            VALIDATE((node), !edge->isPhantomAllocation());
+                        });
+                    break;
+                }
+            }
+        }
+    }
+
+    void validateEdgeWithDoubleResultIfNecessary(Node* node, Edge edge)
+    {
+        if (!edge->hasDoubleResult())
+            return;
+
+        if (m_graph.m_planStage < PlanStage::AfterFixup)
+            return;
+        
+        VALIDATE((node, edge), edge.useKind() == DoubleRepUse || edge.useKind() == DoubleRepRealUse || edge.useKind() == DoubleRepAnyIntUse);
+    }
+
+    void checkOperand(
+        BasicBlock* block, Operands<size_t>& getLocalPositions,
+        Operands<size_t>& setLocalPositions, VirtualRegister operand)
+    {
+        if (getLocalPositions.operand(operand) == notSet)
+            return;
+        if (setLocalPositions.operand(operand) == notSet)
+            return;
+        
+        VALIDATE(
+            (block->at(getLocalPositions.operand(operand)),
+             block->at(setLocalPositions.operand(operand)),
+             block),
+            getLocalPositions.operand(operand) < setLocalPositions.operand(operand));
+    }
+    
+    void reportValidationContext(Node* node)
+    {
+        dataLogF("@%u", node->index());
+    }
+    
+    void reportValidationContext(BasicBlock* block)
+    {
+        dataLog("Block ", *block);
+    }
+    
+    void reportValidationContext(Node* node, Edge edge)
+    {
+        dataLog(node, " -> ", edge);
+    }
+    
+    void reportValidationContext(VirtualRegister local, BasicBlock* block)
+    {
+        if (!block) {
+            dataLog(local, " in null Block ");
+            return;
+        }
+
+        dataLog(local, " in Block ", *block);
+    }
+    
+    void reportValidationContext(
+        VirtualRegister local, BasicBlock* sourceBlock, BasicBlock* destinationBlock)
+    {
+        dataLog(local, " in Block ", *sourceBlock, " -> ", *destinationBlock);
+    }
+    
+    void reportValidationContext(
+        VirtualRegister local, BasicBlock* sourceBlock, Node* prevNode)
+    {
+        dataLog(prevNode, " for ", local, " in Block ", *sourceBlock);
+    }
+    
+    void reportValidationContext(Node* node, BasicBlock* block)
+    {
+        dataLog(node, " in Block ", *block);
+    }
+    
+    void reportValidationContext(Node* node, Node* node2, BasicBlock* block)
+    {
+        dataLog(node, " and ", node2, " in Block ", *block);
+    }
+    
+    void reportValidationContext(
+        Node* node, BasicBlock* block, Node* expectedNode, Edge incomingEdge)
+    {
+        dataLog(node, " in Block ", *block, ", searching for ", expectedNode, " from ", incomingEdge);
+    }
+    
+    void dumpGraphIfAppropriate()
+    {
+        if (m_graphDumpMode == DontDumpGraph)
+            return;
+        dataLog("\n");
+        if (!m_graphDumpBeforePhase.isNull()) {
+            dataLog("Before phase:\n");
+            dataLog(m_graphDumpBeforePhase);
+        }
+        dataLog("At time of failure:\n");
+        m_graph.dump();
+    }
+};
+
+} // End anonymous namespace.
+
+void validate(Graph& graph, GraphDumpMode graphDumpMode, CString graphDumpBeforePhase)
+{
+    Validate validationObject(graph, graphDumpMode, graphDumpBeforePhase);
+    validationObject.validate();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGValidate.h b/dfg/DFGValidate.h
new file mode 100644
index 0000000..4e506c8
--- /dev/null
+++ b/dfg/DFGValidate.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+enum GraphDumpMode { DontDumpGraph, DumpGraph };
+
+void validate(Graph&, GraphDumpMode = DumpGraph, CString graphDumpBeforePhase = CString());
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGValueSource.cpp b/dfg/DFGValueSource.cpp
new file mode 100644
index 0000000..41d8b47
--- /dev/null
+++ b/dfg/DFGValueSource.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2012, 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGValueSource.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void ValueSource::dump(PrintStream& out) const
+{
+    switch (kind()) {
+    case SourceNotSet:
+        out.print("NotSet");
+        break;
+    case SourceIsDead:
+        out.print("IsDead");
+        break;
+    case ValueInJSStack:
+        out.print("JS:", virtualRegister());
+        break;
+    case Int32InJSStack:
+        out.print("Int32:", virtualRegister());
+        break;
+    case Int52InJSStack:
+        out.print("Int52:", virtualRegister());
+        break;
+    case CellInJSStack:
+        out.print("Cell:", virtualRegister());
+        break;
+    case BooleanInJSStack:
+        out.print("Bool:", virtualRegister());
+        break;
+    case DoubleInJSStack:
+        out.print("Double:", virtualRegister());
+        break;
+    case HaveNode:
+        out.print("Node(", m_value, ")");
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void ValueSource::dumpInContext(PrintStream& out, DumpContext*) const
+{
+    dump(out);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGValueSource.h b/dfg/DFGValueSource.h
new file mode 100644
index 0000000..6aa75a4
--- /dev/null
+++ b/dfg/DFGValueSource.h
@@ -0,0 +1,218 @@
+/*
+ * Copyright (C) 2011, 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGFlushFormat.h"
+#include "DFGMinifiedID.h"
+#include "DataFormat.h"
+#include "SpeculatedType.h"
+#include "ValueRecovery.h"
+
+namespace JSC { namespace DFG {
+
+enum ValueSourceKind {
+    SourceNotSet,
+    ValueInJSStack,
+    Int32InJSStack,
+    Int52InJSStack,
+    CellInJSStack,
+    BooleanInJSStack,
+    DoubleInJSStack,
+    SourceIsDead,
+    HaveNode
+};
+
+static inline ValueSourceKind dataFormatToValueSourceKind(DataFormat dataFormat)
+{
+    switch (dataFormat) {
+    case DataFormatInt32:
+        return Int32InJSStack;
+    case DataFormatInt52:
+        return Int52InJSStack;
+    case DataFormatDouble:
+        return DoubleInJSStack;
+    case DataFormatBoolean:
+        return BooleanInJSStack;
+    case DataFormatCell:
+        return CellInJSStack;
+    case DataFormatDead:
+        return SourceIsDead;
+    default:
+        RELEASE_ASSERT(dataFormat & DataFormatJS);
+        return ValueInJSStack;
+    }
+}
+
+static inline DataFormat valueSourceKindToDataFormat(ValueSourceKind kind)
+{
+    switch (kind) {
+    case ValueInJSStack:
+        return DataFormatJS;
+    case Int32InJSStack:
+        return DataFormatInt32;
+    case Int52InJSStack:
+        return DataFormatInt52;
+    case CellInJSStack:
+        return DataFormatCell;
+    case BooleanInJSStack:
+        return DataFormatBoolean;
+    case DoubleInJSStack:
+        return DataFormatDouble;
+    case SourceIsDead:
+        return DataFormatDead;
+    default:
+        return DataFormatNone;
+    }
+}
+
+static inline bool isInJSStack(ValueSourceKind kind)
+{
+    DataFormat format = valueSourceKindToDataFormat(kind);
+    return format != DataFormatNone && format < DataFormatOSRMarker;
+}
+
+// Can this value be recovered without having to look at register allocation state or
+// DFG node liveness?
+static inline bool isTriviallyRecoverable(ValueSourceKind kind)
+{
+    return valueSourceKindToDataFormat(kind) != DataFormatNone;
+}
+
+class ValueSource {
+public:
+    ValueSource()
+        : m_kind(SourceNotSet)
+    {
+    }
+    
+    explicit ValueSource(ValueSourceKind valueSourceKind)
+        : m_kind(valueSourceKind)
+    {
+        ASSERT(kind() == SourceIsDead);
+    }
+    
+    explicit ValueSource(MinifiedID id)
+        : m_kind(HaveNode)
+        , m_value(id.bits())
+    {
+        ASSERT(!!id);
+        ASSERT(kind() == HaveNode);
+    }
+    
+    ValueSource(ValueSourceKind valueSourceKind, VirtualRegister where)
+        : m_kind(valueSourceKind)
+        , m_value(static_cast<intptr_t>(where.offset()))
+    {
+        ASSERT(kind() != SourceNotSet);
+        ASSERT(kind() != HaveNode);
+    }
+    
+    static ValueSource forFlushFormat(VirtualRegister where, FlushFormat format)
+    {
+        switch (format) {
+        case DeadFlush:
+        case ConflictingFlush:
+            return ValueSource(SourceIsDead);
+        case FlushedJSValue:
+            return ValueSource(ValueInJSStack, where);
+        case FlushedDouble:
+            return ValueSource(DoubleInJSStack, where);
+        case FlushedInt32:
+            return ValueSource(Int32InJSStack, where);
+        case FlushedInt52:
+            return ValueSource(Int52InJSStack, where);
+        case FlushedCell:
+            return ValueSource(CellInJSStack, where);
+        case FlushedBoolean:
+            return ValueSource(BooleanInJSStack, where);
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return ValueSource();
+    }
+    
+    static ValueSource forDataFormat(VirtualRegister where, DataFormat dataFormat)
+    {
+        return ValueSource(dataFormatToValueSourceKind(dataFormat), where);
+    }
+    
+    bool isSet() const
+    {
+        return kind() != SourceNotSet;
+    }
+    
+    bool operator!() const { return !isSet(); }
+    
+    ValueSourceKind kind() const
+    {
+        return m_kind;
+    }
+    
+    bool isInJSStack() const { return JSC::DFG::isInJSStack(kind()); }
+    bool isTriviallyRecoverable() const { return JSC::DFG::isTriviallyRecoverable(kind()); }
+    
+    DataFormat dataFormat() const
+    {
+        return valueSourceKindToDataFormat(kind());
+    }
+    
+    ValueRecovery valueRecovery() const
+    {
+        ASSERT(isTriviallyRecoverable());
+        switch (kind()) {
+        case SourceIsDead:
+            return ValueRecovery::constant(jsUndefined());
+            
+        default:
+            return ValueRecovery::displacedInJSStack(virtualRegister(), dataFormat());
+        }
+    }
+    
+    MinifiedID id() const
+    {
+        ASSERT(kind() == HaveNode);
+        return MinifiedID::fromBits(m_value);
+    }
+    
+    VirtualRegister virtualRegister() const
+    {
+        ASSERT(isInJSStack());
+        return VirtualRegister(m_value);
+    }
+    
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    
+private:
+    ValueSourceKind m_kind;
+    uintptr_t m_value;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGValueStrength.cpp b/dfg/DFGValueStrength.cpp
new file mode 100644
index 0000000..2c6e612
--- /dev/null
+++ b/dfg/DFGValueStrength.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGValueStrength.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace WTF {
+
+using namespace JSC::DFG;
+
+void printInternal(PrintStream& out, ValueStrength strength)
+{
+    switch (strength) {
+    case WeakValue:
+        out.print("Weak");
+        return;
+    case StrongValue:
+        out.print("Strong");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGValueStrength.h b/dfg/DFGValueStrength.h
new file mode 100644
index 0000000..42874bf
--- /dev/null
+++ b/dfg/DFGValueStrength.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+enum ValueStrength {
+    // The value has been used for optimization and it arose through inference. We don't want the
+    // fact that we optimized the code to result in the GC keeping this value alive unnecessarily,
+    // so we'd rather kill the code and recompile than keep the object alive longer.
+    WeakValue,
+    
+    // The code will keep this value alive. This is true of constants that were present in the
+    // source. String constants tend to be strong.
+    StrongValue
+};
+
+inline ValueStrength merge(ValueStrength a, ValueStrength b)
+{
+    switch (a) {
+    case WeakValue:
+        return b;
+    case StrongValue:
+        return StrongValue;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+
+    return WeakValue;
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::DFG::ValueStrength);
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGVarargsForwardingPhase.cpp b/dfg/DFGVarargsForwardingPhase.cpp
new file mode 100644
index 0000000..e3c52ac
--- /dev/null
+++ b/dfg/DFGVarargsForwardingPhase.cpp
@@ -0,0 +1,334 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVarargsForwardingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGArgumentsUtilities.h"
+#include "DFGClobberize.h"
+#include "DFGForAllKills.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace DFG {
+
+namespace {
+
+bool verbose = false;
+
+class VarargsForwardingPhase : public Phase {
+public:
+    VarargsForwardingPhase(Graph& graph)
+        : Phase(graph, "varargs forwarding")
+    {
+    }
+    
+    bool run()
+    {
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_form != SSA);
+        
+        if (verbose) {
+            dataLog("Graph before varargs forwarding:\n");
+            m_graph.dump();
+        }
+        
+        m_changed = false;
+        for (BasicBlock* block : m_graph.blocksInNaturalOrder())
+            handleBlock(block);
+        return m_changed;
+    }
+
+private:
+    void handleBlock(BasicBlock* block)
+    {
+        for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            switch (node->op()) {
+            case CreateDirectArguments:
+            case CreateClonedArguments:
+                handleCandidate(block, nodeIndex);
+                break;
+            default:
+                break;
+            }
+        }
+    }
+    
+    void handleCandidate(BasicBlock* block, unsigned candidateNodeIndex)
+    {
+        // We expect calls into this function to be rare. So, this is written in a simple O(n) manner.
+        
+        Node* candidate = block->at(candidateNodeIndex);
+        if (verbose)
+            dataLog("Handling candidate ", candidate, "\n");
+        
+        // Find the index of the last node in this block to use the candidate, and look for escaping
+        // sites.
+        unsigned lastUserIndex = candidateNodeIndex;
+        Vector<VirtualRegister, 2> relevantLocals; // This is a set. We expect it to be a small set.
+        for (unsigned nodeIndex = candidateNodeIndex + 1; nodeIndex < block->size(); ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            
+            switch (node->op()) {
+            case MovHint:
+                if (node->child1() != candidate)
+                    break;
+                lastUserIndex = nodeIndex;
+                if (!relevantLocals.contains(node->unlinkedLocal()))
+                    relevantLocals.append(node->unlinkedLocal());
+                break;
+                
+            case Check: {
+                bool sawEscape = false;
+                m_graph.doToChildren(
+                    node,
+                    [&] (Edge edge) {
+                        if (edge == candidate)
+                            lastUserIndex = nodeIndex;
+                        
+                        if (edge.willNotHaveCheck())
+                            return;
+                        
+                        if (alreadyChecked(edge.useKind(), SpecObject))
+                            return;
+                        
+                        sawEscape = true;
+                    });
+                if (sawEscape) {
+                    if (verbose)
+                        dataLog("    Escape at ", node, "\n");
+                    return;
+                }
+                break;
+            }
+                
+            case LoadVarargs:
+                if (m_graph.uses(node, candidate))
+                    lastUserIndex = nodeIndex;
+                break;
+                
+            case CallVarargs:
+            case ConstructVarargs:
+            case TailCallVarargs:
+            case TailCallVarargsInlinedCaller:
+                if (node->child1() == candidate || node->child2() == candidate) {
+                    if (verbose)
+                        dataLog("    Escape at ", node, "\n");
+                    return;
+                }
+                if (node->child2() == candidate)
+                    lastUserIndex = nodeIndex;
+                break;
+                
+            case SetLocal:
+                if (node->child1() == candidate && node->variableAccessData()->isLoadedFrom()) {
+                    if (verbose)
+                        dataLog("    Escape at ", node, "\n");
+                    return;
+                }
+                break;
+                
+            default:
+                if (m_graph.uses(node, candidate)) {
+                    if (verbose)
+                        dataLog("    Escape at ", node, "\n");
+                    return;
+                }
+            }
+            
+            forAllKilledOperands(
+                m_graph, node, block->tryAt(nodeIndex + 1),
+                [&] (VirtualRegister reg) {
+                    if (verbose)
+                        dataLog("    Killing ", reg, " while we are interested in ", listDump(relevantLocals), "\n");
+                    for (unsigned i = 0; i < relevantLocals.size(); ++i) {
+                        if (relevantLocals[i] == reg) {
+                            relevantLocals[i--] = relevantLocals.last();
+                            relevantLocals.removeLast();
+                            lastUserIndex = nodeIndex;
+                        }
+                    }
+                });
+        }
+        if (verbose)
+            dataLog("Selected lastUserIndex = ", lastUserIndex, ", ", block->at(lastUserIndex), "\n");
+        
+        // We're still in business. Determine if between the candidate and the last user there is any
+        // effect that could interfere with sinking.
+        for (unsigned nodeIndex = candidateNodeIndex + 1; nodeIndex <= lastUserIndex; ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            
+            // We have our own custom switch to detect some interferences that clobberize() wouldn't know
+            // about, and also some of the common ones, too. In particular, clobberize() doesn't know
+            // that Flush, MovHint, ZombieHint, and KillStack are bad because it's not worried about
+            // what gets read on OSR exit.
+            switch (node->op()) {
+            case MovHint:
+            case ZombieHint:
+            case KillStack:
+                if (argumentsInvolveStackSlot(candidate, node->unlinkedLocal())) {
+                    if (verbose)
+                        dataLog("    Interference at ", node, "\n");
+                    return;
+                }
+                break;
+                
+            case PutStack:
+                if (argumentsInvolveStackSlot(candidate, node->stackAccessData()->local)) {
+                    if (verbose)
+                        dataLog("    Interference at ", node, "\n");
+                    return;
+                }
+                break;
+                
+            case SetLocal:
+            case Flush:
+                if (argumentsInvolveStackSlot(candidate, node->local())) {
+                    if (verbose)
+                        dataLog("    Interference at ", node, "\n");
+                    return;
+                }
+                break;
+                
+            default: {
+                bool doesInterfere = false;
+                clobberize(
+                    m_graph, node, NoOpClobberize(),
+                    [&] (AbstractHeap heap) {
+                        if (heap.kind() != Stack) {
+                            ASSERT(!heap.overlaps(Stack));
+                            return;
+                        }
+                        ASSERT(!heap.payload().isTop());
+                        VirtualRegister reg(heap.payload().value32());
+                        if (argumentsInvolveStackSlot(candidate, reg))
+                            doesInterfere = true;
+                    },
+                    NoOpClobberize());
+                if (doesInterfere) {
+                    if (verbose)
+                        dataLog("    Interference at ", node, "\n");
+                    return;
+                }
+            } }
+        }
+        
+        // We can make this work.
+        if (verbose)
+            dataLog("    Will do forwarding!\n");
+        m_changed = true;
+        
+        // Transform the program.
+        switch (candidate->op()) {
+        case CreateDirectArguments:
+            candidate->setOpAndDefaultFlags(PhantomDirectArguments);
+            break;
+
+        case CreateClonedArguments:
+            candidate->setOpAndDefaultFlags(PhantomClonedArguments);
+            break;
+            
+        default:
+            DFG_CRASH(m_graph, candidate, "bad node type");
+            break;
+        }
+        for (unsigned nodeIndex = candidateNodeIndex + 1; nodeIndex <= lastUserIndex; ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            switch (node->op()) {
+            case Check:
+            case MovHint:
+            case PutHint:
+                // We don't need to change anything with these.
+                break;
+                
+            case LoadVarargs:
+                if (node->child1() != candidate)
+                    break;
+                node->setOpAndDefaultFlags(ForwardVarargs);
+                break;
+                
+            case CallVarargs:
+                if (node->child3() != candidate)
+                    break;
+                node->setOpAndDefaultFlags(CallForwardVarargs);
+                break;
+                
+            case ConstructVarargs:
+                if (node->child3() != candidate)
+                    break;
+                node->setOpAndDefaultFlags(ConstructForwardVarargs);
+                break;
+
+            case TailCallVarargs:
+                if (node->child3() != candidate)
+                    break;
+                node->setOpAndDefaultFlags(TailCallForwardVarargs);
+                break;
+
+            case TailCallVarargsInlinedCaller:
+                if (node->child3() != candidate)
+                    break;
+                node->setOpAndDefaultFlags(TailCallForwardVarargsInlinedCaller);
+                break;
+
+            case SetLocal:
+                // This is super odd. We don't have to do anything here, since in DFG IR, the phantom
+                // arguments nodes do produce a JSValue. Also, we know that if this SetLocal referenecs a
+                // candidate then the SetLocal - along with all of its references - will die off pretty
+                // soon, since it has no real users. DCE will surely kill it. If we make it to SSA, then
+                // SSA conversion will kill it.
+                break;
+                
+            default:
+                if (ASSERT_DISABLED)
+                    break;
+                m_graph.doToChildren(
+                    node,
+                    [&] (Edge edge) {
+                        DFG_ASSERT(m_graph, node, edge != candidate);
+                    });
+                break;
+            }
+        }
+    }
+    
+    bool m_changed;
+};
+
+} // anonymous namespace
+
+bool performVarargsForwarding(Graph& graph)
+{
+    return runPhase<VarargsForwardingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGVarargsForwardingPhase.h b/dfg/DFGVarargsForwardingPhase.h
new file mode 100644
index 0000000..a4438da
--- /dev/null
+++ b/dfg/DFGVarargsForwardingPhase.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Eliminates allocations of Arguments-class objects when they flow into CallVarargs, ConstructVarargs,
+// or LoadVarargs.
+
+bool performVarargsForwarding(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGVariableAccessData.cpp b/dfg/DFGVariableAccessData.cpp
new file mode 100644
index 0000000..8fc4267
--- /dev/null
+++ b/dfg/DFGVariableAccessData.cpp
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVariableAccessData.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+VariableAccessData::VariableAccessData()
+    : m_local(static_cast<VirtualRegister>(std::numeric_limits<int>::min()))
+    , m_prediction(SpecNone)
+    , m_argumentAwarePrediction(SpecNone)
+    , m_flags(0)
+    , m_shouldNeverUnbox(false)
+    , m_structureCheckHoistingFailed(false)
+    , m_checkArrayHoistingFailed(false)
+    , m_isProfitableToUnbox(false)
+    , m_isLoadedFrom(false)
+    , m_doubleFormatState(EmptyDoubleFormatState)
+{
+    clearVotes();
+}
+
+VariableAccessData::VariableAccessData(VirtualRegister local)
+    : m_local(local)
+    , m_prediction(SpecNone)
+    , m_argumentAwarePrediction(SpecNone)
+    , m_flags(0)
+    , m_shouldNeverUnbox(false)
+    , m_structureCheckHoistingFailed(false)
+    , m_checkArrayHoistingFailed(false)
+    , m_isProfitableToUnbox(false)
+    , m_isLoadedFrom(false)
+    , m_doubleFormatState(EmptyDoubleFormatState)
+{
+    clearVotes();
+}
+
+bool VariableAccessData::mergeShouldNeverUnbox(bool shouldNeverUnbox)
+{
+    bool newShouldNeverUnbox = m_shouldNeverUnbox | shouldNeverUnbox;
+    if (newShouldNeverUnbox == m_shouldNeverUnbox)
+        return false;
+    m_shouldNeverUnbox = newShouldNeverUnbox;
+    return true;
+}
+
+bool VariableAccessData::predict(SpeculatedType prediction)
+{
+    VariableAccessData* self = find();
+    bool result = mergeSpeculation(self->m_prediction, prediction);
+    if (result)
+        mergeSpeculation(m_argumentAwarePrediction, m_prediction);
+    return result;
+}
+
+bool VariableAccessData::mergeArgumentAwarePrediction(SpeculatedType prediction)
+{
+    return mergeSpeculation(find()->m_argumentAwarePrediction, prediction);
+}
+
+bool VariableAccessData::shouldUseDoubleFormatAccordingToVote()
+{
+    // We don't support this facility for arguments, yet.
+    // FIXME: make this work for arguments.
+    if (local().isArgument())
+        return false;
+        
+    // If the variable is not a number prediction, then this doesn't
+    // make any sense.
+    if (!isFullNumberSpeculation(prediction())) {
+        // FIXME: we may end up forcing a local in inlined argument position to be a double even
+        // if it is sometimes not even numeric, since this never signals the fact that it doesn't
+        // want doubles. https://bugs.webkit.org/show_bug.cgi?id=109511
+        return false;
+    }
+        
+    // If the variable is predicted to hold only doubles, then it's a
+    // no-brainer: it should be formatted as a double.
+    if (isDoubleSpeculation(prediction()))
+        return true;
+        
+    // If the variable is known to be used as an integer, then be safe -
+    // don't force it to be a double.
+    if (flags() & NodeBytecodeUsesAsInt)
+        return false;
+        
+    // If the variable has been voted to become a double, then make it a
+    // double.
+    if (voteRatio() >= Options::doubleVoteRatioForDoubleFormat())
+        return true;
+        
+    return false;
+}
+
+bool VariableAccessData::tallyVotesForShouldUseDoubleFormat()
+{
+    ASSERT(isRoot());
+        
+    if (local().isArgument() || shouldNeverUnbox()
+        || (flags() & NodeBytecodeUsesAsArrayIndex))
+        return DFG::mergeDoubleFormatState(m_doubleFormatState, NotUsingDoubleFormat);
+    
+    if (m_doubleFormatState == CantUseDoubleFormat)
+        return false;
+        
+    bool newValueOfShouldUseDoubleFormat = shouldUseDoubleFormatAccordingToVote();
+    if (!newValueOfShouldUseDoubleFormat) {
+        // We monotonically convert to double. Hence, if the fixpoint leads us to conclude that we should
+        // switch back to int, we instead ignore this and stick with double.
+        return false;
+    }
+        
+    if (m_doubleFormatState == UsingDoubleFormat)
+        return false;
+        
+    return DFG::mergeDoubleFormatState(m_doubleFormatState, UsingDoubleFormat);
+}
+
+bool VariableAccessData::mergeDoubleFormatState(DoubleFormatState doubleFormatState)
+{
+    return DFG::mergeDoubleFormatState(find()->m_doubleFormatState, doubleFormatState);
+}
+
+bool VariableAccessData::makePredictionForDoubleFormat()
+{
+    ASSERT(isRoot());
+    
+    if (m_doubleFormatState != UsingDoubleFormat)
+        return false;
+    
+    SpeculatedType type = m_prediction;
+    if (type & ~SpecBytecodeNumber)
+        type |= SpecDoublePureNaN;
+    if (type & SpecAnyInt)
+        type |= SpecAnyIntAsDouble;
+    return checkAndSet(m_prediction, type);
+}
+
+bool VariableAccessData::couldRepresentInt52()
+{
+    if (shouldNeverUnbox())
+        return false;
+    
+    return couldRepresentInt52Impl();
+}
+
+bool VariableAccessData::couldRepresentInt52Impl()
+{
+    // The hardware has to support it.
+    if (!enableInt52())
+        return false;
+    
+    // We punt for machine arguments.
+    if (m_local.isArgument())
+        return false;
+    
+    // The argument-aware prediction -- which merges all of an (inlined or machine)
+    // argument's variable access datas' predictions -- must possibly be AnyInt.
+    return !(argumentAwarePrediction() & ~SpecAnyInt);
+}
+
+FlushFormat VariableAccessData::flushFormat()
+{
+    ASSERT(find() == this);
+    
+    if (!shouldUnboxIfPossible())
+        return FlushedJSValue;
+    
+    if (shouldUseDoubleFormat())
+        return FlushedDouble;
+    
+    SpeculatedType prediction = argumentAwarePrediction();
+    
+    // This guard is here to protect the call to couldRepresentInt52(), which will return
+    // true for !prediction.
+    if (!prediction)
+        return FlushedJSValue;
+    
+    if (isInt32Speculation(prediction))
+        return FlushedInt32;
+    
+    if (couldRepresentInt52Impl())
+        return FlushedInt52;
+    
+    if (isCellSpeculation(prediction))
+        return FlushedCell;
+    
+    if (isBooleanSpeculation(prediction))
+        return FlushedBoolean;
+    
+    return FlushedJSValue;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGVariableAccessData.h b/dfg/DFGVariableAccessData.h
new file mode 100644
index 0000000..5bb4de1
--- /dev/null
+++ b/dfg/DFGVariableAccessData.h
@@ -0,0 +1,227 @@
+/*
+ * Copyright (C) 2011-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGDoubleFormatState.h"
+#include "DFGFlushFormat.h"
+#include "DFGFlushedAt.h"
+#include "DFGNodeFlags.h"
+#include "Operands.h"
+#include "SpeculatedType.h"
+#include "VirtualRegister.h"
+#include <wtf/UnionFind.h>
+
+namespace JSC { namespace DFG {
+
+struct Node;
+
+enum DoubleBallot { VoteValue, VoteDouble };
+
+class VariableAccessData : public UnionFind<VariableAccessData> {
+public:
+    VariableAccessData();
+    VariableAccessData(VirtualRegister local);
+    
+    VirtualRegister local()
+    {
+        ASSERT(m_local == find()->m_local);
+        return m_local;
+    }
+    
+    VirtualRegister& machineLocal()
+    {
+        ASSERT(find() == this);
+        return m_machineLocal;
+    }
+
+    bool mergeIsProfitableToUnbox(bool isProfitableToUnbox)
+    {
+        return checkAndSet(m_isProfitableToUnbox, m_isProfitableToUnbox || isProfitableToUnbox);
+    }
+    
+    bool isProfitableToUnbox()
+    {
+        return m_isProfitableToUnbox;
+    }
+    
+    bool mergeShouldNeverUnbox(bool shouldNeverUnbox);
+    
+    // Returns true if it would be unsound to store the value in an unboxed fashion.
+    // If this returns false, it simply means that it is sound to unbox; it doesn't
+    // mean that we have actually done so.
+    bool shouldNeverUnbox()
+    {
+        return m_shouldNeverUnbox;
+    }
+    
+    // Returns true if we should be unboxing the value provided that the predictions
+    // and double format vote say so. This may return false even if shouldNeverUnbox()
+    // returns false, since this incorporates heuristics of profitability.
+    bool shouldUnboxIfPossible()
+    {
+        return !shouldNeverUnbox() && isProfitableToUnbox();
+    }
+
+    bool mergeStructureCheckHoistingFailed(bool failed)
+    {
+        return checkAndSet(m_structureCheckHoistingFailed, m_structureCheckHoistingFailed || failed);
+    }
+    
+    bool mergeCheckArrayHoistingFailed(bool failed)
+    {
+        return checkAndSet(m_checkArrayHoistingFailed, m_checkArrayHoistingFailed || failed);
+    }
+    
+    bool structureCheckHoistingFailed()
+    {
+        return m_structureCheckHoistingFailed;
+    }
+    
+    bool checkArrayHoistingFailed()
+    {
+        return m_checkArrayHoistingFailed;
+    }
+    
+    bool mergeIsLoadedFrom(bool isLoadedFrom)
+    {
+        return checkAndSet(m_isLoadedFrom, m_isLoadedFrom || isLoadedFrom);
+    }
+    
+    void setIsLoadedFrom(bool isLoadedFrom)
+    {
+        m_isLoadedFrom = isLoadedFrom;
+    }
+    
+    bool isLoadedFrom()
+    {
+        return m_isLoadedFrom;
+    }
+    
+    bool predict(SpeculatedType prediction);
+    
+    SpeculatedType nonUnifiedPrediction()
+    {
+        return m_prediction;
+    }
+    
+    SpeculatedType prediction()
+    {
+        return find()->m_prediction;
+    }
+    
+    SpeculatedType argumentAwarePrediction()
+    {
+        return find()->m_argumentAwarePrediction;
+    }
+    
+    bool mergeArgumentAwarePrediction(SpeculatedType prediction);
+    
+    void clearVotes()
+    {
+        ASSERT(find() == this);
+        m_votes[0] = 0;
+        m_votes[1] = 0;
+    }
+    
+    void vote(unsigned ballot, float weight = 1)
+    {
+        ASSERT(ballot < 2);
+        m_votes[ballot] += weight;
+    }
+    
+    double voteRatio()
+    {
+        ASSERT(find() == this);
+        return static_cast<double>(m_votes[1]) / m_votes[0];
+    }
+    
+    bool shouldUseDoubleFormatAccordingToVote();
+    
+    DoubleFormatState doubleFormatState()
+    {
+        return find()->m_doubleFormatState;
+    }
+    
+    bool shouldUseDoubleFormat()
+    {
+        ASSERT(isRoot());
+        bool doubleState = m_doubleFormatState == UsingDoubleFormat;
+        ASSERT(!(doubleState && shouldNeverUnbox()));
+        return doubleState && isProfitableToUnbox();
+    }
+    
+    bool tallyVotesForShouldUseDoubleFormat();
+    
+    bool mergeDoubleFormatState(DoubleFormatState);
+    
+    bool makePredictionForDoubleFormat();
+    
+    NodeFlags flags() const { return m_flags; }
+    
+    bool mergeFlags(NodeFlags newFlags)
+    {
+        return checkAndSet(m_flags, m_flags | newFlags);
+    }
+    
+    FlushFormat flushFormat();
+    
+    bool couldRepresentInt52();
+    
+    FlushedAt flushedAt()
+    {
+        return FlushedAt(flushFormat(), machineLocal());
+    }
+
+private:
+    bool couldRepresentInt52Impl();
+    
+    // This is slightly space-inefficient, since anything we're unified with
+    // will have the same operand and should have the same prediction. But
+    // putting them here simplifies the code, and we don't expect DFG space
+    // usage for variable access nodes do be significant.
+
+    VirtualRegister m_local;
+    VirtualRegister m_machineLocal;
+    SpeculatedType m_prediction;
+    SpeculatedType m_argumentAwarePrediction;
+    NodeFlags m_flags;
+
+    bool m_shouldNeverUnbox;
+    bool m_structureCheckHoistingFailed;
+    bool m_checkArrayHoistingFailed;
+    bool m_isProfitableToUnbox;
+    bool m_isLoadedFrom;
+
+    float m_votes[2]; // Used primarily for double voting but may be reused for other purposes.
+    DoubleFormatState m_doubleFormatState;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGVariableAccessDataDump.cpp b/dfg/DFGVariableAccessDataDump.cpp
new file mode 100644
index 0000000..0062173
--- /dev/null
+++ b/dfg/DFGVariableAccessDataDump.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVariableAccessDataDump.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGVariableAccessData.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+VariableAccessDataDump::VariableAccessDataDump(Graph& graph, VariableAccessData* data)
+    : m_graph(graph)
+    , m_data(data)
+{
+}
+
+void VariableAccessDataDump::dump(PrintStream& out) const
+{
+    unsigned index = std::numeric_limits<unsigned>::max();
+    for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
+        if (&m_graph.m_variableAccessData[i] == m_data) {
+            index = i;
+            break;
+        }
+    }
+    
+    ASSERT(index != std::numeric_limits<unsigned>::max());
+    
+    if (!index) {
+        out.print("a");
+        return;
+    }
+
+    while (index) {
+        out.print(CharacterDump('A' + (index % 26)));
+        index /= 26;
+    }
+    
+    if (m_data->shouldNeverUnbox())
+        out.print("!");
+    else if (!m_data->shouldUnboxIfPossible())
+        out.print("~");
+
+    out.print(AbbreviatedSpeculationDump(m_data->prediction()), "/", m_data->flushFormat());
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+
diff --git a/dfg/DFGVariableAccessDataDump.h b/dfg/DFGVariableAccessDataDump.h
new file mode 100644
index 0000000..0663a7e
--- /dev/null
+++ b/dfg/DFGVariableAccessDataDump.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+class Graph;
+class VariableAccessData;
+
+class VariableAccessDataDump {
+public:
+    VariableAccessDataDump(Graph&, VariableAccessData*);
+    
+    void dump(PrintStream&) const;
+
+private:
+    Graph& m_graph;
+    VariableAccessData* m_data;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGVariableEvent.cpp b/dfg/DFGVariableEvent.cpp
new file mode 100644
index 0000000..28e437f
--- /dev/null
+++ b/dfg/DFGVariableEvent.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVariableEvent.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void VariableEvent::dump(PrintStream& out) const
+{
+    switch (kind()) {
+    case Reset:
+        out.printf("Reset");
+        break;
+    case BirthToFill:
+        dumpFillInfo("BirthToFill", out);
+        break;
+    case BirthToSpill:
+        dumpSpillInfo("BirthToSpill", out);
+        break;
+    case Birth:
+        out.print("Birth(", id(), ")");
+        break;
+    case Fill:
+        dumpFillInfo("Fill", out);
+        break;
+    case Spill:
+        dumpSpillInfo("Spill", out);
+        break;
+    case Death:
+        out.print("Death(", id(), ")");
+        break;
+    case MovHintEvent:
+        out.print("MovHint(", id(), ", ", bytecodeRegister(), ")");
+        break;
+    case SetLocalEvent:
+        out.print(
+            "SetLocal(machine:", machineRegister(), " -> bytecode:", bytecodeRegister(),
+            ", ", dataFormatToString(dataFormat()), ")");
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void VariableEvent::dumpFillInfo(const char* name, PrintStream& out) const
+{
+    out.print(name, "(", id(), ", ");
+    if (dataFormat() == DataFormatDouble)
+        out.printf("%s", FPRInfo::debugName(fpr()));
+#if USE(JSVALUE32_64)
+    else if (dataFormat() & DataFormatJS)
+        out.printf("%s:%s", GPRInfo::debugName(tagGPR()), GPRInfo::debugName(payloadGPR()));
+#endif
+    else
+        out.printf("%s", GPRInfo::debugName(gpr()));
+    out.printf(", %s)", dataFormatToString(dataFormat()));
+}
+
+void VariableEvent::dumpSpillInfo(const char* name, PrintStream& out) const
+{
+    out.print(name, "(", id(), ", ", spillRegister(), ", ", dataFormatToString(dataFormat()), ")");
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGVariableEvent.h b/dfg/DFGVariableEvent.h
new file mode 100644
index 0000000..6196c2d
--- /dev/null
+++ b/dfg/DFGVariableEvent.h
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGMinifiedID.h"
+#include "DataFormat.h"
+#include "MacroAssembler.h"
+#include <stdio.h>
+
+namespace JSC { namespace DFG {
+
+enum VariableEventKind {
+    // Marks the beginning of a checkpoint. If you interpret the variable
+    // events starting at a Reset point then you'll get everything you need.
+    Reset,
+    
+    // Node births. Points in the code where a node becomes relevant for OSR.
+    // It may be the point where it is actually born (i.e. assigned) or it may
+    // be a later point, if it's only later in the sequence of instructions
+    // that we start to care about this node.
+    BirthToFill,
+    BirthToSpill,
+    Birth,
+    
+    // Events related to how a node is represented.
+    Fill,
+    Spill,
+    
+    // Death of a node - after this we no longer care about this node.
+    Death,
+    
+    // A MovHintEvent means that a node is being associated with a bytecode operand,
+    // but that it has not been stored into that operand.
+    MovHintEvent,
+    
+    // A SetLocalEvent means that a node's value has been stored into the stack.
+    SetLocalEvent,
+    
+    // Used to indicate an uninitialized VariableEvent. Don't use for other
+    // purposes.
+    InvalidEventKind
+};
+
+union VariableRepresentation {
+    MacroAssembler::RegisterID gpr;
+    MacroAssembler::FPRegisterID fpr;
+#if USE(JSVALUE32_64)
+    struct {
+        MacroAssembler::RegisterID tagGPR;
+        MacroAssembler::RegisterID payloadGPR;
+    } pair;
+#endif
+    int32_t virtualReg;
+};
+
+class VariableEvent {
+public:
+    VariableEvent()
+        : m_kind(InvalidEventKind)
+    {
+    }
+    
+    static VariableEvent reset()
+    {
+        VariableEvent event;
+        event.m_kind = Reset;
+        return event;
+    }
+    
+    static VariableEvent fillGPR(VariableEventKind kind, MinifiedID id, MacroAssembler::RegisterID gpr, DataFormat dataFormat)
+    {
+        ASSERT(kind == BirthToFill || kind == Fill);
+        ASSERT(dataFormat != DataFormatDouble);
+#if USE(JSVALUE32_64)
+        ASSERT(!(dataFormat & DataFormatJS));
+#endif
+        VariableEvent event;
+        event.m_which.id = id.bits();
+        event.m_representation.gpr = gpr;
+        event.m_kind = kind;
+        event.m_dataFormat = dataFormat;
+        return event;
+    }
+    
+#if USE(JSVALUE32_64)
+    static VariableEvent fillPair(VariableEventKind kind, MinifiedID id, MacroAssembler::RegisterID tagGPR, MacroAssembler::RegisterID payloadGPR)
+    {
+        ASSERT(kind == BirthToFill || kind == Fill);
+        VariableEvent event;
+        event.m_which.id = id.bits();
+        event.m_representation.pair.tagGPR = tagGPR;
+        event.m_representation.pair.payloadGPR = payloadGPR;
+        event.m_kind = kind;
+        event.m_dataFormat = DataFormatJS;
+        return event;
+    }
+#endif // USE(JSVALUE32_64)
+    
+    static VariableEvent fillFPR(VariableEventKind kind, MinifiedID id, MacroAssembler::FPRegisterID fpr)
+    {
+        ASSERT(kind == BirthToFill || kind == Fill);
+        VariableEvent event;
+        event.m_which.id = id.bits();
+        event.m_representation.fpr = fpr;
+        event.m_kind = kind;
+        event.m_dataFormat = DataFormatDouble;
+        return event;
+    }
+    
+    static VariableEvent birth(MinifiedID id)
+    {
+        VariableEvent event;
+        event.m_which.id = id.bits();
+        event.m_kind = Birth;
+        return event;
+    }
+    
+    static VariableEvent spill(VariableEventKind kind, MinifiedID id, VirtualRegister virtualRegister, DataFormat format)
+    {
+        ASSERT(kind == BirthToSpill || kind == Spill);
+        VariableEvent event;
+        event.m_which.id = id.bits();
+        event.m_representation.virtualReg = virtualRegister.offset();
+        event.m_kind = kind;
+        event.m_dataFormat = format;
+        return event;
+    }
+    
+    static VariableEvent death(MinifiedID id)
+    {
+        VariableEvent event;
+        event.m_which.id = id.bits();
+        event.m_kind = Death;
+        return event;
+    }
+    
+    static VariableEvent setLocal(
+        VirtualRegister bytecodeReg, VirtualRegister machineReg, DataFormat format)
+    {
+        VariableEvent event;
+        event.m_which.virtualReg = machineReg.offset();
+        event.m_representation.virtualReg = bytecodeReg.offset();
+        event.m_kind = SetLocalEvent;
+        event.m_dataFormat = format;
+        return event;
+    }
+    
+    static VariableEvent movHint(MinifiedID id, VirtualRegister bytecodeReg)
+    {
+        VariableEvent event;
+        event.m_which.id = id.bits();
+        event.m_representation.virtualReg = bytecodeReg.offset();
+        event.m_kind = MovHintEvent;
+        return event;
+    }
+    
+    VariableEventKind kind() const
+    {
+        return static_cast<VariableEventKind>(m_kind);
+    }
+    
+    MinifiedID id() const
+    {
+        ASSERT(
+            m_kind == BirthToFill || m_kind == Fill || m_kind == BirthToSpill || m_kind == Spill
+            || m_kind == Death || m_kind == MovHintEvent || m_kind == Birth);
+        return MinifiedID::fromBits(m_which.id);
+    }
+    
+    DataFormat dataFormat() const
+    {
+        ASSERT(
+            m_kind == BirthToFill || m_kind == Fill || m_kind == BirthToSpill || m_kind == Spill
+            || m_kind == SetLocalEvent);
+        return static_cast<DataFormat>(m_dataFormat);
+    }
+    
+    MacroAssembler::RegisterID gpr() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill);
+        ASSERT(m_dataFormat);
+        ASSERT(m_dataFormat != DataFormatDouble);
+#if USE(JSVALUE32_64)
+        ASSERT(!(m_dataFormat & DataFormatJS));
+#endif
+        return m_representation.gpr;
+    }
+    
+#if USE(JSVALUE32_64)
+    MacroAssembler::RegisterID tagGPR() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill);
+        ASSERT(m_dataFormat & DataFormatJS);
+        return m_representation.pair.tagGPR;
+    }
+    MacroAssembler::RegisterID payloadGPR() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill);
+        ASSERT(m_dataFormat & DataFormatJS);
+        return m_representation.pair.payloadGPR;
+    }
+#endif // USE(JSVALUE32_64)
+    
+    MacroAssembler::FPRegisterID fpr() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill);
+        ASSERT(m_dataFormat == DataFormatDouble);
+        return m_representation.fpr;
+    }
+    
+    VirtualRegister spillRegister() const
+    {
+        ASSERT(m_kind == BirthToSpill || m_kind == Spill);
+        return VirtualRegister(m_representation.virtualReg);
+    }
+    
+    VirtualRegister bytecodeRegister() const
+    {
+        ASSERT(m_kind == SetLocalEvent || m_kind == MovHintEvent);
+        return VirtualRegister(m_representation.virtualReg);
+    }
+    
+    VirtualRegister machineRegister() const
+    {
+        ASSERT(m_kind == SetLocalEvent);
+        return VirtualRegister(m_which.virtualReg);
+    }
+    
+    const VariableRepresentation& variableRepresentation() const { return m_representation; }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    void dumpFillInfo(const char* name, PrintStream&) const;
+    void dumpSpillInfo(const char* name, PrintStream&) const;
+    
+    union {
+        int virtualReg;
+        uintptr_t id;
+    } m_which;
+    
+    // For BirthToFill, Fill:
+    //   - The GPR or FPR, or a GPR pair.
+    // For BirthToSpill, Spill:
+    //   - The virtual register.
+    // For MovHintEvent, SetLocalEvent:
+    //   - The bytecode operand.
+    // For Death:
+    //   - Unused.
+    VariableRepresentation m_representation;
+    
+    int8_t m_kind;
+    int8_t m_dataFormat;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGVariableEventStream.cpp b/dfg/DFGVariableEventStream.cpp
new file mode 100644
index 0000000..1809621
--- /dev/null
+++ b/dfg/DFGVariableEventStream.cpp
@@ -0,0 +1,233 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVariableEventStream.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGJITCode.h"
+#include "DFGValueSource.h"
+#include "InlineCallFrame.h"
+#include "JSCInlines.h"
+#include <wtf/DataLog.h>
+#include <wtf/HashMap.h>
+
+namespace JSC { namespace DFG {
+
+void VariableEventStream::logEvent(const VariableEvent& event)
+{
+    dataLogF("seq#%u:", static_cast<unsigned>(size()));
+    event.dump(WTF::dataFile());
+    dataLogF(" ");
+}
+
+namespace {
+
+struct MinifiedGenerationInfo {
+    bool filled; // true -> in gpr/fpr/pair, false -> spilled
+    bool alive;
+    VariableRepresentation u;
+    DataFormat format;
+    
+    MinifiedGenerationInfo()
+        : filled(false)
+        , alive(false)
+        , format(DataFormatNone)
+    {
+    }
+    
+    void update(const VariableEvent& event)
+    {
+        switch (event.kind()) {
+        case BirthToFill:
+        case Fill:
+            filled = true;
+            alive = true;
+            break;
+        case BirthToSpill:
+        case Spill:
+            filled = false;
+            alive = true;
+            break;
+        case Birth:
+            alive = true;
+            return;
+        case Death:
+            format = DataFormatNone;
+            alive = false;
+            return;
+        default:
+            return;
+        }
+        
+        u = event.variableRepresentation();
+        format = event.dataFormat();
+    }
+};
+
+} // namespace
+
+bool VariableEventStream::tryToSetConstantRecovery(ValueRecovery& recovery, MinifiedNode* node) const
+{
+    if (!node)
+        return false;
+    
+    if (node->hasConstant()) {
+        recovery = ValueRecovery::constant(node->constant());
+        return true;
+    }
+    
+    if (node->op() == PhantomDirectArguments) {
+        recovery = ValueRecovery::directArgumentsThatWereNotCreated(node->id());
+        return true;
+    }
+    
+    if (node->op() == PhantomClonedArguments) {
+        recovery = ValueRecovery::clonedArgumentsThatWereNotCreated(node->id());
+        return true;
+    }
+    
+    return false;
+}
+
+void VariableEventStream::reconstruct(
+    CodeBlock* codeBlock, CodeOrigin codeOrigin, MinifiedGraph& graph,
+    unsigned index, Operands<ValueRecovery>& valueRecoveries) const
+{
+    ASSERT(codeBlock->jitType() == JITCode::DFGJIT);
+    CodeBlock* baselineCodeBlock = codeBlock->baselineVersion();
+    
+    unsigned numVariables;
+    if (codeOrigin.inlineCallFrame)
+        numVariables = baselineCodeBlockForInlineCallFrame(codeOrigin.inlineCallFrame)->m_numCalleeLocals + VirtualRegister(codeOrigin.inlineCallFrame->stackOffset).toLocal() + 1;
+    else
+        numVariables = baselineCodeBlock->m_numCalleeLocals;
+    
+    // Crazy special case: if we're at index == 0 then this must be an argument check
+    // failure, in which case all variables are already set up. The recoveries should
+    // reflect this.
+    if (!index) {
+        valueRecoveries = Operands<ValueRecovery>(codeBlock->numParameters(), numVariables);
+        for (size_t i = 0; i < valueRecoveries.size(); ++i) {
+            valueRecoveries[i] = ValueRecovery::displacedInJSStack(
+                VirtualRegister(valueRecoveries.operandForIndex(i)), DataFormatJS);
+        }
+        return;
+    }
+    
+    // Step 1: Find the last checkpoint, and figure out the number of virtual registers as we go.
+    unsigned startIndex = index - 1;
+    while (at(startIndex).kind() != Reset)
+        startIndex--;
+    
+    // Step 2: Create a mock-up of the DFG's state and execute the events.
+    Operands<ValueSource> operandSources(codeBlock->numParameters(), numVariables);
+    for (unsigned i = operandSources.size(); i--;)
+        operandSources[i] = ValueSource(SourceIsDead);
+    HashMap<MinifiedID, MinifiedGenerationInfo> generationInfos;
+    for (unsigned i = startIndex; i < index; ++i) {
+        const VariableEvent& event = at(i);
+        switch (event.kind()) {
+        case Reset:
+            // nothing to do.
+            break;
+        case BirthToFill:
+        case BirthToSpill:
+        case Birth: {
+            MinifiedGenerationInfo info;
+            info.update(event);
+            generationInfos.add(event.id(), info);
+            break;
+        }
+        case Fill:
+        case Spill:
+        case Death: {
+            HashMap<MinifiedID, MinifiedGenerationInfo>::iterator iter = generationInfos.find(event.id());
+            ASSERT(iter != generationInfos.end());
+            iter->value.update(event);
+            break;
+        }
+        case MovHintEvent:
+            if (operandSources.hasOperand(event.bytecodeRegister()))
+                operandSources.setOperand(event.bytecodeRegister(), ValueSource(event.id()));
+            break;
+        case SetLocalEvent:
+            if (operandSources.hasOperand(event.bytecodeRegister()))
+                operandSources.setOperand(event.bytecodeRegister(), ValueSource::forDataFormat(event.machineRegister(), event.dataFormat()));
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+    
+    // Step 3: Compute value recoveries!
+    valueRecoveries = Operands<ValueRecovery>(codeBlock->numParameters(), numVariables);
+    for (unsigned i = 0; i < operandSources.size(); ++i) {
+        ValueSource& source = operandSources[i];
+        if (source.isTriviallyRecoverable()) {
+            valueRecoveries[i] = source.valueRecovery();
+            continue;
+        }
+        
+        ASSERT(source.kind() == HaveNode);
+        MinifiedNode* node = graph.at(source.id());
+        MinifiedGenerationInfo info = generationInfos.get(source.id());
+        if (!info.alive) {
+            valueRecoveries[i] = ValueRecovery::constant(jsUndefined());
+            continue;
+        }
+
+        if (tryToSetConstantRecovery(valueRecoveries[i], node))
+            continue;
+        
+        ASSERT(info.format != DataFormatNone);
+        
+        if (info.filled) {
+            if (info.format == DataFormatDouble) {
+                valueRecoveries[i] = ValueRecovery::inFPR(info.u.fpr, DataFormatDouble);
+                continue;
+            }
+#if USE(JSVALUE32_64)
+            if (info.format & DataFormatJS) {
+                valueRecoveries[i] = ValueRecovery::inPair(info.u.pair.tagGPR, info.u.pair.payloadGPR);
+                continue;
+            }
+#endif
+            valueRecoveries[i] = ValueRecovery::inGPR(info.u.gpr, info.format);
+            continue;
+        }
+        
+        valueRecoveries[i] =
+            ValueRecovery::displacedInJSStack(static_cast<VirtualRegister>(info.u.virtualReg), info.format);
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGVariableEventStream.h b/dfg/DFGVariableEventStream.h
new file mode 100644
index 0000000..1734a87
--- /dev/null
+++ b/dfg/DFGVariableEventStream.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGMinifiedGraph.h"
+#include "DFGVariableEvent.h"
+#include "Operands.h"
+#include "ValueRecovery.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class VariableEventStream : public Vector<VariableEvent> {
+public:
+    void appendAndLog(const VariableEvent& event)
+    {
+        append(event);
+    }
+    
+    void reconstruct(
+        CodeBlock*, CodeOrigin, MinifiedGraph&,
+        unsigned index, Operands<ValueRecovery>&) const;
+
+private:
+    bool tryToSetConstantRecovery(ValueRecovery&, MinifiedNode*) const;
+    
+    void logEvent(const VariableEvent&);
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGVirtualRegisterAllocationPhase.cpp b/dfg/DFGVirtualRegisterAllocationPhase.cpp
new file mode 100644
index 0000000..f812759
--- /dev/null
+++ b/dfg/DFGVirtualRegisterAllocationPhase.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVirtualRegisterAllocationPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGScoreBoard.h"
+#include "JSCInlines.h"
+#include "StackAlignment.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC { namespace DFG {
+
+class VirtualRegisterAllocationPhase : public Phase {
+public:
+    VirtualRegisterAllocationPhase(Graph& graph)
+        : Phase(graph, "virtual register allocation")
+    {
+    }
+    
+    bool run()
+    {
+        DFG_ASSERT(m_graph, nullptr, m_graph.m_form == ThreadedCPS);
+        
+        ScoreBoard scoreBoard(m_graph.m_nextMachineLocal);
+        scoreBoard.assertClear();
+        for (size_t blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            if (!block->isReachable)
+                continue;
+            if (!ASSERT_DISABLED) {
+                // Force usage of highest-numbered virtual registers.
+                scoreBoard.sortFree();
+            }
+            for (size_t indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+                Node* node = block->at(indexInBlock);
+        
+                if (!node->shouldGenerate())
+                    continue;
+                
+                switch (node->op()) {
+                case Phi:
+                case Flush:
+                case PhantomLocal:
+                    continue;
+                case GetLocal:
+                    ASSERT(!node->child1()->hasResult());
+                    break;
+                default:
+                    break;
+                }
+                
+                // First, call use on all of the current node's children, then
+                // allocate a VirtualRegister for this node. We do so in this
+                // order so that if a child is on its last use, and a
+                // VirtualRegister is freed, then it may be reused for node.
+                if (node->flags() & NodeHasVarArgs) {
+                    for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++)
+                        scoreBoard.useIfHasResult(m_graph.m_varArgChildren[childIdx]);
+                } else {
+                    scoreBoard.useIfHasResult(node->child1());
+                    scoreBoard.useIfHasResult(node->child2());
+                    scoreBoard.useIfHasResult(node->child3());
+                }
+
+                if (!node->hasResult())
+                    continue;
+
+                VirtualRegister virtualRegister = scoreBoard.allocate();
+                node->setVirtualRegister(virtualRegister);
+                // 'mustGenerate' nodes have their useCount artificially elevated,
+                // call use now to account for this.
+                if (node->mustGenerate())
+                    scoreBoard.use(node);
+            }
+            scoreBoard.assertClear();
+        }
+        
+        // Record the number of virtual registers we're using. This is used by calls
+        // to figure out where to put the parameters.
+        m_graph.m_nextMachineLocal = scoreBoard.highWatermark();
+
+        return true;
+    }
+};
+
+bool performVirtualRegisterAllocation(Graph& graph)
+{
+    return runPhase<VirtualRegisterAllocationPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGVirtualRegisterAllocationPhase.h b/dfg/DFGVirtualRegisterAllocationPhase.h
new file mode 100644
index 0000000..4a4ee01
--- /dev/null
+++ b/dfg/DFGVirtualRegisterAllocationPhase.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGPhase.h"
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Prior to running this phase, we have no idea where in the call frame nodes
+// will have their values spilled. This phase fixes that by giving each node
+// a spill slot. The spill slot index (i.e. the virtual register) is also used
+// for look-up tables for the linear scan register allocator that the backend
+// uses.
+
+bool performVirtualRegisterAllocation(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGWatchpointCollectionPhase.cpp b/dfg/DFGWatchpointCollectionPhase.cpp
new file mode 100644
index 0000000..39e296a
--- /dev/null
+++ b/dfg/DFGWatchpointCollectionPhase.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGWatchpointCollectionPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayPrototype.h"
+#include "DFGClobberize.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+// FIXME: Remove this phase entirely by moving the addLazily() calls into either the backend or
+// into the phase that performs the optimization. Moving the calls into the backend makes the most
+// sense when the intermediate phases don't need to know that the watchpoint was set. Moving the
+// calls earlier usually only makes sense if the node's only purpose was to convey the need for
+// the watchpoint (like VarInjectionWatchpoint). But, it can also make sense if the fact that the
+// watchpoint was set enables other optimizations.
+// https://bugs.webkit.org/show_bug.cgi?id=144669
+
+namespace JSC { namespace DFG {
+
+class WatchpointCollectionPhase : public Phase {
+    static const bool verbose = false;
+    
+public:
+    WatchpointCollectionPhase(Graph& graph)
+        : Phase(graph, "watchpoint collection")
+    {
+    }
+    
+    bool run()
+    {
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+                m_node = block->at(nodeIndex);
+                handle();
+            }
+        }
+        
+        return true;
+    }
+
+private:
+    void handle()
+    {
+        switch (m_node->op()) {
+        case IsUndefined:
+            handleMasqueradesAsUndefined();
+            break;
+            
+        case CompareEq:
+            if (m_node->isBinaryUseKind(ObjectUse)
+                || (m_node->child1().useKind() == ObjectUse && m_node->child2().useKind() == ObjectOrOtherUse)
+                || (m_node->child1().useKind() == ObjectOrOtherUse && m_node->child2().useKind() == ObjectUse)
+                || (m_node->child1().useKind() == OtherUse || m_node->child2().useKind() == OtherUse))
+                handleMasqueradesAsUndefined();
+            break;
+            
+        case LogicalNot:
+        case Branch:
+            switch (m_node->child1().useKind()) {
+            case ObjectOrOtherUse:
+            case UntypedUse:
+                handleMasqueradesAsUndefined();
+                break;
+            default:
+                break;
+            }
+            break;
+            
+        default:
+            break;
+        }
+    }
+    
+    void handleMasqueradesAsUndefined()
+    {
+        if (m_graph.masqueradesAsUndefinedWatchpointIsStillValid(m_node->origin.semantic))
+            addLazily(globalObject()->masqueradesAsUndefinedWatchpoint());
+    }
+    
+    void addLazily(WatchpointSet* set)
+    {
+        m_graph.watchpoints().addLazily(set);
+    }
+    void addLazily(InlineWatchpointSet& set)
+    {
+        m_graph.watchpoints().addLazily(set);
+    }
+    
+    JSGlobalObject* globalObject()
+    {
+        return m_graph.globalObjectFor(m_node->origin.semantic);
+    }
+    
+    Node* m_node;
+};
+
+bool performWatchpointCollection(Graph& graph)
+{
+    return runPhase<WatchpointCollectionPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/dfg/DFGWatchpointCollectionPhase.h b/dfg/DFGWatchpointCollectionPhase.h
new file mode 100644
index 0000000..9166d29
--- /dev/null
+++ b/dfg/DFGWatchpointCollectionPhase.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Collects all desired watchpoints into the Graph::watchpoints() data structure.
+
+bool performWatchpointCollection(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
diff --git a/dfg/DFGWorklist.cpp b/dfg/DFGWorklist.cpp
new file mode 100644
index 0000000..114ca95
--- /dev/null
+++ b/dfg/DFGWorklist.cpp
@@ -0,0 +1,561 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGWorklist.h"
+
+#include "CodeBlock.h"
+#include "DFGLongLivedState.h"
+#include "DFGSafepoint.h"
+#include "DeferGC.h"
+#include "JSCInlines.h"
+#include "ReleaseHeapAccessScope.h"
+#include <mutex>
+
+namespace JSC { namespace DFG {
+
+#if ENABLE(DFG_JIT)
+
+class Worklist::ThreadBody : public AutomaticThread {
+public:
+    ThreadBody(const LockHolder& locker, Worklist& worklist, ThreadData& data, Box<Lock> lock, RefPtr<AutomaticThreadCondition> condition, int relativePriority)
+        : AutomaticThread(locker, lock, condition)
+        , m_worklist(worklist)
+        , m_data(data)
+        , m_relativePriority(relativePriority)
+    {
+    }
+    
+protected:
+    PollResult poll(const LockHolder& locker) override
+    {
+        if (m_worklist.m_queue.isEmpty())
+            return PollResult::Wait;
+        
+        m_plan = m_worklist.m_queue.takeFirst();
+        if (!m_plan) {
+            if (Options::verboseCompilationQueue()) {
+                m_worklist.dump(locker, WTF::dataFile());
+                dataLog(": Thread shutting down\n");
+            }
+            return PollResult::Stop;
+        }
+        RELEASE_ASSERT(m_plan->stage == Plan::Preparing);
+        m_worklist.m_numberOfActiveThreads++;
+        return PollResult::Work;
+    }
+    
+    class WorkScope;
+    friend class WorkScope;
+    class WorkScope {
+    public:
+        WorkScope(ThreadBody& thread)
+            : m_thread(thread)
+        {
+            RELEASE_ASSERT(m_thread.m_plan);
+            RELEASE_ASSERT(m_thread.m_worklist.m_numberOfActiveThreads);
+        }
+        
+        ~WorkScope()
+        {
+            LockHolder locker(*m_thread.m_worklist.m_lock);
+            m_thread.m_plan = nullptr;
+            m_thread.m_worklist.m_numberOfActiveThreads--;
+        }
+        
+    private:
+        ThreadBody& m_thread;
+    };
+    
+    WorkResult work() override
+    {
+        WorkScope workScope(*this);
+        
+        LockHolder locker(m_data.m_rightToRun);
+        {
+            LockHolder locker(*m_worklist.m_lock);
+            if (m_plan->stage == Plan::Cancelled)
+                return WorkResult::Continue;
+            m_plan->notifyCompiling();
+        }
+        
+        if (Options::verboseCompilationQueue())
+            dataLog(m_worklist, ": Compiling ", m_plan->key(), " asynchronously\n");
+        
+        // There's no way for the GC to be safepointing since we own rightToRun.
+        if (m_plan->vm->heap.collectorBelievesThatTheWorldIsStopped()) {
+            dataLog("Heap is stoped but here we are! (1)\n");
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+        m_plan->compileInThread(*m_longLivedState, &m_data);
+        if (m_plan->stage != Plan::Cancelled) {
+            if (m_plan->vm->heap.collectorBelievesThatTheWorldIsStopped()) {
+                dataLog("Heap is stopped but here we are! (2)\n");
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+        
+        {
+            LockHolder locker(*m_worklist.m_lock);
+            if (m_plan->stage == Plan::Cancelled)
+                return WorkResult::Continue;
+            
+            m_plan->notifyReady();
+            
+            if (Options::verboseCompilationQueue()) {
+                m_worklist.dump(locker, WTF::dataFile());
+                dataLog(": Compiled ", m_plan->key(), " asynchronously\n");
+            }
+            
+            m_worklist.m_readyPlans.append(m_plan);
+            
+            m_worklist.m_planCompiled.notifyAll();
+        }
+        RELEASE_ASSERT(!m_plan->vm->heap.collectorBelievesThatTheWorldIsStopped());
+        
+        return WorkResult::Continue;
+    }
+    
+    void threadDidStart() override
+    {
+        if (Options::verboseCompilationQueue())
+            dataLog(m_worklist, ": Thread started\n");
+        
+        if (m_relativePriority)
+            changeThreadPriority(currentThread(), m_relativePriority);
+        
+        m_compilationScope = std::make_unique<CompilationScope>();
+        m_longLivedState = std::make_unique<LongLivedState>();
+    }
+    
+    void threadIsStopping(const LockHolder&) override
+    {
+        // We're holding the Worklist::m_lock, so we should be careful not to deadlock.
+        
+        if (Options::verboseCompilationQueue())
+            dataLog(m_worklist, ": Thread will stop\n");
+        
+        ASSERT(!m_plan);
+        
+        m_compilationScope = nullptr;
+        m_longLivedState = nullptr;
+        m_plan = nullptr;
+    }
+    
+private:
+    Worklist& m_worklist;
+    ThreadData& m_data;
+    int m_relativePriority;
+    std::unique_ptr<CompilationScope> m_compilationScope;
+    std::unique_ptr<LongLivedState> m_longLivedState;
+    RefPtr<Plan> m_plan;
+};
+
+Worklist::Worklist(CString worklistName)
+    : m_threadName(toCString(worklistName, " Worker Thread"))
+    , m_lock(Box<Lock>::create())
+    , m_planEnqueued(AutomaticThreadCondition::create())
+    , m_numberOfActiveThreads(0)
+{
+}
+
+Worklist::~Worklist()
+{
+    {
+        LockHolder locker(*m_lock);
+        for (unsigned i = m_threads.size(); i--;)
+            m_queue.append(nullptr); // Use null plan to indicate that we want the thread to terminate.
+        m_planEnqueued->notifyAll(locker);
+    }
+    for (unsigned i = m_threads.size(); i--;)
+        m_threads[i]->m_thread->join();
+    ASSERT(!m_numberOfActiveThreads);
+}
+
+void Worklist::finishCreation(unsigned numberOfThreads, int relativePriority)
+{
+    RELEASE_ASSERT(numberOfThreads);
+    LockHolder locker(*m_lock);
+    for (unsigned i = numberOfThreads; i--;) {
+        std::unique_ptr<ThreadData> data = std::make_unique<ThreadData>(this);
+        data->m_thread = adoptRef(new ThreadBody(locker, *this, *data, m_lock, m_planEnqueued, relativePriority));
+        m_threads.append(WTFMove(data));
+    }
+}
+
+Ref<Worklist> Worklist::create(CString worklistName, unsigned numberOfThreads, int relativePriority)
+{
+    Ref<Worklist> result = adoptRef(*new Worklist(worklistName));
+    result->finishCreation(numberOfThreads, relativePriority);
+    return result;
+}
+
+bool Worklist::isActiveForVM(VM& vm) const
+{
+    LockHolder locker(*m_lock);
+    PlanMap::const_iterator end = m_plans.end();
+    for (PlanMap::const_iterator iter = m_plans.begin(); iter != end; ++iter) {
+        if (iter->value->vm == &vm)
+            return true;
+    }
+    return false;
+}
+
+void Worklist::enqueue(PassRefPtr<Plan> passedPlan)
+{
+    RefPtr<Plan> plan = passedPlan;
+    LockHolder locker(*m_lock);
+    if (Options::verboseCompilationQueue()) {
+        dump(locker, WTF::dataFile());
+        dataLog(": Enqueueing plan to optimize ", plan->key(), "\n");
+    }
+    ASSERT(m_plans.find(plan->key()) == m_plans.end());
+    m_plans.add(plan->key(), plan);
+    m_queue.append(plan);
+    m_planEnqueued->notifyOne(locker);
+}
+
+Worklist::State Worklist::compilationState(CompilationKey key)
+{
+    LockHolder locker(*m_lock);
+    PlanMap::iterator iter = m_plans.find(key);
+    if (iter == m_plans.end())
+        return NotKnown;
+    return iter->value->stage == Plan::Ready ? Compiled : Compiling;
+}
+
+void Worklist::waitUntilAllPlansForVMAreReady(VM& vm)
+{
+    DeferGC deferGC(vm.heap);
+    
+    // While we are waiting for the compiler to finish, the collector might have already suspended
+    // the compiler and then it will be waiting for us to stop. That's a deadlock. We avoid that
+    // deadlock by relinquishing our heap access, so that the collector pretends that we are stopped
+    // even if we aren't.
+    ReleaseHeapAccessScope releaseHeapAccessScope(vm.heap);
+    
+    // Wait for all of the plans for the given VM to complete. The idea here
+    // is that we want all of the caller VM's plans to be done. We don't care
+    // about any other VM's plans, and we won't attempt to wait on those.
+    // After we release this lock, we know that although other VMs may still
+    // be adding plans, our VM will not be.
+    
+    LockHolder locker(*m_lock);
+    
+    if (Options::verboseCompilationQueue()) {
+        dump(locker, WTF::dataFile());
+        dataLog(": Waiting for all in VM to complete.\n");
+    }
+    
+    for (;;) {
+        bool allAreCompiled = true;
+        PlanMap::iterator end = m_plans.end();
+        for (PlanMap::iterator iter = m_plans.begin(); iter != end; ++iter) {
+            if (iter->value->vm != &vm)
+                continue;
+            if (iter->value->stage != Plan::Ready) {
+                allAreCompiled = false;
+                break;
+            }
+        }
+        
+        if (allAreCompiled)
+            break;
+        
+        m_planCompiled.wait(*m_lock);
+    }
+}
+
+void Worklist::removeAllReadyPlansForVM(VM& vm, Vector<RefPtr<Plan>, 8>& myReadyPlans)
+{
+    DeferGC deferGC(vm.heap);
+    LockHolder locker(*m_lock);
+    for (size_t i = 0; i < m_readyPlans.size(); ++i) {
+        RefPtr<Plan> plan = m_readyPlans[i];
+        if (plan->vm != &vm)
+            continue;
+        if (plan->stage != Plan::Ready)
+            continue;
+        myReadyPlans.append(plan);
+        m_readyPlans[i--] = m_readyPlans.last();
+        m_readyPlans.removeLast();
+        m_plans.remove(plan->key());
+    }
+}
+
+void Worklist::removeAllReadyPlansForVM(VM& vm)
+{
+    Vector<RefPtr<Plan>, 8> myReadyPlans;
+    removeAllReadyPlansForVM(vm, myReadyPlans);
+}
+
+Worklist::State Worklist::completeAllReadyPlansForVM(VM& vm, CompilationKey requestedKey)
+{
+    DeferGC deferGC(vm.heap);
+    Vector<RefPtr<Plan>, 8> myReadyPlans;
+    
+    removeAllReadyPlansForVM(vm, myReadyPlans);
+    
+    State resultingState = NotKnown;
+
+    while (!myReadyPlans.isEmpty()) {
+        RefPtr<Plan> plan = myReadyPlans.takeLast();
+        CompilationKey currentKey = plan->key();
+        
+        if (Options::verboseCompilationQueue())
+            dataLog(*this, ": Completing ", currentKey, "\n");
+        
+        RELEASE_ASSERT(plan->stage == Plan::Ready);
+        
+        plan->finalizeAndNotifyCallback();
+        
+        if (currentKey == requestedKey)
+            resultingState = Compiled;
+    }
+    
+    if (!!requestedKey && resultingState == NotKnown) {
+        LockHolder locker(*m_lock);
+        if (m_plans.contains(requestedKey))
+            resultingState = Compiling;
+    }
+    
+    return resultingState;
+}
+
+void Worklist::completeAllPlansForVM(VM& vm)
+{
+    DeferGC deferGC(vm.heap);
+    waitUntilAllPlansForVMAreReady(vm);
+    completeAllReadyPlansForVM(vm);
+}
+
+void Worklist::suspendAllThreads()
+{
+    m_suspensionLock.lock();
+    for (unsigned i = m_threads.size(); i--;)
+        m_threads[i]->m_rightToRun.lock();
+}
+
+void Worklist::resumeAllThreads()
+{
+    for (unsigned i = m_threads.size(); i--;)
+        m_threads[i]->m_rightToRun.unlock();
+    m_suspensionLock.unlock();
+}
+
+void Worklist::visitWeakReferences(SlotVisitor& visitor)
+{
+    VM* vm = visitor.heap()->vm();
+    {
+        LockHolder locker(*m_lock);
+        for (PlanMap::iterator iter = m_plans.begin(); iter != m_plans.end(); ++iter) {
+            Plan* plan = iter->value.get();
+            if (plan->vm != vm)
+                continue;
+            plan->checkLivenessAndVisitChildren(visitor);
+        }
+    }
+    // This loop doesn't need locking because:
+    // (1) no new threads can be added to m_threads. Hence, it is immutable and needs no locks.
+    // (2) ThreadData::m_safepoint is protected by that thread's m_rightToRun which we must be
+    //     holding here because of a prior call to suspendAllThreads().
+    for (unsigned i = m_threads.size(); i--;) {
+        ThreadData* data = m_threads[i].get();
+        Safepoint* safepoint = data->m_safepoint;
+        if (safepoint && safepoint->vm() == vm)
+            safepoint->checkLivenessAndVisitChildren(visitor);
+    }
+}
+
+void Worklist::removeDeadPlans(VM& vm)
+{
+    {
+        LockHolder locker(*m_lock);
+        HashSet<CompilationKey> deadPlanKeys;
+        for (PlanMap::iterator iter = m_plans.begin(); iter != m_plans.end(); ++iter) {
+            Plan* plan = iter->value.get();
+            if (plan->vm != &vm)
+                continue;
+            if (plan->isKnownToBeLiveDuringGC())
+                continue;
+            RELEASE_ASSERT(plan->stage != Plan::Cancelled); // Should not be cancelled, yet.
+            ASSERT(!deadPlanKeys.contains(plan->key()));
+            deadPlanKeys.add(plan->key());
+        }
+        if (!deadPlanKeys.isEmpty()) {
+            for (HashSet<CompilationKey>::iterator iter = deadPlanKeys.begin(); iter != deadPlanKeys.end(); ++iter)
+                m_plans.take(*iter)->cancel();
+            Deque<RefPtr<Plan>> newQueue;
+            while (!m_queue.isEmpty()) {
+                RefPtr<Plan> plan = m_queue.takeFirst();
+                if (plan->stage != Plan::Cancelled)
+                    newQueue.append(plan);
+            }
+            m_queue.swap(newQueue);
+            for (unsigned i = 0; i < m_readyPlans.size(); ++i) {
+                if (m_readyPlans[i]->stage != Plan::Cancelled)
+                    continue;
+                m_readyPlans[i--] = m_readyPlans.last();
+                m_readyPlans.removeLast();
+            }
+        }
+    }
+    
+    // No locking needed for this part, see comment in visitWeakReferences().
+    for (unsigned i = m_threads.size(); i--;) {
+        ThreadData* data = m_threads[i].get();
+        Safepoint* safepoint = data->m_safepoint;
+        if (!safepoint)
+            continue;
+        if (safepoint->vm() != &vm)
+            continue;
+        if (safepoint->isKnownToBeLiveDuringGC())
+            continue;
+        safepoint->cancel();
+    }
+}
+
+void Worklist::removeNonCompilingPlansForVM(VM& vm)
+{
+    LockHolder locker(*m_lock);
+    HashSet<CompilationKey> deadPlanKeys;
+    Vector<RefPtr<Plan>> deadPlans;
+    for (auto& entry : m_plans) {
+        Plan* plan = entry.value.get();
+        if (plan->vm != &vm)
+            continue;
+        if (plan->stage == Plan::Compiling)
+            continue;
+        deadPlanKeys.add(plan->key());
+        deadPlans.append(plan);
+    }
+    for (CompilationKey key : deadPlanKeys)
+        m_plans.remove(key);
+    Deque<RefPtr<Plan>> newQueue;
+    while (!m_queue.isEmpty()) {
+        RefPtr<Plan> plan = m_queue.takeFirst();
+        if (!deadPlanKeys.contains(plan->key()))
+            newQueue.append(WTFMove(plan));
+    }
+    m_queue = WTFMove(newQueue);
+    m_readyPlans.removeAllMatching(
+        [&] (RefPtr<Plan>& plan) -> bool {
+            return deadPlanKeys.contains(plan->key());
+        });
+    for (auto& plan : deadPlans)
+        plan->cancel();
+}
+
+size_t Worklist::queueLength()
+{
+    LockHolder locker(*m_lock);
+    return m_queue.size();
+}
+
+void Worklist::dump(PrintStream& out) const
+{
+    LockHolder locker(*m_lock);
+    dump(locker, out);
+}
+
+void Worklist::dump(const LockHolder&, PrintStream& out) const
+{
+    out.print(
+        "Worklist(", RawPointer(this), ")[Queue Length = ", m_queue.size(),
+        ", Map Size = ", m_plans.size(), ", Num Ready = ", m_readyPlans.size(),
+        ", Num Active Threads = ", m_numberOfActiveThreads, "/", m_threads.size(), "]");
+}
+
+static Worklist* theGlobalDFGWorklist;
+
+Worklist& ensureGlobalDFGWorklist()
+{
+    static std::once_flag initializeGlobalWorklistOnceFlag;
+    std::call_once(initializeGlobalWorklistOnceFlag, [] {
+        theGlobalDFGWorklist = &Worklist::create("DFG Worklist", Options::numberOfDFGCompilerThreads(), Options::priorityDeltaOfDFGCompilerThreads()).leakRef();
+    });
+    return *theGlobalDFGWorklist;
+}
+
+Worklist* existingGlobalDFGWorklistOrNull()
+{
+    return theGlobalDFGWorklist;
+}
+
+static Worklist* theGlobalFTLWorklist;
+
+Worklist& ensureGlobalFTLWorklist()
+{
+    static std::once_flag initializeGlobalWorklistOnceFlag;
+    std::call_once(initializeGlobalWorklistOnceFlag, [] {
+        theGlobalFTLWorklist = &Worklist::create("FTL Worklist", Options::numberOfFTLCompilerThreads(), Options::priorityDeltaOfFTLCompilerThreads()).leakRef();
+    });
+    return *theGlobalFTLWorklist;
+}
+
+Worklist* existingGlobalFTLWorklistOrNull()
+{
+    return theGlobalFTLWorklist;
+}
+
+Worklist& ensureGlobalWorklistFor(CompilationMode mode)
+{
+    switch (mode) {
+    case InvalidCompilationMode:
+        RELEASE_ASSERT_NOT_REACHED();
+        return ensureGlobalDFGWorklist();
+    case DFGMode:
+        return ensureGlobalDFGWorklist();
+    case FTLMode:
+    case FTLForOSREntryMode:
+        return ensureGlobalFTLWorklist();
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return ensureGlobalDFGWorklist();
+}
+
+void completeAllPlansForVM(VM& vm)
+{
+    for (unsigned i = DFG::numberOfWorklists(); i--;) {
+        if (DFG::Worklist* worklist = DFG::existingWorklistForIndexOrNull(i))
+            worklist->completeAllPlansForVM(vm);
+    }
+}
+
+#else // ENABLE(DFG_JIT)
+
+void completeAllPlansForVM(VM&)
+{
+}
+
+void markCodeBlocks(VM&, SlotVisitor&)
+{
+}
+
+#endif // ENABLE(DFG_JIT)
+
+} } // namespace JSC::DFG
+
+
diff --git a/dfg/DFGWorklist.h b/dfg/DFGWorklist.h
new file mode 100644
index 0000000..3661e6e
--- /dev/null
+++ b/dfg/DFGWorklist.h
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGPlan.h"
+#include "DFGThreadData.h"
+#include <wtf/AutomaticThread.h>
+#include <wtf/Condition.h>
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/Lock.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class SlotVisitor;
+
+namespace DFG {
+
+#if ENABLE(DFG_JIT)
+
+class Worklist : public RefCounted<Worklist> {
+public:
+    enum State { NotKnown, Compiling, Compiled };
+
+    ~Worklist();
+    
+    static Ref<Worklist> create(CString worklistName, unsigned numberOfThreads, int relativePriority = 0);
+    
+    void enqueue(PassRefPtr<Plan>);
+    
+    // This is equivalent to:
+    // worklist->waitUntilAllPlansForVMAreReady(vm);
+    // worklist->completeAllReadyPlansForVM(vm);
+    void completeAllPlansForVM(VM&);
+
+    template<typename Func>
+    void iterateCodeBlocksForGC(VM&, const Func&);
+
+    void waitUntilAllPlansForVMAreReady(VM&);
+    State completeAllReadyPlansForVM(VM&, CompilationKey = CompilationKey());
+    void removeAllReadyPlansForVM(VM&);
+    
+    State compilationState(CompilationKey);
+    
+    size_t queueLength();
+    
+    void suspendAllThreads();
+    void resumeAllThreads();
+    
+    bool isActiveForVM(VM&) const;
+    
+    // Only called on the main thread after suspending all threads.
+    void visitWeakReferences(SlotVisitor&);
+    void removeDeadPlans(VM&);
+    
+    void removeNonCompilingPlansForVM(VM&);
+    
+    void dump(PrintStream&) const;
+    
+private:
+    Worklist(CString worklistName);
+    void finishCreation(unsigned numberOfThreads, int);
+    
+    class ThreadBody;
+    friend class ThreadBody;
+    
+    void runThread(ThreadData*);
+    static void threadFunction(void* argument);
+    
+    void removeAllReadyPlansForVM(VM&, Vector<RefPtr<Plan>, 8>&);
+
+    void dump(const LockHolder&, PrintStream&) const;
+    
+    CString m_threadName;
+    
+    // Used to inform the thread about what work there is left to do.
+    Deque<RefPtr<Plan>> m_queue;
+    
+    // Used to answer questions about the current state of a code block. This
+    // is particularly great for the cti_optimize OSR slow path, which wants
+    // to know: did I get here because a better version of me just got
+    // compiled?
+    typedef HashMap<CompilationKey, RefPtr<Plan>> PlanMap;
+    PlanMap m_plans;
+    
+    // Used to quickly find which plans have been compiled and are ready to
+    // be completed.
+    Vector<RefPtr<Plan>, 16> m_readyPlans;
+
+    Lock m_suspensionLock;
+    
+    Box<Lock> m_lock;
+    RefPtr<AutomaticThreadCondition> m_planEnqueued;
+    Condition m_planCompiled;
+    
+    Vector<std::unique_ptr<ThreadData>> m_threads;
+    unsigned m_numberOfActiveThreads;
+};
+
+// For DFGMode compilations.
+Worklist& ensureGlobalDFGWorklist();
+Worklist* existingGlobalDFGWorklistOrNull();
+
+// For FTLMode and FTLForOSREntryMode compilations.
+Worklist& ensureGlobalFTLWorklist();
+Worklist* existingGlobalFTLWorklistOrNull();
+
+Worklist& ensureGlobalWorklistFor(CompilationMode);
+
+// Simplify doing things for all worklists.
+inline unsigned numberOfWorklists() { return 2; }
+inline Worklist& ensureWorklistForIndex(unsigned index)
+{
+    switch (index) {
+    case 0:
+        return ensureGlobalDFGWorklist();
+    case 1:
+        return ensureGlobalFTLWorklist();
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return ensureGlobalDFGWorklist();
+    }
+}
+inline Worklist* existingWorklistForIndexOrNull(unsigned index)
+{
+    switch (index) {
+    case 0:
+        return existingGlobalDFGWorklistOrNull();
+    case 1:
+        return existingGlobalFTLWorklistOrNull();
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+inline Worklist& existingWorklistForIndex(unsigned index)
+{
+    Worklist* result = existingWorklistForIndexOrNull(index);
+    RELEASE_ASSERT(result);
+    return *result;
+}
+
+#endif // ENABLE(DFG_JIT)
+
+void completeAllPlansForVM(VM&);
+void markCodeBlocks(VM&, SlotVisitor&);
+
+template<typename Func>
+void iterateCodeBlocksForGC(VM&, const Func&);
+
+} } // namespace JSC::DFG
+
diff --git a/dfg/DFGWorklistInlines.h b/dfg/DFGWorklistInlines.h
new file mode 100644
index 0000000..8a5bfec
--- /dev/null
+++ b/dfg/DFGWorklistInlines.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGPlanInlines.h"
+#include "DFGWorklist.h"
+
+namespace JSC { namespace DFG {
+
+#if ENABLE(DFG_JIT)
+
+template<typename Func>
+void iterateCodeBlocksForGC(VM& vm, const Func& func)
+{
+    for (unsigned i = DFG::numberOfWorklists(); i--;) {
+        if (DFG::Worklist* worklist = DFG::existingWorklistForIndexOrNull(i))
+            worklist->iterateCodeBlocksForGC(vm, func);
+    }
+}
+
+template<typename Func>
+void Worklist::iterateCodeBlocksForGC(VM& vm, const Func& func)
+{
+    LockHolder locker(*m_lock);
+    for (PlanMap::iterator iter = m_plans.begin(); iter != m_plans.end(); ++iter) {
+        Plan* plan = iter->value.get();
+        if (plan->vm != &vm)
+            continue;
+        plan->iterateCodeBlocksForGC(func);
+    }
+}
+
+#else // ENABLE(DFG_JIT)
+
+template<typename Func>
+void iterateCodeBlocksForGC(VM&, const Func&)
+{
+}
+
+#endif // ENABLE(DFG_JIT)
+
+} } // namespace JSC::DFG
+
diff --git a/disassembler/ARM64/A64DOpcode.cpp b/disassembler/ARM64/A64DOpcode.cpp
new file mode 100644
index 0000000..98e3ba8
--- /dev/null
+++ b/disassembler/ARM64/A64DOpcode.cpp
@@ -0,0 +1,1217 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ARM64_DISASSEMBLER)
+
+#include "A64DOpcode.h"
+
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+
+namespace JSC { namespace ARM64Disassembler {
+
+A64DOpcode::OpcodeGroup* A64DOpcode::opcodeTable[32];
+
+const char* const A64DOpcode::s_conditionNames[16] = {
+    "eq", "ne", "hs", "lo", "mi", "pl", "vs", "vc",
+    "hi", "ls", "ge", "lt", "gt", "le", "al", "ne"
+};
+
+const char* const A64DOpcode::s_optionName[8] = {
+    "uxtb", "uxth", "uxtw", "uxtx", "sxtb", "sxth", "sxtw", "sxtx"
+};
+
+const char* const A64DOpcode::s_shiftNames[4] = {
+    "lsl", "lsr", "asl", "ror"
+};
+
+const char A64DOpcode::s_FPRegisterPrefix[5] = {
+    'b', 'h', 's', 'd', 'q'
+};
+
+struct OpcodeGroupInitializer {
+    unsigned m_opcodeGroupNumber;
+    uint32_t m_mask;
+    uint32_t m_pattern;
+    const char* (*m_format)(A64DOpcode*);
+};
+
+#define OPCODE_GROUP_ENTRY(groupIndex, groupClass) \
+{ groupIndex, groupClass::mask, groupClass::pattern, groupClass::format }
+
+static OpcodeGroupInitializer opcodeGroupList[] = {
+    OPCODE_GROUP_ENTRY(0x08, A64DOpcodeLoadStoreRegisterPair),
+    OPCODE_GROUP_ENTRY(0x09, A64DOpcodeLoadStoreRegisterPair),
+    OPCODE_GROUP_ENTRY(0x0a, A64DOpcodeLogicalShiftedRegister),
+    OPCODE_GROUP_ENTRY(0x0b, A64DOpcodeAddSubtractExtendedRegister),
+    OPCODE_GROUP_ENTRY(0x0b, A64DOpcodeAddSubtractShiftedRegister),
+    OPCODE_GROUP_ENTRY(0x11, A64DOpcodeAddSubtractImmediate),
+    OPCODE_GROUP_ENTRY(0x12, A64DOpcodeMoveWide),
+    OPCODE_GROUP_ENTRY(0x12, A64DOpcodeLogicalImmediate),
+    OPCODE_GROUP_ENTRY(0x13, A64DOpcodeBitfield),
+    OPCODE_GROUP_ENTRY(0x13, A64DOpcodeExtract),
+    OPCODE_GROUP_ENTRY(0x14, A64DOpcodeUnconditionalBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x14, A64DOpcodeConditionalBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x14, A64DOpcodeCompareAndBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x14, A64OpcodeExceptionGeneration),
+    OPCODE_GROUP_ENTRY(0x15, A64DOpcodeUnconditionalBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x15, A64DOpcodeConditionalBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x15, A64DOpcodeCompareAndBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x15, A64DOpcodeHint),
+    OPCODE_GROUP_ENTRY(0x15, A64DOpcodeDmbIsh),
+    OPCODE_GROUP_ENTRY(0x15, A64DOpcodeDmbIshSt),
+    OPCODE_GROUP_ENTRY(0x16, A64DOpcodeUnconditionalBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x16, A64DOpcodeUnconditionalBranchRegister),
+    OPCODE_GROUP_ENTRY(0x16, A64DOpcodeTestAndBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x17, A64DOpcodeUnconditionalBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x17, A64DOpcodeUnconditionalBranchRegister),
+    OPCODE_GROUP_ENTRY(0x17, A64DOpcodeTestAndBranchImmediate),
+    OPCODE_GROUP_ENTRY(0x18, A64DOpcodeLoadStoreImmediate),
+    OPCODE_GROUP_ENTRY(0x18, A64DOpcodeLoadStoreRegisterOffset),
+    OPCODE_GROUP_ENTRY(0x19, A64DOpcodeLoadStoreUnsignedImmediate),
+    OPCODE_GROUP_ENTRY(0x1a, A64DOpcodeConditionalSelect),
+    OPCODE_GROUP_ENTRY(0x1a, A64DOpcodeDataProcessing2Source),
+    OPCODE_GROUP_ENTRY(0x1b, A64DOpcodeDataProcessing3Source),
+    OPCODE_GROUP_ENTRY(0x1c, A64DOpcodeLoadStoreImmediate),
+    OPCODE_GROUP_ENTRY(0x1c, A64DOpcodeLoadStoreRegisterOffset),
+    OPCODE_GROUP_ENTRY(0x1d, A64DOpcodeLoadStoreUnsignedImmediate),
+    OPCODE_GROUP_ENTRY(0x1e, A64DOpcodeFloatingPointCompare),
+    OPCODE_GROUP_ENTRY(0x1e, A64DOpcodeFloatingPointDataProcessing2Source),
+    OPCODE_GROUP_ENTRY(0x1e, A64DOpcodeFloatingPointDataProcessing1Source),
+    OPCODE_GROUP_ENTRY(0x1e, A64DOpcodeFloatingFixedPointConversions),
+    OPCODE_GROUP_ENTRY(0x1e, A64DOpcodeFloatingPointIntegerConversions),
+};
+
+bool A64DOpcode::s_initialized = false;
+
+void A64DOpcode::init()
+{
+    if (s_initialized)
+        return;
+
+    OpcodeGroup* lastGroups[32];
+
+    for (unsigned i = 0; i < 32; i++) {
+        opcodeTable[i] = 0;
+        lastGroups[i] = 0;
+    }
+
+    for (unsigned i = 0; i < sizeof(opcodeGroupList) / sizeof(struct OpcodeGroupInitializer); i++) {
+        OpcodeGroup* newOpcodeGroup = new OpcodeGroup(opcodeGroupList[i].m_mask, opcodeGroupList[i].m_pattern, opcodeGroupList[i].m_format);
+        uint32_t opcodeGroupNumber = opcodeGroupList[i].m_opcodeGroupNumber;
+
+        if (!opcodeTable[opcodeGroupNumber])
+            opcodeTable[opcodeGroupNumber] = newOpcodeGroup;
+        else
+            lastGroups[opcodeGroupNumber]->setNext(newOpcodeGroup);
+        lastGroups[opcodeGroupNumber] = newOpcodeGroup;
+    }
+
+    s_initialized = true;
+}
+
+void A64DOpcode::setPCAndOpcode(uint32_t* newPC, uint32_t newOpcode)
+{
+    m_currentPC = newPC;
+    m_opcode = newOpcode;
+    m_bufferOffset = 0;
+    m_formatBuffer[0] = '\0';
+}
+
+const char* A64DOpcode::disassemble(uint32_t* currentPC)
+{
+    setPCAndOpcode(currentPC, *currentPC);
+
+    OpcodeGroup* opGroup = opcodeTable[opcodeGroupNumber(m_opcode)];
+
+    while (opGroup) {
+        if (opGroup->matches(m_opcode))
+            return opGroup->format(this);
+        opGroup = opGroup->next();
+    }
+
+    return A64DOpcode::format();
+}
+
+void A64DOpcode::bufferPrintf(const char* format, ...)
+{
+    if (m_bufferOffset >= bufferSize)
+        return;
+
+    va_list argList;
+    va_start(argList, format);
+
+    m_bufferOffset += vsnprintf(m_formatBuffer + m_bufferOffset, bufferSize - m_bufferOffset, format, argList);
+
+    va_end(argList);
+}
+
+const char* A64DOpcode::format()
+{
+    bufferPrintf("   .long  %08x", m_opcode);
+    return m_formatBuffer;
+}
+
+void A64DOpcode::appendRegisterName(unsigned registerNumber, bool is64Bit)
+{
+    if (registerNumber == 29) {
+        bufferPrintf(is64Bit ? "fp" : "wfp");
+        return;
+    }
+
+    if (registerNumber == 30) {
+        bufferPrintf(is64Bit ? "lr" : "wlr");
+        return;
+    }
+
+    bufferPrintf("%c%u", is64Bit ? 'x' : 'w', registerNumber);
+}
+
+void A64DOpcode::appendFPRegisterName(unsigned registerNumber, unsigned registerSize)
+{
+    bufferPrintf("%c%u", FPRegisterPrefix(registerSize), registerNumber);
+}
+
+const char* const A64DOpcodeAddSubtract::s_opNames[4] = { "add", "adds", "sub", "subs" };
+
+const char* A64DOpcodeAddSubtractImmediate::format()
+{
+    if (isCMP())
+        appendInstructionName(cmpName());
+    else {
+        if (isMovSP())
+            appendInstructionName("mov");
+        else
+            appendInstructionName(opName());
+        appendSPOrRegisterName(rd(), is64Bit());
+        appendSeparator();
+    }
+    appendSPOrRegisterName(rn(), is64Bit());
+
+    if (!isMovSP()) {
+        appendSeparator();
+        appendUnsignedImmediate(immed12());
+        if (shift()) {
+            appendSeparator();
+            appendString(shift() == 1 ? "lsl" : "reserved");
+        }
+    }
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeAddSubtractExtendedRegister::format()
+{
+    if (immediate3() > 4)
+        return A64DOpcode::format();
+
+    if (isCMP())
+        appendInstructionName(cmpName());
+    else {
+        appendInstructionName(opName());
+        appendSPOrRegisterName(rd(), is64Bit());
+        appendSeparator();
+    }
+    appendSPOrRegisterName(rn(), is64Bit());
+    appendSeparator();
+    appendZROrRegisterName(rm(), is64Bit() && ((option() & 0x3) == 0x3));
+    appendSeparator();
+    if (option() == 0x2 && ((rd() == 31) || (rn() == 31)))
+        appendString("lsl");
+    else
+        appendString(optionName());
+    if (immediate3()) {
+        appendCharacter(' ');
+        appendUnsignedImmediate(immediate3());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeAddSubtractShiftedRegister::format()
+{
+    if (!is64Bit() && immediate6() & 0x20)
+        return A64DOpcode::format();
+
+    if (shift() == 0x3)
+        return A64DOpcode::format();
+
+    if (isCMP())
+        appendInstructionName(cmpName());
+    else {
+        if (isNeg())
+            appendInstructionName(cmpName());
+        else
+            appendInstructionName(opName());
+        appendSPOrRegisterName(rd(), is64Bit());
+        appendSeparator();
+    }
+    if (!isNeg()) {
+        appendRegisterName(rn(), is64Bit());
+        appendSeparator();
+    }
+    appendZROrRegisterName(rm(), is64Bit());
+    if (immediate6()) {
+        appendSeparator();
+        appendShiftType(shift());
+        appendUnsignedImmediate(immediate6());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeBitfield::s_opNames[3] = { "sbfm", "bfm", "ubfm" };
+const char* const A64DOpcodeBitfield::s_extendPseudoOpNames[3][3] = {
+    { "sxtb", "sxth", "sxtw" }, { 0, 0, 0} , { "uxtb", "uxth", "uxtw" } };
+const char* const A64DOpcodeBitfield::s_insertOpNames[3] = { "sbfiz", "bfi", "ubfiz" };
+const char* const A64DOpcodeBitfield::s_extractOpNames[3] = { "sbfx", "bf", "ubfx" };
+
+const char* A64DOpcodeBitfield::format()
+{
+    if (opc() == 0x3)
+        return A64DOpcode::format();
+
+    if (is64Bit() != nBit())
+        return A64DOpcode::format();
+
+    if (!is64Bit() && ((immediateR() & 0x20) || (immediateS() & 0x20)))
+        return A64DOpcode::format();
+
+    if (!(opc() & 0x1) && !immediateR()) {
+        // [un]signed {btye,half-word,word} extend
+        bool isSTXType = false;
+        if (immediateS() == 7) {
+            appendInstructionName(extendPseudoOpNames(0));
+            isSTXType = true;
+        } else if (immediateS() == 15) {
+            appendInstructionName(extendPseudoOpNames(1));
+            isSTXType = true;
+        } else if (immediateS() == 31 && is64Bit()) {
+            appendInstructionName(extendPseudoOpNames(2));
+            isSTXType = true;
+        }
+
+        if (isSTXType) {
+            appendRegisterName(rd(), is64Bit());
+            appendSeparator();
+            appendRegisterName(rn(), false);
+
+            return m_formatBuffer;
+        }
+    }
+
+    if (opc() == 0x2 && immediateS() == (immediateR() + 1)) {
+        // lsl
+        appendInstructionName("lsl");
+        appendRegisterName(rd(), is64Bit());
+        appendSeparator();
+        appendRegisterName(rn(), is64Bit());
+        appendSeparator();
+        appendUnsignedImmediate((is64Bit() ? 63u : 31u) - immediateR());
+
+        return m_formatBuffer;
+    } else if (!(opc() & 0x1) && ((immediateS() & 0x1f) == 0x1f) && (is64Bit() == (immediateS() >> 5))) {
+        // asr/lsr
+        appendInstructionName(!opc() ? "ars" : "lsr");
+
+        appendRegisterName(rd(), is64Bit());
+        appendSeparator();
+        appendRegisterName(rn(), is64Bit());
+        appendSeparator();
+        appendUnsignedImmediate(immediateR());
+
+        return m_formatBuffer;
+    } else if (immediateS() < immediateR()) {
+        // bit field insert
+        appendInstructionName(insertOpNames());
+
+        appendRegisterName(rd(), is64Bit());
+        appendSeparator();
+        appendRegisterName(rn(), is64Bit());
+        appendSeparator();
+        appendUnsignedImmediate((is64Bit() ? 64u : 32u) - immediateR());
+        appendSeparator();
+        appendUnsignedImmediate(immediateS() + 1);
+
+        return m_formatBuffer;
+    } else {
+        // bit field extract
+        appendInstructionName(extractOpNames());
+
+        appendRegisterName(rd(), is64Bit());
+        appendSeparator();
+        appendRegisterName(rn(), is64Bit());
+        appendSeparator();
+        appendUnsignedImmediate(immediateR());
+        appendSeparator();
+        appendUnsignedImmediate(immediateS() - immediateR() + 1);
+
+        return m_formatBuffer;
+    }
+
+    appendInstructionName(opName());
+    appendRegisterName(rd(), is64Bit());
+    appendSeparator();
+    appendRegisterName(rn(), is64Bit());
+    appendSeparator();
+    appendUnsignedImmediate(immediateR());
+    appendSeparator();
+    appendUnsignedImmediate(immediateS());
+
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeCompareAndBranchImmediate::format()
+{
+    appendInstructionName(opBit() ? "cbnz" : "cbz");
+    appendRegisterName(rt(), is64Bit());
+    appendSeparator();    
+    appendPCRelativeOffset(m_currentPC, static_cast<int32_t>(immediate19()));
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeConditionalBranchImmediate::format()
+{
+    bufferPrintf("   b.%-5.5s", conditionName(condition()));
+    appendPCRelativeOffset(m_currentPC, static_cast<int32_t>(immediate19()));
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeConditionalSelect::s_opNames[4] = {
+    "csel", "csinc", "csinv", "csneg"
+};
+
+const char* A64DOpcodeConditionalSelect::format()
+{
+    if (sBit())
+        return A64DOpcode::format();
+
+    if (op2() & 0x2)
+        return A64DOpcode::format();
+
+    if (rn() == rm() && (opNum() == 1 || opNum() == 2)) {
+        if (rn() == 31) {
+            appendInstructionName((opNum() == 1) ? "cset" : "csetm");
+            appendRegisterName(rd(), is64Bit());
+        } else {
+            appendInstructionName((opNum() == 1) ? "cinc" : "cinv");
+            appendRegisterName(rd(), is64Bit());
+            appendSeparator();
+            appendZROrRegisterName(rn(), is64Bit());
+        }
+        appendSeparator();
+        appendString(conditionName(condition() ^ 0x1));
+
+        return m_formatBuffer;
+    }
+
+    appendInstructionName(opName());
+    appendRegisterName(rd(), is64Bit());
+    appendSeparator();
+    appendZROrRegisterName(rn(), is64Bit());
+    appendSeparator();
+    appendZROrRegisterName(rm(), is64Bit());
+    appendSeparator();
+    appendString(conditionName(condition()));
+
+    return m_formatBuffer;
+
+}
+
+const char* const A64DOpcodeDataProcessing2Source::s_opNames[8] = {
+    0, 0, "udiv", "sdiv", "lsl", "lsr", "asr", "ror" // We use the pseudo-op names for the shift/rotate instructions
+};
+
+const char* A64DOpcodeDataProcessing2Source::format()
+{
+    if (sBit())
+        return A64DOpcode::format();
+
+    if (!(opCode() & 0x3e))
+        return A64DOpcode::format();
+
+    if (opCode() & 0x30)
+        return A64DOpcode::format();
+
+    if ((opCode() & 0x34) == 0x4)
+        return A64DOpcode::format();
+
+    appendInstructionName(opName());
+    appendRegisterName(rd(), is64Bit());
+    appendSeparator();
+    appendRegisterName(rn(), is64Bit());
+    appendSeparator();
+    appendRegisterName(rm(), is64Bit());
+
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeDataProcessing3Source::s_opNames[16] = {
+    "madd", "msub", "smaddl", "smsubl", "smulh", 0, 0, 0,
+    0, 0, "umaddl", "umsubl", "umulh", 0, 0, 0
+};
+
+const char* const A64DOpcodeDataProcessing3Source::s_pseudoOpNames[16] = {
+    "mul", "mneg", "smull", "smnegl", "smulh", 0, 0, 0,
+    0, 0, "umull", "umnegl", "umulh", 0, 0, 0
+};
+
+const char* A64DOpcodeDataProcessing3Source::format()
+{
+    if (op54())
+        return A64DOpcode::format();
+
+    if (opNum() > 12)
+        return A64DOpcode::format();
+
+    if (!is64Bit() && opNum() > 1)
+        return A64DOpcode::format();
+
+    if (!opName())
+        return A64DOpcode::format();
+
+    appendInstructionName(opName());
+    appendRegisterName(rd(), is64Bit());
+    appendSeparator();
+    bool srcOneAndTwoAre64Bit = is64Bit() & !(opNum() & 0x2);
+    appendRegisterName(rn(), srcOneAndTwoAre64Bit);
+    appendSeparator();
+    appendRegisterName(rm(), srcOneAndTwoAre64Bit);
+
+    if ((ra() != 31) || !(opNum() & 0x4)) {
+        appendSeparator();
+        appendRegisterName(ra(), is64Bit());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* A64OpcodeExceptionGeneration::format()
+{
+    const char* opname = 0;
+    if (!op2()) {
+        switch (opc()) {
+        case 0x0: // SVC, HVC & SMC
+            switch (ll()) {
+            case 0x1:
+                opname = "svc";
+                break;
+            case 0x2:
+                opname = "hvc";
+                break;
+            case 0x3:
+                opname = "smc";
+                break;
+            }
+            break;
+        case 0x1: // BRK
+            if (!ll())
+                opname = "brk";
+            break;
+        case 0x2: // HLT
+            if (!ll())
+                opname = "hlt";
+            break;
+        case 0x5: // DPCS1-3
+            switch (ll()) {
+            case 0x1:
+                opname = "dpcs1";
+                break;
+            case 0x2:
+                opname = "dpcs2";
+                break;
+            case 0x3:
+                opname = "dpcs3";
+                break;
+            }
+            break;
+        }
+    }
+
+    if (!opname)
+        return A64DOpcode::format();
+
+    appendInstructionName(opname);
+    appendUnsignedImmediate(immediate16());
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeExtract::format()
+{
+    if (!op21() || !o0Bit())
+        return A64DOpcode::format();
+
+    if (is64Bit() != nBit())
+        return A64DOpcode::format();
+
+    if (is64Bit() && (immediateS() & 0x20))
+        return A64DOpcode::format();
+
+    const char* opName = (rn() == rm()) ? "ror" : "extr";
+
+    appendInstructionName(opName);
+    appendRegisterName(rd(), is64Bit());
+    appendSeparator();
+    appendRegisterName(rn(), is64Bit());
+    appendSeparator();
+    appendRegisterName(rm(), is64Bit());
+    appendSeparator();
+    appendUnsignedImmediate(immediateS());
+
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeFloatingPointCompare::format()
+{
+    if (mBit())
+        return A64DOpcode::format();
+
+    if (sBit())
+        return A64DOpcode::format();
+
+    if (type() & 0x2)
+        return A64DOpcode::format();
+
+    if (op())
+        return A64DOpcode::format();
+
+    if (opCode2() & 0x7)
+        return A64DOpcode::format();
+
+    appendInstructionName(opName());
+    unsigned registerSize = type() + 2;
+    appendFPRegisterName(rn(), registerSize);
+    appendSeparator();
+    if (opCode2() & 0x8)
+        bufferPrintf("#0.0");
+    else
+        appendFPRegisterName(rm(), registerSize);
+    
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeFloatingPointDataProcessing1Source::s_opNames[16] = {
+    "fmov", "fabs", "fneg", "fsqrt", "fcvt", "fcvt", 0, "fcvt",
+    "frintn", "frintp", "frintm", "frintz", "frinta", 0, "frintx", "frinti"
+};
+
+const char* A64DOpcodeFloatingPointDataProcessing1Source::format()
+{
+    if (mBit())
+        return A64DOpcode::format();
+
+    if (sBit())
+        return A64DOpcode::format();
+
+    if (opNum() > 16)
+        return A64DOpcode::format();
+
+    switch (type()) {
+    case 0:
+        if ((opNum() == 0x4) || (opNum() == 0x6) || (opNum() == 0xd))
+            return A64DOpcode::format();
+        break;
+    case 1:
+        if ((opNum() == 0x5) || (opNum() == 0x6) || (opNum() == 0xd))
+            return A64DOpcode::format();
+        break;
+    case 2:
+        return A64DOpcode::format();
+    case 3:
+        if ((opNum() < 0x4) || (opNum() > 0x5))
+            return A64DOpcode::format();
+        break;
+    }
+
+    appendInstructionName(opName());
+    if ((opNum() >= 0x4) && (opNum() <= 0x7)) {
+        unsigned srcRegisterSize = type() ^ 0x2; // 0:s, 1:d & 3:h
+        unsigned destRegisterSize = (opNum() & 0x3) ^ 0x2;
+        appendFPRegisterName(rd(), destRegisterSize);
+        appendSeparator();
+        appendFPRegisterName(rn(), srcRegisterSize);
+    } else {
+        unsigned registerSize = type() + 2;
+        appendFPRegisterName(rd(), registerSize);
+        appendSeparator();
+        appendFPRegisterName(rn(), registerSize);
+    }
+
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeFloatingPointDataProcessing2Source::s_opNames[16] = {
+    "fmul", "fdiv", "fadd", "fsub", "fmax", "fmin", "fmaxnm", "fminnm", "fnmul"
+};
+
+const char* A64DOpcodeFloatingPointDataProcessing2Source::format()
+{
+    if (mBit())
+        return A64DOpcode::format();
+
+    if (sBit())
+        return A64DOpcode::format();
+
+    if (type() & 0x2)
+        return A64DOpcode::format();
+
+    if (opNum() > 8)
+        return A64DOpcode::format();
+
+    appendInstructionName(opName());
+    unsigned registerSize = type() + 2;
+    appendFPRegisterName(rd(), registerSize);
+    appendSeparator();
+    appendFPRegisterName(rn(), registerSize);
+    appendSeparator();
+    appendFPRegisterName(rm(), registerSize);
+
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeFloatingFixedPointConversions::s_opNames[4] = {
+    "fcvtzs", "fcvtzu", "scvtf", "ucvtf"
+};
+
+const char* A64DOpcodeFloatingFixedPointConversions::format()
+{
+    if (sBit())
+        return A64DOpcode::format();
+
+    if (type() & 0x2)
+        return A64DOpcode::format();
+
+    if (opcode() & 0x4)
+        return A64DOpcode::format();
+
+    if (!(rmode() & 0x1) && !(opcode() & 0x6))
+        return A64DOpcode::format();
+
+    if ((rmode() & 0x1) && (opcode() & 0x6) == 0x2)
+        return A64DOpcode::format();
+
+    if (!(rmode() & 0x2) && !(opcode() & 0x6))
+        return A64DOpcode::format();
+
+    if ((rmode() & 0x2) && (opcode() & 0x6) == 0x2)
+        return A64DOpcode::format();
+
+    if (!is64Bit() && scale() >= 32)
+        return A64DOpcode::format();
+
+    appendInstructionName(opName());
+    unsigned FPRegisterSize = type() + 2;
+    bool destIsFP = !rmode();
+    
+    if (destIsFP) {
+        appendFPRegisterName(rd(), FPRegisterSize);
+        appendSeparator();
+        appendRegisterName(rn(), is64Bit());
+    } else {
+        appendRegisterName(rd(), is64Bit());
+        appendSeparator();
+        appendFPRegisterName(rn(), FPRegisterSize);
+    }
+    appendSeparator();
+    appendUnsignedImmediate(64 - scale());
+    
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeFloatingPointIntegerConversions::s_opNames[32] = {
+    "fcvtns", "fcvtnu", "scvtf", "ucvtf", "fcvtas", "fcvtau", "fmov", "fmov",
+    "fcvtps", "fcvtpu", 0, 0, 0, 0, "fmov", "fmov",
+    "fcvtms", "fcvtmu", 0, 0, 0, 0, 0, 0,
+    "fcvtzs", "fcvtzu", 0, 0, 0, 0, 0, 0
+};
+
+const char* A64DOpcodeFloatingPointIntegerConversions::format()
+{
+    if (sBit())
+        return A64DOpcode::format();
+
+    if (type() == 0x3)
+        return A64DOpcode::format();
+
+    if (((rmode() & 0x1) || (rmode() & 0x2)) && (((opcode() & 0x6) == 0x2) || ((opcode() & 0x6) == 0x4)))
+        return A64DOpcode::format();
+
+    if ((type() == 0x2) && (!(opcode() & 0x4) || ((opcode() & 0x6) == 0x4)))
+        return A64DOpcode::format();
+
+    if (!type() && (rmode() & 0x1) && ((opcode() & 0x6) == 0x6))
+        return A64DOpcode::format();
+
+    if (is64Bit() && type() == 0x2 && ((opNum() & 0xe) == 0x6))
+        return A64DOpcode::format();
+
+    if (!opName())
+        return A64DOpcode::format();
+
+    if ((opNum() & 0x1e) == 0xe) {
+        // Handle fmov to/from upper half of quad separately
+        if (!is64Bit() || (type() != 0x2))
+            return A64DOpcode::format();
+
+        appendInstructionName(opName());
+        if (opcode() & 0x1) {
+            // fmov Vd.D[1], Xn
+            bufferPrintf("V%u.D[1]", rd());
+            appendSeparator();
+            appendRegisterName(rn());
+        } else {
+            // fmov Xd, Vn.D[1]
+            appendRegisterName(rd());
+            appendSeparator();
+            bufferPrintf("V%u.D[1]", rn());
+        }
+
+        return m_formatBuffer;
+    }
+
+    appendInstructionName(opName());
+    unsigned FPRegisterSize = type() + 2;
+    bool destIsFP = ((opNum() == 2) || (opNum() == 3) || (opNum() == 7));
+
+    if (destIsFP) {
+        appendFPRegisterName(rd(), FPRegisterSize);
+        appendSeparator();
+        appendRegisterName(rn(), is64Bit());
+    } else {
+        appendRegisterName(rd(), is64Bit());
+        appendSeparator();
+        appendFPRegisterName(rn(), FPRegisterSize);
+    }
+
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeHint::s_opNames[6] = {
+    "nop", "yield", "wfe", "wfi", "sev", "sevl"
+};
+
+const char* A64DOpcodeHint::format()
+{
+    appendInstructionName(opName());
+
+    if (immediate7() > 5)
+        appendUnsignedImmediate(immediate7());
+
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeDmbIsh::format()
+{
+    appendInstructionName("dmb");
+    appendString("ish");
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeDmbIshSt::format()
+{
+    appendInstructionName("dmb");
+    appendString("ishst");
+    return m_formatBuffer;
+}
+
+// A zero in an entry of the table means the instruction is Unallocated
+const char* const A64DOpcodeLoadStore::s_opNames[32] = {
+    "strb", "ldrb", "ldrsb", "ldrsb", "str", "ldr", "str", "ldr",
+    "strh", "ldrh", "ldrsh", "ldrsh", "str", "ldr", 0, 0,
+    "str", "ldr", "ldrsw", 0, "str", "ldr", 0, 0,
+    "str", "ldr", 0, 0, "str", "ldr", 0, 0
+};
+
+// A zero in an entry of the table means the instruction is Unallocated
+const char* const A64DOpcodeLoadStoreImmediate::s_unprivilegedOpNames[32] = {
+    "sttrb", "ldtrb", "ldtrsb", "ldtrsb", 0, 0, 0, 0,
+    "sttrh", "ldtrh", "ldtrsh", "ldtrsh", 0, 0, 0, 0,
+    "sttr", "ldtr", "ldtrsw", 0, 0, 0, 0, 0,
+    "sttr", "ldtr", 0, 0, 0, 0, 0, 0
+};
+
+// A zero in an entry of the table means the instruction is Unallocated
+const char* const A64DOpcodeLoadStoreImmediate::s_unscaledOpNames[32] = {
+    "sturb", "ldurb", "ldursb", "ldursb", "stur", "ldur", "stur", "ldur",
+    "sturh", "ldurh", "ldursh", "ldursh", "stur", "ldur", 0, 0,
+    "stur", "ldur", "ldursw", 0, "stur", "ldur", 0, 0,
+    "stur", "ldur", "prfum", 0, "stur", "ldur", 0, 0
+};
+
+const char* A64DOpcodeLoadStoreImmediate::format()
+{
+    const char* thisOpName;
+
+    if (type() & 0x1)
+        thisOpName = opName();
+    else if (!type())
+        thisOpName = unscaledOpName();
+    else
+        thisOpName = unprivilegedOpName();
+
+    if (!thisOpName)
+        return A64DOpcode::format();
+
+    appendInstructionName(thisOpName);
+    if (vBit())
+        appendFPRegisterName(rt(), size());
+    else
+        appendRegisterName(rt(), is64BitRT());
+    appendSeparator();
+    appendCharacter('[');
+    appendSPOrRegisterName(rn());
+
+    switch (type()) {
+    case 0: // Unscaled Immediate
+        if (immediate9()) {
+            appendSeparator();
+            appendSignedImmediate(immediate9());
+        }
+        appendCharacter(']');
+        break;
+    case 1: // Immediate Post-Indexed
+        appendCharacter(']');
+        if (immediate9()) {
+            appendSeparator();
+            appendSignedImmediate(immediate9());
+        }
+        break;
+    case 2: // Unprivileged
+        if (immediate9()) {
+            appendSeparator();
+            appendSignedImmediate(immediate9());
+        }
+        appendCharacter(']');
+        break;
+    case 3: // Immediate Pre-Indexed
+        if (immediate9()) {
+            appendSeparator();
+            appendSignedImmediate(immediate9());
+        }
+        appendCharacter(']');
+        appendCharacter('!');
+        break;
+    }
+
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeLoadStoreRegisterOffset::format()
+{
+    const char* thisOpName = opName();
+
+    if (!thisOpName)
+        return A64DOpcode::format();
+
+    if (!(option() & 0x2))
+        return A64DOpcode::format();
+
+    appendInstructionName(thisOpName);
+    unsigned scale;
+    if (vBit()) {
+        appendFPRegisterName(rt(), size());
+        scale = ((opc() & 2)<<1) | size();
+    } else {
+        appendRegisterName(rt(), is64BitRT());
+        scale = size();
+    }
+    appendSeparator();
+    appendCharacter('[');
+    appendSPOrRegisterName(rn());
+    appendSeparator();
+    appendZROrRegisterName(rm(), (option() & 0x3) == 0x3);
+
+    unsigned shift = sBit() ? scale : 0;
+
+    if (option() == 0x3) {
+        if (shift) {
+            appendSeparator();
+            appendString("lsl ");
+            appendUnsignedImmediate(shift);
+        }
+    } else {
+        appendSeparator();
+        appendString(optionName());
+        if (shift)
+            appendUnsignedImmediate(shift);
+    }
+
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeLoadStoreRegisterPair::opName()
+{
+    if (!vBit() && lBit() && size() == 0x1)
+        return "ldpsw";
+    if (lBit())
+        return "ldp";
+    return "stp";
+}
+
+const char* A64DOpcodeLoadStoreRegisterPair::format()
+{
+    const char* thisOpName = opName();
+    
+    if (size() == 0x3)
+        return A64DOpcode::format();
+
+    if ((offsetMode() < 0x1) || (offsetMode() > 0x3))
+        return A64DOpcode::format();
+
+    if ((offsetMode() == 0x1) && !vBit() && !lBit())
+        return A64DOpcode::format();
+
+    appendInstructionName(thisOpName);
+    unsigned offsetShift;
+    if (vBit()) {
+        appendFPRegisterName(rt(), size());
+        appendSeparator();
+        appendFPRegisterName(rt2(), size());
+        offsetShift = size() + 2;
+    } else {
+        appendRegisterName(rt(), is64Bit());
+        appendSeparator();
+        appendRegisterName(rt2(), is64Bit());
+        offsetShift = (size() >> 1) + 2;
+    }
+
+    appendSeparator();
+    appendCharacter('[');
+    appendSPOrRegisterName(rn());
+
+    int offset = immediate7() << offsetShift;
+
+    if (offsetMode() == 1) {
+        appendCharacter(']');
+        appendSeparator();
+        appendSignedImmediate(offset);
+    } else {
+        appendSeparator();
+        appendSignedImmediate(offset);
+        appendCharacter(']');
+        if (offsetMode() == 0x3)
+            appendCharacter('!');
+    }
+
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeLoadStoreUnsignedImmediate::format()
+{
+    const char* thisOpName = opName();
+
+    if (!thisOpName)
+        return A64DOpcode::format();
+
+    appendInstructionName(thisOpName);
+    unsigned scale;
+    if (vBit()) {
+        appendFPRegisterName(rt(), size());
+        scale = ((opc() & 2)<<1) | size();
+    } else {
+        appendRegisterName(rt(), is64BitRT());
+        scale = size();
+    }
+    appendSeparator();
+    appendCharacter('[');
+    appendSPOrRegisterName(rn());
+
+    if (immediate12()) {
+        appendSeparator();
+        appendUnsignedImmediate(immediate12() << scale);
+    }
+
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+// A zero in an entry of the table means the instruction is Unallocated
+const char* const A64DOpcodeLogical::s_opNames[8] = {
+    "and", "bic", "orr", "orn", "eor", "eon", "ands", "bics"
+};
+
+const char* A64DOpcodeLogicalShiftedRegister::format()
+{
+    if (!is64Bit() && immediate6() & 0x20)
+        return A64DOpcode::format();
+
+    if (isTst())
+        appendInstructionName("tst");
+    else {
+        if (isMov())
+            appendInstructionName("mov");
+        else
+            appendInstructionName(opName(opNumber()));
+        appendSPOrRegisterName(rd(), is64Bit());
+        appendSeparator();
+    }
+
+    if (!isMov()) {
+        appendRegisterName(rn(), is64Bit());
+        appendSeparator();
+    }
+
+    appendZROrRegisterName(rm(), is64Bit());
+    if (immediate6()) {
+        appendSeparator();
+        appendShiftType(shift());
+        appendUnsignedImmediate(immediate6());
+    }
+
+    return m_formatBuffer;
+}
+
+static unsigned highestBitSet(unsigned value)
+{
+    unsigned result = 0;
+
+    while (value >>= 1)
+        result++;
+
+    return result;
+}
+
+static uint64_t rotateRight(uint64_t value, unsigned width, unsigned shift)
+{
+    uint64_t result = value;
+
+    if (shift)
+        result = (value >> (shift % width)) | (value << (width - shift));
+
+    return result;
+}
+
+static uint64_t replicate(uint64_t value, unsigned width)
+{
+    uint64_t result = 0;
+
+    for (unsigned totalBits = 0; totalBits < 64; totalBits += width)
+        result = (result << width) | value;
+
+    return result;
+}
+
+const char* A64DOpcodeLogicalImmediate::format()
+{
+    if (!is64Bit() && nBit())
+        return A64DOpcode::format();
+
+    unsigned len = highestBitSet(nBit() << 6 | (immediateS() ^ 0x3f));
+    unsigned levels = (1 << len) - 1; // len number of 1 bits starting at LSB
+
+    if ((immediateS() & levels) == levels)
+        return A64DOpcode::format();
+
+    unsigned r = immediateR() & levels;
+    unsigned s = immediateS() & levels;
+    unsigned eSize = 1 << len;
+    uint64_t pattern = rotateRight((1ull << (s + 1)) - 1, eSize, r);
+
+    uint64_t immediate = replicate(pattern, eSize);
+
+    if (!is64Bit())
+        immediate &= 0xffffffffull;
+
+    if (isTst())
+        appendInstructionName("tst");
+    else {
+        if (isMov())
+            appendInstructionName("mov");
+        else
+            appendInstructionName(opName(opNumber()));
+        appendRegisterName(rd(), is64Bit());
+        appendSeparator();
+    }
+    if (!isMov()) {
+        appendRegisterName(rn(), is64Bit());
+        appendSeparator();
+    }
+    appendUnsignedImmediate64(immediate);
+
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeMoveWide::s_opNames[4] = { "movn", "", "movz", "movk" };
+
+const char* A64DOpcodeMoveWide::format()
+{
+    if (opc() == 1)
+        return A64DOpcode::format();
+    if (!size() && hw() >= 2)
+        return A64DOpcode::format();
+
+    appendInstructionName(opName());
+    appendRegisterName(rd(), is64Bit());
+    appendSeparator();
+    appendUnsignedImmediate(immediate16());
+    if (hw()) {
+        appendSeparator();
+        appendShiftAmount(hw());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeTestAndBranchImmediate::format()
+{
+    appendInstructionName(opBit() ? "tbnz" : "tbz");
+    appendRegisterName(rt());
+    appendSeparator();
+    appendUnsignedImmediate(bitNumber());
+    appendSeparator();
+    appendPCRelativeOffset(m_currentPC, static_cast<int32_t>(immediate14()));
+    return m_formatBuffer;
+}
+
+const char* A64DOpcodeUnconditionalBranchImmediate::format()
+{
+    appendInstructionName(op() ? "bl" : "b");
+    appendPCRelativeOffset(m_currentPC, static_cast<int32_t>(immediate26()));
+    return m_formatBuffer;
+}
+
+const char* const A64DOpcodeUnconditionalBranchRegister::s_opNames[8] = { "br", "blr", "ret", "", "eret", "drps", "", "" };
+
+const char* A64DOpcodeUnconditionalBranchRegister::format()
+{
+    unsigned opcValue = opc();
+    if (opcValue == 3 || opcValue > 5)
+        return A64DOpcode::format();
+    if (((opcValue & 0xe) == 0x4) && rn() != 0x1f)
+        return A64DOpcode::format();
+    appendInstructionName(opName());
+    if (opcValue <= 2)
+        appendRegisterName(rn());
+    return m_formatBuffer;
+}
+
+} } // namespace JSC::ARM64Disassembler
+
+#endif // USE(ARM64_DISASSEMBLER)
diff --git a/disassembler/ARM64/A64DOpcode.h b/disassembler/ARM64/A64DOpcode.h
new file mode 100644
index 0000000..eb565de
--- /dev/null
+++ b/disassembler/ARM64/A64DOpcode.h
@@ -0,0 +1,729 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Assertions.h>
+#include <stdint.h>
+
+namespace JSC { namespace ARM64Disassembler {
+
+class A64DOpcode {
+private:
+    class OpcodeGroup {
+    public:
+        OpcodeGroup(uint32_t opcodeMask, uint32_t opcodePattern, const char* (*format)(A64DOpcode*))
+            : m_opcodeMask(opcodeMask)
+            , m_opcodePattern(opcodePattern)
+            , m_format(format)
+            , m_next(0)
+        {
+        }
+
+        void setNext(OpcodeGroup* next)
+        {
+            m_next = next;
+        }
+
+        OpcodeGroup* next()
+        {
+            return m_next;
+        }
+
+        bool matches(uint32_t opcode)
+        {
+            return (opcode & m_opcodeMask) == m_opcodePattern;
+        }
+
+        const char* format(A64DOpcode* thisObj)
+        {
+            return m_format(thisObj);
+        }
+
+    private:
+        uint32_t m_opcodeMask;
+        uint32_t m_opcodePattern;
+        const char* (*m_format)(A64DOpcode*);
+        OpcodeGroup* m_next;
+    };
+
+public:
+    static void init();
+
+    A64DOpcode()
+        : m_opcode(0)
+        , m_bufferOffset(0)
+    {
+        init();
+        m_formatBuffer[0] = '\0';
+    }
+
+    const char* disassemble(uint32_t* currentPC);
+
+protected:
+    void setPCAndOpcode(uint32_t*, uint32_t);
+    const char* format();
+
+    static const char* const s_conditionNames[16];
+    static const char* const s_shiftNames[4];
+    static const char* const s_optionName[8];
+    static const char s_FPRegisterPrefix[5];
+
+    static const char* conditionName(unsigned condition) { return s_conditionNames[condition & 0xf]; }
+    static const char* shiftName(unsigned shiftValue) { return s_shiftNames[shiftValue & 0x3]; }
+    const char* optionName() { return s_optionName[option()]; }
+    static char FPRegisterPrefix(unsigned FPRegisterSize)
+    {
+        if (FPRegisterSize > 4)
+            FPRegisterSize = 4;
+        return s_FPRegisterPrefix[FPRegisterSize];
+    }
+
+    unsigned opcodeGroupNumber(uint32_t opcode) { return (opcode >> 24) & 0x1f; }
+
+    bool is64Bit() { return m_opcode & 0x80000000; }
+    unsigned size() { return m_opcode >> 30; }
+    unsigned option() { return (m_opcode >> 13) & 0x7; }
+    unsigned rd() { return m_opcode & 0x1f; }
+    unsigned rt() { return m_opcode & 0x1f; }
+    unsigned rn() { return (m_opcode >> 5) & 0x1f; }
+    unsigned rm() { return (m_opcode >> 16) & 0x1f; }
+
+    void bufferPrintf(const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
+
+    void appendInstructionName(const char* instructionName)
+    {
+        bufferPrintf("   %-7.7s", instructionName);
+    }
+
+    void appendRegisterName(unsigned registerNumber, bool is64Bit = true);
+    void appendSPOrRegisterName(unsigned registerNumber, bool is64Bit = true)
+    {
+        if (registerNumber == 31) {
+            bufferPrintf(is64Bit ? "sp" : "wsp");
+            return;
+        }
+        appendRegisterName(registerNumber, is64Bit);
+    }
+
+    void appendZROrRegisterName(unsigned registerNumber, bool is64Bit = true)
+    {
+        if (registerNumber == 31) {
+            bufferPrintf(is64Bit ? "xzr" : "wzr");
+            return;
+        }
+        appendRegisterName(registerNumber, is64Bit);
+    }
+
+    void appendFPRegisterName(unsigned registerNumber, unsigned registerSize);
+
+    void appendSeparator()
+    {
+        bufferPrintf(", ");
+    }
+
+    void appendCharacter(const char c)
+    {
+        bufferPrintf("%c", c);
+    }
+
+    void appendString(const char* string)
+    {
+        bufferPrintf("%s", string);
+    }
+
+    void appendShiftType(unsigned shiftValue)
+    {
+        bufferPrintf("%s ", shiftName(shiftValue));
+    }
+
+    void appendSignedImmediate(int immediate)
+    {
+        bufferPrintf("#%d", immediate);
+    }
+
+    void appendUnsignedImmediate(unsigned immediate)
+    {
+        bufferPrintf("#%u", immediate);
+    }
+
+    void appendUnsignedImmediate64(uint64_t immediate)
+    {
+        bufferPrintf("#0x%" PRIx64, immediate);
+    }
+
+    void appendPCRelativeOffset(uint32_t* pc, int32_t immediate)
+    {
+        bufferPrintf("0x%" PRIx64, reinterpret_cast<uint64_t>(pc + immediate));
+    }
+
+    void appendShiftAmount(unsigned amount)
+    {
+        bufferPrintf("lsl #%u", 16 * amount);
+    }
+
+    static const int bufferSize = 81;
+
+    char m_formatBuffer[bufferSize];
+    uint32_t* m_currentPC;
+    uint32_t m_opcode;
+    int m_bufferOffset;
+
+private:
+    static OpcodeGroup* opcodeTable[32];
+
+    static bool s_initialized;
+};
+
+#define DEFINE_STATIC_FORMAT(klass, thisObj) \
+   static const char* format(A64DOpcode* thisObj) { return reinterpret_cast< klass *>(thisObj)->format(); }
+
+class A64DOpcodeAddSubtract : public A64DOpcode {
+private:
+    static const char* const s_opNames[4];
+
+public:
+    const char* opName() { return s_opNames[opAndS()]; }
+    const char* cmpName() { return op() ? "cmp" : "cmn"; }
+
+    bool isCMP() { return (sBit() && rd() == 31); }
+    unsigned op() { return (m_opcode >> 30) & 0x1; }
+    unsigned sBit() { return (m_opcode >> 29) & 0x1; }
+    unsigned opAndS() { return (m_opcode >> 29) & 0x3; }
+};
+
+class A64DOpcodeAddSubtractImmediate : public A64DOpcodeAddSubtract {
+public:
+    static const uint32_t mask = 0x1f000000;
+    static const uint32_t pattern = 0x11000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeAddSubtractImmediate, thisObj);
+
+    const char* format();
+
+    bool isMovSP() { return (!opAndS() && !immed12() && ((rd() == 31) || rn() == 31)); }
+    unsigned shift() { return (m_opcode >> 22) & 0x3; }
+    unsigned immed12() { return (m_opcode >> 10) & 0xfff; }
+};
+
+class A64DOpcodeAddSubtractExtendedRegister : public A64DOpcodeAddSubtract {
+public:
+    static const uint32_t mask = 0x1fe00000;
+    static const uint32_t pattern = 0x0b200000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeAddSubtractExtendedRegister, thisObj);
+
+    const char* format();
+
+    unsigned immediate3() { return (m_opcode >> 10) & 0x7; }
+};
+
+class A64DOpcodeAddSubtractShiftedRegister : public A64DOpcodeAddSubtract {
+public:
+    static const uint32_t mask = 0x1f200000;
+    static const uint32_t pattern = 0x0b000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeAddSubtractShiftedRegister, thisObj);
+
+    const char* format();
+
+    bool isNeg() { return (op() && rn() == 31); }
+    const char* negName() { return sBit() ? "negs" : "neg"; }
+    unsigned shift() { return (m_opcode >> 22) & 0x3; }
+    int immediate6() { return (static_cast<int>((m_opcode >> 10) & 0x3f) << 26) >> 26; }
+};
+
+class A64DOpcodeBitfield : public A64DOpcode {
+private:
+    static const char* const s_opNames[3];
+    static const char* const s_extendPseudoOpNames[3][3];
+    static const char* const s_insertOpNames[3];
+    static const char* const s_extractOpNames[3];
+
+public:
+    static const uint32_t mask = 0x1f800000;
+    static const uint32_t pattern = 0x13000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeBitfield, thisObj);
+
+    const char* format();
+
+    const char* opName() { return s_opNames[opc()]; }
+    const char* extendPseudoOpNames(unsigned opSize) { return s_extendPseudoOpNames[opc()][opSize]; }
+    const char* insertOpNames() { return s_insertOpNames[opc()]; }
+    const char* extractOpNames() { return s_extractOpNames[opc()]; }
+
+    unsigned opc() { return (m_opcode >> 29) & 0x3; }
+    unsigned nBit() { return (m_opcode >> 22) & 0x1; }
+    unsigned immediateR() { return (m_opcode >> 16) & 0x3f; }
+    unsigned immediateS() { return (m_opcode >> 10) & 0x3f; }
+};
+
+class A64DOpcodeCompareAndBranchImmediate : public A64DOpcode {
+public:
+    static const uint32_t mask = 0x7e000000;
+    static const uint32_t pattern = 0x34000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeCompareAndBranchImmediate, thisObj);
+
+    const char* format();
+
+    unsigned opBit() { return (m_opcode >> 24) & 0x1; }
+    int immediate19() { return (static_cast<int>((m_opcode >> 5) & 0x7ffff) << 13) >> 13; }
+};
+
+class A64DOpcodeConditionalBranchImmediate : public A64DOpcode {
+public:
+    static const uint32_t mask = 0xff000010;
+    static const uint32_t pattern = 0x54000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeConditionalBranchImmediate, thisObj);
+
+    const char* format();
+
+    unsigned condition() { return m_opcode & 0xf; }
+    int immediate19() { return (static_cast<int>((m_opcode >> 5) & 0x7ffff) << 13) >> 13; }
+};
+
+class A64DOpcodeConditionalSelect : public A64DOpcode {
+private:
+    static const char* const s_opNames[4];
+
+public:
+    static const uint32_t mask = 0x1fe00010;
+    static const uint32_t pattern = 0x1a800000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeConditionalSelect, thisObj);
+
+    const char* format();
+
+    const char* opName() { return s_opNames[opNum()]; }
+    unsigned opNum() { return (op() << 1 | (op2() & 0x1)); }
+    unsigned op() { return (m_opcode >> 30) & 0x1; }
+    unsigned sBit() { return (m_opcode >> 29) & 0x1; }
+    unsigned condition() { return (m_opcode >> 12) & 0xf; }
+    unsigned op2() { return (m_opcode >> 10) & 0x3; }
+};
+
+class A64DOpcodeDataProcessing2Source : public A64DOpcode {
+private:
+    static const char* const s_opNames[8];
+
+public:
+    static const uint32_t mask = 0x5fe00000;
+    static const uint32_t pattern = 0x1ac00000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeDataProcessing2Source, thisObj);
+
+    const char* format();
+
+    const char* opName() { return s_opNames[opNameIndex()]; }
+    unsigned sBit() { return (m_opcode >> 29) & 0x1; }
+    unsigned opCode() { return (m_opcode >> 10) & 0x3f; }
+    unsigned opNameIndex() { return ((m_opcode >> 11) & 0x4) | ((m_opcode >> 10) & 0x3); }
+};
+
+class A64DOpcodeDataProcessing3Source : public A64DOpcode {
+private:
+    static const char* const s_opNames[16];
+    static const char* const s_pseudoOpNames[16];
+
+public:
+    static const uint32_t mask = 0x1f000000;
+    static const uint32_t pattern = 0x1b000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeDataProcessing3Source, thisObj);
+
+    const char* format();
+
+    const char* opName() { return ra() == 31 ? s_opNames[opNum() & 0xf] : s_pseudoOpNames[opNum() & 0xf]; }
+    unsigned ra() { return (m_opcode >> 10) & 0x1f; }
+    unsigned op54() { return (m_opcode >> 29) & 0x3; }
+    unsigned op31() { return (m_opcode >> 21) & 0x7; }
+    unsigned op0() { return (m_opcode >> 15) & 0x1; }
+    unsigned opNum() { return ((m_opcode >> 25) & 0x30) | ((m_opcode >> 20) & 0xe) | ((m_opcode >> 15) & 0x1); }
+};
+
+class A64OpcodeExceptionGeneration : public A64DOpcode {
+public:
+    static const uint32_t mask = 0xff000010;
+    static const uint32_t pattern = 0xd4000000;
+
+    DEFINE_STATIC_FORMAT(A64OpcodeExceptionGeneration, thisObj);
+
+    const char* format();
+
+    unsigned opc() { return (m_opcode>>21) & 0x7; }
+    unsigned op2() { return (m_opcode>>2) & 0x7; }
+    unsigned ll() { return m_opcode & 0x3; }
+    int immediate16() { return (static_cast<int>((m_opcode >> 5) & 0xffff) << 16) >> 16; }
+};
+
+class A64DOpcodeExtract : public A64DOpcode {
+public:
+    static const uint32_t mask = 0x1f800000;
+    static const uint32_t pattern = 0x13800000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeExtract, thisObj);
+
+    const char* format();
+
+    unsigned op21() { return (m_opcode >> 29) & 0x3; }
+    unsigned nBit() { return (m_opcode >> 22) & 0x1; }
+    unsigned o0Bit() { return (m_opcode >> 21) & 0x1; }
+    unsigned immediateS() { return (m_opcode >> 10) & 0x3f; }
+};
+
+class A64DOpcodeFloatingPointOps : public A64DOpcode {
+public:
+    unsigned mBit() { return (m_opcode >> 31) & 0x1; }
+    unsigned sBit() { return (m_opcode >> 29) & 0x1; }
+    unsigned type() { return (m_opcode >> 22) & 0x3; }
+};
+
+class A64DOpcodeFloatingPointCompare : public A64DOpcodeFloatingPointOps {
+private:
+    static const char* const s_opNames[16];
+    
+public:
+    static const uint32_t mask = 0x5f203c00;
+    static const uint32_t pattern = 0x1e202000;
+    
+    DEFINE_STATIC_FORMAT(A64DOpcodeFloatingPointCompare, thisObj);
+    
+    const char* format();
+
+    const char* opName() { return (opNum() & 0x2) ? "fcmpe" : "fcmp"; }
+
+    unsigned op() { return (m_opcode >> 14) & 0x3; }
+    unsigned opCode2() { return m_opcode & 0x1f; }
+    unsigned opNum() { return (m_opcode >> 3) & 0x3; }
+};
+
+class A64DOpcodeFloatingPointDataProcessing1Source : public A64DOpcodeFloatingPointOps {
+private:
+    static const char* const s_opNames[16];
+
+public:
+    static const uint32_t mask = 0x5f207c00;
+    static const uint32_t pattern = 0x1e204000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeFloatingPointDataProcessing1Source, thisObj);
+
+    const char* format();
+
+    const char* opName() { return s_opNames[opNum()]; }
+
+    unsigned opNum() { return (m_opcode >> 15) & 0x3f; }
+};
+
+class A64DOpcodeFloatingPointDataProcessing2Source : public A64DOpcodeFloatingPointOps {
+private:
+    static const char* const s_opNames[16];
+
+public:
+    static const uint32_t mask = 0x5f200800;
+    static const uint32_t pattern = 0x1e200800;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeFloatingPointDataProcessing2Source, thisObj);
+
+    const char* format();
+
+    const char* opName() { return s_opNames[opNum()]; }
+
+    unsigned opNum() { return (m_opcode >> 12) & 0xf; }
+};
+
+class A64DOpcodeFloatingFixedPointConversions : public A64DOpcodeFloatingPointOps {
+private:
+    static const char* const s_opNames[4];
+    
+public:
+    static const uint32_t mask = 0x5f200000;
+    static const uint32_t pattern = 0x1e000000;
+    
+    DEFINE_STATIC_FORMAT(A64DOpcodeFloatingFixedPointConversions, thisObj);
+    
+    const char* format();
+    
+    const char* opName() { return s_opNames[opNum()]; }
+    unsigned rmode() { return (m_opcode >> 19) & 0x3; }
+    unsigned opcode() { return (m_opcode >> 16) & 0x7; }
+    unsigned scale() { return (m_opcode >> 10) & 0x3f; }
+    unsigned opNum() { return (m_opcode >> 16) & 0x3; }
+};
+
+class A64DOpcodeFloatingPointIntegerConversions : public A64DOpcodeFloatingPointOps {
+private:
+    static const char* const s_opNames[32];
+    
+public:
+    static const uint32_t mask = 0x5f20fc00;
+    static const uint32_t pattern = 0x1e200000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeFloatingPointIntegerConversions, thisObj);
+
+    const char* format();
+
+    const char* opName() { return s_opNames[opNum()]; }
+    unsigned rmode() { return (m_opcode >> 19) & 0x3; }
+    unsigned opcode() { return (m_opcode >> 16) & 0x7; }
+    unsigned opNum() { return (m_opcode >> 16) & 0x1f; }
+};
+
+class A64DOpcodeHint : public A64DOpcode {
+private:
+    static const char* const s_opNames[6];
+
+public:
+    static const uint32_t mask = 0xfffff01f;
+    static const uint32_t pattern = 0xd503201f;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeHint, thisObj);
+
+    const char* format();
+
+    const char* opName() { return immediate7() <= 5 ? s_opNames[immediate7()] : "hint"; }
+    unsigned immediate7() { return (m_opcode >> 5) & 0x7f; }
+};
+
+class A64DOpcodeDmbIsh : public A64DOpcode {
+public:
+    static const uint32_t mask = 0xffffffff;
+    static const uint32_t pattern = 0xd5033bbf;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeDmbIsh, thisObj);
+
+    const char* format();
+
+    const char* opName() { return "dmb"; }
+};
+
+class A64DOpcodeDmbIshSt : public A64DOpcode {
+public:
+    static const uint32_t mask = 0xffffffff;
+    static const uint32_t pattern = 0xd5033abf;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeDmbIshSt, thisObj);
+
+    const char* format();
+
+    const char* opName() { return "dmb"; }
+};
+
+class A64DOpcodeLoadStore : public A64DOpcode {
+private:
+    static const char* const s_opNames[32];
+
+protected:
+    const char* opName()
+    {
+        return s_opNames[opNumber()];
+    }
+
+    unsigned size() { return (m_opcode >> 30) & 0x3; }
+    unsigned vBit() { return (m_opcode >> 26) & 0x1; }
+    unsigned opc() { return (m_opcode >> 22) & 0x3; }
+    unsigned opNumber() { return (size() <<3 ) | (vBit() << 2) | opc(); }
+    bool is64BitRT() { return ((opNumber() & 0x17) == 0x02) || ((opNumber() & 0x1e) == 0x18); }
+};
+
+class A64DOpcodeLoadStoreImmediate : public A64DOpcodeLoadStore {
+private:
+    static const char* const s_unprivilegedOpNames[32];
+    static const char* const s_unscaledOpNames[32];
+
+public:
+    static const uint32_t mask = 0x3b200000;
+    static const uint32_t pattern = 0x38000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeLoadStoreImmediate, thisObj);
+
+    const char* format();
+
+    const char* unprivilegedOpName()
+    {
+        return s_unprivilegedOpNames[opNumber()];
+    }
+    const char* unscaledOpName()
+    {
+        return s_unscaledOpNames[opNumber()];
+    }
+    unsigned type() { return (m_opcode >> 10) & 0x3; }
+    int immediate9() { return (static_cast<int>((m_opcode >> 12) & 0x1ff) << 23) >> 23; }
+};
+
+class A64DOpcodeLoadStoreRegisterOffset : public A64DOpcodeLoadStore {
+public:
+    static const uint32_t mask = 0x3b200c00;
+    static const uint32_t pattern = 0x38200800;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeLoadStoreRegisterOffset, thisObj);
+
+    const char* format();
+
+    unsigned option() { return (m_opcode >> 13) & 0x7; }
+    int sBit() { return (m_opcode >> 12) & 0x1; }
+};
+
+class A64DOpcodeLoadStoreRegisterPair : public A64DOpcodeLoadStore {
+public:
+    static const uint32_t mask = 0x3a000000;
+    static const uint32_t pattern = 0x28000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeLoadStoreRegisterPair, thisObj);
+
+    const char* format();
+    const char* opName();
+
+    unsigned rt2() { return (m_opcode >> 10) & 0x1f; }
+    int immediate7() { return (static_cast<int>((m_opcode >> 15) & 0x7f) << 25) >> 25; }
+    unsigned offsetMode() { return (m_opcode >> 23) & 0x7; }
+    int lBit() { return (m_opcode >> 22) & 0x1; }
+};
+
+class A64DOpcodeLoadStoreUnsignedImmediate : public A64DOpcodeLoadStore {
+public:
+    static const uint32_t mask = 0x3b000000;
+    static const uint32_t pattern = 0x39000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeLoadStoreUnsignedImmediate, thisObj);
+
+    const char* format();
+
+    unsigned immediate12() { return (m_opcode >> 10) & 0xfff; }
+};
+
+class A64DOpcodeLogical : public A64DOpcode {
+private:
+    static const char* const s_opNames[8];
+
+public:
+    const char* opName(unsigned opNumber)
+    {
+        return s_opNames[opNumber & 0x7];
+    }
+
+    unsigned opc() { return (m_opcode >> 29) & 0x3; }
+    unsigned nBit() { return (m_opcode >> 21) & 0x1; }
+};
+
+class A64DOpcodeLogicalImmediate : public A64DOpcodeLogical {
+public:
+    static const uint32_t mask = 0x1f800000;
+    static const uint32_t pattern = 0x12000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeLogicalImmediate, thisObj);
+
+    const char* format();
+
+    bool isTst() { return ((opNumber() == 6) && (rd() == 31)); }
+    bool isMov() { return ((opNumber() == 2) && (rn() == 31)); }
+    unsigned opNumber() { return opc() << 1; }
+    unsigned nBit() { return (m_opcode >> 22) & 0x1; }
+    unsigned immediateR() { return (m_opcode >> 16) & 0x3f; }
+    unsigned immediateS() { return (m_opcode >> 10) & 0x3f; }
+};
+
+class A64DOpcodeLogicalShiftedRegister : public A64DOpcodeLogical {
+public:
+    static const uint32_t mask = 0x1f000000;
+    static const uint32_t pattern = 0x0a000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeLogicalShiftedRegister, thisObj);
+
+    const char* format();
+
+    bool isTst() { return ((opNumber() == 6) && (rd() == 31)); }
+    bool isMov() { return ((opNumber() == 2) && (rn() == 31)); }
+    unsigned opNumber() { return (opc() << 1) | nBit(); }
+    unsigned shift() { return (m_opcode >> 22) & 0x3; }
+    int immediate6() { return (static_cast<int>((m_opcode >> 10) & 0x3f) << 26) >> 26; }
+};
+
+class A64DOpcodeMoveWide : public A64DOpcode {
+private:
+    static const char* const s_opNames[4];
+
+public:
+    static const uint32_t mask = 0x1f800000;
+    static const uint32_t pattern = 0x12800000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeMoveWide, thisObj);
+
+    const char* format();
+
+    const char* opName() { return s_opNames[opc()]; }
+    unsigned opc() { return (m_opcode >> 29) & 0x3; }
+    unsigned hw() { return (m_opcode >> 21) & 0x3; }
+    unsigned immediate16() { return (m_opcode >> 5) & 0xffff; }
+};
+
+class A64DOpcodeTestAndBranchImmediate : public A64DOpcode {
+public:
+    static const uint32_t mask = 0x7e000000;
+    static const uint32_t pattern = 0x36000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeTestAndBranchImmediate, thisObj);
+
+    const char* format();
+
+    unsigned bitNumber() { return ((m_opcode >> 26) & 0x20) | ((m_opcode >> 19) & 0x1f); }
+    unsigned opBit() { return (m_opcode >> 24) & 0x1; }
+    int immediate14() { return (static_cast<int>((m_opcode >> 5) & 0x3fff) << 18) >> 18; }
+};
+
+class A64DOpcodeUnconditionalBranchImmediate : public A64DOpcode {
+public:
+    static const uint32_t mask = 0x7c000000;
+    static const uint32_t pattern = 0x14000000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeUnconditionalBranchImmediate, thisObj);
+
+    const char* format();
+
+    unsigned op() { return (m_opcode >> 31) & 0x1; }
+    int immediate26() { return (static_cast<int>(m_opcode & 0x3ffffff) << 6) >> 6; }
+};
+
+class A64DOpcodeUnconditionalBranchRegister : public A64DOpcode {
+private:
+    static const char* const s_opNames[8];
+
+public:
+    static const uint32_t mask = 0xfe1ffc1f;
+    static const uint32_t pattern = 0xd61f0000;
+
+    DEFINE_STATIC_FORMAT(A64DOpcodeUnconditionalBranchRegister, thisObj);
+
+    const char* format();
+
+    const char* opName() { return s_opNames[opc()]; }
+    unsigned opc() { return (m_opcode >> 21) & 0xf; }
+};
+
+} } // namespace JSC::ARM64Disassembler
+
+using JSC::ARM64Disassembler::A64DOpcode;
diff --git a/disassembler/ARM64Disassembler.cpp b/disassembler/ARM64Disassembler.cpp
new file mode 100644
index 0000000..ac52213
--- /dev/null
+++ b/disassembler/ARM64Disassembler.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Disassembler.h"
+
+#if USE(ARM64_DISASSEMBLER)
+
+#include "ARM64/A64DOpcode.h"
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+bool tryToDisassemble(const MacroAssemblerCodePtr& codePtr, size_t size, const char* prefix, PrintStream& out)
+{
+    A64DOpcode arm64Opcode;
+
+    uint32_t* currentPC = reinterpret_cast<uint32_t*>(codePtr.executableAddress());
+    size_t byteCount = size;
+
+    while (byteCount) {
+        char pcString[20];
+        snprintf(pcString, sizeof(pcString), "0x%lx", reinterpret_cast<unsigned long>(currentPC));
+        out.printf("%s%16s: %s\n", prefix, pcString, arm64Opcode.disassemble(currentPC));
+        currentPC++;
+        byteCount -= sizeof(uint32_t);
+    }
+
+    return true;
+}
+
+} // namespace JSC
+
+#endif // USE(ARM64_DISASSEMBLER)
+
diff --git a/disassembler/ARMLLVMDisassembler.cpp b/disassembler/ARMLLVMDisassembler.cpp
new file mode 100644
index 0000000..a349abb
--- /dev/null
+++ b/disassembler/ARMLLVMDisassembler.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Disassembler.h"
+
+#if USE(ARM_LLVM_DISASSEMBLER)
+
+#include "MacroAssemblerCodeRef.h"
+#include <llvm-c/Disassembler.h>
+#include <llvm-c/Target.h>
+
+namespace JSC {
+
+bool tryToDisassemble(const MacroAssemblerCodePtr& codePtr, size_t size, const char* prefix, PrintStream& out)
+{
+    LLVMInitializeAllTargetInfos();
+    LLVMInitializeAllTargetMCs();
+    LLVMInitializeAllDisassemblers();
+
+    const char* triple = "armv7-unknown-linux-gnueabihf";
+    LLVMDisasmContextRef disassemblyContext = LLVMCreateDisasm(triple, 0, 0, 0, 0);
+
+    RELEASE_ASSERT(disassemblyContext);
+
+    char pcString[20];
+    char instructionString[100];
+
+    uint8_t* pc = static_cast<uint8_t*>(codePtr.executableAddress());
+    uint8_t* end = pc + size;
+
+    while (pc < end) {
+        snprintf(
+            pcString, sizeof(pcString), "0x%lx",
+            static_cast<unsigned long>(bitwise_cast<uintptr_t>(pc)));
+
+        size_t instructionSize = LLVMDisasmInstruction(
+            disassemblyContext, pc, end - pc, bitwise_cast<uintptr_t>(pc),
+            instructionString, sizeof(instructionString));
+
+        if (!instructionSize)
+            snprintf(instructionString, sizeof(instructionString), "unknown instruction");
+
+        out.printf("%s%16s: [0x%08lx] %s\n", prefix, pcString, *(reinterpret_cast<unsigned long*>(pc)), instructionString);
+        pc += 4;
+    }
+
+    LLVMDisasmDispose(disassemblyContext);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // USE(ARM_LLVM_DISASSEMBLER)
diff --git a/disassembler/ARMv7/ARMv7DOpcode.cpp b/disassembler/ARMv7/ARMv7DOpcode.cpp
new file mode 100644
index 0000000..3175ccc
--- /dev/null
+++ b/disassembler/ARMv7/ARMv7DOpcode.cpp
@@ -0,0 +1,1733 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ARMV7_DISASSEMBLER)
+
+#include "ARMv7DOpcode.h"
+
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+namespace JSC { namespace ARMv7Disassembler {
+
+ARMv7D16BitOpcode::OpcodeGroup* ARMv7D16BitOpcode::opcodeTable[32];
+ARMv7D32BitOpcode::OpcodeGroup* ARMv7D32BitOpcode::opcodeTable[16];
+
+const char* const ARMv7DOpcode::s_conditionNames[16] = {
+    "eq", "ne", "hs", "lo", "mi", "pl", "vs", "vc",
+    "hi", "ls", "ge", "lt", "gt", "le", "al", "al"
+};
+
+const char* const ARMv7DOpcode::s_optionName[8] = {
+    "uxtb", "uxth", "uxtw", "uxtx", "sxtb", "sxth", "sxtw", "sxtx"
+};
+
+const char* const ARMv7DOpcode::s_shiftNames[4] = {
+    "lsl", "lsr", "asr", "ror"
+};
+
+const char* const ARMv7DOpcode::s_specialRegisterNames[3] = { "sp", "lr", "pc" };
+
+template <typename OpcodeType, typename InstructionType>
+struct OpcodeGroupInitializer {
+    unsigned m_opcodeGroupNumber;
+    InstructionType m_mask;
+    InstructionType m_pattern;
+    const char* (*m_format)(OpcodeType*);
+};
+
+#define OPCODE_GROUP_ENTRY(groupIndex, groupClass) \
+{ groupIndex, groupClass::s_mask, groupClass::s_pattern, groupClass::format }
+
+typedef OpcodeGroupInitializer<ARMv7D16BitOpcode, uint16_t> Opcode16GroupInitializer;
+typedef OpcodeGroupInitializer<ARMv7D32BitOpcode, uint32_t> Opcode32GroupInitializer;
+
+static Opcode16GroupInitializer opcode16BitGroupList[] = {
+    OPCODE_GROUP_ENTRY(0x0, ARMv7DOpcodeLogicalImmediateT1),
+    OPCODE_GROUP_ENTRY(0x1, ARMv7DOpcodeLogicalImmediateT1),
+    OPCODE_GROUP_ENTRY(0x2, ARMv7DOpcodeLogicalImmediateT1),
+    OPCODE_GROUP_ENTRY(0x3, ARMv7DOpcodeAddSubtractT1),
+    OPCODE_GROUP_ENTRY(0x3, ARMv7DOpcodeAddSubtractImmediate3),
+    OPCODE_GROUP_ENTRY(0x4, ARMv7DOpcodeMoveImmediateT1),
+    OPCODE_GROUP_ENTRY(0x5, ARMv7DOpcodeCompareImmediateT1),
+    OPCODE_GROUP_ENTRY(0x6, ARMv7DOpcodeAddSubtractImmediate8),
+    OPCODE_GROUP_ENTRY(0x7, ARMv7DOpcodeAddSubtractImmediate8),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeDataProcessingRegisterT1),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeAddRegisterT2),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeCompareRegisterT2),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeCompareRegisterT1),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeMoveRegisterT1),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeBranchExchangeT1),
+    OPCODE_GROUP_ENTRY(0x9, ARMv7DOpcodeLoadFromLiteralPool),
+    OPCODE_GROUP_ENTRY(0xa, ARMv7DOpcodeLoadStoreRegisterOffsetT1),
+    OPCODE_GROUP_ENTRY(0xb, ARMv7DOpcodeLoadStoreRegisterOffsetT1),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeLoadStoreRegisterImmediateWordAndByte),
+    OPCODE_GROUP_ENTRY(0xd, ARMv7DOpcodeLoadStoreRegisterImmediateWordAndByte),
+    OPCODE_GROUP_ENTRY(0xe, ARMv7DOpcodeLoadStoreRegisterImmediateWordAndByte),
+    OPCODE_GROUP_ENTRY(0xf, ARMv7DOpcodeLoadStoreRegisterImmediateWordAndByte),
+    OPCODE_GROUP_ENTRY(0x10, ARMv7DOpcodeStoreRegisterImmediateHalfWord),
+    OPCODE_GROUP_ENTRY(0x11, ARMv7DOpcodeLoadRegisterImmediateHalfWord),
+    OPCODE_GROUP_ENTRY(0x12, ARMv7DOpcodeLoadStoreRegisterSPRelative),
+    OPCODE_GROUP_ENTRY(0x13, ARMv7DOpcodeLoadStoreRegisterSPRelative),
+    OPCODE_GROUP_ENTRY(0x14, ARMv7DOpcodeGeneratePCRelativeAddress),
+    OPCODE_GROUP_ENTRY(0x15, ARMv7DOpcodeAddSPPlusImmediate),
+    OPCODE_GROUP_ENTRY(0x16, ARMv7DOpcodeMiscCompareAndBranch),
+    OPCODE_GROUP_ENTRY(0x16, ARMv7DOpcodeMiscByteHalfwordOps),
+    OPCODE_GROUP_ENTRY(0x16, ARMv7DOpcodeMiscPushPop),
+    OPCODE_GROUP_ENTRY(0x16, ARMv7DOpcodeMiscAddSubSP),
+    OPCODE_GROUP_ENTRY(0x17, ARMv7DOpcodeMiscHint16), // Needs to be before IfThenT1
+    OPCODE_GROUP_ENTRY(0x17, ARMv7DOpcodeMiscIfThenT1),
+    OPCODE_GROUP_ENTRY(0x17, ARMv7DOpcodeMiscByteHalfwordOps),
+    OPCODE_GROUP_ENTRY(0x17, ARMv7DOpcodeMiscCompareAndBranch),
+    OPCODE_GROUP_ENTRY(0x17, ARMv7DOpcodeMiscPushPop),
+    OPCODE_GROUP_ENTRY(0x17, ARMv7DOpcodeMiscBreakpointT1),
+    OPCODE_GROUP_ENTRY(0x1a, ARMv7DOpcodeBranchConditionalT1),
+    OPCODE_GROUP_ENTRY(0x1b, ARMv7DOpcodeBranchConditionalT1),
+    OPCODE_GROUP_ENTRY(0x1c, ARMv7DOpcodeBranchT2)
+};
+
+static Opcode32GroupInitializer opcode32BitGroupList[] = {
+    OPCODE_GROUP_ENTRY(0x4, ARMv7DOpcodeDataPopMultiple),
+    OPCODE_GROUP_ENTRY(0x4, ARMv7DOpcodeDataPushMultiple),
+    OPCODE_GROUP_ENTRY(0x5, ARMv7DOpcodeDataProcessingShiftedReg),
+    OPCODE_GROUP_ENTRY(0x6, ARMv7DOpcodeVLDR),
+    OPCODE_GROUP_ENTRY(0x6, ARMv7DOpcodeVMOVSinglePrecision),
+    OPCODE_GROUP_ENTRY(0x6, ARMv7DOpcodeVMOVDoublePrecision),
+    OPCODE_GROUP_ENTRY(0x7, ARMv7DOpcodeFPTransfer),
+    OPCODE_GROUP_ENTRY(0x7, ARMv7DOpcodeVMSR),
+    OPCODE_GROUP_ENTRY(0x7, ARMv7DOpcodeVCMP),
+    OPCODE_GROUP_ENTRY(0x7, ARMv7DOpcodeVCVTBetweenFPAndInt),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeDataProcessingModifiedImmediate),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeConditionalBranchT3),
+    OPCODE_GROUP_ENTRY(0x8, ARMv7DOpcodeBranchOrBranchLink),
+    OPCODE_GROUP_ENTRY(0x9, ARMv7DOpcodeUnmodifiedImmediate),
+    OPCODE_GROUP_ENTRY(0x9, ARMv7DOpcodeHint32),
+    OPCODE_GROUP_ENTRY(0x9, ARMv7DOpcodeConditionalBranchT3),
+    OPCODE_GROUP_ENTRY(0x9, ARMv7DOpcodeBranchOrBranchLink),
+    OPCODE_GROUP_ENTRY(0xa, ARMv7DOpcodeDataProcessingModifiedImmediate),
+    OPCODE_GROUP_ENTRY(0xa, ARMv7DOpcodeConditionalBranchT3),
+    OPCODE_GROUP_ENTRY(0xa, ARMv7DOpcodeBranchOrBranchLink),
+    OPCODE_GROUP_ENTRY(0xb, ARMv7DOpcodeUnmodifiedImmediate),
+    OPCODE_GROUP_ENTRY(0xb, ARMv7DOpcodeConditionalBranchT3),
+    OPCODE_GROUP_ENTRY(0xb, ARMv7DOpcodeBranchOrBranchLink),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeLoadRegister),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeDataPushPopSingle), // Should be before StoreSingle*
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeDataPopMultiple),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeDataPushMultiple),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeStoreSingleRegister),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeStoreSingleImmediate12),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeStoreSingleImmediate8),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeLoadSignedImmediate),
+    OPCODE_GROUP_ENTRY(0xc, ARMv7DOpcodeLoadUnsignedImmediate),
+    OPCODE_GROUP_ENTRY(0xd, ARMv7DOpcodeLongMultipleDivide),
+    OPCODE_GROUP_ENTRY(0xd, ARMv7DOpcodeDataProcessingRegShift),
+    OPCODE_GROUP_ENTRY(0xd, ARMv7DOpcodeDataProcessingRegExtend),
+    OPCODE_GROUP_ENTRY(0xd, ARMv7DOpcodeDataProcessingRegParallel),
+    OPCODE_GROUP_ENTRY(0xd, ARMv7DOpcodeDataProcessingRegMisc),
+    OPCODE_GROUP_ENTRY(0xe, ARMv7DOpcodeVLDR),
+    OPCODE_GROUP_ENTRY(0xf, ARMv7DOpcodeVCMP),
+    OPCODE_GROUP_ENTRY(0xf, ARMv7DOpcodeVCVTBetweenFPAndInt),
+};
+
+bool ARMv7DOpcode::s_initialized = false;
+
+void ARMv7DOpcode::init()
+{
+    if (s_initialized)
+        return;
+
+    ARMv7D16BitOpcode::init();
+    ARMv7D32BitOpcode::init();
+
+    s_initialized = true;
+}
+
+void ARMv7DOpcode::startITBlock(unsigned blocksize, unsigned firstCondition)
+{
+    ASSERT(blocksize > 0 && blocksize <= MaxITBlockSize);
+    m_ITBlocksize = blocksize;
+    m_ITConditionIndex = m_ITBlocksize + 1;
+    m_currentITCondition = 0;
+    m_ifThenConditions[0] = firstCondition;
+}
+
+void ARMv7DOpcode::saveITConditionAt(unsigned blockPosition, unsigned condition)
+{
+    if (blockPosition < m_ITBlocksize)
+        m_ifThenConditions[blockPosition] = static_cast<unsigned char>(condition);
+}
+
+void ARMv7DOpcode::fetchOpcode(uint16_t*& newPC)
+{
+    m_bufferOffset = 0;
+    m_formatBuffer[0] = '\0';
+    m_currentPC = newPC;
+
+    m_opcode = *newPC++;
+
+    if (is32BitInstruction()) {
+        m_opcode <<= 16;
+        m_opcode |= *newPC++;
+    }
+
+    if (m_ITConditionIndex < m_ITBlocksize)
+        m_currentITCondition = m_ifThenConditions[m_ITConditionIndex];
+    else
+        m_currentITCondition = CondNone;
+}
+
+const char* ARMv7DOpcode::disassemble(uint16_t*& currentPC)
+{
+    const char* result;
+    fetchOpcode(currentPC);
+
+    if (is32BitInstruction())
+        result = reinterpret_cast<ARMv7D32BitOpcode*>(this)->doDisassemble();
+    else
+        result = reinterpret_cast<ARMv7D16BitOpcode*>(this)->doDisassemble();
+
+    if (startingITBlock())
+        m_ITConditionIndex = 0;
+    else if (inITBlock() && (++m_ITConditionIndex >= m_ITBlocksize))
+        endITBlock();
+
+    return result;
+}
+
+void ARMv7DOpcode::bufferPrintf(const char* format, ...)
+{
+    if (m_bufferOffset >= bufferSize)
+        return;
+
+    va_list argList;
+    va_start(argList, format);
+
+    m_bufferOffset += vsnprintf(m_formatBuffer + m_bufferOffset, bufferSize - m_bufferOffset, format, argList);
+
+    va_end(argList);
+}
+
+void ARMv7DOpcode::appendInstructionName(const char* instructionName, bool addS)
+{
+    if (!inITBlock()  && !addS) {
+        appendInstructionNameNoITBlock(instructionName);
+
+        return;
+    }
+
+    const char sevenSpaces[8] = "       ";
+
+    unsigned length = strlen(instructionName);
+
+    bufferPrintf("   %s", instructionName);
+    if (inITBlock()) {
+        const char* condition = conditionName(m_currentITCondition);
+        length += strlen(condition);
+        appendString(condition);
+    } else if (addS) {
+        length++;
+        appendCharacter('s');
+    }
+
+    if (length >= 7)
+        length = 6;
+
+    appendString(sevenSpaces + length);
+}
+
+void ARMv7DOpcode::appendRegisterName(unsigned registerNumber)
+{
+    registerNumber &= 0xf;
+
+    if (registerNumber > 12) {
+        appendString(s_specialRegisterNames[registerNumber - 13]);
+        return;
+    }
+
+    bufferPrintf("r%u", registerNumber);
+}
+
+void ARMv7DOpcode::appendRegisterList(unsigned registers)
+{
+    unsigned numberPrinted = 0;
+
+    appendCharacter('{');
+
+    for (unsigned i = 0; i < 16; i++) {
+        if (registers & (1 << i)) {
+            if (numberPrinted++)
+                appendSeparator();
+            appendRegisterName(i);
+        }
+    }
+
+    appendCharacter('}');
+}
+
+void ARMv7DOpcode::appendFPRegisterName(char registerPrefix, unsigned registerNumber)
+{
+    bufferPrintf("%c%u", registerPrefix, registerNumber);
+}
+
+// 16 Bit Instructions
+
+void ARMv7D16BitOpcode::init()
+{
+    OpcodeGroup* lastGroups[OpcodeGroup::opcodeTableSize];
+
+    for (unsigned i = 0; i < OpcodeGroup::opcodeTableSize; i++) {
+        opcodeTable[i] = 0;
+        lastGroups[i] = 0;
+    }
+
+    for (unsigned i = 0; i < sizeof(opcode16BitGroupList) / sizeof(Opcode16GroupInitializer); i++) {
+        OpcodeGroup* newOpcodeGroup = new OpcodeGroup(opcode16BitGroupList[i].m_mask, opcode16BitGroupList[i].m_pattern, opcode16BitGroupList[i].m_format);
+        uint16_t opcodeGroupNumber = opcode16BitGroupList[i].m_opcodeGroupNumber;
+
+        if (!opcodeTable[opcodeGroupNumber])
+            opcodeTable[opcodeGroupNumber] = newOpcodeGroup;
+        else
+            lastGroups[opcodeGroupNumber]->setNext(newOpcodeGroup);
+        lastGroups[opcodeGroupNumber] = newOpcodeGroup;
+    }
+}
+
+const char* ARMv7D16BitOpcode::doDisassemble()
+{
+    OpcodeGroup* opGroup = opcodeTable[opcodeGroupNumber(m_opcode)];
+
+    while (opGroup) {
+        if (opGroup->matches(static_cast<uint16_t>(m_opcode)))
+            return opGroup->format(this);
+        opGroup = opGroup->next();
+    }
+
+    return defaultFormat();
+}
+
+const char* ARMv7D16BitOpcode::defaultFormat()
+{
+    bufferPrintf("   .word  %04x", m_opcode);
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeAddRegisterT2::format()
+{
+    appendInstructionName("add");
+    appendRegisterName(rdn());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeAddSPPlusImmediate::format()
+{
+    appendInstructionName("add");
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(RegSP);
+    appendSeparator();
+    appendUnsignedImmediate(immediate8());
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeAddSubtract::s_opNames[2] = { "add", "sub" };
+
+const char* ARMv7DOpcodeAddSubtractT1::format()
+{
+    appendInstructionName(opName(), !inITBlock());
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeAddSubtractImmediate3::format()
+{
+    appendInstructionName(opName(), !inITBlock());
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendUnsignedImmediate(immediate3());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeAddSubtractImmediate8::format()
+{
+    appendInstructionName(opName(), !inITBlock());
+    appendRegisterName(rdn());
+    appendSeparator();
+    appendUnsignedImmediate(immediate8());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeBranchConditionalT1::format()
+{
+    if (condition() == 0xe)
+        return defaultFormat();
+
+    if (condition() == 0xf) {
+        appendInstructionName("svc");
+        appendUnsignedImmediate(offset());
+
+        return m_formatBuffer;
+    }
+
+    bufferPrintf("   b%-6.6s", conditionName(condition()));
+    appendPCRelativeOffset(static_cast<int32_t>(offset()) + 2);
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeBranchExchangeT1::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeBranchT2::format()
+{
+    appendInstructionName("b");
+    appendPCRelativeOffset(static_cast<int32_t>(immediate11()) + 2);
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeCompareImmediateT1::format()
+{
+    appendInstructionName("cmp");
+    appendRegisterName(rn());
+    appendSeparator();
+    appendUnsignedImmediate(immediate8());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeCompareRegisterT1::format()
+{
+    appendInstructionName("cmp");
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeCompareRegisterT2::format()
+{
+    appendInstructionName("compare");
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeDataProcessingRegisterT1::s_opNames[16] = {
+    "and", "eor", "lsl", "lsr", "asr", "adc", "sbc", "ror", "tst", "rsb", "cmp", "cmn", "orr", "mul", "bic", "mvn"
+};
+
+const char* ARMv7DOpcodeDataProcessingRegisterT1::format()
+{
+    appendInstructionName(opName(), inITBlock() && (!(op() == 0x8) || (op() == 0xa) || (op() == 0xb)));
+    appendRegisterName(rdn());
+    appendSeparator();
+    appendRegisterName(rm());
+    if (op() == 0x9) // rsb T1
+        appendString(", #0");
+    else if (op() == 0xd) { // mul T1
+        appendSeparator();
+        appendRegisterName(rdn());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeGeneratePCRelativeAddress::format()
+{
+    appendInstructionName("adr");
+    appendRegisterName(rd());
+    appendSeparator();
+    appendPCRelativeOffset(static_cast<int32_t>(immediate8()));
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeLoadFromLiteralPool::format()
+{
+    appendInstructionName("ldr");
+    appendRegisterName(rt());
+    appendSeparator();
+    appendPCRelativeOffset(static_cast<int32_t>(immediate8()));
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeLoadStoreRegisterImmediate::s_opNames[6] = {
+    "str", "ldr", "strb",  "ldrb", "strh", "ldrh"
+};
+
+const char* ARMv7DOpcodeLoadStoreRegisterImmediate::format()
+{
+    const char* instructionName = opName();
+
+    if (!instructionName)
+        return defaultFormat();
+
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(rn());
+    if (immediate5()) {
+        appendSeparator();
+        appendUnsignedImmediate(immediate5() << scale());
+    }
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+unsigned ARMv7DOpcodeLoadStoreRegisterImmediate::scale()
+{
+    switch (op()) {
+    case 0:
+    case 1:
+        return 2;
+    case 2:
+    case 3:
+        return 0;
+    case 4:
+    case 5:
+        return 1;
+    default:
+        break;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+const char* const ARMv7DOpcodeLoadStoreRegisterOffsetT1::s_opNames[8] = {
+    "str", "strh", "strb", "ldrsb", "ldr", "ldrh", "ldrb", "ldrsh"
+};
+
+const char* ARMv7DOpcodeLoadStoreRegisterOffsetT1::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeLoadStoreRegisterSPRelative::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(RegSP);
+    if (immediate8()) {
+        appendSeparator();
+        appendUnsignedImmediate(immediate8() << 2);
+    }
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeLogicalImmediateT1::format()
+{
+    if (!op() && !immediate5()) {
+        // mov T2
+        appendInstructionName("movs");
+        appendRegisterName(rd());
+        appendSeparator();
+        appendRegisterName(rm());
+
+        return m_formatBuffer;
+    }
+
+    appendInstructionName(opName(), !inITBlock());
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rm());
+    appendSeparator();
+    appendUnsignedImmediate((op() && !immediate5()) ? 32 : immediate5());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeMiscAddSubSP::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(RegSP);
+    appendSeparator();
+    appendRegisterName(RegSP);
+    appendSeparator();
+    appendUnsignedImmediate(immediate7());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeMiscBreakpointT1::format()
+{
+    appendInstructionNameNoITBlock("bkpt");
+    appendUnsignedImmediate(immediate8());
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeMiscByteHalfwordOps::s_opNames[8] = {
+    "sxth", "sxb", "uxth", "uxtb", "rev", "rev16", "revsh"
+};
+
+const char* ARMv7DOpcodeMiscByteHalfwordOps::format()
+{
+    const char* instructionName = opName();
+
+    if (!instructionName)
+        return defaultFormat();
+
+    appendInstructionName(instructionName);
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeMiscCompareAndBranch::format()
+{
+    appendInstructionName(opName());
+    appendPCRelativeOffset(immediate6() + 2);
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeMiscHint16::s_opNames[16] = {
+    "nop", "yield", "wfe", "wfi", "sev"
+};
+
+const char* ARMv7DOpcodeMiscHint16::format()
+{
+    if (opA() > 4)
+        return defaultFormat();
+
+    appendInstructionName(opName());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeMiscIfThenT1::format()
+{
+    char opName[6];
+    opName[0] = 'i';
+    opName[1] = 't';
+
+    unsigned condition = firstCondition();
+    unsigned maskBits = mask();
+    unsigned blockLength = 0;
+
+    for (unsigned i = 0; i < 4; ++i) {
+        if (maskBits & (1 << i)) {
+            blockLength = 4 - i;
+            break;
+        }
+    }
+
+    startITBlock(blockLength, condition);
+
+    for (unsigned i = 1; i < blockLength; ++i) {
+        unsigned currMaskBit = (maskBits >> (4-i)) & 0x1;
+        opName[i + 1] = (currMaskBit ^ (condition & 1)) ? 'e' : 't';
+        saveITConditionAt(i, (condition & ~1) | currMaskBit);
+    }
+    opName[blockLength + 1] = '\0';
+
+    appendInstructionNameNoITBlock(opName);
+    appendString(conditionName(condition));
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeMiscPushPop::format()
+{
+    appendInstructionName(opName());
+    appendRegisterList(registerMask());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeMoveImmediateT1::format()
+{
+    appendInstructionName("mov", !inITBlock());
+    appendRegisterName(rd());
+    appendSeparator();
+    appendUnsignedImmediate(immediate8());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeMoveRegisterT1::format()
+{
+    appendInstructionName("mov");
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+// 32 bit Intructions
+
+void ARMv7D32BitOpcode::init()
+{
+    OpcodeGroup* lastGroups[OpcodeGroup::opcodeTableSize];
+
+    for (unsigned i = 0; i < OpcodeGroup::opcodeTableSize; i++) {
+        opcodeTable[i] = 0;
+        lastGroups[i] = 0;
+    }
+
+    for (unsigned i = 0; i < sizeof(opcode32BitGroupList) / sizeof(Opcode32GroupInitializer); i++) {
+        OpcodeGroup* newOpcodeGroup = new OpcodeGroup(opcode32BitGroupList[i].m_mask, opcode32BitGroupList[i].m_pattern, opcode32BitGroupList[i].m_format);
+        uint16_t opcodeGroupNumber = opcode32BitGroupList[i].m_opcodeGroupNumber;
+
+        if (!opcodeTable[opcodeGroupNumber])
+            opcodeTable[opcodeGroupNumber] = newOpcodeGroup;
+        else
+            lastGroups[opcodeGroupNumber]->setNext(newOpcodeGroup);
+        lastGroups[opcodeGroupNumber] = newOpcodeGroup;
+    }
+}
+
+const char* ARMv7D32BitOpcode::doDisassemble()
+{
+    OpcodeGroup* opGroup = opcodeTable[opcodeGroupNumber(m_opcode)];
+
+    while (opGroup) {
+        if (opGroup->matches(m_opcode))
+            return opGroup->format(this);
+        opGroup = opGroup->next();
+    }
+
+    return defaultFormat();
+}
+
+const char* ARMv7D32BitOpcode::defaultFormat()
+{
+    bufferPrintf("   .long  %08x", m_opcode);
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeConditionalBranchT3::format()
+{
+    if (condition() < 0xe)
+        bufferPrintf("   b%-6.6s", conditionName(condition()));
+    else
+        appendInstructionName("b");
+    appendPCRelativeOffset(offset() + 2);
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeBranchOrBranchLink::format()
+{
+    appendInstructionName(isBL() ? "bl" : "b");
+    appendPCRelativeOffset(offset() + 2);
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeDataProcessingLogicalAndRithmetic::s_opNames[16] = {
+    "and", "bic", "orr", "orn", "eor", 0, "pkh", 0, "add", 0, "adc", "sbc", 0, "sub", "rsb", 0
+};
+
+void ARMv7DOpcodeDataProcessingModifiedImmediate::appendModifiedImmediate(unsigned immediate12)
+{
+    if (!(immediate12 & 0xc00)) {
+        unsigned immediate = 0;
+        unsigned lower8Bits = immediate12 & 0xff;
+
+        switch ((immediate12 >> 8) & 3) {
+        case 0:
+            immediate = lower8Bits;
+            break;
+        case 1:
+            immediate = (lower8Bits << 16) | lower8Bits;
+            break;
+        case 2:
+            immediate = (lower8Bits << 24) | (lower8Bits << 8);
+            break;
+        case 3:
+            immediate = (lower8Bits << 24) | (lower8Bits << 16) | (lower8Bits << 8) | lower8Bits;
+            break;
+        }
+        appendUnsignedImmediate(immediate);
+        return;
+    }
+
+    unsigned immediate8 = 0x80 | (immediate12 & 0x7f);
+    unsigned shiftAmount = 32 - ((immediate12 >> 7) & 0x1f);
+
+    appendUnsignedImmediate(immediate8 << shiftAmount);
+}
+
+const char* ARMv7DOpcodeDataProcessingModifiedImmediate::format()
+{
+    if ((op() == 0x5) || (op() == 0x6) || (op() == 0x7) || (op() == 0x9) || (op() == 0xc) || (op() == 0xf))
+        return defaultFormat();
+
+    const char* instructionName = opName();
+
+    if (rn() == 15) {
+        if (op() == 2) {
+            // MOV T2
+            instructionName = sBit() ? "movs" : "mov";
+            appendInstructionName(instructionName);
+            appendRegisterName(rd());
+            appendSeparator();
+            appendModifiedImmediate(immediate12());
+
+            return m_formatBuffer;
+        }
+
+        if (op() == 3) {
+            // MVN T1
+            instructionName = sBit() ? "mvns" : "mvn";
+            appendInstructionName(instructionName);
+            appendRegisterName(rd());
+            appendSeparator();
+            appendModifiedImmediate(immediate12());
+
+            return m_formatBuffer;
+        }
+    }
+
+    if (rd() == 15) {
+        if (sBit()) {
+            bool testOrCmpInstruction = false;
+
+            switch (op()) {
+            case 0x0:
+                instructionName = "tst";
+                testOrCmpInstruction = true;
+                break;
+            case 0x4:
+                instructionName = "teq";
+                testOrCmpInstruction = true;
+                break;
+            case 0x8:
+                instructionName = "cmn";
+                testOrCmpInstruction = true;
+                break;
+            case 0xd:
+                instructionName = "cmp";
+                testOrCmpInstruction = true;
+                break;
+            }
+
+            if (testOrCmpInstruction) {
+                appendInstructionName(instructionName);
+                appendRegisterName(rn());
+                appendSeparator();
+                appendModifiedImmediate(immediate12());
+
+                return m_formatBuffer;
+            }
+        }
+    }
+
+    appendInstructionName(instructionName);
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendModifiedImmediate(immediate12());
+
+    return m_formatBuffer;
+}
+
+void ARMv7DOpcodeDataProcessingShiftedReg::appendImmShift(unsigned type, unsigned immediate)
+{
+    if (type || immediate) {
+        appendSeparator();
+
+        if (!immediate) {
+            switch (type) {
+            case 1:
+            case 2:
+                immediate = 32;
+                break;
+            case 3:
+                appendString("rrx");
+                return;
+            }
+        }
+
+        appendShiftType(type);
+        appendUnsignedImmediate(immediate);
+    }
+}
+
+const char* ARMv7DOpcodeDataProcessingShiftedReg::format()
+{
+    if ((op() == 0x5) || (op() == 0x7) || (op() == 0x9) || (op() == 0xc) || (op() == 0xf))
+        return defaultFormat();
+
+    if (op() == 6) {
+        // pkhbt or pkhtb
+        if (sBit() || tBit())
+            return defaultFormat();
+
+        if (tbBit())
+            appendInstructionName("pkhtb");
+        else
+            appendInstructionName("pkhbt");
+        appendRegisterName(rd());
+        appendSeparator();
+        appendRegisterName(rn());
+        appendSeparator();
+        appendRegisterName(rm());
+        appendImmShift(tbBit() << 1, immediate5());
+
+        return m_formatBuffer;
+    }
+
+    const char* instructionName = opName();
+
+    if (rn() == 15) {
+        if (op() == 2) {
+            if (!type() && !immediate5()) {
+                // MOV T3
+                instructionName = sBit() ? "movs" : "mov";
+                appendInstructionName(instructionName);
+                appendRegisterName(rd());
+                appendSeparator();
+                appendRegisterName(rm());
+
+                return m_formatBuffer;
+            }
+
+            if (type() == 3 && !immediate5()) {
+                // RRX T1
+                instructionName = sBit() ? "rrx" : "rrx";
+                appendInstructionName(instructionName);
+                appendRegisterName(rd());
+                appendSeparator();
+                appendRegisterName(rm());
+
+                return m_formatBuffer;
+            }
+
+            // Logical
+            if (sBit())
+                bufferPrintf("%ss ", shiftName(type()));
+            else
+                appendInstructionName(shiftName(type()));
+            appendRegisterName(rd());
+            appendSeparator();
+            appendRegisterName(rm());
+            appendSeparator();
+            appendUnsignedImmediate(immediate5());
+
+            return m_formatBuffer;
+        }
+
+        if (op() == 3) {
+            // MVN T2
+            instructionName = sBit() ? "mvns" : "mvn";
+            appendInstructionName(instructionName);
+            appendRegisterName(rd());
+            appendSeparator();
+            appendRegisterName(rm());
+            appendImmShift(type(), immediate5());
+
+            return m_formatBuffer;
+        }
+    }
+
+    if (rd() == 15) {
+        if (sBit()) {
+            bool testOrCmpInstruction = false;
+
+            switch (op()) {
+            case 0x0:
+                instructionName = "tst";
+                testOrCmpInstruction = true;
+                break;
+            case 0x4:
+                instructionName = "teq";
+                testOrCmpInstruction = true;
+                break;
+            case 0x8:
+                instructionName = "cmn";
+                testOrCmpInstruction = true;
+                break;
+            case 0xd:
+                instructionName = "cmp";
+                testOrCmpInstruction = true;
+                break;
+            }
+
+            if (testOrCmpInstruction) {
+                appendInstructionName(instructionName);
+                appendRegisterName(rn());
+                appendSeparator();
+                appendRegisterName(rm());
+                appendImmShift(type(), immediate5());
+
+                return m_formatBuffer;
+            }
+        }
+    }
+
+    appendInstructionName(instructionName);
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+    appendImmShift(type(), immediate5());
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeFPTransfer::format()
+{
+    appendInstructionName("vmov");
+
+    if (opL()) {
+        appendFPRegister();
+        appendSeparator();
+    }
+
+    appendRegisterName(rt());
+
+    if (!opL()) {
+        appendSeparator();
+        appendFPRegister();
+    }
+
+    return m_formatBuffer;
+}
+
+void ARMv7DOpcodeFPTransfer::appendFPRegister()
+{
+    if (opC()) {
+        appendFPRegisterName('d', vd());
+        bufferPrintf("[%u]", opH());
+    } else
+        appendFPRegisterName('s', vn());
+}
+
+const char* ARMv7DOpcodeDataProcessingRegShift::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeDataProcessingRegExtend::s_opExtendNames[8] = {
+    "sxth", "uxth", "sxtb16", "uxtb16", "sxtb", "uxtb"
+};
+
+const char* const ARMv7DOpcodeDataProcessingRegExtend::s_opExtendAndAddNames[8] = {
+    "sxtah", "uxtah", "sxtab16", "uxtab16", "sxtab", "uxtab"
+};
+
+const char* ARMv7DOpcodeDataProcessingRegExtend::format()
+{
+    const char* instructionName;
+
+    if (rn() == 0xf)
+        instructionName = opExtendName();
+    else
+        instructionName = opExtendAndAddName();
+
+    if (!instructionName)
+        return defaultFormat();
+
+    appendInstructionName(instructionName);
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    if (rotate()) {
+        appendSeparator();
+        appendString("ror ");
+        appendUnsignedImmediate(rotate() * 8);
+    }
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeDataProcessingRegParallel::s_opNames[16] = {
+    "sadd8", "sadd16", "sasx", 0, "ssub8", "ssub16", "ssax", 0,
+    "qadd8", "qadd16", "qasx", 0, "qsub8", "qsub16", "qsax", 0
+};
+
+const char* ARMv7DOpcodeDataProcessingRegParallel::format()
+{
+    const char* instructionName;
+
+    instructionName = opName();
+
+    if (!instructionName)
+        return defaultFormat();
+
+    appendInstructionName(instructionName);
+    appendRegisterName(rd());
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeDataProcessingRegMisc::s_opNames[16] = {
+    "qadd", "qdadd", "qsub", "qdsub", "rev", "rev16", "rbit", "revsh",
+    "sel", 0, 0, 0, "clz"
+};
+
+const char* ARMv7DOpcodeDataProcessingRegMisc::format()
+{
+    const char* instructionName;
+
+    instructionName = opName();
+
+    if (!instructionName)
+        return defaultFormat();
+
+    if ((op1() & 0x1) && (rn() != rm()))
+        return defaultFormat();
+
+    appendInstructionName(instructionName);
+    appendRegisterName(rd());
+    appendSeparator();
+
+    if (op1() == 0x2) { // sel
+        appendRegisterName(rn());
+        appendSeparator();
+        appendRegisterName(rm());
+
+        return m_formatBuffer;
+    }
+
+    appendRegisterName(rm());
+
+    if (!(op1() & 0x1)) {
+        appendSeparator();
+        appendRegisterName(rn());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeHint32::s_opNames[8] = {
+    "nop", "yield", "wfe", "wfi", "sev"
+};
+
+const char* ARMv7DOpcodeHint32::format()
+{
+    if (isDebugHint()) {
+        appendInstructionName("debug");
+        appendUnsignedImmediate(debugOption());
+
+        return m_formatBuffer;
+    }
+
+    if (op() > 0x4)
+        return defaultFormat();
+
+    appendInstructionName(opName());
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeDataLoad::s_opNames[8] = {
+    "ldrb", "ldrh", "ldr", 0, "ldrsb", "ldrsh"
+};
+
+const char* ARMv7DOpcodeLoadRegister::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+    if (immediate2()) {
+        appendSeparator();
+        appendUnsignedImmediate(immediate2());
+    }
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeLoadSignedImmediate::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(rn());
+    if (pBit()) {
+        if (wBit() || immediate8()) {
+            appendSeparator();
+            if (uBit())
+                appendUnsignedImmediate(immediate8());
+            else
+                appendSignedImmediate(0 - static_cast<int>(immediate8()));
+        }
+        appendCharacter(']');
+        if (wBit())
+            appendCharacter('!');
+    } else {
+        appendCharacter(']');
+        appendSeparator();
+        if (uBit())
+            appendUnsignedImmediate(immediate8());
+        else
+            appendSignedImmediate(0 - static_cast<int>(immediate8()));
+    }
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeLoadUnsignedImmediate::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(rn());
+    if (immediate12()) {
+        appendSeparator();
+        appendUnsignedImmediate(immediate12());
+    }
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeLongMultipleDivide::s_opNames[8] = {
+    "smull", "sdiv", "umull", "udiv", "smlal", "smlsld", "umlal", 0
+};
+
+const char* const ARMv7DOpcodeLongMultipleDivide::s_smlalOpNames[4] = {
+    "smlalbb", "smlalbt", "smlaltb", "smlaltt"
+};
+
+const char* const ARMv7DOpcodeLongMultipleDivide::s_smlaldOpNames[2] = {
+    "smlald", "smlaldx"
+};
+
+const char* const ARMv7DOpcodeLongMultipleDivide::s_smlsldOpNames[2] = {
+    "smlsld", "smlsldx"
+};
+
+const char* ARMv7DOpcodeLongMultipleDivide::format()
+{
+    const char* instructionName = opName();
+
+    switch (op1()) {
+    case 0x0:
+    case 0x2:
+        if (op2())
+            return defaultFormat();
+        break;
+    case 0x1:
+    case 0x3:
+        if (op2() != 0xf)
+            return defaultFormat();
+        break;
+    case 0x4:
+        if ((op2() & 0xc) == 0x8)
+            instructionName = smlalOpName();
+        else if ((op2() & 0xe) == 0xc)
+            instructionName = smlaldOpName();
+        else if (op2())
+            return defaultFormat();
+        break;
+    case 0x5:
+        if ((op2() & 0xe) == 0xc)
+            instructionName = smlaldOpName();
+        else
+            return defaultFormat();
+        break;
+    case 0x6:
+        if (op2() == 0x5)
+            instructionName = "umaal";
+        else if (op2())
+            return defaultFormat();
+        break;
+    case 0x7:
+        return defaultFormat();
+        break;
+    }
+
+    appendInstructionName(instructionName);
+    if ((op1() & 0x5) == 0x1) { // sdiv and udiv
+        if (rt() != 0xf)
+            return defaultFormat();
+    } else {
+        appendRegisterName(rdLo());
+        appendSeparator();
+    }
+    appendRegisterName(rdHi());
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeUnmodifiedImmediate::s_opNames[16] = {
+    "addw", 0, "movw", 0, 0, "subw", "movt", 0,
+    "ssat", "ssat16", "sbfx", "bfi", "usat" , "usat16", "ubfx", 0
+};
+
+const char* ARMv7DOpcodeUnmodifiedImmediate::format()
+{
+    const char* instructionName = opName();
+
+    switch (op() >> 1) {
+    case 0x0:
+    case 0x5:
+        if (rn() == 0xf)
+            instructionName = "adr";
+        break;
+    case 0x9:
+        if (immediate5())
+            instructionName = "ssat";
+        break;
+    case 0xb:
+        if (rn() == 0xf)
+            instructionName = "bfc";
+        break;
+    case 0xd:
+        if (immediate5())
+            instructionName = "usat";
+        break;
+    }
+
+    if (!instructionName)
+        return defaultFormat();
+
+    appendInstructionName(instructionName);
+    appendRegisterName(rd());
+    appendSeparator();
+
+    if ((op() & 0x17) == 0x4) { // movw or movt
+        appendUnsignedImmediate(immediate16());
+
+        return m_formatBuffer;
+    }
+
+    if (!op() || (op() == 0xa)) { // addw, subw and adr
+        if (rn() == 0xf) {
+            int32_t offset;
+
+            if ((op() == 0xa) && (rn() == 0xf))
+                offset = 0 - static_cast<int32_t>(immediate12());
+            else
+                offset = static_cast<int32_t>(immediate12());
+
+            appendPCRelativeOffset(offset);
+
+            return m_formatBuffer;
+        }
+
+        appendRegisterName(rn());
+        appendSeparator();
+        appendUnsignedImmediate(immediate12());
+
+        return m_formatBuffer;
+    }
+
+    if (((op() & 0x15) == 0x10) || (((op() & 0x17) == 0x12) && immediate5())) { // ssat, usat, ssat16 & usat16
+        appendSeparator();
+        appendUnsignedImmediate(bitNumOrSatImmediate() + 1);
+        appendSeparator();
+        appendRegisterName(rn());
+        if (shBit() || immediate5()) {
+            appendSeparator();
+            appendShiftType(shBit() << 1);
+            appendUnsignedImmediate(immediate5());
+        }
+
+        return m_formatBuffer;
+    }
+
+    if (op() == 0x16) { // bfi or bfc
+        int width = static_cast<int>(bitNumOrSatImmediate()) - static_cast<int>(immediate5()) + 1;
+
+        if (width < 0)
+            return defaultFormat();
+
+        if (rn() != 0xf) {
+            appendSeparator();
+            appendRegisterName(rn());
+        }
+        appendSeparator();
+        appendUnsignedImmediate(immediate5());
+        appendSeparator();
+        appendSignedImmediate(width);
+
+        return m_formatBuffer;
+    }
+
+    // Must be sbfx or ubfx
+    appendSeparator();
+    appendRegisterName(rn());
+    appendSeparator();
+    appendUnsignedImmediate(immediate5());
+    appendSeparator();
+    appendUnsignedImmediate(bitNumOrSatImmediate() + 1);
+
+    return m_formatBuffer;
+}
+
+const char* const ARMv7DOpcodeDataStoreSingle::s_opNames[4] = {
+    "strb", "strh", "str", 0
+};
+
+const char* ARMv7DOpcodeDataPushPopSingle::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+
+    return m_formatBuffer;
+}
+
+void ARMv7DOpcodeDataPushPopMultiple::appendRegisterList()
+{
+    unsigned registers = registerList();
+
+    appendCharacter('{');
+    bool needSeparator = false;
+
+    for (unsigned i = 0; i < 16; i++) {
+        if (registers & (1 << i)) {
+            if (needSeparator)
+                appendSeparator();
+            appendRegisterName(i);
+            needSeparator = true;
+        }
+    }
+    appendCharacter('}');
+}
+
+const char* ARMv7DOpcodeDataPopMultiple::format()
+{
+    if (condition() != 0xe)
+        bufferPrintf("   pop%-4.4s", conditionName(condition()));
+    else
+        appendInstructionName("pop");
+    appendRegisterList();
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeDataPushMultiple::format()
+{
+    if (condition() != 0xe)
+        bufferPrintf("   push%-3.3s", conditionName(condition()));
+    else
+        appendInstructionName("push");
+    appendRegisterList();
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeStoreSingleImmediate12::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(rn());
+    if (immediate12()) {
+        appendSeparator();
+        appendUnsignedImmediate(immediate12());
+    }
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeStoreSingleImmediate8::format()
+{
+    if (pBit() && uBit() && !wBit()) // Really undecoded strt
+        return defaultFormat();
+
+    if ((rn() == 0xf) || (!pBit() && !wBit()))
+        return defaultFormat();
+
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(rn());
+
+    if (!pBit()) {
+        appendCharacter(']');
+        appendSeparator();
+        appendSignedImmediate(uBit() ? static_cast<int32_t>(immediate8()) : (0 - static_cast<int32_t>(immediate8())));
+
+        return m_formatBuffer;
+    }
+
+    if (immediate8()) {
+        appendSeparator();
+        appendSignedImmediate(uBit() ? static_cast<int32_t>(immediate8()) : (0 - static_cast<int32_t>(immediate8())));
+    }
+    appendCharacter(']');
+
+    if (wBit())
+        appendCharacter('!');
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeStoreSingleRegister::format()
+{
+    appendInstructionName(opName());
+    appendRegisterName(rt());
+    appendSeparator();
+    appendCharacter('[');
+    appendRegisterName(rn());
+    appendSeparator();
+    appendRegisterName(rm());
+    if (immediate2()) {
+        appendSeparator();
+        appendString("lsl ");
+        appendUnsignedImmediate(immediate2());
+    }
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeVCMP::format()
+{
+    bufferPrintf("   vcmp");
+
+    if (eBit())
+        appendCharacter('e'); // Raise exception on qNaN
+
+    if (condition() != 0xe)
+        appendString(conditionName(condition()));
+
+    appendCharacter('.');
+    appendString(szBit() ? "f64" : "f32");
+    appendCharacter(' ');
+    if (szBit()) {
+        appendFPRegisterName('d', (dBit() << 4) | vd());
+        appendSeparator();
+        appendFPRegisterName('d', (mBit() << 4) | vm());
+    } else {
+        appendFPRegisterName('s', (vd() << 1) | dBit());
+        appendSeparator();
+        appendFPRegisterName('s', (vm() << 1) | mBit());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeVCVTBetweenFPAndInt::format()
+{
+    bufferPrintf("   vcvt");
+    bool convertToInteger = op2() & 0x4;
+
+    if (convertToInteger) {
+        if (!op())
+            appendCharacter('r'); // Round using mode in FPSCR
+        if (condition() != 0xe)
+            appendString(conditionName(condition()));
+        appendCharacter('.');
+        appendCharacter((op2() & 1) ? 's' : 'u');
+        appendString("32.f");
+        appendString(szBit() ? "64" : "32");
+        appendCharacter(' ');
+        appendFPRegisterName('s', (vd() << 1) | dBit());
+        appendSeparator();
+        if (szBit())
+            appendFPRegisterName('d', (mBit() << 4) | vm());
+        else
+            appendFPRegisterName('s', (vm() << 1) | mBit());
+    } else {
+        if (condition() != 0xe)
+            appendString(conditionName(condition()));
+        appendCharacter('.');
+        appendString(szBit() ? "f64." : "f32.");
+        appendString(op() ? "s32" : "u32");
+        appendCharacter(' ');
+        if (szBit())
+            appendFPRegisterName('d', (dBit() << 4) | vd());
+        else
+            appendFPRegisterName('s', (vd() << 1) | dBit());
+        appendSeparator();
+        appendFPRegisterName('s', (vm() << 1) | mBit());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeVLDR::format()
+{
+    if (condition() != 0xe)
+        bufferPrintf("   vldr%-3.3s", conditionName(condition()));
+    else
+        appendInstructionName("vldr");
+
+    appendFPRegisterName(doubleReg() ? 'd' : 's', vd());
+    appendSeparator();
+
+    int immediate = immediate8() * 4;
+
+    if (!uBit())
+        immediate = -immediate;
+
+    appendCharacter('[');
+
+    if (rn() == RegPC)
+        appendPCRelativeOffset(immediate);
+    else {
+        appendRegisterName(rn());
+
+        if (immediate) {
+            appendSeparator();
+            appendSignedImmediate(immediate);
+        }
+    }
+
+    appendCharacter(']');
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeVMOVDoublePrecision::format()
+{
+    appendInstructionName("vmov");
+    if (op()) {
+        appendRegisterName(rt());
+        appendSeparator();
+        appendRegisterName(rt2());
+        appendSeparator();
+    }
+
+    appendFPRegisterName('d', vm());
+
+    if (!op()) {
+        appendSeparator();
+        appendRegisterName(rt());
+        appendSeparator();
+        appendRegisterName(rt2());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeVMOVSinglePrecision::format()
+{
+    appendInstructionName("vmov");
+    if (op()) {
+        appendRegisterName(rt());
+        appendSeparator();
+        appendRegisterName(rt2());
+        appendSeparator();
+    }
+
+    appendFPRegisterName('s', vm());
+    appendSeparator();
+    appendFPRegisterName('s', (vm() + 1) % 32);
+
+    if (!op()) {
+        appendSeparator();
+        appendRegisterName(rt());
+        appendSeparator();
+        appendRegisterName(rt2());
+    }
+
+    return m_formatBuffer;
+}
+
+const char* ARMv7DOpcodeVMSR::format()
+{
+    appendInstructionName("vmrs");
+    if (opL()) {
+        if (rt() == 0xf)
+            appendString("apsr_nzcv");
+        else
+            appendRegisterName(rt());
+        appendSeparator();
+    }
+
+    appendString("fpscr");
+
+    if (!opL()) {
+        appendSeparator();
+        appendRegisterName(rt());
+    }
+
+    return m_formatBuffer;
+}
+
+} } // namespace JSC::ARMv7Disassembler
+
+#endif // #if USE(ARMV7_DISASSEMBLER)
diff --git a/disassembler/ARMv7/ARMv7DOpcode.h b/disassembler/ARMv7/ARMv7DOpcode.h
new file mode 100644
index 0000000..e00ff9c
--- /dev/null
+++ b/disassembler/ARMv7/ARMv7DOpcode.h
@@ -0,0 +1,1234 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if USE(ARMV7_DISASSEMBLER)
+
+#include <stdint.h>
+#include <wtf/Assertions.h>
+
+namespace JSC { namespace ARMv7Disassembler {
+
+class ARMv7DOpcode {
+public:
+    static void init();
+
+    ARMv7DOpcode()
+        : m_opcode(0)
+        , m_bufferOffset(0)
+    {
+        init();
+
+        for (unsigned i = 0; i < 4; i++)
+            m_ifThenConditions[i] = CondNone;
+
+        endITBlock();
+
+        m_formatBuffer[0] = '\0';
+    }
+
+    const char* disassemble(uint16_t*& currentPC);
+
+protected:
+    const unsigned RegSP = 0xd;
+    const unsigned RegLR = 0xe;
+    const unsigned RegPC = 0xf;
+
+    void fetchOpcode(uint16_t*&);
+    bool is32BitInstruction() { return (m_opcode & 0xfffff800) > 0xe000; }
+    bool isFPInstruction() { return (m_opcode & 0xfc000e00) == 0xec000a00; }
+
+    static const char* const s_conditionNames[16];
+    static const char* const s_shiftNames[4];
+    static const char* const s_optionName[8];
+    static const char* const s_specialRegisterNames[3];
+
+    static const char* conditionName(unsigned condition) { return s_conditionNames[condition & 0xf]; }
+    static const char* shiftName(unsigned shiftValue) { return s_shiftNames[shiftValue & 0x3]; }
+
+    bool inITBlock() { return m_ITConditionIndex < m_ITBlocksize; }
+    bool startingITBlock() { return m_ITConditionIndex == m_ITBlocksize + 1; }
+
+    void startITBlock(unsigned, unsigned);
+    void saveITConditionAt(unsigned, unsigned);
+    void endITBlock()
+    {
+        m_currentITCondition = CondNone;
+        m_ITConditionIndex = 0;
+        m_ITBlocksize = 0;
+    }
+
+    void bufferPrintf(const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
+    void appendInstructionName(const char*, bool addS = false);
+
+    void appendInstructionNameNoITBlock(const char* instructionName)
+    {
+        bufferPrintf("   %-7.7s", instructionName);
+    }
+
+    void appendRegisterName(unsigned);
+    void appendRegisterList(unsigned);
+    void appendFPRegisterName(char, unsigned);
+
+    void appendSeparator()
+    {
+        bufferPrintf(", ");
+    }
+
+    void appendCharacter(const char c)
+    {
+        bufferPrintf("%c", c);
+    }
+
+    void appendString(const char* string)
+    {
+        bufferPrintf("%s", string);
+    }
+
+    void appendShiftType(unsigned shiftValue)
+    {
+        bufferPrintf("%s ", shiftName(shiftValue));
+    }
+
+    void appendSignedImmediate(int immediate)
+    {
+        bufferPrintf("#%d", immediate);
+    }
+
+    void appendUnsignedImmediate(unsigned immediate)
+    {
+        bufferPrintf("#%u", immediate);
+    }
+
+    void appendPCRelativeOffset(int32_t immediate)
+    {
+        bufferPrintf("0x%x", reinterpret_cast<uint32_t>(m_currentPC + immediate));
+    }
+
+    void appendShiftAmount(unsigned amount)
+    {
+        bufferPrintf("lsl #%u", 16 * amount);
+    }
+
+    static const int bufferSize = 81;
+    static const unsigned char CondNone = 0xe;
+    static const unsigned MaxITBlockSize = 4;
+
+    char m_formatBuffer[bufferSize];
+    unsigned char m_ifThenConditions[MaxITBlockSize];
+    uint16_t* m_currentPC;
+    uint32_t m_opcode;
+    int m_bufferOffset;
+    int m_currentITCondition;
+    unsigned m_ITConditionIndex;
+    unsigned m_ITBlocksize;
+
+private:
+    static bool s_initialized;
+};
+
+#define DEFINE_STATIC_FORMAT16(klass, thisObj) \
+    static const char* format(ARMv7D16BitOpcode* thisObj) { return reinterpret_cast< klass *>(thisObj)->format(); }
+
+class ARMv7D16BitOpcode : public ARMv7DOpcode {
+private:
+    class OpcodeGroup {
+    public:
+        OpcodeGroup(uint16_t opcodeMask, uint16_t opcodePattern, const char* (*format)(ARMv7D16BitOpcode*))
+            : m_opcodeMask(opcodeMask)
+            , m_opcodePattern(opcodePattern)
+            , m_format(format)
+            , m_next(0)
+        {
+        }
+
+        void setNext(OpcodeGroup* next)
+        {
+            m_next = next;
+        }
+
+        OpcodeGroup* next()
+        {
+            return m_next;
+        }
+
+        bool matches(uint16_t opcode)
+        {
+            return (opcode & m_opcodeMask) == m_opcodePattern;
+        }
+
+        const char* format(ARMv7D16BitOpcode* thisObj)
+        {
+            return m_format(thisObj);
+        }
+
+    public:
+        static const unsigned opcodeTableSize = 32;
+        static const unsigned opcodeTableMask = opcodeTableSize-1;
+
+        // private:
+        uint16_t m_opcodeMask;
+        uint16_t m_opcodePattern;
+        const char* (*m_format)(ARMv7D16BitOpcode*);
+        OpcodeGroup* m_next;
+    };
+
+public:
+    static void init();
+
+    const char* defaultFormat();
+    const char* doDisassemble();
+
+protected:
+    unsigned rm() { return (m_opcode >> 3) & 0x7; }
+    unsigned rd() { return m_opcode & 0x7; }
+    unsigned opcodeGroupNumber(unsigned opcode) { return (opcode >> 11) & OpcodeGroup::opcodeTableMask; }
+
+private:
+    static OpcodeGroup* opcodeTable[OpcodeGroup::opcodeTableSize];
+};
+
+class ARMv7DOpcodeAddRegisterT2 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xff00;
+    static const uint16_t s_pattern = 0x4400;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeAddRegisterT2, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rdn() { return ((m_opcode >> 4) & 0x8) | (m_opcode & 0x7); }
+    unsigned rm() { return ((m_opcode >> 3) & 0xf); }
+};
+
+class ARMv7DOpcodeAddSPPlusImmediate : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf800;
+    static const uint16_t s_pattern = 0xc800;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeAddSPPlusImmediate, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rd() { return (m_opcode >> 8) & 0x7; }
+    unsigned immediate8() { return m_opcode & 0x0ff; }
+};
+
+class ARMv7DOpcodeAddSubtract : public ARMv7D16BitOpcode {
+protected:
+    static const char* const s_opNames[2];
+};
+
+class ARMv7DOpcodeAddSubtractT1 : public ARMv7DOpcodeAddSubtract {
+public:
+    static const uint16_t s_mask = 0xfc00;
+    static const uint16_t s_pattern = 0x1800;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeAddSubtractT1, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned op() { return (m_opcode >> 9) & 0x1; }
+    unsigned rm() { return (m_opcode >> 6) & 0x7; }
+    unsigned rn() { return (m_opcode >> 3) & 0x7; }
+};
+
+class ARMv7DOpcodeAddSubtractImmediate3 : public ARMv7DOpcodeAddSubtract {
+public:
+    static const uint16_t s_mask = 0xfc00;
+    static const uint16_t s_pattern = 0x1c00;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeAddSubtractImmediate3, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned op() { return (m_opcode >> 9) & 0x1; }
+    unsigned immediate3() { return (m_opcode >> 6) & 0x7; }
+    unsigned rn() { return (m_opcode >> 3) & 0x7; }
+};
+
+class ARMv7DOpcodeAddSubtractImmediate8 : public ARMv7DOpcodeAddSubtract {
+public:
+    static const uint16_t s_mask = 0xf000;
+    static const uint16_t s_pattern = 0x3000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeAddSubtractImmediate8, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned op() { return (m_opcode >> 11) & 0x1; }
+    unsigned rdn() { return (m_opcode >> 8) & 0x7; }
+    unsigned immediate8() { return m_opcode & 0xff; }
+};
+
+class ARMv7DOpcodeBranchConditionalT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf000;
+    static const uint16_t s_pattern = 0xd000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeBranchConditionalT1, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned condition() { return (m_opcode >> 8) & 0xf; }
+    int offset() { return static_cast<int>(m_opcode & 0xff); }
+};
+
+class ARMv7DOpcodeBranchExchangeT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xff00;
+    static const uint16_t s_pattern = 0x4700;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeBranchExchangeT1, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return (m_opcode & 0x80) ? "blx" : "bx"; }
+    unsigned rm() { return ((m_opcode >> 3) & 0xf); }
+};
+
+class ARMv7DOpcodeBranchT2 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf800;
+    static const uint16_t s_pattern = 0xe000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeBranchT2, thisObj);
+
+protected:
+    const char* format();
+
+    int immediate11() { return static_cast<int>(m_opcode & 0x7ff); }
+};
+
+class ARMv7DOpcodeCompareImmediateT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf800;
+    static const uint16_t s_pattern = 0x2800;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeCompareImmediateT1, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rn() { return (m_opcode >> 8) & 0x3; }
+    unsigned immediate8() { return m_opcode & 0xff; }
+};
+
+class ARMv7DOpcodeCompareRegisterT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xffc0;
+    static const uint16_t s_pattern = 0x4280;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeCompareRegisterT1, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rn() { return m_opcode & 0x7; }
+};
+
+class ARMv7DOpcodeCompareRegisterT2 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xff00;
+    static const uint16_t s_pattern = 0x4500;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeCompareRegisterT2, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rn() { return ((m_opcode >> 4) & 0x8) | (m_opcode & 0x7); }
+    unsigned rm() { return ((m_opcode >> 3) & 0xf); }
+};
+
+class ARMv7DOpcodeDataProcessingRegisterT1 : public ARMv7D16BitOpcode {
+private:
+    static const char* const s_opNames[16];
+
+public:
+    static const uint16_t s_mask = 0xfc00;
+    static const uint16_t s_pattern = 0x4000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeDataProcessingRegisterT1, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned op() { return (m_opcode >> 6) & 0xf; }
+
+    unsigned rm() { return (m_opcode >> 3) & 0x7; }
+    unsigned rdn() { return m_opcode & 0x7; }
+};
+
+class ARMv7DOpcodeGeneratePCRelativeAddress : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf800;
+    static const uint16_t s_pattern = 0xa000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeGeneratePCRelativeAddress, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rd() { return (m_opcode >> 8) & 0x7; }
+    unsigned immediate8() { return m_opcode & 0x0ff; }
+};
+
+class ARMv7DOpcodeLoadFromLiteralPool : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf800;
+    static const uint16_t s_pattern = 0x4800;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeLoadFromLiteralPool, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rt() { return (m_opcode >> 8) & 0x7; }
+    unsigned immediate8() { return m_opcode & 0x0ff; }
+};
+
+class ARMv7DOpcodeLoadStoreRegisterImmediate : public ARMv7D16BitOpcode {
+private:
+    static const char* const s_opNames[6];
+
+public:
+    const char* format();
+
+protected:
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned op() { return ((m_opcode >> 11) & 0x1f) - 0xc; }
+    unsigned immediate5() { return (m_opcode >> 6) & 0x01f; }
+    unsigned rn() { return (m_opcode >> 3) & 0x7; }
+    unsigned rt() { return m_opcode & 0x7; }
+    unsigned scale();
+};
+
+class ARMv7DOpcodeLoadStoreRegisterImmediateWordAndByte : public ARMv7DOpcodeLoadStoreRegisterImmediate {
+public:
+    static const uint16_t s_mask = 0xe000;
+    static const uint16_t s_pattern = 0x6000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeLoadStoreRegisterImmediate, thisObj);
+};
+
+class ARMv7DOpcodeStoreRegisterImmediateHalfWord : public ARMv7DOpcodeLoadStoreRegisterImmediate {
+public:
+    static const uint16_t s_mask = 0xf800;
+    static const uint16_t s_pattern = 0x8000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeLoadStoreRegisterImmediate, thisObj);
+};
+
+class ARMv7DOpcodeLoadRegisterImmediateHalfWord : public ARMv7DOpcodeLoadStoreRegisterImmediate {
+public:
+    static const uint16_t s_mask = 0xf800;
+    static const uint16_t s_pattern = 0x8800;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeLoadStoreRegisterImmediate, thisObj);
+};
+
+class ARMv7DOpcodeLoadStoreRegisterOffsetT1 : public ARMv7D16BitOpcode {
+private:
+    static const char* const s_opNames[8];
+
+public:
+    static const uint16_t s_mask = 0xf000;
+    static const uint16_t s_pattern = 0x5000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeLoadStoreRegisterOffsetT1, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[opB()]; }
+
+    unsigned opB() { return (m_opcode >> 9) & 0x7; }
+    unsigned rm() { return (m_opcode >> 6) & 0x7; }
+    unsigned rn() { return (m_opcode >> 3) & 0x7; }
+    unsigned rt() { return m_opcode & 0x7; }
+};
+
+class ARMv7DOpcodeLoadStoreRegisterSPRelative : public ARMv7D16BitOpcode {
+private:
+    static const char* const s_opNames[8];
+
+public:
+    static const uint16_t s_mask = 0xf000;
+    static const uint16_t s_pattern = 0x9000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeLoadStoreRegisterSPRelative, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return op() ? "ldr" : "str"; }
+
+    unsigned op() { return (m_opcode >> 11) & 0x1; }
+    unsigned rt() { return (m_opcode >> 8) & 0x7; }
+    unsigned immediate8() { return m_opcode & 0xff; }
+};
+
+class ARMv7DOpcodeLogicalImmediateT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xe000;
+    static const uint16_t s_pattern = 0x0000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeLogicalImmediateT1, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return shiftName(op()); }
+
+    unsigned op() { return (m_opcode >> 12) & 0x3; }
+    unsigned immediate5() { return (m_opcode >> 6) & 0x1f; }
+};
+
+class ARMv7DOpcodeMiscAddSubSP : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xff00;
+    static const uint16_t s_pattern = 0xb000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMiscAddSubSP, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return op() ? "sub" : "add"; }
+    unsigned op() { return (m_opcode >> 7) & 0x1; }
+    unsigned immediate7() { return m_opcode & 0x7f; }
+};
+
+class ARMv7DOpcodeMiscByteHalfwordOps : public ARMv7D16BitOpcode {
+private:
+    static const char* const s_opNames[8];
+
+public:
+    static const uint16_t s_mask = 0xf700;
+    static const uint16_t s_pattern = 0xb200;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMiscByteHalfwordOps, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op()]; }
+    unsigned op() { return ((m_opcode >> 9) & 0x4) || ((m_opcode >> 6) & 0x3); }
+};
+
+class ARMv7DOpcodeMiscBreakpointT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xff00;
+    static const uint16_t s_pattern = 0xbe00;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMiscBreakpointT1, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned immediate8() { return m_opcode & 0xff; }
+};
+
+class ARMv7DOpcodeMiscCompareAndBranch : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf500;
+    static const uint16_t s_pattern = 0xb100;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMiscCompareAndBranch, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return op() ? "cbnz" : "cbz"; }
+    unsigned op() { return (m_opcode >> 11) & 0x1; }
+    int32_t immediate6() { return ((m_opcode >> 4) & 0x20) | ((m_opcode >> 3) & 0x1f); }
+    unsigned rn() { return m_opcode & 0x7; }
+};
+
+class ARMv7DOpcodeMiscHint16 : public ARMv7D16BitOpcode {
+private:
+    static const char* const s_opNames[16];
+
+public:
+    static const uint16_t s_mask = 0xff0f;
+    static const uint16_t s_pattern = 0xbf00;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMiscHint16, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[opA()]; }
+    unsigned opA() { return (m_opcode >> 4) & 0xf; }
+};
+
+class ARMv7DOpcodeMiscIfThenT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xff00;
+    static const uint16_t s_pattern = 0xbf00;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMiscIfThenT1, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned firstCondition() { return (m_opcode >> 4) & 0xf; }
+    unsigned mask() { return m_opcode & 0xf; }
+};
+
+class ARMv7DOpcodeMiscPushPop : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf600;
+    static const uint16_t s_pattern = 0xb400;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMiscPushPop, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return op() ? "pop" : "push"; }
+    unsigned op() { return (m_opcode >> 11) & 0x1; }
+    unsigned registerMask() { return ((m_opcode << 6) & 0x4000) | (m_opcode & 0xff); }
+};
+
+class ARMv7DOpcodeMoveImmediateT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xf800;
+    static const uint16_t s_pattern = 0x2000;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMoveImmediateT1, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rd() { return (m_opcode >> 8) & 0x3; }
+    unsigned immediate8() { return m_opcode & 0xff; }
+};
+
+class ARMv7DOpcodeMoveRegisterT1 : public ARMv7D16BitOpcode {
+public:
+    static const uint16_t s_mask = 0xff00;
+    static const uint16_t s_pattern = 0x4600;
+
+    DEFINE_STATIC_FORMAT16(ARMv7DOpcodeMoveRegisterT1, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned rd() { return ((m_opcode >> 4) & 0x8) | (m_opcode & 0x7); }
+    unsigned rm() { return ((m_opcode >> 3) & 0xf); }
+};
+
+// 32 Bit instructions
+
+#define DEFINE_STATIC_FORMAT32(klass, thisObj) \
+    static const char* format(ARMv7D32BitOpcode* thisObj) { return reinterpret_cast< klass *>(thisObj)->format(); }
+
+class ARMv7D32BitOpcode : public ARMv7DOpcode {
+private:
+    class OpcodeGroup {
+    public:
+        OpcodeGroup(uint32_t opcodeMask, uint32_t opcodePattern, const char* (*format)(ARMv7D32BitOpcode*))
+            : m_opcodeMask(opcodeMask)
+            , m_opcodePattern(opcodePattern)
+            , m_format(format)
+            , m_next(0)
+        {
+        }
+
+        void setNext(OpcodeGroup* next)
+        {
+            m_next = next;
+        }
+
+        OpcodeGroup* next()
+        {
+            return m_next;
+        }
+
+        bool matches(uint32_t opcode)
+        {
+            return (opcode & m_opcodeMask) == m_opcodePattern;
+        }
+
+        const char* format(ARMv7D32BitOpcode* thisObj)
+        {
+            return m_format(thisObj);
+        }
+
+    public:
+        static const unsigned opcodeTableSize = 16;
+        static const unsigned opcodeTableMask = opcodeTableSize-1;
+
+    private:
+        uint32_t m_opcodeMask;
+        uint32_t m_opcodePattern;
+        const char* (*m_format)(ARMv7D32BitOpcode*);
+        OpcodeGroup* m_next;
+    };
+
+public:
+    static void init();
+
+    const char* defaultFormat();
+    const char* doDisassemble();
+
+protected:
+    unsigned rd() { return (m_opcode >> 8) & 0xf; }
+    unsigned rm() { return m_opcode & 0xf; }
+    unsigned rn() { return (m_opcode >> 16) & 0xf; }
+    unsigned rt() { return (m_opcode >> 12) & 0xf; }
+
+    unsigned opcodeGroupNumber(unsigned opcode) { return (opcode >> 25) & OpcodeGroup::opcodeTableMask; }
+
+private:
+    static OpcodeGroup* opcodeTable[OpcodeGroup::opcodeTableSize];
+};
+
+class ARMv7DOpcodeBranchRelative : public ARMv7D32BitOpcode {
+protected:
+    unsigned sBit() { return (m_opcode >> 26) & 0x1; }
+    unsigned j1() { return (m_opcode >> 13) & 0x1; }
+    unsigned j2() { return (m_opcode >> 11) & 0x1; }
+    unsigned immediate11() { return m_opcode & 0x7ff; }
+};
+
+class ARMv7DOpcodeConditionalBranchT3 : public ARMv7DOpcodeBranchRelative {
+public:
+    static const uint32_t s_mask = 0xf800d000;
+    static const uint32_t s_pattern = 0xf0008000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeConditionalBranchT3, thisObj);
+
+protected:
+    const char* format();
+
+    int32_t offset() { return ((static_cast<int32_t>(sBit() << 31)) >> 12) | static_cast<int32_t>((j1() << 18) | (j2() << 17) | (immediate6() << 11) | immediate11()); }
+    unsigned condition() { return (m_opcode >> 22) & 0xf; }
+    unsigned immediate6() { return (m_opcode >> 16) & 0x3f; }
+};
+
+class ARMv7DOpcodeBranchOrBranchLink : public ARMv7DOpcodeBranchRelative {
+public:
+    static const uint32_t s_mask = 0xf8009000;
+    static const uint32_t s_pattern = 0xf0009000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeBranchOrBranchLink, thisObj);
+
+protected:
+    const char* format();
+
+    int32_t offset() { return ((static_cast<int32_t>(sBit() << 31)) >> 8) | static_cast<int32_t>((~(j1() ^ sBit()) << 22) | (~(j2() ^ sBit()) << 21) | (immediate10() << 11) | immediate11()); }
+    unsigned immediate10() { return (m_opcode >> 16) & 0x3ff; }
+    bool isBL() { return !!((m_opcode >> 14) & 0x1); }
+};
+
+class ARMv7DOpcodeDataProcessingLogicalAndRithmetic : public ARMv7D32BitOpcode {
+protected:
+    static const char* const s_opNames[16];
+};
+
+class ARMv7DOpcodeDataProcessingModifiedImmediate : public ARMv7DOpcodeDataProcessingLogicalAndRithmetic {
+private:
+    void appendImmShift(unsigned, unsigned);
+
+public:
+    static const uint32_t s_mask = 0xfa008000;
+    static const uint32_t s_pattern = 0xf0000000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataProcessingModifiedImmediate, thisObj);
+
+protected:
+    const char* format();
+    void appendModifiedImmediate(unsigned);
+
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned op() { return (m_opcode >> 21) & 0xf; }
+    unsigned sBit() { return (m_opcode >> 20) & 0x1; }
+    unsigned immediate12() { return ((m_opcode >> 15) & 0x0800) | ((m_opcode >> 4) & 0x0700) | (m_opcode & 0x00ff); }
+};
+
+class ARMv7DOpcodeDataProcessingShiftedReg : public ARMv7DOpcodeDataProcessingLogicalAndRithmetic {
+private:
+    void appendImmShift(unsigned, unsigned);
+
+public:
+    static const uint32_t s_mask = 0xfe000000;
+    static const uint32_t s_pattern = 0xea000000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataProcessingShiftedReg, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned sBit() { return (m_opcode >> 20) & 0x1; }
+    unsigned op() { return (m_opcode >> 21) & 0xf; }
+    unsigned immediate5() { return ((m_opcode >> 10) & 0x1c) | ((m_opcode >> 6) & 0x3); }
+    unsigned type() { return (m_opcode >> 4) & 0x3; }
+    unsigned tbBit() { return (m_opcode >> 5) & 0x1; }
+    unsigned tBit() { return (m_opcode >> 4) & 0x1; }
+};
+
+class ARMv7DOpcodeDataProcessingReg : public ARMv7D32BitOpcode {
+protected:
+    unsigned op1() { return (m_opcode >> 20) & 0xf; }
+    unsigned op2() { return (m_opcode >> 4) & 0xf; }
+};
+
+class ARMv7DOpcodeDataProcessingRegShift : public ARMv7DOpcodeDataProcessingReg {
+public:
+    static const uint32_t s_mask = 0xffe0f0f0;
+    static const uint32_t s_pattern = 0xfa00f000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataProcessingRegShift, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return shiftName((op1() >> 1) & 0x3); }
+};
+
+class ARMv7DOpcodeDataProcessingRegExtend : public ARMv7DOpcodeDataProcessingReg {
+private:
+    static const char* const s_opExtendNames[8];
+    static const char* const s_opExtendAndAddNames[8];
+
+public:
+    static const uint32_t s_mask = 0xff80f0c0;
+    static const uint32_t s_pattern = 0xfa00f080;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataProcessingRegExtend, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opExtendName() { return s_opExtendNames[op1()]; }
+    const char* opExtendAndAddName() { return s_opExtendAndAddNames[op1()]; }
+    unsigned rotate() { return (m_opcode >> 4) & 0x3; }
+};
+
+class ARMv7DOpcodeDataProcessingRegParallel : public ARMv7DOpcodeDataProcessingReg {
+private:
+    static const char* const s_opNames[16];
+
+public:
+    static const uint32_t s_mask = 0xff80f0e0;
+    static const uint32_t s_pattern = 0xfa00f000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataProcessingRegParallel, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[((op1() & 0x7) << 1) | (op2() & 0x1)]; }
+};
+
+class ARMv7DOpcodeDataProcessingRegMisc : public ARMv7DOpcodeDataProcessingReg {
+private:
+    static const char* const s_opNames[16];
+
+public:
+    static const uint32_t s_mask = 0xffc0f0c0;
+    static const uint32_t s_pattern = 0xfa80f080;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataProcessingRegMisc, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[((op1() & 0x3) << 2) | (op2() & 0x3)]; }
+};
+
+class ARMv7DOpcodeHint32 : public ARMv7D32BitOpcode {
+private:
+    static const char* const s_opNames[8];
+
+public:
+    static const uint32_t s_mask = 0xfff0d000;
+    static const uint32_t s_pattern = 0xf3a08000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeHint32, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op()]; }
+
+    bool isDebugHint() { return (m_opcode & 0xf0) == 0xf0; }
+    unsigned debugOption() { return m_opcode & 0xf; }
+    unsigned op() { return m_opcode & 0x7; }
+};
+
+class ARMv7DOpcodeFPTransfer : public ARMv7D32BitOpcode {
+public:
+    static const uint32_t s_mask = 0xffc00e7f;
+    static const uint32_t s_pattern = 0xee000a10;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeFPTransfer, thisObj);
+
+protected:
+    const char* format();
+
+    void appendFPRegister();
+
+    unsigned opH() { return (m_opcode >> 21) & 0x1; }
+    unsigned opL() { return (m_opcode >> 20) & 0x1; }
+    unsigned rt() { return (m_opcode >> 12) & 0xf; }
+    unsigned opC() { return (m_opcode >> 8) & 0x1; }
+    unsigned opB() { return (m_opcode >> 5) & 0x3; }
+    unsigned vd() { return ((m_opcode >> 3) & 0x10) | ((m_opcode >> 16) & 0xf); }
+    unsigned vn() { return ((m_opcode >> 7) & 0x1) | ((m_opcode >> 15) & 0x1e); }
+};
+
+class ARMv7DOpcodeDataLoad : public ARMv7D32BitOpcode {
+protected:
+    static const char* const s_opNames[8];
+
+protected:
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned op() { return ((m_opcode >> 22) & 0x4) | ((m_opcode >> 21) & 0x3); }
+};
+
+class ARMv7DOpcodeLoadRegister : public ARMv7DOpcodeDataLoad {
+public:
+    static const uint32_t s_mask = 0xfe900800;
+    static const uint32_t s_pattern = 0xf8100000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeLoadRegister, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned immediate2() { return (m_opcode >> 4) & 0x3; }
+};
+
+class ARMv7DOpcodeLoadSignedImmediate : public ARMv7DOpcodeDataLoad {
+public:
+    static const uint32_t s_mask = 0xfe900800;
+    static const uint32_t s_pattern = 0xf8100800;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeLoadSignedImmediate, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned pBit() { return (m_opcode >> 10) & 0x1; }
+    unsigned uBit() { return (m_opcode >> 9) & 0x1; }
+    unsigned wBit() { return (m_opcode >> 8) & 0x1; }
+    unsigned immediate8() { return m_opcode & 0xff; }
+};
+
+class ARMv7DOpcodeLoadUnsignedImmediate : public ARMv7DOpcodeDataLoad {
+public:
+    static const uint32_t s_mask = 0xfe900000;
+    static const uint32_t s_pattern = 0xf8900000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeLoadUnsignedImmediate, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned immediate12() { return m_opcode & 0xfff; }
+};
+
+class ARMv7DOpcodeLongMultipleDivide : public ARMv7D32BitOpcode {
+protected:
+    static const char* const s_opNames[8];
+    static const char* const s_smlalOpNames[4];
+    static const char* const s_smlaldOpNames[2];
+    static const char* const s_smlsldOpNames[2];
+
+public:
+    static const uint32_t s_mask = 0xff800000;
+    static const uint32_t s_pattern = 0xfb800000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeLongMultipleDivide, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op1()]; }
+    const char* smlalOpName() { return s_smlalOpNames[(nBit() << 1) | mBit()]; }
+    const char* smlaldOpName() { return s_smlaldOpNames[mBit()]; }
+    const char* smlsldOpName() { return s_smlsldOpNames[mBit()]; }
+
+    unsigned rdLo() { return rt(); }
+    unsigned rdHi() { return rd(); }
+    unsigned op1() { return (m_opcode >> 20) & 0x7; }
+    unsigned op2() { return (m_opcode >> 4) & 0xf; }
+    unsigned nBit() { return (m_opcode >> 5) & 0x1; }
+    unsigned mBit() { return (m_opcode >> 4) & 0x1; }
+};
+
+class ARMv7DOpcodeDataPushPopSingle : public ARMv7D32BitOpcode {
+public:
+    static const uint32_t s_mask = 0xffef0fff;
+    static const uint32_t s_pattern = 0xf84d0d04;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataPushPopSingle, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return op() ? "pop" : "push"; }
+    unsigned op() { return (m_opcode >> 20) & 0x1; }
+};
+
+class ARMv7DOpcodeDataPushPopMultiple : public ARMv7D32BitOpcode {
+protected:
+    void appendRegisterList();
+
+    unsigned registerList() { return m_opcode & 0xffff; }
+    unsigned condition() { return m_opcode >> 28; }
+};
+
+class ARMv7DOpcodeDataPopMultiple : public ARMv7DOpcodeDataPushPopMultiple {
+public:
+    static const uint32_t s_mask = 0x0fff0000;
+    static const uint32_t s_pattern = 0x08bd0000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataPopMultiple, thisObj);
+
+protected:
+    const char* format();
+};
+
+class ARMv7DOpcodeDataPushMultiple : public ARMv7DOpcodeDataPushPopMultiple {
+public:
+    static const uint32_t s_mask = 0xfe7f0000;
+    static const uint32_t s_pattern = 0xe82d0000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeDataPushMultiple, thisObj);
+
+protected:
+    const char* format();
+};
+
+class ARMv7DOpcodeDataStoreSingle : public ARMv7D32BitOpcode {
+protected:
+    static const char* const s_opNames[4];
+
+protected:
+    const char* opName() { return s_opNames[op()]; }
+
+    unsigned op() { return (m_opcode >> 21) & 0x3; }
+};
+
+class ARMv7DOpcodeStoreSingleImmediate12 : public ARMv7DOpcodeDataStoreSingle {
+public:
+    static const uint32_t s_mask = 0xfff00000;
+    static const uint32_t s_pattern = 0xf8c00000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeStoreSingleImmediate12, thisObj);
+
+    const char* format();
+
+protected:
+    unsigned immediate12() { return m_opcode & 0xfff; }
+};
+
+class ARMv7DOpcodeStoreSingleImmediate8 : public ARMv7DOpcodeDataStoreSingle {
+public:
+    static const uint32_t s_mask = 0xfff00800;
+    static const uint32_t s_pattern = 0xf8400800;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeStoreSingleImmediate8, thisObj);
+
+    const char* format();
+
+protected:
+    unsigned pBit() { return (m_opcode >> 10) & 0x1; }
+    unsigned uBit() { return (m_opcode >> 9) & 0x1; }
+    unsigned wBit() { return (m_opcode >> 8) & 0x1; }
+    unsigned immediate8() { return m_opcode & 0xff; }
+};
+
+class ARMv7DOpcodeStoreSingleRegister : public ARMv7DOpcodeDataStoreSingle {
+public:
+    static const uint32_t s_mask = 0xfff00fc0;
+    static const uint32_t s_pattern = 0xf8400000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeStoreSingleRegister, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned immediate2() { return (m_opcode >> 4) & 0x3; }
+};
+
+class ARMv7DOpcodeUnmodifiedImmediate : public ARMv7D32BitOpcode {
+protected:
+    static const char* const s_opNames[16];
+
+public:
+    static const uint32_t s_mask = 0xfa008000;
+    static const uint32_t s_pattern = 0xf2000000;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeUnmodifiedImmediate, thisObj);
+
+protected:
+    const char* format();
+
+    const char* opName() { return s_opNames[op() >> 1]; }
+
+    unsigned op() { return (m_opcode >> 20) & 0x1f; }
+    unsigned shBit() { return (m_opcode >> 21) & 0x1; }
+    unsigned bitNumOrSatImmediate() { return m_opcode & 0x1f; }
+    unsigned immediate5() { return ((m_opcode >> 9) & 0x1c) | ((m_opcode >> 6) & 0x3); }
+    unsigned immediate12() { return ((m_opcode >> 15) & 0x0800) | ((m_opcode >> 4) & 0x0700) | (m_opcode & 0x00ff); }
+    unsigned immediate16() { return ((m_opcode >> 4) & 0xf000) | ((m_opcode >> 15) & 0x0800) | ((m_opcode >> 4) & 0x0700) | (m_opcode & 0x00ff); }
+};
+
+class ARMv7DOpcodeVCMP : public ARMv7D32BitOpcode {
+public:
+    static const uint32_t s_mask = 0x0fbf0e50;
+    static const uint32_t s_pattern = 0x0eb40a40;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeVCMP, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned condition() { return m_opcode >> 28; }
+    unsigned dBit() { return (m_opcode >> 22) & 0x1; }
+    unsigned vd() { return (m_opcode >> 12) & 0xf; }
+    unsigned szBit() { return (m_opcode >> 8) & 0x1; }
+    unsigned eBit() { return (m_opcode >> 7) & 0x1; }
+    unsigned mBit() { return (m_opcode >> 5) & 0x1; }
+    unsigned vm() { return m_opcode & 0xf; }
+};
+
+class ARMv7DOpcodeVCVTBetweenFPAndInt : public ARMv7D32BitOpcode {
+public:
+    static const uint32_t s_mask = 0x0fb80e50;
+    static const uint32_t s_pattern = 0x0eb80a40;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeVCVTBetweenFPAndInt, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned condition() { return m_opcode >> 28; }
+    unsigned dBit() { return (m_opcode >> 22) & 0x1; }
+    unsigned op2() { return (m_opcode >> 16) & 0x7; }
+    unsigned vd() { return (m_opcode >> 12) & 0xf; }
+    unsigned szBit() { return (m_opcode >> 8) & 0x1; }
+    unsigned op() { return (m_opcode >> 7) & 0x1; }
+    unsigned mBit() { return (m_opcode >> 5) & 0x1; }
+    unsigned vm() { return m_opcode & 0xf; }
+};
+
+class ARMv7DOpcodeVLDR : public ARMv7D32BitOpcode {
+public:
+    static const uint32_t s_mask = 0x0f300e00;
+    static const uint32_t s_pattern = 0x0d100a00;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeVLDR, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned condition() { return m_opcode >> 28; }
+    unsigned uBit() { return (m_opcode >> 23) & 0x1; }
+    unsigned rn() { return (m_opcode >> 16) & 0xf; }
+    unsigned vd() { return ((m_opcode >> 18) & 0x10) | ((m_opcode >> 12) & 0xf); }
+    bool doubleReg() { return !!(m_opcode & 0x100); }
+    unsigned immediate8() { return m_opcode & 0xff; }
+};
+
+class ARMv7DOpcodeVMOVDoublePrecision : public ARMv7D32BitOpcode {
+public:
+    static const uint32_t s_mask = 0xffe00fd0;
+    static const uint32_t s_pattern = 0xec400b10;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeVMOVDoublePrecision, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned op() { return (m_opcode >> 20) & 0x1; }
+    unsigned rt2() { return (m_opcode >> 16) & 0xf; }
+    unsigned rt() { return (m_opcode >> 16) & 0xf; }
+    unsigned vm() { return (m_opcode & 0xf) | ((m_opcode >> 1) & 0x10); }
+};
+
+class ARMv7DOpcodeVMOVSinglePrecision : public ARMv7D32BitOpcode {
+public:
+    static const uint32_t s_mask = 0xffe00fd0;
+    static const uint32_t s_pattern = 0xec400a10;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeVMOVSinglePrecision, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned op() { return (m_opcode >> 20) & 0x1; }
+    unsigned rt2() { return (m_opcode >> 16) & 0xf; }
+    unsigned rt() { return (m_opcode >> 16) & 0xf; }
+    unsigned vm() { return ((m_opcode << 1) & 0x1e) | ((m_opcode >> 5) & 0x1); }
+};
+
+class ARMv7DOpcodeVMSR : public ARMv7D32BitOpcode {
+public:
+    static const uint32_t s_mask = 0xffef0fff;
+    static const uint32_t s_pattern = 0xeee10a10;
+
+    DEFINE_STATIC_FORMAT32(ARMv7DOpcodeVMSR, thisObj);
+
+protected:
+    const char* format();
+
+    unsigned opL() { return (m_opcode >> 20) & 0x1; }
+    unsigned rt() { return (m_opcode >> 12) & 0xf; }
+};
+
+
+} } // namespace JSC::ARMv7Disassembler
+
+using JSC::ARMv7Disassembler::ARMv7DOpcode;
+
+#endif // #if USE(ARMV7_DISASSEMBLER)
diff --git a/disassembler/ARMv7Disassembler.cpp b/disassembler/ARMv7Disassembler.cpp
new file mode 100644
index 0000000..bfb4895
--- /dev/null
+++ b/disassembler/ARMv7Disassembler.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Disassembler.h"
+
+#if USE(ARMV7_DISASSEMBLER)
+
+#include "ARMv7/ARMv7DOpcode.h"
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+bool tryToDisassemble(const MacroAssemblerCodePtr& codePtr, size_t size, const char* prefix, PrintStream& out)
+{
+    ARMv7DOpcode armOpcode;
+
+    uint16_t* currentPC = reinterpret_cast<uint16_t*>(reinterpret_cast<uintptr_t>(codePtr.executableAddress())&~1);
+    uint16_t* endPC = currentPC + (size / sizeof(uint16_t));
+
+    while (currentPC < endPC) {
+        char pcString[12];
+        snprintf(pcString, sizeof(pcString), "0x%x", reinterpret_cast<unsigned>(currentPC));
+        out.printf("%s%10s: %s\n", prefix, pcString, armOpcode.disassemble(currentPC));
+    }
+
+    return true;
+}
+
+} // namespace JSC
+
+#endif // USE(ARMV7_DISASSEMBLER)
+
diff --git a/disassembler/Disassembler.cpp b/disassembler/Disassembler.cpp
new file mode 100644
index 0000000..788a6c3
--- /dev/null
+++ b/disassembler/Disassembler.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2012, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Disassembler.h"
+
+#include "MacroAssemblerCodeRef.h"
+#include <wtf/Condition.h>
+#include <wtf/DataLog.h>
+#include <wtf/Deque.h>
+#include <wtf/Lock.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/StringPrintStream.h>
+#include <wtf/Threading.h>
+
+namespace JSC {
+
+void disassemble(const MacroAssemblerCodePtr& codePtr, size_t size, const char* prefix, PrintStream& out)
+{
+    if (tryToDisassemble(codePtr, size, prefix, out))
+        return;
+    
+    out.printf("%sdisassembly not available for range %p...%p\n", prefix, codePtr.executableAddress(), static_cast<char*>(codePtr.executableAddress()) + size);
+}
+
+namespace {
+
+// This is really a struct, except that it should be a class because that's what the WTF_* macros
+// expect.
+class DisassemblyTask {
+    WTF_MAKE_NONCOPYABLE(DisassemblyTask);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    DisassemblyTask()
+    {
+    }
+    
+    ~DisassemblyTask()
+    {
+        if (header)
+            free(header); // free() because it would have been copied by strdup.
+    }
+    
+    char* header { nullptr };
+    MacroAssemblerCodeRef codeRef;
+    size_t size { 0 };
+    const char* prefix { nullptr };
+};
+
+class AsynchronousDisassembler {
+public:
+    AsynchronousDisassembler()
+    {
+        createThread("Asynchronous Disassembler", [&] () { run(); });
+    }
+    
+    void enqueue(std::unique_ptr<DisassemblyTask> task)
+    {
+        LockHolder locker(m_lock);
+        m_queue.append(WTFMove(task));
+        m_condition.notifyAll();
+    }
+    
+    void waitUntilEmpty()
+    {
+        LockHolder locker(m_lock);
+        while (!m_queue.isEmpty() || m_working)
+            m_condition.wait(m_lock);
+    }
+    
+private:
+    NO_RETURN void run()
+    {
+        for (;;) {
+            std::unique_ptr<DisassemblyTask> task;
+            {
+                LockHolder locker(m_lock);
+                m_working = false;
+                m_condition.notifyAll();
+                while (m_queue.isEmpty())
+                    m_condition.wait(m_lock);
+                task = m_queue.takeFirst();
+                m_working = true;
+            }
+
+            dataLog(task->header);
+            disassemble(task->codeRef.code(), task->size, task->prefix, WTF::dataFile());
+        }
+    }
+    
+    Lock m_lock;
+    Condition m_condition;
+    Deque<std::unique_ptr<DisassemblyTask>> m_queue;
+    bool m_working { false };
+};
+
+bool hadAnyAsynchronousDisassembly = false;
+
+AsynchronousDisassembler& asynchronousDisassembler()
+{
+    static NeverDestroyed<AsynchronousDisassembler> disassembler;
+    hadAnyAsynchronousDisassembly = true;
+    return disassembler.get();
+}
+
+} // anonymous namespace
+
+void disassembleAsynchronously(
+    const CString& header, const MacroAssemblerCodeRef& codeRef, size_t size, const char* prefix)
+{
+    std::unique_ptr<DisassemblyTask> task = std::make_unique<DisassemblyTask>();
+    task->header = strdup(header.data()); // Yuck! We need this because CString does racy refcounting.
+    task->codeRef = codeRef;
+    task->size = size;
+    task->prefix = prefix;
+    
+    asynchronousDisassembler().enqueue(WTFMove(task));
+}
+
+void waitForAsynchronousDisassembly()
+{
+    if (!hadAnyAsynchronousDisassembly)
+        return;
+    
+    asynchronousDisassembler().waitUntilEmpty();
+}
+
+} // namespace JSC
+
diff --git a/disassembler/Disassembler.h b/disassembler/Disassembler.h
new file mode 100644
index 0000000..9317449
--- /dev/null
+++ b/disassembler/Disassembler.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSExportMacros.h"
+#include <functional>
+#include <wtf/PrintStream.h>
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+class MacroAssemblerCodePtr;
+class MacroAssemblerCodeRef;
+
+#if ENABLE(DISASSEMBLER)
+bool tryToDisassemble(const MacroAssemblerCodePtr&, size_t, const char* prefix, PrintStream&);
+#else
+inline bool tryToDisassemble(const MacroAssemblerCodePtr&, size_t, const char*, PrintStream&)
+{
+    return false;
+}
+#endif
+
+// Prints either the disassembly, or a line of text indicating that disassembly failed and
+// the range of machine code addresses.
+void disassemble(const MacroAssemblerCodePtr&, size_t, const char* prefix, PrintStream& out);
+
+// Asynchronous disassembly. This happens on another thread, and calls the provided
+// callback when the disassembly is done.
+void disassembleAsynchronously(
+    const CString& header, const MacroAssemblerCodeRef&, size_t, const char* prefix);
+
+JS_EXPORT_PRIVATE void waitForAsynchronousDisassembly();
+
+} // namespace JSC
diff --git a/disassembler/UDis86Disassembler.cpp b/disassembler/UDis86Disassembler.cpp
new file mode 100644
index 0000000..4093f13
--- /dev/null
+++ b/disassembler/UDis86Disassembler.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "UDis86Disassembler.h"
+
+#if USE(UDIS86)
+
+#include "MacroAssemblerCodeRef.h"
+#include "udis86.h"
+
+namespace JSC {
+
+bool tryToDisassembleWithUDis86(const MacroAssemblerCodePtr& codePtr, size_t size, const char* prefix, PrintStream& out)
+{
+    ud_t disassembler;
+    ud_init(&disassembler);
+    ud_set_input_buffer(&disassembler, static_cast<unsigned char*>(codePtr.executableAddress()), size);
+#if CPU(X86_64)
+    ud_set_mode(&disassembler, 64);
+#else
+    ud_set_mode(&disassembler, 32);
+#endif
+    ud_set_pc(&disassembler, bitwise_cast<uintptr_t>(codePtr.executableAddress()));
+    ud_set_syntax(&disassembler, UD_SYN_ATT);
+    
+    uint64_t currentPC = disassembler.pc;
+    while (ud_disassemble(&disassembler)) {
+        char pcString[20];
+        snprintf(pcString, sizeof(pcString), "0x%lx", static_cast<unsigned long>(currentPC));
+        out.printf("%s%16s: %s\n", prefix, pcString, ud_insn_asm(&disassembler));
+        currentPC = disassembler.pc;
+    }
+    
+    return true;
+}
+
+} // namespace JSC
+
+#endif // USE(UDIS86)
+
diff --git a/disassembler/UDis86Disassembler.h b/disassembler/UDis86Disassembler.h
new file mode 100644
index 0000000..8de53ea
--- /dev/null
+++ b/disassembler/UDis86Disassembler.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Disassembler.h"
+
+namespace JSC {
+
+#if USE(UDIS86)
+
+bool tryToDisassembleWithUDis86(const MacroAssemblerCodePtr& codePtr, size_t size, const char* prefix, PrintStream& out);
+
+#else // USE(UDIS86)
+
+inline bool tryToDisassembleWithUDis86(const MacroAssemblerCodePtr&, size_t, const char*, PrintStream&) { return false; }
+
+#endif // USE(UDIS86)
+
+} // namespace JSC
diff --git a/disassembler/X86Disassembler.cpp b/disassembler/X86Disassembler.cpp
new file mode 100644
index 0000000..247b227
--- /dev/null
+++ b/disassembler/X86Disassembler.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Disassembler.h"
+
+#if USE(UDIS86)
+
+#include "MacroAssemblerCodeRef.h"
+#include "Options.h"
+#include "UDis86Disassembler.h"
+
+namespace JSC {
+
+bool tryToDisassemble(const MacroAssemblerCodePtr& codePtr, size_t size, const char* prefix, PrintStream& out)
+{
+    return tryToDisassembleWithUDis86(codePtr, size, prefix, out);
+}
+
+} // namespace JSC
+
+#endif // USE(UDIS86)
diff --git a/disassembler/udis86/differences.txt b/disassembler/udis86/differences.txt
new file mode 100644
index 0000000..c3dabf6
--- /dev/null
+++ b/disassembler/udis86/differences.txt
@@ -0,0 +1,9 @@
+This documents the differences between the stock version of udis86 and the one found
+here:
+
+- All files not named "udis86" were prefixed with "udis86".
+
+- assert() has been changed to ASSERT()
+
+- Fixed udis86_syn-att.c's jump destination printing to work correctly in 64-bit mode.
+
diff --git a/disassembler/udis86/optable.xml b/disassembler/udis86/optable.xml
new file mode 100644
index 0000000..3bda858
--- /dev/null
+++ b/disassembler/udis86/optable.xml
@@ -0,0 +1,10099 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="optable.xsl" type="text/xsl"?>
+<x86optable>
+
+  <!--
+      The most important elements of each instruction definition are the
+      pfx (prefix), opc (opcode), and opr (operand) elements.  Each is a
+      CDATA element consisting of blank-separated words.  Upper and lower
+      case are equivalent.
+
+      <pfx></pfx>
+
+      pfx describes the set of valid prefixes that can precede the main
+      opcode without turning it into a different instruction. These may
+      be:
+
+      aso   accepts address size override
+      oso   accepts operand size override
+      seg   accepts a segment override
+      rexw, rexr, rexx, rexb
+            uses the indicated REX bit
+      vexl  accepts the vex.L prefix bit, in other words, the vexl
+            bit can be used in the decoding of the avx instruction.
+
+      <opr></opr>
+
+      [T][s]
+
+      Size Suffix
+      ===========
+
+      x     - If vex.L = 1 => m256/YMM
+                 vex.L = 0 => m128/XMM
+
+      opc words may be actual byte values (two hex digits), or may be one of
+      the following:
+      /sse=66,f3,f2 - required prefix (always first, and always
+        followed by 0f)
+      /3dnow=00-ff - this is a 3DNow opcode (only in a definition of the
+        form 0f 0f 3dnow=<byte>)
+      /a=16,32,64 - has this address size
+      /m=16,32,64,!64 - applicable only when the CPU is in this mode
+      /o=16,32,64 - has this operand size
+      /mod=11,!11 - has ModR/M with 11 or not-11 in the Mod field
+      /reg=0-7 - has ModR/M with this value in the reg field
+      /rm=0-7 - has ModR/M with this value in the R/M field (only with
+        /mod=11)
+      /x87=00-3f - X87 opcode with this value in the low 6 bits of the
+        following "ModR/M" byte (only with /mod=11 and no other modifiers)
+
+      opr words follow the Intel documentation somewhat, and specify the
+      location and the size of the operand.  The OperandDict table in
+      ud_itab.py maps these words to named OP_ and SZ_ constants for the
+      location and size respectively.  These constants are defined in
+      decode.h, q.v. for details.
+
+      The mode element affects instruction semantics but not decoding:
+          inv64 - invalid in 64-bit mode
+      def64 - default operand size is 64 bits in 64-bit mode
+
+      cpuid
+
+        The cpuid element maybe applied to an instruction or a specific
+        definition of the instruction. One ore more strings define the
+        cpuid features that the instruction (or a definition belongs to)
+
+        Values are: sse, sse2, sse3, sse4, sse4.1, sse4.2, avx
+
+      AVX Instructions
+
+      AVX instructions can be described in two ways. One, the explicit
+      form, and the other that promotes an existing sse instruction
+      definition to its avx form.
+
+      If an instruction is defined to be in cpuid=avx, but is defined in
+      the legacy form (using /sse= extensions), then the opcode generator
+      will infer that as two definitions, one the see instruction and the
+      other, an inferred avx instruction.
+
+      In generating the sse definition from the above, the following
+      transformations happen,
+
+        - /vexw and /vexl extensions (if any) are removed
+        - The operands H and L are removed. Operands specified on
+          the right to removed operands are shifted to the left
+          position.
+        - The vexl prefix is removed.
+        - "avx" is removed form the cpuid definition.
+
+     In generating the avx definition from the above, the following
+     transformations happen,
+
+        - c4 is inserted in the 0th position of the opcode string
+        - /sse extension is removed
+        - A new /vex extension is constructed using /sse, 0f, 38 and
+          3a opcodes (if any).
+        - Operands V, W, H, and U are marked explicitly to have the
+          size suffix "x"
+
+     If the above transformations do not generate the required
+     definitions, the instructions will need to be defined separately.
+  -->
+
+    <instruction>
+        <mnemonic>aaa</mnemonic>
+        <def>
+            <opc>37 /m=!64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aad</mnemonic>
+        <def>
+            <opc>d5 /m=!64</opc>
+            <opr>Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aam</mnemonic>
+        <def>
+            <opc>d4 /m=!64</opc>
+            <opr>Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aas</mnemonic>
+        <def>
+            <opc>3f /m=!64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>adc</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>10</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>11</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>12</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>13</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <opc>14</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>15</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>80 /reg=2</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>82 /reg=2 /m=!64</opc>
+            <opr>Eb Ib</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>81 /reg=2</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>83 /reg=2</opc>
+            <opr>Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>add</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>00</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>01</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>02</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>03</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <opc>04</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>05</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>80 /reg=0</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>82 /reg=0 /m=!64</opc>
+            <opr>Eb Ib</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>81 /reg=0</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>83 /reg=0</opc>
+            <opr>Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>addpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 58</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>addps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 58</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>addsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 58</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>addss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 58</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>addsubpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d0</opc>
+            <opr>V H W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>addsubps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f d0</opc>
+            <opr>V H W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aesdec</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 de</opc>
+            <opr>V H W</opr>
+            <cpuid>aesni avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aesdeclast</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 df</opc>
+            <opr>V W</opr>
+            <cpuid>aesni avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aesenc</mnemonic>
+        <cpuid>aesni</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 dc</opc>
+            <opr>V W</opr>
+            <cpuid>aesni avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aesenclast</mnemonic>
+        <cpuid>aesni avx</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 dd</opc>
+            <opr>V H W</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aesimc</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 db</opc>
+            <opr>V W</opr>
+            <cpuid>aesni avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>aeskeygenassist</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a df</opc>
+            <opr>V W Ib</opr>
+            <cpuid>aesni avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>and</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>20</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>21</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>22</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>23</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <opc>24</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>25</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>80 /reg=4</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>82 /reg=4 /m=!64</opc>
+            <opr>Eb Ib</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>81 /reg=4</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>83 /reg=4</opc>
+            <opr>Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>andpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 54</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>andps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 54</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>andnpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 55</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>andnps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 55</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>arpl</mnemonic>
+        <def>
+            <pfx>aso</pfx>
+            <opc>63 /m=!64</opc>
+            <opr>Ew Gw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movsxd</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexx rexr rexb</pfx>
+            <opc>63 /m=64</opc>
+            <opr>Gq Ed</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>call</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>ff /reg=2 /m=!64</opc>
+            <opr>Ev</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>ff /reg=2 /m=64</opc>
+            <opr>Eq</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>ff /reg=3</opc>
+            <opr>Fv</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>e8</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>9a /m=!64</opc>
+            <opr>Av</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cbw</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>98 /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cwde</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>98 /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cdqe</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>98 /o=64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>clc</mnemonic>
+        <def>
+            <opc>f8</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cld</mnemonic>
+        <def>
+            <opc>fc</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>clflush</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f ae /reg=7 /mod=!11</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>clgi</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=3 /mod=11 /rm=5</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cli</mnemonic>
+        <def>
+            <opc>fa</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>clts</mnemonic>
+        <def>
+            <opc>0f 06</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmc</mnemonic>
+        <def>
+            <opc>f5</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovo</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 40</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovno</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 41</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovb</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 42</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovae</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 43</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovz</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 44</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovnz</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 45</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovbe</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 46</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmova</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 47</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovs</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 48</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovns</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 49</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovp</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 4a</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovnp</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 4b</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovl</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 4c</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovge</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 4d</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovle</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 4e</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmovg</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 4f</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmp</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>38</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>39</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>3a</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>3b</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <opc>3c</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>3d</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>80 /reg=7</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>82 /reg=7 /m=!64</opc>
+            <opr>Eb Ib</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>81 /reg=7</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>83 /reg=7</opc>
+            <opr>Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmppd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f c2</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f c2</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpsb</mnemonic>
+        <def>
+            <pfx>repz seg</pfx>
+            <opc>a6</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpsw</mnemonic>
+        <def>
+            <pfx>repz oso rexw seg</pfx>
+            <opc>a7 /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpsd</mnemonic>
+        <def>
+            <pfx>repz oso rexw seg</pfx>
+            <opc>a7 /o=32</opc>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f c2</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpsq</mnemonic>
+        <def>
+            <pfx>repz oso rexw seg</pfx>
+            <opc>a7 /o=64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f c2</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpxchg</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f b0</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f b1</opc>
+            <opr>Ev Gv</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpxchg8b</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f c7 /mod=!11 /reg=1 /o=16</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f c7 /mod=!11 /reg=1 /o=32</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cmpxchg16b</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f c7 /mod=!11 /reg=1 /o=64</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>comisd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 2f</opc>
+            <opr>Vsd Wsd</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>comiss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 2f</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cpuid</mnemonic>
+        <def>
+            <opc>0f a2</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtdq2pd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f3 0f e6</opc>
+            <opr>V Wdq</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtdq2ps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 5b</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtpd2dq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f2 0f e6</opc>
+            <opr>Vdq W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtpd2pi</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 2d</opc>
+            <opr>P W</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtpd2ps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 5a</opc>
+            <opr>Vdq W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtpi2ps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 2a</opc>
+            <opr>V Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtpi2pd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 2a</opc>
+            <opr>V Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtps2dq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 5b</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtps2pd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 5a</opc>
+            <opr>V Wdq</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtps2pi</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 2d</opc>
+            <opr>P MqU</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtsd2si</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 2d</opc>
+            <opr>Gy MqU</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtsd2ss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 5a</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtsi2sd</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 2a</opc>
+            <opr>V H Ey</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtsi2ss</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 2a</opc>
+            <opr>V H Ey</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtss2sd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 5a</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvtss2si</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 2d</opc>
+            <opr>Gy MdU</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvttpd2dq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f e6</opc>
+            <opr>Vdq W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvttpd2pi</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 2c</opc>
+            <opr>P W</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvttps2dq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f3 0f 5b</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvttps2pi</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 2c</opc>
+            <opr>P W</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvttsd2si</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 2c</opc>
+            <opr>Gy MqU</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cvttss2si</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 2c</opc>
+            <opr>Gy MdU</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cwd</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>99 /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cdq</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>99 /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>cqo</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>99 /o=64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>daa</mnemonic>
+        <def>
+            <opc>27 /m=!64</opc>
+            <mode>inv64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>das</mnemonic>
+        <def>
+            <opc>2f /m=!64</opc>
+            <mode>inv64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>dec</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>48</opc>
+            <opr>R0z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>49</opc>
+            <opr>R1z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>4a</opc>
+            <opr>R2z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>4b</opc>
+            <opr>R3z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>4c</opc>
+            <opr>R4z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>4d</opc>
+            <opr>R5z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>4e</opc>
+            <opr>R6z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>4f</opc>
+            <opr>R7z</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>fe /reg=1</opc>
+            <opr>Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>ff /reg=1</opc>
+            <opr>Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>div</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>f7 /reg=6</opc>
+            <opr>Ev</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>f6 /reg=6</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>divpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 5e</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>divps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 5e</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>divsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 5e</opc>
+            <opr>V H MqU</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>divss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 5e</opc>
+            <opr>V H MdU</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>dppd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 41</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>dpps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 3a 40</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>emms</mnemonic>
+        <def>
+            <opc>0f 77</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>enter</mnemonic>
+        <def>
+            <opc>c8</opc>
+            <opr>Iw Ib</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>extractps</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 17</opc>
+            <opr>MdRy V Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>f2xm1</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=30</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fabs</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=21</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fadd</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dc /mod=!11 /reg=0</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d8 /mod=!11 /reg=0</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=00</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=01</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=02</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=03</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=04</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=05</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=06</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=07</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=00</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=01</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=02</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=03</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=04</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=05</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=06</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=07</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>faddp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>de /mod=11 /x87=00</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=01</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=02</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=03</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=04</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=05</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=06</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=07</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fbld</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>df /mod=!11 /reg=4</opc>
+            <opr>Mt</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fbstp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>df /mod=!11 /reg=6</opc>
+            <opr>Mt</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fchs</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=20</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fclex</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=22</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcmovb</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>da /mod=11 /x87=00</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=01</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=02</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=03</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=04</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=05</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=06</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=07</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcmove</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>da /mod=11 /x87=08</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=09</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=0a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=0b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=0c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=0d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=0e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=0f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcmovbe</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>da /mod=11 /x87=10</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=11</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=12</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=13</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=14</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=15</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=16</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=17</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcmovu</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>da /mod=11 /x87=18</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=19</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=1a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=1b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=1c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=1d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=1e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>da /mod=11 /x87=1f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcmovnb</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=00</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=01</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=02</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=03</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=04</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=05</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=06</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=07</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcmovne</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=08</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=09</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=0a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=0b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=0c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=0d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=0e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=0f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcmovnbe</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=10</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=11</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=12</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=13</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=14</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=15</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=16</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=17</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcmovnu</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=18</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=19</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=1a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=1b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=1c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=1d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=1e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=1f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fucomi</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=28</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=29</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=2a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=2b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=2c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=2d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=2e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=2f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcom</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d8 /mod=!11 /reg=2</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dc /mod=!11 /reg=2</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=10</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=11</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=12</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=13</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=14</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=15</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=16</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=17</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcom2</mnemonic>
+        <cpuid>X87 UNDOC</cpuid>
+        <def>
+            <opc>dc /mod=11 /x87=10</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=11</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=12</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=13</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=14</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=15</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=16</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=17</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcomp3</mnemonic>
+        <cpuid>X87 UNDOC</cpuid>
+        <def>
+            <opc>dc /mod=11 /x87=18</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=19</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=1a</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=1b</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=1c</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=1d</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=1e</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=1f</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcomi</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=30</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=31</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=32</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=33</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=34</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=35</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=36</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>db /mod=11 /x87=37</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fucomip</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>df /mod=11 /x87=28</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=29</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=2a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=2b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=2c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=2d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=2e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=2f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcomip</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>df /mod=11 /x87=30</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=31</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=32</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=33</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=34</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=35</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=36</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=37</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcomp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d8 /mod=!11 /reg=3</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dc /mod=!11 /reg=3</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=18</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=19</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=1a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=1b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=1c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=1d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=1e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=1f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcomp5</mnemonic>
+        <cpuid>X87 UNDOC</cpuid>
+        <def>
+            <opc>de /mod=11 /x87=10</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=11</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=12</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=13</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=14</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=15</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=16</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=17</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcompp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>de /mod=11 /x87=19</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fcos</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=3f</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fdecstp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=36</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fdiv</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dc /mod=!11 /reg=6</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=38</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=39</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=3a</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=3b</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=3c</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=3d</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=3e</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=3f</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d8 /mod=!11 /reg=6</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=30</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=31</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=32</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=33</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=34</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=35</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=36</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=37</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fdivp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>de /mod=11 /x87=38</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=39</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=3a</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=3b</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=3c</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=3d</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=3e</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=3f</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fdivr</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dc /mod=!11 /reg=7</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=30</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=31</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=32</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=33</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=34</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=35</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=36</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=37</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d8 /mod=!11 /reg=7</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=38</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=39</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=3a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=3b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=3c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=3d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=3e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=3f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fdivrp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>de /mod=11 /x87=30</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=31</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=32</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=33</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=34</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=35</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=36</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=37</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>femms</mnemonic>
+        <def>
+            <opc>0f 0e</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ffree</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>dd /mod=11 /x87=00</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=01</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=02</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=03</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=04</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=05</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=06</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=07</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ffreep</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>df /mod=11 /x87=00</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=01</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=02</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=03</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=04</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=05</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=06</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=07</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ficom</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>de /mod=!11 /reg=2</opc>
+            <opr>Mw</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>da /mod=!11 /reg=2</opc>
+            <opr>Md</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ficomp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>de /mod=!11 /reg=3</opc>
+            <opr>Mw</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>da /mod=!11 /reg=3</opc>
+            <opr>Md</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fild</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>df /mod=!11 /reg=0</opc>
+            <opr>Mw</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>df /mod=!11 /reg=5</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>db /mod=!11 /reg=0</opc>
+            <opr>Md</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fincstp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=37</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fninit</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=23</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fiadd</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>da /mod=!11 /reg=0</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>de /mod=!11 /reg=0</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fidivr</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>da /mod=!11 /reg=7</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>de /mod=!11 /reg=7</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fidiv</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>da /mod=!11 /reg=6</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>de /mod=!11 /reg=6</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fisub</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>da /mod=!11 /reg=4</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>de /mod=!11 /reg=4</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fisubr</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>da /mod=!11 /reg=5</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>de /mod=!11 /reg=5</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fist</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>df /mod=!11 /reg=2</opc>
+            <opr>Mw</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>db /mod=!11 /reg=2</opc>
+            <opr>Md</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fistp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>df /mod=!11 /reg=3</opc>
+            <opr>Mw</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>df /mod=!11 /reg=7</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>db /mod=!11 /reg=3</opc>
+            <opr>Md</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fisttp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>db /mod=!11 /reg=1</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dd /mod=!11 /reg=1</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>df /mod=!11 /reg=1</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fld</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>db /mod=!11 /reg=5</opc>
+            <opr>Mt</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dd /mod=!11 /reg=0</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d9 /mod=!11 /reg=0</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=00</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=01</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=02</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=03</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=04</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=05</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=06</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=07</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fld1</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=28</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fldl2t</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=29</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fldl2e</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=2a</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fldpi</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=2b</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fldlg2</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=2c</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fldln2</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=2d</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fldz</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=2e</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fldcw</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d9 /mod=!11 /reg=5</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fldenv</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d9 /mod=!11 /reg=4</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fmul</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dc /mod=!11 /reg=1</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=08</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=09</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=0a</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=0b</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=0c</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=0d</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=0e</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=0f</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d8 /mod=!11 /reg=1</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=08</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=09</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=0a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=0b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=0c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=0d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=0e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=0f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fmulp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>de /mod=11 /x87=08</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=09</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=0a</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=0b</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=0c</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=0d</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=0e</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=0f</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fimul</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>da /mod=!11 /reg=1</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>de /mod=!11 /reg=1</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fnop</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=10</opc>
+        </def>
+    </instruction>
+	
+    <instruction>
+        <mnemonic>fndisi</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=21</opc>
+        </def>
+    </instruction>
+	
+    <instruction>
+        <mnemonic>fneni</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=20</opc>
+        </def>
+    </instruction>
+	
+    <instruction>
+        <mnemonic>fnsetpm</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=24</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fpatan</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=33</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fprem</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=38</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fprem1</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=35</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fptan</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>frndint</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=3c</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>frstor</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dd /mod=!11 /reg=4</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+	
+    <instruction>
+        <mnemonic>frstpm</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>db /mod=11 /x87=25</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fnsave</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dd /mod=!11 /reg=6</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fscale</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=3d</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fsin</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=3e</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fsincos</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=3b</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fsqrt</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=3a</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fstp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>db /mod=!11 /reg=7</opc>
+            <opr>Mt</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dd /mod=!11 /reg=3</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d9 /mod=!11 /reg=3</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=18</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=19</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=1a</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=1b</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=1c</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=1d</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=1e</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=1f</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fstp1</mnemonic>
+        <def>
+            <opc>d9 /mod=11 /x87=18</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=19</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=1a</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=1b</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=1c</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=1d</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=1e</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=1f</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fstp8</mnemonic>
+        <def>
+            <opc>df /mod=11 /x87=10</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=11</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=12</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=13</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=14</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=15</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=16</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=17</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fstp9</mnemonic>
+        <def>
+            <opc>df /mod=11 /x87=18</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=19</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=1a</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=1b</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=1c</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=1d</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=1e</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=1f</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fst</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d9 /mod=!11 /reg=2</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dd /mod=!11 /reg=2</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=10</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=11</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=12</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=13</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=14</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=15</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=16</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=17</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fnstcw</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d9 /mod=!11 /reg=7</opc>
+            <opr>Mw</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fnstenv</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d9 /mod=!11 /reg=6</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fnstsw</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dd /mod=!11 /reg=7</opc>
+            <opr>Mw</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=20</opc>
+            <opr>AX</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fsub</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d8 /mod=!11 /reg=4</opc>
+            <opr>Md</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dc /mod=!11 /reg=4</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=20</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=21</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=22</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=23</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=24</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=25</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=26</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=27</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=28</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=29</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=2a</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=2b</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=2c</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=2d</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=2e</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=2f</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fsubp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>de /mod=11 /x87=28</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=29</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=2a</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=2b</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=2c</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=2d</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=2e</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=2f</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fsubr</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>dc /mod=!11 /reg=5</opc>
+            <opr>Mq</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=28</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=29</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=2a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=2b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=2c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=2d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=2e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d8 /mod=11 /x87=2f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=20</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=21</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=22</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=23</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=24</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=25</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=26</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>dc /mod=11 /x87=27</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d8 /mod=!11 /reg=5</opc>
+            <opr>Md</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fsubrp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>de /mod=11 /x87=20</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=21</opc>
+            <opr>ST1 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=22</opc>
+            <opr>ST2 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=23</opc>
+            <opr>ST3 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=24</opc>
+            <opr>ST4 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=25</opc>
+            <opr>ST5 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=26</opc>
+            <opr>ST6 ST0</opr>
+        </def>
+        <def>
+            <opc>de /mod=11 /x87=27</opc>
+            <opr>ST7 ST0</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ftst</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=24</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fucom</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>dd /mod=11 /x87=20</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=21</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=22</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=23</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=24</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=25</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=26</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=27</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fucomp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>dd /mod=11 /x87=28</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=29</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=2a</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=2b</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=2c</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=2d</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=2e</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=2f</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fucompp</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>da /mod=11 /x87=29</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fxam</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=25</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fxch</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=08</opc>
+            <opr>ST0 ST0</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=09</opc>
+            <opr>ST0 ST1</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=0a</opc>
+            <opr>ST0 ST2</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=0b</opc>
+            <opr>ST0 ST3</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=0c</opc>
+            <opr>ST0 ST4</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=0d</opc>
+            <opr>ST0 ST5</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=0e</opc>
+            <opr>ST0 ST6</opr>
+        </def>
+        <def>
+            <opc>d9 /mod=11 /x87=0f</opc>
+            <opr>ST0 ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fxch4</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>dd /mod=11 /x87=08</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=09</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=0a</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=0b</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=0c</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=0d</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=0e</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>dd /mod=11 /x87=0f</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fxch7</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>df /mod=11 /x87=08</opc>
+            <opr>ST0</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=09</opc>
+            <opr>ST1</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=0a</opc>
+            <opr>ST2</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=0b</opc>
+            <opr>ST3</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=0c</opc>
+            <opr>ST4</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=0d</opc>
+            <opr>ST5</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=0e</opc>
+            <opr>ST6</opr>
+        </def>
+        <def>
+            <opc>df /mod=11 /x87=0f</opc>
+            <opr>ST7</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fxrstor</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f ae /mod=!11 /reg=1</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fxsave</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f ae /mod=!11 /reg=0</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fxtract</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=34</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fyl2x</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=31</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>fyl2xp1</mnemonic>
+        <cpuid>X87</cpuid>
+        <def>
+            <opc>d9 /mod=11 /x87=39</opc>
+        </def>
+    </instruction>
+
+     <instruction>
+        <mnemonic>hlt</mnemonic>
+        <def>
+            <opc>f4</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>idiv</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>f7 /reg=7</opc>
+            <opr>Ev</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>f6 /reg=7</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>in</mnemonic>
+        <def>
+            <opc>e4</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>e5</opc>
+            <opr>eAX Ib</opr>
+        </def>
+        <def>
+            <opc>ec</opc>
+            <opr>AL DX</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>ed</opc>
+            <opr>eAX DX</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>imul</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f af</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>f6 /reg=5</opc>
+            <opr>Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>f7 /reg=5</opc>
+            <opr>Ev</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>69</opc>
+            <opr>Gv Ev Iz</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>6b</opc>
+            <opr>Gv Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>inc</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>40</opc>
+            <opr>R0z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>41</opc>
+            <opr>R1z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>42</opc>
+            <opr>R2z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>43</opc>
+            <opr>R3z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>44</opc>
+            <opr>R4z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>45</opc>
+            <opr>R5z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>46</opc>
+            <opr>R6z</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>47</opc>
+            <opr>R7z</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>ff /reg=0</opc>
+            <opr>Ev</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>fe /reg=0</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>insb</mnemonic>
+        <def>
+            <pfx>rep seg</pfx>
+            <opc>6c</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>insw</mnemonic>
+        <def>
+            <pfx>rep oso seg</pfx>
+            <opc>6d /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>insd</mnemonic>
+        <def>
+            <pfx>rep oso seg</pfx>
+            <opc>6d /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>int1</mnemonic>
+        <def>
+            <opc>f1</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>int3</mnemonic>
+        <def>
+            <opc>cc</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>int</mnemonic>
+        <def>
+            <opc>cd</opc>
+            <opr>Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>into</mnemonic>
+        <def>
+            <opc>ce /m=!64</opc>
+            <mode>inv64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>invd</mnemonic>
+        <def>
+            <opc>0f 08</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>invept</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <opc>/sse=66 0f 38 80 /m=32</opc>
+            <opr>Gd Mo</opr>
+        </def>
+        <def>
+            <opc>/sse=66 0f 38 80 /m=64</opc>
+            <opr>Gq Mo</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>invlpg</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 01 /reg=7 /mod=!11</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>invlpga</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=3 /mod=11 /rm=7</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>invvpid</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <opc>/sse=66 0f 38 81 /m=32</opc>
+            <opr>Gd Mo</opr>
+        </def>
+        <def>
+            <opc>/sse=66 0f 38 81 /m=64</opc>
+            <opr>Gq Mo</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>iretw</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>cf /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>iretd</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>cf /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>iretq</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>cf /o=64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jo</mnemonic>
+        <def>
+            <opc>70</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 80</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jno</mnemonic>
+        <def>
+            <opc>71</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 81</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jb</mnemonic>
+        <def>
+            <opc>72</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 82</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jae</mnemonic>
+        <def>
+            <opc>73</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 83</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jz</mnemonic>
+        <def>
+            <opc>74</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 84</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jnz</mnemonic>
+        <def>
+            <opc>75</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 85</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jbe</mnemonic>
+        <def>
+            <opc>76</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 86</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ja</mnemonic>
+        <def>
+            <opc>77</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 87</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>js</mnemonic>
+        <def>
+            <opc>78</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 88</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jns</mnemonic>
+        <def>
+            <opc>79</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 89</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jp</mnemonic>
+        <def>
+            <opc>7a</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 8a</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jnp</mnemonic>
+        <def>
+            <opc>7b</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 8b</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jl</mnemonic>
+        <def>
+            <opc>7c</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 8c</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jge</mnemonic>
+        <def>
+            <opc>7d</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 8d</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jle</mnemonic>
+        <def>
+            <opc>7e</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 8e</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jg</mnemonic>
+        <def>
+            <opc>7f</opc>
+            <opr>Jb</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>0f 8f</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jcxz</mnemonic>
+        <def>
+            <pfx>aso</pfx>
+            <opc>e3 /a=16</opc>
+            <opr>Jb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jecxz</mnemonic>
+        <def>
+            <pfx>aso</pfx>
+            <opc>e3 /a=32</opc>
+            <opr>Jb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jrcxz</mnemonic>
+        <def>
+            <pfx>aso</pfx>
+            <opc>e3 /a=64</opc>
+            <opr>Jb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>jmp</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>ff /reg=4</opc>
+            <opr>Ev</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>ff /reg=5</opc>
+            <opr>Fv</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>e9</opc>
+            <opr>Jz</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>ea /m=!64</opc>
+            <opr>Av</opr>
+        </def>
+        <def>
+            <opc>eb</opc>
+            <opr>Jb</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lahf</mnemonic>
+        <def>
+            <opc>9f</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lar</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 02</opc>
+            <opr>Gv Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ldmxcsr</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f ae /reg=2 /mod=!11</opc>
+            <opr>Md</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lds</mnemonic>
+        <def>
+            <pfx>aso oso</pfx>
+            <opc>c5 /vex=none /m=!64</opc>
+            <opr>Gv M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lea</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>8d</opc>
+            <opr>Gv M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>les</mnemonic>
+        <def>
+            <pfx>aso oso</pfx>
+            <opc>c4 /m=!64</opc>
+            <opr>Gv M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lfs</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f b4</opc>
+            <opr>Gz M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lgs</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f b5</opc>
+            <opr>Gz M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lidt</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 01 /reg=3 /mod=!11</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lss</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f b2</opc>
+            <opr>Gv M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>leave</mnemonic>
+        <def>
+            <opc>c9</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lfence</mnemonic>
+        <def>
+            <opc>0f ae /reg=5 /mod=11 /rm=0</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=5 /mod=11 /rm=1</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=5 /mod=11 /rm=2</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=5 /mod=11 /rm=3</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=5 /mod=11 /rm=4</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=5 /mod=11 /rm=5</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=5 /mod=11 /rm=6</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=5 /mod=11 /rm=7</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lgdt</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 01 /reg=2 /mod=!11</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lldt</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 00 /reg=2</opc>
+            <opr>Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lmsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 01 /reg=6 /mod=!11</opc>
+            <opr>Ew</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 01 /reg=6 /mod=11</opc>
+            <opr>Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lock</mnemonic>
+        <def>
+            <opc>f0</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lodsb</mnemonic>
+        <def>
+            <pfx>rep seg</pfx>
+            <opc>ac</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lodsw</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>ad /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lodsd</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>ad /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lodsq</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>ad /o=64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>loopne</mnemonic>
+        <def>
+            <opc>e0</opc>
+            <opr>Jb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>loope</mnemonic>
+        <def>
+            <opc>e1</opc>
+            <opr>Jb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>loop</mnemonic>
+        <def>
+            <opc>e2</opc>
+            <opr>Jb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lsl</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f 03</opc>
+            <opr>Gv Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ltr</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 00 /reg=3</opc>
+            <opr>Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>maskmovq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f7 /mod=11</opc>
+            <opr>P N</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>maxpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 5f</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>maxps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 5f</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>maxsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 5f</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>maxss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 5f</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mfence</mnemonic>
+        <def>
+            <opc>0f ae /reg=6 /mod=11 /rm=0</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=6 /mod=11 /rm=1</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=6 /mod=11 /rm=2</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=6 /mod=11 /rm=3</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=6 /mod=11 /rm=4</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=6 /mod=11 /rm=5</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=6 /mod=11 /rm=6</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=6 /mod=11 /rm=7</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>minpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 5d</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>minps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 5d</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>minsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 5d</opc>
+            <opr>V H MqU</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>minss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 5d</opc>
+            <opr>V H MdU</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>monitor</mnemonic>
+        <def>
+            <opc>0f 01 /reg=1 /mod=11 /rm=0</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>montmul</mnemonic>
+        <def>
+            <opc>0f a6 /mod=11 /rm=0 /reg=0</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mov</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c6 /reg=0</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c7 /reg=0</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>88</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>89</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>8a</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>8b</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>8c</opc>
+            <opr>MwRv S</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>8e</opc>
+            <opr>S MwRv</opr>
+        </def>
+        <def>
+            <opc>a0</opc>
+            <opr>AL Ob</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw</pfx>
+            <opc>a1</opc>
+            <opr>rAX Ov</opr>
+        </def>
+        <def>
+            <opc>a2</opc>
+            <opr>Ob AL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw</pfx>
+            <opc>a3</opc>
+            <opr>Ov rAX</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>b0</opc>
+            <opr>R0b Ib</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>b1</opc>
+            <opr>R1b Ib</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>b2</opc>
+            <opr>R2b Ib</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>b3</opc>
+            <opr>R3b Ib</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>b4</opc>
+            <opr>R4b Ib</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>b5</opc>
+            <opr>R5b Ib</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>b6</opc>
+            <opr>R6b Ib</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>b7</opc>
+            <opr>R7b Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>b8</opc>
+            <opr>R0v Iv</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>b9</opc>
+            <opr>R1v Iv</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>ba</opc>
+            <opr>R2v Iv</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>bb</opc>
+            <opr>R3v Iv</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>bc</opc>
+            <opr>R4v Iv</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>bd</opc>
+            <opr>R5v Iv</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>be</opc>
+            <opr>R6v Iv</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>bf</opc>
+            <opr>R7v Iv</opr>
+        </def>
+        <def>
+            <pfx>rexr rexw rexb</pfx>
+            <opc>0f 20</opc>
+            <opr>R C</opr>
+        </def>
+        <def>
+            <pfx>rexr rexw rexb</pfx>
+            <opc>0f 21</opc>
+            <opr>R D</opr>
+        </def>
+        <def>
+            <pfx>rexr rexw rexb</pfx>
+            <opc>0f 22</opc>
+            <opr>C R</opr>
+        </def>
+        <def>
+            <pfx>rexr rexw rexb</pfx>
+            <opc>0f 23</opc>
+            <opr>D R</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movapd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 28</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 29</opc>
+            <opr>W V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movaps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 28</opc>
+            <opr>V W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 29</opc>
+            <opr>W V</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movd</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 6e /o=16</opc>
+            <opr>P Ey</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 6e /o=32</opc>
+            <opr>P Ey</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 6e /o=16</opc>
+            <opr>V Ey</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 6e /o=32</opc>
+            <opr>V Ey</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 7e /o=16</opc>
+            <opr>Ey P</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 7e /o=32</opc>
+            <opr>Ey P</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 7e /o=16</opc>
+            <opr>Ey V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 7e /o=32</opc>
+            <opr>Ey V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movhpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 16 /mod=!11</opc>
+            <opr>V H M</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 17</opc>
+            <opr>M V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movhps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 16 /mod=!11</opc>
+            <opr>V H M</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 17</opc>
+            <opr>M V</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movlhps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 16 /mod=11</opc>
+            <opr>V H U</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movlpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 12 /mod=!11</opc>
+            <opr>V M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 13</opc>
+            <opr>M V</opr>
+        </def>
+        <cpuid>sse2 avx</cpuid>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movlps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 12 /mod=!11</opc>
+            <opr>V M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 13</opc>
+            <opr>M V</opr>
+        </def>
+        <cpuid>sse avx</cpuid>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movhlps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 12 /mod=11</opc>
+            <opr>V U</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movmskpd</mnemonic>
+        <def>
+            <pfx>oso rexr rexb vexl</pfx>
+            <opc>/sse=66 0f 50</opc>
+            <opr>Gd U</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movmskps</mnemonic>
+        <def>
+            <pfx>oso rexr rexb</pfx>
+            <opc>0f 50</opc>
+            <opr>Gd U</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movntdq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f e7</opc>
+            <opr>M V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movnti</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f c3</opc>
+            <opr>M Gy</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movntpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 2b</opc>
+            <opr>M V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movntps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 2b</opc>
+            <opr>M V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movntq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e7</opc>
+            <opr>M P</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movq</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 6e /o=64</opc>
+            <opr>P Eq</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 6e /o=64</opc>
+            <opr>V Eq</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 7e /o=64</opc>
+            <opr>Eq P</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 7e /o=64</opc>
+            <opr>Eq V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 7e</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d6</opc>
+            <opr>W V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 6f</opc>
+            <opr>P Q</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 7f</opc>
+            <opr>Q P</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movsb</mnemonic>
+        <def>
+            <pfx>rep seg</pfx>
+            <opc>a4</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movsw</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>a5 /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movsd</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>a5 /o=32</opc>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 10</opc>
+            <opr>V MqU</opr>
+            <cpuid>sse2</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 11</opc>
+            <opr>W V</opr>
+            <cpuid>sse2</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movsq</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>a5 /o=64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 10</opc>
+            <opr>V MdU</opr>
+            <cpuid>sse</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 11</opc>
+            <opr>W V</opr>
+            <cpuid>sse</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movsx</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f be</opc>
+            <opr>Gv Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f bf</opc>
+            <opr>Gy Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movupd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 10</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 11</opc>
+            <opr>W V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movups</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 10</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 11</opc>
+            <opr>W V</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movzx</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f b6</opc>
+            <opr>Gv Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f b7</opc>
+            <opr>Gy Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mul</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>f6 /reg=4</opc>
+            <opr>Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>f7 /reg=4</opc>
+            <opr>Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mulpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 59</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mulps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 59</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mulsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 59</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mulss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 59</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mwait</mnemonic>
+        <def>
+            <opc>0f 01 /reg=1 /mod=11 /rm=1</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>neg</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>f6 /reg=3</opc>
+            <opr>Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>f7 /reg=3</opc>
+            <opr>Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>nop</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 19</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 1a</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 1b</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 1c</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 1d</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 1e</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 1f</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>not</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>f6 /reg=2</opc>
+            <opr>Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>f7 /reg=2</opc>
+            <opr>Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>or</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>08</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>09</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0a</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0b</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <opc>0c</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>0d</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>80 /reg=1</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>81 /reg=1</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>82 /reg=1 /m=!64</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>83 /reg=1</opc>
+            <opr>Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>orpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 56</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>orps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 56</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>out</mnemonic>
+        <def>
+            <opc>e6</opc>
+            <opr>Ib AL</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>e7</opc>
+            <opr>Ib eAX</opr>
+        </def>
+        <def>
+            <opc>ee</opc>
+            <opr>DX AL</opr>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>ef</opc>
+            <opr>DX eAX</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>outsb</mnemonic>
+        <def>
+            <pfx>rep seg</pfx>
+            <opc>6e</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>outsw</mnemonic>
+        <def>
+            <pfx>rep oso seg</pfx>
+            <opc>6f /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>outsd</mnemonic>
+        <def>
+            <pfx>rep oso seg</pfx>
+            <opc>6f /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>packsswb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 63</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 63</opc>
+            <opr>P Q</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>packssdw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 6b</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 6b</opc>
+            <opr>P Q</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>packuswb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 67</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 67</opc>
+            <opr>P Q</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>paddb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f fc</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f fc</opc>
+            <opr>P Q</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>paddw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f fd</opc>
+            <opr>P Q</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f fd</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>paddd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f fe</opc>
+            <opr>P Q</opr>
+            <cpuid>mmx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f fe</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+
+    <instruction>
+        <mnemonic>paddsb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f ec</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f ec</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>paddsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f ed</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f ed</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>paddusb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f dc</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f dc</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>paddusw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f dd</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f dd</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pand</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f db</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f db</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pandn</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f df</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f df</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pavgb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f e0</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e0</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pavgw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f e3</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e3</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpeqb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 74</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 74</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpeqw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 75</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 75</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpeqd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 76</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 76</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpgtb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 64</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 64</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpgtw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 65</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 65</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpgtd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 66</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 66</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pextrb</mnemonic>
+        <def>
+            <pfx>aso rexx rexr rexb</pfx>
+            <opc>/sse=66 0f 3a 14 /vexw=0</opc>
+            <opr>MbRv V Ib</opr>
+            <mode>def64</mode>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pextrd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexw rexb</pfx>
+            <opc>/sse=66 0f 3a 16 /o=16 /vexw=0</opc>
+            <opr>Ed V Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexw rexb</pfx>
+            <opc>/sse=66 0f 3a 16 /o=32 /vexw=0</opc>
+            <opr>Ed V Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pextrq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexb</pfx>
+            <opc>/sse=66 0f 3a 16 /o=64 /vexw=1</opc>
+            <opr>Eq V Ib</opr>
+            <mode>def64</mode>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+   <instruction>
+        <mnemonic>pextrw</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexb</pfx>
+            <opc>/sse=66 0f c5</opc>
+            <opr>Gd U Ib</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f c5</opc>
+            <opr>Gd N Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexx rexr rexb</pfx>
+            <opc>/sse=66 0f 3a 15</opc>
+            <opr>MwRd V Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pinsrb</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 20</opc>
+            <opr>V MbRd Ib</opr>
+            <cpuid>sse4.1</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pinsrw</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f c4</opc>
+            <opr>P MwRy Ib</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f c4</opc>
+            <opr>V MwRy Ib</opr>
+            <mode>def64</mode>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pinsrd</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 22 /o=16</opc>
+            <opr>V Ed Ib</opr>
+            <cpuid>sse4.1</cpuid>
+        </def>
+ 
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 22 /o=32</opc>
+            <opr>V Ed Ib</opr>
+            <cpuid>sse4.1</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pinsrq</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 22 /o=64</opc>
+            <opr>V Eq Ib</opr>
+            <cpuid>sse4.1</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vpinsrb</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>/vex=66_0f3a 20 /vexw=0 /vexl=0</opc>
+            <opr>V H MbRd Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vpinsrd</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>/vex=66_0f3a 22 /m=!64 /vexw=0 /vexl=0</opc>
+            <opr>V H Ed Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>/vex=66_0f3a 22 /m=64 /vexw=0 /vexl=0</opc>
+            <opr>V H Ed Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+
+    <instruction>
+        <mnemonic>vpinsrq</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>/vex=66_0f3a 22 /m=64 /vexw=1 /vexl=0</opc>
+            <opr>V H Eq Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+
+    <instruction>
+        <mnemonic>pmaddwd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f5</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f5</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmaxsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f ee</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f ee</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmaxub</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f de</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f de</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pminsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f ea</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f ea</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pminub</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f da</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f da</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovmskb</mnemonic>
+        <def>
+            <pfx>oso rexr rexw rexb</pfx>
+            <opc>/sse=66 0f d7 /vexl=0</opc>
+            <opr>Gd U</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>oso rexr rexw rexb</pfx>
+            <opc>0f d7</opc>
+            <opr>Gd N</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmulhuw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e4</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f e4</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmulhw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f e5</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e5</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmullw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f d5</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d5</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pop</mnemonic>
+        <def>
+            <opc>07 /m=!64</opc>
+            <opr>ES</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <opc>17 /m=!64</opc>
+            <opr>SS</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <opc>1f /m=!64</opc>
+            <opr>DS</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <opc>0f a9</opc>
+            <opr>GS</opr>
+        </def>
+        <def>
+            <opc>0f a1</opc>
+            <opr>FS</opr>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>58</opc>
+            <opr>R0v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>59</opc>
+            <opr>R1v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>5a</opc>
+            <opr>R2v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>5b</opc>
+            <opr>R3v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>5c</opc>
+            <opr>R4v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>5d</opc>
+            <opr>R5v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>5e</opc>
+            <opr>R6v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>5f</opc>
+            <opr>R7v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>8f /reg=0</opc>
+            <opr>Ev</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>popa</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>61 /o=16 /m=!64</opc>
+            <mode>inv64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>popad</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>61 /o=32 /m=!64</opc>
+            <mode>inv64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>popfw</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>9d /m=!64 /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>popfd</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>9d /m=!64 /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>popfq</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>9d /m=64 /o=32</opc>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>9d /m=64 /o=64</opc>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>por</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f eb</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f eb</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>prefetch</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 0d /reg=0</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 0d /reg=1</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 0d /reg=2</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 0d /reg=3</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 0d /reg=4</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 0d /reg=5</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 0d /reg=6</opc>
+            <opr>M</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 0d /reg=7</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>prefetchnta</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 18 /reg=0</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>prefetcht0</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 18 /reg=1</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>prefetcht1</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 18 /reg=2</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>prefetcht2</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f 18 /reg=3</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psadbw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f6</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f6</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pshufw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 70</opc>
+            <opr>P Q Ib</opr>
+        </def>
+    </instruction>
+
+     <instruction>
+        <mnemonic>psllw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f1</opc>
+            <opr>V W</opr>
+            <cpuid>sse2</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f1</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 71 /reg=6</opc>
+            <opr>U Ib</opr>
+            <cpuid>sse2</cpuid>
+        </def>
+        <def>
+            <opc>0f 71 /reg=6</opc>
+            <opr>N Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pslld</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f2</opc>
+            <opr>V W</opr>
+            <cpuid>sse2</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f2</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 72 /reg=6</opc>
+            <opr>U Ib</opr>
+            <cpuid>sse2</cpuid>
+        </def>
+        <def>
+            <opc>0f 72 /reg=6</opc>
+            <opr>N Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psllq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f3</opc>
+            <opr>V W</opr>
+            <cpuid>sse2</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f3</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 73 /reg=6</opc>
+            <opr>U Ib</opr>
+            <cpuid>sse2</cpuid>
+        </def>
+        <def>
+            <opc>0f 73 /reg=6</opc>
+            <opr>N Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psraw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e1</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f e1</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 71 /reg=4</opc>
+            <opr>H U Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <opc>0f 71 /reg=4</opc>
+            <opr>N Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psrad</mnemonic>
+        <def>
+            <opc>0f 72 /reg=4</opc>
+            <opr>N Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f e2</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e2</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 72 /reg=4</opc>
+            <opr>H U Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psrlw</mnemonic>
+        <def>
+            <opc>0f 71 /reg=2</opc>
+            <opr>N Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f d1</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d1</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 71 /reg=2</opc>
+            <opr>H U Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psrld</mnemonic>
+        <def>
+            <opc>0f 72 /reg=2</opc>
+            <opr>N Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f d2</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d2</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 72 /reg=2</opc>
+            <opr>H U Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psrlq</mnemonic>
+        <def>
+            <opc>0f 73 /reg=2</opc>
+            <opr>N Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f d3</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d3</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 73 /reg=2</opc>
+            <opr>H U Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psubb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f8</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f8</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psubw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f9</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f9</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psubd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f fa</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f fa</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psubsb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e8</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f e8</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psubsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f e9</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f e9</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psubusb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f d8</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d8</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psubusw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f d9</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d9</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>punpckhbw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 68</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 68</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>punpckhwd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 69</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 69</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>punpckhdq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 6a</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 6a</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>punpcklbw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 60</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 60</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>punpcklwd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 61</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 61</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>punpckldq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 62</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 62</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pi2fw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=0c</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pi2fd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=0d</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pf2iw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=1c</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pf2id</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=1d</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfnacc</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=8a</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfpnacc</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=8e</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfcmpge</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=90</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfmin</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=94</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfrcp</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=96</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfrsqrt</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=97</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfsub</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=9a</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfadd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=9e</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfcmpgt</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=a0</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfmax</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=a4</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfrcpit1</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=a6</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfrsqit1</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=a7</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfsubr</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=aa</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfacc</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=ae</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfcmpeq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=b0</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfmul</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=b4</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pfrcpit2</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=b6</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmulhrw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=b7</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pswapd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=bb</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pavgusb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 0f /3dnow=bf</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>push</mnemonic>
+        <def>
+            <opc>06 /m=!64</opc>
+            <opr>ES</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <opc>0e /m=!64</opc>
+            <opr>CS</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <opc>16 /m=!64</opc>
+            <opr>SS</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <opc>1e /m=!64</opc>
+            <opr>DS</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <opc>0f a8</opc>
+            <opr>GS</opr>
+        </def>
+        <def>
+            <opc>0f a0</opc>
+            <opr>FS</opr>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>50</opc>
+            <opr>R0v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>51</opc>
+            <opr>R1v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>52</opc>
+            <opr>R2v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>53</opc>
+            <opr>R3v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>54</opc>
+            <opr>R4v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>55</opc>
+            <opr>R5v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>56</opc>
+            <opr>R6v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexb</pfx>
+            <opc>57</opc>
+            <opr>R7v</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>68</opc>
+            <opr>sIz</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>ff /reg=6</opc>
+            <opr>Ev</opr>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso</pfx>
+            <opc>6a</opc>
+            <opr>sIb</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pusha</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>60 /o=16 /m=!64</opc>
+            <mode>inv64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pushad</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>60 /o=32 /m=!64</opc>
+            <mode>inv64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pushfw</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>9c /m=!64 /o=16</opc>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>9c /m=64 /o=16</opc>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pushfd</mnemonic>
+        <def>
+            <pfx>oso</pfx>
+            <opc>9c /m=!64 /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pushfq</mnemonic>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>9c /m=64 /o=32</opc>
+            <mode>def64</mode>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>9c /m=64 /o=64</opc>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pxor</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f ef</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f ef</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rcl</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c0 /reg=2</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c1 /reg=2</opc>
+            <opr>Ev Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d0 /reg=2</opc>
+            <opr>Eb I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d2 /reg=2</opc>
+            <opr>Eb CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d3 /reg=2</opc>
+            <opr>Ev CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d1 /reg=2</opc>
+            <opr>Ev I1</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rcr</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d0 /reg=3</opc>
+            <opr>Eb I1</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c1 /reg=3</opc>
+            <opr>Ev Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c0 /reg=3</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d1 /reg=3</opc>
+            <opr>Ev I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d2 /reg=3</opc>
+            <opr>Eb CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d3 /reg=3</opc>
+            <opr>Ev CL</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rol</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c0 /reg=0</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d0 /reg=0</opc>
+            <opr>Eb I1</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d1 /reg=0</opc>
+            <opr>Ev I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d2 /reg=0</opc>
+            <opr>Eb CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d3 /reg=0</opc>
+            <opr>Ev CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c1 /reg=0</opc>
+            <opr>Ev Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ror</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d0 /reg=1</opc>
+            <opr>Eb I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c0 /reg=1</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c1 /reg=1</opc>
+            <opr>Ev Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d1 /reg=1</opc>
+            <opr>Ev I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d2 /reg=1</opc>
+            <opr>Eb CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d3 /reg=1</opc>
+            <opr>Ev CL</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rcpps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 53</opc>
+            <opr>V W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rcpss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 53</opc>
+            <opr>V W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rdmsr</mnemonic>
+        <def>
+            <opc>0f 32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rdpmc</mnemonic>
+        <def>
+            <opc>0f 33</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rdtsc</mnemonic>
+        <def>
+            <opc>0f 31</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rdtscp</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=7 /mod=11 /rm=1</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>repne</mnemonic>
+        <def>
+            <opc>f2</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rep</mnemonic>
+        <def>
+            <opc>f3</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ret</mnemonic>
+        <def>
+            <opc>c2</opc>
+            <opr>Iw</opr>
+        </def>
+        <def>
+            <opc>c3</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>retf</mnemonic>
+        <def>
+            <opc>ca</opc>
+            <opr>Iw</opr>
+        </def>
+        <def>
+            <opc>cb</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rsm</mnemonic>
+        <def>
+            <opc>0f aa</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rsqrtps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 52</opc>
+            <opr>V W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rsqrtss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 52</opc>
+            <opr>V W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sahf</mnemonic>
+        <def>
+            <opc>9e</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sal</mnemonic>
+    </instruction>
+
+    <instruction>
+        <mnemonic>salc</mnemonic>
+        <def>
+            <opc>d6 /m=!64</opc>
+            <mode>inv64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sar</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d1 /reg=7</opc>
+            <opr>Ev I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c0 /reg=7</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d0 /reg=7</opc>
+            <opr>Eb I1</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c1 /reg=7</opc>
+            <opr>Ev Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d2 /reg=7</opc>
+            <opr>Eb CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d3 /reg=7</opc>
+            <opr>Ev CL</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>shl</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c0 /reg=6</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c1 /reg=6</opc>
+            <opr>Ev Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d0 /reg=6</opc>
+            <opr>Eb I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d2 /reg=6</opc>
+            <opr>Eb CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d3 /reg=6</opc>
+            <opr>Ev CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c1 /reg=4</opc>
+            <opr>Ev Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>d2 /reg=4</opc>
+            <opr>Eb CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d1 /reg=4</opc>
+            <opr>Ev I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d0 /reg=4</opc>
+            <opr>Eb I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c0 /reg=4</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d3 /reg=4</opc>
+            <opr>Ev CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d1 /reg=6</opc>
+            <opr>Ev I1</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>shr</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>c1 /reg=5</opc>
+            <opr>Ev Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d2 /reg=5</opc>
+            <opr>Eb CL</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d1 /reg=5</opc>
+            <opr>Ev I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>d0 /reg=5</opc>
+            <opr>Eb I1</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>c0 /reg=5</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>d3 /reg=5</opc>
+            <opr>Ev CL</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sbb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>18</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>19</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>1a</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>1b</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <opc>1c</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>1d</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>80 /reg=3</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>81 /reg=3</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>82 /reg=3 /m=!64</opc>
+            <opr>Eb Ib</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>83 /reg=3</opc>
+            <opr>Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>scasb</mnemonic>
+        <def>
+            <pfx>repz</pfx>
+            <opc>ae</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>scasw</mnemonic>
+        <def>
+            <pfx>repz oso rexw</pfx>
+            <opc>af /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>scasd</mnemonic>
+        <def>
+            <pfx>repz oso rexw</pfx>
+            <opc>af /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>scasq</mnemonic>
+        <def>
+            <pfx>repz oso rexw</pfx>
+            <opc>af /o=64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>seto</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 90</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setno</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 91</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 92</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setae</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 93</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setz</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 94</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setnz</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 95</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setbe</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 96</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>seta</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 97</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sets</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 98</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setns</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 99</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setp</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 9a</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setnp</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 9b</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setl</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 9c</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setge</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 9d</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setle</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 9e</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>setg</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 9f</opc>
+            <opr>Eb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sfence</mnemonic>
+        <def>
+            <opc>0f ae /reg=7 /mod=11 /rm=0</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=7 /mod=11 /rm=1</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=7 /mod=11 /rm=2</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=7 /mod=11 /rm=3</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=7 /mod=11 /rm=4</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=7 /mod=11 /rm=5</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=7 /mod=11 /rm=6</opc>
+        </def>
+        <def>
+            <opc>0f ae /reg=7 /mod=11 /rm=7</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sgdt</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 01 /reg=0 /mod=!11</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>shld</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f a4</opc>
+            <opr>Ev Gv Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f a5</opc>
+            <opr>Ev Gv CL</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>shrd</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f ac</opc>
+            <opr>Ev Gv Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f ad</opc>
+            <opr>Ev Gv CL</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>shufpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f c6</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>shufps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f c6</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sidt</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 01 /reg=1 /mod=!11</opc>
+            <opr>M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sldt</mnemonic>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>0f 00 /reg=0</opc>
+            <opr>MwRv</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>smsw</mnemonic>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>0f 01 /reg=4 /mod=!11</opc>
+            <opr>MwRv</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>0f 01 /reg=4 /mod=11</opc>
+            <opr>MwRv</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sqrtps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 51</opc>
+            <opr>V W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sqrtpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 51</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sqrtsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 51</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sqrtss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 51</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>stc</mnemonic>
+        <def>
+            <opc>f9</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>std</mnemonic>
+        <def>
+            <opc>fd</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>stgi</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=3 /mod=11 /rm=4</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sti</mnemonic>
+        <def>
+            <opc>fb</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>skinit</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=3 /mod=11 /rm=6</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>stmxcsr</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>0f ae /mod=!11 /reg=3</opc>
+            <opr>Md</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>stosb</mnemonic>
+        <def>
+            <pfx>rep seg</pfx>
+            <opc>aa</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>stosw</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>ab /o=16</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>stosd</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>ab /o=32</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>stosq</mnemonic>
+        <def>
+            <pfx>rep seg oso rexw</pfx>
+            <opc>ab /o=64</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>str</mnemonic>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>0f 00 /reg=1</opc>
+            <opr>MwRv</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sub</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>28</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>29</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>2a</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>2b</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <opc>2c</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>2d</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>80 /reg=5</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>81 /reg=5</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>82 /reg=5 /m=!64</opc>
+            <opr>Eb Ib</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>83 /reg=5</opc>
+            <opr>Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>subpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 5c</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>subps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>0f 5c</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>subsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 5c</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>subss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 5c</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>swapgs</mnemonic>
+        <def>
+            <opc>0f 01 /reg=7 /mod=11 /rm=0</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>syscall</mnemonic>
+        <def>
+            <opc>0f 05</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sysenter</mnemonic>
+        <def>
+            <opc>0f 34 /m=!64</opc>
+        </def>
+        <def>
+            <opc>0f 34 /m=64</opc>
+            <vendor>intel</vendor>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sysexit</mnemonic>
+        <def>
+            <opc>0f 35 /m=!64</opc>
+        </def>
+        <def>
+            <opc>0f 35 /m=64</opc>
+            <vendor>intel</vendor>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>sysret</mnemonic>
+        <def>
+            <opc>0f 07</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>test</mnemonic>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>f6 /reg=0</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>84</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>85</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <opc>a8</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>a9</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexw rexr rexx rexb</pfx>
+            <opc>f6 /reg=1</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>f7 /reg=0</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>f7 /reg=1</opc>
+            <opr>Ev Iz</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ucomisd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 2e</opc>
+            <opr>V W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ucomiss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 2e</opc>
+            <opr>V W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ud2</mnemonic>
+        <def>
+            <opc>0f 0b</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>unpckhpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 15</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>unpckhps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 15</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>unpcklps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 14</opc>
+            <opr>V H W</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>unpcklpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 14</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>verr</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 00 /reg=4</opc>
+            <opr>Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>verw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 00 /reg=5</opc>
+            <opr>Ew</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmcall</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <opc>0f 01 /reg=0 /mod=11 /rm=1</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>rdrand</mnemonic>
+        <def>
+            <pfx>oso rexr rexw rexx rexb</pfx>
+            <opc>0f c7 /mod=11 /reg=6</opc>
+            <opr>R</opr>
+        </def>
+        <cpuid>rdrand</cpuid>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmclear</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f c7 /mod=!11 /reg=6</opc>
+            <opr>Mq</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmxon</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f c7 /mod=!11 /reg=6</opc>
+            <opr>Mq</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmptrld</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f c7 /mod=!11 /reg=6</opc>
+            <opr>Mq</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmptrst</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f c7 /mod=!11 /reg=7</opc>
+            <opr>Mq</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmlaunch</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <opc>0f 01 /reg=0 /mod=11 /rm=2</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmresume</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <opc>0f 01 /reg=0 /mod=11 /rm=3</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmxoff</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <opc>0f 01 /reg=0 /mod=11 /rm=4</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmread</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 78</opc>
+            <opr>Ey Gy</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmwrite</mnemonic>
+        <vendor>intel</vendor>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 79</opc>
+            <opr>Gy Ey</opr>
+            <mode>def64</mode>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmrun</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=3 /mod=11 /rm=0</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmmcall</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=3 /mod=11 /rm=1</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmload</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=3 /mod=11 /rm=2</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmsave</mnemonic>
+        <vendor>amd</vendor>
+        <def>
+            <opc>0f 01 /reg=3 /mod=11 /rm=3</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>wait</mnemonic>
+        <def>
+            <opc>9b</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>wbinvd</mnemonic>
+        <def>
+            <opc>0f 09</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>wrmsr</mnemonic>
+        <def>
+            <opc>0f 30</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xadd</mnemonic>
+        <def>
+            <pfx>aso oso rexr rexx rexb</pfx>
+            <opc>0f c0</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f c1</opc>
+            <opr>Ev Gv</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xchg</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>86</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>87</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>90</opc>
+            <opr>R0v rAX</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>91</opc>
+            <opr>R1v rAX</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>92</opc>
+            <opr>R2v rAX</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>93</opc>
+            <opr>R3v rAX</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>94</opc>
+            <opr>R4v rAX</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>95</opc>
+            <opr>R5v rAX</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>96</opc>
+            <opr>R6v rAX</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>97</opc>
+            <opr>R7v rAX</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xgetbv</mnemonic>
+    <def>
+        <opc>0f 01 /mod=11 /reg=2 /rm=0</opc>
+    </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xlatb</mnemonic>
+        <def>
+            <pfx>rexw seg</pfx>
+            <opc>d7</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xor</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>30</opc>
+            <opr>Eb Gb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>31</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>32</opc>
+            <opr>Gb Eb</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>33</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <def>
+            <opc>34</opc>
+            <opr>AL Ib</opr>
+        </def>
+        <def>
+            <pfx>oso rexw</pfx>
+            <opc>35</opc>
+            <opr>rAX sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>80 /reg=6</opc>
+            <opr>Eb Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>81 /reg=6</opc>
+            <opr>Ev sIz</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>82 /reg=6 /m=!64</opc>
+            <opr>Eb Ib</opr>
+            <mode>inv64</mode>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>83 /reg=6</opc>
+            <opr>Ev sIb</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xorpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 57</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xorps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 57</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xcryptecb</mnemonic>
+        <def>
+            <opc>0f a7 /mod=11 /rm=0 /reg=1</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xcryptcbc</mnemonic>
+        <def>
+            <opc>0f a7 /mod=11 /rm=0 /reg=2</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xcryptctr</mnemonic>
+        <def>
+            <opc>0f a7 /mod=11 /rm=0 /reg=3</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xcryptcfb</mnemonic>
+        <def>
+            <opc>0f a7 /mod=11 /rm=0 /reg=4</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xcryptofb</mnemonic>
+        <def>
+            <opc>0f a7 /mod=11 /rm=0 /reg=5</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xrstor</mnemonic>
+    <def>
+        <pfx>aso rexw rexr rexx rexb</pfx>
+        <opc>0f ae /reg=5 /mod=!11</opc>
+        <opr>M</opr>
+    </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xsave</mnemonic>
+    <def>
+        <pfx>aso rexw rexr rexx rexb</pfx>
+        <opc>0f ae /reg=4 /mod=!11</opc>
+        <opr>M</opr>
+    </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xsetbv</mnemonic>
+    <def>
+        <opc>0f 01 /mod=11 /reg=2 /rm=1</opc>
+    </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xsha1</mnemonic>
+        <def>
+            <opc>0f a6 /mod=11 /rm=0 /reg=1</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xsha256</mnemonic>
+        <def>
+            <opc>0f a6 /mod=11 /rm=0 /reg=2</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>xstore</mnemonic>
+        <def>
+            <opc>0f a7 /mod=11 /rm=0 /reg=0</opc>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pclmulqdq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 44</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>aesni avx</cpuid>
+        </def>
+    </instruction>
+
+    <!--
+    SMX
+      -->
+
+    <instruction>
+        <mnemonic>getsec</mnemonic>
+    <cpuid>smx</cpuid>
+    <def>
+        <opc>0f 37</opc>
+    </def>
+    </instruction>
+
+    <!--
+         SSE 2 
+     -->
+
+    <instruction>
+        <mnemonic>movdqa</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 7f</opc>
+            <opr>W V</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 6f</opc>
+            <opr>V W</opr>
+        </def>
+        <cpuid>sse2 avx</cpuid>
+    </instruction>
+
+    <instruction>
+        <mnemonic>maskmovdqu</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f7 /mod=11</opc>
+            <opr>V U</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movdq2q</mnemonic>
+        <def>
+            <pfx>aso rexb</pfx>
+            <opc>/sse=f2 0f d6</opc>
+            <opr>P U</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movdqu</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f3 0f 6f</opc>
+            <opr>V W</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f3 0f 7f</opc>
+            <opr>W V</opr>
+        </def>
+		<cpuid>sse2 avx</cpuid>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movq2dq</mnemonic>
+        <def>
+            <pfx>aso rexr</pfx>
+            <opc>/sse=f3 0f d6</opc>
+            <opr>V N</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>paddq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f d4</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f d4</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psubq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f fb</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f fb</opc>
+            <opr>P Q</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmuludq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f f4</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f f4</opc>
+            <opr>V W</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pshufhw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f3 0f 70</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pshuflw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 70</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pshufd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 70</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pslldq</mnemonic>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 73 /reg=7</opc>
+            <opr>H U Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psrldq</mnemonic>
+        <def>
+            <pfx>rexb</pfx>
+            <opc>/sse=66 0f 73 /reg=3</opc>
+            <opr>H U Ib</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>punpckhqdq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 6d</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>punpcklqdq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 6c</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>haddpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 7c</opc>
+            <opr>V H W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>haddps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f2 0f 7c</opc>
+            <opr>V H W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>hsubpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 7d</opc>
+            <opr>V H W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>hsubps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f2 0f 7d</opc>
+            <opr>V H W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>insertps</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 21</opc>
+            <opr>V H Md Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>lddqu</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f2 0f f0</opc>
+            <opr>V M</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movddup</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 12 /mod=11</opc>
+            <opr>V W</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=f2 0f 12 /mod=!11</opc>
+            <opr>V W</opr>
+        </def>
+        <cpuid>sse3 avx</cpuid>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movshdup</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f3 0f 16 /mod=11</opc>
+            <opr>V W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f3 0f 16 /mod=!11</opc>
+            <opr>V W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movsldup</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f3 0f 12 /mod=11</opc>
+            <opr>V W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=f3 0f 12 /mod=!11</opc>
+            <opr>V W</opr>
+            <cpuid>sse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <!--
+         SSSE 3
+     -->
+
+    <instruction>
+        <mnemonic>pabsb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 1c</opc>
+            <opr>P Q</opr>
+            <cpuid>ssse3</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 38 1c</opc>
+            <opr>V W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pabsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 1d</opc>
+            <opr>P Q</opr>
+            <cpuid>ssse3</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 38 1d</opc>
+            <opr>V W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pabsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 1e</opc>
+            <opr>P Q</opr>
+            <cpuid>ssse3</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 38 1e</opc>
+            <opr>V W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pshufb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 00</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 00</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>phaddw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 01</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 01</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>phaddd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 02</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 02</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>phaddsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 03</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 03</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmaddubsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 04</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 04</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>phsubw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 05</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 05</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>phsubd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 06</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 06</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>phsubsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 07</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 07</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psignb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 08</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 08</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psignd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 0a</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 0a</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>psignw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 09</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 09</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmulhrsw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 38 0b</opc>
+            <opr>P Q</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 0b</opc>
+            <opr>V H W</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>palignr</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>0f 3a 0f</opc>
+            <opr>P Q Ib</opr>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 0f</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>ssse3 avx</cpuid>
+        </def>
+    </instruction>
+
+    <!--
+         SSE 4.1
+     -->
+
+    <instruction>
+        <mnemonic>pblendvb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 10</opc>
+            <opr>V W</opr>
+            <cpuid>sse4.1</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmuldq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 28</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pminsb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 38</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pminsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 39</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pminuw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 3a</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pminud</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 3b</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmaxsb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 3c</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmaxsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 3d</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmaxud</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 3f</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmaxuw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 3e</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmulld</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 40</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>phminposuw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 41</opc>
+            <opr>V W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>roundps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 3a 08</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>roundpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 3a 09</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>roundss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 0a</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>roundsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 0b</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>blendpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 3a 0d</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>blendps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 0c</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>blendvpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 15</opc>
+            <opr>V W</opr>
+            <cpuid>sse4.1</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>blendvps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 38 14</opc>
+            <opr>V W</opr>
+            <cpuid>sse4.1</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>bound</mnemonic>
+        <def>
+            <pfx>aso oso</pfx>
+            <opc>62 /m=!64</opc>
+            <opr>Gv M</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>bsf</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f bc</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>bsr</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f bd</opc>
+            <opr>Gv Ev</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>bswap</mnemonic>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>0f c8</opc>
+            <opr>R0y</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>0f c9</opc>
+            <opr>R1y</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>0f ca</opc>
+            <opr>R2y</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>0f cb</opc>
+            <opr>R3y</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>0f cc</opc>
+            <opr>R4y</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>0f cd</opc>
+            <opr>R5y</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>0f ce</opc>
+            <opr>R6y</opr>
+        </def>
+        <def>
+            <pfx>oso rexw rexb</pfx>
+            <opc>0f cf</opc>
+            <opr>R7y</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>bt</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f ba /reg=4</opc>
+            <opr>Ev Ib</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f a3</opc>
+            <opr>Ev Gv</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>btc</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f bb</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f ba /reg=7</opc>
+            <opr>Ev Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>btr</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f b3</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f ba /reg=6</opc>
+            <opr>Ev Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>bts</mnemonic>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f ab</opc>
+            <opr>Ev Gv</opr>
+        </def>
+        <def>
+            <pfx>aso oso rexw rexr rexx rexb</pfx>
+            <opc>0f ba /reg=5</opc>
+            <opr>Ev Ib</opr>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pblendw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 0e</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>mpsadbw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 3a 42</opc>
+            <opr>V H W Ib</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movntdqa</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 38 2a</opc>
+            <opr>V M</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>packusdw</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 38 2b</opc>
+            <opr>V H W</opr>
+            <cpuid>sse2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovsxbw</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 20</opc>
+            <opr>V MqU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovsxbd</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 21</opc>
+            <opr>V MdU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovsxbq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 22</opc>
+            <opr>V MwU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovsxwd</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 23</opc>
+            <opr>V MqU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovsxwq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 24</opc>
+            <opr>V MdU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovsxdq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 25</opc>
+            <opr>V MqU</opr>
+            <cpuid>sse4.1</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovzxbw</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 30</opc>
+            <opr>V MqU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovzxbd</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 31</opc>
+            <opr>V MdU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovzxbq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 32</opc>
+            <opr>V MwU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovzxwd</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 33</opc>
+            <opr>V MqU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovzxwq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 34</opc>
+            <opr>V MdU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pmovzxdq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 35</opc>
+            <opr>V MqU</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpeqq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 29</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+     <instruction>
+        <mnemonic>popcnt</mnemonic>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>/sse=f3 0f b8</opc>
+            <opr>Gv Ev</opr>
+        </def>
+        <cpuid>sse4.2</cpuid>
+    </instruction>
+
+    <instruction>
+        <mnemonic>ptest</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb vexl</pfx>
+            <opc>/sse=66 0f 38 17</opc>
+            <opr>V W</opr>
+            <cpuid>sse4.1 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpestri</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 61</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse4.2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpestrm</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 60</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse4.2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpgtq</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 38 37</opc>
+            <opr>V H W</opr>
+            <cpuid>sse4.2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpistri</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 63</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse4.2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>pcmpistrm</mnemonic>
+        <def>
+            <pfx>aso rexr rexw rexx rexb</pfx>
+            <opc>/sse=66 0f 3a 62</opc>
+            <opr>V W Ib</opr>
+            <cpuid>sse4.2 avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>movbe</mnemonic>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>0f 38 f0</opc>
+            <opr>Gv Mv</opr>
+            <cpuid>sse3 atom</cpuid>
+        </def>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>0f 38 f1</opc>
+            <opr>Mv Gv</opr>
+            <cpuid>sse3 atom</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>crc32</mnemonic>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>/sse=f2 0f 38 f0</opc>
+            <opr>Gy Eb</opr>
+            <cpuid>sse4.2</cpuid>
+        </def>
+        <def>
+            <pfx>aso oso rexr rexw rexx rexb</pfx>
+            <opc>/sse=f2 0f 38 f1</opc>
+            <opr>Gy Ev</opr>
+            <cpuid>sse4.2</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>invalid</mnemonic>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vbroadcastss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 18 /vexw=0</opc>
+            <opr>V Md</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vbroadcastsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 19 /vexw=0 /vexl=1</opc>
+            <opr>Vqq Mq</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vextractf128</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f3a 19 /vexw=0 /vexl=1</opc>
+            <opr>Wdq Vqq Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vinsertf128</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f3a 18 /vexw=0 /vexl=1</opc>
+            <opr>Vqq Hqq Wdq Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmaskmovps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 2c /vexw=0</opc>
+            <opr>V H M</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 2e /vexw=0</opc>
+            <opr>M H V</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmaskmovpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 2d /vexw=0</opc>
+            <opr>V H M</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 2f /vexw=0</opc>
+            <opr>M H V</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vpermilpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 0d /vexw=0</opc>
+            <opr>Vx Hx Wx</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f3a 05 /vexw=0</opc>
+            <opr>V W Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vpermilps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 0c /vexw=0</opc>
+            <opr>Vx Hx Wx</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f3a 04 /vexw=0</opc>
+            <opr>Vx Wx Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vperm2f128</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f3a 06 /vexw=0 /vexl=1</opc>
+            <opr>Vqq Hqq Wqq Ib</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vtestps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 0e /vexw=0</opc>
+            <opr>Vx Wx</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vtestpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f38 0f /vexw=0</opc>
+            <opr>Vx Wx</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vzeroupper</mnemonic>
+        <def>
+            <opc>/vex=0f 77 /vexl=0</opc>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vzeroall</mnemonic>
+        <def>
+            <opc>/vex=0f 77 /vexl=1</opc>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vblendvpd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f3a 4b /vexw=0</opc>
+            <opr>Vx Hx Wx Lx</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vblendvps</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb vexl</pfx>
+            <opc>/vex=66_0f3a 4a /vexw=0</opc>
+            <opr>Vx Hx Wx Lx</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmovsd</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=f2_0f 10 /mod=11</opc>
+            <opr>V H U</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=f2_0f 10 /mod=!11</opc>
+            <opr>V Mq</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=f2_0f 11 /mod=11</opc>
+            <opr>U H V</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=f2_0f 11 /mod=!11</opc>
+            <opr>Mq V</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vmovss</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=f3_0f 10 /mod=11</opc>
+            <opr>V H U</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=f3_0f 10 /mod=!11</opc>
+            <opr>V Md</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=f3_0f 11 /mod=11</opc>
+            <opr>U H V</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=f3_0f 11 /mod=!11</opc>
+            <opr>Md V</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vpblendvb</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=66_0f3a 4c /vexw=0</opc>
+            <opr>V H W L</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+    <instruction>
+        <mnemonic>vpsllw</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=66_0f f1 /vexl=0</opc>
+            <opr>V H W</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=66_0f 71 /reg=6 /vexl=0</opc>
+            <opr>H V W</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+     <instruction>
+        <mnemonic>vpslld</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=66_0f f2 /vexl=0</opc>
+            <opr>V H W</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=66_0f 72 /reg=6 /vexl=0</opc>
+            <opr>H V W</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+
+      <instruction>
+        <mnemonic>vpsllq</mnemonic>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=66_0f f3 /vexl=0</opc>
+            <opr>V H W</opr>
+            <cpuid>avx</cpuid>
+        </def>
+        <def>
+            <pfx>aso rexr rexx rexb</pfx>
+            <opc>/vex=66_0f 73 /reg=6 /vexl=0</opc>
+            <opr>H V W</opr>
+            <cpuid>avx</cpuid>
+        </def>
+    </instruction>
+ 
+</x86optable>
diff --git a/disassembler/udis86/ud_itab.py b/disassembler/udis86/ud_itab.py
new file mode 100644
index 0000000..ef011d2
--- /dev/null
+++ b/disassembler/udis86/ud_itab.py
@@ -0,0 +1,379 @@
+# udis86 - scripts/ud_itab.py
+# 
+# Copyright (c) 2009, 2013 Vivek Thampi
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without modification, 
+# are permitted provided that the following conditions are met:
+# 
+#     * Redistributions of source code must retain the above copyright notice, 
+#       this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above copyright notice, 
+#       this list of conditions and the following disclaimer in the documentation 
+#       and/or other materials provided with the distribution.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+import sys
+from ud_opcode import UdOpcodeTable, UdOpcodeTables, UdInsnDef
+
+class UdItabGenerator:
+
+    OperandDict = {
+        "Av"       : [    "OP_A"        , "SZ_V"     ],
+        "E"        : [    "OP_E"        , "SZ_NA"    ],
+        "Eb"       : [    "OP_E"        , "SZ_B"     ],
+        "Ew"       : [    "OP_E"        , "SZ_W"     ],
+        "Ev"       : [    "OP_E"        , "SZ_V"     ],
+        "Ed"       : [    "OP_E"        , "SZ_D"     ],
+        "Ey"       : [    "OP_E"        , "SZ_Y"     ],
+        "Eq"       : [    "OP_E"        , "SZ_Q"     ],
+        "Ez"       : [    "OP_E"        , "SZ_Z"     ],
+        "Fv"       : [    "OP_F"        , "SZ_V"     ],
+        "G"        : [    "OP_G"        , "SZ_NA"    ],
+        "Gb"       : [    "OP_G"        , "SZ_B"     ],
+        "Gw"       : [    "OP_G"        , "SZ_W"     ],
+        "Gv"       : [    "OP_G"        , "SZ_V"     ],
+        "Gy"       : [    "OP_G"        , "SZ_Y"     ],
+        "Gd"       : [    "OP_G"        , "SZ_D"     ],
+        "Gq"       : [    "OP_G"        , "SZ_Q"     ],
+        "Gz"       : [    "OP_G"        , "SZ_Z"     ],
+        "M"        : [    "OP_M"        , "SZ_NA"    ],
+        "Mb"       : [    "OP_M"        , "SZ_B"     ],
+        "Mw"       : [    "OP_M"        , "SZ_W"     ],
+        "Ms"       : [    "OP_M"        , "SZ_W"     ],
+        "Md"       : [    "OP_M"        , "SZ_D"     ],
+        "Mq"       : [    "OP_M"        , "SZ_Q"     ],
+        "Mdq"      : [    "OP_M"        , "SZ_DQ"    ],
+        "Mv"       : [    "OP_M"        , "SZ_V"     ],
+        "Mt"       : [    "OP_M"        , "SZ_T"     ],
+        "Mo"       : [    "OP_M"        , "SZ_O"     ],
+        "MbRd"     : [    "OP_MR"       , "SZ_BD"    ],
+        "MbRv"     : [    "OP_MR"       , "SZ_BV"    ],
+        "MwRv"     : [    "OP_MR"       , "SZ_WV"    ],
+        "MwRd"     : [    "OP_MR"       , "SZ_WD"    ],
+        "MwRy"     : [    "OP_MR"       , "SZ_WY"    ],
+        "MdRy"     : [    "OP_MR"       , "SZ_DY"    ],
+        "I1"       : [    "OP_I1"       , "SZ_NA"    ],
+        "I3"       : [    "OP_I3"       , "SZ_NA"    ],
+        "Ib"       : [    "OP_I"        , "SZ_B"     ],
+        "Iw"       : [    "OP_I"        , "SZ_W"     ],
+        "Iv"       : [    "OP_I"        , "SZ_V"     ],
+        "Iz"       : [    "OP_I"        , "SZ_Z"     ],
+        "sIb"      : [    "OP_sI"       , "SZ_B"     ],
+        "sIz"      : [    "OP_sI"       , "SZ_Z"     ],
+        "sIv"      : [    "OP_sI"       , "SZ_V"     ],
+        "Jv"       : [    "OP_J"        , "SZ_V"     ],
+        "Jz"       : [    "OP_J"        , "SZ_Z"     ],
+        "Jb"       : [    "OP_J"        , "SZ_B"     ],
+        "R"        : [    "OP_R"        , "SZ_RDQ"   ], 
+        "C"        : [    "OP_C"        , "SZ_NA"    ],
+        "D"        : [    "OP_D"        , "SZ_NA"    ],
+        "S"        : [    "OP_S"        , "SZ_W"     ],
+        "Ob"       : [    "OP_O"        , "SZ_B"     ],
+        "Ow"       : [    "OP_O"        , "SZ_W"     ],
+        "Ov"       : [    "OP_O"        , "SZ_V"     ],
+        "U"        : [    "OP_U"        , "SZ_O"     ],
+        "Ux"       : [    "OP_U"        , "SZ_X"     ],
+        "V"        : [    "OP_V"        , "SZ_DQ"    ],
+        "Vdq"      : [    "OP_V"        , "SZ_DQ"    ],
+        "Vqq"      : [    "OP_V"        , "SZ_QQ"    ],
+        "Vsd"      : [    "OP_V"        , "SZ_Q"     ],
+        "Vx"       : [    "OP_V"        , "SZ_X"     ],
+        "H"        : [    "OP_H"        , "SZ_X"     ],
+        "Hx"       : [    "OP_H"        , "SZ_X"     ],
+        "Hqq"      : [    "OP_H"        , "SZ_QQ"    ],
+        "W"        : [    "OP_W"        , "SZ_DQ"    ],
+        "Wdq"      : [    "OP_W"        , "SZ_DQ"    ],
+        "Wqq"      : [    "OP_W"        , "SZ_QQ"    ],
+        "Wsd"      : [    "OP_W"        , "SZ_Q"     ],
+        "Wx"       : [    "OP_W"        , "SZ_X"     ],
+        "L"        : [    "OP_L"        , "SZ_O"     ],
+        "Lx"       : [    "OP_L"        , "SZ_X"     ],
+        "MwU"      : [    "OP_MU"       , "SZ_WO"    ],
+        "MdU"      : [    "OP_MU"       , "SZ_DO"    ],
+        "MqU"      : [    "OP_MU"       , "SZ_QO"    ],
+        "N"        : [    "OP_N"        , "SZ_Q"     ],
+        "P"        : [    "OP_P"        , "SZ_Q"     ],
+        "Q"        : [    "OP_Q"        , "SZ_Q"     ],
+        "AL"       : [    "OP_AL"       , "SZ_B"     ],
+        "AX"       : [    "OP_AX"       , "SZ_W"     ],
+        "eAX"      : [    "OP_eAX"      , "SZ_Z"     ],
+        "rAX"      : [    "OP_rAX"      , "SZ_V"     ],
+        "CL"       : [    "OP_CL"       , "SZ_B"     ],
+        "CX"       : [    "OP_CX"       , "SZ_W"     ],
+        "eCX"      : [    "OP_eCX"      , "SZ_Z"     ],
+        "rCX"      : [    "OP_rCX"      , "SZ_V"     ],
+        "DL"       : [    "OP_DL"       , "SZ_B"     ],
+        "DX"       : [    "OP_DX"       , "SZ_W"     ],
+        "eDX"      : [    "OP_eDX"      , "SZ_Z"     ],
+        "rDX"      : [    "OP_rDX"      , "SZ_V"     ],
+        "R0b"      : [    "OP_R0"       , "SZ_B"     ],
+        "R1b"      : [    "OP_R1"       , "SZ_B"     ],
+        "R2b"      : [    "OP_R2"       , "SZ_B"     ],
+        "R3b"      : [    "OP_R3"       , "SZ_B"     ],
+        "R4b"      : [    "OP_R4"       , "SZ_B"     ],
+        "R5b"      : [    "OP_R5"       , "SZ_B"     ],
+        "R6b"      : [    "OP_R6"       , "SZ_B"     ],
+        "R7b"      : [    "OP_R7"       , "SZ_B"     ],
+        "R0w"      : [    "OP_R0"       , "SZ_W"     ],
+        "R1w"      : [    "OP_R1"       , "SZ_W"     ],
+        "R2w"      : [    "OP_R2"       , "SZ_W"     ],
+        "R3w"      : [    "OP_R3"       , "SZ_W"     ],
+        "R4w"      : [    "OP_R4"       , "SZ_W"     ],
+        "R5w"      : [    "OP_R5"       , "SZ_W"     ],
+        "R6w"      : [    "OP_R6"       , "SZ_W"     ],
+        "R7w"      : [    "OP_R7"       , "SZ_W"     ],
+        "R0v"      : [    "OP_R0"       , "SZ_V"     ],
+        "R1v"      : [    "OP_R1"       , "SZ_V"     ],
+        "R2v"      : [    "OP_R2"       , "SZ_V"     ],
+        "R3v"      : [    "OP_R3"       , "SZ_V"     ],
+        "R4v"      : [    "OP_R4"       , "SZ_V"     ],
+        "R5v"      : [    "OP_R5"       , "SZ_V"     ],
+        "R6v"      : [    "OP_R6"       , "SZ_V"     ],
+        "R7v"      : [    "OP_R7"       , "SZ_V"     ],
+        "R0z"      : [    "OP_R0"       , "SZ_Z"     ],
+        "R1z"      : [    "OP_R1"       , "SZ_Z"     ],
+        "R2z"      : [    "OP_R2"       , "SZ_Z"     ],
+        "R3z"      : [    "OP_R3"       , "SZ_Z"     ],
+        "R4z"      : [    "OP_R4"       , "SZ_Z"     ],
+        "R5z"      : [    "OP_R5"       , "SZ_Z"     ],
+        "R6z"      : [    "OP_R6"       , "SZ_Z"     ],
+        "R7z"      : [    "OP_R7"       , "SZ_Z"     ],
+        "R0y"      : [    "OP_R0"       , "SZ_Y"     ],
+        "R1y"      : [    "OP_R1"       , "SZ_Y"     ],
+        "R2y"      : [    "OP_R2"       , "SZ_Y"     ],
+        "R3y"      : [    "OP_R3"       , "SZ_Y"     ],
+        "R4y"      : [    "OP_R4"       , "SZ_Y"     ],
+        "R5y"      : [    "OP_R5"       , "SZ_Y"     ],
+        "R6y"      : [    "OP_R6"       , "SZ_Y"     ],
+        "R7y"      : [    "OP_R7"       , "SZ_Y"     ],
+        "ES"       : [    "OP_ES"       , "SZ_NA"    ],
+        "CS"       : [    "OP_CS"       , "SZ_NA"    ],
+        "DS"       : [    "OP_DS"       , "SZ_NA"    ],
+        "SS"       : [    "OP_SS"       , "SZ_NA"    ],
+        "GS"       : [    "OP_GS"       , "SZ_NA"    ],
+        "FS"       : [    "OP_FS"       , "SZ_NA"    ],
+        "ST0"      : [    "OP_ST0"      , "SZ_NA"    ],
+        "ST1"      : [    "OP_ST1"      , "SZ_NA"    ],
+        "ST2"      : [    "OP_ST2"      , "SZ_NA"    ],
+        "ST3"      : [    "OP_ST3"      , "SZ_NA"    ],
+        "ST4"      : [    "OP_ST4"      , "SZ_NA"    ],
+        "ST5"      : [    "OP_ST5"      , "SZ_NA"    ],
+        "ST6"      : [    "OP_ST6"      , "SZ_NA"    ],
+        "ST7"      : [    "OP_ST7"      , "SZ_NA"    ],
+        "NONE"     : [    "OP_NONE"     , "SZ_NA"    ],
+    }
+
+    #
+    # opcode prefix dictionary
+    # 
+    PrefixDict = { 
+        "rep"      : "P_str",   
+        "repz"     : "P_strz",   
+        "aso"      : "P_aso",   
+        "oso"      : "P_oso",   
+        "rexw"     : "P_rexw", 
+        "rexb"     : "P_rexb",  
+        "rexx"     : "P_rexx",  
+        "rexr"     : "P_rexr",
+        "vexl"     : "P_vexl",
+        "vexw"     : "P_vexw",
+        "seg"      : "P_seg",
+        "inv64"    : "P_inv64", 
+        "def64"    : "P_def64", 
+        "cast"     : "P_cast",
+    }
+
+    MnemonicAliases = ( "invalid", "3dnow", "none", "db", "pause" )
+    
+    def __init__(self, tables):
+        self.tables = tables
+        self._insnIndexMap, i = {}, 0
+        for insn in tables.getInsnList():
+            self._insnIndexMap[insn], i = i, i + 1
+
+        self._tableIndexMap, i = {}, 0
+        for table in tables.getTableList():
+            self._tableIndexMap[table], i = i, i + 1
+
+    def getInsnIndex(self, insn):
+        assert isinstance(insn, UdInsnDef)
+        return self._insnIndexMap[insn]
+
+    def getTableIndex(self, table):
+        assert isinstance(table, UdOpcodeTable)
+        return self._tableIndexMap[table]
+
+    def getTableName(self, table):
+        return "ud_itab__%d" % self.getTableIndex(table)
+
+    def genOpcodeTable(self, table, isGlobal=False):
+        """Emit Opcode Table in C.
+        """
+        self.ItabC.write( "\n" );
+        if not isGlobal:
+            self.ItabC.write('static ')
+        self.ItabC.write( "const uint16_t %s[] = {\n" % self.getTableName(table))
+        for i in range(table.size()):
+            if i > 0 and i % 4 == 0: 
+                self.ItabC.write( "\n" )
+            if i % 4 == 0:
+                self.ItabC.write( "  /* %2x */" % i)
+            e = table.entryAt(i)
+            if e is None:
+                self.ItabC.write("%12s," % "INVALID")
+            elif isinstance(e, UdOpcodeTable):
+                self.ItabC.write("%12s," % ("GROUP(%d)" % self.getTableIndex(e)))
+            elif isinstance(e, UdInsnDef):
+                self.ItabC.write("%12s," % self.getInsnIndex(e))
+        self.ItabC.write( "\n" )
+        self.ItabC.write( "};\n" )
+
+
+    def genOpcodeTables(self):
+        tables = self.tables.getTableList()
+        for table in tables:
+            self.genOpcodeTable(table, table is self.tables.root)
+
+
+    def genOpcodeTablesLookupIndex(self):
+        self.ItabC.write( "\n\n"  );
+        self.ItabC.write( "struct ud_lookup_table_list_entry ud_lookup_table_list[] = {\n" )
+        for table in self.tables.getTableList():
+            f0 = self.getTableName(table) + ","
+            f1 = table.label() + ","
+            f2 = "\"%s\"" % table.meta()
+            self.ItabC.write("    /* %03d */ { %s %s %s },\n" % 
+                             (self.getTableIndex(table), f0, f1, f2))
+        self.ItabC.write( "};" )
+
+
+    def genInsnTable( self ):
+        self.ItabC.write( "struct ud_itab_entry ud_itab[] = {\n" );
+        for insn in self.tables.getInsnList():
+            opr_c = [ "O_NONE", "O_NONE", "O_NONE", "O_NONE" ]
+            pfx_c = []
+            opr   = insn.operands
+            for i in range(len(opr)): 
+                if not (opr[i] in self.OperandDict.keys()):
+                    print("error: invalid operand declaration: %s\n" % opr[i])
+                opr_c[i] = "O_" + opr[i]
+            opr = "%s %s %s %s" % (opr_c[0] + ",", opr_c[1] + ",",
+                                   opr_c[2] + ",", opr_c[3])
+
+            for p in insn.prefixes:
+                if not ( p in self.PrefixDict.keys() ):
+                    print("error: invalid prefix specification: %s \n" % pfx)
+                pfx_c.append( self.PrefixDict[p] )
+            if len(insn.prefixes) == 0:
+                pfx_c.append( "P_none" )
+            pfx = "|".join( pfx_c )
+
+            self.ItabC.write( "  /* %04d */ { UD_I%s %s, %s },\n" \
+                        % ( self.getInsnIndex(insn), insn.mnemonic + ',', opr, pfx ) )
+        self.ItabC.write( "};\n" )
+
+   
+    def getMnemonicsList(self):
+        mnemonics = self.tables.getMnemonicsList()
+        mnemonics.extend(self.MnemonicAliases)
+        return mnemonics
+
+    def genMnemonicsList(self):
+        mnemonics = self.getMnemonicsList()
+        self.ItabC.write( "\n\n"  );
+        self.ItabC.write( "const char* ud_mnemonics_str[] = {\n    " )
+        self.ItabC.write( ",\n    ".join( [ "\"%s\"" % m for m in mnemonics ] ) )
+        self.ItabC.write( "\n};\n" )
+ 
+
+    def genItabH( self, filePath ):
+        self.ItabH = open( filePath, "w" )
+
+        # Generate Table Type Enumeration
+        self.ItabH.write( "#ifndef UD_ITAB_H\n" )
+        self.ItabH.write( "#define UD_ITAB_H\n\n" )
+
+        self.ItabH.write("/* itab.h -- generated by udis86:scripts/ud_itab.py, do no edit */\n\n")
+
+        # table type enumeration
+        self.ItabH.write( "/* ud_table_type -- lookup table types (see decode.c) */\n" )
+        self.ItabH.write( "enum ud_table_type {\n    " )
+        enum = UdOpcodeTable.getLabels()
+        self.ItabH.write( ",\n    ".join( enum ) )
+        self.ItabH.write( "\n};\n\n" );
+
+        # mnemonic enumeration
+        self.ItabH.write( "/* ud_mnemonic -- mnemonic constants */\n" )
+        enum  = "enum ud_mnemonic_code {\n    "
+        enum += ",\n    ".join( [ "UD_I%s" % m for m in self.getMnemonicsList() ] )
+        enum += ",\n    UD_MAX_MNEMONIC_CODE"
+        enum += "\n};\n"
+        self.ItabH.write( enum )
+        self.ItabH.write( "\n" )
+
+        self.ItabH.write( "extern const char * ud_mnemonics_str[];\n" )
+
+        self.ItabH.write( "\n#endif /* UD_ITAB_H */\n" )
+    
+        self.ItabH.close()
+
+
+    def genItabC(self, filePath):
+        self.ItabC = open(filePath, "w")
+        self.ItabC.write("/* itab.c -- generated by udis86:scripts/ud_itab.py, do no edit")
+        self.ItabC.write(" */\n");
+        self.ItabC.write("#include \"udis86_decode.h\"\n\n");
+
+        self.ItabC.write("#define GROUP(n) (0x8000 | (n))\n")
+        self.ItabC.write("#define INVALID  %d\n\n" % self.getInsnIndex(self.tables.invalidInsn))
+
+        self.genOpcodeTables() 
+        self.genOpcodeTablesLookupIndex()
+
+        #
+        # Macros defining short-names for operands
+        #
+        self.ItabC.write("\n\n/* itab entry operand definitions (for readability) */\n");
+        operands = self.OperandDict.keys()
+        operands = sorted(operands)
+        for o in operands:
+            self.ItabC.write("#define O_%-7s { %-12s %-8s }\n" %
+                    (o, self.OperandDict[o][0] + ",", self.OperandDict[o][1]));
+        self.ItabC.write("\n");
+
+        self.genInsnTable()
+        self.genMnemonicsList()
+
+        self.ItabC.close()
+
+    def genItab( self, location ):
+        self.genItabC(os.path.join(location, "udis86_itab.c"))
+        self.genItabH(os.path.join(location, "udis86_itab.h"))
+
+def usage():
+    print("usage: ud_itab.py <optable.xml> <output-path>")
+
+def main():
+
+    if len(sys.argv) != 3:
+        usage()
+        sys.exit(1)
+    
+    tables = UdOpcodeTables(xml=sys.argv[1])
+    itab   = UdItabGenerator(tables)
+    itab.genItab(sys.argv[2])
+
+if __name__ == '__main__':
+    main()
diff --git a/disassembler/udis86/ud_opcode.py b/disassembler/udis86/ud_opcode.py
new file mode 100644
index 0000000..fe1833d
--- /dev/null
+++ b/disassembler/udis86/ud_opcode.py
@@ -0,0 +1,622 @@
+# udis86 - scripts/ud_opcode.py
+# 
+# Copyright (c) 2009, 2013 Vivek Thampi
+# All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without modification, 
+# are permitted provided that the following conditions are met:
+# 
+#     * Redistributions of source code must retain the above copyright notice, 
+#       this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above copyright notice, 
+#       this list of conditions and the following disclaimer in the documentation 
+#       and/or other materials provided with the distribution.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+
+# Some compatibility stuff for supporting python 2.x as well as python 3.x
+def itemslist(dict):
+    try:
+        return dict.iteritems() # python 2.x
+    except AttributeError:
+        return list(dict.items()) # python 3.x
+
+class UdInsnDef:
+    """An x86 instruction definition
+    """
+    def __init__(self, **insnDef):
+        self.mnemonic  = insnDef['mnemonic']
+        self.prefixes  = insnDef['prefixes']
+        self.opcodes   = insnDef['opcodes']
+        self.operands  = insnDef['operands']
+        self._cpuid    = insnDef['cpuid']
+        self._opcexts  = {}
+
+        for opc in self.opcodes:
+            if opc.startswith('/'):
+                e, v = opc.split('=')
+                self._opcexts[e] = v
+
+    def lookupPrefix(self, pfx):
+        """Lookup prefix (if any, None otherwise), by name"""
+        return True if pfx in self.prefixes else None
+
+
+    @property
+    def vendor(self):
+        return self._opcexts.get('/vendor', None)
+
+    @property
+    def mode(self):
+        return self._opcexts.get('/m', None)
+
+    @property
+    def osize(self):
+        return self._opcexts.get('/o', None)
+
+    def isDef64(self):
+        return 'def64' in self.prefixes
+
+    def __str__(self):
+        return self.mnemonic + " " + ', '.join(self.operands) + \
+               " " + ' '.join(self.opcodes)
+
+
+class UdOpcodeTable:
+    """A single table of instruction definitions, indexed by
+       a decode field. 
+    """
+
+    class CollisionError(Exception):
+        pass
+
+    class IndexError(Exception):
+        """Invalid Index Error"""
+        pass
+
+    @classmethod
+    def vendor2idx(cls, v):
+        return (0 if v == 'amd' 
+                  else (1 if v == 'intel'
+                          else 2))
+
+    @classmethod
+    def vex2idx(cls, v):
+        if v.startswith("none_"):
+            v = v[5:]
+        vexOpcExtMap = {
+            'none'      : 0x0, 
+            '0f'        : 0x1, 
+            '0f38'      : 0x2, 
+            '0f3a'      : 0x3,
+            '66'        : 0x4, 
+            '66_0f'     : 0x5, 
+            '66_0f38'   : 0x6, 
+            '66_0f3a'   : 0x7,
+            'f3'        : 0x8, 
+            'f3_0f'     : 0x9, 
+            'f3_0f38'   : 0xa, 
+            'f3_0f3a'   : 0xb,
+            'f2'        : 0xc, 
+            'f2_0f'     : 0xd, 
+            'f2_0f38'   : 0xe, 
+            'f2_0f3a'   : 0xf,
+        }
+        return vexOpcExtMap[v]
+
+
+    # A mapping of opcode extensions to their representational
+    # values used in the opcode map.
+    OpcExtMap = {
+        '/rm'    : lambda v: int(v, 16),
+        '/x87'   : lambda v: int(v, 16),
+        '/3dnow' : lambda v: int(v, 16),
+        '/reg'   : lambda v: int(v, 16),
+        # modrm.mod
+        # (!11, 11)    => (00b, 01b)
+        '/mod'   : lambda v: 0 if v == '!11' else 1,
+        # Mode extensions:
+        # (16, 32, 64) => (00, 01, 02)
+        '/o'     : lambda v: (int(v) / 32),
+        '/a'     : lambda v: (int(v) / 32),
+        # Disassembly mode 
+        # (!64, 64)    => (00b, 01b)
+        '/m'     : lambda v: 1 if v == '64' else 0,
+        # SSE
+        # none => 0
+        # f2   => 1
+        # f3   => 2
+        # 66   => 3
+        '/sse'   : lambda v: (0 if v == 'none'
+                                else (((int(v, 16) & 0xf) + 1) / 2)),
+        # AVX
+        '/vex'   : lambda v: UdOpcodeTable.vex2idx(v),
+        '/vexw'  : lambda v: 0 if v == '0' else 1,
+        '/vexl'  : lambda v: 0 if v == '0' else 1,
+        # Vendor
+        '/vendor': lambda v: UdOpcodeTable.vendor2idx(v)
+    }
+
+
+    _TableInfo = {
+        'opctbl'    : { 'label' : 'UD_TAB__OPC_TABLE',   'size' : 256 },
+        '/sse'      : { 'label' : 'UD_TAB__OPC_SSE',     'size' : 4 },
+        '/reg'      : { 'label' : 'UD_TAB__OPC_REG',     'size' : 8 },
+        '/rm'       : { 'label' : 'UD_TAB__OPC_RM',      'size' : 8 },
+        '/mod'      : { 'label' : 'UD_TAB__OPC_MOD',     'size' : 2 },
+        '/m'        : { 'label' : 'UD_TAB__OPC_MODE',    'size' : 2 },
+        '/x87'      : { 'label' : 'UD_TAB__OPC_X87',     'size' : 64 },
+        '/a'        : { 'label' : 'UD_TAB__OPC_ASIZE',   'size' : 3 },
+        '/o'        : { 'label' : 'UD_TAB__OPC_OSIZE',   'size' : 3 },
+        '/3dnow'    : { 'label' : 'UD_TAB__OPC_3DNOW',   'size' : 256 },
+        '/vendor'   : { 'label' : 'UD_TAB__OPC_VENDOR',  'size' : 3 },
+        '/vex'      : { 'label' : 'UD_TAB__OPC_VEX',     'size' : 16 },
+        '/vexw'     : { 'label' : 'UD_TAB__OPC_VEX_W',   'size' : 2 },
+        '/vexl'     : { 'label' : 'UD_TAB__OPC_VEX_L',   'size' : 2 },
+    }
+
+
+    def __init__(self, typ):
+        assert typ in self._TableInfo
+        self._typ     = typ
+        self._entries = {}
+
+
+    def size(self):
+        return self._TableInfo[self._typ]['size']
+
+    def entries(self):
+        return itemslist(self._entries)
+
+    def numEntries(self):
+        return len(self._entries.keys())
+
+    def label(self):
+        return self._TableInfo[self._typ]['label']
+
+    def typ(self):
+        return self._typ
+
+    def meta(self):
+        return self._typ
+
+
+    def __str__(self):
+        return "table-%s" % self._typ
+
+
+    def add(self, opc, obj):
+        typ = UdOpcodeTable.getOpcodeTyp(opc)
+        idx = UdOpcodeTable.getOpcodeIdx(opc)
+        if self._typ != typ or idx in self._entries:
+            raise CollisionError()
+        self._entries[idx] = obj
+
+
+    def lookup(self, opc):
+        typ = UdOpcodeTable.getOpcodeTyp(opc)
+        idx = UdOpcodeTable.getOpcodeIdx(opc)
+        if self._typ != typ:
+            raise UdOpcodeTable.CollisionError("%s <-> %s" % (self._typ, typ))
+        return self._entries.get(idx, None)
+
+    
+    def entryAt(self, index):
+        """Returns the entry at a given index of the table,
+           None if there is none. Raises an exception if the
+           index is out of bounds.
+        """
+        if index < self.size():
+            return self._entries.get(index, None)
+        raise self.IndexError("index out of bounds: %s" % index)
+
+    def setEntryAt(self, index, obj):
+        if index < self.size():
+            self._entries[index] = obj
+        else:
+            raise self.IndexError("index out of bounds: %s" % index)
+
+    @classmethod
+    def getOpcodeTyp(cls, opc):
+        if opc.startswith('/'):
+            return opc.split('=')[0]
+        else:
+            return 'opctbl'
+
+
+    @classmethod
+    def getOpcodeIdx(cls, opc):
+        if opc.startswith('/'):
+            typ, v = opc.split('=')
+            return cls.OpcExtMap[typ](v)
+        else:
+            # plain opctbl opcode
+            return int(opc, 16)
+
+
+    @classmethod
+    def getLabels(cls):
+        """Returns a list of all labels"""
+        return [cls._TableInfo[k]['label'] for k in cls._TableInfo.keys()]
+
+
+class UdOpcodeTables(object):
+    """Collection of opcode tables
+    """
+
+    class CollisionError(Exception):
+        def __init__(self, obj1, obj2):
+            self.obj1, self.obj2 = obj1, obj2
+
+    def newTable(self, typ):
+        """Create a new opcode table of a give type `typ`. """
+        tbl = UdOpcodeTable(typ)
+        self._tables.append(tbl)
+        return tbl
+
+    def mkTrie(self, opcodes, obj):
+        """Recursively contruct a trie entry mapping a string of
+           opcodes to an object.
+        """
+        if len(opcodes) == 0:
+            return obj
+        opc = opcodes[0]
+        tbl = self.newTable(UdOpcodeTable.getOpcodeTyp(opc))
+        tbl.add(opc, self.mkTrie(opcodes[1:], obj))
+        return tbl
+
+    def walk(self, tbl, opcodes):
+        """Walk down the opcode trie, starting at a given opcode
+           table, given a string of opcodes. Return None if unable
+           to walk, the object at the leaf otherwise.
+        """
+        opc = opcodes[0]
+        e   = tbl.lookup(opc)
+        if e is None:
+            return None
+        elif isinstance(e, UdOpcodeTable) and len(opcodes[1:]):
+            return self.walk(e, opcodes[1:])
+        return e
+
+    def map(self, tbl, opcodes, obj):
+        """Create a mapping from a given string of opcodes to an
+           object in the opcode trie. Constructs trie branches as
+           needed.
+        """
+        opc = opcodes[0]
+        e   =  tbl.lookup(opc)
+        if e is None:
+            tbl.add(opc, self.mkTrie(opcodes[1:], obj))
+        else:
+            if len(opcodes[1:]) == 0:
+                raise self.CollisionError(e, obj)
+            self.map(e, opcodes[1:], obj)
+
+    def __init__(self, xml):
+        self._tables    = []
+        self._insns     = []
+        self._mnemonics = {}
+
+        # The root table is always a 256 entry opctbl, indexed
+        # by a plain opcode byte
+        self.root       = self.newTable('opctbl')
+
+        if os.getenv("UD_OPCODE_DEBUG"):
+            self._logFh     = open("opcodeTables.log", "w")
+
+        # add an invalid instruction entry without any mapping
+        # in the opcode tables.
+        self.invalidInsn = UdInsnDef(mnemonic="invalid", opcodes=[], cpuid=[],
+                                     operands=[], prefixes=[])
+        self._insns.append(self.invalidInsn)
+
+        # Construct UdOpcodeTables object from the given
+        # udis86 optable.xml
+        for insn in self.__class__.parseOptableXML(xml):
+            self.addInsnDef(insn)
+        self.patchAvx2byte()
+        self.mergeSSENONE()
+        self.printStats()
+
+    def log(self, s):
+        if os.getenv("UD_OPCODE_DEBUG"):
+            self._logFh.write(s + "\n")
+
+
+    def mergeSSENONE(self):
+        """Merge sse tables with only one entry for /sse=none
+        """
+        for table in self._tables:
+            for k, e in table.entries():
+                if isinstance(e, UdOpcodeTable) and e.typ() == '/sse':
+                    if e.numEntries() == 1:
+                        sse = e.lookup("/sse=none")
+                        if sse:
+                            table.setEntryAt(k, sse)
+        uniqTables = {}
+        def genTableList(tbl):
+            if tbl not in uniqTables:
+                self._tables.append(tbl)
+            uniqTables[tbl] = 1
+            for k, e in tbl.entries():
+                if isinstance(e, UdOpcodeTable):
+                    genTableList(e)
+        self._tables = []
+        genTableList(self.root)
+                
+
+    def patchAvx2byte(self):
+        # create avx tables
+        for pp in (None, 'f2', 'f3', '66'):
+            for m in (None, '0f', '0f38', '0f3a'):
+                if pp is None and m is None:
+                    continue
+                if pp is None:
+                    vex = m
+                elif m is None:
+                    vex = pp
+                else:
+                    vex = pp + '_' + m
+                table = self.walk(self.root, ('c4', '/vex=' + vex))
+                self.map(self.root, ('c5', '/vex=' + vex), table)
+
+
+    def addInsn(self, **insnDef):
+
+        # Canonicalize opcode list
+        opcexts = insnDef['opcexts']
+        opcodes = list(insnDef['opcodes'])
+
+        # Re-order vex
+        if '/vex' in opcexts:
+            assert opcodes[0] == 'c4' or opcodes[0] == 'c5'
+            opcodes.insert(1, '/vex=' + opcexts['/vex'])
+
+        # Add extensions. The order is important, and determines how
+        # well the opcode table is packed. Also note, /sse must be
+        # before /o, because /sse may consume operand size prefix
+        # affect the outcome of /o.
+        for ext in ('/mod', '/x87', '/reg', '/rm', '/sse', '/o', '/a', '/m',
+                    '/vexw', '/vexl', '/3dnow', '/vendor'):
+            if ext in opcexts:
+                opcodes.append(ext + '=' + opcexts[ext])
+
+        insn = UdInsnDef(mnemonic = insnDef['mnemonic'],
+                         prefixes = insnDef['prefixes'],
+                         operands = insnDef['operands'],
+                         opcodes  = opcodes,
+                         cpuid    = insnDef['cpuid'])
+        try:
+            self.map(self.root, opcodes, insn)
+        except self.CollisionError as e:
+            self.pprint()
+            print(opcodes, insn, str(e.obj1), str(e.obj2))
+            raise
+        except Exception as e:
+            self.pprint()
+            raise
+        self._insns.append(insn)
+        # add to lookup by mnemonic structure
+        if insn.mnemonic not in self._mnemonics:
+            self._mnemonics[insn.mnemonic] = [ insn ]
+        else:
+            self._mnemonics[insn.mnemonic].append(insn)
+
+
+    def addInsnDef(self, insnDef):
+        opcodes  = []
+        opcexts  = {}
+
+        # pack plain opcodes first, and collect opcode
+        # extensions
+        for opc in insnDef['opcodes']:
+            if not opc.startswith('/'):
+                opcodes.append(opc)
+            else:
+                e, v = opc.split('=')
+                opcexts[e] = v
+
+        # treat vendor as an opcode extension
+        if len(insnDef['vendor']):
+            opcexts['/vendor'] = insnDef['vendor'][0]
+
+        if insnDef['mnemonic'] in ('lds', 'les'):
+            #
+            # Massage lds and les, which share the same prefix as AVX
+            # instructions, to work well with the opcode tree.
+            #
+            opcexts['/vex'] = 'none'
+        elif '/vex' in opcexts:
+            # A proper avx instruction definition; make sure there are
+            # no legacy opcode extensions
+            assert '/sse' not in opcodes
+
+            # make sure the opcode definitions don't already include
+            # the avx prefixes.
+            assert opcodes[0] not in ('c4', 'c5')
+
+            # An avx only instruction is defined by the /vex= opcode
+            # extension. They do not include the c4 (long form) or
+            # c5 (short form) prefix. As part of opcode table generate,
+            # here we create the long form definition, and then patch
+            # the table for c5 in a later stage.
+            # Construct a long-form definition of the avx instruction
+            opcodes.insert(0, 'c4')
+        elif (opcodes[0] == '0f' and opcodes[1] != '0f' and
+            '/sse' not in opcexts):
+            # Make all 2-byte opcode form isntructions play nice with sse
+            # opcode maps.
+            opcexts['/sse'] = 'none'
+
+        # legacy sse defs that get promoted to avx
+        fn = self.addInsn
+        if 'avx' in insnDef['cpuid'] and '/sse' in opcexts:
+            fn = self.addSSE2AVXInsn
+
+        fn(mnemonic = insnDef['mnemonic'],
+           prefixes = insnDef['prefixes'],
+           opcodes  = opcodes,
+           opcexts  = opcexts,
+           operands = insnDef['operands'],
+           cpuid    = insnDef['cpuid'])
+
+
+    def addSSE2AVXInsn(self, **insnDef):
+        """Add an instruction definition containing an avx cpuid bit, but
+           declared in its legacy SSE form. The function splits the
+           definition to create two new definitions, one for SSE and one
+           promoted to an AVX form.
+        """
+
+        # SSE
+        ssemnemonic = insnDef['mnemonic']
+        sseopcodes  = insnDef['opcodes']
+        # remove vex opcode extensions
+        sseopcexts  = dict([(e, v) for e, v in itemslist(insnDef['opcexts'])
+                                  if not e.startswith('/vex')])
+        # strip out avx operands, preserving relative ordering
+        # of remaining operands
+        sseoperands = [opr for opr in insnDef['operands']
+                        if opr not in ('H', 'L')]
+        # strip out avx prefixes
+        sseprefixes = [pfx for pfx in insnDef['prefixes']
+                        if not pfx.startswith('vex')]
+        # strip out avx bits from cpuid
+        ssecpuid    = [flag for flag in insnDef['cpuid']
+                        if not flag.startswith('avx')]
+
+        self.addInsn(mnemonic = ssemnemonic,
+                     prefixes = sseprefixes,
+                     opcodes  = sseopcodes,
+                     opcexts  = sseopcexts,
+                     operands = sseoperands,
+                     cpuid    = ssecpuid)
+
+        # AVX
+        vexmnemonic = 'v' + insnDef['mnemonic']
+        vexprefixes = insnDef['prefixes']
+        vexopcodes  = ['c4']
+        vexopcexts  = dict([(e, insnDef['opcexts'][e])
+                              for e in insnDef['opcexts'] if e != '/sse'])
+        vexopcexts['/vex'] = insnDef['opcexts']['/sse'] + '_' + '0f'
+        if insnDef['opcodes'][1] == '38' or insnDef['opcodes'][1] == '3a':
+            vexopcexts['/vex'] += insnDef['opcodes'][1]
+            vexopcodes.extend(insnDef['opcodes'][2:])
+        else:
+            vexopcodes.extend(insnDef['opcodes'][1:])
+        vexoperands = []
+        for o in insnDef['operands']:
+            # make the operand size explicit: x
+            if o in ('V', 'W', 'H', 'U'):
+                o = o + 'x'
+            vexoperands.append(o)
+        vexcpuid    = [flag for flag in insnDef['cpuid']
+                        if not flag.startswith('sse')]
+
+        self.addInsn(mnemonic = vexmnemonic,
+                     prefixes = vexprefixes,
+                     opcodes  = vexopcodes,
+                     opcexts  = vexopcexts,
+                     operands = vexoperands,
+                     cpuid    = vexcpuid)
+
+    def getInsnList(self):
+        """Returns a list of all instructions in the collection"""
+        return self._insns
+
+
+    def getTableList(self):
+        """Returns a list of all tables in the collection"""
+        return self._tables
+
+    def getMnemonicsList(self):
+        """Returns a sorted list of mnemonics"""
+        return sorted(self._mnemonics.keys())
+
+
+    def pprint(self):
+        def printWalk(tbl, indent=""):
+            entries = tbl.entries()
+            for k, e in entries:
+                if isinstance(e, UdOpcodeTable):
+                    self.log("%s    |-<%02x> %s" % (indent, k, e))
+                    printWalk(e, indent + "    |")
+                elif isinstance(e, UdInsnDef):
+                    self.log("%s    |-<%02x> %s" % (indent, k, e))
+        printWalk(self.root)
+
+
+    def printStats(self):
+        tables = self.getTableList()
+        self.log("stats: ")
+        self.log("  Num tables    = %d" % len(tables))
+        self.log("  Num insnDefs  = %d" % len(self.getInsnList()))
+        self.log("  Num insns     = %d" % len(self.getMnemonicsList()))
+
+        totalSize = 0
+        totalEntries = 0
+        for table in tables:
+            totalSize += table.size()
+            totalEntries += table.numEntries()
+        self.log("  Packing Ratio = %d%%" % ((totalEntries * 100) / totalSize))
+        self.log("--------------------")
+
+        self.pprint()
+
+
+    @staticmethod
+    def parseOptableXML(xml):
+        """Parse udis86 optable.xml file and return list of
+           instruction definitions.
+        """
+        from xml.dom import minidom
+
+        xmlDoc = minidom.parse(xml)
+        tlNode = xmlDoc.firstChild
+        insns  = []
+
+        while tlNode and tlNode.localName != "x86optable": 
+            tlNode = tlNode.nextSibling
+
+        for insnNode in tlNode.childNodes:
+            if not insnNode.localName:
+                continue
+            if insnNode.localName != "instruction":
+                raise Exception("warning: invalid insn node - %s" % insnNode.localName)
+            mnemonic = insnNode.getElementsByTagName('mnemonic')[0].firstChild.data
+            vendor, cpuid = '', []
+
+            for node in insnNode.childNodes:
+                if node.localName == 'vendor':
+                    vendor = node.firstChild.data.split()
+                elif node.localName == 'cpuid':
+                    cpuid = node.firstChild.data.split()
+
+            for node in insnNode.childNodes:
+                if node.localName == 'def':
+                    insnDef = { 'pfx' : [] }
+                    for node in node.childNodes:
+                        if not node.localName:
+                            continue
+                        if node.localName in ('pfx', 'opc', 'opr', 'vendor', 'cpuid'):
+                            insnDef[node.localName] = node.firstChild.data.split()
+                        elif node.localName == 'mode':
+                            insnDef['pfx'].extend(node.firstChild.data.split())
+                    insns.append({'prefixes' : insnDef.get('pfx', []),
+                                  'mnemonic' : mnemonic,
+                                  'opcodes'  : insnDef.get('opc', []),
+                                  'operands' : insnDef.get('opr', []),
+                                  'vendor'   : insnDef.get('vendor', vendor),
+                                  'cpuid'    : insnDef.get('cpuid', cpuid)})
+        return insns
diff --git a/disassembler/udis86/udis86.c b/disassembler/udis86/udis86.c
new file mode 100644
index 0000000..56ab1a7
--- /dev/null
+++ b/disassembler/udis86/udis86.c
@@ -0,0 +1,462 @@
+/* udis86 - libudis86/udis86.c
+ *
+ * Copyright (c) 2002-2013 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(UDIS86)
+
+#include "udis86_udint.h"
+#include "udis86_extern.h"
+#include "udis86_decode.h"
+
+#if !defined(__UD_STANDALONE__)
+#include <string.h>
+#endif /* !__UD_STANDALONE__ */
+
+static void ud_inp_init(struct ud *u);
+
+/* =============================================================================
+ * ud_init
+ *    Initializes ud_t object.
+ * =============================================================================
+ */
+extern void 
+ud_init(struct ud* u)
+{
+  memset((void*)u, 0, sizeof(struct ud));
+  ud_set_mode(u, 16);
+  u->mnemonic = UD_Iinvalid;
+  ud_set_pc(u, 0);
+#ifndef __UD_STANDALONE__
+  ud_set_input_file(u, stdin);
+#endif /* __UD_STANDALONE__ */
+
+  ud_set_asm_buffer(u, u->asm_buf_int, sizeof(u->asm_buf_int));
+}
+
+
+/* =============================================================================
+ * ud_disassemble
+ *    Disassembles one instruction and returns the number of 
+ *    bytes disassembled. A zero means end of disassembly.
+ * =============================================================================
+ */
+extern unsigned int
+ud_disassemble(struct ud* u)
+{
+  int len;
+  if (u->inp_end) {
+    return 0;
+  }
+  if ((len = ud_decode(u)) > 0) {
+    if (u->translator != NULL) {
+      u->asm_buf[0] = '\0';
+      u->translator(u);
+    }
+  }
+  return len;
+}
+
+
+/* =============================================================================
+ * ud_set_mode() - Set Disassemly Mode.
+ * =============================================================================
+ */
+extern void 
+ud_set_mode(struct ud* u, uint8_t m)
+{
+  switch(m) {
+  case 16:
+  case 32:
+  case 64: u->dis_mode = m ; return;
+  default: u->dis_mode = 16; return;
+  }
+}
+
+/* =============================================================================
+ * ud_set_vendor() - Set vendor.
+ * =============================================================================
+ */
+extern void 
+ud_set_vendor(struct ud* u, unsigned v)
+{
+  switch(v) {
+  case UD_VENDOR_INTEL:
+    u->vendor = v;
+    break;
+  case UD_VENDOR_ANY:
+    u->vendor = v;
+    break;
+  default:
+    u->vendor = UD_VENDOR_AMD;
+  }
+}
+
+/* =============================================================================
+ * ud_set_pc() - Sets code origin. 
+ * =============================================================================
+ */
+extern void 
+ud_set_pc(struct ud* u, uint64_t o)
+{
+  u->pc = o;
+}
+
+/* =============================================================================
+ * ud_set_syntax() - Sets the output syntax.
+ * =============================================================================
+ */
+extern void 
+ud_set_syntax(struct ud* u, void (*t)(struct ud*))
+{
+  u->translator = t;
+}
+
+/* =============================================================================
+ * ud_insn() - returns the disassembled instruction
+ * =============================================================================
+ */
+const char* 
+ud_insn_asm(const struct ud* u) 
+{
+  return u->asm_buf;
+}
+
+/* =============================================================================
+ * ud_insn_offset() - Returns the offset.
+ * =============================================================================
+ */
+uint64_t
+ud_insn_off(const struct ud* u) 
+{
+  return u->insn_offset;
+}
+
+
+/* =============================================================================
+ * ud_insn_hex() - Returns hex form of disassembled instruction.
+ * =============================================================================
+ */
+const char* 
+ud_insn_hex(struct ud* u) 
+{
+  u->insn_hexcode[0] = 0;
+  if (!u->error) {
+    unsigned int i;
+    const unsigned char *src_ptr = ud_insn_ptr(u);
+    char* src_hex;
+    src_hex = (char*) u->insn_hexcode;
+    /* for each byte used to decode instruction */
+    for (i = 0; i < ud_insn_len(u) && i < sizeof(u->insn_hexcode) / 2;
+         ++i, ++src_ptr) {
+      sprintf(src_hex, "%02x", *src_ptr & 0xFF);
+      src_hex += 2;
+    }
+  }
+  return u->insn_hexcode;
+}
+
+
+/* =============================================================================
+ * ud_insn_ptr
+ *    Returns a pointer to buffer containing the bytes that were
+ *    disassembled.
+ * =============================================================================
+ */
+extern const uint8_t* 
+ud_insn_ptr(const struct ud* u) 
+{
+  return (u->inp_buf == NULL) ? 
+            u->inp_sess : u->inp_buf + (u->inp_buf_index - u->inp_ctr);
+}
+
+
+/* =============================================================================
+ * ud_insn_len
+ *    Returns the count of bytes disassembled.
+ * =============================================================================
+ */
+extern unsigned int 
+ud_insn_len(const struct ud* u) 
+{
+  return u->inp_ctr;
+}
+
+
+/* =============================================================================
+ * ud_insn_get_opr
+ *    Return the operand struct representing the nth operand of
+ *    the currently disassembled instruction. Returns NULL if
+ *    there's no such operand.
+ * =============================================================================
+ */
+const struct ud_operand*
+ud_insn_opr(const struct ud *u, unsigned int n)
+{
+  if (n > 3 || u->operand[n].type == UD_NONE) {
+    return NULL; 
+  } else {
+    return &u->operand[n];
+  }
+}
+
+
+/* =============================================================================
+ * ud_opr_is_sreg
+ *    Returns non-zero if the given operand is of a segment register type.
+ * =============================================================================
+ */
+int
+ud_opr_is_sreg(const struct ud_operand *opr)
+{
+  return opr->type == UD_OP_REG && 
+         opr->base >= UD_R_ES   &&
+         opr->base <= UD_R_GS;
+}
+
+
+/* =============================================================================
+ * ud_opr_is_sreg
+ *    Returns non-zero if the given operand is of a general purpose
+ *    register type.
+ * =============================================================================
+ */
+int
+ud_opr_is_gpr(const struct ud_operand *opr)
+{
+  return opr->type == UD_OP_REG && 
+         opr->base >= UD_R_AL   &&
+         opr->base <= UD_R_R15;
+}
+
+
+/* =============================================================================
+ * ud_set_user_opaque_data
+ * ud_get_user_opaque_data
+ *    Get/set user opaqute data pointer
+ * =============================================================================
+ */
+void
+ud_set_user_opaque_data(struct ud * u, void* opaque)
+{
+  u->user_opaque_data = opaque;
+}
+
+void*
+ud_get_user_opaque_data(const struct ud *u)
+{
+  return u->user_opaque_data;
+}
+
+
+/* =============================================================================
+ * ud_set_asm_buffer
+ *    Allow the user to set an assembler output buffer. If `buf` is NULL,
+ *    we switch back to the internal buffer.
+ * =============================================================================
+ */
+void
+ud_set_asm_buffer(struct ud *u, char *buf, size_t size)
+{
+  if (buf == NULL) {
+    ud_set_asm_buffer(u, u->asm_buf_int, sizeof(u->asm_buf_int));
+  } else {
+    u->asm_buf = buf;
+    u->asm_buf_size = size;
+  }
+}
+
+
+/* =============================================================================
+ * ud_set_sym_resolver
+ *    Set symbol resolver for relative targets used in the translation
+ *    phase.
+ *
+ *    The resolver is a function that takes a uint64_t address and returns a
+ *    symbolic name for the that address. The function also takes a second
+ *    argument pointing to an integer that the client can optionally set to a
+ *    non-zero value for offsetted targets. (symbol+offset) The function may
+ *    also return NULL, in which case the translator only prints the target
+ *    address.
+ *
+ *    The function pointer maybe NULL which resets symbol resolution.
+ * =============================================================================
+ */
+void
+ud_set_sym_resolver(struct ud *u, const char* (*resolver)(struct ud*, 
+                                                          uint64_t addr,
+                                                          int64_t *offset))
+{
+  u->sym_resolver = resolver;
+}
+
+
+/* =============================================================================
+ * ud_insn_mnemonic
+ *    Return the current instruction mnemonic.
+ * =============================================================================
+ */
+enum ud_mnemonic_code
+ud_insn_mnemonic(const struct ud *u)
+{
+  return u->mnemonic;
+}
+
+
+/* =============================================================================
+ * ud_lookup_mnemonic
+ *    Looks up mnemonic code in the mnemonic string table.
+ *    Returns NULL if the mnemonic code is invalid.
+ * =============================================================================
+ */
+const char*
+ud_lookup_mnemonic(enum ud_mnemonic_code c)
+{
+  if (c < UD_MAX_MNEMONIC_CODE) {
+    return ud_mnemonics_str[c];
+  } else {
+    return NULL;
+  }
+}
+
+
+/* 
+ * ud_inp_init
+ *    Initializes the input system.
+ */
+static void
+ud_inp_init(struct ud *u)
+{
+  u->inp_hook      = NULL;
+  u->inp_buf       = NULL;
+  u->inp_buf_size  = 0;
+  u->inp_buf_index = 0;
+  u->inp_curr      = 0;
+  u->inp_ctr       = 0;
+  u->inp_end       = 0;
+  u->inp_peek      = UD_EOI;
+  UD_NON_STANDALONE(u->inp_file = NULL);
+}
+
+
+/* =============================================================================
+ * ud_inp_set_hook
+ *    Sets input hook.
+ * =============================================================================
+ */
+void 
+ud_set_input_hook(register struct ud* u, int (*hook)(struct ud*))
+{
+  ud_inp_init(u);
+  u->inp_hook = hook;
+}
+
+/* =============================================================================
+ * ud_inp_set_buffer
+ *    Set buffer as input.
+ * =============================================================================
+ */
+void 
+ud_set_input_buffer(register struct ud* u, const uint8_t* buf, size_t len)
+{
+  ud_inp_init(u);
+  u->inp_buf = buf;
+  u->inp_buf_size = len;
+  u->inp_buf_index = 0;
+}
+
+
+#ifndef __UD_STANDALONE__
+/* =============================================================================
+ * ud_input_set_file
+ *    Set FILE as input.
+ * =============================================================================
+ */
+static int 
+inp_file_hook(struct ud* u)
+{
+  return fgetc(u->inp_file);
+}
+
+void 
+ud_set_input_file(register struct ud* u, FILE* f)
+{
+  ud_inp_init(u);
+  u->inp_hook = inp_file_hook;
+  u->inp_file = f;
+}
+#endif /* __UD_STANDALONE__ */
+
+
+/* =============================================================================
+ * ud_input_skip
+ *    Skip n input bytes.
+ * ============================================================================
+ */
+void 
+ud_input_skip(struct ud* u, size_t n)
+{
+  if (u->inp_end) {
+    return;
+  }
+  if (u->inp_buf == NULL) {
+    while (n--) {
+      int c = u->inp_hook(u);
+      if (c == UD_EOI) {
+        goto eoi;
+      }
+    }
+    return;
+  } else {
+    if (n > u->inp_buf_size ||
+        u->inp_buf_index > u->inp_buf_size - n) {
+      u->inp_buf_index = u->inp_buf_size; 
+      goto eoi;
+    }
+    u->inp_buf_index += n; 
+    return;
+  }
+eoi:
+  u->inp_end = 1;
+  UDERR(u, "cannot skip, eoi received\b");
+  return;
+}
+
+
+/* =============================================================================
+ * ud_input_end
+ *    Returns non-zero on end-of-input.
+ * =============================================================================
+ */
+int
+ud_input_end(const struct ud *u)
+{
+  return u->inp_end;
+}
+
+#endif // USE(UDIS86)
+
+/* vim:set ts=2 sw=2 expandtab */
diff --git a/disassembler/udis86/udis86.h b/disassembler/udis86/udis86.h
new file mode 100644
index 0000000..baaf495
--- /dev/null
+++ b/disassembler/udis86/udis86.h
@@ -0,0 +1,33 @@
+/* udis86 - udis86.h
+ *
+ * Copyright (c) 2002-2009 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef UDIS86_H
+#define UDIS86_H
+
+#include "udis86_types.h"
+#include "udis86_extern.h"
+#include "udis86_itab.h"
+
+#endif
diff --git a/disassembler/udis86/udis86_decode.c b/disassembler/udis86/udis86_decode.c
new file mode 100644
index 0000000..c0ea283
--- /dev/null
+++ b/disassembler/udis86/udis86_decode.c
@@ -0,0 +1,1273 @@
+/* udis86 - libudis86/decode.c
+ * 
+ * Copyright (c) 2002-2009 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(UDIS86)
+
+#include "udis86_udint.h"
+#include "udis86_types.h"
+#include "udis86_extern.h"
+#include "udis86_decode.h"
+
+#ifndef __UD_STANDALONE__
+# include <string.h>
+#endif /* __UD_STANDALONE__ */
+
+/* The max number of prefixes to an instruction */
+#define MAX_PREFIXES    15
+
+/* rex prefix bits */
+#define REX_W(r)        ( ( 0xF & ( r ) )  >> 3 )
+#define REX_R(r)        ( ( 0x7 & ( r ) )  >> 2 )
+#define REX_X(r)        ( ( 0x3 & ( r ) )  >> 1 )
+#define REX_B(r)        ( ( 0x1 & ( r ) )  >> 0 )
+#define REX_PFX_MASK(n) ( ( P_REXW(n) << 3 ) | \
+                          ( P_REXR(n) << 2 ) | \
+                          ( P_REXX(n) << 1 ) | \
+                          ( P_REXB(n) << 0 ) )
+
+/* scable-index-base bits */
+#define SIB_S(b)        ( ( b ) >> 6 )
+#define SIB_I(b)        ( ( ( b ) >> 3 ) & 7 )
+#define SIB_B(b)        ( ( b ) & 7 )
+
+/* modrm bits */
+#define MODRM_REG(b)    ( ( ( b ) >> 3 ) & 7 )
+#define MODRM_NNN(b)    ( ( ( b ) >> 3 ) & 7 )
+#define MODRM_MOD(b)    ( ( ( b ) >> 6 ) & 3 )
+#define MODRM_RM(b)     ( ( b ) & 7 )
+
+static int decode_ext(struct ud *u, uint16_t ptr);
+static int decode_opcode(struct ud *u);
+
+enum reg_class { /* register classes */
+  REGCLASS_GPR,
+  REGCLASS_MMX,
+  REGCLASS_CR,
+  REGCLASS_DB,
+  REGCLASS_SEG,
+  REGCLASS_XMM
+};
+
+ /* 
+ * inp_start
+ *    Should be called before each de-code operation.
+ */
+static void
+inp_start(struct ud *u)
+{
+  u->inp_ctr = 0;
+}
+
+static uint8_t
+inp_peek(struct ud *u)
+{
+  if (u->inp_end == 0) {
+    if (u->inp_buf != NULL) {
+      if (u->inp_buf_index < u->inp_buf_size) {
+        return u->inp_buf[u->inp_buf_index];
+      }
+    } else if (u->inp_peek != UD_EOI) {
+      return u->inp_peek;
+    } else {
+      int c;
+      if ((c = u->inp_hook(u)) != UD_EOI) {
+        u->inp_peek = c;
+        return u->inp_peek;
+      }
+    }
+  }
+  u->inp_end = 1;
+  UDERR(u, "byte expected, eoi received\n");
+  return 0;
+}
+   
+static uint8_t
+inp_next(struct ud *u)
+{
+  if (u->inp_end == 0) {
+    if (u->inp_buf != NULL) {
+      if (u->inp_buf_index < u->inp_buf_size) {
+        u->inp_ctr++;
+        return (u->inp_curr = u->inp_buf[u->inp_buf_index++]);
+      }
+    } else {
+      int c = u->inp_peek;
+      if (c != UD_EOI || (c = u->inp_hook(u)) != UD_EOI) {
+        u->inp_peek = UD_EOI;
+        u->inp_curr = c;
+        u->inp_sess[u->inp_ctr++] = u->inp_curr;
+        return u->inp_curr;
+      }
+    }
+  }
+  u->inp_end = 1;
+  UDERR(u, "byte expected, eoi received\n");
+  return 0;
+}
+
+static uint8_t
+inp_curr(struct ud *u)
+{
+  return u->inp_curr;
+}
+
+
+/*
+ * inp_uint8
+ * int_uint16
+ * int_uint32
+ * int_uint64
+ *    Load little-endian values from input
+ */
+static uint8_t 
+inp_uint8(struct ud* u)
+{
+  return inp_next(u);
+}
+
+static uint16_t 
+inp_uint16(struct ud* u)
+{
+  uint16_t r, ret;
+
+  ret = inp_next(u);
+  r = inp_next(u);
+  return ret | (r << 8);
+}
+
+static uint32_t 
+inp_uint32(struct ud* u)
+{
+  uint32_t r, ret;
+
+  ret = inp_next(u);
+  r = inp_next(u);
+  ret = ret | (r << 8);
+  r = inp_next(u);
+  ret = ret | (r << 16);
+  r = inp_next(u);
+  return ret | (r << 24);
+}
+
+static uint64_t 
+inp_uint64(struct ud* u)
+{
+  uint64_t r, ret;
+
+  ret = inp_next(u);
+  r = inp_next(u);
+  ret = ret | (r << 8);
+  r = inp_next(u);
+  ret = ret | (r << 16);
+  r = inp_next(u);
+  ret = ret | (r << 24);
+  r = inp_next(u);
+  ret = ret | (r << 32);
+  r = inp_next(u);
+  ret = ret | (r << 40);
+  r = inp_next(u);
+  ret = ret | (r << 48);
+  r = inp_next(u);
+  return ret | (r << 56);
+}
+
+
+static UD_INLINE int
+eff_opr_mode(int dis_mode, int rex_w, int pfx_opr)
+{
+  if (dis_mode == 64) {
+    return rex_w ? 64 : (pfx_opr ? 16 : 32);
+  } else if (dis_mode == 32) {
+    return pfx_opr ? 16 : 32;
+  } else {
+    UD_ASSERT(dis_mode == 16);
+    return pfx_opr ? 32 : 16;
+  }
+}
+
+
+static UD_INLINE int
+eff_adr_mode(int dis_mode, int pfx_adr)
+{
+  if (dis_mode == 64) {
+    return pfx_adr ? 32 : 64;
+  } else if (dis_mode == 32) {
+    return pfx_adr ? 16 : 32;
+  } else {
+    UD_ASSERT(dis_mode == 16);
+    return pfx_adr ? 32 : 16;
+  }
+}
+
+
+/* 
+ * decode_prefixes
+ *
+ *  Extracts instruction prefixes.
+ */
+static int 
+decode_prefixes(struct ud *u)
+{
+  int done = 0;
+  uint8_t curr = 0, last = 0;
+  UD_RETURN_ON_ERROR(u);
+
+  do {
+    last = curr;
+    curr = inp_next(u); 
+    UD_RETURN_ON_ERROR(u);
+    if (u->inp_ctr == MAX_INSN_LENGTH) {
+      UD_RETURN_WITH_ERROR(u, "max instruction length");
+    }
+   
+    switch (curr)  
+    {
+    case 0x2E: 
+      u->pfx_seg = UD_R_CS; 
+      break;
+    case 0x36:     
+      u->pfx_seg = UD_R_SS; 
+      break;
+    case 0x3E: 
+      u->pfx_seg = UD_R_DS; 
+      break;
+    case 0x26: 
+      u->pfx_seg = UD_R_ES; 
+      break;
+    case 0x64: 
+      u->pfx_seg = UD_R_FS; 
+      break;
+    case 0x65: 
+      u->pfx_seg = UD_R_GS; 
+      break;
+    case 0x67: /* adress-size override prefix */ 
+      u->pfx_adr = 0x67;
+      break;
+    case 0xF0: 
+      u->pfx_lock = 0xF0;
+      break;
+    case 0x66: 
+      u->pfx_opr = 0x66;
+      break;
+    case 0xF2:
+      u->pfx_str = 0xf2;
+      break;
+    case 0xF3:
+      u->pfx_str = 0xf3;
+      break;
+    default:
+      /* consume if rex */
+      done = (u->dis_mode == 64 && (curr & 0xF0) == 0x40) ? 0 : 1;
+      break;
+    }
+  } while (!done);
+  /* rex prefixes in 64bit mode, must be the last prefix */
+  if (u->dis_mode == 64 && (last & 0xF0) == 0x40) {
+    u->pfx_rex = last;  
+  }
+  return 0;
+}
+
+
+/*
+ * vex_l, vex_w
+ *  Return the vex.L and vex.W bits
+ */
+static UD_INLINE uint8_t
+vex_l(const struct ud *u)
+{
+  UD_ASSERT(u->vex_op != 0);
+  return ((u->vex_op == 0xc4 ? u->vex_b2 : u->vex_b1) >> 2) & 1;
+}
+
+static UD_INLINE uint8_t
+vex_w(const struct ud *u)
+{
+  UD_ASSERT(u->vex_op != 0);
+  return u->vex_op == 0xc4 ? ((u->vex_b2 >> 7) & 1) : 0;
+}
+
+
+static UD_INLINE uint8_t
+modrm(struct ud * u)
+{
+    if ( !u->have_modrm ) {
+        u->modrm = inp_next( u );
+        u->modrm_offset = (uint8_t) (u->inp_ctr - 1);
+        u->have_modrm = 1;
+    }
+    return u->modrm;
+}
+
+
+static unsigned int
+resolve_operand_size(const struct ud* u, ud_operand_size_t osize)
+{
+  switch (osize) {
+  case SZ_V:
+    return u->opr_mode;
+  case SZ_Z:  
+    return u->opr_mode == 16 ? 16 : 32;
+  case SZ_Y:
+    return u->opr_mode == 16 ? 32 : u->opr_mode;
+  case SZ_RDQ:
+    return u->dis_mode == 64 ? 64 : 32;
+  case SZ_X:
+    UD_ASSERT(u->vex_op != 0);
+    return (P_VEXL(u->itab_entry->prefix) && vex_l(u)) ?  SZ_QQ : SZ_DQ;
+  default:
+    return osize;
+  }
+}
+
+
+static int resolve_mnemonic( struct ud* u )
+{
+  /* resolve 3dnow weirdness. */
+  if ( u->mnemonic == UD_I3dnow ) {
+    u->mnemonic = ud_itab[ u->le->table[ inp_curr( u )  ] ].mnemonic;
+  }
+  /* SWAPGS is only valid in 64bits mode */
+  if ( u->mnemonic == UD_Iswapgs && u->dis_mode != 64 ) {
+    UDERR(u, "swapgs invalid in 64bits mode\n");
+    return -1;
+  }
+
+  if (u->mnemonic == UD_Ixchg) {
+    if ((u->operand[0].type == UD_OP_REG && u->operand[0].base == UD_R_AX  &&
+         u->operand[1].type == UD_OP_REG && u->operand[1].base == UD_R_AX) ||
+        (u->operand[0].type == UD_OP_REG && u->operand[0].base == UD_R_EAX &&
+         u->operand[1].type == UD_OP_REG && u->operand[1].base == UD_R_EAX)) {
+      u->operand[0].type = UD_NONE;
+      u->operand[1].type = UD_NONE;
+      u->mnemonic = UD_Inop;
+    }
+  }
+
+  if (u->mnemonic == UD_Inop && u->pfx_repe) {
+    u->pfx_repe = 0;
+    u->mnemonic = UD_Ipause;
+  }
+  return 0;
+}
+
+
+/* -----------------------------------------------------------------------------
+ * decode_a()- Decodes operands of the type seg:offset
+ * -----------------------------------------------------------------------------
+ */
+static void 
+decode_a(struct ud* u, struct ud_operand *op)
+{
+  if (u->opr_mode == 16) {  
+    /* seg16:off16 */
+    op->type = UD_OP_PTR;
+    op->size = 32;
+    op->lval.ptr.off = inp_uint16(u);
+    op->lval.ptr.seg = inp_uint16(u);
+  } else {
+    /* seg16:off32 */
+    op->type = UD_OP_PTR;
+    op->size = 48;
+    op->lval.ptr.off = inp_uint32(u);
+    op->lval.ptr.seg = inp_uint16(u);
+  }
+}
+
+/* -----------------------------------------------------------------------------
+ * decode_gpr() - Returns decoded General Purpose Register 
+ * -----------------------------------------------------------------------------
+ */
+static enum ud_type 
+decode_gpr(register struct ud* u, unsigned int s, unsigned char rm)
+{
+  switch (s) {
+    case 64:
+        return UD_R_RAX + rm;
+    case 32:
+        return UD_R_EAX + rm;
+    case 16:
+        return UD_R_AX  + rm;
+    case  8:
+        if (u->dis_mode == 64 && u->pfx_rex) {
+            if (rm >= 4)
+                return UD_R_SPL + (rm-4);
+            return UD_R_AL + rm;
+        } else return UD_R_AL + rm;
+    case 0:
+        /* invalid size in case of a decode error */
+        UD_ASSERT(u->error);
+        return UD_NONE;
+    default:
+        UD_ASSERT(!"invalid operand size");
+        return UD_NONE;
+  }
+}
+
+static void
+decode_reg(struct ud *u, 
+           struct ud_operand *opr,
+           int type,
+           int num,
+           int size)
+{
+  int reg;
+  size = resolve_operand_size(u, size);
+  switch (type) {
+    case REGCLASS_GPR : reg = decode_gpr(u, size, num); break;
+    case REGCLASS_MMX : reg = UD_R_MM0  + (num & 7); break;
+    case REGCLASS_XMM :
+      reg = num + (size == SZ_QQ ? UD_R_YMM0 : UD_R_XMM0);
+      break;
+    case REGCLASS_CR : reg = UD_R_CR0  + num; break;
+    case REGCLASS_DB : reg = UD_R_DR0  + num; break;
+    case REGCLASS_SEG : {
+      /*
+       * Only 6 segment registers, anything else is an error.
+       */
+      if ((num & 7) > 5) {
+        UDERR(u, "invalid segment register value\n");
+        return;
+      } else {
+        reg = UD_R_ES + (num & 7);
+      }
+      break;
+    }
+    default:
+      UD_ASSERT(!"invalid register type");
+      return;
+  }
+  opr->type = UD_OP_REG;
+  opr->base = reg;
+  opr->size = size;
+}
+
+
+/*
+ * decode_imm 
+ *
+ *    Decode Immediate values.
+ */
+static void 
+decode_imm(struct ud* u, unsigned int size, struct ud_operand *op)
+{
+  op->size = resolve_operand_size(u, size);
+  op->type = UD_OP_IMM;
+
+  switch (op->size) {
+  case  8: op->lval.sbyte = inp_uint8(u);   break;
+  case 16: op->lval.uword = inp_uint16(u);  break;
+  case 32: op->lval.udword = inp_uint32(u); break;
+  case 64: op->lval.uqword = inp_uint64(u); break;
+  default: return;
+  }
+}
+
+
+/* 
+ * decode_mem_disp
+ *
+ *    Decode mem address displacement.
+ */
+static void 
+decode_mem_disp(struct ud* u, unsigned int size, struct ud_operand *op)
+{
+  switch (size) {
+  case 8:
+    op->offset = 8; 
+    op->lval.ubyte  = inp_uint8(u);
+    break;
+  case 16:
+    op->offset = 16; 
+    op->lval.uword  = inp_uint16(u); 
+    break;
+  case 32:
+    op->offset = 32; 
+    op->lval.udword = inp_uint32(u); 
+    break;
+  case 64:
+    op->offset = 64; 
+    op->lval.uqword = inp_uint64(u); 
+    break;
+  default:
+      return;
+  }
+}
+
+
+/*
+ * decode_modrm_reg
+ *
+ *    Decodes reg field of mod/rm byte
+ * 
+ */
+static UD_INLINE void
+decode_modrm_reg(struct ud         *u, 
+                 struct ud_operand *operand,
+                 unsigned int       type,
+                 unsigned int       size)
+{
+  uint8_t reg = (REX_R(u->_rex) << 3) | MODRM_REG(modrm(u));
+  decode_reg(u, operand, type, reg, size);
+}
+
+
+/*
+ * decode_modrm_rm
+ *
+ *    Decodes rm field of mod/rm byte
+ * 
+ */
+static void 
+decode_modrm_rm(struct ud         *u, 
+                struct ud_operand *op,
+                unsigned char      type,    /* register type */
+                unsigned int       size)    /* operand size */
+
+{
+  size_t offset = 0;
+  unsigned char mod, rm;
+
+  /* get mod, r/m and reg fields */
+  mod = MODRM_MOD(modrm(u));
+  rm  = (REX_B(u->_rex) << 3) | MODRM_RM(modrm(u));
+
+  /* 
+   * If mod is 11b, then the modrm.rm specifies a register.
+   *
+   */
+  if (mod == 3) {
+    decode_reg(u, op, type, rm, size);
+    return;
+  }
+
+  /* 
+   * !11b => Memory Address
+   */  
+  op->type = UD_OP_MEM;
+  op->size = resolve_operand_size(u, size);
+
+  if (u->adr_mode == 64) {
+    op->base = UD_R_RAX + rm;
+    if (mod == 1) {
+      offset = 8;
+    } else if (mod == 2) {
+      offset = 32;
+    } else if (mod == 0 && (rm & 7) == 5) {           
+      op->base = UD_R_RIP;
+      offset = 32;
+    } else {
+      offset = 0;
+    }
+    /* 
+     * Scale-Index-Base (SIB) 
+     */
+    if ((rm & 7) == 4) {
+      inp_next(u);
+      
+      op->base  = UD_R_RAX + (SIB_B(inp_curr(u)) | (REX_B(u->_rex) << 3));
+      op->index = UD_R_RAX + (SIB_I(inp_curr(u)) | (REX_X(u->_rex) << 3));
+      /* special conditions for base reference */
+      if (op->index == UD_R_RSP) {
+        op->index = UD_NONE;
+        op->scale = UD_NONE;
+      } else {
+        op->scale = (1 << SIB_S(inp_curr(u))) & ~1;
+      }
+
+      if (op->base == UD_R_RBP || op->base == UD_R_R13) {
+        if (mod == 0) {
+          op->base = UD_NONE;
+        } 
+        if (mod == 1) {
+          offset = 8;
+        } else {
+          offset = 32;
+        }
+      }
+    } else {
+        op->scale = UD_NONE;
+        op->index = UD_NONE;
+    }
+  } else if (u->adr_mode == 32) {
+    op->base = UD_R_EAX + rm;
+    if (mod == 1) {
+      offset = 8;
+    } else if (mod == 2) {
+      offset = 32;
+    } else if (mod == 0 && rm == 5) {
+      op->base = UD_NONE;
+      offset = 32;
+    } else {
+      offset = 0;
+    }
+
+    /* Scale-Index-Base (SIB) */
+    if ((rm & 7) == 4) {
+      inp_next(u);
+
+      op->scale = (1 << SIB_S(inp_curr(u))) & ~1;
+      op->index = UD_R_EAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3));
+      op->base  = UD_R_EAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3));
+
+      if (op->index == UD_R_ESP) {
+        op->index = UD_NONE;
+        op->scale = UD_NONE;
+      }
+
+      /* special condition for base reference */
+      if (op->base == UD_R_EBP) {
+        if (mod == 0) {
+          op->base = UD_NONE;
+        } 
+        if (mod == 1) {
+          offset = 8;
+        } else {
+          offset = 32;
+        }
+      }
+    } else {
+      op->scale = UD_NONE;
+      op->index = UD_NONE;
+    }
+  } else {
+    const unsigned int bases[]   = { UD_R_BX, UD_R_BX, UD_R_BP, UD_R_BP,
+                                     UD_R_SI, UD_R_DI, UD_R_BP, UD_R_BX };
+    const unsigned int indices[] = { UD_R_SI, UD_R_DI, UD_R_SI, UD_R_DI,
+                                     UD_NONE, UD_NONE, UD_NONE, UD_NONE };
+    op->base  = bases[rm & 7];
+    op->index = indices[rm & 7];
+    op->scale = UD_NONE;
+    if (mod == 0 && rm == 6) {
+      offset = 16;
+      op->base = UD_NONE;
+    } else if (mod == 1) {
+      offset = 8;
+    } else if (mod == 2) { 
+      offset = 16;
+    }
+  }
+
+  if (offset) {
+    decode_mem_disp(u, offset, op);
+  } else {
+    op->offset = 0;
+  }
+}
+
+
+/* 
+ * decode_moffset
+ *    Decode offset-only memory operand
+ */
+static void
+decode_moffset(struct ud *u, unsigned int size, struct ud_operand *opr)
+{
+  opr->type  = UD_OP_MEM;
+  opr->base  = UD_NONE;
+  opr->index = UD_NONE;
+  opr->scale = UD_NONE;
+  opr->size  = resolve_operand_size(u, size);
+  decode_mem_disp(u, u->adr_mode, opr);
+}
+
+
+static void
+decode_vex_vvvv(struct ud *u, struct ud_operand *opr, unsigned size)
+{
+  uint8_t vvvv;
+  UD_ASSERT(u->vex_op != 0);
+  vvvv = ((u->vex_op == 0xc4 ? u->vex_b2 : u->vex_b1) >> 3) & 0xf;
+  decode_reg(u, opr, REGCLASS_XMM, (0xf & ~vvvv), size);
+}
+
+
+/* 
+ * decode_vex_immreg
+ *    Decode source operand encoded in immediate byte [7:4]
+ */
+static int
+decode_vex_immreg(struct ud *u, struct ud_operand *opr, unsigned size)
+{
+  uint8_t imm  = inp_next(u);
+  uint8_t mask = u->dis_mode == 64 ? 0xf : 0x7;
+  UD_RETURN_ON_ERROR(u);
+  UD_ASSERT(u->vex_op != 0);
+  decode_reg(u, opr, REGCLASS_XMM, mask & (imm >> 4), size);
+  return 0;
+}
+
+
+/* 
+ * decode_operand
+ *
+ *      Decodes a single operand.
+ *      Returns the type of the operand (UD_NONE if none)
+ */
+static int
+decode_operand(struct ud           *u, 
+               struct ud_operand   *operand,
+               enum ud_operand_code type,
+               unsigned int         size)
+{
+  operand->type = UD_NONE;
+  operand->_oprcode = type;
+
+  switch (type) {
+    case OP_A :
+      decode_a(u, operand);
+      break;
+    case OP_MR:
+      decode_modrm_rm(u, operand, REGCLASS_GPR, 
+                      MODRM_MOD(modrm(u)) == 3 ? 
+                        Mx_reg_size(size) : Mx_mem_size(size));
+      break;
+    case OP_F:
+      u->br_far  = 1;
+      /* intended fall through */
+    case OP_M:
+      if (MODRM_MOD(modrm(u)) == 3) {
+        UDERR(u, "expected modrm.mod != 3\n");
+      }
+      /* intended fall through */
+    case OP_E:
+      decode_modrm_rm(u, operand, REGCLASS_GPR, size);
+      break;
+    case OP_G:
+      decode_modrm_reg(u, operand, REGCLASS_GPR, size);
+      break;
+    case OP_sI:
+    case OP_I:
+      decode_imm(u, size, operand);
+      break;
+    case OP_I1:
+      operand->type = UD_OP_CONST;
+      operand->lval.udword = 1;
+      break;
+    case OP_N:
+      if (MODRM_MOD(modrm(u)) != 3) {
+        UDERR(u, "expected modrm.mod == 3\n");
+      }
+      /* intended fall through */
+    case OP_Q:
+      decode_modrm_rm(u, operand, REGCLASS_MMX, size);
+      break;
+    case OP_P:
+      decode_modrm_reg(u, operand, REGCLASS_MMX, size);
+      break;
+    case OP_U:
+      if (MODRM_MOD(modrm(u)) != 3) {
+        UDERR(u, "expected modrm.mod == 3\n");
+      }
+      /* intended fall through */
+    case OP_W:
+      decode_modrm_rm(u, operand, REGCLASS_XMM, size);
+      break;
+    case OP_V:
+      decode_modrm_reg(u, operand, REGCLASS_XMM, size);
+      break;
+    case OP_H:
+      decode_vex_vvvv(u, operand, size);
+      break;
+    case OP_MU:
+      decode_modrm_rm(u, operand, REGCLASS_XMM, 
+                      MODRM_MOD(modrm(u)) == 3 ? 
+                        Mx_reg_size(size) : Mx_mem_size(size));
+      break;
+    case OP_S:
+      decode_modrm_reg(u, operand, REGCLASS_SEG, size);
+      break;
+    case OP_O:
+      decode_moffset(u, size, operand);
+      break;
+    case OP_R0: 
+    case OP_R1: 
+    case OP_R2: 
+    case OP_R3: 
+    case OP_R4: 
+    case OP_R5: 
+    case OP_R6: 
+    case OP_R7:
+      decode_reg(u, operand, REGCLASS_GPR, 
+                 (REX_B(u->_rex) << 3) | (type - OP_R0), size);
+      break;
+    case OP_AL:
+    case OP_AX:
+    case OP_eAX:
+    case OP_rAX:
+      decode_reg(u, operand, REGCLASS_GPR, 0, size);
+      break;
+    case OP_CL:
+    case OP_CX:
+    case OP_eCX:
+      decode_reg(u, operand, REGCLASS_GPR, 1, size);
+      break;
+    case OP_DL:
+    case OP_DX:
+    case OP_eDX:
+      decode_reg(u, operand, REGCLASS_GPR, 2, size);
+      break;
+    case OP_ES: 
+    case OP_CS: 
+    case OP_DS:
+    case OP_SS: 
+    case OP_FS: 
+    case OP_GS:
+      /* in 64bits mode, only fs and gs are allowed */
+      if (u->dis_mode == 64) {
+        if (type != OP_FS && type != OP_GS) {
+          UDERR(u, "invalid segment register in 64bits\n");
+        }
+      }
+      operand->type = UD_OP_REG;
+      operand->base = (type - OP_ES) + UD_R_ES;
+      operand->size = 16;
+      break;
+    case OP_J :
+      decode_imm(u, size, operand);
+      operand->type = UD_OP_JIMM;
+      break ;
+    case OP_R :
+      if (MODRM_MOD(modrm(u)) != 3) {
+        UDERR(u, "expected modrm.mod == 3\n");
+      }
+      decode_modrm_rm(u, operand, REGCLASS_GPR, size);
+      break;
+    case OP_C:
+      decode_modrm_reg(u, operand, REGCLASS_CR, size);
+      break;
+    case OP_D:
+      decode_modrm_reg(u, operand, REGCLASS_DB, size);
+      break;
+    case OP_I3 :
+      operand->type = UD_OP_CONST;
+      operand->lval.sbyte = 3;
+      break;
+    case OP_ST0: 
+    case OP_ST1: 
+    case OP_ST2: 
+    case OP_ST3:
+    case OP_ST4:
+    case OP_ST5: 
+    case OP_ST6: 
+    case OP_ST7:
+      operand->type = UD_OP_REG;
+      operand->base = (type - OP_ST0) + UD_R_ST0;
+      operand->size = 80;
+      break;
+    case OP_L:
+      decode_vex_immreg(u, operand, size);
+      break;
+    default :
+      operand->type = UD_NONE;
+      break;
+  }
+  return operand->type;
+}
+
+
+/* 
+ * decode_operands
+ *
+ *    Disassemble upto 3 operands of the current instruction being
+ *    disassembled. By the end of the function, the operand fields
+ *    of the ud structure will have been filled.
+ */
+static int
+decode_operands(struct ud* u)
+{
+  decode_operand(u, &u->operand[0],
+                    u->itab_entry->operand1.type,
+                    u->itab_entry->operand1.size);
+  if (u->operand[0].type != UD_NONE) {
+      decode_operand(u, &u->operand[1],
+                        u->itab_entry->operand2.type,
+                        u->itab_entry->operand2.size);
+  }
+  if (u->operand[1].type != UD_NONE) {
+      decode_operand(u, &u->operand[2],
+                        u->itab_entry->operand3.type,
+                        u->itab_entry->operand3.size);
+  }
+  if (u->operand[2].type != UD_NONE) {
+      decode_operand(u, &u->operand[3],
+                        u->itab_entry->operand4.type,
+                        u->itab_entry->operand4.size);
+  }
+  return 0;
+}
+    
+/* -----------------------------------------------------------------------------
+ * clear_insn() - clear instruction structure
+ * -----------------------------------------------------------------------------
+ */
+static void
+clear_insn(register struct ud* u)
+{
+  u->error     = 0;
+  u->pfx_seg   = 0;
+  u->pfx_opr   = 0;
+  u->pfx_adr   = 0;
+  u->pfx_lock  = 0;
+  u->pfx_repne = 0;
+  u->pfx_rep   = 0;
+  u->pfx_repe  = 0;
+  u->pfx_rex   = 0;
+  u->pfx_str   = 0;
+  u->mnemonic  = UD_Inone;
+  u->itab_entry = NULL;
+  u->have_modrm = 0;
+  u->br_far    = 0;
+  u->vex_op    = 0;
+  u->_rex      = 0;
+  u->operand[0].type = UD_NONE;
+  u->operand[1].type = UD_NONE;
+  u->operand[2].type = UD_NONE;
+  u->operand[3].type = UD_NONE;
+}
+
+
+static UD_INLINE int
+resolve_pfx_str(struct ud* u)
+{
+  if (u->pfx_str == 0xf3) {
+    if (P_STR(u->itab_entry->prefix)) {
+        u->pfx_rep  = 0xf3;
+    } else {
+        u->pfx_repe = 0xf3;
+    }
+  } else if (u->pfx_str == 0xf2) {
+    u->pfx_repne = 0xf3;
+  }
+  return 0;
+}
+
+
+static int
+resolve_mode( struct ud* u )
+{
+  int default64;
+  /* if in error state, bail out */
+  if ( u->error ) return -1; 
+
+  /* propagate prefix effects */
+  if ( u->dis_mode == 64 ) {  /* set 64bit-mode flags */
+
+    /* Check validity of  instruction m64 */
+    if ( P_INV64( u->itab_entry->prefix ) ) {
+      UDERR(u, "instruction invalid in 64bits\n");
+      return -1;
+    }
+
+    /* compute effective rex based on,
+     *  - vex prefix (if any)
+     *  - rex prefix (if any, and not vex)
+     *  - allowed prefixes specified by the opcode map
+     */
+    if (u->vex_op == 0xc4) {
+        /* vex has rex.rxb in 1's complement */
+        u->_rex = ((~(u->vex_b1 >> 5) & 0x7) /* rex.0rxb */ | 
+                   ((u->vex_b2  >> 4) & 0x8) /* rex.w000 */);
+    } else if (u->vex_op == 0xc5) {
+        /* vex has rex.r in 1's complement */
+        u->_rex = (~(u->vex_b1 >> 5)) & 4;
+    } else {
+        UD_ASSERT(u->vex_op == 0);
+        u->_rex = u->pfx_rex;
+    }
+    u->_rex &= REX_PFX_MASK(u->itab_entry->prefix);
+
+    /* whether this instruction has a default operand size of 
+     * 64bit, also hardcoded into the opcode map.
+     */
+    default64 = P_DEF64( u->itab_entry->prefix ); 
+    /* calculate effective operand size */
+    if (REX_W(u->_rex)) {
+        u->opr_mode = 64;
+    } else if ( u->pfx_opr ) {
+        u->opr_mode = 16;
+    } else {
+        /* unless the default opr size of instruction is 64,
+         * the effective operand size in the absence of rex.w
+         * prefix is 32.
+         */
+        u->opr_mode = default64 ? 64 : 32;
+    }
+
+    /* calculate effective address size */
+    u->adr_mode = (u->pfx_adr) ? 32 : 64;
+  } else if ( u->dis_mode == 32 ) { /* set 32bit-mode flags */
+    u->opr_mode = ( u->pfx_opr ) ? 16 : 32;
+    u->adr_mode = ( u->pfx_adr ) ? 16 : 32;
+  } else if ( u->dis_mode == 16 ) { /* set 16bit-mode flags */
+    u->opr_mode = ( u->pfx_opr ) ? 32 : 16;
+    u->adr_mode = ( u->pfx_adr ) ? 32 : 16;
+  }
+
+  return 0;
+}
+
+
+static UD_INLINE int
+decode_insn(struct ud *u, uint16_t ptr)
+{
+  UD_ASSERT((ptr & 0x8000) == 0);
+  u->itab_entry = &ud_itab[ ptr ];
+  u->mnemonic = u->itab_entry->mnemonic;
+  return (resolve_pfx_str(u)  == 0 &&
+          resolve_mode(u)     == 0 &&
+          decode_operands(u)  == 0 &&
+          resolve_mnemonic(u) == 0) ? 0 : -1;
+}
+
+
+/*
+ * decode_3dnow()
+ *
+ *    Decoding 3dnow is a little tricky because of its strange opcode
+ *    structure. The final opcode disambiguation depends on the last
+ *    byte that comes after the operands have been decoded. Fortunately,
+ *    all 3dnow instructions have the same set of operand types. So we
+ *    go ahead and decode the instruction by picking an arbitrarily chosen
+ *    valid entry in the table, decode the operands, and read the final
+ *    byte to resolve the menmonic.
+ */
+static UD_INLINE int
+decode_3dnow(struct ud* u)
+{
+  uint16_t ptr;
+  UD_ASSERT(u->le->type == UD_TAB__OPC_3DNOW);
+  UD_ASSERT(u->le->table[0xc] != 0);
+  decode_insn(u, u->le->table[0xc]);
+  inp_next(u); 
+  if (u->error) {
+    return -1;
+  }
+  ptr = u->le->table[inp_curr(u)]; 
+  UD_ASSERT((ptr & 0x8000) == 0);
+  u->mnemonic = ud_itab[ptr].mnemonic;
+  return 0;
+}
+
+
+static int
+decode_ssepfx(struct ud *u)
+{
+  uint8_t idx;
+  uint8_t pfx;
+ 
+  /*
+   * String prefixes (f2, f3) take precedence over operand
+   * size prefix (66).
+   */
+  pfx = u->pfx_str;
+  if (pfx == 0) {
+    pfx = u->pfx_opr;
+  }
+  idx = ((pfx & 0xf) + 1) / 2;
+  if (u->le->table[idx] == 0) {
+    idx = 0;
+  }
+  if (idx && u->le->table[idx] != 0) {
+    /*
+     * "Consume" the prefix as a part of the opcode, so it is no
+     * longer exported as an instruction prefix.
+     */
+    u->pfx_str = 0;
+    if (pfx == 0x66) {
+        /* 
+         * consume "66" only if it was used for decoding, leaving
+         * it to be used as an operands size override for some
+         * simd instructions.
+         */
+        u->pfx_opr = 0;
+    }
+  }
+  return decode_ext(u, u->le->table[idx]);
+}
+
+
+static int
+decode_vex(struct ud *u)
+{
+  uint8_t index;
+  if (u->dis_mode != 64 && MODRM_MOD(inp_peek(u)) != 0x3) {
+    index = 0;
+  } else {
+    u->vex_op = inp_curr(u);
+    u->vex_b1 = inp_next(u);
+    if (u->vex_op == 0xc4) {
+      uint8_t pp, m;
+      /* 3-byte vex */
+      u->vex_b2 = inp_next(u);
+      UD_RETURN_ON_ERROR(u);
+      m  = u->vex_b1 & 0x1f;
+      if (m == 0 || m > 3) {
+        UD_RETURN_WITH_ERROR(u, "reserved vex.m-mmmm value");
+      }
+      pp = u->vex_b2 & 0x3;
+      index = (pp << 2) | m;
+    } else {
+      /* 2-byte vex */
+      UD_ASSERT(u->vex_op == 0xc5);
+      index = 0x1 | ((u->vex_b1 & 0x3) << 2);
+    }
+  }
+  return decode_ext(u, u->le->table[index]); 
+}
+
+
+/*
+ * decode_ext()
+ *
+ *    Decode opcode extensions (if any)
+ */
+static int
+decode_ext(struct ud *u, uint16_t ptr)
+{
+  uint8_t idx = 0;
+  if ((ptr & 0x8000) == 0) {
+    return decode_insn(u, ptr); 
+  }
+  u->le = &ud_lookup_table_list[(~0x8000 & ptr)];
+  if (u->le->type == UD_TAB__OPC_3DNOW) {
+    return decode_3dnow(u);
+  }
+
+  switch (u->le->type) {
+    case UD_TAB__OPC_MOD:
+      /* !11 = 0, 11 = 1 */
+      idx = (MODRM_MOD(modrm(u)) + 1) / 4;
+      break;
+      /* disassembly mode/operand size/address size based tables.
+       * 16 = 0,, 32 = 1, 64 = 2
+       */
+    case UD_TAB__OPC_MODE:
+      idx = u->dis_mode != 64 ? 0 : 1;
+      break;
+    case UD_TAB__OPC_OSIZE:
+      idx = eff_opr_mode(u->dis_mode, REX_W(u->pfx_rex), u->pfx_opr) / 32;
+      break;
+    case UD_TAB__OPC_ASIZE:
+      idx = eff_adr_mode(u->dis_mode, u->pfx_adr) / 32;
+      break;
+    case UD_TAB__OPC_X87:
+      idx = modrm(u) - 0xC0;
+      break;
+    case UD_TAB__OPC_VENDOR:
+      if (u->vendor == UD_VENDOR_ANY) {
+        /* choose a valid entry */
+        idx = (u->le->table[idx] != 0) ? 0 : 1;
+      } else if (u->vendor == UD_VENDOR_AMD) {
+        idx = 0;
+      } else {
+        idx = 1;
+      }
+      break;
+    case UD_TAB__OPC_RM:
+      idx = MODRM_RM(modrm(u));
+      break;
+    case UD_TAB__OPC_REG:
+      idx = MODRM_REG(modrm(u));
+      break;
+    case UD_TAB__OPC_SSE:
+      return decode_ssepfx(u);
+    case UD_TAB__OPC_VEX:
+      return decode_vex(u);
+    case UD_TAB__OPC_VEX_W:
+      idx = vex_w(u);
+      break;
+    case UD_TAB__OPC_VEX_L:
+      idx = vex_l(u);
+      break;
+    case UD_TAB__OPC_TABLE:
+      inp_next(u);
+      return decode_opcode(u);
+    default:
+      UD_ASSERT(!"not reached");
+      break;
+  }
+
+  return decode_ext(u, u->le->table[idx]);
+}
+
+
+static int
+decode_opcode(struct ud *u)
+{
+  uint16_t ptr;
+  UD_ASSERT(u->le->type == UD_TAB__OPC_TABLE);
+  UD_RETURN_ON_ERROR(u);
+  ptr = u->le->table[inp_curr(u)];
+  return decode_ext(u, ptr);
+}
+
+ 
+/* =============================================================================
+ * ud_decode() - Instruction decoder. Returns the number of bytes decoded.
+ * =============================================================================
+ */
+unsigned int
+ud_decode(struct ud *u)
+{
+  inp_start(u);
+  clear_insn(u);
+  u->le = &ud_lookup_table_list[0];
+  u->error = decode_prefixes(u) == -1 || 
+             decode_opcode(u)   == -1 ||
+             u->error;
+  /* Handle decode error. */
+  if (u->error) {
+    /* clear out the decode data. */
+    clear_insn(u);
+    /* mark the sequence of bytes as invalid. */
+    u->itab_entry = &ud_itab[0]; /* entry 0 is invalid */
+    u->mnemonic = u->itab_entry->mnemonic;
+  } 
+
+    /* maybe this stray segment override byte
+     * should be spewed out?
+     */
+    if ( !P_SEG( u->itab_entry->prefix ) && 
+            u->operand[0].type != UD_OP_MEM &&
+            u->operand[1].type != UD_OP_MEM )
+        u->pfx_seg = 0;
+
+  u->insn_offset = u->pc; /* set offset of instruction */
+  u->asm_buf_fill = 0;   /* set translation buffer index to 0 */
+  u->pc += u->inp_ctr;    /* move program counter by bytes decoded */
+
+  /* return number of bytes disassembled. */
+  return u->inp_ctr;
+}
+
+#endif // USE(UDIS86)
+
+/*
+vim: set ts=2 sw=2 expandtab
+*/
diff --git a/disassembler/udis86/udis86_decode.h b/disassembler/udis86/udis86_decode.h
new file mode 100644
index 0000000..411c883
--- /dev/null
+++ b/disassembler/udis86/udis86_decode.h
@@ -0,0 +1,197 @@
+/* udis86 - libudis86/decode.h
+ *
+ * Copyright (c) 2002-2009 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef UD_DECODE_H
+#define UD_DECODE_H
+
+#include "udis86_types.h"
+#include "udis86_udint.h"
+#include "udis86_itab.h"
+
+#define MAX_INSN_LENGTH 15
+
+/* itab prefix bits */
+#define P_none          ( 0 )
+
+#define P_inv64         ( 1 << 0 )
+#define P_INV64(n)      ( ( n >> 0 ) & 1 )
+#define P_def64         ( 1 << 1 )
+#define P_DEF64(n)      ( ( n >> 1 ) & 1 )
+
+#define P_oso           ( 1 << 2 )
+#define P_OSO(n)        ( ( n >> 2 ) & 1 )
+#define P_aso           ( 1 << 3 )
+#define P_ASO(n)        ( ( n >> 3 ) & 1 )
+
+#define P_rexb          ( 1 << 4 )
+#define P_REXB(n)       ( ( n >> 4 ) & 1 )
+#define P_rexw          ( 1 << 5 )
+#define P_REXW(n)       ( ( n >> 5 ) & 1 )
+#define P_rexr          ( 1 << 6 )
+#define P_REXR(n)       ( ( n >> 6 ) & 1 )
+#define P_rexx          ( 1 << 7 )
+#define P_REXX(n)       ( ( n >> 7 ) & 1 )
+
+#define P_seg           ( 1 << 8 )
+#define P_SEG(n)        ( ( n >> 8 ) & 1 )
+
+#define P_vexl          ( 1 << 9 )
+#define P_VEXL(n)       ( ( n >> 9 ) & 1 )
+#define P_vexw          ( 1 << 10 )
+#define P_VEXW(n)       ( ( n >> 10 ) & 1 )
+
+#define P_str           ( 1 << 11 )
+#define P_STR(n)        ( ( n >> 11 ) & 1 )
+#define P_strz          ( 1 << 12 )
+#define P_STR_ZF(n)     ( ( n >> 12 ) & 1 )
+
+/* operand type constants -- order is important! */
+
+enum ud_operand_code {
+    OP_NONE,
+
+    OP_A,      OP_E,      OP_M,       OP_G,       
+    OP_I,      OP_F,
+
+    OP_R0,     OP_R1,     OP_R2,      OP_R3,
+    OP_R4,     OP_R5,     OP_R6,      OP_R7,
+
+    OP_AL,     OP_CL,     OP_DL,
+    OP_AX,     OP_CX,     OP_DX,
+    OP_eAX,    OP_eCX,    OP_eDX,
+    OP_rAX,    OP_rCX,    OP_rDX,
+
+    OP_ES,     OP_CS,     OP_SS,      OP_DS,  
+    OP_FS,     OP_GS,
+
+    OP_ST0,    OP_ST1,    OP_ST2,     OP_ST3,
+    OP_ST4,    OP_ST5,    OP_ST6,     OP_ST7,
+
+    OP_J,      OP_S,      OP_O,          
+    OP_I1,     OP_I3,     OP_sI,
+
+    OP_V,      OP_W,      OP_Q,       OP_P, 
+    OP_U,      OP_N,      OP_MU,      OP_H,
+    OP_L,
+
+    OP_R,      OP_C,      OP_D,       
+
+    OP_MR
+} UD_ATTR_PACKED;
+
+
+/*
+ * Operand size constants
+ *
+ *  Symbolic constants for various operand sizes. Some of these constants
+ *  are given a value equal to the width of the data (SZ_B == 8), such
+ *  that they maybe used interchangeably in the internals. Modifying them
+ *  will most certainly break things!
+ */
+typedef uint16_t ud_operand_size_t;
+
+#define SZ_NA  0
+#define SZ_Z   1
+#define SZ_V   2
+#define SZ_Y   3
+#define SZ_X   4
+#define SZ_RDQ 7
+#define SZ_B   8
+#define SZ_W   16
+#define SZ_D   32
+#define SZ_Q   64
+#define SZ_T   80
+#define SZ_O   12
+#define SZ_DQ  128 /* double quad */
+#define SZ_QQ  256 /* quad quad */
+
+/*
+ * Complex size types; that encode sizes for operands of type MR (memory or
+ * register); for internal use only. Id space above 256.
+ */
+#define SZ_BD  ((SZ_B << 8) | SZ_D)
+#define SZ_BV  ((SZ_B << 8) | SZ_V)
+#define SZ_WD  ((SZ_W << 8) | SZ_D)
+#define SZ_WV  ((SZ_W << 8) | SZ_V)
+#define SZ_WY  ((SZ_W << 8) | SZ_Y)
+#define SZ_DY  ((SZ_D << 8) | SZ_Y)
+#define SZ_WO  ((SZ_W << 8) | SZ_O)
+#define SZ_DO  ((SZ_D << 8) | SZ_O)
+#define SZ_QO  ((SZ_Q << 8) | SZ_O)
+
+
+/* resolve complex size type.
+ */
+static UD_INLINE ud_operand_size_t
+Mx_mem_size(ud_operand_size_t size)
+{
+  return (size >> 8) & 0xff;
+}
+
+static UD_INLINE ud_operand_size_t
+Mx_reg_size(ud_operand_size_t size)
+{
+  return size & 0xff;
+}
+
+/* A single operand of an entry in the instruction table. 
+ * (internal use only)
+ */
+struct ud_itab_entry_operand 
+{
+  enum ud_operand_code type;
+  ud_operand_size_t size;
+};
+
+
+/* A single entry in an instruction table. 
+ *(internal use only)
+ */
+struct ud_itab_entry 
+{
+  enum ud_mnemonic_code         mnemonic;
+  struct ud_itab_entry_operand  operand1;
+  struct ud_itab_entry_operand  operand2;
+  struct ud_itab_entry_operand  operand3;
+  struct ud_itab_entry_operand  operand4;
+  uint32_t                      prefix;
+};
+
+struct ud_lookup_table_list_entry {
+    const uint16_t *table;
+    enum ud_table_type type;
+    const char *meta;
+};
+     
+extern struct ud_itab_entry ud_itab[];
+extern struct ud_lookup_table_list_entry ud_lookup_table_list[];
+
+#endif /* UD_DECODE_H */
+
+/* vim:cindent
+ * vim:expandtab
+ * vim:ts=4
+ * vim:sw=4
+ */
diff --git a/disassembler/udis86/udis86_extern.h b/disassembler/udis86/udis86_extern.h
new file mode 100644
index 0000000..bf3314d
--- /dev/null
+++ b/disassembler/udis86/udis86_extern.h
@@ -0,0 +1,113 @@
+/* udis86 - libudis86/extern.h
+ *
+ * Copyright (c) 2002-2009, 2013 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef UD_EXTERN_H
+#define UD_EXTERN_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "udis86_types.h"
+
+#if defined(_MSC_VER) && defined(_USRDLL)
+# ifdef LIBUDIS86_EXPORTS
+#  define LIBUDIS86_DLLEXTERN __declspec(dllexport)
+# else 
+#  define LIBUDIS86_DLLEXTERN __declspec(dllimport)
+# endif
+#else
+# define LIBUDIS86_DLLEXTERN 
+#endif
+
+/* ============================= PUBLIC API ================================= */
+
+extern LIBUDIS86_DLLEXTERN void ud_init(struct ud*);
+
+extern LIBUDIS86_DLLEXTERN void ud_set_mode(struct ud*, uint8_t);
+
+extern LIBUDIS86_DLLEXTERN void ud_set_pc(struct ud*, uint64_t);
+
+extern LIBUDIS86_DLLEXTERN void ud_set_input_hook(struct ud*, int (*)(struct ud*));
+
+extern LIBUDIS86_DLLEXTERN void ud_set_input_buffer(struct ud*, const uint8_t*, size_t);
+
+#ifndef __UD_STANDALONE__
+extern LIBUDIS86_DLLEXTERN void ud_set_input_file(struct ud*, FILE*);
+#endif /* __UD_STANDALONE__ */
+
+extern LIBUDIS86_DLLEXTERN void ud_set_vendor(struct ud*, unsigned);
+
+extern LIBUDIS86_DLLEXTERN void ud_set_syntax(struct ud*, void (*)(struct ud*));
+
+extern LIBUDIS86_DLLEXTERN void ud_input_skip(struct ud*, size_t);
+
+extern LIBUDIS86_DLLEXTERN int ud_input_end(const struct ud*);
+
+extern LIBUDIS86_DLLEXTERN unsigned int ud_decode(struct ud*);
+
+extern LIBUDIS86_DLLEXTERN unsigned int ud_disassemble(struct ud*);
+
+extern LIBUDIS86_DLLEXTERN void ud_translate_intel(struct ud*);
+
+extern LIBUDIS86_DLLEXTERN void ud_translate_att(struct ud*);
+
+extern LIBUDIS86_DLLEXTERN const char* ud_insn_asm(const struct ud* u);
+
+extern LIBUDIS86_DLLEXTERN const uint8_t* ud_insn_ptr(const struct ud* u);
+
+extern LIBUDIS86_DLLEXTERN uint64_t ud_insn_off(const struct ud*);
+
+extern LIBUDIS86_DLLEXTERN const char* ud_insn_hex(struct ud*);
+
+extern LIBUDIS86_DLLEXTERN unsigned int ud_insn_len(const struct ud* u);
+
+extern LIBUDIS86_DLLEXTERN const struct ud_operand* ud_insn_opr(const struct ud *u, unsigned int n);
+
+extern LIBUDIS86_DLLEXTERN int ud_opr_is_sreg(const struct ud_operand *opr);
+
+extern LIBUDIS86_DLLEXTERN int ud_opr_is_gpr(const struct ud_operand *opr);
+
+extern LIBUDIS86_DLLEXTERN enum ud_mnemonic_code ud_insn_mnemonic(const struct ud *u);
+
+extern LIBUDIS86_DLLEXTERN const char* ud_lookup_mnemonic(enum ud_mnemonic_code c);
+
+extern LIBUDIS86_DLLEXTERN void ud_set_user_opaque_data(struct ud*, void*);
+
+extern LIBUDIS86_DLLEXTERN void* ud_get_user_opaque_data(const struct ud*);
+
+extern LIBUDIS86_DLLEXTERN void ud_set_asm_buffer(struct ud *u, char *buf, size_t size);
+
+extern LIBUDIS86_DLLEXTERN void ud_set_sym_resolver(struct ud *u, 
+                                const char* (*resolver)(struct ud*, 
+                                                        uint64_t addr,
+                                                        int64_t *offset));
+
+/* ========================================================================== */
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* UD_EXTERN_H */
diff --git a/disassembler/udis86/udis86_itab_holder.c b/disassembler/udis86/udis86_itab_holder.c
new file mode 100644
index 0000000..80dda3a
--- /dev/null
+++ b/disassembler/udis86/udis86_itab_holder.c
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(UDIS86)
+
+#include "udis86_itab.c"
+
+#endif
+
diff --git a/disassembler/udis86/udis86_syn-att.c b/disassembler/udis86/udis86_syn-att.c
new file mode 100644
index 0000000..7d5646e
--- /dev/null
+++ b/disassembler/udis86/udis86_syn-att.c
@@ -0,0 +1,235 @@
+/* udis86 - libudis86/syn-att.c
+ *
+ * Copyright (c) 2002-2009 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(UDIS86)
+
+#include "udis86_types.h"
+#include "udis86_extern.h"
+#include "udis86_decode.h"
+#include "udis86_itab.h"
+#include "udis86_syn.h"
+#include "udis86_udint.h"
+
+/* -----------------------------------------------------------------------------
+ * opr_cast() - Prints an operand cast.
+ * -----------------------------------------------------------------------------
+ */
+static void 
+opr_cast(struct ud* u, struct ud_operand* op)
+{
+  switch(op->size) {
+  case 16 : case 32 :
+    ud_asmprintf(u, "*");   break;
+  default: break;
+  }
+}
+
+/* -----------------------------------------------------------------------------
+ * gen_operand() - Generates assembly output for each operand.
+ * -----------------------------------------------------------------------------
+ */
+static void 
+gen_operand(struct ud* u, struct ud_operand* op)
+{
+  switch(op->type) {
+  case UD_OP_CONST:
+    ud_asmprintf(u, "$0x%x", op->lval.udword);
+    break;
+
+  case UD_OP_REG:
+    ud_asmprintf(u, "%%%s", ud_reg_tab[op->base - UD_R_AL]);
+    break;
+
+  case UD_OP_MEM:
+    if (u->br_far) {
+        opr_cast(u, op);
+    }
+    if (u->pfx_seg) {
+      ud_asmprintf(u, "%%%s:", ud_reg_tab[u->pfx_seg - UD_R_AL]);
+    }
+    if (op->offset != 0) { 
+      ud_syn_print_mem_disp(u, op, 0);
+    }
+    if (op->base) {
+      ud_asmprintf(u, "(%%%s", ud_reg_tab[op->base - UD_R_AL]);
+    }
+    if (op->index) {
+      if (op->base) {
+        ud_asmprintf(u, ",");
+      } else {
+        ud_asmprintf(u, "(");
+      }
+      ud_asmprintf(u, "%%%s", ud_reg_tab[op->index - UD_R_AL]);
+    }
+    if (op->scale) {
+      ud_asmprintf(u, ",%d", op->scale);
+    }
+    if (op->base || op->index) {
+      ud_asmprintf(u, ")");
+    }
+    break;
+
+  case UD_OP_IMM:
+    ud_asmprintf(u, "$");
+    ud_syn_print_imm(u, op);
+    break;
+
+  case UD_OP_JIMM:
+    ud_syn_print_addr(u, ud_syn_rel_target(u, op));
+    break;
+
+  case UD_OP_PTR:
+    switch (op->size) {
+      case 32:
+        ud_asmprintf(u, "$0x%x, $0x%x", op->lval.ptr.seg, 
+          op->lval.ptr.off & 0xFFFF);
+        break;
+      case 48:
+        ud_asmprintf(u, "$0x%x, $0x%x", op->lval.ptr.seg, 
+          op->lval.ptr.off);
+        break;
+    }
+    break;
+      
+  default: return;
+  }
+}
+
+/* =============================================================================
+ * translates to AT&T syntax 
+ * =============================================================================
+ */
+extern void 
+ud_translate_att(struct ud *u)
+{
+  int size = 0;
+  int star = 0;
+
+  /* check if P_OSO prefix is used */
+  if (! P_OSO(u->itab_entry->prefix) && u->pfx_opr) {
+  switch (u->dis_mode) {
+    case 16: 
+      ud_asmprintf(u, "o32 ");
+      break;
+    case 32:
+    case 64:
+      ud_asmprintf(u, "o16 ");
+      break;
+  }
+  }
+
+  /* check if P_ASO prefix was used */
+  if (! P_ASO(u->itab_entry->prefix) && u->pfx_adr) {
+  switch (u->dis_mode) {
+    case 16: 
+      ud_asmprintf(u, "a32 ");
+      break;
+    case 32:
+      ud_asmprintf(u, "a16 ");
+      break;
+    case 64:
+      ud_asmprintf(u, "a32 ");
+      break;
+  }
+  }
+
+  if (u->pfx_lock)
+    ud_asmprintf(u,  "lock ");
+  if (u->pfx_rep) {
+    ud_asmprintf(u, "rep ");
+  } else if (u->pfx_repe) {
+    ud_asmprintf(u, "repe ");
+  } else if (u->pfx_repne) {
+    ud_asmprintf(u, "repne ");
+  }
+
+  /* special instructions */
+  switch (u->mnemonic) {
+  case UD_Iretf: 
+    ud_asmprintf(u, "lret "); 
+    break;
+  case UD_Idb:
+    ud_asmprintf(u, ".byte 0x%x", u->operand[0].lval.ubyte);
+    return;
+  case UD_Ijmp:
+  case UD_Icall:
+    if (u->br_far) ud_asmprintf(u,  "l");
+        if (u->operand[0].type == UD_OP_REG) {
+          star = 1;
+        }
+    ud_asmprintf(u, "%s", ud_lookup_mnemonic(u->mnemonic));
+    break;
+  case UD_Ibound:
+  case UD_Ienter:
+    if (u->operand[0].type != UD_NONE)
+      gen_operand(u, &u->operand[0]);
+    if (u->operand[1].type != UD_NONE) {
+      ud_asmprintf(u, ",");
+      gen_operand(u, &u->operand[1]);
+    }
+    return;
+  default:
+    ud_asmprintf(u, "%s", ud_lookup_mnemonic(u->mnemonic));
+  }
+
+  if (size == 8) {
+    ud_asmprintf(u, "b");
+  } else if (size == 16) {
+    ud_asmprintf(u, "w");
+  } else if (size == 64) {
+    ud_asmprintf(u, "q");
+  }
+
+  if (star) {
+    ud_asmprintf(u, " *");
+  } else {
+    ud_asmprintf(u, " ");
+  }
+
+  if (u->operand[3].type != UD_NONE) {
+    gen_operand(u, &u->operand[3]);
+    ud_asmprintf(u, ", ");
+  }
+  if (u->operand[2].type != UD_NONE) {
+    gen_operand(u, &u->operand[2]);
+    ud_asmprintf(u, ", ");
+  }
+  if (u->operand[1].type != UD_NONE) {
+    gen_operand(u, &u->operand[1]);
+    ud_asmprintf(u, ", ");
+  }
+  if (u->operand[0].type != UD_NONE) {
+    gen_operand(u, &u->operand[0]);
+  }
+}
+
+#endif // USE(UDIS86)
+
+/*
+vim: set ts=2 sw=2 expandtab
+*/
diff --git a/disassembler/udis86/udis86_syn-intel.c b/disassembler/udis86/udis86_syn-intel.c
new file mode 100644
index 0000000..769df89
--- /dev/null
+++ b/disassembler/udis86/udis86_syn-intel.c
@@ -0,0 +1,231 @@
+/* udis86 - libudis86/syn-intel.c
+ *
+ * Copyright (c) 2002-2013 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(UDIS86)
+
+#include "udis86_types.h"
+#include "udis86_extern.h"
+#include "udis86_decode.h"
+#include "udis86_itab.h"
+#include "udis86_syn.h"
+#include "udis86_udint.h"
+
+/* -----------------------------------------------------------------------------
+ * opr_cast() - Prints an operand cast.
+ * -----------------------------------------------------------------------------
+ */
+static void 
+opr_cast(struct ud* u, struct ud_operand* op)
+{
+  if (u->br_far) {
+    ud_asmprintf(u, "far "); 
+  }
+  switch(op->size) {
+  case  8:  ud_asmprintf(u, "byte " ); break;
+  case 16:  ud_asmprintf(u, "word " ); break;
+  case 32:  ud_asmprintf(u, "dword "); break;
+  case 64:  ud_asmprintf(u, "qword "); break;
+  case 80:  ud_asmprintf(u, "tword "); break;
+  case 128: ud_asmprintf(u, "oword "); break;
+  case 256: ud_asmprintf(u, "yword "); break;
+  default: break;
+  }
+}
+
+/* -----------------------------------------------------------------------------
+ * gen_operand() - Generates assembly output for each operand.
+ * -----------------------------------------------------------------------------
+ */
+static void gen_operand(struct ud* u, struct ud_operand* op, int syn_cast)
+{
+  switch(op->type) {
+  case UD_OP_REG:
+    ud_asmprintf(u, "%s", ud_reg_tab[op->base - UD_R_AL]);
+    break;
+
+  case UD_OP_MEM:
+    if (syn_cast) {
+      opr_cast(u, op);
+    }
+    ud_asmprintf(u, "[");
+    if (u->pfx_seg) {
+      ud_asmprintf(u, "%s:", ud_reg_tab[u->pfx_seg - UD_R_AL]);
+    }
+    if (op->base) {
+      ud_asmprintf(u, "%s", ud_reg_tab[op->base - UD_R_AL]);
+    }
+    if (op->index) {
+      ud_asmprintf(u, "%s%s", op->base != UD_NONE? "+" : "",
+                              ud_reg_tab[op->index - UD_R_AL]);
+      if (op->scale) {
+        ud_asmprintf(u, "*%d", op->scale);
+      }
+    }
+    if (op->offset != 0) {
+      ud_syn_print_mem_disp(u, op, (op->base  != UD_NONE || 
+                                    op->index != UD_NONE) ? 1 : 0);
+    }
+    ud_asmprintf(u, "]");
+    break;
+      
+  case UD_OP_IMM:
+    ud_syn_print_imm(u, op);
+    break;
+
+
+  case UD_OP_JIMM:
+    ud_syn_print_addr(u, ud_syn_rel_target(u, op));
+    break;
+
+  case UD_OP_PTR:
+    switch (op->size) {
+      case 32:
+        ud_asmprintf(u, "word 0x%x:0x%x", op->lval.ptr.seg, 
+          op->lval.ptr.off & 0xFFFF);
+        break;
+      case 48:
+        ud_asmprintf(u, "dword 0x%x:0x%x", op->lval.ptr.seg, 
+          op->lval.ptr.off);
+        break;
+    }
+    break;
+
+  case UD_OP_CONST:
+    if (syn_cast) opr_cast(u, op);
+    ud_asmprintf(u, "%d", op->lval.udword);
+    break;
+
+  default: return;
+  }
+}
+
+/* =============================================================================
+ * translates to intel syntax 
+ * =============================================================================
+ */
+extern void
+ud_translate_intel(struct ud* u)
+{
+  /* check if P_OSO prefix is used */
+  if (!P_OSO(u->itab_entry->prefix) && u->pfx_opr) {
+    switch (u->dis_mode) {
+    case 16: ud_asmprintf(u, "o32 "); break;
+    case 32:
+    case 64: ud_asmprintf(u, "o16 "); break;
+    }
+  }
+
+  /* check if P_ASO prefix was used */
+  if (!P_ASO(u->itab_entry->prefix) && u->pfx_adr) {
+    switch (u->dis_mode) {
+    case 16: ud_asmprintf(u, "a32 "); break;
+    case 32: ud_asmprintf(u, "a16 "); break;
+    case 64: ud_asmprintf(u, "a32 "); break;
+    }
+  }
+
+  if (u->pfx_seg &&
+      u->operand[0].type != UD_OP_MEM &&
+      u->operand[1].type != UD_OP_MEM ) {
+    ud_asmprintf(u, "%s ", ud_reg_tab[u->pfx_seg - UD_R_AL]);
+  }
+
+  if (u->pfx_lock) {
+    ud_asmprintf(u, "lock ");
+  }
+  if (u->pfx_rep) {
+    ud_asmprintf(u, "rep ");
+  } else if (u->pfx_repe) {
+    ud_asmprintf(u, "repe ");
+  } else if (u->pfx_repne) {
+    ud_asmprintf(u, "repne ");
+  }
+
+  /* print the instruction mnemonic */
+  ud_asmprintf(u, "%s", ud_lookup_mnemonic(u->mnemonic));
+
+  if (u->operand[0].type != UD_NONE) {
+    int cast = 0;
+    ud_asmprintf(u, " ");
+    if (u->operand[0].type == UD_OP_MEM) {
+      if (u->operand[1].type == UD_OP_IMM   ||
+          u->operand[1].type == UD_OP_CONST ||
+          u->operand[1].type == UD_NONE     ||
+          (u->operand[0].size != u->operand[1].size)) {
+          cast = 1;
+      } else if (u->operand[1].type == UD_OP_REG &&
+                 u->operand[1].base == UD_R_CL) {
+          switch (u->mnemonic) {
+          case UD_Ircl:
+          case UD_Irol:
+          case UD_Iror:
+          case UD_Ircr:
+          case UD_Ishl:
+          case UD_Ishr:
+          case UD_Isar:
+              cast = 1;
+              break;
+          default: break;
+          }
+      }
+    }
+    gen_operand(u, &u->operand[0], cast);
+  }
+
+  if (u->operand[1].type != UD_NONE) {
+    int cast = 0;
+    ud_asmprintf(u, ", ");
+    if (u->operand[1].type == UD_OP_MEM &&
+        u->operand[0].size != u->operand[1].size && 
+        !ud_opr_is_sreg(&u->operand[0])) {
+      cast = 1;
+    }
+    gen_operand(u, &u->operand[1], cast);
+  }
+
+  if (u->operand[2].type != UD_NONE) {
+    int cast = 0;
+    ud_asmprintf(u, ", ");
+    if (u->operand[2].type == UD_OP_MEM &&
+        u->operand[2].size != u->operand[1].size) {
+      cast = 1;
+    }
+    gen_operand(u, &u->operand[2], cast);
+  }
+
+  if (u->operand[3].type != UD_NONE) {
+    ud_asmprintf(u, ", ");
+    gen_operand(u, &u->operand[3], 0);
+  }
+}
+
+#endif // USE(UDIS86)
+
+/*
+vim: set ts=2 sw=2 expandtab
+*/
diff --git a/disassembler/udis86/udis86_syn.c b/disassembler/udis86/udis86_syn.c
new file mode 100644
index 0000000..4417d99
--- /dev/null
+++ b/disassembler/udis86/udis86_syn.c
@@ -0,0 +1,219 @@
+/* udis86 - libudis86/syn.c
+ *
+ * Copyright (c) 2002-2013 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(UDIS86)
+
+#include "udis86_types.h"
+#include "udis86_decode.h"
+#include "udis86_syn.h"
+#include "udis86_udint.h"
+
+/* 
+ * Register Table - Order Matters (types.h)!
+ *
+ */
+const char* ud_reg_tab[] = 
+{
+  "al",   "cl",   "dl",   "bl",
+  "ah",   "ch",   "dh",   "bh",
+  "spl",  "bpl",  "sil",  "dil",
+  "r8b",  "r9b",  "r10b", "r11b",
+  "r12b", "r13b", "r14b", "r15b",
+
+  "ax",   "cx",   "dx",   "bx",
+  "sp",   "bp",   "si",   "di",
+  "r8w",  "r9w",  "r10w", "r11w",
+  "r12w", "r13w", "r14w", "r15w",
+  
+  "eax",  "ecx",  "edx",  "ebx",
+  "esp",  "ebp",  "esi",  "edi",
+  "r8d",  "r9d",  "r10d", "r11d",
+  "r12d", "r13d", "r14d", "r15d",
+  
+  "rax",  "rcx",  "rdx",  "rbx",
+  "rsp",  "rbp",  "rsi",  "rdi",
+  "r8",   "r9",   "r10",  "r11",
+  "r12",  "r13",  "r14",  "r15",
+
+  "es",   "cs",   "ss",   "ds",
+  "fs",   "gs", 
+
+  "cr0",  "cr1",  "cr2",  "cr3",
+  "cr4",  "cr5",  "cr6",  "cr7",
+  "cr8",  "cr9",  "cr10", "cr11",
+  "cr12", "cr13", "cr14", "cr15",
+  
+  "dr0",  "dr1",  "dr2",  "dr3",
+  "dr4",  "dr5",  "dr6",  "dr7",
+  "dr8",  "dr9",  "dr10", "dr11",
+  "dr12", "dr13", "dr14", "dr15",
+
+  "mm0",  "mm1",  "mm2",  "mm3",
+  "mm4",  "mm5",  "mm6",  "mm7",
+
+  "st0",  "st1",  "st2",  "st3",
+  "st4",  "st5",  "st6",  "st7", 
+
+  "xmm0", "xmm1", "xmm2", "xmm3",
+  "xmm4", "xmm5", "xmm6", "xmm7",
+  "xmm8", "xmm9", "xmm10", "xmm11",
+  "xmm12", "xmm13", "xmm14", "xmm15",
+
+  "ymm0", "ymm1", "ymm2",   "ymm3",
+  "ymm4", "ymm5", "ymm6",   "ymm7",
+  "ymm8", "ymm9", "ymm10",  "ymm11",
+  "ymm12", "ymm13", "ymm14", "ymm15",
+
+  "rip"
+};
+
+
+uint64_t
+ud_syn_rel_target(struct ud *u, struct ud_operand *opr)
+{
+  const uint64_t trunc_mask = 0xffffffffffffffffull >> (64 - u->opr_mode);
+  switch (opr->size) {
+  case 8 : return (u->pc + opr->lval.sbyte)  & trunc_mask;
+  case 16: return (u->pc + opr->lval.sword)  & trunc_mask;
+  case 32: return (u->pc + opr->lval.sdword) & trunc_mask;
+  default: UD_ASSERT(!"invalid relative offset size.");
+    return 0ull;
+  }
+}
+
+
+/*
+ * asmprintf
+ *    Printf style function for printing translated assembly
+ *    output. Returns the number of characters written and
+ *    moves the buffer pointer forward. On an overflow,
+ *    returns a negative number and truncates the output.
+ */
+int
+ud_asmprintf(struct ud *u, const char *fmt, ...)
+{
+  int ret;
+  int avail;
+  va_list ap;
+  va_start(ap, fmt);
+  avail = u->asm_buf_size - u->asm_buf_fill - 1 /* nullchar */;
+  ret = vsnprintf((char*) u->asm_buf + u->asm_buf_fill, avail, fmt, ap);
+  if (ret < 0 || ret > avail) {
+      u->asm_buf_fill = u->asm_buf_size - 1;
+  } else {
+      u->asm_buf_fill += ret;
+  }
+  va_end(ap);
+  return ret;
+}
+
+
+void
+ud_syn_print_addr(struct ud *u, uint64_t addr)
+{
+  const char *name = NULL;
+  if (u->sym_resolver) {
+    int64_t offset = 0;
+    name = u->sym_resolver(u, addr, &offset);
+    if (name) {
+      if (offset) {
+        ud_asmprintf(u, "%s%+" FMT64 "d", name, offset);
+      } else {
+        ud_asmprintf(u, "%s", name);
+      }
+      return;
+    }
+  }
+  ud_asmprintf(u, "0x%" FMT64 "x", addr);
+}
+
+
+void
+ud_syn_print_imm(struct ud* u, const struct ud_operand *op)
+{
+  uint64_t v;
+  if (op->_oprcode == OP_sI && op->size != u->opr_mode) {
+    if (op->size == 8) {
+      v = (int64_t)op->lval.sbyte;
+    } else {
+      UD_ASSERT(op->size == 32);
+      v = (int64_t)op->lval.sdword;
+    }
+    if (u->opr_mode < 64) {
+      v = v & ((1ull << u->opr_mode) - 1ull);
+    }
+  } else {
+    switch (op->size) {
+    case 8 : v = op->lval.ubyte;  break;
+    case 16: v = op->lval.uword;  break;
+    case 32: v = op->lval.udword; break;
+    case 64: v = op->lval.uqword; break;
+    default: UD_ASSERT(!"invalid offset"); v = 0; /* keep cc happy */
+    }
+  }
+  ud_asmprintf(u, "0x%" FMT64 "x", v);
+}
+
+
+void
+ud_syn_print_mem_disp(struct ud* u, const struct ud_operand *op, int sign)
+{
+  UD_ASSERT(op->offset != 0);
+ if (op->base == UD_NONE && op->index == UD_NONE) {
+    uint64_t v;
+    UD_ASSERT(op->scale == UD_NONE && op->offset != 8);
+    /* unsigned mem-offset */
+    switch (op->offset) {
+    case 16: v = op->lval.uword;  break;
+    case 32: v = op->lval.udword; break;
+    case 64: v = op->lval.uqword; break;
+    default: UD_ASSERT(!"invalid offset"); v = 0; /* keep cc happy */
+    }
+    ud_asmprintf(u, "0x%" FMT64 "x", v);
+  } else {
+    int64_t v;
+    UD_ASSERT(op->offset != 64);
+    switch (op->offset) {
+    case 8 : v = op->lval.sbyte;  break;
+    case 16: v = op->lval.sword;  break;
+    case 32: v = op->lval.sdword; break;
+    default: UD_ASSERT(!"invalid offset"); v = 0; /* keep cc happy */
+    }
+    if (v < 0) {
+      ud_asmprintf(u, "-0x%" FMT64 "x", -v);
+    } else if (v > 0) {
+      ud_asmprintf(u, "%s0x%" FMT64 "x", sign? "+" : "", v);
+    }
+  }
+}
+
+#endif // USE(UDIS86)
+
+/*
+vim: set ts=2 sw=2 expandtab
+*/
diff --git a/disassembler/udis86/udis86_syn.h b/disassembler/udis86/udis86_syn.h
new file mode 100644
index 0000000..712ec37
--- /dev/null
+++ b/disassembler/udis86/udis86_syn.h
@@ -0,0 +1,53 @@
+/* udis86 - libudis86/syn.h
+ *
+ * Copyright (c) 2002-2009
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef UD_SYN_H
+#define UD_SYN_H
+
+#include "udis86_types.h"
+#ifndef __UD_STANDALONE__
+# include <stdarg.h>
+#endif /* __UD_STANDALONE__ */
+
+extern const char* ud_reg_tab[];
+
+uint64_t ud_syn_rel_target(struct ud*, struct ud_operand*);
+
+#ifdef __GNUC__
+int ud_asmprintf(struct ud *u, const char *fmt, ...)
+    __attribute__ ((format (printf, 2, 3)));
+#else
+int ud_asmprintf(struct ud *u, const char *fmt, ...);
+#endif
+
+void ud_syn_print_addr(struct ud *u, uint64_t addr);
+void ud_syn_print_imm(struct ud* u, const struct ud_operand *op);
+void ud_syn_print_mem_disp(struct ud* u, const struct ud_operand *, int sign);
+
+#endif /* UD_SYN_H */
+
+/*
+vim: set ts=2 sw=2 expandtab
+*/
diff --git a/disassembler/udis86/udis86_types.h b/disassembler/udis86/udis86_types.h
new file mode 100644
index 0000000..604f08e
--- /dev/null
+++ b/disassembler/udis86/udis86_types.h
@@ -0,0 +1,260 @@
+/* udis86 - libudis86/types.h
+ *
+ * Copyright (c) 2002-2013 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef UD_TYPES_H
+#define UD_TYPES_H
+
+#ifdef __KERNEL__
+  /* 
+   * -D__KERNEL__ is automatically passed on the command line when
+   * building something as part of the Linux kernel. Assume standalone
+   * mode.
+   */
+# include <linux/kernel.h>
+# include <linux/string.h>
+# ifndef __UD_STANDALONE__
+#  define __UD_STANDALONE__ 1
+# endif
+#endif /* __KERNEL__ */
+
+#if !defined(__UD_STANDALONE__)
+# include <stdint.h>
+# include <stdio.h>
+#endif
+
+/* gcc specific extensions */
+#ifdef __GNUC__
+# define UD_ATTR_PACKED __attribute__((packed))
+#else
+# define UD_ATTR_PACKED
+#endif /* UD_ATTR_PACKED */
+
+
+/* -----------------------------------------------------------------------------
+ * All possible "types" of objects in udis86. Order is Important!
+ * -----------------------------------------------------------------------------
+ */
+enum ud_type
+{
+  UD_NONE,
+
+  /* 8 bit GPRs */
+  UD_R_AL,  UD_R_CL,  UD_R_DL,  UD_R_BL,
+  UD_R_AH,  UD_R_CH,  UD_R_DH,  UD_R_BH,
+  UD_R_SPL, UD_R_BPL, UD_R_SIL, UD_R_DIL,
+  UD_R_R8B, UD_R_R9B, UD_R_R10B,  UD_R_R11B,
+  UD_R_R12B,  UD_R_R13B,  UD_R_R14B,  UD_R_R15B,
+
+  /* 16 bit GPRs */
+  UD_R_AX,  UD_R_CX,  UD_R_DX,  UD_R_BX,
+  UD_R_SP,  UD_R_BP,  UD_R_SI,  UD_R_DI,
+  UD_R_R8W, UD_R_R9W, UD_R_R10W,  UD_R_R11W,
+  UD_R_R12W,  UD_R_R13W,  UD_R_R14W,  UD_R_R15W,
+  
+  /* 32 bit GPRs */
+  UD_R_EAX, UD_R_ECX, UD_R_EDX, UD_R_EBX,
+  UD_R_ESP, UD_R_EBP, UD_R_ESI, UD_R_EDI,
+  UD_R_R8D, UD_R_R9D, UD_R_R10D,  UD_R_R11D,
+  UD_R_R12D,  UD_R_R13D,  UD_R_R14D,  UD_R_R15D,
+  
+  /* 64 bit GPRs */
+  UD_R_RAX, UD_R_RCX, UD_R_RDX, UD_R_RBX,
+  UD_R_RSP, UD_R_RBP, UD_R_RSI, UD_R_RDI,
+  UD_R_R8,  UD_R_R9,  UD_R_R10, UD_R_R11,
+  UD_R_R12, UD_R_R13, UD_R_R14, UD_R_R15,
+
+  /* segment registers */
+  UD_R_ES,  UD_R_CS,  UD_R_SS,  UD_R_DS,
+  UD_R_FS,  UD_R_GS,  
+
+  /* control registers*/
+  UD_R_CR0, UD_R_CR1, UD_R_CR2, UD_R_CR3,
+  UD_R_CR4, UD_R_CR5, UD_R_CR6, UD_R_CR7,
+  UD_R_CR8, UD_R_CR9, UD_R_CR10,  UD_R_CR11,
+  UD_R_CR12,  UD_R_CR13,  UD_R_CR14,  UD_R_CR15,
+  
+  /* debug registers */
+  UD_R_DR0, UD_R_DR1, UD_R_DR2, UD_R_DR3,
+  UD_R_DR4, UD_R_DR5, UD_R_DR6, UD_R_DR7,
+  UD_R_DR8, UD_R_DR9, UD_R_DR10,  UD_R_DR11,
+  UD_R_DR12,  UD_R_DR13,  UD_R_DR14,  UD_R_DR15,
+
+  /* mmx registers */
+  UD_R_MM0, UD_R_MM1, UD_R_MM2, UD_R_MM3,
+  UD_R_MM4, UD_R_MM5, UD_R_MM6, UD_R_MM7,
+
+  /* x87 registers */
+  UD_R_ST0, UD_R_ST1, UD_R_ST2, UD_R_ST3,
+  UD_R_ST4, UD_R_ST5, UD_R_ST6, UD_R_ST7, 
+
+  /* extended multimedia registers */
+  UD_R_XMM0,  UD_R_XMM1,  UD_R_XMM2,  UD_R_XMM3,
+  UD_R_XMM4,  UD_R_XMM5,  UD_R_XMM6,  UD_R_XMM7,
+  UD_R_XMM8,  UD_R_XMM9,  UD_R_XMM10, UD_R_XMM11,
+  UD_R_XMM12, UD_R_XMM13, UD_R_XMM14, UD_R_XMM15,
+
+  /* 256B multimedia registers */
+  UD_R_YMM0,  UD_R_YMM1,  UD_R_YMM2,  UD_R_YMM3,
+  UD_R_YMM4,  UD_R_YMM5,  UD_R_YMM6,  UD_R_YMM7,
+  UD_R_YMM8,  UD_R_YMM9,  UD_R_YMM10, UD_R_YMM11,
+  UD_R_YMM12, UD_R_YMM13, UD_R_YMM14, UD_R_YMM15,
+
+  UD_R_RIP,
+
+  /* Operand Types */
+  UD_OP_REG,  UD_OP_MEM,  UD_OP_PTR,  UD_OP_IMM,  
+  UD_OP_JIMM, UD_OP_CONST
+};
+
+#include "udis86_itab.h"
+
+union ud_lval {
+  int8_t     sbyte;
+  uint8_t    ubyte;
+  int16_t    sword;
+  uint16_t   uword;
+  int32_t    sdword;
+  uint32_t   udword;
+  int64_t    sqword;
+  uint64_t   uqword;
+  struct {
+    uint16_t seg;
+    uint32_t off;
+  } ptr;
+};
+
+/* -----------------------------------------------------------------------------
+ * struct ud_operand - Disassembled instruction Operand.
+ * -----------------------------------------------------------------------------
+ */
+struct ud_operand {
+  enum ud_type    type;
+  uint16_t        size;
+  enum ud_type    base;
+  enum ud_type    index;
+  uint8_t         scale;  
+  uint8_t         offset;
+  union ud_lval   lval;
+  /*
+   * internal use only
+   */
+  uint64_t        _legacy; /* this will be removed in 1.8 */
+  uint8_t         _oprcode;
+};
+
+/* -----------------------------------------------------------------------------
+ * struct ud - The udis86 object.
+ * -----------------------------------------------------------------------------
+ */
+struct ud
+{
+  /*
+   * input buffering
+   */
+  int       (*inp_hook) (struct ud*);
+#ifndef __UD_STANDALONE__
+  FILE*     inp_file;
+#endif
+  const uint8_t* inp_buf;
+  size_t    inp_buf_size;
+  size_t    inp_buf_index;
+  uint8_t   inp_curr;
+  size_t    inp_ctr;
+  uint8_t   inp_sess[64];
+  int       inp_end;
+  int       inp_peek;
+
+  void      (*translator)(struct ud*);
+  uint64_t  insn_offset;
+  char      insn_hexcode[64];
+
+  /*
+   * Assembly output buffer
+   */
+  char     *asm_buf;
+  size_t    asm_buf_size;
+  size_t    asm_buf_fill;
+  char      asm_buf_int[128];
+
+  /*
+   * Symbol resolver for use in the translation phase.
+   */
+  const char* (*sym_resolver)(struct ud*, uint64_t addr, int64_t *offset);
+
+  uint8_t   dis_mode;
+  uint64_t  pc;
+  uint8_t   vendor;
+  enum ud_mnemonic_code mnemonic;
+  struct ud_operand operand[4];
+  uint8_t   error;
+  uint8_t   _rex;
+  uint8_t   pfx_rex;
+  uint8_t   pfx_seg;
+  uint8_t   pfx_opr;
+  uint8_t   pfx_adr;
+  uint8_t   pfx_lock;
+  uint8_t   pfx_str;
+  uint8_t   pfx_rep;
+  uint8_t   pfx_repe;
+  uint8_t   pfx_repne;
+  uint8_t   opr_mode;
+  uint8_t   adr_mode;
+  uint8_t   br_far;
+  uint8_t   br_near;
+  uint8_t   have_modrm;
+  uint8_t   modrm;
+  uint8_t   modrm_offset;
+  uint8_t   vex_op;
+  uint8_t   vex_b1;
+  uint8_t   vex_b2;
+  uint8_t   primary_opcode;
+  void *    user_opaque_data;
+  struct ud_itab_entry * itab_entry;
+  struct ud_lookup_table_list_entry *le;
+};
+
+/* -----------------------------------------------------------------------------
+ * Type-definitions
+ * -----------------------------------------------------------------------------
+ */
+typedef enum ud_type          ud_type_t;
+typedef enum ud_mnemonic_code ud_mnemonic_code_t;
+
+typedef struct ud             ud_t;
+typedef struct ud_operand     ud_operand_t;
+
+#define UD_SYN_INTEL          ud_translate_intel
+#define UD_SYN_ATT            ud_translate_att
+#define UD_EOI                (-1)
+#define UD_INP_CACHE_SZ       32
+#define UD_VENDOR_AMD         0
+#define UD_VENDOR_INTEL       1
+#define UD_VENDOR_ANY         2
+
+#endif
+
+/*
+vim: set ts=2 sw=2 expandtab
+*/
diff --git a/disassembler/udis86/udis86_udint.h b/disassembler/udis86/udis86_udint.h
new file mode 100644
index 0000000..d166b91
--- /dev/null
+++ b/disassembler/udis86/udis86_udint.h
@@ -0,0 +1,98 @@
+/* udis86 - libudis86/udint.h -- definitions for internal use only
+ * 
+ * Copyright (c) 2002-2009 Vivek Thampi
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without modification, 
+ * are permitted provided that the following conditions are met:
+ * 
+ *     * Redistributions of source code must retain the above copyright notice, 
+ *       this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright notice, 
+ *       this list of conditions and the following disclaimer in the documentation 
+ *       and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR 
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON 
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef _UDINT_H_
+#define _UDINT_H_
+
+#include "udis86_types.h"
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif /* HAVE_CONFIG_H */
+
+#if defined(UD_DEBUG) && HAVE_ASSERT_H
+# define UD_ASSERT(_x) ASSERT(_x)
+#else
+# define UD_ASSERT(_x)
+#endif /* !HAVE_ASSERT_H */
+
+#if defined(UD_DEBUG)
+  #define UDERR(u, msg) \
+    do { \
+      (u)->error = 1; \
+      fprintf(stderr, "decode-error: %s:%d: %s", \
+              __FILE__, __LINE__, (msg)); \
+    } while (0)
+#else
+  #define UDERR(u, m) \
+    do { \
+      (u)->error = 1; \
+    } while (0)
+#endif /* !LOGERR */
+
+#define UD_RETURN_ON_ERROR(u) \
+  do { \
+    if ((u)->error != 0) { \
+      return (u)->error; \
+    } \
+  } while (0)
+
+#define UD_RETURN_WITH_ERROR(u, m) \
+  do { \
+    UDERR(u, m); \
+    return (u)->error; \
+  } while (0)
+
+#ifndef __UD_STANDALONE__
+# define UD_NON_STANDALONE(x) x
+#else
+# define UD_NON_STANDALONE(x)
+#endif
+
+/* printf formatting int64 specifier */
+#ifdef FMT64
+# undef FMT64
+#endif
+#if defined(_MSC_VER) || defined(__BORLANDC__)
+# define FMT64 "I64"
+#else
+# if defined(__APPLE__)
+#  define FMT64 "ll"
+# elif defined(__amd64__) || defined(__x86_64__)
+#  define FMT64 "l"
+# else 
+#  define FMT64 "ll"
+# endif /* !x64 */
+#endif
+
+/* define an inline macro */
+#if defined(_MSC_VER) || defined(__BORLANDC__)
+# define UD_INLINE __inline /* MS Visual Studio requires __inline
+                               instead of inline for C code */
+#else
+# define UD_INLINE inline
+#endif
+
+#endif /* _UDINT_H_ */
diff --git a/domjit/DOMJITAbstractHeap.cpp b/domjit/DOMJITAbstractHeap.cpp
new file mode 100644
index 0000000..f4855b9
--- /dev/null
+++ b/domjit/DOMJITAbstractHeap.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMJITAbstractHeap.h"
+
+#if ENABLE(JIT)
+
+namespace JSC { namespace DOMJIT {
+
+void AbstractHeap::compute(unsigned begin)
+{
+    unsigned current = begin;
+    // Increment the end of the range.
+    if (m_children.isEmpty()) {
+        m_range = HeapRange(begin, current + 1);
+        return;
+    }
+    for (auto& child : m_children) {
+        child->compute(current);
+        current = child->range().end();
+    }
+    ASSERT(begin < UINT16_MAX);
+    ASSERT(current <= UINT16_MAX);
+    m_range = HeapRange(begin, current);
+}
+
+void AbstractHeap::dump(PrintStream& out) const
+{
+    shallowDump(out);
+    if (m_parent)
+        out.print("->", *m_parent);
+}
+
+void AbstractHeap::shallowDump(PrintStream& out) const
+{
+    out.print(m_name, "<", m_range, ">");
+}
+
+void AbstractHeap::deepDump(PrintStream& out, unsigned indent) const
+{
+    auto printIndent = [&] () {
+        for (unsigned i = indent; i--;)
+            out.print("    ");
+    };
+
+    printIndent();
+    shallowDump(out);
+
+    if (m_children.isEmpty()) {
+        out.print("\n");
+        return;
+    }
+
+    out.print(":\n");
+    for (auto* child : m_children)
+        child->deepDump(out, indent + 1);
+}
+
+} }
+
+#endif
diff --git a/domjit/DOMJITAbstractHeap.h b/domjit/DOMJITAbstractHeap.h
new file mode 100644
index 0000000..be87b07
--- /dev/null
+++ b/domjit/DOMJITAbstractHeap.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITHeapRange.h"
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE(JIT)
+
+namespace JSC { namespace DOMJIT {
+
+class AbstractHeap {
+public:
+    AbstractHeap(const String& name)
+        : m_name(name)
+    {
+    }
+
+    void setParent(AbstractHeap* parent)
+    {
+        ASSERT(!m_parent);
+        parent->m_children.append(this);
+        m_parent = parent;
+    }
+
+    bool isRoot() const { return !m_parent; }
+
+    JS_EXPORT_PRIVATE void compute(unsigned begin);
+
+    bool isComputed() const { return !!m_range; }
+    HeapRange range() const { return m_range; }
+
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+    JS_EXPORT_PRIVATE void shallowDump(PrintStream&) const;
+    JS_EXPORT_PRIVATE void deepDump(PrintStream&, unsigned indent = 0) const;
+
+private:
+    String m_name;
+    AbstractHeap* m_parent { nullptr };
+    Vector<AbstractHeap*> m_children { };
+    HeapRange m_range;
+};
+
+} }
+
+#endif
diff --git a/domjit/DOMJITCallDOMGetterPatchpoint.h b/domjit/DOMJITCallDOMGetterPatchpoint.h
new file mode 100644
index 0000000..c1c2dd1
--- /dev/null
+++ b/domjit/DOMJITCallDOMGetterPatchpoint.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "DOMJITEffect.h"
+#include "DOMJITPatchpoint.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace DOMJIT {
+
+class CallDOMGetterPatchpoint : public Patchpoint {
+public:
+    static Ref<CallDOMGetterPatchpoint> create()
+    {
+        return adoptRef(*new CallDOMGetterPatchpoint());
+    }
+
+    // To look up DOMWrapper cache, GlobalObject is required.
+    // FIXME: Later, we will extend this patchpoint to represent the result type by DOMJIT::Signature.
+    // And after that, we will automatically pass a global object when the result type includes a DOM wrapper thing.
+    // https://bugs.webkit.org/show_bug.cgi?id=162980
+    bool requireGlobalObject { true };
+
+    Effect effect { };
+
+private:
+    CallDOMGetterPatchpoint() = default;
+};
+
+} }
+
+#endif
diff --git a/domjit/DOMJITEffect.h b/domjit/DOMJITEffect.h
new file mode 100644
index 0000000..61cf3b7
--- /dev/null
+++ b/domjit/DOMJITEffect.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITHeapRange.h"
+#include <wtf/Optional.h>
+
+namespace JSC { namespace DOMJIT {
+
+class Effect {
+public:
+    HeapRange reads { HeapRange::top() };
+    HeapRange writes { HeapRange::top() };
+    HeapRange def { HeapRange::top() };
+
+    constexpr Effect() = default;
+    constexpr Effect(HeapRange reads, HeapRange writes)
+        : reads(reads)
+        , writes(writes)
+    {
+    }
+
+    constexpr Effect(HeapRange reads, HeapRange writes, HeapRange def)
+        : reads(reads)
+        , writes(writes)
+        , def(def)
+    {
+    }
+
+    constexpr static Effect forWrite(HeapRange writeRange)
+    {
+        return Effect(HeapRange::none(), writeRange);
+    }
+
+    constexpr static Effect forRead(HeapRange readRange)
+    {
+        return Effect(readRange, HeapRange::none());
+    }
+
+    constexpr static Effect forReadWrite(HeapRange readRange, HeapRange writeRange)
+    {
+        return Effect(readRange, writeRange);
+    }
+
+    constexpr static Effect forPure()
+    {
+        return Effect(HeapRange::none(), HeapRange::none(), HeapRange::none());
+    }
+
+    constexpr static Effect forDef(HeapRange def)
+    {
+        return Effect(def, HeapRange::none(), def);
+    }
+
+    constexpr static Effect forDef(HeapRange def, HeapRange readRange, HeapRange writeRange)
+    {
+        return Effect(readRange, writeRange, def);
+    }
+
+    constexpr bool mustGenerate() const
+    {
+        return !!writes;
+    }
+};
+
+} }
diff --git a/domjit/DOMJITGetterSetter.h b/domjit/DOMJITGetterSetter.h
new file mode 100644
index 0000000..b94f87a
--- /dev/null
+++ b/domjit/DOMJITGetterSetter.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITCallDOMGetterPatchpoint.h"
+#include "PropertySlot.h"
+#include "PutPropertySlot.h"
+#include "SpeculatedType.h"
+
+namespace JSC { namespace DOMJIT {
+
+class GetterSetter {
+public:
+    typedef PropertySlot::GetValueFunc CustomGetter;
+    typedef PutPropertySlot::PutValueFunc CustomSetter;
+
+    GetterSetter(CustomGetter getter, CustomSetter setter, const ClassInfo* classInfo, SpeculatedType resultType)
+        : m_getter(getter)
+        , m_setter(setter)
+        , m_thisClassInfo(classInfo)
+        , m_resultType(resultType)
+    {
+    }
+
+    virtual ~GetterSetter() { }
+
+    CustomGetter getter() const { return m_getter; }
+    CustomSetter setter() const { return m_setter; }
+    const ClassInfo* thisClassInfo() const { return m_thisClassInfo; }
+    SpeculatedType resultType() const { return m_resultType; }
+
+#if ENABLE(JIT)
+    virtual Ref<DOMJIT::CallDOMGetterPatchpoint> callDOMGetter() = 0;
+    virtual Ref<DOMJIT::Patchpoint> checkDOM() = 0;
+#endif
+
+private:
+    CustomGetter m_getter;
+    CustomSetter m_setter;
+    const ClassInfo* m_thisClassInfo;
+    SpeculatedType m_resultType;
+};
+
+} }
diff --git a/domjit/DOMJITHeapRange.cpp b/domjit/DOMJITHeapRange.cpp
new file mode 100644
index 0000000..9365b2d
--- /dev/null
+++ b/domjit/DOMJITHeapRange.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMJITHeapRange.h"
+
+namespace JSC { namespace DOMJIT {
+
+void HeapRange::dump(PrintStream& out) const
+{
+    out.printf("0x%x-0x%x", static_cast<unsigned>(begin()), static_cast<unsigned>(end()));
+}
+
+} }
diff --git a/domjit/DOMJITHeapRange.h b/domjit/DOMJITHeapRange.h
new file mode 100644
index 0000000..aab02bf
--- /dev/null
+++ b/domjit/DOMJITHeapRange.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/MathExtras.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DOMJIT {
+
+class HeapRange {
+public:
+    constexpr HeapRange()
+        : m_begin(UINT16_MAX)
+        , m_end(UINT16_MAX)
+    {
+    }
+
+    HeapRange(uint16_t begin, uint16_t end)
+        : m_begin(begin)
+        , m_end(end)
+    {
+        ASSERT_WITH_MESSAGE(begin <= end, "begin <= end is the invariant of this HeapRange.");
+    }
+
+    enum ConstExprTag { ConstExpr };
+    constexpr HeapRange(ConstExprTag, uint16_t begin, uint16_t end)
+        : m_begin(begin)
+        , m_end(end)
+    {
+    }
+
+    enum RawRepresentationTag { RawRepresentation };
+    explicit constexpr HeapRange(RawRepresentationTag, uint32_t value)
+        : m_raw(value)
+    {
+    }
+
+    constexpr static HeapRange fromRaw(uint32_t value)
+    {
+        return HeapRange(RawRepresentation, value);
+    }
+
+    uint16_t begin() const { return m_begin; }
+    uint16_t end() const { return m_end; }
+    uint32_t rawRepresentation() { return m_raw; }
+
+    constexpr explicit operator bool() const
+    {
+        return m_begin != m_end;
+    }
+
+    constexpr bool operator==(const HeapRange& other) const
+    {
+        return m_begin == other.m_begin && m_end == other.m_end;
+    }
+
+    constexpr bool operator!=(const HeapRange& other) const
+    {
+        return !operator==(other);
+    }
+
+    template<uint16_t begin, uint16_t end>
+    static constexpr HeapRange fromConstant()
+    {
+        static_assert(begin < end || (begin == UINT16_MAX && end == UINT16_MAX), "begin < end or the both are UINT16_MAX is the invariant of this HeapRange.");
+        return HeapRange(ConstExpr, begin, end);
+    }
+
+    static constexpr HeapRange top() { return fromConstant<0, UINT16_MAX>(); }
+    static constexpr HeapRange none() { return fromConstant<UINT16_MAX, UINT16_MAX>(); } // Empty range.
+
+    bool isStrictSubtypeOf(const HeapRange& other) const
+    {
+        if (!*this || !other)
+            return false;
+        if (*this == other)
+            return false;
+        return other.m_begin <= m_begin && m_end <= other.m_end;
+    }
+
+    bool isSubtypeOf(const HeapRange& other) const
+    {
+        if (!*this || !other)
+            return false;
+        if (*this == other)
+            return true;
+        return isStrictSubtypeOf(other);
+    }
+
+    bool overlaps(const HeapRange& other) const
+    {
+        return WTF::rangesOverlap(m_begin, m_end, other.m_begin, other.m_end);
+    }
+
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+
+private:
+    union {
+        struct {
+            uint16_t m_begin;
+            uint16_t m_end;
+        };
+        uint32_t m_raw;
+    };
+};
+
+} }
diff --git a/domjit/DOMJITPatchpoint.h b/domjit/DOMJITPatchpoint.h
new file mode 100644
index 0000000..bb9f5e4
--- /dev/null
+++ b/domjit/DOMJITPatchpoint.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace DOMJIT {
+
+class PatchpointParams;
+
+typedef CCallHelpers::JumpList PatchpointGeneratorFunction(CCallHelpers&, PatchpointParams&);
+typedef SharedTask<PatchpointGeneratorFunction> PatchpointGenerator;
+
+// DOMJIT patchpoint is the way to inject an opaque code generator into DFG and FTL.
+// While B3::Patchpoint is self-contained about its compilation information,
+// DOMJIT::Patchpoint depends on which DFG Node invokes. For example, CheckDOM will
+// link returned failureCases to BadType OSRExit, but this information is offered
+// from CheckDOM DFG Node, not from this patchpoint. This patchpoint mainly focuses
+// on injecting a snippet generator that can tell register usage and can be used
+// in both DFG and FTL.
+class Patchpoint : public ThreadSafeRefCounted<Patchpoint> {
+public:
+    static Ref<Patchpoint> create()
+    {
+        return adoptRef(*new Patchpoint());
+    }
+
+    template<typename Functor>
+    void setGenerator(const Functor& functor)
+    {
+        m_generator = createSharedTask<PatchpointGeneratorFunction>(functor);
+    }
+
+    RefPtr<PatchpointGenerator> generator() const { return m_generator; }
+
+    uint8_t numGPScratchRegisters { 0 };
+    uint8_t numFPScratchRegisters { 0 };
+
+protected:
+    Patchpoint() = default;
+
+private:
+    RefPtr<PatchpointGenerator> m_generator;
+};
+
+} }
+
+#endif
diff --git a/domjit/DOMJITPatchpointParams.h b/domjit/DOMJITPatchpointParams.h
new file mode 100644
index 0000000..d83b6b0
--- /dev/null
+++ b/domjit/DOMJITPatchpointParams.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "DOMJITSlowPathCalls.h"
+#include "DOMJITValue.h"
+#include "JITOperations.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace DOMJIT {
+
+class PatchpointParams {
+WTF_MAKE_NONCOPYABLE(PatchpointParams);
+public:
+    virtual ~PatchpointParams() { }
+
+    unsigned size() const { return m_regs.size(); }
+    const Value& at(unsigned index) const { return m_regs[index]; }
+    const Value& operator[](unsigned index) const { return at(index); }
+
+    GPRReg gpScratch(unsigned index) const { return m_gpScratch[index]; }
+    FPRReg fpScratch(unsigned index) const { return m_fpScratch[index]; }
+
+    PatchpointParams(Vector<Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
+        : m_regs(WTFMove(regs))
+        , m_gpScratch(WTFMove(gpScratch))
+        , m_fpScratch(WTFMove(fpScratch))
+    {
+    }
+
+    template<typename FunctionType, typename ResultType, typename... Arguments>
+    void addSlowPathCall(CCallHelpers::JumpList from, CCallHelpers& jit, FunctionType function, ResultType result, Arguments... arguments)
+    {
+        addSlowPathCallImpl(from, jit, function, result, std::make_tuple(arguments...));
+    }
+
+private:
+#define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) JS_EXPORT_PRIVATE virtual void addSlowPathCallImpl(CCallHelpers::JumpList, CCallHelpers&, OperationType, ResultType, std::tuple<__VA_ARGS__> args) = 0;
+    DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
+#undef JSC_DEFINE_CALL_OPERATIONS
+
+    Vector<Value> m_regs;
+    Vector<GPRReg> m_gpScratch;
+    Vector<FPRReg> m_fpScratch;
+};
+
+} }
+
+#endif
diff --git a/domjit/DOMJITReg.h b/domjit/DOMJITReg.h
new file mode 100644
index 0000000..ea9eab8
--- /dev/null
+++ b/domjit/DOMJITReg.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Reg.h"
+#include <wtf/Variant.h>
+
+#if ENABLE(JIT)
+
+namespace JSC { namespace DOMJIT {
+
+// It is quite unfortunate that 32 bit environment exists on DFG! This means that JSValueRegs contains 2 registers
+// in such an environment. If we use GPRReg and FPRReg in DOMJITPatchpointParams, DOMJITPatchpointParams may contain
+// different number of registers in 32bit and 64bit environments when we pass JSValueRegs, it is confusing.
+// Therefore, we introduce an abstraction that DOMJIT::Reg, which is a polymorphic register class. It can refer FPRReg,
+// GPRReg, and "JSValueRegs". Note that isGPR() will return false if the target Reg is "JSValueRegs" even if the
+// environment is 64bit.
+//
+// FIXME: Eventually we should move this class into JSC and make is available for other JIT code.
+// https://bugs.webkit.org/show_bug.cgi?id=162990
+class Reg {
+public:
+    enum class Type : uint8_t {
+        GPR = 0,
+        FPR = 1,
+        JSValue = 2,
+    };
+
+    Reg(GPRReg reg)
+        : m_variant(reg)
+    {
+    }
+
+    Reg(FPRReg reg)
+        : m_variant(reg)
+    {
+    }
+
+    Reg(JSValueRegs regs)
+        : m_variant(regs)
+    {
+    }
+
+    bool isGPR() const { return m_variant.index() == static_cast<unsigned>(Type::GPR); }
+    bool isFPR() const { return m_variant.index() == static_cast<unsigned>(Type::FPR); }
+    bool isJSValueRegs() const { return m_variant.index() == static_cast<unsigned>(Type::JSValue); }
+
+    GPRReg gpr() const
+    {
+        ASSERT(isGPR());
+        return WTF::get<GPRReg>(m_variant);
+    }
+    FPRReg fpr() const
+    {
+        ASSERT(isFPR());
+        return WTF::get<FPRReg>(m_variant);
+    }
+    JSValueRegs jsValueRegs() const
+    {
+        ASSERT(isJSValueRegs());
+        return WTF::get<JSValueRegs>(m_variant);
+    }
+
+private:
+    Variant<GPRReg, FPRReg, JSValueRegs> m_variant;
+};
+
+} }
+
+#endif
diff --git a/domjit/DOMJITSignature.h b/domjit/DOMJITSignature.h
new file mode 100644
index 0000000..a37a6fd
--- /dev/null
+++ b/domjit/DOMJITSignature.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ClassInfo.h"
+#include "DOMJITEffect.h"
+#include "SpeculatedType.h"
+
+namespace JSC { namespace DOMJIT {
+
+// FIXME: Currently, we only support functions which arguments are up to 2.
+// Eventually, we should extend this. But possibly, 2 or 3 can cover typical use cases.
+// https://bugs.webkit.org/show_bug.cgi?id=164346
+#define JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS 2
+#define JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS_INCLUDING_THIS (1 + JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS)
+
+class Patchpoint;
+
+typedef Ref<Patchpoint> CheckDOMGeneratorFunction(void);
+
+class Signature {
+public:
+    template<typename... Arguments>
+    constexpr Signature(uintptr_t unsafeFunction, CheckDOMGeneratorFunction* checkDOMGeneratorFunction, const ClassInfo* classInfo, Effect effect, SpeculatedType result, Arguments... arguments)
+        : unsafeFunction(unsafeFunction)
+        , checkDOMGeneratorFunction(checkDOMGeneratorFunction)
+        , classInfo(classInfo)
+        , effect(effect)
+        , result(result)
+        , arguments {static_cast<SpeculatedType>(arguments)...}
+        , argumentCount(sizeof...(Arguments))
+    {
+    }
+
+#if ENABLE(JIT)
+    Ref<Patchpoint> checkDOM() const
+    {
+        return checkDOMGeneratorFunction();
+    }
+#endif
+
+    uintptr_t unsafeFunction;
+    CheckDOMGeneratorFunction* checkDOMGeneratorFunction;
+    const ClassInfo* const classInfo;
+    const Effect effect;
+    const SpeculatedType result;
+    const SpeculatedType arguments[JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS];
+    const unsigned argumentCount;
+};
+
+} }
diff --git a/domjit/DOMJITSlowPathCalls.h b/domjit/DOMJITSlowPathCalls.h
new file mode 100644
index 0000000..cb22b1f
--- /dev/null
+++ b/domjit/DOMJITSlowPathCalls.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+// macro(OperationType, ArgType1, ArgType2, ...)
+#define DOMJIT_SLOW_PATH_CALLS(macro) \
+    macro(J_JITOperation_EP, JSValueRegs, GPRReg) \
+    macro(J_JITOperation_EGP, JSValueRegs, GPRReg, GPRReg) \
+
+#endif
diff --git a/domjit/DOMJITValue.h b/domjit/DOMJITValue.h
new file mode 100644
index 0000000..de6cb93
--- /dev/null
+++ b/domjit/DOMJITValue.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DOMJITReg.h"
+
+#if ENABLE(JIT)
+
+namespace JSC { namespace DOMJIT {
+
+class Value {
+public:
+    Value(Reg reg)
+        : m_reg(reg)
+    {
+    }
+
+    Value(Reg reg, JSValue value)
+        : m_reg(reg)
+        , m_value(value)
+    {
+    }
+
+    bool isGPR() const { return m_reg.isGPR(); }
+    bool isFPR() const { return m_reg.isFPR(); }
+    bool isJSValueRegs() const { return m_reg.isJSValueRegs(); }
+    GPRReg gpr() const { return m_reg.gpr(); }
+    FPRReg fpr() const { return m_reg.fpr(); }
+    JSValueRegs jsValueRegs() const { return m_reg.jsValueRegs(); }
+
+    Reg reg() const
+    {
+        return m_reg;
+    }
+
+    JSValue value() const
+    {
+        return m_value;
+    }
+
+private:
+    Reg m_reg;
+    JSValue m_value;
+};
+
+} }
+
+#endif
diff --git a/dynbench.cpp b/dynbench.cpp
new file mode 100644
index 0000000..16065db
--- /dev/null
+++ b/dynbench.cpp
@@ -0,0 +1,242 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "Identifier.h"
+#include "InitializeThreading.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSGlobalObject.h"
+#include "JSLock.h"
+#include "JSObject.h"
+#include "VM.h"
+#include <wtf/MainThread.h>
+
+using namespace JSC;
+
+namespace {
+
+StaticLock crashLock;
+const char* nameFilter;
+unsigned requestedIterationCount;
+
+#define CHECK(x) do {                                                   \
+        if (!!(x))                                                      \
+            break;                                                      \
+        crashLock.lock();                                               \
+        WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, #x); \
+        CRASH();                                                        \
+    } while (false)
+
+template<typename Callback>
+NEVER_INLINE void benchmarkImpl(const char* name, unsigned iterationCount, const Callback& callback)
+{
+    if (nameFilter && !strcasestr(name, nameFilter))
+        return;
+
+    if (requestedIterationCount)
+        iterationCount = requestedIterationCount;
+    
+    double before = monotonicallyIncreasingTimeMS();
+    callback(iterationCount);
+    double after = monotonicallyIncreasingTimeMS();
+    dataLog(name, ": ", after - before, " ms.\n");
+}
+
+} // anonymous namespace
+
+int main(int argc, char** argv)
+{
+    if (argc >= 2) {
+        if (argv[1][0] == '-') {
+            dataLog("Usage: dynbench [<filter> [<iteration count>]]\n");
+            return 1;
+        }
+
+        nameFilter = argv[1];
+
+        if (argc >= 3) {
+            if (sscanf(argv[2], "%u", &requestedIterationCount) != 1) {
+                dataLog("Could not parse iteration count ", argv[2], "\n");
+                return 1;
+            }
+        }
+    }
+    
+    WTF::initializeMainThread();
+    JSC::initializeThreading();
+
+    VM* vm = &VM::create(LargeHeap).leakRef();
+    {
+        JSLockHolder locker(vm);
+
+        JSGlobalObject* globalObject =
+            JSGlobalObject::create(*vm, JSGlobalObject::createStructure(*vm, jsNull()));
+        ExecState* exec = globalObject->globalExec();
+
+        Identifier identF = Identifier::fromString(exec, "f");
+        Identifier identG = Identifier::fromString(exec, "g");
+
+        Structure* objectStructure =
+            JSFinalObject::createStructure(*vm, globalObject, globalObject->objectPrototype(), 2);
+
+        // Non-strict dynamic get by id:
+        JSValue object = JSFinalObject::create(*vm, objectStructure);
+        {
+            PutPropertySlot slot(object, false, PutPropertySlot::PutById);
+            object.putInline(exec, identF, jsNumber(42), slot);
+        }
+        {
+            PutPropertySlot slot(object, false, PutPropertySlot::PutById);
+            object.putInline(exec, identG, jsNumber(43), slot);
+        }
+        benchmarkImpl(
+            "Non Strict Dynamic Get By Id",
+            1000000,
+            [&] (unsigned iterationCount) {
+                for (unsigned i = iterationCount; i--;) {
+                    JSValue result = object.get(exec, identF);
+                    CHECK(result == jsNumber(42));
+                    result = object.get(exec, identG);
+                    CHECK(result == jsNumber(43));
+                }
+            });
+
+        // Non-strict dynamic put by id replace:
+        object = JSFinalObject::create(*vm, objectStructure);
+        {
+            PutPropertySlot slot(object, false, PutPropertySlot::PutById);
+            object.putInline(exec, identF, jsNumber(42), slot);
+        }
+        {
+            PutPropertySlot slot(object, false, PutPropertySlot::PutById);
+            object.putInline(exec, identG, jsNumber(43), slot);
+        }
+        benchmarkImpl(
+            "Non Strict Dynamic Put By Id Replace",
+            1000000,
+            [&] (unsigned iterationCount) {
+                for (unsigned i = iterationCount; i--;) {
+                    {
+                        PutPropertySlot slot(object, false, PutPropertySlot::PutById);
+                        object.putInline(exec, identF, jsNumber(i), slot);
+                    }
+                    {
+                        PutPropertySlot slot(object, false, PutPropertySlot::PutById);
+                        object.putInline(exec, identG, jsNumber(i), slot);
+                    }
+                }
+            });
+
+        // Non-strict dynamic put by id transition with object allocation:
+        benchmarkImpl(
+            "Non Strict Dynamic Allocation and Put By Id Transition",
+            1000000,
+            [&] (unsigned iterationCount) {
+                for (unsigned i = iterationCount; i--;) {
+                    JSValue object = JSFinalObject::create(*vm, objectStructure);
+                    {
+                        PutPropertySlot slot(object, false, PutPropertySlot::PutById);
+                        object.putInline(exec, identF, jsNumber(i), slot);
+                    }
+                    {
+                        PutPropertySlot slot(object, false, PutPropertySlot::PutById);
+                        object.putInline(exec, identG, jsNumber(i), slot);
+                    }
+                }
+            });
+
+        // Non-strict dynamic get by id with dynamic store context:
+        object = JSFinalObject::create(*vm, objectStructure);
+        {
+            PutPropertySlot slot(object, false);
+            object.putInline(exec, identF, jsNumber(42), slot);
+        }
+        {
+            PutPropertySlot slot(object, false);
+            object.putInline(exec, identG, jsNumber(43), slot);
+        }
+        benchmarkImpl(
+            "Non Strict Dynamic Get By Id With Dynamic Store Context",
+            1000000,
+            [&] (unsigned iterationCount) {
+                for (unsigned i = iterationCount; i--;) {
+                    JSValue result = object.get(exec, identF);
+                    CHECK(result == jsNumber(42));
+                    result = object.get(exec, identG);
+                    CHECK(result == jsNumber(43));
+                }
+            });
+
+        // Non-strict dynamic put by id replace with dynamic store context:
+        object = JSFinalObject::create(*vm, objectStructure);
+        {
+            PutPropertySlot slot(object, false);
+            object.putInline(exec, identF, jsNumber(42), slot);
+        }
+        {
+            PutPropertySlot slot(object, false);
+            object.putInline(exec, identG, jsNumber(43), slot);
+        }
+        benchmarkImpl(
+            "Non Strict Dynamic Put By Id Replace With Dynamic Store Context",
+            1000000,
+            [&] (unsigned iterationCount) {
+                for (unsigned i = iterationCount; i--;) {
+                    {
+                        PutPropertySlot slot(object, false);
+                        object.putInline(exec, identF, jsNumber(i), slot);
+                    }
+                    {
+                        PutPropertySlot slot(object, false);
+                        object.putInline(exec, identG, jsNumber(i), slot);
+                    }
+                }
+            });
+
+        // Non-strict dynamic put by id transition with object allocation with dynamic store context:
+        benchmarkImpl(
+            "Non Strict Dynamic Allocation and Put By Id Transition With Dynamic Store Context",
+            1000000,
+            [&] (unsigned iterationCount) {
+                for (unsigned i = iterationCount; i--;) {
+                    JSValue object = JSFinalObject::create(*vm, objectStructure);
+                    {
+                        PutPropertySlot slot(object, false);
+                        object.putInline(exec, identF, jsNumber(i), slot);
+                    }
+                    {
+                        PutPropertySlot slot(object, false);
+                        object.putInline(exec, identG, jsNumber(i), slot);
+                    }
+                }
+            });
+    }
+
+    crashLock.lock();
+    return 0;
+}
+
diff --git a/entitlements.plist b/entitlements.plist
new file mode 100644
index 0000000..9a1d0fb
--- /dev/null
+++ b/entitlements.plist
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>dynamic-codesigning</key>
+	<true/>
+</dict>
+</plist>
diff --git a/features.json b/features.json
new file mode 100644
index 0000000..3ccf419
--- /dev/null
+++ b/features.json
@@ -0,0 +1,404 @@
+{
+    "specification": [
+    {
+        "name": "ES6",
+        "url": "http://wiki.ecmascript.org/doku.php?id=harmony:specification_drafts",
+        "keywords": ["es6", "es2015", "ecmascript"],
+        "status": {
+            "status": "Done"
+        },
+        "contact": [
+            {
+                "name": "Saam Barati",
+                "email": "sbarati@apple.com",
+                "twitter": "@saambarati"
+            },
+            {
+                "name": "Keith Miller",
+                "email": "keith_miller@apple.com"
+            }
+        ]
+    },
+    {
+        "name": "ES7",
+        "url": "https://github.com/tc39/ecma262",
+        "keywords": ["es7", "ecmascript"]
+    },
+    {
+        "name": "Internationalization API",
+        "status": {
+            "status": "Done"
+        },
+        "url": "http://ecma-international.org/publications/standards/Ecma-402.htm",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=90906",
+        "description": "The Internationalization API provides language sensitive operations for  string, number, and date.",
+        "keywords": ["Intl", "Collator", "ECMA-402"]
+    },
+    {
+        "name": "WebAssembly",
+        "status": {
+            "status": "In Development"
+        },
+        "url": "http://webassembly.github.io",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=146064",
+        "description": "WebAssembly is a new format for native programs on the web. It aims to support everything that asm.js supports, but allows the VM to sidestep the JS parsing and profiling pipeline entirely.",
+        "keywords": ["webassembly", "wasm", "webassy"],
+        "contact": {
+            "name": "Jon Davis",
+            "email": "web-evangelist@apple.com",
+            "twitter": "@jonathandavis"
+        }
+    }
+    ],
+
+    "features": [
+    {
+        "name": "ASM.js",
+        "status": {
+            "status": "In Development",
+            "enabled-by-default": true
+        },
+        "url": "http://asmjs.org",
+        "description": "ASM.js defines a subset of JavaScript that enforce stronger typing and has specific patterns of memory access. ASM.js is rarely hand-written, it is typically generated from other languages by compiler such as Emscripten.",
+        "comment": "There is no \"use asm\" mode in JavaScriptCore. Instead WebKit integrates ASM.js optimizations directly in the optimizer. As a result, it is possible to mix ASM-style typing with regular code and still get great performance and power efficiency."
+    },
+    {
+        "name": "Array.prototype.copyWithin",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "https://people.mozilla.org/~jorendorff/es6-draft.html#sec-array.prototype.copywithin",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/copyWithin",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=145107",
+        "specification": "ES6",
+        "contact": {
+            "name": "Yusuke Suzuki",
+            "email": "utatane.tea@gmail.com"
+        }
+    },
+    {
+        "name": "Array.prototype.includes",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "https://github.com/tc39/Array.prototype.includes",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/includes",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=142707",
+        "specification": "ES7"
+    },
+    {
+        "name": "Arrow Functions",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/index.html#sec-arrow-function-definitions",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/Arrow_functions",
+        "description": "Arrow functions are a new type of function expression in ES6 that lexically binds this, new.target, arguments, and super.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Block Scoping",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/#sec-let-and-const-declarations",
+        "documentation-url": "http://www.2ality.com/2015/02/es6-scoping.html",
+        "description": "Block Scoping let/const/class variables are a new way of declaring variables that are local to the block they're defined in. They have clearer scoping semantics than var variables.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Classes",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/#sec-class-definitions",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes",
+        "description": "Classes are a way to write object oriented code in JavaScript with standard syntax and semantics.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Default Parameter Values",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/#sec-function-definitions",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/Default_parameters",
+        "description": "Default parameter values are a convenient way to specify expressions that parameters should evaluate to when undefined (or nothing) is passed in as a function argument.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Destructuring Syntax",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/#sec-destructuring-assignment",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Destructuring_assignment",
+        "description": "Destructuring syntax is a shorthand form that allows you to easily assign local variables to the values of an object or array's properties.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Exponentiation Syntax",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "https://tc39.github.io/ecma262/#prod-ExponentiationExpression",
+        "specification": "ES7",
+        "description": "Exponentiation syntax (like x ** y) provides the syntax suger for exponentiation.",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=159969",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Arithmetic_Operators#Exponentiation_(**)",
+        "contact": {
+            "name": "Yusuke Suzuki",
+            "twitter": "@Constellation",
+            "email": "utatane.tea@gmail.com"
+        }
+    },
+    {
+        "name": "Generators",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/index.html#sec-generator-objects",
+        "specification": "ES6",
+        "description": "An iterative function object that is interruptible and resumable. Generators are currently spec compliant, however, we're still actively working on improving their performance.",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=150290",
+        "documentation-url": "https://hacks.mozilla.org/2015/05/es6-in-depth-generators/",
+        "contact": {
+            "name": "Yusuke Suzuki",
+            "twitter": "@Constellation",
+            "email": "utatane.tea@gmail.com"
+        }
+    },
+    {
+        "name": "Map Data Structure",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://people.mozilla.org/~jorendorff/es6-draft.html#sec-map-constructor",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=120333",
+        "description": "Map provides an <a href=\"https://en.wikipedia.org/wiki/Associative_array\">associative array data</a> structure that maps keys to values.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Modules",
+        "status": {
+            "status": "In Development",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/index.html#sec-modules",
+        "documentation-url": "https://hacks.mozilla.org/2015/08/es6-in-depth-modules/",
+        "description": "Modules make modularizing code and splitting it across different files easy because the syntax and semantics are now standard in the JavaScript langauge.",
+        "specification": "ES6",
+        "comment": "ES6 work is done, however, this feature is still listed as \"In Development\" because the module loading specification has yet to be finalized <a href=\"https:\/\/whatwg.github.io\/loader\/\"><\/a>. It is possible to use Modules with the jsc command line tool by passing the -m flag, although it is primarily intended for testing."
+    },
+    {
+        "name": "Number Object Extensions",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://people.mozilla.org/~jorendorff/es6-draft.html#sec-number-objects",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=131707",
+        "specification": "ES6",
+        "description": "Extend Number with the methods Number.isFinite(), Number.isInteger(), Number.isSafeInteger(), Number.isNaN() and the attributes Number.EPSILON, Number.MIN_SAFE_INTEGER, Number.MAX_SAFE_INTEGER."
+    },
+    {
+        "name": "Octal and Binary Literals",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "https://people.mozilla.org/~jorendorff/es6-draft.html#sec-literals-numeric-literals",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=142681",
+        "specification": "ES6",
+        "description": "New syntax for number literals. Numbers can be provided as binary (e.g. 0b001001) or octal (e.g. 0o24)."
+    },
+    {
+        "name": "Promise Objects",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true,
+            "shipped": ["ios8-safari", "osx-safari-7.1"]
+        },
+        "url": "https://people.mozilla.org/~jorendorff/es6-draft.html#sec-promise-objects",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=120260",
+        "specification": "ES6"
+    },
+    {
+        "name": "Proxy Objects",
+        "status": {
+            "status": "Done"
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/index.html#sec-proxy-objects",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=35731",
+        "specification": "ES6",
+        "description": "An intermediary object that defines custom basic behaviors of another object such as property lookup, assignment, enumeration.",
+        "contact": {
+            "name": "Jon Davis",
+            "twitter": "@jonathandavis",
+            "email": "web-evangelist@apple.com"
+        }
+    },
+    {
+        "name": "Reflect API",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/#sec-reflect-object",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Reflect",
+        "description": "The Reflect API is a way to set properties and call methods on certain objects that can be intercepted by ES6 Proxies.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Rest Parameter",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/#sec-function-definitions",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/rest_parameters",
+        "description": "Rest parameters allow you to collect the arguments, or the arguments after some offset, of a function into a JS array.",
+        "specification": "ES6",
+        "contact": {
+            "name": "Saam Barati",
+            "email": "sbarati@apple.com",
+            "twitter": "@saambarati"
+        }
+    },
+    {
+        "name": "Set Data Structure",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "https://people.mozilla.org/~jorendorff/es6-draft.html#sec-set-constructor",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Set",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=120549",
+        "description": "Set is a collection of unique objects.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Symbol Objects",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "https://people.mozilla.org/~jorendorff/es6-draft.html#sec-symbol-objects",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=140435",
+        "specification": "ES6",
+        "contact": {
+            "name": "Yusuke Suzuki",
+            "email": "utatane.tea@gmail.com"
+        }
+    },
+    {
+        "name": "Tagged Templates",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://people.mozilla.org/~jorendorff/es6-draft.html#sec-tagged-templates",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/template_strings",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=143183",
+        "description": "The tagged-templates (like String.raw`Hello ${World}`) provides a way to modify the produced string from a given template-literals with a function.",
+        "specification": "ES6",
+        "contact": {
+            "name": "Yusuke Suzuki",
+            "email": "utatane.tea@gmail.com"
+        }
+    },
+    {
+        "name": "Tail Calls",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/index.html#sec-tail-position-calls",
+        "documentation-url": "http://www.2ality.com/2015/06/tail-call-optimization.html",
+        "description": "Tail Calls allow you to make function calls that are in tail position without growing the stack. It is commonly used to write loops using function calls instead of for or while syntax.",
+        "specification": "ES6"
+    },
+    {
+        "name": "Template Literals",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://people.mozilla.org/~jorendorff/es6-draft.html#sec-template-literals",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/template_strings",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=142691",
+        "description": "The template-literals (like `Hello ${World}`) provides string interpolation feature. Line terminators are also allowed in the template-literals.",
+        "specification": "ES6",
+        "contact": {
+            "name": "Yusuke Suzuki",
+            "email": "utatane.tea@gmail.com"
+        }
+    },
+    {
+        "name": "WeakMap",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://people.mozilla.org/~jorendorff/es6-draft.html#sec-weakmap-objects",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WeakMap",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=120912",
+        "description": "WeakMap provides an <a href=\"https://en.wikipedia.org/wiki/Associative_array\">associative array data</a> structure that maps keys to values. WeakMap's keys must be objects.",
+        "specification": "ES6"
+    },
+    {
+        "name": "WeakSet",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://people.mozilla.org/~jorendorff/es6-draft.html#sec-weakset-objects",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/WeakSet",
+        "webkit-url": "https://bugs.webkit.org/show_bug.cgi?id=142408",
+        "description": "WeakSet is a collection of unique objects. Keys stored in WeakSet are referenced weakly.",
+        "specification": "ES6",
+        "contact": {
+            "name": "Yusuke Suzuki",
+            "email": "utatane.tea@gmail.com"
+        }
+    },
+    {
+        "name": "for...of Loops",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://people.mozilla.org/~jorendorff/es6-draft.html#sec-for-in-and-for-of-statements",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for...of",
+        "description": "The for...of loops iterate over the values provided by the iterator of the target object.",
+        "specification": "ES6",
+        "comment": "Older versions of WebKit only supported iterating JavaScript arrays."
+    },
+    {
+        "name": "new.target",
+        "status": {
+            "status": "Done",
+            "enabled-by-default": true
+        },
+        "url": "http://www.ecma-international.org/ecma-262/6.0/#sec-built-in-function-objects",
+        "documentation-url": "https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target",
+        "description": "new.target allows you to detect if a function or constructor was instantiated with the new operator, or if instead it was called using normal function calling syntax.",
+        "specification": "ES6"
+    }
+    ]
+}
diff --git a/framework.sb b/framework.sb
new file mode 100644
index 0000000..4bd10c6
--- /dev/null
+++ b/framework.sb
@@ -0,0 +1,24 @@
+; Copyright (C) 2014 Apple Inc. All rights reserved.
+;
+; Redistribution and use in source and binary forms, with or without
+; modification, are permitted provided that the following conditions
+; are met:
+; 1. Redistributions of source code must retain the above copyright
+;    notice, this list of conditions and the following disclaimer.
+; 2. Redistributions in binary form must reproduce the above copyright
+;    notice, this list of conditions and the following disclaimer in the
+;    documentation and/or other materials provided with the distribution.
+;
+; THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+; THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+; PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+; BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+; THE POSSIBILITY OF SUCH DAMAGE.
+
+(allow mach-lookup (global-name "com.apple.webinspector"))
diff --git a/ftl/FTLAbbreviatedTypes.h b/ftl/FTLAbbreviatedTypes.h
new file mode 100644
index 0000000..7a64d4d
--- /dev/null
+++ b/ftl/FTLAbbreviatedTypes.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGCommon.h"
+
+namespace JSC { namespace B3 {
+class BasicBlock;
+class Value;
+enum Type : int8_t;
+} }
+
+namespace JSC { namespace FTL {
+
+typedef B3::BasicBlock* LBasicBlock;
+typedef B3::Type LType;
+typedef B3::Value* LValue;
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLAbstractHeap.cpp b/ftl/FTLAbstractHeap.cpp
new file mode 100644
index 0000000..90211fd
--- /dev/null
+++ b/ftl/FTLAbstractHeap.cpp
@@ -0,0 +1,273 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLAbstractHeap.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGCommon.h"
+#include "FTLAbbreviatedTypes.h"
+#include "FTLAbstractHeapRepository.h"
+#include "FTLOutput.h"
+#include "FTLTypedPointer.h"
+#include "JSCInlines.h"
+#include "Options.h"
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+
+AbstractHeap::AbstractHeap(AbstractHeap* parent, const char* heapName, ptrdiff_t offset)
+    : m_offset(offset)
+    , m_heapName(heapName)
+{
+    changeParent(parent);
+}
+
+void AbstractHeap::changeParent(AbstractHeap* parent)
+{
+    if (m_parent) {
+        bool result = m_parent->m_children.removeFirst(this);
+        RELEASE_ASSERT(result);
+    }
+
+    m_parent = parent;
+
+    if (parent) {
+        ASSERT(!m_parent->m_children.contains(this));
+        m_parent->m_children.append(this);
+    }
+}
+
+void AbstractHeap::compute(unsigned begin)
+{
+    // This recursively computes the ranges of the tree. This solves the following constraints
+    // in linear time:
+    //
+    // - A node's end is greater than its begin.
+    // - A node's begin is greater than or equal to its parent's begin.
+    // - A node's end is less than or equal to its parent's end.
+    // - The ranges are as small as possible.
+    //
+    // It's OK to recurse because we keep the depth of our abstract heap hierarchy fairly sane.
+    // I think that it gets 4 deep at most.
+
+    if (m_children.isEmpty()) {
+        // Must special-case leaves so that they use just one slot on the number line.
+        m_range = HeapRange(begin);
+        return;
+    }
+
+    unsigned current = begin;
+    for (AbstractHeap* child : m_children) {
+        child->compute(current);
+        current = child->range().end();
+    }
+
+    m_range = HeapRange(begin, current);
+}
+
+void AbstractHeap::shallowDump(PrintStream& out) const
+{
+    out.print(heapName(), "(", m_offset, ")");
+    if (m_range)
+        out.print("<", m_range, ">");
+}
+
+void AbstractHeap::dump(PrintStream& out) const
+{
+    shallowDump(out);
+    if (m_parent)
+        out.print("->", *m_parent);
+}
+
+void AbstractHeap::deepDump(PrintStream& out, unsigned indent) const
+{
+    auto printIndent = [&] () {
+        for (unsigned i = indent; i--;)
+            out.print("    ");
+    };
+
+    printIndent();
+    shallowDump(out);
+
+    if (m_children.isEmpty()) {
+        out.print("\n");
+        return;
+    }
+
+    out.print(":\n");
+    for (AbstractHeap* child : m_children)
+        child->deepDump(out, indent + 1);
+}
+
+void AbstractHeap::badRangeError() const
+{
+    dataLog("Heap does not have range: ", *this, "\n");
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+IndexedAbstractHeap::IndexedAbstractHeap(AbstractHeap* parent, const char* heapName, ptrdiff_t offset, size_t elementSize)
+    : m_heapForAnyIndex(parent, heapName)
+    , m_heapNameLength(strlen(heapName))
+    , m_offset(offset)
+    , m_elementSize(elementSize)
+{
+}
+
+IndexedAbstractHeap::~IndexedAbstractHeap()
+{
+}
+
+TypedPointer IndexedAbstractHeap::baseIndex(Output& out, LValue base, LValue index, JSValue indexAsConstant, ptrdiff_t offset)
+{
+    if (indexAsConstant.isInt32())
+        return out.address(base, at(indexAsConstant.asInt32()), offset);
+
+    LValue result = out.add(base, out.mul(index, out.constIntPtr(m_elementSize)));
+    
+    return TypedPointer(atAnyIndex(), out.addPtr(result, m_offset + offset));
+}
+
+const AbstractHeap& IndexedAbstractHeap::atSlow(ptrdiff_t index)
+{
+    ASSERT(static_cast<size_t>(index) >= m_smallIndices.size());
+    
+    if (UNLIKELY(!m_largeIndices))
+        m_largeIndices = std::make_unique<MapType>();
+
+    std::unique_ptr<AbstractHeap>& field = m_largeIndices->add(index, nullptr).iterator->value;
+    if (!field) {
+        field = std::make_unique<AbstractHeap>();
+        initialize(*field, index);
+    }
+
+    return *field;
+}
+
+void IndexedAbstractHeap::initialize(AbstractHeap& field, ptrdiff_t signedIndex)
+{
+    // Build up a name of the form:
+    //
+    //    heapName_hexIndex
+    //
+    // or:
+    //
+    //    heapName_neg_hexIndex
+    //
+    // For example if you access an indexed heap called FooBar at index 5, you'll
+    // get:
+    //
+    //    FooBar_5
+    //
+    // Or if you access an indexed heap called Blah at index -10, you'll get:
+    //
+    //    Blah_neg_A
+    //
+    // This naming convention comes from our previous use of LLVM. It's not clear that we need
+    // it anymore, though it is sort of nifty. Basically, B3 doesn't need string names for
+    // abstract heaps, but the fact that we have a reasonably efficient way to always name the
+    // heaps will probably come in handy for debugging.
+    
+    static const char* negSplit = "_neg_";
+    static const char* posSplit = "_";
+    
+    bool negative;
+    size_t index;
+    if (signedIndex < 0) {
+        negative = true;
+        index = -signedIndex;
+    } else {
+        negative = false;
+        index = signedIndex;
+    }
+    
+    for (unsigned power = 4; power <= sizeof(void*) * 8; power += 4) {
+        if (isGreaterThanNonZeroPowerOfTwo(index, power))
+            continue;
+        
+        unsigned numHexlets = power >> 2;
+        
+        size_t stringLength = m_heapNameLength + (negative ? strlen(negSplit) : strlen(posSplit)) + numHexlets;
+        char* characters;
+        m_largeIndexNames.append(CString::newUninitialized(stringLength, characters));
+        
+        memcpy(characters, m_heapForAnyIndex.heapName(), m_heapNameLength);
+        if (negative)
+            memcpy(characters + m_heapNameLength, negSplit, strlen(negSplit));
+        else
+            memcpy(characters + m_heapNameLength, posSplit, strlen(posSplit));
+        
+        size_t accumulator = index;
+        for (unsigned i = 0; i < numHexlets; ++i) {
+            characters[stringLength - i - 1] = lowerNibbleToASCIIHexDigit(accumulator);
+            accumulator >>= 4;
+        }
+        
+        field.initialize(&m_heapForAnyIndex, characters, m_offset + signedIndex * m_elementSize);
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void IndexedAbstractHeap::dump(PrintStream& out) const
+{
+    out.print("Indexed:", atAnyIndex());
+}
+
+NumberedAbstractHeap::NumberedAbstractHeap(AbstractHeap* heap, const char* heapName)
+    : m_indexedHeap(heap, heapName, 0, 1)
+{
+}
+
+NumberedAbstractHeap::~NumberedAbstractHeap()
+{
+}
+
+void NumberedAbstractHeap::dump(PrintStream& out) const
+{
+    out.print("Numbered: ", atAnyNumber());
+}
+
+AbsoluteAbstractHeap::AbsoluteAbstractHeap(AbstractHeap* heap, const char* heapName)
+    : m_indexedHeap(heap, heapName, 0, 1)
+{
+}
+
+AbsoluteAbstractHeap::~AbsoluteAbstractHeap()
+{
+}
+
+void AbsoluteAbstractHeap::dump(PrintStream& out) const
+{
+    out.print("Absolute:", atAnyAddress());
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLAbstractHeap.h b/ftl/FTLAbstractHeap.h
new file mode 100644
index 0000000..ae883a6
--- /dev/null
+++ b/ftl/FTLAbstractHeap.h
@@ -0,0 +1,216 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "B3HeapRange.h"
+#include "FTLAbbreviatedTypes.h"
+#include "JSCJSValue.h"
+#include <array>
+#include <wtf/FastMalloc.h>
+#include <wtf/HashMap.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
+#include <wtf/text/CString.h>
+
+namespace JSC { namespace FTL {
+
+class AbstractHeapRepository;
+class Output;
+class TypedPointer;
+
+class AbstractHeap {
+    WTF_MAKE_NONCOPYABLE(AbstractHeap); WTF_MAKE_FAST_ALLOCATED;
+public:
+    AbstractHeap()
+    {
+    }
+    
+    AbstractHeap(AbstractHeap* parent, const char* heapName, ptrdiff_t offset = 0);
+
+    bool isInitialized() const { return !!m_heapName; }
+    
+    void initialize(AbstractHeap* parent, const char* heapName, ptrdiff_t offset = 0)
+    {
+        changeParent(parent);
+        m_heapName = heapName;
+        m_offset = offset;
+    }
+    
+    void changeParent(AbstractHeap* parent);
+
+    AbstractHeap* parent() const
+    {
+        ASSERT(isInitialized());
+        return m_parent;
+    }
+
+    const Vector<AbstractHeap*>& children() const;
+    
+    const char* heapName() const
+    {
+        ASSERT(isInitialized());
+        return m_heapName;
+    }
+
+    B3::HeapRange range() const
+    {
+        // This will not have a valid value until after all lowering is done. Do associate an
+        // AbstractHeap with a B3::Value*, use AbstractHeapRepository::decorateXXX().
+        if (!m_range)
+            badRangeError();
+        
+        return m_range;
+    }
+
+    // WARNING: Not all abstract heaps have a meaningful offset.
+    ptrdiff_t offset() const
+    {
+        ASSERT(isInitialized());
+        return m_offset;
+    }
+
+    void compute(unsigned begin = 0);
+
+    // Print information about just this heap.
+    void shallowDump(PrintStream&) const;
+
+    // Print information about this heap and its ancestors. This is the default.
+    void dump(PrintStream&) const;
+
+    // Print information about this heap and its descendents. This is a multi-line dump.
+    void deepDump(PrintStream&, unsigned indent = 0) const;
+
+private:
+    friend class AbstractHeapRepository;
+
+    NO_RETURN_DUE_TO_CRASH void badRangeError() const;
+
+    AbstractHeap* m_parent { nullptr };
+    Vector<AbstractHeap*> m_children;
+    intptr_t m_offset { 0 };
+    B3::HeapRange m_range;
+    const char* m_heapName { nullptr };
+};
+
+class IndexedAbstractHeap {
+public:
+    IndexedAbstractHeap(AbstractHeap* parent, const char* heapName, ptrdiff_t offset, size_t elementSize);
+    ~IndexedAbstractHeap();
+    
+    const AbstractHeap& atAnyIndex() const { return m_heapForAnyIndex; }
+    
+    const AbstractHeap& at(ptrdiff_t index)
+    {
+        if (static_cast<size_t>(index) < m_smallIndices.size())
+            return returnInitialized(m_smallIndices[index], index);
+        return atSlow(index);
+    }
+    
+    const AbstractHeap& operator[](ptrdiff_t index) { return at(index); }
+    
+    TypedPointer baseIndex(Output& out, LValue base, LValue index, JSValue indexAsConstant = JSValue(), ptrdiff_t offset = 0);
+    
+    void dump(PrintStream&) const;
+
+private:
+    const AbstractHeap& returnInitialized(AbstractHeap& field, ptrdiff_t index)
+    {
+        if (UNLIKELY(!field.isInitialized()))
+            initialize(field, index);
+        return field;
+    }
+
+    const AbstractHeap& atSlow(ptrdiff_t index);
+    void initialize(AbstractHeap& field, ptrdiff_t index);
+
+    AbstractHeap m_heapForAnyIndex;
+    size_t m_heapNameLength;
+    ptrdiff_t m_offset;
+    size_t m_elementSize;
+    std::array<AbstractHeap, 16> m_smallIndices;
+    
+    struct WithoutZeroOrOneHashTraits : WTF::GenericHashTraits<ptrdiff_t> {
+        static void constructDeletedValue(ptrdiff_t& slot) { slot = 1; }
+        static bool isDeletedValue(ptrdiff_t value) { return value == 1; }
+    };
+    typedef HashMap<ptrdiff_t, std::unique_ptr<AbstractHeap>, WTF::IntHash<ptrdiff_t>, WithoutZeroOrOneHashTraits> MapType;
+    
+    std::unique_ptr<MapType> m_largeIndices;
+    Vector<CString, 16> m_largeIndexNames;
+};
+
+// A numbered abstract heap is like an indexed abstract heap, except that you
+// can't rely on there being a relationship between the number you use to
+// retrieve the sub-heap, and the offset that this heap has. (In particular,
+// the sub-heaps don't have indices.)
+
+class NumberedAbstractHeap {
+public:
+    NumberedAbstractHeap(AbstractHeap* parent, const char* heapName);
+    ~NumberedAbstractHeap();
+    
+    const AbstractHeap& atAnyNumber() const { return m_indexedHeap.atAnyIndex(); }
+    
+    const AbstractHeap& at(unsigned number) { return m_indexedHeap.at(number); }
+    const AbstractHeap& operator[](unsigned number) { return at(number); }
+
+    void dump(PrintStream&) const;
+
+private:
+    
+    // We use the fact that the indexed heap already has a superset of the
+    // functionality we need.
+    IndexedAbstractHeap m_indexedHeap;
+};
+
+class AbsoluteAbstractHeap {
+public:
+    AbsoluteAbstractHeap(AbstractHeap* parent, const char* heapName);
+    ~AbsoluteAbstractHeap();
+    
+    const AbstractHeap& atAnyAddress() const { return m_indexedHeap.atAnyIndex(); }
+    
+    const AbstractHeap& at(const void* address)
+    {
+        return m_indexedHeap.at(bitwise_cast<ptrdiff_t>(address));
+    }
+    
+    const AbstractHeap& operator[](const void* address) { return at(address); }
+
+    void dump(PrintStream&) const;
+
+private:
+    // The trick here is that the indexed heap is "indexed" by a pointer-width
+    // integer. Pointers are themselves pointer-width integers. So we can reuse
+    // all of the functionality.
+    IndexedAbstractHeap m_indexedHeap;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLAbstractHeapRepository.cpp b/ftl/FTLAbstractHeapRepository.cpp
new file mode 100644
index 0000000..0b48c4b
--- /dev/null
+++ b/ftl/FTLAbstractHeapRepository.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLAbstractHeapRepository.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "B3CCallValue.h"
+#include "B3FenceValue.h"
+#include "B3MemoryValue.h"
+#include "B3PatchpointValue.h"
+#include "B3ValueInlines.h"
+#include "DirectArguments.h"
+#include "FTLState.h"
+#include "GetterSetter.h"
+#include "JSPropertyNameEnumerator.h"
+#include "JSScope.h"
+#include "JSCInlines.h"
+#include "RegExpConstructor.h"
+#include "RegExpObject.h"
+#include "ScopedArguments.h"
+#include "ScopedArgumentsTable.h"
+#include "ShadowChicken.h"
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+
+AbstractHeapRepository::AbstractHeapRepository()
+    : root(nullptr, "jscRoot")
+
+#define ABSTRACT_HEAP_INITIALIZATION(name) , name(&root, #name)
+    FOR_EACH_ABSTRACT_HEAP(ABSTRACT_HEAP_INITIALIZATION)
+#undef ABSTRACT_HEAP_INITIALIZATION
+
+#define ABSTRACT_FIELD_INITIALIZATION(name, offset) , name(&root, #name, offset)
+    FOR_EACH_ABSTRACT_FIELD(ABSTRACT_FIELD_INITIALIZATION)
+#undef ABSTRACT_FIELD_INITIALIZATION
+    
+    , JSCell_freeListNext(JSCell_header)
+    
+#define INDEXED_ABSTRACT_HEAP_INITIALIZATION(name, offset, size) , name(&root, #name, offset, size)
+    FOR_EACH_INDEXED_ABSTRACT_HEAP(INDEXED_ABSTRACT_HEAP_INITIALIZATION)
+#undef INDEXED_ABSTRACT_HEAP_INITIALIZATION
+    
+#define NUMBERED_ABSTRACT_HEAP_INITIALIZATION(name) , name(&root, #name)
+    FOR_EACH_NUMBERED_ABSTRACT_HEAP(NUMBERED_ABSTRACT_HEAP_INITIALIZATION)
+#undef NUMBERED_ABSTRACT_HEAP_INITIALIZATION
+
+    , absolute(&root, "absolute")
+{
+    // Make sure that our explicit assumptions about the StructureIDBlob match reality.
+    RELEASE_ASSERT(!(JSCell_indexingTypeAndMisc.offset() & (sizeof(int32_t) - 1)));
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 1 == JSCell_typeInfoType.offset());
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 2 == JSCell_typeInfoFlags.offset());
+    RELEASE_ASSERT(JSCell_indexingTypeAndMisc.offset() + 3 == JSCell_cellState.offset());
+
+    JSCell_structureID.changeParent(&JSCell_header);
+    JSCell_usefulBytes.changeParent(&JSCell_header);
+    JSCell_indexingTypeAndMisc.changeParent(&JSCell_usefulBytes);
+    JSCell_typeInfoType.changeParent(&JSCell_usefulBytes);
+    JSCell_typeInfoFlags.changeParent(&JSCell_usefulBytes);
+    JSCell_cellState.changeParent(&JSCell_usefulBytes);
+
+    RELEASE_ASSERT(!JSCell_freeListNext.offset());
+}
+
+AbstractHeapRepository::~AbstractHeapRepository()
+{
+}
+
+void AbstractHeapRepository::decorateMemory(const AbstractHeap* heap, Value* value)
+{
+    m_heapForMemory.append(HeapForValue(heap, value));
+}
+
+void AbstractHeapRepository::decorateCCallRead(const AbstractHeap* heap, Value* value)
+{
+    m_heapForCCallRead.append(HeapForValue(heap, value));
+}
+
+void AbstractHeapRepository::decorateCCallWrite(const AbstractHeap* heap, Value* value)
+{
+    m_heapForCCallWrite.append(HeapForValue(heap, value));
+}
+
+void AbstractHeapRepository::decoratePatchpointRead(const AbstractHeap* heap, Value* value)
+{
+    m_heapForPatchpointRead.append(HeapForValue(heap, value));
+}
+
+void AbstractHeapRepository::decoratePatchpointWrite(const AbstractHeap* heap, Value* value)
+{
+    m_heapForPatchpointWrite.append(HeapForValue(heap, value));
+}
+
+void AbstractHeapRepository::decorateFenceRead(const AbstractHeap* heap, Value* value)
+{
+    m_heapForFenceRead.append(HeapForValue(heap, value));
+}
+
+void AbstractHeapRepository::decorateFenceWrite(const AbstractHeap* heap, Value* value)
+{
+    m_heapForFenceWrite.append(HeapForValue(heap, value));
+}
+
+void AbstractHeapRepository::computeRangesAndDecorateInstructions()
+{
+    root.compute();
+
+    if (verboseCompilationEnabled()) {
+        dataLog("Abstract Heap Repository:\n");
+        root.deepDump(WTF::dataFile());
+    }
+    
+    auto rangeFor = [&] (const AbstractHeap* heap) -> HeapRange {
+        if (heap)
+            return heap->range();
+        return HeapRange();
+    };
+
+    for (HeapForValue entry : m_heapForMemory)
+        entry.value->as<MemoryValue>()->setRange(rangeFor(entry.heap));
+    for (HeapForValue entry : m_heapForCCallRead)
+        entry.value->as<CCallValue>()->effects.reads = rangeFor(entry.heap);
+    for (HeapForValue entry : m_heapForCCallWrite)
+        entry.value->as<CCallValue>()->effects.writes = rangeFor(entry.heap);
+    for (HeapForValue entry : m_heapForPatchpointRead)
+        entry.value->as<PatchpointValue>()->effects.reads = rangeFor(entry.heap);
+    for (HeapForValue entry : m_heapForPatchpointWrite)
+        entry.value->as<PatchpointValue>()->effects.writes = rangeFor(entry.heap);
+    for (HeapForValue entry : m_heapForFenceRead)
+        entry.value->as<FenceValue>()->read = rangeFor(entry.heap);
+    for (HeapForValue entry : m_heapForFenceWrite)
+        entry.value->as<FenceValue>()->write = rangeFor(entry.heap);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLAbstractHeapRepository.h b/ftl/FTLAbstractHeapRepository.h
new file mode 100644
index 0000000..8bc7874
--- /dev/null
+++ b/ftl/FTLAbstractHeapRepository.h
@@ -0,0 +1,257 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "B3Value.h"
+#include "DFGArrayMode.h"
+#include "FTLAbstractHeap.h"
+#include "HasOwnPropertyCache.h"
+#include "IndexingType.h"
+#include "JSFixedArray.h"
+#include "JSMap.h"
+#include "JSSet.h"
+#include "Symbol.h"
+
+namespace JSC { namespace FTL {
+
+#define FOR_EACH_ABSTRACT_HEAP(macro) \
+    macro(typedArrayProperties)
+
+#define FOR_EACH_ABSTRACT_FIELD(macro) \
+    macro(ArrayBuffer_data, ArrayBuffer::offsetOfData()) \
+    macro(Butterfly_arrayBuffer, Butterfly::offsetOfArrayBuffer()) \
+    macro(Butterfly_publicLength, Butterfly::offsetOfPublicLength()) \
+    macro(Butterfly_vectorLength, Butterfly::offsetOfVectorLength()) \
+    macro(CallFrame_callerFrame, CallFrame::callerFrameOffset()) \
+    macro(DirectArguments_callee, DirectArguments::offsetOfCallee()) \
+    macro(DirectArguments_length, DirectArguments::offsetOfLength()) \
+    macro(DirectArguments_minCapacity, DirectArguments::offsetOfMinCapacity()) \
+    macro(DirectArguments_overrides, DirectArguments::offsetOfOverrides()) \
+    macro(GetterSetter_getter, GetterSetter::offsetOfGetter()) \
+    macro(GetterSetter_setter, GetterSetter::offsetOfSetter()) \
+    macro(JSArrayBufferView_length, JSArrayBufferView::offsetOfLength()) \
+    macro(JSArrayBufferView_mode, JSArrayBufferView::offsetOfMode()) \
+    macro(JSArrayBufferView_vector, JSArrayBufferView::offsetOfVector()) \
+    macro(JSCell_cellState, JSCell::cellStateOffset()) \
+    macro(JSCell_header, 0) \
+    macro(JSCell_indexingTypeAndMisc, JSCell::indexingTypeAndMiscOffset()) \
+    macro(JSCell_structureID, JSCell::structureIDOffset()) \
+    macro(JSCell_typeInfoFlags, JSCell::typeInfoFlagsOffset()) \
+    macro(JSCell_typeInfoType, JSCell::typeInfoTypeOffset()) \
+    macro(JSCell_usefulBytes, JSCell::indexingTypeAndMiscOffset()) \
+    macro(JSFunction_executable, JSFunction::offsetOfExecutable()) \
+    macro(JSFunction_scope, JSFunction::offsetOfScopeChain()) \
+    macro(JSFunction_rareData, JSFunction::offsetOfRareData()) \
+    macro(JSObject_butterfly, JSObject::butterflyOffset()) \
+    macro(JSPropertyNameEnumerator_cachedInlineCapacity, JSPropertyNameEnumerator::cachedInlineCapacityOffset()) \
+    macro(JSPropertyNameEnumerator_cachedPropertyNamesVector, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()) \
+    macro(JSPropertyNameEnumerator_cachedStructureID, JSPropertyNameEnumerator::cachedStructureIDOffset()) \
+    macro(JSPropertyNameEnumerator_endGenericPropertyIndex, JSPropertyNameEnumerator::endGenericPropertyIndexOffset()) \
+    macro(JSPropertyNameEnumerator_endStructurePropertyIndex, JSPropertyNameEnumerator::endStructurePropertyIndexOffset()) \
+    macro(JSPropertyNameEnumerator_indexLength, JSPropertyNameEnumerator::indexedLengthOffset()) \
+    macro(JSScope_next, JSScope::offsetOfNext()) \
+    macro(JSString_flags, JSString::offsetOfFlags()) \
+    macro(JSString_length, JSString::offsetOfLength()) \
+    macro(JSString_value, JSString::offsetOfValue()) \
+    macro(JSSymbolTableObject_symbolTable, JSSymbolTableObject::offsetOfSymbolTable()) \
+    macro(JSWrapperObject_internalValue, JSWrapperObject::internalValueOffset()) \
+    macro(RegExpConstructor_cachedResult_lastRegExp, RegExpConstructor::offsetOfCachedResult() + RegExpCachedResult::offsetOfLastRegExp()) \
+    macro(RegExpConstructor_cachedResult_lastInput, RegExpConstructor::offsetOfCachedResult() + RegExpCachedResult::offsetOfLastInput()) \
+    macro(RegExpConstructor_cachedResult_result_start, RegExpConstructor::offsetOfCachedResult() + RegExpCachedResult::offsetOfResult() + OBJECT_OFFSETOF(MatchResult, start)) \
+    macro(RegExpConstructor_cachedResult_result_end, RegExpConstructor::offsetOfCachedResult() + RegExpCachedResult::offsetOfResult() + OBJECT_OFFSETOF(MatchResult, end)) \
+    macro(RegExpConstructor_cachedResult_reified, RegExpConstructor::offsetOfCachedResult() + RegExpCachedResult::offsetOfReified()) \
+    macro(RegExpObject_lastIndex, RegExpObject::offsetOfLastIndex()) \
+    macro(RegExpObject_lastIndexIsWritable, RegExpObject::offsetOfLastIndexIsWritable()) \
+    macro(ShadowChicken_Packet_callee, OBJECT_OFFSETOF(ShadowChicken::Packet, callee)) \
+    macro(ShadowChicken_Packet_frame, OBJECT_OFFSETOF(ShadowChicken::Packet, frame)) \
+    macro(ShadowChicken_Packet_callerFrame, OBJECT_OFFSETOF(ShadowChicken::Packet, callerFrame)) \
+    macro(ShadowChicken_Packet_thisValue, OBJECT_OFFSETOF(ShadowChicken::Packet, thisValue)) \
+    macro(ShadowChicken_Packet_scope, OBJECT_OFFSETOF(ShadowChicken::Packet, scope)) \
+    macro(ShadowChicken_Packet_codeBlock, OBJECT_OFFSETOF(ShadowChicken::Packet, codeBlock)) \
+    macro(ShadowChicken_Packet_callSiteIndex, OBJECT_OFFSETOF(ShadowChicken::Packet, callSiteIndex)) \
+    macro(ScopedArguments_overrodeThings, ScopedArguments::offsetOfOverrodeThings()) \
+    macro(ScopedArguments_scope, ScopedArguments::offsetOfScope()) \
+    macro(ScopedArguments_table, ScopedArguments::offsetOfTable()) \
+    macro(ScopedArguments_totalLength, ScopedArguments::offsetOfTotalLength()) \
+    macro(ScopedArgumentsTable_arguments, ScopedArgumentsTable::offsetOfArguments()) \
+    macro(ScopedArgumentsTable_length, ScopedArgumentsTable::offsetOfLength()) \
+    macro(StringImpl_data, StringImpl::dataOffset()) \
+    macro(StringImpl_hashAndFlags, StringImpl::flagsOffset()) \
+    macro(StringImpl_length, StringImpl::lengthMemoryOffset()) \
+    macro(Structure_classInfo, Structure::classInfoOffset()) \
+    macro(Structure_globalObject, Structure::globalObjectOffset()) \
+    macro(Structure_prototype, Structure::prototypeOffset()) \
+    macro(Structure_structureID, Structure::structureIDOffset()) \
+    macro(Structure_inlineCapacity, Structure::inlineCapacityOffset()) \
+    macro(Structure_indexingTypeIncludingHistory, Structure::indexingTypeIncludingHistoryOffset()) \
+    macro(JSMap_hashMapImpl, JSMap::offsetOfHashMapImpl()) \
+    macro(JSSet_hashMapImpl, JSSet::offsetOfHashMapImpl()) \
+    macro(HashMapImpl_capacity, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfCapacity()) \
+    macro(HashMapImpl_buffer,  HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::offsetOfBuffer()) \
+    macro(HashMapBucket_value, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()) \
+    macro(HashMapBucket_key, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfKey()) \
+    macro(Symbol_symbolImpl, Symbol::offsetOfSymbolImpl()) \
+    macro(JSFixedArray_size, JSFixedArray::offsetOfSize()) \
+
+#define FOR_EACH_INDEXED_ABSTRACT_HEAP(macro) \
+    macro(DirectArguments_storage, DirectArguments::storageOffset(), sizeof(EncodedJSValue)) \
+    macro(JSEnvironmentRecord_variables, JSEnvironmentRecord::offsetOfVariables(), sizeof(EncodedJSValue)) \
+    macro(JSPropertyNameEnumerator_cachedPropertyNamesVectorContents, 0, sizeof(WriteBarrier<JSString>)) \
+    macro(JSRopeString_fibers, JSRopeString::offsetOfFibers(), sizeof(WriteBarrier<JSString>)) \
+    macro(ScopedArguments_overflowStorage, ScopedArguments::overflowStorageOffset(), sizeof(EncodedJSValue)) \
+    macro(Subspace_allocatorForSizeStep, Subspace::offsetOfAllocatorForSizeStep(), sizeof(MarkedAllocator*)) \
+    macro(WriteBarrierBuffer_bufferContents, 0, sizeof(JSCell*)) \
+    macro(characters8, 0, sizeof(LChar)) \
+    macro(characters16, 0, sizeof(UChar)) \
+    macro(indexedInt32Properties, 0, sizeof(EncodedJSValue)) \
+    macro(indexedDoubleProperties, 0, sizeof(double)) \
+    macro(indexedContiguousProperties, 0, sizeof(EncodedJSValue)) \
+    macro(indexedArrayStorageProperties, 0, sizeof(EncodedJSValue)) \
+    macro(scopedArgumentsTableArguments, 0, sizeof(int32_t)) \
+    macro(singleCharacterStrings, 0, sizeof(JSString*)) \
+    macro(structureTable, 0, sizeof(Structure*)) \
+    macro(variables, 0, sizeof(Register)) \
+    macro(HasOwnPropertyCache, 0, sizeof(HasOwnPropertyCache::Entry)) \
+    macro(JSFixedArray_buffer, JSFixedArray::offsetOfData(), sizeof(EncodedJSValue)) \
+    
+#define FOR_EACH_NUMBERED_ABSTRACT_HEAP(macro) \
+    macro(properties)
+    
+// This class is meant to be cacheable between compilations, but it doesn't have to be.
+// Doing so saves on creation of nodes. But clearing it will save memory.
+
+class AbstractHeapRepository {
+    WTF_MAKE_NONCOPYABLE(AbstractHeapRepository);
+public:
+    AbstractHeapRepository();
+    ~AbstractHeapRepository();
+    
+    AbstractHeap root;
+    
+#define ABSTRACT_HEAP_DECLARATION(name) AbstractHeap name;
+    FOR_EACH_ABSTRACT_HEAP(ABSTRACT_HEAP_DECLARATION)
+#undef ABSTRACT_HEAP_DECLARATION
+
+#define ABSTRACT_FIELD_DECLARATION(name, offset) AbstractHeap name;
+    FOR_EACH_ABSTRACT_FIELD(ABSTRACT_FIELD_DECLARATION)
+#undef ABSTRACT_FIELD_DECLARATION
+    
+    AbstractHeap& JSCell_freeListNext;
+    
+#define INDEXED_ABSTRACT_HEAP_DECLARATION(name, offset, size) IndexedAbstractHeap name;
+    FOR_EACH_INDEXED_ABSTRACT_HEAP(INDEXED_ABSTRACT_HEAP_DECLARATION)
+#undef INDEXED_ABSTRACT_HEAP_DECLARATION
+    
+#define NUMBERED_ABSTRACT_HEAP_DECLARATION(name) NumberedAbstractHeap name;
+    FOR_EACH_NUMBERED_ABSTRACT_HEAP(NUMBERED_ABSTRACT_HEAP_DECLARATION)
+#undef NUMBERED_ABSTRACT_HEAP_DECLARATION
+
+    AbsoluteAbstractHeap absolute;
+    
+    IndexedAbstractHeap* forIndexingType(IndexingType indexingType)
+    {
+        switch (indexingType) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_UNDECIDED_INDEXING_TYPES:
+            return 0;
+            
+        case ALL_INT32_INDEXING_TYPES:
+            return &indexedInt32Properties;
+            
+        case ALL_DOUBLE_INDEXING_TYPES:
+            return &indexedDoubleProperties;
+            
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return &indexedContiguousProperties;
+            
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return &indexedArrayStorageProperties;
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return 0;
+        }
+    }
+    
+    IndexedAbstractHeap& forArrayType(DFG::Array::Type type)
+    {
+        switch (type) {
+        case DFG::Array::Int32:
+            return indexedInt32Properties;
+        case DFG::Array::Double:
+            return indexedDoubleProperties;
+        case DFG::Array::Contiguous:
+            return indexedContiguousProperties;
+        case DFG::Array::ArrayStorage:
+        case DFG::Array::SlowPutArrayStorage:
+            return indexedArrayStorageProperties;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return indexedInt32Properties;
+        }
+    }
+
+    void decorateMemory(const AbstractHeap*, B3::Value*);
+    void decorateCCallRead(const AbstractHeap*, B3::Value*);
+    void decorateCCallWrite(const AbstractHeap*, B3::Value*);
+    void decoratePatchpointRead(const AbstractHeap*, B3::Value*);
+    void decoratePatchpointWrite(const AbstractHeap*, B3::Value*);
+    void decorateFenceRead(const AbstractHeap*, B3::Value*);
+    void decorateFenceWrite(const AbstractHeap*, B3::Value*);
+
+    void computeRangesAndDecorateInstructions();
+
+private:
+
+    struct HeapForValue {
+        HeapForValue()
+        {
+        }
+
+        HeapForValue(const AbstractHeap* heap, B3::Value* value)
+            : heap(heap)
+            , value(value)
+        {
+        }
+        
+        const AbstractHeap* heap { nullptr };
+        B3::Value* value { nullptr };
+    };
+
+    Vector<HeapForValue> m_heapForMemory;
+    Vector<HeapForValue> m_heapForCCallRead;
+    Vector<HeapForValue> m_heapForCCallWrite;
+    Vector<HeapForValue> m_heapForPatchpointRead;
+    Vector<HeapForValue> m_heapForPatchpointWrite;
+    Vector<HeapForValue> m_heapForFenceRead;
+    Vector<HeapForValue> m_heapForFenceWrite;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLAvailableRecovery.cpp b/ftl/FTLAvailableRecovery.cpp
new file mode 100644
index 0000000..6c00fa4
--- /dev/null
+++ b/ftl/FTLAvailableRecovery.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLAvailableRecovery.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+void AvailableRecovery::dump(PrintStream& out) const
+{
+    out.print(node(), " => ", opcode(), ", ", RawPointer(m_left), ", ", RawPointer(m_right), ", ", m_format);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLAvailableRecovery.h b/ftl/FTLAvailableRecovery.h
new file mode 100644
index 0000000..1f36c3b
--- /dev/null
+++ b/ftl/FTLAvailableRecovery.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGNode.h"
+#include "DataFormat.h"
+#include "FTLAbbreviatedTypes.h"
+#include "FTLRecoveryOpcode.h"
+
+namespace JSC { namespace FTL {
+
+class AvailableRecovery {
+public:
+    AvailableRecovery()
+        : m_node(0)
+        , m_format(DataFormatNone)
+        , m_opcode(AddRecovery)
+        , m_left(0)
+        , m_right(0)
+    {
+    }
+    
+    AvailableRecovery(DFG::Node* node, RecoveryOpcode opcode, LValue left, LValue right, DataFormat format)
+        : m_node(node)
+        , m_format(format)
+        , m_opcode(opcode)
+        , m_left(left)
+        , m_right(right)
+    {
+    }
+    
+    DFG::Node* node() const { return m_node; }
+    DataFormat format() const { return m_format; }
+    RecoveryOpcode opcode() const { return m_opcode; }
+    LValue left() const { return m_left; }
+    LValue right() const { return m_right; }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    DFG::Node* m_node;
+    DataFormat m_format;
+    RecoveryOpcode m_opcode;
+    LValue m_left;
+    LValue m_right;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLCapabilities.cpp b/ftl/FTLCapabilities.cpp
new file mode 100644
index 0000000..4383f12
--- /dev/null
+++ b/ftl/FTLCapabilities.cpp
@@ -0,0 +1,511 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLCapabilities.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+using namespace DFG;
+
+static bool verboseCapabilities()
+{
+    return verboseCompilationEnabled() || Options::verboseFTLFailure();
+}
+
+inline CapabilityLevel canCompile(Node* node)
+{
+    // NOTE: If we ever have phantom arguments, we can compile them but we cannot
+    // OSR enter.
+    
+    switch (node->op()) {
+    case JSConstant:
+    case LazyJSConstant:
+    case GetLocal:
+    case SetLocal:
+    case PutStack:
+    case KillStack:
+    case GetStack:
+    case MovHint:
+    case ZombieHint:
+    case ExitOK:
+    case Phantom:
+    case Flush:
+    case PhantomLocal:
+    case SetArgument:
+    case Return:
+    case BitAnd:
+    case BitOr:
+    case BitXor:
+    case BitRShift:
+    case BitLShift:
+    case BitURShift:
+    case CheckStructure:
+    case DoubleAsInt32:
+    case ArrayifyToStructure:
+    case PutStructure:
+    case GetButterfly:
+    case NewObject:
+    case NewArray:
+    case NewArrayWithSpread:
+    case Spread:
+    case NewArrayBuffer:
+    case NewTypedArray:
+    case GetByOffset:
+    case GetGetterSetterByOffset:
+    case GetGetter:
+    case GetSetter:
+    case PutByOffset:
+    case GetGlobalVar:
+    case GetGlobalLexicalVariable:
+    case PutGlobalVariable:
+    case ValueAdd:
+    case StrCat:
+    case ArithAdd:
+    case ArithClz32:
+    case ArithSub:
+    case ArithMul:
+    case ArithDiv:
+    case ArithMod:
+    case ArithMin:
+    case ArithMax:
+    case ArithAbs:
+    case ArithSin:
+    case ArithCos:
+    case ArithTan:
+    case ArithPow:
+    case ArithRandom:
+    case ArithRound:
+    case ArithFloor:
+    case ArithCeil:
+    case ArithTrunc:
+    case ArithSqrt:
+    case ArithLog:
+    case ArithFRound:
+    case ArithNegate:
+    case UInt32ToNumber:
+    case Jump:
+    case ForceOSRExit:
+    case Phi:
+    case Upsilon:
+    case ExtractOSREntryLocal:
+    case LoopHint:
+    case SkipScope:
+    case GetGlobalObject:
+    case CreateActivation:
+    case NewFunction:
+    case NewGeneratorFunction:
+    case NewAsyncFunction:
+    case GetClosureVar:
+    case PutClosureVar:
+    case CreateDirectArguments:
+    case CreateScopedArguments:
+    case CreateClonedArguments:
+    case GetFromArguments:
+    case PutToArguments:
+    case GetArgument:
+    case InvalidationPoint:
+    case StringCharAt:
+    case CheckCell:
+    case CheckBadCell:
+    case CheckNotEmpty:
+    case CheckStringIdent:
+    case CheckWatchdogTimer:
+    case StringCharCodeAt:
+    case StringFromCharCode:
+    case AllocatePropertyStorage:
+    case ReallocatePropertyStorage:
+    case NukeStructureAndSetButterfly:
+    case GetTypedArrayByteOffset:
+    case NotifyWrite:
+    case StoreBarrier:
+    case FencedStoreBarrier:
+    case Call:
+    case DirectCall:
+    case TailCall:
+    case DirectTailCall:
+    case TailCallInlinedCaller:
+    case DirectTailCallInlinedCaller:
+    case Construct:
+    case DirectConstruct:
+    case CallVarargs:
+    case CallEval:
+    case TailCallVarargs:
+    case TailCallVarargsInlinedCaller:
+    case ConstructVarargs:
+    case CallForwardVarargs:
+    case TailCallForwardVarargs:
+    case TailCallForwardVarargsInlinedCaller:
+    case ConstructForwardVarargs:
+    case LoadVarargs:
+    case ValueToInt32:
+    case Branch:
+    case LogicalNot:
+    case CheckInBounds:
+    case ConstantStoragePointer:
+    case Check:
+    case CountExecution:
+    case GetExecutable:
+    case GetScope:
+    case GetCallee:
+    case GetArgumentCountIncludingThis:
+    case ToNumber:
+    case ToString:
+    case CallObjectConstructor:
+    case CallStringConstructor:
+    case MakeRope:
+    case NewArrayWithSize:
+    case TryGetById:
+    case GetById:
+    case GetByIdFlush:
+    case GetByIdWithThis:
+    case ToThis:
+    case MultiGetByOffset:
+    case MultiPutByOffset:
+    case ToPrimitive:
+    case Throw:
+    case ThrowStaticError:
+    case Unreachable:
+    case In:
+    case HasOwnProperty:
+    case IsCellWithType:
+    case MapHash:
+    case GetMapBucket:
+    case LoadFromJSMapBucket:
+    case IsNonEmptyMapBucket:
+    case IsEmpty:
+    case IsUndefined:
+    case IsBoolean:
+    case IsNumber:
+    case IsObject:
+    case IsObjectOrNull:
+    case IsFunction:
+    case IsTypedArrayView:
+    case CheckTypeInfoFlags:
+    case OverridesHasInstance:
+    case InstanceOf:
+    case InstanceOfCustom:
+    case DoubleRep:
+    case ValueRep:
+    case Int52Rep:
+    case DoubleConstant:
+    case Int52Constant:
+    case BooleanToNumber:
+    case HasGenericProperty:
+    case HasStructureProperty:
+    case GetDirectPname:
+    case GetEnumerableLength:
+    case GetIndexedPropertyStorage:
+    case GetPropertyEnumerator:
+    case GetEnumeratorStructurePname:
+    case GetEnumeratorGenericPname:
+    case ToIndexString:
+    case BottomValue:
+    case PhantomNewObject:
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomCreateActivation:
+    case PutHint:
+    case CheckStructureImmediate:
+    case MaterializeNewObject:
+    case MaterializeCreateActivation:
+    case PhantomDirectArguments:
+    case PhantomCreateRest:
+    case PhantomSpread:
+    case PhantomNewArrayWithSpread:
+    case PhantomClonedArguments:
+    case GetMyArgumentByVal:
+    case GetMyArgumentByValOutOfBounds:
+    case ForwardVarargs:
+    case Switch:
+    case TypeOf:
+    case PutById:
+    case PutByIdDirect:
+    case PutByIdFlush:
+    case PutByIdWithThis:
+    case PutGetterById:
+    case PutSetterById:
+    case PutGetterSetterById:
+    case PutGetterByVal:
+    case PutSetterByVal:
+    case CreateRest:
+    case GetRestLength:
+    case RegExpExec:
+    case RegExpTest:
+    case NewRegexp:
+    case StringReplace:
+    case StringReplaceRegExp: 
+    case GetRegExpObjectLastIndex:
+    case SetRegExpObjectLastIndex:
+    case RecordRegExpCachedResult:
+    case SetFunctionName:
+    case LogShadowChickenPrologue:
+    case LogShadowChickenTail:
+    case ResolveScope:
+    case GetDynamicVar:
+    case PutDynamicVar:
+    case CompareEq:
+    case CompareEqPtr:
+    case CompareLess:
+    case CompareLessEq:
+    case CompareGreater:
+    case CompareGreaterEq:
+    case CompareStrictEq:
+    case DefineDataProperty:
+    case DefineAccessorProperty:
+    case ToLowerCase:
+    case CheckDOM:
+    case CallDOM:
+    case CallDOMGetter:
+    case ArraySlice:
+        // These are OK.
+        break;
+
+    case Identity:
+        // No backend handles this because it will be optimized out. But we may check
+        // for capabilities before optimization. It would be a deep error to remove this
+        // case because it would prevent us from catching bugs where the FTL backend
+        // pipeline failed to optimize out an Identity.
+        break;
+    case CheckArray:
+        switch (node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::DirectArguments:
+        case Array::ScopedArguments:
+            break;
+        default:
+            if (isTypedView(node->arrayMode().typedArrayType()))
+                break;
+            return CannotCompile;
+        }
+        break;
+    case GetArrayLength:
+        switch (node->arrayMode().type()) {
+        case Array::Undecided:
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::String:
+        case Array::DirectArguments:
+        case Array::ScopedArguments:
+            break;
+        default:
+            if (node->arrayMode().isSomeTypedArrayView())
+                break;
+            return CannotCompile;
+        }
+        break;
+    case HasIndexedProperty:
+        switch (node->arrayMode().type()) {
+        case Array::ForceExit:
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+            break;
+        default:
+            return CannotCompile;
+        }
+        break;
+    case GetByVal:
+        switch (node->arrayMode().type()) {
+        case Array::ForceExit:
+        case Array::Generic:
+        case Array::String:
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+        case Array::Undecided:
+        case Array::DirectArguments:
+        case Array::ScopedArguments:
+            break;
+        default:
+            if (isTypedView(node->arrayMode().typedArrayType()))
+                return CanCompileAndOSREnter;
+            return CannotCompile;
+        }
+        break;
+    case GetByValWithThis:
+        break;
+    case PutByVal:
+    case PutByValAlias:
+    case PutByValDirect:
+        switch (node->arrayMode().type()) {
+        case Array::ForceExit:
+        case Array::Generic:
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous:
+            break;
+        default:
+            if (isTypedView(node->arrayMode().typedArrayType()))
+                return CanCompileAndOSREnter;
+            return CannotCompile;
+        }
+        break;
+    case PutByValWithThis:
+        break;
+    case ArrayPush:
+    case ArrayPop:
+        switch (node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Contiguous:
+        case Array::Double:
+            break;
+        default:
+            return CannotCompile;
+        }
+        break;
+    default:
+        // Don't know how to handle anything else.
+        return CannotCompile;
+    }
+    return CanCompileAndOSREnter;
+}
+
+CapabilityLevel canCompile(Graph& graph)
+{
+    if (graph.m_codeBlock->instructionCount() > Options::maximumFTLCandidateInstructionCount()) {
+        if (verboseCapabilities())
+            dataLog("FTL rejecting ", *graph.m_codeBlock, " because it's too big.\n");
+        return CannotCompile;
+    }
+    
+    if (graph.m_codeBlock->codeType() != FunctionCode) {
+        if (verboseCapabilities())
+            dataLog("FTL rejecting ", *graph.m_codeBlock, " because it doesn't belong to a function.\n");
+        return CannotCompile;
+    }
+
+    if (UNLIKELY(graph.m_codeBlock->ownerScriptExecutable()->neverFTLOptimize())) {
+        if (verboseCapabilities())
+            dataLog("FTL rejecting ", *graph.m_codeBlock, " because it is marked as never FTL compile.\n");
+        return CannotCompile;
+    }
+    
+    CapabilityLevel result = CanCompileAndOSREnter;
+    
+    for (BlockIndex blockIndex = graph.numBlocks(); blockIndex--;) {
+        BasicBlock* block = graph.block(blockIndex);
+        if (!block)
+            continue;
+        
+        // We don't care if we can compile blocks that the CFA hasn't visited.
+        if (!block->cfaHasVisited)
+            continue;
+        
+        for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+            Node* node = block->at(nodeIndex);
+            
+            for (unsigned childIndex = graph.numChildren(node); childIndex--;) {
+                Edge edge = graph.child(node, childIndex);
+                if (!edge)
+                    continue;
+                switch (edge.useKind()) {
+                case UntypedUse:
+                case Int32Use:
+                case KnownInt32Use:
+                case Int52RepUse:
+                case NumberUse:
+                case RealNumberUse:
+                case DoubleRepUse:
+                case DoubleRepRealUse:
+                case BooleanUse:
+                case KnownBooleanUse:
+                case CellUse:
+                case KnownCellUse:
+                case CellOrOtherUse:
+                case ObjectUse:
+                case ArrayUse:
+                case FunctionUse:
+                case ObjectOrOtherUse:
+                case StringUse:
+                case StringOrOtherUse:
+                case KnownStringUse:
+                case KnownPrimitiveUse:
+                case StringObjectUse:
+                case StringOrStringObjectUse:
+                case SymbolUse:
+                case MapObjectUse:
+                case SetObjectUse:
+                case FinalObjectUse:
+                case RegExpObjectUse:
+                case ProxyObjectUse:
+                case DerivedArrayUse:
+                case NotCellUse:
+                case OtherUse:
+                case MiscUse:
+                case StringIdentUse:
+                case NotStringVarUse:
+                case AnyIntUse:
+                case DoubleRepAnyIntUse:
+                    // These are OK.
+                    break;
+                default:
+                    // Don't know how to handle anything else.
+                    if (verboseCapabilities()) {
+                        dataLog("FTL rejecting node in ", *graph.m_codeBlock, " because of bad use kind: ", edge.useKind(), " in node:\n");
+                        graph.dump(WTF::dataFile(), "    ", node);
+                    }
+                    return CannotCompile;
+                }
+            }
+            
+            switch (canCompile(node)) {
+            case CannotCompile: 
+                if (verboseCapabilities()) {
+                    dataLog("FTL rejecting node in ", *graph.m_codeBlock, ":\n");
+                    graph.dump(WTF::dataFile(), "    ", node);
+                }
+                return CannotCompile;
+                
+            case CanCompile:
+                if (result == CanCompileAndOSREnter && verboseCompilationEnabled()) {
+                    dataLog("FTL disabling OSR entry because of node:\n");
+                    graph.dump(WTF::dataFile(), "    ", node);
+                }
+                result = CanCompile;
+                break;
+                
+            case CanCompileAndOSREnter:
+                break;
+            }
+            
+            if (node->op() == ForceOSRExit)
+                break;
+        }
+    }
+    
+    return result;
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLCapabilities.h b/ftl/FTLCapabilities.h
new file mode 100644
index 0000000..ab3a62b
--- /dev/null
+++ b/ftl/FTLCapabilities.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace FTL {
+
+enum CapabilityLevel {
+    CannotCompile,
+    CanCompile,
+    CanCompileAndOSREnter
+};
+
+CapabilityLevel canCompile(DFG::Graph&);
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLCommonValues.cpp b/ftl/FTLCommonValues.cpp
new file mode 100644
index 0000000..5b4925c
--- /dev/null
+++ b/ftl/FTLCommonValues.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLCommonValues.h"
+
+#include "B3BasicBlockInlines.h"
+#include "B3Const32Value.h"
+#include "B3Const64Value.h"
+#include "B3ConstDoubleValue.h"
+#include "B3ConstPtrValue.h"
+#include "B3ProcedureInlines.h"
+#include "B3Type.h"
+#include "B3ValueInlines.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+
+CommonValues::CommonValues()
+{
+}
+
+void CommonValues::initializeConstants(B3::Procedure& proc, B3::BasicBlock* block)
+{
+    int32Zero = block->appendNew<Const32Value>(proc, Origin(), 0);
+    int32One = block->appendNew<Const32Value>(proc, Origin(), 1);
+    booleanTrue = int32One;
+    booleanFalse = int32Zero;
+    int64Zero = block->appendNew<Const64Value>(proc, Origin(), 0);
+    intPtrZero = block->appendNew<ConstPtrValue>(proc, Origin(), 0);
+    intPtrOne = block->appendNew<ConstPtrValue>(proc, Origin(), 1);
+    intPtrTwo = block->appendNew<ConstPtrValue>(proc, Origin(), 2);
+    intPtrThree = block->appendNew<ConstPtrValue>(proc, Origin(), 3);
+    intPtrEight = block->appendNew<ConstPtrValue>(proc, Origin(), 8);
+    doubleZero = block->appendNew<ConstDoubleValue>(proc, Origin(), 0.);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLCommonValues.h b/ftl/FTLCommonValues.h
new file mode 100644
index 0000000..c1d6d5a
--- /dev/null
+++ b/ftl/FTLCommonValues.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLAbbreviatedTypes.h"
+#include "FTLValueRange.h"
+
+namespace JSC {
+
+namespace B3 {
+class BasicBlock;
+class Procedure;
+}
+
+namespace FTL {
+
+class CommonValues {
+public:
+    CommonValues();
+
+    void initializeConstants(B3::Procedure&, B3::BasicBlock*);
+    
+    LValue booleanTrue { nullptr };
+    LValue booleanFalse { nullptr };
+    LValue int32Zero { nullptr };
+    LValue int32One { nullptr };
+    LValue int64Zero { nullptr };
+    LValue intPtrZero { nullptr };
+    LValue intPtrOne { nullptr };
+    LValue intPtrTwo { nullptr };
+    LValue intPtrThree { nullptr };
+    LValue intPtrEight { nullptr };
+    LValue doubleZero { nullptr };
+    
+    const unsigned rangeKind { 0 };
+    const unsigned profKind { 0 };
+    const LValue branchWeights { nullptr };
+    
+    const ValueRange nonNegativeInt32;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLCompile.cpp b/ftl/FTLCompile.cpp
new file mode 100644
index 0000000..e85e287
--- /dev/null
+++ b/ftl/FTLCompile.cpp
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLCompile.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "AirCode.h"
+#include "B3Generate.h"
+#include "B3ProcedureInlines.h"
+#include "B3StackSlot.h"
+#include "CodeBlockWithJITType.h"
+#include "CCallHelpers.h"
+#include "DFGCommon.h"
+#include "DFGGraphSafepoint.h"
+#include "DFGOperations.h"
+#include "DataView.h"
+#include "Disassembler.h"
+#include "FTLJITCode.h"
+#include "FTLThunks.h"
+#include "JITSubGenerator.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "PCToCodeOriginMap.h"
+#include "ScratchRegisterAllocator.h"
+
+namespace JSC { namespace FTL {
+
+using namespace DFG;
+
+void compile(State& state, Safepoint::Result& safepointResult)
+{
+    Graph& graph = state.graph;
+    CodeBlock* codeBlock = graph.m_codeBlock;
+    VM& vm = graph.m_vm;
+
+    {
+        GraphSafepoint safepoint(state.graph, safepointResult);
+
+        B3::prepareForGeneration(*state.proc);
+    }
+
+    if (safepointResult.didGetCancelled())
+        return;
+    RELEASE_ASSERT(!state.graph.m_vm.heap.collectorBelievesThatTheWorldIsStopped());
+    
+    if (state.allocationFailed)
+        return;
+    
+    std::unique_ptr<RegisterAtOffsetList> registerOffsets =
+        std::make_unique<RegisterAtOffsetList>(state.proc->calleeSaveRegisters());
+    if (shouldDumpDisassembly()) {
+        dataLog("Unwind info for ", CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::FTLJIT), ":\n");
+        dataLog("    ", *registerOffsets, "\n");
+    }
+    state.graph.m_codeBlock->setCalleeSaveRegisters(WTFMove(registerOffsets));
+    ASSERT(!(state.proc->frameSize() % sizeof(EncodedJSValue)));
+    state.jitCode->common.frameRegisterCount = state.proc->frameSize() / sizeof(EncodedJSValue);
+
+    int localsOffset =
+        state.capturedValue->offsetFromFP() / sizeof(EncodedJSValue) + graph.m_nextMachineLocal;
+    if (shouldDumpDisassembly()) {
+        dataLog(
+            "localsOffset = ", localsOffset, " for stack slot: ",
+            pointerDump(state.capturedValue), " at ", RawPointer(state.capturedValue), "\n");
+    }
+    
+    for (unsigned i = graph.m_inlineVariableData.size(); i--;) {
+        InlineCallFrame* inlineCallFrame = graph.m_inlineVariableData[i].inlineCallFrame;
+        
+        if (inlineCallFrame->argumentCountRegister.isValid())
+            inlineCallFrame->argumentCountRegister += localsOffset;
+        
+        for (unsigned argument = inlineCallFrame->arguments.size(); argument-- > 1;) {
+            inlineCallFrame->arguments[argument] =
+                inlineCallFrame->arguments[argument].withLocalsOffset(localsOffset);
+        }
+        
+        if (inlineCallFrame->isClosureCall) {
+            inlineCallFrame->calleeRecovery =
+                inlineCallFrame->calleeRecovery.withLocalsOffset(localsOffset);
+        }
+
+    }
+
+    // Note that the scope register could be invalid here if the original code had CallEval but it
+    // got killed. That's because it takes the CallEval to cause the scope register to be kept alive
+    // unless the debugger is also enabled.
+    if (graph.needsScopeRegister() && codeBlock->scopeRegister().isValid())
+        codeBlock->setScopeRegister(codeBlock->scopeRegister() + localsOffset);
+
+    for (OSRExitDescriptor& descriptor : state.jitCode->osrExitDescriptors) {
+        for (unsigned i = descriptor.m_values.size(); i--;)
+            descriptor.m_values[i] = descriptor.m_values[i].withLocalsOffset(localsOffset);
+        for (ExitTimeObjectMaterialization* materialization : descriptor.m_materializations)
+            materialization->accountForLocalsOffset(localsOffset);
+    }
+
+    // We will add exception handlers while generating.
+    codeBlock->clearExceptionHandlers();
+
+    CCallHelpers jit(&vm, codeBlock);
+    B3::generate(*state.proc, jit);
+
+    // Emit the exception handler.
+    *state.exceptionHandler = jit.label();
+    jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+    jit.move(MacroAssembler::TrustedImmPtr(jit.vm()), GPRInfo::argumentGPR0);
+    jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+    CCallHelpers::Call call = jit.call();
+    jit.jumpToExceptionHandler();
+    jit.addLinkTask(
+        [=] (LinkBuffer& linkBuffer) {
+            linkBuffer.link(call, FunctionPtr(lookupExceptionHandler));
+        });
+
+    state.finalizer->b3CodeLinkBuffer = std::make_unique<LinkBuffer>(
+        vm, jit, codeBlock, JITCompilationCanFail);
+    if (state.finalizer->b3CodeLinkBuffer->didFailToAllocate()) {
+        state.allocationFailed = true;
+        return;
+    }
+    
+    B3::PCToOriginMap originMap = state.proc->releasePCToOriginMap();
+    if (vm.shouldBuilderPCToCodeOriginMapping())
+        codeBlock->setPCToCodeOriginMap(std::make_unique<PCToCodeOriginMap>(PCToCodeOriginMapBuilder(vm, WTFMove(originMap)), *state.finalizer->b3CodeLinkBuffer));
+
+    state.generatedFunction = bitwise_cast<GeneratedFunction>(
+        state.finalizer->b3CodeLinkBuffer->entrypoint().executableAddress());
+    state.jitCode->initializeB3Byproducts(state.proc->releaseByproducts());
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLCompile.h b/ftl/FTLCompile.h
new file mode 100644
index 0000000..c3dd83a
--- /dev/null
+++ b/ftl/FTLCompile.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGSafepoint.h"
+#include "FTLState.h"
+
+namespace JSC { namespace FTL {
+
+void compile(State&, DFG::Safepoint::Result&);
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLDOMJITPatchpointParams.cpp b/ftl/FTLDOMJITPatchpointParams.cpp
new file mode 100644
index 0000000..106e2e5
--- /dev/null
+++ b/ftl/FTLDOMJITPatchpointParams.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FTLDOMJITPatchpointParams.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "AllowMacroScratchRegisterUsage.h"
+#include "FTLSlowPathCall.h"
+#include "FTLState.h"
+
+namespace JSC { namespace FTL {
+
+template<typename OperationType, typename ResultType, typename Arguments, size_t... ArgumentsIndex>
+static void dispatch(CCallHelpers& jit, FTL::State* state, const B3::StackmapGenerationParams& params, DFG::Node* node, Box<CCallHelpers::JumpList> exceptions, CCallHelpers::JumpList from, OperationType operation, ResultType result, Arguments arguments, std::index_sequence<ArgumentsIndex...>)
+{
+    CCallHelpers::Label done = jit.label();
+    params.addLatePath([=] (CCallHelpers& jit) {
+        AllowMacroScratchRegisterUsage allowScratch(jit);
+
+        from.link(&jit);
+        callOperation(
+            *state, params.unavailableRegisters(), jit, node->origin.semantic,
+            exceptions.get(), operation, extractResult(result), std::get<ArgumentsIndex>(arguments)...);
+        jit.jump().linkTo(done, &jit);
+    });
+}
+
+#define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) \
+    void DOMJITPatchpointParams::addSlowPathCallImpl(CCallHelpers::JumpList from, CCallHelpers& jit, OperationType operation, ResultType result, std::tuple<__VA_ARGS__> args) \
+    { \
+        dispatch(jit, &m_state, m_params, m_node, m_exceptions, from, operation, result, args, std::make_index_sequence<std::tuple_size<decltype(args)>::value>()); \
+    } \
+
+DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
+#undef JSC_DEFINE_CALL_OPERATIONS
+
+} }
+
+#endif
diff --git a/ftl/FTLDOMJITPatchpointParams.h b/ftl/FTLDOMJITPatchpointParams.h
new file mode 100644
index 0000000..3387c90
--- /dev/null
+++ b/ftl/FTLDOMJITPatchpointParams.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "B3StackmapGenerationParams.h"
+#include "DOMJITPatchpointParams.h"
+
+namespace JSC { namespace FTL {
+
+class State;
+
+class DOMJITPatchpointParams : public DOMJIT::PatchpointParams {
+public:
+    DOMJITPatchpointParams(State& state, const B3::StackmapGenerationParams& params, DFG::Node* node, Box<CCallHelpers::JumpList> exceptions, Vector<DOMJIT::Value>&& regs, Vector<GPRReg>&& gpScratch, Vector<FPRReg>&& fpScratch)
+        : DOMJIT::PatchpointParams(WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch))
+        , m_state(state)
+        , m_params(params)
+        , m_node(node)
+        , m_exceptions(exceptions)
+    {
+    }
+
+private:
+#define JSC_DEFINE_CALL_OPERATIONS(OperationType, ResultType, ...) void addSlowPathCallImpl(CCallHelpers::JumpList, CCallHelpers&, OperationType, ResultType, std::tuple<__VA_ARGS__> args) override;
+    DOMJIT_SLOW_PATH_CALLS(JSC_DEFINE_CALL_OPERATIONS)
+#undef JSC_DEFINE_CALL_OPERATIONS
+
+    State& m_state;
+    const B3::StackmapGenerationParams& m_params;
+    DFG::Node* m_node;
+    Box<CCallHelpers::JumpList> m_exceptions;
+};
+
+} }
+
+#endif
diff --git a/ftl/FTLExceptionTarget.cpp b/ftl/FTLExceptionTarget.cpp
new file mode 100644
index 0000000..023e119
--- /dev/null
+++ b/ftl/FTLExceptionTarget.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLExceptionTarget.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLState.h"
+
+namespace JSC { namespace FTL {
+
+ExceptionTarget::~ExceptionTarget()
+{
+}
+
+CodeLocationLabel ExceptionTarget::label(LinkBuffer& linkBuffer)
+{
+    if (m_isDefaultHandler)
+        return linkBuffer.locationOf(*m_defaultHandler);
+    return linkBuffer.locationOf(m_handle->label);
+}
+
+Box<CCallHelpers::JumpList> ExceptionTarget::jumps(CCallHelpers& jit)
+{
+    Box<CCallHelpers::JumpList> result = Box<CCallHelpers::JumpList>::create();
+    if (m_isDefaultHandler) {
+        Box<CCallHelpers::Label> defaultHandler = m_defaultHandler;
+        jit.addLinkTask(
+            [=] (LinkBuffer& linkBuffer) {
+                linkBuffer.link(*result, linkBuffer.locationOf(*defaultHandler));
+            });
+    } else {
+        RefPtr<OSRExitHandle> handle = m_handle;
+        jit.addLinkTask(
+            [=] (LinkBuffer& linkBuffer) {
+                linkBuffer.link(*result, linkBuffer.locationOf(handle->label));
+            });
+    }
+    return result;
+}
+
+ExceptionTarget::ExceptionTarget(
+    bool isDefaultHandler, Box<CCallHelpers::Label> defaultHandler, RefPtr<OSRExitHandle> handle)
+    : m_isDefaultHandler(isDefaultHandler)
+    , m_defaultHandler(defaultHandler)
+    , m_handle(handle)
+{
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLExceptionTarget.h b/ftl/FTLExceptionTarget.h
new file mode 100644
index 0000000..4953774
--- /dev/null
+++ b/ftl/FTLExceptionTarget.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGCommon.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "CCallHelpers.h"
+#include "FTLOSRExitHandle.h"
+#include <wtf/Box.h>
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace JSC { namespace FTL {
+
+class State;
+
+class ExceptionTarget : public ThreadSafeRefCounted<ExceptionTarget> {
+public:
+    ~ExceptionTarget();
+
+    // It's OK to call this during linking, but not any sooner.
+    CodeLocationLabel label(LinkBuffer&);
+
+    // Or, you can get a JumpList at any time. Anything you add to this JumpList will be linked to
+    // the target's label.
+    Box<CCallHelpers::JumpList> jumps(CCallHelpers&);
+    
+private:
+    friend class PatchpointExceptionHandle;
+
+    ExceptionTarget(bool isDefaultHandler, Box<CCallHelpers::Label>, RefPtr<OSRExitHandle>);
+    
+    bool m_isDefaultHandler;
+    Box<CCallHelpers::Label> m_defaultHandler;
+    RefPtr<OSRExitHandle> m_handle;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLExitArgument.cpp b/ftl/FTLExitArgument.cpp
new file mode 100644
index 0000000..381b3d3
--- /dev/null
+++ b/ftl/FTLExitArgument.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLExitArgument.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+void ExitArgument::dump(PrintStream& out) const
+{
+    out.print("#", argument(), " as ", format());
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLExitArgument.h b/ftl/FTLExitArgument.h
new file mode 100644
index 0000000..833b3b1
--- /dev/null
+++ b/ftl/FTLExitArgument.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DataFormat.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace FTL {
+
+struct ExitArgumentRepresentation {
+    DataFormat format;
+    unsigned argument;
+};
+
+class ExitArgument {
+public:
+    ExitArgument()
+    {
+        m_representation.format = DataFormatNone;
+    }
+    
+    ExitArgument(DataFormat format, unsigned argument)
+    {
+        m_representation.format = format;
+        m_representation.argument = argument;
+    }
+    
+    explicit ExitArgument(ExitArgumentRepresentation representation)
+    {
+        m_representation = representation;
+    }
+    
+    bool operator!() const { return m_representation.format == DataFormatNone; }
+    
+    DataFormat format() const
+    {
+        ASSERT(*this);
+        return m_representation.format;
+    }
+    
+    unsigned argument() const
+    {
+        ASSERT(*this);
+        return m_representation.argument;
+    }
+    
+    ExitArgument withFormat(DataFormat format)
+    {
+        return ExitArgument(format, argument());
+    }
+
+    ExitArgumentRepresentation representation() const { return m_representation; }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    ExitArgumentRepresentation m_representation;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLExitArgumentForOperand.cpp b/ftl/FTLExitArgumentForOperand.cpp
new file mode 100644
index 0000000..074e7a6
--- /dev/null
+++ b/ftl/FTLExitArgumentForOperand.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLExitArgumentForOperand.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+void ExitArgumentForOperand::dump(PrintStream& out) const
+{
+    out.print(m_exitArgument, " for ", m_operand);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLExitArgumentForOperand.h b/ftl/FTLExitArgumentForOperand.h
new file mode 100644
index 0000000..2cad043
--- /dev/null
+++ b/ftl/FTLExitArgumentForOperand.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLExitArgument.h"
+#include "VirtualRegister.h"
+
+namespace JSC { namespace FTL {
+
+class ExitArgumentForOperand {
+public:
+    ExitArgumentForOperand()
+        : m_operand(VirtualRegister())
+    {
+    }
+    
+    ExitArgumentForOperand(ExitArgument exitArgument, VirtualRegister operand)
+        : m_exitArgument(exitArgument)
+        , m_operand(operand)
+    {
+    }
+    
+    bool operator!() const { return !m_exitArgument; }
+    
+    const ExitArgument& exitArgument() const { return m_exitArgument; }
+    VirtualRegister operand() const { return m_operand; }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    ExitArgument m_exitArgument;
+    VirtualRegister m_operand;
+};
+
+inline bool lesserArgumentIndex(
+    const ExitArgumentForOperand& a, const ExitArgumentForOperand& b)
+{
+    return a.exitArgument().argument() < b.exitArgument().argument();
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLExitPropertyValue.cpp b/ftl/FTLExitPropertyValue.cpp
new file mode 100644
index 0000000..d57db74
--- /dev/null
+++ b/ftl/FTLExitPropertyValue.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLExitPropertyValue.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+ExitPropertyValue ExitPropertyValue::withLocalsOffset(int offset) const
+{
+    return ExitPropertyValue(m_location, m_value.withLocalsOffset(offset));
+}
+
+void ExitPropertyValue::dump(PrintStream& out) const
+{
+    out.print(m_location, " => ", m_value);
+}
+
+void ExitPropertyValue::validateReferences(const TrackedReferences& trackedReferences) const
+{
+    m_value.validateReferences(trackedReferences);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLExitPropertyValue.h b/ftl/FTLExitPropertyValue.h
new file mode 100644
index 0000000..228827a
--- /dev/null
+++ b/ftl/FTLExitPropertyValue.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGPromotedHeapLocation.h"
+#include "FTLExitValue.h"
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace FTL {
+
+class ExitPropertyValue {
+public:
+    ExitPropertyValue()
+    {
+    }
+    
+    ExitPropertyValue(DFG::PromotedLocationDescriptor location, const ExitValue& value)
+        : m_location(location)
+        , m_value(value)
+    {
+        ASSERT(!!location == !!value);
+    }
+    
+    bool operator!() const { return !m_location; }
+    
+    DFG::PromotedLocationDescriptor location() const { return m_location; }
+    const ExitValue& value() const { return m_value; }
+    
+    ExitPropertyValue withLocalsOffset(int offset) const;
+    
+    void dump(PrintStream& out) const;
+    
+    void validateReferences(const TrackedReferences&) const;
+
+private:
+    DFG::PromotedLocationDescriptor m_location;
+    ExitValue m_value;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLExitTimeObjectMaterialization.cpp b/ftl/FTLExitTimeObjectMaterialization.cpp
new file mode 100644
index 0000000..858d1ba
--- /dev/null
+++ b/ftl/FTLExitTimeObjectMaterialization.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLExitTimeObjectMaterialization.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace FTL {
+
+using namespace JSC::DFG;
+
+ExitTimeObjectMaterialization::ExitTimeObjectMaterialization(NodeType type, CodeOrigin codeOrigin)
+    : m_type(type)
+    , m_origin(codeOrigin)
+{
+}
+
+ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization()
+{
+}
+
+void ExitTimeObjectMaterialization::add(
+    PromotedLocationDescriptor location, const ExitValue& value)
+{
+    m_properties.append(ExitPropertyValue(location, value));
+}
+
+ExitValue ExitTimeObjectMaterialization::get(PromotedLocationDescriptor location) const
+{
+    for (ExitPropertyValue value : m_properties) {
+        if (value.location() == location)
+            return value.value();
+    }
+    return ExitValue();
+}
+
+void ExitTimeObjectMaterialization::accountForLocalsOffset(int offset)
+{
+    for (ExitPropertyValue& property : m_properties)
+        property = property.withLocalsOffset(offset);
+}
+
+void ExitTimeObjectMaterialization::dump(PrintStream& out) const
+{
+    out.print(RawPointer(this), ":", Graph::opName(m_type), "(", listDump(m_properties), ")");
+}
+
+void ExitTimeObjectMaterialization::validateReferences(const TrackedReferences& trackedReferences) const
+{
+    for (ExitPropertyValue value : m_properties)
+        value.validateReferences(trackedReferences);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLExitTimeObjectMaterialization.h b/ftl/FTLExitTimeObjectMaterialization.h
new file mode 100644
index 0000000..549af11
--- /dev/null
+++ b/ftl/FTLExitTimeObjectMaterialization.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGNodeType.h"
+#include "FTLExitPropertyValue.h"
+#include "FTLExitValue.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace FTL {
+
+class ExitTimeObjectMaterialization {
+    WTF_MAKE_NONCOPYABLE(ExitTimeObjectMaterialization)
+public:
+    ExitTimeObjectMaterialization(DFG::NodeType, CodeOrigin);
+    ~ExitTimeObjectMaterialization();
+    
+    void add(DFG::PromotedLocationDescriptor, const ExitValue&);
+    
+    DFG::NodeType type() const { return m_type; }
+    CodeOrigin origin() const { return m_origin; }
+    
+    ExitValue get(DFG::PromotedLocationDescriptor) const;
+    const Vector<ExitPropertyValue>& properties() const { return m_properties; }
+    
+    void accountForLocalsOffset(int offset);
+    
+    void dump(PrintStream& out) const;
+    
+    void validateReferences(const TrackedReferences&) const;
+    
+private:
+    DFG::NodeType m_type;
+    CodeOrigin m_origin;
+    Vector<ExitPropertyValue> m_properties;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLExitValue.cpp b/ftl/FTLExitValue.cpp
new file mode 100644
index 0000000..7004b9b
--- /dev/null
+++ b/ftl/FTLExitValue.cpp
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLExitValue.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLExitTimeObjectMaterialization.h"
+#include "JSCInlines.h"
+#include "TrackedReferences.h"
+
+namespace JSC { namespace FTL {
+
+ExitValue ExitValue::materializeNewObject(ExitTimeObjectMaterialization* data)
+{
+    ExitValue result;
+    result.m_kind = ExitValueMaterializeNewObject;
+    result.u.newObjectMaterializationData = data;
+    return result;
+}
+
+ExitValue ExitValue::withLocalsOffset(int offset) const
+{
+    if (!isInJSStackSomehow())
+        return *this;
+    if (!virtualRegister().isLocal())
+        return *this;
+    return withVirtualRegister(virtualRegister() + offset);
+}
+
+DataFormat ExitValue::dataFormat() const
+{
+    switch (kind()) {
+    case InvalidExitValue:
+        RELEASE_ASSERT_NOT_REACHED();
+        return DataFormatNone;
+            
+    case ExitValueDead:
+    case ExitValueConstant:
+    case ExitValueInJSStack:
+    case ExitValueMaterializeNewObject:
+        return DataFormatJS;
+            
+    case ExitValueArgument:
+        return exitArgument().format();
+            
+    case ExitValueInJSStackAsInt32:
+        return DataFormatInt32;
+            
+    case ExitValueInJSStackAsInt52:
+        return DataFormatInt52;
+            
+    case ExitValueInJSStackAsDouble:
+        return DataFormatDouble;
+            
+    case ExitValueRecovery:
+        return recoveryFormat();
+    }
+        
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ExitValue::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    switch (kind()) {
+    case InvalidExitValue:
+        out.print("Invalid");
+        return;
+    case ExitValueDead:
+        out.print("Dead");
+        return;
+    case ExitValueArgument:
+        out.print("Argument(", exitArgument(), ")");
+        return;
+    case ExitValueConstant:
+        out.print("Constant(", inContext(constant(), context), ")");
+        return;
+    case ExitValueInJSStack:
+        out.print("InJSStack:", virtualRegister());
+        return;
+    case ExitValueInJSStackAsInt32:
+        out.print("InJSStackAsInt32:", virtualRegister());
+        return;
+    case ExitValueInJSStackAsInt52:
+        out.print("InJSStackAsInt52:", virtualRegister());
+        return;
+    case ExitValueInJSStackAsDouble:
+        out.print("InJSStackAsDouble:", virtualRegister());
+        return;
+    case ExitValueRecovery:
+        out.print("Recovery(", recoveryOpcode(), ", arg", leftRecoveryArgument(), ", arg", rightRecoveryArgument(), ", ", recoveryFormat(), ")");
+        return;
+    case ExitValueMaterializeNewObject:
+        out.print("Materialize(", WTF::RawPointer(objectMaterialization()), ")");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ExitValue::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+void ExitValue::validateReferences(const TrackedReferences& trackedReferences) const
+{
+    if (isConstant())
+        trackedReferences.check(constant());
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLExitValue.h b/ftl/FTLExitValue.h
new file mode 100644
index 0000000..c9946b2
--- /dev/null
+++ b/ftl/FTLExitValue.h
@@ -0,0 +1,261 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLExitArgument.h"
+#include "FTLRecoveryOpcode.h"
+#include "JSCJSValue.h"
+#include "VirtualRegister.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace FTL {
+
+// This is like ValueRecovery, but respects the way that the FTL does OSR
+// exit: the live non-constant non-flushed values are passed as arguments
+// to a noreturn tail call. ExitValue is hence mostly responsible for
+// telling us the mapping between operands in bytecode and the arguments to
+// the call.
+
+enum ExitValueKind {
+    InvalidExitValue,
+    ExitValueDead,
+    ExitValueArgument,
+    ExitValueConstant,
+    ExitValueInJSStack,
+    ExitValueInJSStackAsInt32,
+    ExitValueInJSStackAsInt52,
+    ExitValueInJSStackAsDouble,
+    ExitValueRecovery,
+    ExitValueMaterializeNewObject
+};
+
+class ExitTimeObjectMaterialization;
+
+class ExitValue {
+public:
+    ExitValue()
+        : m_kind(InvalidExitValue)
+    {
+    }
+    
+    bool operator!() const { return m_kind == InvalidExitValue; }
+    
+    static ExitValue dead()
+    {
+        ExitValue result;
+        result.m_kind = ExitValueDead;
+        return result;
+    }
+    
+    static ExitValue inJSStack(VirtualRegister reg)
+    {
+        ExitValue result;
+        result.m_kind = ExitValueInJSStack;
+        result.u.virtualRegister = reg.offset();
+        return result;
+    }
+    
+    static ExitValue inJSStackAsInt32(VirtualRegister reg)
+    {
+        ExitValue result;
+        result.m_kind = ExitValueInJSStackAsInt32;
+        result.u.virtualRegister = reg.offset();
+        return result;
+    }
+    
+    static ExitValue inJSStackAsInt52(VirtualRegister reg)
+    {
+        ExitValue result;
+        result.m_kind = ExitValueInJSStackAsInt52;
+        result.u.virtualRegister = reg.offset();
+        return result;
+    }
+    
+    static ExitValue inJSStackAsDouble(VirtualRegister reg)
+    {
+        ExitValue result;
+        result.m_kind = ExitValueInJSStackAsDouble;
+        result.u.virtualRegister = reg.offset();
+        return result;
+    }
+    
+    static ExitValue constant(JSValue value)
+    {
+        ExitValue result;
+        result.m_kind = ExitValueConstant;
+        result.u.constant = JSValue::encode(value);
+        return result;
+    }
+    
+    static ExitValue exitArgument(const ExitArgument& argument)
+    {
+        ExitValue result;
+        result.m_kind = ExitValueArgument;
+        result.u.argument = argument.representation();
+        return result;
+    }
+    
+    static ExitValue recovery(RecoveryOpcode opcode, unsigned leftArgument, unsigned rightArgument, DataFormat format)
+    {
+        ExitValue result;
+        result.m_kind = ExitValueRecovery;
+        result.u.recovery.opcode = opcode;
+        result.u.recovery.leftArgument = leftArgument;
+        result.u.recovery.rightArgument = rightArgument;
+        result.u.recovery.format = format;
+        return result;
+    }
+    
+    static ExitValue materializeNewObject(ExitTimeObjectMaterialization*);
+    
+    ExitValueKind kind() const { return m_kind; }
+    
+    bool isDead() const { return kind() == ExitValueDead; }
+    bool isInJSStackSomehow() const
+    {
+        switch (kind()) {
+        case ExitValueInJSStack:
+        case ExitValueInJSStackAsInt32:
+        case ExitValueInJSStackAsInt52:
+        case ExitValueInJSStackAsDouble:
+            return true;
+        default:
+            return false;
+        }
+    }
+    bool isConstant() const { return kind() == ExitValueConstant; }
+    bool isArgument() const { return kind() == ExitValueArgument; }
+    bool isRecovery() const { return kind() == ExitValueRecovery; }
+    bool isObjectMaterialization() const { return kind() == ExitValueMaterializeNewObject; }
+    bool hasIndexInStackmapLocations() const { return isArgument() || isRecovery(); }
+    
+    ExitArgument exitArgument() const
+    {
+        ASSERT(isArgument());
+        return ExitArgument(u.argument);
+    }
+    
+    unsigned leftRecoveryArgument() const
+    {
+        ASSERT(isRecovery());
+        return u.recovery.leftArgument;
+    }
+    
+    unsigned rightRecoveryArgument() const
+    {
+        ASSERT(isRecovery());
+        return u.recovery.rightArgument;
+    }
+
+    void adjustStackmapLocationsIndexByOffset(unsigned offset)
+    {
+        ASSERT(hasIndexInStackmapLocations());
+        if (isArgument())
+            u.argument.argument += offset;
+        else {
+            ASSERT(isRecovery());
+            u.recovery.rightArgument += offset;
+            u.recovery.leftArgument += offset;
+        }
+    }
+    
+    DataFormat recoveryFormat() const
+    {
+        ASSERT(isRecovery());
+        return static_cast<DataFormat>(u.recovery.format);
+    }
+    
+    RecoveryOpcode recoveryOpcode() const
+    {
+        ASSERT(isRecovery());
+        return static_cast<RecoveryOpcode>(u.recovery.opcode);
+    }
+    
+    JSValue constant() const
+    {
+        ASSERT(isConstant());
+        return JSValue::decode(u.constant);
+    }
+    
+    VirtualRegister virtualRegister() const
+    {
+        ASSERT(isInJSStackSomehow());
+        return VirtualRegister(u.virtualRegister);
+    }
+    
+    ExitTimeObjectMaterialization* objectMaterialization() const
+    {
+        ASSERT(isObjectMaterialization());
+        return u.newObjectMaterializationData;
+    }
+
+    ExitValue withVirtualRegister(VirtualRegister virtualRegister) const
+    {
+        ASSERT(isInJSStackSomehow());
+        ExitValue result;
+        result.m_kind = m_kind;
+        result.u.virtualRegister = virtualRegister.offset();
+        return result;
+    }
+    
+    ExitValue withLocalsOffset(int offset) const;
+    
+    // If it's in the JSStack somehow, this will tell you what format it's in, in a manner
+    // that is compatible with exitArgument().format(). If it's a constant or it's dead, it
+    // will claim to be a JSValue. If it's an argument then it will tell you the argument's
+    // format.
+    DataFormat dataFormat() const;
+
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    
+    void validateReferences(const TrackedReferences&) const;
+    
+private:
+    ExitValueKind m_kind;
+    union {
+        ExitArgumentRepresentation argument;
+        EncodedJSValue constant;
+        int virtualRegister;
+        struct {
+            uint16_t leftArgument;
+            uint16_t rightArgument;
+            uint16_t opcode;
+            uint16_t format;
+        } recovery;
+        ExitTimeObjectMaterialization* newObjectMaterializationData;
+    } u;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLFail.cpp b/ftl/FTLFail.cpp
new file mode 100644
index 0000000..5c6426a
--- /dev/null
+++ b/ftl/FTLFail.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLFail.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGFailedFinalizer.h"
+#include "FTLJITCode.h"
+
+namespace JSC { namespace FTL {
+
+using namespace DFG;
+
+void fail(State& state)
+{
+    state.graph.m_plan.finalizer = std::make_unique<FailedFinalizer>(state.graph.m_plan);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLFail.h b/ftl/FTLFail.h
new file mode 100644
index 0000000..35188a4
--- /dev/null
+++ b/ftl/FTLFail.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLState.h"
+
+namespace JSC { namespace FTL {
+
+void fail(State&);
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLForOSREntryJITCode.cpp b/ftl/FTLForOSREntryJITCode.cpp
new file mode 100644
index 0000000..3080dc3
--- /dev/null
+++ b/ftl/FTLForOSREntryJITCode.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLForOSREntryJITCode.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+ForOSREntryJITCode::ForOSREntryJITCode()
+    : m_bytecodeIndex(UINT_MAX)
+    , m_entryFailureCount(0)
+{
+}
+
+ForOSREntryJITCode::~ForOSREntryJITCode()
+{
+}
+
+ForOSREntryJITCode* ForOSREntryJITCode::ftlForOSREntry()
+{
+    return this;
+}
+
+void ForOSREntryJITCode::initializeEntryBuffer(VM& vm, unsigned numCalleeLocals)
+{
+    m_entryBuffer = vm.scratchBufferForSize(numCalleeLocals * sizeof(EncodedJSValue));
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLForOSREntryJITCode.h b/ftl/FTLForOSREntryJITCode.h
new file mode 100644
index 0000000..06db3de
--- /dev/null
+++ b/ftl/FTLForOSREntryJITCode.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLJITCode.h"
+
+namespace JSC { namespace FTL {
+
+// OSR entry into the FTL has a number of quirks:
+//
+// - OSR entry only happens through special OSR entry compilations. They have their
+//   own CodeBlock and their own JITCode.
+//
+// - We only OSR enter in loop headers that have a null inline call frame.
+//
+// - Each OSR entry compilation allows entry through only one bytecode index.
+
+class ForOSREntryJITCode : public FTL::JITCode {
+public:
+    ForOSREntryJITCode();
+    ~ForOSREntryJITCode();
+    
+    void initializeEntryBuffer(VM&, unsigned numCalleeLocals);
+    ScratchBuffer* entryBuffer() const { return m_entryBuffer; }
+    
+    void setBytecodeIndex(unsigned value) { m_bytecodeIndex = value; }
+    unsigned bytecodeIndex() const { return m_bytecodeIndex; }
+    
+    void countEntryFailure() { m_entryFailureCount++; }
+    unsigned entryFailureCount() const { return m_entryFailureCount; }
+    
+    ForOSREntryJITCode* ftlForOSREntry();
+    
+private:
+    ScratchBuffer* m_entryBuffer; // Only for OSR entry code blocks.
+    unsigned m_bytecodeIndex;
+    unsigned m_entryFailureCount;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FLT_JIT)
diff --git a/ftl/FTLFormattedValue.h b/ftl/FTLFormattedValue.h
new file mode 100644
index 0000000..ee0a070
--- /dev/null
+++ b/ftl/FTLFormattedValue.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DataFormat.h"
+#include "FTLAbbreviatedTypes.h"
+
+namespace JSC { namespace FTL {
+
+// This class is mostly used for OSR; it's a way of specifying how a value is formatted
+// in cases where it wouldn't have been obvious from looking at other indicators (like
+// the type of the B3::Value* or the type of the DFG::Node).
+
+class FormattedValue {
+public:
+    FormattedValue()
+        : m_format(DataFormatNone)
+        , m_value(0)
+    {
+    }
+    
+    FormattedValue(DataFormat format, LValue value)
+        : m_format(format)
+        , m_value(value)
+    {
+    }
+    
+    bool operator!() const
+    {
+        ASSERT((m_format == DataFormatNone) == !m_value);
+        return m_format == DataFormatNone;
+    }
+    
+    DataFormat format() const { return m_format; }
+    LValue value() const { return m_value; }
+
+private:
+    DataFormat m_format;
+    LValue m_value;
+};
+
+static inline FormattedValue noValue() { return FormattedValue(); }
+static inline FormattedValue int32Value(LValue value) { return FormattedValue(DataFormatInt32, value); }
+static inline FormattedValue booleanValue(LValue value) { return FormattedValue(DataFormatBoolean, value); }
+static inline FormattedValue jsValueValue(LValue value) { return FormattedValue(DataFormatJS, value); }
+static inline FormattedValue doubleValue(LValue value) { return FormattedValue(DataFormatDouble, value); }
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLGeneratedFunction.h b/ftl/FTLGeneratedFunction.h
new file mode 100644
index 0000000..f6fba28
--- /dev/null
+++ b/ftl/FTLGeneratedFunction.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "CallFrame.h"
+
+namespace JSC { namespace FTL {
+
+typedef EncodedJSValue (*GeneratedFunction)(ExecState*);
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLJITCode.cpp b/ftl/FTLJITCode.cpp
new file mode 100644
index 0000000..1cdb509
--- /dev/null
+++ b/ftl/FTLJITCode.cpp
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLJITCode.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLState.h"
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+
+JITCode::JITCode()
+    : JSC::JITCode(FTLJIT)
+{
+}
+
+JITCode::~JITCode()
+{
+    if (FTL::shouldDumpDisassembly()) {
+        dataLog("Destroying FTL JIT code at ");
+        CommaPrinter comma;
+        dataLog(comma, m_b3Code);
+        dataLog(comma, m_arityCheckEntrypoint);
+        dataLog("\n");
+    }
+}
+
+void JITCode::initializeB3Code(CodeRef b3Code)
+{
+    m_b3Code = b3Code;
+}
+
+void JITCode::initializeB3Byproducts(std::unique_ptr<OpaqueByproducts> byproducts)
+{
+    m_b3Byproducts = WTFMove(byproducts);
+}
+
+void JITCode::initializeAddressForCall(CodePtr address)
+{
+    m_addressForCall = address;
+}
+
+void JITCode::initializeArityCheckEntrypoint(CodeRef entrypoint)
+{
+    m_arityCheckEntrypoint = entrypoint;
+}
+
+JITCode::CodePtr JITCode::addressForCall(ArityCheckMode arityCheck)
+{
+    switch (arityCheck) {
+    case ArityCheckNotRequired:
+        return m_addressForCall;
+    case MustCheckArity:
+        return m_arityCheckEntrypoint.code();
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return CodePtr();
+}
+
+void* JITCode::executableAddressAtOffset(size_t offset)
+{
+    return reinterpret_cast<char*>(m_addressForCall.executableAddress()) + offset;
+}
+
+void* JITCode::dataAddressAtOffset(size_t)
+{
+    // We can't patch FTL code, yet. Even if we did, it's not clear that we would do so
+    // through this API.
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+unsigned JITCode::offsetOf(void*)
+{
+    // We currently don't have visibility into the FTL code.
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+size_t JITCode::size()
+{
+    // We don't know the size of FTL code, yet. Make a wild guess. This is mostly used for
+    // GC load estimates.
+    return 1000;
+}
+
+bool JITCode::contains(void*)
+{
+    // We have no idea what addresses the FTL code contains, yet.
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+JITCode* JITCode::ftl()
+{
+    return this;
+}
+
+DFG::CommonData* JITCode::dfgCommon()
+{
+    return &common;
+}
+
+void JITCode::validateReferences(const TrackedReferences& trackedReferences)
+{
+    common.validateReferences(trackedReferences);
+    
+    for (OSRExit& exit : osrExit)
+        exit.m_descriptor->validateReferences(trackedReferences);
+}
+
+RegisterSet JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite(CodeBlock*, CallSiteIndex callSiteIndex)
+{
+    for (OSRExit& exit : osrExit) {
+        if (exit.m_exceptionHandlerCallSiteIndex.bits() == callSiteIndex.bits()) {
+            RELEASE_ASSERT(exit.isExceptionHandler());
+            RELEASE_ASSERT(exit.isGenericUnwindHandler());
+            return ValueRep::usedRegisters(exit.m_valueReps);
+        }
+    }
+    return RegisterSet();
+}
+
+std::optional<CodeOrigin> JITCode::findPC(CodeBlock* codeBlock, void* pc)
+{
+    for (OSRExit& exit : osrExit) {
+        if (ExecutableMemoryHandle* handle = exit.m_code.executableMemory()) {
+            if (handle->start() <= pc && pc < handle->end())
+                return std::optional<CodeOrigin>(exit.m_codeOriginForExitProfile);
+        }
+    }
+
+    for (std::unique_ptr<LazySlowPath>& lazySlowPath : lazySlowPaths) {
+        if (ExecutableMemoryHandle* handle = lazySlowPath->stub().executableMemory()) {
+            if (handle->start() <= pc && pc < handle->end())
+                return std::optional<CodeOrigin>(codeBlock->codeOrigin(lazySlowPath->callSiteIndex()));
+        }
+    }
+
+    return std::nullopt;
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLJITCode.h b/ftl/FTLJITCode.h
new file mode 100644
index 0000000..2c2809e
--- /dev/null
+++ b/ftl/FTLJITCode.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "B3OpaqueByproducts.h"
+#include "DFGCommonData.h"
+#include "FTLLazySlowPath.h"
+#include "FTLOSRExit.h"
+#include "JITCode.h"
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace FTL {
+
+class JITCode : public JSC::JITCode {
+public:
+    JITCode();
+    ~JITCode();
+
+    CodePtr addressForCall(ArityCheckMode) override;
+    void* executableAddressAtOffset(size_t offset) override;
+    void* dataAddressAtOffset(size_t offset) override;
+    unsigned offsetOf(void* pointerIntoCode) override;
+    size_t size() override;
+    bool contains(void*) override;
+
+    void initializeB3Code(CodeRef);
+    void initializeB3Byproducts(std::unique_ptr<B3::OpaqueByproducts>);
+    void initializeAddressForCall(CodePtr);
+    void initializeArityCheckEntrypoint(CodeRef);
+    
+    void validateReferences(const TrackedReferences&) override;
+
+    RegisterSet liveRegistersToPreserveAtExceptionHandlingCallSite(CodeBlock*, CallSiteIndex) override;
+
+    std::optional<CodeOrigin> findPC(CodeBlock*, void* pc) override;
+
+    CodeRef b3Code() const { return m_b3Code; }
+    
+    JITCode* ftl() override;
+    DFG::CommonData* dfgCommon() override;
+    static ptrdiff_t commonDataOffset() { return OBJECT_OFFSETOF(JITCode, common); }
+    
+    DFG::CommonData common;
+    SegmentedVector<OSRExit, 8> osrExit;
+    SegmentedVector<OSRExitDescriptor, 8> osrExitDescriptors;
+    Vector<std::unique_ptr<LazySlowPath>> lazySlowPaths;
+    
+private:
+    CodePtr m_addressForCall;
+    CodeRef m_b3Code;
+    std::unique_ptr<B3::OpaqueByproducts> m_b3Byproducts;
+    CodeRef m_arityCheckEntrypoint;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FLT_JIT)
diff --git a/ftl/FTLJITFinalizer.cpp b/ftl/FTLJITFinalizer.cpp
new file mode 100644
index 0000000..dcf3dad
--- /dev/null
+++ b/ftl/FTLJITFinalizer.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2013-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLJITFinalizer.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "CodeBlockWithJITType.h"
+#include "DFGPlan.h"
+#include "FTLState.h"
+#include "FTLThunks.h"
+#include "JSCInlines.h"
+#include "ProfilerDatabase.h"
+
+namespace JSC { namespace FTL {
+
+using namespace DFG;
+
+JITFinalizer::JITFinalizer(Plan& plan)
+    : Finalizer(plan)
+{
+}
+
+JITFinalizer::~JITFinalizer()
+{
+}
+
+size_t JITFinalizer::codeSize()
+{
+    size_t result = 0;
+
+    if (b3CodeLinkBuffer)
+        result += b3CodeLinkBuffer->size();
+    
+    if (entrypointLinkBuffer)
+        result += entrypointLinkBuffer->size();
+    
+    return result;
+}
+
+bool JITFinalizer::finalize()
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool JITFinalizer::finalizeFunction()
+{
+    bool dumpDisassembly = shouldDumpDisassembly() || Options::asyncDisassembly();
+    
+    jitCode->initializeB3Code(
+        FINALIZE_CODE_IF(
+            dumpDisassembly, *b3CodeLinkBuffer,
+            ("FTL B3 code for %s", toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::FTLJIT)).data())));
+
+    jitCode->initializeArityCheckEntrypoint(
+        FINALIZE_CODE_IF(
+            dumpDisassembly, *entrypointLinkBuffer,
+            ("FTL entrypoint thunk for %s with B3 generated code at %p", toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::FTLJIT)).data(), function)));
+    
+    m_plan.codeBlock->setJITCode(jitCode);
+
+    if (m_plan.compilation)
+        m_plan.vm->m_perBytecodeProfiler->addCompilation(m_plan.codeBlock, m_plan.compilation);
+    
+    return true;
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLJITFinalizer.h b/ftl/FTLJITFinalizer.h
new file mode 100644
index 0000000..630c3b4
--- /dev/null
+++ b/ftl/FTLJITFinalizer.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGFinalizer.h"
+#include "FTLGeneratedFunction.h"
+#include "FTLJITCode.h"
+#include "FTLSlowPathCall.h"
+#include "LinkBuffer.h"
+#include "MacroAssembler.h"
+
+namespace JSC { namespace FTL {
+
+class OutOfLineCodeInfo {
+public:
+    OutOfLineCodeInfo(std::unique_ptr<LinkBuffer> linkBuffer, const char* codeDescription)
+        : m_linkBuffer(WTFMove(linkBuffer))
+        , m_codeDescription(codeDescription)
+    {
+    }
+
+    std::unique_ptr<LinkBuffer> m_linkBuffer;
+    const char* m_codeDescription;
+};
+
+class JITFinalizer : public DFG::Finalizer {
+public:
+    JITFinalizer(DFG::Plan&);
+    virtual ~JITFinalizer();
+
+    size_t codeSize() override;
+    bool finalize() override;
+    bool finalizeFunction() override;
+
+    std::unique_ptr<LinkBuffer> b3CodeLinkBuffer;
+
+    // Eventually, we can get rid of this with B3.
+    std::unique_ptr<LinkBuffer> entrypointLinkBuffer;
+    
+    Vector<CCallHelpers::Jump> lazySlowPathGeneratorJumps;
+    GeneratedFunction function;
+    RefPtr<JITCode> jitCode;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLLazySlowPath.cpp b/ftl/FTLLazySlowPath.cpp
new file mode 100644
index 0000000..9bdc06d
--- /dev/null
+++ b/ftl/FTLLazySlowPath.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLLazySlowPath.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLSlowPathCall.h"
+#include "LinkBuffer.h"
+
+namespace JSC { namespace FTL {
+
+LazySlowPath::LazySlowPath(
+    CodeLocationJump patchableJump, CodeLocationLabel done,
+    CodeLocationLabel exceptionTarget,
+    const RegisterSet& usedRegisters, CallSiteIndex callSiteIndex, RefPtr<Generator> generator
+    )
+    : m_patchableJump(patchableJump)
+    , m_done(done)
+    , m_exceptionTarget(exceptionTarget)
+    , m_usedRegisters(usedRegisters)
+    , m_callSiteIndex(callSiteIndex)
+    , m_generator(generator)
+{
+}
+
+LazySlowPath::~LazySlowPath()
+{
+}
+
+void LazySlowPath::generate(CodeBlock* codeBlock)
+{
+    RELEASE_ASSERT(!m_stub);
+
+    VM& vm = *codeBlock->vm();
+
+    CCallHelpers jit(&vm, codeBlock);
+    GenerationParams params;
+    CCallHelpers::JumpList exceptionJumps;
+    params.exceptionJumps = m_exceptionTarget ? &exceptionJumps : nullptr;
+    params.lazySlowPath = this;
+
+    m_generator->run(jit, params);
+
+    LinkBuffer linkBuffer(vm, jit, codeBlock, JITCompilationMustSucceed);
+    linkBuffer.link(params.doneJumps, m_done);
+    if (m_exceptionTarget)
+        linkBuffer.link(exceptionJumps, m_exceptionTarget);
+    m_stub = FINALIZE_CODE_FOR(codeBlock, linkBuffer, ("Lazy slow path call stub"));
+
+    MacroAssembler::repatchJump(m_patchableJump, CodeLocationLabel(m_stub.code()));
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLLazySlowPath.h b/ftl/FTLLazySlowPath.h
new file mode 100644
index 0000000..83b5baf
--- /dev/null
+++ b/ftl/FTLLazySlowPath.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "CCallHelpers.h"
+#include "CodeBlock.h"
+#include "CodeLocation.h"
+#include "GPRInfo.h"
+#include "MacroAssemblerCodeRef.h"
+#include "RegisterSet.h"
+#include "ScratchRegisterAllocator.h"
+#include <wtf/SharedTask.h>
+
+namespace JSC { namespace FTL {
+
+// A LazySlowPath is an object that represents a piece of code that is part of FTL generated code
+// that will be generated lazily. It holds all of the important information needed to generate that
+// code, such as where to link jumps to and which registers are in use. It also has a reference to a
+// SharedTask that will do the actual code generation. That SharedTask may have additional data, like
+// which registers hold the inputs or outputs.
+class LazySlowPath {
+    WTF_MAKE_NONCOPYABLE(LazySlowPath);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    struct GenerationParams {
+        // Extra parameters to the GeneratorFunction are made into fields of this struct, so that if
+        // we add new parameters, we don't have to change all of the users.
+        CCallHelpers::JumpList doneJumps;
+        CCallHelpers::JumpList* exceptionJumps;
+        LazySlowPath* lazySlowPath;
+    };
+
+    typedef void GeneratorFunction(CCallHelpers&, GenerationParams&);
+    typedef SharedTask<GeneratorFunction> Generator;
+
+    template<typename Functor>
+    static RefPtr<Generator> createGenerator(const Functor& functor)
+    {
+        return createSharedTask<GeneratorFunction>(functor);
+    }
+    
+    LazySlowPath(
+        CodeLocationJump patchableJump, CodeLocationLabel done,
+        CodeLocationLabel exceptionTarget, const RegisterSet& usedRegisters,
+        CallSiteIndex, RefPtr<Generator>
+        );
+
+    ~LazySlowPath();
+
+    CodeLocationJump patchableJump() const { return m_patchableJump; }
+    CodeLocationLabel done() const { return m_done; }
+    const RegisterSet& usedRegisters() const { return m_usedRegisters; }
+    CallSiteIndex callSiteIndex() const { return m_callSiteIndex; }
+
+    void generate(CodeBlock*);
+
+    MacroAssemblerCodeRef stub() const { return m_stub; }
+
+private:
+    CodeLocationJump m_patchableJump;
+    CodeLocationLabel m_done;
+    CodeLocationLabel m_exceptionTarget;
+    RegisterSet m_usedRegisters;
+    CallSiteIndex m_callSiteIndex;
+    MacroAssemblerCodeRef m_stub;
+    RefPtr<Generator> m_generator;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLLazySlowPathCall.h b/ftl/FTLLazySlowPathCall.h
new file mode 100644
index 0000000..29214ac
--- /dev/null
+++ b/ftl/FTLLazySlowPathCall.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "CodeLocation.h"
+#include "FTLLazySlowPath.h"
+#include "FTLSlowPathCall.h"
+#include "FTLThunks.h"
+#include "GPRInfo.h"
+#include "MacroAssemblerCodeRef.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace FTL {
+
+template<typename ResultType, typename... ArgumentTypes>
+RefPtr<LazySlowPath::Generator> createLazyCallGenerator(
+    FunctionPtr function, ResultType result, ArgumentTypes... arguments)
+{
+    return LazySlowPath::createGenerator(
+        [=] (CCallHelpers& jit, LazySlowPath::GenerationParams& params) {
+            callOperation(
+                params.lazySlowPath->usedRegisters(), jit, params.lazySlowPath->callSiteIndex(),
+                params.exceptionJumps, function, result, arguments...);
+            params.doneJumps.append(jit.jump());
+        });
+}
+
+} } // namespace JSC::FTL
diff --git a/ftl/FTLLink.cpp b/ftl/FTLLink.cpp
new file mode 100644
index 0000000..d11b2a9
--- /dev/null
+++ b/ftl/FTLLink.cpp
@@ -0,0 +1,211 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLLink.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "CCallHelpers.h"
+#include "CodeBlockWithJITType.h"
+#include "DFGCommon.h"
+#include "FTLJITCode.h"
+#include "JITOperations.h"
+#include "LinkBuffer.h"
+#include "JSCInlines.h"
+#include "ProfilerCompilation.h"
+#include "VirtualRegister.h"
+
+namespace JSC { namespace FTL {
+
+using namespace DFG;
+
+void link(State& state)
+{
+    Graph& graph = state.graph;
+    CodeBlock* codeBlock = graph.m_codeBlock;
+    VM& vm = graph.m_vm;
+    
+    // B3 will create its own jump tables as needed.
+    codeBlock->clearSwitchJumpTables();
+
+    state.jitCode->common.requiredRegisterCountForExit = graph.requiredRegisterCountForExit();
+    
+    if (!graph.m_plan.inlineCallFrames->isEmpty())
+        state.jitCode->common.inlineCallFrames = graph.m_plan.inlineCallFrames;
+    
+    graph.registerFrozenValues();
+
+    // Create the entrypoint. Note that we use this entrypoint totally differently
+    // depending on whether we're doing OSR entry or not.
+    CCallHelpers jit(&vm, codeBlock);
+    
+    std::unique_ptr<LinkBuffer> linkBuffer;
+
+    CCallHelpers::Address frame = CCallHelpers::Address(
+        CCallHelpers::stackPointerRegister, -static_cast<int32_t>(AssemblyHelpers::prologueStackPointerDelta()));
+    
+    if (Profiler::Compilation* compilation = graph.compilation()) {
+        compilation->addDescription(
+            Profiler::OriginStack(),
+            toCString("Generated FTL JIT code for ", CodeBlockWithJITType(codeBlock, JITCode::FTLJIT), ", instruction count = ", graph.m_codeBlock->instructionCount(), ":\n"));
+        
+        graph.ensureDominators();
+        graph.ensureNaturalLoops();
+        
+        const char* prefix = "    ";
+        
+        DumpContext dumpContext;
+        StringPrintStream out;
+        Node* lastNode = 0;
+        for (size_t blockIndex = 0; blockIndex < graph.numBlocks(); ++blockIndex) {
+            BasicBlock* block = graph.block(blockIndex);
+            if (!block)
+                continue;
+            
+            graph.dumpBlockHeader(out, prefix, block, Graph::DumpLivePhisOnly, &dumpContext);
+            compilation->addDescription(Profiler::OriginStack(), out.toCString());
+            out.reset();
+            
+            for (size_t nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+                Node* node = block->at(nodeIndex);
+                
+                Profiler::OriginStack stack;
+                
+                if (node->origin.semantic.isSet()) {
+                    stack = Profiler::OriginStack(
+                        *vm.m_perBytecodeProfiler, codeBlock, node->origin.semantic);
+                }
+                
+                if (graph.dumpCodeOrigin(out, prefix, lastNode, node, &dumpContext)) {
+                    compilation->addDescription(stack, out.toCString());
+                    out.reset();
+                }
+                
+                graph.dump(out, prefix, node, &dumpContext);
+                compilation->addDescription(stack, out.toCString());
+                out.reset();
+                
+                if (node->origin.semantic.isSet())
+                    lastNode = node;
+            }
+        }
+        
+        dumpContext.dump(out, prefix);
+        compilation->addDescription(Profiler::OriginStack(), out.toCString());
+        out.reset();
+
+        out.print("    Disassembly:\n");
+        out.print("        <not implemented yet>\n");
+        compilation->addDescription(Profiler::OriginStack(), out.toCString());
+        out.reset();
+        
+        state.jitCode->common.compilation = compilation;
+    }
+    
+    switch (graph.m_plan.mode) {
+    case FTLMode: {
+        CCallHelpers::JumpList mainPathJumps;
+    
+        jit.load32(
+            frame.withOffset(sizeof(Register) * CallFrameSlot::argumentCount),
+            GPRInfo::regT1);
+        mainPathJumps.append(jit.branch32(
+            CCallHelpers::AboveOrEqual, GPRInfo::regT1,
+            CCallHelpers::TrustedImm32(codeBlock->numParameters())));
+        jit.emitFunctionPrologue();
+        jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+        jit.storePtr(GPRInfo::callFrameRegister, &vm.topCallFrame);
+        CCallHelpers::Call callArityCheck = jit.call();
+
+        auto noException = jit.branch32(CCallHelpers::GreaterThanOrEqual, GPRInfo::returnValueGPR, CCallHelpers::TrustedImm32(0));
+        jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+        jit.move(CCallHelpers::TrustedImmPtr(jit.vm()), GPRInfo::argumentGPR0);
+        jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+        CCallHelpers::Call callLookupExceptionHandlerFromCallerFrame = jit.call();
+        jit.jumpToExceptionHandler();
+        noException.link(&jit);
+
+        if (!ASSERT_DISABLED) {
+            jit.load64(vm.addressOfException(), GPRInfo::regT1);
+            jit.jitAssertIsNull(GPRInfo::regT1);
+        }
+
+        jit.move(GPRInfo::returnValueGPR, GPRInfo::argumentGPR0);
+        jit.emitFunctionEpilogue();
+        mainPathJumps.append(jit.branchTest32(CCallHelpers::Zero, GPRInfo::argumentGPR0));
+        jit.emitFunctionPrologue();
+        CCallHelpers::Call callArityFixup = jit.call();
+        jit.emitFunctionEpilogue();
+        mainPathJumps.append(jit.jump());
+
+        linkBuffer = std::make_unique<LinkBuffer>(vm, jit, codeBlock, JITCompilationCanFail);
+        if (linkBuffer->didFailToAllocate()) {
+            state.allocationFailed = true;
+            return;
+        }
+        linkBuffer->link(callArityCheck, codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck);
+        linkBuffer->link(callLookupExceptionHandlerFromCallerFrame, lookupExceptionHandlerFromCallerFrame);
+        linkBuffer->link(callArityFixup, FunctionPtr((vm.getCTIStub(arityFixupGenerator)).code().executableAddress()));
+        linkBuffer->link(mainPathJumps, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
+
+        state.jitCode->initializeAddressForCall(MacroAssemblerCodePtr(bitwise_cast<void*>(state.generatedFunction)));
+        break;
+    }
+        
+    case FTLForOSREntryMode: {
+        // We jump to here straight from DFG code, after having boxed up all of the
+        // values into the scratch buffer. Everything should be good to go - at this
+        // point we've even done the stack check. Basically we just have to make the
+        // call to the B3-generated code.
+        CCallHelpers::Label start = jit.label();
+        jit.emitFunctionEpilogue();
+        CCallHelpers::Jump mainPathJump = jit.jump();
+        
+        linkBuffer = std::make_unique<LinkBuffer>(vm, jit, codeBlock, JITCompilationCanFail);
+        if (linkBuffer->didFailToAllocate()) {
+            state.allocationFailed = true;
+            return;
+        }
+        linkBuffer->link(mainPathJump, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
+
+        state.jitCode->initializeAddressForCall(linkBuffer->locationOf(start));
+        break;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    
+    state.finalizer->entrypointLinkBuffer = WTFMove(linkBuffer);
+    state.finalizer->function = state.generatedFunction;
+    state.finalizer->jitCode = state.jitCode;
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLLink.h b/ftl/FTLLink.h
new file mode 100644
index 0000000..d380573
--- /dev/null
+++ b/ftl/FTLLink.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLState.h"
+
+namespace JSC { namespace FTL {
+
+void link(State&);
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLLocation.cpp b/ftl/FTLLocation.cpp
new file mode 100644
index 0000000..ac8f23e
--- /dev/null
+++ b/ftl/FTLLocation.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLLocation.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "B3ValueRep.h"
+#include "FTLSaveRestore.h"
+#include "RegisterSet.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/DataLog.h>
+#include <wtf/ListDump.h>
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+
+Location Location::forValueRep(const ValueRep& rep)
+{
+    switch (rep.kind()) {
+    case ValueRep::Register:
+        return forRegister(rep.reg(), 0);
+    case ValueRep::Stack:
+        return forIndirect(GPRInfo::callFrameRegister, rep.offsetFromFP());
+    case ValueRep::Constant:
+        return forConstant(rep.value());
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return Location();
+    }
+}
+
+void Location::dump(PrintStream& out) const
+{
+    out.print("(", kind());
+    if (hasReg())
+        out.print(", ", reg());
+    if (hasOffset())
+        out.print(", ", offset());
+    if (hasAddend())
+        out.print(", ", addend());
+    if (hasConstant())
+        out.print(", ", constant());
+    out.print(")");
+}
+
+bool Location::involvesGPR() const
+{
+    return isGPR() || kind() == Indirect;
+}
+
+bool Location::isGPR() const
+{
+    return kind() == Register && reg().isGPR();
+}
+
+GPRReg Location::gpr() const
+{
+    return reg().gpr();
+}
+
+bool Location::isFPR() const
+{
+    return kind() == Register && reg().isFPR();
+}
+
+FPRReg Location::fpr() const
+{
+    return reg().fpr();
+}
+
+void Location::restoreInto(MacroAssembler& jit, char* savedRegisters, GPRReg result, unsigned numFramesToPop) const
+{
+    if (involvesGPR() && RegisterSet::stackRegisters().get(gpr())) {
+        // Make the result GPR contain the appropriate stack register.
+        if (numFramesToPop) {
+            jit.move(MacroAssembler::framePointerRegister, result);
+            
+            for (unsigned i = numFramesToPop - 1; i--;)
+                jit.loadPtr(result, result);
+            
+            if (gpr() == MacroAssembler::framePointerRegister)
+                jit.loadPtr(result, result);
+            else
+                jit.addPtr(MacroAssembler::TrustedImmPtr(sizeof(void*) * 2), result);
+        } else
+            jit.move(gpr(), result);
+    }
+    
+    if (isGPR()) {
+        if (RegisterSet::stackRegisters().get(gpr())) {
+            // Already restored into result.
+        } else
+            jit.load64(savedRegisters + offsetOfGPR(gpr()), result);
+        
+        if (addend())
+            jit.add64(MacroAssembler::TrustedImm32(addend()), result);
+        return;
+    }
+    
+    if (isFPR()) {
+        jit.load64(savedRegisters + offsetOfFPR(fpr()), result);
+        ASSERT(!addend());
+        return;
+    }
+    
+    switch (kind()) {
+    case Register:
+        // B3 used some register that we don't know about!
+        dataLog("Unrecognized location: ", *this, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+        
+    case Indirect:
+        if (RegisterSet::stackRegisters().get(gpr())) {
+            // The stack register is already recovered into result.
+            jit.load64(MacroAssembler::Address(result, offset()), result);
+            return;
+        }
+        
+        jit.load64(savedRegisters + offsetOfGPR(gpr()), result);
+        jit.load64(MacroAssembler::Address(result, offset()), result);
+        return;
+        
+    case Constant:
+        jit.move(MacroAssembler::TrustedImm64(constant()), result);
+        return;
+        
+    case Unprocessed:
+        RELEASE_ASSERT_NOT_REACHED();
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+GPRReg Location::directGPR() const
+{
+    RELEASE_ASSERT(!addend());
+    return gpr();
+}
+
+} } // namespace JSC::FTL
+
+namespace WTF {
+
+using namespace JSC::FTL;
+
+void printInternal(PrintStream& out, JSC::FTL::Location::Kind kind)
+{
+    switch (kind) {
+    case Location::Unprocessed:
+        out.print("Unprocessed");
+        return;
+    case Location::Register:
+        out.print("Register");
+        return;
+    case Location::Indirect:
+        out.print("Indirect");
+        return;
+    case Location::Constant:
+        out.print("Constant");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLLocation.h b/ftl/FTLLocation.h
new file mode 100644
index 0000000..46772b9
--- /dev/null
+++ b/ftl/FTLLocation.h
@@ -0,0 +1,213 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGCommon.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "Reg.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+namespace B3 {
+class ValueRep;
+} // namespace B3
+
+namespace FTL {
+
+class Location {
+public:
+    enum Kind {
+        Unprocessed,
+        Register,
+        Indirect,
+        Constant
+    };
+    
+    Location()
+        : m_kind(Unprocessed)
+    {
+        u.constant = 0;
+    }
+    
+    Location(WTF::HashTableDeletedValueType)
+        : m_kind(Unprocessed)
+    {
+        u.constant = 1;
+    }
+
+    static Location forRegister(Reg reg, int32_t addend)
+    {
+        Location result;
+        result.m_kind = Register;
+        result.u.variable.regIndex = reg.index();
+        result.u.variable.offset = addend;
+        return result;
+    }
+    
+    static Location forIndirect(Reg reg, int32_t offset)
+    {
+        Location result;
+        result.m_kind = Indirect;
+        result.u.variable.regIndex = reg.index();
+        result.u.variable.offset = offset;
+        return result;
+    }
+    
+    static Location forConstant(int64_t constant)
+    {
+        Location result;
+        result.m_kind = Constant;
+        result.u.constant = constant;
+        return result;
+    }
+
+    static Location forValueRep(const B3::ValueRep&);
+
+    Kind kind() const { return m_kind; }
+
+    bool hasReg() const { return kind() == Register || kind() == Indirect; }
+    Reg reg() const
+    {
+        ASSERT(hasReg());
+        return Reg::fromIndex(u.variable.regIndex);
+    }
+    
+    bool hasOffset() const { return kind() == Indirect; }
+    int32_t offset() const
+    {
+        ASSERT(hasOffset());
+        return u.variable.offset;
+    }
+    
+    bool hasAddend() const { return kind() == Register; }
+    int32_t addend() const
+    {
+        ASSERT(hasAddend());
+        return u.variable.offset;
+    }
+    
+    bool hasConstant() const { return kind() == Constant; }
+    int64_t constant() const
+    {
+        ASSERT(hasConstant());
+        return u.constant;
+    }
+    
+    explicit operator bool() const { return kind() != Unprocessed || u.variable.offset; }
+
+    bool operator!() const { return !static_cast<bool>(*this); }
+    
+    bool isHashTableDeletedValue() const { return kind() == Unprocessed && u.variable.offset; }
+    
+    bool operator==(const Location& other) const
+    {
+        return m_kind == other.m_kind
+            && u.constant == other.u.constant;
+    }
+    
+    unsigned hash() const
+    {
+        unsigned result = m_kind;
+        
+        switch (kind()) {
+        case Unprocessed:
+            result ^= u.variable.offset;
+            break;
+
+        case Register:
+            result ^= u.variable.regIndex;
+            break;
+            
+        case Indirect:
+            result ^= u.variable.regIndex;
+            result ^= u.variable.offset;
+            break;
+            
+        case Constant:
+            result ^= WTF::IntHash<int64_t>::hash(u.constant);
+            break;
+        }
+        
+        return WTF::IntHash<unsigned>::hash(result);
+    }
+    
+    void dump(PrintStream&) const;
+    
+    bool isGPR() const;
+    bool involvesGPR() const;
+    GPRReg gpr() const;
+    GPRReg directGPR() const; // Get the GPR and assert that there is no addend.
+    
+    bool isFPR() const;
+    FPRReg fpr() const;
+    
+    // Assuming that all registers are saved to the savedRegisters buffer according
+    // to FTLSaveRestore convention, this loads the value into the given register.
+    // The code that this generates isn't exactly super fast. This assumes that FP
+    // and SP contain the same values that they would have contained in the original
+    // frame, or that you've done one or more canonically formed calls (i.e. can
+    // restore the FP by following the call frame linked list numFramesToPop times,
+    // and SP can be recovered by popping FP numFramesToPop-1 times and adding 16).
+    void restoreInto(MacroAssembler&, char* savedRegisters, GPRReg result, unsigned numFramesToPop = 0) const;
+    
+private:
+    Kind m_kind;
+    union {
+        int64_t constant;
+        struct {
+            unsigned regIndex;
+            int32_t offset;
+        } variable;
+    } u;
+};
+
+struct LocationHash {
+    static unsigned hash(const Location& key) { return key.hash(); }
+    static bool equal(const Location& a, const Location& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::FTL
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::FTL::Location::Kind);
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::FTL::Location> {
+    typedef JSC::FTL::LocationHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::FTL::Location> : SimpleClassHashTraits<JSC::FTL::Location> { };
+
+} // namespace WTF
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLLowerDFGToB3.cpp b/ftl/FTLLowerDFGToB3.cpp
new file mode 100644
index 0000000..8a59324
--- /dev/null
+++ b/ftl/FTLLowerDFGToB3.cpp
@@ -0,0 +1,13899 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLLowerDFGToB3.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "AirGenerationContext.h"
+#include "AllowMacroScratchRegisterUsage.h"
+#include "B3CheckValue.h"
+#include "B3FenceValue.h"
+#include "B3PatchpointValue.h"
+#include "B3SlotBaseValue.h"
+#include "B3StackmapGenerationParams.h"
+#include "B3ValueInlines.h"
+#include "CallFrameShuffler.h"
+#include "CodeBlockWithJITType.h"
+#include "DFGAbstractInterpreterInlines.h"
+#include "DFGCapabilities.h"
+#include "DFGDominators.h"
+#include "DFGInPlaceAbstractState.h"
+#include "DFGOSRAvailabilityAnalysisPhase.h"
+#include "DFGOSRExitFuzz.h"
+#include "DOMJITPatchpoint.h"
+#include "DirectArguments.h"
+#include "FTLAbstractHeapRepository.h"
+#include "FTLAvailableRecovery.h"
+#include "FTLDOMJITPatchpointParams.h"
+#include "FTLExceptionTarget.h"
+#include "FTLForOSREntryJITCode.h"
+#include "FTLFormattedValue.h"
+#include "FTLLazySlowPathCall.h"
+#include "FTLLoweredNodeValue.h"
+#include "FTLOperations.h"
+#include "FTLOutput.h"
+#include "FTLPatchpointExceptionHandle.h"
+#include "FTLThunks.h"
+#include "FTLWeightedTarget.h"
+#include "JITAddGenerator.h"
+#include "JITBitAndGenerator.h"
+#include "JITBitOrGenerator.h"
+#include "JITBitXorGenerator.h"
+#include "JITDivGenerator.h"
+#include "JITInlineCacheGenerator.h"
+#include "JITLeftShiftGenerator.h"
+#include "JITMathIC.h"
+#include "JITMulGenerator.h"
+#include "JITRightShiftGenerator.h"
+#include "JITSubGenerator.h"
+#include "JSCInlines.h"
+#include "JSGeneratorFunction.h"
+#include "JSLexicalEnvironment.h"
+#include "JSMap.h"
+#include "OperandsInlines.h"
+#include "ScopedArguments.h"
+#include "ScopedArgumentsTable.h"
+#include "ScratchRegisterAllocator.h"
+#include "SetupVarargsFrame.h"
+#include "ShadowChicken.h"
+#include "StructureStubInfo.h"
+#include "VirtualRegister.h"
+#include "Watchdog.h"
+#include <atomic>
+#if !OS(WINDOWS)
+#include <dlfcn.h>
+#endif
+#include <unordered_set>
+#include <wtf/Box.h>
+#include <wtf/ProcessID.h>
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+using namespace DFG;
+
+namespace {
+
+std::atomic<int> compileCounter;
+
+#if !ASSERT_DISABLED
+NO_RETURN_DUE_TO_CRASH static void ftlUnreachable(
+    CodeBlock* codeBlock, BlockIndex blockIndex, unsigned nodeIndex)
+{
+    dataLog("Crashing in thought-to-be-unreachable FTL-generated code for ", pointerDump(codeBlock), " at basic block #", blockIndex);
+    if (nodeIndex != UINT_MAX)
+        dataLog(", node @", nodeIndex);
+    dataLog(".\n");
+    CRASH();
+}
+#endif
+
+// Using this instead of typeCheck() helps to reduce the load on B3, by creating
+// significantly less dead code.
+#define FTL_TYPE_CHECK_WITH_EXIT_KIND(exitKind, lowValue, highValue, typesPassedThrough, failCondition) do { \
+        FormattedValue _ftc_lowValue = (lowValue);                      \
+        Edge _ftc_highValue = (highValue);                              \
+        SpeculatedType _ftc_typesPassedThrough = (typesPassedThrough);  \
+        if (!m_interpreter.needsTypeCheck(_ftc_highValue, _ftc_typesPassedThrough)) \
+            break;                                                      \
+        typeCheck(_ftc_lowValue, _ftc_highValue, _ftc_typesPassedThrough, (failCondition), exitKind); \
+    } while (false)
+
+#define FTL_TYPE_CHECK(lowValue, highValue, typesPassedThrough, failCondition) \
+    FTL_TYPE_CHECK_WITH_EXIT_KIND(BadType, lowValue, highValue, typesPassedThrough, failCondition)
+
+class LowerDFGToB3 {
+    WTF_MAKE_NONCOPYABLE(LowerDFGToB3);
+public:
+    LowerDFGToB3(State& state)
+        : m_graph(state.graph)
+        , m_ftlState(state)
+        , m_out(state)
+        , m_proc(*state.proc)
+        , m_availabilityCalculator(m_graph)
+        , m_state(state.graph)
+        , m_interpreter(state.graph, m_state)
+    {
+    }
+    
+    void lower()
+    {
+        State* state = &m_ftlState;
+        
+        CString name;
+        if (verboseCompilationEnabled()) {
+            name = toCString(
+                "jsBody_", ++compileCounter, "_", codeBlock()->inferredName(),
+                "_", codeBlock()->hash());
+        } else
+            name = "jsBody";
+        
+        m_graph.ensureDominators();
+
+        if (verboseCompilationEnabled())
+            dataLog("Function ready, beginning lowering.\n");
+
+        m_out.initialize(m_heaps);
+
+        // We use prologue frequency for all of the initialization code.
+        m_out.setFrequency(1);
+        
+        m_prologue = m_out.newBlock();
+        m_handleExceptions = m_out.newBlock();
+
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+            m_highBlock = m_graph.block(blockIndex);
+            if (!m_highBlock)
+                continue;
+            m_out.setFrequency(m_highBlock->executionCount);
+            m_blocks.add(m_highBlock, m_out.newBlock());
+        }
+
+        // Back to prologue frequency for any bocks that get sneakily created in the initialization code.
+        m_out.setFrequency(1);
+        
+        m_out.appendTo(m_prologue, m_handleExceptions);
+        m_out.initializeConstants(m_proc, m_prologue);
+        createPhiVariables();
+
+        size_t sizeOfCaptured = sizeof(JSValue) * m_graph.m_nextMachineLocal;
+        B3::SlotBaseValue* capturedBase = m_out.lockedStackSlot(sizeOfCaptured);
+        m_captured = m_out.add(capturedBase, m_out.constIntPtr(sizeOfCaptured));
+        state->capturedValue = capturedBase->slot();
+
+        auto preOrder = m_graph.blocksInPreOrder();
+
+        m_callFrame = m_out.framePointer();
+        m_tagTypeNumber = m_out.constInt64(TagTypeNumber);
+        m_tagMask = m_out.constInt64(TagMask);
+
+        // Make sure that B3 knows that we really care about the mask registers. This forces the
+        // constants to be materialized in registers.
+        m_proc.addFastConstant(m_tagTypeNumber->key());
+        m_proc.addFastConstant(m_tagMask->key());
+        
+        // We don't want the CodeBlock to have a weak pointer to itself because
+        // that would cause it to always get collected.
+        m_out.storePtr(m_out.constIntPtr(bitwise_cast<intptr_t>(codeBlock())), addressFor(CallFrameSlot::codeBlock));
+
+        // Stack Overflow Check.
+        unsigned exitFrameSize = m_graph.requiredRegisterCountForExit() * sizeof(Register);
+        MacroAssembler::AbsoluteAddress addressOfStackLimit(vm().addressOfSoftStackLimit());
+        PatchpointValue* stackOverflowHandler = m_out.patchpoint(Void);
+        CallSiteIndex callSiteIndex = callSiteIndexForCodeOrigin(m_ftlState, CodeOrigin(0));
+        stackOverflowHandler->appendSomeRegister(m_callFrame);
+        stackOverflowHandler->clobber(RegisterSet::macroScratchRegisters());
+        stackOverflowHandler->numGPScratchRegisters = 1;
+        stackOverflowHandler->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                GPRReg fp = params[0].gpr();
+                GPRReg scratch = params.gpScratch(0);
+
+                unsigned ftlFrameSize = params.proc().frameSize();
+
+                jit.addPtr(MacroAssembler::TrustedImm32(-std::max(exitFrameSize, ftlFrameSize)), fp, scratch);
+                MacroAssembler::Jump stackOverflow = jit.branchPtr(MacroAssembler::Above, addressOfStackLimit, scratch);
+
+                params.addLatePath([=] (CCallHelpers& jit) {
+                    AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                    stackOverflow.link(&jit);
+                    jit.store32(
+                        MacroAssembler::TrustedImm32(callSiteIndex.bits()),
+                        CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCount)));
+                    jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+
+                    jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+                    jit.move(CCallHelpers::TrustedImmPtr(jit.codeBlock()), GPRInfo::argumentGPR1);
+                    CCallHelpers::Call throwCall = jit.call();
+
+                    jit.move(CCallHelpers::TrustedImmPtr(jit.vm()), GPRInfo::argumentGPR0);
+                    jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+                    CCallHelpers::Call lookupExceptionHandlerCall = jit.call();
+                    jit.jumpToExceptionHandler();
+
+                    jit.addLinkTask(
+                        [=] (LinkBuffer& linkBuffer) {
+                            linkBuffer.link(throwCall, FunctionPtr(operationThrowStackOverflowError));
+                            linkBuffer.link(lookupExceptionHandlerCall, FunctionPtr(lookupExceptionHandlerFromCallerFrame));
+                    });
+                });
+            });
+
+        LBasicBlock firstDFGBasicBlock = lowBlock(m_graph.block(0));
+        // Check Arguments.
+        availabilityMap().clear();
+        availabilityMap().m_locals = Operands<Availability>(codeBlock()->numParameters(), 0);
+        for (unsigned i = codeBlock()->numParameters(); i--;) {
+            availabilityMap().m_locals.argument(i) =
+                Availability(FlushedAt(FlushedJSValue, virtualRegisterForArgument(i)));
+        }
+        m_node = nullptr;
+        m_origin = NodeOrigin(CodeOrigin(0), CodeOrigin(0), true);
+        for (unsigned i = codeBlock()->numParameters(); i--;) {
+            Node* node = m_graph.m_arguments[i];
+            VirtualRegister operand = virtualRegisterForArgument(i);
+            
+            LValue jsValue = m_out.load64(addressFor(operand));
+            
+            if (node) {
+                DFG_ASSERT(m_graph, node, operand == node->stackAccessData()->machineLocal);
+                
+                // This is a hack, but it's an effective one. It allows us to do CSE on the
+                // primordial load of arguments. This assumes that the GetLocal that got put in
+                // place of the original SetArgument doesn't have any effects before it. This
+                // should hold true.
+                m_loadedArgumentValues.add(node, jsValue);
+            }
+            
+            switch (m_graph.m_argumentFormats[i]) {
+            case FlushedInt32:
+                speculate(BadType, jsValueValue(jsValue), node, isNotInt32(jsValue));
+                break;
+            case FlushedBoolean:
+                speculate(BadType, jsValueValue(jsValue), node, isNotBoolean(jsValue));
+                break;
+            case FlushedCell:
+                speculate(BadType, jsValueValue(jsValue), node, isNotCell(jsValue));
+                break;
+            case FlushedJSValue:
+                break;
+            default:
+                DFG_CRASH(m_graph, node, "Bad flush format for argument");
+                break;
+            }
+        }
+        m_out.jump(firstDFGBasicBlock);
+
+        m_out.appendTo(m_handleExceptions, firstDFGBasicBlock);
+        Box<CCallHelpers::Label> exceptionHandler = state->exceptionHandler;
+        m_out.patchpoint(Void)->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+                CCallHelpers::Jump jump = jit.jump();
+                jit.addLinkTask(
+                    [=] (LinkBuffer& linkBuffer) {
+                        linkBuffer.link(jump, linkBuffer.locationOf(*exceptionHandler));
+                    });
+            });
+        m_out.unreachable();
+
+        for (DFG::BasicBlock* block : preOrder)
+            compileBlock(block);
+
+        // Make sure everything is decorated. This does a bunch of deferred decorating. This has
+        // to happen last because our abstract heaps are generated lazily. They have to be
+        // generated lazily because we have an infiniten number of numbered, indexed, and
+        // absolute heaps. We only become aware of the ones we actually mention while lowering.
+        m_heaps.computeRangesAndDecorateInstructions();
+
+        // We create all Phi's up front, but we may then decide not to compile the basic block
+        // that would have contained one of them. So this creates orphans, which triggers B3
+        // validation failures. Calling this fixes the issue.
+        //
+        // Note that you should avoid the temptation to make this call conditional upon
+        // validation being enabled. B3 makes no guarantees of any kind of correctness when
+        // dealing with IR that would have failed validation. For example, it would be valid to
+        // write a B3 phase that so aggressively assumes the lack of orphans that it would crash
+        // if any orphans were around. We might even have such phases already.
+        m_proc.deleteOrphans();
+
+        // We put the blocks into the B3 procedure in a super weird order. Now we reorder them.
+        m_out.applyBlockOrder();
+    }
+
+private:
+    
+    void createPhiVariables()
+    {
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            DFG::BasicBlock* block = m_graph.block(blockIndex);
+            if (!block)
+                continue;
+            for (unsigned nodeIndex = block->size(); nodeIndex--;) {
+                Node* node = block->at(nodeIndex);
+                if (node->op() != DFG::Phi)
+                    continue;
+                LType type;
+                switch (node->flags() & NodeResultMask) {
+                case NodeResultDouble:
+                    type = Double;
+                    break;
+                case NodeResultInt32:
+                    type = Int32;
+                    break;
+                case NodeResultInt52:
+                    type = Int64;
+                    break;
+                case NodeResultBoolean:
+                    type = Int32;
+                    break;
+                case NodeResultJS:
+                    type = Int64;
+                    break;
+                default:
+                    DFG_CRASH(m_graph, node, "Bad Phi node result type");
+                    break;
+                }
+                m_phis.add(node, m_proc.add<Value>(B3::Phi, type, Origin(node)));
+            }
+        }
+    }
+    
+    void compileBlock(DFG::BasicBlock* block)
+    {
+        if (!block)
+            return;
+        
+        if (verboseCompilationEnabled())
+            dataLog("Compiling block ", *block, "\n");
+        
+        m_highBlock = block;
+        
+        // Make sure that any blocks created while lowering code in the high block have the frequency of
+        // the high block. This is appropriate because B3 doesn't need precise frequencies. It just needs
+        // something roughly approximate for things like register allocation.
+        m_out.setFrequency(m_highBlock->executionCount);
+        
+        LBasicBlock lowBlock = m_blocks.get(m_highBlock);
+        
+        m_nextHighBlock = 0;
+        for (BlockIndex nextBlockIndex = m_highBlock->index + 1; nextBlockIndex < m_graph.numBlocks(); ++nextBlockIndex) {
+            m_nextHighBlock = m_graph.block(nextBlockIndex);
+            if (m_nextHighBlock)
+                break;
+        }
+        m_nextLowBlock = m_nextHighBlock ? m_blocks.get(m_nextHighBlock) : 0;
+        
+        // All of this effort to find the next block gives us the ability to keep the
+        // generated IR in roughly program order. This ought not affect the performance
+        // of the generated code (since we expect B3 to reorder things) but it will
+        // make IR dumps easier to read.
+        m_out.appendTo(lowBlock, m_nextLowBlock);
+        
+        if (Options::ftlCrashes())
+            m_out.trap();
+        
+        if (!m_highBlock->cfaHasVisited) {
+            if (verboseCompilationEnabled())
+                dataLog("Bailing because CFA didn't reach.\n");
+            crash(m_highBlock, nullptr);
+            return;
+        }
+        
+        m_availabilityCalculator.beginBlock(m_highBlock);
+        
+        m_state.reset();
+        m_state.beginBasicBlock(m_highBlock);
+        
+        for (m_nodeIndex = 0; m_nodeIndex < m_highBlock->size(); ++m_nodeIndex) {
+            if (!compileNode(m_nodeIndex))
+                break;
+        }
+    }
+
+    void safelyInvalidateAfterTermination()
+    {
+        if (verboseCompilationEnabled())
+            dataLog("Bailing.\n");
+        crash();
+
+        // Invalidate dominated blocks. Under normal circumstances we would expect
+        // them to be invalidated already. But you can have the CFA become more
+        // precise over time because the structures of objects change on the main
+        // thread. Failing to do this would result in weird crashes due to a value
+        // being used but not defined. Race conditions FTW!
+        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+            DFG::BasicBlock* target = m_graph.block(blockIndex);
+            if (!target)
+                continue;
+            if (m_graph.m_dominators->dominates(m_highBlock, target)) {
+                if (verboseCompilationEnabled())
+                    dataLog("Block ", *target, " will bail also.\n");
+                target->cfaHasVisited = false;
+            }
+        }
+    }
+
+    bool compileNode(unsigned nodeIndex)
+    {
+        if (!m_state.isValid()) {
+            safelyInvalidateAfterTermination();
+            return false;
+        }
+        
+        m_node = m_highBlock->at(nodeIndex);
+        m_origin = m_node->origin;
+        m_out.setOrigin(m_node);
+        
+        if (verboseCompilationEnabled())
+            dataLog("Lowering ", m_node, "\n");
+        
+        m_availableRecoveries.resize(0);
+        
+        m_interpreter.startExecuting();
+        m_interpreter.executeKnownEdgeTypes(m_node);
+        
+        switch (m_node->op()) {
+        case DFG::Upsilon:
+            compileUpsilon();
+            break;
+        case DFG::Phi:
+            compilePhi();
+            break;
+        case JSConstant:
+            break;
+        case DoubleConstant:
+            compileDoubleConstant();
+            break;
+        case Int52Constant:
+            compileInt52Constant();
+            break;
+        case LazyJSConstant:
+            compileLazyJSConstant();
+            break;
+        case DoubleRep:
+            compileDoubleRep();
+            break;
+        case DoubleAsInt32:
+            compileDoubleAsInt32();
+            break;
+        case DFG::ValueRep:
+            compileValueRep();
+            break;
+        case Int52Rep:
+            compileInt52Rep();
+            break;
+        case ValueToInt32:
+            compileValueToInt32();
+            break;
+        case BooleanToNumber:
+            compileBooleanToNumber();
+            break;
+        case ExtractOSREntryLocal:
+            compileExtractOSREntryLocal();
+            break;
+        case GetStack:
+            compileGetStack();
+            break;
+        case PutStack:
+            compilePutStack();
+            break;
+        case DFG::Check:
+            compileNoOp();
+            break;
+        case CallObjectConstructor:
+            compileCallObjectConstructor();
+            break;
+        case ToThis:
+            compileToThis();
+            break;
+        case ValueAdd:
+            compileValueAdd();
+            break;
+        case StrCat:
+            compileStrCat();
+            break;
+        case ArithAdd:
+        case ArithSub:
+            compileArithAddOrSub();
+            break;
+        case ArithClz32:
+            compileArithClz32();
+            break;
+        case ArithMul:
+            compileArithMul();
+            break;
+        case ArithDiv:
+            compileArithDiv();
+            break;
+        case ArithMod:
+            compileArithMod();
+            break;
+        case ArithMin:
+        case ArithMax:
+            compileArithMinOrMax();
+            break;
+        case ArithAbs:
+            compileArithAbs();
+            break;
+        case ArithSin:
+            compileArithSin();
+            break;
+        case ArithCos:
+            compileArithCos();
+            break;
+        case ArithTan:
+            compileArithTan();
+            break;
+        case ArithPow:
+            compileArithPow();
+            break;
+        case ArithRandom:
+            compileArithRandom();
+            break;
+        case ArithRound:
+            compileArithRound();
+            break;
+        case ArithFloor:
+            compileArithFloor();
+            break;
+        case ArithCeil:
+            compileArithCeil();
+            break;
+        case ArithTrunc:
+            compileArithTrunc();
+            break;
+        case ArithSqrt:
+            compileArithSqrt();
+            break;
+        case ArithLog:
+            compileArithLog();
+            break;
+        case ArithFRound:
+            compileArithFRound();
+            break;
+        case ArithNegate:
+            compileArithNegate();
+            break;
+        case DFG::BitAnd:
+            compileBitAnd();
+            break;
+        case DFG::BitOr:
+            compileBitOr();
+            break;
+        case DFG::BitXor:
+            compileBitXor();
+            break;
+        case BitRShift:
+            compileBitRShift();
+            break;
+        case BitLShift:
+            compileBitLShift();
+            break;
+        case BitURShift:
+            compileBitURShift();
+            break;
+        case UInt32ToNumber:
+            compileUInt32ToNumber();
+            break;
+        case CheckStructure:
+            compileCheckStructure();
+            break;
+        case CheckCell:
+            compileCheckCell();
+            break;
+        case CheckNotEmpty:
+            compileCheckNotEmpty();
+            break;
+        case CheckBadCell:
+            compileCheckBadCell();
+            break;
+        case CheckStringIdent:
+            compileCheckStringIdent();
+            break;
+        case GetExecutable:
+            compileGetExecutable();
+            break;
+        case ArrayifyToStructure:
+            compileArrayifyToStructure();
+            break;
+        case PutStructure:
+            compilePutStructure();
+            break;
+        case TryGetById:
+            compileGetById(AccessType::GetPure);
+            break;
+        case GetById:
+        case GetByIdFlush:
+            compileGetById(AccessType::Get);
+            break;
+        case GetByIdWithThis:
+            compileGetByIdWithThis();
+            break;
+        case In:
+            compileIn();
+            break;
+        case HasOwnProperty:
+            compileHasOwnProperty();
+            break;
+        case PutById:
+        case PutByIdDirect:
+        case PutByIdFlush:
+            compilePutById();
+            break;
+        case PutByIdWithThis:
+            compilePutByIdWithThis();
+            break;
+        case PutGetterById:
+        case PutSetterById:
+            compilePutAccessorById();
+            break;
+        case PutGetterSetterById:
+            compilePutGetterSetterById();
+            break;
+        case PutGetterByVal:
+        case PutSetterByVal:
+            compilePutAccessorByVal();
+            break;
+        case GetButterfly:
+            compileGetButterfly();
+            break;
+        case ConstantStoragePointer:
+            compileConstantStoragePointer();
+            break;
+        case GetIndexedPropertyStorage:
+            compileGetIndexedPropertyStorage();
+            break;
+        case CheckArray:
+            compileCheckArray();
+            break;
+        case GetArrayLength:
+            compileGetArrayLength();
+            break;
+        case CheckInBounds:
+            compileCheckInBounds();
+            break;
+        case GetByVal:
+            compileGetByVal();
+            break;
+        case GetMyArgumentByVal:
+        case GetMyArgumentByValOutOfBounds:
+            compileGetMyArgumentByVal();
+            break;
+        case GetByValWithThis:
+            compileGetByValWithThis();
+            break;
+        case PutByVal:
+        case PutByValAlias:
+        case PutByValDirect:
+            compilePutByVal();
+            break;
+        case PutByValWithThis:
+            compilePutByValWithThis();
+            break;
+        case DefineDataProperty:
+            compileDefineDataProperty();
+            break;
+        case DefineAccessorProperty:
+            compileDefineAccessorProperty();
+            break;
+        case ArrayPush:
+            compileArrayPush();
+            break;
+        case ArrayPop:
+            compileArrayPop();
+            break;
+        case ArraySlice:
+            compileArraySlice();
+            break;
+        case CreateActivation:
+            compileCreateActivation();
+            break;
+        case NewFunction:
+        case NewGeneratorFunction:
+        case NewAsyncFunction:
+            compileNewFunction();
+            break;
+        case CreateDirectArguments:
+            compileCreateDirectArguments();
+            break;
+        case CreateScopedArguments:
+            compileCreateScopedArguments();
+            break;
+        case CreateClonedArguments:
+            compileCreateClonedArguments();
+            break;
+        case NewObject:
+            compileNewObject();
+            break;
+        case NewArray:
+            compileNewArray();
+            break;
+        case NewArrayWithSpread:
+            compileNewArrayWithSpread();
+            break;
+        case Spread:
+            compileSpread();
+            break;
+        case NewArrayBuffer:
+            compileNewArrayBuffer();
+            break;
+        case NewArrayWithSize:
+            compileNewArrayWithSize();
+            break;
+        case NewTypedArray:
+            compileNewTypedArray();
+            break;
+        case GetTypedArrayByteOffset:
+            compileGetTypedArrayByteOffset();
+            break;
+        case AllocatePropertyStorage:
+            compileAllocatePropertyStorage();
+            break;
+        case ReallocatePropertyStorage:
+            compileReallocatePropertyStorage();
+            break;
+        case NukeStructureAndSetButterfly:
+            compileNukeStructureAndSetButterfly();
+            break;
+        case ToNumber:
+            compileToNumber();
+            break;
+        case ToString:
+        case CallStringConstructor:
+            compileToStringOrCallStringConstructor();
+            break;
+        case ToPrimitive:
+            compileToPrimitive();
+            break;
+        case MakeRope:
+            compileMakeRope();
+            break;
+        case StringCharAt:
+            compileStringCharAt();
+            break;
+        case StringCharCodeAt:
+            compileStringCharCodeAt();
+            break;
+        case StringFromCharCode:
+            compileStringFromCharCode();
+            break;
+        case GetByOffset:
+        case GetGetterSetterByOffset:
+            compileGetByOffset();
+            break;
+        case GetGetter:
+            compileGetGetter();
+            break;
+        case GetSetter:
+            compileGetSetter();
+            break;
+        case MultiGetByOffset:
+            compileMultiGetByOffset();
+            break;
+        case PutByOffset:
+            compilePutByOffset();
+            break;
+        case MultiPutByOffset:
+            compileMultiPutByOffset();
+            break;
+        case GetGlobalVar:
+        case GetGlobalLexicalVariable:
+            compileGetGlobalVariable();
+            break;
+        case PutGlobalVariable:
+            compilePutGlobalVariable();
+            break;
+        case NotifyWrite:
+            compileNotifyWrite();
+            break;
+        case GetCallee:
+            compileGetCallee();
+            break;
+        case GetArgumentCountIncludingThis:
+            compileGetArgumentCountIncludingThis();
+            break;
+        case GetScope:
+            compileGetScope();
+            break;
+        case SkipScope:
+            compileSkipScope();
+            break;
+        case GetGlobalObject:
+            compileGetGlobalObject();
+            break;
+        case GetClosureVar:
+            compileGetClosureVar();
+            break;
+        case PutClosureVar:
+            compilePutClosureVar();
+            break;
+        case GetFromArguments:
+            compileGetFromArguments();
+            break;
+        case PutToArguments:
+            compilePutToArguments();
+            break;
+        case GetArgument:
+            compileGetArgument();
+            break;
+        case CompareEq:
+            compileCompareEq();
+            break;
+        case CompareStrictEq:
+            compileCompareStrictEq();
+            break;
+        case CompareLess:
+            compileCompareLess();
+            break;
+        case CompareLessEq:
+            compileCompareLessEq();
+            break;
+        case CompareGreater:
+            compileCompareGreater();
+            break;
+        case CompareGreaterEq:
+            compileCompareGreaterEq();
+            break;
+        case CompareEqPtr:
+            compileCompareEqPtr();
+            break;
+        case LogicalNot:
+            compileLogicalNot();
+            break;
+        case Call:
+        case TailCallInlinedCaller:
+        case Construct:
+            compileCallOrConstruct();
+            break;
+        case DirectCall:
+        case DirectTailCallInlinedCaller:
+        case DirectConstruct:
+        case DirectTailCall:
+            compileDirectCallOrConstruct();
+            break;
+        case TailCall:
+            compileTailCall();
+            break;
+        case CallVarargs:
+        case CallForwardVarargs:
+        case TailCallVarargs:
+        case TailCallVarargsInlinedCaller:
+        case TailCallForwardVarargs:
+        case TailCallForwardVarargsInlinedCaller:
+        case ConstructVarargs:
+        case ConstructForwardVarargs:
+            compileCallOrConstructVarargs();
+            break;
+        case CallEval:
+            compileCallEval();
+            break;
+        case LoadVarargs:
+            compileLoadVarargs();
+            break;
+        case ForwardVarargs:
+            compileForwardVarargs();
+            break;
+        case DFG::Jump:
+            compileJump();
+            break;
+        case DFG::Branch:
+            compileBranch();
+            break;
+        case DFG::Switch:
+            compileSwitch();
+            break;
+        case DFG::Return:
+            compileReturn();
+            break;
+        case ForceOSRExit:
+            compileForceOSRExit();
+            break;
+        case Throw:
+        case ThrowStaticError:
+            compileThrow();
+            break;
+        case InvalidationPoint:
+            compileInvalidationPoint();
+            break;
+        case IsEmpty:
+            compileIsEmpty();
+            break;
+        case IsUndefined:
+            compileIsUndefined();
+            break;
+        case IsBoolean:
+            compileIsBoolean();
+            break;
+        case IsNumber:
+            compileIsNumber();
+            break;
+        case IsCellWithType:
+            compileIsCellWithType();
+            break;
+        case MapHash:
+            compileMapHash();
+            break;
+        case GetMapBucket:
+            compileGetMapBucket();
+            break;
+        case LoadFromJSMapBucket:
+            compileLoadFromJSMapBucket();
+            break;
+        case IsNonEmptyMapBucket:
+            compileIsNonEmptyMapBucket();
+            break;
+        case IsObject:
+            compileIsObject();
+            break;
+        case IsObjectOrNull:
+            compileIsObjectOrNull();
+            break;
+        case IsFunction:
+            compileIsFunction();
+            break;
+        case IsTypedArrayView:
+            compileIsTypedArrayView();
+            break;
+        case TypeOf:
+            compileTypeOf();
+            break;
+        case CheckTypeInfoFlags:
+            compileCheckTypeInfoFlags();
+            break;
+        case OverridesHasInstance:
+            compileOverridesHasInstance();
+            break;
+        case InstanceOf:
+            compileInstanceOf();
+            break;
+        case InstanceOfCustom:
+            compileInstanceOfCustom();
+            break;
+        case CountExecution:
+            compileCountExecution();
+            break;
+        case StoreBarrier:
+        case FencedStoreBarrier:
+            compileStoreBarrier();
+            break;
+        case HasIndexedProperty:
+            compileHasIndexedProperty();
+            break;
+        case HasGenericProperty:
+            compileHasGenericProperty();
+            break;
+        case HasStructureProperty:
+            compileHasStructureProperty();
+            break;
+        case GetDirectPname:
+            compileGetDirectPname();
+            break;
+        case GetEnumerableLength:
+            compileGetEnumerableLength();
+            break;
+        case GetPropertyEnumerator:
+            compileGetPropertyEnumerator();
+            break;
+        case GetEnumeratorStructurePname:
+            compileGetEnumeratorStructurePname();
+            break;
+        case GetEnumeratorGenericPname:
+            compileGetEnumeratorGenericPname();
+            break;
+        case ToIndexString:
+            compileToIndexString();
+            break;
+        case CheckStructureImmediate:
+            compileCheckStructureImmediate();
+            break;
+        case MaterializeNewObject:
+            compileMaterializeNewObject();
+            break;
+        case MaterializeCreateActivation:
+            compileMaterializeCreateActivation();
+            break;
+        case CheckWatchdogTimer:
+            compileCheckWatchdogTimer();
+            break;
+        case CreateRest:
+            compileCreateRest();
+            break;
+        case GetRestLength:
+            compileGetRestLength();
+            break;
+        case RegExpExec:
+            compileRegExpExec();
+            break;
+        case RegExpTest:
+            compileRegExpTest();
+            break;
+        case NewRegexp:
+            compileNewRegexp();
+            break;
+        case SetFunctionName:
+            compileSetFunctionName();
+            break;
+        case StringReplace:
+        case StringReplaceRegExp:
+            compileStringReplace();
+            break;
+        case GetRegExpObjectLastIndex:
+            compileGetRegExpObjectLastIndex();
+            break;
+        case SetRegExpObjectLastIndex:
+            compileSetRegExpObjectLastIndex();
+            break;
+        case LogShadowChickenPrologue:
+            compileLogShadowChickenPrologue();
+            break;
+        case LogShadowChickenTail:
+            compileLogShadowChickenTail();
+            break;
+        case RecordRegExpCachedResult:
+            compileRecordRegExpCachedResult();
+            break;
+        case ResolveScope:
+            compileResolveScope();
+            break;
+        case GetDynamicVar:
+            compileGetDynamicVar();
+            break;
+        case PutDynamicVar:
+            compilePutDynamicVar();
+            break;
+        case Unreachable:
+            compileUnreachable();
+            break;
+        case ToLowerCase:
+            compileToLowerCase();
+            break;
+        case CheckDOM:
+            compileCheckDOM();
+            break;
+        case CallDOM:
+            compileCallDOM();
+            break;
+        case CallDOMGetter:
+            compileCallDOMGetter();
+            break;
+
+        case PhantomLocal:
+        case LoopHint:
+        case MovHint:
+        case ZombieHint:
+        case ExitOK:
+        case PhantomNewObject:
+        case PhantomNewFunction:
+        case PhantomNewGeneratorFunction:
+        case PhantomNewAsyncFunction:
+        case PhantomCreateActivation:
+        case PhantomDirectArguments:
+        case PhantomCreateRest:
+        case PhantomSpread:
+        case PhantomNewArrayWithSpread:
+        case PhantomClonedArguments:
+        case PutHint:
+        case BottomValue:
+        case KillStack:
+            break;
+        default:
+            DFG_CRASH(m_graph, m_node, "Unrecognized node in FTL backend");
+            break;
+        }
+        
+        if (m_node->isTerminal())
+            return false;
+        
+        if (!m_state.isValid()) {
+            safelyInvalidateAfterTermination();
+            return false;
+        }
+
+        m_availabilityCalculator.executeNode(m_node);
+        m_interpreter.executeEffects(nodeIndex);
+        
+        return true;
+    }
+
+    void compileUpsilon()
+    {
+        LValue upsilonValue = nullptr;
+        switch (m_node->child1().useKind()) {
+        case DoubleRepUse:
+            upsilonValue = lowDouble(m_node->child1());
+            break;
+        case Int32Use:
+        case KnownInt32Use:
+            upsilonValue = lowInt32(m_node->child1());
+            break;
+        case Int52RepUse:
+            upsilonValue = lowInt52(m_node->child1());
+            break;
+        case BooleanUse:
+        case KnownBooleanUse:
+            upsilonValue = lowBoolean(m_node->child1());
+            break;
+        case CellUse:
+        case KnownCellUse:
+            upsilonValue = lowCell(m_node->child1());
+            break;
+        case UntypedUse:
+            upsilonValue = lowJSValue(m_node->child1());
+            break;
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+        ValueFromBlock upsilon = m_out.anchor(upsilonValue);
+        LValue phiNode = m_phis.get(m_node->phi());
+        m_out.addIncomingToPhi(phiNode, upsilon);
+    }
+    
+    void compilePhi()
+    {
+        LValue phi = m_phis.get(m_node);
+        m_out.m_block->append(phi);
+
+        switch (m_node->flags() & NodeResultMask) {
+        case NodeResultDouble:
+            setDouble(phi);
+            break;
+        case NodeResultInt32:
+            setInt32(phi);
+            break;
+        case NodeResultInt52:
+            setInt52(phi);
+            break;
+        case NodeResultBoolean:
+            setBoolean(phi);
+            break;
+        case NodeResultJS:
+            setJSValue(phi);
+            break;
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+    }
+    
+    void compileDoubleConstant()
+    {
+        setDouble(m_out.constDouble(m_node->asNumber()));
+    }
+    
+    void compileInt52Constant()
+    {
+        int64_t value = m_node->asAnyInt();
+        
+        setInt52(m_out.constInt64(value << JSValue::int52ShiftAmount));
+        setStrictInt52(m_out.constInt64(value));
+    }
+
+    void compileLazyJSConstant()
+    {
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        LazyJSValue value = m_node->lazyJSValue();
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                value.emit(jit, JSValueRegs(params[0].gpr()));
+            });
+        patchpoint->effects = Effects::none();
+        setJSValue(patchpoint);
+    }
+
+    void compileDoubleRep()
+    {
+        switch (m_node->child1().useKind()) {
+        case RealNumberUse: {
+            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);
+            
+            LValue doubleValue = unboxDouble(value);
+            
+            LBasicBlock intCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            ValueFromBlock fastResult = m_out.anchor(doubleValue);
+            m_out.branch(
+                m_out.doubleEqual(doubleValue, doubleValue),
+                usually(continuation), rarely(intCase));
+            
+            LBasicBlock lastNext = m_out.appendTo(intCase, continuation);
+
+            FTL_TYPE_CHECK(
+                jsValueValue(value), m_node->child1(), SpecBytecodeRealNumber,
+                isNotInt32(value, provenType(m_node->child1()) & ~SpecDoubleReal));
+            ValueFromBlock slowResult = m_out.anchor(m_out.intToDouble(unboxInt32(value)));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            
+            setDouble(m_out.phi(Double, fastResult, slowResult));
+            return;
+        }
+            
+        case NotCellUse:
+        case NumberUse: {
+            bool shouldConvertNonNumber = m_node->child1().useKind() == NotCellUse;
+            
+            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);
+
+            LBasicBlock intCase = m_out.newBlock();
+            LBasicBlock doubleTesting = m_out.newBlock();
+            LBasicBlock doubleCase = m_out.newBlock();
+            LBasicBlock nonDoubleCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            m_out.branch(
+                isNotInt32(value, provenType(m_node->child1())),
+                unsure(doubleTesting), unsure(intCase));
+            
+            LBasicBlock lastNext = m_out.appendTo(intCase, doubleTesting);
+            
+            ValueFromBlock intToDouble = m_out.anchor(
+                m_out.intToDouble(unboxInt32(value)));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(doubleTesting, doubleCase);
+            LValue valueIsNumber = isNumber(value, provenType(m_node->child1()));
+            m_out.branch(valueIsNumber, usually(doubleCase), rarely(nonDoubleCase));
+
+            m_out.appendTo(doubleCase, nonDoubleCase);
+            ValueFromBlock unboxedDouble = m_out.anchor(unboxDouble(value));
+            m_out.jump(continuation);
+
+            if (shouldConvertNonNumber) {
+                LBasicBlock undefinedCase = m_out.newBlock();
+                LBasicBlock testNullCase = m_out.newBlock();
+                LBasicBlock nullCase = m_out.newBlock();
+                LBasicBlock testBooleanTrueCase = m_out.newBlock();
+                LBasicBlock convertBooleanTrueCase = m_out.newBlock();
+                LBasicBlock convertBooleanFalseCase = m_out.newBlock();
+
+                m_out.appendTo(nonDoubleCase, undefinedCase);
+                LValue valueIsUndefined = m_out.equal(value, m_out.constInt64(ValueUndefined));
+                m_out.branch(valueIsUndefined, unsure(undefinedCase), unsure(testNullCase));
+
+                m_out.appendTo(undefinedCase, testNullCase);
+                ValueFromBlock convertedUndefined = m_out.anchor(m_out.constDouble(PNaN));
+                m_out.jump(continuation);
+
+                m_out.appendTo(testNullCase, nullCase);
+                LValue valueIsNull = m_out.equal(value, m_out.constInt64(ValueNull));
+                m_out.branch(valueIsNull, unsure(nullCase), unsure(testBooleanTrueCase));
+
+                m_out.appendTo(nullCase, testBooleanTrueCase);
+                ValueFromBlock convertedNull = m_out.anchor(m_out.constDouble(0));
+                m_out.jump(continuation);
+
+                m_out.appendTo(testBooleanTrueCase, convertBooleanTrueCase);
+                LValue valueIsBooleanTrue = m_out.equal(value, m_out.constInt64(ValueTrue));
+                m_out.branch(valueIsBooleanTrue, unsure(convertBooleanTrueCase), unsure(convertBooleanFalseCase));
+
+                m_out.appendTo(convertBooleanTrueCase, convertBooleanFalseCase);
+                ValueFromBlock convertedTrue = m_out.anchor(m_out.constDouble(1));
+                m_out.jump(continuation);
+
+                m_out.appendTo(convertBooleanFalseCase, continuation);
+
+                LValue valueIsNotBooleanFalse = m_out.notEqual(value, m_out.constInt64(ValueFalse));
+                FTL_TYPE_CHECK(jsValueValue(value), m_node->child1(), ~SpecCell, valueIsNotBooleanFalse);
+                ValueFromBlock convertedFalse = m_out.anchor(m_out.constDouble(0));
+                m_out.jump(continuation);
+
+                m_out.appendTo(continuation, lastNext);
+                setDouble(m_out.phi(Double, intToDouble, unboxedDouble, convertedUndefined, convertedNull, convertedTrue, convertedFalse));
+                return;
+            }
+            m_out.appendTo(nonDoubleCase, continuation);
+            FTL_TYPE_CHECK(jsValueValue(value), m_node->child1(), SpecBytecodeNumber, m_out.booleanTrue);
+            m_out.unreachable();
+
+            m_out.appendTo(continuation, lastNext);
+
+            setDouble(m_out.phi(Double, intToDouble, unboxedDouble));
+            return;
+        }
+            
+        case Int52RepUse: {
+            setDouble(strictInt52ToDouble(lowStrictInt52(m_node->child1())));
+            return;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+        }
+    }
+
+    void compileDoubleAsInt32()
+    {
+        LValue integerValue = convertDoubleToInt32(lowDouble(m_node->child1()), shouldCheckNegativeZero(m_node->arithMode()));
+        setInt32(integerValue);
+    }
+
+    void compileValueRep()
+    {
+        switch (m_node->child1().useKind()) {
+        case DoubleRepUse: {
+            LValue value = lowDouble(m_node->child1());
+            
+            if (m_interpreter.needsTypeCheck(m_node->child1(), ~SpecDoubleImpureNaN)) {
+                value = m_out.select(
+                    m_out.doubleEqual(value, value), value, m_out.constDouble(PNaN));
+            }
+            
+            setJSValue(boxDouble(value));
+            return;
+        }
+            
+        case Int52RepUse: {
+            setJSValue(strictInt52ToJSValue(lowStrictInt52(m_node->child1())));
+            return;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+        }
+    }
+    
+    void compileInt52Rep()
+    {
+        switch (m_node->child1().useKind()) {
+        case Int32Use:
+            setStrictInt52(m_out.signExt32To64(lowInt32(m_node->child1())));
+            return;
+            
+        case AnyIntUse:
+            setStrictInt52(
+                jsValueToStrictInt52(
+                    m_node->child1(), lowJSValue(m_node->child1(), ManualOperandSpeculation)));
+            return;
+            
+        case DoubleRepAnyIntUse:
+            setStrictInt52(
+                doubleToStrictInt52(
+                    m_node->child1(), lowDouble(m_node->child1())));
+            return;
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    
+    void compileValueToInt32()
+    {
+        switch (m_node->child1().useKind()) {
+        case Int52RepUse:
+            setInt32(m_out.castToInt32(lowStrictInt52(m_node->child1())));
+            break;
+            
+        case DoubleRepUse:
+            setInt32(doubleToInt32(lowDouble(m_node->child1())));
+            break;
+            
+        case NumberUse:
+        case NotCellUse: {
+            LoweredNodeValue value = m_int32Values.get(m_node->child1().node());
+            if (isValid(value)) {
+                setInt32(value.value());
+                break;
+            }
+            
+            value = m_jsValueValues.get(m_node->child1().node());
+            if (isValid(value)) {
+                setInt32(numberOrNotCellToInt32(m_node->child1(), value.value()));
+                break;
+            }
+            
+            // We'll basically just get here for constants. But it's good to have this
+            // catch-all since we often add new representations into the mix.
+            setInt32(
+                numberOrNotCellToInt32(
+                    m_node->child1(),
+                    lowJSValue(m_node->child1(), ManualOperandSpeculation)));
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+    }
+    
+    void compileBooleanToNumber()
+    {
+        switch (m_node->child1().useKind()) {
+        case BooleanUse: {
+            setInt32(m_out.zeroExt(lowBoolean(m_node->child1()), Int32));
+            return;
+        }
+            
+        case UntypedUse: {
+            LValue value = lowJSValue(m_node->child1());
+            
+            if (!m_interpreter.needsTypeCheck(m_node->child1(), SpecBoolInt32 | SpecBoolean)) {
+                setInt32(m_out.bitAnd(m_out.castToInt32(value), m_out.int32One));
+                return;
+            }
+            
+            LBasicBlock booleanCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            ValueFromBlock notBooleanResult = m_out.anchor(value);
+            m_out.branch(
+                isBoolean(value, provenType(m_node->child1())),
+                unsure(booleanCase), unsure(continuation));
+            
+            LBasicBlock lastNext = m_out.appendTo(booleanCase, continuation);
+            ValueFromBlock booleanResult = m_out.anchor(m_out.bitOr(
+                m_out.zeroExt(unboxBoolean(value), Int64), m_tagTypeNumber));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, booleanResult, notBooleanResult));
+            return;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+
+    void compileExtractOSREntryLocal()
+    {
+        EncodedJSValue* buffer = static_cast<EncodedJSValue*>(
+            m_ftlState.jitCode->ftlForOSREntry()->entryBuffer()->dataBuffer());
+        setJSValue(m_out.load64(m_out.absolute(buffer + m_node->unlinkedLocal().toLocal())));
+    }
+    
+    void compileGetStack()
+    {
+        // GetLocals arise only for captured variables and arguments. For arguments, we might have
+        // already loaded it.
+        if (LValue value = m_loadedArgumentValues.get(m_node)) {
+            setJSValue(value);
+            return;
+        }
+        
+        StackAccessData* data = m_node->stackAccessData();
+        AbstractValue& value = m_state.variables().operand(data->local);
+        
+        DFG_ASSERT(m_graph, m_node, isConcrete(data->format));
+        DFG_ASSERT(m_graph, m_node, data->format != FlushedDouble); // This just happens to not arise for GetStacks, right now. It would be trivial to support.
+        
+        if (isInt32Speculation(value.m_type))
+            setInt32(m_out.load32(payloadFor(data->machineLocal)));
+        else
+            setJSValue(m_out.load64(addressFor(data->machineLocal)));
+    }
+    
+    void compilePutStack()
+    {
+        StackAccessData* data = m_node->stackAccessData();
+        switch (data->format) {
+        case FlushedJSValue: {
+            LValue value = lowJSValue(m_node->child1());
+            m_out.store64(value, addressFor(data->machineLocal));
+            break;
+        }
+            
+        case FlushedDouble: {
+            LValue value = lowDouble(m_node->child1());
+            m_out.storeDouble(value, addressFor(data->machineLocal));
+            break;
+        }
+            
+        case FlushedInt32: {
+            LValue value = lowInt32(m_node->child1());
+            m_out.store32(value, payloadFor(data->machineLocal));
+            break;
+        }
+            
+        case FlushedInt52: {
+            LValue value = lowInt52(m_node->child1());
+            m_out.store64(value, addressFor(data->machineLocal));
+            break;
+        }
+            
+        case FlushedCell: {
+            LValue value = lowCell(m_node->child1());
+            m_out.store64(value, addressFor(data->machineLocal));
+            break;
+        }
+            
+        case FlushedBoolean: {
+            speculateBoolean(m_node->child1());
+            m_out.store64(
+                lowJSValue(m_node->child1(), ManualOperandSpeculation),
+                addressFor(data->machineLocal));
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad flush format");
+            break;
+        }
+    }
+    
+    void compileNoOp()
+    {
+        DFG_NODE_DO_TO_CHILDREN(m_graph, m_node, speculate);
+    }
+
+    void compileCallObjectConstructor()
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        LValue value = lowJSValue(m_node->child1());
+
+        LBasicBlock isCellCase = m_out.newBlock();
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(isCell(value, provenType(m_node->child1())), usually(isCellCase), rarely(slowCase));
+
+        LBasicBlock lastNext = m_out.appendTo(isCellCase, slowCase);
+        ValueFromBlock fastResult = m_out.anchor(value);
+        m_out.branch(isObject(value), usually(continuation), rarely(slowCase));
+
+        m_out.appendTo(slowCase, continuation);
+        ValueFromBlock slowResult = m_out.anchor(vmCall(Int64, m_out.operation(operationObjectConstructor), m_callFrame, weakPointer(globalObject), value));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, fastResult, slowResult));
+    }
+    
+    void compileToThis()
+    {
+        LValue value = lowJSValue(m_node->child1());
+        
+        LBasicBlock isCellCase = m_out.newBlock();
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        m_out.branch(
+            isCell(value, provenType(m_node->child1())), usually(isCellCase), rarely(slowCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(isCellCase, slowCase);
+        ValueFromBlock fastResult = m_out.anchor(value);
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoFlags),
+                m_out.constInt32(OverridesToThis)),
+            usually(continuation), rarely(slowCase));
+        
+        m_out.appendTo(slowCase, continuation);
+        J_JITOperation_EJ function;
+        if (m_graph.isStrictModeFor(m_node->origin.semantic))
+            function = operationToThisStrict;
+        else
+            function = operationToThis;
+        ValueFromBlock slowResult = m_out.anchor(
+            vmCall(Int64, m_out.operation(function), m_callFrame, value));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, fastResult, slowResult));
+    }
+
+    void compileValueAdd()
+    {
+        ArithProfile* arithProfile = m_ftlState.graph.baselineCodeBlockFor(m_node->origin.semantic)->arithProfileForBytecodeOffset(m_node->origin.semantic.bytecodeIndex);
+        JITAddIC* addIC = codeBlock()->addJITAddIC(arithProfile);
+        auto repatchingFunction = operationValueAddOptimize;
+        auto nonRepatchingFunction = operationValueAdd;
+        compileMathIC(addIC, repatchingFunction, nonRepatchingFunction);
+    }
+
+    template <typename Generator>
+    void compileMathIC(JITUnaryMathIC<Generator>* mathIC, FunctionPtr repatchingFunction, FunctionPtr nonRepatchingFunction)
+    {
+        Node* node = m_node;
+
+        LValue operand = lowJSValue(node->child1());
+
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendSomeRegister(operand);
+        patchpoint->append(m_tagMask, ValueRep::lateReg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::lateReg(GPRInfo::tagTypeNumberRegister));
+        RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
+        patchpoint->numGPScratchRegisters = 1;
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+#if ENABLE(MATH_IC_STATS)
+                auto inlineStart = jit.label();
+#endif
+
+                Box<MathICGenerationState> mathICGenerationState = Box<MathICGenerationState>::create();
+                mathIC->m_generator = Generator(JSValueRegs(params[0].gpr()), JSValueRegs(params[1].gpr()), params.gpScratch(0));
+
+                bool shouldEmitProfiling = false;
+                bool generatedInline = mathIC->generateInline(jit, *mathICGenerationState, shouldEmitProfiling);
+
+                if (generatedInline) {
+                    ASSERT(!mathICGenerationState->slowPathJumps.empty());
+                    auto done = jit.label();
+                    params.addLatePath([=] (CCallHelpers& jit) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+                        mathICGenerationState->slowPathJumps.link(&jit);
+                        mathICGenerationState->slowPathStart = jit.label();
+#if ENABLE(MATH_IC_STATS)
+                        auto slowPathStart = jit.label();
+#endif
+
+                        if (mathICGenerationState->shouldSlowPathRepatch) {
+                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, node->origin.semantic, exceptions.get(),
+                                repatchingFunction, params[0].gpr(), params[1].gpr(), CCallHelpers::TrustedImmPtr(mathIC));
+                            mathICGenerationState->slowPathCall = call.call();
+                        } else {
+                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, node->origin.semantic,
+                                exceptions.get(), nonRepatchingFunction, params[0].gpr(), params[1].gpr());
+                            mathICGenerationState->slowPathCall = call.call();
+                        }
+                        jit.jump().linkTo(done, &jit);
+
+                        jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                            mathIC->finalizeInlineCode(*mathICGenerationState, linkBuffer);
+                        });
+
+#if ENABLE(MATH_IC_STATS)
+                        auto slowPathEnd = jit.label();
+                        jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                            size_t size = static_cast<char*>(linkBuffer.locationOf(slowPathEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(slowPathStart).executableAddress());
+                            mathIC->m_generatedCodeSize += size;
+                        });
+#endif
+                    });
+                } else {
+                    callOperation(
+                        *state, params.unavailableRegisters(), jit, node->origin.semantic, exceptions.get(),
+                        nonRepatchingFunction, params[0].gpr(), params[1].gpr());
+                }
+
+#if ENABLE(MATH_IC_STATS)
+                auto inlineEnd = jit.label();
+                jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                    size_t size = static_cast<char*>(linkBuffer.locationOf(inlineEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(inlineStart).executableAddress());
+                    mathIC->m_generatedCodeSize += size;
+                });
+#endif
+            });
+
+        setJSValue(patchpoint);
+    }
+
+    template <typename Generator>
+    void compileMathIC(JITBinaryMathIC<Generator>* mathIC, FunctionPtr repatchingFunction, FunctionPtr nonRepatchingFunction)
+    {
+        Node* node = m_node;
+        
+        LValue left = lowJSValue(node->child1());
+        LValue right = lowJSValue(node->child2());
+
+        SnippetOperand leftOperand(m_state.forNode(node->child1()).resultType());
+        SnippetOperand rightOperand(m_state.forNode(node->child2()).resultType());
+            
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendSomeRegister(left);
+        patchpoint->appendSomeRegister(right);
+        patchpoint->append(m_tagMask, ValueRep::lateReg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::lateReg(GPRInfo::tagTypeNumberRegister));
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(patchpoint);
+        patchpoint->numGPScratchRegisters = 1;
+        patchpoint->numFPScratchRegisters = 2;
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+#if ENABLE(MATH_IC_STATS)
+                auto inlineStart = jit.label();
+#endif
+
+                Box<MathICGenerationState> mathICGenerationState = Box<MathICGenerationState>::create();
+                mathIC->m_generator = Generator(leftOperand, rightOperand, JSValueRegs(params[0].gpr()),
+                    JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()), params.fpScratch(0),
+                    params.fpScratch(1), params.gpScratch(0), InvalidFPRReg);
+
+                bool shouldEmitProfiling = false;
+                bool generatedInline = mathIC->generateInline(jit, *mathICGenerationState, shouldEmitProfiling);
+
+                if (generatedInline) {
+                    ASSERT(!mathICGenerationState->slowPathJumps.empty());
+                    auto done = jit.label();
+                    params.addLatePath([=] (CCallHelpers& jit) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+                        mathICGenerationState->slowPathJumps.link(&jit);
+                        mathICGenerationState->slowPathStart = jit.label();
+#if ENABLE(MATH_IC_STATS)
+                        auto slowPathStart = jit.label();
+#endif
+
+                        if (mathICGenerationState->shouldSlowPathRepatch) {
+                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, node->origin.semantic, exceptions.get(),
+                                repatchingFunction, params[0].gpr(), params[1].gpr(), params[2].gpr(), CCallHelpers::TrustedImmPtr(mathIC));
+                            mathICGenerationState->slowPathCall = call.call();
+                        } else {
+                            SlowPathCall call = callOperation(*state, params.unavailableRegisters(), jit, node->origin.semantic,
+                                exceptions.get(), nonRepatchingFunction, params[0].gpr(), params[1].gpr(), params[2].gpr());
+                            mathICGenerationState->slowPathCall = call.call();
+                        }
+                        jit.jump().linkTo(done, &jit);
+
+                        jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                            mathIC->finalizeInlineCode(*mathICGenerationState, linkBuffer);
+                        });
+
+#if ENABLE(MATH_IC_STATS)
+                        auto slowPathEnd = jit.label();
+                        jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                            size_t size = static_cast<char*>(linkBuffer.locationOf(slowPathEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(slowPathStart).executableAddress());
+                            mathIC->m_generatedCodeSize += size;
+                        });
+#endif
+                    });
+                } else {
+                    callOperation(
+                        *state, params.unavailableRegisters(), jit, node->origin.semantic, exceptions.get(),
+                        nonRepatchingFunction, params[0].gpr(), params[1].gpr(), params[2].gpr());
+                }
+
+#if ENABLE(MATH_IC_STATS)
+                auto inlineEnd = jit.label();
+                jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                    size_t size = static_cast<char*>(linkBuffer.locationOf(inlineEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(inlineStart).executableAddress());
+                    mathIC->m_generatedCodeSize += size;
+                });
+#endif
+            });
+
+        setJSValue(patchpoint);
+    }
+    
+    void compileStrCat()
+    {
+        LValue result;
+        if (m_node->child3()) {
+            result = vmCall(
+                Int64, m_out.operation(operationStrCat3), m_callFrame,
+                lowJSValue(m_node->child1(), ManualOperandSpeculation),
+                lowJSValue(m_node->child2(), ManualOperandSpeculation),
+                lowJSValue(m_node->child3(), ManualOperandSpeculation));
+        } else {
+            result = vmCall(
+                Int64, m_out.operation(operationStrCat2), m_callFrame,
+                lowJSValue(m_node->child1(), ManualOperandSpeculation),
+                lowJSValue(m_node->child2(), ManualOperandSpeculation));
+        }
+        setJSValue(result);
+    }
+    
+    void compileArithAddOrSub()
+    {
+        bool isSub =  m_node->op() == ArithSub;
+        switch (m_node->binaryUseKind()) {
+        case Int32Use: {
+            LValue left = lowInt32(m_node->child1());
+            LValue right = lowInt32(m_node->child2());
+
+            if (!shouldCheckOverflow(m_node->arithMode())) {
+                setInt32(isSub ? m_out.sub(left, right) : m_out.add(left, right));
+                break;
+            }
+
+            CheckValue* result =
+                isSub ? m_out.speculateSub(left, right) : m_out.speculateAdd(left, right);
+            blessSpeculation(result, Overflow, noValue(), nullptr, m_origin);
+            setInt32(result);
+            break;
+        }
+            
+        case Int52RepUse: {
+            if (!abstractValue(m_node->child1()).couldBeType(SpecInt52Only)
+                && !abstractValue(m_node->child2()).couldBeType(SpecInt52Only)) {
+                Int52Kind kind;
+                LValue left = lowWhicheverInt52(m_node->child1(), kind);
+                LValue right = lowInt52(m_node->child2(), kind);
+                setInt52(isSub ? m_out.sub(left, right) : m_out.add(left, right), kind);
+                break;
+            }
+
+            LValue left = lowInt52(m_node->child1());
+            LValue right = lowInt52(m_node->child2());
+            CheckValue* result =
+                isSub ? m_out.speculateSub(left, right) : m_out.speculateAdd(left, right);
+            blessSpeculation(result, Overflow, noValue(), nullptr, m_origin);
+            setInt52(result);
+            break;
+        }
+            
+        case DoubleRepUse: {
+            LValue C1 = lowDouble(m_node->child1());
+            LValue C2 = lowDouble(m_node->child2());
+
+            setDouble(isSub ? m_out.doubleSub(C1, C2) : m_out.doubleAdd(C1, C2));
+            break;
+        }
+
+        case UntypedUse: {
+            if (!isSub) {
+                DFG_CRASH(m_graph, m_node, "Bad use kind");
+                break;
+            }
+
+            ArithProfile* arithProfile = m_ftlState.graph.baselineCodeBlockFor(m_node->origin.semantic)->arithProfileForBytecodeOffset(m_node->origin.semantic.bytecodeIndex);
+            JITSubIC* subIC = codeBlock()->addJITSubIC(arithProfile);
+            auto repatchingFunction = operationValueSubOptimize;
+            auto nonRepatchingFunction = operationValueSub;
+            compileMathIC(subIC, repatchingFunction, nonRepatchingFunction);
+            break;
+        }
+
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+    }
+
+    void compileArithClz32()
+    {
+        if (m_node->child1().useKind() == Int32Use || m_node->child1().useKind() == KnownInt32Use) {
+            LValue operand = lowInt32(m_node->child1());
+            setInt32(m_out.ctlz32(operand));
+            return;
+        }
+        DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse);
+        LValue argument = lowJSValue(m_node->child1());
+        LValue result = vmCall(Int32, m_out.operation(operationArithClz32), m_callFrame, argument);
+        setInt32(result);
+    }
+    
+    void compileArithMul()
+    {
+        switch (m_node->binaryUseKind()) {
+        case Int32Use: {
+            LValue left = lowInt32(m_node->child1());
+            LValue right = lowInt32(m_node->child2());
+            
+            LValue result;
+
+            if (!shouldCheckOverflow(m_node->arithMode()))
+                result = m_out.mul(left, right);
+            else {
+                CheckValue* speculation = m_out.speculateMul(left, right);
+                blessSpeculation(speculation, Overflow, noValue(), nullptr, m_origin);
+                result = speculation;
+            }
+            
+            if (shouldCheckNegativeZero(m_node->arithMode())) {
+                LBasicBlock slowCase = m_out.newBlock();
+                LBasicBlock continuation = m_out.newBlock();
+                
+                m_out.branch(
+                    m_out.notZero32(result), usually(continuation), rarely(slowCase));
+                
+                LBasicBlock lastNext = m_out.appendTo(slowCase, continuation);
+                speculate(NegativeZero, noValue(), nullptr, m_out.lessThan(left, m_out.int32Zero));
+                speculate(NegativeZero, noValue(), nullptr, m_out.lessThan(right, m_out.int32Zero));
+                m_out.jump(continuation);
+                m_out.appendTo(continuation, lastNext);
+            }
+            
+            setInt32(result);
+            break;
+        }
+            
+        case Int52RepUse: {
+            Int52Kind kind;
+            LValue left = lowWhicheverInt52(m_node->child1(), kind);
+            LValue right = lowInt52(m_node->child2(), opposite(kind));
+
+            CheckValue* result = m_out.speculateMul(left, right);
+            blessSpeculation(result, Overflow, noValue(), nullptr, m_origin);
+
+            if (shouldCheckNegativeZero(m_node->arithMode())) {
+                LBasicBlock slowCase = m_out.newBlock();
+                LBasicBlock continuation = m_out.newBlock();
+                
+                m_out.branch(
+                    m_out.notZero64(result), usually(continuation), rarely(slowCase));
+                
+                LBasicBlock lastNext = m_out.appendTo(slowCase, continuation);
+                speculate(NegativeZero, noValue(), nullptr, m_out.lessThan(left, m_out.int64Zero));
+                speculate(NegativeZero, noValue(), nullptr, m_out.lessThan(right, m_out.int64Zero));
+                m_out.jump(continuation);
+                m_out.appendTo(continuation, lastNext);
+            }
+            
+            setInt52(result);
+            break;
+        }
+            
+        case DoubleRepUse: {
+            setDouble(
+                m_out.doubleMul(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
+            break;
+        }
+
+        case UntypedUse: {
+            ArithProfile* arithProfile = m_ftlState.graph.baselineCodeBlockFor(m_node->origin.semantic)->arithProfileForBytecodeOffset(m_node->origin.semantic.bytecodeIndex);
+            JITMulIC* mulIC = codeBlock()->addJITMulIC(arithProfile);
+            auto repatchingFunction = operationValueMulOptimize;
+            auto nonRepatchingFunction = operationValueMul;
+            compileMathIC(mulIC, repatchingFunction, nonRepatchingFunction);
+            break;
+        }
+
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+    }
+
+    void compileArithDiv()
+    {
+        switch (m_node->binaryUseKind()) {
+        case Int32Use: {
+            LValue numerator = lowInt32(m_node->child1());
+            LValue denominator = lowInt32(m_node->child2());
+
+            if (shouldCheckNegativeZero(m_node->arithMode())) {
+                LBasicBlock zeroNumerator = m_out.newBlock();
+                LBasicBlock numeratorContinuation = m_out.newBlock();
+
+                m_out.branch(
+                    m_out.isZero32(numerator),
+                    rarely(zeroNumerator), usually(numeratorContinuation));
+
+                LBasicBlock innerLastNext = m_out.appendTo(zeroNumerator, numeratorContinuation);
+
+                speculate(
+                    NegativeZero, noValue(), 0, m_out.lessThan(denominator, m_out.int32Zero));
+
+                m_out.jump(numeratorContinuation);
+
+                m_out.appendTo(numeratorContinuation, innerLastNext);
+            }
+            
+            if (shouldCheckOverflow(m_node->arithMode())) {
+                LBasicBlock unsafeDenominator = m_out.newBlock();
+                LBasicBlock continuation = m_out.newBlock();
+
+                LValue adjustedDenominator = m_out.add(denominator, m_out.int32One);
+                m_out.branch(
+                    m_out.above(adjustedDenominator, m_out.int32One),
+                    usually(continuation), rarely(unsafeDenominator));
+
+                LBasicBlock lastNext = m_out.appendTo(unsafeDenominator, continuation);
+                LValue neg2ToThe31 = m_out.constInt32(-2147483647-1);
+                speculate(Overflow, noValue(), nullptr, m_out.isZero32(denominator));
+                speculate(Overflow, noValue(), nullptr, m_out.equal(numerator, neg2ToThe31));
+                m_out.jump(continuation);
+
+                m_out.appendTo(continuation, lastNext);
+                LValue result = m_out.div(numerator, denominator);
+                speculate(
+                    Overflow, noValue(), 0,
+                    m_out.notEqual(m_out.mul(result, denominator), numerator));
+                setInt32(result);
+            } else
+                setInt32(m_out.chillDiv(numerator, denominator));
+
+            break;
+        }
+            
+        case DoubleRepUse: {
+            setDouble(m_out.doubleDiv(
+                lowDouble(m_node->child1()), lowDouble(m_node->child2())));
+            break;
+        }
+
+        case UntypedUse: {
+            emitBinarySnippet<JITDivGenerator, NeedScratchFPR>(operationValueDiv);
+            break;
+        }
+
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+    }
+    
+    void compileArithMod()
+    {
+        switch (m_node->binaryUseKind()) {
+        case Int32Use: {
+            LValue numerator = lowInt32(m_node->child1());
+            LValue denominator = lowInt32(m_node->child2());
+
+            LValue remainder;
+            if (shouldCheckOverflow(m_node->arithMode())) {
+                LBasicBlock unsafeDenominator = m_out.newBlock();
+                LBasicBlock continuation = m_out.newBlock();
+
+                LValue adjustedDenominator = m_out.add(denominator, m_out.int32One);
+                m_out.branch(
+                    m_out.above(adjustedDenominator, m_out.int32One),
+                    usually(continuation), rarely(unsafeDenominator));
+
+                LBasicBlock lastNext = m_out.appendTo(unsafeDenominator, continuation);
+                LValue neg2ToThe31 = m_out.constInt32(-2147483647-1);
+                speculate(Overflow, noValue(), nullptr, m_out.isZero32(denominator));
+                speculate(Overflow, noValue(), nullptr, m_out.equal(numerator, neg2ToThe31));
+                m_out.jump(continuation);
+
+                m_out.appendTo(continuation, lastNext);
+                LValue result = m_out.mod(numerator, denominator);
+                remainder = result;
+            } else
+                remainder = m_out.chillMod(numerator, denominator);
+
+            if (shouldCheckNegativeZero(m_node->arithMode())) {
+                LBasicBlock negativeNumerator = m_out.newBlock();
+                LBasicBlock numeratorContinuation = m_out.newBlock();
+
+                m_out.branch(
+                    m_out.lessThan(numerator, m_out.int32Zero),
+                    unsure(negativeNumerator), unsure(numeratorContinuation));
+
+                LBasicBlock innerLastNext = m_out.appendTo(negativeNumerator, numeratorContinuation);
+
+                speculate(NegativeZero, noValue(), 0, m_out.isZero32(remainder));
+
+                m_out.jump(numeratorContinuation);
+
+                m_out.appendTo(numeratorContinuation, innerLastNext);
+            }
+
+            setInt32(remainder);
+            break;
+        }
+            
+        case DoubleRepUse: {
+            setDouble(
+                m_out.doubleMod(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+    }
+
+    void compileArithMinOrMax()
+    {
+        switch (m_node->binaryUseKind()) {
+        case Int32Use: {
+            LValue left = lowInt32(m_node->child1());
+            LValue right = lowInt32(m_node->child2());
+            
+            setInt32(
+                m_out.select(
+                    m_node->op() == ArithMin
+                        ? m_out.lessThan(left, right)
+                        : m_out.lessThan(right, left),
+                    left, right));
+            break;
+        }
+            
+        case DoubleRepUse: {
+            LValue left = lowDouble(m_node->child1());
+            LValue right = lowDouble(m_node->child2());
+            
+            LBasicBlock notLessThan = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            Vector<ValueFromBlock, 2> results;
+            
+            results.append(m_out.anchor(left));
+            m_out.branch(
+                m_node->op() == ArithMin
+                    ? m_out.doubleLessThan(left, right)
+                    : m_out.doubleGreaterThan(left, right),
+                unsure(continuation), unsure(notLessThan));
+            
+            LBasicBlock lastNext = m_out.appendTo(notLessThan, continuation);
+            results.append(m_out.anchor(m_out.select(
+                m_node->op() == ArithMin
+                    ? m_out.doubleGreaterThanOrEqual(left, right)
+                    : m_out.doubleLessThanOrEqual(left, right),
+                right, m_out.constDouble(PNaN))));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setDouble(m_out.phi(Double, results));
+            break;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+    }
+    
+    void compileArithAbs()
+    {
+        switch (m_node->child1().useKind()) {
+        case Int32Use: {
+            LValue value = lowInt32(m_node->child1());
+
+            LValue mask = m_out.aShr(value, m_out.constInt32(31));
+            LValue result = m_out.bitXor(mask, m_out.add(mask, value));
+
+            if (shouldCheckOverflow(m_node->arithMode()))
+                speculate(Overflow, noValue(), 0, m_out.lessThan(result, m_out.int32Zero));
+
+            setInt32(result);
+            break;
+        }
+            
+        case DoubleRepUse: {
+            setDouble(m_out.doubleAbs(lowDouble(m_node->child1())));
+            break;
+        }
+            
+        default: {
+            DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse);
+            LValue argument = lowJSValue(m_node->child1());
+            LValue result = vmCall(Double, m_out.operation(operationArithAbs), m_callFrame, argument);
+            setDouble(result);
+            break;
+        }
+        }
+    }
+
+    void compileArithSin()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            setDouble(m_out.doubleSin(lowDouble(m_node->child1())));
+            return;
+        }
+        LValue argument = lowJSValue(m_node->child1());
+        LValue result = vmCall(Double, m_out.operation(operationArithSin), m_callFrame, argument);
+        setDouble(result);
+    }
+
+    void compileArithCos()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            setDouble(m_out.doubleCos(lowDouble(m_node->child1())));
+            return;
+        }
+        LValue argument = lowJSValue(m_node->child1());
+        LValue result = vmCall(Double, m_out.operation(operationArithCos), m_callFrame, argument);
+        setDouble(result);
+    }
+
+    void compileArithTan()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            setDouble(m_out.doubleTan(lowDouble(m_node->child1())));
+            return;
+        }
+        LValue argument = lowJSValue(m_node->child1());
+        LValue result = vmCall(Double, m_out.operation(operationArithTan), m_callFrame, argument);
+        setDouble(result);
+    }
+
+    void compileArithPow()
+    {
+        if (m_node->child2().useKind() == Int32Use)
+            setDouble(m_out.doublePowi(lowDouble(m_node->child1()), lowInt32(m_node->child2())));
+        else {
+            LValue base = lowDouble(m_node->child1());
+            LValue exponent = lowDouble(m_node->child2());
+
+            LBasicBlock integerExponentIsSmallBlock = m_out.newBlock();
+            LBasicBlock integerExponentPowBlock = m_out.newBlock();
+            LBasicBlock doubleExponentPowBlockEntry = m_out.newBlock();
+            LBasicBlock nanExceptionBaseIsOne = m_out.newBlock();
+            LBasicBlock nanExceptionExponentIsInfinity = m_out.newBlock();
+            LBasicBlock testExponentIsOneHalf = m_out.newBlock();
+            LBasicBlock handleBaseZeroExponentIsOneHalf = m_out.newBlock();
+            LBasicBlock handleInfinityForExponentIsOneHalf = m_out.newBlock();
+            LBasicBlock exponentIsOneHalfNormal = m_out.newBlock();
+            LBasicBlock exponentIsOneHalfInfinity = m_out.newBlock();
+            LBasicBlock testExponentIsNegativeOneHalf = m_out.newBlock();
+            LBasicBlock testBaseZeroExponentIsNegativeOneHalf = m_out.newBlock();
+            LBasicBlock handleBaseZeroExponentIsNegativeOneHalf = m_out.newBlock();
+            LBasicBlock handleInfinityForExponentIsNegativeOneHalf = m_out.newBlock();
+            LBasicBlock exponentIsNegativeOneHalfNormal = m_out.newBlock();
+            LBasicBlock exponentIsNegativeOneHalfInfinity = m_out.newBlock();
+            LBasicBlock powBlock = m_out.newBlock();
+            LBasicBlock nanExceptionResultIsNaN = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            LValue integerExponent = m_out.doubleToInt(exponent);
+            LValue integerExponentConvertedToDouble = m_out.intToDouble(integerExponent);
+            LValue exponentIsInteger = m_out.doubleEqual(exponent, integerExponentConvertedToDouble);
+            m_out.branch(exponentIsInteger, unsure(integerExponentIsSmallBlock), unsure(doubleExponentPowBlockEntry));
+
+            LBasicBlock lastNext = m_out.appendTo(integerExponentIsSmallBlock, integerExponentPowBlock);
+            LValue integerExponentBelowMax = m_out.belowOrEqual(integerExponent, m_out.constInt32(maxExponentForIntegerMathPow));
+            m_out.branch(integerExponentBelowMax, usually(integerExponentPowBlock), rarely(doubleExponentPowBlockEntry));
+
+            m_out.appendTo(integerExponentPowBlock, doubleExponentPowBlockEntry);
+            ValueFromBlock powDoubleIntResult = m_out.anchor(m_out.doublePowi(base, integerExponent));
+            m_out.jump(continuation);
+
+            // If y is NaN, the result is NaN.
+            m_out.appendTo(doubleExponentPowBlockEntry, nanExceptionBaseIsOne);
+            LValue exponentIsNaN;
+            if (provenType(m_node->child2()) & SpecDoubleNaN)
+                exponentIsNaN = m_out.doubleNotEqualOrUnordered(exponent, exponent);
+            else
+                exponentIsNaN = m_out.booleanFalse;
+            m_out.branch(exponentIsNaN, rarely(nanExceptionResultIsNaN), usually(nanExceptionBaseIsOne));
+
+            // If abs(x) is 1 and y is +infinity, the result is NaN.
+            // If abs(x) is 1 and y is -infinity, the result is NaN.
+
+            //     Test if base == 1.
+            m_out.appendTo(nanExceptionBaseIsOne, nanExceptionExponentIsInfinity);
+            LValue absoluteBase = m_out.doubleAbs(base);
+            LValue absoluteBaseIsOne = m_out.doubleEqual(absoluteBase, m_out.constDouble(1));
+            m_out.branch(absoluteBaseIsOne, rarely(nanExceptionExponentIsInfinity), usually(testExponentIsOneHalf));
+
+            //     Test if abs(y) == Infinity.
+            m_out.appendTo(nanExceptionExponentIsInfinity, testExponentIsOneHalf);
+            LValue absoluteExponent = m_out.doubleAbs(exponent);
+            LValue absoluteExponentIsInfinity = m_out.doubleEqual(absoluteExponent, m_out.constDouble(std::numeric_limits<double>::infinity()));
+            m_out.branch(absoluteExponentIsInfinity, rarely(nanExceptionResultIsNaN), usually(testExponentIsOneHalf));
+
+            // If y == 0.5 or y == -0.5, handle it through SQRT.
+            // We have be carefuly with -0 and -Infinity.
+
+            //     Test if y == 0.5
+            m_out.appendTo(testExponentIsOneHalf, handleBaseZeroExponentIsOneHalf);
+            LValue exponentIsOneHalf = m_out.doubleEqual(exponent, m_out.constDouble(0.5));
+            m_out.branch(exponentIsOneHalf, rarely(handleBaseZeroExponentIsOneHalf), usually(testExponentIsNegativeOneHalf));
+
+            //     Handle x == -0.
+            m_out.appendTo(handleBaseZeroExponentIsOneHalf, handleInfinityForExponentIsOneHalf);
+            LValue baseIsZeroExponentIsOneHalf = m_out.doubleEqual(base, m_out.doubleZero);
+            ValueFromBlock zeroResultExponentIsOneHalf = m_out.anchor(m_out.doubleZero);
+            m_out.branch(baseIsZeroExponentIsOneHalf, rarely(continuation), usually(handleInfinityForExponentIsOneHalf));
+
+            //     Test if abs(x) == Infinity.
+            m_out.appendTo(handleInfinityForExponentIsOneHalf, exponentIsOneHalfNormal);
+            LValue absoluteBaseIsInfinityOneHalf = m_out.doubleEqual(absoluteBase, m_out.constDouble(std::numeric_limits<double>::infinity()));
+            m_out.branch(absoluteBaseIsInfinityOneHalf, rarely(exponentIsOneHalfInfinity), usually(exponentIsOneHalfNormal));
+
+            //     The exponent is 0.5, the base is finite or NaN, we can use SQRT.
+            m_out.appendTo(exponentIsOneHalfNormal, exponentIsOneHalfInfinity);
+            ValueFromBlock sqrtResult = m_out.anchor(m_out.doubleSqrt(base));
+            m_out.jump(continuation);
+
+            //     The exponent is 0.5, the base is infinite, the result is always infinite.
+            m_out.appendTo(exponentIsOneHalfInfinity, testExponentIsNegativeOneHalf);
+            ValueFromBlock sqrtInfinityResult = m_out.anchor(m_out.constDouble(std::numeric_limits<double>::infinity()));
+            m_out.jump(continuation);
+
+            //     Test if y == -0.5
+            m_out.appendTo(testExponentIsNegativeOneHalf, testBaseZeroExponentIsNegativeOneHalf);
+            LValue exponentIsNegativeOneHalf = m_out.doubleEqual(exponent, m_out.constDouble(-0.5));
+            m_out.branch(exponentIsNegativeOneHalf, rarely(testBaseZeroExponentIsNegativeOneHalf), usually(powBlock));
+
+            //     Handle x == -0.
+            m_out.appendTo(testBaseZeroExponentIsNegativeOneHalf, handleBaseZeroExponentIsNegativeOneHalf);
+            LValue baseIsZeroExponentIsNegativeOneHalf = m_out.doubleEqual(base, m_out.doubleZero);
+            m_out.branch(baseIsZeroExponentIsNegativeOneHalf, rarely(handleBaseZeroExponentIsNegativeOneHalf), usually(handleInfinityForExponentIsNegativeOneHalf));
+
+            m_out.appendTo(handleBaseZeroExponentIsNegativeOneHalf, handleInfinityForExponentIsNegativeOneHalf);
+            ValueFromBlock oneOverSqrtZeroResult = m_out.anchor(m_out.constDouble(std::numeric_limits<double>::infinity()));
+            m_out.jump(continuation);
+
+            //     Test if abs(x) == Infinity.
+            m_out.appendTo(handleInfinityForExponentIsNegativeOneHalf, exponentIsNegativeOneHalfNormal);
+            LValue absoluteBaseIsInfinityNegativeOneHalf = m_out.doubleEqual(absoluteBase, m_out.constDouble(std::numeric_limits<double>::infinity()));
+            m_out.branch(absoluteBaseIsInfinityNegativeOneHalf, rarely(exponentIsNegativeOneHalfInfinity), usually(exponentIsNegativeOneHalfNormal));
+
+            //     The exponent is -0.5, the base is finite or NaN, we can use 1/SQRT.
+            m_out.appendTo(exponentIsNegativeOneHalfNormal, exponentIsNegativeOneHalfInfinity);
+            LValue sqrtBase = m_out.doubleSqrt(base);
+            ValueFromBlock oneOverSqrtResult = m_out.anchor(m_out.div(m_out.constDouble(1.), sqrtBase));
+            m_out.jump(continuation);
+
+            //     The exponent is -0.5, the base is infinite, the result is always zero.
+            m_out.appendTo(exponentIsNegativeOneHalfInfinity, powBlock);
+            ValueFromBlock oneOverSqrtInfinityResult = m_out.anchor(m_out.doubleZero);
+            m_out.jump(continuation);
+
+            m_out.appendTo(powBlock, nanExceptionResultIsNaN);
+            ValueFromBlock powResult = m_out.anchor(m_out.doublePow(base, exponent));
+            m_out.jump(continuation);
+
+            m_out.appendTo(nanExceptionResultIsNaN, continuation);
+            ValueFromBlock pureNan = m_out.anchor(m_out.constDouble(PNaN));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            setDouble(m_out.phi(Double, powDoubleIntResult, zeroResultExponentIsOneHalf, sqrtResult, sqrtInfinityResult, oneOverSqrtZeroResult, oneOverSqrtResult, oneOverSqrtInfinityResult, powResult, pureNan));
+        }
+    }
+
+    void compileArithRandom()
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+
+        // Inlined WeakRandom::advance().
+        // uint64_t x = m_low;
+        void* lowAddress = reinterpret_cast<uint8_t*>(globalObject) + JSGlobalObject::weakRandomOffset() + WeakRandom::lowOffset();
+        LValue low = m_out.load64(m_out.absolute(lowAddress));
+        // uint64_t y = m_high;
+        void* highAddress = reinterpret_cast<uint8_t*>(globalObject) + JSGlobalObject::weakRandomOffset() + WeakRandom::highOffset();
+        LValue high = m_out.load64(m_out.absolute(highAddress));
+        // m_low = y;
+        m_out.store64(high, m_out.absolute(lowAddress));
+
+        // x ^= x << 23;
+        LValue phase1 = m_out.bitXor(m_out.shl(low, m_out.constInt64(23)), low);
+
+        // x ^= x >> 17;
+        LValue phase2 = m_out.bitXor(m_out.lShr(phase1, m_out.constInt64(17)), phase1);
+
+        // x ^= y ^ (y >> 26);
+        LValue phase3 = m_out.bitXor(m_out.bitXor(high, m_out.lShr(high, m_out.constInt64(26))), phase2);
+
+        // m_high = x;
+        m_out.store64(phase3, m_out.absolute(highAddress));
+
+        // return x + y;
+        LValue random64 = m_out.add(phase3, high);
+
+        // Extract random 53bit. [0, 53] bit is safe integer number ranges in double representation.
+        LValue random53 = m_out.bitAnd(random64, m_out.constInt64((1ULL << 53) - 1));
+
+        LValue double53Integer = m_out.intToDouble(random53);
+
+        // Convert `(53bit double integer value) / (1 << 53)` to `(53bit double integer value) * (1.0 / (1 << 53))`.
+        // In latter case, `1.0 / (1 << 53)` will become a double value represented as (mantissa = 0 & exp = 970, it means 1e-(2**54)).
+        static const double scale = 1.0 / (1ULL << 53);
+
+        // Multiplying 1e-(2**54) with the double integer does not change anything of the mantissa part of the double integer.
+        // It just reduces the exp part of the given 53bit double integer.
+        // (Except for 0.0. This is specially handled and in this case, exp just becomes 0.)
+        // Now we get 53bit precision random double value in [0, 1).
+        LValue result = m_out.doubleMul(double53Integer, m_out.constDouble(scale));
+
+        setDouble(result);
+    }
+
+    void compileArithRound()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            LValue result = nullptr;
+            if (producesInteger(m_node->arithRoundingMode()) && !shouldCheckNegativeZero(m_node->arithRoundingMode())) {
+                LValue value = lowDouble(m_node->child1());
+                result = m_out.doubleFloor(m_out.doubleAdd(value, m_out.constDouble(0.5)));
+            } else {
+                LBasicBlock realPartIsMoreThanHalf = m_out.newBlock();
+                LBasicBlock continuation = m_out.newBlock();
+
+                LValue value = lowDouble(m_node->child1());
+                LValue integerValue = m_out.doubleCeil(value);
+                ValueFromBlock integerValueResult = m_out.anchor(integerValue);
+
+                LValue realPart = m_out.doubleSub(integerValue, value);
+
+                m_out.branch(m_out.doubleGreaterThanOrUnordered(realPart, m_out.constDouble(0.5)), unsure(realPartIsMoreThanHalf), unsure(continuation));
+
+                LBasicBlock lastNext = m_out.appendTo(realPartIsMoreThanHalf, continuation);
+                LValue integerValueRoundedDown = m_out.doubleSub(integerValue, m_out.constDouble(1));
+                ValueFromBlock integerValueRoundedDownResult = m_out.anchor(integerValueRoundedDown);
+                m_out.jump(continuation);
+                m_out.appendTo(continuation, lastNext);
+
+                result = m_out.phi(Double, integerValueResult, integerValueRoundedDownResult);
+            }
+
+            if (producesInteger(m_node->arithRoundingMode())) {
+                LValue integerValue = convertDoubleToInt32(result, shouldCheckNegativeZero(m_node->arithRoundingMode()));
+                setInt32(integerValue);
+            } else
+                setDouble(result);
+            return;
+        }
+
+        DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse);
+        LValue argument = lowJSValue(m_node->child1());
+        setJSValue(vmCall(Int64, m_out.operation(operationArithRound), m_callFrame, argument));
+    }
+
+    void compileArithFloor()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            LValue value = lowDouble(m_node->child1());
+            LValue integerValue = m_out.doubleFloor(value);
+            if (producesInteger(m_node->arithRoundingMode()))
+                setInt32(convertDoubleToInt32(integerValue, shouldCheckNegativeZero(m_node->arithRoundingMode())));
+            else
+                setDouble(integerValue);
+            return;
+        }
+        DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse);
+        LValue argument = lowJSValue(m_node->child1());
+        setJSValue(vmCall(Int64, m_out.operation(operationArithFloor), m_callFrame, argument));
+    }
+
+    void compileArithCeil()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            LValue value = lowDouble(m_node->child1());
+            LValue integerValue = m_out.doubleCeil(value);
+            if (producesInteger(m_node->arithRoundingMode()))
+                setInt32(convertDoubleToInt32(integerValue, shouldCheckNegativeZero(m_node->arithRoundingMode())));
+            else
+                setDouble(integerValue);
+            return;
+        }
+        DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse);
+        LValue argument = lowJSValue(m_node->child1());
+        setJSValue(vmCall(Int64, m_out.operation(operationArithCeil), m_callFrame, argument));
+    }
+
+    void compileArithTrunc()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            LValue value = lowDouble(m_node->child1());
+            LValue result = m_out.doubleTrunc(value);
+            if (producesInteger(m_node->arithRoundingMode()))
+                setInt32(convertDoubleToInt32(result, shouldCheckNegativeZero(m_node->arithRoundingMode())));
+            else
+                setDouble(result);
+            return;
+        }
+        DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse);
+        LValue argument = lowJSValue(m_node->child1());
+        setJSValue(vmCall(Int64, m_out.operation(operationArithTrunc), m_callFrame, argument));
+    }
+
+    void compileArithSqrt()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            setDouble(m_out.doubleSqrt(lowDouble(m_node->child1())));
+            return;
+        }
+        LValue argument = lowJSValue(m_node->child1());
+        LValue result = vmCall(Double, m_out.operation(operationArithSqrt), m_callFrame, argument);
+        setDouble(result);
+    }
+
+    void compileArithLog()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            setDouble(m_out.doubleLog(lowDouble(m_node->child1())));
+            return;
+        }
+        LValue argument = lowJSValue(m_node->child1());
+        LValue result = vmCall(Double, m_out.operation(operationArithLog), m_callFrame, argument);
+        setDouble(result);
+    }
+    
+    void compileArithFRound()
+    {
+        if (m_node->child1().useKind() == DoubleRepUse) {
+            setDouble(m_out.fround(lowDouble(m_node->child1())));
+            return;
+        }
+        LValue argument = lowJSValue(m_node->child1());
+        LValue result = vmCall(Double, m_out.operation(operationArithFRound), m_callFrame, argument);
+        setDouble(result);
+    }
+    
+    void compileArithNegate()
+    {
+        switch (m_node->child1().useKind()) {
+        case Int32Use: {
+            LValue value = lowInt32(m_node->child1());
+            
+            LValue result;
+            if (!shouldCheckOverflow(m_node->arithMode()))
+                result = m_out.neg(value);
+            else if (!shouldCheckNegativeZero(m_node->arithMode())) {
+                CheckValue* check = m_out.speculateSub(m_out.int32Zero, value);
+                blessSpeculation(check, Overflow, noValue(), nullptr, m_origin);
+                result = check;
+            } else {
+                speculate(Overflow, noValue(), 0, m_out.testIsZero32(value, m_out.constInt32(0x7fffffff)));
+                result = m_out.neg(value);
+            }
+
+            setInt32(result);
+            break;
+        }
+            
+        case Int52RepUse: {
+            if (!abstractValue(m_node->child1()).couldBeType(SpecInt52Only)) {
+                Int52Kind kind;
+                LValue value = lowWhicheverInt52(m_node->child1(), kind);
+                LValue result = m_out.neg(value);
+                if (shouldCheckNegativeZero(m_node->arithMode()))
+                    speculate(NegativeZero, noValue(), 0, m_out.isZero64(result));
+                setInt52(result, kind);
+                break;
+            }
+            
+            LValue value = lowInt52(m_node->child1());
+            CheckValue* result = m_out.speculateSub(m_out.int64Zero, value);
+            blessSpeculation(result, Int52Overflow, noValue(), nullptr, m_origin);
+            speculate(NegativeZero, noValue(), 0, m_out.isZero64(result));
+            setInt52(result);
+            break;
+        }
+            
+        case DoubleRepUse: {
+            setDouble(m_out.doubleNeg(lowDouble(m_node->child1())));
+            break;
+        }
+            
+        default:
+            DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == UntypedUse);
+            ArithProfile* arithProfile = m_ftlState.graph.baselineCodeBlockFor(m_node->origin.semantic)->arithProfileForBytecodeOffset(m_node->origin.semantic.bytecodeIndex);
+            JITNegIC* negIC = codeBlock()->addJITNegIC(arithProfile);
+            auto repatchingFunction = operationArithNegateOptimize;
+            auto nonRepatchingFunction = operationArithNegate;
+            compileMathIC(negIC, repatchingFunction, nonRepatchingFunction);
+            break;
+        }
+    }
+    
+    void compileBitAnd()
+    {
+        if (m_node->isBinaryUseKind(UntypedUse)) {
+            emitBinaryBitOpSnippet<JITBitAndGenerator>(operationValueBitAnd);
+            return;
+        }
+        setInt32(m_out.bitAnd(lowInt32(m_node->child1()), lowInt32(m_node->child2())));
+    }
+    
+    void compileBitOr()
+    {
+        if (m_node->isBinaryUseKind(UntypedUse)) {
+            emitBinaryBitOpSnippet<JITBitOrGenerator>(operationValueBitOr);
+            return;
+        }
+        setInt32(m_out.bitOr(lowInt32(m_node->child1()), lowInt32(m_node->child2())));
+    }
+    
+    void compileBitXor()
+    {
+        if (m_node->isBinaryUseKind(UntypedUse)) {
+            emitBinaryBitOpSnippet<JITBitXorGenerator>(operationValueBitXor);
+            return;
+        }
+        setInt32(m_out.bitXor(lowInt32(m_node->child1()), lowInt32(m_node->child2())));
+    }
+    
+    void compileBitRShift()
+    {
+        if (m_node->isBinaryUseKind(UntypedUse)) {
+            emitRightShiftSnippet(JITRightShiftGenerator::SignedShift);
+            return;
+        }
+        setInt32(m_out.aShr(
+            lowInt32(m_node->child1()),
+            m_out.bitAnd(lowInt32(m_node->child2()), m_out.constInt32(31))));
+    }
+    
+    void compileBitLShift()
+    {
+        if (m_node->isBinaryUseKind(UntypedUse)) {
+            emitBinaryBitOpSnippet<JITLeftShiftGenerator>(operationValueBitLShift);
+            return;
+        }
+        setInt32(m_out.shl(
+            lowInt32(m_node->child1()),
+            m_out.bitAnd(lowInt32(m_node->child2()), m_out.constInt32(31))));
+    }
+    
+    void compileBitURShift()
+    {
+        if (m_node->isBinaryUseKind(UntypedUse)) {
+            emitRightShiftSnippet(JITRightShiftGenerator::UnsignedShift);
+            return;
+        }
+        setInt32(m_out.lShr(
+            lowInt32(m_node->child1()),
+            m_out.bitAnd(lowInt32(m_node->child2()), m_out.constInt32(31))));
+    }
+    
+    void compileUInt32ToNumber()
+    {
+        LValue value = lowInt32(m_node->child1());
+
+        if (doesOverflow(m_node->arithMode())) {
+            setStrictInt52(m_out.zeroExtPtr(value));
+            return;
+        }
+
+        speculate(Overflow, noValue(), 0, m_out.lessThan(value, m_out.int32Zero));
+        setInt32(value);
+    }
+    
+    void compileCheckStructure()
+    {
+        ExitKind exitKind;
+        if (m_node->child1()->hasConstant())
+            exitKind = BadConstantCache;
+        else
+            exitKind = BadCache;
+
+        switch (m_node->child1().useKind()) {
+        case CellUse:
+        case KnownCellUse: {
+            LValue cell = lowCell(m_node->child1());
+            
+            checkStructure(
+                m_out.load32(cell, m_heaps.JSCell_structureID), jsValueValue(cell),
+                exitKind, m_node->structureSet(),
+                [&] (RegisteredStructure structure) {
+                    return weakStructureID(structure);
+                });
+            return;
+        }
+
+        case CellOrOtherUse: {
+            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);
+
+            LBasicBlock cellCase = m_out.newBlock();
+            LBasicBlock notCellCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            m_out.branch(
+                isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));
+
+            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
+            checkStructure(
+                m_out.load32(value, m_heaps.JSCell_structureID), jsValueValue(value),
+                exitKind, m_node->structureSet(),
+                [&] (RegisteredStructure structure) {
+                    return weakStructureID(structure);
+                });
+            m_out.jump(continuation);
+
+            m_out.appendTo(notCellCase, continuation);
+            FTL_TYPE_CHECK(jsValueValue(value), m_node->child1(), SpecCell | SpecOther, isNotOther(value));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            return;
+        }
+
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            return;
+        }
+    }
+    
+    void compileCheckCell()
+    {
+        LValue cell = lowCell(m_node->child1());
+        
+        speculate(
+            BadCell, jsValueValue(cell), m_node->child1().node(),
+            m_out.notEqual(cell, weakPointer(m_node->cellOperand()->cell())));
+    }
+    
+    void compileCheckBadCell()
+    {
+        terminate(BadCell);
+    }
+
+    void compileCheckNotEmpty()
+    {
+        speculate(TDZFailure, noValue(), nullptr, m_out.isZero64(lowJSValue(m_node->child1())));
+    }
+
+    void compileCheckStringIdent()
+    {
+        UniquedStringImpl* uid = m_node->uidOperand();
+        LValue stringImpl = lowStringIdent(m_node->child1());
+        speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
+    }
+
+    void compileGetExecutable()
+    {
+        LValue cell = lowCell(m_node->child1());
+        speculateFunction(m_node->child1(), cell);
+        setJSValue(m_out.loadPtr(cell, m_heaps.JSFunction_executable));
+    }
+    
+    void compileArrayifyToStructure()
+    {
+        LValue cell = lowCell(m_node->child1());
+        LValue property = !!m_node->child2() ? lowInt32(m_node->child2()) : 0;
+        
+        LBasicBlock unexpectedStructure = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
+        
+        m_out.branch(
+            m_out.notEqual(structureID, weakStructureID(m_node->structure())),
+            rarely(unexpectedStructure), usually(continuation));
+        
+        LBasicBlock lastNext = m_out.appendTo(unexpectedStructure, continuation);
+        
+        if (property) {
+            switch (m_node->arrayMode().type()) {
+            case Array::Int32:
+            case Array::Double:
+            case Array::Contiguous:
+                speculate(
+                    Uncountable, noValue(), 0,
+                    m_out.aboveOrEqual(property, m_out.constInt32(MIN_SPARSE_ARRAY_INDEX)));
+                break;
+            default:
+                break;
+            }
+        }
+        
+        switch (m_node->arrayMode().type()) {
+        case Array::Int32:
+            vmCall(Void, m_out.operation(operationEnsureInt32), m_callFrame, cell);
+            break;
+        case Array::Double:
+            vmCall(Void, m_out.operation(operationEnsureDouble), m_callFrame, cell);
+            break;
+        case Array::Contiguous:
+            vmCall(Void, m_out.operation(operationEnsureContiguous), m_callFrame, cell);
+            break;
+        case Array::ArrayStorage:
+        case Array::SlowPutArrayStorage:
+            vmCall(Void, m_out.operation(operationEnsureArrayStorage), m_callFrame, cell);
+            break;
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad array type");
+            break;
+        }
+        
+        structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
+        speculate(
+            BadIndexingType, jsValueValue(cell), 0,
+            m_out.notEqual(structureID, weakStructureID(m_node->structure())));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void compilePutStructure()
+    {
+        m_ftlState.jitCode->common.notifyCompilingStructureTransition(m_graph.m_plan, codeBlock(), m_node);
+        
+        RegisteredStructure oldStructure = m_node->transition()->previous;
+        RegisteredStructure newStructure = m_node->transition()->next;
+        ASSERT_UNUSED(oldStructure, oldStructure->indexingType() == newStructure->indexingType());
+        ASSERT(oldStructure->typeInfo().inlineTypeFlags() == newStructure->typeInfo().inlineTypeFlags());
+        ASSERT(oldStructure->typeInfo().type() == newStructure->typeInfo().type());
+
+        LValue cell = lowCell(m_node->child1()); 
+        m_out.store32(
+            weakStructureID(newStructure),
+            cell, m_heaps.JSCell_structureID);
+    }
+    
+    void compileGetById(AccessType type)
+    {
+        ASSERT(type == AccessType::Get || type == AccessType::GetPure);
+        switch (m_node->child1().useKind()) {
+        case CellUse: {
+            setJSValue(getById(lowCell(m_node->child1()), type));
+            return;
+        }
+            
+        case UntypedUse: {
+            // This is pretty weird, since we duplicate the slow path both here and in the
+            // code generated by the IC. We should investigate making this less bad.
+            // https://bugs.webkit.org/show_bug.cgi?id=127830
+            LValue value = lowJSValue(m_node->child1());
+            
+            LBasicBlock cellCase = m_out.newBlock();
+            LBasicBlock notCellCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            m_out.branch(
+                isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));
+            
+            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
+            ValueFromBlock cellResult = m_out.anchor(getById(value, type));
+            m_out.jump(continuation);
+
+            J_JITOperation_EJI getByIdFunction;
+            if (type == AccessType::Get)
+                getByIdFunction = operationGetByIdGeneric;
+            else
+                getByIdFunction = operationTryGetByIdGeneric;
+
+            m_out.appendTo(notCellCase, continuation);
+            ValueFromBlock notCellResult = m_out.anchor(vmCall(
+                Int64, m_out.operation(getByIdFunction),
+                m_callFrame, value,
+                m_out.constIntPtr(m_graph.identifiers()[m_node->identifierNumber()])));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, cellResult, notCellResult));
+            return;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            return;
+        }
+    }
+
+    void compileGetByIdWithThis()
+    {
+        LValue base = lowJSValue(m_node->child1());
+        LValue thisValue = lowJSValue(m_node->child2());
+        LValue result = vmCall(Int64, m_out.operation(operationGetByIdWithThis), m_callFrame, base, thisValue, m_out.constIntPtr(m_graph.identifiers()[m_node->identifierNumber()]));
+        setJSValue(result);
+    }
+
+    void compileGetByValWithThis()
+    {
+        LValue base = lowJSValue(m_node->child1());
+        LValue thisValue = lowJSValue(m_node->child2());
+        LValue subscript = lowJSValue(m_node->child3());
+
+        LValue result = vmCall(Int64, m_out.operation(operationGetByValWithThis), m_callFrame, base, thisValue, subscript);
+        setJSValue(result);
+    }
+
+    void compilePutByIdWithThis()
+    {
+        LValue base = lowJSValue(m_node->child1());
+        LValue thisValue = lowJSValue(m_node->child2());
+        LValue value = lowJSValue(m_node->child3());
+
+        vmCall(Void, m_out.operation(m_graph.isStrictModeFor(m_node->origin.semantic) ? operationPutByIdWithThisStrict : operationPutByIdWithThis),
+            m_callFrame, base, thisValue, value, m_out.constIntPtr(m_graph.identifiers()[m_node->identifierNumber()]));
+    }
+
+    void compilePutByValWithThis()
+    {
+        LValue base = lowJSValue(m_graph.varArgChild(m_node, 0));
+        LValue thisValue = lowJSValue(m_graph.varArgChild(m_node, 1));
+        LValue property = lowJSValue(m_graph.varArgChild(m_node, 2));
+        LValue value = lowJSValue(m_graph.varArgChild(m_node, 3));
+
+        vmCall(Void, m_out.operation(m_graph.isStrictModeFor(m_node->origin.semantic) ? operationPutByValWithThisStrict : operationPutByValWithThis),
+            m_callFrame, base, thisValue, property, value);
+    }
+
+    void compileDefineDataProperty()
+    {
+        LValue base = lowCell(m_graph.varArgChild(m_node, 0));
+        LValue value  = lowJSValue(m_graph.varArgChild(m_node, 2));
+        LValue attributes = lowInt32(m_graph.varArgChild(m_node, 3));
+        Edge& propertyEdge = m_graph.varArgChild(m_node, 1);
+        switch (propertyEdge.useKind()) {
+        case StringUse: {
+            LValue property = lowString(propertyEdge);
+            vmCall(Void, m_out.operation(operationDefineDataPropertyString), m_callFrame, base, property, value, attributes);
+            break;
+        }
+        case StringIdentUse: {
+            LValue property = lowStringIdent(propertyEdge);
+            vmCall(Void, m_out.operation(operationDefineDataPropertyStringIdent), m_callFrame, base, property, value, attributes);
+            break;
+        }
+        case SymbolUse: {
+            LValue property = lowSymbol(propertyEdge);
+            vmCall(Void, m_out.operation(operationDefineDataPropertySymbol), m_callFrame, base, property, value, attributes);
+            break;
+        }
+        case UntypedUse: {
+            LValue property = lowJSValue(propertyEdge);
+            vmCall(Void, m_out.operation(operationDefineDataProperty), m_callFrame, base, property, value, attributes);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void compileDefineAccessorProperty()
+    {
+        LValue base = lowCell(m_graph.varArgChild(m_node, 0));
+        LValue getter = lowCell(m_graph.varArgChild(m_node, 2));
+        LValue setter = lowCell(m_graph.varArgChild(m_node, 3));
+        LValue attributes = lowInt32(m_graph.varArgChild(m_node, 4));
+        Edge& propertyEdge = m_graph.varArgChild(m_node, 1);
+        switch (propertyEdge.useKind()) {
+        case StringUse: {
+            LValue property = lowString(propertyEdge);
+            vmCall(Void, m_out.operation(operationDefineAccessorPropertyString), m_callFrame, base, property, getter, setter, attributes);
+            break;
+        }
+        case StringIdentUse: {
+            LValue property = lowStringIdent(propertyEdge);
+            vmCall(Void, m_out.operation(operationDefineAccessorPropertyStringIdent), m_callFrame, base, property, getter, setter, attributes);
+            break;
+        }
+        case SymbolUse: {
+            LValue property = lowSymbol(propertyEdge);
+            vmCall(Void, m_out.operation(operationDefineAccessorPropertySymbol), m_callFrame, base, property, getter, setter, attributes);
+            break;
+        }
+        case UntypedUse: {
+            LValue property = lowJSValue(propertyEdge);
+            vmCall(Void, m_out.operation(operationDefineAccessorProperty), m_callFrame, base, property, getter, setter, attributes);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+    
+    void compilePutById()
+    {
+        DFG_ASSERT(m_graph, m_node, m_node->child1().useKind() == CellUse);
+
+        Node* node = m_node;
+        LValue base = lowCell(node->child1());
+        LValue value = lowJSValue(node->child2());
+        auto uid = m_graph.identifiers()[node->identifierNumber()];
+
+        B3::PatchpointValue* patchpoint = m_out.patchpoint(Void);
+        patchpoint->appendSomeRegister(base);
+        patchpoint->appendSomeRegister(value);
+        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+
+        // FIXME: If this is a PutByIdFlush, we might want to late-clobber volatile registers.
+        // https://bugs.webkit.org/show_bug.cgi?id=152848
+
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(patchpoint);
+
+        State* state = &m_ftlState;
+        ECMAMode ecmaMode = m_graph.executableFor(node->origin.semantic)->ecmaMode();
+        
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                CallSiteIndex callSiteIndex =
+                    state->jitCode->common.addUniqueCallSiteIndex(node->origin.semantic);
+
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+                // JS setter call ICs generated by the PutById IC will need this.
+                exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
+
+                auto generator = Box<JITPutByIdGenerator>::create(
+                    jit.codeBlock(), node->origin.semantic, callSiteIndex,
+                    params.unavailableRegisters(), JSValueRegs(params[0].gpr()),
+                    JSValueRegs(params[1].gpr()), GPRInfo::patchpointScratchRegister, ecmaMode,
+                    node->op() == PutByIdDirect ? Direct : NotDirect);
+
+                generator->generateFastPath(jit);
+                CCallHelpers::Label done = jit.label();
+
+                params.addLatePath(
+                    [=] (CCallHelpers& jit) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                        generator->slowPathJump().link(&jit);
+                        CCallHelpers::Label slowPathBegin = jit.label();
+                        CCallHelpers::Call slowPathCall = callOperation(
+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                            exceptions.get(), generator->slowPathFunction(), InvalidGPRReg,
+                            CCallHelpers::TrustedImmPtr(generator->stubInfo()), params[1].gpr(),
+                            params[0].gpr(), CCallHelpers::TrustedImmPtr(uid)).call();
+                        jit.jump().linkTo(done, &jit);
+
+                        generator->reportSlowPathCall(slowPathBegin, slowPathCall);
+
+                        jit.addLinkTask(
+                            [=] (LinkBuffer& linkBuffer) {
+                                generator->finalize(linkBuffer);
+                            });
+                    });
+            });
+    }
+    
+    void compileGetButterfly()
+    {
+        setStorage(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.JSObject_butterfly));
+    }
+
+    void compileConstantStoragePointer()
+    {
+        setStorage(m_out.constIntPtr(m_node->storagePointer()));
+    }
+    
+    void compileGetIndexedPropertyStorage()
+    {
+        LValue cell = lowCell(m_node->child1());
+        
+        if (m_node->arrayMode().type() == Array::String) {
+            LBasicBlock slowPath = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            LValue fastResultValue = m_out.loadPtr(cell, m_heaps.JSString_value);
+            ValueFromBlock fastResult = m_out.anchor(fastResultValue);
+            
+            m_out.branch(
+                m_out.notNull(fastResultValue), usually(continuation), rarely(slowPath));
+            
+            LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
+            
+            ValueFromBlock slowResult = m_out.anchor(
+                vmCall(pointerType(), m_out.operation(operationResolveRope), m_callFrame, cell));
+            
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            
+            setStorage(m_out.loadPtr(m_out.phi(pointerType(), fastResult, slowResult), m_heaps.StringImpl_data));
+            return;
+        }
+
+        DFG_ASSERT(m_graph, m_node, isTypedView(m_node->arrayMode().typedArrayType()));
+        setStorage(m_out.loadPtr(cell, m_heaps.JSArrayBufferView_vector));
+    }
+    
+    void compileCheckArray()
+    {
+        Edge edge = m_node->child1();
+        LValue cell = lowCell(edge);
+        
+        if (m_node->arrayMode().alreadyChecked(m_graph, m_node, abstractValue(edge)))
+            return;
+        
+        speculate(
+            BadIndexingType, jsValueValue(cell), 0,
+            m_out.logicalNot(isArrayType(cell, m_node->arrayMode())));
+    }
+
+    void compileGetTypedArrayByteOffset()
+    {
+        LValue basePtr = lowCell(m_node->child1());    
+
+        LBasicBlock simpleCase = m_out.newBlock();
+        LBasicBlock wastefulCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LValue mode = m_out.load32(basePtr, m_heaps.JSArrayBufferView_mode);
+        m_out.branch(
+            m_out.notEqual(mode, m_out.constInt32(WastefulTypedArray)),
+            unsure(simpleCase), unsure(wastefulCase));
+
+        LBasicBlock lastNext = m_out.appendTo(simpleCase, wastefulCase);
+
+        ValueFromBlock simpleOut = m_out.anchor(m_out.constIntPtr(0));
+
+        m_out.jump(continuation);
+
+        m_out.appendTo(wastefulCase, continuation);
+
+        LValue vectorPtr = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector);
+        LValue butterflyPtr = m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly);
+        LValue arrayBufferPtr = m_out.loadPtr(butterflyPtr, m_heaps.Butterfly_arrayBuffer);
+        LValue dataPtr = m_out.loadPtr(arrayBufferPtr, m_heaps.ArrayBuffer_data);
+
+        ValueFromBlock wastefulOut = m_out.anchor(m_out.sub(vectorPtr, dataPtr));
+
+        m_out.jump(continuation);
+        m_out.appendTo(continuation, lastNext);
+
+        setInt32(m_out.castToInt32(m_out.phi(pointerType(), simpleOut, wastefulOut)));
+    }
+    
+    void compileGetArrayLength()
+    {
+        switch (m_node->arrayMode().type()) {
+        case Array::Undecided:
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous: {
+            setInt32(m_out.load32NonNegative(lowStorage(m_node->child2()), m_heaps.Butterfly_publicLength));
+            return;
+        }
+            
+        case Array::String: {
+            LValue string = lowCell(m_node->child1());
+            setInt32(m_out.load32NonNegative(string, m_heaps.JSString_length));
+            return;
+        }
+            
+        case Array::DirectArguments: {
+            LValue arguments = lowCell(m_node->child1());
+            speculate(
+                ExoticObjectMode, noValue(), nullptr,
+                m_out.notNull(m_out.loadPtr(arguments, m_heaps.DirectArguments_overrides)));
+            setInt32(m_out.load32NonNegative(arguments, m_heaps.DirectArguments_length));
+            return;
+        }
+            
+        case Array::ScopedArguments: {
+            LValue arguments = lowCell(m_node->child1());
+            speculate(
+                ExoticObjectMode, noValue(), nullptr,
+                m_out.notZero32(m_out.load8ZeroExt32(arguments, m_heaps.ScopedArguments_overrodeThings)));
+            setInt32(m_out.load32NonNegative(arguments, m_heaps.ScopedArguments_totalLength));
+            return;
+        }
+            
+        default:
+            if (m_node->arrayMode().isSomeTypedArrayView()) {
+                setInt32(
+                    m_out.load32NonNegative(lowCell(m_node->child1()), m_heaps.JSArrayBufferView_length));
+                return;
+            }
+            
+            DFG_CRASH(m_graph, m_node, "Bad array type");
+            return;
+        }
+    }
+    
+    void compileCheckInBounds()
+    {
+        speculate(
+            OutOfBounds, noValue(), 0,
+            m_out.aboveOrEqual(lowInt32(m_node->child1()), lowInt32(m_node->child2())));
+    }
+    
+    void compileGetByVal()
+    {
+        switch (m_node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Contiguous: {
+            LValue index = lowInt32(m_node->child2());
+            LValue storage = lowStorage(m_node->child3());
+            
+            IndexedAbstractHeap& heap = m_node->arrayMode().type() == Array::Int32 ?
+                m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties;
+            
+            if (m_node->arrayMode().isInBounds()) {
+                LValue result = m_out.load64(baseIndex(heap, storage, index, m_node->child2()));
+                LValue isHole = m_out.isZero64(result);
+                if (m_node->arrayMode().isSaneChain()) {
+                    DFG_ASSERT(
+                        m_graph, m_node, m_node->arrayMode().type() == Array::Contiguous);
+                    result = m_out.select(
+                        isHole, m_out.constInt64(JSValue::encode(jsUndefined())), result);
+                } else
+                    speculate(LoadFromHole, noValue(), 0, isHole);
+                setJSValue(result);
+                return;
+            }
+            
+            LValue base = lowCell(m_node->child1());
+            
+            LBasicBlock fastCase = m_out.newBlock();
+            LBasicBlock slowCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            m_out.branch(
+                m_out.aboveOrEqual(
+                    index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
+                rarely(slowCase), usually(fastCase));
+            
+            LBasicBlock lastNext = m_out.appendTo(fastCase, slowCase);
+
+            LValue fastResultValue = m_out.load64(baseIndex(heap, storage, index, m_node->child2()));
+            ValueFromBlock fastResult = m_out.anchor(fastResultValue);
+            m_out.branch(
+                m_out.isZero64(fastResultValue), rarely(slowCase), usually(continuation));
+            
+            m_out.appendTo(slowCase, continuation);
+            ValueFromBlock slowResult = m_out.anchor(
+                vmCall(Int64, m_out.operation(operationGetByValArrayInt), m_callFrame, base, index));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, fastResult, slowResult));
+            return;
+        }
+            
+        case Array::Double: {
+            LValue index = lowInt32(m_node->child2());
+            LValue storage = lowStorage(m_node->child3());
+            
+            IndexedAbstractHeap& heap = m_heaps.indexedDoubleProperties;
+            
+            if (m_node->arrayMode().isInBounds()) {
+                LValue result = m_out.loadDouble(
+                    baseIndex(heap, storage, index, m_node->child2()));
+                
+                if (!m_node->arrayMode().isSaneChain()) {
+                    speculate(
+                        LoadFromHole, noValue(), 0,
+                        m_out.doubleNotEqualOrUnordered(result, result));
+                }
+                setDouble(result);
+                break;
+            }
+            
+            LValue base = lowCell(m_node->child1());
+            
+            LBasicBlock inBounds = m_out.newBlock();
+            LBasicBlock boxPath = m_out.newBlock();
+            LBasicBlock slowCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            m_out.branch(
+                m_out.aboveOrEqual(
+                    index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
+                rarely(slowCase), usually(inBounds));
+            
+            LBasicBlock lastNext = m_out.appendTo(inBounds, boxPath);
+            LValue doubleValue = m_out.loadDouble(
+                baseIndex(heap, storage, index, m_node->child2()));
+            m_out.branch(
+                m_out.doubleNotEqualOrUnordered(doubleValue, doubleValue),
+                rarely(slowCase), usually(boxPath));
+            
+            m_out.appendTo(boxPath, slowCase);
+            ValueFromBlock fastResult = m_out.anchor(boxDouble(doubleValue));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(slowCase, continuation);
+            ValueFromBlock slowResult = m_out.anchor(
+                vmCall(Int64, m_out.operation(operationGetByValArrayInt), m_callFrame, base, index));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, fastResult, slowResult));
+            return;
+        }
+
+        case Array::Undecided: {
+            LValue index = lowInt32(m_node->child2());
+
+            speculate(OutOfBounds, noValue(), m_node, m_out.lessThan(index, m_out.int32Zero));
+            setJSValue(m_out.constInt64(ValueUndefined));
+            return;
+        }
+            
+        case Array::DirectArguments: {
+            LValue base = lowCell(m_node->child1());
+            LValue index = lowInt32(m_node->child2());
+            
+            speculate(
+                ExoticObjectMode, noValue(), nullptr,
+                m_out.notNull(m_out.loadPtr(base, m_heaps.DirectArguments_overrides)));
+            speculate(
+                ExoticObjectMode, noValue(), nullptr,
+                m_out.aboveOrEqual(
+                    index,
+                    m_out.load32NonNegative(base, m_heaps.DirectArguments_length)));
+
+            TypedPointer address = m_out.baseIndex(
+                m_heaps.DirectArguments_storage, base, m_out.zeroExtPtr(index));
+            setJSValue(m_out.load64(address));
+            return;
+        }
+            
+        case Array::ScopedArguments: {
+            LValue base = lowCell(m_node->child1());
+            LValue index = lowInt32(m_node->child2());
+            
+            speculate(
+                ExoticObjectMode, noValue(), nullptr,
+                m_out.aboveOrEqual(
+                    index,
+                    m_out.load32NonNegative(base, m_heaps.ScopedArguments_totalLength)));
+            
+            LValue table = m_out.loadPtr(base, m_heaps.ScopedArguments_table);
+            LValue namedLength = m_out.load32(table, m_heaps.ScopedArgumentsTable_length);
+            
+            LBasicBlock namedCase = m_out.newBlock();
+            LBasicBlock overflowCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            m_out.branch(
+                m_out.aboveOrEqual(index, namedLength), unsure(overflowCase), unsure(namedCase));
+            
+            LBasicBlock lastNext = m_out.appendTo(namedCase, overflowCase);
+            
+            LValue scope = m_out.loadPtr(base, m_heaps.ScopedArguments_scope);
+            LValue arguments = m_out.loadPtr(table, m_heaps.ScopedArgumentsTable_arguments);
+            
+            TypedPointer address = m_out.baseIndex(
+                m_heaps.scopedArgumentsTableArguments, arguments, m_out.zeroExtPtr(index));
+            LValue scopeOffset = m_out.load32(address);
+            
+            speculate(
+                ExoticObjectMode, noValue(), nullptr,
+                m_out.equal(scopeOffset, m_out.constInt32(ScopeOffset::invalidOffset)));
+            
+            address = m_out.baseIndex(
+                m_heaps.JSEnvironmentRecord_variables, scope, m_out.zeroExtPtr(scopeOffset));
+            ValueFromBlock namedResult = m_out.anchor(m_out.load64(address));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(overflowCase, continuation);
+            
+            address = m_out.baseIndex(
+                m_heaps.ScopedArguments_overflowStorage, base,
+                m_out.zeroExtPtr(m_out.sub(index, namedLength)));
+            LValue overflowValue = m_out.load64(address);
+            speculate(ExoticObjectMode, noValue(), nullptr, m_out.isZero64(overflowValue));
+            ValueFromBlock overflowResult = m_out.anchor(overflowValue);
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, namedResult, overflowResult));
+            return;
+        }
+            
+        case Array::Generic: {
+            setJSValue(vmCall(
+                Int64, m_out.operation(operationGetByVal), m_callFrame,
+                lowJSValue(m_node->child1()), lowJSValue(m_node->child2())));
+            return;
+        }
+            
+        case Array::String: {
+            compileStringCharAt();
+            return;
+        }
+            
+        default: {
+            LValue index = lowInt32(m_node->child2());
+            LValue storage = lowStorage(m_node->child3());
+            
+            TypedArrayType type = m_node->arrayMode().typedArrayType();
+            
+            if (isTypedView(type)) {
+                TypedPointer pointer = TypedPointer(
+                    m_heaps.typedArrayProperties,
+                    m_out.add(
+                        storage,
+                        m_out.shl(
+                            m_out.zeroExtPtr(index),
+                            m_out.constIntPtr(logElementSize(type)))));
+                
+                if (isInt(type)) {
+                    LValue result;
+                    switch (elementSize(type)) {
+                    case 1:
+                        result = isSigned(type) ? m_out.load8SignExt32(pointer) :  m_out.load8ZeroExt32(pointer);
+                        break;
+                    case 2:
+                        result = isSigned(type) ? m_out.load16SignExt32(pointer) :  m_out.load16ZeroExt32(pointer);
+                        break;
+                    case 4:
+                        result = m_out.load32(pointer);
+                        break;
+                    default:
+                        DFG_CRASH(m_graph, m_node, "Bad element size");
+                    }
+                    
+                    if (elementSize(type) < 4 || isSigned(type)) {
+                        setInt32(result);
+                        return;
+                    }
+
+                    if (m_node->shouldSpeculateInt32()) {
+                        speculate(
+                            Overflow, noValue(), 0, m_out.lessThan(result, m_out.int32Zero));
+                        setInt32(result);
+                        return;
+                    }
+                    
+                    if (m_node->shouldSpeculateAnyInt()) {
+                        setStrictInt52(m_out.zeroExt(result, Int64));
+                        return;
+                    }
+                    
+                    setDouble(m_out.unsignedToDouble(result));
+                    return;
+                }
+            
+                ASSERT(isFloat(type));
+                
+                LValue result;
+                switch (type) {
+                case TypeFloat32:
+                    result = m_out.floatToDouble(m_out.loadFloat(pointer));
+                    break;
+                case TypeFloat64:
+                    result = m_out.loadDouble(pointer);
+                    break;
+                default:
+                    DFG_CRASH(m_graph, m_node, "Bad typed array type");
+                }
+                
+                setDouble(result);
+                return;
+            }
+            
+            DFG_CRASH(m_graph, m_node, "Bad array type");
+            return;
+        } }
+    }
+    
+    void compileGetMyArgumentByVal()
+    {
+        InlineCallFrame* inlineCallFrame = m_node->child1()->origin.semantic.inlineCallFrame;
+        
+        LValue index = lowInt32(m_node->child2());
+        if (m_node->numberOfArgumentsToSkip())
+            index = m_out.add(index, m_out.constInt32(m_node->numberOfArgumentsToSkip()));
+        
+        LValue limit;
+        if (inlineCallFrame && !inlineCallFrame->isVarargs())
+            limit = m_out.constInt32(inlineCallFrame->arguments.size() - 1);
+        else {
+            VirtualRegister argumentCountRegister = AssemblyHelpers::argumentCount(inlineCallFrame);
+            limit = m_out.sub(m_out.load32(payloadFor(argumentCountRegister)), m_out.int32One);
+        }
+        
+        LValue isOutOfBounds = m_out.aboveOrEqual(index, limit);
+        LBasicBlock continuation = nullptr;
+        LBasicBlock lastNext = nullptr;
+        ValueFromBlock slowResult;
+        if (m_node->op() == GetMyArgumentByValOutOfBounds) {
+            LBasicBlock normalCase = m_out.newBlock();
+            continuation = m_out.newBlock();
+            
+            slowResult = m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined())));
+            m_out.branch(isOutOfBounds, unsure(continuation), unsure(normalCase));
+            
+            lastNext = m_out.appendTo(normalCase, continuation);
+        } else
+            speculate(ExoticObjectMode, noValue(), 0, isOutOfBounds);
+        
+        TypedPointer base;
+        if (inlineCallFrame) {
+            if (inlineCallFrame->arguments.size() > 1)
+                base = addressFor(inlineCallFrame->arguments[1].virtualRegister());
+        } else
+            base = addressFor(virtualRegisterForArgument(1));
+        
+        LValue result;
+        if (base) {
+            LValue pointer = m_out.baseIndex(
+                base.value(), m_out.zeroExt(index, pointerType()), ScaleEight);
+            result = m_out.load64(TypedPointer(m_heaps.variables.atAnyIndex(), pointer));
+        } else
+            result = m_out.constInt64(JSValue::encode(jsUndefined()));
+        
+        if (m_node->op() == GetMyArgumentByValOutOfBounds) {
+            ValueFromBlock normalResult = m_out.anchor(result);
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            result = m_out.phi(Int64, slowResult, normalResult);
+        }
+        
+        setJSValue(result);
+    }
+    
+    void compilePutByVal()
+    {
+        Edge child1 = m_graph.varArgChild(m_node, 0);
+        Edge child2 = m_graph.varArgChild(m_node, 1);
+        Edge child3 = m_graph.varArgChild(m_node, 2);
+        Edge child4 = m_graph.varArgChild(m_node, 3);
+        Edge child5 = m_graph.varArgChild(m_node, 4);
+        
+        switch (m_node->arrayMode().type()) {
+        case Array::Generic: {
+            V_JITOperation_EJJJ operation;
+            if (m_node->op() == PutByValDirect) {
+                if (m_graph.isStrictModeFor(m_node->origin.semantic))
+                    operation = operationPutByValDirectStrict;
+                else
+                    operation = operationPutByValDirectNonStrict;
+            } else {
+                if (m_graph.isStrictModeFor(m_node->origin.semantic))
+                    operation = operationPutByValStrict;
+                else
+                    operation = operationPutByValNonStrict;
+            }
+                
+            vmCall(
+                Void, m_out.operation(operation), m_callFrame,
+                lowJSValue(child1), lowJSValue(child2), lowJSValue(child3));
+            return;
+        }
+            
+        default:
+            break;
+        }
+
+        LValue base = lowCell(child1);
+        LValue index = lowInt32(child2);
+        LValue storage = lowStorage(child4);
+        
+        switch (m_node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous: {
+            LBasicBlock continuation = m_out.newBlock();
+            LBasicBlock outerLastNext = m_out.appendTo(m_out.m_block, continuation);
+            
+            switch (m_node->arrayMode().type()) {
+            case Array::Int32:
+            case Array::Contiguous: {
+                LValue value = lowJSValue(child3, ManualOperandSpeculation);
+                
+                if (m_node->arrayMode().type() == Array::Int32)
+                    FTL_TYPE_CHECK(jsValueValue(value), child3, SpecInt32Only, isNotInt32(value));
+                
+                TypedPointer elementPointer = m_out.baseIndex(
+                    m_node->arrayMode().type() == Array::Int32 ?
+                    m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties,
+                    storage, m_out.zeroExtPtr(index), provenValue(child2));
+                
+                if (m_node->op() == PutByValAlias) {
+                    m_out.store64(value, elementPointer);
+                    break;
+                }
+                
+                contiguousPutByValOutOfBounds(
+                    codeBlock()->isStrictMode()
+                    ? operationPutByValBeyondArrayBoundsStrict
+                    : operationPutByValBeyondArrayBoundsNonStrict,
+                    base, storage, index, value, continuation);
+                
+                m_out.store64(value, elementPointer);
+                break;
+            }
+                
+            case Array::Double: {
+                LValue value = lowDouble(child3);
+                
+                FTL_TYPE_CHECK(
+                    doubleValue(value), child3, SpecDoubleReal,
+                    m_out.doubleNotEqualOrUnordered(value, value));
+                
+                TypedPointer elementPointer = m_out.baseIndex(
+                    m_heaps.indexedDoubleProperties, storage, m_out.zeroExtPtr(index),
+                    provenValue(child2));
+                
+                if (m_node->op() == PutByValAlias) {
+                    m_out.storeDouble(value, elementPointer);
+                    break;
+                }
+                
+                contiguousPutByValOutOfBounds(
+                    codeBlock()->isStrictMode()
+                    ? operationPutDoubleByValBeyondArrayBoundsStrict
+                    : operationPutDoubleByValBeyondArrayBoundsNonStrict,
+                    base, storage, index, value, continuation);
+                
+                m_out.storeDouble(value, elementPointer);
+                break;
+            }
+                
+            default:
+                DFG_CRASH(m_graph, m_node, "Bad array type");
+            }
+
+            m_out.jump(continuation);
+            m_out.appendTo(continuation, outerLastNext);
+            return;
+        }
+            
+        default:
+            TypedArrayType type = m_node->arrayMode().typedArrayType();
+            
+            if (isTypedView(type)) {
+                TypedPointer pointer = TypedPointer(
+                    m_heaps.typedArrayProperties,
+                    m_out.add(
+                        storage,
+                        m_out.shl(
+                            m_out.zeroExt(index, pointerType()),
+                            m_out.constIntPtr(logElementSize(type)))));
+                
+                Output::StoreType storeType;
+                LValue valueToStore;
+                
+                if (isInt(type)) {
+                    LValue intValue;
+                    switch (child3.useKind()) {
+                    case Int52RepUse:
+                    case Int32Use: {
+                        if (child3.useKind() == Int32Use)
+                            intValue = lowInt32(child3);
+                        else
+                            intValue = m_out.castToInt32(lowStrictInt52(child3));
+
+                        if (isClamped(type)) {
+                            ASSERT(elementSize(type) == 1);
+                            
+                            LBasicBlock atLeastZero = m_out.newBlock();
+                            LBasicBlock continuation = m_out.newBlock();
+                            
+                            Vector<ValueFromBlock, 2> intValues;
+                            intValues.append(m_out.anchor(m_out.int32Zero));
+                            m_out.branch(
+                                m_out.lessThan(intValue, m_out.int32Zero),
+                                unsure(continuation), unsure(atLeastZero));
+                            
+                            LBasicBlock lastNext = m_out.appendTo(atLeastZero, continuation);
+                            
+                            intValues.append(m_out.anchor(m_out.select(
+                                m_out.greaterThan(intValue, m_out.constInt32(255)),
+                                m_out.constInt32(255),
+                                intValue)));
+                            m_out.jump(continuation);
+                            
+                            m_out.appendTo(continuation, lastNext);
+                            intValue = m_out.phi(Int32, intValues);
+                        }
+                        break;
+                    }
+                        
+                    case DoubleRepUse: {
+                        LValue doubleValue = lowDouble(child3);
+                        
+                        if (isClamped(type)) {
+                            ASSERT(elementSize(type) == 1);
+                            
+                            LBasicBlock atLeastZero = m_out.newBlock();
+                            LBasicBlock withinRange = m_out.newBlock();
+                            LBasicBlock continuation = m_out.newBlock();
+                            
+                            Vector<ValueFromBlock, 3> intValues;
+                            intValues.append(m_out.anchor(m_out.int32Zero));
+                            m_out.branch(
+                                m_out.doubleLessThanOrUnordered(doubleValue, m_out.doubleZero),
+                                unsure(continuation), unsure(atLeastZero));
+                            
+                            LBasicBlock lastNext = m_out.appendTo(atLeastZero, withinRange);
+                            intValues.append(m_out.anchor(m_out.constInt32(255)));
+                            m_out.branch(
+                                m_out.doubleGreaterThan(doubleValue, m_out.constDouble(255)),
+                                unsure(continuation), unsure(withinRange));
+                            
+                            m_out.appendTo(withinRange, continuation);
+                            intValues.append(m_out.anchor(m_out.doubleToInt(doubleValue)));
+                            m_out.jump(continuation);
+                            
+                            m_out.appendTo(continuation, lastNext);
+                            intValue = m_out.phi(Int32, intValues);
+                        } else
+                            intValue = doubleToInt32(doubleValue);
+                        break;
+                    }
+                        
+                    default:
+                        DFG_CRASH(m_graph, m_node, "Bad use kind");
+                    }
+
+                    valueToStore = intValue;
+                    switch (elementSize(type)) {
+                    case 1:
+                        storeType = Output::Store32As8;
+                        break;
+                    case 2:
+                        storeType = Output::Store32As16;
+                        break;
+                    case 4:
+                        storeType = Output::Store32;
+                        break;
+                    default:
+                        DFG_CRASH(m_graph, m_node, "Bad element size");
+                    }
+                } else /* !isInt(type) */ {
+                    LValue value = lowDouble(child3);
+                    switch (type) {
+                    case TypeFloat32:
+                        valueToStore = m_out.doubleToFloat(value);
+                        storeType = Output::StoreFloat;
+                        break;
+                    case TypeFloat64:
+                        valueToStore = value;
+                        storeType = Output::StoreDouble;
+                        break;
+                    default:
+                        DFG_CRASH(m_graph, m_node, "Bad typed array type");
+                    }
+                }
+
+                if (m_node->arrayMode().isInBounds() || m_node->op() == PutByValAlias)
+                    m_out.store(valueToStore, pointer, storeType);
+                else {
+                    LBasicBlock isInBounds = m_out.newBlock();
+                    LBasicBlock isOutOfBounds = m_out.newBlock();
+                    LBasicBlock continuation = m_out.newBlock();
+                    
+                    m_out.branch(
+                        m_out.aboveOrEqual(index, lowInt32(child5)),
+                        unsure(isOutOfBounds), unsure(isInBounds));
+                    
+                    LBasicBlock lastNext = m_out.appendTo(isInBounds, isOutOfBounds);
+                    m_out.store(valueToStore, pointer, storeType);
+                    m_out.jump(continuation);
+
+                    m_out.appendTo(isOutOfBounds, continuation);
+                    speculateTypedArrayIsNotNeutered(base);
+                    m_out.jump(continuation);
+                    
+                    m_out.appendTo(continuation, lastNext);
+                }
+                
+                return;
+            }
+
+            DFG_CRASH(m_graph, m_node, "Bad array type");
+            break;
+        }
+    }
+
+    void compilePutAccessorById()
+    {
+        LValue base = lowCell(m_node->child1());
+        LValue accessor = lowCell(m_node->child2());
+        auto uid = m_graph.identifiers()[m_node->identifierNumber()];
+        vmCall(
+            Void,
+            m_out.operation(m_node->op() == PutGetterById ? operationPutGetterById : operationPutSetterById),
+            m_callFrame, base, m_out.constIntPtr(uid), m_out.constInt32(m_node->accessorAttributes()), accessor);
+    }
+
+    void compilePutGetterSetterById()
+    {
+        LValue base = lowCell(m_node->child1());
+        LValue getter = lowJSValue(m_node->child2());
+        LValue setter = lowJSValue(m_node->child3());
+        auto uid = m_graph.identifiers()[m_node->identifierNumber()];
+        vmCall(
+            Void, m_out.operation(operationPutGetterSetter),
+            m_callFrame, base, m_out.constIntPtr(uid), m_out.constInt32(m_node->accessorAttributes()), getter, setter);
+
+    }
+
+    void compilePutAccessorByVal()
+    {
+        LValue base = lowCell(m_node->child1());
+        LValue subscript = lowJSValue(m_node->child2());
+        LValue accessor = lowCell(m_node->child3());
+        vmCall(
+            Void,
+            m_out.operation(m_node->op() == PutGetterByVal ? operationPutGetterByVal : operationPutSetterByVal),
+            m_callFrame, base, subscript, m_out.constInt32(m_node->accessorAttributes()), accessor);
+    }
+    
+    void compileArrayPush()
+    {
+        LValue base = lowCell(m_node->child1());
+        LValue storage = lowStorage(m_node->child3());
+        
+        switch (m_node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Contiguous:
+        case Array::Double: {
+            LValue value;
+            Output::StoreType storeType;
+            
+            if (m_node->arrayMode().type() != Array::Double) {
+                value = lowJSValue(m_node->child2(), ManualOperandSpeculation);
+                if (m_node->arrayMode().type() == Array::Int32) {
+                    FTL_TYPE_CHECK(
+                        jsValueValue(value), m_node->child2(), SpecInt32Only, isNotInt32(value));
+                }
+                storeType = Output::Store64;
+            } else {
+                value = lowDouble(m_node->child2());
+                FTL_TYPE_CHECK(
+                    doubleValue(value), m_node->child2(), SpecDoubleReal,
+                    m_out.doubleNotEqualOrUnordered(value, value));
+                storeType = Output::StoreDouble;
+            }
+            
+            IndexedAbstractHeap& heap = m_heaps.forArrayType(m_node->arrayMode().type());
+
+            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
+            
+            LBasicBlock fastPath = m_out.newBlock();
+            LBasicBlock slowPath = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            m_out.branch(
+                m_out.aboveOrEqual(
+                    prevLength, m_out.load32(storage, m_heaps.Butterfly_vectorLength)),
+                unsure(slowPath), unsure(fastPath));
+            
+            LBasicBlock lastNext = m_out.appendTo(fastPath, slowPath);
+            m_out.store(
+                value, m_out.baseIndex(heap, storage, m_out.zeroExtPtr(prevLength)), storeType);
+            LValue newLength = m_out.add(prevLength, m_out.int32One);
+            m_out.store32(newLength, storage, m_heaps.Butterfly_publicLength);
+            
+            ValueFromBlock fastResult = m_out.anchor(boxInt32(newLength));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(slowPath, continuation);
+            LValue operation;
+            if (m_node->arrayMode().type() != Array::Double)
+                operation = m_out.operation(operationArrayPush);
+            else
+                operation = m_out.operation(operationArrayPushDouble);
+            ValueFromBlock slowResult = m_out.anchor(
+                vmCall(Int64, operation, m_callFrame, value, base));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, fastResult, slowResult));
+            return;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad array type");
+            return;
+        }
+    }
+
+    void compileArraySlice()
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+
+        LValue sourceStorage = lowStorage(m_node->numChildren() == 3 ? m_graph.varArgChild(m_node, 2) : m_graph.varArgChild(m_node, 3));
+        LValue inputLength = m_out.load32(sourceStorage, m_heaps.Butterfly_publicLength);
+
+        LValue endBoundary;
+        if (m_node->numChildren() == 3)
+            endBoundary = m_out.load32(sourceStorage, m_heaps.Butterfly_publicLength);
+        else {
+            endBoundary = lowInt32(m_graph.varArgChild(m_node, 2));
+            endBoundary = m_out.select(m_out.greaterThanOrEqual(endBoundary, m_out.constInt32(0)),
+                m_out.select(m_out.above(endBoundary, inputLength), inputLength, endBoundary),
+                m_out.select(m_out.lessThan(m_out.add(inputLength, endBoundary), m_out.constInt32(0)), m_out.constInt32(0), m_out.add(inputLength, endBoundary)));
+        }
+
+        LValue startIndex = lowInt32(m_graph.varArgChild(m_node, 1));
+        startIndex = m_out.select(m_out.greaterThanOrEqual(startIndex, m_out.constInt32(0)),
+            m_out.select(m_out.above(startIndex, inputLength), inputLength, startIndex),
+            m_out.select(m_out.lessThan(m_out.add(inputLength, startIndex), m_out.constInt32(0)), m_out.constInt32(0), m_out.add(inputLength, startIndex)));
+
+        LValue resultLength = m_out.select(m_out.below(startIndex, endBoundary),
+            m_out.sub(endBoundary, startIndex),
+            m_out.constInt32(0));
+
+        ArrayValues arrayResult;
+        {
+            LValue indexingType = m_out.load8ZeroExt32(lowCell(m_graph.varArgChild(m_node, 0)), m_heaps.JSCell_indexingTypeAndMisc);
+            indexingType = m_out.bitAnd(indexingType, m_out.constInt32(AllArrayTypesAndHistory));
+            // When we emit an ArraySlice, we dominate the use of the array by a CheckStructure
+            // to ensure the incoming array is one to be one of the original array structures
+            // with one of the following indexing shapes: Int32, Contiguous, Double.
+            LValue structure = m_out.select(
+                m_out.equal(indexingType, m_out.constInt32(ArrayWithInt32)),
+                weakStructure(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithInt32))),
+                m_out.select(m_out.equal(indexingType, m_out.constInt32(ArrayWithContiguous)),
+                    weakStructure(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous))),
+                    weakStructure(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithDouble)))));
+            arrayResult = allocateJSArray(resultLength, structure, indexingType, false, false);
+        }
+
+        LBasicBlock loop = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        resultLength = m_out.zeroExtPtr(resultLength);
+        ValueFromBlock startLoadIndex = m_out.anchor(m_out.zeroExtPtr(startIndex));
+        ValueFromBlock startStoreIndex = m_out.anchor(m_out.constIntPtr(0));
+
+        m_out.branch(
+            m_out.below(m_out.constIntPtr(0), resultLength), unsure(loop), unsure(continuation));
+
+        LBasicBlock lastNext = m_out.appendTo(loop, continuation);
+        LValue storeIndex = m_out.phi(pointerType(), startStoreIndex);
+        LValue loadIndex = m_out.phi(pointerType(), startLoadIndex);
+        LValue value = m_out.load64(m_out.baseIndex(m_heaps.root, sourceStorage, loadIndex, ScaleEight));
+        m_out.store64(value, m_out.baseIndex(m_heaps.root, arrayResult.butterfly, storeIndex, ScaleEight));
+        LValue nextStoreIndex = m_out.add(storeIndex, m_out.constIntPtr(1));
+        m_out.addIncomingToPhi(storeIndex, m_out.anchor(nextStoreIndex));
+        m_out.addIncomingToPhi(loadIndex, m_out.anchor(m_out.add(loadIndex, m_out.constIntPtr(1))));
+        m_out.branch(
+            m_out.below(nextStoreIndex, resultLength), unsure(loop), unsure(continuation));
+
+        m_out.appendTo(continuation, lastNext);
+
+        mutatorFence();
+        setJSValue(arrayResult.array);
+    }
+    
+    void compileArrayPop()
+    {
+        LValue base = lowCell(m_node->child1());
+        LValue storage = lowStorage(m_node->child2());
+        
+        switch (m_node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous: {
+            IndexedAbstractHeap& heap = m_heaps.forArrayType(m_node->arrayMode().type());
+            
+            LBasicBlock fastCase = m_out.newBlock();
+            LBasicBlock slowCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
+            
+            Vector<ValueFromBlock, 3> results;
+            results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined()))));
+            m_out.branch(
+                m_out.isZero32(prevLength), rarely(continuation), usually(fastCase));
+            
+            LBasicBlock lastNext = m_out.appendTo(fastCase, slowCase);
+            LValue newLength = m_out.sub(prevLength, m_out.int32One);
+            m_out.store32(newLength, storage, m_heaps.Butterfly_publicLength);
+            TypedPointer pointer = m_out.baseIndex(heap, storage, m_out.zeroExtPtr(newLength));
+            if (m_node->arrayMode().type() != Array::Double) {
+                LValue result = m_out.load64(pointer);
+                m_out.store64(m_out.int64Zero, pointer);
+                results.append(m_out.anchor(result));
+                m_out.branch(
+                    m_out.notZero64(result), usually(continuation), rarely(slowCase));
+            } else {
+                LValue result = m_out.loadDouble(pointer);
+                m_out.store64(m_out.constInt64(bitwise_cast<int64_t>(PNaN)), pointer);
+                results.append(m_out.anchor(boxDouble(result)));
+                m_out.branch(
+                    m_out.doubleEqual(result, result),
+                    usually(continuation), rarely(slowCase));
+            }
+            
+            m_out.appendTo(slowCase, continuation);
+            results.append(m_out.anchor(vmCall(
+                Int64, m_out.operation(operationArrayPopAndRecoverLength), m_callFrame, base)));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, results));
+            return;
+        }
+
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad array type");
+            return;
+        }
+    }
+    
+    void compileCreateActivation()
+    {
+        LValue scope = lowCell(m_node->child1());
+        SymbolTable* table = m_node->castOperand<SymbolTable*>();
+        RegisteredStructure structure = m_graph.registerStructure(m_graph.globalObjectFor(m_node->origin.semantic)->activationStructure());
+        JSValue initializationValue = m_node->initializationValueForActivation();
+        ASSERT(initializationValue.isUndefined() || initializationValue == jsTDZValue());
+        if (table->singletonScope()->isStillValid()) {
+            LValue callResult = vmCall(
+                Int64,
+                m_out.operation(operationCreateActivationDirect), m_callFrame, weakStructure(structure),
+                scope, weakPointer(table), m_out.constInt64(JSValue::encode(initializationValue)));
+            setJSValue(callResult);
+            return;
+        }
+        
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+        
+        LValue fastObject = allocateObject<JSLexicalEnvironment>(
+            JSLexicalEnvironment::allocationSize(table), structure, m_out.intPtrZero, slowPath);
+        
+        // We don't need memory barriers since we just fast-created the activation, so the
+        // activation must be young.
+        m_out.storePtr(scope, fastObject, m_heaps.JSScope_next);
+        m_out.storePtr(weakPointer(table), fastObject, m_heaps.JSSymbolTableObject_symbolTable);
+        
+        for (unsigned i = 0; i < table->scopeSize(); ++i) {
+            m_out.store64(
+                m_out.constInt64(JSValue::encode(initializationValue)),
+                fastObject, m_heaps.JSEnvironmentRecord_variables[i]);
+        }
+        
+        mutatorFence();
+        
+        ValueFromBlock fastResult = m_out.anchor(fastObject);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+        LValue callResult = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationCreateActivationDirect, locations[0].directGPR(),
+                    CCallHelpers::TrustedImmPtr(structure.get()), locations[1].directGPR(),
+                    CCallHelpers::TrustedImmPtr(table),
+                    CCallHelpers::TrustedImm64(JSValue::encode(initializationValue)));
+            },
+            scope);
+        ValueFromBlock slowResult = m_out.anchor(callResult);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(pointerType(), fastResult, slowResult));
+    }
+    
+    void compileNewFunction()
+    {
+        ASSERT(m_node->op() == NewFunction || m_node->op() == NewGeneratorFunction || m_node->op() == NewAsyncFunction);
+        bool isGeneratorFunction = m_node->op() == NewGeneratorFunction;
+        bool isAsyncFunction = m_node->op() == NewAsyncFunction;
+        
+        LValue scope = lowCell(m_node->child1());
+        
+        FunctionExecutable* executable = m_node->castOperand<FunctionExecutable*>();
+        if (executable->singletonFunction()->isStillValid()) {
+            LValue callResult =
+                isGeneratorFunction ? vmCall(Int64, m_out.operation(operationNewGeneratorFunction), m_callFrame, scope, weakPointer(executable)) :
+                isAsyncFunction ? vmCall(Int64, m_out.operation(operationNewAsyncFunction), m_callFrame, scope, weakPointer(executable)) :
+                vmCall(Int64, m_out.operation(operationNewFunction), m_callFrame, scope, weakPointer(executable));
+            setJSValue(callResult);
+            return;
+        }
+        
+        RegisteredStructure structure = m_graph.registerStructure(
+            isGeneratorFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->generatorFunctionStructure() :
+            isAsyncFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->asyncFunctionStructure() :
+            m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure());
+        
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+        
+        LValue fastObject =
+            isGeneratorFunction ? allocateObject<JSGeneratorFunction>(structure, m_out.intPtrZero, slowPath) :
+            allocateObject<JSFunction>(structure, m_out.intPtrZero, slowPath);
+        
+        
+        // We don't need memory barriers since we just fast-created the function, so it
+        // must be young.
+        m_out.storePtr(scope, fastObject, m_heaps.JSFunction_scope);
+        m_out.storePtr(weakPointer(executable), fastObject, m_heaps.JSFunction_executable);
+        m_out.storePtr(m_out.intPtrZero, fastObject, m_heaps.JSFunction_rareData);
+        
+        mutatorFence();
+        
+        ValueFromBlock fastResult = m_out.anchor(fastObject);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+
+        Vector<LValue> slowPathArguments;
+        slowPathArguments.append(scope);
+        LValue callResult = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                if (isGeneratorFunction) {
+                    return createLazyCallGenerator(
+                        operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint,
+                        locations[0].directGPR(), locations[1].directGPR(),
+                        CCallHelpers::TrustedImmPtr(executable));
+                }
+                if (isAsyncFunction) {
+                    return createLazyCallGenerator(
+                        operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint,
+                        locations[0].directGPR(), locations[1].directGPR(),
+                        CCallHelpers::TrustedImmPtr(executable));
+                }
+                return createLazyCallGenerator(
+                    operationNewFunctionWithInvalidatedReallocationWatchpoint,
+                    locations[0].directGPR(), locations[1].directGPR(),
+                    CCallHelpers::TrustedImmPtr(executable));
+            },
+            slowPathArguments);
+        ValueFromBlock slowResult = m_out.anchor(callResult);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(pointerType(), fastResult, slowResult));
+    }
+    
+    void compileCreateDirectArguments()
+    {
+        // FIXME: A more effective way of dealing with the argument count and callee is to have
+        // them be explicit arguments to this node.
+        // https://bugs.webkit.org/show_bug.cgi?id=142207
+        
+        RegisteredStructure structure =
+            m_graph.registerStructure(m_graph.globalObjectFor(m_node->origin.semantic)->directArgumentsStructure());
+        
+        unsigned minCapacity = m_graph.baselineCodeBlockFor(m_node->origin.semantic)->numParameters() - 1;
+        
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+        
+        ArgumentsLength length = getArgumentsLength();
+        
+        LValue fastObject;
+        if (length.isKnown) {
+            fastObject = allocateObject<DirectArguments>(
+                DirectArguments::allocationSize(std::max(length.known, minCapacity)), structure,
+                m_out.intPtrZero, slowPath);
+        } else {
+            LValue size = m_out.add(
+                m_out.shl(length.value, m_out.constInt32(3)),
+                m_out.constInt32(DirectArguments::storageOffset()));
+            
+            size = m_out.select(
+                m_out.aboveOrEqual(length.value, m_out.constInt32(minCapacity)),
+                size, m_out.constInt32(DirectArguments::allocationSize(minCapacity)));
+            
+            fastObject = allocateVariableSizedObject<DirectArguments>(
+                m_out.zeroExtPtr(size), structure, m_out.intPtrZero, slowPath);
+        }
+        
+        m_out.store32(length.value, fastObject, m_heaps.DirectArguments_length);
+        m_out.store32(m_out.constInt32(minCapacity), fastObject, m_heaps.DirectArguments_minCapacity);
+        m_out.storePtr(m_out.intPtrZero, fastObject, m_heaps.DirectArguments_overrides);
+        
+        ValueFromBlock fastResult = m_out.anchor(fastObject);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+        LValue callResult = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationCreateDirectArguments, locations[0].directGPR(),
+                    CCallHelpers::TrustedImmPtr(structure.get()), locations[1].directGPR(),
+                    CCallHelpers::TrustedImm32(minCapacity));
+            }, length.value);
+        ValueFromBlock slowResult = m_out.anchor(callResult);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        LValue result = m_out.phi(pointerType(), fastResult, slowResult);
+
+        m_out.storePtr(getCurrentCallee(), result, m_heaps.DirectArguments_callee);
+        
+        if (length.isKnown) {
+            VirtualRegister start = AssemblyHelpers::argumentsStart(m_node->origin.semantic);
+            for (unsigned i = 0; i < std::max(length.known, minCapacity); ++i) {
+                m_out.store64(
+                    m_out.load64(addressFor(start + i)),
+                    result, m_heaps.DirectArguments_storage[i]);
+            }
+        } else {
+            LValue stackBase = getArgumentsStart();
+            
+            LBasicBlock loop = m_out.newBlock();
+            LBasicBlock end = m_out.newBlock();
+
+            ValueFromBlock originalLength;
+            if (minCapacity) {
+                LValue capacity = m_out.select(
+                    m_out.aboveOrEqual(length.value, m_out.constInt32(minCapacity)),
+                    length.value,
+                    m_out.constInt32(minCapacity));
+                LValue originalLengthValue = m_out.zeroExtPtr(capacity);
+                originalLength = m_out.anchor(originalLengthValue);
+                m_out.jump(loop);
+            } else {
+                LValue originalLengthValue = m_out.zeroExtPtr(length.value);
+                originalLength = m_out.anchor(originalLengthValue);
+                m_out.branch(m_out.isNull(originalLengthValue), unsure(end), unsure(loop));
+            }
+            
+            lastNext = m_out.appendTo(loop, end);
+            LValue previousIndex = m_out.phi(pointerType(), originalLength);
+            LValue index = m_out.sub(previousIndex, m_out.intPtrOne);
+            m_out.store64(
+                m_out.load64(m_out.baseIndex(m_heaps.variables, stackBase, index)),
+                m_out.baseIndex(m_heaps.DirectArguments_storage, result, index));
+            ValueFromBlock nextIndex = m_out.anchor(index);
+            m_out.addIncomingToPhi(previousIndex, nextIndex);
+            m_out.branch(m_out.isNull(index), unsure(end), unsure(loop));
+            
+            m_out.appendTo(end, lastNext);
+        }
+        
+        mutatorFence();
+        
+        setJSValue(result);
+    }
+    
+    void compileCreateScopedArguments()
+    {
+        LValue scope = lowCell(m_node->child1());
+        
+        LValue result = vmCall(
+            Int64, m_out.operation(operationCreateScopedArguments), m_callFrame,
+            weakPointer(
+                m_graph.globalObjectFor(m_node->origin.semantic)->scopedArgumentsStructure()),
+            getArgumentsStart(), getArgumentsLength().value, getCurrentCallee(), scope);
+        
+        setJSValue(result);
+    }
+    
+    void compileCreateClonedArguments()
+    {
+        LValue result = vmCall(
+            Int64, m_out.operation(operationCreateClonedArguments), m_callFrame,
+            weakPointer(
+                m_graph.globalObjectFor(m_node->origin.semantic)->clonedArgumentsStructure()),
+            getArgumentsStart(), getArgumentsLength().value, getCurrentCallee());
+        
+        setJSValue(result);
+    }
+
+    void compileCreateRest()
+    {
+        if (m_graph.isWatchingHavingABadTimeWatchpoint(m_node)) {
+            LBasicBlock continuation = m_out.newBlock();
+            LValue arrayLength = lowInt32(m_node->child1());
+            LBasicBlock loopStart = m_out.newBlock();
+            JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+            RegisteredStructure structure = m_graph.registerStructure(globalObject->restParameterStructure());
+            ArrayValues arrayValues = allocateUninitializedContiguousJSArray(arrayLength, structure);
+            LValue array = arrayValues.array;
+            LValue butterfly = arrayValues.butterfly;
+            ValueFromBlock startLength = m_out.anchor(arrayLength);
+            LValue argumentRegion = m_out.add(getArgumentsStart(), m_out.constInt64(sizeof(Register) * m_node->numberOfArgumentsToSkip()));
+            m_out.branch(m_out.equal(arrayLength, m_out.constInt32(0)),
+                unsure(continuation), unsure(loopStart));
+
+            LBasicBlock lastNext = m_out.appendTo(loopStart, continuation);
+            LValue phiOffset = m_out.phi(Int32, startLength);
+            LValue currentOffset = m_out.sub(phiOffset, m_out.int32One);
+            m_out.addIncomingToPhi(phiOffset, m_out.anchor(currentOffset));
+            LValue loadedValue = m_out.load64(m_out.baseIndex(m_heaps.variables, argumentRegion, m_out.zeroExtPtr(currentOffset)));
+            IndexedAbstractHeap& heap = m_heaps.indexedContiguousProperties;
+            m_out.store64(loadedValue, m_out.baseIndex(heap, butterfly, m_out.zeroExtPtr(currentOffset)));
+            m_out.branch(m_out.equal(currentOffset, m_out.constInt32(0)), unsure(continuation), unsure(loopStart));
+
+            m_out.appendTo(continuation, lastNext);
+            mutatorFence();
+            setJSValue(array);
+            return;
+        }
+
+        LValue arrayLength = lowInt32(m_node->child1());
+        LValue argumentStart = getArgumentsStart();
+        LValue numberOfArgumentsToSkip = m_out.constInt32(m_node->numberOfArgumentsToSkip());
+        setJSValue(vmCall(
+            Int64, m_out.operation(operationCreateRest), m_callFrame, argumentStart, numberOfArgumentsToSkip, arrayLength));
+    }
+
+    void compileGetRestLength()
+    {
+        LBasicBlock nonZeroLength = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        ValueFromBlock zeroLengthResult = m_out.anchor(m_out.constInt32(0));
+
+        LValue numberOfArgumentsToSkip = m_out.constInt32(m_node->numberOfArgumentsToSkip());
+        LValue argumentsLength = getArgumentsLength().value;
+        m_out.branch(m_out.above(argumentsLength, numberOfArgumentsToSkip),
+            unsure(nonZeroLength), unsure(continuation));
+        
+        LBasicBlock lastNext = m_out.appendTo(nonZeroLength, continuation);
+        ValueFromBlock nonZeroLengthResult = m_out.anchor(m_out.sub(argumentsLength, numberOfArgumentsToSkip));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setInt32(m_out.phi(Int32, zeroLengthResult, nonZeroLengthResult));
+    }
+    
+    void compileNewObject()
+    {
+        setJSValue(allocateObject(m_node->structure()));
+        mutatorFence();
+    }
+    
+    void compileNewArray()
+    {
+        // First speculate appropriately on all of the children. Do this unconditionally up here
+        // because some of the slow paths may otherwise forget to do it. It's sort of arguable
+        // that doing the speculations up here might be unprofitable for RA - so we can consider
+        // sinking this to below the allocation fast path if we find that this has a lot of
+        // register pressure.
+        for (unsigned operandIndex = 0; operandIndex < m_node->numChildren(); ++operandIndex)
+            speculate(m_graph.varArgChild(m_node, operandIndex));
+        
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        RegisteredStructure structure = m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(
+            m_node->indexingType()));
+
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
+            unsigned numElements = m_node->numChildren();
+            
+            ArrayValues arrayValues =
+                allocateUninitializedContiguousJSArray(m_out.constInt32(numElements), structure);
+            
+            for (unsigned operandIndex = 0; operandIndex < m_node->numChildren(); ++operandIndex) {
+                Edge edge = m_graph.varArgChild(m_node, operandIndex);
+                
+                switch (m_node->indexingType()) {
+                case ALL_BLANK_INDEXING_TYPES:
+                case ALL_UNDECIDED_INDEXING_TYPES:
+                    DFG_CRASH(m_graph, m_node, "Bad indexing type");
+                    break;
+                    
+                case ALL_DOUBLE_INDEXING_TYPES:
+                    m_out.storeDouble(
+                        lowDouble(edge),
+                        arrayValues.butterfly, m_heaps.indexedDoubleProperties[operandIndex]);
+                    break;
+                    
+                case ALL_INT32_INDEXING_TYPES:
+                case ALL_CONTIGUOUS_INDEXING_TYPES:
+                    m_out.store64(
+                        lowJSValue(edge, ManualOperandSpeculation),
+                        arrayValues.butterfly,
+                        m_heaps.forIndexingType(m_node->indexingType())->at(operandIndex));
+                    break;
+                    
+                default:
+                    DFG_CRASH(m_graph, m_node, "Corrupt indexing type");
+                    break;
+                }
+            }
+            
+            setJSValue(arrayValues.array);
+            mutatorFence();
+            return;
+        }
+        
+        if (!m_node->numChildren()) {
+            setJSValue(vmCall(
+                Int64, m_out.operation(operationNewEmptyArray), m_callFrame,
+                weakStructure(structure)));
+            return;
+        }
+        
+        size_t scratchSize = sizeof(EncodedJSValue) * m_node->numChildren();
+        ASSERT(scratchSize);
+        ScratchBuffer* scratchBuffer = vm().scratchBufferForSize(scratchSize);
+        EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
+        
+        for (unsigned operandIndex = 0; operandIndex < m_node->numChildren(); ++operandIndex) {
+            Edge edge = m_graph.varArgChild(m_node, operandIndex);
+            m_out.store64(
+                lowJSValue(edge, ManualOperandSpeculation),
+                m_out.absolute(buffer + operandIndex));
+        }
+        
+        m_out.storePtr(
+            m_out.constIntPtr(scratchSize), m_out.absolute(scratchBuffer->activeLengthPtr()));
+        
+        LValue result = vmCall(
+            Int64, m_out.operation(operationNewArray), m_callFrame,
+            weakStructure(structure), m_out.constIntPtr(buffer),
+            m_out.constIntPtr(m_node->numChildren()));
+        
+        m_out.storePtr(m_out.intPtrZero, m_out.absolute(scratchBuffer->activeLengthPtr()));
+        
+        setJSValue(result);
+    }
+
+    void compileNewArrayWithSpread()
+    {
+        if (m_graph.isWatchingHavingABadTimeWatchpoint(m_node)) {
+            unsigned startLength = 0;
+            BitVector* bitVector = m_node->bitVector();
+            HashMap<InlineCallFrame*, LValue, WTF::DefaultHash<InlineCallFrame*>::Hash, WTF::NullableHashTraits<InlineCallFrame*>> cachedSpreadLengths;
+
+            for (unsigned i = 0; i < m_node->numChildren(); ++i) {
+                if (!bitVector->get(i))
+                    ++startLength;
+            }
+
+            LValue length = m_out.constInt32(startLength);
+
+            for (unsigned i = 0; i < m_node->numChildren(); ++i) {
+                if (bitVector->get(i)) {
+                    Edge use = m_graph.varArgChild(m_node, i);
+                    if (use->op() == PhantomSpread) {
+                        RELEASE_ASSERT(use->child1()->op() == PhantomCreateRest);
+                        InlineCallFrame* inlineCallFrame = use->child1()->origin.semantic.inlineCallFrame;
+                        unsigned numberOfArgumentsToSkip = use->child1()->numberOfArgumentsToSkip();
+                        LValue spreadLength = cachedSpreadLengths.ensure(inlineCallFrame, [&] () {
+                            return getSpreadLengthFromInlineCallFrame(inlineCallFrame, numberOfArgumentsToSkip);
+                        }).iterator->value;
+                        length = m_out.add(length, spreadLength);
+                    } else {
+                        LValue fixedArray = lowCell(use);
+                        length = m_out.add(length, m_out.load32(fixedArray, m_heaps.JSFixedArray_size));
+                    }
+                }
+            }
+
+            RegisteredStructure structure = m_graph.registerStructure(m_graph.globalObjectFor(m_node->origin.semantic)->originalArrayStructureForIndexingType(ArrayWithContiguous));
+            ArrayValues arrayValues = allocateUninitializedContiguousJSArray(length, structure);
+            LValue result = arrayValues.array;
+            LValue storage = arrayValues.butterfly;
+            LValue index = m_out.constIntPtr(0);
+
+            for (unsigned i = 0; i < m_node->numChildren(); ++i) {
+                Edge use = m_graph.varArgChild(m_node, i);
+                if (bitVector->get(i)) {
+                    if (use->op() == PhantomSpread) {
+                        RELEASE_ASSERT(use->child1()->op() == PhantomCreateRest);
+                        InlineCallFrame* inlineCallFrame = use->child1()->origin.semantic.inlineCallFrame;
+                        unsigned numberOfArgumentsToSkip = use->child1()->numberOfArgumentsToSkip();
+
+                        LValue length = m_out.zeroExtPtr(cachedSpreadLengths.get(inlineCallFrame));
+                        LValue sourceStart = getArgumentsStart(inlineCallFrame, numberOfArgumentsToSkip);
+
+                        LBasicBlock loopStart = m_out.newBlock();
+                        LBasicBlock continuation = m_out.newBlock();
+
+                        ValueFromBlock loadIndexStart = m_out.anchor(m_out.constIntPtr(0));
+                        ValueFromBlock arrayIndexStart = m_out.anchor(index);
+                        ValueFromBlock arrayIndexStartForFinish = m_out.anchor(index);
+
+                        m_out.branch(
+                            m_out.isZero64(length),
+                            unsure(continuation), unsure(loopStart));
+
+                        LBasicBlock lastNext = m_out.appendTo(loopStart, continuation);
+
+                        LValue arrayIndex = m_out.phi(pointerType(), arrayIndexStart);
+                        LValue loadIndex = m_out.phi(pointerType(), loadIndexStart);
+
+                        LValue item = m_out.load64(m_out.baseIndex(m_heaps.variables, sourceStart, loadIndex));
+                        m_out.store64(item, m_out.baseIndex(m_heaps.indexedContiguousProperties, storage, arrayIndex));
+
+                        LValue nextArrayIndex = m_out.add(arrayIndex, m_out.constIntPtr(1));
+                        LValue nextLoadIndex = m_out.add(loadIndex, m_out.constIntPtr(1));
+                        ValueFromBlock arrayIndexLoopForFinish = m_out.anchor(nextArrayIndex);
+
+                        m_out.addIncomingToPhi(loadIndex, m_out.anchor(nextLoadIndex));
+                        m_out.addIncomingToPhi(arrayIndex, m_out.anchor(nextArrayIndex));
+
+                        m_out.branch(
+                            m_out.below(nextLoadIndex, length),
+                            unsure(loopStart), unsure(continuation));
+
+                        m_out.appendTo(continuation, lastNext);
+                        index = m_out.phi(pointerType(), arrayIndexStartForFinish, arrayIndexLoopForFinish);
+                    } else {
+                        LBasicBlock loopStart = m_out.newBlock();
+                        LBasicBlock continuation = m_out.newBlock();
+
+                        LValue fixedArray = lowCell(use);
+
+                        ValueFromBlock fixedIndexStart = m_out.anchor(m_out.constIntPtr(0));
+                        ValueFromBlock arrayIndexStart = m_out.anchor(index);
+                        ValueFromBlock arrayIndexStartForFinish = m_out.anchor(index);
+
+                        LValue fixedArraySize = m_out.zeroExtPtr(m_out.load32(fixedArray, m_heaps.JSFixedArray_size));
+
+                        m_out.branch(
+                            m_out.isZero64(fixedArraySize),
+                            unsure(continuation), unsure(loopStart));
+
+                        LBasicBlock lastNext = m_out.appendTo(loopStart, continuation);
+
+                        LValue arrayIndex = m_out.phi(pointerType(), arrayIndexStart);
+                        LValue fixedArrayIndex = m_out.phi(pointerType(), fixedIndexStart);
+
+                        LValue item = m_out.load64(m_out.baseIndex(m_heaps.JSFixedArray_buffer, fixedArray, fixedArrayIndex));
+                        m_out.store64(item, m_out.baseIndex(m_heaps.indexedContiguousProperties, storage, arrayIndex));
+
+                        LValue nextArrayIndex = m_out.add(arrayIndex, m_out.constIntPtr(1));
+                        LValue nextFixedArrayIndex = m_out.add(fixedArrayIndex, m_out.constIntPtr(1));
+                        ValueFromBlock arrayIndexLoopForFinish = m_out.anchor(nextArrayIndex);
+
+                        m_out.addIncomingToPhi(fixedArrayIndex, m_out.anchor(nextFixedArrayIndex));
+                        m_out.addIncomingToPhi(arrayIndex, m_out.anchor(nextArrayIndex));
+
+                        m_out.branch(
+                            m_out.below(nextFixedArrayIndex, fixedArraySize),
+                            unsure(loopStart), unsure(continuation));
+
+                        m_out.appendTo(continuation, lastNext);
+                        index = m_out.phi(pointerType(), arrayIndexStartForFinish, arrayIndexLoopForFinish);
+                    }
+                } else {
+                    IndexedAbstractHeap& heap = m_heaps.indexedContiguousProperties;
+                    LValue item = lowJSValue(use);
+                    m_out.store64(item, m_out.baseIndex(heap, storage, index));
+                    index = m_out.add(index, m_out.constIntPtr(1));
+                }
+            }
+
+            mutatorFence();
+            setJSValue(result);
+            return;
+        }
+
+        ASSERT(m_node->numChildren());
+        size_t scratchSize = sizeof(EncodedJSValue) * m_node->numChildren();
+        ScratchBuffer* scratchBuffer = vm().scratchBufferForSize(scratchSize);
+        EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
+        BitVector* bitVector = m_node->bitVector();
+        for (unsigned i = 0; i < m_node->numChildren(); ++i) {
+            Edge use = m_graph.m_varArgChildren[m_node->firstChild() + i];
+            LValue value;
+            if (bitVector->get(i))
+                value = lowCell(use);
+            else
+                value = lowJSValue(use);
+            m_out.store64(value, m_out.absolute(&buffer[i]));
+        }
+
+        m_out.storePtr(m_out.constIntPtr(scratchSize), m_out.absolute(scratchBuffer->activeLengthPtr()));
+        LValue result = vmCall(Int64, m_out.operation(operationNewArrayWithSpreadSlow), m_callFrame, m_out.constIntPtr(buffer), m_out.constInt32(m_node->numChildren()));
+        m_out.storePtr(m_out.constIntPtr(0), m_out.absolute(scratchBuffer->activeLengthPtr()));
+
+        setJSValue(result);
+    }
+
+    void compileSpread()
+    {
+        // It would be trivial to support this, but for now, we never create
+        // IR that would necessitate this. The reason is that Spread is only
+        // consumed by NewArrayWithSpread and never anything else. Also, any
+        // Spread(PhantomCreateRest) will turn into PhantomSpread(PhantomCreateRest).
+        RELEASE_ASSERT(m_node->child1()->op() != PhantomCreateRest); 
+
+        LValue argument = lowCell(m_node->child1());
+
+        LValue result;
+        if (m_node->child1().useKind() == ArrayUse) {
+            speculateArray(m_node->child1());
+
+            LBasicBlock preLoop = m_out.newBlock();
+            LBasicBlock loopSelection = m_out.newBlock();
+            LBasicBlock contiguousLoopStart = m_out.newBlock();
+            LBasicBlock doubleLoopStart = m_out.newBlock();
+            LBasicBlock slowPath = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            LValue indexingShape = m_out.load8ZeroExt32(argument, m_heaps.JSCell_indexingTypeAndMisc);
+            indexingShape = m_out.bitAnd(indexingShape, m_out.constInt32(IndexingShapeMask));
+            LValue isOKIndexingType = m_out.belowOrEqual(
+                m_out.sub(indexingShape, m_out.constInt32(Int32Shape)),
+                m_out.constInt32(ContiguousShape - Int32Shape));
+
+            m_out.branch(isOKIndexingType, unsure(preLoop), unsure(slowPath));
+            LBasicBlock lastNext = m_out.appendTo(preLoop, loopSelection);
+
+            LValue butterfly = m_out.loadPtr(argument, m_heaps.JSObject_butterfly);
+            LValue length = m_out.load32NonNegative(butterfly, m_heaps.Butterfly_publicLength);
+            static_assert(sizeof(JSValue) == 8 && 1 << 3 == 8, "Assumed in the code below.");
+            LValue size = m_out.add(
+                m_out.shl(m_out.zeroExtPtr(length), m_out.constInt32(3)),
+                m_out.constIntPtr(JSFixedArray::offsetOfData()));
+
+            LValue fastAllocation = allocateVariableSizedCell<JSFixedArray>(size, m_graph.m_vm.fixedArrayStructure.get(), slowPath);
+            ValueFromBlock fastResult = m_out.anchor(fastAllocation);
+            m_out.store32(length, fastAllocation, m_heaps.JSFixedArray_size);
+
+            ValueFromBlock startIndexForContiguous = m_out.anchor(m_out.constIntPtr(0));
+            ValueFromBlock startIndexForDouble = m_out.anchor(m_out.constIntPtr(0));
+
+            m_out.branch(m_out.isZero32(length), unsure(continuation), unsure(loopSelection));
+
+            m_out.appendTo(loopSelection, contiguousLoopStart);
+            m_out.branch(m_out.equal(indexingShape, m_out.constInt32(DoubleShape)),
+                unsure(doubleLoopStart), unsure(contiguousLoopStart));
+
+            {
+                m_out.appendTo(contiguousLoopStart, doubleLoopStart);
+                LValue index = m_out.phi(pointerType(), startIndexForContiguous);
+
+                TypedPointer loadSite = m_out.baseIndex(m_heaps.root, butterfly, index, ScaleEight); // We read TOP here since we can be reading either int32 or contiguous properties.
+                LValue value = m_out.load64(loadSite);
+                value = m_out.select(m_out.isZero64(value), m_out.constInt64(JSValue::encode(jsUndefined())), value);
+                m_out.store64(value, m_out.baseIndex(m_heaps.JSFixedArray_buffer, fastAllocation, index));
+
+                LValue nextIndex = m_out.add(index, m_out.constIntPtr(1));
+                m_out.addIncomingToPhi(index, m_out.anchor(nextIndex));
+
+                m_out.branch(m_out.below(nextIndex, m_out.zeroExtPtr(length)),
+                    unsure(contiguousLoopStart), unsure(continuation));
+            }
+
+            {
+                m_out.appendTo(doubleLoopStart, slowPath);
+                LValue index = m_out.phi(pointerType(), startIndexForDouble);
+
+                LValue value = m_out.loadDouble(m_out.baseIndex(m_heaps.indexedDoubleProperties, butterfly, index));
+                LValue isNaN = m_out.doubleNotEqualOrUnordered(value, value);
+                LValue holeResult = m_out.constInt64(JSValue::encode(jsUndefined()));
+                LValue normalResult = boxDouble(value);
+                value = m_out.select(isNaN, holeResult, normalResult);
+                m_out.store64(value, m_out.baseIndex(m_heaps.JSFixedArray_buffer, fastAllocation, index));
+
+                LValue nextIndex = m_out.add(index, m_out.constIntPtr(1));
+                m_out.addIncomingToPhi(index, m_out.anchor(nextIndex));
+
+                m_out.branch(m_out.below(nextIndex, m_out.zeroExtPtr(length)),
+                    unsure(doubleLoopStart), unsure(continuation));
+            }
+
+            m_out.appendTo(slowPath, continuation);
+            ValueFromBlock slowResult = m_out.anchor(vmCall(Int64, m_out.operation(operationSpreadFastArray), m_callFrame, argument));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            result = m_out.phi(Int64, fastResult, slowResult);
+            mutatorFence();
+        } else
+            result = vmCall(Int64, m_out.operation(operationSpreadGeneric), m_callFrame, argument);
+
+        setJSValue(result);
+    }
+    
+    void compileNewArrayBuffer()
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        RegisteredStructure structure = m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(
+            m_node->indexingType()));
+        
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
+            unsigned numElements = m_node->numConstants();
+            
+            ArrayValues arrayValues =
+                allocateUninitializedContiguousJSArray(m_out.constInt32(numElements), structure);
+            
+            JSValue* data = codeBlock()->constantBuffer(m_node->startConstant());
+            for (unsigned index = 0; index < m_node->numConstants(); ++index) {
+                int64_t value;
+                if (hasDouble(m_node->indexingType()))
+                    value = bitwise_cast<int64_t>(data[index].asNumber());
+                else
+                    value = JSValue::encode(data[index]);
+                
+                m_out.store64(
+                    m_out.constInt64(value),
+                    arrayValues.butterfly,
+                    m_heaps.forIndexingType(m_node->indexingType())->at(index));
+            }
+            
+            mutatorFence();
+            setJSValue(arrayValues.array);
+            return;
+        }
+        
+        setJSValue(vmCall(
+            Int64, m_out.operation(operationNewArrayBuffer), m_callFrame,
+            weakStructure(structure), m_out.constIntPtr(m_node->startConstant()),
+            m_out.constIntPtr(m_node->numConstants())));
+    }
+
+    void compileNewArrayWithSize()
+    {
+        LValue publicLength = lowInt32(m_node->child1());
+        
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        RegisteredStructure structure = m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(
+            m_node->indexingType()));
+        
+        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
+            IndexingType indexingType = m_node->indexingType();
+            setJSValue(
+                allocateJSArray(
+                    publicLength, weakPointer(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), m_out.constInt32(indexingType)).array);
+            mutatorFence();
+            return;
+        }
+        
+        LValue structureValue = m_out.select(
+            m_out.aboveOrEqual(publicLength, m_out.constInt32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)),
+            weakStructure(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))),
+            weakStructure(structure));
+        setJSValue(vmCall(Int64, m_out.operation(operationNewArrayWithSize), m_callFrame, structureValue, publicLength, m_out.intPtrZero));
+    }
+
+    void compileNewTypedArray()
+    {
+        TypedArrayType type = m_node->typedArrayType();
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        
+        switch (m_node->child1().useKind()) {
+        case Int32Use: {
+            RegisteredStructure structure = m_graph.registerStructure(globalObject->typedArrayStructureConcurrently(type));
+
+            LValue size = lowInt32(m_node->child1());
+
+            LBasicBlock smallEnoughCase = m_out.newBlock();
+            LBasicBlock nonZeroCase = m_out.newBlock();
+            LBasicBlock slowCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            ValueFromBlock noStorage = m_out.anchor(m_out.intPtrZero);
+
+            m_out.branch(
+                m_out.above(size, m_out.constInt32(JSArrayBufferView::fastSizeLimit)),
+                rarely(slowCase), usually(smallEnoughCase));
+
+            LBasicBlock lastNext = m_out.appendTo(smallEnoughCase, nonZeroCase);
+
+            m_out.branch(m_out.notZero32(size), usually(nonZeroCase), rarely(slowCase));
+
+            m_out.appendTo(nonZeroCase, slowCase);
+
+            LValue byteSize =
+                m_out.shl(m_out.zeroExtPtr(size), m_out.constInt32(logElementSize(type)));
+            if (elementSize(type) < 8) {
+                byteSize = m_out.bitAnd(
+                    m_out.add(byteSize, m_out.constIntPtr(7)),
+                    m_out.constIntPtr(~static_cast<intptr_t>(7)));
+            }
+        
+            LValue allocator = allocatorForSize(vm().auxiliarySpace, byteSize, slowCase);
+            LValue storage = allocateHeapCell(allocator, slowCase);
+            
+            splatWords(
+                storage,
+                m_out.int32Zero,
+                m_out.castToInt32(m_out.lShr(byteSize, m_out.constIntPtr(3))),
+                m_out.int64Zero,
+                m_heaps.typedArrayProperties);
+
+            ValueFromBlock haveStorage = m_out.anchor(storage);
+
+            LValue fastResultValue =
+                allocateObject<JSArrayBufferView>(structure, m_out.intPtrZero, slowCase);
+
+            m_out.storePtr(storage, fastResultValue, m_heaps.JSArrayBufferView_vector);
+            m_out.store32(size, fastResultValue, m_heaps.JSArrayBufferView_length);
+            m_out.store32(m_out.constInt32(FastTypedArray), fastResultValue, m_heaps.JSArrayBufferView_mode);
+            
+            mutatorFence();
+            ValueFromBlock fastResult = m_out.anchor(fastResultValue);
+            m_out.jump(continuation);
+
+            m_out.appendTo(slowCase, continuation);
+            LValue storageValue = m_out.phi(pointerType(), noStorage, haveStorage);
+
+            LValue slowResultValue = lazySlowPath(
+                [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                    return createLazyCallGenerator(
+                        operationNewTypedArrayWithSizeForType(type), locations[0].directGPR(),
+                        CCallHelpers::TrustedImmPtr(structure.get()), locations[1].directGPR(),
+                        locations[2].directGPR());
+                },
+                size, storageValue);
+            ValueFromBlock slowResult = m_out.anchor(slowResultValue);
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(pointerType(), fastResult, slowResult));
+            return;
+        }
+
+        case UntypedUse: {
+            LValue argument = lowJSValue(m_node->child1());
+
+            LValue result = vmCall(
+                pointerType(), m_out.operation(operationNewTypedArrayWithOneArgumentForType(type)),
+                m_callFrame, weakPointer(globalObject->typedArrayStructureConcurrently(type)), argument);
+
+            setJSValue(result);
+            return;
+        }
+
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            return;
+        }
+    }
+    
+    void compileAllocatePropertyStorage()
+    {
+        LValue object = lowCell(m_node->child1());
+        setStorage(allocatePropertyStorage(object, m_node->transition()->previous.get()));
+    }
+
+    void compileReallocatePropertyStorage()
+    {
+        Transition* transition = m_node->transition();
+        LValue object = lowCell(m_node->child1());
+        LValue oldStorage = lowStorage(m_node->child2());
+        
+        setStorage(
+            reallocatePropertyStorage(
+                object, oldStorage, transition->previous.get(), transition->next.get()));
+    }
+    
+    void compileNukeStructureAndSetButterfly()
+    {
+        nukeStructureAndSetButterfly(lowStorage(m_node->child2()), lowCell(m_node->child1()));
+    }
+
+    void compileToNumber()
+    {
+        LValue value = lowJSValue(m_node->child1());
+
+        if (!(abstractValue(m_node->child1()).m_type & SpecBytecodeNumber))
+            setJSValue(vmCall(Int64, m_out.operation(operationToNumber), m_callFrame, value));
+        else {
+            LBasicBlock notNumber = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            ValueFromBlock fastResult = m_out.anchor(value);
+            m_out.branch(isNumber(value, provenType(m_node->child1())), unsure(continuation), unsure(notNumber));
+
+            // notNumber case.
+            LBasicBlock lastNext = m_out.appendTo(notNumber, continuation);
+            // We have several attempts to remove ToNumber. But ToNumber still exists.
+            // It means that converting non-numbers to numbers by this ToNumber is not rare.
+            // Instead of the lazy slow path generator, we call the operation here.
+            ValueFromBlock slowResult = m_out.anchor(vmCall(Int64, m_out.operation(operationToNumber), m_callFrame, value));
+            m_out.jump(continuation);
+
+            // continuation case.
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, fastResult, slowResult));
+        }
+    }
+    
+    void compileToStringOrCallStringConstructor()
+    {
+        switch (m_node->child1().useKind()) {
+        case StringObjectUse: {
+            LValue cell = lowCell(m_node->child1());
+            speculateStringObjectForCell(m_node->child1(), cell);
+            m_interpreter.filter(m_node->child1(), SpecStringObject);
+            
+            setJSValue(m_out.loadPtr(cell, m_heaps.JSWrapperObject_internalValue));
+            return;
+        }
+            
+        case StringOrStringObjectUse: {
+            LValue cell = lowCell(m_node->child1());
+            LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
+            
+            LBasicBlock notString = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            ValueFromBlock simpleResult = m_out.anchor(cell);
+            m_out.branch(
+                m_out.equal(structureID, m_out.constInt32(vm().stringStructure->id())),
+                unsure(continuation), unsure(notString));
+            
+            LBasicBlock lastNext = m_out.appendTo(notString, continuation);
+            speculateStringObjectForStructureID(m_node->child1(), structureID);
+            ValueFromBlock unboxedResult = m_out.anchor(
+                m_out.loadPtr(cell, m_heaps.JSWrapperObject_internalValue));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, simpleResult, unboxedResult));
+            
+            m_interpreter.filter(m_node->child1(), SpecString | SpecStringObject);
+            return;
+        }
+            
+        case CellUse:
+        case UntypedUse: {
+            LValue value;
+            if (m_node->child1().useKind() == CellUse)
+                value = lowCell(m_node->child1());
+            else
+                value = lowJSValue(m_node->child1());
+            
+            LBasicBlock isCell = m_out.newBlock();
+            LBasicBlock notString = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            LValue isCellPredicate;
+            if (m_node->child1().useKind() == CellUse)
+                isCellPredicate = m_out.booleanTrue;
+            else
+                isCellPredicate = this->isCell(value, provenType(m_node->child1()));
+            m_out.branch(isCellPredicate, unsure(isCell), unsure(notString));
+            
+            LBasicBlock lastNext = m_out.appendTo(isCell, notString);
+            ValueFromBlock simpleResult = m_out.anchor(value);
+            LValue isStringPredicate;
+            if (m_node->child1()->prediction() & SpecString) {
+                isStringPredicate = isString(value, provenType(m_node->child1()));
+            } else
+                isStringPredicate = m_out.booleanFalse;
+            m_out.branch(isStringPredicate, unsure(continuation), unsure(notString));
+            
+            m_out.appendTo(notString, continuation);
+            LValue operation;
+            if (m_node->child1().useKind() == CellUse)
+                operation = m_out.operation(m_node->op() == ToString ? operationToStringOnCell : operationCallStringConstructorOnCell);
+            else
+                operation = m_out.operation(m_node->op() == ToString ? operationToString : operationCallStringConstructor);
+            ValueFromBlock convertedResult = m_out.anchor(vmCall(Int64, operation, m_callFrame, value));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setJSValue(m_out.phi(Int64, simpleResult, convertedResult));
+            return;
+        }
+            
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            break;
+        }
+    }
+    
+    void compileToPrimitive()
+    {
+        LValue value = lowJSValue(m_node->child1());
+        
+        LBasicBlock isCellCase = m_out.newBlock();
+        LBasicBlock isObjectCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        Vector<ValueFromBlock, 3> results;
+        
+        results.append(m_out.anchor(value));
+        m_out.branch(
+            isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
+        
+        LBasicBlock lastNext = m_out.appendTo(isCellCase, isObjectCase);
+        results.append(m_out.anchor(value));
+        m_out.branch(
+            isObject(value, provenType(m_node->child1())),
+            unsure(isObjectCase), unsure(continuation));
+        
+        m_out.appendTo(isObjectCase, continuation);
+        results.append(m_out.anchor(vmCall(
+            Int64, m_out.operation(operationToPrimitive), m_callFrame, value)));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, results));
+    }
+    
+    void compileMakeRope()
+    {
+        LValue kids[3];
+        unsigned numKids;
+        kids[0] = lowCell(m_node->child1());
+        kids[1] = lowCell(m_node->child2());
+        if (m_node->child3()) {
+            kids[2] = lowCell(m_node->child3());
+            numKids = 3;
+        } else {
+            kids[2] = 0;
+            numKids = 2;
+        }
+        
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+        
+        MarkedAllocator* allocator = subspaceFor<JSRopeString>(vm())->allocatorFor(sizeof(JSRopeString));
+        DFG_ASSERT(m_graph, m_node, allocator);
+        
+        LValue result = allocateCell(
+            m_out.constIntPtr(allocator), vm().stringStructure.get(), slowPath);
+        
+        m_out.storePtr(m_out.intPtrZero, result, m_heaps.JSString_value);
+        for (unsigned i = 0; i < numKids; ++i)
+            m_out.storePtr(kids[i], result, m_heaps.JSRopeString_fibers[i]);
+        for (unsigned i = numKids; i < JSRopeString::s_maxInternalRopeLength; ++i)
+            m_out.storePtr(m_out.intPtrZero, result, m_heaps.JSRopeString_fibers[i]);
+        LValue flags = m_out.load32(kids[0], m_heaps.JSString_flags);
+        LValue length = m_out.load32(kids[0], m_heaps.JSString_length);
+        for (unsigned i = 1; i < numKids; ++i) {
+            flags = m_out.bitAnd(flags, m_out.load32(kids[i], m_heaps.JSString_flags));
+            CheckValue* lengthCheck = m_out.speculateAdd(
+                length, m_out.load32(kids[i], m_heaps.JSString_length));
+            blessSpeculation(lengthCheck, Uncountable, noValue(), nullptr, m_origin);
+            length = lengthCheck;
+        }
+        m_out.store32(
+            m_out.bitAnd(m_out.constInt32(JSString::Is8Bit), flags),
+            result, m_heaps.JSString_flags);
+        m_out.store32(length, result, m_heaps.JSString_length);
+        
+        mutatorFence();
+        ValueFromBlock fastResult = m_out.anchor(result);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+        LValue slowResultValue;
+        switch (numKids) {
+        case 2:
+            slowResultValue = lazySlowPath(
+                [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                    return createLazyCallGenerator(
+                        operationMakeRope2, locations[0].directGPR(), locations[1].directGPR(),
+                        locations[2].directGPR());
+                }, kids[0], kids[1]);
+            break;
+        case 3:
+            slowResultValue = lazySlowPath(
+                [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                    return createLazyCallGenerator(
+                        operationMakeRope3, locations[0].directGPR(), locations[1].directGPR(),
+                        locations[2].directGPR(), locations[3].directGPR());
+                }, kids[0], kids[1], kids[2]);
+            break;
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad number of children");
+            break;
+        }
+        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, fastResult, slowResult));
+    }
+    
+    void compileStringCharAt()
+    {
+        LValue base = lowCell(m_node->child1());
+        LValue index = lowInt32(m_node->child2());
+        LValue storage = lowStorage(m_node->child3());
+            
+        LBasicBlock fastPath = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+            
+        m_out.branch(
+            m_out.aboveOrEqual(
+                index, m_out.load32NonNegative(base, m_heaps.JSString_length)),
+            rarely(slowPath), usually(fastPath));
+            
+        LBasicBlock lastNext = m_out.appendTo(fastPath, slowPath);
+            
+        LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value);
+            
+        LBasicBlock is8Bit = m_out.newBlock();
+        LBasicBlock is16Bit = m_out.newBlock();
+        LBasicBlock bitsContinuation = m_out.newBlock();
+        LBasicBlock bigCharacter = m_out.newBlock();
+            
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIs8Bit())),
+            unsure(is16Bit), unsure(is8Bit));
+            
+        m_out.appendTo(is8Bit, is16Bit);
+            
+        ValueFromBlock char8Bit = m_out.anchor(
+            m_out.load8ZeroExt32(m_out.baseIndex(
+                m_heaps.characters8, storage, m_out.zeroExtPtr(index),
+                provenValue(m_node->child2()))));
+        m_out.jump(bitsContinuation);
+            
+        m_out.appendTo(is16Bit, bigCharacter);
+
+        LValue char16BitValue = m_out.load16ZeroExt32(
+            m_out.baseIndex(
+                m_heaps.characters16, storage, m_out.zeroExtPtr(index),
+                provenValue(m_node->child2())));
+        ValueFromBlock char16Bit = m_out.anchor(char16BitValue);
+        m_out.branch(
+            m_out.aboveOrEqual(char16BitValue, m_out.constInt32(0x100)),
+            rarely(bigCharacter), usually(bitsContinuation));
+            
+        m_out.appendTo(bigCharacter, bitsContinuation);
+            
+        Vector<ValueFromBlock, 4> results;
+        results.append(m_out.anchor(vmCall(
+            Int64, m_out.operation(operationSingleCharacterString),
+            m_callFrame, char16BitValue)));
+        m_out.jump(continuation);
+            
+        m_out.appendTo(bitsContinuation, slowPath);
+            
+        LValue character = m_out.phi(Int32, char8Bit, char16Bit);
+            
+        LValue smallStrings = m_out.constIntPtr(vm().smallStrings.singleCharacterStrings());
+            
+        results.append(m_out.anchor(m_out.loadPtr(m_out.baseIndex(
+            m_heaps.singleCharacterStrings, smallStrings, m_out.zeroExtPtr(character)))));
+        m_out.jump(continuation);
+            
+        m_out.appendTo(slowPath, continuation);
+            
+        if (m_node->arrayMode().isInBounds()) {
+            speculate(OutOfBounds, noValue(), 0, m_out.booleanTrue);
+            results.append(m_out.anchor(m_out.intPtrZero));
+        } else {
+            JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+            
+            bool prototypeChainIsSane = false;
+            if (globalObject->stringPrototypeChainIsSane()) {
+                // FIXME: This could be captured using a Speculation mode that means
+                // "out-of-bounds loads return a trivial value", something like
+                // SaneChainOutOfBounds.
+                // https://bugs.webkit.org/show_bug.cgi?id=144668
+                
+                m_graph.watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
+                m_graph.watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
+                
+                prototypeChainIsSane = globalObject->stringPrototypeChainIsSane();
+            }
+            if (prototypeChainIsSane) {
+                LBasicBlock negativeIndex = m_out.newBlock();
+                    
+                results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined()))));
+                m_out.branch(
+                    m_out.lessThan(index, m_out.int32Zero),
+                    rarely(negativeIndex), usually(continuation));
+                    
+                m_out.appendTo(negativeIndex, continuation);
+            }
+                
+            results.append(m_out.anchor(vmCall(
+                Int64, m_out.operation(operationGetByValStringInt), m_callFrame, base, index)));
+        }
+            
+        m_out.jump(continuation);
+            
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, results));
+    }
+    
+    void compileStringCharCodeAt()
+    {
+        LBasicBlock is8Bit = m_out.newBlock();
+        LBasicBlock is16Bit = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LValue base = lowCell(m_node->child1());
+        LValue index = lowInt32(m_node->child2());
+        LValue storage = lowStorage(m_node->child3());
+        
+        speculate(
+            Uncountable, noValue(), 0,
+            m_out.aboveOrEqual(
+                index, m_out.load32NonNegative(base, m_heaps.JSString_length)));
+        
+        LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value);
+        
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIs8Bit())),
+            unsure(is16Bit), unsure(is8Bit));
+            
+        LBasicBlock lastNext = m_out.appendTo(is8Bit, is16Bit);
+            
+        ValueFromBlock char8Bit = m_out.anchor(
+            m_out.load8ZeroExt32(m_out.baseIndex(
+                m_heaps.characters8, storage, m_out.zeroExtPtr(index),
+                provenValue(m_node->child2()))));
+        m_out.jump(continuation);
+            
+        m_out.appendTo(is16Bit, continuation);
+            
+        ValueFromBlock char16Bit = m_out.anchor(
+            m_out.load16ZeroExt32(m_out.baseIndex(
+                m_heaps.characters16, storage, m_out.zeroExtPtr(index),
+                provenValue(m_node->child2()))));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        
+        setInt32(m_out.phi(Int32, char8Bit, char16Bit));
+    }
+
+    void compileStringFromCharCode()
+    {
+        Edge childEdge = m_node->child1();
+        
+        if (childEdge.useKind() == UntypedUse) {
+            LValue result = vmCall(
+                Int64, m_out.operation(operationStringFromCharCodeUntyped), m_callFrame,
+                lowJSValue(childEdge));
+            setJSValue(result);
+            return;
+        }
+
+        DFG_ASSERT(m_graph, m_node, childEdge.useKind() == Int32Use);
+
+        LValue value = lowInt32(childEdge);
+        
+        LBasicBlock smallIntCase = m_out.newBlock();
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(
+            m_out.aboveOrEqual(value, m_out.constInt32(0xff)),
+            rarely(slowCase), usually(smallIntCase));
+
+        LBasicBlock lastNext = m_out.appendTo(smallIntCase, slowCase);
+
+        LValue smallStrings = m_out.constIntPtr(vm().smallStrings.singleCharacterStrings());
+        LValue fastResultValue = m_out.loadPtr(
+            m_out.baseIndex(m_heaps.singleCharacterStrings, smallStrings, m_out.zeroExtPtr(value)));
+        ValueFromBlock fastResult = m_out.anchor(fastResultValue);
+        m_out.jump(continuation);
+
+        m_out.appendTo(slowCase, continuation);
+
+        LValue slowResultValue = vmCall(
+            pointerType(), m_out.operation(operationStringFromCharCode), m_callFrame, value);
+        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+
+        setJSValue(m_out.phi(Int64, fastResult, slowResult));
+    }
+    
+    void compileGetByOffset()
+    {
+        StorageAccessData& data = m_node->storageAccessData();
+        
+        setJSValue(loadProperty(
+            lowStorage(m_node->child1()), data.identifierNumber, data.offset));
+    }
+    
+    void compileGetGetter()
+    {
+        setJSValue(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.GetterSetter_getter));
+    }
+    
+    void compileGetSetter()
+    {
+        setJSValue(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.GetterSetter_setter));
+    }
+    
+    void compileMultiGetByOffset()
+    {
+        LValue base = lowCell(m_node->child1());
+        
+        MultiGetByOffsetData& data = m_node->multiGetByOffsetData();
+
+        if (data.cases.isEmpty()) {
+            // Protect against creating a Phi function with zero inputs. LLVM didn't like that.
+            // It's not clear if this is needed anymore.
+            // FIXME: https://bugs.webkit.org/show_bug.cgi?id=154382
+            terminate(BadCache);
+            return;
+        }
+        
+        Vector<LBasicBlock, 2> blocks(data.cases.size());
+        for (unsigned i = data.cases.size(); i--;)
+            blocks[i] = m_out.newBlock();
+        LBasicBlock exit = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        Vector<SwitchCase, 2> cases;
+        RegisteredStructureSet baseSet;
+        for (unsigned i = data.cases.size(); i--;) {
+            MultiGetByOffsetCase getCase = data.cases[i];
+            for (unsigned j = getCase.set().size(); j--;) {
+                RegisteredStructure structure = getCase.set()[j];
+                baseSet.add(structure);
+                cases.append(SwitchCase(weakStructureID(structure), blocks[i], Weight(1)));
+            }
+        }
+        m_out.switchInstruction(
+            m_out.load32(base, m_heaps.JSCell_structureID), cases, exit, Weight(0));
+        
+        LBasicBlock lastNext = m_out.m_nextBlock;
+        
+        Vector<ValueFromBlock, 2> results;
+        for (unsigned i = data.cases.size(); i--;) {
+            MultiGetByOffsetCase getCase = data.cases[i];
+            GetByOffsetMethod method = getCase.method();
+            
+            m_out.appendTo(blocks[i], i + 1 < data.cases.size() ? blocks[i + 1] : exit);
+            
+            LValue result;
+            
+            switch (method.kind()) {
+            case GetByOffsetMethod::Invalid:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+                
+            case GetByOffsetMethod::Constant:
+                result = m_out.constInt64(JSValue::encode(method.constant()->value()));
+                break;
+                
+            case GetByOffsetMethod::Load:
+            case GetByOffsetMethod::LoadFromPrototype: {
+                LValue propertyBase;
+                if (method.kind() == GetByOffsetMethod::Load)
+                    propertyBase = base;
+                else
+                    propertyBase = weakPointer(method.prototype()->value().asCell());
+                if (!isInlineOffset(method.offset()))
+                    propertyBase = m_out.loadPtr(propertyBase, m_heaps.JSObject_butterfly);
+                result = loadProperty(
+                    propertyBase, data.identifierNumber, method.offset());
+                break;
+            } }
+            
+            results.append(m_out.anchor(result));
+            m_out.jump(continuation);
+        }
+        
+        m_out.appendTo(exit, continuation);
+        if (!m_interpreter.forNode(m_node->child1()).m_structure.isSubsetOf(baseSet))
+            speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
+        m_out.unreachable();
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, results));
+    }
+    
+    void compilePutByOffset()
+    {
+        StorageAccessData& data = m_node->storageAccessData();
+        
+        storeProperty(
+            lowJSValue(m_node->child3()),
+            lowStorage(m_node->child1()), data.identifierNumber, data.offset);
+    }
+    
+    void compileMultiPutByOffset()
+    {
+        LValue base = lowCell(m_node->child1());
+        LValue value = lowJSValue(m_node->child2());
+        
+        MultiPutByOffsetData& data = m_node->multiPutByOffsetData();
+        
+        Vector<LBasicBlock, 2> blocks(data.variants.size());
+        for (unsigned i = data.variants.size(); i--;)
+            blocks[i] = m_out.newBlock();
+        LBasicBlock exit = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        Vector<SwitchCase, 2> cases;
+        RegisteredStructureSet baseSet;
+        for (unsigned i = data.variants.size(); i--;) {
+            PutByIdVariant variant = data.variants[i];
+            for (unsigned j = variant.oldStructure().size(); j--;) {
+                RegisteredStructure structure = m_graph.registerStructure(variant.oldStructure()[j]);
+                baseSet.add(structure);
+                cases.append(SwitchCase(weakStructureID(structure), blocks[i], Weight(1)));
+            }
+        }
+        m_out.switchInstruction(
+            m_out.load32(base, m_heaps.JSCell_structureID), cases, exit, Weight(0));
+        
+        LBasicBlock lastNext = m_out.m_nextBlock;
+        
+        for (unsigned i = data.variants.size(); i--;) {
+            m_out.appendTo(blocks[i], i + 1 < data.variants.size() ? blocks[i + 1] : exit);
+            
+            PutByIdVariant variant = data.variants[i];
+
+            checkInferredType(m_node->child2(), value, variant.requiredType());
+            
+            LValue storage;
+            if (variant.kind() == PutByIdVariant::Replace) {
+                if (isInlineOffset(variant.offset()))
+                    storage = base;
+                else
+                    storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
+            } else {
+                DFG_ASSERT(m_graph, m_node, variant.kind() == PutByIdVariant::Transition);
+                m_graph.m_plan.transitions.addLazily(
+                    codeBlock(), m_node->origin.semantic.codeOriginOwner(),
+                    variant.oldStructureForTransition(), variant.newStructure());
+                
+                storage = storageForTransition(
+                    base, variant.offset(),
+                    variant.oldStructureForTransition(), variant.newStructure());
+            }
+            
+            storeProperty(value, storage, data.identifierNumber, variant.offset());
+            
+            if (variant.kind() == PutByIdVariant::Transition) {
+                ASSERT(variant.oldStructureForTransition()->indexingType() == variant.newStructure()->indexingType());
+                ASSERT(variant.oldStructureForTransition()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
+                ASSERT(variant.oldStructureForTransition()->typeInfo().type() == variant.newStructure()->typeInfo().type());
+                m_out.store32(
+                    weakStructureID(m_graph.registerStructure(variant.newStructure())), base, m_heaps.JSCell_structureID);
+            }
+            
+            m_out.jump(continuation);
+        }
+        
+        m_out.appendTo(exit, continuation);
+        if (!m_interpreter.forNode(m_node->child1()).m_structure.isSubsetOf(baseSet))
+            speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
+        m_out.unreachable();
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void compileGetGlobalVariable()
+    {
+        setJSValue(m_out.load64(m_out.absolute(m_node->variablePointer())));
+    }
+    
+    void compilePutGlobalVariable()
+    {
+        m_out.store64(
+            lowJSValue(m_node->child2()), m_out.absolute(m_node->variablePointer()));
+    }
+    
+    void compileNotifyWrite()
+    {
+        WatchpointSet* set = m_node->watchpointSet();
+        
+        LBasicBlock isNotInvalidated = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LValue state = m_out.load8ZeroExt32(m_out.absolute(set->addressOfState()));
+        m_out.branch(
+            m_out.equal(state, m_out.constInt32(IsInvalidated)),
+            usually(continuation), rarely(isNotInvalidated));
+        
+        LBasicBlock lastNext = m_out.appendTo(isNotInvalidated, continuation);
+
+        lazySlowPath(
+            [=] (const Vector<Location>&) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationNotifyWrite, InvalidGPRReg, CCallHelpers::TrustedImmPtr(set));
+            });
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void compileGetCallee()
+    {
+        setJSValue(m_out.loadPtr(addressFor(CallFrameSlot::callee)));
+    }
+    
+    void compileGetArgumentCountIncludingThis()
+    {
+        setInt32(m_out.load32(payloadFor(CallFrameSlot::argumentCount)));
+    }
+    
+    void compileGetScope()
+    {
+        setJSValue(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.JSFunction_scope));
+    }
+    
+    void compileSkipScope()
+    {
+        setJSValue(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.JSScope_next));
+    }
+
+    void compileGetGlobalObject()
+    {
+        LValue structure = loadStructure(lowCell(m_node->child1()));
+        setJSValue(m_out.loadPtr(structure, m_heaps.Structure_globalObject));
+    }
+    
+    void compileGetClosureVar()
+    {
+        setJSValue(
+            m_out.load64(
+                lowCell(m_node->child1()),
+                m_heaps.JSEnvironmentRecord_variables[m_node->scopeOffset().offset()]));
+    }
+    
+    void compilePutClosureVar()
+    {
+        m_out.store64(
+            lowJSValue(m_node->child2()),
+            lowCell(m_node->child1()),
+            m_heaps.JSEnvironmentRecord_variables[m_node->scopeOffset().offset()]);
+    }
+    
+    void compileGetFromArguments()
+    {
+        setJSValue(
+            m_out.load64(
+                lowCell(m_node->child1()),
+                m_heaps.DirectArguments_storage[m_node->capturedArgumentsOffset().offset()]));
+    }
+    
+    void compilePutToArguments()
+    {
+        m_out.store64(
+            lowJSValue(m_node->child2()),
+            lowCell(m_node->child1()),
+            m_heaps.DirectArguments_storage[m_node->capturedArgumentsOffset().offset()]);
+    }
+
+    void compileGetArgument()
+    {
+        LValue argumentCount = m_out.load32(payloadFor(AssemblyHelpers::argumentCount(m_node->origin.semantic)));
+
+        LBasicBlock inBounds = m_out.newBlock();
+        LBasicBlock outOfBounds = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(m_out.lessThanOrEqual(argumentCount, m_out.constInt32(m_node->argumentIndex())), unsure(outOfBounds), unsure(inBounds));
+
+        LBasicBlock lastNext = m_out.appendTo(inBounds, outOfBounds);
+        VirtualRegister arg = AssemblyHelpers::argumentsStart(m_node->origin.semantic) + m_node->argumentIndex() - 1;
+        ValueFromBlock inBoundsResult = m_out.anchor(m_out.load64(addressFor(arg)));
+        m_out.jump(continuation);
+
+        m_out.appendTo(outOfBounds, continuation);
+        ValueFromBlock outOfBoundsResult = m_out.anchor(m_out.constInt64(ValueUndefined));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, inBoundsResult, outOfBoundsResult));
+    }
+    
+    void compileCompareEq()
+    {
+        if (m_node->isBinaryUseKind(Int32Use)
+            || m_node->isBinaryUseKind(Int52RepUse)
+            || m_node->isBinaryUseKind(DoubleRepUse)
+            || m_node->isBinaryUseKind(ObjectUse)
+            || m_node->isBinaryUseKind(BooleanUse)
+            || m_node->isBinaryUseKind(SymbolUse)
+            || m_node->isBinaryUseKind(StringIdentUse)
+            || m_node->isBinaryUseKind(StringUse)) {
+            compileCompareStrictEq();
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse)) {
+            compareEqObjectOrOtherToObject(m_node->child2(), m_node->child1());
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse)) {
+            compareEqObjectOrOtherToObject(m_node->child1(), m_node->child2());
+            return;
+        }
+
+        if (m_node->child1().useKind() == OtherUse) {
+            ASSERT(!m_interpreter.needsTypeCheck(m_node->child1(), SpecOther));
+            setBoolean(equalNullOrUndefined(m_node->child2(), AllCellsAreFalse, EqualNullOrUndefined, ManualOperandSpeculation));
+            return;
+        }
+
+        if (m_node->child2().useKind() == OtherUse) {
+            ASSERT(!m_interpreter.needsTypeCheck(m_node->child2(), SpecOther));
+            setBoolean(equalNullOrUndefined(m_node->child1(), AllCellsAreFalse, EqualNullOrUndefined, ManualOperandSpeculation));
+            return;
+        }
+
+        DFG_ASSERT(m_graph, m_node, m_node->isBinaryUseKind(UntypedUse));
+        nonSpeculativeCompare(
+            [&] (LValue left, LValue right) {
+                return m_out.equal(left, right);
+            },
+            operationCompareEq);
+    }
+    
+    void compileCompareStrictEq()
+    {
+        if (m_node->isBinaryUseKind(Int32Use)) {
+            setBoolean(
+                m_out.equal(lowInt32(m_node->child1()), lowInt32(m_node->child2())));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(Int52RepUse)) {
+            Int52Kind kind;
+            LValue left = lowWhicheverInt52(m_node->child1(), kind);
+            LValue right = lowInt52(m_node->child2(), kind);
+            setBoolean(m_out.equal(left, right));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(DoubleRepUse)) {
+            setBoolean(
+                m_out.doubleEqual(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(StringIdentUse)) {
+            setBoolean(
+                m_out.equal(lowStringIdent(m_node->child1()), lowStringIdent(m_node->child2())));
+            return;
+        }
+
+        if (m_node->isBinaryUseKind(StringUse)) {
+            LValue left = lowCell(m_node->child1());
+            LValue right = lowCell(m_node->child2());
+
+            LBasicBlock notTriviallyEqualCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            speculateString(m_node->child1(), left);
+
+            ValueFromBlock fastResult = m_out.anchor(m_out.booleanTrue);
+            m_out.branch(
+                m_out.equal(left, right), unsure(continuation), unsure(notTriviallyEqualCase));
+
+            LBasicBlock lastNext = m_out.appendTo(notTriviallyEqualCase, continuation);
+
+            speculateString(m_node->child2(), right);
+            
+            ValueFromBlock slowResult = m_out.anchor(stringsEqual(left, right));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            setBoolean(m_out.phi(Int32, fastResult, slowResult));
+            return;
+        }
+
+        if (m_node->isBinaryUseKind(ObjectUse, UntypedUse)) {
+            setBoolean(
+                m_out.equal(
+                    lowNonNullObject(m_node->child1()),
+                    lowJSValue(m_node->child2())));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(UntypedUse, ObjectUse)) {
+            setBoolean(
+                m_out.equal(
+                    lowNonNullObject(m_node->child2()),
+                    lowJSValue(m_node->child1())));
+            return;
+        }
+
+        if (m_node->isBinaryUseKind(ObjectUse)) {
+            setBoolean(
+                m_out.equal(
+                    lowNonNullObject(m_node->child1()),
+                    lowNonNullObject(m_node->child2())));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(BooleanUse)) {
+            setBoolean(
+                m_out.equal(lowBoolean(m_node->child1()), lowBoolean(m_node->child2())));
+            return;
+        }
+
+        if (m_node->isBinaryUseKind(SymbolUse)) {
+            LValue leftSymbol = lowSymbol(m_node->child1());
+            LValue rightSymbol = lowSymbol(m_node->child2());
+            setBoolean(m_out.equal(leftSymbol, rightSymbol));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(SymbolUse, UntypedUse)
+            || m_node->isBinaryUseKind(UntypedUse, SymbolUse)) {
+            Edge symbolEdge = m_node->child1();
+            Edge untypedEdge = m_node->child2();
+            if (symbolEdge.useKind() != SymbolUse)
+                std::swap(symbolEdge, untypedEdge);
+            
+            LValue leftSymbol = lowSymbol(symbolEdge);
+            LValue untypedValue = lowJSValue(untypedEdge);
+
+            setBoolean(m_out.equal(leftSymbol, untypedValue));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(MiscUse, UntypedUse)
+            || m_node->isBinaryUseKind(UntypedUse, MiscUse)) {
+            speculate(m_node->child1());
+            speculate(m_node->child2());
+            LValue left = lowJSValue(m_node->child1(), ManualOperandSpeculation);
+            LValue right = lowJSValue(m_node->child2(), ManualOperandSpeculation);
+            setBoolean(m_out.equal(left, right));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(StringIdentUse, NotStringVarUse)
+            || m_node->isBinaryUseKind(NotStringVarUse, StringIdentUse)) {
+            Edge leftEdge = m_node->childFor(StringIdentUse);
+            Edge rightEdge = m_node->childFor(NotStringVarUse);
+            
+            LValue left = lowStringIdent(leftEdge);
+            LValue rightValue = lowJSValue(rightEdge, ManualOperandSpeculation);
+            
+            LBasicBlock isCellCase = m_out.newBlock();
+            LBasicBlock isStringCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
+            m_out.branch(
+                isCell(rightValue, provenType(rightEdge)),
+                unsure(isCellCase), unsure(continuation));
+            
+            LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);
+            ValueFromBlock notStringResult = m_out.anchor(m_out.booleanFalse);
+            m_out.branch(
+                isString(rightValue, provenType(rightEdge)),
+                unsure(isStringCase), unsure(continuation));
+            
+            m_out.appendTo(isStringCase, continuation);
+            LValue right = m_out.loadPtr(rightValue, m_heaps.JSString_value);
+            speculateStringIdent(rightEdge, rightValue, right);
+            ValueFromBlock isStringResult = m_out.anchor(m_out.equal(left, right));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setBoolean(m_out.phi(Int32, notCellResult, notStringResult, isStringResult));
+            return;
+        }
+
+        if (m_node->isBinaryUseKind(StringUse, UntypedUse)) {
+            compileStringToUntypedStrictEquality(m_node->child1(), m_node->child2());
+            return;
+        }
+        if (m_node->isBinaryUseKind(UntypedUse, StringUse)) {
+            compileStringToUntypedStrictEquality(m_node->child2(), m_node->child1());
+            return;
+        }
+
+        DFG_ASSERT(m_graph, m_node, m_node->isBinaryUseKind(UntypedUse));
+        nonSpeculativeCompare(
+            [&] (LValue left, LValue right) {
+                return m_out.equal(left, right);
+            },
+            operationCompareStrictEq);
+    }
+
+    void compileStringToUntypedStrictEquality(Edge stringEdge, Edge untypedEdge)
+    {
+        ASSERT(stringEdge.useKind() == StringUse);
+        ASSERT(untypedEdge.useKind() == UntypedUse);
+
+        LValue leftString = lowCell(stringEdge);
+        LValue rightValue = lowJSValue(untypedEdge);
+        SpeculatedType rightValueType = provenType(untypedEdge);
+
+        // Verify left is string.
+        speculateString(stringEdge, leftString);
+
+        LBasicBlock testUntypedEdgeIsCell = m_out.newBlock();
+        LBasicBlock testUntypedEdgeIsString = m_out.newBlock();
+        LBasicBlock testStringEquality = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        // Given left is string. If the value are strictly equal, rightValue has to be the same string.
+        ValueFromBlock fastTrue = m_out.anchor(m_out.booleanTrue);
+        m_out.branch(m_out.equal(leftString, rightValue), unsure(continuation), unsure(testUntypedEdgeIsCell));
+
+        LBasicBlock lastNext = m_out.appendTo(testUntypedEdgeIsCell, testUntypedEdgeIsString);
+        ValueFromBlock fastFalse = m_out.anchor(m_out.booleanFalse);
+        m_out.branch(isNotCell(rightValue, rightValueType), unsure(continuation), unsure(testUntypedEdgeIsString));
+
+        // Check if the untyped edge is a string.
+        m_out.appendTo(testUntypedEdgeIsString, testStringEquality);
+        m_out.branch(isNotString(rightValue, rightValueType), unsure(continuation), unsure(testStringEquality));
+
+        // Full String compare.
+        m_out.appendTo(testStringEquality, continuation);
+        ValueFromBlock slowResult = m_out.anchor(stringsEqual(leftString, rightValue));
+        m_out.jump(continuation);
+
+        // Continuation.
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(m_out.phi(Int32, fastTrue, fastFalse, slowResult));
+    }
+
+    void compileCompareEqPtr()
+    {
+        setBoolean(
+            m_out.equal(
+                lowJSValue(m_node->child1()),
+                weakPointer(m_node->cellOperand()->cell())));
+    }
+    
+    void compileCompareLess()
+    {
+        compare(
+            [&] (LValue left, LValue right) {
+                return m_out.lessThan(left, right);
+            },
+            [&] (LValue left, LValue right) {
+                return m_out.doubleLessThan(left, right);
+            },
+            operationCompareStringImplLess,
+            operationCompareStringLess,
+            operationCompareLess);
+    }
+    
+    void compileCompareLessEq()
+    {
+        compare(
+            [&] (LValue left, LValue right) {
+                return m_out.lessThanOrEqual(left, right);
+            },
+            [&] (LValue left, LValue right) {
+                return m_out.doubleLessThanOrEqual(left, right);
+            },
+            operationCompareStringImplLessEq,
+            operationCompareStringLessEq,
+            operationCompareLessEq);
+    }
+    
+    void compileCompareGreater()
+    {
+        compare(
+            [&] (LValue left, LValue right) {
+                return m_out.greaterThan(left, right);
+            },
+            [&] (LValue left, LValue right) {
+                return m_out.doubleGreaterThan(left, right);
+            },
+            operationCompareStringImplGreater,
+            operationCompareStringGreater,
+            operationCompareGreater);
+    }
+    
+    void compileCompareGreaterEq()
+    {
+        compare(
+            [&] (LValue left, LValue right) {
+                return m_out.greaterThanOrEqual(left, right);
+            },
+            [&] (LValue left, LValue right) {
+                return m_out.doubleGreaterThanOrEqual(left, right);
+            },
+            operationCompareStringImplGreaterEq,
+            operationCompareStringGreaterEq,
+            operationCompareGreaterEq);
+    }
+    
+    void compileLogicalNot()
+    {
+        setBoolean(m_out.logicalNot(boolify(m_node->child1())));
+    }
+
+    void compileCallOrConstruct()
+    {
+        Node* node = m_node;
+        unsigned numArgs = node->numChildren() - 1;
+
+        LValue jsCallee = lowJSValue(m_graph.varArgChild(node, 0));
+
+        unsigned frameSize = (CallFrame::headerSizeInRegisters + numArgs) * sizeof(EncodedJSValue);
+        unsigned alignedFrameSize = WTF::roundUpToMultipleOf(stackAlignmentBytes(), frameSize);
+
+        // JS->JS calling convention requires that the caller allows this much space on top of stack to
+        // get trashed by the callee, even if not all of that space is used to pass arguments. We tell
+        // B3 this explicitly for two reasons:
+        //
+        // - We will only pass frameSize worth of stuff.
+        // - The trashed stack guarantee is logically separate from the act of passing arguments, so we
+        //   shouldn't rely on Air to infer the trashed stack property based on the arguments it ends
+        //   up seeing.
+        m_proc.requestCallArgAreaSizeInBytes(alignedFrameSize);
+
+        // Collect the arguments, since this can generate code and we want to generate it before we emit
+        // the call.
+        Vector<ConstrainedValue> arguments;
+
+        // Make sure that the callee goes into GPR0 because that's where the slow path thunks expect the
+        // callee to be.
+        arguments.append(ConstrainedValue(jsCallee, ValueRep::reg(GPRInfo::regT0)));
+
+        auto addArgument = [&] (LValue value, VirtualRegister reg, int offset) {
+            intptr_t offsetFromSP =
+                (reg.offset() - CallerFrameAndPC::sizeInRegisters) * sizeof(EncodedJSValue) + offset;
+            arguments.append(ConstrainedValue(value, ValueRep::stackArgument(offsetFromSP)));
+        };
+
+        addArgument(jsCallee, VirtualRegister(CallFrameSlot::callee), 0);
+        addArgument(m_out.constInt32(numArgs), VirtualRegister(CallFrameSlot::argumentCount), PayloadOffset);
+        for (unsigned i = 0; i < numArgs; ++i)
+            addArgument(lowJSValue(m_graph.varArgChild(node, 1 + i)), virtualRegisterForArgument(i), 0);
+
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendVector(arguments);
+
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(patchpoint);
+        
+        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        patchpoint->clobberLate(RegisterSet::volatileRegistersForJSCall());
+        patchpoint->resultConstraint = ValueRep::reg(GPRInfo::returnValueGPR);
+
+        CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                CallSiteIndex callSiteIndex = state->jitCode->common.addUniqueCallSiteIndex(codeOrigin);
+
+                exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
+
+                jit.store32(
+                    CCallHelpers::TrustedImm32(callSiteIndex.bits()),
+                    CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCount)));
+
+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo();
+
+                CCallHelpers::DataLabelPtr targetToCheck;
+                CCallHelpers::Jump slowPath = jit.branchPtrWithPatch(
+                    CCallHelpers::NotEqual, GPRInfo::regT0, targetToCheck,
+                    CCallHelpers::TrustedImmPtr(0));
+
+                CCallHelpers::Call fastCall = jit.nearCall();
+                CCallHelpers::Jump done = jit.jump();
+
+                slowPath.link(&jit);
+
+                jit.move(CCallHelpers::TrustedImmPtr(callLinkInfo), GPRInfo::regT2);
+                CCallHelpers::Call slowCall = jit.nearCall();
+                done.link(&jit);
+
+                callLinkInfo->setUpCall(
+                    node->op() == Construct ? CallLinkInfo::Construct : CallLinkInfo::Call,
+                    node->origin.semantic, GPRInfo::regT0);
+
+                jit.addPtr(
+                    CCallHelpers::TrustedImm32(-params.proc().frameSize()),
+                    GPRInfo::callFrameRegister, CCallHelpers::stackPointerRegister);
+
+                jit.addLinkTask(
+                    [=] (LinkBuffer& linkBuffer) {
+                        MacroAssemblerCodePtr linkCall =
+                            linkBuffer.vm().getCTIStub(linkCallThunkGenerator).code();
+                        linkBuffer.link(slowCall, FunctionPtr(linkCall.executableAddress()));
+
+                        callLinkInfo->setCallLocations(
+                            CodeLocationLabel(linkBuffer.locationOfNearCall(slowCall)),
+                            CodeLocationLabel(linkBuffer.locationOf(targetToCheck)),
+                            linkBuffer.locationOfNearCall(fastCall));
+                    });
+            });
+
+        setJSValue(patchpoint);
+    }
+    
+    void compileDirectCallOrConstruct()
+    {
+        Node* node = m_node;
+        bool isTail = node->op() == DirectTailCall;
+        bool isConstruct = node->op() == DirectConstruct;
+        
+        ExecutableBase* executable = node->castOperand<ExecutableBase*>();
+        FunctionExecutable* functionExecutable = jsDynamicCast<FunctionExecutable*>(executable);
+        
+        unsigned numPassedArgs = node->numChildren() - 1;
+        unsigned numAllocatedArgs = numPassedArgs;
+        
+        if (functionExecutable) {
+            numAllocatedArgs = std::max(
+                numAllocatedArgs,
+                std::min(
+                    static_cast<unsigned>(functionExecutable->parameterCount()) + 1,
+                    Options::maximumDirectCallStackSize()));
+        }
+        
+        LValue jsCallee = lowJSValue(m_graph.varArgChild(node, 0));
+        
+        if (!isTail) {
+            unsigned frameSize = (CallFrame::headerSizeInRegisters + numAllocatedArgs) * sizeof(EncodedJSValue);
+            unsigned alignedFrameSize = WTF::roundUpToMultipleOf(stackAlignmentBytes(), frameSize);
+            
+            m_proc.requestCallArgAreaSizeInBytes(alignedFrameSize);
+        }
+        
+        Vector<ConstrainedValue> arguments;
+        
+        arguments.append(ConstrainedValue(jsCallee, ValueRep::SomeRegister));
+        if (!isTail) {
+            auto addArgument = [&] (LValue value, VirtualRegister reg, int offset) {
+                intptr_t offsetFromSP =
+                    (reg.offset() - CallerFrameAndPC::sizeInRegisters) * sizeof(EncodedJSValue) + offset;
+                arguments.append(ConstrainedValue(value, ValueRep::stackArgument(offsetFromSP)));
+            };
+            
+            addArgument(jsCallee, VirtualRegister(CallFrameSlot::callee), 0);
+            addArgument(m_out.constInt32(numPassedArgs), VirtualRegister(CallFrameSlot::argumentCount), PayloadOffset);
+            for (unsigned i = 0; i < numPassedArgs; ++i)
+                addArgument(lowJSValue(m_graph.varArgChild(node, 1 + i)), virtualRegisterForArgument(i), 0);
+            for (unsigned i = numPassedArgs; i < numAllocatedArgs; ++i)
+                addArgument(m_out.constInt64(JSValue::encode(jsUndefined())), virtualRegisterForArgument(i), 0);
+        } else {
+            for (unsigned i = 0; i < numPassedArgs; ++i)
+                arguments.append(ConstrainedValue(lowJSValue(m_graph.varArgChild(node, 1 + i)), ValueRep::WarmAny));
+        }
+        
+        PatchpointValue* patchpoint = m_out.patchpoint(isTail ? Void : Int64);
+        patchpoint->appendVector(arguments);
+        
+        RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
+        
+        if (isTail) {
+            // The shuffler needs tags.
+            patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+            patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+        }
+        
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        if (!isTail) {
+            patchpoint->clobberLate(RegisterSet::volatileRegistersForJSCall());
+            patchpoint->resultConstraint = ValueRep::reg(GPRInfo::returnValueGPR);
+        }
+        
+        CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                CallSiteIndex callSiteIndex = state->jitCode->common.addUniqueCallSiteIndex(codeOrigin);
+                
+                GPRReg calleeGPR = params[!isTail].gpr();
+
+                exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
+                
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+                
+                if (isTail) {
+                    CallFrameShuffleData shuffleData;
+                    shuffleData.numLocals = state->jitCode->common.frameRegisterCount;
+                    
+                    RegisterSet toSave = params.unavailableRegisters();
+                    shuffleData.callee = ValueRecovery::inGPR(calleeGPR, DataFormatCell);
+                    toSave.set(calleeGPR);
+                    for (unsigned i = 0; i < numPassedArgs; ++i) {
+                        ValueRecovery recovery = params[1 + i].recoveryForJSValue();
+                        shuffleData.args.append(recovery);
+                        recovery.forEachReg(
+                            [&] (Reg reg) {
+                                toSave.set(reg);
+                            });
+                    }
+                    for (unsigned i = numPassedArgs; i < numAllocatedArgs; ++i)
+                        shuffleData.args.append(ValueRecovery::constant(jsUndefined()));
+                    shuffleData.numPassedArgs = numPassedArgs;
+                    shuffleData.setupCalleeSaveRegisters(jit.codeBlock());
+                    
+                    CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo();
+                    
+                    CCallHelpers::PatchableJump patchableJump = jit.patchableJump();
+                    CCallHelpers::Label mainPath = jit.label();
+                    
+                    jit.store32(
+                        CCallHelpers::TrustedImm32(callSiteIndex.bits()),
+                        CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCount)));
+                
+                    callLinkInfo->setFrameShuffleData(shuffleData);
+                    CallFrameShuffler(jit, shuffleData).prepareForTailCall();
+                    
+                    CCallHelpers::Call call = jit.nearTailCall();
+                    
+                    jit.abortWithReason(JITDidReturnFromTailCall);
+                    
+                    CCallHelpers::Label slowPath = jit.label();
+                    patchableJump.m_jump.linkTo(slowPath, &jit);
+                    callOperation(
+                        *state, toSave, jit,
+                        node->origin.semantic, exceptions.get(), operationLinkDirectCall,
+                        InvalidGPRReg, CCallHelpers::TrustedImmPtr(callLinkInfo), calleeGPR).call();
+                    jit.jump().linkTo(mainPath, &jit);
+                    
+                    callLinkInfo->setUpCall(
+                        CallLinkInfo::DirectTailCall, node->origin.semantic, InvalidGPRReg);
+                    callLinkInfo->setExecutableDuringCompilation(executable);
+                    if (numAllocatedArgs > numPassedArgs)
+                        callLinkInfo->setMaxNumArguments(numAllocatedArgs);
+                    
+                    jit.addLinkTask(
+                        [=] (LinkBuffer& linkBuffer) {
+                            CodeLocationLabel patchableJumpLocation = linkBuffer.locationOf(patchableJump);
+                            CodeLocationNearCall callLocation = linkBuffer.locationOfNearCall(call);
+                            CodeLocationLabel slowPathLocation = linkBuffer.locationOf(slowPath);
+                            
+                            callLinkInfo->setCallLocations(
+                                patchableJumpLocation,
+                                slowPathLocation,
+                                callLocation);
+                        });
+                    return;
+                }
+                
+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo();
+                
+                CCallHelpers::Label mainPath = jit.label();
+
+                jit.store32(
+                    CCallHelpers::TrustedImm32(callSiteIndex.bits()),
+                    CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCount)));
+                
+                CCallHelpers::Call call = jit.nearCall();
+                jit.addPtr(
+                    CCallHelpers::TrustedImm32(-params.proc().frameSize()),
+                    GPRInfo::callFrameRegister, CCallHelpers::stackPointerRegister);
+                
+                callLinkInfo->setUpCall(
+                    isConstruct ? CallLinkInfo::DirectConstruct : CallLinkInfo::DirectCall,
+                    node->origin.semantic, InvalidGPRReg);
+                callLinkInfo->setExecutableDuringCompilation(executable);
+                if (numAllocatedArgs > numPassedArgs)
+                    callLinkInfo->setMaxNumArguments(numAllocatedArgs);
+                
+                params.addLatePath(
+                    [=] (CCallHelpers& jit) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+                        
+                        CCallHelpers::Label slowPath = jit.label();
+                        if (isX86())
+                            jit.pop(CCallHelpers::selectScratchGPR(calleeGPR));
+                        
+                        callOperation(
+                            *state, params.unavailableRegisters(), jit,
+                            node->origin.semantic, exceptions.get(), operationLinkDirectCall,
+                            InvalidGPRReg, CCallHelpers::TrustedImmPtr(callLinkInfo),
+                            calleeGPR).call();
+                        jit.jump().linkTo(mainPath, &jit);
+                        
+                        jit.addLinkTask(
+                            [=] (LinkBuffer& linkBuffer) {
+                                CodeLocationNearCall callLocation = linkBuffer.locationOfNearCall(call);
+                                CodeLocationLabel slowPathLocation = linkBuffer.locationOf(slowPath);
+                                
+                                linkBuffer.link(call, slowPathLocation);
+                                
+                                callLinkInfo->setCallLocations(
+                                    CodeLocationLabel(),
+                                    slowPathLocation,
+                                    callLocation);
+                            });
+                    });
+            });
+        
+        if (isTail)
+            patchpoint->effects.terminal = true;
+        else
+            setJSValue(patchpoint);
+    }
+
+    void compileTailCall()
+    {
+        Node* node = m_node;
+        unsigned numArgs = node->numChildren() - 1;
+
+        LValue jsCallee = lowJSValue(m_graph.varArgChild(node, 0));
+        
+        // We want B3 to give us all of the arguments using whatever mechanism it thinks is
+        // convenient. The generator then shuffles those arguments into our own call frame,
+        // destroying our frame in the process.
+
+        // Note that we don't have to do anything special for exceptions. A tail call is only a
+        // tail call if it is not inside a try block.
+
+        Vector<ConstrainedValue> arguments;
+
+        arguments.append(ConstrainedValue(jsCallee, ValueRep::reg(GPRInfo::regT0)));
+
+        for (unsigned i = 0; i < numArgs; ++i) {
+            // Note: we could let the shuffler do boxing for us, but it's not super clear that this
+            // would be better. Also, if we wanted to do that, then we'd have to teach the shuffler
+            // that 32-bit values could land at 4-byte alignment but not 8-byte alignment.
+            
+            ConstrainedValue constrainedValue(
+                lowJSValue(m_graph.varArgChild(node, 1 + i)),
+                ValueRep::WarmAny);
+            arguments.append(constrainedValue);
+        }
+
+        PatchpointValue* patchpoint = m_out.patchpoint(Void);
+        patchpoint->appendVector(arguments);
+
+        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+
+        // Prevent any of the arguments from using the scratch register.
+        patchpoint->clobberEarly(RegisterSet::macroScratchRegisters());
+        
+        patchpoint->effects.terminal = true;
+
+        // We don't have to tell the patchpoint that we will clobber registers, since we won't return
+        // anyway.
+
+        CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                CallSiteIndex callSiteIndex = state->jitCode->common.addUniqueCallSiteIndex(codeOrigin);
+
+                // Yes, this is really necessary. You could throw an exception in a host call on the
+                // slow path. That'll route us to lookupExceptionHandler(), which unwinds starting
+                // with the call site index of our frame. Bad things happen if it's not set.
+                jit.store32(
+                    CCallHelpers::TrustedImm32(callSiteIndex.bits()),
+                    CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCount)));
+
+                CallFrameShuffleData shuffleData;
+                shuffleData.numLocals = state->jitCode->common.frameRegisterCount;
+                shuffleData.callee = ValueRecovery::inGPR(GPRInfo::regT0, DataFormatJS);
+
+                for (unsigned i = 0; i < numArgs; ++i)
+                    shuffleData.args.append(params[1 + i].recoveryForJSValue());
+
+                shuffleData.numPassedArgs = numArgs;
+                
+                shuffleData.setupCalleeSaveRegisters(jit.codeBlock());
+
+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo();
+
+                CCallHelpers::DataLabelPtr targetToCheck;
+                CCallHelpers::Jump slowPath = jit.branchPtrWithPatch(
+                    CCallHelpers::NotEqual, GPRInfo::regT0, targetToCheck,
+                    CCallHelpers::TrustedImmPtr(0));
+
+                callLinkInfo->setFrameShuffleData(shuffleData);
+                CallFrameShuffler(jit, shuffleData).prepareForTailCall();
+
+                CCallHelpers::Call fastCall = jit.nearTailCall();
+
+                slowPath.link(&jit);
+
+                CallFrameShuffler slowPathShuffler(jit, shuffleData);
+                slowPathShuffler.setCalleeJSValueRegs(JSValueRegs(GPRInfo::regT0));
+                slowPathShuffler.prepareForSlowPath();
+
+                jit.move(CCallHelpers::TrustedImmPtr(callLinkInfo), GPRInfo::regT2);
+                CCallHelpers::Call slowCall = jit.nearCall();
+
+                jit.abortWithReason(JITDidReturnFromTailCall);
+
+                callLinkInfo->setUpCall(CallLinkInfo::TailCall, codeOrigin, GPRInfo::regT0);
+
+                jit.addLinkTask(
+                    [=] (LinkBuffer& linkBuffer) {
+                        MacroAssemblerCodePtr linkCall =
+                            linkBuffer.vm().getCTIStub(linkCallThunkGenerator).code();
+                        linkBuffer.link(slowCall, FunctionPtr(linkCall.executableAddress()));
+
+                        callLinkInfo->setCallLocations(
+                            CodeLocationLabel(linkBuffer.locationOfNearCall(slowCall)),
+                            CodeLocationLabel(linkBuffer.locationOf(targetToCheck)),
+                            linkBuffer.locationOfNearCall(fastCall));
+                    });
+            });
+    }
+    
+    void compileCallOrConstructVarargsSpread()
+    {
+        Node* node = m_node;
+        LValue jsCallee = lowJSValue(m_node->child1());
+        LValue thisArg = lowJSValue(m_node->child2());
+
+        RELEASE_ASSERT(node->child3()->op() == PhantomNewArrayWithSpread);
+        Node* arrayWithSpread = node->child3().node();
+        BitVector* bitVector = arrayWithSpread->bitVector();
+        unsigned numNonSpreadParameters = 0;
+        Vector<LValue, 2> spreadLengths;
+        Vector<LValue, 8> patchpointArguments;
+        HashMap<InlineCallFrame*, LValue, WTF::DefaultHash<InlineCallFrame*>::Hash, WTF::NullableHashTraits<InlineCallFrame*>> cachedSpreadLengths;
+
+        for (unsigned i = 0; i < arrayWithSpread->numChildren(); i++) {
+            if (bitVector->get(i)) {
+                Node* spread = m_graph.varArgChild(arrayWithSpread, i).node();
+                RELEASE_ASSERT(spread->op() == PhantomSpread);
+                RELEASE_ASSERT(spread->child1()->op() == PhantomCreateRest);
+                InlineCallFrame* inlineCallFrame = spread->child1()->origin.semantic.inlineCallFrame;
+                unsigned numberOfArgumentsToSkip = spread->child1()->numberOfArgumentsToSkip();
+                LValue length = cachedSpreadLengths.ensure(inlineCallFrame, [&] () {
+                    return m_out.zeroExtPtr(getSpreadLengthFromInlineCallFrame(inlineCallFrame, numberOfArgumentsToSkip));
+                }).iterator->value;
+                patchpointArguments.append(length);
+                spreadLengths.append(length);
+            } else {
+                ++numNonSpreadParameters;
+                LValue argument = lowJSValue(m_graph.varArgChild(arrayWithSpread, i));
+                patchpointArguments.append(argument);
+            }
+        }
+
+        LValue argumentCountIncludingThis = m_out.constIntPtr(numNonSpreadParameters + 1);
+        for (LValue length : spreadLengths)
+            argumentCountIncludingThis = m_out.add(length, argumentCountIncludingThis);
+        
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+
+        patchpoint->append(jsCallee, ValueRep::reg(GPRInfo::regT0));
+        patchpoint->append(thisArg, ValueRep::WarmAny);
+        patchpoint->append(argumentCountIncludingThis, ValueRep::WarmAny);
+        patchpoint->appendVectorWithRep(patchpointArguments, ValueRep::WarmAny);
+        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+
+        RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
+
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        patchpoint->clobber(RegisterSet::volatileRegistersForJSCall()); // No inputs will be in a volatile register.
+        patchpoint->resultConstraint = ValueRep::reg(GPRInfo::returnValueGPR);
+
+        patchpoint->numGPScratchRegisters = 0;
+
+        // This is the minimum amount of call arg area stack space that all JS->JS calls always have.
+        unsigned minimumJSCallAreaSize =
+            sizeof(CallerFrameAndPC) +
+            WTF::roundUpToMultipleOf(stackAlignmentBytes(), 5 * sizeof(EncodedJSValue));
+
+        m_proc.requestCallArgAreaSizeInBytes(minimumJSCallAreaSize);
+        
+        CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                CallSiteIndex callSiteIndex =
+                    state->jitCode->common.addUniqueCallSiteIndex(codeOrigin);
+
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+                exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
+
+                jit.store32(
+                    CCallHelpers::TrustedImm32(callSiteIndex.bits()),
+                    CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCount)));
+
+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo();
+
+                RegisterSet usedRegisters = RegisterSet::allRegisters();
+                usedRegisters.exclude(RegisterSet::volatileRegistersForJSCall());
+                GPRReg calleeGPR = params[1].gpr();
+                usedRegisters.set(calleeGPR);
+
+                ScratchRegisterAllocator allocator(usedRegisters);
+                GPRReg scratchGPR1 = allocator.allocateScratchGPR();
+                GPRReg scratchGPR2 = allocator.allocateScratchGPR();
+                GPRReg scratchGPR3 = allocator.allocateScratchGPR();
+                GPRReg scratchGPR4 = allocator.allocateScratchGPR();
+                RELEASE_ASSERT(!allocator.numberOfReusedRegisters());
+
+                auto getValueFromRep = [&] (B3::ValueRep rep, GPRReg result) {
+                    ASSERT(!usedRegisters.get(result));
+
+                    if (rep.isConstant()) {
+                        jit.move(CCallHelpers::Imm64(rep.value()), result);
+                        return;
+                    }
+
+                    // Note: in this function, we only request 64 bit values.
+                    if (rep.isStack()) {
+                        jit.load64(
+                            CCallHelpers::Address(GPRInfo::callFrameRegister, rep.offsetFromFP()),
+                            result);
+                        return;
+                    }
+
+                    RELEASE_ASSERT(rep.isGPR());
+                    ASSERT(usedRegisters.get(rep.gpr()));
+                    jit.move(rep.gpr(), result);
+                };
+
+                auto callWithExceptionCheck = [&] (void* callee) {
+                    jit.move(CCallHelpers::TrustedImmPtr(callee), GPRInfo::nonPreservedNonArgumentGPR);
+                    jit.call(GPRInfo::nonPreservedNonArgumentGPR);
+                    exceptions->append(jit.emitExceptionCheck(AssemblyHelpers::NormalExceptionCheck, AssemblyHelpers::FarJumpWidth));
+                };
+
+                auto adjustStack = [&] (GPRReg amount) {
+                    jit.addPtr(CCallHelpers::TrustedImm32(sizeof(CallerFrameAndPC)), amount, CCallHelpers::stackPointerRegister);
+                };
+
+                CCallHelpers::JumpList slowCase;
+                unsigned originalStackHeight = params.proc().frameSize();
+
+                {
+                    unsigned numUsedSlots = WTF::roundUpToMultipleOf(stackAlignmentRegisters(), originalStackHeight / sizeof(EncodedJSValue));
+                    B3::ValueRep argumentCountIncludingThisRep = params[3];
+                    getValueFromRep(argumentCountIncludingThisRep, scratchGPR2);
+                    slowCase.append(jit.branch32(CCallHelpers::Above, scratchGPR2, CCallHelpers::TrustedImm32(JSC::maxArguments + 1)));
+                    
+                    jit.move(scratchGPR2, scratchGPR1);
+                    jit.addPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(numUsedSlots + CallFrame::headerSizeInRegisters)), scratchGPR1);
+                    // scratchGPR1 now has the required frame size in Register units
+                    // Round scratchGPR1 to next multiple of stackAlignmentRegisters()
+                    jit.addPtr(CCallHelpers::TrustedImm32(stackAlignmentRegisters() - 1), scratchGPR1);
+                    jit.andPtr(CCallHelpers::TrustedImm32(~(stackAlignmentRegisters() - 1)), scratchGPR1);
+                    jit.negPtr(scratchGPR1);
+                    jit.lshiftPtr(CCallHelpers::Imm32(3), scratchGPR1);
+                    jit.addPtr(GPRInfo::callFrameRegister, scratchGPR1);
+
+                    jit.store32(scratchGPR2, CCallHelpers::Address(scratchGPR1, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset));
+
+                    int storeOffset = CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register));
+
+                    for (unsigned i = arrayWithSpread->numChildren(); i--; ) {
+                        unsigned paramsOffset = 4;
+
+                        if (bitVector->get(i)) {
+                            Node* spread = state->graph.varArgChild(arrayWithSpread, i).node();
+                            RELEASE_ASSERT(spread->op() == PhantomSpread);
+                            RELEASE_ASSERT(spread->child1()->op() == PhantomCreateRest);
+                            InlineCallFrame* inlineCallFrame = spread->child1()->origin.semantic.inlineCallFrame;
+
+                            unsigned numberOfArgumentsToSkip = spread->child1()->numberOfArgumentsToSkip();
+
+                            B3::ValueRep numArgumentsToCopy = params[paramsOffset + i];
+                            getValueFromRep(numArgumentsToCopy, scratchGPR3);
+                            int loadOffset = (AssemblyHelpers::argumentsStart(inlineCallFrame).offset() + numberOfArgumentsToSkip) * static_cast<int>(sizeof(Register));
+
+                            auto done = jit.branchTestPtr(MacroAssembler::Zero, scratchGPR3);
+                            auto loopStart = jit.label();
+                            jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR3);
+                            jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR2);
+                            jit.load64(CCallHelpers::BaseIndex(GPRInfo::callFrameRegister, scratchGPR3, CCallHelpers::TimesEight, loadOffset), scratchGPR4);
+                            jit.store64(scratchGPR4,
+                                CCallHelpers::BaseIndex(scratchGPR1, scratchGPR2, CCallHelpers::TimesEight, storeOffset));
+                            jit.branchTestPtr(CCallHelpers::NonZero, scratchGPR3).linkTo(loopStart, &jit);
+                            done.link(&jit);
+                        } else {
+                            jit.subPtr(CCallHelpers::TrustedImmPtr(static_cast<size_t>(1)), scratchGPR2);
+                            getValueFromRep(params[paramsOffset + i], scratchGPR3);
+                            jit.store64(scratchGPR3,
+                                CCallHelpers::BaseIndex(scratchGPR1, scratchGPR2, CCallHelpers::TimesEight, storeOffset));
+                        }
+                    }
+                }
+
+                {
+                    CCallHelpers::Jump dontThrow = jit.jump();
+                    slowCase.link(&jit);
+                    jit.setupArgumentsExecState();
+                    callWithExceptionCheck(bitwise_cast<void*>(operationThrowStackOverflowForVarargs));
+                    jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
+                    
+                    dontThrow.link(&jit);
+                }
+
+                adjustStack(scratchGPR1);
+                
+                ASSERT(calleeGPR == GPRInfo::regT0);
+                jit.store64(calleeGPR, CCallHelpers::calleeFrameSlot(CallFrameSlot::callee));
+                getValueFromRep(params[2], scratchGPR3);
+                jit.store64(scratchGPR3, CCallHelpers::calleeArgumentSlot(0));
+                
+                CallLinkInfo::CallType callType;
+                if (node->op() == ConstructVarargs || node->op() == ConstructForwardVarargs)
+                    callType = CallLinkInfo::ConstructVarargs;
+                else if (node->op() == TailCallVarargs || node->op() == TailCallForwardVarargs)
+                    callType = CallLinkInfo::TailCallVarargs;
+                else
+                    callType = CallLinkInfo::CallVarargs;
+                
+                bool isTailCall = CallLinkInfo::callModeFor(callType) == CallMode::Tail;
+                
+                CCallHelpers::DataLabelPtr targetToCheck;
+                CCallHelpers::Jump slowPath = jit.branchPtrWithPatch(
+                    CCallHelpers::NotEqual, GPRInfo::regT0, targetToCheck,
+                    CCallHelpers::TrustedImmPtr(nullptr));
+                
+                CCallHelpers::Call fastCall;
+                CCallHelpers::Jump done;
+                
+                if (isTailCall) {
+                    jit.emitRestoreCalleeSaves();
+                    jit.prepareForTailCallSlow();
+                    fastCall = jit.nearTailCall();
+                } else {
+                    fastCall = jit.nearCall();
+                    done = jit.jump();
+                }
+                
+                slowPath.link(&jit);
+
+                if (isTailCall)
+                    jit.emitRestoreCalleeSaves();
+                ASSERT(!usedRegisters.get(GPRInfo::regT2));
+                jit.move(CCallHelpers::TrustedImmPtr(callLinkInfo), GPRInfo::regT2);
+                CCallHelpers::Call slowCall = jit.nearCall();
+                
+                if (isTailCall)
+                    jit.abortWithReason(JITDidReturnFromTailCall);
+                else
+                    done.link(&jit);
+                
+                callLinkInfo->setUpCall(callType, node->origin.semantic, GPRInfo::regT0);
+
+                jit.addPtr(
+                    CCallHelpers::TrustedImm32(-originalStackHeight),
+                    GPRInfo::callFrameRegister, CCallHelpers::stackPointerRegister);
+                
+                jit.addLinkTask(
+                    [=] (LinkBuffer& linkBuffer) {
+                        MacroAssemblerCodePtr linkCall =
+                            linkBuffer.vm().getCTIStub(linkCallThunkGenerator).code();
+                        linkBuffer.link(slowCall, FunctionPtr(linkCall.executableAddress()));
+                        
+                        callLinkInfo->setCallLocations(
+                            CodeLocationLabel(linkBuffer.locationOfNearCall(slowCall)),
+                            CodeLocationLabel(linkBuffer.locationOf(targetToCheck)),
+                            linkBuffer.locationOfNearCall(fastCall));
+                    });
+            });
+
+        switch (node->op()) {
+        case TailCallForwardVarargs:
+            m_out.unreachable();
+            break;
+
+        default:
+            setJSValue(patchpoint);
+            break;
+        }
+    }
+
+    void compileCallOrConstructVarargs()
+    {
+        Node* node = m_node;
+        LValue jsCallee = lowJSValue(m_node->child1());
+        LValue thisArg = lowJSValue(m_node->child2());
+        
+        LValue jsArguments = nullptr;
+        bool forwarding = false;
+        
+        switch (node->op()) {
+        case CallVarargs:
+        case TailCallVarargs:
+        case TailCallVarargsInlinedCaller:
+        case ConstructVarargs:
+            jsArguments = lowJSValue(node->child3());
+            break;
+        case CallForwardVarargs:
+        case TailCallForwardVarargs:
+        case TailCallForwardVarargsInlinedCaller:
+        case ConstructForwardVarargs:
+            forwarding = true;
+            break;
+        default:
+            DFG_CRASH(m_graph, node, "bad node type");
+            break;
+        }
+
+        if (forwarding && m_node->child3() && m_node->child3()->op() == PhantomNewArrayWithSpread) {
+            compileCallOrConstructVarargsSpread();
+            return;
+        }
+
+        
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+
+        // Append the forms of the arguments that we will use before any clobbering happens.
+        patchpoint->append(jsCallee, ValueRep::reg(GPRInfo::regT0));
+        if (jsArguments)
+            patchpoint->appendSomeRegister(jsArguments);
+        patchpoint->appendSomeRegister(thisArg);
+
+        if (!forwarding) {
+            // Now append them again for after clobbering. Note that the compiler may ask us to use a
+            // different register for the late for the post-clobbering version of the value. This gives
+            // the compiler a chance to spill these values without having to burn any callee-saves.
+            patchpoint->append(jsCallee, ValueRep::LateColdAny);
+            patchpoint->append(jsArguments, ValueRep::LateColdAny);
+            patchpoint->append(thisArg, ValueRep::LateColdAny);
+        }
+
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(patchpoint);
+        
+        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        patchpoint->clobberLate(RegisterSet::volatileRegistersForJSCall());
+        patchpoint->resultConstraint = ValueRep::reg(GPRInfo::returnValueGPR);
+
+        // This is the minimum amount of call arg area stack space that all JS->JS calls always have.
+        unsigned minimumJSCallAreaSize =
+            sizeof(CallerFrameAndPC) +
+            WTF::roundUpToMultipleOf(stackAlignmentBytes(), 5 * sizeof(EncodedJSValue));
+
+        m_proc.requestCallArgAreaSizeInBytes(minimumJSCallAreaSize);
+        
+        CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                CallSiteIndex callSiteIndex =
+                    state->jitCode->common.addUniqueCallSiteIndex(codeOrigin);
+
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+                exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
+
+                jit.store32(
+                    CCallHelpers::TrustedImm32(callSiteIndex.bits()),
+                    CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCount)));
+
+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo();
+                CallVarargsData* data = node->callVarargsData();
+
+                unsigned argIndex = 1;
+                GPRReg calleeGPR = params[argIndex++].gpr();
+                ASSERT(calleeGPR == GPRInfo::regT0);
+                GPRReg argumentsGPR = jsArguments ? params[argIndex++].gpr() : InvalidGPRReg;
+                GPRReg thisGPR = params[argIndex++].gpr();
+
+                B3::ValueRep calleeLateRep;
+                B3::ValueRep argumentsLateRep;
+                B3::ValueRep thisLateRep;
+                if (!forwarding) {
+                    // If we're not forwarding then we'll need callee, arguments, and this after we
+                    // have potentially clobbered calleeGPR, argumentsGPR, and thisGPR. Our technique
+                    // for this is to supply all of those operands as late uses in addition to
+                    // specifying them as early uses. It's possible that the late use uses a spill
+                    // while the early use uses a register, and it's possible for the late and early
+                    // uses to use different registers. We do know that the late uses interfere with
+                    // all volatile registers and so won't use those, but the early uses may use
+                    // volatile registers and in the case of calleeGPR, it's pinned to regT0 so it
+                    // definitely will.
+                    //
+                    // Note that we have to be super careful with these. It's possible that these
+                    // use a shuffling of the registers used for calleeGPR, argumentsGPR, and
+                    // thisGPR. If that happens and we do for example:
+                    //
+                    //     calleeLateRep.emitRestore(jit, calleeGPR);
+                    //     argumentsLateRep.emitRestore(jit, calleeGPR);
+                    //
+                    // Then we might end up with garbage if calleeLateRep.gpr() == argumentsGPR and
+                    // argumentsLateRep.gpr() == calleeGPR.
+                    //
+                    // We do a variety of things to prevent this from happening. For example, we use
+                    // argumentsLateRep before needing the other two and after we've already stopped
+                    // using the *GPRs. Also, we pin calleeGPR to regT0, and rely on the fact that
+                    // the *LateReps cannot use volatile registers (so they cannot be regT0, so
+                    // calleeGPR != argumentsLateRep.gpr() and calleeGPR != thisLateRep.gpr()).
+                    //
+                    // An alternative would have been to just use early uses and early-clobber all
+                    // volatile registers. But that would force callee, arguments, and this into
+                    // callee-save registers even if we have to spill them. We don't want spilling to
+                    // use up three callee-saves.
+                    //
+                    // TL;DR: The way we use LateReps here is dangerous and barely works but achieves
+                    // some desirable performance properties, so don't mistake the cleverness for
+                    // elegance.
+                    calleeLateRep = params[argIndex++];
+                    argumentsLateRep = params[argIndex++];
+                    thisLateRep = params[argIndex++];
+                }
+
+                // Get some scratch registers.
+                RegisterSet usedRegisters;
+                usedRegisters.merge(RegisterSet::stackRegisters());
+                usedRegisters.merge(RegisterSet::reservedHardwareRegisters());
+                usedRegisters.merge(RegisterSet::calleeSaveRegisters());
+                usedRegisters.set(calleeGPR);
+                if (argumentsGPR != InvalidGPRReg)
+                    usedRegisters.set(argumentsGPR);
+                usedRegisters.set(thisGPR);
+                if (calleeLateRep.isReg())
+                    usedRegisters.set(calleeLateRep.reg());
+                if (argumentsLateRep.isReg())
+                    usedRegisters.set(argumentsLateRep.reg());
+                if (thisLateRep.isReg())
+                    usedRegisters.set(thisLateRep.reg());
+                ScratchRegisterAllocator allocator(usedRegisters);
+                GPRReg scratchGPR1 = allocator.allocateScratchGPR();
+                GPRReg scratchGPR2 = allocator.allocateScratchGPR();
+                GPRReg scratchGPR3 = forwarding ? allocator.allocateScratchGPR() : InvalidGPRReg;
+                RELEASE_ASSERT(!allocator.numberOfReusedRegisters());
+
+                auto callWithExceptionCheck = [&] (void* callee) {
+                    jit.move(CCallHelpers::TrustedImmPtr(callee), GPRInfo::nonPreservedNonArgumentGPR);
+                    jit.call(GPRInfo::nonPreservedNonArgumentGPR);
+                    exceptions->append(jit.emitExceptionCheck(AssemblyHelpers::NormalExceptionCheck, AssemblyHelpers::FarJumpWidth));
+                };
+
+                auto adjustStack = [&] (GPRReg amount) {
+                    jit.addPtr(CCallHelpers::TrustedImm32(sizeof(CallerFrameAndPC)), amount, CCallHelpers::stackPointerRegister);
+                };
+
+                unsigned originalStackHeight = params.proc().frameSize();
+
+                if (forwarding) {
+                    jit.move(CCallHelpers::TrustedImm32(originalStackHeight / sizeof(EncodedJSValue)), scratchGPR2);
+                    
+                    CCallHelpers::JumpList slowCase;
+                    InlineCallFrame* inlineCallFrame;
+                    if (node->child3())
+                        inlineCallFrame = node->child3()->origin.semantic.inlineCallFrame;
+                    else
+                        inlineCallFrame = node->origin.semantic.inlineCallFrame;
+                    emitSetupVarargsFrameFastCase(jit, scratchGPR2, scratchGPR1, scratchGPR2, scratchGPR3, inlineCallFrame, data->firstVarArgOffset, slowCase);
+
+                    CCallHelpers::Jump done = jit.jump();
+                    slowCase.link(&jit);
+                    jit.setupArgumentsExecState();
+                    callWithExceptionCheck(bitwise_cast<void*>(operationThrowStackOverflowForVarargs));
+                    jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
+                    
+                    done.link(&jit);
+
+                    adjustStack(scratchGPR2);
+                } else {
+                    jit.move(CCallHelpers::TrustedImm32(originalStackHeight / sizeof(EncodedJSValue)), scratchGPR1);
+                    jit.setupArgumentsWithExecState(argumentsGPR, scratchGPR1, CCallHelpers::TrustedImm32(data->firstVarArgOffset));
+                    callWithExceptionCheck(bitwise_cast<void*>(operationSizeFrameForVarargs));
+
+                    jit.move(GPRInfo::returnValueGPR, scratchGPR1);
+                    jit.move(CCallHelpers::TrustedImm32(originalStackHeight / sizeof(EncodedJSValue)), scratchGPR2);
+                    argumentsLateRep.emitRestore(jit, argumentsGPR);
+                    emitSetVarargsFrame(jit, scratchGPR1, false, scratchGPR2, scratchGPR2);
+                    jit.addPtr(CCallHelpers::TrustedImm32(-minimumJSCallAreaSize), scratchGPR2, CCallHelpers::stackPointerRegister);
+                    jit.setupArgumentsWithExecState(scratchGPR2, argumentsGPR, CCallHelpers::TrustedImm32(data->firstVarArgOffset), scratchGPR1);
+                    callWithExceptionCheck(bitwise_cast<void*>(operationSetupVarargsFrame));
+                    
+                    adjustStack(GPRInfo::returnValueGPR);
+
+                    calleeLateRep.emitRestore(jit, GPRInfo::regT0);
+
+                    // This may not emit code if thisGPR got a callee-save. Also, we're guaranteed
+                    // that thisGPR != GPRInfo::regT0 because regT0 interferes with it.
+                    thisLateRep.emitRestore(jit, thisGPR);
+                }
+                
+                jit.store64(GPRInfo::regT0, CCallHelpers::calleeFrameSlot(CallFrameSlot::callee));
+                jit.store64(thisGPR, CCallHelpers::calleeArgumentSlot(0));
+                
+                CallLinkInfo::CallType callType;
+                if (node->op() == ConstructVarargs || node->op() == ConstructForwardVarargs)
+                    callType = CallLinkInfo::ConstructVarargs;
+                else if (node->op() == TailCallVarargs || node->op() == TailCallForwardVarargs)
+                    callType = CallLinkInfo::TailCallVarargs;
+                else
+                    callType = CallLinkInfo::CallVarargs;
+                
+                bool isTailCall = CallLinkInfo::callModeFor(callType) == CallMode::Tail;
+                
+                CCallHelpers::DataLabelPtr targetToCheck;
+                CCallHelpers::Jump slowPath = jit.branchPtrWithPatch(
+                    CCallHelpers::NotEqual, GPRInfo::regT0, targetToCheck,
+                    CCallHelpers::TrustedImmPtr(0));
+                
+                CCallHelpers::Call fastCall;
+                CCallHelpers::Jump done;
+                
+                if (isTailCall) {
+                    jit.emitRestoreCalleeSaves();
+                    jit.prepareForTailCallSlow();
+                    fastCall = jit.nearTailCall();
+                } else {
+                    fastCall = jit.nearCall();
+                    done = jit.jump();
+                }
+                
+                slowPath.link(&jit);
+
+                if (isTailCall)
+                    jit.emitRestoreCalleeSaves();
+                jit.move(CCallHelpers::TrustedImmPtr(callLinkInfo), GPRInfo::regT2);
+                CCallHelpers::Call slowCall = jit.nearCall();
+                
+                if (isTailCall)
+                    jit.abortWithReason(JITDidReturnFromTailCall);
+                else
+                    done.link(&jit);
+                
+                callLinkInfo->setUpCall(callType, node->origin.semantic, GPRInfo::regT0);
+                
+                jit.addPtr(
+                    CCallHelpers::TrustedImm32(-originalStackHeight),
+                    GPRInfo::callFrameRegister, CCallHelpers::stackPointerRegister);
+                
+                jit.addLinkTask(
+                    [=] (LinkBuffer& linkBuffer) {
+                        MacroAssemblerCodePtr linkCall =
+                            linkBuffer.vm().getCTIStub(linkCallThunkGenerator).code();
+                        linkBuffer.link(slowCall, FunctionPtr(linkCall.executableAddress()));
+                        
+                        callLinkInfo->setCallLocations(
+                            CodeLocationLabel(linkBuffer.locationOfNearCall(slowCall)),
+                            CodeLocationLabel(linkBuffer.locationOf(targetToCheck)),
+                            linkBuffer.locationOfNearCall(fastCall));
+                    });
+            });
+
+        switch (node->op()) {
+        case TailCallVarargs:
+        case TailCallForwardVarargs:
+            m_out.unreachable();
+            break;
+
+        default:
+            setJSValue(patchpoint);
+            break;
+        }
+    }
+    
+    void compileCallEval()
+    {
+        Node* node = m_node;
+        unsigned numArgs = node->numChildren() - 1;
+        
+        LValue jsCallee = lowJSValue(m_graph.varArgChild(node, 0));
+        
+        unsigned frameSize = (CallFrame::headerSizeInRegisters + numArgs) * sizeof(EncodedJSValue);
+        unsigned alignedFrameSize = WTF::roundUpToMultipleOf(stackAlignmentBytes(), frameSize);
+        
+        m_proc.requestCallArgAreaSizeInBytes(alignedFrameSize);
+        
+        Vector<ConstrainedValue> arguments;
+        arguments.append(ConstrainedValue(jsCallee, ValueRep::reg(GPRInfo::regT0)));
+        
+        auto addArgument = [&] (LValue value, VirtualRegister reg, int offset) {
+            intptr_t offsetFromSP = 
+                (reg.offset() - CallerFrameAndPC::sizeInRegisters) * sizeof(EncodedJSValue) + offset;
+            arguments.append(ConstrainedValue(value, ValueRep::stackArgument(offsetFromSP)));
+        };
+        
+        addArgument(jsCallee, VirtualRegister(CallFrameSlot::callee), 0);
+        addArgument(m_out.constInt32(numArgs), VirtualRegister(CallFrameSlot::argumentCount), PayloadOffset);
+        for (unsigned i = 0; i < numArgs; ++i)
+            addArgument(lowJSValue(m_graph.varArgChild(node, 1 + i)), virtualRegisterForArgument(i), 0);
+        
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendVector(arguments);
+        
+        RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
+        
+        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        patchpoint->clobberLate(RegisterSet::volatileRegistersForJSCall());
+        patchpoint->resultConstraint = ValueRep::reg(GPRInfo::returnValueGPR);
+        
+        CodeOrigin codeOrigin = codeOriginDescriptionOfCallSite();
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                CallSiteIndex callSiteIndex = state->jitCode->common.addUniqueCallSiteIndex(codeOrigin);
+                
+                Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+                
+                exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
+                
+                jit.store32(
+                    CCallHelpers::TrustedImm32(callSiteIndex.bits()),
+                    CCallHelpers::tagFor(VirtualRegister(CallFrameSlot::argumentCount)));
+                
+                CallLinkInfo* callLinkInfo = jit.codeBlock()->addCallLinkInfo();
+                callLinkInfo->setUpCall(CallLinkInfo::Call, node->origin.semantic, GPRInfo::regT0);
+                
+                jit.addPtr(CCallHelpers::TrustedImm32(-static_cast<ptrdiff_t>(sizeof(CallerFrameAndPC))), CCallHelpers::stackPointerRegister, GPRInfo::regT1);
+                jit.storePtr(GPRInfo::callFrameRegister, CCallHelpers::Address(GPRInfo::regT1, CallFrame::callerFrameOffset()));
+                
+                // Now we need to make room for:
+                // - The caller frame and PC for a call to operationCallEval.
+                // - Potentially two arguments on the stack.
+                unsigned requiredBytes = sizeof(CallerFrameAndPC) + sizeof(ExecState*) * 2;
+                requiredBytes = WTF::roundUpToMultipleOf(stackAlignmentBytes(), requiredBytes);
+                jit.subPtr(CCallHelpers::TrustedImm32(requiredBytes), CCallHelpers::stackPointerRegister);
+                jit.setupArgumentsWithExecState(GPRInfo::regT1);
+                jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationCallEval)), GPRInfo::nonPreservedNonArgumentGPR);
+                jit.call(GPRInfo::nonPreservedNonArgumentGPR);
+                exceptions->append(jit.emitExceptionCheck(AssemblyHelpers::NormalExceptionCheck, AssemblyHelpers::FarJumpWidth));
+                
+                CCallHelpers::Jump done = jit.branchTest64(CCallHelpers::NonZero, GPRInfo::returnValueGPR);
+                
+                jit.addPtr(CCallHelpers::TrustedImm32(requiredBytes), CCallHelpers::stackPointerRegister);
+                jit.load64(CCallHelpers::calleeFrameSlot(CallFrameSlot::callee), GPRInfo::regT0);
+                jit.emitDumbVirtualCall(callLinkInfo);
+                
+                done.link(&jit);
+                jit.addPtr(
+                    CCallHelpers::TrustedImm32(-params.proc().frameSize()),
+                    GPRInfo::callFrameRegister, CCallHelpers::stackPointerRegister);
+            });
+        
+        setJSValue(patchpoint);
+    }
+    
+    void compileLoadVarargs()
+    {
+        LoadVarargsData* data = m_node->loadVarargsData();
+        LValue jsArguments = lowJSValue(m_node->child1());
+        
+        LValue length = vmCall(
+            Int32, m_out.operation(operationSizeOfVarargs), m_callFrame, jsArguments,
+            m_out.constInt32(data->offset));
+        
+        // FIXME: There is a chance that we will call an effectful length property twice. This is safe
+        // from the standpoint of the VM's integrity, but it's subtly wrong from a spec compliance
+        // standpoint. The best solution would be one where we can exit *into* the op_call_varargs right
+        // past the sizing.
+        // https://bugs.webkit.org/show_bug.cgi?id=141448
+        
+        LValue lengthIncludingThis = m_out.add(length, m_out.int32One);
+        speculate(
+            VarargsOverflow, noValue(), nullptr,
+            m_out.above(lengthIncludingThis, m_out.constInt32(data->limit)));
+        
+        m_out.store32(lengthIncludingThis, payloadFor(data->machineCount));
+        
+        // FIXME: This computation is rather silly. If operationLaodVarargs just took a pointer instead
+        // of a VirtualRegister, we wouldn't have to do this.
+        // https://bugs.webkit.org/show_bug.cgi?id=141660
+        LValue machineStart = m_out.lShr(
+            m_out.sub(addressFor(data->machineStart.offset()).value(), m_callFrame),
+            m_out.constIntPtr(3));
+        
+        vmCall(
+            Void, m_out.operation(operationLoadVarargs), m_callFrame,
+            m_out.castToInt32(machineStart), jsArguments, m_out.constInt32(data->offset),
+            length, m_out.constInt32(data->mandatoryMinimum));
+    }
+    
+    void compileForwardVarargs()
+    {
+        if (m_node->child1() && m_node->child1()->op() == PhantomNewArrayWithSpread) {
+            compileForwardVarargsWithSpread();
+            return;
+        }
+
+        LoadVarargsData* data = m_node->loadVarargsData();
+        InlineCallFrame* inlineCallFrame;
+        if (m_node->child1())
+            inlineCallFrame = m_node->child1()->origin.semantic.inlineCallFrame;
+        else
+            inlineCallFrame = m_node->origin.semantic.inlineCallFrame;
+
+        LValue length = nullptr; 
+        LValue lengthIncludingThis = nullptr;
+        ArgumentsLength argumentsLength = getArgumentsLength(inlineCallFrame);
+        if (argumentsLength.isKnown) {
+            unsigned knownLength = argumentsLength.known;
+            if (knownLength >= data->offset)
+                knownLength = knownLength - data->offset;
+            else
+                knownLength = 0;
+            length = m_out.constInt32(knownLength);
+            lengthIncludingThis = m_out.constInt32(knownLength + 1);
+        } else {
+            // We need to perform the same logical operation as the code above, but through dynamic operations.
+            if (!data->offset)
+                length = argumentsLength.value;
+            else {
+                LBasicBlock isLarger = m_out.newBlock();
+                LBasicBlock continuation = m_out.newBlock();
+
+                ValueFromBlock smallerOrEqualLengthResult = m_out.anchor(m_out.constInt32(0));
+                m_out.branch(
+                    m_out.above(argumentsLength.value, m_out.constInt32(data->offset)), unsure(isLarger), unsure(continuation));
+                LBasicBlock lastNext = m_out.appendTo(isLarger, continuation);
+                ValueFromBlock largerLengthResult = m_out.anchor(m_out.sub(argumentsLength.value, m_out.constInt32(data->offset)));
+                m_out.jump(continuation);
+
+                m_out.appendTo(continuation, lastNext);
+                length = m_out.phi(Int32, smallerOrEqualLengthResult, largerLengthResult);
+            }
+            lengthIncludingThis = m_out.add(length, m_out.constInt32(1));
+        }
+
+        speculate(
+            VarargsOverflow, noValue(), nullptr,
+            m_out.above(lengthIncludingThis, m_out.constInt32(data->limit)));
+        
+        m_out.store32(lengthIncludingThis, payloadFor(data->machineCount));
+        
+        unsigned numberOfArgumentsToSkip = data->offset;
+        LValue sourceStart = getArgumentsStart(inlineCallFrame, numberOfArgumentsToSkip);
+        LValue targetStart = addressFor(data->machineStart).value();
+
+        LBasicBlock undefinedLoop = m_out.newBlock();
+        LBasicBlock mainLoopEntry = m_out.newBlock();
+        LBasicBlock mainLoop = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LValue lengthAsPtr = m_out.zeroExtPtr(length);
+        LValue loopBoundValue = m_out.constIntPtr(data->mandatoryMinimum);
+        ValueFromBlock loopBound = m_out.anchor(loopBoundValue);
+        m_out.branch(
+            m_out.above(loopBoundValue, lengthAsPtr), unsure(undefinedLoop), unsure(mainLoopEntry));
+        
+        LBasicBlock lastNext = m_out.appendTo(undefinedLoop, mainLoopEntry);
+        LValue previousIndex = m_out.phi(pointerType(), loopBound);
+        LValue currentIndex = m_out.sub(previousIndex, m_out.intPtrOne);
+        m_out.store64(
+            m_out.constInt64(JSValue::encode(jsUndefined())),
+            m_out.baseIndex(m_heaps.variables, targetStart, currentIndex));
+        ValueFromBlock nextIndex = m_out.anchor(currentIndex);
+        m_out.addIncomingToPhi(previousIndex, nextIndex);
+        m_out.branch(
+            m_out.above(currentIndex, lengthAsPtr), unsure(undefinedLoop), unsure(mainLoopEntry));
+        
+        m_out.appendTo(mainLoopEntry, mainLoop);
+        loopBound = m_out.anchor(lengthAsPtr);
+        m_out.branch(m_out.notNull(lengthAsPtr), unsure(mainLoop), unsure(continuation));
+        
+        m_out.appendTo(mainLoop, continuation);
+        previousIndex = m_out.phi(pointerType(), loopBound);
+        currentIndex = m_out.sub(previousIndex, m_out.intPtrOne);
+        LValue value = m_out.load64(
+            m_out.baseIndex(m_heaps.variables, sourceStart, currentIndex));
+        m_out.store64(value, m_out.baseIndex(m_heaps.variables, targetStart, currentIndex));
+        nextIndex = m_out.anchor(currentIndex);
+        m_out.addIncomingToPhi(previousIndex, nextIndex);
+        m_out.branch(m_out.isNull(currentIndex), unsure(continuation), unsure(mainLoop));
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+
+    LValue getSpreadLengthFromInlineCallFrame(InlineCallFrame* inlineCallFrame, unsigned numberOfArgumentsToSkip)
+    {
+        ArgumentsLength argumentsLength = getArgumentsLength(inlineCallFrame);
+        if (argumentsLength.isKnown) {
+            unsigned knownLength = argumentsLength.known;
+            if (knownLength >= numberOfArgumentsToSkip)
+                knownLength = knownLength - numberOfArgumentsToSkip;
+            else
+                knownLength = 0;
+            return m_out.constInt32(knownLength);
+        }
+
+
+        // We need to perform the same logical operation as the code above, but through dynamic operations.
+        if (!numberOfArgumentsToSkip)
+            return argumentsLength.value;
+
+        LBasicBlock isLarger = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        ValueFromBlock smallerOrEqualLengthResult = m_out.anchor(m_out.constInt32(0));
+        m_out.branch(
+            m_out.above(argumentsLength.value, m_out.constInt32(numberOfArgumentsToSkip)), unsure(isLarger), unsure(continuation));
+        LBasicBlock lastNext = m_out.appendTo(isLarger, continuation);
+        ValueFromBlock largerLengthResult = m_out.anchor(m_out.sub(argumentsLength.value, m_out.constInt32(numberOfArgumentsToSkip)));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(Int32, smallerOrEqualLengthResult, largerLengthResult);
+    }
+
+    void compileForwardVarargsWithSpread()
+    {
+        HashMap<InlineCallFrame*, LValue, WTF::DefaultHash<InlineCallFrame*>::Hash, WTF::NullableHashTraits<InlineCallFrame*>> cachedSpreadLengths;
+
+        Node* arrayWithSpread = m_node->child1().node();
+        RELEASE_ASSERT(arrayWithSpread->op() == PhantomNewArrayWithSpread);
+        BitVector* bitVector = arrayWithSpread->bitVector();
+
+        unsigned numberOfStaticArguments = 0;
+        Vector<LValue, 2> spreadLengths;
+        for (unsigned i = 0; i < arrayWithSpread->numChildren(); i++) {
+            if (bitVector->get(i)) {
+                Node* child = m_graph.varArgChild(arrayWithSpread, i).node();
+                ASSERT(child->op() == PhantomSpread);
+                ASSERT(child->child1()->op() == PhantomCreateRest);
+                InlineCallFrame* inlineCallFrame = child->child1()->origin.semantic.inlineCallFrame;
+                LValue length = cachedSpreadLengths.ensure(inlineCallFrame, [&] () {
+                    return getSpreadLengthFromInlineCallFrame(inlineCallFrame, child->child1()->numberOfArgumentsToSkip());
+                }).iterator->value;
+                spreadLengths.append(length);
+            } else
+                ++numberOfStaticArguments;
+        }
+
+        LValue lengthIncludingThis = m_out.constInt32(1 + numberOfStaticArguments);
+        for (LValue length : spreadLengths)
+            lengthIncludingThis = m_out.add(lengthIncludingThis, length);
+
+        LoadVarargsData* data = m_node->loadVarargsData();
+        speculate(
+            VarargsOverflow, noValue(), nullptr,
+            m_out.above(lengthIncludingThis, m_out.constInt32(data->limit)));
+        
+        m_out.store32(lengthIncludingThis, payloadFor(data->machineCount));
+
+        LValue targetStart = addressFor(data->machineStart).value();
+        LValue storeIndex = m_out.constIntPtr(0);
+        for (unsigned i = 0; i < arrayWithSpread->numChildren(); i++) {
+            if (bitVector->get(i)) {
+                Node* child = m_graph.varArgChild(arrayWithSpread, i).node();
+                RELEASE_ASSERT(child->op() == PhantomSpread);
+                RELEASE_ASSERT(child->child1()->op() == PhantomCreateRest);
+                InlineCallFrame* inlineCallFrame = child->child1()->origin.semantic.inlineCallFrame;
+
+                LValue sourceStart = getArgumentsStart(inlineCallFrame, child->child1()->numberOfArgumentsToSkip());
+                LValue spreadLength = m_out.zeroExtPtr(cachedSpreadLengths.get(inlineCallFrame));
+
+                LBasicBlock loop = m_out.newBlock();
+                LBasicBlock continuation = m_out.newBlock();
+                ValueFromBlock startLoadIndex = m_out.anchor(m_out.constIntPtr(0));
+                ValueFromBlock startStoreIndex = m_out.anchor(storeIndex);
+                ValueFromBlock startStoreIndexForEnd = m_out.anchor(storeIndex);
+
+                m_out.branch(m_out.isZero64(spreadLength), unsure(continuation), unsure(loop));
+
+                LBasicBlock lastNext = m_out.appendTo(loop, continuation);
+                LValue loopStoreIndex = m_out.phi(Int64, startStoreIndex);
+                LValue loadIndex = m_out.phi(Int64, startLoadIndex);
+                LValue value = m_out.load64(
+                    m_out.baseIndex(m_heaps.variables, sourceStart, loadIndex));
+                m_out.store64(value, m_out.baseIndex(m_heaps.variables, targetStart, loopStoreIndex));
+                LValue nextLoadIndex = m_out.add(m_out.constIntPtr(1), loadIndex);
+                m_out.addIncomingToPhi(loadIndex, m_out.anchor(nextLoadIndex));
+                LValue nextStoreIndex = m_out.add(m_out.constIntPtr(1), loopStoreIndex);
+                m_out.addIncomingToPhi(loopStoreIndex, m_out.anchor(nextStoreIndex));
+                ValueFromBlock loopStoreIndexForEnd = m_out.anchor(nextStoreIndex);
+                m_out.branch(m_out.below(nextLoadIndex, spreadLength), unsure(loop), unsure(continuation));
+
+                m_out.appendTo(continuation, lastNext);
+                storeIndex = m_out.phi(Int64, startStoreIndexForEnd, loopStoreIndexForEnd);
+            } else {
+                LValue value = lowJSValue(m_graph.varArgChild(arrayWithSpread, i));
+                m_out.store64(value, m_out.baseIndex(m_heaps.variables, targetStart, storeIndex));
+                storeIndex = m_out.add(m_out.constIntPtr(1), storeIndex);
+            }
+        }
+
+        LBasicBlock undefinedLoop = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        ValueFromBlock startStoreIndex = m_out.anchor(storeIndex);
+        LValue loopBoundValue = m_out.constIntPtr(data->mandatoryMinimum);
+        m_out.branch(m_out.below(storeIndex, loopBoundValue),
+            unsure(undefinedLoop), unsure(continuation));
+
+        LBasicBlock lastNext = m_out.appendTo(undefinedLoop, continuation);
+        LValue loopStoreIndex = m_out.phi(Int64, startStoreIndex);
+        m_out.store64(
+            m_out.constInt64(JSValue::encode(jsUndefined())),
+            m_out.baseIndex(m_heaps.variables, targetStart, loopStoreIndex));
+        LValue nextIndex = m_out.add(loopStoreIndex, m_out.constIntPtr(1));
+        m_out.addIncomingToPhi(loopStoreIndex, m_out.anchor(nextIndex));
+        m_out.branch(
+            m_out.below(nextIndex, loopBoundValue), unsure(undefinedLoop), unsure(continuation));
+
+        m_out.appendTo(continuation, lastNext);
+    }
+
+    void compileJump()
+    {
+        m_out.jump(lowBlock(m_node->targetBlock()));
+    }
+    
+    void compileBranch()
+    {
+        m_out.branch(
+            boolify(m_node->child1()),
+            WeightedTarget(
+                lowBlock(m_node->branchData()->taken.block),
+                m_node->branchData()->taken.count),
+            WeightedTarget(
+                lowBlock(m_node->branchData()->notTaken.block),
+                m_node->branchData()->notTaken.count));
+    }
+    
+    void compileSwitch()
+    {
+        SwitchData* data = m_node->switchData();
+        switch (data->kind) {
+        case SwitchImm: {
+            Vector<ValueFromBlock, 2> intValues;
+            LBasicBlock switchOnInts = m_out.newBlock();
+            
+            LBasicBlock lastNext = m_out.appendTo(m_out.m_block, switchOnInts);
+            
+            switch (m_node->child1().useKind()) {
+            case Int32Use: {
+                intValues.append(m_out.anchor(lowInt32(m_node->child1())));
+                m_out.jump(switchOnInts);
+                break;
+            }
+                
+            case UntypedUse: {
+                LBasicBlock isInt = m_out.newBlock();
+                LBasicBlock isNotInt = m_out.newBlock();
+                LBasicBlock isDouble = m_out.newBlock();
+                
+                LValue boxedValue = lowJSValue(m_node->child1());
+                m_out.branch(isNotInt32(boxedValue), unsure(isNotInt), unsure(isInt));
+                
+                LBasicBlock innerLastNext = m_out.appendTo(isInt, isNotInt);
+                
+                intValues.append(m_out.anchor(unboxInt32(boxedValue)));
+                m_out.jump(switchOnInts);
+                
+                m_out.appendTo(isNotInt, isDouble);
+                m_out.branch(
+                    isCellOrMisc(boxedValue, provenType(m_node->child1())),
+                    usually(lowBlock(data->fallThrough.block)), rarely(isDouble));
+                
+                m_out.appendTo(isDouble, innerLastNext);
+                LValue doubleValue = unboxDouble(boxedValue);
+                LValue intInDouble = m_out.doubleToInt(doubleValue);
+                intValues.append(m_out.anchor(intInDouble));
+                m_out.branch(
+                    m_out.doubleEqual(m_out.intToDouble(intInDouble), doubleValue),
+                    unsure(switchOnInts), unsure(lowBlock(data->fallThrough.block)));
+                break;
+            }
+                
+            default:
+                DFG_CRASH(m_graph, m_node, "Bad use kind");
+                break;
+            }
+            
+            m_out.appendTo(switchOnInts, lastNext);
+            buildSwitch(data, Int32, m_out.phi(Int32, intValues));
+            return;
+        }
+        
+        case SwitchChar: {
+            LValue stringValue;
+            
+            // FIXME: We should use something other than unsure() for the branch weight
+            // of the fallThrough block. The main challenge is just that we have multiple
+            // branches to fallThrough but a single count, so we would need to divvy it up
+            // among the different lowered branches.
+            // https://bugs.webkit.org/show_bug.cgi?id=129082
+            
+            switch (m_node->child1().useKind()) {
+            case StringUse: {
+                stringValue = lowString(m_node->child1());
+                break;
+            }
+                
+            case UntypedUse: {
+                LValue unboxedValue = lowJSValue(m_node->child1());
+                
+                LBasicBlock isCellCase = m_out.newBlock();
+                LBasicBlock isStringCase = m_out.newBlock();
+                
+                m_out.branch(
+                    isNotCell(unboxedValue, provenType(m_node->child1())),
+                    unsure(lowBlock(data->fallThrough.block)), unsure(isCellCase));
+                
+                LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);
+                LValue cellValue = unboxedValue;
+                m_out.branch(
+                    isNotString(cellValue, provenType(m_node->child1())),
+                    unsure(lowBlock(data->fallThrough.block)), unsure(isStringCase));
+                
+                m_out.appendTo(isStringCase, lastNext);
+                stringValue = cellValue;
+                break;
+            }
+                
+            default:
+                DFG_CRASH(m_graph, m_node, "Bad use kind");
+                break;
+            }
+            
+            LBasicBlock lengthIs1 = m_out.newBlock();
+            LBasicBlock needResolution = m_out.newBlock();
+            LBasicBlock resolved = m_out.newBlock();
+            LBasicBlock is8Bit = m_out.newBlock();
+            LBasicBlock is16Bit = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            m_out.branch(
+                m_out.notEqual(
+                    m_out.load32NonNegative(stringValue, m_heaps.JSString_length),
+                    m_out.int32One),
+                unsure(lowBlock(data->fallThrough.block)), unsure(lengthIs1));
+            
+            LBasicBlock lastNext = m_out.appendTo(lengthIs1, needResolution);
+            Vector<ValueFromBlock, 2> values;
+            LValue fastValue = m_out.loadPtr(stringValue, m_heaps.JSString_value);
+            values.append(m_out.anchor(fastValue));
+            m_out.branch(m_out.isNull(fastValue), rarely(needResolution), usually(resolved));
+            
+            m_out.appendTo(needResolution, resolved);
+            values.append(m_out.anchor(
+                vmCall(pointerType(), m_out.operation(operationResolveRope), m_callFrame, stringValue)));
+            m_out.jump(resolved);
+            
+            m_out.appendTo(resolved, is8Bit);
+            LValue value = m_out.phi(pointerType(), values);
+            LValue characterData = m_out.loadPtr(value, m_heaps.StringImpl_data);
+            m_out.branch(
+                m_out.testNonZero32(
+                    m_out.load32(value, m_heaps.StringImpl_hashAndFlags),
+                    m_out.constInt32(StringImpl::flagIs8Bit())),
+                unsure(is8Bit), unsure(is16Bit));
+            
+            Vector<ValueFromBlock, 2> characters;
+            m_out.appendTo(is8Bit, is16Bit);
+            characters.append(m_out.anchor(m_out.load8ZeroExt32(characterData, m_heaps.characters8[0])));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(is16Bit, continuation);
+            characters.append(m_out.anchor(m_out.load16ZeroExt32(characterData, m_heaps.characters16[0])));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            buildSwitch(data, Int32, m_out.phi(Int32, characters));
+            return;
+        }
+        
+        case SwitchString: {
+            switch (m_node->child1().useKind()) {
+            case StringIdentUse: {
+                LValue stringImpl = lowStringIdent(m_node->child1());
+                
+                Vector<SwitchCase> cases;
+                for (unsigned i = 0; i < data->cases.size(); ++i) {
+                    LValue value = m_out.constIntPtr(data->cases[i].value.stringImpl());
+                    LBasicBlock block = lowBlock(data->cases[i].target.block);
+                    Weight weight = Weight(data->cases[i].target.count);
+                    cases.append(SwitchCase(value, block, weight));
+                }
+                
+                m_out.switchInstruction(
+                    stringImpl, cases, lowBlock(data->fallThrough.block),
+                    Weight(data->fallThrough.count));
+                return;
+            }
+                
+            case StringUse: {
+                switchString(data, lowString(m_node->child1()));
+                return;
+            }
+                
+            case UntypedUse: {
+                LValue value = lowJSValue(m_node->child1());
+                
+                LBasicBlock isCellBlock = m_out.newBlock();
+                LBasicBlock isStringBlock = m_out.newBlock();
+                
+                m_out.branch(
+                    isCell(value, provenType(m_node->child1())),
+                    unsure(isCellBlock), unsure(lowBlock(data->fallThrough.block)));
+                
+                LBasicBlock lastNext = m_out.appendTo(isCellBlock, isStringBlock);
+                
+                m_out.branch(
+                    isString(value, provenType(m_node->child1())),
+                    unsure(isStringBlock), unsure(lowBlock(data->fallThrough.block)));
+                
+                m_out.appendTo(isStringBlock, lastNext);
+                
+                switchString(data, value);
+                return;
+            }
+                
+            default:
+                DFG_CRASH(m_graph, m_node, "Bad use kind");
+                return;
+            }
+            return;
+        }
+            
+        case SwitchCell: {
+            LValue cell;
+            switch (m_node->child1().useKind()) {
+            case CellUse: {
+                cell = lowCell(m_node->child1());
+                break;
+            }
+                
+            case UntypedUse: {
+                LValue value = lowJSValue(m_node->child1());
+                LBasicBlock cellCase = m_out.newBlock();
+                m_out.branch(
+                    isCell(value, provenType(m_node->child1())),
+                    unsure(cellCase), unsure(lowBlock(data->fallThrough.block)));
+                m_out.appendTo(cellCase);
+                cell = value;
+                break;
+            }
+                
+            default:
+                DFG_CRASH(m_graph, m_node, "Bad use kind");
+                return;
+            }
+            
+            buildSwitch(m_node->switchData(), pointerType(), cell);
+            return;
+        } }
+        
+        DFG_CRASH(m_graph, m_node, "Bad switch kind");
+    }
+    
+    void compileReturn()
+    {
+        m_out.ret(lowJSValue(m_node->child1()));
+    }
+    
+    void compileForceOSRExit()
+    {
+        terminate(InadequateCoverage);
+    }
+    
+    void compileThrow()
+    {
+        terminate(Uncountable);
+    }
+    
+    void compileInvalidationPoint()
+    {
+        if (verboseCompilationEnabled())
+            dataLog("    Invalidation point with availability: ", availabilityMap(), "\n");
+
+        DFG_ASSERT(m_graph, m_node, m_origin.exitOK);
+        
+        PatchpointValue* patchpoint = m_out.patchpoint(Void);
+        OSRExitDescriptor* descriptor = appendOSRExitDescriptor(noValue(), nullptr);
+        NodeOrigin origin = m_origin;
+        patchpoint->appendColdAnys(buildExitArguments(descriptor, origin.forExit, noValue()));
+        
+        State* state = &m_ftlState;
+
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
+                // The MacroAssembler knows more about this than B3 does. The watchpointLabel() method
+                // will ensure that this is followed by a nop shadow but only when this is actually
+                // necessary.
+                CCallHelpers::Label label = jit.watchpointLabel();
+
+                RefPtr<OSRExitHandle> handle = descriptor->emitOSRExitLater(
+                    *state, UncountableInvalidation, origin, params);
+
+                RefPtr<JITCode> jitCode = state->jitCode.get();
+
+                jit.addLinkTask(
+                    [=] (LinkBuffer& linkBuffer) {
+                        JumpReplacement jumpReplacement(
+                            linkBuffer.locationOf(label),
+                            linkBuffer.locationOf(handle->label));
+                        jitCode->common.jumpReplacements.append(jumpReplacement);
+                    });
+            });
+
+        // Set some obvious things.
+        patchpoint->effects.terminal = false;
+        patchpoint->effects.writesLocalState = false;
+        patchpoint->effects.readsLocalState = false;
+        
+        // This is how we tell B3 about the possibility of jump replacement.
+        patchpoint->effects.exitsSideways = true;
+        
+        // It's not possible for some prior branch to determine the safety of this operation. It's always
+        // fine to execute this on some path that wouldn't have originally executed it before
+        // optimization.
+        patchpoint->effects.controlDependent = false;
+
+        // If this falls through then it won't write anything.
+        patchpoint->effects.writes = HeapRange();
+
+        // When this abruptly terminates, it could read any heap location.
+        patchpoint->effects.reads = HeapRange::top();
+    }
+
+    void compileIsEmpty()
+    {
+        setBoolean(m_out.isZero64(lowJSValue(m_node->child1())));
+    }
+    
+    void compileIsUndefined()
+    {
+        setBoolean(equalNullOrUndefined(m_node->child1(), AllCellsAreFalse, EqualUndefined));
+    }
+    
+    void compileIsBoolean()
+    {
+        setBoolean(isBoolean(lowJSValue(m_node->child1()), provenType(m_node->child1())));
+    }
+    
+    void compileIsNumber()
+    {
+        setBoolean(isNumber(lowJSValue(m_node->child1()), provenType(m_node->child1())));
+    }
+    
+    void compileIsCellWithType()
+    {
+        if (m_node->child1().useKind() == UntypedUse) {
+            LValue value = lowJSValue(m_node->child1());
+
+            LBasicBlock isCellCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
+            m_out.branch(
+                isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
+
+            LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
+            ValueFromBlock cellResult = m_out.anchor(isCellWithType(value, m_node->queriedType(), m_node->speculatedTypeForQuery(), provenType(m_node->child1())));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            setBoolean(m_out.phi(Int32, notCellResult, cellResult));
+        } else {
+            ASSERT(m_node->child1().useKind() == CellUse);
+            setBoolean(isCellWithType(lowCell(m_node->child1()), m_node->queriedType(), m_node->speculatedTypeForQuery(), provenType(m_node->child1())));
+        }
+    }
+
+    void compileIsObject()
+    {
+        LValue value = lowJSValue(m_node->child1());
+
+        LBasicBlock isCellCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
+        m_out.branch(
+            isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
+
+        LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
+        ValueFromBlock cellResult = m_out.anchor(isObject(value, provenType(m_node->child1())));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(m_out.phi(Int32, notCellResult, cellResult));
+    }
+
+    LValue wangsInt64Hash(LValue input)
+    {
+        // key += ~(key << 32);
+        LValue key = input;
+        LValue temp = key;
+        temp = m_out.shl(temp, m_out.constInt32(32));
+        temp = m_out.bitNot(temp);
+        key = m_out.add(key, temp);
+        // key ^= (key >> 22);
+        temp = key;
+        temp = m_out.lShr(temp, m_out.constInt32(22));
+        key = m_out.bitXor(key, temp);
+        // key += ~(key << 13);
+        temp = key;
+        temp = m_out.shl(temp, m_out.constInt32(13));
+        temp = m_out.bitNot(temp);
+        key = m_out.add(key, temp);
+        // key ^= (key >> 8);
+        temp = key;
+        temp = m_out.lShr(temp, m_out.constInt32(8));
+        key = m_out.bitXor(key, temp);
+        // key += (key << 3);
+        temp = key;
+        temp = m_out.shl(temp, m_out.constInt32(3));
+        key = m_out.add(key, temp);
+        // key ^= (key >> 15);
+        temp = key;
+        temp = m_out.lShr(temp, m_out.constInt32(15));
+        key = m_out.bitXor(key, temp);
+        // key += ~(key << 27);
+        temp = key;
+        temp = m_out.shl(temp, m_out.constInt32(27));
+        temp = m_out.bitNot(temp);
+        key = m_out.add(key, temp);
+        // key ^= (key >> 31);
+        temp = key;
+        temp = m_out.lShr(temp, m_out.constInt32(31));
+        key = m_out.bitXor(key, temp);
+        key = m_out.castToInt32(key);
+
+        return key;
+    }
+
+    LValue mapHashString(LValue string)
+    {
+        LBasicBlock nonEmptyStringCase = m_out.newBlock();
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
+        m_out.branch(
+            m_out.equal(stringImpl, m_out.constIntPtr(0)), unsure(slowCase), unsure(nonEmptyStringCase));
+
+        LBasicBlock lastNext = m_out.appendTo(nonEmptyStringCase, slowCase);
+        LValue hash = m_out.lShr(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
+        ValueFromBlock nonEmptyStringHashResult = m_out.anchor(hash);
+        m_out.branch(m_out.equal(hash, m_out.constInt32(0)),
+            unsure(slowCase), unsure(continuation));
+
+        m_out.appendTo(slowCase, continuation);
+        ValueFromBlock slowResult = m_out.anchor(
+            vmCall(Int32, m_out.operation(operationMapHash), m_callFrame, string));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(Int32, slowResult, nonEmptyStringHashResult);
+    }
+
+    void compileMapHash()
+    {
+        switch (m_node->child1().useKind()) {
+        case BooleanUse:
+        case Int32Use:
+        case SymbolUse:
+        case ObjectUse: {
+            LValue key = lowJSValue(m_node->child1(), ManualOperandSpeculation);
+            speculate(m_node->child1());
+            setInt32(wangsInt64Hash(key));
+            return;
+        }
+
+        case CellUse: {
+            LBasicBlock isString = m_out.newBlock();
+            LBasicBlock notString = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            LValue value = lowCell(m_node->child1());
+            LValue isStringValue = m_out.equal(m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType), m_out.constInt32(StringType));
+            m_out.branch(
+                isStringValue, unsure(isString), unsure(notString));
+
+            LBasicBlock lastNext = m_out.appendTo(isString, notString);
+            ValueFromBlock stringResult = m_out.anchor(mapHashString(value));
+            m_out.jump(continuation);
+
+            m_out.appendTo(notString, continuation);
+            ValueFromBlock notStringResult = m_out.anchor(wangsInt64Hash(value));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            setInt32(m_out.phi(Int32, stringResult, notStringResult));
+            return;
+        }
+
+        case StringUse: {
+            LValue string = lowString(m_node->child1());
+            setInt32(mapHashString(string));
+            return;
+        }
+
+        default:
+            RELEASE_ASSERT(m_node->child1().useKind() == UntypedUse);
+            break;
+        }
+
+        LValue value = lowJSValue(m_node->child1());
+
+        LBasicBlock isCellCase = m_out.newBlock();
+        LBasicBlock notCell = m_out.newBlock();
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock straightHash = m_out.newBlock();
+        LBasicBlock isNumberCase = m_out.newBlock();
+        LBasicBlock isStringCase = m_out.newBlock();
+        LBasicBlock nonEmptyStringCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(
+            isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(notCell));
+
+        LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);
+        LValue isString = m_out.equal(m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType), m_out.constInt32(StringType));
+        m_out.branch(
+            isString, unsure(isStringCase), unsure(straightHash));
+
+        m_out.appendTo(isStringCase, nonEmptyStringCase);
+        LValue stringImpl = m_out.loadPtr(value, m_heaps.JSString_value);
+        m_out.branch(
+            m_out.equal(stringImpl, m_out.constIntPtr(0)), rarely(slowCase), usually(nonEmptyStringCase));
+
+        m_out.appendTo(nonEmptyStringCase, notCell);
+        LValue hash = m_out.lShr(m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
+        ValueFromBlock nonEmptyStringHashResult = m_out.anchor(hash);
+        m_out.branch(m_out.equal(hash, m_out.constInt32(0)),
+            unsure(slowCase), unsure(continuation));
+
+        m_out.appendTo(notCell, isNumberCase);
+        m_out.branch(
+            isNumber(value), unsure(isNumberCase), unsure(straightHash));
+
+        m_out.appendTo(isNumberCase, straightHash);
+        m_out.branch(
+            isInt32(value), unsure(straightHash), unsure(slowCase));
+
+        m_out.appendTo(straightHash, slowCase);
+        ValueFromBlock fastResult = m_out.anchor(wangsInt64Hash(value));
+        m_out.jump(continuation);
+
+        m_out.appendTo(slowCase, continuation);
+        ValueFromBlock slowResult = m_out.anchor(
+            vmCall(Int32, m_out.operation(operationMapHash), m_callFrame, value));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setInt32(m_out.phi(Int32, fastResult, slowResult, nonEmptyStringHashResult));
+    }
+
+    void compileGetMapBucket()
+    {
+        LBasicBlock loopStart = m_out.newBlock();
+        LBasicBlock loopAround = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock notPresentInTable = m_out.newBlock();
+        LBasicBlock notEmptyValue = m_out.newBlock();
+        LBasicBlock notDeletedValue = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(loopStart);
+
+        LValue map;
+        if (m_node->child1().useKind() == MapObjectUse)
+            map = lowMapObject(m_node->child1());
+        else if (m_node->child1().useKind() == SetObjectUse)
+            map = lowSetObject(m_node->child1());
+        else
+            RELEASE_ASSERT_NOT_REACHED();
+
+        LValue key = lowJSValue(m_node->child2(), ManualOperandSpeculation);
+        if (m_node->child2().useKind() != UntypedUse)
+            speculate(m_node->child2());
+
+        LValue hash = lowInt32(m_node->child3());
+
+        LValue hashMapImpl = m_out.loadPtr(map, m_node->child1().useKind() == MapObjectUse ? m_heaps.JSMap_hashMapImpl : m_heaps.JSSet_hashMapImpl);
+        LValue buffer = m_out.loadPtr(hashMapImpl, m_heaps.HashMapImpl_buffer);
+        LValue mask = m_out.sub(m_out.load32(hashMapImpl, m_heaps.HashMapImpl_capacity), m_out.int32One);
+
+        ValueFromBlock indexStart = m_out.anchor(hash);
+        m_out.jump(loopStart);
+
+        m_out.appendTo(loopStart, notEmptyValue);
+        LValue unmaskedIndex = m_out.phi(Int32, indexStart);
+        LValue index = m_out.bitAnd(mask, unmaskedIndex);
+        LValue hashMapBucket = m_out.load64(m_out.baseIndex(m_heaps.properties.atAnyNumber(), buffer, m_out.zeroExt(index, Int64), ScaleEight));
+        ValueFromBlock bucketResult = m_out.anchor(hashMapBucket);
+        m_out.branch(m_out.equal(hashMapBucket, m_out.constIntPtr(bitwise_cast<intptr_t>(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::emptyValue()))),
+            unsure(notPresentInTable), unsure(notEmptyValue));
+
+        m_out.appendTo(notEmptyValue, notDeletedValue);
+        m_out.branch(m_out.equal(hashMapBucket, m_out.constIntPtr(bitwise_cast<intptr_t>(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::deletedValue()))),
+            unsure(loopAround), unsure(notDeletedValue));
+
+        m_out.appendTo(notDeletedValue, loopAround);
+        LValue bucketKey = m_out.load64(hashMapBucket, m_heaps.HashMapBucket_key);
+
+        // Perform Object.is()
+        switch (m_node->child2().useKind()) {
+        case BooleanUse:
+        case Int32Use:
+        case SymbolUse:
+        case ObjectUse: {
+            m_out.branch(m_out.equal(key, bucketKey),
+                unsure(continuation), unsure(loopAround));
+            break;
+        }
+        case StringUse: {
+            LBasicBlock notBitEqual = m_out.newBlock();
+            LBasicBlock bucketKeyIsCell = m_out.newBlock();
+
+            m_out.branch(m_out.equal(key, bucketKey),
+                unsure(continuation), unsure(notBitEqual));
+
+            m_out.appendTo(notBitEqual, bucketKeyIsCell);
+            m_out.branch(isCell(bucketKey),
+                unsure(bucketKeyIsCell), unsure(loopAround));
+
+            m_out.appendTo(bucketKeyIsCell, loopAround);
+            m_out.branch(isString(bucketKey),
+                unsure(slowPath), unsure(loopAround));
+            break;
+        }
+        case CellUse: {
+            LBasicBlock notBitEqual = m_out.newBlock();
+            LBasicBlock bucketKeyIsCell = m_out.newBlock();
+            LBasicBlock bucketKeyIsString = m_out.newBlock();
+
+            m_out.branch(m_out.equal(key, bucketKey),
+                unsure(continuation), unsure(notBitEqual));
+
+            m_out.appendTo(notBitEqual, bucketKeyIsCell);
+            m_out.branch(isCell(bucketKey),
+                unsure(bucketKeyIsCell), unsure(loopAround));
+
+            m_out.appendTo(bucketKeyIsCell, bucketKeyIsString);
+            m_out.branch(isString(bucketKey),
+                unsure(bucketKeyIsString), unsure(loopAround));
+
+            m_out.appendTo(bucketKeyIsString, loopAround);
+            m_out.branch(isString(key),
+                unsure(slowPath), unsure(loopAround));
+            break;
+        }
+        case UntypedUse: {
+            LBasicBlock notBitEqual = m_out.newBlock();
+            LBasicBlock bucketKeyIsCell = m_out.newBlock();
+            LBasicBlock bothAreCells = m_out.newBlock();
+            LBasicBlock bucketKeyIsString = m_out.newBlock();
+            LBasicBlock bucketKeyNotCell = m_out.newBlock();
+            LBasicBlock bucketKeyIsNumber = m_out.newBlock();
+            LBasicBlock bothAreNumbers = m_out.newBlock();
+            LBasicBlock bucketKeyIsInt32 = m_out.newBlock();
+
+            m_out.branch(m_out.equal(key, bucketKey),
+                unsure(continuation), unsure(notBitEqual));
+
+            m_out.appendTo(notBitEqual, bucketKeyIsCell);
+            m_out.branch(isCell(bucketKey),
+                unsure(bucketKeyIsCell), unsure(bucketKeyNotCell));
+
+            m_out.appendTo(bucketKeyIsCell, bothAreCells);
+            m_out.branch(isCell(key),
+                unsure(bothAreCells), unsure(loopAround));
+
+            m_out.appendTo(bothAreCells, bucketKeyIsString);
+            m_out.branch(isString(bucketKey),
+                unsure(bucketKeyIsString), unsure(loopAround));
+
+            m_out.appendTo(bucketKeyIsString, bucketKeyNotCell);
+            m_out.branch(isString(key),
+                unsure(slowPath), unsure(loopAround));
+
+            m_out.appendTo(bucketKeyNotCell, bucketKeyIsNumber);
+            m_out.branch(isNotNumber(bucketKey),
+                unsure(loopAround), unsure(bucketKeyIsNumber));
+
+            m_out.appendTo(bucketKeyIsNumber, bothAreNumbers);
+            m_out.branch(isNotNumber(key),
+                unsure(loopAround), unsure(bothAreNumbers));
+
+            m_out.appendTo(bothAreNumbers, bucketKeyIsInt32);
+            m_out.branch(isNotInt32(bucketKey),
+                unsure(slowPath), unsure(bucketKeyIsInt32));
+
+            m_out.appendTo(bucketKeyIsInt32, loopAround);
+            m_out.branch(isNotInt32(key),
+                unsure(slowPath), unsure(loopAround));
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        m_out.appendTo(loopAround, slowPath);
+        m_out.addIncomingToPhi(unmaskedIndex, m_out.anchor(m_out.add(index, m_out.int32One)));
+        m_out.jump(loopStart);
+
+        m_out.appendTo(slowPath, notPresentInTable);
+        ValueFromBlock slowPathResult = m_out.anchor(vmCall(pointerType(),
+            m_out.operation(m_node->child1().useKind() == MapObjectUse ? operationJSMapFindBucket : operationJSSetFindBucket), m_callFrame, map, key, hash));
+        m_out.jump(continuation);
+
+        m_out.appendTo(notPresentInTable, continuation);
+        ValueFromBlock notPresentResult = m_out.anchor(m_out.constIntPtr(0));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setMapBucket(m_out.phi(pointerType(), bucketResult, slowPathResult, notPresentResult));
+    }
+
+    void compileLoadFromJSMapBucket()
+    {
+        LValue mapBucket = lowMapBucket(m_node->child1());
+
+        LBasicBlock continuation = m_out.newBlock();
+        LBasicBlock hasBucket = m_out.newBlock();
+
+        ValueFromBlock noBucketResult = m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined())));
+
+        m_out.branch(m_out.equal(mapBucket, m_out.constIntPtr(0)),
+            unsure(continuation), unsure(hasBucket));
+
+        LBasicBlock lastNext = m_out.appendTo(hasBucket, continuation);
+        ValueFromBlock bucketResult = m_out.anchor(m_out.load64(mapBucket, m_heaps.HashMapBucket_value));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, noBucketResult, bucketResult));
+    }
+
+    void compileIsNonEmptyMapBucket()
+    {
+        LValue bucket = lowMapBucket(m_node->child1());
+        LValue result = m_out.notEqual(bucket, m_out.constIntPtr(0));
+        setBoolean(result);
+    }
+
+    void compileIsObjectOrNull()
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        
+        Edge child = m_node->child1();
+        LValue value = lowJSValue(child);
+        
+        LBasicBlock cellCase = m_out.newBlock();
+        LBasicBlock notFunctionCase = m_out.newBlock();
+        LBasicBlock objectCase = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock notCellCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        m_out.branch(isCell(value, provenType(child)), unsure(cellCase), unsure(notCellCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(cellCase, notFunctionCase);
+        ValueFromBlock isFunctionResult = m_out.anchor(m_out.booleanFalse);
+        m_out.branch(
+            isFunction(value, provenType(child)),
+            unsure(continuation), unsure(notFunctionCase));
+        
+        m_out.appendTo(notFunctionCase, objectCase);
+        ValueFromBlock notObjectResult = m_out.anchor(m_out.booleanFalse);
+        m_out.branch(
+            isObject(value, provenType(child)),
+            unsure(objectCase), unsure(continuation));
+        
+        m_out.appendTo(objectCase, slowPath);
+        ValueFromBlock objectResult = m_out.anchor(m_out.booleanTrue);
+        m_out.branch(
+            isExoticForTypeof(value, provenType(child)),
+            rarely(slowPath), usually(continuation));
+        
+        m_out.appendTo(slowPath, notCellCase);
+        LValue slowResultValue = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationObjectIsObject, locations[0].directGPR(),
+                    CCallHelpers::TrustedImmPtr(globalObject), locations[1].directGPR());
+            }, value);
+        ValueFromBlock slowResult = m_out.anchor(m_out.notZero64(slowResultValue));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(notCellCase, continuation);
+        LValue notCellResultValue = m_out.equal(value, m_out.constInt64(JSValue::encode(jsNull())));
+        ValueFromBlock notCellResult = m_out.anchor(notCellResultValue);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        LValue result = m_out.phi(
+            Int32,
+            isFunctionResult, notObjectResult, objectResult, slowResult, notCellResult);
+        setBoolean(result);
+    }
+    
+    void compileIsFunction()
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        
+        Edge child = m_node->child1();
+        LValue value = lowJSValue(child);
+        
+        LBasicBlock cellCase = m_out.newBlock();
+        LBasicBlock notFunctionCase = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
+        m_out.branch(
+            isCell(value, provenType(child)), unsure(cellCase), unsure(continuation));
+        
+        LBasicBlock lastNext = m_out.appendTo(cellCase, notFunctionCase);
+        ValueFromBlock functionResult = m_out.anchor(m_out.booleanTrue);
+        m_out.branch(
+            isFunction(value, provenType(child)),
+            unsure(continuation), unsure(notFunctionCase));
+        
+        m_out.appendTo(notFunctionCase, slowPath);
+        ValueFromBlock objectResult = m_out.anchor(m_out.booleanFalse);
+        m_out.branch(
+            isExoticForTypeof(value, provenType(child)),
+            rarely(slowPath), usually(continuation));
+        
+        m_out.appendTo(slowPath, continuation);
+        LValue slowResultValue = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationObjectIsFunction, locations[0].directGPR(),
+                    CCallHelpers::TrustedImmPtr(globalObject), locations[1].directGPR());
+            }, value);
+        ValueFromBlock slowResult = m_out.anchor(m_out.notNull(slowResultValue));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        LValue result = m_out.phi(
+            Int32, notCellResult, functionResult, objectResult, slowResult);
+        setBoolean(result);
+    }
+
+    void compileIsTypedArrayView()
+    {
+        LValue value = lowJSValue(m_node->child1());
+
+        LBasicBlock isCellCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
+        m_out.branch(isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
+
+        LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
+        ValueFromBlock cellResult = m_out.anchor(isTypedArrayView(value, provenType(m_node->child1())));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(m_out.phi(Int32, notCellResult, cellResult));
+    }
+
+    void compileTypeOf()
+    {
+        Edge child = m_node->child1();
+        LValue value = lowJSValue(child);
+        
+        LBasicBlock continuation = m_out.newBlock();
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
+        
+        Vector<ValueFromBlock> results;
+        
+        buildTypeOf(
+            child, value,
+            [&] (TypeofType type) {
+                results.append(m_out.anchor(weakPointer(vm().smallStrings.typeString(type))));
+                m_out.jump(continuation);
+            });
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, results));
+    }
+    
+    void compileIn()
+    {
+        DFG_ASSERT(m_graph, m_node, m_node->child2().useKind() == CellUse);
+
+        Node* node = m_node;
+        Edge base = node->child2();
+        LValue cell = lowCell(base);
+        if (JSString* string = node->child1()->dynamicCastConstant<JSString*>()) {
+            if (string->tryGetValueImpl() && string->tryGetValueImpl()->isAtomic()) {
+                UniquedStringImpl* str = bitwise_cast<UniquedStringImpl*>(string->tryGetValueImpl());
+                B3::PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+                patchpoint->appendSomeRegister(cell);
+                patchpoint->append(m_tagMask, ValueRep::lateReg(GPRInfo::tagMaskRegister));
+                patchpoint->append(m_tagTypeNumber, ValueRep::lateReg(GPRInfo::tagTypeNumberRegister));
+                patchpoint->clobber(RegisterSet::macroScratchRegisters());
+
+                RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
+
+                State* state = &m_ftlState;
+                patchpoint->setGenerator(
+                    [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                        // This is the direct exit target for operation calls. We don't need a JS exceptionHandle because we don't
+                        // cache Proxy objects.
+                        Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+                        GPRReg baseGPR = params[1].gpr();
+                        GPRReg resultGPR = params[0].gpr();
+
+                        StructureStubInfo* stubInfo =
+                            jit.codeBlock()->addStubInfo(AccessType::In);
+                        stubInfo->callSiteIndex =
+                            state->jitCode->common.addCodeOrigin(node->origin.semantic);
+                        stubInfo->codeOrigin = node->origin.semantic;
+                        stubInfo->patch.baseGPR = static_cast<int8_t>(baseGPR);
+                        stubInfo->patch.valueGPR = static_cast<int8_t>(resultGPR);
+                        stubInfo->patch.usedRegisters = params.unavailableRegisters();
+
+                        CCallHelpers::PatchableJump jump = jit.patchableJump();
+                        CCallHelpers::Label done = jit.label();
+
+                        params.addLatePath(
+                            [=] (CCallHelpers& jit) {
+                                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                                jump.m_jump.link(&jit);
+                                CCallHelpers::Label slowPathBegin = jit.label();
+                                CCallHelpers::Call slowPathCall = callOperation(
+                                    *state, params.unavailableRegisters(), jit,
+                                    node->origin.semantic, exceptions.get(), operationInOptimize,
+                                    resultGPR, CCallHelpers::TrustedImmPtr(stubInfo), baseGPR,
+                                    CCallHelpers::TrustedImmPtr(str)).call();
+                                jit.jump().linkTo(done, &jit);
+
+                                jit.addLinkTask(
+                                    [=] (LinkBuffer& linkBuffer) {
+                                        CodeLocationLabel start = linkBuffer.locationOf(jump);
+                                        stubInfo->patch.start = start;
+                                        ptrdiff_t inlineSize = MacroAssembler::differenceBetweenCodePtr(
+                                            start, linkBuffer.locationOf(done));
+                                        RELEASE_ASSERT(inlineSize >= 0);
+                                        stubInfo->patch.inlineSize = inlineSize;
+
+                                        stubInfo->patch.deltaFromStartToSlowPathCallLocation = MacroAssembler::differenceBetweenCodePtr(
+                                            start, linkBuffer.locationOf(slowPathCall));
+
+                                        stubInfo->patch.deltaFromStartToSlowPathStart = MacroAssembler::differenceBetweenCodePtr(
+                                            start, linkBuffer.locationOf(slowPathBegin));
+
+                                    });
+                            });
+                    });
+
+                setJSValue(patchpoint);
+                return;
+            }
+        } 
+
+        setJSValue(vmCall(Int64, m_out.operation(operationGenericIn), m_callFrame, cell, lowJSValue(m_node->child1())));
+    }
+
+    void compileHasOwnProperty()
+    {
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        LBasicBlock lastNext = nullptr;
+
+        LValue object = lowObject(m_node->child1());
+        LValue uniquedStringImpl;
+        LValue keyAsValue = nullptr;
+        switch (m_node->child2().useKind()) {
+        case StringUse: {
+            LBasicBlock isNonEmptyString = m_out.newBlock();
+            LBasicBlock isAtomicString = m_out.newBlock();
+
+            keyAsValue = lowString(m_node->child2());
+            uniquedStringImpl = m_out.loadPtr(keyAsValue, m_heaps.JSString_value);
+            m_out.branch(m_out.notNull(uniquedStringImpl), usually(isNonEmptyString), rarely(slowCase));
+
+            lastNext = m_out.appendTo(isNonEmptyString, isAtomicString);
+            LValue isNotAtomic = m_out.testIsZero32(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::flagIsAtomic()));
+            m_out.branch(isNotAtomic, rarely(slowCase), usually(isAtomicString));
+
+            m_out.appendTo(isAtomicString, slowCase);
+            break;
+        }
+        case SymbolUse: {
+            keyAsValue = lowSymbol(m_node->child2());
+            uniquedStringImpl = m_out.loadPtr(keyAsValue, m_heaps.Symbol_symbolImpl);
+            lastNext = m_out.insertNewBlocksBefore(slowCase);
+            break;
+        }
+        case UntypedUse: {
+            LBasicBlock isCellCase = m_out.newBlock();
+            LBasicBlock isStringCase = m_out.newBlock();
+            LBasicBlock notStringCase = m_out.newBlock();
+            LBasicBlock isNonEmptyString = m_out.newBlock();
+            LBasicBlock isSymbolCase = m_out.newBlock();
+            LBasicBlock hasUniquedStringImpl = m_out.newBlock();
+
+            keyAsValue = lowJSValue(m_node->child2());
+            m_out.branch(isCell(keyAsValue), usually(isCellCase), rarely(slowCase));
+
+            lastNext = m_out.appendTo(isCellCase, isStringCase);
+            m_out.branch(isString(keyAsValue), unsure(isStringCase), unsure(notStringCase));
+
+            m_out.appendTo(isStringCase, isNonEmptyString);
+            LValue implFromString = m_out.loadPtr(keyAsValue, m_heaps.JSString_value);
+            ValueFromBlock stringResult = m_out.anchor(implFromString);
+            m_out.branch(m_out.notNull(implFromString), usually(isNonEmptyString), rarely(slowCase));
+
+            m_out.appendTo(isNonEmptyString, notStringCase);
+            LValue isNotAtomic = m_out.testIsZero32(m_out.load32(implFromString, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::flagIsAtomic()));
+            m_out.branch(isNotAtomic, rarely(slowCase), usually(hasUniquedStringImpl));
+
+            m_out.appendTo(notStringCase, isSymbolCase);
+            m_out.branch(isSymbol(keyAsValue), unsure(isSymbolCase), unsure(slowCase));
+
+            m_out.appendTo(isSymbolCase, hasUniquedStringImpl);
+            ValueFromBlock symbolResult = m_out.anchor(m_out.loadPtr(keyAsValue, m_heaps.Symbol_symbolImpl));
+            m_out.jump(hasUniquedStringImpl);
+
+            m_out.appendTo(hasUniquedStringImpl, slowCase);
+            uniquedStringImpl = m_out.phi(pointerType(), stringResult, symbolResult);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        ASSERT(keyAsValue);
+
+        // Note that we don't test if the hash is zero here. AtomicStringImpl's can't have a zero
+        // hash, however, a SymbolImpl may. But, because this is a cache, we don't care. We only
+        // ever load the result from the cache if the cache entry matches what we are querying for.
+        // So we either get super lucky and use zero for the hash and somehow collide with the entity
+        // we're looking for, or we realize we're comparing against another entity, and go to the
+        // slow path anyways.
+        LValue hash = m_out.lShr(m_out.load32(uniquedStringImpl, m_heaps.StringImpl_hashAndFlags), m_out.constInt32(StringImpl::s_flagCount));
+
+        LValue structureID = m_out.load32(object, m_heaps.JSCell_structureID);
+        LValue index = m_out.add(hash, structureID);
+        index = m_out.zeroExtPtr(m_out.bitAnd(index, m_out.constInt32(HasOwnPropertyCache::mask)));
+        ASSERT(vm().hasOwnPropertyCache());
+        LValue cache = m_out.constIntPtr(vm().hasOwnPropertyCache());
+
+        IndexedAbstractHeap& heap = m_heaps.HasOwnPropertyCache;
+        LValue sameStructureID = m_out.equal(structureID, m_out.load32(m_out.baseIndex(heap, cache, index, JSValue(), HasOwnPropertyCache::Entry::offsetOfStructureID())));
+        LValue sameImpl = m_out.equal(uniquedStringImpl, m_out.loadPtr(m_out.baseIndex(heap, cache, index, JSValue(), HasOwnPropertyCache::Entry::offsetOfImpl())));
+        ValueFromBlock fastResult = m_out.anchor(m_out.load8ZeroExt32(m_out.baseIndex(heap, cache, index, JSValue(), HasOwnPropertyCache::Entry::offsetOfResult())));
+        LValue cacheHit = m_out.bitAnd(sameStructureID, sameImpl);
+
+        m_out.branch(m_out.notZero32(cacheHit), usually(continuation), rarely(slowCase));
+
+        m_out.appendTo(slowCase, continuation);
+        ValueFromBlock slowResult;
+        slowResult = m_out.anchor(vmCall(Int32, m_out.operation(operationHasOwnProperty), m_callFrame, object, keyAsValue));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(m_out.phi(Int32, fastResult, slowResult));
+    }
+
+    void compileOverridesHasInstance()
+    {
+        FrozenValue* defaultHasInstanceFunction = m_node->cellOperand();
+        ASSERT(defaultHasInstanceFunction->cell()->inherits(JSFunction::info()));
+
+        LValue constructor = lowCell(m_node->child1());
+        LValue hasInstance = lowJSValue(m_node->child2());
+
+        LBasicBlock defaultHasInstance = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        // Unlike in the DFG, we don't worry about cleaning this code up for the case where we have proven the hasInstanceValue is a constant as B3 should fix it for us.
+
+        ValueFromBlock notDefaultHasInstanceResult = m_out.anchor(m_out.booleanTrue);
+        m_out.branch(m_out.notEqual(hasInstance, frozenPointer(defaultHasInstanceFunction)), unsure(continuation), unsure(defaultHasInstance));
+
+        LBasicBlock lastNext = m_out.appendTo(defaultHasInstance, continuation);
+        ValueFromBlock implementsDefaultHasInstanceResult = m_out.anchor(m_out.testIsZero32(
+            m_out.load8ZeroExt32(constructor, m_heaps.JSCell_typeInfoFlags),
+            m_out.constInt32(ImplementsDefaultHasInstance)));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(m_out.phi(Int32, implementsDefaultHasInstanceResult, notDefaultHasInstanceResult));
+    }
+
+    void compileCheckTypeInfoFlags()
+    {
+        speculate(
+            BadTypeInfoFlags, noValue(), 0,
+            m_out.testIsZero32(
+                m_out.load8ZeroExt32(lowCell(m_node->child1()), m_heaps.JSCell_typeInfoFlags),
+                m_out.constInt32(m_node->typeInfoOperand())));
+    }
+    
+    void compileInstanceOf()
+    {
+        LValue cell;
+        
+        if (m_node->child1().useKind() == UntypedUse)
+            cell = lowJSValue(m_node->child1());
+        else
+            cell = lowCell(m_node->child1());
+        
+        LValue prototype = lowCell(m_node->child2());
+        
+        LBasicBlock isCellCase = m_out.newBlock();
+        LBasicBlock loop = m_out.newBlock();
+        LBasicBlock notYetInstance = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        LBasicBlock loadPrototypeDirect = m_out.newBlock();
+        LBasicBlock defaultHasInstanceSlow = m_out.newBlock();
+        
+        LValue condition;
+        if (m_node->child1().useKind() == UntypedUse)
+            condition = isCell(cell, provenType(m_node->child1()));
+        else
+            condition = m_out.booleanTrue;
+        
+        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
+        m_out.branch(condition, unsure(isCellCase), unsure(continuation));
+        
+        LBasicBlock lastNext = m_out.appendTo(isCellCase, loop);
+        
+        speculate(BadType, noValue(), 0, isNotObject(prototype, provenType(m_node->child2())));
+        
+        ValueFromBlock originalValue = m_out.anchor(cell);
+        m_out.jump(loop);
+        
+        m_out.appendTo(loop, loadPrototypeDirect);
+        LValue value = m_out.phi(Int64, originalValue);
+        LValue type = m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType);
+        m_out.branch(
+            m_out.notEqual(type, m_out.constInt32(ProxyObjectType)),
+            usually(loadPrototypeDirect), rarely(defaultHasInstanceSlow));
+
+        m_out.appendTo(loadPrototypeDirect, notYetInstance);
+        LValue structure = loadStructure(value);
+        LValue currentPrototype = m_out.load64(structure, m_heaps.Structure_prototype);
+        ValueFromBlock isInstanceResult = m_out.anchor(m_out.booleanTrue);
+        m_out.branch(
+            m_out.equal(currentPrototype, prototype),
+            unsure(continuation), unsure(notYetInstance));
+        
+        m_out.appendTo(notYetInstance, defaultHasInstanceSlow);
+        ValueFromBlock notInstanceResult = m_out.anchor(m_out.booleanFalse);
+        m_out.addIncomingToPhi(value, m_out.anchor(currentPrototype));
+        m_out.branch(isCell(currentPrototype), unsure(loop), unsure(continuation));
+
+        m_out.appendTo(defaultHasInstanceSlow, continuation);
+        // We can use the value that we're looping with because we
+        // can just continue off from wherever we bailed from the
+        // loop.
+        ValueFromBlock defaultHasInstanceResult = m_out.anchor(
+            vmCall(Int32, m_out.operation(operationDefaultHasInstance), m_callFrame, value, prototype));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(
+            m_out.phi(Int32, notCellResult, isInstanceResult, notInstanceResult, defaultHasInstanceResult));
+    }
+
+    void compileInstanceOfCustom()
+    {
+        LValue value = lowJSValue(m_node->child1());
+        LValue constructor = lowCell(m_node->child2());
+        LValue hasInstance = lowJSValue(m_node->child3());
+
+        setBoolean(m_out.logicalNot(m_out.equal(m_out.constInt32(0), vmCall(Int32, m_out.operation(operationInstanceOfCustom), m_callFrame, value, constructor, hasInstance))));
+    }
+    
+    void compileCountExecution()
+    {
+        TypedPointer counter = m_out.absolute(m_node->executionCounter()->address());
+        m_out.store64(m_out.add(m_out.load64(counter), m_out.constInt64(1)), counter);
+    }
+    
+    void compileStoreBarrier()
+    {
+        emitStoreBarrier(lowCell(m_node->child1()), m_node->op() == FencedStoreBarrier);
+    }
+    
+    void compileHasIndexedProperty()
+    {
+        switch (m_node->arrayMode().type()) {
+        case Array::Int32:
+        case Array::Contiguous: {
+            LValue base = lowCell(m_node->child1());
+            LValue index = lowInt32(m_node->child2());
+            LValue storage = lowStorage(m_node->child3());
+
+            IndexedAbstractHeap& heap = m_node->arrayMode().type() == Array::Int32 ?
+                m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties;
+
+            LBasicBlock checkHole = m_out.newBlock();
+            LBasicBlock slowCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            if (!m_node->arrayMode().isInBounds()) {
+                m_out.branch(
+                    m_out.aboveOrEqual(
+                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
+                    rarely(slowCase), usually(checkHole));
+            } else
+                m_out.jump(checkHole);
+
+            LBasicBlock lastNext = m_out.appendTo(checkHole, slowCase);
+            LValue checkHoleResultValue =
+                m_out.notZero64(m_out.load64(baseIndex(heap, storage, index, m_node->child2())));
+            ValueFromBlock checkHoleResult = m_out.anchor(checkHoleResultValue);
+            m_out.branch(checkHoleResultValue, usually(continuation), rarely(slowCase));
+
+            m_out.appendTo(slowCase, continuation);
+            ValueFromBlock slowResult = m_out.anchor(m_out.equal(
+                m_out.constInt64(JSValue::encode(jsBoolean(true))), 
+                vmCall(Int64, m_out.operation(operationHasIndexedProperty), m_callFrame, base, index)));
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            setBoolean(m_out.phi(Int32, checkHoleResult, slowResult));
+            return;
+        }
+        case Array::Double: {
+            LValue base = lowCell(m_node->child1());
+            LValue index = lowInt32(m_node->child2());
+            LValue storage = lowStorage(m_node->child3());
+            
+            IndexedAbstractHeap& heap = m_heaps.indexedDoubleProperties;
+            
+            LBasicBlock checkHole = m_out.newBlock();
+            LBasicBlock slowCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            if (!m_node->arrayMode().isInBounds()) {
+                m_out.branch(
+                    m_out.aboveOrEqual(
+                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
+                    rarely(slowCase), usually(checkHole));
+            } else
+                m_out.jump(checkHole);
+
+            LBasicBlock lastNext = m_out.appendTo(checkHole, slowCase);
+            LValue doubleValue = m_out.loadDouble(baseIndex(heap, storage, index, m_node->child2()));
+            LValue checkHoleResultValue = m_out.doubleEqual(doubleValue, doubleValue);
+            ValueFromBlock checkHoleResult = m_out.anchor(checkHoleResultValue);
+            m_out.branch(checkHoleResultValue, usually(continuation), rarely(slowCase));
+            
+            m_out.appendTo(slowCase, continuation);
+            ValueFromBlock slowResult = m_out.anchor(m_out.equal(
+                m_out.constInt64(JSValue::encode(jsBoolean(true))), 
+                vmCall(Int64, m_out.operation(operationHasIndexedProperty), m_callFrame, base, index)));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            setBoolean(m_out.phi(Int32, checkHoleResult, slowResult));
+            return;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+
+    void compileHasGenericProperty()
+    {
+        LValue base = lowJSValue(m_node->child1());
+        LValue property = lowCell(m_node->child2());
+        setJSValue(vmCall(Int64, m_out.operation(operationHasGenericProperty), m_callFrame, base, property));
+    }
+
+    void compileHasStructureProperty()
+    {
+        LValue base = lowJSValue(m_node->child1());
+        LValue property = lowString(m_node->child2());
+        LValue enumerator = lowCell(m_node->child3());
+
+        LBasicBlock correctStructure = m_out.newBlock();
+        LBasicBlock wrongStructure = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(m_out.notEqual(
+            m_out.load32(base, m_heaps.JSCell_structureID),
+            m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedStructureID)),
+            rarely(wrongStructure), usually(correctStructure));
+
+        LBasicBlock lastNext = m_out.appendTo(correctStructure, wrongStructure);
+        ValueFromBlock correctStructureResult = m_out.anchor(m_out.booleanTrue);
+        m_out.jump(continuation);
+
+        m_out.appendTo(wrongStructure, continuation);
+        ValueFromBlock wrongStructureResult = m_out.anchor(
+            m_out.equal(
+                m_out.constInt64(JSValue::encode(jsBoolean(true))), 
+                vmCall(Int64, m_out.operation(operationHasGenericProperty), m_callFrame, base, property)));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(m_out.phi(Int32, correctStructureResult, wrongStructureResult));
+    }
+
+    void compileGetDirectPname()
+    {
+        LValue base = lowCell(m_graph.varArgChild(m_node, 0));
+        LValue property = lowCell(m_graph.varArgChild(m_node, 1));
+        LValue index = lowInt32(m_graph.varArgChild(m_node, 2));
+        LValue enumerator = lowCell(m_graph.varArgChild(m_node, 3));
+
+        LBasicBlock checkOffset = m_out.newBlock();
+        LBasicBlock inlineLoad = m_out.newBlock();
+        LBasicBlock outOfLineLoad = m_out.newBlock();
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(m_out.notEqual(
+            m_out.load32(base, m_heaps.JSCell_structureID),
+            m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedStructureID)),
+            rarely(slowCase), usually(checkOffset));
+
+        LBasicBlock lastNext = m_out.appendTo(checkOffset, inlineLoad);
+        m_out.branch(m_out.aboveOrEqual(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedInlineCapacity)),
+            unsure(outOfLineLoad), unsure(inlineLoad));
+
+        m_out.appendTo(inlineLoad, outOfLineLoad);
+        ValueFromBlock inlineResult = m_out.anchor(
+            m_out.load64(m_out.baseIndex(m_heaps.properties.atAnyNumber(), 
+                base, m_out.zeroExt(index, Int64), ScaleEight, JSObject::offsetOfInlineStorage())));
+        m_out.jump(continuation);
+
+        m_out.appendTo(outOfLineLoad, slowCase);
+        LValue storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
+        LValue realIndex = m_out.signExt32To64(
+            m_out.neg(m_out.sub(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedInlineCapacity))));
+        int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
+        ValueFromBlock outOfLineResult = m_out.anchor(
+            m_out.load64(m_out.baseIndex(m_heaps.properties.atAnyNumber(), storage, realIndex, ScaleEight, offsetOfFirstProperty)));
+        m_out.jump(continuation);
+
+        m_out.appendTo(slowCase, continuation);
+        ValueFromBlock slowCaseResult = m_out.anchor(
+            vmCall(Int64, m_out.operation(operationGetByVal), m_callFrame, base, property));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, inlineResult, outOfLineResult, slowCaseResult));
+    }
+
+    void compileGetEnumerableLength()
+    {
+        LValue enumerator = lowCell(m_node->child1());
+        setInt32(m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_indexLength));
+    }
+
+    void compileGetPropertyEnumerator()
+    {
+        LValue base = lowCell(m_node->child1());
+        setJSValue(vmCall(Int64, m_out.operation(operationGetPropertyEnumerator), m_callFrame, base));
+    }
+
+    void compileGetEnumeratorStructurePname()
+    {
+        LValue enumerator = lowCell(m_node->child1());
+        LValue index = lowInt32(m_node->child2());
+
+        LBasicBlock inBounds = m_out.newBlock();
+        LBasicBlock outOfBounds = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(m_out.below(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_endStructurePropertyIndex)),
+            usually(inBounds), rarely(outOfBounds));
+
+        LBasicBlock lastNext = m_out.appendTo(inBounds, outOfBounds);
+        LValue storage = m_out.loadPtr(enumerator, m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVector);
+        ValueFromBlock inBoundsResult = m_out.anchor(
+            m_out.loadPtr(m_out.baseIndex(m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVectorContents, storage, m_out.zeroExtPtr(index))));
+        m_out.jump(continuation);
+
+        m_out.appendTo(outOfBounds, continuation);
+        ValueFromBlock outOfBoundsResult = m_out.anchor(m_out.constInt64(ValueNull));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, inBoundsResult, outOfBoundsResult));
+    }
+
+    void compileGetEnumeratorGenericPname()
+    {
+        LValue enumerator = lowCell(m_node->child1());
+        LValue index = lowInt32(m_node->child2());
+
+        LBasicBlock inBounds = m_out.newBlock();
+        LBasicBlock outOfBounds = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(m_out.below(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_endGenericPropertyIndex)),
+            usually(inBounds), rarely(outOfBounds));
+
+        LBasicBlock lastNext = m_out.appendTo(inBounds, outOfBounds);
+        LValue storage = m_out.loadPtr(enumerator, m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVector);
+        ValueFromBlock inBoundsResult = m_out.anchor(
+            m_out.loadPtr(m_out.baseIndex(m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVectorContents, storage, m_out.zeroExtPtr(index))));
+        m_out.jump(continuation);
+
+        m_out.appendTo(outOfBounds, continuation);
+        ValueFromBlock outOfBoundsResult = m_out.anchor(m_out.constInt64(ValueNull));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(Int64, inBoundsResult, outOfBoundsResult));
+    }
+    
+    void compileToIndexString()
+    {
+        LValue index = lowInt32(m_node->child1());
+        setJSValue(vmCall(Int64, m_out.operation(operationToIndexString), m_callFrame, index));
+    }
+    
+    void compileCheckStructureImmediate()
+    {
+        LValue structure = lowCell(m_node->child1());
+        checkStructure(
+            structure, noValue(), BadCache, m_node->structureSet(),
+            [this] (RegisteredStructure structure) {
+                return weakStructure(structure);
+            });
+    }
+    
+    void compileMaterializeNewObject()
+    {
+        ObjectMaterializationData& data = m_node->objectMaterializationData();
+        
+        // Lower the values first, to avoid creating values inside a control flow diamond.
+        
+        Vector<LValue, 8> values;
+        for (unsigned i = 0; i < data.m_properties.size(); ++i) {
+            Edge edge = m_graph.varArgChild(m_node, 1 + i);
+            switch (data.m_properties[i].kind()) {
+            case PublicLengthPLoc:
+            case VectorLengthPLoc:
+                values.append(lowInt32(edge));
+                break;
+            default:
+                values.append(lowJSValue(edge));
+                break;
+            }
+        }
+        
+        RegisteredStructureSet set = m_node->structureSet();
+
+        Vector<LBasicBlock, 1> blocks(set.size());
+        for (unsigned i = set.size(); i--;)
+            blocks[i] = m_out.newBlock();
+        LBasicBlock dummyDefault = m_out.newBlock();
+        LBasicBlock outerContinuation = m_out.newBlock();
+        
+        Vector<SwitchCase, 1> cases(set.size());
+        for (unsigned i = set.size(); i--;)
+            cases[i] = SwitchCase(weakStructure(set.at(i)), blocks[i], Weight(1));
+        m_out.switchInstruction(
+            lowCell(m_graph.varArgChild(m_node, 0)), cases, dummyDefault, Weight(0));
+        
+        LBasicBlock outerLastNext = m_out.m_nextBlock;
+        
+        Vector<ValueFromBlock, 1> results;
+        
+        for (unsigned i = set.size(); i--;) {
+            m_out.appendTo(blocks[i], i + 1 < set.size() ? blocks[i + 1] : dummyDefault);
+            
+            RegisteredStructure structure = set.at(i);
+            
+            LValue object;
+            LValue butterfly;
+            
+            if (structure->outOfLineCapacity() || hasIndexedProperties(structure->indexingType())) {
+                size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
+                MarkedAllocator* cellAllocator = subspaceFor<JSFinalObject>(vm())->allocatorFor(allocationSize);
+                DFG_ASSERT(m_graph, m_node, cellAllocator);
+
+                bool hasIndexingHeader = hasIndexedProperties(structure->indexingType());
+                unsigned indexingHeaderSize = 0;
+                LValue indexingPayloadSizeInBytes = m_out.intPtrZero;
+                LValue vectorLength = m_out.int32Zero;
+                LValue publicLength = m_out.int32Zero;
+                if (hasIndexingHeader) {
+                    indexingHeaderSize = sizeof(IndexingHeader);
+                    for (unsigned i = data.m_properties.size(); i--;) {
+                        PromotedLocationDescriptor descriptor = data.m_properties[i];
+                        switch (descriptor.kind()) {
+                        case PublicLengthPLoc:
+                            publicLength = values[i];
+                            break;
+                        case VectorLengthPLoc:
+                            vectorLength = values[i];
+                            break;
+                        default:
+                            break;
+                        }
+                    }
+                    indexingPayloadSizeInBytes =
+                        m_out.mul(m_out.zeroExtPtr(vectorLength), m_out.intPtrEight);
+                }
+                
+                LValue butterflySize = m_out.add(
+                    m_out.constIntPtr(
+                        structure->outOfLineCapacity() * sizeof(JSValue) + indexingHeaderSize),
+                    indexingPayloadSizeInBytes);
+                
+                LBasicBlock slowPath = m_out.newBlock();
+                LBasicBlock continuation = m_out.newBlock();
+                
+                LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+                
+                ValueFromBlock noButterfly = m_out.anchor(m_out.intPtrZero);
+                
+                LValue startOfStorage = allocateHeapCell(
+                    allocatorForSize(vm().auxiliarySpace, butterflySize, slowPath),
+                    slowPath);
+
+                LValue fastButterflyValue = m_out.add(
+                    startOfStorage,
+                    m_out.constIntPtr(
+                        structure->outOfLineCapacity() * sizeof(JSValue) + sizeof(IndexingHeader)));
+                
+                ValueFromBlock haveButterfly = m_out.anchor(fastButterflyValue);
+                
+                splatWords(
+                    fastButterflyValue,
+                    m_out.constInt32(-structure->outOfLineCapacity() - 1),
+                    m_out.constInt32(-1),
+                    m_out.int64Zero, m_heaps.properties.atAnyNumber());
+
+                m_out.store32(vectorLength, fastButterflyValue, m_heaps.Butterfly_vectorLength);
+                
+                LValue fastObjectValue = allocateObject(
+                    m_out.constIntPtr(cellAllocator), structure, fastButterflyValue, slowPath);
+
+                ValueFromBlock fastObject = m_out.anchor(fastObjectValue);
+                ValueFromBlock fastButterfly = m_out.anchor(fastButterflyValue);
+                m_out.jump(continuation);
+                
+                m_out.appendTo(slowPath, continuation);
+                
+                LValue butterflyValue = m_out.phi(pointerType(), noButterfly, haveButterfly);
+
+                LValue slowObjectValue;
+                if (hasIndexingHeader) {
+                    slowObjectValue = lazySlowPath(
+                        [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                            return createLazyCallGenerator(
+                                operationNewObjectWithButterflyWithIndexingHeaderAndVectorLength,
+                                locations[0].directGPR(), CCallHelpers::TrustedImmPtr(structure.get()),
+                                locations[1].directGPR(), locations[2].directGPR());
+                        },
+                        vectorLength, butterflyValue);
+                } else {
+                    slowObjectValue = lazySlowPath(
+                        [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                            return createLazyCallGenerator(
+                                operationNewObjectWithButterfly, locations[0].directGPR(),
+                                CCallHelpers::TrustedImmPtr(structure.get()), locations[1].directGPR());
+                        },
+                        butterflyValue);
+                }
+                ValueFromBlock slowObject = m_out.anchor(slowObjectValue);
+                ValueFromBlock slowButterfly = m_out.anchor(
+                    m_out.loadPtr(slowObjectValue, m_heaps.JSObject_butterfly));
+                
+                m_out.jump(continuation);
+                
+                m_out.appendTo(continuation, lastNext);
+                
+                object = m_out.phi(pointerType(), fastObject, slowObject);
+                butterfly = m_out.phi(pointerType(), fastButterfly, slowButterfly);
+
+                m_out.store32(publicLength, butterfly, m_heaps.Butterfly_publicLength);
+
+                initializeArrayElements(m_out.constInt32(structure->indexingType()), m_out.int32Zero, vectorLength, butterfly);
+
+                HashMap<int32_t, LValue, DefaultHash<int32_t>::Hash, WTF::UnsignedWithZeroKeyHashTraits<int32_t>> indexMap;
+                Vector<int32_t> indices;
+                for (unsigned i = data.m_properties.size(); i--;) {
+                    PromotedLocationDescriptor descriptor = data.m_properties[i];
+                    if (descriptor.kind() != IndexedPropertyPLoc)
+                        continue;
+                    int32_t index = static_cast<int32_t>(descriptor.info());
+                    
+                    auto result = indexMap.add(index, values[i]);
+                    DFG_ASSERT(m_graph, m_node, result); // Duplicates are illegal.
+
+                    indices.append(index);
+                }
+
+                if (!indices.isEmpty()) {
+                    std::sort(indices.begin(), indices.end());
+                    
+                    Vector<LBasicBlock> blocksWithStores(indices.size());
+                    Vector<LBasicBlock> blocksWithChecks(indices.size());
+                    
+                    for (unsigned i = indices.size(); i--;) {
+                        blocksWithStores[i] = m_out.newBlock();
+                        blocksWithChecks[i] = m_out.newBlock(); // blocksWithChecks[0] is the continuation.
+                    }
+
+                    LBasicBlock indexLastNext = m_out.m_nextBlock;
+                    
+                    for (unsigned i = indices.size(); i--;) {
+                        int32_t index = indices[i];
+                        LValue value = indexMap.get(index);
+                        
+                        m_out.branch(
+                            m_out.below(m_out.constInt32(index), publicLength),
+                            unsure(blocksWithStores[i]), unsure(blocksWithChecks[i]));
+
+                        m_out.appendTo(blocksWithStores[i], blocksWithChecks[i]);
+
+                        // This has to type-check and convert its inputs, but it cannot do so in a
+                        // way that updates AI. That's a bit annoying, but if you think about how
+                        // sinking works, it's actually not a bad thing. We are virtually guaranteed
+                        // that these type checks will not fail, since the type checks that guarded
+                        // the original stores to the array are still somewhere above this point.
+                        Output::StoreType storeType;
+                        IndexedAbstractHeap* heap;
+                        switch (structure->indexingType()) {
+                        case ALL_INT32_INDEXING_TYPES:
+                            // FIXME: This could use the proven type if we had the Edge for the
+                            // value. https://bugs.webkit.org/show_bug.cgi?id=155311
+                            speculate(BadType, noValue(), nullptr, isNotInt32(value));
+                            storeType = Output::Store64;
+                            heap = &m_heaps.indexedInt32Properties;
+                            break;
+
+                        case ALL_DOUBLE_INDEXING_TYPES: {
+                            // FIXME: If the source is ValueRep, we should avoid emitting any
+                            // checks. We could also avoid emitting checks if we had the Edge of
+                            // this value. https://bugs.webkit.org/show_bug.cgi?id=155311
+
+                            LBasicBlock intCase = m_out.newBlock();
+                            LBasicBlock doubleCase = m_out.newBlock();
+                            LBasicBlock continuation = m_out.newBlock();
+
+                            m_out.branch(isInt32(value), unsure(intCase), unsure(doubleCase));
+
+                            LBasicBlock lastNext = m_out.appendTo(intCase, doubleCase);
+
+                            ValueFromBlock intResult =
+                                m_out.anchor(m_out.intToDouble(unboxInt32(value)));
+                            m_out.jump(continuation);
+
+                            m_out.appendTo(doubleCase, continuation);
+
+                            speculate(BadType, noValue(), nullptr, isNumber(value));
+                            ValueFromBlock doubleResult = m_out.anchor(unboxDouble(value));
+                            m_out.jump(continuation);
+
+                            m_out.appendTo(continuation, lastNext);
+                            value = m_out.phi(Double, intResult, doubleResult);
+                            storeType = Output::StoreDouble;
+                            heap = &m_heaps.indexedDoubleProperties;
+                            break;
+                        }
+
+                        case ALL_CONTIGUOUS_INDEXING_TYPES:
+                            storeType = Output::Store64;
+                            heap = &m_heaps.indexedContiguousProperties;
+                            break;
+
+                        default:
+                            DFG_CRASH(m_graph, m_node, "Invalid indexing type");
+                            break;
+                        }
+                        
+                        m_out.store(value, m_out.address(butterfly, heap->at(index)), storeType);
+
+                        m_out.jump(blocksWithChecks[i]);
+                        m_out.appendTo(
+                            blocksWithChecks[i], i ? blocksWithStores[i - 1] : indexLastNext);
+                    }
+                }
+            } else {
+                // In the easy case where we can do a one-shot allocation, we simply allocate the
+                // object to directly have the desired structure.
+                object = allocateObject(structure);
+                butterfly = nullptr; // Don't have one, don't need one.
+            }
+
+            BitVector setInlineOffsets;
+            for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
+                for (unsigned i = data.m_properties.size(); i--;) {
+                    PromotedLocationDescriptor descriptor = data.m_properties[i];
+                    if (descriptor.kind() != NamedPropertyPLoc)
+                        continue;
+                    if (m_graph.identifiers()[descriptor.info()] != entry.key)
+                        continue;
+                    
+                    LValue base;
+                    if (isInlineOffset(entry.offset)) {
+                        setInlineOffsets.set(entry.offset);
+                        base = object;
+                    } else
+                        base = butterfly;
+                    storeProperty(values[i], base, descriptor.info(), entry.offset);
+                    break;
+                }
+            }
+            for (unsigned i = structure->inlineCapacity(); i--;) {
+                if (!setInlineOffsets.get(i))
+                    m_out.store64(m_out.int64Zero, m_out.address(m_heaps.properties.atAnyNumber(), object, offsetRelativeToBase(i)));
+            }
+            
+            results.append(m_out.anchor(object));
+            m_out.jump(outerContinuation);
+        }
+        
+        m_out.appendTo(dummyDefault, outerContinuation);
+        m_out.unreachable();
+        
+        m_out.appendTo(outerContinuation, outerLastNext);
+        setJSValue(m_out.phi(pointerType(), results));
+        mutatorFence();
+    }
+
+    void compileMaterializeCreateActivation()
+    {
+        ObjectMaterializationData& data = m_node->objectMaterializationData();
+
+        Vector<LValue, 8> values;
+        for (unsigned i = 0; i < data.m_properties.size(); ++i)
+            values.append(lowJSValue(m_graph.varArgChild(m_node, 2 + i)));
+
+        LValue scope = lowCell(m_graph.varArgChild(m_node, 1));
+        SymbolTable* table = m_node->castOperand<SymbolTable*>();
+        ASSERT(table == m_graph.varArgChild(m_node, 0)->castConstant<SymbolTable*>());
+        RegisteredStructure structure = m_graph.registerStructure(m_graph.globalObjectFor(m_node->origin.semantic)->activationStructure());
+
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+
+        LValue fastObject = allocateObject<JSLexicalEnvironment>(
+            JSLexicalEnvironment::allocationSize(table), structure, m_out.intPtrZero, slowPath);
+
+        m_out.storePtr(scope, fastObject, m_heaps.JSScope_next);
+        m_out.storePtr(weakPointer(table), fastObject, m_heaps.JSSymbolTableObject_symbolTable);
+
+
+        ValueFromBlock fastResult = m_out.anchor(fastObject);
+        m_out.jump(continuation);
+
+        m_out.appendTo(slowPath, continuation);
+        // We ensure allocation sinking explictly sets bottom values for all field members. 
+        // Therefore, it doesn't matter what JSValue we pass in as the initialization value
+        // because all fields will be overwritten.
+        // FIXME: It may be worth creating an operation that calls a constructor on JSLexicalEnvironment that 
+        // doesn't initialize every slot because we are guaranteed to do that here.
+        LValue callResult = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationCreateActivationDirect, locations[0].directGPR(),
+                    CCallHelpers::TrustedImmPtr(structure.get()), locations[1].directGPR(),
+                    CCallHelpers::TrustedImmPtr(table),
+                    CCallHelpers::TrustedImm64(JSValue::encode(jsUndefined())));
+            }, scope);
+        ValueFromBlock slowResult =  m_out.anchor(callResult);
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        LValue activation = m_out.phi(pointerType(), fastResult, slowResult);
+        RELEASE_ASSERT(data.m_properties.size() == table->scopeSize());
+        for (unsigned i = 0; i < data.m_properties.size(); ++i) {
+            PromotedLocationDescriptor descriptor = data.m_properties[i];
+            ASSERT(descriptor.kind() == ClosureVarPLoc);
+            m_out.store64(
+                values[i], activation,
+                m_heaps.JSEnvironmentRecord_variables[descriptor.info()]);
+        }
+
+        if (validationEnabled()) {
+            // Validate to make sure every slot in the scope has one value.
+            ConcurrentJSLocker locker(table->m_lock);
+            for (auto iter = table->begin(locker), end = table->end(locker); iter != end; ++iter) {
+                bool found = false;
+                for (unsigned i = 0; i < data.m_properties.size(); ++i) {
+                    PromotedLocationDescriptor descriptor = data.m_properties[i];
+                    ASSERT(descriptor.kind() == ClosureVarPLoc);
+                    if (iter->value.scopeOffset().offset() == descriptor.info()) {
+                        found = true;
+                        break;
+                    }
+                }
+                ASSERT_UNUSED(found, found);
+            }
+        }
+
+        mutatorFence();
+        setJSValue(activation);
+    }
+
+    void compileCheckWatchdogTimer()
+    {
+        LBasicBlock timerDidFire = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LValue state = m_out.load8ZeroExt32(m_out.absolute(vm().watchdog()->timerDidFireAddress()));
+        m_out.branch(m_out.isZero32(state),
+            usually(continuation), rarely(timerDidFire));
+
+        LBasicBlock lastNext = m_out.appendTo(timerDidFire, continuation);
+
+        lazySlowPath(
+            [=] (const Vector<Location>&) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(operationHandleWatchdogTimer, InvalidGPRReg);
+            });
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+
+    void compileRegExpExec()
+    {
+        LValue globalObject = lowCell(m_node->child1());
+        
+        if (m_node->child2().useKind() == RegExpObjectUse) {
+            LValue base = lowRegExpObject(m_node->child2());
+            
+            if (m_node->child3().useKind() == StringUse) {
+                LValue argument = lowString(m_node->child3());
+                LValue result = vmCall(
+                    Int64, m_out.operation(operationRegExpExecString), m_callFrame, globalObject,
+                    base, argument);
+                setJSValue(result);
+                return;
+            }
+            
+            LValue argument = lowJSValue(m_node->child3());
+            LValue result = vmCall(
+                Int64, m_out.operation(operationRegExpExec), m_callFrame, globalObject, base,
+                argument);
+            setJSValue(result);
+            return;
+        }
+        
+        LValue base = lowJSValue(m_node->child2());
+        LValue argument = lowJSValue(m_node->child3());
+        LValue result = vmCall(
+            Int64, m_out.operation(operationRegExpExecGeneric), m_callFrame, globalObject, base,
+            argument);
+        setJSValue(result);
+    }
+
+    void compileRegExpTest()
+    {
+        LValue globalObject = lowCell(m_node->child1());
+        
+        if (m_node->child2().useKind() == RegExpObjectUse) {
+            LValue base = lowRegExpObject(m_node->child2());
+            
+            if (m_node->child3().useKind() == StringUse) {
+                LValue argument = lowString(m_node->child3());
+                LValue result = vmCall(
+                    Int32, m_out.operation(operationRegExpTestString), m_callFrame, globalObject,
+                    base, argument);
+                setBoolean(result);
+                return;
+            }
+
+            LValue argument = lowJSValue(m_node->child3());
+            LValue result = vmCall(
+                Int32, m_out.operation(operationRegExpTest), m_callFrame, globalObject, base,
+                argument);
+            setBoolean(result);
+            return;
+        }
+
+        LValue base = lowJSValue(m_node->child2());
+        LValue argument = lowJSValue(m_node->child3());
+        LValue result = vmCall(
+            Int32, m_out.operation(operationRegExpTestGeneric), m_callFrame, globalObject, base,
+            argument);
+        setBoolean(result);
+    }
+
+    void compileNewRegexp()
+    {
+        FrozenValue* regexp = m_node->cellOperand();
+        ASSERT(regexp->cell()->inherits(RegExp::info()));
+        LValue result = vmCall(
+            pointerType(),
+            m_out.operation(operationNewRegexp), m_callFrame,
+            frozenPointer(regexp));
+        
+        setJSValue(result);
+    }
+
+    void compileSetFunctionName()
+    {
+        vmCall(Void, m_out.operation(operationSetFunctionName), m_callFrame,
+            lowCell(m_node->child1()), lowJSValue(m_node->child2()));
+    }
+    
+    void compileStringReplace()
+    {
+        if (m_node->child1().useKind() == StringUse
+            && m_node->child2().useKind() == RegExpObjectUse
+            && m_node->child3().useKind() == StringUse) {
+
+            if (JSString* replace = m_node->child3()->dynamicCastConstant<JSString*>()) {
+                if (!replace->length()) {
+                    LValue string = lowString(m_node->child1());
+                    LValue regExp = lowRegExpObject(m_node->child2());
+
+                    LValue result = vmCall(
+                        Int64, m_out.operation(operationStringProtoFuncReplaceRegExpEmptyStr),
+                        m_callFrame, string, regExp);
+
+                    setJSValue(result);
+                    return;
+                }
+            }
+            
+            LValue string = lowString(m_node->child1());
+            LValue regExp = lowRegExpObject(m_node->child2());
+            LValue replace = lowString(m_node->child3());
+
+            LValue result = vmCall(
+                Int64, m_out.operation(operationStringProtoFuncReplaceRegExpString),
+                m_callFrame, string, regExp, replace);
+
+            setJSValue(result);
+            return;
+        }
+
+        LValue search;
+        if (m_node->child2().useKind() == StringUse)
+            search = lowString(m_node->child2());
+        else
+            search = lowJSValue(m_node->child2());
+
+        LValue result = vmCall(
+            Int64, m_out.operation(operationStringProtoFuncReplaceGeneric), m_callFrame,
+            lowJSValue(m_node->child1()), search,
+            lowJSValue(m_node->child3()));
+
+        setJSValue(result);
+    }
+
+    void compileGetRegExpObjectLastIndex()
+    {
+        setJSValue(m_out.load64(lowRegExpObject(m_node->child1()), m_heaps.RegExpObject_lastIndex));
+    }
+
+    void compileSetRegExpObjectLastIndex()
+    {
+        LValue regExp = lowRegExpObject(m_node->child1());
+        LValue value = lowJSValue(m_node->child2());
+
+        speculate(
+            ExoticObjectMode, noValue(), nullptr,
+            m_out.isZero32(m_out.load8ZeroExt32(regExp, m_heaps.RegExpObject_lastIndexIsWritable)));
+        
+        m_out.store64(value, regExp, m_heaps.RegExpObject_lastIndex);
+    }
+    
+    void compileLogShadowChickenPrologue()
+    {
+        LValue packet = ensureShadowChickenPacket();
+        LValue scope = lowCell(m_node->child1());
+
+        m_out.storePtr(m_callFrame, packet, m_heaps.ShadowChicken_Packet_frame);
+        m_out.storePtr(m_out.loadPtr(addressFor(0)), packet, m_heaps.ShadowChicken_Packet_callerFrame);
+        m_out.storePtr(m_out.loadPtr(payloadFor(CallFrameSlot::callee)), packet, m_heaps.ShadowChicken_Packet_callee);
+        m_out.storePtr(scope, packet, m_heaps.ShadowChicken_Packet_scope);
+    }
+    
+    void compileLogShadowChickenTail()
+    {
+        LValue packet = ensureShadowChickenPacket();
+        LValue thisValue = lowJSValue(m_node->child1());
+        LValue scope = lowCell(m_node->child2());
+        CallSiteIndex callSiteIndex = m_ftlState.jitCode->common.addCodeOrigin(m_node->origin.semantic);
+        
+        m_out.storePtr(m_callFrame, packet, m_heaps.ShadowChicken_Packet_frame);
+        m_out.storePtr(m_out.constIntPtr(bitwise_cast<intptr_t>(ShadowChicken::Packet::tailMarker())), packet, m_heaps.ShadowChicken_Packet_callee);
+        m_out.store64(thisValue, packet, m_heaps.ShadowChicken_Packet_thisValue);
+        m_out.storePtr(scope, packet, m_heaps.ShadowChicken_Packet_scope);
+        // We don't want the CodeBlock to have a weak pointer to itself because
+        // that would cause it to always get collected.
+        m_out.storePtr(m_out.constIntPtr(bitwise_cast<intptr_t>(codeBlock())), packet, m_heaps.ShadowChicken_Packet_codeBlock);
+        m_out.store32(m_out.constInt32(callSiteIndex.bits()), packet, m_heaps.ShadowChicken_Packet_callSiteIndex);
+    }
+
+    void compileRecordRegExpCachedResult()
+    {
+        Edge constructorEdge = m_graph.varArgChild(m_node, 0);
+        Edge regExpEdge = m_graph.varArgChild(m_node, 1);
+        Edge stringEdge = m_graph.varArgChild(m_node, 2);
+        Edge startEdge = m_graph.varArgChild(m_node, 3);
+        Edge endEdge = m_graph.varArgChild(m_node, 4);
+        
+        LValue constructor = lowCell(constructorEdge);
+        LValue regExp = lowCell(regExpEdge);
+        LValue string = lowCell(stringEdge);
+        LValue start = lowInt32(startEdge);
+        LValue end = lowInt32(endEdge);
+
+        m_out.storePtr(regExp, constructor, m_heaps.RegExpConstructor_cachedResult_lastRegExp);
+        m_out.storePtr(string, constructor, m_heaps.RegExpConstructor_cachedResult_lastInput);
+        m_out.store32(start, constructor, m_heaps.RegExpConstructor_cachedResult_result_start);
+        m_out.store32(end, constructor, m_heaps.RegExpConstructor_cachedResult_result_end);
+        m_out.store32As8(
+            m_out.constInt32(0),
+            m_out.address(constructor, m_heaps.RegExpConstructor_cachedResult_reified));
+    }
+    
+    struct ArgumentsLength {
+        ArgumentsLength()
+            : isKnown(false)
+            , known(UINT_MAX)
+            , value(nullptr)
+        {
+        }
+        
+        bool isKnown;
+        unsigned known;
+        LValue value;
+    };
+    ArgumentsLength getArgumentsLength(InlineCallFrame* inlineCallFrame)
+    {
+        ArgumentsLength length;
+
+        if (inlineCallFrame && !inlineCallFrame->isVarargs()) {
+            length.known = inlineCallFrame->arguments.size() - 1;
+            length.isKnown = true;
+            length.value = m_out.constInt32(length.known);
+        } else {
+            length.known = UINT_MAX;
+            length.isKnown = false;
+            
+            VirtualRegister argumentCountRegister;
+            if (!inlineCallFrame)
+                argumentCountRegister = VirtualRegister(CallFrameSlot::argumentCount);
+            else
+                argumentCountRegister = inlineCallFrame->argumentCountRegister;
+            length.value = m_out.sub(m_out.load32(payloadFor(argumentCountRegister)), m_out.int32One);
+        }
+        
+        return length;
+    }
+    
+    ArgumentsLength getArgumentsLength()
+    {
+        return getArgumentsLength(m_node->origin.semantic.inlineCallFrame);
+    }
+    
+    LValue getCurrentCallee()
+    {
+        if (InlineCallFrame* frame = m_node->origin.semantic.inlineCallFrame) {
+            if (frame->isClosureCall)
+                return m_out.loadPtr(addressFor(frame->calleeRecovery.virtualRegister()));
+            return weakPointer(frame->calleeRecovery.constant().asCell());
+        }
+        return m_out.loadPtr(addressFor(CallFrameSlot::callee));
+    }
+    
+    LValue getArgumentsStart(InlineCallFrame* inlineCallFrame, unsigned offset = 0)
+    {
+        VirtualRegister start = AssemblyHelpers::argumentsStart(inlineCallFrame) + offset;
+        return addressFor(start).value();
+    }
+    
+    LValue getArgumentsStart()
+    {
+        return getArgumentsStart(m_node->origin.semantic.inlineCallFrame);
+    }
+    
+    template<typename Functor>
+    void checkStructure(
+        LValue structureDiscriminant, const FormattedValue& formattedValue, ExitKind exitKind,
+        RegisteredStructureSet set, const Functor& weakStructureDiscriminant)
+    {
+        if (set.isEmpty()) {
+            terminate(exitKind);
+            return;
+        }
+
+        if (set.size() == 1) {
+            speculate(
+                exitKind, formattedValue, 0,
+                m_out.notEqual(structureDiscriminant, weakStructureDiscriminant(set[0])));
+            return;
+        }
+        
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
+        for (unsigned i = 0; i < set.size() - 1; ++i) {
+            LBasicBlock nextStructure = m_out.newBlock();
+            m_out.branch(
+                m_out.equal(structureDiscriminant, weakStructureDiscriminant(set[i])),
+                unsure(continuation), unsure(nextStructure));
+            m_out.appendTo(nextStructure);
+        }
+        
+        speculate(
+            exitKind, formattedValue, 0,
+            m_out.notEqual(structureDiscriminant, weakStructureDiscriminant(set.last())));
+        
+        m_out.jump(continuation);
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    LValue numberOrNotCellToInt32(Edge edge, LValue value)
+    {
+        LBasicBlock intCase = m_out.newBlock();
+        LBasicBlock notIntCase = m_out.newBlock();
+        LBasicBlock doubleCase = 0;
+        LBasicBlock notNumberCase = 0;
+        if (edge.useKind() == NotCellUse) {
+            doubleCase = m_out.newBlock();
+            notNumberCase = m_out.newBlock();
+        }
+        LBasicBlock continuation = m_out.newBlock();
+        
+        Vector<ValueFromBlock> results;
+        
+        m_out.branch(isNotInt32(value), unsure(notIntCase), unsure(intCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(intCase, notIntCase);
+        results.append(m_out.anchor(unboxInt32(value)));
+        m_out.jump(continuation);
+        
+        if (edge.useKind() == NumberUse) {
+            m_out.appendTo(notIntCase, continuation);
+            FTL_TYPE_CHECK(jsValueValue(value), edge, SpecBytecodeNumber, isCellOrMisc(value));
+            results.append(m_out.anchor(doubleToInt32(unboxDouble(value))));
+            m_out.jump(continuation);
+        } else {
+            m_out.appendTo(notIntCase, doubleCase);
+            m_out.branch(
+                isCellOrMisc(value, provenType(edge)), unsure(notNumberCase), unsure(doubleCase));
+            
+            m_out.appendTo(doubleCase, notNumberCase);
+            results.append(m_out.anchor(doubleToInt32(unboxDouble(value))));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(notNumberCase, continuation);
+            
+            FTL_TYPE_CHECK(jsValueValue(value), edge, ~SpecCell, isCell(value));
+            
+            LValue specialResult = m_out.select(
+                m_out.equal(value, m_out.constInt64(JSValue::encode(jsBoolean(true)))),
+                m_out.int32One, m_out.int32Zero);
+            results.append(m_out.anchor(specialResult));
+            m_out.jump(continuation);
+        }
+        
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(Int32, results);
+    }
+
+    void checkInferredType(Edge edge, LValue value, const InferredType::Descriptor& type)
+    {
+        // This cannot use FTL_TYPE_CHECK or typeCheck() because it is called partially, as in a node like:
+        //
+        //     MultiPutByOffset(...)
+        //
+        // may be lowered to:
+        //
+        //     switch (object->structure) {
+        //     case 42:
+        //         checkInferredType(..., type1);
+        //         ...
+        //         break;
+        //     case 43:
+        //         checkInferredType(..., type2);
+        //         ...
+        //         break;
+        //     }
+        //
+        // where type1 and type2 are different. Using typeCheck() would mean that the edge would be
+        // filtered by type1 & type2, instead of type1 | type2.
+        
+        switch (type.kind()) {
+        case InferredType::Bottom:
+            speculate(BadType, jsValueValue(value), edge.node(), m_out.booleanTrue);
+            return;
+
+        case InferredType::Boolean:
+            speculate(BadType, jsValueValue(value), edge.node(), isNotBoolean(value, provenType(edge)));
+            return;
+
+        case InferredType::Other:
+            speculate(BadType, jsValueValue(value), edge.node(), isNotOther(value, provenType(edge)));
+            return;
+
+        case InferredType::Int32:
+            speculate(BadType, jsValueValue(value), edge.node(), isNotInt32(value, provenType(edge)));
+            return;
+
+        case InferredType::Number:
+            speculate(BadType, jsValueValue(value), edge.node(), isNotNumber(value, provenType(edge)));
+            return;
+
+        case InferredType::String:
+            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
+            speculate(BadType, jsValueValue(value), edge.node(), isNotString(value, provenType(edge)));
+            return;
+
+        case InferredType::Symbol:
+            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
+            speculate(BadType, jsValueValue(value), edge.node(), isNotSymbol(value, provenType(edge)));
+            return;
+
+        case InferredType::ObjectWithStructure: {
+            RegisteredStructure structure = m_graph.registerStructure(type.structure());
+            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
+            if (!abstractValue(edge).m_structure.isSubsetOf(RegisteredStructureSet(structure))) {
+                speculate(
+                    BadType, jsValueValue(value), edge.node(),
+                    m_out.notEqual(
+                        m_out.load32(value, m_heaps.JSCell_structureID),
+                        weakStructureID(structure)));
+            }
+            return;
+        }
+
+        case InferredType::ObjectWithStructureOrOther: {
+            LBasicBlock cellCase = m_out.newBlock();
+            LBasicBlock notCellCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
+
+            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
+
+            RegisteredStructure structure = m_graph.registerStructure(type.structure());
+            if (!abstractValue(edge).m_structure.isSubsetOf(RegisteredStructureSet(structure))) {
+                speculate(
+                    BadType, jsValueValue(value), edge.node(),
+                    m_out.notEqual(
+                        m_out.load32(value, m_heaps.JSCell_structureID),
+                        weakStructureID(structure)));
+            }
+
+            m_out.jump(continuation);
+
+            m_out.appendTo(notCellCase, continuation);
+
+            speculate(
+                BadType, jsValueValue(value), edge.node(),
+                isNotOther(value, provenType(edge) & ~SpecCell));
+
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            return;
+        }
+
+        case InferredType::Object:
+            speculate(BadType, jsValueValue(value), edge.node(), isNotCell(value, provenType(edge)));
+            speculate(BadType, jsValueValue(value), edge.node(), isNotObject(value, provenType(edge)));
+            return;
+
+        case InferredType::ObjectOrOther: {
+            LBasicBlock cellCase = m_out.newBlock();
+            LBasicBlock notCellCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
+
+            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
+
+            speculate(
+                BadType, jsValueValue(value), edge.node(),
+                isNotObject(value, provenType(edge) & SpecCell));
+
+            m_out.jump(continuation);
+
+            m_out.appendTo(notCellCase, continuation);
+
+            speculate(
+                BadType, jsValueValue(value), edge.node(),
+                isNotOther(value, provenType(edge) & ~SpecCell));
+
+            m_out.jump(continuation);
+
+            m_out.appendTo(continuation, lastNext);
+            return;
+        }
+
+        case InferredType::Top:
+            return;
+        }
+
+        DFG_CRASH(m_graph, m_node, "Bad inferred type");
+    }
+    
+    LValue loadProperty(LValue storage, unsigned identifierNumber, PropertyOffset offset)
+    {
+        return m_out.load64(addressOfProperty(storage, identifierNumber, offset));
+    }
+    
+    void storeProperty(
+        LValue value, LValue storage, unsigned identifierNumber, PropertyOffset offset)
+    {
+        m_out.store64(value, addressOfProperty(storage, identifierNumber, offset));
+    }
+    
+    TypedPointer addressOfProperty(
+        LValue storage, unsigned identifierNumber, PropertyOffset offset)
+    {
+        return m_out.address(
+            m_heaps.properties[identifierNumber], storage, offsetRelativeToBase(offset));
+    }
+    
+    LValue storageForTransition(
+        LValue object, PropertyOffset offset,
+        Structure* previousStructure, Structure* nextStructure)
+    {
+        if (isInlineOffset(offset))
+            return object;
+        
+        if (previousStructure->outOfLineCapacity() == nextStructure->outOfLineCapacity())
+            return m_out.loadPtr(object, m_heaps.JSObject_butterfly);
+        
+        LValue result;
+        if (!previousStructure->outOfLineCapacity())
+            result = allocatePropertyStorage(object, previousStructure);
+        else {
+            result = reallocatePropertyStorage(
+                object, m_out.loadPtr(object, m_heaps.JSObject_butterfly),
+                previousStructure, nextStructure);
+        }
+        
+        nukeStructureAndSetButterfly(result, object);
+        return result;
+    }
+
+    void initializeArrayElements(LValue indexingType, LValue begin, LValue end, LValue butterfly)
+    {
+        
+        if (begin == end)
+            return;
+        
+        if (indexingType->hasInt32()) {
+            IndexingType rawIndexingType = static_cast<IndexingType>(indexingType->asInt32());
+            if (hasUndecided(rawIndexingType))
+                return;
+            IndexedAbstractHeap* heap = m_heaps.forIndexingType(rawIndexingType);
+            DFG_ASSERT(m_graph, m_node, heap);
+            
+            LValue hole;
+            if (hasDouble(rawIndexingType))
+                hole = m_out.constInt64(bitwise_cast<int64_t>(PNaN));
+            else
+                hole = m_out.constInt64(JSValue::encode(JSValue()));
+            
+            splatWords(butterfly, begin, end, hole, heap->atAnyIndex());
+        } else {
+            LValue hole = m_out.select(
+                m_out.equal(m_out.bitAnd(indexingType, m_out.constInt32(IndexingShapeMask)), m_out.constInt32(DoubleShape)),
+                m_out.constInt64(bitwise_cast<int64_t>(PNaN)),
+                m_out.constInt64(JSValue::encode(JSValue())));
+            splatWords(butterfly, begin, end, hole, m_heaps.root);
+        }
+    }
+
+    void splatWords(LValue base, LValue begin, LValue end, LValue value, const AbstractHeap& heap)
+    {
+        const uint64_t unrollingLimit = 10;
+        if (begin->hasInt() && end->hasInt()) {
+            uint64_t beginConst = static_cast<uint64_t>(begin->asInt());
+            uint64_t endConst = static_cast<uint64_t>(end->asInt());
+            
+            if (endConst - beginConst <= unrollingLimit) {
+                for (uint64_t i = beginConst; i < endConst; ++i) {
+                    LValue pointer = m_out.add(base, m_out.constIntPtr(i * sizeof(uint64_t)));
+                    m_out.store64(value, TypedPointer(heap, pointer));
+                }
+                return;
+            }
+        }
+
+        LBasicBlock initLoop = m_out.newBlock();
+        LBasicBlock initDone = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(initLoop);
+        
+        ValueFromBlock originalIndex = m_out.anchor(end);
+        ValueFromBlock originalPointer = m_out.anchor(
+            m_out.add(base, m_out.shl(m_out.signExt32ToPtr(begin), m_out.constInt32(3))));
+        m_out.branch(m_out.notEqual(end, begin), unsure(initLoop), unsure(initDone));
+        
+        m_out.appendTo(initLoop, initDone);
+        LValue index = m_out.phi(Int32, originalIndex);
+        LValue pointer = m_out.phi(pointerType(), originalPointer);
+        
+        m_out.store64(value, TypedPointer(heap, pointer));
+        
+        LValue nextIndex = m_out.sub(index, m_out.int32One);
+        m_out.addIncomingToPhi(index, m_out.anchor(nextIndex));
+        m_out.addIncomingToPhi(pointer, m_out.anchor(m_out.add(pointer, m_out.intPtrEight)));
+        m_out.branch(
+            m_out.notEqual(nextIndex, begin), unsure(initLoop), unsure(initDone));
+        
+        m_out.appendTo(initDone, lastNext);
+    }
+    
+    LValue allocatePropertyStorage(LValue object, Structure* previousStructure)
+    {
+        if (previousStructure->couldHaveIndexingHeader()) {
+            return vmCall(
+                pointerType(),
+                m_out.operation(operationAllocateComplexPropertyStorageWithInitialCapacity),
+                m_callFrame, object);
+        }
+        
+        LValue result = allocatePropertyStorageWithSizeImpl(initialOutOfLineCapacity);
+
+        splatWords(
+            result,
+            m_out.constInt32(-initialOutOfLineCapacity - 1), m_out.constInt32(-1),
+            m_out.int64Zero, m_heaps.properties.atAnyNumber());
+        
+        return result;
+    }
+    
+    LValue reallocatePropertyStorage(
+        LValue object, LValue oldStorage, Structure* previous, Structure* next)
+    {
+        size_t oldSize = previous->outOfLineCapacity();
+        size_t newSize = oldSize * outOfLineGrowthFactor; 
+
+        ASSERT_UNUSED(next, newSize == next->outOfLineCapacity());
+        
+        if (previous->couldHaveIndexingHeader()) {
+            LValue newAllocSize = m_out.constIntPtr(newSize);                    
+            return vmCall(pointerType(), m_out.operation(operationAllocateComplexPropertyStorage), m_callFrame, object, newAllocSize);
+        }
+        
+        LValue result = allocatePropertyStorageWithSizeImpl(newSize);
+
+        ptrdiff_t headerSize = -sizeof(IndexingHeader) - sizeof(void*);
+        ptrdiff_t endStorage = headerSize - static_cast<ptrdiff_t>(oldSize * sizeof(JSValue));
+
+        for (ptrdiff_t offset = headerSize; offset > endStorage; offset -= sizeof(void*)) {
+            LValue loaded = 
+                m_out.loadPtr(m_out.address(m_heaps.properties.atAnyNumber(), oldStorage, offset));
+            m_out.storePtr(loaded, m_out.address(m_heaps.properties.atAnyNumber(), result, offset));
+        }
+        
+        splatWords(
+            result,
+            m_out.constInt32(-newSize - 1), m_out.constInt32(-oldSize - 1),
+            m_out.int64Zero, m_heaps.properties.atAnyNumber());
+        
+        return result;
+    }
+    
+    LValue allocatePropertyStorageWithSizeImpl(size_t sizeInValues)
+    {
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+
+        size_t sizeInBytes = sizeInValues * sizeof(JSValue);
+        MarkedAllocator* allocator = vm().auxiliarySpace.allocatorFor(sizeInBytes);
+        LValue startOfStorage = allocateHeapCell(m_out.constIntPtr(allocator), slowPath);
+        ValueFromBlock fastButterfly = m_out.anchor(
+            m_out.add(m_out.constIntPtr(sizeInBytes + sizeof(IndexingHeader)), startOfStorage));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+        
+        LValue slowButterflyValue;
+        if (sizeInValues == initialOutOfLineCapacity) {
+            slowButterflyValue = lazySlowPath(
+                [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                    return createLazyCallGenerator(
+                        operationAllocateSimplePropertyStorageWithInitialCapacity,
+                        locations[0].directGPR());
+                });
+        } else {
+            slowButterflyValue = lazySlowPath(
+                [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                    return createLazyCallGenerator(
+                        operationAllocateSimplePropertyStorage, locations[0].directGPR(),
+                        CCallHelpers::TrustedImmPtr(sizeInValues));
+                });
+        }
+        ValueFromBlock slowButterfly = m_out.anchor(slowButterflyValue);
+        
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        
+        return m_out.phi(pointerType(), fastButterfly, slowButterfly);
+    }
+    
+    LValue getById(LValue base, AccessType type)
+    {
+        Node* node = m_node;
+        UniquedStringImpl* uid = m_graph.identifiers()[node->identifierNumber()];
+
+        B3::PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendSomeRegister(base);
+        patchpoint->append(m_tagMask, ValueRep::lateReg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::lateReg(GPRInfo::tagTypeNumberRegister));
+
+        // FIXME: If this is a GetByIdFlush, we might get some performance boost if we claim that it
+        // clobbers volatile registers late. It's not necessary for correctness, though, since the
+        // IC code is super smart about saving registers.
+        // https://bugs.webkit.org/show_bug.cgi?id=152848
+        
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(patchpoint);
+
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                CallSiteIndex callSiteIndex =
+                    state->jitCode->common.addUniqueCallSiteIndex(node->origin.semantic);
+
+                // This is the direct exit target for operation calls.
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+                // This is the exit for call IC's created by the getById for getters. We don't have
+                // to do anything weird other than call this, since it will associate the exit with
+                // the callsite index.
+                exceptionHandle->scheduleExitCreationForUnwind(params, callSiteIndex);
+
+                auto generator = Box<JITGetByIdGenerator>::create(
+                    jit.codeBlock(), node->origin.semantic, callSiteIndex,
+                    params.unavailableRegisters(), uid, JSValueRegs(params[1].gpr()),
+                    JSValueRegs(params[0].gpr()), type);
+
+                generator->generateFastPath(jit);
+                CCallHelpers::Label done = jit.label();
+
+                params.addLatePath(
+                    [=] (CCallHelpers& jit) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                        J_JITOperation_ESsiJI optimizationFunction;
+                        if (type == AccessType::Get)
+                            optimizationFunction = operationGetByIdOptimize;
+                        else
+                            optimizationFunction = operationTryGetByIdOptimize;
+
+                        generator->slowPathJump().link(&jit);
+                        CCallHelpers::Label slowPathBegin = jit.label();
+                        CCallHelpers::Call slowPathCall = callOperation(
+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                            exceptions.get(), optimizationFunction, params[0].gpr(),
+                            CCallHelpers::TrustedImmPtr(generator->stubInfo()), params[1].gpr(),
+                            CCallHelpers::TrustedImmPtr(uid)).call();
+                        jit.jump().linkTo(done, &jit);
+
+                        generator->reportSlowPathCall(slowPathBegin, slowPathCall);
+
+                        jit.addLinkTask(
+                            [=] (LinkBuffer& linkBuffer) {
+                                generator->finalize(linkBuffer);
+                            });
+                    });
+            });
+
+        return patchpoint;
+    }
+
+    LValue isFastTypedArray(LValue object)
+    {
+        return m_out.equal(
+            m_out.load32(object, m_heaps.JSArrayBufferView_mode),
+            m_out.constInt32(FastTypedArray));
+    }
+    
+    TypedPointer baseIndex(IndexedAbstractHeap& heap, LValue storage, LValue index, Edge edge, ptrdiff_t offset = 0)
+    {
+        return m_out.baseIndex(
+            heap, storage, m_out.zeroExtPtr(index), provenValue(edge), offset);
+    }
+
+    template<typename IntFunctor, typename DoubleFunctor>
+    void compare(
+        const IntFunctor& intFunctor, const DoubleFunctor& doubleFunctor,
+        C_JITOperation_TT stringIdentFunction,
+        C_JITOperation_B_EJssJss stringFunction,
+        S_JITOperation_EJJ fallbackFunction)
+    {
+        if (m_node->isBinaryUseKind(Int32Use)) {
+            LValue left = lowInt32(m_node->child1());
+            LValue right = lowInt32(m_node->child2());
+            setBoolean(intFunctor(left, right));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(Int52RepUse)) {
+            Int52Kind kind;
+            LValue left = lowWhicheverInt52(m_node->child1(), kind);
+            LValue right = lowInt52(m_node->child2(), kind);
+            setBoolean(intFunctor(left, right));
+            return;
+        }
+        
+        if (m_node->isBinaryUseKind(DoubleRepUse)) {
+            LValue left = lowDouble(m_node->child1());
+            LValue right = lowDouble(m_node->child2());
+            setBoolean(doubleFunctor(left, right));
+            return;
+        }
+
+        if (m_node->isBinaryUseKind(StringIdentUse)) {
+            LValue left = lowStringIdent(m_node->child1());
+            LValue right = lowStringIdent(m_node->child2());
+            setBoolean(m_out.callWithoutSideEffects(Int32, stringIdentFunction, left, right));
+            return;
+        }
+
+        if (m_node->isBinaryUseKind(StringUse)) {
+            LValue left = lowCell(m_node->child1());
+            LValue right = lowCell(m_node->child2());
+            speculateString(m_node->child1(), left);
+            speculateString(m_node->child2(), right);
+
+            LValue result = vmCall(
+                Int32, m_out.operation(stringFunction),
+                m_callFrame, left, right);
+            setBoolean(result);
+            return;
+        }
+
+        DFG_ASSERT(m_graph, m_node, m_node->isBinaryUseKind(UntypedUse));
+        nonSpeculativeCompare(intFunctor, fallbackFunction);
+    }
+
+    void compileToLowerCase()
+    {
+        LBasicBlock notRope = m_out.newBlock();
+        LBasicBlock is8Bit = m_out.newBlock();
+        LBasicBlock loopTop = m_out.newBlock();
+        LBasicBlock loopBody = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LValue string = lowString(m_node->child1());
+        ValueFromBlock startIndex = m_out.anchor(m_out.constInt32(0));
+        ValueFromBlock startIndexForCall = m_out.anchor(m_out.constInt32(0));
+        LValue impl = m_out.loadPtr(string, m_heaps.JSString_value);
+        m_out.branch(m_out.isZero64(impl),
+            unsure(slowPath), unsure(notRope));
+
+        LBasicBlock lastNext = m_out.appendTo(notRope, is8Bit);
+
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load32(impl, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIs8Bit())),
+            unsure(slowPath), unsure(is8Bit));
+
+        m_out.appendTo(is8Bit, loopTop);
+        LValue length = m_out.load32(impl, m_heaps.StringImpl_length);
+        LValue buffer = m_out.loadPtr(impl, m_heaps.StringImpl_data);
+        ValueFromBlock fastResult = m_out.anchor(string);
+        m_out.jump(loopTop);
+
+        m_out.appendTo(loopTop, loopBody);
+        LValue index = m_out.phi(Int32, startIndex);
+        ValueFromBlock indexFromBlock = m_out.anchor(index);
+        m_out.branch(m_out.below(index, length),
+            unsure(loopBody), unsure(continuation));
+
+        m_out.appendTo(loopBody, slowPath);
+
+        LValue byte = m_out.load8ZeroExt32(m_out.baseIndex(m_heaps.characters8, buffer, m_out.zeroExtPtr(index)));
+        LValue isInvalidAsciiRange = m_out.bitAnd(byte, m_out.constInt32(~0x7F));
+        LValue isUpperCase = m_out.belowOrEqual(m_out.sub(byte, m_out.constInt32('A')), m_out.constInt32('Z' - 'A'));
+        LValue isBadCharacter = m_out.bitOr(isInvalidAsciiRange, isUpperCase);
+        m_out.addIncomingToPhi(index, m_out.anchor(m_out.add(index, m_out.int32One)));
+        m_out.branch(isBadCharacter, unsure(slowPath), unsure(loopTop));
+
+        m_out.appendTo(slowPath, continuation);
+        LValue slowPathIndex = m_out.phi(Int32, startIndexForCall, indexFromBlock);
+        ValueFromBlock slowResult = m_out.anchor(vmCall(pointerType(), m_out.operation(operationToLowerCase), m_callFrame, string, slowPathIndex));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        setJSValue(m_out.phi(pointerType(), fastResult, slowResult));
+    }
+
+    void compileResolveScope()
+    {
+        UniquedStringImpl* uid = m_graph.identifiers()[m_node->identifierNumber()];
+        setJSValue(vmCall(pointerType(), m_out.operation(operationResolveScope),
+            m_callFrame, lowCell(m_node->child1()), m_out.constIntPtr(uid)));
+    }
+
+    void compileGetDynamicVar()
+    {
+        UniquedStringImpl* uid = m_graph.identifiers()[m_node->identifierNumber()];
+        setJSValue(vmCall(Int64, m_out.operation(operationGetDynamicVar),
+            m_callFrame, lowCell(m_node->child1()), m_out.constIntPtr(uid), m_out.constInt32(m_node->getPutInfo())));
+    }
+
+    void compilePutDynamicVar()
+    {
+        UniquedStringImpl* uid = m_graph.identifiers()[m_node->identifierNumber()];
+        setJSValue(vmCall(Void, m_out.operation(operationPutDynamicVar),
+            m_callFrame, lowCell(m_node->child1()), lowJSValue(m_node->child2()), m_out.constIntPtr(uid), m_out.constInt32(m_node->getPutInfo())));
+    }
+    
+    void compileUnreachable()
+    {
+        // It's so tempting to assert that AI has proved that this is unreachable. But that's
+        // simply not a requirement of the Unreachable opcode at all. If you emit an opcode that
+        // *you* know will not return, then it's fine to end the basic block with Unreachable
+        // after that opcode. You don't have to also prove to AI that your opcode does not return.
+        // Hence, there is nothing to do here but emit code that will crash, so that we catch
+        // cases where you said Unreachable but you lied.
+        
+        crash();
+    }
+
+    void compileCheckDOM()
+    {
+        LValue cell = lowCell(m_node->child1());
+
+        DOMJIT::Patchpoint* domJIT = m_node->checkDOMPatchpoint();
+
+        PatchpointValue* patchpoint = m_out.patchpoint(Void);
+        patchpoint->appendSomeRegister(cell);
+        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+
+        NodeOrigin origin = m_origin;
+        unsigned osrExitArgumentOffset = patchpoint->numChildren();
+        OSRExitDescriptor* exitDescriptor = appendOSRExitDescriptor(jsValueValue(cell), m_node->child1().node());
+        patchpoint->appendColdAnys(buildExitArguments(exitDescriptor, origin.forExit, jsValueValue(cell)));
+
+        patchpoint->numGPScratchRegisters = domJIT->numGPScratchRegisters;
+        patchpoint->numFPScratchRegisters = domJIT->numFPScratchRegisters;
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+
+        State* state = &m_ftlState;
+        Node* node = m_node;
+        JSValue child1Constant = m_state.forNode(m_node->child1()).value();
+
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                Vector<GPRReg> gpScratch;
+                Vector<FPRReg> fpScratch;
+                Vector<DOMJIT::Value> regs;
+
+                regs.append(DOMJIT::Value(params[0].gpr(), child1Constant));
+
+                for (unsigned i = 0; i < domJIT->numGPScratchRegisters; ++i)
+                    gpScratch.append(params.gpScratch(i));
+
+                for (unsigned i = 0; i < domJIT->numFPScratchRegisters; ++i)
+                    fpScratch.append(params.fpScratch(i));
+
+                RefPtr<OSRExitHandle> handle = exitDescriptor->emitOSRExitLater(*state, BadType, origin, params, osrExitArgumentOffset);
+
+                DOMJITPatchpointParams domJITParams(*state, params, node, nullptr, WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
+                CCallHelpers::JumpList failureCases = domJIT->generator()->run(jit, domJITParams);
+
+                jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                    linkBuffer.link(failureCases, linkBuffer.locationOf(handle->label));
+                });
+            });
+        patchpoint->effects = Effects::forCheck();
+    }
+
+    void compileCallDOM()
+    {
+        const DOMJIT::Signature* signature = m_node->signature();
+
+        // FIXME: We should have a way to call functions with the vector of registers.
+        // https://bugs.webkit.org/show_bug.cgi?id=163099
+        Vector<LValue, JSC_DOMJIT_SIGNATURE_MAX_ARGUMENTS_INCLUDING_THIS> operands;
+
+        unsigned index = 0;
+        DFG_NODE_DO_TO_CHILDREN(m_graph, m_node, [&](Node*, Edge edge) {
+            if (!index)
+                operands.append(lowCell(edge));
+            else {
+                switch (signature->arguments[index - 1]) {
+                case SpecString:
+                    operands.append(lowString(edge));
+                    break;
+                case SpecInt32Only:
+                    operands.append(lowInt32(edge));
+                    break;
+                case SpecBoolean:
+                    operands.append(lowBoolean(edge));
+                    break;
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                    break;
+                }
+            }
+            ++index;
+        });
+
+        unsigned argumentCountIncludingThis = signature->argumentCount + 1;
+        LValue result;
+        switch (argumentCountIncludingThis) {
+        case 1:
+            result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EP>(signature->unsafeFunction)), m_callFrame, operands[0]);
+            break;
+        case 2:
+            result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EPP>(signature->unsafeFunction)), m_callFrame, operands[0], operands[1]);
+            break;
+        case 3:
+            result = vmCall(Int64, m_out.operation(reinterpret_cast<J_JITOperation_EPPP>(signature->unsafeFunction)), m_callFrame, operands[0], operands[1], operands[2]);
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+
+        setJSValue(result);
+    }
+
+    void compileCallDOMGetter()
+    {
+        DOMJIT::CallDOMGetterPatchpoint* domJIT = m_node->callDOMGetterData()->patchpoint;
+
+        Edge& baseEdge = m_node->child1();
+        LValue base = lowCell(baseEdge);
+        JSValue baseConstant = m_state.forNode(baseEdge).value();
+
+        LValue globalObject;
+        JSValue globalObjectConstant;
+        if (domJIT->requireGlobalObject) {
+            Edge& globalObjectEdge = m_node->child2();
+            globalObject = lowCell(globalObjectEdge);
+            globalObjectConstant = m_state.forNode(globalObjectEdge).value();
+        }
+
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendSomeRegister(base);
+        if (domJIT->requireGlobalObject)
+            patchpoint->appendSomeRegister(globalObject);
+        patchpoint->append(m_tagMask, ValueRep::reg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::reg(GPRInfo::tagTypeNumberRegister));
+        RefPtr<PatchpointExceptionHandle> exceptionHandle = preparePatchpointForExceptions(patchpoint);
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        patchpoint->numGPScratchRegisters = domJIT->numGPScratchRegisters;
+        patchpoint->numFPScratchRegisters = domJIT->numFPScratchRegisters;
+        patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
+
+        State* state = &m_ftlState;
+        Node* node = m_node;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                Vector<GPRReg> gpScratch;
+                Vector<FPRReg> fpScratch;
+                Vector<DOMJIT::Value> regs;
+
+                regs.append(JSValueRegs(params[0].gpr()));
+                regs.append(DOMJIT::Value(params[1].gpr(), baseConstant));
+                if (domJIT->requireGlobalObject)
+                    regs.append(DOMJIT::Value(params[2].gpr(), globalObjectConstant));
+
+                for (unsigned i = 0; i < domJIT->numGPScratchRegisters; ++i)
+                    gpScratch.append(params.gpScratch(i));
+
+                for (unsigned i = 0; i < domJIT->numFPScratchRegisters; ++i)
+                    fpScratch.append(params.fpScratch(i));
+
+                Box<CCallHelpers::JumpList> exceptions = exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+                DOMJITPatchpointParams domJITParams(*state, params, node, exceptions, WTFMove(regs), WTFMove(gpScratch), WTFMove(fpScratch));
+                domJIT->generator()->run(jit, domJITParams);
+            });
+        patchpoint->effects = Effects::forCall();
+        setJSValue(patchpoint);
+    }
+    
+    void compareEqObjectOrOtherToObject(Edge leftChild, Edge rightChild)
+    {
+        LValue rightCell = lowCell(rightChild);
+        LValue leftValue = lowJSValue(leftChild, ManualOperandSpeculation);
+        
+        speculateTruthyObject(rightChild, rightCell, SpecObject);
+        
+        LBasicBlock leftCellCase = m_out.newBlock();
+        LBasicBlock leftNotCellCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        m_out.branch(
+            isCell(leftValue, provenType(leftChild)),
+            unsure(leftCellCase), unsure(leftNotCellCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(leftCellCase, leftNotCellCase);
+        speculateTruthyObject(leftChild, leftValue, SpecObject | (~SpecCell));
+        ValueFromBlock cellResult = m_out.anchor(m_out.equal(rightCell, leftValue));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(leftNotCellCase, continuation);
+        FTL_TYPE_CHECK(
+            jsValueValue(leftValue), leftChild, SpecOther | SpecCell, isNotOther(leftValue));
+        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(m_out.phi(Int32, cellResult, notCellResult));
+    }
+    
+    void speculateTruthyObject(Edge edge, LValue cell, SpeculatedType filter)
+    {
+        if (masqueradesAsUndefinedWatchpointIsStillValid()) {
+            FTL_TYPE_CHECK(jsValueValue(cell), edge, filter, isNotObject(cell));
+            return;
+        }
+        
+        FTL_TYPE_CHECK(jsValueValue(cell), edge, filter, isNotObject(cell));
+        speculate(
+            BadType, jsValueValue(cell), edge.node(),
+            m_out.testNonZero32(
+                m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoFlags),
+                m_out.constInt32(MasqueradesAsUndefined)));
+    }
+
+    template<typename IntFunctor>
+    void nonSpeculativeCompare(const IntFunctor& intFunctor, S_JITOperation_EJJ helperFunction)
+    {
+        LValue left = lowJSValue(m_node->child1());
+        LValue right = lowJSValue(m_node->child2());
+        
+        LBasicBlock leftIsInt = m_out.newBlock();
+        LBasicBlock fastPath = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        m_out.branch(isNotInt32(left, provenType(m_node->child1())), rarely(slowPath), usually(leftIsInt));
+        
+        LBasicBlock lastNext = m_out.appendTo(leftIsInt, fastPath);
+        m_out.branch(isNotInt32(right, provenType(m_node->child2())), rarely(slowPath), usually(fastPath));
+        
+        m_out.appendTo(fastPath, slowPath);
+        ValueFromBlock fastResult = m_out.anchor(intFunctor(unboxInt32(left), unboxInt32(right)));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+        ValueFromBlock slowResult = m_out.anchor(m_out.notNull(vmCall(
+            pointerType(), m_out.operation(helperFunction), m_callFrame, left, right)));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        setBoolean(m_out.phi(Int32, fastResult, slowResult));
+    }
+
+    LValue stringsEqual(LValue leftJSString, LValue rightJSString)
+    {
+        LBasicBlock notTriviallyUnequalCase = m_out.newBlock();
+        LBasicBlock notEmptyCase = m_out.newBlock();
+        LBasicBlock leftReadyCase = m_out.newBlock();
+        LBasicBlock rightReadyCase = m_out.newBlock();
+        LBasicBlock left8BitCase = m_out.newBlock();
+        LBasicBlock right8BitCase = m_out.newBlock();
+        LBasicBlock loop = m_out.newBlock();
+        LBasicBlock bytesEqual = m_out.newBlock();
+        LBasicBlock trueCase = m_out.newBlock();
+        LBasicBlock falseCase = m_out.newBlock();
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LValue length = m_out.load32(leftJSString, m_heaps.JSString_length);
+
+        m_out.branch(
+            m_out.notEqual(length, m_out.load32(rightJSString, m_heaps.JSString_length)),
+            unsure(falseCase), unsure(notTriviallyUnequalCase));
+
+        LBasicBlock lastNext = m_out.appendTo(notTriviallyUnequalCase, notEmptyCase);
+
+        m_out.branch(m_out.isZero32(length), unsure(trueCase), unsure(notEmptyCase));
+
+        m_out.appendTo(notEmptyCase, leftReadyCase);
+
+        LValue left = m_out.loadPtr(leftJSString, m_heaps.JSString_value);
+        LValue right = m_out.loadPtr(rightJSString, m_heaps.JSString_value);
+
+        m_out.branch(m_out.notNull(left), usually(leftReadyCase), rarely(slowCase));
+
+        m_out.appendTo(leftReadyCase, rightReadyCase);
+        
+        m_out.branch(m_out.notNull(right), usually(rightReadyCase), rarely(slowCase));
+
+        m_out.appendTo(rightReadyCase, left8BitCase);
+
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load32(left, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIs8Bit())),
+            unsure(slowCase), unsure(left8BitCase));
+
+        m_out.appendTo(left8BitCase, right8BitCase);
+
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load32(right, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIs8Bit())),
+            unsure(slowCase), unsure(right8BitCase));
+
+        m_out.appendTo(right8BitCase, loop);
+
+        LValue leftData = m_out.loadPtr(left, m_heaps.StringImpl_data);
+        LValue rightData = m_out.loadPtr(right, m_heaps.StringImpl_data);
+
+        ValueFromBlock indexAtStart = m_out.anchor(length);
+
+        m_out.jump(loop);
+
+        m_out.appendTo(loop, bytesEqual);
+
+        LValue indexAtLoopTop = m_out.phi(Int32, indexAtStart);
+        LValue indexInLoop = m_out.sub(indexAtLoopTop, m_out.int32One);
+
+        LValue leftByte = m_out.load8ZeroExt32(
+            m_out.baseIndex(m_heaps.characters8, leftData, m_out.zeroExtPtr(indexInLoop)));
+        LValue rightByte = m_out.load8ZeroExt32(
+            m_out.baseIndex(m_heaps.characters8, rightData, m_out.zeroExtPtr(indexInLoop)));
+
+        m_out.branch(m_out.notEqual(leftByte, rightByte), unsure(falseCase), unsure(bytesEqual));
+
+        m_out.appendTo(bytesEqual, trueCase);
+
+        ValueFromBlock indexForNextIteration = m_out.anchor(indexInLoop);
+        m_out.addIncomingToPhi(indexAtLoopTop, indexForNextIteration);
+        m_out.branch(m_out.notZero32(indexInLoop), unsure(loop), unsure(trueCase));
+
+        m_out.appendTo(trueCase, falseCase);
+        
+        ValueFromBlock trueResult = m_out.anchor(m_out.booleanTrue);
+        m_out.jump(continuation);
+
+        m_out.appendTo(falseCase, slowCase);
+
+        ValueFromBlock falseResult = m_out.anchor(m_out.booleanFalse);
+        m_out.jump(continuation);
+
+        m_out.appendTo(slowCase, continuation);
+
+        LValue slowResultValue = vmCall(
+            Int64, m_out.operation(operationCompareStringEq), m_callFrame,
+            leftJSString, rightJSString);
+        ValueFromBlock slowResult = m_out.anchor(unboxBoolean(slowResultValue));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(Int32, trueResult, falseResult, slowResult);
+    }
+
+    enum ScratchFPRUsage {
+        DontNeedScratchFPR,
+        NeedScratchFPR
+    };
+    template<typename BinaryArithOpGenerator, ScratchFPRUsage scratchFPRUsage = DontNeedScratchFPR>
+    void emitBinarySnippet(J_JITOperation_EJJ slowPathFunction)
+    {
+        Node* node = m_node;
+        
+        LValue left = lowJSValue(node->child1());
+        LValue right = lowJSValue(node->child2());
+
+        SnippetOperand leftOperand(m_state.forNode(node->child1()).resultType());
+        SnippetOperand rightOperand(m_state.forNode(node->child2()).resultType());
+            
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendSomeRegister(left);
+        patchpoint->appendSomeRegister(right);
+        patchpoint->append(m_tagMask, ValueRep::lateReg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::lateReg(GPRInfo::tagTypeNumberRegister));
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(patchpoint);
+        patchpoint->numGPScratchRegisters = 1;
+        patchpoint->numFPScratchRegisters = 2;
+        if (scratchFPRUsage == NeedScratchFPR)
+            patchpoint->numFPScratchRegisters++;
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+
+                auto generator = Box<BinaryArithOpGenerator>::create(
+                    leftOperand, rightOperand, JSValueRegs(params[0].gpr()),
+                    JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()),
+                    params.fpScratch(0), params.fpScratch(1), params.gpScratch(0),
+                    scratchFPRUsage == NeedScratchFPR ? params.fpScratch(2) : InvalidFPRReg);
+
+                generator->generateFastPath(jit);
+
+                if (generator->didEmitFastPath()) {
+                    generator->endJumpList().link(&jit);
+                    CCallHelpers::Label done = jit.label();
+                    
+                    params.addLatePath(
+                        [=] (CCallHelpers& jit) {
+                            AllowMacroScratchRegisterUsage allowScratch(jit);
+                            
+                            generator->slowPathJumpList().link(&jit);
+                            callOperation(
+                                *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                                exceptions.get(), slowPathFunction, params[0].gpr(),
+                                params[1].gpr(), params[2].gpr());
+                            jit.jump().linkTo(done, &jit);
+                        });
+                } else {
+                    callOperation(
+                        *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                        exceptions.get(), slowPathFunction, params[0].gpr(), params[1].gpr(),
+                        params[2].gpr());
+                }
+            });
+
+        setJSValue(patchpoint);
+    }
+
+    template<typename BinaryBitOpGenerator>
+    void emitBinaryBitOpSnippet(J_JITOperation_EJJ slowPathFunction)
+    {
+        Node* node = m_node;
+        
+        LValue left = lowJSValue(node->child1());
+        LValue right = lowJSValue(node->child2());
+
+        SnippetOperand leftOperand(m_state.forNode(node->child1()).resultType());
+        SnippetOperand rightOperand(m_state.forNode(node->child2()).resultType());
+            
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendSomeRegister(left);
+        patchpoint->appendSomeRegister(right);
+        patchpoint->append(m_tagMask, ValueRep::lateReg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::lateReg(GPRInfo::tagTypeNumberRegister));
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(patchpoint);
+        patchpoint->numGPScratchRegisters = 1;
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                    
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+                    
+                auto generator = Box<BinaryBitOpGenerator>::create(
+                    leftOperand, rightOperand, JSValueRegs(params[0].gpr()),
+                    JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()), params.gpScratch(0));
+
+                generator->generateFastPath(jit);
+                generator->endJumpList().link(&jit);
+                CCallHelpers::Label done = jit.label();
+
+                params.addLatePath(
+                    [=] (CCallHelpers& jit) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+                            
+                        generator->slowPathJumpList().link(&jit);
+                        callOperation(
+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                            exceptions.get(), slowPathFunction, params[0].gpr(),
+                            params[1].gpr(), params[2].gpr());
+                        jit.jump().linkTo(done, &jit);
+                    });
+            });
+
+        setJSValue(patchpoint);
+    }
+
+    void emitRightShiftSnippet(JITRightShiftGenerator::ShiftType shiftType)
+    {
+        Node* node = m_node;
+        
+        // FIXME: Make this do exceptions.
+        // https://bugs.webkit.org/show_bug.cgi?id=151686
+            
+        LValue left = lowJSValue(node->child1());
+        LValue right = lowJSValue(node->child2());
+
+        SnippetOperand leftOperand(m_state.forNode(node->child1()).resultType());
+        SnippetOperand rightOperand(m_state.forNode(node->child2()).resultType());
+            
+        PatchpointValue* patchpoint = m_out.patchpoint(Int64);
+        patchpoint->appendSomeRegister(left);
+        patchpoint->appendSomeRegister(right);
+        patchpoint->append(m_tagMask, ValueRep::lateReg(GPRInfo::tagMaskRegister));
+        patchpoint->append(m_tagTypeNumber, ValueRep::lateReg(GPRInfo::tagTypeNumberRegister));
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(patchpoint);
+        patchpoint->numGPScratchRegisters = 1;
+        patchpoint->numFPScratchRegisters = 1;
+        patchpoint->clobber(RegisterSet::macroScratchRegisters());
+        patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
+        State* state = &m_ftlState;
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                    
+                Box<CCallHelpers::JumpList> exceptions =
+                    exceptionHandle->scheduleExitCreation(params)->jumps(jit);
+                    
+                auto generator = Box<JITRightShiftGenerator>::create(
+                    leftOperand, rightOperand, JSValueRegs(params[0].gpr()),
+                    JSValueRegs(params[1].gpr()), JSValueRegs(params[2].gpr()),
+                    params.fpScratch(0), params.gpScratch(0), InvalidFPRReg, shiftType);
+
+                generator->generateFastPath(jit);
+                generator->endJumpList().link(&jit);
+                CCallHelpers::Label done = jit.label();
+
+                params.addLatePath(
+                    [=] (CCallHelpers& jit) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+                            
+                        generator->slowPathJumpList().link(&jit);
+
+                        J_JITOperation_EJJ slowPathFunction =
+                            shiftType == JITRightShiftGenerator::SignedShift
+                            ? operationValueBitRShift : operationValueBitURShift;
+                        
+                        callOperation(
+                            *state, params.unavailableRegisters(), jit, node->origin.semantic,
+                            exceptions.get(), slowPathFunction, params[0].gpr(),
+                            params[1].gpr(), params[2].gpr());
+                        jit.jump().linkTo(done, &jit);
+                    });
+            });
+
+        setJSValue(patchpoint);
+    }
+
+    LValue allocateHeapCell(LValue allocator, LBasicBlock slowPath)
+    {
+        MarkedAllocator* actualAllocator = nullptr;
+        if (allocator->hasIntPtr())
+            actualAllocator = bitwise_cast<MarkedAllocator*>(allocator->asIntPtr());
+        
+        if (!actualAllocator) {
+            // This means that either we know that the allocator is null or we don't know what the
+            // allocator is. In either case, we need the null check.
+            LBasicBlock haveAllocator = m_out.newBlock();
+            LBasicBlock lastNext = m_out.insertNewBlocksBefore(haveAllocator);
+            m_out.branch(allocator, usually(haveAllocator), rarely(slowPath));
+            m_out.appendTo(haveAllocator, lastNext);
+        }
+        
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
+        
+        PatchpointValue* patchpoint = m_out.patchpoint(pointerType());
+        patchpoint->effects.terminal = true;
+        patchpoint->appendSomeRegister(allocator);
+        patchpoint->numGPScratchRegisters++;
+        patchpoint->resultConstraint = ValueRep::SomeEarlyRegister;
+        
+        m_out.appendSuccessor(usually(continuation));
+        m_out.appendSuccessor(rarely(slowPath));
+        
+        patchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                CCallHelpers::JumpList jumpToSlowPath;
+                
+                // We use a patchpoint to emit the allocation path because whenever we mess with
+                // allocation paths, we already reason about them at the machine code level. We know
+                // exactly what instruction sequence we want. We're confident that no compiler
+                // optimization could make this code better. So, it's best to have the code in
+                // AssemblyHelpers::emitAllocate(). That way, the same optimized path is shared by
+                // all of the compiler tiers.
+                jit.emitAllocateWithNonNullAllocator(
+                    params[0].gpr(), actualAllocator, params[1].gpr(), params.gpScratch(0),
+                    jumpToSlowPath);
+                
+                CCallHelpers::Jump jumpToSuccess;
+                if (!params.fallsThroughToSuccessor(0))
+                    jumpToSuccess = jit.jump();
+                
+                Vector<Box<CCallHelpers::Label>> labels = params.successorLabels();
+                
+                params.addLatePath(
+                    [=] (CCallHelpers& jit) {
+                        jumpToSlowPath.linkTo(*labels[1], &jit);
+                        if (jumpToSuccess.isSet())
+                            jumpToSuccess.linkTo(*labels[0], &jit);
+                    });
+            });
+        
+        m_out.appendTo(continuation, lastNext);
+        return patchpoint;
+    }
+    
+    void storeStructure(LValue object, Structure* structure)
+    {
+        m_out.store32(m_out.constInt32(structure->id()), object, m_heaps.JSCell_structureID);
+        m_out.store32(
+            m_out.constInt32(structure->objectInitializationBlob()),
+            object, m_heaps.JSCell_usefulBytes);
+    }
+
+    void storeStructure(LValue object, LValue structure)
+    {
+        if (structure->hasIntPtr()) {
+            storeStructure(object, bitwise_cast<Structure*>(structure->asIntPtr()));
+            return;
+        }
+
+        LValue id = m_out.load32(structure, m_heaps.Structure_structureID);
+        m_out.store32(id, object, m_heaps.JSCell_structureID);
+
+        LValue blob = m_out.load32(structure, m_heaps.Structure_indexingTypeIncludingHistory);
+        m_out.store32(blob, object, m_heaps.JSCell_usefulBytes);
+    }
+
+    template <typename StructureType>
+    LValue allocateCell(LValue allocator, StructureType structure, LBasicBlock slowPath)
+    {
+        LValue result = allocateHeapCell(allocator, slowPath);
+        storeStructure(result, structure);
+        return result;
+    }
+
+    LValue allocateObject(LValue allocator, RegisteredStructure structure, LValue butterfly, LBasicBlock slowPath)
+    {
+        return allocateObject(allocator, weakStructure(structure), butterfly, slowPath);
+    }
+
+    LValue allocateObject(LValue allocator, LValue structure, LValue butterfly, LBasicBlock slowPath)
+    {
+        LValue result = allocateCell(allocator, structure, slowPath);
+        if (structure->hasIntPtr()) {
+            splatWords(
+                result,
+                m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8),
+                m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8 + bitwise_cast<Structure*>(structure->asIntPtr())->inlineCapacity()),
+                m_out.int64Zero,
+                m_heaps.properties.atAnyNumber());
+        } else {
+            LValue end = m_out.add(
+                m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8),
+                m_out.load8ZeroExt32(structure, m_heaps.Structure_inlineCapacity));
+            splatWords(
+                result,
+                m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8),
+                end,
+                m_out.int64Zero,
+                m_heaps.properties.atAnyNumber());
+        }
+        
+        m_out.storePtr(butterfly, result, m_heaps.JSObject_butterfly);
+        return result;
+    }
+    
+    template<typename ClassType, typename StructureType>
+    LValue allocateObject(
+        size_t size, StructureType structure, LValue butterfly, LBasicBlock slowPath)
+    {
+        MarkedAllocator* allocator = subspaceFor<ClassType>(vm())->allocatorFor(size);
+        return allocateObject(m_out.constIntPtr(allocator), structure, butterfly, slowPath);
+    }
+    
+    template<typename ClassType, typename StructureType>
+    LValue allocateObject(StructureType structure, LValue butterfly, LBasicBlock slowPath)
+    {
+        return allocateObject<ClassType>(
+            ClassType::allocationSize(0), structure, butterfly, slowPath);
+    }
+    
+    LValue allocatorForSize(LValue subspace, LValue size, LBasicBlock slowPath)
+    {
+        static_assert(!(MarkedSpace::sizeStep & (MarkedSpace::sizeStep - 1)), "MarkedSpace::sizeStep must be a power of two.");
+        
+        // Try to do some constant-folding here.
+        if (subspace->hasIntPtr() && size->hasIntPtr()) {
+            Subspace* actualSubspace = bitwise_cast<Subspace*>(subspace->asIntPtr());
+            size_t actualSize = size->asIntPtr();
+            
+            MarkedAllocator* actualAllocator = actualSubspace->allocatorFor(actualSize);
+            if (!actualAllocator) {
+                LBasicBlock continuation = m_out.newBlock();
+                LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
+                m_out.jump(slowPath);
+                m_out.appendTo(continuation, lastNext);
+                return m_out.intPtrZero;
+            }
+            
+            return m_out.constIntPtr(actualAllocator);
+        }
+        
+        unsigned stepShift = getLSBSet(MarkedSpace::sizeStep);
+        
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
+        
+        LValue sizeClassIndex = m_out.lShr(
+            m_out.add(size, m_out.constIntPtr(MarkedSpace::sizeStep - 1)),
+            m_out.constInt32(stepShift));
+        
+        m_out.branch(
+            m_out.above(sizeClassIndex, m_out.constIntPtr(MarkedSpace::largeCutoff >> stepShift)),
+            rarely(slowPath), usually(continuation));
+        
+        m_out.appendTo(continuation, lastNext);
+        
+        return m_out.loadPtr(
+            m_out.baseIndex(
+                m_heaps.Subspace_allocatorForSizeStep,
+                subspace, m_out.sub(sizeClassIndex, m_out.intPtrOne)));
+    }
+    
+    LValue allocatorForSize(Subspace& subspace, LValue size, LBasicBlock slowPath)
+    {
+        return allocatorForSize(m_out.constIntPtr(&subspace), size, slowPath);
+    }
+    
+    template<typename ClassType>
+    LValue allocateVariableSizedObject(
+        LValue size, RegisteredStructure structure, LValue butterfly, LBasicBlock slowPath)
+    {
+        LValue allocator = allocatorForSize(
+            *subspaceFor<ClassType>(vm()), size, slowPath);
+        return allocateObject(allocator, structure, butterfly, slowPath);
+    }
+
+    template<typename ClassType>
+    LValue allocateVariableSizedCell(
+        LValue size, Structure* structure, LBasicBlock slowPath)
+    {
+        LValue allocator = allocatorForSize(
+            *subspaceFor<ClassType>(vm()), size, slowPath);
+        return allocateCell(allocator, structure, slowPath);
+    }
+    
+    LValue allocateObject(RegisteredStructure structure)
+    {
+        size_t allocationSize = JSFinalObject::allocationSize(structure.get()->inlineCapacity());
+        MarkedAllocator* allocator = subspaceFor<JSFinalObject>(vm())->allocatorFor(allocationSize);
+        
+        // FIXME: If the allocator is null, we could simply emit a normal C call to the allocator
+        // instead of putting it on the slow path.
+        // https://bugs.webkit.org/show_bug.cgi?id=161062
+        
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+        
+        ValueFromBlock fastResult = m_out.anchor(allocateObject(
+            m_out.constIntPtr(allocator), structure, m_out.intPtrZero, slowPath));
+        
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+
+        LValue slowResultValue = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationNewObject, locations[0].directGPR(),
+                    CCallHelpers::TrustedImmPtr(structure.get()));
+            });
+        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(pointerType(), fastResult, slowResult);
+    }
+    
+    struct ArrayValues {
+        ArrayValues()
+            : array(0)
+            , butterfly(0)
+        {
+        }
+        
+        ArrayValues(LValue array, LValue butterfly)
+            : array(array)
+            , butterfly(butterfly)
+        {
+        }
+        
+        LValue array;
+        LValue butterfly;
+    };
+
+    ArrayValues allocateJSArray(LValue publicLength, LValue structure, LValue indexingType, bool shouldInitializeElements = true, bool shouldLargeArraySizeCreateArrayStorage = true)
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        if (indexingType->hasInt32()) {
+            IndexingType type = static_cast<IndexingType>(indexingType->asInt32());
+            ASSERT_UNUSED(type,
+                hasUndecided(type)
+                || hasInt32(type)
+                || hasDouble(type)
+                || hasContiguous(type));
+        }
+
+        LBasicBlock fastCase = m_out.newBlock();
+        LBasicBlock largeCase = m_out.newBlock();
+        LBasicBlock failCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        LBasicBlock slowCase = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(fastCase);
+        
+        ValueFromBlock noButterfly = m_out.anchor(m_out.intPtrZero);
+        
+        LValue predicate;
+        if (shouldLargeArraySizeCreateArrayStorage)
+            predicate = m_out.aboveOrEqual(publicLength, m_out.constInt32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
+        else
+            predicate = m_out.booleanFalse;
+        
+        m_out.branch(predicate, rarely(largeCase), usually(fastCase));
+        
+        m_out.appendTo(fastCase, largeCase);
+
+        LValue vectorLength = nullptr;
+        if (publicLength->hasInt32() && structure->hasIntPtr()) {
+            unsigned publicLengthConst = static_cast<unsigned>(publicLength->asInt32());
+            if (publicLengthConst <= MAX_STORAGE_VECTOR_LENGTH) {
+                vectorLength = m_out.constInt32(
+                    Butterfly::optimalContiguousVectorLength(
+                        bitwise_cast<Structure*>(structure->asIntPtr())->outOfLineCapacity(), publicLengthConst));
+            }
+        }
+        
+        if (!vectorLength) {
+            // We don't compute the optimal vector length for new Array(blah) where blah is not
+            // statically known, since the compute effort of doing it here is probably not worth it.
+            vectorLength = publicLength;
+        }
+            
+        LValue payloadSize =
+            m_out.shl(m_out.zeroExt(vectorLength, pointerType()), m_out.constIntPtr(3));
+            
+        LValue butterflySize = m_out.add(
+            payloadSize, m_out.constIntPtr(sizeof(IndexingHeader)));
+            
+        LValue allocator = allocatorForSize(vm().auxiliarySpace, butterflySize, failCase);
+        LValue startOfStorage = allocateHeapCell(allocator, failCase);
+            
+        LValue butterfly = m_out.add(startOfStorage, m_out.constIntPtr(sizeof(IndexingHeader)));
+        
+        m_out.store32(publicLength, butterfly, m_heaps.Butterfly_publicLength);
+        m_out.store32(vectorLength, butterfly, m_heaps.Butterfly_vectorLength);
+    
+        initializeArrayElements(
+            indexingType,
+            shouldInitializeElements ? m_out.int32Zero : publicLength, vectorLength,
+            butterfly);
+        
+        ValueFromBlock haveButterfly = m_out.anchor(butterfly);
+        
+        LValue object = allocateObject<JSArray>(structure, butterfly, failCase);
+
+        ValueFromBlock fastResult = m_out.anchor(object);
+        ValueFromBlock fastButterfly = m_out.anchor(butterfly);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(largeCase, failCase);
+        ValueFromBlock largeStructure = m_out.anchor(
+            weakStructure(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))));
+        m_out.jump(slowCase);
+        
+        m_out.appendTo(failCase, slowCase);
+        ValueFromBlock failStructure = m_out.anchor(structure);
+        m_out.jump(slowCase);
+        
+        m_out.appendTo(slowCase, continuation);
+        LValue structureValue = m_out.phi(pointerType(), largeStructure, failStructure);
+        LValue butterflyValue = m_out.phi(pointerType(), noButterfly, haveButterfly);
+
+        LValue slowResultValue = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationNewArrayWithSize, locations[0].directGPR(),
+                    locations[1].directGPR(), locations[2].directGPR(), locations[3].directGPR());
+            },
+            structureValue, publicLength, butterflyValue);
+        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
+        ValueFromBlock slowButterfly = m_out.anchor(
+            m_out.loadPtr(slowResultValue, m_heaps.JSObject_butterfly));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        return ArrayValues(
+            m_out.phi(pointerType(), fastResult, slowResult),
+            m_out.phi(pointerType(), fastButterfly, slowButterfly));
+    }
+    
+    ArrayValues allocateUninitializedContiguousJSArray(LValue publicLength, RegisteredStructure structure)
+    {
+        bool shouldInitializeElements = false;
+        bool shouldLargeArraySizeCreateArrayStorage = false;
+        return allocateJSArray(
+            publicLength, weakStructure(structure), m_out.constInt32(structure->indexingType()), shouldInitializeElements,
+            shouldLargeArraySizeCreateArrayStorage);
+    }
+    
+    LValue ensureShadowChickenPacket()
+    {
+        LBasicBlock slowCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        TypedPointer addressOfLogCursor = m_out.absolute(vm().shadowChicken().addressOfLogCursor());
+        LValue logCursor = m_out.loadPtr(addressOfLogCursor);
+        
+        ValueFromBlock fastResult = m_out.anchor(logCursor);
+        
+        m_out.branch(
+            m_out.below(logCursor, m_out.constIntPtr(vm().shadowChicken().logEnd())),
+            usually(continuation), rarely(slowCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(slowCase, continuation);
+        
+        vmCall(Void, m_out.operation(operationProcessShadowChickenLog), m_callFrame);
+        
+        ValueFromBlock slowResult = m_out.anchor(m_out.loadPtr(addressOfLogCursor));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        LValue result = m_out.phi(pointerType(), fastResult, slowResult);
+        
+        m_out.storePtr(
+            m_out.add(result, m_out.constIntPtr(sizeof(ShadowChicken::Packet))),
+            addressOfLogCursor);
+        
+        return result;
+    }
+    
+    LValue boolify(Edge edge)
+    {
+        switch (edge.useKind()) {
+        case BooleanUse:
+        case KnownBooleanUse:
+            return lowBoolean(edge);
+        case Int32Use:
+            return m_out.notZero32(lowInt32(edge));
+        case DoubleRepUse:
+            return m_out.doubleNotEqualAndOrdered(lowDouble(edge), m_out.doubleZero);
+        case ObjectOrOtherUse:
+            return m_out.logicalNot(
+                equalNullOrUndefined(
+                    edge, CellCaseSpeculatesObject, SpeculateNullOrUndefined,
+                    ManualOperandSpeculation));
+        case StringUse: {
+            LValue stringValue = lowString(edge);
+            LValue length = m_out.load32NonNegative(stringValue, m_heaps.JSString_length);
+            return m_out.notEqual(length, m_out.int32Zero);
+        }
+        case StringOrOtherUse: {
+            LValue value = lowJSValue(edge, ManualOperandSpeculation);
+
+            LBasicBlock cellCase = m_out.newBlock();
+            LBasicBlock notCellCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+
+            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
+            
+            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
+            
+            FTL_TYPE_CHECK(jsValueValue(value), edge, (~SpecCell) | SpecString, isNotString(value));
+            LValue length = m_out.load32NonNegative(value, m_heaps.JSString_length);
+            ValueFromBlock cellResult = m_out.anchor(m_out.notEqual(length, m_out.int32Zero));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(notCellCase, continuation);
+            
+            FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
+            ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
+            m_out.jump(continuation);
+            m_out.appendTo(continuation, lastNext);
+
+            return m_out.phi(Int32, cellResult, notCellResult);
+        }
+        case UntypedUse: {
+            LValue value = lowJSValue(edge);
+            
+            // Implements the following control flow structure:
+            // if (value is cell) {
+            //     if (value is string)
+            //         result = !!value->length
+            //     else {
+            //         do evil things for masquerades-as-undefined
+            //         result = true
+            //     }
+            // } else if (value is int32) {
+            //     result = !!unboxInt32(value)
+            // } else if (value is number) {
+            //     result = !!unboxDouble(value)
+            // } else {
+            //     result = value == jsTrue
+            // }
+            
+            LBasicBlock cellCase = m_out.newBlock();
+            LBasicBlock stringCase = m_out.newBlock();
+            LBasicBlock notStringCase = m_out.newBlock();
+            LBasicBlock notCellCase = m_out.newBlock();
+            LBasicBlock int32Case = m_out.newBlock();
+            LBasicBlock notInt32Case = m_out.newBlock();
+            LBasicBlock doubleCase = m_out.newBlock();
+            LBasicBlock notDoubleCase = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            
+            Vector<ValueFromBlock> results;
+            
+            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
+            
+            LBasicBlock lastNext = m_out.appendTo(cellCase, stringCase);
+            m_out.branch(
+                isString(value, provenType(edge) & SpecCell),
+                unsure(stringCase), unsure(notStringCase));
+            
+            m_out.appendTo(stringCase, notStringCase);
+            LValue nonEmptyString = m_out.notZero32(
+                m_out.load32NonNegative(value, m_heaps.JSString_length));
+            results.append(m_out.anchor(nonEmptyString));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(notStringCase, notCellCase);
+            LValue isTruthyObject;
+            if (masqueradesAsUndefinedWatchpointIsStillValid())
+                isTruthyObject = m_out.booleanTrue;
+            else {
+                LBasicBlock masqueradesCase = m_out.newBlock();
+                
+                results.append(m_out.anchor(m_out.booleanTrue));
+                
+                m_out.branch(
+                    m_out.testIsZero32(
+                        m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoFlags),
+                        m_out.constInt32(MasqueradesAsUndefined)),
+                    usually(continuation), rarely(masqueradesCase));
+                
+                m_out.appendTo(masqueradesCase);
+                
+                isTruthyObject = m_out.notEqual(
+                    weakPointer(m_graph.globalObjectFor(m_node->origin.semantic)),
+                    m_out.loadPtr(loadStructure(value), m_heaps.Structure_globalObject));
+            }
+            results.append(m_out.anchor(isTruthyObject));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(notCellCase, int32Case);
+            m_out.branch(
+                isInt32(value, provenType(edge) & ~SpecCell),
+                unsure(int32Case), unsure(notInt32Case));
+            
+            m_out.appendTo(int32Case, notInt32Case);
+            results.append(m_out.anchor(m_out.notZero32(unboxInt32(value))));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(notInt32Case, doubleCase);
+            m_out.branch(
+                isNumber(value, provenType(edge) & ~SpecCell),
+                unsure(doubleCase), unsure(notDoubleCase));
+            
+            m_out.appendTo(doubleCase, notDoubleCase);
+            LValue doubleIsTruthy = m_out.doubleNotEqualAndOrdered(
+                unboxDouble(value), m_out.constDouble(0));
+            results.append(m_out.anchor(doubleIsTruthy));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(notDoubleCase, continuation);
+            LValue miscIsTruthy = m_out.equal(
+                value, m_out.constInt64(JSValue::encode(jsBoolean(true))));
+            results.append(m_out.anchor(miscIsTruthy));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            return m_out.phi(Int32, results);
+        }
+        default:
+            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            return 0;
+        }
+    }
+    
+    enum StringOrObjectMode {
+        AllCellsAreFalse,
+        CellCaseSpeculatesObject
+    };
+    enum EqualNullOrUndefinedMode {
+        EqualNull,
+        EqualUndefined,
+        EqualNullOrUndefined,
+        SpeculateNullOrUndefined
+    };
+    LValue equalNullOrUndefined(
+        Edge edge, StringOrObjectMode cellMode, EqualNullOrUndefinedMode primitiveMode,
+        OperandSpeculationMode operandMode = AutomaticOperandSpeculation)
+    {
+        bool validWatchpoint = masqueradesAsUndefinedWatchpointIsStillValid();
+        
+        LValue value = lowJSValue(edge, operandMode);
+        
+        LBasicBlock cellCase = m_out.newBlock();
+        LBasicBlock primitiveCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        m_out.branch(isNotCell(value, provenType(edge)), unsure(primitiveCase), unsure(cellCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(cellCase, primitiveCase);
+        
+        Vector<ValueFromBlock, 3> results;
+        
+        switch (cellMode) {
+        case AllCellsAreFalse:
+            break;
+        case CellCaseSpeculatesObject:
+            FTL_TYPE_CHECK(
+                jsValueValue(value), edge, (~SpecCell) | SpecObject, isNotObject(value));
+            break;
+        }
+        
+        if (validWatchpoint) {
+            results.append(m_out.anchor(m_out.booleanFalse));
+            m_out.jump(continuation);
+        } else {
+            LBasicBlock masqueradesCase =
+                m_out.newBlock();
+                
+            results.append(m_out.anchor(m_out.booleanFalse));
+            
+            m_out.branch(
+                m_out.testNonZero32(
+                    m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoFlags),
+                    m_out.constInt32(MasqueradesAsUndefined)),
+                rarely(masqueradesCase), usually(continuation));
+            
+            m_out.appendTo(masqueradesCase, primitiveCase);
+            
+            LValue structure = loadStructure(value);
+            
+            results.append(m_out.anchor(
+                m_out.equal(
+                    weakPointer(m_graph.globalObjectFor(m_node->origin.semantic)),
+                    m_out.loadPtr(structure, m_heaps.Structure_globalObject))));
+            m_out.jump(continuation);
+        }
+        
+        m_out.appendTo(primitiveCase, continuation);
+        
+        LValue primitiveResult;
+        switch (primitiveMode) {
+        case EqualNull:
+            primitiveResult = m_out.equal(value, m_out.constInt64(ValueNull));
+            break;
+        case EqualUndefined:
+            primitiveResult = m_out.equal(value, m_out.constInt64(ValueUndefined));
+            break;
+        case EqualNullOrUndefined:
+            primitiveResult = isOther(value, provenType(edge));
+            break;
+        case SpeculateNullOrUndefined:
+            FTL_TYPE_CHECK(
+                jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
+            primitiveResult = m_out.booleanTrue;
+            break;
+        }
+        results.append(m_out.anchor(primitiveResult));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        
+        return m_out.phi(Int32, results);
+    }
+    
+    template<typename FunctionType>
+    void contiguousPutByValOutOfBounds(
+        FunctionType slowPathFunction, LValue base, LValue storage, LValue index, LValue value,
+        LBasicBlock continuation)
+    {
+        LValue isNotInBounds = m_out.aboveOrEqual(
+            index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength));
+        if (!m_node->arrayMode().isInBounds()) {
+            LBasicBlock notInBoundsCase =
+                m_out.newBlock();
+            LBasicBlock performStore =
+                m_out.newBlock();
+                
+            m_out.branch(isNotInBounds, unsure(notInBoundsCase), unsure(performStore));
+                
+            LBasicBlock lastNext = m_out.appendTo(notInBoundsCase, performStore);
+                
+            LValue isOutOfBounds = m_out.aboveOrEqual(
+                index, m_out.load32NonNegative(storage, m_heaps.Butterfly_vectorLength));
+                
+            if (!m_node->arrayMode().isOutOfBounds())
+                speculate(OutOfBounds, noValue(), 0, isOutOfBounds);
+            else {
+                LBasicBlock outOfBoundsCase =
+                    m_out.newBlock();
+                LBasicBlock holeCase =
+                    m_out.newBlock();
+                    
+                m_out.branch(isOutOfBounds, rarely(outOfBoundsCase), usually(holeCase));
+                    
+                LBasicBlock innerLastNext = m_out.appendTo(outOfBoundsCase, holeCase);
+                    
+                vmCall(
+                    Void, m_out.operation(slowPathFunction),
+                    m_callFrame, base, index, value);
+                    
+                m_out.jump(continuation);
+                    
+                m_out.appendTo(holeCase, innerLastNext);
+            }
+            
+            m_out.store32(
+                m_out.add(index, m_out.int32One),
+                storage, m_heaps.Butterfly_publicLength);
+                
+            m_out.jump(performStore);
+            m_out.appendTo(performStore, lastNext);
+        }
+    }
+    
+    void buildSwitch(SwitchData* data, LType type, LValue switchValue)
+    {
+        ASSERT(type == pointerType() || type == Int32);
+
+        Vector<SwitchCase> cases;
+        for (unsigned i = 0; i < data->cases.size(); ++i) {
+            SwitchCase newCase;
+
+            if (type == pointerType()) {
+                newCase = SwitchCase(m_out.constIntPtr(data->cases[i].value.switchLookupValue(data->kind)),
+                    lowBlock(data->cases[i].target.block), Weight(data->cases[i].target.count));
+            } else if (type == Int32) {
+                newCase = SwitchCase(m_out.constInt32(data->cases[i].value.switchLookupValue(data->kind)),
+                    lowBlock(data->cases[i].target.block), Weight(data->cases[i].target.count));
+            } else
+                CRASH();
+
+            cases.append(newCase);
+        }
+        
+        m_out.switchInstruction(
+            switchValue, cases,
+            lowBlock(data->fallThrough.block), Weight(data->fallThrough.count));
+    }
+    
+    void switchString(SwitchData* data, LValue string)
+    {
+        bool canDoBinarySwitch = true;
+        unsigned totalLength = 0;
+        
+        for (DFG::SwitchCase myCase : data->cases) {
+            StringImpl* string = myCase.value.stringImpl();
+            if (!string->is8Bit()) {
+                canDoBinarySwitch = false;
+                break;
+            }
+            if (string->length() > Options::maximumBinaryStringSwitchCaseLength()) {
+                canDoBinarySwitch = false;
+                break;
+            }
+            totalLength += string->length();
+        }
+        
+        if (!canDoBinarySwitch || totalLength > Options::maximumBinaryStringSwitchTotalLength()) {
+            switchStringSlow(data, string);
+            return;
+        }
+        
+        LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
+        LValue length = m_out.load32(string, m_heaps.JSString_length);
+        
+        LBasicBlock hasImplBlock = m_out.newBlock();
+        LBasicBlock is8BitBlock = m_out.newBlock();
+        LBasicBlock slowBlock = m_out.newBlock();
+        
+        m_out.branch(m_out.isNull(stringImpl), unsure(slowBlock), unsure(hasImplBlock));
+        
+        LBasicBlock lastNext = m_out.appendTo(hasImplBlock, is8BitBlock);
+        
+        m_out.branch(
+            m_out.testIsZero32(
+                m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIs8Bit())),
+            unsure(slowBlock), unsure(is8BitBlock));
+        
+        m_out.appendTo(is8BitBlock, slowBlock);
+        
+        LValue buffer = m_out.loadPtr(stringImpl, m_heaps.StringImpl_data);
+        
+        // FIXME: We should propagate branch weight data to the cases of this switch.
+        // https://bugs.webkit.org/show_bug.cgi?id=144368
+        
+        Vector<StringSwitchCase> cases;
+        for (DFG::SwitchCase myCase : data->cases)
+            cases.append(StringSwitchCase(myCase.value.stringImpl(), lowBlock(myCase.target.block)));
+        std::sort(cases.begin(), cases.end());
+        switchStringRecurse(data, buffer, length, cases, 0, 0, cases.size(), 0, false);
+
+        m_out.appendTo(slowBlock, lastNext);
+        switchStringSlow(data, string);
+    }
+    
+    // The code for string switching is based closely on the same code in the DFG backend. While it
+    // would be nice to reduce the amount of similar-looking code, it seems like this is one of
+    // those algorithms where factoring out the common bits would result in more code than just
+    // duplicating.
+    
+    struct StringSwitchCase {
+        StringSwitchCase() { }
+        
+        StringSwitchCase(StringImpl* string, LBasicBlock target)
+            : string(string)
+            , target(target)
+        {
+        }
+
+        bool operator<(const StringSwitchCase& other) const
+        {
+            return stringLessThan(*string, *other.string);
+        }
+        
+        StringImpl* string;
+        LBasicBlock target;
+    };
+    
+    struct CharacterCase {
+        CharacterCase()
+            : character(0)
+            , begin(0)
+            , end(0)
+        {
+        }
+        
+        CharacterCase(LChar character, unsigned begin, unsigned end)
+            : character(character)
+            , begin(begin)
+            , end(end)
+        {
+        }
+        
+        bool operator<(const CharacterCase& other) const
+        {
+            return character < other.character;
+        }
+        
+        LChar character;
+        unsigned begin;
+        unsigned end;
+    };
+    
+    void switchStringRecurse(
+        SwitchData* data, LValue buffer, LValue length, const Vector<StringSwitchCase>& cases,
+        unsigned numChecked, unsigned begin, unsigned end, unsigned alreadyCheckedLength,
+        unsigned checkedExactLength)
+    {
+        LBasicBlock fallThrough = lowBlock(data->fallThrough.block);
+        
+        if (begin == end) {
+            m_out.jump(fallThrough);
+            return;
+        }
+        
+        unsigned minLength = cases[begin].string->length();
+        unsigned commonChars = minLength;
+        bool allLengthsEqual = true;
+        for (unsigned i = begin + 1; i < end; ++i) {
+            unsigned myCommonChars = numChecked;
+            unsigned limit = std::min(cases[begin].string->length(), cases[i].string->length());
+            for (unsigned j = numChecked; j < limit; ++j) {
+                if (cases[begin].string->at(j) != cases[i].string->at(j))
+                    break;
+                myCommonChars++;
+            }
+            commonChars = std::min(commonChars, myCommonChars);
+            if (minLength != cases[i].string->length())
+                allLengthsEqual = false;
+            minLength = std::min(minLength, cases[i].string->length());
+        }
+        
+        if (checkedExactLength) {
+            DFG_ASSERT(m_graph, m_node, alreadyCheckedLength == minLength);
+            DFG_ASSERT(m_graph, m_node, allLengthsEqual);
+        }
+        
+        DFG_ASSERT(m_graph, m_node, minLength >= commonChars);
+        
+        if (!allLengthsEqual && alreadyCheckedLength < minLength)
+            m_out.check(m_out.below(length, m_out.constInt32(minLength)), unsure(fallThrough));
+        if (allLengthsEqual && (alreadyCheckedLength < minLength || !checkedExactLength))
+            m_out.check(m_out.notEqual(length, m_out.constInt32(minLength)), unsure(fallThrough));
+        
+        for (unsigned i = numChecked; i < commonChars; ++i) {
+            m_out.check(
+                m_out.notEqual(
+                    m_out.load8ZeroExt32(buffer, m_heaps.characters8[i]),
+                    m_out.constInt32(static_cast<uint16_t>(cases[begin].string->at(i)))),
+                unsure(fallThrough));
+        }
+        
+        if (minLength == commonChars) {
+            // This is the case where one of the cases is a prefix of all of the other cases.
+            // We've already checked that the input string is a prefix of all of the cases,
+            // so we just check length to jump to that case.
+            
+            DFG_ASSERT(m_graph, m_node, cases[begin].string->length() == commonChars);
+            for (unsigned i = begin + 1; i < end; ++i)
+                DFG_ASSERT(m_graph, m_node, cases[i].string->length() > commonChars);
+            
+            if (allLengthsEqual) {
+                DFG_ASSERT(m_graph, m_node, end == begin + 1);
+                m_out.jump(cases[begin].target);
+                return;
+            }
+            
+            m_out.check(
+                m_out.equal(length, m_out.constInt32(commonChars)),
+                unsure(cases[begin].target));
+            
+            // We've checked if the length is >= minLength, and then we checked if the length is
+            // == commonChars. We get to this point if it is >= minLength but not == commonChars.
+            // Hence we know that it now must be > minLength, i.e. that it's >= minLength + 1.
+            switchStringRecurse(
+                data, buffer, length, cases, commonChars, begin + 1, end, minLength + 1, false);
+            return;
+        }
+        
+        // At this point we know that the string is longer than commonChars, and we've only verified
+        // commonChars. Use a binary switch on the next unchecked character, i.e.
+        // string[commonChars].
+        
+        DFG_ASSERT(m_graph, m_node, end >= begin + 2);
+        
+        LValue uncheckedChar = m_out.load8ZeroExt32(buffer, m_heaps.characters8[commonChars]);
+        
+        Vector<CharacterCase> characterCases;
+        CharacterCase currentCase(cases[begin].string->at(commonChars), begin, begin + 1);
+        for (unsigned i = begin + 1; i < end; ++i) {
+            LChar currentChar = cases[i].string->at(commonChars);
+            if (currentChar != currentCase.character) {
+                currentCase.end = i;
+                characterCases.append(currentCase);
+                currentCase = CharacterCase(currentChar, i, i + 1);
+            } else
+                currentCase.end = i + 1;
+        }
+        characterCases.append(currentCase);
+        
+        Vector<LBasicBlock> characterBlocks;
+        for (unsigned i = characterCases.size(); i--;)
+            characterBlocks.append(m_out.newBlock());
+        
+        Vector<SwitchCase> switchCases;
+        for (unsigned i = 0; i < characterCases.size(); ++i) {
+            if (i)
+                DFG_ASSERT(m_graph, m_node, characterCases[i - 1].character < characterCases[i].character);
+            switchCases.append(SwitchCase(
+                m_out.constInt32(characterCases[i].character), characterBlocks[i], Weight()));
+        }
+        m_out.switchInstruction(uncheckedChar, switchCases, fallThrough, Weight());
+        
+        LBasicBlock lastNext = m_out.m_nextBlock;
+        characterBlocks.append(lastNext); // Makes it convenient to set nextBlock.
+        for (unsigned i = 0; i < characterCases.size(); ++i) {
+            m_out.appendTo(characterBlocks[i], characterBlocks[i + 1]);
+            switchStringRecurse(
+                data, buffer, length, cases, commonChars + 1,
+                characterCases[i].begin, characterCases[i].end, minLength, allLengthsEqual);
+        }
+        
+        DFG_ASSERT(m_graph, m_node, m_out.m_nextBlock == lastNext);
+    }
+    
+    void switchStringSlow(SwitchData* data, LValue string)
+    {
+        // FIXME: We ought to be able to use computed gotos here. We would save the labels of the
+        // blocks we want to jump to, and then request their addresses after compilation completes.
+        // https://bugs.webkit.org/show_bug.cgi?id=144369
+        
+        LValue branchOffset = vmCall(
+            Int32, m_out.operation(operationSwitchStringAndGetBranchOffset),
+            m_callFrame, m_out.constIntPtr(data->switchTableIndex), string);
+        
+        StringJumpTable& table = codeBlock()->stringSwitchJumpTable(data->switchTableIndex);
+        
+        Vector<SwitchCase> cases;
+        std::unordered_set<int32_t> alreadyHandled; // These may be negative, or zero, or probably other stuff, too. We don't want to mess with HashSet's corner cases and we don't really care about throughput here.
+        for (unsigned i = 0; i < data->cases.size(); ++i) {
+            // FIXME: The fact that we're using the bytecode's switch table means that the
+            // following DFG IR transformation would be invalid.
+            //
+            // Original code:
+            //     switch (v) {
+            //     case "foo":
+            //     case "bar":
+            //         things();
+            //         break;
+            //     default:
+            //         break;
+            //     }
+            //
+            // New code:
+            //     switch (v) {
+            //     case "foo":
+            //         instrumentFoo();
+            //         goto _things;
+            //     case "bar":
+            //         instrumentBar();
+            //     _things:
+            //         things();
+            //         break;
+            //     default:
+            //         break;
+            //     }
+            //
+            // Luckily, we don't currently do any such transformation. But it's kind of silly that
+            // this is an issue.
+            // https://bugs.webkit.org/show_bug.cgi?id=144635
+            
+            DFG::SwitchCase myCase = data->cases[i];
+            StringJumpTable::StringOffsetTable::iterator iter =
+                table.offsetTable.find(myCase.value.stringImpl());
+            DFG_ASSERT(m_graph, m_node, iter != table.offsetTable.end());
+            
+            if (!alreadyHandled.insert(iter->value.branchOffset).second)
+                continue;
+
+            cases.append(SwitchCase(
+                m_out.constInt32(iter->value.branchOffset),
+                lowBlock(myCase.target.block), Weight(myCase.target.count)));
+        }
+        
+        m_out.switchInstruction(
+            branchOffset, cases, lowBlock(data->fallThrough.block),
+            Weight(data->fallThrough.count));
+    }
+    
+    // Calls the functor at the point of code generation where we know what the result type is.
+    // You can emit whatever code you like at that point. Expects you to terminate the basic block.
+    // When buildTypeOf() returns, it will have terminated all basic blocks that it created. So, if
+    // you aren't using this as the terminator of a high-level block, you should create your own
+    // contination and set it as the nextBlock (m_out.insertNewBlocksBefore(continuation)) before
+    // calling this. For example:
+    //
+    // LBasicBlock continuation = m_out.newBlock();
+    // LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
+    // buildTypeOf(
+    //     child, value,
+    //     [&] (TypeofType type) {
+    //          do things;
+    //          m_out.jump(continuation);
+    //     });
+    // m_out.appendTo(continuation, lastNext);
+    template<typename Functor>
+    void buildTypeOf(Edge child, LValue value, const Functor& functor)
+    {
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        
+        // Implements the following branching structure:
+        //
+        // if (is cell) {
+        //     if (is object) {
+        //         if (is function) {
+        //             return function;
+        //         } else if (doesn't have call trap and doesn't masquerade as undefined) {
+        //             return object
+        //         } else {
+        //             return slowPath();
+        //         }
+        //     } else if (is string) {
+        //         return string
+        //     } else {
+        //         return symbol
+        //     }
+        // } else if (is number) {
+        //     return number
+        // } else if (is null) {
+        //     return object
+        // } else if (is boolean) {
+        //     return boolean
+        // } else {
+        //     return undefined
+        // }
+        
+        LBasicBlock cellCase = m_out.newBlock();
+        LBasicBlock objectCase = m_out.newBlock();
+        LBasicBlock functionCase = m_out.newBlock();
+        LBasicBlock notFunctionCase = m_out.newBlock();
+        LBasicBlock reallyObjectCase = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock unreachable = m_out.newBlock();
+        LBasicBlock notObjectCase = m_out.newBlock();
+        LBasicBlock stringCase = m_out.newBlock();
+        LBasicBlock symbolCase = m_out.newBlock();
+        LBasicBlock notCellCase = m_out.newBlock();
+        LBasicBlock numberCase = m_out.newBlock();
+        LBasicBlock notNumberCase = m_out.newBlock();
+        LBasicBlock notNullCase = m_out.newBlock();
+        LBasicBlock booleanCase = m_out.newBlock();
+        LBasicBlock undefinedCase = m_out.newBlock();
+        
+        m_out.branch(isCell(value, provenType(child)), unsure(cellCase), unsure(notCellCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(cellCase, objectCase);
+        m_out.branch(isObject(value, provenType(child)), unsure(objectCase), unsure(notObjectCase));
+        
+        m_out.appendTo(objectCase, functionCase);
+        m_out.branch(
+            isFunction(value, provenType(child) & SpecObject),
+            unsure(functionCase), unsure(notFunctionCase));
+        
+        m_out.appendTo(functionCase, notFunctionCase);
+        functor(TypeofType::Function);
+        
+        m_out.appendTo(notFunctionCase, reallyObjectCase);
+        m_out.branch(
+            isExoticForTypeof(value, provenType(child) & (SpecObject - SpecFunction)),
+            rarely(slowPath), usually(reallyObjectCase));
+        
+        m_out.appendTo(reallyObjectCase, slowPath);
+        functor(TypeofType::Object);
+        
+        m_out.appendTo(slowPath, unreachable);
+        LValue result = lazySlowPath(
+            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+                return createLazyCallGenerator(
+                    operationTypeOfObjectAsTypeofType, locations[0].directGPR(),
+                    CCallHelpers::TrustedImmPtr(globalObject), locations[1].directGPR());
+            }, value);
+        Vector<SwitchCase, 3> cases;
+        cases.append(SwitchCase(m_out.constInt32(static_cast<int32_t>(TypeofType::Undefined)), undefinedCase));
+        cases.append(SwitchCase(m_out.constInt32(static_cast<int32_t>(TypeofType::Object)), reallyObjectCase));
+        cases.append(SwitchCase(m_out.constInt32(static_cast<int32_t>(TypeofType::Function)), functionCase));
+        m_out.switchInstruction(m_out.castToInt32(result), cases, unreachable, Weight());
+        
+        m_out.appendTo(unreachable, notObjectCase);
+        m_out.unreachable();
+        
+        m_out.appendTo(notObjectCase, stringCase);
+        m_out.branch(
+            isString(value, provenType(child) & (SpecCell - SpecObject)),
+            unsure(stringCase), unsure(symbolCase));
+        
+        m_out.appendTo(stringCase, symbolCase);
+        functor(TypeofType::String);
+        
+        m_out.appendTo(symbolCase, notCellCase);
+        functor(TypeofType::Symbol);
+        
+        m_out.appendTo(notCellCase, numberCase);
+        m_out.branch(
+            isNumber(value, provenType(child) & ~SpecCell),
+            unsure(numberCase), unsure(notNumberCase));
+        
+        m_out.appendTo(numberCase, notNumberCase);
+        functor(TypeofType::Number);
+        
+        m_out.appendTo(notNumberCase, notNullCase);
+        LValue isNull;
+        if (provenType(child) & SpecOther)
+            isNull = m_out.equal(value, m_out.constInt64(ValueNull));
+        else
+            isNull = m_out.booleanFalse;
+        m_out.branch(isNull, unsure(reallyObjectCase), unsure(notNullCase));
+        
+        m_out.appendTo(notNullCase, booleanCase);
+        m_out.branch(
+            isBoolean(value, provenType(child) & ~(SpecCell | SpecFullNumber)),
+            unsure(booleanCase), unsure(undefinedCase));
+        
+        m_out.appendTo(booleanCase, undefinedCase);
+        functor(TypeofType::Boolean);
+        
+        m_out.appendTo(undefinedCase, lastNext);
+        functor(TypeofType::Undefined);
+    }
+    
+    LValue doubleToInt32(LValue doubleValue, double low, double high, bool isSigned = true)
+    {
+        LBasicBlock greatEnough = m_out.newBlock();
+        LBasicBlock withinRange = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        Vector<ValueFromBlock, 2> results;
+        
+        m_out.branch(
+            m_out.doubleGreaterThanOrEqual(doubleValue, m_out.constDouble(low)),
+            unsure(greatEnough), unsure(slowPath));
+        
+        LBasicBlock lastNext = m_out.appendTo(greatEnough, withinRange);
+        m_out.branch(
+            m_out.doubleLessThanOrEqual(doubleValue, m_out.constDouble(high)),
+            unsure(withinRange), unsure(slowPath));
+        
+        m_out.appendTo(withinRange, slowPath);
+        LValue fastResult;
+        if (isSigned)
+            fastResult = m_out.doubleToInt(doubleValue);
+        else
+            fastResult = m_out.doubleToUInt(doubleValue);
+        results.append(m_out.anchor(fastResult));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+        results.append(m_out.anchor(m_out.call(Int32, m_out.operation(operationToInt32), doubleValue)));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(Int32, results);
+    }
+    
+    LValue doubleToInt32(LValue doubleValue)
+    {
+        if (Output::hasSensibleDoubleToInt())
+            return sensibleDoubleToInt32(doubleValue);
+        
+        double limit = pow(2, 31) - 1;
+        return doubleToInt32(doubleValue, -limit, limit);
+    }
+    
+    LValue sensibleDoubleToInt32(LValue doubleValue)
+    {
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LValue fastResultValue = m_out.doubleToInt(doubleValue);
+        ValueFromBlock fastResult = m_out.anchor(fastResultValue);
+        m_out.branch(
+            m_out.equal(fastResultValue, m_out.constInt32(0x80000000)),
+            rarely(slowPath), usually(continuation));
+        
+        LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
+        ValueFromBlock slowResult = m_out.anchor(
+            m_out.call(Int32, m_out.operation(operationToInt32), doubleValue));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(Int32, fastResult, slowResult);
+    }
+
+    // This is a mechanism for creating a code generator that fills in a gap in the code using our
+    // own MacroAssembler. This is useful for slow paths that involve a lot of code and we don't want
+    // to pay the price of B3 optimizing it. A lazy slow path will only be generated if it actually
+    // executes. On the other hand, a lazy slow path always incurs the cost of two additional jumps.
+    // Also, the lazy slow path's register allocation state is slaved to whatever B3 did, so you
+    // have to use a ScratchRegisterAllocator to try to use some unused registers and you may have
+    // to spill to top of stack if there aren't enough registers available.
+    //
+    // Lazy slow paths involve three different stages of execution. Each stage has unique
+    // capabilities and knowledge. The stages are:
+    //
+    // 1) DFG->B3 lowering, i.e. code that runs in this phase. Lowering is the last time you will
+    //    have access to LValues. If there is an LValue that needs to be fed as input to a lazy slow
+    //    path, then you must pass it as an argument here (as one of the varargs arguments after the
+    //    functor). But, lowering doesn't know which registers will be used for those LValues. Hence
+    //    you pass a lambda to lazySlowPath() and that lambda will run during stage (2):
+    //
+    // 2) FTLCompile.cpp's fixFunctionBasedOnStackMaps. This code is the only stage at which we know
+    //    the mapping from arguments passed to this method in (1) and the registers that B3
+    //    selected for those arguments. You don't actually want to generate any code here, since then
+    //    the slow path wouldn't actually be lazily generated. Instead, you want to save the
+    //    registers being used for the arguments and defer code generation to stage (3) by creating
+    //    and returning a LazySlowPath::Generator:
+    //
+    // 3) LazySlowPath's generate() method. This code runs in response to the lazy slow path
+    //    executing for the first time. It will call the generator you created in stage (2).
+    //
+    // Note that each time you invoke stage (1), stage (2) may be invoked zero, one, or many times.
+    // Stage (2) will usually be invoked once for stage (1). But, B3 may kill the code, in which
+    // case stage (2) won't run. B3 may duplicate the code (for example via tail duplication),
+    // leading to many calls to your stage (2) lambda. Stage (3) may be called zero or once for each
+    // stage (2). It will be called zero times if the slow path never runs. This is what you hope for
+    // whenever you use the lazySlowPath() mechanism.
+    //
+    // A typical use of lazySlowPath() will look like the example below, which just creates a slow
+    // path that adds some value to the input and returns it.
+    //
+    // // Stage (1) is here. This is your last chance to figure out which LValues to use as inputs.
+    // // Notice how we pass "input" as an argument to lazySlowPath().
+    // LValue input = ...;
+    // int addend = ...;
+    // LValue output = lazySlowPath(
+    //     [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+    //         // Stage (2) is here. This is your last chance to figure out which registers are used
+    //         // for which values. Location zero is always the return value. You can ignore it if
+    //         // you don't want to return anything. Location 1 is the register for the first
+    //         // argument to the lazySlowPath(), i.e. "input". Note that the Location object could
+    //         // also hold an FPR, if you are passing a double.
+    //         GPRReg outputGPR = locations[0].directGPR();
+    //         GPRReg inputGPR = locations[1].directGPR();
+    //         return LazySlowPath::createGenerator(
+    //             [=] (CCallHelpers& jit, LazySlowPath::GenerationParams& params) {
+    //                 // Stage (3) is here. This is when you generate code. You have access to the
+    //                 // registers you collected in stage (2) because this lambda closes over those
+    //                 // variables (outputGPR and inputGPR). You also have access to whatever extra
+    //                 // data you collected in stage (1), such as the addend in this case.
+    //                 jit.add32(TrustedImm32(addend), inputGPR, outputGPR);
+    //                 // You have to end by jumping to done. There is nothing to fall through to.
+    //                 // You can also jump to the exception handler (see LazySlowPath.h for more
+    //                 // info). Note that currently you cannot OSR exit.
+    //                 params.doneJumps.append(jit.jump());
+    //             });
+    //     },
+    //     input);
+    //
+    // You can basically pass as many inputs as you like, either using this varargs form, or by
+    // passing a Vector of LValues.
+    //
+    // Note that if your slow path is only doing a call, you can use the createLazyCallGenerator()
+    // helper. For example:
+    //
+    // LValue input = ...;
+    // LValue output = lazySlowPath(
+    //     [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
+    //         return createLazyCallGenerator(
+    //             operationDoThings, locations[0].directGPR(), locations[1].directGPR());
+    //     }, input);
+    //
+    // Finally, note that all of the lambdas - both the stage (2) lambda and the stage (3) lambda -
+    // run after the function that created them returns. Hence, you should not use by-reference
+    // capture (i.e. [&]) in any of these lambdas.
+    template<typename Functor, typename... ArgumentTypes>
+    PatchpointValue* lazySlowPath(const Functor& functor, ArgumentTypes... arguments)
+    {
+        return lazySlowPath(functor, Vector<LValue>{ arguments... });
+    }
+
+    template<typename Functor>
+    PatchpointValue* lazySlowPath(const Functor& functor, const Vector<LValue>& userArguments)
+    {
+        CodeOrigin origin = m_node->origin.semantic;
+        
+        PatchpointValue* result = m_out.patchpoint(B3::Int64);
+        for (LValue arg : userArguments)
+            result->append(ConstrainedValue(arg, B3::ValueRep::SomeRegister));
+
+        RefPtr<PatchpointExceptionHandle> exceptionHandle =
+            preparePatchpointForExceptions(result);
+        
+        result->clobber(RegisterSet::macroScratchRegisters());
+        State* state = &m_ftlState;
+
+        result->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                Vector<Location> locations;
+                for (const B3::ValueRep& rep : params)
+                    locations.append(Location::forValueRep(rep));
+
+                RefPtr<LazySlowPath::Generator> generator = functor(locations);
+                
+                CCallHelpers::PatchableJump patchableJump = jit.patchableJump();
+                CCallHelpers::Label done = jit.label();
+
+                RegisterSet usedRegisters = params.unavailableRegisters();
+
+                RefPtr<ExceptionTarget> exceptionTarget =
+                    exceptionHandle->scheduleExitCreation(params);
+
+                // FIXME: As part of handling exceptions, we need to create a concrete OSRExit here.
+                // Doing so should automagically register late paths that emit exit thunks.
+
+                params.addLatePath(
+                    [=] (CCallHelpers& jit) {
+                        AllowMacroScratchRegisterUsage allowScratch(jit);
+                        patchableJump.m_jump.link(&jit);
+                        unsigned index = state->jitCode->lazySlowPaths.size();
+                        state->jitCode->lazySlowPaths.append(nullptr);
+                        jit.pushToSaveImmediateWithoutTouchingRegisters(
+                            CCallHelpers::TrustedImm32(index));
+                        CCallHelpers::Jump generatorJump = jit.jump();
+
+                        // Note that so long as we're here, we don't really know if our late path
+                        // runs before or after any other late paths that we might depend on, like
+                        // the exception thunk.
+
+                        RefPtr<JITCode> jitCode = state->jitCode;
+                        VM* vm = &state->graph.m_vm;
+
+                        jit.addLinkTask(
+                            [=] (LinkBuffer& linkBuffer) {
+                                linkBuffer.link(
+                                    generatorJump, CodeLocationLabel(
+                                        vm->getCTIStub(
+                                            lazySlowPathGenerationThunkGenerator).code()));
+                                
+                                CodeLocationJump linkedPatchableJump = CodeLocationJump(
+                                    linkBuffer.locationOf(patchableJump));
+                                CodeLocationLabel linkedDone = linkBuffer.locationOf(done);
+
+                                CallSiteIndex callSiteIndex =
+                                    jitCode->common.addUniqueCallSiteIndex(origin);
+                                    
+                                std::unique_ptr<LazySlowPath> lazySlowPath =
+                                    std::make_unique<LazySlowPath>(
+                                        linkedPatchableJump, linkedDone,
+                                        exceptionTarget->label(linkBuffer), usedRegisters,
+                                        callSiteIndex, generator);
+                                    
+                                jitCode->lazySlowPaths[index] = WTFMove(lazySlowPath);
+                            });
+                    });
+            });
+        return result;
+    }
+    
+    void speculate(
+        ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition)
+    {
+        appendOSRExit(kind, lowValue, highValue, failCondition, m_origin);
+    }
+    
+    void terminate(ExitKind kind)
+    {
+        speculate(kind, noValue(), nullptr, m_out.booleanTrue);
+        didAlreadyTerminate();
+    }
+    
+    void didAlreadyTerminate()
+    {
+        m_state.setIsValid(false);
+    }
+    
+    void typeCheck(
+        FormattedValue lowValue, Edge highValue, SpeculatedType typesPassedThrough,
+        LValue failCondition, ExitKind exitKind = BadType)
+    {
+        appendTypeCheck(lowValue, highValue, typesPassedThrough, failCondition, exitKind);
+    }
+    
+    void appendTypeCheck(
+        FormattedValue lowValue, Edge highValue, SpeculatedType typesPassedThrough,
+        LValue failCondition, ExitKind exitKind)
+    {
+        if (!m_interpreter.needsTypeCheck(highValue, typesPassedThrough))
+            return;
+        ASSERT(mayHaveTypeCheck(highValue.useKind()));
+        appendOSRExit(exitKind, lowValue, highValue.node(), failCondition, m_origin);
+        m_interpreter.filter(highValue, typesPassedThrough);
+    }
+    
+    LValue lowInt32(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || (edge.useKind() == Int32Use || edge.useKind() == KnownInt32Use));
+        
+        if (edge->hasConstant()) {
+            JSValue value = edge->asJSValue();
+            if (!value.isInt32()) {
+                terminate(Uncountable);
+                return m_out.int32Zero;
+            }
+            return m_out.constInt32(value.asInt32());
+        }
+        
+        LoweredNodeValue value = m_int32Values.get(edge.node());
+        if (isValid(value))
+            return value.value();
+        
+        value = m_strictInt52Values.get(edge.node());
+        if (isValid(value))
+            return strictInt52ToInt32(edge, value.value());
+        
+        value = m_int52Values.get(edge.node());
+        if (isValid(value))
+            return strictInt52ToInt32(edge, int52ToStrictInt52(value.value()));
+        
+        value = m_jsValueValues.get(edge.node());
+        if (isValid(value)) {
+            LValue boxedResult = value.value();
+            FTL_TYPE_CHECK(
+                jsValueValue(boxedResult), edge, SpecInt32Only, isNotInt32(boxedResult));
+            LValue result = unboxInt32(boxedResult);
+            setInt32(edge.node(), result);
+            return result;
+        }
+
+        DFG_ASSERT(m_graph, m_node, !(provenType(edge) & SpecInt32Only));
+        terminate(Uncountable);
+        return m_out.int32Zero;
+    }
+    
+    enum Int52Kind { StrictInt52, Int52 };
+    LValue lowInt52(Edge edge, Int52Kind kind)
+    {
+        DFG_ASSERT(m_graph, m_node, edge.useKind() == Int52RepUse);
+        
+        LoweredNodeValue value;
+        
+        switch (kind) {
+        case Int52:
+            value = m_int52Values.get(edge.node());
+            if (isValid(value))
+                return value.value();
+            
+            value = m_strictInt52Values.get(edge.node());
+            if (isValid(value))
+                return strictInt52ToInt52(value.value());
+            break;
+            
+        case StrictInt52:
+            value = m_strictInt52Values.get(edge.node());
+            if (isValid(value))
+                return value.value();
+            
+            value = m_int52Values.get(edge.node());
+            if (isValid(value))
+                return int52ToStrictInt52(value.value());
+            break;
+        }
+
+        DFG_ASSERT(m_graph, m_node, !provenType(edge));
+        terminate(Uncountable);
+        return m_out.int64Zero;
+    }
+    
+    LValue lowInt52(Edge edge)
+    {
+        return lowInt52(edge, Int52);
+    }
+    
+    LValue lowStrictInt52(Edge edge)
+    {
+        return lowInt52(edge, StrictInt52);
+    }
+    
+    bool betterUseStrictInt52(Node* node)
+    {
+        return !isValid(m_int52Values.get(node));
+    }
+    bool betterUseStrictInt52(Edge edge)
+    {
+        return betterUseStrictInt52(edge.node());
+    }
+    template<typename T>
+    Int52Kind bestInt52Kind(T node)
+    {
+        return betterUseStrictInt52(node) ? StrictInt52 : Int52;
+    }
+    Int52Kind opposite(Int52Kind kind)
+    {
+        switch (kind) {
+        case Int52:
+            return StrictInt52;
+        case StrictInt52:
+            return Int52;
+        }
+        DFG_CRASH(m_graph, m_node, "Bad use kind");
+        return Int52;
+    }
+    
+    LValue lowWhicheverInt52(Edge edge, Int52Kind& kind)
+    {
+        kind = bestInt52Kind(edge);
+        return lowInt52(edge, kind);
+    }
+    
+    LValue lowCell(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        DFG_ASSERT(m_graph, m_node, mode == ManualOperandSpeculation || DFG::isCell(edge.useKind()));
+        
+        if (edge->op() == JSConstant) {
+            FrozenValue* value = edge->constant();
+            if (!value->value().isCell()) {
+                terminate(Uncountable);
+                return m_out.intPtrZero;
+            }
+            return frozenPointer(value);
+        }
+        
+        LoweredNodeValue value = m_jsValueValues.get(edge.node());
+        if (isValid(value)) {
+            LValue uncheckedValue = value.value();
+            FTL_TYPE_CHECK(
+                jsValueValue(uncheckedValue), edge, SpecCell, isNotCell(uncheckedValue));
+            return uncheckedValue;
+        }
+        
+        DFG_ASSERT(m_graph, m_node, !(provenType(edge) & SpecCell));
+        terminate(Uncountable);
+        return m_out.intPtrZero;
+    }
+    
+    LValue lowObject(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == ObjectUse);
+        
+        LValue result = lowCell(edge, mode);
+        speculateObject(edge, result);
+        return result;
+    }
+
+    LValue lowRegExpObject(Edge edge)
+    {
+        LValue result = lowCell(edge);
+        speculateRegExpObject(edge, result);
+        return result;
+    }
+
+    LValue lowMapObject(Edge edge)
+    {
+        LValue result = lowCell(edge);
+        speculateMapObject(edge, result);
+        return result;
+    }
+
+    LValue lowSetObject(Edge edge)
+    {
+        LValue result = lowCell(edge);
+        speculateSetObject(edge, result);
+        return result;
+    }
+    
+    LValue lowString(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == StringUse || edge.useKind() == KnownStringUse || edge.useKind() == StringIdentUse);
+        
+        LValue result = lowCell(edge, mode);
+        speculateString(edge, result);
+        return result;
+    }
+    
+    LValue lowStringIdent(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == StringIdentUse);
+        
+        LValue string = lowString(edge, mode);
+        LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
+        speculateStringIdent(edge, string, stringImpl);
+        return stringImpl;
+    }
+
+    LValue lowSymbol(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == SymbolUse);
+
+        LValue result = lowCell(edge, mode);
+        speculateSymbol(edge, result);
+        return result;
+    }
+    
+    LValue lowNonNullObject(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == ObjectUse);
+        
+        LValue result = lowCell(edge, mode);
+        speculateNonNullObject(edge, result);
+        return result;
+    }
+    
+    LValue lowBoolean(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse || edge.useKind() == KnownBooleanUse);
+        
+        if (edge->hasConstant()) {
+            JSValue value = edge->asJSValue();
+            if (!value.isBoolean()) {
+                terminate(Uncountable);
+                return m_out.booleanFalse;
+            }
+            return m_out.constBool(value.asBoolean());
+        }
+        
+        LoweredNodeValue value = m_booleanValues.get(edge.node());
+        if (isValid(value))
+            return value.value();
+        
+        value = m_jsValueValues.get(edge.node());
+        if (isValid(value)) {
+            LValue unboxedResult = value.value();
+            FTL_TYPE_CHECK(
+                jsValueValue(unboxedResult), edge, SpecBoolean, isNotBoolean(unboxedResult));
+            LValue result = unboxBoolean(unboxedResult);
+            setBoolean(edge.node(), result);
+            return result;
+        }
+        
+        DFG_ASSERT(m_graph, m_node, !(provenType(edge) & SpecBoolean));
+        terminate(Uncountable);
+        return m_out.booleanFalse;
+    }
+    
+    LValue lowDouble(Edge edge)
+    {
+        DFG_ASSERT(m_graph, m_node, isDouble(edge.useKind()));
+        
+        LoweredNodeValue value = m_doubleValues.get(edge.node());
+        if (isValid(value))
+            return value.value();
+        DFG_ASSERT(m_graph, m_node, !provenType(edge));
+        terminate(Uncountable);
+        return m_out.doubleZero;
+    }
+    
+    LValue lowJSValue(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
+    {
+        DFG_ASSERT(m_graph, m_node, mode == ManualOperandSpeculation || edge.useKind() == UntypedUse);
+        DFG_ASSERT(m_graph, m_node, !isDouble(edge.useKind()));
+        DFG_ASSERT(m_graph, m_node, edge.useKind() != Int52RepUse);
+        
+        if (edge->hasConstant())
+            return m_out.constInt64(JSValue::encode(edge->asJSValue()));
+
+        LoweredNodeValue value = m_jsValueValues.get(edge.node());
+        if (isValid(value))
+            return value.value();
+        
+        value = m_int32Values.get(edge.node());
+        if (isValid(value)) {
+            LValue result = boxInt32(value.value());
+            setJSValue(edge.node(), result);
+            return result;
+        }
+        
+        value = m_booleanValues.get(edge.node());
+        if (isValid(value)) {
+            LValue result = boxBoolean(value.value());
+            setJSValue(edge.node(), result);
+            return result;
+        }
+        
+        DFG_CRASH(m_graph, m_node, "Value not defined");
+        return 0;
+    }
+    
+    LValue lowStorage(Edge edge)
+    {
+        LoweredNodeValue value = m_storageValues.get(edge.node());
+        if (isValid(value))
+            return value.value();
+        
+        LValue result = lowCell(edge);
+        setStorage(edge.node(), result);
+        return result;
+    }
+
+    LValue lowMapBucket(Edge edge)
+    {
+        LoweredNodeValue value = m_mapBucketValues.get(edge.node());
+        if (isValid(value))
+            return value.value();
+        
+        LValue result = lowCell(edge);
+        setStorage(edge.node(), result);
+        return result;
+    }
+    
+    LValue strictInt52ToInt32(Edge edge, LValue value)
+    {
+        LValue result = m_out.castToInt32(value);
+        FTL_TYPE_CHECK(
+            noValue(), edge, SpecInt32Only,
+            m_out.notEqual(m_out.signExt32To64(result), value));
+        setInt32(edge.node(), result);
+        return result;
+    }
+    
+    LValue strictInt52ToDouble(LValue value)
+    {
+        return m_out.intToDouble(value);
+    }
+    
+    LValue strictInt52ToJSValue(LValue value)
+    {
+        LBasicBlock isInt32 = m_out.newBlock();
+        LBasicBlock isDouble = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        Vector<ValueFromBlock, 2> results;
+            
+        LValue int32Value = m_out.castToInt32(value);
+        m_out.branch(
+            m_out.equal(m_out.signExt32To64(int32Value), value),
+            unsure(isInt32), unsure(isDouble));
+        
+        LBasicBlock lastNext = m_out.appendTo(isInt32, isDouble);
+        
+        results.append(m_out.anchor(boxInt32(int32Value)));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(isDouble, continuation);
+        
+        results.append(m_out.anchor(boxDouble(m_out.intToDouble(value))));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        return m_out.phi(Int64, results);
+    }
+    
+    LValue strictInt52ToInt52(LValue value)
+    {
+        return m_out.shl(value, m_out.constInt64(JSValue::int52ShiftAmount));
+    }
+    
+    LValue int52ToStrictInt52(LValue value)
+    {
+        return m_out.aShr(value, m_out.constInt64(JSValue::int52ShiftAmount));
+    }
+    
+    LValue isInt32(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, SpecInt32Only))
+            return proven;
+        return m_out.aboveOrEqual(jsValue, m_tagTypeNumber);
+    }
+    LValue isNotInt32(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, ~SpecInt32Only))
+            return proven;
+        return m_out.below(jsValue, m_tagTypeNumber);
+    }
+    LValue unboxInt32(LValue jsValue)
+    {
+        return m_out.castToInt32(jsValue);
+    }
+    LValue boxInt32(LValue value)
+    {
+        return m_out.add(m_out.zeroExt(value, Int64), m_tagTypeNumber);
+    }
+    
+    LValue isCellOrMisc(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, SpecCell | SpecMisc))
+            return proven;
+        return m_out.testIsZero64(jsValue, m_tagTypeNumber);
+    }
+    LValue isNotCellOrMisc(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, ~(SpecCell | SpecMisc)))
+            return proven;
+        return m_out.testNonZero64(jsValue, m_tagTypeNumber);
+    }
+
+    LValue unboxDouble(LValue jsValue)
+    {
+        return m_out.bitCast(m_out.add(jsValue, m_tagTypeNumber), Double);
+    }
+    LValue boxDouble(LValue doubleValue)
+    {
+        return m_out.sub(m_out.bitCast(doubleValue, Int64), m_tagTypeNumber);
+    }
+    
+    LValue jsValueToStrictInt52(Edge edge, LValue boxedValue)
+    {
+        LBasicBlock intCase = m_out.newBlock();
+        LBasicBlock doubleCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+            
+        LValue isNotInt32;
+        if (!m_interpreter.needsTypeCheck(edge, SpecInt32Only))
+            isNotInt32 = m_out.booleanFalse;
+        else if (!m_interpreter.needsTypeCheck(edge, ~SpecInt32Only))
+            isNotInt32 = m_out.booleanTrue;
+        else
+            isNotInt32 = this->isNotInt32(boxedValue);
+        m_out.branch(isNotInt32, unsure(doubleCase), unsure(intCase));
+            
+        LBasicBlock lastNext = m_out.appendTo(intCase, doubleCase);
+            
+        ValueFromBlock intToInt52 = m_out.anchor(
+            m_out.signExt32To64(unboxInt32(boxedValue)));
+        m_out.jump(continuation);
+            
+        m_out.appendTo(doubleCase, continuation);
+        
+        LValue possibleResult = m_out.call(
+            Int64, m_out.operation(operationConvertBoxedDoubleToInt52), boxedValue);
+        FTL_TYPE_CHECK(
+            jsValueValue(boxedValue), edge, SpecInt32Only | SpecAnyIntAsDouble,
+            m_out.equal(possibleResult, m_out.constInt64(JSValue::notInt52)));
+            
+        ValueFromBlock doubleToInt52 = m_out.anchor(possibleResult);
+        m_out.jump(continuation);
+            
+        m_out.appendTo(continuation, lastNext);
+            
+        return m_out.phi(Int64, intToInt52, doubleToInt52);
+    }
+    
+    LValue doubleToStrictInt52(Edge edge, LValue value)
+    {
+        LValue possibleResult = m_out.call(
+            Int64, m_out.operation(operationConvertDoubleToInt52), value);
+        FTL_TYPE_CHECK_WITH_EXIT_KIND(Int52Overflow,
+            doubleValue(value), edge, SpecAnyIntAsDouble,
+            m_out.equal(possibleResult, m_out.constInt64(JSValue::notInt52)));
+        
+        return possibleResult;
+    }
+
+    LValue convertDoubleToInt32(LValue value, bool shouldCheckNegativeZero)
+    {
+        LValue integerValue = m_out.doubleToInt(value);
+        LValue integerValueConvertedToDouble = m_out.intToDouble(integerValue);
+        LValue valueNotConvertibleToInteger = m_out.doubleNotEqualOrUnordered(value, integerValueConvertedToDouble);
+        speculate(Overflow, FormattedValue(DataFormatDouble, value), m_node, valueNotConvertibleToInteger);
+
+        if (shouldCheckNegativeZero) {
+            LBasicBlock valueIsZero = m_out.newBlock();
+            LBasicBlock continuation = m_out.newBlock();
+            m_out.branch(m_out.isZero32(integerValue), unsure(valueIsZero), unsure(continuation));
+
+            LBasicBlock lastNext = m_out.appendTo(valueIsZero, continuation);
+
+            LValue doubleBitcastToInt64 = m_out.bitCast(value, Int64);
+            LValue signBitSet = m_out.lessThan(doubleBitcastToInt64, m_out.constInt64(0));
+
+            speculate(NegativeZero, FormattedValue(DataFormatDouble, value), m_node, signBitSet);
+            m_out.jump(continuation);
+            m_out.appendTo(continuation, lastNext);
+        }
+        return integerValue;
+    }
+
+    LValue isNumber(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, SpecFullNumber))
+            return proven;
+        return isNotCellOrMisc(jsValue);
+    }
+    LValue isNotNumber(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, ~SpecFullNumber))
+            return proven;
+        return isCellOrMisc(jsValue);
+    }
+    
+    LValue isNotCell(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, ~SpecCell))
+            return proven;
+        return m_out.testNonZero64(jsValue, m_tagMask);
+    }
+    
+    LValue isCell(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, SpecCell))
+            return proven;
+        return m_out.testIsZero64(jsValue, m_tagMask);
+    }
+    
+    LValue isNotMisc(LValue value, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, ~SpecMisc))
+            return proven;
+        return m_out.above(value, m_out.constInt64(TagBitTypeOther | TagBitBool | TagBitUndefined));
+    }
+    
+    LValue isMisc(LValue value, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, SpecMisc))
+            return proven;
+        return m_out.logicalNot(isNotMisc(value));
+    }
+    
+    LValue isNotBoolean(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, ~SpecBoolean))
+            return proven;
+        return m_out.testNonZero64(
+            m_out.bitXor(jsValue, m_out.constInt64(ValueFalse)),
+            m_out.constInt64(~1));
+    }
+    LValue isBoolean(LValue jsValue, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, SpecBoolean))
+            return proven;
+        return m_out.logicalNot(isNotBoolean(jsValue));
+    }
+    LValue unboxBoolean(LValue jsValue)
+    {
+        // We want to use a cast that guarantees that B3 knows that even the integer
+        // value is just 0 or 1. But for now we do it the dumb way.
+        return m_out.notZero64(m_out.bitAnd(jsValue, m_out.constInt64(1)));
+    }
+    LValue boxBoolean(LValue value)
+    {
+        return m_out.select(
+            value, m_out.constInt64(ValueTrue), m_out.constInt64(ValueFalse));
+    }
+    
+    LValue isNotOther(LValue value, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, ~SpecOther))
+            return proven;
+        return m_out.notEqual(
+            m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
+            m_out.constInt64(ValueNull));
+    }
+    LValue isOther(LValue value, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type, SpecOther))
+            return proven;
+        return m_out.equal(
+            m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
+            m_out.constInt64(ValueNull));
+    }
+    
+    LValue isProvenValue(SpeculatedType provenType, SpeculatedType wantedType)
+    {
+        if (!(provenType & ~wantedType))
+            return m_out.booleanTrue;
+        if (!(provenType & wantedType))
+            return m_out.booleanFalse;
+        return nullptr;
+    }
+
+    void speculate(Edge edge)
+    {
+        switch (edge.useKind()) {
+        case UntypedUse:
+            break;
+        case KnownInt32Use:
+        case KnownStringUse:
+        case KnownPrimitiveUse:
+        case DoubleRepUse:
+        case Int52RepUse:
+            ASSERT(!m_interpreter.needsTypeCheck(edge));
+            break;
+        case Int32Use:
+            speculateInt32(edge);
+            break;
+        case CellUse:
+            speculateCell(edge);
+            break;
+        case CellOrOtherUse:
+            speculateCellOrOther(edge);
+            break;
+        case KnownCellUse:
+            ASSERT(!m_interpreter.needsTypeCheck(edge));
+            break;
+        case AnyIntUse:
+            speculateAnyInt(edge);
+            break;
+        case ObjectUse:
+            speculateObject(edge);
+            break;
+        case ArrayUse:
+            speculateArray(edge);
+            break;
+        case FunctionUse:
+            speculateFunction(edge);
+            break;
+        case ObjectOrOtherUse:
+            speculateObjectOrOther(edge);
+            break;
+        case FinalObjectUse:
+            speculateFinalObject(edge);
+            break;
+        case RegExpObjectUse:
+            speculateRegExpObject(edge);
+            break;
+        case ProxyObjectUse:
+            speculateProxyObject(edge);
+            break;
+        case DerivedArrayUse:
+            speculateDerivedArray(edge);
+            break;
+        case MapObjectUse:
+            speculateMapObject(edge);
+            break;
+        case SetObjectUse:
+            speculateSetObject(edge);
+            break;
+        case StringUse:
+            speculateString(edge);
+            break;
+        case StringOrOtherUse:
+            speculateStringOrOther(edge);
+            break;
+        case StringIdentUse:
+            speculateStringIdent(edge);
+            break;
+        case SymbolUse:
+            speculateSymbol(edge);
+            break;
+        case StringObjectUse:
+            speculateStringObject(edge);
+            break;
+        case StringOrStringObjectUse:
+            speculateStringOrStringObject(edge);
+            break;
+        case NumberUse:
+            speculateNumber(edge);
+            break;
+        case RealNumberUse:
+            speculateRealNumber(edge);
+            break;
+        case DoubleRepRealUse:
+            speculateDoubleRepReal(edge);
+            break;
+        case DoubleRepAnyIntUse:
+            speculateDoubleRepAnyInt(edge);
+            break;
+        case BooleanUse:
+            speculateBoolean(edge);
+            break;
+        case NotStringVarUse:
+            speculateNotStringVar(edge);
+            break;
+        case NotCellUse:
+            speculateNotCell(edge);
+            break;
+        case OtherUse:
+            speculateOther(edge);
+            break;
+        case MiscUse:
+            speculateMisc(edge);
+            break;
+        default:
+            DFG_CRASH(m_graph, m_node, "Unsupported speculation use kind");
+        }
+    }
+    
+    void speculate(Node*, Edge edge)
+    {
+        speculate(edge);
+    }
+    
+    void speculateInt32(Edge edge)
+    {
+        lowInt32(edge);
+    }
+    
+    void speculateCell(Edge edge)
+    {
+        lowCell(edge);
+    }
+    
+    void speculateCellOrOther(Edge edge)
+    {
+        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+
+        LBasicBlock isNotCell = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(isCell(value, provenType(edge)), unsure(continuation), unsure(isNotCell));
+
+        LBasicBlock lastNext = m_out.appendTo(isNotCell, continuation);
+        FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void speculateAnyInt(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge))
+            return;
+        
+        jsValueToStrictInt52(edge, lowJSValue(edge, ManualOperandSpeculation));
+    }
+
+    LValue isCellWithType(LValue cell, JSType queriedType, SpeculatedType speculatedTypeForQuery, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, speculatedTypeForQuery))
+            return proven;
+        return m_out.equal(
+            m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
+            m_out.constInt32(queriedType));
+    }
+
+    LValue isTypedArrayView(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, SpecTypedArrayView))
+            return proven;
+        LValue jsType = m_out.sub(
+            m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
+            m_out.constInt32(Int8ArrayType));
+        return m_out.belowOrEqual(
+            jsType,
+            m_out.constInt32(Float64ArrayType - Int8ArrayType));
+    }
+    
+    LValue isObject(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, SpecObject))
+            return proven;
+        return m_out.aboveOrEqual(
+            m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
+            m_out.constInt32(ObjectType));
+    }
+
+    LValue isNotObject(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, ~SpecObject))
+            return proven;
+        return m_out.below(
+            m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
+            m_out.constInt32(ObjectType));
+    }
+
+    LValue isNotString(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, ~SpecString))
+            return proven;
+        return m_out.notEqual(
+            m_out.load32(cell, m_heaps.JSCell_structureID),
+            m_out.constInt32(vm().stringStructure->id()));
+    }
+    
+    LValue isString(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, SpecString))
+            return proven;
+        return m_out.equal(
+            m_out.load32(cell, m_heaps.JSCell_structureID),
+            m_out.constInt32(vm().stringStructure->id()));
+    }
+
+    LValue isNotSymbol(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, ~SpecSymbol))
+            return proven;
+        return m_out.notEqual(
+            m_out.load32(cell, m_heaps.JSCell_structureID),
+            m_out.constInt32(vm().symbolStructure->id()));
+    }
+    
+    LValue isSymbol(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, SpecSymbol))
+            return proven;
+        return m_out.equal(
+            m_out.load32(cell, m_heaps.JSCell_structureID),
+            m_out.constInt32(vm().symbolStructure->id()));
+    }
+
+    LValue isArrayType(LValue cell, ArrayMode arrayMode)
+    {
+        switch (arrayMode.type()) {
+        case Array::Int32:
+        case Array::Double:
+        case Array::Contiguous: {
+            LValue indexingType = m_out.load8ZeroExt32(cell, m_heaps.JSCell_indexingTypeAndMisc);
+            
+            switch (arrayMode.arrayClass()) {
+            case Array::OriginalArray:
+                DFG_CRASH(m_graph, m_node, "Unexpected original array");
+                return 0;
+                
+            case Array::Array:
+                return m_out.equal(
+                    m_out.bitAnd(indexingType, m_out.constInt32(IsArray | IndexingShapeMask)),
+                    m_out.constInt32(IsArray | arrayMode.shapeMask()));
+                
+            case Array::NonArray:
+            case Array::OriginalNonArray:
+                return m_out.equal(
+                    m_out.bitAnd(indexingType, m_out.constInt32(IsArray | IndexingShapeMask)),
+                    m_out.constInt32(arrayMode.shapeMask()));
+                
+            case Array::PossiblyArray:
+                return m_out.equal(
+                    m_out.bitAnd(indexingType, m_out.constInt32(IndexingShapeMask)),
+                    m_out.constInt32(arrayMode.shapeMask()));
+            }
+            
+            DFG_CRASH(m_graph, m_node, "Corrupt array class");
+        }
+            
+        case Array::DirectArguments:
+            return m_out.equal(
+                m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
+                m_out.constInt32(DirectArgumentsType));
+            
+        case Array::ScopedArguments:
+            return m_out.equal(
+                m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
+                m_out.constInt32(ScopedArgumentsType));
+            
+        default:
+            return m_out.equal(
+                m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
+                m_out.constInt32(typeForTypedArrayType(arrayMode.typedArrayType())));
+        }
+    }
+    
+    LValue isFunction(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, SpecFunction))
+            return proven;
+        return isType(cell, JSFunctionType);
+    }
+    LValue isNotFunction(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (LValue proven = isProvenValue(type & SpecCell, ~SpecFunction))
+            return proven;
+        return isNotType(cell, JSFunctionType);
+    }
+            
+    LValue isExoticForTypeof(LValue cell, SpeculatedType type = SpecFullTop)
+    {
+        if (!(type & SpecObjectOther))
+            return m_out.booleanFalse;
+        return m_out.testNonZero32(
+            m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoFlags),
+            m_out.constInt32(MasqueradesAsUndefined | TypeOfShouldCallGetCallData));
+    }
+
+    LValue isType(LValue cell, JSType type)
+    {
+        return m_out.equal(
+            m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoType),
+            m_out.constInt32(type));
+    }
+    
+    LValue isNotType(LValue cell, JSType type)
+    {
+        return m_out.logicalNot(isType(cell, type));
+    }
+    
+    void speculateObject(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecObject, isNotObject(cell));
+    }
+    
+    void speculateObject(Edge edge)
+    {
+        speculateObject(edge, lowCell(edge));
+    }
+
+    void speculateArray(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecArray, isNotType(cell, ArrayType));
+    }
+
+    void speculateArray(Edge edge)
+    {
+        speculateArray(edge, lowCell(edge));
+    }
+    
+    void speculateFunction(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecFunction, isNotFunction(cell));
+    }
+    
+    void speculateFunction(Edge edge)
+    {
+        speculateFunction(edge, lowCell(edge));
+    }
+    
+    void speculateObjectOrOther(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge))
+            return;
+        
+        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+        
+        LBasicBlock cellCase = m_out.newBlock();
+        LBasicBlock primitiveCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        m_out.branch(isNotCell(value, provenType(edge)), unsure(primitiveCase), unsure(cellCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(cellCase, primitiveCase);
+        
+        FTL_TYPE_CHECK(
+            jsValueValue(value), edge, (~SpecCell) | SpecObject, isNotObject(value));
+        
+        m_out.jump(continuation);
+        
+        m_out.appendTo(primitiveCase, continuation);
+        
+        FTL_TYPE_CHECK(
+            jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
+        
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void speculateFinalObject(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecFinalObject, isNotType(cell, FinalObjectType));
+    }
+    
+    void speculateFinalObject(Edge edge)
+    {
+        speculateFinalObject(edge, lowCell(edge));
+    }
+    
+    void speculateRegExpObject(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecRegExpObject, isNotType(cell, RegExpObjectType));
+    }
+    
+    void speculateRegExpObject(Edge edge)
+    {
+        speculateRegExpObject(edge, lowCell(edge));
+    }
+
+    void speculateProxyObject(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecProxyObject, isNotType(cell, ProxyObjectType));
+    }
+
+    void speculateProxyObject(Edge edge)
+    {
+        speculateProxyObject(edge, lowCell(edge));
+    }
+
+    void speculateDerivedArray(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecDerivedArray, isNotType(cell, DerivedArrayType));
+    }
+
+    void speculateDerivedArray(Edge edge)
+    {
+        speculateDerivedArray(edge, lowCell(edge));
+    }
+
+    void speculateMapObject(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecMapObject, isNotType(cell, JSMapType));
+    }
+
+    void speculateMapObject(Edge edge)
+    {
+        speculateMapObject(edge, lowCell(edge));
+    }
+
+    void speculateSetObject(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecSetObject, isNotType(cell, JSSetType));
+    }
+
+    void speculateSetObject(Edge edge)
+    {
+        speculateSetObject(edge, lowCell(edge));
+    }
+    
+    void speculateString(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecString | ~SpecCell, isNotString(cell));
+    }
+    
+    void speculateString(Edge edge)
+    {
+        speculateString(edge, lowCell(edge));
+    }
+    
+    void speculateStringOrOther(Edge edge, LValue value)
+    {
+        LBasicBlock cellCase = m_out.newBlock();
+        LBasicBlock notCellCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
+
+        LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
+
+        FTL_TYPE_CHECK(jsValueValue(value), edge, (~SpecCell) | SpecString, isNotString(value));
+
+        m_out.jump(continuation);
+        m_out.appendTo(notCellCase, continuation);
+
+        FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
+
+        m_out.jump(continuation);
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void speculateStringOrOther(Edge edge)
+    {
+        speculateStringOrOther(edge, lowJSValue(edge, ManualOperandSpeculation));
+    }
+    
+    void speculateStringIdent(Edge edge, LValue string, LValue stringImpl)
+    {
+        if (!m_interpreter.needsTypeCheck(edge, SpecStringIdent | ~SpecString))
+            return;
+        
+        speculate(BadType, jsValueValue(string), edge.node(), m_out.isNull(stringImpl));
+        speculate(
+            BadType, jsValueValue(string), edge.node(),
+            m_out.testIsZero32(
+                m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
+                m_out.constInt32(StringImpl::flagIsAtomic())));
+        m_interpreter.filter(edge, SpecStringIdent | ~SpecString);
+    }
+    
+    void speculateStringIdent(Edge edge)
+    {
+        lowStringIdent(edge);
+    }
+    
+    void speculateStringObject(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge, SpecStringObject))
+            return;
+        
+        speculateStringObjectForCell(edge, lowCell(edge));
+        m_interpreter.filter(edge, SpecStringObject);
+    }
+    
+    void speculateStringOrStringObject(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge, SpecString | SpecStringObject))
+            return;
+        
+        LBasicBlock notString = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LValue structureID = m_out.load32(lowCell(edge), m_heaps.JSCell_structureID);
+        m_out.branch(
+            m_out.equal(structureID, m_out.constInt32(vm().stringStructure->id())),
+            unsure(continuation), unsure(notString));
+        
+        LBasicBlock lastNext = m_out.appendTo(notString, continuation);
+        speculateStringObjectForStructureID(edge, structureID);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+        
+        m_interpreter.filter(edge, SpecString | SpecStringObject);
+    }
+    
+    void speculateStringObjectForCell(Edge edge, LValue cell)
+    {
+        speculateStringObjectForStructureID(edge, m_out.load32(cell, m_heaps.JSCell_structureID));
+    }
+    
+    void speculateStringObjectForStructureID(Edge edge, LValue structureID)
+    {
+        RegisteredStructure stringObjectStructure =
+            m_graph.registerStructure(m_graph.globalObjectFor(m_node->origin.semantic)->stringObjectStructure());
+
+        if (abstractStructure(edge).isSubsetOf(RegisteredStructureSet(stringObjectStructure)))
+            return;
+        
+        speculate(
+            NotStringObject, noValue(), 0,
+            m_out.notEqual(structureID, weakStructureID(stringObjectStructure)));
+    }
+
+    void speculateSymbol(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecSymbol | ~SpecCell, isNotSymbol(cell));
+    }
+
+    void speculateSymbol(Edge edge)
+    {
+        speculateSymbol(edge, lowCell(edge));
+    }
+
+    void speculateNonNullObject(Edge edge, LValue cell)
+    {
+        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecObject, isNotObject(cell));
+        if (masqueradesAsUndefinedWatchpointIsStillValid())
+            return;
+        
+        speculate(
+            BadType, jsValueValue(cell), edge.node(),
+            m_out.testNonZero32(
+                m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoFlags),
+                m_out.constInt32(MasqueradesAsUndefined)));
+    }
+    
+    void speculateNumber(Edge edge)
+    {
+        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+        FTL_TYPE_CHECK(jsValueValue(value), edge, SpecBytecodeNumber, isNotNumber(value));
+    }
+    
+    void speculateRealNumber(Edge edge)
+    {
+        // Do an early return here because lowDouble() can create a lot of control flow.
+        if (!m_interpreter.needsTypeCheck(edge))
+            return;
+        
+        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+        LValue doubleValue = unboxDouble(value);
+        
+        LBasicBlock intCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        m_out.branch(
+            m_out.doubleEqual(doubleValue, doubleValue),
+            usually(continuation), rarely(intCase));
+        
+        LBasicBlock lastNext = m_out.appendTo(intCase, continuation);
+        
+        typeCheck(
+            jsValueValue(value), m_node->child1(), SpecBytecodeRealNumber,
+            isNotInt32(value, provenType(m_node->child1()) & ~SpecFullDouble));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void speculateDoubleRepReal(Edge edge)
+    {
+        // Do an early return here because lowDouble() can create a lot of control flow.
+        if (!m_interpreter.needsTypeCheck(edge))
+            return;
+        
+        LValue value = lowDouble(edge);
+        FTL_TYPE_CHECK(
+            doubleValue(value), edge, SpecDoubleReal,
+            m_out.doubleNotEqualOrUnordered(value, value));
+    }
+    
+    void speculateDoubleRepAnyInt(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge))
+            return;
+        
+        doubleToStrictInt52(edge, lowDouble(edge));
+    }
+    
+    void speculateBoolean(Edge edge)
+    {
+        lowBoolean(edge);
+    }
+    
+    void speculateNotStringVar(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge, ~SpecStringVar))
+            return;
+        
+        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+        
+        LBasicBlock isCellCase = m_out.newBlock();
+        LBasicBlock isStringCase = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        m_out.branch(isCell(value, provenType(edge)), unsure(isCellCase), unsure(continuation));
+        
+        LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);
+        m_out.branch(isString(value, provenType(edge)), unsure(isStringCase), unsure(continuation));
+        
+        m_out.appendTo(isStringCase, continuation);
+        speculateStringIdent(edge, value, m_out.loadPtr(value, m_heaps.JSString_value));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void speculateNotCell(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge))
+            return;
+        
+        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+        typeCheck(jsValueValue(value), edge, ~SpecCell, isCell(value));
+    }
+    
+    void speculateOther(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge))
+            return;
+        
+        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+        typeCheck(jsValueValue(value), edge, SpecOther, isNotOther(value));
+    }
+    
+    void speculateMisc(Edge edge)
+    {
+        if (!m_interpreter.needsTypeCheck(edge))
+            return;
+        
+        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+        typeCheck(jsValueValue(value), edge, SpecMisc, isNotMisc(value));
+    }
+
+    void speculateTypedArrayIsNotNeutered(LValue base)
+    {
+        LBasicBlock isWasteful = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+
+        LValue mode = m_out.load32(base, m_heaps.JSArrayBufferView_mode);
+        m_out.branch(m_out.equal(mode, m_out.constInt32(WastefulTypedArray)),
+            unsure(isWasteful), unsure(continuation));
+
+        LBasicBlock lastNext = m_out.appendTo(isWasteful, continuation);
+        LValue vector = m_out.loadPtr(base, m_heaps.JSArrayBufferView_vector);
+        speculate(Uncountable, jsValueValue(vector), m_node, m_out.isZero64(vector));
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+    }
+
+    bool masqueradesAsUndefinedWatchpointIsStillValid()
+    {
+        return m_graph.masqueradesAsUndefinedWatchpointIsStillValid(m_node->origin.semantic);
+    }
+    
+    LValue loadCellState(LValue base)
+    {
+        return m_out.load8ZeroExt32(base, m_heaps.JSCell_cellState);
+    }
+
+    void emitStoreBarrier(LValue base, bool isFenced)
+    {
+        LBasicBlock recheckPath = nullptr;
+        if (isFenced)
+            recheckPath = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(isFenced ? recheckPath : slowPath);
+
+        LValue threshold;
+        if (isFenced)
+            threshold = m_out.load32(m_out.absolute(vm().heap.addressOfBarrierThreshold()));
+        else
+            threshold = m_out.constInt32(blackThreshold);
+        
+        m_out.branch(
+            m_out.above(loadCellState(base), threshold),
+            usually(continuation), rarely(isFenced ? recheckPath : slowPath));
+        
+        if (isFenced) {
+            m_out.appendTo(recheckPath, slowPath);
+            
+            m_out.fence(&m_heaps.root, &m_heaps.JSCell_cellState);
+            
+            m_out.branch(
+                m_out.above(loadCellState(base), m_out.constInt32(blackThreshold)),
+                usually(continuation), rarely(slowPath));
+        }
+
+        m_out.appendTo(slowPath, continuation);
+        
+        LValue call = vmCall(Void, m_out.operation(operationWriteBarrierSlowPath), m_callFrame, base);
+        m_heaps.decorateCCallRead(&m_heaps.root, call);
+        m_heaps.decorateCCallWrite(&m_heaps.JSCell_cellState, call);
+        
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void mutatorFence()
+    {
+        if (isX86()) {
+            m_out.fence(&m_heaps.root, nullptr);
+            return;
+        }
+        
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
+        
+        m_out.branch(
+            m_out.load8ZeroExt32(m_out.absolute(vm().heap.addressOfMutatorShouldBeFenced())),
+            rarely(slowPath), usually(continuation));
+        
+        m_out.appendTo(slowPath, continuation);
+        
+        m_out.fence(&m_heaps.root, nullptr);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+    
+    void nukeStructureAndSetButterfly(LValue butterfly, LValue object)
+    {
+        if (isX86()) {
+            m_out.store32(
+                m_out.bitOr(
+                    m_out.load32(object, m_heaps.JSCell_structureID),
+                    m_out.constInt32(nukedStructureIDBit())),
+                object, m_heaps.JSCell_structureID);
+            m_out.fence(&m_heaps.root, nullptr);
+            m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);
+            m_out.fence(&m_heaps.root, nullptr);
+            return;
+        }
+        
+        LBasicBlock fastPath = m_out.newBlock();
+        LBasicBlock slowPath = m_out.newBlock();
+        LBasicBlock continuation = m_out.newBlock();
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(fastPath);
+        
+        m_out.branch(
+            m_out.load8ZeroExt32(m_out.absolute(vm().heap.addressOfMutatorShouldBeFenced())),
+            rarely(slowPath), usually(fastPath));
+
+        m_out.appendTo(fastPath, slowPath);
+        
+        m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(slowPath, continuation);
+        
+        m_out.store32(
+            m_out.bitOr(
+                m_out.load32(object, m_heaps.JSCell_structureID),
+                m_out.constInt32(nukedStructureIDBit())),
+            object, m_heaps.JSCell_structureID);
+        m_out.fence(&m_heaps.root, nullptr);
+        m_out.storePtr(butterfly, object, m_heaps.JSObject_butterfly);
+        m_out.fence(&m_heaps.root, nullptr);
+        m_out.jump(continuation);
+        
+        m_out.appendTo(continuation, lastNext);
+    }
+
+    template<typename... Args>
+    LValue vmCall(LType type, LValue function, Args... args)
+    {
+        callPreflight();
+        LValue result = m_out.call(type, function, args...);
+        callCheck();
+        return result;
+    }
+    
+    void callPreflight(CodeOrigin codeOrigin)
+    {
+        CallSiteIndex callSiteIndex = m_ftlState.jitCode->common.addCodeOrigin(codeOrigin);
+        m_out.store32(
+            m_out.constInt32(callSiteIndex.bits()),
+            tagFor(CallFrameSlot::argumentCount));
+    }
+
+    void callPreflight()
+    {
+        callPreflight(codeOriginDescriptionOfCallSite());
+    }
+
+    CodeOrigin codeOriginDescriptionOfCallSite() const
+    {
+        CodeOrigin codeOrigin = m_node->origin.semantic;
+        if (m_node->op() == TailCallInlinedCaller
+            || m_node->op() == TailCallVarargsInlinedCaller
+            || m_node->op() == TailCallForwardVarargsInlinedCaller
+            || m_node->op() == DirectTailCallInlinedCaller) {
+            // This case arises when you have a situation like this:
+            // foo makes a call to bar, bar is inlined in foo. bar makes a call
+            // to baz and baz is inlined in bar. And then baz makes a tail-call to jaz,
+            // and jaz is inlined in baz. We want the callframe for jaz to appear to 
+            // have caller be bar.
+            codeOrigin = *codeOrigin.inlineCallFrame->getCallerSkippingTailCalls();
+        }
+
+        return codeOrigin;
+    }
+    
+    void callCheck()
+    {
+        if (Options::useExceptionFuzz())
+            m_out.call(Void, m_out.operation(operationExceptionFuzz), m_callFrame);
+        
+        LValue exception = m_out.load64(m_out.absolute(vm().addressOfException()));
+        LValue hadException = m_out.notZero64(exception);
+
+        CodeOrigin opCatchOrigin;
+        HandlerInfo* exceptionHandler;
+        if (m_graph.willCatchExceptionInMachineFrame(m_origin.forExit, opCatchOrigin, exceptionHandler)) {
+            bool exitOK = true;
+            bool isExceptionHandler = true;
+            appendOSRExit(
+                ExceptionCheck, noValue(), nullptr, hadException,
+                m_origin.withForExitAndExitOK(opCatchOrigin, exitOK), isExceptionHandler);
+            return;
+        }
+
+        LBasicBlock continuation = m_out.newBlock();
+
+        m_out.branch(
+            hadException, rarely(m_handleExceptions), usually(continuation));
+
+        m_out.appendTo(continuation);
+    }
+
+    RefPtr<PatchpointExceptionHandle> preparePatchpointForExceptions(PatchpointValue* value)
+    {
+        CodeOrigin opCatchOrigin;
+        HandlerInfo* exceptionHandler;
+        bool willCatchException = m_graph.willCatchExceptionInMachineFrame(m_origin.forExit, opCatchOrigin, exceptionHandler);
+        if (!willCatchException)
+            return PatchpointExceptionHandle::defaultHandle(m_ftlState);
+
+        if (verboseCompilationEnabled()) {
+            dataLog("    Patchpoint exception OSR exit #", m_ftlState.jitCode->osrExitDescriptors.size(), " with availability: ", availabilityMap(), "\n");
+            if (!m_availableRecoveries.isEmpty())
+                dataLog("        Available recoveries: ", listDump(m_availableRecoveries), "\n");
+        }
+
+        bool exitOK = true;
+        NodeOrigin origin = m_origin.withForExitAndExitOK(opCatchOrigin, exitOK);
+
+        OSRExitDescriptor* exitDescriptor = appendOSRExitDescriptor(noValue(), nullptr);
+
+        // Compute the offset into the StackmapGenerationParams where we will find the exit arguments
+        // we are about to append. We need to account for both the children we've already added, and
+        // for the possibility of a result value if the patchpoint is not void.
+        unsigned offset = value->numChildren();
+        if (value->type() != Void)
+            offset++;
+
+        // Use LateColdAny to ensure that the stackmap arguments interfere with the patchpoint's
+        // result and with any late-clobbered registers.
+        value->appendVectorWithRep(
+            buildExitArguments(exitDescriptor, opCatchOrigin, noValue()),
+            ValueRep::LateColdAny);
+
+        return PatchpointExceptionHandle::create(
+            m_ftlState, exitDescriptor, origin, offset, *exceptionHandler);
+    }
+
+    LBasicBlock lowBlock(DFG::BasicBlock* block)
+    {
+        return m_blocks.get(block);
+    }
+
+    OSRExitDescriptor* appendOSRExitDescriptor(FormattedValue lowValue, Node* highValue)
+    {
+        return &m_ftlState.jitCode->osrExitDescriptors.alloc(
+            lowValue.format(), m_graph.methodOfGettingAValueProfileFor(m_node, highValue),
+            availabilityMap().m_locals.numberOfArguments(),
+            availabilityMap().m_locals.numberOfLocals());
+    }
+    
+    void appendOSRExit(
+        ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition, 
+        NodeOrigin origin, bool isExceptionHandler = false)
+    {
+        if (verboseCompilationEnabled()) {
+            dataLog("    OSR exit #", m_ftlState.jitCode->osrExitDescriptors.size(), " with availability: ", availabilityMap(), "\n");
+            if (!m_availableRecoveries.isEmpty())
+                dataLog("        Available recoveries: ", listDump(m_availableRecoveries), "\n");
+        }
+
+        DFG_ASSERT(m_graph, m_node, origin.exitOK);
+
+        if (!isExceptionHandler
+            && Options::useOSRExitFuzz()
+            && canUseOSRExitFuzzing(m_graph.baselineCodeBlockFor(m_node->origin.semantic))
+            && doOSRExitFuzzing()) {
+            LValue numberOfFuzzChecks = m_out.add(
+                m_out.load32(m_out.absolute(&g_numberOfOSRExitFuzzChecks)),
+                m_out.int32One);
+            
+            m_out.store32(numberOfFuzzChecks, m_out.absolute(&g_numberOfOSRExitFuzzChecks));
+            
+            if (unsigned atOrAfter = Options::fireOSRExitFuzzAtOrAfter()) {
+                failCondition = m_out.bitOr(
+                    failCondition,
+                    m_out.aboveOrEqual(numberOfFuzzChecks, m_out.constInt32(atOrAfter)));
+            }
+            if (unsigned at = Options::fireOSRExitFuzzAt()) {
+                failCondition = m_out.bitOr(
+                    failCondition,
+                    m_out.equal(numberOfFuzzChecks, m_out.constInt32(at)));
+            }
+        }
+
+        if (failCondition == m_out.booleanFalse)
+            return;
+
+        blessSpeculation(
+            m_out.speculate(failCondition), kind, lowValue, highValue, origin);
+    }
+
+    void blessSpeculation(CheckValue* value, ExitKind kind, FormattedValue lowValue, Node* highValue, NodeOrigin origin)
+    {
+        OSRExitDescriptor* exitDescriptor = appendOSRExitDescriptor(lowValue, highValue);
+        
+        value->appendColdAnys(buildExitArguments(exitDescriptor, origin.forExit, lowValue));
+
+        State* state = &m_ftlState;
+        value->setGenerator(
+            [=] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
+                exitDescriptor->emitOSRExit(
+                    *state, kind, origin, jit, params, 0);
+            });
+    }
+
+    StackmapArgumentList buildExitArguments(
+        OSRExitDescriptor* exitDescriptor, CodeOrigin exitOrigin, FormattedValue lowValue,
+        unsigned offsetOfExitArgumentsInStackmapLocations = 0)
+    {
+        StackmapArgumentList result;
+        buildExitArguments(
+            exitDescriptor, exitOrigin, result, lowValue, offsetOfExitArgumentsInStackmapLocations);
+        return result;
+    }
+    
+    void buildExitArguments(
+        OSRExitDescriptor* exitDescriptor, CodeOrigin exitOrigin, StackmapArgumentList& arguments, FormattedValue lowValue,
+        unsigned offsetOfExitArgumentsInStackmapLocations = 0)
+    {
+        if (!!lowValue)
+            arguments.append(lowValue.value());
+        
+        AvailabilityMap availabilityMap = this->availabilityMap();
+        availabilityMap.pruneByLiveness(m_graph, exitOrigin);
+        
+        HashMap<Node*, ExitTimeObjectMaterialization*> map;
+        availabilityMap.forEachAvailability(
+            [&] (Availability availability) {
+                if (!availability.shouldUseNode())
+                    return;
+                
+                Node* node = availability.node();
+                if (!node->isPhantomAllocation())
+                    return;
+                
+                auto result = map.add(node, nullptr);
+                if (result.isNewEntry) {
+                    result.iterator->value =
+                        exitDescriptor->m_materializations.add(node->op(), node->origin.semantic);
+                }
+            });
+        
+        for (unsigned i = 0; i < exitDescriptor->m_values.size(); ++i) {
+            int operand = exitDescriptor->m_values.operandForIndex(i);
+            
+            Availability availability = availabilityMap.m_locals[i];
+            
+            if (Options::validateFTLOSRExitLiveness()
+                && m_graph.m_plan.mode != FTLForOSREntryMode) {
+                
+                if (availability.isDead() && m_graph.isLiveInBytecode(VirtualRegister(operand), exitOrigin))
+                    DFG_CRASH(m_graph, m_node, toCString("Live bytecode local not available: operand = ", VirtualRegister(operand), ", availability = ", availability, ", origin = ", exitOrigin).data());
+            }
+            ExitValue exitValue = exitValueForAvailability(arguments, map, availability);
+            if (exitValue.hasIndexInStackmapLocations())
+                exitValue.adjustStackmapLocationsIndexByOffset(offsetOfExitArgumentsInStackmapLocations);
+            exitDescriptor->m_values[i] = exitValue;
+        }
+        
+        for (auto heapPair : availabilityMap.m_heap) {
+            Node* node = heapPair.key.base();
+            ExitTimeObjectMaterialization* materialization = map.get(node);
+            ExitValue exitValue = exitValueForAvailability(arguments, map, heapPair.value);
+            if (exitValue.hasIndexInStackmapLocations())
+                exitValue.adjustStackmapLocationsIndexByOffset(offsetOfExitArgumentsInStackmapLocations);
+            materialization->add(
+                heapPair.key.descriptor(),
+                exitValue);
+        }
+        
+        if (verboseCompilationEnabled()) {
+            dataLog("        Exit values: ", exitDescriptor->m_values, "\n");
+            if (!exitDescriptor->m_materializations.isEmpty()) {
+                dataLog("        Materializations: \n");
+                for (ExitTimeObjectMaterialization* materialization : exitDescriptor->m_materializations)
+                    dataLog("            ", pointerDump(materialization), "\n");
+            }
+        }
+    }
+
+    ExitValue exitValueForAvailability(
+        StackmapArgumentList& arguments, const HashMap<Node*, ExitTimeObjectMaterialization*>& map,
+        Availability availability)
+    {
+        FlushedAt flush = availability.flushedAt();
+        switch (flush.format()) {
+        case DeadFlush:
+        case ConflictingFlush:
+            if (availability.hasNode())
+                return exitValueForNode(arguments, map, availability.node());
+            
+            // This means that the value is dead. It could be dead in bytecode or it could have
+            // been killed by our DCE, which can sometimes kill things even if they were live in
+            // bytecode.
+            return ExitValue::dead();
+
+        case FlushedJSValue:
+        case FlushedCell:
+        case FlushedBoolean:
+            return ExitValue::inJSStack(flush.virtualRegister());
+                
+        case FlushedInt32:
+            return ExitValue::inJSStackAsInt32(flush.virtualRegister());
+                
+        case FlushedInt52:
+            return ExitValue::inJSStackAsInt52(flush.virtualRegister());
+                
+        case FlushedDouble:
+            return ExitValue::inJSStackAsDouble(flush.virtualRegister());
+        }
+        
+        DFG_CRASH(m_graph, m_node, "Invalid flush format");
+        return ExitValue::dead();
+    }
+    
+    ExitValue exitValueForNode(
+        StackmapArgumentList& arguments, const HashMap<Node*, ExitTimeObjectMaterialization*>& map,
+        Node* node)
+    {
+        // NOTE: In FTL->B3, we cannot generate code here, because m_output is positioned after the
+        // stackmap value. Like all values, the stackmap value cannot use a child that is defined after
+        // it.
+        
+        ASSERT(node->shouldGenerate());
+        ASSERT(node->hasResult());
+
+        if (node) {
+            switch (node->op()) {
+            case BottomValue:
+                // This might arise in object materializations. I actually doubt that it would,
+                // but it seems worthwhile to be conservative.
+                return ExitValue::dead();
+                
+            case JSConstant:
+            case Int52Constant:
+            case DoubleConstant:
+                return ExitValue::constant(node->asJSValue());
+                
+            default:
+                if (node->isPhantomAllocation())
+                    return ExitValue::materializeNewObject(map.get(node));
+                break;
+            }
+        }
+        
+        for (unsigned i = 0; i < m_availableRecoveries.size(); ++i) {
+            AvailableRecovery recovery = m_availableRecoveries[i];
+            if (recovery.node() != node)
+                continue;
+            ExitValue result = ExitValue::recovery(
+                recovery.opcode(), arguments.size(), arguments.size() + 1,
+                recovery.format());
+            arguments.append(recovery.left());
+            arguments.append(recovery.right());
+            return result;
+        }
+        
+        LoweredNodeValue value = m_int32Values.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatInt32, value.value());
+        
+        value = m_int52Values.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatInt52, value.value());
+        
+        value = m_strictInt52Values.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatStrictInt52, value.value());
+        
+        value = m_booleanValues.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatBoolean, value.value());
+        
+        value = m_jsValueValues.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatJS, value.value());
+        
+        value = m_doubleValues.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatDouble, value.value());
+
+        DFG_CRASH(m_graph, m_node, toCString("Cannot find value for node: ", node).data());
+        return ExitValue::dead();
+    }
+
+    ExitValue exitArgument(StackmapArgumentList& arguments, DataFormat format, LValue value)
+    {
+        ExitValue result = ExitValue::exitArgument(ExitArgument(format, arguments.size()));
+        arguments.append(value);
+        return result;
+    }
+
+    ExitValue exitValueForTailCall(StackmapArgumentList& arguments, Node* node)
+    {
+        ASSERT(node->shouldGenerate());
+        ASSERT(node->hasResult());
+
+        switch (node->op()) {
+        case JSConstant:
+        case Int52Constant:
+        case DoubleConstant:
+            return ExitValue::constant(node->asJSValue());
+
+        default:
+            break;
+        }
+
+        LoweredNodeValue value = m_jsValueValues.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatJS, value.value());
+
+        value = m_int32Values.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatJS, boxInt32(value.value()));
+
+        value = m_booleanValues.get(node);
+        if (isValid(value))
+            return exitArgument(arguments, DataFormatJS, boxBoolean(value.value()));
+
+        // Doubles and Int52 have been converted by ValueRep()
+        DFG_CRASH(m_graph, m_node, toCString("Cannot find value for node: ", node).data());
+    }
+
+    void addAvailableRecovery(
+        Node* node, RecoveryOpcode opcode, LValue left, LValue right, DataFormat format)
+    {
+        m_availableRecoveries.append(AvailableRecovery(node, opcode, left, right, format));
+    }
+    
+    void addAvailableRecovery(
+        Edge edge, RecoveryOpcode opcode, LValue left, LValue right, DataFormat format)
+    {
+        addAvailableRecovery(edge.node(), opcode, left, right, format);
+    }
+    
+    void setInt32(Node* node, LValue value)
+    {
+        m_int32Values.set(node, LoweredNodeValue(value, m_highBlock));
+    }
+    void setInt52(Node* node, LValue value)
+    {
+        m_int52Values.set(node, LoweredNodeValue(value, m_highBlock));
+    }
+    void setStrictInt52(Node* node, LValue value)
+    {
+        m_strictInt52Values.set(node, LoweredNodeValue(value, m_highBlock));
+    }
+    void setInt52(Node* node, LValue value, Int52Kind kind)
+    {
+        switch (kind) {
+        case Int52:
+            setInt52(node, value);
+            return;
+            
+        case StrictInt52:
+            setStrictInt52(node, value);
+            return;
+        }
+        
+        DFG_CRASH(m_graph, m_node, "Corrupt int52 kind");
+    }
+    void setJSValue(Node* node, LValue value)
+    {
+        m_jsValueValues.set(node, LoweredNodeValue(value, m_highBlock));
+    }
+    void setBoolean(Node* node, LValue value)
+    {
+        m_booleanValues.set(node, LoweredNodeValue(value, m_highBlock));
+    }
+    void setStorage(Node* node, LValue value)
+    {
+        m_storageValues.set(node, LoweredNodeValue(value, m_highBlock));
+    }
+    void setMapBucket(Node* node, LValue value)
+    {
+        m_mapBucketValues.set(node, LoweredNodeValue(value, m_highBlock));
+    }
+    void setDouble(Node* node, LValue value)
+    {
+        m_doubleValues.set(node, LoweredNodeValue(value, m_highBlock));
+    }
+
+    void setInt32(LValue value)
+    {
+        setInt32(m_node, value);
+    }
+    void setInt52(LValue value)
+    {
+        setInt52(m_node, value);
+    }
+    void setStrictInt52(LValue value)
+    {
+        setStrictInt52(m_node, value);
+    }
+    void setInt52(LValue value, Int52Kind kind)
+    {
+        setInt52(m_node, value, kind);
+    }
+    void setJSValue(LValue value)
+    {
+        setJSValue(m_node, value);
+    }
+    void setBoolean(LValue value)
+    {
+        setBoolean(m_node, value);
+    }
+    void setStorage(LValue value)
+    {
+        setStorage(m_node, value);
+    }
+    void setMapBucket(LValue value)
+    {
+        setMapBucket(m_node, value);
+    }
+    void setDouble(LValue value)
+    {
+        setDouble(m_node, value);
+    }
+    
+    bool isValid(const LoweredNodeValue& value)
+    {
+        if (!value)
+            return false;
+        if (!m_graph.m_dominators->dominates(value.block(), m_highBlock))
+            return false;
+        return true;
+    }
+    
+    void addWeakReference(JSCell* target)
+    {
+        m_graph.m_plan.weakReferences.addLazily(target);
+    }
+
+    LValue loadStructure(LValue value)
+    {
+        LValue tableIndex = m_out.load32(value, m_heaps.JSCell_structureID);
+        LValue tableBase = m_out.loadPtr(
+            m_out.absolute(vm().heap.structureIDTable().base()));
+        TypedPointer address = m_out.baseIndex(
+            m_heaps.structureTable, tableBase, m_out.zeroExtPtr(tableIndex));
+        return m_out.loadPtr(address);
+    }
+
+    LValue weakPointer(JSCell* pointer)
+    {
+        // There are weird relationships in how optimized CodeBlocks
+        // point to other CodeBlocks. We don't want to have them be
+        // part of the weak pointer set. For example, an optimized CodeBlock
+        // having a weak pointer to itself will cause it to get collected.
+        RELEASE_ASSERT(!jsDynamicCast<CodeBlock*>(pointer));
+
+        addWeakReference(pointer);
+        return m_out.weakPointer(m_graph, pointer);
+    }
+
+    LValue frozenPointer(FrozenValue* value)
+    {
+        return m_out.weakPointer(value);
+    }
+
+    LValue weakStructureID(RegisteredStructure structure)
+    {
+        return m_out.constInt32(structure->id());
+    }
+    
+    LValue weakStructure(RegisteredStructure structure)
+    {
+        ASSERT(!!structure.get());
+        return m_out.weakPointer(m_graph, structure.get());
+    }
+    
+    TypedPointer addressFor(LValue base, int operand, ptrdiff_t offset = 0)
+    {
+        return m_out.address(base, m_heaps.variables[operand], offset);
+    }
+    TypedPointer payloadFor(LValue base, int operand)
+    {
+        return addressFor(base, operand, PayloadOffset);
+    }
+    TypedPointer tagFor(LValue base, int operand)
+    {
+        return addressFor(base, operand, TagOffset);
+    }
+    TypedPointer addressFor(int operand, ptrdiff_t offset = 0)
+    {
+        return addressFor(VirtualRegister(operand), offset);
+    }
+    TypedPointer addressFor(VirtualRegister operand, ptrdiff_t offset = 0)
+    {
+        if (operand.isLocal())
+            return addressFor(m_captured, operand.offset(), offset);
+        return addressFor(m_callFrame, operand.offset(), offset);
+    }
+    TypedPointer payloadFor(int operand)
+    {
+        return payloadFor(VirtualRegister(operand));
+    }
+    TypedPointer payloadFor(VirtualRegister operand)
+    {
+        return addressFor(operand, PayloadOffset);
+    }
+    TypedPointer tagFor(int operand)
+    {
+        return tagFor(VirtualRegister(operand));
+    }
+    TypedPointer tagFor(VirtualRegister operand)
+    {
+        return addressFor(operand, TagOffset);
+    }
+    
+    AbstractValue abstractValue(Node* node)
+    {
+        return m_state.forNode(node);
+    }
+    AbstractValue abstractValue(Edge edge)
+    {
+        return abstractValue(edge.node());
+    }
+    
+    SpeculatedType provenType(Node* node)
+    {
+        return abstractValue(node).m_type;
+    }
+    SpeculatedType provenType(Edge edge)
+    {
+        return provenType(edge.node());
+    }
+    
+    JSValue provenValue(Node* node)
+    {
+        return abstractValue(node).m_value;
+    }
+    JSValue provenValue(Edge edge)
+    {
+        return provenValue(edge.node());
+    }
+    
+    StructureAbstractValue abstractStructure(Node* node)
+    {
+        return abstractValue(node).m_structure;
+    }
+    StructureAbstractValue abstractStructure(Edge edge)
+    {
+        return abstractStructure(edge.node());
+    }
+    
+#if ENABLE(MASM_PROBE)
+    void probe(std::function<void (CCallHelpers::ProbeContext*)> probeFunc)
+    {
+        UNUSED_PARAM(probeFunc);
+    }
+#endif
+
+    void crash()
+    {
+        crash(m_highBlock, m_node);
+    }
+    void crash(DFG::BasicBlock* block, Node* node)
+    {
+        BlockIndex blockIndex = block->index;
+        unsigned nodeIndex = node ? node->index() : UINT_MAX;
+#if ASSERT_DISABLED
+        m_out.patchpoint(Void)->setGenerator(
+            [=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+                
+                jit.move(CCallHelpers::TrustedImm32(blockIndex), GPRInfo::regT0);
+                jit.move(CCallHelpers::TrustedImm32(nodeIndex), GPRInfo::regT1);
+                if (node)
+                    jit.move(CCallHelpers::TrustedImm32(node->op()), GPRInfo::regT2);
+                jit.abortWithReason(FTLCrash);
+            });
+#else
+        m_out.call(
+            Void,
+            m_out.constIntPtr(ftlUnreachable),
+            // We don't want the CodeBlock to have a weak pointer to itself because
+            // that would cause it to always get collected.
+            m_out.constIntPtr(bitwise_cast<intptr_t>(codeBlock())), m_out.constInt32(blockIndex),
+            m_out.constInt32(nodeIndex));
+#endif
+        m_out.unreachable();
+    }
+
+    AvailabilityMap& availabilityMap() { return m_availabilityCalculator.m_availability; }
+    
+    VM& vm() { return m_graph.m_vm; }
+    CodeBlock* codeBlock() { return m_graph.m_codeBlock; }
+    
+    Graph& m_graph;
+    State& m_ftlState;
+    AbstractHeapRepository m_heaps;
+    Output m_out;
+    Procedure& m_proc;
+    
+    LBasicBlock m_prologue;
+    LBasicBlock m_handleExceptions;
+    HashMap<DFG::BasicBlock*, LBasicBlock> m_blocks;
+    
+    LValue m_callFrame;
+    LValue m_captured;
+    LValue m_tagTypeNumber;
+    LValue m_tagMask;
+    
+    HashMap<Node*, LoweredNodeValue> m_int32Values;
+    HashMap<Node*, LoweredNodeValue> m_strictInt52Values;
+    HashMap<Node*, LoweredNodeValue> m_int52Values;
+    HashMap<Node*, LoweredNodeValue> m_jsValueValues;
+    HashMap<Node*, LoweredNodeValue> m_booleanValues;
+    HashMap<Node*, LoweredNodeValue> m_storageValues;
+    HashMap<Node*, LoweredNodeValue> m_mapBucketValues;
+    HashMap<Node*, LoweredNodeValue> m_doubleValues;
+    
+    // This is a bit of a hack. It prevents B3 from having to do CSE on loading of arguments.
+    // It's nice to have these optimizations on our end because we can guarantee them a bit better.
+    // Probably also saves B3 compile time.
+    HashMap<Node*, LValue> m_loadedArgumentValues;
+    
+    HashMap<Node*, LValue> m_phis;
+    
+    LocalOSRAvailabilityCalculator m_availabilityCalculator;
+    
+    Vector<AvailableRecovery, 3> m_availableRecoveries;
+    
+    InPlaceAbstractState m_state;
+    AbstractInterpreter<InPlaceAbstractState> m_interpreter;
+    DFG::BasicBlock* m_highBlock;
+    DFG::BasicBlock* m_nextHighBlock;
+    LBasicBlock m_nextLowBlock;
+
+    NodeOrigin m_origin;
+    unsigned m_nodeIndex;
+    Node* m_node;
+};
+
+} // anonymous namespace
+
+void lowerDFGToB3(State& state)
+{
+    LowerDFGToB3 lowering(state);
+    lowering.lower();
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLLowerDFGToB3.h b/ftl/FTLLowerDFGToB3.h
new file mode 100644
index 0000000..e9569f4
--- /dev/null
+++ b/ftl/FTLLowerDFGToB3.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGGraph.h"
+#include "FTLState.h"
+
+namespace JSC { namespace FTL {
+
+void lowerDFGToB3(State&);
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLLoweredNodeValue.h b/ftl/FTLLoweredNodeValue.h
new file mode 100644
index 0000000..059667b
--- /dev/null
+++ b/ftl/FTLLoweredNodeValue.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGBasicBlock.h"
+#include "FTLAbbreviatedTypes.h"
+
+namespace JSC { namespace FTL {
+
+// Represents the act of having lowered a DFG::Node to an LValue, and records the
+// DFG::BasicBlock that did the lowering. The LValue is what we use most often, but
+// we need to verify that we're in a block that is dominated by the one that did
+// the lowering. We're guaranteed that for each DFG::Node, there will be one
+// LoweredNodeValue that always dominates all uses of the DFG::Node; but there may
+// be others that don't dominate and we're effectively doing opportunistic GVN on
+// the lowering code.
+
+class LoweredNodeValue {
+public:
+    LoweredNodeValue()
+        : m_value(0)
+        , m_block(0)
+    {
+    }
+    
+    LoweredNodeValue(LValue value, DFG::BasicBlock* block)
+        : m_value(value)
+        , m_block(block)
+    {
+        ASSERT(m_value);
+        ASSERT(m_block);
+    }
+    
+    bool isSet() const { return !!m_value; }
+    bool operator!() const { return !isSet(); }
+    
+    LValue value() const { return m_value; }
+    DFG::BasicBlock* block() const { return m_block; }
+    
+private:
+    LValue m_value;
+    DFG::BasicBlock* m_block;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLOSREntry.cpp b/ftl/FTLOSREntry.cpp
new file mode 100644
index 0000000..9a391e3
--- /dev/null
+++ b/ftl/FTLOSREntry.cpp
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2013-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLOSREntry.h"
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "DFGJITCode.h"
+#include "FTLForOSREntryJITCode.h"
+#include "OperandsInlines.h"
+#include "JSCInlines.h"
+#include "VMInlines.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+SUPPRESS_ASAN
+void* prepareOSREntry(
+    ExecState* exec, CodeBlock* dfgCodeBlock, CodeBlock* entryCodeBlock,
+    unsigned bytecodeIndex, unsigned streamIndex)
+{
+    VM& vm = exec->vm();
+    CodeBlock* baseline = dfgCodeBlock->baselineVersion();
+    ExecutableBase* executable = dfgCodeBlock->ownerExecutable();
+    DFG::JITCode* dfgCode = dfgCodeBlock->jitCode()->dfg();
+    ForOSREntryJITCode* entryCode = entryCodeBlock->jitCode()->ftlForOSREntry();
+    
+    if (Options::verboseOSR()) {
+        dataLog(
+            "FTL OSR from ", *dfgCodeBlock, " to ", *entryCodeBlock, " at bc#",
+            bytecodeIndex, ".\n");
+    }
+    
+    if (bytecodeIndex)
+        jsCast<ScriptExecutable*>(executable)->setDidTryToEnterInLoop(true);
+
+    if (bytecodeIndex != entryCode->bytecodeIndex()) {
+        if (Options::verboseOSR())
+            dataLog("    OSR failed because we don't have an entrypoint for bc#", bytecodeIndex, "; ours is for bc#", entryCode->bytecodeIndex(), "\n");
+        return 0;
+    }
+    
+    Operands<JSValue> values;
+    dfgCode->reconstruct(
+        exec, dfgCodeBlock, CodeOrigin(bytecodeIndex), streamIndex, values);
+    
+    if (Options::verboseOSR())
+        dataLog("    Values at entry: ", values, "\n");
+    
+    for (int argument = values.numberOfArguments(); argument--;) {
+        JSValue valueOnStack = exec->r(virtualRegisterForArgument(argument).offset()).asanUnsafeJSValue();
+        JSValue reconstructedValue = values.argument(argument);
+        if (valueOnStack == reconstructedValue || !argument)
+            continue;
+        dataLog("Mismatch between reconstructed values and the the value on the stack for argument arg", argument, " for ", *entryCodeBlock, " at bc#", bytecodeIndex, ":\n");
+        dataLog("    Value on stack: ", valueOnStack, "\n");
+        dataLog("    Reconstructed value: ", reconstructedValue, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    RELEASE_ASSERT(
+        static_cast<int>(values.numberOfLocals()) == baseline->m_numCalleeLocals);
+    
+    EncodedJSValue* scratch = static_cast<EncodedJSValue*>(
+        entryCode->entryBuffer()->dataBuffer());
+    
+    for (int local = values.numberOfLocals(); local--;)
+        scratch[local] = JSValue::encode(values.local(local));
+    
+    int stackFrameSize = entryCode->common.requiredRegisterCountForExecutionAndExit();
+    if (UNLIKELY(!vm.ensureStackCapacityFor(&exec->registers()[virtualRegisterForLocal(stackFrameSize - 1).offset()]))) {
+        if (Options::verboseOSR())
+            dataLog("    OSR failed because stack growth failed.\n");
+        return 0;
+    }
+    
+    exec->setCodeBlock(entryCodeBlock);
+    
+    void* result = entryCode->addressForCall(ArityCheckNotRequired).executableAddress();
+    if (Options::verboseOSR())
+        dataLog("    Entry will succeed, going to address", RawPointer(result), "\n");
+    
+    return result;
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
+
diff --git a/ftl/FTLOSREntry.h b/ftl/FTLOSREntry.h
new file mode 100644
index 0000000..439c4c2
--- /dev/null
+++ b/ftl/FTLOSREntry.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC {
+
+class CodeBlock;
+class ExecState;
+
+namespace FTL {
+
+void* prepareOSREntry(
+    ExecState*, CodeBlock* dfgCodeBlock, CodeBlock* entryCodeBlock, unsigned bytecodeIndex,
+    unsigned streamIndex);
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLOSRExit.cpp b/ftl/FTLOSRExit.cpp
new file mode 100644
index 0000000..d7b7838
--- /dev/null
+++ b/ftl/FTLOSRExit.cpp
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLOSRExit.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "AirGenerationContext.h"
+#include "B3StackmapGenerationParams.h"
+#include "B3StackmapValue.h"
+#include "CodeBlock.h"
+#include "DFGBasicBlock.h"
+#include "DFGNode.h"
+#include "FTLExitArgument.h"
+#include "FTLJITCode.h"
+#include "FTLLocation.h"
+#include "FTLState.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+using namespace DFG;
+
+OSRExitDescriptor::OSRExitDescriptor(
+    DataFormat profileDataFormat, MethodOfGettingAValueProfile valueProfile,
+    unsigned numberOfArguments, unsigned numberOfLocals)
+    : m_profileDataFormat(profileDataFormat)
+    , m_valueProfile(valueProfile)
+    , m_values(numberOfArguments, numberOfLocals)
+{
+}
+
+void OSRExitDescriptor::validateReferences(const TrackedReferences& trackedReferences)
+{
+    for (unsigned i = m_values.size(); i--;)
+        m_values[i].validateReferences(trackedReferences);
+    
+    for (ExitTimeObjectMaterialization* materialization : m_materializations)
+        materialization->validateReferences(trackedReferences);
+}
+
+RefPtr<OSRExitHandle> OSRExitDescriptor::emitOSRExit(
+    State& state, ExitKind exitKind, const NodeOrigin& nodeOrigin, CCallHelpers& jit,
+    const StackmapGenerationParams& params, unsigned offset)
+{
+    RefPtr<OSRExitHandle> handle =
+        prepareOSRExitHandle(state, exitKind, nodeOrigin, params, offset);
+    handle->emitExitThunk(state, jit);
+    return handle;
+}
+
+RefPtr<OSRExitHandle> OSRExitDescriptor::emitOSRExitLater(
+    State& state, ExitKind exitKind, const NodeOrigin& nodeOrigin,
+    const StackmapGenerationParams& params, unsigned offset)
+{
+    RefPtr<OSRExitHandle> handle =
+        prepareOSRExitHandle(state, exitKind, nodeOrigin, params, offset);
+    params.addLatePath(
+        [handle, &state] (CCallHelpers& jit) {
+            handle->emitExitThunk(state, jit);
+        });
+    return handle;
+}
+
+RefPtr<OSRExitHandle> OSRExitDescriptor::prepareOSRExitHandle(
+    State& state, ExitKind exitKind, const NodeOrigin& nodeOrigin,
+    const StackmapGenerationParams& params, unsigned offset)
+{
+    unsigned index = state.jitCode->osrExit.size();
+    OSRExit& exit = state.jitCode->osrExit.alloc(
+        this, exitKind, nodeOrigin.forExit, nodeOrigin.semantic, nodeOrigin.wasHoisted);
+    RefPtr<OSRExitHandle> handle = adoptRef(new OSRExitHandle(index, exit));
+    for (unsigned i = offset; i < params.size(); ++i)
+        exit.m_valueReps.append(params[i]);
+    exit.m_valueReps.shrinkToFit();
+    return handle;
+}
+
+OSRExit::OSRExit(
+    OSRExitDescriptor* descriptor, ExitKind exitKind, CodeOrigin codeOrigin,
+    CodeOrigin codeOriginForExitProfile, bool wasHoisted)
+    : OSRExitBase(exitKind, codeOrigin, codeOriginForExitProfile, wasHoisted)
+    , m_descriptor(descriptor)
+{
+}
+
+CodeLocationJump OSRExit::codeLocationForRepatch(CodeBlock* ftlCodeBlock) const
+{
+    UNUSED_PARAM(ftlCodeBlock);
+    return m_patchableJump;
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLOSRExit.h b/ftl/FTLOSRExit.h
new file mode 100644
index 0000000..d17909b
--- /dev/null
+++ b/ftl/FTLOSRExit.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "B3ValueRep.h"
+#include "CodeOrigin.h"
+#include "DFGExitProfile.h"
+#include "DFGNodeOrigin.h"
+#include "DFGOSRExitBase.h"
+#include "FTLAbbreviatedTypes.h"
+#include "FTLExitTimeObjectMaterialization.h"
+#include "FTLExitValue.h"
+#include "FTLFormattedValue.h"
+#include "FTLOSRExitHandle.h"
+#include "FTLStackmapArgumentList.h"
+#include "HandlerInfo.h"
+#include "MethodOfGettingAValueProfile.h"
+#include "Operands.h"
+#include "Reg.h"
+#include "ValueProfile.h"
+#include "VirtualRegister.h"
+
+namespace JSC {
+
+class TrackedReferences;
+
+namespace B3 {
+class StackmapGenerationParams;
+namespace Air {
+struct GenerationContext;
+} // namespace Air
+} // namespace B3
+
+namespace DFG {
+struct NodeOrigin;
+} // namespace DFG;
+
+namespace FTL {
+
+class State;
+struct OSRExitDescriptorImpl;
+struct OSRExitHandle;
+
+struct OSRExitDescriptor {
+    OSRExitDescriptor(
+        DataFormat profileDataFormat, MethodOfGettingAValueProfile,
+        unsigned numberOfArguments, unsigned numberOfLocals);
+
+    // The first argument to the exit call may be a value we wish to profile.
+    // If that's the case, the format will be not Invalid and we'll have a
+    // method of getting a value profile. Note that all of the ExitArgument's
+    // are already aware of this possible off-by-one, so there is no need to
+    // correct them.
+    DataFormat m_profileDataFormat;
+    MethodOfGettingAValueProfile m_valueProfile;
+    
+    Operands<ExitValue> m_values;
+    Bag<ExitTimeObjectMaterialization> m_materializations;
+
+    void validateReferences(const TrackedReferences&);
+
+    // Call this once we have a place to emit the OSR exit jump and we have data about how the state
+    // should be recovered. This effectively emits code that does the exit, though the code is really a
+    // patchable jump and we emit the real code lazily. The description of how to emit the real code is
+    // up to the OSRExit object, which this creates. Note that it's OK to drop the OSRExitHandle object
+    // on the ground. It contains information that is mostly not useful if you use this API, since after
+    // this call, the OSRExit is simply ready to go.
+    RefPtr<OSRExitHandle> emitOSRExit(
+        State&, ExitKind, const DFG::NodeOrigin&, CCallHelpers&, const B3::StackmapGenerationParams&,
+        unsigned offset = 0);
+
+    // In some cases you want an OSRExit to come into existence, but you don't want to emit it right now.
+    // This will emit the OSR exit in a late path. You can't be sure exactly when that will happen, but
+    // you know that it will be done by the time late path emission is done. So, a linker task will
+    // surely happen after that. You can use the OSRExitHandle to retrieve the exit's label.
+    //
+    // This API is meant to be used for things like exception handling, where some patchpoint wants to
+    // have a place to jump to for OSR exit. It doesn't care where that OSR exit is emitted so long as it
+    // eventually gets access to its label.
+    RefPtr<OSRExitHandle> emitOSRExitLater(
+        State&, ExitKind, const DFG::NodeOrigin&, const B3::StackmapGenerationParams&,
+        unsigned offset = 0);
+
+private:
+    // This is the low-level interface. It will create a handle representing the desire to emit code for
+    // an OSR exit. You can call OSRExitHandle::emitExitThunk() once you have a place to emit it. Note
+    // that the above two APIs are written in terms of this and OSRExitHandle::emitExitThunk().
+    RefPtr<OSRExitHandle> prepareOSRExitHandle(
+        State&, ExitKind, const DFG::NodeOrigin&, const B3::StackmapGenerationParams&,
+        unsigned offset = 0);
+};
+
+struct OSRExit : public DFG::OSRExitBase {
+    OSRExit(OSRExitDescriptor*, ExitKind, CodeOrigin, CodeOrigin codeOriginForExitProfile, bool wasHoisted);
+
+    OSRExitDescriptor* m_descriptor;
+    MacroAssemblerCodeRef m_code;
+    // This tells us where to place a jump.
+    CodeLocationJump m_patchableJump;
+    Vector<B3::ValueRep> m_valueReps;
+
+    CodeLocationJump codeLocationForRepatch(CodeBlock* ftlCodeBlock) const;
+    void considerAddingAsFrequentExitSite(CodeBlock* profiledCodeBlock)
+    {
+        OSRExitBase::considerAddingAsFrequentExitSite(profiledCodeBlock, ExitFromFTL);
+    }
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLOSRExitCompiler.cpp b/ftl/FTLOSRExitCompiler.cpp
new file mode 100644
index 0000000..9919e71
--- /dev/null
+++ b/ftl/FTLOSRExitCompiler.cpp
@@ -0,0 +1,587 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLOSRExitCompiler.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGOSRExitCompilerCommon.h"
+#include "DFGOSRExitPreparation.h"
+#include "FTLExitArgumentForOperand.h"
+#include "FTLJITCode.h"
+#include "FTLLocation.h"
+#include "FTLOSRExit.h"
+#include "FTLOperations.h"
+#include "FTLState.h"
+#include "FTLSaveRestore.h"
+#include "LinkBuffer.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "OperandsInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace FTL {
+
+using namespace DFG;
+
+static void reboxAccordingToFormat(
+    DataFormat format, AssemblyHelpers& jit, GPRReg value, GPRReg scratch1, GPRReg scratch2)
+{
+    switch (format) {
+    case DataFormatInt32: {
+        jit.zeroExtend32ToPtr(value, value);
+        jit.or64(GPRInfo::tagTypeNumberRegister, value);
+        break;
+    }
+
+    case DataFormatInt52: {
+        jit.rshift64(AssemblyHelpers::TrustedImm32(JSValue::int52ShiftAmount), value);
+        jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch2);
+        jit.boxInt52(value, value, scratch1, FPRInfo::fpRegT0);
+        jit.move64ToDouble(scratch2, FPRInfo::fpRegT0);
+        break;
+    }
+
+    case DataFormatStrictInt52: {
+        jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch2);
+        jit.boxInt52(value, value, scratch1, FPRInfo::fpRegT0);
+        jit.move64ToDouble(scratch2, FPRInfo::fpRegT0);
+        break;
+    }
+
+    case DataFormatBoolean: {
+        jit.zeroExtend32ToPtr(value, value);
+        jit.or32(MacroAssembler::TrustedImm32(ValueFalse), value);
+        break;
+    }
+
+    case DataFormatJS: {
+        // Done already!
+        break;
+    }
+
+    case DataFormatDouble: {
+        jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch1);
+        jit.move64ToDouble(value, FPRInfo::fpRegT0);
+        jit.purifyNaN(FPRInfo::fpRegT0);
+        jit.boxDouble(FPRInfo::fpRegT0, value);
+        jit.move64ToDouble(scratch1, FPRInfo::fpRegT0);
+        break;
+    }
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+static void compileRecovery(
+    CCallHelpers& jit, const ExitValue& value,
+    Vector<B3::ValueRep>& valueReps,
+    char* registerScratch,
+    const HashMap<ExitTimeObjectMaterialization*, EncodedJSValue*>& materializationToPointer)
+{
+    switch (value.kind()) {
+    case ExitValueDead:
+        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
+        break;
+            
+    case ExitValueConstant:
+        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
+        break;
+            
+    case ExitValueArgument:
+        Location::forValueRep(valueReps[value.exitArgument().argument()]).restoreInto(
+            jit, registerScratch, GPRInfo::regT0);
+        break;
+            
+    case ExitValueInJSStack:
+    case ExitValueInJSStackAsInt32:
+    case ExitValueInJSStackAsInt52:
+    case ExitValueInJSStackAsDouble:
+        jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
+        break;
+            
+    case ExitValueRecovery:
+        Location::forValueRep(valueReps[value.rightRecoveryArgument()]).restoreInto(
+            jit, registerScratch, GPRInfo::regT1);
+        Location::forValueRep(valueReps[value.leftRecoveryArgument()]).restoreInto(
+            jit, registerScratch, GPRInfo::regT0);
+        switch (value.recoveryOpcode()) {
+        case AddRecovery:
+            switch (value.recoveryFormat()) {
+            case DataFormatInt32:
+                jit.add32(GPRInfo::regT1, GPRInfo::regT0);
+                break;
+            case DataFormatInt52:
+                jit.add64(GPRInfo::regT1, GPRInfo::regT0);
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            break;
+        case SubRecovery:
+            switch (value.recoveryFormat()) {
+            case DataFormatInt32:
+                jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
+                break;
+            case DataFormatInt52:
+                jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        break;
+        
+    case ExitValueMaterializeNewObject:
+        jit.loadPtr(materializationToPointer.get(value.objectMaterialization()), GPRInfo::regT0);
+        break;
+            
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+        
+    reboxAccordingToFormat(
+        value.dataFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
+}
+
+static void compileStub(
+    unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)
+{
+    // This code requires framePointerRegister is the same as callFrameRegister
+    static_assert(MacroAssembler::framePointerRegister == GPRInfo::callFrameRegister, "MacroAssembler::framePointerRegister and GPRInfo::callFrameRegister must be the same");
+
+    CCallHelpers jit(vm, codeBlock);
+
+    // The first thing we need to do is restablish our frame in the case of an exception.
+    if (exit.isGenericUnwindHandler()) {
+        RELEASE_ASSERT(vm->callFrameForCatch); // The first time we hit this exit, like at all other times, this field should be non-null.
+        jit.restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer();
+        jit.loadPtr(vm->addressOfCallFrameForCatch(), MacroAssembler::framePointerRegister);
+        jit.addPtr(CCallHelpers::TrustedImm32(codeBlock->stackPointerOffset() * sizeof(Register)),
+            MacroAssembler::framePointerRegister, CCallHelpers::stackPointerRegister);
+
+        // Do a pushToSave because that's what the exit compiler below expects the stack
+        // to look like because that's the last thing the ExitThunkGenerator does. The code
+        // below doesn't actually use the value that was pushed, but it does rely on the
+        // general shape of the stack being as it is in the non-exception OSR case.
+        jit.pushToSaveImmediateWithoutTouchingRegisters(CCallHelpers::TrustedImm32(0xbadbeef));
+    }
+
+    // We need scratch space to save all registers, to build up the JS stack, to deal with unwind
+    // fixup, pointers to all of the objects we materialize, and the elements inside those objects
+    // that we materialize.
+    
+    // Figure out how much space we need for those object allocations.
+    unsigned numMaterializations = 0;
+    size_t maxMaterializationNumArguments = 0;
+    for (ExitTimeObjectMaterialization* materialization : exit.m_descriptor->m_materializations) {
+        numMaterializations++;
+        
+        maxMaterializationNumArguments = std::max(
+            maxMaterializationNumArguments,
+            materialization->properties().size());
+    }
+    
+    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(
+        sizeof(EncodedJSValue) * (
+            exit.m_descriptor->m_values.size() + numMaterializations + maxMaterializationNumArguments) +
+        requiredScratchMemorySizeInBytes() +
+        codeBlock->calleeSaveRegisters()->size() * sizeof(uint64_t));
+    EncodedJSValue* scratch = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;
+    EncodedJSValue* materializationPointers = scratch + exit.m_descriptor->m_values.size();
+    EncodedJSValue* materializationArguments = materializationPointers + numMaterializations;
+    char* registerScratch = bitwise_cast<char*>(materializationArguments + maxMaterializationNumArguments);
+    uint64_t* unwindScratch = bitwise_cast<uint64_t*>(registerScratch + requiredScratchMemorySizeInBytes());
+    
+    HashMap<ExitTimeObjectMaterialization*, EncodedJSValue*> materializationToPointer;
+    unsigned materializationCount = 0;
+    for (ExitTimeObjectMaterialization* materialization : exit.m_descriptor->m_materializations) {
+        materializationToPointer.add(
+            materialization, materializationPointers + materializationCount++);
+    }
+
+    auto recoverValue = [&] (const ExitValue& value) {
+        compileRecovery(
+            jit, value,
+            exit.m_valueReps,
+            registerScratch, materializationToPointer);
+    };
+    
+    // Note that we come in here, the stack used to be as B3 left it except that someone called pushToSave().
+    // We don't care about the value they saved. But, we do appreciate the fact that they did it, because we use
+    // that slot for saveAllRegisters().
+
+    saveAllRegisters(jit, registerScratch);
+    
+    // Bring the stack back into a sane form and assert that it's sane.
+    jit.popToRestore(GPRInfo::regT0);
+    jit.checkStackPointerAlignment();
+    
+    if (vm->m_perBytecodeProfiler && jitCode->dfgCommon()->compilation) {
+        Profiler::Database& database = *vm->m_perBytecodeProfiler;
+        Profiler::Compilation* compilation = jitCode->dfgCommon()->compilation.get();
+        
+        Profiler::OSRExit* profilerExit = compilation->addOSRExit(
+            exitID, Profiler::OriginStack(database, codeBlock, exit.m_codeOrigin),
+            exit.m_kind, exit.m_kind == UncountableInvalidation);
+        jit.add64(CCallHelpers::TrustedImm32(1), CCallHelpers::AbsoluteAddress(profilerExit->counterAddress()));
+    }
+
+    // The remaining code assumes that SP/FP are in the same state that they were in the FTL's
+    // call frame.
+    
+    // Get the call frame and tag thingies.
+    // Restore the exiting function's callFrame value into a regT4
+    jit.move(MacroAssembler::TrustedImm64(TagTypeNumber), GPRInfo::tagTypeNumberRegister);
+    jit.move(MacroAssembler::TrustedImm64(TagMask), GPRInfo::tagMaskRegister);
+    
+    // Do some value profiling.
+    if (exit.m_descriptor->m_profileDataFormat != DataFormatNone) {
+        Location::forValueRep(exit.m_valueReps[0]).restoreInto(jit, registerScratch, GPRInfo::regT0);
+        reboxAccordingToFormat(
+            exit.m_descriptor->m_profileDataFormat, jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
+        
+        if (exit.m_kind == BadCache || exit.m_kind == BadIndexingType) {
+            CodeOrigin codeOrigin = exit.m_codeOriginForExitProfile;
+            if (ArrayProfile* arrayProfile = jit.baselineCodeBlockFor(codeOrigin)->getArrayProfile(codeOrigin.bytecodeIndex)) {
+                jit.load32(MacroAssembler::Address(GPRInfo::regT0, JSCell::structureIDOffset()), GPRInfo::regT1);
+                jit.store32(GPRInfo::regT1, arrayProfile->addressOfLastSeenStructureID());
+                jit.load8(MacroAssembler::Address(GPRInfo::regT0, JSCell::indexingTypeAndMiscOffset()), GPRInfo::regT1);
+                jit.move(MacroAssembler::TrustedImm32(1), GPRInfo::regT2);
+                jit.lshift32(GPRInfo::regT1, GPRInfo::regT2);
+                jit.or32(GPRInfo::regT2, MacroAssembler::AbsoluteAddress(arrayProfile->addressOfArrayModes()));
+            }
+        }
+
+        if (exit.m_descriptor->m_valueProfile)
+            exit.m_descriptor->m_valueProfile.emitReportValue(jit, JSValueRegs(GPRInfo::regT0));
+    }
+
+    // Materialize all objects. Don't materialize an object until all
+    // of the objects it needs have been materialized. We break cycles
+    // by populating objects late - we only consider an object as
+    // needing another object if the later is needed for the
+    // allocation of the former.
+
+    HashSet<ExitTimeObjectMaterialization*> toMaterialize;
+    for (ExitTimeObjectMaterialization* materialization : exit.m_descriptor->m_materializations)
+        toMaterialize.add(materialization);
+
+    while (!toMaterialize.isEmpty()) {
+        unsigned previousToMaterializeSize = toMaterialize.size();
+
+        Vector<ExitTimeObjectMaterialization*> worklist;
+        worklist.appendRange(toMaterialize.begin(), toMaterialize.end());
+        for (ExitTimeObjectMaterialization* materialization : worklist) {
+            // Check if we can do anything about this right now.
+            bool allGood = true;
+            for (ExitPropertyValue value : materialization->properties()) {
+                if (!value.value().isObjectMaterialization())
+                    continue;
+                if (!value.location().neededForMaterialization())
+                    continue;
+                if (toMaterialize.contains(value.value().objectMaterialization())) {
+                    // Gotta skip this one, since it needs a
+                    // materialization that hasn't been materialized.
+                    allGood = false;
+                    break;
+                }
+            }
+            if (!allGood)
+                continue;
+
+            // All systems go for materializing the object. First we
+            // recover the values of all of its fields and then we
+            // call a function to actually allocate the beast.
+            // We only recover the fields that are needed for the allocation.
+            for (unsigned propertyIndex = materialization->properties().size(); propertyIndex--;) {
+                const ExitPropertyValue& property = materialization->properties()[propertyIndex];
+                if (!property.location().neededForMaterialization())
+                    continue;
+
+                recoverValue(property.value());
+                jit.storePtr(GPRInfo::regT0, materializationArguments + propertyIndex);
+            }
+            
+            // This call assumes that we don't pass arguments on the stack.
+            jit.setupArgumentsWithExecState(
+                CCallHelpers::TrustedImmPtr(materialization),
+                CCallHelpers::TrustedImmPtr(materializationArguments));
+            jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationMaterializeObjectInOSR)), GPRInfo::nonArgGPR0);
+            jit.call(GPRInfo::nonArgGPR0);
+            jit.storePtr(GPRInfo::returnValueGPR, materializationToPointer.get(materialization));
+
+            // Let everyone know that we're done.
+            toMaterialize.remove(materialization);
+        }
+        
+        // We expect progress! This ensures that we crash rather than looping infinitely if there
+        // is something broken about this fixpoint. Or, this could happen if we ever violate the
+        // "materializations form a DAG" rule.
+        RELEASE_ASSERT(toMaterialize.size() < previousToMaterializeSize);
+    }
+
+    // Now that all the objects have been allocated, we populate them
+    // with the correct values. This time we can recover all the
+    // fields, including those that are only needed for the allocation.
+    for (ExitTimeObjectMaterialization* materialization : exit.m_descriptor->m_materializations) {
+        for (unsigned propertyIndex = materialization->properties().size(); propertyIndex--;) {
+            recoverValue(materialization->properties()[propertyIndex].value());
+            jit.storePtr(GPRInfo::regT0, materializationArguments + propertyIndex);
+        }
+
+        // This call assumes that we don't pass arguments on the stack
+        jit.setupArgumentsWithExecState(
+            CCallHelpers::TrustedImmPtr(materialization),
+            CCallHelpers::TrustedImmPtr(materializationToPointer.get(materialization)),
+            CCallHelpers::TrustedImmPtr(materializationArguments));
+        jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationPopulateObjectInOSR)), GPRInfo::nonArgGPR0);
+        jit.call(GPRInfo::nonArgGPR0);
+    }
+
+    // Save all state from wherever the exit data tells us it was, into the appropriate place in
+    // the scratch buffer. This also does the reboxing.
+    
+    for (unsigned index = exit.m_descriptor->m_values.size(); index--;) {
+        recoverValue(exit.m_descriptor->m_values[index]);
+        jit.store64(GPRInfo::regT0, scratch + index);
+    }
+    
+    // Henceforth we make it look like the exiting function was called through a register
+    // preservation wrapper. This implies that FP must be nudged down by a certain amount. Then
+    // we restore the various things according to either exit.m_descriptor->m_values or by copying from the
+    // old frame, and finally we save the various callee-save registers into where the
+    // restoration thunk would restore them from.
+    
+    // Before we start messing with the frame, we need to set aside any registers that the
+    // FTL code was preserving.
+    for (unsigned i = codeBlock->calleeSaveRegisters()->size(); i--;) {
+        RegisterAtOffset entry = codeBlock->calleeSaveRegisters()->at(i);
+        jit.load64(
+            MacroAssembler::Address(MacroAssembler::framePointerRegister, entry.offset()),
+            GPRInfo::regT0);
+        jit.store64(GPRInfo::regT0, unwindScratch + i);
+    }
+    
+    jit.load32(CCallHelpers::payloadFor(CallFrameSlot::argumentCount), GPRInfo::regT2);
+    
+    // Let's say that the FTL function had failed its arity check. In that case, the stack will
+    // contain some extra stuff.
+    //
+    // We compute the padded stack space:
+    //
+    //     paddedStackSpace = roundUp(codeBlock->numParameters - regT2 + 1)
+    //
+    // The stack will have regT2 + CallFrameHeaderSize stuff.
+    // We want to make the stack look like this, from higher addresses down:
+    //
+    //     - argument padding
+    //     - actual arguments
+    //     - call frame header
+
+    // This code assumes that we're dealing with FunctionCode.
+    RELEASE_ASSERT(codeBlock->codeType() == FunctionCode);
+    
+    jit.add32(
+        MacroAssembler::TrustedImm32(-codeBlock->numParameters()), GPRInfo::regT2,
+        GPRInfo::regT3);
+    MacroAssembler::Jump arityIntact = jit.branch32(
+        MacroAssembler::GreaterThanOrEqual, GPRInfo::regT3, MacroAssembler::TrustedImm32(0));
+    jit.neg32(GPRInfo::regT3);
+    jit.add32(MacroAssembler::TrustedImm32(1 + stackAlignmentRegisters() - 1), GPRInfo::regT3);
+    jit.and32(MacroAssembler::TrustedImm32(-stackAlignmentRegisters()), GPRInfo::regT3);
+    jit.add32(GPRInfo::regT3, GPRInfo::regT2);
+    arityIntact.link(&jit);
+
+    CodeBlock* baselineCodeBlock = jit.baselineCodeBlockFor(exit.m_codeOrigin);
+
+    // First set up SP so that our data doesn't get clobbered by signals.
+    unsigned conservativeStackDelta =
+        (exit.m_descriptor->m_values.numberOfLocals() + baselineCodeBlock->calleeSaveSpaceAsVirtualRegisters()) * sizeof(Register) +
+        maxFrameExtentForSlowPathCall;
+    conservativeStackDelta = WTF::roundUpToMultipleOf(
+        stackAlignmentBytes(), conservativeStackDelta);
+    jit.addPtr(
+        MacroAssembler::TrustedImm32(-conservativeStackDelta),
+        MacroAssembler::framePointerRegister, MacroAssembler::stackPointerRegister);
+    jit.checkStackPointerAlignment();
+
+    RegisterSet allFTLCalleeSaves = RegisterSet::ftlCalleeSaveRegisters();
+    RegisterAtOffsetList* baselineCalleeSaves = baselineCodeBlock->calleeSaveRegisters();
+    RegisterAtOffsetList* vmCalleeSaves = vm->getAllCalleeSaveRegisterOffsets();
+    RegisterSet vmCalleeSavesToSkip = RegisterSet::stackRegisters();
+    if (exit.isExceptionHandler()) {
+        jit.loadPtr(&vm->topVMEntryFrame, GPRInfo::regT1);
+        jit.addPtr(CCallHelpers::TrustedImm32(VMEntryFrame::calleeSaveRegistersBufferOffset()), GPRInfo::regT1);
+    }
+
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        if (!allFTLCalleeSaves.get(reg)) {
+            if (exit.isExceptionHandler())
+                RELEASE_ASSERT(!vmCalleeSaves->find(reg));
+            continue;
+        }
+        unsigned unwindIndex = codeBlock->calleeSaveRegisters()->indexOf(reg);
+        RegisterAtOffset* baselineRegisterOffset = baselineCalleeSaves->find(reg);
+        RegisterAtOffset* vmCalleeSave = nullptr; 
+        if (exit.isExceptionHandler())
+            vmCalleeSave = vmCalleeSaves->find(reg);
+
+        if (reg.isGPR()) {
+            GPRReg regToLoad = baselineRegisterOffset ? GPRInfo::regT0 : reg.gpr();
+            RELEASE_ASSERT(regToLoad != GPRInfo::regT1);
+
+            if (unwindIndex == UINT_MAX) {
+                // The FTL compilation didn't preserve this register. This means that it also
+                // didn't use the register. So its value at the beginning of OSR exit should be
+                // preserved by the thunk. Luckily, we saved all registers into the register
+                // scratch buffer, so we can restore them from there.
+                jit.load64(registerScratch + offsetOfReg(reg), regToLoad);
+            } else {
+                // The FTL compilation preserved the register. Its new value is therefore
+                // irrelevant, but we can get the value that was preserved by using the unwind
+                // data. We've already copied all unwind-able preserved registers into the unwind
+                // scratch buffer, so we can get it from there.
+                jit.load64(unwindScratch + unwindIndex, regToLoad);
+            }
+
+            if (baselineRegisterOffset)
+                jit.store64(regToLoad, MacroAssembler::Address(MacroAssembler::framePointerRegister, baselineRegisterOffset->offset()));
+            if (vmCalleeSave && !vmCalleeSavesToSkip.get(vmCalleeSave->reg()))
+                jit.store64(regToLoad, MacroAssembler::Address(GPRInfo::regT1, vmCalleeSave->offset()));
+        } else {
+            FPRReg fpRegToLoad = baselineRegisterOffset ? FPRInfo::fpRegT0 : reg.fpr();
+
+            if (unwindIndex == UINT_MAX)
+                jit.loadDouble(MacroAssembler::TrustedImmPtr(registerScratch + offsetOfReg(reg)), fpRegToLoad);
+            else
+                jit.loadDouble(MacroAssembler::TrustedImmPtr(unwindScratch + unwindIndex), fpRegToLoad);
+
+            if (baselineRegisterOffset)
+                jit.storeDouble(fpRegToLoad, MacroAssembler::Address(MacroAssembler::framePointerRegister, baselineRegisterOffset->offset()));
+            if (vmCalleeSave && !vmCalleeSavesToSkip.get(vmCalleeSave->reg()))
+                jit.storeDouble(fpRegToLoad, MacroAssembler::Address(GPRInfo::regT1, vmCalleeSave->offset()));
+        }
+    }
+
+    if (exit.isExceptionHandler()) {
+        RegisterAtOffset* vmCalleeSave = vmCalleeSaves->find(GPRInfo::tagTypeNumberRegister);
+        jit.store64(GPRInfo::tagTypeNumberRegister, MacroAssembler::Address(GPRInfo::regT1, vmCalleeSave->offset()));
+
+        vmCalleeSave = vmCalleeSaves->find(GPRInfo::tagMaskRegister);
+        jit.store64(GPRInfo::tagMaskRegister, MacroAssembler::Address(GPRInfo::regT1, vmCalleeSave->offset()));
+    }
+
+    size_t baselineVirtualRegistersForCalleeSaves = baselineCodeBlock->calleeSaveSpaceAsVirtualRegisters();
+
+    // Now get state out of the scratch buffer and place it back into the stack. The values are
+    // already reboxed so we just move them.
+    for (unsigned index = exit.m_descriptor->m_values.size(); index--;) {
+        VirtualRegister reg = exit.m_descriptor->m_values.virtualRegisterForIndex(index);
+
+        if (reg.isLocal() && reg.toLocal() < static_cast<int>(baselineVirtualRegistersForCalleeSaves))
+            continue;
+
+        jit.load64(scratch + index, GPRInfo::regT0);
+        jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(reg));
+    }
+    
+    handleExitCounts(jit, exit);
+    reifyInlinedCallFrames(jit, exit);
+    adjustAndJumpToTarget(jit, exit);
+    
+    LinkBuffer patchBuffer(*vm, jit, codeBlock);
+    exit.m_code = FINALIZE_CODE_IF(
+        shouldDumpDisassembly() || Options::verboseOSR() || Options::verboseFTLOSRExit(),
+        patchBuffer,
+        ("FTL OSR exit #%u (%s, %s) from %s, with operands = %s",
+            exitID, toCString(exit.m_codeOrigin).data(),
+            exitKindToString(exit.m_kind), toCString(*codeBlock).data(),
+            toCString(ignoringContext<DumpContext>(exit.m_descriptor->m_values)).data())
+        );
+}
+
+extern "C" void* compileFTLOSRExit(ExecState* exec, unsigned exitID)
+{
+    if (shouldDumpDisassembly() || Options::verboseOSR() || Options::verboseFTLOSRExit())
+        dataLog("Compiling OSR exit with exitID = ", exitID, "\n");
+
+    if (exec->vm().callFrameForCatch)
+        RELEASE_ASSERT(exec->vm().callFrameForCatch == exec);
+    
+    CodeBlock* codeBlock = exec->codeBlock();
+    
+    ASSERT(codeBlock);
+    ASSERT(codeBlock->jitType() == JITCode::FTLJIT);
+    
+    VM* vm = &exec->vm();
+    
+    // It's sort of preferable that we don't GC while in here. Anyways, doing so wouldn't
+    // really be profitable.
+    DeferGCForAWhile deferGC(vm->heap);
+
+    JITCode* jitCode = codeBlock->jitCode()->ftl();
+    OSRExit& exit = jitCode->osrExit[exitID];
+    
+    if (shouldDumpDisassembly() || Options::verboseOSR() || Options::verboseFTLOSRExit()) {
+        dataLog("    Owning block: ", pointerDump(codeBlock), "\n");
+        dataLog("    Origin: ", exit.m_codeOrigin, "\n");
+        if (exit.m_codeOriginForExitProfile != exit.m_codeOrigin)
+            dataLog("    Origin for exit profile: ", exit.m_codeOriginForExitProfile, "\n");
+        dataLog("    Current call site index: ", exec->callSiteIndex().bits(), "\n");
+        dataLog("    Exit is exception handler: ", exit.isExceptionHandler(), "\n");
+        dataLog("    Is unwind handler: ", exit.isGenericUnwindHandler(), "\n");
+        dataLog("    Exit values: ", exit.m_descriptor->m_values, "\n");
+        dataLog("    Value reps: ", listDump(exit.m_valueReps), "\n");
+        if (!exit.m_descriptor->m_materializations.isEmpty()) {
+            dataLog("    Materializations:\n");
+            for (ExitTimeObjectMaterialization* materialization : exit.m_descriptor->m_materializations)
+                dataLog("        ", pointerDump(materialization), "\n");
+        }
+    }
+
+    prepareCodeOriginForOSRExit(exec, exit.m_codeOrigin);
+    
+    compileStub(exitID, jitCode, exit, vm, codeBlock);
+
+    MacroAssembler::repatchJump(
+        exit.codeLocationForRepatch(codeBlock), CodeLocationLabel(exit.m_code.code()));
+    
+    return exit.m_code.code().executableAddress();
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLOSRExitCompiler.h b/ftl/FTLOSRExitCompiler.h
new file mode 100644
index 0000000..405b7a5
--- /dev/null
+++ b/ftl/FTLOSRExitCompiler.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGOperations.h"
+
+namespace JSC { namespace FTL {
+
+// Takes the call frame and the index of the exit, and returns the address to
+// jump to.
+extern "C" {
+void* JIT_OPERATION compileFTLOSRExit(ExecState*, unsigned exitID) WTF_INTERNAL;
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLOSRExitHandle.cpp b/ftl/FTLOSRExitHandle.cpp
new file mode 100644
index 0000000..11942b7
--- /dev/null
+++ b/ftl/FTLOSRExitHandle.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLOSRExitHandle.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLOSRExit.h"
+#include "FTLState.h"
+#include "FTLThunks.h"
+#include "LinkBuffer.h"
+#include "ProfilerCompilation.h"
+
+namespace JSC { namespace FTL {
+
+void OSRExitHandle::emitExitThunk(State& state, CCallHelpers& jit)
+{
+    Profiler::Compilation* compilation = state.graph.compilation();
+    CCallHelpers::Label myLabel = jit.label();
+    label = myLabel;
+    jit.pushToSaveImmediateWithoutTouchingRegisters(CCallHelpers::TrustedImm32(index));
+    CCallHelpers::PatchableJump jump = jit.patchableJump();
+    RefPtr<OSRExitHandle> self = this;
+    jit.addLinkTask(
+        [self, jump, myLabel, compilation] (LinkBuffer& linkBuffer) {
+            self->exit.m_patchableJump = CodeLocationJump(linkBuffer.locationOf(jump));
+
+            linkBuffer.link(
+                jump.m_jump,
+                CodeLocationLabel(linkBuffer.vm().getCTIStub(osrExitGenerationThunkGenerator).code()));
+            if (compilation)
+                compilation->addOSRExitSite({ linkBuffer.locationOf(myLabel).executableAddress() });
+        });
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLOSRExitHandle.h b/ftl/FTLOSRExitHandle.h
new file mode 100644
index 0000000..0763d79
--- /dev/null
+++ b/ftl/FTLOSRExitHandle.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGCommon.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "CCallHelpers.h"
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace JSC { namespace FTL {
+
+class State;
+struct OSRExit;
+
+// This is an object that stores some interesting data about an OSR exit. It's expected that you will
+// scrape this data from this object by the time compilation finishes.
+struct OSRExitHandle : public ThreadSafeRefCounted<OSRExitHandle> {
+    OSRExitHandle(unsigned index, OSRExit& exit)
+        : index(index)
+        , exit(exit)
+    {
+    }
+
+    unsigned index;
+    OSRExit& exit;
+
+    // This is the label at which the OSR exit jump lives. This will get populated once the OSR exit
+    // emits its jump. This happens immediately when you call OSRExit::appendOSRExit(). It happens at
+    // some time during late path emission if you do OSRExit::appendOSRExitLater().
+    CCallHelpers::Label label;
+
+    // This emits the exit thunk and populates 'label'.
+    void emitExitThunk(State&, CCallHelpers&);
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLOperations.cpp b/ftl/FTLOperations.cpp
new file mode 100644
index 0000000..f769d2c
--- /dev/null
+++ b/ftl/FTLOperations.cpp
@@ -0,0 +1,529 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLOperations.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "ClonedArguments.h"
+#include "DirectArguments.h"
+#include "FTLJITCode.h"
+#include "FTLLazySlowPath.h"
+#include "InlineCallFrame.h"
+#include "JSAsyncFunction.h"
+#include "JSCInlines.h"
+#include "JSFixedArray.h"
+#include "JSGeneratorFunction.h"
+#include "JSLexicalEnvironment.h"
+
+namespace JSC { namespace FTL {
+
+using namespace JSC::DFG;
+
+extern "C" void JIT_OPERATION operationPopulateObjectInOSR(
+    ExecState* exec, ExitTimeObjectMaterialization* materialization,
+    EncodedJSValue* encodedValue, EncodedJSValue* values)
+{
+    VM& vm = exec->vm();
+    CodeBlock* codeBlock = exec->codeBlock();
+
+    // We cannot GC. We've got pointers in evil places.
+    // FIXME: We are not doing anything that can GC here, and this is
+    // probably unnecessary.
+    DeferGCForAWhile deferGC(vm.heap);
+
+    switch (materialization->type()) {
+    case PhantomNewObject: {
+        JSFinalObject* object = jsCast<JSFinalObject*>(JSValue::decode(*encodedValue));
+        Structure* structure = object->structure();
+
+        // Figure out what the heck to populate the object with. Use
+        // getPropertiesConcurrently() because that happens to be
+        // lower-level and more convenient. It doesn't change the
+        // materialization of the property table. We want to have
+        // minimal visible effects on the system. Also, don't mind
+        // that this is O(n^2). It doesn't matter. We only get here
+        // from OSR exit.
+        for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
+            for (unsigned i = materialization->properties().size(); i--;) {
+                const ExitPropertyValue& property = materialization->properties()[i];
+                if (property.location().kind() != NamedPropertyPLoc)
+                    continue;
+                if (codeBlock->identifier(property.location().info()).impl() != entry.key)
+                    continue;
+
+                object->putDirect(vm, entry.offset, JSValue::decode(values[i]));
+            }
+        }
+        break;
+    }
+
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction:
+    case PhantomDirectArguments:
+    case PhantomClonedArguments:
+    case PhantomCreateRest:
+    case PhantomSpread:
+    case PhantomNewArrayWithSpread:
+        // Those are completely handled by operationMaterializeObjectInOSR
+        break;
+
+    case PhantomCreateActivation: {
+        JSLexicalEnvironment* activation = jsCast<JSLexicalEnvironment*>(JSValue::decode(*encodedValue));
+
+        // Figure out what to populate the activation with
+        for (unsigned i = materialization->properties().size(); i--;) {
+            const ExitPropertyValue& property = materialization->properties()[i];
+            if (property.location().kind() != ClosureVarPLoc)
+                continue;
+
+            activation->variableAt(ScopeOffset(property.location().info())).set(exec->vm(), activation, JSValue::decode(values[i]));
+        }
+
+        break;
+    }
+
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+
+    }
+}
+
+extern "C" JSCell* JIT_OPERATION operationMaterializeObjectInOSR(
+    ExecState* exec, ExitTimeObjectMaterialization* materialization, EncodedJSValue* values)
+{
+    VM& vm = exec->vm();
+
+    // We cannot GC. We've got pointers in evil places.
+    DeferGCForAWhile deferGC(vm.heap);
+    
+    switch (materialization->type()) {
+    case PhantomNewObject: {
+        // Figure out what the structure is
+        Structure* structure = nullptr;
+        for (unsigned i = materialization->properties().size(); i--;) {
+            const ExitPropertyValue& property = materialization->properties()[i];
+            if (property.location() != PromotedLocationDescriptor(StructurePLoc))
+                continue;
+
+            RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits(Structure::info()));
+            structure = jsCast<Structure*>(JSValue::decode(values[i]));
+            break;
+        }
+        RELEASE_ASSERT(structure);
+
+        JSFinalObject* result = JSFinalObject::create(vm, structure);
+
+        // The real values will be put subsequently by
+        // operationPopulateNewObjectInOSR. We can't fill them in
+        // now, because they may not be available yet (typically
+        // because we have a cyclic dependency graph).
+
+        // We put a dummy value here in order to avoid super-subtle
+        // GC-and-OSR-exit crashes in case we have a bug and some
+        // field is, for any reason, not filled later.
+        // We use a random-ish number instead of a sensible value like
+        // undefined to make possible bugs easier to track.
+        for (PropertyMapEntry entry : structure->getPropertiesConcurrently())
+            result->putDirect(vm, entry.offset, jsNumber(19723));
+
+        return result;
+    }
+
+    case PhantomNewFunction:
+    case PhantomNewGeneratorFunction:
+    case PhantomNewAsyncFunction: {
+        // Figure out what the executable and activation are
+        FunctionExecutable* executable = nullptr;
+        JSScope* activation = nullptr;
+        for (unsigned i = materialization->properties().size(); i--;) {
+            const ExitPropertyValue& property = materialization->properties()[i];
+            if (property.location() == PromotedLocationDescriptor(FunctionExecutablePLoc)) {
+                RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits(FunctionExecutable::info()));
+                executable = jsCast<FunctionExecutable*>(JSValue::decode(values[i]));
+            }
+            if (property.location() == PromotedLocationDescriptor(FunctionActivationPLoc)) {
+                RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits(JSScope::info()));
+                activation = jsCast<JSScope*>(JSValue::decode(values[i]));
+            }
+        }
+        RELEASE_ASSERT(executable && activation);
+
+        if (materialization->type() == PhantomNewFunction)
+            return JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
+        else if (materialization->type() == PhantomNewGeneratorFunction)
+            return JSGeneratorFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);    
+        ASSERT(materialization->type() == PhantomNewAsyncFunction);
+        return JSAsyncFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
+    }
+
+    case PhantomCreateActivation: {
+        // Figure out what the scope and symbol table are
+        JSScope* scope = nullptr;
+        SymbolTable* table = nullptr;
+        for (unsigned i = materialization->properties().size(); i--;) {
+            const ExitPropertyValue& property = materialization->properties()[i];
+            if (property.location() == PromotedLocationDescriptor(ActivationScopePLoc)) {
+                RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits(JSScope::info()));
+                scope = jsCast<JSScope*>(JSValue::decode(values[i]));
+            } else if (property.location() == PromotedLocationDescriptor(ActivationSymbolTablePLoc)) {
+                RELEASE_ASSERT(JSValue::decode(values[i]).asCell()->inherits(SymbolTable::info()));
+                table = jsCast<SymbolTable*>(JSValue::decode(values[i]));
+            }
+        }
+        RELEASE_ASSERT(scope);
+        RELEASE_ASSERT(table);
+
+        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
+            materialization->origin(), exec->codeBlock());
+        Structure* structure = codeBlock->globalObject()->activationStructure();
+
+        // It doesn't matter what values we initialize as bottom values inside the activation constructor because
+        // activation sinking will set bottom values for each slot.
+        // FIXME: Slight optimization would be to create a constructor that doesn't initialize all slots.
+        JSLexicalEnvironment* result = JSLexicalEnvironment::create(vm, structure, scope, table, jsUndefined());
+
+        RELEASE_ASSERT(materialization->properties().size() - 2 == table->scopeSize());
+
+        // The real values will be put subsequently by
+        // operationPopulateNewObjectInOSR. See the PhantomNewObject
+        // case for details.
+        for (unsigned i = materialization->properties().size(); i--;) {
+            const ExitPropertyValue& property = materialization->properties()[i];
+            if (property.location().kind() != ClosureVarPLoc)
+                continue;
+
+            result->variableAt(ScopeOffset(property.location().info())).set(
+                exec->vm(), result, jsNumber(29834));
+        }
+
+        if (validationEnabled()) {
+            // Validate to make sure every slot in the scope has one value.
+            ConcurrentJSLocker locker(table->m_lock);
+            for (auto iter = table->begin(locker), end = table->end(locker); iter != end; ++iter) {
+                bool found = false;
+                for (unsigned i = materialization->properties().size(); i--;) {
+                    const ExitPropertyValue& property = materialization->properties()[i];
+                    if (property.location().kind() != ClosureVarPLoc)
+                        continue;
+                    if (ScopeOffset(property.location().info()) == iter->value.scopeOffset()) {
+                        found = true;
+                        break;
+                    }
+                }
+                ASSERT_UNUSED(found, found);
+            }
+            unsigned numberOfClosureVarPloc = 0;
+            for (unsigned i = materialization->properties().size(); i--;) {
+                const ExitPropertyValue& property = materialization->properties()[i];
+                if (property.location().kind() == ClosureVarPLoc)
+                    numberOfClosureVarPloc++;
+            }
+            ASSERT(numberOfClosureVarPloc == table->scopeSize());
+        }
+
+        return result;
+    }
+
+    case PhantomCreateRest:
+    case PhantomDirectArguments:
+    case PhantomClonedArguments: {
+        if (!materialization->origin().inlineCallFrame) {
+            switch (materialization->type()) {
+            case PhantomDirectArguments:
+                return DirectArguments::createByCopying(exec);
+            case PhantomClonedArguments:
+                return ClonedArguments::createWithMachineFrame(exec, exec, ArgumentsMode::Cloned);
+            case PhantomCreateRest: {
+                CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
+                    materialization->origin(), exec->codeBlock());
+
+                unsigned numberOfArgumentsToSkip = codeBlock->numParameters() - 1;
+                JSGlobalObject* globalObject = codeBlock->globalObject();
+                Structure* structure = globalObject->restParameterStructure();
+                JSValue* argumentsToCopyRegion = exec->addressOfArgumentsStart() + numberOfArgumentsToSkip;
+                unsigned arraySize = exec->argumentCount() > numberOfArgumentsToSkip ? exec->argumentCount() - numberOfArgumentsToSkip : 0;
+                return constructArray(exec, structure, argumentsToCopyRegion, arraySize);
+            }
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                return nullptr;
+            }
+        }
+
+        // First figure out the argument count. If there isn't one then we represent the machine frame.
+        unsigned argumentCount = 0;
+        if (materialization->origin().inlineCallFrame->isVarargs()) {
+            for (unsigned i = materialization->properties().size(); i--;) {
+                const ExitPropertyValue& property = materialization->properties()[i];
+                if (property.location() != PromotedLocationDescriptor(ArgumentCountPLoc))
+                    continue;
+                argumentCount = JSValue::decode(values[i]).asUInt32();
+                break;
+            }
+        } else
+            argumentCount = materialization->origin().inlineCallFrame->arguments.size();
+        RELEASE_ASSERT(argumentCount);
+        
+        JSFunction* callee = nullptr;
+        if (materialization->origin().inlineCallFrame->isClosureCall) {
+            for (unsigned i = materialization->properties().size(); i--;) {
+                const ExitPropertyValue& property = materialization->properties()[i];
+                if (property.location() != PromotedLocationDescriptor(ArgumentsCalleePLoc))
+                    continue;
+                
+                callee = jsCast<JSFunction*>(JSValue::decode(values[i]));
+                break;
+            }
+        } else
+            callee = materialization->origin().inlineCallFrame->calleeConstant();
+        RELEASE_ASSERT(callee);
+        
+        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
+            materialization->origin(), exec->codeBlock());
+        
+        // We have an inline frame and we have all of the data we need to recreate it.
+        switch (materialization->type()) {
+        case PhantomDirectArguments: {
+            unsigned length = argumentCount - 1;
+            unsigned capacity = std::max(length, static_cast<unsigned>(codeBlock->numParameters() - 1));
+            DirectArguments* result = DirectArguments::create(
+                vm, codeBlock->globalObject()->directArgumentsStructure(), length, capacity);
+            result->callee().set(vm, result, callee);
+            for (unsigned i = materialization->properties().size(); i--;) {
+                const ExitPropertyValue& property = materialization->properties()[i];
+                if (property.location().kind() != ArgumentPLoc)
+                    continue;
+                
+                unsigned index = property.location().info();
+                if (index >= capacity)
+                    continue;
+                
+                // We don't want to use setIndexQuickly(), since that's only for the passed-in
+                // arguments but sometimes the number of named arguments is greater. For
+                // example:
+                //
+                // function foo(a, b, c) { ... }
+                // foo();
+                //
+                // setIndexQuickly() would fail for indices 0, 1, 2 - but we need to recover
+                // those here.
+                result->argument(DirectArgumentsOffset(index)).set(
+                    vm, result, JSValue::decode(values[i]));
+            }
+            return result;
+        }
+        case PhantomClonedArguments: {
+            unsigned length = argumentCount - 1;
+            ClonedArguments* result = ClonedArguments::createEmpty(
+                vm, codeBlock->globalObject()->clonedArgumentsStructure(), callee, length);
+            
+            for (unsigned i = materialization->properties().size(); i--;) {
+                const ExitPropertyValue& property = materialization->properties()[i];
+                if (property.location().kind() != ArgumentPLoc)
+                    continue;
+                
+                unsigned index = property.location().info();
+                if (index >= length)
+                    continue;
+                result->initializeIndex(vm, index, JSValue::decode(values[i]));
+            }
+            
+            return result;
+        }
+        case PhantomCreateRest: {
+            unsigned numberOfArgumentsToSkip = codeBlock->numParameters() - 1;
+            JSGlobalObject* globalObject = codeBlock->globalObject();
+            Structure* structure = globalObject->restParameterStructure();
+            ASSERT(argumentCount > 0);
+            unsigned arraySize = (argumentCount - 1) > numberOfArgumentsToSkip ? argumentCount - 1 - numberOfArgumentsToSkip : 0;
+            JSArray* array = JSArray::tryCreateUninitialized(vm, structure, arraySize);
+            RELEASE_ASSERT(array);
+
+            for (unsigned i = materialization->properties().size(); i--;) {
+                const ExitPropertyValue& property = materialization->properties()[i];
+                if (property.location().kind() != ArgumentPLoc)
+                    continue;
+
+                unsigned argIndex = property.location().info();
+                if (numberOfArgumentsToSkip > argIndex)
+                    continue;
+                unsigned arrayIndex = argIndex - numberOfArgumentsToSkip;
+                if (arrayIndex >= arraySize)
+                    continue;
+                array->initializeIndex(vm, arrayIndex, JSValue::decode(values[i]));
+            }
+
+#if !ASSERT_DISABLED
+            // We avoid this O(n^2) loop when asserts are disabled, but the condition checked here
+            // must hold to ensure the correctness of the above loop because of how we allocate the array.
+            for (unsigned targetIndex = 0; targetIndex < arraySize; ++targetIndex) {
+                bool found = false;
+                for (unsigned i = materialization->properties().size(); i--;) {
+                    const ExitPropertyValue& property = materialization->properties()[i];
+                    if (property.location().kind() != ArgumentPLoc)
+                        continue;
+
+                    unsigned argIndex = property.location().info();
+                    if (numberOfArgumentsToSkip > argIndex)
+                        continue;
+                    unsigned arrayIndex = argIndex - numberOfArgumentsToSkip;
+                    if (arrayIndex >= arraySize)
+                        continue;
+                    if (arrayIndex == targetIndex) {
+                        found = true;
+                        break;
+                    }
+                }
+                ASSERT(found);
+            }
+#endif
+            return array;
+        }
+
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return nullptr;
+        }
+    }
+
+    case PhantomSpread: {
+        JSArray* array = nullptr;
+        for (unsigned i = materialization->properties().size(); i--;) {
+            const ExitPropertyValue& property = materialization->properties()[i];
+            if (property.location().kind() == SpreadPLoc) {
+                array = jsCast<JSArray*>(JSValue::decode(values[i]));
+                break;
+            }
+        }
+        RELEASE_ASSERT(array);
+
+        // Note: it is sound for JSFixedArray::createFromArray to call getDirectIndex here
+        // because we're guaranteed we won't be calling any getters. The reason for this is
+        // that we only support PhantomSpread over CreateRest, which is an array we create.
+        // Any attempts to put a getter on any indices on the rest array will escape the array.
+        JSFixedArray* fixedArray = JSFixedArray::createFromArray(exec, vm, array);
+        return fixedArray;
+    }
+
+    case PhantomNewArrayWithSpread: {
+        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
+            materialization->origin(), exec->codeBlock());
+        JSGlobalObject* globalObject = codeBlock->globalObject();
+        Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
+
+        unsigned arraySize = 0;
+        unsigned numProperties = 0;
+        for (unsigned i = materialization->properties().size(); i--;) {
+            const ExitPropertyValue& property = materialization->properties()[i];
+            if (property.location().kind() == NewArrayWithSpreadArgumentPLoc) {
+                ++numProperties;
+                JSValue value = JSValue::decode(values[i]);
+                if (JSFixedArray* fixedArray = jsDynamicCast<JSFixedArray*>(value))
+                    arraySize += fixedArray->size();
+                else
+                    arraySize += 1;
+            }
+        }
+
+        JSArray* result = JSArray::tryCreateUninitialized(vm, structure, arraySize);
+        RELEASE_ASSERT(result);
+
+#if !ASSERT_DISABLED
+        // Ensure we see indices for everything in the range: [0, numProperties)
+        for (unsigned i = 0; i < numProperties; ++i) {
+            bool found = false;
+            for (unsigned j = 0; j < materialization->properties().size(); ++j) {
+                const ExitPropertyValue& property = materialization->properties()[j];
+                if (property.location().kind() == NewArrayWithSpreadArgumentPLoc && property.location().info() == i) {
+                    found = true;
+                    break;
+                }
+            }
+            ASSERT(found);
+        }
+#endif
+
+        Vector<JSValue, 8> arguments;
+        arguments.grow(numProperties);
+
+        for (unsigned i = materialization->properties().size(); i--;) {
+            const ExitPropertyValue& property = materialization->properties()[i];
+            if (property.location().kind() == NewArrayWithSpreadArgumentPLoc) {
+                JSValue value = JSValue::decode(values[i]);
+                RELEASE_ASSERT(property.location().info() < numProperties);
+                arguments[property.location().info()] = value;
+            }
+        }
+
+        unsigned arrayIndex = 0;
+        for (JSValue value : arguments) {
+            if (JSFixedArray* fixedArray = jsDynamicCast<JSFixedArray*>(value)) {
+                for (unsigned i = 0; i < fixedArray->size(); i++) {
+                    ASSERT(fixedArray->get(i));
+                    result->initializeIndex(vm, arrayIndex, fixedArray->get(i));
+                    ++arrayIndex;
+                }
+            } else {
+                // We are not spreading.
+                result->initializeIndex(vm, arrayIndex, value);
+                ++arrayIndex;
+            }
+        }
+
+        return result;
+    }
+
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+}
+
+extern "C" void* JIT_OPERATION compileFTLLazySlowPath(ExecState* exec, unsigned index)
+{
+    VM& vm = exec->vm();
+
+    // We cannot GC. We've got pointers in evil places.
+    DeferGCForAWhile deferGC(vm.heap);
+
+    CodeBlock* codeBlock = exec->codeBlock();
+    JITCode* jitCode = codeBlock->jitCode()->ftl();
+
+    LazySlowPath& lazySlowPath = *jitCode->lazySlowPaths[index];
+    lazySlowPath.generate(codeBlock);
+
+    return lazySlowPath.stub().code().executableAddress();
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLOperations.h b/ftl/FTLOperations.h
new file mode 100644
index 0000000..0318401
--- /dev/null
+++ b/ftl/FTLOperations.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGOperations.h"
+#include "FTLExitTimeObjectMaterialization.h"
+
+namespace JSC { namespace FTL {
+
+class LazySlowPath;
+
+extern "C" {
+
+JSCell* JIT_OPERATION operationMaterializeObjectInOSR(
+    ExecState*, ExitTimeObjectMaterialization*, EncodedJSValue*) WTF_INTERNAL;
+
+void JIT_OPERATION operationPopulateObjectInOSR(
+    ExecState*, ExitTimeObjectMaterialization*, EncodedJSValue*, EncodedJSValue*) WTF_INTERNAL;
+
+void* JIT_OPERATION compileFTLLazySlowPath(ExecState*, unsigned) WTF_INTERNAL;
+
+} // extern "C"
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLOutput.cpp b/ftl/FTLOutput.cpp
new file mode 100644
index 0000000..bf209b0
--- /dev/null
+++ b/ftl/FTLOutput.cpp
@@ -0,0 +1,838 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLOutput.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "B3ArgumentRegValue.h"
+#include "B3BasicBlockInlines.h"
+#include "B3CCallValue.h"
+#include "B3Const32Value.h"
+#include "B3ConstPtrValue.h"
+#include "B3FenceValue.h"
+#include "B3MathExtras.h"
+#include "B3MemoryValue.h"
+#include "B3SlotBaseValue.h"
+#include "B3StackmapGenerationParams.h"
+#include "B3SwitchValue.h"
+#include "B3UpsilonValue.h"
+#include "B3ValueInlines.h"
+#include "SuperSampler.h"
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+
+Output::Output(State& state)
+    : m_proc(*state.proc)
+{
+}
+
+Output::~Output()
+{
+}
+
+void Output::initialize(AbstractHeapRepository& heaps)
+{
+    m_heaps = &heaps;
+}
+
+LBasicBlock Output::newBlock()
+{
+    LBasicBlock result = m_proc.addBlock(m_frequency);
+
+    if (!m_nextBlock)
+        m_blockOrder.append(result);
+    else
+        m_blockOrder.insertBefore(m_nextBlock, result);
+
+    return result;
+}
+
+void Output::applyBlockOrder()
+{
+    m_proc.setBlockOrder(m_blockOrder);
+}
+
+LBasicBlock Output::appendTo(LBasicBlock block, LBasicBlock nextBlock)
+{
+    appendTo(block);
+    return insertNewBlocksBefore(nextBlock);
+}
+
+void Output::appendTo(LBasicBlock block)
+{
+    m_block = block;
+}
+
+LValue Output::framePointer()
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::FramePointer, origin());
+}
+
+SlotBaseValue* Output::lockedStackSlot(size_t bytes)
+{
+    return m_block->appendNew<SlotBaseValue>(m_proc, origin(), m_proc.addStackSlot(bytes));
+}
+
+LValue Output::constBool(bool value)
+{
+    if (value)
+        return booleanTrue;
+    return booleanFalse;
+}
+
+LValue Output::constInt32(int32_t value)
+{
+    return m_block->appendNew<B3::Const32Value>(m_proc, origin(), value);
+}
+
+LValue Output::constInt64(int64_t value)
+{
+    return m_block->appendNew<B3::Const64Value>(m_proc, origin(), value);
+}
+
+LValue Output::constDouble(double value)
+{
+    return m_block->appendNew<B3::ConstDoubleValue>(m_proc, origin(), value);
+}
+
+LValue Output::phi(LType type)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Phi, type, origin());
+}
+
+LValue Output::add(LValue left, LValue right)
+{
+    if (Value* result = left->addConstant(m_proc, right)) {
+        m_block->append(result);
+        return result;
+    }
+    return m_block->appendNew<B3::Value>(m_proc, B3::Add, origin(), left, right);
+}
+
+LValue Output::sub(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Sub, origin(), left, right);
+}
+
+LValue Output::mul(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Mul, origin(), left, right);
+}
+
+LValue Output::div(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Div, origin(), left, right);
+}
+
+LValue Output::chillDiv(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, chill(B3::Div), origin(), left, right);
+}
+
+LValue Output::mod(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Mod, origin(), left, right);
+}
+
+LValue Output::chillMod(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, chill(B3::Mod), origin(), left, right);
+}
+
+LValue Output::neg(LValue value)
+{
+    return m_block->appendNew<Value>(m_proc, B3::Neg, origin(), value);
+}
+
+LValue Output::doubleAdd(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Add, origin(), left, right);
+}
+
+LValue Output::doubleSub(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Sub, origin(), left, right);
+}
+
+LValue Output::doubleMul(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Mul, origin(), left, right);
+}
+
+LValue Output::doubleDiv(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Div, origin(), left, right);
+}
+
+LValue Output::doubleMod(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Mod, origin(), left, right);
+}
+
+LValue Output::bitAnd(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::BitAnd, origin(), left, right);
+}
+
+LValue Output::bitOr(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::BitOr, origin(), left, right);
+}
+
+LValue Output::bitXor(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::BitXor, origin(), left, right);
+}
+
+LValue Output::shl(LValue left, LValue right)
+{
+    right = castToInt32(right);
+    if (Value* result = left->shlConstant(m_proc, right)) {
+        m_block->append(result);
+        return result;
+    }
+    return m_block->appendNew<B3::Value>(m_proc, B3::Shl, origin(), left, right);
+}
+
+LValue Output::aShr(LValue left, LValue right)
+{
+    right = castToInt32(right);
+    if (Value* result = left->sShrConstant(m_proc, right)) {
+        m_block->append(result);
+        return result;
+    }
+    return m_block->appendNew<B3::Value>(m_proc, B3::SShr, origin(), left, right);
+}
+
+LValue Output::lShr(LValue left, LValue right)
+{
+    right = castToInt32(right);
+    if (Value* result = left->zShrConstant(m_proc, right)) {
+        m_block->append(result);
+        return result;
+    }
+    return m_block->appendNew<B3::Value>(m_proc, B3::ZShr, origin(), left, right);
+}
+
+LValue Output::bitNot(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::BitXor, origin(),
+        value,
+        m_block->appendIntConstant(m_proc, origin(), value->type(), -1));
+}
+
+LValue Output::logicalNot(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Equal, origin(), value, int32Zero);
+}
+
+LValue Output::ctlz32(LValue operand)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Clz, origin(), operand);
+}
+
+LValue Output::doubleAbs(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Abs, origin(), value);
+}
+
+LValue Output::doubleCeil(LValue operand)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Ceil, origin(), operand);
+}
+
+LValue Output::doubleFloor(LValue operand)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Floor, origin(), operand);
+}
+
+LValue Output::doubleTrunc(LValue value)
+{
+    if (MacroAssembler::supportsFloatingPointRounding()) {
+        PatchpointValue* result = patchpoint(Double);
+        result->append(value, ValueRep::SomeRegister);
+        result->setGenerator(
+            [] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+                jit.roundTowardZeroDouble(params[1].fpr(), params[0].fpr());
+            });
+        result->effects = Effects::none();
+        return result;
+    }
+    double (*truncDouble)(double) = trunc;
+    return callWithoutSideEffects(Double, truncDouble, value);
+}
+
+LValue Output::doubleSin(LValue value)
+{
+    double (*sinDouble)(double) = sin;
+    return callWithoutSideEffects(B3::Double, sinDouble, value);
+}
+
+LValue Output::doubleCos(LValue value)
+{
+    double (*cosDouble)(double) = cos;
+    return callWithoutSideEffects(B3::Double, cosDouble, value);
+}
+
+LValue Output::doubleTan(LValue value)
+{
+    double (*tanDouble)(double) = tan;
+    return callWithoutSideEffects(B3::Double, tanDouble, value);
+}
+
+LValue Output::doublePow(LValue xOperand, LValue yOperand)
+{
+    double (*powDouble)(double, double) = pow;
+    return callWithoutSideEffects(B3::Double, powDouble, xOperand, yOperand);
+}
+
+LValue Output::doublePowi(LValue x, LValue y)
+{
+    // FIXME: powDoubleInt32() should be inlined here since Output knows about block layout and
+    // should be involved in any operation that creates blocks.
+    // https://bugs.webkit.org/show_bug.cgi?id=152223
+    auto result = powDoubleInt32(m_proc, m_block, origin(), x, y);
+    m_block = result.first;
+    return result.second;
+}
+
+LValue Output::doubleSqrt(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Sqrt, origin(), value);
+}
+
+LValue Output::doubleLog(LValue value)
+{
+    double (*logDouble)(double) = log;
+    return callWithoutSideEffects(B3::Double, logDouble, value);
+}
+
+bool Output::hasSensibleDoubleToInt()
+{
+    return optimizeForX86();
+}
+
+LValue Output::doubleToInt(LValue value)
+{
+    PatchpointValue* result = patchpoint(Int32);
+    result->append(value, ValueRep::SomeRegister);
+    result->setGenerator(
+        [] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            jit.truncateDoubleToInt32(params[1].fpr(), params[0].gpr());
+        });
+    result->effects = Effects::none();
+    return result;
+}
+
+LValue Output::doubleToUInt(LValue value)
+{
+    PatchpointValue* result = patchpoint(Int32);
+    result->append(value, ValueRep::SomeRegister);
+    result->setGenerator(
+        [] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+            jit.truncateDoubleToUint32(params[1].fpr(), params[0].gpr());
+        });
+    result->effects = Effects::none();
+    return result;
+}
+
+LValue Output::signExt32To64(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::SExt32, origin(), value);
+}
+
+LValue Output::signExt32ToPtr(LValue value)
+{
+    return signExt32To64(value);
+}
+
+LValue Output::zeroExt(LValue value, LType type)
+{
+    if (value->type() == type)
+        return value;
+    if (value->hasInt32())
+        return m_block->appendIntConstant(m_proc, origin(), Int64, static_cast<uint64_t>(static_cast<uint32_t>(value->asInt32())));
+    return m_block->appendNew<B3::Value>(m_proc, B3::ZExt32, origin(), value);
+}
+
+LValue Output::intToDouble(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::IToD, origin(), value);
+}
+
+LValue Output::unsignedToDouble(LValue value)
+{
+    return intToDouble(zeroExt(value, Int64));
+}
+
+LValue Output::castToInt32(LValue value)
+{
+    if (value->type() == Int32)
+        return value;
+    if (value->hasInt64())
+        return constInt32(static_cast<int32_t>(value->asInt64()));
+    return m_block->appendNew<B3::Value>(m_proc, B3::Trunc, origin(), value);
+}
+
+LValue Output::doubleToFloat(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::DoubleToFloat, origin(), value);
+}
+
+LValue Output::floatToDouble(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::FloatToDouble, origin(), value);
+}
+
+LValue Output::load(TypedPointer pointer, LType type)
+{
+    LValue load = m_block->appendNew<MemoryValue>(m_proc, Load, type, origin(), pointer.value());
+    m_heaps->decorateMemory(pointer.heap(), load);
+    return load;
+}
+
+LValue Output::load8SignExt32(TypedPointer pointer)
+{
+    LValue load = m_block->appendNew<MemoryValue>(m_proc, Load8S, Int32, origin(), pointer.value());
+    m_heaps->decorateMemory(pointer.heap(), load);
+    return load;
+}
+
+LValue Output::load8ZeroExt32(TypedPointer pointer)
+{
+    LValue load = m_block->appendNew<MemoryValue>(m_proc, Load8Z, Int32, origin(), pointer.value());
+    m_heaps->decorateMemory(pointer.heap(), load);
+    return load;
+}
+
+LValue Output::load16SignExt32(TypedPointer pointer)
+{
+    LValue load = m_block->appendNew<MemoryValue>(m_proc, Load16S, Int32, origin(), pointer.value());
+    m_heaps->decorateMemory(pointer.heap(), load);
+    return load;
+}
+
+LValue Output::load16ZeroExt32(TypedPointer pointer)
+{
+    LValue load = m_block->appendNew<MemoryValue>(m_proc, Load16Z, Int32, origin(), pointer.value());
+    m_heaps->decorateMemory(pointer.heap(), load);
+    return load;
+}
+
+void Output::store(LValue value, TypedPointer pointer)
+{
+    LValue store = m_block->appendNew<MemoryValue>(m_proc, Store, origin(), value, pointer.value());
+    m_heaps->decorateMemory(pointer.heap(), store);
+}
+
+FenceValue* Output::fence(const AbstractHeap* read, const AbstractHeap* write)
+{
+    FenceValue* result = m_block->appendNew<FenceValue>(m_proc, origin());
+    m_heaps->decorateFenceRead(read, result);
+    m_heaps->decorateFenceWrite(write, result);
+    return result;
+}
+
+void Output::store32As8(LValue value, TypedPointer pointer)
+{
+    LValue store = m_block->appendNew<MemoryValue>(m_proc, Store8, origin(), value, pointer.value());
+    m_heaps->decorateMemory(pointer.heap(), store);
+}
+
+void Output::store32As16(LValue value, TypedPointer pointer)
+{
+    LValue store = m_block->appendNew<MemoryValue>(m_proc, Store16, origin(), value, pointer.value());
+    m_heaps->decorateMemory(pointer.heap(), store);
+}
+
+LValue Output::baseIndex(LValue base, LValue index, Scale scale, ptrdiff_t offset)
+{
+    LValue accumulatedOffset;
+        
+    switch (scale) {
+    case ScaleOne:
+        accumulatedOffset = index;
+        break;
+    case ScaleTwo:
+        accumulatedOffset = shl(index, intPtrOne);
+        break;
+    case ScaleFour:
+        accumulatedOffset = shl(index, intPtrTwo);
+        break;
+    case ScaleEight:
+    case ScalePtr:
+        accumulatedOffset = shl(index, intPtrThree);
+        break;
+    }
+        
+    if (offset)
+        accumulatedOffset = add(accumulatedOffset, constIntPtr(offset));
+        
+    return add(base, accumulatedOffset);
+}
+
+LValue Output::equal(LValue left, LValue right)
+{
+    TriState result = left->equalConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::Equal, origin(), left, right);
+}
+
+LValue Output::notEqual(LValue left, LValue right)
+{
+    TriState result = left->notEqualConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::NotEqual, origin(), left, right);
+}
+
+LValue Output::above(LValue left, LValue right)
+{
+    TriState result = left->aboveConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::Above, origin(), left, right);
+}
+
+LValue Output::aboveOrEqual(LValue left, LValue right)
+{
+    TriState result = left->aboveEqualConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::AboveEqual, origin(), left, right);
+}
+
+LValue Output::below(LValue left, LValue right)
+{
+    TriState result = left->belowConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::Below, origin(), left, right);
+}
+
+LValue Output::belowOrEqual(LValue left, LValue right)
+{
+    TriState result = left->belowEqualConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::BelowEqual, origin(), left, right);
+}
+
+LValue Output::greaterThan(LValue left, LValue right)
+{
+    TriState result = left->greaterThanConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::GreaterThan, origin(), left, right);
+}
+
+LValue Output::greaterThanOrEqual(LValue left, LValue right)
+{
+    TriState result = left->greaterEqualConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::GreaterEqual, origin(), left, right);
+}
+
+LValue Output::lessThan(LValue left, LValue right)
+{
+    TriState result = left->lessThanConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::LessThan, origin(), left, right);
+}
+
+LValue Output::lessThanOrEqual(LValue left, LValue right)
+{
+    TriState result = left->lessEqualConstant(right);
+    if (result != MixedTriState)
+        return constBool(result == TrueTriState);
+    return m_block->appendNew<B3::Value>(m_proc, B3::LessEqual, origin(), left, right);
+}
+
+LValue Output::doubleEqual(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Equal, origin(), left, right);
+}
+
+LValue Output::doubleEqualOrUnordered(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::EqualOrUnordered, origin(), left, right);
+}
+
+LValue Output::doubleNotEqualOrUnordered(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::NotEqual, origin(), left, right);
+}
+
+LValue Output::doubleLessThan(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::LessThan, origin(), left, right);
+}
+
+LValue Output::doubleLessThanOrEqual(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::LessEqual, origin(), left, right);
+}
+
+LValue Output::doubleGreaterThan(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::GreaterThan, origin(), left, right);
+}
+
+LValue Output::doubleGreaterThanOrEqual(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::GreaterEqual, origin(), left, right);
+}
+
+LValue Output::doubleNotEqualAndOrdered(LValue left, LValue right)
+{
+    return logicalNot(doubleEqualOrUnordered(left, right));
+}
+
+LValue Output::doubleLessThanOrUnordered(LValue left, LValue right)
+{
+    return logicalNot(doubleGreaterThanOrEqual(left, right));
+}
+
+LValue Output::doubleLessThanOrEqualOrUnordered(LValue left, LValue right)
+{
+    return logicalNot(doubleGreaterThan(left, right));
+}
+
+LValue Output::doubleGreaterThanOrUnordered(LValue left, LValue right)
+{
+    return logicalNot(doubleLessThanOrEqual(left, right));
+}
+
+LValue Output::doubleGreaterThanOrEqualOrUnordered(LValue left, LValue right)
+{
+    return logicalNot(doubleLessThan(left, right));
+}
+
+LValue Output::isZero32(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Equal, origin(), value, int32Zero);
+}
+
+LValue Output::notZero32(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::NotEqual, origin(), value, int32Zero);
+}
+
+LValue Output::isZero64(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::Equal, origin(), value, int64Zero);
+}
+
+LValue Output::notZero64(LValue value)
+{
+    return m_block->appendNew<B3::Value>(m_proc, B3::NotEqual, origin(), value, int64Zero);
+}
+
+LValue Output::select(LValue value, LValue taken, LValue notTaken)
+{
+    if (value->hasInt32()) {
+        if (value->asInt32())
+            return taken;
+        else
+            return notTaken;
+    }
+    return m_block->appendNew<B3::Value>(m_proc, B3::Select, origin(), value, taken, notTaken);
+}
+
+void Output::jump(LBasicBlock destination)
+{
+    m_block->appendNewControlValue(m_proc, B3::Jump, origin(), B3::FrequentedBlock(destination));
+}
+
+void Output::branch(LValue condition, LBasicBlock taken, Weight takenWeight, LBasicBlock notTaken, Weight notTakenWeight)
+{
+    m_block->appendNewControlValue(
+        m_proc, B3::Branch, origin(), condition,
+        FrequentedBlock(taken, takenWeight.frequencyClass()),
+        FrequentedBlock(notTaken, notTakenWeight.frequencyClass()));
+}
+
+void Output::check(LValue condition, WeightedTarget taken, Weight notTakenWeight)
+{
+    LBasicBlock continuation = newBlock();
+    branch(condition, taken, WeightedTarget(continuation, notTakenWeight));
+    appendTo(continuation);
+}
+
+void Output::check(LValue condition, WeightedTarget taken)
+{
+    check(condition, taken, taken.weight().inverse());
+}
+
+void Output::ret(LValue value)
+{
+    m_block->appendNewControlValue(m_proc, B3::Return, origin(), value);
+}
+
+void Output::unreachable()
+{
+    m_block->appendNewControlValue(m_proc, B3::Oops, origin());
+}
+
+void Output::appendSuccessor(WeightedTarget target)
+{
+    m_block->appendSuccessor(target.frequentedBlock());
+}
+
+CheckValue* Output::speculate(LValue value)
+{
+    return m_block->appendNew<B3::CheckValue>(m_proc, B3::Check, origin(), value);
+}
+
+CheckValue* Output::speculateAdd(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::CheckValue>(m_proc, B3::CheckAdd, origin(), left, right);
+}
+
+CheckValue* Output::speculateSub(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::CheckValue>(m_proc, B3::CheckSub, origin(), left, right);
+}
+
+CheckValue* Output::speculateMul(LValue left, LValue right)
+{
+    return m_block->appendNew<B3::CheckValue>(m_proc, B3::CheckMul, origin(), left, right);
+}
+
+PatchpointValue* Output::patchpoint(LType type)
+{
+    return m_block->appendNew<B3::PatchpointValue>(m_proc, type, origin());
+}
+
+void Output::trap()
+{
+    m_block->appendNewControlValue(m_proc, B3::Oops, origin());
+}
+
+ValueFromBlock Output::anchor(LValue value)
+{
+    B3::UpsilonValue* upsilon = m_block->appendNew<B3::UpsilonValue>(m_proc, origin(), value);
+    return ValueFromBlock(upsilon, m_block);
+}
+
+LValue Output::bitCast(LValue value, LType type)
+{
+    ASSERT_UNUSED(type, type == Int64 || type == Double);
+    return m_block->appendNew<B3::Value>(m_proc, B3::BitwiseCast, origin(), value);
+}
+
+LValue Output::fround(LValue doubleValue)
+{
+    return floatToDouble(doubleToFloat(doubleValue));
+}
+
+LValue Output::load(TypedPointer pointer, LoadType type)
+{
+    switch (type) {
+    case Load8SignExt32:
+        return load8SignExt32(pointer);
+    case Load8ZeroExt32:
+        return load8ZeroExt32(pointer);
+    case Load16SignExt32:
+        return load8SignExt32(pointer);
+    case Load16ZeroExt32:
+        return load8ZeroExt32(pointer);
+    case Load32:
+        return load32(pointer);
+    case Load64:
+        return load64(pointer);
+    case LoadPtr:
+        return loadPtr(pointer);
+    case LoadFloat:
+        return loadFloat(pointer);
+    case LoadDouble:
+        return loadDouble(pointer);
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+void Output::store(LValue value, TypedPointer pointer, StoreType type)
+{
+    switch (type) {
+    case Store32As8:
+        store32As8(value, pointer);
+        return;
+    case Store32As16:
+        store32As16(value, pointer);
+        return;
+    case Store32:
+        store32(value, pointer);
+        return;
+    case Store64:
+        store64(value, pointer);
+        return;
+    case StorePtr:
+        storePtr(value, pointer);
+        return;
+    case StoreFloat:
+        storeFloat(value, pointer);
+        return;
+    case StoreDouble:
+        storeDouble(value, pointer);
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+TypedPointer Output::absolute(const void* address)
+{
+    return TypedPointer(m_heaps->absolute[address], constIntPtr(address));
+}
+
+void Output::incrementSuperSamplerCount()
+{
+    TypedPointer counter = absolute(bitwise_cast<void*>(&g_superSamplerCount));
+    store32(add(load32(counter), int32One), counter);
+}
+
+void Output::decrementSuperSamplerCount()
+{
+    TypedPointer counter = absolute(bitwise_cast<void*>(&g_superSamplerCount));
+    store32(sub(load32(counter), int32One), counter);
+}
+
+void Output::addIncomingToPhi(LValue phi, ValueFromBlock value)
+{
+    if (value)
+        value.value()->as<B3::UpsilonValue>()->setPhi(phi);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLOutput.h b/ftl/FTLOutput.h
new file mode 100644
index 0000000..433e1e0
--- /dev/null
+++ b/ftl/FTLOutput.h
@@ -0,0 +1,489 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DFGCommon.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "B3BasicBlockInlines.h"
+#include "B3CCallValue.h"
+#include "B3Compilation.h"
+#include "B3FrequentedBlock.h"
+#include "B3Procedure.h"
+#include "B3SwitchValue.h"
+#include "FTLAbbreviatedTypes.h"
+#include "FTLAbstractHeapRepository.h"
+#include "FTLCommonValues.h"
+#include "FTLState.h"
+#include "FTLSwitchCase.h"
+#include "FTLTypedPointer.h"
+#include "FTLValueFromBlock.h"
+#include "FTLWeight.h"
+#include "FTLWeightedTarget.h"
+#include "HeapCell.h"
+#include <wtf/OrderMaker.h>
+#include <wtf/StringPrintStream.h>
+
+// FIXME: remove this once everything can be generated through B3.
+#if COMPILER(GCC_OR_CLANG)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wmissing-noreturn"
+#pragma GCC diagnostic ignored "-Wunused-parameter"
+#endif // COMPILER(GCC_OR_CLANG)
+
+namespace JSC {
+
+namespace DFG {
+struct Node;
+} // namespace DFG
+
+namespace B3 {
+class FenceValue;
+class SlotBaseValue;
+} // namespace B3
+
+namespace FTL {
+
+enum Scale { ScaleOne, ScaleTwo, ScaleFour, ScaleEight, ScalePtr };
+
+class Output : public CommonValues {
+public:
+    Output(State&);
+    ~Output();
+
+    void initialize(AbstractHeapRepository&);
+
+    void setFrequency(double value)
+    {
+        m_frequency = value;
+    }
+
+    LBasicBlock newBlock();
+
+    LBasicBlock insertNewBlocksBefore(LBasicBlock nextBlock)
+    {
+        LBasicBlock lastNextBlock = m_nextBlock;
+        m_nextBlock = nextBlock;
+        return lastNextBlock;
+    }
+
+    void applyBlockOrder();
+
+    LBasicBlock appendTo(LBasicBlock, LBasicBlock nextBlock);
+    void appendTo(LBasicBlock);
+
+    void setOrigin(DFG::Node* node) { m_origin = node; }
+    B3::Origin origin() { return B3::Origin(m_origin); }
+
+    LValue framePointer();
+
+    B3::SlotBaseValue* lockedStackSlot(size_t bytes);
+
+    LValue constBool(bool value);
+    LValue constInt32(int32_t value);
+
+    LValue weakPointer(DFG::Graph& graph, JSCell* cell)
+    {
+        ASSERT(graph.m_plan.weakReferences.contains(cell));
+
+        if (sizeof(void*) == 8)
+            return constInt64(bitwise_cast<intptr_t>(cell));
+        return constInt32(bitwise_cast<intptr_t>(cell));
+    }
+
+    LValue weakPointer(DFG::FrozenValue* value)
+    {
+        RELEASE_ASSERT(value->value().isCell());
+
+        if (sizeof(void*) == 8)
+            return constInt64(bitwise_cast<intptr_t>(value->cell()));
+        return constInt32(bitwise_cast<intptr_t>(value->cell()));
+    }
+
+    template<typename T>
+    LValue constIntPtr(T* value)
+    {
+        static_assert(!std::is_base_of<HeapCell, T>::value, "To use a GC pointer, the graph must be aware of it. Use gcPointer instead and make sure the graph is aware of this reference.");
+        if (sizeof(void*) == 8)
+            return constInt64(bitwise_cast<intptr_t>(value));
+        return constInt32(bitwise_cast<intptr_t>(value));
+    }
+    template<typename T>
+    LValue constIntPtr(T value)
+    {
+        if (sizeof(void*) == 8)
+            return constInt64(static_cast<intptr_t>(value));
+        return constInt32(static_cast<intptr_t>(value));
+    }
+    LValue constInt64(int64_t value);
+    LValue constDouble(double value);
+
+    LValue phi(LType);
+    template<typename... Params>
+    LValue phi(LType, ValueFromBlock, Params... theRest);
+    template<typename VectorType>
+    LValue phi(LType, const VectorType&);
+    void addIncomingToPhi(LValue phi, ValueFromBlock);
+    template<typename... Params>
+    void addIncomingToPhi(LValue phi, ValueFromBlock, Params... theRest);
+
+    LValue add(LValue, LValue);
+    LValue sub(LValue, LValue);
+    LValue mul(LValue, LValue);
+    LValue div(LValue, LValue);
+    LValue chillDiv(LValue, LValue);
+    LValue mod(LValue, LValue);
+    LValue chillMod(LValue, LValue);
+    LValue neg(LValue);
+
+    LValue doubleAdd(LValue, LValue);
+    LValue doubleSub(LValue, LValue);
+    LValue doubleMul(LValue, LValue);
+    LValue doubleDiv(LValue, LValue);
+    LValue doubleMod(LValue, LValue);
+    LValue doubleNeg(LValue value) { return neg(value); }
+
+    LValue bitAnd(LValue, LValue);
+    LValue bitOr(LValue, LValue);
+    LValue bitXor(LValue, LValue);
+    LValue shl(LValue, LValue shiftAmount);
+    LValue aShr(LValue, LValue shiftAmount);
+    LValue lShr(LValue, LValue shiftAmount);
+    LValue bitNot(LValue);
+    LValue logicalNot(LValue);
+
+    LValue ctlz32(LValue);
+    LValue doubleAbs(LValue);
+    LValue doubleCeil(LValue);
+    LValue doubleFloor(LValue);
+    LValue doubleTrunc(LValue);
+
+    LValue doubleSin(LValue);
+    LValue doubleCos(LValue);
+    LValue doubleTan(LValue);
+
+    LValue doublePow(LValue base, LValue exponent);
+    LValue doublePowi(LValue base, LValue exponent);
+
+    LValue doubleSqrt(LValue);
+
+    LValue doubleLog(LValue);
+
+    static bool hasSensibleDoubleToInt();
+    LValue doubleToInt(LValue);
+    LValue doubleToUInt(LValue);
+
+    LValue signExt32To64(LValue);
+    LValue signExt32ToPtr(LValue);
+    LValue zeroExt(LValue, LType);
+    LValue zeroExtPtr(LValue value) { return zeroExt(value, B3::Int64); }
+    LValue intToDouble(LValue);
+    LValue unsignedToDouble(LValue);
+    LValue castToInt32(LValue);
+    LValue doubleToFloat(LValue);
+    LValue floatToDouble(LValue);
+    LValue bitCast(LValue, LType);
+    LValue fround(LValue);
+
+    LValue load(TypedPointer, LType);
+    void store(LValue, TypedPointer);
+    B3::FenceValue* fence(const AbstractHeap* read, const AbstractHeap* write);
+
+    LValue load8SignExt32(TypedPointer);
+    LValue load8ZeroExt32(TypedPointer);
+    LValue load16SignExt32(TypedPointer);
+    LValue load16ZeroExt32(TypedPointer);
+    LValue load32(TypedPointer pointer) { return load(pointer, B3::Int32); }
+    LValue load64(TypedPointer pointer) { return load(pointer, B3::Int64); }
+    LValue loadPtr(TypedPointer pointer) { return load(pointer, B3::pointerType()); }
+    LValue loadFloat(TypedPointer pointer) { return load(pointer, B3::Float); }
+    LValue loadDouble(TypedPointer pointer) { return load(pointer, B3::Double); }
+    void store32As8(LValue, TypedPointer);
+    void store32As16(LValue, TypedPointer);
+    void store32(LValue value, TypedPointer pointer)
+    {
+        ASSERT(value->type() == B3::Int32);
+        store(value, pointer);
+    }
+    void store64(LValue value, TypedPointer pointer)
+    {
+        ASSERT(value->type() == B3::Int64);
+        store(value, pointer);
+    }
+    void storePtr(LValue value, TypedPointer pointer)
+    {
+        ASSERT(value->type() == B3::pointerType());
+        store(value, pointer);
+    }
+    void storeFloat(LValue value, TypedPointer pointer)
+    {
+        ASSERT(value->type() == B3::Float);
+        store(value, pointer);
+    }
+    void storeDouble(LValue value, TypedPointer pointer)
+    {
+        ASSERT(value->type() == B3::Double);
+        store(value, pointer);
+    }
+
+    enum LoadType {
+        Load8SignExt32,
+        Load8ZeroExt32,
+        Load16SignExt32,
+        Load16ZeroExt32,
+        Load32,
+        Load64,
+        LoadPtr,
+        LoadFloat,
+        LoadDouble
+    };
+
+    LValue load(TypedPointer, LoadType);
+    
+    enum StoreType {
+        Store32As8,
+        Store32As16,
+        Store32,
+        Store64,
+        StorePtr,
+        StoreFloat,
+        StoreDouble
+    };
+
+    void store(LValue, TypedPointer, StoreType);
+
+    LValue addPtr(LValue value, ptrdiff_t immediate = 0)
+    {
+        if (!immediate)
+            return value;
+        return add(value, constIntPtr(immediate));
+    }
+
+    // Construct an address by offsetting base by the requested amount and ascribing
+    // the requested abstract heap to it.
+    TypedPointer address(const AbstractHeap& heap, LValue base, ptrdiff_t offset = 0)
+    {
+        return TypedPointer(heap, addPtr(base, offset));
+    }
+    // Construct an address by offsetting base by the amount specified by the field,
+    // and optionally an additional amount (use this with care), and then creating
+    // a TypedPointer with the given field as the heap.
+    TypedPointer address(LValue base, const AbstractHeap& field, ptrdiff_t offset = 0)
+    {
+        return address(field, base, offset + field.offset());
+    }
+
+    LValue baseIndex(LValue base, LValue index, Scale, ptrdiff_t offset = 0);
+
+    TypedPointer baseIndex(const AbstractHeap& heap, LValue base, LValue index, Scale scale, ptrdiff_t offset = 0)
+    {
+        return TypedPointer(heap, baseIndex(base, index, scale, offset));
+    }
+    TypedPointer baseIndex(IndexedAbstractHeap& heap, LValue base, LValue index, JSValue indexAsConstant = JSValue(), ptrdiff_t offset = 0)
+    {
+        return heap.baseIndex(*this, base, index, indexAsConstant, offset);
+    }
+
+    TypedPointer absolute(const void* address);
+
+    LValue load8SignExt32(LValue base, const AbstractHeap& field) { return load8SignExt32(address(base, field)); }
+    LValue load8ZeroExt32(LValue base, const AbstractHeap& field) { return load8ZeroExt32(address(base, field)); }
+    LValue load16SignExt32(LValue base, const AbstractHeap& field) { return load16SignExt32(address(base, field)); }
+    LValue load16ZeroExt32(LValue base, const AbstractHeap& field) { return load16ZeroExt32(address(base, field)); }
+    LValue load32(LValue base, const AbstractHeap& field) { return load32(address(base, field)); }
+    LValue load64(LValue base, const AbstractHeap& field) { return load64(address(base, field)); }
+    LValue loadPtr(LValue base, const AbstractHeap& field) { return loadPtr(address(base, field)); }
+    LValue loadDouble(LValue base, const AbstractHeap& field) { return loadDouble(address(base, field)); }
+    void store32(LValue value, LValue base, const AbstractHeap& field) { store32(value, address(base, field)); }
+    void store64(LValue value, LValue base, const AbstractHeap& field) { store64(value, address(base, field)); }
+    void storePtr(LValue value, LValue base, const AbstractHeap& field) { storePtr(value, address(base, field)); }
+    void storeDouble(LValue value, LValue base, const AbstractHeap& field) { storeDouble(value, address(base, field)); }
+
+    // FIXME: Explore adding support for value range constraints to B3. Maybe it could be as simple as having
+    // a load instruction that guarantees that its result is non-negative.
+    // https://bugs.webkit.org/show_bug.cgi?id=151458
+    void ascribeRange(LValue, const ValueRange&) { }
+    LValue nonNegative32(LValue loadInstruction) { return loadInstruction; }
+    LValue load32NonNegative(TypedPointer pointer) { return load32(pointer); }
+    LValue load32NonNegative(LValue base, const AbstractHeap& field) { return load32(base, field); }
+
+    LValue equal(LValue, LValue);
+    LValue notEqual(LValue, LValue);
+    LValue above(LValue, LValue);
+    LValue aboveOrEqual(LValue, LValue);
+    LValue below(LValue, LValue);
+    LValue belowOrEqual(LValue, LValue);
+    LValue greaterThan(LValue, LValue);
+    LValue greaterThanOrEqual(LValue, LValue);
+    LValue lessThan(LValue, LValue);
+    LValue lessThanOrEqual(LValue, LValue);
+
+    LValue doubleEqual(LValue, LValue);
+    LValue doubleEqualOrUnordered(LValue, LValue);
+    LValue doubleNotEqualOrUnordered(LValue, LValue);
+    LValue doubleLessThan(LValue, LValue);
+    LValue doubleLessThanOrEqual(LValue, LValue);
+    LValue doubleGreaterThan(LValue, LValue);
+    LValue doubleGreaterThanOrEqual(LValue, LValue);
+    LValue doubleNotEqualAndOrdered(LValue, LValue);
+    LValue doubleLessThanOrUnordered(LValue, LValue);
+    LValue doubleLessThanOrEqualOrUnordered(LValue, LValue);
+    LValue doubleGreaterThanOrUnordered(LValue, LValue);
+    LValue doubleGreaterThanOrEqualOrUnordered(LValue, LValue);
+
+    LValue isZero32(LValue);
+    LValue notZero32(LValue);
+    LValue isZero64(LValue);
+    LValue notZero64(LValue);
+    LValue isNull(LValue value) { return isZero64(value); }
+    LValue notNull(LValue value) { return notZero64(value); }
+
+    LValue testIsZero32(LValue value, LValue mask) { return isZero32(bitAnd(value, mask)); }
+    LValue testNonZero32(LValue value, LValue mask) { return notZero32(bitAnd(value, mask)); }
+    LValue testIsZero64(LValue value, LValue mask) { return isZero64(bitAnd(value, mask)); }
+    LValue testNonZero64(LValue value, LValue mask) { return notZero64(bitAnd(value, mask)); }
+    LValue testIsZeroPtr(LValue value, LValue mask) { return isNull(bitAnd(value, mask)); }
+    LValue testNonZeroPtr(LValue value, LValue mask) { return notNull(bitAnd(value, mask)); }
+
+    LValue select(LValue value, LValue taken, LValue notTaken);
+
+    template<typename VectorType>
+    LValue call(LType type, LValue function, const VectorType& vector)
+    {
+        B3::CCallValue* result = m_block->appendNew<B3::CCallValue>(m_proc, type, origin(), function);
+        result->children().appendVector(vector);
+        return result;
+    }
+    LValue call(LType type, LValue function) { return m_block->appendNew<B3::CCallValue>(m_proc, type, origin(), function); }
+    LValue call(LType type, LValue function, LValue arg1) { return m_block->appendNew<B3::CCallValue>(m_proc, type, origin(), function, arg1); }
+    template<typename... Args>
+    LValue call(LType type, LValue function, LValue arg1, Args... args) { return m_block->appendNew<B3::CCallValue>(m_proc, type, origin(), function, arg1, args...); }
+
+    template<typename Function, typename... Args>
+    LValue callWithoutSideEffects(B3::Type type, Function function, LValue arg1, Args... args)
+    {
+        return m_block->appendNew<B3::CCallValue>(m_proc, type, origin(), B3::Effects::none(),
+            constIntPtr(bitwise_cast<void*>(function)), arg1, args...);
+    }
+
+    template<typename FunctionType>
+    LValue operation(FunctionType function) { return constIntPtr(bitwise_cast<void*>(function)); }
+
+    void jump(LBasicBlock);
+    void branch(LValue condition, LBasicBlock taken, Weight takenWeight, LBasicBlock notTaken, Weight notTakenWeight);
+    void branch(LValue condition, WeightedTarget taken, WeightedTarget notTaken)
+    {
+        branch(condition, taken.target(), taken.weight(), notTaken.target(), notTaken.weight());
+    }
+
+    // Branches to an already-created handler if true, "falls through" if false. Fall-through is
+    // simulated by creating a continuation for you.
+    void check(LValue condition, WeightedTarget taken, Weight notTakenWeight);
+    
+    // Same as check(), but uses Weight::inverse() to compute the notTakenWeight.
+    void check(LValue condition, WeightedTarget taken);
+    
+    template<typename VectorType>
+    void switchInstruction(LValue value, const VectorType& cases, LBasicBlock fallThrough, Weight fallThroughWeight)
+    {
+        B3::SwitchValue* switchValue = m_block->appendNew<B3::SwitchValue>(m_proc, origin(), value);
+        switchValue->setFallThrough(B3::FrequentedBlock(fallThrough));
+        for (const SwitchCase& switchCase : cases) {
+            int64_t value = switchCase.value()->asInt();
+            B3::FrequentedBlock target(switchCase.target(), switchCase.weight().frequencyClass());
+            switchValue->appendCase(B3::SwitchCase(value, target));
+        }
+    }
+
+    void ret(LValue);
+
+    void unreachable();
+    
+    void appendSuccessor(WeightedTarget);
+
+    B3::CheckValue* speculate(LValue);
+    B3::CheckValue* speculateAdd(LValue, LValue);
+    B3::CheckValue* speculateSub(LValue, LValue);
+    B3::CheckValue* speculateMul(LValue, LValue);
+
+    B3::PatchpointValue* patchpoint(LType);
+
+    void trap();
+
+    ValueFromBlock anchor(LValue);
+
+    void incrementSuperSamplerCount();
+    void decrementSuperSamplerCount();
+
+#if PLATFORM(COCOA)
+#pragma mark - States
+#endif
+    B3::Procedure& m_proc;
+
+    DFG::Node* m_origin { nullptr };
+    LBasicBlock m_block { nullptr };
+    LBasicBlock m_nextBlock { nullptr };
+
+    AbstractHeapRepository* m_heaps;
+
+    double m_frequency { 1 };
+
+private:
+    OrderMaker<LBasicBlock> m_blockOrder;
+};
+
+template<typename... Params>
+inline LValue Output::phi(LType type, ValueFromBlock value, Params... theRest)
+{
+    LValue phiNode = phi(type);
+    addIncomingToPhi(phiNode, value, theRest...);
+    return phiNode;
+}
+
+template<typename VectorType>
+inline LValue Output::phi(LType type, const VectorType& vector)
+{
+    LValue phiNode = phi(type);
+    for (const ValueFromBlock& valueFromBlock : vector)
+        addIncomingToPhi(phiNode, valueFromBlock);
+    return phiNode;
+}
+
+template<typename... Params>
+inline void Output::addIncomingToPhi(LValue phi, ValueFromBlock value, Params... theRest)
+{
+    addIncomingToPhi(phi, value);
+    addIncomingToPhi(phi, theRest...);
+}
+
+#if COMPILER(GCC_OR_CLANG)
+#pragma GCC diagnostic pop
+#endif // COMPILER(GCC_OR_CLANG)
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLPatchpointExceptionHandle.cpp b/ftl/FTLPatchpointExceptionHandle.cpp
new file mode 100644
index 0000000..6dcc5ee
--- /dev/null
+++ b/ftl/FTLPatchpointExceptionHandle.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLPatchpointExceptionHandle.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "B3StackmapGenerationParams.h"
+#include "FTLExceptionTarget.h"
+#include "FTLOSRExit.h"
+#include "FTLOSRExitHandle.h"
+#include "FTLState.h"
+
+namespace JSC { namespace FTL {
+
+using namespace DFG;
+
+RefPtr<PatchpointExceptionHandle> PatchpointExceptionHandle::create(
+    State& state, OSRExitDescriptor* descriptor, NodeOrigin origin, unsigned offset,
+    const HandlerInfo& handler)
+{
+    return adoptRef(new PatchpointExceptionHandle(state, descriptor, origin, offset, handler));
+}
+
+RefPtr<PatchpointExceptionHandle> PatchpointExceptionHandle::defaultHandle(State& state)
+{
+    if (!state.defaultExceptionHandle) {
+        state.defaultExceptionHandle = adoptRef(
+            new PatchpointExceptionHandle(state, nullptr, NodeOrigin(), 0, HandlerInfo()));
+    }
+    return state.defaultExceptionHandle;
+}
+
+PatchpointExceptionHandle::~PatchpointExceptionHandle()
+{
+}
+
+RefPtr<ExceptionTarget> PatchpointExceptionHandle::scheduleExitCreation(
+    const B3::StackmapGenerationParams& params)
+{
+    if (!m_descriptor) {
+        // NOTE: This object could be a singleton, however usually we toss the ExceptionHandler
+        // object shortly after creation.
+        bool isDefaultHandler = true;
+        return adoptRef(
+            new ExceptionTarget(isDefaultHandler, m_state.exceptionHandler, nullptr));
+    }
+    bool isDefaultHandler = false;
+    return adoptRef(new ExceptionTarget(isDefaultHandler, { }, createHandle(ExceptionCheck, params)));
+}
+
+void PatchpointExceptionHandle::scheduleExitCreationForUnwind(
+    const B3::StackmapGenerationParams& params, CallSiteIndex callSiteIndex)
+{
+    if (!m_descriptor)
+        return;
+    
+    RefPtr<OSRExitHandle> handle = createHandle(GenericUnwind, params);
+
+    handle->exit.m_exceptionHandlerCallSiteIndex = callSiteIndex;
+
+    HandlerInfo handler = m_handler;
+    params.addLatePath(
+        [handle, handler, callSiteIndex] (CCallHelpers& jit) {
+            CodeBlock* codeBlock = jit.codeBlock();
+            jit.addLinkTask(
+                [=] (LinkBuffer& linkBuffer) {
+                    HandlerInfo newHandler = handler;
+                    newHandler.start = callSiteIndex.bits();
+                    newHandler.end = callSiteIndex.bits() + 1;
+                    newHandler.nativeCode = linkBuffer.locationOf(handle->label);
+                    codeBlock->appendExceptionHandler(newHandler);
+                });
+        });
+}
+
+PatchpointExceptionHandle::PatchpointExceptionHandle(
+    State& state, OSRExitDescriptor* descriptor, NodeOrigin origin, unsigned offset,
+    const HandlerInfo& handler)
+    : m_state(state)
+    , m_descriptor(descriptor)
+    , m_origin(origin)
+    , m_offset(offset)
+    , m_handler(handler)
+{
+}
+
+RefPtr<OSRExitHandle> PatchpointExceptionHandle::createHandle(
+    ExitKind kind, const B3::StackmapGenerationParams& params)
+{
+    return m_descriptor->emitOSRExitLater(
+        m_state, kind, m_origin, params, m_offset);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLPatchpointExceptionHandle.h b/ftl/FTLPatchpointExceptionHandle.h
new file mode 100644
index 0000000..523369b
--- /dev/null
+++ b/ftl/FTLPatchpointExceptionHandle.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DFGCommon.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "DFGNodeOrigin.h"
+#include "ExitKind.h"
+#include "HandlerInfo.h"
+#include <wtf/Ref.h>
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace JSC {
+
+namespace B3 {
+class StackmapGenerationParams;
+} // namespace B3
+
+namespace FTL {
+
+class ExceptionTarget;
+class State;
+struct OSRExitDescriptor;
+struct OSRExitHandle;
+
+class PatchpointExceptionHandle : public ThreadSafeRefCounted<PatchpointExceptionHandle> {
+public:
+    static RefPtr<PatchpointExceptionHandle> create(
+        State&, OSRExitDescriptor*, DFG::NodeOrigin, unsigned offset, const HandlerInfo&);
+
+    static RefPtr<PatchpointExceptionHandle> defaultHandle(State&);
+    
+    ~PatchpointExceptionHandle();
+
+    // Note that you can use this handle to schedule any number of exits. This capability is here for
+    // two reasons:
+    // 
+    // - B3 code duplication. B3 could take a patchpoint and turn it into multiple patchpoints if it
+    //   duplicates code. Duplicating code is legal since you can do it without changing the behavior
+    //   of the program. One example is tail duplication. Another is jump threading. Yet another is
+    //   path specialization. You will have one PatchpointExceptionHandle per patchpoint you create
+    //   during DFG->B3 lowering, and that patchpoint will have a generator that calls
+    //   handle->scheduleBlah(). That generator will be called multiple times if your patchpoint got
+    //   duplicated.
+    //
+    // - Combination of unwind and non-unwind exception handlers inside one patchpoint. A GetById may
+    //   need both an exception handler that serves as an unwind target and an exception handler that
+    //   is branched to directly for operation calls emitted inside the patchpoint. In that case,
+    //   you'll call both scheduleExitCreation() and scheduleExitCreationForUnwind() on the same
+    //   handle.
+
+    // Schedules the creation of an OSR exit jump destination. You don't know when this will be
+    // created, but it will happen before linking. You can link jumps to it during link time. That's
+    // why this returns an ExceptionTarget. That will contain the jump destination (target->label())
+    // at link time. This function should be used for exceptions from C calls.
+    RefPtr<ExceptionTarget> scheduleExitCreation(const B3::StackmapGenerationParams&);
+
+    // Schedules the creation of an OSR exit jump destination, and ensures that it gets associated
+    // with the handler for some callsite index. This function should be used for exceptions from JS.
+    void scheduleExitCreationForUnwind(const B3::StackmapGenerationParams&, CallSiteIndex);
+
+private:
+    PatchpointExceptionHandle(
+        State&, OSRExitDescriptor*, DFG::NodeOrigin, unsigned offset, const HandlerInfo&);
+
+    RefPtr<OSRExitHandle> createHandle(ExitKind, const B3::StackmapGenerationParams&);
+
+    State& m_state;
+    OSRExitDescriptor* m_descriptor;
+    DFG::NodeOrigin m_origin;
+    unsigned m_offset;
+    HandlerInfo m_handler;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLRecoveryOpcode.cpp b/ftl/FTLRecoveryOpcode.cpp
new file mode 100644
index 0000000..70770dd
--- /dev/null
+++ b/ftl/FTLRecoveryOpcode.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLRecoveryOpcode.h"
+
+#if ENABLE(FTL_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::FTL::RecoveryOpcode opcode)
+{
+    switch (opcode) {
+    case JSC::FTL::AddRecovery:
+        out.print("Add");
+        return;
+    case JSC::FTL::SubRecovery:
+        out.print("Sub");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLRecoveryOpcode.h b/ftl/FTLRecoveryOpcode.h
new file mode 100644
index 0000000..70e7e4e
--- /dev/null
+++ b/ftl/FTLRecoveryOpcode.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+enum RecoveryOpcode {
+    AddRecovery,
+    SubRecovery
+};
+
+} } // namespace JSC::FTL
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::FTL::RecoveryOpcode);
+
+} // namespace WTF
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLSaveRestore.cpp b/ftl/FTLSaveRestore.cpp
new file mode 100644
index 0000000..c752fd2
--- /dev/null
+++ b/ftl/FTLSaveRestore.cpp
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLSaveRestore.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "MacroAssembler.h"
+#include "RegisterSet.h"
+
+namespace JSC { namespace FTL {
+
+static size_t bytesForGPRs()
+{
+    return MacroAssembler::numberOfRegisters() * sizeof(int64_t);
+}
+
+static size_t bytesForFPRs()
+{
+    // FIXME: It might be worthwhile saving the full state of the FP registers, at some point.
+    // Right now we don't need this since we only do the save/restore just prior to OSR exit, and
+    // OSR exit will be guaranteed to only need the double portion of the FP registers.
+    return MacroAssembler::numberOfFPRegisters() * sizeof(double);
+}
+
+size_t requiredScratchMemorySizeInBytes()
+{
+    return bytesForGPRs() + bytesForFPRs();
+}
+
+size_t offsetOfGPR(GPRReg reg)
+{
+    return MacroAssembler::registerIndex(reg) * sizeof(int64_t);
+}
+
+size_t offsetOfFPR(FPRReg reg)
+{
+    return bytesForGPRs() + MacroAssembler::fpRegisterIndex(reg) * sizeof(double);
+}
+
+size_t offsetOfReg(Reg reg)
+{
+    if (reg.isGPR())
+        return offsetOfGPR(reg.gpr());
+    return offsetOfFPR(reg.fpr());
+}
+
+namespace {
+
+struct Regs {
+    Regs()
+    {
+        special = RegisterSet::stackRegisters();
+        special.merge(RegisterSet::reservedHardwareRegisters());
+        
+        first = MacroAssembler::firstRegister();
+        while (special.get(first))
+            first = MacroAssembler::nextRegister(first);
+        second = MacroAssembler::nextRegister(first);
+        while (special.get(second))
+            second = MacroAssembler::nextRegister(second);
+    }
+    
+    RegisterSet special;
+    GPRReg first;
+    GPRReg second;
+};
+
+} // anonymous namespace
+
+void saveAllRegisters(MacroAssembler& jit, char* scratchMemory)
+{
+    Regs regs;
+    
+    // Get the first register out of the way, so that we can use it as a pointer.
+    jit.poke64(regs.first, 0);
+    jit.move(MacroAssembler::TrustedImmPtr(scratchMemory), regs.first);
+    
+    // Get all of the other GPRs out of the way.
+    for (MacroAssembler::RegisterID reg = regs.second; reg <= MacroAssembler::lastRegister(); reg = MacroAssembler::nextRegister(reg)) {
+        if (regs.special.get(reg))
+            continue;
+        jit.store64(reg, MacroAssembler::Address(regs.first, offsetOfGPR(reg)));
+    }
+    
+    // Restore the first register into the second one and save it.
+    jit.peek64(regs.second, 0);
+    jit.store64(regs.second, MacroAssembler::Address(regs.first, offsetOfGPR(regs.first)));
+    
+    // Finally save all FPR's.
+    for (MacroAssembler::FPRegisterID reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = MacroAssembler::nextFPRegister(reg)) {
+        if (regs.special.get(reg))
+            continue;
+        jit.storeDouble(reg, MacroAssembler::Address(regs.first, offsetOfFPR(reg)));
+    }
+}
+
+void restoreAllRegisters(MacroAssembler& jit, char* scratchMemory)
+{
+    Regs regs;
+    
+    // Give ourselves a pointer to the scratch memory.
+    jit.move(MacroAssembler::TrustedImmPtr(scratchMemory), regs.first);
+    
+    // Restore all FPR's.
+    for (MacroAssembler::FPRegisterID reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = MacroAssembler::nextFPRegister(reg)) {
+        if (regs.special.get(reg))
+            continue;
+        jit.loadDouble(MacroAssembler::Address(regs.first, offsetOfFPR(reg)), reg);
+    }
+    
+    for (MacroAssembler::RegisterID reg = regs.second; reg <= MacroAssembler::lastRegister(); reg = MacroAssembler::nextRegister(reg)) {
+        if (regs.special.get(reg))
+            continue;
+        jit.load64(MacroAssembler::Address(regs.first, offsetOfGPR(reg)), reg);
+    }
+    
+    jit.load64(MacroAssembler::Address(regs.first, offsetOfGPR(regs.first)), regs.first);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLSaveRestore.h b/ftl/FTLSaveRestore.h
new file mode 100644
index 0000000..c624641
--- /dev/null
+++ b/ftl/FTLSaveRestore.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "Reg.h"
+
+namespace JSC {
+
+class MacroAssembler;
+
+namespace FTL {
+
+size_t requiredScratchMemorySizeInBytes();
+
+size_t offsetOfReg(Reg);
+size_t offsetOfGPR(GPRReg);
+size_t offsetOfFPR(FPRReg);
+
+// Assumes that top-of-stack can be used as a pointer-sized scratchpad. Saves all of
+// the registers into the scratch buffer such that RegisterID * sizeof(int64_t) is the
+// offset of every register.
+void saveAllRegisters(MacroAssembler& jit, char* scratchMemory);
+
+void restoreAllRegisters(MacroAssembler& jit, char* scratchMemory);
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLSlowPathCall.cpp b/ftl/FTLSlowPathCall.cpp
new file mode 100644
index 0000000..eeba482
--- /dev/null
+++ b/ftl/FTLSlowPathCall.cpp
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLSlowPathCall.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "CCallHelpers.h"
+#include "FTLState.h"
+#include "FTLThunks.h"
+#include "GPRInfo.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace FTL {
+
+// This code relies on us being 64-bit. FTL is currently always 64-bit.
+static const size_t wordSize = 8;
+
+SlowPathCallContext::SlowPathCallContext(
+    RegisterSet usedRegisters, CCallHelpers& jit, unsigned numArgs, GPRReg returnRegister)
+    : m_jit(jit)
+    , m_numArgs(numArgs)
+    , m_returnRegister(returnRegister)
+{
+    // We don't care that you're using callee-save, stack, or hardware registers.
+    usedRegisters.exclude(RegisterSet::stackRegisters());
+    usedRegisters.exclude(RegisterSet::reservedHardwareRegisters());
+    usedRegisters.exclude(RegisterSet::calleeSaveRegisters());
+        
+    // The return register doesn't need to be saved.
+    if (m_returnRegister != InvalidGPRReg)
+        usedRegisters.clear(m_returnRegister);
+        
+    size_t stackBytesNeededForReturnAddress = wordSize;
+        
+    m_offsetToSavingArea =
+        (std::max(m_numArgs, NUMBER_OF_ARGUMENT_REGISTERS) - NUMBER_OF_ARGUMENT_REGISTERS) * wordSize;
+        
+    for (unsigned i = std::min(NUMBER_OF_ARGUMENT_REGISTERS, numArgs); i--;)
+        m_argumentRegisters.set(GPRInfo::toArgumentRegister(i));
+    m_callingConventionRegisters.merge(m_argumentRegisters);
+    if (returnRegister != InvalidGPRReg)
+        m_callingConventionRegisters.set(GPRInfo::returnValueGPR);
+    m_callingConventionRegisters.filter(usedRegisters);
+        
+    unsigned numberOfCallingConventionRegisters =
+        m_callingConventionRegisters.numberOfSetRegisters();
+        
+    size_t offsetToThunkSavingArea =
+        m_offsetToSavingArea +
+        numberOfCallingConventionRegisters * wordSize;
+        
+    m_stackBytesNeeded =
+        offsetToThunkSavingArea +
+        stackBytesNeededForReturnAddress +
+        (usedRegisters.numberOfSetRegisters() - numberOfCallingConventionRegisters) * wordSize;
+        
+    m_stackBytesNeeded = (m_stackBytesNeeded + stackAlignmentBytes() - 1) & ~(stackAlignmentBytes() - 1);
+        
+    m_jit.subPtr(CCallHelpers::TrustedImm32(m_stackBytesNeeded), CCallHelpers::stackPointerRegister);
+
+    m_thunkSaveSet = usedRegisters;
+        
+    // This relies on all calling convention registers also being temp registers.
+    unsigned stackIndex = 0;
+    for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
+        GPRReg reg = GPRInfo::toRegister(i);
+        if (!m_callingConventionRegisters.get(reg))
+            continue;
+        m_jit.storePtr(reg, CCallHelpers::Address(CCallHelpers::stackPointerRegister, m_offsetToSavingArea + (stackIndex++) * wordSize));
+        m_thunkSaveSet.clear(reg);
+    }
+        
+    m_offset = offsetToThunkSavingArea;
+}
+    
+SlowPathCallContext::~SlowPathCallContext()
+{
+    if (m_returnRegister != InvalidGPRReg)
+        m_jit.move(GPRInfo::returnValueGPR, m_returnRegister);
+    
+    unsigned stackIndex = 0;
+    for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
+        GPRReg reg = GPRInfo::toRegister(i);
+        if (!m_callingConventionRegisters.get(reg))
+            continue;
+        m_jit.loadPtr(CCallHelpers::Address(CCallHelpers::stackPointerRegister, m_offsetToSavingArea + (stackIndex++) * wordSize), reg);
+    }
+    
+    m_jit.addPtr(CCallHelpers::TrustedImm32(m_stackBytesNeeded), CCallHelpers::stackPointerRegister);
+}
+
+SlowPathCallKey SlowPathCallContext::keyWithTarget(void* callTarget) const
+{
+    return SlowPathCallKey(m_thunkSaveSet, callTarget, m_argumentRegisters, m_offset);
+}
+
+SlowPathCall SlowPathCallContext::makeCall(void* callTarget)
+{
+    SlowPathCall result = SlowPathCall(m_jit.call(), keyWithTarget(callTarget));
+
+    m_jit.addLinkTask(
+        [result] (LinkBuffer& linkBuffer) {
+            VM& vm = linkBuffer.vm();
+
+            MacroAssemblerCodeRef thunk =
+                vm.ftlThunks->getSlowPathCallThunk(vm, result.key());
+
+            linkBuffer.link(result.call(), CodeLocationLabel(thunk.code()));
+        });
+    
+    return result;
+}
+
+CallSiteIndex callSiteIndexForCodeOrigin(State& state, CodeOrigin codeOrigin)
+{
+    if (codeOrigin)
+        return state.jitCode->common.addCodeOrigin(codeOrigin);
+    return CallSiteIndex();
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLSlowPathCall.h b/ftl/FTLSlowPathCall.h
new file mode 100644
index 0000000..1d6eb96
--- /dev/null
+++ b/ftl/FTLSlowPathCall.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "CCallHelpers.h"
+#include "FTLSlowPathCallKey.h"
+#include "JITOperations.h"
+
+namespace JSC { namespace FTL {
+
+class State;
+
+class SlowPathCall {
+public:
+    SlowPathCall() { }
+    
+    SlowPathCall(MacroAssembler::Call call, const SlowPathCallKey& key)
+        : m_call(call)
+        , m_key(key)
+    {
+    }
+    
+    MacroAssembler::Call call() const { return m_call; }
+    SlowPathCallKey key() const { return m_key; }
+    
+private:
+    MacroAssembler::Call m_call;
+    SlowPathCallKey m_key;
+};
+
+// This will be an RAII thingy that will set up the necessary stack sizes and offsets and such.
+class SlowPathCallContext {
+public:
+    SlowPathCallContext(RegisterSet usedRegisters, CCallHelpers&, unsigned numArgs, GPRReg returnRegister);
+    ~SlowPathCallContext();
+
+    // NOTE: The call that this returns is already going to be linked by the JIT using addLinkTask(),
+    // so there is no need for you to link it yourself.
+    SlowPathCall makeCall(void* callTarget);
+
+private:
+    SlowPathCallKey keyWithTarget(void* callTarget) const;
+    
+    RegisterSet m_argumentRegisters;
+    RegisterSet m_callingConventionRegisters;
+    CCallHelpers& m_jit;
+    unsigned m_numArgs;
+    GPRReg m_returnRegister;
+    size_t m_offsetToSavingArea;
+    size_t m_stackBytesNeeded;
+    RegisterSet m_thunkSaveSet;
+    ptrdiff_t m_offset;
+};
+
+template<typename... ArgumentTypes>
+SlowPathCall callOperation(
+    const RegisterSet& usedRegisters, CCallHelpers& jit, CCallHelpers::JumpList* exceptionTarget,
+    FunctionPtr function, GPRReg resultGPR, ArgumentTypes... arguments)
+{
+    SlowPathCall call;
+    {
+        SlowPathCallContext context(usedRegisters, jit, sizeof...(ArgumentTypes) + 1, resultGPR);
+        jit.setupArgumentsWithExecState(arguments...);
+        call = context.makeCall(function.value());
+    }
+    if (exceptionTarget)
+        exceptionTarget->append(jit.emitExceptionCheck());
+    return call;
+}
+
+template<typename... ArgumentTypes>
+SlowPathCall callOperation(
+    const RegisterSet& usedRegisters, CCallHelpers& jit, CallSiteIndex callSiteIndex,
+    CCallHelpers::JumpList* exceptionTarget, FunctionPtr function, GPRReg resultGPR,
+    ArgumentTypes... arguments)
+{
+    if (callSiteIndex) {
+        jit.store32(
+            CCallHelpers::TrustedImm32(callSiteIndex.bits()),
+            CCallHelpers::tagFor(CallFrameSlot::argumentCount));
+    }
+    return callOperation(usedRegisters, jit, exceptionTarget, function, resultGPR, arguments...);
+}
+
+CallSiteIndex callSiteIndexForCodeOrigin(State&, CodeOrigin);
+
+template<typename... ArgumentTypes>
+SlowPathCall callOperation(
+    State& state, const RegisterSet& usedRegisters, CCallHelpers& jit, CodeOrigin codeOrigin,
+    CCallHelpers::JumpList* exceptionTarget, FunctionPtr function, GPRReg result, ArgumentTypes... arguments)
+{
+    return callOperation(
+        usedRegisters, jit, callSiteIndexForCodeOrigin(state, codeOrigin), exceptionTarget, function,
+        result, arguments...);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLSlowPathCallKey.cpp b/ftl/FTLSlowPathCallKey.cpp
new file mode 100644
index 0000000..4cc835d
--- /dev/null
+++ b/ftl/FTLSlowPathCallKey.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLSlowPathCallKey.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+void SlowPathCallKey::dump(PrintStream& out) const
+{
+    out.print("<usedRegisters = ", m_usedRegisters, ", offset = ", m_offset, ", callTarget = ", RawPointer(m_callTarget), ", argumentRegisters = ", m_argumentRegisters, ">");
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLSlowPathCallKey.h b/ftl/FTLSlowPathCallKey.h
new file mode 100644
index 0000000..f1161fb
--- /dev/null
+++ b/ftl/FTLSlowPathCallKey.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "RegisterSet.h"
+
+namespace JSC { namespace FTL {
+
+// This is used for creating some sanity in slow-path calls out of the FTL's inline
+// caches. The idea is that we don't want all of the register save/restore stuff to
+// be generated at each IC site. Instead, the IC slow path call site will just save
+// the registers needed for the arguments. It will arrange for there to be enough
+// space on top of stack to save the remaining registers and the return PC. Then it
+// will call a shared thunk that will save the remaining registers. That thunk needs
+// to know the stack offset at which things get saved along with the call target.
+
+// Note that the offset is *not including* the return PC that would be pushed on X86.
+
+class SlowPathCallKey {
+public:
+    SlowPathCallKey()
+        : m_callTarget(0)
+        , m_offset(0)
+    {
+    }
+    
+    SlowPathCallKey(
+        const RegisterSet& set, void* callTarget, const RegisterSet& argumentRegisters,
+        ptrdiff_t offset)
+        : m_usedRegisters(set)
+        , m_callTarget(callTarget)
+        , m_argumentRegisters(argumentRegisters)
+        , m_offset(offset)
+    {
+    }
+    
+    const RegisterSet& usedRegisters() const { return m_usedRegisters; }
+    void* callTarget() const { return m_callTarget; }
+    const RegisterSet& argumentRegisters() const { return m_argumentRegisters; }
+    ptrdiff_t offset() const { return m_offset; }
+    
+    SlowPathCallKey withCallTarget(void* callTarget)
+    {
+        return SlowPathCallKey(usedRegisters(), callTarget, argumentRegisters(), offset());
+    }
+    
+    void dump(PrintStream&) const;
+    
+    enum EmptyValueTag { EmptyValue };
+    enum DeletedValueTag { DeletedValue };
+    
+    SlowPathCallKey(EmptyValueTag)
+        : m_usedRegisters(RegisterSet::EmptyValue)
+        , m_callTarget(0)
+        , m_offset(0)
+    {
+    }
+    
+    SlowPathCallKey(DeletedValueTag)
+        : m_usedRegisters(RegisterSet::DeletedValue)
+        , m_callTarget(0)
+        , m_offset(0)
+    {
+    }
+    
+    bool isEmptyValue() const { return m_usedRegisters.isEmptyValue(); }
+    bool isDeletedValue() const { return m_usedRegisters.isDeletedValue(); }
+    
+    bool operator==(const SlowPathCallKey& other) const
+    {
+        return m_usedRegisters == other.m_usedRegisters
+            && m_callTarget == other.m_callTarget
+            && m_offset == other.m_offset;
+    }
+    unsigned hash() const
+    {
+        return m_usedRegisters.hash() + PtrHash<void*>::hash(m_callTarget) + m_offset;
+    }
+
+private:
+    RegisterSet m_usedRegisters;
+    void* m_callTarget;
+    RegisterSet m_argumentRegisters;
+    ptrdiff_t m_offset;
+};
+
+struct SlowPathCallKeyHash {
+    static unsigned hash(const SlowPathCallKey& key) { return key.hash(); }
+    static bool equal(const SlowPathCallKey& a, const SlowPathCallKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = false;
+};
+
+} } // namespace JSC::FTL
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::FTL::SlowPathCallKey> {
+    typedef JSC::FTL::SlowPathCallKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::FTL::SlowPathCallKey> : public CustomHashTraits<JSC::FTL::SlowPathCallKey> { };
+
+} // namespace WTF
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLStackmapArgumentList.h b/ftl/FTLStackmapArgumentList.h
new file mode 100644
index 0000000..bbbfb64
--- /dev/null
+++ b/ftl/FTLStackmapArgumentList.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLAbbreviatedTypes.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace FTL {
+
+typedef Vector<LValue, 16> StackmapArgumentList;
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLState.cpp b/ftl/FTLState.cpp
new file mode 100644
index 0000000..d624337
--- /dev/null
+++ b/ftl/FTLState.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLState.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "CodeBlockWithJITType.h"
+#include "FTLForOSREntryJITCode.h"
+#include "FTLJITCode.h"
+#include "FTLJITFinalizer.h"
+#include "FTLPatchpointExceptionHandle.h"
+#include <stdio.h>
+
+namespace JSC { namespace FTL {
+
+using namespace B3;
+using namespace DFG;
+
+State::State(Graph& graph)
+    : graph(graph)
+    , generatedFunction(0)
+{
+    switch (graph.m_plan.mode) {
+    case FTLMode: {
+        jitCode = adoptRef(new JITCode());
+        break;
+    }
+    case FTLForOSREntryMode: {
+        RefPtr<ForOSREntryJITCode> code = adoptRef(new ForOSREntryJITCode());
+        code->initializeEntryBuffer(graph.m_vm, graph.m_profiledBlock->m_numCalleeLocals);
+        code->setBytecodeIndex(graph.m_plan.osrEntryBytecodeIndex);
+        jitCode = code;
+        break;
+    }
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+
+    graph.m_plan.finalizer = std::make_unique<JITFinalizer>(graph.m_plan);
+    finalizer = static_cast<JITFinalizer*>(graph.m_plan.finalizer.get());
+
+    proc = std::make_unique<Procedure>();
+
+    proc->setOriginPrinter(
+        [this] (PrintStream& out, B3::Origin origin) {
+            out.print("DFG:", bitwise_cast<Node*>(origin.data()));
+        });
+
+    proc->setFrontendData(&graph);
+}
+
+State::~State()
+{
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLState.h b/ftl/FTLState.h
new file mode 100644
index 0000000..bc43430
--- /dev/null
+++ b/ftl/FTLState.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "B3Procedure.h"
+#include "DFGCommon.h"
+#include "DFGGraph.h"
+#include "FTLAbbreviatedTypes.h"
+#include "FTLGeneratedFunction.h"
+#include "FTLJITCode.h"
+#include "FTLJITFinalizer.h"
+#include <wtf/Box.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+namespace B3 {
+class PatchpointValue;
+class StackSlot;
+} // namespace B3
+
+namespace FTL {
+
+class PatchpointExceptionHandle;
+
+inline bool verboseCompilationEnabled()
+{
+    return DFG::verboseCompilationEnabled(DFG::FTLMode);
+}
+
+inline bool shouldDumpDisassembly()
+{
+    return DFG::shouldDumpDisassembly(DFG::FTLMode);
+}
+
+class State {
+    WTF_MAKE_NONCOPYABLE(State);
+    
+public:
+    State(DFG::Graph& graph);
+    ~State();
+    
+    // None of these things is owned by State. It is the responsibility of
+    // FTL phases to properly manage the lifecycle of the module and function.
+    DFG::Graph& graph;
+    std::unique_ptr<B3::Procedure> proc;
+    bool allocationFailed { false }; // Throw out the compilation once B3 returns.
+    RefPtr<JITCode> jitCode;
+    GeneratedFunction generatedFunction;
+    JITFinalizer* finalizer;
+    // Top-level exception handler. Jump here if you know that you have to genericUnwind() and there
+    // are no applicable catch blocks anywhere in the Graph.
+    RefPtr<PatchpointExceptionHandle> defaultExceptionHandle;
+    Box<CCallHelpers::Label> exceptionHandler { Box<CCallHelpers::Label>::create() };
+    B3::StackSlot* capturedValue { nullptr };
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLSwitchCase.h b/ftl/FTLSwitchCase.h
new file mode 100644
index 0000000..948e746
--- /dev/null
+++ b/ftl/FTLSwitchCase.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLAbbreviatedTypes.h"
+#include "FTLWeight.h"
+
+namespace JSC { namespace FTL {
+
+class SwitchCase {
+public:
+    SwitchCase()
+        : m_value(nullptr)
+        , m_target(nullptr)
+    {
+    }
+
+    SwitchCase(LValue value, LBasicBlock target, Weight weight = Weight())
+        : m_value(value)
+        , m_target(target)
+        , m_weight(weight)
+    {
+    }
+
+    LValue value() const { return m_value; }
+    LBasicBlock target() const { return m_target; }
+    Weight weight() const { return m_weight; }
+
+private:
+    LValue m_value;
+    LBasicBlock m_target;
+    Weight m_weight;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLThunks.cpp b/ftl/FTLThunks.cpp
new file mode 100644
index 0000000..cfbc75b
--- /dev/null
+++ b/ftl/FTLThunks.cpp
@@ -0,0 +1,233 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLThunks.h"
+
+#if ENABLE(FTL_JIT)
+
+#include "AssemblyHelpers.h"
+#include "DFGOSRExitCompilerCommon.h"
+#include "FPRInfo.h"
+#include "FTLOSRExitCompiler.h"
+#include "FTLOperations.h"
+#include "FTLSaveRestore.h"
+#include "GPRInfo.h"
+#include "LinkBuffer.h"
+
+namespace JSC { namespace FTL {
+
+using namespace DFG;
+
+enum class FrameAndStackAdjustmentRequirement {
+    Needed, 
+    NotNeeded 
+};
+
+static MacroAssemblerCodeRef genericGenerationThunkGenerator(
+    VM* vm, FunctionPtr generationFunction, const char* name, unsigned extraPopsToRestore, FrameAndStackAdjustmentRequirement frameAndStackAdjustmentRequirement)
+{
+    AssemblyHelpers jit(vm, 0);
+
+    if (frameAndStackAdjustmentRequirement == FrameAndStackAdjustmentRequirement::Needed) {
+        // This needs to happen before we use the scratch buffer because this function also uses the scratch buffer.
+        adjustFrameAndStackInOSRExitCompilerThunk<FTL::JITCode>(jit, vm, JITCode::FTLJIT);
+    }
+    
+    // Note that the "return address" will be the ID that we pass to the generation function.
+    
+    ptrdiff_t stackMisalignment = MacroAssembler::pushToSaveByteOffset();
+    
+    // Pretend that we're a C call frame.
+    jit.pushToSave(MacroAssembler::framePointerRegister);
+    jit.move(MacroAssembler::stackPointerRegister, MacroAssembler::framePointerRegister);
+    stackMisalignment += MacroAssembler::pushToSaveByteOffset();
+    
+    // Now create ourselves enough stack space to give saveAllRegisters() a scratch slot.
+    unsigned numberOfRequiredPops = 0;
+    do {
+        jit.pushToSave(GPRInfo::regT0);
+        stackMisalignment += MacroAssembler::pushToSaveByteOffset();
+        numberOfRequiredPops++;
+    } while (stackMisalignment % stackAlignmentBytes());
+    
+    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(requiredScratchMemorySizeInBytes());
+    char* buffer = static_cast<char*>(scratchBuffer->dataBuffer());
+    
+    saveAllRegisters(jit, buffer);
+    
+    // Tell GC mark phase how much of the scratch buffer is active during call.
+    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::nonArgGPR0);
+    jit.storePtr(MacroAssembler::TrustedImmPtr(requiredScratchMemorySizeInBytes()), GPRInfo::nonArgGPR0);
+
+    jit.loadPtr(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    jit.peek(
+        GPRInfo::argumentGPR1,
+        (stackMisalignment - MacroAssembler::pushToSaveByteOffset()) / sizeof(void*));
+    MacroAssembler::Call functionCall = jit.call();
+    
+    // At this point we want to make a tail call to what was returned to us in the
+    // returnValueGPR. But at the same time as we do this, we must restore all registers.
+    // The way we will accomplish this is by arranging to have the tail call target in the
+    // return address "slot" (be it a register or the stack).
+    
+    jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
+    
+    // Make sure we tell the GC that we're not using the scratch buffer anymore.
+    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT1);
+    jit.storePtr(MacroAssembler::TrustedImmPtr(0), GPRInfo::regT1);
+    
+    // Prepare for tail call.
+    while (numberOfRequiredPops--)
+        jit.popToRestore(GPRInfo::regT1);
+    jit.popToRestore(MacroAssembler::framePointerRegister);
+
+    // When we came in here, there was an additional thing pushed to the stack. Some clients want it
+    // popped before proceeding.
+    while (extraPopsToRestore--)
+        jit.popToRestore(GPRInfo::regT1);
+
+    // Put the return address wherever the return instruction wants it. On all platforms, this
+    // ensures that the return address is out of the way of register restoration.
+    jit.restoreReturnAddressBeforeReturn(GPRInfo::regT0);
+
+    restoreAllRegisters(jit, buffer);
+
+    jit.ret();
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    patchBuffer.link(functionCall, generationFunction);
+    return FINALIZE_CODE(patchBuffer, ("%s", name));
+}
+
+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM* vm)
+{
+    unsigned extraPopsToRestore = 0;
+    return genericGenerationThunkGenerator(
+        vm, compileFTLOSRExit, "FTL OSR exit generation thunk", extraPopsToRestore, FrameAndStackAdjustmentRequirement::Needed);
+}
+
+MacroAssemblerCodeRef lazySlowPathGenerationThunkGenerator(VM* vm)
+{
+    unsigned extraPopsToRestore = 1;
+    return genericGenerationThunkGenerator(
+        vm, compileFTLLazySlowPath, "FTL lazy slow path generation thunk", extraPopsToRestore, FrameAndStackAdjustmentRequirement::NotNeeded);
+}
+
+static void registerClobberCheck(AssemblyHelpers& jit, RegisterSet dontClobber)
+{
+    if (!Options::clobberAllRegsInFTLICSlowPath())
+        return;
+    
+    RegisterSet clobber = RegisterSet::allRegisters();
+    clobber.exclude(RegisterSet::reservedHardwareRegisters());
+    clobber.exclude(RegisterSet::stackRegisters());
+    clobber.exclude(RegisterSet::calleeSaveRegisters());
+    clobber.exclude(dontClobber);
+    
+    GPRReg someGPR;
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        if (!clobber.get(reg) || !reg.isGPR())
+            continue;
+        
+        jit.move(AssemblyHelpers::TrustedImm32(0x1337beef), reg.gpr());
+        someGPR = reg.gpr();
+    }
+    
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        if (!clobber.get(reg) || !reg.isFPR())
+            continue;
+        
+        jit.move64ToDouble(someGPR, reg.fpr());
+    }
+}
+
+MacroAssemblerCodeRef slowPathCallThunkGenerator(VM& vm, const SlowPathCallKey& key)
+{
+    AssemblyHelpers jit(&vm, 0);
+    
+    // We want to save the given registers at the given offset, then we want to save the
+    // old return address somewhere past that offset, and then finally we want to make the
+    // call.
+    
+    size_t currentOffset = key.offset() + sizeof(void*);
+    
+#if CPU(X86) || CPU(X86_64)
+    currentOffset += sizeof(void*);
+#endif
+    
+    for (MacroAssembler::RegisterID reg = MacroAssembler::firstRegister(); reg <= MacroAssembler::lastRegister(); reg = static_cast<MacroAssembler::RegisterID>(reg + 1)) {
+        if (!key.usedRegisters().get(reg))
+            continue;
+        jit.storePtr(reg, AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, currentOffset));
+        currentOffset += sizeof(void*);
+    }
+    
+    for (MacroAssembler::FPRegisterID reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = static_cast<MacroAssembler::FPRegisterID>(reg + 1)) {
+        if (!key.usedRegisters().get(reg))
+            continue;
+        jit.storeDouble(reg, AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, currentOffset));
+        currentOffset += sizeof(double);
+    }
+    
+    jit.preserveReturnAddressAfterCall(GPRInfo::nonArgGPR0);
+    jit.storePtr(GPRInfo::nonArgGPR0, AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, key.offset()));
+    
+    registerClobberCheck(jit, key.argumentRegisters());
+    
+    AssemblyHelpers::Call call = jit.call();
+
+    jit.loadPtr(AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, key.offset()), GPRInfo::nonPreservedNonReturnGPR);
+    jit.restoreReturnAddressBeforeReturn(GPRInfo::nonPreservedNonReturnGPR);
+    
+    for (MacroAssembler::FPRegisterID reg = MacroAssembler::lastFPRegister(); ; reg = static_cast<MacroAssembler::FPRegisterID>(reg - 1)) {
+        if (key.usedRegisters().get(reg)) {
+            currentOffset -= sizeof(double);
+            jit.loadDouble(AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, currentOffset), reg);
+        }
+        if (reg == MacroAssembler::firstFPRegister())
+            break;
+    }
+    
+    for (MacroAssembler::RegisterID reg = MacroAssembler::lastRegister(); ; reg = static_cast<MacroAssembler::RegisterID>(reg - 1)) {
+        if (key.usedRegisters().get(reg)) {
+            currentOffset -= sizeof(void*);
+            jit.loadPtr(AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, currentOffset), reg);
+        }
+        if (reg == MacroAssembler::firstRegister())
+            break;
+    }
+    
+    jit.ret();
+
+    LinkBuffer patchBuffer(vm, jit, GLOBAL_THUNK_ID);
+    patchBuffer.link(call, FunctionPtr(key.callTarget()));
+    return FINALIZE_CODE(patchBuffer, ("FTL slow path call thunk for %s", toCString(key).data()));
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
+
diff --git a/ftl/FTLThunks.h b/ftl/FTLThunks.h
new file mode 100644
index 0000000..33e3b02
--- /dev/null
+++ b/ftl/FTLThunks.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLLocation.h"
+#include "FTLSlowPathCallKey.h"
+#include "MacroAssemblerCodeRef.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class VM;
+
+namespace FTL {
+
+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM*);
+MacroAssemblerCodeRef lazySlowPathGenerationThunkGenerator(VM*);
+MacroAssemblerCodeRef slowPathCallThunkGenerator(VM&, const SlowPathCallKey&);
+
+template<typename KeyTypeArgument>
+struct ThunkMap {
+    typedef KeyTypeArgument KeyType;
+    typedef HashMap<KeyType, MacroAssemblerCodeRef> ToThunkMap;
+    typedef HashMap<MacroAssemblerCodePtr, KeyType> FromThunkMap;
+    
+    ToThunkMap m_toThunk;
+    FromThunkMap m_fromThunk;
+};
+
+template<typename MapType, typename GeneratorType>
+MacroAssemblerCodeRef generateIfNecessary(
+    VM& vm, MapType& map, const typename MapType::KeyType& key, GeneratorType generator)
+{
+    typename MapType::ToThunkMap::iterator iter = map.m_toThunk.find(key);
+    if (iter != map.m_toThunk.end())
+        return iter->value;
+    
+    MacroAssemblerCodeRef result = generator(vm, key);
+    map.m_toThunk.add(key, result);
+    map.m_fromThunk.add(result.code(), key);
+    return result;
+}
+
+template<typename MapType>
+typename MapType::KeyType keyForThunk(MapType& map, MacroAssemblerCodePtr ptr)
+{
+    typename MapType::FromThunkMap::iterator iter = map.m_fromThunk.find(ptr);
+    RELEASE_ASSERT(iter != map.m_fromThunk.end());
+    return iter->value;
+}
+
+class Thunks {
+public:
+    MacroAssemblerCodeRef getSlowPathCallThunk(VM& vm, const SlowPathCallKey& key)
+    {
+        return generateIfNecessary(
+            vm, m_slowPathCallThunks, key, slowPathCallThunkGenerator);
+    }
+    
+    SlowPathCallKey keyForSlowPathCallThunk(MacroAssemblerCodePtr ptr)
+    {
+        return keyForThunk(m_slowPathCallThunks, ptr);
+    }
+    
+private:
+    ThunkMap<SlowPathCallKey> m_slowPathCallThunks;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLTypedPointer.h b/ftl/FTLTypedPointer.h
new file mode 100644
index 0000000..8c0cbae
--- /dev/null
+++ b/ftl/FTLTypedPointer.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLAbbreviatedTypes.h"
+#include "FTLAbstractHeap.h"
+
+namespace JSC { namespace FTL {
+
+class TypedPointer {
+public:
+    TypedPointer()
+        : m_heap(0)
+        , m_value(0)
+    {
+    }
+    
+    TypedPointer(const AbstractHeap& heap, LValue value)
+        : m_heap(&heap)
+        , m_value(value)
+    {
+    }
+    
+    explicit operator bool() const
+    {
+        ASSERT(!m_heap == !m_value);
+        return !!m_heap;
+    }
+    
+    const AbstractHeap* heap() const { return m_heap; }
+    LValue value() const { return m_value; }
+
+private:
+    const AbstractHeap* m_heap;
+    LValue m_value;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLValueFromBlock.h b/ftl/FTLValueFromBlock.h
new file mode 100644
index 0000000..5bd14ca
--- /dev/null
+++ b/ftl/FTLValueFromBlock.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLAbbreviatedTypes.h"
+
+namespace JSC { namespace FTL {
+
+class ValueFromBlock {
+public:
+    ValueFromBlock()
+        : m_value(0)
+        , m_block(0)
+    {
+    }
+    
+    ValueFromBlock(LValue value, LBasicBlock block)
+        : m_value(value)
+        , m_block(block)
+    {
+    }
+    
+    explicit operator bool() const { return m_value || m_block; }
+
+    LValue value() const { return m_value; }
+    LBasicBlock block() const { return m_block; }
+
+private:
+    LValue m_value;
+    LBasicBlock m_block;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLValueRange.cpp b/ftl/FTLValueRange.cpp
new file mode 100644
index 0000000..d46ddaf
--- /dev/null
+++ b/ftl/FTLValueRange.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FTLValueRange.h"
+
+#if ENABLE(FTL_JIT)
+
+namespace JSC { namespace FTL {
+
+void ValueRange::decorateInstruction(LValue loadInstruction, unsigned rangeKind) const
+{
+    UNUSED_PARAM(loadInstruction);
+    UNUSED_PARAM(rangeKind);
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLValueRange.h b/ftl/FTLValueRange.h
new file mode 100644
index 0000000..3ae3dcb
--- /dev/null
+++ b/ftl/FTLValueRange.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLAbbreviatedTypes.h"
+
+namespace JSC { namespace FTL {
+
+class ValueRange {
+public:
+    ValueRange()
+        : m_begin(0)
+        , m_end(0)
+    {
+    }
+    
+    ValueRange(LValue begin, LValue end)
+        : m_begin(begin)
+        , m_end(end)
+    {
+    }
+    
+    LValue begin() const { return m_begin; }
+    LValue end() const { return m_end; }
+    
+    void decorateInstruction(LValue loadInstruction, unsigned rangeKind) const;
+    
+private:
+    LValue m_begin;
+    LValue m_end;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLWeight.h b/ftl/FTLWeight.h
new file mode 100644
index 0000000..cde2307
--- /dev/null
+++ b/ftl/FTLWeight.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "B3FrequencyClass.h"
+#include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC { namespace FTL {
+
+class Weight {
+public:
+    Weight()
+        : m_value(std::numeric_limits<float>::quiet_NaN())
+    {
+    }
+    
+    explicit Weight(float value)
+        : m_value(value)
+    {
+    }
+    
+    bool isSet() const { return m_value == m_value; }
+    bool operator!() const { return !isSet(); }
+    
+    float value() const { return m_value; }
+
+    B3::FrequencyClass frequencyClass() const { return value() ? B3::FrequencyClass::Normal : B3::FrequencyClass::Rare; }
+    
+    // Inverse weight for a two-target branch.
+    Weight inverse() const
+    {
+        if (!isSet())
+            return Weight();
+        if (value())
+            return Weight(0);
+        return Weight(1);
+    }
+    
+private:
+    float m_value;
+};
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/ftl/FTLWeightedTarget.h b/ftl/FTLWeightedTarget.h
new file mode 100644
index 0000000..5ed2968
--- /dev/null
+++ b/ftl/FTLWeightedTarget.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(FTL_JIT)
+
+#include "FTLAbbreviatedTypes.h"
+#include "FTLWeight.h"
+
+namespace JSC { namespace FTL {
+
+class WeightedTarget {
+public:
+    WeightedTarget()
+        : m_target(nullptr)
+    {
+    }
+    
+    WeightedTarget(LBasicBlock target, Weight weight)
+        : m_target(target)
+        , m_weight(weight)
+    {
+    }
+    
+    WeightedTarget(LBasicBlock target, float weight)
+        : m_target(target)
+        , m_weight(weight)
+    {
+    }
+    
+    LBasicBlock target() const { return m_target; }
+    Weight weight() const { return m_weight; }
+    
+    B3::FrequentedBlock frequentedBlock() const
+    {
+        return B3::FrequentedBlock(target(), weight().frequencyClass());
+    }
+    
+private:
+    LBasicBlock m_target;
+    Weight m_weight;
+};
+
+// Helpers for creating weighted targets for statically known (or unknown) branch
+// profiles.
+
+inline WeightedTarget usually(LBasicBlock block)
+{
+    return WeightedTarget(block, 1);
+}
+
+inline WeightedTarget rarely(LBasicBlock block)
+{
+    return WeightedTarget(block, 0);
+}
+
+// Currently in B3 this is the equivalent of "usually", but we like to make the distinction in
+// case we ever make B3 support proper branch weights. We used to do that in LLVM.
+inline WeightedTarget unsure(LBasicBlock block)
+{
+    return WeightedTarget(block, Weight());
+}
+
+} } // namespace JSC::FTL
+
+#endif // ENABLE(FTL_JIT)
diff --git a/generate-bytecode-files b/generate-bytecode-files
new file mode 100644
index 0000000..5b2fce8
--- /dev/null
+++ b/generate-bytecode-files
@@ -0,0 +1,220 @@
+#! /usr/bin/python
+
+# Copyright (C) 2014 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# This tool processes the bytecode list to create Bytecodes.h and InitBytecodes.asm
+
+import hashlib
+import json
+import optparse
+import os
+import re
+import sys
+
+cCopyrightMsg = """/*
+* Copyright (C) 2014 Apple Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+*
+* 1.  Redistributions of source code must retain the above copyright
+*     notice, this list of conditions and the following disclaimer. 
+* 2.  Redistributions in binary form must reproduce the above copyright
+*     notice, this list of conditions and the following disclaimer in the
+*     documentation and/or other materials provided with the distribution. 
+*
+* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+* Autogenerated from %s, do not modify.
+*/
+
+"""
+
+asmCopyrightMsg = """# Copyright (C) 2014 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Autogenerated from %s, do not modify.
+
+"""
+def openOrExit(path, mode):
+    try:
+        return open(path, mode)
+    except IOError as e:
+        print "I/O error opening {0}, ({1}): {2}".format(path, e.errno, e.strerror)
+        exit(1)
+
+def hashFile(file):
+    sha1 = hashlib.sha1()
+    file.seek(0)
+    for line in file:
+        sha1.update(line)
+
+    file.seek(0)
+
+    return sha1.hexdigest()
+
+if __name__ == "__main__":
+    parser = optparse.OptionParser(usage = "usage: %prog [--bytecodes_h <FILE>] [--init_bytecodes_asm <FILE>] <bytecode-json-file>")
+    parser.add_option("-b", "--bytecodes_h", dest = "bytecodesHFileName", help = "generate bytecodes macro .h FILE", metavar = "FILE")
+    parser.add_option("-a", "--init_bytecodes_asm", dest = "initASMFileName", help="generate ASM bytecodes init FILE", metavar = "FILE")
+    (options, args) = parser.parse_args()
+
+    if len(args) != 1:
+        parser.error("missing <bytecode-json-file>")
+
+    bytecodeJSONFile = args[0]
+    bytecodeFile = openOrExit(bytecodeJSONFile, "rb")
+    sha1Hash = hashFile(bytecodeFile)
+
+    hFileHashString = "// SHA1Hash: {0}\n".format(sha1Hash)
+    asmFileHashString = "# SHA1Hash: {0}\n".format(sha1Hash)
+
+    bytecodeHFilename = options.bytecodesHFileName
+    initASMFileName = options.initASMFileName
+
+    if not bytecodeHFilename and not initASMFileName:
+        parser.print_help()
+        exit(0)
+
+    needToGenerate = False
+
+    if bytecodeHFilename:
+        try:
+            bytecodeHReadFile = open(bytecodeHFilename, "rb")
+            
+            hashLine = bytecodeHReadFile.readline()
+            if hashLine != hFileHashString:
+                needToGenerate = True
+        except:
+            needToGenerate = True
+        else:
+            bytecodeHReadFile.close()
+
+    if initASMFileName:
+        try:
+            initBytecodesReadFile = open(initASMFileName, "rb")
+            
+            hashLine = initBytecodesReadFile.readline()
+            if hashLine != asmFileHashString:
+                needToGenerate = True
+        except:
+            needToGenerate = True
+        else:
+            initBytecodesReadFile.close()
+
+    if not needToGenerate:
+        exit(0)
+
+    if bytecodeHFilename:
+        bytecodeHFile = openOrExit(bytecodeHFilename, "wb")
+
+    if initASMFileName:
+        initBytecodesFile = openOrExit(initASMFileName, "wb")
+
+    try:
+        bytecodeSections = json.load(bytecodeFile, encoding = "utf-8")
+    except:
+        print "Unexpected error parsing {0}: {1}".format(bytecodeJSONFile, sys.exc_info())
+
+    if bytecodeHFilename:
+        bytecodeHFile.write(hFileHashString)
+        bytecodeHFile.write(cCopyrightMsg % bytecodeJSONFile)
+        bytecodeHFile.write("#pragma once\n\n")
+
+    if initASMFileName:
+        initBytecodesFile.write(asmFileHashString)
+        initBytecodesFile.write(asmCopyrightMsg % bytecodeJSONFile)
+        initASMBytecodeNum = 0
+
+    for section in bytecodeSections:
+        if bytecodeHFilename and section['emitInHFile']:
+            bytecodeHFile.write("#define FOR_EACH_{0}_ID(macro) \\\n".format(section["macroNameComponent"]))
+            firstMacro = True
+            defaultLength = 1
+            if "defaultLength" in section:
+                defaultLength = section["defaultLength"]
+
+            bytecodeNum = 0
+            for bytecode in section["bytecodes"]:
+                if not firstMacro:
+                    bytecodeHFile.write(" \\\n")
+
+                length = defaultLength
+                if "length" in bytecode:
+                    length = bytecode["length"]
+
+                bytecodeHFile.write("    macro({0}, {1})".format(bytecode["name"], length))
+                firstMacro = False
+                bytecodeNum = bytecodeNum + 1
+
+            bytecodeHFile.write("\n\n")
+            bytecodeHFile.write("#define NUMBER_OF_{0}_IDS {1}\n\n".format(section["macroNameComponent"], bytecodeNum))
+
+        if initASMFileName and section['emitInASMFile']:
+            prefix = ""
+            if "asmPrefix" in section:
+                prefix = section["asmPrefix"]
+            for bytecode in section["bytecodes"]:
+                initBytecodesFile.write("setEntryAddress({0}, _{1}{2})\n".format(initASMBytecodeNum, prefix, bytecode["name"]))
+                initASMBytecodeNum = initASMBytecodeNum + 1
+
+    if bytecodeHFilename:
+        bytecodeHFile.close()
+
+    if initASMFileName:
+        initBytecodesFile.close()
+
+    bytecodeFile.close()
+
+    exit(0)
diff --git a/generateYarrCanonicalizeUnicode b/generateYarrCanonicalizeUnicode
new file mode 100644
index 0000000..c78860a
--- /dev/null
+++ b/generateYarrCanonicalizeUnicode
@@ -0,0 +1,200 @@
+#! /usr/bin/python
+
+# Copyright (C) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# This tool processes the Unicode Character Database file CaseFolding.txt to create
+# canonicalization table as decribed in ECMAScript 6 standard in section
+# "21.2.2.8.2 Runtime Semantics: Canonicalize()", step 2.
+
+import optparse
+import re
+import sys
+from sets import Set
+
+header = """/*
+* Copyright (C) 2016 Apple Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+*
+* 1.  Redistributions of source code must retain the above copyright
+*     notice, this list of conditions and the following disclaimer. 
+* 2.  Redistributions in binary form must reproduce the above copyright
+*     notice, this list of conditions and the following disclaimer in the
+*     documentation and/or other materials provided with the distribution. 
+*
+* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+// DO NO EDIT! - This file was generated by generateYarrCanonicalizeUnicode
+
+#include "config.h"
+#include "YarrCanonicalize.h"
+
+namespace JSC { namespace Yarr {
+
+"""
+
+footer = """} } // JSC::Yarr
+"""
+
+MaxUnicode = 0x10ffff
+commonAndSimpleLinesRE = re.compile(r"(?P<code>[0-9A-F]+)\s*;\s*[CS]\s*;\s*(?P<mapping>[0-9A-F]+)", re.IGNORECASE)
+
+def openOrExit(path, mode):
+    try:
+        return open(path, mode)
+    except IOError as e:
+        print "I/O error opening {0}, ({1}): {2}".format(path, e.errno, e.strerror)
+        exit(1)
+
+class Canonicalize:
+    def __init__(self):
+        self.canonicalGroups = {};
+
+    def addMapping(self, code, mapping):
+        if mapping not in self.canonicalGroups:
+            self.canonicalGroups[mapping] = []
+        self.canonicalGroups[mapping].append(code)
+        
+    def readCaseFolding(self, file):
+        codesSeen = Set()
+        for line in file:
+            line = line.split('#', 1)[0]
+            line = line.rstrip()
+            if (not len(line)):
+                continue
+
+            fields = commonAndSimpleLinesRE.match(line)
+            if (not fields):
+                continue
+
+            code = int(fields.group('code'), 16)
+            mapping = int(fields.group('mapping'), 16)
+
+            codesSeen.add(code)
+            self.addMapping(code, mapping)
+
+        for i in range(MaxUnicode + 1):
+            if i in codesSeen:
+                continue;
+
+            self.addMapping(i, i)
+
+    def createTables(self, file):
+        typeInfo = [""] * (MaxUnicode + 1)
+        characterSets = []
+
+        for mapping in sorted(self.canonicalGroups.keys()):
+            characters = self.canonicalGroups[mapping]
+            if len(characters) == 1:
+                typeInfo[characters[0]] = "CanonicalizeUnique:0"
+            else:
+                characters.sort()
+                if len(characters) > 2:
+                    for ch in characters:
+                        typeInfo[ch] = "CanonicalizeSet:%d" % len(characterSets)
+                    characterSets.append(characters)
+                else:
+                    low = characters[0]
+                    high = characters[1]
+                    delta = high - low
+                    if delta == 1:
+                        type = "CanonicalizeAlternatingUnaligned:0" if low & 1 else "CanonicalizeAlternatingAligned:0"
+                        typeInfo[low] = type
+                        typeInfo[high] = type
+                    else:
+                        typeInfo[low] = "CanonicalizeRangeLo:%d" % delta
+                        typeInfo[high] = "CanonicalizeRangeHi:%d" % delta
+
+        rangeInfo = []
+        end = 0
+        while end <= MaxUnicode:
+            begin = end
+            type = typeInfo[end]
+            while end < MaxUnicode and typeInfo[end + 1] == type:
+                end = end + 1
+            rangeInfo.append({"begin": begin, "end": end, "type": type})
+            end = end + 1
+        
+        for i in range(len(characterSets)):
+            characters = ""
+            set = characterSets[i]
+            for ch in set:
+                characters = characters + "0x{character:04x}, ".format(character=ch)
+            file.write("const UChar32 unicodeCharacterSet{index:d}[] = {{ {characters}0 }};\n".format(index=i, characters=characters))
+
+        file.write("\n")
+        file.write("static const size_t UNICODE_CANONICALIZATION_SETS = {setCount:d};\n".format(setCount=len(characterSets)))
+        file.write("const UChar32* const unicodeCharacterSetInfo[UNICODE_CANONICALIZATION_SETS] = {\n")
+
+        for i in range(len(characterSets)):
+            file.write("    unicodeCharacterSet{setNumber:d},\n".format(setNumber=i))
+
+        file.write("};\n")
+        file.write("\n")
+        file.write("const size_t UNICODE_CANONICALIZATION_RANGES = {rangeCount:d};\n".format(rangeCount=len(rangeInfo)))
+        file.write("const CanonicalizationRange unicodeRangeInfo[UNICODE_CANONICALIZATION_RANGES] = {\n")
+
+        for info in rangeInfo:
+            typeAndValue = info["type"].split(":")
+            file.write("    {{ 0x{begin:04x}, 0x{end:04x}, 0x{value:04x}, {type} }},\n".format(begin=info["begin"], end=info["end"], value=int(typeAndValue[1]), type=typeAndValue[0]))
+
+        file.write("};\n")
+        file.write("\n")
+
+        
+if __name__ == "__main__":
+    parser = optparse.OptionParser(usage = "usage: %prog  <CaseFolding.txt> <YarrCanonicalizeUnicode.h>")
+    (options, args) = parser.parse_args()
+
+    if len(args) != 2:
+        parser.error("<CaseFolding.txt> <YarrCanonicalizeUnicode.h>")
+
+    caseFoldingTxtPath = args[0]
+    canonicalizeHPath = args[1]
+    caseFoldingTxtFile = openOrExit(caseFoldingTxtPath, "r")
+    canonicalizeHFile = openOrExit(canonicalizeHPath, "wb")
+
+    canonicalize = Canonicalize()
+    canonicalize.readCaseFolding(caseFoldingTxtFile)
+
+    canonicalizeHFile.write(header);
+    canonicalize.createTables(canonicalizeHFile)
+    canonicalizeHFile.write(footer);
+
+    caseFoldingTxtFile.close()
+    canonicalizeHFile.close()
+
+    exit(0)
diff --git a/heap/AllocatingScope.h b/heap/AllocatingScope.h
new file mode 100644
index 0000000..1d13ae0
--- /dev/null
+++ b/heap/AllocatingScope.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Heap.h"
+
+namespace JSC {
+
+class AllocatingScope {
+public:
+    AllocatingScope(Heap& heap)
+        : m_heap(heap)
+    {
+        RELEASE_ASSERT(m_heap.m_mutatorState == MutatorState::Running);
+        m_heap.m_mutatorState = MutatorState::Allocating;
+    }
+    
+    ~AllocatingScope()
+    {
+        RELEASE_ASSERT(m_heap.m_mutatorState == MutatorState::Allocating);
+        m_heap.m_mutatorState = MutatorState::Running;
+    }
+
+private:
+    Heap& m_heap;
+};
+
+} // namespace JSC
+
diff --git a/heap/AllocatorAttributes.cpp b/heap/AllocatorAttributes.cpp
new file mode 100644
index 0000000..468f91c
--- /dev/null
+++ b/heap/AllocatorAttributes.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AllocatorAttributes.h"
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+void AllocatorAttributes::dump(PrintStream& out) const
+{
+    out.print("{", destruction, ", ", cellKind, "}");
+}
+
+} // namespace JSC
+
diff --git a/heap/AllocatorAttributes.h b/heap/AllocatorAttributes.h
new file mode 100644
index 0000000..6d5299f
--- /dev/null
+++ b/heap/AllocatorAttributes.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ConstraintVolatility.h"
+#include "DestructionMode.h"
+#include "HeapCell.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+struct AllocatorAttributes {
+    AllocatorAttributes() { }
+    
+    AllocatorAttributes(DestructionMode destruction, HeapCell::Kind cellKind)
+        : destruction(destruction)
+        , cellKind(cellKind)
+    {
+    }
+    
+    void dump(PrintStream& out) const;
+    
+    DestructionMode destruction { DoesNotNeedDestruction };
+    HeapCell::Kind cellKind { HeapCell::JSCell };
+};
+
+} // namespace JSC
+
diff --git a/heap/CellContainer.cpp b/heap/CellContainer.cpp
new file mode 100644
index 0000000..baccde9
--- /dev/null
+++ b/heap/CellContainer.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CellContainer.h"
+
+#include "MarkedBlockInlines.h"
+
+namespace JSC {
+
+bool CellContainer::isNewlyAllocated(HeapCell* cell) const
+{
+    if (isLargeAllocation())
+        return largeAllocation().isNewlyAllocated();
+    MarkedBlock::Handle& handle = markedBlock().handle();
+    return !handle.isNewlyAllocatedStale()
+        && handle.isNewlyAllocated(cell);
+}
+
+} // namespace JSC
+
diff --git a/heap/CellContainer.h b/heap/CellContainer.h
new file mode 100644
index 0000000..e4f2ff2
--- /dev/null
+++ b/heap/CellContainer.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class Heap;
+class HeapCell;
+class LargeAllocation;
+class MarkedBlock;
+class WeakSet;
+class VM;
+
+typedef uint32_t HeapVersion;
+
+// This is how we abstract over either MarkedBlock& or LargeAllocation&. Put things in here as you
+// find need for them.
+
+class CellContainer {
+public:
+    CellContainer()
+        : m_encodedPointer(0)
+    {
+    }
+    
+    CellContainer(MarkedBlock& markedBlock)
+        : m_encodedPointer(bitwise_cast<uintptr_t>(&markedBlock))
+    {
+    }
+    
+    CellContainer(LargeAllocation& largeAllocation)
+        : m_encodedPointer(bitwise_cast<uintptr_t>(&largeAllocation) | isLargeAllocationBit)
+    {
+    }
+    
+    VM* vm() const;
+    Heap* heap() const;
+    
+    explicit operator bool() const { return !!m_encodedPointer; }
+    
+    bool isMarkedBlock() const { return m_encodedPointer && !(m_encodedPointer & isLargeAllocationBit); }
+    bool isLargeAllocation() const { return m_encodedPointer & isLargeAllocationBit; }
+    
+    MarkedBlock& markedBlock() const
+    {
+        ASSERT(isMarkedBlock());
+        return *bitwise_cast<MarkedBlock*>(m_encodedPointer);
+    }
+    
+    LargeAllocation& largeAllocation() const
+    {
+        ASSERT(isLargeAllocation());
+        return *bitwise_cast<LargeAllocation*>(m_encodedPointer - isLargeAllocationBit);
+    }
+    
+    void aboutToMark(HeapVersion markingVersion);
+    bool areMarksStale() const;
+    
+    bool isMarked(HeapCell*) const;
+    bool isMarked(HeapVersion markingVersion, HeapCell*) const;
+    
+    bool isNewlyAllocated(HeapCell*) const;
+    
+    void noteMarked();
+    void assertValidCell(VM&, HeapCell*) const;
+    
+    size_t cellSize() const;
+    
+    WeakSet& weakSet() const;
+    
+private:
+    static const uintptr_t isLargeAllocationBit = 1;
+    uintptr_t m_encodedPointer;
+};
+
+} // namespace JSC
+
diff --git a/heap/CellContainerInlines.h b/heap/CellContainerInlines.h
new file mode 100644
index 0000000..c23d488
--- /dev/null
+++ b/heap/CellContainerInlines.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CellContainer.h"
+#include "JSCell.h"
+#include "LargeAllocation.h"
+#include "MarkedBlock.h"
+#include "VM.h"
+
+namespace JSC {
+
+inline VM* CellContainer::vm() const
+{
+    if (isLargeAllocation())
+        return largeAllocation().vm();
+    return markedBlock().vm();
+}
+
+inline Heap* CellContainer::heap() const
+{
+    return &vm()->heap;
+}
+
+inline bool CellContainer::isMarked(HeapCell* cell) const
+{
+    if (isLargeAllocation())
+        return largeAllocation().isMarked();
+    return markedBlock().isMarked(cell);
+}
+
+inline bool CellContainer::isMarked(HeapVersion markingVersion, HeapCell* cell) const
+{
+    if (isLargeAllocation())
+        return largeAllocation().isMarked();
+    return markedBlock().isMarked(markingVersion, cell);
+}
+
+inline void CellContainer::noteMarked()
+{
+    if (!isLargeAllocation())
+        markedBlock().noteMarked();
+}
+
+inline void CellContainer::assertValidCell(VM& vm, HeapCell* cell) const
+{
+    if (isLargeAllocation())
+        largeAllocation().assertValidCell(vm, cell);
+    else
+        markedBlock().assertValidCell(vm, cell);
+}
+
+inline size_t CellContainer::cellSize() const
+{
+    if (isLargeAllocation())
+        return largeAllocation().cellSize();
+    return markedBlock().cellSize();
+}
+
+inline WeakSet& CellContainer::weakSet() const
+{
+    if (isLargeAllocation())
+        return largeAllocation().weakSet();
+    return markedBlock().weakSet();
+}
+
+inline void CellContainer::aboutToMark(HeapVersion markingVersion)
+{
+    if (!isLargeAllocation())
+        markedBlock().aboutToMark(markingVersion);
+}
+
+inline bool CellContainer::areMarksStale() const
+{
+    if (isLargeAllocation())
+        return false;
+    return markedBlock().areMarksStale();
+}
+
+} // namespace JSC
+
diff --git a/heap/CellState.h b/heap/CellState.h
new file mode 100644
index 0000000..caf32b6
--- /dev/null
+++ b/heap/CellState.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+// The CellState of a cell is a kind of hint about what the state of the cell is.
+enum class CellState : uint8_t {
+    // The object is either currently being scanned, or it has finished being scanned, or this
+    // is a full collection and it's actually a white object (you'd know because its mark bit
+    // would be clear).
+    PossiblyBlack = 0,
+    
+    // The object is in eden. During GC, this means that the object has not been marked yet.
+    DefinitelyWhite = 1,
+
+    // This sorta means that the object is grey - i.e. it will be scanned. Or it could be white
+    // during a full collection if its mark bit is clear. That would happen if it had been black,
+    // got barriered, and we did a full collection.
+    PossiblyGrey = 2
+};
+
+static const unsigned blackThreshold = 0; // x <= blackThreshold means x is PossiblyOldOrBlack.
+static const unsigned tautologicalThreshold = 100; // x <= tautologicalThreshold is always true.
+
+inline bool isWithinThreshold(CellState cellState, unsigned threshold)
+{
+    return static_cast<unsigned>(cellState) <= threshold;
+}
+
+} // namespace JSC
diff --git a/heap/CodeBlockSet.cpp b/heap/CodeBlockSet.cpp
new file mode 100644
index 0000000..8819a45
--- /dev/null
+++ b/heap/CodeBlockSet.cpp
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CodeBlockSet.h"
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+CodeBlockSet::CodeBlockSet()
+{
+}
+
+CodeBlockSet::~CodeBlockSet()
+{
+}
+
+void CodeBlockSet::add(CodeBlock* codeBlock)
+{
+    LockHolder locker(&m_lock);
+    bool isNewEntry = m_newCodeBlocks.add(codeBlock).isNewEntry;
+    ASSERT_UNUSED(isNewEntry, isNewEntry);
+}
+
+void CodeBlockSet::promoteYoungCodeBlocks(const LockHolder&)
+{
+    ASSERT(m_lock.isLocked());
+    m_oldCodeBlocks.add(m_newCodeBlocks.begin(), m_newCodeBlocks.end());
+    m_newCodeBlocks.clear();
+}
+
+void CodeBlockSet::clearMarksForFullCollection()
+{
+    LockHolder locker(&m_lock);
+    for (CodeBlock* codeBlock : m_oldCodeBlocks)
+        codeBlock->clearVisitWeaklyHasBeenCalled();
+}
+
+void CodeBlockSet::lastChanceToFinalize()
+{
+    LockHolder locker(&m_lock);
+    for (CodeBlock* codeBlock : m_newCodeBlocks)
+        codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock);
+
+    for (CodeBlock* codeBlock : m_oldCodeBlocks)
+        codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock);
+}
+
+void CodeBlockSet::deleteUnmarkedAndUnreferenced(CollectionScope scope)
+{
+    LockHolder locker(&m_lock);
+    Vector<CodeBlock*> unmarked;
+    
+    auto consider = [&] (HashSet<CodeBlock*>& set) {
+        for (CodeBlock* codeBlock : set) {
+            if (Heap::isMarked(codeBlock))
+                continue;;
+            unmarked.append(codeBlock);
+        }
+        for (CodeBlock* codeBlock : unmarked) {
+            codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock);
+            set.remove(codeBlock);
+        }
+        unmarked.resize(0);
+    };
+
+    switch (scope) {
+    case CollectionScope::Eden:
+        consider(m_newCodeBlocks);
+        break;
+    case CollectionScope::Full:
+        consider(m_oldCodeBlocks);
+        consider(m_newCodeBlocks);
+        break;
+    }
+
+    // Any remaining young CodeBlocks are live and need to be promoted to the set of old CodeBlocks.
+    promoteYoungCodeBlocks(locker);
+}
+
+bool CodeBlockSet::contains(const LockHolder&, void* candidateCodeBlock)
+{
+    RELEASE_ASSERT(m_lock.isLocked());
+    CodeBlock* codeBlock = static_cast<CodeBlock*>(candidateCodeBlock);
+    if (!HashSet<CodeBlock*>::isValidValue(codeBlock))
+        return false;
+    return m_oldCodeBlocks.contains(codeBlock) || m_newCodeBlocks.contains(codeBlock) || m_currentlyExecuting.contains(codeBlock);
+}
+
+void CodeBlockSet::clearCurrentlyExecuting()
+{
+    m_currentlyExecuting.clear();
+}
+
+void CodeBlockSet::dump(PrintStream& out) const
+{
+    CommaPrinter comma;
+    out.print("{old = [");
+    for (CodeBlock* codeBlock : m_oldCodeBlocks)
+        out.print(comma, pointerDump(codeBlock));
+    out.print("], new = [");
+    comma = CommaPrinter();
+    for (CodeBlock* codeBlock : m_newCodeBlocks)
+        out.print(comma, pointerDump(codeBlock));
+    out.print("], currentlyExecuting = [");
+    comma = CommaPrinter();
+    for (CodeBlock* codeBlock : m_currentlyExecuting)
+        out.print(comma, pointerDump(codeBlock));
+    out.print("]}");
+}
+
+} // namespace JSC
+
diff --git a/heap/CodeBlockSet.h b/heap/CodeBlockSet.h
new file mode 100644
index 0000000..83f16fd
--- /dev/null
+++ b/heap/CodeBlockSet.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CollectionScope.h"
+#include "GCSegmentedArray.h"
+#include <wtf/HashSet.h>
+#include <wtf/Lock.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+class CodeBlock;
+class Heap;
+class JSCell;
+
+// CodeBlockSet tracks all CodeBlocks. Every CodeBlock starts out with one
+// reference coming in from GC. The GC is responsible for freeing CodeBlocks
+// once they hasOneRef() and nobody is running code from that CodeBlock.
+
+class CodeBlockSet {
+    WTF_MAKE_NONCOPYABLE(CodeBlockSet);
+
+public:
+    CodeBlockSet();
+    ~CodeBlockSet();
+
+    void lastChanceToFinalize();
+    
+    // Add a CodeBlock. This is only called by CodeBlock constructors.
+    void add(CodeBlock*);
+    
+    // Clear all mark bits for all CodeBlocks.
+    void clearMarksForFullCollection();
+
+    // Mark a pointer that may be a CodeBlock that belongs to the set of DFG
+    // blocks. This is defined in CodeBlock.h.
+private:
+    void mark(const LockHolder&, CodeBlock* candidateCodeBlock);
+public:
+    void mark(const LockHolder&, void* candidateCodeBlock);
+    
+    // Delete all code blocks that are only referenced by this set (i.e. owned
+    // by this set), and that have not been marked.
+    void deleteUnmarkedAndUnreferenced(CollectionScope);
+    
+    void clearCurrentlyExecuting();
+
+    bool contains(const LockHolder&, void* candidateCodeBlock);
+    Lock& getLock() { return m_lock; }
+
+    // Visits each CodeBlock in the heap until the visitor function returns true
+    // to indicate that it is done iterating, or until every CodeBlock has been
+    // visited.
+    template<typename Functor> void iterate(const Functor&);
+    
+    template<typename Functor> void iterateCurrentlyExecuting(const Functor&);
+    
+    void dump(PrintStream&) const;
+
+private:
+    void promoteYoungCodeBlocks(const LockHolder&);
+
+    HashSet<CodeBlock*> m_oldCodeBlocks;
+    HashSet<CodeBlock*> m_newCodeBlocks;
+    HashSet<CodeBlock*> m_currentlyExecuting;
+    Lock m_lock;
+};
+
+} // namespace JSC
diff --git a/heap/CodeBlockSetInlines.h b/heap/CodeBlockSetInlines.h
new file mode 100644
index 0000000..04dbcec
--- /dev/null
+++ b/heap/CodeBlockSetInlines.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "CodeBlockSet.h"
+
+namespace JSC {
+
+inline void CodeBlockSet::mark(const LockHolder& locker, void* candidateCodeBlock)
+{
+    ASSERT(m_lock.isLocked());
+    // We have to check for 0 and -1 because those are used by the HashMap as markers.
+    uintptr_t value = reinterpret_cast<uintptr_t>(candidateCodeBlock);
+    
+    // This checks for both of those nasty cases in one go.
+    // 0 + 1 = 1
+    // -1 + 1 = 0
+    if (value + 1 <= 1)
+        return;
+
+    CodeBlock* codeBlock = static_cast<CodeBlock*>(candidateCodeBlock); 
+    if (!m_oldCodeBlocks.contains(codeBlock) && !m_newCodeBlocks.contains(codeBlock))
+        return;
+
+    mark(locker, codeBlock);
+}
+
+inline void CodeBlockSet::mark(const LockHolder&, CodeBlock* codeBlock)
+{
+    if (!codeBlock)
+        return;
+
+    m_currentlyExecuting.add(codeBlock);
+}
+
+template<typename Functor>
+void CodeBlockSet::iterate(const Functor& functor)
+{
+    LockHolder locker(m_lock);
+    for (auto& codeBlock : m_oldCodeBlocks) {
+        bool done = functor(codeBlock);
+        if (done)
+            return;
+    }
+    
+    for (auto& codeBlock : m_newCodeBlocks) {
+        bool done = functor(codeBlock);
+        if (done)
+            return;
+    }
+}
+
+template<typename Functor>
+void CodeBlockSet::iterateCurrentlyExecuting(const Functor& functor)
+{
+    LockHolder locker(&m_lock);
+    for (CodeBlock* codeBlock : m_currentlyExecuting)
+        functor(codeBlock);
+}
+
+} // namespace JSC
+
diff --git a/heap/CollectionScope.cpp b/heap/CollectionScope.cpp
new file mode 100644
index 0000000..b2990e7
--- /dev/null
+++ b/heap/CollectionScope.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CollectionScope.h"
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+const char* collectionScopeName(CollectionScope scope)
+{
+    switch (scope) {
+    case CollectionScope::Eden:
+        return "Eden";
+    case CollectionScope::Full:
+        return "Full";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::CollectionScope scope)
+{
+    out.print(JSC::collectionScopeName(scope));
+}
+
+} // namespace WTF
+
diff --git a/heap/CollectionScope.h b/heap/CollectionScope.h
new file mode 100644
index 0000000..9b4f487
--- /dev/null
+++ b/heap/CollectionScope.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum class CollectionScope { Eden, Full };
+
+const char* collectionScopeName(CollectionScope);
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream& out, JSC::CollectionScope);
+
+} // namespace WTF
+
diff --git a/heap/ConservativeRoots.cpp b/heap/ConservativeRoots.cpp
new file mode 100644
index 0000000..554c9c2
--- /dev/null
+++ b/heap/ConservativeRoots.cpp
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ConservativeRoots.h"
+
+#include "CodeBlock.h"
+#include "CodeBlockSetInlines.h"
+#include "HeapInlines.h"
+#include "HeapUtil.h"
+#include "JITStubRoutineSet.h"
+#include "JSCell.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "MarkedBlockInlines.h"
+#include "Structure.h"
+#include <wtf/OSAllocator.h>
+
+namespace JSC {
+
+ConservativeRoots::ConservativeRoots(Heap& heap)
+    : m_roots(m_inlineRoots)
+    , m_size(0)
+    , m_capacity(inlineCapacity)
+    , m_heap(heap)
+{
+}
+
+ConservativeRoots::~ConservativeRoots()
+{
+    if (m_roots != m_inlineRoots)
+        OSAllocator::decommitAndRelease(m_roots, m_capacity * sizeof(HeapCell*));
+}
+
+void ConservativeRoots::grow()
+{
+    size_t newCapacity = m_capacity == inlineCapacity ? nonInlineCapacity : m_capacity * 2;
+    HeapCell** newRoots = static_cast<HeapCell**>(OSAllocator::reserveAndCommit(newCapacity * sizeof(HeapCell*)));
+    memcpy(newRoots, m_roots, m_size * sizeof(HeapCell*));
+    if (m_roots != m_inlineRoots)
+        OSAllocator::decommitAndRelease(m_roots, m_capacity * sizeof(HeapCell*));
+    m_capacity = newCapacity;
+    m_roots = newRoots;
+}
+
+template<typename MarkHook>
+inline void ConservativeRoots::genericAddPointer(void* p, HeapVersion markingVersion, TinyBloomFilter filter, MarkHook& markHook)
+{
+    markHook.mark(p);
+
+    HeapUtil::findGCObjectPointersForMarking(
+        m_heap, markingVersion, filter, p,
+        [&] (void* p) {
+            if (m_size == m_capacity)
+                grow();
+            
+            m_roots[m_size++] = bitwise_cast<HeapCell*>(p);
+        });
+}
+
+template<typename MarkHook>
+SUPPRESS_ASAN
+void ConservativeRoots::genericAddSpan(void* begin, void* end, MarkHook& markHook)
+{
+    if (begin > end) {
+        void* swapTemp = begin;
+        begin = end;
+        end = swapTemp;
+    }
+
+    RELEASE_ASSERT(isPointerAligned(begin));
+    RELEASE_ASSERT(isPointerAligned(end));
+
+    TinyBloomFilter filter = m_heap.objectSpace().blocks().filter(); // Make a local copy of filter to show the compiler it won't alias, and can be register-allocated.
+    HeapVersion markingVersion = m_heap.objectSpace().markingVersion();
+    for (char** it = static_cast<char**>(begin); it != static_cast<char**>(end); ++it)
+        genericAddPointer(*it, markingVersion, filter, markHook);
+}
+
+class DummyMarkHook {
+public:
+    void mark(void*) { }
+};
+
+void ConservativeRoots::add(void* begin, void* end)
+{
+    DummyMarkHook dummy;
+    genericAddSpan(begin, end, dummy);
+}
+
+void ConservativeRoots::add(void* begin, void* end, JITStubRoutineSet& jitStubRoutines)
+{
+    genericAddSpan(begin, end, jitStubRoutines);
+}
+
+class CompositeMarkHook {
+public:
+    CompositeMarkHook(JITStubRoutineSet& stubRoutines, CodeBlockSet& codeBlocks, const LockHolder& locker)
+        : m_stubRoutines(stubRoutines)
+        , m_codeBlocks(codeBlocks)
+        , m_codeBlocksLocker(locker)
+    {
+    }
+    
+    void mark(void* address)
+    {
+        m_stubRoutines.mark(address);
+        m_codeBlocks.mark(m_codeBlocksLocker, address);
+    }
+
+private:
+    JITStubRoutineSet& m_stubRoutines;
+    CodeBlockSet& m_codeBlocks;
+    const LockHolder& m_codeBlocksLocker;
+};
+
+void ConservativeRoots::add(
+    void* begin, void* end, JITStubRoutineSet& jitStubRoutines, CodeBlockSet& codeBlocks)
+{
+    LockHolder locker(codeBlocks.getLock());
+    CompositeMarkHook markHook(jitStubRoutines, codeBlocks, locker);
+    genericAddSpan(begin, end, markHook);
+}
+
+} // namespace JSC
diff --git a/heap/ConservativeRoots.h b/heap/ConservativeRoots.h
new file mode 100644
index 0000000..e46445b
--- /dev/null
+++ b/heap/ConservativeRoots.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Heap.h"
+
+namespace JSC {
+
+class CodeBlockSet;
+class HeapCell;
+class JITStubRoutineSet;
+
+class ConservativeRoots {
+public:
+    ConservativeRoots(Heap&);
+    ~ConservativeRoots();
+
+    void add(void* begin, void* end);
+    void add(void* begin, void* end, JITStubRoutineSet&);
+    void add(void* begin, void* end, JITStubRoutineSet&, CodeBlockSet&);
+    
+    size_t size();
+    HeapCell** roots();
+
+private:
+    static const size_t inlineCapacity = 128;
+    static const size_t nonInlineCapacity = 8192 / sizeof(HeapCell*);
+    
+    template<typename MarkHook>
+    void genericAddPointer(void*, HeapVersion, TinyBloomFilter, MarkHook&);
+
+    template<typename MarkHook>
+    void genericAddSpan(void*, void* end, MarkHook&);
+    
+    void grow();
+
+    HeapCell** m_roots;
+    size_t m_size;
+    size_t m_capacity;
+    Heap& m_heap;
+    HeapCell* m_inlineRoots[inlineCapacity];
+};
+
+inline size_t ConservativeRoots::size()
+{
+    return m_size;
+}
+
+inline HeapCell** ConservativeRoots::roots()
+{
+    return m_roots;
+}
+
+} // namespace JSC
diff --git a/heap/ConstraintVolatility.h b/heap/ConstraintVolatility.h
new file mode 100644
index 0000000..5cf986f
--- /dev/null
+++ b/heap/ConstraintVolatility.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum class ConstraintVolatility : uint8_t {
+    // The constraint needs to be validated, but it is unlikely to ever produce information.
+    // It's best to run it at the bitter end.
+    SeldomGreyed,
+    
+    // FIXME: We could introduce a new kind of volatility called GreyedByResumption, which
+    // would mean running all of the times that GreyedByExecution runs except as a root in a
+    // full GC.
+    // https://bugs.webkit.org/show_bug.cgi?id=166830
+    
+    // The constraint needs to be reevaluated anytime the mutator runs: so at GC start and
+    // whenever the GC resuspends after a resumption. This is almost always something that
+    // you'd call a "root" in a traditional GC.
+    GreyedByExecution,
+    
+    // The constraint needs to be reevaluated any time any object is marked and anytime the
+    // mutator resumes.
+    GreyedByMarking
+};
+    
+} // namespace JSC
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::ConstraintVolatility volatility)
+{
+    switch (volatility) {
+    case JSC::ConstraintVolatility::SeldomGreyed:
+        out.print("SeldomGreyed");
+        return;
+    case JSC::ConstraintVolatility::GreyedByExecution:
+        out.print("GreyedByExecuction");
+        return;
+    case JSC::ConstraintVolatility::GreyedByMarking:
+        out.print("GreyedByMarking");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/heap/DeferGC.cpp b/heap/DeferGC.cpp
new file mode 100644
index 0000000..dd66c63
--- /dev/null
+++ b/heap/DeferGC.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DeferGC.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+#ifndef NDEBUG
+WTF::ThreadSpecificKey DisallowGC::s_isGCDisallowedOnCurrentThread = 0;
+#endif
+
+} // namespace JSC
diff --git a/heap/DeferGC.h b/heap/DeferGC.h
new file mode 100644
index 0000000..2c0336e
--- /dev/null
+++ b/heap/DeferGC.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Heap.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/ThreadSpecific.h>
+
+namespace JSC {
+
+class DeferGC {
+    WTF_MAKE_NONCOPYABLE(DeferGC);
+public:
+    DeferGC(Heap& heap)
+        : m_heap(heap)
+    {
+        m_heap.incrementDeferralDepth();
+    }
+    
+    ~DeferGC()
+    {
+        m_heap.decrementDeferralDepthAndGCIfNeeded();
+    }
+
+private:
+    Heap& m_heap;
+};
+
+class DeferGCForAWhile {
+    WTF_MAKE_NONCOPYABLE(DeferGCForAWhile);
+public:
+    DeferGCForAWhile(Heap& heap)
+        : m_heap(heap)
+    {
+        m_heap.incrementDeferralDepth();
+    }
+    
+    ~DeferGCForAWhile()
+    {
+        m_heap.decrementDeferralDepth();
+    }
+
+private:
+    Heap& m_heap;
+};
+
+class DisallowGC {
+    WTF_MAKE_NONCOPYABLE(DisallowGC);
+public:
+    DisallowGC()
+    {
+#ifndef NDEBUG
+        WTF::threadSpecificSet(s_isGCDisallowedOnCurrentThread, reinterpret_cast<void*>(true));
+#endif
+    }
+
+    ~DisallowGC()
+    {
+#ifndef NDEBUG
+        WTF::threadSpecificSet(s_isGCDisallowedOnCurrentThread, reinterpret_cast<void*>(false));
+#endif
+    }
+
+    static bool isGCDisallowedOnCurrentThread()
+    {
+#ifndef NDEBUG
+        return !!WTF::threadSpecificGet(s_isGCDisallowedOnCurrentThread);
+#else
+        return false;
+#endif
+    }
+    static void initialize()
+    {
+#ifndef NDEBUG
+        WTF::threadSpecificKeyCreate(&s_isGCDisallowedOnCurrentThread, 0);
+#endif
+    }
+
+#ifndef NDEBUG
+    JS_EXPORT_PRIVATE static WTF::ThreadSpecificKey s_isGCDisallowedOnCurrentThread;
+#endif
+};
+
+} // namespace JSC
diff --git a/heap/DeleteAllCodeEffort.h b/heap/DeleteAllCodeEffort.h
new file mode 100644
index 0000000..cb854ae
--- /dev/null
+++ b/heap/DeleteAllCodeEffort.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum DeleteAllCodeEffort {
+    PreventCollectionAndDeleteAllCode,
+    DeleteAllCodeIfNotCollecting
+};
+
+} // namespace JSC
+
diff --git a/heap/DestructionMode.cpp b/heap/DestructionMode.cpp
new file mode 100644
index 0000000..bf7d93a
--- /dev/null
+++ b/heap/DestructionMode.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DestructionMode.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, DestructionMode mode)
+{
+    switch (mode) {
+    case NeedsDestruction:
+        out.print("NeedsDestruction");
+        return;
+    case DoesNotNeedDestruction:
+        out.print("DoesNotNeedDestruction");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/heap/DestructionMode.h b/heap/DestructionMode.h
new file mode 100644
index 0000000..08d21bc
--- /dev/null
+++ b/heap/DestructionMode.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum DestructionMode : int8_t {
+    DoesNotNeedDestruction,
+    NeedsDestruction
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::DestructionMode);
+
+} // namespace WTF
+
diff --git a/heap/EdenGCActivityCallback.cpp b/heap/EdenGCActivityCallback.cpp
new file mode 100644
index 0000000..41fb2e9
--- /dev/null
+++ b/heap/EdenGCActivityCallback.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EdenGCActivityCallback.h"
+
+#include "VM.h"
+
+namespace JSC {
+
+#if USE(CF) || USE(GLIB)
+
+EdenGCActivityCallback::EdenGCActivityCallback(Heap* heap)
+    : GCActivityCallback(heap)
+{
+}
+
+void EdenGCActivityCallback::doCollection()
+{
+    m_vm->heap.collectAsync(CollectionScope::Eden);
+}
+
+double EdenGCActivityCallback::lastGCLength()
+{
+    return m_vm->heap.lastEdenGCLength();
+}
+
+double EdenGCActivityCallback::deathRate()
+{
+    Heap* heap = &m_vm->heap;
+    size_t sizeBefore = heap->sizeBeforeLastEdenCollection();
+    size_t sizeAfter = heap->sizeAfterLastEdenCollection();
+    if (!sizeBefore)
+        return 1.0;
+    if (sizeAfter > sizeBefore) {
+        // GC caused the heap to grow(!)
+        // This could happen if the we visited more extra memory than was reported allocated.
+        // We don't return a negative death rate, since that would schedule the next GC in the past.
+        return 0;
+    }
+    return static_cast<double>(sizeBefore - sizeAfter) / static_cast<double>(sizeBefore);
+}
+
+double EdenGCActivityCallback::gcTimeSlice(size_t bytes)
+{
+    return std::min((static_cast<double>(bytes) / MB) * Options::percentCPUPerMBForEdenTimer(), Options::collectionTimerMaxPercentCPU());
+}
+
+#else
+
+EdenGCActivityCallback::EdenGCActivityCallback(Heap* heap)
+    : GCActivityCallback(heap->vm())
+{
+}
+
+void EdenGCActivityCallback::doCollection()
+{
+}
+
+double EdenGCActivityCallback::lastGCLength()
+{
+    return 0;
+}
+
+double EdenGCActivityCallback::deathRate()
+{
+    return 0;
+}
+
+double EdenGCActivityCallback::gcTimeSlice(size_t)
+{
+    return 0;
+}
+
+#endif // USE(CF) || USE(GLIB)
+
+} // namespace JSC
diff --git a/heap/EdenGCActivityCallback.h b/heap/EdenGCActivityCallback.h
new file mode 100644
index 0000000..cc4e93f
--- /dev/null
+++ b/heap/EdenGCActivityCallback.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GCActivityCallback.h"
+
+namespace JSC {
+
+class JS_EXPORT_PRIVATE EdenGCActivityCallback : public GCActivityCallback {
+public:
+    EdenGCActivityCallback(Heap*);
+
+    void doCollection() override;
+
+protected:
+    double lastGCLength() override;
+    double gcTimeSlice(size_t bytes) override;
+    double deathRate() override;
+};
+
+inline RefPtr<GCActivityCallback> GCActivityCallback::createEdenTimer(Heap* heap)
+{
+    return s_shouldCreateGCTimer ? adoptRef(new EdenGCActivityCallback(heap)) : nullptr;
+}
+
+} // namespace JSC
diff --git a/heap/FreeList.cpp b/heap/FreeList.cpp
new file mode 100644
index 0000000..43bc7ae
--- /dev/null
+++ b/heap/FreeList.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FreeList.h"
+
+namespace JSC {
+
+void FreeList::dump(PrintStream& out) const
+{
+    out.print("{head = ", RawPointer(head), ", payloadEnd = ", RawPointer(payloadEnd), ", remaining = ", remaining, ", originalSize = ", originalSize, "}");
+}
+
+} // namespace JSC
+
diff --git a/heap/FreeList.h b/heap/FreeList.h
new file mode 100644
index 0000000..842caa6
--- /dev/null
+++ b/heap/FreeList.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+struct FreeCell {
+    FreeCell* next;
+};
+        
+// This representation of a FreeList is convenient for the MarkedAllocator.
+
+struct FreeList {
+    FreeCell* head { nullptr };
+    char* payloadEnd { nullptr };
+    unsigned remaining { 0 };
+    unsigned originalSize { 0 };
+    
+    FreeList()
+    {
+    }
+    
+    static FreeList list(FreeCell* head, unsigned bytes)
+    {
+        FreeList result;
+        result.head = head;
+        result.remaining = 0;
+        result.originalSize = bytes;
+        return result;
+    }
+    
+    static FreeList bump(char* payloadEnd, unsigned remaining)
+    {
+        FreeList result;
+        result.payloadEnd = payloadEnd;
+        result.remaining = remaining;
+        result.originalSize = remaining;
+        return result;
+    }
+    
+    bool operator==(const FreeList& other) const
+    {
+        return head == other.head
+            && payloadEnd == other.payloadEnd
+            && remaining == other.remaining
+            && originalSize == other.originalSize;
+    }
+    
+    bool operator!=(const FreeList& other) const
+    {
+        return !(*this == other);
+    }
+    
+    explicit operator bool() const
+    {
+        return *this != FreeList();
+    }
+    
+    bool allocationWillFail() const { return !head && !remaining; }
+    bool allocationWillSucceed() const { return !allocationWillFail(); }
+    
+    void dump(PrintStream&) const;
+};
+
+} // namespace JSC
+
diff --git a/heap/FullGCActivityCallback.cpp b/heap/FullGCActivityCallback.cpp
new file mode 100644
index 0000000..3d1545f
--- /dev/null
+++ b/heap/FullGCActivityCallback.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FullGCActivityCallback.h"
+
+#include "VM.h"
+
+namespace JSC {
+
+#if USE(CF) || USE(GLIB)
+
+#if !PLATFORM(IOS)
+const double pagingTimeOut = 0.1; // Time in seconds to allow opportunistic timer to iterate over all blocks to see if the Heap is paged out.
+#endif
+
+FullGCActivityCallback::FullGCActivityCallback(Heap* heap)
+    : GCActivityCallback(heap)
+{
+}
+
+void FullGCActivityCallback::doCollection()
+{
+    Heap& heap = m_vm->heap;
+    m_didSyncGCRecently = false;
+
+#if !PLATFORM(IOS)
+    double startTime = WTF::monotonicallyIncreasingTime();
+    if (heap.isPagedOut(startTime + pagingTimeOut)) {
+        cancel();
+        heap.increaseLastFullGCLength(pagingTimeOut);
+        return;
+    }
+#endif
+
+    heap.collectAsync(CollectionScope::Full);
+}
+
+double FullGCActivityCallback::lastGCLength()
+{
+    return m_vm->heap.lastFullGCLength();
+}
+
+double FullGCActivityCallback::deathRate()
+{
+    Heap* heap = &m_vm->heap;
+    size_t sizeBefore = heap->sizeBeforeLastFullCollection();
+    size_t sizeAfter = heap->sizeAfterLastFullCollection();
+    if (!sizeBefore)
+        return 1.0;
+    if (sizeAfter > sizeBefore) {
+        // GC caused the heap to grow(!)
+        // This could happen if the we visited more extra memory than was reported allocated.
+        // We don't return a negative death rate, since that would schedule the next GC in the past.
+        return 0;
+    }
+    return static_cast<double>(sizeBefore - sizeAfter) / static_cast<double>(sizeBefore);
+}
+
+double FullGCActivityCallback::gcTimeSlice(size_t bytes)
+{
+    return std::min((static_cast<double>(bytes) / MB) * Options::percentCPUPerMBForFullTimer(), Options::collectionTimerMaxPercentCPU());
+}
+
+#else
+
+FullGCActivityCallback::FullGCActivityCallback(Heap* heap)
+    : GCActivityCallback(heap)
+{
+}
+
+void FullGCActivityCallback::doCollection()
+{
+}
+
+double FullGCActivityCallback::lastGCLength()
+{
+    return 0;
+}
+
+double FullGCActivityCallback::deathRate()
+{
+    return 0;
+}
+
+double FullGCActivityCallback::gcTimeSlice(size_t)
+{
+    return 0;
+}
+
+#endif // USE(CF) || USE(GLIB)
+
+} // namespace JSC
diff --git a/heap/FullGCActivityCallback.h b/heap/FullGCActivityCallback.h
new file mode 100644
index 0000000..5106ee7
--- /dev/null
+++ b/heap/FullGCActivityCallback.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GCActivityCallback.h"
+
+namespace JSC {
+
+class JS_EXPORT_PRIVATE FullGCActivityCallback : public GCActivityCallback {
+public:
+    FullGCActivityCallback(Heap*);
+
+    void doCollection() override;
+
+    bool didSyncGCRecently() const { return m_didSyncGCRecently; }
+    void setDidSyncGCRecently() { m_didSyncGCRecently = true; }
+
+protected:
+    double lastGCLength() override;
+    double gcTimeSlice(size_t bytes) override;
+    double deathRate() override;
+
+    bool m_didSyncGCRecently { false };
+};
+
+inline RefPtr<FullGCActivityCallback> GCActivityCallback::createFullTimer(Heap* heap)
+{
+    return s_shouldCreateGCTimer ? adoptRef(new FullGCActivityCallback(heap)) : nullptr;
+}
+
+} // namespace JSC
diff --git a/heap/GCActivityCallback.cpp b/heap/GCActivityCallback.cpp
new file mode 100644
index 0000000..e55dc6e
--- /dev/null
+++ b/heap/GCActivityCallback.cpp
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2010-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GCActivityCallback.h"
+
+#include "HeapInlines.h"
+#include "JSLock.h"
+#include "JSObject.h"
+#include "VM.h"
+
+#if PLATFORM(EFL)
+#include <wtf/MainThread.h>
+#elif USE(GLIB)
+#include <glib.h>
+#endif
+
+namespace JSC {
+
+bool GCActivityCallback::s_shouldCreateGCTimer = true;
+
+#if USE(CF) || USE(GLIB)
+
+const double timerSlop = 2.0; // Fudge factor to avoid performance cost of resetting timer.
+
+#if USE(CF)
+GCActivityCallback::GCActivityCallback(Heap* heap)
+    : GCActivityCallback(heap->vm())
+{
+}
+#elif PLATFORM(EFL)
+GCActivityCallback::GCActivityCallback(Heap* heap)
+    : GCActivityCallback(heap->vm(), WTF::isMainThread())
+{
+}
+#elif USE(GLIB)
+GCActivityCallback::GCActivityCallback(Heap* heap)
+    : GCActivityCallback(heap->vm())
+{
+}
+#endif
+
+void GCActivityCallback::doWork()
+{
+    Heap* heap = &m_vm->heap;
+    if (!isEnabled())
+        return;
+    
+    JSLockHolder locker(m_vm);
+    if (heap->isDeferred()) {
+        scheduleTimer(0);
+        return;
+    }
+
+    doCollection();
+}
+
+#if USE(CF)
+void GCActivityCallback::scheduleTimer(double newDelay)
+{
+    if (newDelay * timerSlop > m_delay)
+        return;
+    double delta = m_delay - newDelay;
+    m_delay = newDelay;
+    m_nextFireTime = WTF::currentTime() + newDelay;
+    CFRunLoopTimerSetNextFireDate(m_timer.get(), CFRunLoopTimerGetNextFireDate(m_timer.get()) - delta);
+}
+
+void GCActivityCallback::cancelTimer()
+{
+    m_delay = s_decade;
+    m_nextFireTime = 0;
+    CFRunLoopTimerSetNextFireDate(m_timer.get(), CFAbsoluteTimeGetCurrent() + s_decade);
+}
+#elif PLATFORM(EFL)
+void GCActivityCallback::scheduleTimer(double newDelay)
+{
+    if (newDelay * timerSlop > m_delay)
+        return;
+
+    stop();
+    m_delay = newDelay;
+    
+    ASSERT(!m_timer);
+    m_timer = add(newDelay, this);
+}
+
+void GCActivityCallback::cancelTimer()
+{
+    m_delay = s_hour;
+    stop();
+}
+#elif USE(GLIB)
+void GCActivityCallback::scheduleTimer(double newDelay)
+{
+    ASSERT(newDelay >= 0);
+    if (m_delay != -1 && newDelay * timerSlop > m_delay)
+        return;
+
+    m_delay = newDelay;
+    if (!m_delay) {
+        g_source_set_ready_time(m_timer.get(), 0);
+        return;
+    }
+
+    auto delayDuration = std::chrono::duration<double>(m_delay);
+    auto safeDelayDuration = std::chrono::microseconds::max();
+    if (delayDuration < safeDelayDuration)
+        safeDelayDuration = std::chrono::duration_cast<std::chrono::microseconds>(delayDuration);
+    gint64 currentTime = g_get_monotonic_time();
+    gint64 targetTime = currentTime + std::min<gint64>(G_MAXINT64 - currentTime, safeDelayDuration.count());
+    ASSERT(targetTime >= currentTime);
+    g_source_set_ready_time(m_timer.get(), targetTime);
+}
+
+void GCActivityCallback::cancelTimer()
+{
+    m_delay = -1;
+    g_source_set_ready_time(m_timer.get(), -1);
+}
+#endif
+
+void GCActivityCallback::didAllocate(size_t bytes)
+{
+#if PLATFORM(EFL)
+    if (!isEnabled())
+        return;
+
+    ASSERT(WTF::isMainThread());
+#endif
+
+    // The first byte allocated in an allocation cycle will report 0 bytes to didAllocate. 
+    // We pretend it's one byte so that we don't ignore this allocation entirely.
+    if (!bytes)
+        bytes = 1;
+    double bytesExpectedToReclaim = static_cast<double>(bytes) * deathRate();
+    double newDelay = lastGCLength() / gcTimeSlice(bytesExpectedToReclaim);
+    scheduleTimer(newDelay);
+}
+
+void GCActivityCallback::willCollect()
+{
+    cancelTimer();
+}
+
+void GCActivityCallback::cancel()
+{
+    cancelTimer();
+}
+
+#else
+
+GCActivityCallback::GCActivityCallback(Heap* heap)
+    : GCActivityCallback(heap->vm())
+{
+}
+
+void GCActivityCallback::doWork()
+{
+}
+
+void GCActivityCallback::didAllocate(size_t)
+{
+}
+
+void GCActivityCallback::willCollect()
+{
+}
+
+void GCActivityCallback::cancel()
+{
+}
+
+#endif
+
+}
+
diff --git a/heap/GCActivityCallback.h b/heap/GCActivityCallback.h
new file mode 100644
index 0000000..ec988c8
--- /dev/null
+++ b/heap/GCActivityCallback.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2010, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "HeapTimer.h"
+#include <wtf/RefPtr.h>
+
+#if USE(CF)
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
+namespace JSC {
+
+class FullGCActivityCallback;
+class Heap;
+
+class JS_EXPORT_PRIVATE GCActivityCallback : public HeapTimer {
+public:
+    static RefPtr<FullGCActivityCallback> createFullTimer(Heap*);
+    static RefPtr<GCActivityCallback> createEdenTimer(Heap*);
+
+    GCActivityCallback(Heap*);
+
+    void doWork() override;
+
+    virtual void doCollection() = 0;
+
+    virtual void didAllocate(size_t);
+    virtual void willCollect();
+    virtual void cancel();
+    bool isEnabled() const { return m_enabled; }
+    void setEnabled(bool enabled) { m_enabled = enabled; }
+
+    static bool s_shouldCreateGCTimer;
+
+#if USE(CF) || PLATFORM(EFL)
+    double nextFireTime() const { return m_nextFireTime; }
+#endif
+
+protected:
+    virtual double lastGCLength() = 0;
+    virtual double gcTimeSlice(size_t bytes) = 0;
+    virtual double deathRate() = 0;
+
+#if USE(CF)
+    GCActivityCallback(VM* vm)
+        : HeapTimer(vm)
+        , m_enabled(true)
+        , m_delay(s_decade)
+    {
+    }
+#elif PLATFORM(EFL)
+    static constexpr double s_hour = 3600;
+    GCActivityCallback(VM* vm, bool flag)
+        : HeapTimer(vm)
+        , m_enabled(flag)
+        , m_delay(s_hour)
+    {
+    }
+#elif USE(GLIB)
+    GCActivityCallback(VM* vm)
+        : HeapTimer(vm)
+        , m_enabled(true)
+        , m_delay(-1)
+    {
+    }
+#else
+    GCActivityCallback(VM* vm)
+        : HeapTimer(vm)
+        , m_enabled(true)
+    {
+    }
+#endif
+
+    bool m_enabled;
+
+#if USE(CF) || USE(GLIB)
+protected:
+    void cancelTimer();
+    void scheduleTimer(double);
+
+private:
+    double m_delay;
+    double m_nextFireTime { 0 };
+#endif
+};
+
+} // namespace JSC
diff --git a/heap/GCAssertions.h b/heap/GCAssertions.h
new file mode 100644
index 0000000..4af12c0
--- /dev/null
+++ b/heap/GCAssertions.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <type_traits>
+#include <wtf/Assertions.h>
+
+#if ENABLE(GC_VALIDATION)
+#define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { \
+    RELEASE_ASSERT(cell);\
+    RELEASE_ASSERT(cell->structure()->structure() == cell->structure()->structure()->structure()); \
+} while (0)
+
+#define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do {\
+    ASSERT_GC_OBJECT_LOOKS_VALID(object); \
+    RELEASE_ASSERT(object->inherits(classInfo)); \
+} while (0)
+
+// Used to avoid triggering -Wundefined-bool-conversion.
+#define ASSERT_THIS_GC_OBJECT_LOOKS_VALID() do { \
+    RELEASE_ASSERT(this->structure()->structure() == this->structure()->structure()->structure()); \
+} while (0)
+
+#define ASSERT_THIS_GC_OBJECT_INHERITS(classInfo) do {\
+    ASSERT_THIS_GC_OBJECT_LOOKS_VALID(); \
+    RELEASE_ASSERT(this->inherits(classInfo)); \
+} while (0)
+
+#else
+#define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { (void)cell; } while (0)
+#define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do { (void)object; (void)classInfo; } while (0)
+#define ASSERT_THIS_GC_OBJECT_LOOKS_VALID()
+#define ASSERT_THIS_GC_OBJECT_INHERITS(classInfo) do { (void)classInfo; } while (0)
+#endif
+
+#define STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(klass) static_assert(std::is_trivially_destructible<klass>::value, #klass " must have a trivial destructor")
diff --git a/heap/GCDeferralContext.h b/heap/GCDeferralContext.h
new file mode 100644
index 0000000..b4d151e
--- /dev/null
+++ b/heap/GCDeferralContext.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+class Heap;
+class MarkedAllocator;
+
+class GCDeferralContext {
+    friend class Heap;
+    friend class MarkedAllocator;
+public:
+    inline GCDeferralContext(Heap&);
+    inline ~GCDeferralContext();
+
+private:
+    Heap& m_heap;
+    bool m_shouldGC { false };
+};
+
+} // namespace JSC
+
diff --git a/heap/GCDeferralContextInlines.h b/heap/GCDeferralContextInlines.h
new file mode 100644
index 0000000..cd8c1e7
--- /dev/null
+++ b/heap/GCDeferralContextInlines.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GCDeferralContext.h"
+#include "Heap.h"
+
+namespace JSC {
+
+ALWAYS_INLINE GCDeferralContext::GCDeferralContext(Heap& heap)
+    : m_heap(heap)
+{
+}
+
+ALWAYS_INLINE GCDeferralContext::~GCDeferralContext()
+{
+    ASSERT(!DisallowGC::isGCDisallowedOnCurrentThread());
+#if ENABLE(GC_VALIDATION)
+    ASSERT(!m_heap.vm()->isInitializingObject());
+#endif
+    if (UNLIKELY(m_shouldGC))
+        m_heap.collectIfNecessaryOrDefer();
+}
+
+} // namespace JSC
+
diff --git a/heap/GCIncomingRefCounted.h b/heap/GCIncomingRefCounted.h
new file mode 100644
index 0000000..6c8b73e
--- /dev/null
+++ b/heap/GCIncomingRefCounted.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/DeferrableRefCounted.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JSCell;
+
+// A C-heap-allocated object that may have additional reference counts
+// due to incoming references from the heap, which are tracked in
+// reverse: the object knows its incoming references. Such objects also
+// have the invariant that they don't have references back into the GC
+// heap.
+
+template<typename T>
+class GCIncomingRefCounted : public DeferrableRefCounted<T> {
+public:
+    GCIncomingRefCounted()
+        : m_encodedPointer(0)
+    {
+    }
+    
+    ~GCIncomingRefCounted()
+    {
+        if (hasVectorOfCells())
+            delete vectorOfCells();
+    }
+    
+    size_t numberOfIncomingReferences() const
+    {
+        if (!hasAnyIncoming())
+            return 0;
+        if (hasSingleton())
+            return 1;
+        return vectorOfCells()->size();
+    }
+    
+    JSCell* incomingReferenceAt(size_t index) const
+    {
+        ASSERT(hasAnyIncoming());
+        if (hasSingleton()) {
+            ASSERT(!index);
+            return singleton();
+        }
+        return vectorOfCells()->at(index);
+    }
+    
+    // It's generally not a good idea to call this directly, since if this
+    // returns true, you're supposed to add this object to the GC's list.
+    // Call GCIncomingRefCountedSet::addReference() instead.
+    bool addIncomingReference(JSCell*);
+    
+    // A filter function returns true if we wish to keep the incoming
+    // reference, and false if we don't. This may delete the object,
+    // and if it does so, this returns true. In general, you don't want
+    // to use this with a filter function that can return false unless
+    // you're also walking the GC's list.
+    template<typename FilterFunctionType>
+    bool filterIncomingReferences(FilterFunctionType&);
+    
+private:
+    static uintptr_t singletonFlag() { return 1; }
+    
+    bool hasVectorOfCells() const { return !(m_encodedPointer & singletonFlag()); }
+    bool hasAnyIncoming() const { return !!m_encodedPointer; }
+    bool hasSingleton() const { return hasAnyIncoming() && !hasVectorOfCells(); }
+    
+    JSCell* singleton() const
+    {
+        ASSERT(hasSingleton());
+        return bitwise_cast<JSCell*>(m_encodedPointer & ~singletonFlag());
+    }
+    
+    Vector<JSCell*>* vectorOfCells() const
+    {
+        ASSERT(hasVectorOfCells());
+        return bitwise_cast<Vector<JSCell*>*>(m_encodedPointer);
+    }
+    
+    // Singleton flag is set: this is a JSCell*.
+    // Singleton flag not set: this is a pointer to a vector of cells.
+    uintptr_t m_encodedPointer;
+};
+
+} // namespace JSC
diff --git a/heap/GCIncomingRefCountedInlines.h b/heap/GCIncomingRefCountedInlines.h
new file mode 100644
index 0000000..a1a91e2
--- /dev/null
+++ b/heap/GCIncomingRefCountedInlines.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GCIncomingRefCounted.h"
+#include "Heap.h"
+
+namespace JSC {
+
+template<typename T>
+bool GCIncomingRefCounted<T>::addIncomingReference(JSCell* cell)
+{
+    if (!hasAnyIncoming()) {
+        m_encodedPointer = bitwise_cast<uintptr_t>(cell) | singletonFlag();
+        this->setIsDeferred(true);
+        ASSERT(hasSingleton());
+        return true;
+    }
+    
+    ASSERT(Heap::heap(incomingReferenceAt(0)) == Heap::heap(cell));
+    
+    if (hasSingleton()) {
+        Vector<JSCell*>* vector = new Vector<JSCell*>();
+        vector->append(singleton());
+        vector->append(cell);
+        m_encodedPointer = bitwise_cast<uintptr_t>(vector);
+        ASSERT(hasVectorOfCells());
+        return false;
+    }
+    
+    vectorOfCells()->append(cell);
+    return false;
+}
+
+template<typename T>
+template<typename FilterFunctionType>
+bool GCIncomingRefCounted<T>::filterIncomingReferences(FilterFunctionType& filterFunction)
+{
+    const bool verbose = false;
+    
+    if (verbose)
+        dataLog("Filtering incoming references.\n");
+    
+    if (!hasAnyIncoming()) {
+        ASSERT(!this->isDeferred());
+        ASSERT(this->refCount());
+        if (verbose)
+            dataLog("    Has no incoming.\n");
+        return false;
+    }
+    
+    ASSERT(this->isDeferred());
+    
+    if (hasSingleton()) {
+        if (filterFunction(singleton())) {
+            if (verbose)
+                dataLog("   Singleton passed.\n");
+            return false;
+        }
+        
+        if (verbose)
+            dataLog("   Removing singleton.\n");
+        m_encodedPointer = 0;
+        ASSERT(!hasAnyIncoming());
+        this->setIsDeferred(false);
+        return true;
+    }
+    
+    if (verbose)
+        dataLog("   Has ", vectorOfCells()->size(), " entries.\n");
+    for (size_t i = 0; i < vectorOfCells()->size(); ++i) {
+        if (filterFunction(vectorOfCells()->at(i)))
+            continue;
+        vectorOfCells()->at(i--) = vectorOfCells()->last();
+        vectorOfCells()->removeLast();
+    }
+    
+    if (vectorOfCells()->size() >= 2) {
+        if (verbose)
+            dataLog("   Still has ", vectorOfCells()->size(), " entries.\n");
+        return false;
+    }
+    
+    if (vectorOfCells()->isEmpty()) {
+        if (verbose)
+            dataLog("   Removing.\n");
+        delete vectorOfCells();
+        m_encodedPointer = 0;
+        ASSERT(!hasAnyIncoming());
+        this->setIsDeferred(false);
+        return true;
+    }
+    
+    if (verbose)
+        dataLog("   Shrinking to singleton.\n");
+    JSCell* singleton = vectorOfCells()->at(0);
+    delete vectorOfCells();
+    m_encodedPointer = bitwise_cast<uintptr_t>(singleton) | singletonFlag();
+    ASSERT(hasSingleton());
+    return false;
+}
+
+} // namespace JSC
diff --git a/heap/GCIncomingRefCountedSet.h b/heap/GCIncomingRefCountedSet.h
new file mode 100644
index 0000000..0b43519
--- /dev/null
+++ b/heap/GCIncomingRefCountedSet.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GCIncomingRefCounted.h"
+
+namespace JSC {
+
+// T = some subtype of GCIncomingRefCounted, must support a gcSizeEstimateInBytes()
+// method.
+template<typename T>
+class GCIncomingRefCountedSet {
+public:
+    GCIncomingRefCountedSet();
+
+    void lastChanceToFinalize();
+
+    // Returns true if the native object is new to this set.
+    bool addReference(JSCell*, T*);
+    
+    void sweep();
+    
+    size_t size() const { return m_bytes; };
+    
+private:
+    static bool removeAll(JSCell*);
+    static bool removeDead(JSCell*);
+    
+    Vector<T*> m_vector;
+    size_t m_bytes;
+};
+
+} // namespace JSC
diff --git a/heap/GCIncomingRefCountedSetInlines.h b/heap/GCIncomingRefCountedSetInlines.h
new file mode 100644
index 0000000..b10972d
--- /dev/null
+++ b/heap/GCIncomingRefCountedSetInlines.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GCIncomingRefCountedSet.h"
+#include "VM.h"
+
+namespace JSC {
+
+template<typename T>
+GCIncomingRefCountedSet<T>::GCIncomingRefCountedSet()
+    : m_bytes(0)
+{
+}
+
+template<typename T>
+void GCIncomingRefCountedSet<T>::lastChanceToFinalize()
+{
+    for (size_t i = m_vector.size(); i--;)
+        m_vector[i]->filterIncomingReferences(removeAll);
+}
+
+template<typename T>
+bool GCIncomingRefCountedSet<T>::addReference(JSCell* cell, T* object)
+{
+    if (!object->addIncomingReference(cell)) {
+        ASSERT(object->isDeferred());
+        ASSERT(object->numberOfIncomingReferences());
+        return false;
+    }
+    m_vector.append(object);
+    m_bytes += object->gcSizeEstimateInBytes();
+    ASSERT(object->isDeferred());
+    ASSERT(object->numberOfIncomingReferences());
+    return true;
+}
+
+template<typename T>
+void GCIncomingRefCountedSet<T>::sweep()
+{
+    for (size_t i = 0; i < m_vector.size(); ++i) {
+        T* object = m_vector[i];
+        size_t size = object->gcSizeEstimateInBytes();
+        ASSERT(object->isDeferred());
+        ASSERT(object->numberOfIncomingReferences());
+        if (!object->filterIncomingReferences(removeDead))
+            continue;
+        m_bytes -= size;
+        m_vector[i--] = m_vector.last();
+        m_vector.removeLast();
+    }
+}
+
+template<typename T>
+bool GCIncomingRefCountedSet<T>::removeAll(JSCell*)
+{
+    return false;
+}
+
+template<typename T>
+bool GCIncomingRefCountedSet<T>::removeDead(JSCell* cell)
+{
+    return Heap::isMarked(cell);
+}
+
+} // namespace JSC
diff --git a/heap/GCLogging.cpp b/heap/GCLogging.cpp
new file mode 100644
index 0000000..688de60
--- /dev/null
+++ b/heap/GCLogging.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GCLogging.h"
+
+#include "ClassInfo.h"
+#include "Heap.h"
+#include "HeapIterationScope.h"
+#include "JSCell.h"
+#include "JSCellInlines.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+const char* GCLogging::levelAsString(Level level)
+{
+    switch (level) {
+    case None:
+        return "None";
+    case Basic:
+        return "Basic";
+    case Verbose:
+        return "Verbose";
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return "";
+    }
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::GCLogging::Level level)
+{
+    switch (level) {
+    case JSC::GCLogging::Level::None:
+        out.print("None");
+        return;
+    case JSC::GCLogging::Level::Basic:
+        out.print("Basic");
+        return;
+    case JSC::GCLogging::Level::Verbose:
+        out.print("Verbose");
+        return;
+    default:
+        out.print("Level=", level - JSC::GCLogging::Level::None);
+        return;
+    }
+}
+
+} // namespace WTF
+
diff --git a/heap/GCLogging.h b/heap/GCLogging.h
new file mode 100644
index 0000000..712addc
--- /dev/null
+++ b/heap/GCLogging.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+class Heap;
+
+class GCLogging {
+public:
+    enum Level : uint8_t {
+        None = 0,
+        Basic,
+        Verbose
+    };
+
+    static const char* levelAsString(Level);
+    static void dumpObjectGraph(Heap*);
+};
+
+typedef GCLogging::Level gcLogLevel;
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::GCLogging::Level);
+
+} // namespace WTF
diff --git a/heap/GCSegmentedArray.h b/heap/GCSegmentedArray.h
new file mode 100644
index 0000000..176c084
--- /dev/null
+++ b/heap/GCSegmentedArray.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/ListDump.h>
+#include <wtf/PrintStream.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+template <typename T>
+class GCArraySegment : public DoublyLinkedListNode<GCArraySegment<T>> {
+    friend class WTF::DoublyLinkedListNode<GCArraySegment<T>>;
+public:
+    GCArraySegment()
+        : DoublyLinkedListNode<GCArraySegment<T>>()
+#if !ASSERT_DISABLED
+        , m_top(0)
+#endif
+    {
+    }
+
+    static GCArraySegment* create();
+    static void destroy(GCArraySegment*);
+
+    T* data()
+    {
+        return bitwise_cast<T*>(this + 1);
+    }
+
+    static const size_t blockSize = 4 * KB;
+
+    GCArraySegment* m_prev;
+    GCArraySegment* m_next;
+#if !ASSERT_DISABLED
+    size_t m_top;
+#endif
+};
+
+template <typename T> class GCSegmentedArrayIterator;
+
+template <typename T>
+class GCSegmentedArray {
+    friend class GCSegmentedArrayIterator<T>;
+    friend class GCSegmentedArrayIterator<const T>;
+public:
+    GCSegmentedArray();
+    ~GCSegmentedArray();
+
+    void append(T);
+
+    bool canRemoveLast();
+    const T removeLast();
+    bool refill();
+    
+    size_t size();
+    bool isEmpty();
+
+    void fillVector(Vector<T>&);
+    void clear();
+
+    typedef GCSegmentedArrayIterator<T> iterator;
+    iterator begin() const { return GCSegmentedArrayIterator<T>(m_segments.head(), m_top); }
+    iterator end() const { return GCSegmentedArrayIterator<T>(); }
+
+protected:
+    template <size_t size> struct CapacityFromSize {
+        static const size_t value = (size - sizeof(GCArraySegment<T>)) / sizeof(T);
+    };
+
+    void expand();
+    
+    size_t postIncTop();
+    size_t preDecTop();
+    void setTopForFullSegment();
+    void setTopForEmptySegment();
+    size_t top();
+    
+    void validatePrevious();
+
+    DoublyLinkedList<GCArraySegment<T>> m_segments;
+
+    JS_EXPORT_PRIVATE static const size_t s_segmentCapacity = CapacityFromSize<GCArraySegment<T>::blockSize>::value;
+    size_t m_top;
+    size_t m_numberOfSegments;
+};
+
+template <typename T>
+class GCSegmentedArrayIterator {
+    friend class GCSegmentedArray<T>;
+public:
+    GCSegmentedArrayIterator()
+        : m_currentSegment(0)
+        , m_currentOffset(0)
+    {
+    }
+
+    T& get() { return m_currentSegment->data()[m_currentOffset]; }
+    T& operator*() { return get(); }
+    T& operator->() { return get(); }
+
+    bool operator==(const GCSegmentedArrayIterator& other)
+    {
+        return m_currentSegment == other.m_currentSegment && m_currentOffset == other.m_currentOffset;
+    }
+
+    bool operator!=(const GCSegmentedArrayIterator& other)
+    {
+        return !(*this == other);
+    }
+
+    GCSegmentedArrayIterator& operator++()
+    {
+        ASSERT(m_currentSegment);
+
+        m_currentOffset++;
+
+        if (m_currentOffset >= m_offsetLimit) {
+            m_currentSegment = m_currentSegment->next();
+            m_currentOffset = 0;
+            m_offsetLimit = GCSegmentedArray<T>::s_segmentCapacity;
+        }
+
+        return *this;
+    }
+
+private:
+    GCSegmentedArrayIterator(GCArraySegment<T>* start, size_t top)
+        : m_currentSegment(start)
+        , m_currentOffset(0)
+        , m_offsetLimit(top)
+    {
+        if (!m_offsetLimit)
+            m_currentSegment = nullptr;
+    }
+
+    GCArraySegment<T>* m_currentSegment;
+    size_t m_currentOffset;
+    size_t m_offsetLimit;
+};
+
+} // namespace JSC
+
diff --git a/heap/GCSegmentedArrayInlines.h b/heap/GCSegmentedArrayInlines.h
new file mode 100644
index 0000000..19aca9b
--- /dev/null
+++ b/heap/GCSegmentedArrayInlines.h
@@ -0,0 +1,227 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GCSegmentedArray.h"
+
+namespace JSC {
+
+template <typename T>
+GCSegmentedArray<T>::GCSegmentedArray()
+    : m_top(0)
+    , m_numberOfSegments(0)
+{
+    m_segments.push(GCArraySegment<T>::create());
+    m_numberOfSegments++;
+}
+
+template <typename T>
+GCSegmentedArray<T>::~GCSegmentedArray()
+{
+    ASSERT(m_numberOfSegments == 1);
+    ASSERT(m_segments.size() == 1);
+    GCArraySegment<T>::destroy(m_segments.removeHead());
+    m_numberOfSegments--;
+    ASSERT(!m_numberOfSegments);
+    ASSERT(!m_segments.size());
+}
+
+template <typename T>
+void GCSegmentedArray<T>::clear()
+{
+    if (!m_segments.head())
+        return;
+    GCArraySegment<T>* next;
+    for (GCArraySegment<T>* current = m_segments.head(); current->next(); current = next) {
+        next = current->next();
+        m_segments.remove(current);
+        GCArraySegment<T>::destroy(current);
+    }
+    m_top = 0;
+    m_numberOfSegments = 1;
+#if !ASSERT_DISABLED
+    m_segments.head()->m_top = 0;
+#endif
+}
+
+template <typename T>
+void GCSegmentedArray<T>::expand()
+{
+    ASSERT(m_segments.head()->m_top == s_segmentCapacity);
+    
+    GCArraySegment<T>* nextSegment = GCArraySegment<T>::create();
+    m_numberOfSegments++;
+    
+#if !ASSERT_DISABLED
+    nextSegment->m_top = 0;
+#endif
+
+    m_segments.push(nextSegment);
+    setTopForEmptySegment();
+    validatePrevious();
+}
+
+template <typename T>
+bool GCSegmentedArray<T>::refill()
+{
+    validatePrevious();
+    if (top())
+        return true;
+    GCArraySegment<T>::destroy(m_segments.removeHead());
+    ASSERT(m_numberOfSegments > 1);
+    m_numberOfSegments--;
+    setTopForFullSegment();
+    validatePrevious();
+    return true;
+}
+
+template <typename T>
+void GCSegmentedArray<T>::fillVector(Vector<T>& vector)
+{
+    ASSERT(vector.size() == size());
+
+    GCArraySegment<T>* currentSegment = m_segments.head();
+    if (!currentSegment)
+        return;
+
+    unsigned count = 0;
+    for (unsigned i = 0; i < m_top; ++i) {
+        ASSERT(currentSegment->data()[i]);
+        vector[count++] = currentSegment->data()[i];
+    }
+
+    currentSegment = currentSegment->next();
+    while (currentSegment) {
+        for (unsigned i = 0; i < s_segmentCapacity; ++i) {
+            ASSERT(currentSegment->data()[i]);
+            vector[count++] = currentSegment->data()[i];
+        }
+        currentSegment = currentSegment->next();
+    }
+}
+
+template <typename T>
+inline GCArraySegment<T>* GCArraySegment<T>::create()
+{
+    return new (NotNull, fastMalloc(blockSize)) GCArraySegment<T>();
+}
+
+template <typename T>
+inline void GCArraySegment<T>::destroy(GCArraySegment* segment)
+{
+    segment->~GCArraySegment();
+    fastFree(segment);
+}
+
+template <typename T>
+inline size_t GCSegmentedArray<T>::postIncTop()
+{
+    size_t result = m_top++;
+    ASSERT(result == m_segments.head()->m_top++);
+    return result;
+}
+
+template <typename T>
+inline size_t GCSegmentedArray<T>::preDecTop()
+{
+    size_t result = --m_top;
+    ASSERT(result == --m_segments.head()->m_top);
+    return result;
+}
+
+template <typename T>
+inline void GCSegmentedArray<T>::setTopForFullSegment()
+{
+    ASSERT(m_segments.head()->m_top == s_segmentCapacity);
+    m_top = s_segmentCapacity;
+}
+
+template <typename T>
+inline void GCSegmentedArray<T>::setTopForEmptySegment()
+{
+    ASSERT(!m_segments.head()->m_top);
+    m_top = 0;
+}
+
+template <typename T>
+inline size_t GCSegmentedArray<T>::top()
+{
+    ASSERT(m_top == m_segments.head()->m_top);
+    return m_top;
+}
+
+template <typename T>
+#if ASSERT_DISABLED
+inline void GCSegmentedArray<T>::validatePrevious() { }
+#else
+inline void GCSegmentedArray<T>::validatePrevious()
+{
+    unsigned count = 0;
+    for (GCArraySegment<T>* current = m_segments.head(); current; current = current->next())
+        count++;
+    ASSERT(m_segments.size() == m_numberOfSegments);
+}
+#endif
+
+template <typename T>
+inline void GCSegmentedArray<T>::append(T value)
+{
+    if (m_top == s_segmentCapacity)
+        expand();
+    m_segments.head()->data()[postIncTop()] = value;
+}
+
+template <typename T>
+inline bool GCSegmentedArray<T>::canRemoveLast()
+{
+    return !!m_top;
+}
+
+template <typename T>
+inline const T GCSegmentedArray<T>::removeLast()
+{
+    return m_segments.head()->data()[preDecTop()];
+}
+
+template <typename T>
+inline bool GCSegmentedArray<T>::isEmpty()
+{
+    if (m_top)
+        return false;
+    if (m_segments.head()->next()) {
+        ASSERT(m_segments.head()->next()->m_top == s_segmentCapacity);
+        return false;
+    }
+    return true;
+}
+
+template <typename T>
+inline size_t GCSegmentedArray<T>::size()
+{
+    return m_top + s_segmentCapacity * (m_numberOfSegments - 1);
+}
+
+} // namespace JSC
diff --git a/heap/GCTypeMap.h b/heap/GCTypeMap.h
new file mode 100644
index 0000000..9e19e67
--- /dev/null
+++ b/heap/GCTypeMap.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CollectionScope.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+template<typename T>
+struct GCTypeMap {
+    T eden;
+    T full;
+    
+    T& operator[](CollectionScope scope)
+    {
+        switch (scope) {
+        case CollectionScope::Full:
+            return full;
+        case CollectionScope::Eden:
+            return eden;
+        }
+        ASSERT_NOT_REACHED();
+        return full;
+    }
+    
+    const T& operator[](CollectionScope scope) const
+    {
+        switch (scope) {
+        case CollectionScope::Full:
+            return full;
+        case CollectionScope::Eden:
+            return eden;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return full;
+    }
+};
+
+} // namespace JSC
+
diff --git a/heap/Handle.h b/heap/Handle.h
new file mode 100644
index 0000000..ba4161c
--- /dev/null
+++ b/heap/Handle.h
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "HandleTypes.h"
+
+namespace JSC {
+
+/*
+    A Handle is a smart pointer that updates automatically when the garbage
+    collector moves the object to which it points.
+
+    The base Handle class represents a temporary reference to a pointer whose
+    lifetime is guaranteed by something else.
+*/
+
+template <class T> class Handle;
+
+// Creating a JSValue Handle is invalid
+template <> class Handle<JSValue>;
+
+class HandleBase {
+    template <typename T> friend class Weak;
+    template <typename T> friend class Strong;
+    friend class HandleSet;
+    friend struct JSCallbackObjectData;
+
+public:
+    bool operator!() const { return !m_slot || !*m_slot; }
+
+    explicit operator bool() const { return m_slot && *m_slot; }
+
+    HandleSlot slot() const { return m_slot; }
+
+protected:
+    HandleBase(HandleSlot slot)
+        : m_slot(slot)
+    {
+    }
+    
+    void swap(HandleBase& other) { std::swap(m_slot, other.m_slot); }
+
+    void setSlot(HandleSlot slot)
+    {
+        m_slot = slot;
+    }
+
+private:
+    HandleSlot m_slot;
+};
+
+template <typename Base, typename T> struct HandleConverter {
+    T* operator->()
+    {
+        return static_cast<Base*>(this)->get();
+    }
+    const T* operator->() const
+    {
+        return static_cast<const Base*>(this)->get();
+    }
+
+    T* operator*()
+    {
+        return static_cast<Base*>(this)->get();
+    }
+    const T* operator*() const
+    {
+        return static_cast<const Base*>(this)->get();
+    }
+};
+
+template <typename Base> struct HandleConverter<Base, Unknown> {
+    Handle<JSObject> asObject() const;
+    bool isObject() const { return jsValue().isObject(); }
+    bool getNumber(double number) const { return jsValue().getNumber(number); }
+    WTF::String getString(ExecState*) const;
+    bool isUndefinedOrNull() const { return jsValue().isUndefinedOrNull(); }
+
+private:
+    JSValue jsValue() const
+    {
+        return static_cast<const Base*>(this)->get();
+    }
+};
+
+template <typename T> class Handle : public HandleBase, public HandleConverter<Handle<T>, T> {
+public:
+    template <typename A, typename B> friend struct HandleConverter;
+    typedef typename HandleTypes<T>::ExternalType ExternalType;
+    template <typename U> Handle(Handle<U> o)
+    {
+        typename HandleTypes<T>::template validateUpcast<U>();
+        setSlot(o.slot());
+    }
+
+    void swap(Handle& other) { HandleBase::swap(other); }
+
+    ExternalType get() const { return HandleTypes<T>::getFromSlot(this->slot()); }
+
+protected:
+    Handle(HandleSlot slot = 0)
+        : HandleBase(slot)
+    {
+    }
+    
+private:
+    friend class HandleSet;
+    friend class WeakBlock;
+
+    static Handle<T> wrapSlot(HandleSlot slot)
+    {
+        return Handle<T>(slot);
+    }
+};
+
+template <typename Base> Handle<JSObject> HandleConverter<Base, Unknown>::asObject() const
+{
+    return Handle<JSObject>::wrapSlot(static_cast<const Base*>(this)->slot());
+}
+
+template <typename T, typename U> inline bool operator==(const Handle<T>& a, const Handle<U>& b)
+{ 
+    return a.get() == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator==(const Handle<T>& a, U* b)
+{ 
+    return a.get() == b; 
+}
+
+template <typename T, typename U> inline bool operator==(T* a, const Handle<U>& b) 
+{
+    return a == b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const Handle<T>& a, const Handle<U>& b)
+{ 
+    return a.get() != b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const Handle<T>& a, U* b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(T* a, const Handle<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+template <typename T, typename U> inline bool operator!=(const Handle<T>& a, JSValue b)
+{
+    return a.get() != b; 
+}
+
+template <typename T, typename U> inline bool operator!=(JSValue a, const Handle<U>& b)
+{ 
+    return a != b.get(); 
+}
+
+} // namespace JSC
diff --git a/heap/HandleBlock.h b/heap/HandleBlock.h
new file mode 100644
index 0000000..ef64433
--- /dev/null
+++ b/heap/HandleBlock.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/DoublyLinkedList.h>
+
+namespace JSC {
+
+class HandleSet;
+class HandleNode;
+
+class HandleBlock : public DoublyLinkedListNode<HandleBlock> {
+    friend class WTF::DoublyLinkedListNode<HandleBlock>;
+public:
+    static HandleBlock* create(HandleSet*);
+    static void destroy(HandleBlock*);
+    static HandleBlock* blockFor(HandleNode*);
+
+    static const size_t blockSize = 4 * KB;
+
+    HandleSet* handleSet();
+
+    HandleNode* nodes();
+    HandleNode* nodeAtIndex(unsigned);
+    unsigned nodeCapacity();
+
+private:
+    HandleBlock(HandleSet*);
+
+    char* payload();
+    char* payloadEnd();
+
+    static const size_t s_blockMask = ~(blockSize - 1);
+
+    HandleBlock* m_prev;
+    HandleBlock* m_next;
+    HandleSet* m_handleSet;
+};
+
+inline HandleBlock* HandleBlock::blockFor(HandleNode* node)
+{
+    return reinterpret_cast<HandleBlock*>(reinterpret_cast<size_t>(node) & s_blockMask);
+}
+
+inline HandleSet* HandleBlock::handleSet()
+{
+    return m_handleSet;
+}
+
+} // namespace JSC
diff --git a/heap/HandleBlockInlines.h b/heap/HandleBlockInlines.h
new file mode 100644
index 0000000..c87481f
--- /dev/null
+++ b/heap/HandleBlockInlines.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "HandleBlock.h"
+#include <wtf/FastMalloc.h>
+
+namespace JSC {
+
+inline HandleBlock* HandleBlock::create(HandleSet* handleSet)
+{
+    return new (NotNull, fastAlignedMalloc(blockSize, blockSize)) HandleBlock(handleSet);
+}
+
+inline void HandleBlock::destroy(HandleBlock* block)
+{
+    block->~HandleBlock();
+    fastAlignedFree(block);
+}
+
+inline HandleBlock::HandleBlock(HandleSet* handleSet)
+    : DoublyLinkedListNode<HandleBlock>()
+    , m_handleSet(handleSet)
+{
+}
+
+inline char* HandleBlock::payloadEnd()
+{
+    return reinterpret_cast<char*>(this) + blockSize;
+}
+
+inline char* HandleBlock::payload()
+{
+    return reinterpret_cast<char*>(this) + WTF::roundUpToMultipleOf<sizeof(double)>(sizeof(HandleBlock));
+}
+
+inline HandleNode* HandleBlock::nodes()
+{
+    return reinterpret_cast_ptr<HandleNode*>(payload());
+}
+
+inline HandleNode* HandleBlock::nodeAtIndex(unsigned i)
+{
+    ASSERT(i < nodeCapacity());
+    return &nodes()[i];
+}
+
+inline unsigned HandleBlock::nodeCapacity()
+{
+    return (payloadEnd() - payload()) / sizeof(HandleNode);
+}
+
+} // namespace JSC
diff --git a/heap/HandleSet.cpp b/heap/HandleSet.cpp
new file mode 100644
index 0000000..9d7d5c6
--- /dev/null
+++ b/heap/HandleSet.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HandleSet.h"
+
+#include "HandleBlock.h"
+#include "HandleBlockInlines.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include <wtf/DataLog.h>
+
+namespace JSC {
+
+HandleSet::HandleSet(VM* vm)
+    : m_vm(vm)
+{
+    grow();
+}
+
+HandleSet::~HandleSet()
+{
+    while (!m_blockList.isEmpty())
+        HandleBlock::destroy(m_blockList.removeHead());
+}
+
+void HandleSet::grow()
+{
+    HandleBlock* newBlock = HandleBlock::create(this);
+    m_blockList.append(newBlock);
+
+    for (int i = newBlock->nodeCapacity() - 1; i >= 0; --i) {
+        Node* node = newBlock->nodeAtIndex(i);
+        new (NotNull, node) Node;
+        m_freeList.push(node);
+    }
+}
+
+void HandleSet::visitStrongHandles(SlotVisitor& visitor)
+{
+    Node* end = m_strongList.end();
+    for (Node* node = m_strongList.begin(); node != end; node = node->next()) {
+#if ENABLE(GC_VALIDATION)
+        RELEASE_ASSERT(isLiveNode(node));
+#endif
+        visitor.appendUnbarriered(*node->slot());
+    }
+}
+
+void HandleSet::writeBarrier(HandleSlot slot, const JSValue& value)
+{
+    if (!value == !*slot && slot->isCell() == value.isCell())
+        return;
+
+    Node* node = toNode(slot);
+#if ENABLE(GC_VALIDATION)
+    RELEASE_ASSERT(isLiveNode(node));
+#endif
+    SentinelLinkedList<Node>::remove(node);
+    if (!value || !value.isCell()) {
+        m_immediateList.push(node);
+        return;
+    }
+
+    m_strongList.push(node);
+#if ENABLE(GC_VALIDATION)
+    RELEASE_ASSERT(isLiveNode(node));
+#endif
+}
+
+unsigned HandleSet::protectedGlobalObjectCount()
+{
+    unsigned count = 0;
+    Node* end = m_strongList.end();
+    for (Node* node = m_strongList.begin(); node != end; node = node->next()) {
+        JSValue value = *node->slot();
+        if (value.isObject() && asObject(value.asCell())->isGlobalObject())
+            count++;
+    }
+    return count;
+}
+
+#if ENABLE(GC_VALIDATION) || !ASSERT_DISABLED
+bool HandleSet::isLiveNode(Node* node)
+{
+    if (node->prev()->next() != node)
+        return false;
+    if (node->next()->prev() != node)
+        return false;
+        
+    return true;
+}
+#endif
+
+} // namespace JSC
diff --git a/heap/HandleSet.h b/heap/HandleSet.h
new file mode 100644
index 0000000..458daeb
--- /dev/null
+++ b/heap/HandleSet.h
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Handle.h"
+#include "HandleBlock.h"
+#include "HeapCell.h"
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/HashCountedSet.h>
+#include <wtf/SentinelLinkedList.h>
+#include <wtf/SinglyLinkedList.h>
+
+namespace JSC {
+
+class HandleSet;
+class VM;
+class JSValue;
+class SlotVisitor;
+
+class HandleNode {
+public:
+    HandleNode(WTF::SentinelTag);
+    HandleNode();
+    
+    HandleSlot slot();
+    HandleSet* handleSet();
+
+    void setPrev(HandleNode*);
+    HandleNode* prev();
+
+    void setNext(HandleNode*);
+    HandleNode* next();
+
+private:
+    JSValue m_value;
+    HandleNode* m_prev;
+    HandleNode* m_next;
+};
+
+class HandleSet {
+    friend class HandleBlock;
+public:
+    static HandleSet* heapFor(HandleSlot);
+
+    HandleSet(VM*);
+    ~HandleSet();
+
+    VM* vm();
+
+    HandleSlot allocate();
+    void deallocate(HandleSlot);
+
+    void visitStrongHandles(SlotVisitor&);
+
+    JS_EXPORT_PRIVATE void writeBarrier(HandleSlot, const JSValue&);
+
+    unsigned protectedGlobalObjectCount();
+
+    template<typename Functor> void forEachStrongHandle(const Functor&, const HashCountedSet<JSCell*>& skipSet);
+
+private:
+    typedef HandleNode Node;
+    static HandleSlot toHandle(Node*);
+    static Node* toNode(HandleSlot);
+
+    JS_EXPORT_PRIVATE void grow();
+    
+#if ENABLE(GC_VALIDATION) || !ASSERT_DISABLED
+    bool isLiveNode(Node*);
+#endif
+
+    VM* m_vm;
+    DoublyLinkedList<HandleBlock> m_blockList;
+
+    SentinelLinkedList<Node> m_strongList;
+    SentinelLinkedList<Node> m_immediateList;
+    SinglyLinkedList<Node> m_freeList;
+};
+
+inline HandleSet* HandleSet::heapFor(HandleSlot handle)
+{
+    return toNode(handle)->handleSet();
+}
+
+inline VM* HandleSet::vm()
+{
+    return m_vm;
+}
+
+inline HandleSlot HandleSet::toHandle(HandleSet::Node* node)
+{
+    return reinterpret_cast<HandleSlot>(node);
+}
+
+inline HandleSet::Node* HandleSet::toNode(HandleSlot handle)
+{
+    return reinterpret_cast<HandleSet::Node*>(handle);
+}
+
+inline HandleSlot HandleSet::allocate()
+{
+    if (m_freeList.isEmpty())
+        grow();
+
+    HandleSet::Node* node = m_freeList.pop();
+    new (NotNull, node) HandleSet::Node();
+    m_immediateList.push(node);
+    return toHandle(node);
+}
+
+inline void HandleSet::deallocate(HandleSlot handle)
+{
+    HandleSet::Node* node = toNode(handle);
+    SentinelLinkedList<HandleSet::Node>::remove(node);
+    m_freeList.push(node);
+}
+
+inline HandleNode::HandleNode()
+    : m_prev(0)
+    , m_next(0)
+{
+}
+
+inline HandleNode::HandleNode(WTF::SentinelTag)
+    : m_prev(0)
+    , m_next(0)
+{
+}
+
+inline HandleSlot HandleNode::slot()
+{
+    return &m_value;
+}
+
+inline HandleSet* HandleNode::handleSet()
+{
+    return HandleBlock::blockFor(this)->handleSet();
+}
+
+inline void HandleNode::setPrev(HandleNode* prev)
+{
+    m_prev = prev;
+}
+
+inline HandleNode* HandleNode::prev()
+{
+    return m_prev;
+}
+
+inline void HandleNode::setNext(HandleNode* next)
+{
+    m_next = next;
+}
+
+inline HandleNode* HandleNode::next()
+{
+    return m_next;
+}
+
+template<typename Functor> void HandleSet::forEachStrongHandle(const Functor& functor, const HashCountedSet<JSCell*>& skipSet)
+{
+    HandleSet::Node* end = m_strongList.end();
+    for (HandleSet::Node* node = m_strongList.begin(); node != end; node = node->next()) {
+        JSValue value = *node->slot();
+        if (!value || !value.isCell())
+            continue;
+        if (skipSet.contains(value.asCell()))
+            continue;
+        functor(value.asCell());
+    }
+}
+
+} // namespace JSC
diff --git a/heap/HandleStack.cpp b/heap/HandleStack.cpp
new file mode 100644
index 0000000..30c0d1f
--- /dev/null
+++ b/heap/HandleStack.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2010-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HandleStack.h"
+
+#include "JSObject.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+HandleStack::HandleStack()
+#ifndef NDEBUG
+    : m_scopeDepth(0)
+#endif
+{
+    grow();
+}
+
+void HandleStack::visit(SlotVisitor& visitor)
+{
+    const Vector<HandleSlot>& blocks = m_blockStack.blocks();
+    size_t blockLength = m_blockStack.blockLength;
+
+    int end = blocks.size() - 1;
+    for (int i = 0; i < end; ++i) {
+        HandleSlot block = blocks[i];
+        visitor.appendUnbarriered(block, blockLength);
+    }
+    HandleSlot block = blocks[end];
+    visitor.appendUnbarriered(block, m_frame.m_next - block);
+}
+
+void HandleStack::grow()
+{
+    HandleSlot block = m_blockStack.grow();
+    m_frame.m_next = block;
+    m_frame.m_end = block + m_blockStack.blockLength;
+}
+
+}
diff --git a/heap/HandleStack.h b/heap/HandleStack.h
new file mode 100644
index 0000000..dc14864
--- /dev/null
+++ b/heap/HandleStack.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2010-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Assertions.h>
+#include <wtf/BlockStack.h>
+#include "Handle.h"
+
+namespace JSC {
+
+class LocalScope;
+class SlotVisitor;
+
+class HandleStack {
+public:
+    class Frame {
+    public:
+        HandleSlot m_next;
+        HandleSlot m_end;
+    };
+
+    HandleStack();
+    
+    void enterScope(Frame&);
+    void leaveScope(Frame&);
+
+    HandleSlot push();
+
+    void visit(SlotVisitor&);
+
+private:
+    JS_EXPORT_PRIVATE void grow();
+    void zapTo(Frame&);
+    HandleSlot findFirstAfter(HandleSlot);
+
+#ifndef NDEBUG
+    size_t m_scopeDepth;
+#endif
+    BlockStack<JSValue> m_blockStack;
+    Frame m_frame;
+};
+
+inline void HandleStack::enterScope(Frame& lastFrame)
+{
+#ifndef NDEBUG
+    ++m_scopeDepth;
+#endif
+
+    lastFrame = m_frame;
+}
+
+
+
+inline void HandleStack::zapTo(Frame& lastFrame)
+{
+#ifdef NDEBUG
+    UNUSED_PARAM(lastFrame);
+#else
+    const Vector<HandleSlot>& blocks = m_blockStack.blocks();
+    
+    if (lastFrame.m_end != m_frame.m_end) { // Zapping to a frame in a different block.
+        int i = blocks.size() - 1;
+        for ( ; blocks[i] + m_blockStack.blockLength != lastFrame.m_end; --i) {
+            for (int j = m_blockStack.blockLength - 1; j >= 0; --j)
+                blocks[i][j] = JSValue();
+        }
+        
+        for (HandleSlot it = blocks[i] + m_blockStack.blockLength - 1; it != lastFrame.m_next - 1; --it)
+            *it = JSValue();
+        
+        return;
+    }
+    
+    for (HandleSlot it = m_frame.m_next - 1; it != lastFrame.m_next - 1; --it)
+        *it = JSValue();
+#endif
+}
+
+inline void HandleStack::leaveScope(Frame& lastFrame)
+{
+#ifndef NDEBUG
+    --m_scopeDepth;
+#endif
+
+    zapTo(lastFrame);
+
+    if (lastFrame.m_end != m_frame.m_end) // Popping to a frame in a different block.
+        m_blockStack.shrink(lastFrame.m_end);
+
+    m_frame = lastFrame;
+}
+
+inline HandleSlot HandleStack::push()
+{
+    ASSERT(m_scopeDepth); // Creating a Local outside of a LocalScope is a memory leak.
+    if (m_frame.m_next == m_frame.m_end)
+        grow();
+    return m_frame.m_next++;
+}
+
+} // namespace JSC
diff --git a/heap/HandleTypes.h b/heap/HandleTypes.h
new file mode 100644
index 0000000..6cf11df
--- /dev/null
+++ b/heap/HandleTypes.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+typedef enum { } Unknown;
+typedef JSValue* HandleSlot;
+
+template<typename T> struct HandleTypes {
+    typedef T* ExternalType;
+    static ExternalType getFromSlot(HandleSlot slot) { return (slot && *slot) ? reinterpret_cast<ExternalType>(static_cast<void*>(slot->asCell())) : 0; }
+    static JSValue toJSValue(T* cell) { return reinterpret_cast<JSCell*>(cell); }
+    template<typename U> static void validateUpcast() { T* temp; temp = (U*)0; }
+};
+
+template<> struct HandleTypes<Unknown> {
+    typedef JSValue ExternalType;
+    static ExternalType getFromSlot(HandleSlot slot) { return slot ? *slot : JSValue(); }
+    static JSValue toJSValue(const JSValue& v) { return v; }
+    template<typename U> static void validateUpcast() { }
+};
+
+} // namespace JSC
diff --git a/heap/Heap.cpp b/heap/Heap.cpp
new file mode 100644
index 0000000..faee4f5
--- /dev/null
+++ b/heap/Heap.cpp
@@ -0,0 +1,2383 @@
+/*
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "Heap.h"
+
+#include "CodeBlock.h"
+#include "CodeBlockSetInlines.h"
+#include "ConservativeRoots.h"
+#include "DFGWorklistInlines.h"
+#include "EdenGCActivityCallback.h"
+#include "Exception.h"
+#include "FullGCActivityCallback.h"
+#include "GCActivityCallback.h"
+#include "GCIncomingRefCountedSetInlines.h"
+#include "GCSegmentedArrayInlines.h"
+#include "GCTypeMap.h"
+#include "HasOwnPropertyCache.h"
+#include "HeapHelperPool.h"
+#include "HeapIterationScope.h"
+#include "HeapProfiler.h"
+#include "HeapSnapshot.h"
+#include "HeapStatistics.h"
+#include "HeapVerifier.h"
+#include "HelpingGCScope.h"
+#include "IncrementalSweeper.h"
+#include "Interpreter.h"
+#include "JITStubRoutineSet.h"
+#include "JITWorklist.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSLock.h"
+#include "JSVirtualMachineInternal.h"
+#include "MarkedSpaceInlines.h"
+#include "MarkingConstraintSet.h"
+#include "PreventCollectionScope.h"
+#include "SamplingProfiler.h"
+#include "ShadowChicken.h"
+#include "SpaceTimeMutatorScheduler.h"
+#include "SuperSampler.h"
+#include "StochasticSpaceTimeMutatorScheduler.h"
+#include "StopIfNecessaryTimer.h"
+#include "SynchronousStopTheWorldMutatorScheduler.h"
+#include "TypeProfilerLog.h"
+#include "UnlinkedCodeBlock.h"
+#include "VM.h"
+#include "WeakSetInlines.h"
+#include <algorithm>
+#include <wtf/CurrentTime.h>
+#include <wtf/MainThread.h>
+#include <wtf/ParallelVectorIterator.h>
+#include <wtf/ProcessID.h>
+#include <wtf/RAMSize.h>
+#include <wtf/SimpleStats.h>
+
+#if USE(FOUNDATION)
+#if __has_include(<objc/objc-internal.h>)
+#include <objc/objc-internal.h>
+#else
+extern "C" void* objc_autoreleasePoolPush(void);
+extern "C" void objc_autoreleasePoolPop(void *context);
+#endif
+#endif // USE(FOUNDATION)
+
+using namespace std;
+
+namespace JSC {
+
+namespace {
+
+bool verboseStop = false;
+
+double maxPauseMS(double thisPauseMS)
+{
+    static double maxPauseMS;
+    maxPauseMS = std::max(thisPauseMS, maxPauseMS);
+    return maxPauseMS;
+}
+
+size_t minHeapSize(HeapType heapType, size_t ramSize)
+{
+    if (heapType == LargeHeap) {
+        double result = min(
+            static_cast<double>(Options::largeHeapSize()),
+            ramSize * Options::smallHeapRAMFraction());
+        return static_cast<size_t>(result);
+    }
+    return Options::smallHeapSize();
+}
+
+size_t proportionalHeapSize(size_t heapSize, size_t ramSize)
+{
+    if (heapSize < ramSize * Options::smallHeapRAMFraction())
+        return Options::smallHeapGrowthFactor() * heapSize;
+    if (heapSize < ramSize * Options::mediumHeapRAMFraction())
+        return Options::mediumHeapGrowthFactor() * heapSize;
+    return Options::largeHeapGrowthFactor() * heapSize;
+}
+
+bool isValidSharedInstanceThreadState(VM* vm)
+{
+    return vm->currentThreadIsHoldingAPILock();
+}
+
+bool isValidThreadState(VM* vm)
+{
+    if (vm->atomicStringTable() != wtfThreadData().atomicStringTable())
+        return false;
+
+    if (vm->isSharedInstance() && !isValidSharedInstanceThreadState(vm))
+        return false;
+
+    return true;
+}
+
+void recordType(TypeCountSet& set, JSCell* cell)
+{
+    const char* typeName = "[unknown]";
+    const ClassInfo* info = cell->classInfo();
+    if (info && info->className)
+        typeName = info->className;
+    set.add(typeName);
+}
+
+bool measurePhaseTiming()
+{
+    return false;
+}
+
+HashMap<const char*, GCTypeMap<SimpleStats>>& timingStats()
+{
+    static HashMap<const char*, GCTypeMap<SimpleStats>>* result;
+    static std::once_flag once;
+    std::call_once(
+        once,
+        [] {
+            result = new HashMap<const char*, GCTypeMap<SimpleStats>>();
+        });
+    return *result;
+}
+
+SimpleStats& timingStats(const char* name, CollectionScope scope)
+{
+    return timingStats().add(name, GCTypeMap<SimpleStats>()).iterator->value[scope];
+}
+
+class TimingScope {
+public:
+    TimingScope(std::optional<CollectionScope> scope, const char* name)
+        : m_scope(scope)
+        , m_name(name)
+    {
+        if (measurePhaseTiming())
+            m_before = monotonicallyIncreasingTimeMS();
+    }
+    
+    TimingScope(Heap& heap, const char* name)
+        : TimingScope(heap.collectionScope(), name)
+    {
+    }
+    
+    void setScope(std::optional<CollectionScope> scope)
+    {
+        m_scope = scope;
+    }
+    
+    void setScope(Heap& heap)
+    {
+        setScope(heap.collectionScope());
+    }
+    
+    ~TimingScope()
+    {
+        if (measurePhaseTiming()) {
+            double after = monotonicallyIncreasingTimeMS();
+            double timing = after - m_before;
+            SimpleStats& stats = timingStats(m_name, *m_scope);
+            stats.add(timing);
+            dataLog("[GC:", *m_scope, "] ", m_name, " took: ", timing, "ms (average ", stats.mean(), "ms).\n");
+        }
+    }
+private:
+    std::optional<CollectionScope> m_scope;
+    double m_before;
+    const char* m_name;
+};
+
+} // anonymous namespace
+
+class Heap::Thread : public AutomaticThread {
+public:
+    Thread(const LockHolder& locker, Heap& heap)
+        : AutomaticThread(locker, heap.m_threadLock, heap.m_threadCondition)
+        , m_heap(heap)
+    {
+    }
+    
+protected:
+    PollResult poll(const LockHolder& locker) override
+    {
+        if (m_heap.m_threadShouldStop) {
+            m_heap.notifyThreadStopping(locker);
+            return PollResult::Stop;
+        }
+        if (m_heap.shouldCollectInThread(locker))
+            return PollResult::Work;
+        return PollResult::Wait;
+    }
+    
+    WorkResult work() override
+    {
+        m_heap.collectInThread();
+        return WorkResult::Continue;
+    }
+    
+    void threadDidStart() override
+    {
+        WTF::registerGCThread(GCThreadType::Main);
+    }
+
+private:
+    Heap& m_heap;
+};
+
+Heap::Heap(VM* vm, HeapType heapType)
+    : m_heapType(heapType)
+    , m_ramSize(Options::forceRAMSize() ? Options::forceRAMSize() : ramSize())
+    , m_minBytesPerCycle(minHeapSize(m_heapType, m_ramSize))
+    , m_sizeAfterLastCollect(0)
+    , m_sizeAfterLastFullCollect(0)
+    , m_sizeBeforeLastFullCollect(0)
+    , m_sizeAfterLastEdenCollect(0)
+    , m_sizeBeforeLastEdenCollect(0)
+    , m_bytesAllocatedThisCycle(0)
+    , m_bytesAbandonedSinceLastFullCollect(0)
+    , m_maxEdenSize(m_minBytesPerCycle)
+    , m_maxHeapSize(m_minBytesPerCycle)
+    , m_shouldDoFullCollection(false)
+    , m_totalBytesVisited(0)
+    , m_objectSpace(this)
+    , m_extraMemorySize(0)
+    , m_deprecatedExtraMemorySize(0)
+    , m_machineThreads(this)
+    , m_collectorSlotVisitor(std::make_unique<SlotVisitor>(*this))
+    , m_mutatorMarkStack(std::make_unique<MarkStackArray>())
+    , m_raceMarkStack(std::make_unique<MarkStackArray>())
+    , m_constraintSet(std::make_unique<MarkingConstraintSet>())
+    , m_handleSet(vm)
+    , m_codeBlocks(std::make_unique<CodeBlockSet>())
+    , m_jitStubRoutines(std::make_unique<JITStubRoutineSet>())
+    , m_isSafeToCollect(false)
+    , m_vm(vm)
+    // We seed with 10ms so that GCActivityCallback::didAllocate doesn't continuously 
+    // schedule the timer if we've never done a collection.
+    , m_lastFullGCLength(0.01)
+    , m_lastEdenGCLength(0.01)
+#if USE(CF)
+    , m_runLoop(CFRunLoopGetCurrent())
+#endif // USE(CF)
+    , m_fullActivityCallback(GCActivityCallback::createFullTimer(this))
+    , m_edenActivityCallback(GCActivityCallback::createEdenTimer(this))
+    , m_sweeper(adoptRef(new IncrementalSweeper(this)))
+    , m_stopIfNecessaryTimer(adoptRef(new StopIfNecessaryTimer(vm)))
+    , m_deferralDepth(0)
+#if USE(FOUNDATION)
+    , m_delayedReleaseRecursionCount(0)
+#endif
+    , m_sharedCollectorMarkStack(std::make_unique<MarkStackArray>())
+    , m_sharedMutatorMarkStack(std::make_unique<MarkStackArray>())
+    , m_helperClient(&heapHelperPool())
+    , m_threadLock(Box<Lock>::create())
+    , m_threadCondition(AutomaticThreadCondition::create())
+{
+    m_worldState.store(0);
+    
+    if (Options::useConcurrentGC()) {
+        if (Options::useStochasticMutatorScheduler())
+            m_scheduler = std::make_unique<StochasticSpaceTimeMutatorScheduler>(*this);
+        else
+            m_scheduler = std::make_unique<SpaceTimeMutatorScheduler>(*this);
+    } else {
+        // We simulate turning off concurrent GC by making the scheduler say that the world
+        // should always be stopped when the collector is running.
+        m_scheduler = std::make_unique<SynchronousStopTheWorldMutatorScheduler>();
+    }
+    
+    if (Options::verifyHeap())
+        m_verifier = std::make_unique<HeapVerifier>(this, Options::numberOfGCCyclesToRecordForVerification());
+    
+    m_collectorSlotVisitor->optimizeForStoppedMutator();
+    
+    LockHolder locker(*m_threadLock);
+    m_thread = adoptRef(new Thread(locker, *this));
+}
+
+Heap::~Heap()
+{
+    for (auto& slotVisitor : m_parallelSlotVisitors)
+        slotVisitor->clearMarkStacks();
+    m_collectorSlotVisitor->clearMarkStacks();
+    m_mutatorMarkStack->clear();
+    m_raceMarkStack->clear();
+    
+    for (WeakBlock* block : m_logicallyEmptyWeakBlocks)
+        WeakBlock::destroy(*this, block);
+}
+
+bool Heap::isPagedOut(double deadline)
+{
+    return m_objectSpace.isPagedOut(deadline);
+}
+
+// The VM is being destroyed and the collector will never run again.
+// Run all pending finalizers now because we won't get another chance.
+void Heap::lastChanceToFinalize()
+{
+    RELEASE_ASSERT(!m_vm->entryScope);
+    RELEASE_ASSERT(m_mutatorState == MutatorState::Running);
+    
+    if (m_collectContinuouslyThread) {
+        {
+            LockHolder locker(m_collectContinuouslyLock);
+            m_shouldStopCollectingContinuously = true;
+            m_collectContinuouslyCondition.notifyOne();
+        }
+        waitForThreadCompletion(m_collectContinuouslyThread);
+    }
+    
+    // Carefully bring the thread down. We need to use waitForCollector() until we know that there
+    // won't be any other collections.
+    bool stopped = false;
+    {
+        LockHolder locker(*m_threadLock);
+        stopped = m_thread->tryStop(locker);
+        if (!stopped) {
+            m_threadShouldStop = true;
+            m_threadCondition->notifyOne(locker);
+        }
+    }
+    if (!stopped) {
+        waitForCollector(
+            [&] (const LockHolder&) -> bool {
+                return m_threadIsStopping;
+            });
+        // It's now safe to join the thread, since we know that there will not be any more collections.
+        m_thread->join();
+    }
+    
+    m_arrayBuffers.lastChanceToFinalize();
+    m_codeBlocks->lastChanceToFinalize();
+    m_objectSpace.stopAllocating();
+    m_objectSpace.lastChanceToFinalize();
+    releaseDelayedReleasedObjects();
+
+    sweepAllLogicallyEmptyWeakBlocks();
+}
+
+void Heap::releaseDelayedReleasedObjects()
+{
+#if USE(FOUNDATION)
+    // We need to guard against the case that releasing an object can create more objects due to the
+    // release calling into JS. When those JS call(s) exit and all locks are being dropped we end up
+    // back here and could try to recursively release objects. We guard that with a recursive entry
+    // count. Only the initial call will release objects, recursive calls simple return and let the
+    // the initial call to the function take care of any objects created during release time.
+    // This also means that we need to loop until there are no objects in m_delayedReleaseObjects
+    // and use a temp Vector for the actual releasing.
+    if (!m_delayedReleaseRecursionCount++) {
+        while (!m_delayedReleaseObjects.isEmpty()) {
+            ASSERT(m_vm->currentThreadIsHoldingAPILock());
+
+            Vector<RetainPtr<CFTypeRef>> objectsToRelease = WTFMove(m_delayedReleaseObjects);
+
+            {
+                // We need to drop locks before calling out to arbitrary code.
+                JSLock::DropAllLocks dropAllLocks(m_vm);
+
+                void* context = objc_autoreleasePoolPush();
+                objectsToRelease.clear();
+                objc_autoreleasePoolPop(context);
+            }
+        }
+    }
+    m_delayedReleaseRecursionCount--;
+#endif
+}
+
+void Heap::reportExtraMemoryAllocatedSlowCase(size_t size)
+{
+    didAllocate(size);
+    collectIfNecessaryOrDefer();
+}
+
+void Heap::deprecatedReportExtraMemorySlowCase(size_t size)
+{
+    m_deprecatedExtraMemorySize += size;
+    reportExtraMemoryAllocatedSlowCase(size);
+}
+
+void Heap::reportAbandonedObjectGraph()
+{
+    // Our clients don't know exactly how much memory they
+    // are abandoning so we just guess for them.
+    size_t abandonedBytes = static_cast<size_t>(0.1 * capacity());
+
+    // We want to accelerate the next collection. Because memory has just 
+    // been abandoned, the next collection has the potential to 
+    // be more profitable. Since allocation is the trigger for collection, 
+    // we hasten the next collection by pretending that we've allocated more memory. 
+    if (m_fullActivityCallback) {
+        m_fullActivityCallback->didAllocate(
+            m_sizeAfterLastCollect - m_sizeAfterLastFullCollect + m_bytesAllocatedThisCycle + m_bytesAbandonedSinceLastFullCollect);
+    }
+    m_bytesAbandonedSinceLastFullCollect += abandonedBytes;
+}
+
+void Heap::protect(JSValue k)
+{
+    ASSERT(k);
+    ASSERT(m_vm->currentThreadIsHoldingAPILock());
+
+    if (!k.isCell())
+        return;
+
+    m_protectedValues.add(k.asCell());
+}
+
+bool Heap::unprotect(JSValue k)
+{
+    ASSERT(k);
+    ASSERT(m_vm->currentThreadIsHoldingAPILock());
+
+    if (!k.isCell())
+        return false;
+
+    return m_protectedValues.remove(k.asCell());
+}
+
+void Heap::addReference(JSCell* cell, ArrayBuffer* buffer)
+{
+    if (m_arrayBuffers.addReference(cell, buffer)) {
+        collectIfNecessaryOrDefer();
+        didAllocate(buffer->gcSizeEstimateInBytes());
+    }
+}
+
+void Heap::finalizeUnconditionalFinalizers()
+{
+    while (m_unconditionalFinalizers.hasNext()) {
+        UnconditionalFinalizer* finalizer = m_unconditionalFinalizers.removeNext();
+        finalizer->finalizeUnconditionally();
+    }
+}
+
+void Heap::willStartIterating()
+{
+    m_objectSpace.willStartIterating();
+}
+
+void Heap::didFinishIterating()
+{
+    m_objectSpace.didFinishIterating();
+}
+
+void Heap::completeAllJITPlans()
+{
+#if ENABLE(JIT)
+    JITWorklist::instance()->completeAllForVM(*m_vm);
+#endif // ENABLE(JIT)
+    DFG::completeAllPlansForVM(*m_vm);
+}
+
+template<typename Func>
+void Heap::iterateExecutingAndCompilingCodeBlocks(const Func& func)
+{
+    m_codeBlocks->iterateCurrentlyExecuting(func);
+    DFG::iterateCodeBlocksForGC(*m_vm, func);
+}
+
+template<typename Func>
+void Heap::iterateExecutingAndCompilingCodeBlocksWithoutHoldingLocks(const Func& func)
+{
+    Vector<CodeBlock*, 256> codeBlocks;
+    iterateExecutingAndCompilingCodeBlocks(
+        [&] (CodeBlock* codeBlock) {
+            codeBlocks.append(codeBlock);
+        });
+    for (CodeBlock* codeBlock : codeBlocks)
+        func(codeBlock);
+}
+
+void Heap::assertSharedMarkStacksEmpty()
+{
+    bool ok = true;
+    
+    if (!m_sharedCollectorMarkStack->isEmpty()) {
+        dataLog("FATAL: Shared collector mark stack not empty! It has ", m_sharedCollectorMarkStack->size(), " elements.\n");
+        ok = false;
+    }
+    
+    if (!m_sharedMutatorMarkStack->isEmpty()) {
+        dataLog("FATAL: Shared mutator mark stack not empty! It has ", m_sharedMutatorMarkStack->size(), " elements.\n");
+        ok = false;
+    }
+    
+    RELEASE_ASSERT(ok);
+}
+
+void Heap::markToFixpoint(double gcStartTime)
+{
+    TimingScope markToFixpointTimingScope(*this, "Heap::markToFixpoint");
+    
+    if (m_collectionScope == CollectionScope::Full) {
+        m_opaqueRoots.clear();
+        m_collectorSlotVisitor->clearMarkStacks();
+        m_mutatorMarkStack->clear();
+    }
+
+    RELEASE_ASSERT(m_raceMarkStack->isEmpty());
+
+    beginMarking();
+
+    m_parallelMarkersShouldExit = false;
+
+    m_helperClient.setFunction(
+        [this] () {
+            SlotVisitor* slotVisitor;
+            {
+                LockHolder locker(m_parallelSlotVisitorLock);
+                if (m_availableParallelSlotVisitors.isEmpty()) {
+                    std::unique_ptr<SlotVisitor> newVisitor =
+                        std::make_unique<SlotVisitor>(*this);
+                    
+                    if (Options::optimizeParallelSlotVisitorsForStoppedMutator())
+                        newVisitor->optimizeForStoppedMutator();
+                    
+                    slotVisitor = newVisitor.get();
+                    m_parallelSlotVisitors.append(WTFMove(newVisitor));
+                } else
+                    slotVisitor = m_availableParallelSlotVisitors.takeLast();
+            }
+
+            WTF::registerGCThread(GCThreadType::Helper);
+
+            {
+                ParallelModeEnabler parallelModeEnabler(*slotVisitor);
+                slotVisitor->didStartMarking();
+                slotVisitor->drainFromShared(SlotVisitor::SlaveDrain);
+            }
+
+            {
+                LockHolder locker(m_parallelSlotVisitorLock);
+                m_availableParallelSlotVisitors.append(slotVisitor);
+            }
+        });
+
+    SlotVisitor& slotVisitor = *m_collectorSlotVisitor;
+    slotVisitor.didStartMarking();
+    m_constraintSet->didStartMarking();
+    
+    m_scheduler->beginCollection();
+    if (Options::logGC())
+        m_scheduler->log();
+    
+    // After this, we will almost certainly fall through all of the "slotVisitor.isEmpty()"
+    // checks because bootstrap would have put things into the visitor. So, we should fall
+    // through to draining.
+    
+    if (!slotVisitor.didReachTermination()) {
+        dataLog("Fatal: SlotVisitor should think that GC should terminate before constraint solving, but it does not think this.\n");
+        dataLog("slotVisitor.isEmpty(): ", slotVisitor.isEmpty(), "\n");
+        dataLog("slotVisitor.collectorMarkStack().isEmpty(): ", slotVisitor.collectorMarkStack().isEmpty(), "\n");
+        dataLog("slotVisitor.mutatorMarkStack().isEmpty(): ", slotVisitor.mutatorMarkStack().isEmpty(), "\n");
+        dataLog("m_numberOfActiveParallelMarkers: ", m_numberOfActiveParallelMarkers, "\n");
+        dataLog("m_sharedCollectorMarkStack->isEmpty(): ", m_sharedCollectorMarkStack->isEmpty(), "\n");
+        dataLog("m_sharedMutatorMarkStack->isEmpty(): ", m_sharedMutatorMarkStack->isEmpty(), "\n");
+        dataLog("slotVisitor.didReachTermination(): ", slotVisitor.didReachTermination(), "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    for (;;) {
+        if (Options::logGC())
+            dataLog("v=", bytesVisited() / 1024, "kb o=", m_opaqueRoots.size(), " b=", m_barriersExecuted, " ");
+        
+        if (slotVisitor.didReachTermination()) {
+            m_scheduler->didReachTermination();
+            
+            assertSharedMarkStacksEmpty();
+            
+            slotVisitor.mergeIfNecessary();
+            for (auto& parallelVisitor : m_parallelSlotVisitors)
+                parallelVisitor->mergeIfNecessary();
+            
+            // FIXME: Take m_mutatorDidRun into account when scheduling constraints. Most likely,
+            // we don't have to execute root constraints again unless the mutator did run. At a
+            // minimum, we could use this for work estimates - but it's probably more than just an
+            // estimate.
+            // https://bugs.webkit.org/show_bug.cgi?id=166828
+            
+            // FIXME: We should take advantage of the fact that we could timeout. This only comes
+            // into play if we're executing constraints for the first time. But that will matter
+            // when we have deep stacks or a lot of DOM stuff.
+            // https://bugs.webkit.org/show_bug.cgi?id=166831
+            
+            // Wondering what this does? Look at Heap::addCoreConstraints(). The DOM and others can also
+            // add their own using Heap::addMarkingConstraint().
+            bool converged =
+                m_constraintSet->executeConvergence(slotVisitor, MonotonicTime::infinity());
+            if (converged && slotVisitor.isEmpty()) {
+                assertSharedMarkStacksEmpty();
+                break;
+            }
+            
+            m_scheduler->didExecuteConstraints();
+        }
+        
+        if (Options::logGC())
+            dataLog(slotVisitor.collectorMarkStack().size(), "+", m_mutatorMarkStack->size() + slotVisitor.mutatorMarkStack().size(), " ");
+        
+        {
+            ParallelModeEnabler enabler(slotVisitor);
+            slotVisitor.drainInParallel(m_scheduler->timeToResume());
+        }
+        
+        m_scheduler->synchronousDrainingDidStall();
+
+        if (slotVisitor.didReachTermination())
+            continue;
+        
+        if (!m_scheduler->shouldResume())
+            continue;
+        
+        m_scheduler->willResume();
+        
+        if (Options::logGC()) {
+            double thisPauseMS = (MonotonicTime::now() - m_stopTime).milliseconds();
+            dataLog("p=", thisPauseMS, "ms (max ", maxPauseMS(thisPauseMS), ")...]\n");
+        }
+        
+        resumeTheWorld();
+        
+        {
+            ParallelModeEnabler enabler(slotVisitor);
+            slotVisitor.drainInParallelPassively(m_scheduler->timeToStop());
+        }
+
+        stopTheWorld();
+        
+        if (Options::logGC())
+            dataLog("[GC: ");
+        
+        m_scheduler->didStop();
+        
+        if (Options::logGC())
+            m_scheduler->log();
+    }
+    
+    m_scheduler->endCollection();
+
+    {
+        std::lock_guard<Lock> lock(m_markingMutex);
+        m_parallelMarkersShouldExit = true;
+        m_markingConditionVariable.notifyAll();
+    }
+    m_helperClient.finish();
+
+    iterateExecutingAndCompilingCodeBlocks(
+        [&] (CodeBlock* codeBlock) {
+            writeBarrier(codeBlock);
+        });
+        
+    updateObjectCounts(gcStartTime);
+    endMarking();
+}
+
+void Heap::gatherStackRoots(ConservativeRoots& roots)
+{
+    m_machineThreads.gatherConservativeRoots(roots, *m_jitStubRoutines, *m_codeBlocks);
+}
+
+void Heap::gatherJSStackRoots(ConservativeRoots& roots)
+{
+#if !ENABLE(JIT)
+    m_vm->interpreter->cloopStack().gatherConservativeRoots(roots, *m_jitStubRoutines, *m_codeBlocks);
+#else
+    UNUSED_PARAM(roots);
+#endif
+}
+
+void Heap::gatherScratchBufferRoots(ConservativeRoots& roots)
+{
+#if ENABLE(DFG_JIT)
+    m_vm->gatherConservativeRoots(roots);
+#else
+    UNUSED_PARAM(roots);
+#endif
+}
+
+void Heap::beginMarking()
+{
+    TimingScope timingScope(*this, "Heap::beginMarking");
+    if (m_collectionScope == CollectionScope::Full)
+        m_codeBlocks->clearMarksForFullCollection();
+    m_jitStubRoutines->clearMarks();
+    m_objectSpace.beginMarking();
+    setMutatorShouldBeFenced(true);
+}
+
+void Heap::removeDeadCompilerWorklistEntries()
+{
+#if ENABLE(DFG_JIT)
+    for (unsigned i = DFG::numberOfWorklists(); i--;)
+        DFG::existingWorklistForIndex(i).removeDeadPlans(*m_vm);
+#endif
+}
+
+bool Heap::isHeapSnapshotting() const
+{
+    HeapProfiler* heapProfiler = m_vm->heapProfiler();
+    if (UNLIKELY(heapProfiler))
+        return heapProfiler->activeSnapshotBuilder();
+    return false;
+}
+
+struct GatherHeapSnapshotData : MarkedBlock::CountFunctor {
+    GatherHeapSnapshotData(HeapSnapshotBuilder& builder)
+        : m_builder(builder)
+    {
+    }
+
+    IterationStatus operator()(HeapCell* heapCell, HeapCell::Kind kind) const
+    {
+        if (kind == HeapCell::JSCell) {
+            JSCell* cell = static_cast<JSCell*>(heapCell);
+            cell->methodTable()->heapSnapshot(cell, m_builder);
+        }
+        return IterationStatus::Continue;
+    }
+
+    HeapSnapshotBuilder& m_builder;
+};
+
+void Heap::gatherExtraHeapSnapshotData(HeapProfiler& heapProfiler)
+{
+    if (HeapSnapshotBuilder* builder = heapProfiler.activeSnapshotBuilder()) {
+        HeapIterationScope heapIterationScope(*this);
+        GatherHeapSnapshotData functor(*builder);
+        m_objectSpace.forEachLiveCell(heapIterationScope, functor);
+    }
+}
+
+struct RemoveDeadHeapSnapshotNodes : MarkedBlock::CountFunctor {
+    RemoveDeadHeapSnapshotNodes(HeapSnapshot& snapshot)
+        : m_snapshot(snapshot)
+    {
+    }
+
+    IterationStatus operator()(HeapCell* cell, HeapCell::Kind kind) const
+    {
+        if (kind == HeapCell::JSCell)
+            m_snapshot.sweepCell(static_cast<JSCell*>(cell));
+        return IterationStatus::Continue;
+    }
+
+    HeapSnapshot& m_snapshot;
+};
+
+void Heap::removeDeadHeapSnapshotNodes(HeapProfiler& heapProfiler)
+{
+    if (HeapSnapshot* snapshot = heapProfiler.mostRecentSnapshot()) {
+        HeapIterationScope heapIterationScope(*this);
+        RemoveDeadHeapSnapshotNodes functor(*snapshot);
+        m_objectSpace.forEachDeadCell(heapIterationScope, functor);
+        snapshot->shrinkToFit();
+    }
+}
+
+void Heap::updateObjectCounts(double gcStartTime)
+{
+    if (Options::logGC() == GCLogging::Verbose) {
+        size_t visitCount = m_collectorSlotVisitor->visitCount();
+        visitCount += threadVisitCount();
+        dataLogF("\nNumber of live Objects after GC %lu, took %.6f secs\n", static_cast<unsigned long>(visitCount), WTF::monotonicallyIncreasingTime() - gcStartTime);
+    }
+    
+    if (m_collectionScope == CollectionScope::Full)
+        m_totalBytesVisited = 0;
+
+    m_totalBytesVisitedThisCycle = bytesVisited();
+    
+    m_totalBytesVisited += m_totalBytesVisitedThisCycle;
+}
+
+void Heap::endMarking()
+{
+    m_collectorSlotVisitor->reset();
+
+    for (auto& parallelVisitor : m_parallelSlotVisitors)
+        parallelVisitor->reset();
+
+    assertSharedMarkStacksEmpty();
+    m_weakReferenceHarvesters.removeAll();
+
+    RELEASE_ASSERT(m_raceMarkStack->isEmpty());
+    
+    m_objectSpace.endMarking();
+    setMutatorShouldBeFenced(Options::forceFencedBarrier());
+}
+
+size_t Heap::objectCount()
+{
+    return m_objectSpace.objectCount();
+}
+
+size_t Heap::extraMemorySize()
+{
+    return m_extraMemorySize + m_deprecatedExtraMemorySize + m_arrayBuffers.size();
+}
+
+size_t Heap::size()
+{
+    return m_objectSpace.size() + extraMemorySize();
+}
+
+size_t Heap::capacity()
+{
+    return m_objectSpace.capacity() + extraMemorySize();
+}
+
+size_t Heap::protectedGlobalObjectCount()
+{
+    size_t result = 0;
+    forEachProtectedCell(
+        [&] (JSCell* cell) {
+            if (cell->isObject() && asObject(cell)->isGlobalObject())
+                result++;
+        });
+    return result;
+}
+
+size_t Heap::globalObjectCount()
+{
+    HeapIterationScope iterationScope(*this);
+    size_t result = 0;
+    m_objectSpace.forEachLiveCell(
+        iterationScope,
+        [&] (HeapCell* heapCell, HeapCell::Kind kind) -> IterationStatus {
+            if (kind != HeapCell::JSCell)
+                return IterationStatus::Continue;
+            JSCell* cell = static_cast<JSCell*>(heapCell);
+            if (cell->isObject() && asObject(cell)->isGlobalObject())
+                result++;
+            return IterationStatus::Continue;
+        });
+    return result;
+}
+
+size_t Heap::protectedObjectCount()
+{
+    size_t result = 0;
+    forEachProtectedCell(
+        [&] (JSCell*) {
+            result++;
+        });
+    return result;
+}
+
+std::unique_ptr<TypeCountSet> Heap::protectedObjectTypeCounts()
+{
+    std::unique_ptr<TypeCountSet> result = std::make_unique<TypeCountSet>();
+    forEachProtectedCell(
+        [&] (JSCell* cell) {
+            recordType(*result, cell);
+        });
+    return result;
+}
+
+std::unique_ptr<TypeCountSet> Heap::objectTypeCounts()
+{
+    std::unique_ptr<TypeCountSet> result = std::make_unique<TypeCountSet>();
+    HeapIterationScope iterationScope(*this);
+    m_objectSpace.forEachLiveCell(
+        iterationScope,
+        [&] (HeapCell* cell, HeapCell::Kind kind) -> IterationStatus {
+            if (kind == HeapCell::JSCell)
+                recordType(*result, static_cast<JSCell*>(cell));
+            return IterationStatus::Continue;
+        });
+    return result;
+}
+
+void Heap::deleteAllCodeBlocks(DeleteAllCodeEffort effort)
+{
+    if (m_collectionScope && effort == DeleteAllCodeIfNotCollecting)
+        return;
+    
+    PreventCollectionScope preventCollectionScope(*this);
+    
+    // If JavaScript is running, it's not safe to delete all JavaScript code, since
+    // we'll end up returning to deleted code.
+    RELEASE_ASSERT(!m_vm->entryScope);
+    RELEASE_ASSERT(!m_collectionScope);
+
+    completeAllJITPlans();
+
+    for (ExecutableBase* executable : m_executables)
+        executable->clearCode();
+}
+
+void Heap::deleteAllUnlinkedCodeBlocks(DeleteAllCodeEffort effort)
+{
+    if (m_collectionScope && effort == DeleteAllCodeIfNotCollecting)
+        return;
+    
+    PreventCollectionScope preventCollectionScope(*this);
+
+    RELEASE_ASSERT(!m_collectionScope);
+    
+    for (ExecutableBase* current : m_executables) {
+        if (!current->isFunctionExecutable())
+            continue;
+        static_cast<FunctionExecutable*>(current)->unlinkedExecutable()->clearCode();
+    }
+}
+
+void Heap::clearUnmarkedExecutables()
+{
+    for (unsigned i = m_executables.size(); i--;) {
+        ExecutableBase* current = m_executables[i];
+        if (isMarked(current))
+            continue;
+
+        // Eagerly dereference the Executable's JITCode in order to run watchpoint
+        // destructors. Otherwise, watchpoints might fire for deleted CodeBlocks.
+        current->clearCode();
+        std::swap(m_executables[i], m_executables.last());
+        m_executables.removeLast();
+    }
+
+    m_executables.shrinkToFit();
+}
+
+void Heap::deleteUnmarkedCompiledCode()
+{
+    clearUnmarkedExecutables();
+    m_codeBlocks->deleteUnmarkedAndUnreferenced(*m_lastCollectionScope);
+    m_jitStubRoutines->deleteUnmarkedJettisonedStubRoutines();
+}
+
+void Heap::addToRememberedSet(const JSCell* constCell)
+{
+    JSCell* cell = const_cast<JSCell*>(constCell);
+    ASSERT(cell);
+    ASSERT(!Options::useConcurrentJIT() || !isCompilationThread());
+    m_barriersExecuted++;
+    if (m_mutatorShouldBeFenced) {
+        WTF::loadLoadFence();
+        if (!isMarkedConcurrently(cell)) {
+            // During a full collection a store into an unmarked object that had surivived past
+            // collections will manifest as a store to an unmarked PossiblyBlack object. If the
+            // object gets marked at some time after this then it will go down the normal marking
+            // path. So, we don't have to remember this object. We could return here. But we go
+            // further and attempt to re-white the object.
+            
+            RELEASE_ASSERT(m_collectionScope == CollectionScope::Full);
+            
+            if (cell->atomicCompareExchangeCellStateStrong(CellState::PossiblyBlack, CellState::DefinitelyWhite) == CellState::PossiblyBlack) {
+                // Now we protect against this race:
+                //
+                //     1) Object starts out black + unmarked.
+                //     --> We do isMarkedConcurrently here.
+                //     2) Object is marked and greyed.
+                //     3) Object is scanned and blacked.
+                //     --> We do atomicCompareExchangeCellStateStrong here.
+                //
+                // In this case we would have made the object white again, even though it should
+                // be black. This check lets us correct our mistake. This relies on the fact that
+                // isMarkedConcurrently converges monotonically to true.
+                if (isMarkedConcurrently(cell)) {
+                    // It's difficult to work out whether the object should be grey or black at
+                    // this point. We say black conservatively.
+                    cell->setCellState(CellState::PossiblyBlack);
+                }
+                
+                // Either way, we can return. Most likely, the object was not marked, and so the
+                // object is now labeled white. This means that future barrier executions will not
+                // fire. In the unlikely event that the object had become marked, we can still
+                // return anyway, since we proved that the object was not marked at the time that
+                // we executed this slow path.
+            }
+            
+            return;
+        }
+    } else
+        ASSERT(Heap::isMarkedConcurrently(cell));
+    // It could be that the object was *just* marked. This means that the collector may set the
+    // state to DefinitelyGrey and then to PossiblyOldOrBlack at any time. It's OK for us to
+    // race with the collector here. If we win then this is accurate because the object _will_
+    // get scanned again. If we lose then someone else will barrier the object again. That would
+    // be unfortunate but not the end of the world.
+    cell->setCellState(CellState::PossiblyGrey);
+    m_mutatorMarkStack->append(cell);
+}
+
+void Heap::collectAllGarbage()
+{
+    if (!m_isSafeToCollect)
+        return;
+    
+    collectSync(CollectionScope::Full);
+
+    DeferGCForAWhile deferGC(*this);
+    if (UNLIKELY(Options::useImmortalObjects()))
+        sweeper()->willFinishSweeping();
+    else {
+        double before = 0;
+        if (Options::logGC()) {
+            dataLog("[Full sweep: ", capacity() / 1024, "kb ");
+            before = currentTimeMS();
+        }
+        m_objectSpace.sweep();
+        m_objectSpace.shrink();
+        if (Options::logGC()) {
+            double after = currentTimeMS();
+            dataLog("=> ", capacity() / 1024, "kb, ", after - before, "ms]\n");
+        }
+    }
+    m_objectSpace.assertNoUnswept();
+
+    sweepAllLogicallyEmptyWeakBlocks();
+}
+
+void Heap::collectAsync(std::optional<CollectionScope> scope)
+{
+    if (!m_isSafeToCollect)
+        return;
+
+    bool alreadyRequested = false;
+    {
+        LockHolder locker(*m_threadLock);
+        for (std::optional<CollectionScope> request : m_requests) {
+            if (scope) {
+                if (scope == CollectionScope::Eden) {
+                    alreadyRequested = true;
+                    break;
+                } else {
+                    RELEASE_ASSERT(scope == CollectionScope::Full);
+                    if (request == CollectionScope::Full) {
+                        alreadyRequested = true;
+                        break;
+                    }
+                }
+            } else {
+                if (!request || request == CollectionScope::Full) {
+                    alreadyRequested = true;
+                    break;
+                }
+            }
+        }
+    }
+    if (alreadyRequested)
+        return;
+
+    requestCollection(scope);
+}
+
+void Heap::collectSync(std::optional<CollectionScope> scope)
+{
+    if (!m_isSafeToCollect)
+        return;
+    
+    waitForCollection(requestCollection(scope));
+}
+
+bool Heap::shouldCollectInThread(const LockHolder&)
+{
+    RELEASE_ASSERT(m_requests.isEmpty() == (m_lastServedTicket == m_lastGrantedTicket));
+    RELEASE_ASSERT(m_lastServedTicket <= m_lastGrantedTicket);
+    
+    return !m_requests.isEmpty();
+}
+
+void Heap::collectInThread()
+{
+    m_currentGCStartTime = MonotonicTime::now();
+    
+    std::optional<CollectionScope> scope;
+    {
+        LockHolder locker(*m_threadLock);
+        RELEASE_ASSERT(!m_requests.isEmpty());
+        scope = m_requests.first();
+    }
+    
+    SuperSamplerScope superSamplerScope(false);
+    TimingScope collectImplTimingScope(scope, "Heap::collectInThread");
+    
+#if ENABLE(ALLOCATION_LOGGING)
+    dataLogF("JSC GC starting collection.\n");
+#endif
+    
+    stopTheWorld();
+    
+    if (false)
+        dataLog("GC START!\n");
+
+    MonotonicTime before;
+    if (Options::logGC()) {
+        dataLog("[GC: START ", capacity() / 1024, "kb ");
+        before = MonotonicTime::now();
+    }
+    
+    double gcStartTime;
+    
+    ASSERT(m_isSafeToCollect);
+    if (m_collectionScope) {
+        dataLog("Collection scope already set during GC: ", *m_collectionScope, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    willStartCollection(scope);
+    collectImplTimingScope.setScope(*this);
+    
+    gcStartTime = WTF::monotonicallyIncreasingTime();
+    if (m_verifier) {
+        // Verify that live objects from the last GC cycle haven't been corrupted by
+        // mutators before we begin this new GC cycle.
+        m_verifier->verify(HeapVerifier::Phase::BeforeGC);
+            
+        m_verifier->initializeGCCycle();
+        m_verifier->gatherLiveObjects(HeapVerifier::Phase::BeforeMarking);
+    }
+    
+    prepareForMarking();
+    
+    markToFixpoint(gcStartTime);
+    
+    if (m_verifier) {
+        m_verifier->gatherLiveObjects(HeapVerifier::Phase::AfterMarking);
+        m_verifier->verify(HeapVerifier::Phase::AfterMarking);
+    }
+        
+    if (vm()->typeProfiler())
+        vm()->typeProfiler()->invalidateTypeSetCache();
+        
+    reapWeakHandles();
+    pruneStaleEntriesFromWeakGCMaps();
+    sweepArrayBuffers();
+    snapshotUnswept();
+    finalizeUnconditionalFinalizers();
+    removeDeadCompilerWorklistEntries();
+    notifyIncrementalSweeper();
+    
+    m_codeBlocks->iterateCurrentlyExecuting(
+        [&] (CodeBlock* codeBlock) {
+            writeBarrier(codeBlock);
+        });
+    m_codeBlocks->clearCurrentlyExecuting();
+        
+    m_objectSpace.prepareForAllocation();
+    updateAllocationLimits();
+
+    didFinishCollection(gcStartTime);
+    
+    if (m_verifier) {
+        m_verifier->trimDeadObjects();
+        m_verifier->verify(HeapVerifier::Phase::AfterGC);
+    }
+
+    if (false) {
+        dataLog("Heap state after GC:\n");
+        m_objectSpace.dumpBits();
+    }
+    
+    if (Options::logGC()) {
+        MonotonicTime after = MonotonicTime::now();
+        double thisPauseMS = (after - m_stopTime).milliseconds();
+        dataLog("p=", thisPauseMS, "ms (max ", maxPauseMS(thisPauseMS), "), cycle ", (after - before).milliseconds(), "ms END]\n");
+    }
+    
+    {
+        LockHolder locker(*m_threadLock);
+        m_requests.removeFirst();
+        m_lastServedTicket++;
+        clearMutatorWaiting();
+    }
+    ParkingLot::unparkAll(&m_worldState);
+
+    if (false)
+        dataLog("GC END!\n");
+
+    setNeedFinalize();
+    resumeTheWorld();
+    
+    m_lastGCStartTime = m_currentGCStartTime;
+    m_lastGCEndTime = MonotonicTime::now();
+}
+
+void Heap::stopTheWorld()
+{
+    RELEASE_ASSERT(!m_collectorBelievesThatTheWorldIsStopped);
+    waitWhileNeedFinalize();
+    stopTheMutator();
+    
+    if (m_mutatorDidRun)
+        m_mutatorExecutionVersion++;
+    
+    m_mutatorDidRun = false;
+    
+    suspendCompilerThreads();
+    m_collectorBelievesThatTheWorldIsStopped = true;
+
+    forEachSlotVisitor(
+        [&] (SlotVisitor& slotVisitor) {
+            slotVisitor.updateMutatorIsStopped(NoLockingNecessary);
+        });
+
+#if ENABLE(JIT)
+    {
+        DeferGCForAWhile awhile(*this);
+        if (JITWorklist::instance()->completeAllForVM(*m_vm))
+            setGCDidJIT();
+    }
+#endif // ENABLE(JIT)
+    
+    vm()->shadowChicken().update(*vm(), vm()->topCallFrame);
+    
+    m_structureIDTable.flushOldTables();
+    m_objectSpace.stopAllocating();
+    
+    m_stopTime = MonotonicTime::now();
+}
+
+void Heap::resumeTheWorld()
+{
+    // Calling resumeAllocating does the Right Thing depending on whether this is the end of a
+    // collection cycle or this is just a concurrent phase within a collection cycle:
+    // - At end of collection cycle: it's a no-op because prepareForAllocation already cleared the
+    //   last active block.
+    // - During collection cycle: it reinstates the last active block.
+    m_objectSpace.resumeAllocating();
+    
+    m_barriersExecuted = 0;
+    
+    RELEASE_ASSERT(m_collectorBelievesThatTheWorldIsStopped);
+    m_collectorBelievesThatTheWorldIsStopped = false;
+    
+    // FIXME: This could be vastly improved: we want to grab the locks in the order in which they
+    // become available. We basically want a lockAny() method that will lock whatever lock is available
+    // and tell you which one it locked. That would require teaching ParkingLot how to park on multiple
+    // queues at once, which is totally achievable - it would just require memory allocation, which is
+    // suboptimal but not a disaster. Alternatively, we could replace the SlotVisitor rightToRun lock
+    // with a DLG-style handshake mechanism, but that seems not as general.
+    Vector<SlotVisitor*, 8> slotVisitorsToUpdate;
+
+    forEachSlotVisitor(
+        [&] (SlotVisitor& slotVisitor) {
+            slotVisitorsToUpdate.append(&slotVisitor);
+        });
+    
+    for (unsigned countdown = 40; !slotVisitorsToUpdate.isEmpty() && countdown--;) {
+        for (unsigned index = 0; index < slotVisitorsToUpdate.size(); ++index) {
+            SlotVisitor& slotVisitor = *slotVisitorsToUpdate[index];
+            bool remove = false;
+            if (slotVisitor.hasAcknowledgedThatTheMutatorIsResumed())
+                remove = true;
+            else if (auto locker = tryHoldLock(slotVisitor.rightToRun())) {
+                slotVisitor.updateMutatorIsStopped(locker);
+                remove = true;
+            }
+            if (remove) {
+                slotVisitorsToUpdate[index--] = slotVisitorsToUpdate.last();
+                slotVisitorsToUpdate.takeLast();
+            }
+        }
+        std::this_thread::yield();
+    }
+    
+    for (SlotVisitor* slotVisitor : slotVisitorsToUpdate)
+        slotVisitor->updateMutatorIsStopped();
+    
+    resumeCompilerThreads();
+    resumeTheMutator();
+}
+
+void Heap::stopTheMutator()
+{
+    for (;;) {
+        unsigned oldState = m_worldState.load();
+        if ((oldState & stoppedBit)
+            && (oldState & shouldStopBit))
+            return;
+        
+        // Note: We could just have the mutator stop in-place like we do when !hasAccessBit. We could
+        // switch to that if it turned out to be less confusing, but then it would not give the
+        // mutator the opportunity to react to the world being stopped.
+        if (oldState & mutatorWaitingBit) {
+            if (m_worldState.compareExchangeWeak(oldState, oldState & ~mutatorWaitingBit))
+                ParkingLot::unparkAll(&m_worldState);
+            continue;
+        }
+        
+        if (!(oldState & hasAccessBit)
+            || (oldState & stoppedBit)) {
+            // We can stop the world instantly.
+            if (m_worldState.compareExchangeWeak(oldState, oldState | stoppedBit | shouldStopBit))
+                return;
+            continue;
+        }
+        
+        RELEASE_ASSERT(oldState & hasAccessBit);
+        RELEASE_ASSERT(!(oldState & stoppedBit));
+        m_worldState.compareExchangeStrong(oldState, oldState | shouldStopBit);
+        m_stopIfNecessaryTimer->scheduleSoon();
+        ParkingLot::compareAndPark(&m_worldState, oldState | shouldStopBit);
+    }
+}
+
+void Heap::resumeTheMutator()
+{
+    for (;;) {
+        unsigned oldState = m_worldState.load();
+        RELEASE_ASSERT(oldState & shouldStopBit);
+        
+        if (!(oldState & hasAccessBit)) {
+            // We can resume the world instantly.
+            if (m_worldState.compareExchangeWeak(oldState, oldState & ~(stoppedBit | shouldStopBit))) {
+                ParkingLot::unparkAll(&m_worldState);
+                return;
+            }
+            continue;
+        }
+        
+        // We can tell the world to resume.
+        if (m_worldState.compareExchangeWeak(oldState, oldState & ~shouldStopBit)) {
+            ParkingLot::unparkAll(&m_worldState);
+            return;
+        }
+    }
+}
+
+void Heap::stopIfNecessarySlow()
+{
+    while (stopIfNecessarySlow(m_worldState.load())) { }
+    
+    RELEASE_ASSERT(m_worldState.load() & hasAccessBit);
+    RELEASE_ASSERT(!(m_worldState.load() & stoppedBit));
+    
+    handleGCDidJIT();
+    handleNeedFinalize();
+    m_mutatorDidRun = true;
+}
+
+bool Heap::stopIfNecessarySlow(unsigned oldState)
+{
+    RELEASE_ASSERT(oldState & hasAccessBit);
+    
+    // It's possible for us to wake up with finalization already requested but the world not yet
+    // resumed. If that happens, we can't run finalization yet.
+    if (!(oldState & stoppedBit)
+        && handleNeedFinalize(oldState))
+        return true;
+    
+    if (!(oldState & shouldStopBit) && !m_scheduler->shouldStop()) {
+        if (!(oldState & stoppedBit))
+            return false;
+        m_worldState.compareExchangeStrong(oldState, oldState & ~stoppedBit);
+        return true;
+    }
+    
+    sanitizeStackForVM(m_vm);
+
+    if (verboseStop) {
+        dataLog("Stopping!\n");
+        WTFReportBacktrace();
+    }
+    m_worldState.compareExchangeStrong(oldState, oldState | stoppedBit);
+    ParkingLot::unparkAll(&m_worldState);
+    ParkingLot::compareAndPark(&m_worldState, oldState | stoppedBit);
+    return true;
+}
+
+template<typename Func>
+void Heap::waitForCollector(const Func& func)
+{
+    for (;;) {
+        bool done;
+        {
+            LockHolder locker(*m_threadLock);
+            done = func(locker);
+            if (!done) {
+                setMutatorWaiting();
+                // At this point, the collector knows that we intend to wait, and he will clear the
+                // waiting bit and then unparkAll when the GC cycle finishes. Clearing the bit
+                // prevents us from parking except if there is also stop-the-world. Unparking after
+                // clearing means that if the clearing happens after we park, then we will unpark.
+            }
+        }
+
+        // If we're in a stop-the-world scenario, we need to wait for that even if done is true.
+        unsigned oldState = m_worldState.load();
+        if (stopIfNecessarySlow(oldState))
+            continue;
+        
+        if (done) {
+            clearMutatorWaiting(); // Clean up just in case.
+            return;
+        }
+        
+        // If mutatorWaitingBit is still set then we want to wait.
+        ParkingLot::compareAndPark(&m_worldState, oldState | mutatorWaitingBit);
+    }
+}
+
+void Heap::acquireAccessSlow()
+{
+    for (;;) {
+        unsigned oldState = m_worldState.load();
+        RELEASE_ASSERT(!(oldState & hasAccessBit));
+        
+        if (oldState & shouldStopBit) {
+            RELEASE_ASSERT(oldState & stoppedBit);
+            if (verboseStop) {
+                dataLog("Stopping in acquireAccess!\n");
+                WTFReportBacktrace();
+            }
+            // Wait until we're not stopped anymore.
+            ParkingLot::compareAndPark(&m_worldState, oldState);
+            continue;
+        }
+        
+        RELEASE_ASSERT(!(oldState & stoppedBit));
+        unsigned newState = oldState | hasAccessBit;
+        if (m_worldState.compareExchangeWeak(oldState, newState)) {
+            handleGCDidJIT();
+            handleNeedFinalize();
+            m_mutatorDidRun = true;
+            return;
+        }
+    }
+}
+
+void Heap::releaseAccessSlow()
+{
+    for (;;) {
+        unsigned oldState = m_worldState.load();
+        RELEASE_ASSERT(oldState & hasAccessBit);
+        RELEASE_ASSERT(!(oldState & stoppedBit));
+        
+        if (handleNeedFinalize(oldState))
+            continue;
+        
+        if (oldState & shouldStopBit) {
+            unsigned newState = (oldState & ~hasAccessBit) | stoppedBit;
+            if (m_worldState.compareExchangeWeak(oldState, newState)) {
+                ParkingLot::unparkAll(&m_worldState);
+                return;
+            }
+            continue;
+        }
+        
+        RELEASE_ASSERT(!(oldState & shouldStopBit));
+        
+        if (m_worldState.compareExchangeWeak(oldState, oldState & ~hasAccessBit))
+            return;
+    }
+}
+
+bool Heap::handleGCDidJIT(unsigned oldState)
+{
+    RELEASE_ASSERT(oldState & hasAccessBit);
+    if (!(oldState & gcDidJITBit))
+        return false;
+    if (m_worldState.compareExchangeWeak(oldState, oldState & ~gcDidJITBit)) {
+        WTF::crossModifyingCodeFence();
+        return true;
+    }
+    return true;
+}
+
+bool Heap::handleNeedFinalize(unsigned oldState)
+{
+    RELEASE_ASSERT(oldState & hasAccessBit);
+    RELEASE_ASSERT(!(oldState & stoppedBit));
+    
+    if (!(oldState & needFinalizeBit))
+        return false;
+    if (m_worldState.compareExchangeWeak(oldState, oldState & ~needFinalizeBit)) {
+        finalize();
+        // Wake up anyone waiting for us to finalize. Note that they may have woken up already, in
+        // which case they would be waiting for us to release heap access.
+        ParkingLot::unparkAll(&m_worldState);
+        return true;
+    }
+    return true;
+}
+
+void Heap::handleGCDidJIT()
+{
+    while (handleGCDidJIT(m_worldState.load())) { }
+}
+
+void Heap::handleNeedFinalize()
+{
+    while (handleNeedFinalize(m_worldState.load())) { }
+}
+
+void Heap::setGCDidJIT()
+{
+    m_worldState.transaction(
+        [&] (unsigned& state) {
+            RELEASE_ASSERT(state & stoppedBit);
+            state |= gcDidJITBit;
+        });
+}
+
+void Heap::setNeedFinalize()
+{
+    m_worldState.exchangeOr(needFinalizeBit);
+    ParkingLot::unparkAll(&m_worldState);
+    m_stopIfNecessaryTimer->scheduleSoon();
+}
+
+void Heap::waitWhileNeedFinalize()
+{
+    for (;;) {
+        unsigned oldState = m_worldState.load();
+        if (!(oldState & needFinalizeBit)) {
+            // This means that either there was no finalize request or the main thread will finalize
+            // with heap access, so a subsequent call to stopTheWorld() will return only when
+            // finalize finishes.
+            return;
+        }
+        ParkingLot::compareAndPark(&m_worldState, oldState);
+    }
+}
+
+void Heap::setMutatorWaiting()
+{
+    m_worldState.exchangeOr(mutatorWaitingBit);
+}
+
+void Heap::clearMutatorWaiting()
+{
+    m_worldState.exchangeAnd(~mutatorWaitingBit);
+}
+
+void Heap::notifyThreadStopping(const LockHolder&)
+{
+    m_threadIsStopping = true;
+    clearMutatorWaiting();
+    ParkingLot::unparkAll(&m_worldState);
+}
+
+void Heap::finalize()
+{
+    {
+        HelpingGCScope helpingGCScope(*this);
+        deleteUnmarkedCompiledCode();
+        deleteSourceProviderCaches();
+        sweepLargeAllocations();
+    }
+    
+    if (HasOwnPropertyCache* cache = vm()->hasOwnPropertyCache())
+        cache->clear();
+}
+
+Heap::Ticket Heap::requestCollection(std::optional<CollectionScope> scope)
+{
+    stopIfNecessary();
+    
+    ASSERT(vm()->currentThreadIsHoldingAPILock());
+    RELEASE_ASSERT(vm()->atomicStringTable() == wtfThreadData().atomicStringTable());
+    
+    LockHolder locker(*m_threadLock);
+    m_requests.append(scope);
+    m_lastGrantedTicket++;
+    m_threadCondition->notifyOne(locker);
+    return m_lastGrantedTicket;
+}
+
+void Heap::waitForCollection(Ticket ticket)
+{
+    waitForCollector(
+        [&] (const LockHolder&) -> bool {
+            return m_lastServedTicket >= ticket;
+        });
+}
+
+void Heap::sweepLargeAllocations()
+{
+    m_objectSpace.sweepLargeAllocations();
+}
+
+void Heap::suspendCompilerThreads()
+{
+#if ENABLE(DFG_JIT)
+    // We ensure the worklists so that it's not possible for the mutator to start a new worklist
+    // after we have suspended the ones that he had started before. That's not very expensive since
+    // the worklists use AutomaticThreads anyway.
+    for (unsigned i = DFG::numberOfWorklists(); i--;)
+        DFG::ensureWorklistForIndex(i).suspendAllThreads();
+#endif
+}
+
+void Heap::willStartCollection(std::optional<CollectionScope> scope)
+{
+    if (Options::logGC())
+        dataLog("=> ");
+    
+    if (shouldDoFullCollection(scope)) {
+        m_collectionScope = CollectionScope::Full;
+        m_shouldDoFullCollection = false;
+        if (Options::logGC())
+            dataLog("FullCollection, ");
+        if (false)
+            dataLog("Full collection!\n");
+    } else {
+        m_collectionScope = CollectionScope::Eden;
+        if (Options::logGC())
+            dataLog("EdenCollection, ");
+        if (false)
+            dataLog("Eden collection!\n");
+    }
+    if (m_collectionScope == CollectionScope::Full) {
+        m_sizeBeforeLastFullCollect = m_sizeAfterLastCollect + m_bytesAllocatedThisCycle;
+        m_extraMemorySize = 0;
+        m_deprecatedExtraMemorySize = 0;
+#if ENABLE(RESOURCE_USAGE)
+        m_externalMemorySize = 0;
+#endif
+
+        if (m_fullActivityCallback)
+            m_fullActivityCallback->willCollect();
+    } else {
+        ASSERT(m_collectionScope == CollectionScope::Eden);
+        m_sizeBeforeLastEdenCollect = m_sizeAfterLastCollect + m_bytesAllocatedThisCycle;
+    }
+
+    if (m_edenActivityCallback)
+        m_edenActivityCallback->willCollect();
+
+    for (auto* observer : m_observers)
+        observer->willGarbageCollect();
+}
+
+void Heap::prepareForMarking()
+{
+    m_objectSpace.prepareForMarking();
+}
+
+void Heap::reapWeakHandles()
+{
+    m_objectSpace.reapWeakSets();
+}
+
+void Heap::pruneStaleEntriesFromWeakGCMaps()
+{
+    if (m_collectionScope != CollectionScope::Full)
+        return;
+    for (auto& pruneCallback : m_weakGCMaps.values())
+        pruneCallback();
+}
+
+void Heap::sweepArrayBuffers()
+{
+    m_arrayBuffers.sweep();
+}
+
+void Heap::snapshotUnswept()
+{
+    TimingScope timingScope(*this, "Heap::snapshotUnswept");
+    m_objectSpace.snapshotUnswept();
+}
+
+void Heap::deleteSourceProviderCaches()
+{
+    m_vm->clearSourceProviderCaches();
+}
+
+void Heap::notifyIncrementalSweeper()
+{
+    if (m_collectionScope == CollectionScope::Full) {
+        if (!m_logicallyEmptyWeakBlocks.isEmpty())
+            m_indexOfNextLogicallyEmptyWeakBlockToSweep = 0;
+    }
+
+    m_sweeper->startSweeping();
+}
+
+void Heap::updateAllocationLimits()
+{
+    static const bool verbose = false;
+    
+    if (verbose) {
+        dataLog("\n");
+        dataLog("bytesAllocatedThisCycle = ", m_bytesAllocatedThisCycle, "\n");
+    }
+    
+    // Calculate our current heap size threshold for the purpose of figuring out when we should
+    // run another collection. This isn't the same as either size() or capacity(), though it should
+    // be somewhere between the two. The key is to match the size calculations involved calls to
+    // didAllocate(), while never dangerously underestimating capacity(). In extreme cases of
+    // fragmentation, we may have size() much smaller than capacity().
+    size_t currentHeapSize = 0;
+
+    // For marked space, we use the total number of bytes visited. This matches the logic for
+    // MarkedAllocator's calls to didAllocate(), which effectively accounts for the total size of
+    // objects allocated rather than blocks used. This will underestimate capacity(), and in case
+    // of fragmentation, this may be substantial. Fortunately, marked space rarely fragments because
+    // cells usually have a narrow range of sizes. So, the underestimation is probably OK.
+    currentHeapSize += m_totalBytesVisited;
+    if (verbose)
+        dataLog("totalBytesVisited = ", m_totalBytesVisited, ", currentHeapSize = ", currentHeapSize, "\n");
+
+    // It's up to the user to ensure that extraMemorySize() ends up corresponding to allocation-time
+    // extra memory reporting.
+    currentHeapSize += extraMemorySize();
+
+    if (verbose)
+        dataLog("extraMemorySize() = ", extraMemorySize(), ", currentHeapSize = ", currentHeapSize, "\n");
+    
+    if (Options::gcMaxHeapSize() && currentHeapSize > Options::gcMaxHeapSize())
+        HeapStatistics::exitWithFailure();
+
+    if (m_collectionScope == CollectionScope::Full) {
+        // To avoid pathological GC churn in very small and very large heaps, we set
+        // the new allocation limit based on the current size of the heap, with a
+        // fixed minimum.
+        m_maxHeapSize = max(minHeapSize(m_heapType, m_ramSize), proportionalHeapSize(currentHeapSize, m_ramSize));
+        if (verbose)
+            dataLog("Full: maxHeapSize = ", m_maxHeapSize, "\n");
+        m_maxEdenSize = m_maxHeapSize - currentHeapSize;
+        if (verbose)
+            dataLog("Full: maxEdenSize = ", m_maxEdenSize, "\n");
+        m_sizeAfterLastFullCollect = currentHeapSize;
+        if (verbose)
+            dataLog("Full: sizeAfterLastFullCollect = ", currentHeapSize, "\n");
+        m_bytesAbandonedSinceLastFullCollect = 0;
+        if (verbose)
+            dataLog("Full: bytesAbandonedSinceLastFullCollect = ", 0, "\n");
+    } else {
+        ASSERT(currentHeapSize >= m_sizeAfterLastCollect);
+        // Theoretically, we shouldn't ever scan more memory than the heap size we planned to have.
+        // But we are sloppy, so we have to defend against the overflow.
+        m_maxEdenSize = currentHeapSize > m_maxHeapSize ? 0 : m_maxHeapSize - currentHeapSize;
+        if (verbose)
+            dataLog("Eden: maxEdenSize = ", m_maxEdenSize, "\n");
+        m_sizeAfterLastEdenCollect = currentHeapSize;
+        if (verbose)
+            dataLog("Eden: sizeAfterLastEdenCollect = ", currentHeapSize, "\n");
+        double edenToOldGenerationRatio = (double)m_maxEdenSize / (double)m_maxHeapSize;
+        double minEdenToOldGenerationRatio = 1.0 / 3.0;
+        if (edenToOldGenerationRatio < minEdenToOldGenerationRatio)
+            m_shouldDoFullCollection = true;
+        // This seems suspect at first, but what it does is ensure that the nursery size is fixed.
+        m_maxHeapSize += currentHeapSize - m_sizeAfterLastCollect;
+        if (verbose)
+            dataLog("Eden: maxHeapSize = ", m_maxHeapSize, "\n");
+        m_maxEdenSize = m_maxHeapSize - currentHeapSize;
+        if (verbose)
+            dataLog("Eden: maxEdenSize = ", m_maxEdenSize, "\n");
+        if (m_fullActivityCallback) {
+            ASSERT(currentHeapSize >= m_sizeAfterLastFullCollect);
+            m_fullActivityCallback->didAllocate(currentHeapSize - m_sizeAfterLastFullCollect);
+        }
+    }
+
+    m_sizeAfterLastCollect = currentHeapSize;
+    if (verbose)
+        dataLog("sizeAfterLastCollect = ", m_sizeAfterLastCollect, "\n");
+    m_bytesAllocatedThisCycle = 0;
+
+    if (Options::logGC())
+        dataLog("=> ", currentHeapSize / 1024, "kb, ");
+}
+
+void Heap::didFinishCollection(double gcStartTime)
+{
+    double gcEndTime = WTF::monotonicallyIncreasingTime();
+    CollectionScope scope = *m_collectionScope;
+    if (scope == CollectionScope::Full)
+        m_lastFullGCLength = gcEndTime - gcStartTime;
+    else
+        m_lastEdenGCLength = gcEndTime - gcStartTime;
+
+#if ENABLE(RESOURCE_USAGE)
+    ASSERT(externalMemorySize() <= extraMemorySize());
+#endif
+
+    if (Options::recordGCPauseTimes())
+        HeapStatistics::recordGCPauseTime(gcStartTime, gcEndTime);
+
+    if (Options::useZombieMode())
+        zombifyDeadObjects();
+
+    if (Options::dumpObjectStatistics())
+        HeapStatistics::dumpObjectStatistics(this);
+
+    if (HeapProfiler* heapProfiler = m_vm->heapProfiler()) {
+        gatherExtraHeapSnapshotData(*heapProfiler);
+        removeDeadHeapSnapshotNodes(*heapProfiler);
+    }
+
+    RELEASE_ASSERT(m_collectionScope);
+    m_lastCollectionScope = m_collectionScope;
+    m_collectionScope = std::nullopt;
+
+    for (auto* observer : m_observers)
+        observer->didGarbageCollect(scope);
+}
+
+void Heap::resumeCompilerThreads()
+{
+#if ENABLE(DFG_JIT)
+    for (unsigned i = DFG::numberOfWorklists(); i--;)
+        DFG::existingWorklistForIndex(i).resumeAllThreads();
+#endif
+}
+
+GCActivityCallback* Heap::fullActivityCallback()
+{
+    return m_fullActivityCallback.get();
+}
+
+GCActivityCallback* Heap::edenActivityCallback()
+{
+    return m_edenActivityCallback.get();
+}
+
+IncrementalSweeper* Heap::sweeper()
+{
+    return m_sweeper.get();
+}
+
+void Heap::setGarbageCollectionTimerEnabled(bool enable)
+{
+    if (m_fullActivityCallback)
+        m_fullActivityCallback->setEnabled(enable);
+    if (m_edenActivityCallback)
+        m_edenActivityCallback->setEnabled(enable);
+}
+
+void Heap::didAllocate(size_t bytes)
+{
+    if (m_edenActivityCallback)
+        m_edenActivityCallback->didAllocate(m_bytesAllocatedThisCycle + m_bytesAbandonedSinceLastFullCollect);
+    m_bytesAllocatedThisCycle += bytes;
+}
+
+bool Heap::isValidAllocation(size_t)
+{
+    if (!isValidThreadState(m_vm))
+        return false;
+
+    if (isCurrentThreadBusy())
+        return false;
+    
+    return true;
+}
+
+void Heap::addFinalizer(JSCell* cell, Finalizer finalizer)
+{
+    WeakSet::allocate(cell, &m_finalizerOwner, reinterpret_cast<void*>(finalizer)); // Balanced by FinalizerOwner::finalize().
+}
+
+void Heap::FinalizerOwner::finalize(Handle<Unknown> handle, void* context)
+{
+    HandleSlot slot = handle.slot();
+    Finalizer finalizer = reinterpret_cast<Finalizer>(context);
+    finalizer(slot->asCell());
+    WeakSet::deallocate(WeakImpl::asWeakImpl(slot));
+}
+
+void Heap::addExecutable(ExecutableBase* executable)
+{
+    m_executables.append(executable);
+}
+
+void Heap::collectAllGarbageIfNotDoneRecently()
+{
+    if (!m_fullActivityCallback) {
+        collectAllGarbage();
+        return;
+    }
+
+    if (m_fullActivityCallback->didSyncGCRecently()) {
+        // A synchronous GC was already requested recently so we merely accelerate next collection.
+        reportAbandonedObjectGraph();
+        return;
+    }
+
+    m_fullActivityCallback->setDidSyncGCRecently();
+    collectAllGarbage();
+}
+
+class Zombify : public MarkedBlock::VoidFunctor {
+public:
+    inline void visit(HeapCell* cell) const
+    {
+        void** current = reinterpret_cast_ptr<void**>(cell);
+
+        // We want to maintain zapped-ness because that's how we know if we've called 
+        // the destructor.
+        if (cell->isZapped())
+            current++;
+
+        void* limit = static_cast<void*>(reinterpret_cast<char*>(cell) + cell->cellSize());
+        for (; current < limit; current++)
+            *current = zombifiedBits;
+    }
+    IterationStatus operator()(HeapCell* cell, HeapCell::Kind) const
+    {
+        visit(cell);
+        return IterationStatus::Continue;
+    }
+};
+
+void Heap::zombifyDeadObjects()
+{
+    // Sweep now because destructors will crash once we're zombified.
+    m_objectSpace.sweep();
+    HeapIterationScope iterationScope(*this);
+    m_objectSpace.forEachDeadCell(iterationScope, Zombify());
+}
+
+bool Heap::shouldDoFullCollection(std::optional<CollectionScope> scope) const
+{
+    if (!Options::useGenerationalGC())
+        return true;
+
+    if (!scope)
+        return m_shouldDoFullCollection;
+    return *scope == CollectionScope::Full;
+}
+
+void Heap::addLogicallyEmptyWeakBlock(WeakBlock* block)
+{
+    m_logicallyEmptyWeakBlocks.append(block);
+}
+
+void Heap::sweepAllLogicallyEmptyWeakBlocks()
+{
+    if (m_logicallyEmptyWeakBlocks.isEmpty())
+        return;
+
+    m_indexOfNextLogicallyEmptyWeakBlockToSweep = 0;
+    while (sweepNextLogicallyEmptyWeakBlock()) { }
+}
+
+bool Heap::sweepNextLogicallyEmptyWeakBlock()
+{
+    if (m_indexOfNextLogicallyEmptyWeakBlockToSweep == WTF::notFound)
+        return false;
+
+    WeakBlock* block = m_logicallyEmptyWeakBlocks[m_indexOfNextLogicallyEmptyWeakBlockToSweep];
+
+    block->sweep();
+    if (block->isEmpty()) {
+        std::swap(m_logicallyEmptyWeakBlocks[m_indexOfNextLogicallyEmptyWeakBlockToSweep], m_logicallyEmptyWeakBlocks.last());
+        m_logicallyEmptyWeakBlocks.removeLast();
+        WeakBlock::destroy(*this, block);
+    } else
+        m_indexOfNextLogicallyEmptyWeakBlockToSweep++;
+
+    if (m_indexOfNextLogicallyEmptyWeakBlockToSweep >= m_logicallyEmptyWeakBlocks.size()) {
+        m_indexOfNextLogicallyEmptyWeakBlockToSweep = WTF::notFound;
+        return false;
+    }
+
+    return true;
+}
+
+size_t Heap::threadVisitCount()
+{       
+    unsigned long result = 0;
+    for (auto& parallelVisitor : m_parallelSlotVisitors)
+        result += parallelVisitor->visitCount();
+    return result;
+}
+
+size_t Heap::bytesVisited()
+{
+    return m_collectorSlotVisitor->bytesVisited() + threadBytesVisited();
+}
+
+size_t Heap::threadBytesVisited()
+{       
+    size_t result = 0;
+    for (auto& parallelVisitor : m_parallelSlotVisitors)
+        result += parallelVisitor->bytesVisited();
+    return result;
+}
+
+void Heap::forEachCodeBlockImpl(const ScopedLambda<bool(CodeBlock*)>& func)
+{
+    // We don't know the full set of CodeBlocks until compilation has terminated.
+    completeAllJITPlans();
+
+    return m_codeBlocks->iterate(func);
+}
+
+void Heap::forEachCodeBlockIgnoringJITPlansImpl(const ScopedLambda<bool(CodeBlock*)>& func)
+{
+    return m_codeBlocks->iterate(func);
+}
+
+void Heap::writeBarrierSlowPath(const JSCell* from)
+{
+    if (UNLIKELY(mutatorShouldBeFenced())) {
+        // In this case, the barrierThreshold is the tautological threshold, so from could still be
+        // not black. But we can't know for sure until we fire off a fence.
+        WTF::storeLoadFence();
+        if (from->cellState() != CellState::PossiblyBlack)
+            return;
+    }
+    
+    addToRememberedSet(from);
+}
+
+bool Heap::isCurrentThreadBusy()
+{
+    return mayBeGCThread() || mutatorState() != MutatorState::Running;
+}
+
+void Heap::reportExtraMemoryVisited(size_t size)
+{
+    size_t* counter = &m_extraMemorySize;
+    
+    for (;;) {
+        size_t oldSize = *counter;
+        if (WTF::atomicCompareExchangeWeakRelaxed(counter, oldSize, oldSize + size))
+            return;
+    }
+}
+
+#if ENABLE(RESOURCE_USAGE)
+void Heap::reportExternalMemoryVisited(size_t size)
+{
+    size_t* counter = &m_externalMemorySize;
+
+    for (;;) {
+        size_t oldSize = *counter;
+        if (WTF::atomicCompareExchangeWeakRelaxed(counter, oldSize, oldSize + size))
+            return;
+    }
+}
+#endif
+
+void Heap::collectIfNecessaryOrDefer(GCDeferralContext* deferralContext)
+{
+    ASSERT(!DisallowGC::isGCDisallowedOnCurrentThread());
+
+    if (!m_isSafeToCollect)
+        return;
+    if (mutatorState() == MutatorState::HelpingGC)
+        return;
+    if (!Options::useGC())
+        return;
+    
+    if (mayNeedToStop()) {
+        if (deferralContext)
+            deferralContext->m_shouldGC = true;
+        else if (isDeferred())
+            m_didDeferGCWork = true;
+        else {
+            stopIfNecessary();
+            // FIXME: Check if the scheduler wants us to stop.
+            // https://bugs.webkit.org/show_bug.cgi?id=166827
+        }
+    }
+    
+    if (UNLIKELY(Options::gcMaxHeapSize())) {
+        if (m_bytesAllocatedThisCycle <= Options::gcMaxHeapSize())
+            return;
+    } else {
+        if (m_bytesAllocatedThisCycle <= m_maxEdenSize)
+            return;
+    }
+
+    if (deferralContext)
+        deferralContext->m_shouldGC = true;
+    else if (isDeferred())
+        m_didDeferGCWork = true;
+    else
+        collectAsync();
+}
+
+void Heap::decrementDeferralDepthAndGCIfNeededSlow()
+{
+    // Can't do anything if we're still deferred.
+    if (m_deferralDepth)
+        return;
+    
+    ASSERT(!isDeferred());
+    
+    m_didDeferGCWork = false;
+    // FIXME: Bring back something like the DeferGCProbability mode.
+    // https://bugs.webkit.org/show_bug.cgi?id=166627
+    collectIfNecessaryOrDefer();
+}
+
+void Heap::registerWeakGCMap(void* weakGCMap, std::function<void()> pruningCallback)
+{
+    m_weakGCMaps.add(weakGCMap, WTFMove(pruningCallback));
+}
+
+void Heap::unregisterWeakGCMap(void* weakGCMap)
+{
+    m_weakGCMaps.remove(weakGCMap);
+}
+
+void Heap::didAllocateBlock(size_t capacity)
+{
+#if ENABLE(RESOURCE_USAGE)
+    m_blockBytesAllocated += capacity;
+#else
+    UNUSED_PARAM(capacity);
+#endif
+}
+
+void Heap::didFreeBlock(size_t capacity)
+{
+#if ENABLE(RESOURCE_USAGE)
+    m_blockBytesAllocated -= capacity;
+#else
+    UNUSED_PARAM(capacity);
+#endif
+}
+
+#if USE(CF)
+void Heap::setRunLoop(CFRunLoopRef runLoop)
+{
+    m_runLoop = runLoop;
+    m_fullActivityCallback->setRunLoop(runLoop);
+    m_edenActivityCallback->setRunLoop(runLoop);
+    m_sweeper->setRunLoop(runLoop);
+}
+#endif // USE(CF)
+
+void Heap::addCoreConstraints()
+{
+    m_constraintSet->add(
+        "Cs", "Conservative Scan",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            TimingScope preConvergenceTimingScope(*this, "Constraint: conservative scan");
+            m_objectSpace.prepareForConservativeScan();
+            ConservativeRoots conservativeRoots(*this);
+            SuperSamplerScope superSamplerScope(false);
+            gatherStackRoots(conservativeRoots);
+            gatherJSStackRoots(conservativeRoots);
+            gatherScratchBufferRoots(conservativeRoots);
+            slotVisitor.append(conservativeRoots);
+        },
+        ConstraintVolatility::GreyedByExecution);
+    
+    m_constraintSet->add(
+        "Msr", "Misc Small Roots",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+#if JSC_OBJC_API_ENABLED
+            scanExternalRememberedSet(*m_vm, slotVisitor);
+#endif
+
+            if (m_vm->smallStrings.needsToBeVisited(*m_collectionScope))
+                m_vm->smallStrings.visitStrongReferences(slotVisitor);
+            
+            for (auto& pair : m_protectedValues)
+                slotVisitor.appendUnbarriered(pair.key);
+            
+            if (m_markListSet && m_markListSet->size())
+                MarkedArgumentBuffer::markLists(slotVisitor, *m_markListSet);
+            
+            slotVisitor.appendUnbarriered(m_vm->exception());
+            slotVisitor.appendUnbarriered(m_vm->lastException());
+        },
+        ConstraintVolatility::GreyedByExecution);
+    
+    m_constraintSet->add(
+        "Sh", "Strong Handles",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            m_handleSet.visitStrongHandles(slotVisitor);
+            m_handleStack.visit(slotVisitor);
+        },
+        ConstraintVolatility::GreyedByExecution);
+    
+    m_constraintSet->add(
+        "D", "Debugger",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+#if ENABLE(SAMPLING_PROFILER)
+            if (SamplingProfiler* samplingProfiler = m_vm->samplingProfiler()) {
+                LockHolder locker(samplingProfiler->getLock());
+                samplingProfiler->processUnverifiedStackTraces();
+                samplingProfiler->visit(slotVisitor);
+                if (Options::logGC() == GCLogging::Verbose)
+                    dataLog("Sampling Profiler data:\n", slotVisitor);
+            }
+#endif // ENABLE(SAMPLING_PROFILER)
+            
+            if (m_vm->typeProfiler())
+                m_vm->typeProfilerLog()->visit(slotVisitor);
+            
+            m_vm->shadowChicken().visitChildren(slotVisitor);
+        },
+        ConstraintVolatility::GreyedByExecution);
+    
+    m_constraintSet->add(
+        "Jsr", "JIT Stub Routines",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            m_jitStubRoutines->traceMarkedStubRoutines(slotVisitor);
+        },
+        ConstraintVolatility::GreyedByExecution);
+    
+    m_constraintSet->add(
+        "Ws", "Weak Sets",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            m_objectSpace.visitWeakSets(slotVisitor);
+        },
+        ConstraintVolatility::GreyedByMarking);
+    
+    m_constraintSet->add(
+        "Wrh", "Weak Reference Harvesters",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            for (WeakReferenceHarvester* current = m_weakReferenceHarvesters.head(); current; current = current->next())
+                current->visitWeakReferences(slotVisitor);
+        },
+        ConstraintVolatility::GreyedByMarking);
+    
+#if ENABLE(DFG_JIT)
+    m_constraintSet->add(
+        "Dw", "DFG Worklists",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            for (unsigned i = DFG::numberOfWorklists(); i--;)
+                DFG::existingWorklistForIndex(i).visitWeakReferences(slotVisitor);
+            
+            // FIXME: This is almost certainly unnecessary.
+            // https://bugs.webkit.org/show_bug.cgi?id=166829
+            DFG::iterateCodeBlocksForGC(
+                *m_vm,
+                [&] (CodeBlock* codeBlock) {
+                    slotVisitor.appendUnbarriered(codeBlock);
+                });
+            
+            if (Options::logGC() == GCLogging::Verbose)
+                dataLog("DFG Worklists:\n", slotVisitor);
+        },
+        ConstraintVolatility::GreyedByMarking);
+#endif
+    
+    m_constraintSet->add(
+        "Cb", "CodeBlocks",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            iterateExecutingAndCompilingCodeBlocksWithoutHoldingLocks(
+                [&] (CodeBlock* codeBlock) {
+                    // Visit the CodeBlock as a constraint only if it's black.
+                    if (Heap::isMarked(codeBlock)
+                        && codeBlock->cellState() == CellState::PossiblyBlack)
+                        slotVisitor.visitAsConstraint(codeBlock);
+                });
+        },
+        ConstraintVolatility::SeldomGreyed);
+    
+    m_constraintSet->add(
+        "Mrms", "Mutator+Race Mark Stack",
+        [this] (SlotVisitor& slotVisitor, const VisitingTimeout&) {
+            // Indicate to the fixpoint that we introduced work!
+            size_t size = m_mutatorMarkStack->size() + m_raceMarkStack->size();
+            slotVisitor.addToVisitCount(size);
+            
+            if (Options::logGC())
+                dataLog("(", size, ")");
+            
+            m_mutatorMarkStack->transferTo(slotVisitor.mutatorMarkStack());
+            m_raceMarkStack->transferTo(slotVisitor.mutatorMarkStack());
+        },
+        [this] (SlotVisitor&) -> double {
+            return m_mutatorMarkStack->size() + m_raceMarkStack->size();
+        },
+        ConstraintVolatility::GreyedByExecution);
+}
+
+void Heap::addMarkingConstraint(std::unique_ptr<MarkingConstraint> constraint)
+{
+    PreventCollectionScope preventCollectionScope(*this);
+    m_constraintSet->add(WTFMove(constraint));
+}
+
+void Heap::notifyIsSafeToCollect()
+{
+    addCoreConstraints();
+    
+    m_isSafeToCollect = true;
+    
+    if (Options::collectContinuously()) {
+        m_collectContinuouslyThread = createThread(
+            "JSC DEBUG Continuous GC",
+            [this] () {
+                MonotonicTime initialTime = MonotonicTime::now();
+                Seconds period = Seconds::fromMilliseconds(Options::collectContinuouslyPeriodMS());
+                while (!m_shouldStopCollectingContinuously) {
+                    {
+                        LockHolder locker(*m_threadLock);
+                        if (m_requests.isEmpty()) {
+                            m_requests.append(std::nullopt);
+                            m_lastGrantedTicket++;
+                            m_threadCondition->notifyOne(locker);
+                        }
+                    }
+                    
+                    {
+                        LockHolder locker(m_collectContinuouslyLock);
+                        Seconds elapsed = MonotonicTime::now() - initialTime;
+                        Seconds elapsedInPeriod = elapsed % period;
+                        MonotonicTime timeToWakeUp =
+                            initialTime + elapsed - elapsedInPeriod + period;
+                        while (!hasElapsed(timeToWakeUp) && !m_shouldStopCollectingContinuously) {
+                            m_collectContinuouslyCondition.waitUntil(
+                                m_collectContinuouslyLock, timeToWakeUp);
+                        }
+                    }
+                }
+            });
+    }
+}
+
+void Heap::preventCollection()
+{
+    if (!m_isSafeToCollect)
+        return;
+    
+    // This prevents the collectContinuously thread from starting a collection.
+    m_collectContinuouslyLock.lock();
+    
+    // Wait for all collections to finish.
+    waitForCollector(
+        [&] (const LockHolder&) -> bool {
+            ASSERT(m_lastServedTicket <= m_lastGrantedTicket);
+            return m_lastServedTicket == m_lastGrantedTicket;
+        });
+    
+    // Now a collection can only start if this thread starts it.
+    RELEASE_ASSERT(!m_collectionScope);
+}
+
+void Heap::allowCollection()
+{
+    if (!m_isSafeToCollect)
+        return;
+    
+    m_collectContinuouslyLock.unlock();
+}
+
+template<typename Func>
+void Heap::forEachSlotVisitor(const Func& func)
+{
+    auto locker = holdLock(m_parallelSlotVisitorLock);
+    func(*m_collectorSlotVisitor);
+    for (auto& slotVisitor : m_parallelSlotVisitors)
+        func(*slotVisitor);
+}
+
+void Heap::setMutatorShouldBeFenced(bool value)
+{
+    m_mutatorShouldBeFenced = value;
+    m_barrierThreshold = value ? tautologicalThreshold : blackThreshold;
+}
+    
+} // namespace JSC
diff --git a/heap/Heap.h b/heap/Heap.h
new file mode 100644
index 0000000..047e2bd
--- /dev/null
+++ b/heap/Heap.h
@@ -0,0 +1,639 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "ArrayBuffer.h"
+#include "CellState.h"
+#include "CollectionScope.h"
+#include "DeleteAllCodeEffort.h"
+#include "GCIncomingRefCountedSet.h"
+#include "HandleSet.h"
+#include "HandleStack.h"
+#include "HeapObserver.h"
+#include "ListableHandler.h"
+#include "MachineStackMarker.h"
+#include "MarkedBlock.h"
+#include "MarkedBlockSet.h"
+#include "MarkedSpace.h"
+#include "MutatorState.h"
+#include "Options.h"
+#include "StructureIDTable.h"
+#include "TinyBloomFilter.h"
+#include "UnconditionalFinalizer.h"
+#include "VisitRaceKey.h"
+#include "WeakHandleOwner.h"
+#include "WeakReferenceHarvester.h"
+#include "WriteBarrierSupport.h"
+#include <wtf/AutomaticThread.h>
+#include <wtf/Deque.h>
+#include <wtf/HashCountedSet.h>
+#include <wtf/HashSet.h>
+#include <wtf/ParallelHelperPool.h>
+
+namespace JSC {
+
+class CodeBlock;
+class CodeBlockSet;
+class GCDeferralContext;
+class EdenGCActivityCallback;
+class ExecutableBase;
+class FullGCActivityCallback;
+class GCActivityCallback;
+class GCAwareJITStubRoutine;
+class Heap;
+class HeapProfiler;
+class HeapVerifier;
+class HelpingGCScope;
+class IncrementalSweeper;
+class JITStubRoutine;
+class JITStubRoutineSet;
+class JSCell;
+class JSValue;
+class LLIntOffsetsExtractor;
+class MarkStackArray;
+class MarkedAllocator;
+class MarkedArgumentBuffer;
+class MarkingConstraint;
+class MarkingConstraintSet;
+class MutatorScheduler;
+class SlotVisitor;
+class SpaceTimeMutatorScheduler;
+class StopIfNecessaryTimer;
+class VM;
+
+namespace DFG {
+class SpeculativeJIT;
+class Worklist;
+}
+
+static void* const zombifiedBits = reinterpret_cast<void*>(static_cast<uintptr_t>(0xdeadbeef));
+
+typedef HashCountedSet<JSCell*> ProtectCountSet;
+typedef HashCountedSet<const char*> TypeCountSet;
+
+enum HeapType { SmallHeap, LargeHeap };
+
+class HeapUtil;
+
+class Heap {
+    WTF_MAKE_NONCOPYABLE(Heap);
+public:
+    friend class JIT;
+    friend class DFG::SpeculativeJIT;
+    static Heap* heap(const JSValue); // 0 for immediate values
+    static Heap* heap(const HeapCell*);
+
+    // This constant determines how many blocks we iterate between checks of our 
+    // deadline when calling Heap::isPagedOut. Decreasing it will cause us to detect 
+    // overstepping our deadline more quickly, while increasing it will cause 
+    // our scan to run faster. 
+    static const unsigned s_timeCheckResolution = 16;
+
+    static bool isMarked(const void*);
+    static bool isMarkedConcurrently(const void*);
+    static bool testAndSetMarked(HeapVersion, const void*);
+    
+    static size_t cellSize(const void*);
+
+    void writeBarrier(const JSCell* from);
+    void writeBarrier(const JSCell* from, JSValue to);
+    void writeBarrier(const JSCell* from, JSCell* to);
+    
+    void writeBarrierWithoutFence(const JSCell* from);
+    
+    void mutatorFence();
+    
+    // Take this if you know that from->cellState() < barrierThreshold.
+    JS_EXPORT_PRIVATE void writeBarrierSlowPath(const JSCell* from);
+
+    Heap(VM*, HeapType);
+    ~Heap();
+    void lastChanceToFinalize();
+    void releaseDelayedReleasedObjects();
+
+    VM* vm() const;
+
+    MarkedSpace& objectSpace() { return m_objectSpace; }
+    MachineThreads& machineThreads() { return m_machineThreads; }
+
+    SlotVisitor& collectorSlotVisitor() { return *m_collectorSlotVisitor; }
+
+    JS_EXPORT_PRIVATE GCActivityCallback* fullActivityCallback();
+    JS_EXPORT_PRIVATE GCActivityCallback* edenActivityCallback();
+    JS_EXPORT_PRIVATE void setGarbageCollectionTimerEnabled(bool);
+
+    JS_EXPORT_PRIVATE IncrementalSweeper* sweeper();
+
+    void addObserver(HeapObserver* observer) { m_observers.append(observer); }
+    void removeObserver(HeapObserver* observer) { m_observers.removeFirst(observer); }
+
+    MutatorState mutatorState() const { return m_mutatorState; }
+    std::optional<CollectionScope> collectionScope() const { return m_collectionScope; }
+    bool hasHeapAccess() const;
+    bool mutatorIsStopped() const;
+    bool collectorBelievesThatTheWorldIsStopped() const;
+
+    // We're always busy on the collection threads. On the main thread, this returns true if we're
+    // helping heap.
+    JS_EXPORT_PRIVATE bool isCurrentThreadBusy();
+    
+    typedef void (*Finalizer)(JSCell*);
+    JS_EXPORT_PRIVATE void addFinalizer(JSCell*, Finalizer);
+    void addExecutable(ExecutableBase*);
+
+    void notifyIsSafeToCollect();
+    bool isSafeToCollect() const { return m_isSafeToCollect; }
+
+    JS_EXPORT_PRIVATE bool isHeapSnapshotting() const;
+
+    JS_EXPORT_PRIVATE void collectAllGarbageIfNotDoneRecently();
+    JS_EXPORT_PRIVATE void collectAllGarbage();
+
+    bool shouldCollectHeuristic();
+    
+    // Queue up a collection. Returns immediately. This will not queue a collection if a collection
+    // of equal or greater strength exists. Full collections are stronger than std::nullopt collections
+    // and std::nullopt collections are stronger than Eden collections. std::nullopt means that the GC can
+    // choose Eden or Full. This implies that if you request a GC while that GC is ongoing, nothing
+    // will happen.
+    JS_EXPORT_PRIVATE void collectAsync(std::optional<CollectionScope> = std::nullopt);
+    
+    // Queue up a collection and wait for it to complete. This won't return until you get your own
+    // complete collection. For example, if there was an ongoing asynchronous collection at the time
+    // you called this, then this would wait for that one to complete and then trigger your
+    // collection and then return. In weird cases, there could be multiple GC requests in the backlog
+    // and this will wait for that backlog before running its GC and returning.
+    JS_EXPORT_PRIVATE void collectSync(std::optional<CollectionScope> = std::nullopt);
+    
+    void collectIfNecessaryOrDefer(GCDeferralContext* = nullptr);
+
+    void completeAllJITPlans();
+    
+    // Use this API to report non-GC memory referenced by GC objects. Be sure to
+    // call both of these functions: Calling only one may trigger catastropic
+    // memory growth.
+    void reportExtraMemoryAllocated(size_t);
+    JS_EXPORT_PRIVATE void reportExtraMemoryVisited(size_t);
+
+#if ENABLE(RESOURCE_USAGE)
+    // Use this API to report the subset of extra memory that lives outside this process.
+    JS_EXPORT_PRIVATE void reportExternalMemoryVisited(size_t);
+    size_t externalMemorySize() { return m_externalMemorySize; }
+#endif
+
+    // Use this API to report non-GC memory if you can't use the better API above.
+    void deprecatedReportExtraMemory(size_t);
+
+    JS_EXPORT_PRIVATE void reportAbandonedObjectGraph();
+
+    JS_EXPORT_PRIVATE void protect(JSValue);
+    JS_EXPORT_PRIVATE bool unprotect(JSValue); // True when the protect count drops to 0.
+    
+    JS_EXPORT_PRIVATE size_t extraMemorySize(); // Non-GC memory referenced by GC objects.
+    JS_EXPORT_PRIVATE size_t size();
+    JS_EXPORT_PRIVATE size_t capacity();
+    JS_EXPORT_PRIVATE size_t objectCount();
+    JS_EXPORT_PRIVATE size_t globalObjectCount();
+    JS_EXPORT_PRIVATE size_t protectedObjectCount();
+    JS_EXPORT_PRIVATE size_t protectedGlobalObjectCount();
+    JS_EXPORT_PRIVATE std::unique_ptr<TypeCountSet> protectedObjectTypeCounts();
+    JS_EXPORT_PRIVATE std::unique_ptr<TypeCountSet> objectTypeCounts();
+
+    HashSet<MarkedArgumentBuffer*>& markListSet();
+    
+    template<typename Functor> void forEachProtectedCell(const Functor&);
+    template<typename Functor> void forEachCodeBlock(const Functor&);
+    template<typename Functor> void forEachCodeBlockIgnoringJITPlans(const Functor&);
+
+    HandleSet* handleSet() { return &m_handleSet; }
+    HandleStack* handleStack() { return &m_handleStack; }
+
+    void willStartIterating();
+    void didFinishIterating();
+
+    double lastFullGCLength() const { return m_lastFullGCLength; }
+    double lastEdenGCLength() const { return m_lastEdenGCLength; }
+    void increaseLastFullGCLength(double amount) { m_lastFullGCLength += amount; }
+
+    size_t sizeBeforeLastEdenCollection() const { return m_sizeBeforeLastEdenCollect; }
+    size_t sizeAfterLastEdenCollection() const { return m_sizeAfterLastEdenCollect; }
+    size_t sizeBeforeLastFullCollection() const { return m_sizeBeforeLastFullCollect; }
+    size_t sizeAfterLastFullCollection() const { return m_sizeAfterLastFullCollect; }
+
+    void deleteAllCodeBlocks(DeleteAllCodeEffort);
+    void deleteAllUnlinkedCodeBlocks(DeleteAllCodeEffort);
+
+    void didAllocate(size_t);
+    bool isPagedOut(double deadline);
+    
+    const JITStubRoutineSet& jitStubRoutines() { return *m_jitStubRoutines; }
+    
+    void addReference(JSCell*, ArrayBuffer*);
+    
+    bool isDeferred() const { return !!m_deferralDepth; }
+
+    StructureIDTable& structureIDTable() { return m_structureIDTable; }
+
+    CodeBlockSet& codeBlockSet() { return *m_codeBlocks; }
+
+#if USE(FOUNDATION)
+    template<typename T> void releaseSoon(RetainPtr<T>&&);
+#endif
+
+    static bool isZombified(JSCell* cell) { return *(void**)cell == zombifiedBits; }
+
+    JS_EXPORT_PRIVATE void registerWeakGCMap(void* weakGCMap, std::function<void()> pruningCallback);
+    JS_EXPORT_PRIVATE void unregisterWeakGCMap(void* weakGCMap);
+
+    void addLogicallyEmptyWeakBlock(WeakBlock*);
+
+#if ENABLE(RESOURCE_USAGE)
+    size_t blockBytesAllocated() const { return m_blockBytesAllocated; }
+#endif
+
+    void didAllocateBlock(size_t capacity);
+    void didFreeBlock(size_t capacity);
+    
+    bool mutatorShouldBeFenced() const { return m_mutatorShouldBeFenced; }
+    const bool* addressOfMutatorShouldBeFenced() const { return &m_mutatorShouldBeFenced; }
+    
+    unsigned barrierThreshold() const { return m_barrierThreshold; }
+    const unsigned* addressOfBarrierThreshold() const { return &m_barrierThreshold; }
+
+    // If true, the GC believes that the mutator is currently messing with the heap. We call this
+    // "having heap access". The GC may block if the mutator is in this state. If false, the GC may
+    // currently be doing things to the heap that make the heap unsafe to access for the mutator.
+    bool hasAccess() const;
+    
+    // If the mutator does not currently have heap access, this function will acquire it. If the GC
+    // is currently using the lack of heap access to do dangerous things to the heap then this
+    // function will block, waiting for the GC to finish. It's not valid to call this if the mutator
+    // already has heap access. The mutator is required to precisely track whether or not it has
+    // heap access.
+    //
+    // It's totally fine to acquireAccess() upon VM instantiation and keep it that way. This is how
+    // WebCore uses us. For most other clients, JSLock does acquireAccess()/releaseAccess() for you.
+    void acquireAccess();
+    
+    // Releases heap access. If the GC is blocking waiting to do bad things to the heap, it will be
+    // allowed to run now.
+    //
+    // Ordinarily, you should use the ReleaseHeapAccessScope to release and then reacquire heap
+    // access. You should do this anytime you're about do perform a blocking operation, like waiting
+    // on the ParkingLot.
+    void releaseAccess();
+    
+    // This is like a super optimized way of saying:
+    //
+    //     releaseAccess()
+    //     acquireAccess()
+    //
+    // The fast path is an inlined relaxed load and branch. The slow path will block the mutator if
+    // the GC wants to do bad things to the heap.
+    //
+    // All allocations logically call this. As an optimization to improve GC progress, you can call
+    // this anywhere that you can afford a load-branch and where an object allocation would have been
+    // safe.
+    //
+    // The GC will also push a stopIfNecessary() event onto the runloop of the thread that
+    // instantiated the VM whenever it wants the mutator to stop. This means that if you never block
+    // but instead use the runloop to wait for events, then you could safely run in a mode where the
+    // mutator has permanent heap access (like the DOM does). If you have good event handling
+    // discipline (i.e. you don't block the runloop) then you can be sure that stopIfNecessary() will
+    // already be called for you at the right times.
+    void stopIfNecessary();
+    
+    bool mayNeedToStop();
+    
+    // This is a much stronger kind of stopping of the collector, and it may require waiting for a
+    // while. This is meant to be a legacy API for clients of collectAllGarbage that expect that there
+    // is no GC before or after that function call. After calling this, you are free to start GCs
+    // yourself but you can be sure that none are running.
+    //
+    // This both prevents new collections from being started asynchronously and waits for any
+    // outstanding collections to complete.
+    void preventCollection();
+    void allowCollection();
+    
+    size_t bytesVisited();
+    
+    uint64_t mutatorExecutionVersion() const { return m_mutatorExecutionVersion; }
+    
+    JS_EXPORT_PRIVATE void addMarkingConstraint(std::unique_ptr<MarkingConstraint>);
+    
+    size_t numOpaqueRoots() const { return m_opaqueRoots.size(); }
+
+#if USE(CF)
+    CFRunLoopRef runLoop() const { return m_runLoop.get(); }
+    JS_EXPORT_PRIVATE void setRunLoop(CFRunLoopRef);
+#endif // USE(CF)
+
+private:
+    friend class AllocatingScope;
+    friend class CodeBlock;
+    friend class DeferGC;
+    friend class DeferGCForAWhile;
+    friend class GCAwareJITStubRoutine;
+    friend class GCLogging;
+    friend class GCThread;
+    friend class HandleSet;
+    friend class HeapUtil;
+    friend class HeapVerifier;
+    friend class HelpingGCScope;
+    friend class JITStubRoutine;
+    friend class LLIntOffsetsExtractor;
+    friend class MarkedSpace;
+    friend class MarkedAllocator;
+    friend class MarkedBlock;
+    friend class SlotVisitor;
+    friend class SpaceTimeMutatorScheduler;
+    friend class StochasticSpaceTimeMutatorScheduler;
+    friend class IncrementalSweeper;
+    friend class HeapStatistics;
+    friend class VM;
+    friend class WeakSet;
+
+    class Thread;
+    friend class Thread;
+
+    static const size_t minExtraMemory = 256;
+    
+    class FinalizerOwner : public WeakHandleOwner {
+        void finalize(Handle<Unknown>, void* context) override;
+    };
+
+    JS_EXPORT_PRIVATE bool isValidAllocation(size_t);
+    JS_EXPORT_PRIVATE void reportExtraMemoryAllocatedSlowCase(size_t);
+    JS_EXPORT_PRIVATE void deprecatedReportExtraMemorySlowCase(size_t);
+    
+    bool shouldCollectInThread(const LockHolder&);
+    void collectInThread();
+    
+    void stopTheWorld();
+    void resumeTheWorld();
+    
+    void stopTheMutator();
+    void resumeTheMutator();
+    
+    void stopIfNecessarySlow();
+    bool stopIfNecessarySlow(unsigned extraStateBits);
+    
+    template<typename Func>
+    void waitForCollector(const Func&);
+    
+    JS_EXPORT_PRIVATE void acquireAccessSlow();
+    JS_EXPORT_PRIVATE void releaseAccessSlow();
+    
+    bool handleGCDidJIT(unsigned);
+    bool handleNeedFinalize(unsigned);
+    void handleGCDidJIT();
+    void handleNeedFinalize();
+    
+    void setGCDidJIT();
+    void setNeedFinalize();
+    void waitWhileNeedFinalize();
+    
+    void setMutatorWaiting();
+    void clearMutatorWaiting();
+    void notifyThreadStopping(const LockHolder&);
+    
+    typedef uint64_t Ticket;
+    Ticket requestCollection(std::optional<CollectionScope>);
+    void waitForCollection(Ticket);
+    
+    void suspendCompilerThreads();
+    void willStartCollection(std::optional<CollectionScope>);
+    void prepareForMarking();
+    
+    void markToFixpoint(double gcStartTime);
+    void gatherStackRoots(ConservativeRoots&);
+    void gatherJSStackRoots(ConservativeRoots&);
+    void gatherScratchBufferRoots(ConservativeRoots&);
+    void beginMarking();
+    void visitCompilerWorklistWeakReferences();
+    void removeDeadCompilerWorklistEntries();
+    void updateObjectCounts(double gcStartTime);
+    void endMarking();
+
+    void reapWeakHandles();
+    void pruneStaleEntriesFromWeakGCMaps();
+    void sweepArrayBuffers();
+    void snapshotUnswept();
+    void deleteSourceProviderCaches();
+    void notifyIncrementalSweeper();
+    void harvestWeakReferences();
+    void finalizeUnconditionalFinalizers();
+    void clearUnmarkedExecutables();
+    void deleteUnmarkedCompiledCode();
+    JS_EXPORT_PRIVATE void addToRememberedSet(const JSCell*);
+    void updateAllocationLimits();
+    void didFinishCollection(double gcStartTime);
+    void resumeCompilerThreads();
+    void zombifyDeadObjects();
+    void gatherExtraHeapSnapshotData(HeapProfiler&);
+    void removeDeadHeapSnapshotNodes(HeapProfiler&);
+    void finalize();
+    void sweepLargeAllocations();
+    
+    void sweepAllLogicallyEmptyWeakBlocks();
+    bool sweepNextLogicallyEmptyWeakBlock();
+
+    bool shouldDoFullCollection(std::optional<CollectionScope> requestedCollectionScope) const;
+
+    void incrementDeferralDepth();
+    void decrementDeferralDepth();
+    void decrementDeferralDepthAndGCIfNeeded();
+    JS_EXPORT_PRIVATE void decrementDeferralDepthAndGCIfNeededSlow();
+
+    size_t threadVisitCount();
+    size_t threadBytesVisited();
+    
+    void forEachCodeBlockImpl(const ScopedLambda<bool(CodeBlock*)>&);
+    void forEachCodeBlockIgnoringJITPlansImpl(const ScopedLambda<bool(CodeBlock*)>&);
+    
+    void setMutatorShouldBeFenced(bool value);
+    
+    void addCoreConstraints();
+    
+    template<typename Func>
+    void iterateExecutingAndCompilingCodeBlocks(const Func&);
+    
+    template<typename Func>
+    void iterateExecutingAndCompilingCodeBlocksWithoutHoldingLocks(const Func&);
+    
+    void assertSharedMarkStacksEmpty();
+
+    const HeapType m_heapType;
+    const size_t m_ramSize;
+    const size_t m_minBytesPerCycle;
+    size_t m_sizeAfterLastCollect;
+    size_t m_sizeAfterLastFullCollect;
+    size_t m_sizeBeforeLastFullCollect;
+    size_t m_sizeAfterLastEdenCollect;
+    size_t m_sizeBeforeLastEdenCollect;
+
+    size_t m_bytesAllocatedThisCycle;
+    size_t m_bytesAbandonedSinceLastFullCollect;
+    size_t m_maxEdenSize;
+    size_t m_maxHeapSize;
+    bool m_shouldDoFullCollection;
+    size_t m_totalBytesVisited;
+    size_t m_totalBytesVisitedThisCycle;
+    
+    std::optional<CollectionScope> m_collectionScope;
+    std::optional<CollectionScope> m_lastCollectionScope;
+    MutatorState m_mutatorState { MutatorState::Running };
+    StructureIDTable m_structureIDTable;
+    MarkedSpace m_objectSpace;
+    GCIncomingRefCountedSet<ArrayBuffer> m_arrayBuffers;
+    size_t m_extraMemorySize;
+    size_t m_deprecatedExtraMemorySize;
+
+    HashSet<const JSCell*> m_copyingRememberedSet;
+
+    ProtectCountSet m_protectedValues;
+    std::unique_ptr<HashSet<MarkedArgumentBuffer*>> m_markListSet;
+
+    MachineThreads m_machineThreads;
+    
+    std::unique_ptr<SlotVisitor> m_collectorSlotVisitor;
+    std::unique_ptr<MarkStackArray> m_mutatorMarkStack;
+
+    Lock m_raceMarkStackLock;
+    std::unique_ptr<MarkStackArray> m_raceMarkStack;
+
+    std::unique_ptr<MarkingConstraintSet> m_constraintSet;
+
+    // We pool the slot visitors used by parallel marking threads. It's useful to be able to
+    // enumerate over them, and it's useful to have them cache some small amount of memory from
+    // one GC to the next. GC marking threads claim these at the start of marking, and return
+    // them at the end.
+    Vector<std::unique_ptr<SlotVisitor>> m_parallelSlotVisitors;
+    Vector<SlotVisitor*> m_availableParallelSlotVisitors;
+    Lock m_parallelSlotVisitorLock;
+    
+    template<typename Func>
+    void forEachSlotVisitor(const Func&);
+
+    HandleSet m_handleSet;
+    HandleStack m_handleStack;
+    std::unique_ptr<CodeBlockSet> m_codeBlocks;
+    std::unique_ptr<JITStubRoutineSet> m_jitStubRoutines;
+    FinalizerOwner m_finalizerOwner;
+    
+    bool m_isSafeToCollect;
+
+    bool m_mutatorShouldBeFenced { Options::forceFencedBarrier() };
+    unsigned m_barrierThreshold { Options::forceFencedBarrier() ? tautologicalThreshold : blackThreshold };
+
+    VM* m_vm;
+    double m_lastFullGCLength;
+    double m_lastEdenGCLength;
+
+    Vector<ExecutableBase*> m_executables;
+
+    Vector<WeakBlock*> m_logicallyEmptyWeakBlocks;
+    size_t m_indexOfNextLogicallyEmptyWeakBlockToSweep { WTF::notFound };
+    
+#if USE(CF)
+    RetainPtr<CFRunLoopRef> m_runLoop;
+#endif // USE(CF)
+    RefPtr<FullGCActivityCallback> m_fullActivityCallback;
+    RefPtr<GCActivityCallback> m_edenActivityCallback;
+    RefPtr<IncrementalSweeper> m_sweeper;
+    RefPtr<StopIfNecessaryTimer> m_stopIfNecessaryTimer;
+
+    Vector<HeapObserver*> m_observers;
+
+    unsigned m_deferralDepth;
+    bool m_didDeferGCWork { false };
+
+    std::unique_ptr<HeapVerifier> m_verifier;
+
+#if USE(FOUNDATION)
+    Vector<RetainPtr<CFTypeRef>> m_delayedReleaseObjects;
+    unsigned m_delayedReleaseRecursionCount;
+#endif
+
+    HashMap<void*, std::function<void()>> m_weakGCMaps;
+    
+    Lock m_visitRaceLock;
+
+    Lock m_markingMutex;
+    Condition m_markingConditionVariable;
+    std::unique_ptr<MarkStackArray> m_sharedCollectorMarkStack;
+    std::unique_ptr<MarkStackArray> m_sharedMutatorMarkStack;
+    unsigned m_numberOfActiveParallelMarkers { 0 };
+    unsigned m_numberOfWaitingParallelMarkers { 0 };
+    bool m_parallelMarkersShouldExit { false };
+
+    Lock m_opaqueRootsMutex;
+    HashSet<const void*> m_opaqueRoots;
+
+    static const size_t s_blockFragmentLength = 32;
+
+    ListableHandler<WeakReferenceHarvester>::List m_weakReferenceHarvesters;
+    ListableHandler<UnconditionalFinalizer>::List m_unconditionalFinalizers;
+
+    ParallelHelperClient m_helperClient;
+
+#if ENABLE(RESOURCE_USAGE)
+    size_t m_blockBytesAllocated { 0 };
+    size_t m_externalMemorySize { 0 };
+#endif
+    
+    std::unique_ptr<MutatorScheduler> m_scheduler;
+    
+    static const unsigned shouldStopBit = 1u << 0u;
+    static const unsigned stoppedBit = 1u << 1u;
+    static const unsigned hasAccessBit = 1u << 2u;
+    static const unsigned gcDidJITBit = 1u << 3u; // Set when the GC did some JITing, so on resume we need to cpuid.
+    static const unsigned needFinalizeBit = 1u << 4u;
+    static const unsigned mutatorWaitingBit = 1u << 5u; // Allows the mutator to use this as a condition variable.
+    Atomic<unsigned> m_worldState;
+    bool m_collectorBelievesThatTheWorldIsStopped { false };
+    MonotonicTime m_stopTime;
+    
+    Deque<std::optional<CollectionScope>> m_requests;
+    Ticket m_lastServedTicket { 0 };
+    Ticket m_lastGrantedTicket { 0 };
+    bool m_threadShouldStop { false };
+    bool m_threadIsStopping { false };
+    bool m_mutatorDidRun { true };
+    uint64_t m_mutatorExecutionVersion { 0 };
+    Box<Lock> m_threadLock;
+    RefPtr<AutomaticThreadCondition> m_threadCondition; // The mutator must not wait on this. It would cause a deadlock.
+    RefPtr<AutomaticThread> m_thread;
+    
+    Lock m_collectContinuouslyLock;
+    Condition m_collectContinuouslyCondition;
+    bool m_shouldStopCollectingContinuously { false };
+    ThreadIdentifier m_collectContinuouslyThread { 0 };
+    
+    MonotonicTime m_lastGCStartTime;
+    MonotonicTime m_lastGCEndTime;
+    MonotonicTime m_currentGCStartTime;
+    
+    uintptr_t m_barriersExecuted { 0 };
+};
+
+} // namespace JSC
diff --git a/heap/HeapCell.cpp b/heap/HeapCell.cpp
new file mode 100644
index 0000000..e3a6597
--- /dev/null
+++ b/heap/HeapCell.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HeapCell.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, HeapCell::Kind kind)
+{
+    switch (kind) {
+    case HeapCell::JSCell:
+        out.print("JSCell");
+        return;
+    case HeapCell::Auxiliary:
+        out.print("Auxiliary");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/heap/HeapCell.h b/heap/HeapCell.h
new file mode 100644
index 0000000..4fd17b4
--- /dev/null
+++ b/heap/HeapCell.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DestructionMode.h"
+
+namespace JSC {
+
+class CellContainer;
+class Heap;
+class LargeAllocation;
+class MarkedBlock;
+class VM;
+struct AllocatorAttributes;
+
+class HeapCell {
+public:
+    enum Kind : int8_t {
+        JSCell,
+        Auxiliary
+    };
+    
+    HeapCell() { }
+    
+    void zap() { *reinterpret_cast_ptr<uintptr_t**>(this) = 0; }
+    bool isZapped() const { return !*reinterpret_cast_ptr<uintptr_t* const*>(this); }
+    
+    bool isLargeAllocation() const;
+    CellContainer cellContainer() const;
+    MarkedBlock& markedBlock() const;
+    LargeAllocation& largeAllocation() const;
+
+    // If you want performance and you know that your cell is small, you can do this instead:
+    // ASSERT(!cell->isLargeAllocation());
+    // cell->markedBlock().vm()
+    // We currently only use this hack for callees to make ExecState::vm() fast. It's not
+    // recommended to use it for too many other things, since the large allocation cutoff is
+    // a runtime option and its default value is small (400 bytes).
+    Heap* heap() const;
+    VM* vm() const;
+    
+    size_t cellSize() const;
+    AllocatorAttributes allocatorAttributes() const;
+    DestructionMode destructionMode() const;
+    Kind cellKind() const;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::HeapCell::Kind);
+
+} // namespace WTF
+
diff --git a/heap/HeapCellInlines.h b/heap/HeapCellInlines.h
new file mode 100644
index 0000000..c2d909f
--- /dev/null
+++ b/heap/HeapCellInlines.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CellContainer.h"
+#include "HeapCell.h"
+#include "LargeAllocation.h"
+#include "MarkedBlock.h"
+#include "VM.h"
+
+namespace JSC {
+
+ALWAYS_INLINE bool HeapCell::isLargeAllocation() const
+{
+    return LargeAllocation::isLargeAllocation(const_cast<HeapCell*>(this));
+}
+
+ALWAYS_INLINE CellContainer HeapCell::cellContainer() const
+{
+    if (isLargeAllocation())
+        return largeAllocation();
+    return markedBlock();
+}
+
+ALWAYS_INLINE MarkedBlock& HeapCell::markedBlock() const
+{
+    return *MarkedBlock::blockFor(this);
+}
+
+ALWAYS_INLINE LargeAllocation& HeapCell::largeAllocation() const
+{
+    return *LargeAllocation::fromCell(const_cast<HeapCell*>(this));
+}
+
+ALWAYS_INLINE Heap* HeapCell::heap() const
+{
+    return &vm()->heap;
+}
+
+ALWAYS_INLINE VM* HeapCell::vm() const
+{
+    if (isLargeAllocation())
+        return largeAllocation().vm();
+    return markedBlock().vm();
+}
+    
+ALWAYS_INLINE size_t HeapCell::cellSize() const
+{
+    if (isLargeAllocation())
+        return largeAllocation().cellSize();
+    return markedBlock().cellSize();
+}
+
+ALWAYS_INLINE AllocatorAttributes HeapCell::allocatorAttributes() const
+{
+    if (isLargeAllocation())
+        return largeAllocation().attributes();
+    return markedBlock().attributes();
+}
+
+ALWAYS_INLINE DestructionMode HeapCell::destructionMode() const
+{
+    return allocatorAttributes().destruction;
+}
+
+ALWAYS_INLINE HeapCell::Kind HeapCell::cellKind() const
+{
+    return allocatorAttributes().cellKind;
+}
+
+} // namespace JSC
+
diff --git a/heap/HeapHelperPool.cpp b/heap/HeapHelperPool.cpp
new file mode 100644
index 0000000..791aa75
--- /dev/null
+++ b/heap/HeapHelperPool.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HeapHelperPool.h"
+
+#include <mutex>
+#include "Options.h"
+
+namespace JSC {
+
+ParallelHelperPool& heapHelperPool()
+{
+    static std::once_flag initializeHelperPoolOnceFlag;
+    static ParallelHelperPool* helperPool;
+    std::call_once(
+        initializeHelperPoolOnceFlag,
+        [] {
+            helperPool = new ParallelHelperPool();
+            helperPool->ensureThreads(Options::numberOfGCMarkers() - 1);
+        });
+    return *helperPool;
+}
+
+} // namespace JSC
diff --git a/heap/HeapHelperPool.h b/heap/HeapHelperPool.h
new file mode 100644
index 0000000..098d9e5
--- /dev/null
+++ b/heap/HeapHelperPool.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/ParallelHelperPool.h>
+
+namespace JSC {
+
+ParallelHelperPool& heapHelperPool();
+
+} // namespace JSC
diff --git a/heap/HeapInlines.h b/heap/HeapInlines.h
new file mode 100644
index 0000000..6652f4f
--- /dev/null
+++ b/heap/HeapInlines.h
@@ -0,0 +1,288 @@
+/*
+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GCDeferralContext.h"
+#include "Heap.h"
+#include "HeapCellInlines.h"
+#include "IndexingHeader.h"
+#include "JSCallee.h"
+#include "JSCell.h"
+#include "Structure.h"
+#include <type_traits>
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
+#include <wtf/RandomNumber.h>
+
+namespace JSC {
+
+ALWAYS_INLINE VM* Heap::vm() const
+{
+    return bitwise_cast<VM*>(bitwise_cast<uintptr_t>(this) - OBJECT_OFFSETOF(VM, heap));
+}
+
+ALWAYS_INLINE Heap* Heap::heap(const HeapCell* cell)
+{
+    return cell->heap();
+}
+
+inline Heap* Heap::heap(const JSValue v)
+{
+    if (!v.isCell())
+        return 0;
+    return heap(v.asCell());
+}
+
+inline bool Heap::hasHeapAccess() const
+{
+    return m_worldState.load() & hasAccessBit;
+}
+
+inline bool Heap::mutatorIsStopped() const
+{
+    unsigned state = m_worldState.load();
+    bool shouldStop = state & shouldStopBit;
+    bool stopped = state & stoppedBit;
+    // I only got it right when I considered all four configurations of shouldStop/stopped:
+    // !shouldStop, !stopped: The GC has not requested that we stop and we aren't stopped, so we
+    //     should return false.
+    // !shouldStop, stopped: The mutator is still stopped but the GC is done and the GC has requested
+    //     that we resume, so we should return false.
+    // shouldStop, !stopped: The GC called stopTheWorld() but the mutator hasn't hit a safepoint yet.
+    //     The mutator should be able to do whatever it wants in this state, as if we were not
+    //     stopped. So return false.
+    // shouldStop, stopped: The GC requested stop the world and the mutator obliged. The world is
+    //     stopped, so return true.
+    return shouldStop & stopped;
+}
+
+inline bool Heap::collectorBelievesThatTheWorldIsStopped() const
+{
+    return m_collectorBelievesThatTheWorldIsStopped;
+}
+
+ALWAYS_INLINE bool Heap::isMarked(const void* rawCell)
+{
+    ASSERT(mayBeGCThread() != GCThreadType::Helper);
+    HeapCell* cell = bitwise_cast<HeapCell*>(rawCell);
+    if (cell->isLargeAllocation())
+        return cell->largeAllocation().isMarked();
+    MarkedBlock& block = cell->markedBlock();
+    return block.isMarked(
+        block.vm()->heap.objectSpace().markingVersion(), cell);
+}
+
+ALWAYS_INLINE bool Heap::isMarkedConcurrently(const void* rawCell)
+{
+    HeapCell* cell = bitwise_cast<HeapCell*>(rawCell);
+    if (cell->isLargeAllocation())
+        return cell->largeAllocation().isMarked();
+    MarkedBlock& block = cell->markedBlock();
+    return block.isMarkedConcurrently(
+        block.vm()->heap.objectSpace().markingVersion(), cell);
+}
+
+ALWAYS_INLINE bool Heap::testAndSetMarked(HeapVersion markingVersion, const void* rawCell)
+{
+    HeapCell* cell = bitwise_cast<HeapCell*>(rawCell);
+    if (cell->isLargeAllocation())
+        return cell->largeAllocation().testAndSetMarked();
+    MarkedBlock& block = cell->markedBlock();
+    block.aboutToMark(markingVersion);
+    return block.testAndSetMarked(cell);
+}
+
+ALWAYS_INLINE size_t Heap::cellSize(const void* rawCell)
+{
+    return bitwise_cast<HeapCell*>(rawCell)->cellSize();
+}
+
+inline void Heap::writeBarrier(const JSCell* from, JSValue to)
+{
+#if ENABLE(WRITE_BARRIER_PROFILING)
+    WriteBarrierCounters::countWriteBarrier();
+#endif
+    if (!to.isCell())
+        return;
+    writeBarrier(from, to.asCell());
+}
+
+inline void Heap::writeBarrier(const JSCell* from, JSCell* to)
+{
+#if ENABLE(WRITE_BARRIER_PROFILING)
+    WriteBarrierCounters::countWriteBarrier();
+#endif
+    if (!from)
+        return;
+    if (!isWithinThreshold(from->cellState(), barrierThreshold()))
+        return;
+    if (LIKELY(!to))
+        return;
+    writeBarrierSlowPath(from);
+}
+
+inline void Heap::writeBarrier(const JSCell* from)
+{
+    ASSERT_GC_OBJECT_LOOKS_VALID(const_cast<JSCell*>(from));
+    if (!from)
+        return;
+    if (UNLIKELY(isWithinThreshold(from->cellState(), barrierThreshold())))
+        writeBarrierSlowPath(from);
+}
+
+inline void Heap::writeBarrierWithoutFence(const JSCell* from)
+{
+    ASSERT_GC_OBJECT_LOOKS_VALID(const_cast<JSCell*>(from));
+    if (!from)
+        return;
+    if (UNLIKELY(isWithinThreshold(from->cellState(), blackThreshold)))
+        addToRememberedSet(from);
+}
+
+inline void Heap::mutatorFence()
+{
+    if (isX86() || UNLIKELY(mutatorShouldBeFenced()))
+        WTF::storeStoreFence();
+}
+
+template<typename Functor> inline void Heap::forEachCodeBlock(const Functor& func)
+{
+    forEachCodeBlockImpl(scopedLambdaRef<bool(CodeBlock*)>(func));
+}
+
+template<typename Functor> inline void Heap::forEachCodeBlockIgnoringJITPlans(const Functor& func)
+{
+    forEachCodeBlockIgnoringJITPlansImpl(scopedLambdaRef<bool(CodeBlock*)>(func));
+}
+
+template<typename Functor> inline void Heap::forEachProtectedCell(const Functor& functor)
+{
+    for (auto& pair : m_protectedValues)
+        functor(pair.key);
+    m_handleSet.forEachStrongHandle(functor, m_protectedValues);
+}
+
+#if USE(FOUNDATION)
+template <typename T>
+inline void Heap::releaseSoon(RetainPtr<T>&& object)
+{
+    m_delayedReleaseObjects.append(WTFMove(object));
+}
+#endif
+
+inline void Heap::incrementDeferralDepth()
+{
+    ASSERT(!mayBeGCThread() || m_collectorBelievesThatTheWorldIsStopped);
+    m_deferralDepth++;
+}
+
+inline void Heap::decrementDeferralDepth()
+{
+    ASSERT(!mayBeGCThread() || m_collectorBelievesThatTheWorldIsStopped);
+    m_deferralDepth--;
+}
+
+inline void Heap::decrementDeferralDepthAndGCIfNeeded()
+{
+    ASSERT(!mayBeGCThread() || m_collectorBelievesThatTheWorldIsStopped);
+    m_deferralDepth--;
+    
+    if (UNLIKELY(m_didDeferGCWork)) {
+        decrementDeferralDepthAndGCIfNeededSlow();
+        
+        // Here are the possible relationships between m_deferralDepth and m_didDeferGCWork.
+        // Note that prior to the call to decrementDeferralDepthAndGCIfNeededSlow,
+        // m_didDeferGCWork had to have been true. Now it can be either false or true. There is
+        // nothing we can reliably assert.
+        //
+        // Possible arrangements of m_didDeferGCWork and !!m_deferralDepth:
+        //
+        // Both false: We popped out of all DeferGCs and we did whatever work was deferred.
+        //
+        // Only m_didDeferGCWork is true: We stopped for GC and the GC did DeferGC. This is
+        // possible because of how we handle the baseline JIT's worklist. It's also perfectly
+        // safe because it only protects reportExtraMemory. We can just ignore this.
+        //
+        // Only !!m_deferralDepth is true: m_didDeferGCWork had been set spuriously. It is only
+        // cleared by decrementDeferralDepthAndGCIfNeededSlow(). So, if we had deferred work but
+        // then decrementDeferralDepth()'d, then we might have the bit set even if we GC'd since
+        // then.
+        //
+        // Both true: We're in a recursive ~DeferGC. We wanted to do something about the
+        // deferred work, but were unable to.
+    }
+}
+
+inline HashSet<MarkedArgumentBuffer*>& Heap::markListSet()
+{
+    if (!m_markListSet)
+        m_markListSet = std::make_unique<HashSet<MarkedArgumentBuffer*>>();
+    return *m_markListSet;
+}
+
+inline void Heap::reportExtraMemoryAllocated(size_t size)
+{
+    if (size > minExtraMemory) 
+        reportExtraMemoryAllocatedSlowCase(size);
+}
+
+inline void Heap::deprecatedReportExtraMemory(size_t size)
+{
+    if (size > minExtraMemory) 
+        deprecatedReportExtraMemorySlowCase(size);
+}
+
+inline void Heap::acquireAccess()
+{
+    if (m_worldState.compareExchangeWeak(0, hasAccessBit))
+        return;
+    acquireAccessSlow();
+}
+
+inline bool Heap::hasAccess() const
+{
+    return m_worldState.loadRelaxed() & hasAccessBit;
+}
+
+inline void Heap::releaseAccess()
+{
+    if (m_worldState.compareExchangeWeak(hasAccessBit, 0))
+        return;
+    releaseAccessSlow();
+}
+
+inline bool Heap::mayNeedToStop()
+{
+    return m_worldState.loadRelaxed() != hasAccessBit;
+}
+
+inline void Heap::stopIfNecessary()
+{
+    if (mayNeedToStop())
+        stopIfNecessarySlow();
+}
+
+} // namespace JSC
diff --git a/heap/HeapIterationScope.h b/heap/HeapIterationScope.h
new file mode 100644
index 0000000..c70fa99
--- /dev/null
+++ b/heap/HeapIterationScope.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Heap.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class HeapIterationScope {
+    WTF_MAKE_NONCOPYABLE(HeapIterationScope);
+public:
+    HeapIterationScope(Heap&);
+    ~HeapIterationScope();
+
+private:
+    Heap& m_heap;
+};
+
+inline HeapIterationScope::HeapIterationScope(Heap& heap)
+    : m_heap(heap)
+{
+    m_heap.willStartIterating();
+}
+
+inline HeapIterationScope::~HeapIterationScope()
+{
+    m_heap.didFinishIterating();
+}
+
+} // namespace JSC
diff --git a/heap/HeapObserver.h b/heap/HeapObserver.h
new file mode 100644
index 0000000..ccbb7e6
--- /dev/null
+++ b/heap/HeapObserver.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CollectionScope.h"
+
+namespace JSC {
+
+class HeapObserver {
+public:
+    virtual ~HeapObserver() { }
+    virtual void willGarbageCollect() = 0;
+    virtual void didGarbageCollect(CollectionScope) = 0;
+};
+
+} // namespace JSC
diff --git a/heap/HeapProfiler.cpp b/heap/HeapProfiler.cpp
new file mode 100644
index 0000000..d4681b5
--- /dev/null
+++ b/heap/HeapProfiler.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HeapProfiler.h"
+
+#include "HeapSnapshot.h"
+#include "VM.h"
+
+namespace JSC {
+
+HeapProfiler::HeapProfiler(VM& vm)
+    : m_vm(vm)
+{
+}
+
+HeapProfiler::~HeapProfiler()
+{
+}
+
+HeapSnapshot* HeapProfiler::mostRecentSnapshot()
+{
+    if (m_snapshots.isEmpty())
+        return nullptr;
+    return m_snapshots.last().get();
+}
+
+void HeapProfiler::appendSnapshot(std::unique_ptr<HeapSnapshot> snapshot)
+{
+    m_snapshots.append(WTFMove(snapshot));
+}
+
+void HeapProfiler::clearSnapshots()
+{
+    m_snapshots.clear();
+}
+
+void HeapProfiler::setActiveSnapshotBuilder(HeapSnapshotBuilder* builder)
+{
+    ASSERT(!!m_activeBuilder != !!builder);
+    m_activeBuilder = builder;
+}
+
+} // namespace JSC
diff --git a/heap/HeapProfiler.h b/heap/HeapProfiler.h
new file mode 100644
index 0000000..0a068fa
--- /dev/null
+++ b/heap/HeapProfiler.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class HeapSnapshot;
+class HeapSnapshotBuilder;
+class VM;
+
+class HeapProfiler {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    HeapProfiler(VM&);
+    ~HeapProfiler();
+
+    VM& vm() const { return m_vm; }
+
+    HeapSnapshot* mostRecentSnapshot();
+    void appendSnapshot(std::unique_ptr<HeapSnapshot>);
+    void clearSnapshots();
+
+    HeapSnapshotBuilder* activeSnapshotBuilder() const { return m_activeBuilder; }
+    void setActiveSnapshotBuilder(HeapSnapshotBuilder*);
+
+private:
+    VM& m_vm;
+    Vector<std::unique_ptr<HeapSnapshot>> m_snapshots;
+    HeapSnapshotBuilder* m_activeBuilder { nullptr };
+};
+
+} // namespace JSC
diff --git a/heap/HeapSnapshot.cpp b/heap/HeapSnapshot.cpp
new file mode 100644
index 0000000..34db12c
--- /dev/null
+++ b/heap/HeapSnapshot.cpp
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HeapSnapshot.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+HeapSnapshot::HeapSnapshot(HeapSnapshot* previousSnapshot)
+    : m_previous(previousSnapshot)
+{
+}
+
+HeapSnapshot::~HeapSnapshot()
+{
+}
+
+void HeapSnapshot::appendNode(const HeapSnapshotNode& node)
+{
+    ASSERT(!m_finalized);
+    ASSERT(!m_previous || !m_previous->nodeForCell(node.cell));
+
+    m_nodes.append(node);
+    m_filter.add(bitwise_cast<uintptr_t>(node.cell));
+}
+
+void HeapSnapshot::sweepCell(JSCell* cell)
+{
+    ASSERT(cell);
+
+    if (m_finalized && !m_filter.ruleOut(bitwise_cast<uintptr_t>(cell))) {
+        ASSERT_WITH_MESSAGE(!isEmpty(), "Our filter should have ruled us out if we are empty.");
+        unsigned start = 0;
+        unsigned end = m_nodes.size();
+        while (start != end) {
+            unsigned middle = start + ((end - start) / 2);
+            HeapSnapshotNode& node = m_nodes[middle];
+            if (cell == node.cell) {
+                // Cells should always have 0 as low bits.
+                // Mark this cell for removal by setting the low bit.
+                ASSERT(!(reinterpret_cast<intptr_t>(node.cell) & CellToSweepTag));
+                node.cell = reinterpret_cast<JSCell*>(reinterpret_cast<intptr_t>(node.cell) | CellToSweepTag);
+                m_hasCellsToSweep = true;
+                return;
+            }
+            if (cell < node.cell)
+                end = middle;
+            else
+                start = middle + 1;
+        }
+    }
+
+    if (m_previous)
+        m_previous->sweepCell(cell);
+}
+
+void HeapSnapshot::shrinkToFit()
+{
+    if (m_finalized && m_hasCellsToSweep) {
+        m_filter.reset();
+        m_nodes.removeAllMatching(
+            [&] (const HeapSnapshotNode& node) -> bool {
+                bool willRemoveCell = bitwise_cast<intptr_t>(node.cell) & CellToSweepTag;
+                if (!willRemoveCell)
+                    m_filter.add(bitwise_cast<uintptr_t>(node.cell));
+                return willRemoveCell;
+            });
+        m_nodes.shrinkToFit();
+        m_hasCellsToSweep = false;
+    }
+
+    if (m_previous)
+        m_previous->shrinkToFit();
+}
+
+void HeapSnapshot::finalize()
+{
+    ASSERT(!m_finalized);
+    m_finalized = true;
+
+    // Nodes are appended to the snapshot in identifier order.
+    // Now that we have the complete list of nodes we will sort
+    // them in a different order. Remember the range of identifiers
+    // in this snapshot.
+    if (!isEmpty()) {
+        m_firstObjectIdentifier = m_nodes.first().identifier;
+        m_lastObjectIdentifier = m_nodes.last().identifier;
+    }
+
+    std::sort(m_nodes.begin(), m_nodes.end(), [] (const HeapSnapshotNode& a, const HeapSnapshotNode& b) {
+        return a.cell < b.cell;
+    });
+
+#ifndef NDEBUG
+    // Assert there are no duplicates or nullptr cells.
+    JSCell* previousCell = nullptr;
+    for (auto& node : m_nodes) {
+        ASSERT(node.cell);
+        ASSERT(!(reinterpret_cast<intptr_t>(node.cell) & CellToSweepTag));
+        if (node.cell == previousCell) {
+            dataLog("Seeing same cell twice: ", RawPointer(previousCell), "\n");
+            ASSERT(node.cell != previousCell);
+        }
+        previousCell = node.cell;
+    }
+#endif
+}
+
+std::optional<HeapSnapshotNode> HeapSnapshot::nodeForCell(JSCell* cell)
+{
+    ASSERT(m_finalized);
+
+    if (!m_filter.ruleOut(bitwise_cast<uintptr_t>(cell))) {
+        ASSERT_WITH_MESSAGE(!isEmpty(), "Our filter should have ruled us out if we are empty.");
+        unsigned start = 0;
+        unsigned end = m_nodes.size();
+        while (start != end) {
+            unsigned middle = start + ((end - start) / 2);
+            HeapSnapshotNode& node = m_nodes[middle];
+            if (cell == node.cell)
+                return std::optional<HeapSnapshotNode>(node);
+            if (cell < node.cell)
+                end = middle;
+            else
+                start = middle + 1;
+        }
+    }
+
+    if (m_previous)
+        return m_previous->nodeForCell(cell);
+
+    return std::nullopt;
+}
+
+std::optional<HeapSnapshotNode> HeapSnapshot::nodeForObjectIdentifier(unsigned objectIdentifier)
+{
+    if (isEmpty()) {
+        if (m_previous)
+            return m_previous->nodeForObjectIdentifier(objectIdentifier);
+        return std::nullopt;
+    }
+
+    if (objectIdentifier > m_lastObjectIdentifier)
+        return std::nullopt;
+
+    if (objectIdentifier < m_firstObjectIdentifier) {
+        if (m_previous)
+            return m_previous->nodeForObjectIdentifier(objectIdentifier);
+        return std::nullopt;
+    }
+
+    for (auto& node : m_nodes) {
+        if (node.identifier == objectIdentifier)
+            return std::optional<HeapSnapshotNode>(node);
+    }
+
+    return std::nullopt;
+}
+
+} // namespace JSC
diff --git a/heap/HeapSnapshot.h b/heap/HeapSnapshot.h
new file mode 100644
index 0000000..fdd3de3
--- /dev/null
+++ b/heap/HeapSnapshot.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "HeapSnapshotBuilder.h"
+#include "TinyBloomFilter.h"
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+class HeapSnapshot {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    HeapSnapshot(HeapSnapshot*);
+    ~HeapSnapshot();
+
+    HeapSnapshot* previous() const { return m_previous; }
+
+    void appendNode(const HeapSnapshotNode&);
+    void sweepCell(JSCell*);
+    void shrinkToFit();
+    void finalize();
+
+    bool isEmpty() const { return m_nodes.isEmpty(); }
+    std::optional<HeapSnapshotNode> nodeForCell(JSCell*);
+    std::optional<HeapSnapshotNode> nodeForObjectIdentifier(unsigned objectIdentifier);
+
+private:
+    friend class HeapSnapshotBuilder;
+    static const intptr_t CellToSweepTag = 1;
+
+    Vector<HeapSnapshotNode> m_nodes;
+    TinyBloomFilter m_filter;
+    HeapSnapshot* m_previous { nullptr };
+    unsigned m_firstObjectIdentifier { 0 };
+    unsigned m_lastObjectIdentifier { 0 };
+    bool m_finalized { false };
+    bool m_hasCellsToSweep { false };
+};
+
+} // namespace JSC
diff --git a/heap/HeapSnapshotBuilder.cpp b/heap/HeapSnapshotBuilder.cpp
new file mode 100644
index 0000000..3196b4b
--- /dev/null
+++ b/heap/HeapSnapshotBuilder.cpp
@@ -0,0 +1,393 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HeapSnapshotBuilder.h"
+
+#include "DeferGC.h"
+#include "Heap.h"
+#include "HeapProfiler.h"
+#include "HeapSnapshot.h"
+#include "JSCInlines.h"
+#include "JSCell.h"
+#include "PreventCollectionScope.h"
+#include "VM.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+    
+unsigned HeapSnapshotBuilder::nextAvailableObjectIdentifier = 1;
+unsigned HeapSnapshotBuilder::getNextObjectIdentifier() { return nextAvailableObjectIdentifier++; }
+void HeapSnapshotBuilder::resetNextAvailableObjectIdentifier() { HeapSnapshotBuilder::nextAvailableObjectIdentifier = 1; }
+
+HeapSnapshotBuilder::HeapSnapshotBuilder(HeapProfiler& profiler)
+    : m_profiler(profiler)
+{
+}
+
+HeapSnapshotBuilder::~HeapSnapshotBuilder()
+{
+}
+
+void HeapSnapshotBuilder::buildSnapshot()
+{
+    PreventCollectionScope preventCollectionScope(m_profiler.vm().heap);
+    
+    m_snapshot = std::make_unique<HeapSnapshot>(m_profiler.mostRecentSnapshot());
+    {
+        m_profiler.setActiveSnapshotBuilder(this);
+        m_profiler.vm().heap.collectAllGarbage();
+        m_profiler.setActiveSnapshotBuilder(nullptr);
+    }
+    m_snapshot->finalize();
+
+    m_profiler.appendSnapshot(WTFMove(m_snapshot));
+}
+
+void HeapSnapshotBuilder::appendNode(JSCell* cell)
+{
+    ASSERT(m_profiler.activeSnapshotBuilder() == this);
+    ASSERT(Heap::isMarkedConcurrently(cell));
+
+    if (hasExistingNodeForCell(cell))
+        return;
+
+    std::lock_guard<Lock> lock(m_buildingNodeMutex);
+
+    m_snapshot->appendNode(HeapSnapshotNode(cell, getNextObjectIdentifier()));
+}
+
+void HeapSnapshotBuilder::appendEdge(JSCell* from, JSCell* to)
+{
+    ASSERT(m_profiler.activeSnapshotBuilder() == this);
+    ASSERT(to);
+
+    // Avoid trivial edges.
+    if (from == to)
+        return;
+
+    std::lock_guard<Lock> lock(m_buildingEdgeMutex);
+
+    m_edges.append(HeapSnapshotEdge(from, to));
+}
+
+void HeapSnapshotBuilder::appendPropertyNameEdge(JSCell* from, JSCell* to, UniquedStringImpl* propertyName)
+{
+    ASSERT(m_profiler.activeSnapshotBuilder() == this);
+    ASSERT(to);
+
+    std::lock_guard<Lock> lock(m_buildingEdgeMutex);
+
+    m_edges.append(HeapSnapshotEdge(from, to, EdgeType::Property, propertyName));
+}
+
+void HeapSnapshotBuilder::appendVariableNameEdge(JSCell* from, JSCell* to, UniquedStringImpl* variableName)
+{
+    ASSERT(m_profiler.activeSnapshotBuilder() == this);
+    ASSERT(to);
+
+    std::lock_guard<Lock> lock(m_buildingEdgeMutex);
+
+    m_edges.append(HeapSnapshotEdge(from, to, EdgeType::Variable, variableName));
+}
+
+void HeapSnapshotBuilder::appendIndexEdge(JSCell* from, JSCell* to, uint32_t index)
+{
+    ASSERT(m_profiler.activeSnapshotBuilder() == this);
+    ASSERT(to);
+
+    std::lock_guard<Lock> lock(m_buildingEdgeMutex);
+
+    m_edges.append(HeapSnapshotEdge(from, to, index));
+}
+
+bool HeapSnapshotBuilder::hasExistingNodeForCell(JSCell* cell)
+{
+    if (!m_snapshot->previous())
+        return false;
+
+    return !!m_snapshot->previous()->nodeForCell(cell);
+}
+
+
+// Heap Snapshot JSON Format:
+//
+//   {
+//      "version": 1.0,
+//      "nodes": [
+//          <nodeId>, <sizeInBytes>, <nodeClassNameIndex>, <internal>,
+//          <nodeId>, <sizeInBytes>, <nodeClassNameIndex>, <internal>,
+//          ...
+//      ],
+//      "nodeClassNames": [
+//          "string", "Structure", "Object", ...
+//      ],
+//      "edges": [
+//          <fromNodeId>, <toNodeId>, <edgeTypeIndex>, <edgeExtraData>,
+//          <fromNodeId>, <toNodeId>, <edgeTypeIndex>, <edgeExtraData>,
+//          ...
+//      ],
+//      "edgeTypes": [
+//          "Internal", "Property", "Index", "Variable"
+//      ],
+//      "edgeNames": [
+//          "propertyName", "variableName", ...
+//      ]
+//   }
+//
+// Notes:
+//
+//     <nodeClassNameIndex>
+//       - index into the "nodeClassNames" list.
+//
+//     <internal>
+//       - 0 = false, 1 = true.
+//
+//     <edgeTypeIndex>
+//       - index into the "edgeTypes" list.
+//
+//     <edgeExtraData>
+//       - for Internal edges this should be ignored (0).
+//       - for Index edges this is the index value.
+//       - for Property or Variable edges this is an index into the "edgeNames" list.
+
+static uint8_t edgeTypeToNumber(EdgeType type)
+{
+    return static_cast<uint8_t>(type);
+}
+
+static const char* edgeTypeToString(EdgeType type)
+{
+    switch (type) {
+    case EdgeType::Internal:
+        return "Internal";
+    case EdgeType::Property:
+        return "Property";
+    case EdgeType::Index:
+        return "Index";
+    case EdgeType::Variable:
+        return "Variable";
+    }
+    ASSERT_NOT_REACHED();
+    return "Internal";
+}
+
+String HeapSnapshotBuilder::json()
+{
+    return json([] (const HeapSnapshotNode&) { return true; });
+}
+
+String HeapSnapshotBuilder::json(std::function<bool (const HeapSnapshotNode&)> allowNodeCallback)
+{
+    VM& vm = m_profiler.vm();
+    DeferGCForAWhile deferGC(vm.heap);
+
+    // Build a node to identifier map of allowed nodes to use when serializing edges.
+    HashMap<JSCell*, unsigned> allowedNodeIdentifiers;
+
+    // Build a list of used class names.
+    HashMap<const char*, unsigned> classNameIndexes;
+    classNameIndexes.set("<root>", 0);
+    unsigned nextClassNameIndex = 1;
+
+    // Build a list of used edge names.
+    HashMap<UniquedStringImpl*, unsigned> edgeNameIndexes;
+    unsigned nextEdgeNameIndex = 0;
+
+    StringBuilder json;
+
+    auto appendNodeJSON = [&] (const HeapSnapshotNode& node) {
+        // Let the client decide if they want to allow or disallow certain nodes.
+        if (!allowNodeCallback(node))
+            return;
+
+        allowedNodeIdentifiers.set(node.cell, node.identifier);
+
+        auto result = classNameIndexes.add(node.cell->classInfo()->className, nextClassNameIndex);
+        if (result.isNewEntry)
+            nextClassNameIndex++;
+        unsigned classNameIndex = result.iterator->value;
+
+        bool isInternal = false;
+        if (!node.cell->isString()) {
+            Structure* structure = node.cell->structure(vm);
+            isInternal = !structure || !structure->globalObject();
+        }
+
+        // <nodeId>, <sizeInBytes>, <className>, <optionalInternalBoolean>
+        json.append(',');
+        json.appendNumber(node.identifier);
+        json.append(',');
+        json.appendNumber(node.cell->estimatedSizeInBytes());
+        json.append(',');
+        json.appendNumber(classNameIndex);
+        json.append(',');
+        json.append(isInternal ? '1' : '0');
+    };
+
+    bool firstEdge = true;
+    auto appendEdgeJSON = [&] (const HeapSnapshotEdge& edge) {
+        if (!firstEdge)
+            json.append(',');
+        firstEdge = false;
+
+        // <fromNodeId>, <toNodeId>, <edgeTypeIndex>, <edgeExtraData>
+        json.appendNumber(edge.from.identifier);
+        json.append(',');
+        json.appendNumber(edge.to.identifier);
+        json.append(',');
+        json.appendNumber(edgeTypeToNumber(edge.type));
+        json.append(',');
+        switch (edge.type) {
+        case EdgeType::Property:
+        case EdgeType::Variable: {
+            auto result = edgeNameIndexes.add(edge.u.name, nextEdgeNameIndex);
+            if (result.isNewEntry)
+                nextEdgeNameIndex++;
+            unsigned edgeNameIndex = result.iterator->value;
+            json.appendNumber(edgeNameIndex);
+            break;
+        }
+        case EdgeType::Index:
+            json.appendNumber(edge.u.index);
+            break;
+        default:
+            // No data for this edge type.
+            json.append('0');
+            break;
+        }
+    };
+
+    json.append('{');
+
+    // version
+    json.appendLiteral("\"version\":1");
+
+    // nodes
+    json.append(',');
+    json.appendLiteral("\"nodes\":");
+    json.append('[');
+    json.appendLiteral("0,0,0,0"); // <root>
+    for (HeapSnapshot* snapshot = m_profiler.mostRecentSnapshot(); snapshot; snapshot = snapshot->previous()) {
+        for (auto& node : snapshot->m_nodes)
+            appendNodeJSON(node);
+    }
+    json.append(']');
+
+    // node class names
+    json.append(',');
+    json.appendLiteral("\"nodeClassNames\":");
+    json.append('[');
+    Vector<const char *> orderedClassNames(classNameIndexes.size());
+    for (auto& entry : classNameIndexes)
+        orderedClassNames[entry.value] = entry.key;
+    classNameIndexes.clear();
+    bool firstClassName = true;
+    for (auto& className : orderedClassNames) {
+        if (!firstClassName)
+            json.append(',');
+        firstClassName = false;
+        json.appendQuotedJSONString(className);
+    }
+    orderedClassNames.clear();
+    json.append(']');
+
+    // Process edges.
+    // Replace pointers with identifiers.
+    // Remove any edges that we won't need.
+    m_edges.removeAllMatching([&] (HeapSnapshotEdge& edge) {
+        // If the from cell is null, this means a <root> edge.
+        if (!edge.from.cell)
+            edge.from.identifier = 0;
+        else {
+            auto fromLookup = allowedNodeIdentifiers.find(edge.from.cell);
+            if (fromLookup == allowedNodeIdentifiers.end())
+                return true;
+            edge.from.identifier = fromLookup->value;
+        }
+
+        if (!edge.to.cell)
+            edge.to.identifier = 0;
+        else {
+            auto toLookup = allowedNodeIdentifiers.find(edge.to.cell);
+            if (toLookup == allowedNodeIdentifiers.end())
+                return true;
+            edge.to.identifier = toLookup->value;
+        }
+
+        return false;
+    });
+    allowedNodeIdentifiers.clear();
+    m_edges.shrinkToFit();
+
+    // Sort edges based on from identifier.
+    std::sort(m_edges.begin(), m_edges.end(), [&] (const HeapSnapshotEdge& a, const HeapSnapshotEdge& b) {
+        return a.from.identifier < b.from.identifier;
+    });
+
+    // edges
+    json.append(',');
+    json.appendLiteral("\"edges\":");
+    json.append('[');
+    for (auto& edge : m_edges)
+        appendEdgeJSON(edge);
+    json.append(']');
+
+    // edge types
+    json.append(',');
+    json.appendLiteral("\"edgeTypes\":");
+    json.append('[');
+    json.appendQuotedJSONString(edgeTypeToString(EdgeType::Internal));
+    json.append(',');
+    json.appendQuotedJSONString(edgeTypeToString(EdgeType::Property));
+    json.append(',');
+    json.appendQuotedJSONString(edgeTypeToString(EdgeType::Index));
+    json.append(',');
+    json.appendQuotedJSONString(edgeTypeToString(EdgeType::Variable));
+    json.append(']');
+
+    // edge names
+    json.append(',');
+    json.appendLiteral("\"edgeNames\":");
+    json.append('[');
+    Vector<UniquedStringImpl*> orderedEdgeNames(edgeNameIndexes.size());
+    for (auto& entry : edgeNameIndexes)
+        orderedEdgeNames[entry.value] = entry.key;
+    edgeNameIndexes.clear();
+    bool firstEdgeName = true;
+    for (auto& edgeName : orderedEdgeNames) {
+        if (!firstEdgeName)
+            json.append(',');
+        firstEdgeName = false;
+        json.appendQuotedJSONString(edgeName);
+    }
+    orderedEdgeNames.clear();
+    json.append(']');
+
+    json.append('}');
+    return json.toString();
+}
+
+} // namespace JSC
diff --git a/heap/HeapSnapshotBuilder.h b/heap/HeapSnapshotBuilder.h
new file mode 100644
index 0000000..0ed85d1
--- /dev/null
+++ b/heap/HeapSnapshotBuilder.h
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <functional>
+#include <wtf/Lock.h>
+#include <wtf/Vector.h>
+#include <wtf/text/UniquedStringImpl.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class HeapProfiler;
+class HeapSnapshot;
+class JSCell;
+
+struct HeapSnapshotNode {
+    HeapSnapshotNode(JSCell* cell, unsigned identifier)
+        : cell(cell)
+        , identifier(identifier)
+    { }
+
+    JSCell* cell;
+    unsigned identifier;
+};
+
+enum class EdgeType : uint8_t {
+    Internal,     // Normal strong reference. No name.
+    Property,     // Named property. In `object.property` the name is "property"
+    Index,        // Indexed property. In `array[0]` name is index "0".
+    Variable,     // Variable held by a scope. In `let x, f=() => x++` name is "x" in f's captured scope.
+    // FIXME: <https://webkit.org/b/154934> Heap Snapshot should include "Weak" edges
+};
+
+struct HeapSnapshotEdge {
+    HeapSnapshotEdge(JSCell* fromCell, JSCell* toCell)
+        : type(EdgeType::Internal)
+    {
+        from.cell = fromCell;
+        to.cell = toCell;
+    }
+
+    HeapSnapshotEdge(JSCell* fromCell, JSCell* toCell, EdgeType type, UniquedStringImpl* name)
+        : type(type)
+    {
+        ASSERT(type == EdgeType::Property || type == EdgeType::Variable);
+        from.cell = fromCell;
+        to.cell = toCell;
+        u.name = name;
+    }
+
+    HeapSnapshotEdge(JSCell* fromCell, JSCell* toCell, uint32_t index)
+        : type(EdgeType::Index)
+    {
+        from.cell = fromCell;
+        to.cell = toCell;
+        u.index = index;
+    }
+
+    union {
+        JSCell *cell;
+        unsigned identifier;
+    } from;
+
+    union {
+        JSCell *cell;
+        unsigned identifier;
+    } to;
+
+    union {
+        UniquedStringImpl* name;
+        uint32_t index;
+    } u;
+
+    EdgeType type;
+};
+
+class JS_EXPORT_PRIVATE HeapSnapshotBuilder {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    HeapSnapshotBuilder(HeapProfiler&);
+    ~HeapSnapshotBuilder();
+
+    static unsigned nextAvailableObjectIdentifier;
+    static unsigned getNextObjectIdentifier();
+    static void resetNextAvailableObjectIdentifier();
+
+    // Performs a garbage collection that builds a snapshot of all live cells.
+    void buildSnapshot();
+
+    // A marked cell.
+    void appendNode(JSCell*);
+
+    // A reference from one cell to another.
+    void appendEdge(JSCell* from, JSCell* to);
+    void appendPropertyNameEdge(JSCell* from, JSCell* to, UniquedStringImpl* propertyName);
+    void appendVariableNameEdge(JSCell* from, JSCell* to, UniquedStringImpl* variableName);
+    void appendIndexEdge(JSCell* from, JSCell* to, uint32_t index);
+
+    String json();
+    String json(std::function<bool (const HeapSnapshotNode&)> allowNodeCallback);
+
+private:
+    // Finalized snapshots are not modified during building. So searching them
+    // for an existing node can be done concurrently without a lock.
+    bool hasExistingNodeForCell(JSCell*);
+
+    HeapProfiler& m_profiler;
+
+    // SlotVisitors run in parallel.
+    Lock m_buildingNodeMutex;
+    std::unique_ptr<HeapSnapshot> m_snapshot;
+    Lock m_buildingEdgeMutex;
+    Vector<HeapSnapshotEdge> m_edges;
+};
+
+} // namespace JSC
diff --git a/heap/HeapStatistics.cpp b/heap/HeapStatistics.cpp
new file mode 100644
index 0000000..1afa098
--- /dev/null
+++ b/heap/HeapStatistics.cpp
@@ -0,0 +1,251 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HeapStatistics.h"
+
+#include "Heap.h"
+#include "HeapIterationScope.h"
+#include "JSCInlines.h"
+#include "JSObject.h"
+#include "MarkedSpaceInlines.h"
+#include "Options.h"
+#include <stdlib.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/DataLog.h>
+#include <wtf/StdLibExtras.h>
+
+#if OS(UNIX)
+#include <sys/resource.h>
+#endif
+
+namespace JSC {
+
+double HeapStatistics::s_startTime = 0.0;
+double HeapStatistics::s_endTime = 0.0;
+Vector<double>* HeapStatistics::s_pauseTimeStarts = 0;
+Vector<double>* HeapStatistics::s_pauseTimeEnds = 0;
+
+#if OS(UNIX) 
+
+void HeapStatistics::initialize()
+{
+    ASSERT(Options::recordGCPauseTimes());
+    s_startTime = WTF::monotonicallyIncreasingTime();
+    s_pauseTimeStarts = new Vector<double>();
+    s_pauseTimeEnds = new Vector<double>();
+}
+
+void HeapStatistics::recordGCPauseTime(double start, double end)
+{
+    ASSERT(Options::recordGCPauseTimes());
+    ASSERT(s_pauseTimeStarts);
+    ASSERT(s_pauseTimeEnds);
+    s_pauseTimeStarts->append(start);
+    s_pauseTimeEnds->append(end);
+}
+
+void HeapStatistics::logStatistics()
+{
+    struct rusage usage;
+    getrusage(RUSAGE_SELF, &usage);
+#if USE(CF) || OS(UNIX)
+    char* vmName = getenv("JSVMName");
+    char* suiteName = getenv("JSSuiteName");
+    char* benchmarkName = getenv("JSBenchmarkName");
+#else
+#error "The HeapStatistics module is not supported on this platform."
+#endif
+    if (!vmName || !suiteName || !benchmarkName)
+        dataLogF("HeapStatistics: {\"max_rss\": %ld", usage.ru_maxrss);
+    else
+        dataLogF("HeapStatistics: {\"max_rss\": %ld, \"vm_name\": \"%s\", \"suite_name\": \"%s\", \"benchmark_name\": \"%s\"", 
+            usage.ru_maxrss, vmName, suiteName, benchmarkName); 
+
+    if (Options::recordGCPauseTimes()) {
+        dataLogF(", \"pause_times\": [");
+        Vector<double>::iterator startIt = s_pauseTimeStarts->begin();
+        Vector<double>::iterator endIt = s_pauseTimeEnds->begin();
+        if (startIt != s_pauseTimeStarts->end() && endIt != s_pauseTimeEnds->end()) {
+            dataLogF("[%f, %f]", *startIt, *endIt);
+            ++startIt;
+            ++endIt;
+        }
+        while (startIt != s_pauseTimeStarts->end() && endIt != s_pauseTimeEnds->end()) {
+            dataLogF(", [%f, %f]", *startIt, *endIt);
+            ++startIt;
+            ++endIt;
+        }
+        dataLogF("], \"start_time\": %f, \"end_time\": %f", s_startTime, s_endTime);
+    }
+    dataLogF("}\n");
+}
+
+void HeapStatistics::exitWithFailure()
+{
+    ASSERT(Options::logHeapStatisticsAtExit());
+    s_endTime = WTF::monotonicallyIncreasingTime();
+    logStatistics();
+    exit(-1);
+}
+
+void HeapStatistics::reportSuccess()
+{
+    ASSERT(Options::logHeapStatisticsAtExit());
+    s_endTime = WTF::monotonicallyIncreasingTime();
+    logStatistics();
+}
+
+#else
+
+void HeapStatistics::initialize()
+{
+}
+
+void HeapStatistics::recordGCPauseTime(double, double)
+{
+}
+
+void HeapStatistics::logStatistics()
+{
+}
+
+void HeapStatistics::exitWithFailure()
+{
+    exit(-1);
+}
+
+void HeapStatistics::reportSuccess()
+{
+}
+
+#endif // OS(UNIX)
+
+class StorageStatistics : public MarkedBlock::VoidFunctor {
+public:
+    StorageStatistics();
+
+    IterationStatus operator()(HeapCell*, HeapCell::Kind) const;
+
+    size_t objectWithOutOfLineStorageCount();
+    size_t objectCount();
+
+    size_t storageSize();
+    size_t storageCapacity();
+
+private:
+    void visit(JSCell*);
+
+    size_t m_objectWithOutOfLineStorageCount;
+    size_t m_objectCount;
+    size_t m_storageSize;
+    size_t m_storageCapacity;
+};
+
+inline StorageStatistics::StorageStatistics()
+    : m_objectWithOutOfLineStorageCount(0)
+    , m_objectCount(0)
+    , m_storageSize(0)
+    , m_storageCapacity(0)
+{
+}
+
+inline void StorageStatistics::visit(JSCell* cell)
+{
+    if (!cell->isObject())
+        return;
+
+    JSObject* object = jsCast<JSObject*>(cell);
+    if (hasIndexedProperties(object->indexingType()))
+        return;
+
+    if (object->structure()->isUncacheableDictionary())
+        return;
+
+    ++m_objectCount;
+    if (!object->hasInlineStorage())
+        ++m_objectWithOutOfLineStorageCount;
+    m_storageSize += object->structure()->totalStorageSize() * sizeof(WriteBarrierBase<Unknown>);
+    m_storageCapacity += object->structure()->totalStorageCapacity() * sizeof(WriteBarrierBase<Unknown>); 
+}
+
+inline IterationStatus StorageStatistics::operator()(HeapCell* cell, HeapCell::Kind kind) const
+{
+    if (kind == HeapCell::JSCell) {
+        // FIXME: This const_cast exists because this isn't a C++ lambda.
+        // https://bugs.webkit.org/show_bug.cgi?id=159644
+        const_cast<StorageStatistics*>(this)->visit(static_cast<JSCell*>(cell));
+    }
+    return IterationStatus::Continue;
+}
+
+inline size_t StorageStatistics::objectWithOutOfLineStorageCount()
+{
+    return m_objectWithOutOfLineStorageCount;
+}
+
+inline size_t StorageStatistics::objectCount()
+{
+    return m_objectCount;
+}
+
+inline size_t StorageStatistics::storageSize()
+{
+    return m_storageSize;
+}
+
+inline size_t StorageStatistics::storageCapacity()
+{
+    return m_storageCapacity;
+}
+
+void HeapStatistics::dumpObjectStatistics(Heap* heap)
+{
+    dataLogF("\n=== Heap Statistics: ===\n");
+    dataLogF("size: %ldkB\n", static_cast<long>(heap->m_sizeAfterLastCollect / KB));
+    dataLogF("capacity: %ldkB\n", static_cast<long>(heap->capacity() / KB));
+    dataLogF("pause time: %lfs\n\n", heap->m_lastFullGCLength);
+
+    StorageStatistics storageStatistics;
+    {
+        HeapIterationScope iterationScope(*heap);
+        heap->m_objectSpace.forEachLiveCell(iterationScope, storageStatistics);
+    }
+    long wastedPropertyStorageBytes = 0;
+    long wastedPropertyStoragePercent = 0;
+    long objectWithOutOfLineStorageCount = 0;
+    long objectsWithOutOfLineStoragePercent = 0;
+    if ((storageStatistics.storageCapacity() > 0) && (storageStatistics.objectCount() > 0)) {
+        wastedPropertyStorageBytes = static_cast<long>((storageStatistics.storageCapacity() - storageStatistics.storageSize()) / KB);
+        wastedPropertyStoragePercent = static_cast<long>(
+            (storageStatistics.storageCapacity() - storageStatistics.storageSize()) * 100 / storageStatistics.storageCapacity());
+        objectWithOutOfLineStorageCount = static_cast<long>(storageStatistics.objectWithOutOfLineStorageCount());
+        objectsWithOutOfLineStoragePercent = objectWithOutOfLineStorageCount * 100 / storageStatistics.objectCount();
+    }
+    dataLogF("wasted .property storage: %ldkB (%ld%%)\n", wastedPropertyStorageBytes, wastedPropertyStoragePercent);
+    dataLogF("objects with out-of-line .property storage: %ld (%ld%%)\n", objectWithOutOfLineStorageCount, objectsWithOutOfLineStoragePercent);
+}
+
+} // namespace JSC
diff --git a/heap/HeapStatistics.h b/heap/HeapStatistics.h
new file mode 100644
index 0000000..890da5e
--- /dev/null
+++ b/heap/HeapStatistics.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSExportMacros.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class Heap;
+
+class HeapStatistics {
+public:
+    NO_RETURN static void exitWithFailure();
+    JS_EXPORT_PRIVATE static void reportSuccess();
+
+    static void initialize();
+    static void recordGCPauseTime(double start, double end);
+
+    static void dumpObjectStatistics(Heap*);
+
+private:
+    static void logStatistics();
+    static Vector<double>* s_pauseTimeStarts;
+    static Vector<double>* s_pauseTimeEnds;
+    static double s_startTime;
+    static double s_endTime;
+};
+
+} // namespace JSC
diff --git a/heap/HeapTimer.cpp b/heap/HeapTimer.cpp
new file mode 100644
index 0000000..87069b7
--- /dev/null
+++ b/heap/HeapTimer.cpp
@@ -0,0 +1,258 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HeapTimer.h"
+
+#include "GCActivityCallback.h"
+#include "IncrementalSweeper.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+#include <wtf/MainThread.h>
+#include <wtf/Threading.h>
+
+#if PLATFORM(EFL)
+#include <Ecore.h>
+#elif USE(GLIB)
+#include <glib.h>
+#endif
+
+namespace JSC {
+
+#if USE(CF)
+    
+const CFTimeInterval HeapTimer::s_decade = 60 * 60 * 24 * 365 * 10;
+
+HeapTimer::HeapTimer(VM* vm)
+    : m_vm(vm)
+    , m_apiLock(&vm->apiLock())
+{
+    setRunLoop(vm->heap.runLoop());
+}
+
+void HeapTimer::setRunLoop(CFRunLoopRef runLoop)
+{
+    if (m_runLoop) {
+        CFRunLoopRemoveTimer(m_runLoop.get(), m_timer.get(), kCFRunLoopCommonModes);
+        CFRunLoopTimerInvalidate(m_timer.get());
+        m_runLoop.clear();
+        m_timer.clear();
+    }
+    
+    if (runLoop) {
+        m_runLoop = runLoop;
+        memset(&m_context, 0, sizeof(CFRunLoopTimerContext));
+        m_context.info = this;
+        m_timer = adoptCF(CFRunLoopTimerCreate(kCFAllocatorDefault, s_decade, s_decade, 0, 0, HeapTimer::timerDidFire, &m_context));
+        CFRunLoopAddTimer(m_runLoop.get(), m_timer.get(), kCFRunLoopCommonModes);
+    }
+}
+
+HeapTimer::~HeapTimer()
+{
+    setRunLoop(0);
+}
+
+void HeapTimer::timerDidFire(CFRunLoopTimerRef, void* contextPtr)
+{
+    HeapTimer* timer = static_cast<HeapTimer*>(contextPtr);
+    timer->m_apiLock->lock();
+
+    RefPtr<VM> vm = timer->m_apiLock->vm();
+    if (!vm) {
+        // The VM has been destroyed, so we should just give up.
+        timer->m_apiLock->unlock();
+        return;
+    }
+
+    {
+        JSLockHolder locker(vm.get());
+        timer->doWork();
+    }
+
+    timer->m_apiLock->unlock();
+}
+
+void HeapTimer::scheduleTimer(double intervalInSeconds)
+{
+    CFRunLoopTimerSetNextFireDate(m_timer.get(), CFAbsoluteTimeGetCurrent() + intervalInSeconds);
+    m_isScheduled = true;
+}
+
+void HeapTimer::cancelTimer()
+{
+    CFRunLoopTimerSetNextFireDate(m_timer.get(), CFAbsoluteTimeGetCurrent() + s_decade);
+    m_isScheduled = false;
+}
+
+#elif PLATFORM(EFL)
+
+HeapTimer::HeapTimer(VM* vm)
+    : m_vm(vm)
+    , m_apiLock(&vm->apiLock())
+    , m_timer(0)
+{
+}
+
+HeapTimer::~HeapTimer()
+{
+    stop();
+}
+
+Ecore_Timer* HeapTimer::add(double delay, void* agent)
+{
+    return ecore_timer_add(delay, reinterpret_cast<Ecore_Task_Cb>(timerEvent), agent);
+}
+    
+void HeapTimer::stop()
+{
+    if (!m_timer)
+        return;
+
+    ecore_timer_del(m_timer);
+    m_timer = 0;
+}
+
+bool HeapTimer::timerEvent(void* info)
+{
+    HeapTimer* agent = static_cast<HeapTimer*>(info);
+    
+    JSLockHolder locker(agent->m_vm);
+    agent->doWork();
+    agent->m_timer = 0;
+    
+    return ECORE_CALLBACK_CANCEL;
+}
+
+void HeapTimer::scheduleTimer(double intervalInSeconds)
+{
+    if (ecore_timer_freeze_get(m_timer))
+        ecore_timer_thaw(m_timer);
+
+    double targetTime = currentTime() + intervalInSeconds;
+    ecore_timer_interval_set(m_timer, targetTime);
+    m_isScheduled = true;
+}
+
+void HeapTimer::cancelTimer()
+{
+    ecore_timer_freeze(m_timer);
+    m_isScheduled = false;
+}
+#elif USE(GLIB)
+
+static GSourceFuncs heapTimerSourceFunctions = {
+    nullptr, // prepare
+    nullptr, // check
+    // dispatch
+    [](GSource* source, GSourceFunc callback, gpointer userData) -> gboolean
+    {
+        if (g_source_get_ready_time(source) == -1)
+            return G_SOURCE_CONTINUE;
+        g_source_set_ready_time(source, -1);
+        return callback(userData);
+    },
+    nullptr, // finalize
+    nullptr, // closure_callback
+    nullptr, // closure_marshall
+};
+
+HeapTimer::HeapTimer(VM* vm)
+    : m_vm(vm)
+    , m_apiLock(&vm->apiLock())
+    , m_timer(adoptGRef(g_source_new(&heapTimerSourceFunctions, sizeof(GSource))))
+{
+    g_source_set_name(m_timer.get(), "[JavaScriptCore] HeapTimer");
+    g_source_set_callback(m_timer.get(), [](gpointer userData) -> gboolean {
+        static_cast<HeapTimer*>(userData)->timerDidFire();
+        return G_SOURCE_CONTINUE;
+    }, this, nullptr);
+    g_source_attach(m_timer.get(), g_main_context_get_thread_default());
+}
+
+HeapTimer::~HeapTimer()
+{
+    g_source_destroy(m_timer.get());
+}
+
+void HeapTimer::timerDidFire()
+{
+    m_apiLock->lock();
+
+    if (!m_apiLock->vm()) {
+        // The VM has been destroyed, so we should just give up.
+        m_apiLock->unlock();
+        return;
+    }
+
+    {
+        JSLockHolder locker(m_vm);
+        doWork();
+    }
+
+    m_apiLock->unlock();
+}
+
+void HeapTimer::scheduleTimer(double intervalInSeconds)
+{
+    auto delayDuration = std::chrono::duration_cast<std::chrono::microseconds>(std::chrono::duration<double>(intervalInSeconds));
+    gint64 currentTime = g_get_monotonic_time();
+    gint64 targetTime = currentTime + std::min<gint64>(G_MAXINT64 - currentTime, delayDuration.count());
+    ASSERT(targetTime >= currentTime);
+    g_source_set_ready_time(m_timer.get(), targetTime);
+    m_isScheduled = true;
+}
+
+void HeapTimer::cancelTimer()
+{
+    g_source_set_ready_time(m_timer.get(), -1);
+    m_isScheduled = false;
+}
+#else
+HeapTimer::HeapTimer(VM* vm)
+    : m_vm(vm)
+{
+}
+
+HeapTimer::~HeapTimer()
+{
+}
+
+void HeapTimer::invalidate()
+{
+}
+
+void HeapTimer::scheduleTimer(double)
+{
+}
+
+void HeapTimer::cancelTimer()
+{
+}
+#endif
+    
+
+} // namespace JSC
diff --git a/heap/HeapTimer.h b/heap/HeapTimer.h
new file mode 100644
index 0000000..b470f3a
--- /dev/null
+++ b/heap/HeapTimer.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2012, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/Lock.h>
+#include <wtf/RefPtr.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/ThreadSafeRefCounted.h>
+#include <wtf/Threading.h>
+
+#if USE(CF)
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
+#if USE(GLIB) && !PLATFORM(EFL)
+#include <wtf/glib/GRefPtr.h>
+#endif
+
+namespace JSC {
+
+class JSLock;
+class VM;
+
+class HeapTimer : public ThreadSafeRefCounted<HeapTimer> {
+public:
+    HeapTimer(VM*);
+#if USE(CF)
+    static void timerDidFire(CFRunLoopTimerRef, void*);
+#endif
+    
+    JS_EXPORT_PRIVATE virtual ~HeapTimer();
+    virtual void doWork() = 0;
+
+    void scheduleTimer(double intervalInSeconds);
+    void cancelTimer();
+    bool isScheduled() const { return m_isScheduled; }
+
+#if USE(CF)
+    JS_EXPORT_PRIVATE void setRunLoop(CFRunLoopRef);
+#endif // USE(CF)
+    
+protected:
+    VM* m_vm;
+
+    RefPtr<JSLock> m_apiLock;
+    bool m_isScheduled { false };
+#if USE(CF)
+    static const CFTimeInterval s_decade;
+
+    RetainPtr<CFRunLoopTimerRef> m_timer;
+    RetainPtr<CFRunLoopRef> m_runLoop;
+    
+    CFRunLoopTimerContext m_context;
+
+    Lock m_shutdownMutex;
+#elif PLATFORM(EFL)
+    static bool timerEvent(void*);
+    Ecore_Timer* add(double delay, void* agent);
+    void stop();
+    Ecore_Timer* m_timer;
+#elif USE(GLIB)
+    void timerDidFire();
+    GRefPtr<GSource> m_timer;
+#endif
+    
+private:
+    void invalidate();
+};
+
+} // namespace JSC
diff --git a/heap/HeapUtil.h b/heap/HeapUtil.h
new file mode 100644
index 0000000..44d14ba
--- /dev/null
+++ b/heap/HeapUtil.h
@@ -0,0 +1,189 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+// Are you tired of waiting for all of WebKit to build because you changed the implementation of a
+// function in HeapInlines.h?  Does it bother you that you're waiting on rebuilding the JS DOM
+// bindings even though your change is in a function called from only 2 .cpp files?  Then HeapUtil.h
+// is for you!  Everything in this class should be a static method that takes a Heap& if needed.
+// This is a friend of Heap, so you can access all of Heap's privates.
+//
+// This ends up being an issue because Heap exposes a lot of methods that ought to be inline for
+// performance or that must be inline because they are templates.  This class ought to contain
+// methods that are used for the implementation of the collector, or for unusual clients that need
+// to reach deep into the collector for some reason.  Don't put things in here that would cause you
+// to have to include it from more than a handful of places, since that would defeat the purpose.
+// This class isn't here to look pretty.  It's to let us hack the GC more easily!
+
+class HeapUtil {
+public:
+    // This function must be run after stopAllocation() is called and 
+    // before liveness data is cleared to be accurate.
+    template<typename Func>
+    static void findGCObjectPointersForMarking(
+        Heap& heap, HeapVersion markingVersion, TinyBloomFilter filter, void* passedPointer,
+        const Func& func)
+    {
+        const HashSet<MarkedBlock*>& set = heap.objectSpace().blocks().set();
+        
+        ASSERT(heap.objectSpace().isMarking());
+        static const bool isMarking = true;
+        
+        char* pointer = static_cast<char*>(passedPointer);
+        
+        // It could point to a large allocation.
+        if (heap.objectSpace().largeAllocationsForThisCollectionSize()) {
+            if (heap.objectSpace().largeAllocationsForThisCollectionBegin()[0]->aboveLowerBound(pointer)
+                && heap.objectSpace().largeAllocationsForThisCollectionEnd()[-1]->belowUpperBound(pointer)) {
+                LargeAllocation** result = approximateBinarySearch<LargeAllocation*>(
+                    heap.objectSpace().largeAllocationsForThisCollectionBegin(),
+                    heap.objectSpace().largeAllocationsForThisCollectionSize(),
+                    LargeAllocation::fromCell(pointer),
+                    [] (LargeAllocation** ptr) -> LargeAllocation* { return *ptr; });
+                if (result) {
+                    if (result > heap.objectSpace().largeAllocationsForThisCollectionBegin()
+                        && result[-1]->contains(pointer))
+                        func(result[-1]->cell());
+                    if (result[0]->contains(pointer))
+                        func(result[0]->cell());
+                    if (result + 1 < heap.objectSpace().largeAllocationsForThisCollectionEnd()
+                        && result[1]->contains(pointer))
+                        func(result[1]->cell());
+                }
+            }
+        }
+    
+        MarkedBlock* candidate = MarkedBlock::blockFor(pointer);
+        // It's possible for a butterfly pointer to point past the end of a butterfly. Check this now.
+        if (pointer <= bitwise_cast<char*>(candidate) + sizeof(IndexingHeader)) {
+            // We may be interested in the last cell of the previous MarkedBlock.
+            char* previousPointer = pointer - sizeof(IndexingHeader) - 1;
+            MarkedBlock* previousCandidate = MarkedBlock::blockFor(previousPointer);
+            if (!filter.ruleOut(bitwise_cast<Bits>(previousCandidate))
+                && set.contains(previousCandidate)
+                && previousCandidate->handle().cellKind() == HeapCell::Auxiliary) {
+                previousPointer = static_cast<char*>(previousCandidate->handle().cellAlign(previousPointer));
+                if (previousCandidate->handle().isLiveCell(markingVersion, isMarking, previousPointer))
+                    func(previousPointer);
+            }
+        }
+    
+        if (filter.ruleOut(bitwise_cast<Bits>(candidate))) {
+            ASSERT(!candidate || !set.contains(candidate));
+            return;
+        }
+    
+        if (!set.contains(candidate))
+            return;
+        
+        auto tryPointer = [&] (void* pointer) {
+            if (candidate->handle().isLiveCell(markingVersion, isMarking, pointer))
+                func(pointer);
+        };
+    
+        if (candidate->handle().cellKind() == HeapCell::JSCell) {
+            if (!MarkedBlock::isAtomAligned(pointer))
+                return;
+        
+            tryPointer(pointer);
+            return;
+        }
+    
+        // A butterfly could point into the middle of an object.
+        char* alignedPointer = static_cast<char*>(candidate->handle().cellAlign(pointer));
+        tryPointer(alignedPointer);
+    
+        // Also, a butterfly could point at the end of an object plus sizeof(IndexingHeader). In that
+        // case, this is pointing to the object to the right of the one we should be marking.
+        if (candidate->atomNumber(alignedPointer) > MarkedBlock::firstAtom()
+            && pointer <= alignedPointer + sizeof(IndexingHeader))
+            tryPointer(alignedPointer - candidate->cellSize());
+    }
+    
+    static bool isPointerGCObjectJSCell(
+        Heap& heap, TinyBloomFilter filter, const void* pointer)
+    {
+        // It could point to a large allocation.
+        const Vector<LargeAllocation*>& largeAllocations = heap.objectSpace().largeAllocations();
+        if (!largeAllocations.isEmpty()) {
+            if (largeAllocations[0]->aboveLowerBound(pointer)
+                && largeAllocations.last()->belowUpperBound(pointer)) {
+                LargeAllocation*const* result = approximateBinarySearch<LargeAllocation*const>(
+                    largeAllocations.begin(), largeAllocations.size(),
+                    LargeAllocation::fromCell(pointer),
+                    [] (LargeAllocation*const* ptr) -> LargeAllocation* { return *ptr; });
+                if (result) {
+                    if (result > largeAllocations.begin()
+                        && result[-1]->cell() == pointer
+                        && result[-1]->attributes().cellKind == HeapCell::JSCell)
+                        return true;
+                    if (result[0]->cell() == pointer
+                        && result[0]->attributes().cellKind == HeapCell::JSCell)
+                        return true;
+                    if (result + 1 < largeAllocations.end()
+                        && result[1]->cell() == pointer
+                        && result[1]->attributes().cellKind == HeapCell::JSCell)
+                        return true;
+                }
+            }
+        }
+    
+        const HashSet<MarkedBlock*>& set = heap.objectSpace().blocks().set();
+        
+        MarkedBlock* candidate = MarkedBlock::blockFor(pointer);
+        if (filter.ruleOut(bitwise_cast<Bits>(candidate))) {
+            ASSERT(!candidate || !set.contains(candidate));
+            return false;
+        }
+        
+        if (!MarkedBlock::isAtomAligned(pointer))
+            return false;
+        
+        if (!set.contains(candidate))
+            return false;
+        
+        if (candidate->handle().cellKind() != HeapCell::JSCell)
+            return false;
+        
+        if (!candidate->handle().isLiveCell(pointer))
+            return false;
+        
+        return true;
+    }
+    
+    static bool isValueGCObject(
+        Heap& heap, TinyBloomFilter filter, JSValue value)
+    {
+        if (!value.isCell())
+            return false;
+        return isPointerGCObjectJSCell(heap, filter, static_cast<void*>(value.asCell()));
+    }
+};
+
+} // namespace JSC
+
diff --git a/heap/HeapVerifier.cpp b/heap/HeapVerifier.cpp
new file mode 100644
index 0000000..c779cf1
--- /dev/null
+++ b/heap/HeapVerifier.cpp
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HeapVerifier.h"
+
+#include "ButterflyInlines.h"
+#include "HeapIterationScope.h"
+#include "JSCInlines.h"
+#include "JSObject.h"
+#include "MarkedSpaceInlines.h"
+
+namespace JSC {
+
+HeapVerifier::HeapVerifier(Heap* heap, unsigned numberOfGCCyclesToRecord)
+    : m_heap(heap)
+    , m_currentCycle(0)
+    , m_numberOfCycles(numberOfGCCyclesToRecord)
+{
+    RELEASE_ASSERT(m_numberOfCycles > 0);
+    m_cycles = std::make_unique<GCCycle[]>(m_numberOfCycles);
+}
+
+const char* HeapVerifier::phaseName(HeapVerifier::Phase phase)
+{
+    switch (phase) {
+    case Phase::BeforeGC:
+        return "BeforeGC";
+    case Phase::BeforeMarking:
+        return "BeforeMarking";
+    case Phase::AfterMarking:
+        return "AfterMarking";
+    case Phase::AfterGC:
+        return "AfterGC";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr; // Silencing a compiler warning.
+}
+
+void HeapVerifier::initializeGCCycle()
+{
+    Heap* heap = m_heap;
+    incrementCycle();
+    currentCycle().scope = *heap->collectionScope();
+}
+
+struct GatherLiveObjFunctor : MarkedBlock::CountFunctor {
+    GatherLiveObjFunctor(LiveObjectList& list)
+        : m_list(list)
+    {
+        ASSERT(!list.liveObjects.size());
+    }
+
+    inline void visit(JSCell* cell)
+    {
+        if (!cell->isObject())
+            return;        
+        LiveObjectData data(asObject(cell));
+        m_list.liveObjects.append(data);
+    }
+
+    IterationStatus operator()(HeapCell* cell, HeapCell::Kind kind) const
+    {
+        if (kind == HeapCell::JSCell) {
+            // FIXME: This const_cast exists because this isn't a C++ lambda.
+            // https://bugs.webkit.org/show_bug.cgi?id=159644
+            const_cast<GatherLiveObjFunctor*>(this)->visit(static_cast<JSCell*>(cell));
+        }
+        return IterationStatus::Continue;
+    }
+
+    LiveObjectList& m_list;
+};
+
+void HeapVerifier::gatherLiveObjects(HeapVerifier::Phase phase)
+{
+    Heap* heap = m_heap;
+    LiveObjectList& list = *liveObjectListForGathering(phase);
+
+    HeapIterationScope iterationScope(*heap);
+    list.reset();
+    GatherLiveObjFunctor functor(list);
+    heap->m_objectSpace.forEachLiveCell(iterationScope, functor);
+}
+
+LiveObjectList* HeapVerifier::liveObjectListForGathering(HeapVerifier::Phase phase)
+{
+    switch (phase) {
+    case Phase::BeforeMarking:
+        return &currentCycle().before;
+    case Phase::AfterMarking:
+        return &currentCycle().after;
+    case Phase::BeforeGC:
+    case Phase::AfterGC:
+        // We should not be gathering live objects during these phases.
+        break;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr; // Silencing a compiler warning.
+}
+
+static void trimDeadObjectsFromList(HashSet<JSObject*>& knownLiveSet, LiveObjectList& list)
+{
+    if (!list.hasLiveObjects)
+        return;
+
+    size_t liveObjectsFound = 0;
+    for (size_t i = 0; i < list.liveObjects.size(); i++) {
+        LiveObjectData& objData = list.liveObjects[i];
+        if (objData.isConfirmedDead)
+            continue; // Don't "resurrect" known dead objects.
+        if (!knownLiveSet.contains(objData.obj)) {
+            objData.isConfirmedDead = true;
+            continue;
+        }
+        liveObjectsFound++;
+    }
+    list.hasLiveObjects = !!liveObjectsFound;
+}
+
+void HeapVerifier::trimDeadObjects()
+{
+    HashSet<JSObject*> knownLiveSet;
+
+    LiveObjectList& after = currentCycle().after;
+    for (size_t i = 0; i < after.liveObjects.size(); i++) {
+        LiveObjectData& objData = after.liveObjects[i];
+        knownLiveSet.add(objData.obj);
+    }
+
+    trimDeadObjectsFromList(knownLiveSet, currentCycle().before);
+
+    for (int i = -1; i > -m_numberOfCycles; i--) {
+        trimDeadObjectsFromList(knownLiveSet, cycleForIndex(i).before);
+        trimDeadObjectsFromList(knownLiveSet, cycleForIndex(i).after);
+    }
+}
+
+bool HeapVerifier::verifyButterflyIsInStorageSpace(Phase, LiveObjectList&)
+{
+    // FIXME: Make this work again. https://bugs.webkit.org/show_bug.cgi?id=161752
+    return true;
+}
+
+void HeapVerifier::verify(HeapVerifier::Phase phase)
+{
+    bool beforeVerified = verifyButterflyIsInStorageSpace(phase, currentCycle().before);
+    bool afterVerified = verifyButterflyIsInStorageSpace(phase, currentCycle().after);
+    RELEASE_ASSERT(beforeVerified && afterVerified);
+}
+
+void HeapVerifier::reportObject(LiveObjectData& objData, int cycleIndex, HeapVerifier::GCCycle& cycle, LiveObjectList& list)
+{
+    JSObject* obj = objData.obj;
+
+    if (objData.isConfirmedDead) {
+        dataLogF("FOUND dead obj %p in GC[%d] %s list '%s'\n",
+            obj, cycleIndex, collectionScopeName(cycle.scope), list.name);
+        return;
+    }
+
+    Structure* structure = obj->structure();
+    Butterfly* butterfly = obj->butterfly();
+    void* butterflyBase = butterfly->base(structure);
+
+    dataLogF("FOUND obj %p type '%s' butterfly %p (base %p) in GC[%d] %s list '%s'\n",
+        obj, structure->classInfo()->className,
+        butterfly, butterflyBase,
+        cycleIndex, collectionScopeName(cycle.scope), list.name);
+}
+
+void HeapVerifier::checkIfRecorded(JSObject* obj)
+{
+    bool found = false;
+
+    for (int cycleIndex = 0; cycleIndex > -m_numberOfCycles; cycleIndex--) {
+        GCCycle& cycle = cycleForIndex(cycleIndex);
+        LiveObjectList& beforeList = cycle.before; 
+        LiveObjectList& afterList = cycle.after; 
+
+        LiveObjectData* objData;
+        objData = beforeList.findObject(obj);
+        if (objData) {
+            reportObject(*objData, cycleIndex, cycle, beforeList);
+            found = true;
+        }
+        objData = afterList.findObject(obj);
+        if (objData) {
+            reportObject(*objData, cycleIndex, cycle, afterList);
+            found = true;
+        }
+    }
+
+    if (!found)
+        dataLogF("obj %p NOT FOUND\n", obj);
+}
+
+} // namespace JSC
diff --git a/heap/HeapVerifier.h b/heap/HeapVerifier.h
new file mode 100644
index 0000000..d736b47
--- /dev/null
+++ b/heap/HeapVerifier.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2014-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Heap.h"
+#include "LiveObjectList.h"
+
+namespace JSC {
+
+class JSObject;
+class MarkedBlock;
+
+class HeapVerifier {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    enum class Phase {
+        BeforeGC,
+        BeforeMarking,
+        AfterMarking,
+        AfterGC
+    };
+
+    HeapVerifier(Heap*, unsigned numberOfGCCyclesToRecord);
+
+    void initializeGCCycle();
+    void gatherLiveObjects(Phase);
+    void trimDeadObjects();
+    void verify(Phase);
+
+    // Scans all previously recorded LiveObjectLists and checks if the specified
+    // object was in any of those lists.
+    JS_EXPORT_PRIVATE void checkIfRecorded(JSObject*);
+
+    static const char* phaseName(Phase);
+
+private:
+    struct GCCycle {
+        GCCycle()
+            : before("Before Marking")
+            , after("After Marking")
+        {
+        }
+
+        CollectionScope scope;
+        LiveObjectList before;
+        LiveObjectList after;
+    };
+
+    void incrementCycle() { m_currentCycle = (m_currentCycle + 1) % m_numberOfCycles; }
+    GCCycle& currentCycle() { return m_cycles[m_currentCycle]; }
+    GCCycle& cycleForIndex(int cycleIndex)
+    {
+        ASSERT(cycleIndex <= 0 && cycleIndex > -m_numberOfCycles);
+        cycleIndex += m_currentCycle;
+        if (cycleIndex < 0)
+            cycleIndex += m_numberOfCycles;
+        ASSERT(cycleIndex < m_numberOfCycles);
+        return m_cycles[cycleIndex];
+    }
+
+    LiveObjectList* liveObjectListForGathering(Phase);
+    bool verifyButterflyIsInStorageSpace(Phase, LiveObjectList&);
+
+    static void reportObject(LiveObjectData&, int cycleIndex, HeapVerifier::GCCycle&, LiveObjectList&);
+
+    Heap* m_heap;
+    int m_currentCycle;
+    int m_numberOfCycles;
+    std::unique_ptr<GCCycle[]> m_cycles;
+};
+
+} // namespace JSC
diff --git a/heap/HelpingGCScope.h b/heap/HelpingGCScope.h
new file mode 100644
index 0000000..e8f4085
--- /dev/null
+++ b/heap/HelpingGCScope.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Heap.h"
+
+namespace JSC {
+
+class HelpingGCScope {
+public:
+    HelpingGCScope(Heap& heap)
+        : m_heap(heap)
+        , m_oldState(m_heap.m_mutatorState)
+    {
+        m_heap.m_mutatorState = MutatorState::HelpingGC;
+    }
+    
+    ~HelpingGCScope()
+    {
+        m_heap.m_mutatorState = m_oldState;
+    }
+
+private:
+    Heap& m_heap;
+    MutatorState m_oldState;
+};
+
+} // namespace JSC
+
diff --git a/heap/IncrementalSweeper.cpp b/heap/IncrementalSweeper.cpp
new file mode 100644
index 0000000..6df607f
--- /dev/null
+++ b/heap/IncrementalSweeper.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IncrementalSweeper.h"
+
+#include "Heap.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "MarkedBlock.h"
+#include "JSCInlines.h"
+#include <wtf/CurrentTime.h>
+
+namespace JSC {
+
+static const double sweepTimeSlice = .01; // seconds
+static const double sweepTimeTotal = .10;
+static const double sweepTimeMultiplier = 1.0 / sweepTimeTotal;
+
+void IncrementalSweeper::scheduleTimer()
+{
+    HeapTimer::scheduleTimer(sweepTimeSlice * sweepTimeMultiplier);
+}
+
+IncrementalSweeper::IncrementalSweeper(Heap* heap)
+    : HeapTimer(heap->vm())
+    , m_currentAllocator(nullptr)
+{
+}
+
+void IncrementalSweeper::doWork()
+{
+    doSweep(WTF::monotonicallyIncreasingTime());
+}
+
+void IncrementalSweeper::doSweep(double sweepBeginTime)
+{
+    while (sweepNextBlock()) {
+        double elapsedTime = WTF::monotonicallyIncreasingTime() - sweepBeginTime;
+        if (elapsedTime < sweepTimeSlice)
+            continue;
+
+        scheduleTimer();
+        return;
+    }
+
+    cancelTimer();
+}
+
+bool IncrementalSweeper::sweepNextBlock()
+{
+    m_vm->heap.stopIfNecessary();
+
+    MarkedBlock::Handle* block = nullptr;
+    
+    for (; m_currentAllocator; m_currentAllocator = m_currentAllocator->nextAllocator()) {
+        block = m_currentAllocator->findBlockToSweep();
+        if (block)
+            break;
+    }
+    
+    if (block) {
+        DeferGCForAWhile deferGC(m_vm->heap);
+        block->sweep();
+        m_vm->heap.objectSpace().freeOrShrinkBlock(block);
+        return true;
+    }
+
+    return m_vm->heap.sweepNextLogicallyEmptyWeakBlock();
+}
+
+void IncrementalSweeper::startSweeping()
+{
+    scheduleTimer();
+    m_currentAllocator = m_vm->heap.objectSpace().firstAllocator();
+}
+
+void IncrementalSweeper::willFinishSweeping()
+{
+    m_currentAllocator = nullptr;
+    if (m_vm)
+        cancelTimer();
+}
+
+} // namespace JSC
diff --git a/heap/IncrementalSweeper.h b/heap/IncrementalSweeper.h
new file mode 100644
index 0000000..a84830b
--- /dev/null
+++ b/heap/IncrementalSweeper.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "HeapTimer.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class Heap;
+class MarkedAllocator;
+
+class IncrementalSweeper : public HeapTimer {
+public:
+    JS_EXPORT_PRIVATE explicit IncrementalSweeper(Heap*);
+
+    void startSweeping();
+
+    JS_EXPORT_PRIVATE void doWork() override;
+    bool sweepNextBlock();
+    void willFinishSweeping();
+
+private:
+    void doSweep(double startTime);
+    void scheduleTimer();
+    
+    MarkedAllocator* m_currentAllocator;
+};
+
+} // namespace JSC
diff --git a/heap/JITStubRoutineSet.cpp b/heap/JITStubRoutineSet.cpp
new file mode 100644
index 0000000..ae80595
--- /dev/null
+++ b/heap/JITStubRoutineSet.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITStubRoutineSet.h"
+
+#if ENABLE(JIT)
+
+#include "GCAwareJITStubRoutine.h"
+#include "JSCInlines.h"
+#include "SlotVisitor.h"
+
+namespace JSC {
+
+JITStubRoutineSet::JITStubRoutineSet() { }
+JITStubRoutineSet::~JITStubRoutineSet()
+{
+    for (size_t i = m_listOfRoutines.size(); i--;) {
+        GCAwareJITStubRoutine* routine = m_listOfRoutines[i];
+        
+        routine->m_mayBeExecuting = false;
+        
+        if (!routine->m_isJettisoned) {
+            // Inform the deref() routine that it should delete this guy as soon
+            // as the ref count reaches zero.
+            routine->m_isJettisoned = true;
+            continue;
+        }
+        
+        routine->deleteFromGC();
+    }
+}
+
+void JITStubRoutineSet::add(GCAwareJITStubRoutine* routine)
+{
+    ASSERT(!routine->m_isJettisoned);
+    
+    m_listOfRoutines.append(routine);
+    
+    uintptr_t start = routine->startAddress();
+    uintptr_t end = routine->endAddress();
+    uintptr_t step = JITStubRoutine::addressStep();
+    for (uintptr_t iter = start; iter < end; iter += step) {
+        ASSERT(m_addressToRoutineMap.find(iter) == m_addressToRoutineMap.end());
+        m_addressToRoutineMap.add(iter, routine);
+    }
+}
+
+void JITStubRoutineSet::clearMarks()
+{
+    for (size_t i = m_listOfRoutines.size(); i--;)
+        m_listOfRoutines[i]->m_mayBeExecuting = false;
+}
+
+void JITStubRoutineSet::markSlow(uintptr_t address)
+{
+    HashMap<uintptr_t, GCAwareJITStubRoutine*>::iterator iter =
+        m_addressToRoutineMap.find(address & ~(JITStubRoutine::addressStep() - 1));
+    
+    if (iter == m_addressToRoutineMap.end())
+        return;
+    
+    iter->value->m_mayBeExecuting = true;
+}
+
+void JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines()
+{
+    for (size_t i = 0; i < m_listOfRoutines.size(); i++) {
+        GCAwareJITStubRoutine* routine = m_listOfRoutines[i];
+        if (!routine->m_isJettisoned || routine->m_mayBeExecuting)
+            continue;
+        
+        uintptr_t start = routine->startAddress();
+        uintptr_t end = routine->endAddress();
+        uintptr_t step = JITStubRoutine::addressStep();
+        for (uintptr_t iter = start; iter < end; iter += step) {
+            ASSERT(m_addressToRoutineMap.find(iter) != m_addressToRoutineMap.end());
+            ASSERT(m_addressToRoutineMap.find(iter)->value == routine);
+            m_addressToRoutineMap.remove(iter);
+        }
+        
+        routine->deleteFromGC();
+        
+        m_listOfRoutines[i] = m_listOfRoutines.last();
+        m_listOfRoutines.removeLast();
+        i--;
+    }
+}
+
+void JITStubRoutineSet::traceMarkedStubRoutines(SlotVisitor& visitor)
+{
+    for (size_t i = m_listOfRoutines.size(); i--;) {
+        GCAwareJITStubRoutine* routine = m_listOfRoutines[i];
+        if (!routine->m_mayBeExecuting)
+            continue;
+        
+        routine->markRequiredObjects(visitor);
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/heap/JITStubRoutineSet.h b/heap/JITStubRoutineSet.h
new file mode 100644
index 0000000..1f9cd2a
--- /dev/null
+++ b/heap/JITStubRoutineSet.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JITStubRoutine.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class GCAwareJITStubRoutine;
+class SlotVisitor;
+
+#if ENABLE(JIT)
+
+class JITStubRoutineSet {
+    WTF_MAKE_NONCOPYABLE(JITStubRoutineSet);
+    WTF_MAKE_FAST_ALLOCATED;
+    
+public:
+    JITStubRoutineSet();
+    ~JITStubRoutineSet();
+    
+    void add(GCAwareJITStubRoutine*);
+
+    void clearMarks();
+    
+    void mark(void* candidateAddress)
+    {
+        uintptr_t address = reinterpret_cast<uintptr_t>(candidateAddress);
+        if (!JITStubRoutine::passesFilter(address))
+            return;
+        
+        markSlow(address);
+    }
+    
+    void deleteUnmarkedJettisonedStubRoutines();
+    
+    void traceMarkedStubRoutines(SlotVisitor&);
+    
+    unsigned size() const { return m_listOfRoutines.size(); }
+    GCAwareJITStubRoutine* at(unsigned i) const { return m_listOfRoutines[i]; }
+    
+private:
+    void markSlow(uintptr_t address);
+    
+    HashMap<uintptr_t, GCAwareJITStubRoutine*> m_addressToRoutineMap;
+    Vector<GCAwareJITStubRoutine*> m_listOfRoutines;
+};
+
+#else // !ENABLE(JIT)
+
+class JITStubRoutineSet {
+    WTF_MAKE_NONCOPYABLE(JITStubRoutineSet);
+    WTF_MAKE_FAST_ALLOCATED;
+    
+public:
+    JITStubRoutineSet() { }
+    ~JITStubRoutineSet() { }
+
+    void add(GCAwareJITStubRoutine*) { }
+    void clearMarks() { }
+    void mark(void*) { }
+    void deleteUnmarkedJettisonedStubRoutines() { }
+    void traceMarkedStubRoutines(SlotVisitor&) { }
+};
+
+#endif // !ENABLE(JIT)
+
+} // namespace JSC
diff --git a/heap/LargeAllocation.cpp b/heap/LargeAllocation.cpp
new file mode 100644
index 0000000..839c616
--- /dev/null
+++ b/heap/LargeAllocation.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LargeAllocation.h"
+
+#include "Heap.h"
+#include "JSCInlines.h"
+#include "Operations.h"
+
+namespace JSC {
+
+LargeAllocation* LargeAllocation::tryCreate(Heap& heap, size_t size, Subspace* subspace)
+{
+    void* space = tryFastAlignedMalloc(alignment, headerSize() + size);
+    if (!space)
+        return nullptr;
+    if (scribbleFreeCells())
+        scribble(space, size);
+    return new (NotNull, space) LargeAllocation(heap, size, subspace);
+}
+
+LargeAllocation::LargeAllocation(Heap& heap, size_t size, Subspace* subspace)
+    : m_cellSize(size)
+    , m_isNewlyAllocated(true)
+    , m_hasValidCell(true)
+    , m_attributes(subspace->attributes())
+    , m_subspace(subspace)
+    , m_weakSet(heap.vm(), *this)
+{
+    m_isMarked.store(0);
+}
+
+LargeAllocation::~LargeAllocation()
+{
+    if (isOnList())
+        remove();
+}
+
+void LargeAllocation::lastChanceToFinalize()
+{
+    m_weakSet.lastChanceToFinalize();
+    clearMarked();
+    clearNewlyAllocated();
+    sweep();
+}
+
+void LargeAllocation::shrink()
+{
+    m_weakSet.shrink();
+}
+
+void LargeAllocation::visitWeakSet(SlotVisitor& visitor)
+{
+    m_weakSet.visit(visitor);
+}
+
+void LargeAllocation::reapWeakSet()
+{
+    return m_weakSet.reap();
+}
+
+void LargeAllocation::flip()
+{
+    ASSERT(heap()->collectionScope() == CollectionScope::Full);
+    clearMarked();
+}
+
+bool LargeAllocation::isEmpty()
+{
+    return !isMarked() && m_weakSet.isEmpty() && !isNewlyAllocated();
+}
+
+void LargeAllocation::sweep()
+{
+    m_weakSet.sweep();
+    
+    if (m_hasValidCell && !isLive()) {
+        if (m_attributes.destruction == NeedsDestruction)
+            m_subspace->destroy(*vm(), static_cast<JSCell*>(cell()));
+        m_hasValidCell = false;
+    }
+}
+
+void LargeAllocation::destroy()
+{
+    this->~LargeAllocation();
+    fastAlignedFree(this);
+}
+
+void LargeAllocation::dump(PrintStream& out) const
+{
+    out.print(RawPointer(this), ":(cell at ", RawPointer(cell()), " with size ", m_cellSize, " and attributes ", m_attributes, ")");
+}
+
+#if !ASSERT_DISABLED
+void LargeAllocation::assertValidCell(VM& vm, HeapCell* cell) const
+{
+    ASSERT(&vm == this->vm());
+    ASSERT(cell == this->cell());
+    ASSERT(m_hasValidCell);
+}
+#endif
+
+} // namespace JSC
+
diff --git a/heap/LargeAllocation.h b/heap/LargeAllocation.h
new file mode 100644
index 0000000..528575b
--- /dev/null
+++ b/heap/LargeAllocation.h
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MarkedBlock.h"
+#include "WeakSet.h"
+
+namespace JSC {
+
+class SlotVisitor;
+
+// WebKit has a good malloc that already knows what to do for large allocations. The GC shouldn't
+// have to think about such things. That's where LargeAllocation comes in. We will allocate large
+// objects directly using malloc, and put the LargeAllocation header just before them. We can detect
+// when a HeapCell* is a LargeAllocation because it will have the MarkedBlock::atomSize / 2 bit set.
+
+class LargeAllocation : public BasicRawSentinelNode<LargeAllocation> {
+public:
+    static LargeAllocation* tryCreate(Heap&, size_t, Subspace*);
+    
+    ~LargeAllocation();
+    
+    static LargeAllocation* fromCell(const void* cell)
+    {
+        return bitwise_cast<LargeAllocation*>(bitwise_cast<char*>(cell) - headerSize());
+    }
+    
+    HeapCell* cell() const
+    {
+        return bitwise_cast<HeapCell*>(bitwise_cast<char*>(this) + headerSize());
+    }
+    
+    static bool isLargeAllocation(HeapCell* cell)
+    {
+        return bitwise_cast<uintptr_t>(cell) & halfAlignment;
+    }
+    
+    void lastChanceToFinalize();
+    
+    Heap* heap() const { return m_weakSet.heap(); }
+    VM* vm() const { return m_weakSet.vm(); }
+    WeakSet& weakSet() { return m_weakSet; }
+    
+    void shrink();
+    
+    void visitWeakSet(SlotVisitor&);
+    void reapWeakSet();
+    
+    void clearNewlyAllocated() { m_isNewlyAllocated = false; }
+    void flip();
+    
+    bool isNewlyAllocated() const { return m_isNewlyAllocated; }
+    ALWAYS_INLINE bool isMarked() { return m_isMarked.load(std::memory_order_relaxed); }
+    ALWAYS_INLINE bool isMarked(HeapCell*) { return m_isMarked.load(std::memory_order_relaxed); }
+    ALWAYS_INLINE bool isMarkedConcurrently(HeapVersion, HeapCell*) { return m_isMarked.load(std::memory_order_relaxed); }
+    bool isLive() { return isMarked() || isNewlyAllocated(); }
+    
+    bool hasValidCell() const { return m_hasValidCell; }
+    
+    bool isEmpty();
+    
+    size_t cellSize() const { return m_cellSize; }
+    
+    bool aboveLowerBound(const void* rawPtr)
+    {
+        char* ptr = bitwise_cast<char*>(rawPtr);
+        char* begin = bitwise_cast<char*>(cell());
+        return ptr >= begin;
+    }
+    
+    bool belowUpperBound(const void* rawPtr)
+    {
+        char* ptr = bitwise_cast<char*>(rawPtr);
+        char* begin = bitwise_cast<char*>(cell());
+        char* end = begin + cellSize();
+        // We cannot #include IndexingHeader.h because reasons. The fact that IndexingHeader is 8
+        // bytes is wired deep into our engine, so this isn't so bad.
+        size_t sizeOfIndexingHeader = 8;
+        return ptr <= end + sizeOfIndexingHeader;
+    }
+    
+    bool contains(const void* rawPtr)
+    {
+        return aboveLowerBound(rawPtr) && belowUpperBound(rawPtr);
+    }
+    
+    const AllocatorAttributes& attributes() const { return m_attributes; }
+    
+    void aboutToMark(HeapVersion) { }
+    
+    ALWAYS_INLINE bool testAndSetMarked()
+    {
+        // This method is usually called when the object is already marked. This avoids us
+        // having to CAS in that case. It's profitable to reduce the total amount of CAS
+        // traffic.
+        if (isMarked())
+            return true;
+        return m_isMarked.compareExchangeStrong(false, true);
+    }
+    ALWAYS_INLINE bool testAndSetMarked(HeapCell*) { return testAndSetMarked(); }
+    void clearMarked() { m_isMarked.store(false); }
+    
+    void noteMarked() { }
+    
+#if ASSERT_DISABLED
+    void assertValidCell(VM&, HeapCell*) const { }
+#else
+    void assertValidCell(VM&, HeapCell*) const;
+#endif
+    
+    void sweep();
+    
+    void destroy();
+    
+    void dump(PrintStream&) const;
+    
+private:
+    LargeAllocation(Heap&, size_t, Subspace*);
+    
+    static const unsigned alignment = MarkedBlock::atomSize;
+    static const unsigned halfAlignment = alignment / 2;
+
+    static unsigned headerSize();
+    
+    size_t m_cellSize;
+    bool m_isNewlyAllocated;
+    bool m_hasValidCell;
+    Atomic<bool> m_isMarked;
+    AllocatorAttributes m_attributes;
+    Subspace* m_subspace;
+    WeakSet m_weakSet;
+};
+
+inline unsigned LargeAllocation::headerSize()
+{
+    return ((sizeof(LargeAllocation) + halfAlignment - 1) & ~(halfAlignment - 1)) | halfAlignment;
+}
+
+} // namespace JSC
+
diff --git a/heap/ListableHandler.h b/heap/ListableHandler.h
new file mode 100644
index 0000000..7ee78f2
--- /dev/null
+++ b/heap/ListableHandler.h
@@ -0,0 +1,116 @@
+/*
+ *  Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include <wtf/Lock.h>
+#include <wtf/Locker.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/ThreadingPrimitives.h>
+
+namespace JSC {
+
+class Heap;
+class SlotVisitor;
+
+template<typename T>
+class ListableHandler {
+    WTF_MAKE_NONCOPYABLE(ListableHandler);
+
+public:    
+    bool isOnList() const
+    {
+        return m_nextAndFlag & 1;
+    }
+    
+protected:
+    ListableHandler()
+        : m_nextAndFlag(0)
+    {
+    }
+    
+    virtual ~ListableHandler() { }
+    
+    T* next() const
+    {
+        return reinterpret_cast<T*>(m_nextAndFlag & ~1);
+    }
+
+private:
+    // Allow these classes to use ListableHandler::List.
+    friend class Heap;
+    friend class SlotVisitor;
+    
+    class List {
+        WTF_MAKE_NONCOPYABLE(List);
+    public:
+        List()
+            : m_first(0)
+        {
+        }
+        
+        void addThreadSafe(T* handler)
+        {
+            LockHolder locker(&m_lock);
+            addNotThreadSafe(handler);
+        }
+        
+        bool hasNext()
+        {
+            return !!m_first;
+        }
+        
+        T* head()
+        {
+            return m_first;
+        }
+        
+        T* removeNext()
+        {
+            T* current = m_first;
+            T* next = current->next();
+            current->m_nextAndFlag = 0;
+            m_first = next;
+            return current;
+        }
+        
+        void removeAll()
+        {
+            while (hasNext())
+                removeNext();
+        }
+        
+    private:
+        void addNotThreadSafe(T* handler)
+        {
+            if (handler->m_nextAndFlag & 1)
+                return;
+            handler->m_nextAndFlag = reinterpret_cast<uintptr_t>(m_first) | 1;
+            m_first = handler;
+        }
+        
+        Lock m_lock;
+        T* m_first;
+    };
+    
+    uintptr_t m_nextAndFlag;
+};
+
+} // namespace JSC
diff --git a/heap/LiveObjectData.h b/heap/LiveObjectData.h
new file mode 100644
index 0000000..6fb7197
--- /dev/null
+++ b/heap/LiveObjectData.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+class JSObject;
+
+struct LiveObjectData {
+    LiveObjectData(JSObject* obj, bool isConfirmedDead = false)
+        : obj(obj)
+        , isConfirmedDead(isConfirmedDead)
+    {
+    }
+    
+    JSObject* obj;
+    bool isConfirmedDead;
+};
+
+} // namespace JSC
diff --git a/heap/LiveObjectList.cpp b/heap/LiveObjectList.cpp
new file mode 100644
index 0000000..af0367d
--- /dev/null
+++ b/heap/LiveObjectList.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LiveObjectList.h"
+
+namespace JSC {
+
+LiveObjectData* LiveObjectList::findObject(JSObject* obj)
+{
+    for (size_t i = 0; i < liveObjects.size(); i++) {
+        LiveObjectData& data = liveObjects[i];
+        if (obj == data.obj)
+            return &data;
+    }
+    return nullptr;
+}
+
+} // namespace JSC
diff --git a/heap/LiveObjectList.h b/heap/LiveObjectList.h
new file mode 100644
index 0000000..c40fd3a
--- /dev/null
+++ b/heap/LiveObjectList.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "LiveObjectData.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+struct LiveObjectList {
+    LiveObjectList(const char* name)
+        : name(name)
+        , hasLiveObjects(true)
+    {
+    }
+    
+    void reset()
+    {
+        liveObjects.clear();
+        hasLiveObjects = true; // Presume to have live objects until the list is trimmed.
+    }
+    
+    LiveObjectData* findObject(JSObject*);
+    
+    const char* name;
+    Vector<LiveObjectData> liveObjects;
+    bool hasLiveObjects;
+};
+    
+} // namespace JSC
diff --git a/heap/Local.h b/heap/Local.h
new file mode 100644
index 0000000..a0aadbe
--- /dev/null
+++ b/heap/Local.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Handle.h"
+#include "VM.h"
+
+/*
+    A strongly referenced handle whose lifetime is temporary, limited to a given
+    LocalScope. Use Locals for local values on the stack. It is an error to
+    create a Local outside of any LocalScope.
+*/
+
+namespace JSC {
+
+template <typename T> class Local : public Handle<T> {
+    friend class LocalScope;
+    using Handle<T>::slot;
+
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+
+    Local(VM&, ExternalType = ExternalType());
+    Local(VM&, Handle<T>);
+    Local(const Local<T>&); // Adopting constructor. Used to return a Local to a calling function.
+
+    Local& operator=(ExternalType);
+    Local& operator=(Handle<T>);
+
+private:
+    Local(HandleSlot, ExternalType); // Used by LocalScope::release() to move a Local to a containing scope.
+    void set(ExternalType);
+};
+
+template <typename T> inline Local<T>::Local(VM& vm, ExternalType value)
+    : Handle<T>(vm.heap.handleStack()->push())
+{
+    set(value);
+}
+
+template <typename T> inline Local<T>::Local(VM& vm, Handle<T> other)
+    : Handle<T>(vm.heap.handleStack()->push())
+{
+    set(other.get());
+}
+
+template <typename T> inline Local<T>::Local(const Local<T>& other)
+    : Handle<T>(other.slot())
+{
+    const_cast<Local<T>&>(other).setSlot(0); // Prevent accidental sharing.
+}
+
+template <typename T> inline Local<T>::Local(HandleSlot slot, ExternalType value)
+    : Handle<T>(slot, value)
+{
+}
+
+template <typename T> inline Local<T>& Local<T>::operator=(ExternalType value)
+{
+    set(value);
+    return *this;
+}
+
+template <typename T> inline Local<T>& Local<T>::operator=(Handle<T> other)
+{
+    set(other.get());
+    return *this;
+}
+
+template <typename T> inline void Local<T>::set(ExternalType externalType)
+{
+    ASSERT(slot());
+    *slot() = externalType;
+}
+
+
+template <typename T, unsigned inlineCapacity = 0> class LocalStack {
+    typedef typename Handle<T>::ExternalType ExternalType;
+public:
+    LocalStack(VM& vm)
+        : m_vm(vm)
+        , m_count(0)
+    {
+    }
+
+    ExternalType peek() const
+    {
+        ASSERT(m_count > 0);
+        return m_stack[m_count - 1].get();
+    }
+
+    ExternalType pop()
+    {
+        ASSERT(m_count > 0);
+        return m_stack[--m_count].get();
+    }
+
+    void push(ExternalType value)
+    {
+        if (m_count == m_stack.size())
+            m_stack.append(Local<T>(m_vm, value));
+        else
+            m_stack[m_count] = value;
+        m_count++;
+    }
+
+    bool isEmpty() const { return !m_count; }
+    unsigned size() const { return m_count; }
+
+private:
+    VM& m_vm;
+    Vector<Local<T>, inlineCapacity> m_stack;
+    unsigned m_count;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Local<T>> : SimpleClassVectorTraits {
+    static const bool needsDestruction = false;
+    static const bool canInitializeWithMemset = false;
+    static const bool canCompareWithMemcmp = false;
+};
+
+} // namespace WTF
diff --git a/heap/LocalScope.h b/heap/LocalScope.h
new file mode 100644
index 0000000..f17f9f9
--- /dev/null
+++ b/heap/LocalScope.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "HandleStack.h"
+#include "Local.h"
+
+namespace JSC {
+/*  
+    A LocalScope is a temporary scope in which Locals are allocated. When a
+    LocalScope goes out of scope, all the Locals created in it are destroyed.
+
+    LocalScope is similar in concept to NSAutoreleasePool.
+*/
+
+class VM;
+
+class LocalScope {
+public:
+    explicit LocalScope(VM&);
+    ~LocalScope();
+    
+    template <typename T> Local<T> release(Local<T>); // Destroys all other locals in the scope.
+
+private:
+    HandleStack* m_handleStack;
+    HandleStack::Frame m_lastFrame;
+};
+
+inline LocalScope::LocalScope(VM& vm)
+    : m_handleStack(vm.heap.handleStack())
+{
+    m_handleStack->enterScope(m_lastFrame);
+}
+
+inline LocalScope::~LocalScope()
+{
+    m_handleStack->leaveScope(m_lastFrame);
+}
+
+template <typename T> Local<T> LocalScope::release(Local<T> local)
+{
+    typename Local<T>::ExternalType ptr = local.get();
+
+    m_handleStack->leaveScope(m_lastFrame);
+    HandleSlot slot = m_handleStack->push();
+    m_handleStack->enterScope(m_lastFrame);
+
+    return Local<T>(slot, ptr);
+}
+
+} // namespace JSC
diff --git a/heap/LockDuringMarking.h b/heap/LockDuringMarking.h
new file mode 100644
index 0000000..2603787
--- /dev/null
+++ b/heap/LockDuringMarking.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <heap/Heap.h>
+#include <wtf/Locker.h>
+
+namespace JSC {
+
+// Use this lock scope like so:
+// auto locker = lockDuringMarking(heap, lock);
+template<typename LockType>
+Locker<LockType> lockDuringMarking(Heap& heap, LockType& passedLock)
+{
+    LockType* lock;
+    if (heap.mutatorShouldBeFenced())
+        lock = &passedLock;
+    else
+        lock = nullptr;
+    return Locker<LockType>(lock);
+}
+
+} // namespace JSC
+
diff --git a/heap/MachineStackMarker.cpp b/heap/MachineStackMarker.cpp
new file mode 100644
index 0000000..15c85ad
--- /dev/null
+++ b/heap/MachineStackMarker.cpp
@@ -0,0 +1,1027 @@
+/*
+ *  Copyright (C) 2003-2009, 2015-2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *  Copyright (C) 2009 Acision BV. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "MachineStackMarker.h"
+
+#include "ConservativeRoots.h"
+#include "GPRInfo.h"
+#include "Heap.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "LLIntPCRanges.h"
+#include "MacroAssembler.h"
+#include "VM.h"
+#include <setjmp.h>
+#include <stdlib.h>
+#include <wtf/StdLibExtras.h>
+
+#if OS(DARWIN)
+
+#include <mach/mach_init.h>
+#include <mach/mach_port.h>
+#include <mach/task.h>
+#include <mach/thread_act.h>
+#include <mach/vm_map.h>
+
+#elif OS(WINDOWS)
+
+#include <windows.h>
+#include <malloc.h>
+
+#elif OS(UNIX)
+
+#include <sys/mman.h>
+#include <unistd.h>
+
+#if OS(SOLARIS)
+#include <thread.h>
+#else
+#include <pthread.h>
+#endif
+
+#if HAVE(PTHREAD_NP_H)
+#include <pthread_np.h>
+#endif
+
+#if USE(PTHREADS) && !OS(WINDOWS) && !OS(DARWIN)
+#include <signal.h>
+
+// We use SIGUSR2 to suspend and resume machine threads in JavaScriptCore.
+static const int SigThreadSuspendResume = SIGUSR2;
+static StaticLock globalSignalLock;
+thread_local static std::atomic<JSC::MachineThreads::Thread*> threadLocalCurrentThread;
+
+static void pthreadSignalHandlerSuspendResume(int, siginfo_t*, void* ucontext)
+{
+    // Touching thread local atomic types from signal handlers is allowed.
+    JSC::MachineThreads::Thread* thread = threadLocalCurrentThread.load();
+
+    if (thread->suspended.load(std::memory_order_acquire)) {
+        // This is signal handler invocation that is intended to be used to resume sigsuspend.
+        // So this handler invocation itself should not process.
+        //
+        // When signal comes, first, the system calls signal handler. And later, sigsuspend will be resumed. Signal handler invocation always precedes.
+        // So, the problem never happens that suspended.store(true, ...) will be executed before the handler is called.
+        // http://pubs.opengroup.org/onlinepubs/009695399/functions/sigsuspend.html
+        return;
+    }
+
+    ucontext_t* userContext = static_cast<ucontext_t*>(ucontext);
+#if CPU(PPC)
+    thread->suspendedMachineContext = *userContext->uc_mcontext.uc_regs;
+#else
+    thread->suspendedMachineContext = userContext->uc_mcontext;
+#endif
+
+    // Allow suspend caller to see that this thread is suspended.
+    // sem_post is async-signal-safe function. It means that we can call this from a signal handler.
+    // http://pubs.opengroup.org/onlinepubs/009695399/functions/xsh_chap02_04.html#tag_02_04_03
+    //
+    // And sem_post emits memory barrier that ensures that suspendedMachineContext is correctly saved.
+    // http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html#tag_04_11
+    sem_post(&thread->semaphoreForSuspendResume);
+
+    // Reaching here, SigThreadSuspendResume is blocked in this handler (this is configured by sigaction's sa_mask).
+    // So before calling sigsuspend, SigThreadSuspendResume to this thread is deferred. This ensures that the handler is not executed recursively.
+    sigset_t blockedSignalSet;
+    sigfillset(&blockedSignalSet);
+    sigdelset(&blockedSignalSet, SigThreadSuspendResume);
+    sigsuspend(&blockedSignalSet);
+
+    // Allow resume caller to see that this thread is resumed.
+    sem_post(&thread->semaphoreForSuspendResume);
+}
+#endif // USE(PTHREADS) && !OS(WINDOWS) && !OS(DARWIN)
+
+#endif
+
+using namespace WTF;
+
+namespace JSC {
+
+using Thread = MachineThreads::Thread;
+
+class ActiveMachineThreadsManager;
+static ActiveMachineThreadsManager& activeMachineThreadsManager();
+
+class ActiveMachineThreadsManager {
+    WTF_MAKE_NONCOPYABLE(ActiveMachineThreadsManager);
+public:
+
+    class Locker {
+    public:
+        Locker(ActiveMachineThreadsManager& manager)
+            : m_locker(manager.m_lock)
+        {
+        }
+
+    private:
+        LockHolder m_locker;
+    };
+
+    void add(MachineThreads* machineThreads)
+    {
+        LockHolder managerLock(m_lock);
+        m_set.add(machineThreads);
+    }
+
+    void THREAD_SPECIFIC_CALL remove(MachineThreads* machineThreads)
+    {
+        LockHolder managerLock(m_lock);
+        auto recordedMachineThreads = m_set.take(machineThreads);
+        RELEASE_ASSERT(recordedMachineThreads = machineThreads);
+    }
+
+    bool contains(MachineThreads* machineThreads)
+    {
+        return m_set.contains(machineThreads);
+    }
+
+private:
+    typedef HashSet<MachineThreads*> MachineThreadsSet;
+
+    ActiveMachineThreadsManager() { }
+    
+    Lock m_lock;
+    MachineThreadsSet m_set;
+
+    friend ActiveMachineThreadsManager& activeMachineThreadsManager();
+};
+
+static ActiveMachineThreadsManager& activeMachineThreadsManager()
+{
+    static std::once_flag initializeManagerOnceFlag;
+    static ActiveMachineThreadsManager* manager = nullptr;
+
+    std::call_once(initializeManagerOnceFlag, [] {
+        manager = new ActiveMachineThreadsManager();
+    });
+    return *manager;
+}
+    
+static inline PlatformThread getCurrentPlatformThread()
+{
+#if OS(DARWIN)
+    return pthread_mach_thread_np(pthread_self());
+#elif OS(WINDOWS)
+    return GetCurrentThreadId();
+#elif USE(PTHREADS)
+    return pthread_self();
+#endif
+}
+
+MachineThreads::MachineThreads(Heap* heap)
+    : m_registeredThreads(0)
+    , m_threadSpecificForMachineThreads(0)
+#if !ASSERT_DISABLED
+    , m_heap(heap)
+#endif
+{
+    UNUSED_PARAM(heap);
+    threadSpecificKeyCreate(&m_threadSpecificForMachineThreads, removeThread);
+    activeMachineThreadsManager().add(this);
+}
+
+MachineThreads::~MachineThreads()
+{
+    activeMachineThreadsManager().remove(this);
+    threadSpecificKeyDelete(m_threadSpecificForMachineThreads);
+
+    LockHolder registeredThreadsLock(m_registeredThreadsMutex);
+    for (Thread* t = m_registeredThreads; t;) {
+        Thread* next = t->next;
+        delete t;
+        t = next;
+    }
+}
+
+Thread* MachineThreads::Thread::createForCurrentThread()
+{
+    auto stackBounds = wtfThreadData().stack();
+    return new Thread(getCurrentPlatformThread(), stackBounds.origin(), stackBounds.end());
+}
+
+bool MachineThreads::Thread::operator==(const PlatformThread& other) const
+{
+#if OS(DARWIN) || OS(WINDOWS)
+    return platformThread == other;
+#elif USE(PTHREADS)
+    return !!pthread_equal(platformThread, other);
+#else
+#error Need a way to compare threads on this platform
+#endif
+}
+
+void MachineThreads::addCurrentThread()
+{
+    ASSERT(!m_heap->vm()->hasExclusiveThread() || m_heap->vm()->exclusiveThread() == std::this_thread::get_id());
+
+    if (threadSpecificGet(m_threadSpecificForMachineThreads)) {
+#ifndef NDEBUG
+        LockHolder lock(m_registeredThreadsMutex);
+        ASSERT(threadSpecificGet(m_threadSpecificForMachineThreads) == this);
+#endif
+        return;
+    }
+
+    Thread* thread = Thread::createForCurrentThread();
+    threadSpecificSet(m_threadSpecificForMachineThreads, this);
+
+    LockHolder lock(m_registeredThreadsMutex);
+
+    thread->next = m_registeredThreads;
+    m_registeredThreads = thread;
+}
+
+Thread* MachineThreads::machineThreadForCurrentThread()
+{
+    LockHolder lock(m_registeredThreadsMutex);
+    PlatformThread platformThread = getCurrentPlatformThread();
+    for (Thread* thread = m_registeredThreads; thread; thread = thread->next) {
+        if (*thread == platformThread)
+            return thread;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+void THREAD_SPECIFIC_CALL MachineThreads::removeThread(void* p)
+{
+    auto& manager = activeMachineThreadsManager();
+    ActiveMachineThreadsManager::Locker lock(manager);
+    auto machineThreads = static_cast<MachineThreads*>(p);
+    if (manager.contains(machineThreads)) {
+        // There's a chance that the MachineThreads registry that this thread
+        // was registered with was already destructed, and another one happened
+        // to be instantiated at the same address. Hence, this thread may or
+        // may not be found in this MachineThreads registry. We only need to
+        // do a removal if this thread is found in it.
+        machineThreads->removeThreadIfFound(getCurrentPlatformThread());
+    }
+}
+
+template<typename PlatformThread>
+void MachineThreads::removeThreadIfFound(PlatformThread platformThread)
+{
+    LockHolder lock(m_registeredThreadsMutex);
+    Thread* t = m_registeredThreads;
+    if (*t == platformThread) {
+        m_registeredThreads = m_registeredThreads->next;
+        delete t;
+    } else {
+        Thread* last = m_registeredThreads;
+        for (t = m_registeredThreads->next; t; t = t->next) {
+            if (*t == platformThread) {
+                last->next = t->next;
+                break;
+            }
+            last = t;
+        }
+        delete t;
+    }
+}
+
+MachineThreads::Thread::Thread(const PlatformThread& platThread, void* base, void* end)
+    : platformThread(platThread)
+    , stackBase(base)
+    , stackEnd(end)
+{
+#if OS(WINDOWS)
+    ASSERT(platformThread == GetCurrentThreadId());
+    bool isSuccessful =
+        DuplicateHandle(GetCurrentProcess(), GetCurrentThread(), GetCurrentProcess(),
+            &platformThreadHandle, 0, FALSE, DUPLICATE_SAME_ACCESS);
+    RELEASE_ASSERT(isSuccessful);
+#elif USE(PTHREADS) && !OS(DARWIN)
+    threadLocalCurrentThread.store(this);
+
+    // Signal handlers are process global configuration.
+    static std::once_flag initializeSignalHandler;
+    std::call_once(initializeSignalHandler, [] {
+        // Intentionally block SigThreadSuspendResume in the handler.
+        // SigThreadSuspendResume will be allowed in the handler by sigsuspend.
+        struct sigaction action;
+        sigemptyset(&action.sa_mask);
+        sigaddset(&action.sa_mask, SigThreadSuspendResume);
+
+        action.sa_sigaction = pthreadSignalHandlerSuspendResume;
+        action.sa_flags = SA_RESTART | SA_SIGINFO;
+        sigaction(SigThreadSuspendResume, &action, 0);
+    });
+
+    sigset_t mask;
+    sigemptyset(&mask);
+    sigaddset(&mask, SigThreadSuspendResume);
+    pthread_sigmask(SIG_UNBLOCK, &mask, 0);
+
+    sem_init(&semaphoreForSuspendResume, /* Only available in this process. */ 0, /* Initial value for the semaphore. */ 0);
+#endif
+}
+
+MachineThreads::Thread::~Thread()
+{
+#if OS(WINDOWS)
+    CloseHandle(platformThreadHandle);
+#elif USE(PTHREADS) && !OS(DARWIN)
+    sem_destroy(&semaphoreForSuspendResume);
+#endif
+}
+
+bool MachineThreads::Thread::suspend()
+{
+#if OS(DARWIN)
+    kern_return_t result = thread_suspend(platformThread);
+    return result == KERN_SUCCESS;
+#elif OS(WINDOWS)
+    bool threadIsSuspended = (SuspendThread(platformThreadHandle) != (DWORD)-1);
+    ASSERT(threadIsSuspended);
+    return threadIsSuspended;
+#elif USE(PTHREADS)
+    ASSERT_WITH_MESSAGE(getCurrentPlatformThread() != platformThread, "Currently we don't support suspend the current thread itself.");
+    {
+        // During suspend, suspend or resume should not be executed from the other threads.
+        // We use global lock instead of per thread lock.
+        // Consider the following case, there are threads A and B.
+        // And A attempt to suspend B and B attempt to suspend A.
+        // A and B send signals. And later, signals are delivered to A and B.
+        // In that case, both will be suspended.
+        LockHolder lock(globalSignalLock);
+        if (!suspendCount) {
+            // Ideally, we would like to use pthread_sigqueue. It allows us to pass the argument to the signal handler.
+            // But it can be used in a few platforms, like Linux.
+            // Instead, we use Thread* stored in the thread local storage to pass it to the signal handler.
+            if (pthread_kill(platformThread, SigThreadSuspendResume) == ESRCH)
+                return false;
+            sem_wait(&semaphoreForSuspendResume);
+            // Release barrier ensures that this operation is always executed after all the above processing is done.
+            suspended.store(true, std::memory_order_release);
+        }
+        ++suspendCount;
+    }
+    return true;
+#else
+#error Need a way to suspend threads on this platform
+#endif
+}
+
+void MachineThreads::Thread::resume()
+{
+#if OS(DARWIN)
+    thread_resume(platformThread);
+#elif OS(WINDOWS)
+    ResumeThread(platformThreadHandle);
+#elif USE(PTHREADS)
+    {
+        // During resume, suspend or resume should not be executed from the other threads.
+        LockHolder lock(globalSignalLock);
+        if (suspendCount == 1) {
+            // When allowing SigThreadSuspendResume interrupt in the signal handler by sigsuspend and SigThreadSuspendResume is actually issued,
+            // the signal handler itself will be called once again.
+            // There are several ways to distinguish the handler invocation for suspend and resume.
+            // 1. Use different signal numbers. And check the signal number in the handler.
+            // 2. Use some arguments to distinguish suspend and resume in the handler. If pthread_sigqueue can be used, we can take this.
+            // 3. Use thread local storage with atomic variables in the signal handler.
+            // In this implementaiton, we take (3). suspended flag is used to distinguish it.
+            if (pthread_kill(platformThread, SigThreadSuspendResume) == ESRCH)
+                return;
+            sem_wait(&semaphoreForSuspendResume);
+            // Release barrier ensures that this operation is always executed after all the above processing is done.
+            suspended.store(false, std::memory_order_release);
+        }
+        --suspendCount;
+    }
+#else
+#error Need a way to resume threads on this platform
+#endif
+}
+
+size_t MachineThreads::Thread::getRegisters(Thread::Registers& registers)
+{
+    Thread::Registers::PlatformRegisters& regs = registers.regs;
+#if OS(DARWIN)
+#if CPU(X86)
+    unsigned user_count = sizeof(regs)/sizeof(int);
+    thread_state_flavor_t flavor = i386_THREAD_STATE;
+#elif CPU(X86_64)
+    unsigned user_count = x86_THREAD_STATE64_COUNT;
+    thread_state_flavor_t flavor = x86_THREAD_STATE64;
+#elif CPU(PPC) 
+    unsigned user_count = PPC_THREAD_STATE_COUNT;
+    thread_state_flavor_t flavor = PPC_THREAD_STATE;
+#elif CPU(PPC64)
+    unsigned user_count = PPC_THREAD_STATE64_COUNT;
+    thread_state_flavor_t flavor = PPC_THREAD_STATE64;
+#elif CPU(ARM)
+    unsigned user_count = ARM_THREAD_STATE_COUNT;
+    thread_state_flavor_t flavor = ARM_THREAD_STATE;
+#elif CPU(ARM64)
+    unsigned user_count = ARM_THREAD_STATE64_COUNT;
+    thread_state_flavor_t flavor = ARM_THREAD_STATE64;
+#else
+#error Unknown Architecture
+#endif
+
+    kern_return_t result = thread_get_state(platformThread, flavor, (thread_state_t)&regs, &user_count);
+    if (result != KERN_SUCCESS) {
+        WTFReportFatalError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, 
+                            "JavaScript garbage collection failed because thread_get_state returned an error (%d). This is probably the result of running inside Rosetta, which is not supported.", result);
+        CRASH();
+    }
+    return user_count * sizeof(uintptr_t);
+// end OS(DARWIN)
+
+#elif OS(WINDOWS)
+    regs.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL;
+    GetThreadContext(platformThreadHandle, &regs);
+    return sizeof(CONTEXT);
+#elif USE(PTHREADS)
+    pthread_attr_init(&regs.attribute);
+#if HAVE(PTHREAD_NP_H) || OS(NETBSD)
+#if !OS(OPENBSD)
+    // e.g. on FreeBSD 5.4, neundorf@kde.org
+    pthread_attr_get_np(platformThread, &regs.attribute);
+#endif
+#else
+    // FIXME: this function is non-portable; other POSIX systems may have different np alternatives
+    pthread_getattr_np(platformThread, &regs.attribute);
+#endif
+    regs.machineContext = suspendedMachineContext;
+    return 0;
+#else
+#error Need a way to get thread registers on this platform
+#endif
+}
+
+void* MachineThreads::Thread::Registers::stackPointer() const
+{
+#if OS(DARWIN)
+
+#if __DARWIN_UNIX03
+
+#if CPU(X86)
+    return reinterpret_cast<void*>(regs.__esp);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>(regs.__rsp);
+#elif CPU(PPC) || CPU(PPC64)
+    return reinterpret_cast<void*>(regs.__r1);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>(regs.__sp);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>(regs.__sp);
+#else
+#error Unknown Architecture
+#endif
+
+#else // !__DARWIN_UNIX03
+
+#if CPU(X86)
+    return reinterpret_cast<void*>(regs.esp);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>(regs.rsp);
+#elif CPU(PPC) || CPU(PPC64)
+    return reinterpret_cast<void*>(regs.r1);
+#else
+#error Unknown Architecture
+#endif
+
+#endif // __DARWIN_UNIX03
+
+// end OS(DARWIN)
+#elif OS(WINDOWS)
+
+#if CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.Sp);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.IntSp);
+#elif CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.Esp);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.Rsp);
+#else
+#error Unknown Architecture
+#endif
+
+#elif USE(PTHREADS)
+
+#if OS(FREEBSD) && ENABLE(JIT)
+
+#if CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_esp);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_rsp);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.__gregs[_REG_SP]);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_gpregs.gp_sp);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_regs[29]);
+#else
+#error Unknown Architecture
+#endif
+
+#elif defined(__GLIBC__) && ENABLE(JIT)
+
+#if CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[REG_ESP]);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[REG_RSP]);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.arm_sp);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.sp);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[29]);
+#else
+#error Unknown Architecture
+#endif
+
+#else
+    void* stackBase = 0;
+    size_t stackSize = 0;
+#if OS(OPENBSD)
+    stack_t ss;
+    int rc = pthread_stackseg_np(pthread_self(), &ss);
+    stackBase = (void*)((size_t) ss.ss_sp - ss.ss_size);
+    stackSize = ss.ss_size;
+#else
+    int rc = pthread_attr_getstack(&regs.attribute, &stackBase, &stackSize);
+#endif
+    (void)rc; // FIXME: Deal with error code somehow? Seems fatal.
+    ASSERT(stackBase);
+    return static_cast<char*>(stackBase) + stackSize;
+#endif
+
+#else
+#error Need a way to get the stack pointer for another thread on this platform
+#endif
+}
+
+#if ENABLE(SAMPLING_PROFILER)
+void* MachineThreads::Thread::Registers::framePointer() const
+{
+#if OS(DARWIN)
+
+#if __DARWIN_UNIX03
+
+#if CPU(X86)
+    return reinterpret_cast<void*>(regs.__ebp);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>(regs.__rbp);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>(regs.__r[11]);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>(regs.__x[29]);
+#else
+#error Unknown Architecture
+#endif
+
+#else // !__DARWIN_UNIX03
+
+#if CPU(X86)
+    return reinterpret_cast<void*>(regs.esp);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>(regs.rsp);
+#else
+#error Unknown Architecture
+#endif
+
+#endif // __DARWIN_UNIX03
+
+// end OS(DARWIN)
+#elif OS(WINDOWS)
+
+#if CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.R11);
+#elif CPU(MIPS)
+#error Dont know what to do with mips. Do we even need this?
+#elif CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.Ebp);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.Rbp);
+#else
+#error Unknown Architecture
+#endif
+
+#elif OS(FREEBSD)
+
+#if CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_ebp);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_rbp);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.__gregs[_REG_FP]);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_gpregs.gp_x[29]);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_regs[30]);
+#else
+#error Unknown Architecture
+#endif
+
+#elif defined(__GLIBC__)
+
+// The following sequence depends on glibc's sys/ucontext.h.
+#if CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[REG_EBP]);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[REG_RBP]);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.arm_fp);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.regs[29]);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[30]);
+#else
+#error Unknown Architecture
+#endif
+
+#else
+#error Need a way to get the frame pointer for another thread on this platform
+#endif
+}
+
+void* MachineThreads::Thread::Registers::instructionPointer() const
+{
+#if OS(DARWIN)
+
+#if __DARWIN_UNIX03
+
+#if CPU(X86)
+    return reinterpret_cast<void*>(regs.__eip);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>(regs.__rip);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>(regs.__pc);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>(regs.__pc);
+#else
+#error Unknown Architecture
+#endif
+
+#else // !__DARWIN_UNIX03
+#if CPU(X86)
+    return reinterpret_cast<void*>(regs.eip);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>(regs.rip);
+#else
+#error Unknown Architecture
+#endif
+
+#endif // __DARWIN_UNIX03
+
+// end OS(DARWIN)
+#elif OS(WINDOWS)
+
+#if CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.Pc);
+#elif CPU(MIPS)
+#error Dont know what to do with mips. Do we even need this?
+#elif CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.Eip);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.Rip);
+#else
+#error Unknown Architecture
+#endif
+
+#elif OS(FREEBSD)
+
+#if CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_eip);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_rip);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.__gregs[_REG_PC]);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_gpregs.gp_elr);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_pc);
+#else
+#error Unknown Architecture
+#endif
+
+#elif defined(__GLIBC__)
+
+// The following sequence depends on glibc's sys/ucontext.h.
+#if CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[REG_EIP]);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[REG_RIP]);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.arm_pc);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.pc);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.pc);
+#else
+#error Unknown Architecture
+#endif
+
+#else
+#error Need a way to get the instruction pointer for another thread on this platform
+#endif
+}
+void* MachineThreads::Thread::Registers::llintPC() const
+{
+    // LLInt uses regT4 as PC.
+#if OS(DARWIN)
+
+#if __DARWIN_UNIX03
+
+#if CPU(X86)
+    static_assert(LLInt::LLIntPC == X86Registers::esi, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>(regs.__esi);
+#elif CPU(X86_64)
+    static_assert(LLInt::LLIntPC == X86Registers::r8, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>(regs.__r8);
+#elif CPU(ARM)
+    static_assert(LLInt::LLIntPC == ARMRegisters::r8, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>(regs.__r[8]);
+#elif CPU(ARM64)
+    static_assert(LLInt::LLIntPC == ARM64Registers::x4, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>(regs.__x[4]);
+#else
+#error Unknown Architecture
+#endif
+
+#else // !__DARWIN_UNIX03
+#if CPU(X86)
+    static_assert(LLInt::LLIntPC == X86Registers::esi, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>(regs.esi);
+#elif CPU(X86_64)
+    static_assert(LLInt::LLIntPC == X86Registers::r8, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>(regs.r8);
+#else
+#error Unknown Architecture
+#endif
+
+#endif // __DARWIN_UNIX03
+
+// end OS(DARWIN)
+#elif OS(WINDOWS)
+
+#if CPU(ARM)
+    static_assert(LLInt::LLIntPC == ARMRegisters::r8, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>((uintptr_t) regs.R8);
+#elif CPU(MIPS)
+#error Dont know what to do with mips. Do we even need this?
+#elif CPU(X86)
+    static_assert(LLInt::LLIntPC == X86Registers::esi, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>((uintptr_t) regs.Esi);
+#elif CPU(X86_64)
+    static_assert(LLInt::LLIntPC == X86Registers::r10, "Wrong LLInt PC.");
+    return reinterpret_cast<void*>((uintptr_t) regs.R10);
+#else
+#error Unknown Architecture
+#endif
+
+#elif OS(FREEBSD)
+
+#if CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_esi);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_r8);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.__gregs[_REG_R8]);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_gpregs.gp_x[4]);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.mc_regs[12]);
+#else
+#error Unknown Architecture
+#endif
+
+#elif defined(__GLIBC__)
+
+// The following sequence depends on glibc's sys/ucontext.h.
+#if CPU(X86)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[REG_ESI]);
+#elif CPU(X86_64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[REG_R8]);
+#elif CPU(ARM)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.arm_r8);
+#elif CPU(ARM64)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.regs[4]);
+#elif CPU(MIPS)
+    return reinterpret_cast<void*>((uintptr_t) regs.machineContext.gregs[12]);
+#else
+#error Unknown Architecture
+#endif
+
+#else
+#error Need a way to get the LLIntPC for another thread on this platform
+#endif
+}
+#endif // ENABLE(SAMPLING_PROFILER)
+
+void MachineThreads::Thread::freeRegisters(Thread::Registers& registers)
+{
+    Thread::Registers::PlatformRegisters& regs = registers.regs;
+#if USE(PTHREADS) && !OS(WINDOWS) && !OS(DARWIN)
+    pthread_attr_destroy(&regs.attribute);
+#else
+    UNUSED_PARAM(regs);
+#endif
+}
+
+static inline int osRedZoneAdjustment()
+{
+    int redZoneAdjustment = 0;
+#if !OS(WINDOWS)
+#if CPU(X86_64)
+    // See http://people.freebsd.org/~obrien/amd64-elf-abi.pdf Section 3.2.2.
+    redZoneAdjustment = -128;
+#elif CPU(ARM64)
+    // See https://developer.apple.com/library/ios/documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARM64FunctionCallingConventions.html#//apple_ref/doc/uid/TP40013702-SW7
+    redZoneAdjustment = -128;
+#endif
+#endif // !OS(WINDOWS)
+    return redZoneAdjustment;
+}
+
+std::pair<void*, size_t> MachineThreads::Thread::captureStack(void* stackTop)
+{
+    char* begin = reinterpret_cast_ptr<char*>(stackBase);
+    char* end = bitwise_cast<char*>(WTF::roundUpToMultipleOf<sizeof(void*)>(reinterpret_cast<uintptr_t>(stackTop)));
+    ASSERT(begin >= end);
+
+    char* endWithRedZone = end + osRedZoneAdjustment();
+    ASSERT(WTF::roundUpToMultipleOf<sizeof(void*)>(reinterpret_cast<uintptr_t>(endWithRedZone)) == reinterpret_cast<uintptr_t>(endWithRedZone));
+
+    if (endWithRedZone < stackEnd)
+        endWithRedZone = reinterpret_cast_ptr<char*>(stackEnd);
+
+    std::swap(begin, endWithRedZone);
+    return std::make_pair(begin, endWithRedZone - begin);
+}
+
+SUPPRESS_ASAN
+static void copyMemory(void* dst, const void* src, size_t size)
+{
+    size_t dstAsSize = reinterpret_cast<size_t>(dst);
+    size_t srcAsSize = reinterpret_cast<size_t>(src);
+    RELEASE_ASSERT(dstAsSize == WTF::roundUpToMultipleOf<sizeof(intptr_t)>(dstAsSize));
+    RELEASE_ASSERT(srcAsSize == WTF::roundUpToMultipleOf<sizeof(intptr_t)>(srcAsSize));
+    RELEASE_ASSERT(size == WTF::roundUpToMultipleOf<sizeof(intptr_t)>(size));
+
+    intptr_t* dstPtr = reinterpret_cast<intptr_t*>(dst);
+    const intptr_t* srcPtr = reinterpret_cast<const intptr_t*>(src);
+    size /= sizeof(intptr_t);
+    while (size--)
+        *dstPtr++ = *srcPtr++;
+}
+    
+
+
+// This function must not call malloc(), free(), or any other function that might
+// acquire a lock. Since 'thread' is suspended, trying to acquire a lock
+// will deadlock if 'thread' holds that lock.
+// This function, specifically the memory copying, was causing problems with Address Sanitizer in
+// apps. Since we cannot blacklist the system memcpy we must use our own naive implementation,
+// copyMemory, for ASan to work on either instrumented or non-instrumented builds. This is not a
+// significant performance loss as tryCopyOtherThreadStack is only called as part of an O(heapsize)
+// operation. As the heap is generally much larger than the stack the performance hit is minimal.
+// See: https://bugs.webkit.org/show_bug.cgi?id=146297
+void MachineThreads::tryCopyOtherThreadStack(Thread* thread, void* buffer, size_t capacity, size_t* size)
+{
+    Thread::Registers registers;
+    size_t registersSize = thread->getRegisters(registers);
+    std::pair<void*, size_t> stack = thread->captureStack(registers.stackPointer());
+
+    bool canCopy = *size + registersSize + stack.second <= capacity;
+
+    if (canCopy)
+        copyMemory(static_cast<char*>(buffer) + *size, &registers, registersSize);
+    *size += registersSize;
+
+    if (canCopy)
+        copyMemory(static_cast<char*>(buffer) + *size, stack.first, stack.second);
+    *size += stack.second;
+
+    thread->freeRegisters(registers);
+}
+
+bool MachineThreads::tryCopyOtherThreadStacks(LockHolder&, void* buffer, size_t capacity, size_t* size)
+{
+    // Prevent two VMs from suspending each other's threads at the same time,
+    // which can cause deadlock: <rdar://problem/20300842>.
+    static StaticLock mutex;
+    std::lock_guard<StaticLock> lock(mutex);
+
+    *size = 0;
+
+    PlatformThread currentPlatformThread = getCurrentPlatformThread();
+    int numberOfThreads = 0; // Using 0 to denote that we haven't counted the number of threads yet.
+    int index = 1;
+    Thread* threadsToBeDeleted = nullptr;
+
+    Thread* previousThread = nullptr;
+    for (Thread* thread = m_registeredThreads; thread; index++) {
+        if (*thread != currentPlatformThread) {
+            bool success = thread->suspend();
+#if OS(DARWIN)
+            if (!success) {
+                if (!numberOfThreads) {
+                    for (Thread* countedThread = m_registeredThreads; countedThread; countedThread = countedThread->next)
+                        numberOfThreads++;
+                }
+                
+                // Re-do the suspension to get the actual failure result for logging.
+                kern_return_t error = thread_suspend(thread->platformThread);
+                ASSERT(error != KERN_SUCCESS);
+
+                WTFReportError(__FILE__, __LINE__, WTF_PRETTY_FUNCTION,
+                    "JavaScript garbage collection encountered an invalid thread (err 0x%x): Thread [%d/%d: %p] platformThread %p.",
+                    error, index, numberOfThreads, thread, reinterpret_cast<void*>(thread->platformThread));
+
+                // Put the invalid thread on the threadsToBeDeleted list.
+                // We can't just delete it here because we have suspended other
+                // threads, and they may still be holding the C heap lock which
+                // we need for deleting the invalid thread. Hence, we need to
+                // defer the deletion till after we have resumed all threads.
+                Thread* nextThread = thread->next;
+                thread->next = threadsToBeDeleted;
+                threadsToBeDeleted = thread;
+
+                if (previousThread)
+                    previousThread->next = nextThread;
+                else
+                    m_registeredThreads = nextThread;
+                thread = nextThread;
+                continue;
+            }
+#else
+            UNUSED_PARAM(numberOfThreads);
+            UNUSED_PARAM(previousThread);
+            ASSERT_UNUSED(success, success);
+#endif
+        }
+        previousThread = thread;
+        thread = thread->next;
+    }
+
+    for (Thread* thread = m_registeredThreads; thread; thread = thread->next) {
+        if (*thread != currentPlatformThread)
+            tryCopyOtherThreadStack(thread, buffer, capacity, size);
+    }
+
+    for (Thread* thread = m_registeredThreads; thread; thread = thread->next) {
+        if (*thread != currentPlatformThread)
+            thread->resume();
+    }
+
+    for (Thread* thread = threadsToBeDeleted; thread; ) {
+        Thread* nextThread = thread->next;
+        delete thread;
+        thread = nextThread;
+    }
+    
+    return *size <= capacity;
+}
+
+static void growBuffer(size_t size, void** buffer, size_t* capacity)
+{
+    if (*buffer)
+        fastFree(*buffer);
+
+    *capacity = WTF::roundUpToMultipleOf(WTF::pageSize(), size * 2);
+    *buffer = fastMalloc(*capacity);
+}
+
+void MachineThreads::gatherConservativeRoots(ConservativeRoots& conservativeRoots, JITStubRoutineSet& jitStubRoutines, CodeBlockSet& codeBlocks)
+{
+    size_t size;
+    size_t capacity = 0;
+    void* buffer = nullptr;
+    LockHolder lock(m_registeredThreadsMutex);
+    while (!tryCopyOtherThreadStacks(lock, buffer, capacity, &size))
+        growBuffer(size, &buffer, &capacity);
+
+    if (!buffer)
+        return;
+
+    conservativeRoots.add(buffer, static_cast<char*>(buffer) + size, jitStubRoutines, codeBlocks);
+    fastFree(buffer);
+}
+
+} // namespace JSC
diff --git a/heap/MachineStackMarker.h b/heap/MachineStackMarker.h
new file mode 100644
index 0000000..07b40dc
--- /dev/null
+++ b/heap/MachineStackMarker.h
@@ -0,0 +1,184 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2009, 2015-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include <setjmp.h>
+#include <wtf/Lock.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/ThreadSpecific.h>
+
+#if OS(DARWIN)
+#include <mach/thread_act.h>
+#endif
+
+#if USE(PTHREADS) && !OS(WINDOWS) && !OS(DARWIN)
+#include <semaphore.h>
+#include <signal.h>
+// Using signal.h didn't make mcontext_t and ucontext_t available on FreeBSD.
+// This bug has been fixed in FreeBSD 11.0-CURRENT, so this workaround can be
+// removed after FreeBSD 10.x goes EOL.
+// https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207079
+#if OS(FREEBSD)
+#include <ucontext.h>
+#endif
+#endif
+
+#if OS(DARWIN)
+typedef mach_port_t PlatformThread;
+#elif OS(WINDOWS)
+typedef DWORD PlatformThread;
+#elif USE(PTHREADS)
+typedef pthread_t PlatformThread;
+#endif // OS(DARWIN)
+
+namespace JSC {
+
+class CodeBlockSet;
+class ConservativeRoots;
+class Heap;
+class JITStubRoutineSet;
+
+class MachineThreads {
+    WTF_MAKE_NONCOPYABLE(MachineThreads);
+public:
+    typedef jmp_buf RegisterState;
+
+    MachineThreads(Heap*);
+    ~MachineThreads();
+
+    void gatherConservativeRoots(ConservativeRoots&, JITStubRoutineSet&, CodeBlockSet&);
+
+    JS_EXPORT_PRIVATE void addCurrentThread(); // Only needs to be called by clients that can use the same heap from multiple threads.
+
+    class Thread {
+        WTF_MAKE_FAST_ALLOCATED;
+        Thread(const PlatformThread& platThread, void* base, void* end);
+
+    public:
+        ~Thread();
+
+        static Thread* createForCurrentThread();
+
+        struct Registers {
+            void* stackPointer() const;
+#if ENABLE(SAMPLING_PROFILER)
+            void* framePointer() const;
+            void* instructionPointer() const;
+            void* llintPC() const;
+#endif // ENABLE(SAMPLING_PROFILER)
+            
+#if OS(DARWIN)
+#if CPU(X86)
+            typedef i386_thread_state_t PlatformRegisters;
+#elif CPU(X86_64)
+            typedef x86_thread_state64_t PlatformRegisters;
+#elif CPU(PPC)
+            typedef ppc_thread_state_t PlatformRegisters;
+#elif CPU(PPC64)
+            typedef ppc_thread_state64_t PlatformRegisters;
+#elif CPU(ARM)
+            typedef arm_thread_state_t PlatformRegisters;
+#elif CPU(ARM64)
+            typedef arm_thread_state64_t PlatformRegisters;
+#else
+#error Unknown Architecture
+#endif
+            
+#elif OS(WINDOWS)
+            typedef CONTEXT PlatformRegisters;
+#elif USE(PTHREADS)
+            struct PlatformRegisters {
+                pthread_attr_t attribute;
+                mcontext_t machineContext;
+            };
+#else
+#error Need a thread register struct for this platform
+#endif
+            
+            PlatformRegisters regs;
+        };
+        
+        bool operator==(const PlatformThread& other) const;
+        bool operator!=(const PlatformThread& other) const { return !(*this == other); }
+
+        bool suspend();
+        void resume();
+        size_t getRegisters(Registers&);
+        void freeRegisters(Registers&);
+        std::pair<void*, size_t> captureStack(void* stackTop);
+
+        Thread* next;
+        PlatformThread platformThread;
+        void* stackBase;
+        void* stackEnd;
+#if OS(WINDOWS)
+        HANDLE platformThreadHandle;
+#elif USE(PTHREADS) && !OS(DARWIN)
+        sem_t semaphoreForSuspendResume;
+        mcontext_t suspendedMachineContext;
+        int suspendCount { 0 };
+        std::atomic<bool> suspended { false };
+#endif
+    };
+
+    Lock& getLock() { return m_registeredThreadsMutex; }
+    Thread* threadsListHead(const LockHolder&) const { ASSERT(m_registeredThreadsMutex.isLocked()); return m_registeredThreads; }
+    Thread* machineThreadForCurrentThread();
+
+private:
+    void tryCopyOtherThreadStack(Thread*, void*, size_t capacity, size_t*);
+    bool tryCopyOtherThreadStacks(LockHolder&, void*, size_t capacity, size_t*);
+
+    static void THREAD_SPECIFIC_CALL removeThread(void*);
+
+    template<typename PlatformThread>
+    void removeThreadIfFound(PlatformThread);
+
+    Lock m_registeredThreadsMutex;
+    Thread* m_registeredThreads;
+    WTF::ThreadSpecificKey m_threadSpecificForMachineThreads;
+#if !ASSERT_DISABLED
+    Heap* m_heap;
+#endif
+};
+
+} // namespace JSC
+
+#if COMPILER(GCC_OR_CLANG)
+#define REGISTER_BUFFER_ALIGNMENT __attribute__ ((aligned (sizeof(void*))))
+#else
+#define REGISTER_BUFFER_ALIGNMENT
+#endif
+
+// ALLOCATE_AND_GET_REGISTER_STATE() is a macro so that it is always "inlined" even in debug builds.
+#if COMPILER(MSVC)
+#pragma warning(push)
+#pragma warning(disable: 4611)
+#define ALLOCATE_AND_GET_REGISTER_STATE(registers) \
+    MachineThreads::RegisterState registers REGISTER_BUFFER_ALIGNMENT; \
+    setjmp(registers)
+#pragma warning(pop)
+#else
+#define ALLOCATE_AND_GET_REGISTER_STATE(registers) \
+    MachineThreads::RegisterState registers REGISTER_BUFFER_ALIGNMENT; \
+    setjmp(registers)
+#endif
diff --git a/heap/MarkStack.cpp b/heap/MarkStack.cpp
new file mode 100644
index 0000000..4ec2f7f
--- /dev/null
+++ b/heap/MarkStack.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2009-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MarkStack.h"
+
+#include "GCSegmentedArrayInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+MarkStackArray::MarkStackArray()
+    : GCSegmentedArray<const JSCell*>()
+{
+}
+
+void MarkStackArray::transferTo(MarkStackArray& other)
+{
+    RELEASE_ASSERT(this != &other);
+    
+    // Remove our head and the head of the other list.
+    GCArraySegment<const JSCell*>* myHead = m_segments.removeHead();
+    GCArraySegment<const JSCell*>* otherHead = other.m_segments.removeHead();
+    m_numberOfSegments--;
+    other.m_numberOfSegments--;
+    
+    other.m_segments.append(m_segments);
+    
+    other.m_numberOfSegments += m_numberOfSegments;
+    m_numberOfSegments = 0;
+    
+    // Put the original heads back in their places.
+    m_segments.push(myHead);
+    other.m_segments.push(otherHead);
+    m_numberOfSegments++;
+    other.m_numberOfSegments++;
+    
+    while (!isEmpty()) {
+        refill();
+        while (canRemoveLast())
+            other.append(removeLast());
+    }
+}
+
+void MarkStackArray::donateSomeCellsTo(MarkStackArray& other)
+{
+    // Try to donate about 1 / 2 of our cells. To reduce copying costs,
+    // we prefer donating whole segments over donating individual cells,
+    // even if this skews away from our 1 / 2 target.
+
+    size_t segmentsToDonate = m_numberOfSegments / 2; // If we only have one segment (our head) we don't donate any segments.
+
+    if (!segmentsToDonate) {
+        size_t cellsToDonate = m_top / 2; // Round down to donate 0 / 1 cells.
+        while (cellsToDonate--) {
+            ASSERT(m_top);
+            other.append(removeLast());
+        }
+        return;
+    }
+
+    validatePrevious();
+    other.validatePrevious();
+
+    // Remove our head and the head of the other list before we start moving segments around.
+    // We'll add them back on once we're done donating.
+    GCArraySegment<const JSCell*>* myHead = m_segments.removeHead();
+    GCArraySegment<const JSCell*>* otherHead = other.m_segments.removeHead();
+
+    while (segmentsToDonate--) {
+        GCArraySegment<const JSCell*>* current = m_segments.removeHead();
+        ASSERT(current);
+        ASSERT(m_numberOfSegments > 1);
+        other.m_segments.push(current);
+        m_numberOfSegments--;
+        other.m_numberOfSegments++;
+    }
+
+    // Put the original heads back in their places.
+    m_segments.push(myHead);
+    other.m_segments.push(otherHead);
+
+    validatePrevious();
+    other.validatePrevious();
+}
+
+void MarkStackArray::stealSomeCellsFrom(MarkStackArray& other, size_t idleThreadCount)
+{
+    // Try to steal 1 / Nth of the shared array, where N is the number of idle threads.
+    // To reduce copying costs, we prefer stealing a whole segment over stealing
+    // individual cells, even if this skews away from our 1 / N target.
+
+    validatePrevious();
+    other.validatePrevious();
+        
+    // If other has an entire segment, steal it and return.
+    if (other.m_numberOfSegments > 1) {
+        // Move the heads of the lists aside. We'll push them back on after.
+        GCArraySegment<const JSCell*>* otherHead = other.m_segments.removeHead();
+        GCArraySegment<const JSCell*>* myHead = m_segments.removeHead();
+
+        ASSERT(other.m_segments.head()->m_top == s_segmentCapacity);
+
+        m_segments.push(other.m_segments.removeHead());
+
+        m_numberOfSegments++;
+        other.m_numberOfSegments--;
+        
+        m_segments.push(myHead);
+        other.m_segments.push(otherHead);
+    
+        validatePrevious();
+        other.validatePrevious();
+        return;
+    }
+
+    // Steal ceil(other.size() / idleThreadCount) things.
+    size_t numberOfCellsToSteal = (other.size() + idleThreadCount - 1) / idleThreadCount;
+    while (numberOfCellsToSteal-- > 0 && other.canRemoveLast())
+        append(other.removeLast());
+}
+
+} // namespace JSC
diff --git a/heap/MarkStack.h b/heap/MarkStack.h
new file mode 100644
index 0000000..75bd040
--- /dev/null
+++ b/heap/MarkStack.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GCSegmentedArray.h"
+
+namespace JSC {
+
+class JSCell;
+
+class MarkStackArray : public GCSegmentedArray<const JSCell*> {
+public:
+    MarkStackArray();
+
+    void transferTo(MarkStackArray&);
+    void donateSomeCellsTo(MarkStackArray&);
+    void stealSomeCellsFrom(MarkStackArray&, size_t idleThreadCount);
+};
+
+} // namespace JSC
diff --git a/heap/MarkedAllocator.cpp b/heap/MarkedAllocator.cpp
new file mode 100644
index 0000000..04754ac
--- /dev/null
+++ b/heap/MarkedAllocator.cpp
@@ -0,0 +1,497 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MarkedAllocator.h"
+
+#include "AllocatingScope.h"
+#include "GCActivityCallback.h"
+#include "Heap.h"
+#include "IncrementalSweeper.h"
+#include "JSCInlines.h"
+#include "MarkedAllocatorInlines.h"
+#include "MarkedBlockInlines.h"
+#include "SuperSampler.h"
+#include "VM.h"
+#include <wtf/CurrentTime.h>
+
+namespace JSC {
+
+MarkedAllocator::MarkedAllocator(Heap* heap, Subspace* subspace, size_t cellSize)
+    : m_currentBlock(0)
+    , m_lastActiveBlock(0)
+    , m_cellSize(static_cast<unsigned>(cellSize))
+    , m_attributes(subspace->attributes())
+    , m_heap(heap)
+    , m_subspace(subspace)
+{
+}
+
+bool MarkedAllocator::isPagedOut(double deadline)
+{
+    unsigned itersSinceLastTimeCheck = 0;
+    for (size_t index = 0; index < m_blocks.size(); ++index) {
+        MarkedBlock::Handle* block = m_blocks[index];
+        if (block)
+            block->block().updateNeedsDestruction();
+        ++itersSinceLastTimeCheck;
+        if (itersSinceLastTimeCheck >= Heap::s_timeCheckResolution) {
+            double currentTime = WTF::monotonicallyIncreasingTime();
+            if (currentTime > deadline)
+                return true;
+            itersSinceLastTimeCheck = 0;
+        }
+    }
+    return false;
+}
+
+bool MarkedAllocator::shouldStealEmptyBlocksFromOtherAllocators() const
+{
+    return !needsDestruction();
+}
+
+MarkedBlock::Handle* MarkedAllocator::findEmptyBlockToSteal()
+{
+    // Don't allow others to steal from us, if we wouldn't steal from others.
+    if (!shouldStealEmptyBlocksFromOtherAllocators())
+        return nullptr;
+    
+    m_emptyCursor = m_empty.findBit(m_emptyCursor, true);
+    if (m_emptyCursor >= m_blocks.size())
+        return nullptr;
+    return m_blocks[m_emptyCursor];
+}
+
+void MarkedAllocator::didConsumeFreeList()
+{
+    if (m_currentBlock)
+        m_currentBlock->didConsumeFreeList();
+    
+    setFreeList(FreeList());
+    m_currentBlock = nullptr;
+}
+
+void* MarkedAllocator::tryAllocateWithoutCollecting()
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    ASSERT(!m_currentBlock);
+    ASSERT(!m_freeList);
+    
+    for (;;) {
+        m_allocationCursor = (m_canAllocateButNotEmpty | m_empty).findBit(m_allocationCursor, true);
+        if (m_allocationCursor >= m_blocks.size())
+            break;
+        
+        setIsCanAllocateButNotEmpty(NoLockingNecessary, m_allocationCursor, false);
+
+        if (void* result = tryAllocateIn(m_blocks[m_allocationCursor]))
+            return result;
+    }
+    
+    if (Options::stealEmptyBlocksFromOtherAllocators()
+        && shouldStealEmptyBlocksFromOtherAllocators()) {
+        if (MarkedBlock::Handle* block = markedSpace().findEmptyBlockToSteal()) {
+            block->sweep();
+            
+            // It's good that this clears canAllocateButNotEmpty as well as all other bits,
+            // because there is a remote chance that a block may have both canAllocateButNotEmpty
+            // and empty set at the same time.
+            block->removeFromAllocator();
+            addBlock(block);
+            return allocateIn(block);
+        }
+    }
+    
+    return nullptr;
+}
+
+void* MarkedAllocator::allocateIn(MarkedBlock::Handle* block)
+{
+    void* result = tryAllocateIn(block);
+    RELEASE_ASSERT(result);
+    return result;
+}
+
+void* MarkedAllocator::tryAllocateIn(MarkedBlock::Handle* block)
+{
+    ASSERT(block);
+    ASSERT(!block->isFreeListed());
+    
+    FreeList freeList = block->sweep(MarkedBlock::Handle::SweepToFreeList);
+    
+    // It's possible to stumble on a completely full block. Marking tries to retire these, but
+    // that algorithm is racy and may forget to do it sometimes.
+    if (freeList.allocationWillFail()) {
+        ASSERT(block->isFreeListed());
+        block->unsweepWithNoNewlyAllocated();
+        ASSERT(!block->isFreeListed());
+        ASSERT(!isEmpty(NoLockingNecessary, block));
+        ASSERT(!isCanAllocateButNotEmpty(NoLockingNecessary, block));
+        return nullptr;
+    }
+    
+    m_currentBlock = block;
+    setFreeList(freeList);
+    
+    void* result;
+    if (m_freeList.remaining) {
+        unsigned cellSize = m_cellSize;
+        m_freeList.remaining -= cellSize;
+        result = m_freeList.payloadEnd - m_freeList.remaining - cellSize;
+    } else {
+        FreeCell* head = m_freeList.head;
+        m_freeList.head = head->next;
+        result = head;
+    }
+    RELEASE_ASSERT(result);
+    setIsEden(NoLockingNecessary, m_currentBlock, true);
+    markedSpace().didAllocateInBlock(m_currentBlock);
+    return result;
+}
+
+ALWAYS_INLINE void MarkedAllocator::doTestCollectionsIfNeeded(GCDeferralContext* deferralContext)
+{
+    if (!Options::slowPathAllocsBetweenGCs())
+        return;
+
+    static unsigned allocationCount = 0;
+    if (!allocationCount) {
+        if (!m_heap->isDeferred()) {
+            if (deferralContext)
+                deferralContext->m_shouldGC = true;
+            else
+                m_heap->collectAllGarbage();
+        }
+    }
+    if (++allocationCount >= Options::slowPathAllocsBetweenGCs())
+        allocationCount = 0;
+}
+
+void* MarkedAllocator::allocateSlowCase(GCDeferralContext* deferralContext)
+{
+    bool crashOnFailure = true;
+    return allocateSlowCaseImpl(deferralContext, crashOnFailure);
+}
+
+void* MarkedAllocator::tryAllocateSlowCase(GCDeferralContext* deferralContext)
+{
+    bool crashOnFailure = false;
+    return allocateSlowCaseImpl(deferralContext, crashOnFailure);
+}
+
+void* MarkedAllocator::allocateSlowCaseImpl(GCDeferralContext* deferralContext, bool crashOnFailure)
+{
+    SuperSamplerScope superSamplerScope(false);
+    ASSERT(m_heap->vm()->currentThreadIsHoldingAPILock());
+    doTestCollectionsIfNeeded(deferralContext);
+
+    ASSERT(!markedSpace().isIterating());
+    m_heap->didAllocate(m_freeList.originalSize);
+    
+    didConsumeFreeList();
+    
+    AllocatingScope helpingHeap(*m_heap);
+
+    m_heap->collectIfNecessaryOrDefer(deferralContext);
+    
+    void* result = tryAllocateWithoutCollecting();
+    
+    if (LIKELY(result != 0))
+        return result;
+    
+    MarkedBlock::Handle* block = tryAllocateBlock();
+    if (!block) {
+        if (crashOnFailure)
+            RELEASE_ASSERT_NOT_REACHED();
+        else
+            return nullptr;
+    }
+    addBlock(block);
+    result = allocateIn(block);
+    ASSERT(result);
+    return result;
+}
+
+static size_t blockHeaderSize()
+{
+    return WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(sizeof(MarkedBlock));
+}
+
+size_t MarkedAllocator::blockSizeForBytes(size_t bytes)
+{
+    size_t minBlockSize = MarkedBlock::blockSize;
+    size_t minAllocationSize = blockHeaderSize() + WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(bytes);
+    minAllocationSize = WTF::roundUpToMultipleOf(WTF::pageSize(), minAllocationSize);
+    return std::max(minBlockSize, minAllocationSize);
+}
+
+MarkedBlock::Handle* MarkedAllocator::tryAllocateBlock()
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    MarkedBlock::Handle* handle = MarkedBlock::tryCreate(*m_heap);
+    if (!handle)
+        return nullptr;
+    
+    markedSpace().didAddBlock(handle);
+    
+    return handle;
+}
+
+void MarkedAllocator::addBlock(MarkedBlock::Handle* block)
+{
+    size_t index;
+    if (m_freeBlockIndices.isEmpty()) {
+        index = m_blocks.size();
+
+        size_t oldCapacity = m_blocks.capacity();
+        m_blocks.append(block);
+        if (m_blocks.capacity() != oldCapacity) {
+            forEachBitVector(
+                NoLockingNecessary,
+                [&] (FastBitVector& vector) {
+                    ASSERT_UNUSED(vector, vector.numBits() == oldCapacity);
+                });
+            
+            ASSERT(m_blocks.capacity() > oldCapacity);
+            
+            LockHolder locker(m_bitvectorLock);
+            forEachBitVector(
+                locker,
+                [&] (FastBitVector& vector) {
+                    vector.resize(m_blocks.capacity());
+                });
+        }
+    } else {
+        index = m_freeBlockIndices.takeLast();
+        ASSERT(!m_blocks[index]);
+        m_blocks[index] = block;
+    }
+    
+    forEachBitVector(
+        NoLockingNecessary,
+        [&] (FastBitVector& vector) {
+            ASSERT_UNUSED(vector, !vector[index]);
+        });
+
+    // This is the point at which the block learns of its cellSize() and attributes().
+    block->didAddToAllocator(this, index);
+    
+    setIsLive(NoLockingNecessary, index, true);
+    setIsEmpty(NoLockingNecessary, index, true);
+}
+
+void MarkedAllocator::removeBlock(MarkedBlock::Handle* block)
+{
+    ASSERT(block->allocator() == this);
+    ASSERT(m_blocks[block->index()] == block);
+
+    m_blocks[block->index()] = nullptr;
+    m_freeBlockIndices.append(block->index());
+    
+    forEachBitVector(
+        holdLock(m_bitvectorLock),
+        [&] (FastBitVector& vector) {
+            vector[block->index()] = false;
+        });
+    
+    block->didRemoveFromAllocator();
+}
+
+void MarkedAllocator::stopAllocating()
+{
+    if (false)
+        dataLog(RawPointer(this), ": MarkedAllocator::stopAllocating!\n");
+    ASSERT(!m_lastActiveBlock);
+    if (!m_currentBlock) {
+        ASSERT(!m_freeList);
+        return;
+    }
+    
+    m_currentBlock->stopAllocating(m_freeList);
+    m_lastActiveBlock = m_currentBlock;
+    m_currentBlock = 0;
+    m_freeList = FreeList();
+}
+
+void MarkedAllocator::prepareForAllocation()
+{
+    m_lastActiveBlock = nullptr;
+    m_currentBlock = nullptr;
+    setFreeList(FreeList());
+
+    m_allocationCursor = 0;
+    m_emptyCursor = 0;
+    m_unsweptCursor = 0;
+    
+    m_eden.clearAll();
+
+    if (UNLIKELY(Options::useImmortalObjects())) {
+        // FIXME: Make this work again.
+        // https://bugs.webkit.org/show_bug.cgi?id=162296
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+
+void MarkedAllocator::lastChanceToFinalize()
+{
+    forEachBlock(
+        [&] (MarkedBlock::Handle* block) {
+            block->lastChanceToFinalize();
+        });
+}
+
+void MarkedAllocator::setFreeList(const FreeList& freeList)
+{
+    m_freeList = freeList;
+}
+
+void MarkedAllocator::resumeAllocating()
+{
+    if (!m_lastActiveBlock)
+        return;
+
+    m_freeList = m_lastActiveBlock->resumeAllocating();
+    m_currentBlock = m_lastActiveBlock;
+    m_lastActiveBlock = nullptr;
+}
+
+void MarkedAllocator::beginMarkingForFullCollection()
+{
+    // Mark bits are sticky and so is our summary of mark bits. We only clear these during full
+    // collections, so if you survived the last collection you will survive the next one so long
+    // as the next one is eden.
+    m_markingNotEmpty.clearAll();
+    m_markingRetired.clearAll();
+}
+
+void MarkedAllocator::endMarking()
+{
+    m_allocated.clearAll();
+    
+    // It's surprising and frustrating to comprehend, but the end-of-marking flip does not need to
+    // know what kind of collection it is. That knowledge is already encoded in the m_markingXYZ
+    // vectors.
+    
+    if (needsDestruction()) {
+        // If blocks need destruction then nothing is empty! This is a correct assertion but may
+        // become wrong once we go full concurrent: when we create a new block, it will flicker
+        // into the empty set for a tiny moment. On the other hand, this code is likely to be run
+        // in stopTheWorld.
+        ASSERT(m_empty.isEmpty());
+        m_canAllocateButNotEmpty = m_live & ~m_markingRetired;
+        return;
+    }
+    
+    m_empty = m_live & ~m_markingNotEmpty;
+    m_canAllocateButNotEmpty = m_live & m_markingNotEmpty & ~m_markingRetired;
+    
+    if (false) {
+        dataLog("Bits for ", m_cellSize, ", ", m_attributes, " after endMarking:\n");
+        dumpBits(WTF::dataFile());
+    }
+}
+
+void MarkedAllocator::snapshotUnsweptForEdenCollection()
+{
+    m_unswept |= m_eden;
+}
+
+void MarkedAllocator::snapshotUnsweptForFullCollection()
+{
+    m_unswept = m_live;
+}
+
+MarkedBlock::Handle* MarkedAllocator::findBlockToSweep()
+{
+    m_unsweptCursor = m_unswept.findBit(m_unsweptCursor, true);
+    if (m_unsweptCursor >= m_blocks.size())
+        return nullptr;
+    return m_blocks[m_unsweptCursor];
+}
+
+void MarkedAllocator::sweep()
+{
+    m_unswept.forEachSetBit(
+        [&] (size_t index) {
+            MarkedBlock::Handle* block = m_blocks[index];
+            block->sweep();
+        });
+}
+
+void MarkedAllocator::shrink()
+{
+    m_empty.forEachSetBit(
+        [&] (size_t index) {
+            markedSpace().freeBlock(m_blocks[index]);
+        });
+}
+
+void MarkedAllocator::assertNoUnswept()
+{
+    if (ASSERT_DISABLED)
+        return;
+    
+    if (m_unswept.isEmpty())
+        return;
+    
+    dataLog("Assertion failed: unswept not empty in ", *this, ".\n");
+    dumpBits();
+    ASSERT_NOT_REACHED();
+}
+
+void MarkedAllocator::dump(PrintStream& out) const
+{
+    out.print(RawPointer(this), ":", m_cellSize, "/", m_attributes);
+}
+
+void MarkedAllocator::dumpBits(PrintStream& out)
+{
+    unsigned maxNameLength = 0;
+    forEachBitVectorWithName(
+        NoLockingNecessary,
+        [&] (FastBitVector&, const char* name) {
+            unsigned length = strlen(name);
+            maxNameLength = std::max(maxNameLength, length);
+        });
+    
+    forEachBitVectorWithName(
+        NoLockingNecessary,
+        [&] (FastBitVector& vector, const char* name) {
+            out.print("    ", name, ": ");
+            for (unsigned i = maxNameLength - strlen(name); i--;)
+                out.print(" ");
+            out.print(vector, "\n");
+        });
+}
+
+MarkedSpace& MarkedAllocator::markedSpace() const
+{
+    return m_subspace->space();
+}
+
+} // namespace JSC
+
diff --git a/heap/MarkedAllocator.h b/heap/MarkedAllocator.h
new file mode 100644
index 0000000..09903e4
--- /dev/null
+++ b/heap/MarkedAllocator.h
@@ -0,0 +1,279 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "AllocatorAttributes.h"
+#include "FreeList.h"
+#include "MarkedBlock.h"
+#include <wtf/FastBitVector.h>
+#include <wtf/SentinelLinkedList.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class GCDeferralContext;
+class Heap;
+class MarkedSpace;
+class LLIntOffsetsExtractor;
+
+#define FOR_EACH_MARKED_ALLOCATOR_BIT(macro) \
+    macro(live, Live) /* The set of block indices that have actual blocks. */\
+    macro(empty, Empty) /* The set of all blocks that have no live objects and nothing to destroy. */ \
+    macro(allocated, Allocated) /* The set of allblocks that are full of live objects. */\
+    macro(canAllocateButNotEmpty, CanAllocateButNotEmpty) /* The set of all blocks are neither empty nor retired (i.e. are more than minMarkedBlockUtilization full). */ \
+    macro(eden, Eden) /* The set of all blocks that have new objects since the last GC. */\
+    macro(unswept, Unswept) /* The set of all blocks that could be swept by the incremental sweeper. */\
+    \
+    /* These are computed during marking. */\
+    macro(markingNotEmpty, MarkingNotEmpty) /* The set of all blocks that are not empty. */ \
+    macro(markingRetired, MarkingRetired) /* The set of all blocks that are retired. */
+
+// FIXME: We defined canAllocateButNotEmpty and empty to be exclusive:
+//
+//     canAllocateButNotEmpty & empty == 0
+//
+// Instead of calling it canAllocate and making it inclusive:
+//
+//     canAllocate & empty == empty
+//
+// The latter is probably better. I'll leave it to a future bug to fix that, since breathing on
+// this code leads to regressions for days, and it's not clear that making this change would
+// improve perf since it would not change the collector's behavior, and either way the allocator
+// has to look at both bitvectors.
+// https://bugs.webkit.org/show_bug.cgi?id=162121
+
+// Note that this collector supports overlapping allocator state with marking state, since in a
+// concurrent collector you allow allocation while marking is running. So it's best to visualize a
+// full mutable->eden collect->mutate->full collect cycle and see how the bits above get affected.
+// The example below tries to be exhaustive about what happens to the bits, but omits a lot of
+// things that happen to other state.
+//
+// Create allocator
+// - all bits are empty
+// Start allocating in some block
+// - allocate the block and set the live bit.
+// - the empty bit for the block flickers on and then gets immediately cleared by sweeping.
+// - set the eden bit.
+// Finish allocating in that block
+// - set the allocated bit.
+// Do that to a lot of blocks and then start an eden collection.
+// - beginMarking() has nothing to do.
+// - by default we have cleared markingNotEmpty/markingRetired bits.
+// - marking builds up markingNotEmpty/markingRetired bits.
+// We do endMarking()
+// - clear all allocated bits.
+// - for destructor blocks: fragmented = live & ~markingRetired
+// - for non-destructor blocks:
+//       empty = live & ~markingNotEmpty
+//       fragmented = live & markingNotEmpty & ~markingRetired
+// Snapshotting.
+// - unswept |= eden
+// Prepare for allocation.
+// - clear eden
+// Finish collection.
+// Allocate in some block that had some free and some live objects.
+// - clear the canAllocateButNotEmpty bit
+// - clear the unswept bit
+// - set the eden bit
+// Finish allocating (set the allocated bit).
+// Allocate in some block that was completely empty.
+// - clear the empty bit
+// - clear the unswept bit
+// - set the eden bit.
+// Finish allocating (set the allocated bit).
+// Allocate in some block that was completely empty in another allocator.
+// - clear the empty bit
+// - clear all bits in that allocator
+// - set the live bit in another allocator and the empty bit.
+// - clear the empty, unswept bits.
+// - set the eden bit.
+// Finish allocating (set the allocated bit).
+// Start a full collection.
+// - beginMarking() clears markingNotEmpty, markingRetired
+// - the heap version is incremented
+// - marking rebuilds markingNotEmpty/markingretired bits.
+// We do endMarking()
+// - clear all allocated bits.
+// - set canAllocateButNotEmpty/empty the same way as in eden collection.
+// Snapshotting.
+// - unswept = live
+// prepare for allocation.
+// - clear eden.
+// Finish collection.
+//
+// Notice how in this scheme, the empty/canAllocateButNotEmpty state stays separate from the
+// markingNotEmpty/markingRetired state. This is one step towards having separated allocation and
+// marking state.
+
+class MarkedAllocator {
+    friend class LLIntOffsetsExtractor;
+
+public:
+    static ptrdiff_t offsetOfFreeList();
+    static ptrdiff_t offsetOfCellSize();
+
+    MarkedAllocator(Heap*, Subspace*, size_t cellSize);
+    void lastChanceToFinalize();
+    void prepareForAllocation();
+    void stopAllocating();
+    void resumeAllocating();
+    void beginMarkingForFullCollection();
+    void endMarking();
+    void snapshotUnsweptForEdenCollection();
+    void snapshotUnsweptForFullCollection();
+    void sweep();
+    void shrink();
+    void assertNoUnswept();
+    size_t cellSize() const { return m_cellSize; }
+    const AllocatorAttributes& attributes() const { return m_attributes; }
+    bool needsDestruction() const { return m_attributes.destruction == NeedsDestruction; }
+    DestructionMode destruction() const { return m_attributes.destruction; }
+    HeapCell::Kind cellKind() const { return m_attributes.cellKind; }
+    void* allocate(GCDeferralContext* = nullptr);
+    void* tryAllocate(GCDeferralContext* = nullptr);
+    Heap* heap() { return m_heap; }
+    MarkedBlock::Handle* takeLastActiveBlock()
+    {
+        MarkedBlock::Handle* block = m_lastActiveBlock;
+        m_lastActiveBlock = 0;
+        return block;
+    }
+    
+    template<typename Functor> void forEachBlock(const Functor&);
+    template<typename Functor> void forEachNotEmptyBlock(const Functor&);
+    
+    void addBlock(MarkedBlock::Handle*);
+    void removeBlock(MarkedBlock::Handle*);
+
+    bool isPagedOut(double deadline);
+    
+    static size_t blockSizeForBytes(size_t);
+    
+    Lock& bitvectorLock() { return m_bitvectorLock; }
+   
+#define MARKED_ALLOCATOR_BIT_ACCESSORS(lowerBitName, capitalBitName)     \
+    bool is ## capitalBitName(const AbstractLocker&, size_t index) const { return m_ ## lowerBitName[index]; } \
+    bool is ## capitalBitName(const AbstractLocker& locker, MarkedBlock::Handle* block) const { return is ## capitalBitName(locker, block->index()); } \
+    void setIs ## capitalBitName(const AbstractLocker&, size_t index, bool value) { m_ ## lowerBitName[index] = value; } \
+    void setIs ## capitalBitName(const AbstractLocker& locker, MarkedBlock::Handle* block, bool value) { setIs ## capitalBitName(locker, block->index(), value); }
+    FOR_EACH_MARKED_ALLOCATOR_BIT(MARKED_ALLOCATOR_BIT_ACCESSORS)
+#undef MARKED_ALLOCATOR_BIT_ACCESSORS
+
+    template<typename Func>
+    void forEachBitVector(const AbstractLocker&, const Func& func)
+    {
+#define MARKED_ALLOCATOR_BIT_CALLBACK(lowerBitName, capitalBitName) \
+        func(m_ ## lowerBitName);
+        FOR_EACH_MARKED_ALLOCATOR_BIT(MARKED_ALLOCATOR_BIT_CALLBACK);
+#undef MARKED_ALLOCATOR_BIT_CALLBACK
+    }
+    
+    template<typename Func>
+    void forEachBitVectorWithName(const AbstractLocker&, const Func& func)
+    {
+#define MARKED_ALLOCATOR_BIT_CALLBACK(lowerBitName, capitalBitName) \
+        func(m_ ## lowerBitName, #capitalBitName);
+        FOR_EACH_MARKED_ALLOCATOR_BIT(MARKED_ALLOCATOR_BIT_CALLBACK);
+#undef MARKED_ALLOCATOR_BIT_CALLBACK
+    }
+    
+    MarkedAllocator* nextAllocator() const { return m_nextAllocator; }
+    MarkedAllocator* nextAllocatorInSubspace() const { return m_nextAllocatorInSubspace; }
+    
+    void setNextAllocator(MarkedAllocator* allocator) { m_nextAllocator = allocator; }
+    void setNextAllocatorInSubspace(MarkedAllocator* allocator) { m_nextAllocatorInSubspace = allocator; }
+    
+    MarkedBlock::Handle* findEmptyBlockToSteal();
+    
+    MarkedBlock::Handle* findBlockToSweep();
+    
+    Subspace* subspace() const { return m_subspace; }
+    MarkedSpace& markedSpace() const;
+    
+    void dump(PrintStream&) const;
+    void dumpBits(PrintStream& = WTF::dataFile());
+    
+private:
+    friend class MarkedBlock;
+    
+    bool shouldStealEmptyBlocksFromOtherAllocators() const;
+    
+    JS_EXPORT_PRIVATE void* allocateSlowCase(GCDeferralContext*);
+    JS_EXPORT_PRIVATE void* tryAllocateSlowCase(GCDeferralContext*);
+    void* allocateSlowCaseImpl(GCDeferralContext*, bool crashOnFailure);
+    void didConsumeFreeList();
+    void* tryAllocateWithoutCollecting();
+    MarkedBlock::Handle* tryAllocateBlock();
+    void* tryAllocateIn(MarkedBlock::Handle*);
+    void* allocateIn(MarkedBlock::Handle*);
+    ALWAYS_INLINE void doTestCollectionsIfNeeded(GCDeferralContext*);
+    
+    void setFreeList(const FreeList&);
+    
+    FreeList m_freeList;
+    
+    Vector<MarkedBlock::Handle*> m_blocks;
+    Vector<unsigned> m_freeBlockIndices;
+
+    // Mutator uses this to guard resizing the bitvectors. Those things in the GC that may run
+    // concurrently to the mutator must lock this when accessing the bitvectors.
+    Lock m_bitvectorLock;
+#define MARKED_ALLOCATOR_BIT_DECLARATION(lowerBitName, capitalBitName) \
+    FastBitVector m_ ## lowerBitName;
+    FOR_EACH_MARKED_ALLOCATOR_BIT(MARKED_ALLOCATOR_BIT_DECLARATION)
+#undef MARKED_ALLOCATOR_BIT_DECLARATION
+    
+    // After you do something to a block based on one of these cursors, you clear the bit in the
+    // corresponding bitvector and leave the cursor where it was.
+    size_t m_allocationCursor { 0 }; // Points to the next block that is a candidate for allocation.
+    size_t m_emptyCursor { 0 }; // Points to the next block that is a candidate for empty allocation (allocating in empty blocks).
+    size_t m_unsweptCursor { 0 }; // Points to the next block that is a candidate for incremental sweeping.
+    
+    MarkedBlock::Handle* m_currentBlock;
+    MarkedBlock::Handle* m_lastActiveBlock;
+
+    Lock m_lock;
+    unsigned m_cellSize;
+    AllocatorAttributes m_attributes;
+    // FIXME: All of these should probably be references.
+    // https://bugs.webkit.org/show_bug.cgi?id=166988
+    Heap* m_heap;
+    Subspace* m_subspace;
+    MarkedAllocator* m_nextAllocator { nullptr };
+    MarkedAllocator* m_nextAllocatorInSubspace { nullptr };
+};
+
+inline ptrdiff_t MarkedAllocator::offsetOfFreeList()
+{
+    return OBJECT_OFFSETOF(MarkedAllocator, m_freeList);
+}
+
+inline ptrdiff_t MarkedAllocator::offsetOfCellSize()
+{
+    return OBJECT_OFFSETOF(MarkedAllocator, m_cellSize);
+}
+
+} // namespace JSC
diff --git a/heap/MarkedAllocatorInlines.h b/heap/MarkedAllocatorInlines.h
new file mode 100644
index 0000000..bd9d707
--- /dev/null
+++ b/heap/MarkedAllocatorInlines.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MarkedAllocator.h"
+
+namespace JSC {
+
+ALWAYS_INLINE void* MarkedAllocator::tryAllocate(GCDeferralContext* deferralContext)
+{
+    unsigned remaining = m_freeList.remaining;
+    if (remaining) {
+        unsigned cellSize = m_cellSize;
+        remaining -= cellSize;
+        m_freeList.remaining = remaining;
+        return m_freeList.payloadEnd - remaining - cellSize;
+    }
+    
+    FreeCell* head = m_freeList.head;
+    if (UNLIKELY(!head))
+        return tryAllocateSlowCase(deferralContext);
+    
+    m_freeList.head = head->next;
+    return head;
+}
+
+ALWAYS_INLINE void* MarkedAllocator::allocate(GCDeferralContext* deferralContext)
+{
+    unsigned remaining = m_freeList.remaining;
+    if (remaining) {
+        unsigned cellSize = m_cellSize;
+        remaining -= cellSize;
+        m_freeList.remaining = remaining;
+        return m_freeList.payloadEnd - remaining - cellSize;
+    }
+    
+    FreeCell* head = m_freeList.head;
+    if (UNLIKELY(!head))
+        return allocateSlowCase(deferralContext);
+    
+    m_freeList.head = head->next;
+    return head;
+}
+
+template <typename Functor> inline void MarkedAllocator::forEachBlock(const Functor& functor)
+{
+    m_live.forEachSetBit(
+        [&] (size_t index) {
+            functor(m_blocks[index]);
+        });
+}
+
+template <typename Functor> inline void MarkedAllocator::forEachNotEmptyBlock(const Functor& functor)
+{
+    m_markingNotEmpty.forEachSetBit(
+        [&] (size_t index) {
+            functor(m_blocks[index]);
+        });
+}
+
+} // namespace JSC
+
diff --git a/heap/MarkedBlock.cpp b/heap/MarkedBlock.cpp
new file mode 100644
index 0000000..88c631d
--- /dev/null
+++ b/heap/MarkedBlock.cpp
@@ -0,0 +1,503 @@
+/*
+ * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MarkedBlock.h"
+
+#include "HelpingGCScope.h"
+#include "JSCell.h"
+#include "JSDestructibleObject.h"
+#include "JSCInlines.h"
+#include "MarkedBlockInlines.h"
+#include "SuperSampler.h"
+
+namespace JSC {
+
+const size_t MarkedBlock::blockSize;
+
+static const bool computeBalance = false;
+static size_t balance;
+
+MarkedBlock::Handle* MarkedBlock::tryCreate(Heap& heap)
+{
+    if (computeBalance) {
+        balance++;
+        if (!(balance % 10))
+            dataLog("MarkedBlock Balance: ", balance, "\n");
+    }
+    void* blockSpace = tryFastAlignedMalloc(blockSize, blockSize);
+    if (!blockSpace)
+        return nullptr;
+    if (scribbleFreeCells())
+        scribble(blockSpace, blockSize);
+    return new Handle(heap, blockSpace);
+}
+
+MarkedBlock::Handle::Handle(Heap& heap, void* blockSpace)
+    : m_weakSet(heap.vm(), CellContainer())
+    , m_newlyAllocatedVersion(MarkedSpace::nullVersion)
+{
+    m_block = new (NotNull, blockSpace) MarkedBlock(*heap.vm(), *this);
+    
+    m_weakSet.setContainer(*m_block);
+    
+    heap.didAllocateBlock(blockSize);
+}
+
+MarkedBlock::Handle::~Handle()
+{
+    Heap& heap = *this->heap();
+    if (computeBalance) {
+        balance--;
+        if (!(balance % 10))
+            dataLog("MarkedBlock Balance: ", balance, "\n");
+    }
+    removeFromAllocator();
+    m_block->~MarkedBlock();
+    fastAlignedFree(m_block);
+    heap.didFreeBlock(blockSize);
+}
+
+MarkedBlock::MarkedBlock(VM& vm, Handle& handle)
+    : m_markingVersion(MarkedSpace::nullVersion)
+    , m_handle(handle)
+    , m_vm(&vm)
+{
+    if (false)
+        dataLog(RawPointer(this), ": Allocated.\n");
+}
+
+void MarkedBlock::Handle::unsweepWithNoNewlyAllocated()
+{
+    RELEASE_ASSERT(m_isFreeListed);
+    m_isFreeListed = false;
+}
+
+void MarkedBlock::Handle::setIsFreeListed()
+{
+    m_allocator->setIsEmpty(NoLockingNecessary, this, false);
+    m_isFreeListed = true;
+}
+
+void MarkedBlock::Handle::stopAllocating(const FreeList& freeList)
+{
+    auto locker = holdLock(block().m_lock);
+    
+    if (false)
+        dataLog(RawPointer(this), ": MarkedBlock::Handle::stopAllocating!\n");
+    ASSERT(!allocator()->isAllocated(NoLockingNecessary, this));
+
+    if (!isFreeListed()) {
+        if (false)
+            dataLog("There ain't no newly allocated.\n");
+        // This means that we either didn't use this block at all for allocation since last GC,
+        // or someone had already done stopAllocating() before.
+        ASSERT(freeList.allocationWillFail());
+        return;
+    }
+    
+    if (false)
+        dataLog("Free list: ", freeList, "\n");
+    
+    // Roll back to a coherent state for Heap introspection. Cells newly
+    // allocated from our free list are not currently marked, so we need another
+    // way to tell what's live vs dead. 
+    
+    m_newlyAllocated.clearAll();
+    m_newlyAllocatedVersion = heap()->objectSpace().newlyAllocatedVersion();
+
+    forEachCell(
+        [&] (HeapCell* cell, HeapCell::Kind) -> IterationStatus {
+            setNewlyAllocated(cell);
+            return IterationStatus::Continue;
+        });
+
+    forEachFreeCell(
+        freeList,
+        [&] (HeapCell* cell) {
+            if (false)
+                dataLog("Free cell: ", RawPointer(cell), "\n");
+            if (m_attributes.destruction == NeedsDestruction)
+                cell->zap();
+            clearNewlyAllocated(cell);
+        });
+    
+    m_isFreeListed = false;
+}
+
+void MarkedBlock::Handle::lastChanceToFinalize()
+{
+    allocator()->setIsAllocated(NoLockingNecessary, this, false);
+    m_block->m_marks.clearAll();
+    m_block->clearHasAnyMarked();
+    m_block->m_markingVersion = heap()->objectSpace().markingVersion();
+    m_weakSet.lastChanceToFinalize();
+    m_newlyAllocated.clearAll();
+    m_newlyAllocatedVersion = heap()->objectSpace().newlyAllocatedVersion();
+    sweep();
+}
+
+FreeList MarkedBlock::Handle::resumeAllocating()
+{
+    {
+        auto locker = holdLock(block().m_lock);
+        
+        if (false)
+            dataLog(RawPointer(this), ": MarkedBlock::Handle::resumeAllocating!\n");
+        ASSERT(!allocator()->isAllocated(NoLockingNecessary, this));
+        ASSERT(!isFreeListed());
+        
+        if (!hasAnyNewlyAllocated()) {
+            if (false)
+                dataLog("There ain't no newly allocated.\n");
+            // This means we had already exhausted the block when we stopped allocation.
+            return FreeList();
+        }
+    }
+
+    // Re-create our free list from before stopping allocation. Note that this may return an empty
+    // freelist, in which case the block will still be Marked!
+    return sweep(SweepToFreeList);
+}
+
+void MarkedBlock::Handle::zap(const FreeList& freeList)
+{
+    forEachFreeCell(
+        freeList,
+        [&] (HeapCell* cell) {
+            if (m_attributes.destruction == NeedsDestruction)
+                cell->zap();
+        });
+}
+
+template<typename Func>
+void MarkedBlock::Handle::forEachFreeCell(const FreeList& freeList, const Func& func)
+{
+    if (freeList.remaining) {
+        for (unsigned remaining = freeList.remaining; remaining; remaining -= cellSize())
+            func(bitwise_cast<HeapCell*>(freeList.payloadEnd - remaining));
+    } else {
+        for (FreeCell* current = freeList.head; current;) {
+            FreeCell* next = current->next;
+            func(bitwise_cast<HeapCell*>(current));
+            current = next;
+        }
+    }
+}
+
+void MarkedBlock::aboutToMarkSlow(HeapVersion markingVersion)
+{
+    ASSERT(vm()->heap.objectSpace().isMarking());
+    LockHolder locker(m_lock);
+    
+    if (!areMarksStale(markingVersion))
+        return;
+    
+    MarkedAllocator* allocator = handle().allocator();
+
+    if (handle().allocator()->isAllocated(holdLock(allocator->bitvectorLock()), &handle())
+        || !marksConveyLivenessDuringMarking(markingVersion)) {
+        if (false)
+            dataLog(RawPointer(this), ": Clearing marks without doing anything else.\n");
+        // We already know that the block is full and is already recognized as such, or that the
+        // block did not survive the previous GC. So, we can clear mark bits the old fashioned
+        // way. Note that it's possible for such a block to have newlyAllocated with an up-to-
+        // date version! If it does, then we want to leave the newlyAllocated alone, since that
+        // means that we had allocated in this previously empty block but did not fill it up, so
+        // we created a newlyAllocated.
+        m_marks.clearAll();
+    } else {
+        if (false)
+            dataLog(RawPointer(this), ": Doing things.\n");
+        HeapVersion newlyAllocatedVersion = space()->newlyAllocatedVersion();
+        if (handle().m_newlyAllocatedVersion == newlyAllocatedVersion) {
+            // Merge the contents of marked into newlyAllocated. If we get the full set of bits
+            // then invalidate newlyAllocated and set allocated.
+            handle().m_newlyAllocated.mergeAndClear(m_marks);
+        } else {
+            // Replace the contents of newlyAllocated with marked. If we get the full set of
+            // bits then invalidate newlyAllocated and set allocated.
+            handle().m_newlyAllocated.setAndClear(m_marks);
+        }
+        handle().m_newlyAllocatedVersion = newlyAllocatedVersion;
+    }
+    clearHasAnyMarked();
+    WTF::storeStoreFence();
+    m_markingVersion = markingVersion;
+    
+    // This means we're the first ones to mark any object in this block.
+    allocator->setIsMarkingNotEmpty(holdLock(allocator->bitvectorLock()), &handle(), true);
+}
+
+void MarkedBlock::Handle::resetAllocated()
+{
+    m_newlyAllocated.clearAll();
+    m_newlyAllocatedVersion = MarkedSpace::nullVersion;
+}
+
+void MarkedBlock::resetMarks()
+{
+    // We want aboutToMarkSlow() to see what the mark bits were after the last collection. It uses
+    // the version number to distinguish between the marks having already been stale before
+    // beginMarking(), or just stale now that beginMarking() bumped the version. If we have a version
+    // wraparound, then we will call this method before resetting the version to null. When the
+    // version is null, aboutToMarkSlow() will assume that the marks were not stale as of before
+    // beginMarking(). Hence the need to whip the marks into shape.
+    if (areMarksStale())
+        m_marks.clearAll();
+    m_markingVersion = MarkedSpace::nullVersion;
+}
+
+#if !ASSERT_DISABLED
+void MarkedBlock::assertMarksNotStale()
+{
+    ASSERT(m_markingVersion == vm()->heap.objectSpace().markingVersion());
+}
+#endif // !ASSERT_DISABLED
+
+bool MarkedBlock::areMarksStale()
+{
+    return areMarksStale(vm()->heap.objectSpace().markingVersion());
+}
+
+bool MarkedBlock::Handle::areMarksStale()
+{
+    return m_block->areMarksStale();
+}
+
+bool MarkedBlock::isMarked(const void* p)
+{
+    return isMarked(vm()->heap.objectSpace().markingVersion(), p);
+}
+
+void MarkedBlock::Handle::didConsumeFreeList()
+{
+    auto locker = holdLock(block().m_lock);
+    if (false)
+        dataLog(RawPointer(this), ": MarkedBlock::Handle::didConsumeFreeList!\n");
+    ASSERT(isFreeListed());
+    m_isFreeListed = false;
+    allocator()->setIsAllocated(NoLockingNecessary, this, true);
+}
+
+size_t MarkedBlock::markCount()
+{
+    return areMarksStale() ? 0 : m_marks.count();
+}
+
+bool MarkedBlock::Handle::isEmpty()
+{
+    return m_allocator->isEmpty(NoLockingNecessary, this);
+}
+
+void MarkedBlock::clearHasAnyMarked()
+{
+    m_biasedMarkCount = m_markCountBias;
+}
+
+void MarkedBlock::noteMarkedSlow()
+{
+    MarkedAllocator* allocator = handle().allocator();
+    allocator->setIsMarkingRetired(holdLock(allocator->bitvectorLock()), &handle(), true);
+}
+
+void MarkedBlock::Handle::removeFromAllocator()
+{
+    if (!m_allocator)
+        return;
+    
+    m_allocator->removeBlock(this);
+}
+
+void MarkedBlock::updateNeedsDestruction()
+{
+    m_needsDestruction = handle().needsDestruction();
+}
+
+void MarkedBlock::Handle::didAddToAllocator(MarkedAllocator* allocator, size_t index)
+{
+    ASSERT(m_index == std::numeric_limits<size_t>::max());
+    ASSERT(!m_allocator);
+    
+    m_index = index;
+    m_allocator = allocator;
+    
+    size_t cellSize = allocator->cellSize();
+    m_atomsPerCell = (cellSize + atomSize - 1) / atomSize;
+    m_endAtom = atomsPerBlock - m_atomsPerCell + 1;
+    
+    m_attributes = allocator->attributes();
+
+    if (m_attributes.cellKind != HeapCell::JSCell)
+        RELEASE_ASSERT(m_attributes.destruction == DoesNotNeedDestruction);
+    
+    block().updateNeedsDestruction();
+    
+    double markCountBias = -(Options::minMarkedBlockUtilization() * cellsPerBlock());
+    
+    // The mark count bias should be comfortably within this range.
+    RELEASE_ASSERT(markCountBias > static_cast<double>(std::numeric_limits<int16_t>::min()));
+    RELEASE_ASSERT(markCountBias < 0);
+    
+    // This means we haven't marked anything yet.
+    block().m_biasedMarkCount = block().m_markCountBias = static_cast<int16_t>(markCountBias);
+}
+
+void MarkedBlock::Handle::didRemoveFromAllocator()
+{
+    ASSERT(m_index != std::numeric_limits<size_t>::max());
+    ASSERT(m_allocator);
+    
+    m_index = std::numeric_limits<size_t>::max();
+    m_allocator = nullptr;
+}
+
+bool MarkedBlock::Handle::isLive(const HeapCell* cell)
+{
+    return isLive(space()->markingVersion(), space()->isMarking(), cell);
+}
+
+bool MarkedBlock::Handle::isLiveCell(const void* p)
+{
+    return isLiveCell(space()->markingVersion(), space()->isMarking(), p);
+}
+
+#if !ASSERT_DISABLED
+void MarkedBlock::assertValidCell(VM& vm, HeapCell* cell) const
+{
+    RELEASE_ASSERT(&vm == this->vm());
+    RELEASE_ASSERT(const_cast<MarkedBlock*>(this)->handle().cellAlign(cell) == cell);
+}
+#endif
+
+void MarkedBlock::Handle::dumpState(PrintStream& out)
+{
+    CommaPrinter comma;
+    allocator()->forEachBitVectorWithName(
+        holdLock(allocator()->bitvectorLock()),
+        [&] (FastBitVector& bitvector, const char* name) {
+            out.print(comma, name, ":", bitvector[index()] ? "YES" : "no");
+        });
+}
+
+Subspace* MarkedBlock::Handle::subspace() const
+{
+    return allocator()->subspace();
+}
+
+FreeList MarkedBlock::Handle::sweep(SweepMode sweepMode)
+{
+    // FIXME: Maybe HelpingGCScope should just be called SweepScope?
+    HelpingGCScope helpingGCScope(*heap());
+    
+    m_allocator->setIsUnswept(NoLockingNecessary, this, false);
+    
+    m_weakSet.sweep();
+
+    if (sweepMode == SweepOnly && m_attributes.destruction == DoesNotNeedDestruction)
+        return FreeList();
+
+    if (UNLIKELY(m_isFreeListed)) {
+        RELEASE_ASSERT(sweepMode == SweepToFreeList);
+        return FreeList();
+    }
+    
+    ASSERT(!m_allocator->isAllocated(NoLockingNecessary, this));
+    
+    if (space()->isMarking())
+        block().m_lock.lock();
+    
+    if (m_attributes.destruction == NeedsDestruction)
+        return subspace()->finishSweep(*this, sweepMode);
+    
+    // Handle the no-destructor specializations here, since we have the most of those. This
+    // ensures that they don't get re-specialized for every destructor space.
+    
+    EmptyMode emptyMode = this->emptyMode();
+    ScribbleMode scribbleMode = this->scribbleMode();
+    NewlyAllocatedMode newlyAllocatedMode = this->newlyAllocatedMode();
+    MarksMode marksMode = this->marksMode();
+    
+    FreeList result;
+    auto trySpecialized = [&] () -> bool {
+        if (sweepMode != SweepToFreeList)
+            return false;
+        if (scribbleMode != DontScribble)
+            return false;
+        if (newlyAllocatedMode != DoesNotHaveNewlyAllocated)
+            return false;
+        
+        switch (emptyMode) {
+        case IsEmpty:
+            switch (marksMode) {
+            case MarksNotStale:
+                result = specializedSweep<true, IsEmpty, SweepToFreeList, BlockHasNoDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksNotStale>(IsEmpty, SweepToFreeList, BlockHasNoDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksNotStale, [] (VM&, JSCell*) { });
+                return true;
+            case MarksStale:
+                result = specializedSweep<true, IsEmpty, SweepToFreeList, BlockHasNoDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksStale>(IsEmpty, SweepToFreeList, BlockHasNoDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksStale, [] (VM&, JSCell*) { });
+                return true;
+            }
+            break;
+        case NotEmpty:
+            switch (marksMode) {
+            case MarksNotStale:
+                result = specializedSweep<true, NotEmpty, SweepToFreeList, BlockHasNoDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksNotStale>(IsEmpty, SweepToFreeList, BlockHasNoDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksNotStale, [] (VM&, JSCell*) { });
+                return true;
+            case MarksStale:
+                result = specializedSweep<true, NotEmpty, SweepToFreeList, BlockHasNoDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksStale>(IsEmpty, SweepToFreeList, BlockHasNoDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksStale, [] (VM&, JSCell*) { });
+                return true;
+            }
+            break;
+        }
+        
+        return false;
+    };
+    
+    if (trySpecialized())
+        return result;
+
+    // The template arguments don't matter because the first one is false.
+    return specializedSweep<false, IsEmpty, SweepOnly, BlockHasNoDestructors, DontScribble, HasNewlyAllocated, MarksStale>(emptyMode, sweepMode, BlockHasNoDestructors, scribbleMode, newlyAllocatedMode, marksMode, [] (VM&, JSCell*) { });
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::MarkedBlock::Handle::SweepMode mode)
+{
+    switch (mode) {
+    case JSC::MarkedBlock::Handle::SweepToFreeList:
+        out.print("SweepToFreeList");
+        return;
+    case JSC::MarkedBlock::Handle::SweepOnly:
+        out.print("SweepOnly");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/heap/MarkedBlock.h b/heap/MarkedBlock.h
new file mode 100644
index 0000000..b105941
--- /dev/null
+++ b/heap/MarkedBlock.h
@@ -0,0 +1,621 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "AllocatorAttributes.h"
+#include "DestructionMode.h"
+#include "FreeList.h"
+#include "HeapCell.h"
+#include "IterationStatus.h"
+#include "WeakSet.h"
+#include <wtf/Atomics.h>
+#include <wtf/Bitmap.h>
+#include <wtf/DataLog.h>
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/HashFunctions.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+    
+class Heap;
+class JSCell;
+class MarkedAllocator;
+class MarkedSpace;
+class SlotVisitor;
+class Subspace;
+
+typedef uintptr_t Bits;
+typedef uint32_t HeapVersion;
+
+// A marked block is a page-aligned container for heap-allocated objects.
+// Objects are allocated within cells of the marked block. For a given
+// marked block, all cells have the same size. Objects smaller than the
+// cell size may be allocated in the marked block, in which case the
+// allocation suffers from internal fragmentation: wasted space whose
+// size is equal to the difference between the cell size and the object
+// size.
+
+class MarkedBlock {
+    WTF_MAKE_NONCOPYABLE(MarkedBlock);
+    friend class LLIntOffsetsExtractor;
+    friend struct VerifyMarked;
+
+public:
+    class Handle;
+private:
+    friend class Handle;
+public:
+    static const size_t atomSize = 16; // bytes
+    static const size_t blockSize = 16 * KB;
+    static const size_t blockMask = ~(blockSize - 1); // blockSize must be a power of two.
+
+    static const size_t atomsPerBlock = blockSize / atomSize;
+
+    static_assert(!(MarkedBlock::atomSize & (MarkedBlock::atomSize - 1)), "MarkedBlock::atomSize must be a power of two.");
+    static_assert(!(MarkedBlock::blockSize & (MarkedBlock::blockSize - 1)), "MarkedBlock::blockSize must be a power of two.");
+    
+    struct VoidFunctor {
+        typedef void ReturnType;
+        void returnValue() { }
+    };
+    
+    class CountFunctor {
+    public:
+        typedef size_t ReturnType;
+
+        CountFunctor() : m_count(0) { }
+        void count(size_t count) const { m_count += count; }
+        ReturnType returnValue() const { return m_count; }
+
+    private:
+        // FIXME: This is mutable because we're using a functor rather than C++ lambdas.
+        // https://bugs.webkit.org/show_bug.cgi?id=159644
+        mutable ReturnType m_count;
+    };
+        
+    class Handle {
+        WTF_MAKE_NONCOPYABLE(Handle);
+        WTF_MAKE_FAST_ALLOCATED;
+        friend class LLIntOffsetsExtractor;
+        friend class MarkedBlock;
+        friend struct VerifyMarked;
+    public:
+            
+        ~Handle();
+            
+        MarkedBlock& block();
+            
+        void* cellAlign(void*);
+            
+        bool isEmpty();
+
+        void lastChanceToFinalize();
+
+        MarkedAllocator* allocator() const;
+        Subspace* subspace() const;
+        Heap* heap() const;
+        inline MarkedSpace* space() const;
+        VM* vm() const;
+        WeakSet& weakSet();
+            
+        // Sweeping ensures that destructors get called and removes the block from the unswept
+        // set. Sweeping to free list also removes the block from the empty set, if it was in that
+        // set. Sweeping with SweepOnly may add this block to the empty set, if the block is found
+        // to be empty.
+        //
+        // Note that you need to make sure that the empty bit reflects reality. If it's not set
+        // and the block is freshly created, then we'll make the mistake of running destructors in
+        // the block. If it's not set and the block has nothing marked, then we'll make the
+        // mistake of making a pop freelist rather than a bump freelist.
+        enum SweepMode { SweepOnly, SweepToFreeList };
+        FreeList sweep(SweepMode = SweepOnly);
+        
+        // This is to be called by Subspace.
+        template<typename DestroyFunc>
+        FreeList finishSweepKnowingSubspace(SweepMode, const DestroyFunc&);
+        
+        void unsweepWithNoNewlyAllocated();
+        
+        void zap(const FreeList&);
+        
+        void shrink();
+            
+        void visitWeakSet(SlotVisitor&);
+        void reapWeakSet();
+            
+        // While allocating from a free list, MarkedBlock temporarily has bogus
+        // cell liveness data. To restore accurate cell liveness data, call one
+        // of these functions:
+        void didConsumeFreeList(); // Call this once you've allocated all the items in the free list.
+        void stopAllocating(const FreeList&);
+        FreeList resumeAllocating(); // Call this if you canonicalized a block for some non-collection related purpose.
+            
+        size_t cellSize();
+        inline unsigned cellsPerBlock();
+        
+        const AllocatorAttributes& attributes() const;
+        DestructionMode destruction() const;
+        bool needsDestruction() const;
+        HeapCell::Kind cellKind() const;
+            
+        size_t markCount();
+        size_t size();
+        
+        inline bool isLive(HeapVersion markingVersion, bool isMarking, const HeapCell*);
+        inline bool isLiveCell(HeapVersion markingVersion, bool isMarking, const void*);
+
+        bool isLive(const HeapCell*);
+        bool isLiveCell(const void*);
+
+        bool isNewlyAllocated(const void*);
+        void setNewlyAllocated(const void*);
+        void clearNewlyAllocated(const void*);
+        
+        HeapVersion newlyAllocatedVersion() const { return m_newlyAllocatedVersion; }
+        
+        inline bool isNewlyAllocatedStale() const;
+        
+        inline bool hasAnyNewlyAllocated();
+        void resetAllocated();
+        
+        template <typename Functor> IterationStatus forEachCell(const Functor&);
+        template <typename Functor> inline IterationStatus forEachLiveCell(const Functor&);
+        template <typename Functor> inline IterationStatus forEachDeadCell(const Functor&);
+        template <typename Functor> inline IterationStatus forEachMarkedCell(const Functor&);
+            
+        JS_EXPORT_PRIVATE bool areMarksStale();
+        
+        void assertMarksNotStale();
+            
+        bool isFreeListed() const { return m_isFreeListed; }
+        
+        size_t index() const { return m_index; }
+        
+        void removeFromAllocator();
+        
+        void didAddToAllocator(MarkedAllocator*, size_t index);
+        void didRemoveFromAllocator();
+        
+        void dumpState(PrintStream&);
+        
+    private:
+        Handle(Heap&, void*);
+        
+        enum SweepDestructionMode { BlockHasNoDestructors, BlockHasDestructors, BlockHasDestructorsAndCollectorIsRunning };
+        enum ScribbleMode { DontScribble, Scribble };
+        enum EmptyMode { IsEmpty, NotEmpty };
+        enum NewlyAllocatedMode { HasNewlyAllocated, DoesNotHaveNewlyAllocated };
+        enum MarksMode { MarksStale, MarksNotStale };
+        
+        SweepDestructionMode sweepDestructionMode();
+        EmptyMode emptyMode();
+        ScribbleMode scribbleMode();
+        NewlyAllocatedMode newlyAllocatedMode();
+        MarksMode marksMode();
+        
+        template<bool, EmptyMode, SweepMode, SweepDestructionMode, ScribbleMode, NewlyAllocatedMode, MarksMode, typename DestroyFunc>
+        FreeList specializedSweep(EmptyMode, SweepMode, SweepDestructionMode, ScribbleMode, NewlyAllocatedMode, MarksMode, const DestroyFunc&);
+        
+        template<typename Func>
+        void forEachFreeCell(const FreeList&, const Func&);
+        
+        void setIsFreeListed();
+        
+        MarkedBlock::Handle* m_prev;
+        MarkedBlock::Handle* m_next;
+            
+        size_t m_atomsPerCell { std::numeric_limits<size_t>::max() };
+        size_t m_endAtom { std::numeric_limits<size_t>::max() }; // This is a fuzzy end. Always test for < m_endAtom.
+            
+        WTF::Bitmap<atomsPerBlock> m_newlyAllocated;
+            
+        AllocatorAttributes m_attributes;
+        bool m_isFreeListed { false };
+            
+        MarkedAllocator* m_allocator { nullptr };
+        size_t m_index { std::numeric_limits<size_t>::max() };
+        WeakSet m_weakSet;
+        
+        HeapVersion m_newlyAllocatedVersion;
+            
+        MarkedBlock* m_block { nullptr };
+    };
+        
+    static MarkedBlock::Handle* tryCreate(Heap&);
+        
+    Handle& handle();
+        
+    VM* vm() const;
+    inline Heap* heap() const;
+    inline MarkedSpace* space() const;
+
+    static bool isAtomAligned(const void*);
+    static MarkedBlock* blockFor(const void*);
+    static size_t firstAtom();
+    size_t atomNumber(const void*);
+        
+    size_t markCount();
+
+    bool isMarked(const void*);
+    bool isMarked(HeapVersion markingVersion, const void*);
+    bool isMarkedConcurrently(HeapVersion markingVersion, const void*);
+    bool testAndSetMarked(const void*);
+        
+    bool isAtom(const void*);
+    void clearMarked(const void*);
+    
+    size_t cellSize();
+    const AllocatorAttributes& attributes() const;
+    
+    bool hasAnyMarked() const;
+    void noteMarked();
+#if ASSERT_DISABLED
+    void assertValidCell(VM&, HeapCell*) const { }
+#else
+    void assertValidCell(VM&, HeapCell*) const;
+#endif
+        
+    WeakSet& weakSet();
+
+    JS_EXPORT_PRIVATE bool areMarksStale();
+    bool areMarksStale(HeapVersion markingVersion);
+    struct MarksWithDependency {
+        bool areStale;
+        ConsumeDependency dependency;
+    };
+    MarksWithDependency areMarksStaleWithDependency(HeapVersion markingVersion);
+    
+    void aboutToMark(HeapVersion markingVersion);
+        
+    void assertMarksNotStale();
+        
+    bool needsDestruction() const { return m_needsDestruction; }
+    
+    // This is usually a no-op, and we use it as a no-op that touches the page in isPagedOut().
+    void updateNeedsDestruction();
+    
+    void resetMarks();
+    
+    bool isMarkedRaw(const void* p);
+    HeapVersion markingVersion() const { return m_markingVersion; }
+    
+private:
+    static const size_t atomAlignmentMask = atomSize - 1;
+
+    typedef char Atom[atomSize];
+
+    MarkedBlock(VM&, Handle&);
+    Atom* atoms();
+        
+    void aboutToMarkSlow(HeapVersion markingVersion);
+    void clearHasAnyMarked();
+    
+    void noteMarkedSlow();
+    
+    inline bool marksConveyLivenessDuringMarking(HeapVersion markingVersion);
+        
+    WTF::Bitmap<atomsPerBlock> m_marks;
+
+    bool m_needsDestruction;
+    Lock m_lock;
+    
+    // The actual mark count can be computed by doing: m_biasedMarkCount - m_markCountBias. Note
+    // that this count is racy. It will accurately detect whether or not exactly zero things were
+    // marked, but if N things got marked, then this may report anything in the range [1, N] (or
+    // before unbiased, it would be [1 + m_markCountBias, N + m_markCountBias].)
+    int16_t m_biasedMarkCount;
+    
+    // We bias the mark count so that if m_biasedMarkCount >= 0 then the block should be retired.
+    // We go to all this trouble to make marking a bit faster: this way, marking knows when to
+    // retire a block using a js/jns on m_biasedMarkCount.
+    //
+    // For example, if a block has room for 100 objects and retirement happens whenever 90% are
+    // live, then m_markCountBias will be -90. This way, when marking begins, this will cause us to
+    // set m_biasedMarkCount to -90 as well, since:
+    //
+    //     m_biasedMarkCount = actualMarkCount + m_markCountBias.
+    //
+    // Marking an object will increment m_biasedMarkCount. Once 90 objects get marked, we will have
+    // m_biasedMarkCount = 0, which will trigger retirement. In other words, we want to set
+    // m_markCountBias like so:
+    //
+    //     m_markCountBias = -(minMarkedBlockUtilization * cellsPerBlock)
+    //
+    // All of this also means that you can detect if any objects are marked by doing:
+    //
+    //     m_biasedMarkCount != m_markCountBias
+    int16_t m_markCountBias;
+
+    HeapVersion m_markingVersion;
+    
+    Handle& m_handle;
+    VM* m_vm;
+};
+
+inline MarkedBlock::Handle& MarkedBlock::handle()
+{
+    return m_handle;
+}
+
+inline MarkedBlock& MarkedBlock::Handle::block()
+{
+    return *m_block;
+}
+
+inline size_t MarkedBlock::firstAtom()
+{
+    return WTF::roundUpToMultipleOf<atomSize>(sizeof(MarkedBlock)) / atomSize;
+}
+
+inline MarkedBlock::Atom* MarkedBlock::atoms()
+{
+    return reinterpret_cast<Atom*>(this);
+}
+
+inline bool MarkedBlock::isAtomAligned(const void* p)
+{
+    return !(reinterpret_cast<Bits>(p) & atomAlignmentMask);
+}
+
+inline void* MarkedBlock::Handle::cellAlign(void* p)
+{
+    Bits base = reinterpret_cast<Bits>(block().atoms() + firstAtom());
+    Bits bits = reinterpret_cast<Bits>(p);
+    bits -= base;
+    bits -= bits % cellSize();
+    bits += base;
+    return reinterpret_cast<void*>(bits);
+}
+
+inline MarkedBlock* MarkedBlock::blockFor(const void* p)
+{
+    return reinterpret_cast<MarkedBlock*>(reinterpret_cast<Bits>(p) & blockMask);
+}
+
+inline MarkedAllocator* MarkedBlock::Handle::allocator() const
+{
+    return m_allocator;
+}
+
+inline Heap* MarkedBlock::Handle::heap() const
+{
+    return m_weakSet.heap();
+}
+
+inline VM* MarkedBlock::Handle::vm() const
+{
+    return m_weakSet.vm();
+}
+
+inline VM* MarkedBlock::vm() const
+{
+    return m_vm;
+}
+
+inline WeakSet& MarkedBlock::Handle::weakSet()
+{
+    return m_weakSet;
+}
+
+inline WeakSet& MarkedBlock::weakSet()
+{
+    return m_handle.weakSet();
+}
+
+inline void MarkedBlock::Handle::shrink()
+{
+    m_weakSet.shrink();
+}
+
+inline void MarkedBlock::Handle::visitWeakSet(SlotVisitor& visitor)
+{
+    return m_weakSet.visit(visitor);
+}
+
+inline void MarkedBlock::Handle::reapWeakSet()
+{
+    m_weakSet.reap();
+}
+
+inline size_t MarkedBlock::Handle::cellSize()
+{
+    return m_atomsPerCell * atomSize;
+}
+
+inline size_t MarkedBlock::cellSize()
+{
+    return m_handle.cellSize();
+}
+
+inline const AllocatorAttributes& MarkedBlock::Handle::attributes() const
+{
+    return m_attributes;
+}
+
+inline const AllocatorAttributes& MarkedBlock::attributes() const
+{
+    return m_handle.attributes();
+}
+
+inline bool MarkedBlock::Handle::needsDestruction() const
+{
+    return m_attributes.destruction == NeedsDestruction;
+}
+
+inline DestructionMode MarkedBlock::Handle::destruction() const
+{
+    return m_attributes.destruction;
+}
+
+inline HeapCell::Kind MarkedBlock::Handle::cellKind() const
+{
+    return m_attributes.cellKind;
+}
+
+inline size_t MarkedBlock::Handle::markCount()
+{
+    return m_block->markCount();
+}
+
+inline size_t MarkedBlock::Handle::size()
+{
+    return markCount() * cellSize();
+}
+
+inline size_t MarkedBlock::atomNumber(const void* p)
+{
+    return (reinterpret_cast<Bits>(p) - reinterpret_cast<Bits>(this)) / atomSize;
+}
+
+inline bool MarkedBlock::areMarksStale(HeapVersion markingVersion)
+{
+    return markingVersion != m_markingVersion;
+}
+
+ALWAYS_INLINE MarkedBlock::MarksWithDependency MarkedBlock::areMarksStaleWithDependency(HeapVersion markingVersion)
+{
+    auto consumed = consumeLoad(&m_markingVersion);
+    MarksWithDependency ret;
+    ret.areStale = consumed.value != markingVersion;
+    ret.dependency = consumed.dependency;
+    return ret;
+}
+
+inline void MarkedBlock::aboutToMark(HeapVersion markingVersion)
+{
+    if (UNLIKELY(areMarksStale(markingVersion)))
+        aboutToMarkSlow(markingVersion);
+    WTF::loadLoadFence();
+}
+
+#if ASSERT_DISABLED
+inline void MarkedBlock::assertMarksNotStale()
+{
+}
+#endif // ASSERT_DISABLED
+
+inline void MarkedBlock::Handle::assertMarksNotStale()
+{
+    block().assertMarksNotStale();
+}
+
+inline bool MarkedBlock::isMarkedRaw(const void* p)
+{
+    return m_marks.get(atomNumber(p));
+}
+
+inline bool MarkedBlock::isMarked(HeapVersion markingVersion, const void* p)
+{
+    return areMarksStale(markingVersion) ? false : isMarkedRaw(p);
+}
+
+inline bool MarkedBlock::isMarkedConcurrently(HeapVersion markingVersion, const void* p)
+{
+    auto marksWithDependency = areMarksStaleWithDependency(markingVersion);
+    if (marksWithDependency.areStale)
+        return false;
+    return m_marks.get(atomNumber(p) + marksWithDependency.dependency);
+}
+
+inline bool MarkedBlock::testAndSetMarked(const void* p)
+{
+    assertMarksNotStale();
+    return m_marks.concurrentTestAndSet(atomNumber(p));
+}
+
+inline bool MarkedBlock::Handle::isNewlyAllocated(const void* p)
+{
+    return m_newlyAllocated.get(m_block->atomNumber(p));
+}
+
+inline void MarkedBlock::Handle::setNewlyAllocated(const void* p)
+{
+    m_newlyAllocated.set(m_block->atomNumber(p));
+}
+
+inline void MarkedBlock::Handle::clearNewlyAllocated(const void* p)
+{
+    m_newlyAllocated.clear(m_block->atomNumber(p));
+}
+
+inline bool MarkedBlock::isAtom(const void* p)
+{
+    ASSERT(MarkedBlock::isAtomAligned(p));
+    size_t atomNumber = this->atomNumber(p);
+    size_t firstAtom = MarkedBlock::firstAtom();
+    if (atomNumber < firstAtom) // Filters pointers into MarkedBlock metadata.
+        return false;
+    if ((atomNumber - firstAtom) % m_handle.m_atomsPerCell) // Filters pointers into cell middles.
+        return false;
+    if (atomNumber >= m_handle.m_endAtom) // Filters pointers into invalid cells out of the range.
+        return false;
+    return true;
+}
+
+template <typename Functor>
+inline IterationStatus MarkedBlock::Handle::forEachCell(const Functor& functor)
+{
+    HeapCell::Kind kind = m_attributes.cellKind;
+    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+        HeapCell* cell = reinterpret_cast_ptr<HeapCell*>(&m_block->atoms()[i]);
+        if (functor(cell, kind) == IterationStatus::Done)
+            return IterationStatus::Done;
+    }
+    return IterationStatus::Continue;
+}
+
+inline bool MarkedBlock::hasAnyMarked() const
+{
+    return m_biasedMarkCount != m_markCountBias;
+}
+
+inline void MarkedBlock::noteMarked()
+{
+    // This is racy by design. We don't want to pay the price of an atomic increment!
+    int16_t biasedMarkCount = m_biasedMarkCount;
+    ++biasedMarkCount;
+    m_biasedMarkCount = biasedMarkCount;
+    if (UNLIKELY(!biasedMarkCount))
+        noteMarkedSlow();
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+struct MarkedBlockHash : PtrHash<JSC::MarkedBlock*> {
+    static unsigned hash(JSC::MarkedBlock* const& key)
+    {
+        // Aligned VM regions tend to be monotonically increasing integers,
+        // which is a great hash function, but we have to remove the low bits,
+        // since they're always zero, which is a terrible hash function!
+        return reinterpret_cast<JSC::Bits>(key) / JSC::MarkedBlock::blockSize;
+    }
+};
+
+template<> struct DefaultHash<JSC::MarkedBlock*> {
+    typedef MarkedBlockHash Hash;
+};
+
+void printInternal(PrintStream& out, JSC::MarkedBlock::Handle::SweepMode);
+
+} // namespace WTF
diff --git a/heap/MarkedBlockInlines.h b/heap/MarkedBlockInlines.h
new file mode 100644
index 0000000..78379f3
--- /dev/null
+++ b/heap/MarkedBlockInlines.h
@@ -0,0 +1,394 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "MarkedAllocator.h"
+#include "MarkedBlock.h"
+#include "MarkedSpace.h"
+#include "Operations.h"
+#include "SuperSampler.h"
+#include "VM.h"
+
+namespace JSC {
+
+inline unsigned MarkedBlock::Handle::cellsPerBlock()
+{
+    return MarkedSpace::blockPayload / cellSize();
+}
+
+inline bool MarkedBlock::Handle::isNewlyAllocatedStale() const
+{
+    return m_newlyAllocatedVersion != space()->newlyAllocatedVersion();
+}
+
+inline bool MarkedBlock::Handle::hasAnyNewlyAllocated()
+{
+    return !isNewlyAllocatedStale();
+}
+
+inline Heap* MarkedBlock::heap() const
+{
+    return &vm()->heap;
+}
+
+inline MarkedSpace* MarkedBlock::space() const
+{
+    return &heap()->objectSpace();
+}
+
+inline MarkedSpace* MarkedBlock::Handle::space() const
+{
+    return &heap()->objectSpace();
+}
+
+inline bool MarkedBlock::marksConveyLivenessDuringMarking(HeapVersion markingVersion)
+{
+    // This returns true if any of these is true:
+    // - We just created the block and so the bits are clear already.
+    // - This block has objects marked during the last GC, and so its version was up-to-date just
+    //   before the current collection did beginMarking(). This means that any objects that have 
+    //   their mark bit set are valid objects that were never deleted, and so are candidates for
+    //   marking in any conservative scan. Using our jargon, they are "live".
+    // - We did ~2^32 collections and rotated the version back to null, so we needed to hard-reset
+    //   everything. If the marks had been stale, we would have cleared them. So, we can be sure that
+    //   any set mark bit reflects objects marked during last GC, i.e. "live" objects.
+    // It would be absurd to use this method when not collecting, since this special "one version
+    // back" state only makes sense when we're in a concurrent collection and have to be
+    // conservative.
+    ASSERT(space()->isMarking());
+    if (heap()->collectionScope() != CollectionScope::Full)
+        return false;
+    return m_markingVersion == MarkedSpace::nullVersion
+        || MarkedSpace::nextVersion(m_markingVersion) == markingVersion;
+}
+
+inline bool MarkedBlock::Handle::isLive(HeapVersion markingVersion, bool isMarking, const HeapCell* cell)
+{
+    ASSERT(!isFreeListed());
+    
+    if (UNLIKELY(hasAnyNewlyAllocated())) {
+        if (isNewlyAllocated(cell))
+            return true;
+    }
+    
+    if (allocator()->isAllocated(NoLockingNecessary, this))
+        return true;
+    
+    MarkedBlock& block = this->block();
+    
+    if (block.areMarksStale()) {
+        if (!isMarking)
+            return false;
+        if (!block.marksConveyLivenessDuringMarking(markingVersion))
+            return false;
+    }
+
+    return block.m_marks.get(block.atomNumber(cell));
+}
+
+inline bool MarkedBlock::Handle::isLiveCell(HeapVersion markingVersion, bool isMarking, const void* p)
+{
+    if (!m_block->isAtom(p))
+        return false;
+    return isLive(markingVersion, isMarking, static_cast<const HeapCell*>(p));
+}
+
+// The following has to be true for specialization to kick in:
+//
+// sweepMode == SweepToFreeList
+// scribbleMode == DontScribble
+// newlyAllocatedMode == DoesNotHaveNewlyAllocated
+// destructionMode != BlockHasDestrictorsAndCollectorIsRunning
+//
+// emptyMode = IsEmpty
+//     destructionMode = DoesNotNeedDestruction
+//         marksMode = MarksNotStale (1)
+//         marksMode = MarksStale (2)
+// emptyMode = NotEmpty
+//     destructionMode = DoesNotNeedDestruction
+//         marksMode = MarksNotStale (3)
+//         marksMode = MarksStale (4)
+//     destructionMode = NeedsDestruction
+//         marksMode = MarksNotStale (5)
+//         marksMode = MarksStale (6)
+//
+// Only the DoesNotNeedDestruction one should be specialized by MarkedBlock.
+
+template<bool specialize, MarkedBlock::Handle::EmptyMode specializedEmptyMode, MarkedBlock::Handle::SweepMode specializedSweepMode, MarkedBlock::Handle::SweepDestructionMode specializedDestructionMode, MarkedBlock::Handle::ScribbleMode specializedScribbleMode, MarkedBlock::Handle::NewlyAllocatedMode specializedNewlyAllocatedMode, MarkedBlock::Handle::MarksMode specializedMarksMode, typename DestroyFunc>
+FreeList MarkedBlock::Handle::specializedSweep(MarkedBlock::Handle::EmptyMode emptyMode, MarkedBlock::Handle::SweepMode sweepMode, MarkedBlock::Handle::SweepDestructionMode destructionMode, MarkedBlock::Handle::ScribbleMode scribbleMode, MarkedBlock::Handle::NewlyAllocatedMode newlyAllocatedMode, MarkedBlock::Handle::MarksMode marksMode, const DestroyFunc& destroyFunc)
+{
+    if (specialize) {
+        emptyMode = specializedEmptyMode;
+        sweepMode = specializedSweepMode;
+        destructionMode = specializedDestructionMode;
+        scribbleMode = specializedScribbleMode;
+        newlyAllocatedMode = specializedNewlyAllocatedMode;
+        marksMode = specializedMarksMode;
+    }
+    
+    RELEASE_ASSERT(!(destructionMode == BlockHasNoDestructors && sweepMode == SweepOnly));
+    
+    SuperSamplerScope superSamplerScope(false);
+
+    MarkedBlock& block = this->block();
+    
+    if (false)
+        dataLog(RawPointer(this), "/", RawPointer(&block), ": MarkedBlock::Handle::specializedSweep!\n");
+    
+    if (Options::useBumpAllocator()
+        && emptyMode == IsEmpty
+        && newlyAllocatedMode == DoesNotHaveNewlyAllocated) {
+        
+        // This is an incredibly powerful assertion that checks the sanity of our block bits.
+        if (marksMode == MarksNotStale && !block.m_marks.isEmpty()) {
+            WTF::dataFile().atomically(
+                [&] (PrintStream& out) {
+                    out.print("Block ", RawPointer(&block), ": marks not empty!\n");
+                    out.print("Block lock is held: ", block.m_lock.isHeld(), "\n");
+                    out.print("Marking version of block: ", block.m_markingVersion, "\n");
+                    out.print("Marking version of heap: ", space()->markingVersion(), "\n");
+                    UNREACHABLE_FOR_PLATFORM();
+                });
+        }
+        
+        char* startOfLastCell = static_cast<char*>(cellAlign(block.atoms() + m_endAtom - 1));
+        char* payloadEnd = startOfLastCell + cellSize();
+        RELEASE_ASSERT(payloadEnd - MarkedBlock::blockSize <= bitwise_cast<char*>(&block));
+        char* payloadBegin = bitwise_cast<char*>(block.atoms() + firstAtom());
+        if (scribbleMode == Scribble)
+            scribble(payloadBegin, payloadEnd - payloadBegin);
+        if (sweepMode == SweepToFreeList)
+            setIsFreeListed();
+        else
+            m_allocator->setIsEmpty(NoLockingNecessary, this, true);
+        if (space()->isMarking())
+            block.m_lock.unlock();
+        FreeList result = FreeList::bump(payloadEnd, payloadEnd - payloadBegin);
+        if (false)
+            dataLog("Quickly swept block ", RawPointer(this), " with cell size ", cellSize(), " and attributes ", m_attributes, ": ", result, "\n");
+        return result;
+    }
+
+    // This produces a free list that is ordered in reverse through the block.
+    // This is fine, since the allocation code makes no assumptions about the
+    // order of the free list.
+    FreeCell* head = 0;
+    size_t count = 0;
+    bool isEmpty = true;
+    Vector<size_t> deadCells;
+    VM& vm = *this->vm();
+    auto handleDeadCell = [&] (size_t i) {
+        HeapCell* cell = reinterpret_cast_ptr<HeapCell*>(&block.atoms()[i]);
+
+        if (destructionMode != BlockHasNoDestructors && emptyMode == NotEmpty) {
+            JSCell* jsCell = static_cast<JSCell*>(cell);
+            if (!jsCell->isZapped()) {
+                destroyFunc(vm, jsCell);
+                jsCell->zap();
+            }
+        }
+
+        if (sweepMode == SweepToFreeList) {
+            FreeCell* freeCell = reinterpret_cast_ptr<FreeCell*>(cell);
+            if (scribbleMode == Scribble)
+                scribble(freeCell, cellSize());
+            freeCell->next = head;
+            head = freeCell;
+            ++count;
+        }
+    };
+    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+        if (emptyMode == NotEmpty
+            && ((marksMode == MarksNotStale && block.m_marks.get(i))
+                || (newlyAllocatedMode == HasNewlyAllocated && m_newlyAllocated.get(i)))) {
+            isEmpty = false;
+            continue;
+        }
+        
+        if (destructionMode == BlockHasDestructorsAndCollectorIsRunning)
+            deadCells.append(i);
+        else
+            handleDeadCell(i);
+    }
+    
+    // We only want to discard the newlyAllocated bits if we're creating a FreeList,
+    // otherwise we would lose information on what's currently alive.
+    if (sweepMode == SweepToFreeList && newlyAllocatedMode == HasNewlyAllocated)
+        m_newlyAllocatedVersion = MarkedSpace::nullVersion;
+    
+    if (space()->isMarking())
+        block.m_lock.unlock();
+    
+    if (destructionMode == BlockHasDestructorsAndCollectorIsRunning) {
+        for (size_t i : deadCells)
+            handleDeadCell(i);
+    }
+
+    FreeList result = FreeList::list(head, count * cellSize());
+    if (sweepMode == SweepToFreeList)
+        setIsFreeListed();
+    else if (isEmpty)
+        m_allocator->setIsEmpty(NoLockingNecessary, this, true);
+    if (false)
+        dataLog("Slowly swept block ", RawPointer(&block), " with cell size ", cellSize(), " and attributes ", m_attributes, ": ", result, "\n");
+    return result;
+}
+
+template<typename DestroyFunc>
+FreeList MarkedBlock::Handle::finishSweepKnowingSubspace(SweepMode sweepMode, const DestroyFunc& destroyFunc)
+{
+    SweepDestructionMode destructionMode = this->sweepDestructionMode();
+    EmptyMode emptyMode = this->emptyMode();
+    ScribbleMode scribbleMode = this->scribbleMode();
+    NewlyAllocatedMode newlyAllocatedMode = this->newlyAllocatedMode();
+    MarksMode marksMode = this->marksMode();
+
+    FreeList result;
+    auto trySpecialized = [&] () -> bool {
+        if (sweepMode != SweepToFreeList)
+            return false;
+        if (scribbleMode != DontScribble)
+            return false;
+        if (newlyAllocatedMode != DoesNotHaveNewlyAllocated)
+            return false;
+        if (destructionMode != BlockHasDestructors)
+            return false;
+        if (emptyMode == IsEmpty)
+            return false;
+        
+        switch (marksMode) {
+        case MarksNotStale:
+            result = specializedSweep<true, NotEmpty, SweepToFreeList, BlockHasDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksNotStale>(IsEmpty, SweepToFreeList, BlockHasDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksNotStale, destroyFunc);
+            return true;
+        case MarksStale:
+            result = specializedSweep<true, NotEmpty, SweepToFreeList, BlockHasDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksStale>(IsEmpty, SweepToFreeList, BlockHasDestructors, DontScribble, DoesNotHaveNewlyAllocated, MarksStale, destroyFunc);
+            return true;
+        }
+        
+        return false;
+    };
+    
+    if (trySpecialized())
+        return result;
+    
+    // The template arguments don't matter because the first one is false.
+    return specializedSweep<false, IsEmpty, SweepOnly, BlockHasNoDestructors, DontScribble, HasNewlyAllocated, MarksStale>(emptyMode, sweepMode, destructionMode, scribbleMode, newlyAllocatedMode, marksMode, destroyFunc);
+}
+
+inline MarkedBlock::Handle::SweepDestructionMode MarkedBlock::Handle::sweepDestructionMode()
+{
+    if (m_attributes.destruction == NeedsDestruction) {
+        if (space()->isMarking())
+            return BlockHasDestructorsAndCollectorIsRunning;
+        return BlockHasDestructors;
+    }
+    return BlockHasNoDestructors;
+}
+
+inline MarkedBlock::Handle::EmptyMode MarkedBlock::Handle::emptyMode()
+{
+    // It's not obvious, but this is the only way to know if the block is empty. It's the only
+    // bit that captures these caveats:
+    // - It's true when the block is freshly allocated.
+    // - It's true if the block had been swept in the past, all destructors were called, and that
+    //   sweep proved that the block is empty.
+    // - It's false if there are any destructors that need to be called, even if the block has no
+    //   live objects.
+    return m_allocator->isEmpty(NoLockingNecessary, this) ? IsEmpty : NotEmpty;
+}
+
+inline MarkedBlock::Handle::ScribbleMode MarkedBlock::Handle::scribbleMode()
+{
+    return scribbleFreeCells() ? Scribble : DontScribble;
+}
+
+inline MarkedBlock::Handle::NewlyAllocatedMode MarkedBlock::Handle::newlyAllocatedMode()
+{
+    return hasAnyNewlyAllocated() ? HasNewlyAllocated : DoesNotHaveNewlyAllocated;
+}
+
+inline MarkedBlock::Handle::MarksMode MarkedBlock::Handle::marksMode()
+{
+    HeapVersion markingVersion = space()->markingVersion();
+    bool marksAreUseful = !block().areMarksStale(markingVersion);
+    if (space()->isMarking())
+        marksAreUseful |= block().marksConveyLivenessDuringMarking(markingVersion);
+    return marksAreUseful ? MarksNotStale : MarksStale;
+}
+
+template <typename Functor>
+inline IterationStatus MarkedBlock::Handle::forEachLiveCell(const Functor& functor)
+{
+    HeapCell::Kind kind = m_attributes.cellKind;
+    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+        HeapCell* cell = reinterpret_cast_ptr<HeapCell*>(&m_block->atoms()[i]);
+        if (!isLive(cell))
+            continue;
+
+        if (functor(cell, kind) == IterationStatus::Done)
+            return IterationStatus::Done;
+    }
+    return IterationStatus::Continue;
+}
+
+template <typename Functor>
+inline IterationStatus MarkedBlock::Handle::forEachDeadCell(const Functor& functor)
+{
+    HeapCell::Kind kind = m_attributes.cellKind;
+    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+        HeapCell* cell = reinterpret_cast_ptr<HeapCell*>(&m_block->atoms()[i]);
+        if (isLive(cell))
+            continue;
+
+        if (functor(cell, kind) == IterationStatus::Done)
+            return IterationStatus::Done;
+    }
+    return IterationStatus::Continue;
+}
+
+template <typename Functor>
+inline IterationStatus MarkedBlock::Handle::forEachMarkedCell(const Functor& functor)
+{
+    HeapCell::Kind kind = m_attributes.cellKind;
+    MarkedBlock& block = this->block();
+    bool areMarksStale = block.areMarksStale();
+    WTF::loadLoadFence();
+    if (areMarksStale)
+        return IterationStatus::Continue;
+    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+        HeapCell* cell = reinterpret_cast_ptr<HeapCell*>(&m_block->atoms()[i]);
+        if (!block.isMarkedRaw(cell))
+            continue;
+
+        if (functor(cell, kind) == IterationStatus::Done)
+            return IterationStatus::Done;
+    }
+    return IterationStatus::Continue;
+}
+
+} // namespace JSC
+
diff --git a/heap/MarkedBlockSet.h b/heap/MarkedBlockSet.h
new file mode 100644
index 0000000..d54e901
--- /dev/null
+++ b/heap/MarkedBlockSet.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "MarkedBlock.h"
+#include "TinyBloomFilter.h"
+#include <wtf/HashSet.h>
+
+namespace JSC {
+
+class MarkedBlock;
+
+class MarkedBlockSet {
+public:
+    void add(MarkedBlock*);
+    void remove(MarkedBlock*);
+
+    TinyBloomFilter filter() const;
+    const HashSet<MarkedBlock*>& set() const;
+
+private:
+    void recomputeFilter();
+
+    TinyBloomFilter m_filter;
+    HashSet<MarkedBlock*> m_set;
+};
+
+inline void MarkedBlockSet::add(MarkedBlock* block)
+{
+    m_filter.add(reinterpret_cast<Bits>(block));
+    m_set.add(block);
+}
+
+inline void MarkedBlockSet::remove(MarkedBlock* block)
+{
+    unsigned oldCapacity = m_set.capacity();
+    m_set.remove(block);
+    if (m_set.capacity() != oldCapacity) // Indicates we've removed a lot of blocks.
+        recomputeFilter();
+}
+
+inline void MarkedBlockSet::recomputeFilter()
+{
+    TinyBloomFilter filter;
+    for (HashSet<MarkedBlock*>::iterator it = m_set.begin(); it != m_set.end(); ++it)
+        filter.add(reinterpret_cast<Bits>(*it));
+    m_filter = filter;
+}
+
+inline TinyBloomFilter MarkedBlockSet::filter() const
+{
+    return m_filter;
+}
+
+inline const HashSet<MarkedBlock*>& MarkedBlockSet::set() const
+{
+    return m_set;
+}
+
+} // namespace JSC
diff --git a/heap/MarkedSpace.cpp b/heap/MarkedSpace.cpp
new file mode 100644
index 0000000..6caad4f
--- /dev/null
+++ b/heap/MarkedSpace.cpp
@@ -0,0 +1,579 @@
+/*
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "MarkedSpace.h"
+
+#include "FunctionCodeBlock.h"
+#include "IncrementalSweeper.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "MarkedAllocatorInlines.h"
+#include "MarkedBlockInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+std::array<size_t, MarkedSpace::numSizeClasses> MarkedSpace::s_sizeClassForSizeStep;
+
+namespace {
+
+const Vector<size_t>& sizeClasses()
+{
+    static Vector<size_t>* result;
+    static std::once_flag once;
+    std::call_once(
+        once,
+        [] {
+            result = new Vector<size_t>();
+            
+            auto add = [&] (size_t sizeClass) {
+                sizeClass = WTF::roundUpToMultipleOf<MarkedBlock::atomSize>(sizeClass);
+                if (Options::dumpSizeClasses())
+                    dataLog("Adding JSC MarkedSpace size class: ", sizeClass, "\n");
+                // Perform some validation as we go.
+                RELEASE_ASSERT(!(sizeClass % MarkedSpace::sizeStep));
+                if (result->isEmpty())
+                    RELEASE_ASSERT(sizeClass == MarkedSpace::sizeStep);
+                result->append(sizeClass);
+            };
+            
+            // This is a definition of the size classes in our GC. It must define all of the
+            // size classes from sizeStep up to largeCutoff.
+    
+            // Have very precise size classes for the small stuff. This is a loop to make it easy to reduce
+            // atomSize.
+            for (size_t size = MarkedSpace::sizeStep; size < MarkedSpace::preciseCutoff; size += MarkedSpace::sizeStep)
+                add(size);
+            
+            // We want to make sure that the remaining size classes minimize internal fragmentation (i.e.
+            // the wasted space at the tail end of a MarkedBlock) while proceeding roughly in an exponential
+            // way starting at just above the precise size classes to four cells per block.
+            
+            if (Options::dumpSizeClasses())
+                dataLog("    Marked block payload size: ", static_cast<size_t>(MarkedSpace::blockPayload), "\n");
+            
+            for (unsigned i = 0; ; ++i) {
+                double approximateSize = MarkedSpace::preciseCutoff * pow(Options::sizeClassProgression(), i);
+                
+                if (Options::dumpSizeClasses())
+                    dataLog("    Next size class as a double: ", approximateSize, "\n");
+        
+                size_t approximateSizeInBytes = static_cast<size_t>(approximateSize);
+        
+                if (Options::dumpSizeClasses())
+                    dataLog("    Next size class as bytes: ", approximateSizeInBytes, "\n");
+        
+                // Make sure that the computer did the math correctly.
+                RELEASE_ASSERT(approximateSizeInBytes >= MarkedSpace::preciseCutoff);
+                
+                if (approximateSizeInBytes > MarkedSpace::largeCutoff)
+                    break;
+                
+                size_t sizeClass =
+                    WTF::roundUpToMultipleOf<MarkedSpace::sizeStep>(approximateSizeInBytes);
+                
+                if (Options::dumpSizeClasses())
+                    dataLog("    Size class: ", sizeClass, "\n");
+                
+                // Optimize the size class so that there isn't any slop at the end of the block's
+                // payload.
+                unsigned cellsPerBlock = MarkedSpace::blockPayload / sizeClass;
+                size_t possiblyBetterSizeClass = (MarkedSpace::blockPayload / cellsPerBlock) & ~(MarkedSpace::sizeStep - 1);
+                
+                if (Options::dumpSizeClasses())
+                    dataLog("    Possibly better size class: ", possiblyBetterSizeClass, "\n");
+
+                // The size class we just came up with is better than the other one if it reduces
+                // total wastage assuming we only allocate cells of that size.
+                size_t originalWastage = MarkedSpace::blockPayload - cellsPerBlock * sizeClass;
+                size_t newWastage = (possiblyBetterSizeClass - sizeClass) * cellsPerBlock;
+                
+                if (Options::dumpSizeClasses())
+                    dataLog("    Original wastage: ", originalWastage, ", new wastage: ", newWastage, "\n");
+                
+                size_t betterSizeClass;
+                if (newWastage > originalWastage)
+                    betterSizeClass = sizeClass;
+                else
+                    betterSizeClass = possiblyBetterSizeClass;
+                
+                if (Options::dumpSizeClasses())
+                    dataLog("    Choosing size class: ", betterSizeClass, "\n");
+                
+                if (betterSizeClass == result->last()) {
+                    // Defense for when expStep is small.
+                    continue;
+                }
+                
+                // This is usually how we get out of the loop.
+                if (betterSizeClass > MarkedSpace::largeCutoff
+                    || betterSizeClass > Options::largeAllocationCutoff())
+                    break;
+                
+                add(betterSizeClass);
+            }
+
+            add(sizeof(UnlinkedFunctionExecutable));
+            add(sizeof(UnlinkedFunctionCodeBlock));
+            add(sizeof(FunctionExecutable));
+            add(sizeof(FunctionCodeBlock));
+
+            {
+                // Sort and deduplicate.
+                std::sort(result->begin(), result->end());
+                auto it = std::unique(result->begin(), result->end());
+                result->shrinkCapacity(it - result->begin());
+            }
+
+            if (Options::dumpSizeClasses())
+                dataLog("JSC Heap MarkedSpace size class dump: ", listDump(*result), "\n");
+
+            // We have an optimiation in MarkedSpace::optimalSizeFor() that assumes things about
+            // the size class table. This checks our results against that function's assumptions.
+            for (size_t size = MarkedSpace::sizeStep, i = 0; size <= MarkedSpace::preciseCutoff; size += MarkedSpace::sizeStep, i++)
+                RELEASE_ASSERT(result->at(i) == size);
+        });
+    return *result;
+}
+
+template<typename TableType, typename SizeClassCons, typename DefaultCons>
+void buildSizeClassTable(TableType& table, const SizeClassCons& cons, const DefaultCons& defaultCons)
+{
+    size_t nextIndex = 0;
+    for (size_t sizeClass : sizeClasses()) {
+        auto entry = cons(sizeClass);
+        size_t index = MarkedSpace::sizeClassToIndex(sizeClass);
+        for (size_t i = nextIndex; i <= index; ++i)
+            table[i] = entry;
+        nextIndex = index + 1;
+    }
+    for (size_t i = nextIndex; i < MarkedSpace::numSizeClasses; ++i)
+        table[i] = defaultCons(MarkedSpace::indexToSizeClass(i));
+}
+
+} // anonymous namespace
+
+void MarkedSpace::initializeSizeClassForStepSize()
+{
+    static std::once_flag flag;
+    std::call_once(
+        flag,
+        [] {
+            buildSizeClassTable(
+                s_sizeClassForSizeStep,
+                [&] (size_t sizeClass) -> size_t {
+                    return sizeClass;
+                },
+                [&] (size_t sizeClass) -> size_t {
+                    return sizeClass;
+                });
+        });
+}
+
+MarkedSpace::MarkedSpace(Heap* heap)
+    : m_heap(heap)
+    , m_capacity(0)
+    , m_isIterating(false)
+{
+    initializeSizeClassForStepSize();
+}
+
+MarkedSpace::~MarkedSpace()
+{
+    forEachBlock(
+        [&] (MarkedBlock::Handle* block) {
+            freeBlock(block);
+        });
+    for (LargeAllocation* allocation : m_largeAllocations)
+        allocation->destroy();
+    ASSERT(!m_blocks.set().size());
+}
+
+void MarkedSpace::lastChanceToFinalize()
+{
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.lastChanceToFinalize();
+            return IterationStatus::Continue;
+        });
+    for (LargeAllocation* allocation : m_largeAllocations)
+        allocation->lastChanceToFinalize();
+}
+
+void MarkedSpace::sweep()
+{
+    m_heap->sweeper()->willFinishSweeping();
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.sweep();
+            return IterationStatus::Continue;
+        });
+}
+
+void MarkedSpace::sweepLargeAllocations()
+{
+    RELEASE_ASSERT(m_largeAllocationsNurseryOffset == m_largeAllocations.size());
+    unsigned srcIndex = m_largeAllocationsNurseryOffsetForSweep;
+    unsigned dstIndex = srcIndex;
+    while (srcIndex < m_largeAllocations.size()) {
+        LargeAllocation* allocation = m_largeAllocations[srcIndex++];
+        allocation->sweep();
+        if (allocation->isEmpty()) {
+            m_capacity -= allocation->cellSize();
+            allocation->destroy();
+            continue;
+        }
+        m_largeAllocations[dstIndex++] = allocation;
+    }
+    m_largeAllocations.resize(dstIndex);
+    m_largeAllocationsNurseryOffset = m_largeAllocations.size();
+}
+
+void MarkedSpace::prepareForAllocation()
+{
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.prepareForAllocation();
+            return IterationStatus::Continue;
+        });
+
+    m_activeWeakSets.takeFrom(m_newActiveWeakSets);
+    
+    if (m_heap->collectionScope() == CollectionScope::Eden)
+        m_largeAllocationsNurseryOffsetForSweep = m_largeAllocationsNurseryOffset;
+    else
+        m_largeAllocationsNurseryOffsetForSweep = 0;
+    m_largeAllocationsNurseryOffset = m_largeAllocations.size();
+    
+    m_allocatorForEmptyAllocation = m_firstAllocator;
+}
+
+void MarkedSpace::visitWeakSets(SlotVisitor& visitor)
+{
+    auto visit = [&] (WeakSet* weakSet) {
+        weakSet->visit(visitor);
+    };
+    
+    m_newActiveWeakSets.forEach(visit);
+    
+    if (m_heap->collectionScope() == CollectionScope::Full)
+        m_activeWeakSets.forEach(visit);
+}
+
+void MarkedSpace::reapWeakSets()
+{
+    auto visit = [&] (WeakSet* weakSet) {
+        weakSet->reap();
+    };
+    
+    m_newActiveWeakSets.forEach(visit);
+    
+    if (m_heap->collectionScope() == CollectionScope::Full)
+        m_activeWeakSets.forEach(visit);
+}
+
+void MarkedSpace::stopAllocating()
+{
+    ASSERT(!isIterating());
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.stopAllocating();
+            return IterationStatus::Continue;
+        });
+}
+
+void MarkedSpace::prepareForConservativeScan()
+{
+    m_largeAllocationsForThisCollectionBegin = m_largeAllocations.begin() + m_largeAllocationsOffsetForThisCollection;
+    m_largeAllocationsForThisCollectionSize = m_largeAllocations.size() - m_largeAllocationsOffsetForThisCollection;
+    m_largeAllocationsForThisCollectionEnd = m_largeAllocations.end();
+    RELEASE_ASSERT(m_largeAllocationsForThisCollectionEnd == m_largeAllocationsForThisCollectionBegin + m_largeAllocationsForThisCollectionSize);
+    
+    std::sort(
+        m_largeAllocationsForThisCollectionBegin, m_largeAllocationsForThisCollectionEnd,
+        [&] (LargeAllocation* a, LargeAllocation* b) {
+            return a < b;
+        });
+}
+
+void MarkedSpace::prepareForMarking()
+{
+    if (m_heap->collectionScope() == CollectionScope::Eden)
+        m_largeAllocationsOffsetForThisCollection = m_largeAllocationsNurseryOffset;
+    else
+        m_largeAllocationsOffsetForThisCollection = 0;
+}
+
+void MarkedSpace::resumeAllocating()
+{
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.resumeAllocating();
+            return IterationStatus::Continue;
+        });
+    // Nothing to do for LargeAllocations.
+}
+
+bool MarkedSpace::isPagedOut(double deadline)
+{
+    bool result = false;
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            if (allocator.isPagedOut(deadline)) {
+                result = true;
+                return IterationStatus::Done;
+            }
+            return IterationStatus::Continue;
+        });
+    // FIXME: Consider taking LargeAllocations into account here.
+    return result;
+}
+
+void MarkedSpace::freeBlock(MarkedBlock::Handle* block)
+{
+    block->allocator()->removeBlock(block);
+    m_capacity -= MarkedBlock::blockSize;
+    m_blocks.remove(&block->block());
+    delete block;
+}
+
+void MarkedSpace::freeOrShrinkBlock(MarkedBlock::Handle* block)
+{
+    if (!block->isEmpty()) {
+        block->shrink();
+        return;
+    }
+
+    freeBlock(block);
+}
+
+void MarkedSpace::shrink()
+{
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.shrink();
+            return IterationStatus::Continue;
+        });
+}
+
+void MarkedSpace::beginMarking()
+{
+    if (m_heap->collectionScope() == CollectionScope::Full) {
+        forEachAllocator(
+            [&] (MarkedAllocator& allocator) -> IterationStatus {
+                allocator.beginMarkingForFullCollection();
+                return IterationStatus::Continue;
+            });
+
+        if (UNLIKELY(nextVersion(m_markingVersion) == initialVersion)) {
+            forEachBlock(
+                [&] (MarkedBlock::Handle* handle) {
+                    handle->block().resetMarks();
+                });
+        }
+        
+        m_markingVersion = nextVersion(m_markingVersion);
+        
+        for (LargeAllocation* allocation : m_largeAllocations)
+            allocation->flip();
+    }
+
+    if (!ASSERT_DISABLED) {
+        forEachBlock(
+            [&] (MarkedBlock::Handle* block) {
+                if (block->areMarksStale())
+                    return;
+                ASSERT(!block->isFreeListed());
+            });
+    }
+    
+    m_isMarking = true;
+}
+
+void MarkedSpace::endMarking()
+{
+    if (UNLIKELY(nextVersion(m_newlyAllocatedVersion) == initialVersion)) {
+        forEachBlock(
+            [&] (MarkedBlock::Handle* handle) {
+                handle->resetAllocated();
+            });
+    }
+        
+    m_newlyAllocatedVersion = nextVersion(m_newlyAllocatedVersion);
+    
+    for (unsigned i = m_largeAllocationsOffsetForThisCollection; i < m_largeAllocations.size(); ++i)
+        m_largeAllocations[i]->clearNewlyAllocated();
+
+    if (!ASSERT_DISABLED) {
+        for (LargeAllocation* allocation : m_largeAllocations)
+            ASSERT_UNUSED(allocation, !allocation->isNewlyAllocated());
+    }
+
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.endMarking();
+            return IterationStatus::Continue;
+        });
+    
+    m_isMarking = false;
+}
+
+void MarkedSpace::willStartIterating()
+{
+    ASSERT(!isIterating());
+    stopAllocating();
+    m_isIterating = true;
+}
+
+void MarkedSpace::didFinishIterating()
+{
+    ASSERT(isIterating());
+    resumeAllocating();
+    m_isIterating = false;
+}
+
+size_t MarkedSpace::objectCount()
+{
+    size_t result = 0;
+    forEachBlock(
+        [&] (MarkedBlock::Handle* block) {
+            result += block->markCount();
+        });
+    for (LargeAllocation* allocation : m_largeAllocations) {
+        if (allocation->isMarked())
+            result++;
+    }
+    return result;
+}
+
+size_t MarkedSpace::size()
+{
+    size_t result = 0;
+    forEachBlock(
+        [&] (MarkedBlock::Handle* block) {
+            result += block->markCount() * block->cellSize();
+        });
+    for (LargeAllocation* allocation : m_largeAllocations) {
+        if (allocation->isMarked())
+            result += allocation->cellSize();
+    }
+    return result;
+}
+
+size_t MarkedSpace::capacity()
+{
+    return m_capacity;
+}
+
+void MarkedSpace::addActiveWeakSet(WeakSet* weakSet)
+{
+    // We conservatively assume that the WeakSet should belong in the new set. In fact, some weak
+    // sets might contain new weak handles even though they are tied to old objects. This slightly
+    // increases the amount of scanning that an eden collection would have to do, but the effect
+    // ought to be small.
+    m_newActiveWeakSets.append(weakSet);
+}
+
+void MarkedSpace::didAddBlock(MarkedBlock::Handle* block)
+{
+    // WARNING: This function is called before block is fully initialized. The block will not know
+    // its cellSize() or attributes(). The latter implies that you can't ask things like
+    // needsDestruction().
+    m_capacity += MarkedBlock::blockSize;
+    m_blocks.add(&block->block());
+}
+
+void MarkedSpace::didAllocateInBlock(MarkedBlock::Handle* block)
+{
+    if (block->weakSet().isOnList()) {
+        block->weakSet().remove();
+        m_newActiveWeakSets.append(&block->weakSet());
+    }
+}
+
+MarkedBlock::Handle* MarkedSpace::findEmptyBlockToSteal()
+{
+    for (; m_allocatorForEmptyAllocation; m_allocatorForEmptyAllocation = m_allocatorForEmptyAllocation->nextAllocator()) {
+        if (MarkedBlock::Handle* block = m_allocatorForEmptyAllocation->findEmptyBlockToSteal())
+            return block;
+    }
+    return nullptr;
+}
+
+void MarkedSpace::snapshotUnswept()
+{
+    if (m_heap->collectionScope() == CollectionScope::Eden) {
+        forEachAllocator(
+            [&] (MarkedAllocator& allocator) -> IterationStatus {
+                allocator.snapshotUnsweptForEdenCollection();
+                return IterationStatus::Continue;
+            });
+    } else {
+        forEachAllocator(
+            [&] (MarkedAllocator& allocator) -> IterationStatus {
+                allocator.snapshotUnsweptForFullCollection();
+                return IterationStatus::Continue;
+            });
+    }
+}
+
+void MarkedSpace::assertNoUnswept()
+{
+    if (ASSERT_DISABLED)
+        return;
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.assertNoUnswept();
+            return IterationStatus::Continue;
+        });
+}
+
+void MarkedSpace::dumpBits(PrintStream& out)
+{
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            out.print("Bits for ", allocator, ":\n");
+            allocator.dumpBits(out);
+            return IterationStatus::Continue;
+        });
+}
+
+MarkedAllocator* MarkedSpace::addMarkedAllocator(
+    const AbstractLocker&, Subspace* subspace, size_t sizeClass)
+{
+    MarkedAllocator* allocator = m_bagOfAllocators.add(heap(), subspace, sizeClass);
+    allocator->setNextAllocator(nullptr);
+    
+    WTF::storeStoreFence();
+
+    if (!m_firstAllocator) {
+        m_firstAllocator = allocator;
+        m_lastAllocator = allocator;
+        m_allocatorForEmptyAllocation = allocator;
+    } else {
+        m_lastAllocator->setNextAllocator(allocator);
+        m_lastAllocator = allocator;
+    }
+    
+    return allocator;
+}
+
+} // namespace JSC
diff --git a/heap/MarkedSpace.h b/heap/MarkedSpace.h
new file mode 100644
index 0000000..26be5e3
--- /dev/null
+++ b/heap/MarkedSpace.h
@@ -0,0 +1,245 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "IterationStatus.h"
+#include "LargeAllocation.h"
+#include "MarkedAllocator.h"
+#include "MarkedBlock.h"
+#include "MarkedBlockSet.h"
+#include <array>
+#include <wtf/Bag.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/SentinelLinkedList.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class Heap;
+class HeapIterationScope;
+class LLIntOffsetsExtractor;
+class Subspace;
+class WeakSet;
+
+typedef uint32_t HeapVersion;
+
+class MarkedSpace {
+    WTF_MAKE_NONCOPYABLE(MarkedSpace);
+public:
+    // sizeStep is really a synonym for atomSize; it's no accident that they are the same.
+    static const size_t sizeStep = MarkedBlock::atomSize;
+    
+    // Sizes up to this amount get a size class for each size step.
+    static const size_t preciseCutoff = 80;
+    
+    // The amount of available payload in a block is the block's size minus the header. But the
+    // header size might not be atom size aligned, so we round down the result accordingly.
+    static const size_t blockPayload = (MarkedBlock::blockSize - sizeof(MarkedBlock)) & ~(MarkedBlock::atomSize - 1);
+    
+    // The largest cell we're willing to allocate in a MarkedBlock the "normal way" (i.e. using size
+    // classes, rather than a large allocation) is half the size of the payload, rounded down. This
+    // ensures that we only use the size class approach if it means being able to pack two things
+    // into one block.
+    static const size_t largeCutoff = (blockPayload / 2) & ~(sizeStep - 1);
+
+    static const size_t numSizeClasses = largeCutoff / sizeStep;
+    
+    static const HeapVersion nullVersion = 0; // The version of freshly allocated blocks.
+    static const HeapVersion initialVersion = 2; // The version that the heap starts out with. Set to make sure that nextVersion(nullVersion) != initialVersion.
+    
+    static HeapVersion nextVersion(HeapVersion version)
+    {
+        version++;
+        if (version == nullVersion)
+            version = initialVersion;
+        return version;
+    }
+    
+    static size_t sizeClassToIndex(size_t size)
+    {
+        ASSERT(size);
+        return (size + sizeStep - 1) / sizeStep - 1;
+    }
+    
+    static size_t indexToSizeClass(size_t index)
+    {
+        return (index + 1) * sizeStep;
+    }
+    
+    MarkedSpace(Heap*);
+    ~MarkedSpace();
+    
+    Heap* heap() const { return m_heap; }
+    
+    void lastChanceToFinalize(); // You must call stopAllocating before you call this.
+
+    static size_t optimalSizeFor(size_t);
+    
+    void prepareForAllocation();
+
+    void visitWeakSets(SlotVisitor&);
+    void reapWeakSets();
+
+    MarkedBlockSet& blocks() { return m_blocks; }
+
+    void willStartIterating();
+    bool isIterating() const { return m_isIterating; }
+    void didFinishIterating();
+
+    void stopAllocating();
+    void resumeAllocating(); // If we just stopped allocation but we didn't do a collection, we need to resume allocation.
+    
+    void prepareForMarking();
+    
+    void prepareForConservativeScan();
+
+    typedef HashSet<MarkedBlock*>::iterator BlockIterator;
+
+    template<typename Functor> void forEachLiveCell(HeapIterationScope&, const Functor&);
+    template<typename Functor> void forEachDeadCell(HeapIterationScope&, const Functor&);
+    template<typename Functor> void forEachBlock(const Functor&);
+
+    void shrink();
+    void freeBlock(MarkedBlock::Handle*);
+    void freeOrShrinkBlock(MarkedBlock::Handle*);
+
+    void didAddBlock(MarkedBlock::Handle*);
+    void didConsumeFreeList(MarkedBlock::Handle*);
+    void didAllocateInBlock(MarkedBlock::Handle*);
+
+    void beginMarking();
+    void endMarking();
+    void snapshotUnswept();
+    void clearNewlyAllocated();
+    void sweep();
+    void sweepLargeAllocations();
+    void assertNoUnswept();
+    size_t objectCount();
+    size_t size();
+    size_t capacity();
+
+    bool isPagedOut(double deadline);
+    
+    HeapVersion markingVersion() const { return m_markingVersion; }
+    HeapVersion newlyAllocatedVersion() const { return m_newlyAllocatedVersion; }
+
+    const Vector<LargeAllocation*>& largeAllocations() const { return m_largeAllocations; }
+    unsigned largeAllocationsNurseryOffset() const { return m_largeAllocationsNurseryOffset; }
+    unsigned largeAllocationsOffsetForThisCollection() const { return m_largeAllocationsOffsetForThisCollection; }
+    
+    // These are cached pointers and offsets for quickly searching the large allocations that are
+    // relevant to this collection.
+    LargeAllocation** largeAllocationsForThisCollectionBegin() const { return m_largeAllocationsForThisCollectionBegin; }
+    LargeAllocation** largeAllocationsForThisCollectionEnd() const { return m_largeAllocationsForThisCollectionEnd; }
+    unsigned largeAllocationsForThisCollectionSize() const { return m_largeAllocationsForThisCollectionSize; }
+    
+    MarkedAllocator* firstAllocator() const { return m_firstAllocator; }
+    MarkedAllocator* allocatorForEmptyAllocation() const { return m_allocatorForEmptyAllocation; }
+    
+    MarkedBlock::Handle* findEmptyBlockToSteal();
+    
+    Lock& allocatorLock() { return m_allocatorLock; }
+    MarkedAllocator* addMarkedAllocator(const AbstractLocker&, Subspace*, size_t cellSize);
+    
+    // When this is true it means that we have flipped but the mark bits haven't converged yet.
+    bool isMarking() const { return m_isMarking; }
+    
+    void dumpBits(PrintStream& = WTF::dataFile());
+    
+    JS_EXPORT_PRIVATE static std::array<size_t, numSizeClasses> s_sizeClassForSizeStep;
+    
+private:
+    friend class LLIntOffsetsExtractor;
+    friend class JIT;
+    friend class WeakSet;
+    friend class Subspace;
+    
+    void* allocateSlow(Subspace&, GCDeferralContext*, size_t);
+    void* tryAllocateSlow(Subspace&, GCDeferralContext*, size_t);
+
+    static void initializeSizeClassForStepSize();
+    
+    void initializeSubspace(Subspace&);
+
+    template<typename Functor> inline void forEachAllocator(const Functor&);
+    
+    void addActiveWeakSet(WeakSet*);
+
+    Vector<Subspace*> m_subspaces;
+
+    Vector<LargeAllocation*> m_largeAllocations;
+    unsigned m_largeAllocationsNurseryOffset { 0 };
+    unsigned m_largeAllocationsOffsetForThisCollection { 0 };
+    unsigned m_largeAllocationsNurseryOffsetForSweep { 0 };
+    LargeAllocation** m_largeAllocationsForThisCollectionBegin { nullptr };
+    LargeAllocation** m_largeAllocationsForThisCollectionEnd { nullptr };
+    unsigned m_largeAllocationsForThisCollectionSize { 0 };
+
+    Heap* m_heap;
+    HeapVersion m_markingVersion { initialVersion };
+    HeapVersion m_newlyAllocatedVersion { initialVersion };
+    size_t m_capacity;
+    bool m_isIterating;
+    bool m_isMarking { false };
+    MarkedBlockSet m_blocks;
+    
+    SentinelLinkedList<WeakSet, BasicRawSentinelNode<WeakSet>> m_activeWeakSets;
+    SentinelLinkedList<WeakSet, BasicRawSentinelNode<WeakSet>> m_newActiveWeakSets;
+
+    Lock m_allocatorLock;
+    Bag<MarkedAllocator> m_bagOfAllocators;
+    MarkedAllocator* m_firstAllocator { nullptr };
+    MarkedAllocator* m_lastAllocator { nullptr };
+    MarkedAllocator* m_allocatorForEmptyAllocation { nullptr };
+};
+
+template <typename Functor> inline void MarkedSpace::forEachBlock(const Functor& functor)
+{
+    forEachAllocator(
+        [&] (MarkedAllocator& allocator) -> IterationStatus {
+            allocator.forEachBlock(functor);
+            return IterationStatus::Continue;
+        });
+}
+
+template <typename Functor>
+void MarkedSpace::forEachAllocator(const Functor& functor)
+{
+    for (MarkedAllocator* allocator = m_firstAllocator; allocator; allocator = allocator->nextAllocator()) {
+        if (functor(*allocator) == IterationStatus::Done)
+            return;
+    }
+}
+
+ALWAYS_INLINE size_t MarkedSpace::optimalSizeFor(size_t bytes)
+{
+    ASSERT(bytes);
+    if (bytes <= preciseCutoff)
+        return WTF::roundUpToMultipleOf<sizeStep>(bytes);
+    if (bytes <= largeCutoff)
+        return s_sizeClassForSizeStep[sizeClassToIndex(bytes)];
+    return bytes;
+}
+
+} // namespace JSC
diff --git a/heap/MarkedSpaceInlines.h b/heap/MarkedSpaceInlines.h
new file mode 100644
index 0000000..e629cb0
--- /dev/null
+++ b/heap/MarkedSpaceInlines.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MarkedBlockInlines.h"
+#include "MarkedSpace.h"
+
+namespace JSC {
+
+template<typename Functor> inline void MarkedSpace::forEachLiveCell(HeapIterationScope&, const Functor& functor)
+{
+    ASSERT(isIterating());
+    BlockIterator end = m_blocks.set().end();
+    for (BlockIterator it = m_blocks.set().begin(); it != end; ++it) {
+        if ((*it)->handle().forEachLiveCell(functor) == IterationStatus::Done)
+            return;
+    }
+    for (LargeAllocation* allocation : m_largeAllocations) {
+        if (allocation->isLive()) {
+            if (functor(allocation->cell(), allocation->attributes().cellKind) == IterationStatus::Done)
+                return;
+        }
+    }
+}
+
+template<typename Functor> inline void MarkedSpace::forEachDeadCell(HeapIterationScope&, const Functor& functor)
+{
+    ASSERT(isIterating());
+    BlockIterator end = m_blocks.set().end();
+    for (BlockIterator it = m_blocks.set().begin(); it != end; ++it) {
+        if ((*it)->handle().forEachDeadCell(functor) == IterationStatus::Done)
+            return;
+    }
+    for (LargeAllocation* allocation : m_largeAllocations) {
+        if (!allocation->isLive()) {
+            if (functor(allocation->cell(), allocation->attributes().cellKind) == IterationStatus::Done)
+                return;
+        }
+    }
+}
+
+} // namespace JSC
+
diff --git a/heap/MarkingConstraint.cpp b/heap/MarkingConstraint.cpp
new file mode 100644
index 0000000..39a3081
--- /dev/null
+++ b/heap/MarkingConstraint.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MarkingConstraint.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+MarkingConstraint::MarkingConstraint(
+    CString abbreviatedName, CString name,
+    ::Function<void(SlotVisitor&, const VisitingTimeout&)> executeFunction,
+    ConstraintVolatility volatility)
+    : m_abbreviatedName(abbreviatedName)
+    , m_name(WTFMove(name))
+    , m_executeFunction(WTFMove(executeFunction))
+    , m_volatility(volatility)
+{
+}
+
+MarkingConstraint::MarkingConstraint(
+    CString abbreviatedName, CString name,
+    ::Function<void(SlotVisitor&, const VisitingTimeout&)> executeFunction,
+    ::Function<double(SlotVisitor&)> quickWorkEstimateFunction,
+    ConstraintVolatility volatility)
+    : m_abbreviatedName(abbreviatedName)
+    , m_name(WTFMove(name))
+    , m_executeFunction(WTFMove(executeFunction))
+    , m_quickWorkEstimateFunction(WTFMove(quickWorkEstimateFunction))
+    , m_volatility(volatility)
+{
+}
+
+MarkingConstraint::~MarkingConstraint()
+{
+}
+
+void MarkingConstraint::resetStats()
+{
+    m_lastVisitCount = 0;
+}
+
+void MarkingConstraint::execute(SlotVisitor& visitor, bool& didVisitSomething, MonotonicTime timeout)
+{
+    if (Options::logGC())
+        dataLog(abbreviatedName());
+    VisitingTimeout visitingTimeout(visitor, didVisitSomething, timeout);
+    m_executeFunction(visitor, visitingTimeout);
+    m_lastVisitCount = visitingTimeout.visitCount(visitor);
+    didVisitSomething = visitingTimeout.didVisitSomething(visitor);
+}
+
+} // namespace JSC
+
diff --git a/heap/MarkingConstraint.h b/heap/MarkingConstraint.h
new file mode 100644
index 0000000..4c57419
--- /dev/null
+++ b/heap/MarkingConstraint.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConstraintVolatility.h"
+#include "VisitingTimeout.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Function.h>
+#include <wtf/MonotonicTime.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+class MarkingConstraintSet;
+class SlotVisitor;
+
+class MarkingConstraint {
+    WTF_MAKE_NONCOPYABLE(MarkingConstraint);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JS_EXPORT_PRIVATE MarkingConstraint(
+        CString abbreviatedName, CString name,
+        ::Function<void(SlotVisitor&, const VisitingTimeout&)>,
+        ConstraintVolatility);
+    
+    JS_EXPORT_PRIVATE MarkingConstraint(
+        CString abbreviatedName, CString name,
+        ::Function<void(SlotVisitor&, const VisitingTimeout&)>,
+        ::Function<double(SlotVisitor&)>,
+        ConstraintVolatility);
+    
+    JS_EXPORT_PRIVATE ~MarkingConstraint();
+    
+    unsigned index() const { return m_index; }
+    
+    const char* abbreviatedName() const { return m_abbreviatedName.data(); }
+    const char* name() const { return m_name.data(); }
+    
+    void resetStats();
+    
+    size_t lastVisitCount() const { return m_lastVisitCount; }
+    
+    void execute(SlotVisitor&, bool& didVisitSomething, MonotonicTime timeout);
+    
+    double quickWorkEstimate(SlotVisitor& visitor)
+    {
+        if (!m_quickWorkEstimateFunction)
+            return 0;
+        return m_quickWorkEstimateFunction(visitor);
+    }
+    
+    double workEstimate(SlotVisitor& visitor)
+    {
+        return lastVisitCount() + quickWorkEstimate(visitor);
+    }
+    
+    ConstraintVolatility volatility() const { return m_volatility; }
+    
+private:
+    friend class MarkingConstraintSet; // So it can set m_index.
+    
+    unsigned m_index { UINT_MAX };
+    CString m_abbreviatedName;
+    CString m_name;
+    ::Function<void(SlotVisitor&, const VisitingTimeout& timeout)> m_executeFunction;
+    ::Function<double(SlotVisitor&)> m_quickWorkEstimateFunction;
+    ConstraintVolatility m_volatility;
+    size_t m_lastVisitCount { 0 };
+};
+
+} // namespace JSC
+
diff --git a/heap/MarkingConstraintSet.cpp b/heap/MarkingConstraintSet.cpp
new file mode 100644
index 0000000..01c06e7
--- /dev/null
+++ b/heap/MarkingConstraintSet.cpp
@@ -0,0 +1,249 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MarkingConstraintSet.h"
+
+#include "Options.h"
+#include <wtf/TimeWithDynamicClockType.h>
+
+namespace JSC {
+
+class MarkingConstraintSet::ExecutionContext {
+public:
+    ExecutionContext(MarkingConstraintSet& set, SlotVisitor& visitor, MonotonicTime timeout)
+        : m_set(set)
+        , m_visitor(visitor)
+        , m_timeout(timeout)
+    {
+    }
+    
+    bool didVisitSomething() const
+    {
+        return m_didVisitSomething;
+    }
+    
+    bool shouldTimeOut() const
+    {
+        return didVisitSomething() && hasElapsed(m_timeout);
+    }
+    
+    // Returns false if it times out.
+    bool drain(BitVector& unexecuted)
+    {
+        for (size_t index : unexecuted) {
+            execute(index);
+            unexecuted.clear(index);
+            if (shouldTimeOut())
+                return false;
+        }
+        return true;
+    }
+    
+    bool didExecute(size_t index) const { return m_executed.get(index); }
+
+    void execute(size_t index)
+    {
+        m_set.m_set[index]->execute(m_visitor, m_didVisitSomething, m_timeout);
+        m_executed.set(index);
+    }
+    
+private:
+    MarkingConstraintSet& m_set;
+    SlotVisitor& m_visitor;
+    MonotonicTime m_timeout;
+    BitVector m_executed;
+    bool m_didVisitSomething { false };
+};
+
+MarkingConstraintSet::MarkingConstraintSet()
+{
+}
+
+MarkingConstraintSet::~MarkingConstraintSet()
+{
+}
+
+void MarkingConstraintSet::didStartMarking()
+{
+    m_unexecutedRoots.clearAll();
+    m_unexecutedOutgrowths.clearAll();
+    for (auto& constraint : m_set) {
+        constraint->resetStats();
+        switch (constraint->volatility()) {
+        case ConstraintVolatility::GreyedByExecution:
+            m_unexecutedRoots.set(constraint->index());
+            break;
+        case ConstraintVolatility::GreyedByMarking:
+            m_unexecutedOutgrowths.set(constraint->index());
+            break;
+        case ConstraintVolatility::SeldomGreyed:
+            break;
+        }
+    }
+    m_iteration = 1;
+}
+
+void MarkingConstraintSet::add(CString abbreviatedName, CString name, Function<void(SlotVisitor&, const VisitingTimeout&)> function, ConstraintVolatility volatility)
+{
+    add(std::make_unique<MarkingConstraint>(WTFMove(abbreviatedName), WTFMove(name), WTFMove(function), volatility));
+}
+
+void MarkingConstraintSet::add(
+    CString abbreviatedName, CString name,
+    Function<void(SlotVisitor&, const VisitingTimeout&)> executeFunction,
+    Function<double(SlotVisitor&)> quickWorkEstimateFunction,
+    ConstraintVolatility volatility)
+{
+    add(std::make_unique<MarkingConstraint>(WTFMove(abbreviatedName), WTFMove(name), WTFMove(executeFunction), WTFMove(quickWorkEstimateFunction), volatility));
+}
+
+void MarkingConstraintSet::add(
+    std::unique_ptr<MarkingConstraint> constraint)
+{
+    constraint->m_index = m_set.size();
+    m_ordered.append(constraint.get());
+    if (constraint->volatility() == ConstraintVolatility::GreyedByMarking)
+        m_outgrowths.append(constraint.get());
+    m_set.append(WTFMove(constraint));
+}
+
+bool MarkingConstraintSet::executeConvergence(SlotVisitor& visitor, MonotonicTime timeout)
+{
+    bool result = executeConvergenceImpl(visitor, timeout);
+    if (Options::logGC())
+        dataLog(" ");
+    return result;
+}
+
+bool MarkingConstraintSet::isWavefrontAdvancing(SlotVisitor& visitor)
+{
+    for (MarkingConstraint* outgrowth : m_outgrowths) {
+        if (outgrowth->workEstimate(visitor))
+            return true;
+    }
+    return false;
+}
+
+bool MarkingConstraintSet::executeConvergenceImpl(SlotVisitor& visitor, MonotonicTime timeout)
+{
+    ExecutionContext executionContext(*this, visitor, timeout);
+    
+    unsigned iteration = m_iteration++;
+    
+    if (Options::logGC())
+        dataLog("i#", iteration, ":");
+
+    // If there are any constraints that we have not executed at all during this cycle, then
+    // we should execute those now.
+    if (!executionContext.drain(m_unexecutedRoots))
+        return false;
+    
+    // First iteration is before any visitor draining, so it's unlikely to trigger any constraints other
+    // than roots.
+    if (iteration == 1)
+        return false;
+    
+    if (!executionContext.drain(m_unexecutedOutgrowths))
+        return false;
+    
+    // We want to keep preferring the outgrowth constraints - the ones that need to be fixpointed
+    // even in a stop-the-world GC - until they stop producing. They have a tendency to go totally
+    // silent at some point during GC, at which point it makes sense not to run them again until
+    // the end. Outgrowths producing new information corresponds almost exactly to the wavefront
+    // advancing: it usually means that we are marking objects that should be marked based on
+    // other objects that we would have marked anyway. Once the wavefront is no longer advancing,
+    // we want to run mostly the root constraints (based on their predictions of how much work
+    // they will have) because at this point we are just trying to outpace the retreating
+    // wavefront.
+    //
+    // Note that this function (executeConvergenceImpl) only returns true if it runs all
+    // constraints. So, all we are controlling are the heuristics that say which constraints to
+    // run first. Choosing the constraints that are the most likely to produce means running fewer
+    // constraints before returning.
+    bool isWavefrontAdvancing = this->isWavefrontAdvancing(visitor);
+    
+    std::sort(
+        m_ordered.begin(), m_ordered.end(),
+        [&] (MarkingConstraint* a, MarkingConstraint* b) -> bool {
+            // Remember: return true if a should come before b.
+            
+            auto volatilityScore = [] (MarkingConstraint* constraint) -> unsigned {
+                return constraint->volatility() == ConstraintVolatility::GreyedByMarking ? 1 : 0;
+            };
+            
+            unsigned aVolatilityScore = volatilityScore(a);
+            unsigned bVolatilityScore = volatilityScore(b);
+            
+            if (aVolatilityScore != bVolatilityScore) {
+                if (isWavefrontAdvancing)
+                    return aVolatilityScore > bVolatilityScore;
+                else
+                    return aVolatilityScore < bVolatilityScore;
+            }
+            
+            double aWorkEstimate = a->workEstimate(visitor);
+            double bWorkEstimate = b->workEstimate(visitor);
+            
+            if (aWorkEstimate != bWorkEstimate)
+                return aWorkEstimate > bWorkEstimate;
+            
+            // This causes us to use SeldomGreyed vs GreyedByExecution as a final tie-breaker.
+            return a->volatility() > b->volatility();
+        });
+    
+    for (MarkingConstraint* constraint : m_ordered) {
+        size_t i = constraint->index();
+        
+        if (executionContext.didExecute(i))
+            continue;
+        executionContext.execute(i);
+        
+        // Once we're in convergence, it makes the most sense to let some marking happen anytime
+        // we find work.
+        // FIXME: Maybe this should execute all constraints until timeout? Not clear if that's
+        // better or worse. Maybe even better is this:
+        // - If the visitor is empty, keep running.
+        // - If the visitor is has at least N things, return.
+        // - Else run until timeout.
+        // https://bugs.webkit.org/show_bug.cgi?id=166832
+        if (executionContext.didVisitSomething())
+            return false;
+    }
+    
+    return true;
+}
+
+void MarkingConstraintSet::executeAll(SlotVisitor& visitor)
+{
+    bool didVisitSomething = false;
+    for (auto& constraint : m_set)
+        constraint->execute(visitor, didVisitSomething, MonotonicTime::infinity());
+    if (Options::logGC())
+        dataLog(" ");
+}
+
+} // namespace JSC
+
diff --git a/heap/MarkingConstraintSet.h b/heap/MarkingConstraintSet.h
new file mode 100644
index 0000000..40e616f
--- /dev/null
+++ b/heap/MarkingConstraintSet.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "MarkingConstraint.h"
+#include <wtf/BitVector.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class MarkingConstraintSet {
+public:
+    MarkingConstraintSet();
+    ~MarkingConstraintSet();
+    
+    void didStartMarking();
+    
+    void add(
+        CString abbreviatedName,
+        CString name,
+        ::Function<void(SlotVisitor&, const VisitingTimeout&)>,
+        ConstraintVolatility);
+    
+    void add(
+        CString abbreviatedName,
+        CString name,
+        ::Function<void(SlotVisitor&, const VisitingTimeout&)>,
+        ::Function<double(SlotVisitor&)>,
+        ConstraintVolatility);
+    
+    void add(std::unique_ptr<MarkingConstraint>);
+    
+    // Assuming that the mark stacks are all empty, this will give you a guess as to whether or
+    // not the wavefront is advancing.
+    bool isWavefrontAdvancing(SlotVisitor&);
+    bool isWavefrontRetreating(SlotVisitor& visitor) { return !isWavefrontAdvancing(visitor); }
+    
+    // Returns true if this executed all constraints and none of them produced new work. This
+    // assumes that you've alraedy visited roots and drained from there.
+    bool executeConvergence(
+        SlotVisitor&,
+        MonotonicTime timeout = MonotonicTime::infinity());
+    
+    // Simply runs all constraints without any shenanigans.
+    void executeAll(SlotVisitor&);
+    
+private:
+    class ExecutionContext;
+    friend class ExecutionContext;
+    
+    bool executeConvergenceImpl(SlotVisitor&, MonotonicTime timeout);
+    
+    bool drain(SlotVisitor&, MonotonicTime, BitVector& unexecuted, BitVector& executed, bool& didVisitSomething);
+    
+    BitVector m_unexecutedRoots;
+    BitVector m_unexecutedOutgrowths;
+    Vector<std::unique_ptr<MarkingConstraint>> m_set;
+    Vector<MarkingConstraint*> m_ordered;
+    Vector<MarkingConstraint*> m_outgrowths;
+    unsigned m_iteration { 1 };
+};
+
+} // namespace JSC
+
diff --git a/heap/MutatorScheduler.cpp b/heap/MutatorScheduler.cpp
new file mode 100644
index 0000000..305b8b6
--- /dev/null
+++ b/heap/MutatorScheduler.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MutatorScheduler.h"
+
+#include <wtf/TimeWithDynamicClockType.h>
+
+namespace JSC {
+
+MutatorScheduler::MutatorScheduler()
+{
+}
+
+MutatorScheduler::~MutatorScheduler()
+{
+}
+
+void MutatorScheduler::didStop()
+{
+}
+
+void MutatorScheduler::willResume()
+{
+}
+
+void MutatorScheduler::didReachTermination()
+{
+}
+
+void MutatorScheduler::didExecuteConstraints()
+{
+}
+
+void MutatorScheduler::synchronousDrainingDidStall()
+{
+}
+
+void MutatorScheduler::log()
+{
+}
+
+bool MutatorScheduler::shouldStop()
+{
+    return hasElapsed(timeToStop());
+}
+
+bool MutatorScheduler::shouldResume()
+{
+    return hasElapsed(timeToResume());
+}
+
+} // namespace JSC
+
diff --git a/heap/MutatorScheduler.h b/heap/MutatorScheduler.h
new file mode 100644
index 0000000..63652e5
--- /dev/null
+++ b/heap/MutatorScheduler.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/FastMalloc.h>
+#include <wtf/MonotonicTime.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class MutatorScheduler {
+    WTF_MAKE_NONCOPYABLE(MutatorScheduler);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    enum State {
+        Normal, // Not collecting.
+        Stopped,
+        Resumed
+    };
+    
+    MutatorScheduler();
+    virtual ~MutatorScheduler();
+    
+    virtual State state() const = 0;
+    
+    virtual void beginCollection() = 0;
+    
+    virtual void didStop();
+    virtual void willResume();
+    
+    // At the top of an iteration, the GC will may call didReachTermination.
+    virtual void didReachTermination();
+    
+    // If it called didReachTermination, it will then later call didExecuteConstraints.
+    virtual void didExecuteConstraints();
+    
+    // After doing that, it will do synchronous draining. When this stalls - either due to timeout or
+    // just 'cause, it will call this.
+    virtual void synchronousDrainingDidStall();
+    
+    virtual MonotonicTime timeToStop() = 0; // Call while resumed, to ask when to stop.
+    virtual MonotonicTime timeToResume() = 0; // Call while stopped, to ask when to resume.
+    
+    virtual void log();
+    
+    bool shouldStop(); // Call while resumed, to ask if we should stop now.
+    bool shouldResume(); // Call while stopped, to ask if we should resume now.
+    
+    virtual void endCollection() = 0;
+};
+
+} // namespace JSC
+
diff --git a/heap/MutatorState.cpp b/heap/MutatorState.cpp
new file mode 100644
index 0000000..8368f43
--- /dev/null
+++ b/heap/MutatorState.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MutatorState.h"
+
+#include <wtf/PrintStream.h>
+
+using namespace JSC;
+
+namespace WTF {
+
+void printInternal(PrintStream& out, MutatorState state)
+{
+    switch (state) {
+    case MutatorState::Running:
+        out.print("Running");
+        return;
+    case MutatorState::Allocating:
+        out.print("Allocating");
+        return;
+    case MutatorState::HelpingGC:
+        out.print("HelpingGC");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/heap/MutatorState.h b/heap/MutatorState.h
new file mode 100644
index 0000000..65b61f7
--- /dev/null
+++ b/heap/MutatorState.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum class MutatorState {
+    // The mutator is running when it's not inside a Heap slow path.
+    Running,
+    
+    // The mutator is in an allocation slow path.
+    Allocating,
+    
+    // The mutator was asked by the GC to do some work.
+    HelpingGC
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::MutatorState);
+
+} // namespace WTF
+
diff --git a/heap/OpaqueRootSet.h b/heap/OpaqueRootSet.h
new file mode 100644
index 0000000..f190989
--- /dev/null
+++ b/heap/OpaqueRootSet.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/HashSet.h>
+
+namespace JSC {
+
+class OpaqueRootSet {
+    WTF_MAKE_NONCOPYABLE(OpaqueRootSet);
+public:
+    OpaqueRootSet()
+        : m_lastQueriedRoot(nullptr)
+        , m_containsLastQueriedRoot(false)
+    {
+    }
+
+    bool contains(void* root) const
+    {
+        if (root != m_lastQueriedRoot) {
+            m_lastQueriedRoot = root;
+            m_containsLastQueriedRoot = m_roots.contains(root);
+        }
+        return m_containsLastQueriedRoot;
+    }
+
+    bool isEmpty() const
+    {
+        return m_roots.isEmpty();
+    }
+
+    void clear()
+    {
+        m_roots.clear();
+        m_lastQueriedRoot = nullptr;
+        m_containsLastQueriedRoot = false;
+    }
+
+    bool add(void* root)
+    {
+        if (root == m_lastQueriedRoot)
+            m_containsLastQueriedRoot = true;
+        return m_roots.add(root).isNewEntry;
+    }
+
+    int size() const
+    {
+        return m_roots.size();
+    }
+
+    HashSet<void*>::const_iterator begin() const
+    {
+        return m_roots.begin();
+    }
+
+    HashSet<void*>::const_iterator end() const
+    {
+        return m_roots.end();
+    }
+
+
+private:
+    HashSet<void*> m_roots;
+    mutable void* m_lastQueriedRoot;
+    mutable bool m_containsLastQueriedRoot;
+};
+
+} // namespace JSC
diff --git a/heap/PreventCollectionScope.h b/heap/PreventCollectionScope.h
new file mode 100644
index 0000000..766cd1f
--- /dev/null
+++ b/heap/PreventCollectionScope.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Heap.h"
+
+namespace JSC { 
+
+class PreventCollectionScope {
+public:
+    PreventCollectionScope(Heap& heap)
+        : m_heap(heap)
+    {
+        m_heap.preventCollection();
+    }
+    
+    ~PreventCollectionScope()
+    {
+        m_heap.allowCollection();
+    }
+
+private:
+    Heap& m_heap;
+};
+
+} // namespace JSC
+
diff --git a/heap/ReleaseHeapAccessScope.h b/heap/ReleaseHeapAccessScope.h
new file mode 100644
index 0000000..e39dd1f
--- /dev/null
+++ b/heap/ReleaseHeapAccessScope.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Heap.h"
+
+namespace JSC {
+
+// Almost all of the VM's code runs with "heap access". This means that the GC thread believes that
+// the VM is messing with the heap in a way that would be unsafe for certain phases of the collector,
+// like the weak reference fixpoint, stack scanning, and changing barrier modes. However, many long
+// running operations inside the VM don't require heap access. For example, memcpying a typed array
+// if a reference to it is on the stack is totally fine without heap access. Blocking on a futex is
+// also fine without heap access. Releasing heap access for long-running code (in the case of futex
+// wait, possibly infinitely long-running) ensures that the GC can finish a collection cycle while
+// you are waiting.
+class ReleaseHeapAccessScope {
+public:
+    ReleaseHeapAccessScope(Heap& heap)
+        : m_heap(heap)
+    {
+        m_heap.releaseAccess();
+    }
+    
+    ~ReleaseHeapAccessScope()
+    {
+        m_heap.acquireAccess();
+    }
+
+private:
+    Heap& m_heap;
+};
+
+} // namespace JSC
+
diff --git a/heap/SlotVisitor.cpp b/heap/SlotVisitor.cpp
new file mode 100644
index 0000000..7485b56
--- /dev/null
+++ b/heap/SlotVisitor.cpp
@@ -0,0 +1,718 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SlotVisitor.h"
+
+#include "CPU.h"
+#include "ConservativeRoots.h"
+#include "GCSegmentedArrayInlines.h"
+#include "HeapCellInlines.h"
+#include "HeapProfiler.h"
+#include "HeapSnapshotBuilder.h"
+#include "JSArray.h"
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+#include "SlotVisitorInlines.h"
+#include "SuperSampler.h"
+#include "VM.h"
+#include <wtf/Lock.h>
+
+namespace JSC {
+
+#if ENABLE(GC_VALIDATION)
+static void validate(JSCell* cell)
+{
+    RELEASE_ASSERT(cell);
+
+    if (!cell->structure()) {
+        dataLogF("cell at %p has a null structure\n" , cell);
+        CRASH();
+    }
+
+    // Both the cell's structure, and the cell's structure's structure should be the Structure Structure.
+    // I hate this sentence.
+    if (cell->structure()->structure()->JSCell::classInfo() != cell->structure()->JSCell::classInfo()) {
+        const char* parentClassName = 0;
+        const char* ourClassName = 0;
+        if (cell->structure()->structure() && cell->structure()->structure()->JSCell::classInfo())
+            parentClassName = cell->structure()->structure()->JSCell::classInfo()->className;
+        if (cell->structure()->JSCell::classInfo())
+            ourClassName = cell->structure()->JSCell::classInfo()->className;
+        dataLogF("parent structure (%p <%s>) of cell at %p doesn't match cell's structure (%p <%s>)\n",
+            cell->structure()->structure(), parentClassName, cell, cell->structure(), ourClassName);
+        CRASH();
+    }
+
+    // Make sure we can walk the ClassInfo chain
+    const ClassInfo* info = cell->classInfo();
+    do { } while ((info = info->parentClass));
+}
+#endif
+
+SlotVisitor::SlotVisitor(Heap& heap)
+    : m_bytesVisited(0)
+    , m_visitCount(0)
+    , m_isInParallelMode(false)
+    , m_markingVersion(MarkedSpace::initialVersion)
+    , m_heap(heap)
+#if !ASSERT_DISABLED
+    , m_isCheckingForDefaultMarkViolation(false)
+    , m_isDraining(false)
+#endif
+{
+}
+
+SlotVisitor::~SlotVisitor()
+{
+    clearMarkStacks();
+}
+
+void SlotVisitor::didStartMarking()
+{
+    if (heap()->collectionScope() == CollectionScope::Full)
+        ASSERT(m_opaqueRoots.isEmpty()); // Should have merged by now.
+    else
+        reset();
+
+    if (HeapProfiler* heapProfiler = vm().heapProfiler())
+        m_heapSnapshotBuilder = heapProfiler->activeSnapshotBuilder();
+    
+    m_markingVersion = heap()->objectSpace().markingVersion();
+}
+
+void SlotVisitor::reset()
+{
+    RELEASE_ASSERT(!m_opaqueRoots.size());
+    m_bytesVisited = 0;
+    m_visitCount = 0;
+    m_heapSnapshotBuilder = nullptr;
+    RELEASE_ASSERT(!m_currentCell);
+}
+
+void SlotVisitor::clearMarkStacks()
+{
+    m_collectorStack.clear();
+    m_mutatorStack.clear();
+}
+
+void SlotVisitor::append(ConservativeRoots& conservativeRoots)
+{
+    HeapCell** roots = conservativeRoots.roots();
+    size_t size = conservativeRoots.size();
+    for (size_t i = 0; i < size; ++i)
+        appendJSCellOrAuxiliary(roots[i]);
+}
+
+void SlotVisitor::appendJSCellOrAuxiliary(HeapCell* heapCell)
+{
+    if (!heapCell)
+        return;
+    
+    ASSERT(!m_isCheckingForDefaultMarkViolation);
+    
+    auto validateCell = [&] (JSCell* jsCell) {
+        StructureID structureID = jsCell->structureID();
+        
+        auto die = [&] (const char* text) {
+            WTF::dataFile().atomically(
+                [&] (PrintStream& out) {
+                    out.print(text);
+                    out.print("GC type: ", heap()->collectionScope(), "\n");
+                    out.print("Object at: ", RawPointer(jsCell), "\n");
+#if USE(JSVALUE64)
+                    out.print("Structure ID: ", structureID, " (0x", format("%x", structureID), ")\n");
+                    out.print("Structure ID table size: ", heap()->structureIDTable().size(), "\n");
+#else
+                    out.print("Structure: ", RawPointer(structureID), "\n");
+#endif
+                    out.print("Object contents:");
+                    for (unsigned i = 0; i < 2; ++i)
+                        out.print(" ", format("0x%016llx", bitwise_cast<uint64_t*>(jsCell)[i]));
+                    out.print("\n");
+                    CellContainer container = jsCell->cellContainer();
+                    out.print("Is marked: ", container.isMarked(jsCell), "\n");
+                    out.print("Is newly allocated: ", container.isNewlyAllocated(jsCell), "\n");
+                    if (container.isMarkedBlock()) {
+                        MarkedBlock& block = container.markedBlock();
+                        out.print("Block: ", RawPointer(&block), "\n");
+                        block.handle().dumpState(out);
+                        out.print("\n");
+                        out.print("Is marked raw: ", block.isMarkedRaw(jsCell), "\n");
+                        out.print("Marking version: ", block.markingVersion(), "\n");
+                        out.print("Heap marking version: ", heap()->objectSpace().markingVersion(), "\n");
+                        out.print("Is newly allocated raw: ", block.handle().isNewlyAllocated(jsCell), "\n");
+                        out.print("Newly allocated version: ", block.handle().newlyAllocatedVersion(), "\n");
+                        out.print("Heap newly allocated version: ", heap()->objectSpace().newlyAllocatedVersion(), "\n");
+                    }
+                    UNREACHABLE_FOR_PLATFORM();
+                });
+        };
+        
+        // It's not OK for the structure to be null at any GC scan point. We must not GC while
+        // an object is not fully initialized.
+        if (!structureID)
+            die("GC scan found corrupt object: structureID is zero!\n");
+        
+        // It's not OK for the structure to be nuked at any GC scan point.
+        if (isNuked(structureID))
+            die("GC scan found object in bad state: structureID is nuked!\n");
+        
+#if USE(JSVALUE64)
+        // This detects the worst of the badness.
+        if (structureID >= heap()->structureIDTable().size())
+            die("GC scan found corrupt object: structureID is out of bounds!\n");
+#endif
+    };
+    
+    // In debug mode, we validate before marking since this makes it clearer what the problem
+    // was. It's also slower, so we don't do it normally.
+    if (!ASSERT_DISABLED && heapCell->cellKind() == HeapCell::JSCell)
+        validateCell(static_cast<JSCell*>(heapCell));
+    
+    if (Heap::testAndSetMarked(m_markingVersion, heapCell))
+        return;
+    
+    switch (heapCell->cellKind()) {
+    case HeapCell::JSCell: {
+        // We have ample budget to perform validation here.
+    
+        JSCell* jsCell = static_cast<JSCell*>(heapCell);
+        validateCell(jsCell);
+        
+        jsCell->setCellState(CellState::PossiblyGrey);
+
+        appendToMarkStack(jsCell);
+        return;
+    }
+        
+    case HeapCell::Auxiliary: {
+        noteLiveAuxiliaryCell(heapCell);
+        return;
+    } }
+}
+
+void SlotVisitor::appendUnbarriered(JSValue value)
+{
+    if (!value || !value.isCell())
+        return;
+
+    if (UNLIKELY(m_heapSnapshotBuilder))
+        m_heapSnapshotBuilder->appendEdge(m_currentCell, value.asCell());
+
+    setMarkedAndAppendToMarkStack(value.asCell());
+}
+
+void SlotVisitor::appendHidden(JSValue value)
+{
+    if (!value || !value.isCell())
+        return;
+
+    setMarkedAndAppendToMarkStack(value.asCell());
+}
+
+void SlotVisitor::setMarkedAndAppendToMarkStack(JSCell* cell)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    ASSERT(!m_isCheckingForDefaultMarkViolation);
+    if (!cell)
+        return;
+
+#if ENABLE(GC_VALIDATION)
+    validate(cell);
+#endif
+    
+    if (cell->isLargeAllocation())
+        setMarkedAndAppendToMarkStack(cell->largeAllocation(), cell);
+    else
+        setMarkedAndAppendToMarkStack(cell->markedBlock(), cell);
+}
+
+template<typename ContainerType>
+ALWAYS_INLINE void SlotVisitor::setMarkedAndAppendToMarkStack(ContainerType& container, JSCell* cell)
+{
+    container.aboutToMark(m_markingVersion);
+    
+    if (container.testAndSetMarked(cell))
+        return;
+    
+    ASSERT(cell->structure());
+    
+    // Indicate that the object is grey and that:
+    // In case of concurrent GC: it's the first time it is grey in this GC cycle.
+    // In case of eden collection: it's a new object that became grey rather than an old remembered object.
+    cell->setCellState(CellState::PossiblyGrey);
+    
+    appendToMarkStack(container, cell);
+}
+
+void SlotVisitor::appendToMarkStack(JSCell* cell)
+{
+    if (cell->isLargeAllocation())
+        appendToMarkStack(cell->largeAllocation(), cell);
+    else
+        appendToMarkStack(cell->markedBlock(), cell);
+}
+
+template<typename ContainerType>
+ALWAYS_INLINE void SlotVisitor::appendToMarkStack(ContainerType& container, JSCell* cell)
+{
+    ASSERT(Heap::isMarkedConcurrently(cell));
+    ASSERT(!cell->isZapped());
+    
+    container.noteMarked();
+    
+    m_visitCount++;
+    m_bytesVisited += container.cellSize();
+    
+    m_collectorStack.append(cell);
+}
+
+void SlotVisitor::appendToMutatorMarkStack(const JSCell* cell)
+{
+    m_mutatorStack.append(cell);
+}
+
+void SlotVisitor::markAuxiliary(const void* base)
+{
+    HeapCell* cell = bitwise_cast<HeapCell*>(base);
+    
+    ASSERT(cell->heap() == heap());
+    
+    if (Heap::testAndSetMarked(m_markingVersion, cell))
+        return;
+    
+    noteLiveAuxiliaryCell(cell);
+}
+
+void SlotVisitor::noteLiveAuxiliaryCell(HeapCell* cell)
+{
+    // We get here once per GC under these circumstances:
+    //
+    // Eden collection: if the cell was allocated since the last collection and is live somehow.
+    //
+    // Full collection: if the cell is live somehow.
+    
+    CellContainer container = cell->cellContainer();
+    
+    container.assertValidCell(vm(), cell);
+    container.noteMarked();
+    
+    m_visitCount++;
+    m_bytesVisited += container.cellSize();
+}
+
+class SetCurrentCellScope {
+public:
+    SetCurrentCellScope(SlotVisitor& visitor, const JSCell* cell)
+        : m_visitor(visitor)
+    {
+        ASSERT(!m_visitor.m_currentCell);
+        m_visitor.m_currentCell = const_cast<JSCell*>(cell);
+    }
+
+    ~SetCurrentCellScope()
+    {
+        ASSERT(m_visitor.m_currentCell);
+        m_visitor.m_currentCell = nullptr;
+    }
+
+private:
+    SlotVisitor& m_visitor;
+};
+
+ALWAYS_INLINE void SlotVisitor::visitChildren(const JSCell* cell)
+{
+    ASSERT(Heap::isMarkedConcurrently(cell));
+    
+    SetCurrentCellScope currentCellScope(*this, cell);
+    
+    if (false) {
+        dataLog("Visiting ", RawPointer(cell));
+        if (!m_isFirstVisit)
+            dataLog(" (subsequent)");
+        dataLog("\n");
+    }
+    
+    // Funny story: it's possible for the object to be black already, if we barrier the object at
+    // about the same time that it's marked. That's fine. It's a gnarly and super-rare race. It's
+    // not clear to me that it would be correct or profitable to bail here if the object is already
+    // black.
+    
+    cell->setCellState(CellState::PossiblyBlack);
+    
+    WTF::storeLoadFence();
+    
+    switch (cell->type()) {
+    case StringType:
+        JSString::visitChildren(const_cast<JSCell*>(cell), *this);
+        break;
+        
+    case FinalObjectType:
+        JSFinalObject::visitChildren(const_cast<JSCell*>(cell), *this);
+        break;
+
+    case ArrayType:
+        JSArray::visitChildren(const_cast<JSCell*>(cell), *this);
+        break;
+        
+    default:
+        // FIXME: This could be so much better.
+        // https://bugs.webkit.org/show_bug.cgi?id=162462
+        cell->methodTable(vm())->visitChildren(const_cast<JSCell*>(cell), *this);
+        break;
+    }
+    
+    if (UNLIKELY(m_heapSnapshotBuilder)) {
+        if (m_isFirstVisit)
+            m_heapSnapshotBuilder->appendNode(const_cast<JSCell*>(cell));
+    }
+}
+
+void SlotVisitor::visitAsConstraint(const JSCell* cell)
+{
+    m_isFirstVisit = false;
+    visitChildren(cell);
+}
+
+void SlotVisitor::donateKnownParallel(MarkStackArray& from, MarkStackArray& to)
+{
+    // NOTE: Because we re-try often, we can afford to be conservative, and
+    // assume that donating is not profitable.
+
+    // Avoid locking when a thread reaches a dead end in the object graph.
+    if (from.size() < 2)
+        return;
+
+    // If there's already some shared work queued up, be conservative and assume
+    // that donating more is not profitable.
+    if (to.size())
+        return;
+
+    // If we're contending on the lock, be conservative and assume that another
+    // thread is already donating.
+    std::unique_lock<Lock> lock(m_heap.m_markingMutex, std::try_to_lock);
+    if (!lock.owns_lock())
+        return;
+
+    // Otherwise, assume that a thread will go idle soon, and donate.
+    from.donateSomeCellsTo(to);
+
+    m_heap.m_markingConditionVariable.notifyAll();
+}
+
+void SlotVisitor::donateKnownParallel()
+{
+    donateKnownParallel(m_collectorStack, *m_heap.m_sharedCollectorMarkStack);
+    donateKnownParallel(m_mutatorStack, *m_heap.m_sharedMutatorMarkStack);
+}
+
+void SlotVisitor::updateMutatorIsStopped(const AbstractLocker&)
+{
+    m_mutatorIsStopped = (m_heap.collectorBelievesThatTheWorldIsStopped() & m_canOptimizeForStoppedMutator);
+}
+
+void SlotVisitor::updateMutatorIsStopped()
+{
+    if (mutatorIsStoppedIsUpToDate())
+        return;
+    updateMutatorIsStopped(holdLock(m_rightToRun));
+}
+
+bool SlotVisitor::hasAcknowledgedThatTheMutatorIsResumed() const
+{
+    return !m_mutatorIsStopped;
+}
+
+bool SlotVisitor::mutatorIsStoppedIsUpToDate() const
+{
+    return m_mutatorIsStopped == (m_heap.collectorBelievesThatTheWorldIsStopped() & m_canOptimizeForStoppedMutator);
+}
+
+void SlotVisitor::optimizeForStoppedMutator()
+{
+    m_canOptimizeForStoppedMutator = true;
+}
+
+void SlotVisitor::drain(MonotonicTime timeout)
+{
+    ASSERT(m_isInParallelMode);
+    
+    auto locker = holdLock(m_rightToRun);
+    
+    while (!hasElapsed(timeout)) {
+        updateMutatorIsStopped(locker);
+        if (!m_collectorStack.isEmpty()) {
+            m_collectorStack.refill();
+            m_isFirstVisit = true;
+            for (unsigned countdown = Options::minimumNumberOfScansBetweenRebalance(); m_collectorStack.canRemoveLast() && countdown--;)
+                visitChildren(m_collectorStack.removeLast());
+        } else if (!m_mutatorStack.isEmpty()) {
+            m_mutatorStack.refill();
+            // We know for sure that we are visiting objects because of the barrier, not because of
+            // marking. Marking will visit an object exactly once. The barrier will visit it
+            // possibly many times, and always after it was already marked.
+            m_isFirstVisit = false;
+            for (unsigned countdown = Options::minimumNumberOfScansBetweenRebalance(); m_mutatorStack.canRemoveLast() && countdown--;)
+                visitChildren(m_mutatorStack.removeLast());
+        } else
+            break;
+        m_rightToRun.safepoint();
+        donateKnownParallel();
+    }
+    
+    mergeIfNecessary();
+}
+
+bool SlotVisitor::didReachTermination()
+{
+    LockHolder locker(m_heap.m_markingMutex);
+    return didReachTermination(locker);
+}
+
+bool SlotVisitor::didReachTermination(const LockHolder&)
+{
+    return isEmpty()
+        && !m_heap.m_numberOfActiveParallelMarkers
+        && m_heap.m_sharedCollectorMarkStack->isEmpty()
+        && m_heap.m_sharedMutatorMarkStack->isEmpty();
+}
+
+bool SlotVisitor::hasWork(const LockHolder&)
+{
+    return !m_heap.m_sharedCollectorMarkStack->isEmpty()
+        || !m_heap.m_sharedMutatorMarkStack->isEmpty();
+}
+
+SlotVisitor::SharedDrainResult SlotVisitor::drainFromShared(SharedDrainMode sharedDrainMode, MonotonicTime timeout)
+{
+    ASSERT(m_isInParallelMode);
+    
+    ASSERT(Options::numberOfGCMarkers());
+    
+    bool isActive = false;
+    while (true) {
+        {
+            LockHolder locker(m_heap.m_markingMutex);
+            if (isActive)
+                m_heap.m_numberOfActiveParallelMarkers--;
+            m_heap.m_numberOfWaitingParallelMarkers++;
+
+            if (sharedDrainMode == MasterDrain) {
+                while (true) {
+                    if (hasElapsed(timeout))
+                        return SharedDrainResult::TimedOut;
+                    
+                    if (didReachTermination(locker)) {
+                        m_heap.m_markingConditionVariable.notifyAll();
+                        return SharedDrainResult::Done;
+                    }
+                    
+                    if (hasWork(locker))
+                        break;
+                    
+                    m_heap.m_markingConditionVariable.waitUntil(m_heap.m_markingMutex, timeout);
+                }
+            } else {
+                ASSERT(sharedDrainMode == SlaveDrain);
+
+                if (hasElapsed(timeout))
+                    return SharedDrainResult::TimedOut;
+                
+                if (didReachTermination(locker))
+                    m_heap.m_markingConditionVariable.notifyAll();
+
+                m_heap.m_markingConditionVariable.waitUntil(
+                    m_heap.m_markingMutex, timeout,
+                    [&] {
+                        return hasWork(locker)
+                            || m_heap.m_parallelMarkersShouldExit;
+                    });
+                
+                if (m_heap.m_parallelMarkersShouldExit)
+                    return SharedDrainResult::Done;
+            }
+
+            m_collectorStack.stealSomeCellsFrom(
+                *m_heap.m_sharedCollectorMarkStack, m_heap.m_numberOfWaitingParallelMarkers);
+            m_mutatorStack.stealSomeCellsFrom(
+                *m_heap.m_sharedMutatorMarkStack, m_heap.m_numberOfWaitingParallelMarkers);
+            m_heap.m_numberOfActiveParallelMarkers++;
+            m_heap.m_numberOfWaitingParallelMarkers--;
+        }
+        
+        drain(timeout);
+        isActive = true;
+    }
+}
+
+SlotVisitor::SharedDrainResult SlotVisitor::drainInParallel(MonotonicTime timeout)
+{
+    donateAndDrain(timeout);
+    return drainFromShared(MasterDrain, timeout);
+}
+
+SlotVisitor::SharedDrainResult SlotVisitor::drainInParallelPassively(MonotonicTime timeout)
+{
+    ASSERT(m_isInParallelMode);
+    
+    ASSERT(Options::numberOfGCMarkers());
+    
+    if (Options::numberOfGCMarkers() < 4
+        || !m_heap.hasHeapAccess()
+        || m_heap.collectorBelievesThatTheWorldIsStopped()) {
+        // This is an optimization over drainInParallel() when we have a concurrent mutator but
+        // otherwise it is not profitable.
+        return drainInParallel(timeout);
+    }
+
+    LockHolder locker(m_heap.m_markingMutex);
+    m_collectorStack.transferTo(*m_heap.m_sharedCollectorMarkStack);
+    m_mutatorStack.transferTo(*m_heap.m_sharedMutatorMarkStack);
+    m_heap.m_markingConditionVariable.notifyAll();
+    
+    for (;;) {
+        if (hasElapsed(timeout))
+            return SharedDrainResult::TimedOut;
+        
+        if (didReachTermination(locker)) {
+            m_heap.m_markingConditionVariable.notifyAll();
+            return SharedDrainResult::Done;
+        }
+        
+        m_heap.m_markingConditionVariable.waitUntil(m_heap.m_markingMutex, timeout);
+    }
+}
+
+void SlotVisitor::addOpaqueRoot(void* root)
+{
+    if (!root)
+        return;
+    
+    if (m_ignoreNewOpaqueRoots)
+        return;
+    
+    if (Options::numberOfGCMarkers() == 1) {
+        // Put directly into the shared HashSet.
+        m_heap.m_opaqueRoots.add(root);
+        return;
+    }
+    // Put into the local set, but merge with the shared one every once in
+    // a while to make sure that the local sets don't grow too large.
+    mergeOpaqueRootsIfProfitable();
+    m_opaqueRoots.add(root);
+}
+
+bool SlotVisitor::containsOpaqueRoot(void* root) const
+{
+    if (!root)
+        return false;
+    
+    ASSERT(!m_isInParallelMode);
+    return m_heap.m_opaqueRoots.contains(root);
+}
+
+TriState SlotVisitor::containsOpaqueRootTriState(void* root) const
+{
+    if (!root)
+        return FalseTriState;
+    
+    if (m_opaqueRoots.contains(root))
+        return TrueTriState;
+    std::lock_guard<Lock> lock(m_heap.m_opaqueRootsMutex);
+    if (m_heap.m_opaqueRoots.contains(root))
+        return TrueTriState;
+    return MixedTriState;
+}
+
+void SlotVisitor::mergeIfNecessary()
+{
+    if (m_opaqueRoots.isEmpty())
+        return;
+    mergeOpaqueRoots();
+}
+
+void SlotVisitor::mergeOpaqueRootsIfProfitable()
+{
+    if (static_cast<unsigned>(m_opaqueRoots.size()) < Options::opaqueRootMergeThreshold())
+        return;
+    mergeOpaqueRoots();
+}
+    
+void SlotVisitor::donate()
+{
+    ASSERT(m_isInParallelMode);
+    if (Options::numberOfGCMarkers() == 1)
+        return;
+    
+    donateKnownParallel();
+}
+
+void SlotVisitor::donateAndDrain(MonotonicTime timeout)
+{
+    donate();
+    drain(timeout);
+}
+
+void SlotVisitor::mergeOpaqueRoots()
+{
+    {
+        std::lock_guard<Lock> lock(m_heap.m_opaqueRootsMutex);
+        for (auto* root : m_opaqueRoots)
+            m_heap.m_opaqueRoots.add(root);
+    }
+    m_opaqueRoots.clear();
+}
+
+void SlotVisitor::addWeakReferenceHarvester(WeakReferenceHarvester* weakReferenceHarvester)
+{
+    m_heap.m_weakReferenceHarvesters.addThreadSafe(weakReferenceHarvester);
+}
+
+void SlotVisitor::addUnconditionalFinalizer(UnconditionalFinalizer* unconditionalFinalizer)
+{
+    m_heap.m_unconditionalFinalizers.addThreadSafe(unconditionalFinalizer);
+}
+
+void SlotVisitor::didRace(const VisitRaceKey& race)
+{
+    if (Options::verboseVisitRace())
+        dataLog(toCString("GC visit race: ", race, "\n"));
+    
+    auto locker = holdLock(heap()->m_raceMarkStackLock);
+    JSCell* cell = race.cell();
+    cell->setCellState(CellState::PossiblyGrey);
+    heap()->m_raceMarkStack->append(cell);
+}
+
+void SlotVisitor::dump(PrintStream& out) const
+{
+    out.print("Collector: [", pointerListDump(collectorMarkStack()), "], Mutator: [", pointerListDump(mutatorMarkStack()), "]");
+}
+
+} // namespace JSC
diff --git a/heap/SlotVisitor.h b/heap/SlotVisitor.h
new file mode 100644
index 0000000..2e4655d
--- /dev/null
+++ b/heap/SlotVisitor.h
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CellState.h"
+#include "HandleTypes.h"
+#include "MarkStack.h"
+#include "OpaqueRootSet.h"
+#include "VisitRaceKey.h"
+#include <wtf/MonotonicTime.h>
+
+namespace JSC {
+
+class ConservativeRoots;
+class GCThreadSharedData;
+class Heap;
+class HeapCell;
+class HeapSnapshotBuilder;
+class MarkedBlock;
+class UnconditionalFinalizer;
+template<typename T> class Weak;
+class WeakReferenceHarvester;
+template<typename T> class WriteBarrierBase;
+
+typedef uint32_t HeapVersion;
+
+class SlotVisitor {
+    WTF_MAKE_NONCOPYABLE(SlotVisitor);
+    WTF_MAKE_FAST_ALLOCATED;
+
+    friend class SetCurrentCellScope;
+    friend class Heap;
+
+public:
+    SlotVisitor(Heap&);
+    ~SlotVisitor();
+
+    MarkStackArray& collectorMarkStack() { return m_collectorStack; }
+    MarkStackArray& mutatorMarkStack() { return m_mutatorStack; }
+    const MarkStackArray& collectorMarkStack() const { return m_collectorStack; }
+    const MarkStackArray& mutatorMarkStack() const { return m_mutatorStack; }
+    
+    VM& vm();
+    const VM& vm() const;
+    Heap* heap() const;
+
+    void append(ConservativeRoots&);
+    
+    template<typename T> void append(const WriteBarrierBase<T>&);
+    template<typename T> void appendHidden(const WriteBarrierBase<T>&);
+    template<typename Iterator> void append(Iterator begin , Iterator end);
+    void appendValues(const WriteBarrierBase<Unknown>*, size_t count);
+    void appendValuesHidden(const WriteBarrierBase<Unknown>*, size_t count);
+    
+    // These don't require you to prove that you have a WriteBarrier<>. That makes sense
+    // for:
+    //
+    // - roots.
+    // - sophisticated data structures that barrier through other means (like DFG::Plan and
+    //   friends).
+    //
+    // If you are not a root and you don't know what kind of barrier you have, then you
+    // shouldn't call these methods.
+    JS_EXPORT_PRIVATE void appendUnbarriered(JSValue);
+    void appendUnbarriered(JSValue*, size_t);
+    void appendUnbarriered(JSCell*);
+    
+    template<typename T>
+    void append(const Weak<T>& weak);
+    
+    JS_EXPORT_PRIVATE void addOpaqueRoot(void*);
+    
+    JS_EXPORT_PRIVATE bool containsOpaqueRoot(void*) const;
+    TriState containsOpaqueRootTriState(void*) const;
+
+    bool isEmpty() { return m_collectorStack.isEmpty() && m_mutatorStack.isEmpty(); }
+
+    void didStartMarking();
+    void reset();
+    void clearMarkStacks();
+
+    size_t bytesVisited() const { return m_bytesVisited; }
+    size_t visitCount() const { return m_visitCount; }
+    
+    void addToVisitCount(size_t value) { m_visitCount += value; }
+
+    void donate();
+    void drain(MonotonicTime timeout = MonotonicTime::infinity());
+    void donateAndDrain(MonotonicTime timeout = MonotonicTime::infinity());
+    
+    enum SharedDrainMode { SlaveDrain, MasterDrain };
+    enum class SharedDrainResult { Done, TimedOut };
+    SharedDrainResult drainFromShared(SharedDrainMode, MonotonicTime timeout = MonotonicTime::infinity());
+
+    SharedDrainResult drainInParallel(MonotonicTime timeout = MonotonicTime::infinity());
+    SharedDrainResult drainInParallelPassively(MonotonicTime timeout = MonotonicTime::infinity());
+    
+    JS_EXPORT_PRIVATE void mergeIfNecessary();
+
+    // This informs the GC about auxiliary of some size that we are keeping alive. If you don't do
+    // this then the space will be freed at end of GC.
+    void markAuxiliary(const void* base);
+
+    void reportExtraMemoryVisited(size_t);
+#if ENABLE(RESOURCE_USAGE)
+    void reportExternalMemoryVisited(size_t);
+#endif
+    
+    void addWeakReferenceHarvester(WeakReferenceHarvester*);
+    void addUnconditionalFinalizer(UnconditionalFinalizer*);
+
+    void dump(PrintStream&) const;
+
+    bool isBuildingHeapSnapshot() const { return !!m_heapSnapshotBuilder; }
+    
+    HeapVersion markingVersion() const { return m_markingVersion; }
+
+    bool mutatorIsStopped() const { return m_mutatorIsStopped; }
+    
+    Lock& rightToRun() { return m_rightToRun; }
+    
+    void updateMutatorIsStopped(const AbstractLocker&);
+    void updateMutatorIsStopped();
+    
+    bool hasAcknowledgedThatTheMutatorIsResumed() const;
+    bool mutatorIsStoppedIsUpToDate() const;
+    
+    void optimizeForStoppedMutator();
+    
+    void didRace(const VisitRaceKey&);
+    void didRace(JSCell* cell, const char* reason) { didRace(VisitRaceKey(cell, reason)); }
+    
+    void visitAsConstraint(const JSCell*);
+    
+    bool didReachTermination();
+    
+    void setIgnoreNewOpaqueRoots(bool value) { m_ignoreNewOpaqueRoots = value; }
+
+private:
+    friend class ParallelModeEnabler;
+    
+    void appendJSCellOrAuxiliary(HeapCell*);
+    void appendHidden(JSValue);
+
+    JS_EXPORT_PRIVATE void setMarkedAndAppendToMarkStack(JSCell*);
+    
+    template<typename ContainerType>
+    void setMarkedAndAppendToMarkStack(ContainerType&, JSCell*);
+    
+    void appendToMarkStack(JSCell*);
+    
+    template<typename ContainerType>
+    void appendToMarkStack(ContainerType&, JSCell*);
+    
+    void appendToMutatorMarkStack(const JSCell*);
+    
+    void noteLiveAuxiliaryCell(HeapCell*);
+    
+    void mergeOpaqueRoots();
+
+    void mergeOpaqueRootsIfProfitable();
+
+    void visitChildren(const JSCell*);
+    
+    void donateKnownParallel();
+    void donateKnownParallel(MarkStackArray& from, MarkStackArray& to);
+    
+    bool hasWork(const LockHolder&);
+    bool didReachTermination(const LockHolder&);
+
+    MarkStackArray m_collectorStack;
+    MarkStackArray m_mutatorStack;
+    OpaqueRootSet m_opaqueRoots; // Handle-owning data structures not visible to the garbage collector.
+    bool m_ignoreNewOpaqueRoots { false }; // Useful as a debugging mode.
+    
+    size_t m_bytesVisited;
+    size_t m_visitCount;
+    bool m_isInParallelMode;
+    
+    HeapVersion m_markingVersion;
+    
+    Heap& m_heap;
+
+    HeapSnapshotBuilder* m_heapSnapshotBuilder { nullptr };
+    JSCell* m_currentCell { nullptr };
+    bool m_isFirstVisit { false };
+    bool m_mutatorIsStopped { false };
+    bool m_canOptimizeForStoppedMutator { false };
+    Lock m_rightToRun;
+    
+public:
+#if !ASSERT_DISABLED
+    bool m_isCheckingForDefaultMarkViolation;
+    bool m_isDraining;
+#endif
+};
+
+class ParallelModeEnabler {
+public:
+    ParallelModeEnabler(SlotVisitor& stack)
+        : m_stack(stack)
+    {
+        ASSERT(!m_stack.m_isInParallelMode);
+        m_stack.m_isInParallelMode = true;
+    }
+    
+    ~ParallelModeEnabler()
+    {
+        ASSERT(m_stack.m_isInParallelMode);
+        m_stack.m_isInParallelMode = false;
+    }
+    
+private:
+    SlotVisitor& m_stack;
+};
+
+} // namespace JSC
diff --git a/heap/SlotVisitorInlines.h b/heap/SlotVisitorInlines.h
new file mode 100644
index 0000000..1fd1d83
--- /dev/null
+++ b/heap/SlotVisitorInlines.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "SlotVisitor.h"
+#include "Weak.h"
+#include "WeakInlines.h"
+
+namespace JSC {
+
+inline void SlotVisitor::appendUnbarriered(JSValue* slot, size_t count)
+{
+    for (size_t i = count; i--;)
+        appendUnbarriered(slot[i]);
+}
+
+inline void SlotVisitor::appendUnbarriered(JSCell* cell)
+{
+    appendUnbarriered(JSValue(cell));
+}
+
+template<typename T>
+inline void SlotVisitor::append(const Weak<T>& weak)
+{
+    appendUnbarriered(weak.get());
+}
+
+template<typename T>
+inline void SlotVisitor::append(const WriteBarrierBase<T>& slot)
+{
+    appendUnbarriered(slot.get());
+}
+
+template<typename T>
+inline void SlotVisitor::appendHidden(const WriteBarrierBase<T>& slot)
+{
+    appendHidden(slot.get());
+}
+
+template<typename Iterator>
+inline void SlotVisitor::append(Iterator begin, Iterator end)
+{
+    for (auto it = begin; it != end; ++it)
+        append(*it);
+}
+
+inline void SlotVisitor::appendValues(const WriteBarrierBase<Unknown>* barriers, size_t count)
+{
+    for (size_t i = 0; i < count; ++i)
+        append(barriers[i]);
+}
+
+inline void SlotVisitor::appendValuesHidden(const WriteBarrierBase<Unknown>* barriers, size_t count)
+{
+    for (size_t i = 0; i < count; ++i)
+        appendHidden(barriers[i]);
+}
+
+inline void SlotVisitor::reportExtraMemoryVisited(size_t size)
+{
+    if (m_isFirstVisit)
+        heap()->reportExtraMemoryVisited(size);
+}
+
+#if ENABLE(RESOURCE_USAGE)
+inline void SlotVisitor::reportExternalMemoryVisited(size_t size)
+{
+    if (m_isFirstVisit)
+        heap()->reportExternalMemoryVisited(size);
+}
+#endif
+
+inline Heap* SlotVisitor::heap() const
+{
+    return &m_heap;
+}
+
+inline VM& SlotVisitor::vm()
+{
+    return *m_heap.m_vm;
+}
+
+inline const VM& SlotVisitor::vm() const
+{
+    return *m_heap.m_vm;
+}
+
+} // namespace JSC
diff --git a/heap/SpaceTimeMutatorScheduler.cpp b/heap/SpaceTimeMutatorScheduler.cpp
new file mode 100644
index 0000000..7a41856
--- /dev/null
+++ b/heap/SpaceTimeMutatorScheduler.cpp
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SpaceTimeMutatorScheduler.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+// The scheduler will often make decisions based on state that is in flux. It will be fine so
+// long as multiple uses of the same value all see the same value. We wouldn't get this for free,
+// since our need to modularize the calculation results in a tendency to access the same mutable
+// field in Heap multiple times, and to access the current time multiple times.
+class SpaceTimeMutatorScheduler::Snapshot {
+public:
+    Snapshot(SpaceTimeMutatorScheduler& scheduler)
+    {
+        m_now = MonotonicTime::now();
+        m_bytesAllocatedThisCycle = scheduler.bytesAllocatedThisCycleImpl();
+    }
+    
+    MonotonicTime now() const { return m_now; }
+    
+    double bytesAllocatedThisCycle() const { return m_bytesAllocatedThisCycle; }
+    
+private:
+    MonotonicTime m_now;
+    double m_bytesAllocatedThisCycle;
+};
+
+SpaceTimeMutatorScheduler::SpaceTimeMutatorScheduler(Heap& heap)
+    : m_heap(heap)
+    , m_period(Seconds::fromMilliseconds(Options::concurrentGCPeriodMS()))
+{
+}
+
+SpaceTimeMutatorScheduler::~SpaceTimeMutatorScheduler()
+{
+}
+
+MutatorScheduler::State SpaceTimeMutatorScheduler::state() const
+{
+    return m_state;
+}
+
+void SpaceTimeMutatorScheduler::beginCollection()
+{
+    RELEASE_ASSERT(m_state == Normal);
+    m_state = Stopped;
+    m_startTime = MonotonicTime::now();
+
+    m_bytesAllocatedThisCycleAtTheBeginning = m_heap.m_bytesAllocatedThisCycle;
+    m_bytesAllocatedThisCycleAtTheEnd = 
+        Options::concurrentGCMaxHeadroom() *
+        std::max<double>(m_bytesAllocatedThisCycleAtTheBeginning, m_heap.m_maxEdenSize);
+}
+
+void SpaceTimeMutatorScheduler::didStop()
+{
+    RELEASE_ASSERT(m_state == Stopped || m_state == Resumed);
+    m_state = Stopped;
+}
+
+void SpaceTimeMutatorScheduler::willResume()
+{
+    RELEASE_ASSERT(m_state == Stopped || m_state == Resumed);
+    m_state = Resumed;
+}
+
+void SpaceTimeMutatorScheduler::didExecuteConstraints()
+{
+    // If we execute constraints, we want to forgive the GC for all of the time it had stopped the
+    // world for in this increment. This hack is empirically better than every other heuristic I
+    // tried, because it just means that the GC is happy to pause for longer when it's dealing
+    // with things that don't play well with concurrency.
+    // FIXME: The feels so wrong but benchmarks so good.
+    // https://bugs.webkit.org/show_bug.cgi?id=166833
+    m_startTime = MonotonicTime::now();
+}
+
+MonotonicTime SpaceTimeMutatorScheduler::timeToStop()
+{
+    switch (m_state) {
+    case Normal:
+        return MonotonicTime::infinity();
+    case Stopped:
+        return MonotonicTime::now();
+    case Resumed: {
+        Snapshot snapshot(*this);
+        if (!shouldBeResumed(snapshot))
+            return snapshot.now();
+        return snapshot.now() - elapsedInPeriod(snapshot) + m_period;
+    } }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return MonotonicTime();
+}
+
+MonotonicTime SpaceTimeMutatorScheduler::timeToResume()
+{
+    switch (m_state) {
+    case Normal:
+    case Resumed:
+        return MonotonicTime::now();
+    case Stopped: {
+        Snapshot snapshot(*this);
+        if (shouldBeResumed(snapshot))
+            return snapshot.now();
+        return snapshot.now() - elapsedInPeriod(snapshot) + m_period * collectorUtilization(snapshot);
+    } }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return MonotonicTime();
+}
+
+void SpaceTimeMutatorScheduler::log()
+{
+    ASSERT(Options::logGC());
+    Snapshot snapshot(*this);
+    dataLog(
+        "a=", format("%.0lf", bytesSinceBeginningOfCycle(snapshot) / 1024), " kb ",
+        "hf=", format("%.3lf", headroomFullness(snapshot)), " ",
+        "mu=", format("%.3lf", mutatorUtilization(snapshot)), " ");
+}
+
+void SpaceTimeMutatorScheduler::endCollection()
+{
+    m_state = Normal;
+    m_startTime = MonotonicTime::now();
+}
+
+double SpaceTimeMutatorScheduler::bytesAllocatedThisCycleImpl()
+{
+    return m_heap.m_bytesAllocatedThisCycle;
+}
+
+double SpaceTimeMutatorScheduler::bytesSinceBeginningOfCycle(const Snapshot& snapshot)
+{
+    return snapshot.bytesAllocatedThisCycle() - m_bytesAllocatedThisCycleAtTheBeginning;
+}
+
+double SpaceTimeMutatorScheduler::maxHeadroom()
+{
+    return m_bytesAllocatedThisCycleAtTheEnd - m_bytesAllocatedThisCycleAtTheBeginning;
+}
+
+double SpaceTimeMutatorScheduler::headroomFullness(const Snapshot& snapshot)
+{
+    double result = bytesSinceBeginningOfCycle(snapshot) / maxHeadroom();
+
+    // headroomFullness can be NaN and other interesting things if
+    // bytesAllocatedThisCycleAtTheBeginning is zero. We see that in debug tests. This code
+    // defends against all floating point dragons.
+    
+    if (!(result >= 0))
+        result = 0;
+    if (!(result <= 1))
+        result = 1;
+
+    return result;
+}
+
+double SpaceTimeMutatorScheduler::mutatorUtilization(const Snapshot& snapshot)
+{
+    double mutatorUtilization = 1 - headroomFullness(snapshot);
+    
+    // Scale the mutator utilization into the permitted window.
+    mutatorUtilization =
+        Options::minimumMutatorUtilization() +
+        mutatorUtilization * (
+            Options::maximumMutatorUtilization() -
+            Options::minimumMutatorUtilization());
+    
+    return mutatorUtilization;
+}
+
+double SpaceTimeMutatorScheduler::collectorUtilization(const Snapshot& snapshot)
+{
+    return 1 - mutatorUtilization(snapshot);
+}
+
+Seconds SpaceTimeMutatorScheduler::elapsedInPeriod(const Snapshot& snapshot)
+{
+    return (snapshot.now() - m_startTime) % m_period;
+}
+
+double SpaceTimeMutatorScheduler::phase(const Snapshot& snapshot)
+{
+    return elapsedInPeriod(snapshot) / m_period;
+}
+
+bool SpaceTimeMutatorScheduler::shouldBeResumed(const Snapshot& snapshot)
+{
+    return phase(snapshot) > collectorUtilization(snapshot);
+}
+
+} // namespace JSC
+
diff --git a/heap/SpaceTimeMutatorScheduler.h b/heap/SpaceTimeMutatorScheduler.h
new file mode 100644
index 0000000..ebded25
--- /dev/null
+++ b/heap/SpaceTimeMutatorScheduler.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MutatorScheduler.h"
+#include <wtf/Seconds.h>
+
+namespace JSC {
+
+class Heap;
+
+// The JSC concurrent GC sometimes stops the world in order to stay ahead of it. These deliberate,
+// synthetic pauses ensure that the GC won't have to do one huge pause in order to catch up to the
+// retreating wavefront. The scheduler is called "space-time" because it links the amount of time
+// that the world is paused for to the amount of space that the world allocated since the GC cycle
+// began.
+
+class SpaceTimeMutatorScheduler : public MutatorScheduler {
+public:
+    SpaceTimeMutatorScheduler(Heap&);
+    ~SpaceTimeMutatorScheduler();
+    
+    State state() const override;
+    
+    void beginCollection() override;
+    
+    void didStop() override;
+    void willResume() override;
+    void didExecuteConstraints() override;
+    
+    MonotonicTime timeToStop() override;
+    MonotonicTime timeToResume() override;
+    
+    void log() override;
+    
+    void endCollection() override;
+    
+private:
+    class Snapshot;
+    friend class Snapshot;
+    
+    double bytesAllocatedThisCycleImpl();
+    
+    double bytesSinceBeginningOfCycle(const Snapshot&);
+    double maxHeadroom();
+    double headroomFullness(const Snapshot&);
+    double mutatorUtilization(const Snapshot&);
+    double collectorUtilization(const Snapshot&);
+    Seconds elapsedInPeriod(const Snapshot&);
+    double phase(const Snapshot&);
+    bool shouldBeResumed(const Snapshot&);
+    
+    Heap& m_heap;
+    Seconds m_period;
+    State m_state { Normal };
+    
+    double m_bytesAllocatedThisCycleAtTheBeginning { 0 };
+    double m_bytesAllocatedThisCycleAtTheEnd { 0 };
+    MonotonicTime m_startTime;
+};
+
+} // namespace JSC
+
diff --git a/heap/StochasticSpaceTimeMutatorScheduler.cpp b/heap/StochasticSpaceTimeMutatorScheduler.cpp
new file mode 100644
index 0000000..38c5378
--- /dev/null
+++ b/heap/StochasticSpaceTimeMutatorScheduler.cpp
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "StochasticSpaceTimeMutatorScheduler.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+// The scheduler will often make decisions based on state that is in flux. It will be fine so
+// long as multiple uses of the same value all see the same value. We wouldn't get this for free,
+// since our need to modularize the calculation results in a tendency to access the same mutable
+// field in Heap multiple times, and to access the current time multiple times.
+class StochasticSpaceTimeMutatorScheduler::Snapshot {
+public:
+    Snapshot(StochasticSpaceTimeMutatorScheduler& scheduler)
+    {
+        m_now = MonotonicTime::now();
+        m_bytesAllocatedThisCycle = scheduler.bytesAllocatedThisCycleImpl();
+    }
+    
+    MonotonicTime now() const { return m_now; }
+    
+    double bytesAllocatedThisCycle() const { return m_bytesAllocatedThisCycle; }
+    
+private:
+    MonotonicTime m_now;
+    double m_bytesAllocatedThisCycle;
+};
+
+StochasticSpaceTimeMutatorScheduler::StochasticSpaceTimeMutatorScheduler(Heap& heap)
+    : m_heap(heap)
+    , m_minimumPause(Seconds::fromMilliseconds(Options::minimumGCPauseMS()))
+    , m_pauseScale(Options::gcPauseScale())
+{
+}
+
+StochasticSpaceTimeMutatorScheduler::~StochasticSpaceTimeMutatorScheduler()
+{
+}
+
+MutatorScheduler::State StochasticSpaceTimeMutatorScheduler::state() const
+{
+    return m_state;
+}
+
+void StochasticSpaceTimeMutatorScheduler::beginCollection()
+{
+    RELEASE_ASSERT(m_state == Normal);
+    m_state = Stopped;
+
+    m_bytesAllocatedThisCycleAtTheBeginning = m_heap.m_bytesAllocatedThisCycle;
+    m_bytesAllocatedThisCycleAtTheEnd = 
+        Options::concurrentGCMaxHeadroom() *
+        std::max<double>(m_bytesAllocatedThisCycleAtTheBeginning, m_heap.m_maxEdenSize);
+    m_beforeConstraints = MonotonicTime::now();
+}
+
+void StochasticSpaceTimeMutatorScheduler::didStop()
+{
+    RELEASE_ASSERT(m_state == Stopped || m_state == Resumed);
+    m_state = Stopped;
+}
+
+void StochasticSpaceTimeMutatorScheduler::willResume()
+{
+    RELEASE_ASSERT(m_state == Stopped || m_state == Resumed);
+    m_state = Resumed;
+}
+
+void StochasticSpaceTimeMutatorScheduler::didReachTermination()
+{
+    m_beforeConstraints = MonotonicTime::now();
+}
+
+void StochasticSpaceTimeMutatorScheduler::didExecuteConstraints()
+{
+    Snapshot snapshot(*this);
+    
+    Seconds constraintExecutionDuration = snapshot.now() - m_beforeConstraints;
+    
+    m_targetPause = std::max(
+        constraintExecutionDuration * m_pauseScale,
+        m_minimumPause);
+    
+    if (Options::logGC())
+        dataLog("tp=", m_targetPause.milliseconds(), "ms ");
+    
+    m_plannedResumeTime = snapshot.now() + m_targetPause;
+}
+
+void StochasticSpaceTimeMutatorScheduler::synchronousDrainingDidStall()
+{
+    Snapshot snapshot(*this);
+    
+    double resumeProbability = mutatorUtilization(snapshot);
+    bool shouldResume = m_random.get() < resumeProbability;
+    
+    if (shouldResume) {
+        m_plannedResumeTime = snapshot.now();
+        return;
+    }
+    
+    m_plannedResumeTime = snapshot.now() + m_targetPause;
+}
+
+MonotonicTime StochasticSpaceTimeMutatorScheduler::timeToStop()
+{
+    switch (m_state) {
+    case Normal:
+        return MonotonicTime::infinity();
+    case Stopped:
+        return MonotonicTime::now();
+    case Resumed: {
+        // Once we're running, we keep going.
+        // FIXME: Maybe force stop when we run out of headroom?
+        return MonotonicTime::infinity();
+    } }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return MonotonicTime();
+}
+
+MonotonicTime StochasticSpaceTimeMutatorScheduler::timeToResume()
+{
+    switch (m_state) {
+    case Normal:
+    case Resumed:
+        return MonotonicTime::now();
+    case Stopped:
+        return m_plannedResumeTime;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return MonotonicTime();
+}
+
+void StochasticSpaceTimeMutatorScheduler::log()
+{
+    ASSERT(Options::logGC());
+    Snapshot snapshot(*this);
+    dataLog(
+        "a=", format("%.0lf", bytesSinceBeginningOfCycle(snapshot) / 1024), " kb ",
+        "hf=", format("%.3lf", headroomFullness(snapshot)), " ",
+        "mu=", format("%.3lf", mutatorUtilization(snapshot)), " ");
+}
+
+void StochasticSpaceTimeMutatorScheduler::endCollection()
+{
+    m_state = Normal;
+}
+
+double StochasticSpaceTimeMutatorScheduler::bytesAllocatedThisCycleImpl()
+{
+    return m_heap.m_bytesAllocatedThisCycle;
+}
+
+double StochasticSpaceTimeMutatorScheduler::bytesSinceBeginningOfCycle(const Snapshot& snapshot)
+{
+    return snapshot.bytesAllocatedThisCycle() - m_bytesAllocatedThisCycleAtTheBeginning;
+}
+
+double StochasticSpaceTimeMutatorScheduler::maxHeadroom()
+{
+    return m_bytesAllocatedThisCycleAtTheEnd - m_bytesAllocatedThisCycleAtTheBeginning;
+}
+
+double StochasticSpaceTimeMutatorScheduler::headroomFullness(const Snapshot& snapshot)
+{
+    double result = bytesSinceBeginningOfCycle(snapshot) / maxHeadroom();
+
+    // headroomFullness can be NaN and other interesting things if
+    // bytesAllocatedThisCycleAtTheBeginning is zero. We see that in debug tests. This code
+    // defends against all floating point dragons.
+    
+    if (!(result >= 0))
+        result = 0;
+    if (!(result <= 1))
+        result = 1;
+
+    return result;
+}
+
+double StochasticSpaceTimeMutatorScheduler::mutatorUtilization(const Snapshot& snapshot)
+{
+    double mutatorUtilization = 1 - headroomFullness(snapshot);
+    
+    // Scale the mutator utilization into the permitted window.
+    mutatorUtilization =
+        Options::minimumMutatorUtilization() +
+        mutatorUtilization * (
+            Options::maximumMutatorUtilization() -
+            Options::minimumMutatorUtilization());
+    
+    return mutatorUtilization;
+}
+
+} // namespace JSC
+
diff --git a/heap/StochasticSpaceTimeMutatorScheduler.h b/heap/StochasticSpaceTimeMutatorScheduler.h
new file mode 100644
index 0000000..4eca908
--- /dev/null
+++ b/heap/StochasticSpaceTimeMutatorScheduler.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MutatorScheduler.h"
+#include <wtf/Seconds.h>
+#include <wtf/WeakRandom.h>
+
+namespace JSC {
+
+class Heap;
+
+// The JSC concurrent GC sometimes stops the world in order to stay ahead of it. These deliberate,
+// synthetic pauses ensure that the GC won't have to do one huge pause in order to catch up to the
+// retreating wavefront. The scheduler is called "space-time" because it links the amount of time
+// that the world is paused for to the amount of space that the world allocated since the GC cycle
+// began.
+
+class StochasticSpaceTimeMutatorScheduler : public MutatorScheduler {
+public:
+    StochasticSpaceTimeMutatorScheduler(Heap&);
+    ~StochasticSpaceTimeMutatorScheduler();
+    
+    State state() const override;
+    
+    void beginCollection() override;
+    
+    void didStop() override;
+    void willResume() override;
+    void didReachTermination() override;
+    void didExecuteConstraints() override;
+    void synchronousDrainingDidStall() override;
+    
+    MonotonicTime timeToStop() override;
+    MonotonicTime timeToResume() override;
+    
+    void log() override;
+    
+    void endCollection() override;
+    
+private:
+    class Snapshot;
+    friend class Snapshot;
+    
+    double bytesAllocatedThisCycleImpl();
+    
+    double bytesSinceBeginningOfCycle(const Snapshot&);
+    double maxHeadroom();
+    double headroomFullness(const Snapshot&);
+    double mutatorUtilization(const Snapshot&);
+    
+    Heap& m_heap;
+    State m_state { Normal };
+    
+    WeakRandom m_random;
+    
+    Seconds m_minimumPause;
+    double m_pauseScale;
+    Seconds m_targetPause;
+    
+    double m_bytesAllocatedThisCycleAtTheBeginning { 0 };
+    double m_bytesAllocatedThisCycleAtTheEnd { 0 };
+    
+    MonotonicTime m_beforeConstraints;
+    MonotonicTime m_plannedResumeTime;
+};
+
+} // namespace JSC
+
diff --git a/heap/StopIfNecessaryTimer.cpp b/heap/StopIfNecessaryTimer.cpp
new file mode 100644
index 0000000..6e3176c
--- /dev/null
+++ b/heap/StopIfNecessaryTimer.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "StopIfNecessaryTimer.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+StopIfNecessaryTimer::StopIfNecessaryTimer(VM* vm)
+    : HeapTimer(vm)
+{
+}
+
+void StopIfNecessaryTimer::doWork()
+{
+    cancelTimer();
+    WTF::storeStoreFence();
+    m_vm->heap.stopIfNecessary();
+}
+
+void StopIfNecessaryTimer::scheduleSoon()
+{
+    if (isScheduled()) {
+        WTF::loadLoadFence();
+        return;
+    }
+    scheduleTimer(0);
+}
+
+} // namespace JSC
+
diff --git a/heap/StopIfNecessaryTimer.h b/heap/StopIfNecessaryTimer.h
new file mode 100644
index 0000000..a683184
--- /dev/null
+++ b/heap/StopIfNecessaryTimer.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "HeapTimer.h"
+
+namespace JSC {
+
+class Heap;
+
+class StopIfNecessaryTimer : public HeapTimer {
+public:
+    explicit StopIfNecessaryTimer(VM*);
+    
+    void doWork() override;
+    
+    void scheduleSoon();
+};
+
+} // namespace JSC
+
diff --git a/heap/Strong.h b/heap/Strong.h
new file mode 100644
index 0000000..264c24e
--- /dev/null
+++ b/heap/Strong.h
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Assertions.h>
+#include "Handle.h"
+#include "HandleSet.h"
+
+namespace JSC {
+
+class VM;
+
+// A strongly referenced handle that prevents the object it points to from being garbage collected.
+template <typename T> class Strong : public Handle<T> {
+    using Handle<T>::slot;
+    using Handle<T>::setSlot;
+    template <typename U> friend class Strong;
+
+public:
+    typedef typename Handle<T>::ExternalType ExternalType;
+    
+    Strong()
+        : Handle<T>()
+    {
+    }
+    
+    Strong(VM&, ExternalType = ExternalType());
+
+    Strong(VM&, Handle<T>);
+    
+    Strong(const Strong& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleSet::heapFor(other.slot())->allocate());
+        set(other.get());
+    }
+
+    template <typename U> Strong(const Strong<U>& other)
+        : Handle<T>()
+    {
+        if (!other.slot())
+            return;
+        setSlot(HandleSet::heapFor(other.slot())->allocate());
+        set(other.get());
+    }
+    
+    enum HashTableDeletedValueTag { HashTableDeletedValue };
+    bool isHashTableDeletedValue() const { return slot() == hashTableDeletedValue(); }
+    Strong(HashTableDeletedValueTag)
+        : Handle<T>(hashTableDeletedValue())
+    {
+    }
+
+    ~Strong()
+    {
+        clear();
+    }
+
+    bool operator!() const { return !slot() || !*slot(); }
+
+    explicit operator bool() const { return !!*this; }
+
+    void swap(Strong& other)
+    {
+        Handle<T>::swap(other);
+    }
+
+    ExternalType get() const { return HandleTypes<T>::getFromSlot(this->slot()); }
+
+    void set(VM&, ExternalType);
+
+    template <typename U> Strong& operator=(const Strong<U>& other)
+    {
+        if (!other.slot()) {
+            clear();
+            return *this;
+        }
+
+        set(*HandleSet::heapFor(other.slot())->vm(), other.get());
+        return *this;
+    }
+    
+    Strong& operator=(const Strong& other)
+    {
+        if (!other.slot()) {
+            clear();
+            return *this;
+        }
+
+        set(*HandleSet::heapFor(other.slot())->vm(), other.get());
+        return *this;
+    }
+
+    void clear()
+    {
+        if (!slot())
+            return;
+        HandleSet::heapFor(slot())->deallocate(slot());
+        setSlot(0);
+    }
+
+private:
+    static HandleSlot hashTableDeletedValue() { return reinterpret_cast<HandleSlot>(-1); }
+
+    void set(ExternalType externalType)
+    {
+        ASSERT(slot());
+        JSValue value = HandleTypes<T>::toJSValue(externalType);
+        HandleSet::heapFor(slot())->writeBarrier(slot(), value);
+        *slot() = value;
+    }
+};
+
+template<class T> inline void swap(Strong<T>& a, Strong<T>& b)
+{
+    a.swap(b);
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Strong<T>> : SimpleClassVectorTraits {
+    static const bool canCompareWithMemcmp = false;
+};
+
+template<typename P> struct HashTraits<JSC::Strong<P>> : SimpleClassHashTraits<JSC::Strong<P>> { };
+
+} // namespace WTF
diff --git a/heap/StrongInlines.h b/heap/StrongInlines.h
new file mode 100644
index 0000000..6b8197c
--- /dev/null
+++ b/heap/StrongInlines.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "VM.h"
+
+namespace JSC {
+
+template <typename T>
+inline Strong<T>::Strong(VM& vm, ExternalType value)
+    : Handle<T>(vm.heap.handleSet()->allocate())
+{
+    set(value);
+}
+
+template <typename T>
+inline Strong<T>::Strong(VM& vm, Handle<T> handle)
+    : Handle<T>(vm.heap.handleSet()->allocate())
+{
+    set(handle.get());
+}
+
+template <typename T>
+inline void Strong<T>::set(VM& vm, ExternalType value)
+{
+    if (!slot())
+        setSlot(vm.heap.handleSet()->allocate());
+    set(value);
+}
+
+} // namespace JSC
diff --git a/heap/Subspace.cpp b/heap/Subspace.cpp
new file mode 100644
index 0000000..ed6c19e
--- /dev/null
+++ b/heap/Subspace.cpp
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Subspace.h"
+
+#include "JSCInlines.h"
+#include "MarkedAllocatorInlines.h"
+#include "MarkedBlockInlines.h"
+#include "PreventCollectionScope.h"
+#include "SubspaceInlines.h"
+
+namespace JSC {
+
+namespace {
+
+// Writing it this way ensures that when you pass this as a functor, the callee is specialized for
+// this callback. If you wrote this as a normal function then the callee would be specialized for
+// the function's type and it would have indirect calls to that function. And unlike a lambda, it's
+// possible to mark this ALWAYS_INLINE.
+struct DestroyFunc {
+    ALWAYS_INLINE void operator()(VM& vm, JSCell* cell) const
+    {
+        ASSERT(cell->structureID());
+        ASSERT(cell->inlineTypeFlags() & StructureIsImmortal);
+        Structure* structure = cell->structure(vm);
+        const ClassInfo* classInfo = structure->classInfo();
+        MethodTable::DestroyFunctionPtr destroy = classInfo->methodTable.destroy;
+        destroy(cell);
+    }
+};
+
+} // anonymous namespace
+
+Subspace::Subspace(CString name, Heap& heap, AllocatorAttributes attributes)
+    : m_space(heap.objectSpace())
+    , m_name(name)
+    , m_attributes(attributes)
+{
+    // It's remotely possible that we're GCing right now even if the client is careful to only
+    // create subspaces right after VM creation, since collectContinuously (and probably other
+    // things) could cause a GC to be launched at pretty much any time and it's not 100% obvious
+    // that all clients would be able to ensure that there are zero safepoints between when they
+    // create VM and when they do this. Preventing GC while we're creating the Subspace ensures
+    // that we don't have to worry about whether it's OK for the GC to ever see a brand new
+    // subspace.
+    PreventCollectionScope preventCollectionScope(heap);
+    heap.objectSpace().m_subspaces.append(this);
+    
+    for (size_t i = MarkedSpace::numSizeClasses; i--;)
+        m_allocatorForSizeStep[i] = nullptr;
+}
+
+Subspace::~Subspace()
+{
+}
+
+FreeList Subspace::finishSweep(MarkedBlock::Handle& block, MarkedBlock::Handle::SweepMode sweepMode)
+{
+    return block.finishSweepKnowingSubspace(sweepMode, DestroyFunc());
+}
+
+void Subspace::destroy(VM& vm, JSCell* cell)
+{
+    DestroyFunc()(vm, cell);
+}
+
+// The reason why we distinguish between allocate and tryAllocate is to minimize the number of
+// checks on the allocation path in both cases. Likewise, the reason why we have overloads with and
+// without deferralContext is to minimize the amount of code for calling allocate when you don't
+// need the deferralContext.
+void* Subspace::allocate(size_t size)
+{
+    if (MarkedAllocator* allocator = tryAllocatorFor(size))
+        return allocator->allocate();
+    return allocateSlow(nullptr, size);
+}
+
+void* Subspace::allocate(GCDeferralContext* deferralContext, size_t size)
+{
+    if (MarkedAllocator* allocator = tryAllocatorFor(size))
+        return allocator->allocate(deferralContext);
+    return allocateSlow(deferralContext, size);
+}
+
+void* Subspace::tryAllocate(size_t size)
+{
+    if (MarkedAllocator* allocator = tryAllocatorFor(size))
+        return allocator->tryAllocate();
+    return tryAllocateSlow(nullptr, size);
+}
+
+void* Subspace::tryAllocate(GCDeferralContext* deferralContext, size_t size)
+{
+    if (MarkedAllocator* allocator = tryAllocatorFor(size))
+        return allocator->tryAllocate(deferralContext);
+    return tryAllocateSlow(deferralContext, size);
+}
+
+MarkedAllocator* Subspace::allocatorForSlow(size_t size)
+{
+    size_t index = MarkedSpace::sizeClassToIndex(size);
+    size_t sizeClass = MarkedSpace::s_sizeClassForSizeStep[index];
+    if (!sizeClass)
+        return nullptr;
+    
+    // This is written in such a way that it's OK for the JIT threads to end up here if they want
+    // to generate code that uses some allocator that hadn't been used yet. Note that a possibly-
+    // just-as-good solution would be to return null if we're in the JIT since the JIT treats null
+    // allocator as "please always take the slow path". But, that could lead to performance
+    // surprises and the algorithm here is pretty easy. Only this code has to hold the lock, to
+    // prevent simultaneously MarkedAllocator creations from multiple threads. This code ensures
+    // that any "forEachAllocator" traversals will only see this allocator after it's initialized
+    // enough: it will have 
+    auto locker = holdLock(m_space.allocatorLock());
+    if (MarkedAllocator* allocator = m_allocatorForSizeStep[index])
+        return allocator;
+
+    if (false)
+        dataLog("Creating marked allocator for ", m_name, ", ", m_attributes, ", ", sizeClass, ".\n");
+    MarkedAllocator* allocator = m_space.addMarkedAllocator(locker, this, sizeClass);
+    index = MarkedSpace::sizeClassToIndex(sizeClass);
+    for (;;) {
+        if (MarkedSpace::s_sizeClassForSizeStep[index] != sizeClass)
+            break;
+
+        m_allocatorForSizeStep[index] = allocator;
+        
+        if (!index--)
+            break;
+    }
+    allocator->setNextAllocatorInSubspace(m_firstAllocator);
+    WTF::storeStoreFence();
+    m_firstAllocator = allocator;
+    return allocator;
+}
+
+void* Subspace::allocateSlow(GCDeferralContext* deferralContext, size_t size)
+{
+    void* result = tryAllocateSlow(deferralContext, size);
+    RELEASE_ASSERT(result);
+    return result;
+}
+
+void* Subspace::tryAllocateSlow(GCDeferralContext* deferralContext, size_t size)
+{
+    if (MarkedAllocator* allocator = allocatorFor(size))
+        return allocator->tryAllocate(deferralContext);
+    
+    if (size <= Options::largeAllocationCutoff()
+        && size <= MarkedSpace::largeCutoff) {
+        dataLog("FATAL: attampting to allocate small object using large allocation.\n");
+        dataLog("Requested allocation size: ", size, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    m_space.heap()->collectIfNecessaryOrDefer(deferralContext);
+    
+    size = WTF::roundUpToMultipleOf<MarkedSpace::sizeStep>(size);
+    LargeAllocation* allocation = LargeAllocation::tryCreate(*m_space.m_heap, size, this);
+    if (!allocation)
+        return nullptr;
+    
+    m_space.m_largeAllocations.append(allocation);
+    m_space.m_heap->didAllocate(size);
+    m_space.m_capacity += size;
+    
+    m_largeAllocations.append(allocation);
+        
+    return allocation->cell();
+}
+
+} // namespace JSC
+
diff --git a/heap/Subspace.h b/heap/Subspace.h
new file mode 100644
index 0000000..d95f71b
--- /dev/null
+++ b/heap/Subspace.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MarkedBlock.h"
+#include "MarkedSpace.h"
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+// The idea of subspaces is that you can provide some custom behavior for your objects if you
+// allocate them from a custom Subspace in which you override some of the virtual methods. This
+// class is the baseclass of Subspaces and it provides a reasonable default implementation, where
+// sweeping assumes immortal structure. The common ways of overriding this are:
+//
+// - Provide customized destructor behavior. You can change how the destructor is called. You can
+//   also specialize the destructor call in the loop.
+//
+// - Use the Subspace as a quick way to iterate all of the objects in that subspace.
+class Subspace {
+    WTF_MAKE_NONCOPYABLE(Subspace);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JS_EXPORT_PRIVATE Subspace(CString name, Heap&, AllocatorAttributes);
+    JS_EXPORT_PRIVATE virtual ~Subspace();
+    
+    const char *name() const { return m_name.data(); }
+    MarkedSpace& space() const { return m_space; }
+    
+    const AllocatorAttributes& attributes() const { return m_attributes; }
+    
+    // The purpose of overriding this is to specialize the sweep for your destructors. This won't
+    // be called for no-destructor blocks. This must call MarkedBlock::finishSweepKnowingSubspace.
+    virtual FreeList finishSweep(MarkedBlock::Handle&, MarkedBlock::Handle::SweepMode);
+    
+    // These get called for large objects.
+    virtual void destroy(VM&, JSCell*);
+    
+    MarkedAllocator* tryAllocatorFor(size_t);
+    MarkedAllocator* allocatorFor(size_t);
+    
+    JS_EXPORT_PRIVATE void* allocate(size_t);
+    JS_EXPORT_PRIVATE void* allocate(GCDeferralContext*, size_t);
+    
+    JS_EXPORT_PRIVATE void* tryAllocate(size_t);
+    JS_EXPORT_PRIVATE void* tryAllocate(GCDeferralContext*, size_t);
+    
+    template<typename Func>
+    void forEachMarkedBlock(const Func&);
+    
+    template<typename Func>
+    void forEachNotEmptyMarkedBlock(const Func&);
+    
+    template<typename Func>
+    void forEachLargeAllocation(const Func&);
+    
+    template<typename Func>
+    void forEachMarkedCell(const Func&);
+    
+    static ptrdiff_t offsetOfAllocatorForSizeStep() { return OBJECT_OFFSETOF(Subspace, m_allocatorForSizeStep); }
+    
+    MarkedAllocator** allocatorForSizeStep() { return &m_allocatorForSizeStep[0]; }
+
+private:
+    MarkedAllocator* allocatorForSlow(size_t);
+    
+    // These slow paths are concerned with large allocations and allocator creation.
+    void* allocateSlow(GCDeferralContext*, size_t);
+    void* tryAllocateSlow(GCDeferralContext*, size_t);
+    
+    MarkedSpace& m_space;
+    
+    CString m_name;
+    AllocatorAttributes m_attributes;
+    
+    std::array<MarkedAllocator*, MarkedSpace::numSizeClasses> m_allocatorForSizeStep;
+    MarkedAllocator* m_firstAllocator { nullptr };
+    SentinelLinkedList<LargeAllocation, BasicRawSentinelNode<LargeAllocation>> m_largeAllocations;
+};
+
+ALWAYS_INLINE MarkedAllocator* Subspace::tryAllocatorFor(size_t size)
+{
+    if (size <= MarkedSpace::largeCutoff)
+        return m_allocatorForSizeStep[MarkedSpace::sizeClassToIndex(size)];
+    return nullptr;
+}
+
+ALWAYS_INLINE MarkedAllocator* Subspace::allocatorFor(size_t size)
+{
+    if (size <= MarkedSpace::largeCutoff) {
+        if (MarkedAllocator* result = m_allocatorForSizeStep[MarkedSpace::sizeClassToIndex(size)])
+            return result;
+        return allocatorForSlow(size);
+    }
+    return nullptr;
+}
+
+} // namespace JSC
+
diff --git a/heap/SubspaceInlines.h b/heap/SubspaceInlines.h
new file mode 100644
index 0000000..b6851c3
--- /dev/null
+++ b/heap/SubspaceInlines.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "MarkedAllocator.h"
+#include "MarkedBlock.h"
+#include "MarkedSpace.h"
+#include "Subspace.h"
+
+namespace JSC {
+
+template<typename Func>
+void Subspace::forEachMarkedBlock(const Func& func)
+{
+    for (MarkedAllocator* allocator = m_firstAllocator; allocator; allocator = allocator->nextAllocatorInSubspace())
+        allocator->forEachBlock(func);
+}
+
+template<typename Func>
+void Subspace::forEachNotEmptyMarkedBlock(const Func& func)
+{
+    for (MarkedAllocator* allocator = m_firstAllocator; allocator; allocator = allocator->nextAllocatorInSubspace())
+        allocator->forEachNotEmptyBlock(func);
+}
+
+template<typename Func>
+void Subspace::forEachLargeAllocation(const Func& func)
+{
+    for (LargeAllocation* allocation = m_largeAllocations.begin(); allocation != m_largeAllocations.end(); allocation = allocation->next())
+        func(allocation);
+}
+
+template<typename Func>
+void Subspace::forEachMarkedCell(const Func& func)
+{
+    forEachNotEmptyMarkedBlock(
+        [&] (MarkedBlock::Handle* handle) {
+            handle->forEachMarkedCell(
+                [&] (HeapCell* cell, HeapCell::Kind kind) -> IterationStatus { 
+                    func(cell, kind);
+                    return IterationStatus::Continue;
+                });
+        });
+    forEachLargeAllocation(
+        [&] (LargeAllocation* allocation) {
+            if (allocation->isMarked())
+                func(allocation->cell(), m_attributes.cellKind);
+        });
+}
+
+} // namespace JSC
+
diff --git a/heap/SynchronousStopTheWorldMutatorScheduler.cpp b/heap/SynchronousStopTheWorldMutatorScheduler.cpp
new file mode 100644
index 0000000..7ac95ad
--- /dev/null
+++ b/heap/SynchronousStopTheWorldMutatorScheduler.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SynchronousStopTheWorldMutatorScheduler.h"
+
+namespace JSC {
+
+SynchronousStopTheWorldMutatorScheduler::SynchronousStopTheWorldMutatorScheduler()
+{
+}
+
+SynchronousStopTheWorldMutatorScheduler::~SynchronousStopTheWorldMutatorScheduler()
+{
+}
+
+MutatorScheduler::State SynchronousStopTheWorldMutatorScheduler::state() const
+{
+    return m_state;
+}
+
+void SynchronousStopTheWorldMutatorScheduler::beginCollection()
+{
+    RELEASE_ASSERT(m_state == Normal);
+    m_state = Stopped;
+}
+
+MonotonicTime SynchronousStopTheWorldMutatorScheduler::timeToStop()
+{
+    return m_state == Normal ? MonotonicTime::infinity() : MonotonicTime::now();
+}
+
+MonotonicTime SynchronousStopTheWorldMutatorScheduler::timeToResume()
+{
+    return m_state == Normal ? MonotonicTime::now() : MonotonicTime::infinity();
+}
+
+void SynchronousStopTheWorldMutatorScheduler::endCollection()
+{
+    RELEASE_ASSERT(m_state == Stopped);
+    m_state = Normal;
+}
+
+} // namespace JSC
+
diff --git a/heap/SynchronousStopTheWorldMutatorScheduler.h b/heap/SynchronousStopTheWorldMutatorScheduler.h
new file mode 100644
index 0000000..46af40d
--- /dev/null
+++ b/heap/SynchronousStopTheWorldMutatorScheduler.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MutatorScheduler.h"
+
+namespace JSC {
+
+// The JSC concurrent GC relies on stopping the world to stay ahead of the retreating wavefront.
+// It so happens that the same API can be reused to implement a non-concurrent GC mode, which we
+// use on platforms that don't support the GC's atomicity protocols. That means anything other
+// than X86-64 and ARM64. This scheduler is a drop-in replacement for the concurrent GC's
+// SpaceTimeMutatorScheduler. It tells the GC to never resume the world once the GC cycle begins.
+
+class SynchronousStopTheWorldMutatorScheduler : public MutatorScheduler {
+public:
+    SynchronousStopTheWorldMutatorScheduler();
+    ~SynchronousStopTheWorldMutatorScheduler();
+    
+    State state() const override;
+    
+    void beginCollection() override;
+    
+    MonotonicTime timeToStop() override;
+    MonotonicTime timeToResume() override;
+    
+    void endCollection() override;
+
+private:
+    State m_state { Normal };
+};
+
+} // namespace JSC
+
diff --git a/heap/TinyBloomFilter.h b/heap/TinyBloomFilter.h
new file mode 100644
index 0000000..3ad7715
--- /dev/null
+++ b/heap/TinyBloomFilter.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+typedef uintptr_t Bits;
+
+class TinyBloomFilter {
+public:
+    TinyBloomFilter();
+
+    void add(Bits);
+    void add(TinyBloomFilter&);
+    bool ruleOut(Bits) const; // True for 0.
+    void reset();
+
+private:
+    Bits m_bits;
+};
+
+inline TinyBloomFilter::TinyBloomFilter()
+    : m_bits(0)
+{
+}
+
+inline void TinyBloomFilter::add(Bits bits)
+{
+    m_bits |= bits;
+}
+
+inline void TinyBloomFilter::add(TinyBloomFilter& other)
+{
+    m_bits |= other.m_bits;
+}
+
+inline bool TinyBloomFilter::ruleOut(Bits bits) const
+{
+    if (!bits)
+        return true;
+
+    if ((bits & m_bits) != bits)
+        return true;
+
+    return false;
+}
+
+inline void TinyBloomFilter::reset()
+{
+    m_bits = 0;
+}
+
+} // namespace JSC
diff --git a/heap/UnconditionalFinalizer.h b/heap/UnconditionalFinalizer.h
new file mode 100644
index 0000000..10c0cc8
--- /dev/null
+++ b/heap/UnconditionalFinalizer.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ListableHandler.h"
+
+namespace JSC {
+
+// An unconditional finalizer is useful for caches that you would like to
+// destroy on each GC. This is currently used for the bytecode stream
+// associated with each CodeBlock.
+
+class UnconditionalFinalizer : public ListableHandler<UnconditionalFinalizer> {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    virtual void finalizeUnconditionally() = 0;
+
+protected:
+    virtual ~UnconditionalFinalizer() { }
+};
+
+} // namespace JSC
diff --git a/heap/VisitRaceKey.cpp b/heap/VisitRaceKey.cpp
new file mode 100644
index 0000000..28ee30b
--- /dev/null
+++ b/heap/VisitRaceKey.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "VisitRaceKey.h"
+
+namespace JSC {
+
+const char* VisitRaceKey::m_deletedValueRaceName = "deleted value";
+
+void VisitRaceKey::dump(PrintStream& out) const
+{
+    out.print(RawPointer(m_cell), "(", m_raceName, ")");
+}
+
+} // namespace JSC
+
+
diff --git a/heap/VisitRaceKey.h b/heap/VisitRaceKey.h
new file mode 100644
index 0000000..23187a9
--- /dev/null
+++ b/heap/VisitRaceKey.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/HashTable.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class JSCell;
+
+class VisitRaceKey {
+public:
+    VisitRaceKey() { }
+    
+    VisitRaceKey(JSCell* cell, const char* raceName)
+        : m_cell(cell)
+        , m_raceName(raceName)
+    {
+    }
+    
+    VisitRaceKey(WTF::HashTableDeletedValueType)
+        : m_raceName(m_deletedValueRaceName)
+    {
+    }
+    
+    bool operator==(const VisitRaceKey& other) const
+    {
+        return m_cell == other.m_cell
+            && m_raceName == other.m_raceName;
+    }
+    
+    bool operator!=(const VisitRaceKey& other) const
+    {
+        return !(*this == other);
+    }
+    
+    explicit operator bool() const
+    {
+        return *this != VisitRaceKey();
+    }
+    
+    void dump(PrintStream& out) const;
+    
+    JSCell* cell() const { return m_cell; }
+    const char* raceName() const { return m_raceName; }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return *this == VisitRaceKey(WTF::HashTableDeletedValue);
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::PtrHash<JSCell*>::hash(m_cell) ^ WTF::PtrHash<const char*>::hash(m_raceName);
+    }
+
+private:
+    static const char* m_deletedValueRaceName;
+    
+    JSCell* m_cell { nullptr };
+    const char* m_raceName { nullptr };
+};
+
+struct VisitRaceKeyHash {
+    static unsigned hash(const VisitRaceKey& key) { return key.hash(); }
+    static bool equal(const VisitRaceKey& a, const VisitRaceKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::VisitRaceKey> {
+    typedef JSC::VisitRaceKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::VisitRaceKey> : SimpleClassHashTraits<JSC::VisitRaceKey> { };
+
+} // namespace WTF
+
diff --git a/heap/VisitingTimeout.h b/heap/VisitingTimeout.h
new file mode 100644
index 0000000..f1ac861
--- /dev/null
+++ b/heap/VisitingTimeout.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "SlotVisitor.h"
+#include <wtf/MonotonicTime.h>
+
+namespace JSC {
+
+class VisitingTimeout {
+public:
+    VisitingTimeout()
+    {
+    }
+    
+    VisitingTimeout(SlotVisitor& visitor, bool didVisitSomething, MonotonicTime timeout)
+        : m_didVisitSomething(didVisitSomething)
+        , m_visitCountBefore(visitor.visitCount())
+        , m_timeout(timeout)
+    {
+    }
+    
+    size_t visitCount(SlotVisitor& visitor) const
+    {
+        return visitor.visitCount() - m_visitCountBefore;
+    }
+
+    bool didVisitSomething(SlotVisitor& visitor) const
+    {
+        return m_didVisitSomething || visitCount(visitor);
+    }
+    
+    bool shouldTimeOut(SlotVisitor& visitor) const
+    {
+        return didVisitSomething(visitor) && hasElapsed(m_timeout);
+    }
+    
+private:
+    bool m_didVisitSomething { false };
+    size_t m_visitCountBefore { 0 };
+    MonotonicTime m_timeout;
+};
+
+} // namespace JSC
+
diff --git a/heap/Weak.cpp b/heap/Weak.cpp
new file mode 100644
index 0000000..a30b7c0
--- /dev/null
+++ b/heap/Weak.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Weak.h"
+
+#include "JSCInlines.h"
+#include "WeakSetInlines.h"
+
+namespace JSC {
+
+void weakClearSlowCase(WeakImpl*& impl)
+{
+    ASSERT(impl);
+
+    WeakSet::deallocate(impl);
+    impl = 0;
+}
+
+} // namespace JSC
diff --git a/heap/Weak.h b/heap/Weak.h
new file mode 100644
index 0000000..2d7b38b
--- /dev/null
+++ b/heap/Weak.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2009, 2012, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSExportMacros.h"
+#include <cstddef>
+#include <wtf/HashTraits.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/VectorTraits.h>
+
+namespace JSC {
+
+class WeakImpl;
+class WeakHandleOwner;
+
+// This is a free function rather than a Weak<T> member function so we can put it in Weak.cpp.
+JS_EXPORT_PRIVATE void weakClearSlowCase(WeakImpl*&);
+
+template<typename T> class Weak {
+    WTF_MAKE_NONCOPYABLE(Weak);
+public:
+    Weak()
+        : m_impl(0)
+    {
+    }
+
+    Weak(std::nullptr_t)
+        : m_impl(0)
+    {
+    }
+
+    inline Weak(T*, WeakHandleOwner* = 0, void* context = 0);
+
+    enum HashTableDeletedValueTag { HashTableDeletedValue };
+    inline bool isHashTableDeletedValue() const;
+    inline Weak(HashTableDeletedValueTag);
+
+    inline Weak(Weak&&);
+
+    ~Weak()
+    {
+        clear();
+    }
+
+    inline void swap(Weak&);
+
+    inline Weak& operator=(Weak&&);
+
+    inline bool operator!() const;
+    inline T* operator->() const;
+    inline T& operator*() const;
+    inline T* get() const;
+
+    inline bool was(T*) const;
+
+    inline explicit operator bool() const;
+
+    inline WeakImpl* leakImpl() WARN_UNUSED_RETURN;
+    void clear()
+    {
+        if (!m_impl)
+            return;
+        weakClearSlowCase(m_impl);
+    }
+    
+private:
+    static inline WeakImpl* hashTableDeletedValue();
+
+    WeakImpl* m_impl;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct VectorTraits<JSC::Weak<T>> : SimpleClassVectorTraits {
+    static const bool canCompareWithMemcmp = false;
+};
+
+template<typename T> struct HashTraits<JSC::Weak<T>> : SimpleClassHashTraits<JSC::Weak<T>> {
+    typedef JSC::Weak<T> StorageType;
+
+    typedef std::nullptr_t EmptyValueType;
+    static EmptyValueType emptyValue() { return nullptr; }
+
+    typedef T* PeekType;
+    static PeekType peek(const StorageType& value) { return value.get(); }
+    static PeekType peek(EmptyValueType) { return PeekType(); }
+};
+
+} // namespace WTF
diff --git a/heap/WeakBlock.cpp b/heap/WeakBlock.cpp
new file mode 100644
index 0000000..0ac3180
--- /dev/null
+++ b/heap/WeakBlock.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WeakBlock.h"
+
+#include "CellContainerInlines.h"
+#include "Heap.h"
+#include "JSCInlines.h"
+#include "JSObject.h"
+#include "WeakHandleOwner.h"
+
+namespace JSC {
+
+WeakBlock* WeakBlock::create(Heap& heap, CellContainer container)
+{
+    heap.didAllocateBlock(WeakBlock::blockSize);
+    return new (NotNull, fastMalloc(blockSize)) WeakBlock(container);
+}
+
+void WeakBlock::destroy(Heap& heap, WeakBlock* block)
+{
+    block->~WeakBlock();
+    fastFree(block);
+    heap.didFreeBlock(WeakBlock::blockSize);
+}
+
+WeakBlock::WeakBlock(CellContainer container)
+    : DoublyLinkedListNode<WeakBlock>()
+    , m_container(container)
+{
+    for (size_t i = 0; i < weakImplCount(); ++i) {
+        WeakImpl* weakImpl = &weakImpls()[i];
+        new (NotNull, weakImpl) WeakImpl;
+        addToFreeList(&m_sweepResult.freeList, weakImpl);
+    }
+
+    ASSERT(isEmpty());
+}
+
+void WeakBlock::lastChanceToFinalize()
+{
+    for (size_t i = 0; i < weakImplCount(); ++i) {
+        WeakImpl* weakImpl = &weakImpls()[i];
+        if (weakImpl->state() >= WeakImpl::Finalized)
+            continue;
+        weakImpl->setState(WeakImpl::Dead);
+        finalize(weakImpl);
+    }
+}
+
+void WeakBlock::sweep()
+{
+    // If a block is completely empty, a sweep won't have any effect.
+    if (isEmpty())
+        return;
+
+    SweepResult sweepResult;
+    for (size_t i = 0; i < weakImplCount(); ++i) {
+        WeakImpl* weakImpl = &weakImpls()[i];
+        if (weakImpl->state() == WeakImpl::Dead)
+            finalize(weakImpl);
+        if (weakImpl->state() == WeakImpl::Deallocated)
+            addToFreeList(&sweepResult.freeList, weakImpl);
+        else {
+            sweepResult.blockIsFree = false;
+            if (weakImpl->state() == WeakImpl::Live)
+                sweepResult.blockIsLogicallyEmpty = false;
+        }
+    }
+
+    m_sweepResult = sweepResult;
+    ASSERT(!m_sweepResult.isNull());
+}
+
+template<typename ContainerType>
+void WeakBlock::specializedVisit(ContainerType& container, SlotVisitor& visitor)
+{
+    HeapVersion markingVersion = visitor.markingVersion();
+
+    size_t count = weakImplCount();
+    for (size_t i = 0; i < count; ++i) {
+        WeakImpl* weakImpl = &weakImpls()[i];
+        if (weakImpl->state() != WeakImpl::Live)
+            continue;
+
+        WeakHandleOwner* weakHandleOwner = weakImpl->weakHandleOwner();
+        if (!weakHandleOwner)
+            continue;
+
+        JSValue jsValue = weakImpl->jsValue();
+        if (container.isMarkedConcurrently(markingVersion, jsValue.asCell()))
+            continue;
+        
+        if (!weakHandleOwner->isReachableFromOpaqueRoots(Handle<Unknown>::wrapSlot(&const_cast<JSValue&>(jsValue)), weakImpl->context(), visitor))
+            continue;
+
+        visitor.appendUnbarriered(jsValue);
+    }
+}
+
+void WeakBlock::visit(SlotVisitor& visitor)
+{
+    // If a block is completely empty, a visit won't have any effect.
+    if (isEmpty())
+        return;
+
+    // If this WeakBlock doesn't belong to a CellContainer, we won't even be here.
+    ASSERT(m_container);
+    
+    if (m_container.isLargeAllocation())
+        specializedVisit(m_container.largeAllocation(), visitor);
+    else
+        specializedVisit(m_container.markedBlock(), visitor);
+}
+
+void WeakBlock::reap()
+{
+    // If a block is completely empty, a reaping won't have any effect.
+    if (isEmpty())
+        return;
+
+    // If this WeakBlock doesn't belong to a CellContainer, we won't even be here.
+    ASSERT(m_container);
+    
+    HeapVersion markingVersion = m_container.heap()->objectSpace().markingVersion();
+
+    for (size_t i = 0; i < weakImplCount(); ++i) {
+        WeakImpl* weakImpl = &weakImpls()[i];
+        if (weakImpl->state() > WeakImpl::Dead)
+            continue;
+
+        if (m_container.isMarked(markingVersion, weakImpl->jsValue().asCell())) {
+            ASSERT(weakImpl->state() == WeakImpl::Live);
+            continue;
+        }
+
+        weakImpl->setState(WeakImpl::Dead);
+    }
+}
+
+} // namespace JSC
diff --git a/heap/WeakBlock.h b/heap/WeakBlock.h
new file mode 100644
index 0000000..6d4ff07
--- /dev/null
+++ b/heap/WeakBlock.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CellContainer.h"
+#include "WeakImpl.h"
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class Heap;
+class SlotVisitor;
+
+class WeakBlock : public DoublyLinkedListNode<WeakBlock> {
+public:
+    friend class WTF::DoublyLinkedListNode<WeakBlock>;
+    static const size_t blockSize = 256; // 1/16 of MarkedBlock size
+
+    struct FreeCell {
+        FreeCell* next;
+    };
+
+    struct SweepResult {
+        bool isNull() const;
+
+        bool blockIsFree { true };
+        bool blockIsLogicallyEmpty { true };
+        FreeCell* freeList { nullptr };
+    };
+
+    static WeakBlock* create(Heap&, CellContainer);
+    static void destroy(Heap&, WeakBlock*);
+
+    static WeakImpl* asWeakImpl(FreeCell*);
+
+    bool isEmpty();
+    bool isLogicallyEmptyButNotFree() const;
+
+    void sweep();
+    SweepResult takeSweepResult();
+
+    void visit(SlotVisitor&);
+
+    void reap();
+
+    void lastChanceToFinalize();
+    void disconnectContainer() { m_container = CellContainer(); }
+
+private:
+    static FreeCell* asFreeCell(WeakImpl*);
+    
+    template<typename ContainerType>
+    void specializedVisit(ContainerType&, SlotVisitor&);
+
+    explicit WeakBlock(CellContainer);
+    void finalize(WeakImpl*);
+    WeakImpl* weakImpls();
+    size_t weakImplCount();
+    void addToFreeList(FreeCell**, WeakImpl*);
+
+    CellContainer m_container;
+    WeakBlock* m_prev;
+    WeakBlock* m_next;
+    SweepResult m_sweepResult;
+};
+
+inline bool WeakBlock::SweepResult::isNull() const
+{
+    return blockIsFree && !freeList; // This state is impossible, so we can use it to mean null.
+}
+
+inline WeakImpl* WeakBlock::asWeakImpl(FreeCell* freeCell)
+{
+    return reinterpret_cast_ptr<WeakImpl*>(freeCell);
+}
+
+inline WeakBlock::SweepResult WeakBlock::takeSweepResult()
+{
+    SweepResult tmp;
+    std::swap(tmp, m_sweepResult);
+    ASSERT(m_sweepResult.isNull());
+    return tmp;
+}
+
+inline WeakBlock::FreeCell* WeakBlock::asFreeCell(WeakImpl* weakImpl)
+{
+    return reinterpret_cast_ptr<FreeCell*>(weakImpl);
+}
+
+inline WeakImpl* WeakBlock::weakImpls()
+{
+    return reinterpret_cast_ptr<WeakImpl*>(this) + ((sizeof(WeakBlock) + sizeof(WeakImpl) - 1) / sizeof(WeakImpl));
+}
+
+inline size_t WeakBlock::weakImplCount()
+{
+    return (blockSize / sizeof(WeakImpl)) - ((sizeof(WeakBlock) + sizeof(WeakImpl) - 1) / sizeof(WeakImpl));
+}
+
+inline void WeakBlock::addToFreeList(FreeCell** freeList, WeakImpl* weakImpl)
+{
+    ASSERT(weakImpl->state() == WeakImpl::Deallocated);
+    FreeCell* freeCell = asFreeCell(weakImpl);
+    ASSERT(!*freeList || ((char*)*freeList > (char*)this && (char*)*freeList < (char*)this + blockSize));
+    ASSERT((char*)freeCell > (char*)this && (char*)freeCell < (char*)this + blockSize);
+    freeCell->next = *freeList;
+    *freeList = freeCell;
+}
+
+inline bool WeakBlock::isEmpty()
+{
+    return !m_sweepResult.isNull() && m_sweepResult.blockIsFree;
+}
+
+inline bool WeakBlock::isLogicallyEmptyButNotFree() const
+{
+    return !m_sweepResult.isNull() && !m_sweepResult.blockIsFree && m_sweepResult.blockIsLogicallyEmpty;
+}
+
+} // namespace JSC
diff --git a/heap/WeakHandleOwner.cpp b/heap/WeakHandleOwner.cpp
new file mode 100644
index 0000000..044518f
--- /dev/null
+++ b/heap/WeakHandleOwner.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WeakHandleOwner.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+class SlotVisitor;
+template<typename T> class Handle;
+
+WeakHandleOwner::~WeakHandleOwner()
+{
+}
+
+bool WeakHandleOwner::isReachableFromOpaqueRoots(Handle<Unknown>, void*, SlotVisitor&)
+{
+    return false;
+}
+
+void WeakHandleOwner::finalize(Handle<Unknown>, void*)
+{
+}
+
+} // namespace JSC
diff --git a/heap/WeakHandleOwner.h b/heap/WeakHandleOwner.h
new file mode 100644
index 0000000..219a9c5
--- /dev/null
+++ b/heap/WeakHandleOwner.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Handle.h"
+
+namespace JSC {
+
+class SlotVisitor;
+
+class JS_EXPORT_PRIVATE WeakHandleOwner {
+public:
+    virtual ~WeakHandleOwner();
+    virtual bool isReachableFromOpaqueRoots(Handle<Unknown>, void* context, SlotVisitor&);
+    virtual void finalize(Handle<Unknown>, void* context);
+};
+
+} // namespace JSC
diff --git a/heap/WeakImpl.h b/heap/WeakImpl.h
new file mode 100644
index 0000000..3f6ffbf
--- /dev/null
+++ b/heap/WeakImpl.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+class WeakHandleOwner;
+
+class WeakImpl {
+public:
+    enum State {
+        Live        = 0x0,
+        Dead        = 0x1,
+        Finalized   = 0x2,
+        Deallocated = 0x3
+    };
+
+    enum {
+        StateMask   = 0x3
+    };
+
+    WeakImpl();
+    WeakImpl(JSValue, WeakHandleOwner*, void* context);
+
+    State state();
+    void setState(State);
+
+    const JSValue& jsValue();
+    static ptrdiff_t offsetOfJSValue() { return OBJECT_OFFSETOF(WeakImpl, m_jsValue); }
+    WeakHandleOwner* weakHandleOwner();
+    static ptrdiff_t offsetOfWeakHandleOwner() { return OBJECT_OFFSETOF(WeakImpl, m_weakHandleOwner); }
+    void* context();
+
+    static WeakImpl* asWeakImpl(JSValue*);
+
+private:
+    const JSValue m_jsValue;
+    WeakHandleOwner* m_weakHandleOwner;
+    void* m_context;
+};
+
+inline WeakImpl::WeakImpl()
+    : m_weakHandleOwner(0)
+    , m_context(0)
+{
+    setState(Deallocated);
+}
+
+inline WeakImpl::WeakImpl(JSValue jsValue, WeakHandleOwner* weakHandleOwner, void* context)
+    : m_jsValue(jsValue)
+    , m_weakHandleOwner(weakHandleOwner)
+    , m_context(context)
+{
+    ASSERT(state() == Live);
+    ASSERT(m_jsValue && m_jsValue.isCell());
+}
+
+inline WeakImpl::State WeakImpl::state()
+{
+    return static_cast<State>(reinterpret_cast<uintptr_t>(m_weakHandleOwner) & StateMask);
+}
+
+inline void WeakImpl::setState(WeakImpl::State state)
+{
+    ASSERT(state >= this->state());
+    m_weakHandleOwner = reinterpret_cast<WeakHandleOwner*>((reinterpret_cast<uintptr_t>(m_weakHandleOwner) & ~StateMask) | state);
+}
+
+inline const JSValue& WeakImpl::jsValue()
+{
+    return m_jsValue;
+}
+
+inline WeakHandleOwner* WeakImpl::weakHandleOwner()
+{
+    return reinterpret_cast<WeakHandleOwner*>((reinterpret_cast<uintptr_t>(m_weakHandleOwner) & ~StateMask));
+}
+
+inline void* WeakImpl::context()
+{
+    return m_context;
+}
+
+inline WeakImpl* WeakImpl::asWeakImpl(JSValue* slot)
+{
+    return reinterpret_cast_ptr<WeakImpl*>(reinterpret_cast_ptr<char*>(slot) + OBJECT_OFFSETOF(WeakImpl, m_jsValue));
+}
+
+} // namespace JSC
diff --git a/heap/WeakInlines.h b/heap/WeakInlines.h
new file mode 100644
index 0000000..35a71e6
--- /dev/null
+++ b/heap/WeakInlines.h
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2009, 2012, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "WeakSetInlines.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+template<typename T> inline Weak<T>::Weak(T* cell, WeakHandleOwner* weakOwner, void* context)
+    : m_impl(cell ? WeakSet::allocate(cell, weakOwner, context) : 0)
+{
+}
+
+template<typename T> inline bool Weak<T>::isHashTableDeletedValue() const
+{
+    return m_impl == hashTableDeletedValue();
+}
+
+template<typename T> inline Weak<T>::Weak(typename Weak<T>::HashTableDeletedValueTag)
+    : m_impl(hashTableDeletedValue())
+{
+}
+
+template<typename T> inline Weak<T>::Weak(Weak&& other)
+    : m_impl(other.leakImpl())
+{
+}
+
+template<class T> inline void swap(Weak<T>& a, Weak<T>& b)
+{
+    a.swap(b);
+}
+
+template<typename T> inline void Weak<T>::swap(Weak& other)
+{
+    std::swap(m_impl, other.m_impl);
+}
+
+template<typename T> inline auto Weak<T>::operator=(Weak&& other) -> Weak&
+{
+    Weak weak = WTFMove(other);
+    swap(weak);
+    return *this;
+}
+
+template<typename T> inline T* Weak<T>::operator->() const
+{
+    ASSERT(m_impl && m_impl->state() == WeakImpl::Live);
+    return jsCast<T*>(m_impl->jsValue().asCell());
+}
+
+template<typename T> inline T& Weak<T>::operator*() const
+{
+    ASSERT(m_impl && m_impl->state() == WeakImpl::Live);
+    return *jsCast<T*>(m_impl->jsValue().asCell());
+}
+
+template<typename T> inline T* Weak<T>::get() const
+{
+    if (!m_impl || m_impl->state() != WeakImpl::Live)
+        return 0;
+    return jsCast<T*>(m_impl->jsValue().asCell());
+}
+
+template<typename T> inline bool Weak<T>::was(T* other) const
+{
+    return static_cast<T*>(m_impl->jsValue().asCell()) == other;
+}
+
+template<typename T> inline bool Weak<T>::operator!() const
+{
+    return !m_impl || !m_impl->jsValue() || m_impl->state() != WeakImpl::Live;
+}
+
+template<typename T> inline Weak<T>::operator bool() const
+{
+    return !!*this;
+}
+
+template<typename T> inline WeakImpl* Weak<T>::leakImpl()
+{
+    WeakImpl* impl = m_impl;
+    m_impl = nullptr;
+    return impl;
+}
+
+template<typename T> inline WeakImpl* Weak<T>::hashTableDeletedValue()
+{
+    return reinterpret_cast<WeakImpl*>(-1);
+}
+
+template <typename T> inline bool operator==(const Weak<T>& lhs, const Weak<T>& rhs)
+{
+    return lhs.get() == rhs.get();
+}
+
+// This function helps avoid modifying a weak table while holding an iterator into it. (Object allocation
+// can run a finalizer that modifies the table. We avoid that by requiring a pre-constructed object as our value.)
+template<typename Map, typename Key, typename Value> inline void weakAdd(Map& map, const Key& key, Value&& value)
+{
+    ASSERT(!map.get(key));
+    map.set(key, std::forward<Value>(value)); // The table may still have a zombie for value.
+}
+
+template<typename Map, typename Key, typename Value> inline void weakRemove(Map& map, const Key& key, Value value)
+{
+    typename Map::iterator it = map.find(key);
+    ASSERT_UNUSED(value, value);
+    ASSERT(it != map.end());
+    ASSERT(it->value.was(value));
+    ASSERT(!it->value);
+    map.remove(it);
+}
+
+template<typename T> inline void weakClear(Weak<T>& weak, T* cell)
+{
+    ASSERT_UNUSED(cell, cell);
+    ASSERT(weak.was(cell));
+    ASSERT(!weak);
+    weak.clear();
+}
+
+} // namespace JSC
diff --git a/heap/WeakReferenceHarvester.h b/heap/WeakReferenceHarvester.h
new file mode 100644
index 0000000..4807e06
--- /dev/null
+++ b/heap/WeakReferenceHarvester.h
@@ -0,0 +1,40 @@
+/*
+ *  Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "ListableHandler.h"
+
+namespace JSC {
+
+class SlotVisitor;
+
+class WeakReferenceHarvester : public ListableHandler<WeakReferenceHarvester> {
+public:
+    virtual void visitWeakReferences(SlotVisitor&) = 0;
+    
+protected:
+    WeakReferenceHarvester()
+    {
+    }
+    
+    virtual ~WeakReferenceHarvester() { }
+};
+
+} // namespace JSC
diff --git a/heap/WeakSet.cpp b/heap/WeakSet.cpp
new file mode 100644
index 0000000..faae02c
--- /dev/null
+++ b/heap/WeakSet.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WeakSet.h"
+
+#include "Heap.h"
+#include "JSCInlines.h"
+#include "VM.h"
+
+namespace JSC {
+
+WeakSet::~WeakSet()
+{
+    if (isOnList())
+        remove();
+    
+    Heap& heap = *this->heap();
+    WeakBlock* next = 0;
+    for (WeakBlock* block = m_blocks.head(); block; block = next) {
+        next = block->next();
+        WeakBlock::destroy(heap, block);
+    }
+    m_blocks.clear();
+}
+
+void WeakSet::sweep()
+{
+    for (WeakBlock* block = m_blocks.head(); block;) {
+        heap()->sweepNextLogicallyEmptyWeakBlock();
+
+        WeakBlock* nextBlock = block->next();
+        block->sweep();
+        if (block->isLogicallyEmptyButNotFree()) {
+            // If this WeakBlock is logically empty, but still has Weaks pointing into it,
+            // we can't destroy it just yet. Detach it from the WeakSet and hand ownership
+            // to the Heap so we don't pin down the entire MarkedBlock or LargeAllocation.
+            m_blocks.remove(block);
+            heap()->addLogicallyEmptyWeakBlock(block);
+            block->disconnectContainer();
+        }
+        block = nextBlock;
+    }
+
+    resetAllocator();
+}
+
+void WeakSet::shrink()
+{
+    WeakBlock* next;
+    for (WeakBlock* block = m_blocks.head(); block; block = next) {
+        next = block->next();
+
+        if (block->isEmpty())
+            removeAllocator(block);
+    }
+
+    resetAllocator();
+    
+    if (m_blocks.isEmpty() && isOnList())
+        remove();
+}
+
+WeakBlock::FreeCell* WeakSet::findAllocator()
+{
+    if (WeakBlock::FreeCell* allocator = tryFindAllocator())
+        return allocator;
+
+    return addAllocator();
+}
+
+WeakBlock::FreeCell* WeakSet::tryFindAllocator()
+{
+    while (m_nextAllocator) {
+        WeakBlock* block = m_nextAllocator;
+        m_nextAllocator = m_nextAllocator->next();
+
+        WeakBlock::SweepResult sweepResult = block->takeSweepResult();
+        if (sweepResult.freeList)
+            return sweepResult.freeList;
+    }
+
+    return 0;
+}
+
+WeakBlock::FreeCell* WeakSet::addAllocator()
+{
+    if (!isOnList())
+        heap()->objectSpace().addActiveWeakSet(this);
+    
+    WeakBlock* block = WeakBlock::create(*heap(), m_container);
+    heap()->didAllocate(WeakBlock::blockSize);
+    m_blocks.append(block);
+    WeakBlock::SweepResult sweepResult = block->takeSweepResult();
+    ASSERT(!sweepResult.isNull() && sweepResult.freeList);
+    return sweepResult.freeList;
+}
+
+void WeakSet::removeAllocator(WeakBlock* block)
+{
+    m_blocks.remove(block);
+    WeakBlock::destroy(*heap(), block);
+}
+
+} // namespace JSC
diff --git a/heap/WeakSet.h b/heap/WeakSet.h
new file mode 100644
index 0000000..ddcf743
--- /dev/null
+++ b/heap/WeakSet.h
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CellContainer.h"
+#include "WeakBlock.h"
+#include <wtf/SentinelLinkedList.h>
+
+namespace JSC {
+
+class Heap;
+class WeakImpl;
+
+class WeakSet : public BasicRawSentinelNode<WeakSet> {
+    friend class LLIntOffsetsExtractor;
+
+public:
+    static WeakImpl* allocate(JSValue, WeakHandleOwner* = 0, void* context = 0);
+    static void deallocate(WeakImpl*);
+
+    WeakSet(VM*, CellContainer);
+    ~WeakSet();
+    void lastChanceToFinalize();
+    
+    CellContainer container() const { return m_container; }
+    void setContainer(CellContainer container) { m_container = container; }
+
+    Heap* heap() const;
+    VM* vm() const;
+
+    bool isEmpty() const;
+
+    void visit(SlotVisitor&);
+
+    void reap();
+    void sweep();
+    void shrink();
+    void resetAllocator();
+
+private:
+    JS_EXPORT_PRIVATE WeakBlock::FreeCell* findAllocator();
+    WeakBlock::FreeCell* tryFindAllocator();
+    WeakBlock::FreeCell* addAllocator();
+    void removeAllocator(WeakBlock*);
+
+    WeakBlock::FreeCell* m_allocator;
+    WeakBlock* m_nextAllocator;
+    DoublyLinkedList<WeakBlock> m_blocks;
+    VM* m_vm;
+    CellContainer m_container;
+};
+
+inline WeakSet::WeakSet(VM* vm, CellContainer container)
+    : m_allocator(0)
+    , m_nextAllocator(0)
+    , m_vm(vm)
+    , m_container(container)
+{
+}
+
+inline VM* WeakSet::vm() const
+{
+    return m_vm;
+}
+
+inline bool WeakSet::isEmpty() const
+{
+    for (WeakBlock* block = m_blocks.head(); block; block = block->next()) {
+        if (!block->isEmpty())
+            return false;
+    }
+
+    return true;
+}
+
+inline void WeakSet::deallocate(WeakImpl* weakImpl)
+{
+    weakImpl->setState(WeakImpl::Deallocated);
+}
+
+inline void WeakSet::lastChanceToFinalize()
+{
+    for (WeakBlock* block = m_blocks.head(); block; block = block->next())
+        block->lastChanceToFinalize();
+}
+
+inline void WeakSet::visit(SlotVisitor& visitor)
+{
+    for (WeakBlock* block = m_blocks.head(); block; block = block->next())
+        block->visit(visitor);
+}
+
+inline void WeakSet::reap()
+{
+    for (WeakBlock* block = m_blocks.head(); block; block = block->next())
+        block->reap();
+}
+
+inline void WeakSet::resetAllocator()
+{
+    m_allocator = 0;
+    m_nextAllocator = m_blocks.head();
+}
+
+} // namespace JSC
diff --git a/heap/WeakSetInlines.h b/heap/WeakSetInlines.h
new file mode 100644
index 0000000..360e1f9
--- /dev/null
+++ b/heap/WeakSetInlines.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CellContainerInlines.h"
+#include "MarkedBlock.h"
+
+namespace JSC {
+
+inline WeakImpl* WeakSet::allocate(JSValue jsValue, WeakHandleOwner* weakHandleOwner, void* context)
+{
+    WeakSet& weakSet = jsValue.asCell()->cellContainer().weakSet();
+    WeakBlock::FreeCell* allocator = weakSet.m_allocator;
+    if (UNLIKELY(!allocator))
+        allocator = weakSet.findAllocator();
+    weakSet.m_allocator = allocator->next;
+
+    WeakImpl* weakImpl = WeakBlock::asWeakImpl(allocator);
+    return new (NotNull, weakImpl) WeakImpl(jsValue, weakHandleOwner, context);
+}
+
+inline void WeakBlock::finalize(WeakImpl* weakImpl)
+{
+    ASSERT(weakImpl->state() == WeakImpl::Dead);
+    weakImpl->setState(WeakImpl::Finalized);
+    WeakHandleOwner* weakHandleOwner = weakImpl->weakHandleOwner();
+    if (!weakHandleOwner)
+        return;
+    weakHandleOwner->finalize(Handle<Unknown>::wrapSlot(&const_cast<JSValue&>(weakImpl->jsValue())), weakImpl->context());
+}
+
+} // namespace JSC
diff --git a/heap/WriteBarrierSupport.cpp b/heap/WriteBarrierSupport.cpp
new file mode 100644
index 0000000..984f004
--- /dev/null
+++ b/heap/WriteBarrierSupport.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WriteBarrierSupport.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+#if ENABLE(WRITE_BARRIER_PROFILING)
+GlobalSamplingCounter WriteBarrierCounters::usesWithBarrierFromCpp;
+GlobalSamplingCounter WriteBarrierCounters::usesWithoutBarrierFromCpp;
+GlobalSamplingCounter WriteBarrierCounters::usesWithBarrierFromJit;
+GlobalSamplingCounter WriteBarrierCounters::usesForPropertiesFromJit;
+GlobalSamplingCounter WriteBarrierCounters::usesForVariablesFromJit;
+GlobalSamplingCounter WriteBarrierCounters::usesWithoutBarrierFromJit;
+
+void WriteBarrierCounters::initialize()
+{
+    usesWithBarrierFromCpp.name("WithBarrierFromCpp");
+    usesWithoutBarrierFromCpp.name("WithoutBarrierFromCpp");
+    usesWithBarrierFromJit.name("WithBarrierFromJit");
+    usesForPropertiesFromJit.name("WriteForPropertiesFromJit");
+    usesForVariablesFromJit.name("WriteForVariablesFromJit");
+    usesWithoutBarrierFromJit.name("WithoutBarrierFromJit");
+}
+#else
+char WriteBarrierCounters::usesWithBarrierFromCpp;
+char WriteBarrierCounters::usesWithoutBarrierFromCpp;
+#endif
+
+} // namespace JSC
+
diff --git a/heap/WriteBarrierSupport.h b/heap/WriteBarrierSupport.h
new file mode 100644
index 0000000..570bba2
--- /dev/null
+++ b/heap/WriteBarrierSupport.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "SamplingCounter.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+// This allows the JIT to distinguish between uses of the barrier for different
+// kinds of writes. This is used by the JIT for profiling, and may be appropriate
+// for allowing the GC implementation to specialize the JIT's write barrier code
+// for different kinds of target objects.
+enum WriteBarrierUseKind {
+    // This allows specialization for access to the property storage (either
+    // array element or property), but not for any other kind of property
+    // accesses (such as writes that are a consequence of setter execution).
+    WriteBarrierForPropertyAccess,
+    
+    // This allows specialization for variable accesses (such as global or
+    // scoped variables).
+    WriteBarrierForVariableAccess,
+    
+    // This captures all other forms of write barriers. It should always be
+    // correct to use a generic access write barrier, even when storing to
+    // properties. Hence, if optimization is not necessary, it is preferable
+    // to just use a generic access.
+    WriteBarrierForGenericAccess
+};
+
+class WriteBarrierCounters {
+private:
+    WriteBarrierCounters() { }
+
+public:
+#if ENABLE(WRITE_BARRIER_PROFILING)
+    static GlobalSamplingCounter usesWithBarrierFromCpp;
+    static GlobalSamplingCounter usesWithoutBarrierFromCpp;
+    static GlobalSamplingCounter usesWithBarrierFromJit;
+    static GlobalSamplingCounter usesForPropertiesFromJit;
+    static GlobalSamplingCounter usesForVariablesFromJit;
+    static GlobalSamplingCounter usesWithoutBarrierFromJit;
+    
+    static void initialize();
+    
+    static GlobalSamplingCounter& jitCounterFor(WriteBarrierUseKind useKind)
+    {
+        switch (useKind) {
+        case WriteBarrierForPropertyAccess:
+            return usesForPropertiesFromJit;
+        case WriteBarrierForVariableAccess:
+            return usesForVariablesFromJit;
+        default:
+            ASSERT(useKind == WriteBarrierForGenericAccess);
+            return usesWithBarrierFromJit;
+        }
+    }
+#else
+    // These are necessary to work around not having conditional exports.
+    JS_EXPORTDATA static char usesWithBarrierFromCpp;
+    JS_EXPORTDATA static char usesWithoutBarrierFromCpp;
+#endif // ENABLE(WRITE_BARRIER_PROFILING)
+
+    static void countWriteBarrier()
+    {
+#if ENABLE(WRITE_BARRIER_PROFILING)
+        WriteBarrierCounters::usesWithBarrierFromCpp.count();
+#endif
+    }
+};
+
+} // namespace JSC
diff --git a/icu/LICENSE b/icu/LICENSE
new file mode 100644
index 0000000..385d130
--- /dev/null
+++ b/icu/LICENSE
@@ -0,0 +1,25 @@
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright (c) 1995-2006 International Business Machines Corporation and others
+
+All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this
+software and associated documentation files (the "Software"), to deal in the Software
+without restriction, including without limitation the rights to use, copy, modify,
+merge, publish, distribute, and/or sell copies of the Software, and to permit persons
+to whom the Software is furnished to do so, provided that the above copyright notice(s)
+and this permission notice appear in all copies of the Software and that both the above
+copyright notice(s) and this permission notice appear in supporting documentation.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER
+OR HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR
+CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall not be used in
+advertising or otherwise to promote the sale, use or other dealings in this Software
+without prior written authorization of the copyright holder.
diff --git a/icu/README b/icu/README
new file mode 100644
index 0000000..389e2e8
--- /dev/null
+++ b/icu/README
@@ -0,0 +1,4 @@
+The headers in this directory are for compiling on Mac OS X 10.4.
+The Mac OS X 10.4 release includes the ICU binary, but not ICU headers.
+For other platforms, installed ICU headers should be used rather than these.
+They are specific to Mac OS X 10.4.
diff --git a/icu/unicode/localpointer.h b/icu/unicode/localpointer.h
new file mode 100644
index 0000000..e3ccb25
--- /dev/null
+++ b/icu/unicode/localpointer.h
@@ -0,0 +1,304 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 2009-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  localpointer.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 2009nov13
+*   created by: Markus W. Scherer
+*/
+
+#ifndef __LOCALPOINTER_H__
+#define __LOCALPOINTER_H__
+
+/**
+ * \file 
+ * \brief C++ API: "Smart pointers" for use with and in ICU4C C++ code.
+ *
+ * These classes are inspired by
+ * - std::auto_ptr
+ * - boost::scoped_ptr & boost::scoped_array
+ * - Taligent Safe Pointers (TOnlyPointerTo)
+ *
+ * but none of those provide for all of the goals for ICU smart pointers:
+ * - Smart pointer owns the object and releases it when it goes out of scope.
+ * - No transfer of ownership via copy/assignment to reduce misuse. Simpler & more robust.
+ * - ICU-compatible: No exceptions.
+ * - Need to be able to orphan/release the pointer and its ownership.
+ * - Need variants for normal C++ object pointers, C++ arrays, and ICU C service objects.
+ *
+ * For details see http://site.icu-project.org/design/cpp/scoped_ptr
+ */
+
+#include "unicode/utypes.h"
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * "Smart pointer" base class; do not use directly: use LocalPointer etc.
+ *
+ * Base class for smart pointer classes that do not throw exceptions.
+ *
+ * Do not use this base class directly, since it does not delete its pointer.
+ * A subclass must implement methods that delete the pointer:
+ * Destructor and adoptInstead().
+ *
+ * There is no operator T *() provided because the programmer must decide
+ * whether to use getAlias() (without transfer of ownership) or orpan()
+ * (with transfer of ownership and NULLing of the pointer).
+ *
+ * @see LocalPointer
+ * @see LocalArray
+ * @see U_DEFINE_LOCAL_OPEN_POINTER
+ * @stable ICU 4.4
+ */
+template<typename T>
+class LocalPointerBase {
+public:
+    /**
+     * Constructor takes ownership.
+     * @param p simple pointer to an object that is adopted
+     * @stable ICU 4.4
+     */
+    explicit LocalPointerBase(T *p=NULL) : ptr(p) {}
+    /**
+     * Destructor deletes the object it owns.
+     * Subclass must override: Base class does nothing.
+     * @stable ICU 4.4
+     */
+    ~LocalPointerBase() { /* delete ptr; */ }
+    /**
+     * NULL check.
+     * @return TRUE if ==NULL
+     * @stable ICU 4.4
+     */
+    UBool isNull() const { return ptr==NULL; }
+    /**
+     * NULL check.
+     * @return TRUE if !=NULL
+     * @stable ICU 4.4
+     */
+    UBool isValid() const { return ptr!=NULL; }
+    /**
+     * Comparison with a simple pointer, so that existing code
+     * with ==NULL need not be changed.
+     * @param other simple pointer for comparison
+     * @return true if this pointer value equals other
+     * @stable ICU 4.4
+     */
+    bool operator==(const T *other) const { return ptr==other; }
+    /**
+     * Comparison with a simple pointer, so that existing code
+     * with !=NULL need not be changed.
+     * @param other simple pointer for comparison
+     * @return true if this pointer value differs from other
+     * @stable ICU 4.4
+     */
+    bool operator!=(const T *other) const { return ptr!=other; }
+    /**
+     * Access without ownership change.
+     * @return the pointer value
+     * @stable ICU 4.4
+     */
+    T *getAlias() const { return ptr; }
+    /**
+     * Access without ownership change.
+     * @return the pointer value as a reference
+     * @stable ICU 4.4
+     */
+    T &operator*() const { return *ptr; }
+    /**
+     * Access without ownership change.
+     * @return the pointer value
+     * @stable ICU 4.4
+     */
+    T *operator->() const { return ptr; }
+    /**
+     * Gives up ownership; the internal pointer becomes NULL.
+     * @return the pointer value;
+     *         caller becomes responsible for deleting the object
+     * @stable ICU 4.4
+     */
+    T *orphan() {
+        T *p=ptr;
+        ptr=NULL;
+        return p;
+    }
+    /**
+     * Deletes the object it owns,
+     * and adopts (takes ownership of) the one passed in.
+     * Subclass must override: Base class does not delete the object.
+     * @param p simple pointer to an object that is adopted
+     * @stable ICU 4.4
+     */
+    void adoptInstead(T *p) {
+        // delete ptr;
+        ptr=p;
+    }
+protected:
+    /**
+     * Actual pointer.
+     * @internal
+     */
+    T *ptr;
+private:
+    // No comparison operators with other LocalPointerBases.
+    bool operator==(const LocalPointerBase &other);
+    bool operator!=(const LocalPointerBase &other);
+    // No ownership transfer: No copy constructor, no assignment operator.
+    LocalPointerBase(const LocalPointerBase &other);
+    void operator=(const LocalPointerBase &other);
+    // No heap allocation. Use only on the stack.
+    static void * U_EXPORT2 operator new(size_t size);
+    static void * U_EXPORT2 operator new[](size_t size);
+#if U_HAVE_PLACEMENT_NEW
+    static void * U_EXPORT2 operator new(size_t, void *ptr);
+#endif
+};
+
+/**
+ * "Smart pointer" class, deletes objects via the standard C++ delete operator.
+ * For most methods see the LocalPointerBase base class.
+ *
+ * Usage example:
+ * \code
+ * LocalPointer<UnicodeString> s(new UnicodeString((UChar32)0x50005));
+ * int32_t length=s->length();  // 2
+ * UChar lead=s->charAt(0);  // 0xd900
+ * if(some condition) { return; }  // no need to explicitly delete the pointer
+ * s.adoptInstead(new UnicodeString((UChar)0xfffc));
+ * length=s->length();  // 1
+ * // no need to explicitly delete the pointer
+ * \endcode
+ *
+ * @see LocalPointerBase
+ * @stable ICU 4.4
+ */
+template<typename T>
+class LocalPointer : public LocalPointerBase<T> {
+public:
+    /**
+     * Constructor takes ownership.
+     * @param p simple pointer to an object that is adopted
+     * @stable ICU 4.4
+     */
+    explicit LocalPointer(T *p=NULL) : LocalPointerBase<T>(p) {}
+    /**
+     * Destructor deletes the object it owns.
+     * @stable ICU 4.4
+     */
+    ~LocalPointer() {
+        delete LocalPointerBase<T>::ptr;
+    }
+    /**
+     * Deletes the object it owns,
+     * and adopts (takes ownership of) the one passed in.
+     * @param p simple pointer to an object that is adopted
+     * @stable ICU 4.4
+     */
+    void adoptInstead(T *p) {
+        delete LocalPointerBase<T>::ptr;
+        LocalPointerBase<T>::ptr=p;
+    }
+};
+
+/**
+ * "Smart pointer" class, deletes objects via the C++ array delete[] operator.
+ * For most methods see the LocalPointerBase base class.
+ * Adds operator[] for array item access.
+ *
+ * Usage example:
+ * \code
+ * LocalArray<UnicodeString> a(new UnicodeString[2]);
+ * a[0].append((UChar)0x61);
+ * if(some condition) { return; }  // no need to explicitly delete the array
+ * a.adoptInstead(new UnicodeString[4]);
+ * a[3].append((UChar)0x62).append((UChar)0x63).reverse();
+ * // no need to explicitly delete the array
+ * \endcode
+ *
+ * @see LocalPointerBase
+ * @stable ICU 4.4
+ */
+template<typename T>
+class LocalArray : public LocalPointerBase<T> {
+public:
+    /**
+     * Constructor takes ownership.
+     * @param p simple pointer to an array of T objects that is adopted
+     * @stable ICU 4.4
+     */
+    explicit LocalArray(T *p=NULL) : LocalPointerBase<T>(p) {}
+    /**
+     * Destructor deletes the array it owns.
+     * @stable ICU 4.4
+     */
+    ~LocalArray() {
+        delete[] LocalPointerBase<T>::ptr;
+    }
+    /**
+     * Deletes the array it owns,
+     * and adopts (takes ownership of) the one passed in.
+     * @param p simple pointer to an array of T objects that is adopted
+     * @stable ICU 4.4
+     */
+    void adoptInstead(T *p) {
+        delete[] LocalPointerBase<T>::ptr;
+        LocalPointerBase<T>::ptr=p;
+    }
+    /**
+     * Array item access (writable).
+     * No index bounds check.
+     * @param i array index
+     * @return reference to the array item
+     * @stable ICU 4.4
+     */
+    T &operator[](ptrdiff_t i) const { return LocalPointerBase<T>::ptr[i]; }
+};
+
+/**
+ * \def U_DEFINE_LOCAL_OPEN_POINTER
+ * "Smart pointer" definition macro, deletes objects via the closeFunction.
+ * Defines a subclass of LocalPointerBase which works just
+ * like LocalPointer<Type> except that this subclass will use the closeFunction
+ * rather than the C++ delete operator.
+ *
+ * Requirement: The closeFunction must tolerate a NULL pointer.
+ * (We could add a NULL check here but it is normally redundant.)
+ *
+ * Usage example:
+ * \code
+ * LocalUCaseMapPointer csm(ucasemap_open(localeID, options, &errorCode));
+ * utf8OutLength=ucasemap_utf8ToLower(csm.getAlias(),
+ *     utf8Out, (int32_t)sizeof(utf8Out),
+ *     utf8In, utf8InLength, &errorCode);
+ * if(U_FAILURE(errorCode)) { return; }  // no need to explicitly delete the UCaseMap
+ * \endcode
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+#define U_DEFINE_LOCAL_OPEN_POINTER(LocalPointerClassName, Type, closeFunction) \
+    class LocalPointerClassName : public LocalPointerBase<Type> { \
+    public: \
+        explicit LocalPointerClassName(Type *p=NULL) : LocalPointerBase<Type>(p) {} \
+        ~LocalPointerClassName() { closeFunction(ptr); } \
+        void adoptInstead(Type *p) { \
+            closeFunction(ptr); \
+            ptr=p; \
+        } \
+    }
+
+U_NAMESPACE_END
+
+#endif  /* U_SHOW_CPLUSPLUS_API */
+#endif  /* __LOCALPOINTER_H__ */
diff --git a/icu/unicode/parseerr.h b/icu/unicode/parseerr.h
new file mode 100644
index 0000000..44ff008
--- /dev/null
+++ b/icu/unicode/parseerr.h
@@ -0,0 +1,92 @@
+/*
+**********************************************************************
+*   Copyright (C) 1999-2005, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+*   Date        Name        Description
+*   03/14/00    aliu        Creation.
+*   06/27/00    aliu        Change from C++ class to C struct
+**********************************************************************
+*/
+#ifndef PARSEERR_H
+#define PARSEERR_H
+
+#include "unicode/utypes.h"
+
+
+/**
+ * \file
+ * \brief C API: Parse Error Information
+ */
+/**
+ * The capacity of the context strings in UParseError.
+ * @stable ICU 2.0
+ */ 
+enum { U_PARSE_CONTEXT_LEN = 16 };
+
+/**
+ * A UParseError struct is used to returned detailed information about
+ * parsing errors.  It is used by ICU parsing engines that parse long
+ * rules, patterns, or programs, where the text being parsed is long
+ * enough that more information than a UErrorCode is needed to
+ * localize the error.
+ *
+ * <p>The line, offset, and context fields are optional; parsing
+ * engines may choose not to use to use them.
+ *
+ * <p>The preContext and postContext strings include some part of the
+ * context surrounding the error.  If the source text is "let for=7"
+ * and "for" is the error (e.g., because it is a reserved word), then
+ * some examples of what a parser might produce are the following:
+ *
+ * <pre>
+ * preContext   postContext
+ * ""           ""            The parser does not support context
+ * "let "       "=7"          Pre- and post-context only
+ * "let "       "for=7"       Pre- and post-context and error text
+ * ""           "for"         Error text only
+ * </pre>
+ *
+ * <p>Examples of engines which use UParseError (or may use it in the
+ * future) are Transliterator, RuleBasedBreakIterator, and
+ * RegexPattern.
+ * 
+ * @stable ICU 2.0
+ */
+typedef struct UParseError {
+
+    /**
+     * The line on which the error occured.  If the parser uses this
+     * field, it sets it to the line number of the source text line on
+     * which the error appears, which will be be a value >= 1.  If the
+     * parse does not support line numbers, the value will be <= 0.
+     * @stable ICU 2.0
+     */
+    int32_t        line;
+
+    /**
+     * The character offset to the error.  If the line field is >= 1,
+     * then this is the offset from the start of the line.  Otherwise,
+     * this is the offset from the start of the text.  If the parser
+     * does not support this field, it will have a value < 0.
+     * @stable ICU 2.0
+     */
+    int32_t        offset;
+
+    /**
+     * Textual context before the error.  Null-terminated.  The empty
+     * string if not supported by parser.
+     * @stable ICU 2.0   
+     */
+    UChar          preContext[U_PARSE_CONTEXT_LEN];
+
+    /**
+     * The error itself and/or textual context after the error.
+     * Null-terminated.  The empty string if not supported by parser.
+     * @stable ICU 2.0   
+     */
+    UChar          postContext[U_PARSE_CONTEXT_LEN];
+
+} UParseError;
+
+#endif
diff --git a/icu/unicode/platform.h b/icu/unicode/platform.h
new file mode 100644
index 0000000..1b2ab30
--- /dev/null
+++ b/icu/unicode/platform.h
@@ -0,0 +1,755 @@
+/*
+******************************************************************************
+*
+*   Copyright (C) 1997-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+******************************************************************************
+*
+*  FILE NAME : platform.h
+*
+*   Date        Name        Description
+*   05/13/98    nos         Creation (content moved here from ptypes.h).
+*   03/02/99    stephen     Added AS400 support.
+*   03/30/99    stephen     Added Linux support.
+*   04/13/99    stephen     Reworked for autoconf.
+******************************************************************************
+*/
+
+#ifndef _PLATFORM_H
+#define _PLATFORM_H
+
+#include "unicode/uconfig.h"
+#include "unicode/uvernum.h"
+
+/**
+ * \file
+ * \brief Basic types for the platform.
+ *
+ * This file used to be generated by autoconf/configure.
+ * Starting with ICU 49, platform.h is a normal source file,
+ * to simplify cross-compiling and working with non-autoconf/make build systems.
+ *
+ * When a value in this file does not work on a platform, then please
+ * try to derive it from the U_PLATFORM value
+ * (for which we might need a new value constant in rare cases)
+ * and/or from other macros that are predefined by the compiler
+ * or defined in standard (POSIX or platform or compiler) headers.
+ *
+ * As a temporary workaround, you can add an explicit <code>#define</code> for some macros
+ * before it is first tested, or add an equivalent -D macro definition
+ * to the compiler's command line.
+ *
+ * Note: Some compilers provide ways to show the predefined macros.
+ * For example, with gcc you can compile an empty .c file and have the compiler
+ * print the predefined macros with
+ * \code
+ * gcc -E -dM -x c /dev/null | sort
+ * \endcode
+ * (You can provide an actual empty .c file rather than /dev/null.
+ * <code>-x c++</code> is for C++.)
+ */
+
+/**
+ * Define some things so that they can be documented.
+ * @internal
+ */
+#ifdef U_IN_DOXYGEN
+/*
+ * Problem: "platform.h:335: warning: documentation for unknown define U_HAVE_STD_STRING found." means that U_HAVE_STD_STRING is not documented.
+ * Solution: #define any defines for non @internal API here, so that they are visible in the docs.  If you just set PREDEFINED in Doxyfile.in,  they won't be documented.
+ */
+
+/* None for now. */
+#endif
+
+/**
+ * \def U_PLATFORM
+ * The U_PLATFORM macro defines the platform we're on.
+ *
+ * We used to define one different, value-less macro per platform.
+ * That made it hard to know the set of relevant platforms and macros,
+ * and hard to deal with variants of platforms.
+ *
+ * Starting with ICU 49, we define platforms as numeric macros,
+ * with ranges of values for related platforms and their variants.
+ * The U_PLATFORM macro is set to one of these values.
+ *
+ * Historical note from the Solaris Wikipedia article:
+ * AT&T and Sun collaborated on a project to merge the most popular Unix variants
+ * on the market at that time: BSD, System V, and Xenix.
+ * This became Unix System V Release 4 (SVR4).
+ *
+ * @internal
+ */
+
+/** Unknown platform. @internal */
+#define U_PF_UNKNOWN 0
+/** Windows @internal */
+#define U_PF_WINDOWS 1000
+/** MinGW. Windows, calls to Win32 API, but using GNU gcc and binutils. @internal */
+#define U_PF_MINGW 1800
+/**
+ * Cygwin. Windows, calls to cygwin1.dll for Posix functions,
+ * using MSVC or GNU gcc and binutils.
+ * @internal
+ */
+#define U_PF_CYGWIN 1900
+/* Reserve 2000 for U_PF_UNIX? */
+/** HP-UX is based on UNIX System V. @internal */
+#define U_PF_HPUX 2100
+/** Solaris is a Unix operating system based on SVR4. @internal */
+#define U_PF_SOLARIS 2600
+/** BSD is a UNIX operating system derivative. @internal */
+#define U_PF_BSD 3000
+/** AIX is based on UNIX System V Releases and 4.3 BSD. @internal */
+#define U_PF_AIX 3100
+/** IRIX is based on UNIX System V with BSD extensions. @internal */
+#define U_PF_IRIX 3200
+/**
+ * Darwin is a POSIX-compliant operating system, composed of code developed by Apple,
+ * as well as code derived from NeXTSTEP, BSD, and other projects,
+ * built around the Mach kernel.
+ * Darwin forms the core set of components upon which Mac OS X, Apple TV, and iOS are based.
+ * (Original description modified from WikiPedia.)
+ * @internal
+ */
+#define U_PF_DARWIN 3500
+/** iPhone OS (iOS) is a derivative of Mac OS X. @internal */
+#define U_PF_IPHONE 3550
+/** QNX is a commercial Unix-like real-time operating system related to BSD. @internal */
+#define U_PF_QNX 3700
+/** Linux is a Unix-like operating system. @internal */
+#define U_PF_LINUX 4000
+/** Android is based on Linux. @internal */
+#define U_PF_ANDROID 4050
+/** "Classic" Mac OS (1984-2001) @internal */
+#define U_PF_CLASSIC_MACOS 8000
+/** z/OS is the successor to OS/390 which was the successor to MVS. @internal */
+#define U_PF_OS390 9000
+/** "IBM i" is the current name of what used to be i5/OS and earlier OS/400. @internal */
+#define U_PF_OS400 9400
+
+#ifdef U_PLATFORM
+    /* Use the predefined value. */
+#elif defined(__MINGW32__)
+#   define U_PLATFORM U_PF_MINGW
+#elif defined(__CYGWIN__)
+#   define U_PLATFORM U_PF_CYGWIN
+#elif defined(WIN32) || defined(_WIN32) || defined(WIN64) || defined(_WIN64)
+#   define U_PLATFORM U_PF_WINDOWS
+#elif defined(__ANDROID__)
+#   define U_PLATFORM U_PF_ANDROID
+    /* Android wchar_t support depends on the API level. */
+#   include <android/api-level.h>
+#elif defined(linux) || defined(__linux__) || defined(__linux)
+#   define U_PLATFORM U_PF_LINUX
+#elif defined(__APPLE__) && defined(__MACH__)
+#   include <TargetConditionals.h>
+#   if defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE  /* variant of TARGET_OS_MAC */
+#       define U_PLATFORM U_PF_IPHONE
+#   else
+#       define U_PLATFORM U_PF_DARWIN
+#   endif
+#elif defined(BSD) || defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__MirBSD__)
+#   define U_PLATFORM U_PF_BSD
+#elif defined(sun) || defined(__sun)
+    /* Check defined(__SVR4) || defined(__svr4__) to distinguish Solaris from SunOS? */
+#   define U_PLATFORM U_PF_SOLARIS
+#   if defined(__GNUC__)
+        /* Solaris/GCC needs this header file to get the proper endianness. Normally, this
+         * header file is included with stddef.h but on Solairs/GCC, the GCC version of stddef.h
+         *  is included which does not include this header file.
+         */
+#       include <sys/isa_defs.h>
+#   endif
+#elif defined(_AIX) || defined(__TOS_AIX__)
+#   define U_PLATFORM U_PF_AIX
+#elif defined(_hpux) || defined(hpux) || defined(__hpux)
+#   define U_PLATFORM U_PF_HPUX
+#elif defined(sgi) || defined(__sgi)
+#   define U_PLATFORM U_PF_IRIX
+#elif defined(macintosh)
+#   define U_PLATFORM U_PF_CLASSIC_MACOS
+#elif defined(__QNX__) || defined(__QNXNTO__)
+#   define U_PLATFORM U_PF_QNX
+#elif defined(__TOS_MVS__)
+#   define U_PLATFORM U_PF_OS390
+#elif defined(__OS400__) || defined(__TOS_OS400__)
+#   define U_PLATFORM U_PF_OS400
+#else
+#   define U_PLATFORM U_PF_UNKNOWN
+#endif
+
+/**
+ * \def CYGWINMSVC
+ * Defined if this is Windows with Cygwin, but using MSVC rather than gcc.
+ * Otherwise undefined.
+ * @internal
+ */
+/* Commented out because this is already set in mh-cygwin-msvc
+#if U_PLATFORM == U_PF_CYGWIN && defined(_MSC_VER)
+#   define CYGWINMSVC
+#endif
+*/
+
+/**
+ * \def U_PLATFORM_USES_ONLY_WIN32_API
+ * Defines whether the platform uses only the Win32 API.
+ * Set to 1 for Windows/MSVC and MinGW but not Cygwin.
+ * @internal
+ */
+#ifdef U_PLATFORM_USES_ONLY_WIN32_API
+    /* Use the predefined value. */
+#elif (U_PF_WINDOWS <= U_PLATFORM && U_PLATFORM <= U_PF_MINGW) || defined(CYGWINMSVC)
+#   define U_PLATFORM_USES_ONLY_WIN32_API 1
+#else
+    /* Cygwin implements POSIX. */
+#   define U_PLATFORM_USES_ONLY_WIN32_API 0
+#endif
+
+/**
+ * \def U_PLATFORM_HAS_WIN32_API
+ * Defines whether the Win32 API is available on the platform.
+ * Set to 1 for Windows/MSVC, MinGW and Cygwin.
+ * @internal
+ */
+#ifdef U_PLATFORM_HAS_WIN32_API
+    /* Use the predefined value. */
+#elif U_PF_WINDOWS <= U_PLATFORM && U_PLATFORM <= U_PF_CYGWIN
+#   define U_PLATFORM_HAS_WIN32_API 1
+#else
+#   define U_PLATFORM_HAS_WIN32_API 0
+#endif
+
+/**
+ * \def U_PLATFORM_IMPLEMENTS_POSIX
+ * Defines whether the platform implements (most of) the POSIX API.
+ * Set to 1 for Cygwin and most other platforms.
+ * @internal
+ */
+#ifdef U_PLATFORM_IMPLEMENTS_POSIX
+    /* Use the predefined value. */
+#elif U_PLATFORM_USES_ONLY_WIN32_API || U_PLATFORM == U_PF_CLASSIC_MACOS
+#   define U_PLATFORM_IMPLEMENTS_POSIX 0
+#else
+#   define U_PLATFORM_IMPLEMENTS_POSIX 1
+#endif
+
+/**
+ * \def U_PLATFORM_IS_LINUX_BASED
+ * Defines whether the platform is Linux or one of its derivatives.
+ * @internal
+ */
+#ifdef U_PLATFORM_IS_LINUX_BASED
+    /* Use the predefined value. */
+#elif U_PF_LINUX <= U_PLATFORM && U_PLATFORM <= U_PF_ANDROID
+#   define U_PLATFORM_IS_LINUX_BASED 1
+#else
+#   define U_PLATFORM_IS_LINUX_BASED 0
+#endif
+
+/**
+ * \def U_PLATFORM_IS_DARWIN_BASED
+ * Defines whether the platform is Darwin or one of its derivatives.
+ * @internal
+ */
+#ifdef U_PLATFORM_IS_DARWIN_BASED
+    /* Use the predefined value. */
+#elif U_PF_DARWIN <= U_PLATFORM && U_PLATFORM <= U_PF_IPHONE
+#   define U_PLATFORM_IS_DARWIN_BASED 1
+#else
+#   define U_PLATFORM_IS_DARWIN_BASED 0
+#endif
+
+/**
+ * \def U_HAVE_STDINT_H
+ * Defines whether stdint.h is available. It is a C99 standard header.
+ * We used to include inttypes.h which includes stdint.h but we usually do not need
+ * the additional definitions from inttypes.h.
+ * @internal
+ */
+#ifdef U_HAVE_STDINT_H
+    /* Use the predefined value. */
+#elif U_PLATFORM_USES_ONLY_WIN32_API
+#   if defined(__BORLANDC__) || U_PLATFORM == U_PF_MINGW || (defined(_MSC_VER) && _MSC_VER>=1600)
+        /* Windows Visual Studio 9 and below do not have stdint.h & inttypes.h, but VS 2010 adds them. */
+#       define U_HAVE_STDINT_H 1
+#   else
+#       define U_HAVE_STDINT_H 0
+#   endif
+#elif U_PLATFORM == U_PF_SOLARIS
+    /* Solaris has inttypes.h but not stdint.h. */
+#   define U_HAVE_STDINT_H 0
+#elif U_PLATFORM == U_PF_AIX && !defined(_AIX51) && defined(_POWER)
+    /* PPC AIX <= 4.3 has inttypes.h but not stdint.h. */
+#   define U_HAVE_STDINT_H 0
+#else
+#   define U_HAVE_STDINT_H 1
+#endif
+
+/**
+ * \def U_HAVE_INTTYPES_H
+ * Defines whether inttypes.h is available. It is a C99 standard header.
+ * We include inttypes.h where it is available but stdint.h is not.
+ * @internal
+ */
+#ifdef U_HAVE_INTTYPES_H
+    /* Use the predefined value. */
+#elif U_PLATFORM == U_PF_SOLARIS
+    /* Solaris has inttypes.h but not stdint.h. */
+#   define U_HAVE_INTTYPES_H 1
+#elif U_PLATFORM == U_PF_AIX && !defined(_AIX51) && defined(_POWER)
+    /* PPC AIX <= 4.3 has inttypes.h but not stdint.h. */
+#   define U_HAVE_INTTYPES_H 1
+#else
+    /* Most platforms have both inttypes.h and stdint.h, or neither. */
+#   define U_HAVE_INTTYPES_H U_HAVE_STDINT_H
+#endif
+
+/**
+ * \def U_IOSTREAM_SOURCE
+ * Defines what support for C++ streams is available.
+ *
+ * If U_IOSTREAM_SOURCE is set to 199711, then &lt;iostream&gt; is available
+ * (the ISO/IEC C++ FDIS was published in November 1997), and then
+ * one should qualify streams using the std namespace in ICU header
+ * files.
+ * Starting with ICU 49, this is the only supported version.
+ *
+ * If U_IOSTREAM_SOURCE is set to 198506, then &lt;iostream.h&gt; is
+ * available instead (in June 1985 Stroustrup published
+ * "An Extensible I/O Facility for C++" at the summer USENIX conference).
+ * Starting with ICU 49, this version is not supported any more.
+ *
+ * If U_IOSTREAM_SOURCE is 0 (or any value less than 199711),
+ * then C++ streams are not available and
+ * support for them will be silently suppressed in ICU.
+ *
+ * @internal
+ */
+#ifndef U_IOSTREAM_SOURCE
+#define U_IOSTREAM_SOURCE 199711
+#endif
+
+/**
+ * \def U_HAVE_STD_STRING
+ * Defines whether the standard C++ (STL) &lt;string&gt; header is available.
+ * @internal
+ */
+#ifdef U_HAVE_STD_STRING
+    /* Use the predefined value. */
+#else
+#   define U_HAVE_STD_STRING 1
+#endif
+
+/*===========================================================================*/
+/** @{ Compiler and environment features                                     */
+/*===========================================================================*/
+
+/**
+ * \def U_GCC_MAJOR_MINOR
+ * Indicates whether the compiler is gcc (test for != 0),
+ * and if so, contains its major (times 100) and minor version numbers.
+ * If the compiler is not gcc, then U_GCC_MAJOR_MINOR == 0.
+ *
+ * For example, for testing for whether we have gcc, and whether it's 4.6 or higher,
+ * use "#if U_GCC_MAJOR_MINOR >= 406".
+ * @internal
+ */
+#ifdef __GNUC__
+#   define U_GCC_MAJOR_MINOR (__GNUC__ * 100 + __GNUC_MINOR__)
+#else
+#   define U_GCC_MAJOR_MINOR 0
+#endif
+
+/**
+ * \def U_IS_BIG_ENDIAN
+ * Determines the endianness of the platform.
+ * @internal
+ */
+#ifdef U_IS_BIG_ENDIAN
+    /* Use the predefined value. */
+#elif defined(BYTE_ORDER) && defined(BIG_ENDIAN)
+#   define U_IS_BIG_ENDIAN (BYTE_ORDER == BIG_ENDIAN)
+#elif defined(__BYTE_ORDER__) && defined(__ORDER_BIG_ENDIAN__)
+    /* gcc */
+#   define U_IS_BIG_ENDIAN (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)
+#elif defined(__BIG_ENDIAN__) || defined(_BIG_ENDIAN)
+#   define U_IS_BIG_ENDIAN 1
+#elif defined(__LITTLE_ENDIAN__) || defined(_LITTLE_ENDIAN)
+#   define U_IS_BIG_ENDIAN 0
+#elif U_PLATFORM == U_PF_OS390 || U_PLATFORM == U_PF_OS400 || defined(__s390__) || defined(__s390x__)
+    /* These platforms do not appear to predefine any endianness macros. */
+#   define U_IS_BIG_ENDIAN 1
+#elif defined(_PA_RISC1_0) || defined(_PA_RISC1_1) || defined(_PA_RISC2_0)
+    /* HPPA do not appear to predefine any endianness macros. */
+#   define U_IS_BIG_ENDIAN 1
+#elif defined(sparc) || defined(__sparc) || defined(__sparc__)
+    /* Some sparc based systems (e.g. Linux) do not predefine any endianness macros. */
+#   define U_IS_BIG_ENDIAN 1
+#else
+#   define U_IS_BIG_ENDIAN 0
+#endif
+
+/**
+ * \def U_HAVE_PLACEMENT_NEW
+ * Determines whether to override placement new and delete for STL.
+ * @stable ICU 2.6
+ */
+#ifdef U_HAVE_PLACEMENT_NEW
+    /* Use the predefined value. */
+#elif defined(__BORLANDC__)
+#   define U_HAVE_PLACEMENT_NEW 0
+#else
+#   define U_HAVE_PLACEMENT_NEW 1
+#endif
+
+/**
+ * \def U_HAVE_DEBUG_LOCATION_NEW 
+ * Define this to define the MFC debug version of the operator new.
+ *
+ * @stable ICU 3.4
+ */
+#ifdef U_HAVE_DEBUG_LOCATION_NEW
+    /* Use the predefined value. */
+#elif defined(_MSC_VER)
+#   define U_HAVE_DEBUG_LOCATION_NEW 1
+#else
+#   define U_HAVE_DEBUG_LOCATION_NEW 0
+#endif
+
+/* Compatibility with non clang compilers */
+#ifndef __has_attribute
+#    define __has_attribute(x) 0
+#endif
+
+/**
+ * \def U_MALLOC_ATTR
+ * Attribute to mark functions as malloc-like
+ * @internal
+ */
+#if defined(__GNUC__) && __GNUC__>=3
+#    define U_MALLOC_ATTR __attribute__ ((__malloc__))
+#else
+#    define U_MALLOC_ATTR
+#endif
+
+/**
+ * \def U_ALLOC_SIZE_ATTR
+ * Attribute to specify the size of the allocated buffer for malloc-like functions
+ * @internal
+ */
+#if (defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 3))) || __has_attribute(alloc_size)
+#   define U_ALLOC_SIZE_ATTR(X) __attribute__ ((alloc_size(X)))
+#   define U_ALLOC_SIZE_ATTR2(X,Y) __attribute__ ((alloc_size(X,Y)))
+#else
+#   define U_ALLOC_SIZE_ATTR(X)
+#   define U_ALLOC_SIZE_ATTR2(X,Y)
+#endif
+
+/** @} */
+
+/*===========================================================================*/
+/** @{ Character data types                                                  */
+/*===========================================================================*/
+
+/**
+ * U_CHARSET_FAMILY is equal to this value when the platform is an ASCII based platform.
+ * @stable ICU 2.0
+ */
+#define U_ASCII_FAMILY 0
+
+/**
+ * U_CHARSET_FAMILY is equal to this value when the platform is an EBCDIC based platform.
+ * @stable ICU 2.0
+ */
+#define U_EBCDIC_FAMILY 1
+
+/**
+ * \def U_CHARSET_FAMILY
+ *
+ * <p>These definitions allow to specify the encoding of text
+ * in the char data type as defined by the platform and the compiler.
+ * It is enough to determine the code point values of "invariant characters",
+ * which are the ones shared by all encodings that are in use
+ * on a given platform.</p>
+ *
+ * <p>Those "invariant characters" should be all the uppercase and lowercase
+ * latin letters, the digits, the space, and "basic punctuation".
+ * Also, '\\n', '\\r', '\\t' should be available.</p>
+ *
+ * <p>The list of "invariant characters" is:<br>
+ * \code
+ *    A-Z  a-z  0-9  SPACE  "  %  &amp;  '  (  )  *  +  ,  -  .  /  :  ;  <  =  >  ?  _
+ * \endcode
+ * <br>
+ * (52 letters + 10 numbers + 20 punc/sym/space = 82 total)</p>
+ *
+ * <p>This matches the IBM Syntactic Character Set (CS 640).</p>
+ *
+ * <p>In other words, all the graphic characters in 7-bit ASCII should
+ * be safely accessible except the following:</p>
+ *
+ * \code
+ *    '\' <backslash>
+ *    '[' <left bracket>
+ *    ']' <right bracket>
+ *    '{' <left brace>
+ *    '}' <right brace>
+ *    '^' <circumflex>
+ *    '~' <tilde>
+ *    '!' <exclamation mark>
+ *    '#' <number sign>
+ *    '|' <vertical line>
+ *    '$' <dollar sign>
+ *    '@' <commercial at>
+ *    '`' <grave accent>
+ * \endcode
+ * @stable ICU 2.0
+ */
+#ifdef U_CHARSET_FAMILY
+    /* Use the predefined value. */
+#elif U_PLATFORM == U_PF_OS390 && (!defined(__CHARSET_LIB) || !__CHARSET_LIB)
+#   define U_CHARSET_FAMILY U_EBCDIC_FAMILY
+#elif U_PLATFORM == U_PF_OS400 && !defined(__UTF32__)
+#   define U_CHARSET_FAMILY U_EBCDIC_FAMILY
+#else
+#   define U_CHARSET_FAMILY U_ASCII_FAMILY
+#endif
+
+/**
+ * \def U_CHARSET_IS_UTF8
+ *
+ * Hardcode the default charset to UTF-8.
+ *
+ * If this is set to 1, then
+ * - ICU will assume that all non-invariant char*, StringPiece, std::string etc.
+ *   contain UTF-8 text, regardless of what the system API uses
+ * - some ICU code will use fast functions like u_strFromUTF8()
+ *   rather than the more general and more heavy-weight conversion API (ucnv.h)
+ * - ucnv_getDefaultName() always returns "UTF-8"
+ * - ucnv_setDefaultName() is disabled and will not change the default charset
+ * - static builds of ICU are smaller
+ * - more functionality is available with the UCONFIG_NO_CONVERSION build-time
+ *   configuration option (see unicode/uconfig.h)
+ * - the UCONFIG_NO_CONVERSION build option in uconfig.h is more usable
+ *
+ * @stable ICU 4.2
+ * @see UCONFIG_NO_CONVERSION
+ */
+#ifdef U_CHARSET_IS_UTF8
+    /* Use the predefined value. */
+#elif U_PLATFORM == U_PF_ANDROID || U_PLATFORM_IS_DARWIN_BASED
+#   define U_CHARSET_IS_UTF8 1
+#else
+#   define U_CHARSET_IS_UTF8 0
+#endif
+
+/** @} */
+
+/*===========================================================================*/
+/** @{ Information about wchar support                                       */
+/*===========================================================================*/
+
+/**
+ * \def U_HAVE_WCHAR_H
+ * Indicates whether <wchar.h> is available (1) or not (0). Set to 1 by default.
+ *
+ * @stable ICU 2.0
+ */
+#ifdef U_HAVE_WCHAR_H
+    /* Use the predefined value. */
+#elif U_PLATFORM == U_PF_ANDROID && __ANDROID_API__ < 9
+    /*
+     * Android before Gingerbread (Android 2.3, API level 9) did not support wchar_t.
+     * The type and header existed, but the library functions did not work as expected.
+     * The size of wchar_t was 1 but L"xyz" string literals had 32-bit units anyway.
+     */
+#   define U_HAVE_WCHAR_H 0
+#else
+#   define U_HAVE_WCHAR_H 1
+#endif
+
+/**
+ * \def U_SIZEOF_WCHAR_T
+ * U_SIZEOF_WCHAR_T==sizeof(wchar_t)
+ *
+ * @stable ICU 2.0
+ */
+#ifdef U_SIZEOF_WCHAR_T
+    /* Use the predefined value. */
+#elif (U_PLATFORM == U_PF_ANDROID && __ANDROID_API__ < 9) || U_PLATFORM == U_PF_CLASSIC_MACOS
+    /*
+     * Classic Mac OS and Mac OS X before 10.3 (Panther) did not support wchar_t or wstring.
+     * Newer Mac OS X has size 4.
+     */
+#   define U_SIZEOF_WCHAR_T 1
+#elif U_PLATFORM_HAS_WIN32_API || U_PLATFORM == U_PF_CYGWIN
+#   define U_SIZEOF_WCHAR_T 2
+#elif U_PLATFORM == U_PF_AIX
+    /*
+     * AIX 6.1 information, section "Wide character data representation":
+     * "... the wchar_t datatype is 32-bit in the 64-bit environment and
+     * 16-bit in the 32-bit environment."
+     * and
+     * "All locales use Unicode for their wide character code values (process code),
+     * except the IBM-eucTW codeset."
+     */
+#   ifdef __64BIT__
+#       define U_SIZEOF_WCHAR_T 4
+#   else
+#       define U_SIZEOF_WCHAR_T 2
+#   endif
+#elif U_PLATFORM == U_PF_OS390
+    /*
+     * z/OS V1R11 information center, section "LP64 | ILP32":
+     * "In 31-bit mode, the size of long and pointers is 4 bytes and the size of wchar_t is 2 bytes.
+     * Under LP64, the size of long and pointer is 8 bytes and the size of wchar_t is 4 bytes."
+     */
+#   ifdef _LP64
+#       define U_SIZEOF_WCHAR_T 4
+#   else
+#       define U_SIZEOF_WCHAR_T 2
+#   endif
+#elif U_PLATFORM == U_PF_OS400
+#   if defined(__UTF32__)
+        /*
+         * LOCALETYPE(*LOCALEUTF) is specified.
+         * Wide-character strings are in UTF-32,
+         * narrow-character strings are in UTF-8.
+         */
+#       define U_SIZEOF_WCHAR_T 4
+#   elif defined(__UCS2__)
+        /*
+         * LOCALETYPE(*LOCALEUCS2) is specified.
+         * Wide-character strings are in UCS-2,
+         * narrow-character strings are in EBCDIC.
+         */
+#       define U_SIZEOF_WCHAR_T 2
+#else
+        /*
+         * LOCALETYPE(*CLD) or LOCALETYPE(*LOCALE) is specified.
+         * Wide-character strings are in 16-bit EBCDIC,
+         * narrow-character strings are in EBCDIC.
+         */
+#       define U_SIZEOF_WCHAR_T 2
+#   endif
+#else
+#   define U_SIZEOF_WCHAR_T 4
+#endif
+
+#ifndef U_HAVE_WCSCPY
+#define U_HAVE_WCSCPY U_HAVE_WCHAR_H
+#endif
+
+/** @} */
+
+/**
+ * \def U_HAVE_CHAR16_T
+ * Defines whether the char16_t type is available for UTF-16
+ * and u"abc" UTF-16 string literals are supported.
+ * This is a new standard type and standard string literal syntax in C++0x
+ * but has been available in some compilers before.
+ * @internal
+ */
+#ifdef U_HAVE_CHAR16_T
+    /* Use the predefined value. */
+#else
+    /*
+     * Notes:
+     * Visual Studio 10 (_MSC_VER>=1600) defines char16_t but
+     * does not support u"abc" string literals.
+     * gcc 4.4 defines the __CHAR16_TYPE__ macro to a usable type but
+     * does not support u"abc" string literals.
+     * C++11 and C11 require support for UTF-16 literals
+     */
+#   if (defined(__cplusplus) && __cplusplus >= 201103L) || (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L)
+#       define U_HAVE_CHAR16_T 1
+#   else
+#       define U_HAVE_CHAR16_T 0
+#   endif
+#endif
+
+/**
+ * @{
+ * \def U_DECLARE_UTF16
+ * Do not use this macro because it is not defined on all platforms.
+ * Use the UNICODE_STRING or U_STRING_DECL macros instead.
+ * @internal
+ */
+#ifdef U_DECLARE_UTF16
+    /* Use the predefined value. */
+#elif U_HAVE_CHAR16_T \
+    || (defined(__xlC__) && defined(__IBM_UTF_LITERAL) && U_SIZEOF_WCHAR_T != 2) \
+    || (defined(__HP_aCC) && __HP_aCC >= 035000) \
+    || (defined(__HP_cc) && __HP_cc >= 111106)
+#   define U_DECLARE_UTF16(string) u ## string
+#elif U_SIZEOF_WCHAR_T == 2 \
+    && (U_CHARSET_FAMILY == 0 || (U_PF_OS390 <= U_PLATFORM && U_PLATFORM <= U_PF_OS400 && defined(__UCS2__)))
+#   define U_DECLARE_UTF16(string) L ## string
+#else
+    /* Leave U_DECLARE_UTF16 undefined. See unistr.h. */
+#endif
+
+/** @} */
+
+/*===========================================================================*/
+/** @{ Symbol import-export control                                          */
+/*===========================================================================*/
+
+#ifdef U_EXPORT
+    /* Use the predefined value. */
+#elif defined(U_STATIC_IMPLEMENTATION)
+#   define U_EXPORT
+#elif defined(__GNUC__)
+#   define U_EXPORT __attribute__((visibility("default")))
+#elif (defined(__SUNPRO_CC) && __SUNPRO_CC >= 0x550) \
+   || (defined(__SUNPRO_C) && __SUNPRO_C >= 0x550) 
+#   define U_EXPORT __global
+/*#elif defined(__HP_aCC) || defined(__HP_cc)
+#   define U_EXPORT __declspec(dllexport)*/
+#elif defined(_MSC_VER)
+#   define U_EXPORT __declspec(dllexport)
+#else
+#   define U_EXPORT
+#endif
+
+/* U_CALLCONV is releated to U_EXPORT2 */
+#ifdef U_EXPORT2
+    /* Use the predefined value. */
+#elif defined(_MSC_VER)
+#   define U_EXPORT2 __cdecl
+#else
+#   define U_EXPORT2
+#endif
+
+#ifdef U_IMPORT
+    /* Use the predefined value. */
+#elif defined(_MSC_VER)
+    /* Windows needs to export/import data. */
+#   define U_IMPORT __declspec(dllimport)
+#else
+#   define U_IMPORT 
+#endif
+
+/**
+ * \def U_CALLCONV
+ * Similar to U_CDECL_BEGIN/U_CDECL_END, this qualifier is necessary
+ * in callback function typedefs to make sure that the calling convention
+ * is compatible.
+ *
+ * This is only used for non-ICU-API functions.
+ * When a function is a public ICU API,
+ * you must use the U_CAPI and U_EXPORT2 qualifiers.
+ * @stable ICU 2.0
+ */
+#if U_PLATFORM == U_PF_OS390 && defined(__cplusplus)
+#    define U_CALLCONV __cdecl
+#else
+#    define U_CALLCONV U_EXPORT2
+#endif
+
+/* @} */
+
+#endif
diff --git a/icu/unicode/ptypes.h b/icu/unicode/ptypes.h
new file mode 100644
index 0000000..b7f7116
--- /dev/null
+++ b/icu/unicode/ptypes.h
@@ -0,0 +1,126 @@
+/*
+******************************************************************************
+*
+*   Copyright (C) 1997-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+******************************************************************************
+*
+*  FILE NAME : ptypes.h
+*
+*   Date        Name        Description
+*   05/13/98    nos         Creation (content moved here from ptypes.h).
+*   03/02/99    stephen     Added AS400 support.
+*   03/30/99    stephen     Added Linux support.
+*   04/13/99    stephen     Reworked for autoconf.
+*   09/18/08    srl         Moved basic types back to ptypes.h from platform.h
+******************************************************************************
+*/
+
+/**
+ * \file
+ * \brief C API: Definitions of integer types of various widths
+ */
+
+#ifndef _PTYPES_H
+#define _PTYPES_H
+
+/**
+ * \def __STDC_LIMIT_MACROS
+ * According to the Linux stdint.h, the ISO C99 standard specifies that in C++ implementations
+ * macros like INT32_MIN and UINTPTR_MAX should only be defined if explicitly requested.
+ * We need to define __STDC_LIMIT_MACROS before including stdint.h in C++ code
+ * that uses such limit macros.
+ * @internal
+ */
+#ifndef __STDC_LIMIT_MACROS
+#define __STDC_LIMIT_MACROS
+#endif
+
+/* NULL, size_t, wchar_t */
+#include <stddef.h>
+
+/*
+ * If all compilers provided all of the C99 headers and types,
+ * we would just unconditionally #include <stdint.h> here
+ * and not need any of the stuff after including platform.h.
+ */
+
+/* Find out if we have stdint.h etc. */
+#include "unicode/platform.h"
+
+/*===========================================================================*/
+/* Generic data types                                                        */
+/*===========================================================================*/
+
+/* If your platform does not have the <stdint.h> header, you may
+   need to edit the typedefs in the #else section below.
+   Use #if...#else...#endif with predefined compiler macros if possible. */
+#if U_HAVE_STDINT_H
+
+/*
+ * We mostly need <stdint.h> (which defines the standard integer types) but not <inttypes.h>.
+ * <inttypes.h> includes <stdint.h> and adds the printf/scanf helpers PRId32, SCNx16 etc.
+ * which we almost never use, plus stuff like imaxabs() which we never use.
+ */
+#include <stdint.h>
+
+#if U_PLATFORM == U_PF_OS390
+/* The features header is needed to get (u)int64_t sometimes. */
+#include <features.h>
+/* z/OS has <stdint.h>, but some versions are missing uint8_t (APAR PK62248). */
+#if !defined(__uint8_t)
+#define __uint8_t 1
+typedef unsigned char uint8_t;
+#endif
+#endif /* U_PLATFORM == U_PF_OS390 */
+
+#elif U_HAVE_INTTYPES_H
+
+#   include <inttypes.h>
+
+#else /* neither U_HAVE_STDINT_H nor U_HAVE_INTTYPES_H */
+
+#if ! U_HAVE_INT8_T
+typedef signed char int8_t;
+#endif
+
+#if ! U_HAVE_UINT8_T
+typedef unsigned char uint8_t;
+#endif
+
+#if ! U_HAVE_INT16_T
+typedef signed short int16_t;
+#endif
+
+#if ! U_HAVE_UINT16_T
+typedef unsigned short uint16_t;
+#endif
+
+#if ! U_HAVE_INT32_T
+typedef signed int int32_t;
+#endif
+
+#if ! U_HAVE_UINT32_T
+typedef unsigned int uint32_t;
+#endif
+
+#if ! U_HAVE_INT64_T
+#ifdef _MSC_VER
+    typedef signed __int64 int64_t;
+#else
+    typedef signed long long int64_t;
+#endif
+#endif
+
+#if ! U_HAVE_UINT64_T
+#ifdef _MSC_VER
+    typedef unsigned __int64 uint64_t;
+#else
+    typedef unsigned long long uint64_t;
+#endif
+#endif
+
+#endif /* U_HAVE_STDINT_H / U_HAVE_INTTYPES_H */
+
+#endif /* _PTYPES_H */
diff --git a/icu/unicode/putil.h b/icu/unicode/putil.h
new file mode 100644
index 0000000..6fc7e9c
--- /dev/null
+++ b/icu/unicode/putil.h
@@ -0,0 +1,164 @@
+/*
+******************************************************************************
+*
+*   Copyright (C) 1997-2011, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+******************************************************************************
+*
+*  FILE NAME : putil.h
+*
+*   Date        Name        Description
+*   05/14/98    nos         Creation (content moved here from utypes.h).
+*   06/17/99    erm         Added IEEE_754
+*   07/22/98    stephen     Added IEEEremainder, max, min, trunc
+*   08/13/98    stephen     Added isNegativeInfinity, isPositiveInfinity
+*   08/24/98    stephen     Added longBitsFromDouble
+*   03/02/99    stephen     Removed openFile().  Added AS400 support.
+*   04/15/99    stephen     Converted to C
+*   11/15/99    helena      Integrated S/390 changes for IEEE support.
+*   01/11/00    helena      Added u_getVersion.
+******************************************************************************
+*/
+
+#ifndef PUTIL_H
+#define PUTIL_H
+
+#include "unicode/utypes.h"
+ /**
+  * \file
+  * \brief C API: Platform Utilities
+  */
+
+/*==========================================================================*/
+/* Platform utilities                                                       */
+/*==========================================================================*/
+
+/**
+ * Platform utilities isolates the platform dependencies of the
+ * libarary.  For each platform which this code is ported to, these
+ * functions may have to be re-implemented.
+ */
+
+/**
+ * Return the ICU data directory. 
+ * The data directory is where common format ICU data files (.dat files)
+ *   are loaded from.  Note that normal use of the built-in ICU
+ *   facilities does not require loading of an external data file;
+ *   unless you are adding custom data to ICU, the data directory
+ *   does not need to be set.
+ *
+ * The data directory is determined as follows:
+ *    If u_setDataDirectory() has been called, that is it, otherwise
+ *    if the ICU_DATA environment variable is set, use that, otherwise
+ *    If a data directory was specifed at ICU build time
+ *      <code>
+ * \code
+ *        #define ICU_DATA_DIR "path" 
+ * \endcode
+ * </code> use that,
+ *    otherwise no data directory is available.
+ *
+ * @return the data directory, or an empty string ("") if no data directory has
+ *         been specified.
+ *   
+ * @stable ICU 2.0
+ */
+U_STABLE const char* U_EXPORT2 u_getDataDirectory(void);
+
+/** 
+ * Set the ICU data directory. 
+ * The data directory is where common format ICU data files (.dat files)
+ *   are loaded from.  Note that normal use of the built-in ICU
+ *   facilities does not require loading of an external data file;
+ *   unless you are adding custom data to ICU, the data directory
+ *   does not need to be set.
+ *
+ * This function should be called at most once in a process, before the
+ * first ICU operation (e.g., u_init()) that will require the loading of an
+ * ICU data file.
+ * This function is not thread-safe. Use it before calling ICU APIs from
+ * multiple threads.
+ *
+ * @param directory The directory to be set.
+ *
+ * @see u_init
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 u_setDataDirectory(const char *directory);
+
+/**
+ * @{
+ * Filesystem file and path separator characters.
+ * Example: '/' and ':' on Unix, '\\' and ';' on Windows.
+ * @stable ICU 2.0
+ */
+#if U_PLATFORM == U_PF_CLASSIC_MACOS
+#   define U_FILE_SEP_CHAR ':'
+#   define U_FILE_ALT_SEP_CHAR ':'
+#   define U_PATH_SEP_CHAR ';'
+#   define U_FILE_SEP_STRING ":"
+#   define U_FILE_ALT_SEP_STRING ":"
+#   define U_PATH_SEP_STRING ";"
+#elif U_PLATFORM_USES_ONLY_WIN32_API
+#   define U_FILE_SEP_CHAR '\\'
+#   define U_FILE_ALT_SEP_CHAR '/'
+#   define U_PATH_SEP_CHAR ';'
+#   define U_FILE_SEP_STRING "\\"
+#   define U_FILE_ALT_SEP_STRING "/"
+#   define U_PATH_SEP_STRING ";"
+#else
+#   define U_FILE_SEP_CHAR '/'
+#   define U_FILE_ALT_SEP_CHAR '/'
+#   define U_PATH_SEP_CHAR ':'
+#   define U_FILE_SEP_STRING "/"
+#   define U_FILE_ALT_SEP_STRING "/"
+#   define U_PATH_SEP_STRING ":"
+#endif
+
+/** @} */
+
+/**
+ * Convert char characters to UChar characters.
+ * This utility function is useful only for "invariant characters"
+ * that are encoded in the platform default encoding.
+ * They are a small, constant subset of the encoding and include
+ * just the latin letters, digits, and some punctuation.
+ * For details, see U_CHARSET_FAMILY.
+ *
+ * @param cs Input string, points to <code>length</code>
+ *           character bytes from a subset of the platform encoding.
+ * @param us Output string, points to memory for <code>length</code>
+ *           Unicode characters.
+ * @param length The number of characters to convert; this may
+ *               include the terminating <code>NUL</code>.
+ *
+ * @see U_CHARSET_FAMILY
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+u_charsToUChars(const char *cs, UChar *us, int32_t length);
+
+/**
+ * Convert UChar characters to char characters.
+ * This utility function is useful only for "invariant characters"
+ * that can be encoded in the platform default encoding.
+ * They are a small, constant subset of the encoding and include
+ * just the latin letters, digits, and some punctuation.
+ * For details, see U_CHARSET_FAMILY.
+ *
+ * @param us Input string, points to <code>length</code>
+ *           Unicode characters that can be encoded with the
+ *           codepage-invariant subset of the platform encoding.
+ * @param cs Output string, points to memory for <code>length</code>
+ *           character bytes.
+ * @param length The number of characters to convert; this may
+ *               include the terminating <code>NUL</code>.
+ *
+ * @see U_CHARSET_FAMILY
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+u_UCharsToChars(const UChar *us, char *cs, int32_t length);
+
+#endif
diff --git a/icu/unicode/ucal.h b/icu/unicode/ucal.h
new file mode 100644
index 0000000..8f0cccc
--- /dev/null
+++ b/icu/unicode/ucal.h
@@ -0,0 +1,1565 @@
+/*
+ *******************************************************************************
+ * Copyright (C) 1996-2013, International Business Machines Corporation and
+ * others. All Rights Reserved.
+ *******************************************************************************
+ */
+
+#ifndef UCAL_H
+#define UCAL_H
+
+#include "unicode/utypes.h"
+#include "unicode/uenum.h"
+#include "unicode/uloc.h"
+#include "unicode/localpointer.h"
+
+#if !UCONFIG_NO_FORMATTING
+
+/**
+ * \file
+ * \brief C API: Calendar
+ *
+ * <h2>Calendar C API</h2>
+ *
+ * UCalendar C API is used  for converting between a <code>UDate</code> object
+ * and a set of integer fields such as <code>UCAL_YEAR</code>, <code>UCAL_MONTH</code>,
+ * <code>UCAL_DAY</code>, <code>UCAL_HOUR</code>, and so on.
+ * (A <code>UDate</code> object represents a specific instant in
+ * time with millisecond precision. See UDate
+ * for information about the <code>UDate</code> .)
+ *
+ * <p>
+ * Types of <code>UCalendar</code> interpret a <code>UDate</code>
+ * according to the rules of a specific calendar system. The U_STABLE
+ * provides the enum UCalendarType with UCAL_TRADITIONAL and
+ * UCAL_GREGORIAN.
+ * <p>
+ * Like other locale-sensitive C API, calendar API  provides a
+ * function, <code>ucal_open()</code>, which returns a pointer to
+ * <code>UCalendar</code> whose time fields have been initialized
+ * with the current date and time. We need to specify the type of
+ * calendar to be opened and the  timezoneId.
+ * \htmlonly<blockquote>\endhtmlonly
+ * <pre>
+ * \code
+ * UCalendar *caldef;
+ * UChar *tzId;
+ * UErrorCode status;
+ * tzId=(UChar*)malloc(sizeof(UChar) * (strlen("PST") +1) );
+ * u_uastrcpy(tzId, "PST");
+ * caldef=ucal_open(tzID, u_strlen(tzID), NULL, UCAL_TRADITIONAL, &status);
+ * \endcode
+ * </pre>
+ * \htmlonly</blockquote>\endhtmlonly
+ *
+ * <p>
+ * A <code>UCalendar</code> object can produce all the time field values
+ * needed to implement the date-time formatting for a particular language
+ * and calendar style (for example, Japanese-Gregorian, Japanese-Traditional).
+ *
+ * <p>
+ * When computing a <code>UDate</code> from time fields, two special circumstances
+ * may arise: there may be insufficient information to compute the
+ * <code>UDate</code> (such as only year and month but no day in the month),
+ * or there may be inconsistent information (such as "Tuesday, July 15, 1996"
+ * -- July 15, 1996 is actually a Monday).
+ *
+ * <p>
+ * <strong>Insufficient information.</strong> The calendar will use default
+ * information to specify the missing fields. This may vary by calendar; for
+ * the Gregorian calendar, the default for a field is the same as that of the
+ * start of the epoch: i.e., UCAL_YEAR = 1970, UCAL_MONTH = JANUARY, UCAL_DATE = 1, etc.
+ *
+ * <p>
+ * <strong>Inconsistent information.</strong> If fields conflict, the calendar
+ * will give preference to fields set more recently. For example, when
+ * determining the day, the calendar will look for one of the following
+ * combinations of fields.  The most recent combination, as determined by the
+ * most recently set single field, will be used.
+ *
+ * \htmlonly<blockquote>\endhtmlonly
+ * <pre>
+ * \code
+ * UCAL_MONTH + UCAL_DAY_OF_MONTH
+ * UCAL_MONTH + UCAL_WEEK_OF_MONTH + UCAL_DAY_OF_WEEK
+ * UCAL_MONTH + UCAL_DAY_OF_WEEK_IN_MONTH + UCAL_DAY_OF_WEEK
+ * UCAL_DAY_OF_YEAR
+ * UCAL_DAY_OF_WEEK + UCAL_WEEK_OF_YEAR
+ * \endcode
+ * </pre>
+ * \htmlonly</blockquote>\endhtmlonly
+ *
+ * For the time of day:
+ *
+ * \htmlonly<blockquote>\endhtmlonly
+ * <pre>
+ * \code
+ * UCAL_HOUR_OF_DAY
+ * UCAL_AM_PM + UCAL_HOUR
+ * \endcode
+ * </pre>
+ * \htmlonly</blockquote>\endhtmlonly
+ *
+ * <p>
+ * <strong>Note:</strong> for some non-Gregorian calendars, different
+ * fields may be necessary for complete disambiguation. For example, a full
+ * specification of the historial Arabic astronomical calendar requires year,
+ * month, day-of-month <em>and</em> day-of-week in some cases.
+ *
+ * <p>
+ * <strong>Note:</strong> There are certain possible ambiguities in
+ * interpretation of certain singular times, which are resolved in the
+ * following ways:
+ * <ol>
+ *     <li> 24:00:00 "belongs" to the following day. That is,
+ *          23:59 on Dec 31, 1969 &lt; 24:00 on Jan 1, 1970 &lt; 24:01:00 on Jan 1, 1970
+ *
+ *     <li> Although historically not precise, midnight also belongs to "am",
+ *          and noon belongs to "pm", so on the same day,
+ *          12:00 am (midnight) &lt; 12:01 am, and 12:00 pm (noon) &lt; 12:01 pm
+ * </ol>
+ *
+ * <p>
+ * The date or time format strings are not part of the definition of a
+ * calendar, as those must be modifiable or overridable by the user at
+ * runtime. Use {@link icu::DateFormat}
+ * to format dates.
+ *
+ * <p>
+ * <code>Calendar</code> provides an API for field "rolling", where fields
+ * can be incremented or decremented, but wrap around. For example, rolling the
+ * month up in the date <code>December 12, <b>1996</b></code> results in
+ * <code>January 12, <b>1996</b></code>.
+ *
+ * <p>
+ * <code>Calendar</code> also provides a date arithmetic function for
+ * adding the specified (signed) amount of time to a particular time field.
+ * For example, subtracting 5 days from the date <code>September 12, 1996</code>
+ * results in <code>September 7, 1996</code>.
+ *
+ * @stable ICU 2.0
+ */
+
+/**
+ * The time zone ID reserved for unknown time zone.
+ * @stable ICU 4.8
+ */
+#define UCAL_UNKNOWN_ZONE_ID "Etc/Unknown"
+
+/** A calendar.
+ *  For usage in C programs.
+ * @stable ICU 2.0
+ */
+typedef void* UCalendar;
+
+/** Possible types of UCalendars 
+ * @stable ICU 2.0
+ */
+enum UCalendarType {
+  /**
+   * Despite the name, UCAL_TRADITIONAL designates the locale's default calendar,
+   * which may be the Gregorian calendar or some other calendar.
+   * @stable ICU 2.0
+   */
+  UCAL_TRADITIONAL,
+  /**
+   * A better name for UCAL_TRADITIONAL.
+   * @stable ICU 4.2
+   */
+  UCAL_DEFAULT = UCAL_TRADITIONAL,
+  /**
+   * Unambiguously designates the Gregorian calendar for the locale.
+   * @stable ICU 2.0
+   */
+  UCAL_GREGORIAN
+};
+
+/** @stable ICU 2.0 */
+typedef enum UCalendarType UCalendarType;
+
+/** Possible fields in a UCalendar 
+ * @stable ICU 2.0
+ */
+enum UCalendarDateFields {
+  /** 
+   * Field number indicating the era, e.g., AD or BC in the Gregorian (Julian) calendar. 
+   * This is a calendar-specific value.
+   * @stable ICU 2.6 
+   */
+  UCAL_ERA,
+
+  /**
+   * Field number indicating the year. This is a calendar-specific value.
+   * @stable ICU 2.6 
+   */
+  UCAL_YEAR,
+
+  /**
+   * Field number indicating the month. This is a calendar-specific value. 
+   * The first month of the year is
+   * <code>JANUARY</code>; the last depends on the number of months in a year.
+   * @see #UCAL_JANUARY
+   * @see #UCAL_FEBRUARY
+   * @see #UCAL_MARCH
+   * @see #UCAL_APRIL
+   * @see #UCAL_MAY
+   * @see #UCAL_JUNE
+   * @see #UCAL_JULY
+   * @see #UCAL_AUGUST
+   * @see #UCAL_SEPTEMBER
+   * @see #UCAL_OCTOBER
+   * @see #UCAL_NOVEMBER
+   * @see #UCAL_DECEMBER
+   * @see #UCAL_UNDECIMBER
+   * @stable ICU 2.6 
+   */
+  UCAL_MONTH,
+
+  /**
+   * Field number indicating the
+   * week number within the current year.  The first week of the year, as
+   * defined by <code>UCAL_FIRST_DAY_OF_WEEK</code> and <code>UCAL_MINIMAL_DAYS_IN_FIRST_WEEK</code>
+   * attributes, has value 1.  Subclasses define
+   * the value of <code>UCAL_WEEK_OF_YEAR</code> for days before the first week of
+   * the year.
+   * @see ucal_getAttribute
+   * @see ucal_setAttribute
+   * @stable ICU 2.6 
+   */
+  UCAL_WEEK_OF_YEAR,
+
+ /**
+   * Field number indicating the
+   * week number within the current month.  The first week of the month, as
+   * defined by <code>UCAL_FIRST_DAY_OF_WEEK</code> and <code>UCAL_MINIMAL_DAYS_IN_FIRST_WEEK</code>
+   * attributes, has value 1.  Subclasses define
+   * the value of <code>WEEK_OF_MONTH</code> for days before the first week of
+   * the month.
+   * @see ucal_getAttribute
+   * @see ucal_setAttribute
+   * @see #UCAL_FIRST_DAY_OF_WEEK
+   * @see #UCAL_MINIMAL_DAYS_IN_FIRST_WEEK
+   * @stable ICU 2.6 
+   */
+  UCAL_WEEK_OF_MONTH,
+
+ /**
+   * Field number indicating the
+   * day of the month. This is a synonym for <code>DAY_OF_MONTH</code>.
+   * The first day of the month has value 1.
+   * @see #UCAL_DAY_OF_MONTH
+   * @stable ICU 2.6 
+   */
+  UCAL_DATE,
+
+ /**
+   * Field number indicating the day
+   * number within the current year.  The first day of the year has value 1.
+   * @stable ICU 2.6 
+   */
+  UCAL_DAY_OF_YEAR,
+
+ /**
+   * Field number indicating the day
+   * of the week.  This field takes values <code>SUNDAY</code>,
+   * <code>MONDAY</code>, <code>TUESDAY</code>, <code>WEDNESDAY</code>,
+   * <code>THURSDAY</code>, <code>FRIDAY</code>, and <code>SATURDAY</code>.
+   * @see #UCAL_SUNDAY
+   * @see #UCAL_MONDAY
+   * @see #UCAL_TUESDAY
+   * @see #UCAL_WEDNESDAY
+   * @see #UCAL_THURSDAY
+   * @see #UCAL_FRIDAY
+   * @see #UCAL_SATURDAY
+   * @stable ICU 2.6 
+   */
+  UCAL_DAY_OF_WEEK,
+
+ /**
+   * Field number indicating the
+   * ordinal number of the day of the week within the current month. Together
+   * with the <code>DAY_OF_WEEK</code> field, this uniquely specifies a day
+   * within a month.  Unlike <code>WEEK_OF_MONTH</code> and
+   * <code>WEEK_OF_YEAR</code>, this field's value does <em>not</em> depend on
+   * <code>getFirstDayOfWeek()</code> or
+   * <code>getMinimalDaysInFirstWeek()</code>.  <code>DAY_OF_MONTH 1</code>
+   * through <code>7</code> always correspond to <code>DAY_OF_WEEK_IN_MONTH
+   * 1</code>; <code>8</code> through <code>15</code> correspond to
+   * <code>DAY_OF_WEEK_IN_MONTH 2</code>, and so on.
+   * <code>DAY_OF_WEEK_IN_MONTH 0</code> indicates the week before
+   * <code>DAY_OF_WEEK_IN_MONTH 1</code>.  Negative values count back from the
+   * end of the month, so the last Sunday of a month is specified as
+   * <code>DAY_OF_WEEK = SUNDAY, DAY_OF_WEEK_IN_MONTH = -1</code>.  Because
+   * negative values count backward they will usually be aligned differently
+   * within the month than positive values.  For example, if a month has 31
+   * days, <code>DAY_OF_WEEK_IN_MONTH -1</code> will overlap
+   * <code>DAY_OF_WEEK_IN_MONTH 5</code> and the end of <code>4</code>.
+   * @see #UCAL_DAY_OF_WEEK
+   * @see #UCAL_WEEK_OF_MONTH
+   * @stable ICU 2.6 
+   */
+  UCAL_DAY_OF_WEEK_IN_MONTH,
+
+ /**
+   * Field number indicating
+   * whether the <code>HOUR</code> is before or after noon.
+   * E.g., at 10:04:15.250 PM the <code>AM_PM</code> is <code>PM</code>.
+   * @see #UCAL_AM
+   * @see #UCAL_PM
+   * @see #UCAL_HOUR
+   * @stable ICU 2.6 
+   */
+  UCAL_AM_PM,
+
+ /**
+   * Field number indicating the
+   * hour of the morning or afternoon. <code>HOUR</code> is used for the 12-hour
+   * clock.
+   * E.g., at 10:04:15.250 PM the <code>HOUR</code> is 10.
+   * @see #UCAL_AM_PM
+   * @see #UCAL_HOUR_OF_DAY
+   * @stable ICU 2.6 
+   */
+  UCAL_HOUR,
+
+ /**
+   * Field number indicating the
+   * hour of the day. <code>HOUR_OF_DAY</code> is used for the 24-hour clock.
+   * E.g., at 10:04:15.250 PM the <code>HOUR_OF_DAY</code> is 22.
+   * @see #UCAL_HOUR
+   * @stable ICU 2.6 
+   */
+  UCAL_HOUR_OF_DAY,
+
+ /**
+   * Field number indicating the
+   * minute within the hour.
+   * E.g., at 10:04:15.250 PM the <code>UCAL_MINUTE</code> is 4.
+   * @stable ICU 2.6 
+   */
+  UCAL_MINUTE,
+
+ /**
+   * Field number indicating the
+   * second within the minute.
+   * E.g., at 10:04:15.250 PM the <code>UCAL_SECOND</code> is 15.
+   * @stable ICU 2.6 
+   */
+  UCAL_SECOND,
+
+ /**
+   * Field number indicating the
+   * millisecond within the second.
+   * E.g., at 10:04:15.250 PM the <code>UCAL_MILLISECOND</code> is 250.
+   * @stable ICU 2.6 
+   */
+  UCAL_MILLISECOND,
+
+ /**
+   * Field number indicating the
+   * raw offset from GMT in milliseconds.
+   * @stable ICU 2.6 
+   */
+  UCAL_ZONE_OFFSET,
+
+ /**
+   * Field number indicating the
+   * daylight savings offset in milliseconds.
+   * @stable ICU 2.6 
+   */
+  UCAL_DST_OFFSET,
+  
+ /**
+   * Field number 
+   * indicating the extended year corresponding to the
+   * <code>UCAL_WEEK_OF_YEAR</code> field.  This may be one greater or less
+   * than the value of <code>UCAL_EXTENDED_YEAR</code>.
+   * @stable ICU 2.6
+   */
+  UCAL_YEAR_WOY,
+
+ /**
+   * Field number 
+   * indicating the localized day of week.  This will be a value from 1
+   * to 7 inclusive, with 1 being the localized first day of the week.
+   * @stable ICU 2.6
+   */
+  UCAL_DOW_LOCAL,
+
+  /**
+   * Year of this calendar system, encompassing all supra-year fields. For example, 
+   * in Gregorian/Julian calendars, positive Extended Year values indicate years AD,
+   *  1 BC = 0 extended, 2 BC = -1 extended, and so on. 
+   * @stable ICU 2.8 
+   */
+  UCAL_EXTENDED_YEAR,
+
+ /**
+   * Field number 
+   * indicating the modified Julian day number.  This is different from
+   * the conventional Julian day number in two regards.  First, it
+   * demarcates days at local zone midnight, rather than noon GMT.
+   * Second, it is a local number; that is, it depends on the local time
+   * zone.  It can be thought of as a single number that encompasses all
+   * the date-related fields.
+   * @stable ICU 2.8
+   */
+  UCAL_JULIAN_DAY, 
+
+  /**
+   * Ranges from 0 to 23:59:59.999 (regardless of DST).  This field behaves <em>exactly</em> 
+   * like a composite of all time-related fields, not including the zone fields.  As such, 
+   * it also reflects discontinuities of those fields on DST transition days.  On a day
+   * of DST onset, it will jump forward.  On a day of DST cessation, it will jump 
+   * backward.  This reflects the fact that it must be combined with the DST_OFFSET field
+   * to obtain a unique local time value.
+   * @stable ICU 2.8
+   */
+  UCAL_MILLISECONDS_IN_DAY,
+
+  /**
+   * Whether or not the current month is a leap month (0 or 1). See the Chinese calendar for
+   * an example of this.
+   */
+  UCAL_IS_LEAP_MONTH,
+  
+  /**
+   * Field count
+   * @stable ICU 2.6
+   */
+  UCAL_FIELD_COUNT,
+
+ /**
+   * Field number indicating the
+   * day of the month. This is a synonym for <code>UCAL_DATE</code>.
+   * The first day of the month has value 1.
+   * @see #UCAL_DATE
+   * Synonym for UCAL_DATE
+   * @stable ICU 2.8
+   **/
+  UCAL_DAY_OF_MONTH=UCAL_DATE
+};
+
+/** @stable ICU 2.0 */
+typedef enum UCalendarDateFields UCalendarDateFields;
+    /**
+     * Useful constant for days of week. Note: Calendar day-of-week is 1-based. Clients
+     * who create locale resources for the field of first-day-of-week should be aware of
+     * this. For instance, in US locale, first-day-of-week is set to 1, i.e., UCAL_SUNDAY.
+     */
+/** Possible days of the week in a UCalendar 
+ * @stable ICU 2.0
+ */
+enum UCalendarDaysOfWeek {
+  /** Sunday */
+  UCAL_SUNDAY = 1,
+  /** Monday */
+  UCAL_MONDAY,
+  /** Tuesday */
+  UCAL_TUESDAY,
+  /** Wednesday */
+  UCAL_WEDNESDAY,
+  /** Thursday */
+  UCAL_THURSDAY,
+  /** Friday */
+  UCAL_FRIDAY,
+  /** Saturday */
+  UCAL_SATURDAY
+};
+
+/** @stable ICU 2.0 */
+typedef enum UCalendarDaysOfWeek UCalendarDaysOfWeek;
+
+/** Possible months in a UCalendar. Note: Calendar month is 0-based.
+ * @stable ICU 2.0
+ */
+enum UCalendarMonths {
+  /** January */
+  UCAL_JANUARY,
+  /** February */
+  UCAL_FEBRUARY,
+  /** March */
+  UCAL_MARCH,
+  /** April */
+  UCAL_APRIL,
+  /** May */
+  UCAL_MAY,
+  /** June */
+  UCAL_JUNE,
+  /** July */
+  UCAL_JULY,
+  /** August */
+  UCAL_AUGUST,
+  /** September */
+  UCAL_SEPTEMBER,
+  /** October */
+  UCAL_OCTOBER,
+  /** November */
+  UCAL_NOVEMBER,
+  /** December */
+  UCAL_DECEMBER,
+  /** Value of the <code>UCAL_MONTH</code> field indicating the
+    * thirteenth month of the year. Although the Gregorian calendar
+    * does not use this value, lunar calendars do.
+    */
+  UCAL_UNDECIMBER
+};
+
+/** @stable ICU 2.0 */
+typedef enum UCalendarMonths UCalendarMonths;
+
+/** Possible AM/PM values in a UCalendar 
+ * @stable ICU 2.0
+ */
+enum UCalendarAMPMs {
+    /** AM */
+  UCAL_AM,
+  /** PM */
+  UCAL_PM
+};
+
+/** @stable ICU 2.0 */
+typedef enum UCalendarAMPMs UCalendarAMPMs;
+
+/**
+ * System time zone type constants used by filtering zones
+ * in ucal_openTimeZoneIDEnumeration.
+ * @see ucal_openTimeZoneIDEnumeration
+ * @stable ICU 4.8
+ */
+enum USystemTimeZoneType {
+    /**
+     * Any system zones.
+     * @stable ICU 4.8
+     */
+    UCAL_ZONE_TYPE_ANY,
+    /**
+     * Canonical system zones.
+     * @stable ICU 4.8
+     */
+    UCAL_ZONE_TYPE_CANONICAL,
+    /**
+     * Canonical system zones associated with actual locations.
+     * @stable ICU 4.8
+     */
+    UCAL_ZONE_TYPE_CANONICAL_LOCATION
+};
+
+/** @stable ICU 4.8 */
+typedef enum USystemTimeZoneType USystemTimeZoneType;
+
+/** 
+ * Create an enumeration over system time zone IDs with the given
+ * filter conditions. 
+ * @param zoneType  The system time zone type.
+ * @param region    The ISO 3166 two-letter country code or UN M.49
+ *                  three-digit area code.  When NULL, no filtering
+ *                  done by region. 
+ * @param rawOffset An offset from GMT in milliseconds, ignoring the
+ *                  effect of daylight savings time, if any. When NULL,
+ *                  no filtering done by zone offset.
+ * @param ec        A pointer to an UErrorCode to receive any errors
+ * @return  an enumeration object that the caller must dispose of
+ *          using enum_close(), or NULL upon failure. In case of failure,
+ *          *ec will indicate the error.
+ * @stable ICU 4.8
+ */ 
+U_STABLE UEnumeration* U_EXPORT2
+ucal_openTimeZoneIDEnumeration(USystemTimeZoneType zoneType, const char* region,
+                                const int32_t* rawOffset, UErrorCode* ec);
+
+/**
+ * Create an enumeration over all time zones.
+ *
+ * @param ec input/output error code
+ *
+ * @return an enumeration object that the caller must dispose of using
+ * uenum_close(), or NULL upon failure. In case of failure *ec will
+ * indicate the error.
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE UEnumeration* U_EXPORT2
+ucal_openTimeZones(UErrorCode* ec);
+
+/**
+ * Create an enumeration over all time zones associated with the given
+ * country. Some zones are affiliated with no country (e.g., "UTC");
+ * these may also be retrieved, as a group.
+ *
+ * @param country the ISO 3166 two-letter country code, or NULL to
+ * retrieve zones not affiliated with any country
+ *
+ * @param ec input/output error code
+ *
+ * @return an enumeration object that the caller must dispose of using
+ * uenum_close(), or NULL upon failure. In case of failure *ec will
+ * indicate the error.
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE UEnumeration* U_EXPORT2
+ucal_openCountryTimeZones(const char* country, UErrorCode* ec);
+
+/**
+ * Return the default time zone. The default is determined initially
+ * by querying the host operating system. It may be changed with
+ * ucal_setDefaultTimeZone() or with the C++ TimeZone API.
+ *
+ * @param result A buffer to receive the result, or NULL
+ *
+ * @param resultCapacity The capacity of the result buffer
+ *
+ * @param ec input/output error code
+ *
+ * @return The result string length, not including the terminating
+ * null
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE int32_t U_EXPORT2
+ucal_getDefaultTimeZone(UChar* result, int32_t resultCapacity, UErrorCode* ec);
+
+/**
+ * Set the default time zone.
+ *
+ * @param zoneID null-terminated time zone ID
+ *
+ * @param ec input/output error code
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE void U_EXPORT2
+ucal_setDefaultTimeZone(const UChar* zoneID, UErrorCode* ec);
+
+/**
+ * Return the amount of time in milliseconds that the clock is
+ * advanced during daylight savings time for the given time zone, or
+ * zero if the time zone does not observe daylight savings time.
+ *
+ * @param zoneID null-terminated time zone ID
+ *
+ * @param ec input/output error code
+ *
+ * @return the number of milliseconds the time is advanced with
+ * respect to standard time when the daylight savings rules are in
+ * effect. This is always a non-negative number, most commonly either
+ * 3,600,000 (one hour) or zero.
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE int32_t U_EXPORT2
+ucal_getDSTSavings(const UChar* zoneID, UErrorCode* ec);
+
+/**
+ * Get the current date and time.
+ * The value returned is represented as milliseconds from the epoch.
+ * @return The current date and time.
+ * @stable ICU 2.0
+ */
+U_STABLE UDate U_EXPORT2 
+ucal_getNow(void);
+
+/**
+ * Open a UCalendar.
+ * A UCalendar may be used to convert a millisecond value to a year,
+ * month, and day.
+ * <p>
+ * Note: When unknown TimeZone ID is specified or if the TimeZone ID specified is "Etc/Unknown",
+ * the UCalendar returned by the function is initialized with GMT zone with TimeZone ID
+ * <code>UCAL_UNKNOWN_ZONE_ID</code> ("Etc/Unknown") without any errors/warnings.  If you want
+ * to check if a TimeZone ID is valid prior to this function, use <code>ucal_getCanonicalTimeZoneID</code>.
+ * 
+ * @param zoneID The desired TimeZone ID.  If 0, use the default time zone.
+ * @param len The length of zoneID, or -1 if null-terminated.
+ * @param locale The desired locale
+ * @param type The type of UCalendar to open. This can be UCAL_GREGORIAN to open the Gregorian
+ * calendar for the locale, or UCAL_DEFAULT to open the default calendar for the locale (the
+ * default calendar may also be Gregorian). To open a specific non-Gregorian calendar for the
+ * locale, use uloc_setKeywordValue to set the value of the calendar keyword for the locale
+ * and then pass the locale to ucal_open with UCAL_DEFAULT as the type.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return A pointer to a UCalendar, or 0 if an error occurred.
+ * @see #UCAL_UNKNOWN_ZONE_ID
+ * @stable ICU 2.0
+ */
+U_STABLE UCalendar* U_EXPORT2 
+ucal_open(const UChar*   zoneID,
+          int32_t        len,
+          const char*    locale,
+          UCalendarType  type,
+          UErrorCode*    status);
+
+/**
+ * Close a UCalendar.
+ * Once closed, a UCalendar may no longer be used.
+ * @param cal The UCalendar to close.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_close(UCalendar *cal);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUCalendarPointer
+ * "Smart pointer" class, closes a UCalendar via ucal_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUCalendarPointer, UCalendar, ucal_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Open a copy of a UCalendar.
+ * This function performs a deep copy.
+ * @param cal The calendar to copy
+ * @param status A pointer to an UErrorCode to receive any errors.
+ * @return A pointer to a UCalendar identical to cal.
+ * @stable ICU 4.0
+ */
+U_STABLE UCalendar* U_EXPORT2 
+ucal_clone(const UCalendar* cal,
+           UErrorCode*      status);
+
+/**
+ * Set the TimeZone used by a UCalendar.
+ * A UCalendar uses a timezone for converting from Greenwich time to local time.
+ * @param cal The UCalendar to set.
+ * @param zoneID The desired TimeZone ID.  If 0, use the default time zone.
+ * @param len The length of zoneID, or -1 if null-terminated.
+ * @param status A pointer to an UErrorCode to receive any errors.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_setTimeZone(UCalendar*    cal,
+                 const UChar*  zoneID,
+                 int32_t       len,
+                 UErrorCode*   status);
+
+#ifndef U_HIDE_DRAFT_API
+/** 
+ * Get the ID of the UCalendar's time zone. 
+ * 
+ * @param cal           The UCalendar to query. 
+ * @param result        Receives the UCalendar's time zone ID. 
+ * @param resultLength  The maximum size of result. 
+ * @param status        Receives the status. 
+ * @return              The total buffer size needed; if greater than resultLength, the output was truncated. 
+ * @draft ICU 51 
+ */ 
+U_DRAFT int32_t U_EXPORT2 
+ucal_getTimeZoneID(const UCalendar *cal,
+                   UChar *result,
+                   int32_t resultLength,
+                   UErrorCode *status);
+#endif /* U_HIDE_DRAFT_API */
+
+/**
+ * Possible formats for a UCalendar's display name 
+ * @stable ICU 2.0
+ */
+enum UCalendarDisplayNameType {
+  /** Standard display name */
+  UCAL_STANDARD,
+  /** Short standard display name */
+  UCAL_SHORT_STANDARD,
+  /** Daylight savings display name */
+  UCAL_DST,
+  /** Short daylight savings display name */
+  UCAL_SHORT_DST
+};
+
+/** @stable ICU 2.0 */
+typedef enum UCalendarDisplayNameType UCalendarDisplayNameType;
+
+/**
+ * Get the display name for a UCalendar's TimeZone.
+ * A display name is suitable for presentation to a user.
+ * @param cal          The UCalendar to query.
+ * @param type         The desired display name format; one of UCAL_STANDARD, UCAL_SHORT_STANDARD,
+ *                     UCAL_DST, UCAL_SHORT_DST
+ * @param locale       The desired locale for the display name.
+ * @param result       A pointer to a buffer to receive the formatted number.
+ * @param resultLength The maximum size of result.
+ * @param status       A pointer to an UErrorCode to receive any errors
+ * @return             The total buffer size needed; if greater than resultLength, the output was truncated.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucal_getTimeZoneDisplayName(const UCalendar*          cal,
+                            UCalendarDisplayNameType  type,
+                            const char*               locale,
+                            UChar*                    result,
+                            int32_t                   resultLength,
+                            UErrorCode*               status);
+
+/**
+ * Determine if a UCalendar is currently in daylight savings time.
+ * Daylight savings time is not used in all parts of the world.
+ * @param cal The UCalendar to query.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return TRUE if cal is currently in daylight savings time, FALSE otherwise
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2 
+ucal_inDaylightTime(const UCalendar*  cal,
+                    UErrorCode*       status );
+
+/**
+ * Sets the GregorianCalendar change date. This is the point when the switch from
+ * Julian dates to Gregorian dates occurred. Default is 00:00:00 local time, October
+ * 15, 1582. Previous to this time and date will be Julian dates.
+ *
+ * This function works only for Gregorian calendars. If the UCalendar is not
+ * an instance of a Gregorian calendar, then a U_UNSUPPORTED_ERROR
+ * error code is set.
+ *
+ * @param cal        The calendar object.
+ * @param date       The given Gregorian cutover date.
+ * @param pErrorCode Pointer to a standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ *
+ * @see GregorianCalendar::setGregorianChange
+ * @see ucal_getGregorianChange
+ * @stable ICU 3.6
+ */
+U_STABLE void U_EXPORT2
+ucal_setGregorianChange(UCalendar *cal, UDate date, UErrorCode *pErrorCode);
+
+/**
+ * Gets the Gregorian Calendar change date. This is the point when the switch from
+ * Julian dates to Gregorian dates occurred. Default is 00:00:00 local time, October
+ * 15, 1582. Previous to this time and date will be Julian dates.
+ *
+ * This function works only for Gregorian calendars. If the UCalendar is not
+ * an instance of a Gregorian calendar, then a U_UNSUPPORTED_ERROR
+ * error code is set.
+ *
+ * @param cal        The calendar object.
+ * @param pErrorCode Pointer to a standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return   The Gregorian cutover time for this calendar.
+ *
+ * @see GregorianCalendar::getGregorianChange
+ * @see ucal_setGregorianChange
+ * @stable ICU 3.6
+ */
+U_STABLE UDate U_EXPORT2
+ucal_getGregorianChange(const UCalendar *cal, UErrorCode *pErrorCode);
+
+/**
+ * Types of UCalendar attributes 
+ * @stable ICU 2.0
+ */
+enum UCalendarAttribute {
+  /**
+   * Lenient parsing
+   * @stable ICU 2.0
+   */
+  UCAL_LENIENT,
+  /**
+   * First day of week
+   * @stable ICU 2.0
+   */
+  UCAL_FIRST_DAY_OF_WEEK,
+  /**
+   * Minimum number of days in first week
+   * @stable ICU 2.0
+   */
+  UCAL_MINIMAL_DAYS_IN_FIRST_WEEK,
+  /**
+   * The behavior for handling wall time repeating multiple times
+   * at negative time zone offset transitions
+   * @stable ICU 49
+   */
+  UCAL_REPEATED_WALL_TIME,
+  /**
+   * The behavior for handling skipped wall time at positive time
+   * zone offset transitions.
+   * @stable ICU 49
+   */
+  UCAL_SKIPPED_WALL_TIME
+};
+
+/** @stable ICU 2.0 */
+typedef enum UCalendarAttribute UCalendarAttribute;
+
+/**
+ * Options for handling ambiguous wall time at time zone
+ * offset transitions.
+ * @stable ICU 49
+ */
+enum UCalendarWallTimeOption {
+    /**
+     * An ambiguous wall time to be interpreted as the latest.
+     * This option is valid for UCAL_REPEATED_WALL_TIME and
+     * UCAL_SKIPPED_WALL_TIME.
+     * @stable ICU 49
+     */
+    UCAL_WALLTIME_LAST,
+    /**
+     * An ambiguous wall time to be interpreted as the earliest.
+     * This option is valid for UCAL_REPEATED_WALL_TIME and
+     * UCAL_SKIPPED_WALL_TIME.
+     * @stable ICU 49
+     */
+    UCAL_WALLTIME_FIRST,
+    /**
+     * An ambiguous wall time to be interpreted as the next valid
+     * wall time. This option is valid for UCAL_SKIPPED_WALL_TIME.
+     * @stable ICU 49
+     */
+    UCAL_WALLTIME_NEXT_VALID
+};
+/** @stable ICU 49 */
+typedef enum UCalendarWallTimeOption UCalendarWallTimeOption;
+
+/**
+ * Get a numeric attribute associated with a UCalendar.
+ * Numeric attributes include the first day of the week, or the minimal numbers
+ * of days in the first week of the month.
+ * @param cal The UCalendar to query.
+ * @param attr The desired attribute; one of UCAL_LENIENT, UCAL_FIRST_DAY_OF_WEEK,
+ * UCAL_MINIMAL_DAYS_IN_FIRST_WEEK, UCAL_REPEATED_WALL_TIME or UCAL_SKIPPED_WALL_TIME
+ * @return The value of attr.
+ * @see ucal_setAttribute
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucal_getAttribute(const UCalendar*    cal,
+                  UCalendarAttribute  attr);
+
+/**
+ * Set a numeric attribute associated with a UCalendar.
+ * Numeric attributes include the first day of the week, or the minimal numbers
+ * of days in the first week of the month.
+ * @param cal The UCalendar to set.
+ * @param attr The desired attribute; one of UCAL_LENIENT, UCAL_FIRST_DAY_OF_WEEK,
+ * UCAL_MINIMAL_DAYS_IN_FIRST_WEEK, UCAL_REPEATED_WALL_TIME or UCAL_SKIPPED_WALL_TIME
+ * @param newValue The new value of attr.
+ * @see ucal_getAttribute
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_setAttribute(UCalendar*          cal,
+                  UCalendarAttribute  attr,
+                  int32_t             newValue);
+
+/**
+ * Get a locale for which calendars are available.
+ * A UCalendar in a locale returned by this function will contain the correct
+ * day and month names for the locale.
+ * @param localeIndex The index of the desired locale.
+ * @return A locale for which calendars are available, or 0 if none.
+ * @see ucal_countAvailable
+ * @stable ICU 2.0
+ */
+U_STABLE const char* U_EXPORT2 
+ucal_getAvailable(int32_t localeIndex);
+
+/**
+ * Determine how many locales have calendars available.
+ * This function is most useful as determining the loop ending condition for
+ * calls to \ref ucal_getAvailable.
+ * @return The number of locales for which calendars are available.
+ * @see ucal_getAvailable
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucal_countAvailable(void);
+
+/**
+ * Get a UCalendar's current time in millis.
+ * The time is represented as milliseconds from the epoch.
+ * @param cal The UCalendar to query.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return The calendar's current time in millis.
+ * @see ucal_setMillis
+ * @see ucal_setDate
+ * @see ucal_setDateTime
+ * @stable ICU 2.0
+ */
+U_STABLE UDate U_EXPORT2 
+ucal_getMillis(const UCalendar*  cal,
+               UErrorCode*       status);
+
+/**
+ * Set a UCalendar's current time in millis.
+ * The time is represented as milliseconds from the epoch.
+ * @param cal The UCalendar to set.
+ * @param dateTime The desired date and time.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @see ucal_getMillis
+ * @see ucal_setDate
+ * @see ucal_setDateTime
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_setMillis(UCalendar*   cal,
+               UDate        dateTime,
+               UErrorCode*  status );
+
+/**
+ * Set a UCalendar's current date.
+ * The date is represented as a series of 32-bit integers.
+ * @param cal The UCalendar to set.
+ * @param year The desired year.
+ * @param month The desired month; one of UCAL_JANUARY, UCAL_FEBRUARY, UCAL_MARCH, UCAL_APRIL, UCAL_MAY,
+ * UCAL_JUNE, UCAL_JULY, UCAL_AUGUST, UCAL_SEPTEMBER, UCAL_OCTOBER, UCAL_NOVEMBER, UCAL_DECEMBER, UCAL_UNDECIMBER
+ * @param date The desired day of the month.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @see ucal_getMillis
+ * @see ucal_setMillis
+ * @see ucal_setDateTime
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_setDate(UCalendar*   cal,
+             int32_t      year,
+             int32_t      month,
+             int32_t      date,
+             UErrorCode*  status);
+
+/**
+ * Set a UCalendar's current date.
+ * The date is represented as a series of 32-bit integers.
+ * @param cal The UCalendar to set.
+ * @param year The desired year.
+ * @param month The desired month; one of UCAL_JANUARY, UCAL_FEBRUARY, UCAL_MARCH, UCAL_APRIL, UCAL_MAY,
+ * UCAL_JUNE, UCAL_JULY, UCAL_AUGUST, UCAL_SEPTEMBER, UCAL_OCTOBER, UCAL_NOVEMBER, UCAL_DECEMBER, UCAL_UNDECIMBER
+ * @param date The desired day of the month.
+ * @param hour The desired hour of day.
+ * @param minute The desired minute.
+ * @param second The desirec second.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @see ucal_getMillis
+ * @see ucal_setMillis
+ * @see ucal_setDate
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_setDateTime(UCalendar*   cal,
+                 int32_t      year,
+                 int32_t      month,
+                 int32_t      date,
+                 int32_t      hour,
+                 int32_t      minute,
+                 int32_t      second,
+                 UErrorCode*  status);
+
+/**
+ * Returns TRUE if two UCalendars are equivalent.  Equivalent
+ * UCalendars will behave identically, but they may be set to
+ * different times.
+ * @param cal1 The first of the UCalendars to compare.
+ * @param cal2 The second of the UCalendars to compare.
+ * @return TRUE if cal1 and cal2 are equivalent, FALSE otherwise.
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2 
+ucal_equivalentTo(const UCalendar*  cal1,
+                  const UCalendar*  cal2);
+
+/**
+ * Add a specified signed amount to a particular field in a UCalendar.
+ * This can modify more significant fields in the calendar.
+ * Adding a positive value always means moving forward in time, so for the Gregorian calendar,
+ * starting with 100 BC and adding +1 to year results in 99 BC (even though this actually reduces
+ * the numeric value of the field itself).
+ * @param cal The UCalendar to which to add.
+ * @param field The field to which to add the signed value; one of UCAL_ERA, UCAL_YEAR, UCAL_MONTH,
+ * UCAL_WEEK_OF_YEAR, UCAL_WEEK_OF_MONTH, UCAL_DATE, UCAL_DAY_OF_YEAR, UCAL_DAY_OF_WEEK,
+ * UCAL_DAY_OF_WEEK_IN_MONTH, UCAL_AM_PM, UCAL_HOUR, UCAL_HOUR_OF_DAY, UCAL_MINUTE, UCAL_SECOND,
+ * UCAL_MILLISECOND, UCAL_ZONE_OFFSET, UCAL_DST_OFFSET.
+ * @param amount The signed amount to add to field. If the amount causes the value
+ * to exceed to maximum or minimum values for that field, other fields are modified
+ * to preserve the magnitude of the change.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @see ucal_roll
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_add(UCalendar*           cal,
+         UCalendarDateFields  field,
+         int32_t              amount,
+         UErrorCode*          status);
+
+/**
+ * Add a specified signed amount to a particular field in a UCalendar.
+ * This will not modify more significant fields in the calendar.
+ * Rolling by a positive value always means moving forward in time (unless the limit of the
+ * field is reached, in which case it may pin or wrap), so for Gregorian calendar,
+ * starting with 100 BC and rolling the year by +1 results in 99 BC.
+ * When eras have a definite beginning and end (as in the Chinese calendar, or as in most eras in the
+ * Japanese calendar) then rolling the year past either limit of the era will cause the year to wrap around.
+ * When eras only have a limit at one end, then attempting to roll the year past that limit will result in
+ * pinning the year at that limit. Note that for most calendars in which era 0 years move forward in time
+ * (such as Buddhist, Hebrew, or Islamic), it is possible for add or roll to result in negative years for
+ * era 0 (that is the only way to represent years before the calendar epoch).
+ * @param cal The UCalendar to which to add.
+ * @param field The field to which to add the signed value; one of UCAL_ERA, UCAL_YEAR, UCAL_MONTH,
+ * UCAL_WEEK_OF_YEAR, UCAL_WEEK_OF_MONTH, UCAL_DATE, UCAL_DAY_OF_YEAR, UCAL_DAY_OF_WEEK,
+ * UCAL_DAY_OF_WEEK_IN_MONTH, UCAL_AM_PM, UCAL_HOUR, UCAL_HOUR_OF_DAY, UCAL_MINUTE, UCAL_SECOND,
+ * UCAL_MILLISECOND, UCAL_ZONE_OFFSET, UCAL_DST_OFFSET.
+ * @param amount The signed amount to add to field. If the amount causes the value
+ * to exceed to maximum or minimum values for that field, the field is pinned to a permissible
+ * value.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @see ucal_add
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_roll(UCalendar*           cal,
+          UCalendarDateFields  field,
+          int32_t              amount,
+          UErrorCode*          status);
+
+/**
+ * Get the current value of a field from a UCalendar.
+ * All fields are represented as 32-bit integers.
+ * @param cal The UCalendar to query.
+ * @param field The desired field; one of UCAL_ERA, UCAL_YEAR, UCAL_MONTH,
+ * UCAL_WEEK_OF_YEAR, UCAL_WEEK_OF_MONTH, UCAL_DATE, UCAL_DAY_OF_YEAR, UCAL_DAY_OF_WEEK,
+ * UCAL_DAY_OF_WEEK_IN_MONTH, UCAL_AM_PM, UCAL_HOUR, UCAL_HOUR_OF_DAY, UCAL_MINUTE, UCAL_SECOND,
+ * UCAL_MILLISECOND, UCAL_ZONE_OFFSET, UCAL_DST_OFFSET.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return The value of the desired field.
+ * @see ucal_set
+ * @see ucal_isSet
+ * @see ucal_clearField
+ * @see ucal_clear
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucal_get(const UCalendar*     cal,
+         UCalendarDateFields  field,
+         UErrorCode*          status );
+
+/**
+ * Set the value of a field in a UCalendar.
+ * All fields are represented as 32-bit integers.
+ * @param cal The UCalendar to set.
+ * @param field The field to set; one of UCAL_ERA, UCAL_YEAR, UCAL_MONTH,
+ * UCAL_WEEK_OF_YEAR, UCAL_WEEK_OF_MONTH, UCAL_DATE, UCAL_DAY_OF_YEAR, UCAL_DAY_OF_WEEK,
+ * UCAL_DAY_OF_WEEK_IN_MONTH, UCAL_AM_PM, UCAL_HOUR, UCAL_HOUR_OF_DAY, UCAL_MINUTE, UCAL_SECOND,
+ * UCAL_MILLISECOND, UCAL_ZONE_OFFSET, UCAL_DST_OFFSET.
+ * @param value The desired value of field.
+ * @see ucal_get
+ * @see ucal_isSet
+ * @see ucal_clearField
+ * @see ucal_clear
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_set(UCalendar*           cal,
+         UCalendarDateFields  field,
+         int32_t              value);
+
+/**
+ * Determine if a field in a UCalendar is set.
+ * All fields are represented as 32-bit integers.
+ * @param cal The UCalendar to query.
+ * @param field The desired field; one of UCAL_ERA, UCAL_YEAR, UCAL_MONTH,
+ * UCAL_WEEK_OF_YEAR, UCAL_WEEK_OF_MONTH, UCAL_DATE, UCAL_DAY_OF_YEAR, UCAL_DAY_OF_WEEK,
+ * UCAL_DAY_OF_WEEK_IN_MONTH, UCAL_AM_PM, UCAL_HOUR, UCAL_HOUR_OF_DAY, UCAL_MINUTE, UCAL_SECOND,
+ * UCAL_MILLISECOND, UCAL_ZONE_OFFSET, UCAL_DST_OFFSET.
+ * @return TRUE if field is set, FALSE otherwise.
+ * @see ucal_get
+ * @see ucal_set
+ * @see ucal_clearField
+ * @see ucal_clear
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2 
+ucal_isSet(const UCalendar*     cal,
+           UCalendarDateFields  field);
+
+/**
+ * Clear a field in a UCalendar.
+ * All fields are represented as 32-bit integers.
+ * @param cal The UCalendar containing the field to clear.
+ * @param field The field to clear; one of UCAL_ERA, UCAL_YEAR, UCAL_MONTH,
+ * UCAL_WEEK_OF_YEAR, UCAL_WEEK_OF_MONTH, UCAL_DATE, UCAL_DAY_OF_YEAR, UCAL_DAY_OF_WEEK,
+ * UCAL_DAY_OF_WEEK_IN_MONTH, UCAL_AM_PM, UCAL_HOUR, UCAL_HOUR_OF_DAY, UCAL_MINUTE, UCAL_SECOND,
+ * UCAL_MILLISECOND, UCAL_ZONE_OFFSET, UCAL_DST_OFFSET.
+ * @see ucal_get
+ * @see ucal_set
+ * @see ucal_isSet
+ * @see ucal_clear
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_clearField(UCalendar*           cal,
+                UCalendarDateFields  field);
+
+/**
+ * Clear all fields in a UCalendar.
+ * All fields are represented as 32-bit integers.
+ * @param calendar The UCalendar to clear.
+ * @see ucal_get
+ * @see ucal_set
+ * @see ucal_isSet
+ * @see ucal_clearField
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucal_clear(UCalendar* calendar);
+
+/**
+ * Possible limit values for a UCalendar 
+ * @stable ICU 2.0
+ */
+enum UCalendarLimitType {
+  /** Minimum value */
+  UCAL_MINIMUM,
+  /** Maximum value */
+  UCAL_MAXIMUM,
+  /** Greatest minimum value */
+  UCAL_GREATEST_MINIMUM,
+  /** Leaest maximum value */
+  UCAL_LEAST_MAXIMUM,
+  /** Actual minimum value */
+  UCAL_ACTUAL_MINIMUM,
+  /** Actual maximum value */
+  UCAL_ACTUAL_MAXIMUM
+};
+
+/** @stable ICU 2.0 */
+typedef enum UCalendarLimitType UCalendarLimitType;
+
+/**
+ * Determine a limit for a field in a UCalendar.
+ * A limit is a maximum or minimum value for a field.
+ * @param cal The UCalendar to query.
+ * @param field The desired field; one of UCAL_ERA, UCAL_YEAR, UCAL_MONTH,
+ * UCAL_WEEK_OF_YEAR, UCAL_WEEK_OF_MONTH, UCAL_DATE, UCAL_DAY_OF_YEAR, UCAL_DAY_OF_WEEK,
+ * UCAL_DAY_OF_WEEK_IN_MONTH, UCAL_AM_PM, UCAL_HOUR, UCAL_HOUR_OF_DAY, UCAL_MINUTE, UCAL_SECOND,
+ * UCAL_MILLISECOND, UCAL_ZONE_OFFSET, UCAL_DST_OFFSET.
+ * @param type The desired critical point; one of UCAL_MINIMUM, UCAL_MAXIMUM, UCAL_GREATEST_MINIMUM,
+ * UCAL_LEAST_MAXIMUM, UCAL_ACTUAL_MINIMUM, UCAL_ACTUAL_MAXIMUM
+ * @param status A pointer to an UErrorCode to receive any errors.
+ * @return The requested value.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucal_getLimit(const UCalendar*     cal,
+              UCalendarDateFields  field,
+              UCalendarLimitType   type,
+              UErrorCode*          status);
+
+/** Get the locale for this calendar object. You can choose between valid and actual locale.
+ *  @param cal The calendar object
+ *  @param type type of the locale we're looking for (valid or actual) 
+ *  @param status error code for the operation
+ *  @return the locale name
+ *  @stable ICU 2.8
+ */
+U_STABLE const char * U_EXPORT2
+ucal_getLocaleByType(const UCalendar *cal, ULocDataLocaleType type, UErrorCode* status);
+
+/**
+ * Returns the timezone data version currently used by ICU.
+ * @param status error code for the operation
+ * @return the version string, such as "2007f"
+ * @stable ICU 3.8
+ */
+U_STABLE const char * U_EXPORT2
+ucal_getTZDataVersion(UErrorCode* status);
+
+/**
+ * Returns the canonical system timezone ID or the normalized
+ * custom time zone ID for the given time zone ID.
+ * @param id        The input timezone ID to be canonicalized.
+ * @param len       The length of id, or -1 if null-terminated.
+ * @param result    The buffer receives the canonical system timezone ID
+ *                  or the custom timezone ID in normalized format.
+ * @param resultCapacity    The capacity of the result buffer.
+ * @param isSystemID        Receives if the given ID is a known system
+     *                      timezone ID.
+ * @param status    Recevies the status.  When the given timezone ID
+ *                  is neither a known system time zone ID nor a
+ *                  valid custom timezone ID, U_ILLEGAL_ARGUMENT_ERROR
+ *                  is set.
+ * @return          The result string length, not including the terminating
+ *                  null.
+ * @stable ICU 4.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucal_getCanonicalTimeZoneID(const UChar* id, int32_t len,
+                            UChar* result, int32_t resultCapacity, UBool *isSystemID, UErrorCode* status);
+/**
+ * Get the resource keyword value string designating the calendar type for the UCalendar.
+ * @param cal The UCalendar to query.
+ * @param status The error code for the operation.
+ * @return The resource keyword value string.
+ * @stable ICU 4.2
+ */
+U_STABLE const char * U_EXPORT2
+ucal_getType(const UCalendar *cal, UErrorCode* status);
+
+/**
+ * Given a key and a locale, returns an array of string values in a preferred
+ * order that would make a difference. These are all and only those values where
+ * the open (creation) of the service with the locale formed from the input locale
+ * plus input keyword and that value has different behavior than creation with the
+ * input locale alone.
+ * @param key           one of the keys supported by this service.  For now, only
+ *                      "calendar" is supported.
+ * @param locale        the locale
+ * @param commonlyUsed  if set to true it will return only commonly used values
+ *                      with the given locale in preferred order.  Otherwise,
+ *                      it will return all the available values for the locale.
+ * @param status error status
+ * @return a string enumeration over keyword values for the given key and the locale.
+ * @stable ICU 4.2
+ */
+U_STABLE UEnumeration* U_EXPORT2
+ucal_getKeywordValuesForLocale(const char* key,
+                               const char* locale,
+                               UBool commonlyUsed,
+                               UErrorCode* status);
+
+
+/** Weekday types, as returned by ucal_getDayOfWeekType().
+ * @stable ICU 4.4
+ */
+enum UCalendarWeekdayType {
+  /**
+   * Designates a full weekday (no part of the day is included in the weekend).
+   * @stable ICU 4.4 
+   */
+  UCAL_WEEKDAY,
+  /**
+   * Designates a full weekend day (the entire day is included in the weekend).
+   * @stable ICU 4.4 
+   */
+  UCAL_WEEKEND,
+  /**
+   * Designates a day that starts as a weekday and transitions to the weekend.
+   * Call ucal_getWeekendTransition() to get the time of transition.
+   * @stable ICU 4.4 
+   */
+  UCAL_WEEKEND_ONSET,
+  /**
+   * Designates a day that starts as the weekend and transitions to a weekday.
+   * Call ucal_getWeekendTransition() to get the time of transition.
+   * @stable ICU 4.4 
+   */
+  UCAL_WEEKEND_CEASE
+};
+
+/** @stable ICU 4.4 */
+typedef enum UCalendarWeekdayType UCalendarWeekdayType;
+
+/**
+ * Returns whether the given day of the week is a weekday, a weekend day,
+ * or a day that transitions from one to the other, for the locale and
+ * calendar system associated with this UCalendar (the locale's region is
+ * often the most determinant factor). If a transition occurs at midnight,
+ * then the days before and after the transition will have the
+ * type UCAL_WEEKDAY or UCAL_WEEKEND. If a transition occurs at a time
+ * other than midnight, then the day of the transition will have
+ * the type UCAL_WEEKEND_ONSET or UCAL_WEEKEND_CEASE. In this case, the
+ * function ucal_getWeekendTransition() will return the point of
+ * transition.
+ * @param cal The UCalendar to query.
+ * @param dayOfWeek The day of the week whose type is desired (UCAL_SUNDAY..UCAL_SATURDAY).
+ * @param status The error code for the operation.
+ * @return The UCalendarWeekdayType for the day of the week.
+ * @stable ICU 4.4
+ */
+U_STABLE UCalendarWeekdayType U_EXPORT2
+ucal_getDayOfWeekType(const UCalendar *cal, UCalendarDaysOfWeek dayOfWeek, UErrorCode* status);
+
+/**
+ * Returns the time during the day at which the weekend begins or ends in
+ * this calendar system.  If ucal_getDayOfWeekType() returns UCAL_WEEKEND_ONSET
+ * for the specified dayOfWeek, return the time at which the weekend begins.
+ * If ucal_getDayOfWeekType() returns UCAL_WEEKEND_CEASE for the specified dayOfWeek,
+ * return the time at which the weekend ends. If ucal_getDayOfWeekType() returns
+ * some other UCalendarWeekdayType for the specified dayOfWeek, is it an error condition
+ * (U_ILLEGAL_ARGUMENT_ERROR).
+ * @param cal The UCalendar to query.
+ * @param dayOfWeek The day of the week for which the weekend transition time is
+ * desired (UCAL_SUNDAY..UCAL_SATURDAY).
+ * @param status The error code for the operation.
+ * @return The milliseconds after midnight at which the weekend begins or ends.
+ * @stable ICU 4.4
+ */
+U_STABLE int32_t U_EXPORT2
+ucal_getWeekendTransition(const UCalendar *cal, UCalendarDaysOfWeek dayOfWeek, UErrorCode *status);
+
+/**
+ * Returns TRUE if the given UDate is in the weekend in
+ * this calendar system.
+ * @param cal The UCalendar to query.
+ * @param date The UDate in question.
+ * @param status The error code for the operation.
+ * @return TRUE if the given UDate is in the weekend in
+ * this calendar system, FALSE otherwise.
+ * @stable ICU 4.4
+ */
+U_STABLE UBool U_EXPORT2
+ucal_isWeekend(const UCalendar *cal, UDate date, UErrorCode *status);
+
+/**
+ * Return the difference between the target time and the time this calendar object is currently set to.
+ * If the target time is after the current calendar setting, the the returned value will be positive.
+ * The field parameter specifies the units of the return value. For example, if field is UCAL_MONTH
+ * and ucal_getFieldDifference returns 3, then the target time is 3 to less than 4 months after the
+ * current calendar setting.
+ *
+ * As a side effect of this call, this calendar is advanced toward target by the given amount. That is,
+ * calling this function has the side effect of calling ucal_add on this calendar with the specified
+ * field and an amount equal to the return value from this function.
+ *
+ * A typical way of using this function is to call it first with the largest field of interest, then
+ * with progressively smaller fields.
+ * 
+ * @param cal The UCalendar to compare and update.
+ * @param target The target date to compare to the current calendar setting.
+ * @param field The field to compare; one of UCAL_ERA, UCAL_YEAR, UCAL_MONTH,
+ * UCAL_WEEK_OF_YEAR, UCAL_WEEK_OF_MONTH, UCAL_DATE, UCAL_DAY_OF_YEAR, UCAL_DAY_OF_WEEK,
+ * UCAL_DAY_OF_WEEK_IN_MONTH, UCAL_AM_PM, UCAL_HOUR, UCAL_HOUR_OF_DAY, UCAL_MINUTE, UCAL_SECOND,
+ * UCAL_MILLISECOND, UCAL_ZONE_OFFSET, UCAL_DST_OFFSET.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return The date difference for the specified field.
+ * @stable ICU 4.8
+ */
+U_STABLE int32_t U_EXPORT2 
+ucal_getFieldDifference(UCalendar* cal,
+                        UDate target,
+                        UCalendarDateFields field,
+                        UErrorCode* status);
+
+/**
+ * Time zone transition types for ucal_getTimeZoneTransitionDate
+ * @stable ICU 50
+ */
+enum UTimeZoneTransitionType {
+    /**
+     * Get the next transition after the current date,
+     * i.e. excludes the current date
+     * @stable ICU 50
+     */
+    UCAL_TZ_TRANSITION_NEXT,
+    /**
+     * Get the next transition on or after the current date,
+     * i.e. may include the current date
+     * @stable ICU 50
+     */
+    UCAL_TZ_TRANSITION_NEXT_INCLUSIVE,
+    /**
+     * Get the previous transition before the current date,
+     * i.e. excludes the current date
+     * @stable ICU 50
+     */
+    UCAL_TZ_TRANSITION_PREVIOUS,
+    /**
+     * Get the previous transition on or before the current date,
+     * i.e. may include the current date
+     * @stable ICU 50
+     */
+    UCAL_TZ_TRANSITION_PREVIOUS_INCLUSIVE
+};
+
+typedef enum UTimeZoneTransitionType UTimeZoneTransitionType; /**< @stable ICU 50 */
+
+/**
+* Get the UDate for the next/previous time zone transition relative to
+* the calendar's current date, in the time zone to which the calendar
+* is currently set. If there is no known time zone transition of the
+* requested type relative to the calendar's date, the function returns
+* FALSE.
+* @param cal The UCalendar to query.
+* @param type The type of transition desired.
+* @param transition A pointer to a UDate to be set to the transition time.
+*         If the function returns FALSE, the value set is unspecified.
+* @param status A pointer to a UErrorCode to receive any errors.
+* @return TRUE if a valid transition time is set in *transition, FALSE
+*         otherwise.
+* @stable ICU 50
+*/
+U_DRAFT UBool U_EXPORT2 
+ucal_getTimeZoneTransitionDate(const UCalendar* cal, UTimeZoneTransitionType type,
+                               UDate* transition, UErrorCode* status);
+
+#ifndef U_HIDE_DRAFT_API
+/**
+* Converts a system time zone ID to an equivalent Windows time zone ID. For example,
+* Windows time zone ID "Pacific Standard Time" is returned for input "America/Los_Angeles".
+*
+* <p>There are system time zones that cannot be mapped to Windows zones. When the input
+* system time zone ID is unknown or unmappable to a Windows time zone, then this
+* function returns 0 as the result length, but the operation itself remains successful
+* (no error status set on return).
+*
+* <p>This implementation utilizes <a href="http://unicode.org/cldr/charts/supplemental/zone_tzid.html">
+* Zone-Tzid mapping data</a>. The mapping data is updated time to time. To get the latest changes,
+* please read the ICU user guide section <a href="http://userguide.icu-project.org/datetime/timezone#TOC-Updating-the-Time-Zone-Data">
+* Updating the Time Zone Data</a>.
+*
+* @param id            A system time zone ID.
+* @param len           The length of <code>id</code>, or -1 if null-terminated.
+* @param winid         A buffer to receive a Windows time zone ID.
+* @param winidCapacity The capacity of the result buffer <code>winid</code>.
+* @param status        Receives the status.
+* @return              The result string length, not including the terminating null.
+* @see ucal_getTimeZoneIDForWindowsID
+*
+* @draft ICU 52
+*/
+U_DRAFT int32_t U_EXPORT2
+ucal_getWindowsTimeZoneID(const UChar* id, int32_t len,
+                            UChar* winid, int32_t winidCapacity, UErrorCode* status);
+
+/**
+* Converts a Windows time zone ID to an equivalent system time zone ID
+* for a region. For example, system time zone ID "America/Los_Angeles" is returned
+* for input Windows ID "Pacific Standard Time" and region "US" (or <code>null</code>),
+* "America/Vancouver" is returned for the same Windows ID "Pacific Standard Time" and
+* region "CA".
+*
+* <p>Not all Windows time zones can be mapped to system time zones. When the input
+* Windows time zone ID is unknown or unmappable to a system time zone, then this
+* function returns 0 as the result length, but the operation itself remains successful
+* (no error status set on return).
+*
+* <p>This implementation utilizes <a href="http://unicode.org/cldr/charts/supplemental/zone_tzid.html">
+* Zone-Tzid mapping data</a>. The mapping data is updated time to time. To get the latest changes,
+* please read the ICU user guide section <a href="http://userguide.icu-project.org/datetime/timezone#TOC-Updating-the-Time-Zone-Data">
+* Updating the Time Zone Data</a>.
+*
+* @param winid         A Windows time zone ID.
+* @param len           The length of <code>winid</code>, or -1 if null-terminated.
+* @param region        A null-terminated region code, or <code>NULL</code> if no regional preference.
+* @param id            A buffer to receive a system time zone ID.
+* @param idCapacity    The capacity of the result buffer <code>id</code>.
+* @param status        Receives the status.
+* @return              The result string length, not including the terminating null.
+* @see ucal_getWindowsTimeZoneID
+*
+* @draft ICU 52
+*/
+U_DRAFT int32_t U_EXPORT2
+ucal_getTimeZoneIDForWindowsID(const UChar* winid, int32_t len, const char* region,
+                                UChar* id, int32_t idCapacity, UErrorCode* status);
+
+#endif  /* U_HIDE_DRAFT_API */
+
+#endif /* #if !UCONFIG_NO_FORMATTING */
+
+#endif
diff --git a/icu/unicode/uchar.h b/icu/unicode/uchar.h
new file mode 100644
index 0000000..1a5b71b
--- /dev/null
+++ b/icu/unicode/uchar.h
@@ -0,0 +1,3331 @@
+/*
+**********************************************************************
+*   Copyright (C) 1997-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+*
+* File UCHAR.H
+*
+* Modification History:
+*
+*   Date        Name        Description
+*   04/02/97    aliu        Creation.
+*   03/29/99    helena      Updated for C APIs.
+*   4/15/99     Madhu       Updated for C Implementation and Javadoc
+*   5/20/99     Madhu       Added the function u_getVersion()
+*   8/19/1999   srl         Upgraded scripts to Unicode 3.0
+*   8/27/1999   schererm    UCharDirection constants: U_...
+*   11/11/1999  weiv        added u_isalnum(), cleaned comments
+*   01/11/2000  helena      Renamed u_getVersion to u_getUnicodeVersion().
+******************************************************************************
+*/
+
+#ifndef UCHAR_H
+#define UCHAR_H
+
+#include "unicode/utypes.h"
+
+U_CDECL_BEGIN
+
+/*==========================================================================*/
+/* Unicode version number                                                   */
+/*==========================================================================*/
+/**
+ * Unicode version number, default for the current ICU version.
+ * The actual Unicode Character Database (UCD) data is stored in uprops.dat
+ * and may be generated from UCD files from a different Unicode version.
+ * Call u_getUnicodeVersion to get the actual Unicode version of the data.
+ *
+ * @see u_getUnicodeVersion
+ * @stable ICU 2.0
+ */
+#define U_UNICODE_VERSION "6.3"
+
+/**
+ * \file
+ * \brief C API: Unicode Properties
+ *
+ * This C API provides low-level access to the Unicode Character Database.
+ * In addition to raw property values, some convenience functions calculate
+ * derived properties, for example for Java-style programming.
+ *
+ * Unicode assigns each code point (not just assigned character) values for
+ * many properties.
+ * Most of them are simple boolean flags, or constants from a small enumerated list.
+ * For some properties, values are strings or other relatively more complex types.
+ *
+ * For more information see
+ * "About the Unicode Character Database" (http://www.unicode.org/ucd/)
+ * and the ICU User Guide chapter on Properties (http://icu-project.org/userguide/properties.html).
+ *
+ * Many functions are designed to match java.lang.Character functions.
+ * See the individual function documentation,
+ * and see the JDK 1.4 java.lang.Character documentation
+ * at http://java.sun.com/j2se/1.4/docs/api/java/lang/Character.html
+ *
+ * There are also functions that provide easy migration from C/POSIX functions
+ * like isblank(). Their use is generally discouraged because the C/POSIX
+ * standards do not define their semantics beyond the ASCII range, which means
+ * that different implementations exhibit very different behavior.
+ * Instead, Unicode properties should be used directly.
+ *
+ * There are also only a few, broad C/POSIX character classes, and they tend
+ * to be used for conflicting purposes. For example, the "isalpha()" class
+ * is sometimes used to determine word boundaries, while a more sophisticated
+ * approach would at least distinguish initial letters from continuation
+ * characters (the latter including combining marks).
+ * (In ICU, BreakIterator is the most sophisticated API for word boundaries.)
+ * Another example: There is no "istitle()" class for titlecase characters.
+ *
+ * ICU 3.4 and later provides API access for all twelve C/POSIX character classes.
+ * ICU implements them according to the Standard Recommendations in
+ * Annex C: Compatibility Properties of UTS #18 Unicode Regular Expressions
+ * (http://www.unicode.org/reports/tr18/#Compatibility_Properties).
+ *
+ * API access for C/POSIX character classes is as follows:
+ * - alpha:     u_isUAlphabetic(c) or u_hasBinaryProperty(c, UCHAR_ALPHABETIC)
+ * - lower:     u_isULowercase(c) or u_hasBinaryProperty(c, UCHAR_LOWERCASE)
+ * - upper:     u_isUUppercase(c) or u_hasBinaryProperty(c, UCHAR_UPPERCASE)
+ * - punct:     u_ispunct(c)
+ * - digit:     u_isdigit(c) or u_charType(c)==U_DECIMAL_DIGIT_NUMBER
+ * - xdigit:    u_isxdigit(c) or u_hasBinaryProperty(c, UCHAR_POSIX_XDIGIT)
+ * - alnum:     u_hasBinaryProperty(c, UCHAR_POSIX_ALNUM)
+ * - space:     u_isUWhiteSpace(c) or u_hasBinaryProperty(c, UCHAR_WHITE_SPACE)
+ * - blank:     u_isblank(c) or u_hasBinaryProperty(c, UCHAR_POSIX_BLANK)
+ * - cntrl:     u_charType(c)==U_CONTROL_CHAR
+ * - graph:     u_hasBinaryProperty(c, UCHAR_POSIX_GRAPH)
+ * - print:     u_hasBinaryProperty(c, UCHAR_POSIX_PRINT)
+ *
+ * Note: Some of the u_isxyz() functions in uchar.h predate, and do not match,
+ * the Standard Recommendations in UTS #18. Instead, they match Java
+ * functions according to their API documentation.
+ *
+ * \htmlonly
+ * The C/POSIX character classes are also available in UnicodeSet patterns,
+ * using patterns like [:graph:] or \p{graph}.
+ * \endhtmlonly
+ *
+ * Note: There are several ICU whitespace functions.
+ * Comparison:
+ * - u_isUWhiteSpace=UCHAR_WHITE_SPACE: Unicode White_Space property;
+ *       most of general categories "Z" (separators) + most whitespace ISO controls
+ *       (including no-break spaces, but excluding IS1..IS4 and ZWSP)
+ * - u_isWhitespace: Java isWhitespace; Z + whitespace ISO controls but excluding no-break spaces
+ * - u_isJavaSpaceChar: Java isSpaceChar; just Z (including no-break spaces)
+ * - u_isspace: Z + whitespace ISO controls (including no-break spaces)
+ * - u_isblank: "horizontal spaces" = TAB + Zs - ZWSP
+ */
+
+/**
+ * Constants.
+ */
+
+/** The lowest Unicode code point value. Code points are non-negative. @stable ICU 2.0 */
+#define UCHAR_MIN_VALUE 0
+
+/**
+ * The highest Unicode code point value (scalar value) according to
+ * The Unicode Standard. This is a 21-bit value (20.1 bits, rounded up).
+ * For a single character, UChar32 is a simple type that can hold any code point value.
+ *
+ * @see UChar32
+ * @stable ICU 2.0
+ */
+#define UCHAR_MAX_VALUE 0x10ffff
+
+/**
+ * Get a single-bit bit set (a flag) from a bit number 0..31.
+ * @stable ICU 2.1
+ */
+#define U_MASK(x) ((uint32_t)1<<(x))
+
+/**
+ * Selection constants for Unicode properties.
+ * These constants are used in functions like u_hasBinaryProperty to select
+ * one of the Unicode properties.
+ *
+ * The properties APIs are intended to reflect Unicode properties as defined
+ * in the Unicode Character Database (UCD) and Unicode Technical Reports (UTR).
+ * For details about the properties see http://www.unicode.org/ucd/ .
+ * For names of Unicode properties see the UCD file PropertyAliases.txt.
+ *
+ * Important: If ICU is built with UCD files from Unicode versions below, e.g., 3.2,
+ * then properties marked with "new in Unicode 3.2" are not or not fully available.
+ * Check u_getUnicodeVersion to be sure.
+ *
+ * @see u_hasBinaryProperty
+ * @see u_getIntPropertyValue
+ * @see u_getUnicodeVersion
+ * @stable ICU 2.1
+ */
+typedef enum UProperty {
+    /*
+     * Note: UProperty constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     UCHAR_<Unicode property name>=<integer>,
+     */
+
+    /*  Note: Place UCHAR_ALPHABETIC before UCHAR_BINARY_START so that
+    debuggers display UCHAR_ALPHABETIC as the symbolic name for 0,
+    rather than UCHAR_BINARY_START.  Likewise for other *_START
+    identifiers. */
+
+    /** Binary property Alphabetic. Same as u_isUAlphabetic, different from u_isalpha.
+        Lu+Ll+Lt+Lm+Lo+Nl+Other_Alphabetic @stable ICU 2.1 */
+    UCHAR_ALPHABETIC=0,
+    /** First constant for binary Unicode properties. @stable ICU 2.1 */
+    UCHAR_BINARY_START=UCHAR_ALPHABETIC,
+    /** Binary property ASCII_Hex_Digit. 0-9 A-F a-f @stable ICU 2.1 */
+    UCHAR_ASCII_HEX_DIGIT=1,
+    /** Binary property Bidi_Control.
+        Format controls which have specific functions
+        in the Bidi Algorithm. @stable ICU 2.1 */
+    UCHAR_BIDI_CONTROL=2,
+    /** Binary property Bidi_Mirrored.
+        Characters that may change display in RTL text.
+        Same as u_isMirrored.
+        See Bidi Algorithm, UTR 9. @stable ICU 2.1 */
+    UCHAR_BIDI_MIRRORED=3,
+    /** Binary property Dash. Variations of dashes. @stable ICU 2.1 */
+    UCHAR_DASH=4,
+    /** Binary property Default_Ignorable_Code_Point (new in Unicode 3.2).
+        Ignorable in most processing.
+        <2060..206F, FFF0..FFFB, E0000..E0FFF>+Other_Default_Ignorable_Code_Point+(Cf+Cc+Cs-White_Space) @stable ICU 2.1 */
+    UCHAR_DEFAULT_IGNORABLE_CODE_POINT=5,
+    /** Binary property Deprecated (new in Unicode 3.2).
+        The usage of deprecated characters is strongly discouraged. @stable ICU 2.1 */
+    UCHAR_DEPRECATED=6,
+    /** Binary property Diacritic. Characters that linguistically modify
+        the meaning of another character to which they apply. @stable ICU 2.1 */
+    UCHAR_DIACRITIC=7,
+    /** Binary property Extender.
+        Extend the value or shape of a preceding alphabetic character,
+        e.g., length and iteration marks. @stable ICU 2.1 */
+    UCHAR_EXTENDER=8,
+    /** Binary property Full_Composition_Exclusion.
+        CompositionExclusions.txt+Singleton Decompositions+
+        Non-Starter Decompositions. @stable ICU 2.1 */
+    UCHAR_FULL_COMPOSITION_EXCLUSION=9,
+    /** Binary property Grapheme_Base (new in Unicode 3.2).
+        For programmatic determination of grapheme cluster boundaries.
+        [0..10FFFF]-Cc-Cf-Cs-Co-Cn-Zl-Zp-Grapheme_Link-Grapheme_Extend-CGJ @stable ICU 2.1 */
+    UCHAR_GRAPHEME_BASE=10,
+    /** Binary property Grapheme_Extend (new in Unicode 3.2).
+        For programmatic determination of grapheme cluster boundaries.
+        Me+Mn+Mc+Other_Grapheme_Extend-Grapheme_Link-CGJ @stable ICU 2.1 */
+    UCHAR_GRAPHEME_EXTEND=11,
+    /** Binary property Grapheme_Link (new in Unicode 3.2).
+        For programmatic determination of grapheme cluster boundaries. @stable ICU 2.1 */
+    UCHAR_GRAPHEME_LINK=12,
+    /** Binary property Hex_Digit.
+        Characters commonly used for hexadecimal numbers. @stable ICU 2.1 */
+    UCHAR_HEX_DIGIT=13,
+    /** Binary property Hyphen. Dashes used to mark connections
+        between pieces of words, plus the Katakana middle dot. @stable ICU 2.1 */
+    UCHAR_HYPHEN=14,
+    /** Binary property ID_Continue.
+        Characters that can continue an identifier.
+        DerivedCoreProperties.txt also says "NOTE: Cf characters should be filtered out."
+        ID_Start+Mn+Mc+Nd+Pc @stable ICU 2.1 */
+    UCHAR_ID_CONTINUE=15,
+    /** Binary property ID_Start.
+        Characters that can start an identifier.
+        Lu+Ll+Lt+Lm+Lo+Nl @stable ICU 2.1 */
+    UCHAR_ID_START=16,
+    /** Binary property Ideographic.
+        CJKV ideographs. @stable ICU 2.1 */
+    UCHAR_IDEOGRAPHIC=17,
+    /** Binary property IDS_Binary_Operator (new in Unicode 3.2).
+        For programmatic determination of
+        Ideographic Description Sequences. @stable ICU 2.1 */
+    UCHAR_IDS_BINARY_OPERATOR=18,
+    /** Binary property IDS_Trinary_Operator (new in Unicode 3.2).
+        For programmatic determination of
+        Ideographic Description Sequences. @stable ICU 2.1 */
+    UCHAR_IDS_TRINARY_OPERATOR=19,
+    /** Binary property Join_Control.
+        Format controls for cursive joining and ligation. @stable ICU 2.1 */
+    UCHAR_JOIN_CONTROL=20,
+    /** Binary property Logical_Order_Exception (new in Unicode 3.2).
+        Characters that do not use logical order and
+        require special handling in most processing. @stable ICU 2.1 */
+    UCHAR_LOGICAL_ORDER_EXCEPTION=21,
+    /** Binary property Lowercase. Same as u_isULowercase, different from u_islower.
+        Ll+Other_Lowercase @stable ICU 2.1 */
+    UCHAR_LOWERCASE=22,
+    /** Binary property Math. Sm+Other_Math @stable ICU 2.1 */
+    UCHAR_MATH=23,
+    /** Binary property Noncharacter_Code_Point.
+        Code points that are explicitly defined as illegal
+        for the encoding of characters. @stable ICU 2.1 */
+    UCHAR_NONCHARACTER_CODE_POINT=24,
+    /** Binary property Quotation_Mark. @stable ICU 2.1 */
+    UCHAR_QUOTATION_MARK=25,
+    /** Binary property Radical (new in Unicode 3.2).
+        For programmatic determination of
+        Ideographic Description Sequences. @stable ICU 2.1 */
+    UCHAR_RADICAL=26,
+    /** Binary property Soft_Dotted (new in Unicode 3.2).
+        Characters with a "soft dot", like i or j.
+        An accent placed on these characters causes
+        the dot to disappear. @stable ICU 2.1 */
+    UCHAR_SOFT_DOTTED=27,
+    /** Binary property Terminal_Punctuation.
+        Punctuation characters that generally mark
+        the end of textual units. @stable ICU 2.1 */
+    UCHAR_TERMINAL_PUNCTUATION=28,
+    /** Binary property Unified_Ideograph (new in Unicode 3.2).
+        For programmatic determination of
+        Ideographic Description Sequences. @stable ICU 2.1 */
+    UCHAR_UNIFIED_IDEOGRAPH=29,
+    /** Binary property Uppercase. Same as u_isUUppercase, different from u_isupper.
+        Lu+Other_Uppercase @stable ICU 2.1 */
+    UCHAR_UPPERCASE=30,
+    /** Binary property White_Space.
+        Same as u_isUWhiteSpace, different from u_isspace and u_isWhitespace.
+        Space characters+TAB+CR+LF-ZWSP-ZWNBSP @stable ICU 2.1 */
+    UCHAR_WHITE_SPACE=31,
+    /** Binary property XID_Continue.
+        ID_Continue modified to allow closure under
+        normalization forms NFKC and NFKD. @stable ICU 2.1 */
+    UCHAR_XID_CONTINUE=32,
+    /** Binary property XID_Start. ID_Start modified to allow
+        closure under normalization forms NFKC and NFKD. @stable ICU 2.1 */
+    UCHAR_XID_START=33,
+    /** Binary property Case_Sensitive. Either the source of a case
+        mapping or _in_ the target of a case mapping. Not the same as
+        the general category Cased_Letter. @stable ICU 2.6 */
+   UCHAR_CASE_SENSITIVE=34,
+    /** Binary property STerm (new in Unicode 4.0.1).
+        Sentence Terminal. Used in UAX #29: Text Boundaries
+        (http://www.unicode.org/reports/tr29/)
+        @stable ICU 3.0 */
+    UCHAR_S_TERM=35,
+    /** Binary property Variation_Selector (new in Unicode 4.0.1).
+        Indicates all those characters that qualify as Variation Selectors.
+        For details on the behavior of these characters,
+        see StandardizedVariants.html and 15.6 Variation Selectors.
+        @stable ICU 3.0 */
+    UCHAR_VARIATION_SELECTOR=36,
+    /** Binary property NFD_Inert.
+        ICU-specific property for characters that are inert under NFD,
+        i.e., they do not interact with adjacent characters.
+        See the documentation for the Normalizer2 class and the
+        Normalizer2::isInert() method.
+        @stable ICU 3.0 */
+    UCHAR_NFD_INERT=37,
+    /** Binary property NFKD_Inert.
+        ICU-specific property for characters that are inert under NFKD,
+        i.e., they do not interact with adjacent characters.
+        See the documentation for the Normalizer2 class and the
+        Normalizer2::isInert() method.
+        @stable ICU 3.0 */
+    UCHAR_NFKD_INERT=38,
+    /** Binary property NFC_Inert.
+        ICU-specific property for characters that are inert under NFC,
+        i.e., they do not interact with adjacent characters.
+        See the documentation for the Normalizer2 class and the
+        Normalizer2::isInert() method.
+        @stable ICU 3.0 */
+    UCHAR_NFC_INERT=39,
+    /** Binary property NFKC_Inert.
+        ICU-specific property for characters that are inert under NFKC,
+        i.e., they do not interact with adjacent characters.
+        See the documentation for the Normalizer2 class and the
+        Normalizer2::isInert() method.
+        @stable ICU 3.0 */
+    UCHAR_NFKC_INERT=40,
+    /** Binary Property Segment_Starter.
+        ICU-specific property for characters that are starters in terms of
+        Unicode normalization and combining character sequences.
+        They have ccc=0 and do not occur in non-initial position of the
+        canonical decomposition of any character
+        (like a-umlaut in NFD and a Jamo T in an NFD(Hangul LVT)).
+        ICU uses this property for segmenting a string for generating a set of
+        canonically equivalent strings, e.g. for canonical closure while
+        processing collation tailoring rules.
+        @stable ICU 3.0 */
+    UCHAR_SEGMENT_STARTER=41,
+    /** Binary property Pattern_Syntax (new in Unicode 4.1).
+        See UAX #31 Identifier and Pattern Syntax
+        (http://www.unicode.org/reports/tr31/)
+        @stable ICU 3.4 */
+    UCHAR_PATTERN_SYNTAX=42,
+    /** Binary property Pattern_White_Space (new in Unicode 4.1).
+        See UAX #31 Identifier and Pattern Syntax
+        (http://www.unicode.org/reports/tr31/)
+        @stable ICU 3.4 */
+    UCHAR_PATTERN_WHITE_SPACE=43,
+    /** Binary property alnum (a C/POSIX character class).
+        Implemented according to the UTS #18 Annex C Standard Recommendation.
+        See the uchar.h file documentation.
+        @stable ICU 3.4 */
+    UCHAR_POSIX_ALNUM=44,
+    /** Binary property blank (a C/POSIX character class).
+        Implemented according to the UTS #18 Annex C Standard Recommendation.
+        See the uchar.h file documentation.
+        @stable ICU 3.4 */
+    UCHAR_POSIX_BLANK=45,
+    /** Binary property graph (a C/POSIX character class).
+        Implemented according to the UTS #18 Annex C Standard Recommendation.
+        See the uchar.h file documentation.
+        @stable ICU 3.4 */
+    UCHAR_POSIX_GRAPH=46,
+    /** Binary property print (a C/POSIX character class).
+        Implemented according to the UTS #18 Annex C Standard Recommendation.
+        See the uchar.h file documentation.
+        @stable ICU 3.4 */
+    UCHAR_POSIX_PRINT=47,
+    /** Binary property xdigit (a C/POSIX character class).
+        Implemented according to the UTS #18 Annex C Standard Recommendation.
+        See the uchar.h file documentation.
+        @stable ICU 3.4 */
+    UCHAR_POSIX_XDIGIT=48,
+    /** Binary property Cased. For Lowercase, Uppercase and Titlecase characters. @stable ICU 4.4 */
+    UCHAR_CASED=49,
+    /** Binary property Case_Ignorable. Used in context-sensitive case mappings. @stable ICU 4.4 */
+    UCHAR_CASE_IGNORABLE=50,
+    /** Binary property Changes_When_Lowercased. @stable ICU 4.4 */
+    UCHAR_CHANGES_WHEN_LOWERCASED=51,
+    /** Binary property Changes_When_Uppercased. @stable ICU 4.4 */
+    UCHAR_CHANGES_WHEN_UPPERCASED=52,
+    /** Binary property Changes_When_Titlecased. @stable ICU 4.4 */
+    UCHAR_CHANGES_WHEN_TITLECASED=53,
+    /** Binary property Changes_When_Casefolded. @stable ICU 4.4 */
+    UCHAR_CHANGES_WHEN_CASEFOLDED=54,
+    /** Binary property Changes_When_Casemapped. @stable ICU 4.4 */
+    UCHAR_CHANGES_WHEN_CASEMAPPED=55,
+    /** Binary property Changes_When_NFKC_Casefolded. @stable ICU 4.4 */
+    UCHAR_CHANGES_WHEN_NFKC_CASEFOLDED=56,
+    /** One more than the last constant for binary Unicode properties. @stable ICU 2.1 */
+    UCHAR_BINARY_LIMIT=57,
+
+    /** Enumerated property Bidi_Class.
+        Same as u_charDirection, returns UCharDirection values. @stable ICU 2.2 */
+    UCHAR_BIDI_CLASS=0x1000,
+    /** First constant for enumerated/integer Unicode properties. @stable ICU 2.2 */
+    UCHAR_INT_START=UCHAR_BIDI_CLASS,
+    /** Enumerated property Block.
+        Same as ublock_getCode, returns UBlockCode values. @stable ICU 2.2 */
+    UCHAR_BLOCK=0x1001,
+    /** Enumerated property Canonical_Combining_Class.
+        Same as u_getCombiningClass, returns 8-bit numeric values. @stable ICU 2.2 */
+    UCHAR_CANONICAL_COMBINING_CLASS=0x1002,
+    /** Enumerated property Decomposition_Type.
+        Returns UDecompositionType values. @stable ICU 2.2 */
+    UCHAR_DECOMPOSITION_TYPE=0x1003,
+    /** Enumerated property East_Asian_Width.
+        See http://www.unicode.org/reports/tr11/
+        Returns UEastAsianWidth values. @stable ICU 2.2 */
+    UCHAR_EAST_ASIAN_WIDTH=0x1004,
+    /** Enumerated property General_Category.
+        Same as u_charType, returns UCharCategory values. @stable ICU 2.2 */
+    UCHAR_GENERAL_CATEGORY=0x1005,
+    /** Enumerated property Joining_Group.
+        Returns UJoiningGroup values. @stable ICU 2.2 */
+    UCHAR_JOINING_GROUP=0x1006,
+    /** Enumerated property Joining_Type.
+        Returns UJoiningType values. @stable ICU 2.2 */
+    UCHAR_JOINING_TYPE=0x1007,
+    /** Enumerated property Line_Break.
+        Returns ULineBreak values. @stable ICU 2.2 */
+    UCHAR_LINE_BREAK=0x1008,
+    /** Enumerated property Numeric_Type.
+        Returns UNumericType values. @stable ICU 2.2 */
+    UCHAR_NUMERIC_TYPE=0x1009,
+    /** Enumerated property Script.
+        Same as uscript_getScript, returns UScriptCode values. @stable ICU 2.2 */
+    UCHAR_SCRIPT=0x100A,
+    /** Enumerated property Hangul_Syllable_Type, new in Unicode 4.
+        Returns UHangulSyllableType values. @stable ICU 2.6 */
+    UCHAR_HANGUL_SYLLABLE_TYPE=0x100B,
+    /** Enumerated property NFD_Quick_Check.
+        Returns UNormalizationCheckResult values. @stable ICU 3.0 */
+    UCHAR_NFD_QUICK_CHECK=0x100C,
+    /** Enumerated property NFKD_Quick_Check.
+        Returns UNormalizationCheckResult values. @stable ICU 3.0 */
+    UCHAR_NFKD_QUICK_CHECK=0x100D,
+    /** Enumerated property NFC_Quick_Check.
+        Returns UNormalizationCheckResult values. @stable ICU 3.0 */
+    UCHAR_NFC_QUICK_CHECK=0x100E,
+    /** Enumerated property NFKC_Quick_Check.
+        Returns UNormalizationCheckResult values. @stable ICU 3.0 */
+    UCHAR_NFKC_QUICK_CHECK=0x100F,
+    /** Enumerated property Lead_Canonical_Combining_Class.
+        ICU-specific property for the ccc of the first code point
+        of the decomposition, or lccc(c)=ccc(NFD(c)[0]).
+        Useful for checking for canonically ordered text;
+        see UNORM_FCD and http://www.unicode.org/notes/tn5/#FCD .
+        Returns 8-bit numeric values like UCHAR_CANONICAL_COMBINING_CLASS. @stable ICU 3.0 */
+    UCHAR_LEAD_CANONICAL_COMBINING_CLASS=0x1010,
+    /** Enumerated property Trail_Canonical_Combining_Class.
+        ICU-specific property for the ccc of the last code point
+        of the decomposition, or tccc(c)=ccc(NFD(c)[last]).
+        Useful for checking for canonically ordered text;
+        see UNORM_FCD and http://www.unicode.org/notes/tn5/#FCD .
+        Returns 8-bit numeric values like UCHAR_CANONICAL_COMBINING_CLASS. @stable ICU 3.0 */
+    UCHAR_TRAIL_CANONICAL_COMBINING_CLASS=0x1011,
+    /** Enumerated property Grapheme_Cluster_Break (new in Unicode 4.1).
+        Used in UAX #29: Text Boundaries
+        (http://www.unicode.org/reports/tr29/)
+        Returns UGraphemeClusterBreak values. @stable ICU 3.4 */
+    UCHAR_GRAPHEME_CLUSTER_BREAK=0x1012,
+    /** Enumerated property Sentence_Break (new in Unicode 4.1).
+        Used in UAX #29: Text Boundaries
+        (http://www.unicode.org/reports/tr29/)
+        Returns USentenceBreak values. @stable ICU 3.4 */
+    UCHAR_SENTENCE_BREAK=0x1013,
+    /** Enumerated property Word_Break (new in Unicode 4.1).
+        Used in UAX #29: Text Boundaries
+        (http://www.unicode.org/reports/tr29/)
+        Returns UWordBreakValues values. @stable ICU 3.4 */
+    UCHAR_WORD_BREAK=0x1014,
+    /** Enumerated property Bidi_Paired_Bracket_Type (new in Unicode 6.3).
+        Used in UAX #9: Unicode Bidirectional Algorithm
+        (http://www.unicode.org/reports/tr9/)
+        Returns UBidiPairedBracketType values. @stable ICU 52 */
+    UCHAR_BIDI_PAIRED_BRACKET_TYPE=0x1015,
+    /** One more than the last constant for enumerated/integer Unicode properties. @stable ICU 2.2 */
+    UCHAR_INT_LIMIT=0x1016,
+
+    /** Bitmask property General_Category_Mask.
+        This is the General_Category property returned as a bit mask.
+        When used in u_getIntPropertyValue(c), same as U_MASK(u_charType(c)),
+        returns bit masks for UCharCategory values where exactly one bit is set.
+        When used with u_getPropertyValueName() and u_getPropertyValueEnum(),
+        a multi-bit mask is used for sets of categories like "Letters".
+        Mask values should be cast to uint32_t.
+        @stable ICU 2.4 */
+    UCHAR_GENERAL_CATEGORY_MASK=0x2000,
+    /** First constant for bit-mask Unicode properties. @stable ICU 2.4 */
+    UCHAR_MASK_START=UCHAR_GENERAL_CATEGORY_MASK,
+    /** One more than the last constant for bit-mask Unicode properties. @stable ICU 2.4 */
+    UCHAR_MASK_LIMIT=0x2001,
+
+    /** Double property Numeric_Value.
+        Corresponds to u_getNumericValue. @stable ICU 2.4 */
+    UCHAR_NUMERIC_VALUE=0x3000,
+    /** First constant for double Unicode properties. @stable ICU 2.4 */
+    UCHAR_DOUBLE_START=UCHAR_NUMERIC_VALUE,
+    /** One more than the last constant for double Unicode properties. @stable ICU 2.4 */
+    UCHAR_DOUBLE_LIMIT=0x3001,
+
+    /** String property Age.
+        Corresponds to u_charAge. @stable ICU 2.4 */
+    UCHAR_AGE=0x4000,
+    /** First constant for string Unicode properties. @stable ICU 2.4 */
+    UCHAR_STRING_START=UCHAR_AGE,
+    /** String property Bidi_Mirroring_Glyph.
+        Corresponds to u_charMirror. @stable ICU 2.4 */
+    UCHAR_BIDI_MIRRORING_GLYPH=0x4001,
+    /** String property Case_Folding.
+        Corresponds to u_strFoldCase in ustring.h. @stable ICU 2.4 */
+    UCHAR_CASE_FOLDING=0x4002,
+#ifndef U_HIDE_DEPRECATED_API
+    /** Deprecated string property ISO_Comment.
+        Corresponds to u_getISOComment. @deprecated ICU 49 */
+    UCHAR_ISO_COMMENT=0x4003,
+#endif  /* U_HIDE_DEPRECATED_API */
+    /** String property Lowercase_Mapping.
+        Corresponds to u_strToLower in ustring.h. @stable ICU 2.4 */
+    UCHAR_LOWERCASE_MAPPING=0x4004,
+    /** String property Name.
+        Corresponds to u_charName. @stable ICU 2.4 */
+    UCHAR_NAME=0x4005,
+    /** String property Simple_Case_Folding.
+        Corresponds to u_foldCase. @stable ICU 2.4 */
+    UCHAR_SIMPLE_CASE_FOLDING=0x4006,
+    /** String property Simple_Lowercase_Mapping.
+        Corresponds to u_tolower. @stable ICU 2.4 */
+    UCHAR_SIMPLE_LOWERCASE_MAPPING=0x4007,
+    /** String property Simple_Titlecase_Mapping.
+        Corresponds to u_totitle. @stable ICU 2.4 */
+    UCHAR_SIMPLE_TITLECASE_MAPPING=0x4008,
+    /** String property Simple_Uppercase_Mapping.
+        Corresponds to u_toupper. @stable ICU 2.4 */
+    UCHAR_SIMPLE_UPPERCASE_MAPPING=0x4009,
+    /** String property Titlecase_Mapping.
+        Corresponds to u_strToTitle in ustring.h. @stable ICU 2.4 */
+    UCHAR_TITLECASE_MAPPING=0x400A,
+#ifndef U_HIDE_DEPRECATED_API
+    /** String property Unicode_1_Name.
+        This property is of little practical value.
+        Beginning with ICU 49, ICU APIs return an empty string for this property.
+        Corresponds to u_charName(U_UNICODE_10_CHAR_NAME). @deprecated ICU 49 */
+    UCHAR_UNICODE_1_NAME=0x400B,
+#endif  /* U_HIDE_DEPRECATED_API */
+    /** String property Uppercase_Mapping.
+        Corresponds to u_strToUpper in ustring.h. @stable ICU 2.4 */
+    UCHAR_UPPERCASE_MAPPING=0x400C,
+    /** String property Bidi_Paired_Bracket (new in Unicode 6.3).
+        Corresponds to u_getBidiPairedBracket. @stable ICU 52 */
+    UCHAR_BIDI_PAIRED_BRACKET=0x400D,
+    /** One more than the last constant for string Unicode properties. @stable ICU 2.4 */
+    UCHAR_STRING_LIMIT=0x400E,
+
+    /** Miscellaneous property Script_Extensions (new in Unicode 6.0).
+        Some characters are commonly used in multiple scripts.
+        For more information, see UAX #24: http://www.unicode.org/reports/tr24/.
+        Corresponds to uscript_hasScript and uscript_getScriptExtensions in uscript.h.
+        @stable ICU 4.6 */
+    UCHAR_SCRIPT_EXTENSIONS=0x7000,
+    /** First constant for Unicode properties with unusual value types. @stable ICU 4.6 */
+    UCHAR_OTHER_PROPERTY_START=UCHAR_SCRIPT_EXTENSIONS,
+    /** One more than the last constant for Unicode properties with unusual value types.
+     * @stable ICU 4.6 */
+    UCHAR_OTHER_PROPERTY_LIMIT=0x7001,
+    /** Represents a nonexistent or invalid property or property value. @stable ICU 2.4 */
+    UCHAR_INVALID_CODE = -1
+} UProperty;
+
+/**
+ * Data for enumerated Unicode general category types.
+ * See http://www.unicode.org/Public/UNIDATA/UnicodeData.html .
+ * @stable ICU 2.0
+ */
+typedef enum UCharCategory
+{
+    /*
+     * Note: UCharCategory constants and their API comments are parsed by preparseucd.py.
+     * It matches pairs of lines like
+     *     / ** <Unicode 2-letter General_Category value> comment... * /
+     *     U_<[A-Z_]+> = <integer>,
+     */
+
+    /** Non-category for unassigned and non-character code points. @stable ICU 2.0 */
+    U_UNASSIGNED              = 0,
+    /** Cn "Other, Not Assigned (no characters in [UnicodeData.txt] have this property)" (same as U_UNASSIGNED!) @stable ICU 2.0 */
+    U_GENERAL_OTHER_TYPES     = 0,
+    /** Lu @stable ICU 2.0 */
+    U_UPPERCASE_LETTER        = 1,
+    /** Ll @stable ICU 2.0 */
+    U_LOWERCASE_LETTER        = 2,
+    /** Lt @stable ICU 2.0 */
+    U_TITLECASE_LETTER        = 3,
+    /** Lm @stable ICU 2.0 */
+    U_MODIFIER_LETTER         = 4,
+    /** Lo @stable ICU 2.0 */
+    U_OTHER_LETTER            = 5,
+    /** Mn @stable ICU 2.0 */
+    U_NON_SPACING_MARK        = 6,
+    /** Me @stable ICU 2.0 */
+    U_ENCLOSING_MARK          = 7,
+    /** Mc @stable ICU 2.0 */
+    U_COMBINING_SPACING_MARK  = 8,
+    /** Nd @stable ICU 2.0 */
+    U_DECIMAL_DIGIT_NUMBER    = 9,
+    /** Nl @stable ICU 2.0 */
+    U_LETTER_NUMBER           = 10,
+    /** No @stable ICU 2.0 */
+    U_OTHER_NUMBER            = 11,
+    /** Zs @stable ICU 2.0 */
+    U_SPACE_SEPARATOR         = 12,
+    /** Zl @stable ICU 2.0 */
+    U_LINE_SEPARATOR          = 13,
+    /** Zp @stable ICU 2.0 */
+    U_PARAGRAPH_SEPARATOR     = 14,
+    /** Cc @stable ICU 2.0 */
+    U_CONTROL_CHAR            = 15,
+    /** Cf @stable ICU 2.0 */
+    U_FORMAT_CHAR             = 16,
+    /** Co @stable ICU 2.0 */
+    U_PRIVATE_USE_CHAR        = 17,
+    /** Cs @stable ICU 2.0 */
+    U_SURROGATE               = 18,
+    /** Pd @stable ICU 2.0 */
+    U_DASH_PUNCTUATION        = 19,
+    /** Ps @stable ICU 2.0 */
+    U_START_PUNCTUATION       = 20,
+    /** Pe @stable ICU 2.0 */
+    U_END_PUNCTUATION         = 21,
+    /** Pc @stable ICU 2.0 */
+    U_CONNECTOR_PUNCTUATION   = 22,
+    /** Po @stable ICU 2.0 */
+    U_OTHER_PUNCTUATION       = 23,
+    /** Sm @stable ICU 2.0 */
+    U_MATH_SYMBOL             = 24,
+    /** Sc @stable ICU 2.0 */
+    U_CURRENCY_SYMBOL         = 25,
+    /** Sk @stable ICU 2.0 */
+    U_MODIFIER_SYMBOL         = 26,
+    /** So @stable ICU 2.0 */
+    U_OTHER_SYMBOL            = 27,
+    /** Pi @stable ICU 2.0 */
+    U_INITIAL_PUNCTUATION     = 28,
+    /** Pf @stable ICU 2.0 */
+    U_FINAL_PUNCTUATION       = 29,
+    /** One higher than the last enum UCharCategory constant. @stable ICU 2.0 */
+    U_CHAR_CATEGORY_COUNT
+} UCharCategory;
+
+/**
+ * U_GC_XX_MASK constants are bit flags corresponding to Unicode
+ * general category values.
+ * For each category, the nth bit is set if the numeric value of the
+ * corresponding UCharCategory constant is n.
+ *
+ * There are also some U_GC_Y_MASK constants for groups of general categories
+ * like L for all letter categories.
+ *
+ * @see u_charType
+ * @see U_GET_GC_MASK
+ * @see UCharCategory
+ * @stable ICU 2.1
+ */
+#define U_GC_CN_MASK    U_MASK(U_GENERAL_OTHER_TYPES)
+
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_LU_MASK    U_MASK(U_UPPERCASE_LETTER)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_LL_MASK    U_MASK(U_LOWERCASE_LETTER)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_LT_MASK    U_MASK(U_TITLECASE_LETTER)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_LM_MASK    U_MASK(U_MODIFIER_LETTER)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_LO_MASK    U_MASK(U_OTHER_LETTER)
+
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_MN_MASK    U_MASK(U_NON_SPACING_MARK)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_ME_MASK    U_MASK(U_ENCLOSING_MARK)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_MC_MASK    U_MASK(U_COMBINING_SPACING_MARK)
+
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_ND_MASK    U_MASK(U_DECIMAL_DIGIT_NUMBER)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_NL_MASK    U_MASK(U_LETTER_NUMBER)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_NO_MASK    U_MASK(U_OTHER_NUMBER)
+
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_ZS_MASK    U_MASK(U_SPACE_SEPARATOR)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_ZL_MASK    U_MASK(U_LINE_SEPARATOR)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_ZP_MASK    U_MASK(U_PARAGRAPH_SEPARATOR)
+
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_CC_MASK    U_MASK(U_CONTROL_CHAR)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_CF_MASK    U_MASK(U_FORMAT_CHAR)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_CO_MASK    U_MASK(U_PRIVATE_USE_CHAR)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_CS_MASK    U_MASK(U_SURROGATE)
+
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_PD_MASK    U_MASK(U_DASH_PUNCTUATION)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_PS_MASK    U_MASK(U_START_PUNCTUATION)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_PE_MASK    U_MASK(U_END_PUNCTUATION)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_PC_MASK    U_MASK(U_CONNECTOR_PUNCTUATION)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_PO_MASK    U_MASK(U_OTHER_PUNCTUATION)
+
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_SM_MASK    U_MASK(U_MATH_SYMBOL)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_SC_MASK    U_MASK(U_CURRENCY_SYMBOL)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_SK_MASK    U_MASK(U_MODIFIER_SYMBOL)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_SO_MASK    U_MASK(U_OTHER_SYMBOL)
+
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_PI_MASK    U_MASK(U_INITIAL_PUNCTUATION)
+/** Mask constant for a UCharCategory. @stable ICU 2.1 */
+#define U_GC_PF_MASK    U_MASK(U_FINAL_PUNCTUATION)
+
+
+/** Mask constant for multiple UCharCategory bits (L Letters). @stable ICU 2.1 */
+#define U_GC_L_MASK \
+            (U_GC_LU_MASK|U_GC_LL_MASK|U_GC_LT_MASK|U_GC_LM_MASK|U_GC_LO_MASK)
+
+/** Mask constant for multiple UCharCategory bits (LC Cased Letters). @stable ICU 2.1 */
+#define U_GC_LC_MASK \
+            (U_GC_LU_MASK|U_GC_LL_MASK|U_GC_LT_MASK)
+
+/** Mask constant for multiple UCharCategory bits (M Marks). @stable ICU 2.1 */
+#define U_GC_M_MASK (U_GC_MN_MASK|U_GC_ME_MASK|U_GC_MC_MASK)
+
+/** Mask constant for multiple UCharCategory bits (N Numbers). @stable ICU 2.1 */
+#define U_GC_N_MASK (U_GC_ND_MASK|U_GC_NL_MASK|U_GC_NO_MASK)
+
+/** Mask constant for multiple UCharCategory bits (Z Separators). @stable ICU 2.1 */
+#define U_GC_Z_MASK (U_GC_ZS_MASK|U_GC_ZL_MASK|U_GC_ZP_MASK)
+
+/** Mask constant for multiple UCharCategory bits (C Others). @stable ICU 2.1 */
+#define U_GC_C_MASK \
+            (U_GC_CN_MASK|U_GC_CC_MASK|U_GC_CF_MASK|U_GC_CO_MASK|U_GC_CS_MASK)
+
+/** Mask constant for multiple UCharCategory bits (P Punctuation). @stable ICU 2.1 */
+#define U_GC_P_MASK \
+            (U_GC_PD_MASK|U_GC_PS_MASK|U_GC_PE_MASK|U_GC_PC_MASK|U_GC_PO_MASK| \
+             U_GC_PI_MASK|U_GC_PF_MASK)
+
+/** Mask constant for multiple UCharCategory bits (S Symbols). @stable ICU 2.1 */
+#define U_GC_S_MASK (U_GC_SM_MASK|U_GC_SC_MASK|U_GC_SK_MASK|U_GC_SO_MASK)
+
+/**
+ * This specifies the language directional property of a character set.
+ * @stable ICU 2.0
+ */
+typedef enum UCharDirection {
+    /*
+     * Note: UCharDirection constants and their API comments are parsed by preparseucd.py.
+     * It matches pairs of lines like
+     *     / ** <Unicode 1..3-letter Bidi_Class value> comment... * /
+     *     U_<[A-Z_]+> = <integer>,
+     */
+
+    /** L @stable ICU 2.0 */
+    U_LEFT_TO_RIGHT               = 0,
+    /** R @stable ICU 2.0 */
+    U_RIGHT_TO_LEFT               = 1,
+    /** EN @stable ICU 2.0 */
+    U_EUROPEAN_NUMBER             = 2,
+    /** ES @stable ICU 2.0 */
+    U_EUROPEAN_NUMBER_SEPARATOR   = 3,
+    /** ET @stable ICU 2.0 */
+    U_EUROPEAN_NUMBER_TERMINATOR  = 4,
+    /** AN @stable ICU 2.0 */
+    U_ARABIC_NUMBER               = 5,
+    /** CS @stable ICU 2.0 */
+    U_COMMON_NUMBER_SEPARATOR     = 6,
+    /** B @stable ICU 2.0 */
+    U_BLOCK_SEPARATOR             = 7,
+    /** S @stable ICU 2.0 */
+    U_SEGMENT_SEPARATOR           = 8,
+    /** WS @stable ICU 2.0 */
+    U_WHITE_SPACE_NEUTRAL         = 9,
+    /** ON @stable ICU 2.0 */
+    U_OTHER_NEUTRAL               = 10,
+    /** LRE @stable ICU 2.0 */
+    U_LEFT_TO_RIGHT_EMBEDDING     = 11,
+    /** LRO @stable ICU 2.0 */
+    U_LEFT_TO_RIGHT_OVERRIDE      = 12,
+    /** AL @stable ICU 2.0 */
+    U_RIGHT_TO_LEFT_ARABIC        = 13,
+    /** RLE @stable ICU 2.0 */
+    U_RIGHT_TO_LEFT_EMBEDDING     = 14,
+    /** RLO @stable ICU 2.0 */
+    U_RIGHT_TO_LEFT_OVERRIDE      = 15,
+    /** PDF @stable ICU 2.0 */
+    U_POP_DIRECTIONAL_FORMAT      = 16,
+    /** NSM @stable ICU 2.0 */
+    U_DIR_NON_SPACING_MARK        = 17,
+    /** BN @stable ICU 2.0 */
+    U_BOUNDARY_NEUTRAL            = 18,
+    /** FSI @stable ICU 52 */
+    U_FIRST_STRONG_ISOLATE        = 19,
+    /** LRI @stable ICU 52 */
+    U_LEFT_TO_RIGHT_ISOLATE       = 20,
+    /** RLI @stable ICU 52 */
+    U_RIGHT_TO_LEFT_ISOLATE       = 21,
+    /** PDI @stable ICU 52 */
+    U_POP_DIRECTIONAL_ISOLATE     = 22,
+    /** @stable ICU 2.0 */
+    U_CHAR_DIRECTION_COUNT
+} UCharDirection;
+
+/**
+ * Bidi Paired Bracket Type constants.
+ *
+ * @see UCHAR_BIDI_PAIRED_BRACKET_TYPE
+ * @stable ICU 52
+ */
+typedef enum UBidiPairedBracketType {
+    /*
+     * Note: UBidiPairedBracketType constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_BPT_<Unicode Bidi_Paired_Bracket_Type value name>
+     */
+
+    /** Not a paired bracket. @stable ICU 52 */
+    U_BPT_NONE,
+    /** Open paired bracket. @stable ICU 52 */
+    U_BPT_OPEN,
+    /** Close paired bracket. @stable ICU 52 */
+    U_BPT_CLOSE,
+    /** @stable ICU 52 */
+    U_BPT_COUNT /* 3 */
+} UBidiPairedBracketType;
+
+/**
+ * Constants for Unicode blocks, see the Unicode Data file Blocks.txt
+ * @stable ICU 2.0
+ */
+enum UBlockCode {
+    /*
+     * Note: UBlockCode constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     UBLOCK_<Unicode Block value name> = <integer>,
+     */
+
+    /** New No_Block value in Unicode 4. @stable ICU 2.6 */
+    UBLOCK_NO_BLOCK = 0, /*[none]*/ /* Special range indicating No_Block */
+
+    /** @stable ICU 2.0 */
+    UBLOCK_BASIC_LATIN = 1, /*[0000]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_LATIN_1_SUPPLEMENT=2, /*[0080]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_LATIN_EXTENDED_A =3, /*[0100]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_LATIN_EXTENDED_B =4, /*[0180]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_IPA_EXTENSIONS =5, /*[0250]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_SPACING_MODIFIER_LETTERS =6, /*[02B0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_COMBINING_DIACRITICAL_MARKS =7, /*[0300]*/
+
+    /**
+     * Unicode 3.2 renames this block to "Greek and Coptic".
+     * @stable ICU 2.0
+     */
+    UBLOCK_GREEK =8, /*[0370]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CYRILLIC =9, /*[0400]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ARMENIAN =10, /*[0530]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_HEBREW =11, /*[0590]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ARABIC =12, /*[0600]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_SYRIAC =13, /*[0700]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_THAANA =14, /*[0780]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_DEVANAGARI =15, /*[0900]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_BENGALI =16, /*[0980]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_GURMUKHI =17, /*[0A00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_GUJARATI =18, /*[0A80]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ORIYA =19, /*[0B00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_TAMIL =20, /*[0B80]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_TELUGU =21, /*[0C00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_KANNADA =22, /*[0C80]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_MALAYALAM =23, /*[0D00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_SINHALA =24, /*[0D80]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_THAI =25, /*[0E00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_LAO =26, /*[0E80]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_TIBETAN =27, /*[0F00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_MYANMAR =28, /*[1000]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_GEORGIAN =29, /*[10A0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_HANGUL_JAMO =30, /*[1100]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ETHIOPIC =31, /*[1200]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CHEROKEE =32, /*[13A0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_UNIFIED_CANADIAN_ABORIGINAL_SYLLABICS =33, /*[1400]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_OGHAM =34, /*[1680]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_RUNIC =35, /*[16A0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_KHMER =36, /*[1780]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_MONGOLIAN =37, /*[1800]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_LATIN_EXTENDED_ADDITIONAL =38, /*[1E00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_GREEK_EXTENDED =39, /*[1F00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_GENERAL_PUNCTUATION =40, /*[2000]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_SUPERSCRIPTS_AND_SUBSCRIPTS =41, /*[2070]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CURRENCY_SYMBOLS =42, /*[20A0]*/
+
+    /**
+     * Unicode 3.2 renames this block to "Combining Diacritical Marks for Symbols".
+     * @stable ICU 2.0
+     */
+    UBLOCK_COMBINING_MARKS_FOR_SYMBOLS =43, /*[20D0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_LETTERLIKE_SYMBOLS =44, /*[2100]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_NUMBER_FORMS =45, /*[2150]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ARROWS =46, /*[2190]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_MATHEMATICAL_OPERATORS =47, /*[2200]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_MISCELLANEOUS_TECHNICAL =48, /*[2300]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CONTROL_PICTURES =49, /*[2400]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_OPTICAL_CHARACTER_RECOGNITION =50, /*[2440]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ENCLOSED_ALPHANUMERICS =51, /*[2460]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_BOX_DRAWING =52, /*[2500]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_BLOCK_ELEMENTS =53, /*[2580]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_GEOMETRIC_SHAPES =54, /*[25A0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_MISCELLANEOUS_SYMBOLS =55, /*[2600]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_DINGBATS =56, /*[2700]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_BRAILLE_PATTERNS =57, /*[2800]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_RADICALS_SUPPLEMENT =58, /*[2E80]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_KANGXI_RADICALS =59, /*[2F00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_IDEOGRAPHIC_DESCRIPTION_CHARACTERS =60, /*[2FF0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_SYMBOLS_AND_PUNCTUATION =61, /*[3000]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_HIRAGANA =62, /*[3040]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_KATAKANA =63, /*[30A0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_BOPOMOFO =64, /*[3100]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_HANGUL_COMPATIBILITY_JAMO =65, /*[3130]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_KANBUN =66, /*[3190]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_BOPOMOFO_EXTENDED =67, /*[31A0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ENCLOSED_CJK_LETTERS_AND_MONTHS =68, /*[3200]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_COMPATIBILITY =69, /*[3300]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_UNIFIED_IDEOGRAPHS_EXTENSION_A =70, /*[3400]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_UNIFIED_IDEOGRAPHS =71, /*[4E00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_YI_SYLLABLES =72, /*[A000]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_YI_RADICALS =73, /*[A490]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_HANGUL_SYLLABLES =74, /*[AC00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_HIGH_SURROGATES =75, /*[D800]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_HIGH_PRIVATE_USE_SURROGATES =76, /*[DB80]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_LOW_SURROGATES =77, /*[DC00]*/
+
+    /**
+     * Same as UBLOCK_PRIVATE_USE.
+     * Until Unicode 3.1.1, the corresponding block name was "Private Use",
+     * and multiple code point ranges had this block.
+     * Unicode 3.2 renames the block for the BMP PUA to "Private Use Area" and
+     * adds separate blocks for the supplementary PUAs.
+     *
+     * @stable ICU 2.0
+     */
+    UBLOCK_PRIVATE_USE_AREA =78, /*[E000]*/
+    /**
+     * Same as UBLOCK_PRIVATE_USE_AREA.
+     * Until Unicode 3.1.1, the corresponding block name was "Private Use",
+     * and multiple code point ranges had this block.
+     * Unicode 3.2 renames the block for the BMP PUA to "Private Use Area" and
+     * adds separate blocks for the supplementary PUAs.
+     *
+     * @stable ICU 2.0
+     */
+    UBLOCK_PRIVATE_USE = UBLOCK_PRIVATE_USE_AREA,
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_COMPATIBILITY_IDEOGRAPHS =79, /*[F900]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ALPHABETIC_PRESENTATION_FORMS =80, /*[FB00]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ARABIC_PRESENTATION_FORMS_A =81, /*[FB50]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_COMBINING_HALF_MARKS =82, /*[FE20]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_COMPATIBILITY_FORMS =83, /*[FE30]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_SMALL_FORM_VARIANTS =84, /*[FE50]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_ARABIC_PRESENTATION_FORMS_B =85, /*[FE70]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_SPECIALS =86, /*[FFF0]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_HALFWIDTH_AND_FULLWIDTH_FORMS =87, /*[FF00]*/
+
+    /* New blocks in Unicode 3.1 */
+
+    /** @stable ICU 2.0 */
+    UBLOCK_OLD_ITALIC = 88, /*[10300]*/
+    /** @stable ICU 2.0 */
+    UBLOCK_GOTHIC = 89, /*[10330]*/
+    /** @stable ICU 2.0 */
+    UBLOCK_DESERET = 90, /*[10400]*/
+    /** @stable ICU 2.0 */
+    UBLOCK_BYZANTINE_MUSICAL_SYMBOLS = 91, /*[1D000]*/
+    /** @stable ICU 2.0 */
+    UBLOCK_MUSICAL_SYMBOLS = 92, /*[1D100]*/
+    /** @stable ICU 2.0 */
+    UBLOCK_MATHEMATICAL_ALPHANUMERIC_SYMBOLS = 93, /*[1D400]*/
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_UNIFIED_IDEOGRAPHS_EXTENSION_B  = 94, /*[20000]*/
+    /** @stable ICU 2.0 */
+    UBLOCK_CJK_COMPATIBILITY_IDEOGRAPHS_SUPPLEMENT = 95, /*[2F800]*/
+    /** @stable ICU 2.0 */
+    UBLOCK_TAGS = 96, /*[E0000]*/
+
+    /* New blocks in Unicode 3.2 */
+
+    /** @stable ICU 3.0  */
+    UBLOCK_CYRILLIC_SUPPLEMENT = 97, /*[0500]*/
+    /**
+     * Unicode 4.0.1 renames the "Cyrillic Supplementary" block to "Cyrillic Supplement".
+     * @stable ICU 2.2
+     */
+    UBLOCK_CYRILLIC_SUPPLEMENTARY = UBLOCK_CYRILLIC_SUPPLEMENT, 
+    /** @stable ICU 2.2 */
+    UBLOCK_TAGALOG = 98, /*[1700]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_HANUNOO = 99, /*[1720]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_BUHID = 100, /*[1740]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_TAGBANWA = 101, /*[1760]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_MISCELLANEOUS_MATHEMATICAL_SYMBOLS_A = 102, /*[27C0]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_SUPPLEMENTAL_ARROWS_A = 103, /*[27F0]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_SUPPLEMENTAL_ARROWS_B = 104, /*[2900]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_MISCELLANEOUS_MATHEMATICAL_SYMBOLS_B = 105, /*[2980]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_SUPPLEMENTAL_MATHEMATICAL_OPERATORS = 106, /*[2A00]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_KATAKANA_PHONETIC_EXTENSIONS = 107, /*[31F0]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_VARIATION_SELECTORS = 108, /*[FE00]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_SUPPLEMENTARY_PRIVATE_USE_AREA_A = 109, /*[F0000]*/
+    /** @stable ICU 2.2 */
+    UBLOCK_SUPPLEMENTARY_PRIVATE_USE_AREA_B = 110, /*[100000]*/
+
+    /* New blocks in Unicode 4 */
+
+    /** @stable ICU 2.6 */
+    UBLOCK_LIMBU = 111, /*[1900]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_TAI_LE = 112, /*[1950]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_KHMER_SYMBOLS = 113, /*[19E0]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_PHONETIC_EXTENSIONS = 114, /*[1D00]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_MISCELLANEOUS_SYMBOLS_AND_ARROWS = 115, /*[2B00]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_YIJING_HEXAGRAM_SYMBOLS = 116, /*[4DC0]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_LINEAR_B_SYLLABARY = 117, /*[10000]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_LINEAR_B_IDEOGRAMS = 118, /*[10080]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_AEGEAN_NUMBERS = 119, /*[10100]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_UGARITIC = 120, /*[10380]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_SHAVIAN = 121, /*[10450]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_OSMANYA = 122, /*[10480]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_CYPRIOT_SYLLABARY = 123, /*[10800]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_TAI_XUAN_JING_SYMBOLS = 124, /*[1D300]*/
+    /** @stable ICU 2.6 */
+    UBLOCK_VARIATION_SELECTORS_SUPPLEMENT = 125, /*[E0100]*/
+
+    /* New blocks in Unicode 4.1 */
+
+    /** @stable ICU 3.4 */
+    UBLOCK_ANCIENT_GREEK_MUSICAL_NOTATION = 126, /*[1D200]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_ANCIENT_GREEK_NUMBERS = 127, /*[10140]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_ARABIC_SUPPLEMENT = 128, /*[0750]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_BUGINESE = 129, /*[1A00]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_CJK_STROKES = 130, /*[31C0]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_COMBINING_DIACRITICAL_MARKS_SUPPLEMENT = 131, /*[1DC0]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_COPTIC = 132, /*[2C80]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_ETHIOPIC_EXTENDED = 133, /*[2D80]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_ETHIOPIC_SUPPLEMENT = 134, /*[1380]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_GEORGIAN_SUPPLEMENT = 135, /*[2D00]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_GLAGOLITIC = 136, /*[2C00]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_KHAROSHTHI = 137, /*[10A00]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_MODIFIER_TONE_LETTERS = 138, /*[A700]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_NEW_TAI_LUE = 139, /*[1980]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_OLD_PERSIAN = 140, /*[103A0]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_PHONETIC_EXTENSIONS_SUPPLEMENT = 141, /*[1D80]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_SUPPLEMENTAL_PUNCTUATION = 142, /*[2E00]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_SYLOTI_NAGRI = 143, /*[A800]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_TIFINAGH = 144, /*[2D30]*/
+    /** @stable ICU 3.4 */
+    UBLOCK_VERTICAL_FORMS = 145, /*[FE10]*/
+
+    /* New blocks in Unicode 5.0 */
+
+    /** @stable ICU 3.6 */
+    UBLOCK_NKO = 146, /*[07C0]*/
+    /** @stable ICU 3.6 */
+    UBLOCK_BALINESE = 147, /*[1B00]*/
+    /** @stable ICU 3.6 */
+    UBLOCK_LATIN_EXTENDED_C = 148, /*[2C60]*/
+    /** @stable ICU 3.6 */
+    UBLOCK_LATIN_EXTENDED_D = 149, /*[A720]*/
+    /** @stable ICU 3.6 */
+    UBLOCK_PHAGS_PA = 150, /*[A840]*/
+    /** @stable ICU 3.6 */
+    UBLOCK_PHOENICIAN = 151, /*[10900]*/
+    /** @stable ICU 3.6 */
+    UBLOCK_CUNEIFORM = 152, /*[12000]*/
+    /** @stable ICU 3.6 */
+    UBLOCK_CUNEIFORM_NUMBERS_AND_PUNCTUATION = 153, /*[12400]*/
+    /** @stable ICU 3.6 */
+    UBLOCK_COUNTING_ROD_NUMERALS = 154, /*[1D360]*/
+
+    /* New blocks in Unicode 5.1 */
+
+    /** @stable ICU 4.0 */
+    UBLOCK_SUNDANESE = 155, /*[1B80]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_LEPCHA = 156, /*[1C00]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_OL_CHIKI = 157, /*[1C50]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_CYRILLIC_EXTENDED_A = 158, /*[2DE0]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_VAI = 159, /*[A500]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_CYRILLIC_EXTENDED_B = 160, /*[A640]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_SAURASHTRA = 161, /*[A880]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_KAYAH_LI = 162, /*[A900]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_REJANG = 163, /*[A930]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_CHAM = 164, /*[AA00]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_ANCIENT_SYMBOLS = 165, /*[10190]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_PHAISTOS_DISC = 166, /*[101D0]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_LYCIAN = 167, /*[10280]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_CARIAN = 168, /*[102A0]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_LYDIAN = 169, /*[10920]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_MAHJONG_TILES = 170, /*[1F000]*/
+    /** @stable ICU 4.0 */
+    UBLOCK_DOMINO_TILES = 171, /*[1F030]*/
+
+    /* New blocks in Unicode 5.2 */
+
+    /** @stable ICU 4.4 */
+    UBLOCK_SAMARITAN = 172, /*[0800]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_UNIFIED_CANADIAN_ABORIGINAL_SYLLABICS_EXTENDED = 173, /*[18B0]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_TAI_THAM = 174, /*[1A20]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_VEDIC_EXTENSIONS = 175, /*[1CD0]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_LISU = 176, /*[A4D0]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_BAMUM = 177, /*[A6A0]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_COMMON_INDIC_NUMBER_FORMS = 178, /*[A830]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_DEVANAGARI_EXTENDED = 179, /*[A8E0]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_HANGUL_JAMO_EXTENDED_A = 180, /*[A960]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_JAVANESE = 181, /*[A980]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_MYANMAR_EXTENDED_A = 182, /*[AA60]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_TAI_VIET = 183, /*[AA80]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_MEETEI_MAYEK = 184, /*[ABC0]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_HANGUL_JAMO_EXTENDED_B = 185, /*[D7B0]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_IMPERIAL_ARAMAIC = 186, /*[10840]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_OLD_SOUTH_ARABIAN = 187, /*[10A60]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_AVESTAN = 188, /*[10B00]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_INSCRIPTIONAL_PARTHIAN = 189, /*[10B40]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_INSCRIPTIONAL_PAHLAVI = 190, /*[10B60]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_OLD_TURKIC = 191, /*[10C00]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_RUMI_NUMERAL_SYMBOLS = 192, /*[10E60]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_KAITHI = 193, /*[11080]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_EGYPTIAN_HIEROGLYPHS = 194, /*[13000]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_ENCLOSED_ALPHANUMERIC_SUPPLEMENT = 195, /*[1F100]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_ENCLOSED_IDEOGRAPHIC_SUPPLEMENT = 196, /*[1F200]*/
+    /** @stable ICU 4.4 */
+    UBLOCK_CJK_UNIFIED_IDEOGRAPHS_EXTENSION_C = 197, /*[2A700]*/
+
+    /* New blocks in Unicode 6.0 */
+
+    /** @stable ICU 4.6 */
+    UBLOCK_MANDAIC = 198, /*[0840]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_BATAK = 199, /*[1BC0]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_ETHIOPIC_EXTENDED_A = 200, /*[AB00]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_BRAHMI = 201, /*[11000]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_BAMUM_SUPPLEMENT = 202, /*[16800]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_KANA_SUPPLEMENT = 203, /*[1B000]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_PLAYING_CARDS = 204, /*[1F0A0]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_MISCELLANEOUS_SYMBOLS_AND_PICTOGRAPHS = 205, /*[1F300]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_EMOTICONS = 206, /*[1F600]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_TRANSPORT_AND_MAP_SYMBOLS = 207, /*[1F680]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_ALCHEMICAL_SYMBOLS = 208, /*[1F700]*/
+    /** @stable ICU 4.6 */
+    UBLOCK_CJK_UNIFIED_IDEOGRAPHS_EXTENSION_D = 209, /*[2B740]*/
+
+    /* New blocks in Unicode 6.1 */
+
+    /** @stable ICU 49 */
+    UBLOCK_ARABIC_EXTENDED_A = 210, /*[08A0]*/
+    /** @stable ICU 49 */
+    UBLOCK_ARABIC_MATHEMATICAL_ALPHABETIC_SYMBOLS = 211, /*[1EE00]*/
+    /** @stable ICU 49 */
+    UBLOCK_CHAKMA = 212, /*[11100]*/
+    /** @stable ICU 49 */
+    UBLOCK_MEETEI_MAYEK_EXTENSIONS = 213, /*[AAE0]*/
+    /** @stable ICU 49 */
+    UBLOCK_MEROITIC_CURSIVE = 214, /*[109A0]*/
+    /** @stable ICU 49 */
+    UBLOCK_MEROITIC_HIEROGLYPHS = 215, /*[10980]*/
+    /** @stable ICU 49 */
+    UBLOCK_MIAO = 216, /*[16F00]*/
+    /** @stable ICU 49 */
+    UBLOCK_SHARADA = 217, /*[11180]*/
+    /** @stable ICU 49 */
+    UBLOCK_SORA_SOMPENG = 218, /*[110D0]*/
+    /** @stable ICU 49 */
+    UBLOCK_SUNDANESE_SUPPLEMENT = 219, /*[1CC0]*/
+    /** @stable ICU 49 */
+    UBLOCK_TAKRI = 220, /*[11680]*/
+
+    /** @stable ICU 2.0 */
+    UBLOCK_COUNT = 221,
+
+    /** @stable ICU 2.0 */
+    UBLOCK_INVALID_CODE=-1
+};
+
+/** @stable ICU 2.0 */
+typedef enum UBlockCode UBlockCode;
+
+/**
+ * East Asian Width constants.
+ *
+ * @see UCHAR_EAST_ASIAN_WIDTH
+ * @see u_getIntPropertyValue
+ * @stable ICU 2.2
+ */
+typedef enum UEastAsianWidth {
+    /*
+     * Note: UEastAsianWidth constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_EA_<Unicode East_Asian_Width value name>
+     */
+
+    U_EA_NEUTRAL,   /*[N]*/
+    U_EA_AMBIGUOUS, /*[A]*/
+    U_EA_HALFWIDTH, /*[H]*/
+    U_EA_FULLWIDTH, /*[F]*/
+    U_EA_NARROW,    /*[Na]*/
+    U_EA_WIDE,      /*[W]*/
+    U_EA_COUNT
+} UEastAsianWidth;
+
+/**
+ * Selector constants for u_charName().
+ * u_charName() returns the "modern" name of a
+ * Unicode character; or the name that was defined in
+ * Unicode version 1.0, before the Unicode standard merged
+ * with ISO-10646; or an "extended" name that gives each
+ * Unicode code point a unique name.
+ *
+ * @see u_charName
+ * @stable ICU 2.0
+ */
+typedef enum UCharNameChoice {
+    /** Unicode character name (Name property). @stable ICU 2.0 */
+    U_UNICODE_CHAR_NAME,
+#ifndef U_HIDE_DEPRECATED_API 
+    /**
+     * The Unicode_1_Name property value which is of little practical value.
+     * Beginning with ICU 49, ICU APIs return an empty string for this name choice.
+     * @deprecated ICU 49
+     */
+    U_UNICODE_10_CHAR_NAME,
+#endif  /* U_HIDE_DEPRECATED_API */
+    /** Standard or synthetic character name. @stable ICU 2.0 */
+    U_EXTENDED_CHAR_NAME = U_UNICODE_CHAR_NAME+2,
+    /** Corrected name from NameAliases.txt. @stable ICU 4.4 */
+    U_CHAR_NAME_ALIAS,
+    /** @stable ICU 2.0 */
+    U_CHAR_NAME_CHOICE_COUNT
+} UCharNameChoice;
+
+/**
+ * Selector constants for u_getPropertyName() and
+ * u_getPropertyValueName().  These selectors are used to choose which
+ * name is returned for a given property or value.  All properties and
+ * values have a long name.  Most have a short name, but some do not.
+ * Unicode allows for additional names, beyond the long and short
+ * name, which would be indicated by U_LONG_PROPERTY_NAME + i, where
+ * i=1, 2,...
+ *
+ * @see u_getPropertyName()
+ * @see u_getPropertyValueName()
+ * @stable ICU 2.4
+ */
+typedef enum UPropertyNameChoice {
+    U_SHORT_PROPERTY_NAME,
+    U_LONG_PROPERTY_NAME,
+    U_PROPERTY_NAME_CHOICE_COUNT
+} UPropertyNameChoice;
+
+/**
+ * Decomposition Type constants.
+ *
+ * @see UCHAR_DECOMPOSITION_TYPE
+ * @stable ICU 2.2
+ */
+typedef enum UDecompositionType {
+    /*
+     * Note: UDecompositionType constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_DT_<Unicode Decomposition_Type value name>
+     */
+
+    U_DT_NONE,              /*[none]*/
+    U_DT_CANONICAL,         /*[can]*/
+    U_DT_COMPAT,            /*[com]*/
+    U_DT_CIRCLE,            /*[enc]*/
+    U_DT_FINAL,             /*[fin]*/
+    U_DT_FONT,              /*[font]*/
+    U_DT_FRACTION,          /*[fra]*/
+    U_DT_INITIAL,           /*[init]*/
+    U_DT_ISOLATED,          /*[iso]*/
+    U_DT_MEDIAL,            /*[med]*/
+    U_DT_NARROW,            /*[nar]*/
+    U_DT_NOBREAK,           /*[nb]*/
+    U_DT_SMALL,             /*[sml]*/
+    U_DT_SQUARE,            /*[sqr]*/
+    U_DT_SUB,               /*[sub]*/
+    U_DT_SUPER,             /*[sup]*/
+    U_DT_VERTICAL,          /*[vert]*/
+    U_DT_WIDE,              /*[wide]*/
+    U_DT_COUNT /* 18 */
+} UDecompositionType;
+
+/**
+ * Joining Type constants.
+ *
+ * @see UCHAR_JOINING_TYPE
+ * @stable ICU 2.2
+ */
+typedef enum UJoiningType {
+    /*
+     * Note: UJoiningType constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_JT_<Unicode Joining_Type value name>
+     */
+
+    U_JT_NON_JOINING,       /*[U]*/
+    U_JT_JOIN_CAUSING,      /*[C]*/
+    U_JT_DUAL_JOINING,      /*[D]*/
+    U_JT_LEFT_JOINING,      /*[L]*/
+    U_JT_RIGHT_JOINING,     /*[R]*/
+    U_JT_TRANSPARENT,       /*[T]*/
+    U_JT_COUNT /* 6 */
+} UJoiningType;
+
+/**
+ * Joining Group constants.
+ *
+ * @see UCHAR_JOINING_GROUP
+ * @stable ICU 2.2
+ */
+typedef enum UJoiningGroup {
+    /*
+     * Note: UJoiningGroup constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_JG_<Unicode Joining_Group value name>
+     */
+
+    U_JG_NO_JOINING_GROUP,
+    U_JG_AIN,
+    U_JG_ALAPH,
+    U_JG_ALEF,
+    U_JG_BEH,
+    U_JG_BETH,
+    U_JG_DAL,
+    U_JG_DALATH_RISH,
+    U_JG_E,
+    U_JG_FEH,
+    U_JG_FINAL_SEMKATH,
+    U_JG_GAF,
+    U_JG_GAMAL,
+    U_JG_HAH,
+    U_JG_TEH_MARBUTA_GOAL,  /**< @stable ICU 4.6 */
+    U_JG_HAMZA_ON_HEH_GOAL=U_JG_TEH_MARBUTA_GOAL,
+    U_JG_HE,
+    U_JG_HEH,
+    U_JG_HEH_GOAL,
+    U_JG_HETH,
+    U_JG_KAF,
+    U_JG_KAPH,
+    U_JG_KNOTTED_HEH,
+    U_JG_LAM,
+    U_JG_LAMADH,
+    U_JG_MEEM,
+    U_JG_MIM,
+    U_JG_NOON,
+    U_JG_NUN,
+    U_JG_PE,
+    U_JG_QAF,
+    U_JG_QAPH,
+    U_JG_REH,
+    U_JG_REVERSED_PE,
+    U_JG_SAD,
+    U_JG_SADHE,
+    U_JG_SEEN,
+    U_JG_SEMKATH,
+    U_JG_SHIN,
+    U_JG_SWASH_KAF,
+    U_JG_SYRIAC_WAW,
+    U_JG_TAH,
+    U_JG_TAW,
+    U_JG_TEH_MARBUTA,
+    U_JG_TETH,
+    U_JG_WAW,
+    U_JG_YEH,
+    U_JG_YEH_BARREE,
+    U_JG_YEH_WITH_TAIL,
+    U_JG_YUDH,
+    U_JG_YUDH_HE,
+    U_JG_ZAIN,
+    U_JG_FE,        /**< @stable ICU 2.6 */
+    U_JG_KHAPH,     /**< @stable ICU 2.6 */
+    U_JG_ZHAIN,     /**< @stable ICU 2.6 */
+    U_JG_BURUSHASKI_YEH_BARREE, /**< @stable ICU 4.0 */
+    U_JG_FARSI_YEH, /**< @stable ICU 4.4 */
+    U_JG_NYA,       /**< @stable ICU 4.4 */
+    U_JG_ROHINGYA_YEH,  /**< @stable ICU 49 */
+    U_JG_COUNT
+} UJoiningGroup;
+
+/**
+ * Grapheme Cluster Break constants.
+ *
+ * @see UCHAR_GRAPHEME_CLUSTER_BREAK
+ * @stable ICU 3.4
+ */
+typedef enum UGraphemeClusterBreak {
+    /*
+     * Note: UGraphemeClusterBreak constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_GCB_<Unicode Grapheme_Cluster_Break value name>
+     */
+
+    U_GCB_OTHER = 0,            /*[XX]*/
+    U_GCB_CONTROL = 1,          /*[CN]*/
+    U_GCB_CR = 2,               /*[CR]*/
+    U_GCB_EXTEND = 3,           /*[EX]*/
+    U_GCB_L = 4,                /*[L]*/
+    U_GCB_LF = 5,               /*[LF]*/
+    U_GCB_LV = 6,               /*[LV]*/
+    U_GCB_LVT = 7,              /*[LVT]*/
+    U_GCB_T = 8,                /*[T]*/
+    U_GCB_V = 9,                /*[V]*/
+    U_GCB_SPACING_MARK = 10,    /*[SM]*/ /* from here on: new in Unicode 5.1/ICU 4.0 */
+    U_GCB_PREPEND = 11,         /*[PP]*/
+    U_GCB_REGIONAL_INDICATOR = 12,  /*[RI]*/ /* new in Unicode 6.2/ICU 50 */
+    U_GCB_COUNT = 13
+} UGraphemeClusterBreak;
+
+/**
+ * Word Break constants.
+ * (UWordBreak is a pre-existing enum type in ubrk.h for word break status tags.)
+ *
+ * @see UCHAR_WORD_BREAK
+ * @stable ICU 3.4
+ */
+typedef enum UWordBreakValues {
+    /*
+     * Note: UWordBreakValues constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_WB_<Unicode Word_Break value name>
+     */
+
+    U_WB_OTHER = 0,             /*[XX]*/
+    U_WB_ALETTER = 1,           /*[LE]*/
+    U_WB_FORMAT = 2,            /*[FO]*/
+    U_WB_KATAKANA = 3,          /*[KA]*/
+    U_WB_MIDLETTER = 4,         /*[ML]*/
+    U_WB_MIDNUM = 5,            /*[MN]*/
+    U_WB_NUMERIC = 6,           /*[NU]*/
+    U_WB_EXTENDNUMLET = 7,      /*[EX]*/
+    U_WB_CR = 8,                /*[CR]*/ /* from here on: new in Unicode 5.1/ICU 4.0 */
+    U_WB_EXTEND = 9,            /*[Extend]*/
+    U_WB_LF = 10,               /*[LF]*/
+    U_WB_MIDNUMLET =11,         /*[MB]*/
+    U_WB_NEWLINE =12,           /*[NL]*/
+    U_WB_REGIONAL_INDICATOR = 13,   /*[RI]*/ /* new in Unicode 6.2/ICU 50 */
+    U_WB_HEBREW_LETTER = 14,    /*[HL]*/ /* from here on: new in Unicode 6.3/ICU 52 */
+    U_WB_SINGLE_QUOTE = 15,     /*[SQ]*/
+    U_WB_DOUBLE_QUOTE = 16,     /*[DQ]*/
+    U_WB_COUNT = 17
+} UWordBreakValues;
+
+/**
+ * Sentence Break constants.
+ *
+ * @see UCHAR_SENTENCE_BREAK
+ * @stable ICU 3.4
+ */
+typedef enum USentenceBreak {
+    /*
+     * Note: USentenceBreak constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_SB_<Unicode Sentence_Break value name>
+     */
+
+    U_SB_OTHER = 0,             /*[XX]*/
+    U_SB_ATERM = 1,             /*[AT]*/
+    U_SB_CLOSE = 2,             /*[CL]*/
+    U_SB_FORMAT = 3,            /*[FO]*/
+    U_SB_LOWER = 4,             /*[LO]*/
+    U_SB_NUMERIC = 5,           /*[NU]*/
+    U_SB_OLETTER = 6,           /*[LE]*/
+    U_SB_SEP = 7,               /*[SE]*/
+    U_SB_SP = 8,                /*[SP]*/
+    U_SB_STERM = 9,             /*[ST]*/
+    U_SB_UPPER = 10,            /*[UP]*/
+    U_SB_CR = 11,               /*[CR]*/ /* from here on: new in Unicode 5.1/ICU 4.0 */
+    U_SB_EXTEND = 12,           /*[EX]*/
+    U_SB_LF = 13,               /*[LF]*/
+    U_SB_SCONTINUE = 14,        /*[SC]*/
+    U_SB_COUNT = 15
+} USentenceBreak;
+
+/**
+ * Line Break constants.
+ *
+ * @see UCHAR_LINE_BREAK
+ * @stable ICU 2.2
+ */
+typedef enum ULineBreak {
+    /*
+     * Note: ULineBreak constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_LB_<Unicode Line_Break value name>
+     */
+
+    U_LB_UNKNOWN = 0,           /*[XX]*/
+    U_LB_AMBIGUOUS = 1,         /*[AI]*/
+    U_LB_ALPHABETIC = 2,        /*[AL]*/
+    U_LB_BREAK_BOTH = 3,        /*[B2]*/
+    U_LB_BREAK_AFTER = 4,       /*[BA]*/
+    U_LB_BREAK_BEFORE = 5,      /*[BB]*/
+    U_LB_MANDATORY_BREAK = 6,   /*[BK]*/
+    U_LB_CONTINGENT_BREAK = 7,  /*[CB]*/
+    U_LB_CLOSE_PUNCTUATION = 8, /*[CL]*/
+    U_LB_COMBINING_MARK = 9,    /*[CM]*/
+    U_LB_CARRIAGE_RETURN = 10,   /*[CR]*/
+    U_LB_EXCLAMATION = 11,       /*[EX]*/
+    U_LB_GLUE = 12,              /*[GL]*/
+    U_LB_HYPHEN = 13,            /*[HY]*/
+    U_LB_IDEOGRAPHIC = 14,       /*[ID]*/
+    /** Renamed from the misspelled "inseperable" in Unicode 4.0.1/ICU 3.0 @stable ICU 3.0 */
+    U_LB_INSEPARABLE = 15,       /*[IN]*/
+    U_LB_INSEPERABLE = U_LB_INSEPARABLE,
+    U_LB_INFIX_NUMERIC = 16,     /*[IS]*/
+    U_LB_LINE_FEED = 17,         /*[LF]*/
+    U_LB_NONSTARTER = 18,        /*[NS]*/
+    U_LB_NUMERIC = 19,           /*[NU]*/
+    U_LB_OPEN_PUNCTUATION = 20,  /*[OP]*/
+    U_LB_POSTFIX_NUMERIC = 21,   /*[PO]*/
+    U_LB_PREFIX_NUMERIC = 22,    /*[PR]*/
+    U_LB_QUOTATION = 23,         /*[QU]*/
+    U_LB_COMPLEX_CONTEXT = 24,   /*[SA]*/
+    U_LB_SURROGATE = 25,         /*[SG]*/
+    U_LB_SPACE = 26,             /*[SP]*/
+    U_LB_BREAK_SYMBOLS = 27,     /*[SY]*/
+    U_LB_ZWSPACE = 28,           /*[ZW]*/
+    U_LB_NEXT_LINE = 29,         /*[NL]*/ /* from here on: new in Unicode 4/ICU 2.6 */
+    U_LB_WORD_JOINER = 30,       /*[WJ]*/
+    U_LB_H2 = 31,                /*[H2]*/ /* from here on: new in Unicode 4.1/ICU 3.4 */
+    U_LB_H3 = 32,                /*[H3]*/
+    U_LB_JL = 33,                /*[JL]*/
+    U_LB_JT = 34,                /*[JT]*/
+    U_LB_JV = 35,                /*[JV]*/
+    U_LB_CLOSE_PARENTHESIS = 36, /*[CP]*/ /* new in Unicode 5.2/ICU 4.4 */
+    U_LB_CONDITIONAL_JAPANESE_STARTER = 37,/*[CJ]*/ /* new in Unicode 6.1/ICU 49 */
+    U_LB_HEBREW_LETTER = 38,     /*[HL]*/ /* new in Unicode 6.1/ICU 49 */
+    U_LB_REGIONAL_INDICATOR = 39,/*[RI]*/ /* new in Unicode 6.2/ICU 50 */
+    U_LB_COUNT = 40
+} ULineBreak;
+
+/**
+ * Numeric Type constants.
+ *
+ * @see UCHAR_NUMERIC_TYPE
+ * @stable ICU 2.2
+ */
+typedef enum UNumericType {
+    /*
+     * Note: UNumericType constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_NT_<Unicode Numeric_Type value name>
+     */
+
+    U_NT_NONE,              /*[None]*/
+    U_NT_DECIMAL,           /*[de]*/
+    U_NT_DIGIT,             /*[di]*/
+    U_NT_NUMERIC,           /*[nu]*/
+    U_NT_COUNT
+} UNumericType;
+
+/**
+ * Hangul Syllable Type constants.
+ *
+ * @see UCHAR_HANGUL_SYLLABLE_TYPE
+ * @stable ICU 2.6
+ */
+typedef enum UHangulSyllableType {
+    /*
+     * Note: UHangulSyllableType constants are parsed by preparseucd.py.
+     * It matches lines like
+     *     U_HST_<Unicode Hangul_Syllable_Type value name>
+     */
+
+    U_HST_NOT_APPLICABLE,   /*[NA]*/
+    U_HST_LEADING_JAMO,     /*[L]*/
+    U_HST_VOWEL_JAMO,       /*[V]*/
+    U_HST_TRAILING_JAMO,    /*[T]*/
+    U_HST_LV_SYLLABLE,      /*[LV]*/
+    U_HST_LVT_SYLLABLE,     /*[LVT]*/
+    U_HST_COUNT
+} UHangulSyllableType;
+
+/**
+ * Check a binary Unicode property for a code point.
+ *
+ * Unicode, especially in version 3.2, defines many more properties than the
+ * original set in UnicodeData.txt.
+ *
+ * The properties APIs are intended to reflect Unicode properties as defined
+ * in the Unicode Character Database (UCD) and Unicode Technical Reports (UTR).
+ * For details about the properties see http://www.unicode.org/ucd/ .
+ * For names of Unicode properties see the UCD file PropertyAliases.txt.
+ *
+ * Important: If ICU is built with UCD files from Unicode versions below 3.2,
+ * then properties marked with "new in Unicode 3.2" are not or not fully available.
+ *
+ * @param c Code point to test.
+ * @param which UProperty selector constant, identifies which binary property to check.
+ *        Must be UCHAR_BINARY_START<=which<UCHAR_BINARY_LIMIT.
+ * @return TRUE or FALSE according to the binary Unicode property value for c.
+ *         Also FALSE if 'which' is out of bounds or if the Unicode version
+ *         does not have data for the property at all, or not for this code point.
+ *
+ * @see UProperty
+ * @see u_getIntPropertyValue
+ * @see u_getUnicodeVersion
+ * @stable ICU 2.1
+ */
+U_STABLE UBool U_EXPORT2
+u_hasBinaryProperty(UChar32 c, UProperty which);
+
+/**
+ * Check if a code point has the Alphabetic Unicode property.
+ * Same as u_hasBinaryProperty(c, UCHAR_ALPHABETIC).
+ * This is different from u_isalpha!
+ * @param c Code point to test
+ * @return true if the code point has the Alphabetic Unicode property, false otherwise
+ *
+ * @see UCHAR_ALPHABETIC
+ * @see u_isalpha
+ * @see u_hasBinaryProperty
+ * @stable ICU 2.1
+ */
+U_STABLE UBool U_EXPORT2
+u_isUAlphabetic(UChar32 c);
+
+/**
+ * Check if a code point has the Lowercase Unicode property.
+ * Same as u_hasBinaryProperty(c, UCHAR_LOWERCASE).
+ * This is different from u_islower!
+ * @param c Code point to test
+ * @return true if the code point has the Lowercase Unicode property, false otherwise
+ *
+ * @see UCHAR_LOWERCASE
+ * @see u_islower
+ * @see u_hasBinaryProperty
+ * @stable ICU 2.1
+ */
+U_STABLE UBool U_EXPORT2
+u_isULowercase(UChar32 c);
+
+/**
+ * Check if a code point has the Uppercase Unicode property.
+ * Same as u_hasBinaryProperty(c, UCHAR_UPPERCASE).
+ * This is different from u_isupper!
+ * @param c Code point to test
+ * @return true if the code point has the Uppercase Unicode property, false otherwise
+ *
+ * @see UCHAR_UPPERCASE
+ * @see u_isupper
+ * @see u_hasBinaryProperty
+ * @stable ICU 2.1
+ */
+U_STABLE UBool U_EXPORT2
+u_isUUppercase(UChar32 c);
+
+/**
+ * Check if a code point has the White_Space Unicode property.
+ * Same as u_hasBinaryProperty(c, UCHAR_WHITE_SPACE).
+ * This is different from both u_isspace and u_isWhitespace!
+ *
+ * Note: There are several ICU whitespace functions; please see the uchar.h
+ * file documentation for a detailed comparison.
+ *
+ * @param c Code point to test
+ * @return true if the code point has the White_Space Unicode property, false otherwise.
+ *
+ * @see UCHAR_WHITE_SPACE
+ * @see u_isWhitespace
+ * @see u_isspace
+ * @see u_isJavaSpaceChar
+ * @see u_hasBinaryProperty
+ * @stable ICU 2.1
+ */
+U_STABLE UBool U_EXPORT2
+u_isUWhiteSpace(UChar32 c);
+
+/**
+ * Get the property value for an enumerated or integer Unicode property for a code point.
+ * Also returns binary and mask property values.
+ *
+ * Unicode, especially in version 3.2, defines many more properties than the
+ * original set in UnicodeData.txt.
+ *
+ * The properties APIs are intended to reflect Unicode properties as defined
+ * in the Unicode Character Database (UCD) and Unicode Technical Reports (UTR).
+ * For details about the properties see http://www.unicode.org/ .
+ * For names of Unicode properties see the UCD file PropertyAliases.txt.
+ *
+ * Sample usage:
+ * UEastAsianWidth ea=(UEastAsianWidth)u_getIntPropertyValue(c, UCHAR_EAST_ASIAN_WIDTH);
+ * UBool b=(UBool)u_getIntPropertyValue(c, UCHAR_IDEOGRAPHIC);
+ *
+ * @param c Code point to test.
+ * @param which UProperty selector constant, identifies which property to check.
+ *        Must be UCHAR_BINARY_START<=which<UCHAR_BINARY_LIMIT
+ *        or UCHAR_INT_START<=which<UCHAR_INT_LIMIT
+ *        or UCHAR_MASK_START<=which<UCHAR_MASK_LIMIT.
+ * @return Numeric value that is directly the property value or,
+ *         for enumerated properties, corresponds to the numeric value of the enumerated
+ *         constant of the respective property value enumeration type
+ *         (cast to enum type if necessary).
+ *         Returns 0 or 1 (for FALSE/TRUE) for binary Unicode properties.
+ *         Returns a bit-mask for mask properties.
+ *         Returns 0 if 'which' is out of bounds or if the Unicode version
+ *         does not have data for the property at all, or not for this code point.
+ *
+ * @see UProperty
+ * @see u_hasBinaryProperty
+ * @see u_getIntPropertyMinValue
+ * @see u_getIntPropertyMaxValue
+ * @see u_getUnicodeVersion
+ * @stable ICU 2.2
+ */
+U_STABLE int32_t U_EXPORT2
+u_getIntPropertyValue(UChar32 c, UProperty which);
+
+/**
+ * Get the minimum value for an enumerated/integer/binary Unicode property.
+ * Can be used together with u_getIntPropertyMaxValue
+ * to allocate arrays of UnicodeSet or similar.
+ *
+ * @param which UProperty selector constant, identifies which binary property to check.
+ *        Must be UCHAR_BINARY_START<=which<UCHAR_BINARY_LIMIT
+ *        or UCHAR_INT_START<=which<UCHAR_INT_LIMIT.
+ * @return Minimum value returned by u_getIntPropertyValue for a Unicode property.
+ *         0 if the property selector is out of range.
+ *
+ * @see UProperty
+ * @see u_hasBinaryProperty
+ * @see u_getUnicodeVersion
+ * @see u_getIntPropertyMaxValue
+ * @see u_getIntPropertyValue
+ * @stable ICU 2.2
+ */
+U_STABLE int32_t U_EXPORT2
+u_getIntPropertyMinValue(UProperty which);
+
+/**
+ * Get the maximum value for an enumerated/integer/binary Unicode property.
+ * Can be used together with u_getIntPropertyMinValue
+ * to allocate arrays of UnicodeSet or similar.
+ *
+ * Examples for min/max values (for Unicode 3.2):
+ *
+ * - UCHAR_BIDI_CLASS:    0/18 (U_LEFT_TO_RIGHT/U_BOUNDARY_NEUTRAL)
+ * - UCHAR_SCRIPT:        0/45 (USCRIPT_COMMON/USCRIPT_TAGBANWA)
+ * - UCHAR_IDEOGRAPHIC:   0/1  (FALSE/TRUE)
+ *
+ * For undefined UProperty constant values, min/max values will be 0/-1.
+ *
+ * @param which UProperty selector constant, identifies which binary property to check.
+ *        Must be UCHAR_BINARY_START<=which<UCHAR_BINARY_LIMIT
+ *        or UCHAR_INT_START<=which<UCHAR_INT_LIMIT.
+ * @return Maximum value returned by u_getIntPropertyValue for a Unicode property.
+ *         <=0 if the property selector is out of range.
+ *
+ * @see UProperty
+ * @see u_hasBinaryProperty
+ * @see u_getUnicodeVersion
+ * @see u_getIntPropertyMaxValue
+ * @see u_getIntPropertyValue
+ * @stable ICU 2.2
+ */
+U_STABLE int32_t U_EXPORT2
+u_getIntPropertyMaxValue(UProperty which);
+
+/**
+ * Get the numeric value for a Unicode code point as defined in the
+ * Unicode Character Database.
+ *
+ * A "double" return type is necessary because
+ * some numeric values are fractions, negative, or too large for int32_t.
+ *
+ * For characters without any numeric values in the Unicode Character Database,
+ * this function will return U_NO_NUMERIC_VALUE.
+ * Note: This is different from the Unicode Standard which specifies NaN as the default value.
+ * (NaN is not available on all platforms.)
+ *
+ * Similar to java.lang.Character.getNumericValue(), but u_getNumericValue()
+ * also supports negative values, large values, and fractions,
+ * while Java's getNumericValue() returns values 10..35 for ASCII letters.
+ *
+ * @param c Code point to get the numeric value for.
+ * @return Numeric value of c, or U_NO_NUMERIC_VALUE if none is defined.
+ *
+ * @see U_NO_NUMERIC_VALUE
+ * @stable ICU 2.2
+ */
+U_STABLE double U_EXPORT2
+u_getNumericValue(UChar32 c);
+
+/**
+ * Special value that is returned by u_getNumericValue when
+ * no numeric value is defined for a code point.
+ *
+ * @see u_getNumericValue
+ * @stable ICU 2.2
+ */
+#define U_NO_NUMERIC_VALUE ((double)-123456789.)
+
+/**
+ * Determines whether the specified code point has the general category "Ll"
+ * (lowercase letter).
+ *
+ * Same as java.lang.Character.isLowerCase().
+ *
+ * This misses some characters that are also lowercase but
+ * have a different general category value.
+ * In order to include those, use UCHAR_LOWERCASE.
+ *
+ * In addition to being equivalent to a Java function, this also serves
+ * as a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is an Ll lowercase letter
+ *
+ * @see UCHAR_LOWERCASE
+ * @see u_isupper
+ * @see u_istitle
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_islower(UChar32 c);
+
+/**
+ * Determines whether the specified code point has the general category "Lu"
+ * (uppercase letter).
+ *
+ * Same as java.lang.Character.isUpperCase().
+ *
+ * This misses some characters that are also uppercase but
+ * have a different general category value.
+ * In order to include those, use UCHAR_UPPERCASE.
+ *
+ * In addition to being equivalent to a Java function, this also serves
+ * as a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is an Lu uppercase letter
+ *
+ * @see UCHAR_UPPERCASE
+ * @see u_islower
+ * @see u_istitle
+ * @see u_tolower
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isupper(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a titlecase letter.
+ * True for general category "Lt" (titlecase letter).
+ *
+ * Same as java.lang.Character.isTitleCase().
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is an Lt titlecase letter
+ *
+ * @see u_isupper
+ * @see u_islower
+ * @see u_totitle
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_istitle(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a digit character according to Java.
+ * True for characters with general category "Nd" (decimal digit numbers).
+ * Beginning with Unicode 4, this is the same as
+ * testing for the Numeric_Type of Decimal.
+ *
+ * Same as java.lang.Character.isDigit().
+ *
+ * In addition to being equivalent to a Java function, this also serves
+ * as a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a digit character according to Character.isDigit()
+ *
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isdigit(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a letter character.
+ * True for general categories "L" (letters).
+ *
+ * Same as java.lang.Character.isLetter().
+ *
+ * In addition to being equivalent to a Java function, this also serves
+ * as a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a letter character
+ *
+ * @see u_isdigit
+ * @see u_isalnum
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isalpha(UChar32 c);
+
+/**
+ * Determines whether the specified code point is an alphanumeric character
+ * (letter or digit) according to Java.
+ * True for characters with general categories
+ * "L" (letters) and "Nd" (decimal digit numbers).
+ *
+ * Same as java.lang.Character.isLetterOrDigit().
+ *
+ * In addition to being equivalent to a Java function, this also serves
+ * as a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is an alphanumeric character according to Character.isLetterOrDigit()
+ *
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isalnum(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a hexadecimal digit.
+ * This is equivalent to u_digit(c, 16)>=0.
+ * True for characters with general category "Nd" (decimal digit numbers)
+ * as well as Latin letters a-f and A-F in both ASCII and Fullwidth ASCII.
+ * (That is, for letters with code points
+ * 0041..0046, 0061..0066, FF21..FF26, FF41..FF46.)
+ *
+ * In order to narrow the definition of hexadecimal digits to only ASCII
+ * characters, use (c<=0x7f && u_isxdigit(c)).
+ *
+ * This is a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a hexadecimal digit
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE UBool U_EXPORT2
+u_isxdigit(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a punctuation character.
+ * True for characters with general categories "P" (punctuation).
+ *
+ * This is a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a punctuation character
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE UBool U_EXPORT2
+u_ispunct(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a "graphic" character
+ * (printable, excluding spaces).
+ * TRUE for all characters except those with general categories
+ * "Cc" (control codes), "Cf" (format controls), "Cs" (surrogates),
+ * "Cn" (unassigned), and "Z" (separators).
+ *
+ * This is a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a "graphic" character
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE UBool U_EXPORT2
+u_isgraph(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a "blank" or "horizontal space",
+ * a character that visibly separates words on a line.
+ * The following are equivalent definitions:
+ *
+ * TRUE for Unicode White_Space characters except for "vertical space controls"
+ * where "vertical space controls" are the following characters:
+ * U+000A (LF) U+000B (VT) U+000C (FF) U+000D (CR) U+0085 (NEL) U+2028 (LS) U+2029 (PS)
+ *
+ * same as
+ *
+ * TRUE for U+0009 (TAB) and characters with general category "Zs" (space separators)
+ * except Zero Width Space (ZWSP, U+200B).
+ *
+ * Note: There are several ICU whitespace functions; please see the uchar.h
+ * file documentation for a detailed comparison.
+ *
+ * This is a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a "blank"
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE UBool U_EXPORT2
+u_isblank(UChar32 c);
+
+/**
+ * Determines whether the specified code point is "defined",
+ * which usually means that it is assigned a character.
+ * True for general categories other than "Cn" (other, not assigned),
+ * i.e., true for all code points mentioned in UnicodeData.txt.
+ *
+ * Note that non-character code points (e.g., U+FDD0) are not "defined"
+ * (they are Cn), but surrogate code points are "defined" (Cs).
+ *
+ * Same as java.lang.Character.isDefined().
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is assigned a character
+ *
+ * @see u_isdigit
+ * @see u_isalpha
+ * @see u_isalnum
+ * @see u_isupper
+ * @see u_islower
+ * @see u_istitle
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isdefined(UChar32 c);
+
+/**
+ * Determines if the specified character is a space character or not.
+ *
+ * Note: There are several ICU whitespace functions; please see the uchar.h
+ * file documentation for a detailed comparison.
+ *
+ * This is a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c    the character to be tested
+ * @return  true if the character is a space character; false otherwise.
+ *
+ * @see u_isJavaSpaceChar
+ * @see u_isWhitespace
+ * @see u_isUWhiteSpace
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isspace(UChar32 c);
+
+/**
+ * Determine if the specified code point is a space character according to Java.
+ * True for characters with general categories "Z" (separators),
+ * which does not include control codes (e.g., TAB or Line Feed).
+ *
+ * Same as java.lang.Character.isSpaceChar().
+ *
+ * Note: There are several ICU whitespace functions; please see the uchar.h
+ * file documentation for a detailed comparison.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a space character according to Character.isSpaceChar()
+ *
+ * @see u_isspace
+ * @see u_isWhitespace
+ * @see u_isUWhiteSpace
+ * @stable ICU 2.6
+ */
+U_STABLE UBool U_EXPORT2
+u_isJavaSpaceChar(UChar32 c);
+
+/**
+ * Determines if the specified code point is a whitespace character according to Java/ICU.
+ * A character is considered to be a Java whitespace character if and only
+ * if it satisfies one of the following criteria:
+ *
+ * - It is a Unicode Separator character (categories "Z" = "Zs" or "Zl" or "Zp"), but is not
+ *      also a non-breaking space (U+00A0 NBSP or U+2007 Figure Space or U+202F Narrow NBSP).
+ * - It is U+0009 HORIZONTAL TABULATION.
+ * - It is U+000A LINE FEED.
+ * - It is U+000B VERTICAL TABULATION.
+ * - It is U+000C FORM FEED.
+ * - It is U+000D CARRIAGE RETURN.
+ * - It is U+001C FILE SEPARATOR.
+ * - It is U+001D GROUP SEPARATOR.
+ * - It is U+001E RECORD SEPARATOR.
+ * - It is U+001F UNIT SEPARATOR.
+ *
+ * This API tries to sync with the semantics of Java's
+ * java.lang.Character.isWhitespace(), but it may not return
+ * the exact same results because of the Unicode version
+ * difference.
+ *
+ * Note: Unicode 4.0.1 changed U+200B ZERO WIDTH SPACE from a Space Separator (Zs)
+ * to a Format Control (Cf). Since then, isWhitespace(0x200b) returns false.
+ * See http://www.unicode.org/versions/Unicode4.0.1/
+ *
+ * Note: There are several ICU whitespace functions; please see the uchar.h
+ * file documentation for a detailed comparison.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a whitespace character according to Java/ICU
+ *
+ * @see u_isspace
+ * @see u_isJavaSpaceChar
+ * @see u_isUWhiteSpace
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isWhitespace(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a control character
+ * (as defined by this function).
+ * A control character is one of the following:
+ * - ISO 8-bit control character (U+0000..U+001f and U+007f..U+009f)
+ * - U_CONTROL_CHAR (Cc)
+ * - U_FORMAT_CHAR (Cf)
+ * - U_LINE_SEPARATOR (Zl)
+ * - U_PARAGRAPH_SEPARATOR (Zp)
+ *
+ * This is a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a control character
+ *
+ * @see UCHAR_DEFAULT_IGNORABLE_CODE_POINT
+ * @see u_isprint
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_iscntrl(UChar32 c);
+
+/**
+ * Determines whether the specified code point is an ISO control code.
+ * True for U+0000..U+001f and U+007f..U+009f (general category "Cc").
+ *
+ * Same as java.lang.Character.isISOControl().
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is an ISO control code
+ *
+ * @see u_iscntrl
+ * @stable ICU 2.6
+ */
+U_STABLE UBool U_EXPORT2
+u_isISOControl(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a printable character.
+ * True for general categories <em>other</em> than "C" (controls).
+ *
+ * This is a C/POSIX migration function.
+ * See the comments about C/POSIX character classification functions in the
+ * documentation at the top of this header file.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a printable character
+ *
+ * @see UCHAR_DEFAULT_IGNORABLE_CODE_POINT
+ * @see u_iscntrl
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isprint(UChar32 c);
+
+/**
+ * Determines whether the specified code point is a base character.
+ * True for general categories "L" (letters), "N" (numbers),
+ * "Mc" (spacing combining marks), and "Me" (enclosing marks).
+ *
+ * Note that this is different from the Unicode definition in
+ * chapter 3.5, conformance clause D13,
+ * which defines base characters to be all characters (not Cn)
+ * that do not graphically combine with preceding characters (M)
+ * and that are neither control (Cc) or format (Cf) characters.
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is a base character according to this function
+ *
+ * @see u_isalpha
+ * @see u_isdigit
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isbase(UChar32 c);
+
+/**
+ * Returns the bidirectional category value for the code point,
+ * which is used in the Unicode bidirectional algorithm
+ * (UAX #9 http://www.unicode.org/reports/tr9/).
+ * Note that some <em>unassigned</em> code points have bidi values
+ * of R or AL because they are in blocks that are reserved
+ * for Right-To-Left scripts.
+ *
+ * Same as java.lang.Character.getDirectionality()
+ *
+ * @param c the code point to be tested
+ * @return the bidirectional category (UCharDirection) value
+ *
+ * @see UCharDirection
+ * @stable ICU 2.0
+ */
+U_STABLE UCharDirection U_EXPORT2
+u_charDirection(UChar32 c);
+
+/**
+ * Determines whether the code point has the Bidi_Mirrored property.
+ * This property is set for characters that are commonly used in
+ * Right-To-Left contexts and need to be displayed with a "mirrored"
+ * glyph.
+ *
+ * Same as java.lang.Character.isMirrored().
+ * Same as UCHAR_BIDI_MIRRORED
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the character has the Bidi_Mirrored property
+ *
+ * @see UCHAR_BIDI_MIRRORED
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isMirrored(UChar32 c);
+
+/**
+ * Maps the specified character to a "mirror-image" character.
+ * For characters with the Bidi_Mirrored property, implementations
+ * sometimes need a "poor man's" mapping to another Unicode
+ * character (code point) such that the default glyph may serve
+ * as the mirror-image of the default glyph of the specified
+ * character. This is useful for text conversion to and from
+ * codepages with visual order, and for displays without glyph
+ * selection capabilities.
+ *
+ * @param c the code point to be mapped
+ * @return another Unicode code point that may serve as a mirror-image
+ *         substitute, or c itself if there is no such mapping or c
+ *         does not have the Bidi_Mirrored property
+ *
+ * @see UCHAR_BIDI_MIRRORED
+ * @see u_isMirrored
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32 U_EXPORT2
+u_charMirror(UChar32 c);
+
+/**
+ * Maps the specified character to its paired bracket character.
+ * For Bidi_Paired_Bracket_Type!=None, this is the same as u_charMirror().
+ * Otherwise c itself is returned.
+ * See http://www.unicode.org/reports/tr9/
+ *
+ * @param c the code point to be mapped
+ * @return the paired bracket code point,
+ *         or c itself if there is no such mapping
+ *         (Bidi_Paired_Bracket_Type=None)
+ *
+ * @see UCHAR_BIDI_PAIRED_BRACKET
+ * @see UCHAR_BIDI_PAIRED_BRACKET_TYPE
+ * @see u_charMirror
+ * @stable ICU 52
+ */
+U_STABLE UChar32 U_EXPORT2
+u_getBidiPairedBracket(UChar32 c);
+
+/**
+ * Returns the general category value for the code point.
+ *
+ * Same as java.lang.Character.getType().
+ *
+ * @param c the code point to be tested
+ * @return the general category (UCharCategory) value
+ *
+ * @see UCharCategory
+ * @stable ICU 2.0
+ */
+U_STABLE int8_t U_EXPORT2
+u_charType(UChar32 c);
+
+/**
+ * Get a single-bit bit set for the general category of a character.
+ * This bit set can be compared bitwise with U_GC_SM_MASK, U_GC_L_MASK, etc.
+ * Same as U_MASK(u_charType(c)).
+ *
+ * @param c the code point to be tested
+ * @return a single-bit mask corresponding to the general category (UCharCategory) value
+ *
+ * @see u_charType
+ * @see UCharCategory
+ * @see U_GC_CN_MASK
+ * @stable ICU 2.1
+ */
+#define U_GET_GC_MASK(c) U_MASK(u_charType(c))
+
+/**
+ * Callback from u_enumCharTypes(), is called for each contiguous range
+ * of code points c (where start<=c<limit)
+ * with the same Unicode general category ("character type").
+ *
+ * The callback function can stop the enumeration by returning FALSE.
+ *
+ * @param context an opaque pointer, as passed into utrie_enum()
+ * @param start the first code point in a contiguous range with value
+ * @param limit one past the last code point in a contiguous range with value
+ * @param type the general category for all code points in [start..limit[
+ * @return FALSE to stop the enumeration
+ *
+ * @stable ICU 2.1
+ * @see UCharCategory
+ * @see u_enumCharTypes
+ */
+typedef UBool U_CALLCONV
+UCharEnumTypeRange(const void *context, UChar32 start, UChar32 limit, UCharCategory type);
+
+/**
+ * Enumerate efficiently all code points with their Unicode general categories.
+ *
+ * This is useful for building data structures (e.g., UnicodeSet's),
+ * for enumerating all assigned code points (type!=U_UNASSIGNED), etc.
+ *
+ * For each contiguous range of code points with a given general category ("character type"),
+ * the UCharEnumTypeRange function is called.
+ * Adjacent ranges have different types.
+ * The Unicode Standard guarantees that the numeric value of the type is 0..31.
+ *
+ * @param enumRange a pointer to a function that is called for each contiguous range
+ *                  of code points with the same general category
+ * @param context an opaque pointer that is passed on to the callback function
+ *
+ * @stable ICU 2.1
+ * @see UCharCategory
+ * @see UCharEnumTypeRange
+ */
+U_STABLE void U_EXPORT2
+u_enumCharTypes(UCharEnumTypeRange *enumRange, const void *context);
+
+#if !UCONFIG_NO_NORMALIZATION
+
+/**
+ * Returns the combining class of the code point as specified in UnicodeData.txt.
+ *
+ * @param c the code point of the character
+ * @return the combining class of the character
+ * @stable ICU 2.0
+ */
+U_STABLE uint8_t U_EXPORT2
+u_getCombiningClass(UChar32 c);
+
+#endif
+
+/**
+ * Returns the decimal digit value of a decimal digit character.
+ * Such characters have the general category "Nd" (decimal digit numbers)
+ * and a Numeric_Type of Decimal.
+ *
+ * Unlike ICU releases before 2.6, no digit values are returned for any
+ * Han characters because Han number characters are often used with a special
+ * Chinese-style number format (with characters for powers of 10 in between)
+ * instead of in decimal-positional notation.
+ * Unicode 4 explicitly assigns Han number characters the Numeric_Type
+ * Numeric instead of Decimal.
+ * See Jitterbug 1483 for more details.
+ *
+ * Use u_getIntPropertyValue(c, UCHAR_NUMERIC_TYPE) and u_getNumericValue()
+ * for complete numeric Unicode properties.
+ *
+ * @param c the code point for which to get the decimal digit value
+ * @return the decimal digit value of c,
+ *         or -1 if c is not a decimal digit character
+ *
+ * @see u_getNumericValue
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_charDigitValue(UChar32 c);
+
+/**
+ * Returns the Unicode allocation block that contains the character.
+ *
+ * @param c the code point to be tested
+ * @return the block value (UBlockCode) for c
+ *
+ * @see UBlockCode
+ * @stable ICU 2.0
+ */
+U_STABLE UBlockCode U_EXPORT2
+ublock_getCode(UChar32 c);
+
+/**
+ * Retrieve the name of a Unicode character.
+ * Depending on <code>nameChoice</code>, the character name written
+ * into the buffer is the "modern" name or the name that was defined
+ * in Unicode version 1.0.
+ * The name contains only "invariant" characters
+ * like A-Z, 0-9, space, and '-'.
+ * Unicode 1.0 names are only retrieved if they are different from the modern
+ * names and if the data file contains the data for them. gennames may or may
+ * not be called with a command line option to include 1.0 names in unames.dat.
+ *
+ * @param code The character (code point) for which to get the name.
+ *             It must be <code>0<=code<=0x10ffff</code>.
+ * @param nameChoice Selector for which name to get.
+ * @param buffer Destination address for copying the name.
+ *               The name will always be zero-terminated.
+ *               If there is no name, then the buffer will be set to the empty string.
+ * @param bufferLength <code>==sizeof(buffer)</code>
+ * @param pErrorCode Pointer to a UErrorCode variable;
+ *        check for <code>U_SUCCESS()</code> after <code>u_charName()</code>
+ *        returns.
+ * @return The length of the name, or 0 if there is no name for this character.
+ *         If the bufferLength is less than or equal to the length, then the buffer
+ *         contains the truncated name and the returned length indicates the full
+ *         length of the name.
+ *         The length does not include the zero-termination.
+ *
+ * @see UCharNameChoice
+ * @see u_charFromName
+ * @see u_enumCharNames
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_charName(UChar32 code, UCharNameChoice nameChoice,
+           char *buffer, int32_t bufferLength,
+           UErrorCode *pErrorCode);
+
+#ifndef U_HIDE_DEPRECATED_API 
+/**
+ * Returns an empty string.
+ * Used to return the ISO 10646 comment for a character.
+ * The Unicode ISO_Comment property is deprecated and has no values.
+ *
+ * @param c The character (code point) for which to get the ISO comment.
+ *             It must be <code>0<=c<=0x10ffff</code>.
+ * @param dest Destination address for copying the comment.
+ *             The comment will be zero-terminated if possible.
+ *             If there is no comment, then the buffer will be set to the empty string.
+ * @param destCapacity <code>==sizeof(dest)</code>
+ * @param pErrorCode Pointer to a UErrorCode variable;
+ *        check for <code>U_SUCCESS()</code> after <code>u_getISOComment()</code>
+ *        returns.
+ * @return 0
+ *
+ * @deprecated ICU 49
+ */
+U_STABLE int32_t U_EXPORT2
+u_getISOComment(UChar32 c,
+                char *dest, int32_t destCapacity,
+                UErrorCode *pErrorCode);
+#endif  /* U_HIDE_DEPRECATED_API */
+
+/**
+ * Find a Unicode character by its name and return its code point value.
+ * The name is matched exactly and completely.
+ * If the name does not correspond to a code point, <i>pErrorCode</i>
+ * is set to <code>U_INVALID_CHAR_FOUND</code>.
+ * A Unicode 1.0 name is matched only if it differs from the modern name.
+ * Unicode names are all uppercase. Extended names are lowercase followed
+ * by an uppercase hexadecimal number, and within angle brackets.
+ *
+ * @param nameChoice Selector for which name to match.
+ * @param name The name to match.
+ * @param pErrorCode Pointer to a UErrorCode variable
+ * @return The Unicode value of the code point with the given name,
+ *         or an undefined value if there is no such code point.
+ *
+ * @see UCharNameChoice
+ * @see u_charName
+ * @see u_enumCharNames
+ * @stable ICU 1.7
+ */
+U_STABLE UChar32 U_EXPORT2
+u_charFromName(UCharNameChoice nameChoice,
+               const char *name,
+               UErrorCode *pErrorCode);
+
+/**
+ * Type of a callback function for u_enumCharNames() that gets called
+ * for each Unicode character with the code point value and
+ * the character name.
+ * If such a function returns FALSE, then the enumeration is stopped.
+ *
+ * @param context The context pointer that was passed to u_enumCharNames().
+ * @param code The Unicode code point for the character with this name.
+ * @param nameChoice Selector for which kind of names is enumerated.
+ * @param name The character's name, zero-terminated.
+ * @param length The length of the name.
+ * @return TRUE if the enumeration should continue, FALSE to stop it.
+ *
+ * @see UCharNameChoice
+ * @see u_enumCharNames
+ * @stable ICU 1.7
+ */
+typedef UBool U_CALLCONV UEnumCharNamesFn(void *context,
+                               UChar32 code,
+                               UCharNameChoice nameChoice,
+                               const char *name,
+                               int32_t length);
+
+/**
+ * Enumerate all assigned Unicode characters between the start and limit
+ * code points (start inclusive, limit exclusive) and call a function
+ * for each, passing the code point value and the character name.
+ * For Unicode 1.0 names, only those are enumerated that differ from the
+ * modern names.
+ *
+ * @param start The first code point in the enumeration range.
+ * @param limit One more than the last code point in the enumeration range
+ *              (the first one after the range).
+ * @param fn The function that is to be called for each character name.
+ * @param context An arbitrary pointer that is passed to the function.
+ * @param nameChoice Selector for which kind of names to enumerate.
+ * @param pErrorCode Pointer to a UErrorCode variable
+ *
+ * @see UCharNameChoice
+ * @see UEnumCharNamesFn
+ * @see u_charName
+ * @see u_charFromName
+ * @stable ICU 1.7
+ */
+U_STABLE void U_EXPORT2
+u_enumCharNames(UChar32 start, UChar32 limit,
+                UEnumCharNamesFn *fn,
+                void *context,
+                UCharNameChoice nameChoice,
+                UErrorCode *pErrorCode);
+
+/**
+ * Return the Unicode name for a given property, as given in the
+ * Unicode database file PropertyAliases.txt.
+ *
+ * In addition, this function maps the property
+ * UCHAR_GENERAL_CATEGORY_MASK to the synthetic names "gcm" /
+ * "General_Category_Mask".  These names are not in
+ * PropertyAliases.txt.
+ *
+ * @param property UProperty selector other than UCHAR_INVALID_CODE.
+ *         If out of range, NULL is returned.
+ *
+ * @param nameChoice selector for which name to get.  If out of range,
+ *         NULL is returned.  All properties have a long name.  Most
+ *         have a short name, but some do not.  Unicode allows for
+ *         additional names; if present these will be returned by
+ *         U_LONG_PROPERTY_NAME + i, where i=1, 2,...
+ *
+ * @return a pointer to the name, or NULL if either the
+ *         property or the nameChoice is out of range.  If a given
+ *         nameChoice returns NULL, then all larger values of
+ *         nameChoice will return NULL, with one exception: if NULL is
+ *         returned for U_SHORT_PROPERTY_NAME, then
+ *         U_LONG_PROPERTY_NAME (and higher) may still return a
+ *         non-NULL value.  The returned pointer is valid until
+ *         u_cleanup() is called.
+ *
+ * @see UProperty
+ * @see UPropertyNameChoice
+ * @stable ICU 2.4
+ */
+U_STABLE const char* U_EXPORT2
+u_getPropertyName(UProperty property,
+                  UPropertyNameChoice nameChoice);
+
+/**
+ * Return the UProperty enum for a given property name, as specified
+ * in the Unicode database file PropertyAliases.txt.  Short, long, and
+ * any other variants are recognized.
+ *
+ * In addition, this function maps the synthetic names "gcm" /
+ * "General_Category_Mask" to the property
+ * UCHAR_GENERAL_CATEGORY_MASK.  These names are not in
+ * PropertyAliases.txt.
+ *
+ * @param alias the property name to be matched.  The name is compared
+ *         using "loose matching" as described in PropertyAliases.txt.
+ *
+ * @return a UProperty enum, or UCHAR_INVALID_CODE if the given name
+ *         does not match any property.
+ *
+ * @see UProperty
+ * @stable ICU 2.4
+ */
+U_STABLE UProperty U_EXPORT2
+u_getPropertyEnum(const char* alias);
+
+/**
+ * Return the Unicode name for a given property value, as given in the
+ * Unicode database file PropertyValueAliases.txt.
+ *
+ * Note: Some of the names in PropertyValueAliases.txt can only be
+ * retrieved using UCHAR_GENERAL_CATEGORY_MASK, not
+ * UCHAR_GENERAL_CATEGORY.  These include: "C" / "Other", "L" /
+ * "Letter", "LC" / "Cased_Letter", "M" / "Mark", "N" / "Number", "P"
+ * / "Punctuation", "S" / "Symbol", and "Z" / "Separator".
+ *
+ * @param property UProperty selector constant.
+ *        Must be UCHAR_BINARY_START<=which<UCHAR_BINARY_LIMIT
+ *        or UCHAR_INT_START<=which<UCHAR_INT_LIMIT
+ *        or UCHAR_MASK_START<=which<UCHAR_MASK_LIMIT.
+ *        If out of range, NULL is returned.
+ *
+ * @param value selector for a value for the given property.  If out
+ *         of range, NULL is returned.  In general, valid values range
+ *         from 0 up to some maximum.  There are a few exceptions:
+ *         (1.) UCHAR_BLOCK values begin at the non-zero value
+ *         UBLOCK_BASIC_LATIN.  (2.)  UCHAR_CANONICAL_COMBINING_CLASS
+ *         values are not contiguous and range from 0..240.  (3.)
+ *         UCHAR_GENERAL_CATEGORY_MASK values are not values of
+ *         UCharCategory, but rather mask values produced by
+ *         U_GET_GC_MASK().  This allows grouped categories such as
+ *         [:L:] to be represented.  Mask values range
+ *         non-contiguously from 1..U_GC_P_MASK.
+ *
+ * @param nameChoice selector for which name to get.  If out of range,
+ *         NULL is returned.  All values have a long name.  Most have
+ *         a short name, but some do not.  Unicode allows for
+ *         additional names; if present these will be returned by
+ *         U_LONG_PROPERTY_NAME + i, where i=1, 2,...
+
+ * @return a pointer to the name, or NULL if either the
+ *         property or the nameChoice is out of range.  If a given
+ *         nameChoice returns NULL, then all larger values of
+ *         nameChoice will return NULL, with one exception: if NULL is
+ *         returned for U_SHORT_PROPERTY_NAME, then
+ *         U_LONG_PROPERTY_NAME (and higher) may still return a
+ *         non-NULL value.  The returned pointer is valid until
+ *         u_cleanup() is called.
+ *
+ * @see UProperty
+ * @see UPropertyNameChoice
+ * @stable ICU 2.4
+ */
+U_STABLE const char* U_EXPORT2
+u_getPropertyValueName(UProperty property,
+                       int32_t value,
+                       UPropertyNameChoice nameChoice);
+
+/**
+ * Return the property value integer for a given value name, as
+ * specified in the Unicode database file PropertyValueAliases.txt.
+ * Short, long, and any other variants are recognized.
+ *
+ * Note: Some of the names in PropertyValueAliases.txt will only be
+ * recognized with UCHAR_GENERAL_CATEGORY_MASK, not
+ * UCHAR_GENERAL_CATEGORY.  These include: "C" / "Other", "L" /
+ * "Letter", "LC" / "Cased_Letter", "M" / "Mark", "N" / "Number", "P"
+ * / "Punctuation", "S" / "Symbol", and "Z" / "Separator".
+ *
+ * @param property UProperty selector constant.
+ *        Must be UCHAR_BINARY_START<=which<UCHAR_BINARY_LIMIT
+ *        or UCHAR_INT_START<=which<UCHAR_INT_LIMIT
+ *        or UCHAR_MASK_START<=which<UCHAR_MASK_LIMIT.
+ *        If out of range, UCHAR_INVALID_CODE is returned.
+ *
+ * @param alias the value name to be matched.  The name is compared
+ *         using "loose matching" as described in
+ *         PropertyValueAliases.txt.
+ *
+ * @return a value integer or UCHAR_INVALID_CODE if the given name
+ *         does not match any value of the given property, or if the
+ *         property is invalid.  Note: UCHAR_GENERAL_CATEGORY_MASK values
+ *         are not values of UCharCategory, but rather mask values
+ *         produced by U_GET_GC_MASK().  This allows grouped
+ *         categories such as [:L:] to be represented.
+ *
+ * @see UProperty
+ * @stable ICU 2.4
+ */
+U_STABLE int32_t U_EXPORT2
+u_getPropertyValueEnum(UProperty property,
+                       const char* alias);
+
+/**
+ * Determines if the specified character is permissible as the
+ * first character in an identifier according to Unicode
+ * (The Unicode Standard, Version 3.0, chapter 5.16 Identifiers).
+ * True for characters with general categories "L" (letters) and "Nl" (letter numbers).
+ *
+ * Same as java.lang.Character.isUnicodeIdentifierStart().
+ * Same as UCHAR_ID_START
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point may start an identifier
+ *
+ * @see UCHAR_ID_START
+ * @see u_isalpha
+ * @see u_isIDPart
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isIDStart(UChar32 c);
+
+/**
+ * Determines if the specified character is permissible
+ * in an identifier according to Java.
+ * True for characters with general categories "L" (letters),
+ * "Nl" (letter numbers), "Nd" (decimal digits),
+ * "Mc" and "Mn" (combining marks), "Pc" (connecting punctuation), and
+ * u_isIDIgnorable(c).
+ *
+ * Same as java.lang.Character.isUnicodeIdentifierPart().
+ * Almost the same as Unicode's ID_Continue (UCHAR_ID_CONTINUE)
+ * except that Unicode recommends to ignore Cf which is less than
+ * u_isIDIgnorable(c).
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point may occur in an identifier according to Java
+ *
+ * @see UCHAR_ID_CONTINUE
+ * @see u_isIDStart
+ * @see u_isIDIgnorable
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isIDPart(UChar32 c);
+
+/**
+ * Determines if the specified character should be regarded
+ * as an ignorable character in an identifier,
+ * according to Java.
+ * True for characters with general category "Cf" (format controls) as well as
+ * non-whitespace ISO controls
+ * (U+0000..U+0008, U+000E..U+001B, U+007F..U+009F).
+ *
+ * Same as java.lang.Character.isIdentifierIgnorable().
+ *
+ * Note that Unicode just recommends to ignore Cf (format controls).
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point is ignorable in identifiers according to Java
+ *
+ * @see UCHAR_DEFAULT_IGNORABLE_CODE_POINT
+ * @see u_isIDStart
+ * @see u_isIDPart
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isIDIgnorable(UChar32 c);
+
+/**
+ * Determines if the specified character is permissible as the
+ * first character in a Java identifier.
+ * In addition to u_isIDStart(c), true for characters with
+ * general categories "Sc" (currency symbols) and "Pc" (connecting punctuation).
+ *
+ * Same as java.lang.Character.isJavaIdentifierStart().
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point may start a Java identifier
+ *
+ * @see     u_isJavaIDPart
+ * @see     u_isalpha
+ * @see     u_isIDStart
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isJavaIDStart(UChar32 c);
+
+/**
+ * Determines if the specified character is permissible
+ * in a Java identifier.
+ * In addition to u_isIDPart(c), true for characters with
+ * general category "Sc" (currency symbols).
+ *
+ * Same as java.lang.Character.isJavaIdentifierPart().
+ *
+ * @param c the code point to be tested
+ * @return TRUE if the code point may occur in a Java identifier
+ *
+ * @see     u_isIDIgnorable
+ * @see     u_isJavaIDStart
+ * @see     u_isalpha
+ * @see     u_isdigit
+ * @see     u_isIDPart
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+u_isJavaIDPart(UChar32 c);
+
+/**
+ * The given character is mapped to its lowercase equivalent according to
+ * UnicodeData.txt; if the character has no lowercase equivalent, the character
+ * itself is returned.
+ *
+ * Same as java.lang.Character.toLowerCase().
+ *
+ * This function only returns the simple, single-code point case mapping.
+ * Full case mappings should be used whenever possible because they produce
+ * better results by working on whole strings.
+ * They take into account the string context and the language and can map
+ * to a result string with a different length as appropriate.
+ * Full case mappings are applied by the string case mapping functions,
+ * see ustring.h and the UnicodeString class.
+ * See also the User Guide chapter on C/POSIX migration:
+ * http://icu-project.org/userguide/posix.html#case_mappings
+ *
+ * @param c the code point to be mapped
+ * @return the Simple_Lowercase_Mapping of the code point, if any;
+ *         otherwise the code point itself.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32 U_EXPORT2
+u_tolower(UChar32 c);
+
+/**
+ * The given character is mapped to its uppercase equivalent according to UnicodeData.txt;
+ * if the character has no uppercase equivalent, the character itself is
+ * returned.
+ *
+ * Same as java.lang.Character.toUpperCase().
+ *
+ * This function only returns the simple, single-code point case mapping.
+ * Full case mappings should be used whenever possible because they produce
+ * better results by working on whole strings.
+ * They take into account the string context and the language and can map
+ * to a result string with a different length as appropriate.
+ * Full case mappings are applied by the string case mapping functions,
+ * see ustring.h and the UnicodeString class.
+ * See also the User Guide chapter on C/POSIX migration:
+ * http://icu-project.org/userguide/posix.html#case_mappings
+ *
+ * @param c the code point to be mapped
+ * @return the Simple_Uppercase_Mapping of the code point, if any;
+ *         otherwise the code point itself.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32 U_EXPORT2
+u_toupper(UChar32 c);
+
+/**
+ * The given character is mapped to its titlecase equivalent
+ * according to UnicodeData.txt;
+ * if none is defined, the character itself is returned.
+ *
+ * Same as java.lang.Character.toTitleCase().
+ *
+ * This function only returns the simple, single-code point case mapping.
+ * Full case mappings should be used whenever possible because they produce
+ * better results by working on whole strings.
+ * They take into account the string context and the language and can map
+ * to a result string with a different length as appropriate.
+ * Full case mappings are applied by the string case mapping functions,
+ * see ustring.h and the UnicodeString class.
+ * See also the User Guide chapter on C/POSIX migration:
+ * http://icu-project.org/userguide/posix.html#case_mappings
+ *
+ * @param c the code point to be mapped
+ * @return the Simple_Titlecase_Mapping of the code point, if any;
+ *         otherwise the code point itself.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32 U_EXPORT2
+u_totitle(UChar32 c);
+
+/** Option value for case folding: use default mappings defined in CaseFolding.txt. @stable ICU 2.0 */
+#define U_FOLD_CASE_DEFAULT 0
+
+/**
+ * Option value for case folding:
+ *
+ * Use the modified set of mappings provided in CaseFolding.txt to handle dotted I
+ * and dotless i appropriately for Turkic languages (tr, az).
+ *
+ * Before Unicode 3.2, CaseFolding.txt contains mappings marked with 'I' that
+ * are to be included for default mappings and
+ * excluded for the Turkic-specific mappings.
+ *
+ * Unicode 3.2 CaseFolding.txt instead contains mappings marked with 'T' that
+ * are to be excluded for default mappings and
+ * included for the Turkic-specific mappings.
+ *
+ * @stable ICU 2.0
+ */
+#define U_FOLD_CASE_EXCLUDE_SPECIAL_I 1
+
+/**
+ * The given character is mapped to its case folding equivalent according to
+ * UnicodeData.txt and CaseFolding.txt;
+ * if the character has no case folding equivalent, the character
+ * itself is returned.
+ *
+ * This function only returns the simple, single-code point case mapping.
+ * Full case mappings should be used whenever possible because they produce
+ * better results by working on whole strings.
+ * They take into account the string context and the language and can map
+ * to a result string with a different length as appropriate.
+ * Full case mappings are applied by the string case mapping functions,
+ * see ustring.h and the UnicodeString class.
+ * See also the User Guide chapter on C/POSIX migration:
+ * http://icu-project.org/userguide/posix.html#case_mappings
+ *
+ * @param c the code point to be mapped
+ * @param options Either U_FOLD_CASE_DEFAULT or U_FOLD_CASE_EXCLUDE_SPECIAL_I
+ * @return the Simple_Case_Folding of the code point, if any;
+ *         otherwise the code point itself.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32 U_EXPORT2
+u_foldCase(UChar32 c, uint32_t options);
+
+/**
+ * Returns the decimal digit value of the code point in the
+ * specified radix.
+ *
+ * If the radix is not in the range <code>2<=radix<=36</code> or if the
+ * value of <code>c</code> is not a valid digit in the specified
+ * radix, <code>-1</code> is returned. A character is a valid digit
+ * if at least one of the following is true:
+ * <ul>
+ * <li>The character has a decimal digit value.
+ *     Such characters have the general category "Nd" (decimal digit numbers)
+ *     and a Numeric_Type of Decimal.
+ *     In this case the value is the character's decimal digit value.</li>
+ * <li>The character is one of the uppercase Latin letters
+ *     <code>'A'</code> through <code>'Z'</code>.
+ *     In this case the value is <code>c-'A'+10</code>.</li>
+ * <li>The character is one of the lowercase Latin letters
+ *     <code>'a'</code> through <code>'z'</code>.
+ *     In this case the value is <code>ch-'a'+10</code>.</li>
+ * <li>Latin letters from both the ASCII range (0061..007A, 0041..005A)
+ *     as well as from the Fullwidth ASCII range (FF41..FF5A, FF21..FF3A)
+ *     are recognized.</li>
+ * </ul>
+ *
+ * Same as java.lang.Character.digit().
+ *
+ * @param   ch      the code point to be tested.
+ * @param   radix   the radix.
+ * @return  the numeric value represented by the character in the
+ *          specified radix,
+ *          or -1 if there is no value or if the value exceeds the radix.
+ *
+ * @see     UCHAR_NUMERIC_TYPE
+ * @see     u_forDigit
+ * @see     u_charDigitValue
+ * @see     u_isdigit
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_digit(UChar32 ch, int8_t radix);
+
+/**
+ * Determines the character representation for a specific digit in
+ * the specified radix. If the value of <code>radix</code> is not a
+ * valid radix, or the value of <code>digit</code> is not a valid
+ * digit in the specified radix, the null character
+ * (<code>U+0000</code>) is returned.
+ * <p>
+ * The <code>radix</code> argument is valid if it is greater than or
+ * equal to 2 and less than or equal to 36.
+ * The <code>digit</code> argument is valid if
+ * <code>0 <= digit < radix</code>.
+ * <p>
+ * If the digit is less than 10, then
+ * <code>'0' + digit</code> is returned. Otherwise, the value
+ * <code>'a' + digit - 10</code> is returned.
+ *
+ * Same as java.lang.Character.forDigit().
+ *
+ * @param   digit   the number to convert to a character.
+ * @param   radix   the radix.
+ * @return  the <code>char</code> representation of the specified digit
+ *          in the specified radix.
+ *
+ * @see     u_digit
+ * @see     u_charDigitValue
+ * @see     u_isdigit
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32 U_EXPORT2
+u_forDigit(int32_t digit, int8_t radix);
+
+/**
+ * Get the "age" of the code point.
+ * The "age" is the Unicode version when the code point was first
+ * designated (as a non-character or for Private Use)
+ * or assigned a character.
+ * This can be useful to avoid emitting code points to receiving
+ * processes that do not accept newer characters.
+ * The data is from the UCD file DerivedAge.txt.
+ *
+ * @param c The code point.
+ * @param versionArray The Unicode version number array, to be filled in.
+ *
+ * @stable ICU 2.1
+ */
+U_STABLE void U_EXPORT2
+u_charAge(UChar32 c, UVersionInfo versionArray);
+
+/**
+ * Gets the Unicode version information.
+ * The version array is filled in with the version information
+ * for the Unicode standard that is currently used by ICU.
+ * For example, Unicode version 3.1.1 is represented as an array with
+ * the values { 3, 1, 1, 0 }.
+ *
+ * @param versionArray an output array that will be filled in with
+ *                     the Unicode version number
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+u_getUnicodeVersion(UVersionInfo versionArray);
+
+#if !UCONFIG_NO_NORMALIZATION
+/**
+ * Get the FC_NFKC_Closure property string for a character.
+ * See Unicode Standard Annex #15 for details, search for "FC_NFKC_Closure"
+ * or for "FNC": http://www.unicode.org/reports/tr15/
+ *
+ * @param c The character (code point) for which to get the FC_NFKC_Closure string.
+ *             It must be <code>0<=c<=0x10ffff</code>.
+ * @param dest Destination address for copying the string.
+ *             The string will be zero-terminated if possible.
+ *             If there is no FC_NFKC_Closure string,
+ *             then the buffer will be set to the empty string.
+ * @param destCapacity <code>==sizeof(dest)</code>
+ * @param pErrorCode Pointer to a UErrorCode variable.
+ * @return The length of the string, or 0 if there is no FC_NFKC_Closure string for this character.
+ *         If the destCapacity is less than or equal to the length, then the buffer
+ *         contains the truncated name and the returned length indicates the full
+ *         length of the name.
+ *         The length does not include the zero-termination.
+ *
+ * @stable ICU 2.2
+ */
+U_STABLE int32_t U_EXPORT2
+u_getFC_NFKC_Closure(UChar32 c, UChar *dest, int32_t destCapacity, UErrorCode *pErrorCode);
+
+#endif
+
+
+U_CDECL_END
+
+#endif /*_UCHAR*/
+/*eof*/
diff --git a/icu/unicode/ucnv.h b/icu/unicode/ucnv.h
new file mode 100644
index 0000000..c5fc2dc
--- /dev/null
+++ b/icu/unicode/ucnv.h
@@ -0,0 +1,2034 @@
+/*
+**********************************************************************
+*   Copyright (C) 1999-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+ *  ucnv.h:
+ *  External APIs for the ICU's codeset conversion library
+ *  Bertrand A. Damiba
+ *
+ * Modification History:
+ *
+ *   Date        Name        Description
+ *   04/04/99    helena      Fixed internal header inclusion.
+ *   05/11/00    helena      Added setFallback and usesFallback APIs.
+ *   06/29/2000  helena      Major rewrite of the callback APIs.
+ *   12/07/2000  srl         Update of documentation
+ */
+
+/**
+ * \file
+ * \brief C API: Character conversion 
+ *
+ * <h2>Character Conversion C API</h2>
+ *
+ * <p>This API is used to convert codepage or character encoded data to and
+ * from UTF-16. You can open a converter with {@link ucnv_open() }. With that
+ * converter, you can get its properties, set options, convert your data and
+ * close the converter.</p>
+ *
+ * <p>Since many software programs recogize different converter names for
+ * different types of converters, there are other functions in this API to
+ * iterate over the converter aliases. The functions {@link ucnv_getAvailableName() },
+ * {@link ucnv_getAlias() } and {@link ucnv_getStandardName() } are some of the
+ * more frequently used alias functions to get this information.</p>
+ *
+ * <p>When a converter encounters an illegal, irregular, invalid or unmappable character
+ * its default behavior is to use a substitution character to replace the
+ * bad byte sequence. This behavior can be changed by using {@link ucnv_setFromUCallBack() }
+ * or {@link ucnv_setToUCallBack() } on the converter. The header ucnv_err.h defines
+ * many other callback actions that can be used instead of a character substitution.</p>
+ *
+ * <p>More information about this API can be found in our 
+ * <a href="http://icu-project.org/userguide/conversion.html">User's
+ * Guide</a>.</p>
+ */
+
+#ifndef UCNV_H
+#define UCNV_H
+
+#include "unicode/ucnv_err.h"
+#include "unicode/uenum.h"
+#include "unicode/localpointer.h"
+
+#ifndef __USET_H__
+
+/**
+ * USet is the C API type for Unicode sets.
+ * It is forward-declared here to avoid including the header file if related
+ * conversion APIs are not used.
+ * See unicode/uset.h
+ *
+ * @see ucnv_getUnicodeSet
+ * @stable ICU 2.6
+ */
+struct USet;
+/** @stable ICU 2.6 */
+typedef struct USet USet;
+
+#endif
+
+#if !UCONFIG_NO_CONVERSION
+
+U_CDECL_BEGIN
+
+/** Maximum length of a converter name including the terminating NULL @stable ICU 2.0 */
+#define UCNV_MAX_CONVERTER_NAME_LENGTH 60
+/** Maximum length of a converter name including path and terminating NULL @stable ICU 2.0 */
+#define UCNV_MAX_FULL_FILE_NAME_LENGTH (600+UCNV_MAX_CONVERTER_NAME_LENGTH)
+
+/** Shift in for EBDCDIC_STATEFUL and iso2022 states @stable ICU 2.0 */
+#define  UCNV_SI 0x0F
+/** Shift out for EBDCDIC_STATEFUL and iso2022 states @stable ICU 2.0 */
+#define  UCNV_SO 0x0E
+
+/**
+ * Enum for specifying basic types of converters
+ * @see ucnv_getType
+ * @stable ICU 2.0
+ */
+typedef enum {
+    /** @stable ICU 2.0 */
+    UCNV_UNSUPPORTED_CONVERTER = -1,
+    /** @stable ICU 2.0 */
+    UCNV_SBCS = 0,
+    /** @stable ICU 2.0 */
+    UCNV_DBCS = 1,
+    /** @stable ICU 2.0 */
+    UCNV_MBCS = 2,
+    /** @stable ICU 2.0 */
+    UCNV_LATIN_1 = 3,
+    /** @stable ICU 2.0 */
+    UCNV_UTF8 = 4,
+    /** @stable ICU 2.0 */
+    UCNV_UTF16_BigEndian = 5,
+    /** @stable ICU 2.0 */
+    UCNV_UTF16_LittleEndian = 6,
+    /** @stable ICU 2.0 */
+    UCNV_UTF32_BigEndian = 7,
+    /** @stable ICU 2.0 */
+    UCNV_UTF32_LittleEndian = 8,
+    /** @stable ICU 2.0 */
+    UCNV_EBCDIC_STATEFUL = 9,
+    /** @stable ICU 2.0 */
+    UCNV_ISO_2022 = 10,
+
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_1 = 11,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_2, 
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_3,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_4,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_5,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_6,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_8,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_11,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_16,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_17,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_18,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_19,
+    /** @stable ICU 2.0 */
+    UCNV_LMBCS_LAST = UCNV_LMBCS_19,
+    /** @stable ICU 2.0 */
+    UCNV_HZ,
+    /** @stable ICU 2.0 */
+    UCNV_SCSU,
+    /** @stable ICU 2.0 */
+    UCNV_ISCII,
+    /** @stable ICU 2.0 */
+    UCNV_US_ASCII,
+    /** @stable ICU 2.0 */
+    UCNV_UTF7,
+    /** @stable ICU 2.2 */
+    UCNV_BOCU1,
+    /** @stable ICU 2.2 */
+    UCNV_UTF16,
+    /** @stable ICU 2.2 */
+    UCNV_UTF32,
+    /** @stable ICU 2.2 */
+    UCNV_CESU8,
+    /** @stable ICU 2.4 */
+    UCNV_IMAP_MAILBOX,
+    /** @stable ICU 4.8 */
+    UCNV_COMPOUND_TEXT,
+
+    /* Number of converter types for which we have conversion routines. */
+    UCNV_NUMBER_OF_SUPPORTED_CONVERTER_TYPES
+} UConverterType;
+
+/**
+ * Enum for specifying which platform a converter ID refers to.
+ * The use of platform/CCSID is not recommended. See ucnv_openCCSID().
+ *
+ * @see ucnv_getPlatform
+ * @see ucnv_openCCSID
+ * @see ucnv_getCCSID
+ * @stable ICU 2.0
+ */
+typedef enum {
+    UCNV_UNKNOWN = -1,
+    UCNV_IBM = 0
+} UConverterPlatform;
+
+/**
+ * Function pointer for error callback in the codepage to unicode direction.
+ * Called when an error has occured in conversion to unicode, or on open/close of the callback (see reason).
+ * @param context Pointer to the callback's private data
+ * @param args Information about the conversion in progress
+ * @param codeUnits Points to 'length' bytes of the concerned codepage sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param reason Defines the reason the callback was invoked
+ * @param pErrorCode    ICU error code in/out parameter.
+ *                      For converter callback functions, set to a conversion error
+ *                      before the call, and the callback may reset it to U_ZERO_ERROR.
+ * @see ucnv_setToUCallBack
+ * @see UConverterToUnicodeArgs
+ * @stable ICU 2.0
+ */
+typedef void (U_EXPORT2 *UConverterToUCallback) (
+                  const void* context,
+                  UConverterToUnicodeArgs *args,
+                  const char *codeUnits,
+                  int32_t length,
+                  UConverterCallbackReason reason,
+                  UErrorCode *pErrorCode);
+
+/**
+ * Function pointer for error callback in the unicode to codepage direction.
+ * Called when an error has occured in conversion from unicode, or on open/close of the callback (see reason).
+ * @param context Pointer to the callback's private data
+ * @param args Information about the conversion in progress
+ * @param codeUnits Points to 'length' UChars of the concerned Unicode sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param codePoint Single UChar32 (UTF-32) containing the concerend Unicode codepoint.
+ * @param reason Defines the reason the callback was invoked
+ * @param pErrorCode    ICU error code in/out parameter.
+ *                      For converter callback functions, set to a conversion error
+ *                      before the call, and the callback may reset it to U_ZERO_ERROR.
+ * @see ucnv_setFromUCallBack
+ * @stable ICU 2.0
+ */
+typedef void (U_EXPORT2 *UConverterFromUCallback) (
+                    const void* context,
+                    UConverterFromUnicodeArgs *args,
+                    const UChar* codeUnits,
+                    int32_t length,
+                    UChar32 codePoint,
+                    UConverterCallbackReason reason,
+                    UErrorCode *pErrorCode);
+
+U_CDECL_END
+
+/**
+ * Character that separates converter names from options and options from each other.
+ * @see ucnv_open
+ * @stable ICU 2.0
+ */
+#define UCNV_OPTION_SEP_CHAR ','
+
+/**
+ * String version of UCNV_OPTION_SEP_CHAR. 
+ * @see ucnv_open
+ * @stable ICU 2.0
+ */
+#define UCNV_OPTION_SEP_STRING ","
+
+/**
+ * Character that separates a converter option from its value.
+ * @see ucnv_open
+ * @stable ICU 2.0
+ */
+#define UCNV_VALUE_SEP_CHAR '='
+
+/**
+ * String version of UCNV_VALUE_SEP_CHAR. 
+ * @see ucnv_open
+ * @stable ICU 2.0
+ */
+#define UCNV_VALUE_SEP_STRING "="
+
+/**
+ * Converter option for specifying a locale.
+ * For example, ucnv_open("SCSU,locale=ja", &errorCode);
+ * See convrtrs.txt.
+ *
+ * @see ucnv_open
+ * @stable ICU 2.0
+ */
+#define UCNV_LOCALE_OPTION_STRING ",locale="
+
+/**
+ * Converter option for specifying a version selector (0..9) for some converters.
+ * For example, 
+ * \code
+ *   ucnv_open("UTF-7,version=1", &errorCode);
+ * \endcode
+ * See convrtrs.txt.
+ *
+ * @see ucnv_open
+ * @stable ICU 2.4
+ */
+#define UCNV_VERSION_OPTION_STRING ",version="
+
+/**
+ * Converter option for EBCDIC SBCS or mixed-SBCS/DBCS (stateful) codepages.
+ * Swaps Unicode mappings for EBCDIC LF and NL codes, as used on
+ * S/390 (z/OS) Unix System Services (Open Edition).
+ * For example, ucnv_open("ibm-1047,swaplfnl", &errorCode);
+ * See convrtrs.txt.
+ *
+ * @see ucnv_open
+ * @stable ICU 2.4
+ */
+#define UCNV_SWAP_LFNL_OPTION_STRING ",swaplfnl"
+
+/**
+ * Do a fuzzy compare of two converter/alias names.
+ * The comparison is case-insensitive, ignores leading zeroes if they are not
+ * followed by further digits, and ignores all but letters and digits.
+ * Thus the strings "UTF-8", "utf_8", "u*T@f08" and "Utf 8" are exactly equivalent.
+ * See section 1.4, Charset Alias Matching in Unicode Technical Standard #22
+ * at http://www.unicode.org/reports/tr22/
+ *
+ * @param name1 a converter name or alias, zero-terminated
+ * @param name2 a converter name or alias, zero-terminated
+ * @return 0 if the names match, or a negative value if the name1
+ * lexically precedes name2, or a positive value if the name1
+ * lexically follows name2.
+ * @stable ICU 2.0
+ */
+U_STABLE int U_EXPORT2
+ucnv_compareNames(const char *name1, const char *name2);
+
+
+/**
+ * Creates a UConverter object with the name of a coded character set specified as a C string.
+ * The actual name will be resolved with the alias file
+ * using a case-insensitive string comparison that ignores
+ * leading zeroes and all non-alphanumeric characters.
+ * E.g., the names "UTF8", "utf-8", "u*T@f08" and "Utf 8" are all equivalent.
+ * (See also ucnv_compareNames().)
+ * If <code>NULL</code> is passed for the converter name, it will create one with the
+ * getDefaultName return value.
+ *
+ * <p>A converter name for ICU 1.5 and above may contain options
+ * like a locale specification to control the specific behavior of
+ * the newly instantiated converter.
+ * The meaning of the options depends on the particular converter.
+ * If an option is not defined for or recognized by a given converter, then it is ignored.</p>
+ *
+ * <p>Options are appended to the converter name string, with a
+ * <code>UCNV_OPTION_SEP_CHAR</code> between the name and the first option and
+ * also between adjacent options.</p>
+ *
+ * <p>If the alias is ambiguous, then the preferred converter is used
+ * and the status is set to U_AMBIGUOUS_ALIAS_WARNING.</p>
+ *
+ * <p>The conversion behavior and names can vary between platforms. ICU may
+ * convert some characters differently from other platforms. Details on this topic
+ * are in the <a href="http://icu-project.org/userguide/conversion.html">User's
+ * Guide</a>. Aliases starting with a "cp" prefix have no specific meaning
+ * other than its an alias starting with the letters "cp". Please do not
+ * associate any meaning to these aliases.</p>
+ *
+ * \snippet samples/ucnv/convsamp.cpp ucnv_open
+ *
+ * @param converterName Name of the coded character set table.
+ *          This may have options appended to the string.
+ *          IANA alias character set names, IBM CCSIDs starting with "ibm-",
+ *          Windows codepage numbers starting with "windows-" are frequently
+ *          used for this parameter. See ucnv_getAvailableName and
+ *          ucnv_getAlias for a complete list that is available.
+ *          If this parameter is NULL, the default converter will be used.
+ * @param err outgoing error status <TT>U_MEMORY_ALLOCATION_ERROR, U_FILE_ACCESS_ERROR</TT>
+ * @return the created Unicode converter object, or <TT>NULL</TT> if an error occured
+ * @see ucnv_openU
+ * @see ucnv_openCCSID
+ * @see ucnv_getAvailableName
+ * @see ucnv_getAlias
+ * @see ucnv_getDefaultName
+ * @see ucnv_close
+ * @see ucnv_compareNames
+ * @stable ICU 2.0
+ */
+U_STABLE UConverter* U_EXPORT2 
+ucnv_open(const char *converterName, UErrorCode *err);
+
+
+/**
+ * Creates a Unicode converter with the names specified as unicode string. 
+ * The name should be limited to the ASCII-7 alphanumerics range.
+ * The actual name will be resolved with the alias file
+ * using a case-insensitive string comparison that ignores
+ * leading zeroes and all non-alphanumeric characters.
+ * E.g., the names "UTF8", "utf-8", "u*T@f08" and "Utf 8" are all equivalent.
+ * (See also ucnv_compareNames().)
+ * If <TT>NULL</TT> is passed for the converter name, it will create 
+ * one with the ucnv_getDefaultName() return value.
+ * If the alias is ambiguous, then the preferred converter is used
+ * and the status is set to U_AMBIGUOUS_ALIAS_WARNING.
+ *
+ * <p>See ucnv_open for the complete details</p>
+ * @param name Name of the UConverter table in a zero terminated 
+ *        Unicode string
+ * @param err outgoing error status <TT>U_MEMORY_ALLOCATION_ERROR, 
+ *        U_FILE_ACCESS_ERROR</TT>
+ * @return the created Unicode converter object, or <TT>NULL</TT> if an 
+ *        error occured
+ * @see ucnv_open
+ * @see ucnv_openCCSID
+ * @see ucnv_close
+ * @see ucnv_compareNames
+ * @stable ICU 2.0
+ */
+U_STABLE UConverter* U_EXPORT2 
+ucnv_openU(const UChar *name,
+           UErrorCode *err);
+
+/**
+ * Creates a UConverter object from a CCSID number and platform pair.
+ * Note that the usefulness of this function is limited to platforms with numeric
+ * encoding IDs. Only IBM and Microsoft platforms use numeric (16-bit) identifiers for
+ * encodings.
+ *
+ * In addition, IBM CCSIDs and Unicode conversion tables are not 1:1 related.
+ * For many IBM CCSIDs there are multiple (up to six) Unicode conversion tables, and
+ * for some Unicode conversion tables there are multiple CCSIDs.
+ * Some "alternate" Unicode conversion tables are provided by the
+ * IBM CDRA conversion table registry.
+ * The most prominent example of a systematic modification of conversion tables that is
+ * not provided in the form of conversion table files in the repository is
+ * that S/390 Unix System Services swaps the codes for Line Feed and New Line in all
+ * EBCDIC codepages, which requires such a swap in the Unicode conversion tables as well.
+ *
+ * Only IBM default conversion tables are accessible with ucnv_openCCSID().
+ * ucnv_getCCSID() will return the same CCSID for all conversion tables that are associated
+ * with that CCSID.
+ *
+ * Currently, the only "platform" supported in the ICU converter API is UCNV_IBM.
+ *
+ * In summary, the use of CCSIDs and the associated API functions is not recommended.
+ *
+ * In order to open a converter with the default IBM CDRA Unicode conversion table,
+ * you can use this function or use the prefix "ibm-":
+ * \code
+ *     char name[20];
+ *     sprintf(name, "ibm-%hu", ccsid);
+ *     cnv=ucnv_open(name, &errorCode);
+ * \endcode
+ *
+ * In order to open a converter with the IBM S/390 Unix System Services variant
+ * of a Unicode/EBCDIC conversion table,
+ * you can use the prefix "ibm-" together with the option string UCNV_SWAP_LFNL_OPTION_STRING:
+ * \code
+ *     char name[20];
+ *     sprintf(name, "ibm-%hu" UCNV_SWAP_LFNL_OPTION_STRING, ccsid);
+ *     cnv=ucnv_open(name, &errorCode);
+ * \endcode
+ *
+ * In order to open a converter from a Microsoft codepage number, use the prefix "cp":
+ * \code
+ *     char name[20];
+ *     sprintf(name, "cp%hu", codepageID);
+ *     cnv=ucnv_open(name, &errorCode);
+ * \endcode
+ *
+ * If the alias is ambiguous, then the preferred converter is used
+ * and the status is set to U_AMBIGUOUS_ALIAS_WARNING.
+ *
+ * @param codepage codepage number to create
+ * @param platform the platform in which the codepage number exists
+ * @param err error status <TT>U_MEMORY_ALLOCATION_ERROR, U_FILE_ACCESS_ERROR</TT>
+ * @return the created Unicode converter object, or <TT>NULL</TT> if an error
+ *   occured.
+ * @see ucnv_open
+ * @see ucnv_openU
+ * @see ucnv_close
+ * @see ucnv_getCCSID
+ * @see ucnv_getPlatform
+ * @see UConverterPlatform
+ * @stable ICU 2.0
+ */
+U_STABLE UConverter* U_EXPORT2
+ucnv_openCCSID(int32_t codepage,
+               UConverterPlatform platform,
+               UErrorCode * err);
+
+/**
+ * <p>Creates a UConverter object specified from a packageName and a converterName.</p>
+ * 
+ * <p>The packageName and converterName must point to an ICU udata object, as defined by
+ *   <code> udata_open( packageName, "cnv", converterName, err) </code> or equivalent.
+ * Typically, packageName will refer to a (.dat) file, or to a package registered with
+ * udata_setAppData(). Using a full file or directory pathname for packageName is deprecated.</p>
+ * 
+ * <p>The name will NOT be looked up in the alias mechanism, nor will the converter be
+ * stored in the converter cache or the alias table. The only way to open further converters
+ * is call this function multiple times, or use the ucnv_safeClone() function to clone a 
+ * 'master' converter.</p>
+ *
+ * <p>A future version of ICU may add alias table lookups and/or caching
+ * to this function.</p>
+ * 
+ * <p>Example Use:
+ *      <code>cnv = ucnv_openPackage("myapp", "myconverter", &err);</code>
+ * </p>
+ *
+ * @param packageName name of the package (equivalent to 'path' in udata_open() call)
+ * @param converterName name of the data item to be used, without suffix.
+ * @param err outgoing error status <TT>U_MEMORY_ALLOCATION_ERROR, U_FILE_ACCESS_ERROR</TT>
+ * @return the created Unicode converter object, or <TT>NULL</TT> if an error occured
+ * @see udata_open
+ * @see ucnv_open
+ * @see ucnv_safeClone
+ * @see ucnv_close
+ * @stable ICU 2.2
+ */
+U_STABLE UConverter* U_EXPORT2 
+ucnv_openPackage(const char *packageName, const char *converterName, UErrorCode *err);
+
+/**
+ * Thread safe converter cloning operation.
+ * For most efficient operation, pass in a stackBuffer (and a *pBufferSize)
+ * with at least U_CNV_SAFECLONE_BUFFERSIZE bytes of space.
+ * If the buffer size is sufficient, then the clone will use the stack buffer;
+ * otherwise, it will be allocated, and *pBufferSize will indicate
+ * the actual size. (This should not occur with U_CNV_SAFECLONE_BUFFERSIZE.)
+ *
+ * You must ucnv_close() the clone in any case.
+ *
+ * If *pBufferSize==0, (regardless of whether stackBuffer==NULL or not)
+ * then *pBufferSize will be changed to a sufficient size
+ * for cloning this converter,
+ * without actually cloning the converter ("pure pre-flighting").
+ *
+ * If *pBufferSize is greater than zero but not large enough for a stack-based
+ * clone, then the converter is cloned using newly allocated memory
+ * and *pBufferSize is changed to the necessary size.
+ *
+ * If the converter clone fits into the stack buffer but the stack buffer is not
+ * sufficiently aligned for the clone, then the clone will use an
+ * adjusted pointer and use an accordingly smaller buffer size.
+ *
+ * @param cnv converter to be cloned
+ * @param stackBuffer <em>Deprecated functionality as of ICU 52, use NULL.</em><br>
+ *  user allocated space for the new clone. If NULL new memory will be allocated. 
+ *  If buffer is not large enough, new memory will be allocated.
+ *  Clients can use the U_CNV_SAFECLONE_BUFFERSIZE. This will probably be enough to avoid memory allocations.
+ * @param pBufferSize <em>Deprecated functionality as of ICU 52, use NULL or 1.</em><br>
+ *  pointer to size of allocated space.
+ * @param status to indicate whether the operation went on smoothly or there were errors
+ *  An informational status value, U_SAFECLONE_ALLOCATED_WARNING,
+ *  is used if any allocations were necessary.
+ *  However, it is better to check if *pBufferSize grew for checking for
+ *  allocations because warning codes can be overridden by subsequent
+ *  function calls.
+ * @return pointer to the new clone
+ * @stable ICU 2.0
+ */
+U_STABLE UConverter * U_EXPORT2 
+ucnv_safeClone(const UConverter *cnv, 
+               void             *stackBuffer,
+               int32_t          *pBufferSize, 
+               UErrorCode       *status);
+
+#ifndef U_HIDE_DEPRECATED_API
+
+/**
+ * \def U_CNV_SAFECLONE_BUFFERSIZE
+ * Definition of a buffer size that is designed to be large enough for
+ * converters to be cloned with ucnv_safeClone().
+ * @deprecated ICU 52. Do not rely on ucnv_safeClone() cloning into any provided buffer.
+ */
+#define U_CNV_SAFECLONE_BUFFERSIZE  1024
+
+#endif /* U_HIDE_DEPRECATED_API */
+
+/**
+ * Deletes the unicode converter and releases resources associated
+ * with just this instance.
+ * Does not free up shared converter tables.
+ *
+ * @param converter the converter object to be deleted
+ * @see ucnv_open
+ * @see ucnv_openU
+ * @see ucnv_openCCSID
+ * @stable ICU 2.0
+ */
+U_STABLE void  U_EXPORT2
+ucnv_close(UConverter * converter);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUConverterPointer
+ * "Smart pointer" class, closes a UConverter via ucnv_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUConverterPointer, UConverter, ucnv_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Fills in the output parameter, subChars, with the substitution characters
+ * as multiple bytes.
+ * If ucnv_setSubstString() set a Unicode string because the converter is
+ * stateful, then subChars will be an empty string.
+ *
+ * @param converter the Unicode converter
+ * @param subChars the subsitution characters
+ * @param len on input the capacity of subChars, on output the number 
+ * of bytes copied to it
+ * @param  err the outgoing error status code.
+ * If the substitution character array is too small, an
+ * <TT>U_INDEX_OUTOFBOUNDS_ERROR</TT> will be returned.
+ * @see ucnv_setSubstString
+ * @see ucnv_setSubstChars
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_getSubstChars(const UConverter *converter,
+                   char *subChars,
+                   int8_t *len,
+                   UErrorCode *err);
+
+/**
+ * Sets the substitution chars when converting from unicode to a codepage. The
+ * substitution is specified as a string of 1-4 bytes, and may contain
+ * <TT>NULL</TT> bytes.
+ * The subChars must represent a single character. The caller needs to know the
+ * byte sequence of a valid character in the converter's charset.
+ * For some converters, for example some ISO 2022 variants, only single-byte
+ * substitution characters may be supported.
+ * The newer ucnv_setSubstString() function relaxes these limitations.
+ *
+ * @param converter the Unicode converter
+ * @param subChars the substitution character byte sequence we want set
+ * @param len the number of bytes in subChars
+ * @param err the error status code.  <TT>U_INDEX_OUTOFBOUNDS_ERROR </TT> if
+ * len is bigger than the maximum number of bytes allowed in subchars
+ * @see ucnv_setSubstString
+ * @see ucnv_getSubstChars
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_setSubstChars(UConverter *converter,
+                   const char *subChars,
+                   int8_t len,
+                   UErrorCode *err);
+
+/**
+ * Set a substitution string for converting from Unicode to a charset.
+ * The caller need not know the charset byte sequence for each charset.
+ *
+ * Unlike ucnv_setSubstChars() which is designed to set a charset byte sequence
+ * for a single character, this function takes a Unicode string with
+ * zero, one or more characters, and immediately verifies that the string can be
+ * converted to the charset.
+ * If not, or if the result is too long (more than 32 bytes as of ICU 3.6),
+ * then the function returns with an error accordingly.
+ *
+ * Also unlike ucnv_setSubstChars(), this function works for stateful charsets
+ * by converting on the fly at the point of substitution rather than setting
+ * a fixed byte sequence.
+ *
+ * @param cnv The UConverter object.
+ * @param s The Unicode string.
+ * @param length The number of UChars in s, or -1 for a NUL-terminated string.
+ * @param err Pointer to a standard ICU error code. Its input value must
+ *            pass the U_SUCCESS() test, or else the function returns
+ *            immediately. Check for U_FAILURE() on output or use with
+ *            function chaining. (See User Guide for details.)
+ *
+ * @see ucnv_setSubstChars
+ * @see ucnv_getSubstChars
+ * @stable ICU 3.6
+ */
+U_STABLE void U_EXPORT2
+ucnv_setSubstString(UConverter *cnv,
+                    const UChar *s,
+                    int32_t length,
+                    UErrorCode *err);
+
+/**
+ * Fills in the output parameter, errBytes, with the error characters from the
+ * last failing conversion.
+ *
+ * @param converter the Unicode converter
+ * @param errBytes the codepage bytes which were in error
+ * @param len on input the capacity of errBytes, on output the number of
+ *  bytes which were copied to it
+ * @param err the error status code.
+ * If the substitution character array is too small, an
+ * <TT>U_INDEX_OUTOFBOUNDS_ERROR</TT> will be returned.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_getInvalidChars(const UConverter *converter,
+                     char *errBytes,
+                     int8_t *len,
+                     UErrorCode *err);
+
+/**
+ * Fills in the output parameter, errChars, with the error characters from the
+ * last failing conversion.
+ *
+ * @param converter the Unicode converter
+ * @param errUChars the UChars which were in error
+ * @param len on input the capacity of errUChars, on output the number of 
+ *  UChars which were copied to it
+ * @param err the error status code.
+ * If the substitution character array is too small, an
+ * <TT>U_INDEX_OUTOFBOUNDS_ERROR</TT> will be returned.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_getInvalidUChars(const UConverter *converter,
+                      UChar *errUChars,
+                      int8_t *len,
+                      UErrorCode *err);
+
+/**
+ * Resets the state of a converter to the default state. This is used
+ * in the case of an error, to restart a conversion from a known default state.
+ * It will also empty the internal output buffers.
+ * @param converter the Unicode converter
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_reset(UConverter *converter);
+
+/**
+ * Resets the to-Unicode part of a converter state to the default state.
+ * This is used in the case of an error to restart a conversion to
+ * Unicode to a known default state. It will also empty the internal
+ * output buffers used for the conversion to Unicode codepoints.
+ * @param converter the Unicode converter
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucnv_resetToUnicode(UConverter *converter);
+
+/**
+ * Resets the from-Unicode part of a converter state to the default state.
+ * This is used in the case of an error to restart a conversion from
+ * Unicode to a known default state. It will also empty the internal output
+ * buffers used for the conversion from Unicode codepoints.
+ * @param converter the Unicode converter
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucnv_resetFromUnicode(UConverter *converter);
+
+/**
+ * Returns the maximum number of bytes that are output per UChar in conversion
+ * from Unicode using this converter.
+ * The returned number can be used with UCNV_GET_MAX_BYTES_FOR_STRING
+ * to calculate the size of a target buffer for conversion from Unicode.
+ *
+ * Note: Before ICU 2.8, this function did not return reliable numbers for
+ * some stateful converters (EBCDIC_STATEFUL, ISO-2022) and LMBCS.
+ *
+ * This number may not be the same as the maximum number of bytes per
+ * "conversion unit". In other words, it may not be the intuitively expected
+ * number of bytes per character that would be published for a charset,
+ * and may not fulfill any other purpose than the allocation of an output
+ * buffer of guaranteed sufficient size for a given input length and converter.
+ *
+ * Examples for special cases that are taken into account:
+ * - Supplementary code points may convert to more bytes than BMP code points.
+ *   This function returns bytes per UChar (UTF-16 code unit), not per
+ *   Unicode code point, for efficient buffer allocation.
+ * - State-shifting output (SI/SO, escapes, etc.) from stateful converters.
+ * - When m input UChars are converted to n output bytes, then the maximum m/n
+ *   is taken into account.
+ *
+ * The number returned here does not take into account
+ * (see UCNV_GET_MAX_BYTES_FOR_STRING):
+ * - callbacks which output more than one charset character sequence per call,
+ *   like escape callbacks
+ * - initial and final non-character bytes that are output by some converters
+ *   (automatic BOMs, initial escape sequence, final SI, etc.)
+ *
+ * Examples for returned values:
+ * - SBCS charsets: 1
+ * - Shift-JIS: 2
+ * - UTF-16: 2 (2 per BMP, 4 per surrogate _pair_, BOM not counted)
+ * - UTF-8: 3 (3 per BMP, 4 per surrogate _pair_)
+ * - EBCDIC_STATEFUL (EBCDIC mixed SBCS/DBCS): 3 (SO + DBCS)
+ * - ISO-2022: 3 (always outputs UTF-8)
+ * - ISO-2022-JP: 6 (4-byte escape sequences + DBCS)
+ * - ISO-2022-CN: 8 (4-byte designator sequences + 2-byte SS2/SS3 + DBCS)
+ *
+ * @param converter The Unicode converter.
+ * @return The maximum number of bytes per UChar that are output by ucnv_fromUnicode(),
+ *         to be used together with UCNV_GET_MAX_BYTES_FOR_STRING for buffer allocation.
+ *
+ * @see UCNV_GET_MAX_BYTES_FOR_STRING
+ * @see ucnv_getMinCharSize
+ * @stable ICU 2.0
+ */
+U_STABLE int8_t U_EXPORT2
+ucnv_getMaxCharSize(const UConverter *converter);
+
+/**
+ * Calculates the size of a buffer for conversion from Unicode to a charset.
+ * The calculated size is guaranteed to be sufficient for this conversion.
+ *
+ * It takes into account initial and final non-character bytes that are output
+ * by some converters.
+ * It does not take into account callbacks which output more than one charset
+ * character sequence per call, like escape callbacks.
+ * The default (substitution) callback only outputs one charset character sequence.
+ *
+ * @param length Number of UChars to be converted.
+ * @param maxCharSize Return value from ucnv_getMaxCharSize() for the converter
+ *                    that will be used.
+ * @return Size of a buffer that will be large enough to hold the output bytes of
+ *         converting length UChars with the converter that returned the maxCharSize.
+ *
+ * @see ucnv_getMaxCharSize
+ * @stable ICU 2.8
+ */
+#define UCNV_GET_MAX_BYTES_FOR_STRING(length, maxCharSize) \
+     (((int32_t)(length)+10)*(int32_t)(maxCharSize))
+
+/**
+ * Returns the minimum byte length for characters in this codepage. 
+ * This is usually either 1 or 2.
+ * @param converter the Unicode converter
+ * @return the minimum number of bytes allowed by this particular converter
+ * @see ucnv_getMaxCharSize
+ * @stable ICU 2.0
+ */
+U_STABLE int8_t U_EXPORT2
+ucnv_getMinCharSize(const UConverter *converter);
+
+/**
+ * Returns the display name of the converter passed in based on the Locale 
+ * passed in. If the locale contains no display name, the internal ASCII
+ * name will be filled in.
+ *
+ * @param converter the Unicode converter.
+ * @param displayLocale is the specific Locale we want to localised for
+ * @param displayName user provided buffer to be filled in
+ * @param displayNameCapacity size of displayName Buffer
+ * @param err error status code
+ * @return displayNameLength number of UChar needed in displayName
+ * @see ucnv_getName
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_getDisplayName(const UConverter *converter,
+                    const char *displayLocale,
+                    UChar *displayName,
+                    int32_t displayNameCapacity,
+                    UErrorCode *err);
+
+/**
+ * Gets the internal, canonical name of the converter (zero-terminated).
+ * The lifetime of the returned string will be that of the converter 
+ * passed to this function.
+ * @param converter the Unicode converter
+ * @param err UErrorCode status
+ * @return the internal name of the converter
+ * @see ucnv_getDisplayName
+ * @stable ICU 2.0
+ */
+U_STABLE const char * U_EXPORT2 
+ucnv_getName(const UConverter *converter, UErrorCode *err);
+
+/**
+ * Gets a codepage number associated with the converter. This is not guaranteed
+ * to be the one used to create the converter. Some converters do not represent
+ * platform registered codepages and return zero for the codepage number.
+ * The error code fill-in parameter indicates if the codepage number
+ * is available.
+ * Does not check if the converter is <TT>NULL</TT> or if converter's data
+ * table is <TT>NULL</TT>.
+ *
+ * Important: The use of CCSIDs is not recommended because it is limited
+ * to only two platforms in principle and only one (UCNV_IBM) in the current
+ * ICU converter API.
+ * Also, CCSIDs are insufficient to identify IBM Unicode conversion tables precisely.
+ * For more details see ucnv_openCCSID().
+ *
+ * @param converter the Unicode converter
+ * @param err the error status code.
+ * @return If any error occurrs, -1 will be returned otherwise, the codepage number
+ * will be returned
+ * @see ucnv_openCCSID
+ * @see ucnv_getPlatform
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_getCCSID(const UConverter *converter,
+              UErrorCode *err);
+
+/**
+ * Gets a codepage platform associated with the converter. Currently, 
+ * only <TT>UCNV_IBM</TT> will be returned.
+ * Does not test if the converter is <TT>NULL</TT> or if converter's data 
+ * table is <TT>NULL</TT>. 
+ * @param converter the Unicode converter
+ * @param err the error status code.
+ * @return The codepage platform
+ * @stable ICU 2.0
+ */
+U_STABLE UConverterPlatform U_EXPORT2
+ucnv_getPlatform(const UConverter *converter,
+                 UErrorCode *err);
+
+/**
+ * Gets the type of the converter
+ * e.g. SBCS, MBCS, DBCS, UTF8, UTF16_BE, UTF16_LE, ISO_2022, 
+ * EBCDIC_STATEFUL, LATIN_1
+ * @param converter a valid, opened converter
+ * @return the type of the converter
+ * @stable ICU 2.0
+ */
+U_STABLE UConverterType U_EXPORT2
+ucnv_getType(const UConverter * converter);
+
+/**
+ * Gets the "starter" (lead) bytes for converters of type MBCS.
+ * Will fill in an <TT>U_ILLEGAL_ARGUMENT_ERROR</TT> if converter passed in
+ * is not MBCS. Fills in an array of type UBool, with the value of the byte 
+ * as offset to the array. For example, if (starters[0x20] == TRUE) at return,
+ * it means that the byte 0x20 is a starter byte in this converter.
+ * Context pointers are always owned by the caller.
+ * 
+ * @param converter a valid, opened converter of type MBCS
+ * @param starters an array of size 256 to be filled in
+ * @param err error status, <TT>U_ILLEGAL_ARGUMENT_ERROR</TT> if the 
+ * converter is not a type which can return starters.
+ * @see ucnv_getType
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_getStarters(const UConverter* converter, 
+                 UBool starters[256],
+                 UErrorCode* err);
+
+
+/**
+ * Selectors for Unicode sets that can be returned by ucnv_getUnicodeSet().
+ * @see ucnv_getUnicodeSet
+ * @stable ICU 2.6
+ */
+typedef enum UConverterUnicodeSet {
+    /** Select the set of roundtrippable Unicode code points. @stable ICU 2.6 */
+    UCNV_ROUNDTRIP_SET,
+    /** Select the set of Unicode code points with roundtrip or fallback mappings. @stable ICU 4.0 */
+    UCNV_ROUNDTRIP_AND_FALLBACK_SET,
+    /** Number of UConverterUnicodeSet selectors. @stable ICU 2.6 */
+    UCNV_SET_COUNT
+} UConverterUnicodeSet;
+
+
+/**
+ * Returns the set of Unicode code points that can be converted by an ICU converter.
+ *
+ * Returns one of several kinds of set:
+ *
+ * 1. UCNV_ROUNDTRIP_SET
+ *
+ * The set of all Unicode code points that can be roundtrip-converted
+ * (converted without any data loss) with the converter (ucnv_fromUnicode()).
+ * This set will not include code points that have fallback mappings
+ * or are only the result of reverse fallback mappings.
+ * This set will also not include PUA code points with fallbacks, although
+ * ucnv_fromUnicode() will always uses those mappings despite ucnv_setFallback().
+ * See UTR #22 "Character Mapping Markup Language"
+ * at http://www.unicode.org/reports/tr22/
+ *
+ * This is useful for example for
+ * - checking that a string or document can be roundtrip-converted with a converter,
+ *   without/before actually performing the conversion
+ * - testing if a converter can be used for text for typical text for a certain locale,
+ *   by comparing its roundtrip set with the set of ExemplarCharacters from
+ *   ICU's locale data or other sources
+ *
+ * 2. UCNV_ROUNDTRIP_AND_FALLBACK_SET
+ *
+ * The set of all Unicode code points that can be converted with the converter (ucnv_fromUnicode())
+ * when fallbacks are turned on (see ucnv_setFallback()).
+ * This set includes all code points with roundtrips and fallbacks (but not reverse fallbacks).
+ *
+ * In the future, there may be more UConverterUnicodeSet choices to select
+ * sets with different properties.
+ *
+ * @param cnv The converter for which a set is requested.
+ * @param setFillIn A valid USet *. It will be cleared by this function before
+ *            the converter's specific set is filled into the USet.
+ * @param whichSet A UConverterUnicodeSet selector;
+ *              currently UCNV_ROUNDTRIP_SET is the only supported value.
+ * @param pErrorCode ICU error code in/out parameter.
+ *                   Must fulfill U_SUCCESS before the function call.
+ *
+ * @see UConverterUnicodeSet
+ * @see uset_open
+ * @see uset_close
+ * @stable ICU 2.6
+ */
+U_STABLE void U_EXPORT2
+ucnv_getUnicodeSet(const UConverter *cnv,
+                   USet *setFillIn,
+                   UConverterUnicodeSet whichSet,
+                   UErrorCode *pErrorCode);
+
+/**
+ * Gets the current calback function used by the converter when an illegal
+ *  or invalid codepage sequence is found. 
+ * Context pointers are always owned by the caller.
+ *
+ * @param converter the unicode converter
+ * @param action fillin: returns the callback function pointer
+ * @param context fillin: returns the callback's private void* context
+ * @see ucnv_setToUCallBack
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_getToUCallBack (const UConverter * converter,
+                     UConverterToUCallback *action,
+                     const void **context);
+
+/**
+ * Gets the current callback function used by the converter when illegal 
+ * or invalid Unicode sequence is found.
+ * Context pointers are always owned by the caller.
+ *
+ * @param converter the unicode converter
+ * @param action fillin: returns the callback function pointer
+ * @param context fillin: returns the callback's private void* context
+ * @see ucnv_setFromUCallBack
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_getFromUCallBack (const UConverter * converter,
+                       UConverterFromUCallback *action,
+                       const void **context);
+
+/**
+ * Changes the callback function used by the converter when
+ * an illegal or invalid sequence is found.
+ * Context pointers are always owned by the caller.
+ * Predefined actions and contexts can be found in the ucnv_err.h header.
+ *
+ * @param converter the unicode converter
+ * @param newAction the new callback function
+ * @param newContext the new toUnicode callback context pointer. This can be NULL.
+ * @param oldAction fillin: returns the old callback function pointer. This can be NULL.
+ * @param oldContext fillin: returns the old callback's private void* context. This can be NULL.
+ * @param err The error code status
+ * @see ucnv_getToUCallBack
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_setToUCallBack (UConverter * converter,
+                     UConverterToUCallback newAction,
+                     const void* newContext,
+                     UConverterToUCallback *oldAction,
+                     const void** oldContext,
+                     UErrorCode * err);
+
+/**
+ * Changes the current callback function used by the converter when
+ * an illegal or invalid sequence is found.
+ * Context pointers are always owned by the caller.
+ * Predefined actions and contexts can be found in the ucnv_err.h header.
+ *
+ * @param converter the unicode converter
+ * @param newAction the new callback function
+ * @param newContext the new fromUnicode callback context pointer. This can be NULL.
+ * @param oldAction fillin: returns the old callback function pointer. This can be NULL.
+ * @param oldContext fillin: returns the old callback's private void* context. This can be NULL.
+ * @param err The error code status
+ * @see ucnv_getFromUCallBack
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_setFromUCallBack (UConverter * converter,
+                       UConverterFromUCallback newAction,
+                       const void *newContext,
+                       UConverterFromUCallback *oldAction,
+                       const void **oldContext,
+                       UErrorCode * err);
+
+/**
+ * Converts an array of unicode characters to an array of codepage
+ * characters. This function is optimized for converting a continuous
+ * stream of data in buffer-sized chunks, where the entire source and
+ * target does not fit in available buffers.
+ * 
+ * The source pointer is an in/out parameter. It starts out pointing where the 
+ * conversion is to begin, and ends up pointing after the last UChar consumed. 
+ * 
+ * Target similarly starts out pointer at the first available byte in the output
+ * buffer, and ends up pointing after the last byte written to the output.
+ * 
+ * The converter always attempts to consume the entire source buffer, unless 
+ * (1.) the target buffer is full, or (2.) a failing error is returned from the
+ * current callback function.  When a successful error status has been
+ * returned, it means that all of the source buffer has been
+ *  consumed. At that point, the caller should reset the source and
+ *  sourceLimit pointers to point to the next chunk.
+ * 
+ * At the end of the stream (flush==TRUE), the input is completely consumed
+ * when *source==sourceLimit and no error code is set.
+ * The converter object is then automatically reset by this function.
+ * (This means that a converter need not be reset explicitly between data
+ * streams if it finishes the previous stream without errors.)
+ * 
+ * This is a <I>stateful</I> conversion. Additionally, even when all source data has
+ * been consumed, some data may be in the converters' internal state.
+ * Call this function repeatedly, updating the target pointers with
+ * the next empty chunk of target in case of a
+ * <TT>U_BUFFER_OVERFLOW_ERROR</TT>, and updating the source  pointers
+ *  with the next chunk of source when a successful error status is
+ * returned, until there are no more chunks of source data.
+ * @param converter the Unicode converter
+ * @param target I/O parameter. Input : Points to the beginning of the buffer to copy
+ *  codepage characters to. Output : points to after the last codepage character copied
+ *  to <TT>target</TT>.
+ * @param targetLimit the pointer just after last of the <TT>target</TT> buffer
+ * @param source I/O parameter, pointer to pointer to the source Unicode character buffer. 
+ * @param sourceLimit the pointer just after the last of the source buffer
+ * @param offsets if NULL is passed, nothing will happen to it, otherwise it needs to have the same number
+ * of allocated cells as <TT>target</TT>. Will fill in offsets from target to source pointer
+ * e.g: <TT>offsets[3]</TT> is equal to 6, it means that the <TT>target[3]</TT> was a result of transcoding <TT>source[6]</TT>
+ * For output data carried across calls, and other data without a specific source character
+ * (such as from escape sequences or callbacks)  -1 will be placed for offsets. 
+ * @param flush set to <TT>TRUE</TT> if the current source buffer is the last available
+ * chunk of the source, <TT>FALSE</TT> otherwise. Note that if a failing status is returned,
+ * this function may have to be called multiple times with flush set to <TT>TRUE</TT> until
+ * the source buffer is consumed.
+ * @param err the error status.  <TT>U_ILLEGAL_ARGUMENT_ERROR</TT> will be set if the
+ * converter is <TT>NULL</TT>.
+ * <code>U_BUFFER_OVERFLOW_ERROR</code> will be set if the target is full and there is 
+ * still data to be written to the target.
+ * @see ucnv_fromUChars
+ * @see ucnv_convert
+ * @see ucnv_getMinCharSize
+ * @see ucnv_setToUCallBack
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucnv_fromUnicode (UConverter * converter,
+                  char **target,
+                  const char *targetLimit,
+                  const UChar ** source,
+                  const UChar * sourceLimit,
+                  int32_t* offsets,
+                  UBool flush,
+                  UErrorCode * err);
+
+/**
+ * Converts a buffer of codepage bytes into an array of unicode UChars
+ * characters. This function is optimized for converting a continuous
+ * stream of data in buffer-sized chunks, where the entire source and
+ * target does not fit in available buffers.
+ * 
+ * The source pointer is an in/out parameter. It starts out pointing where the 
+ * conversion is to begin, and ends up pointing after the last byte of source consumed. 
+ * 
+ * Target similarly starts out pointer at the first available UChar in the output
+ * buffer, and ends up pointing after the last UChar written to the output. 
+ * It does NOT necessarily keep UChar sequences together.
+ * 
+ * The converter always attempts to consume the entire source buffer, unless 
+ * (1.) the target buffer is full, or (2.) a failing error is returned from the
+ * current callback function.  When a successful error status has been
+ * returned, it means that all of the source buffer has been
+ *  consumed. At that point, the caller should reset the source and
+ *  sourceLimit pointers to point to the next chunk.
+ *
+ * At the end of the stream (flush==TRUE), the input is completely consumed
+ * when *source==sourceLimit and no error code is set
+ * The converter object is then automatically reset by this function.
+ * (This means that a converter need not be reset explicitly between data
+ * streams if it finishes the previous stream without errors.)
+ * 
+ * This is a <I>stateful</I> conversion. Additionally, even when all source data has
+ * been consumed, some data may be in the converters' internal state.
+ * Call this function repeatedly, updating the target pointers with
+ * the next empty chunk of target in case of a
+ * <TT>U_BUFFER_OVERFLOW_ERROR</TT>, and updating the source  pointers
+ *  with the next chunk of source when a successful error status is
+ * returned, until there are no more chunks of source data.
+ * @param converter the Unicode converter
+ * @param target I/O parameter. Input : Points to the beginning of the buffer to copy
+ *  UChars into. Output : points to after the last UChar copied.
+ * @param targetLimit the pointer just after the end of the <TT>target</TT> buffer
+ * @param source I/O parameter, pointer to pointer to the source codepage buffer. 
+ * @param sourceLimit the pointer to the byte after the end of the source buffer
+ * @param offsets if NULL is passed, nothing will happen to it, otherwise it needs to have the same number
+ * of allocated cells as <TT>target</TT>. Will fill in offsets from target to source pointer
+ * e.g: <TT>offsets[3]</TT> is equal to 6, it means that the <TT>target[3]</TT> was a result of transcoding <TT>source[6]</TT>
+ * For output data carried across calls, and other data without a specific source character
+ * (such as from escape sequences or callbacks)  -1 will be placed for offsets. 
+ * @param flush set to <TT>TRUE</TT> if the current source buffer is the last available
+ * chunk of the source, <TT>FALSE</TT> otherwise. Note that if a failing status is returned,
+ * this function may have to be called multiple times with flush set to <TT>TRUE</TT> until
+ * the source buffer is consumed.
+ * @param err the error status.  <TT>U_ILLEGAL_ARGUMENT_ERROR</TT> will be set if the
+ * converter is <TT>NULL</TT>.
+ * <code>U_BUFFER_OVERFLOW_ERROR</code> will be set if the target is full and there is 
+ * still data to be written to the target. 
+ * @see ucnv_fromUChars
+ * @see ucnv_convert
+ * @see ucnv_getMinCharSize
+ * @see ucnv_setFromUCallBack
+ * @see ucnv_getNextUChar
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucnv_toUnicode(UConverter *converter,
+               UChar **target,
+               const UChar *targetLimit,
+               const char **source,
+               const char *sourceLimit,
+               int32_t *offsets,
+               UBool flush,
+               UErrorCode *err);
+
+/**
+ * Convert the Unicode string into a codepage string using an existing UConverter.
+ * The output string is NUL-terminated if possible.
+ *
+ * This function is a more convenient but less powerful version of ucnv_fromUnicode().
+ * It is only useful for whole strings, not for streaming conversion.
+ *
+ * The maximum output buffer capacity required (barring output from callbacks) will be
+ * UCNV_GET_MAX_BYTES_FOR_STRING(srcLength, ucnv_getMaxCharSize(cnv)).
+ *
+ * @param cnv the converter object to be used (ucnv_resetFromUnicode() will be called)
+ * @param src the input Unicode string
+ * @param srcLength the input string length, or -1 if NUL-terminated
+ * @param dest destination string buffer, can be NULL if destCapacity==0
+ * @param destCapacity the number of chars available at dest
+ * @param pErrorCode normal ICU error code;
+ *                  common error codes that may be set by this function include
+ *                  U_BUFFER_OVERFLOW_ERROR, U_STRING_NOT_TERMINATED_WARNING,
+ *                  U_ILLEGAL_ARGUMENT_ERROR, and conversion errors
+ * @return the length of the output string, not counting the terminating NUL;
+ *         if the length is greater than destCapacity, then the string will not fit
+ *         and a buffer of the indicated length would need to be passed in
+ * @see ucnv_fromUnicode
+ * @see ucnv_convert
+ * @see UCNV_GET_MAX_BYTES_FOR_STRING
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_fromUChars(UConverter *cnv,
+                char *dest, int32_t destCapacity,
+                const UChar *src, int32_t srcLength,
+                UErrorCode *pErrorCode);
+
+/**
+ * Convert the codepage string into a Unicode string using an existing UConverter.
+ * The output string is NUL-terminated if possible.
+ *
+ * This function is a more convenient but less powerful version of ucnv_toUnicode().
+ * It is only useful for whole strings, not for streaming conversion.
+ *
+ * The maximum output buffer capacity required (barring output from callbacks) will be
+ * 2*srcLength (each char may be converted into a surrogate pair).
+ *
+ * @param cnv the converter object to be used (ucnv_resetToUnicode() will be called)
+ * @param src the input codepage string
+ * @param srcLength the input string length, or -1 if NUL-terminated
+ * @param dest destination string buffer, can be NULL if destCapacity==0
+ * @param destCapacity the number of UChars available at dest
+ * @param pErrorCode normal ICU error code;
+ *                  common error codes that may be set by this function include
+ *                  U_BUFFER_OVERFLOW_ERROR, U_STRING_NOT_TERMINATED_WARNING,
+ *                  U_ILLEGAL_ARGUMENT_ERROR, and conversion errors
+ * @return the length of the output string, not counting the terminating NUL;
+ *         if the length is greater than destCapacity, then the string will not fit
+ *         and a buffer of the indicated length would need to be passed in
+ * @see ucnv_toUnicode
+ * @see ucnv_convert
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_toUChars(UConverter *cnv,
+              UChar *dest, int32_t destCapacity,
+              const char *src, int32_t srcLength,
+              UErrorCode *pErrorCode);
+
+/**
+ * Convert a codepage buffer into Unicode one character at a time.
+ * The input is completely consumed when the U_INDEX_OUTOFBOUNDS_ERROR is set.
+ *
+ * Advantage compared to ucnv_toUnicode() or ucnv_toUChars():
+ * - Faster for small amounts of data, for most converters, e.g.,
+ *   US-ASCII, ISO-8859-1, UTF-8/16/32, and most "normal" charsets.
+ *   (For complex converters, e.g., SCSU, UTF-7 and ISO 2022 variants,
+ *    it uses ucnv_toUnicode() internally.)
+ * - Convenient.
+ *
+ * Limitations compared to ucnv_toUnicode():
+ * - Always assumes flush=TRUE.
+ *   This makes ucnv_getNextUChar() unsuitable for "streaming" conversion,
+ *   that is, for where the input is supplied in multiple buffers,
+ *   because ucnv_getNextUChar() will assume the end of the input at the end
+ *   of the first buffer.
+ * - Does not provide offset output.
+ *
+ * It is possible to "mix" ucnv_getNextUChar() and ucnv_toUnicode() because
+ * ucnv_getNextUChar() uses the current state of the converter
+ * (unlike ucnv_toUChars() which always resets first).
+ * However, if ucnv_getNextUChar() is called after ucnv_toUnicode()
+ * stopped in the middle of a character sequence (with flush=FALSE),
+ * then ucnv_getNextUChar() will always use the slower ucnv_toUnicode()
+ * internally until the next character boundary.
+ * (This is new in ICU 2.6. In earlier releases, ucnv_getNextUChar() had to
+ * start at a character boundary.)
+ *
+ * Instead of using ucnv_getNextUChar(), it is recommended
+ * to convert using ucnv_toUnicode() or ucnv_toUChars()
+ * and then iterate over the text using U16_NEXT() or a UCharIterator (uiter.h)
+ * or a C++ CharacterIterator or similar.
+ * This allows streaming conversion and offset output, for example.
+ *
+ * <p>Handling of surrogate pairs and supplementary-plane code points:<br>
+ * There are two different kinds of codepages that provide mappings for surrogate characters:
+ * <ul>
+ *   <li>Codepages like UTF-8, UTF-32, and GB 18030 provide direct representations for Unicode
+ *       code points U+10000-U+10ffff as well as for single surrogates U+d800-U+dfff.
+ *       Each valid sequence will result in exactly one returned code point.
+ *       If a sequence results in a single surrogate, then that will be returned
+ *       by itself, even if a neighboring sequence encodes the matching surrogate.</li>
+ *   <li>Codepages like SCSU and LMBCS (and UTF-16) provide direct representations only for BMP code points
+ *       including surrogates. Code points in supplementary planes are represented with
+ *       two sequences, each encoding a surrogate.
+ *       For these codepages, matching pairs of surrogates will be combined into single
+ *       code points for returning from this function.
+ *       (Note that SCSU is actually a mix of these codepage types.)</li>
+ * </ul></p>
+ *
+ * @param converter an open UConverter
+ * @param source the address of a pointer to the codepage buffer, will be
+ *  updated to point after the bytes consumed in the conversion call.
+ * @param sourceLimit points to the end of the input buffer
+ * @param err fills in error status (see ucnv_toUnicode)
+ * <code>U_INDEX_OUTOFBOUNDS_ERROR</code> will be set if the input 
+ * is empty or does not convert to any output (e.g.: pure state-change 
+ * codes SI/SO, escape sequences for ISO 2022,
+ * or if the callback did not output anything, ...).
+ * This function will not set a <code>U_BUFFER_OVERFLOW_ERROR</code> because
+ *  the "buffer" is the return code. However, there might be subsequent output
+ *  stored in the converter object
+ * that will be returned in following calls to this function.
+ * @return a UChar32 resulting from the partial conversion of source
+ * @see ucnv_toUnicode
+ * @see ucnv_toUChars
+ * @see ucnv_convert
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32 U_EXPORT2
+ucnv_getNextUChar(UConverter * converter,
+                  const char **source,
+                  const char * sourceLimit,
+                  UErrorCode * err);
+
+/**
+ * Convert from one external charset to another using two existing UConverters.
+ * Internally, two conversions - ucnv_toUnicode() and ucnv_fromUnicode() -
+ * are used, "pivoting" through 16-bit Unicode.
+ *
+ * Important: For streaming conversion (multiple function calls for successive
+ * parts of a text stream), the caller must provide a pivot buffer explicitly,
+ * and must preserve the pivot buffer and associated pointers from one
+ * call to another. (The buffer may be moved if its contents and the relative
+ * pointer positions are preserved.)
+ *
+ * There is a similar function, ucnv_convert(),
+ * which has the following limitations:
+ * - it takes charset names, not converter objects, so that
+ *   - two converters are opened for each call
+ *   - only single-string conversion is possible, not streaming operation
+ * - it does not provide enough information to find out,
+ *   in case of failure, whether the toUnicode or
+ *   the fromUnicode conversion failed
+ *
+ * By contrast, ucnv_convertEx()
+ * - takes UConverter parameters instead of charset names
+ * - fully exposes the pivot buffer for streaming conversion and complete error handling
+ *
+ * ucnv_convertEx() also provides further convenience:
+ * - an option to reset the converters at the beginning
+ *   (if reset==TRUE, see parameters;
+ *    also sets *pivotTarget=*pivotSource=pivotStart)
+ * - allow NUL-terminated input
+ *   (only a single NUL byte, will not work for charsets with multi-byte NULs)
+ *   (if sourceLimit==NULL, see parameters)
+ * - terminate with a NUL on output
+ *   (only a single NUL byte, not useful for charsets with multi-byte NULs),
+ *   or set U_STRING_NOT_TERMINATED_WARNING if the output exactly fills
+ *   the target buffer
+ * - the pivot buffer can be provided internally;
+ *   possible only for whole-string conversion, not streaming conversion;
+ *   in this case, the caller will not be able to get details about where an
+ *   error occurred
+ *   (if pivotStart==NULL, see below)
+ *
+ * The function returns when one of the following is true:
+ * - the entire source text has been converted successfully to the target buffer
+ * - a target buffer overflow occurred (U_BUFFER_OVERFLOW_ERROR)
+ * - a conversion error occurred
+ *   (other U_FAILURE(), see description of pErrorCode)
+ *
+ * Limitation compared to the direct use of
+ * ucnv_fromUnicode() and ucnv_toUnicode():
+ * ucnv_convertEx() does not provide offset information.
+ *
+ * Limitation compared to ucnv_fromUChars() and ucnv_toUChars():
+ * ucnv_convertEx() does not support preflighting directly.
+ *
+ * Sample code for converting a single string from
+ * one external charset to UTF-8, ignoring the location of errors:
+ *
+ * \code
+ * int32_t
+ * myToUTF8(UConverter *cnv,
+ *          const char *s, int32_t length,
+ *          char *u8, int32_t capacity,
+ *          UErrorCode *pErrorCode) {
+ *     UConverter *utf8Cnv;
+ *     char *target;
+ *
+ *     if(U_FAILURE(*pErrorCode)) {
+ *         return 0;
+ *     }
+ *
+ *     utf8Cnv=myGetCachedUTF8Converter(pErrorCode);
+ *     if(U_FAILURE(*pErrorCode)) {
+ *         return 0;
+ *     }
+ *
+ *     if(length<0) {
+ *         length=strlen(s);
+ *     }
+ *     target=u8;
+ *     ucnv_convertEx(utf8Cnv, cnv,
+ *                    &target, u8+capacity,
+ *                    &s, s+length,
+ *                    NULL, NULL, NULL, NULL,
+ *                    TRUE, TRUE,
+ *                    pErrorCode);
+ * 
+ *     myReleaseCachedUTF8Converter(utf8Cnv);
+ *
+ *     // return the output string length, but without preflighting
+ *     return (int32_t)(target-u8);
+ * }
+ * \endcode
+ *
+ * @param targetCnv     Output converter, used to convert from the UTF-16 pivot
+ *                      to the target using ucnv_fromUnicode().
+ * @param sourceCnv     Input converter, used to convert from the source to
+ *                      the UTF-16 pivot using ucnv_toUnicode().
+ * @param target        I/O parameter, same as for ucnv_fromUChars().
+ *                      Input: *target points to the beginning of the target buffer.
+ *                      Output: *target points to the first unit after the last char written.
+ * @param targetLimit   Pointer to the first unit after the target buffer.
+ * @param source        I/O parameter, same as for ucnv_toUChars().
+ *                      Input: *source points to the beginning of the source buffer.
+ *                      Output: *source points to the first unit after the last char read.
+ * @param sourceLimit   Pointer to the first unit after the source buffer.
+ * @param pivotStart    Pointer to the UTF-16 pivot buffer. If pivotStart==NULL,
+ *                      then an internal buffer is used and the other pivot
+ *                      arguments are ignored and can be NULL as well.
+ * @param pivotSource   I/O parameter, same as source in ucnv_fromUChars() for
+ *                      conversion from the pivot buffer to the target buffer.
+ * @param pivotTarget   I/O parameter, same as target in ucnv_toUChars() for
+ *                      conversion from the source buffer to the pivot buffer.
+ *                      It must be pivotStart<=*pivotSource<=*pivotTarget<=pivotLimit
+ *                      and pivotStart<pivotLimit (unless pivotStart==NULL).
+ * @param pivotLimit    Pointer to the first unit after the pivot buffer.
+ * @param reset         If TRUE, then ucnv_resetToUnicode(sourceCnv) and
+ *                      ucnv_resetFromUnicode(targetCnv) are called, and the
+ *                      pivot pointers are reset (*pivotTarget=*pivotSource=pivotStart).
+ * @param flush         If true, indicates the end of the input.
+ *                      Passed directly to ucnv_toUnicode(), and carried over to
+ *                      ucnv_fromUnicode() when the source is empty as well.
+ * @param pErrorCode    ICU error code in/out parameter.
+ *                      Must fulfill U_SUCCESS before the function call.
+ *                      U_BUFFER_OVERFLOW_ERROR always refers to the target buffer
+ *                      because overflows into the pivot buffer are handled internally.
+ *                      Other conversion errors are from the source-to-pivot
+ *                      conversion if *pivotSource==pivotStart, otherwise from
+ *                      the pivot-to-target conversion.
+ *
+ * @see ucnv_convert
+ * @see ucnv_fromAlgorithmic
+ * @see ucnv_toAlgorithmic
+ * @see ucnv_fromUnicode
+ * @see ucnv_toUnicode
+ * @see ucnv_fromUChars
+ * @see ucnv_toUChars
+ * @stable ICU 2.6
+ */
+U_STABLE void U_EXPORT2
+ucnv_convertEx(UConverter *targetCnv, UConverter *sourceCnv,
+               char **target, const char *targetLimit,
+               const char **source, const char *sourceLimit,
+               UChar *pivotStart, UChar **pivotSource,
+               UChar **pivotTarget, const UChar *pivotLimit,
+               UBool reset, UBool flush,
+               UErrorCode *pErrorCode);
+
+/**
+ * Convert from one external charset to another.
+ * Internally, two converters are opened according to the name arguments,
+ * then the text is converted to and from the 16-bit Unicode "pivot"
+ * using ucnv_convertEx(), then the converters are closed again.
+ *
+ * This is a convenience function, not an efficient way to convert a lot of text:
+ * ucnv_convert()
+ * - takes charset names, not converter objects, so that
+ *   - two converters are opened for each call
+ *   - only single-string conversion is possible, not streaming operation
+ * - does not provide enough information to find out,
+ *   in case of failure, whether the toUnicode or
+ *   the fromUnicode conversion failed
+ * - allows NUL-terminated input
+ *   (only a single NUL byte, will not work for charsets with multi-byte NULs)
+ *   (if sourceLength==-1, see parameters)
+ * - terminate with a NUL on output
+ *   (only a single NUL byte, not useful for charsets with multi-byte NULs),
+ *   or set U_STRING_NOT_TERMINATED_WARNING if the output exactly fills
+ *   the target buffer
+ * - a pivot buffer is provided internally
+ *
+ * The function returns when one of the following is true:
+ * - the entire source text has been converted successfully to the target buffer
+ *   and either the target buffer is terminated with a single NUL byte
+ *   or the error code is set to U_STRING_NOT_TERMINATED_WARNING
+ * - a target buffer overflow occurred (U_BUFFER_OVERFLOW_ERROR)
+ *   and the full output string length is returned ("preflighting")
+ * - a conversion error occurred
+ *   (other U_FAILURE(), see description of pErrorCode)
+ *
+ * @param toConverterName   The name of the converter that is used to convert
+ *                          from the UTF-16 pivot buffer to the target.
+ * @param fromConverterName The name of the converter that is used to convert
+ *                          from the source to the UTF-16 pivot buffer.
+ * @param target            Pointer to the output buffer.
+ * @param targetCapacity    Capacity of the target, in bytes.
+ * @param source            Pointer to the input buffer.
+ * @param sourceLength      Length of the input text, in bytes, or -1 for NUL-terminated input.
+ * @param pErrorCode        ICU error code in/out parameter.
+ *                          Must fulfill U_SUCCESS before the function call.
+ * @return Length of the complete output text in bytes, even if it exceeds the targetCapacity
+ *         and a U_BUFFER_OVERFLOW_ERROR is set.
+ *
+ * @see ucnv_convertEx
+ * @see ucnv_fromAlgorithmic
+ * @see ucnv_toAlgorithmic
+ * @see ucnv_fromUnicode
+ * @see ucnv_toUnicode
+ * @see ucnv_fromUChars
+ * @see ucnv_toUChars
+ * @see ucnv_getNextUChar
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_convert(const char *toConverterName,
+             const char *fromConverterName,
+             char *target,
+             int32_t targetCapacity,
+             const char *source,
+             int32_t sourceLength,
+             UErrorCode *pErrorCode);
+
+/**
+ * Convert from one external charset to another.
+ * Internally, the text is converted to and from the 16-bit Unicode "pivot"
+ * using ucnv_convertEx(). ucnv_toAlgorithmic() works exactly like ucnv_convert()
+ * except that the two converters need not be looked up and opened completely.
+ *
+ * The source-to-pivot conversion uses the cnv converter parameter.
+ * The pivot-to-target conversion uses a purely algorithmic converter
+ * according to the specified type, e.g., UCNV_UTF8 for a UTF-8 converter.
+ *
+ * Internally, the algorithmic converter is opened and closed for each
+ * function call, which is more efficient than using the public ucnv_open()
+ * but somewhat less efficient than only resetting an existing converter
+ * and using ucnv_convertEx().
+ *
+ * This function is more convenient than ucnv_convertEx() for single-string
+ * conversions, especially when "preflighting" is desired (returning the length
+ * of the complete output even if it does not fit into the target buffer;
+ * see the User Guide Strings chapter). See ucnv_convert() for details.
+ *
+ * @param algorithmicType   UConverterType constant identifying the desired target
+ *                          charset as a purely algorithmic converter.
+ *                          Those are converters for Unicode charsets like
+ *                          UTF-8, BOCU-1, SCSU, UTF-7, IMAP-mailbox-name, etc.,
+ *                          as well as US-ASCII and ISO-8859-1.
+ * @param cnv               The converter that is used to convert
+ *                          from the source to the UTF-16 pivot buffer.
+ * @param target            Pointer to the output buffer.
+ * @param targetCapacity    Capacity of the target, in bytes.
+ * @param source            Pointer to the input buffer.
+ * @param sourceLength      Length of the input text, in bytes
+ * @param pErrorCode        ICU error code in/out parameter.
+ *                          Must fulfill U_SUCCESS before the function call.
+ * @return Length of the complete output text in bytes, even if it exceeds the targetCapacity
+ *         and a U_BUFFER_OVERFLOW_ERROR is set.
+ *
+ * @see ucnv_fromAlgorithmic
+ * @see ucnv_convert
+ * @see ucnv_convertEx
+ * @see ucnv_fromUnicode
+ * @see ucnv_toUnicode
+ * @see ucnv_fromUChars
+ * @see ucnv_toUChars
+ * @stable ICU 2.6
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_toAlgorithmic(UConverterType algorithmicType,
+                   UConverter *cnv,
+                   char *target, int32_t targetCapacity,
+                   const char *source, int32_t sourceLength,
+                   UErrorCode *pErrorCode);
+
+/**
+ * Convert from one external charset to another.
+ * Internally, the text is converted to and from the 16-bit Unicode "pivot"
+ * using ucnv_convertEx(). ucnv_fromAlgorithmic() works exactly like ucnv_convert()
+ * except that the two converters need not be looked up and opened completely.
+ *
+ * The source-to-pivot conversion uses a purely algorithmic converter
+ * according to the specified type, e.g., UCNV_UTF8 for a UTF-8 converter.
+ * The pivot-to-target conversion uses the cnv converter parameter.
+ *
+ * Internally, the algorithmic converter is opened and closed for each
+ * function call, which is more efficient than using the public ucnv_open()
+ * but somewhat less efficient than only resetting an existing converter
+ * and using ucnv_convertEx().
+ *
+ * This function is more convenient than ucnv_convertEx() for single-string
+ * conversions, especially when "preflighting" is desired (returning the length
+ * of the complete output even if it does not fit into the target buffer;
+ * see the User Guide Strings chapter). See ucnv_convert() for details.
+ *
+ * @param cnv               The converter that is used to convert
+ *                          from the UTF-16 pivot buffer to the target.
+ * @param algorithmicType   UConverterType constant identifying the desired source
+ *                          charset as a purely algorithmic converter.
+ *                          Those are converters for Unicode charsets like
+ *                          UTF-8, BOCU-1, SCSU, UTF-7, IMAP-mailbox-name, etc.,
+ *                          as well as US-ASCII and ISO-8859-1.
+ * @param target            Pointer to the output buffer.
+ * @param targetCapacity    Capacity of the target, in bytes.
+ * @param source            Pointer to the input buffer.
+ * @param sourceLength      Length of the input text, in bytes
+ * @param pErrorCode        ICU error code in/out parameter.
+ *                          Must fulfill U_SUCCESS before the function call.
+ * @return Length of the complete output text in bytes, even if it exceeds the targetCapacity
+ *         and a U_BUFFER_OVERFLOW_ERROR is set.
+ *
+ * @see ucnv_fromAlgorithmic
+ * @see ucnv_convert
+ * @see ucnv_convertEx
+ * @see ucnv_fromUnicode
+ * @see ucnv_toUnicode
+ * @see ucnv_fromUChars
+ * @see ucnv_toUChars
+ * @stable ICU 2.6
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_fromAlgorithmic(UConverter *cnv,
+                     UConverterType algorithmicType,
+                     char *target, int32_t targetCapacity,
+                     const char *source, int32_t sourceLength,
+                     UErrorCode *pErrorCode);
+
+/**
+ * Frees up memory occupied by unused, cached converter shared data.
+ *
+ * @return the number of cached converters successfully deleted
+ * @see ucnv_close
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_flushCache(void);
+
+/**
+ * Returns the number of available converters, as per the alias file.
+ *
+ * @return the number of available converters
+ * @see ucnv_getAvailableName
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_countAvailable(void);
+
+/**
+ * Gets the canonical converter name of the specified converter from a list of
+ * all available converters contaied in the alias file. All converters
+ * in this list can be opened.
+ *
+ * @param n the index to a converter available on the system (in the range <TT>[0..ucnv_countAvaiable()]</TT>)
+ * @return a pointer a string (library owned), or <TT>NULL</TT> if the index is out of bounds.
+ * @see ucnv_countAvailable
+ * @stable ICU 2.0
+ */
+U_STABLE const char* U_EXPORT2
+ucnv_getAvailableName(int32_t n);
+
+/**
+ * Returns a UEnumeration to enumerate all of the canonical converter
+ * names, as per the alias file, regardless of the ability to open each
+ * converter.
+ *
+ * @return A UEnumeration object for getting all the recognized canonical
+ *   converter names.
+ * @see ucnv_getAvailableName
+ * @see uenum_close
+ * @see uenum_next
+ * @stable ICU 2.4
+ */
+U_STABLE UEnumeration * U_EXPORT2
+ucnv_openAllNames(UErrorCode *pErrorCode);
+
+/**
+ * Gives the number of aliases for a given converter or alias name.
+ * If the alias is ambiguous, then the preferred converter is used
+ * and the status is set to U_AMBIGUOUS_ALIAS_WARNING.
+ * This method only enumerates the listed entries in the alias file.
+ * @param alias alias name
+ * @param pErrorCode error status
+ * @return number of names on alias list for given alias
+ * @stable ICU 2.0
+ */
+U_STABLE uint16_t U_EXPORT2 
+ucnv_countAliases(const char *alias, UErrorCode *pErrorCode);
+
+/**
+ * Gives the name of the alias at given index of alias list.
+ * This method only enumerates the listed entries in the alias file.
+ * If the alias is ambiguous, then the preferred converter is used
+ * and the status is set to U_AMBIGUOUS_ALIAS_WARNING.
+ * @param alias alias name
+ * @param n index in alias list
+ * @param pErrorCode result of operation
+ * @return returns the name of the alias at given index
+ * @see ucnv_countAliases
+ * @stable ICU 2.0
+ */
+U_STABLE const char * U_EXPORT2 
+ucnv_getAlias(const char *alias, uint16_t n, UErrorCode *pErrorCode);
+
+/**
+ * Fill-up the list of alias names for the given alias.
+ * This method only enumerates the listed entries in the alias file.
+ * If the alias is ambiguous, then the preferred converter is used
+ * and the status is set to U_AMBIGUOUS_ALIAS_WARNING.
+ * @param alias alias name
+ * @param aliases fill-in list, aliases is a pointer to an array of
+ *        <code>ucnv_countAliases()</code> string-pointers
+ *        (<code>const char *</code>) that will be filled in.
+ *        The strings themselves are owned by the library.
+ * @param pErrorCode result of operation
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucnv_getAliases(const char *alias, const char **aliases, UErrorCode *pErrorCode);
+
+/**
+ * Return a new UEnumeration object for enumerating all the
+ * alias names for a given converter that are recognized by a standard.
+ * This method only enumerates the listed entries in the alias file.
+ * The convrtrs.txt file can be modified to change the results of
+ * this function.
+ * The first result in this list is the same result given by
+ * <code>ucnv_getStandardName</code>, which is the default alias for
+ * the specified standard name. The returned object must be closed with
+ * <code>uenum_close</code> when you are done with the object.
+ *
+ * @param convName original converter name
+ * @param standard name of the standard governing the names; MIME and IANA
+ *      are such standards
+ * @param pErrorCode The error code
+ * @return A UEnumeration object for getting all aliases that are recognized
+ *      by a standard. If any of the parameters are invalid, NULL
+ *      is returned.
+ * @see ucnv_getStandardName
+ * @see uenum_close
+ * @see uenum_next
+ * @stable ICU 2.2
+ */
+U_STABLE UEnumeration * U_EXPORT2
+ucnv_openStandardNames(const char *convName,
+                       const char *standard,
+                       UErrorCode *pErrorCode);
+
+/**
+ * Gives the number of standards associated to converter names.
+ * @return number of standards
+ * @stable ICU 2.0
+ */
+U_STABLE uint16_t U_EXPORT2
+ucnv_countStandards(void);
+
+/**
+ * Gives the name of the standard at given index of standard list.
+ * @param n index in standard list
+ * @param pErrorCode result of operation
+ * @return returns the name of the standard at given index. Owned by the library.
+ * @stable ICU 2.0
+ */
+U_STABLE const char * U_EXPORT2
+ucnv_getStandard(uint16_t n, UErrorCode *pErrorCode);
+
+/**
+ * Returns a standard name for a given converter name.
+ * <p>
+ * Example alias table:<br>
+ * conv alias1 { STANDARD1 } alias2 { STANDARD1* }
+ * <p>
+ * Result of ucnv_getStandardName("conv", "STANDARD1") from example
+ * alias table:<br>
+ * <b>"alias2"</b>
+ *
+ * @param name original converter name
+ * @param standard name of the standard governing the names; MIME and IANA
+ *        are such standards
+ * @param pErrorCode result of operation
+ * @return returns the standard converter name;
+ *         if a standard converter name cannot be determined,
+ *         then <code>NULL</code> is returned. Owned by the library.
+ * @stable ICU 2.0
+ */
+U_STABLE const char * U_EXPORT2
+ucnv_getStandardName(const char *name, const char *standard, UErrorCode *pErrorCode);
+
+/**
+ * This function will return the internal canonical converter name of the
+ * tagged alias. This is the opposite of ucnv_openStandardNames, which
+ * returns the tagged alias given the canonical name.
+ * <p>
+ * Example alias table:<br>
+ * conv alias1 { STANDARD1 } alias2 { STANDARD1* }
+ * <p>
+ * Result of ucnv_getStandardName("alias1", "STANDARD1") from example
+ * alias table:<br>
+ * <b>"conv"</b>
+ *
+ * @return returns the canonical converter name;
+ *         if a standard or alias name cannot be determined,
+ *         then <code>NULL</code> is returned. The returned string is
+ *         owned by the library.
+ * @see ucnv_getStandardName
+ * @stable ICU 2.4
+ */
+U_STABLE const char * U_EXPORT2
+ucnv_getCanonicalName(const char *alias, const char *standard, UErrorCode *pErrorCode);
+
+/**
+ * Returns the current default converter name. If you want to open
+ * a default converter, you do not need to use this function.
+ * It is faster if you pass a NULL argument to ucnv_open the
+ * default converter.
+ *
+ * If U_CHARSET_IS_UTF8 is defined to 1 in utypes.h then this function
+ * always returns "UTF-8".
+ *
+ * @return returns the current default converter name.
+ *         Storage owned by the library
+ * @see ucnv_setDefaultName
+ * @stable ICU 2.0
+ */
+U_STABLE const char * U_EXPORT2
+ucnv_getDefaultName(void);
+
+#ifndef U_HIDE_SYSTEM_API
+/**
+ * This function is not thread safe. DO NOT call this function when ANY ICU
+ * function is being used from more than one thread! This function sets the
+ * current default converter name. If this function needs to be called, it
+ * should be called during application initialization. Most of the time, the
+ * results from ucnv_getDefaultName() or ucnv_open with a NULL string argument
+ * is sufficient for your application.
+ *
+ * If U_CHARSET_IS_UTF8 is defined to 1 in utypes.h then this function
+ * does nothing.
+ *
+ * @param name the converter name to be the default (must be known by ICU).
+ * @see ucnv_getDefaultName
+ * @system
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_setDefaultName(const char *name);
+#endif  /* U_HIDE_SYSTEM_API */
+
+/**
+ * Fixes the backslash character mismapping.  For example, in SJIS, the backslash 
+ * character in the ASCII portion is also used to represent the yen currency sign.  
+ * When mapping from Unicode character 0x005C, it's unclear whether to map the 
+ * character back to yen or backslash in SJIS.  This function will take the input
+ * buffer and replace all the yen sign characters with backslash.  This is necessary
+ * when the user tries to open a file with the input buffer on Windows.
+ * This function will test the converter to see whether such mapping is
+ * required.  You can sometimes avoid using this function by using the correct version
+ * of Shift-JIS.
+ *
+ * @param cnv The converter representing the target codepage.
+ * @param source the input buffer to be fixed
+ * @param sourceLen the length of the input buffer
+ * @see ucnv_isAmbiguous
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucnv_fixFileSeparator(const UConverter *cnv, UChar *source, int32_t sourceLen);
+
+/**
+ * Determines if the converter contains ambiguous mappings of the same
+ * character or not.
+ * @param cnv the converter to be tested
+ * @return TRUE if the converter contains ambiguous mapping of the same 
+ * character, FALSE otherwise.
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2
+ucnv_isAmbiguous(const UConverter *cnv);
+
+/**
+ * Sets the converter to use fallback mappings or not.
+ * Regardless of this flag, the converter will always use
+ * fallbacks from Unicode Private Use code points, as well as
+ * reverse fallbacks (to Unicode).
+ * For details see ".ucm File Format"
+ * in the Conversion Data chapter of the ICU User Guide:
+ * http://www.icu-project.org/userguide/conversion-data.html#ucmformat
+ *
+ * @param cnv The converter to set the fallback mapping usage on.
+ * @param usesFallback TRUE if the user wants the converter to take advantage of the fallback 
+ * mapping, FALSE otherwise.
+ * @stable ICU 2.0
+ * @see ucnv_usesFallback
+ */
+U_STABLE void U_EXPORT2 
+ucnv_setFallback(UConverter *cnv, UBool usesFallback);
+
+/**
+ * Determines if the converter uses fallback mappings or not.
+ * This flag has restrictions, see ucnv_setFallback().
+ *
+ * @param cnv The converter to be tested
+ * @return TRUE if the converter uses fallback, FALSE otherwise.
+ * @stable ICU 2.0
+ * @see ucnv_setFallback
+ */
+U_STABLE UBool U_EXPORT2 
+ucnv_usesFallback(const UConverter *cnv);
+
+/**
+ * Detects Unicode signature byte sequences at the start of the byte stream
+ * and returns the charset name of the indicated Unicode charset.
+ * NULL is returned when no Unicode signature is recognized.
+ * The number of bytes in the signature is output as well.
+ *
+ * The caller can ucnv_open() a converter using the charset name.
+ * The first code unit (UChar) from the start of the stream will be U+FEFF
+ * (the Unicode BOM/signature character) and can usually be ignored.
+ *
+ * For most Unicode charsets it is also possible to ignore the indicated
+ * number of initial stream bytes and start converting after them.
+ * However, there are stateful Unicode charsets (UTF-7 and BOCU-1) for which
+ * this will not work. Therefore, it is best to ignore the first output UChar
+ * instead of the input signature bytes.
+ * <p>
+ * Usage:
+ * \snippet samples/ucnv/convsamp.cpp ucnv_detectUnicodeSignature
+ *
+ * @param source            The source string in which the signature should be detected.
+ * @param sourceLength      Length of the input string, or -1 if terminated with a NUL byte.
+ * @param signatureLength   A pointer to int32_t to receive the number of bytes that make up the signature 
+ *                          of the detected UTF. 0 if not detected.
+ *                          Can be a NULL pointer.
+ * @param pErrorCode        ICU error code in/out parameter.
+ *                          Must fulfill U_SUCCESS before the function call.
+ * @return The name of the encoding detected. NULL if encoding is not detected. 
+ * @stable ICU 2.4
+ */
+U_STABLE const char* U_EXPORT2
+ucnv_detectUnicodeSignature(const char* source,
+                            int32_t sourceLength,
+                            int32_t *signatureLength,
+                            UErrorCode *pErrorCode);
+
+/**
+ * Returns the number of UChars held in the converter's internal state 
+ * because more input is needed for completing the conversion. This function is 
+ * useful for mapping semantics of ICU's converter interface to those of iconv,
+ * and this information is not needed for normal conversion.
+ * @param cnv       The converter in which the input is held
+ * @param status    ICU error code in/out parameter.
+ *                  Must fulfill U_SUCCESS before the function call.
+ * @return The number of UChars in the state. -1 if an error is encountered.
+ * @stable ICU 3.4
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_fromUCountPending(const UConverter* cnv, UErrorCode* status);
+
+/**
+ * Returns the number of chars held in the converter's internal state
+ * because more input is needed for completing the conversion. This function is 
+ * useful for mapping semantics of ICU's converter interface to those of iconv,
+ * and this information is not needed for normal conversion.
+ * @param cnv       The converter in which the input is held as internal state
+ * @param status    ICU error code in/out parameter.
+ *                  Must fulfill U_SUCCESS before the function call.
+ * @return The number of chars in the state. -1 if an error is encountered.
+ * @stable ICU 3.4
+ */
+U_STABLE int32_t U_EXPORT2
+ucnv_toUCountPending(const UConverter* cnv, UErrorCode* status);
+
+/**
+ * Returns whether or not the charset of the converter has a fixed number of bytes
+ * per charset character.
+ * An example of this are converters that are of the type UCNV_SBCS or UCNV_DBCS.
+ * Another example is UTF-32 which is always 4 bytes per character.
+ * A Unicode code point may be represented by more than one UTF-8 or UTF-16 code unit
+ * but a UTF-32 converter encodes each code point with 4 bytes.
+ * Note: This method is not intended to be used to determine whether the charset has a
+ * fixed ratio of bytes to Unicode codes <i>units</i> for any particular Unicode encoding form.
+ * FALSE is returned with the UErrorCode if error occurs or cnv is NULL.
+ * @param cnv       The converter to be tested
+ * @param status    ICU error code in/out paramter
+ * @return TRUE if the converter is fixed-width
+ * @stable ICU 4.8
+ */
+U_STABLE UBool U_EXPORT2
+ucnv_isFixedWidth(UConverter *cnv, UErrorCode *status);
+
+#endif
+
+#endif
+/*_UCNV*/
diff --git a/icu/unicode/ucnv_err.h b/icu/unicode/ucnv_err.h
new file mode 100644
index 0000000..e092e95
--- /dev/null
+++ b/icu/unicode/ucnv_err.h
@@ -0,0 +1,463 @@
+/*
+**********************************************************************
+*   Copyright (C) 1999-2009, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+ *
+ *
+ *   ucnv_err.h:
+ */
+
+/**
+ * \file
+ * \brief C UConverter predefined error callbacks
+ *
+ *  <h2>Error Behaviour Functions</h2>
+ *  Defines some error behaviour functions called by ucnv_{from,to}Unicode
+ *  These are provided as part of ICU and many are stable, but they
+ *  can also be considered only as an example of what can be done with
+ *  callbacks.  You may of course write your own.
+ *
+ *  If you want to write your own, you may also find the functions from
+ *  ucnv_cb.h useful when writing your own callbacks.
+ *
+ *  These functions, although public, should NEVER be called directly.
+ *  They should be used as parameters to the ucnv_setFromUCallback
+ *  and ucnv_setToUCallback functions, to set the behaviour of a converter
+ *  when it encounters ILLEGAL/UNMAPPED/INVALID sequences.
+ *
+ *  usage example:  'STOP' doesn't need any context, but newContext
+ *    could be set to something other than 'NULL' if needed. The available
+ *    contexts in this header can modify the default behavior of the callback.
+ *
+ *  \code
+ *  UErrorCode err = U_ZERO_ERROR;
+ *  UConverter *myConverter = ucnv_open("ibm-949", &err);
+ *  const void *oldContext;
+ *  UConverterFromUCallback oldAction;
+ *
+ *
+ *  if (U_SUCCESS(err))
+ *  {
+ *      ucnv_setFromUCallBack(myConverter,
+ *                       UCNV_FROM_U_CALLBACK_STOP,
+ *                       NULL,
+ *                       &oldAction,
+ *                       &oldContext,
+ *                       &status);
+ *  }
+ *  \endcode
+ *
+ *  The code above tells "myConverter" to stop when it encounters an
+ *  ILLEGAL/TRUNCATED/INVALID sequences when it is used to convert from
+ *  Unicode -> Codepage. The behavior from Codepage to Unicode is not changed,
+ *  and ucnv_setToUCallBack would need to be called in order to change
+ *  that behavior too.
+ *
+ *  Here is an example with a context:
+ *
+ *  \code
+ *  UErrorCode err = U_ZERO_ERROR;
+ *  UConverter *myConverter = ucnv_open("ibm-949", &err);
+ *  const void *oldContext;
+ *  UConverterFromUCallback oldAction;
+ *
+ *
+ *  if (U_SUCCESS(err))
+ *  {
+ *      ucnv_setToUCallBack(myConverter,
+ *                       UCNV_TO_U_CALLBACK_SUBSTITUTE,
+ *                       UCNV_SUB_STOP_ON_ILLEGAL,
+ *                       &oldAction,
+ *                       &oldContext,
+ *                       &status);
+ *  }
+ *  \endcode
+ *
+ *  The code above tells "myConverter" to stop when it encounters an
+ *  ILLEGAL/TRUNCATED/INVALID sequences when it is used to convert from
+ *  Codepage -> Unicode. Any unmapped and legal characters will be
+ *  substituted to be the default substitution character.
+ */
+
+#ifndef UCNV_ERR_H
+#define UCNV_ERR_H
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_CONVERSION
+
+/** Forward declaring the UConverter structure. @stable ICU 2.0 */
+struct UConverter;
+
+/** @stable ICU 2.0 */
+typedef struct UConverter UConverter;
+
+/**
+ * FROM_U, TO_U context options for sub callback
+ * @stable ICU 2.0
+ */
+#define UCNV_SUB_STOP_ON_ILLEGAL "i"
+
+/**
+ * FROM_U, TO_U context options for skip callback
+ * @stable ICU 2.0
+ */
+#define UCNV_SKIP_STOP_ON_ILLEGAL "i"
+
+/**
+ * FROM_U_CALLBACK_ESCAPE context option to escape the code unit according to ICU (%UXXXX) 
+ * @stable ICU 2.0
+ */
+#define UCNV_ESCAPE_ICU       NULL
+/**
+ * FROM_U_CALLBACK_ESCAPE context option to escape the code unit according to JAVA (\\uXXXX)
+ * @stable ICU 2.0
+ */
+#define UCNV_ESCAPE_JAVA      "J"
+/**
+ * FROM_U_CALLBACK_ESCAPE context option to escape the code unit according to C (\\uXXXX \\UXXXXXXXX)
+ * TO_U_CALLBACK_ESCAPE option to escape the character value accoding to C (\\xXXXX)
+ * @stable ICU 2.0
+ */
+#define UCNV_ESCAPE_C         "C"
+/**
+ * FROM_U_CALLBACK_ESCAPE context option to escape the code unit according to XML Decimal escape \htmlonly(&amp;#DDDD;)\endhtmlonly
+ * TO_U_CALLBACK_ESCAPE context option to escape the character value accoding to XML Decimal escape \htmlonly(&amp;#DDDD;)\endhtmlonly
+ * @stable ICU 2.0
+ */
+#define UCNV_ESCAPE_XML_DEC   "D"
+/**
+ * FROM_U_CALLBACK_ESCAPE context option to escape the code unit according to XML Hex escape \htmlonly(&amp;#xXXXX;)\endhtmlonly
+ * TO_U_CALLBACK_ESCAPE context option to escape the character value accoding to XML Hex escape \htmlonly(&amp;#xXXXX;)\endhtmlonly
+ * @stable ICU 2.0
+ */
+#define UCNV_ESCAPE_XML_HEX   "X"
+/**
+ * FROM_U_CALLBACK_ESCAPE context option to escape the code unit according to Unicode (U+XXXXX)
+ * @stable ICU 2.0
+ */
+#define UCNV_ESCAPE_UNICODE   "U"
+
+/**
+ * FROM_U_CALLBACK_ESCAPE context option to escape the code unit according to CSS2 conventions (\\HH..H<space>, that is,
+ * a backslash, 1..6 hex digits, and a space)
+ * @stable ICU 4.0
+ */
+#define UCNV_ESCAPE_CSS2   "S"
+
+/** 
+ * The process condition code to be used with the callbacks.  
+ * Codes which are greater than UCNV_IRREGULAR should be 
+ * passed on to any chained callbacks.
+ * @stable ICU 2.0
+ */
+typedef enum {
+    UCNV_UNASSIGNED = 0,  /**< The code point is unassigned.
+                             The error code U_INVALID_CHAR_FOUND will be set. */
+    UCNV_ILLEGAL = 1,     /**< The code point is illegal. For example, 
+                             \\x81\\x2E is illegal in SJIS because \\x2E
+                             is not a valid trail byte for the \\x81 
+                             lead byte.
+                             Also, starting with Unicode 3.0.1, non-shortest byte sequences
+                             in UTF-8 (like \\xC1\\xA1 instead of \\x61 for U+0061)
+                             are also illegal, not just irregular.
+                             The error code U_ILLEGAL_CHAR_FOUND will be set. */
+    UCNV_IRREGULAR = 2,   /**< The codepoint is not a regular sequence in 
+                             the encoding. For example, \\xED\\xA0\\x80..\\xED\\xBF\\xBF
+                             are irregular UTF-8 byte sequences for single surrogate
+                             code points.
+                             The error code U_INVALID_CHAR_FOUND will be set. */
+    UCNV_RESET = 3,       /**< The callback is called with this reason when a
+                             'reset' has occured. Callback should reset all
+                             state. */
+    UCNV_CLOSE = 4,        /**< Called when the converter is closed. The
+                             callback should release any allocated memory.*/
+    UCNV_CLONE = 5         /**< Called when ucnv_safeClone() is called on the
+                              converter. the pointer available as the
+                              'context' is an alias to the original converters'
+                              context pointer. If the context must be owned
+                              by the new converter, the callback must clone 
+                              the data and call ucnv_setFromUCallback 
+                              (or setToUCallback) with the correct pointer.
+                              @stable ICU 2.2
+                           */
+} UConverterCallbackReason;
+
+
+/**
+ * The structure for the fromUnicode callback function parameter.
+ * @stable ICU 2.0
+ */
+typedef struct {
+    uint16_t size;              /**< The size of this struct. @stable ICU 2.0 */
+    UBool flush;                /**< The internal state of converter will be reset and data flushed if set to TRUE. @stable ICU 2.0    */
+    UConverter *converter;      /**< Pointer to the converter that is opened and to which this struct is passed as an argument. @stable ICU 2.0  */
+    const UChar *source;        /**< Pointer to the source source buffer. @stable ICU 2.0    */
+    const UChar *sourceLimit;   /**< Pointer to the limit (end + 1) of source buffer. @stable ICU 2.0    */
+    char *target;               /**< Pointer to the target buffer. @stable ICU 2.0    */
+    const char *targetLimit;    /**< Pointer to the limit (end + 1) of target buffer. @stable ICU 2.0     */
+    int32_t *offsets;           /**< Pointer to the buffer that recieves the offsets. *offset = blah ; offset++;. @stable ICU 2.0  */
+} UConverterFromUnicodeArgs;
+
+
+/**
+ * The structure for the toUnicode callback function parameter.
+ * @stable ICU 2.0
+ */
+typedef struct {
+    uint16_t size;              /**< The size of this struct   @stable ICU 2.0 */
+    UBool flush;                /**< The internal state of converter will be reset and data flushed if set to TRUE. @stable ICU 2.0   */
+    UConverter *converter;      /**< Pointer to the converter that is opened and to which this struct is passed as an argument. @stable ICU 2.0 */
+    const char *source;         /**< Pointer to the source source buffer. @stable ICU 2.0    */
+    const char *sourceLimit;    /**< Pointer to the limit (end + 1) of source buffer. @stable ICU 2.0    */
+    UChar *target;              /**< Pointer to the target buffer. @stable ICU 2.0    */
+    const UChar *targetLimit;   /**< Pointer to the limit (end + 1) of target buffer. @stable ICU 2.0     */
+    int32_t *offsets;           /**< Pointer to the buffer that recieves the offsets. *offset = blah ; offset++;. @stable ICU 2.0  */
+} UConverterToUnicodeArgs;
+
+
+/**
+ * DO NOT CALL THIS FUNCTION DIRECTLY!
+ * This From Unicode callback STOPS at the ILLEGAL_SEQUENCE,
+ * returning the error code back to the caller immediately.
+ *
+ * @param context Pointer to the callback's private data
+ * @param fromUArgs Information about the conversion in progress
+ * @param codeUnits Points to 'length' UChars of the concerned Unicode sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param codePoint Single UChar32 (UTF-32) containing the concerend Unicode codepoint.
+ * @param reason Defines the reason the callback was invoked
+ * @param err This should always be set to a failure status prior to calling.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 UCNV_FROM_U_CALLBACK_STOP (
+                  const void *context,
+                  UConverterFromUnicodeArgs *fromUArgs,
+                  const UChar* codeUnits,
+                  int32_t length,
+                  UChar32 codePoint,
+                  UConverterCallbackReason reason,
+                  UErrorCode * err);
+
+
+
+/**
+ * DO NOT CALL THIS FUNCTION DIRECTLY!
+ * This To Unicode callback STOPS at the ILLEGAL_SEQUENCE,
+ * returning the error code back to the caller immediately.
+ *
+ * @param context Pointer to the callback's private data
+ * @param toUArgs Information about the conversion in progress
+ * @param codeUnits Points to 'length' bytes of the concerned codepage sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param reason Defines the reason the callback was invoked
+ * @param err This should always be set to a failure status prior to calling.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 UCNV_TO_U_CALLBACK_STOP (
+                  const void *context,
+                  UConverterToUnicodeArgs *toUArgs,
+                  const char* codeUnits,
+                  int32_t length,
+                  UConverterCallbackReason reason,
+                  UErrorCode * err);
+
+/**
+ * DO NOT CALL THIS FUNCTION DIRECTLY!
+ * This From Unicode callback skips any ILLEGAL_SEQUENCE, or
+ * skips only UNASSINGED_SEQUENCE depending on the context parameter
+ * simply ignoring those characters. 
+ *
+ * @param context  The function currently recognizes the callback options:
+ *                 UCNV_SKIP_STOP_ON_ILLEGAL: STOPS at the ILLEGAL_SEQUENCE,
+ *                      returning the error code back to the caller immediately.
+ *                 NULL: Skips any ILLEGAL_SEQUENCE
+ * @param fromUArgs Information about the conversion in progress
+ * @param codeUnits Points to 'length' UChars of the concerned Unicode sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param codePoint Single UChar32 (UTF-32) containing the concerend Unicode codepoint.
+ * @param reason Defines the reason the callback was invoked
+ * @param err Return value will be set to success if the callback was handled,
+ *      otherwise this value will be set to a failure status.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 UCNV_FROM_U_CALLBACK_SKIP (
+                  const void *context,
+                  UConverterFromUnicodeArgs *fromUArgs,
+                  const UChar* codeUnits,
+                  int32_t length,
+                  UChar32 codePoint,
+                  UConverterCallbackReason reason,
+                  UErrorCode * err);
+
+/**
+ * DO NOT CALL THIS FUNCTION DIRECTLY!
+ * This From Unicode callback will Substitute the ILLEGAL SEQUENCE, or 
+ * UNASSIGNED_SEQUENCE depending on context parameter, with the
+ * current substitution string for the converter. This is the default
+ * callback.
+ *
+ * @param context The function currently recognizes the callback options:
+ *                 UCNV_SUB_STOP_ON_ILLEGAL: STOPS at the ILLEGAL_SEQUENCE,
+ *                      returning the error code back to the caller immediately.
+ *                 NULL: Substitutes any ILLEGAL_SEQUENCE
+ * @param fromUArgs Information about the conversion in progress
+ * @param codeUnits Points to 'length' UChars of the concerned Unicode sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param codePoint Single UChar32 (UTF-32) containing the concerend Unicode codepoint.
+ * @param reason Defines the reason the callback was invoked
+ * @param err Return value will be set to success if the callback was handled,
+ *      otherwise this value will be set to a failure status.
+ * @see ucnv_setSubstChars
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 UCNV_FROM_U_CALLBACK_SUBSTITUTE (
+                  const void *context,
+                  UConverterFromUnicodeArgs *fromUArgs,
+                  const UChar* codeUnits,
+                  int32_t length,
+                  UChar32 codePoint,
+                  UConverterCallbackReason reason,
+                  UErrorCode * err);
+
+/**
+ * DO NOT CALL THIS FUNCTION DIRECTLY!
+ * This From Unicode callback will Substitute the ILLEGAL SEQUENCE with the
+ * hexadecimal representation of the illegal codepoints
+ *
+ * @param context The function currently recognizes the callback options:
+ *        <ul>
+ *        <li>UCNV_ESCAPE_ICU: Substitues the  ILLEGAL SEQUENCE with the hexadecimal 
+ *          representation in the format  %UXXXX, e.g. "%uFFFE%u00AC%uC8FE"). 
+ *          In the Event the converter doesn't support the characters {%,U}[A-F][0-9], 
+ *          it will  substitute  the illegal sequence with the substitution characters.
+ *          Note that  codeUnit(32bit int eg: unit of a surrogate pair) is represented as
+ *          %UD84D%UDC56</li>
+ *        <li>UCNV_ESCAPE_JAVA: Substitues the  ILLEGAL SEQUENCE with the hexadecimal 
+ *          representation in the format  \\uXXXX, e.g. "\\uFFFE\\u00AC\\uC8FE"). 
+ *          In the Event the converter doesn't support the characters {\,u}[A-F][0-9], 
+ *          it will  substitute  the illegal sequence with the substitution characters.
+ *          Note that  codeUnit(32bit int eg: unit of a surrogate pair) is represented as
+ *          \\uD84D\\uDC56</li>
+ *        <li>UCNV_ESCAPE_C: Substitues the  ILLEGAL SEQUENCE with the hexadecimal 
+ *          representation in the format  \\uXXXX, e.g. "\\uFFFE\\u00AC\\uC8FE"). 
+ *          In the Event the converter doesn't support the characters {\,u,U}[A-F][0-9], 
+ *          it will  substitute  the illegal sequence with the substitution characters.
+ *          Note that  codeUnit(32bit int eg: unit of a surrogate pair) is represented as
+ *          \\U00023456</li>
+ *        <li>UCNV_ESCAPE_XML_DEC: Substitues the  ILLEGAL SEQUENCE with the decimal 
+ *          representation in the format \htmlonly&amp;#DDDDDDDD;, e.g. "&amp;#65534;&amp;#172;&amp;#51454;")\endhtmlonly. 
+ *          In the Event the converter doesn't support the characters {&amp;,#}[0-9], 
+ *          it will  substitute  the illegal sequence with the substitution characters.
+ *          Note that  codeUnit(32bit int eg: unit of a surrogate pair) is represented as
+ *          &amp;#144470; and Zero padding is ignored.</li>
+ *        <li>UCNV_ESCAPE_XML_HEX:Substitues the  ILLEGAL SEQUENCE with the decimal 
+ *          representation in the format \htmlonly&amp;#xXXXX; e.g. "&amp;#xFFFE;&amp;#x00AC;&amp;#xC8FE;")\endhtmlonly. 
+ *          In the Event the converter doesn't support the characters {&,#,x}[0-9], 
+ *          it will  substitute  the illegal sequence with the substitution characters.
+ *          Note that  codeUnit(32bit int eg: unit of a surrogate pair) is represented as
+ *          \htmlonly&amp;#x23456;\endhtmlonly</li>
+ *        </ul>
+ * @param fromUArgs Information about the conversion in progress
+ * @param codeUnits Points to 'length' UChars of the concerned Unicode sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param codePoint Single UChar32 (UTF-32) containing the concerend Unicode codepoint.
+ * @param reason Defines the reason the callback was invoked
+ * @param err Return value will be set to success if the callback was handled,
+ *      otherwise this value will be set to a failure status.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 UCNV_FROM_U_CALLBACK_ESCAPE (
+                  const void *context,
+                  UConverterFromUnicodeArgs *fromUArgs,
+                  const UChar* codeUnits,
+                  int32_t length,
+                  UChar32 codePoint,
+                  UConverterCallbackReason reason,
+                  UErrorCode * err);
+
+
+/**
+ * DO NOT CALL THIS FUNCTION DIRECTLY!
+ * This To Unicode callback skips any ILLEGAL_SEQUENCE, or
+ * skips only UNASSINGED_SEQUENCE depending on the context parameter
+ * simply ignoring those characters. 
+ *
+ * @param context  The function currently recognizes the callback options:
+ *                 UCNV_SKIP_STOP_ON_ILLEGAL: STOPS at the ILLEGAL_SEQUENCE,
+ *                      returning the error code back to the caller immediately.
+ *                 NULL: Skips any ILLEGAL_SEQUENCE
+ * @param toUArgs Information about the conversion in progress
+ * @param codeUnits Points to 'length' bytes of the concerned codepage sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param reason Defines the reason the callback was invoked
+ * @param err Return value will be set to success if the callback was handled,
+ *      otherwise this value will be set to a failure status.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 UCNV_TO_U_CALLBACK_SKIP (
+                  const void *context,
+                  UConverterToUnicodeArgs *toUArgs,
+                  const char* codeUnits,
+                  int32_t length,
+                  UConverterCallbackReason reason,
+                  UErrorCode * err);
+
+/**
+ * DO NOT CALL THIS FUNCTION DIRECTLY!
+ * This To Unicode callback will Substitute the ILLEGAL SEQUENCE,or 
+ * UNASSIGNED_SEQUENCE depending on context parameter,  with the
+ * Unicode substitution character, U+FFFD.
+ *
+ * @param context  The function currently recognizes the callback options:
+ *                 UCNV_SUB_STOP_ON_ILLEGAL: STOPS at the ILLEGAL_SEQUENCE,
+ *                      returning the error code back to the caller immediately.
+ *                 NULL: Substitutes any ILLEGAL_SEQUENCE
+ * @param toUArgs Information about the conversion in progress
+ * @param codeUnits Points to 'length' bytes of the concerned codepage sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param reason Defines the reason the callback was invoked
+ * @param err Return value will be set to success if the callback was handled,
+ *      otherwise this value will be set to a failure status.
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 UCNV_TO_U_CALLBACK_SUBSTITUTE (
+                  const void *context,
+                  UConverterToUnicodeArgs *toUArgs,
+                  const char* codeUnits,
+                  int32_t length,
+                  UConverterCallbackReason reason,
+                  UErrorCode * err);
+
+/**
+ * DO NOT CALL THIS FUNCTION DIRECTLY!
+ * This To Unicode callback will Substitute the ILLEGAL SEQUENCE with the
+ * hexadecimal representation of the illegal bytes
+ *  (in the format  %XNN, e.g. "%XFF%X0A%XC8%X03").
+ *
+ * @param context This function currently recognizes the callback options:
+ *      UCNV_ESCAPE_ICU, UCNV_ESCAPE_JAVA, UCNV_ESCAPE_C, UCNV_ESCAPE_XML_DEC,
+ *      UCNV_ESCAPE_XML_HEX and UCNV_ESCAPE_UNICODE.
+ * @param toUArgs Information about the conversion in progress
+ * @param codeUnits Points to 'length' bytes of the concerned codepage sequence
+ * @param length Size (in bytes) of the concerned codepage sequence
+ * @param reason Defines the reason the callback was invoked
+ * @param err Return value will be set to success if the callback was handled,
+ *      otherwise this value will be set to a failure status.
+ * @stable ICU 2.0
+ */
+
+U_STABLE void U_EXPORT2 UCNV_TO_U_CALLBACK_ESCAPE (
+                  const void *context,
+                  UConverterToUnicodeArgs *toUArgs,
+                  const char* codeUnits,
+                  int32_t length,
+                  UConverterCallbackReason reason,
+                  UErrorCode * err);
+
+#endif
+
+#endif
+
+/*UCNV_ERR_H*/ 
diff --git a/icu/unicode/ucol.h b/icu/unicode/ucol.h
new file mode 100644
index 0000000..5a459b5
--- /dev/null
+++ b/icu/unicode/ucol.h
@@ -0,0 +1,1433 @@
+/*
+*******************************************************************************
+* Copyright (c) 1996-2013, International Business Machines Corporation and others.
+* All Rights Reserved.
+*******************************************************************************
+*/
+
+#ifndef UCOL_H
+#define UCOL_H
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_COLLATION
+
+#include "unicode/unorm.h"
+#include "unicode/localpointer.h"
+#include "unicode/parseerr.h"
+#include "unicode/uloc.h"
+#include "unicode/uset.h"
+#include "unicode/uscript.h"
+
+/**
+ * \file
+ * \brief C API: Collator 
+ *
+ * <h2> Collator C API </h2>
+ *
+ * The C API for Collator performs locale-sensitive
+ * string comparison. You use this service to build
+ * searching and sorting routines for natural language text.
+ * <em>Important: </em>The ICU collation service has been reimplemented 
+ * in order to achieve better performance and UCA compliance. 
+ * For details, see the 
+ * <a href="http://source.icu-project.org/repos/icu/icuhtml/trunk/design/collation/ICU_collation_design.htm">
+ * collation design document</a>.
+ * <p>
+ * For more information about the collation service see 
+ * <a href="http://icu-project.org/userguide/Collate_Intro.html">the users guide</a>.
+ * <p>
+ * Collation service provides correct sorting orders for most locales supported in ICU. 
+ * If specific data for a locale is not available, the orders eventually falls back
+ * to the <a href="http://www.unicode.org/unicode/reports/tr10/">UCA sort order</a>. 
+ * <p>
+ * Sort ordering may be customized by providing your own set of rules. For more on
+ * this subject see the 
+ * <a href="http://icu-project.org/userguide/Collate_Customization.html">
+ * Collation customization</a> section of the users guide.
+ * <p>
+ * @see         UCollationResult
+ * @see         UNormalizationMode
+ * @see         UCollationStrength
+ * @see         UCollationElements
+ */
+
+/** A collator.
+*  For usage in C programs.
+*/
+struct UCollator;
+/** structure representing a collator object instance 
+ * @stable ICU 2.0
+ */
+typedef struct UCollator UCollator;
+
+
+/**
+ * UCOL_LESS is returned if source string is compared to be less than target
+ * string in the ucol_strcoll() method.
+ * UCOL_EQUAL is returned if source string is compared to be equal to target
+ * string in the ucol_strcoll() method.
+ * UCOL_GREATER is returned if source string is compared to be greater than
+ * target string in the ucol_strcoll() method.
+ * @see ucol_strcoll()
+ * <p>
+ * Possible values for a comparison result 
+ * @stable ICU 2.0
+ */
+typedef enum {
+  /** string a == string b */
+  UCOL_EQUAL    = 0,
+  /** string a > string b */
+  UCOL_GREATER    = 1,
+  /** string a < string b */
+  UCOL_LESS    = -1
+} UCollationResult ;
+
+
+/** Enum containing attribute values for controling collation behavior.
+ * Here are all the allowable values. Not every attribute can take every value. The only
+ * universal value is UCOL_DEFAULT, which resets the attribute value to the predefined  
+ * value for that locale 
+ * @stable ICU 2.0
+ */
+typedef enum {
+  /** accepted by most attributes */
+  UCOL_DEFAULT = -1,
+
+  /** Primary collation strength */
+  UCOL_PRIMARY = 0,
+  /** Secondary collation strength */
+  UCOL_SECONDARY = 1,
+  /** Tertiary collation strength */
+  UCOL_TERTIARY = 2,
+  /** Default collation strength */
+  UCOL_DEFAULT_STRENGTH = UCOL_TERTIARY,
+  UCOL_CE_STRENGTH_LIMIT,
+  /** Quaternary collation strength */
+  UCOL_QUATERNARY=3,
+  /** Identical collation strength */
+  UCOL_IDENTICAL=15,
+  UCOL_STRENGTH_LIMIT,
+
+  /** Turn the feature off - works for UCOL_FRENCH_COLLATION, 
+      UCOL_CASE_LEVEL, UCOL_HIRAGANA_QUATERNARY_MODE
+      & UCOL_DECOMPOSITION_MODE*/
+  UCOL_OFF = 16,
+  /** Turn the feature on - works for UCOL_FRENCH_COLLATION, 
+      UCOL_CASE_LEVEL, UCOL_HIRAGANA_QUATERNARY_MODE
+      & UCOL_DECOMPOSITION_MODE*/
+  UCOL_ON = 17,
+  
+  /** Valid for UCOL_ALTERNATE_HANDLING. Alternate handling will be shifted */
+  UCOL_SHIFTED = 20,
+  /** Valid for UCOL_ALTERNATE_HANDLING. Alternate handling will be non ignorable */
+  UCOL_NON_IGNORABLE = 21,
+
+  /** Valid for UCOL_CASE_FIRST - 
+      lower case sorts before upper case */
+  UCOL_LOWER_FIRST = 24,
+  /** upper case sorts before lower case */
+  UCOL_UPPER_FIRST = 25,
+
+  UCOL_ATTRIBUTE_VALUE_COUNT
+
+} UColAttributeValue;
+
+/**
+ * Enum containing the codes for reordering segments of the collation table that are not script
+ * codes. These reordering codes are to be used in conjunction with the script codes.
+ * @see ucol_getReorderCodes
+ * @see ucol_setReorderCodes
+ * @see ucol_getEquivalentReorderCodes
+ * @see UScriptCode
+ * @stable ICU 4.8
+ */
+ typedef enum {
+   /**
+    * A special reordering code that is used to specify the default
+    * reordering codes for a locale.
+    * @stable ICU 4.8
+    */   
+    UCOL_REORDER_CODE_DEFAULT       = -1,
+   /**
+    * A special reordering code that is used to specify no reordering codes.
+    * @stable ICU 4.8
+    */   
+    UCOL_REORDER_CODE_NONE          = USCRIPT_UNKNOWN,
+   /**
+    * A special reordering code that is used to specify all other codes used for
+    * reordering except for the codes lised as UColReorderCode values and those
+    * listed explicitly in a reordering.
+    * @stable ICU 4.8
+    */   
+    UCOL_REORDER_CODE_OTHERS        = USCRIPT_UNKNOWN,
+   /**
+    * Characters with the space property.
+    * This is equivalent to the rule value "space".
+    * @stable ICU 4.8
+    */    
+    UCOL_REORDER_CODE_SPACE         = 0x1000,
+   /**
+    * The first entry in the enumeration of reordering groups. This is intended for use in
+    * range checking and enumeration of the reorder codes.
+    * @stable ICU 4.8
+    */    
+    UCOL_REORDER_CODE_FIRST         = UCOL_REORDER_CODE_SPACE,
+   /**
+    * Characters with the punctuation property.
+    * This is equivalent to the rule value "punct".
+    * @stable ICU 4.8
+    */    
+    UCOL_REORDER_CODE_PUNCTUATION   = 0x1001,
+   /**
+    * Characters with the symbol property.
+    * This is equivalent to the rule value "symbol".
+    * @stable ICU 4.8
+    */    
+    UCOL_REORDER_CODE_SYMBOL        = 0x1002,
+   /**
+    * Characters with the currency property.
+    * This is equivalent to the rule value "currency".
+    * @stable ICU 4.8
+    */    
+    UCOL_REORDER_CODE_CURRENCY      = 0x1003,
+   /**
+    * Characters with the digit property.
+    * This is equivalent to the rule value "digit".
+    * @stable ICU 4.8
+    */    
+    UCOL_REORDER_CODE_DIGIT         = 0x1004,
+   /**
+    * The limit of the reorder codes. This is intended for use in range checking 
+    * and enumeration of the reorder codes.
+    * @stable ICU 4.8
+    */    
+    UCOL_REORDER_CODE_LIMIT         = 0x1005
+} UColReorderCode;
+
+/**
+ * Base letter represents a primary difference.  Set comparison
+ * level to UCOL_PRIMARY to ignore secondary and tertiary differences.
+ * Use this to set the strength of a Collator object.
+ * Example of primary difference, "abc" &lt; "abd"
+ * 
+ * Diacritical differences on the same base letter represent a secondary
+ * difference.  Set comparison level to UCOL_SECONDARY to ignore tertiary
+ * differences. Use this to set the strength of a Collator object.
+ * Example of secondary difference, "&auml;" >> "a".
+ *
+ * Uppercase and lowercase versions of the same character represents a
+ * tertiary difference.  Set comparison level to UCOL_TERTIARY to include
+ * all comparison differences. Use this to set the strength of a Collator
+ * object.
+ * Example of tertiary difference, "abc" &lt;&lt;&lt; "ABC".
+ *
+ * Two characters are considered "identical" when they have the same
+ * unicode spellings.  UCOL_IDENTICAL.
+ * For example, "&auml;" == "&auml;".
+ *
+ * UCollationStrength is also used to determine the strength of sort keys 
+ * generated from UCollator objects
+ * These values can be now found in the UColAttributeValue enum.
+ * @stable ICU 2.0
+ **/
+typedef UColAttributeValue UCollationStrength;
+
+/** Attributes that collation service understands. All the attributes can take UCOL_DEFAULT
+ * value, as well as the values specific to each one. 
+ * @stable ICU 2.0
+ */
+typedef enum {
+     /** Attribute for direction of secondary weights - used in Canadian French.
+      * Acceptable values are UCOL_ON, which results in secondary weights
+      * being considered backwards and UCOL_OFF which treats secondary
+      * weights in the order they appear.
+      * @stable ICU 2.0
+      */
+     UCOL_FRENCH_COLLATION, 
+     /** Attribute for handling variable elements.
+      * Acceptable values are UCOL_NON_IGNORABLE (default)
+      * which treats all the codepoints with non-ignorable 
+      * primary weights in the same way,
+      * and UCOL_SHIFTED which causes codepoints with primary 
+      * weights that are equal or below the variable top value
+      * to be ignored on primary level and moved to the quaternary 
+      * level.
+      * @stable ICU 2.0
+      */
+     UCOL_ALTERNATE_HANDLING, 
+     /** Controls the ordering of upper and lower case letters.
+      * Acceptable values are UCOL_OFF (default), which orders
+      * upper and lower case letters in accordance to their tertiary
+      * weights, UCOL_UPPER_FIRST which forces upper case letters to 
+      * sort before lower case letters, and UCOL_LOWER_FIRST which does 
+      * the opposite.
+      * @stable ICU 2.0
+      */
+     UCOL_CASE_FIRST, 
+     /** Controls whether an extra case level (positioned before the third
+      * level) is generated or not. Acceptable values are UCOL_OFF (default), 
+      * when case level is not generated, and UCOL_ON which causes the case
+      * level to be generated. Contents of the case level are affected by
+      * the value of UCOL_CASE_FIRST attribute. A simple way to ignore 
+      * accent differences in a string is to set the strength to UCOL_PRIMARY
+      * and enable case level.
+      * @stable ICU 2.0
+      */
+     UCOL_CASE_LEVEL,
+     /** Controls whether the normalization check and necessary normalizations
+      * are performed. When set to UCOL_OFF (default) no normalization check
+      * is performed. The correctness of the result is guaranteed only if the 
+      * input data is in so-called FCD form (see users manual for more info).
+      * When set to UCOL_ON, an incremental check is performed to see whether
+      * the input data is in the FCD form. If the data is not in the FCD form,
+      * incremental NFD normalization is performed.
+      * @stable ICU 2.0
+      */
+     UCOL_NORMALIZATION_MODE, 
+     /** An alias for UCOL_NORMALIZATION_MODE attribute.
+      * @stable ICU 2.0
+      */
+     UCOL_DECOMPOSITION_MODE = UCOL_NORMALIZATION_MODE,
+     /** The strength attribute. Can be either UCOL_PRIMARY, UCOL_SECONDARY,
+      * UCOL_TERTIARY, UCOL_QUATERNARY or UCOL_IDENTICAL. The usual strength
+      * for most locales (except Japanese) is tertiary. Quaternary strength 
+      * is useful when combined with shifted setting for alternate handling
+      * attribute and for JIS x 4061 collation, when it is used to distinguish
+      * between Katakana  and Hiragana (this is achieved by setting the 
+      * UCOL_HIRAGANA_QUATERNARY mode to on. Otherwise, quaternary level
+      * is affected only by the number of non ignorable code points in
+      * the string. Identical strength is rarely useful, as it amounts 
+      * to codepoints of the NFD form of the string.
+      * @stable ICU 2.0
+      */
+     UCOL_STRENGTH,  
+#ifndef U_HIDE_DEPRECATED_API
+     /** When turned on, this attribute positions Hiragana before all  
+      * non-ignorables on quaternary level This is a sneaky way to produce JIS
+      * sort order.
+      *
+      * This attribute is an implementation detail of the CLDR Japanese tailoring.
+      * The implementation might change to use a different mechanism
+      * to achieve the same Japanese sort order.
+      * Since ICU 50, this attribute is not settable any more via API functions.
+      * @deprecated ICU 50 Implementation detail, cannot be set via API, might be removed from implementation.
+      */
+     UCOL_HIRAGANA_QUATERNARY_MODE = UCOL_STRENGTH + 1,
+#endif  /* U_HIDE_DEPRECATED_API */
+     /** When turned on, this attribute generates a collation key
+      * for the numeric value of substrings of digits.
+      * This is a way to get '100' to sort AFTER '2'. Note that the longest
+      * digit substring that can be treated as a single collation element is
+      * 254 digits (not counting leading zeros). If a digit substring is
+      * longer than that, the digits beyond the limit will be treated as a
+      * separate digit substring associated with a separate collation element.
+      * @stable ICU 2.8
+      */
+     UCOL_NUMERIC_COLLATION = UCOL_STRENGTH + 2, 
+     /**
+      * The number of UColAttribute constants.
+      * @stable ICU 2.0
+      */
+     UCOL_ATTRIBUTE_COUNT
+} UColAttribute;
+
+/** Options for retrieving the rule string 
+ *  @stable ICU 2.0
+ */
+typedef enum {
+  /**
+   * Retrieves the tailoring rules only.
+   * Same as calling the version of getRules() without UColRuleOption.
+   * @stable ICU 2.0
+   */
+  UCOL_TAILORING_ONLY, 
+  /**
+   * Retrieves the "UCA rules" concatenated with the tailoring rules.
+   * The "UCA rules" are an <i>approximation</i> of the root collator's sort order.
+   * They are almost never used or useful at runtime and can be removed from the data.
+   * See http://userguide.icu-project.org/collation/customization#TOC-Building-on-Existing-Locales
+   * @stable ICU 2.0
+   */
+  UCOL_FULL_RULES 
+} UColRuleOption ;
+
+/**
+ * Open a UCollator for comparing strings.
+ * The UCollator pointer is used in all the calls to the Collation 
+ * service. After finished, collator must be disposed of by calling
+ * {@link #ucol_close }.
+ * @param loc The locale containing the required collation rules. 
+ *            Special values for locales can be passed in - 
+ *            if NULL is passed for the locale, the default locale
+ *            collation rules will be used. If empty string ("") or
+ *            "root" are passed, UCA rules will be used.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return A pointer to a UCollator, or 0 if an error occurred.
+ * @see ucol_openRules
+ * @see ucol_safeClone
+ * @see ucol_close
+ * @stable ICU 2.0
+ */
+U_STABLE UCollator* U_EXPORT2 
+ucol_open(const char *loc, UErrorCode *status);
+
+/**
+ * Produce an UCollator instance according to the rules supplied.
+ * The rules are used to change the default ordering, defined in the
+ * UCA in a process called tailoring. The resulting UCollator pointer
+ * can be used in the same way as the one obtained by {@link #ucol_strcoll }.
+ * @param rules A string describing the collation rules. For the syntax
+ *              of the rules please see users guide.
+ * @param rulesLength The length of rules, or -1 if null-terminated.
+ * @param normalizationMode The normalization mode: One of
+ *             UCOL_OFF     (expect the text to not need normalization),
+ *             UCOL_ON      (normalize), or
+ *             UCOL_DEFAULT (set the mode according to the rules)
+ * @param strength The default collation strength; one of UCOL_PRIMARY, UCOL_SECONDARY,
+ * UCOL_TERTIARY, UCOL_IDENTICAL,UCOL_DEFAULT_STRENGTH - can be also set in the rules.
+ * @param parseError  A pointer to UParseError to recieve information about errors
+ *                    occurred during parsing. This argument can currently be set
+ *                    to NULL, but at users own risk. Please provide a real structure.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return A pointer to a UCollator. It is not guaranteed that NULL be returned in case
+ *         of error - please use status argument to check for errors.
+ * @see ucol_open
+ * @see ucol_safeClone
+ * @see ucol_close
+ * @stable ICU 2.0
+ */
+U_STABLE UCollator* U_EXPORT2 
+ucol_openRules( const UChar        *rules,
+                int32_t            rulesLength,
+                UColAttributeValue normalizationMode,
+                UCollationStrength strength,
+                UParseError        *parseError,
+                UErrorCode         *status);
+
+/** 
+ * Open a collator defined by a short form string.
+ * The structure and the syntax of the string is defined in the "Naming collators"
+ * section of the users guide: 
+ * http://icu-project.org/userguide/Collate_Concepts.html#Naming_Collators
+ * Attributes are overriden by the subsequent attributes. So, for "S2_S3", final
+ * strength will be 3. 3066bis locale overrides individual locale parts.
+ * The call to this function is equivalent to a call to ucol_open, followed by a 
+ * series of calls to ucol_setAttribute and ucol_setVariableTop.
+ * @param definition A short string containing a locale and a set of attributes. 
+ *                   Attributes not explicitly mentioned are left at the default
+ *                   state for a locale.
+ * @param parseError if not NULL, structure that will get filled with error's pre
+ *                   and post context in case of error.
+ * @param forceDefaults if FALSE, the settings that are the same as the collator 
+ *                   default settings will not be applied (for example, setting
+ *                   French secondary on a French collator would not be executed). 
+ *                   If TRUE, all the settings will be applied regardless of the 
+ *                   collator default value. If the definition
+ *                   strings are to be cached, should be set to FALSE.
+ * @param status     Error code. Apart from regular error conditions connected to 
+ *                   instantiating collators (like out of memory or similar), this
+ *                   API will return an error if an invalid attribute or attribute/value
+ *                   combination is specified.
+ * @return           A pointer to a UCollator or 0 if an error occured (including an 
+ *                   invalid attribute).
+ * @see ucol_open
+ * @see ucol_setAttribute
+ * @see ucol_setVariableTop
+ * @see ucol_getShortDefinitionString
+ * @see ucol_normalizeShortDefinitionString
+ * @stable ICU 3.0
+ *
+ */
+U_STABLE UCollator* U_EXPORT2
+ucol_openFromShortString( const char *definition,
+                          UBool forceDefaults,
+                          UParseError *parseError,
+                          UErrorCode *status);
+
+#ifndef U_HIDE_DEPRECATED_API
+/**
+ * Get a set containing the contractions defined by the collator. The set includes
+ * both the UCA contractions and the contractions defined by the collator. This set
+ * will contain only strings. If a tailoring explicitly suppresses contractions from 
+ * the UCA (like Russian), removed contractions will not be in the resulting set.
+ * @param coll collator 
+ * @param conts the set to hold the result. It gets emptied before
+ *              contractions are added. 
+ * @param status to hold the error code
+ * @return the size of the contraction set
+ *
+ * @deprecated ICU 3.4, use ucol_getContractionsAndExpansions instead
+ */
+U_DEPRECATED int32_t U_EXPORT2
+ucol_getContractions( const UCollator *coll,
+                  USet *conts,
+                  UErrorCode *status);
+#endif  /* U_HIDE_DEPRECATED_API */
+
+/**
+ * Get a set containing the expansions defined by the collator. The set includes
+ * both the UCA expansions and the expansions defined by the tailoring
+ * @param coll collator
+ * @param contractions if not NULL, the set to hold the contractions
+ * @param expansions if not NULL, the set to hold the expansions
+ * @param addPrefixes add the prefix contextual elements to contractions
+ * @param status to hold the error code
+ *
+ * @stable ICU 3.4
+ */
+U_STABLE void U_EXPORT2
+ucol_getContractionsAndExpansions( const UCollator *coll,
+                  USet *contractions, USet *expansions,
+                  UBool addPrefixes, UErrorCode *status);
+
+/** 
+ * Close a UCollator.
+ * Once closed, a UCollator should not be used. Every open collator should
+ * be closed. Otherwise, a memory leak will result.
+ * @param coll The UCollator to close.
+ * @see ucol_open
+ * @see ucol_openRules
+ * @see ucol_safeClone
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucol_close(UCollator *coll);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUCollatorPointer
+ * "Smart pointer" class, closes a UCollator via ucol_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUCollatorPointer, UCollator, ucol_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Compare two strings.
+ * The strings will be compared using the options already specified.
+ * @param coll The UCollator containing the comparison rules.
+ * @param source The source string.
+ * @param sourceLength The length of source, or -1 if null-terminated.
+ * @param target The target string.
+ * @param targetLength The length of target, or -1 if null-terminated.
+ * @return The result of comparing the strings; one of UCOL_EQUAL,
+ * UCOL_GREATER, UCOL_LESS
+ * @see ucol_greater
+ * @see ucol_greaterOrEqual
+ * @see ucol_equal
+ * @stable ICU 2.0
+ */
+U_STABLE UCollationResult U_EXPORT2 
+ucol_strcoll(    const    UCollator    *coll,
+        const    UChar        *source,
+        int32_t            sourceLength,
+        const    UChar        *target,
+        int32_t            targetLength);
+
+/** 
+* Compare two strings in UTF-8. 
+* The strings will be compared using the options already specified. 
+* Note: When input string contains malformed a UTF-8 byte sequence, 
+* this function treats these bytes as REPLACEMENT CHARACTER (U+FFFD).
+* @param coll The UCollator containing the comparison rules. 
+* @param source The source UTF-8 string. 
+* @param sourceLength The length of source, or -1 if null-terminated. 
+* @param target The target UTF-8 string. 
+* @param targetLength The length of target, or -1 if null-terminated. 
+* @param status A pointer to an UErrorCode to receive any errors 
+* @return The result of comparing the strings; one of UCOL_EQUAL, 
+* UCOL_GREATER, UCOL_LESS 
+* @see ucol_greater 
+* @see ucol_greaterOrEqual 
+* @see ucol_equal 
+* @stable ICU 50 
+*/ 
+U_STABLE UCollationResult U_EXPORT2
+ucol_strcollUTF8(
+        const UCollator *coll,
+        const char      *source,
+        int32_t         sourceLength,
+        const char      *target,
+        int32_t         targetLength,
+        UErrorCode      *status);
+
+/**
+ * Determine if one string is greater than another.
+ * This function is equivalent to {@link #ucol_strcoll } == UCOL_GREATER
+ * @param coll The UCollator containing the comparison rules.
+ * @param source The source string.
+ * @param sourceLength The length of source, or -1 if null-terminated.
+ * @param target The target string.
+ * @param targetLength The length of target, or -1 if null-terminated.
+ * @return TRUE if source is greater than target, FALSE otherwise.
+ * @see ucol_strcoll
+ * @see ucol_greaterOrEqual
+ * @see ucol_equal
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2 
+ucol_greater(const UCollator *coll,
+             const UChar     *source, int32_t sourceLength,
+             const UChar     *target, int32_t targetLength);
+
+/**
+ * Determine if one string is greater than or equal to another.
+ * This function is equivalent to {@link #ucol_strcoll } != UCOL_LESS
+ * @param coll The UCollator containing the comparison rules.
+ * @param source The source string.
+ * @param sourceLength The length of source, or -1 if null-terminated.
+ * @param target The target string.
+ * @param targetLength The length of target, or -1 if null-terminated.
+ * @return TRUE if source is greater than or equal to target, FALSE otherwise.
+ * @see ucol_strcoll
+ * @see ucol_greater
+ * @see ucol_equal
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2 
+ucol_greaterOrEqual(const UCollator *coll,
+                    const UChar     *source, int32_t sourceLength,
+                    const UChar     *target, int32_t targetLength);
+
+/**
+ * Compare two strings for equality.
+ * This function is equivalent to {@link #ucol_strcoll } == UCOL_EQUAL
+ * @param coll The UCollator containing the comparison rules.
+ * @param source The source string.
+ * @param sourceLength The length of source, or -1 if null-terminated.
+ * @param target The target string.
+ * @param targetLength The length of target, or -1 if null-terminated.
+ * @return TRUE if source is equal to target, FALSE otherwise
+ * @see ucol_strcoll
+ * @see ucol_greater
+ * @see ucol_greaterOrEqual
+ * @stable ICU 2.0
+ */
+U_STABLE UBool U_EXPORT2 
+ucol_equal(const UCollator *coll,
+           const UChar     *source, int32_t sourceLength,
+           const UChar     *target, int32_t targetLength);
+
+/**
+ * Compare two UTF-8 encoded trings.
+ * The strings will be compared using the options already specified.
+ * @param coll The UCollator containing the comparison rules.
+ * @param sIter The source string iterator.
+ * @param tIter The target string iterator.
+ * @return The result of comparing the strings; one of UCOL_EQUAL,
+ * UCOL_GREATER, UCOL_LESS
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @see ucol_strcoll
+ * @stable ICU 2.6
+ */
+U_STABLE UCollationResult U_EXPORT2 
+ucol_strcollIter(  const    UCollator    *coll,
+                  UCharIterator *sIter,
+                  UCharIterator *tIter,
+                  UErrorCode *status);
+
+/**
+ * Get the collation strength used in a UCollator.
+ * The strength influences how strings are compared.
+ * @param coll The UCollator to query.
+ * @return The collation strength; one of UCOL_PRIMARY, UCOL_SECONDARY,
+ * UCOL_TERTIARY, UCOL_QUATERNARY, UCOL_IDENTICAL
+ * @see ucol_setStrength
+ * @stable ICU 2.0
+ */
+U_STABLE UCollationStrength U_EXPORT2 
+ucol_getStrength(const UCollator *coll);
+
+/**
+ * Set the collation strength used in a UCollator.
+ * The strength influences how strings are compared.
+ * @param coll The UCollator to set.
+ * @param strength The desired collation strength; one of UCOL_PRIMARY, 
+ * UCOL_SECONDARY, UCOL_TERTIARY, UCOL_QUATERNARY, UCOL_IDENTICAL, UCOL_DEFAULT
+ * @see ucol_getStrength
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucol_setStrength(UCollator *coll,
+                 UCollationStrength strength);
+
+/**
+ * Retrieves the reordering codes for this collator.
+ * These reordering codes are a combination of UScript codes and UColReorderCode entries.
+ * @param coll The UCollator to query.
+ * @param dest The array to fill with the script ordering.
+ * @param destCapacity The length of dest. If it is 0, then dest may be NULL and the function 
+ * will only return the length of the result without writing any of the result string (pre-flighting).
+ * @param pErrorCode Must be a valid pointer to an error code value, which must not indicate a 
+ * failure before the function call.
+ * @return The number of reordering codes written to the dest array.
+ * @see ucol_setReorderCodes
+ * @see ucol_getEquivalentReorderCodes
+ * @see UScriptCode
+ * @see UColReorderCode
+ * @stable ICU 4.8
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_getReorderCodes(const UCollator* coll,
+                    int32_t* dest,
+                    int32_t destCapacity,
+                    UErrorCode *pErrorCode);
+/** 
+ * Sets the reordering codes for this collator.
+ * Collation reordering allows scripts and some other defined blocks of characters 
+ * to be moved relative to each other as a block. This reordering is done on top of 
+ * the DUCET/CLDR standard collation order. Reordering can specify groups to be placed 
+ * at the start and/or the end of the collation order. These groups are specified using
+ * UScript codes and UColReorderCode entries.
+ * <p>By default, reordering codes specified for the start of the order are placed in the 
+ * order given after a group of "special" non-script blocks. These special groups of characters 
+ * are space, punctuation, symbol, currency, and digit. These special groups are represented with
+ * UColReorderCode entries. Script groups can be intermingled with 
+ * these special non-script blocks if those special blocks are explicitly specified in the reordering.
+ * <p>The special code OTHERS stands for any script that is not explicitly 
+ * mentioned in the list of reordering codes given. Anything that is after OTHERS
+ * will go at the very end of the reordering in the order given.
+ * <p>The special reorder code DEFAULT will reset the reordering for this collator
+ * to the default for this collator. The default reordering may be the DUCET/CLDR order or may be a reordering that
+ * was specified when this collator was created from resource data or from rules. The 
+ * DEFAULT code <b>must</b> be the sole code supplied when it used. If not
+ * that will result in an U_ILLEGAL_ARGUMENT_ERROR being set.
+ * <p>The special reorder code NONE will remove any reordering for this collator.
+ * The result of setting no reordering will be to have the DUCET/CLDR ordering used. The 
+ * NONE code <b>must</b> be the sole code supplied when it used.
+ * @param coll The UCollator to set.
+ * @param reorderCodes An array of script codes in the new order. This can be NULL if the 
+ * length is also set to 0. An empty array will clear any reordering codes on the collator.
+ * @param reorderCodesLength The length of reorderCodes.
+ * @param pErrorCode Must be a valid pointer to an error code value, which must not indicate a
+ * failure before the function call.
+ * @see ucol_getReorderCodes
+ * @see ucol_getEquivalentReorderCodes
+ * @see UScriptCode
+ * @see UColReorderCode
+ * @stable ICU 4.8
+ */ 
+U_STABLE void U_EXPORT2 
+ucol_setReorderCodes(UCollator* coll,
+                    const int32_t* reorderCodes,
+                    int32_t reorderCodesLength,
+                    UErrorCode *pErrorCode);
+
+/**
+ * Retrieves the reorder codes that are grouped with the given reorder code. Some reorder
+ * codes will be grouped and must reorder together.
+ * @param reorderCode The reorder code to determine equivalence for.
+ * @param dest The array to fill with the script ordering.
+ * @param destCapacity The length of dest. If it is 0, then dest may be NULL and the function
+ * will only return the length of the result without writing any of the result string (pre-flighting).
+ * @param pErrorCode Must be a valid pointer to an error code value, which must not indicate 
+ * a failure before the function call.
+ * @return The number of reordering codes written to the dest array.
+ * @see ucol_setReorderCodes
+ * @see ucol_getReorderCodes
+ * @see UScriptCode
+ * @see UColReorderCode
+ * @stable ICU 4.8
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_getEquivalentReorderCodes(int32_t reorderCode,
+                    int32_t* dest,
+                    int32_t destCapacity,
+                    UErrorCode *pErrorCode);
+
+/**
+ * Get the display name for a UCollator.
+ * The display name is suitable for presentation to a user.
+ * @param objLoc The locale of the collator in question.
+ * @param dispLoc The locale for display.
+ * @param result A pointer to a buffer to receive the attribute.
+ * @param resultLength The maximum size of result.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return The total buffer size needed; if greater than resultLength,
+ * the output was truncated.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_getDisplayName(    const    char        *objLoc,
+            const    char        *dispLoc,
+            UChar             *result,
+            int32_t         resultLength,
+            UErrorCode        *status);
+
+/**
+ * Get a locale for which collation rules are available.
+ * A UCollator in a locale returned by this function will perform the correct
+ * collation for the locale.
+ * @param localeIndex The index of the desired locale.
+ * @return A locale for which collation rules are available, or 0 if none.
+ * @see ucol_countAvailable
+ * @stable ICU 2.0
+ */
+U_STABLE const char* U_EXPORT2 
+ucol_getAvailable(int32_t localeIndex);
+
+/**
+ * Determine how many locales have collation rules available.
+ * This function is most useful as determining the loop ending condition for
+ * calls to {@link #ucol_getAvailable }.
+ * @return The number of locales for which collation rules are available.
+ * @see ucol_getAvailable
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_countAvailable(void);
+
+#if !UCONFIG_NO_SERVICE
+/**
+ * Create a string enumerator of all locales for which a valid
+ * collator may be opened.
+ * @param status input-output error code
+ * @return a string enumeration over locale strings. The caller is
+ * responsible for closing the result.
+ * @stable ICU 3.0
+ */
+U_STABLE UEnumeration* U_EXPORT2
+ucol_openAvailableLocales(UErrorCode *status);
+#endif
+
+/**
+ * Create a string enumerator of all possible keywords that are relevant to
+ * collation. At this point, the only recognized keyword for this
+ * service is "collation".
+ * @param status input-output error code
+ * @return a string enumeration over locale strings. The caller is
+ * responsible for closing the result.
+ * @stable ICU 3.0
+ */
+U_STABLE UEnumeration* U_EXPORT2
+ucol_getKeywords(UErrorCode *status);
+
+/**
+ * Given a keyword, create a string enumeration of all values
+ * for that keyword that are currently in use.
+ * @param keyword a particular keyword as enumerated by
+ * ucol_getKeywords. If any other keyword is passed in, *status is set
+ * to U_ILLEGAL_ARGUMENT_ERROR.
+ * @param status input-output error code
+ * @return a string enumeration over collation keyword values, or NULL
+ * upon error. The caller is responsible for closing the result.
+ * @stable ICU 3.0
+ */
+U_STABLE UEnumeration* U_EXPORT2
+ucol_getKeywordValues(const char *keyword, UErrorCode *status);
+
+/**
+ * Given a key and a locale, returns an array of string values in a preferred
+ * order that would make a difference. These are all and only those values where
+ * the open (creation) of the service with the locale formed from the input locale
+ * plus input keyword and that value has different behavior than creation with the
+ * input locale alone.
+ * @param key           one of the keys supported by this service.  For now, only
+ *                      "collation" is supported.
+ * @param locale        the locale
+ * @param commonlyUsed  if set to true it will return only commonly used values
+ *                      with the given locale in preferred order.  Otherwise,
+ *                      it will return all the available values for the locale.
+ * @param status error status
+ * @return a string enumeration over keyword values for the given key and the locale.
+ * @stable ICU 4.2
+ */
+U_STABLE UEnumeration* U_EXPORT2
+ucol_getKeywordValuesForLocale(const char* key,
+                               const char* locale,
+                               UBool commonlyUsed,
+                               UErrorCode* status);
+
+/**
+ * Return the functionally equivalent locale for the given
+ * requested locale, with respect to given keyword, for the
+ * collation service.  If two locales return the same result, then
+ * collators instantiated for these locales will behave
+ * equivalently.  The converse is not always true; two collators
+ * may in fact be equivalent, but return different results, due to
+ * internal details.  The return result has no other meaning than
+ * that stated above, and implies nothing as to the relationship
+ * between the two locales.  This is intended for use by
+ * applications who wish to cache collators, or otherwise reuse
+ * collators when possible.  The functional equivalent may change
+ * over time.  For more information, please see the <a
+ * href="http://icu-project.org/userguide/locale.html#services">
+ * Locales and Services</a> section of the ICU User Guide.
+ * @param result fillin for the functionally equivalent locale
+ * @param resultCapacity capacity of the fillin buffer
+ * @param keyword a particular keyword as enumerated by
+ * ucol_getKeywords.
+ * @param locale the requested locale
+ * @param isAvailable if non-NULL, pointer to a fillin parameter that
+ * indicates whether the requested locale was 'available' to the
+ * collation service. A locale is defined as 'available' if it
+ * physically exists within the collation locale data.
+ * @param status pointer to input-output error code
+ * @return the actual buffer size needed for the locale.  If greater
+ * than resultCapacity, the returned full name will be truncated and
+ * an error code will be returned.
+ * @stable ICU 3.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucol_getFunctionalEquivalent(char* result, int32_t resultCapacity,
+                             const char* keyword, const char* locale,
+                             UBool* isAvailable, UErrorCode* status);
+
+/**
+ * Get the collation tailoring rules from a UCollator.
+ * The rules will follow the rule syntax.
+ * @param coll The UCollator to query.
+ * @param length 
+ * @return The collation tailoring rules.
+ * @stable ICU 2.0
+ */
+U_STABLE const UChar* U_EXPORT2 
+ucol_getRules(    const    UCollator    *coll, 
+        int32_t            *length);
+
+/** Get the short definition string for a collator. This API harvests the collator's
+ *  locale and the attribute set and produces a string that can be used for opening 
+ *  a collator with the same properties using the ucol_openFromShortString API.
+ *  This string will be normalized.
+ *  The structure and the syntax of the string is defined in the "Naming collators"
+ *  section of the users guide: 
+ *  http://icu-project.org/userguide/Collate_Concepts.html#Naming_Collators
+ *  This API supports preflighting.
+ *  @param coll a collator
+ *  @param locale a locale that will appear as a collators locale in the resulting
+ *                short string definition. If NULL, the locale will be harvested 
+ *                from the collator.
+ *  @param buffer space to hold the resulting string
+ *  @param capacity capacity of the buffer
+ *  @param status for returning errors. All the preflighting errors are featured
+ *  @return length of the resulting string
+ *  @see ucol_openFromShortString
+ *  @see ucol_normalizeShortDefinitionString
+ *  @stable ICU 3.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucol_getShortDefinitionString(const UCollator *coll,
+                              const char *locale,
+                              char *buffer,
+                              int32_t capacity,
+                              UErrorCode *status);
+
+/** Verifies and normalizes short definition string.
+ *  Normalized short definition string has all the option sorted by the argument name,
+ *  so that equivalent definition strings are the same. 
+ *  This API supports preflighting.
+ *  @param source definition string
+ *  @param destination space to hold the resulting string
+ *  @param capacity capacity of the buffer
+ *  @param parseError if not NULL, structure that will get filled with error's pre
+ *                   and post context in case of error.
+ *  @param status     Error code. This API will return an error if an invalid attribute 
+ *                    or attribute/value combination is specified. All the preflighting 
+ *                    errors are also featured
+ *  @return length of the resulting normalized string.
+ *
+ *  @see ucol_openFromShortString
+ *  @see ucol_getShortDefinitionString
+ * 
+ *  @stable ICU 3.0
+ */
+
+U_STABLE int32_t U_EXPORT2
+ucol_normalizeShortDefinitionString(const char *source,
+                                    char *destination,
+                                    int32_t capacity,
+                                    UParseError *parseError,
+                                    UErrorCode *status);
+
+
+/**
+ * Get a sort key for a string from a UCollator.
+ * Sort keys may be compared using <TT>strcmp</TT>.
+ *
+ * Like ICU functions that write to an output buffer, the buffer contents
+ * is undefined if the buffer capacity (resultLength parameter) is too small.
+ * Unlike ICU functions that write a string to an output buffer,
+ * the terminating zero byte is counted in the sort key length.
+ * @param coll The UCollator containing the collation rules.
+ * @param source The string to transform.
+ * @param sourceLength The length of source, or -1 if null-terminated.
+ * @param result A pointer to a buffer to receive the attribute.
+ * @param resultLength The maximum size of result.
+ * @return The size needed to fully store the sort key.
+ *      If there was an internal error generating the sort key,
+ *      a zero value is returned.
+ * @see ucol_keyHashCode
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_getSortKey(const    UCollator    *coll,
+        const    UChar        *source,
+        int32_t        sourceLength,
+        uint8_t        *result,
+        int32_t        resultLength);
+
+
+/** Gets the next count bytes of a sort key. Caller needs
+ *  to preserve state array between calls and to provide
+ *  the same type of UCharIterator set with the same string.
+ *  The destination buffer provided must be big enough to store
+ *  the number of requested bytes.
+ *
+ *  The generated sort key may or may not be compatible with
+ *  sort keys generated using ucol_getSortKey().
+ *  @param coll The UCollator containing the collation rules.
+ *  @param iter UCharIterator containing the string we need 
+ *              the sort key to be calculated for.
+ *  @param state Opaque state of sortkey iteration.
+ *  @param dest Buffer to hold the resulting sortkey part
+ *  @param count number of sort key bytes required.
+ *  @param status error code indicator.
+ *  @return the actual number of bytes of a sortkey. It can be
+ *          smaller than count if we have reached the end of 
+ *          the sort key.
+ *  @stable ICU 2.6
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_nextSortKeyPart(const UCollator *coll,
+                     UCharIterator *iter,
+                     uint32_t state[2],
+                     uint8_t *dest, int32_t count,
+                     UErrorCode *status);
+
+/** enum that is taken by ucol_getBound API 
+ * See below for explanation                
+ * do not change the values assigned to the 
+ * members of this enum. Underlying code    
+ * depends on them having these numbers     
+ * @stable ICU 2.0
+ */
+typedef enum {
+  /** lower bound */
+  UCOL_BOUND_LOWER = 0,
+  /** upper bound that will match strings of exact size */
+  UCOL_BOUND_UPPER = 1,
+  /** upper bound that will match all the strings that have the same initial substring as the given string */
+  UCOL_BOUND_UPPER_LONG = 2,
+  UCOL_BOUND_VALUE_COUNT
+} UColBoundMode;
+
+/**
+ * Produce a bound for a given sortkey and a number of levels.
+ * Return value is always the number of bytes needed, regardless of 
+ * whether the result buffer was big enough or even valid.<br>
+ * Resulting bounds can be used to produce a range of strings that are
+ * between upper and lower bounds. For example, if bounds are produced
+ * for a sortkey of string "smith", strings between upper and lower 
+ * bounds with one level would include "Smith", "SMITH", "sMiTh".<br>
+ * There are two upper bounds that can be produced. If UCOL_BOUND_UPPER
+ * is produced, strings matched would be as above. However, if bound
+ * produced using UCOL_BOUND_UPPER_LONG is used, the above example will
+ * also match "Smithsonian" and similar.<br>
+ * For more on usage, see example in cintltst/capitst.c in procedure
+ * TestBounds.
+ * Sort keys may be compared using <TT>strcmp</TT>.
+ * @param source The source sortkey.
+ * @param sourceLength The length of source, or -1 if null-terminated. 
+ *                     (If an unmodified sortkey is passed, it is always null 
+ *                      terminated).
+ * @param boundType Type of bound required. It can be UCOL_BOUND_LOWER, which 
+ *                  produces a lower inclusive bound, UCOL_BOUND_UPPER, that 
+ *                  produces upper bound that matches strings of the same length 
+ *                  or UCOL_BOUND_UPPER_LONG that matches strings that have the 
+ *                  same starting substring as the source string.
+ * @param noOfLevels  Number of levels required in the resulting bound (for most 
+ *                    uses, the recommended value is 1). See users guide for 
+ *                    explanation on number of levels a sortkey can have.
+ * @param result A pointer to a buffer to receive the resulting sortkey.
+ * @param resultLength The maximum size of result.
+ * @param status Used for returning error code if something went wrong. If the 
+ *               number of levels requested is higher than the number of levels
+ *               in the source key, a warning (U_SORT_KEY_TOO_SHORT_WARNING) is 
+ *               issued.
+ * @return The size needed to fully store the bound. 
+ * @see ucol_keyHashCode
+ * @stable ICU 2.1
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_getBound(const uint8_t       *source,
+        int32_t             sourceLength,
+        UColBoundMode       boundType,
+        uint32_t            noOfLevels,
+        uint8_t             *result,
+        int32_t             resultLength,
+        UErrorCode          *status);
+        
+/**
+ * Gets the version information for a Collator. Version is currently
+ * an opaque 32-bit number which depends, among other things, on major
+ * versions of the collator tailoring and UCA.
+ * @param coll The UCollator to query.
+ * @param info the version # information, the result will be filled in
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+ucol_getVersion(const UCollator* coll, UVersionInfo info);
+
+/**
+ * Gets the UCA version information for a Collator. Version is the
+ * UCA version number (3.1.1, 4.0).
+ * @param coll The UCollator to query.
+ * @param info the version # information, the result will be filled in
+ * @stable ICU 2.8
+ */
+U_STABLE void U_EXPORT2
+ucol_getUCAVersion(const UCollator* coll, UVersionInfo info);
+
+/**
+ * Merges two sort keys. The levels are merged with their corresponding counterparts
+ * (primaries with primaries, secondaries with secondaries etc.). Between the values
+ * from the same level a separator is inserted.
+ *
+ * This is useful, for example, for combining sort keys from first and last names
+ * to sort such pairs.
+ * It is possible to merge multiple sort keys by consecutively merging
+ * another one with the intermediate result.
+ *
+ * The length of the merge result is the sum of the lengths of the input sort keys.
+ *
+ * Example (uncompressed):
+ * <pre>191B1D 01 050505 01 910505 00
+ * 1F2123 01 050505 01 910505 00</pre>
+ * will be merged as 
+ * <pre>191B1D 02 1F2123 01 050505 02 050505 01 910505 02 910505 00</pre>
+ *
+ * If the destination buffer is not big enough, then its contents are undefined.
+ * If any of source lengths are zero or any of the source pointers are NULL/undefined,
+ * the result is of size zero.
+ *
+ * @param src1 the first sort key
+ * @param src1Length the length of the first sort key, including the zero byte at the end;
+ *        can be -1 if the function is to find the length
+ * @param src2 the second sort key
+ * @param src2Length the length of the second sort key, including the zero byte at the end;
+ *        can be -1 if the function is to find the length
+ * @param dest the buffer where the merged sort key is written,
+ *        can be NULL if destCapacity==0
+ * @param destCapacity the number of bytes in the dest buffer
+ * @return the length of the merged sort key, src1Length+src2Length;
+ *         can be larger than destCapacity, or 0 if an error occurs (only for illegal arguments),
+ *         in which cases the contents of dest is undefined
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_mergeSortkeys(const uint8_t *src1, int32_t src1Length,
+                   const uint8_t *src2, int32_t src2Length,
+                   uint8_t *dest, int32_t destCapacity);
+
+/**
+ * Universal attribute setter
+ * @param coll collator which attributes are to be changed
+ * @param attr attribute type 
+ * @param value attribute value
+ * @param status to indicate whether the operation went on smoothly or there were errors
+ * @see UColAttribute
+ * @see UColAttributeValue
+ * @see ucol_getAttribute
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucol_setAttribute(UCollator *coll, UColAttribute attr, UColAttributeValue value, UErrorCode *status);
+
+/**
+ * Universal attribute getter
+ * @param coll collator which attributes are to be changed
+ * @param attr attribute type
+ * @return attribute value
+ * @param status to indicate whether the operation went on smoothly or there were errors
+ * @see UColAttribute
+ * @see UColAttributeValue
+ * @see ucol_setAttribute
+ * @stable ICU 2.0
+ */
+U_STABLE UColAttributeValue  U_EXPORT2 
+ucol_getAttribute(const UCollator *coll, UColAttribute attr, UErrorCode *status);
+
+/** Variable top
+ * is a two byte primary value which causes all the codepoints with primary values that
+ * are less or equal than the variable top to be shifted when alternate handling is set
+ * to UCOL_SHIFTED.
+ * Sets the variable top to a collation element value of a string supplied. 
+ * @param coll collator which variable top needs to be changed
+ * @param varTop one or more (if contraction) UChars to which the variable top should be set
+ * @param len length of variable top string. If -1 it is considered to be zero terminated.
+ * @param status error code. If error code is set, the return value is undefined. 
+ *               Errors set by this function are: <br>
+ *    U_CE_NOT_FOUND_ERROR if more than one character was passed and there is no such 
+ *    a contraction<br>
+ *    U_PRIMARY_TOO_LONG_ERROR if the primary for the variable top has more than two bytes
+ * @return a 32 bit value containing the value of the variable top in upper 16 bits. 
+ *         Lower 16 bits are undefined
+ * @see ucol_getVariableTop
+ * @see ucol_restoreVariableTop
+ * @stable ICU 2.0
+ */
+U_STABLE uint32_t U_EXPORT2 
+ucol_setVariableTop(UCollator *coll, 
+                    const UChar *varTop, int32_t len, 
+                    UErrorCode *status);
+
+/** 
+ * Gets the variable top value of a Collator. 
+ * Lower 16 bits are undefined and should be ignored.
+ * @param coll collator which variable top needs to be retrieved
+ * @param status error code (not changed by function). If error code is set, 
+ *               the return value is undefined.
+ * @return the variable top value of a Collator.
+ * @see ucol_setVariableTop
+ * @see ucol_restoreVariableTop
+ * @stable ICU 2.0
+ */
+U_STABLE uint32_t U_EXPORT2 ucol_getVariableTop(const UCollator *coll, UErrorCode *status);
+
+/** 
+ * Sets the variable top to a collation element value supplied. Variable top is 
+ * set to the upper 16 bits. 
+ * Lower 16 bits are ignored.
+ * @param coll collator which variable top needs to be changed
+ * @param varTop CE value, as returned by ucol_setVariableTop or ucol)getVariableTop
+ * @param status error code (not changed by function)
+ * @see ucol_getVariableTop
+ * @see ucol_setVariableTop
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+ucol_restoreVariableTop(UCollator *coll, const uint32_t varTop, UErrorCode *status);
+
+/**
+ * Thread safe cloning operation. The result is a clone of a given collator.
+ * @param coll collator to be cloned
+ * @param stackBuffer <em>Deprecated functionality as of ICU 52, use NULL.</em><br>
+ * user allocated space for the new clone. 
+ * If NULL new memory will be allocated. 
+ *  If buffer is not large enough, new memory will be allocated.
+ *  Clients can use the U_COL_SAFECLONE_BUFFERSIZE.
+ * @param pBufferSize <em>Deprecated functionality as of ICU 52, use NULL or 1.</em><br>
+ *  pointer to size of allocated space. 
+ *  If *pBufferSize == 0, a sufficient size for use in cloning will 
+ *  be returned ('pre-flighting')
+ *  If *pBufferSize is not enough for a stack-based safe clone, 
+ *  new memory will be allocated.
+ * @param status to indicate whether the operation went on smoothly or there were errors
+ *    An informational status value, U_SAFECLONE_ALLOCATED_ERROR, is used if any
+ * allocations were necessary.
+ * @return pointer to the new clone
+ * @see ucol_open
+ * @see ucol_openRules
+ * @see ucol_close
+ * @stable ICU 2.0
+ */
+U_STABLE UCollator* U_EXPORT2 
+ucol_safeClone(const UCollator *coll,
+               void            *stackBuffer,
+               int32_t         *pBufferSize,
+               UErrorCode      *status);
+
+#ifndef U_HIDE_DEPRECATED_API
+
+/** default memory size for the new clone.
+ * @deprecated ICU 52. Do not rely on ucol_safeClone() cloning into any provided buffer.
+ */
+#define U_COL_SAFECLONE_BUFFERSIZE 1
+
+#endif /* U_HIDE_DEPRECATED_API */
+
+/**
+ * Returns current rules. Delta defines whether full rules are returned or just the tailoring. 
+ * Returns number of UChars needed to store rules. If buffer is NULL or bufferLen is not enough 
+ * to store rules, will store up to available space.
+ *
+ * ucol_getRules() should normally be used instead.
+ * See http://userguide.icu-project.org/collation/customization#TOC-Building-on-Existing-Locales
+ * @param coll collator to get the rules from
+ * @param delta one of UCOL_TAILORING_ONLY, UCOL_FULL_RULES. 
+ * @param buffer buffer to store the result in. If NULL, you'll get no rules.
+ * @param bufferLen length of buffer to store rules in. If less than needed you'll get only the part that fits in.
+ * @return current rules
+ * @stable ICU 2.0
+ * @see UCOL_FULL_RULES
+ */
+U_STABLE int32_t U_EXPORT2 
+ucol_getRulesEx(const UCollator *coll, UColRuleOption delta, UChar *buffer, int32_t bufferLen);
+
+#ifndef U_HIDE_DEPRECATED_API
+/**
+ * gets the locale name of the collator. If the collator
+ * is instantiated from the rules, then this function returns
+ * NULL.
+ * @param coll The UCollator for which the locale is needed
+ * @param type You can choose between requested, valid and actual
+ *             locale. For description see the definition of
+ *             ULocDataLocaleType in uloc.h
+ * @param status error code of the operation
+ * @return real locale name from which the collation data comes. 
+ *         If the collator was instantiated from rules, returns
+ *         NULL.
+ * @deprecated ICU 2.8 Use ucol_getLocaleByType instead
+ */
+U_DEPRECATED const char * U_EXPORT2
+ucol_getLocale(const UCollator *coll, ULocDataLocaleType type, UErrorCode *status);
+#endif  /* U_HIDE_DEPRECATED_API */
+
+/**
+ * gets the locale name of the collator. If the collator
+ * is instantiated from the rules, then this function returns
+ * NULL.
+ * @param coll The UCollator for which the locale is needed
+ * @param type You can choose between requested, valid and actual
+ *             locale. For description see the definition of
+ *             ULocDataLocaleType in uloc.h
+ * @param status error code of the operation
+ * @return real locale name from which the collation data comes. 
+ *         If the collator was instantiated from rules, returns
+ *         NULL.
+ * @stable ICU 2.8
+ */
+U_STABLE const char * U_EXPORT2
+ucol_getLocaleByType(const UCollator *coll, ULocDataLocaleType type, UErrorCode *status);
+
+/**
+ * Get an Unicode set that contains all the characters and sequences tailored in 
+ * this collator. The result must be disposed of by using uset_close.
+ * @param coll        The UCollator for which we want to get tailored chars
+ * @param status      error code of the operation
+ * @return a pointer to newly created USet. Must be be disposed by using uset_close
+ * @see ucol_openRules
+ * @see uset_close
+ * @stable ICU 2.4
+ */
+U_STABLE USet * U_EXPORT2
+ucol_getTailoredSet(const UCollator *coll, UErrorCode *status);
+
+#ifndef U_HIDE_INTERNAL_API
+/**
+ * Universal attribute getter that returns UCOL_DEFAULT if the value is default
+ * @param coll collator which attributes are to be changed
+ * @param attr attribute type
+ * @return attribute value or UCOL_DEFAULT if the value is default
+ * @param status to indicate whether the operation went on smoothly or there were errors
+ * @see UColAttribute
+ * @see UColAttributeValue
+ * @see ucol_setAttribute
+ * @internal ICU 3.0
+ */
+U_INTERNAL UColAttributeValue  U_EXPORT2
+ucol_getAttributeOrDefault(const UCollator *coll, UColAttribute attr, UErrorCode *status);
+
+/** Check whether two collators are equal. Collators are considered equal if they
+ *  will sort strings the same. This means that both the current attributes and the
+ *  rules must be equivalent. Currently used for RuleBasedCollator::operator==.
+ *  @param source first collator
+ *  @param target second collator
+ *  @return TRUE or FALSE
+ *  @internal ICU 3.0
+ */
+U_INTERNAL UBool U_EXPORT2
+ucol_equals(const UCollator *source, const UCollator *target);
+
+/** Calculates the set of unsafe code points, given a collator.
+ *   A character is unsafe if you could append any character and cause the ordering to alter significantly.
+ *   Collation sorts in normalized order, so anything that rearranges in normalization can cause this.
+ *   Thus if you have a character like a_umlaut, and you add a lower_dot to it,
+ *   then it normalizes to a_lower_dot + umlaut, and sorts differently.
+ *  @param coll Collator
+ *  @param unsafe a fill-in set to receive the unsafe points
+ *  @param status for catching errors
+ *  @return number of elements in the set
+ *  @internal ICU 3.0
+ */
+U_INTERNAL int32_t U_EXPORT2
+ucol_getUnsafeSet( const UCollator *coll,
+                  USet *unsafe,
+                  UErrorCode *status);
+
+/** Reset UCA's static pointers. You don't want to use this, unless your static memory can go away.
+ * @internal ICU 3.2.1
+ */
+U_INTERNAL void U_EXPORT2
+ucol_forgetUCA(void);
+
+/** Touches all resources needed for instantiating a collator from a short string definition,
+ *  thus filling up the cache.
+ * @param definition A short string containing a locale and a set of attributes. 
+ *                   Attributes not explicitly mentioned are left at the default
+ *                   state for a locale.
+ * @param parseError if not NULL, structure that will get filled with error's pre
+ *                   and post context in case of error.
+ * @param forceDefaults if FALSE, the settings that are the same as the collator 
+ *                   default settings will not be applied (for example, setting
+ *                   French secondary on a French collator would not be executed). 
+ *                   If TRUE, all the settings will be applied regardless of the 
+ *                   collator default value. If the definition
+ *                   strings are to be cached, should be set to FALSE.
+ * @param status     Error code. Apart from regular error conditions connected to 
+ *                   instantiating collators (like out of memory or similar), this
+ *                   API will return an error if an invalid attribute or attribute/value
+ *                   combination is specified.
+ * @see ucol_openFromShortString
+ * @internal ICU 3.2.1
+ */
+U_INTERNAL void U_EXPORT2
+ucol_prepareShortStringOpen( const char *definition,
+                          UBool forceDefaults,
+                          UParseError *parseError,
+                          UErrorCode *status);
+#endif  /* U_HIDE_INTERNAL_API */
+
+/** Creates a binary image of a collator. This binary image can be stored and 
+ *  later used to instantiate a collator using ucol_openBinary.
+ *  This API supports preflighting.
+ *  @param coll Collator
+ *  @param buffer a fill-in buffer to receive the binary image
+ *  @param capacity capacity of the destination buffer
+ *  @param status for catching errors
+ *  @return size of the image
+ *  @see ucol_openBinary
+ *  @stable ICU 3.2
+ */
+U_STABLE int32_t U_EXPORT2
+ucol_cloneBinary(const UCollator *coll,
+                 uint8_t *buffer, int32_t capacity,
+                 UErrorCode *status);
+
+/** Opens a collator from a collator binary image created using
+ *  ucol_cloneBinary. Binary image used in instantiation of the 
+ *  collator remains owned by the user and should stay around for 
+ *  the lifetime of the collator. The API also takes a base collator
+ *  which usualy should be UCA.
+ *  @param bin binary image owned by the user and required through the
+ *             lifetime of the collator
+ *  @param length size of the image. If negative, the API will try to
+ *                figure out the length of the image
+ *  @param base fallback collator, usually UCA. Base is required to be
+ *              present through the lifetime of the collator. Currently 
+ *              it cannot be NULL.
+ *  @param status for catching errors
+ *  @return newly created collator
+ *  @see ucol_cloneBinary
+ *  @stable ICU 3.2
+ */
+U_STABLE UCollator* U_EXPORT2
+ucol_openBinary(const uint8_t *bin, int32_t length, 
+                const UCollator *base, 
+                UErrorCode *status);
+
+
+#endif /* #if !UCONFIG_NO_COLLATION */
+
+#endif
diff --git a/icu/unicode/uconfig.h b/icu/unicode/uconfig.h
new file mode 100644
index 0000000..bfa8e77
--- /dev/null
+++ b/icu/unicode/uconfig.h
@@ -0,0 +1,412 @@
+/*  
+**********************************************************************
+*   Copyright (C) 2002-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+*   file name:  uconfig.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 2002sep19
+*   created by: Markus W. Scherer
+*/
+
+#ifndef __UCONFIG_H__
+#define __UCONFIG_H__
+
+
+/*!
+ * \file
+ * \brief User-configurable settings
+ *
+ * Miscellaneous switches:
+ *
+ * A number of macros affect a variety of minor aspects of ICU.
+ * Most of them used to be defined elsewhere (e.g., in utypes.h or platform.h)
+ * and moved here to make them easier to find.
+ *
+ * Switches for excluding parts of ICU library code modules:
+ *
+ * Changing these macros allows building partial, smaller libraries for special purposes.
+ * By default, all modules are built.
+ * The switches are fairly coarse, controlling large modules.
+ * Basic services cannot be turned off.
+ *
+ * Building with any of these options does not guarantee that the
+ * ICU build process will completely work. It is recommended that
+ * the ICU libraries and data be built using the normal build.
+ * At that time you should remove the data used by those services.
+ * After building the ICU data library, you should rebuild the ICU
+ * libraries with these switches customized to your needs.
+ *
+ * @stable ICU 2.4
+ */
+
+/**
+ * If this switch is defined, ICU will attempt to load a header file named "uconfig_local.h"
+ * prior to determining default settings for uconfig variables.
+ *
+ * @internal ICU 4.0
+ */
+#if defined(UCONFIG_USE_LOCAL)
+#include "uconfig_local.h"
+#endif
+
+/**
+ * \def U_DEBUG
+ * Determines whether to include debugging code.
+ * Automatically set on Windows, but most compilers do not have
+ * related predefined macros.
+ * @internal
+ */
+#ifdef U_DEBUG
+    /* Use the predefined value. */
+#elif defined(_DEBUG)
+    /*
+     * _DEBUG is defined by Visual Studio debug compilation.
+     * Do *not* test for its NDEBUG macro: It is an orthogonal macro
+     * which disables assert().
+     */
+#   define U_DEBUG 1
+# else
+#   define U_DEBUG 0
+#endif
+
+/**
+ * Determines wheter to enable auto cleanup of libraries. 
+ * @internal
+ */
+#ifndef UCLN_NO_AUTO_CLEANUP
+#define UCLN_NO_AUTO_CLEANUP 1
+#endif
+
+/**
+ * \def U_DISABLE_RENAMING
+ * Determines whether to disable renaming or not.
+ * @internal
+ */
+#ifndef U_DISABLE_RENAMING
+#define U_DISABLE_RENAMING 1
+#endif
+
+/**
+ * \def U_NO_DEFAULT_INCLUDE_UTF_HEADERS
+ * Determines whether utypes.h includes utf.h, utf8.h, utf16.h and utf_old.h.
+ * utypes.h includes those headers if this macro is defined to 0.
+ * Otherwise, each those headers must be included explicitly when using one of their macros.
+ * Defaults to 0 for backward compatibility, except inside ICU.
+ * @stable ICU 49
+ */
+#ifdef U_NO_DEFAULT_INCLUDE_UTF_HEADERS
+    /* Use the predefined value. */
+#elif defined(U_COMBINED_IMPLEMENTATION) || defined(U_COMMON_IMPLEMENTATION) || defined(U_I18N_IMPLEMENTATION) || \
+      defined(U_IO_IMPLEMENTATION) || defined(U_LAYOUT_IMPLEMENTATION) || defined(U_LAYOUTEX_IMPLEMENTATION) || \
+      defined(U_TOOLUTIL_IMPLEMENTATION)
+#   define U_NO_DEFAULT_INCLUDE_UTF_HEADERS 1
+#else
+#   define U_NO_DEFAULT_INCLUDE_UTF_HEADERS 0
+#endif
+
+/**
+ * \def U_OVERRIDE_CXX_ALLOCATION
+ * Determines whether to override new and delete.
+ * ICU is normally built such that all of its C++ classes, via their UMemory base,
+ * override operators new and delete to use its internal, customizable,
+ * non-exception-throwing memory allocation functions. (Default value 1 for this macro.)
+ *
+ * This is especially important when the application and its libraries use multiple heaps.
+ * For example, on Windows, this allows the ICU DLL to be used by
+ * applications that statically link the C Runtime library.
+ *
+ * @stable ICU 2.2
+ */
+#ifndef U_OVERRIDE_CXX_ALLOCATION
+#define U_OVERRIDE_CXX_ALLOCATION 1
+#endif
+
+/**
+ * \def U_ENABLE_TRACING
+ * Determines whether to enable tracing.
+ * @internal
+ */
+#ifndef U_ENABLE_TRACING
+#define U_ENABLE_TRACING 0
+#endif
+
+/**
+ * \def U_ENABLE_DYLOAD
+ * Whether to enable Dynamic loading in ICU.
+ * @internal
+ */
+#ifndef U_ENABLE_DYLOAD
+#define U_ENABLE_DYLOAD 1
+#endif
+
+/**
+ * \def U_CHECK_DYLOAD
+ * Whether to test Dynamic loading as an OS capability.
+ * @internal
+ */
+#ifndef U_CHECK_DYLOAD
+#define U_CHECK_DYLOAD 1
+#endif
+
+
+/**
+ * \def U_DEFAULT_SHOW_DRAFT
+ * Do we allow ICU users to use the draft APIs by default?
+ * @internal
+ */
+#ifndef U_DEFAULT_SHOW_DRAFT
+#define U_DEFAULT_SHOW_DRAFT 1
+#endif
+
+/*===========================================================================*/
+/* Custom icu entry point renaming                                           */
+/*===========================================================================*/
+
+/**
+ * \def U_HAVE_LIB_SUFFIX
+ * 1 if a custom library suffix is set.
+ * @internal
+ */
+#ifdef U_HAVE_LIB_SUFFIX
+    /* Use the predefined value. */
+#elif defined(U_LIB_SUFFIX_C_NAME)
+#   define U_HAVE_LIB_SUFFIX 1
+#endif
+
+/**
+ * \def U_LIB_SUFFIX_C_NAME_STRING
+ * Defines the library suffix as a string with C syntax.
+ * @internal
+ */
+#ifdef U_LIB_SUFFIX_C_NAME_STRING
+    /* Use the predefined value. */
+#elif defined(U_LIB_SUFFIX_C_NAME)
+#   define U_LIB_SUFFIX_C_NAME_STRING #U_LIB_SUFFIX_C_NAME
+#else
+#   define U_LIB_SUFFIX_C_NAME_STRING ""
+#endif
+
+/* common/i18n library switches --------------------------------------------- */
+
+/**
+ * \def UCONFIG_ONLY_COLLATION
+ * This switch turns off modules that are not needed for collation.
+ *
+ * It does not turn off legacy conversion because that is necessary
+ * for ICU to work on EBCDIC platforms (for the default converter).
+ * If you want "only collation" and do not build for EBCDIC,
+ * then you can define UCONFIG_NO_LEGACY_CONVERSION 1 as well.
+ *
+ * @stable ICU 2.4
+ */
+#ifndef UCONFIG_ONLY_COLLATION
+#   define UCONFIG_ONLY_COLLATION 0
+#endif
+
+#if UCONFIG_ONLY_COLLATION
+    /* common library */
+#   define UCONFIG_NO_BREAK_ITERATION 1
+#   define UCONFIG_NO_IDNA 1
+
+    /* i18n library */
+#   if UCONFIG_NO_COLLATION
+#       error Contradictory collation switches in uconfig.h.
+#   endif
+#   define UCONFIG_NO_FORMATTING 1
+#   define UCONFIG_NO_TRANSLITERATION 1
+#   define UCONFIG_NO_REGULAR_EXPRESSIONS 1
+#endif
+
+/* common library switches -------------------------------------------------- */
+
+/**
+ * \def UCONFIG_NO_FILE_IO
+ * This switch turns off all file access in the common library
+ * where file access is only used for data loading.
+ * ICU data must then be provided in the form of a data DLL (or with an
+ * equivalent way to link to the data residing in an executable,
+ * as in building a combined library with both the common library's code and
+ * the data), or via udata_setCommonData().
+ * Application data must be provided via udata_setAppData() or by using
+ * "open" functions that take pointers to data, for example ucol_openBinary().
+ *
+ * File access is not used at all in the i18n library.
+ *
+ * File access cannot be turned off for the icuio library or for the ICU
+ * test suites and ICU tools.
+ *
+ * @stable ICU 3.6
+ */
+#ifndef UCONFIG_NO_FILE_IO
+#   define UCONFIG_NO_FILE_IO 0
+#endif
+
+/**
+ * \def UCONFIG_NO_CONVERSION
+ * ICU will not completely build with this switch turned on.
+ * This switch turns off all converters.
+ *
+ * You may want to use this together with U_CHARSET_IS_UTF8 defined to 1
+ * in utypes.h if char* strings in your environment are always in UTF-8.
+ *
+ * @stable ICU 3.2
+ * @see U_CHARSET_IS_UTF8
+ */
+#ifndef UCONFIG_NO_CONVERSION
+#   define UCONFIG_NO_CONVERSION 0
+#endif
+
+#if UCONFIG_NO_CONVERSION
+#   define UCONFIG_NO_LEGACY_CONVERSION 1
+#endif
+
+/**
+ * \def UCONFIG_NO_LEGACY_CONVERSION
+ * This switch turns off all converters except for
+ * - Unicode charsets (UTF-7/8/16/32, CESU-8, SCSU, BOCU-1)
+ * - US-ASCII
+ * - ISO-8859-1
+ *
+ * Turning off legacy conversion is not possible on EBCDIC platforms
+ * because they need ibm-37 or ibm-1047 default converters.
+ *
+ * @stable ICU 2.4
+ */
+#ifndef UCONFIG_NO_LEGACY_CONVERSION
+#   define UCONFIG_NO_LEGACY_CONVERSION 0
+#endif
+
+/**
+ * \def UCONFIG_NO_NORMALIZATION
+ * This switch turns off normalization.
+ * It implies turning off several other services as well, for example
+ * collation and IDNA.
+ *
+ * @stable ICU 2.6
+ */
+#ifndef UCONFIG_NO_NORMALIZATION
+#   define UCONFIG_NO_NORMALIZATION 0
+#elif UCONFIG_NO_NORMALIZATION
+    /* common library */
+    /* ICU 50 CJK dictionary BreakIterator uses normalization */
+#   define UCONFIG_NO_BREAK_ITERATION 1
+    /* IDNA (UTS #46) is implemented via normalization */
+#   define UCONFIG_NO_IDNA 1
+
+    /* i18n library */
+#   if UCONFIG_ONLY_COLLATION
+#       error Contradictory collation switches in uconfig.h.
+#   endif
+#   define UCONFIG_NO_COLLATION 1
+#   define UCONFIG_NO_TRANSLITERATION 1
+#endif
+
+/**
+ * \def UCONFIG_NO_BREAK_ITERATION
+ * This switch turns off break iteration.
+ *
+ * @stable ICU 2.4
+ */
+#ifndef UCONFIG_NO_BREAK_ITERATION
+#   define UCONFIG_NO_BREAK_ITERATION 0
+#endif
+
+/**
+ * \def UCONFIG_NO_IDNA
+ * This switch turns off IDNA.
+ *
+ * @stable ICU 2.6
+ */
+#ifndef UCONFIG_NO_IDNA
+#   define UCONFIG_NO_IDNA 0
+#endif
+
+/**
+ * \def UCONFIG_MSGPAT_DEFAULT_APOSTROPHE_MODE
+ * Determines the default UMessagePatternApostropheMode.
+ * See the documentation for that enum.
+ *
+ * @stable ICU 4.8
+ */
+#ifndef UCONFIG_MSGPAT_DEFAULT_APOSTROPHE_MODE
+#   define UCONFIG_MSGPAT_DEFAULT_APOSTROPHE_MODE UMSGPAT_APOS_DOUBLE_OPTIONAL
+#endif
+
+/* i18n library switches ---------------------------------------------------- */
+
+/**
+ * \def UCONFIG_NO_COLLATION
+ * This switch turns off collation and collation-based string search.
+ *
+ * @stable ICU 2.4
+ */
+#ifndef UCONFIG_NO_COLLATION
+#   define UCONFIG_NO_COLLATION 0
+#endif
+
+/**
+ * \def UCONFIG_NO_FORMATTING
+ * This switch turns off formatting and calendar/timezone services.
+ *
+ * @stable ICU 2.4
+ */
+#ifndef UCONFIG_NO_FORMATTING
+#   define UCONFIG_NO_FORMATTING 0
+#endif
+
+/**
+ * \def UCONFIG_NO_TRANSLITERATION
+ * This switch turns off transliteration.
+ *
+ * @stable ICU 2.4
+ */
+#ifndef UCONFIG_NO_TRANSLITERATION
+#   define UCONFIG_NO_TRANSLITERATION 0
+#endif
+
+/**
+ * \def UCONFIG_NO_REGULAR_EXPRESSIONS
+ * This switch turns off regular expressions.
+ *
+ * @stable ICU 2.4
+ */
+#ifndef UCONFIG_NO_REGULAR_EXPRESSIONS
+#   define UCONFIG_NO_REGULAR_EXPRESSIONS 0
+#endif
+
+/**
+ * \def UCONFIG_NO_SERVICE
+ * This switch turns off service registration.
+ *
+ * @stable ICU 3.2
+ */
+#ifndef UCONFIG_NO_SERVICE
+#   define UCONFIG_NO_SERVICE 1
+#endif
+
+/**
+ * \def UCONFIG_HAVE_PARSEALLINPUT
+ * This switch turns on the "parse all input" attribute. Binary incompatible.
+ *
+ * @internal
+ */
+#ifndef UCONFIG_HAVE_PARSEALLINPUT
+#   define UCONFIG_HAVE_PARSEALLINPUT 1
+#endif
+
+
+/**
+ * \def UCONFIG_FORMAT_FASTPATHS_49
+ * This switch turns on other formatting fastpaths. Binary incompatible in object DecimalFormat and DecimalFormatSymbols
+ *
+ * @internal
+ */
+#ifndef UCONFIG_FORMAT_FASTPATHS_49
+#   define UCONFIG_FORMAT_FASTPATHS_49 1
+#endif
+
+#endif
diff --git a/icu/unicode/ucurr.h b/icu/unicode/ucurr.h
new file mode 100644
index 0000000..2769813
--- /dev/null
+++ b/icu/unicode/ucurr.h
@@ -0,0 +1,360 @@
+/*
+**********************************************************************
+* Copyright (c) 2002-2013, International Business Machines
+* Corporation and others.  All Rights Reserved.
+**********************************************************************
+*/
+#ifndef _UCURR_H_
+#define _UCURR_H_
+
+#include "unicode/utypes.h"
+#include "unicode/uenum.h"
+
+/**
+ * \file 
+ * \brief C API: Encapsulates information about a currency.
+ */
+
+#if !UCONFIG_NO_FORMATTING
+
+/**
+ * The ucurr API encapsulates information about a currency, as defined by
+ * ISO 4217.  A currency is represented by a 3-character string
+ * containing its ISO 4217 code.  This API can return various data
+ * necessary the proper display of a currency:
+ *
+ * <ul><li>A display symbol, for a specific locale
+ * <li>The number of fraction digits to display
+ * <li>A rounding increment
+ * </ul>
+ *
+ * The <tt>DecimalFormat</tt> class uses these data to display
+ * currencies.
+ * @author Alan Liu
+ * @since ICU 2.2
+ */
+
+/**
+ * Finds a currency code for the given locale.
+ * @param locale the locale for which to retrieve a currency code. 
+ *               Currency can be specified by the "currency" keyword
+ *               in which case it overrides the default currency code
+ * @param buff   fill in buffer. Can be NULL for preflighting.
+ * @param buffCapacity capacity of the fill in buffer. Can be 0 for
+ *               preflighting. If it is non-zero, the buff parameter
+ *               must not be NULL.
+ * @param ec error code
+ * @return length of the currency string. It should always be 3. If 0,
+ *                currency couldn't be found or the input values are 
+ *                invalid. 
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2
+ucurr_forLocale(const char* locale,
+                UChar* buff,
+                int32_t buffCapacity,
+                UErrorCode* ec);
+
+/**
+ * Selector constants for ucurr_getName().
+ *
+ * @see ucurr_getName
+ * @stable ICU 2.6
+ */
+typedef enum UCurrNameStyle {
+    /**
+     * Selector for ucurr_getName indicating a symbolic name for a
+     * currency, such as "$" for USD.
+     * @stable ICU 2.6
+     */
+    UCURR_SYMBOL_NAME,
+
+    /**
+     * Selector for ucurr_getName indicating the long name for a
+     * currency, such as "US Dollar" for USD.
+     * @stable ICU 2.6
+     */
+    UCURR_LONG_NAME
+} UCurrNameStyle;
+
+#if !UCONFIG_NO_SERVICE
+/**
+ * @stable ICU 2.6
+ */
+typedef const void* UCurrRegistryKey;
+
+/**
+ * Register an (existing) ISO 4217 currency code for the given locale.
+ * Only the country code and the two variants EURO and PRE_EURO are
+ * recognized.
+ * @param isoCode the three-letter ISO 4217 currency code
+ * @param locale  the locale for which to register this currency code
+ * @param status the in/out status code
+ * @return a registry key that can be used to unregister this currency code, or NULL
+ * if there was an error.
+ * @stable ICU 2.6
+ */
+U_STABLE UCurrRegistryKey U_EXPORT2
+ucurr_register(const UChar* isoCode, 
+                   const char* locale,  
+                   UErrorCode* status);
+/**
+ * Unregister the previously-registered currency definitions using the
+ * URegistryKey returned from ucurr_register.  Key becomes invalid after
+ * a successful call and should not be used again.  Any currency 
+ * that might have been hidden by the original ucurr_register call is 
+ * restored.
+ * @param key the registry key returned by a previous call to ucurr_register
+ * @param status the in/out status code, no special meanings are assigned
+ * @return TRUE if the currency for this key was successfully unregistered
+ * @stable ICU 2.6
+ */
+U_STABLE UBool U_EXPORT2
+ucurr_unregister(UCurrRegistryKey key, UErrorCode* status);
+#endif /* UCONFIG_NO_SERVICE */
+
+/**
+ * Returns the display name for the given currency in the
+ * given locale.  For example, the display name for the USD
+ * currency object in the en_US locale is "$".
+ * @param currency null-terminated 3-letter ISO 4217 code
+ * @param locale locale in which to display currency
+ * @param nameStyle selector for which kind of name to return
+ * @param isChoiceFormat fill-in set to TRUE if the returned value
+ * is a ChoiceFormat pattern; otherwise it is a static string
+ * @param len fill-in parameter to receive length of result
+ * @param ec error code
+ * @return pointer to display string of 'len' UChars.  If the resource
+ * data contains no entry for 'currency', then 'currency' itself is
+ * returned.  If *isChoiceFormat is TRUE, then the result is a
+ * ChoiceFormat pattern.  Otherwise it is a static string.
+ * @stable ICU 2.6
+ */
+U_STABLE const UChar* U_EXPORT2
+ucurr_getName(const UChar* currency,
+              const char* locale,
+              UCurrNameStyle nameStyle,
+              UBool* isChoiceFormat,
+              int32_t* len,
+              UErrorCode* ec);
+
+/**
+ * Returns the plural name for the given currency in the
+ * given locale.  For example, the plural name for the USD
+ * currency object in the en_US locale is "US dollar" or "US dollars".
+ * @param currency null-terminated 3-letter ISO 4217 code
+ * @param locale locale in which to display currency
+ * @param isChoiceFormat fill-in set to TRUE if the returned value
+ * is a ChoiceFormat pattern; otherwise it is a static string
+ * @param pluralCount plural count
+ * @param len fill-in parameter to receive length of result
+ * @param ec error code
+ * @return pointer to display string of 'len' UChars.  If the resource
+ * data contains no entry for 'currency', then 'currency' itself is
+ * returned.  
+ * @stable ICU 4.2
+ */
+U_STABLE const UChar* U_EXPORT2
+ucurr_getPluralName(const UChar* currency,
+                    const char* locale,
+                    UBool* isChoiceFormat,
+                    const char* pluralCount,
+                    int32_t* len,
+                    UErrorCode* ec);
+
+/**
+ * Returns the number of the number of fraction digits that should
+ * be displayed for the given currency.
+ * @param currency null-terminated 3-letter ISO 4217 code
+ * @param ec input-output error code
+ * @return a non-negative number of fraction digits to be
+ * displayed, or 0 if there is an error
+ * @stable ICU 3.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucurr_getDefaultFractionDigits(const UChar* currency,
+                               UErrorCode* ec);
+
+/**
+ * Returns the rounding increment for the given currency, or 0.0 if no
+ * rounding is done by the currency.
+ * @param currency null-terminated 3-letter ISO 4217 code
+ * @param ec input-output error code
+ * @return the non-negative rounding increment, or 0.0 if none,
+ * or 0.0 if there is an error
+ * @stable ICU 3.0
+ */
+U_STABLE double U_EXPORT2
+ucurr_getRoundingIncrement(const UChar* currency,
+                           UErrorCode* ec);
+
+/**
+ * Selector constants for ucurr_openCurrencies().
+ *
+ * @see ucurr_openCurrencies
+ * @stable ICU 3.2
+ */
+typedef enum UCurrCurrencyType {
+    /**
+     * Select all ISO-4217 currency codes.
+     * @stable ICU 3.2
+     */
+    UCURR_ALL = INT32_MAX,
+    /**
+     * Select only ISO-4217 commonly used currency codes.
+     * These currencies can be found in common use, and they usually have
+     * bank notes or coins associated with the currency code.
+     * This does not include fund codes, precious metals and other
+     * various ISO-4217 codes limited to special financial products.
+     * @stable ICU 3.2
+     */
+    UCURR_COMMON = 1,
+    /**
+     * Select ISO-4217 uncommon currency codes.
+     * These codes respresent fund codes, precious metals and other
+     * various ISO-4217 codes limited to special financial products.
+     * A fund code is a monetary resource associated with a currency.
+     * @stable ICU 3.2
+     */
+    UCURR_UNCOMMON = 2,
+    /**
+     * Select only deprecated ISO-4217 codes.
+     * These codes are no longer in general public use.
+     * @stable ICU 3.2
+     */
+    UCURR_DEPRECATED = 4,
+    /**
+     * Select only non-deprecated ISO-4217 codes.
+     * These codes are in general public use.
+     * @stable ICU 3.2
+     */
+    UCURR_NON_DEPRECATED = 8
+} UCurrCurrencyType;
+
+/**
+ * Provides a UEnumeration object for listing ISO-4217 codes.
+ * @param currType You can use one of several UCurrCurrencyType values for this
+ *      variable. You can also | (or) them together to get a specific list of
+ *      currencies. Most people will want to use the (UCURR_CURRENCY|UCURR_NON_DEPRECATED) value to
+ *      get a list of current currencies.
+ * @param pErrorCode Error code
+ * @stable ICU 3.2
+ */
+U_STABLE UEnumeration * U_EXPORT2
+ucurr_openISOCurrencies(uint32_t currType, UErrorCode *pErrorCode);
+
+/**
+  * Queries if the given ISO 4217 3-letter code is available on the specified date range. 
+  * 
+  * Note: For checking availability of a currency on a specific date, specify the date on both 'from' and 'to' 
+  * 
+  * When 'from' is U_DATE_MIN and 'to' is U_DATE_MAX, this method checks if the specified currency is available any time. 
+  * If 'from' and 'to' are same UDate value, this method checks if the specified currency is available on that date.
+  * 
+  * @param isoCode 
+  *            The ISO 4217 3-letter code. 
+  * 
+  * @param from 
+  *            The lower bound of the date range, inclusive. When 'from' is U_DATE_MIN, check the availability 
+  *            of the currency any date before 'to' 
+  * 
+  * @param to 
+  *            The upper bound of the date range, inclusive. When 'to' is U_DATE_MAX, check the availability of 
+  *            the currency any date after 'from' 
+  * 
+  * @param errorCode 
+  *            ICU error code 
+   * 
+  * @return TRUE if the given ISO 4217 3-letter code is supported on the specified date range. 
+  * 
+  * @stable ICU 4.8 
+  */ 
+U_STABLE UBool U_EXPORT2
+ucurr_isAvailable(const UChar* isoCode, 
+             UDate from, 
+             UDate to, 
+             UErrorCode* errorCode);
+
+/** 
+ * Finds the number of valid currency codes for the
+ * given locale and date.
+ * @param locale the locale for which to retrieve the
+ *               currency count.
+ * @param date   the date for which to retrieve the
+ *               currency count for the given locale.
+ * @param ec     error code
+ * @return       the number of currency codes for the
+ *               given locale and date.  If 0, currency
+ *               codes couldn't be found for the input
+ *               values are invalid.
+ * @stable ICU 4.0
+ */
+U_STABLE int32_t U_EXPORT2
+ucurr_countCurrencies(const char* locale, 
+                 UDate date, 
+                 UErrorCode* ec); 
+
+/** 
+ * Finds a currency code for the given locale and date 
+ * @param locale the locale for which to retrieve a currency code.  
+ *               Currency can be specified by the "currency" keyword 
+ *               in which case it overrides the default currency code 
+ * @param date   the date for which to retrieve a currency code for 
+ *               the given locale. 
+ * @param index  the index within the available list of currency codes
+ *               for the given locale on the given date.
+ * @param buff   fill in buffer. Can be NULL for preflighting. 
+ * @param buffCapacity capacity of the fill in buffer. Can be 0 for 
+ *               preflighting. If it is non-zero, the buff parameter 
+ *               must not be NULL. 
+ * @param ec     error code 
+ * @return       length of the currency string. It should always be 3. 
+ *               If 0, currency couldn't be found or the input values are  
+ *               invalid.  
+ * @stable ICU 4.0 
+ */ 
+U_STABLE int32_t U_EXPORT2 
+ucurr_forLocaleAndDate(const char* locale, 
+                UDate date, 
+                int32_t index,
+                UChar* buff, 
+                int32_t buffCapacity, 
+                UErrorCode* ec); 
+
+/**
+ * Given a key and a locale, returns an array of string values in a preferred
+ * order that would make a difference. These are all and only those values where
+ * the open (creation) of the service with the locale formed from the input locale
+ * plus input keyword and that value has different behavior than creation with the
+ * input locale alone.
+ * @param key           one of the keys supported by this service.  For now, only
+ *                      "currency" is supported.
+ * @param locale        the locale
+ * @param commonlyUsed  if set to true it will return only commonly used values
+ *                      with the given locale in preferred order.  Otherwise,
+ *                      it will return all the available values for the locale.
+ * @param status error status
+ * @return a string enumeration over keyword values for the given key and the locale.
+ * @stable ICU 4.2
+ */
+U_STABLE UEnumeration* U_EXPORT2
+ucurr_getKeywordValuesForLocale(const char* key,
+                                const char* locale,
+                                UBool commonlyUsed,
+                                UErrorCode* status);
+
+/**
+ * Returns the ISO 4217 numeric code for the currency.
+ * <p>Note: If the ISO 4217 numeric code is not assigned for the currency or
+ * the currency is unknown, this function returns 0.
+ *
+ * @param currency null-terminated 3-letter ISO 4217 code
+ * @return The ISO 4217 numeric code of the currency
+ * @stable ICU 49
+ */
+U_STABLE int32_t U_EXPORT2
+ucurr_getNumericCode(const UChar* currency);
+
+#endif /* #if !UCONFIG_NO_FORMATTING */
+
+#endif
diff --git a/icu/unicode/udat.h b/icu/unicode/udat.h
new file mode 100644
index 0000000..6ad4380
--- /dev/null
+++ b/icu/unicode/udat.h
@@ -0,0 +1,1433 @@
+/*
+ *******************************************************************************
+ * Copyright (C) 1996-2013, International Business Machines
+ * Corporation and others. All Rights Reserved.
+ *******************************************************************************
+*/
+
+#ifndef UDAT_H
+#define UDAT_H
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_FORMATTING
+
+#include "unicode/localpointer.h"
+#include "unicode/ucal.h"
+#include "unicode/unum.h"
+#include "unicode/udisplaycontext.h"
+/**
+ * \file
+ * \brief C API: DateFormat
+ *
+ * <h2> Date Format C API</h2>
+ *
+ * Date Format C API  consists of functions that convert dates and
+ * times from their internal representations to textual form and back again in a
+ * language-independent manner. Converting from the internal representation (milliseconds
+ * since midnight, January 1, 1970) to text is known as "formatting," and converting
+ * from text to millis is known as "parsing."  We currently define only one concrete
+ * structure UDateFormat, which can handle pretty much all normal
+ * date formatting and parsing actions.
+ * <P>
+ * Date Format helps you to format and parse dates for any locale. Your code can
+ * be completely independent of the locale conventions for months, days of the
+ * week, or even the calendar format: lunar vs. solar.
+ * <P>
+ * To format a date for the current Locale with default time and date style,
+ * use one of the static factory methods:
+ * <pre>
+ * \code
+ *  UErrorCode status = U_ZERO_ERROR;
+ *  UChar *myString;
+ *  int32_t myStrlen = 0;
+ *  UDateFormat* dfmt = udat_open(UDAT_DEFAULT, UDAT_DEFAULT, NULL, NULL, -1, NULL, -1, &status);
+ *  myStrlen = udat_format(dfmt, myDate, NULL, myStrlen, NULL, &status);
+ *  if (status==U_BUFFER_OVERFLOW_ERROR){
+ *      status=U_ZERO_ERROR;
+ *      myString=(UChar*)malloc(sizeof(UChar) * (myStrlen+1) );
+ *      udat_format(dfmt, myDate, myString, myStrlen+1, NULL, &status);
+ *  }
+ * \endcode
+ * </pre>
+ * If you are formatting multiple numbers, it is more efficient to get the
+ * format and use it multiple times so that the system doesn't have to fetch the
+ * information about the local language and country conventions multiple times.
+ * <pre>
+ * \code
+ *  UErrorCode status = U_ZERO_ERROR;
+ *  int32_t i, myStrlen = 0;
+ *  UChar* myString;
+ *  char buffer[1024];
+ *  UDate myDateArr[] = { 0.0, 100000000.0, 2000000000.0 }; // test values
+ *  UDateFormat* df = udat_open(UDAT_DEFAULT, UDAT_DEFAULT, NULL, NULL, -1, NULL, 0, &status);
+ *  for (i = 0; i < 3; i++) {
+ *      myStrlen = udat_format(df, myDateArr[i], NULL, myStrlen, NULL, &status);
+ *      if(status == U_BUFFER_OVERFLOW_ERROR){
+ *          status = U_ZERO_ERROR;
+ *          myString = (UChar*)malloc(sizeof(UChar) * (myStrlen+1) );
+ *          udat_format(df, myDateArr[i], myString, myStrlen+1, NULL, &status);
+ *          printf("%s\n", u_austrcpy(buffer, myString) );
+ *          free(myString);
+ *      }
+ *  }
+ * \endcode
+ * </pre>
+ * To get specific fields of a date, you can use UFieldPosition to
+ * get specific fields.
+ * <pre>
+ * \code
+ *  UErrorCode status = U_ZERO_ERROR;
+ *  UFieldPosition pos;
+ *  UChar *myString;
+ *  int32_t myStrlen = 0;
+ *  char buffer[1024];
+ *
+ *  pos.field = 1;  // Same as the DateFormat::EField enum
+ *  UDateFormat* dfmt = udat_open(UDAT_DEFAULT, UDAT_DEFAULT, NULL, -1, NULL, 0, &status);
+ *  myStrlen = udat_format(dfmt, myDate, NULL, myStrlen, &pos, &status);
+ *  if (status==U_BUFFER_OVERFLOW_ERROR){
+ *      status=U_ZERO_ERROR;
+ *      myString=(UChar*)malloc(sizeof(UChar) * (myStrlen+1) );
+ *      udat_format(dfmt, myDate, myString, myStrlen+1, &pos, &status);
+ *  }
+ *  printf("date format: %s\n", u_austrcpy(buffer, myString));
+ *  buffer[pos.endIndex] = 0;   // NULL terminate the string.
+ *  printf("UFieldPosition position equals %s\n", &buffer[pos.beginIndex]);
+ * \endcode
+ * </pre>
+ * To format a date for a different Locale, specify it in the call to
+ * udat_open()
+ * <pre>
+ * \code
+ *        UDateFormat* df = udat_open(UDAT_SHORT, UDAT_SHORT, "fr_FR", NULL, -1, NULL, 0, &status);
+ * \endcode
+ * </pre>
+ * You can use a DateFormat API udat_parse() to parse.
+ * <pre>
+ * \code
+ *  UErrorCode status = U_ZERO_ERROR;
+ *  int32_t parsepos=0;
+ *  UDate myDate = udat_parse(df, myString, u_strlen(myString), &parsepos, &status);
+ * \endcode
+ * </pre>
+ *  You can pass in different options for the arguments for date and time style
+ *  to control the length of the result; from SHORT to MEDIUM to LONG to FULL.
+ *  The exact result depends on the locale, but generally:
+ *  see UDateFormatStyle for more details
+ * <ul type=round>
+ *   <li>   UDAT_SHORT is completely numeric, such as 12/13/52 or 3:30pm
+ *   <li>   UDAT_MEDIUM is longer, such as Jan 12, 1952
+ *   <li>   UDAT_LONG is longer, such as January 12, 1952 or 3:30:32pm
+ *   <li>   UDAT_FULL is pretty completely specified, such as
+ *          Tuesday, April 12, 1952 AD or 3:30:42pm PST.
+ * </ul>
+ * You can also set the time zone on the format if you wish.
+ * <P>
+ * You can also use forms of the parse and format methods with Parse Position and
+ * UFieldPosition to allow you to
+ * <ul type=round>
+ *   <li>   Progressively parse through pieces of a string.
+ *   <li>   Align any particular field, or find out where it is for selection
+ *          on the screen.
+ * </ul>
+ * <p><strong>Date and Time Patterns:</strong></p>
+ *
+ * <p>Date and time formats are specified by <em>date and time pattern</em> strings.
+ * Within date and time pattern strings, all unquoted ASCII letters [A-Za-z] are reserved
+ * as pattern letters representing calendar fields. <code>UDateFormat</code> supports
+ * the date and time formatting algorithm and pattern letters defined by
+ * <a href="http://www.unicode.org/reports/tr35/tr35-dates.html#Date_Field_Symbol_Table">UTS#35
+ * Unicode Locale Data Markup Language (LDML)</a> and further documented for ICU in the
+ * <a href="https://sites.google.com/site/icuprojectuserguide/formatparse/datetime?pli=1#TOC-Date-Field-Symbol-Table">ICU
+ * User Guide</a>.</p>
+ */
+
+/** A date formatter.
+ *  For usage in C programs.
+ *  @stable ICU 2.6
+ */
+typedef void* UDateFormat;
+
+/** The possible date/time format styles 
+ *  @stable ICU 2.6
+ */
+typedef enum UDateFormatStyle {
+    /** Full style */
+    UDAT_FULL,
+    /** Long style */
+    UDAT_LONG,
+    /** Medium style */
+    UDAT_MEDIUM,
+    /** Short style */
+    UDAT_SHORT,
+    /** Default style */
+    UDAT_DEFAULT = UDAT_MEDIUM,
+
+    /** Bitfield for relative date */
+    UDAT_RELATIVE = (1 << 7),
+    
+    UDAT_FULL_RELATIVE = UDAT_FULL | UDAT_RELATIVE,
+        
+    UDAT_LONG_RELATIVE = UDAT_LONG | UDAT_RELATIVE,
+    
+    UDAT_MEDIUM_RELATIVE = UDAT_MEDIUM | UDAT_RELATIVE,
+    
+    UDAT_SHORT_RELATIVE = UDAT_SHORT | UDAT_RELATIVE,
+    
+    
+    /** No style */
+    UDAT_NONE = -1,
+
+    /**
+     * Use the pattern given in the parameter to udat_open
+     * @see udat_open
+     * @stable ICU 50
+     */
+    UDAT_PATTERN = -2,
+
+    /** @internal alias to UDAT_PATTERN */
+    UDAT_IGNORE = UDAT_PATTERN
+} UDateFormatStyle;
+
+/* Skeletons for dates. */
+
+/**
+ * Constant for date skeleton with year.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR                       "y"
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Constant for date skeleton with quarter.
+ * @draft ICU 51
+ */
+#define UDAT_QUARTER                    "QQQQ"
+/**
+ * Constant for date skeleton with abbreviated quarter.
+ * @draft ICU 51
+ */
+#define UDAT_ABBR_QUARTER               "QQQ"
+#endif  /* U_HIDE_DRAFT_API */
+/**
+ * Constant for date skeleton with year and quarter.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_QUARTER               "yQQQQ"
+/**
+ * Constant for date skeleton with year and abbreviated quarter.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_ABBR_QUARTER          "yQQQ"
+/**
+ * Constant for date skeleton with month.
+ * @stable ICU 4.0
+ */
+#define UDAT_MONTH                      "MMMM"
+/**
+ * Constant for date skeleton with abbreviated month.
+ * @stable ICU 4.0
+ */
+#define UDAT_ABBR_MONTH                 "MMM"
+/**
+ * Constant for date skeleton with numeric month.
+ * @stable ICU 4.0
+ */
+#define UDAT_NUM_MONTH                  "M"
+/**
+ * Constant for date skeleton with year and month.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_MONTH                 "yMMMM"
+/**
+ * Constant for date skeleton with year and abbreviated month.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_ABBR_MONTH            "yMMM"
+/**
+ * Constant for date skeleton with year and numeric month.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_NUM_MONTH             "yM"
+/**
+ * Constant for date skeleton with day.
+ * @stable ICU 4.0
+ */
+#define UDAT_DAY                        "d"
+/**
+ * Constant for date skeleton with year, month, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_MONTH_DAY             "yMMMMd"
+/**
+ * Constant for date skeleton with year, abbreviated month, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_ABBR_MONTH_DAY        "yMMMd"
+/**
+ * Constant for date skeleton with year, numeric month, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_NUM_MONTH_DAY         "yMd"
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Constant for date skeleton with weekday.
+ * @draft ICU 51
+ */
+#define UDAT_WEEKDAY                    "EEEE"
+/**
+ * Constant for date skeleton with abbreviated weekday.
+ * @draft ICU 51
+ */
+#define UDAT_ABBR_WEEKDAY               "E"
+#endif  /* U_HIDE_DRAFT_API */
+/**
+ * Constant for date skeleton with year, month, weekday, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_MONTH_WEEKDAY_DAY     "yMMMMEEEEd"
+/**
+ * Constant for date skeleton with year, abbreviated month, weekday, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_ABBR_MONTH_WEEKDAY_DAY "yMMMEd" 
+/**
+ * Constant for date skeleton with year, numeric month, weekday, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_YEAR_NUM_MONTH_WEEKDAY_DAY "yMEd"
+/**
+ * Constant for date skeleton with long month and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_MONTH_DAY                  "MMMMd"
+/**
+ * Constant for date skeleton with abbreviated month and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_ABBR_MONTH_DAY             "MMMd"
+/**
+ * Constant for date skeleton with numeric month and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_NUM_MONTH_DAY              "Md"
+/**
+ * Constant for date skeleton with month, weekday, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_MONTH_WEEKDAY_DAY          "MMMMEEEEd"
+/**
+ * Constant for date skeleton with abbreviated month, weekday, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_ABBR_MONTH_WEEKDAY_DAY     "MMMEd"
+/**
+ * Constant for date skeleton with numeric month, weekday, and day.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_NUM_MONTH_WEEKDAY_DAY      "MEd"
+
+/* Skeletons for times. */
+
+/**
+ * Constant for date skeleton with hour, with the locale's preferred hour format (12 or 24).
+ * @stable ICU 4.0
+ */
+#define UDAT_HOUR                       "j"
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Constant for date skeleton with hour in 24-hour presentation.
+ * @draft ICU 51
+ */
+#define UDAT_HOUR24                     "H"
+/**
+ * Constant for date skeleton with minute.
+ * @draft ICU 51
+ */
+#define UDAT_MINUTE                     "m"
+#endif  /* U_HIDE_DRAFT_API */
+/**
+ * Constant for date skeleton with hour and minute, with the locale's preferred hour format (12 or 24).
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_HOUR_MINUTE                "jm"
+/**
+ * Constant for date skeleton with hour and minute in 24-hour presentation.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_HOUR24_MINUTE              "Hm"
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Constant for date skeleton with second.
+ * @draft ICU 51
+ */
+#define UDAT_SECOND                     "s"
+#endif  /* U_HIDE_DRAFT_API */
+/**
+ * Constant for date skeleton with hour, minute, and second,
+ * with the locale's preferred hour format (12 or 24).
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_HOUR_MINUTE_SECOND         "jms"
+/**
+ * Constant for date skeleton with hour, minute, and second in
+ * 24-hour presentation.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_HOUR24_MINUTE_SECOND       "Hms"
+/**
+ * Constant for date skeleton with minute and second.
+ * Used in combinations date + time, date + time + zone, or time + zone.
+ * @stable ICU 4.0
+ */
+#define UDAT_MINUTE_SECOND              "ms"
+
+/* Skeletons for time zones. */
+
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Constant for <i>generic location format</i>, such as Los Angeles Time;
+ * used in combinations date + time + zone, or time + zone.
+ * @see <a href="http://unicode.org/reports/tr35/#Date_Format_Patterns">LDML Date Format Patterns</a>
+ * @see <a href="http://unicode.org/reports/tr35/#Time_Zone_Fallback">LDML Time Zone Fallback</a>
+ * @draft ICU 51
+ */
+#define UDAT_LOCATION_TZ "VVVV"
+/**
+ * Constant for <i>generic non-location format</i>, such as Pacific Time;
+ * used in combinations date + time + zone, or time + zone.
+ * @see <a href="http://unicode.org/reports/tr35/#Date_Format_Patterns">LDML Date Format Patterns</a>
+ * @see <a href="http://unicode.org/reports/tr35/#Time_Zone_Fallback">LDML Time Zone Fallback</a>
+ * @draft ICU 51
+ */
+#define UDAT_GENERIC_TZ "vvvv"
+/**
+ * Constant for <i>generic non-location format</i>, abbreviated if possible, such as PT;
+ * used in combinations date + time + zone, or time + zone.
+ * @see <a href="http://unicode.org/reports/tr35/#Date_Format_Patterns">LDML Date Format Patterns</a>
+ * @see <a href="http://unicode.org/reports/tr35/#Time_Zone_Fallback">LDML Time Zone Fallback</a>
+ * @draft ICU 51
+ */
+#define UDAT_ABBR_GENERIC_TZ "v"
+/**
+ * Constant for <i>specific non-location format</i>, such as Pacific Daylight Time;
+ * used in combinations date + time + zone, or time + zone.
+ * @see <a href="http://unicode.org/reports/tr35/#Date_Format_Patterns">LDML Date Format Patterns</a>
+ * @see <a href="http://unicode.org/reports/tr35/#Time_Zone_Fallback">LDML Time Zone Fallback</a>
+ * @draft ICU 51
+ */
+#define UDAT_SPECIFIC_TZ "zzzz"
+/**
+ * Constant for <i>specific non-location format</i>, abbreviated if possible, such as PDT;
+ * used in combinations date + time + zone, or time + zone.
+ * @see <a href="http://unicode.org/reports/tr35/#Date_Format_Patterns">LDML Date Format Patterns</a>
+ * @see <a href="http://unicode.org/reports/tr35/#Time_Zone_Fallback">LDML Time Zone Fallback</a>
+ * @draft ICU 51
+ */
+#define UDAT_ABBR_SPECIFIC_TZ "z"
+/**
+ * Constant for <i>localized GMT/UTC format</i>, such as GMT+8:00 or HPG-8:00;
+ * used in combinations date + time + zone, or time + zone.
+ * @see <a href="http://unicode.org/reports/tr35/#Date_Format_Patterns">LDML Date Format Patterns</a>
+ * @see <a href="http://unicode.org/reports/tr35/#Time_Zone_Fallback">LDML Time Zone Fallback</a>
+ * @draft ICU 51
+ */
+#define UDAT_ABBR_UTC_TZ "ZZZZ"
+#endif  /* U_HIDE_DRAFT_API */
+
+/* deprecated skeleton constants */
+
+#ifndef U_HIDE_DEPRECATED_API 
+/**
+ * Constant for date skeleton with standalone month.
+ * @deprecated ICU 50 Use UDAT_MONTH instead.
+ */
+#define UDAT_STANDALONE_MONTH           "LLLL"
+/**
+ * Constant for date skeleton with standalone abbreviated month.
+ * @deprecated ICU 50 Use UDAT_ABBR_MONTH instead.
+ */
+#define UDAT_ABBR_STANDALONE_MONTH      "LLL"
+
+/**
+ * Constant for date skeleton with hour, minute, and generic timezone.
+ * @deprecated ICU 50 Use instead UDAT_HOUR_MINUTE UDAT_ABBR_GENERIC_TZ or some other timezone presentation.
+ */
+#define UDAT_HOUR_MINUTE_GENERIC_TZ     "jmv"
+/**
+ * Constant for date skeleton with hour, minute, and timezone.
+ * @deprecated ICU 50 Use instead UDAT_HOUR_MINUTE UDAT_ABBR_SPECIFIC_TZ or some other timezone presentation.
+ */
+#define UDAT_HOUR_MINUTE_TZ             "jmz"
+/**
+ * Constant for date skeleton with hour and generic timezone.
+ * @deprecated ICU 50 Use instead UDAT_HOUR UDAT_ABBR_GENERIC_TZ or some other timezone presentation.
+ */
+#define UDAT_HOUR_GENERIC_TZ            "jv"
+/**
+ * Constant for date skeleton with hour and timezone.
+ * @deprecated ICU 50 Use instead UDAT_HOUR UDAT_ABBR_SPECIFIC_TZ or some other timezone presentation.
+ */
+#define UDAT_HOUR_TZ                    "jz"
+#endif  /* U_HIDE_DEPRECATED_API */
+
+/**
+ * FieldPosition and UFieldPosition selectors for format fields
+ * defined by DateFormat and UDateFormat.
+ * @stable ICU 3.0
+ */
+typedef enum UDateFormatField {
+    /**
+     * FieldPosition and UFieldPosition selector for 'G' field alignment,
+     * corresponding to the UCAL_ERA field.
+     * @stable ICU 3.0
+     */
+    UDAT_ERA_FIELD = 0,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'y' field alignment,
+     * corresponding to the UCAL_YEAR field.
+     * @stable ICU 3.0
+     */
+    UDAT_YEAR_FIELD = 1,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'M' field alignment,
+     * corresponding to the UCAL_MONTH field.
+     * @stable ICU 3.0
+     */
+    UDAT_MONTH_FIELD = 2,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'd' field alignment,
+     * corresponding to the UCAL_DATE field.
+     * @stable ICU 3.0
+     */
+    UDAT_DATE_FIELD = 3,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'k' field alignment,
+     * corresponding to the UCAL_HOUR_OF_DAY field.
+     * UDAT_HOUR_OF_DAY1_FIELD is used for the one-based 24-hour clock.
+     * For example, 23:59 + 01:00 results in 24:59.
+     * @stable ICU 3.0
+     */
+    UDAT_HOUR_OF_DAY1_FIELD = 4,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'H' field alignment,
+     * corresponding to the UCAL_HOUR_OF_DAY field.
+     * UDAT_HOUR_OF_DAY0_FIELD is used for the zero-based 24-hour clock.
+     * For example, 23:59 + 01:00 results in 00:59.
+     * @stable ICU 3.0
+     */
+    UDAT_HOUR_OF_DAY0_FIELD = 5,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'm' field alignment,
+     * corresponding to the UCAL_MINUTE field.
+     * @stable ICU 3.0
+     */
+    UDAT_MINUTE_FIELD = 6,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 's' field alignment,
+     * corresponding to the UCAL_SECOND field.
+     * @stable ICU 3.0
+     */
+    UDAT_SECOND_FIELD = 7,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'S' field alignment,
+     * corresponding to the UCAL_MILLISECOND field.
+     *
+     * Note: Time formats that use 'S' can display a maximum of three
+     * significant digits for fractional seconds, corresponding to millisecond
+     * resolution and a fractional seconds sub-pattern of SSS. If the
+     * sub-pattern is S or SS, the fractional seconds value will be truncated
+     * (not rounded) to the number of display places specified. If the
+     * fractional seconds sub-pattern is longer than SSS, the additional
+     * display places will be filled with zeros.
+     * @stable ICU 3.0
+     */
+    UDAT_FRACTIONAL_SECOND_FIELD = 8,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'E' field alignment,
+     * corresponding to the UCAL_DAY_OF_WEEK field.
+     * @stable ICU 3.0
+     */
+    UDAT_DAY_OF_WEEK_FIELD = 9,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'D' field alignment,
+     * corresponding to the UCAL_DAY_OF_YEAR field.
+     * @stable ICU 3.0
+     */
+    UDAT_DAY_OF_YEAR_FIELD = 10,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'F' field alignment,
+     * corresponding to the UCAL_DAY_OF_WEEK_IN_MONTH field.
+     * @stable ICU 3.0
+     */
+    UDAT_DAY_OF_WEEK_IN_MONTH_FIELD = 11,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'w' field alignment,
+     * corresponding to the UCAL_WEEK_OF_YEAR field.
+     * @stable ICU 3.0
+     */
+    UDAT_WEEK_OF_YEAR_FIELD = 12,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'W' field alignment,
+     * corresponding to the UCAL_WEEK_OF_MONTH field.
+     * @stable ICU 3.0
+     */
+    UDAT_WEEK_OF_MONTH_FIELD = 13,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'a' field alignment,
+     * corresponding to the UCAL_AM_PM field.
+     * @stable ICU 3.0
+     */
+    UDAT_AM_PM_FIELD = 14,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'h' field alignment,
+     * corresponding to the UCAL_HOUR field.
+     * UDAT_HOUR1_FIELD is used for the one-based 12-hour clock.
+     * For example, 11:30 PM + 1 hour results in 12:30 AM.
+     * @stable ICU 3.0
+     */
+    UDAT_HOUR1_FIELD = 15,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'K' field alignment,
+     * corresponding to the UCAL_HOUR field.
+     * UDAT_HOUR0_FIELD is used for the zero-based 12-hour clock.
+     * For example, 11:30 PM + 1 hour results in 00:30 AM.
+     * @stable ICU 3.0
+     */
+    UDAT_HOUR0_FIELD = 16,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'z' field alignment,
+     * corresponding to the UCAL_ZONE_OFFSET and
+     * UCAL_DST_OFFSET fields.
+     * @stable ICU 3.0
+     */
+    UDAT_TIMEZONE_FIELD = 17,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'Y' field alignment,
+     * corresponding to the UCAL_YEAR_WOY field.
+     * @stable ICU 3.0
+     */
+    UDAT_YEAR_WOY_FIELD = 18,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'e' field alignment,
+     * corresponding to the UCAL_DOW_LOCAL field.
+     * @stable ICU 3.0
+     */
+    UDAT_DOW_LOCAL_FIELD = 19,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'u' field alignment,
+     * corresponding to the UCAL_EXTENDED_YEAR field.
+     * @stable ICU 3.0
+     */
+    UDAT_EXTENDED_YEAR_FIELD = 20,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'g' field alignment,
+     * corresponding to the UCAL_JULIAN_DAY field.
+     * @stable ICU 3.0
+     */
+    UDAT_JULIAN_DAY_FIELD = 21,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'A' field alignment,
+     * corresponding to the UCAL_MILLISECONDS_IN_DAY field.
+     * @stable ICU 3.0
+     */
+    UDAT_MILLISECONDS_IN_DAY_FIELD = 22,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'Z' field alignment,
+     * corresponding to the UCAL_ZONE_OFFSET and
+     * UCAL_DST_OFFSET fields.
+     * @stable ICU 3.0
+     */
+    UDAT_TIMEZONE_RFC_FIELD = 23,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'v' field alignment,
+     * corresponding to the UCAL_ZONE_OFFSET field.
+     * @stable ICU 3.4
+     */
+    UDAT_TIMEZONE_GENERIC_FIELD = 24,
+    /**
+     * FieldPosition selector for 'c' field alignment,
+     * corresponding to the {@link #UCAL_DOW_LOCAL} field.
+     * This displays the stand alone day name, if available.
+     * @stable ICU 3.4
+     */
+    UDAT_STANDALONE_DAY_FIELD = 25,
+
+    /**
+     * FieldPosition selector for 'L' field alignment,
+     * corresponding to the {@link #UCAL_MONTH} field.
+     * This displays the stand alone month name, if available.
+     * @stable ICU 3.4
+     */
+    UDAT_STANDALONE_MONTH_FIELD = 26,
+
+    /**
+     * FieldPosition selector for "Q" field alignment,
+     * corresponding to quarters. This is implemented
+     * using the {@link #UCAL_MONTH} field. This
+     * displays the quarter.
+     * @stable ICU 3.6
+     */
+    UDAT_QUARTER_FIELD = 27,
+
+    /**
+     * FieldPosition selector for the "q" field alignment,
+     * corresponding to stand-alone quarters. This is
+     * implemented using the {@link #UCAL_MONTH} field.
+     * This displays the stand-alone quarter.
+     * @stable ICU 3.6
+     */
+    UDAT_STANDALONE_QUARTER_FIELD = 28,
+
+    /**
+     * FieldPosition and UFieldPosition selector for 'V' field alignment,
+     * corresponding to the UCAL_ZONE_OFFSET field.
+     * @stable ICU 3.8
+     */
+    UDAT_TIMEZONE_SPECIAL_FIELD = 29,
+
+    /**
+     * FieldPosition selector for "U" field alignment,
+     * corresponding to cyclic year names. This is implemented
+     * using the {@link #UCAL_YEAR} field. This displays
+     * the cyclic year name, if available.
+     * @stable ICU 49
+     */
+    UDAT_YEAR_NAME_FIELD = 30,
+
+#ifndef U_HIDE_DRAFT_API
+    /**
+     * FieldPosition selector for 'O' field alignment,
+     * corresponding to the UCAL_ZONE_OFFSET and UCAL_DST_OFFSETfields.
+     * This displays the localized GMT format.
+     * @draft ICU 51
+     */
+    UDAT_TIMEZONE_LOCALIZED_GMT_OFFSET_FIELD = 31,
+
+    /**
+     * FieldPosition selector for 'X' field alignment,
+     * corresponding to the UCAL_ZONE_OFFSET and UCAL_DST_OFFSETfields.
+     * This displays the ISO 8601 local time offset format or UTC indicator ("Z").
+     * @draft ICU 51
+     */
+    UDAT_TIMEZONE_ISO_FIELD = 32,
+
+    /**
+     * FieldPosition selector for 'x' field alignment,
+     * corresponding to the UCAL_ZONE_OFFSET and UCAL_DST_OFFSETfields.
+     * This displays the ISO 8601 local time offset format.
+     * @draft ICU 51
+     */
+    UDAT_TIMEZONE_ISO_LOCAL_FIELD = 33,
+#endif  /* U_HIDE_DRAFT_API */
+
+    /**
+     * Number of FieldPosition and UFieldPosition selectors for
+     * DateFormat and UDateFormat.
+     * Valid selectors range from 0 to UDAT_FIELD_COUNT-1.
+     * This value is subject to change if new fields are defined
+     * in the future.
+     * @stable ICU 3.0
+     */
+    UDAT_FIELD_COUNT = 34
+
+} UDateFormatField;
+
+
+/**
+ * Maps from a UDateFormatField to the corresponding UCalendarDateFields.
+ * Note: since the mapping is many-to-one, there is no inverse mapping.
+ * @param field the UDateFormatField.
+ * @return the UCalendarDateField.  This will be UCAL_FIELD_COUNT in case
+ * of error (e.g., the input field is UDAT_FIELD_COUNT).
+ * @stable ICU 4.4
+ */
+U_STABLE UCalendarDateFields U_EXPORT2
+udat_toCalendarDateField(UDateFormatField field);
+
+
+/**
+ * Open a new UDateFormat for formatting and parsing dates and times.
+ * A UDateFormat may be used to format dates in calls to {@link #udat_format },
+ * and to parse dates in calls to {@link #udat_parse }.
+ * @param timeStyle The style used to format times; one of UDAT_FULL, UDAT_LONG,
+ * UDAT_MEDIUM, UDAT_SHORT, UDAT_DEFAULT, or UDAT_NONE (relative time styles
+ * are not currently supported).
+ * When the pattern parameter is used, pass in UDAT_PATTERN for both timeStyle and dateStyle.
+ * @param dateStyle The style used to format dates; one of UDAT_FULL, UDAT_LONG,
+ * UDAT_MEDIUM, UDAT_SHORT, UDAT_DEFAULT, UDAT_FULL_RELATIVE, UDAT_LONG_RELATIVE,
+ * UDAT_MEDIUM_RELATIVE, UDAT_SHORT_RELATIVE, or UDAT_NONE.
+ * When the pattern parameter is used, pass in UDAT_PATTERN for both timeStyle and dateStyle.
+ * As currently implemented,
+ * relative date formatting only affects a limited range of calendar days before or
+ * after the current date, based on the CLDR &lt;field type="day"&gt;/&lt;relative&gt; data: For
+ * example, in English, "Yesterday", "Today", and "Tomorrow". Outside of this range,
+ * dates are formatted using the corresponding non-relative style.
+ * @param locale The locale specifying the formatting conventions
+ * @param tzID A timezone ID specifying the timezone to use.  If 0, use
+ * the default timezone.
+ * @param tzIDLength The length of tzID, or -1 if null-terminated.
+ * @param pattern A pattern specifying the format to use.
+ * @param patternLength The number of characters in the pattern, or -1 if null-terminated.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return A pointer to a UDateFormat to use for formatting dates and times, or 0 if
+ * an error occurred.
+ * @stable ICU 2.0
+ */
+U_STABLE UDateFormat* U_EXPORT2 
+udat_open(UDateFormatStyle  timeStyle,
+          UDateFormatStyle  dateStyle,
+          const char        *locale,
+          const UChar       *tzID,
+          int32_t           tzIDLength,
+          const UChar       *pattern,
+          int32_t           patternLength,
+          UErrorCode        *status);
+
+
+/**
+* Close a UDateFormat.
+* Once closed, a UDateFormat may no longer be used.
+* @param format The formatter to close.
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+udat_close(UDateFormat* format);
+
+
+/**
+ * DateFormat boolean attributes
+ * @internal ICU technology preview
+ */
+typedef enum UDateFormatBooleanAttribute {
+    /**
+     * indicates whether whitespace is allowed. Includes trailing dot tolerance.
+     * @internal ICU technology preview
+     */
+    UDAT_PARSE_ALLOW_WHITESPACE,
+    /**
+     * indicates tolerance of numeric data when String data may be assumed. eg: UDAT_YEAR_NAME_FIELD,
+     * UDAT_STANDALONE_MONTH_FIELD, UDAT_DAY_OF_WEEK_FIELD
+     * @internal ICU technology preview
+     */
+    UDAT_PARSE_ALLOW_NUMERIC,
+    /**
+     * count boolean date format constants
+     * @internal ICU technology preview
+     */
+    UDAT_BOOLEAN_ATTRIBUTE_COUNT
+} UDateFormatBooleanAttribute;
+
+#ifndef U_HIDE_INTERNAL_API
+/**
+ * Get a boolean attribute associated with a UDateFormat.
+ * An example would be a true value for a key of UDAT_PARSE_ALLOW_WHITESPACE indicating allowing whitespace leniency.
+ * If the formatter does not understand the attribute, -1 is returned.
+ * @param fmt The formatter to query.
+ * @param attr The attribute to query; e.g. UDAT_PARSE_ALLOW_WHITESPACE.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return The value of attr.
+ * @internal technology preview
+ */
+U_INTERNAL UBool U_EXPORT2
+udat_getBooleanAttribute(const UDateFormat* fmt, UDateFormatBooleanAttribute attr, UErrorCode* status);
+
+/**
+ * Set a boolean attribute associated with a UDateFormat.
+ * An example of a boolean attribute is parse leniency control.  If the formatter does not understand
+ * the attribute, the call is ignored.
+ * @param fmt The formatter to set.
+ * @param attr The attribute to set; one of UDAT_PARSE_ALLOW_WHITESPACE or UDAT_PARSE_ALLOW_NUMERIC
+ * @param newValue The new value of attr.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @internal ICU technology preview
+ */
+U_INTERNAL void U_EXPORT2
+udat_setBooleanAttribute(UDateFormat *fmt, UDateFormatBooleanAttribute attr, UBool, UErrorCode* status);
+
+#endif  /* U_HIDE_INTERNAL_API */
+
+
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUDateFormatPointer
+ * "Smart pointer" class, closes a UDateFormat via udat_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUDateFormatPointer, UDateFormat, udat_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Open a copy of a UDateFormat.
+ * This function performs a deep copy.
+ * @param fmt The format to copy
+ * @param status A pointer to an UErrorCode to receive any errors.
+ * @return A pointer to a UDateFormat identical to fmt.
+ * @stable ICU 2.0
+ */
+U_STABLE UDateFormat* U_EXPORT2 
+udat_clone(const UDateFormat *fmt,
+       UErrorCode *status);
+
+/**
+* Format a date using an UDateFormat.
+* The date will be formatted using the conventions specified in {@link #udat_open }
+* @param format The formatter to use
+* @param dateToFormat The date to format
+* @param result A pointer to a buffer to receive the formatted number.
+* @param resultLength The maximum size of result.
+* @param position A pointer to a UFieldPosition.  On input, position->field
+* is read.  On output, position->beginIndex and position->endIndex indicate
+* the beginning and ending indices of field number position->field, if such
+* a field exists.  This parameter may be NULL, in which case no field
+* position data is returned.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see udat_parse
+* @see UFieldPosition
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+udat_format(    const    UDateFormat*    format,
+                        UDate           dateToFormat,
+                        UChar*          result,
+                        int32_t         resultLength,
+                        UFieldPosition* position,
+                        UErrorCode*     status);
+
+/**
+* Parse a string into an date/time using a UDateFormat.
+* The date will be parsed using the conventions specified in {@link #udat_open }.
+* <P>
+* Note that the normal date formats associated with some calendars - such
+* as the Chinese lunar calendar - do not specify enough fields to enable
+* dates to be parsed unambiguously. In the case of the Chinese lunar
+* calendar, while the year within the current 60-year cycle is specified,
+* the number of such cycles since the start date of the calendar (in the
+* UCAL_ERA field of the UCalendar object) is not normally part of the format,
+* and parsing may assume the wrong era. For cases such as this it is
+* recommended that clients parse using udat_parseCalendar with the UCalendar
+* passed in set to the current date, or to a date within the era/cycle that
+* should be assumed if absent in the format.
+*
+* @param format The formatter to use.
+* @param text The text to parse.
+* @param textLength The length of text, or -1 if null-terminated.
+* @param parsePos If not 0, on input a pointer to an integer specifying the offset at which
+* to begin parsing.  If not 0, on output the offset at which parsing ended.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The value of the parsed date/time
+* @see udat_format
+* @stable ICU 2.0
+*/
+U_STABLE UDate U_EXPORT2 
+udat_parse(const    UDateFormat*    format,
+           const    UChar*          text,
+                    int32_t         textLength,
+                    int32_t         *parsePos,
+                    UErrorCode      *status);
+
+/**
+* Parse a string into an date/time using a UDateFormat.
+* The date will be parsed using the conventions specified in {@link #udat_open }.
+* @param format The formatter to use.
+* @param calendar A calendar set on input to the date and time to be used for
+*                 missing values in the date/time string being parsed, and set
+*                 on output to the parsed date/time. When the calendar type is
+*                 different from the internal calendar held by the UDateFormat
+*                 instance, the internal calendar will be cloned to a work
+*                 calendar set to the same milliseconds and time zone as this
+*                 calendar parameter, field values will be parsed based on the
+*                 work calendar, then the result (milliseconds and time zone)
+*                 will be set in this calendar.
+* @param text The text to parse.
+* @param textLength The length of text, or -1 if null-terminated.
+* @param parsePos If not 0, on input a pointer to an integer specifying the offset at which
+* to begin parsing.  If not 0, on output the offset at which parsing ended.
+* @param status A pointer to an UErrorCode to receive any errors
+* @see udat_format
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+udat_parseCalendar(const    UDateFormat*    format,
+                            UCalendar*      calendar,
+                   const    UChar*          text,
+                            int32_t         textLength,
+                            int32_t         *parsePos,
+                            UErrorCode      *status);
+
+/**
+* Determine if an UDateFormat will perform lenient parsing.
+* With lenient parsing, the parser may use heuristics to interpret inputs that do not
+* precisely match the pattern. With strict parsing, inputs must match the pattern.
+* @param fmt The formatter to query
+* @return TRUE if fmt is set to perform lenient parsing, FALSE otherwise.
+* @see udat_setLenient
+* @stable ICU 2.0
+*/
+U_STABLE UBool U_EXPORT2 
+udat_isLenient(const UDateFormat* fmt);
+
+/**
+* Specify whether an UDateFormat will perform lenient parsing.
+* With lenient parsing, the parser may use heuristics to interpret inputs that do not
+* precisely match the pattern. With strict parsing, inputs must match the pattern.
+* @param fmt The formatter to set
+* @param isLenient TRUE if fmt should perform lenient parsing, FALSE otherwise.
+* @see dat_isLenient
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+udat_setLenient(    UDateFormat*    fmt,
+                    UBool          isLenient);
+
+/**
+* Get the UCalendar associated with an UDateFormat.
+* A UDateFormat uses a UCalendar to convert a raw value to, for example,
+* the day of the week.
+* @param fmt The formatter to query.
+* @return A pointer to the UCalendar used by fmt.
+* @see udat_setCalendar
+* @stable ICU 2.0
+*/
+U_STABLE const UCalendar* U_EXPORT2 
+udat_getCalendar(const UDateFormat* fmt);
+
+/**
+* Set the UCalendar associated with an UDateFormat.
+* A UDateFormat uses a UCalendar to convert a raw value to, for example,
+* the day of the week.
+* @param fmt The formatter to set.
+* @param calendarToSet A pointer to an UCalendar to be used by fmt.
+* @see udat_setCalendar
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+udat_setCalendar(            UDateFormat*    fmt,
+                    const   UCalendar*      calendarToSet);
+
+/**
+* Get the UNumberFormat associated with an UDateFormat.
+* A UDateFormat uses a UNumberFormat to format numbers within a date,
+* for example the day number.
+* @param fmt The formatter to query.
+* @return A pointer to the UNumberFormat used by fmt to format numbers.
+* @see udat_setNumberFormat
+* @stable ICU 2.0
+*/
+U_STABLE const UNumberFormat* U_EXPORT2 
+udat_getNumberFormat(const UDateFormat* fmt);
+
+/**
+* Set the UNumberFormat associated with an UDateFormat.
+* A UDateFormat uses a UNumberFormat to format numbers within a date,
+* for example the day number.
+* @param fmt The formatter to set.
+* @param numberFormatToSet A pointer to the UNumberFormat to be used by fmt to format numbers.
+* @see udat_getNumberFormat
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+udat_setNumberFormat(            UDateFormat*    fmt,
+                        const   UNumberFormat*  numberFormatToSet);
+
+/**
+* Get a locale for which date/time formatting patterns are available.
+* A UDateFormat in a locale returned by this function will perform the correct
+* formatting and parsing for the locale.
+* @param localeIndex The index of the desired locale.
+* @return A locale for which date/time formatting patterns are available, or 0 if none.
+* @see udat_countAvailable
+* @stable ICU 2.0
+*/
+U_STABLE const char* U_EXPORT2 
+udat_getAvailable(int32_t localeIndex);
+
+/**
+* Determine how many locales have date/time  formatting patterns available.
+* This function is most useful as determining the loop ending condition for
+* calls to {@link #udat_getAvailable }.
+* @return The number of locales for which date/time formatting patterns are available.
+* @see udat_getAvailable
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+udat_countAvailable(void);
+
+/**
+* Get the year relative to which all 2-digit years are interpreted.
+* For example, if the 2-digit start year is 2100, the year 99 will be
+* interpreted as 2199.
+* @param fmt The formatter to query.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The year relative to which all 2-digit years are interpreted.
+* @see udat_Set2DigitYearStart
+* @stable ICU 2.0
+*/
+U_STABLE UDate U_EXPORT2 
+udat_get2DigitYearStart(    const   UDateFormat     *fmt,
+                                    UErrorCode      *status);
+
+/**
+* Set the year relative to which all 2-digit years will be interpreted.
+* For example, if the 2-digit start year is 2100, the year 99 will be
+* interpreted as 2199.
+* @param fmt The formatter to set.
+* @param d The year relative to which all 2-digit years will be interpreted.
+* @param status A pointer to an UErrorCode to receive any errors
+* @see udat_Set2DigitYearStart
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+udat_set2DigitYearStart(    UDateFormat     *fmt,
+                            UDate           d,
+                            UErrorCode      *status);
+
+/**
+* Extract the pattern from a UDateFormat.
+* The pattern will follow the pattern syntax rules.
+* @param fmt The formatter to query.
+* @param localized TRUE if the pattern should be localized, FALSE otherwise.
+* @param result A pointer to a buffer to receive the pattern.
+* @param resultLength The maximum size of result.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see udat_applyPattern
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+udat_toPattern(    const   UDateFormat     *fmt,
+                        UBool          localized,
+                        UChar           *result,
+                        int32_t         resultLength,
+                        UErrorCode      *status);
+
+/**
+* Set the pattern used by an UDateFormat.
+* The pattern should follow the pattern syntax rules.
+* @param format The formatter to set.
+* @param localized TRUE if the pattern is localized, FALSE otherwise.
+* @param pattern The new pattern
+* @param patternLength The length of pattern, or -1 if null-terminated.
+* @see udat_toPattern
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+udat_applyPattern(            UDateFormat     *format,
+                            UBool          localized,
+                    const   UChar           *pattern,
+                            int32_t         patternLength);
+
+/** 
+ * The possible types of date format symbols 
+ * @stable ICU 2.6
+ */
+typedef enum UDateFormatSymbolType {
+    /** The era names, for example AD */
+    UDAT_ERAS,
+    /** The month names, for example February */
+    UDAT_MONTHS,
+    /** The short month names, for example Feb. */
+    UDAT_SHORT_MONTHS,
+    /** The CLDR-style format "wide" weekday names, for example Monday */
+    UDAT_WEEKDAYS,
+    /**
+     * The CLDR-style format "abbreviated" (not "short") weekday names, for example "Mon."
+     * For the CLDR-style format "short" weekday names, use UDAT_SHORTER_WEEKDAYS.
+     */
+    UDAT_SHORT_WEEKDAYS,
+    /** The AM/PM names, for example AM */
+    UDAT_AM_PMS,
+    /** The localized characters */
+    UDAT_LOCALIZED_CHARS,
+    /** The long era names, for example Anno Domini */
+    UDAT_ERA_NAMES,
+    /** The narrow month names, for example F */
+    UDAT_NARROW_MONTHS,
+    /** The CLDR-style format "narrow" weekday names, for example "M" */
+    UDAT_NARROW_WEEKDAYS,
+    /** Standalone context versions of months */
+    UDAT_STANDALONE_MONTHS,
+    UDAT_STANDALONE_SHORT_MONTHS,
+    UDAT_STANDALONE_NARROW_MONTHS,
+    /** The CLDR-style stand-alone "wide" weekday names */
+    UDAT_STANDALONE_WEEKDAYS,
+    /**
+     * The CLDR-style stand-alone "abbreviated" (not "short") weekday names.
+     * For the CLDR-style stand-alone "short" weekday names, use UDAT_STANDALONE_SHORTER_WEEKDAYS.
+     */
+    UDAT_STANDALONE_SHORT_WEEKDAYS,
+    /** The CLDR-style stand-alone "narrow" weekday names */
+    UDAT_STANDALONE_NARROW_WEEKDAYS,
+    /** The quarters, for example 1st Quarter */
+    UDAT_QUARTERS,
+    /** The short quarter names, for example Q1 */
+    UDAT_SHORT_QUARTERS,
+    /** Standalone context versions of quarters */
+    UDAT_STANDALONE_QUARTERS,
+    UDAT_STANDALONE_SHORT_QUARTERS,
+#ifndef U_HIDE_DRAFT_API
+    /**
+     * The CLDR-style short weekday names, e.g. "Su", Mo", etc.
+     * These are named "SHORTER" to contrast with the constants using _SHORT_
+     * above, which actually get the CLDR-style *abbreviated* versions of the
+     * corresponding names.
+     * @draft ICU 51
+     */
+    UDAT_SHORTER_WEEKDAYS,
+    /**
+     * Standalone version of UDAT_SHORTER_WEEKDAYS.
+     * @draft ICU 51
+     */
+    UDAT_STANDALONE_SHORTER_WEEKDAYS
+#endif  /* U_HIDE_DRAFT_API */
+} UDateFormatSymbolType;
+
+struct UDateFormatSymbols;
+/** Date format symbols.
+ *  For usage in C programs.
+ *  @stable ICU 2.6
+ */
+typedef struct UDateFormatSymbols UDateFormatSymbols;
+
+/**
+* Get the symbols associated with an UDateFormat.
+* The symbols are what a UDateFormat uses to represent locale-specific data,
+* for example month or day names.
+* @param fmt The formatter to query.
+* @param type The type of symbols to get.  One of UDAT_ERAS, UDAT_MONTHS, UDAT_SHORT_MONTHS,
+* UDAT_WEEKDAYS, UDAT_SHORT_WEEKDAYS, UDAT_AM_PMS, or UDAT_LOCALIZED_CHARS
+* @param symbolIndex The desired symbol of type type.
+* @param result A pointer to a buffer to receive the pattern.
+* @param resultLength The maximum size of result.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see udat_countSymbols
+* @see udat_setSymbols
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+udat_getSymbols(const   UDateFormat             *fmt,
+                        UDateFormatSymbolType   type,
+                        int32_t                 symbolIndex,
+                        UChar                   *result,
+                        int32_t                 resultLength,
+                        UErrorCode              *status);
+
+/**
+* Count the number of particular symbols for an UDateFormat.
+* This function is most useful as for detemining the loop termination condition
+* for calls to {@link #udat_getSymbols }.
+* @param fmt The formatter to query.
+* @param type The type of symbols to count.  One of UDAT_ERAS, UDAT_MONTHS, UDAT_SHORT_MONTHS,
+* UDAT_WEEKDAYS, UDAT_SHORT_WEEKDAYS, UDAT_AM_PMS, or UDAT_LOCALIZED_CHARS
+* @return The number of symbols of type type.
+* @see udat_getSymbols
+* @see udat_setSymbols
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+udat_countSymbols(    const    UDateFormat                *fmt,
+                            UDateFormatSymbolType    type);
+
+/**
+* Set the symbols associated with an UDateFormat.
+* The symbols are what a UDateFormat uses to represent locale-specific data,
+* for example month or day names.
+* @param format The formatter to set
+* @param type The type of symbols to set.  One of UDAT_ERAS, UDAT_MONTHS, UDAT_SHORT_MONTHS,
+* UDAT_WEEKDAYS, UDAT_SHORT_WEEKDAYS, UDAT_AM_PMS, or UDAT_LOCALIZED_CHARS
+* @param symbolIndex The index of the symbol to set of type type.
+* @param value The new value
+* @param valueLength The length of value, or -1 if null-terminated
+* @param status A pointer to an UErrorCode to receive any errors
+* @see udat_getSymbols
+* @see udat_countSymbols
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+udat_setSymbols(    UDateFormat             *format,
+                    UDateFormatSymbolType   type,
+                    int32_t                 symbolIndex,
+                    UChar                   *value,
+                    int32_t                 valueLength,
+                    UErrorCode              *status);
+
+/**
+ * Get the locale for this date format object.
+ * You can choose between valid and actual locale.
+ * @param fmt The formatter to get the locale from
+ * @param type type of the locale we're looking for (valid or actual) 
+ * @param status error code for the operation
+ * @return the locale name
+ * @stable ICU 2.8
+ */
+U_STABLE const char* U_EXPORT2
+udat_getLocaleByType(const UDateFormat *fmt,
+                     ULocDataLocaleType type,
+                     UErrorCode* status); 
+
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Set a particular UDisplayContext value in the formatter, such as
+ * UDISPCTX_CAPITALIZATION_FOR_STANDALONE.
+ * @param fmt The formatter for which to set a UDisplayContext value.
+ * @param value The UDisplayContext value to set.
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @draft ICU 51
+ */
+U_DRAFT void U_EXPORT2
+udat_setContext(UDateFormat* fmt, UDisplayContext value, UErrorCode* status);
+
+/**
+ * Get the formatter's UDisplayContext value for the specified UDisplayContextType,
+ * such as UDISPCTX_TYPE_CAPITALIZATION.
+ * @param fmt The formatter to query.
+ * @param type The UDisplayContextType whose value to return
+ * @param status A pointer to an UErrorCode to receive any errors
+ * @return The UDisplayContextValue for the specified type.
+ * @draft ICU 51
+ */
+U_DRAFT UDisplayContext U_EXPORT2
+udat_getContext(UDateFormat* fmt, UDisplayContextType type, UErrorCode* status);
+
+#endif  /* U_HIDE_DRAFT_API */
+
+#ifndef U_HIDE_INTERNAL_API
+/**
+* Extract the date pattern from a UDateFormat set for relative date formatting.
+* The pattern will follow the pattern syntax rules.
+* @param fmt The formatter to query.
+* @param result A pointer to a buffer to receive the pattern.
+* @param resultLength The maximum size of result.
+* @param status A pointer to a UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see udat_applyPatternRelative
+* @internal ICU 4.2 technology preview
+*/
+U_INTERNAL int32_t U_EXPORT2 
+udat_toPatternRelativeDate(const UDateFormat *fmt,
+                           UChar             *result,
+                           int32_t           resultLength,
+                           UErrorCode        *status);
+
+/**
+* Extract the time pattern from a UDateFormat set for relative date formatting.
+* The pattern will follow the pattern syntax rules.
+* @param fmt The formatter to query.
+* @param result A pointer to a buffer to receive the pattern.
+* @param resultLength The maximum size of result.
+* @param status A pointer to a UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see udat_applyPatternRelative
+* @internal ICU 4.2 technology preview
+*/
+U_INTERNAL int32_t U_EXPORT2 
+udat_toPatternRelativeTime(const UDateFormat *fmt,
+                           UChar             *result,
+                           int32_t           resultLength,
+                           UErrorCode        *status);
+
+/**
+* Set the date & time patterns used by a UDateFormat set for relative date formatting.
+* The patterns should follow the pattern syntax rules.
+* @param format The formatter to set.
+* @param datePattern The new date pattern
+* @param datePatternLength The length of datePattern, or -1 if null-terminated.
+* @param timePattern The new time pattern
+* @param timePatternLength The length of timePattern, or -1 if null-terminated.
+* @param status A pointer to a UErrorCode to receive any errors
+* @see udat_toPatternRelativeDate, udat_toPatternRelativeTime
+* @internal ICU 4.2 technology preview
+*/
+U_INTERNAL void U_EXPORT2 
+udat_applyPatternRelative(UDateFormat *format,
+                          const UChar *datePattern,
+                          int32_t     datePatternLength,
+                          const UChar *timePattern,
+                          int32_t     timePatternLength,
+                          UErrorCode  *status);
+
+/**
+ * @internal
+ * @see udat_open
+ */
+typedef UDateFormat* (U_EXPORT2 *UDateFormatOpener) (UDateFormatStyle  timeStyle,
+                                                    UDateFormatStyle  dateStyle,
+                                                    const char        *locale,
+                                                    const UChar       *tzID,
+                                                    int32_t           tzIDLength,
+                                                    const UChar       *pattern,
+                                                    int32_t           patternLength,
+                                                    UErrorCode        *status);
+
+/**
+ * Register a provider factory
+ * @internal ICU 49
+ */
+U_INTERNAL void U_EXPORT2
+udat_registerOpener(UDateFormatOpener opener, UErrorCode *status);
+
+/**
+ * Un-Register a provider factory
+ * @internal ICU 49
+ */
+U_INTERNAL UDateFormatOpener U_EXPORT2
+udat_unregisterOpener(UDateFormatOpener opener, UErrorCode *status);
+#endif  /* U_HIDE_INTERNAL_API */
+
+
+#endif /* #if !UCONFIG_NO_FORMATTING */
+
+#endif
diff --git a/icu/unicode/udatpg.h b/icu/unicode/udatpg.h
new file mode 100644
index 0000000..7e8ca47
--- /dev/null
+++ b/icu/unicode/udatpg.h
@@ -0,0 +1,588 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 2007-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  udatpg.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 2007jul30
+*   created by: Markus W. Scherer
+*/
+
+#ifndef __UDATPG_H__
+#define __UDATPG_H__
+
+#include "unicode/utypes.h"
+#include "unicode/uenum.h"
+#include "unicode/localpointer.h"
+
+/**
+ * \file
+ * \brief C API: Wrapper for icu::DateTimePatternGenerator (unicode/dtptngen.h).
+ *
+ * UDateTimePatternGenerator provides flexible generation of date format patterns, 
+ * like "yy-MM-dd". The user can build up the generator by adding successive 
+ * patterns. Once that is done, a query can be made using a "skeleton", which is 
+ * a pattern which just includes the desired fields and lengths. The generator 
+ * will return the "best fit" pattern corresponding to that skeleton.
+ * <p>The main method people will use is udatpg_getBestPattern, since normally
+ * UDateTimePatternGenerator is pre-built with data from a particular locale. 
+ * However, generators can be built directly from other data as well.
+ * <p><i>Issue: may be useful to also have a function that returns the list of 
+ * fields in a pattern, in order, since we have that internally.
+ * That would be useful for getting the UI order of field elements.</i>
+ */
+
+/**
+ * Opaque type for a date/time pattern generator object.
+ * @stable ICU 3.8
+ */
+typedef void *UDateTimePatternGenerator;
+
+/**
+ * Field number constants for udatpg_getAppendItemFormats() and similar functions.
+ * These constants are separate from UDateFormatField despite semantic overlap
+ * because some fields are merged for the date/time pattern generator.
+ * @stable ICU 3.8
+ */
+typedef enum UDateTimePatternField {
+    /** @stable ICU 3.8 */
+    UDATPG_ERA_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_YEAR_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_QUARTER_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_MONTH_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_WEEK_OF_YEAR_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_WEEK_OF_MONTH_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_WEEKDAY_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_DAY_OF_YEAR_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_DAY_OF_WEEK_IN_MONTH_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_DAY_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_DAYPERIOD_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_HOUR_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_MINUTE_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_SECOND_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_FRACTIONAL_SECOND_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_ZONE_FIELD,
+    /** @stable ICU 3.8 */
+    UDATPG_FIELD_COUNT
+} UDateTimePatternField;
+
+/**
+ * Masks to control forcing the length of specified fields in the returned
+ * pattern to match those in the skeleton (when this would not happen
+ * otherwise). These may be combined to force the length of multiple fields.
+ * Used with udatpg_getBestPatternWithOptions, udatpg_replaceFieldTypesWithOptions.
+ * @stable ICU 4.4
+ */
+typedef enum UDateTimePatternMatchOptions {
+    /** @stable ICU 4.4 */
+    UDATPG_MATCH_NO_OPTIONS = 0,
+    /** @stable ICU 4.4 */
+    UDATPG_MATCH_HOUR_FIELD_LENGTH = 1 << UDATPG_HOUR_FIELD,
+#ifndef U_HIDE_INTERNAL_API
+    /** @internal ICU 4.4 */
+    UDATPG_MATCH_MINUTE_FIELD_LENGTH = 1 << UDATPG_MINUTE_FIELD,
+    /** @internal ICU 4.4 */
+    UDATPG_MATCH_SECOND_FIELD_LENGTH = 1 << UDATPG_SECOND_FIELD,
+#endif  /* U_HIDE_INTERNAL_API */
+    /** @stable ICU 4.4 */
+    UDATPG_MATCH_ALL_FIELDS_LENGTH = (1 << UDATPG_FIELD_COUNT) - 1
+} UDateTimePatternMatchOptions;
+
+/**
+ * Status return values from udatpg_addPattern().
+ * @stable ICU 3.8
+ */
+typedef enum UDateTimePatternConflict {
+    /** @stable ICU 3.8 */
+    UDATPG_NO_CONFLICT,
+    /** @stable ICU 3.8 */
+    UDATPG_BASE_CONFLICT,
+    /** @stable ICU 3.8 */
+    UDATPG_CONFLICT,
+    /** @stable ICU 3.8 */
+    UDATPG_CONFLICT_COUNT
+} UDateTimePatternConflict;
+
+/**
+  * Open a generator according to a given locale.
+  * @param locale
+  * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+  *                   failure before the function call.
+  * @return a pointer to UDateTimePatternGenerator.
+  * @stable ICU 3.8
+  */
+U_STABLE UDateTimePatternGenerator * U_EXPORT2
+udatpg_open(const char *locale, UErrorCode *pErrorCode);
+
+/**
+  * Open an empty generator, to be constructed with udatpg_addPattern(...) etc.
+  * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+  *                   failure before the function call.
+  * @return a pointer to UDateTimePatternGenerator.
+  * @stable ICU 3.8
+  */
+U_STABLE UDateTimePatternGenerator * U_EXPORT2
+udatpg_openEmpty(UErrorCode *pErrorCode);
+
+/**
+  * Close a generator.
+  * @param dtpg a pointer to UDateTimePatternGenerator.
+  * @stable ICU 3.8
+  */
+U_STABLE void U_EXPORT2
+udatpg_close(UDateTimePatternGenerator *dtpg);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUDateTimePatternGeneratorPointer
+ * "Smart pointer" class, closes a UDateTimePatternGenerator via udatpg_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUDateTimePatternGeneratorPointer, UDateTimePatternGenerator, udatpg_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+  * Create a copy pf a generator.
+  * @param dtpg a pointer to UDateTimePatternGenerator to be copied.
+  * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+  *                   failure before the function call.
+  * @return a pointer to a new UDateTimePatternGenerator.
+  * @stable ICU 3.8
+ */
+U_STABLE UDateTimePatternGenerator * U_EXPORT2
+udatpg_clone(const UDateTimePatternGenerator *dtpg, UErrorCode *pErrorCode);
+
+/**
+ * Get the best pattern matching the input skeleton. It is guaranteed to
+ * have all of the fields in the skeleton.
+ * 
+ * Note that this function uses a non-const UDateTimePatternGenerator:
+ * It uses a stateful pattern parser which is set up for each generator object,
+ * rather than creating one for each function call.
+ * Consecutive calls to this function do not affect each other,
+ * but this function cannot be used concurrently on a single generator object.
+ * 
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param skeleton
+ *            The skeleton is a pattern containing only the variable fields.
+ *            For example, "MMMdd" and "mmhh" are skeletons.
+ * @param length the length of skeleton
+ * @param bestPattern
+ *            The best pattern found from the given skeleton.
+ * @param capacity the capacity of bestPattern.
+ * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+ *                   failure before the function call.
+ * @return the length of bestPattern.
+ * @stable ICU 3.8
+ */
+U_STABLE int32_t U_EXPORT2
+udatpg_getBestPattern(UDateTimePatternGenerator *dtpg,
+                      const UChar *skeleton, int32_t length,
+                      UChar *bestPattern, int32_t capacity,
+                      UErrorCode *pErrorCode);
+
+/**
+ * Get the best pattern matching the input skeleton. It is guaranteed to
+ * have all of the fields in the skeleton.
+ * 
+ * Note that this function uses a non-const UDateTimePatternGenerator:
+ * It uses a stateful pattern parser which is set up for each generator object,
+ * rather than creating one for each function call.
+ * Consecutive calls to this function do not affect each other,
+ * but this function cannot be used concurrently on a single generator object.
+ * 
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param skeleton
+ *            The skeleton is a pattern containing only the variable fields.
+ *            For example, "MMMdd" and "mmhh" are skeletons.
+ * @param length the length of skeleton
+ * @param options
+ *            Options for forcing the length of specified fields in the
+ *            returned pattern to match those in the skeleton (when this
+ *            would not happen otherwise). For default behavior, use
+ *            UDATPG_MATCH_NO_OPTIONS.
+ * @param bestPattern
+ *            The best pattern found from the given skeleton.
+ * @param capacity
+ *            the capacity of bestPattern.
+ * @param pErrorCode
+ *            a pointer to the UErrorCode which must not indicate a
+ *            failure before the function call.
+ * @return the length of bestPattern.
+ * @stable ICU 4.4
+ */
+U_STABLE int32_t U_EXPORT2
+udatpg_getBestPatternWithOptions(UDateTimePatternGenerator *dtpg,
+                                 const UChar *skeleton, int32_t length,
+                                 UDateTimePatternMatchOptions options,
+                                 UChar *bestPattern, int32_t capacity,
+                                 UErrorCode *pErrorCode);
+
+/**
+  * Get a unique skeleton from a given pattern. For example,
+  * both "MMM-dd" and "dd/MMM" produce the skeleton "MMMdd".
+  * 
+  * Note that this function uses a non-const UDateTimePatternGenerator:
+  * It uses a stateful pattern parser which is set up for each generator object,
+  * rather than creating one for each function call.
+  * Consecutive calls to this function do not affect each other,
+  * but this function cannot be used concurrently on a single generator object.
+  *
+  * @param dtpg     a pointer to UDateTimePatternGenerator.
+  * @param pattern  input pattern, such as "dd/MMM".
+  * @param length   the length of pattern.
+  * @param skeleton such as "MMMdd"
+  * @param capacity the capacity of skeleton.
+  * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+  *                  failure before the function call.
+  * @return the length of skeleton.
+  * @stable ICU 3.8
+  */
+U_STABLE int32_t U_EXPORT2
+udatpg_getSkeleton(UDateTimePatternGenerator *dtpg,
+                   const UChar *pattern, int32_t length,
+                   UChar *skeleton, int32_t capacity,
+                   UErrorCode *pErrorCode);
+
+/**
+ * Get a unique base skeleton from a given pattern. This is the same
+ * as the skeleton, except that differences in length are minimized so
+ * as to only preserve the difference between string and numeric form. So
+ * for example, both "MMM-dd" and "d/MMM" produce the skeleton "MMMd"
+ * (notice the single d).
+ *
+ * Note that this function uses a non-const UDateTimePatternGenerator:
+ * It uses a stateful pattern parser which is set up for each generator object,
+ * rather than creating one for each function call.
+ * Consecutive calls to this function do not affect each other,
+ * but this function cannot be used concurrently on a single generator object.
+ *
+ * @param dtpg     a pointer to UDateTimePatternGenerator.
+ * @param pattern  input pattern, such as "dd/MMM".
+ * @param length   the length of pattern.
+ * @param baseSkeleton such as "Md"
+ * @param capacity the capacity of base skeleton.
+ * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+ *                  failure before the function call.
+ * @return the length of baseSkeleton.
+ * @stable ICU 3.8
+ */
+U_STABLE int32_t U_EXPORT2
+udatpg_getBaseSkeleton(UDateTimePatternGenerator *dtpg,
+                       const UChar *pattern, int32_t length,
+                       UChar *baseSkeleton, int32_t capacity,
+                       UErrorCode *pErrorCode);
+
+/**
+ * Adds a pattern to the generator. If the pattern has the same skeleton as
+ * an existing pattern, and the override parameter is set, then the previous
+ * value is overriden. Otherwise, the previous value is retained. In either
+ * case, the conflicting status is set and previous vale is stored in 
+ * conflicting pattern.
+ * <p>
+ * Note that single-field patterns (like "MMM") are automatically added, and
+ * don't need to be added explicitly!
+ *
+ * @param dtpg     a pointer to UDateTimePatternGenerator.
+ * @param pattern  input pattern, such as "dd/MMM"
+ * @param patternLength the length of pattern.
+ * @param override  When existing values are to be overridden use true, 
+ *                  otherwise use false.
+ * @param conflictingPattern  Previous pattern with the same skeleton.
+ * @param capacity the capacity of conflictingPattern.
+ * @param pLength a pointer to the length of conflictingPattern.
+ * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+ *                  failure before the function call.
+ * @return conflicting status. The value could be UDATPG_NO_CONFLICT, 
+ *                  UDATPG_BASE_CONFLICT or UDATPG_CONFLICT.
+ * @stable ICU 3.8
+ */
+U_STABLE UDateTimePatternConflict U_EXPORT2
+udatpg_addPattern(UDateTimePatternGenerator *dtpg,
+                  const UChar *pattern, int32_t patternLength,
+                  UBool override,
+                  UChar *conflictingPattern, int32_t capacity, int32_t *pLength,
+                  UErrorCode *pErrorCode);
+
+/**
+  * An AppendItem format is a pattern used to append a field if there is no
+  * good match. For example, suppose that the input skeleton is "GyyyyMMMd",
+  * and there is no matching pattern internally, but there is a pattern
+  * matching "yyyyMMMd", say "d-MM-yyyy". Then that pattern is used, plus the
+  * G. The way these two are conjoined is by using the AppendItemFormat for G
+  * (era). So if that value is, say "{0}, {1}" then the final resulting
+  * pattern is "d-MM-yyyy, G".
+  * <p>
+  * There are actually three available variables: {0} is the pattern so far,
+  * {1} is the element we are adding, and {2} is the name of the element.
+  * <p>
+  * This reflects the way that the CLDR data is organized.
+  *
+  * @param dtpg   a pointer to UDateTimePatternGenerator.
+  * @param field  UDateTimePatternField, such as UDATPG_ERA_FIELD
+  * @param value  pattern, such as "{0}, {1}"
+  * @param length the length of value.
+  * @stable ICU 3.8
+  */
+U_STABLE void U_EXPORT2
+udatpg_setAppendItemFormat(UDateTimePatternGenerator *dtpg,
+                           UDateTimePatternField field,
+                           const UChar *value, int32_t length);
+
+/**
+ * Getter corresponding to setAppendItemFormat. Values below 0 or at or
+ * above UDATPG_FIELD_COUNT are illegal arguments.
+ *
+ * @param dtpg   A pointer to UDateTimePatternGenerator.
+ * @param field  UDateTimePatternField, such as UDATPG_ERA_FIELD
+ * @param pLength A pointer that will receive the length of appendItemFormat.
+ * @return appendItemFormat for field.
+ * @stable ICU 3.8
+ */
+U_STABLE const UChar * U_EXPORT2
+udatpg_getAppendItemFormat(const UDateTimePatternGenerator *dtpg,
+                           UDateTimePatternField field,
+                           int32_t *pLength);
+
+/**
+   * Set the name of field, eg "era" in English for ERA. These are only
+   * used if the corresponding AppendItemFormat is used, and if it contains a
+   * {2} variable.
+   * <p>
+   * This reflects the way that the CLDR data is organized.
+   *
+   * @param dtpg   a pointer to UDateTimePatternGenerator.
+   * @param field  UDateTimePatternField
+   * @param value  name for the field.
+   * @param length the length of value.
+   * @stable ICU 3.8
+   */
+U_STABLE void U_EXPORT2
+udatpg_setAppendItemName(UDateTimePatternGenerator *dtpg,
+                         UDateTimePatternField field,
+                         const UChar *value, int32_t length);
+
+/**
+ * Getter corresponding to setAppendItemNames. Values below 0 or at or above
+ * UDATPG_FIELD_COUNT are illegal arguments.
+ *
+ * @param dtpg   a pointer to UDateTimePatternGenerator.
+ * @param field  UDateTimePatternField, such as UDATPG_ERA_FIELD
+ * @param pLength A pointer that will receive the length of the name for field.
+ * @return name for field
+ * @stable ICU 3.8
+ */
+U_STABLE const UChar * U_EXPORT2
+udatpg_getAppendItemName(const UDateTimePatternGenerator *dtpg,
+                         UDateTimePatternField field,
+                         int32_t *pLength);
+
+/**
+ * The date time format is a message format pattern used to compose date and
+ * time patterns. The default value is "{0} {1}", where {0} will be replaced
+ * by the date pattern and {1} will be replaced by the time pattern.
+ * <p>
+ * This is used when the input skeleton contains both date and time fields,
+ * but there is not a close match among the added patterns. For example,
+ * suppose that this object was created by adding "dd-MMM" and "hh:mm", and
+ * its datetimeFormat is the default "{0} {1}". Then if the input skeleton
+ * is "MMMdhmm", there is not an exact match, so the input skeleton is
+ * broken up into two components "MMMd" and "hmm". There are close matches
+ * for those two skeletons, so the result is put together with this pattern,
+ * resulting in "d-MMM h:mm".
+ *
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param dtFormat
+ *            message format pattern, here {0} will be replaced by the date
+ *            pattern and {1} will be replaced by the time pattern.
+ * @param length the length of dtFormat.
+ * @stable ICU 3.8
+ */
+U_STABLE void U_EXPORT2
+udatpg_setDateTimeFormat(const UDateTimePatternGenerator *dtpg,
+                         const UChar *dtFormat, int32_t length);
+
+/**
+ * Getter corresponding to setDateTimeFormat.
+ * @param dtpg   a pointer to UDateTimePatternGenerator.
+ * @param pLength A pointer that will receive the length of the format
+ * @return dateTimeFormat.
+ * @stable ICU 3.8
+ */
+U_STABLE const UChar * U_EXPORT2
+udatpg_getDateTimeFormat(const UDateTimePatternGenerator *dtpg,
+                         int32_t *pLength);
+
+/**
+ * The decimal value is used in formatting fractions of seconds. If the
+ * skeleton contains fractional seconds, then this is used with the
+ * fractional seconds. For example, suppose that the input pattern is
+ * "hhmmssSSSS", and the best matching pattern internally is "H:mm:ss", and
+ * the decimal string is ",". Then the resulting pattern is modified to be
+ * "H:mm:ss,SSSS"
+ *
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param decimal
+ * @param length the length of decimal.
+ * @stable ICU 3.8
+ */
+U_STABLE void U_EXPORT2
+udatpg_setDecimal(UDateTimePatternGenerator *dtpg,
+                  const UChar *decimal, int32_t length);
+
+/**
+ * Getter corresponding to setDecimal.
+ * 
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param pLength A pointer that will receive the length of the decimal string.
+ * @return corresponding to the decimal point.
+ * @stable ICU 3.8
+ */
+U_STABLE const UChar * U_EXPORT2
+udatpg_getDecimal(const UDateTimePatternGenerator *dtpg,
+                  int32_t *pLength);
+
+/**
+ * Adjusts the field types (width and subtype) of a pattern to match what is
+ * in a skeleton. That is, if you supply a pattern like "d-M H:m", and a
+ * skeleton of "MMMMddhhmm", then the input pattern is adjusted to be
+ * "dd-MMMM hh:mm". This is used internally to get the best match for the
+ * input skeleton, but can also be used externally.
+ *
+ * Note that this function uses a non-const UDateTimePatternGenerator:
+ * It uses a stateful pattern parser which is set up for each generator object,
+ * rather than creating one for each function call.
+ * Consecutive calls to this function do not affect each other,
+ * but this function cannot be used concurrently on a single generator object.
+ *
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param pattern Input pattern
+ * @param patternLength the length of input pattern.
+ * @param skeleton
+ * @param skeletonLength the length of input skeleton.
+ * @param dest  pattern adjusted to match the skeleton fields widths and subtypes.
+ * @param destCapacity the capacity of dest.
+ * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+ *                  failure before the function call.
+ * @return the length of dest.
+ * @stable ICU 3.8
+ */
+U_STABLE int32_t U_EXPORT2
+udatpg_replaceFieldTypes(UDateTimePatternGenerator *dtpg,
+                         const UChar *pattern, int32_t patternLength,
+                         const UChar *skeleton, int32_t skeletonLength,
+                         UChar *dest, int32_t destCapacity,
+                         UErrorCode *pErrorCode);
+
+/**
+ * Adjusts the field types (width and subtype) of a pattern to match what is
+ * in a skeleton. That is, if you supply a pattern like "d-M H:m", and a
+ * skeleton of "MMMMddhhmm", then the input pattern is adjusted to be
+ * "dd-MMMM hh:mm". This is used internally to get the best match for the
+ * input skeleton, but can also be used externally.
+ *
+ * Note that this function uses a non-const UDateTimePatternGenerator:
+ * It uses a stateful pattern parser which is set up for each generator object,
+ * rather than creating one for each function call.
+ * Consecutive calls to this function do not affect each other,
+ * but this function cannot be used concurrently on a single generator object.
+ *
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param pattern Input pattern
+ * @param patternLength the length of input pattern.
+ * @param skeleton
+ * @param skeletonLength the length of input skeleton.
+ * @param options
+ *            Options controlling whether the length of specified fields in the
+ *            pattern are adjusted to match those in the skeleton (when this
+ *            would not happen otherwise). For default behavior, use
+ *            UDATPG_MATCH_NO_OPTIONS.
+ * @param dest  pattern adjusted to match the skeleton fields widths and subtypes.
+ * @param destCapacity the capacity of dest.
+ * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+ *                  failure before the function call.
+ * @return the length of dest.
+ * @stable ICU 4.4
+ */
+U_STABLE int32_t U_EXPORT2
+udatpg_replaceFieldTypesWithOptions(UDateTimePatternGenerator *dtpg,
+                                    const UChar *pattern, int32_t patternLength,
+                                    const UChar *skeleton, int32_t skeletonLength,
+                                    UDateTimePatternMatchOptions options,
+                                    UChar *dest, int32_t destCapacity,
+                                    UErrorCode *pErrorCode);
+
+/**
+ * Return a UEnumeration list of all the skeletons in canonical form.
+ * Call udatpg_getPatternForSkeleton() to get the corresponding pattern.
+ * 
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+ *                  failure before the function call
+ * @return a UEnumeration list of all the skeletons
+ *         The caller must close the object.
+ * @stable ICU 3.8
+ */
+U_STABLE UEnumeration * U_EXPORT2
+udatpg_openSkeletons(const UDateTimePatternGenerator *dtpg, UErrorCode *pErrorCode);
+
+/**
+ * Return a UEnumeration list of all the base skeletons in canonical form.
+ *
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param pErrorCode a pointer to the UErrorCode which must not indicate a
+ *             failure before the function call.
+ * @return a UEnumeration list of all the base skeletons
+ *             The caller must close the object.
+ * @stable ICU 3.8
+ */
+U_STABLE UEnumeration * U_EXPORT2
+udatpg_openBaseSkeletons(const UDateTimePatternGenerator *dtpg, UErrorCode *pErrorCode);
+
+/**
+ * Get the pattern corresponding to a given skeleton.
+ * 
+ * @param dtpg a pointer to UDateTimePatternGenerator.
+ * @param skeleton 
+ * @param skeletonLength pointer to the length of skeleton.
+ * @param pLength pointer to the length of return pattern.
+ * @return pattern corresponding to a given skeleton.
+ * @stable ICU 3.8
+ */
+U_STABLE const UChar * U_EXPORT2
+udatpg_getPatternForSkeleton(const UDateTimePatternGenerator *dtpg,
+                             const UChar *skeleton, int32_t skeletonLength,
+                             int32_t *pLength);
+
+#endif
diff --git a/icu/unicode/udisplaycontext.h b/icu/unicode/udisplaycontext.h
new file mode 100644
index 0000000..47ed40d
--- /dev/null
+++ b/icu/unicode/udisplaycontext.h
@@ -0,0 +1,124 @@
+/*
+*****************************************************************************************
+* Copyright (C) 2013, International Business Machines
+* Corporation and others. All Rights Reserved.
+*****************************************************************************************
+*/
+
+#ifndef UDISPLAYCONTEXT_H
+#define UDISPLAYCONTEXT_H
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_FORMATTING
+
+/* Dont hide with #ifndef U_HIDE_DRAFT_API, needed by virtual methods */
+/**
+ * \file
+ * \brief C API: Display context types (enum values)
+ */
+
+/**
+ * Display context types, for getting values of a particular setting.
+ * Note, the specific numeric values are internal and may change.
+ * @draft ICU 51
+ */
+enum UDisplayContextType {
+#ifndef U_HIDE_DRAFT_API
+    /**
+     * Type to retrieve the dialect handling setting, e.g.
+     * UDISPCTX_STANDARD_NAMES or UDISPCTX_DIALECT_NAMES.
+     * @draft ICU 51
+     */
+    UDISPCTX_TYPE_DIALECT_HANDLING = 0,
+    /**
+     * Type to retrieve the capitalization context setting, e.g.
+     * UDISPCTX_CAPITALIZATION_NONE, UDISPCTX_CAPITALIZATION_FOR_MIDDLE_OF_SENTENCE,
+     * UDISPCTX_CAPITALIZATION_FOR_BEGINNING_OF_SENTENCE, etc.
+     * @draft ICU 51
+     */
+    UDISPCTX_TYPE_CAPITALIZATION = 1
+#endif /* U_HIDE_DRAFT_API */
+};
+/**
+*  @draft ICU 51
+*/
+typedef enum UDisplayContextType UDisplayContextType;
+
+/* Dont hide with #ifndef U_HIDE_DRAFT_API, needed by virtual methods */
+/**
+ * Display context settings.
+ * Note, the specific numeric values are internal and may change.
+ * @draft ICU 51
+ */
+enum UDisplayContext {
+#ifndef U_HIDE_DRAFT_API
+    /**
+     * ================================
+     * DIALECT_HANDLING can be set to one of UDISPCTX_STANDARD_NAMES or
+     * UDISPCTX_DIALECT_NAMES. Use UDisplayContextType UDISPCTX_TYPE_DIALECT_HANDLING
+     * to get the value.
+     */
+    /**
+     * A possible setting for DIALECT_HANDLING:
+     * use standard names when generating a locale name,
+     * e.g. en_GB displays as 'English (United Kingdom)'.
+     * @draft ICU 51
+     */
+    UDISPCTX_STANDARD_NAMES = (UDISPCTX_TYPE_DIALECT_HANDLING<<8) + 0,
+    /**
+     * A possible setting for DIALECT_HANDLING:
+     * use dialect names, when generating a locale name,
+     * e.g. en_GB displays as 'British English'.
+     * @draft ICU 51
+     */
+    UDISPCTX_DIALECT_NAMES = (UDISPCTX_TYPE_DIALECT_HANDLING<<8) + 1,
+    /**
+     * ================================
+     * CAPITALIZATION can be set to one of UDISPCTX_CAPITALIZATION_NONE,
+     * UDISPCTX_CAPITALIZATION_FOR_MIDDLE_OF_SENTENCE,
+     * UDISPCTX_CAPITALIZATION_FOR_BEGINNING_OF_SENTENCE,
+     * UDISPCTX_CAPITALIZATION_FOR_UI_LIST_OR_MENU, or
+     * UDISPCTX_CAPITALIZATION_FOR_STANDALONE.
+     * Use UDisplayContextType UDISPCTX_TYPE_CAPITALIZATION to get the value.
+     */
+    /**
+     * The capitalization context to be used is unknown (this is the default value).
+     * @draft ICU 51
+     */
+    UDISPCTX_CAPITALIZATION_NONE = (UDISPCTX_TYPE_CAPITALIZATION<<8) + 0,
+    /**
+     * The capitalization context if a date, date symbol or display name is to be
+     * formatted with capitalization appropriate for the middle of a sentence.
+     * @draft ICU 51
+     */
+    UDISPCTX_CAPITALIZATION_FOR_MIDDLE_OF_SENTENCE = (UDISPCTX_TYPE_CAPITALIZATION<<8) + 1,
+    /**
+     * The capitalization context if a date, date symbol or display name is to be
+     * formatted with capitalization appropriate for the beginning of a sentence.
+     * @draft ICU 51
+     */
+    UDISPCTX_CAPITALIZATION_FOR_BEGINNING_OF_SENTENCE = (UDISPCTX_TYPE_CAPITALIZATION<<8) + 2,
+    /**
+     * The capitalization context if a date, date symbol or display name is to be
+     * formatted with capitalization appropriate for a user-interface list or menu item.
+     * @draft ICU 51
+     */
+    UDISPCTX_CAPITALIZATION_FOR_UI_LIST_OR_MENU = (UDISPCTX_TYPE_CAPITALIZATION<<8) + 3,
+    /**
+     * The capitalization context if a date, date symbol or display name is to be
+     * formatted with capitalization appropriate for stand-alone usage such as an
+     * isolated name on a calendar page.
+     * @draft ICU 51
+     */
+    UDISPCTX_CAPITALIZATION_FOR_STANDALONE = (UDISPCTX_TYPE_CAPITALIZATION<<8) + 4
+#endif /* U_HIDE_DRAFT_API */
+};
+/**
+*  @draft ICU 51
+*/
+typedef enum UDisplayContext UDisplayContext;
+
+#endif /* #if !UCONFIG_NO_FORMATTING */
+
+#endif
diff --git a/icu/unicode/uenum.h b/icu/unicode/uenum.h
new file mode 100644
index 0000000..5408ec5
--- /dev/null
+++ b/icu/unicode/uenum.h
@@ -0,0 +1,206 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 2002-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  uenum.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:2
+*
+*   created on: 2002jul08
+*   created by: Vladimir Weinstein
+*/
+
+#ifndef __UENUM_H
+#define __UENUM_H
+
+#include "unicode/utypes.h"
+#include "unicode/localpointer.h"
+
+#if U_SHOW_CPLUSPLUS_API
+#include "unicode/strenum.h"
+#endif
+
+/**
+ * \file
+ * \brief C API: String Enumeration 
+ */
+ 
+/**
+ * An enumeration object.
+ * For usage in C programs.
+ * @stable ICU 2.2
+ */
+struct UEnumeration;
+/** structure representing an enumeration object instance @stable ICU 2.2 */
+typedef struct UEnumeration UEnumeration;
+
+/**
+ * Disposes of resources in use by the iterator.  If en is NULL,
+ * does nothing.  After this call, any char* or UChar* pointer
+ * returned by uenum_unext() or uenum_next() is invalid.
+ * @param en UEnumeration structure pointer
+ * @stable ICU 2.2
+ */
+U_STABLE void U_EXPORT2
+uenum_close(UEnumeration* en);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUEnumerationPointer
+ * "Smart pointer" class, closes a UEnumeration via uenum_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUEnumerationPointer, UEnumeration, uenum_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Returns the number of elements that the iterator traverses.  If
+ * the iterator is out-of-sync with its service, status is set to
+ * U_ENUM_OUT_OF_SYNC_ERROR.
+ * This is a convenience function. It can end up being very
+ * expensive as all the items might have to be pre-fetched (depending
+ * on the type of data being traversed). Use with caution and only 
+ * when necessary.
+ * @param en UEnumeration structure pointer
+ * @param status error code, can be U_ENUM_OUT_OF_SYNC_ERROR if the
+ *               iterator is out of sync.
+ * @return number of elements in the iterator
+ * @stable ICU 2.2
+ */
+U_STABLE int32_t U_EXPORT2
+uenum_count(UEnumeration* en, UErrorCode* status);
+
+/**
+ * Returns the next element in the iterator's list.  If there are
+ * no more elements, returns NULL.  If the iterator is out-of-sync
+ * with its service, status is set to U_ENUM_OUT_OF_SYNC_ERROR and
+ * NULL is returned.  If the native service string is a char* string,
+ * it is converted to UChar* with the invariant converter.
+ * The result is terminated by (UChar)0.
+ * @param en the iterator object
+ * @param resultLength pointer to receive the length of the result
+ *                     (not including the terminating \\0).
+ *                     If the pointer is NULL it is ignored.
+ * @param status the error code, set to U_ENUM_OUT_OF_SYNC_ERROR if
+ *               the iterator is out of sync with its service.
+ * @return a pointer to the string.  The string will be
+ *         zero-terminated.  The return pointer is owned by this iterator
+ *         and must not be deleted by the caller.  The pointer is valid
+ *         until the next call to any uenum_... method, including
+ *         uenum_next() or uenum_unext().  When all strings have been
+ *         traversed, returns NULL.
+ * @stable ICU 2.2
+ */
+U_STABLE const UChar* U_EXPORT2
+uenum_unext(UEnumeration* en,
+            int32_t* resultLength,
+            UErrorCode* status);
+
+/**
+ * Returns the next element in the iterator's list.  If there are
+ * no more elements, returns NULL.  If the iterator is out-of-sync
+ * with its service, status is set to U_ENUM_OUT_OF_SYNC_ERROR and
+ * NULL is returned.  If the native service string is a UChar*
+ * string, it is converted to char* with the invariant converter.
+ * The result is terminated by (char)0.  If the conversion fails
+ * (because a character cannot be converted) then status is set to
+ * U_INVARIANT_CONVERSION_ERROR and the return value is undefined
+ * (but non-NULL).
+ * @param en the iterator object
+ * @param resultLength pointer to receive the length of the result
+ *                     (not including the terminating \\0).
+ *                     If the pointer is NULL it is ignored.
+ * @param status the error code, set to U_ENUM_OUT_OF_SYNC_ERROR if
+ *               the iterator is out of sync with its service.  Set to
+ *               U_INVARIANT_CONVERSION_ERROR if the underlying native string is
+ *               UChar* and conversion to char* with the invariant converter
+ *               fails. This error pertains only to current string, so iteration
+ *               might be able to continue successfully.
+ * @return a pointer to the string.  The string will be
+ *         zero-terminated.  The return pointer is owned by this iterator
+ *         and must not be deleted by the caller.  The pointer is valid
+ *         until the next call to any uenum_... method, including
+ *         uenum_next() or uenum_unext().  When all strings have been
+ *         traversed, returns NULL.
+ * @stable ICU 2.2
+ */
+U_STABLE const char* U_EXPORT2
+uenum_next(UEnumeration* en,
+           int32_t* resultLength,
+           UErrorCode* status);
+
+/**
+ * Resets the iterator to the current list of service IDs.  This
+ * re-establishes sync with the service and rewinds the iterator
+ * to start at the first element.
+ * @param en the iterator object
+ * @param status the error code, set to U_ENUM_OUT_OF_SYNC_ERROR if
+ *               the iterator is out of sync with its service.  
+ * @stable ICU 2.2
+ */
+U_STABLE void U_EXPORT2
+uenum_reset(UEnumeration* en, UErrorCode* status);
+
+#if U_SHOW_CPLUSPLUS_API
+
+/**
+ * Given a StringEnumeration, wrap it in a UEnumeration.  The
+ * StringEnumeration is adopted; after this call, the caller must not
+ * delete it (regardless of error status).
+ * @param adopted the C++ StringEnumeration to be wrapped in a UEnumeration.
+ * @param ec the error code.
+ * @return a UEnumeration wrapping the adopted StringEnumeration.
+ * @stable ICU 4.2
+ */
+U_STABLE UEnumeration* U_EXPORT2
+uenum_openFromStringEnumeration(icu::StringEnumeration* adopted, UErrorCode* ec);
+
+#endif
+
+/**
+ * Given an array of const UChar* strings, return a UEnumeration.  String pointers from 0..count-1 must not be null.
+ * Do not free or modify either the string array or the characters it points to until this object has been destroyed with uenum_close.
+ * \snippet test/cintltst/uenumtst.c uenum_openUCharStringsEnumeration
+ * @param strings array of const UChar* strings (each null terminated). All storage is owned by the caller.
+ * @param count length of the array
+ * @param ec error code
+ * @return the new UEnumeration object. Caller is responsible for calling uenum_close to free memory.
+ * @see uenum_close
+ * @stable ICU 50
+ */
+U_STABLE UEnumeration* U_EXPORT2
+uenum_openUCharStringsEnumeration(const UChar* const strings[], int32_t count,
+                                 UErrorCode* ec);
+
+/* Note:  next function is not hidden as draft, as it is used internally (it was formerly an internal function). */
+
+/**
+ * Given an array of const char* strings (invariant chars only), return a UEnumeration.  String pointers from 0..count-1 must not be null.
+ * Do not free or modify either the string array or the characters it points to until this object has been destroyed with uenum_close.
+ * \snippet test/cintltst/uenumtst.c uenum_openCharStringsEnumeration
+ * @param strings array of char* strings (each null terminated).  All storage is owned by the caller.
+ * @param count length of the array
+ * @param ec error code
+ * @return the new UEnumeration object. Caller is responsible for calling uenum_close to free memory
+ * @see uenum_close
+ * @stable ICU 50
+ */
+U_STABLE UEnumeration* U_EXPORT2
+uenum_openCharStringsEnumeration(const char* const strings[], int32_t count,
+                                 UErrorCode* ec);
+
+#endif
diff --git a/icu/unicode/uformattable.h b/icu/unicode/uformattable.h
new file mode 100644
index 0000000..36c2576
--- /dev/null
+++ b/icu/unicode/uformattable.h
@@ -0,0 +1,283 @@
+/*
+********************************************************************************
+* Copyright (C) 2013, International Business Machines Corporation and others.
+* All Rights Reserved.
+********************************************************************************
+*
+* File UFORMATTABLE.H
+*
+* Modification History:
+*
+*   Date        Name        Description
+*   2013 Jun 7  srl         New
+********************************************************************************
+*/
+
+/**
+ * \file
+ * \brief C API: UFormattable is a thin wrapper for primitive types used for formatting and parsing.
+ *
+ * This is a C interface to the icu::Formattable class. Static functions on this class convert
+ * to and from this interface (via reinterpret_cast).  Note that Formattables (and thus UFormattables)
+ * are mutable, and many operations (even getters) may actually modify the internal state. For this
+ * reason, UFormattables are not thread safe, and should not be shared between threads.
+ *
+ * See {@link unum_parseToUFormattable} for example code.
+ */
+
+#ifndef UFORMATTABLE_H
+#define UFORMATTABLE_H
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_FORMATTING
+
+#ifndef U_HIDE_DRAFT_API
+
+#include "unicode/localpointer.h"
+
+/**
+ * Enum designating the type of a UFormattable instance.
+ * Practically, this indicates which of the getters would return without conversion
+ * or error.
+ * @see icu::Formattable::Type
+ * @draft ICU 52
+ */
+typedef enum UFormattableType {
+  UFMT_DATE = 0, /**< ufmt_getDate() will return without conversion. @see ufmt_getDate*/
+  UFMT_DOUBLE,   /**< ufmt_getDouble() will return without conversion.  @see ufmt_getDouble*/
+  UFMT_LONG,     /**< ufmt_getLong() will return without conversion. @see ufmt_getLong */
+  UFMT_STRING,   /**< ufmt_getUChars() will return without conversion.  @see ufmt_getUChars*/
+  UFMT_ARRAY,    /**< ufmt_countArray() and ufmt_getArray() will return the value.  @see ufmt_getArrayItemByIndex */
+  UFMT_INT64,    /**< ufmt_getInt64() will return without conversion. @see ufmt_getInt64 */
+  UFMT_OBJECT,   /**< ufmt_getObject() will return without conversion.  @see ufmt_getObject*/
+  UFMT_COUNT     /**< Count of defined UFormattableType values */
+} UFormattableType;
+
+
+/**
+ * Opaque type representing various types of data which may be used for formatting
+ * and parsing operations.
+ * @see icu::Formattable
+ * @draft ICU 52
+ */
+typedef void *UFormattable;
+
+/**
+ * Initialize a UFormattable, to type UNUM_LONG, value 0
+ * may return error if memory allocation failed.
+ * parameter status error code.
+ * See {@link unum_parseToUFormattable} for example code.
+ * @draft ICU 52
+ * @return the new UFormattable
+ * @see ufmt_close
+ * @see icu::Formattable::Formattable()
+ */
+U_DRAFT UFormattable* U_EXPORT2
+ufmt_open(UErrorCode* status);
+
+/**
+ * Cleanup any additional memory allocated by this UFormattable.
+ * @param fmt the formatter
+ * @draft ICU 52
+ * @see ufmt_open
+ */
+U_DRAFT void U_EXPORT2
+ufmt_close(UFormattable* fmt);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUFormattablePointer
+ * "Smart pointer" class, closes a UFormattable via ufmt_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @draft ICU 52
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUFormattablePointer, UFormattable, ufmt_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Return the type of this object
+ * @param fmt the UFormattable object
+ * @param status status code - U_ILLEGAL_ARGUMENT_ERROR is returned if the UFormattable contains data not supported by
+ * the API
+ * @return the value as a UFormattableType
+ * @see ufmt_isNumeric
+ * @see icu::Formattable::getType() const
+ * @draft ICU 52
+ */
+U_DRAFT UFormattableType U_EXPORT2
+ufmt_getType(const UFormattable* fmt, UErrorCode *status);
+
+/**
+ * Return whether the object is numeric.
+ * @param fmt the UFormattable object
+ * @return true if the object is a double, long, or int64 value, else false.
+ * @see ufmt_getType
+ * @see icu::Formattable::isNumeric() const
+ * @draft ICU 52
+ */
+U_DRAFT UBool U_EXPORT2
+ufmt_isNumeric(const UFormattable* fmt);
+
+/**
+ * Gets the UDate value of this object.  If the type is not of type UFMT_DATE,
+ * status is set to U_INVALID_FORMAT_ERROR and the return value is
+ * undefined.
+ * @param fmt the UFormattable object
+ * @param status the error code - any conversion or format errors
+ * @return the value
+ * @draft ICU 52
+ * @see icu::Formattable::getDate(UErrorCode&) const
+ */
+U_DRAFT UDate U_EXPORT2
+ufmt_getDate(const UFormattable* fmt, UErrorCode *status);
+
+/**
+ * Gets the double value of this object. If the type is not a UFMT_DOUBLE, or
+ * if there are additional significant digits than fit in a double type,
+ * a conversion is performed with  possible loss of precision.
+ * If the type is UFMT_OBJECT and the
+ * object is a Measure, then the result of
+ * getNumber().getDouble(status) is returned.  If this object is
+ * neither a numeric type nor a Measure, then 0 is returned and
+ * the status is set to U_INVALID_FORMAT_ERROR.
+ * @param fmt the UFormattable object
+ * @param status the error code - any conversion or format errors
+ * @return the value
+ * @draft ICU 52
+ * @see icu::Formattable::getDouble(UErrorCode&) const
+ */
+U_DRAFT double U_EXPORT2
+ufmt_getDouble(UFormattable* fmt, UErrorCode *status);
+
+/**
+ * Gets the long (int32_t) value of this object. If the magnitude is too
+ * large to fit in a long, then the maximum or minimum long value,
+ * as appropriate, is returned and the status is set to
+ * U_INVALID_FORMAT_ERROR.  If this object is of type UFMT_INT64 and
+ * it fits within a long, then no precision is lost.  If it is of
+ * type kDouble or kDecimalNumber, then a conversion is peformed, with
+ * truncation of any fractional part.  If the type is UFMT_OBJECT and
+ * the object is a Measure, then the result of
+ * getNumber().getLong(status) is returned.  If this object is
+ * neither a numeric type nor a Measure, then 0 is returned and
+ * the status is set to U_INVALID_FORMAT_ERROR.
+ * @param fmt the UFormattable object
+ * @param status the error code - any conversion or format errors
+ * @return the value
+ * @draft ICU 52
+ * @see icu::Formattable::getLong(UErrorCode&) const
+ */
+U_DRAFT int32_t U_EXPORT2
+ufmt_getLong(UFormattable* fmt, UErrorCode *status);
+
+
+/**
+ * Gets the int64_t value of this object. If this object is of a numeric
+ * type and the magnitude is too large to fit in an int64, then
+ * the maximum or minimum int64 value, as appropriate, is returned
+ * and the status is set to U_INVALID_FORMAT_ERROR.  If the
+ * magnitude fits in an int64, then a casting conversion is
+ * peformed, with truncation of any fractional part.  If the type
+ * is UFMT_OBJECT and the object is a Measure, then the result of
+ * getNumber().getDouble(status) is returned.  If this object is
+ * neither a numeric type nor a Measure, then 0 is returned and
+ * the status is set to U_INVALID_FORMAT_ERROR.
+ * @param fmt the UFormattable object
+ * @param status the error code - any conversion or format errors
+ * @return the value
+ * @draft ICU 52
+ * @see icu::Formattable::getInt64(UErrorCode&) const
+ */
+U_DRAFT int64_t U_EXPORT2
+ufmt_getInt64(UFormattable* fmt, UErrorCode *status);
+
+/**
+ * Returns a pointer to the UObject contained within this
+ * formattable (as a const void*), or NULL if this object
+ * is not of type UFMT_OBJECT.
+ * @param fmt the UFormattable object
+ * @param status the error code - any conversion or format errors
+ * @return the value as a const void*. It is a polymorphic C++ object.
+ * @draft ICU 52
+ * @see icu::Formattable::getObject() const
+ */
+U_DRAFT const void *U_EXPORT2
+ufmt_getObject(const UFormattable* fmt, UErrorCode *status);
+
+/**
+ * Gets the string value of this object as a UChar string. If the type is not a
+ * string, status is set to U_INVALID_FORMAT_ERROR and a NULL pointer is returned.
+ * This function is not thread safe and may modify the UFormattable if need be to terminate the string.
+ * The returned pointer is not valid if any other functions are called on this UFormattable, or if the UFormattable is closed.
+ * @param fmt the UFormattable object
+ * @param status the error code - any conversion or format errors
+ * @param len if non null, contains the string length on return
+ * @return the null terminated string value - must not be referenced after any other functions are called on this UFormattable.
+ * @draft ICU 52
+ * @see icu::Formattable::getString(UnicodeString&)const
+ */
+U_DRAFT const UChar* U_EXPORT2
+ufmt_getUChars(UFormattable* fmt, int32_t *len, UErrorCode *status);
+
+/**
+ * Get the number of array objects contained, if an array type UFMT_ARRAY
+ * @param fmt the UFormattable object
+ * @param status the error code - any conversion or format errors. U_ILLEGAL_ARGUMENT_ERROR if not an array type.
+ * @return the number of array objects or undefined if not an array type
+ * @draft ICU 52
+ * @see ufmt_getArrayItemByIndex
+ */
+U_DRAFT int32_t U_EXPORT2
+ufmt_getArrayLength(const UFormattable* fmt, UErrorCode *status);
+
+/**
+ * Get the specified value from the array of UFormattables. Invalid if the object is not an array type UFMT_ARRAY
+ * @param fmt the UFormattable object
+ * @param n the number of the array to return (0 based).
+ * @param status the error code - any conversion or format errors. Returns an error if n is out of bounds.
+ * @return the nth array value, only valid while the containing UFormattable is valid. NULL if not an array.
+ * @draft ICU 52
+ * @see icu::Formattable::getArray(int32_t&, UErrorCode&) const
+ */
+U_DRAFT UFormattable * U_EXPORT2
+ufmt_getArrayItemByIndex(UFormattable* fmt, int32_t n, UErrorCode *status);
+
+/**
+ * Returns a numeric string representation of the number contained within this
+ * formattable, or NULL if this object does not contain numeric type.
+ * For values obtained by parsing, the returned decimal number retains
+ * the full precision and range of the original input, unconstrained by
+ * the limits of a double floating point or a 64 bit int.
+ *
+ * This function is not thread safe, and therfore is not declared const,
+ * even though it is logically const.
+ * The resulting buffer is owned by the UFormattable and is invalid if any other functions are
+ * called on the UFormattable.
+ *
+ * Possible errors include U_MEMORY_ALLOCATION_ERROR, and
+ * U_INVALID_STATE if the formattable object has not been set to
+ * a numeric type.
+ * @param fmt the UFormattable object
+ * @param len if non-null, on exit contains the string length (not including the terminating null)
+ * @param status the error code
+ * @return the character buffer as a NULL terminated string, which is owned by the object and must not be accessed if any other functions are called on this object.
+ * @draft ICU 52
+ * @see icu::Formattable::getDecimalNumber(UErrorCode&)
+ */
+U_DRAFT const char * U_EXPORT2
+ufmt_getDecNumChars(UFormattable *fmt, int32_t *len, UErrorCode *status);
+#endif  /* U_HIDE_DRAFT_API */
+
+#endif
+
+#endif
diff --git a/icu/unicode/uiter.h b/icu/unicode/uiter.h
new file mode 100644
index 0000000..0cdb8ff
--- /dev/null
+++ b/icu/unicode/uiter.h
@@ -0,0 +1,707 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 2002-2011 International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  uiter.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 2002jan18
+*   created by: Markus W. Scherer
+*/
+
+#ifndef __UITER_H__
+#define __UITER_H__
+
+/**
+ * \file
+ * \brief C API: Unicode Character Iteration
+ *
+ * @see UCharIterator
+ */
+
+#include "unicode/utypes.h"
+
+#if U_SHOW_CPLUSPLUS_API
+    U_NAMESPACE_BEGIN
+
+    class CharacterIterator;
+    class Replaceable;
+
+    U_NAMESPACE_END
+#endif
+
+U_CDECL_BEGIN
+
+struct UCharIterator;
+typedef struct UCharIterator UCharIterator; /**< C typedef for struct UCharIterator. @stable ICU 2.1 */
+
+/**
+ * Origin constants for UCharIterator.getIndex() and UCharIterator.move().
+ * @see UCharIteratorMove
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+typedef enum UCharIteratorOrigin {
+    UITER_START, UITER_CURRENT, UITER_LIMIT, UITER_ZERO, UITER_LENGTH
+} UCharIteratorOrigin;
+
+/** Constants for UCharIterator. @stable ICU 2.6 */
+enum {
+    /**
+     * Constant value that may be returned by UCharIteratorMove
+     * indicating that the final UTF-16 index is not known, but that the move succeeded.
+     * This can occur when moving relative to limit or length, or
+     * when moving relative to the current index after a setState()
+     * when the current UTF-16 index is not known.
+     *
+     * It would be very inefficient to have to count from the beginning of the text
+     * just to get the current/limit/length index after moving relative to it.
+     * The actual index can be determined with getIndex(UITER_CURRENT)
+     * which will count the UChars if necessary.
+     *
+     * @stable ICU 2.6
+     */
+    UITER_UNKNOWN_INDEX=-2
+};
+
+
+/**
+ * Constant for UCharIterator getState() indicating an error or
+ * an unknown state.
+ * Returned by uiter_getState()/UCharIteratorGetState
+ * when an error occurs.
+ * Also, some UCharIterator implementations may not be able to return
+ * a valid state for each position. This will be clearly documented
+ * for each such iterator (none of the public ones here).
+ *
+ * @stable ICU 2.6
+ */
+#define UITER_NO_STATE ((uint32_t)0xffffffff)
+
+/**
+ * Function type declaration for UCharIterator.getIndex().
+ *
+ * Gets the current position, or the start or limit of the
+ * iteration range.
+ *
+ * This function may perform slowly for UITER_CURRENT after setState() was called,
+ * or for UITER_LENGTH, because an iterator implementation may have to count
+ * UChars if the underlying storage is not UTF-16.
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @param origin get the 0, start, limit, length, or current index
+ * @return the requested index, or U_SENTINEL in an error condition
+ *
+ * @see UCharIteratorOrigin
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+typedef int32_t U_CALLCONV
+UCharIteratorGetIndex(UCharIterator *iter, UCharIteratorOrigin origin);
+
+/**
+ * Function type declaration for UCharIterator.move().
+ *
+ * Use iter->move(iter, index, UITER_ZERO) like CharacterIterator::setIndex(index).
+ *
+ * Moves the current position relative to the start or limit of the
+ * iteration range, or relative to the current position itself.
+ * The movement is expressed in numbers of code units forward
+ * or backward by specifying a positive or negative delta.
+ * Out of bounds movement will be pinned to the start or limit.
+ *
+ * This function may perform slowly for moving relative to UITER_LENGTH
+ * because an iterator implementation may have to count the rest of the
+ * UChars if the native storage is not UTF-16.
+ *
+ * When moving relative to the limit or length, or
+ * relative to the current position after setState() was called,
+ * move() may return UITER_UNKNOWN_INDEX (-2) to avoid an inefficient
+ * determination of the actual UTF-16 index.
+ * The actual index can be determined with getIndex(UITER_CURRENT)
+ * which will count the UChars if necessary.
+ * See UITER_UNKNOWN_INDEX for details.
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @param delta can be positive, zero, or negative
+ * @param origin move relative to the 0, start, limit, length, or current index
+ * @return the new index, or U_SENTINEL on an error condition,
+ *         or UITER_UNKNOWN_INDEX when the index is not known.
+ *
+ * @see UCharIteratorOrigin
+ * @see UCharIterator
+ * @see UITER_UNKNOWN_INDEX
+ * @stable ICU 2.1
+ */
+typedef int32_t U_CALLCONV
+UCharIteratorMove(UCharIterator *iter, int32_t delta, UCharIteratorOrigin origin);
+
+/**
+ * Function type declaration for UCharIterator.hasNext().
+ *
+ * Check if current() and next() can still
+ * return another code unit.
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return boolean value for whether current() and next() can still return another code unit
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+typedef UBool U_CALLCONV
+UCharIteratorHasNext(UCharIterator *iter);
+
+/**
+ * Function type declaration for UCharIterator.hasPrevious().
+ *
+ * Check if previous() can still return another code unit.
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return boolean value for whether previous() can still return another code unit
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+typedef UBool U_CALLCONV
+UCharIteratorHasPrevious(UCharIterator *iter);
+ 
+/**
+ * Function type declaration for UCharIterator.current().
+ *
+ * Return the code unit at the current position,
+ * or U_SENTINEL if there is none (index is at the limit).
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return the current code unit
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+typedef UChar32 U_CALLCONV
+UCharIteratorCurrent(UCharIterator *iter);
+
+/**
+ * Function type declaration for UCharIterator.next().
+ *
+ * Return the code unit at the current index and increment
+ * the index (post-increment, like s[i++]),
+ * or return U_SENTINEL if there is none (index is at the limit).
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return the current code unit (and post-increment the current index)
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+typedef UChar32 U_CALLCONV
+UCharIteratorNext(UCharIterator *iter);
+
+/**
+ * Function type declaration for UCharIterator.previous().
+ *
+ * Decrement the index and return the code unit from there
+ * (pre-decrement, like s[--i]),
+ * or return U_SENTINEL if there is none (index is at the start).
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return the previous code unit (after pre-decrementing the current index)
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+typedef UChar32 U_CALLCONV
+UCharIteratorPrevious(UCharIterator *iter);
+
+/**
+ * Function type declaration for UCharIterator.reservedFn().
+ * Reserved for future use.
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @param something some integer argument
+ * @return some integer
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+typedef int32_t U_CALLCONV
+UCharIteratorReserved(UCharIterator *iter, int32_t something);
+
+/**
+ * Function type declaration for UCharIterator.getState().
+ *
+ * Get the "state" of the iterator in the form of a single 32-bit word.
+ * It is recommended that the state value be calculated to be as small as
+ * is feasible. For strings with limited lengths, fewer than 32 bits may
+ * be sufficient.
+ *
+ * This is used together with setState()/UCharIteratorSetState
+ * to save and restore the iterator position more efficiently than with
+ * getIndex()/move().
+ *
+ * The iterator state is defined as a uint32_t value because it is designed
+ * for use in ucol_nextSortKeyPart() which provides 32 bits to store the state
+ * of the character iterator.
+ *
+ * With some UCharIterator implementations (e.g., UTF-8),
+ * getting and setting the UTF-16 index with existing functions
+ * (getIndex(UITER_CURRENT) followed by move(pos, UITER_ZERO)) is possible but
+ * relatively slow because the iterator has to "walk" from a known index
+ * to the requested one.
+ * This takes more time the farther it needs to go.
+ *
+ * An opaque state value allows an iterator implementation to provide
+ * an internal index (UTF-8: the source byte array index) for
+ * fast, constant-time restoration.
+ *
+ * After calling setState(), a getIndex(UITER_CURRENT) may be slow because
+ * the UTF-16 index may not be restored as well, but the iterator can deliver
+ * the correct text contents and move relative to the current position
+ * without performance degradation.
+ *
+ * Some UCharIterator implementations may not be able to return
+ * a valid state for each position, in which case they return UITER_NO_STATE instead.
+ * This will be clearly documented for each such iterator (none of the public ones here).
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return the state word
+ *
+ * @see UCharIterator
+ * @see UCharIteratorSetState
+ * @see UITER_NO_STATE
+ * @stable ICU 2.6
+ */
+typedef uint32_t U_CALLCONV
+UCharIteratorGetState(const UCharIterator *iter);
+
+/**
+ * Function type declaration for UCharIterator.setState().
+ *
+ * Restore the "state" of the iterator using a state word from a getState() call.
+ * The iterator object need not be the same one as for which getState() was called,
+ * but it must be of the same type (set up using the same uiter_setXYZ function)
+ * and it must iterate over the same string
+ * (binary identical regardless of memory address).
+ * For more about the state word see UCharIteratorGetState.
+ *
+ * After calling setState(), a getIndex(UITER_CURRENT) may be slow because
+ * the UTF-16 index may not be restored as well, but the iterator can deliver
+ * the correct text contents and move relative to the current position
+ * without performance degradation.
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @param state the state word from a getState() call
+ *              on a same-type, same-string iterator
+ * @param pErrorCode Must be a valid pointer to an error code value,
+ *                   which must not indicate a failure before the function call.
+ *
+ * @see UCharIterator
+ * @see UCharIteratorGetState
+ * @stable ICU 2.6
+ */
+typedef void U_CALLCONV
+UCharIteratorSetState(UCharIterator *iter, uint32_t state, UErrorCode *pErrorCode);
+
+
+/**
+ * C API for code unit iteration.
+ * This can be used as a C wrapper around
+ * CharacterIterator, Replaceable, or implemented using simple strings, etc.
+ *
+ * There are two roles for using UCharIterator:
+ *
+ * A "provider" sets the necessary function pointers and controls the "protected"
+ * fields of the UCharIterator structure. A "provider" passes a UCharIterator
+ * into C APIs that need a UCharIterator as an abstract, flexible string interface.
+ *
+ * Implementations of such C APIs are "callers" of UCharIterator functions;
+ * they only use the "public" function pointers and never access the "protected"
+ * fields directly.
+ *
+ * The current() and next() functions only check the current index against the
+ * limit, and previous() only checks the current index against the start,
+ * to see if the iterator already reached the end of the iteration range.
+ *
+ * The assumption - in all iterators - is that the index is moved via the API,
+ * which means it won't go out of bounds, or the index is modified by
+ * user code that knows enough about the iterator implementation to set valid
+ * index values.
+ *
+ * UCharIterator functions return code unit values 0..0xffff,
+ * or U_SENTINEL if the iteration bounds are reached.
+ *
+ * @stable ICU 2.1
+ */
+struct UCharIterator {
+    /**
+     * (protected) Pointer to string or wrapped object or similar.
+     * Not used by caller.
+     * @stable ICU 2.1
+     */
+    const void *context;
+
+    /**
+     * (protected) Length of string or similar.
+     * Not used by caller.
+     * @stable ICU 2.1
+     */
+    int32_t length;
+
+    /**
+     * (protected) Start index or similar.
+     * Not used by caller.
+     * @stable ICU 2.1
+     */
+    int32_t start;
+
+    /**
+     * (protected) Current index or similar.
+     * Not used by caller.
+     * @stable ICU 2.1
+     */
+    int32_t index;
+
+    /**
+     * (protected) Limit index or similar.
+     * Not used by caller.
+     * @stable ICU 2.1
+     */
+    int32_t limit;
+
+    /**
+     * (protected) Used by UTF-8 iterators and possibly others.
+     * @stable ICU 2.1
+     */
+    int32_t reservedField;
+
+    /**
+     * (public) Returns the current position or the
+     * start or limit index of the iteration range.
+     *
+     * @see UCharIteratorGetIndex
+     * @stable ICU 2.1
+     */
+    UCharIteratorGetIndex *getIndex;
+
+    /**
+     * (public) Moves the current position relative to the start or limit of the
+     * iteration range, or relative to the current position itself.
+     * The movement is expressed in numbers of code units forward
+     * or backward by specifying a positive or negative delta.
+     *
+     * @see UCharIteratorMove
+     * @stable ICU 2.1
+     */
+    UCharIteratorMove *move;
+
+    /**
+     * (public) Check if current() and next() can still
+     * return another code unit.
+     *
+     * @see UCharIteratorHasNext
+     * @stable ICU 2.1
+     */
+    UCharIteratorHasNext *hasNext;
+
+    /**
+     * (public) Check if previous() can still return another code unit.
+     *
+     * @see UCharIteratorHasPrevious
+     * @stable ICU 2.1
+     */
+    UCharIteratorHasPrevious *hasPrevious;
+
+    /**
+     * (public) Return the code unit at the current position,
+     * or U_SENTINEL if there is none (index is at the limit).
+     *
+     * @see UCharIteratorCurrent
+     * @stable ICU 2.1
+     */
+    UCharIteratorCurrent *current;
+
+    /**
+     * (public) Return the code unit at the current index and increment
+     * the index (post-increment, like s[i++]),
+     * or return U_SENTINEL if there is none (index is at the limit).
+     *
+     * @see UCharIteratorNext
+     * @stable ICU 2.1
+     */
+    UCharIteratorNext *next;
+
+    /**
+     * (public) Decrement the index and return the code unit from there
+     * (pre-decrement, like s[--i]),
+     * or return U_SENTINEL if there is none (index is at the start).
+     *
+     * @see UCharIteratorPrevious
+     * @stable ICU 2.1
+     */
+    UCharIteratorPrevious *previous;
+
+    /**
+     * (public) Reserved for future use. Currently NULL.
+     *
+     * @see UCharIteratorReserved
+     * @stable ICU 2.1
+     */
+    UCharIteratorReserved *reservedFn;
+
+    /**
+     * (public) Return the state of the iterator, to be restored later with setState().
+     * This function pointer is NULL if the iterator does not implement it.
+     *
+     * @see UCharIteratorGet
+     * @stable ICU 2.6
+     */
+    UCharIteratorGetState *getState;
+
+    /**
+     * (public) Restore the iterator state from the state word from a call
+     * to getState().
+     * This function pointer is NULL if the iterator does not implement it.
+     *
+     * @see UCharIteratorSet
+     * @stable ICU 2.6
+     */
+    UCharIteratorSetState *setState;
+};
+
+/**
+ * Helper function for UCharIterator to get the code point
+ * at the current index.
+ *
+ * Return the code point that includes the code unit at the current position,
+ * or U_SENTINEL if there is none (index is at the limit).
+ * If the current code unit is a lead or trail surrogate,
+ * then the following or preceding surrogate is used to form
+ * the code point value.
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return the current code point
+ *
+ * @see UCharIterator
+ * @see U16_GET
+ * @see UnicodeString::char32At()
+ * @stable ICU 2.1
+ */
+U_STABLE UChar32 U_EXPORT2
+uiter_current32(UCharIterator *iter);
+
+/**
+ * Helper function for UCharIterator to get the next code point.
+ *
+ * Return the code point at the current index and increment
+ * the index (post-increment, like s[i++]),
+ * or return U_SENTINEL if there is none (index is at the limit).
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return the current code point (and post-increment the current index)
+ *
+ * @see UCharIterator
+ * @see U16_NEXT
+ * @stable ICU 2.1
+ */
+U_STABLE UChar32 U_EXPORT2
+uiter_next32(UCharIterator *iter);
+
+/**
+ * Helper function for UCharIterator to get the previous code point.
+ *
+ * Decrement the index and return the code point from there
+ * (pre-decrement, like s[--i]),
+ * or return U_SENTINEL if there is none (index is at the start).
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return the previous code point (after pre-decrementing the current index)
+ *
+ * @see UCharIterator
+ * @see U16_PREV
+ * @stable ICU 2.1
+ */
+U_STABLE UChar32 U_EXPORT2
+uiter_previous32(UCharIterator *iter);
+
+/**
+ * Get the "state" of the iterator in the form of a single 32-bit word.
+ * This is a convenience function that calls iter->getState(iter)
+ * if iter->getState is not NULL;
+ * if it is NULL or any other error occurs, then UITER_NO_STATE is returned.
+ *
+ * Some UCharIterator implementations may not be able to return
+ * a valid state for each position, in which case they return UITER_NO_STATE instead.
+ * This will be clearly documented for each such iterator (none of the public ones here).
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @return the state word
+ *
+ * @see UCharIterator
+ * @see UCharIteratorGetState
+ * @see UITER_NO_STATE
+ * @stable ICU 2.6
+ */
+U_STABLE uint32_t U_EXPORT2
+uiter_getState(const UCharIterator *iter);
+
+/**
+ * Restore the "state" of the iterator using a state word from a getState() call.
+ * This is a convenience function that calls iter->setState(iter, state, pErrorCode)
+ * if iter->setState is not NULL; if it is NULL, then U_UNSUPPORTED_ERROR is set.
+ *
+ * @param iter the UCharIterator structure ("this pointer")
+ * @param state the state word from a getState() call
+ *              on a same-type, same-string iterator
+ * @param pErrorCode Must be a valid pointer to an error code value,
+ *                   which must not indicate a failure before the function call.
+ *
+ * @see UCharIterator
+ * @see UCharIteratorSetState
+ * @stable ICU 2.6
+ */
+U_STABLE void U_EXPORT2
+uiter_setState(UCharIterator *iter, uint32_t state, UErrorCode *pErrorCode);
+
+/**
+ * Set up a UCharIterator to iterate over a string.
+ *
+ * Sets the UCharIterator function pointers for iteration over the string s
+ * with iteration boundaries start=index=0 and length=limit=string length.
+ * The "provider" may set the start, index, and limit values at any time
+ * within the range 0..length.
+ * The length field will be ignored.
+ *
+ * The string pointer s is set into UCharIterator.context without copying
+ * or reallocating the string contents.
+ *
+ * getState() simply returns the current index.
+ * move() will always return the final index.
+ *
+ * @param iter UCharIterator structure to be set for iteration
+ * @param s String to iterate over
+ * @param length Length of s, or -1 if NUL-terminated
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+U_STABLE void U_EXPORT2
+uiter_setString(UCharIterator *iter, const UChar *s, int32_t length);
+
+/**
+ * Set up a UCharIterator to iterate over a UTF-16BE string
+ * (byte vector with a big-endian pair of bytes per UChar).
+ *
+ * Everything works just like with a normal UChar iterator (uiter_setString),
+ * except that UChars are assembled from byte pairs,
+ * and that the length argument here indicates an even number of bytes.
+ *
+ * getState() simply returns the current index.
+ * move() will always return the final index.
+ *
+ * @param iter UCharIterator structure to be set for iteration
+ * @param s UTF-16BE string to iterate over
+ * @param length Length of s as an even number of bytes, or -1 if NUL-terminated
+ *               (NUL means pair of 0 bytes at even index from s)
+ *
+ * @see UCharIterator
+ * @see uiter_setString
+ * @stable ICU 2.6
+ */
+U_STABLE void U_EXPORT2
+uiter_setUTF16BE(UCharIterator *iter, const char *s, int32_t length);
+
+/**
+ * Set up a UCharIterator to iterate over a UTF-8 string.
+ *
+ * Sets the UCharIterator function pointers for iteration over the UTF-8 string s
+ * with UTF-8 iteration boundaries 0 and length.
+ * The implementation counts the UTF-16 index on the fly and
+ * lazily evaluates the UTF-16 length of the text.
+ *
+ * The start field is used as the UTF-8 offset, the limit field as the UTF-8 length.
+ * When the reservedField is not 0, then it contains a supplementary code point
+ * and the UTF-16 index is between the two corresponding surrogates.
+ * At that point, the UTF-8 index is behind that code point.
+ *
+ * The UTF-8 string pointer s is set into UCharIterator.context without copying
+ * or reallocating the string contents.
+ *
+ * getState() returns a state value consisting of
+ * - the current UTF-8 source byte index (bits 31..1)
+ * - a flag (bit 0) that indicates whether the UChar position is in the middle
+ *   of a surrogate pair
+ *   (from a 4-byte UTF-8 sequence for the corresponding supplementary code point)
+ *
+ * getState() cannot also encode the UTF-16 index in the state value.
+ * move(relative to limit or length), or
+ * move(relative to current) after setState(), may return UITER_UNKNOWN_INDEX.
+ *
+ * @param iter UCharIterator structure to be set for iteration
+ * @param s UTF-8 string to iterate over
+ * @param length Length of s in bytes, or -1 if NUL-terminated
+ *
+ * @see UCharIterator
+ * @stable ICU 2.6
+ */
+U_STABLE void U_EXPORT2
+uiter_setUTF8(UCharIterator *iter, const char *s, int32_t length);
+
+#if U_SHOW_CPLUSPLUS_API
+
+/**
+ * Set up a UCharIterator to wrap around a C++ CharacterIterator.
+ *
+ * Sets the UCharIterator function pointers for iteration using the
+ * CharacterIterator charIter.
+ *
+ * The CharacterIterator pointer charIter is set into UCharIterator.context
+ * without copying or cloning the CharacterIterator object.
+ * The other "protected" UCharIterator fields are set to 0 and will be ignored.
+ * The iteration index and boundaries are controlled by the CharacterIterator.
+ *
+ * getState() simply returns the current index.
+ * move() will always return the final index.
+ *
+ * @param iter UCharIterator structure to be set for iteration
+ * @param charIter CharacterIterator to wrap
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+U_STABLE void U_EXPORT2
+uiter_setCharacterIterator(UCharIterator *iter, icu::CharacterIterator *charIter);
+
+/**
+ * Set up a UCharIterator to iterate over a C++ Replaceable.
+ *
+ * Sets the UCharIterator function pointers for iteration over the
+ * Replaceable rep with iteration boundaries start=index=0 and
+ * length=limit=rep->length().
+ * The "provider" may set the start, index, and limit values at any time
+ * within the range 0..length=rep->length().
+ * The length field will be ignored.
+ *
+ * The Replaceable pointer rep is set into UCharIterator.context without copying
+ * or cloning/reallocating the Replaceable object.
+ *
+ * getState() simply returns the current index.
+ * move() will always return the final index.
+ *
+ * @param iter UCharIterator structure to be set for iteration
+ * @param rep Replaceable to iterate over
+ *
+ * @see UCharIterator
+ * @stable ICU 2.1
+ */
+U_STABLE void U_EXPORT2
+uiter_setReplaceable(UCharIterator *iter, const icu::Replaceable *rep);
+
+#endif
+
+U_CDECL_END
+
+#endif
diff --git a/icu/unicode/uloc.h b/icu/unicode/uloc.h
new file mode 100644
index 0000000..28ab902
--- /dev/null
+++ b/icu/unicode/uloc.h
@@ -0,0 +1,1135 @@
+/*
+**********************************************************************
+*   Copyright (C) 1997-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+*
+* File ULOC.H
+*
+* Modification History:
+*
+*   Date        Name        Description
+*   04/01/97    aliu        Creation.
+*   08/22/98    stephen     JDK 1.2 sync.
+*   12/08/98    rtg         New C API for Locale
+*   03/30/99    damiba      overhaul
+*   03/31/99    helena      Javadoc for uloc functions.
+*   04/15/99    Madhu       Updated Javadoc
+********************************************************************************
+*/
+
+#ifndef ULOC_H
+#define ULOC_H
+
+#include "unicode/utypes.h"
+#include "unicode/uenum.h"
+
+/**    
+ * \file
+ * \brief  C API: Locale 
+ *
+ * <h2> ULoc C API for Locale </h2>
+ * A <code>Locale</code> represents a specific geographical, political,
+ * or cultural region. An operation that requires a <code>Locale</code> to perform
+ * its task is called <em>locale-sensitive</em> and uses the <code>Locale</code>
+ * to tailor information for the user. For example, displaying a number
+ * is a locale-sensitive operation--the number should be formatted
+ * according to the customs/conventions of the user's native country,
+ * region, or culture.  In the C APIs, a locales is simply a const char string.
+ *
+ * <P>
+ * You create a <code>Locale</code> with one of the three options listed below.
+ * Each of the component is separated by '_' in the locale string.
+ * \htmlonly<blockquote>\endhtmlonly
+ * <pre>
+ * \code
+ *       newLanguage
+ * 
+ *       newLanguage + newCountry
+ * 
+ *       newLanguage + newCountry + newVariant
+ * \endcode
+ * </pre>
+ * \htmlonly</blockquote>\endhtmlonly
+ * The first option is a valid <STRONG>ISO
+ * Language Code.</STRONG> These codes are the lower-case two-letter
+ * codes as defined by ISO-639.
+ * You can find a full list of these codes at a number of sites, such as:
+ * <BR><a href ="http://www.ics.uci.edu/pub/ietf/http/related/iso639.txt">
+ * http://www.ics.uci.edu/pub/ietf/http/related/iso639.txt</a>
+ *
+ * <P>
+ * The second option includes an additonal <STRONG>ISO Country
+ * Code.</STRONG> These codes are the upper-case two-letter codes
+ * as defined by ISO-3166.
+ * You can find a full list of these codes at a number of sites, such as:
+ * <BR><a href="http://www.chemie.fu-berlin.de/diverse/doc/ISO_3166.html">
+ * http://www.chemie.fu-berlin.de/diverse/doc/ISO_3166.html</a>
+ *
+ * <P>
+ * The third option requires another additonal information--the 
+ * <STRONG>Variant.</STRONG>
+ * The Variant codes are vendor and browser-specific.
+ * For example, use WIN for Windows, MAC for Macintosh, and POSIX for POSIX.
+ * Where there are two variants, separate them with an underscore, and
+ * put the most important one first. For
+ * example, a Traditional Spanish collation might be referenced, with
+ * "ES", "ES", "Traditional_WIN".
+ *
+ * <P>
+ * Because a <code>Locale</code> is just an identifier for a region,
+ * no validity check is performed when you specify a <code>Locale</code>.
+ * If you want to see whether particular resources are available for the
+ * <code>Locale</code> you asked for, you must query those resources. For
+ * example, ask the <code>UNumberFormat</code> for the locales it supports
+ * using its <code>getAvailable</code> method.
+ * <BR><STRONG>Note:</STRONG> When you ask for a resource for a particular
+ * locale, you get back the best available match, not necessarily
+ * precisely what you asked for. For more information, look at
+ * <code>UResourceBundle</code>.
+ *
+ * <P>
+ * The <code>Locale</code> provides a number of convenient constants
+ * that you can use to specify the commonly used
+ * locales. For example, the following refers to a locale
+ * for the United States:
+ * \htmlonly<blockquote>\endhtmlonly
+ * <pre>
+ * \code
+ *       ULOC_US
+ * \endcode
+ * </pre>
+ * \htmlonly</blockquote>\endhtmlonly
+ *
+ * <P>
+ * Once you've specified a locale you can query it for information about
+ * itself. Use <code>uloc_getCountry</code> to get the ISO Country Code and
+ * <code>uloc_getLanguage</code> to get the ISO Language Code. You can
+ * use <code>uloc_getDisplayCountry</code> to get the
+ * name of the country suitable for displaying to the user. Similarly,
+ * you can use <code>uloc_getDisplayLanguage</code> to get the name of
+ * the language suitable for displaying to the user. Interestingly,
+ * the <code>uloc_getDisplayXXX</code> methods are themselves locale-sensitive
+ * and have two versions: one that uses the default locale and one
+ * that takes a locale as an argument and displays the name or country in
+ * a language appropriate to that locale.
+ *
+ * <P>
+ * The ICU provides a number of services that perform locale-sensitive
+ * operations. For example, the <code>unum_xxx</code> functions format
+ * numbers, currency, or percentages in a locale-sensitive manner. 
+ * </P>
+ * \htmlonly<blockquote>\endhtmlonly
+ * <pre>
+ * \code
+ *     UErrorCode success = U_ZERO_ERROR;
+ *     UNumberFormat *nf;
+ *     const char* myLocale = "fr_FR";
+ * 
+ *     nf = unum_open( UNUM_DEFAULT, NULL, success );          
+ *     unum_close(nf);
+ *     nf = unum_open( UNUM_CURRENCY, NULL, success );
+ *     unum_close(nf);
+ *     nf = unum_open( UNUM_PERCENT, NULL, success );   
+ *     unum_close(nf);
+ * \endcode
+ * </pre>
+ * \htmlonly</blockquote>\endhtmlonly
+ * Each of these methods has two variants; one with an explicit locale
+ * and one without; the latter using the default locale.
+ * \htmlonly<blockquote>\endhtmlonly
+ * <pre>
+ * \code 
+ * 
+ *     nf = unum_open( UNUM_DEFAULT, myLocale, success );          
+ *     unum_close(nf);
+ *     nf = unum_open( UNUM_CURRENCY, myLocale, success );
+ *     unum_close(nf);
+ *     nf = unum_open( UNUM_PERCENT, myLocale, success );   
+ *     unum_close(nf);
+ * \endcode
+ * </pre>
+ * \htmlonly</blockquote>\endhtmlonly
+ * A <code>Locale</code> is the mechanism for identifying the kind of services
+ * (<code>UNumberFormat</code>) that you would like to get. The locale is
+ * <STRONG>just</STRONG> a mechanism for identifying these services.
+ *
+ * <P>
+ * Each international serivce that performs locale-sensitive operations 
+ * allows you
+ * to get all the available objects of that type. You can sift
+ * through these objects by language, country, or variant,
+ * and use the display names to present a menu to the user.
+ * For example, you can create a menu of all the collation objects
+ * suitable for a given language. Such classes implement these
+ * three class methods:
+ * \htmlonly<blockquote>\endhtmlonly
+ * <pre>
+ * \code
+ *       const char* uloc_getAvailable(int32_t index);
+ *       int32_t uloc_countAvailable();
+ *       int32_t
+ *       uloc_getDisplayName(const char* localeID,
+ *                 const char* inLocaleID, 
+ *                 UChar* result,
+ *                 int32_t maxResultSize,
+ *                  UErrorCode* err);
+ * 
+ * \endcode
+ * </pre>
+ * \htmlonly</blockquote>\endhtmlonly
+ * <P>
+ * Concerning POSIX/RFC1766 Locale IDs, 
+ *  the getLanguage/getCountry/getVariant/getName functions do understand
+ * the POSIX type form of  language_COUNTRY.ENCODING\@VARIANT
+ * and if there is not an ICU-stype variant, uloc_getVariant() for example
+ * will return the one listed after the \@at sign. As well, the hyphen
+ * "-" is recognized as a country/variant separator similarly to RFC1766.
+ * So for example, "en-us" will be interpreted as en_US.  
+ * As a result, uloc_getName() is far from a no-op, and will have the
+ * effect of converting POSIX/RFC1766 IDs into ICU form, although it does
+ * NOT map any of the actual codes (i.e. russian->ru) in any way.
+ * Applications should call uloc_getName() at the point where a locale ID
+ * is coming from an external source (user entry, OS, web browser)
+ * and pass the resulting string to other ICU functions.  For example,
+ * don't use de-de\@EURO as an argument to resourcebundle.
+ *
+ * @see UResourceBundle
+ */
+
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_CHINESE            "zh"
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_ENGLISH            "en"
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_FRENCH             "fr"
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_GERMAN             "de"
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_ITALIAN            "it"
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_JAPANESE           "ja"
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_KOREAN             "ko"
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_SIMPLIFIED_CHINESE "zh_CN"
+/** Useful constant for this language. @stable ICU 2.0 */
+#define ULOC_TRADITIONAL_CHINESE "zh_TW"
+
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_CANADA         "en_CA"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_CANADA_FRENCH  "fr_CA"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_CHINA          "zh_CN"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_PRC            "zh_CN"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_FRANCE         "fr_FR"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_GERMANY        "de_DE"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_ITALY          "it_IT"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_JAPAN          "ja_JP"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_KOREA          "ko_KR"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_TAIWAN         "zh_TW"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_UK             "en_GB"
+/** Useful constant for this country/region. @stable ICU 2.0 */
+#define ULOC_US             "en_US"
+
+/**
+ * Useful constant for the maximum size of the language part of a locale ID.
+ * (including the terminating NULL).
+ * @stable ICU 2.0
+ */
+#define ULOC_LANG_CAPACITY 12
+
+/**
+ * Useful constant for the maximum size of the country part of a locale ID
+ * (including the terminating NULL).
+ * @stable ICU 2.0
+ */
+#define ULOC_COUNTRY_CAPACITY 4
+/**
+ * Useful constant for the maximum size of the whole locale ID
+ * (including the terminating NULL and all keywords).
+ * @stable ICU 2.0
+ */
+#define ULOC_FULLNAME_CAPACITY 157
+
+/**
+ * Useful constant for the maximum size of the script part of a locale ID
+ * (including the terminating NULL).
+ * @stable ICU 2.8
+ */
+#define ULOC_SCRIPT_CAPACITY 6
+
+/**
+ * Useful constant for the maximum size of keywords in a locale
+ * @stable ICU 2.8
+ */
+#define ULOC_KEYWORDS_CAPACITY 50
+
+/**
+ * Useful constant for the maximum total size of keywords and their values in a locale
+ * @stable ICU 2.8
+ */
+#define ULOC_KEYWORD_AND_VALUES_CAPACITY 100
+
+/**
+ * Invariant character separating keywords from the locale string
+ * @stable ICU 2.8
+ */
+#define ULOC_KEYWORD_SEPARATOR '@'
+
+/**
+  * Unicode code point for '@' separating keywords from the locale string.
+  * @see ULOC_KEYWORD_SEPARATOR
+  * @stable ICU 4.6
+  */
+#define ULOC_KEYWORD_SEPARATOR_UNICODE 0x40
+
+/**
+ * Invariant character for assigning value to a keyword
+ * @stable ICU 2.8
+ */
+#define ULOC_KEYWORD_ASSIGN '='
+
+/**
+  * Unicode code point for '=' for assigning value to a keyword.
+  * @see ULOC_KEYWORD_ASSIGN
+  * @stable ICU 4.6 
+  */
+#define ULOC_KEYWORD_ASSIGN_UNICODE 0x3D
+
+/**
+ * Invariant character separating keywords
+ * @stable ICU 2.8
+ */
+#define ULOC_KEYWORD_ITEM_SEPARATOR ';'
+
+/**
+  * Unicode code point for ';' separating keywords
+  * @see ULOC_KEYWORD_ITEM_SEPARATOR
+  * @stable ICU 4.6
+  */
+#define ULOC_KEYWORD_ITEM_SEPARATOR_UNICODE 0x3B
+
+/**
+ * Constants for *_getLocale()
+ * Allow user to select whether she wants information on 
+ * requested, valid or actual locale.
+ * For example, a collator for "en_US_CALIFORNIA" was
+ * requested. In the current state of ICU (2.0), 
+ * the requested locale is "en_US_CALIFORNIA",
+ * the valid locale is "en_US" (most specific locale supported by ICU)
+ * and the actual locale is "root" (the collation data comes unmodified 
+ * from the UCA)
+ * The locale is considered supported by ICU if there is a core ICU bundle 
+ * for that locale (although it may be empty).
+ * @stable ICU 2.1
+ */
+typedef enum {
+  /** This is locale the data actually comes from 
+   * @stable ICU 2.1
+   */
+  ULOC_ACTUAL_LOCALE    = 0,
+  /** This is the most specific locale supported by ICU 
+   * @stable ICU 2.1
+   */
+  ULOC_VALID_LOCALE    = 1,
+
+#ifndef U_HIDE_DEPRECATED_API
+  /** This is the requested locale
+   *  @deprecated ICU 2.8 
+   */
+  ULOC_REQUESTED_LOCALE = 2,
+#endif /* U_HIDE_DEPRECATED_API */
+
+  ULOC_DATA_LOCALE_TYPE_LIMIT = 3
+} ULocDataLocaleType ;
+
+#ifndef U_HIDE_SYSTEM_API
+/**
+ * Gets ICU's default locale.  
+ * The returned string is a snapshot in time, and will remain valid
+ *   and unchanged even when uloc_setDefault() is called.
+ *   The returned storage is owned by ICU, and must not be altered or deleted
+ *   by the caller.
+ *  
+ * @return the ICU default locale
+ * @system
+ * @stable ICU 2.0
+ */
+U_STABLE const char* U_EXPORT2
+uloc_getDefault(void);
+
+/**
+ * Sets ICU's default locale.  
+ *    By default (without calling this function), ICU's default locale will be based
+ *    on information obtained from the underlying system environment.
+ *    <p>
+ *    Changes to ICU's default locale do not propagate back to the
+ *    system environment.
+ *    <p>
+ *    Changes to ICU's default locale to not affect any ICU services that
+ *    may already be open based on the previous default locale value.
+ *
+ * @param localeID the new ICU default locale. A value of NULL will try to get
+ *                 the system's default locale.
+ * @param status the error information if the setting of default locale fails
+ * @system
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+uloc_setDefault(const char* localeID,
+        UErrorCode*       status);
+#endif  /* U_HIDE_SYSTEM_API */
+
+/**
+ * Gets the language code for the specified locale.
+ *
+ * @param localeID the locale to get the ISO language code with
+ * @param language the language code for localeID
+ * @param languageCapacity the size of the language buffer to store the  
+ * language code with
+ * @param err error information if retrieving the language code failed
+ * @return the actual buffer size needed for the language code.  If it's greater 
+ * than languageCapacity, the returned language code will be truncated.  
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getLanguage(const char*    localeID,
+         char* language,
+         int32_t languageCapacity,
+         UErrorCode* err);
+
+/**
+ * Gets the script code for the specified locale.
+ *
+ * @param localeID the locale to get the ISO language code with
+ * @param script the language code for localeID
+ * @param scriptCapacity the size of the language buffer to store the  
+ * language code with
+ * @param err error information if retrieving the language code failed
+ * @return the actual buffer size needed for the language code.  If it's greater 
+ * than scriptCapacity, the returned language code will be truncated.  
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getScript(const char*    localeID,
+         char* script,
+         int32_t scriptCapacity,
+         UErrorCode* err);
+
+/**
+ * Gets the  country code for the specified locale.
+ *
+ * @param localeID the locale to get the country code with
+ * @param country the country code for localeID
+ * @param countryCapacity the size of the country buffer to store the  
+ * country code with
+ * @param err error information if retrieving the country code failed
+ * @return the actual buffer size needed for the country code.  If it's greater 
+ * than countryCapacity, the returned country code will be truncated.  
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getCountry(const char*    localeID,
+        char* country,
+        int32_t countryCapacity,
+        UErrorCode* err);
+
+/**
+ * Gets the variant code for the specified locale.
+ *
+ * @param localeID the locale to get the variant code with
+ * @param variant the variant code for localeID
+ * @param variantCapacity the size of the variant buffer to store the 
+ * variant code with
+ * @param err error information if retrieving the variant code failed
+ * @return the actual buffer size needed for the variant code.  If it's greater 
+ * than variantCapacity, the returned variant code will be truncated.  
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getVariant(const char*    localeID,
+        char* variant,
+        int32_t variantCapacity,
+        UErrorCode* err);
+
+
+/**
+ * Gets the full name for the specified locale.
+ * Note: This has the effect of 'canonicalizing' the ICU locale ID to
+ * a certain extent. Upper and lower case are set as needed.
+ * It does NOT map aliased names in any way.
+ * See the top of this header file.
+ * This API supports preflighting.
+ *
+ * @param localeID the locale to get the full name with
+ * @param name fill in buffer for the name without keywords.
+ * @param nameCapacity capacity of the fill in buffer.
+ * @param err error information if retrieving the full name failed
+ * @return the actual buffer size needed for the full name.  If it's greater 
+ * than nameCapacity, the returned full name will be truncated.  
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getName(const char*    localeID,
+         char* name,
+         int32_t nameCapacity,
+         UErrorCode* err);
+
+/**
+ * Gets the full name for the specified locale.
+ * Note: This has the effect of 'canonicalizing' the string to
+ * a certain extent. Upper and lower case are set as needed,
+ * and if the components were in 'POSIX' format they are changed to
+ * ICU format.  It does NOT map aliased names in any way.
+ * See the top of this header file.
+ *
+ * @param localeID the locale to get the full name with
+ * @param name the full name for localeID
+ * @param nameCapacity the size of the name buffer to store the 
+ * full name with
+ * @param err error information if retrieving the full name failed
+ * @return the actual buffer size needed for the full name.  If it's greater 
+ * than nameCapacity, the returned full name will be truncated.  
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_canonicalize(const char*    localeID,
+         char* name,
+         int32_t nameCapacity,
+         UErrorCode* err);
+
+/**
+ * Gets the ISO language code for the specified locale.
+ *
+ * @param localeID the locale to get the ISO language code with
+ * @return language the ISO language code for localeID
+ * @stable ICU 2.0
+ */
+U_STABLE const char* U_EXPORT2
+uloc_getISO3Language(const char* localeID);
+
+
+/**
+ * Gets the ISO country code for the specified locale.
+ *
+ * @param localeID the locale to get the ISO country code with
+ * @return country the ISO country code for localeID
+ * @stable ICU 2.0
+ */
+U_STABLE const char* U_EXPORT2
+uloc_getISO3Country(const char* localeID);
+
+/**
+ * Gets the Win32 LCID value for the specified locale.
+ * If the ICU locale is not recognized by Windows, 0 will be returned.
+ *
+ * @param localeID the locale to get the Win32 LCID value with
+ * @return country the Win32 LCID for localeID
+ * @stable ICU 2.0
+ */
+U_STABLE uint32_t U_EXPORT2
+uloc_getLCID(const char* localeID);
+
+/**
+ * Gets the language name suitable for display for the specified locale.
+ *
+ * @param locale the locale to get the ISO language code with
+ * @param displayLocale Specifies the locale to be used to display the name.  In other words,
+ *                 if the locale's language code is "en", passing Locale::getFrench() for
+ *                 inLocale would result in "Anglais", while passing Locale::getGerman()
+ *                 for inLocale would result in "Englisch".
+ * @param language the displayable language code for localeID
+ * @param languageCapacity the size of the language buffer to store the  
+ * displayable language code with
+ * @param status error information if retrieving the displayable language code failed
+ * @return the actual buffer size needed for the displayable language code.  If it's greater 
+ * than languageCapacity, the returned language code will be truncated.  
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getDisplayLanguage(const char* locale,
+            const char* displayLocale,
+            UChar* language,
+            int32_t languageCapacity,
+            UErrorCode* status);
+
+/**
+ * Gets the script name suitable for display for the specified locale.
+ *
+ * @param locale the locale to get the displayable script code with. NULL may be used to specify the default.
+ * @param displayLocale Specifies the locale to be used to display the name.  In other words,
+ *                 if the locale's language code is "en", passing Locale::getFrench() for
+ *                 inLocale would result in "", while passing Locale::getGerman()
+ *                 for inLocale would result in "". NULL may be used to specify the default.
+ * @param script the displayable country code for localeID
+ * @param scriptCapacity the size of the script buffer to store the  
+ * displayable script code with
+ * @param status error information if retrieving the displayable script code failed
+ * @return the actual buffer size needed for the displayable script code.  If it's greater 
+ * than scriptCapacity, the returned displayable script code will be truncated.  
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getDisplayScript(const char* locale,
+            const char* displayLocale,
+            UChar* script,
+            int32_t scriptCapacity,
+            UErrorCode* status);
+
+/**
+ * Gets the country name suitable for display for the specified locale.
+ *
+ * @param locale the locale to get the displayable country code with. NULL may be used to specify the default.
+ * @param displayLocale Specifies the locale to be used to display the name.  In other words,
+ *                 if the locale's language code is "en", passing Locale::getFrench() for
+ *                 inLocale would result in "Anglais", while passing Locale::getGerman()
+ *                 for inLocale would result in "Englisch". NULL may be used to specify the default.
+ * @param country the displayable country code for localeID
+ * @param countryCapacity the size of the country buffer to store the  
+ * displayable country code with
+ * @param status error information if retrieving the displayable country code failed
+ * @return the actual buffer size needed for the displayable country code.  If it's greater 
+ * than countryCapacity, the returned displayable country code will be truncated.  
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getDisplayCountry(const char* locale,
+                       const char* displayLocale,
+                       UChar* country,
+                       int32_t countryCapacity,
+                       UErrorCode* status);
+
+
+/**
+ * Gets the variant name suitable for display for the specified locale.
+ *
+ * @param locale the locale to get the displayable variant code with. NULL may be used to specify the default.
+ * @param displayLocale Specifies the locale to be used to display the name.  In other words,
+ *                 if the locale's language code is "en", passing Locale::getFrench() for
+ *                 inLocale would result in "Anglais", while passing Locale::getGerman()
+ *                 for inLocale would result in "Englisch". NULL may be used to specify the default.
+ * @param variant the displayable variant code for localeID
+ * @param variantCapacity the size of the variant buffer to store the 
+ * displayable variant code with
+ * @param status error information if retrieving the displayable variant code failed
+ * @return the actual buffer size needed for the displayable variant code.  If it's greater 
+ * than variantCapacity, the returned displayable variant code will be truncated.  
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getDisplayVariant(const char* locale,
+                       const char* displayLocale,
+                       UChar* variant,
+                       int32_t variantCapacity,
+                       UErrorCode* status);
+
+/**
+ * Gets the keyword name suitable for display for the specified locale.
+ * E.g: for the locale string de_DE\@collation=PHONEBOOK, this API gets the display 
+ * string for the keyword collation. 
+ * Usage:
+ * <code>
+ *    UErrorCode status = U_ZERO_ERROR;
+ *    const char* keyword =NULL;
+ *    int32_t keywordLen = 0;
+ *    int32_t keywordCount = 0;
+ *    UChar displayKeyword[256];
+ *    int32_t displayKeywordLen = 0;
+ *    UEnumeration* keywordEnum = uloc_openKeywords("de_DE@collation=PHONEBOOK;calendar=TRADITIONAL", &status);
+ *    for(keywordCount = uenum_count(keywordEnum, &status); keywordCount > 0 ; keywordCount--){
+ *          if(U_FAILURE(status)){
+ *              ...something went wrong so handle the error...
+ *              break;
+ *          }
+ *          // the uenum_next returns NUL terminated string
+ *          keyword = uenum_next(keywordEnum, &keywordLen, &status);
+ *          displayKeywordLen = uloc_getDisplayKeyword(keyword, "en_US", displayKeyword, 256);
+ *          ... do something interesting .....
+ *    }
+ *    uenum_close(keywordEnum);
+ * </code>
+ * @param keyword           The keyword whose display string needs to be returned.
+ * @param displayLocale     Specifies the locale to be used to display the name.  In other words,
+ *                          if the locale's language code is "en", passing Locale::getFrench() for
+ *                          inLocale would result in "Anglais", while passing Locale::getGerman()
+ *                          for inLocale would result in "Englisch". NULL may be used to specify the default.
+ * @param dest              the buffer to which the displayable keyword should be written.
+ * @param destCapacity      The size of the buffer (number of UChars). If it is 0, then
+ *                          dest may be NULL and the function will only return the length of the 
+ *                          result without writing any of the result string (pre-flighting).
+ * @param status            error information if retrieving the displayable string failed. 
+ *                          Should not be NULL and should not indicate failure on entry.
+ * @return the actual buffer size needed for the displayable variant code.  
+ * @see #uloc_openKeywords
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getDisplayKeyword(const char* keyword,
+                       const char* displayLocale,
+                       UChar* dest,
+                       int32_t destCapacity,
+                       UErrorCode* status);
+/**
+ * Gets the value of the keyword suitable for display for the specified locale.
+ * E.g: for the locale string de_DE\@collation=PHONEBOOK, this API gets the display 
+ * string for PHONEBOOK, in the display locale, when "collation" is specified as the keyword.
+ *
+ * @param locale            The locale to get the displayable variant code with. NULL may be used to specify the default.
+ * @param keyword           The keyword for whose value should be used.
+ * @param displayLocale     Specifies the locale to be used to display the name.  In other words,
+ *                          if the locale's language code is "en", passing Locale::getFrench() for
+ *                          inLocale would result in "Anglais", while passing Locale::getGerman()
+ *                          for inLocale would result in "Englisch". NULL may be used to specify the default.
+ * @param dest              the buffer to which the displayable keyword should be written.
+ * @param destCapacity      The size of the buffer (number of UChars). If it is 0, then
+ *                          dest may be NULL and the function will only return the length of the 
+ *                          result without writing any of the result string (pre-flighting).
+ * @param status            error information if retrieving the displayable string failed. 
+ *                          Should not be NULL and must not indicate failure on entry.
+ * @return the actual buffer size needed for the displayable variant code.  
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getDisplayKeywordValue(   const char* locale,
+                               const char* keyword,
+                               const char* displayLocale,
+                               UChar* dest,
+                               int32_t destCapacity,
+                               UErrorCode* status);
+/**
+ * Gets the full name suitable for display for the specified locale.
+ *
+ * @param localeID the locale to get the displayable name with. NULL may be used to specify the default.
+ * @param inLocaleID Specifies the locale to be used to display the name.  In other words,
+ *                   if the locale's language code is "en", passing Locale::getFrench() for
+ *                   inLocale would result in "Anglais", while passing Locale::getGerman()
+ *                   for inLocale would result in "Englisch". NULL may be used to specify the default.
+ * @param result the displayable name for localeID
+ * @param maxResultSize the size of the name buffer to store the 
+ * displayable full name with
+ * @param err error information if retrieving the displayable name failed
+ * @return the actual buffer size needed for the displayable name.  If it's greater 
+ * than maxResultSize, the returned displayable name will be truncated.  
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getDisplayName(const char* localeID,
+            const char* inLocaleID,
+            UChar* result,
+            int32_t maxResultSize,
+            UErrorCode* err);
+
+
+/**
+ * Gets the specified locale from a list of all available locales.  
+ * The return value is a pointer to an item of 
+ * a locale name array.  Both this array and the pointers
+ * it contains are owned by ICU and should not be deleted or written through
+ * by the caller.  The locale name is terminated by a null pointer.
+ * @param n the specific locale name index of the available locale list
+ * @return a specified locale name of all available locales
+ * @stable ICU 2.0
+ */
+U_STABLE const char* U_EXPORT2
+uloc_getAvailable(int32_t n);
+
+/**
+ * Gets the size of the all available locale list.
+ *
+ * @return the size of the locale list
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 uloc_countAvailable(void);
+
+/**
+ *
+ * Gets a list of all available 2-letter language codes defined in ISO 639,
+ * plus additional 3-letter codes determined to be useful for locale generation as
+ * defined by Unicode CLDR. This is a pointer
+ * to an array of pointers to arrays of char.  All of these pointers are owned
+ * by ICU-- do not delete them, and do not write through them.  The array is
+ * terminated with a null pointer.
+ * @return a list of all available language codes
+ * @stable ICU 2.0
+ */
+U_STABLE const char* const* U_EXPORT2
+uloc_getISOLanguages(void);
+
+/**
+ *
+ * Gets a list of all available 2-letter country codes defined in ISO 639.  This is a
+ * pointer to an array of pointers to arrays of char.  All of these pointers are
+ * owned by ICU-- do not delete them, and do not write through them.  The array is
+ * terminated with a null pointer.
+ * @return a list of all available country codes
+ * @stable ICU 2.0
+ */
+U_STABLE const char* const* U_EXPORT2
+uloc_getISOCountries(void);
+
+/**
+ * Truncate the locale ID string to get the parent locale ID.
+ * Copies the part of the string before the last underscore.
+ * The parent locale ID will be an empty string if there is no
+ * underscore, or if there is only one underscore at localeID[0].
+ *
+ * @param localeID Input locale ID string.
+ * @param parent   Output string buffer for the parent locale ID.
+ * @param parentCapacity Size of the output buffer.
+ * @param err A UErrorCode value.
+ * @return The length of the parent locale ID.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getParent(const char*    localeID,
+                 char* parent,
+                 int32_t parentCapacity,
+                 UErrorCode* err);
+
+
+
+
+/**
+ * Gets the full name for the specified locale, like uloc_getName(),
+ * but without keywords.
+ *
+ * Note: This has the effect of 'canonicalizing' the string to
+ * a certain extent. Upper and lower case are set as needed,
+ * and if the components were in 'POSIX' format they are changed to
+ * ICU format.  It does NOT map aliased names in any way.
+ * See the top of this header file.
+ *
+ * This API strips off the keyword part, so "de_DE\@collation=phonebook" 
+ * will become "de_DE". 
+ * This API supports preflighting.
+ *
+ * @param localeID the locale to get the full name with
+ * @param name fill in buffer for the name without keywords.
+ * @param nameCapacity capacity of the fill in buffer.
+ * @param err error information if retrieving the full name failed
+ * @return the actual buffer size needed for the full name.  If it's greater 
+ * than nameCapacity, the returned full name will be truncated.  
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getBaseName(const char*    localeID,
+         char* name,
+         int32_t nameCapacity,
+         UErrorCode* err);
+
+/**
+ * Gets an enumeration of keywords for the specified locale. Enumeration
+ * must get disposed of by the client using uenum_close function.
+ *
+ * @param localeID the locale to get the variant code with
+ * @param status error information if retrieving the keywords failed
+ * @return enumeration of keywords or NULL if there are no keywords.
+ * @stable ICU 2.8
+ */
+U_STABLE UEnumeration* U_EXPORT2
+uloc_openKeywords(const char* localeID,
+                        UErrorCode* status);
+
+/**
+ * Get the value for a keyword. Locale name does not need to be normalized.
+ * 
+ * @param localeID locale name containing the keyword ("de_DE@currency=EURO;collation=PHONEBOOK")
+ * @param keywordName name of the keyword for which we want the value. Case insensitive.
+ * @param buffer receiving buffer
+ * @param bufferCapacity capacity of receiving buffer
+ * @param status containing error code - buffer not big enough.
+ * @return the length of keyword value
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getKeywordValue(const char* localeID,
+                     const char* keywordName,
+                     char* buffer, int32_t bufferCapacity,
+                     UErrorCode* status);
+
+
+/**
+ * Sets or removes the value of the specified keyword.
+ *
+ * For removing all keywords, use uloc_getBaseName().
+ *
+ * NOTE: Unlike almost every other ICU function which takes a
+ * buffer, this function will NOT truncate the output text. If a
+ * BUFFER_OVERFLOW_ERROR is received, it means that the original
+ * buffer is untouched. This is done to prevent incorrect or possibly
+ * even malformed locales from being generated and used.
+ *
+ * @param keywordName name of the keyword to be set. Case insensitive.
+ * @param keywordValue value of the keyword to be set. If 0-length or
+ *  NULL, will result in the keyword being removed. No error is given if 
+ *  that keyword does not exist.
+ * @param buffer input buffer containing locale to be modified.
+ * @param bufferCapacity capacity of receiving buffer
+ * @param status containing error code - buffer not big enough.
+ * @return the length needed for the buffer
+ * @see uloc_getKeywordValue
+ * @stable ICU 3.2
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_setKeywordValue(const char* keywordName,
+                     const char* keywordValue,
+                     char* buffer, int32_t bufferCapacity,
+                     UErrorCode* status);
+
+/**
+ * enums for the  return value for the character and line orientation
+ * functions.
+ * @stable ICU 4.0
+ */
+typedef enum {
+  ULOC_LAYOUT_LTR   = 0,  /* left-to-right. */
+  ULOC_LAYOUT_RTL    = 1,  /* right-to-left. */
+  ULOC_LAYOUT_TTB    = 2,  /* top-to-bottom. */
+  ULOC_LAYOUT_BTT    = 3,   /* bottom-to-top. */
+  ULOC_LAYOUT_UNKNOWN
+} ULayoutType;
+
+/**
+ * Get the layout character orientation for the specified locale.
+ * 
+ * @param localeId locale name
+ * @param status Error status
+ * @return an enum indicating the layout orientation for characters.
+ * @stable ICU 4.0
+ */
+U_STABLE ULayoutType U_EXPORT2
+uloc_getCharacterOrientation(const char* localeId,
+                             UErrorCode *status);
+
+/**
+ * Get the layout line orientation for the specified locale.
+ * 
+ * @param localeId locale name
+ * @param status Error status
+ * @return an enum indicating the layout orientation for lines.
+ * @stable ICU 4.0
+ */
+U_STABLE ULayoutType U_EXPORT2
+uloc_getLineOrientation(const char* localeId,
+                        UErrorCode *status);
+
+/**
+ * enums for the 'outResult' parameter return value
+ * @see uloc_acceptLanguageFromHTTP
+ * @see uloc_acceptLanguage
+ * @stable ICU 3.2
+ */
+typedef enum {
+  ULOC_ACCEPT_FAILED   = 0,  /* No exact match was found. */
+  ULOC_ACCEPT_VALID    = 1,  /* An exact match was found. */
+  ULOC_ACCEPT_FALLBACK = 2   /* A fallback was found, for example, 
+                                Accept list contained 'ja_JP'
+                                which matched available locale 'ja'. */
+} UAcceptResult;
+
+
+/**
+ * Based on a HTTP header from a web browser and a list of available locales,
+ * determine an acceptable locale for the user.
+ * @param result - buffer to accept the result locale
+ * @param resultAvailable the size of the result buffer.
+ * @param outResult - An out parameter that contains the fallback status
+ * @param httpAcceptLanguage - "Accept-Language:" header as per HTTP.
+ * @param availableLocales - list of available locales to match
+ * @param status Error status, may be BUFFER_OVERFLOW_ERROR
+ * @return length needed for the locale.
+ * @stable ICU 3.2
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_acceptLanguageFromHTTP(char *result, int32_t resultAvailable,
+                            UAcceptResult *outResult,
+                            const char *httpAcceptLanguage,
+                            UEnumeration* availableLocales,
+                            UErrorCode *status);
+
+/**
+ * Based on a list of available locales,
+ * determine an acceptable locale for the user.
+ * @param result - buffer to accept the result locale
+ * @param resultAvailable the size of the result buffer.
+ * @param outResult - An out parameter that contains the fallback status
+ * @param acceptList - list of acceptable languages
+ * @param acceptListCount - count of acceptList items
+ * @param availableLocales - list of available locales to match
+ * @param status Error status, may be BUFFER_OVERFLOW_ERROR
+ * @return length needed for the locale.
+ * @stable ICU 3.2
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_acceptLanguage(char *result, int32_t resultAvailable, 
+                    UAcceptResult *outResult, const char **acceptList,
+                    int32_t acceptListCount,
+                    UEnumeration* availableLocales,
+                    UErrorCode *status);
+
+
+/**
+ * Gets the ICU locale ID for the specified Win32 LCID value.
+ *
+ * @param hostID the Win32 LCID to translate
+ * @param locale the output buffer for the ICU locale ID, which will be NUL-terminated
+ *  if there is room.
+ * @param localeCapacity the size of the output buffer
+ * @param status an error is returned if the LCID is unrecognized or the output buffer
+ *  is too small
+ * @return actual the actual size of the locale ID, not including NUL-termination 
+ * @stable ICU 3.8
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_getLocaleForLCID(uint32_t hostID, char *locale, int32_t localeCapacity,
+                    UErrorCode *status);
+
+
+/**
+ * Add the likely subtags for a provided locale ID, per the algorithm described
+ * in the following CLDR technical report:
+ *
+ *   http://www.unicode.org/reports/tr35/#Likely_Subtags
+ *
+ * If localeID is already in the maximal form, or there is no data available
+ * for maximization, it will be copied to the output buffer.  For example,
+ * "und-Zzzz" cannot be maximized, since there is no reasonable maximization.
+ *
+ * Examples:
+ *
+ * "en" maximizes to "en_Latn_US"
+ *
+ * "de" maximizes to "de_Latn_US"
+ *
+ * "sr" maximizes to "sr_Cyrl_RS"
+ *
+ * "sh" maximizes to "sr_Latn_RS" (Note this will not reverse.)
+ *
+ * "zh_Hani" maximizes to "zh_Hans_CN" (Note this will not reverse.)
+ *
+ * @param localeID The locale to maximize
+ * @param maximizedLocaleID The maximized locale
+ * @param maximizedLocaleIDCapacity The capacity of the maximizedLocaleID buffer
+ * @param err Error information if maximizing the locale failed.  If the length
+ * of the localeID and the null-terminator is greater than the maximum allowed size,
+ * or the localeId is not well-formed, the error code is U_ILLEGAL_ARGUMENT_ERROR.
+ * @return The actual buffer size needed for the maximized locale.  If it's
+ * greater than maximizedLocaleIDCapacity, the returned ID will be truncated.
+ * On error, the return value is -1.
+ * @stable ICU 4.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_addLikelySubtags(const char*    localeID,
+         char* maximizedLocaleID,
+         int32_t maximizedLocaleIDCapacity,
+         UErrorCode* err);
+
+
+/**
+ * Minimize the subtags for a provided locale ID, per the algorithm described
+ * in the following CLDR technical report:
+ *
+ *   http://www.unicode.org/reports/tr35/#Likely_Subtags
+ *
+ * If localeID is already in the minimal form, or there is no data available
+ * for minimization, it will be copied to the output buffer.  Since the
+ * minimization algorithm relies on proper maximization, see the comments
+ * for uloc_addLikelySubtags for reasons why there might not be any data.
+ *
+ * Examples:
+ *
+ * "en_Latn_US" minimizes to "en"
+ *
+ * "de_Latn_US" minimizes to "de"
+ *
+ * "sr_Cyrl_RS" minimizes to "sr"
+ *
+ * "zh_Hant_TW" minimizes to "zh_TW" (The region is preferred to the
+ * script, and minimizing to "zh" would imply "zh_Hans_CN".)
+ *
+ * @param localeID The locale to minimize
+ * @param minimizedLocaleID The minimized locale
+ * @param minimizedLocaleIDCapacity The capacity of the minimizedLocaleID buffer
+ * @param err Error information if minimizing the locale failed.  If the length
+ * of the localeID and the null-terminator is greater than the maximum allowed size,
+ * or the localeId is not well-formed, the error code is U_ILLEGAL_ARGUMENT_ERROR.
+ * @return The actual buffer size needed for the minimized locale.  If it's
+ * greater than minimizedLocaleIDCapacity, the returned ID will be truncated.
+ * On error, the return value is -1.
+ * @stable ICU 4.0
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_minimizeSubtags(const char*    localeID,
+         char* minimizedLocaleID,
+         int32_t minimizedLocaleIDCapacity,
+         UErrorCode* err);
+
+/**
+ * Returns a locale ID for the specified BCP47 language tag string.
+ * If the specified language tag contains any ill-formed subtags,
+ * the first such subtag and all following subtags are ignored.
+ * <p> 
+ * This implements the 'Language-Tag' production of BCP47, and so
+ * supports grandfathered (regular and irregular) as well as private
+ * use language tags.  Private use tags are represented as 'x-whatever',
+ * and grandfathered tags are converted to their canonical replacements
+ * where they exist.  Note that a few grandfathered tags have no modern
+ * replacement, these will be converted using the fallback described in
+ * the first paragraph, so some information might be lost.
+ * @param langtag   the input BCP47 language tag.
+ * @param localeID  the output buffer receiving a locale ID for the
+ *                  specified BCP47 language tag.
+ * @param localeIDCapacity  the size of the locale ID output buffer.
+ * @param parsedLength  if not NULL, successfully parsed length
+ *                      for the input language tag is set.
+ * @param err       error information if receiving the locald ID
+ *                  failed.
+ * @return          the length of the locale ID.
+ * @stable ICU 4.2
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_forLanguageTag(const char* langtag,
+                    char* localeID,
+                    int32_t localeIDCapacity,
+                    int32_t* parsedLength,
+                    UErrorCode* err);
+
+/**
+ * Returns a well-formed language tag for this locale ID. 
+ * <p> 
+ * <b>Note</b>: When <code>strict</code> is FALSE, any locale
+ * fields which do not satisfy the BCP47 syntax requirement will
+ * be omitted from the result.  When <code>strict</code> is
+ * TRUE, this function sets U_ILLEGAL_ARGUMENT_ERROR to the
+ * <code>err</code> if any locale fields do not satisfy the
+ * BCP47 syntax requirement.
+ * @param localeID  the input locale ID
+ * @param langtag   the output buffer receiving BCP47 language
+ *                  tag for the locale ID.
+ * @param langtagCapacity   the size of the BCP47 language tag
+ *                          output buffer.
+ * @param strict    boolean value indicating if the function returns
+ *                  an error for an ill-formed input locale ID.
+ * @param err       error information if receiving the language
+ *                  tag failed.
+ * @return          The length of the BCP47 language tag.
+ * @stable ICU 4.2
+ */
+U_STABLE int32_t U_EXPORT2
+uloc_toLanguageTag(const char* localeID,
+                   char* langtag,
+                   int32_t langtagCapacity,
+                   UBool strict,
+                   UErrorCode* err);
+
+#endif /*_ULOC*/
diff --git a/icu/unicode/umachine.h b/icu/unicode/umachine.h
new file mode 100644
index 0000000..d1102f4
--- /dev/null
+++ b/icu/unicode/umachine.h
@@ -0,0 +1,322 @@
+/*
+******************************************************************************
+*
+*   Copyright (C) 1999-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+******************************************************************************
+*   file name:  umachine.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 1999sep13
+*   created by: Markus W. Scherer
+*
+*   This file defines basic types and constants for utf.h to be
+*   platform-independent. umachine.h and utf.h are included into
+*   utypes.h to provide all the general definitions for ICU.
+*   All of these definitions used to be in utypes.h before
+*   the UTF-handling macros made this unmaintainable.
+*/
+
+#ifndef __UMACHINE_H__
+#define __UMACHINE_H__
+
+
+/**
+ * \file
+ * \brief Basic types and constants for UTF
+ *
+ * <h2> Basic types and constants for UTF </h2>
+ *   This file defines basic types and constants for utf.h to be
+ *   platform-independent. umachine.h and utf.h are included into
+ *   utypes.h to provide all the general definitions for ICU.
+ *   All of these definitions used to be in utypes.h before
+ *   the UTF-handling macros made this unmaintainable.
+ *
+ */
+/*==========================================================================*/
+/* Include platform-dependent definitions                                   */
+/* which are contained in the platform-specific file platform.h             */
+/*==========================================================================*/
+
+#include "unicode/ptypes.h" /* platform.h is included in ptypes.h */
+
+/*
+ * ANSI C headers:
+ * stddef.h defines wchar_t
+ */
+#include <stddef.h>
+
+/*==========================================================================*/
+/* For C wrappers, we use the symbol U_STABLE.                                */
+/* This works properly if the includer is C or C++.                         */
+/* Functions are declared   U_STABLE return-type U_EXPORT2 function-name()... */
+/*==========================================================================*/
+
+/**
+ * \def U_CFUNC
+ * This is used in a declaration of a library private ICU C function.
+ * @stable ICU 2.4
+ */
+
+/**
+ * \def U_CDECL_BEGIN
+ * This is used to begin a declaration of a library private ICU C API.
+ * @stable ICU 2.4
+ */
+
+/**
+ * \def U_CDECL_END
+ * This is used to end a declaration of a library private ICU C API
+ * @stable ICU 2.4
+ */
+
+#ifdef __cplusplus
+#   define U_CFUNC extern "C"
+#   define U_CDECL_BEGIN extern "C" {
+#   define U_CDECL_END   }
+#else
+#   define U_CFUNC extern
+#   define U_CDECL_BEGIN
+#   define U_CDECL_END
+#endif
+
+#ifndef U_ATTRIBUTE_DEPRECATED
+/**
+ * \def U_ATTRIBUTE_DEPRECATED
+ *  This is used for GCC specific attributes
+ * @internal
+ */
+#if U_GCC_MAJOR_MINOR >= 302
+#    define U_ATTRIBUTE_DEPRECATED __attribute__ ((deprecated))
+/**
+ * \def U_ATTRIBUTE_DEPRECATED
+ * This is used for Visual C++ specific attributes 
+ * @internal
+ */
+#elif defined(_MSC_VER) && (_MSC_VER >= 1400)
+#    define U_ATTRIBUTE_DEPRECATED __declspec(deprecated)
+#else
+#    define U_ATTRIBUTE_DEPRECATED
+#endif
+#endif
+
+/** This is used to declare a function as a public ICU C API @stable ICU 2.0*/
+#define U_CAPI U_CFUNC U_EXPORT
+/** This is used to declare a function as a stable public ICU C API*/
+#define U_STABLE U_CAPI
+/** This is used to declare a function as a draft public ICU C API  */
+#define U_DRAFT  U_CAPI
+/** This is used to declare a function as a deprecated public ICU C API  */
+#define U_DEPRECATED U_CAPI U_ATTRIBUTE_DEPRECATED
+/** This is used to declare a function as an obsolete public ICU C API  */
+#define U_OBSOLETE U_CAPI
+/** This is used to declare a function as an internal ICU C API  */
+#define U_INTERNAL U_CAPI
+
+/*==========================================================================*/
+/* limits for int32_t etc., like in POSIX inttypes.h                        */
+/*==========================================================================*/
+
+#ifndef INT8_MIN
+/** The smallest value an 8 bit signed integer can hold @stable ICU 2.0 */
+#   define INT8_MIN        ((int8_t)(-128))
+#endif
+#ifndef INT16_MIN
+/** The smallest value a 16 bit signed integer can hold @stable ICU 2.0 */
+#   define INT16_MIN       ((int16_t)(-32767-1))
+#endif
+#ifndef INT32_MIN
+/** The smallest value a 32 bit signed integer can hold @stable ICU 2.0 */
+#   define INT32_MIN       ((int32_t)(-2147483647-1))
+#endif
+
+#ifndef INT8_MAX
+/** The largest value an 8 bit signed integer can hold @stable ICU 2.0 */
+#   define INT8_MAX        ((int8_t)(127))
+#endif
+#ifndef INT16_MAX
+/** The largest value a 16 bit signed integer can hold @stable ICU 2.0 */
+#   define INT16_MAX       ((int16_t)(32767))
+#endif
+#ifndef INT32_MAX
+/** The largest value a 32 bit signed integer can hold @stable ICU 2.0 */
+#   define INT32_MAX       ((int32_t)(2147483647))
+#endif
+
+#ifndef UINT8_MAX
+/** The largest value an 8 bit unsigned integer can hold @stable ICU 2.0 */
+#   define UINT8_MAX       ((uint8_t)(255U))
+#endif
+#ifndef UINT16_MAX
+/** The largest value a 16 bit unsigned integer can hold @stable ICU 2.0 */
+#   define UINT16_MAX      ((uint16_t)(65535U))
+#endif
+#ifndef UINT32_MAX
+/** The largest value a 32 bit unsigned integer can hold @stable ICU 2.0 */
+#   define UINT32_MAX      ((uint32_t)(4294967295U))
+#endif
+
+#if defined(U_INT64_T_UNAVAILABLE)
+# error int64_t is required for decimal format and rule-based number format.
+#else
+# ifndef INT64_C
+/**
+ * Provides a platform independent way to specify a signed 64-bit integer constant.
+ * note: may be wrong for some 64 bit platforms - ensure your compiler provides INT64_C
+ * @stable ICU 2.8
+ */
+#   define INT64_C(c) c ## LL
+# endif
+# ifndef UINT64_C
+/**
+ * Provides a platform independent way to specify an unsigned 64-bit integer constant.
+ * note: may be wrong for some 64 bit platforms - ensure your compiler provides UINT64_C
+ * @stable ICU 2.8
+ */
+#   define UINT64_C(c) c ## ULL
+# endif
+# ifndef U_INT64_MIN
+/** The smallest value a 64 bit signed integer can hold @stable ICU 2.8 */
+#     define U_INT64_MIN       ((int64_t)(INT64_C(-9223372036854775807)-1))
+# endif
+# ifndef U_INT64_MAX
+/** The largest value a 64 bit signed integer can hold @stable ICU 2.8 */
+#     define U_INT64_MAX       ((int64_t)(INT64_C(9223372036854775807)))
+# endif
+# ifndef U_UINT64_MAX
+/** The largest value a 64 bit unsigned integer can hold @stable ICU 2.8 */
+#     define U_UINT64_MAX      ((uint64_t)(UINT64_C(18446744073709551615)))
+# endif
+#endif
+
+/*==========================================================================*/
+/* Boolean data type                                                        */
+/*==========================================================================*/
+
+/** The ICU boolean type @stable ICU 2.0 */
+typedef int8_t UBool;
+
+#ifndef TRUE
+/** The TRUE value of a UBool @stable ICU 2.0 */
+#   define TRUE  1
+#endif
+#ifndef FALSE
+/** The FALSE value of a UBool @stable ICU 2.0 */
+#   define FALSE 0
+#endif
+
+
+/*==========================================================================*/
+/* Unicode data types                                                       */
+/*==========================================================================*/
+
+/* wchar_t-related definitions -------------------------------------------- */
+
+/*
+ * \def U_WCHAR_IS_UTF16
+ * Defined if wchar_t uses UTF-16.
+ *
+ * @stable ICU 2.0
+ */
+/*
+ * \def U_WCHAR_IS_UTF32
+ * Defined if wchar_t uses UTF-32.
+ *
+ * @stable ICU 2.0
+ */
+#if !defined(U_WCHAR_IS_UTF16) && !defined(U_WCHAR_IS_UTF32)
+#   ifdef __STDC_ISO_10646__
+#       if (U_SIZEOF_WCHAR_T==2)
+#           define U_WCHAR_IS_UTF16
+#       elif (U_SIZEOF_WCHAR_T==4)
+#           define  U_WCHAR_IS_UTF32
+#       endif
+#   elif defined __UCS2__
+#       if (U_PF_OS390 <= U_PLATFORM && U_PLATFORM <= U_PF_OS400) && (U_SIZEOF_WCHAR_T==2)
+#           define U_WCHAR_IS_UTF16
+#       endif
+#   elif defined(__UCS4__) || (U_PLATFORM == U_PF_OS400 && defined(__UTF32__))
+#       if (U_SIZEOF_WCHAR_T==4)
+#           define U_WCHAR_IS_UTF32
+#       endif
+#   elif U_PLATFORM_IS_DARWIN_BASED || (U_SIZEOF_WCHAR_T==4 && U_PLATFORM_IS_LINUX_BASED)
+#       define U_WCHAR_IS_UTF32
+#   elif U_PLATFORM_HAS_WIN32_API
+#       define U_WCHAR_IS_UTF16
+#   endif
+#endif
+
+/* UChar and UChar32 definitions -------------------------------------------- */
+
+/** Number of bytes in a UChar. @stable ICU 2.0 */
+#define U_SIZEOF_UCHAR 2
+
+/**
+ * \var UChar
+ * Define UChar to be UCHAR_TYPE, if that is #defined (for example, to char16_t),
+ * or wchar_t if that is 16 bits wide; always assumed to be unsigned.
+ * If neither is available, then define UChar to be uint16_t.
+ *
+ * This makes the definition of UChar platform-dependent
+ * but allows direct string type compatibility with platforms with
+ * 16-bit wchar_t types.
+ *
+ * @stable ICU 4.4
+ */
+#if defined(UCHAR_TYPE)
+    typedef UCHAR_TYPE UChar;
+/* Not #elif U_HAVE_CHAR16_T -- because that is type-incompatible with pre-C++11 callers
+    typedef char16_t UChar;  */
+#elif U_SIZEOF_WCHAR_T==2
+    typedef wchar_t UChar;
+#elif defined(__CHAR16_TYPE__)
+    typedef __CHAR16_TYPE__ UChar;
+#else
+    typedef uint16_t UChar;
+#endif
+
+/**
+ * Define UChar32 as a type for single Unicode code points.
+ * UChar32 is a signed 32-bit integer (same as int32_t).
+ *
+ * The Unicode code point range is 0..0x10ffff.
+ * All other values (negative or >=0x110000) are illegal as Unicode code points.
+ * They may be used as sentinel values to indicate "done", "error"
+ * or similar non-code point conditions.
+ *
+ * Before ICU 2.4 (Jitterbug 2146), UChar32 was defined
+ * to be wchar_t if that is 32 bits wide (wchar_t may be signed or unsigned)
+ * or else to be uint32_t.
+ * That is, the definition of UChar32 was platform-dependent.
+ *
+ * @see U_SENTINEL
+ * @stable ICU 2.4
+ */
+typedef int32_t UChar32;
+
+/**
+ * This value is intended for sentinel values for APIs that
+ * (take or) return single code points (UChar32).
+ * It is outside of the Unicode code point range 0..0x10ffff.
+ * 
+ * For example, a "done" or "error" value in a new API
+ * could be indicated with U_SENTINEL.
+ *
+ * ICU APIs designed before ICU 2.4 usually define service-specific "done"
+ * values, mostly 0xffff.
+ * Those may need to be distinguished from
+ * actual U+ffff text contents by calling functions like
+ * CharacterIterator::hasNext() or UnicodeString::length().
+ *
+ * @return -1
+ * @see UChar32
+ * @stable ICU 2.4
+ */
+#define U_SENTINEL (-1)
+
+#include "unicode/urename.h"
+
+#endif
diff --git a/icu/unicode/umisc.h b/icu/unicode/umisc.h
new file mode 100644
index 0000000..d85451f
--- /dev/null
+++ b/icu/unicode/umisc.h
@@ -0,0 +1,60 @@
+/*
+**********************************************************************
+*   Copyright (C) 1999-2006, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+*   file name:  umisc.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 1999oct15
+*   created by: Markus W. Scherer
+*/
+
+#ifndef UMISC_H
+#define UMISC_H
+
+#include "unicode/utypes.h"
+
+/**
+ * \file
+ * \brief  C API:misc definitions 
+ *
+ *  This file contains miscellaneous definitions for the C APIs. 
+ */
+
+U_CDECL_BEGIN
+
+/** A struct representing a range of text containing a specific field 
+ *  @stable ICU 2.0
+ */
+typedef struct UFieldPosition {
+  /**
+   * The field 
+   * @stable ICU 2.0
+   */
+  int32_t field;
+  /**
+   * The start of the text range containing field 
+   * @stable ICU 2.0
+   */
+  int32_t beginIndex;
+  /** 
+   * The limit of the text range containing field 
+   * @stable ICU 2.0
+   */
+  int32_t endIndex;
+} UFieldPosition;
+
+#if !UCONFIG_NO_SERVICE
+/**
+ * Opaque type returned by registerInstance, registerFactory and unregister for service registration.
+ * @stable ICU 2.6
+ */
+typedef const void* URegistryKey;
+#endif
+
+U_CDECL_END
+
+#endif
diff --git a/icu/unicode/unorm.h b/icu/unicode/unorm.h
new file mode 100644
index 0000000..fbb7b49
--- /dev/null
+++ b/icu/unicode/unorm.h
@@ -0,0 +1,561 @@
+/*
+*******************************************************************************
+* Copyright (c) 1996-2010, International Business Machines Corporation
+*               and others. All Rights Reserved.
+*******************************************************************************
+* File unorm.h
+*
+* Created by: Vladimir Weinstein 12052000
+*
+* Modification history :
+*
+* Date        Name        Description
+* 02/01/01    synwee      Added normalization quickcheck enum and method.
+*/
+#ifndef UNORM_H
+#define UNORM_H
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_NORMALIZATION
+
+#include "unicode/uiter.h"
+#include "unicode/unorm2.h"
+
+/**
+ * \file
+ * \brief C API: Unicode Normalization 
+ *
+ * <h2>Unicode normalization API</h2>
+ *
+ * Note: This API has been replaced by the unorm2.h API and is only available
+ * for backward compatibility. The functions here simply delegate to the
+ * unorm2.h functions, for example unorm2_getInstance() and unorm2_normalize().
+ * There is one exception: The new API does not provide a replacement for unorm_compare().
+ *
+ * <code>unorm_normalize</code> transforms Unicode text into an equivalent composed or
+ * decomposed form, allowing for easier sorting and searching of text.
+ * <code>unorm_normalize</code> supports the standard normalization forms described in
+ * <a href="http://www.unicode.org/unicode/reports/tr15/" target="unicode">
+ * Unicode Standard Annex #15: Unicode Normalization Forms</a>.
+ *
+ * Characters with accents or other adornments can be encoded in
+ * several different ways in Unicode.  For example, take the character A-acute.
+ * In Unicode, this can be encoded as a single character (the
+ * "composed" form):
+ *
+ * \code
+ *      00C1    LATIN CAPITAL LETTER A WITH ACUTE
+ * \endcode
+ *
+ * or as two separate characters (the "decomposed" form):
+ *
+ * \code
+ *      0041    LATIN CAPITAL LETTER A
+ *      0301    COMBINING ACUTE ACCENT
+ * \endcode
+ *
+ * To a user of your program, however, both of these sequences should be
+ * treated as the same "user-level" character "A with acute accent".  When you are searching or
+ * comparing text, you must ensure that these two sequences are treated 
+ * equivalently.  In addition, you must handle characters with more than one
+ * accent.  Sometimes the order of a character's combining accents is
+ * significant, while in other cases accent sequences in different orders are
+ * really equivalent.
+ *
+ * Similarly, the string "ffi" can be encoded as three separate letters:
+ *
+ * \code
+ *      0066    LATIN SMALL LETTER F
+ *      0066    LATIN SMALL LETTER F
+ *      0069    LATIN SMALL LETTER I
+ * \endcode
+ *
+ * or as the single character
+ *
+ * \code
+ *      FB03    LATIN SMALL LIGATURE FFI
+ * \endcode
+ *
+ * The ffi ligature is not a distinct semantic character, and strictly speaking
+ * it shouldn't be in Unicode at all, but it was included for compatibility
+ * with existing character sets that already provided it.  The Unicode standard
+ * identifies such characters by giving them "compatibility" decompositions
+ * into the corresponding semantic characters.  When sorting and searching, you
+ * will often want to use these mappings.
+ *
+ * <code>unorm_normalize</code> helps solve these problems by transforming text into the
+ * canonical composed and decomposed forms as shown in the first example above.  
+ * In addition, you can have it perform compatibility decompositions so that 
+ * you can treat compatibility characters the same as their equivalents.
+ * Finally, <code>unorm_normalize</code> rearranges accents into the proper canonical
+ * order, so that you do not have to worry about accent rearrangement on your
+ * own.
+ *
+ * Form FCD, "Fast C or D", is also designed for collation.
+ * It allows to work on strings that are not necessarily normalized
+ * with an algorithm (like in collation) that works under "canonical closure", i.e., it treats precomposed
+ * characters and their decomposed equivalents the same.
+ *
+ * It is not a normalization form because it does not provide for uniqueness of representation. Multiple strings
+ * may be canonically equivalent (their NFDs are identical) and may all conform to FCD without being identical
+ * themselves.
+ *
+ * The form is defined such that the "raw decomposition", the recursive canonical decomposition of each character,
+ * results in a string that is canonically ordered. This means that precomposed characters are allowed for as long
+ * as their decompositions do not need canonical reordering.
+ *
+ * Its advantage for a process like collation is that all NFD and most NFC texts - and many unnormalized texts -
+ * already conform to FCD and do not need to be normalized (NFD) for such a process. The FCD quick check will
+ * return UNORM_YES for most strings in practice.
+ *
+ * unorm_normalize(UNORM_FCD) may be implemented with UNORM_NFD.
+ *
+ * For more details on FCD see the collation design document:
+ * http://source.icu-project.org/repos/icu/icuhtml/trunk/design/collation/ICU_collation_design.htm
+ *
+ * ICU collation performs either NFD or FCD normalization automatically if normalization
+ * is turned on for the collator object.
+ * Beyond collation and string search, normalized strings may be useful for string equivalence comparisons,
+ * transliteration/transcription, unique representations, etc.
+ *
+ * The W3C generally recommends to exchange texts in NFC.
+ * Note also that most legacy character encodings use only precomposed forms and often do not
+ * encode any combining marks by themselves. For conversion to such character encodings the
+ * Unicode text needs to be normalized to NFC.
+ * For more usage examples, see the Unicode Standard Annex.
+ */
+
+/**
+ * Constants for normalization modes.
+ * @stable ICU 2.0
+ */
+typedef enum {
+  /** No decomposition/composition. @stable ICU 2.0 */
+  UNORM_NONE = 1, 
+  /** Canonical decomposition. @stable ICU 2.0 */
+  UNORM_NFD = 2,
+  /** Compatibility decomposition. @stable ICU 2.0 */
+  UNORM_NFKD = 3,
+  /** Canonical decomposition followed by canonical composition. @stable ICU 2.0 */
+  UNORM_NFC = 4,
+  /** Default normalization. @stable ICU 2.0 */
+  UNORM_DEFAULT = UNORM_NFC, 
+  /** Compatibility decomposition followed by canonical composition. @stable ICU 2.0 */
+  UNORM_NFKC =5,
+  /** "Fast C or D" form. @stable ICU 2.0 */
+  UNORM_FCD = 6,
+
+  /** One more than the highest normalization mode constant. @stable ICU 2.0 */
+  UNORM_MODE_COUNT
+} UNormalizationMode;
+
+/**
+ * Constants for options flags for normalization.
+ * Use 0 for default options,
+ * including normalization according to the Unicode version
+ * that is currently supported by ICU (see u_getUnicodeVersion).
+ * @stable ICU 2.6
+ */
+enum {
+    /**
+     * Options bit set value to select Unicode 3.2 normalization
+     * (except NormalizationCorrections).
+     * At most one Unicode version can be selected at a time.
+     * @stable ICU 2.6
+     */
+    UNORM_UNICODE_3_2=0x20
+};
+
+/**
+ * Lowest-order bit number of unorm_compare() options bits corresponding to
+ * normalization options bits.
+ *
+ * The options parameter for unorm_compare() uses most bits for
+ * itself and for various comparison and folding flags.
+ * The most significant bits, however, are shifted down and passed on
+ * to the normalization implementation.
+ * (That is, from unorm_compare(..., options, ...),
+ * options>>UNORM_COMPARE_NORM_OPTIONS_SHIFT will be passed on to the
+ * internal normalization functions.)
+ *
+ * @see unorm_compare
+ * @stable ICU 2.6
+ */
+#define UNORM_COMPARE_NORM_OPTIONS_SHIFT 20
+
+/**
+ * Normalize a string.
+ * The string will be normalized according the specified normalization mode
+ * and options.
+ * The source and result buffers must not be the same, nor overlap.
+ *
+ * @param source The string to normalize.
+ * @param sourceLength The length of source, or -1 if NUL-terminated.
+ * @param mode The normalization mode; one of UNORM_NONE, 
+ *             UNORM_NFD, UNORM_NFC, UNORM_NFKC, UNORM_NFKD, UNORM_DEFAULT.
+ * @param options The normalization options, ORed together (0 for no options).
+ * @param result A pointer to a buffer to receive the result string.
+ *               The result string is NUL-terminated if possible.
+ * @param resultLength The maximum size of result.
+ * @param status A pointer to a UErrorCode to receive any errors.
+ * @return The total buffer size needed; if greater than resultLength,
+ *         the output was truncated, and the error code is set to U_BUFFER_OVERFLOW_ERROR.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+unorm_normalize(const UChar *source, int32_t sourceLength,
+                UNormalizationMode mode, int32_t options,
+                UChar *result, int32_t resultLength,
+                UErrorCode *status);
+
+/**
+ * Performing quick check on a string, to quickly determine if the string is 
+ * in a particular normalization format.
+ * Three types of result can be returned UNORM_YES, UNORM_NO or
+ * UNORM_MAYBE. Result UNORM_YES indicates that the argument
+ * string is in the desired normalized format, UNORM_NO determines that
+ * argument string is not in the desired normalized format. A 
+ * UNORM_MAYBE result indicates that a more thorough check is required, 
+ * the user may have to put the string in its normalized form and compare the 
+ * results.
+ *
+ * @param source       string for determining if it is in a normalized format
+ * @param sourcelength length of source to test, or -1 if NUL-terminated
+ * @param mode         which normalization form to test for
+ * @param status       a pointer to a UErrorCode to receive any errors
+ * @return UNORM_YES, UNORM_NO or UNORM_MAYBE
+ *
+ * @see unorm_isNormalized
+ * @stable ICU 2.0
+ */
+U_STABLE UNormalizationCheckResult U_EXPORT2
+unorm_quickCheck(const UChar *source, int32_t sourcelength,
+                 UNormalizationMode mode,
+                 UErrorCode *status);
+
+/**
+ * Performing quick check on a string; same as unorm_quickCheck but
+ * takes an extra options parameter like most normalization functions.
+ *
+ * @param src        String that is to be tested if it is in a normalization format.
+ * @param srcLength  Length of source to test, or -1 if NUL-terminated.
+ * @param mode       Which normalization form to test for.
+ * @param options    The normalization options, ORed together (0 for no options).
+ * @param pErrorCode ICU error code in/out parameter.
+ *                   Must fulfill U_SUCCESS before the function call.
+ * @return UNORM_YES, UNORM_NO or UNORM_MAYBE
+ *
+ * @see unorm_quickCheck
+ * @see unorm_isNormalized
+ * @stable ICU 2.6
+ */
+U_STABLE UNormalizationCheckResult U_EXPORT2
+unorm_quickCheckWithOptions(const UChar *src, int32_t srcLength, 
+                            UNormalizationMode mode, int32_t options,
+                            UErrorCode *pErrorCode);
+
+/**
+ * Test if a string is in a given normalization form.
+ * This is semantically equivalent to source.equals(normalize(source, mode)) .
+ *
+ * Unlike unorm_quickCheck(), this function returns a definitive result,
+ * never a "maybe".
+ * For NFD, NFKD, and FCD, both functions work exactly the same.
+ * For NFC and NFKC where quickCheck may return "maybe", this function will
+ * perform further tests to arrive at a TRUE/FALSE result.
+ *
+ * @param src        String that is to be tested if it is in a normalization format.
+ * @param srcLength  Length of source to test, or -1 if NUL-terminated.
+ * @param mode       Which normalization form to test for.
+ * @param pErrorCode ICU error code in/out parameter.
+ *                   Must fulfill U_SUCCESS before the function call.
+ * @return Boolean value indicating whether the source string is in the
+ *         "mode" normalization form.
+ *
+ * @see unorm_quickCheck
+ * @stable ICU 2.2
+ */
+U_STABLE UBool U_EXPORT2
+unorm_isNormalized(const UChar *src, int32_t srcLength,
+                   UNormalizationMode mode,
+                   UErrorCode *pErrorCode);
+
+/**
+ * Test if a string is in a given normalization form; same as unorm_isNormalized but
+ * takes an extra options parameter like most normalization functions.
+ *
+ * @param src        String that is to be tested if it is in a normalization format.
+ * @param srcLength  Length of source to test, or -1 if NUL-terminated.
+ * @param mode       Which normalization form to test for.
+ * @param options    The normalization options, ORed together (0 for no options).
+ * @param pErrorCode ICU error code in/out parameter.
+ *                   Must fulfill U_SUCCESS before the function call.
+ * @return Boolean value indicating whether the source string is in the
+ *         "mode/options" normalization form.
+ *
+ * @see unorm_quickCheck
+ * @see unorm_isNormalized
+ * @stable ICU 2.6
+ */
+U_STABLE UBool U_EXPORT2
+unorm_isNormalizedWithOptions(const UChar *src, int32_t srcLength,
+                              UNormalizationMode mode, int32_t options,
+                              UErrorCode *pErrorCode);
+
+/**
+ * Iterative normalization forward.
+ * This function (together with unorm_previous) is somewhat
+ * similar to the C++ Normalizer class (see its non-static functions).
+ *
+ * Iterative normalization is useful when only a small portion of a longer
+ * string/text needs to be processed.
+ *
+ * For example, the likelihood may be high that processing the first 10% of some
+ * text will be sufficient to find certain data.
+ * Another example: When one wants to concatenate two normalized strings and get a
+ * normalized result, it is much more efficient to normalize just a small part of
+ * the result around the concatenation place instead of re-normalizing everything.
+ *
+ * The input text is an instance of the C character iteration API UCharIterator.
+ * It may wrap around a simple string, a CharacterIterator, a Replaceable, or any
+ * other kind of text object.
+ *
+ * If a buffer overflow occurs, then the caller needs to reset the iterator to the
+ * old index and call the function again with a larger buffer - if the caller cares
+ * for the actual output.
+ * Regardless of the output buffer, the iterator will always be moved to the next
+ * normalization boundary.
+ *
+ * This function (like unorm_previous) serves two purposes:
+ *
+ * 1) To find the next boundary so that the normalization of the part of the text
+ * from the current position to that boundary does not affect and is not affected
+ * by the part of the text beyond that boundary.
+ *
+ * 2) To normalize the text up to the boundary.
+ *
+ * The second step is optional, per the doNormalize parameter.
+ * It is omitted for operations like string concatenation, where the two adjacent
+ * string ends need to be normalized together.
+ * In such a case, the output buffer will just contain a copy of the text up to the
+ * boundary.
+ *
+ * pNeededToNormalize is an output-only parameter. Its output value is only defined
+ * if normalization was requested (doNormalize) and successful (especially, no
+ * buffer overflow).
+ * It is useful for operations like a normalizing transliterator, where one would
+ * not want to replace a piece of text if it is not modified.
+ *
+ * If doNormalize==TRUE and pNeededToNormalize!=NULL then *pNeeded... is set TRUE
+ * if the normalization was necessary.
+ *
+ * If doNormalize==FALSE then *pNeededToNormalize will be set to FALSE.
+ *
+ * If the buffer overflows, then *pNeededToNormalize will be undefined;
+ * essentially, whenever U_FAILURE is true (like in buffer overflows), this result
+ * will be undefined.
+ *
+ * @param src The input text in the form of a C character iterator.
+ * @param dest The output buffer; can be NULL if destCapacity==0 for pure preflighting.
+ * @param destCapacity The number of UChars that fit into dest.
+ * @param mode The normalization mode.
+ * @param options The normalization options, ORed together (0 for no options).
+ * @param doNormalize Indicates if the source text up to the next boundary
+ *                    is to be normalized (TRUE) or just copied (FALSE).
+ * @param pNeededToNormalize Output flag indicating if the normalization resulted in
+ *                           different text from the input.
+ *                           Not defined if an error occurs including buffer overflow.
+ *                           Always FALSE if !doNormalize.
+ * @param pErrorCode ICU error code in/out parameter.
+ *                   Must fulfill U_SUCCESS before the function call.
+ * @return Length of output (number of UChars) when successful or buffer overflow.
+ *
+ * @see unorm_previous
+ * @see unorm_normalize
+ *
+ * @stable ICU 2.1
+ */
+U_STABLE int32_t U_EXPORT2
+unorm_next(UCharIterator *src,
+           UChar *dest, int32_t destCapacity,
+           UNormalizationMode mode, int32_t options,
+           UBool doNormalize, UBool *pNeededToNormalize,
+           UErrorCode *pErrorCode);
+
+/**
+ * Iterative normalization backward.
+ * This function (together with unorm_next) is somewhat
+ * similar to the C++ Normalizer class (see its non-static functions).
+ * For all details see unorm_next.
+ *
+ * @param src The input text in the form of a C character iterator.
+ * @param dest The output buffer; can be NULL if destCapacity==0 for pure preflighting.
+ * @param destCapacity The number of UChars that fit into dest.
+ * @param mode The normalization mode.
+ * @param options The normalization options, ORed together (0 for no options).
+ * @param doNormalize Indicates if the source text up to the next boundary
+ *                    is to be normalized (TRUE) or just copied (FALSE).
+ * @param pNeededToNormalize Output flag indicating if the normalization resulted in
+ *                           different text from the input.
+ *                           Not defined if an error occurs including buffer overflow.
+ *                           Always FALSE if !doNormalize.
+ * @param pErrorCode ICU error code in/out parameter.
+ *                   Must fulfill U_SUCCESS before the function call.
+ * @return Length of output (number of UChars) when successful or buffer overflow.
+ *
+ * @see unorm_next
+ * @see unorm_normalize
+ *
+ * @stable ICU 2.1
+ */
+U_STABLE int32_t U_EXPORT2
+unorm_previous(UCharIterator *src,
+               UChar *dest, int32_t destCapacity,
+               UNormalizationMode mode, int32_t options,
+               UBool doNormalize, UBool *pNeededToNormalize,
+               UErrorCode *pErrorCode);
+
+/**
+ * Concatenate normalized strings, making sure that the result is normalized as well.
+ *
+ * If both the left and the right strings are in
+ * the normalization form according to "mode/options",
+ * then the result will be
+ *
+ * \code
+ *     dest=normalize(left+right, mode, options)
+ * \endcode
+ *
+ * With the input strings already being normalized,
+ * this function will use unorm_next() and unorm_previous()
+ * to find the adjacent end pieces of the input strings.
+ * Only the concatenation of these end pieces will be normalized and
+ * then concatenated with the remaining parts of the input strings.
+ *
+ * It is allowed to have dest==left to avoid copying the entire left string.
+ *
+ * @param left Left source string, may be same as dest.
+ * @param leftLength Length of left source string, or -1 if NUL-terminated.
+ * @param right Right source string. Must not be the same as dest, nor overlap.
+ * @param rightLength Length of right source string, or -1 if NUL-terminated.
+ * @param dest The output buffer; can be NULL if destCapacity==0 for pure preflighting.
+ * @param destCapacity The number of UChars that fit into dest.
+ * @param mode The normalization mode.
+ * @param options The normalization options, ORed together (0 for no options).
+ * @param pErrorCode ICU error code in/out parameter.
+ *                   Must fulfill U_SUCCESS before the function call.
+ * @return Length of output (number of UChars) when successful or buffer overflow.
+ *
+ * @see unorm_normalize
+ * @see unorm_next
+ * @see unorm_previous
+ *
+ * @stable ICU 2.1
+ */
+U_STABLE int32_t U_EXPORT2
+unorm_concatenate(const UChar *left, int32_t leftLength,
+                  const UChar *right, int32_t rightLength,
+                  UChar *dest, int32_t destCapacity,
+                  UNormalizationMode mode, int32_t options,
+                  UErrorCode *pErrorCode);
+
+/**
+ * Option bit for unorm_compare:
+ * Both input strings are assumed to fulfill FCD conditions.
+ * @stable ICU 2.2
+ */
+#define UNORM_INPUT_IS_FCD          0x20000
+
+/**
+ * Option bit for unorm_compare:
+ * Perform case-insensitive comparison.
+ * @stable ICU 2.2
+ */
+#define U_COMPARE_IGNORE_CASE       0x10000
+
+#ifndef U_COMPARE_CODE_POINT_ORDER
+/* see also unistr.h and ustring.h */
+/**
+ * Option bit for u_strCaseCompare, u_strcasecmp, unorm_compare, etc:
+ * Compare strings in code point order instead of code unit order.
+ * @stable ICU 2.2
+ */
+#define U_COMPARE_CODE_POINT_ORDER  0x8000
+#endif
+
+/**
+ * Compare two strings for canonical equivalence.
+ * Further options include case-insensitive comparison and
+ * code point order (as opposed to code unit order).
+ *
+ * Canonical equivalence between two strings is defined as their normalized
+ * forms (NFD or NFC) being identical.
+ * This function compares strings incrementally instead of normalizing
+ * (and optionally case-folding) both strings entirely,
+ * improving performance significantly.
+ *
+ * Bulk normalization is only necessary if the strings do not fulfill the FCD
+ * conditions. Only in this case, and only if the strings are relatively long,
+ * is memory allocated temporarily.
+ * For FCD strings and short non-FCD strings there is no memory allocation.
+ *
+ * Semantically, this is equivalent to
+ *   strcmp[CodePointOrder](NFD(foldCase(NFD(s1))), NFD(foldCase(NFD(s2))))
+ * where code point order and foldCase are all optional.
+ *
+ * UAX 21 2.5 Caseless Matching specifies that for a canonical caseless match
+ * the case folding must be performed first, then the normalization.
+ *
+ * @param s1 First source string.
+ * @param length1 Length of first source string, or -1 if NUL-terminated.
+ *
+ * @param s2 Second source string.
+ * @param length2 Length of second source string, or -1 if NUL-terminated.
+ *
+ * @param options A bit set of options:
+ *   - U_FOLD_CASE_DEFAULT or 0 is used for default options:
+ *     Case-sensitive comparison in code unit order, and the input strings
+ *     are quick-checked for FCD.
+ *
+ *   - UNORM_INPUT_IS_FCD
+ *     Set if the caller knows that both s1 and s2 fulfill the FCD conditions.
+ *     If not set, the function will quickCheck for FCD
+ *     and normalize if necessary.
+ *
+ *   - U_COMPARE_CODE_POINT_ORDER
+ *     Set to choose code point order instead of code unit order
+ *     (see u_strCompare for details).
+ *
+ *   - U_COMPARE_IGNORE_CASE
+ *     Set to compare strings case-insensitively using case folding,
+ *     instead of case-sensitively.
+ *     If set, then the following case folding options are used.
+ *
+ *   - Options as used with case-insensitive comparisons, currently:
+ *
+ *   - U_FOLD_CASE_EXCLUDE_SPECIAL_I
+ *    (see u_strCaseCompare for details)
+ *
+ *   - regular normalization options shifted left by UNORM_COMPARE_NORM_OPTIONS_SHIFT
+ *
+ * @param pErrorCode ICU error code in/out parameter.
+ *                   Must fulfill U_SUCCESS before the function call.
+ * @return <0 or 0 or >0 as usual for string comparisons
+ *
+ * @see unorm_normalize
+ * @see UNORM_FCD
+ * @see u_strCompare
+ * @see u_strCaseCompare
+ *
+ * @stable ICU 2.2
+ */
+U_STABLE int32_t U_EXPORT2
+unorm_compare(const UChar *s1, int32_t length1,
+              const UChar *s2, int32_t length2,
+              uint32_t options,
+              UErrorCode *pErrorCode);
+
+#endif /* #if !UCONFIG_NO_NORMALIZATION */
+
+#endif
diff --git a/icu/unicode/unorm2.h b/icu/unicode/unorm2.h
new file mode 100644
index 0000000..7152fc1
--- /dev/null
+++ b/icu/unicode/unorm2.h
@@ -0,0 +1,528 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 2009-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  unorm2.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 2009dec15
+*   created by: Markus W. Scherer
+*/
+
+#ifndef __UNORM2_H__
+#define __UNORM2_H__
+
+/**
+ * \file
+ * \brief C API: New API for Unicode Normalization.
+ *
+ * Unicode normalization functionality for standard Unicode normalization or
+ * for using custom mapping tables.
+ * All instances of UNormalizer2 are unmodifiable/immutable.
+ * Instances returned by unorm2_getInstance() are singletons that must not be deleted by the caller.
+ * For more details see the Normalizer2 C++ class.
+ */
+
+#include "unicode/utypes.h"
+#include "unicode/localpointer.h"
+#include "unicode/uset.h"
+
+/**
+ * Constants for normalization modes.
+ * For details about standard Unicode normalization forms
+ * and about the algorithms which are also used with custom mapping tables
+ * see http://www.unicode.org/unicode/reports/tr15/
+ * @stable ICU 4.4
+ */
+typedef enum {
+    /**
+     * Decomposition followed by composition.
+     * Same as standard NFC when using an "nfc" instance.
+     * Same as standard NFKC when using an "nfkc" instance.
+     * For details about standard Unicode normalization forms
+     * see http://www.unicode.org/unicode/reports/tr15/
+     * @stable ICU 4.4
+     */
+    UNORM2_COMPOSE,
+    /**
+     * Map, and reorder canonically.
+     * Same as standard NFD when using an "nfc" instance.
+     * Same as standard NFKD when using an "nfkc" instance.
+     * For details about standard Unicode normalization forms
+     * see http://www.unicode.org/unicode/reports/tr15/
+     * @stable ICU 4.4
+     */
+    UNORM2_DECOMPOSE,
+    /**
+     * "Fast C or D" form.
+     * If a string is in this form, then further decomposition <i>without reordering</i>
+     * would yield the same form as DECOMPOSE.
+     * Text in "Fast C or D" form can be processed efficiently with data tables
+     * that are "canonically closed", that is, that provide equivalent data for
+     * equivalent text, without having to be fully normalized.
+     * Not a standard Unicode normalization form.
+     * Not a unique form: Different FCD strings can be canonically equivalent.
+     * For details see http://www.unicode.org/notes/tn5/#FCD
+     * @stable ICU 4.4
+     */
+    UNORM2_FCD,
+    /**
+     * Compose only contiguously.
+     * Also known as "FCC" or "Fast C Contiguous".
+     * The result will often but not always be in NFC.
+     * The result will conform to FCD which is useful for processing.
+     * Not a standard Unicode normalization form.
+     * For details see http://www.unicode.org/notes/tn5/#FCC
+     * @stable ICU 4.4
+     */
+    UNORM2_COMPOSE_CONTIGUOUS
+} UNormalization2Mode;
+
+/**
+ * Result values for normalization quick check functions.
+ * For details see http://www.unicode.org/reports/tr15/#Detecting_Normalization_Forms
+ * @stable ICU 2.0
+ */
+typedef enum UNormalizationCheckResult {
+  /**
+   * The input string is not in the normalization form.
+   * @stable ICU 2.0
+   */
+  UNORM_NO,
+  /**
+   * The input string is in the normalization form.
+   * @stable ICU 2.0
+   */
+  UNORM_YES,
+  /**
+   * The input string may or may not be in the normalization form.
+   * This value is only returned for composition forms like NFC and FCC,
+   * when a backward-combining character is found for which the surrounding text
+   * would have to be analyzed further.
+   * @stable ICU 2.0
+   */
+  UNORM_MAYBE
+} UNormalizationCheckResult;
+
+/**
+ * Opaque C service object type for the new normalization API.
+ * @stable ICU 4.4
+ */
+struct UNormalizer2;
+typedef struct UNormalizer2 UNormalizer2;  /**< C typedef for struct UNormalizer2. @stable ICU 4.4 */
+
+#if !UCONFIG_NO_NORMALIZATION
+
+/**
+ * Returns a UNormalizer2 instance for Unicode NFC normalization.
+ * Same as unorm2_getInstance(NULL, "nfc", UNORM2_COMPOSE, pErrorCode).
+ * Returns an unmodifiable singleton instance. Do not delete it.
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                  pass the U_SUCCESS() test, or else the function returns
+ *                  immediately. Check for U_FAILURE() on output or use with
+ *                  function chaining. (See User Guide for details.)
+ * @return the requested Normalizer2, if successful
+ * @stable ICU 49
+ */
+U_STABLE const UNormalizer2 * U_EXPORT2
+unorm2_getNFCInstance(UErrorCode *pErrorCode);
+
+/**
+ * Returns a UNormalizer2 instance for Unicode NFD normalization.
+ * Same as unorm2_getInstance(NULL, "nfc", UNORM2_DECOMPOSE, pErrorCode).
+ * Returns an unmodifiable singleton instance. Do not delete it.
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                  pass the U_SUCCESS() test, or else the function returns
+ *                  immediately. Check for U_FAILURE() on output or use with
+ *                  function chaining. (See User Guide for details.)
+ * @return the requested Normalizer2, if successful
+ * @stable ICU 49
+ */
+U_STABLE const UNormalizer2 * U_EXPORT2
+unorm2_getNFDInstance(UErrorCode *pErrorCode);
+
+/**
+ * Returns a UNormalizer2 instance for Unicode NFKC normalization.
+ * Same as unorm2_getInstance(NULL, "nfkc", UNORM2_COMPOSE, pErrorCode).
+ * Returns an unmodifiable singleton instance. Do not delete it.
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                  pass the U_SUCCESS() test, or else the function returns
+ *                  immediately. Check for U_FAILURE() on output or use with
+ *                  function chaining. (See User Guide for details.)
+ * @return the requested Normalizer2, if successful
+ * @stable ICU 49
+ */
+U_STABLE const UNormalizer2 * U_EXPORT2
+unorm2_getNFKCInstance(UErrorCode *pErrorCode);
+
+/**
+ * Returns a UNormalizer2 instance for Unicode NFKD normalization.
+ * Same as unorm2_getInstance(NULL, "nfkc", UNORM2_DECOMPOSE, pErrorCode).
+ * Returns an unmodifiable singleton instance. Do not delete it.
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                  pass the U_SUCCESS() test, or else the function returns
+ *                  immediately. Check for U_FAILURE() on output or use with
+ *                  function chaining. (See User Guide for details.)
+ * @return the requested Normalizer2, if successful
+ * @stable ICU 49
+ */
+U_STABLE const UNormalizer2 * U_EXPORT2
+unorm2_getNFKDInstance(UErrorCode *pErrorCode);
+
+/**
+ * Returns a UNormalizer2 instance for Unicode NFKC_Casefold normalization.
+ * Same as unorm2_getInstance(NULL, "nfkc_cf", UNORM2_COMPOSE, pErrorCode).
+ * Returns an unmodifiable singleton instance. Do not delete it.
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                  pass the U_SUCCESS() test, or else the function returns
+ *                  immediately. Check for U_FAILURE() on output or use with
+ *                  function chaining. (See User Guide for details.)
+ * @return the requested Normalizer2, if successful
+ * @stable ICU 49
+ */
+U_STABLE const UNormalizer2 * U_EXPORT2
+unorm2_getNFKCCasefoldInstance(UErrorCode *pErrorCode);
+
+/**
+ * Returns a UNormalizer2 instance which uses the specified data file
+ * (packageName/name similar to ucnv_openPackage() and ures_open()/ResourceBundle)
+ * and which composes or decomposes text according to the specified mode.
+ * Returns an unmodifiable singleton instance. Do not delete it.
+ *
+ * Use packageName=NULL for data files that are part of ICU's own data.
+ * Use name="nfc" and UNORM2_COMPOSE/UNORM2_DECOMPOSE for Unicode standard NFC/NFD.
+ * Use name="nfkc" and UNORM2_COMPOSE/UNORM2_DECOMPOSE for Unicode standard NFKC/NFKD.
+ * Use name="nfkc_cf" and UNORM2_COMPOSE for Unicode standard NFKC_CF=NFKC_Casefold.
+ *
+ * @param packageName NULL for ICU built-in data, otherwise application data package name
+ * @param name "nfc" or "nfkc" or "nfkc_cf" or name of custom data file
+ * @param mode normalization mode (compose or decompose etc.)
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                  pass the U_SUCCESS() test, or else the function returns
+ *                  immediately. Check for U_FAILURE() on output or use with
+ *                  function chaining. (See User Guide for details.)
+ * @return the requested UNormalizer2, if successful
+ * @stable ICU 4.4
+ */
+U_STABLE const UNormalizer2 * U_EXPORT2
+unorm2_getInstance(const char *packageName,
+                   const char *name,
+                   UNormalization2Mode mode,
+                   UErrorCode *pErrorCode);
+
+/**
+ * Constructs a filtered normalizer wrapping any UNormalizer2 instance
+ * and a filter set.
+ * Both are aliased and must not be modified or deleted while this object
+ * is used.
+ * The filter set should be frozen; otherwise the performance will suffer greatly.
+ * @param norm2 wrapped UNormalizer2 instance
+ * @param filterSet USet which determines the characters to be normalized
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return the requested UNormalizer2, if successful
+ * @stable ICU 4.4
+ */
+U_STABLE UNormalizer2 * U_EXPORT2
+unorm2_openFiltered(const UNormalizer2 *norm2, const USet *filterSet, UErrorCode *pErrorCode);
+
+/**
+ * Closes a UNormalizer2 instance from unorm2_openFiltered().
+ * Do not close instances from unorm2_getInstance()!
+ * @param norm2 UNormalizer2 instance to be closed
+ * @stable ICU 4.4
+ */
+U_STABLE void U_EXPORT2
+unorm2_close(UNormalizer2 *norm2);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUNormalizer2Pointer
+ * "Smart pointer" class, closes a UNormalizer2 via unorm2_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUNormalizer2Pointer, UNormalizer2, unorm2_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Writes the normalized form of the source string to the destination string
+ * (replacing its contents) and returns the length of the destination string.
+ * The source and destination strings must be different buffers.
+ * @param norm2 UNormalizer2 instance
+ * @param src source string
+ * @param length length of the source string, or -1 if NUL-terminated
+ * @param dest destination string; its contents is replaced with normalized src
+ * @param capacity number of UChars that can be written to dest
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return dest
+ * @stable ICU 4.4
+ */
+U_STABLE int32_t U_EXPORT2
+unorm2_normalize(const UNormalizer2 *norm2,
+                 const UChar *src, int32_t length,
+                 UChar *dest, int32_t capacity,
+                 UErrorCode *pErrorCode);
+/**
+ * Appends the normalized form of the second string to the first string
+ * (merging them at the boundary) and returns the length of the first string.
+ * The result is normalized if the first string was normalized.
+ * The first and second strings must be different buffers.
+ * @param norm2 UNormalizer2 instance
+ * @param first string, should be normalized
+ * @param firstLength length of the first string, or -1 if NUL-terminated
+ * @param firstCapacity number of UChars that can be written to first
+ * @param second string, will be normalized
+ * @param secondLength length of the source string, or -1 if NUL-terminated
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return first
+ * @stable ICU 4.4
+ */
+U_STABLE int32_t U_EXPORT2
+unorm2_normalizeSecondAndAppend(const UNormalizer2 *norm2,
+                                UChar *first, int32_t firstLength, int32_t firstCapacity,
+                                const UChar *second, int32_t secondLength,
+                                UErrorCode *pErrorCode);
+/**
+ * Appends the second string to the first string
+ * (merging them at the boundary) and returns the length of the first string.
+ * The result is normalized if both the strings were normalized.
+ * The first and second strings must be different buffers.
+ * @param norm2 UNormalizer2 instance
+ * @param first string, should be normalized
+ * @param firstLength length of the first string, or -1 if NUL-terminated
+ * @param firstCapacity number of UChars that can be written to first
+ * @param second string, should be normalized
+ * @param secondLength length of the source string, or -1 if NUL-terminated
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return first
+ * @stable ICU 4.4
+ */
+U_STABLE int32_t U_EXPORT2
+unorm2_append(const UNormalizer2 *norm2,
+              UChar *first, int32_t firstLength, int32_t firstCapacity,
+              const UChar *second, int32_t secondLength,
+              UErrorCode *pErrorCode);
+
+/**
+ * Gets the decomposition mapping of c.
+ * Roughly equivalent to normalizing the String form of c
+ * on a UNORM2_DECOMPOSE UNormalizer2 instance, but much faster, and except that this function
+ * returns a negative value and does not write a string
+ * if c does not have a decomposition mapping in this instance's data.
+ * This function is independent of the mode of the UNormalizer2.
+ * @param norm2 UNormalizer2 instance
+ * @param c code point
+ * @param decomposition String buffer which will be set to c's
+ *                      decomposition mapping, if there is one.
+ * @param capacity number of UChars that can be written to decomposition
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return the non-negative length of c's decomposition, if there is one; otherwise a negative value
+ * @stable ICU 4.6
+ */
+U_STABLE int32_t U_EXPORT2
+unorm2_getDecomposition(const UNormalizer2 *norm2,
+                        UChar32 c, UChar *decomposition, int32_t capacity,
+                        UErrorCode *pErrorCode);
+
+/**
+ * Gets the raw decomposition mapping of c.
+ *
+ * This is similar to the unorm2_getDecomposition() function but returns the
+ * raw decomposition mapping as specified in UnicodeData.txt or
+ * (for custom data) in the mapping files processed by the gennorm2 tool.
+ * By contrast, unorm2_getDecomposition() returns the processed,
+ * recursively-decomposed version of this mapping.
+ *
+ * When used on a standard NFKC Normalizer2 instance,
+ * unorm2_getRawDecomposition() returns the Unicode Decomposition_Mapping (dm) property.
+ *
+ * When used on a standard NFC Normalizer2 instance,
+ * it returns the Decomposition_Mapping only if the Decomposition_Type (dt) is Canonical (Can);
+ * in this case, the result contains either one or two code points (=1..4 UChars).
+ *
+ * This function is independent of the mode of the UNormalizer2.
+ * @param norm2 UNormalizer2 instance
+ * @param c code point
+ * @param decomposition String buffer which will be set to c's
+ *                      raw decomposition mapping, if there is one.
+ * @param capacity number of UChars that can be written to decomposition
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return the non-negative length of c's raw decomposition, if there is one; otherwise a negative value
+ * @stable ICU 49
+ */
+U_STABLE int32_t U_EXPORT2
+unorm2_getRawDecomposition(const UNormalizer2 *norm2,
+                           UChar32 c, UChar *decomposition, int32_t capacity,
+                           UErrorCode *pErrorCode);
+
+/**
+ * Performs pairwise composition of a & b and returns the composite if there is one.
+ *
+ * Returns a composite code point c only if c has a two-way mapping to a+b.
+ * In standard Unicode normalization, this means that
+ * c has a canonical decomposition to a+b
+ * and c does not have the Full_Composition_Exclusion property.
+ *
+ * This function is independent of the mode of the UNormalizer2.
+ * @param norm2 UNormalizer2 instance
+ * @param a A (normalization starter) code point.
+ * @param b Another code point.
+ * @return The non-negative composite code point if there is one; otherwise a negative value.
+ * @stable ICU 49
+ */
+U_STABLE UChar32 U_EXPORT2
+unorm2_composePair(const UNormalizer2 *norm2, UChar32 a, UChar32 b);
+
+/**
+ * Gets the combining class of c.
+ * The default implementation returns 0
+ * but all standard implementations return the Unicode Canonical_Combining_Class value.
+ * @param norm2 UNormalizer2 instance
+ * @param c code point
+ * @return c's combining class
+ * @stable ICU 49
+ */
+U_STABLE uint8_t U_EXPORT2
+unorm2_getCombiningClass(const UNormalizer2 *norm2, UChar32 c);
+
+/**
+ * Tests if the string is normalized.
+ * Internally, in cases where the quickCheck() method would return "maybe"
+ * (which is only possible for the two COMPOSE modes) this method
+ * resolves to "yes" or "no" to provide a definitive result,
+ * at the cost of doing more work in those cases.
+ * @param norm2 UNormalizer2 instance
+ * @param s input string
+ * @param length length of the string, or -1 if NUL-terminated
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return TRUE if s is normalized
+ * @stable ICU 4.4
+ */
+U_STABLE UBool U_EXPORT2
+unorm2_isNormalized(const UNormalizer2 *norm2,
+                    const UChar *s, int32_t length,
+                    UErrorCode *pErrorCode);
+
+/**
+ * Tests if the string is normalized.
+ * For the two COMPOSE modes, the result could be "maybe" in cases that
+ * would take a little more work to resolve definitively.
+ * Use spanQuickCheckYes() and normalizeSecondAndAppend() for a faster
+ * combination of quick check + normalization, to avoid
+ * re-checking the "yes" prefix.
+ * @param norm2 UNormalizer2 instance
+ * @param s input string
+ * @param length length of the string, or -1 if NUL-terminated
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return UNormalizationCheckResult
+ * @stable ICU 4.4
+ */
+U_STABLE UNormalizationCheckResult U_EXPORT2
+unorm2_quickCheck(const UNormalizer2 *norm2,
+                  const UChar *s, int32_t length,
+                  UErrorCode *pErrorCode);
+
+/**
+ * Returns the end of the normalized substring of the input string.
+ * In other words, with <code>end=spanQuickCheckYes(s, ec);</code>
+ * the substring <code>UnicodeString(s, 0, end)</code>
+ * will pass the quick check with a "yes" result.
+ *
+ * The returned end index is usually one or more characters before the
+ * "no" or "maybe" character: The end index is at a normalization boundary.
+ * (See the class documentation for more about normalization boundaries.)
+ *
+ * When the goal is a normalized string and most input strings are expected
+ * to be normalized already, then call this method,
+ * and if it returns a prefix shorter than the input string,
+ * copy that prefix and use normalizeSecondAndAppend() for the remainder.
+ * @param norm2 UNormalizer2 instance
+ * @param s input string
+ * @param length length of the string, or -1 if NUL-terminated
+ * @param pErrorCode Standard ICU error code. Its input value must
+ *                   pass the U_SUCCESS() test, or else the function returns
+ *                   immediately. Check for U_FAILURE() on output or use with
+ *                   function chaining. (See User Guide for details.)
+ * @return "yes" span end index
+ * @stable ICU 4.4
+ */
+U_STABLE int32_t U_EXPORT2
+unorm2_spanQuickCheckYes(const UNormalizer2 *norm2,
+                         const UChar *s, int32_t length,
+                         UErrorCode *pErrorCode);
+
+/**
+ * Tests if the character always has a normalization boundary before it,
+ * regardless of context.
+ * For details see the Normalizer2 base class documentation.
+ * @param norm2 UNormalizer2 instance
+ * @param c character to test
+ * @return TRUE if c has a normalization boundary before it
+ * @stable ICU 4.4
+ */
+U_STABLE UBool U_EXPORT2
+unorm2_hasBoundaryBefore(const UNormalizer2 *norm2, UChar32 c);
+
+/**
+ * Tests if the character always has a normalization boundary after it,
+ * regardless of context.
+ * For details see the Normalizer2 base class documentation.
+ * @param norm2 UNormalizer2 instance
+ * @param c character to test
+ * @return TRUE if c has a normalization boundary after it
+ * @stable ICU 4.4
+ */
+U_STABLE UBool U_EXPORT2
+unorm2_hasBoundaryAfter(const UNormalizer2 *norm2, UChar32 c);
+
+/**
+ * Tests if the character is normalization-inert.
+ * For details see the Normalizer2 base class documentation.
+ * @param norm2 UNormalizer2 instance
+ * @param c character to test
+ * @return TRUE if c is normalization-inert
+ * @stable ICU 4.4
+ */
+U_STABLE UBool U_EXPORT2
+unorm2_isInert(const UNormalizer2 *norm2, UChar32 c);
+
+#endif  /* !UCONFIG_NO_NORMALIZATION */
+#endif  /* __UNORM2_H__ */
diff --git a/icu/unicode/unum.h b/icu/unicode/unum.h
new file mode 100644
index 0000000..dce7733
--- /dev/null
+++ b/icu/unicode/unum.h
@@ -0,0 +1,1247 @@
+/*
+*******************************************************************************
+* Copyright (C) 1997-2013, International Business Machines Corporation and others.
+* All Rights Reserved.
+* Modification History:
+*
+*   Date        Name        Description
+*   06/24/99    helena      Integrated Alan's NF enhancements and Java2 bug fixes
+*******************************************************************************
+*/
+
+#ifndef _UNUM
+#define _UNUM
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_FORMATTING
+
+#include "unicode/localpointer.h"
+#include "unicode/uloc.h"
+#include "unicode/umisc.h"
+#include "unicode/parseerr.h"
+#include "unicode/uformattable.h"
+
+/**
+ * \file
+ * \brief C API: NumberFormat
+ *
+ * <h2> Number Format C API </h2>
+ *
+ * Number Format C API  Provides functions for
+ * formatting and parsing a number.  Also provides methods for
+ * determining which locales have number formats, and what their names
+ * are.
+ * <P>
+ * UNumberFormat helps you to format and parse numbers for any locale.
+ * Your code can be completely independent of the locale conventions
+ * for decimal points, thousands-separators, or even the particular
+ * decimal digits used, or whether the number format is even decimal.
+ * There are different number format styles like decimal, currency,
+ * percent and spellout.
+ * <P>
+ * To format a number for the current Locale, use one of the static
+ * factory methods:
+ * <pre>
+ * \code
+ *    UChar myString[20];
+ *    double myNumber = 7.0;
+ *    UErrorCode status = U_ZERO_ERROR;
+ *    UNumberFormat* nf = unum_open(UNUM_DEFAULT, NULL, -1, NULL, NULL, &status);
+ *    unum_formatDouble(nf, myNumber, myString, 20, NULL, &status);
+ *    printf(" Example 1: %s\n", austrdup(myString) ); //austrdup( a function used to convert UChar* to char*)
+ * \endcode
+ * </pre>
+ * If you are formatting multiple numbers, it is more efficient to get
+ * the format and use it multiple times so that the system doesn't
+ * have to fetch the information about the local language and country
+ * conventions multiple times.
+ * <pre>
+ * \code
+ * uint32_t i, resultlength, reslenneeded;
+ * UErrorCode status = U_ZERO_ERROR;
+ * UFieldPosition pos;
+ * uint32_t a[] = { 123, 3333, -1234567 };
+ * const uint32_t a_len = sizeof(a) / sizeof(a[0]);
+ * UNumberFormat* nf;
+ * UChar* result = NULL;
+ *
+ * nf = unum_open(UNUM_DEFAULT, NULL, -1, NULL, NULL, &status);
+ * for (i = 0; i < a_len; i++) {
+ *    resultlength=0;
+ *    reslenneeded=unum_format(nf, a[i], NULL, resultlength, &pos, &status);
+ *    result = NULL;
+ *    if(status==U_BUFFER_OVERFLOW_ERROR){
+ *       status=U_ZERO_ERROR;
+ *       resultlength=reslenneeded+1;
+ *       result=(UChar*)malloc(sizeof(UChar) * resultlength);
+ *       unum_format(nf, a[i], result, resultlength, &pos, &status);
+ *    }
+ *    printf( " Example 2: %s\n", austrdup(result));
+ *    free(result);
+ * }
+ * \endcode
+ * </pre>
+ * To format a number for a different Locale, specify it in the
+ * call to unum_open().
+ * <pre>
+ * \code
+ *     UNumberFormat* nf = unum_open(UNUM_DEFAULT, NULL, -1, "fr_FR", NULL, &success)
+ * \endcode
+ * </pre>
+ * You can use a NumberFormat API unum_parse() to parse.
+ * <pre>
+ * \code
+ *    UErrorCode status = U_ZERO_ERROR;
+ *    int32_t pos=0;
+ *    int32_t num;
+ *    num = unum_parse(nf, str, u_strlen(str), &pos, &status);
+ * \endcode
+ * </pre>
+ * Use UNUM_DECIMAL to get the normal number format for that country.
+ * There are other static options available.  Use UNUM_CURRENCY
+ * to get the currency number format for that country.  Use UNUM_PERCENT
+ * to get a format for displaying percentages. With this format, a
+ * fraction from 0.53 is displayed as 53%.
+ * <P>
+ * Use a pattern to create either a DecimalFormat or a RuleBasedNumberFormat
+ * formatter.  The pattern must conform to the syntax defined for those
+ * formatters.
+ * <P>
+ * You can also control the display of numbers with such function as
+ * unum_getAttributes() and unum_setAttributes(), which let you set the
+ * miminum fraction digits, grouping, etc.
+ * @see UNumberFormatAttributes for more details
+ * <P>
+ * You can also use forms of the parse and format methods with
+ * ParsePosition and UFieldPosition to allow you to:
+ * <ul type=round>
+ *   <li>(a) progressively parse through pieces of a string.
+ *   <li>(b) align the decimal point and other areas.
+ * </ul>
+ * <p>
+ * It is also possible to change or set the symbols used for a particular
+ * locale like the currency symbol, the grouping seperator , monetary seperator
+ * etc by making use of functions unum_setSymbols() and unum_getSymbols().
+ */
+
+/** A number formatter.
+ *  For usage in C programs.
+ *  @stable ICU 2.0
+ */
+typedef void* UNumberFormat;
+
+/** The possible number format styles. 
+ *  @stable ICU 2.0
+ */
+typedef enum UNumberFormatStyle {
+    /**
+     * Decimal format defined by a pattern string.
+     * @stable ICU 3.0
+     */
+    UNUM_PATTERN_DECIMAL=0,
+    /**
+     * Decimal format ("normal" style).
+     * @stable ICU 2.0
+     */
+    UNUM_DECIMAL=1,
+    /**
+     * Currency format with a currency symbol, e.g., "$1.00".
+     * @stable ICU 2.0
+     */
+    UNUM_CURRENCY,
+    /**
+     * Percent format
+     * @stable ICU 2.0
+     */
+    UNUM_PERCENT,
+    /**
+     * Scientific format
+     * @stable ICU 2.1
+     */
+    UNUM_SCIENTIFIC,
+    /**
+     * Spellout rule-based format
+     * @stable ICU 2.0
+     */
+    UNUM_SPELLOUT,
+    /** 
+     * Ordinal rule-based format 
+     * @stable ICU 3.0
+     */
+    UNUM_ORDINAL,
+    /** 
+     * Duration rule-based format 
+     * @stable ICU 3.0
+     */
+    UNUM_DURATION,
+    /** 
+     * Numbering system rule-based format
+     * @stable ICU 4.2
+     */
+    UNUM_NUMBERING_SYSTEM,
+    /** 
+     * Rule-based format defined by a pattern string.
+     * @stable ICU 3.0
+     */
+    UNUM_PATTERN_RULEBASED,
+    /**
+     * Currency format with an ISO currency code, e.g., "USD1.00".
+     * @stable ICU 4.8
+     */
+    UNUM_CURRENCY_ISO,
+    /**
+     * Currency format with a pluralized currency name,
+     * e.g., "1.00 US dollar" and "3.00 US dollars".
+     * @stable ICU 4.8
+     */
+    UNUM_CURRENCY_PLURAL,
+    /**
+     * One more than the highest number format style constant.
+     * @stable ICU 4.8
+     */
+    UNUM_FORMAT_STYLE_COUNT,
+    /**
+     * Default format
+     * @stable ICU 2.0
+     */
+    UNUM_DEFAULT = UNUM_DECIMAL,
+    /**
+     * Alias for UNUM_PATTERN_DECIMAL
+     * @stable ICU 3.0
+     */
+    UNUM_IGNORE = UNUM_PATTERN_DECIMAL
+} UNumberFormatStyle;
+
+/** The possible number format rounding modes. 
+ *  @stable ICU 2.0
+ */
+typedef enum UNumberFormatRoundingMode {
+    UNUM_ROUND_CEILING,
+    UNUM_ROUND_FLOOR,
+    UNUM_ROUND_DOWN,
+    UNUM_ROUND_UP,
+    /**
+     * Half-even rounding
+     * @stable, ICU 3.8
+     */
+    UNUM_ROUND_HALFEVEN,
+#ifndef U_HIDE_DEPRECATED_API
+    /**
+     * Half-even rounding, misspelled name
+     * @deprecated, ICU 3.8
+     */
+    UNUM_FOUND_HALFEVEN = UNUM_ROUND_HALFEVEN,
+#endif  /* U_HIDE_DEPRECATED_API */
+    UNUM_ROUND_HALFDOWN = UNUM_ROUND_HALFEVEN + 1,
+    UNUM_ROUND_HALFUP,
+    /** 
+      * ROUND_UNNECESSARY reports an error if formatted result is not exact.
+      * @stable ICU 4.8
+      */
+    UNUM_ROUND_UNNECESSARY
+} UNumberFormatRoundingMode;
+
+/** The possible number format pad positions. 
+ *  @stable ICU 2.0
+ */
+typedef enum UNumberFormatPadPosition {
+    UNUM_PAD_BEFORE_PREFIX,
+    UNUM_PAD_AFTER_PREFIX,
+    UNUM_PAD_BEFORE_SUFFIX,
+    UNUM_PAD_AFTER_SUFFIX
+} UNumberFormatPadPosition;
+
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Constants for specifying short or long format.
+ * @draft ICU 51
+ */
+typedef enum UNumberCompactStyle {
+  /** @draft ICU 51 */
+  UNUM_SHORT,
+  /** @draft ICU 51 */
+  UNUM_LONG
+  /** @draft ICU 51 */
+} UNumberCompactStyle;
+#endif /* U_HIDE_DRAFT_API */
+
+/**
+ * Constants for specifying currency spacing
+ * @stable ICU 4.8
+ */
+enum UCurrencySpacing {
+    /** @stable ICU 4.8 */
+    UNUM_CURRENCY_MATCH,
+    /** @stable ICU 4.8 */
+    UNUM_CURRENCY_SURROUNDING_MATCH,
+    /** @stable ICU 4.8 */
+    UNUM_CURRENCY_INSERT,
+    /** @stable ICU 4.8 */
+    UNUM_CURRENCY_SPACING_COUNT
+};
+typedef enum UCurrencySpacing UCurrencySpacing; /**< @stable ICU 4.8 */
+
+
+/**
+ * FieldPosition and UFieldPosition selectors for format fields
+ * defined by NumberFormat and UNumberFormat.
+ * @stable ICU 49
+ */
+typedef enum UNumberFormatFields {
+    /** @stable ICU 49 */
+    UNUM_INTEGER_FIELD,
+    /** @stable ICU 49 */
+    UNUM_FRACTION_FIELD,
+    /** @stable ICU 49 */
+    UNUM_DECIMAL_SEPARATOR_FIELD,
+    /** @stable ICU 49 */
+    UNUM_EXPONENT_SYMBOL_FIELD,
+    /** @stable ICU 49 */
+    UNUM_EXPONENT_SIGN_FIELD,
+    /** @stable ICU 49 */
+    UNUM_EXPONENT_FIELD,
+    /** @stable ICU 49 */
+    UNUM_GROUPING_SEPARATOR_FIELD,
+    /** @stable ICU 49 */
+    UNUM_CURRENCY_FIELD,
+    /** @stable ICU 49 */
+    UNUM_PERCENT_FIELD,
+    /** @stable ICU 49 */
+    UNUM_PERMILL_FIELD,
+    /** @stable ICU 49 */
+    UNUM_SIGN_FIELD,
+    /** @stable ICU 49 */
+    UNUM_FIELD_COUNT
+} UNumberFormatFields;
+
+
+/**
+ * Create and return a new UNumberFormat for formatting and parsing
+ * numbers.  A UNumberFormat may be used to format numbers by calling
+ * {@link #unum_format }, and to parse numbers by calling {@link #unum_parse }.
+ * The caller must call {@link #unum_close } when done to release resources
+ * used by this object.
+ * @param style The type of number format to open: one of
+ * UNUM_DECIMAL, UNUM_CURRENCY, UNUM_PERCENT, UNUM_SCIENTIFIC, UNUM_SPELLOUT,
+ * UNUM_PATTERN_DECIMAL, UNUM_PATTERN_RULEBASED, or UNUM_DEFAULT.
+ * If UNUM_PATTERN_DECIMAL or UNUM_PATTERN_RULEBASED is passed then the
+ * number format is opened using the given pattern, which must conform
+ * to the syntax described in DecimalFormat or RuleBasedNumberFormat,
+ * respectively.
+ * @param pattern A pattern specifying the format to use. 
+ * This parameter is ignored unless the style is
+ * UNUM_PATTERN_DECIMAL or UNUM_PATTERN_RULEBASED.
+ * @param patternLength The number of characters in the pattern, or -1
+ * if null-terminated. This parameter is ignored unless the style is
+ * UNUM_PATTERN.
+ * @param locale A locale identifier to use to determine formatting
+ * and parsing conventions, or NULL to use the default locale.
+ * @param parseErr A pointer to a UParseError struct to receive the
+ * details of any parsing errors, or NULL if no parsing error details
+ * are desired.
+ * @param status A pointer to an input-output UErrorCode.
+ * @return A pointer to a newly created UNumberFormat, or NULL if an
+ * error occurred.
+ * @see unum_close
+ * @see DecimalFormat
+ * @stable ICU 2.0
+ */
+U_STABLE UNumberFormat* U_EXPORT2 
+unum_open(  UNumberFormatStyle    style,
+            const    UChar*    pattern,
+            int32_t            patternLength,
+            const    char*     locale,
+            UParseError*       parseErr,
+            UErrorCode*        status);
+
+
+/**
+* Close a UNumberFormat.
+* Once closed, a UNumberFormat may no longer be used.
+* @param fmt The formatter to close.
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+unum_close(UNumberFormat* fmt);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUNumberFormatPointer
+ * "Smart pointer" class, closes a UNumberFormat via unum_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUNumberFormatPointer, UNumberFormat, unum_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Open a copy of a UNumberFormat.
+ * This function performs a deep copy.
+ * @param fmt The format to copy
+ * @param status A pointer to an UErrorCode to receive any errors.
+ * @return A pointer to a UNumberFormat identical to fmt.
+ * @stable ICU 2.0
+ */
+U_STABLE UNumberFormat* U_EXPORT2 
+unum_clone(const UNumberFormat *fmt,
+       UErrorCode *status);
+
+/**
+* Format an integer using a UNumberFormat.
+* The integer will be formatted according to the UNumberFormat's locale.
+* @param fmt The formatter to use.
+* @param number The number to format.
+* @param result A pointer to a buffer to receive the NULL-terminated formatted number. If
+* the formatted number fits into dest but cannot be NULL-terminated (length == resultLength)
+* then the error code is set to U_STRING_NOT_TERMINATED_WARNING. If the formatted number
+* doesn't fit into result then the error code is set to U_BUFFER_OVERFLOW_ERROR.
+* @param resultLength The maximum size of result.
+* @param pos    A pointer to a UFieldPosition.  On input, position->field
+* is read.  On output, position->beginIndex and position->endIndex indicate
+* the beginning and ending indices of field number position->field, if such
+* a field exists.  This parameter may be NULL, in which case no field
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see unum_formatInt64
+* @see unum_formatDouble
+* @see unum_parse
+* @see unum_parseInt64
+* @see unum_parseDouble
+* @see UFieldPosition
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_format(    const    UNumberFormat*    fmt,
+        int32_t            number,
+        UChar*            result,
+        int32_t            resultLength,
+        UFieldPosition    *pos,
+        UErrorCode*        status);
+
+/**
+* Format an int64 using a UNumberFormat.
+* The int64 will be formatted according to the UNumberFormat's locale.
+* @param fmt The formatter to use.
+* @param number The number to format.
+* @param result A pointer to a buffer to receive the NULL-terminated formatted number. If
+* the formatted number fits into dest but cannot be NULL-terminated (length == resultLength)
+* then the error code is set to U_STRING_NOT_TERMINATED_WARNING. If the formatted number
+* doesn't fit into result then the error code is set to U_BUFFER_OVERFLOW_ERROR.
+* @param resultLength The maximum size of result.
+* @param pos    A pointer to a UFieldPosition.  On input, position->field
+* is read.  On output, position->beginIndex and position->endIndex indicate
+* the beginning and ending indices of field number position->field, if such
+* a field exists.  This parameter may be NULL, in which case no field
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see unum_format
+* @see unum_formatDouble
+* @see unum_parse
+* @see unum_parseInt64
+* @see unum_parseDouble
+* @see UFieldPosition
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_formatInt64(const UNumberFormat *fmt,
+        int64_t         number,
+        UChar*          result,
+        int32_t         resultLength,
+        UFieldPosition *pos,
+        UErrorCode*     status);
+
+/**
+* Format a double using a UNumberFormat.
+* The double will be formatted according to the UNumberFormat's locale.
+* @param fmt The formatter to use.
+* @param number The number to format.
+* @param result A pointer to a buffer to receive the NULL-terminated formatted number. If
+* the formatted number fits into dest but cannot be NULL-terminated (length == resultLength)
+* then the error code is set to U_STRING_NOT_TERMINATED_WARNING. If the formatted number
+* doesn't fit into result then the error code is set to U_BUFFER_OVERFLOW_ERROR.
+* @param resultLength The maximum size of result.
+* @param pos    A pointer to a UFieldPosition.  On input, position->field
+* is read.  On output, position->beginIndex and position->endIndex indicate
+* the beginning and ending indices of field number position->field, if such
+* a field exists.  This parameter may be NULL, in which case no field
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see unum_format
+* @see unum_formatInt64
+* @see unum_parse
+* @see unum_parseInt64
+* @see unum_parseDouble
+* @see UFieldPosition
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_formatDouble(    const    UNumberFormat*  fmt,
+            double          number,
+            UChar*          result,
+            int32_t         resultLength,
+            UFieldPosition  *pos, /* 0 if ignore */
+            UErrorCode*     status);
+
+/**
+* Format a decimal number using a UNumberFormat.
+* The number will be formatted according to the UNumberFormat's locale.
+* The syntax of the input number is a "numeric string"
+* as defined in the Decimal Arithmetic Specification, available at
+* http://speleotrove.com/decimal
+* @param fmt The formatter to use.
+* @param number The number to format.
+* @param length The length of the input number, or -1 if the input is nul-terminated.
+* @param result A pointer to a buffer to receive the NULL-terminated formatted number. If
+* the formatted number fits into dest but cannot be NULL-terminated (length == resultLength)
+* then the error code is set to U_STRING_NOT_TERMINATED_WARNING. If the formatted number
+* doesn't fit into result then the error code is set to U_BUFFER_OVERFLOW_ERROR.
+* @param resultLength The maximum size of result.
+* @param pos    A pointer to a UFieldPosition.  On input, position->field
+*               is read.  On output, position->beginIndex and position->endIndex indicate
+*               the beginning and ending indices of field number position->field, if such
+*               a field exists.  This parameter may be NULL, in which case it is ignored.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see unum_format
+* @see unum_formatInt64
+* @see unum_parse
+* @see unum_parseInt64
+* @see unum_parseDouble
+* @see UFieldPosition
+* @stable ICU 4.4 
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_formatDecimal(    const    UNumberFormat*  fmt,
+            const char *    number,
+            int32_t         length,
+            UChar*          result,
+            int32_t         resultLength,
+            UFieldPosition  *pos, /* 0 if ignore */
+            UErrorCode*     status);
+
+/**
+ * Format a double currency amount using a UNumberFormat.
+ * The double will be formatted according to the UNumberFormat's locale.
+ * @param fmt the formatter to use
+ * @param number the number to format
+ * @param currency the 3-letter null-terminated ISO 4217 currency code
+ * @param result A pointer to a buffer to receive the NULL-terminated formatted number. If
+ * the formatted number fits into dest but cannot be NULL-terminated (length == resultLength)
+ * then the error code is set to U_STRING_NOT_TERMINATED_WARNING. If the formatted number
+ * doesn't fit into result then the error code is set to U_BUFFER_OVERFLOW_ERROR.
+ * @param resultLength the maximum number of UChars to write to result
+ * @param pos a pointer to a UFieldPosition.  On input,
+ * position->field is read.  On output, position->beginIndex and
+ * position->endIndex indicate the beginning and ending indices of
+ * field number position->field, if such a field exists.  This
+ * parameter may be NULL, in which case it is ignored.
+ * @param status a pointer to an input-output UErrorCode
+ * @return the total buffer size needed; if greater than resultLength,
+ * the output was truncated.
+ * @see unum_formatDouble
+ * @see unum_parseDoubleCurrency
+ * @see UFieldPosition
+ * @stable ICU 3.0
+ */
+U_STABLE int32_t U_EXPORT2
+unum_formatDoubleCurrency(const UNumberFormat* fmt,
+                          double number,
+                          UChar* currency,
+                          UChar* result,
+                          int32_t resultLength,
+                          UFieldPosition* pos,
+                          UErrorCode* status);
+
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Format a UFormattable into a string.
+ * @param fmt the formatter to use
+ * @param number the number to format, as a UFormattable
+ * @param result A pointer to a buffer to receive the NULL-terminated formatted number. If
+ * the formatted number fits into dest but cannot be NULL-terminated (length == resultLength)
+ * then the error code is set to U_STRING_NOT_TERMINATED_WARNING. If the formatted number
+ * doesn't fit into result then the error code is set to U_BUFFER_OVERFLOW_ERROR.
+ * @param resultLength the maximum number of UChars to write to result
+ * @param pos a pointer to a UFieldPosition.  On input,
+ * position->field is read.  On output, position->beginIndex and
+ * position->endIndex indicate the beginning and ending indices of
+ * field number position->field, if such a field exists.  This
+ * parameter may be NULL, in which case it is ignored.
+ * @param status a pointer to an input-output UErrorCode
+ * @return the total buffer size needed; if greater than resultLength,
+ * the output was truncated. Will return 0 on error.
+ * @see unum_parseToUFormattable
+ * @draft ICU 52
+ */
+U_DRAFT int32_t U_EXPORT2
+unum_formatUFormattable(const UNumberFormat* fmt,
+                        const UFormattable *number,
+                        UChar *result,
+                        int32_t resultLength,
+                        UFieldPosition *pos,
+                        UErrorCode *status);
+#endif  /* U_HIDE_DRAFT_API */
+
+/**
+* Parse a string into an integer using a UNumberFormat.
+* The string will be parsed according to the UNumberFormat's locale.
+* @param fmt The formatter to use.
+* @param text The text to parse.
+* @param textLength The length of text, or -1 if null-terminated.
+* @param parsePos If not NULL, on input a pointer to an integer specifying the offset at which
+* to begin parsing.  If not NULL, on output the offset at which parsing ended.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The value of the parsed integer
+* @see unum_parseInt64
+* @see unum_parseDouble
+* @see unum_format
+* @see unum_formatInt64
+* @see unum_formatDouble
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_parse(    const   UNumberFormat*  fmt,
+        const   UChar*          text,
+        int32_t         textLength,
+        int32_t         *parsePos /* 0 = start */,
+        UErrorCode      *status);
+
+/**
+* Parse a string into an int64 using a UNumberFormat.
+* The string will be parsed according to the UNumberFormat's locale.
+* @param fmt The formatter to use.
+* @param text The text to parse.
+* @param textLength The length of text, or -1 if null-terminated.
+* @param parsePos If not NULL, on input a pointer to an integer specifying the offset at which
+* to begin parsing.  If not NULL, on output the offset at which parsing ended.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The value of the parsed integer
+* @see unum_parse
+* @see unum_parseDouble
+* @see unum_format
+* @see unum_formatInt64
+* @see unum_formatDouble
+* @stable ICU 2.8
+*/
+U_STABLE int64_t U_EXPORT2 
+unum_parseInt64(const UNumberFormat*  fmt,
+        const UChar*  text,
+        int32_t       textLength,
+        int32_t       *parsePos /* 0 = start */,
+        UErrorCode    *status);
+
+/**
+* Parse a string into a double using a UNumberFormat.
+* The string will be parsed according to the UNumberFormat's locale.
+* @param fmt The formatter to use.
+* @param text The text to parse.
+* @param textLength The length of text, or -1 if null-terminated.
+* @param parsePos If not NULL, on input a pointer to an integer specifying the offset at which
+* to begin parsing.  If not NULL, on output the offset at which parsing ended.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The value of the parsed double
+* @see unum_parse
+* @see unum_parseInt64
+* @see unum_format
+* @see unum_formatInt64
+* @see unum_formatDouble
+* @stable ICU 2.0
+*/
+U_STABLE double U_EXPORT2 
+unum_parseDouble(    const   UNumberFormat*  fmt,
+            const   UChar*          text,
+            int32_t         textLength,
+            int32_t         *parsePos /* 0 = start */,
+            UErrorCode      *status);
+
+
+/**
+* Parse a number from a string into an unformatted numeric string using a UNumberFormat.
+* The input string will be parsed according to the UNumberFormat's locale.
+* The syntax of the output is a "numeric string"
+* as defined in the Decimal Arithmetic Specification, available at
+* http://speleotrove.com/decimal
+* @param fmt The formatter to use.
+* @param text The text to parse.
+* @param textLength The length of text, or -1 if null-terminated.
+* @param parsePos If not NULL, on input a pointer to an integer specifying the offset at which
+*                 to begin parsing.  If not NULL, on output the offset at which parsing ended.
+* @param outBuf A (char *) buffer to receive the parsed number as a string.  The output string
+*               will be nul-terminated if there is sufficient space.
+* @param outBufLength The size of the output buffer.  May be zero, in which case
+*               the outBuf pointer may be NULL, and the function will return the
+*               size of the output string.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return the length of the output string, not including any terminating nul.
+* @see unum_parse
+* @see unum_parseInt64
+* @see unum_format
+* @see unum_formatInt64
+* @see unum_formatDouble
+* @stable ICU 4.4
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_parseDecimal(const   UNumberFormat*  fmt,
+                 const   UChar*          text,
+                         int32_t         textLength,
+                         int32_t         *parsePos /* 0 = start */,
+                         char            *outBuf,
+                         int32_t         outBufLength,
+                         UErrorCode      *status);
+
+/**
+ * Parse a string into a double and a currency using a UNumberFormat.
+ * The string will be parsed according to the UNumberFormat's locale.
+ * @param fmt the formatter to use
+ * @param text the text to parse
+ * @param textLength the length of text, or -1 if null-terminated
+ * @param parsePos a pointer to an offset index into text at which to
+ * begin parsing. On output, *parsePos will point after the last
+ * parsed character.  This parameter may be NULL, in which case parsing
+ * begins at offset 0.
+ * @param currency a pointer to the buffer to receive the parsed null-
+ * terminated currency.  This buffer must have a capacity of at least
+ * 4 UChars.
+ * @param status a pointer to an input-output UErrorCode
+ * @return the parsed double
+ * @see unum_parseDouble
+ * @see unum_formatDoubleCurrency
+ * @stable ICU 3.0
+ */
+U_STABLE double U_EXPORT2
+unum_parseDoubleCurrency(const UNumberFormat* fmt,
+                         const UChar* text,
+                         int32_t textLength,
+                         int32_t* parsePos, /* 0 = start */
+                         UChar* currency,
+                         UErrorCode* status);
+
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Parse a UChar string into a UFormattable.
+ * Example code:
+ * \snippet test/cintltst/cnumtst.c unum_parseToUFormattable
+ * @param fmt the formatter to use
+ * @param result the UFormattable to hold the result. If NULL, a new UFormattable will be allocated (which the caller must close with ufmt_close).
+ * @param text the text to parse
+ * @param textLength the length of text, or -1 if null-terminated
+ * @param parsePos a pointer to an offset index into text at which to
+ * begin parsing. On output, *parsePos will point after the last
+ * parsed character.  This parameter may be NULL in which case parsing
+ * begins at offset 0.
+ * @param status a pointer to an input-output UErrorCode
+ * @return the UFormattable.  Will be ==result unless NULL was passed in for result, in which case it will be the newly opened UFormattable.
+ * @see ufmt_getType
+ * @see ufmt_close
+ * @draft ICU 52
+ */
+U_DRAFT UFormattable* U_EXPORT2
+unum_parseToUFormattable(const UNumberFormat* fmt,
+                         UFormattable *result,
+                         const UChar* text,
+                         int32_t textLength,
+                         int32_t* parsePos, /* 0 = start */
+                         UErrorCode* status);
+#endif  /* U_HIDE_DRAFT_API */
+
+/**
+ * Set the pattern used by a UNumberFormat.  This can only be used
+ * on a DecimalFormat, other formats return U_UNSUPPORTED_ERROR
+ * in the status.
+ * @param format The formatter to set.
+ * @param localized TRUE if the pattern is localized, FALSE otherwise.
+ * @param pattern The new pattern
+ * @param patternLength The length of pattern, or -1 if null-terminated.
+ * @param parseError A pointer to UParseError to recieve information
+ * about errors occurred during parsing, or NULL if no parse error
+ * information is desired.
+ * @param status A pointer to an input-output UErrorCode.
+ * @see unum_toPattern
+ * @see DecimalFormat
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2 
+unum_applyPattern(          UNumberFormat  *format,
+                            UBool          localized,
+                    const   UChar          *pattern,
+                            int32_t         patternLength,
+                            UParseError    *parseError,
+                            UErrorCode     *status
+                                    );
+
+/**
+* Get a locale for which decimal formatting patterns are available.
+* A UNumberFormat in a locale returned by this function will perform the correct
+* formatting and parsing for the locale.  The results of this call are not
+* valid for rule-based number formats.
+* @param localeIndex The index of the desired locale.
+* @return A locale for which number formatting patterns are available, or 0 if none.
+* @see unum_countAvailable
+* @stable ICU 2.0
+*/
+U_STABLE const char* U_EXPORT2 
+unum_getAvailable(int32_t localeIndex);
+
+/**
+* Determine how many locales have decimal formatting patterns available.  The
+* results of this call are not valid for rule-based number formats.
+* This function is useful for determining the loop ending condition for
+* calls to {@link #unum_getAvailable }.
+* @return The number of locales for which decimal formatting patterns are available.
+* @see unum_getAvailable
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_countAvailable(void);
+
+#if UCONFIG_HAVE_PARSEALLINPUT
+/**
+ * @internal
+ */
+typedef enum UNumberFormatAttributeValue {
+  /** @internal */
+  UNUM_NO = 0,
+  /** @internal */
+  UNUM_YES = 1,
+  /** @internal */
+  UNUM_MAYBE = 2
+} UNumberFormatAttributeValue;
+#endif
+
+/** The possible UNumberFormat numeric attributes @stable ICU 2.0 */
+typedef enum UNumberFormatAttribute {
+  /** Parse integers only */
+  UNUM_PARSE_INT_ONLY,
+  /** Use grouping separator */
+  UNUM_GROUPING_USED,
+  /** Always show decimal point */
+  UNUM_DECIMAL_ALWAYS_SHOWN,
+  /** Maximum integer digits */
+  UNUM_MAX_INTEGER_DIGITS,
+  /** Minimum integer digits */
+  UNUM_MIN_INTEGER_DIGITS,
+  /** Integer digits */
+  UNUM_INTEGER_DIGITS,
+  /** Maximum fraction digits */
+  UNUM_MAX_FRACTION_DIGITS,
+  /** Minimum fraction digits */
+  UNUM_MIN_FRACTION_DIGITS,
+  /** Fraction digits */
+  UNUM_FRACTION_DIGITS,
+  /** Multiplier */
+  UNUM_MULTIPLIER,
+  /** Grouping size */
+  UNUM_GROUPING_SIZE,
+  /** Rounding Mode */
+  UNUM_ROUNDING_MODE,
+  /** Rounding increment */
+  UNUM_ROUNDING_INCREMENT,
+  /** The width to which the output of <code>format()</code> is padded. */
+  UNUM_FORMAT_WIDTH,
+  /** The position at which padding will take place. */
+  UNUM_PADDING_POSITION,
+  /** Secondary grouping size */
+  UNUM_SECONDARY_GROUPING_SIZE,
+  /** Use significant digits
+   * @stable ICU 3.0 */
+  UNUM_SIGNIFICANT_DIGITS_USED,
+  /** Minimum significant digits
+   * @stable ICU 3.0 */
+  UNUM_MIN_SIGNIFICANT_DIGITS,
+  /** Maximum significant digits
+   * @stable ICU 3.0 */
+  UNUM_MAX_SIGNIFICANT_DIGITS,
+  /** Lenient parse mode used by rule-based formats.
+   * @stable ICU 3.0
+   */
+  UNUM_LENIENT_PARSE,
+#if UCONFIG_HAVE_PARSEALLINPUT
+  /** Consume all input. (may use fastpath). Set to UNUM_YES (require fastpath), UNUM_NO (skip fastpath), or UNUM_MAYBE (heuristic).
+   * This is an internal ICU API. Do not use.
+   * @internal
+   */
+  UNUM_PARSE_ALL_INPUT = UNUM_LENIENT_PARSE + 1,
+#endif
+#ifndef U_HIDE_DRAFT_API
+  /** 
+    * Scale, which adjusts the position of the
+    * decimal point when formatting.  Amounts will be multiplied by 10 ^ (scale)
+    * before they are formatted.  The default value for the scale is 0 ( no adjustment ).
+    *
+    * <p>Example: setting the scale to 3, 123 formats as "123,000"
+    * <p>Example: setting the scale to -4, 123 formats as "0.0123"
+    *
+   * @draft ICU 51 */
+  UNUM_SCALE = UNUM_LENIENT_PARSE + 2,
+#endif /* U_HIDE_DRAFT_API */
+
+#ifndef U_HIDE_INTERNAL_API
+  /** Count of "regular" numeric attributes.
+   * @internal */
+  UNUM_NUMERIC_ATTRIBUTE_COUNT = UNUM_LENIENT_PARSE + 3,
+
+  /** One below the first bitfield-boolean item.
+   * All items after this one are stored in boolean form.
+   * @internal */
+  UNUM_MAX_NONBOOLEAN_ATTRIBUTE = 0x0FFF,
+#endif  /* U_HIDE_INTERNAL_API */
+
+  /** If 1, specifies that if setting the "max integer digits" attribute would truncate a value, set an error status rather than silently truncating.
+   * For example,  formatting the value 1234 with 4 max int digits would succeed, but formatting 12345 would fail. There is no effect on parsing.
+   * Default: 0 (not set)
+   * @stable ICU 50
+   */
+  UNUM_FORMAT_FAIL_IF_MORE_THAN_MAX_DIGITS = 0x1000,
+  /** 
+   * if this attribute is set to 1, specifies that, if the pattern doesn't contain an exponent, the exponent will not be parsed. If the pattern does contain an exponent, this attribute has no effect.
+   * Has no effect on formatting.
+   * Default: 0 (unset)
+   * @stable ICU 50
+   */
+  UNUM_PARSE_NO_EXPONENT,
+
+#ifndef U_HIDE_INTERNAL_API
+  /** Limit of boolean attributes.
+   * @internal */
+  UNUM_LIMIT_BOOLEAN_ATTRIBUTE
+#endif  /* U_HIDE_INTERNAL_API */
+} UNumberFormatAttribute;
+
+/**
+* Get a numeric attribute associated with a UNumberFormat.
+* An example of a numeric attribute is the number of integer digits a formatter will produce.
+* @param fmt The formatter to query.
+* @param attr The attribute to query; one of UNUM_PARSE_INT_ONLY, UNUM_GROUPING_USED,
+* UNUM_DECIMAL_ALWAYS_SHOWN, UNUM_MAX_INTEGER_DIGITS, UNUM_MIN_INTEGER_DIGITS, UNUM_INTEGER_DIGITS,
+* UNUM_MAX_FRACTION_DIGITS, UNUM_MIN_FRACTION_DIGITS, UNUM_FRACTION_DIGITS, UNUM_MULTIPLIER,
+* UNUM_GROUPING_SIZE, UNUM_ROUNDING_MODE, UNUM_FORMAT_WIDTH, UNUM_PADDING_POSITION, UNUM_SECONDARY_GROUPING_SIZE,
+* UNUM_SCALE.
+* @return The value of attr.
+* @see unum_setAttribute
+* @see unum_getDoubleAttribute
+* @see unum_setDoubleAttribute
+* @see unum_getTextAttribute
+* @see unum_setTextAttribute
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_getAttribute(const UNumberFormat*          fmt,
+          UNumberFormatAttribute  attr);
+
+/**
+* Set a numeric attribute associated with a UNumberFormat.
+* An example of a numeric attribute is the number of integer digits a formatter will produce.  If the
+* formatter does not understand the attribute, the call is ignored.  Rule-based formatters only understand
+* the lenient-parse attribute.
+* @param fmt The formatter to set.
+* @param attr The attribute to set; one of UNUM_PARSE_INT_ONLY, UNUM_GROUPING_USED,
+* UNUM_DECIMAL_ALWAYS_SHOWN, UNUM_MAX_INTEGER_DIGITS, UNUM_MIN_INTEGER_DIGITS, UNUM_INTEGER_DIGITS,
+* UNUM_MAX_FRACTION_DIGITS, UNUM_MIN_FRACTION_DIGITS, UNUM_FRACTION_DIGITS, UNUM_MULTIPLIER,
+* UNUM_GROUPING_SIZE, UNUM_ROUNDING_MODE, UNUM_FORMAT_WIDTH, UNUM_PADDING_POSITION, UNUM_SECONDARY_GROUPING_SIZE,
+* UNUM_LENIENT_PARSE, or UNUM_SCALE.
+* @param newValue The new value of attr.
+* @see unum_getAttribute
+* @see unum_getDoubleAttribute
+* @see unum_setDoubleAttribute
+* @see unum_getTextAttribute
+* @see unum_setTextAttribute
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+unum_setAttribute(    UNumberFormat*          fmt,
+            UNumberFormatAttribute  attr,
+            int32_t                 newValue);
+
+
+/**
+* Get a numeric attribute associated with a UNumberFormat.
+* An example of a numeric attribute is the number of integer digits a formatter will produce.
+* If the formatter does not understand the attribute, -1 is returned.
+* @param fmt The formatter to query.
+* @param attr The attribute to query; e.g. UNUM_ROUNDING_INCREMENT.
+* @return The value of attr.
+* @see unum_getAttribute
+* @see unum_setAttribute
+* @see unum_setDoubleAttribute
+* @see unum_getTextAttribute
+* @see unum_setTextAttribute
+* @stable ICU 2.0
+*/
+U_STABLE double U_EXPORT2 
+unum_getDoubleAttribute(const UNumberFormat*          fmt,
+          UNumberFormatAttribute  attr);
+
+/**
+* Set a numeric attribute associated with a UNumberFormat.
+* An example of a numeric attribute is the number of integer digits a formatter will produce.
+* If the formatter does not understand the attribute, this call is ignored.
+* @param fmt The formatter to set.
+* @param attr The attribute to set; e.g. UNUM_ROUNDING_INCREMENT.
+* @param newValue The new value of attr.
+* @see unum_getAttribute
+* @see unum_setAttribute
+* @see unum_getDoubleAttribute
+* @see unum_getTextAttribute
+* @see unum_setTextAttribute
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+unum_setDoubleAttribute(    UNumberFormat*          fmt,
+            UNumberFormatAttribute  attr,
+            double                 newValue);
+
+/** The possible UNumberFormat text attributes @stable ICU 2.0*/
+typedef enum UNumberFormatTextAttribute {
+  /** Positive prefix */
+  UNUM_POSITIVE_PREFIX,
+  /** Positive suffix */
+  UNUM_POSITIVE_SUFFIX,
+  /** Negative prefix */
+  UNUM_NEGATIVE_PREFIX,
+  /** Negative suffix */
+  UNUM_NEGATIVE_SUFFIX,
+  /** The character used to pad to the format width. */
+  UNUM_PADDING_CHARACTER,
+  /** The ISO currency code */
+  UNUM_CURRENCY_CODE,
+  /**
+   * The default rule set.  This is only available with rule-based formatters.
+   * @stable ICU 3.0
+   */
+  UNUM_DEFAULT_RULESET,
+  /**
+   * The public rule sets.  This is only available with rule-based formatters.
+   * This is a read-only attribute.  The public rulesets are returned as a
+   * single string, with each ruleset name delimited by ';' (semicolon).
+   * @stable ICU 3.0
+   */
+  UNUM_PUBLIC_RULESETS
+} UNumberFormatTextAttribute;
+
+/**
+* Get a text attribute associated with a UNumberFormat.
+* An example of a text attribute is the suffix for positive numbers.  If the formatter
+* does not understand the attribute, U_UNSUPPORTED_ERROR is returned as the status.
+* Rule-based formatters only understand UNUM_DEFAULT_RULESET and UNUM_PUBLIC_RULESETS.
+* @param fmt The formatter to query.
+* @param tag The attribute to query; one of UNUM_POSITIVE_PREFIX, UNUM_POSITIVE_SUFFIX,
+* UNUM_NEGATIVE_PREFIX, UNUM_NEGATIVE_SUFFIX, UNUM_PADDING_CHARACTER, UNUM_CURRENCY_CODE,
+* UNUM_DEFAULT_RULESET, or UNUM_PUBLIC_RULESETS.
+* @param result A pointer to a buffer to receive the attribute.
+* @param resultLength The maximum size of result.
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The total buffer size needed; if greater than resultLength, the output was truncated.
+* @see unum_setTextAttribute
+* @see unum_getAttribute
+* @see unum_setAttribute
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2 
+unum_getTextAttribute(    const    UNumberFormat*                    fmt,
+            UNumberFormatTextAttribute      tag,
+            UChar*                            result,
+            int32_t                            resultLength,
+            UErrorCode*                        status);
+
+/**
+* Set a text attribute associated with a UNumberFormat.
+* An example of a text attribute is the suffix for positive numbers.  Rule-based formatters
+* only understand UNUM_DEFAULT_RULESET.
+* @param fmt The formatter to set.
+* @param tag The attribute to set; one of UNUM_POSITIVE_PREFIX, UNUM_POSITIVE_SUFFIX,
+* UNUM_NEGATIVE_PREFIX, UNUM_NEGATIVE_SUFFIX, UNUM_PADDING_CHARACTER, UNUM_CURRENCY_CODE,
+* or UNUM_DEFAULT_RULESET.
+* @param newValue The new value of attr.
+* @param newValueLength The length of newValue, or -1 if null-terminated.
+* @param status A pointer to an UErrorCode to receive any errors
+* @see unum_getTextAttribute
+* @see unum_getAttribute
+* @see unum_setAttribute
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2 
+unum_setTextAttribute(    UNumberFormat*                    fmt,
+            UNumberFormatTextAttribute      tag,
+            const    UChar*                            newValue,
+            int32_t                            newValueLength,
+            UErrorCode                        *status);
+
+/**
+ * Extract the pattern from a UNumberFormat.  The pattern will follow
+ * the DecimalFormat pattern syntax.
+ * @param fmt The formatter to query.
+ * @param isPatternLocalized TRUE if the pattern should be localized,
+ * FALSE otherwise.  This is ignored if the formatter is a rule-based
+ * formatter.
+ * @param result A pointer to a buffer to receive the pattern.
+ * @param resultLength The maximum size of result.
+ * @param status A pointer to an input-output UErrorCode.
+ * @return The total buffer size needed; if greater than resultLength,
+ * the output was truncated.
+ * @see unum_applyPattern
+ * @see DecimalFormat
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2 
+unum_toPattern(    const    UNumberFormat*          fmt,
+        UBool                  isPatternLocalized,
+        UChar*                  result,
+        int32_t                 resultLength,
+        UErrorCode*             status);
+
+
+/**
+ * Constants for specifying a number format symbol.
+ * @stable ICU 2.0
+ */
+typedef enum UNumberFormatSymbol {
+  /** The decimal separator */
+  UNUM_DECIMAL_SEPARATOR_SYMBOL = 0,
+  /** The grouping separator */
+  UNUM_GROUPING_SEPARATOR_SYMBOL = 1,
+  /** The pattern separator */
+  UNUM_PATTERN_SEPARATOR_SYMBOL = 2,
+  /** The percent sign */
+  UNUM_PERCENT_SYMBOL = 3,
+  /** Zero*/
+  UNUM_ZERO_DIGIT_SYMBOL = 4,
+  /** Character representing a digit in the pattern */
+  UNUM_DIGIT_SYMBOL = 5,
+  /** The minus sign */
+  UNUM_MINUS_SIGN_SYMBOL = 6,
+  /** The plus sign */
+  UNUM_PLUS_SIGN_SYMBOL = 7,
+  /** The currency symbol */
+  UNUM_CURRENCY_SYMBOL = 8,
+  /** The international currency symbol */
+  UNUM_INTL_CURRENCY_SYMBOL = 9,
+  /** The monetary separator */
+  UNUM_MONETARY_SEPARATOR_SYMBOL = 10,
+  /** The exponential symbol */
+  UNUM_EXPONENTIAL_SYMBOL = 11,
+  /** Per mill symbol */
+  UNUM_PERMILL_SYMBOL = 12,
+  /** Escape padding character */
+  UNUM_PAD_ESCAPE_SYMBOL = 13,
+  /** Infinity symbol */
+  UNUM_INFINITY_SYMBOL = 14,
+  /** Nan symbol */
+  UNUM_NAN_SYMBOL = 15,
+  /** Significant digit symbol
+   * @stable ICU 3.0 */
+  UNUM_SIGNIFICANT_DIGIT_SYMBOL = 16,
+  /** The monetary grouping separator 
+   * @stable ICU 3.6
+   */
+  UNUM_MONETARY_GROUPING_SEPARATOR_SYMBOL = 17,
+  /** One
+   * @stable ICU 4.6
+   */
+  UNUM_ONE_DIGIT_SYMBOL = 18,
+  /** Two
+   * @stable ICU 4.6
+   */
+  UNUM_TWO_DIGIT_SYMBOL = 19,
+  /** Three
+   * @stable ICU 4.6
+   */
+  UNUM_THREE_DIGIT_SYMBOL = 20,
+  /** Four
+   * @stable ICU 4.6
+   */
+  UNUM_FOUR_DIGIT_SYMBOL = 21,
+  /** Five
+   * @stable ICU 4.6
+   */
+  UNUM_FIVE_DIGIT_SYMBOL = 22,
+  /** Six
+   * @stable ICU 4.6
+   */
+  UNUM_SIX_DIGIT_SYMBOL = 23,
+  /** Seven
+    * @stable ICU 4.6
+   */
+  UNUM_SEVEN_DIGIT_SYMBOL = 24,
+  /** Eight
+   * @stable ICU 4.6
+   */
+  UNUM_EIGHT_DIGIT_SYMBOL = 25,
+  /** Nine
+   * @stable ICU 4.6
+   */
+  UNUM_NINE_DIGIT_SYMBOL = 26,
+  /** count symbol constants */
+  UNUM_FORMAT_SYMBOL_COUNT = 27
+} UNumberFormatSymbol;
+
+/**
+* Get a symbol associated with a UNumberFormat.
+* A UNumberFormat uses symbols to represent the special locale-dependent
+* characters in a number, for example the percent sign. This API is not
+* supported for rule-based formatters.
+* @param fmt The formatter to query.
+* @param symbol The UNumberFormatSymbol constant for the symbol to get
+* @param buffer The string buffer that will receive the symbol string;
+*               if it is NULL, then only the length of the symbol is returned
+* @param size The size of the string buffer
+* @param status A pointer to an UErrorCode to receive any errors
+* @return The length of the symbol; the buffer is not modified if
+*         <code>length&gt;=size</code>
+* @see unum_setSymbol
+* @stable ICU 2.0
+*/
+U_STABLE int32_t U_EXPORT2
+unum_getSymbol(const UNumberFormat *fmt,
+               UNumberFormatSymbol symbol,
+               UChar *buffer,
+               int32_t size,
+               UErrorCode *status);
+
+/**
+* Set a symbol associated with a UNumberFormat.
+* A UNumberFormat uses symbols to represent the special locale-dependent
+* characters in a number, for example the percent sign.  This API is not
+* supported for rule-based formatters.
+* @param fmt The formatter to set.
+* @param symbol The UNumberFormatSymbol constant for the symbol to set
+* @param value The string to set the symbol to
+* @param length The length of the string, or -1 for a zero-terminated string
+* @param status A pointer to an UErrorCode to receive any errors.
+* @see unum_getSymbol
+* @stable ICU 2.0
+*/
+U_STABLE void U_EXPORT2
+unum_setSymbol(UNumberFormat *fmt,
+               UNumberFormatSymbol symbol,
+               const UChar *value,
+               int32_t length,
+               UErrorCode *status);
+
+
+/**
+ * Get the locale for this number format object.
+ * You can choose between valid and actual locale.
+ * @param fmt The formatter to get the locale from
+ * @param type type of the locale we're looking for (valid or actual) 
+ * @param status error code for the operation
+ * @return the locale name
+ * @stable ICU 2.8
+ */
+U_STABLE const char* U_EXPORT2
+unum_getLocaleByType(const UNumberFormat *fmt,
+                     ULocDataLocaleType type,
+                     UErrorCode* status); 
+
+#endif /* #if !UCONFIG_NO_FORMATTING */
+
+#endif
diff --git a/icu/unicode/unumsys.h b/icu/unicode/unumsys.h
new file mode 100644
index 0000000..026463e
--- /dev/null
+++ b/icu/unicode/unumsys.h
@@ -0,0 +1,174 @@
+/*
+*****************************************************************************************
+* Copyright (C) 2013, International Business Machines
+* Corporation and others. All Rights Reserved.
+*****************************************************************************************
+*/
+
+#ifndef UNUMSYS_H
+#define UNUMSYS_H
+
+#include "unicode/utypes.h"
+
+#if !UCONFIG_NO_FORMATTING
+
+#include "unicode/uenum.h"
+#include "unicode/localpointer.h"
+
+/**
+ * \file
+ * \brief C API: UNumberingSystem, information about numbering systems
+ *
+ * Defines numbering systems. A numbering system describes the scheme by which 
+ * numbers are to be presented to the end user. In its simplest form, a numbering
+ * system describes the set of digit characters that are to be used to display
+ * numbers, such as Western digits, Thai digits, Arabic-Indic digits, etc., in a
+ * positional numbering system with a specified radix (typically 10).
+ * More complicated numbering systems are algorithmic in nature, and require use
+ * of an RBNF formatter (rule based number formatter), in order to calculate
+ * the characters to be displayed for a given number. Examples of algorithmic
+ * numbering systems include Roman numerals, Chinese numerals, and Hebrew numerals.
+ * Formatting rules for many commonly used numbering systems are included in
+ * the ICU package, based on the numbering system rules defined in CLDR.
+ * Alternate numbering systems can be specified to a locale by using the
+ * numbers locale keyword.
+ */
+
+#ifndef U_HIDE_DRAFT_API
+
+/**
+ * Opaque UNumberingSystem object for use in C programs.
+ * @draft ICU 52
+ */
+struct UNumberingSystem;
+typedef struct UNumberingSystem UNumberingSystem;  /**< C typedef for struct UNumberingSystem. @draft ICU 52 */
+
+/**
+ * Opens a UNumberingSystem object using the default numbering system for the specified
+ * locale.
+ * @param locale    The locale for which the default numbering system should be opened.
+ * @param status    A pointer to a UErrorCode to receive any errors. For example, this
+ *                  may be U_UNSUPPORTED_ERROR for a locale such as "en@numbers=xyz" that
+ *                  specifies a numbering system unknown to ICU.
+ * @return          A UNumberingSystem for the specified locale, or NULL if an error
+ *                  occurred.
+ * @draft ICU 52
+ */
+U_DRAFT UNumberingSystem * U_EXPORT2
+unumsys_open(const char *locale, UErrorCode *status);
+
+/**
+ * Opens a UNumberingSystem object using the name of one of the predefined numbering
+ * systems specified by CLDR and known to ICU, such as "latn", "arabext", or "hanidec";
+ * the full list is returned by unumsys_openAvailableNames. Note that some of the names
+ * listed at http://unicode.org/repos/cldr/tags/latest/common/bcp47/number.xml - e.g.
+ * default, native, traditional, finance - do not identify specific numbering systems,
+ * but rather key values that may only be used as part of a locale, which in turn
+ * defines how they are mapped to a specific numbering system such as "latn" or "hant".
+ *
+ * @param name      The name of the numbering system for which a UNumberingSystem object
+ *                  should be opened.
+ * @param status    A pointer to a UErrorCode to receive any errors. For example, this
+ *                  may be U_UNSUPPORTED_ERROR for a numbering system such as "xyz" that
+ *                  is unknown to ICU.
+ * @return          A UNumberingSystem for the specified name, or NULL if an error
+ *                  occurred.
+ * @draft ICU 52
+ */
+U_DRAFT UNumberingSystem * U_EXPORT2
+unumsys_openByName(const char *name, UErrorCode *status);
+
+/**
+ * Close a UNumberingSystem object. Once closed it may no longer be used.
+ * @param unumsys   The UNumberingSystem object to close.
+ * @draft ICU 52
+ */
+U_DRAFT void U_EXPORT2
+unumsys_close(UNumberingSystem *unumsys);
+
+#if U_SHOW_CPLUSPLUS_API
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUNumberingSystemPointer
+ * "Smart pointer" class, closes a UNumberingSystem via unumsys_close().
+ * For most methods see the LocalPointerBase base class.
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @draft ICU 52
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUNumberingSystemPointer, UNumberingSystem, unumsys_close);
+
+U_NAMESPACE_END
+#endif
+
+/**
+ * Returns an enumeration over the names of all of the predefined numbering systems known
+ * to ICU.
+ * @param status    A pointer to a UErrorCode to receive any errors.
+ * @return          A pointer to a UEnumeration that must be closed with uenum_close(),
+ *                  or NULL if an error occurred.
+ * @draft ICU 52
+ */
+U_DRAFT UEnumeration * U_EXPORT2
+unumsys_openAvailableNames(UErrorCode *status);
+
+/**
+ * Returns the name of the specified UNumberingSystem object (if it is one of the
+ * predefined names known to ICU).
+ * @param unumsys   The UNumberingSystem whose name is desired.
+ * @return          A pointer to the name of the specified UNumberingSystem object, or
+ *                  NULL if the name is not one of the ICU predefined names. The pointer
+ *                  is only valid for the lifetime of the UNumberingSystem object.
+ * @draft ICU 52
+ */
+U_DRAFT const char * U_EXPORT2
+unumsys_getName(const UNumberingSystem *unumsys);
+
+/**
+ * Returns whether the given UNumberingSystem object is for an algorithmic (not purely
+ * positional) system.
+ * @param unumsys   The UNumberingSystem whose algorithmic status is desired.
+ * @return          TRUE if the specified UNumberingSystem object is for an algorithmic
+ *                  system.
+ * @draft ICU 52
+ */
+U_DRAFT UBool U_EXPORT2
+unumsys_isAlgorithmic(const UNumberingSystem *unumsys);
+
+/**
+ * Returns the radix of the specified UNumberingSystem object. Simple positional
+ * numbering systems typically have radix 10, but might have a radix of e.g. 16 for
+ * hexadecimal. The radix is less well-defined for non-positional algorithmic systems.
+ * @param unumsys   The UNumberingSystem whose radix is desired.
+ * @return          The radix of the specified UNumberingSystem object.
+ * @draft ICU 52
+ */
+U_DRAFT int32_t U_EXPORT2
+unumsys_getRadix(const UNumberingSystem *unumsys);
+
+/**
+ * Get the description string of the specified UNumberingSystem object. For simple
+ * positional systems this is the ordered string of digits (with length matching
+ * the radix), e.g. "\u3007\u4E00\u4E8C\u4E09\u56DB\u4E94\u516D\u4E03\u516B\u4E5D"
+ * for "hanidec"; it would be "0123456789ABCDEF" for hexadecimal. For
+ * algorithmic systems this is the name of the RBNF ruleset used for formatting,
+ * e.g. "zh/SpelloutRules/%spellout-cardinal" for "hans" or "%greek-upper" for
+ * "grek".
+ * @param unumsys   The UNumberingSystem whose description string is desired.
+ * @param result    A pointer to a buffer to receive the description string.
+ * @param resultLength  The maximum size of result.
+ * @param status    A pointer to a UErrorCode to receive any errors.
+ * @return          The total buffer size needed; if greater than resultLength, the
+ *                  output was truncated.
+ * @draft ICU 52
+ */
+U_DRAFT int32_t U_EXPORT2
+unumsys_getDescription(const UNumberingSystem *unumsys, UChar *result,
+                       int32_t resultLength, UErrorCode *status);
+
+#endif  /* U_HIDE_DRAFT_API */
+
+#endif /* #if !UCONFIG_NO_FORMATTING */
+
+#endif
diff --git a/icu/unicode/urename.h b/icu/unicode/urename.h
new file mode 100644
index 0000000..6b1f490
--- /dev/null
+++ b/icu/unicode/urename.h
@@ -0,0 +1,1825 @@
+/*
+*******************************************************************************
+*   Copyright (C) 2002-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*******************************************************************************
+*
+*   file name:  urename.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   Created by: Perl script tools/genren.pl written by Vladimir Weinstein
+*
+*  Contains data for renaming ICU exports.
+*  Gets included by umachine.h
+*
+*  THIS FILE IS MACHINE-GENERATED, DON'T PLAY WITH IT IF YOU DON'T KNOW WHAT
+*  YOU ARE DOING, OTHERWISE VERY BAD THINGS WILL HAPPEN!
+*/
+
+#ifndef URENAME_H
+#define URENAME_H
+
+/* U_DISABLE_RENAMING can be defined in the following ways:
+ *   - when running configure, e.g.
+ *        runConfigureICU Linux --disable-renaming
+ *   - by changing the default setting of U_DISABLE_RENAMING in uconfig.h
+ */
+
+#include "unicode/uconfig.h"
+
+#if !U_DISABLE_RENAMING
+
+/* We need the U_ICU_ENTRY_POINT_RENAME definition. There's a default one in unicode/uvernum.h we can use, but we will give
+   the platform a chance to define it first.
+   Normally (if utypes.h or umachine.h was included first) this will not be necessary as it will already be defined.
+ */
+
+#ifndef U_ICU_ENTRY_POINT_RENAME
+#include "unicode/umachine.h"
+#endif
+
+/* If we still don't have U_ICU_ENTRY_POINT_RENAME use the default. */
+#ifndef U_ICU_ENTRY_POINT_RENAME
+#include "unicode/uvernum.h"
+#endif
+
+/* Error out before the following defines cause very strange and unexpected code breakage */
+#ifndef U_ICU_ENTRY_POINT_RENAME
+#error U_ICU_ENTRY_POINT_RENAME is not defined - cannot continue. Consider defining U_DISABLE_RENAMING if renaming should not be used.
+#endif
+
+
+/* C exports renaming data */
+
+#define T_CString_int64ToString U_ICU_ENTRY_POINT_RENAME(T_CString_int64ToString)
+#define T_CString_integerToString U_ICU_ENTRY_POINT_RENAME(T_CString_integerToString)
+#define T_CString_stringToInteger U_ICU_ENTRY_POINT_RENAME(T_CString_stringToInteger)
+#define T_CString_toLowerCase U_ICU_ENTRY_POINT_RENAME(T_CString_toLowerCase)
+#define T_CString_toUpperCase U_ICU_ENTRY_POINT_RENAME(T_CString_toUpperCase)
+#define UCNV_FROM_U_CALLBACK_ESCAPE U_ICU_ENTRY_POINT_RENAME(UCNV_FROM_U_CALLBACK_ESCAPE)
+#define UCNV_FROM_U_CALLBACK_SKIP U_ICU_ENTRY_POINT_RENAME(UCNV_FROM_U_CALLBACK_SKIP)
+#define UCNV_FROM_U_CALLBACK_STOP U_ICU_ENTRY_POINT_RENAME(UCNV_FROM_U_CALLBACK_STOP)
+#define UCNV_FROM_U_CALLBACK_SUBSTITUTE U_ICU_ENTRY_POINT_RENAME(UCNV_FROM_U_CALLBACK_SUBSTITUTE)
+#define UCNV_TO_U_CALLBACK_ESCAPE U_ICU_ENTRY_POINT_RENAME(UCNV_TO_U_CALLBACK_ESCAPE)
+#define UCNV_TO_U_CALLBACK_SKIP U_ICU_ENTRY_POINT_RENAME(UCNV_TO_U_CALLBACK_SKIP)
+#define UCNV_TO_U_CALLBACK_STOP U_ICU_ENTRY_POINT_RENAME(UCNV_TO_U_CALLBACK_STOP)
+#define UCNV_TO_U_CALLBACK_SUBSTITUTE U_ICU_ENTRY_POINT_RENAME(UCNV_TO_U_CALLBACK_SUBSTITUTE)
+#define UDataMemory_createNewInstance U_ICU_ENTRY_POINT_RENAME(UDataMemory_createNewInstance)
+#define UDataMemory_init U_ICU_ENTRY_POINT_RENAME(UDataMemory_init)
+#define UDataMemory_isLoaded U_ICU_ENTRY_POINT_RENAME(UDataMemory_isLoaded)
+#define UDataMemory_normalizeDataPointer U_ICU_ENTRY_POINT_RENAME(UDataMemory_normalizeDataPointer)
+#define UDataMemory_setData U_ICU_ENTRY_POINT_RENAME(UDataMemory_setData)
+#define UDatamemory_assign U_ICU_ENTRY_POINT_RENAME(UDatamemory_assign)
+#define _ASCIIData U_ICU_ENTRY_POINT_RENAME(_ASCIIData)
+#define _Bocu1Data U_ICU_ENTRY_POINT_RENAME(_Bocu1Data)
+#define _CESU8Data U_ICU_ENTRY_POINT_RENAME(_CESU8Data)
+#define _CompoundTextData U_ICU_ENTRY_POINT_RENAME(_CompoundTextData)
+#define _HZData U_ICU_ENTRY_POINT_RENAME(_HZData)
+#define _IMAPData U_ICU_ENTRY_POINT_RENAME(_IMAPData)
+#define _ISCIIData U_ICU_ENTRY_POINT_RENAME(_ISCIIData)
+#define _ISO2022Data U_ICU_ENTRY_POINT_RENAME(_ISO2022Data)
+#define _LMBCSData1 U_ICU_ENTRY_POINT_RENAME(_LMBCSData1)
+#define _LMBCSData11 U_ICU_ENTRY_POINT_RENAME(_LMBCSData11)
+#define _LMBCSData16 U_ICU_ENTRY_POINT_RENAME(_LMBCSData16)
+#define _LMBCSData17 U_ICU_ENTRY_POINT_RENAME(_LMBCSData17)
+#define _LMBCSData18 U_ICU_ENTRY_POINT_RENAME(_LMBCSData18)
+#define _LMBCSData19 U_ICU_ENTRY_POINT_RENAME(_LMBCSData19)
+#define _LMBCSData2 U_ICU_ENTRY_POINT_RENAME(_LMBCSData2)
+#define _LMBCSData3 U_ICU_ENTRY_POINT_RENAME(_LMBCSData3)
+#define _LMBCSData4 U_ICU_ENTRY_POINT_RENAME(_LMBCSData4)
+#define _LMBCSData5 U_ICU_ENTRY_POINT_RENAME(_LMBCSData5)
+#define _LMBCSData6 U_ICU_ENTRY_POINT_RENAME(_LMBCSData6)
+#define _LMBCSData8 U_ICU_ENTRY_POINT_RENAME(_LMBCSData8)
+#define _Latin1Data U_ICU_ENTRY_POINT_RENAME(_Latin1Data)
+#define _MBCSData U_ICU_ENTRY_POINT_RENAME(_MBCSData)
+#define _SCSUData U_ICU_ENTRY_POINT_RENAME(_SCSUData)
+#define _UTF16BEData U_ICU_ENTRY_POINT_RENAME(_UTF16BEData)
+#define _UTF16Data U_ICU_ENTRY_POINT_RENAME(_UTF16Data)
+#define _UTF16LEData U_ICU_ENTRY_POINT_RENAME(_UTF16LEData)
+#define _UTF32BEData U_ICU_ENTRY_POINT_RENAME(_UTF32BEData)
+#define _UTF32Data U_ICU_ENTRY_POINT_RENAME(_UTF32Data)
+#define _UTF32LEData U_ICU_ENTRY_POINT_RENAME(_UTF32LEData)
+#define _UTF7Data U_ICU_ENTRY_POINT_RENAME(_UTF7Data)
+#define _UTF8Data U_ICU_ENTRY_POINT_RENAME(_UTF8Data)
+#define cmemory_cleanup U_ICU_ENTRY_POINT_RENAME(cmemory_cleanup)
+#define cmemory_inUse U_ICU_ENTRY_POINT_RENAME(cmemory_inUse)
+#define izrule_clone U_ICU_ENTRY_POINT_RENAME(izrule_clone)
+#define izrule_close U_ICU_ENTRY_POINT_RENAME(izrule_close)
+#define izrule_equals U_ICU_ENTRY_POINT_RENAME(izrule_equals)
+#define izrule_getDSTSavings U_ICU_ENTRY_POINT_RENAME(izrule_getDSTSavings)
+#define izrule_getDynamicClassID U_ICU_ENTRY_POINT_RENAME(izrule_getDynamicClassID)
+#define izrule_getFinalStart U_ICU_ENTRY_POINT_RENAME(izrule_getFinalStart)
+#define izrule_getFirstStart U_ICU_ENTRY_POINT_RENAME(izrule_getFirstStart)
+#define izrule_getName U_ICU_ENTRY_POINT_RENAME(izrule_getName)
+#define izrule_getNextStart U_ICU_ENTRY_POINT_RENAME(izrule_getNextStart)
+#define izrule_getPreviousStart U_ICU_ENTRY_POINT_RENAME(izrule_getPreviousStart)
+#define izrule_getRawOffset U_ICU_ENTRY_POINT_RENAME(izrule_getRawOffset)
+#define izrule_getStaticClassID U_ICU_ENTRY_POINT_RENAME(izrule_getStaticClassID)
+#define izrule_isEquivalentTo U_ICU_ENTRY_POINT_RENAME(izrule_isEquivalentTo)
+#define izrule_open U_ICU_ENTRY_POINT_RENAME(izrule_open)
+#define le_close U_ICU_ENTRY_POINT_RENAME(le_close)
+#define le_create U_ICU_ENTRY_POINT_RENAME(le_create)
+#define le_getCharIndices U_ICU_ENTRY_POINT_RENAME(le_getCharIndices)
+#define le_getCharIndicesWithBase U_ICU_ENTRY_POINT_RENAME(le_getCharIndicesWithBase)
+#define le_getGlyphCount U_ICU_ENTRY_POINT_RENAME(le_getGlyphCount)
+#define le_getGlyphPosition U_ICU_ENTRY_POINT_RENAME(le_getGlyphPosition)
+#define le_getGlyphPositions U_ICU_ENTRY_POINT_RENAME(le_getGlyphPositions)
+#define le_getGlyphs U_ICU_ENTRY_POINT_RENAME(le_getGlyphs)
+#define le_layoutChars U_ICU_ENTRY_POINT_RENAME(le_layoutChars)
+#define le_reset U_ICU_ENTRY_POINT_RENAME(le_reset)
+#define locale_getKeywords U_ICU_ENTRY_POINT_RENAME(locale_getKeywords)
+#define locale_getKeywordsStart U_ICU_ENTRY_POINT_RENAME(locale_getKeywordsStart)
+#define locale_get_default U_ICU_ENTRY_POINT_RENAME(locale_get_default)
+#define locale_set_default U_ICU_ENTRY_POINT_RENAME(locale_set_default)
+#define pl_addFontRun U_ICU_ENTRY_POINT_RENAME(pl_addFontRun)
+#define pl_addLocaleRun U_ICU_ENTRY_POINT_RENAME(pl_addLocaleRun)
+#define pl_addValueRun U_ICU_ENTRY_POINT_RENAME(pl_addValueRun)
+#define pl_close U_ICU_ENTRY_POINT_RENAME(pl_close)
+#define pl_closeFontRuns U_ICU_ENTRY_POINT_RENAME(pl_closeFontRuns)
+#define pl_closeLine U_ICU_ENTRY_POINT_RENAME(pl_closeLine)
+#define pl_closeLocaleRuns U_ICU_ENTRY_POINT_RENAME(pl_closeLocaleRuns)
+#define pl_closeValueRuns U_ICU_ENTRY_POINT_RENAME(pl_closeValueRuns)
+#define pl_countLineRuns U_ICU_ENTRY_POINT_RENAME(pl_countLineRuns)
+#define pl_create U_ICU_ENTRY_POINT_RENAME(pl_create)
+#define pl_getAscent U_ICU_ENTRY_POINT_RENAME(pl_getAscent)
+#define pl_getDescent U_ICU_ENTRY_POINT_RENAME(pl_getDescent)
+#define pl_getFontRunCount U_ICU_ENTRY_POINT_RENAME(pl_getFontRunCount)
+#define pl_getFontRunFont U_ICU_ENTRY_POINT_RENAME(pl_getFontRunFont)
+#define pl_getFontRunLastLimit U_ICU_ENTRY_POINT_RENAME(pl_getFontRunLastLimit)
+#define pl_getFontRunLimit U_ICU_ENTRY_POINT_RENAME(pl_getFontRunLimit)
+#define pl_getLeading U_ICU_ENTRY_POINT_RENAME(pl_getLeading)
+#define pl_getLineAscent U_ICU_ENTRY_POINT_RENAME(pl_getLineAscent)
+#define pl_getLineDescent U_ICU_ENTRY_POINT_RENAME(pl_getLineDescent)
+#define pl_getLineLeading U_ICU_ENTRY_POINT_RENAME(pl_getLineLeading)
+#define pl_getLineVisualRun U_ICU_ENTRY_POINT_RENAME(pl_getLineVisualRun)
+#define pl_getLineWidth U_ICU_ENTRY_POINT_RENAME(pl_getLineWidth)
+#define pl_getLocaleRunCount U_ICU_ENTRY_POINT_RENAME(pl_getLocaleRunCount)
+#define pl_getLocaleRunLastLimit U_ICU_ENTRY_POINT_RENAME(pl_getLocaleRunLastLimit)
+#define pl_getLocaleRunLimit U_ICU_ENTRY_POINT_RENAME(pl_getLocaleRunLimit)
+#define pl_getLocaleRunLocale U_ICU_ENTRY_POINT_RENAME(pl_getLocaleRunLocale)
+#define pl_getParagraphLevel U_ICU_ENTRY_POINT_RENAME(pl_getParagraphLevel)
+#define pl_getTextDirection U_ICU_ENTRY_POINT_RENAME(pl_getTextDirection)
+#define pl_getValueRunCount U_ICU_ENTRY_POINT_RENAME(pl_getValueRunCount)
+#define pl_getValueRunLastLimit U_ICU_ENTRY_POINT_RENAME(pl_getValueRunLastLimit)
+#define pl_getValueRunLimit U_ICU_ENTRY_POINT_RENAME(pl_getValueRunLimit)
+#define pl_getValueRunValue U_ICU_ENTRY_POINT_RENAME(pl_getValueRunValue)
+#define pl_getVisualRunAscent U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunAscent)
+#define pl_getVisualRunDescent U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunDescent)
+#define pl_getVisualRunDirection U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunDirection)
+#define pl_getVisualRunFont U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunFont)
+#define pl_getVisualRunGlyphCount U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunGlyphCount)
+#define pl_getVisualRunGlyphToCharMap U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunGlyphToCharMap)
+#define pl_getVisualRunGlyphs U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunGlyphs)
+#define pl_getVisualRunLeading U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunLeading)
+#define pl_getVisualRunPositions U_ICU_ENTRY_POINT_RENAME(pl_getVisualRunPositions)
+#define pl_isComplex U_ICU_ENTRY_POINT_RENAME(pl_isComplex)
+#define pl_nextLine U_ICU_ENTRY_POINT_RENAME(pl_nextLine)
+#define pl_openEmptyFontRuns U_ICU_ENTRY_POINT_RENAME(pl_openEmptyFontRuns)
+#define pl_openEmptyLocaleRuns U_ICU_ENTRY_POINT_RENAME(pl_openEmptyLocaleRuns)
+#define pl_openEmptyValueRuns U_ICU_ENTRY_POINT_RENAME(pl_openEmptyValueRuns)
+#define pl_openFontRuns U_ICU_ENTRY_POINT_RENAME(pl_openFontRuns)
+#define pl_openLocaleRuns U_ICU_ENTRY_POINT_RENAME(pl_openLocaleRuns)
+#define pl_openValueRuns U_ICU_ENTRY_POINT_RENAME(pl_openValueRuns)
+#define pl_reflow U_ICU_ENTRY_POINT_RENAME(pl_reflow)
+#define pl_resetFontRuns U_ICU_ENTRY_POINT_RENAME(pl_resetFontRuns)
+#define pl_resetLocaleRuns U_ICU_ENTRY_POINT_RENAME(pl_resetLocaleRuns)
+#define pl_resetValueRuns U_ICU_ENTRY_POINT_RENAME(pl_resetValueRuns)
+#define res_countArrayItems U_ICU_ENTRY_POINT_RENAME(res_countArrayItems)
+#define res_findResource U_ICU_ENTRY_POINT_RENAME(res_findResource)
+#define res_getAlias U_ICU_ENTRY_POINT_RENAME(res_getAlias)
+#define res_getArrayItem U_ICU_ENTRY_POINT_RENAME(res_getArrayItem)
+#define res_getBinary U_ICU_ENTRY_POINT_RENAME(res_getBinary)
+#define res_getIntVector U_ICU_ENTRY_POINT_RENAME(res_getIntVector)
+#define res_getPublicType U_ICU_ENTRY_POINT_RENAME(res_getPublicType)
+#define res_getResource U_ICU_ENTRY_POINT_RENAME(res_getResource)
+#define res_getString U_ICU_ENTRY_POINT_RENAME(res_getString)
+#define res_getTableItemByIndex U_ICU_ENTRY_POINT_RENAME(res_getTableItemByIndex)
+#define res_getTableItemByKey U_ICU_ENTRY_POINT_RENAME(res_getTableItemByKey)
+#define res_load U_ICU_ENTRY_POINT_RENAME(res_load)
+#define res_read U_ICU_ENTRY_POINT_RENAME(res_read)
+#define res_unload U_ICU_ENTRY_POINT_RENAME(res_unload)
+#define u_UCharsToChars U_ICU_ENTRY_POINT_RENAME(u_UCharsToChars)
+#define u_austrcpy U_ICU_ENTRY_POINT_RENAME(u_austrcpy)
+#define u_austrncpy U_ICU_ENTRY_POINT_RENAME(u_austrncpy)
+#define u_catclose U_ICU_ENTRY_POINT_RENAME(u_catclose)
+#define u_catgets U_ICU_ENTRY_POINT_RENAME(u_catgets)
+#define u_catopen U_ICU_ENTRY_POINT_RENAME(u_catopen)
+#define u_charAge U_ICU_ENTRY_POINT_RENAME(u_charAge)
+#define u_charDigitValue U_ICU_ENTRY_POINT_RENAME(u_charDigitValue)
+#define u_charDirection U_ICU_ENTRY_POINT_RENAME(u_charDirection)
+#define u_charFromName U_ICU_ENTRY_POINT_RENAME(u_charFromName)
+#define u_charMirror U_ICU_ENTRY_POINT_RENAME(u_charMirror)
+#define u_charName U_ICU_ENTRY_POINT_RENAME(u_charName)
+#define u_charType U_ICU_ENTRY_POINT_RENAME(u_charType)
+#define u_charsToUChars U_ICU_ENTRY_POINT_RENAME(u_charsToUChars)
+#define u_cleanup U_ICU_ENTRY_POINT_RENAME(u_cleanup)
+#define u_countChar32 U_ICU_ENTRY_POINT_RENAME(u_countChar32)
+#define u_digit U_ICU_ENTRY_POINT_RENAME(u_digit)
+#define u_enumCharNames U_ICU_ENTRY_POINT_RENAME(u_enumCharNames)
+#define u_enumCharTypes U_ICU_ENTRY_POINT_RENAME(u_enumCharTypes)
+#define u_errorName U_ICU_ENTRY_POINT_RENAME(u_errorName)
+#define u_fadopt U_ICU_ENTRY_POINT_RENAME(u_fadopt)
+#define u_fclose U_ICU_ENTRY_POINT_RENAME(u_fclose)
+#define u_feof U_ICU_ENTRY_POINT_RENAME(u_feof)
+#define u_fflush U_ICU_ENTRY_POINT_RENAME(u_fflush)
+#define u_fgetConverter U_ICU_ENTRY_POINT_RENAME(u_fgetConverter)
+#define u_fgetNumberFormat U_ICU_ENTRY_POINT_RENAME(u_fgetNumberFormat)
+#define u_fgetc U_ICU_ENTRY_POINT_RENAME(u_fgetc)
+#define u_fgetcodepage U_ICU_ENTRY_POINT_RENAME(u_fgetcodepage)
+#define u_fgetcx U_ICU_ENTRY_POINT_RENAME(u_fgetcx)
+#define u_fgetfile U_ICU_ENTRY_POINT_RENAME(u_fgetfile)
+#define u_fgetlocale U_ICU_ENTRY_POINT_RENAME(u_fgetlocale)
+#define u_fgets U_ICU_ENTRY_POINT_RENAME(u_fgets)
+#define u_file_read U_ICU_ENTRY_POINT_RENAME(u_file_read)
+#define u_file_write U_ICU_ENTRY_POINT_RENAME(u_file_write)
+#define u_file_write_flush U_ICU_ENTRY_POINT_RENAME(u_file_write_flush)
+#define u_finit U_ICU_ENTRY_POINT_RENAME(u_finit)
+#define u_flushDefaultConverter U_ICU_ENTRY_POINT_RENAME(u_flushDefaultConverter)
+#define u_foldCase U_ICU_ENTRY_POINT_RENAME(u_foldCase)
+#define u_fopen U_ICU_ENTRY_POINT_RENAME(u_fopen)
+#define u_forDigit U_ICU_ENTRY_POINT_RENAME(u_forDigit)
+#define u_formatMessage U_ICU_ENTRY_POINT_RENAME(u_formatMessage)
+#define u_formatMessageWithError U_ICU_ENTRY_POINT_RENAME(u_formatMessageWithError)
+#define u_fprintf U_ICU_ENTRY_POINT_RENAME(u_fprintf)
+#define u_fprintf_u U_ICU_ENTRY_POINT_RENAME(u_fprintf_u)
+#define u_fputc U_ICU_ENTRY_POINT_RENAME(u_fputc)
+#define u_fputs U_ICU_ENTRY_POINT_RENAME(u_fputs)
+#define u_frewind U_ICU_ENTRY_POINT_RENAME(u_frewind)
+#define u_fscanf U_ICU_ENTRY_POINT_RENAME(u_fscanf)
+#define u_fscanf_u U_ICU_ENTRY_POINT_RENAME(u_fscanf_u)
+#define u_fsetcodepage U_ICU_ENTRY_POINT_RENAME(u_fsetcodepage)
+#define u_fsetlocale U_ICU_ENTRY_POINT_RENAME(u_fsetlocale)
+#define u_fsettransliterator U_ICU_ENTRY_POINT_RENAME(u_fsettransliterator)
+#define u_fstropen U_ICU_ENTRY_POINT_RENAME(u_fstropen)
+#define u_fungetc U_ICU_ENTRY_POINT_RENAME(u_fungetc)
+#define u_getBidiPairedBracket U_ICU_ENTRY_POINT_RENAME(u_getBidiPairedBracket)
+#define u_getCombiningClass U_ICU_ENTRY_POINT_RENAME(u_getCombiningClass)
+#define u_getDataDirectory U_ICU_ENTRY_POINT_RENAME(u_getDataDirectory)
+#define u_getDataVersion U_ICU_ENTRY_POINT_RENAME(u_getDataVersion)
+#define u_getDefaultConverter U_ICU_ENTRY_POINT_RENAME(u_getDefaultConverter)
+#define u_getFC_NFKC_Closure U_ICU_ENTRY_POINT_RENAME(u_getFC_NFKC_Closure)
+#define u_getISOComment U_ICU_ENTRY_POINT_RENAME(u_getISOComment)
+#define u_getIntPropertyMaxValue U_ICU_ENTRY_POINT_RENAME(u_getIntPropertyMaxValue)
+#define u_getIntPropertyMinValue U_ICU_ENTRY_POINT_RENAME(u_getIntPropertyMinValue)
+#define u_getIntPropertyValue U_ICU_ENTRY_POINT_RENAME(u_getIntPropertyValue)
+#define u_getMainProperties U_ICU_ENTRY_POINT_RENAME(u_getMainProperties)
+#define u_getNumericValue U_ICU_ENTRY_POINT_RENAME(u_getNumericValue)
+#define u_getPropertyEnum U_ICU_ENTRY_POINT_RENAME(u_getPropertyEnum)
+#define u_getPropertyName U_ICU_ENTRY_POINT_RENAME(u_getPropertyName)
+#define u_getPropertyValueEnum U_ICU_ENTRY_POINT_RENAME(u_getPropertyValueEnum)
+#define u_getPropertyValueName U_ICU_ENTRY_POINT_RENAME(u_getPropertyValueName)
+#define u_getUnicodeProperties U_ICU_ENTRY_POINT_RENAME(u_getUnicodeProperties)
+#define u_getUnicodeVersion U_ICU_ENTRY_POINT_RENAME(u_getUnicodeVersion)
+#define u_getVersion U_ICU_ENTRY_POINT_RENAME(u_getVersion)
+#define u_get_stdout U_ICU_ENTRY_POINT_RENAME(u_get_stdout)
+#define u_hasBinaryProperty U_ICU_ENTRY_POINT_RENAME(u_hasBinaryProperty)
+#define u_init U_ICU_ENTRY_POINT_RENAME(u_init)
+#define u_isIDIgnorable U_ICU_ENTRY_POINT_RENAME(u_isIDIgnorable)
+#define u_isIDPart U_ICU_ENTRY_POINT_RENAME(u_isIDPart)
+#define u_isIDStart U_ICU_ENTRY_POINT_RENAME(u_isIDStart)
+#define u_isISOControl U_ICU_ENTRY_POINT_RENAME(u_isISOControl)
+#define u_isJavaIDPart U_ICU_ENTRY_POINT_RENAME(u_isJavaIDPart)
+#define u_isJavaIDStart U_ICU_ENTRY_POINT_RENAME(u_isJavaIDStart)
+#define u_isJavaSpaceChar U_ICU_ENTRY_POINT_RENAME(u_isJavaSpaceChar)
+#define u_isMirrored U_ICU_ENTRY_POINT_RENAME(u_isMirrored)
+#define u_isUAlphabetic U_ICU_ENTRY_POINT_RENAME(u_isUAlphabetic)
+#define u_isULowercase U_ICU_ENTRY_POINT_RENAME(u_isULowercase)
+#define u_isUUppercase U_ICU_ENTRY_POINT_RENAME(u_isUUppercase)
+#define u_isUWhiteSpace U_ICU_ENTRY_POINT_RENAME(u_isUWhiteSpace)
+#define u_isWhitespace U_ICU_ENTRY_POINT_RENAME(u_isWhitespace)
+#define u_isalnum U_ICU_ENTRY_POINT_RENAME(u_isalnum)
+#define u_isalnumPOSIX U_ICU_ENTRY_POINT_RENAME(u_isalnumPOSIX)
+#define u_isalpha U_ICU_ENTRY_POINT_RENAME(u_isalpha)
+#define u_isbase U_ICU_ENTRY_POINT_RENAME(u_isbase)
+#define u_isblank U_ICU_ENTRY_POINT_RENAME(u_isblank)
+#define u_iscntrl U_ICU_ENTRY_POINT_RENAME(u_iscntrl)
+#define u_isdefined U_ICU_ENTRY_POINT_RENAME(u_isdefined)
+#define u_isdigit U_ICU_ENTRY_POINT_RENAME(u_isdigit)
+#define u_isgraph U_ICU_ENTRY_POINT_RENAME(u_isgraph)
+#define u_isgraphPOSIX U_ICU_ENTRY_POINT_RENAME(u_isgraphPOSIX)
+#define u_islower U_ICU_ENTRY_POINT_RENAME(u_islower)
+#define u_isprint U_ICU_ENTRY_POINT_RENAME(u_isprint)
+#define u_isprintPOSIX U_ICU_ENTRY_POINT_RENAME(u_isprintPOSIX)
+#define u_ispunct U_ICU_ENTRY_POINT_RENAME(u_ispunct)
+#define u_isspace U_ICU_ENTRY_POINT_RENAME(u_isspace)
+#define u_istitle U_ICU_ENTRY_POINT_RENAME(u_istitle)
+#define u_isupper U_ICU_ENTRY_POINT_RENAME(u_isupper)
+#define u_isxdigit U_ICU_ENTRY_POINT_RENAME(u_isxdigit)
+#define u_locbund_close U_ICU_ENTRY_POINT_RENAME(u_locbund_close)
+#define u_locbund_getNumberFormat U_ICU_ENTRY_POINT_RENAME(u_locbund_getNumberFormat)
+#define u_locbund_init U_ICU_ENTRY_POINT_RENAME(u_locbund_init)
+#define u_memcasecmp U_ICU_ENTRY_POINT_RENAME(u_memcasecmp)
+#define u_memchr U_ICU_ENTRY_POINT_RENAME(u_memchr)
+#define u_memchr32 U_ICU_ENTRY_POINT_RENAME(u_memchr32)
+#define u_memcmp U_ICU_ENTRY_POINT_RENAME(u_memcmp)
+#define u_memcmpCodePointOrder U_ICU_ENTRY_POINT_RENAME(u_memcmpCodePointOrder)
+#define u_memcpy U_ICU_ENTRY_POINT_RENAME(u_memcpy)
+#define u_memmove U_ICU_ENTRY_POINT_RENAME(u_memmove)
+#define u_memrchr U_ICU_ENTRY_POINT_RENAME(u_memrchr)
+#define u_memrchr32 U_ICU_ENTRY_POINT_RENAME(u_memrchr32)
+#define u_memset U_ICU_ENTRY_POINT_RENAME(u_memset)
+#define u_parseMessage U_ICU_ENTRY_POINT_RENAME(u_parseMessage)
+#define u_parseMessageWithError U_ICU_ENTRY_POINT_RENAME(u_parseMessageWithError)
+#define u_printf U_ICU_ENTRY_POINT_RENAME(u_printf)
+#define u_printf_parse U_ICU_ENTRY_POINT_RENAME(u_printf_parse)
+#define u_printf_u U_ICU_ENTRY_POINT_RENAME(u_printf_u)
+#define u_releaseDefaultConverter U_ICU_ENTRY_POINT_RENAME(u_releaseDefaultConverter)
+#define u_scanf_parse U_ICU_ENTRY_POINT_RENAME(u_scanf_parse)
+#define u_setAtomicIncDecFunctions U_ICU_ENTRY_POINT_RENAME(u_setAtomicIncDecFunctions)
+#define u_setDataDirectory U_ICU_ENTRY_POINT_RENAME(u_setDataDirectory)
+#define u_setMemoryFunctions U_ICU_ENTRY_POINT_RENAME(u_setMemoryFunctions)
+#define u_setMutexFunctions U_ICU_ENTRY_POINT_RENAME(u_setMutexFunctions)
+#define u_shapeArabic U_ICU_ENTRY_POINT_RENAME(u_shapeArabic)
+#define u_snprintf U_ICU_ENTRY_POINT_RENAME(u_snprintf)
+#define u_snprintf_u U_ICU_ENTRY_POINT_RENAME(u_snprintf_u)
+#define u_sprintf U_ICU_ENTRY_POINT_RENAME(u_sprintf)
+#define u_sprintf_u U_ICU_ENTRY_POINT_RENAME(u_sprintf_u)
+#define u_sscanf U_ICU_ENTRY_POINT_RENAME(u_sscanf)
+#define u_sscanf_u U_ICU_ENTRY_POINT_RENAME(u_sscanf_u)
+#define u_strCaseCompare U_ICU_ENTRY_POINT_RENAME(u_strCaseCompare)
+#define u_strCompare U_ICU_ENTRY_POINT_RENAME(u_strCompare)
+#define u_strCompareIter U_ICU_ENTRY_POINT_RENAME(u_strCompareIter)
+#define u_strFindFirst U_ICU_ENTRY_POINT_RENAME(u_strFindFirst)
+#define u_strFindLast U_ICU_ENTRY_POINT_RENAME(u_strFindLast)
+#define u_strFoldCase U_ICU_ENTRY_POINT_RENAME(u_strFoldCase)
+#define u_strFromJavaModifiedUTF8WithSub U_ICU_ENTRY_POINT_RENAME(u_strFromJavaModifiedUTF8WithSub)
+#define u_strFromPunycode U_ICU_ENTRY_POINT_RENAME(u_strFromPunycode)
+#define u_strFromUTF32 U_ICU_ENTRY_POINT_RENAME(u_strFromUTF32)
+#define u_strFromUTF32WithSub U_ICU_ENTRY_POINT_RENAME(u_strFromUTF32WithSub)
+#define u_strFromUTF8 U_ICU_ENTRY_POINT_RENAME(u_strFromUTF8)
+#define u_strFromUTF8Lenient U_ICU_ENTRY_POINT_RENAME(u_strFromUTF8Lenient)
+#define u_strFromUTF8WithSub U_ICU_ENTRY_POINT_RENAME(u_strFromUTF8WithSub)
+#define u_strFromWCS U_ICU_ENTRY_POINT_RENAME(u_strFromWCS)
+#define u_strHasMoreChar32Than U_ICU_ENTRY_POINT_RENAME(u_strHasMoreChar32Than)
+#define u_strToJavaModifiedUTF8 U_ICU_ENTRY_POINT_RENAME(u_strToJavaModifiedUTF8)
+#define u_strToLower U_ICU_ENTRY_POINT_RENAME(u_strToLower)
+#define u_strToPunycode U_ICU_ENTRY_POINT_RENAME(u_strToPunycode)
+#define u_strToTitle U_ICU_ENTRY_POINT_RENAME(u_strToTitle)
+#define u_strToUTF32 U_ICU_ENTRY_POINT_RENAME(u_strToUTF32)
+#define u_strToUTF32WithSub U_ICU_ENTRY_POINT_RENAME(u_strToUTF32WithSub)
+#define u_strToUTF8 U_ICU_ENTRY_POINT_RENAME(u_strToUTF8)
+#define u_strToUTF8WithSub U_ICU_ENTRY_POINT_RENAME(u_strToUTF8WithSub)
+#define u_strToUpper U_ICU_ENTRY_POINT_RENAME(u_strToUpper)
+#define u_strToWCS U_ICU_ENTRY_POINT_RENAME(u_strToWCS)
+#define u_strcasecmp U_ICU_ENTRY_POINT_RENAME(u_strcasecmp)
+#define u_strcat U_ICU_ENTRY_POINT_RENAME(u_strcat)
+#define u_strchr U_ICU_ENTRY_POINT_RENAME(u_strchr)
+#define u_strchr32 U_ICU_ENTRY_POINT_RENAME(u_strchr32)
+#define u_strcmp U_ICU_ENTRY_POINT_RENAME(u_strcmp)
+#define u_strcmpCodePointOrder U_ICU_ENTRY_POINT_RENAME(u_strcmpCodePointOrder)
+#define u_strcmpFold U_ICU_ENTRY_POINT_RENAME(u_strcmpFold)
+#define u_strcpy U_ICU_ENTRY_POINT_RENAME(u_strcpy)
+#define u_strcspn U_ICU_ENTRY_POINT_RENAME(u_strcspn)
+#define u_strlen U_ICU_ENTRY_POINT_RENAME(u_strlen)
+#define u_strncasecmp U_ICU_ENTRY_POINT_RENAME(u_strncasecmp)
+#define u_strncat U_ICU_ENTRY_POINT_RENAME(u_strncat)
+#define u_strncmp U_ICU_ENTRY_POINT_RENAME(u_strncmp)
+#define u_strncmpCodePointOrder U_ICU_ENTRY_POINT_RENAME(u_strncmpCodePointOrder)
+#define u_strncpy U_ICU_ENTRY_POINT_RENAME(u_strncpy)
+#define u_strpbrk U_ICU_ENTRY_POINT_RENAME(u_strpbrk)
+#define u_strrchr U_ICU_ENTRY_POINT_RENAME(u_strrchr)
+#define u_strrchr32 U_ICU_ENTRY_POINT_RENAME(u_strrchr32)
+#define u_strrstr U_ICU_ENTRY_POINT_RENAME(u_strrstr)
+#define u_strspn U_ICU_ENTRY_POINT_RENAME(u_strspn)
+#define u_strstr U_ICU_ENTRY_POINT_RENAME(u_strstr)
+#define u_strtok_r U_ICU_ENTRY_POINT_RENAME(u_strtok_r)
+#define u_terminateChars U_ICU_ENTRY_POINT_RENAME(u_terminateChars)
+#define u_terminateUChar32s U_ICU_ENTRY_POINT_RENAME(u_terminateUChar32s)
+#define u_terminateUChars U_ICU_ENTRY_POINT_RENAME(u_terminateUChars)
+#define u_terminateWChars U_ICU_ENTRY_POINT_RENAME(u_terminateWChars)
+#define u_tolower U_ICU_ENTRY_POINT_RENAME(u_tolower)
+#define u_totitle U_ICU_ENTRY_POINT_RENAME(u_totitle)
+#define u_toupper U_ICU_ENTRY_POINT_RENAME(u_toupper)
+#define u_uastrcpy U_ICU_ENTRY_POINT_RENAME(u_uastrcpy)
+#define u_uastrncpy U_ICU_ENTRY_POINT_RENAME(u_uastrncpy)
+#define u_unescape U_ICU_ENTRY_POINT_RENAME(u_unescape)
+#define u_unescapeAt U_ICU_ENTRY_POINT_RENAME(u_unescapeAt)
+#define u_versionFromString U_ICU_ENTRY_POINT_RENAME(u_versionFromString)
+#define u_versionFromUString U_ICU_ENTRY_POINT_RENAME(u_versionFromUString)
+#define u_versionToString U_ICU_ENTRY_POINT_RENAME(u_versionToString)
+#define u_vformatMessage U_ICU_ENTRY_POINT_RENAME(u_vformatMessage)
+#define u_vformatMessageWithError U_ICU_ENTRY_POINT_RENAME(u_vformatMessageWithError)
+#define u_vfprintf U_ICU_ENTRY_POINT_RENAME(u_vfprintf)
+#define u_vfprintf_u U_ICU_ENTRY_POINT_RENAME(u_vfprintf_u)
+#define u_vfscanf U_ICU_ENTRY_POINT_RENAME(u_vfscanf)
+#define u_vfscanf_u U_ICU_ENTRY_POINT_RENAME(u_vfscanf_u)
+#define u_vparseMessage U_ICU_ENTRY_POINT_RENAME(u_vparseMessage)
+#define u_vparseMessageWithError U_ICU_ENTRY_POINT_RENAME(u_vparseMessageWithError)
+#define u_vsnprintf U_ICU_ENTRY_POINT_RENAME(u_vsnprintf)
+#define u_vsnprintf_u U_ICU_ENTRY_POINT_RENAME(u_vsnprintf_u)
+#define u_vsprintf U_ICU_ENTRY_POINT_RENAME(u_vsprintf)
+#define u_vsprintf_u U_ICU_ENTRY_POINT_RENAME(u_vsprintf_u)
+#define u_vsscanf U_ICU_ENTRY_POINT_RENAME(u_vsscanf)
+#define u_vsscanf_u U_ICU_ENTRY_POINT_RENAME(u_vsscanf_u)
+#define u_writeDiff U_ICU_ENTRY_POINT_RENAME(u_writeDiff)
+#define u_writeIdenticalLevelRun U_ICU_ENTRY_POINT_RENAME(u_writeIdenticalLevelRun)
+#define u_writeIdenticalLevelRunTwoChars U_ICU_ENTRY_POINT_RENAME(u_writeIdenticalLevelRunTwoChars)
+#define ubidi_addPropertyStarts U_ICU_ENTRY_POINT_RENAME(ubidi_addPropertyStarts)
+#define ubidi_close U_ICU_ENTRY_POINT_RENAME(ubidi_close)
+#define ubidi_countParagraphs U_ICU_ENTRY_POINT_RENAME(ubidi_countParagraphs)
+#define ubidi_countRuns U_ICU_ENTRY_POINT_RENAME(ubidi_countRuns)
+#define ubidi_getBaseDirection U_ICU_ENTRY_POINT_RENAME(ubidi_getBaseDirection)
+#define ubidi_getClass U_ICU_ENTRY_POINT_RENAME(ubidi_getClass)
+#define ubidi_getClassCallback U_ICU_ENTRY_POINT_RENAME(ubidi_getClassCallback)
+#define ubidi_getCustomizedClass U_ICU_ENTRY_POINT_RENAME(ubidi_getCustomizedClass)
+#define ubidi_getDirection U_ICU_ENTRY_POINT_RENAME(ubidi_getDirection)
+#define ubidi_getJoiningGroup U_ICU_ENTRY_POINT_RENAME(ubidi_getJoiningGroup)
+#define ubidi_getJoiningType U_ICU_ENTRY_POINT_RENAME(ubidi_getJoiningType)
+#define ubidi_getLength U_ICU_ENTRY_POINT_RENAME(ubidi_getLength)
+#define ubidi_getLevelAt U_ICU_ENTRY_POINT_RENAME(ubidi_getLevelAt)
+#define ubidi_getLevels U_ICU_ENTRY_POINT_RENAME(ubidi_getLevels)
+#define ubidi_getLogicalIndex U_ICU_ENTRY_POINT_RENAME(ubidi_getLogicalIndex)
+#define ubidi_getLogicalMap U_ICU_ENTRY_POINT_RENAME(ubidi_getLogicalMap)
+#define ubidi_getLogicalRun U_ICU_ENTRY_POINT_RENAME(ubidi_getLogicalRun)
+#define ubidi_getMaxValue U_ICU_ENTRY_POINT_RENAME(ubidi_getMaxValue)
+#define ubidi_getMemory U_ICU_ENTRY_POINT_RENAME(ubidi_getMemory)
+#define ubidi_getMirror U_ICU_ENTRY_POINT_RENAME(ubidi_getMirror)
+#define ubidi_getPairedBracket U_ICU_ENTRY_POINT_RENAME(ubidi_getPairedBracket)
+#define ubidi_getPairedBracketType U_ICU_ENTRY_POINT_RENAME(ubidi_getPairedBracketType)
+#define ubidi_getParaLevel U_ICU_ENTRY_POINT_RENAME(ubidi_getParaLevel)
+#define ubidi_getParaLevelAtIndex U_ICU_ENTRY_POINT_RENAME(ubidi_getParaLevelAtIndex)
+#define ubidi_getParagraph U_ICU_ENTRY_POINT_RENAME(ubidi_getParagraph)
+#define ubidi_getParagraphByIndex U_ICU_ENTRY_POINT_RENAME(ubidi_getParagraphByIndex)
+#define ubidi_getProcessedLength U_ICU_ENTRY_POINT_RENAME(ubidi_getProcessedLength)
+#define ubidi_getReorderingMode U_ICU_ENTRY_POINT_RENAME(ubidi_getReorderingMode)
+#define ubidi_getReorderingOptions U_ICU_ENTRY_POINT_RENAME(ubidi_getReorderingOptions)
+#define ubidi_getResultLength U_ICU_ENTRY_POINT_RENAME(ubidi_getResultLength)
+#define ubidi_getRuns U_ICU_ENTRY_POINT_RENAME(ubidi_getRuns)
+#define ubidi_getSingleton U_ICU_ENTRY_POINT_RENAME(ubidi_getSingleton)
+#define ubidi_getText U_ICU_ENTRY_POINT_RENAME(ubidi_getText)
+#define ubidi_getVisualIndex U_ICU_ENTRY_POINT_RENAME(ubidi_getVisualIndex)
+#define ubidi_getVisualMap U_ICU_ENTRY_POINT_RENAME(ubidi_getVisualMap)
+#define ubidi_getVisualRun U_ICU_ENTRY_POINT_RENAME(ubidi_getVisualRun)
+#define ubidi_invertMap U_ICU_ENTRY_POINT_RENAME(ubidi_invertMap)
+#define ubidi_isBidiControl U_ICU_ENTRY_POINT_RENAME(ubidi_isBidiControl)
+#define ubidi_isInverse U_ICU_ENTRY_POINT_RENAME(ubidi_isInverse)
+#define ubidi_isJoinControl U_ICU_ENTRY_POINT_RENAME(ubidi_isJoinControl)
+#define ubidi_isMirrored U_ICU_ENTRY_POINT_RENAME(ubidi_isMirrored)
+#define ubidi_isOrderParagraphsLTR U_ICU_ENTRY_POINT_RENAME(ubidi_isOrderParagraphsLTR)
+#define ubidi_open U_ICU_ENTRY_POINT_RENAME(ubidi_open)
+#define ubidi_openSized U_ICU_ENTRY_POINT_RENAME(ubidi_openSized)
+#define ubidi_orderParagraphsLTR U_ICU_ENTRY_POINT_RENAME(ubidi_orderParagraphsLTR)
+#define ubidi_reorderLogical U_ICU_ENTRY_POINT_RENAME(ubidi_reorderLogical)
+#define ubidi_reorderVisual U_ICU_ENTRY_POINT_RENAME(ubidi_reorderVisual)
+#define ubidi_setClassCallback U_ICU_ENTRY_POINT_RENAME(ubidi_setClassCallback)
+#define ubidi_setContext U_ICU_ENTRY_POINT_RENAME(ubidi_setContext)
+#define ubidi_setInverse U_ICU_ENTRY_POINT_RENAME(ubidi_setInverse)
+#define ubidi_setLine U_ICU_ENTRY_POINT_RENAME(ubidi_setLine)
+#define ubidi_setPara U_ICU_ENTRY_POINT_RENAME(ubidi_setPara)
+#define ubidi_setReorderingMode U_ICU_ENTRY_POINT_RENAME(ubidi_setReorderingMode)
+#define ubidi_setReorderingOptions U_ICU_ENTRY_POINT_RENAME(ubidi_setReorderingOptions)
+#define ubidi_writeReordered U_ICU_ENTRY_POINT_RENAME(ubidi_writeReordered)
+#define ubidi_writeReverse U_ICU_ENTRY_POINT_RENAME(ubidi_writeReverse)
+#define ublock_getCode U_ICU_ENTRY_POINT_RENAME(ublock_getCode)
+#define ubrk_close U_ICU_ENTRY_POINT_RENAME(ubrk_close)
+#define ubrk_countAvailable U_ICU_ENTRY_POINT_RENAME(ubrk_countAvailable)
+#define ubrk_current U_ICU_ENTRY_POINT_RENAME(ubrk_current)
+#define ubrk_first U_ICU_ENTRY_POINT_RENAME(ubrk_first)
+#define ubrk_following U_ICU_ENTRY_POINT_RENAME(ubrk_following)
+#define ubrk_getAvailable U_ICU_ENTRY_POINT_RENAME(ubrk_getAvailable)
+#define ubrk_getLocaleByType U_ICU_ENTRY_POINT_RENAME(ubrk_getLocaleByType)
+#define ubrk_getRuleStatus U_ICU_ENTRY_POINT_RENAME(ubrk_getRuleStatus)
+#define ubrk_getRuleStatusVec U_ICU_ENTRY_POINT_RENAME(ubrk_getRuleStatusVec)
+#define ubrk_isBoundary U_ICU_ENTRY_POINT_RENAME(ubrk_isBoundary)
+#define ubrk_last U_ICU_ENTRY_POINT_RENAME(ubrk_last)
+#define ubrk_next U_ICU_ENTRY_POINT_RENAME(ubrk_next)
+#define ubrk_open U_ICU_ENTRY_POINT_RENAME(ubrk_open)
+#define ubrk_openRules U_ICU_ENTRY_POINT_RENAME(ubrk_openRules)
+#define ubrk_preceding U_ICU_ENTRY_POINT_RENAME(ubrk_preceding)
+#define ubrk_previous U_ICU_ENTRY_POINT_RENAME(ubrk_previous)
+#define ubrk_refreshUText U_ICU_ENTRY_POINT_RENAME(ubrk_refreshUText)
+#define ubrk_safeClone U_ICU_ENTRY_POINT_RENAME(ubrk_safeClone)
+#define ubrk_setText U_ICU_ENTRY_POINT_RENAME(ubrk_setText)
+#define ubrk_setUText U_ICU_ENTRY_POINT_RENAME(ubrk_setUText)
+#define ubrk_swap U_ICU_ENTRY_POINT_RENAME(ubrk_swap)
+#define ucal_add U_ICU_ENTRY_POINT_RENAME(ucal_add)
+#define ucal_clear U_ICU_ENTRY_POINT_RENAME(ucal_clear)
+#define ucal_clearField U_ICU_ENTRY_POINT_RENAME(ucal_clearField)
+#define ucal_clone U_ICU_ENTRY_POINT_RENAME(ucal_clone)
+#define ucal_close U_ICU_ENTRY_POINT_RENAME(ucal_close)
+#define ucal_countAvailable U_ICU_ENTRY_POINT_RENAME(ucal_countAvailable)
+#define ucal_equivalentTo U_ICU_ENTRY_POINT_RENAME(ucal_equivalentTo)
+#define ucal_get U_ICU_ENTRY_POINT_RENAME(ucal_get)
+#define ucal_getAttribute U_ICU_ENTRY_POINT_RENAME(ucal_getAttribute)
+#define ucal_getAvailable U_ICU_ENTRY_POINT_RENAME(ucal_getAvailable)
+#define ucal_getCanonicalTimeZoneID U_ICU_ENTRY_POINT_RENAME(ucal_getCanonicalTimeZoneID)
+#define ucal_getDSTSavings U_ICU_ENTRY_POINT_RENAME(ucal_getDSTSavings)
+#define ucal_getDayOfWeekType U_ICU_ENTRY_POINT_RENAME(ucal_getDayOfWeekType)
+#define ucal_getDefaultTimeZone U_ICU_ENTRY_POINT_RENAME(ucal_getDefaultTimeZone)
+#define ucal_getFieldDifference U_ICU_ENTRY_POINT_RENAME(ucal_getFieldDifference)
+#define ucal_getGregorianChange U_ICU_ENTRY_POINT_RENAME(ucal_getGregorianChange)
+#define ucal_getKeywordValuesForLocale U_ICU_ENTRY_POINT_RENAME(ucal_getKeywordValuesForLocale)
+#define ucal_getLimit U_ICU_ENTRY_POINT_RENAME(ucal_getLimit)
+#define ucal_getLocaleByType U_ICU_ENTRY_POINT_RENAME(ucal_getLocaleByType)
+#define ucal_getMillis U_ICU_ENTRY_POINT_RENAME(ucal_getMillis)
+#define ucal_getNow U_ICU_ENTRY_POINT_RENAME(ucal_getNow)
+#define ucal_getTZDataVersion U_ICU_ENTRY_POINT_RENAME(ucal_getTZDataVersion)
+#define ucal_getTimeZoneDisplayName U_ICU_ENTRY_POINT_RENAME(ucal_getTimeZoneDisplayName)
+#define ucal_getTimeZoneID U_ICU_ENTRY_POINT_RENAME(ucal_getTimeZoneID)
+#define ucal_getTimeZoneIDForWindowsID U_ICU_ENTRY_POINT_RENAME(ucal_getTimeZoneIDForWindowsID)
+#define ucal_getTimeZoneTransitionDate U_ICU_ENTRY_POINT_RENAME(ucal_getTimeZoneTransitionDate)
+#define ucal_getType U_ICU_ENTRY_POINT_RENAME(ucal_getType)
+#define ucal_getWeekendTransition U_ICU_ENTRY_POINT_RENAME(ucal_getWeekendTransition)
+#define ucal_getWindowsTimeZoneID U_ICU_ENTRY_POINT_RENAME(ucal_getWindowsTimeZoneID)
+#define ucal_inDaylightTime U_ICU_ENTRY_POINT_RENAME(ucal_inDaylightTime)
+#define ucal_isSet U_ICU_ENTRY_POINT_RENAME(ucal_isSet)
+#define ucal_isWeekend U_ICU_ENTRY_POINT_RENAME(ucal_isWeekend)
+#define ucal_open U_ICU_ENTRY_POINT_RENAME(ucal_open)
+#define ucal_openCountryTimeZones U_ICU_ENTRY_POINT_RENAME(ucal_openCountryTimeZones)
+#define ucal_openTimeZoneIDEnumeration U_ICU_ENTRY_POINT_RENAME(ucal_openTimeZoneIDEnumeration)
+#define ucal_openTimeZones U_ICU_ENTRY_POINT_RENAME(ucal_openTimeZones)
+#define ucal_roll U_ICU_ENTRY_POINT_RENAME(ucal_roll)
+#define ucal_set U_ICU_ENTRY_POINT_RENAME(ucal_set)
+#define ucal_setAttribute U_ICU_ENTRY_POINT_RENAME(ucal_setAttribute)
+#define ucal_setDate U_ICU_ENTRY_POINT_RENAME(ucal_setDate)
+#define ucal_setDateTime U_ICU_ENTRY_POINT_RENAME(ucal_setDateTime)
+#define ucal_setDefaultTimeZone U_ICU_ENTRY_POINT_RENAME(ucal_setDefaultTimeZone)
+#define ucal_setGregorianChange U_ICU_ENTRY_POINT_RENAME(ucal_setGregorianChange)
+#define ucal_setMillis U_ICU_ENTRY_POINT_RENAME(ucal_setMillis)
+#define ucal_setTimeZone U_ICU_ENTRY_POINT_RENAME(ucal_setTimeZone)
+#define ucase_addCaseClosure U_ICU_ENTRY_POINT_RENAME(ucase_addCaseClosure)
+#define ucase_addPropertyStarts U_ICU_ENTRY_POINT_RENAME(ucase_addPropertyStarts)
+#define ucase_addStringCaseClosure U_ICU_ENTRY_POINT_RENAME(ucase_addStringCaseClosure)
+#define ucase_fold U_ICU_ENTRY_POINT_RENAME(ucase_fold)
+#define ucase_getCaseLocale U_ICU_ENTRY_POINT_RENAME(ucase_getCaseLocale)
+#define ucase_getSingleton U_ICU_ENTRY_POINT_RENAME(ucase_getSingleton)
+#define ucase_getType U_ICU_ENTRY_POINT_RENAME(ucase_getType)
+#define ucase_getTypeOrIgnorable U_ICU_ENTRY_POINT_RENAME(ucase_getTypeOrIgnorable)
+#define ucase_hasBinaryProperty U_ICU_ENTRY_POINT_RENAME(ucase_hasBinaryProperty)
+#define ucase_isCaseSensitive U_ICU_ENTRY_POINT_RENAME(ucase_isCaseSensitive)
+#define ucase_isSoftDotted U_ICU_ENTRY_POINT_RENAME(ucase_isSoftDotted)
+#define ucase_toFullFolding U_ICU_ENTRY_POINT_RENAME(ucase_toFullFolding)
+#define ucase_toFullLower U_ICU_ENTRY_POINT_RENAME(ucase_toFullLower)
+#define ucase_toFullTitle U_ICU_ENTRY_POINT_RENAME(ucase_toFullTitle)
+#define ucase_toFullUpper U_ICU_ENTRY_POINT_RENAME(ucase_toFullUpper)
+#define ucase_tolower U_ICU_ENTRY_POINT_RENAME(ucase_tolower)
+#define ucase_totitle U_ICU_ENTRY_POINT_RENAME(ucase_totitle)
+#define ucase_toupper U_ICU_ENTRY_POINT_RENAME(ucase_toupper)
+#define ucasemap_close U_ICU_ENTRY_POINT_RENAME(ucasemap_close)
+#define ucasemap_getBreakIterator U_ICU_ENTRY_POINT_RENAME(ucasemap_getBreakIterator)
+#define ucasemap_getLocale U_ICU_ENTRY_POINT_RENAME(ucasemap_getLocale)
+#define ucasemap_getOptions U_ICU_ENTRY_POINT_RENAME(ucasemap_getOptions)
+#define ucasemap_internalUTF8ToTitle U_ICU_ENTRY_POINT_RENAME(ucasemap_internalUTF8ToTitle)
+#define ucasemap_mapUTF8 U_ICU_ENTRY_POINT_RENAME(ucasemap_mapUTF8)
+#define ucasemap_open U_ICU_ENTRY_POINT_RENAME(ucasemap_open)
+#define ucasemap_setBreakIterator U_ICU_ENTRY_POINT_RENAME(ucasemap_setBreakIterator)
+#define ucasemap_setLocale U_ICU_ENTRY_POINT_RENAME(ucasemap_setLocale)
+#define ucasemap_setOptions U_ICU_ENTRY_POINT_RENAME(ucasemap_setOptions)
+#define ucasemap_toTitle U_ICU_ENTRY_POINT_RENAME(ucasemap_toTitle)
+#define ucasemap_utf8FoldCase U_ICU_ENTRY_POINT_RENAME(ucasemap_utf8FoldCase)
+#define ucasemap_utf8ToLower U_ICU_ENTRY_POINT_RENAME(ucasemap_utf8ToLower)
+#define ucasemap_utf8ToTitle U_ICU_ENTRY_POINT_RENAME(ucasemap_utf8ToTitle)
+#define ucasemap_utf8ToUpper U_ICU_ENTRY_POINT_RENAME(ucasemap_utf8ToUpper)
+#define uchar_addPropertyStarts U_ICU_ENTRY_POINT_RENAME(uchar_addPropertyStarts)
+#define uchar_swapNames U_ICU_ENTRY_POINT_RENAME(uchar_swapNames)
+#define ucln_cleanupOne U_ICU_ENTRY_POINT_RENAME(ucln_cleanupOne)
+#define ucln_common_registerCleanup U_ICU_ENTRY_POINT_RENAME(ucln_common_registerCleanup)
+#define ucln_i18n_registerCleanup U_ICU_ENTRY_POINT_RENAME(ucln_i18n_registerCleanup)
+#define ucln_io_registerCleanup U_ICU_ENTRY_POINT_RENAME(ucln_io_registerCleanup)
+#define ucln_lib_cleanup U_ICU_ENTRY_POINT_RENAME(ucln_lib_cleanup)
+#define ucln_registerCleanup U_ICU_ENTRY_POINT_RENAME(ucln_registerCleanup)
+#define ucnv_MBCSFromUChar32 U_ICU_ENTRY_POINT_RENAME(ucnv_MBCSFromUChar32)
+#define ucnv_MBCSFromUnicodeWithOffsets U_ICU_ENTRY_POINT_RENAME(ucnv_MBCSFromUnicodeWithOffsets)
+#define ucnv_MBCSGetFilteredUnicodeSetForUnicode U_ICU_ENTRY_POINT_RENAME(ucnv_MBCSGetFilteredUnicodeSetForUnicode)
+#define ucnv_MBCSGetType U_ICU_ENTRY_POINT_RENAME(ucnv_MBCSGetType)
+#define ucnv_MBCSGetUnicodeSetForUnicode U_ICU_ENTRY_POINT_RENAME(ucnv_MBCSGetUnicodeSetForUnicode)
+#define ucnv_MBCSIsLeadByte U_ICU_ENTRY_POINT_RENAME(ucnv_MBCSIsLeadByte)
+#define ucnv_MBCSSimpleGetNextUChar U_ICU_ENTRY_POINT_RENAME(ucnv_MBCSSimpleGetNextUChar)
+#define ucnv_MBCSToUnicodeWithOffsets U_ICU_ENTRY_POINT_RENAME(ucnv_MBCSToUnicodeWithOffsets)
+#define ucnv_bld_countAvailableConverters U_ICU_ENTRY_POINT_RENAME(ucnv_bld_countAvailableConverters)
+#define ucnv_bld_getAvailableConverter U_ICU_ENTRY_POINT_RENAME(ucnv_bld_getAvailableConverter)
+#define ucnv_canCreateConverter U_ICU_ENTRY_POINT_RENAME(ucnv_canCreateConverter)
+#define ucnv_cbFromUWriteBytes U_ICU_ENTRY_POINT_RENAME(ucnv_cbFromUWriteBytes)
+#define ucnv_cbFromUWriteSub U_ICU_ENTRY_POINT_RENAME(ucnv_cbFromUWriteSub)
+#define ucnv_cbFromUWriteUChars U_ICU_ENTRY_POINT_RENAME(ucnv_cbFromUWriteUChars)
+#define ucnv_cbToUWriteSub U_ICU_ENTRY_POINT_RENAME(ucnv_cbToUWriteSub)
+#define ucnv_cbToUWriteUChars U_ICU_ENTRY_POINT_RENAME(ucnv_cbToUWriteUChars)
+#define ucnv_close U_ICU_ENTRY_POINT_RENAME(ucnv_close)
+#define ucnv_compareNames U_ICU_ENTRY_POINT_RENAME(ucnv_compareNames)
+#define ucnv_convert U_ICU_ENTRY_POINT_RENAME(ucnv_convert)
+#define ucnv_convertEx U_ICU_ENTRY_POINT_RENAME(ucnv_convertEx)
+#define ucnv_countAliases U_ICU_ENTRY_POINT_RENAME(ucnv_countAliases)
+#define ucnv_countAvailable U_ICU_ENTRY_POINT_RENAME(ucnv_countAvailable)
+#define ucnv_countStandards U_ICU_ENTRY_POINT_RENAME(ucnv_countStandards)
+#define ucnv_createAlgorithmicConverter U_ICU_ENTRY_POINT_RENAME(ucnv_createAlgorithmicConverter)
+#define ucnv_createConverter U_ICU_ENTRY_POINT_RENAME(ucnv_createConverter)
+#define ucnv_createConverterFromPackage U_ICU_ENTRY_POINT_RENAME(ucnv_createConverterFromPackage)
+#define ucnv_createConverterFromSharedData U_ICU_ENTRY_POINT_RENAME(ucnv_createConverterFromSharedData)
+#define ucnv_detectUnicodeSignature U_ICU_ENTRY_POINT_RENAME(ucnv_detectUnicodeSignature)
+#define ucnv_extContinueMatchFromU U_ICU_ENTRY_POINT_RENAME(ucnv_extContinueMatchFromU)
+#define ucnv_extContinueMatchToU U_ICU_ENTRY_POINT_RENAME(ucnv_extContinueMatchToU)
+#define ucnv_extGetUnicodeSet U_ICU_ENTRY_POINT_RENAME(ucnv_extGetUnicodeSet)
+#define ucnv_extInitialMatchFromU U_ICU_ENTRY_POINT_RENAME(ucnv_extInitialMatchFromU)
+#define ucnv_extInitialMatchToU U_ICU_ENTRY_POINT_RENAME(ucnv_extInitialMatchToU)
+#define ucnv_extSimpleMatchFromU U_ICU_ENTRY_POINT_RENAME(ucnv_extSimpleMatchFromU)
+#define ucnv_extSimpleMatchToU U_ICU_ENTRY_POINT_RENAME(ucnv_extSimpleMatchToU)
+#define ucnv_fixFileSeparator U_ICU_ENTRY_POINT_RENAME(ucnv_fixFileSeparator)
+#define ucnv_flushCache U_ICU_ENTRY_POINT_RENAME(ucnv_flushCache)
+#define ucnv_fromAlgorithmic U_ICU_ENTRY_POINT_RENAME(ucnv_fromAlgorithmic)
+#define ucnv_fromUChars U_ICU_ENTRY_POINT_RENAME(ucnv_fromUChars)
+#define ucnv_fromUCountPending U_ICU_ENTRY_POINT_RENAME(ucnv_fromUCountPending)
+#define ucnv_fromUWriteBytes U_ICU_ENTRY_POINT_RENAME(ucnv_fromUWriteBytes)
+#define ucnv_fromUnicode U_ICU_ENTRY_POINT_RENAME(ucnv_fromUnicode)
+#define ucnv_fromUnicode_UTF8 U_ICU_ENTRY_POINT_RENAME(ucnv_fromUnicode_UTF8)
+#define ucnv_fromUnicode_UTF8_OFFSETS_LOGIC U_ICU_ENTRY_POINT_RENAME(ucnv_fromUnicode_UTF8_OFFSETS_LOGIC)
+#define ucnv_getAlias U_ICU_ENTRY_POINT_RENAME(ucnv_getAlias)
+#define ucnv_getAliases U_ICU_ENTRY_POINT_RENAME(ucnv_getAliases)
+#define ucnv_getAvailableName U_ICU_ENTRY_POINT_RENAME(ucnv_getAvailableName)
+#define ucnv_getCCSID U_ICU_ENTRY_POINT_RENAME(ucnv_getCCSID)
+#define ucnv_getCanonicalName U_ICU_ENTRY_POINT_RENAME(ucnv_getCanonicalName)
+#define ucnv_getCompleteUnicodeSet U_ICU_ENTRY_POINT_RENAME(ucnv_getCompleteUnicodeSet)
+#define ucnv_getDefaultName U_ICU_ENTRY_POINT_RENAME(ucnv_getDefaultName)
+#define ucnv_getDisplayName U_ICU_ENTRY_POINT_RENAME(ucnv_getDisplayName)
+#define ucnv_getFromUCallBack U_ICU_ENTRY_POINT_RENAME(ucnv_getFromUCallBack)
+#define ucnv_getInvalidChars U_ICU_ENTRY_POINT_RENAME(ucnv_getInvalidChars)
+#define ucnv_getInvalidUChars U_ICU_ENTRY_POINT_RENAME(ucnv_getInvalidUChars)
+#define ucnv_getMaxCharSize U_ICU_ENTRY_POINT_RENAME(ucnv_getMaxCharSize)
+#define ucnv_getMinCharSize U_ICU_ENTRY_POINT_RENAME(ucnv_getMinCharSize)
+#define ucnv_getName U_ICU_ENTRY_POINT_RENAME(ucnv_getName)
+#define ucnv_getNextUChar U_ICU_ENTRY_POINT_RENAME(ucnv_getNextUChar)
+#define ucnv_getNonSurrogateUnicodeSet U_ICU_ENTRY_POINT_RENAME(ucnv_getNonSurrogateUnicodeSet)
+#define ucnv_getPlatform U_ICU_ENTRY_POINT_RENAME(ucnv_getPlatform)
+#define ucnv_getStandard U_ICU_ENTRY_POINT_RENAME(ucnv_getStandard)
+#define ucnv_getStandardName U_ICU_ENTRY_POINT_RENAME(ucnv_getStandardName)
+#define ucnv_getStarters U_ICU_ENTRY_POINT_RENAME(ucnv_getStarters)
+#define ucnv_getSubstChars U_ICU_ENTRY_POINT_RENAME(ucnv_getSubstChars)
+#define ucnv_getToUCallBack U_ICU_ENTRY_POINT_RENAME(ucnv_getToUCallBack)
+#define ucnv_getType U_ICU_ENTRY_POINT_RENAME(ucnv_getType)
+#define ucnv_getUnicodeSet U_ICU_ENTRY_POINT_RENAME(ucnv_getUnicodeSet)
+#define ucnv_incrementRefCount U_ICU_ENTRY_POINT_RENAME(ucnv_incrementRefCount)
+#define ucnv_io_countKnownConverters U_ICU_ENTRY_POINT_RENAME(ucnv_io_countKnownConverters)
+#define ucnv_io_getConverterName U_ICU_ENTRY_POINT_RENAME(ucnv_io_getConverterName)
+#define ucnv_io_stripASCIIForCompare U_ICU_ENTRY_POINT_RENAME(ucnv_io_stripASCIIForCompare)
+#define ucnv_io_stripEBCDICForCompare U_ICU_ENTRY_POINT_RENAME(ucnv_io_stripEBCDICForCompare)
+#define ucnv_isAmbiguous U_ICU_ENTRY_POINT_RENAME(ucnv_isAmbiguous)
+#define ucnv_isFixedWidth U_ICU_ENTRY_POINT_RENAME(ucnv_isFixedWidth)
+#define ucnv_load U_ICU_ENTRY_POINT_RENAME(ucnv_load)
+#define ucnv_loadSharedData U_ICU_ENTRY_POINT_RENAME(ucnv_loadSharedData)
+#define ucnv_open U_ICU_ENTRY_POINT_RENAME(ucnv_open)
+#define ucnv_openAllNames U_ICU_ENTRY_POINT_RENAME(ucnv_openAllNames)
+#define ucnv_openCCSID U_ICU_ENTRY_POINT_RENAME(ucnv_openCCSID)
+#define ucnv_openPackage U_ICU_ENTRY_POINT_RENAME(ucnv_openPackage)
+#define ucnv_openStandardNames U_ICU_ENTRY_POINT_RENAME(ucnv_openStandardNames)
+#define ucnv_openU U_ICU_ENTRY_POINT_RENAME(ucnv_openU)
+#define ucnv_reset U_ICU_ENTRY_POINT_RENAME(ucnv_reset)
+#define ucnv_resetFromUnicode U_ICU_ENTRY_POINT_RENAME(ucnv_resetFromUnicode)
+#define ucnv_resetToUnicode U_ICU_ENTRY_POINT_RENAME(ucnv_resetToUnicode)
+#define ucnv_safeClone U_ICU_ENTRY_POINT_RENAME(ucnv_safeClone)
+#define ucnv_setDefaultName U_ICU_ENTRY_POINT_RENAME(ucnv_setDefaultName)
+#define ucnv_setFallback U_ICU_ENTRY_POINT_RENAME(ucnv_setFallback)
+#define ucnv_setFromUCallBack U_ICU_ENTRY_POINT_RENAME(ucnv_setFromUCallBack)
+#define ucnv_setSubstChars U_ICU_ENTRY_POINT_RENAME(ucnv_setSubstChars)
+#define ucnv_setSubstString U_ICU_ENTRY_POINT_RENAME(ucnv_setSubstString)
+#define ucnv_setToUCallBack U_ICU_ENTRY_POINT_RENAME(ucnv_setToUCallBack)
+#define ucnv_swap U_ICU_ENTRY_POINT_RENAME(ucnv_swap)
+#define ucnv_swapAliases U_ICU_ENTRY_POINT_RENAME(ucnv_swapAliases)
+#define ucnv_toAlgorithmic U_ICU_ENTRY_POINT_RENAME(ucnv_toAlgorithmic)
+#define ucnv_toUChars U_ICU_ENTRY_POINT_RENAME(ucnv_toUChars)
+#define ucnv_toUCountPending U_ICU_ENTRY_POINT_RENAME(ucnv_toUCountPending)
+#define ucnv_toUWriteCodePoint U_ICU_ENTRY_POINT_RENAME(ucnv_toUWriteCodePoint)
+#define ucnv_toUWriteUChars U_ICU_ENTRY_POINT_RENAME(ucnv_toUWriteUChars)
+#define ucnv_toUnicode U_ICU_ENTRY_POINT_RENAME(ucnv_toUnicode)
+#define ucnv_unload U_ICU_ENTRY_POINT_RENAME(ucnv_unload)
+#define ucnv_unloadSharedDataIfReady U_ICU_ENTRY_POINT_RENAME(ucnv_unloadSharedDataIfReady)
+#define ucnv_usesFallback U_ICU_ENTRY_POINT_RENAME(ucnv_usesFallback)
+#define ucnvsel_close U_ICU_ENTRY_POINT_RENAME(ucnvsel_close)
+#define ucnvsel_open U_ICU_ENTRY_POINT_RENAME(ucnvsel_open)
+#define ucnvsel_openFromSerialized U_ICU_ENTRY_POINT_RENAME(ucnvsel_openFromSerialized)
+#define ucnvsel_selectForString U_ICU_ENTRY_POINT_RENAME(ucnvsel_selectForString)
+#define ucnvsel_selectForUTF8 U_ICU_ENTRY_POINT_RENAME(ucnvsel_selectForUTF8)
+#define ucnvsel_serialize U_ICU_ENTRY_POINT_RENAME(ucnvsel_serialize)
+#define ucol_allocWeights U_ICU_ENTRY_POINT_RENAME(ucol_allocWeights)
+#define ucol_assembleTailoringTable U_ICU_ENTRY_POINT_RENAME(ucol_assembleTailoringTable)
+#define ucol_buildPermutationTable U_ICU_ENTRY_POINT_RENAME(ucol_buildPermutationTable)
+#define ucol_calcSortKey U_ICU_ENTRY_POINT_RENAME(ucol_calcSortKey)
+#define ucol_calcSortKeySimpleTertiary U_ICU_ENTRY_POINT_RENAME(ucol_calcSortKeySimpleTertiary)
+#define ucol_cloneBinary U_ICU_ENTRY_POINT_RENAME(ucol_cloneBinary)
+#define ucol_close U_ICU_ENTRY_POINT_RENAME(ucol_close)
+#define ucol_closeElements U_ICU_ENTRY_POINT_RENAME(ucol_closeElements)
+#define ucol_countAvailable U_ICU_ENTRY_POINT_RENAME(ucol_countAvailable)
+#define ucol_createElements U_ICU_ENTRY_POINT_RENAME(ucol_createElements)
+#define ucol_doCE U_ICU_ENTRY_POINT_RENAME(ucol_doCE)
+#define ucol_equal U_ICU_ENTRY_POINT_RENAME(ucol_equal)
+#define ucol_equals U_ICU_ENTRY_POINT_RENAME(ucol_equals)
+#define ucol_findReorderingEntry U_ICU_ENTRY_POINT_RENAME(ucol_findReorderingEntry)
+#define ucol_forceHanImplicit U_ICU_ENTRY_POINT_RENAME(ucol_forceHanImplicit)
+#define ucol_forgetUCA U_ICU_ENTRY_POINT_RENAME(ucol_forgetUCA)
+#define ucol_freeOffsetBuffer U_ICU_ENTRY_POINT_RENAME(ucol_freeOffsetBuffer)
+#define ucol_getAttribute U_ICU_ENTRY_POINT_RENAME(ucol_getAttribute)
+#define ucol_getAttributeOrDefault U_ICU_ENTRY_POINT_RENAME(ucol_getAttributeOrDefault)
+#define ucol_getAvailable U_ICU_ENTRY_POINT_RENAME(ucol_getAvailable)
+#define ucol_getBound U_ICU_ENTRY_POINT_RENAME(ucol_getBound)
+#define ucol_getCEStrengthDifference U_ICU_ENTRY_POINT_RENAME(ucol_getCEStrengthDifference)
+#define ucol_getCollationKey U_ICU_ENTRY_POINT_RENAME(ucol_getCollationKey)
+#define ucol_getContractions U_ICU_ENTRY_POINT_RENAME(ucol_getContractions)
+#define ucol_getContractionsAndExpansions U_ICU_ENTRY_POINT_RENAME(ucol_getContractionsAndExpansions)
+#define ucol_getDisplayName U_ICU_ENTRY_POINT_RENAME(ucol_getDisplayName)
+#define ucol_getEquivalentReorderCodes U_ICU_ENTRY_POINT_RENAME(ucol_getEquivalentReorderCodes)
+#define ucol_getFirstCE U_ICU_ENTRY_POINT_RENAME(ucol_getFirstCE)
+#define ucol_getFunctionalEquivalent U_ICU_ENTRY_POINT_RENAME(ucol_getFunctionalEquivalent)
+#define ucol_getKeywordValues U_ICU_ENTRY_POINT_RENAME(ucol_getKeywordValues)
+#define ucol_getKeywordValuesForLocale U_ICU_ENTRY_POINT_RENAME(ucol_getKeywordValuesForLocale)
+#define ucol_getKeywords U_ICU_ENTRY_POINT_RENAME(ucol_getKeywords)
+#define ucol_getLeadBytesForReorderCode U_ICU_ENTRY_POINT_RENAME(ucol_getLeadBytesForReorderCode)
+#define ucol_getLocale U_ICU_ENTRY_POINT_RENAME(ucol_getLocale)
+#define ucol_getLocaleByType U_ICU_ENTRY_POINT_RENAME(ucol_getLocaleByType)
+#define ucol_getMaxExpansion U_ICU_ENTRY_POINT_RENAME(ucol_getMaxExpansion)
+#define ucol_getNextCE U_ICU_ENTRY_POINT_RENAME(ucol_getNextCE)
+#define ucol_getOffset U_ICU_ENTRY_POINT_RENAME(ucol_getOffset)
+#define ucol_getPrevCE U_ICU_ENTRY_POINT_RENAME(ucol_getPrevCE)
+#define ucol_getReorderCodes U_ICU_ENTRY_POINT_RENAME(ucol_getReorderCodes)
+#define ucol_getReorderCodesForLeadByte U_ICU_ENTRY_POINT_RENAME(ucol_getReorderCodesForLeadByte)
+#define ucol_getRules U_ICU_ENTRY_POINT_RENAME(ucol_getRules)
+#define ucol_getRulesEx U_ICU_ENTRY_POINT_RENAME(ucol_getRulesEx)
+#define ucol_getShortDefinitionString U_ICU_ENTRY_POINT_RENAME(ucol_getShortDefinitionString)
+#define ucol_getSortKey U_ICU_ENTRY_POINT_RENAME(ucol_getSortKey)
+#define ucol_getStrength U_ICU_ENTRY_POINT_RENAME(ucol_getStrength)
+#define ucol_getTailoredSet U_ICU_ENTRY_POINT_RENAME(ucol_getTailoredSet)
+#define ucol_getUCAVersion U_ICU_ENTRY_POINT_RENAME(ucol_getUCAVersion)
+#define ucol_getUnsafeSet U_ICU_ENTRY_POINT_RENAME(ucol_getUnsafeSet)
+#define ucol_getVariableTop U_ICU_ENTRY_POINT_RENAME(ucol_getVariableTop)
+#define ucol_getVersion U_ICU_ENTRY_POINT_RENAME(ucol_getVersion)
+#define ucol_greater U_ICU_ENTRY_POINT_RENAME(ucol_greater)
+#define ucol_greaterOrEqual U_ICU_ENTRY_POINT_RENAME(ucol_greaterOrEqual)
+#define ucol_initBuffers U_ICU_ENTRY_POINT_RENAME(ucol_initBuffers)
+#define ucol_initCollator U_ICU_ENTRY_POINT_RENAME(ucol_initCollator)
+#define ucol_initInverseUCA U_ICU_ENTRY_POINT_RENAME(ucol_initInverseUCA)
+#define ucol_initUCA U_ICU_ENTRY_POINT_RENAME(ucol_initUCA)
+#define ucol_inv_getNextCE U_ICU_ENTRY_POINT_RENAME(ucol_inv_getNextCE)
+#define ucol_inv_getPrevCE U_ICU_ENTRY_POINT_RENAME(ucol_inv_getPrevCE)
+#define ucol_isTailored U_ICU_ENTRY_POINT_RENAME(ucol_isTailored)
+#define ucol_keyHashCode U_ICU_ENTRY_POINT_RENAME(ucol_keyHashCode)
+#define ucol_looksLikeCollationBinary U_ICU_ENTRY_POINT_RENAME(ucol_looksLikeCollationBinary)
+#define ucol_mergeSortkeys U_ICU_ENTRY_POINT_RENAME(ucol_mergeSortkeys)
+#define ucol_next U_ICU_ENTRY_POINT_RENAME(ucol_next)
+#define ucol_nextProcessed U_ICU_ENTRY_POINT_RENAME(ucol_nextProcessed)
+#define ucol_nextSortKeyPart U_ICU_ENTRY_POINT_RENAME(ucol_nextSortKeyPart)
+#define ucol_nextWeight U_ICU_ENTRY_POINT_RENAME(ucol_nextWeight)
+#define ucol_normalizeShortDefinitionString U_ICU_ENTRY_POINT_RENAME(ucol_normalizeShortDefinitionString)
+#define ucol_open U_ICU_ENTRY_POINT_RENAME(ucol_open)
+#define ucol_openAvailableLocales U_ICU_ENTRY_POINT_RENAME(ucol_openAvailableLocales)
+#define ucol_openBinary U_ICU_ENTRY_POINT_RENAME(ucol_openBinary)
+#define ucol_openElements U_ICU_ENTRY_POINT_RENAME(ucol_openElements)
+#define ucol_openFromShortString U_ICU_ENTRY_POINT_RENAME(ucol_openFromShortString)
+#define ucol_openRules U_ICU_ENTRY_POINT_RENAME(ucol_openRules)
+#define ucol_openRulesForImport U_ICU_ENTRY_POINT_RENAME(ucol_openRulesForImport)
+#define ucol_open_internal U_ICU_ENTRY_POINT_RENAME(ucol_open_internal)
+#define ucol_prepareShortStringOpen U_ICU_ENTRY_POINT_RENAME(ucol_prepareShortStringOpen)
+#define ucol_previous U_ICU_ENTRY_POINT_RENAME(ucol_previous)
+#define ucol_previousProcessed U_ICU_ENTRY_POINT_RENAME(ucol_previousProcessed)
+#define ucol_primaryOrder U_ICU_ENTRY_POINT_RENAME(ucol_primaryOrder)
+#define ucol_prv_getSpecialCE U_ICU_ENTRY_POINT_RENAME(ucol_prv_getSpecialCE)
+#define ucol_prv_getSpecialPrevCE U_ICU_ENTRY_POINT_RENAME(ucol_prv_getSpecialPrevCE)
+#define ucol_reset U_ICU_ENTRY_POINT_RENAME(ucol_reset)
+#define ucol_restoreVariableTop U_ICU_ENTRY_POINT_RENAME(ucol_restoreVariableTop)
+#define ucol_safeClone U_ICU_ENTRY_POINT_RENAME(ucol_safeClone)
+#define ucol_secondaryOrder U_ICU_ENTRY_POINT_RENAME(ucol_secondaryOrder)
+#define ucol_setAttribute U_ICU_ENTRY_POINT_RENAME(ucol_setAttribute)
+#define ucol_setOffset U_ICU_ENTRY_POINT_RENAME(ucol_setOffset)
+#define ucol_setOptionsFromHeader U_ICU_ENTRY_POINT_RENAME(ucol_setOptionsFromHeader)
+#define ucol_setReorderCodes U_ICU_ENTRY_POINT_RENAME(ucol_setReorderCodes)
+#define ucol_setReqValidLocales U_ICU_ENTRY_POINT_RENAME(ucol_setReqValidLocales)
+#define ucol_setStrength U_ICU_ENTRY_POINT_RENAME(ucol_setStrength)
+#define ucol_setText U_ICU_ENTRY_POINT_RENAME(ucol_setText)
+#define ucol_setVariableTop U_ICU_ENTRY_POINT_RENAME(ucol_setVariableTop)
+#define ucol_strcoll U_ICU_ENTRY_POINT_RENAME(ucol_strcoll)
+#define ucol_strcollIter U_ICU_ENTRY_POINT_RENAME(ucol_strcollIter)
+#define ucol_strcollUTF8 U_ICU_ENTRY_POINT_RENAME(ucol_strcollUTF8)
+#define ucol_swap U_ICU_ENTRY_POINT_RENAME(ucol_swap)
+#define ucol_swapBinary U_ICU_ENTRY_POINT_RENAME(ucol_swapBinary)
+#define ucol_swapInverseUCA U_ICU_ENTRY_POINT_RENAME(ucol_swapInverseUCA)
+#define ucol_tertiaryOrder U_ICU_ENTRY_POINT_RENAME(ucol_tertiaryOrder)
+#define ucol_tok_assembleTokenList U_ICU_ENTRY_POINT_RENAME(ucol_tok_assembleTokenList)
+#define ucol_tok_closeTokenList U_ICU_ENTRY_POINT_RENAME(ucol_tok_closeTokenList)
+#define ucol_tok_getNextArgument U_ICU_ENTRY_POINT_RENAME(ucol_tok_getNextArgument)
+#define ucol_tok_getRulesFromBundle U_ICU_ENTRY_POINT_RENAME(ucol_tok_getRulesFromBundle)
+#define ucol_tok_initTokenList U_ICU_ENTRY_POINT_RENAME(ucol_tok_initTokenList)
+#define ucol_tok_parseNextToken U_ICU_ENTRY_POINT_RENAME(ucol_tok_parseNextToken)
+#define ucol_updateInternalState U_ICU_ENTRY_POINT_RENAME(ucol_updateInternalState)
+#define ucsdet_close U_ICU_ENTRY_POINT_RENAME(ucsdet_close)
+#define ucsdet_detect U_ICU_ENTRY_POINT_RENAME(ucsdet_detect)
+#define ucsdet_detectAll U_ICU_ENTRY_POINT_RENAME(ucsdet_detectAll)
+#define ucsdet_enableInputFilter U_ICU_ENTRY_POINT_RENAME(ucsdet_enableInputFilter)
+#define ucsdet_getAllDetectableCharsets U_ICU_ENTRY_POINT_RENAME(ucsdet_getAllDetectableCharsets)
+#define ucsdet_getConfidence U_ICU_ENTRY_POINT_RENAME(ucsdet_getConfidence)
+#define ucsdet_getDetectableCharsets U_ICU_ENTRY_POINT_RENAME(ucsdet_getDetectableCharsets)
+#define ucsdet_getLanguage U_ICU_ENTRY_POINT_RENAME(ucsdet_getLanguage)
+#define ucsdet_getName U_ICU_ENTRY_POINT_RENAME(ucsdet_getName)
+#define ucsdet_getUChars U_ICU_ENTRY_POINT_RENAME(ucsdet_getUChars)
+#define ucsdet_isInputFilterEnabled U_ICU_ENTRY_POINT_RENAME(ucsdet_isInputFilterEnabled)
+#define ucsdet_open U_ICU_ENTRY_POINT_RENAME(ucsdet_open)
+#define ucsdet_setDeclaredEncoding U_ICU_ENTRY_POINT_RENAME(ucsdet_setDeclaredEncoding)
+#define ucsdet_setDetectableCharset U_ICU_ENTRY_POINT_RENAME(ucsdet_setDetectableCharset)
+#define ucsdet_setText U_ICU_ENTRY_POINT_RENAME(ucsdet_setText)
+#define ucurr_countCurrencies U_ICU_ENTRY_POINT_RENAME(ucurr_countCurrencies)
+#define ucurr_forLocale U_ICU_ENTRY_POINT_RENAME(ucurr_forLocale)
+#define ucurr_forLocaleAndDate U_ICU_ENTRY_POINT_RENAME(ucurr_forLocaleAndDate)
+#define ucurr_getDefaultFractionDigits U_ICU_ENTRY_POINT_RENAME(ucurr_getDefaultFractionDigits)
+#define ucurr_getKeywordValuesForLocale U_ICU_ENTRY_POINT_RENAME(ucurr_getKeywordValuesForLocale)
+#define ucurr_getName U_ICU_ENTRY_POINT_RENAME(ucurr_getName)
+#define ucurr_getNumericCode U_ICU_ENTRY_POINT_RENAME(ucurr_getNumericCode)
+#define ucurr_getPluralName U_ICU_ENTRY_POINT_RENAME(ucurr_getPluralName)
+#define ucurr_getRoundingIncrement U_ICU_ENTRY_POINT_RENAME(ucurr_getRoundingIncrement)
+#define ucurr_isAvailable U_ICU_ENTRY_POINT_RENAME(ucurr_isAvailable)
+#define ucurr_openISOCurrencies U_ICU_ENTRY_POINT_RENAME(ucurr_openISOCurrencies)
+#define ucurr_register U_ICU_ENTRY_POINT_RENAME(ucurr_register)
+#define ucurr_unregister U_ICU_ENTRY_POINT_RENAME(ucurr_unregister)
+#define udat_applyPattern U_ICU_ENTRY_POINT_RENAME(udat_applyPattern)
+#define udat_applyPatternRelative U_ICU_ENTRY_POINT_RENAME(udat_applyPatternRelative)
+#define udat_clone U_ICU_ENTRY_POINT_RENAME(udat_clone)
+#define udat_close U_ICU_ENTRY_POINT_RENAME(udat_close)
+#define udat_countAvailable U_ICU_ENTRY_POINT_RENAME(udat_countAvailable)
+#define udat_countSymbols U_ICU_ENTRY_POINT_RENAME(udat_countSymbols)
+#define udat_format U_ICU_ENTRY_POINT_RENAME(udat_format)
+#define udat_get2DigitYearStart U_ICU_ENTRY_POINT_RENAME(udat_get2DigitYearStart)
+#define udat_getAvailable U_ICU_ENTRY_POINT_RENAME(udat_getAvailable)
+#define udat_getCalendar U_ICU_ENTRY_POINT_RENAME(udat_getCalendar)
+#define udat_getContext U_ICU_ENTRY_POINT_RENAME(udat_getContext)
+#define udat_getLocaleByType U_ICU_ENTRY_POINT_RENAME(udat_getLocaleByType)
+#define udat_getNumberFormat U_ICU_ENTRY_POINT_RENAME(udat_getNumberFormat)
+#define udat_getSymbols U_ICU_ENTRY_POINT_RENAME(udat_getSymbols)
+#define udat_isLenient U_ICU_ENTRY_POINT_RENAME(udat_isLenient)
+#define udat_open U_ICU_ENTRY_POINT_RENAME(udat_open)
+#define udat_parse U_ICU_ENTRY_POINT_RENAME(udat_parse)
+#define udat_parseCalendar U_ICU_ENTRY_POINT_RENAME(udat_parseCalendar)
+#define udat_registerOpener U_ICU_ENTRY_POINT_RENAME(udat_registerOpener)
+#define udat_set2DigitYearStart U_ICU_ENTRY_POINT_RENAME(udat_set2DigitYearStart)
+#define udat_setCalendar U_ICU_ENTRY_POINT_RENAME(udat_setCalendar)
+#define udat_setContext U_ICU_ENTRY_POINT_RENAME(udat_setContext)
+#define udat_setLenient U_ICU_ENTRY_POINT_RENAME(udat_setLenient)
+#define udat_setNumberFormat U_ICU_ENTRY_POINT_RENAME(udat_setNumberFormat)
+#define udat_setSymbols U_ICU_ENTRY_POINT_RENAME(udat_setSymbols)
+#define udat_toCalendarDateField U_ICU_ENTRY_POINT_RENAME(udat_toCalendarDateField)
+#define udat_toPattern U_ICU_ENTRY_POINT_RENAME(udat_toPattern)
+#define udat_toPatternRelativeDate U_ICU_ENTRY_POINT_RENAME(udat_toPatternRelativeDate)
+#define udat_toPatternRelativeTime U_ICU_ENTRY_POINT_RENAME(udat_toPatternRelativeTime)
+#define udat_unregisterOpener U_ICU_ENTRY_POINT_RENAME(udat_unregisterOpener)
+#define udata_checkCommonData U_ICU_ENTRY_POINT_RENAME(udata_checkCommonData)
+#define udata_close U_ICU_ENTRY_POINT_RENAME(udata_close)
+#define udata_closeSwapper U_ICU_ENTRY_POINT_RENAME(udata_closeSwapper)
+#define udata_getHeaderSize U_ICU_ENTRY_POINT_RENAME(udata_getHeaderSize)
+#define udata_getInfo U_ICU_ENTRY_POINT_RENAME(udata_getInfo)
+#define udata_getInfoSize U_ICU_ENTRY_POINT_RENAME(udata_getInfoSize)
+#define udata_getLength U_ICU_ENTRY_POINT_RENAME(udata_getLength)
+#define udata_getMemory U_ICU_ENTRY_POINT_RENAME(udata_getMemory)
+#define udata_getRawMemory U_ICU_ENTRY_POINT_RENAME(udata_getRawMemory)
+#define udata_open U_ICU_ENTRY_POINT_RENAME(udata_open)
+#define udata_openChoice U_ICU_ENTRY_POINT_RENAME(udata_openChoice)
+#define udata_openSwapper U_ICU_ENTRY_POINT_RENAME(udata_openSwapper)
+#define udata_openSwapperForInputData U_ICU_ENTRY_POINT_RENAME(udata_openSwapperForInputData)
+#define udata_printError U_ICU_ENTRY_POINT_RENAME(udata_printError)
+#define udata_readInt16 U_ICU_ENTRY_POINT_RENAME(udata_readInt16)
+#define udata_readInt32 U_ICU_ENTRY_POINT_RENAME(udata_readInt32)
+#define udata_setAppData U_ICU_ENTRY_POINT_RENAME(udata_setAppData)
+#define udata_setCommonData U_ICU_ENTRY_POINT_RENAME(udata_setCommonData)
+#define udata_setFileAccess U_ICU_ENTRY_POINT_RENAME(udata_setFileAccess)
+#define udata_swapDataHeader U_ICU_ENTRY_POINT_RENAME(udata_swapDataHeader)
+#define udata_swapInvStringBlock U_ICU_ENTRY_POINT_RENAME(udata_swapInvStringBlock)
+#define udatpg_addPattern U_ICU_ENTRY_POINT_RENAME(udatpg_addPattern)
+#define udatpg_clone U_ICU_ENTRY_POINT_RENAME(udatpg_clone)
+#define udatpg_close U_ICU_ENTRY_POINT_RENAME(udatpg_close)
+#define udatpg_getAppendItemFormat U_ICU_ENTRY_POINT_RENAME(udatpg_getAppendItemFormat)
+#define udatpg_getAppendItemName U_ICU_ENTRY_POINT_RENAME(udatpg_getAppendItemName)
+#define udatpg_getBaseSkeleton U_ICU_ENTRY_POINT_RENAME(udatpg_getBaseSkeleton)
+#define udatpg_getBestPattern U_ICU_ENTRY_POINT_RENAME(udatpg_getBestPattern)
+#define udatpg_getBestPatternWithOptions U_ICU_ENTRY_POINT_RENAME(udatpg_getBestPatternWithOptions)
+#define udatpg_getDateTimeFormat U_ICU_ENTRY_POINT_RENAME(udatpg_getDateTimeFormat)
+#define udatpg_getDecimal U_ICU_ENTRY_POINT_RENAME(udatpg_getDecimal)
+#define udatpg_getPatternForSkeleton U_ICU_ENTRY_POINT_RENAME(udatpg_getPatternForSkeleton)
+#define udatpg_getSkeleton U_ICU_ENTRY_POINT_RENAME(udatpg_getSkeleton)
+#define udatpg_open U_ICU_ENTRY_POINT_RENAME(udatpg_open)
+#define udatpg_openBaseSkeletons U_ICU_ENTRY_POINT_RENAME(udatpg_openBaseSkeletons)
+#define udatpg_openEmpty U_ICU_ENTRY_POINT_RENAME(udatpg_openEmpty)
+#define udatpg_openSkeletons U_ICU_ENTRY_POINT_RENAME(udatpg_openSkeletons)
+#define udatpg_replaceFieldTypes U_ICU_ENTRY_POINT_RENAME(udatpg_replaceFieldTypes)
+#define udatpg_replaceFieldTypesWithOptions U_ICU_ENTRY_POINT_RENAME(udatpg_replaceFieldTypesWithOptions)
+#define udatpg_setAppendItemFormat U_ICU_ENTRY_POINT_RENAME(udatpg_setAppendItemFormat)
+#define udatpg_setAppendItemName U_ICU_ENTRY_POINT_RENAME(udatpg_setAppendItemName)
+#define udatpg_setDateTimeFormat U_ICU_ENTRY_POINT_RENAME(udatpg_setDateTimeFormat)
+#define udatpg_setDecimal U_ICU_ENTRY_POINT_RENAME(udatpg_setDecimal)
+#define udict_swap U_ICU_ENTRY_POINT_RENAME(udict_swap)
+#define udtitvfmt_close U_ICU_ENTRY_POINT_RENAME(udtitvfmt_close)
+#define udtitvfmt_format U_ICU_ENTRY_POINT_RENAME(udtitvfmt_format)
+#define udtitvfmt_open U_ICU_ENTRY_POINT_RENAME(udtitvfmt_open)
+#define uenum_close U_ICU_ENTRY_POINT_RENAME(uenum_close)
+#define uenum_count U_ICU_ENTRY_POINT_RENAME(uenum_count)
+#define uenum_next U_ICU_ENTRY_POINT_RENAME(uenum_next)
+#define uenum_nextDefault U_ICU_ENTRY_POINT_RENAME(uenum_nextDefault)
+#define uenum_openCharStringsEnumeration U_ICU_ENTRY_POINT_RENAME(uenum_openCharStringsEnumeration)
+#define uenum_openFromStringEnumeration U_ICU_ENTRY_POINT_RENAME(uenum_openFromStringEnumeration)
+#define uenum_openUCharStringsEnumeration U_ICU_ENTRY_POINT_RENAME(uenum_openUCharStringsEnumeration)
+#define uenum_reset U_ICU_ENTRY_POINT_RENAME(uenum_reset)
+#define uenum_unext U_ICU_ENTRY_POINT_RENAME(uenum_unext)
+#define uenum_unextDefault U_ICU_ENTRY_POINT_RENAME(uenum_unextDefault)
+#define ufile_close_translit U_ICU_ENTRY_POINT_RENAME(ufile_close_translit)
+#define ufile_fill_uchar_buffer U_ICU_ENTRY_POINT_RENAME(ufile_fill_uchar_buffer)
+#define ufile_flush_io U_ICU_ENTRY_POINT_RENAME(ufile_flush_io)
+#define ufile_flush_translit U_ICU_ENTRY_POINT_RENAME(ufile_flush_translit)
+#define ufile_getch U_ICU_ENTRY_POINT_RENAME(ufile_getch)
+#define ufile_getch32 U_ICU_ENTRY_POINT_RENAME(ufile_getch32)
+#define ufmt_64tou U_ICU_ENTRY_POINT_RENAME(ufmt_64tou)
+#define ufmt_close U_ICU_ENTRY_POINT_RENAME(ufmt_close)
+#define ufmt_defaultCPToUnicode U_ICU_ENTRY_POINT_RENAME(ufmt_defaultCPToUnicode)
+#define ufmt_digitvalue U_ICU_ENTRY_POINT_RENAME(ufmt_digitvalue)
+#define ufmt_getArrayItemByIndex U_ICU_ENTRY_POINT_RENAME(ufmt_getArrayItemByIndex)
+#define ufmt_getArrayLength U_ICU_ENTRY_POINT_RENAME(ufmt_getArrayLength)
+#define ufmt_getDate U_ICU_ENTRY_POINT_RENAME(ufmt_getDate)
+#define ufmt_getDecNumChars U_ICU_ENTRY_POINT_RENAME(ufmt_getDecNumChars)
+#define ufmt_getDouble U_ICU_ENTRY_POINT_RENAME(ufmt_getDouble)
+#define ufmt_getInt64 U_ICU_ENTRY_POINT_RENAME(ufmt_getInt64)
+#define ufmt_getLong U_ICU_ENTRY_POINT_RENAME(ufmt_getLong)
+#define ufmt_getObject U_ICU_ENTRY_POINT_RENAME(ufmt_getObject)
+#define ufmt_getType U_ICU_ENTRY_POINT_RENAME(ufmt_getType)
+#define ufmt_getUChars U_ICU_ENTRY_POINT_RENAME(ufmt_getUChars)
+#define ufmt_isNumeric U_ICU_ENTRY_POINT_RENAME(ufmt_isNumeric)
+#define ufmt_isdigit U_ICU_ENTRY_POINT_RENAME(ufmt_isdigit)
+#define ufmt_open U_ICU_ENTRY_POINT_RENAME(ufmt_open)
+#define ufmt_ptou U_ICU_ENTRY_POINT_RENAME(ufmt_ptou)
+#define ufmt_uto64 U_ICU_ENTRY_POINT_RENAME(ufmt_uto64)
+#define ufmt_utop U_ICU_ENTRY_POINT_RENAME(ufmt_utop)
+#define ugender_getInstance U_ICU_ENTRY_POINT_RENAME(ugender_getInstance)
+#define ugender_getListGender U_ICU_ENTRY_POINT_RENAME(ugender_getListGender)
+#define uhash_close U_ICU_ENTRY_POINT_RENAME(uhash_close)
+#define uhash_compareCaselessUnicodeString U_ICU_ENTRY_POINT_RENAME(uhash_compareCaselessUnicodeString)
+#define uhash_compareChars U_ICU_ENTRY_POINT_RENAME(uhash_compareChars)
+#define uhash_compareIChars U_ICU_ENTRY_POINT_RENAME(uhash_compareIChars)
+#define uhash_compareLong U_ICU_ENTRY_POINT_RENAME(uhash_compareLong)
+#define uhash_compareScriptSet U_ICU_ENTRY_POINT_RENAME(uhash_compareScriptSet)
+#define uhash_compareUChars U_ICU_ENTRY_POINT_RENAME(uhash_compareUChars)
+#define uhash_compareUnicodeString U_ICU_ENTRY_POINT_RENAME(uhash_compareUnicodeString)
+#define uhash_count U_ICU_ENTRY_POINT_RENAME(uhash_count)
+#define uhash_deleteHashtable U_ICU_ENTRY_POINT_RENAME(uhash_deleteHashtable)
+#define uhash_deleteScriptSet U_ICU_ENTRY_POINT_RENAME(uhash_deleteScriptSet)
+#define uhash_equals U_ICU_ENTRY_POINT_RENAME(uhash_equals)
+#define uhash_equalsScriptSet U_ICU_ENTRY_POINT_RENAME(uhash_equalsScriptSet)
+#define uhash_find U_ICU_ENTRY_POINT_RENAME(uhash_find)
+#define uhash_get U_ICU_ENTRY_POINT_RENAME(uhash_get)
+#define uhash_geti U_ICU_ENTRY_POINT_RENAME(uhash_geti)
+#define uhash_hashCaselessUnicodeString U_ICU_ENTRY_POINT_RENAME(uhash_hashCaselessUnicodeString)
+#define uhash_hashChars U_ICU_ENTRY_POINT_RENAME(uhash_hashChars)
+#define uhash_hashIChars U_ICU_ENTRY_POINT_RENAME(uhash_hashIChars)
+#define uhash_hashLong U_ICU_ENTRY_POINT_RENAME(uhash_hashLong)
+#define uhash_hashScriptSet U_ICU_ENTRY_POINT_RENAME(uhash_hashScriptSet)
+#define uhash_hashUChars U_ICU_ENTRY_POINT_RENAME(uhash_hashUChars)
+#define uhash_hashUnicodeString U_ICU_ENTRY_POINT_RENAME(uhash_hashUnicodeString)
+#define uhash_iget U_ICU_ENTRY_POINT_RENAME(uhash_iget)
+#define uhash_igeti U_ICU_ENTRY_POINT_RENAME(uhash_igeti)
+#define uhash_init U_ICU_ENTRY_POINT_RENAME(uhash_init)
+#define uhash_iput U_ICU_ENTRY_POINT_RENAME(uhash_iput)
+#define uhash_iputi U_ICU_ENTRY_POINT_RENAME(uhash_iputi)
+#define uhash_iremove U_ICU_ENTRY_POINT_RENAME(uhash_iremove)
+#define uhash_iremovei U_ICU_ENTRY_POINT_RENAME(uhash_iremovei)
+#define uhash_nextElement U_ICU_ENTRY_POINT_RENAME(uhash_nextElement)
+#define uhash_open U_ICU_ENTRY_POINT_RENAME(uhash_open)
+#define uhash_openSize U_ICU_ENTRY_POINT_RENAME(uhash_openSize)
+#define uhash_put U_ICU_ENTRY_POINT_RENAME(uhash_put)
+#define uhash_puti U_ICU_ENTRY_POINT_RENAME(uhash_puti)
+#define uhash_remove U_ICU_ENTRY_POINT_RENAME(uhash_remove)
+#define uhash_removeAll U_ICU_ENTRY_POINT_RENAME(uhash_removeAll)
+#define uhash_removeElement U_ICU_ENTRY_POINT_RENAME(uhash_removeElement)
+#define uhash_removei U_ICU_ENTRY_POINT_RENAME(uhash_removei)
+#define uhash_setKeyComparator U_ICU_ENTRY_POINT_RENAME(uhash_setKeyComparator)
+#define uhash_setKeyDeleter U_ICU_ENTRY_POINT_RENAME(uhash_setKeyDeleter)
+#define uhash_setKeyHasher U_ICU_ENTRY_POINT_RENAME(uhash_setKeyHasher)
+#define uhash_setResizePolicy U_ICU_ENTRY_POINT_RENAME(uhash_setResizePolicy)
+#define uhash_setValueComparator U_ICU_ENTRY_POINT_RENAME(uhash_setValueComparator)
+#define uhash_setValueDeleter U_ICU_ENTRY_POINT_RENAME(uhash_setValueDeleter)
+#define uidna_IDNToASCII U_ICU_ENTRY_POINT_RENAME(uidna_IDNToASCII)
+#define uidna_IDNToUnicode U_ICU_ENTRY_POINT_RENAME(uidna_IDNToUnicode)
+#define uidna_close U_ICU_ENTRY_POINT_RENAME(uidna_close)
+#define uidna_compare U_ICU_ENTRY_POINT_RENAME(uidna_compare)
+#define uidna_labelToASCII U_ICU_ENTRY_POINT_RENAME(uidna_labelToASCII)
+#define uidna_labelToASCII_UTF8 U_ICU_ENTRY_POINT_RENAME(uidna_labelToASCII_UTF8)
+#define uidna_labelToUnicode U_ICU_ENTRY_POINT_RENAME(uidna_labelToUnicode)
+#define uidna_labelToUnicodeUTF8 U_ICU_ENTRY_POINT_RENAME(uidna_labelToUnicodeUTF8)
+#define uidna_nameToASCII U_ICU_ENTRY_POINT_RENAME(uidna_nameToASCII)
+#define uidna_nameToASCII_UTF8 U_ICU_ENTRY_POINT_RENAME(uidna_nameToASCII_UTF8)
+#define uidna_nameToUnicode U_ICU_ENTRY_POINT_RENAME(uidna_nameToUnicode)
+#define uidna_nameToUnicodeUTF8 U_ICU_ENTRY_POINT_RENAME(uidna_nameToUnicodeUTF8)
+#define uidna_openUTS46 U_ICU_ENTRY_POINT_RENAME(uidna_openUTS46)
+#define uidna_toASCII U_ICU_ENTRY_POINT_RENAME(uidna_toASCII)
+#define uidna_toUnicode U_ICU_ENTRY_POINT_RENAME(uidna_toUnicode)
+#define uiter_current32 U_ICU_ENTRY_POINT_RENAME(uiter_current32)
+#define uiter_getState U_ICU_ENTRY_POINT_RENAME(uiter_getState)
+#define uiter_next32 U_ICU_ENTRY_POINT_RENAME(uiter_next32)
+#define uiter_previous32 U_ICU_ENTRY_POINT_RENAME(uiter_previous32)
+#define uiter_setCharacterIterator U_ICU_ENTRY_POINT_RENAME(uiter_setCharacterIterator)
+#define uiter_setReplaceable U_ICU_ENTRY_POINT_RENAME(uiter_setReplaceable)
+#define uiter_setState U_ICU_ENTRY_POINT_RENAME(uiter_setState)
+#define uiter_setString U_ICU_ENTRY_POINT_RENAME(uiter_setString)
+#define uiter_setUTF16BE U_ICU_ENTRY_POINT_RENAME(uiter_setUTF16BE)
+#define uiter_setUTF8 U_ICU_ENTRY_POINT_RENAME(uiter_setUTF8)
+#define uldn_close U_ICU_ENTRY_POINT_RENAME(uldn_close)
+#define uldn_getContext U_ICU_ENTRY_POINT_RENAME(uldn_getContext)
+#define uldn_getDialectHandling U_ICU_ENTRY_POINT_RENAME(uldn_getDialectHandling)
+#define uldn_getLocale U_ICU_ENTRY_POINT_RENAME(uldn_getLocale)
+#define uldn_keyDisplayName U_ICU_ENTRY_POINT_RENAME(uldn_keyDisplayName)
+#define uldn_keyValueDisplayName U_ICU_ENTRY_POINT_RENAME(uldn_keyValueDisplayName)
+#define uldn_languageDisplayName U_ICU_ENTRY_POINT_RENAME(uldn_languageDisplayName)
+#define uldn_localeDisplayName U_ICU_ENTRY_POINT_RENAME(uldn_localeDisplayName)
+#define uldn_open U_ICU_ENTRY_POINT_RENAME(uldn_open)
+#define uldn_openForContext U_ICU_ENTRY_POINT_RENAME(uldn_openForContext)
+#define uldn_regionDisplayName U_ICU_ENTRY_POINT_RENAME(uldn_regionDisplayName)
+#define uldn_scriptCodeDisplayName U_ICU_ENTRY_POINT_RENAME(uldn_scriptCodeDisplayName)
+#define uldn_scriptDisplayName U_ICU_ENTRY_POINT_RENAME(uldn_scriptDisplayName)
+#define uldn_variantDisplayName U_ICU_ENTRY_POINT_RENAME(uldn_variantDisplayName)
+#define ulist_addItemBeginList U_ICU_ENTRY_POINT_RENAME(ulist_addItemBeginList)
+#define ulist_addItemEndList U_ICU_ENTRY_POINT_RENAME(ulist_addItemEndList)
+#define ulist_close_keyword_values_iterator U_ICU_ENTRY_POINT_RENAME(ulist_close_keyword_values_iterator)
+#define ulist_containsString U_ICU_ENTRY_POINT_RENAME(ulist_containsString)
+#define ulist_count_keyword_values U_ICU_ENTRY_POINT_RENAME(ulist_count_keyword_values)
+#define ulist_createEmptyList U_ICU_ENTRY_POINT_RENAME(ulist_createEmptyList)
+#define ulist_deleteList U_ICU_ENTRY_POINT_RENAME(ulist_deleteList)
+#define ulist_getListFromEnum U_ICU_ENTRY_POINT_RENAME(ulist_getListFromEnum)
+#define ulist_getListSize U_ICU_ENTRY_POINT_RENAME(ulist_getListSize)
+#define ulist_getNext U_ICU_ENTRY_POINT_RENAME(ulist_getNext)
+#define ulist_next_keyword_value U_ICU_ENTRY_POINT_RENAME(ulist_next_keyword_value)
+#define ulist_resetList U_ICU_ENTRY_POINT_RENAME(ulist_resetList)
+#define ulist_reset_keyword_values_iterator U_ICU_ENTRY_POINT_RENAME(ulist_reset_keyword_values_iterator)
+#define uloc_acceptLanguage U_ICU_ENTRY_POINT_RENAME(uloc_acceptLanguage)
+#define uloc_acceptLanguageFromHTTP U_ICU_ENTRY_POINT_RENAME(uloc_acceptLanguageFromHTTP)
+#define uloc_addLikelySubtags U_ICU_ENTRY_POINT_RENAME(uloc_addLikelySubtags)
+#define uloc_canonicalize U_ICU_ENTRY_POINT_RENAME(uloc_canonicalize)
+#define uloc_countAvailable U_ICU_ENTRY_POINT_RENAME(uloc_countAvailable)
+#define uloc_forLanguageTag U_ICU_ENTRY_POINT_RENAME(uloc_forLanguageTag)
+#define uloc_getAvailable U_ICU_ENTRY_POINT_RENAME(uloc_getAvailable)
+#define uloc_getBaseName U_ICU_ENTRY_POINT_RENAME(uloc_getBaseName)
+#define uloc_getCharacterOrientation U_ICU_ENTRY_POINT_RENAME(uloc_getCharacterOrientation)
+#define uloc_getCountry U_ICU_ENTRY_POINT_RENAME(uloc_getCountry)
+#define uloc_getCurrentCountryID U_ICU_ENTRY_POINT_RENAME(uloc_getCurrentCountryID)
+#define uloc_getCurrentLanguageID U_ICU_ENTRY_POINT_RENAME(uloc_getCurrentLanguageID)
+#define uloc_getDefault U_ICU_ENTRY_POINT_RENAME(uloc_getDefault)
+#define uloc_getDisplayCountry U_ICU_ENTRY_POINT_RENAME(uloc_getDisplayCountry)
+#define uloc_getDisplayKeyword U_ICU_ENTRY_POINT_RENAME(uloc_getDisplayKeyword)
+#define uloc_getDisplayKeywordValue U_ICU_ENTRY_POINT_RENAME(uloc_getDisplayKeywordValue)
+#define uloc_getDisplayLanguage U_ICU_ENTRY_POINT_RENAME(uloc_getDisplayLanguage)
+#define uloc_getDisplayName U_ICU_ENTRY_POINT_RENAME(uloc_getDisplayName)
+#define uloc_getDisplayScript U_ICU_ENTRY_POINT_RENAME(uloc_getDisplayScript)
+#define uloc_getDisplayScriptInContext U_ICU_ENTRY_POINT_RENAME(uloc_getDisplayScriptInContext)
+#define uloc_getDisplayVariant U_ICU_ENTRY_POINT_RENAME(uloc_getDisplayVariant)
+#define uloc_getISO3Country U_ICU_ENTRY_POINT_RENAME(uloc_getISO3Country)
+#define uloc_getISO3Language U_ICU_ENTRY_POINT_RENAME(uloc_getISO3Language)
+#define uloc_getISOCountries U_ICU_ENTRY_POINT_RENAME(uloc_getISOCountries)
+#define uloc_getISOLanguages U_ICU_ENTRY_POINT_RENAME(uloc_getISOLanguages)
+#define uloc_getKeywordValue U_ICU_ENTRY_POINT_RENAME(uloc_getKeywordValue)
+#define uloc_getLCID U_ICU_ENTRY_POINT_RENAME(uloc_getLCID)
+#define uloc_getLanguage U_ICU_ENTRY_POINT_RENAME(uloc_getLanguage)
+#define uloc_getLineOrientation U_ICU_ENTRY_POINT_RENAME(uloc_getLineOrientation)
+#define uloc_getLocaleForLCID U_ICU_ENTRY_POINT_RENAME(uloc_getLocaleForLCID)
+#define uloc_getName U_ICU_ENTRY_POINT_RENAME(uloc_getName)
+#define uloc_getParent U_ICU_ENTRY_POINT_RENAME(uloc_getParent)
+#define uloc_getScript U_ICU_ENTRY_POINT_RENAME(uloc_getScript)
+#define uloc_getTableStringWithFallback U_ICU_ENTRY_POINT_RENAME(uloc_getTableStringWithFallback)
+#define uloc_getVariant U_ICU_ENTRY_POINT_RENAME(uloc_getVariant)
+#define uloc_minimizeSubtags U_ICU_ENTRY_POINT_RENAME(uloc_minimizeSubtags)
+#define uloc_openKeywordList U_ICU_ENTRY_POINT_RENAME(uloc_openKeywordList)
+#define uloc_openKeywords U_ICU_ENTRY_POINT_RENAME(uloc_openKeywords)
+#define uloc_setDefault U_ICU_ENTRY_POINT_RENAME(uloc_setDefault)
+#define uloc_setKeywordValue U_ICU_ENTRY_POINT_RENAME(uloc_setKeywordValue)
+#define uloc_toLanguageTag U_ICU_ENTRY_POINT_RENAME(uloc_toLanguageTag)
+#define ulocdata_close U_ICU_ENTRY_POINT_RENAME(ulocdata_close)
+#define ulocdata_getCLDRVersion U_ICU_ENTRY_POINT_RENAME(ulocdata_getCLDRVersion)
+#define ulocdata_getDelimiter U_ICU_ENTRY_POINT_RENAME(ulocdata_getDelimiter)
+#define ulocdata_getExemplarSet U_ICU_ENTRY_POINT_RENAME(ulocdata_getExemplarSet)
+#define ulocdata_getLocaleDisplayPattern U_ICU_ENTRY_POINT_RENAME(ulocdata_getLocaleDisplayPattern)
+#define ulocdata_getLocaleSeparator U_ICU_ENTRY_POINT_RENAME(ulocdata_getLocaleSeparator)
+#define ulocdata_getMeasurementSystem U_ICU_ENTRY_POINT_RENAME(ulocdata_getMeasurementSystem)
+#define ulocdata_getNoSubstitute U_ICU_ENTRY_POINT_RENAME(ulocdata_getNoSubstitute)
+#define ulocdata_getPaperSize U_ICU_ENTRY_POINT_RENAME(ulocdata_getPaperSize)
+#define ulocdata_open U_ICU_ENTRY_POINT_RENAME(ulocdata_open)
+#define ulocdata_setNoSubstitute U_ICU_ENTRY_POINT_RENAME(ulocdata_setNoSubstitute)
+#define ulocimp_getCountry U_ICU_ENTRY_POINT_RENAME(ulocimp_getCountry)
+#define ulocimp_getLanguage U_ICU_ENTRY_POINT_RENAME(ulocimp_getLanguage)
+#define ulocimp_getScript U_ICU_ENTRY_POINT_RENAME(ulocimp_getScript)
+#define umsg_applyPattern U_ICU_ENTRY_POINT_RENAME(umsg_applyPattern)
+#define umsg_autoQuoteApostrophe U_ICU_ENTRY_POINT_RENAME(umsg_autoQuoteApostrophe)
+#define umsg_clone U_ICU_ENTRY_POINT_RENAME(umsg_clone)
+#define umsg_close U_ICU_ENTRY_POINT_RENAME(umsg_close)
+#define umsg_format U_ICU_ENTRY_POINT_RENAME(umsg_format)
+#define umsg_getLocale U_ICU_ENTRY_POINT_RENAME(umsg_getLocale)
+#define umsg_open U_ICU_ENTRY_POINT_RENAME(umsg_open)
+#define umsg_parse U_ICU_ENTRY_POINT_RENAME(umsg_parse)
+#define umsg_setLocale U_ICU_ENTRY_POINT_RENAME(umsg_setLocale)
+#define umsg_toPattern U_ICU_ENTRY_POINT_RENAME(umsg_toPattern)
+#define umsg_vformat U_ICU_ENTRY_POINT_RENAME(umsg_vformat)
+#define umsg_vparse U_ICU_ENTRY_POINT_RENAME(umsg_vparse)
+#define umtx_lock U_ICU_ENTRY_POINT_RENAME(umtx_lock)
+#define umtx_unlock U_ICU_ENTRY_POINT_RENAME(umtx_unlock)
+#define uniset_getUnicode32Instance U_ICU_ENTRY_POINT_RENAME(uniset_getUnicode32Instance)
+#define unorm2_append U_ICU_ENTRY_POINT_RENAME(unorm2_append)
+#define unorm2_close U_ICU_ENTRY_POINT_RENAME(unorm2_close)
+#define unorm2_composePair U_ICU_ENTRY_POINT_RENAME(unorm2_composePair)
+#define unorm2_getCombiningClass U_ICU_ENTRY_POINT_RENAME(unorm2_getCombiningClass)
+#define unorm2_getDecomposition U_ICU_ENTRY_POINT_RENAME(unorm2_getDecomposition)
+#define unorm2_getInstance U_ICU_ENTRY_POINT_RENAME(unorm2_getInstance)
+#define unorm2_getNFCInstance U_ICU_ENTRY_POINT_RENAME(unorm2_getNFCInstance)
+#define unorm2_getNFDInstance U_ICU_ENTRY_POINT_RENAME(unorm2_getNFDInstance)
+#define unorm2_getNFKCCasefoldInstance U_ICU_ENTRY_POINT_RENAME(unorm2_getNFKCCasefoldInstance)
+#define unorm2_getNFKCInstance U_ICU_ENTRY_POINT_RENAME(unorm2_getNFKCInstance)
+#define unorm2_getNFKDInstance U_ICU_ENTRY_POINT_RENAME(unorm2_getNFKDInstance)
+#define unorm2_getRawDecomposition U_ICU_ENTRY_POINT_RENAME(unorm2_getRawDecomposition)
+#define unorm2_hasBoundaryAfter U_ICU_ENTRY_POINT_RENAME(unorm2_hasBoundaryAfter)
+#define unorm2_hasBoundaryBefore U_ICU_ENTRY_POINT_RENAME(unorm2_hasBoundaryBefore)
+#define unorm2_isInert U_ICU_ENTRY_POINT_RENAME(unorm2_isInert)
+#define unorm2_isNormalized U_ICU_ENTRY_POINT_RENAME(unorm2_isNormalized)
+#define unorm2_normalize U_ICU_ENTRY_POINT_RENAME(unorm2_normalize)
+#define unorm2_normalizeSecondAndAppend U_ICU_ENTRY_POINT_RENAME(unorm2_normalizeSecondAndAppend)
+#define unorm2_openFiltered U_ICU_ENTRY_POINT_RENAME(unorm2_openFiltered)
+#define unorm2_quickCheck U_ICU_ENTRY_POINT_RENAME(unorm2_quickCheck)
+#define unorm2_spanQuickCheckYes U_ICU_ENTRY_POINT_RENAME(unorm2_spanQuickCheckYes)
+#define unorm2_swap U_ICU_ENTRY_POINT_RENAME(unorm2_swap)
+#define unorm_closeIter U_ICU_ENTRY_POINT_RENAME(unorm_closeIter)
+#define unorm_compare U_ICU_ENTRY_POINT_RENAME(unorm_compare)
+#define unorm_concatenate U_ICU_ENTRY_POINT_RENAME(unorm_concatenate)
+#define unorm_getFCD16 U_ICU_ENTRY_POINT_RENAME(unorm_getFCD16)
+#define unorm_getQuickCheck U_ICU_ENTRY_POINT_RENAME(unorm_getQuickCheck)
+#define unorm_isNormalized U_ICU_ENTRY_POINT_RENAME(unorm_isNormalized)
+#define unorm_isNormalizedWithOptions U_ICU_ENTRY_POINT_RENAME(unorm_isNormalizedWithOptions)
+#define unorm_next U_ICU_ENTRY_POINT_RENAME(unorm_next)
+#define unorm_normalize U_ICU_ENTRY_POINT_RENAME(unorm_normalize)
+#define unorm_openIter U_ICU_ENTRY_POINT_RENAME(unorm_openIter)
+#define unorm_previous U_ICU_ENTRY_POINT_RENAME(unorm_previous)
+#define unorm_quickCheck U_ICU_ENTRY_POINT_RENAME(unorm_quickCheck)
+#define unorm_quickCheckWithOptions U_ICU_ENTRY_POINT_RENAME(unorm_quickCheckWithOptions)
+#define unorm_setIter U_ICU_ENTRY_POINT_RENAME(unorm_setIter)
+#define unum_applyPattern U_ICU_ENTRY_POINT_RENAME(unum_applyPattern)
+#define unum_clone U_ICU_ENTRY_POINT_RENAME(unum_clone)
+#define unum_close U_ICU_ENTRY_POINT_RENAME(unum_close)
+#define unum_countAvailable U_ICU_ENTRY_POINT_RENAME(unum_countAvailable)
+#define unum_format U_ICU_ENTRY_POINT_RENAME(unum_format)
+#define unum_formatDecimal U_ICU_ENTRY_POINT_RENAME(unum_formatDecimal)
+#define unum_formatDouble U_ICU_ENTRY_POINT_RENAME(unum_formatDouble)
+#define unum_formatDoubleCurrency U_ICU_ENTRY_POINT_RENAME(unum_formatDoubleCurrency)
+#define unum_formatInt64 U_ICU_ENTRY_POINT_RENAME(unum_formatInt64)
+#define unum_formatUFormattable U_ICU_ENTRY_POINT_RENAME(unum_formatUFormattable)
+#define unum_getAttribute U_ICU_ENTRY_POINT_RENAME(unum_getAttribute)
+#define unum_getAvailable U_ICU_ENTRY_POINT_RENAME(unum_getAvailable)
+#define unum_getDoubleAttribute U_ICU_ENTRY_POINT_RENAME(unum_getDoubleAttribute)
+#define unum_getLocaleByType U_ICU_ENTRY_POINT_RENAME(unum_getLocaleByType)
+#define unum_getSymbol U_ICU_ENTRY_POINT_RENAME(unum_getSymbol)
+#define unum_getTextAttribute U_ICU_ENTRY_POINT_RENAME(unum_getTextAttribute)
+#define unum_open U_ICU_ENTRY_POINT_RENAME(unum_open)
+#define unum_parse U_ICU_ENTRY_POINT_RENAME(unum_parse)
+#define unum_parseDecimal U_ICU_ENTRY_POINT_RENAME(unum_parseDecimal)
+#define unum_parseDouble U_ICU_ENTRY_POINT_RENAME(unum_parseDouble)
+#define unum_parseDoubleCurrency U_ICU_ENTRY_POINT_RENAME(unum_parseDoubleCurrency)
+#define unum_parseInt64 U_ICU_ENTRY_POINT_RENAME(unum_parseInt64)
+#define unum_parseToUFormattable U_ICU_ENTRY_POINT_RENAME(unum_parseToUFormattable)
+#define unum_setAttribute U_ICU_ENTRY_POINT_RENAME(unum_setAttribute)
+#define unum_setDoubleAttribute U_ICU_ENTRY_POINT_RENAME(unum_setDoubleAttribute)
+#define unum_setSymbol U_ICU_ENTRY_POINT_RENAME(unum_setSymbol)
+#define unum_setTextAttribute U_ICU_ENTRY_POINT_RENAME(unum_setTextAttribute)
+#define unum_toPattern U_ICU_ENTRY_POINT_RENAME(unum_toPattern)
+#define unumsys_close U_ICU_ENTRY_POINT_RENAME(unumsys_close)
+#define unumsys_getDescription U_ICU_ENTRY_POINT_RENAME(unumsys_getDescription)
+#define unumsys_getName U_ICU_ENTRY_POINT_RENAME(unumsys_getName)
+#define unumsys_getRadix U_ICU_ENTRY_POINT_RENAME(unumsys_getRadix)
+#define unumsys_isAlgorithmic U_ICU_ENTRY_POINT_RENAME(unumsys_isAlgorithmic)
+#define unumsys_open U_ICU_ENTRY_POINT_RENAME(unumsys_open)
+#define unumsys_openAvailableNames U_ICU_ENTRY_POINT_RENAME(unumsys_openAvailableNames)
+#define unumsys_openByName U_ICU_ENTRY_POINT_RENAME(unumsys_openByName)
+#define uplrules_close U_ICU_ENTRY_POINT_RENAME(uplrules_close)
+#define uplrules_open U_ICU_ENTRY_POINT_RENAME(uplrules_open)
+#define uplrules_openForType U_ICU_ENTRY_POINT_RENAME(uplrules_openForType)
+#define uplrules_select U_ICU_ENTRY_POINT_RENAME(uplrules_select)
+#define uplug_closeLibrary U_ICU_ENTRY_POINT_RENAME(uplug_closeLibrary)
+#define uplug_findLibrary U_ICU_ENTRY_POINT_RENAME(uplug_findLibrary)
+#define uplug_getConfiguration U_ICU_ENTRY_POINT_RENAME(uplug_getConfiguration)
+#define uplug_getContext U_ICU_ENTRY_POINT_RENAME(uplug_getContext)
+#define uplug_getCurrentLevel U_ICU_ENTRY_POINT_RENAME(uplug_getCurrentLevel)
+#define uplug_getLibrary U_ICU_ENTRY_POINT_RENAME(uplug_getLibrary)
+#define uplug_getLibraryName U_ICU_ENTRY_POINT_RENAME(uplug_getLibraryName)
+#define uplug_getPlugInternal U_ICU_ENTRY_POINT_RENAME(uplug_getPlugInternal)
+#define uplug_getPlugLevel U_ICU_ENTRY_POINT_RENAME(uplug_getPlugLevel)
+#define uplug_getPlugLoadStatus U_ICU_ENTRY_POINT_RENAME(uplug_getPlugLoadStatus)
+#define uplug_getPlugName U_ICU_ENTRY_POINT_RENAME(uplug_getPlugName)
+#define uplug_getPluginFile U_ICU_ENTRY_POINT_RENAME(uplug_getPluginFile)
+#define uplug_getSymbolName U_ICU_ENTRY_POINT_RENAME(uplug_getSymbolName)
+#define uplug_init U_ICU_ENTRY_POINT_RENAME(uplug_init)
+#define uplug_loadPlugFromEntrypoint U_ICU_ENTRY_POINT_RENAME(uplug_loadPlugFromEntrypoint)
+#define uplug_loadPlugFromLibrary U_ICU_ENTRY_POINT_RENAME(uplug_loadPlugFromLibrary)
+#define uplug_nextPlug U_ICU_ENTRY_POINT_RENAME(uplug_nextPlug)
+#define uplug_openLibrary U_ICU_ENTRY_POINT_RENAME(uplug_openLibrary)
+#define uplug_removePlug U_ICU_ENTRY_POINT_RENAME(uplug_removePlug)
+#define uplug_setContext U_ICU_ENTRY_POINT_RENAME(uplug_setContext)
+#define uplug_setPlugLevel U_ICU_ENTRY_POINT_RENAME(uplug_setPlugLevel)
+#define uplug_setPlugName U_ICU_ENTRY_POINT_RENAME(uplug_setPlugName)
+#define uplug_setPlugNoUnload U_ICU_ENTRY_POINT_RENAME(uplug_setPlugNoUnload)
+#define uprops_getSource U_ICU_ENTRY_POINT_RENAME(uprops_getSource)
+#define upropsvec_addPropertyStarts U_ICU_ENTRY_POINT_RENAME(upropsvec_addPropertyStarts)
+#define uprv_aestrncpy U_ICU_ENTRY_POINT_RENAME(uprv_aestrncpy)
+#define uprv_asciiFromEbcdic U_ICU_ENTRY_POINT_RENAME(uprv_asciiFromEbcdic)
+#define uprv_asciitolower U_ICU_ENTRY_POINT_RENAME(uprv_asciitolower)
+#define uprv_calloc U_ICU_ENTRY_POINT_RENAME(uprv_calloc)
+#define uprv_ceil U_ICU_ENTRY_POINT_RENAME(uprv_ceil)
+#define uprv_cnttab_addContraction U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_addContraction)
+#define uprv_cnttab_changeContraction U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_changeContraction)
+#define uprv_cnttab_changeLastCE U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_changeLastCE)
+#define uprv_cnttab_clone U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_clone)
+#define uprv_cnttab_close U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_close)
+#define uprv_cnttab_constructTable U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_constructTable)
+#define uprv_cnttab_findCE U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_findCE)
+#define uprv_cnttab_findCP U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_findCP)
+#define uprv_cnttab_getCE U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_getCE)
+#define uprv_cnttab_insertContraction U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_insertContraction)
+#define uprv_cnttab_isTailored U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_isTailored)
+#define uprv_cnttab_open U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_open)
+#define uprv_cnttab_setContraction U_ICU_ENTRY_POINT_RENAME(uprv_cnttab_setContraction)
+#define uprv_collIterateAtEnd U_ICU_ENTRY_POINT_RENAME(uprv_collIterateAtEnd)
+#define uprv_compareASCIIPropertyNames U_ICU_ENTRY_POINT_RENAME(uprv_compareASCIIPropertyNames)
+#define uprv_compareEBCDICPropertyNames U_ICU_ENTRY_POINT_RENAME(uprv_compareEBCDICPropertyNames)
+#define uprv_compareInvAscii U_ICU_ENTRY_POINT_RENAME(uprv_compareInvAscii)
+#define uprv_compareInvEbcdic U_ICU_ENTRY_POINT_RENAME(uprv_compareInvEbcdic)
+#define uprv_compareInvEbcdicAsAscii U_ICU_ENTRY_POINT_RENAME(uprv_compareInvEbcdicAsAscii)
+#define uprv_convertToLCID U_ICU_ENTRY_POINT_RENAME(uprv_convertToLCID)
+#define uprv_convertToPosix U_ICU_ENTRY_POINT_RENAME(uprv_convertToPosix)
+#define uprv_copyAscii U_ICU_ENTRY_POINT_RENAME(uprv_copyAscii)
+#define uprv_copyEbcdic U_ICU_ENTRY_POINT_RENAME(uprv_copyEbcdic)
+#define uprv_decContextClearStatus U_ICU_ENTRY_POINT_RENAME(uprv_decContextClearStatus)
+#define uprv_decContextDefault U_ICU_ENTRY_POINT_RENAME(uprv_decContextDefault)
+#define uprv_decContextGetRounding U_ICU_ENTRY_POINT_RENAME(uprv_decContextGetRounding)
+#define uprv_decContextGetStatus U_ICU_ENTRY_POINT_RENAME(uprv_decContextGetStatus)
+#define uprv_decContextRestoreStatus U_ICU_ENTRY_POINT_RENAME(uprv_decContextRestoreStatus)
+#define uprv_decContextSaveStatus U_ICU_ENTRY_POINT_RENAME(uprv_decContextSaveStatus)
+#define uprv_decContextSetRounding U_ICU_ENTRY_POINT_RENAME(uprv_decContextSetRounding)
+#define uprv_decContextSetStatus U_ICU_ENTRY_POINT_RENAME(uprv_decContextSetStatus)
+#define uprv_decContextSetStatusFromString U_ICU_ENTRY_POINT_RENAME(uprv_decContextSetStatusFromString)
+#define uprv_decContextSetStatusFromStringQuiet U_ICU_ENTRY_POINT_RENAME(uprv_decContextSetStatusFromStringQuiet)
+#define uprv_decContextSetStatusQuiet U_ICU_ENTRY_POINT_RENAME(uprv_decContextSetStatusQuiet)
+#define uprv_decContextStatusToString U_ICU_ENTRY_POINT_RENAME(uprv_decContextStatusToString)
+#define uprv_decContextTestSavedStatus U_ICU_ENTRY_POINT_RENAME(uprv_decContextTestSavedStatus)
+#define uprv_decContextTestStatus U_ICU_ENTRY_POINT_RENAME(uprv_decContextTestStatus)
+#define uprv_decContextZeroStatus U_ICU_ENTRY_POINT_RENAME(uprv_decContextZeroStatus)
+#define uprv_decNumberAbs U_ICU_ENTRY_POINT_RENAME(uprv_decNumberAbs)
+#define uprv_decNumberAdd U_ICU_ENTRY_POINT_RENAME(uprv_decNumberAdd)
+#define uprv_decNumberAnd U_ICU_ENTRY_POINT_RENAME(uprv_decNumberAnd)
+#define uprv_decNumberClass U_ICU_ENTRY_POINT_RENAME(uprv_decNumberClass)
+#define uprv_decNumberClassToString U_ICU_ENTRY_POINT_RENAME(uprv_decNumberClassToString)
+#define uprv_decNumberCompare U_ICU_ENTRY_POINT_RENAME(uprv_decNumberCompare)
+#define uprv_decNumberCompareSignal U_ICU_ENTRY_POINT_RENAME(uprv_decNumberCompareSignal)
+#define uprv_decNumberCompareTotal U_ICU_ENTRY_POINT_RENAME(uprv_decNumberCompareTotal)
+#define uprv_decNumberCompareTotalMag U_ICU_ENTRY_POINT_RENAME(uprv_decNumberCompareTotalMag)
+#define uprv_decNumberCopy U_ICU_ENTRY_POINT_RENAME(uprv_decNumberCopy)
+#define uprv_decNumberCopyAbs U_ICU_ENTRY_POINT_RENAME(uprv_decNumberCopyAbs)
+#define uprv_decNumberCopyNegate U_ICU_ENTRY_POINT_RENAME(uprv_decNumberCopyNegate)
+#define uprv_decNumberCopySign U_ICU_ENTRY_POINT_RENAME(uprv_decNumberCopySign)
+#define uprv_decNumberDivide U_ICU_ENTRY_POINT_RENAME(uprv_decNumberDivide)
+#define uprv_decNumberDivideInteger U_ICU_ENTRY_POINT_RENAME(uprv_decNumberDivideInteger)
+#define uprv_decNumberExp U_ICU_ENTRY_POINT_RENAME(uprv_decNumberExp)
+#define uprv_decNumberFMA U_ICU_ENTRY_POINT_RENAME(uprv_decNumberFMA)
+#define uprv_decNumberFromInt32 U_ICU_ENTRY_POINT_RENAME(uprv_decNumberFromInt32)
+#define uprv_decNumberFromString U_ICU_ENTRY_POINT_RENAME(uprv_decNumberFromString)
+#define uprv_decNumberFromUInt32 U_ICU_ENTRY_POINT_RENAME(uprv_decNumberFromUInt32)
+#define uprv_decNumberGetBCD U_ICU_ENTRY_POINT_RENAME(uprv_decNumberGetBCD)
+#define uprv_decNumberInvert U_ICU_ENTRY_POINT_RENAME(uprv_decNumberInvert)
+#define uprv_decNumberIsNormal U_ICU_ENTRY_POINT_RENAME(uprv_decNumberIsNormal)
+#define uprv_decNumberIsSubnormal U_ICU_ENTRY_POINT_RENAME(uprv_decNumberIsSubnormal)
+#define uprv_decNumberLn U_ICU_ENTRY_POINT_RENAME(uprv_decNumberLn)
+#define uprv_decNumberLog10 U_ICU_ENTRY_POINT_RENAME(uprv_decNumberLog10)
+#define uprv_decNumberLogB U_ICU_ENTRY_POINT_RENAME(uprv_decNumberLogB)
+#define uprv_decNumberMax U_ICU_ENTRY_POINT_RENAME(uprv_decNumberMax)
+#define uprv_decNumberMaxMag U_ICU_ENTRY_POINT_RENAME(uprv_decNumberMaxMag)
+#define uprv_decNumberMin U_ICU_ENTRY_POINT_RENAME(uprv_decNumberMin)
+#define uprv_decNumberMinMag U_ICU_ENTRY_POINT_RENAME(uprv_decNumberMinMag)
+#define uprv_decNumberMinus U_ICU_ENTRY_POINT_RENAME(uprv_decNumberMinus)
+#define uprv_decNumberMultiply U_ICU_ENTRY_POINT_RENAME(uprv_decNumberMultiply)
+#define uprv_decNumberNextMinus U_ICU_ENTRY_POINT_RENAME(uprv_decNumberNextMinus)
+#define uprv_decNumberNextPlus U_ICU_ENTRY_POINT_RENAME(uprv_decNumberNextPlus)
+#define uprv_decNumberNextToward U_ICU_ENTRY_POINT_RENAME(uprv_decNumberNextToward)
+#define uprv_decNumberNormalize U_ICU_ENTRY_POINT_RENAME(uprv_decNumberNormalize)
+#define uprv_decNumberOr U_ICU_ENTRY_POINT_RENAME(uprv_decNumberOr)
+#define uprv_decNumberPlus U_ICU_ENTRY_POINT_RENAME(uprv_decNumberPlus)
+#define uprv_decNumberPower U_ICU_ENTRY_POINT_RENAME(uprv_decNumberPower)
+#define uprv_decNumberQuantize U_ICU_ENTRY_POINT_RENAME(uprv_decNumberQuantize)
+#define uprv_decNumberReduce U_ICU_ENTRY_POINT_RENAME(uprv_decNumberReduce)
+#define uprv_decNumberRemainder U_ICU_ENTRY_POINT_RENAME(uprv_decNumberRemainder)
+#define uprv_decNumberRemainderNear U_ICU_ENTRY_POINT_RENAME(uprv_decNumberRemainderNear)
+#define uprv_decNumberRescale U_ICU_ENTRY_POINT_RENAME(uprv_decNumberRescale)
+#define uprv_decNumberRotate U_ICU_ENTRY_POINT_RENAME(uprv_decNumberRotate)
+#define uprv_decNumberSameQuantum U_ICU_ENTRY_POINT_RENAME(uprv_decNumberSameQuantum)
+#define uprv_decNumberScaleB U_ICU_ENTRY_POINT_RENAME(uprv_decNumberScaleB)
+#define uprv_decNumberSetBCD U_ICU_ENTRY_POINT_RENAME(uprv_decNumberSetBCD)
+#define uprv_decNumberShift U_ICU_ENTRY_POINT_RENAME(uprv_decNumberShift)
+#define uprv_decNumberSquareRoot U_ICU_ENTRY_POINT_RENAME(uprv_decNumberSquareRoot)
+#define uprv_decNumberSubtract U_ICU_ENTRY_POINT_RENAME(uprv_decNumberSubtract)
+#define uprv_decNumberToEngString U_ICU_ENTRY_POINT_RENAME(uprv_decNumberToEngString)
+#define uprv_decNumberToInt32 U_ICU_ENTRY_POINT_RENAME(uprv_decNumberToInt32)
+#define uprv_decNumberToIntegralExact U_ICU_ENTRY_POINT_RENAME(uprv_decNumberToIntegralExact)
+#define uprv_decNumberToIntegralValue U_ICU_ENTRY_POINT_RENAME(uprv_decNumberToIntegralValue)
+#define uprv_decNumberToString U_ICU_ENTRY_POINT_RENAME(uprv_decNumberToString)
+#define uprv_decNumberToUInt32 U_ICU_ENTRY_POINT_RENAME(uprv_decNumberToUInt32)
+#define uprv_decNumberTrim U_ICU_ENTRY_POINT_RENAME(uprv_decNumberTrim)
+#define uprv_decNumberVersion U_ICU_ENTRY_POINT_RENAME(uprv_decNumberVersion)
+#define uprv_decNumberXor U_ICU_ENTRY_POINT_RENAME(uprv_decNumberXor)
+#define uprv_decNumberZero U_ICU_ENTRY_POINT_RENAME(uprv_decNumberZero)
+#define uprv_deleteUObject U_ICU_ENTRY_POINT_RENAME(uprv_deleteUObject)
+#define uprv_delete_collIterate U_ICU_ENTRY_POINT_RENAME(uprv_delete_collIterate)
+#define uprv_dl_close U_ICU_ENTRY_POINT_RENAME(uprv_dl_close)
+#define uprv_dl_open U_ICU_ENTRY_POINT_RENAME(uprv_dl_open)
+#define uprv_dlsym_func U_ICU_ENTRY_POINT_RENAME(uprv_dlsym_func)
+#define uprv_eastrncpy U_ICU_ENTRY_POINT_RENAME(uprv_eastrncpy)
+#define uprv_ebcdicFromAscii U_ICU_ENTRY_POINT_RENAME(uprv_ebcdicFromAscii)
+#define uprv_ebcdicToLowercaseAscii U_ICU_ENTRY_POINT_RENAME(uprv_ebcdicToLowercaseAscii)
+#define uprv_ebcdictolower U_ICU_ENTRY_POINT_RENAME(uprv_ebcdictolower)
+#define uprv_fabs U_ICU_ENTRY_POINT_RENAME(uprv_fabs)
+#define uprv_floor U_ICU_ENTRY_POINT_RENAME(uprv_floor)
+#define uprv_fmax U_ICU_ENTRY_POINT_RENAME(uprv_fmax)
+#define uprv_fmin U_ICU_ENTRY_POINT_RENAME(uprv_fmin)
+#define uprv_fmod U_ICU_ENTRY_POINT_RENAME(uprv_fmod)
+#define uprv_free U_ICU_ENTRY_POINT_RENAME(uprv_free)
+#define uprv_getCharNameCharacters U_ICU_ENTRY_POINT_RENAME(uprv_getCharNameCharacters)
+#define uprv_getDefaultCodepage U_ICU_ENTRY_POINT_RENAME(uprv_getDefaultCodepage)
+#define uprv_getDefaultLocaleID U_ICU_ENTRY_POINT_RENAME(uprv_getDefaultLocaleID)
+#define uprv_getInfinity U_ICU_ENTRY_POINT_RENAME(uprv_getInfinity)
+#define uprv_getMaxCharNameLength U_ICU_ENTRY_POINT_RENAME(uprv_getMaxCharNameLength)
+#define uprv_getMaxValues U_ICU_ENTRY_POINT_RENAME(uprv_getMaxValues)
+#define uprv_getNaN U_ICU_ENTRY_POINT_RENAME(uprv_getNaN)
+#define uprv_getRawUTCtime U_ICU_ENTRY_POINT_RENAME(uprv_getRawUTCtime)
+#define uprv_getStaticCurrencyName U_ICU_ENTRY_POINT_RENAME(uprv_getStaticCurrencyName)
+#define uprv_getUTCtime U_ICU_ENTRY_POINT_RENAME(uprv_getUTCtime)
+#define uprv_haveProperties U_ICU_ENTRY_POINT_RENAME(uprv_haveProperties)
+#define uprv_init_collIterate U_ICU_ENTRY_POINT_RENAME(uprv_init_collIterate)
+#define uprv_init_pce U_ICU_ENTRY_POINT_RENAME(uprv_init_pce)
+#define uprv_int32Comparator U_ICU_ENTRY_POINT_RENAME(uprv_int32Comparator)
+#define uprv_isASCIILetter U_ICU_ENTRY_POINT_RENAME(uprv_isASCIILetter)
+#define uprv_isInfinite U_ICU_ENTRY_POINT_RENAME(uprv_isInfinite)
+#define uprv_isInvariantString U_ICU_ENTRY_POINT_RENAME(uprv_isInvariantString)
+#define uprv_isInvariantUString U_ICU_ENTRY_POINT_RENAME(uprv_isInvariantUString)
+#define uprv_isNaN U_ICU_ENTRY_POINT_RENAME(uprv_isNaN)
+#define uprv_isNegativeInfinity U_ICU_ENTRY_POINT_RENAME(uprv_isNegativeInfinity)
+#define uprv_isPositiveInfinity U_ICU_ENTRY_POINT_RENAME(uprv_isPositiveInfinity)
+#define uprv_itou U_ICU_ENTRY_POINT_RENAME(uprv_itou)
+#define uprv_log U_ICU_ENTRY_POINT_RENAME(uprv_log)
+#define uprv_malloc U_ICU_ENTRY_POINT_RENAME(uprv_malloc)
+#define uprv_mapFile U_ICU_ENTRY_POINT_RENAME(uprv_mapFile)
+#define uprv_max U_ICU_ENTRY_POINT_RENAME(uprv_max)
+#define uprv_maxMantissa U_ICU_ENTRY_POINT_RENAME(uprv_maxMantissa)
+#define uprv_maximumPtr U_ICU_ENTRY_POINT_RENAME(uprv_maximumPtr)
+#define uprv_min U_ICU_ENTRY_POINT_RENAME(uprv_min)
+#define uprv_modf U_ICU_ENTRY_POINT_RENAME(uprv_modf)
+#define uprv_new_collIterate U_ICU_ENTRY_POINT_RENAME(uprv_new_collIterate)
+#define uprv_parseCurrency U_ICU_ENTRY_POINT_RENAME(uprv_parseCurrency)
+#define uprv_pathIsAbsolute U_ICU_ENTRY_POINT_RENAME(uprv_pathIsAbsolute)
+#define uprv_pow U_ICU_ENTRY_POINT_RENAME(uprv_pow)
+#define uprv_pow10 U_ICU_ENTRY_POINT_RENAME(uprv_pow10)
+#define uprv_realloc U_ICU_ENTRY_POINT_RENAME(uprv_realloc)
+#define uprv_round U_ICU_ENTRY_POINT_RENAME(uprv_round)
+#define uprv_sortArray U_ICU_ENTRY_POINT_RENAME(uprv_sortArray)
+#define uprv_stableBinarySearch U_ICU_ENTRY_POINT_RENAME(uprv_stableBinarySearch)
+#define uprv_strCompare U_ICU_ENTRY_POINT_RENAME(uprv_strCompare)
+#define uprv_strdup U_ICU_ENTRY_POINT_RENAME(uprv_strdup)
+#define uprv_stricmp U_ICU_ENTRY_POINT_RENAME(uprv_stricmp)
+#define uprv_strndup U_ICU_ENTRY_POINT_RENAME(uprv_strndup)
+#define uprv_strnicmp U_ICU_ENTRY_POINT_RENAME(uprv_strnicmp)
+#define uprv_syntaxError U_ICU_ENTRY_POINT_RENAME(uprv_syntaxError)
+#define uprv_timezone U_ICU_ENTRY_POINT_RENAME(uprv_timezone)
+#define uprv_toupper U_ICU_ENTRY_POINT_RENAME(uprv_toupper)
+#define uprv_trunc U_ICU_ENTRY_POINT_RENAME(uprv_trunc)
+#define uprv_tzname U_ICU_ENTRY_POINT_RENAME(uprv_tzname)
+#define uprv_tzset U_ICU_ENTRY_POINT_RENAME(uprv_tzset)
+#define uprv_uca_addAnElement U_ICU_ENTRY_POINT_RENAME(uprv_uca_addAnElement)
+#define uprv_uca_assembleTable U_ICU_ENTRY_POINT_RENAME(uprv_uca_assembleTable)
+#define uprv_uca_canonicalClosure U_ICU_ENTRY_POINT_RENAME(uprv_uca_canonicalClosure)
+#define uprv_uca_closeTempTable U_ICU_ENTRY_POINT_RENAME(uprv_uca_closeTempTable)
+#define uprv_uca_getCodePointFromRaw U_ICU_ENTRY_POINT_RENAME(uprv_uca_getCodePointFromRaw)
+#define uprv_uca_getImplicitFromRaw U_ICU_ENTRY_POINT_RENAME(uprv_uca_getImplicitFromRaw)
+#define uprv_uca_getRawFromCodePoint U_ICU_ENTRY_POINT_RENAME(uprv_uca_getRawFromCodePoint)
+#define uprv_uca_getRawFromImplicit U_ICU_ENTRY_POINT_RENAME(uprv_uca_getRawFromImplicit)
+#define uprv_uca_initImplicitConstants U_ICU_ENTRY_POINT_RENAME(uprv_uca_initImplicitConstants)
+#define uprv_uca_initTempTable U_ICU_ENTRY_POINT_RENAME(uprv_uca_initTempTable)
+#define uprv_uint16Comparator U_ICU_ENTRY_POINT_RENAME(uprv_uint16Comparator)
+#define uprv_uint32Comparator U_ICU_ENTRY_POINT_RENAME(uprv_uint32Comparator)
+#define uprv_unmapFile U_ICU_ENTRY_POINT_RENAME(uprv_unmapFile)
+#define upvec_cloneArray U_ICU_ENTRY_POINT_RENAME(upvec_cloneArray)
+#define upvec_close U_ICU_ENTRY_POINT_RENAME(upvec_close)
+#define upvec_compact U_ICU_ENTRY_POINT_RENAME(upvec_compact)
+#define upvec_compactToUTrie2Handler U_ICU_ENTRY_POINT_RENAME(upvec_compactToUTrie2Handler)
+#define upvec_compactToUTrie2WithRowIndexes U_ICU_ENTRY_POINT_RENAME(upvec_compactToUTrie2WithRowIndexes)
+#define upvec_getArray U_ICU_ENTRY_POINT_RENAME(upvec_getArray)
+#define upvec_getRow U_ICU_ENTRY_POINT_RENAME(upvec_getRow)
+#define upvec_getValue U_ICU_ENTRY_POINT_RENAME(upvec_getValue)
+#define upvec_open U_ICU_ENTRY_POINT_RENAME(upvec_open)
+#define upvec_setValue U_ICU_ENTRY_POINT_RENAME(upvec_setValue)
+#define uregex_appendReplacement U_ICU_ENTRY_POINT_RENAME(uregex_appendReplacement)
+#define uregex_appendReplacementUText U_ICU_ENTRY_POINT_RENAME(uregex_appendReplacementUText)
+#define uregex_appendTail U_ICU_ENTRY_POINT_RENAME(uregex_appendTail)
+#define uregex_appendTailUText U_ICU_ENTRY_POINT_RENAME(uregex_appendTailUText)
+#define uregex_clone U_ICU_ENTRY_POINT_RENAME(uregex_clone)
+#define uregex_close U_ICU_ENTRY_POINT_RENAME(uregex_close)
+#define uregex_end U_ICU_ENTRY_POINT_RENAME(uregex_end)
+#define uregex_end64 U_ICU_ENTRY_POINT_RENAME(uregex_end64)
+#define uregex_find U_ICU_ENTRY_POINT_RENAME(uregex_find)
+#define uregex_find64 U_ICU_ENTRY_POINT_RENAME(uregex_find64)
+#define uregex_findNext U_ICU_ENTRY_POINT_RENAME(uregex_findNext)
+#define uregex_flags U_ICU_ENTRY_POINT_RENAME(uregex_flags)
+#define uregex_getFindProgressCallback U_ICU_ENTRY_POINT_RENAME(uregex_getFindProgressCallback)
+#define uregex_getMatchCallback U_ICU_ENTRY_POINT_RENAME(uregex_getMatchCallback)
+#define uregex_getStackLimit U_ICU_ENTRY_POINT_RENAME(uregex_getStackLimit)
+#define uregex_getText U_ICU_ENTRY_POINT_RENAME(uregex_getText)
+#define uregex_getTimeLimit U_ICU_ENTRY_POINT_RENAME(uregex_getTimeLimit)
+#define uregex_getUText U_ICU_ENTRY_POINT_RENAME(uregex_getUText)
+#define uregex_group U_ICU_ENTRY_POINT_RENAME(uregex_group)
+#define uregex_groupCount U_ICU_ENTRY_POINT_RENAME(uregex_groupCount)
+#define uregex_groupUText U_ICU_ENTRY_POINT_RENAME(uregex_groupUText)
+#define uregex_groupUTextDeep U_ICU_ENTRY_POINT_RENAME(uregex_groupUTextDeep)
+#define uregex_hasAnchoringBounds U_ICU_ENTRY_POINT_RENAME(uregex_hasAnchoringBounds)
+#define uregex_hasTransparentBounds U_ICU_ENTRY_POINT_RENAME(uregex_hasTransparentBounds)
+#define uregex_hitEnd U_ICU_ENTRY_POINT_RENAME(uregex_hitEnd)
+#define uregex_lookingAt U_ICU_ENTRY_POINT_RENAME(uregex_lookingAt)
+#define uregex_lookingAt64 U_ICU_ENTRY_POINT_RENAME(uregex_lookingAt64)
+#define uregex_matches U_ICU_ENTRY_POINT_RENAME(uregex_matches)
+#define uregex_matches64 U_ICU_ENTRY_POINT_RENAME(uregex_matches64)
+#define uregex_open U_ICU_ENTRY_POINT_RENAME(uregex_open)
+#define uregex_openC U_ICU_ENTRY_POINT_RENAME(uregex_openC)
+#define uregex_openUText U_ICU_ENTRY_POINT_RENAME(uregex_openUText)
+#define uregex_pattern U_ICU_ENTRY_POINT_RENAME(uregex_pattern)
+#define uregex_patternUText U_ICU_ENTRY_POINT_RENAME(uregex_patternUText)
+#define uregex_refreshUText U_ICU_ENTRY_POINT_RENAME(uregex_refreshUText)
+#define uregex_regionEnd U_ICU_ENTRY_POINT_RENAME(uregex_regionEnd)
+#define uregex_regionEnd64 U_ICU_ENTRY_POINT_RENAME(uregex_regionEnd64)
+#define uregex_regionStart U_ICU_ENTRY_POINT_RENAME(uregex_regionStart)
+#define uregex_regionStart64 U_ICU_ENTRY_POINT_RENAME(uregex_regionStart64)
+#define uregex_replaceAll U_ICU_ENTRY_POINT_RENAME(uregex_replaceAll)
+#define uregex_replaceAllUText U_ICU_ENTRY_POINT_RENAME(uregex_replaceAllUText)
+#define uregex_replaceFirst U_ICU_ENTRY_POINT_RENAME(uregex_replaceFirst)
+#define uregex_replaceFirstUText U_ICU_ENTRY_POINT_RENAME(uregex_replaceFirstUText)
+#define uregex_requireEnd U_ICU_ENTRY_POINT_RENAME(uregex_requireEnd)
+#define uregex_reset U_ICU_ENTRY_POINT_RENAME(uregex_reset)
+#define uregex_reset64 U_ICU_ENTRY_POINT_RENAME(uregex_reset64)
+#define uregex_setFindProgressCallback U_ICU_ENTRY_POINT_RENAME(uregex_setFindProgressCallback)
+#define uregex_setMatchCallback U_ICU_ENTRY_POINT_RENAME(uregex_setMatchCallback)
+#define uregex_setRegion U_ICU_ENTRY_POINT_RENAME(uregex_setRegion)
+#define uregex_setRegion64 U_ICU_ENTRY_POINT_RENAME(uregex_setRegion64)
+#define uregex_setRegionAndStart U_ICU_ENTRY_POINT_RENAME(uregex_setRegionAndStart)
+#define uregex_setStackLimit U_ICU_ENTRY_POINT_RENAME(uregex_setStackLimit)
+#define uregex_setText U_ICU_ENTRY_POINT_RENAME(uregex_setText)
+#define uregex_setTimeLimit U_ICU_ENTRY_POINT_RENAME(uregex_setTimeLimit)
+#define uregex_setUText U_ICU_ENTRY_POINT_RENAME(uregex_setUText)
+#define uregex_split U_ICU_ENTRY_POINT_RENAME(uregex_split)
+#define uregex_splitUText U_ICU_ENTRY_POINT_RENAME(uregex_splitUText)
+#define uregex_start U_ICU_ENTRY_POINT_RENAME(uregex_start)
+#define uregex_start64 U_ICU_ENTRY_POINT_RENAME(uregex_start64)
+#define uregex_ucstr_unescape_charAt U_ICU_ENTRY_POINT_RENAME(uregex_ucstr_unescape_charAt)
+#define uregex_useAnchoringBounds U_ICU_ENTRY_POINT_RENAME(uregex_useAnchoringBounds)
+#define uregex_useTransparentBounds U_ICU_ENTRY_POINT_RENAME(uregex_useTransparentBounds)
+#define uregex_utext_unescape_charAt U_ICU_ENTRY_POINT_RENAME(uregex_utext_unescape_charAt)
+#define uregion_areEqual U_ICU_ENTRY_POINT_RENAME(uregion_areEqual)
+#define uregion_contains U_ICU_ENTRY_POINT_RENAME(uregion_contains)
+#define uregion_getAvailable U_ICU_ENTRY_POINT_RENAME(uregion_getAvailable)
+#define uregion_getContainedRegions U_ICU_ENTRY_POINT_RENAME(uregion_getContainedRegions)
+#define uregion_getContainedRegionsOfType U_ICU_ENTRY_POINT_RENAME(uregion_getContainedRegionsOfType)
+#define uregion_getContainingRegion U_ICU_ENTRY_POINT_RENAME(uregion_getContainingRegion)
+#define uregion_getContainingRegionOfType U_ICU_ENTRY_POINT_RENAME(uregion_getContainingRegionOfType)
+#define uregion_getNumericCode U_ICU_ENTRY_POINT_RENAME(uregion_getNumericCode)
+#define uregion_getPreferredValues U_ICU_ENTRY_POINT_RENAME(uregion_getPreferredValues)
+#define uregion_getRegionCode U_ICU_ENTRY_POINT_RENAME(uregion_getRegionCode)
+#define uregion_getRegionFromCode U_ICU_ENTRY_POINT_RENAME(uregion_getRegionFromCode)
+#define uregion_getRegionFromNumericCode U_ICU_ENTRY_POINT_RENAME(uregion_getRegionFromNumericCode)
+#define uregion_getType U_ICU_ENTRY_POINT_RENAME(uregion_getType)
+#define ures_close U_ICU_ENTRY_POINT_RENAME(ures_close)
+#define ures_copyResb U_ICU_ENTRY_POINT_RENAME(ures_copyResb)
+#define ures_countArrayItems U_ICU_ENTRY_POINT_RENAME(ures_countArrayItems)
+#define ures_findResource U_ICU_ENTRY_POINT_RENAME(ures_findResource)
+#define ures_findSubResource U_ICU_ENTRY_POINT_RENAME(ures_findSubResource)
+#define ures_getBinary U_ICU_ENTRY_POINT_RENAME(ures_getBinary)
+#define ures_getByIndex U_ICU_ENTRY_POINT_RENAME(ures_getByIndex)
+#define ures_getByKey U_ICU_ENTRY_POINT_RENAME(ures_getByKey)
+#define ures_getByKeyWithFallback U_ICU_ENTRY_POINT_RENAME(ures_getByKeyWithFallback)
+#define ures_getFunctionalEquivalent U_ICU_ENTRY_POINT_RENAME(ures_getFunctionalEquivalent)
+#define ures_getInt U_ICU_ENTRY_POINT_RENAME(ures_getInt)
+#define ures_getIntVector U_ICU_ENTRY_POINT_RENAME(ures_getIntVector)
+#define ures_getKey U_ICU_ENTRY_POINT_RENAME(ures_getKey)
+#define ures_getKeywordValues U_ICU_ENTRY_POINT_RENAME(ures_getKeywordValues)
+#define ures_getLocale U_ICU_ENTRY_POINT_RENAME(ures_getLocale)
+#define ures_getLocaleByType U_ICU_ENTRY_POINT_RENAME(ures_getLocaleByType)
+#define ures_getLocaleInternal U_ICU_ENTRY_POINT_RENAME(ures_getLocaleInternal)
+#define ures_getName U_ICU_ENTRY_POINT_RENAME(ures_getName)
+#define ures_getNextResource U_ICU_ENTRY_POINT_RENAME(ures_getNextResource)
+#define ures_getNextString U_ICU_ENTRY_POINT_RENAME(ures_getNextString)
+#define ures_getSize U_ICU_ENTRY_POINT_RENAME(ures_getSize)
+#define ures_getString U_ICU_ENTRY_POINT_RENAME(ures_getString)
+#define ures_getStringByIndex U_ICU_ENTRY_POINT_RENAME(ures_getStringByIndex)
+#define ures_getStringByKey U_ICU_ENTRY_POINT_RENAME(ures_getStringByKey)
+#define ures_getStringByKeyWithFallback U_ICU_ENTRY_POINT_RENAME(ures_getStringByKeyWithFallback)
+#define ures_getType U_ICU_ENTRY_POINT_RENAME(ures_getType)
+#define ures_getUInt U_ICU_ENTRY_POINT_RENAME(ures_getUInt)
+#define ures_getUTF8String U_ICU_ENTRY_POINT_RENAME(ures_getUTF8String)
+#define ures_getUTF8StringByIndex U_ICU_ENTRY_POINT_RENAME(ures_getUTF8StringByIndex)
+#define ures_getUTF8StringByKey U_ICU_ENTRY_POINT_RENAME(ures_getUTF8StringByKey)
+#define ures_getVersion U_ICU_ENTRY_POINT_RENAME(ures_getVersion)
+#define ures_getVersionByKey U_ICU_ENTRY_POINT_RENAME(ures_getVersionByKey)
+#define ures_getVersionNumber U_ICU_ENTRY_POINT_RENAME(ures_getVersionNumber)
+#define ures_getVersionNumberInternal U_ICU_ENTRY_POINT_RENAME(ures_getVersionNumberInternal)
+#define ures_hasNext U_ICU_ENTRY_POINT_RENAME(ures_hasNext)
+#define ures_initStackObject U_ICU_ENTRY_POINT_RENAME(ures_initStackObject)
+#define ures_open U_ICU_ENTRY_POINT_RENAME(ures_open)
+#define ures_openAvailableLocales U_ICU_ENTRY_POINT_RENAME(ures_openAvailableLocales)
+#define ures_openDirect U_ICU_ENTRY_POINT_RENAME(ures_openDirect)
+#define ures_openFillIn U_ICU_ENTRY_POINT_RENAME(ures_openFillIn)
+#define ures_openU U_ICU_ENTRY_POINT_RENAME(ures_openU)
+#define ures_resetIterator U_ICU_ENTRY_POINT_RENAME(ures_resetIterator)
+#define ures_swap U_ICU_ENTRY_POINT_RENAME(ures_swap)
+#define uscript_breaksBetweenLetters U_ICU_ENTRY_POINT_RENAME(uscript_breaksBetweenLetters)
+#define uscript_closeRun U_ICU_ENTRY_POINT_RENAME(uscript_closeRun)
+#define uscript_getCode U_ICU_ENTRY_POINT_RENAME(uscript_getCode)
+#define uscript_getName U_ICU_ENTRY_POINT_RENAME(uscript_getName)
+#define uscript_getSampleString U_ICU_ENTRY_POINT_RENAME(uscript_getSampleString)
+#define uscript_getSampleUnicodeString U_ICU_ENTRY_POINT_RENAME(uscript_getSampleUnicodeString)
+#define uscript_getScript U_ICU_ENTRY_POINT_RENAME(uscript_getScript)
+#define uscript_getScriptExtensions U_ICU_ENTRY_POINT_RENAME(uscript_getScriptExtensions)
+#define uscript_getShortName U_ICU_ENTRY_POINT_RENAME(uscript_getShortName)
+#define uscript_getUsage U_ICU_ENTRY_POINT_RENAME(uscript_getUsage)
+#define uscript_hasScript U_ICU_ENTRY_POINT_RENAME(uscript_hasScript)
+#define uscript_isCased U_ICU_ENTRY_POINT_RENAME(uscript_isCased)
+#define uscript_isRightToLeft U_ICU_ENTRY_POINT_RENAME(uscript_isRightToLeft)
+#define uscript_nextRun U_ICU_ENTRY_POINT_RENAME(uscript_nextRun)
+#define uscript_openRun U_ICU_ENTRY_POINT_RENAME(uscript_openRun)
+#define uscript_resetRun U_ICU_ENTRY_POINT_RENAME(uscript_resetRun)
+#define uscript_setRunText U_ICU_ENTRY_POINT_RENAME(uscript_setRunText)
+#define usearch_close U_ICU_ENTRY_POINT_RENAME(usearch_close)
+#define usearch_first U_ICU_ENTRY_POINT_RENAME(usearch_first)
+#define usearch_following U_ICU_ENTRY_POINT_RENAME(usearch_following)
+#define usearch_getAttribute U_ICU_ENTRY_POINT_RENAME(usearch_getAttribute)
+#define usearch_getBreakIterator U_ICU_ENTRY_POINT_RENAME(usearch_getBreakIterator)
+#define usearch_getCollator U_ICU_ENTRY_POINT_RENAME(usearch_getCollator)
+#define usearch_getMatchedLength U_ICU_ENTRY_POINT_RENAME(usearch_getMatchedLength)
+#define usearch_getMatchedStart U_ICU_ENTRY_POINT_RENAME(usearch_getMatchedStart)
+#define usearch_getMatchedText U_ICU_ENTRY_POINT_RENAME(usearch_getMatchedText)
+#define usearch_getOffset U_ICU_ENTRY_POINT_RENAME(usearch_getOffset)
+#define usearch_getPattern U_ICU_ENTRY_POINT_RENAME(usearch_getPattern)
+#define usearch_getText U_ICU_ENTRY_POINT_RENAME(usearch_getText)
+#define usearch_handleNextCanonical U_ICU_ENTRY_POINT_RENAME(usearch_handleNextCanonical)
+#define usearch_handleNextExact U_ICU_ENTRY_POINT_RENAME(usearch_handleNextExact)
+#define usearch_handlePreviousCanonical U_ICU_ENTRY_POINT_RENAME(usearch_handlePreviousCanonical)
+#define usearch_handlePreviousExact U_ICU_ENTRY_POINT_RENAME(usearch_handlePreviousExact)
+#define usearch_last U_ICU_ENTRY_POINT_RENAME(usearch_last)
+#define usearch_next U_ICU_ENTRY_POINT_RENAME(usearch_next)
+#define usearch_open U_ICU_ENTRY_POINT_RENAME(usearch_open)
+#define usearch_openFromCollator U_ICU_ENTRY_POINT_RENAME(usearch_openFromCollator)
+#define usearch_preceding U_ICU_ENTRY_POINT_RENAME(usearch_preceding)
+#define usearch_previous U_ICU_ENTRY_POINT_RENAME(usearch_previous)
+#define usearch_reset U_ICU_ENTRY_POINT_RENAME(usearch_reset)
+#define usearch_search U_ICU_ENTRY_POINT_RENAME(usearch_search)
+#define usearch_searchBackwards U_ICU_ENTRY_POINT_RENAME(usearch_searchBackwards)
+#define usearch_setAttribute U_ICU_ENTRY_POINT_RENAME(usearch_setAttribute)
+#define usearch_setBreakIterator U_ICU_ENTRY_POINT_RENAME(usearch_setBreakIterator)
+#define usearch_setCollator U_ICU_ENTRY_POINT_RENAME(usearch_setCollator)
+#define usearch_setOffset U_ICU_ENTRY_POINT_RENAME(usearch_setOffset)
+#define usearch_setPattern U_ICU_ENTRY_POINT_RENAME(usearch_setPattern)
+#define usearch_setText U_ICU_ENTRY_POINT_RENAME(usearch_setText)
+#define uset_add U_ICU_ENTRY_POINT_RENAME(uset_add)
+#define uset_addAll U_ICU_ENTRY_POINT_RENAME(uset_addAll)
+#define uset_addAllCodePoints U_ICU_ENTRY_POINT_RENAME(uset_addAllCodePoints)
+#define uset_addRange U_ICU_ENTRY_POINT_RENAME(uset_addRange)
+#define uset_addString U_ICU_ENTRY_POINT_RENAME(uset_addString)
+#define uset_applyIntPropertyValue U_ICU_ENTRY_POINT_RENAME(uset_applyIntPropertyValue)
+#define uset_applyPattern U_ICU_ENTRY_POINT_RENAME(uset_applyPattern)
+#define uset_applyPropertyAlias U_ICU_ENTRY_POINT_RENAME(uset_applyPropertyAlias)
+#define uset_charAt U_ICU_ENTRY_POINT_RENAME(uset_charAt)
+#define uset_clear U_ICU_ENTRY_POINT_RENAME(uset_clear)
+#define uset_clone U_ICU_ENTRY_POINT_RENAME(uset_clone)
+#define uset_cloneAsThawed U_ICU_ENTRY_POINT_RENAME(uset_cloneAsThawed)
+#define uset_close U_ICU_ENTRY_POINT_RENAME(uset_close)
+#define uset_closeOver U_ICU_ENTRY_POINT_RENAME(uset_closeOver)
+#define uset_compact U_ICU_ENTRY_POINT_RENAME(uset_compact)
+#define uset_complement U_ICU_ENTRY_POINT_RENAME(uset_complement)
+#define uset_complementAll U_ICU_ENTRY_POINT_RENAME(uset_complementAll)
+#define uset_contains U_ICU_ENTRY_POINT_RENAME(uset_contains)
+#define uset_containsAll U_ICU_ENTRY_POINT_RENAME(uset_containsAll)
+#define uset_containsAllCodePoints U_ICU_ENTRY_POINT_RENAME(uset_containsAllCodePoints)
+#define uset_containsNone U_ICU_ENTRY_POINT_RENAME(uset_containsNone)
+#define uset_containsRange U_ICU_ENTRY_POINT_RENAME(uset_containsRange)
+#define uset_containsSome U_ICU_ENTRY_POINT_RENAME(uset_containsSome)
+#define uset_containsString U_ICU_ENTRY_POINT_RENAME(uset_containsString)
+#define uset_equals U_ICU_ENTRY_POINT_RENAME(uset_equals)
+#define uset_freeze U_ICU_ENTRY_POINT_RENAME(uset_freeze)
+#define uset_getItem U_ICU_ENTRY_POINT_RENAME(uset_getItem)
+#define uset_getItemCount U_ICU_ENTRY_POINT_RENAME(uset_getItemCount)
+#define uset_getSerializedRange U_ICU_ENTRY_POINT_RENAME(uset_getSerializedRange)
+#define uset_getSerializedRangeCount U_ICU_ENTRY_POINT_RENAME(uset_getSerializedRangeCount)
+#define uset_getSerializedSet U_ICU_ENTRY_POINT_RENAME(uset_getSerializedSet)
+#define uset_indexOf U_ICU_ENTRY_POINT_RENAME(uset_indexOf)
+#define uset_isEmpty U_ICU_ENTRY_POINT_RENAME(uset_isEmpty)
+#define uset_isFrozen U_ICU_ENTRY_POINT_RENAME(uset_isFrozen)
+#define uset_open U_ICU_ENTRY_POINT_RENAME(uset_open)
+#define uset_openEmpty U_ICU_ENTRY_POINT_RENAME(uset_openEmpty)
+#define uset_openPattern U_ICU_ENTRY_POINT_RENAME(uset_openPattern)
+#define uset_openPatternOptions U_ICU_ENTRY_POINT_RENAME(uset_openPatternOptions)
+#define uset_remove U_ICU_ENTRY_POINT_RENAME(uset_remove)
+#define uset_removeAll U_ICU_ENTRY_POINT_RENAME(uset_removeAll)
+#define uset_removeAllStrings U_ICU_ENTRY_POINT_RENAME(uset_removeAllStrings)
+#define uset_removeRange U_ICU_ENTRY_POINT_RENAME(uset_removeRange)
+#define uset_removeString U_ICU_ENTRY_POINT_RENAME(uset_removeString)
+#define uset_resemblesPattern U_ICU_ENTRY_POINT_RENAME(uset_resemblesPattern)
+#define uset_retain U_ICU_ENTRY_POINT_RENAME(uset_retain)
+#define uset_retainAll U_ICU_ENTRY_POINT_RENAME(uset_retainAll)
+#define uset_serialize U_ICU_ENTRY_POINT_RENAME(uset_serialize)
+#define uset_serializedContains U_ICU_ENTRY_POINT_RENAME(uset_serializedContains)
+#define uset_set U_ICU_ENTRY_POINT_RENAME(uset_set)
+#define uset_setSerializedToOne U_ICU_ENTRY_POINT_RENAME(uset_setSerializedToOne)
+#define uset_size U_ICU_ENTRY_POINT_RENAME(uset_size)
+#define uset_span U_ICU_ENTRY_POINT_RENAME(uset_span)
+#define uset_spanBack U_ICU_ENTRY_POINT_RENAME(uset_spanBack)
+#define uset_spanBackUTF8 U_ICU_ENTRY_POINT_RENAME(uset_spanBackUTF8)
+#define uset_spanUTF8 U_ICU_ENTRY_POINT_RENAME(uset_spanUTF8)
+#define uset_toPattern U_ICU_ENTRY_POINT_RENAME(uset_toPattern)
+#define uspoof_areConfusable U_ICU_ENTRY_POINT_RENAME(uspoof_areConfusable)
+#define uspoof_areConfusableUTF8 U_ICU_ENTRY_POINT_RENAME(uspoof_areConfusableUTF8)
+#define uspoof_areConfusableUnicodeString U_ICU_ENTRY_POINT_RENAME(uspoof_areConfusableUnicodeString)
+#define uspoof_check U_ICU_ENTRY_POINT_RENAME(uspoof_check)
+#define uspoof_checkUTF8 U_ICU_ENTRY_POINT_RENAME(uspoof_checkUTF8)
+#define uspoof_checkUnicodeString U_ICU_ENTRY_POINT_RENAME(uspoof_checkUnicodeString)
+#define uspoof_clone U_ICU_ENTRY_POINT_RENAME(uspoof_clone)
+#define uspoof_close U_ICU_ENTRY_POINT_RENAME(uspoof_close)
+#define uspoof_getAllowedChars U_ICU_ENTRY_POINT_RENAME(uspoof_getAllowedChars)
+#define uspoof_getAllowedLocales U_ICU_ENTRY_POINT_RENAME(uspoof_getAllowedLocales)
+#define uspoof_getAllowedUnicodeSet U_ICU_ENTRY_POINT_RENAME(uspoof_getAllowedUnicodeSet)
+#define uspoof_getChecks U_ICU_ENTRY_POINT_RENAME(uspoof_getChecks)
+#define uspoof_getInclusionSet U_ICU_ENTRY_POINT_RENAME(uspoof_getInclusionSet)
+#define uspoof_getInclusionUnicodeSet U_ICU_ENTRY_POINT_RENAME(uspoof_getInclusionUnicodeSet)
+#define uspoof_getRecommendedSet U_ICU_ENTRY_POINT_RENAME(uspoof_getRecommendedSet)
+#define uspoof_getRecommendedUnicodeSet U_ICU_ENTRY_POINT_RENAME(uspoof_getRecommendedUnicodeSet)
+#define uspoof_getRestrictionLevel U_ICU_ENTRY_POINT_RENAME(uspoof_getRestrictionLevel)
+#define uspoof_getSkeleton U_ICU_ENTRY_POINT_RENAME(uspoof_getSkeleton)
+#define uspoof_getSkeletonUTF8 U_ICU_ENTRY_POINT_RENAME(uspoof_getSkeletonUTF8)
+#define uspoof_getSkeletonUnicodeString U_ICU_ENTRY_POINT_RENAME(uspoof_getSkeletonUnicodeString)
+#define uspoof_open U_ICU_ENTRY_POINT_RENAME(uspoof_open)
+#define uspoof_openFromSerialized U_ICU_ENTRY_POINT_RENAME(uspoof_openFromSerialized)
+#define uspoof_openFromSource U_ICU_ENTRY_POINT_RENAME(uspoof_openFromSource)
+#define uspoof_serialize U_ICU_ENTRY_POINT_RENAME(uspoof_serialize)
+#define uspoof_setAllowedChars U_ICU_ENTRY_POINT_RENAME(uspoof_setAllowedChars)
+#define uspoof_setAllowedLocales U_ICU_ENTRY_POINT_RENAME(uspoof_setAllowedLocales)
+#define uspoof_setAllowedUnicodeSet U_ICU_ENTRY_POINT_RENAME(uspoof_setAllowedUnicodeSet)
+#define uspoof_setChecks U_ICU_ENTRY_POINT_RENAME(uspoof_setChecks)
+#define uspoof_setRestrictionLevel U_ICU_ENTRY_POINT_RENAME(uspoof_setRestrictionLevel)
+#define uspoof_swap U_ICU_ENTRY_POINT_RENAME(uspoof_swap)
+#define usprep_close U_ICU_ENTRY_POINT_RENAME(usprep_close)
+#define usprep_open U_ICU_ENTRY_POINT_RENAME(usprep_open)
+#define usprep_openByType U_ICU_ENTRY_POINT_RENAME(usprep_openByType)
+#define usprep_prepare U_ICU_ENTRY_POINT_RENAME(usprep_prepare)
+#define usprep_swap U_ICU_ENTRY_POINT_RENAME(usprep_swap)
+#define ustr_hashCharsN U_ICU_ENTRY_POINT_RENAME(ustr_hashCharsN)
+#define ustr_hashICharsN U_ICU_ENTRY_POINT_RENAME(ustr_hashICharsN)
+#define ustr_hashUCharsN U_ICU_ENTRY_POINT_RENAME(ustr_hashUCharsN)
+#define ustrcase_internalFold U_ICU_ENTRY_POINT_RENAME(ustrcase_internalFold)
+#define ustrcase_internalToLower U_ICU_ENTRY_POINT_RENAME(ustrcase_internalToLower)
+#define ustrcase_internalToTitle U_ICU_ENTRY_POINT_RENAME(ustrcase_internalToTitle)
+#define ustrcase_internalToUpper U_ICU_ENTRY_POINT_RENAME(ustrcase_internalToUpper)
+#define ustrcase_map U_ICU_ENTRY_POINT_RENAME(ustrcase_map)
+#define ustrcase_setTempCaseMapLocale U_ICU_ENTRY_POINT_RENAME(ustrcase_setTempCaseMapLocale)
+#define utext_char32At U_ICU_ENTRY_POINT_RENAME(utext_char32At)
+#define utext_clone U_ICU_ENTRY_POINT_RENAME(utext_clone)
+#define utext_close U_ICU_ENTRY_POINT_RENAME(utext_close)
+#define utext_copy U_ICU_ENTRY_POINT_RENAME(utext_copy)
+#define utext_current32 U_ICU_ENTRY_POINT_RENAME(utext_current32)
+#define utext_equals U_ICU_ENTRY_POINT_RENAME(utext_equals)
+#define utext_extract U_ICU_ENTRY_POINT_RENAME(utext_extract)
+#define utext_freeze U_ICU_ENTRY_POINT_RENAME(utext_freeze)
+#define utext_getNativeIndex U_ICU_ENTRY_POINT_RENAME(utext_getNativeIndex)
+#define utext_getPreviousNativeIndex U_ICU_ENTRY_POINT_RENAME(utext_getPreviousNativeIndex)
+#define utext_hasMetaData U_ICU_ENTRY_POINT_RENAME(utext_hasMetaData)
+#define utext_isLengthExpensive U_ICU_ENTRY_POINT_RENAME(utext_isLengthExpensive)
+#define utext_isWritable U_ICU_ENTRY_POINT_RENAME(utext_isWritable)
+#define utext_moveIndex32 U_ICU_ENTRY_POINT_RENAME(utext_moveIndex32)
+#define utext_nativeLength U_ICU_ENTRY_POINT_RENAME(utext_nativeLength)
+#define utext_next32 U_ICU_ENTRY_POINT_RENAME(utext_next32)
+#define utext_next32From U_ICU_ENTRY_POINT_RENAME(utext_next32From)
+#define utext_openCharacterIterator U_ICU_ENTRY_POINT_RENAME(utext_openCharacterIterator)
+#define utext_openConstUnicodeString U_ICU_ENTRY_POINT_RENAME(utext_openConstUnicodeString)
+#define utext_openReplaceable U_ICU_ENTRY_POINT_RENAME(utext_openReplaceable)
+#define utext_openUChars U_ICU_ENTRY_POINT_RENAME(utext_openUChars)
+#define utext_openUTF8 U_ICU_ENTRY_POINT_RENAME(utext_openUTF8)
+#define utext_openUnicodeString U_ICU_ENTRY_POINT_RENAME(utext_openUnicodeString)
+#define utext_previous32 U_ICU_ENTRY_POINT_RENAME(utext_previous32)
+#define utext_previous32From U_ICU_ENTRY_POINT_RENAME(utext_previous32From)
+#define utext_replace U_ICU_ENTRY_POINT_RENAME(utext_replace)
+#define utext_setNativeIndex U_ICU_ENTRY_POINT_RENAME(utext_setNativeIndex)
+#define utext_setup U_ICU_ENTRY_POINT_RENAME(utext_setup)
+#define utf8_appendCharSafeBody U_ICU_ENTRY_POINT_RENAME(utf8_appendCharSafeBody)
+#define utf8_back1SafeBody U_ICU_ENTRY_POINT_RENAME(utf8_back1SafeBody)
+#define utf8_countTrailBytes U_ICU_ENTRY_POINT_RENAME(utf8_countTrailBytes)
+#define utf8_nextCharSafeBody U_ICU_ENTRY_POINT_RENAME(utf8_nextCharSafeBody)
+#define utf8_prevCharSafeBody U_ICU_ENTRY_POINT_RENAME(utf8_prevCharSafeBody)
+#define utmscale_fromInt64 U_ICU_ENTRY_POINT_RENAME(utmscale_fromInt64)
+#define utmscale_getTimeScaleValue U_ICU_ENTRY_POINT_RENAME(utmscale_getTimeScaleValue)
+#define utmscale_toInt64 U_ICU_ENTRY_POINT_RENAME(utmscale_toInt64)
+#define utrace_cleanup U_ICU_ENTRY_POINT_RENAME(utrace_cleanup)
+#define utrace_data U_ICU_ENTRY_POINT_RENAME(utrace_data)
+#define utrace_entry U_ICU_ENTRY_POINT_RENAME(utrace_entry)
+#define utrace_exit U_ICU_ENTRY_POINT_RENAME(utrace_exit)
+#define utrace_format U_ICU_ENTRY_POINT_RENAME(utrace_format)
+#define utrace_functionName U_ICU_ENTRY_POINT_RENAME(utrace_functionName)
+#define utrace_getFunctions U_ICU_ENTRY_POINT_RENAME(utrace_getFunctions)
+#define utrace_getLevel U_ICU_ENTRY_POINT_RENAME(utrace_getLevel)
+#define utrace_level U_ICU_ENTRY_POINT_RENAME(utrace_level)
+#define utrace_setFunctions U_ICU_ENTRY_POINT_RENAME(utrace_setFunctions)
+#define utrace_setLevel U_ICU_ENTRY_POINT_RENAME(utrace_setLevel)
+#define utrace_vformat U_ICU_ENTRY_POINT_RENAME(utrace_vformat)
+#define utrans_clone U_ICU_ENTRY_POINT_RENAME(utrans_clone)
+#define utrans_close U_ICU_ENTRY_POINT_RENAME(utrans_close)
+#define utrans_countAvailableIDs U_ICU_ENTRY_POINT_RENAME(utrans_countAvailableIDs)
+#define utrans_getAvailableID U_ICU_ENTRY_POINT_RENAME(utrans_getAvailableID)
+#define utrans_getID U_ICU_ENTRY_POINT_RENAME(utrans_getID)
+#define utrans_getUnicodeID U_ICU_ENTRY_POINT_RENAME(utrans_getUnicodeID)
+#define utrans_open U_ICU_ENTRY_POINT_RENAME(utrans_open)
+#define utrans_openIDs U_ICU_ENTRY_POINT_RENAME(utrans_openIDs)
+#define utrans_openInverse U_ICU_ENTRY_POINT_RENAME(utrans_openInverse)
+#define utrans_openU U_ICU_ENTRY_POINT_RENAME(utrans_openU)
+#define utrans_register U_ICU_ENTRY_POINT_RENAME(utrans_register)
+#define utrans_rep_caseContextIterator U_ICU_ENTRY_POINT_RENAME(utrans_rep_caseContextIterator)
+#define utrans_setFilter U_ICU_ENTRY_POINT_RENAME(utrans_setFilter)
+#define utrans_stripRules U_ICU_ENTRY_POINT_RENAME(utrans_stripRules)
+#define utrans_trans U_ICU_ENTRY_POINT_RENAME(utrans_trans)
+#define utrans_transIncremental U_ICU_ENTRY_POINT_RENAME(utrans_transIncremental)
+#define utrans_transIncrementalUChars U_ICU_ENTRY_POINT_RENAME(utrans_transIncrementalUChars)
+#define utrans_transUChars U_ICU_ENTRY_POINT_RENAME(utrans_transUChars)
+#define utrans_transliterator_cleanup U_ICU_ENTRY_POINT_RENAME(utrans_transliterator_cleanup)
+#define utrans_unregister U_ICU_ENTRY_POINT_RENAME(utrans_unregister)
+#define utrans_unregisterID U_ICU_ENTRY_POINT_RENAME(utrans_unregisterID)
+#define utrie2_clone U_ICU_ENTRY_POINT_RENAME(utrie2_clone)
+#define utrie2_cloneAsThawed U_ICU_ENTRY_POINT_RENAME(utrie2_cloneAsThawed)
+#define utrie2_close U_ICU_ENTRY_POINT_RENAME(utrie2_close)
+#define utrie2_enum U_ICU_ENTRY_POINT_RENAME(utrie2_enum)
+#define utrie2_enumForLeadSurrogate U_ICU_ENTRY_POINT_RENAME(utrie2_enumForLeadSurrogate)
+#define utrie2_freeze U_ICU_ENTRY_POINT_RENAME(utrie2_freeze)
+#define utrie2_fromUTrie U_ICU_ENTRY_POINT_RENAME(utrie2_fromUTrie)
+#define utrie2_get32 U_ICU_ENTRY_POINT_RENAME(utrie2_get32)
+#define utrie2_get32FromLeadSurrogateCodeUnit U_ICU_ENTRY_POINT_RENAME(utrie2_get32FromLeadSurrogateCodeUnit)
+#define utrie2_getVersion U_ICU_ENTRY_POINT_RENAME(utrie2_getVersion)
+#define utrie2_internalU8NextIndex U_ICU_ENTRY_POINT_RENAME(utrie2_internalU8NextIndex)
+#define utrie2_internalU8PrevIndex U_ICU_ENTRY_POINT_RENAME(utrie2_internalU8PrevIndex)
+#define utrie2_isFrozen U_ICU_ENTRY_POINT_RENAME(utrie2_isFrozen)
+#define utrie2_open U_ICU_ENTRY_POINT_RENAME(utrie2_open)
+#define utrie2_openDummy U_ICU_ENTRY_POINT_RENAME(utrie2_openDummy)
+#define utrie2_openFromSerialized U_ICU_ENTRY_POINT_RENAME(utrie2_openFromSerialized)
+#define utrie2_serialize U_ICU_ENTRY_POINT_RENAME(utrie2_serialize)
+#define utrie2_set32 U_ICU_ENTRY_POINT_RENAME(utrie2_set32)
+#define utrie2_set32ForLeadSurrogateCodeUnit U_ICU_ENTRY_POINT_RENAME(utrie2_set32ForLeadSurrogateCodeUnit)
+#define utrie2_setRange32 U_ICU_ENTRY_POINT_RENAME(utrie2_setRange32)
+#define utrie2_swap U_ICU_ENTRY_POINT_RENAME(utrie2_swap)
+#define utrie2_swapAnyVersion U_ICU_ENTRY_POINT_RENAME(utrie2_swapAnyVersion)
+#define utrie_clone U_ICU_ENTRY_POINT_RENAME(utrie_clone)
+#define utrie_close U_ICU_ENTRY_POINT_RENAME(utrie_close)
+#define utrie_defaultGetFoldingOffset U_ICU_ENTRY_POINT_RENAME(utrie_defaultGetFoldingOffset)
+#define utrie_enum U_ICU_ENTRY_POINT_RENAME(utrie_enum)
+#define utrie_get32 U_ICU_ENTRY_POINT_RENAME(utrie_get32)
+#define utrie_getData U_ICU_ENTRY_POINT_RENAME(utrie_getData)
+#define utrie_open U_ICU_ENTRY_POINT_RENAME(utrie_open)
+#define utrie_serialize U_ICU_ENTRY_POINT_RENAME(utrie_serialize)
+#define utrie_set32 U_ICU_ENTRY_POINT_RENAME(utrie_set32)
+#define utrie_setRange32 U_ICU_ENTRY_POINT_RENAME(utrie_setRange32)
+#define utrie_swap U_ICU_ENTRY_POINT_RENAME(utrie_swap)
+#define utrie_unserialize U_ICU_ENTRY_POINT_RENAME(utrie_unserialize)
+#define utrie_unserializeDummy U_ICU_ENTRY_POINT_RENAME(utrie_unserializeDummy)
+#define vzone_clone U_ICU_ENTRY_POINT_RENAME(vzone_clone)
+#define vzone_close U_ICU_ENTRY_POINT_RENAME(vzone_close)
+#define vzone_countTransitionRules U_ICU_ENTRY_POINT_RENAME(vzone_countTransitionRules)
+#define vzone_equals U_ICU_ENTRY_POINT_RENAME(vzone_equals)
+#define vzone_getDynamicClassID U_ICU_ENTRY_POINT_RENAME(vzone_getDynamicClassID)
+#define vzone_getLastModified U_ICU_ENTRY_POINT_RENAME(vzone_getLastModified)
+#define vzone_getNextTransition U_ICU_ENTRY_POINT_RENAME(vzone_getNextTransition)
+#define vzone_getOffset U_ICU_ENTRY_POINT_RENAME(vzone_getOffset)
+#define vzone_getOffset2 U_ICU_ENTRY_POINT_RENAME(vzone_getOffset2)
+#define vzone_getOffset3 U_ICU_ENTRY_POINT_RENAME(vzone_getOffset3)
+#define vzone_getPreviousTransition U_ICU_ENTRY_POINT_RENAME(vzone_getPreviousTransition)
+#define vzone_getRawOffset U_ICU_ENTRY_POINT_RENAME(vzone_getRawOffset)
+#define vzone_getStaticClassID U_ICU_ENTRY_POINT_RENAME(vzone_getStaticClassID)
+#define vzone_getTZURL U_ICU_ENTRY_POINT_RENAME(vzone_getTZURL)
+#define vzone_hasSameRules U_ICU_ENTRY_POINT_RENAME(vzone_hasSameRules)
+#define vzone_inDaylightTime U_ICU_ENTRY_POINT_RENAME(vzone_inDaylightTime)
+#define vzone_openData U_ICU_ENTRY_POINT_RENAME(vzone_openData)
+#define vzone_openID U_ICU_ENTRY_POINT_RENAME(vzone_openID)
+#define vzone_setLastModified U_ICU_ENTRY_POINT_RENAME(vzone_setLastModified)
+#define vzone_setRawOffset U_ICU_ENTRY_POINT_RENAME(vzone_setRawOffset)
+#define vzone_setTZURL U_ICU_ENTRY_POINT_RENAME(vzone_setTZURL)
+#define vzone_useDaylightTime U_ICU_ENTRY_POINT_RENAME(vzone_useDaylightTime)
+#define vzone_write U_ICU_ENTRY_POINT_RENAME(vzone_write)
+#define vzone_writeFromStart U_ICU_ENTRY_POINT_RENAME(vzone_writeFromStart)
+#define vzone_writeSimple U_ICU_ENTRY_POINT_RENAME(vzone_writeSimple)
+#define zrule_close U_ICU_ENTRY_POINT_RENAME(zrule_close)
+#define zrule_equals U_ICU_ENTRY_POINT_RENAME(zrule_equals)
+#define zrule_getDSTSavings U_ICU_ENTRY_POINT_RENAME(zrule_getDSTSavings)
+#define zrule_getName U_ICU_ENTRY_POINT_RENAME(zrule_getName)
+#define zrule_getRawOffset U_ICU_ENTRY_POINT_RENAME(zrule_getRawOffset)
+#define zrule_isEquivalentTo U_ICU_ENTRY_POINT_RENAME(zrule_isEquivalentTo)
+#define ztrans_adoptFrom U_ICU_ENTRY_POINT_RENAME(ztrans_adoptFrom)
+#define ztrans_adoptTo U_ICU_ENTRY_POINT_RENAME(ztrans_adoptTo)
+#define ztrans_clone U_ICU_ENTRY_POINT_RENAME(ztrans_clone)
+#define ztrans_close U_ICU_ENTRY_POINT_RENAME(ztrans_close)
+#define ztrans_equals U_ICU_ENTRY_POINT_RENAME(ztrans_equals)
+#define ztrans_getDynamicClassID U_ICU_ENTRY_POINT_RENAME(ztrans_getDynamicClassID)
+#define ztrans_getFrom U_ICU_ENTRY_POINT_RENAME(ztrans_getFrom)
+#define ztrans_getStaticClassID U_ICU_ENTRY_POINT_RENAME(ztrans_getStaticClassID)
+#define ztrans_getTime U_ICU_ENTRY_POINT_RENAME(ztrans_getTime)
+#define ztrans_getTo U_ICU_ENTRY_POINT_RENAME(ztrans_getTo)
+#define ztrans_open U_ICU_ENTRY_POINT_RENAME(ztrans_open)
+#define ztrans_openEmpty U_ICU_ENTRY_POINT_RENAME(ztrans_openEmpty)
+#define ztrans_setFrom U_ICU_ENTRY_POINT_RENAME(ztrans_setFrom)
+#define ztrans_setTime U_ICU_ENTRY_POINT_RENAME(ztrans_setTime)
+#define ztrans_setTo U_ICU_ENTRY_POINT_RENAME(ztrans_setTo)
+
+#endif
+
+#endif
diff --git a/icu/unicode/uscript.h b/icu/unicode/uscript.h
new file mode 100644
index 0000000..57255c4
--- /dev/null
+++ b/icu/unicode/uscript.h
@@ -0,0 +1,627 @@
+/*
+ **********************************************************************
+ *   Copyright (C) 1997-2013, International Business Machines
+ *   Corporation and others.  All Rights Reserved.
+ **********************************************************************
+ *
+ * File USCRIPT.H
+ *
+ * Modification History:
+ *
+ *   Date        Name        Description
+ *   07/06/2001    Ram         Creation.
+ ******************************************************************************
+ */
+
+#ifndef USCRIPT_H
+#define USCRIPT_H
+#include "unicode/utypes.h"
+
+/**
+ * \file
+ * \brief C API: Unicode Script Information
+ */
+ 
+/**
+ * Constants for ISO 15924 script codes.
+ *
+ * Many of these script codes - those from Unicode's ScriptNames.txt -
+ * are character property values for Unicode's Script property.
+ * See UAX #24 Script Names (http://www.unicode.org/reports/tr24/).
+ *
+ * Starting with ICU 3.6, constants for most ISO 15924 script codes
+ * are included (currently excluding private-use codes Qaaa..Qabx).
+ * For scripts for which there are codes in ISO 15924 but which are not
+ * used in the Unicode Character Database (UCD), there are no Unicode characters
+ * associated with those scripts.
+ *
+ * For example, there are no characters that have a UCD script code of
+ * Hans or Hant. All Han ideographs have the Hani script code.
+ * The Hans and Hant script codes are used with CLDR data.
+ *
+ * ISO 15924 script codes are included for use with CLDR and similar.
+ *
+ * @stable ICU 2.2
+ */
+typedef enum UScriptCode {
+    /*
+     * Note: UScriptCode constants and their ISO script code comments
+     * are parsed by preparseucd.py.
+     * It matches lines like
+     *     USCRIPT_<Unicode Script value name> = <integer>,  / * <ISO script code> * /
+     */
+
+      /** @stable ICU 2.2 */
+      USCRIPT_INVALID_CODE = -1,
+      /** @stable ICU 2.2 */
+      USCRIPT_COMMON       =  0,  /* Zyyy */
+      /** @stable ICU 2.2 */
+      USCRIPT_INHERITED    =  1,  /* Zinh */ /* "Code for inherited script", for non-spacing combining marks; also Qaai */
+      /** @stable ICU 2.2 */
+      USCRIPT_ARABIC       =  2,  /* Arab */
+      /** @stable ICU 2.2 */
+      USCRIPT_ARMENIAN     =  3,  /* Armn */
+      /** @stable ICU 2.2 */
+      USCRIPT_BENGALI      =  4,  /* Beng */
+      /** @stable ICU 2.2 */
+      USCRIPT_BOPOMOFO     =  5,  /* Bopo */
+      /** @stable ICU 2.2 */
+      USCRIPT_CHEROKEE     =  6,  /* Cher */
+      /** @stable ICU 2.2 */
+      USCRIPT_COPTIC       =  7,  /* Copt */
+      /** @stable ICU 2.2 */
+      USCRIPT_CYRILLIC     =  8,  /* Cyrl */
+      /** @stable ICU 2.2 */
+      USCRIPT_DESERET      =  9,  /* Dsrt */
+      /** @stable ICU 2.2 */
+      USCRIPT_DEVANAGARI   = 10,  /* Deva */
+      /** @stable ICU 2.2 */
+      USCRIPT_ETHIOPIC     = 11,  /* Ethi */
+      /** @stable ICU 2.2 */
+      USCRIPT_GEORGIAN     = 12,  /* Geor */
+      /** @stable ICU 2.2 */
+      USCRIPT_GOTHIC       = 13,  /* Goth */
+      /** @stable ICU 2.2 */
+      USCRIPT_GREEK        = 14,  /* Grek */
+      /** @stable ICU 2.2 */
+      USCRIPT_GUJARATI     = 15,  /* Gujr */
+      /** @stable ICU 2.2 */
+      USCRIPT_GURMUKHI     = 16,  /* Guru */
+      /** @stable ICU 2.2 */
+      USCRIPT_HAN          = 17,  /* Hani */
+      /** @stable ICU 2.2 */
+      USCRIPT_HANGUL       = 18,  /* Hang */
+      /** @stable ICU 2.2 */
+      USCRIPT_HEBREW       = 19,  /* Hebr */
+      /** @stable ICU 2.2 */
+      USCRIPT_HIRAGANA     = 20,  /* Hira */
+      /** @stable ICU 2.2 */
+      USCRIPT_KANNADA      = 21,  /* Knda */
+      /** @stable ICU 2.2 */
+      USCRIPT_KATAKANA     = 22,  /* Kana */
+      /** @stable ICU 2.2 */
+      USCRIPT_KHMER        = 23,  /* Khmr */
+      /** @stable ICU 2.2 */
+      USCRIPT_LAO          = 24,  /* Laoo */
+      /** @stable ICU 2.2 */
+      USCRIPT_LATIN        = 25,  /* Latn */
+      /** @stable ICU 2.2 */
+      USCRIPT_MALAYALAM    = 26,  /* Mlym */
+      /** @stable ICU 2.2 */
+      USCRIPT_MONGOLIAN    = 27,  /* Mong */
+      /** @stable ICU 2.2 */
+      USCRIPT_MYANMAR      = 28,  /* Mymr */
+      /** @stable ICU 2.2 */
+      USCRIPT_OGHAM        = 29,  /* Ogam */
+      /** @stable ICU 2.2 */
+      USCRIPT_OLD_ITALIC   = 30,  /* Ital */
+      /** @stable ICU 2.2 */
+      USCRIPT_ORIYA        = 31,  /* Orya */
+      /** @stable ICU 2.2 */
+      USCRIPT_RUNIC        = 32,  /* Runr */
+      /** @stable ICU 2.2 */
+      USCRIPT_SINHALA      = 33,  /* Sinh */
+      /** @stable ICU 2.2 */
+      USCRIPT_SYRIAC       = 34,  /* Syrc */
+      /** @stable ICU 2.2 */
+      USCRIPT_TAMIL        = 35,  /* Taml */
+      /** @stable ICU 2.2 */
+      USCRIPT_TELUGU       = 36,  /* Telu */
+      /** @stable ICU 2.2 */
+      USCRIPT_THAANA       = 37,  /* Thaa */
+      /** @stable ICU 2.2 */
+      USCRIPT_THAI         = 38,  /* Thai */
+      /** @stable ICU 2.2 */
+      USCRIPT_TIBETAN      = 39,  /* Tibt */
+      /** Canadian_Aboriginal script. @stable ICU 2.6 */
+      USCRIPT_CANADIAN_ABORIGINAL = 40,  /* Cans */
+      /** Canadian_Aboriginal script (alias). @stable ICU 2.2 */
+      USCRIPT_UCAS         = USCRIPT_CANADIAN_ABORIGINAL,
+      /** @stable ICU 2.2 */
+      USCRIPT_YI           = 41,  /* Yiii */
+      /* New scripts in Unicode 3.2 */
+      /** @stable ICU 2.2 */
+      USCRIPT_TAGALOG      = 42,  /* Tglg */
+      /** @stable ICU 2.2 */
+      USCRIPT_HANUNOO      = 43,  /* Hano */
+      /** @stable ICU 2.2 */
+      USCRIPT_BUHID        = 44,  /* Buhd */
+      /** @stable ICU 2.2 */
+      USCRIPT_TAGBANWA     = 45,  /* Tagb */
+
+      /* New scripts in Unicode 4 */
+      /** @stable ICU 2.6 */
+      USCRIPT_BRAILLE      = 46,  /* Brai */
+      /** @stable ICU 2.6 */
+      USCRIPT_CYPRIOT      = 47,  /* Cprt */
+      /** @stable ICU 2.6 */
+      USCRIPT_LIMBU        = 48,  /* Limb */
+      /** @stable ICU 2.6 */
+      USCRIPT_LINEAR_B     = 49,  /* Linb */
+      /** @stable ICU 2.6 */
+      USCRIPT_OSMANYA      = 50,  /* Osma */
+      /** @stable ICU 2.6 */
+      USCRIPT_SHAVIAN      = 51,  /* Shaw */
+      /** @stable ICU 2.6 */
+      USCRIPT_TAI_LE       = 52,  /* Tale */
+      /** @stable ICU 2.6 */
+      USCRIPT_UGARITIC     = 53,  /* Ugar */
+
+      /** New script code in Unicode 4.0.1 @stable ICU 3.0 */
+      USCRIPT_KATAKANA_OR_HIRAGANA = 54,/*Hrkt */
+
+      /* New scripts in Unicode 4.1 */
+      /** @stable ICU 3.4 */
+      USCRIPT_BUGINESE      = 55, /* Bugi */
+      /** @stable ICU 3.4 */
+      USCRIPT_GLAGOLITIC    = 56, /* Glag */
+      /** @stable ICU 3.4 */
+      USCRIPT_KHAROSHTHI    = 57, /* Khar */
+      /** @stable ICU 3.4 */
+      USCRIPT_SYLOTI_NAGRI  = 58, /* Sylo */
+      /** @stable ICU 3.4 */
+      USCRIPT_NEW_TAI_LUE   = 59, /* Talu */
+      /** @stable ICU 3.4 */
+      USCRIPT_TIFINAGH      = 60, /* Tfng */
+      /** @stable ICU 3.4 */
+      USCRIPT_OLD_PERSIAN   = 61, /* Xpeo */
+
+      /* New script codes from ISO 15924 */
+      /** @stable ICU 3.6 */
+      USCRIPT_BALINESE                      = 62, /* Bali */
+      /** @stable ICU 3.6 */
+      USCRIPT_BATAK                         = 63, /* Batk */
+      /** @stable ICU 3.6 */
+      USCRIPT_BLISSYMBOLS                   = 64, /* Blis */
+      /** @stable ICU 3.6 */
+      USCRIPT_BRAHMI                        = 65, /* Brah */
+      /** @stable ICU 3.6 */
+      USCRIPT_CHAM                          = 66, /* Cham */
+      /** @stable ICU 3.6 */
+      USCRIPT_CIRTH                         = 67, /* Cirt */
+      /** @stable ICU 3.6 */
+      USCRIPT_OLD_CHURCH_SLAVONIC_CYRILLIC  = 68, /* Cyrs */
+      /** @stable ICU 3.6 */
+      USCRIPT_DEMOTIC_EGYPTIAN              = 69, /* Egyd */
+      /** @stable ICU 3.6 */
+      USCRIPT_HIERATIC_EGYPTIAN             = 70, /* Egyh */
+      /** @stable ICU 3.6 */
+      USCRIPT_EGYPTIAN_HIEROGLYPHS          = 71, /* Egyp */
+      /** @stable ICU 3.6 */
+      USCRIPT_KHUTSURI                      = 72, /* Geok */
+      /** @stable ICU 3.6 */
+      USCRIPT_SIMPLIFIED_HAN                = 73, /* Hans */
+      /** @stable ICU 3.6 */
+      USCRIPT_TRADITIONAL_HAN               = 74, /* Hant */
+      /** @stable ICU 3.6 */
+      USCRIPT_PAHAWH_HMONG                  = 75, /* Hmng */
+      /** @stable ICU 3.6 */
+      USCRIPT_OLD_HUNGARIAN                 = 76, /* Hung */
+      /** @stable ICU 3.6 */
+      USCRIPT_HARAPPAN_INDUS                = 77, /* Inds */
+      /** @stable ICU 3.6 */
+      USCRIPT_JAVANESE                      = 78, /* Java */
+      /** @stable ICU 3.6 */
+      USCRIPT_KAYAH_LI                      = 79, /* Kali */
+      /** @stable ICU 3.6 */
+      USCRIPT_LATIN_FRAKTUR                 = 80, /* Latf */
+      /** @stable ICU 3.6 */
+      USCRIPT_LATIN_GAELIC                  = 81, /* Latg */
+      /** @stable ICU 3.6 */
+      USCRIPT_LEPCHA                        = 82, /* Lepc */
+      /** @stable ICU 3.6 */
+      USCRIPT_LINEAR_A                      = 83, /* Lina */
+      /** @stable ICU 4.6 */
+      USCRIPT_MANDAIC                       = 84, /* Mand */
+      /** @stable ICU 3.6 */
+      USCRIPT_MANDAEAN                      = USCRIPT_MANDAIC,
+      /** @stable ICU 3.6 */
+      USCRIPT_MAYAN_HIEROGLYPHS             = 85, /* Maya */
+      /** @stable ICU 4.6 */
+      USCRIPT_MEROITIC_HIEROGLYPHS          = 86, /* Mero */
+      /** @stable ICU 3.6 */
+      USCRIPT_MEROITIC                      = USCRIPT_MEROITIC_HIEROGLYPHS,
+      /** @stable ICU 3.6 */
+      USCRIPT_NKO                           = 87, /* Nkoo */
+      /** @stable ICU 3.6 */
+      USCRIPT_ORKHON                        = 88, /* Orkh */
+      /** @stable ICU 3.6 */
+      USCRIPT_OLD_PERMIC                    = 89, /* Perm */
+      /** @stable ICU 3.6 */
+      USCRIPT_PHAGS_PA                      = 90, /* Phag */
+      /** @stable ICU 3.6 */
+      USCRIPT_PHOENICIAN                    = 91, /* Phnx */
+      /** @stable ICU 52 */
+      USCRIPT_MIAO                          = 92, /* Plrd */
+      /** @stable ICU 3.6 */
+      USCRIPT_PHONETIC_POLLARD              = USCRIPT_MIAO,
+      /** @stable ICU 3.6 */
+      USCRIPT_RONGORONGO                    = 93, /* Roro */
+      /** @stable ICU 3.6 */
+      USCRIPT_SARATI                        = 94, /* Sara */
+      /** @stable ICU 3.6 */
+      USCRIPT_ESTRANGELO_SYRIAC             = 95, /* Syre */
+      /** @stable ICU 3.6 */
+      USCRIPT_WESTERN_SYRIAC                = 96, /* Syrj */
+      /** @stable ICU 3.6 */
+      USCRIPT_EASTERN_SYRIAC                = 97, /* Syrn */
+      /** @stable ICU 3.6 */
+      USCRIPT_TENGWAR                       = 98, /* Teng */
+      /** @stable ICU 3.6 */
+      USCRIPT_VAI                           = 99, /* Vaii */
+      /** @stable ICU 3.6 */
+      USCRIPT_VISIBLE_SPEECH                = 100,/* Visp */
+      /** @stable ICU 3.6 */
+      USCRIPT_CUNEIFORM                     = 101,/* Xsux */
+      /** @stable ICU 3.6 */
+      USCRIPT_UNWRITTEN_LANGUAGES           = 102,/* Zxxx */
+      /** @stable ICU 3.6 */
+      USCRIPT_UNKNOWN                       = 103,/* Zzzz */ /* Unknown="Code for uncoded script", for unassigned code points */
+
+      /* New script codes from ISO 15924 */
+      /** @stable ICU 3.8 */
+      USCRIPT_CARIAN                        = 104,/* Cari */
+      /** @stable ICU 3.8 */
+      USCRIPT_JAPANESE                      = 105,/* Jpan */
+      /** @stable ICU 3.8 */
+      USCRIPT_LANNA                         = 106,/* Lana */
+      /** @stable ICU 3.8 */
+      USCRIPT_LYCIAN                        = 107,/* Lyci */
+      /** @stable ICU 3.8 */
+      USCRIPT_LYDIAN                        = 108,/* Lydi */
+      /** @stable ICU 3.8 */
+      USCRIPT_OL_CHIKI                      = 109,/* Olck */
+      /** @stable ICU 3.8 */
+      USCRIPT_REJANG                        = 110,/* Rjng */
+      /** @stable ICU 3.8 */
+      USCRIPT_SAURASHTRA                    = 111,/* Saur */
+      /** @stable ICU 3.8 */
+      USCRIPT_SIGN_WRITING                  = 112,/* Sgnw */
+      /** @stable ICU 3.8 */
+      USCRIPT_SUNDANESE                     = 113,/* Sund */
+      /** @stable ICU 3.8 */
+      USCRIPT_MOON                          = 114,/* Moon */
+      /** @stable ICU 3.8 */
+      USCRIPT_MEITEI_MAYEK                  = 115,/* Mtei */
+
+      /* New script codes from ISO 15924 */
+      /** @stable ICU 4.0 */
+      USCRIPT_IMPERIAL_ARAMAIC              = 116,/* Armi */
+      /** @stable ICU 4.0 */
+      USCRIPT_AVESTAN                       = 117,/* Avst */
+      /** @stable ICU 4.0 */
+      USCRIPT_CHAKMA                        = 118,/* Cakm */
+      /** @stable ICU 4.0 */
+      USCRIPT_KOREAN                        = 119,/* Kore */
+      /** @stable ICU 4.0 */
+      USCRIPT_KAITHI                        = 120,/* Kthi */
+      /** @stable ICU 4.0 */
+      USCRIPT_MANICHAEAN                    = 121,/* Mani */
+      /** @stable ICU 4.0 */
+      USCRIPT_INSCRIPTIONAL_PAHLAVI         = 122,/* Phli */
+      /** @stable ICU 4.0 */
+      USCRIPT_PSALTER_PAHLAVI               = 123,/* Phlp */
+      /** @stable ICU 4.0 */
+      USCRIPT_BOOK_PAHLAVI                  = 124,/* Phlv */
+      /** @stable ICU 4.0 */
+      USCRIPT_INSCRIPTIONAL_PARTHIAN        = 125,/* Prti */
+      /** @stable ICU 4.0 */
+      USCRIPT_SAMARITAN                     = 126,/* Samr */
+      /** @stable ICU 4.0 */
+      USCRIPT_TAI_VIET                      = 127,/* Tavt */
+      /** @stable ICU 4.0 */
+      USCRIPT_MATHEMATICAL_NOTATION         = 128,/* Zmth */
+      /** @stable ICU 4.0 */
+      USCRIPT_SYMBOLS                       = 129,/* Zsym */
+
+      /* New script codes from ISO 15924 */
+      /** @stable ICU 4.4 */
+      USCRIPT_BAMUM                         = 130,/* Bamu */
+      /** @stable ICU 4.4 */
+      USCRIPT_LISU                          = 131,/* Lisu */
+      /** @stable ICU 4.4 */
+      USCRIPT_NAKHI_GEBA                    = 132,/* Nkgb */
+      /** @stable ICU 4.4 */
+      USCRIPT_OLD_SOUTH_ARABIAN             = 133,/* Sarb */
+
+      /* New script codes from ISO 15924 */
+      /** @stable ICU 4.6 */
+      USCRIPT_BASSA_VAH                     = 134,/* Bass */
+      /** @stable ICU 4.6 */
+      USCRIPT_DUPLOYAN_SHORTAND             = 135,/* Dupl */
+      /** @stable ICU 4.6 */
+      USCRIPT_ELBASAN                       = 136,/* Elba */
+      /** @stable ICU 4.6 */
+      USCRIPT_GRANTHA                       = 137,/* Gran */
+      /** @stable ICU 4.6 */
+      USCRIPT_KPELLE                        = 138,/* Kpel */
+      /** @stable ICU 4.6 */
+      USCRIPT_LOMA                          = 139,/* Loma */
+      /** @stable ICU 4.6 */
+      USCRIPT_MENDE                         = 140,/* Mend */
+      /** @stable ICU 4.6 */
+      USCRIPT_MEROITIC_CURSIVE              = 141,/* Merc */
+      /** @stable ICU 4.6 */
+      USCRIPT_OLD_NORTH_ARABIAN             = 142,/* Narb */
+      /** @stable ICU 4.6 */
+      USCRIPT_NABATAEAN                     = 143,/* Nbat */
+      /** @stable ICU 4.6 */
+      USCRIPT_PALMYRENE                     = 144,/* Palm */
+      /** @stable ICU 4.6 */
+      USCRIPT_SINDHI                        = 145,/* Sind */
+      /** @stable ICU 4.6 */
+      USCRIPT_WARANG_CITI                   = 146,/* Wara */
+
+      /** @stable ICU 4.8 */
+      USCRIPT_AFAKA                         = 147,/* Afak */
+      /** @stable ICU 4.8 */
+      USCRIPT_JURCHEN                       = 148,/* Jurc */
+      /** @stable ICU 4.8 */
+      USCRIPT_MRO                           = 149,/* Mroo */
+      /** @stable ICU 4.8 */
+      USCRIPT_NUSHU                         = 150,/* Nshu */
+      /** @stable ICU 4.8 */
+      USCRIPT_SHARADA                       = 151,/* Shrd */
+      /** @stable ICU 4.8 */
+      USCRIPT_SORA_SOMPENG                  = 152,/* Sora */
+      /** @stable ICU 4.8 */
+      USCRIPT_TAKRI                         = 153,/* Takr */
+      /** @stable ICU 4.8 */
+      USCRIPT_TANGUT                        = 154,/* Tang */
+      /** @stable ICU 4.8 */
+      USCRIPT_WOLEAI                        = 155,/* Wole */
+
+      /** @stable ICU 49 */
+      USCRIPT_ANATOLIAN_HIEROGLYPHS         = 156,/* Hluw */
+      /** @stable ICU 49 */
+      USCRIPT_KHOJKI                        = 157,/* Khoj */
+      /** @stable ICU 49 */
+      USCRIPT_TIRHUTA                       = 158,/* Tirh */
+
+      /** @stable ICU 52 */
+      USCRIPT_CAUCASIAN_ALBANIAN            = 159,/* Aghb */
+      /** @stable ICU 52 */
+      USCRIPT_MAHAJANI                      = 160,/* Mahj */
+
+      /* Private use codes from Qaaa - Qabx are not supported */
+
+      /** @stable ICU 2.2 */
+      USCRIPT_CODE_LIMIT    = 161
+} UScriptCode;
+
+/**
+ * Gets script codes associated with the given locale or ISO 15924 abbreviation or name. 
+ * Fills in USCRIPT_MALAYALAM given "Malayam" OR "Mlym".
+ * Fills in USCRIPT_LATIN given "en" OR "en_US" 
+ * If required capacity is greater than capacity of the destination buffer then the error code
+ * is set to U_BUFFER_OVERFLOW_ERROR and the required capacity is returned
+ *
+ * <p>Note: To search by short or long script alias only, use
+ * u_getPropertyValueEnum(UCHAR_SCRIPT, alias) instead.  This does
+ * a fast lookup with no access of the locale data.
+ * @param nameOrAbbrOrLocale name of the script, as given in
+ * PropertyValueAliases.txt, or ISO 15924 code or locale
+ * @param fillIn the UScriptCode buffer to fill in the script code
+ * @param capacity the capacity (size) fo UScriptCode buffer passed in.
+ * @param err the error status code.
+ * @return The number of script codes filled in the buffer passed in 
+ * @stable ICU 2.4
+ */
+U_STABLE int32_t  U_EXPORT2 
+uscript_getCode(const char* nameOrAbbrOrLocale,UScriptCode* fillIn,int32_t capacity,UErrorCode *err);
+
+/**
+ * Gets a script name associated with the given script code. 
+ * Returns  "Malayam" given USCRIPT_MALAYALAM
+ * @param scriptCode UScriptCode enum
+ * @return script long name as given in
+ * PropertyValueAliases.txt, or NULL if scriptCode is invalid
+ * @stable ICU 2.4
+ */
+U_STABLE const char*  U_EXPORT2 
+uscript_getName(UScriptCode scriptCode);
+
+/**
+ * Gets a script name associated with the given script code. 
+ * Returns  "Mlym" given USCRIPT_MALAYALAM
+ * @param scriptCode UScriptCode enum
+ * @return script abbreviated name as given in
+ * PropertyValueAliases.txt, or NULL if scriptCode is invalid
+ * @stable ICU 2.4
+ */
+U_STABLE const char*  U_EXPORT2 
+uscript_getShortName(UScriptCode scriptCode);
+
+/**
+ * Gets the script code associated with the given codepoint.
+ * Returns USCRIPT_MALAYALAM given 0x0D02 
+ * @param codepoint UChar32 codepoint
+ * @param err the error status code.
+ * @return The UScriptCode, or 0 if codepoint is invalid 
+ * @stable ICU 2.4
+ */
+U_STABLE UScriptCode  U_EXPORT2 
+uscript_getScript(UChar32 codepoint, UErrorCode *err);
+
+/**
+ * Do the Script_Extensions of code point c contain script sc?
+ * If c does not have explicit Script_Extensions, then this tests whether
+ * c has the Script property value sc.
+ *
+ * Some characters are commonly used in multiple scripts.
+ * For more information, see UAX #24: http://www.unicode.org/reports/tr24/.
+ *
+ * The Script_Extensions property is provisional. It may be modified or removed
+ * in future versions of the Unicode Standard, and thus in ICU.
+ * @param c code point
+ * @param sc script code
+ * @return TRUE if sc is in Script_Extensions(c)
+ * @stable ICU 49
+ */
+U_STABLE UBool U_EXPORT2
+uscript_hasScript(UChar32 c, UScriptCode sc);
+
+/**
+ * Writes code point c's Script_Extensions as a list of UScriptCode values
+ * to the output scripts array and returns the number of script codes.
+ * - If c does have Script_Extensions, then the Script property value
+ *   (normally Common or Inherited) is not included.
+ * - If c does not have Script_Extensions, then the one Script code is written to the output array.
+ * - If c is not a valid code point, then the one USCRIPT_UNKNOWN code is written.
+ * In other words, if the return value is 1,
+ * then the output array contains exactly c's single Script code.
+ * If the return value is n>=2, then the output array contains c's n Script_Extensions script codes.
+ *
+ * Some characters are commonly used in multiple scripts.
+ * For more information, see UAX #24: http://www.unicode.org/reports/tr24/.
+ *
+ * If there are more than capacity script codes to be written, then
+ * U_BUFFER_OVERFLOW_ERROR is set and the number of Script_Extensions is returned.
+ * (Usual ICU buffer handling behavior.)
+ *
+ * The Script_Extensions property is provisional. It may be modified or removed
+ * in future versions of the Unicode Standard, and thus in ICU.
+ * @param c code point
+ * @param scripts output script code array
+ * @param capacity capacity of the scripts array
+ * @param errorCode Standard ICU error code. Its input value must
+ *                  pass the U_SUCCESS() test, or else the function returns
+ *                  immediately. Check for U_FAILURE() on output or use with
+ *                  function chaining. (See User Guide for details.)
+ * @return number of script codes in c's Script_Extensions, or 1 for the single Script value,
+ *         written to scripts unless U_BUFFER_OVERFLOW_ERROR indicates insufficient capacity
+ * @stable ICU 49
+ */
+U_STABLE int32_t U_EXPORT2
+uscript_getScriptExtensions(UChar32 c,
+                            UScriptCode *scripts, int32_t capacity,
+                            UErrorCode *errorCode);
+
+#ifndef U_HIDE_DRAFT_API
+
+/**
+ * Script usage constants.
+ * See UAX #31 Unicode Identifier and Pattern Syntax.
+ * http://www.unicode.org/reports/tr31/#Table_Candidate_Characters_for_Exclusion_from_Identifiers
+ *
+ * @draft ICU 51
+ */
+typedef enum UScriptUsage {
+    /** Not encoded in Unicode. @draft ICU 51 */
+    USCRIPT_USAGE_NOT_ENCODED,
+    /** Unknown script usage. @draft ICU 51 */
+    USCRIPT_USAGE_UNKNOWN,
+    /** Candidate for Exclusion from Identifiers. @draft ICU 51 */
+    USCRIPT_USAGE_EXCLUDED,
+    /** Limited Use script. @draft ICU 51 */
+    USCRIPT_USAGE_LIMITED_USE,
+    /** Aspirational Use script. @draft ICU 51 */
+    USCRIPT_USAGE_ASPIRATIONAL,
+    /** Recommended script. @draft ICU 51 */
+    USCRIPT_USAGE_RECOMMENDED
+} UScriptUsage;
+
+/**
+ * Writes the script sample character string.
+ * This string normally consists of one code point but might be longer.
+ * The string is empty if the script is not encoded.
+ *
+ * @param script script code
+ * @param dest output string array
+ * @param capacity number of UChars in the dest array
+ * @param pErrorCode standard ICU in/out error code, must pass U_SUCCESS() on input
+ * @return the string length, even if U_BUFFER_OVERFLOW_ERROR
+ * @draft ICU 51
+ */
+U_DRAFT int32_t U_EXPORT2
+uscript_getSampleString(UScriptCode script, UChar *dest, int32_t capacity, UErrorCode *pErrorCode);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+class UnicodeString;
+U_NAMESPACE_END
+
+/**
+ * Returns the script sample character string.
+ * This string normally consists of one code point but might be longer.
+ * The string is empty if the script is not encoded.
+ *
+ * @param script script code
+ * @return the sample character string
+ * @draft ICU 51
+ */
+U_COMMON_API icu::UnicodeString U_EXPORT2
+uscript_getSampleUnicodeString(UScriptCode script);
+
+#endif
+
+/**
+ * Returns the script usage according to UAX #31 Unicode Identifier and Pattern Syntax.
+ * Returns USCRIPT_USAGE_NOT_ENCODED if the script is not encoded in Unicode.
+ *
+ * @param script script code
+ * @return script usage
+ * @see UScriptUsage
+ * @draft ICU 51
+ */
+U_DRAFT UScriptUsage U_EXPORT2
+uscript_getUsage(UScriptCode script);
+
+/**
+ * Returns TRUE if the script is written right-to-left.
+ * For example, Arab and Hebr.
+ *
+ * @param script script code
+ * @return TRUE if the script is right-to-left
+ * @draft ICU 51
+ */
+U_DRAFT UBool U_EXPORT2
+uscript_isRightToLeft(UScriptCode script);
+
+/**
+ * Returns TRUE if the script allows line breaks between letters (excluding hyphenation).
+ * Such a script typically requires dictionary-based line breaking.
+ * For example, Hani and Thai.
+ *
+ * @param script script code
+ * @return TRUE if the script allows line breaks between letters
+ * @draft ICU 51
+ */
+U_DRAFT UBool U_EXPORT2
+uscript_breaksBetweenLetters(UScriptCode script);
+
+/**
+ * Returns TRUE if in modern (or most recent) usage of the script case distinctions are customary.
+ * For example, Latn and Cyrl.
+ *
+ * @param script script code
+ * @return TRUE if the script is cased
+ * @draft ICU 51
+ */
+U_DRAFT UBool U_EXPORT2
+uscript_isCased(UScriptCode script);
+
+#endif  /* U_HIDE_DRAFT_API */
+
+#endif
diff --git a/icu/unicode/uset.h b/icu/unicode/uset.h
new file mode 100644
index 0000000..40510cd
--- /dev/null
+++ b/icu/unicode/uset.h
@@ -0,0 +1,1124 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 2002-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  uset.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 2002mar07
+*   created by: Markus W. Scherer
+*
+*   C version of UnicodeSet.
+*/
+
+
+/**
+ * \file
+ * \brief C API: Unicode Set
+ *
+ * <p>This is a C wrapper around the C++ UnicodeSet class.</p>
+ */
+
+#ifndef __USET_H__
+#define __USET_H__
+
+#include "unicode/utypes.h"
+#include "unicode/uchar.h"
+#include "unicode/localpointer.h"
+
+#ifndef UCNV_H
+struct USet;
+/**
+ * A UnicodeSet.  Use the uset_* API to manipulate.  Create with
+ * uset_open*, and destroy with uset_close.
+ * @stable ICU 2.4
+ */
+typedef struct USet USet;
+#endif
+
+/**
+ * Bitmask values to be passed to uset_openPatternOptions() or
+ * uset_applyPattern() taking an option parameter.
+ * @stable ICU 2.4
+ */
+enum {
+    /**
+     * Ignore white space within patterns unless quoted or escaped.
+     * @stable ICU 2.4
+     */
+    USET_IGNORE_SPACE = 1,  
+
+    /**
+     * Enable case insensitive matching.  E.g., "[ab]" with this flag
+     * will match 'a', 'A', 'b', and 'B'.  "[^ab]" with this flag will
+     * match all except 'a', 'A', 'b', and 'B'. This performs a full
+     * closure over case mappings, e.g. U+017F for s.
+     *
+     * The resulting set is a superset of the input for the code points but
+     * not for the strings.
+     * It performs a case mapping closure of the code points and adds
+     * full case folding strings for the code points, and reduces strings of
+     * the original set to their full case folding equivalents.
+     *
+     * This is designed for case-insensitive matches, for example
+     * in regular expressions. The full code point case closure allows checking of
+     * an input character directly against the closure set.
+     * Strings are matched by comparing the case-folded form from the closure
+     * set with an incremental case folding of the string in question.
+     *
+     * The closure set will also contain single code points if the original
+     * set contained case-equivalent strings (like U+00DF for "ss" or "Ss" etc.).
+     * This is not necessary (that is, redundant) for the above matching method
+     * but results in the same closure sets regardless of whether the original
+     * set contained the code point or a string.
+     *
+     * @stable ICU 2.4
+     */
+    USET_CASE_INSENSITIVE = 2,  
+
+    /**
+     * Enable case insensitive matching.  E.g., "[ab]" with this flag
+     * will match 'a', 'A', 'b', and 'B'.  "[^ab]" with this flag will
+     * match all except 'a', 'A', 'b', and 'B'. This adds the lower-,
+     * title-, and uppercase mappings as well as the case folding
+     * of each existing element in the set.
+     * @stable ICU 3.2
+     */
+    USET_ADD_CASE_MAPPINGS = 4
+};
+
+/**
+ * Argument values for whether span() and similar functions continue while
+ * the current character is contained vs. not contained in the set.
+ *
+ * The functionality is straightforward for sets with only single code points,
+ * without strings (which is the common case):
+ * - USET_SPAN_CONTAINED and USET_SPAN_SIMPLE
+ *   work the same.
+ * - span() and spanBack() partition any string the same way when
+ *   alternating between span(USET_SPAN_NOT_CONTAINED) and
+ *   span(either "contained" condition).
+ * - Using a complemented (inverted) set and the opposite span conditions
+ *   yields the same results.
+ *
+ * When a set contains multi-code point strings, then these statements may not
+ * be true, depending on the strings in the set (for example, whether they
+ * overlap with each other) and the string that is processed.
+ * For a set with strings:
+ * - The complement of the set contains the opposite set of code points,
+ *   but the same set of strings.
+ *   Therefore, complementing both the set and the span conditions
+ *   may yield different results.
+ * - When starting spans at different positions in a string
+ *   (span(s, ...) vs. span(s+1, ...)) the ends of the spans may be different
+ *   because a set string may start before the later position.
+ * - span(USET_SPAN_SIMPLE) may be shorter than
+ *   span(USET_SPAN_CONTAINED) because it will not recursively try
+ *   all possible paths.
+ *   For example, with a set which contains the three strings "xy", "xya" and "ax",
+ *   span("xyax", USET_SPAN_CONTAINED) will return 4 but
+ *   span("xyax", USET_SPAN_SIMPLE) will return 3.
+ *   span(USET_SPAN_SIMPLE) will never be longer than
+ *   span(USET_SPAN_CONTAINED).
+ * - With either "contained" condition, span() and spanBack() may partition
+ *   a string in different ways.
+ *   For example, with a set which contains the two strings "ab" and "ba",
+ *   and when processing the string "aba",
+ *   span() will yield contained/not-contained boundaries of { 0, 2, 3 }
+ *   while spanBack() will yield boundaries of { 0, 1, 3 }.
+ *
+ * Note: If it is important to get the same boundaries whether iterating forward
+ * or backward through a string, then either only span() should be used and
+ * the boundaries cached for backward operation, or an ICU BreakIterator
+ * could be used.
+ *
+ * Note: Unpaired surrogates are treated like surrogate code points.
+ * Similarly, set strings match only on code point boundaries,
+ * never in the middle of a surrogate pair.
+ * Illegal UTF-8 sequences are treated like U+FFFD.
+ * When processing UTF-8 strings, malformed set strings
+ * (strings with unpaired surrogates which cannot be converted to UTF-8)
+ * are ignored.
+ *
+ * @stable ICU 3.8
+ */
+typedef enum USetSpanCondition {
+    /**
+     * Continue a span() while there is no set element at the current position.
+     * Stops before the first set element (character or string).
+     * (For code points only, this is like while contains(current)==FALSE).
+     *
+     * When span() returns, the substring between where it started and the position
+     * it returned consists only of characters that are not in the set,
+     * and none of its strings overlap with the span.
+     *
+     * @stable ICU 3.8
+     */
+    USET_SPAN_NOT_CONTAINED = 0,
+    /**
+     * Continue a span() while there is a set element at the current position.
+     * (For characters only, this is like while contains(current)==TRUE).
+     *
+     * When span() returns, the substring between where it started and the position
+     * it returned consists only of set elements (characters or strings) that are in the set.
+     *
+     * If a set contains strings, then the span will be the longest substring
+     * matching any of the possible concatenations of set elements (characters or strings).
+     * (There must be a single, non-overlapping concatenation of characters or strings.)
+     * This is equivalent to a POSIX regular expression for (OR of each set element)*.
+     *
+     * @stable ICU 3.8
+     */
+    USET_SPAN_CONTAINED = 1,
+    /**
+     * Continue a span() while there is a set element at the current position.
+     * (For characters only, this is like while contains(current)==TRUE).
+     *
+     * When span() returns, the substring between where it started and the position
+     * it returned consists only of set elements (characters or strings) that are in the set.
+     *
+     * If a set only contains single characters, then this is the same
+     * as USET_SPAN_CONTAINED.
+     *
+     * If a set contains strings, then the span will be the longest substring
+     * with a match at each position with the longest single set element (character or string).
+     *
+     * Use this span condition together with other longest-match algorithms,
+     * such as ICU converters (ucnv_getUnicodeSet()).
+     *
+     * @stable ICU 3.8
+     */
+    USET_SPAN_SIMPLE = 2,
+    /**
+     * One more than the last span condition.
+     * @stable ICU 3.8
+     */
+    USET_SPAN_CONDITION_COUNT
+} USetSpanCondition;
+
+enum {
+    /**
+     * Capacity of USerializedSet::staticArray.
+     * Enough for any single-code point set.
+     * Also provides padding for nice sizeof(USerializedSet).
+     * @stable ICU 2.4
+     */
+    USET_SERIALIZED_STATIC_ARRAY_CAPACITY=8
+};
+
+/**
+ * A serialized form of a Unicode set.  Limited manipulations are
+ * possible directly on a serialized set.  See below.
+ * @stable ICU 2.4
+ */
+typedef struct USerializedSet {
+    /**
+     * The serialized Unicode Set.
+     * @stable ICU 2.4
+     */
+    const uint16_t *array;
+    /**
+     * The length of the array that contains BMP characters.
+     * @stable ICU 2.4
+     */
+    int32_t bmpLength;
+    /**
+     * The total length of the array.
+     * @stable ICU 2.4
+     */
+    int32_t length;
+    /**
+     * A small buffer for the array to reduce memory allocations.
+     * @stable ICU 2.4
+     */
+    uint16_t staticArray[USET_SERIALIZED_STATIC_ARRAY_CAPACITY];
+} USerializedSet;
+
+/*********************************************************************
+ * USet API
+ *********************************************************************/
+
+/**
+ * Create an empty USet object.
+ * Equivalent to uset_open(1, 0).
+ * @return a newly created USet.  The caller must call uset_close() on
+ * it when done.
+ * @stable ICU 4.2
+ */
+U_STABLE USet* U_EXPORT2
+uset_openEmpty(void);
+
+/**
+ * Creates a USet object that contains the range of characters
+ * start..end, inclusive.  If <code>start > end</code> 
+ * then an empty set is created (same as using uset_openEmpty()).
+ * @param start first character of the range, inclusive
+ * @param end last character of the range, inclusive
+ * @return a newly created USet.  The caller must call uset_close() on
+ * it when done.
+ * @stable ICU 2.4
+ */
+U_STABLE USet* U_EXPORT2
+uset_open(UChar32 start, UChar32 end);
+
+/**
+ * Creates a set from the given pattern.  See the UnicodeSet class
+ * description for the syntax of the pattern language.
+ * @param pattern a string specifying what characters are in the set
+ * @param patternLength the length of the pattern, or -1 if null
+ * terminated
+ * @param ec the error code
+ * @stable ICU 2.4
+ */
+U_STABLE USet* U_EXPORT2
+uset_openPattern(const UChar* pattern, int32_t patternLength,
+                 UErrorCode* ec);
+
+/**
+ * Creates a set from the given pattern.  See the UnicodeSet class
+ * description for the syntax of the pattern language.
+ * @param pattern a string specifying what characters are in the set
+ * @param patternLength the length of the pattern, or -1 if null
+ * terminated
+ * @param options bitmask for options to apply to the pattern.
+ * Valid options are USET_IGNORE_SPACE and USET_CASE_INSENSITIVE.
+ * @param ec the error code
+ * @stable ICU 2.4
+ */
+U_STABLE USet* U_EXPORT2
+uset_openPatternOptions(const UChar* pattern, int32_t patternLength,
+                 uint32_t options,
+                 UErrorCode* ec);
+
+/**
+ * Disposes of the storage used by a USet object.  This function should
+ * be called exactly once for objects returned by uset_open().
+ * @param set the object to dispose of
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+uset_close(USet* set);
+
+#if U_SHOW_CPLUSPLUS_API
+
+U_NAMESPACE_BEGIN
+
+/**
+ * \class LocalUSetPointer
+ * "Smart pointer" class, closes a USet via uset_close().
+ * For most methods see the LocalPointerBase base class.
+ *
+ * @see LocalPointerBase
+ * @see LocalPointer
+ * @stable ICU 4.4
+ */
+U_DEFINE_LOCAL_OPEN_POINTER(LocalUSetPointer, USet, uset_close);
+
+U_NAMESPACE_END
+
+#endif
+
+/**
+ * Returns a copy of this object.
+ * If this set is frozen, then the clone will be frozen as well.
+ * Use uset_cloneAsThawed() for a mutable clone of a frozen set.
+ * @param set the original set
+ * @return the newly allocated copy of the set
+ * @see uset_cloneAsThawed
+ * @stable ICU 3.8
+ */
+U_STABLE USet * U_EXPORT2
+uset_clone(const USet *set);
+
+/**
+ * Determines whether the set has been frozen (made immutable) or not.
+ * See the ICU4J Freezable interface for details.
+ * @param set the set
+ * @return TRUE/FALSE for whether the set has been frozen
+ * @see uset_freeze
+ * @see uset_cloneAsThawed
+ * @stable ICU 3.8
+ */
+U_STABLE UBool U_EXPORT2
+uset_isFrozen(const USet *set);
+
+/**
+ * Freeze the set (make it immutable).
+ * Once frozen, it cannot be unfrozen and is therefore thread-safe
+ * until it is deleted.
+ * See the ICU4J Freezable interface for details.
+ * Freezing the set may also make some operations faster, for example
+ * uset_contains() and uset_span().
+ * A frozen set will not be modified. (It remains frozen.)
+ * @param set the set
+ * @return the same set, now frozen
+ * @see uset_isFrozen
+ * @see uset_cloneAsThawed
+ * @stable ICU 3.8
+ */
+U_STABLE void U_EXPORT2
+uset_freeze(USet *set);
+
+/**
+ * Clone the set and make the clone mutable.
+ * See the ICU4J Freezable interface for details.
+ * @param set the set
+ * @return the mutable clone
+ * @see uset_freeze
+ * @see uset_isFrozen
+ * @see uset_clone
+ * @stable ICU 3.8
+ */
+U_STABLE USet * U_EXPORT2
+uset_cloneAsThawed(const USet *set);
+
+/**
+ * Causes the USet object to represent the range <code>start - end</code>.
+ * If <code>start > end</code> then this USet is set to an empty range.
+ * A frozen set will not be modified.
+ * @param set the object to set to the given range
+ * @param start first character in the set, inclusive
+ * @param end last character in the set, inclusive
+ * @stable ICU 3.2
+ */
+U_STABLE void U_EXPORT2
+uset_set(USet* set,
+         UChar32 start, UChar32 end);
+
+/**
+ * Modifies the set to represent the set specified by the given
+ * pattern. See the UnicodeSet class description for the syntax of 
+ * the pattern language. See also the User Guide chapter about UnicodeSet.
+ * <em>Empties the set passed before applying the pattern.</em>
+ * A frozen set will not be modified.
+ * @param set               The set to which the pattern is to be applied. 
+ * @param pattern           A pointer to UChar string specifying what characters are in the set.
+ *                          The character at pattern[0] must be a '['.
+ * @param patternLength     The length of the UChar string. -1 if NUL terminated.
+ * @param options           A bitmask for options to apply to the pattern.
+ *                          Valid options are USET_IGNORE_SPACE and USET_CASE_INSENSITIVE.
+ * @param status            Returns an error if the pattern cannot be parsed.
+ * @return                  Upon successful parse, the value is either
+ *                          the index of the character after the closing ']' 
+ *                          of the parsed pattern.
+ *                          If the status code indicates failure, then the return value 
+ *                          is the index of the error in the source.
+ *
+ * @stable ICU 2.8
+ */
+U_STABLE int32_t U_EXPORT2 
+uset_applyPattern(USet *set,
+                  const UChar *pattern, int32_t patternLength,
+                  uint32_t options,
+                  UErrorCode *status);
+
+/**
+ * Modifies the set to contain those code points which have the given value
+ * for the given binary or enumerated property, as returned by
+ * u_getIntPropertyValue.  Prior contents of this set are lost.
+ * A frozen set will not be modified.
+ *
+ * @param set the object to contain the code points defined by the property
+ *
+ * @param prop a property in the range UCHAR_BIN_START..UCHAR_BIN_LIMIT-1
+ * or UCHAR_INT_START..UCHAR_INT_LIMIT-1
+ * or UCHAR_MASK_START..UCHAR_MASK_LIMIT-1.
+ *
+ * @param value a value in the range u_getIntPropertyMinValue(prop)..
+ * u_getIntPropertyMaxValue(prop), with one exception.  If prop is
+ * UCHAR_GENERAL_CATEGORY_MASK, then value should not be a UCharCategory, but
+ * rather a mask value produced by U_GET_GC_MASK().  This allows grouped
+ * categories such as [:L:] to be represented.
+ *
+ * @param ec error code input/output parameter
+ *
+ * @stable ICU 3.2
+ */
+U_STABLE void U_EXPORT2
+uset_applyIntPropertyValue(USet* set,
+                           UProperty prop, int32_t value, UErrorCode* ec);
+
+/**
+ * Modifies the set to contain those code points which have the
+ * given value for the given property.  Prior contents of this
+ * set are lost.
+ * A frozen set will not be modified.
+ *
+ * @param set the object to contain the code points defined by the given
+ * property and value alias
+ *
+ * @param prop a string specifying a property alias, either short or long.
+ * The name is matched loosely.  See PropertyAliases.txt for names and a
+ * description of loose matching.  If the value string is empty, then this
+ * string is interpreted as either a General_Category value alias, a Script
+ * value alias, a binary property alias, or a special ID.  Special IDs are
+ * matched loosely and correspond to the following sets:
+ *
+ * "ANY" = [\\u0000-\\U0010FFFF],
+ * "ASCII" = [\\u0000-\\u007F],
+ * "Assigned" = [:^Cn:].
+ *
+ * @param propLength the length of the prop, or -1 if NULL
+ *
+ * @param value a string specifying a value alias, either short or long.
+ * The name is matched loosely.  See PropertyValueAliases.txt for names
+ * and a description of loose matching.  In addition to aliases listed,
+ * numeric values and canonical combining classes may be expressed
+ * numerically, e.g., ("nv", "0.5") or ("ccc", "220").  The value string
+ * may also be empty.
+ *
+ * @param valueLength the length of the value, or -1 if NULL
+ *
+ * @param ec error code input/output parameter
+ *
+ * @stable ICU 3.2
+ */
+U_STABLE void U_EXPORT2
+uset_applyPropertyAlias(USet* set,
+                        const UChar *prop, int32_t propLength,
+                        const UChar *value, int32_t valueLength,
+                        UErrorCode* ec);
+
+/**
+ * Return true if the given position, in the given pattern, appears
+ * to be the start of a UnicodeSet pattern.
+ *
+ * @param pattern a string specifying the pattern
+ * @param patternLength the length of the pattern, or -1 if NULL
+ * @param pos the given position
+ * @stable ICU 3.2
+ */
+U_STABLE UBool U_EXPORT2
+uset_resemblesPattern(const UChar *pattern, int32_t patternLength,
+                      int32_t pos);
+
+/**
+ * Returns a string representation of this set.  If the result of
+ * calling this function is passed to a uset_openPattern(), it
+ * will produce another set that is equal to this one.
+ * @param set the set
+ * @param result the string to receive the rules, may be NULL
+ * @param resultCapacity the capacity of result, may be 0 if result is NULL
+ * @param escapeUnprintable if TRUE then convert unprintable
+ * character to their hex escape representations, \\uxxxx or
+ * \\Uxxxxxxxx.  Unprintable characters are those other than
+ * U+000A, U+0020..U+007E.
+ * @param ec error code.
+ * @return length of string, possibly larger than resultCapacity
+ * @stable ICU 2.4
+ */
+U_STABLE int32_t U_EXPORT2
+uset_toPattern(const USet* set,
+               UChar* result, int32_t resultCapacity,
+               UBool escapeUnprintable,
+               UErrorCode* ec);
+
+/**
+ * Adds the given character to the given USet.  After this call,
+ * uset_contains(set, c) will return TRUE.
+ * A frozen set will not be modified.
+ * @param set the object to which to add the character
+ * @param c the character to add
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+uset_add(USet* set, UChar32 c);
+
+/**
+ * Adds all of the elements in the specified set to this set if
+ * they're not already present.  This operation effectively
+ * modifies this set so that its value is the <i>union</i> of the two
+ * sets.  The behavior of this operation is unspecified if the specified
+ * collection is modified while the operation is in progress.
+ * A frozen set will not be modified.
+ *
+ * @param set the object to which to add the set
+ * @param additionalSet the source set whose elements are to be added to this set.
+ * @stable ICU 2.6
+ */
+U_STABLE void U_EXPORT2
+uset_addAll(USet* set, const USet *additionalSet);
+
+/**
+ * Adds the given range of characters to the given USet.  After this call,
+ * uset_contains(set, start, end) will return TRUE.
+ * A frozen set will not be modified.
+ * @param set the object to which to add the character
+ * @param start the first character of the range to add, inclusive
+ * @param end the last character of the range to add, inclusive
+ * @stable ICU 2.2
+ */
+U_STABLE void U_EXPORT2
+uset_addRange(USet* set, UChar32 start, UChar32 end);
+
+/**
+ * Adds the given string to the given USet.  After this call,
+ * uset_containsString(set, str, strLen) will return TRUE.
+ * A frozen set will not be modified.
+ * @param set the object to which to add the character
+ * @param str the string to add
+ * @param strLen the length of the string or -1 if null terminated.
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+uset_addString(USet* set, const UChar* str, int32_t strLen);
+
+/**
+ * Adds each of the characters in this string to the set. Thus "ch" => {"c", "h"}
+ * If this set already any particular character, it has no effect on that character.
+ * A frozen set will not be modified.
+ * @param set the object to which to add the character
+ * @param str the source string
+ * @param strLen the length of the string or -1 if null terminated.
+ * @stable ICU 3.4
+ */
+U_STABLE void U_EXPORT2
+uset_addAllCodePoints(USet* set, const UChar *str, int32_t strLen);
+
+/**
+ * Removes the given character from the given USet.  After this call,
+ * uset_contains(set, c) will return FALSE.
+ * A frozen set will not be modified.
+ * @param set the object from which to remove the character
+ * @param c the character to remove
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+uset_remove(USet* set, UChar32 c);
+
+/**
+ * Removes the given range of characters from the given USet.  After this call,
+ * uset_contains(set, start, end) will return FALSE.
+ * A frozen set will not be modified.
+ * @param set the object to which to add the character
+ * @param start the first character of the range to remove, inclusive
+ * @param end the last character of the range to remove, inclusive
+ * @stable ICU 2.2
+ */
+U_STABLE void U_EXPORT2
+uset_removeRange(USet* set, UChar32 start, UChar32 end);
+
+/**
+ * Removes the given string to the given USet.  After this call,
+ * uset_containsString(set, str, strLen) will return FALSE.
+ * A frozen set will not be modified.
+ * @param set the object to which to add the character
+ * @param str the string to remove
+ * @param strLen the length of the string or -1 if null terminated.
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+uset_removeString(USet* set, const UChar* str, int32_t strLen);
+
+/**
+ * Removes from this set all of its elements that are contained in the
+ * specified set.  This operation effectively modifies this
+ * set so that its value is the <i>asymmetric set difference</i> of
+ * the two sets.
+ * A frozen set will not be modified.
+ * @param set the object from which the elements are to be removed
+ * @param removeSet the object that defines which elements will be
+ * removed from this set
+ * @stable ICU 3.2
+ */
+U_STABLE void U_EXPORT2
+uset_removeAll(USet* set, const USet* removeSet);
+
+/**
+ * Retain only the elements in this set that are contained in the
+ * specified range.  If <code>start > end</code> then an empty range is
+ * retained, leaving the set empty.  This is equivalent to
+ * a boolean logic AND, or a set INTERSECTION.
+ * A frozen set will not be modified.
+ *
+ * @param set the object for which to retain only the specified range
+ * @param start first character, inclusive, of range to be retained
+ * to this set.
+ * @param end last character, inclusive, of range to be retained
+ * to this set.
+ * @stable ICU 3.2
+ */
+U_STABLE void U_EXPORT2
+uset_retain(USet* set, UChar32 start, UChar32 end);
+
+/**
+ * Retains only the elements in this set that are contained in the
+ * specified set.  In other words, removes from this set all of
+ * its elements that are not contained in the specified set.  This
+ * operation effectively modifies this set so that its value is
+ * the <i>intersection</i> of the two sets.
+ * A frozen set will not be modified.
+ *
+ * @param set the object on which to perform the retain
+ * @param retain set that defines which elements this set will retain
+ * @stable ICU 3.2
+ */
+U_STABLE void U_EXPORT2
+uset_retainAll(USet* set, const USet* retain);
+
+/**
+ * Reallocate this objects internal structures to take up the least
+ * possible space, without changing this object's value.
+ * A frozen set will not be modified.
+ *
+ * @param set the object on which to perfrom the compact
+ * @stable ICU 3.2
+ */
+U_STABLE void U_EXPORT2
+uset_compact(USet* set);
+
+/**
+ * Inverts this set.  This operation modifies this set so that
+ * its value is its complement.  This operation does not affect
+ * the multicharacter strings, if any.
+ * A frozen set will not be modified.
+ * @param set the set
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+uset_complement(USet* set);
+
+/**
+ * Complements in this set all elements contained in the specified
+ * set.  Any character in the other set will be removed if it is
+ * in this set, or will be added if it is not in this set.
+ * A frozen set will not be modified.
+ *
+ * @param set the set with which to complement
+ * @param complement set that defines which elements will be xor'ed
+ * from this set.
+ * @stable ICU 3.2
+ */
+U_STABLE void U_EXPORT2
+uset_complementAll(USet* set, const USet* complement);
+
+/**
+ * Removes all of the elements from this set.  This set will be
+ * empty after this call returns.
+ * A frozen set will not be modified.
+ * @param set the set
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+uset_clear(USet* set);
+
+/**
+ * Close this set over the given attribute.  For the attribute
+ * USET_CASE, the result is to modify this set so that:
+ *
+ * 1. For each character or string 'a' in this set, all strings or
+ * characters 'b' such that foldCase(a) == foldCase(b) are added
+ * to this set.
+ *
+ * 2. For each string 'e' in the resulting set, if e !=
+ * foldCase(e), 'e' will be removed.
+ *
+ * Example: [aq\\u00DF{Bc}{bC}{Fi}] => [aAqQ\\u00DF\\uFB01{ss}{bc}{fi}]
+ *
+ * (Here foldCase(x) refers to the operation u_strFoldCase, and a
+ * == b denotes that the contents are the same, not pointer
+ * comparison.)
+ *
+ * A frozen set will not be modified.
+ *
+ * @param set the set
+ *
+ * @param attributes bitmask for attributes to close over.
+ * Currently only the USET_CASE bit is supported.  Any undefined bits
+ * are ignored.
+ * @stable ICU 4.2
+ */
+U_STABLE void U_EXPORT2
+uset_closeOver(USet* set, int32_t attributes);
+
+/**
+ * Remove all strings from this set.
+ *
+ * @param set the set
+ * @stable ICU 4.2
+ */
+U_STABLE void U_EXPORT2
+uset_removeAllStrings(USet* set);
+
+/**
+ * Returns TRUE if the given USet contains no characters and no
+ * strings.
+ * @param set the set
+ * @return true if set is empty
+ * @stable ICU 2.4
+ */
+U_STABLE UBool U_EXPORT2
+uset_isEmpty(const USet* set);
+
+/**
+ * Returns TRUE if the given USet contains the given character.
+ * This function works faster with a frozen set.
+ * @param set the set
+ * @param c The codepoint to check for within the set
+ * @return true if set contains c
+ * @stable ICU 2.4
+ */
+U_STABLE UBool U_EXPORT2
+uset_contains(const USet* set, UChar32 c);
+
+/**
+ * Returns TRUE if the given USet contains all characters c
+ * where start <= c && c <= end.
+ * @param set the set
+ * @param start the first character of the range to test, inclusive
+ * @param end the last character of the range to test, inclusive
+ * @return TRUE if set contains the range
+ * @stable ICU 2.2
+ */
+U_STABLE UBool U_EXPORT2
+uset_containsRange(const USet* set, UChar32 start, UChar32 end);
+
+/**
+ * Returns TRUE if the given USet contains the given string.
+ * @param set the set
+ * @param str the string
+ * @param strLen the length of the string or -1 if null terminated.
+ * @return true if set contains str
+ * @stable ICU 2.4
+ */
+U_STABLE UBool U_EXPORT2
+uset_containsString(const USet* set, const UChar* str, int32_t strLen);
+
+/**
+ * Returns the index of the given character within this set, where
+ * the set is ordered by ascending code point.  If the character
+ * is not in this set, return -1.  The inverse of this method is
+ * <code>charAt()</code>.
+ * @param set the set
+ * @param c the character to obtain the index for
+ * @return an index from 0..size()-1, or -1
+ * @stable ICU 3.2
+ */
+U_STABLE int32_t U_EXPORT2
+uset_indexOf(const USet* set, UChar32 c);
+
+/**
+ * Returns the character at the given index within this set, where
+ * the set is ordered by ascending code point.  If the index is
+ * out of range, return (UChar32)-1.  The inverse of this method is
+ * <code>indexOf()</code>.
+ * @param set the set
+ * @param charIndex an index from 0..size()-1 to obtain the char for
+ * @return the character at the given index, or (UChar32)-1.
+ * @stable ICU 3.2
+ */
+U_STABLE UChar32 U_EXPORT2
+uset_charAt(const USet* set, int32_t charIndex);
+
+/**
+ * Returns the number of characters and strings contained in the given
+ * USet.
+ * @param set the set
+ * @return a non-negative integer counting the characters and strings
+ * contained in set
+ * @stable ICU 2.4
+ */
+U_STABLE int32_t U_EXPORT2
+uset_size(const USet* set);
+
+/**
+ * Returns the number of items in this set.  An item is either a range
+ * of characters or a single multicharacter string.
+ * @param set the set
+ * @return a non-negative integer counting the character ranges
+ * and/or strings contained in set
+ * @stable ICU 2.4
+ */
+U_STABLE int32_t U_EXPORT2
+uset_getItemCount(const USet* set);
+
+/**
+ * Returns an item of this set.  An item is either a range of
+ * characters or a single multicharacter string.
+ * @param set the set
+ * @param itemIndex a non-negative integer in the range 0..
+ * uset_getItemCount(set)-1
+ * @param start pointer to variable to receive first character
+ * in range, inclusive
+ * @param end pointer to variable to receive last character in range,
+ * inclusive
+ * @param str buffer to receive the string, may be NULL
+ * @param strCapacity capacity of str, or 0 if str is NULL
+ * @param ec error code
+ * @return the length of the string (>= 2), or 0 if the item is a
+ * range, in which case it is the range *start..*end, or -1 if
+ * itemIndex is out of range
+ * @stable ICU 2.4
+ */
+U_STABLE int32_t U_EXPORT2
+uset_getItem(const USet* set, int32_t itemIndex,
+             UChar32* start, UChar32* end,
+             UChar* str, int32_t strCapacity,
+             UErrorCode* ec);
+
+/**
+ * Returns true if set1 contains all the characters and strings
+ * of set2. It answers the question, 'Is set1 a superset of set2?'
+ * @param set1 set to be checked for containment
+ * @param set2 set to be checked for containment
+ * @return true if the test condition is met
+ * @stable ICU 3.2
+ */
+U_STABLE UBool U_EXPORT2
+uset_containsAll(const USet* set1, const USet* set2);
+
+/**
+ * Returns true if this set contains all the characters
+ * of the given string. This is does not check containment of grapheme
+ * clusters, like uset_containsString.
+ * @param set set of characters to be checked for containment
+ * @param str string containing codepoints to be checked for containment
+ * @param strLen the length of the string or -1 if null terminated.
+ * @return true if the test condition is met
+ * @stable ICU 3.4
+ */
+U_STABLE UBool U_EXPORT2
+uset_containsAllCodePoints(const USet* set, const UChar *str, int32_t strLen);
+
+/**
+ * Returns true if set1 contains none of the characters and strings
+ * of set2. It answers the question, 'Is set1 a disjoint set of set2?'
+ * @param set1 set to be checked for containment
+ * @param set2 set to be checked for containment
+ * @return true if the test condition is met
+ * @stable ICU 3.2
+ */
+U_STABLE UBool U_EXPORT2
+uset_containsNone(const USet* set1, const USet* set2);
+
+/**
+ * Returns true if set1 contains some of the characters and strings
+ * of set2. It answers the question, 'Does set1 and set2 have an intersection?'
+ * @param set1 set to be checked for containment
+ * @param set2 set to be checked for containment
+ * @return true if the test condition is met
+ * @stable ICU 3.2
+ */
+U_STABLE UBool U_EXPORT2
+uset_containsSome(const USet* set1, const USet* set2);
+
+/**
+ * Returns the length of the initial substring of the input string which
+ * consists only of characters and strings that are contained in this set
+ * (USET_SPAN_CONTAINED, USET_SPAN_SIMPLE),
+ * or only of characters and strings that are not contained
+ * in this set (USET_SPAN_NOT_CONTAINED).
+ * See USetSpanCondition for details.
+ * Similar to the strspn() C library function.
+ * Unpaired surrogates are treated according to contains() of their surrogate code points.
+ * This function works faster with a frozen set and with a non-negative string length argument.
+ * @param set the set
+ * @param s start of the string
+ * @param length of the string; can be -1 for NUL-terminated
+ * @param spanCondition specifies the containment condition
+ * @return the length of the initial substring according to the spanCondition;
+ *         0 if the start of the string does not fit the spanCondition
+ * @stable ICU 3.8
+ * @see USetSpanCondition
+ */
+U_STABLE int32_t U_EXPORT2
+uset_span(const USet *set, const UChar *s, int32_t length, USetSpanCondition spanCondition);
+
+/**
+ * Returns the start of the trailing substring of the input string which
+ * consists only of characters and strings that are contained in this set
+ * (USET_SPAN_CONTAINED, USET_SPAN_SIMPLE),
+ * or only of characters and strings that are not contained
+ * in this set (USET_SPAN_NOT_CONTAINED).
+ * See USetSpanCondition for details.
+ * Unpaired surrogates are treated according to contains() of their surrogate code points.
+ * This function works faster with a frozen set and with a non-negative string length argument.
+ * @param set the set
+ * @param s start of the string
+ * @param length of the string; can be -1 for NUL-terminated
+ * @param spanCondition specifies the containment condition
+ * @return the start of the trailing substring according to the spanCondition;
+ *         the string length if the end of the string does not fit the spanCondition
+ * @stable ICU 3.8
+ * @see USetSpanCondition
+ */
+U_STABLE int32_t U_EXPORT2
+uset_spanBack(const USet *set, const UChar *s, int32_t length, USetSpanCondition spanCondition);
+
+/**
+ * Returns the length of the initial substring of the input string which
+ * consists only of characters and strings that are contained in this set
+ * (USET_SPAN_CONTAINED, USET_SPAN_SIMPLE),
+ * or only of characters and strings that are not contained
+ * in this set (USET_SPAN_NOT_CONTAINED).
+ * See USetSpanCondition for details.
+ * Similar to the strspn() C library function.
+ * Malformed byte sequences are treated according to contains(0xfffd).
+ * This function works faster with a frozen set and with a non-negative string length argument.
+ * @param set the set
+ * @param s start of the string (UTF-8)
+ * @param length of the string; can be -1 for NUL-terminated
+ * @param spanCondition specifies the containment condition
+ * @return the length of the initial substring according to the spanCondition;
+ *         0 if the start of the string does not fit the spanCondition
+ * @stable ICU 3.8
+ * @see USetSpanCondition
+ */
+U_STABLE int32_t U_EXPORT2
+uset_spanUTF8(const USet *set, const char *s, int32_t length, USetSpanCondition spanCondition);
+
+/**
+ * Returns the start of the trailing substring of the input string which
+ * consists only of characters and strings that are contained in this set
+ * (USET_SPAN_CONTAINED, USET_SPAN_SIMPLE),
+ * or only of characters and strings that are not contained
+ * in this set (USET_SPAN_NOT_CONTAINED).
+ * See USetSpanCondition for details.
+ * Malformed byte sequences are treated according to contains(0xfffd).
+ * This function works faster with a frozen set and with a non-negative string length argument.
+ * @param set the set
+ * @param s start of the string (UTF-8)
+ * @param length of the string; can be -1 for NUL-terminated
+ * @param spanCondition specifies the containment condition
+ * @return the start of the trailing substring according to the spanCondition;
+ *         the string length if the end of the string does not fit the spanCondition
+ * @stable ICU 3.8
+ * @see USetSpanCondition
+ */
+U_STABLE int32_t U_EXPORT2
+uset_spanBackUTF8(const USet *set, const char *s, int32_t length, USetSpanCondition spanCondition);
+
+/**
+ * Returns true if set1 contains all of the characters and strings
+ * of set2, and vis versa. It answers the question, 'Is set1 equal to set2?'
+ * @param set1 set to be checked for containment
+ * @param set2 set to be checked for containment
+ * @return true if the test condition is met
+ * @stable ICU 3.2
+ */
+U_STABLE UBool U_EXPORT2
+uset_equals(const USet* set1, const USet* set2);
+
+/*********************************************************************
+ * Serialized set API
+ *********************************************************************/
+
+/**
+ * Serializes this set into an array of 16-bit integers.  Serialization
+ * (currently) only records the characters in the set; multicharacter
+ * strings are ignored.
+ *
+ * The array
+ * has following format (each line is one 16-bit integer):
+ *
+ *  length     = (n+2*m) | (m!=0?0x8000:0)
+ *  bmpLength  = n; present if m!=0
+ *  bmp[0]
+ *  bmp[1]
+ *  ...
+ *  bmp[n-1]
+ *  supp-high[0]
+ *  supp-low[0]
+ *  supp-high[1]
+ *  supp-low[1]
+ *  ...
+ *  supp-high[m-1]
+ *  supp-low[m-1]
+ *
+ * The array starts with a header.  After the header are n bmp
+ * code points, then m supplementary code points.  Either n or m
+ * or both may be zero.  n+2*m is always <= 0x7FFF.
+ *
+ * If there are no supplementary characters (if m==0) then the
+ * header is one 16-bit integer, 'length', with value n.
+ *
+ * If there are supplementary characters (if m!=0) then the header
+ * is two 16-bit integers.  The first, 'length', has value
+ * (n+2*m)|0x8000.  The second, 'bmpLength', has value n.
+ *
+ * After the header the code points are stored in ascending order.
+ * Supplementary code points are stored as most significant 16
+ * bits followed by least significant 16 bits.
+ *
+ * @param set the set
+ * @param dest pointer to buffer of destCapacity 16-bit integers.
+ * May be NULL only if destCapacity is zero.
+ * @param destCapacity size of dest, or zero.  Must not be negative.
+ * @param pErrorCode pointer to the error code.  Will be set to
+ * U_INDEX_OUTOFBOUNDS_ERROR if n+2*m > 0x7FFF.  Will be set to
+ * U_BUFFER_OVERFLOW_ERROR if n+2*m+(m!=0?2:1) > destCapacity.
+ * @return the total length of the serialized format, including
+ * the header, that is, n+2*m+(m!=0?2:1), or 0 on error other
+ * than U_BUFFER_OVERFLOW_ERROR.
+ * @stable ICU 2.4
+ */
+U_STABLE int32_t U_EXPORT2
+uset_serialize(const USet* set, uint16_t* dest, int32_t destCapacity, UErrorCode* pErrorCode);
+
+/**
+ * Given a serialized array, fill in the given serialized set object.
+ * @param fillSet pointer to result
+ * @param src pointer to start of array
+ * @param srcLength length of array
+ * @return true if the given array is valid, otherwise false
+ * @stable ICU 2.4
+ */
+U_STABLE UBool U_EXPORT2
+uset_getSerializedSet(USerializedSet* fillSet, const uint16_t* src, int32_t srcLength);
+
+/**
+ * Set the USerializedSet to contain the given character (and nothing
+ * else).
+ * @param fillSet pointer to result
+ * @param c The codepoint to set
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+uset_setSerializedToOne(USerializedSet* fillSet, UChar32 c);
+
+/**
+ * Returns TRUE if the given USerializedSet contains the given
+ * character.
+ * @param set the serialized set
+ * @param c The codepoint to check for within the set
+ * @return true if set contains c
+ * @stable ICU 2.4
+ */
+U_STABLE UBool U_EXPORT2
+uset_serializedContains(const USerializedSet* set, UChar32 c);
+
+/**
+ * Returns the number of disjoint ranges of characters contained in
+ * the given serialized set.  Ignores any strings contained in the
+ * set.
+ * @param set the serialized set
+ * @return a non-negative integer counting the character ranges
+ * contained in set
+ * @stable ICU 2.4
+ */
+U_STABLE int32_t U_EXPORT2
+uset_getSerializedRangeCount(const USerializedSet* set);
+
+/**
+ * Returns a range of characters contained in the given serialized
+ * set.
+ * @param set the serialized set
+ * @param rangeIndex a non-negative integer in the range 0..
+ * uset_getSerializedRangeCount(set)-1
+ * @param pStart pointer to variable to receive first character
+ * in range, inclusive
+ * @param pEnd pointer to variable to receive last character in range,
+ * inclusive
+ * @return true if rangeIndex is valid, otherwise false
+ * @stable ICU 2.4
+ */
+U_STABLE UBool U_EXPORT2
+uset_getSerializedRange(const USerializedSet* set, int32_t rangeIndex,
+                        UChar32* pStart, UChar32* pEnd);
+
+#endif
diff --git a/icu/unicode/ustring.h b/icu/unicode/ustring.h
new file mode 100644
index 0000000..d2ea31c
--- /dev/null
+++ b/icu/unicode/ustring.h
@@ -0,0 +1,1703 @@
+/*
+**********************************************************************
+*   Copyright (C) 1998-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+*
+* File ustring.h
+*
+* Modification History:
+*
+*   Date        Name        Description
+*   12/07/98    bertrand    Creation.
+******************************************************************************
+*/
+
+#ifndef USTRING_H
+#define USTRING_H
+
+#include "unicode/utypes.h"
+#include "unicode/putil.h"
+#include "unicode/uiter.h"
+
+/**
+ * \def UBRK_TYPEDEF_UBREAK_ITERATOR
+ * @internal 
+ */
+
+#ifndef UBRK_TYPEDEF_UBREAK_ITERATOR
+#   define UBRK_TYPEDEF_UBREAK_ITERATOR
+/** Simple declaration for u_strToTitle() to avoid including unicode/ubrk.h. @stable ICU 2.1*/
+    typedef struct UBreakIterator UBreakIterator;
+#endif
+
+/**
+ * \file
+ * \brief C API: Unicode string handling functions
+ *
+ * These C API functions provide general Unicode string handling.
+ *
+ * Some functions are equivalent in name, signature, and behavior to the ANSI C <string.h>
+ * functions. (For example, they do not check for bad arguments like NULL string pointers.)
+ * In some cases, only the thread-safe variant of such a function is implemented here
+ * (see u_strtok_r()).
+ *
+ * Other functions provide more Unicode-specific functionality like locale-specific
+ * upper/lower-casing and string comparison in code point order.
+ *
+ * ICU uses 16-bit Unicode (UTF-16) in the form of arrays of UChar code units.
+ * UTF-16 encodes each Unicode code point with either one or two UChar code units.
+ * (This is the default form of Unicode, and a forward-compatible extension of the original,
+ * fixed-width form that was known as UCS-2. UTF-16 superseded UCS-2 with Unicode 2.0
+ * in 1996.)
+ *
+ * Some APIs accept a 32-bit UChar32 value for a single code point.
+ *
+ * ICU also handles 16-bit Unicode text with unpaired surrogates.
+ * Such text is not well-formed UTF-16.
+ * Code-point-related functions treat unpaired surrogates as surrogate code points,
+ * i.e., as separate units.
+ *
+ * Although UTF-16 is a variable-width encoding form (like some legacy multi-byte encodings),
+ * it is much more efficient even for random access because the code unit values
+ * for single-unit characters vs. lead units vs. trail units are completely disjoint.
+ * This means that it is easy to determine character (code point) boundaries from
+ * random offsets in the string.
+ *
+ * Unicode (UTF-16) string processing is optimized for the single-unit case.
+ * Although it is important to support supplementary characters
+ * (which use pairs of lead/trail code units called "surrogates"),
+ * their occurrence is rare. Almost all characters in modern use require only
+ * a single UChar code unit (i.e., their code point values are <=0xffff).
+ *
+ * For more details see the User Guide Strings chapter (http://icu-project.org/userguide/strings.html).
+ * For a discussion of the handling of unpaired surrogates see also
+ * Jitterbug 2145 and its icu mailing list proposal on 2002-sep-18.
+ */
+
+/**
+ * \defgroup ustring_ustrlen String Length
+ * \ingroup ustring_strlen
+ */
+/*@{*/
+/**
+ * Determine the length of an array of UChar.
+ *
+ * @param s The array of UChars, NULL (U+0000) terminated.
+ * @return The number of UChars in <code>chars</code>, minus the terminator.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strlen(const UChar *s);
+/*@}*/
+
+/**
+ * Count Unicode code points in the length UChar code units of the string.
+ * A code point may occupy either one or two UChar code units.
+ * Counting code points involves reading all code units.
+ *
+ * This functions is basically the inverse of the U16_FWD_N() macro (see utf.h).
+ *
+ * @param s The input string.
+ * @param length The number of UChar code units to be checked, or -1 to count all
+ *               code points before the first NUL (U+0000).
+ * @return The number of code points in the specified code units.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_countChar32(const UChar *s, int32_t length);
+
+/**
+ * Check if the string contains more Unicode code points than a certain number.
+ * This is more efficient than counting all code points in the entire string
+ * and comparing that number with a threshold.
+ * This function may not need to scan the string at all if the length is known
+ * (not -1 for NUL-termination) and falls within a certain range, and
+ * never needs to count more than 'number+1' code points.
+ * Logically equivalent to (u_countChar32(s, length)>number).
+ * A Unicode code point may occupy either one or two UChar code units.
+ *
+ * @param s The input string.
+ * @param length The length of the string, or -1 if it is NUL-terminated.
+ * @param number The number of code points in the string is compared against
+ *               the 'number' parameter.
+ * @return Boolean value for whether the string contains more Unicode code points
+ *         than 'number'. Same as (u_countChar32(s, length)>number).
+ * @stable ICU 2.4
+ */
+U_STABLE UBool U_EXPORT2
+u_strHasMoreChar32Than(const UChar *s, int32_t length, int32_t number);
+
+/**
+ * Concatenate two ustrings.  Appends a copy of <code>src</code>,
+ * including the null terminator, to <code>dst</code>. The initial copied
+ * character from <code>src</code> overwrites the null terminator in <code>dst</code>.
+ *
+ * @param dst The destination string.
+ * @param src The source string.
+ * @return A pointer to <code>dst</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2
+u_strcat(UChar     *dst, 
+    const UChar     *src);
+
+/**
+ * Concatenate two ustrings.  
+ * Appends at most <code>n</code> characters from <code>src</code> to <code>dst</code>.
+ * Adds a terminating NUL.
+ * If src is too long, then only <code>n-1</code> characters will be copied
+ * before the terminating NUL.
+ * If <code>n&lt;=0</code> then dst is not modified.
+ *
+ * @param dst The destination string.
+ * @param src The source string (can be NULL/invalid if n<=0).
+ * @param n The maximum number of characters to append; no-op if <=0.
+ * @return A pointer to <code>dst</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2
+u_strncat(UChar     *dst, 
+     const UChar     *src, 
+     int32_t     n);
+
+/**
+ * Find the first occurrence of a substring in a string.
+ * The substring is found at code point boundaries.
+ * That means that if the substring begins with
+ * a trail surrogate or ends with a lead surrogate,
+ * then it is found only if these surrogates stand alone in the text.
+ * Otherwise, the substring edge units would be matched against
+ * halves of surrogate pairs.
+ *
+ * @param s The string to search (NUL-terminated).
+ * @param substring The substring to find (NUL-terminated).
+ * @return A pointer to the first occurrence of <code>substring</code> in <code>s</code>,
+ *         or <code>s</code> itself if the <code>substring</code> is empty,
+ *         or <code>NULL</code> if <code>substring</code> is not in <code>s</code>.
+ * @stable ICU 2.0
+ *
+ * @see u_strrstr
+ * @see u_strFindFirst
+ * @see u_strFindLast
+ */
+U_STABLE UChar * U_EXPORT2
+u_strstr(const UChar *s, const UChar *substring);
+
+/**
+ * Find the first occurrence of a substring in a string.
+ * The substring is found at code point boundaries.
+ * That means that if the substring begins with
+ * a trail surrogate or ends with a lead surrogate,
+ * then it is found only if these surrogates stand alone in the text.
+ * Otherwise, the substring edge units would be matched against
+ * halves of surrogate pairs.
+ *
+ * @param s The string to search.
+ * @param length The length of s (number of UChars), or -1 if it is NUL-terminated.
+ * @param substring The substring to find (NUL-terminated).
+ * @param subLength The length of substring (number of UChars), or -1 if it is NUL-terminated.
+ * @return A pointer to the first occurrence of <code>substring</code> in <code>s</code>,
+ *         or <code>s</code> itself if the <code>substring</code> is empty,
+ *         or <code>NULL</code> if <code>substring</code> is not in <code>s</code>.
+ * @stable ICU 2.4
+ *
+ * @see u_strstr
+ * @see u_strFindLast
+ */
+U_STABLE UChar * U_EXPORT2
+u_strFindFirst(const UChar *s, int32_t length, const UChar *substring, int32_t subLength);
+
+/**
+ * Find the first occurrence of a BMP code point in a string.
+ * A surrogate code point is found only if its match in the text is not
+ * part of a surrogate pair.
+ * A NUL character is found at the string terminator.
+ *
+ * @param s The string to search (NUL-terminated).
+ * @param c The BMP code point to find.
+ * @return A pointer to the first occurrence of <code>c</code> in <code>s</code>
+ *         or <code>NULL</code> if <code>c</code> is not in <code>s</code>.
+ * @stable ICU 2.0
+ *
+ * @see u_strchr32
+ * @see u_memchr
+ * @see u_strstr
+ * @see u_strFindFirst
+ */
+U_STABLE UChar * U_EXPORT2
+u_strchr(const UChar *s, UChar c);
+
+/**
+ * Find the first occurrence of a code point in a string.
+ * A surrogate code point is found only if its match in the text is not
+ * part of a surrogate pair.
+ * A NUL character is found at the string terminator.
+ *
+ * @param s The string to search (NUL-terminated).
+ * @param c The code point to find.
+ * @return A pointer to the first occurrence of <code>c</code> in <code>s</code>
+ *         or <code>NULL</code> if <code>c</code> is not in <code>s</code>.
+ * @stable ICU 2.0
+ *
+ * @see u_strchr
+ * @see u_memchr32
+ * @see u_strstr
+ * @see u_strFindFirst
+ */
+U_STABLE UChar * U_EXPORT2
+u_strchr32(const UChar *s, UChar32 c);
+
+/**
+ * Find the last occurrence of a substring in a string.
+ * The substring is found at code point boundaries.
+ * That means that if the substring begins with
+ * a trail surrogate or ends with a lead surrogate,
+ * then it is found only if these surrogates stand alone in the text.
+ * Otherwise, the substring edge units would be matched against
+ * halves of surrogate pairs.
+ *
+ * @param s The string to search (NUL-terminated).
+ * @param substring The substring to find (NUL-terminated).
+ * @return A pointer to the last occurrence of <code>substring</code> in <code>s</code>,
+ *         or <code>s</code> itself if the <code>substring</code> is empty,
+ *         or <code>NULL</code> if <code>substring</code> is not in <code>s</code>.
+ * @stable ICU 2.4
+ *
+ * @see u_strstr
+ * @see u_strFindFirst
+ * @see u_strFindLast
+ */
+U_STABLE UChar * U_EXPORT2
+u_strrstr(const UChar *s, const UChar *substring);
+
+/**
+ * Find the last occurrence of a substring in a string.
+ * The substring is found at code point boundaries.
+ * That means that if the substring begins with
+ * a trail surrogate or ends with a lead surrogate,
+ * then it is found only if these surrogates stand alone in the text.
+ * Otherwise, the substring edge units would be matched against
+ * halves of surrogate pairs.
+ *
+ * @param s The string to search.
+ * @param length The length of s (number of UChars), or -1 if it is NUL-terminated.
+ * @param substring The substring to find (NUL-terminated).
+ * @param subLength The length of substring (number of UChars), or -1 if it is NUL-terminated.
+ * @return A pointer to the last occurrence of <code>substring</code> in <code>s</code>,
+ *         or <code>s</code> itself if the <code>substring</code> is empty,
+ *         or <code>NULL</code> if <code>substring</code> is not in <code>s</code>.
+ * @stable ICU 2.4
+ *
+ * @see u_strstr
+ * @see u_strFindLast
+ */
+U_STABLE UChar * U_EXPORT2
+u_strFindLast(const UChar *s, int32_t length, const UChar *substring, int32_t subLength);
+
+/**
+ * Find the last occurrence of a BMP code point in a string.
+ * A surrogate code point is found only if its match in the text is not
+ * part of a surrogate pair.
+ * A NUL character is found at the string terminator.
+ *
+ * @param s The string to search (NUL-terminated).
+ * @param c The BMP code point to find.
+ * @return A pointer to the last occurrence of <code>c</code> in <code>s</code>
+ *         or <code>NULL</code> if <code>c</code> is not in <code>s</code>.
+ * @stable ICU 2.4
+ *
+ * @see u_strrchr32
+ * @see u_memrchr
+ * @see u_strrstr
+ * @see u_strFindLast
+ */
+U_STABLE UChar * U_EXPORT2
+u_strrchr(const UChar *s, UChar c);
+
+/**
+ * Find the last occurrence of a code point in a string.
+ * A surrogate code point is found only if its match in the text is not
+ * part of a surrogate pair.
+ * A NUL character is found at the string terminator.
+ *
+ * @param s The string to search (NUL-terminated).
+ * @param c The code point to find.
+ * @return A pointer to the last occurrence of <code>c</code> in <code>s</code>
+ *         or <code>NULL</code> if <code>c</code> is not in <code>s</code>.
+ * @stable ICU 2.4
+ *
+ * @see u_strrchr
+ * @see u_memchr32
+ * @see u_strrstr
+ * @see u_strFindLast
+ */
+U_STABLE UChar * U_EXPORT2
+u_strrchr32(const UChar *s, UChar32 c);
+
+/**
+ * Locates the first occurrence in the string <code>string</code> of any of the characters
+ * in the string <code>matchSet</code>.
+ * Works just like C's strpbrk but with Unicode.
+ *
+ * @param string The string in which to search, NUL-terminated.
+ * @param matchSet A NUL-terminated string defining a set of code points
+ *                 for which to search in the text string.
+ * @return A pointer to the  character in <code>string</code> that matches one of the
+ *         characters in <code>matchSet</code>, or NULL if no such character is found.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar * U_EXPORT2
+u_strpbrk(const UChar *string, const UChar *matchSet);
+
+/**
+ * Returns the number of consecutive characters in <code>string</code>,
+ * beginning with the first, that do not occur somewhere in <code>matchSet</code>.
+ * Works just like C's strcspn but with Unicode.
+ *
+ * @param string The string in which to search, NUL-terminated.
+ * @param matchSet A NUL-terminated string defining a set of code points
+ *                 for which to search in the text string.
+ * @return The number of initial characters in <code>string</code> that do not
+ *         occur in <code>matchSet</code>.
+ * @see u_strspn
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strcspn(const UChar *string, const UChar *matchSet);
+
+/**
+ * Returns the number of consecutive characters in <code>string</code>,
+ * beginning with the first, that occur somewhere in <code>matchSet</code>.
+ * Works just like C's strspn but with Unicode.
+ *
+ * @param string The string in which to search, NUL-terminated.
+ * @param matchSet A NUL-terminated string defining a set of code points
+ *                 for which to search in the text string.
+ * @return The number of initial characters in <code>string</code> that do
+ *         occur in <code>matchSet</code>.
+ * @see u_strcspn
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strspn(const UChar *string, const UChar *matchSet);
+
+/**
+ * The string tokenizer API allows an application to break a string into
+ * tokens. Unlike strtok(), the saveState (the current pointer within the
+ * original string) is maintained in saveState. In the first call, the
+ * argument src is a pointer to the string. In subsequent calls to
+ * return successive tokens of that string, src must be specified as
+ * NULL. The value saveState is set by this function to maintain the
+ * function's position within the string, and on each subsequent call
+ * you must give this argument the same variable. This function does
+ * handle surrogate pairs. This function is similar to the strtok_r()
+ * the POSIX Threads Extension (1003.1c-1995) version.
+ *
+ * @param src String containing token(s). This string will be modified.
+ *            After the first call to u_strtok_r(), this argument must
+ *            be NULL to get to the next token.
+ * @param delim Set of delimiter characters (Unicode code points).
+ * @param saveState The current pointer within the original string,
+ *              which is set by this function. The saveState
+ *              parameter should the address of a local variable of type
+ *              UChar *. (i.e. defined "Uhar *myLocalSaveState" and use
+ *              &myLocalSaveState for this parameter).
+ * @return A pointer to the next token found in src, or NULL
+ *         when there are no more tokens.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar * U_EXPORT2
+u_strtok_r(UChar    *src, 
+     const UChar    *delim,
+           UChar   **saveState);
+
+/**
+ * Compare two Unicode strings for bitwise equality (code unit order).
+ *
+ * @param s1 A string to compare.
+ * @param s2 A string to compare.
+ * @return 0 if <code>s1</code> and <code>s2</code> are bitwise equal; a negative
+ * value if <code>s1</code> is bitwise less than <code>s2,</code>; a positive
+ * value if <code>s1</code> is bitwise greater than <code>s2</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t  U_EXPORT2
+u_strcmp(const UChar     *s1, 
+         const UChar     *s2);
+
+/**
+ * Compare two Unicode strings in code point order.
+ * See u_strCompare for details.
+ *
+ * @param s1 A string to compare.
+ * @param s2 A string to compare.
+ * @return a negative/zero/positive integer corresponding to whether
+ * the first string is less than/equal to/greater than the second one
+ * in code point order
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strcmpCodePointOrder(const UChar *s1, const UChar *s2);
+
+/**
+ * Compare two Unicode strings (binary order).
+ *
+ * The comparison can be done in code unit order or in code point order.
+ * They differ only in UTF-16 when
+ * comparing supplementary code points (U+10000..U+10ffff)
+ * to BMP code points near the end of the BMP (i.e., U+e000..U+ffff).
+ * In code unit order, high BMP code points sort after supplementary code points
+ * because they are stored as pairs of surrogates which are at U+d800..U+dfff.
+ *
+ * This functions works with strings of different explicitly specified lengths
+ * unlike the ANSI C-like u_strcmp() and u_memcmp() etc.
+ * NUL-terminated strings are possible with length arguments of -1.
+ *
+ * @param s1 First source string.
+ * @param length1 Length of first source string, or -1 if NUL-terminated.
+ *
+ * @param s2 Second source string.
+ * @param length2 Length of second source string, or -1 if NUL-terminated.
+ *
+ * @param codePointOrder Choose between code unit order (FALSE)
+ *                       and code point order (TRUE).
+ *
+ * @return <0 or 0 or >0 as usual for string comparisons
+ *
+ * @stable ICU 2.2
+ */
+U_STABLE int32_t U_EXPORT2
+u_strCompare(const UChar *s1, int32_t length1,
+             const UChar *s2, int32_t length2,
+             UBool codePointOrder);
+
+/**
+ * Compare two Unicode strings (binary order)
+ * as presented by UCharIterator objects.
+ * Works otherwise just like u_strCompare().
+ *
+ * Both iterators are reset to their start positions.
+ * When the function returns, it is undefined where the iterators
+ * have stopped.
+ *
+ * @param iter1 First source string iterator.
+ * @param iter2 Second source string iterator.
+ * @param codePointOrder Choose between code unit order (FALSE)
+ *                       and code point order (TRUE).
+ *
+ * @return <0 or 0 or >0 as usual for string comparisons
+ *
+ * @see u_strCompare
+ *
+ * @stable ICU 2.6
+ */
+U_STABLE int32_t U_EXPORT2
+u_strCompareIter(UCharIterator *iter1, UCharIterator *iter2, UBool codePointOrder);
+
+#ifndef U_COMPARE_CODE_POINT_ORDER
+/* see also unistr.h and unorm.h */
+/**
+ * Option bit for u_strCaseCompare, u_strcasecmp, unorm_compare, etc:
+ * Compare strings in code point order instead of code unit order.
+ * @stable ICU 2.2
+ */
+#define U_COMPARE_CODE_POINT_ORDER  0x8000
+#endif
+
+/**
+ * Compare two strings case-insensitively using full case folding.
+ * This is equivalent to
+ *   u_strCompare(u_strFoldCase(s1, options),
+ *                u_strFoldCase(s2, options),
+ *                (options&U_COMPARE_CODE_POINT_ORDER)!=0).
+ *
+ * The comparison can be done in UTF-16 code unit order or in code point order.
+ * They differ only when comparing supplementary code points (U+10000..U+10ffff)
+ * to BMP code points near the end of the BMP (i.e., U+e000..U+ffff).
+ * In code unit order, high BMP code points sort after supplementary code points
+ * because they are stored as pairs of surrogates which are at U+d800..U+dfff.
+ *
+ * This functions works with strings of different explicitly specified lengths
+ * unlike the ANSI C-like u_strcmp() and u_memcmp() etc.
+ * NUL-terminated strings are possible with length arguments of -1.
+ *
+ * @param s1 First source string.
+ * @param length1 Length of first source string, or -1 if NUL-terminated.
+ *
+ * @param s2 Second source string.
+ * @param length2 Length of second source string, or -1 if NUL-terminated.
+ *
+ * @param options A bit set of options:
+ *   - U_FOLD_CASE_DEFAULT or 0 is used for default options:
+ *     Comparison in code unit order with default case folding.
+ *
+ *   - U_COMPARE_CODE_POINT_ORDER
+ *     Set to choose code point order instead of code unit order
+ *     (see u_strCompare for details).
+ *
+ *   - U_FOLD_CASE_EXCLUDE_SPECIAL_I
+ *
+ * @param pErrorCode Must be a valid pointer to an error code value,
+ *                  which must not indicate a failure before the function call.
+ *
+ * @return <0 or 0 or >0 as usual for string comparisons
+ *
+ * @stable ICU 2.2
+ */
+U_STABLE int32_t U_EXPORT2
+u_strCaseCompare(const UChar *s1, int32_t length1,
+                 const UChar *s2, int32_t length2,
+                 uint32_t options,
+                 UErrorCode *pErrorCode);
+
+/**
+ * Compare two ustrings for bitwise equality. 
+ * Compares at most <code>n</code> characters.
+ *
+ * @param ucs1 A string to compare (can be NULL/invalid if n<=0).
+ * @param ucs2 A string to compare (can be NULL/invalid if n<=0).
+ * @param n The maximum number of characters to compare; always returns 0 if n<=0.
+ * @return 0 if <code>s1</code> and <code>s2</code> are bitwise equal; a negative
+ * value if <code>s1</code> is bitwise less than <code>s2</code>; a positive
+ * value if <code>s1</code> is bitwise greater than <code>s2</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strncmp(const UChar     *ucs1, 
+     const UChar     *ucs2, 
+     int32_t     n);
+
+/**
+ * Compare two Unicode strings in code point order.
+ * This is different in UTF-16 from u_strncmp() if supplementary characters are present.
+ * For details, see u_strCompare().
+ *
+ * @param s1 A string to compare.
+ * @param s2 A string to compare.
+ * @param n The maximum number of characters to compare.
+ * @return a negative/zero/positive integer corresponding to whether
+ * the first string is less than/equal to/greater than the second one
+ * in code point order
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strncmpCodePointOrder(const UChar *s1, const UChar *s2, int32_t n);
+
+/**
+ * Compare two strings case-insensitively using full case folding.
+ * This is equivalent to u_strcmp(u_strFoldCase(s1, options), u_strFoldCase(s2, options)).
+ *
+ * @param s1 A string to compare.
+ * @param s2 A string to compare.
+ * @param options A bit set of options:
+ *   - U_FOLD_CASE_DEFAULT or 0 is used for default options:
+ *     Comparison in code unit order with default case folding.
+ *
+ *   - U_COMPARE_CODE_POINT_ORDER
+ *     Set to choose code point order instead of code unit order
+ *     (see u_strCompare for details).
+ *
+ *   - U_FOLD_CASE_EXCLUDE_SPECIAL_I
+ *
+ * @return A negative, zero, or positive integer indicating the comparison result.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strcasecmp(const UChar *s1, const UChar *s2, uint32_t options);
+
+/**
+ * Compare two strings case-insensitively using full case folding.
+ * This is equivalent to u_strcmp(u_strFoldCase(s1, at most n, options),
+ * u_strFoldCase(s2, at most n, options)).
+ *
+ * @param s1 A string to compare.
+ * @param s2 A string to compare.
+ * @param n The maximum number of characters each string to case-fold and then compare.
+ * @param options A bit set of options:
+ *   - U_FOLD_CASE_DEFAULT or 0 is used for default options:
+ *     Comparison in code unit order with default case folding.
+ *
+ *   - U_COMPARE_CODE_POINT_ORDER
+ *     Set to choose code point order instead of code unit order
+ *     (see u_strCompare for details).
+ *
+ *   - U_FOLD_CASE_EXCLUDE_SPECIAL_I
+ *
+ * @return A negative, zero, or positive integer indicating the comparison result.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strncasecmp(const UChar *s1, const UChar *s2, int32_t n, uint32_t options);
+
+/**
+ * Compare two strings case-insensitively using full case folding.
+ * This is equivalent to u_strcmp(u_strFoldCase(s1, n, options),
+ * u_strFoldCase(s2, n, options)).
+ *
+ * @param s1 A string to compare.
+ * @param s2 A string to compare.
+ * @param length The number of characters in each string to case-fold and then compare.
+ * @param options A bit set of options:
+ *   - U_FOLD_CASE_DEFAULT or 0 is used for default options:
+ *     Comparison in code unit order with default case folding.
+ *
+ *   - U_COMPARE_CODE_POINT_ORDER
+ *     Set to choose code point order instead of code unit order
+ *     (see u_strCompare for details).
+ *
+ *   - U_FOLD_CASE_EXCLUDE_SPECIAL_I
+ *
+ * @return A negative, zero, or positive integer indicating the comparison result.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_memcasecmp(const UChar *s1, const UChar *s2, int32_t length, uint32_t options);
+
+/**
+ * Copy a ustring. Adds a null terminator.
+ *
+ * @param dst The destination string.
+ * @param src The source string.
+ * @return A pointer to <code>dst</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2
+u_strcpy(UChar     *dst, 
+    const UChar     *src);
+
+/**
+ * Copy a ustring.
+ * Copies at most <code>n</code> characters.  The result will be null terminated
+ * if the length of <code>src</code> is less than <code>n</code>.
+ *
+ * @param dst The destination string.
+ * @param src The source string (can be NULL/invalid if n<=0).
+ * @param n The maximum number of characters to copy; no-op if <=0.
+ * @return A pointer to <code>dst</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2
+u_strncpy(UChar     *dst, 
+     const UChar     *src, 
+     int32_t     n);
+
+#if !UCONFIG_NO_CONVERSION
+
+/**
+ * Copy a byte string encoded in the default codepage to a ustring.
+ * Adds a null terminator.
+ * Performs a host byte to UChar conversion
+ *
+ * @param dst The destination string.
+ * @param src The source string.
+ * @return A pointer to <code>dst</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2 u_uastrcpy(UChar *dst,
+               const char *src );
+
+/**
+ * Copy a byte string encoded in the default codepage to a ustring.
+ * Copies at most <code>n</code> characters.  The result will be null terminated
+ * if the length of <code>src</code> is less than <code>n</code>.
+ * Performs a host byte to UChar conversion
+ *
+ * @param dst The destination string.
+ * @param src The source string.
+ * @param n The maximum number of characters to copy.
+ * @return A pointer to <code>dst</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2 u_uastrncpy(UChar *dst,
+            const char *src,
+            int32_t n);
+
+/**
+ * Copy ustring to a byte string encoded in the default codepage.
+ * Adds a null terminator.
+ * Performs a UChar to host byte conversion
+ *
+ * @param dst The destination string.
+ * @param src The source string.
+ * @return A pointer to <code>dst</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE char* U_EXPORT2 u_austrcpy(char *dst,
+            const UChar *src );
+
+/**
+ * Copy ustring to a byte string encoded in the default codepage.
+ * Copies at most <code>n</code> characters.  The result will be null terminated
+ * if the length of <code>src</code> is less than <code>n</code>.
+ * Performs a UChar to host byte conversion
+ *
+ * @param dst The destination string.
+ * @param src The source string.
+ * @param n The maximum number of characters to copy.
+ * @return A pointer to <code>dst</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE char* U_EXPORT2 u_austrncpy(char *dst,
+            const UChar *src,
+            int32_t n );
+
+#endif
+
+/**
+ * Synonym for memcpy(), but with UChars only.
+ * @param dest The destination string
+ * @param src The source string (can be NULL/invalid if count<=0)
+ * @param count The number of characters to copy; no-op if <=0
+ * @return A pointer to <code>dest</code>
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2
+u_memcpy(UChar *dest, const UChar *src, int32_t count);
+
+/**
+ * Synonym for memmove(), but with UChars only.
+ * @param dest The destination string
+ * @param src The source string (can be NULL/invalid if count<=0)
+ * @param count The number of characters to move; no-op if <=0
+ * @return A pointer to <code>dest</code>
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2
+u_memmove(UChar *dest, const UChar *src, int32_t count);
+
+/**
+ * Initialize <code>count</code> characters of <code>dest</code> to <code>c</code>.
+ *
+ * @param dest The destination string.
+ * @param c The character to initialize the string.
+ * @param count The maximum number of characters to set.
+ * @return A pointer to <code>dest</code>.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2
+u_memset(UChar *dest, UChar c, int32_t count);
+
+/**
+ * Compare the first <code>count</code> UChars of each buffer.
+ *
+ * @param buf1 The first string to compare.
+ * @param buf2 The second string to compare.
+ * @param count The maximum number of UChars to compare.
+ * @return When buf1 < buf2, a negative number is returned.
+ *      When buf1 == buf2, 0 is returned.
+ *      When buf1 > buf2, a positive number is returned.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_memcmp(const UChar *buf1, const UChar *buf2, int32_t count);
+
+/**
+ * Compare two Unicode strings in code point order.
+ * This is different in UTF-16 from u_memcmp() if supplementary characters are present.
+ * For details, see u_strCompare().
+ *
+ * @param s1 A string to compare.
+ * @param s2 A string to compare.
+ * @param count The maximum number of characters to compare.
+ * @return a negative/zero/positive integer corresponding to whether
+ * the first string is less than/equal to/greater than the second one
+ * in code point order
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_memcmpCodePointOrder(const UChar *s1, const UChar *s2, int32_t count);
+
+/**
+ * Find the first occurrence of a BMP code point in a string.
+ * A surrogate code point is found only if its match in the text is not
+ * part of a surrogate pair.
+ * A NUL character is found at the string terminator.
+ *
+ * @param s The string to search (contains <code>count</code> UChars).
+ * @param c The BMP code point to find.
+ * @param count The length of the string.
+ * @return A pointer to the first occurrence of <code>c</code> in <code>s</code>
+ *         or <code>NULL</code> if <code>c</code> is not in <code>s</code>.
+ * @stable ICU 2.0
+ *
+ * @see u_strchr
+ * @see u_memchr32
+ * @see u_strFindFirst
+ */
+U_STABLE UChar* U_EXPORT2
+u_memchr(const UChar *s, UChar c, int32_t count);
+
+/**
+ * Find the first occurrence of a code point in a string.
+ * A surrogate code point is found only if its match in the text is not
+ * part of a surrogate pair.
+ * A NUL character is found at the string terminator.
+ *
+ * @param s The string to search (contains <code>count</code> UChars).
+ * @param c The code point to find.
+ * @param count The length of the string.
+ * @return A pointer to the first occurrence of <code>c</code> in <code>s</code>
+ *         or <code>NULL</code> if <code>c</code> is not in <code>s</code>.
+ * @stable ICU 2.0
+ *
+ * @see u_strchr32
+ * @see u_memchr
+ * @see u_strFindFirst
+ */
+U_STABLE UChar* U_EXPORT2
+u_memchr32(const UChar *s, UChar32 c, int32_t count);
+
+/**
+ * Find the last occurrence of a BMP code point in a string.
+ * A surrogate code point is found only if its match in the text is not
+ * part of a surrogate pair.
+ * A NUL character is found at the string terminator.
+ *
+ * @param s The string to search (contains <code>count</code> UChars).
+ * @param c The BMP code point to find.
+ * @param count The length of the string.
+ * @return A pointer to the last occurrence of <code>c</code> in <code>s</code>
+ *         or <code>NULL</code> if <code>c</code> is not in <code>s</code>.
+ * @stable ICU 2.4
+ *
+ * @see u_strrchr
+ * @see u_memrchr32
+ * @see u_strFindLast
+ */
+U_STABLE UChar* U_EXPORT2
+u_memrchr(const UChar *s, UChar c, int32_t count);
+
+/**
+ * Find the last occurrence of a code point in a string.
+ * A surrogate code point is found only if its match in the text is not
+ * part of a surrogate pair.
+ * A NUL character is found at the string terminator.
+ *
+ * @param s The string to search (contains <code>count</code> UChars).
+ * @param c The code point to find.
+ * @param count The length of the string.
+ * @return A pointer to the last occurrence of <code>c</code> in <code>s</code>
+ *         or <code>NULL</code> if <code>c</code> is not in <code>s</code>.
+ * @stable ICU 2.4
+ *
+ * @see u_strrchr32
+ * @see u_memrchr
+ * @see u_strFindLast
+ */
+U_STABLE UChar* U_EXPORT2
+u_memrchr32(const UChar *s, UChar32 c, int32_t count);
+
+/**
+ * Unicode String literals in C.
+ * We need one macro to declare a variable for the string
+ * and to statically preinitialize it if possible,
+ * and a second macro to dynamically intialize such a string variable if necessary.
+ *
+ * The macros are defined for maximum performance.
+ * They work only for strings that contain "invariant characters", i.e.,
+ * only latin letters, digits, and some punctuation.
+ * See utypes.h for details.
+ *
+ * A pair of macros for a single string must be used with the same
+ * parameters.
+ * The string parameter must be a C string literal.
+ * The length of the string, not including the terminating
+ * <code>NUL</code>, must be specified as a constant.
+ * The U_STRING_DECL macro should be invoked exactly once for one
+ * such string variable before it is used.
+ *
+ * Usage:
+ * <pre>
+ *    U_STRING_DECL(ustringVar1, "Quick-Fox 2", 11);
+ *    U_STRING_DECL(ustringVar2, "jumps 5%", 8);
+ *    static UBool didInit=FALSE;
+ * 
+ *    int32_t function() {
+ *        if(!didInit) {
+ *            U_STRING_INIT(ustringVar1, "Quick-Fox 2", 11);
+ *            U_STRING_INIT(ustringVar2, "jumps 5%", 8);
+ *            didInit=TRUE;
+ *        }
+ *        return u_strcmp(ustringVar1, ustringVar2);
+ *    }
+ * </pre>
+ * 
+ * Note that the macros will NOT consistently work if their argument is another <code>#define</code>. 
+ *  The following will not work on all platforms, don't use it.
+ * 
+ * <pre>
+ *     #define GLUCK "Mr. Gluck"
+ *     U_STRING_DECL(var, GLUCK, 9)
+ *     U_STRING_INIT(var, GLUCK, 9)
+ * </pre>
+ * 
+ * Instead, use the string literal "Mr. Gluck"  as the argument to both macro
+ * calls.
+ *
+ *
+ * @stable ICU 2.0
+ */
+#if defined(U_DECLARE_UTF16)
+#   define U_STRING_DECL(var, cs, length) static const UChar *var=(const UChar *)U_DECLARE_UTF16(cs)
+    /**@stable ICU 2.0 */
+#   define U_STRING_INIT(var, cs, length)
+#elif U_SIZEOF_WCHAR_T==U_SIZEOF_UCHAR && (U_CHARSET_FAMILY==U_ASCII_FAMILY || (U_SIZEOF_UCHAR == 2 && defined(U_WCHAR_IS_UTF16)))
+#   define U_STRING_DECL(var, cs, length) static const UChar var[(length)+1]=L ## cs
+    /**@stable ICU 2.0 */
+#   define U_STRING_INIT(var, cs, length)
+#elif U_SIZEOF_UCHAR==1 && U_CHARSET_FAMILY==U_ASCII_FAMILY
+#   define U_STRING_DECL(var, cs, length) static const UChar var[(length)+1]=cs
+    /**@stable ICU 2.0 */
+#   define U_STRING_INIT(var, cs, length)
+#else
+#   define U_STRING_DECL(var, cs, length) static UChar var[(length)+1]
+    /**@stable ICU 2.0 */
+#   define U_STRING_INIT(var, cs, length) u_charsToUChars(cs, var, length+1)
+#endif
+
+/**
+ * Unescape a string of characters and write the resulting
+ * Unicode characters to the destination buffer.  The following escape
+ * sequences are recognized:
+ *
+ * \\uhhhh       4 hex digits; h in [0-9A-Fa-f]
+ * \\Uhhhhhhhh   8 hex digits
+ * \\xhh         1-2 hex digits
+ * \\x{h...}     1-8 hex digits
+ * \\ooo         1-3 octal digits; o in [0-7]
+ * \\cX          control-X; X is masked with 0x1F
+ *
+ * as well as the standard ANSI C escapes:
+ *
+ * \\a => U+0007, \\b => U+0008, \\t => U+0009, \\n => U+000A,
+ * \\v => U+000B, \\f => U+000C, \\r => U+000D, \\e => U+001B,
+ * \\&quot; => U+0022, \\' => U+0027, \\? => U+003F, \\\\ => U+005C
+ *
+ * Anything else following a backslash is generically escaped.  For
+ * example, "[a\\-z]" returns "[a-z]".
+ *
+ * If an escape sequence is ill-formed, this method returns an empty
+ * string.  An example of an ill-formed sequence is "\\u" followed by
+ * fewer than 4 hex digits.
+ *
+ * The above characters are recognized in the compiler's codepage,
+ * that is, they are coded as 'u', '\\', etc.  Characters that are
+ * not parts of escape sequences are converted using u_charsToUChars().
+ *
+ * This function is similar to UnicodeString::unescape() but not
+ * identical to it.  The latter takes a source UnicodeString, so it
+ * does escape recognition but no conversion.
+ *
+ * @param src a zero-terminated string of invariant characters
+ * @param dest pointer to buffer to receive converted and unescaped
+ * text and, if there is room, a zero terminator.  May be NULL for
+ * preflighting, in which case no UChars will be written, but the
+ * return value will still be valid.  On error, an empty string is
+ * stored here (if possible).
+ * @param destCapacity the number of UChars that may be written at
+ * dest.  Ignored if dest == NULL.
+ * @return the length of unescaped string.
+ * @see u_unescapeAt
+ * @see UnicodeString#unescape()
+ * @see UnicodeString#unescapeAt()
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_unescape(const char *src,
+           UChar *dest, int32_t destCapacity);
+
+U_CDECL_BEGIN
+/**
+ * Callback function for u_unescapeAt() that returns a character of
+ * the source text given an offset and a context pointer.  The context
+ * pointer will be whatever is passed into u_unescapeAt().
+ *
+ * @param offset pointer to the offset that will be passed to u_unescapeAt().
+ * @param context an opaque pointer passed directly into u_unescapeAt()
+ * @return the character represented by the escape sequence at
+ * offset
+ * @see u_unescapeAt
+ * @stable ICU 2.0
+ */
+typedef UChar (U_CALLCONV *UNESCAPE_CHAR_AT)(int32_t offset, void *context);
+U_CDECL_END
+
+/**
+ * Unescape a single sequence. The character at offset-1 is assumed
+ * (without checking) to be a backslash.  This method takes a callback
+ * pointer to a function that returns the UChar at a given offset.  By
+ * varying this callback, ICU functions are able to unescape char*
+ * strings, UnicodeString objects, and UFILE pointers.
+ *
+ * If offset is out of range, or if the escape sequence is ill-formed,
+ * (UChar32)0xFFFFFFFF is returned.  See documentation of u_unescape()
+ * for a list of recognized sequences.
+ *
+ * @param charAt callback function that returns a UChar of the source
+ * text given an offset and a context pointer.
+ * @param offset pointer to the offset that will be passed to charAt.
+ * The offset value will be updated upon return to point after the
+ * last parsed character of the escape sequence.  On error the offset
+ * is unchanged.
+ * @param length the number of characters in the source text.  The
+ * last character of the source text is considered to be at offset
+ * length-1.
+ * @param context an opaque pointer passed directly into charAt.
+ * @return the character represented by the escape sequence at
+ * offset, or (UChar32)0xFFFFFFFF on error.
+ * @see u_unescape()
+ * @see UnicodeString#unescape()
+ * @see UnicodeString#unescapeAt()
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32 U_EXPORT2
+u_unescapeAt(UNESCAPE_CHAR_AT charAt,
+             int32_t *offset,
+             int32_t length,
+             void *context);
+
+/**
+ * Uppercase the characters in a string.
+ * Casing is locale-dependent and context-sensitive.
+ * The result may be longer or shorter than the original.
+ * The source string and the destination buffer are allowed to overlap.
+ *
+ * @param dest      A buffer for the result string. The result will be zero-terminated if
+ *                  the buffer is large enough.
+ * @param destCapacity The size of the buffer (number of UChars). If it is 0, then
+ *                  dest may be NULL and the function will only return the length of the result
+ *                  without writing any of the result string.
+ * @param src       The original string
+ * @param srcLength The length of the original string. If -1, then src must be zero-terminated.
+ * @param locale    The locale to consider, or "" for the root locale or NULL for the default locale.
+ * @param pErrorCode Must be a valid pointer to an error code value,
+ *                  which must not indicate a failure before the function call.
+ * @return The length of the result string. It may be greater than destCapacity. In that case,
+ *         only some of the result was written to the destination buffer.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strToUpper(UChar *dest, int32_t destCapacity,
+             const UChar *src, int32_t srcLength,
+             const char *locale,
+             UErrorCode *pErrorCode);
+
+/**
+ * Lowercase the characters in a string.
+ * Casing is locale-dependent and context-sensitive.
+ * The result may be longer or shorter than the original.
+ * The source string and the destination buffer are allowed to overlap.
+ *
+ * @param dest      A buffer for the result string. The result will be zero-terminated if
+ *                  the buffer is large enough.
+ * @param destCapacity The size of the buffer (number of UChars). If it is 0, then
+ *                  dest may be NULL and the function will only return the length of the result
+ *                  without writing any of the result string.
+ * @param src       The original string
+ * @param srcLength The length of the original string. If -1, then src must be zero-terminated.
+ * @param locale    The locale to consider, or "" for the root locale or NULL for the default locale.
+ * @param pErrorCode Must be a valid pointer to an error code value,
+ *                  which must not indicate a failure before the function call.
+ * @return The length of the result string. It may be greater than destCapacity. In that case,
+ *         only some of the result was written to the destination buffer.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strToLower(UChar *dest, int32_t destCapacity,
+             const UChar *src, int32_t srcLength,
+             const char *locale,
+             UErrorCode *pErrorCode);
+
+#if !UCONFIG_NO_BREAK_ITERATION
+
+/**
+ * Titlecase a string.
+ * Casing is locale-dependent and context-sensitive.
+ * Titlecasing uses a break iterator to find the first characters of words
+ * that are to be titlecased. It titlecases those characters and lowercases
+ * all others.
+ *
+ * The titlecase break iterator can be provided to customize for arbitrary
+ * styles, using rules and dictionaries beyond the standard iterators.
+ * It may be more efficient to always provide an iterator to avoid
+ * opening and closing one for each string.
+ * The standard titlecase iterator for the root locale implements the
+ * algorithm of Unicode TR 21.
+ *
+ * This function uses only the setText(), first() and next() methods of the
+ * provided break iterator.
+ *
+ * The result may be longer or shorter than the original.
+ * The source string and the destination buffer are allowed to overlap.
+ *
+ * @param dest      A buffer for the result string. The result will be zero-terminated if
+ *                  the buffer is large enough.
+ * @param destCapacity The size of the buffer (number of UChars). If it is 0, then
+ *                  dest may be NULL and the function will only return the length of the result
+ *                  without writing any of the result string.
+ * @param src       The original string
+ * @param srcLength The length of the original string. If -1, then src must be zero-terminated.
+ * @param titleIter A break iterator to find the first characters of words
+ *                  that are to be titlecased.
+ *                  If none is provided (NULL), then a standard titlecase
+ *                  break iterator is opened.
+ * @param locale    The locale to consider, or "" for the root locale or NULL for the default locale.
+ * @param pErrorCode Must be a valid pointer to an error code value,
+ *                  which must not indicate a failure before the function call.
+ * @return The length of the result string. It may be greater than destCapacity. In that case,
+ *         only some of the result was written to the destination buffer.
+ * @stable ICU 2.1
+ */
+U_STABLE int32_t U_EXPORT2
+u_strToTitle(UChar *dest, int32_t destCapacity,
+             const UChar *src, int32_t srcLength,
+             UBreakIterator *titleIter,
+             const char *locale,
+             UErrorCode *pErrorCode);
+
+#endif
+
+/**
+ * Case-folds the characters in a string.
+ *
+ * Case-folding is locale-independent and not context-sensitive,
+ * but there is an option for whether to include or exclude mappings for dotted I
+ * and dotless i that are marked with 'T' in CaseFolding.txt.
+ *
+ * The result may be longer or shorter than the original.
+ * The source string and the destination buffer are allowed to overlap.
+ *
+ * @param dest      A buffer for the result string. The result will be zero-terminated if
+ *                  the buffer is large enough.
+ * @param destCapacity The size of the buffer (number of UChars). If it is 0, then
+ *                  dest may be NULL and the function will only return the length of the result
+ *                  without writing any of the result string.
+ * @param src       The original string
+ * @param srcLength The length of the original string. If -1, then src must be zero-terminated.
+ * @param options   Either U_FOLD_CASE_DEFAULT or U_FOLD_CASE_EXCLUDE_SPECIAL_I
+ * @param pErrorCode Must be a valid pointer to an error code value,
+ *                  which must not indicate a failure before the function call.
+ * @return The length of the result string. It may be greater than destCapacity. In that case,
+ *         only some of the result was written to the destination buffer.
+ * @stable ICU 2.0
+ */
+U_STABLE int32_t U_EXPORT2
+u_strFoldCase(UChar *dest, int32_t destCapacity,
+              const UChar *src, int32_t srcLength,
+              uint32_t options,
+              UErrorCode *pErrorCode);
+
+#if defined(U_WCHAR_IS_UTF16) || defined(U_WCHAR_IS_UTF32) || !UCONFIG_NO_CONVERSION
+/**
+ * Convert a UTF-16 string to a wchar_t string.
+ * If it is known at compile time that wchar_t strings are in UTF-16 or UTF-32, then
+ * this function simply calls the fast, dedicated function for that.
+ * Otherwise, two conversions UTF-16 -> default charset -> wchar_t* are performed.
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of wchar_t's). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param pErrorCode    Must be a valid pointer to an error code value,
+ *                      which must not indicate a failure before the function call.
+ * @return The pointer to destination buffer.
+ * @stable ICU 2.0
+ */
+U_STABLE wchar_t* U_EXPORT2
+u_strToWCS(wchar_t *dest, 
+           int32_t destCapacity,
+           int32_t *pDestLength,
+           const UChar *src, 
+           int32_t srcLength,
+           UErrorCode *pErrorCode);
+/**
+ * Convert a wchar_t string to UTF-16.
+ * If it is known at compile time that wchar_t strings are in UTF-16 or UTF-32, then
+ * this function simply calls the fast, dedicated function for that.
+ * Otherwise, two conversions wchar_t* -> default charset -> UTF-16 are performed.
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param pErrorCode    Must be a valid pointer to an error code value,
+ *                      which must not indicate a failure before the function call.
+ * @return The pointer to destination buffer.
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2
+u_strFromWCS(UChar   *dest,
+             int32_t destCapacity, 
+             int32_t *pDestLength,
+             const wchar_t *src,
+             int32_t srcLength,
+             UErrorCode *pErrorCode);
+#endif /* defined(U_WCHAR_IS_UTF16) || defined(U_WCHAR_IS_UTF32) || !UCONFIG_NO_CONVERSION */
+
+/**
+ * Convert a UTF-16 string to UTF-8.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of chars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param pErrorCode    Must be a valid pointer to an error code value,
+ *                      which must not indicate a failure before the function call.
+ * @return The pointer to destination buffer.
+ * @stable ICU 2.0
+ * @see u_strToUTF8WithSub
+ * @see u_strFromUTF8
+ */
+U_STABLE char* U_EXPORT2 
+u_strToUTF8(char *dest,           
+            int32_t destCapacity,
+            int32_t *pDestLength,
+            const UChar *src, 
+            int32_t srcLength,
+            UErrorCode *pErrorCode);
+
+/**
+ * Convert a UTF-8 string to UTF-16.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param pErrorCode    Must be a valid pointer to an error code value,
+ *                      which must not indicate a failure before the function call.
+ * @return The pointer to destination buffer.
+ * @stable ICU 2.0
+ * @see u_strFromUTF8WithSub
+ * @see u_strFromUTF8Lenient
+ */
+U_STABLE UChar* U_EXPORT2
+u_strFromUTF8(UChar *dest,             
+              int32_t destCapacity,
+              int32_t *pDestLength,
+              const char *src, 
+              int32_t srcLength,
+              UErrorCode *pErrorCode);
+
+/**
+ * Convert a UTF-16 string to UTF-8.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * Same as u_strToUTF8() except for the additional subchar which is output for
+ * illegal input sequences, instead of stopping with the U_INVALID_CHAR_FOUND error code.
+ * With subchar==U_SENTINEL, this function behaves exactly like u_strToUTF8().
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of chars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param subchar       The substitution character to use in place of an illegal input sequence,
+ *                      or U_SENTINEL if the function is to return with U_INVALID_CHAR_FOUND instead.
+ *                      A substitution character can be any valid Unicode code point (up to U+10FFFF)
+ *                      except for surrogate code points (U+D800..U+DFFF).
+ *                      The recommended value is U+FFFD "REPLACEMENT CHARACTER".
+ * @param pNumSubstitutions Output parameter receiving the number of substitutions if subchar>=0.
+ *                      Set to 0 if no substitutions occur or subchar<0.
+ *                      pNumSubstitutions can be NULL.
+ * @param pErrorCode    Pointer to a standard ICU error code. Its input value must
+ *                      pass the U_SUCCESS() test, or else the function returns
+ *                      immediately. Check for U_FAILURE() on output or use with
+ *                      function chaining. (See User Guide for details.)
+ * @return The pointer to destination buffer.
+ * @see u_strToUTF8
+ * @see u_strFromUTF8WithSub
+ * @stable ICU 3.6
+ */
+U_STABLE char* U_EXPORT2
+u_strToUTF8WithSub(char *dest,
+            int32_t destCapacity,
+            int32_t *pDestLength,
+            const UChar *src,
+            int32_t srcLength,
+            UChar32 subchar, int32_t *pNumSubstitutions,
+            UErrorCode *pErrorCode);
+
+/**
+ * Convert a UTF-8 string to UTF-16.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * Same as u_strFromUTF8() except for the additional subchar which is output for
+ * illegal input sequences, instead of stopping with the U_INVALID_CHAR_FOUND error code.
+ * With subchar==U_SENTINEL, this function behaves exactly like u_strFromUTF8().
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param subchar       The substitution character to use in place of an illegal input sequence,
+ *                      or U_SENTINEL if the function is to return with U_INVALID_CHAR_FOUND instead.
+ *                      A substitution character can be any valid Unicode code point (up to U+10FFFF)
+ *                      except for surrogate code points (U+D800..U+DFFF).
+ *                      The recommended value is U+FFFD "REPLACEMENT CHARACTER".
+ * @param pNumSubstitutions Output parameter receiving the number of substitutions if subchar>=0.
+ *                      Set to 0 if no substitutions occur or subchar<0.
+ *                      pNumSubstitutions can be NULL.
+ * @param pErrorCode    Pointer to a standard ICU error code. Its input value must
+ *                      pass the U_SUCCESS() test, or else the function returns
+ *                      immediately. Check for U_FAILURE() on output or use with
+ *                      function chaining. (See User Guide for details.)
+ * @return The pointer to destination buffer.
+ * @see u_strFromUTF8
+ * @see u_strFromUTF8Lenient
+ * @see u_strToUTF8WithSub
+ * @stable ICU 3.6
+ */
+U_STABLE UChar* U_EXPORT2
+u_strFromUTF8WithSub(UChar *dest,
+              int32_t destCapacity,
+              int32_t *pDestLength,
+              const char *src,
+              int32_t srcLength,
+              UChar32 subchar, int32_t *pNumSubstitutions,
+              UErrorCode *pErrorCode);
+
+/**
+ * Convert a UTF-8 string to UTF-16.
+ *
+ * Same as u_strFromUTF8() except that this function is designed to be very fast,
+ * which it achieves by being lenient about malformed UTF-8 sequences.
+ * This function is intended for use in environments where UTF-8 text is
+ * expected to be well-formed.
+ *
+ * Its semantics are:
+ * - Well-formed UTF-8 text is correctly converted to well-formed UTF-16 text.
+ * - The function will not read beyond the input string, nor write beyond
+ *   the destCapacity.
+ * - Malformed UTF-8 results in "garbage" 16-bit Unicode strings which may not
+ *   be well-formed UTF-16.
+ *   The function will resynchronize to valid code point boundaries
+ *   within a small number of code points after an illegal sequence.
+ * - Non-shortest forms are not detected and will result in "spoofing" output.
+ *
+ * For further performance improvement, if srcLength is given (>=0),
+ * then it must be destCapacity>=srcLength.
+ *
+ * There is no inverse u_strToUTF8Lenient() function because there is practically
+ * no performance gain from not checking that a UTF-16 string is well-formed.
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ *                      Unlike for other ICU functions, if srcLength>=0 then it
+ *                      must be destCapacity>=srcLength.
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ *                      Unlike for other ICU functions, if srcLength>=0 but
+ *                      destCapacity<srcLength, then *pDestLength will be set to srcLength
+ *                      (and U_BUFFER_OVERFLOW_ERROR will be set)
+ *                      regardless of the actual result length.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param pErrorCode    Pointer to a standard ICU error code. Its input value must
+ *                      pass the U_SUCCESS() test, or else the function returns
+ *                      immediately. Check for U_FAILURE() on output or use with
+ *                      function chaining. (See User Guide for details.)
+ * @return The pointer to destination buffer.
+ * @see u_strFromUTF8
+ * @see u_strFromUTF8WithSub
+ * @see u_strToUTF8WithSub
+ * @stable ICU 3.6
+ */
+U_STABLE UChar * U_EXPORT2
+u_strFromUTF8Lenient(UChar *dest,
+                     int32_t destCapacity,
+                     int32_t *pDestLength,
+                     const char *src,
+                     int32_t srcLength,
+                     UErrorCode *pErrorCode);
+
+/**
+ * Convert a UTF-16 string to UTF-32.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChar32s). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param pErrorCode    Must be a valid pointer to an error code value,
+ *                      which must not indicate a failure before the function call.
+ * @return The pointer to destination buffer.
+ * @see u_strToUTF32WithSub
+ * @see u_strFromUTF32
+ * @stable ICU 2.0
+ */
+U_STABLE UChar32* U_EXPORT2 
+u_strToUTF32(UChar32 *dest, 
+             int32_t  destCapacity,
+             int32_t  *pDestLength,
+             const UChar *src, 
+             int32_t  srcLength,
+             UErrorCode *pErrorCode);
+
+/**
+ * Convert a UTF-32 string to UTF-16.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param pErrorCode    Must be a valid pointer to an error code value,
+ *                      which must not indicate a failure before the function call.
+ * @return The pointer to destination buffer.
+ * @see u_strFromUTF32WithSub
+ * @see u_strToUTF32
+ * @stable ICU 2.0
+ */
+U_STABLE UChar* U_EXPORT2 
+u_strFromUTF32(UChar   *dest,
+               int32_t destCapacity, 
+               int32_t *pDestLength,
+               const UChar32 *src,
+               int32_t srcLength,
+               UErrorCode *pErrorCode);
+
+/**
+ * Convert a UTF-16 string to UTF-32.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * Same as u_strToUTF32() except for the additional subchar which is output for
+ * illegal input sequences, instead of stopping with the U_INVALID_CHAR_FOUND error code.
+ * With subchar==U_SENTINEL, this function behaves exactly like u_strToUTF32().
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChar32s). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If
+ *                      pDestLength!=NULL then *pDestLength is always set to the
+ *                      number of output units corresponding to the transformation of
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param subchar       The substitution character to use in place of an illegal input sequence,
+ *                      or U_SENTINEL if the function is to return with U_INVALID_CHAR_FOUND instead.
+ *                      A substitution character can be any valid Unicode code point (up to U+10FFFF)
+ *                      except for surrogate code points (U+D800..U+DFFF).
+ *                      The recommended value is U+FFFD "REPLACEMENT CHARACTER".
+ * @param pNumSubstitutions Output parameter receiving the number of substitutions if subchar>=0.
+ *                      Set to 0 if no substitutions occur or subchar<0.
+ *                      pNumSubstitutions can be NULL.
+ * @param pErrorCode    Pointer to a standard ICU error code. Its input value must
+ *                      pass the U_SUCCESS() test, or else the function returns
+ *                      immediately. Check for U_FAILURE() on output or use with
+ *                      function chaining. (See User Guide for details.)
+ * @return The pointer to destination buffer.
+ * @see u_strToUTF32
+ * @see u_strFromUTF32WithSub
+ * @stable ICU 4.2
+ */
+U_STABLE UChar32* U_EXPORT2
+u_strToUTF32WithSub(UChar32 *dest,
+             int32_t destCapacity,
+             int32_t *pDestLength,
+             const UChar *src,
+             int32_t srcLength,
+             UChar32 subchar, int32_t *pNumSubstitutions,
+             UErrorCode *pErrorCode);
+
+/**
+ * Convert a UTF-32 string to UTF-16.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * Same as u_strFromUTF32() except for the additional subchar which is output for
+ * illegal input sequences, instead of stopping with the U_INVALID_CHAR_FOUND error code.
+ * With subchar==U_SENTINEL, this function behaves exactly like u_strFromUTF32().
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If
+ *                      pDestLength!=NULL then *pDestLength is always set to the
+ *                      number of output units corresponding to the transformation of
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param subchar       The substitution character to use in place of an illegal input sequence,
+ *                      or U_SENTINEL if the function is to return with U_INVALID_CHAR_FOUND instead.
+ *                      A substitution character can be any valid Unicode code point (up to U+10FFFF)
+ *                      except for surrogate code points (U+D800..U+DFFF).
+ *                      The recommended value is U+FFFD "REPLACEMENT CHARACTER".
+ * @param pNumSubstitutions Output parameter receiving the number of substitutions if subchar>=0.
+ *                      Set to 0 if no substitutions occur or subchar<0.
+ *                      pNumSubstitutions can be NULL.
+ * @param pErrorCode    Pointer to a standard ICU error code. Its input value must
+ *                      pass the U_SUCCESS() test, or else the function returns
+ *                      immediately. Check for U_FAILURE() on output or use with
+ *                      function chaining. (See User Guide for details.)
+ * @return The pointer to destination buffer.
+ * @see u_strFromUTF32
+ * @see u_strToUTF32WithSub
+ * @stable ICU 4.2
+ */
+U_STABLE UChar* U_EXPORT2
+u_strFromUTF32WithSub(UChar *dest,
+               int32_t destCapacity,
+               int32_t *pDestLength,
+               const UChar32 *src,
+               int32_t srcLength,
+               UChar32 subchar, int32_t *pNumSubstitutions,
+               UErrorCode *pErrorCode);
+
+/**
+ * Convert a 16-bit Unicode string to Java Modified UTF-8.
+ * See http://java.sun.com/javase/6/docs/api/java/io/DataInput.html#modified-utf-8
+ *
+ * This function behaves according to the documentation for Java DataOutput.writeUTF()
+ * except that it does not encode the output length in the destination buffer
+ * and does not have an output length restriction.
+ * See http://java.sun.com/javase/6/docs/api/java/io/DataOutput.html#writeUTF(java.lang.String)
+ *
+ * The input string need not be well-formed UTF-16.
+ * (Therefore there is no subchar parameter.)
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of chars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param pErrorCode    Pointer to a standard ICU error code. Its input value must
+ *                      pass the U_SUCCESS() test, or else the function returns
+ *                      immediately. Check for U_FAILURE() on output or use with
+ *                      function chaining. (See User Guide for details.)
+ * @return The pointer to destination buffer.
+ * @stable ICU 4.4
+ * @see u_strToUTF8WithSub
+ * @see u_strFromJavaModifiedUTF8WithSub
+ */
+U_STABLE char* U_EXPORT2 
+u_strToJavaModifiedUTF8(
+        char *dest,
+        int32_t destCapacity,
+        int32_t *pDestLength,
+        const UChar *src, 
+        int32_t srcLength,
+        UErrorCode *pErrorCode);
+
+/**
+ * Convert a Java Modified UTF-8 string to a 16-bit Unicode string.
+ * If the input string is not well-formed, then the U_INVALID_CHAR_FOUND error code is set.
+ *
+ * This function behaves according to the documentation for Java DataInput.readUTF()
+ * except that it takes a length parameter rather than
+ * interpreting the first two input bytes as the length.
+ * See http://java.sun.com/javase/6/docs/api/java/io/DataInput.html#readUTF()
+ *
+ * The output string may not be well-formed UTF-16.
+ *
+ * @param dest          A buffer for the result string. The result will be zero-terminated if
+ *                      the buffer is large enough.
+ * @param destCapacity  The size of the buffer (number of UChars). If it is 0, then
+ *                      dest may be NULL and the function will only return the length of the 
+ *                      result without writing any of the result string (pre-flighting).
+ * @param pDestLength   A pointer to receive the number of units written to the destination. If 
+ *                      pDestLength!=NULL then *pDestLength is always set to the 
+ *                      number of output units corresponding to the transformation of 
+ *                      all the input units, even in case of a buffer overflow.
+ * @param src           The original source string
+ * @param srcLength     The length of the original string. If -1, then src must be zero-terminated.
+ * @param subchar       The substitution character to use in place of an illegal input sequence,
+ *                      or U_SENTINEL if the function is to return with U_INVALID_CHAR_FOUND instead.
+ *                      A substitution character can be any valid Unicode code point (up to U+10FFFF)
+ *                      except for surrogate code points (U+D800..U+DFFF).
+ *                      The recommended value is U+FFFD "REPLACEMENT CHARACTER".
+ * @param pNumSubstitutions Output parameter receiving the number of substitutions if subchar>=0.
+ *                      Set to 0 if no substitutions occur or subchar<0.
+ *                      pNumSubstitutions can be NULL.
+ * @param pErrorCode    Pointer to a standard ICU error code. Its input value must
+ *                      pass the U_SUCCESS() test, or else the function returns
+ *                      immediately. Check for U_FAILURE() on output or use with
+ *                      function chaining. (See User Guide for details.)
+ * @return The pointer to destination buffer.
+ * @see u_strFromUTF8WithSub
+ * @see u_strFromUTF8Lenient
+ * @see u_strToJavaModifiedUTF8
+ * @stable ICU 4.4
+ */
+U_STABLE UChar* U_EXPORT2
+u_strFromJavaModifiedUTF8WithSub(
+        UChar *dest,
+        int32_t destCapacity,
+        int32_t *pDestLength,
+        const char *src,
+        int32_t srcLength,
+        UChar32 subchar, int32_t *pNumSubstitutions,
+        UErrorCode *pErrorCode);
+
+#endif
diff --git a/icu/unicode/utf.h b/icu/unicode/utf.h
new file mode 100644
index 0000000..f5954fe
--- /dev/null
+++ b/icu/unicode/utf.h
@@ -0,0 +1,223 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 1999-2011, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  utf.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 1999sep09
+*   created by: Markus W. Scherer
+*/
+
+/**
+ * \file
+ * \brief C API: Code point macros
+ *
+ * This file defines macros for checking whether a code point is
+ * a surrogate or a non-character etc.
+ *
+ * The UChar and UChar32 data types for Unicode code units and code points
+ * are defined in umachine.h because they can be machine-dependent.
+ *
+ * If U_NO_DEFAULT_INCLUDE_UTF_HEADERS is 0 then utf.h is included by utypes.h
+ * and itself includes utf8.h and utf16.h after some
+ * common definitions.
+ * If U_NO_DEFAULT_INCLUDE_UTF_HEADERS is 1 then each of these headers must be
+ * included explicitly if their definitions are used.
+ *
+ * utf8.h and utf16.h define macros for efficiently getting code points
+ * in and out of UTF-8/16 strings.
+ * utf16.h macros have "U16_" prefixes.
+ * utf8.h defines similar macros with "U8_" prefixes for UTF-8 string handling.
+ *
+ * ICU mostly processes 16-bit Unicode strings.
+ * Most of the time, such strings are well-formed UTF-16.
+ * Single, unpaired surrogates must be handled as well, and are treated in ICU
+ * like regular code points where possible.
+ * (Pairs of surrogate code points are indistinguishable from supplementary
+ * code points encoded as pairs of supplementary code units.)
+ *
+ * In fact, almost all Unicode code points in normal text (>99%)
+ * are on the BMP (<=U+ffff) and even <=U+d7ff.
+ * ICU functions handle supplementary code points (U+10000..U+10ffff)
+ * but are optimized for the much more frequently occurring BMP code points.
+ *
+ * umachine.h defines UChar to be an unsigned 16-bit integer.
+ * Where available, UChar is defined to be a char16_t
+ * or a wchar_t (if that is an unsigned 16-bit type), otherwise uint16_t.
+ *
+ * UChar32 is defined to be a signed 32-bit integer (int32_t), large enough for a 21-bit
+ * Unicode code point (Unicode scalar value, 0..0x10ffff).
+ * Before ICU 2.4, the definition of UChar32 was similarly platform-dependent as
+ * the definition of UChar. For details see the documentation for UChar32 itself.
+ *
+ * utf.h defines a small number of C macros for single Unicode code points.
+ * These are simple checks for surrogates and non-characters.
+ * For actual Unicode character properties see uchar.h.
+ *
+ * By default, string operations must be done with error checking in case
+ * a string is not well-formed UTF-16.
+ * The macros will detect if a surrogate code unit is unpaired
+ * (lead unit without trail unit or vice versa) and just return the unit itself
+ * as the code point.
+ *
+ * The regular "safe" macros require that the initial, passed-in string index
+ * is within bounds. They only check the index when they read more than one
+ * code unit. This is usually done with code similar to the following loop:
+ * <pre>while(i<length) {
+ *   U16_NEXT(s, i, length, c);
+ *   // use c
+ * }</pre>
+ *
+ * When it is safe to assume that text is well-formed UTF-16
+ * (does not contain single, unpaired surrogates), then one can use
+ * U16_..._UNSAFE macros.
+ * These do not check for proper code unit sequences or truncated text and may
+ * yield wrong results or even cause a crash if they are used with "malformed"
+ * text.
+ * In practice, U16_..._UNSAFE macros will produce slightly less code but
+ * should not be faster because the processing is only different when a
+ * surrogate code unit is detected, which will be rare.
+ *
+ * Similarly for UTF-8, there are "safe" macros without a suffix,
+ * and U8_..._UNSAFE versions.
+ * The performance differences are much larger here because UTF-8 provides so
+ * many opportunities for malformed sequences.
+ * The unsafe UTF-8 macros are entirely implemented inside the macro definitions
+ * and are fast, while the safe UTF-8 macros call functions for all but the
+ * trivial (ASCII) cases.
+ * (ICU 3.6 optimizes U8_NEXT() and U8_APPEND() to handle most other common
+ * characters inline as well.)
+ *
+ * Unlike with UTF-16, malformed sequences cannot be expressed with distinct
+ * code point values (0..U+10ffff). They are indicated with negative values instead.
+ *
+ * For more information see the ICU User Guide Strings chapter
+ * (http://userguide.icu-project.org/strings).
+ *
+ * <em>Usage:</em>
+ * ICU coding guidelines for if() statements should be followed when using these macros.
+ * Compound statements (curly braces {}) must be used  for if-else-while... 
+ * bodies and all macro statements should be terminated with semicolon.
+ *
+ * @stable ICU 2.4
+ */
+
+#ifndef __UTF_H__
+#define __UTF_H__
+
+#include "unicode/umachine.h"
+/* include the utfXX.h after the following definitions */
+
+/* single-code point definitions -------------------------------------------- */
+
+/**
+ * Is this code point a Unicode noncharacter?
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U_IS_UNICODE_NONCHAR(c) \
+    ((c)>=0xfdd0 && \
+     ((uint32_t)(c)<=0xfdef || ((c)&0xfffe)==0xfffe) && \
+     (uint32_t)(c)<=0x10ffff)
+
+/**
+ * Is c a Unicode code point value (0..U+10ffff)
+ * that can be assigned a character?
+ *
+ * Code points that are not characters include:
+ * - single surrogate code points (U+d800..U+dfff, 2048 code points)
+ * - the last two code points on each plane (U+__fffe and U+__ffff, 34 code points)
+ * - U+fdd0..U+fdef (new with Unicode 3.1, 32 code points)
+ * - the highest Unicode code point value is U+10ffff
+ *
+ * This means that all code points below U+d800 are character code points,
+ * and that boundary is tested first for performance.
+ *
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U_IS_UNICODE_CHAR(c) \
+    ((uint32_t)(c)<0xd800 || \
+        ((uint32_t)(c)>0xdfff && \
+         (uint32_t)(c)<=0x10ffff && \
+         !U_IS_UNICODE_NONCHAR(c)))
+
+/**
+ * Is this code point a BMP code point (U+0000..U+ffff)?
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 2.8
+ */
+#define U_IS_BMP(c) ((uint32_t)(c)<=0xffff)
+
+/**
+ * Is this code point a supplementary code point (U+10000..U+10ffff)?
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 2.8
+ */
+#define U_IS_SUPPLEMENTARY(c) ((uint32_t)((c)-0x10000)<=0xfffff)
+ 
+/**
+ * Is this code point a lead surrogate (U+d800..U+dbff)?
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U_IS_LEAD(c) (((c)&0xfffffc00)==0xd800)
+
+/**
+ * Is this code point a trail surrogate (U+dc00..U+dfff)?
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U_IS_TRAIL(c) (((c)&0xfffffc00)==0xdc00)
+
+/**
+ * Is this code point a surrogate (U+d800..U+dfff)?
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U_IS_SURROGATE(c) (((c)&0xfffff800)==0xd800)
+
+/**
+ * Assuming c is a surrogate code point (U_IS_SURROGATE(c)),
+ * is it a lead surrogate?
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U_IS_SURROGATE_LEAD(c) (((c)&0x400)==0)
+
+/**
+ * Assuming c is a surrogate code point (U_IS_SURROGATE(c)),
+ * is it a trail surrogate?
+ * @param c 32-bit code point
+ * @return TRUE or FALSE
+ * @stable ICU 4.2
+ */
+#define U_IS_SURROGATE_TRAIL(c) (((c)&0x400)!=0)
+
+/* include the utfXX.h ------------------------------------------------------ */
+
+#if !U_NO_DEFAULT_INCLUDE_UTF_HEADERS
+
+#include "unicode/utf8.h"
+#include "unicode/utf16.h"
+
+/* utf_old.h contains deprecated, pre-ICU 2.4 definitions */
+#include "unicode/utf_old.h"
+
+#endif  /* !U_NO_DEFAULT_INCLUDE_UTF_HEADERS */
+
+#endif  /* __UTF_H__ */
diff --git a/icu/unicode/utf16.h b/icu/unicode/utf16.h
new file mode 100644
index 0000000..bdd88a8
--- /dev/null
+++ b/icu/unicode/utf16.h
@@ -0,0 +1,623 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 1999-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  utf16.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 1999sep09
+*   created by: Markus W. Scherer
+*/
+
+/**
+ * \file
+ * \brief C API: 16-bit Unicode handling macros
+ * 
+ * This file defines macros to deal with 16-bit Unicode (UTF-16) code units and strings.
+ *
+ * For more information see utf.h and the ICU User Guide Strings chapter
+ * (http://userguide.icu-project.org/strings).
+ *
+ * <em>Usage:</em>
+ * ICU coding guidelines for if() statements should be followed when using these macros.
+ * Compound statements (curly braces {}) must be used  for if-else-while... 
+ * bodies and all macro statements should be terminated with semicolon.
+ */
+
+#ifndef __UTF16_H__
+#define __UTF16_H__
+
+#include "unicode/umachine.h"
+#ifndef __UTF_H__
+#   include "unicode/utf.h"
+#endif
+
+/* single-code point definitions -------------------------------------------- */
+
+/**
+ * Does this code unit alone encode a code point (BMP, not a surrogate)?
+ * @param c 16-bit code unit
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U16_IS_SINGLE(c) !U_IS_SURROGATE(c)
+
+/**
+ * Is this code unit a lead surrogate (U+d800..U+dbff)?
+ * @param c 16-bit code unit
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U16_IS_LEAD(c) (((c)&0xfffffc00)==0xd800)
+
+/**
+ * Is this code unit a trail surrogate (U+dc00..U+dfff)?
+ * @param c 16-bit code unit
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U16_IS_TRAIL(c) (((c)&0xfffffc00)==0xdc00)
+
+/**
+ * Is this code unit a surrogate (U+d800..U+dfff)?
+ * @param c 16-bit code unit
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U16_IS_SURROGATE(c) U_IS_SURROGATE(c)
+
+/**
+ * Assuming c is a surrogate code point (U16_IS_SURROGATE(c)),
+ * is it a lead surrogate?
+ * @param c 16-bit code unit
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U16_IS_SURROGATE_LEAD(c) (((c)&0x400)==0)
+
+/**
+ * Assuming c is a surrogate code point (U16_IS_SURROGATE(c)),
+ * is it a trail surrogate?
+ * @param c 16-bit code unit
+ * @return TRUE or FALSE
+ * @stable ICU 4.2
+ */
+#define U16_IS_SURROGATE_TRAIL(c) (((c)&0x400)!=0)
+
+/**
+ * Helper constant for U16_GET_SUPPLEMENTARY.
+ * @internal
+ */
+#define U16_SURROGATE_OFFSET ((0xd800<<10UL)+0xdc00-0x10000)
+
+/**
+ * Get a supplementary code point value (U+10000..U+10ffff)
+ * from its lead and trail surrogates.
+ * The result is undefined if the input values are not
+ * lead and trail surrogates.
+ *
+ * @param lead lead surrogate (U+d800..U+dbff)
+ * @param trail trail surrogate (U+dc00..U+dfff)
+ * @return supplementary code point (U+10000..U+10ffff)
+ * @stable ICU 2.4
+ */
+#define U16_GET_SUPPLEMENTARY(lead, trail) \
+    (((UChar32)(lead)<<10UL)+(UChar32)(trail)-U16_SURROGATE_OFFSET)
+
+
+/**
+ * Get the lead surrogate (0xd800..0xdbff) for a
+ * supplementary code point (0x10000..0x10ffff).
+ * @param supplementary 32-bit code point (U+10000..U+10ffff)
+ * @return lead surrogate (U+d800..U+dbff) for supplementary
+ * @stable ICU 2.4
+ */
+#define U16_LEAD(supplementary) (UChar)(((supplementary)>>10)+0xd7c0)
+
+/**
+ * Get the trail surrogate (0xdc00..0xdfff) for a
+ * supplementary code point (0x10000..0x10ffff).
+ * @param supplementary 32-bit code point (U+10000..U+10ffff)
+ * @return trail surrogate (U+dc00..U+dfff) for supplementary
+ * @stable ICU 2.4
+ */
+#define U16_TRAIL(supplementary) (UChar)(((supplementary)&0x3ff)|0xdc00)
+
+/**
+ * How many 16-bit code units are used to encode this Unicode code point? (1 or 2)
+ * The result is not defined if c is not a Unicode code point (U+0000..U+10ffff).
+ * @param c 32-bit code point
+ * @return 1 or 2
+ * @stable ICU 2.4
+ */
+#define U16_LENGTH(c) ((uint32_t)(c)<=0xffff ? 1 : 2)
+
+/**
+ * The maximum number of 16-bit code units per Unicode code point (U+0000..U+10ffff).
+ * @return 2
+ * @stable ICU 2.4
+ */
+#define U16_MAX_LENGTH 2
+
+/**
+ * Get a code point from a string at a random-access offset,
+ * without changing the offset.
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * The offset may point to either the lead or trail surrogate unit
+ * for a supplementary code point, in which case the macro will read
+ * the adjacent matching surrogate as well.
+ * The result is undefined if the offset points to a single, unpaired surrogate.
+ * Iteration through a string is more efficient with U16_NEXT_UNSAFE or U16_NEXT.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @param c output UChar32 variable
+ * @see U16_GET
+ * @stable ICU 2.4
+ */
+#define U16_GET_UNSAFE(s, i, c) { \
+    (c)=(s)[i]; \
+    if(U16_IS_SURROGATE(c)) { \
+        if(U16_IS_SURROGATE_LEAD(c)) { \
+            (c)=U16_GET_SUPPLEMENTARY((c), (s)[(i)+1]); \
+        } else { \
+            (c)=U16_GET_SUPPLEMENTARY((s)[(i)-1], (c)); \
+        } \
+    } \
+}
+
+/**
+ * Get a code point from a string at a random-access offset,
+ * without changing the offset.
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * The offset may point to either the lead or trail surrogate unit
+ * for a supplementary code point, in which case the macro will read
+ * the adjacent matching surrogate as well.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * If the offset points to a single, unpaired surrogate, then that itself
+ * will be returned as the code point.
+ * Iteration through a string is more efficient with U16_NEXT_UNSAFE or U16_NEXT.
+ *
+ * @param s const UChar * string
+ * @param start starting string offset (usually 0)
+ * @param i string offset, must be start<=i<length
+ * @param length string length
+ * @param c output UChar32 variable
+ * @see U16_GET_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_GET(s, start, i, length, c) { \
+    (c)=(s)[i]; \
+    if(U16_IS_SURROGATE(c)) { \
+        uint16_t __c2; \
+        if(U16_IS_SURROGATE_LEAD(c)) { \
+            if((i)+1!=(length) && U16_IS_TRAIL(__c2=(s)[(i)+1])) { \
+                (c)=U16_GET_SUPPLEMENTARY((c), __c2); \
+            } \
+        } else { \
+            if((i)>(start) && U16_IS_LEAD(__c2=(s)[(i)-1])) { \
+                (c)=U16_GET_SUPPLEMENTARY(__c2, (c)); \
+            } \
+        } \
+    } \
+}
+
+/* definitions with forward iteration --------------------------------------- */
+
+/**
+ * Get a code point from a string at a code point boundary offset,
+ * and advance the offset to the next code point boundary.
+ * (Post-incrementing forward iteration.)
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * The offset may point to the lead surrogate unit
+ * for a supplementary code point, in which case the macro will read
+ * the following trail surrogate as well.
+ * If the offset points to a trail surrogate, then that itself
+ * will be returned as the code point.
+ * The result is undefined if the offset points to a single, unpaired lead surrogate.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @param c output UChar32 variable
+ * @see U16_NEXT
+ * @stable ICU 2.4
+ */
+#define U16_NEXT_UNSAFE(s, i, c) { \
+    (c)=(s)[(i)++]; \
+    if(U16_IS_LEAD(c)) { \
+        (c)=U16_GET_SUPPLEMENTARY((c), (s)[(i)++]); \
+    } \
+}
+
+/**
+ * Get a code point from a string at a code point boundary offset,
+ * and advance the offset to the next code point boundary.
+ * (Post-incrementing forward iteration.)
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * The offset may point to the lead surrogate unit
+ * for a supplementary code point, in which case the macro will read
+ * the following trail surrogate as well.
+ * If the offset points to a trail surrogate or
+ * to a single, unpaired lead surrogate, then that itself
+ * will be returned as the code point.
+ *
+ * @param s const UChar * string
+ * @param i string offset, must be i<length
+ * @param length string length
+ * @param c output UChar32 variable
+ * @see U16_NEXT_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_NEXT(s, i, length, c) { \
+    (c)=(s)[(i)++]; \
+    if(U16_IS_LEAD(c)) { \
+        uint16_t __c2; \
+        if((i)!=(length) && U16_IS_TRAIL(__c2=(s)[(i)])) { \
+            ++(i); \
+            (c)=U16_GET_SUPPLEMENTARY((c), __c2); \
+        } \
+    } \
+}
+
+/**
+ * Append a code point to a string, overwriting 1 or 2 code units.
+ * The offset points to the current end of the string contents
+ * and is advanced (post-increment).
+ * "Unsafe" macro, assumes a valid code point and sufficient space in the string.
+ * Otherwise, the result is undefined.
+ *
+ * @param s const UChar * string buffer
+ * @param i string offset
+ * @param c code point to append
+ * @see U16_APPEND
+ * @stable ICU 2.4
+ */
+#define U16_APPEND_UNSAFE(s, i, c) { \
+    if((uint32_t)(c)<=0xffff) { \
+        (s)[(i)++]=(uint16_t)(c); \
+    } else { \
+        (s)[(i)++]=(uint16_t)(((c)>>10)+0xd7c0); \
+        (s)[(i)++]=(uint16_t)(((c)&0x3ff)|0xdc00); \
+    } \
+}
+
+/**
+ * Append a code point to a string, overwriting 1 or 2 code units.
+ * The offset points to the current end of the string contents
+ * and is advanced (post-increment).
+ * "Safe" macro, checks for a valid code point.
+ * If a surrogate pair is written, checks for sufficient space in the string.
+ * If the code point is not valid or a trail surrogate does not fit,
+ * then isError is set to TRUE.
+ *
+ * @param s const UChar * string buffer
+ * @param i string offset, must be i<capacity
+ * @param capacity size of the string buffer
+ * @param c code point to append
+ * @param isError output UBool set to TRUE if an error occurs, otherwise not modified
+ * @see U16_APPEND_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_APPEND(s, i, capacity, c, isError) { \
+    if((uint32_t)(c)<=0xffff) { \
+        (s)[(i)++]=(uint16_t)(c); \
+    } else if((uint32_t)(c)<=0x10ffff && (i)+1<(capacity)) { \
+        (s)[(i)++]=(uint16_t)(((c)>>10)+0xd7c0); \
+        (s)[(i)++]=(uint16_t)(((c)&0x3ff)|0xdc00); \
+    } else /* c>0x10ffff or not enough space */ { \
+        (isError)=TRUE; \
+    } \
+}
+
+/**
+ * Advance the string offset from one code point boundary to the next.
+ * (Post-incrementing iteration.)
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @see U16_FWD_1
+ * @stable ICU 2.4
+ */
+#define U16_FWD_1_UNSAFE(s, i) { \
+    if(U16_IS_LEAD((s)[(i)++])) { \
+        ++(i); \
+    } \
+}
+
+/**
+ * Advance the string offset from one code point boundary to the next.
+ * (Post-incrementing iteration.)
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * @param s const UChar * string
+ * @param i string offset, must be i<length
+ * @param length string length
+ * @see U16_FWD_1_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_FWD_1(s, i, length) { \
+    if(U16_IS_LEAD((s)[(i)++]) && (i)!=(length) && U16_IS_TRAIL((s)[i])) { \
+        ++(i); \
+    } \
+}
+
+/**
+ * Advance the string offset from one code point boundary to the n-th next one,
+ * i.e., move forward by n code points.
+ * (Post-incrementing iteration.)
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @param n number of code points to skip
+ * @see U16_FWD_N
+ * @stable ICU 2.4
+ */
+#define U16_FWD_N_UNSAFE(s, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0) { \
+        U16_FWD_1_UNSAFE(s, i); \
+        --__N; \
+    } \
+}
+
+/**
+ * Advance the string offset from one code point boundary to the n-th next one,
+ * i.e., move forward by n code points.
+ * (Post-incrementing iteration.)
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * @param s const UChar * string
+ * @param i int32_t string offset, must be i<length
+ * @param length int32_t string length
+ * @param n number of code points to skip
+ * @see U16_FWD_N_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_FWD_N(s, i, length, n) { \
+    int32_t __N=(n); \
+    while(__N>0 && ((i)<(length) || ((length)<0 && (s)[i]!=0))) { \
+        U16_FWD_1(s, i, length); \
+        --__N; \
+    } \
+}
+
+/**
+ * Adjust a random-access offset to a code point boundary
+ * at the start of a code point.
+ * If the offset points to the trail surrogate of a surrogate pair,
+ * then the offset is decremented.
+ * Otherwise, it is not modified.
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @see U16_SET_CP_START
+ * @stable ICU 2.4
+ */
+#define U16_SET_CP_START_UNSAFE(s, i) { \
+    if(U16_IS_TRAIL((s)[i])) { \
+        --(i); \
+    } \
+}
+
+/**
+ * Adjust a random-access offset to a code point boundary
+ * at the start of a code point.
+ * If the offset points to the trail surrogate of a surrogate pair,
+ * then the offset is decremented.
+ * Otherwise, it is not modified.
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * @param s const UChar * string
+ * @param start starting string offset (usually 0)
+ * @param i string offset, must be start<=i
+ * @see U16_SET_CP_START_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_SET_CP_START(s, start, i) { \
+    if(U16_IS_TRAIL((s)[i]) && (i)>(start) && U16_IS_LEAD((s)[(i)-1])) { \
+        --(i); \
+    } \
+}
+
+/* definitions with backward iteration -------------------------------------- */
+
+/**
+ * Move the string offset from one code point boundary to the previous one
+ * and get the code point between them.
+ * (Pre-decrementing backward iteration.)
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * The input offset may be the same as the string length.
+ * If the offset is behind a trail surrogate unit
+ * for a supplementary code point, then the macro will read
+ * the preceding lead surrogate as well.
+ * If the offset is behind a lead surrogate, then that itself
+ * will be returned as the code point.
+ * The result is undefined if the offset is behind a single, unpaired trail surrogate.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @param c output UChar32 variable
+ * @see U16_PREV
+ * @stable ICU 2.4
+ */
+#define U16_PREV_UNSAFE(s, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(U16_IS_TRAIL(c)) { \
+        (c)=U16_GET_SUPPLEMENTARY((s)[--(i)], (c)); \
+    } \
+}
+
+/**
+ * Move the string offset from one code point boundary to the previous one
+ * and get the code point between them.
+ * (Pre-decrementing backward iteration.)
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * The input offset may be the same as the string length.
+ * If the offset is behind a trail surrogate unit
+ * for a supplementary code point, then the macro will read
+ * the preceding lead surrogate as well.
+ * If the offset is behind a lead surrogate or behind a single, unpaired
+ * trail surrogate, then that itself
+ * will be returned as the code point.
+ *
+ * @param s const UChar * string
+ * @param start starting string offset (usually 0)
+ * @param i string offset, must be start<i
+ * @param c output UChar32 variable
+ * @see U16_PREV_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_PREV(s, start, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(U16_IS_TRAIL(c)) { \
+        uint16_t __c2; \
+        if((i)>(start) && U16_IS_LEAD(__c2=(s)[(i)-1])) { \
+            --(i); \
+            (c)=U16_GET_SUPPLEMENTARY(__c2, (c)); \
+        } \
+    } \
+}
+
+/**
+ * Move the string offset from one code point boundary to the previous one.
+ * (Pre-decrementing backward iteration.)
+ * The input offset may be the same as the string length.
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @see U16_BACK_1
+ * @stable ICU 2.4
+ */
+#define U16_BACK_1_UNSAFE(s, i) { \
+    if(U16_IS_TRAIL((s)[--(i)])) { \
+        --(i); \
+    } \
+}
+
+/**
+ * Move the string offset from one code point boundary to the previous one.
+ * (Pre-decrementing backward iteration.)
+ * The input offset may be the same as the string length.
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * @param s const UChar * string
+ * @param start starting string offset (usually 0)
+ * @param i string offset, must be start<i
+ * @see U16_BACK_1_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_BACK_1(s, start, i) { \
+    if(U16_IS_TRAIL((s)[--(i)]) && (i)>(start) && U16_IS_LEAD((s)[(i)-1])) { \
+        --(i); \
+    } \
+}
+
+/**
+ * Move the string offset from one code point boundary to the n-th one before it,
+ * i.e., move backward by n code points.
+ * (Pre-decrementing backward iteration.)
+ * The input offset may be the same as the string length.
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @param n number of code points to skip
+ * @see U16_BACK_N
+ * @stable ICU 2.4
+ */
+#define U16_BACK_N_UNSAFE(s, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0) { \
+        U16_BACK_1_UNSAFE(s, i); \
+        --__N; \
+    } \
+}
+
+/**
+ * Move the string offset from one code point boundary to the n-th one before it,
+ * i.e., move backward by n code points.
+ * (Pre-decrementing backward iteration.)
+ * The input offset may be the same as the string length.
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * @param s const UChar * string
+ * @param start start of string
+ * @param i string offset, must be start<i
+ * @param n number of code points to skip
+ * @see U16_BACK_N_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_BACK_N(s, start, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0 && (i)>(start)) { \
+        U16_BACK_1(s, start, i); \
+        --__N; \
+    } \
+}
+
+/**
+ * Adjust a random-access offset to a code point boundary after a code point.
+ * If the offset is behind the lead surrogate of a surrogate pair,
+ * then the offset is incremented.
+ * Otherwise, it is not modified.
+ * The input offset may be the same as the string length.
+ * "Unsafe" macro, assumes well-formed UTF-16.
+ *
+ * @param s const UChar * string
+ * @param i string offset
+ * @see U16_SET_CP_LIMIT
+ * @stable ICU 2.4
+ */
+#define U16_SET_CP_LIMIT_UNSAFE(s, i) { \
+    if(U16_IS_LEAD((s)[(i)-1])) { \
+        ++(i); \
+    } \
+}
+
+/**
+ * Adjust a random-access offset to a code point boundary after a code point.
+ * If the offset is behind the lead surrogate of a surrogate pair,
+ * then the offset is incremented.
+ * Otherwise, it is not modified.
+ * The input offset may be the same as the string length.
+ * "Safe" macro, handles unpaired surrogates and checks for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * @param s const UChar * string
+ * @param start int32_t starting string offset (usually 0)
+ * @param i int32_t string offset, start<=i<=length
+ * @param length int32_t string length
+ * @see U16_SET_CP_LIMIT_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U16_SET_CP_LIMIT(s, start, i, length) { \
+    if((start)<(i) && ((i)<(length) || (length)<0) && U16_IS_LEAD((s)[(i)-1]) && U16_IS_TRAIL((s)[i])) { \
+        ++(i); \
+    } \
+}
+
+#endif
diff --git a/icu/unicode/utf8.h b/icu/unicode/utf8.h
new file mode 100644
index 0000000..21e5f3d
--- /dev/null
+++ b/icu/unicode/utf8.h
@@ -0,0 +1,830 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 1999-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  utf8.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 1999sep13
+*   created by: Markus W. Scherer
+*/
+
+/**
+ * \file
+ * \brief C API: 8-bit Unicode handling macros
+ * 
+ * This file defines macros to deal with 8-bit Unicode (UTF-8) code units (bytes) and strings.
+ *
+ * For more information see utf.h and the ICU User Guide Strings chapter
+ * (http://userguide.icu-project.org/strings).
+ *
+ * <em>Usage:</em>
+ * ICU coding guidelines for if() statements should be followed when using these macros.
+ * Compound statements (curly braces {}) must be used  for if-else-while... 
+ * bodies and all macro statements should be terminated with semicolon.
+ */
+
+#ifndef __UTF8_H__
+#define __UTF8_H__
+
+#include "unicode/umachine.h"
+#ifndef __UTF_H__
+#   include "unicode/utf.h"
+#endif
+
+/* internal definitions ----------------------------------------------------- */
+
+/**
+ * \var utf8_countTrailBytes
+ * Internal array with numbers of trail bytes for any given byte used in
+ * lead byte position.
+ *
+ * This is internal since it is not meant to be called directly by external clients;
+ * however it is called by public macros in this file and thus must remain stable,
+ * and should not be hidden when other internal functions are hidden (otherwise
+ * public macros would fail to compile).
+ * @internal
+ */
+#ifdef U_UTF8_IMPL
+U_EXPORT const uint8_t 
+#elif defined(U_STATIC_IMPLEMENTATION) || defined(U_COMMON_IMPLEMENTATION)
+U_CFUNC const uint8_t
+#else
+U_CFUNC U_IMPORT const uint8_t /* U_IMPORT2? */ /*U_IMPORT*/ 
+#endif
+utf8_countTrailBytes[256];
+
+/**
+ * Counts the trail bytes for a UTF-8 lead byte.
+ * Returns 0 for 0..0xbf as well as for 0xfe and 0xff.
+ *
+ * This is internal since it is not meant to be called directly by external clients;
+ * however it is called by public macros in this file and thus must remain stable.
+ *
+ * Note: Beginning with ICU 50, the implementation uses a multi-condition expression
+ * which was shown in 2012 (on x86-64) to compile to fast, branch-free code.
+ * leadByte is evaluated multiple times.
+ *
+ * The pre-ICU 50 implementation used the exported array utf8_countTrailBytes:
+ * #define U8_COUNT_TRAIL_BYTES(leadByte) (utf8_countTrailBytes[leadByte])
+ * leadByte was evaluated exactly once.
+ *
+ * @param leadByte The first byte of a UTF-8 sequence. Must be 0..0xff.
+ * @internal
+ */
+#define U8_COUNT_TRAIL_BYTES(leadByte) \
+    ((leadByte)<0xf0 ? \
+        ((leadByte)>=0xc0)+((leadByte)>=0xe0) : \
+        (leadByte)<0xfe ? 3+((leadByte)>=0xf8)+((leadByte)>=0xfc) : 0)
+
+/**
+ * Counts the trail bytes for a UTF-8 lead byte of a valid UTF-8 sequence.
+ * The maximum supported lead byte is 0xf4 corresponding to U+10FFFF.
+ * leadByte might be evaluated multiple times.
+ *
+ * This is internal since it is not meant to be called directly by external clients;
+ * however it is called by public macros in this file and thus must remain stable.
+ *
+ * @param leadByte The first byte of a UTF-8 sequence. Must be 0..0xff.
+ * @internal
+ */
+#define U8_COUNT_TRAIL_BYTES_UNSAFE(leadByte) \
+    (((leadByte)>=0xc0)+((leadByte)>=0xe0)+((leadByte)>=0xf0))
+
+/**
+ * Mask a UTF-8 lead byte, leave only the lower bits that form part of the code point value.
+ *
+ * This is internal since it is not meant to be called directly by external clients;
+ * however it is called by public macros in this file and thus must remain stable.
+ * @internal
+ */
+#define U8_MASK_LEAD_BYTE(leadByte, countTrailBytes) ((leadByte)&=(1<<(6-(countTrailBytes)))-1)
+
+/**
+ * Function for handling "next code point" with error-checking.
+ *
+ * This is internal since it is not meant to be called directly by external clients;
+ * however it is U_STABLE (not U_INTERNAL) since it is called by public macros in this
+ * file and thus must remain stable, and should not be hidden when other internal
+ * functions are hidden (otherwise public macros would fail to compile).
+ * @internal
+ */
+U_STABLE UChar32 U_EXPORT2
+utf8_nextCharSafeBody(const uint8_t *s, int32_t *pi, int32_t length, UChar32 c, UBool strict);
+
+/**
+ * Function for handling "append code point" with error-checking.
+ *
+ * This is internal since it is not meant to be called directly by external clients;
+ * however it is U_STABLE (not U_INTERNAL) since it is called by public macros in this
+ * file and thus must remain stable, and should not be hidden when other internal
+ * functions are hidden (otherwise public macros would fail to compile).
+ * @internal
+ */
+U_STABLE int32_t U_EXPORT2
+utf8_appendCharSafeBody(uint8_t *s, int32_t i, int32_t length, UChar32 c, UBool *pIsError);
+
+/**
+ * Function for handling "previous code point" with error-checking.
+ *
+ * This is internal since it is not meant to be called directly by external clients;
+ * however it is U_STABLE (not U_INTERNAL) since it is called by public macros in this
+ * file and thus must remain stable, and should not be hidden when other internal
+ * functions are hidden (otherwise public macros would fail to compile).
+ * @internal
+ */
+U_STABLE UChar32 U_EXPORT2
+utf8_prevCharSafeBody(const uint8_t *s, int32_t start, int32_t *pi, UChar32 c, UBool strict);
+
+/**
+ * Function for handling "skip backward one code point" with error-checking.
+ *
+ * This is internal since it is not meant to be called directly by external clients;
+ * however it is U_STABLE (not U_INTERNAL) since it is called by public macros in this
+ * file and thus must remain stable, and should not be hidden when other internal
+ * functions are hidden (otherwise public macros would fail to compile).
+ * @internal
+ */
+U_STABLE int32_t U_EXPORT2
+utf8_back1SafeBody(const uint8_t *s, int32_t start, int32_t i);
+
+/* single-code point definitions -------------------------------------------- */
+
+/**
+ * Does this code unit (byte) encode a code point by itself (US-ASCII 0..0x7f)?
+ * @param c 8-bit code unit (byte)
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U8_IS_SINGLE(c) (((c)&0x80)==0)
+
+/**
+ * Is this code unit (byte) a UTF-8 lead byte?
+ * @param c 8-bit code unit (byte)
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U8_IS_LEAD(c) ((uint8_t)((c)-0xc0)<0x3e)
+
+/**
+ * Is this code unit (byte) a UTF-8 trail byte?
+ * @param c 8-bit code unit (byte)
+ * @return TRUE or FALSE
+ * @stable ICU 2.4
+ */
+#define U8_IS_TRAIL(c) (((c)&0xc0)==0x80)
+
+/**
+ * How many code units (bytes) are used for the UTF-8 encoding
+ * of this Unicode code point?
+ * @param c 32-bit code point
+ * @return 1..4, or 0 if c is a surrogate or not a Unicode code point
+ * @stable ICU 2.4
+ */
+#define U8_LENGTH(c) \
+    ((uint32_t)(c)<=0x7f ? 1 : \
+        ((uint32_t)(c)<=0x7ff ? 2 : \
+            ((uint32_t)(c)<=0xd7ff ? 3 : \
+                ((uint32_t)(c)<=0xdfff || (uint32_t)(c)>0x10ffff ? 0 : \
+                    ((uint32_t)(c)<=0xffff ? 3 : 4)\
+                ) \
+            ) \
+        ) \
+    )
+
+/**
+ * The maximum number of UTF-8 code units (bytes) per Unicode code point (U+0000..U+10ffff).
+ * @return 4
+ * @stable ICU 2.4
+ */
+#define U8_MAX_LENGTH 4
+
+/**
+ * Get a code point from a string at a random-access offset,
+ * without changing the offset.
+ * The offset may point to either the lead byte or one of the trail bytes
+ * for a code point, in which case the macro will read all of the bytes
+ * for the code point.
+ * The result is undefined if the offset points to an illegal UTF-8
+ * byte sequence.
+ * Iteration through a string is more efficient with U8_NEXT_UNSAFE or U8_NEXT.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @param c output UChar32 variable
+ * @see U8_GET
+ * @stable ICU 2.4
+ */
+#define U8_GET_UNSAFE(s, i, c) { \
+    int32_t _u8_get_unsafe_index=(int32_t)(i); \
+    U8_SET_CP_START_UNSAFE(s, _u8_get_unsafe_index); \
+    U8_NEXT_UNSAFE(s, _u8_get_unsafe_index, c); \
+}
+
+/**
+ * Get a code point from a string at a random-access offset,
+ * without changing the offset.
+ * The offset may point to either the lead byte or one of the trail bytes
+ * for a code point, in which case the macro will read all of the bytes
+ * for the code point.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * If the offset points to an illegal UTF-8 byte sequence, then
+ * c is set to a negative value.
+ * Iteration through a string is more efficient with U8_NEXT_UNSAFE or U8_NEXT.
+ *
+ * @param s const uint8_t * string
+ * @param start int32_t starting string offset
+ * @param i int32_t string offset, must be start<=i<length
+ * @param length int32_t string length
+ * @param c output UChar32 variable, set to <0 in case of an error
+ * @see U8_GET_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_GET(s, start, i, length, c) { \
+    int32_t _u8_get_index=(i); \
+    U8_SET_CP_START(s, start, _u8_get_index); \
+    U8_NEXT(s, _u8_get_index, length, c); \
+}
+
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Get a code point from a string at a random-access offset,
+ * without changing the offset.
+ * The offset may point to either the lead byte or one of the trail bytes
+ * for a code point, in which case the macro will read all of the bytes
+ * for the code point.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * If the offset points to an illegal UTF-8 byte sequence, then
+ * c is set to U+FFFD.
+ * Iteration through a string is more efficient with U8_NEXT_UNSAFE or U8_NEXT_OR_FFFD.
+ *
+ * This macro does not distinguish between a real U+FFFD in the text
+ * and U+FFFD returned for an ill-formed sequence.
+ * Use U8_GET() if that distinction is important.
+ *
+ * @param s const uint8_t * string
+ * @param start int32_t starting string offset
+ * @param i int32_t string offset, must be start<=i<length
+ * @param length int32_t string length
+ * @param c output UChar32 variable, set to U+FFFD in case of an error
+ * @see U8_GET
+ * @draft ICU 51
+ */
+#define U8_GET_OR_FFFD(s, start, i, length, c) { \
+    int32_t _u8_get_index=(i); \
+    U8_SET_CP_START(s, start, _u8_get_index); \
+    U8_NEXT_OR_FFFD(s, _u8_get_index, length, c); \
+}
+#endif /* U_HIDE_DRAFT_API */
+
+/* definitions with forward iteration --------------------------------------- */
+
+/**
+ * Get a code point from a string at a code point boundary offset,
+ * and advance the offset to the next code point boundary.
+ * (Post-incrementing forward iteration.)
+ * "Unsafe" macro, assumes well-formed UTF-8.
+ *
+ * The offset may point to the lead byte of a multi-byte sequence,
+ * in which case the macro will read the whole sequence.
+ * The result is undefined if the offset points to a trail byte
+ * or an illegal UTF-8 sequence.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @param c output UChar32 variable
+ * @see U8_NEXT
+ * @stable ICU 2.4
+ */
+#define U8_NEXT_UNSAFE(s, i, c) { \
+    (c)=(uint8_t)(s)[(i)++]; \
+    if((c)>=0x80) { \
+        if((c)<0xe0) { \
+            (c)=(((c)&0x1f)<<6)|((s)[(i)++]&0x3f); \
+        } else if((c)<0xf0) { \
+            /* no need for (c&0xf) because the upper bits are truncated after <<12 in the cast to (UChar) */ \
+            (c)=(UChar)(((c)<<12)|(((s)[i]&0x3f)<<6)|((s)[(i)+1]&0x3f)); \
+            (i)+=2; \
+        } else { \
+            (c)=(((c)&7)<<18)|(((s)[i]&0x3f)<<12)|(((s)[(i)+1]&0x3f)<<6)|((s)[(i)+2]&0x3f); \
+            (i)+=3; \
+        } \
+    } \
+}
+
+/**
+ * Get a code point from a string at a code point boundary offset,
+ * and advance the offset to the next code point boundary.
+ * (Post-incrementing forward iteration.)
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * The offset may point to the lead byte of a multi-byte sequence,
+ * in which case the macro will read the whole sequence.
+ * If the offset points to a trail byte or an illegal UTF-8 sequence, then
+ * c is set to a negative value.
+ *
+ * @param s const uint8_t * string
+ * @param i int32_t string offset, must be i<length
+ * @param length int32_t string length
+ * @param c output UChar32 variable, set to <0 in case of an error
+ * @see U8_NEXT_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_NEXT(s, i, length, c) { \
+    (c)=(uint8_t)(s)[(i)++]; \
+    if((c)>=0x80) { \
+        uint8_t __t1, __t2; \
+        if( /* handle U+1000..U+CFFF inline */ \
+            (0xe0<(c) && (c)<=0xec) && \
+            (((i)+1)<(length) || (length)<0) && \
+            (__t1=(uint8_t)((s)[i]-0x80))<=0x3f && \
+            (__t2=(uint8_t)((s)[(i)+1]-0x80))<= 0x3f \
+        ) { \
+            /* no need for (c&0xf) because the upper bits are truncated after <<12 in the cast to (UChar) */ \
+            (c)=(UChar)(((c)<<12)|(__t1<<6)|__t2); \
+            (i)+=2; \
+        } else if( /* handle U+0080..U+07FF inline */ \
+            ((c)<0xe0 && (c)>=0xc2) && \
+            ((i)!=(length)) && \
+            (__t1=(uint8_t)((s)[i]-0x80))<=0x3f \
+        ) { \
+            (c)=(((c)&0x1f)<<6)|__t1; \
+            ++(i); \
+        } else { \
+            /* function call for "complicated" and error cases */ \
+            (c)=utf8_nextCharSafeBody((const uint8_t *)s, &(i), (length), c, -1); \
+        } \
+    } \
+}
+
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Get a code point from a string at a code point boundary offset,
+ * and advance the offset to the next code point boundary.
+ * (Post-incrementing forward iteration.)
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * The offset may point to the lead byte of a multi-byte sequence,
+ * in which case the macro will read the whole sequence.
+ * If the offset points to a trail byte or an illegal UTF-8 sequence, then
+ * c is set to U+FFFD.
+ *
+ * This macro does not distinguish between a real U+FFFD in the text
+ * and U+FFFD returned for an ill-formed sequence.
+ * Use U8_NEXT() if that distinction is important.
+ *
+ * @param s const uint8_t * string
+ * @param i int32_t string offset, must be i<length
+ * @param length int32_t string length
+ * @param c output UChar32 variable, set to U+FFFD in case of an error
+ * @see U8_NEXT
+ * @draft ICU 51
+ */
+#define U8_NEXT_OR_FFFD(s, i, length, c) { \
+    (c)=(uint8_t)(s)[(i)++]; \
+    if((c)>=0x80) { \
+        uint8_t __t1, __t2; \
+        if( /* handle U+1000..U+CFFF inline */ \
+            (0xe0<(c) && (c)<=0xec) && \
+            (((i)+1)<(length) || (length)<0) && \
+            (__t1=(uint8_t)((s)[i]-0x80))<=0x3f && \
+            (__t2=(uint8_t)((s)[(i)+1]-0x80))<= 0x3f \
+        ) { \
+            /* no need for (c&0xf) because the upper bits are truncated after <<12 in the cast to (UChar) */ \
+            (c)=(UChar)(((c)<<12)|(__t1<<6)|__t2); \
+            (i)+=2; \
+        } else if( /* handle U+0080..U+07FF inline */ \
+            ((c)<0xe0 && (c)>=0xc2) && \
+            ((i)!=(length)) && \
+            (__t1=(uint8_t)((s)[i]-0x80))<=0x3f \
+        ) { \
+            (c)=(((c)&0x1f)<<6)|__t1; \
+            ++(i); \
+        } else { \
+            /* function call for "complicated" and error cases */ \
+            (c)=utf8_nextCharSafeBody((const uint8_t *)s, &(i), (length), c, -3); \
+        } \
+    } \
+}
+#endif /* U_HIDE_DRAFT_API */
+
+/**
+ * Append a code point to a string, overwriting 1 to 4 bytes.
+ * The offset points to the current end of the string contents
+ * and is advanced (post-increment).
+ * "Unsafe" macro, assumes a valid code point and sufficient space in the string.
+ * Otherwise, the result is undefined.
+ *
+ * @param s const uint8_t * string buffer
+ * @param i string offset
+ * @param c code point to append
+ * @see U8_APPEND
+ * @stable ICU 2.4
+ */
+#define U8_APPEND_UNSAFE(s, i, c) { \
+    if((uint32_t)(c)<=0x7f) { \
+        (s)[(i)++]=(uint8_t)(c); \
+    } else { \
+        if((uint32_t)(c)<=0x7ff) { \
+            (s)[(i)++]=(uint8_t)(((c)>>6)|0xc0); \
+        } else { \
+            if((uint32_t)(c)<=0xffff) { \
+                (s)[(i)++]=(uint8_t)(((c)>>12)|0xe0); \
+            } else { \
+                (s)[(i)++]=(uint8_t)(((c)>>18)|0xf0); \
+                (s)[(i)++]=(uint8_t)((((c)>>12)&0x3f)|0x80); \
+            } \
+            (s)[(i)++]=(uint8_t)((((c)>>6)&0x3f)|0x80); \
+        } \
+        (s)[(i)++]=(uint8_t)(((c)&0x3f)|0x80); \
+    } \
+}
+
+/**
+ * Append a code point to a string, overwriting 1 to 4 bytes.
+ * The offset points to the current end of the string contents
+ * and is advanced (post-increment).
+ * "Safe" macro, checks for a valid code point.
+ * If a non-ASCII code point is written, checks for sufficient space in the string.
+ * If the code point is not valid or trail bytes do not fit,
+ * then isError is set to TRUE.
+ *
+ * @param s const uint8_t * string buffer
+ * @param i int32_t string offset, must be i<capacity
+ * @param capacity int32_t size of the string buffer
+ * @param c UChar32 code point to append
+ * @param isError output UBool set to TRUE if an error occurs, otherwise not modified
+ * @see U8_APPEND_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_APPEND(s, i, capacity, c, isError) { \
+    if((uint32_t)(c)<=0x7f) { \
+        (s)[(i)++]=(uint8_t)(c); \
+    } else if((uint32_t)(c)<=0x7ff && (i)+1<(capacity)) { \
+        (s)[(i)++]=(uint8_t)(((c)>>6)|0xc0); \
+        (s)[(i)++]=(uint8_t)(((c)&0x3f)|0x80); \
+    } else if((uint32_t)(c)<=0xd7ff && (i)+2<(capacity)) { \
+        (s)[(i)++]=(uint8_t)(((c)>>12)|0xe0); \
+        (s)[(i)++]=(uint8_t)((((c)>>6)&0x3f)|0x80); \
+        (s)[(i)++]=(uint8_t)(((c)&0x3f)|0x80); \
+    } else { \
+        (i)=utf8_appendCharSafeBody(s, (i), (capacity), c, &(isError)); \
+    } \
+}
+
+/**
+ * Advance the string offset from one code point boundary to the next.
+ * (Post-incrementing iteration.)
+ * "Unsafe" macro, assumes well-formed UTF-8.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @see U8_FWD_1
+ * @stable ICU 2.4
+ */
+#define U8_FWD_1_UNSAFE(s, i) { \
+    (i)+=1+U8_COUNT_TRAIL_BYTES_UNSAFE((uint8_t)(s)[i]); \
+}
+
+/**
+ * Advance the string offset from one code point boundary to the next.
+ * (Post-incrementing iteration.)
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * @param s const uint8_t * string
+ * @param i int32_t string offset, must be i<length
+ * @param length int32_t string length
+ * @see U8_FWD_1_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_FWD_1(s, i, length) { \
+    uint8_t __b=(uint8_t)(s)[(i)++]; \
+    if(U8_IS_LEAD(__b)) { \
+        uint8_t __count=U8_COUNT_TRAIL_BYTES(__b); \
+        if((i)+__count>(length) && (length)>=0) { \
+            __count=(uint8_t)((length)-(i)); \
+        } \
+        while(__count>0 && U8_IS_TRAIL((s)[i])) { \
+            ++(i); \
+            --__count; \
+        } \
+    } \
+}
+
+/**
+ * Advance the string offset from one code point boundary to the n-th next one,
+ * i.e., move forward by n code points.
+ * (Post-incrementing iteration.)
+ * "Unsafe" macro, assumes well-formed UTF-8.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @param n number of code points to skip
+ * @see U8_FWD_N
+ * @stable ICU 2.4
+ */
+#define U8_FWD_N_UNSAFE(s, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0) { \
+        U8_FWD_1_UNSAFE(s, i); \
+        --__N; \
+    } \
+}
+
+/**
+ * Advance the string offset from one code point boundary to the n-th next one,
+ * i.e., move forward by n code points.
+ * (Post-incrementing iteration.)
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * @param s const uint8_t * string
+ * @param i int32_t string offset, must be i<length
+ * @param length int32_t string length
+ * @param n number of code points to skip
+ * @see U8_FWD_N_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_FWD_N(s, i, length, n) { \
+    int32_t __N=(n); \
+    while(__N>0 && ((i)<(length) || ((length)<0 && (s)[i]!=0))) { \
+        U8_FWD_1(s, i, length); \
+        --__N; \
+    } \
+}
+
+/**
+ * Adjust a random-access offset to a code point boundary
+ * at the start of a code point.
+ * If the offset points to a UTF-8 trail byte,
+ * then the offset is moved backward to the corresponding lead byte.
+ * Otherwise, it is not modified.
+ * "Unsafe" macro, assumes well-formed UTF-8.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @see U8_SET_CP_START
+ * @stable ICU 2.4
+ */
+#define U8_SET_CP_START_UNSAFE(s, i) { \
+    while(U8_IS_TRAIL((s)[i])) { --(i); } \
+}
+
+/**
+ * Adjust a random-access offset to a code point boundary
+ * at the start of a code point.
+ * If the offset points to a UTF-8 trail byte,
+ * then the offset is moved backward to the corresponding lead byte.
+ * Otherwise, it is not modified.
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * @param s const uint8_t * string
+ * @param start int32_t starting string offset (usually 0)
+ * @param i int32_t string offset, must be start<=i
+ * @see U8_SET_CP_START_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_SET_CP_START(s, start, i) { \
+    if(U8_IS_TRAIL((s)[(i)])) { \
+        (i)=utf8_back1SafeBody(s, start, (i)); \
+    } \
+}
+
+/* definitions with backward iteration -------------------------------------- */
+
+/**
+ * Move the string offset from one code point boundary to the previous one
+ * and get the code point between them.
+ * (Pre-decrementing backward iteration.)
+ * "Unsafe" macro, assumes well-formed UTF-8.
+ *
+ * The input offset may be the same as the string length.
+ * If the offset is behind a multi-byte sequence, then the macro will read
+ * the whole sequence.
+ * If the offset is behind a lead byte, then that itself
+ * will be returned as the code point.
+ * The result is undefined if the offset is behind an illegal UTF-8 sequence.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @param c output UChar32 variable
+ * @see U8_PREV
+ * @stable ICU 2.4
+ */
+#define U8_PREV_UNSAFE(s, i, c) { \
+    (c)=(uint8_t)(s)[--(i)]; \
+    if(U8_IS_TRAIL(c)) { \
+        uint8_t __b, __count=1, __shift=6; \
+\
+        /* c is a trail byte */ \
+        (c)&=0x3f; \
+        for(;;) { \
+            __b=(uint8_t)(s)[--(i)]; \
+            if(__b>=0xc0) { \
+                U8_MASK_LEAD_BYTE(__b, __count); \
+                (c)|=(UChar32)__b<<__shift; \
+                break; \
+            } else { \
+                (c)|=(UChar32)(__b&0x3f)<<__shift; \
+                ++__count; \
+                __shift+=6; \
+            } \
+        } \
+    } \
+}
+
+/**
+ * Move the string offset from one code point boundary to the previous one
+ * and get the code point between them.
+ * (Pre-decrementing backward iteration.)
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * The input offset may be the same as the string length.
+ * If the offset is behind a multi-byte sequence, then the macro will read
+ * the whole sequence.
+ * If the offset is behind a lead byte, then that itself
+ * will be returned as the code point.
+ * If the offset is behind an illegal UTF-8 sequence, then c is set to a negative value.
+ *
+ * @param s const uint8_t * string
+ * @param start int32_t starting string offset (usually 0)
+ * @param i int32_t string offset, must be start<i
+ * @param c output UChar32 variable, set to <0 in case of an error
+ * @see U8_PREV_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_PREV(s, start, i, c) { \
+    (c)=(uint8_t)(s)[--(i)]; \
+    if((c)>=0x80) { \
+        (c)=utf8_prevCharSafeBody((const uint8_t *)s, start, &(i), c, -1); \
+    } \
+}
+
+#ifndef U_HIDE_DRAFT_API
+/**
+ * Move the string offset from one code point boundary to the previous one
+ * and get the code point between them.
+ * (Pre-decrementing backward iteration.)
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * The input offset may be the same as the string length.
+ * If the offset is behind a multi-byte sequence, then the macro will read
+ * the whole sequence.
+ * If the offset is behind a lead byte, then that itself
+ * will be returned as the code point.
+ * If the offset is behind an illegal UTF-8 sequence, then c is set to U+FFFD.
+ *
+ * This macro does not distinguish between a real U+FFFD in the text
+ * and U+FFFD returned for an ill-formed sequence.
+ * Use U8_PREV() if that distinction is important.
+ *
+ * @param s const uint8_t * string
+ * @param start int32_t starting string offset (usually 0)
+ * @param i int32_t string offset, must be start<i
+ * @param c output UChar32 variable, set to U+FFFD in case of an error
+ * @see U8_PREV
+ * @draft ICU 51
+ */
+#define U8_PREV_OR_FFFD(s, start, i, c) { \
+    (c)=(uint8_t)(s)[--(i)]; \
+    if((c)>=0x80) { \
+        (c)=utf8_prevCharSafeBody((const uint8_t *)s, start, &(i), c, -3); \
+    } \
+}
+#endif /* U_HIDE_DRAFT_API */
+
+/**
+ * Move the string offset from one code point boundary to the previous one.
+ * (Pre-decrementing backward iteration.)
+ * The input offset may be the same as the string length.
+ * "Unsafe" macro, assumes well-formed UTF-8.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @see U8_BACK_1
+ * @stable ICU 2.4
+ */
+#define U8_BACK_1_UNSAFE(s, i) { \
+    while(U8_IS_TRAIL((s)[--(i)])) {} \
+}
+
+/**
+ * Move the string offset from one code point boundary to the previous one.
+ * (Pre-decrementing backward iteration.)
+ * The input offset may be the same as the string length.
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * @param s const uint8_t * string
+ * @param start int32_t starting string offset (usually 0)
+ * @param i int32_t string offset, must be start<i
+ * @see U8_BACK_1_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_BACK_1(s, start, i) { \
+    if(U8_IS_TRAIL((s)[--(i)])) { \
+        (i)=utf8_back1SafeBody(s, start, (i)); \
+    } \
+}
+
+/**
+ * Move the string offset from one code point boundary to the n-th one before it,
+ * i.e., move backward by n code points.
+ * (Pre-decrementing backward iteration.)
+ * The input offset may be the same as the string length.
+ * "Unsafe" macro, assumes well-formed UTF-8.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @param n number of code points to skip
+ * @see U8_BACK_N
+ * @stable ICU 2.4
+ */
+#define U8_BACK_N_UNSAFE(s, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0) { \
+        U8_BACK_1_UNSAFE(s, i); \
+        --__N; \
+    } \
+}
+
+/**
+ * Move the string offset from one code point boundary to the n-th one before it,
+ * i.e., move backward by n code points.
+ * (Pre-decrementing backward iteration.)
+ * The input offset may be the same as the string length.
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * @param s const uint8_t * string
+ * @param start int32_t index of the start of the string
+ * @param i int32_t string offset, must be start<i
+ * @param n number of code points to skip
+ * @see U8_BACK_N_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_BACK_N(s, start, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0 && (i)>(start)) { \
+        U8_BACK_1(s, start, i); \
+        --__N; \
+    } \
+}
+
+/**
+ * Adjust a random-access offset to a code point boundary after a code point.
+ * If the offset is behind a partial multi-byte sequence,
+ * then the offset is incremented to behind the whole sequence.
+ * Otherwise, it is not modified.
+ * The input offset may be the same as the string length.
+ * "Unsafe" macro, assumes well-formed UTF-8.
+ *
+ * @param s const uint8_t * string
+ * @param i string offset
+ * @see U8_SET_CP_LIMIT
+ * @stable ICU 2.4
+ */
+#define U8_SET_CP_LIMIT_UNSAFE(s, i) { \
+    U8_BACK_1_UNSAFE(s, i); \
+    U8_FWD_1_UNSAFE(s, i); \
+}
+
+/**
+ * Adjust a random-access offset to a code point boundary after a code point.
+ * If the offset is behind a partial multi-byte sequence,
+ * then the offset is incremented to behind the whole sequence.
+ * Otherwise, it is not modified.
+ * The input offset may be the same as the string length.
+ * "Safe" macro, checks for illegal sequences and for string boundaries.
+ *
+ * The length can be negative for a NUL-terminated string.
+ *
+ * @param s const uint8_t * string
+ * @param start int32_t starting string offset (usually 0)
+ * @param i int32_t string offset, must be start<=i<=length
+ * @param length int32_t string length
+ * @see U8_SET_CP_LIMIT_UNSAFE
+ * @stable ICU 2.4
+ */
+#define U8_SET_CP_LIMIT(s, start, i, length) { \
+    if((start)<(i) && ((i)<(length) || ((length)<0 && (s)[i]!=0))) { \
+        U8_BACK_1(s, start, i); \
+        U8_FWD_1(s, i, length); \
+    } \
+}
+
+#endif
diff --git a/icu/unicode/utf_old.h b/icu/unicode/utf_old.h
new file mode 100644
index 0000000..f9125b1
--- /dev/null
+++ b/icu/unicode/utf_old.h
@@ -0,0 +1,1169 @@
+/*
+*******************************************************************************
+*
+*   Copyright (C) 2002-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*
+*******************************************************************************
+*   file name:  utf_old.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   created on: 2002sep21
+*   created by: Markus W. Scherer
+*/
+
+/**
+ * \file 
+ * \brief C API: Deprecated macros for Unicode string handling
+ */
+
+/**
+ * 
+ * The macros in utf_old.h are all deprecated and their use discouraged.
+ * Some of the design principles behind the set of UTF macros
+ * have changed or proved impractical.
+ * Almost all of the old "UTF macros" are at least renamed.
+ * If you are looking for a new equivalent to an old macro, please see the
+ * comment at the old one.
+ *
+ * Brief summary of reasons for deprecation:
+ * - Switch on UTF_SIZE (selection of UTF-8/16/32 default string processing)
+ *   was impractical.
+ * - Switch on UTF_SAFE etc. (selection of unsafe/safe/strict default string processing)
+ *   was of little use and impractical.
+ * - Whole classes of macros became obsolete outside of the UTF_SIZE/UTF_SAFE
+ *   selection framework: UTF32_ macros (all trivial)
+ *   and UTF_ default and intermediate macros (all aliases).
+ * - The selection framework also caused many macro aliases.
+ * - Change in Unicode standard: "irregular" sequences (3.0) became illegal (3.2).
+ * - Change of language in Unicode standard:
+ *   Growing distinction between internal x-bit Unicode strings and external UTF-x
+ *   forms, with the former more lenient.
+ *   Suggests renaming of UTF16_ macros to U16_.
+ * - The prefix "UTF_" without a width number confused some users.
+ * - "Safe" append macros needed the addition of an error indicator output.
+ * - "Safe" UTF-8 macros used legitimate (if rarely used) code point values
+ *   to indicate error conditions.
+ * - The use of the "_CHAR" infix for code point operations confused some users.
+ *
+ * More details:
+ *
+ * Until ICU 2.2, utf.h theoretically allowed to choose among UTF-8/16/32
+ * for string processing, and among unsafe/safe/strict default macros for that.
+ *
+ * It proved nearly impossible to write non-trivial, high-performance code
+ * that is UTF-generic.
+ * Unsafe default macros would be dangerous for default string processing,
+ * and the main reason for the "strict" versions disappeared:
+ * Between Unicode 3.0 and 3.2 all "irregular" UTF-8 sequences became illegal.
+ * The only other conditions that "strict" checked for were non-characters,
+ * which are valid during processing. Only during text input/output should they
+ * be checked, and at that time other well-formedness checks may be
+ * necessary or useful as well.
+ * This can still be done by using U16_NEXT and U_IS_UNICODE_NONCHAR
+ * or U_IS_UNICODE_CHAR.
+ *
+ * The old UTF8_..._SAFE macros also used some normal Unicode code points
+ * to indicate malformed sequences.
+ * The new UTF8_ macros without suffix use negative values instead.
+ *
+ * The entire contents of utf32.h was moved here without replacement
+ * because all those macros were trivial and
+ * were meaningful only in the framework of choosing the UTF size.
+ *
+ * See Jitterbug 2150 and its discussion on the ICU mailing list
+ * in September 2002.
+ *
+ * <hr>
+ *
+ * <em>Obsolete part</em> of pre-ICU 2.4 utf.h file documentation:
+ *
+ * <p>The original concept for these files was for ICU to allow
+ * in principle to set which UTF (UTF-8/16/32) is used internally
+ * by defining UTF_SIZE to either 8, 16, or 32. utf.h would then define the UChar type
+ * accordingly. UTF-16 was the default.</p>
+ *
+ * <p>This concept has been abandoned.
+ * A lot of the ICU source code assumes UChar strings are in UTF-16.
+ * This is especially true for low-level code like
+ * conversion, normalization, and collation.
+ * The utf.h header enforces the default of UTF-16.
+ * The UTF-8 and UTF-32 macros remain for now for completeness and backward compatibility.</p>
+ *
+ * <p>Accordingly, utf.h defines UChar to be an unsigned 16-bit integer. If this matches wchar_t, then
+ * UChar is defined to be exactly wchar_t, otherwise uint16_t.</p>
+ *
+ * <p>UChar32 is defined to be a signed 32-bit integer (int32_t), large enough for a 21-bit
+ * Unicode code point (Unicode scalar value, 0..0x10ffff).
+ * Before ICU 2.4, the definition of UChar32 was similarly platform-dependent as
+ * the definition of UChar. For details see the documentation for UChar32 itself.</p>
+ *
+ * <p>utf.h also defines a number of C macros for handling single Unicode code points and
+ * for using UTF Unicode strings. It includes utf8.h, utf16.h, and utf32.h for the actual
+ * implementations of those macros and then aliases one set of them (for UTF-16) for general use.
+ * The UTF-specific macros have the UTF size in the macro name prefixes (UTF16_...), while
+ * the general alias macros always begin with UTF_...</p>
+ *
+ * <p>Many string operations can be done with or without error checking.
+ * Where such a distinction is useful, there are two versions of the macros, "unsafe" and "safe"
+ * ones with ..._UNSAFE and ..._SAFE suffixes. The unsafe macros are fast but may cause
+ * program failures if the strings are not well-formed. The safe macros have an additional, boolean
+ * parameter "strict". If strict is FALSE, then only illegal sequences are detected.
+ * Otherwise, irregular sequences and non-characters are detected as well (like single surrogates).
+ * Safe macros return special error code points for illegal/irregular sequences:
+ * Typically, U+ffff, or values that would result in a code unit sequence of the same length
+ * as the erroneous input sequence.<br>
+ * Note that _UNSAFE macros have fewer parameters: They do not have the strictness parameter, and
+ * they do not have start/length parameters for boundary checking.</p>
+ *
+ * <p>Here, the macros are aliased in two steps:
+ * In the first step, the UTF-specific macros with UTF16_ prefix and _UNSAFE and _SAFE suffixes are
+ * aliased according to the UTF_SIZE to macros with UTF_ prefix and the same suffixes and signatures.
+ * Then, in a second step, the default, general alias macros are set to use either the unsafe or
+ * the safe/not strict (default) or the safe/strict macro;
+ * these general macros do not have a strictness parameter.</p>
+ *
+ * <p>It is possible to change the default choice for the general alias macros to be unsafe, safe/not strict or safe/strict.
+ * The default is safe/not strict. It is not recommended to select the unsafe macros as the basis for
+ * Unicode string handling in ICU! To select this, define UTF_SAFE, UTF_STRICT, or UTF_UNSAFE.</p>
+ *
+ * <p>For general use, one should use the default, general macros with UTF_ prefix and no _SAFE/_UNSAFE suffix.
+ * Only in some cases it may be necessary to control the choice of macro directly and use a less generic alias.
+ * For example, if it can be assumed that a string is well-formed and the index will stay within the bounds,
+ * then the _UNSAFE version may be used.
+ * If a UTF-8 string is to be processed, then the macros with UTF8_ prefixes need to be used.</p>
+ *
+ * <hr>
+ *
+ * @deprecated ICU 2.4. Use the macros in utf.h, utf16.h, utf8.h instead.
+ */
+
+#ifndef __UTF_OLD_H__
+#define __UTF_OLD_H__
+
+#ifndef U_HIDE_DEPRECATED_API
+
+#include "unicode/utf.h"
+#include "unicode/utf8.h"
+#include "unicode/utf16.h"
+
+/* Formerly utf.h, part 1 --------------------------------------------------- */
+
+#ifdef U_USE_UTF_DEPRECATES
+/**
+ * Unicode string and array offset and index type.
+ * ICU always counts Unicode code units (UChars) for
+ * string offsets, indexes, and lengths, not Unicode code points.
+ *
+ * @obsolete ICU 2.6. Use int32_t directly instead since this API will be removed in that release.
+ */
+typedef int32_t UTextOffset;
+#endif
+
+/** Number of bits in a Unicode string code unit - ICU uses 16-bit Unicode. @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF_SIZE 16
+
+/**
+ * The default choice for general Unicode string macros is to use the ..._SAFE macro implementations
+ * with strict=FALSE.
+ *
+ * @deprecated ICU 2.4. Obsolete, see utf_old.h.
+ */
+#define UTF_SAFE
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#undef UTF_UNSAFE
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#undef UTF_STRICT
+
+/**
+ * UTF8_ERROR_VALUE_1 and UTF8_ERROR_VALUE_2 are special error values for UTF-8,
+ * which need 1 or 2 bytes in UTF-8:
+ * \code
+ * U+0015 = NAK = Negative Acknowledge, C0 control character
+ * U+009f = highest C1 control character
+ * \endcode
+ *
+ * These are used by UTF8_..._SAFE macros so that they can return an error value
+ * that needs the same number of code units (bytes) as were seen by
+ * a macro. They should be tested with UTF_IS_ERROR() or UTF_IS_VALID().
+ *
+ * @deprecated ICU 2.4. Obsolete, see utf_old.h.
+ */
+#define UTF8_ERROR_VALUE_1 0x15
+
+/**
+ * See documentation on UTF8_ERROR_VALUE_1 for details.
+ *
+ * @deprecated ICU 2.4. Obsolete, see utf_old.h.
+ */
+#define UTF8_ERROR_VALUE_2 0x9f
+
+/**
+ * Error value for all UTFs. This code point value will be set by macros with error
+ * checking if an error is detected.
+ *
+ * @deprecated ICU 2.4. Obsolete, see utf_old.h.
+ */
+#define UTF_ERROR_VALUE 0xffff
+
+/**
+ * Is a given 32-bit code an error value
+ * as returned by one of the macros for any UTF?
+ *
+ * @deprecated ICU 2.4. Obsolete, see utf_old.h.
+ */
+#define UTF_IS_ERROR(c) \
+    (((c)&0xfffe)==0xfffe || (c)==UTF8_ERROR_VALUE_1 || (c)==UTF8_ERROR_VALUE_2)
+
+/**
+ * This is a combined macro: Is c a valid Unicode value _and_ not an error code?
+ *
+ * @deprecated ICU 2.4. Obsolete, see utf_old.h.
+ */
+#define UTF_IS_VALID(c) \
+    (UTF_IS_UNICODE_CHAR(c) && \
+     (c)!=UTF8_ERROR_VALUE_1 && (c)!=UTF8_ERROR_VALUE_2)
+
+/**
+ * Is this code unit or code point a surrogate (U+d800..U+dfff)?
+ * @deprecated ICU 2.4. Renamed to U_IS_SURROGATE and U16_IS_SURROGATE, see utf_old.h.
+ */
+#define UTF_IS_SURROGATE(uchar) (((uchar)&0xfffff800)==0xd800)
+
+/**
+ * Is a given 32-bit code point a Unicode noncharacter?
+ *
+ * @deprecated ICU 2.4. Renamed to U_IS_UNICODE_NONCHAR, see utf_old.h.
+ */
+#define UTF_IS_UNICODE_NONCHAR(c) \
+    ((c)>=0xfdd0 && \
+     ((uint32_t)(c)<=0xfdef || ((c)&0xfffe)==0xfffe) && \
+     (uint32_t)(c)<=0x10ffff)
+
+/**
+ * Is a given 32-bit value a Unicode code point value (0..U+10ffff)
+ * that can be assigned a character?
+ *
+ * Code points that are not characters include:
+ * - single surrogate code points (U+d800..U+dfff, 2048 code points)
+ * - the last two code points on each plane (U+__fffe and U+__ffff, 34 code points)
+ * - U+fdd0..U+fdef (new with Unicode 3.1, 32 code points)
+ * - the highest Unicode code point value is U+10ffff
+ *
+ * This means that all code points below U+d800 are character code points,
+ * and that boundary is tested first for performance.
+ *
+ * @deprecated ICU 2.4. Renamed to U_IS_UNICODE_CHAR, see utf_old.h.
+ */
+#define UTF_IS_UNICODE_CHAR(c) \
+    ((uint32_t)(c)<0xd800 || \
+        ((uint32_t)(c)>0xdfff && \
+         (uint32_t)(c)<=0x10ffff && \
+         !UTF_IS_UNICODE_NONCHAR(c)))
+
+/* Formerly utf8.h ---------------------------------------------------------- */
+
+/**
+ * Count the trail bytes for a UTF-8 lead byte.
+ * @deprecated ICU 2.4. Renamed to U8_COUNT_TRAIL_BYTES, see utf_old.h.
+ */
+#define UTF8_COUNT_TRAIL_BYTES(leadByte) (utf8_countTrailBytes[(uint8_t)leadByte])
+
+/**
+ * Mask a UTF-8 lead byte, leave only the lower bits that form part of the code point value.
+ * @deprecated ICU 2.4. Renamed to U8_MASK_LEAD_BYTE, see utf_old.h.
+ */
+#define UTF8_MASK_LEAD_BYTE(leadByte, countTrailBytes) ((leadByte)&=(1<<(6-(countTrailBytes)))-1)
+
+/** Is this this code point a single code unit (byte)? @deprecated ICU 2.4. Renamed to U8_IS_SINGLE, see utf_old.h. */
+#define UTF8_IS_SINGLE(uchar) (((uchar)&0x80)==0)
+/** Is this this code unit the lead code unit (byte) of a code point? @deprecated ICU 2.4. Renamed to U8_IS_LEAD, see utf_old.h. */
+#define UTF8_IS_LEAD(uchar) ((uint8_t)((uchar)-0xc0)<0x3e)
+/** Is this this code unit a trailing code unit (byte) of a code point? @deprecated ICU 2.4. Renamed to U8_IS_TRAIL, see utf_old.h. */
+#define UTF8_IS_TRAIL(uchar) (((uchar)&0xc0)==0x80)
+
+/** Does this scalar Unicode value need multiple code units for storage? @deprecated ICU 2.4. Use U8_LENGTH or test ((uint32_t)(c)>0x7f) instead, see utf_old.h. */
+#define UTF8_NEED_MULTIPLE_UCHAR(c) ((uint32_t)(c)>0x7f)
+
+/**
+ * Given the lead character, how many bytes are taken by this code point.
+ * ICU does not deal with code points >0x10ffff
+ * unless necessary for advancing in the byte stream.
+ *
+ * These length macros take into account that for values >0x10ffff
+ * the UTF8_APPEND_CHAR_SAFE macros would write the error code point 0xffff
+ * with 3 bytes.
+ * Code point comparisons need to be in uint32_t because UChar32
+ * may be a signed type, and negative values must be recognized.
+ *
+ * @deprecated ICU 2.4. Use U8_LENGTH instead, see utf.h.
+ */
+#if 1
+#   define UTF8_CHAR_LENGTH(c) \
+        ((uint32_t)(c)<=0x7f ? 1 : \
+            ((uint32_t)(c)<=0x7ff ? 2 : \
+                ((uint32_t)((c)-0x10000)>0xfffff ? 3 : 4) \
+            ) \
+        )
+#else
+#   define UTF8_CHAR_LENGTH(c) \
+        ((uint32_t)(c)<=0x7f ? 1 : \
+            ((uint32_t)(c)<=0x7ff ? 2 : \
+                ((uint32_t)(c)<=0xffff ? 3 : \
+                    ((uint32_t)(c)<=0x10ffff ? 4 : \
+                        ((uint32_t)(c)<=0x3ffffff ? 5 : \
+                            ((uint32_t)(c)<=0x7fffffff ? 6 : 3) \
+                        ) \
+                    ) \
+                ) \
+            ) \
+        )
+#endif
+
+/** The maximum number of bytes per code point. @deprecated ICU 2.4. Renamed to U8_MAX_LENGTH, see utf_old.h. */
+#define UTF8_MAX_CHAR_LENGTH 4
+
+/** Average number of code units compared to UTF-16. @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF8_ARRAY_SIZE(size) ((5*(size))/2)
+
+/** @deprecated ICU 2.4. Renamed to U8_GET_UNSAFE, see utf_old.h. */
+#define UTF8_GET_CHAR_UNSAFE(s, i, c) { \
+    int32_t _utf8_get_char_unsafe_index=(int32_t)(i); \
+    UTF8_SET_CHAR_START_UNSAFE(s, _utf8_get_char_unsafe_index); \
+    UTF8_NEXT_CHAR_UNSAFE(s, _utf8_get_char_unsafe_index, c); \
+}
+
+/** @deprecated ICU 2.4. Use U8_GET instead, see utf_old.h. */
+#define UTF8_GET_CHAR_SAFE(s, start, i, length, c, strict) { \
+    int32_t _utf8_get_char_safe_index=(int32_t)(i); \
+    UTF8_SET_CHAR_START_SAFE(s, start, _utf8_get_char_safe_index); \
+    UTF8_NEXT_CHAR_SAFE(s, _utf8_get_char_safe_index, length, c, strict); \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_NEXT_UNSAFE, see utf_old.h. */
+#define UTF8_NEXT_CHAR_UNSAFE(s, i, c) { \
+    (c)=(s)[(i)++]; \
+    if((uint8_t)((c)-0xc0)<0x35) { \
+        uint8_t __count=UTF8_COUNT_TRAIL_BYTES(c); \
+        UTF8_MASK_LEAD_BYTE(c, __count); \
+        switch(__count) { \
+        /* each following branch falls through to the next one */ \
+        case 3: \
+            (c)=((c)<<6)|((s)[(i)++]&0x3f); \
+        case 2: \
+            (c)=((c)<<6)|((s)[(i)++]&0x3f); \
+        case 1: \
+            (c)=((c)<<6)|((s)[(i)++]&0x3f); \
+        /* no other branches to optimize switch() */ \
+            break; \
+        } \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_APPEND_UNSAFE, see utf_old.h. */
+#define UTF8_APPEND_CHAR_UNSAFE(s, i, c) { \
+    if((uint32_t)(c)<=0x7f) { \
+        (s)[(i)++]=(uint8_t)(c); \
+    } else { \
+        if((uint32_t)(c)<=0x7ff) { \
+            (s)[(i)++]=(uint8_t)(((c)>>6)|0xc0); \
+        } else { \
+            if((uint32_t)(c)<=0xffff) { \
+                (s)[(i)++]=(uint8_t)(((c)>>12)|0xe0); \
+            } else { \
+                (s)[(i)++]=(uint8_t)(((c)>>18)|0xf0); \
+                (s)[(i)++]=(uint8_t)((((c)>>12)&0x3f)|0x80); \
+            } \
+            (s)[(i)++]=(uint8_t)((((c)>>6)&0x3f)|0x80); \
+        } \
+        (s)[(i)++]=(uint8_t)(((c)&0x3f)|0x80); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_FWD_1_UNSAFE, see utf_old.h. */
+#define UTF8_FWD_1_UNSAFE(s, i) { \
+    (i)+=1+UTF8_COUNT_TRAIL_BYTES((s)[i]); \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_FWD_N_UNSAFE, see utf_old.h. */
+#define UTF8_FWD_N_UNSAFE(s, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0) { \
+        UTF8_FWD_1_UNSAFE(s, i); \
+        --__N; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_SET_CP_START_UNSAFE, see utf_old.h. */
+#define UTF8_SET_CHAR_START_UNSAFE(s, i) { \
+    while(UTF8_IS_TRAIL((s)[i])) { --(i); } \
+}
+
+/** @deprecated ICU 2.4. Use U8_NEXT instead, see utf_old.h. */
+#define UTF8_NEXT_CHAR_SAFE(s, i, length, c, strict) { \
+    (c)=(s)[(i)++]; \
+    if((c)>=0x80) { \
+        if(UTF8_IS_LEAD(c)) { \
+            (c)=utf8_nextCharSafeBody(s, &(i), (int32_t)(length), c, strict); \
+        } else { \
+            (c)=UTF8_ERROR_VALUE_1; \
+        } \
+    } \
+}
+
+/** @deprecated ICU 2.4. Use U8_APPEND instead, see utf_old.h. */
+#define UTF8_APPEND_CHAR_SAFE(s, i, length, c)  { \
+    if((uint32_t)(c)<=0x7f) { \
+        (s)[(i)++]=(uint8_t)(c); \
+    } else { \
+        (i)=utf8_appendCharSafeBody(s, (int32_t)(i), (int32_t)(length), c, NULL); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_FWD_1, see utf_old.h. */
+#define UTF8_FWD_1_SAFE(s, i, length) U8_FWD_1(s, i, length)
+
+/** @deprecated ICU 2.4. Renamed to U8_FWD_N, see utf_old.h. */
+#define UTF8_FWD_N_SAFE(s, i, length, n) U8_FWD_N(s, i, length, n)
+
+/** @deprecated ICU 2.4. Renamed to U8_SET_CP_START, see utf_old.h. */
+#define UTF8_SET_CHAR_START_SAFE(s, start, i) U8_SET_CP_START(s, start, i)
+
+/** @deprecated ICU 2.4. Renamed to U8_PREV_UNSAFE, see utf_old.h. */
+#define UTF8_PREV_CHAR_UNSAFE(s, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(UTF8_IS_TRAIL(c)) { \
+        uint8_t __b, __count=1, __shift=6; \
+\
+        /* c is a trail byte */ \
+        (c)&=0x3f; \
+        for(;;) { \
+            __b=(s)[--(i)]; \
+            if(__b>=0xc0) { \
+                UTF8_MASK_LEAD_BYTE(__b, __count); \
+                (c)|=(UChar32)__b<<__shift; \
+                break; \
+            } else { \
+                (c)|=(UChar32)(__b&0x3f)<<__shift; \
+                ++__count; \
+                __shift+=6; \
+            } \
+        } \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_BACK_1_UNSAFE, see utf_old.h. */
+#define UTF8_BACK_1_UNSAFE(s, i) { \
+    while(UTF8_IS_TRAIL((s)[--(i)])) {} \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_BACK_N_UNSAFE, see utf_old.h. */
+#define UTF8_BACK_N_UNSAFE(s, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0) { \
+        UTF8_BACK_1_UNSAFE(s, i); \
+        --__N; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_SET_CP_LIMIT_UNSAFE, see utf_old.h. */
+#define UTF8_SET_CHAR_LIMIT_UNSAFE(s, i) { \
+    UTF8_BACK_1_UNSAFE(s, i); \
+    UTF8_FWD_1_UNSAFE(s, i); \
+}
+
+/** @deprecated ICU 2.4. Use U8_PREV instead, see utf_old.h. */
+#define UTF8_PREV_CHAR_SAFE(s, start, i, c, strict) { \
+    (c)=(s)[--(i)]; \
+    if((c)>=0x80) { \
+        if((c)<=0xbf) { \
+            (c)=utf8_prevCharSafeBody(s, start, &(i), c, strict); \
+        } else { \
+            (c)=UTF8_ERROR_VALUE_1; \
+        } \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U8_BACK_1, see utf_old.h. */
+#define UTF8_BACK_1_SAFE(s, start, i) U8_BACK_1(s, start, i)
+
+/** @deprecated ICU 2.4. Renamed to U8_BACK_N, see utf_old.h. */
+#define UTF8_BACK_N_SAFE(s, start, i, n) U8_BACK_N(s, start, i, n)
+
+/** @deprecated ICU 2.4. Renamed to U8_SET_CP_LIMIT, see utf_old.h. */
+#define UTF8_SET_CHAR_LIMIT_SAFE(s, start, i, length) U8_SET_CP_LIMIT(s, start, i, length)
+
+/* Formerly utf16.h --------------------------------------------------------- */
+
+/** Is uchar a first/lead surrogate? @deprecated ICU 2.4. Renamed to U_IS_LEAD and U16_IS_LEAD, see utf_old.h. */
+#define UTF_IS_FIRST_SURROGATE(uchar) (((uchar)&0xfffffc00)==0xd800)
+
+/** Is uchar a second/trail surrogate? @deprecated ICU 2.4. Renamed to U_IS_TRAIL and U16_IS_TRAIL, see utf_old.h. */
+#define UTF_IS_SECOND_SURROGATE(uchar) (((uchar)&0xfffffc00)==0xdc00)
+
+/** Assuming c is a surrogate, is it a first/lead surrogate? @deprecated ICU 2.4. Renamed to U_IS_SURROGATE_LEAD and U16_IS_SURROGATE_LEAD, see utf_old.h. */
+#define UTF_IS_SURROGATE_FIRST(c) (((c)&0x400)==0)
+
+/** Helper constant for UTF16_GET_PAIR_VALUE. @deprecated ICU 2.4. Renamed to U16_SURROGATE_OFFSET, see utf_old.h. */
+#define UTF_SURROGATE_OFFSET ((0xd800<<10UL)+0xdc00-0x10000)
+
+/** Get the UTF-32 value from the surrogate code units. @deprecated ICU 2.4. Renamed to U16_GET_SUPPLEMENTARY, see utf_old.h. */
+#define UTF16_GET_PAIR_VALUE(first, second) \
+    (((first)<<10UL)+(second)-UTF_SURROGATE_OFFSET)
+
+/** @deprecated ICU 2.4. Renamed to U16_LEAD, see utf_old.h. */
+#define UTF_FIRST_SURROGATE(supplementary) (UChar)(((supplementary)>>10)+0xd7c0)
+
+/** @deprecated ICU 2.4. Renamed to U16_TRAIL, see utf_old.h. */
+#define UTF_SECOND_SURROGATE(supplementary) (UChar)(((supplementary)&0x3ff)|0xdc00)
+
+/** @deprecated ICU 2.4. Renamed to U16_LEAD, see utf_old.h. */
+#define UTF16_LEAD(supplementary) UTF_FIRST_SURROGATE(supplementary)
+
+/** @deprecated ICU 2.4. Renamed to U16_TRAIL, see utf_old.h. */
+#define UTF16_TRAIL(supplementary) UTF_SECOND_SURROGATE(supplementary)
+
+/** @deprecated ICU 2.4. Renamed to U16_IS_SINGLE, see utf_old.h. */
+#define UTF16_IS_SINGLE(uchar) !UTF_IS_SURROGATE(uchar)
+
+/** @deprecated ICU 2.4. Renamed to U16_IS_LEAD, see utf_old.h. */
+#define UTF16_IS_LEAD(uchar) UTF_IS_FIRST_SURROGATE(uchar)
+
+/** @deprecated ICU 2.4. Renamed to U16_IS_TRAIL, see utf_old.h. */
+#define UTF16_IS_TRAIL(uchar) UTF_IS_SECOND_SURROGATE(uchar)
+
+/** Does this scalar Unicode value need multiple code units for storage? @deprecated ICU 2.4. Use U16_LENGTH or test ((uint32_t)(c)>0xffff) instead, see utf_old.h. */
+#define UTF16_NEED_MULTIPLE_UCHAR(c) ((uint32_t)(c)>0xffff)
+
+/** @deprecated ICU 2.4. Renamed to U16_LENGTH, see utf_old.h. */
+#define UTF16_CHAR_LENGTH(c) ((uint32_t)(c)<=0xffff ? 1 : 2)
+
+/** @deprecated ICU 2.4. Renamed to U16_MAX_LENGTH, see utf_old.h. */
+#define UTF16_MAX_CHAR_LENGTH 2
+
+/** Average number of code units compared to UTF-16. @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF16_ARRAY_SIZE(size) (size)
+
+/**
+ * Get a single code point from an offset that points to any
+ * of the code units that belong to that code point.
+ * Assume 0<=i<length.
+ *
+ * This could be used for iteration together with
+ * UTF16_CHAR_LENGTH() and UTF_IS_ERROR(),
+ * but the use of UTF16_NEXT_CHAR[_UNSAFE]() and
+ * UTF16_PREV_CHAR[_UNSAFE]() is more efficient for that.
+ * @deprecated ICU 2.4. Renamed to U16_GET_UNSAFE, see utf_old.h.
+ */
+#define UTF16_GET_CHAR_UNSAFE(s, i, c) { \
+    (c)=(s)[i]; \
+    if(UTF_IS_SURROGATE(c)) { \
+        if(UTF_IS_SURROGATE_FIRST(c)) { \
+            (c)=UTF16_GET_PAIR_VALUE((c), (s)[(i)+1]); \
+        } else { \
+            (c)=UTF16_GET_PAIR_VALUE((s)[(i)-1], (c)); \
+        } \
+    } \
+}
+
+/** @deprecated ICU 2.4. Use U16_GET instead, see utf_old.h. */
+#define UTF16_GET_CHAR_SAFE(s, start, i, length, c, strict) { \
+    (c)=(s)[i]; \
+    if(UTF_IS_SURROGATE(c)) { \
+        uint16_t __c2; \
+        if(UTF_IS_SURROGATE_FIRST(c)) { \
+            if((i)+1<(length) && UTF_IS_SECOND_SURROGATE(__c2=(s)[(i)+1])) { \
+                (c)=UTF16_GET_PAIR_VALUE((c), __c2); \
+                /* strict: ((c)&0xfffe)==0xfffe is caught by UTF_IS_ERROR() and UTF_IS_UNICODE_CHAR() */ \
+            } else if(strict) {\
+                /* unmatched first surrogate */ \
+                (c)=UTF_ERROR_VALUE; \
+            } \
+        } else { \
+            if((i)-1>=(start) && UTF_IS_FIRST_SURROGATE(__c2=(s)[(i)-1])) { \
+                (c)=UTF16_GET_PAIR_VALUE(__c2, (c)); \
+                /* strict: ((c)&0xfffe)==0xfffe is caught by UTF_IS_ERROR() and UTF_IS_UNICODE_CHAR() */ \
+            } else if(strict) {\
+                /* unmatched second surrogate */ \
+                (c)=UTF_ERROR_VALUE; \
+            } \
+        } \
+    } else if((strict) && !UTF_IS_UNICODE_CHAR(c)) { \
+        (c)=UTF_ERROR_VALUE; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_NEXT_UNSAFE, see utf_old.h. */
+#define UTF16_NEXT_CHAR_UNSAFE(s, i, c) { \
+    (c)=(s)[(i)++]; \
+    if(UTF_IS_FIRST_SURROGATE(c)) { \
+        (c)=UTF16_GET_PAIR_VALUE((c), (s)[(i)++]); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_APPEND_UNSAFE, see utf_old.h. */
+#define UTF16_APPEND_CHAR_UNSAFE(s, i, c) { \
+    if((uint32_t)(c)<=0xffff) { \
+        (s)[(i)++]=(uint16_t)(c); \
+    } else { \
+        (s)[(i)++]=(uint16_t)(((c)>>10)+0xd7c0); \
+        (s)[(i)++]=(uint16_t)(((c)&0x3ff)|0xdc00); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_FWD_1_UNSAFE, see utf_old.h. */
+#define UTF16_FWD_1_UNSAFE(s, i) { \
+    if(UTF_IS_FIRST_SURROGATE((s)[(i)++])) { \
+        ++(i); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_FWD_N_UNSAFE, see utf_old.h. */
+#define UTF16_FWD_N_UNSAFE(s, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0) { \
+        UTF16_FWD_1_UNSAFE(s, i); \
+        --__N; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_SET_CP_START_UNSAFE, see utf_old.h. */
+#define UTF16_SET_CHAR_START_UNSAFE(s, i) { \
+    if(UTF_IS_SECOND_SURROGATE((s)[i])) { \
+        --(i); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Use U16_NEXT instead, see utf_old.h. */
+#define UTF16_NEXT_CHAR_SAFE(s, i, length, c, strict) { \
+    (c)=(s)[(i)++]; \
+    if(UTF_IS_FIRST_SURROGATE(c)) { \
+        uint16_t __c2; \
+        if((i)<(length) && UTF_IS_SECOND_SURROGATE(__c2=(s)[(i)])) { \
+            ++(i); \
+            (c)=UTF16_GET_PAIR_VALUE((c), __c2); \
+            /* strict: ((c)&0xfffe)==0xfffe is caught by UTF_IS_ERROR() and UTF_IS_UNICODE_CHAR() */ \
+        } else if(strict) {\
+            /* unmatched first surrogate */ \
+            (c)=UTF_ERROR_VALUE; \
+        } \
+    } else if((strict) && !UTF_IS_UNICODE_CHAR(c)) { \
+        /* unmatched second surrogate or other non-character */ \
+        (c)=UTF_ERROR_VALUE; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Use U16_APPEND instead, see utf_old.h. */
+#define UTF16_APPEND_CHAR_SAFE(s, i, length, c) { \
+    if((uint32_t)(c)<=0xffff) { \
+        (s)[(i)++]=(uint16_t)(c); \
+    } else if((uint32_t)(c)<=0x10ffff) { \
+        if((i)+1<(length)) { \
+            (s)[(i)++]=(uint16_t)(((c)>>10)+0xd7c0); \
+            (s)[(i)++]=(uint16_t)(((c)&0x3ff)|0xdc00); \
+        } else /* not enough space */ { \
+            (s)[(i)++]=UTF_ERROR_VALUE; \
+        } \
+    } else /* c>0x10ffff, write error value */ { \
+        (s)[(i)++]=UTF_ERROR_VALUE; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_FWD_1, see utf_old.h. */
+#define UTF16_FWD_1_SAFE(s, i, length) U16_FWD_1(s, i, length)
+
+/** @deprecated ICU 2.4. Renamed to U16_FWD_N, see utf_old.h. */
+#define UTF16_FWD_N_SAFE(s, i, length, n) U16_FWD_N(s, i, length, n)
+
+/** @deprecated ICU 2.4. Renamed to U16_SET_CP_START, see utf_old.h. */
+#define UTF16_SET_CHAR_START_SAFE(s, start, i) U16_SET_CP_START(s, start, i)
+
+/** @deprecated ICU 2.4. Renamed to U16_PREV_UNSAFE, see utf_old.h. */
+#define UTF16_PREV_CHAR_UNSAFE(s, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(UTF_IS_SECOND_SURROGATE(c)) { \
+        (c)=UTF16_GET_PAIR_VALUE((s)[--(i)], (c)); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_BACK_1_UNSAFE, see utf_old.h. */
+#define UTF16_BACK_1_UNSAFE(s, i) { \
+    if(UTF_IS_SECOND_SURROGATE((s)[--(i)])) { \
+        --(i); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_BACK_N_UNSAFE, see utf_old.h. */
+#define UTF16_BACK_N_UNSAFE(s, i, n) { \
+    int32_t __N=(n); \
+    while(__N>0) { \
+        UTF16_BACK_1_UNSAFE(s, i); \
+        --__N; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_SET_CP_LIMIT_UNSAFE, see utf_old.h. */
+#define UTF16_SET_CHAR_LIMIT_UNSAFE(s, i) { \
+    if(UTF_IS_FIRST_SURROGATE((s)[(i)-1])) { \
+        ++(i); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Use U16_PREV instead, see utf_old.h. */
+#define UTF16_PREV_CHAR_SAFE(s, start, i, c, strict) { \
+    (c)=(s)[--(i)]; \
+    if(UTF_IS_SECOND_SURROGATE(c)) { \
+        uint16_t __c2; \
+        if((i)>(start) && UTF_IS_FIRST_SURROGATE(__c2=(s)[(i)-1])) { \
+            --(i); \
+            (c)=UTF16_GET_PAIR_VALUE(__c2, (c)); \
+            /* strict: ((c)&0xfffe)==0xfffe is caught by UTF_IS_ERROR() and UTF_IS_UNICODE_CHAR() */ \
+        } else if(strict) {\
+            /* unmatched second surrogate */ \
+            (c)=UTF_ERROR_VALUE; \
+        } \
+    } else if((strict) && !UTF_IS_UNICODE_CHAR(c)) { \
+        /* unmatched first surrogate or other non-character */ \
+        (c)=UTF_ERROR_VALUE; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Renamed to U16_BACK_1, see utf_old.h. */
+#define UTF16_BACK_1_SAFE(s, start, i) U16_BACK_1(s, start, i)
+
+/** @deprecated ICU 2.4. Renamed to U16_BACK_N, see utf_old.h. */
+#define UTF16_BACK_N_SAFE(s, start, i, n) U16_BACK_N(s, start, i, n)
+
+/** @deprecated ICU 2.4. Renamed to U16_SET_CP_LIMIT, see utf_old.h. */
+#define UTF16_SET_CHAR_LIMIT_SAFE(s, start, i, length) U16_SET_CP_LIMIT(s, start, i, length)
+
+/* Formerly utf32.h --------------------------------------------------------- */
+
+/*
+* Old documentation:
+*
+*   This file defines macros to deal with UTF-32 code units and code points.
+*   Signatures and semantics are the same as for the similarly named macros
+*   in utf16.h.
+*   utf32.h is included by utf.h after unicode/umachine.h</p>
+*   and some common definitions.
+*   <p><b>Usage:</b>  ICU coding guidelines for if() statements should be followed when using these macros.
+*                  Compound statements (curly braces {}) must be used  for if-else-while...
+*                  bodies and all macro statements should be terminated with semicolon.</p>
+*/
+
+/* internal definitions ----------------------------------------------------- */
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_IS_SAFE(c, strict) \
+    (!(strict) ? \
+        (uint32_t)(c)<=0x10ffff : \
+        UTF_IS_UNICODE_CHAR(c))
+
+/*
+ * For the semantics of all of these macros, see utf16.h.
+ * The UTF-32 versions are trivial because any code point is
+ * encoded using exactly one code unit.
+ */
+
+/* single-code point definitions -------------------------------------------- */
+
+/* classes of code unit values */
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_IS_SINGLE(uchar) 1
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_IS_LEAD(uchar) 0
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_IS_TRAIL(uchar) 0
+
+/* number of code units per code point */
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_NEED_MULTIPLE_UCHAR(c) 0
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_CHAR_LENGTH(c) 1
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_MAX_CHAR_LENGTH 1
+
+/* average number of code units compared to UTF-16 */
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_ARRAY_SIZE(size) (size)
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_GET_CHAR_UNSAFE(s, i, c) { \
+    (c)=(s)[i]; \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_GET_CHAR_SAFE(s, start, i, length, c, strict) { \
+    (c)=(s)[i]; \
+    if(!UTF32_IS_SAFE(c, strict)) { \
+        (c)=UTF_ERROR_VALUE; \
+    } \
+}
+
+/* definitions with forward iteration --------------------------------------- */
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_NEXT_CHAR_UNSAFE(s, i, c) { \
+    (c)=(s)[(i)++]; \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_APPEND_CHAR_UNSAFE(s, i, c) { \
+    (s)[(i)++]=(c); \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_FWD_1_UNSAFE(s, i) { \
+    ++(i); \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_FWD_N_UNSAFE(s, i, n) { \
+    (i)+=(n); \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_SET_CHAR_START_UNSAFE(s, i) { \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_NEXT_CHAR_SAFE(s, i, length, c, strict) { \
+    (c)=(s)[(i)++]; \
+    if(!UTF32_IS_SAFE(c, strict)) { \
+        (c)=UTF_ERROR_VALUE; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_APPEND_CHAR_SAFE(s, i, length, c) { \
+    if((uint32_t)(c)<=0x10ffff) { \
+        (s)[(i)++]=(c); \
+    } else /* c>0x10ffff, write 0xfffd */ { \
+        (s)[(i)++]=0xfffd; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_FWD_1_SAFE(s, i, length) { \
+    ++(i); \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_FWD_N_SAFE(s, i, length, n) { \
+    if(((i)+=(n))>(length)) { \
+        (i)=(length); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_SET_CHAR_START_SAFE(s, start, i) { \
+}
+
+/* definitions with backward iteration -------------------------------------- */
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_PREV_CHAR_UNSAFE(s, i, c) { \
+    (c)=(s)[--(i)]; \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_BACK_1_UNSAFE(s, i) { \
+    --(i); \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_BACK_N_UNSAFE(s, i, n) { \
+    (i)-=(n); \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_SET_CHAR_LIMIT_UNSAFE(s, i) { \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_PREV_CHAR_SAFE(s, start, i, c, strict) { \
+    (c)=(s)[--(i)]; \
+    if(!UTF32_IS_SAFE(c, strict)) { \
+        (c)=UTF_ERROR_VALUE; \
+    } \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_BACK_1_SAFE(s, start, i) { \
+    --(i); \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_BACK_N_SAFE(s, start, i, n) { \
+    (i)-=(n); \
+    if((i)<(start)) { \
+        (i)=(start); \
+    } \
+}
+
+/** @deprecated ICU 2.4. Obsolete, see utf_old.h. */
+#define UTF32_SET_CHAR_LIMIT_SAFE(s, i, length) { \
+}
+
+/* Formerly utf.h, part 2 --------------------------------------------------- */
+
+/**
+ * Estimate the number of code units for a string based on the number of UTF-16 code units.
+ *
+ * @deprecated ICU 2.4. Obsolete, see utf_old.h.
+ */
+#define UTF_ARRAY_SIZE(size) UTF16_ARRAY_SIZE(size)
+
+/** @deprecated ICU 2.4. Renamed to U16_GET_UNSAFE, see utf_old.h. */
+#define UTF_GET_CHAR_UNSAFE(s, i, c)                 UTF16_GET_CHAR_UNSAFE(s, i, c)
+
+/** @deprecated ICU 2.4. Use U16_GET instead, see utf_old.h. */
+#define UTF_GET_CHAR_SAFE(s, start, i, length, c, strict) UTF16_GET_CHAR_SAFE(s, start, i, length, c, strict)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_NEXT_UNSAFE, see utf_old.h. */
+#define UTF_NEXT_CHAR_UNSAFE(s, i, c)                UTF16_NEXT_CHAR_UNSAFE(s, i, c)
+
+/** @deprecated ICU 2.4. Use U16_NEXT instead, see utf_old.h. */
+#define UTF_NEXT_CHAR_SAFE(s, i, length, c, strict)  UTF16_NEXT_CHAR_SAFE(s, i, length, c, strict)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_APPEND_UNSAFE, see utf_old.h. */
+#define UTF_APPEND_CHAR_UNSAFE(s, i, c)              UTF16_APPEND_CHAR_UNSAFE(s, i, c)
+
+/** @deprecated ICU 2.4. Use U16_APPEND instead, see utf_old.h. */
+#define UTF_APPEND_CHAR_SAFE(s, i, length, c)        UTF16_APPEND_CHAR_SAFE(s, i, length, c)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_FWD_1_UNSAFE, see utf_old.h. */
+#define UTF_FWD_1_UNSAFE(s, i)                       UTF16_FWD_1_UNSAFE(s, i)
+
+/** @deprecated ICU 2.4. Renamed to U16_FWD_1, see utf_old.h. */
+#define UTF_FWD_1_SAFE(s, i, length)                 UTF16_FWD_1_SAFE(s, i, length)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_FWD_N_UNSAFE, see utf_old.h. */
+#define UTF_FWD_N_UNSAFE(s, i, n)                    UTF16_FWD_N_UNSAFE(s, i, n)
+
+/** @deprecated ICU 2.4. Renamed to U16_FWD_N, see utf_old.h. */
+#define UTF_FWD_N_SAFE(s, i, length, n)              UTF16_FWD_N_SAFE(s, i, length, n)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_SET_CP_START_UNSAFE, see utf_old.h. */
+#define UTF_SET_CHAR_START_UNSAFE(s, i)              UTF16_SET_CHAR_START_UNSAFE(s, i)
+
+/** @deprecated ICU 2.4. Renamed to U16_SET_CP_START, see utf_old.h. */
+#define UTF_SET_CHAR_START_SAFE(s, start, i)         UTF16_SET_CHAR_START_SAFE(s, start, i)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_PREV_UNSAFE, see utf_old.h. */
+#define UTF_PREV_CHAR_UNSAFE(s, i, c)                UTF16_PREV_CHAR_UNSAFE(s, i, c)
+
+/** @deprecated ICU 2.4. Use U16_PREV instead, see utf_old.h. */
+#define UTF_PREV_CHAR_SAFE(s, start, i, c, strict)   UTF16_PREV_CHAR_SAFE(s, start, i, c, strict)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_BACK_1_UNSAFE, see utf_old.h. */
+#define UTF_BACK_1_UNSAFE(s, i)                      UTF16_BACK_1_UNSAFE(s, i)
+
+/** @deprecated ICU 2.4. Renamed to U16_BACK_1, see utf_old.h. */
+#define UTF_BACK_1_SAFE(s, start, i)                 UTF16_BACK_1_SAFE(s, start, i)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_BACK_N_UNSAFE, see utf_old.h. */
+#define UTF_BACK_N_UNSAFE(s, i, n)                   UTF16_BACK_N_UNSAFE(s, i, n)
+
+/** @deprecated ICU 2.4. Renamed to U16_BACK_N, see utf_old.h. */
+#define UTF_BACK_N_SAFE(s, start, i, n)              UTF16_BACK_N_SAFE(s, start, i, n)
+
+
+/** @deprecated ICU 2.4. Renamed to U16_SET_CP_LIMIT_UNSAFE, see utf_old.h. */
+#define UTF_SET_CHAR_LIMIT_UNSAFE(s, i)              UTF16_SET_CHAR_LIMIT_UNSAFE(s, i)
+
+/** @deprecated ICU 2.4. Renamed to U16_SET_CP_LIMIT, see utf_old.h. */
+#define UTF_SET_CHAR_LIMIT_SAFE(s, start, i, length) UTF16_SET_CHAR_LIMIT_SAFE(s, start, i, length)
+
+/* Define default macros (UTF-16 "safe") ------------------------------------ */
+
+/**
+ * Does this code unit alone encode a code point (BMP, not a surrogate)?
+ * Same as UTF16_IS_SINGLE.
+ * @deprecated ICU 2.4. Renamed to U_IS_SINGLE and U16_IS_SINGLE, see utf_old.h.
+ */
+#define UTF_IS_SINGLE(uchar) U16_IS_SINGLE(uchar)
+
+/**
+ * Is this code unit the first one of several (a lead surrogate)?
+ * Same as UTF16_IS_LEAD.
+ * @deprecated ICU 2.4. Renamed to U_IS_LEAD and U16_IS_LEAD, see utf_old.h.
+ */
+#define UTF_IS_LEAD(uchar) U16_IS_LEAD(uchar)
+
+/**
+ * Is this code unit one of several but not the first one (a trail surrogate)?
+ * Same as UTF16_IS_TRAIL.
+ * @deprecated ICU 2.4. Renamed to U_IS_TRAIL and U16_IS_TRAIL, see utf_old.h.
+ */
+#define UTF_IS_TRAIL(uchar) U16_IS_TRAIL(uchar)
+
+/**
+ * Does this code point require multiple code units (is it a supplementary code point)?
+ * Same as UTF16_NEED_MULTIPLE_UCHAR.
+ * @deprecated ICU 2.4. Use U16_LENGTH or test ((uint32_t)(c)>0xffff) instead.
+ */
+#define UTF_NEED_MULTIPLE_UCHAR(c) UTF16_NEED_MULTIPLE_UCHAR(c)
+
+/**
+ * How many code units are used to encode this code point (1 or 2)?
+ * Same as UTF16_CHAR_LENGTH.
+ * @deprecated ICU 2.4. Renamed to U16_LENGTH, see utf_old.h.
+ */
+#define UTF_CHAR_LENGTH(c) U16_LENGTH(c)
+
+/**
+ * How many code units are used at most for any Unicode code point (2)?
+ * Same as UTF16_MAX_CHAR_LENGTH.
+ * @deprecated ICU 2.4. Renamed to U16_MAX_LENGTH, see utf_old.h.
+ */
+#define UTF_MAX_CHAR_LENGTH U16_MAX_LENGTH
+
+/**
+ * Set c to the code point that contains the code unit i.
+ * i could point to the lead or the trail surrogate for the code point.
+ * i is not modified.
+ * Same as UTF16_GET_CHAR.
+ * \pre 0<=i<length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_GET, see utf_old.h.
+ */
+#define UTF_GET_CHAR(s, start, i, length, c) U16_GET(s, start, i, length, c)
+
+/**
+ * Set c to the code point that starts at code unit i
+ * and advance i to beyond the code units of this code point (post-increment).
+ * i must point to the first code unit of a code point.
+ * Otherwise c is set to the trail unit (surrogate) itself.
+ * Same as UTF16_NEXT_CHAR.
+ * \pre 0<=i<length
+ * \post 0<i<=length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_NEXT, see utf_old.h.
+ */
+#define UTF_NEXT_CHAR(s, i, length, c) U16_NEXT(s, i, length, c)
+
+/**
+ * Append the code units of code point c to the string at index i
+ * and advance i to beyond the new code units (post-increment).
+ * The code units beginning at index i will be overwritten.
+ * Same as UTF16_APPEND_CHAR.
+ * \pre 0<=c<=0x10ffff
+ * \pre 0<=i<length
+ * \post 0<i<=length
+ *
+ * @deprecated ICU 2.4. Use U16_APPEND instead, see utf_old.h.
+ */
+#define UTF_APPEND_CHAR(s, i, length, c) UTF16_APPEND_CHAR_SAFE(s, i, length, c)
+
+/**
+ * Advance i to beyond the code units of the code point that begins at i.
+ * I.e., advance i by one code point.
+ * Same as UTF16_FWD_1.
+ * \pre 0<=i<length
+ * \post 0<i<=length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_FWD_1, see utf_old.h.
+ */
+#define UTF_FWD_1(s, i, length) U16_FWD_1(s, i, length)
+
+/**
+ * Advance i to beyond the code units of the n code points where the first one begins at i.
+ * I.e., advance i by n code points.
+ * Same as UT16_FWD_N.
+ * \pre 0<=i<length
+ * \post 0<i<=length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_FWD_N, see utf_old.h.
+ */
+#define UTF_FWD_N(s, i, length, n) U16_FWD_N(s, i, length, n)
+
+/**
+ * Take the random-access index i and adjust it so that it points to the beginning
+ * of a code point.
+ * The input index points to any code unit of a code point and is moved to point to
+ * the first code unit of the same code point. i is never incremented.
+ * In other words, if i points to a trail surrogate that is preceded by a matching
+ * lead surrogate, then i is decremented. Otherwise it is not modified.
+ * This can be used to start an iteration with UTF_NEXT_CHAR() from a random index.
+ * Same as UTF16_SET_CHAR_START.
+ * \pre start<=i<length
+ * \post start<=i<length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_SET_CP_START, see utf_old.h.
+ */
+#define UTF_SET_CHAR_START(s, start, i) U16_SET_CP_START(s, start, i)
+
+/**
+ * Set c to the code point that has code units before i
+ * and move i backward (towards the beginning of the string)
+ * to the first code unit of this code point (pre-increment).
+ * i must point to the first code unit after the last unit of a code point (i==length is allowed).
+ * Same as UTF16_PREV_CHAR.
+ * \pre start<i<=length
+ * \post start<=i<length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_PREV, see utf_old.h.
+ */
+#define UTF_PREV_CHAR(s, start, i, c) U16_PREV(s, start, i, c)
+
+/**
+ * Move i backward (towards the beginning of the string)
+ * to the first code unit of the code point that has code units before i.
+ * I.e., move i backward by one code point.
+ * i must point to the first code unit after the last unit of a code point (i==length is allowed).
+ * Same as UTF16_BACK_1.
+ * \pre start<i<=length
+ * \post start<=i<length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_BACK_1, see utf_old.h.
+ */
+#define UTF_BACK_1(s, start, i) U16_BACK_1(s, start, i)
+
+/**
+ * Move i backward (towards the beginning of the string)
+ * to the first code unit of the n code points that have code units before i.
+ * I.e., move i backward by n code points.
+ * i must point to the first code unit after the last unit of a code point (i==length is allowed).
+ * Same as UTF16_BACK_N.
+ * \pre start<i<=length
+ * \post start<=i<length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_BACK_N, see utf_old.h.
+ */
+#define UTF_BACK_N(s, start, i, n) U16_BACK_N(s, start, i, n)
+
+/**
+ * Take the random-access index i and adjust it so that it points beyond
+ * a code point. The input index points beyond any code unit
+ * of a code point and is moved to point beyond the last code unit of the same
+ * code point. i is never decremented.
+ * In other words, if i points to a trail surrogate that is preceded by a matching
+ * lead surrogate, then i is incremented. Otherwise it is not modified.
+ * This can be used to start an iteration with UTF_PREV_CHAR() from a random index.
+ * Same as UTF16_SET_CHAR_LIMIT.
+ * \pre start<i<=length
+ * \post start<i<=length
+ *
+ * @deprecated ICU 2.4. Renamed to U16_SET_CP_LIMIT, see utf_old.h.
+ */
+#define UTF_SET_CHAR_LIMIT(s, start, i, length) U16_SET_CP_LIMIT(s, start, i, length)
+
+#endif /* U_HIDE_DEPRECATED_API */
+
+#endif
+
diff --git a/icu/unicode/utypes.h b/icu/unicode/utypes.h
new file mode 100644
index 0000000..8f924c9
--- /dev/null
+++ b/icu/unicode/utypes.h
@@ -0,0 +1,723 @@
+/*
+**********************************************************************
+*   Copyright (C) 1996-2012, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+**********************************************************************
+*
+*  FILE NAME : UTYPES.H (formerly ptypes.h)
+*
+*   Date        Name        Description
+*   12/11/96    helena      Creation.
+*   02/27/97    aliu        Added typedefs for UClassID, int8, int16, int32,
+*                           uint8, uint16, and uint32.
+*   04/01/97    aliu        Added XP_CPLUSPLUS and modified to work under C as
+*                            well as C++.
+*                           Modified to use memcpy() for uprv_arrayCopy() fns.
+*   04/14/97    aliu        Added TPlatformUtilities.
+*   05/07/97    aliu        Added import/export specifiers (replacing the old
+*                           broken EXT_CLASS).  Added version number for our
+*                           code.  Cleaned up header.
+*    6/20/97    helena      Java class name change.
+*   08/11/98    stephen     UErrorCode changed from typedef to enum
+*   08/12/98    erm         Changed T_ANALYTIC_PACKAGE_VERSION to 3
+*   08/14/98    stephen     Added uprv_arrayCopy() for int8_t, int16_t, int32_t
+*   12/09/98    jfitz       Added BUFFER_OVERFLOW_ERROR (bug 1100066)
+*   04/20/99    stephen     Cleaned up & reworked for autoconf.
+*                           Renamed to utypes.h.
+*   05/05/99    stephen     Changed to use <inttypes.h>
+*   12/07/99    helena      Moved copyright notice string from ucnv_bld.h here.
+*******************************************************************************
+*/
+
+#ifndef UTYPES_H
+#define UTYPES_H
+
+
+#include "unicode/umachine.h"
+#include "unicode/uversion.h"
+#include "unicode/uconfig.h"
+#include <float.h>
+
+#if !U_NO_DEFAULT_INCLUDE_UTF_HEADERS
+#   include "unicode/utf.h"
+#endif
+
+/*!
+ * \file
+ * \brief Basic definitions for ICU, for both C and C++ APIs
+ *
+ * This file defines basic types, constants, and enumerations directly or
+ * indirectly by including other header files, especially utf.h for the
+ * basic character and string definitions and umachine.h for consistent
+ * integer and other types.
+ */
+
+
+/**
+ * \def U_SHOW_CPLUSPLUS_API
+ * @internal
+ */
+#ifdef __cplusplus
+#   ifndef U_SHOW_CPLUSPLUS_API
+#       define U_SHOW_CPLUSPLUS_API 0
+#   endif
+#else
+#   undef U_SHOW_CPLUSPLUS_API
+#   define U_SHOW_CPLUSPLUS_API 0
+#endif
+
+/** @{ API visibility control */
+
+/**
+ * \def U_HIDE_DRAFT_API
+ * Define this to 1 to request that draft API be "hidden"
+ * @internal
+ */
+/**
+ * \def U_HIDE_INTERNAL_API
+ * Define this to 1 to request that internal API be "hidden"
+ * @internal
+ */
+#if !U_DEFAULT_SHOW_DRAFT && !defined(U_SHOW_DRAFT_API)
+#define U_HIDE_DRAFT_API 1
+#endif
+#if !U_DEFAULT_SHOW_DRAFT && !defined(U_SHOW_INTERNAL_API)
+#define U_HIDE_INTERNAL_API 1
+#endif
+
+/** @} */
+
+/*===========================================================================*/
+/* ICUDATA naming scheme                                                     */
+/*===========================================================================*/
+
+/**
+ * \def U_ICUDATA_TYPE_LETTER
+ *
+ * This is a platform-dependent string containing one letter:
+ * - b for big-endian, ASCII-family platforms
+ * - l for little-endian, ASCII-family platforms
+ * - e for big-endian, EBCDIC-family platforms
+ * This letter is part of the common data file name.
+ * @stable ICU 2.0
+ */
+
+/**
+ * \def U_ICUDATA_TYPE_LITLETTER
+ * The non-string form of U_ICUDATA_TYPE_LETTER
+ * @stable ICU 2.0
+ */
+#if U_CHARSET_FAMILY
+#   if U_IS_BIG_ENDIAN
+   /* EBCDIC - should always be BE */
+#     define U_ICUDATA_TYPE_LETTER "e"
+#     define U_ICUDATA_TYPE_LITLETTER e
+#   else
+#     error "Don't know what to do with little endian EBCDIC!"
+#     define U_ICUDATA_TYPE_LETTER "x"
+#     define U_ICUDATA_TYPE_LITLETTER x
+#   endif
+#else
+#   if U_IS_BIG_ENDIAN
+      /* Big-endian ASCII */
+#     define U_ICUDATA_TYPE_LETTER "b"
+#     define U_ICUDATA_TYPE_LITLETTER b
+#   else
+      /* Little-endian ASCII */
+#     define U_ICUDATA_TYPE_LETTER "l"
+#     define U_ICUDATA_TYPE_LITLETTER l
+#   endif
+#endif
+
+/**
+ * A single string literal containing the icudata stub name. i.e. 'icudt18e' for
+ * ICU 1.8.x on EBCDIC, etc..
+ * @stable ICU 2.0
+ */
+#define U_ICUDATA_NAME    "icudt" U_ICU_VERSION_SHORT U_ICUDATA_TYPE_LETTER
+#ifndef U_HIDE_INTERNAL_API
+#define U_USRDATA_NAME    "usrdt" U_ICU_VERSION_SHORT U_ICUDATA_TYPE_LETTER  /**< @internal */
+#define U_USE_USRDATA     1  /**< @internal */
+#endif  /* U_HIDE_INTERNAL_API */
+
+/**
+ *  U_ICU_ENTRY_POINT is the name of the DLL entry point to the ICU data library.
+ *    Defined as a literal, not a string.
+ *    Tricky Preprocessor use - ## operator replaces macro paramters with the literal string
+ *                              from the corresponding macro invocation, _before_ other macro substitutions.
+ *                              Need a nested \#defines to get the actual version numbers rather than
+ *                              the literal text U_ICU_VERSION_MAJOR_NUM into the name.
+ *                              The net result will be something of the form
+ *                                  \#define U_ICU_ENTRY_POINT icudt19_dat
+ * @stable ICU 2.4
+ */
+#define U_ICUDATA_ENTRY_POINT  U_DEF2_ICUDATA_ENTRY_POINT(U_ICU_VERSION_MAJOR_NUM,U_LIB_SUFFIX_C_NAME)
+
+#ifndef U_HIDE_INTERNAL_API
+/**
+ * Do not use. Note that it's OK for the 2nd argument to be undefined (literal).
+ * @internal
+ */
+#define U_DEF2_ICUDATA_ENTRY_POINT(major,suff) U_DEF_ICUDATA_ENTRY_POINT(major,suff)
+
+/**
+ * Do not use.
+ * @internal
+ */
+#ifndef U_DEF_ICUDATA_ENTRY_POINT
+/* affected by symbol renaming. See platform.h */
+#ifndef U_LIB_SUFFIX_C_NAME
+#define U_DEF_ICUDATA_ENTRY_POINT(major, suff) icudt##major##_dat
+#else
+#define U_DEF_ICUDATA_ENTRY_POINT(major, suff) icudt##suff ## major##_dat
+#endif
+#endif
+#endif  /* U_HIDE_INTERNAL_API */
+
+/**
+ * \def NULL
+ * Define NULL if necessary, to 0 for C++ and to ((void *)0) for C.
+ * @stable ICU 2.0
+ */
+#ifndef NULL
+#ifdef __cplusplus
+#define NULL    0
+#else
+#define NULL    ((void *)0)
+#endif
+#endif
+
+/*===========================================================================*/
+/* Calendar/TimeZone data types                                              */
+/*===========================================================================*/
+
+/**
+ * Date and Time data type.
+ * This is a primitive data type that holds the date and time
+ * as the number of milliseconds since 1970-jan-01, 00:00 UTC.
+ * UTC leap seconds are ignored.
+ * @stable ICU 2.0
+ */
+typedef double UDate;
+
+/** The number of milliseconds per second @stable ICU 2.0 */
+#define U_MILLIS_PER_SECOND        (1000)
+/** The number of milliseconds per minute @stable ICU 2.0 */
+#define U_MILLIS_PER_MINUTE       (60000)
+/** The number of milliseconds per hour @stable ICU 2.0 */
+#define U_MILLIS_PER_HOUR       (3600000)
+/** The number of milliseconds per day @stable ICU 2.0 */
+#define U_MILLIS_PER_DAY       (86400000)
+
+/** 
+ * Maximum UDate value 
+ * @stable ICU 4.8 
+ */ 
+#define U_DATE_MAX DBL_MAX
+
+/**
+ * Minimum UDate value 
+ * @stable ICU 4.8 
+ */ 
+#define U_DATE_MIN -U_DATE_MAX
+
+/*===========================================================================*/
+/* Shared library/DLL import-export API control                              */
+/*===========================================================================*/
+
+/*
+ * Control of symbol import/export.
+ * ICU is separated into three libraries.
+ */
+
+/**
+ * \def U_COMBINED_IMPLEMENTATION
+ * Set to export library symbols from inside the ICU library
+ * when all of ICU is in a single library.
+ * This can be set as a compiler option while building ICU, and it
+ * needs to be the first one tested to override U_COMMON_API, U_I18N_API, etc.
+ * @stable ICU 2.0
+ */
+
+/**
+ * \def U_DATA_API
+ * Set to export library symbols from inside the stubdata library,
+ * and to import them from outside.
+ * @stable ICU 3.0
+ */
+
+/**
+ * \def U_COMMON_API
+ * Set to export library symbols from inside the common library,
+ * and to import them from outside.
+ * @stable ICU 2.0
+ */
+
+/**
+ * \def U_I18N_API
+ * Set to export library symbols from inside the i18n library,
+ * and to import them from outside.
+ * @stable ICU 2.0
+ */
+
+/**
+ * \def U_LAYOUT_API
+ * Set to export library symbols from inside the layout engine library,
+ * and to import them from outside.
+ * @stable ICU 2.0
+ */
+
+/**
+ * \def U_LAYOUTEX_API
+ * Set to export library symbols from inside the layout extensions library,
+ * and to import them from outside.
+ * @stable ICU 2.6
+ */
+
+/**
+ * \def U_IO_API
+ * Set to export library symbols from inside the ustdio library,
+ * and to import them from outside.
+ * @stable ICU 2.0
+ */
+
+/**
+ * \def U_TOOLUTIL_API
+ * Set to export library symbols from inside the toolutil library,
+ * and to import them from outside.
+ * @stable ICU 3.4
+ */
+
+#if defined(U_COMBINED_IMPLEMENTATION)
+#define U_DATA_API     U_EXPORT
+#define U_COMMON_API   U_EXPORT
+#define U_I18N_API     U_EXPORT
+#define U_LAYOUT_API   U_EXPORT
+#define U_LAYOUTEX_API U_EXPORT
+#define U_IO_API       U_EXPORT
+#define U_TOOLUTIL_API U_EXPORT
+#elif defined(U_STATIC_IMPLEMENTATION)
+#define U_DATA_API
+#define U_COMMON_API
+#define U_I18N_API
+#define U_LAYOUT_API
+#define U_LAYOUTEX_API
+#define U_IO_API
+#define U_TOOLUTIL_API
+#elif defined(U_COMMON_IMPLEMENTATION)
+#define U_DATA_API     U_IMPORT
+#define U_COMMON_API   U_EXPORT
+#define U_I18N_API     U_IMPORT
+#define U_LAYOUT_API   U_IMPORT
+#define U_LAYOUTEX_API U_IMPORT
+#define U_IO_API       U_IMPORT
+#define U_TOOLUTIL_API U_IMPORT
+#elif defined(U_I18N_IMPLEMENTATION)
+#define U_DATA_API     U_IMPORT
+#define U_COMMON_API   U_IMPORT
+#define U_I18N_API     U_EXPORT
+#define U_LAYOUT_API   U_IMPORT
+#define U_LAYOUTEX_API U_IMPORT
+#define U_IO_API       U_IMPORT
+#define U_TOOLUTIL_API U_IMPORT
+#elif defined(U_LAYOUT_IMPLEMENTATION)
+#define U_DATA_API     U_IMPORT
+#define U_COMMON_API   U_IMPORT
+#define U_I18N_API     U_IMPORT
+#define U_LAYOUT_API   U_EXPORT
+#define U_LAYOUTEX_API U_IMPORT
+#define U_IO_API       U_IMPORT
+#define U_TOOLUTIL_API U_IMPORT
+#elif defined(U_LAYOUTEX_IMPLEMENTATION)
+#define U_DATA_API     U_IMPORT
+#define U_COMMON_API   U_IMPORT
+#define U_I18N_API     U_IMPORT
+#define U_LAYOUT_API   U_IMPORT
+#define U_LAYOUTEX_API U_EXPORT
+#define U_IO_API       U_IMPORT
+#define U_TOOLUTIL_API U_IMPORT
+#elif defined(U_IO_IMPLEMENTATION)
+#define U_DATA_API     U_IMPORT
+#define U_COMMON_API   U_IMPORT
+#define U_I18N_API     U_IMPORT
+#define U_LAYOUT_API   U_IMPORT
+#define U_LAYOUTEX_API U_IMPORT
+#define U_IO_API       U_EXPORT
+#define U_TOOLUTIL_API U_IMPORT
+#elif defined(U_TOOLUTIL_IMPLEMENTATION)
+#define U_DATA_API     U_IMPORT
+#define U_COMMON_API   U_IMPORT
+#define U_I18N_API     U_IMPORT
+#define U_LAYOUT_API   U_IMPORT
+#define U_LAYOUTEX_API U_IMPORT
+#define U_IO_API       U_IMPORT
+#define U_TOOLUTIL_API U_EXPORT
+#else
+#define U_DATA_API     U_IMPORT
+#define U_COMMON_API   U_IMPORT
+#define U_I18N_API     U_IMPORT
+#define U_LAYOUT_API   U_IMPORT
+#define U_LAYOUTEX_API U_IMPORT
+#define U_IO_API       U_IMPORT
+#define U_TOOLUTIL_API U_IMPORT
+#endif
+
+/**
+ * \def U_STANDARD_CPP_NAMESPACE
+ * Control of C++ Namespace
+ * @stable ICU 2.0
+ */
+#ifdef __cplusplus
+#define U_STANDARD_CPP_NAMESPACE        ::
+#else
+#define U_STANDARD_CPP_NAMESPACE
+#endif
+
+
+/*===========================================================================*/
+/* Global delete operator                                                    */
+/*===========================================================================*/
+
+/*
+ * The ICU4C library must not use the global new and delete operators.
+ * These operators here are defined to enable testing for this.
+ * See Jitterbug 2581 for details of why this is necessary.
+ *
+ * Verification that ICU4C's memory usage is correct, i.e.,
+ * that global new/delete are not used:
+ *
+ * a) Check for imports of global new/delete (see uobject.cpp for details)
+ * b) Verify that new is never imported.
+ * c) Verify that delete is only imported from object code for interface/mixin classes.
+ * d) Add global delete and delete[] only for the ICU4C library itself
+ *    and define them in a way that crashes or otherwise easily shows a problem.
+ *
+ * The following implements d).
+ * The operator implementations crash; this is intentional and used for library debugging.
+ *
+ * Note: This is currently only done on Windows because
+ * some Linux/Unix compilers have problems with defining global new/delete.
+ * On Windows, it is _MSC_VER>=1200 for MSVC 6.0 and higher.
+ */
+#if defined(__cplusplus) && U_DEBUG && U_OVERRIDE_CXX_ALLOCATION && (_MSC_VER>=1200) && !defined(U_STATIC_IMPLEMENTATION) && (defined(U_COMMON_IMPLEMENTATION) || defined(U_I18N_IMPLEMENTATION) || defined(U_IO_IMPLEMENTATION) || defined(U_LAYOUT_IMPLEMENTATION) || defined(U_LAYOUTEX_IMPLEMENTATION))
+
+#ifndef U_HIDE_INTERNAL_API
+/**
+ * Global operator new, defined only inside ICU4C, must not be used.
+ * Crashes intentionally.
+ * @internal
+ */
+inline void *
+operator new(size_t /*size*/) {
+    char *q=NULL;
+    *q=5; /* break it */
+    return q;
+}
+
+#ifdef _Ret_bytecap_
+/* This is only needed to suppress a Visual C++ 2008 warning for operator new[]. */
+_Ret_bytecap_(_Size)
+#endif
+/**
+ * Global operator new[], defined only inside ICU4C, must not be used.
+ * Crashes intentionally.
+ * @internal
+ */
+inline void *
+operator new[](size_t /*size*/) {
+    char *q=NULL;
+    *q=5; /* break it */
+    return q;
+}
+
+/**
+ * Global operator delete, defined only inside ICU4C, must not be used.
+ * Crashes intentionally.
+ * @internal
+ */
+inline void
+operator delete(void * /*p*/) {
+    char *q=NULL;
+    *q=5; /* break it */
+}
+
+/**
+ * Global operator delete[], defined only inside ICU4C, must not be used.
+ * Crashes intentionally.
+ * @internal
+ */
+inline void
+operator delete[](void * /*p*/) {
+    char *q=NULL;
+    *q=5; /* break it */
+}
+
+#endif /* U_HIDE_INTERNAL_API */
+#endif
+
+/*===========================================================================*/
+/* UErrorCode */
+/*===========================================================================*/
+
+/**
+ * Error code to replace exception handling, so that the code is compatible with all C++ compilers,
+ * and to use the same mechanism for C and C++.
+ *
+ * \par
+ * ICU functions that take a reference (C++) or a pointer (C) to a UErrorCode
+ * first test if(U_FAILURE(errorCode)) { return immediately; }
+ * so that in a chain of such functions the first one that sets an error code
+ * causes the following ones to not perform any operations.
+ *
+ * \par
+ * Error codes should be tested using U_FAILURE() and U_SUCCESS().
+ * @stable ICU 2.0
+ */
+typedef enum UErrorCode {
+    /* The ordering of U_ERROR_INFO_START Vs U_USING_FALLBACK_WARNING looks weird
+     * and is that way because VC++ debugger displays first encountered constant,
+     * which is not the what the code is used for
+     */
+
+    U_USING_FALLBACK_WARNING  = -128,   /**< A resource bundle lookup returned a fallback result (not an error) */
+
+    U_ERROR_WARNING_START     = -128,   /**< Start of information results (semantically successful) */
+
+    U_USING_DEFAULT_WARNING   = -127,   /**< A resource bundle lookup returned a result from the root locale (not an error) */
+
+    U_SAFECLONE_ALLOCATED_WARNING = -126, /**< A SafeClone operation required allocating memory (informational only) */
+
+    U_STATE_OLD_WARNING       = -125,   /**< ICU has to use compatibility layer to construct the service. Expect performance/memory usage degradation. Consider upgrading */
+
+    U_STRING_NOT_TERMINATED_WARNING = -124,/**< An output string could not be NUL-terminated because output length==destCapacity. */
+
+    U_SORT_KEY_TOO_SHORT_WARNING = -123, /**< Number of levels requested in getBound is higher than the number of levels in the sort key */
+
+    U_AMBIGUOUS_ALIAS_WARNING = -122,   /**< This converter alias can go to different converter implementations */
+
+    U_DIFFERENT_UCA_VERSION = -121,     /**< ucol_open encountered a mismatch between UCA version and collator image version, so the collator was constructed from rules. No impact to further function */
+    
+    U_PLUGIN_CHANGED_LEVEL_WARNING = -120, /**< A plugin caused a level change. May not be an error, but later plugins may not load. */
+
+    U_ERROR_WARNING_LIMIT,              /**< This must always be the last warning value to indicate the limit for UErrorCode warnings (last warning code +1) */
+
+
+    U_ZERO_ERROR              =  0,     /**< No error, no warning. */
+
+    U_ILLEGAL_ARGUMENT_ERROR  =  1,     /**< Start of codes indicating failure */
+    U_MISSING_RESOURCE_ERROR  =  2,     /**< The requested resource cannot be found */
+    U_INVALID_FORMAT_ERROR    =  3,     /**< Data format is not what is expected */
+    U_FILE_ACCESS_ERROR       =  4,     /**< The requested file cannot be found */
+    U_INTERNAL_PROGRAM_ERROR  =  5,     /**< Indicates a bug in the library code */
+    U_MESSAGE_PARSE_ERROR     =  6,     /**< Unable to parse a message (message format) */
+    U_MEMORY_ALLOCATION_ERROR =  7,     /**< Memory allocation error */
+    U_INDEX_OUTOFBOUNDS_ERROR =  8,     /**< Trying to access the index that is out of bounds */
+    U_PARSE_ERROR             =  9,     /**< Equivalent to Java ParseException */
+    U_INVALID_CHAR_FOUND      = 10,     /**< Character conversion: Unmappable input sequence. In other APIs: Invalid character. */
+    U_TRUNCATED_CHAR_FOUND    = 11,     /**< Character conversion: Incomplete input sequence. */
+    U_ILLEGAL_CHAR_FOUND      = 12,     /**< Character conversion: Illegal input sequence/combination of input units. */
+    U_INVALID_TABLE_FORMAT    = 13,     /**< Conversion table file found, but corrupted */
+    U_INVALID_TABLE_FILE      = 14,     /**< Conversion table file not found */
+    U_BUFFER_OVERFLOW_ERROR   = 15,     /**< A result would not fit in the supplied buffer */
+    U_UNSUPPORTED_ERROR       = 16,     /**< Requested operation not supported in current context */
+    U_RESOURCE_TYPE_MISMATCH  = 17,     /**< an operation is requested over a resource that does not support it */
+    U_ILLEGAL_ESCAPE_SEQUENCE = 18,     /**< ISO-2022 illlegal escape sequence */
+    U_UNSUPPORTED_ESCAPE_SEQUENCE = 19, /**< ISO-2022 unsupported escape sequence */
+    U_NO_SPACE_AVAILABLE      = 20,     /**< No space available for in-buffer expansion for Arabic shaping */
+    U_CE_NOT_FOUND_ERROR      = 21,     /**< Currently used only while setting variable top, but can be used generally */
+    U_PRIMARY_TOO_LONG_ERROR  = 22,     /**< User tried to set variable top to a primary that is longer than two bytes */
+    U_STATE_TOO_OLD_ERROR     = 23,     /**< ICU cannot construct a service from this state, as it is no longer supported */
+    U_TOO_MANY_ALIASES_ERROR  = 24,     /**< There are too many aliases in the path to the requested resource.
+                                             It is very possible that a circular alias definition has occured */
+    U_ENUM_OUT_OF_SYNC_ERROR  = 25,     /**< UEnumeration out of sync with underlying collection */
+    U_INVARIANT_CONVERSION_ERROR = 26,  /**< Unable to convert a UChar* string to char* with the invariant converter. */
+    U_INVALID_STATE_ERROR     = 27,     /**< Requested operation can not be completed with ICU in its current state */
+    U_COLLATOR_VERSION_MISMATCH = 28,   /**< Collator version is not compatible with the base version */
+    U_USELESS_COLLATOR_ERROR  = 29,     /**< Collator is options only and no base is specified */
+    U_NO_WRITE_PERMISSION     = 30,     /**< Attempt to modify read-only or constant data. */
+
+    U_STANDARD_ERROR_LIMIT,             /**< This must always be the last value to indicate the limit for standard errors */
+    /*
+     * the error code range 0x10000 0x10100 are reserved for Transliterator
+     */
+    U_BAD_VARIABLE_DEFINITION=0x10000,/**< Missing '$' or duplicate variable name */
+    U_PARSE_ERROR_START = 0x10000,    /**< Start of Transliterator errors */
+    U_MALFORMED_RULE,                 /**< Elements of a rule are misplaced */
+    U_MALFORMED_SET,                  /**< A UnicodeSet pattern is invalid*/
+    U_MALFORMED_SYMBOL_REFERENCE,     /**< UNUSED as of ICU 2.4 */
+    U_MALFORMED_UNICODE_ESCAPE,       /**< A Unicode escape pattern is invalid*/
+    U_MALFORMED_VARIABLE_DEFINITION,  /**< A variable definition is invalid */
+    U_MALFORMED_VARIABLE_REFERENCE,   /**< A variable reference is invalid */
+    U_MISMATCHED_SEGMENT_DELIMITERS,  /**< UNUSED as of ICU 2.4 */
+    U_MISPLACED_ANCHOR_START,         /**< A start anchor appears at an illegal position */
+    U_MISPLACED_CURSOR_OFFSET,        /**< A cursor offset occurs at an illegal position */
+    U_MISPLACED_QUANTIFIER,           /**< A quantifier appears after a segment close delimiter */
+    U_MISSING_OPERATOR,               /**< A rule contains no operator */
+    U_MISSING_SEGMENT_CLOSE,          /**< UNUSED as of ICU 2.4 */
+    U_MULTIPLE_ANTE_CONTEXTS,         /**< More than one ante context */
+    U_MULTIPLE_CURSORS,               /**< More than one cursor */
+    U_MULTIPLE_POST_CONTEXTS,         /**< More than one post context */
+    U_TRAILING_BACKSLASH,             /**< A dangling backslash */
+    U_UNDEFINED_SEGMENT_REFERENCE,    /**< A segment reference does not correspond to a defined segment */
+    U_UNDEFINED_VARIABLE,             /**< A variable reference does not correspond to a defined variable */
+    U_UNQUOTED_SPECIAL,               /**< A special character was not quoted or escaped */
+    U_UNTERMINATED_QUOTE,             /**< A closing single quote is missing */
+    U_RULE_MASK_ERROR,                /**< A rule is hidden by an earlier more general rule */
+    U_MISPLACED_COMPOUND_FILTER,      /**< A compound filter is in an invalid location */
+    U_MULTIPLE_COMPOUND_FILTERS,      /**< More than one compound filter */
+    U_INVALID_RBT_SYNTAX,             /**< A "::id" rule was passed to the RuleBasedTransliterator parser */
+    U_INVALID_PROPERTY_PATTERN,       /**< UNUSED as of ICU 2.4 */
+    U_MALFORMED_PRAGMA,               /**< A 'use' pragma is invlalid */
+    U_UNCLOSED_SEGMENT,               /**< A closing ')' is missing */
+    U_ILLEGAL_CHAR_IN_SEGMENT,        /**< UNUSED as of ICU 2.4 */
+    U_VARIABLE_RANGE_EXHAUSTED,       /**< Too many stand-ins generated for the given variable range */
+    U_VARIABLE_RANGE_OVERLAP,         /**< The variable range overlaps characters used in rules */
+    U_ILLEGAL_CHARACTER,              /**< A special character is outside its allowed context */
+    U_INTERNAL_TRANSLITERATOR_ERROR,  /**< Internal transliterator system error */
+    U_INVALID_ID,                     /**< A "::id" rule specifies an unknown transliterator */
+    U_INVALID_FUNCTION,               /**< A "&fn()" rule specifies an unknown transliterator */
+    U_PARSE_ERROR_LIMIT,              /**< The limit for Transliterator errors */
+
+    /*
+     * the error code range 0x10100 0x10200 are reserved for formatting API parsing error
+     */
+    U_UNEXPECTED_TOKEN=0x10100,       /**< Syntax error in format pattern */
+    U_FMT_PARSE_ERROR_START=0x10100,  /**< Start of format library errors */
+    U_MULTIPLE_DECIMAL_SEPARATORS,    /**< More than one decimal separator in number pattern */
+    U_MULTIPLE_DECIMAL_SEPERATORS = U_MULTIPLE_DECIMAL_SEPARATORS, /**< Typo: kept for backward compatibility. Use U_MULTIPLE_DECIMAL_SEPARATORS */
+    U_MULTIPLE_EXPONENTIAL_SYMBOLS,   /**< More than one exponent symbol in number pattern */
+    U_MALFORMED_EXPONENTIAL_PATTERN,  /**< Grouping symbol in exponent pattern */
+    U_MULTIPLE_PERCENT_SYMBOLS,       /**< More than one percent symbol in number pattern */
+    U_MULTIPLE_PERMILL_SYMBOLS,       /**< More than one permill symbol in number pattern */
+    U_MULTIPLE_PAD_SPECIFIERS,        /**< More than one pad symbol in number pattern */
+    U_PATTERN_SYNTAX_ERROR,           /**< Syntax error in format pattern */
+    U_ILLEGAL_PAD_POSITION,           /**< Pad symbol misplaced in number pattern */
+    U_UNMATCHED_BRACES,               /**< Braces do not match in message pattern */
+    U_UNSUPPORTED_PROPERTY,           /**< UNUSED as of ICU 2.4 */
+    U_UNSUPPORTED_ATTRIBUTE,          /**< UNUSED as of ICU 2.4 */
+    U_ARGUMENT_TYPE_MISMATCH,         /**< Argument name and argument index mismatch in MessageFormat functions */
+    U_DUPLICATE_KEYWORD,              /**< Duplicate keyword in PluralFormat */
+    U_UNDEFINED_KEYWORD,              /**< Undefined Plural keyword */
+    U_DEFAULT_KEYWORD_MISSING,        /**< Missing DEFAULT rule in plural rules */
+    U_DECIMAL_NUMBER_SYNTAX_ERROR,    /**< Decimal number syntax error */
+    U_FORMAT_INEXACT_ERROR,           /**< Cannot format a number exactly and rounding mode is ROUND_UNNECESSARY @stable ICU 4.8 */
+    U_FMT_PARSE_ERROR_LIMIT,          /**< The limit for format library errors */
+
+    /*
+     * the error code range 0x10200 0x102ff are reserved for Break Iterator related error
+     */
+    U_BRK_INTERNAL_ERROR=0x10200,          /**< An internal error (bug) was detected.             */
+    U_BRK_ERROR_START=0x10200,             /**< Start of codes indicating Break Iterator failures */
+    U_BRK_HEX_DIGITS_EXPECTED,             /**< Hex digits expected as part of a escaped char in a rule. */
+    U_BRK_SEMICOLON_EXPECTED,              /**< Missing ';' at the end of a RBBI rule.            */
+    U_BRK_RULE_SYNTAX,                     /**< Syntax error in RBBI rule.                        */
+    U_BRK_UNCLOSED_SET,                    /**< UnicodeSet witing an RBBI rule missing a closing ']'.  */
+    U_BRK_ASSIGN_ERROR,                    /**< Syntax error in RBBI rule assignment statement.   */
+    U_BRK_VARIABLE_REDFINITION,            /**< RBBI rule $Variable redefined.                    */
+    U_BRK_MISMATCHED_PAREN,                /**< Mis-matched parentheses in an RBBI rule.          */
+    U_BRK_NEW_LINE_IN_QUOTED_STRING,       /**< Missing closing quote in an RBBI rule.            */
+    U_BRK_UNDEFINED_VARIABLE,              /**< Use of an undefined $Variable in an RBBI rule.    */
+    U_BRK_INIT_ERROR,                      /**< Initialization failure.  Probable missing ICU Data. */
+    U_BRK_RULE_EMPTY_SET,                  /**< Rule contains an empty Unicode Set.               */
+    U_BRK_UNRECOGNIZED_OPTION,             /**< !!option in RBBI rules not recognized.            */
+    U_BRK_MALFORMED_RULE_TAG,              /**< The {nnn} tag on a rule is mal formed             */
+    U_BRK_ERROR_LIMIT,                     /**< This must always be the last value to indicate the limit for Break Iterator failures */
+
+    /*
+     * The error codes in the range 0x10300-0x103ff are reserved for regular expression related errrs
+     */
+    U_REGEX_INTERNAL_ERROR=0x10300,       /**< An internal error (bug) was detected.              */
+    U_REGEX_ERROR_START=0x10300,          /**< Start of codes indicating Regexp failures          */
+    U_REGEX_RULE_SYNTAX,                  /**< Syntax error in regexp pattern.                    */
+    U_REGEX_INVALID_STATE,                /**< RegexMatcher in invalid state for requested operation */
+    U_REGEX_BAD_ESCAPE_SEQUENCE,          /**< Unrecognized backslash escape sequence in pattern  */
+    U_REGEX_PROPERTY_SYNTAX,              /**< Incorrect Unicode property                         */
+    U_REGEX_UNIMPLEMENTED,                /**< Use of regexp feature that is not yet implemented. */
+    U_REGEX_MISMATCHED_PAREN,             /**< Incorrectly nested parentheses in regexp pattern.  */
+    U_REGEX_NUMBER_TOO_BIG,               /**< Decimal number is too large.                       */
+    U_REGEX_BAD_INTERVAL,                 /**< Error in {min,max} interval                        */
+    U_REGEX_MAX_LT_MIN,                   /**< In {min,max}, max is less than min.                */
+    U_REGEX_INVALID_BACK_REF,             /**< Back-reference to a non-existent capture group.    */
+    U_REGEX_INVALID_FLAG,                 /**< Invalid value for match mode flags.                */
+    U_REGEX_LOOK_BEHIND_LIMIT,            /**< Look-Behind pattern matches must have a bounded maximum length.    */
+    U_REGEX_SET_CONTAINS_STRING,          /**< Regexps cannot have UnicodeSets containing strings.*/
+    U_REGEX_OCTAL_TOO_BIG,                /**< Octal character constants must be <= 0377.         */
+    U_REGEX_MISSING_CLOSE_BRACKET,        /**< Missing closing bracket on a bracket expression.   */
+    U_REGEX_INVALID_RANGE,                /**< In a character range [x-y], x is greater than y.   */
+    U_REGEX_STACK_OVERFLOW,               /**< Regular expression backtrack stack overflow.       */
+    U_REGEX_TIME_OUT,                     /**< Maximum allowed match time exceeded                */
+    U_REGEX_STOPPED_BY_CALLER,            /**< Matching operation aborted by user callback fn.    */
+    U_REGEX_ERROR_LIMIT,                  /**< This must always be the last value to indicate the limit for regexp errors */
+
+    /*
+     * The error code in the range 0x10400-0x104ff are reserved for IDNA related error codes
+     */
+    U_IDNA_PROHIBITED_ERROR=0x10400,
+    U_IDNA_ERROR_START=0x10400,
+    U_IDNA_UNASSIGNED_ERROR,
+    U_IDNA_CHECK_BIDI_ERROR,
+    U_IDNA_STD3_ASCII_RULES_ERROR,
+    U_IDNA_ACE_PREFIX_ERROR,
+    U_IDNA_VERIFICATION_ERROR,
+    U_IDNA_LABEL_TOO_LONG_ERROR,
+    U_IDNA_ZERO_LENGTH_LABEL_ERROR,
+    U_IDNA_DOMAIN_NAME_TOO_LONG_ERROR,
+    U_IDNA_ERROR_LIMIT,
+    /*
+     * Aliases for StringPrep
+     */
+    U_STRINGPREP_PROHIBITED_ERROR = U_IDNA_PROHIBITED_ERROR,
+    U_STRINGPREP_UNASSIGNED_ERROR = U_IDNA_UNASSIGNED_ERROR,
+    U_STRINGPREP_CHECK_BIDI_ERROR = U_IDNA_CHECK_BIDI_ERROR,
+    
+    /*
+     * The error code in the range 0x10500-0x105ff are reserved for Plugin related error codes
+     */
+    U_PLUGIN_ERROR_START=0x10500,         /**< Start of codes indicating plugin failures */
+    U_PLUGIN_TOO_HIGH=0x10500,            /**< The plugin's level is too high to be loaded right now. */
+    U_PLUGIN_DIDNT_SET_LEVEL,             /**< The plugin didn't call uplug_setPlugLevel in response to a QUERY */
+    U_PLUGIN_ERROR_LIMIT,                 /**< This must always be the last value to indicate the limit for plugin errors */
+
+    U_ERROR_LIMIT=U_PLUGIN_ERROR_LIMIT      /**< This must always be the last value to indicate the limit for UErrorCode (last error code +1) */
+} UErrorCode;
+
+/* Use the following to determine if an UErrorCode represents */
+/* operational success or failure. */
+
+#ifdef __cplusplus
+    /**
+     * Does the error code indicate success?
+     * @stable ICU 2.0
+     */
+    static
+    inline UBool U_SUCCESS(UErrorCode code) { return (UBool)(code<=U_ZERO_ERROR); }
+    /**
+     * Does the error code indicate a failure?
+     * @stable ICU 2.0
+     */
+    static
+    inline UBool U_FAILURE(UErrorCode code) { return (UBool)(code>U_ZERO_ERROR); }
+#else
+    /**
+     * Does the error code indicate success?
+     * @stable ICU 2.0
+     */
+#   define U_SUCCESS(x) ((x)<=U_ZERO_ERROR)
+    /**
+     * Does the error code indicate a failure?
+     * @stable ICU 2.0
+     */
+#   define U_FAILURE(x) ((x)>U_ZERO_ERROR)
+#endif
+
+/**
+ * Return a string for a UErrorCode value.
+ * The string will be the same as the name of the error code constant
+ * in the UErrorCode enum above.
+ * @stable ICU 2.0
+ */
+U_STABLE const char * U_EXPORT2
+u_errorName(UErrorCode code);
+
+
+#endif /* _UTYPES */
diff --git a/icu/unicode/uvernum.h b/icu/unicode/uvernum.h
new file mode 100644
index 0000000..bd0b0c9
--- /dev/null
+++ b/icu/unicode/uvernum.h
@@ -0,0 +1,167 @@
+/*
+*******************************************************************************
+*   Copyright (C) 2000-2013, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*******************************************************************************
+*
+*   file name:  uvernum.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   Created by: Vladimir Weinstein
+*   Updated by: Steven R. Loomis
+*
+*/
+
+/**
+ * \file
+ * \brief C API: definitions of ICU version numbers
+ *
+ * This file is included by uversion.h and other files. This file contains only
+ * macros and definitions. The actual version numbers are defined here.
+ */
+
+ /*
+  * IMPORTANT: When updating version, the following things need to be done:
+  * source/common/unicode/uvernum.h - this file: update major, minor,
+  *        patchlevel, suffix, version, short version constants, namespace,
+  *                    renaming macro, and copyright
+  *
+  * The following files need to be updated as well, which can be done
+  *  by running the UNIX makefile target 'update-windows-makefiles' in icu/source.
+  *
+  *
+  * source/common/common.vcproj - update 'Output file name' on the link tab so
+  *                   that it contains the new major/minor combination
+  * source/i18n/i18n.vcproj - same as for the common.vcproj
+  * source/layout/layout.vcproj - same as for the common.vcproj
+  * source/layoutex/layoutex.vcproj - same
+  * source/stubdata/stubdata.vcproj - same as for the common.vcproj
+  * source/io/io.vcproj - same as for the common.vcproj
+  * source/data/makedata.mak - change U_ICUDATA_NAME so that it contains
+  *                            the new major/minor combination and the Unicode version.
+  */
+
+#ifndef UVERNUM_H
+#define UVERNUM_H
+
+/** The standard copyright notice that gets compiled into each library.
+ *  This value will change in the subsequent releases of ICU
+ *  @stable ICU 2.4
+ */
+#define U_COPYRIGHT_STRING \
+  " Copyright (C) 2013, International Business Machines Corporation and others. All Rights Reserved. "
+
+/** The current ICU major version as an integer.
+ *  This value will change in the subsequent releases of ICU
+ *  @stable ICU 2.4
+ */
+#define U_ICU_VERSION_MAJOR_NUM 52
+
+/** The current ICU minor version as an integer.
+ *  This value will change in the subsequent releases of ICU
+ *  @stable ICU 2.6
+ */
+#define U_ICU_VERSION_MINOR_NUM 1
+
+/** The current ICU patchlevel version as an integer.
+ *  This value will change in the subsequent releases of ICU
+ *  @stable ICU 2.4
+ */
+#define U_ICU_VERSION_PATCHLEVEL_NUM 0
+
+/** The current ICU build level version as an integer.
+ *  This value is for use by ICU clients. It defaults to 0.
+ *  @stable ICU 4.0
+ */
+#ifndef U_ICU_VERSION_BUILDLEVEL_NUM
+#define U_ICU_VERSION_BUILDLEVEL_NUM 0
+#endif
+
+/** Glued version suffix for renamers
+ *  This value will change in the subsequent releases of ICU
+ *  @stable ICU 2.6
+ */
+#define U_ICU_VERSION_SUFFIX _52
+
+/**
+ * \def U_DEF2_ICU_ENTRY_POINT_RENAME
+ * @internal
+ */
+/**
+ * \def U_DEF_ICU_ENTRY_POINT_RENAME
+ * @internal
+ */
+/** Glued version suffix function for renamers
+ *  This value will change in the subsequent releases of ICU.
+ *  If a custom suffix (such as matching library suffixes) is desired, this can be modified.
+ *  Note that if present, platform.h may contain an earlier definition of this macro.
+ *  \def U_ICU_ENTRY_POINT_RENAME
+ *  @stable ICU 4.2
+ */
+
+#ifndef U_ICU_ENTRY_POINT_RENAME
+#ifdef U_HAVE_LIB_SUFFIX
+#define U_DEF_ICU_ENTRY_POINT_RENAME(x,y,z) x ## y ##  z
+#define U_DEF2_ICU_ENTRY_POINT_RENAME(x,y,z) U_DEF_ICU_ENTRY_POINT_RENAME(x,y,z)
+#define U_ICU_ENTRY_POINT_RENAME(x)    U_DEF2_ICU_ENTRY_POINT_RENAME(x,U_ICU_VERSION_SUFFIX,U_LIB_SUFFIX_C_NAME)
+#else
+#define U_DEF_ICU_ENTRY_POINT_RENAME(x,y) x ## y
+#define U_DEF2_ICU_ENTRY_POINT_RENAME(x,y) U_DEF_ICU_ENTRY_POINT_RENAME(x,y)
+#define U_ICU_ENTRY_POINT_RENAME(x)    U_DEF2_ICU_ENTRY_POINT_RENAME(x,U_ICU_VERSION_SUFFIX)
+#endif
+#endif
+
+/** The current ICU library version as a dotted-decimal string. The patchlevel
+ *  only appears in this string if it non-zero.
+ *  This value will change in the subsequent releases of ICU
+ *  @stable ICU 2.4
+ */
+#define U_ICU_VERSION "52.1"
+
+/** The current ICU library major/minor version as a string without dots, for library name suffixes.
+ *  This value will change in the subsequent releases of ICU
+ *  @stable ICU 2.6
+ */
+#define U_ICU_VERSION_SHORT "52"
+
+#ifndef U_HIDE_INTERNAL_API
+/** Data version in ICU4C.
+ * @internal ICU 4.4 Internal Use Only
+ **/
+#define U_ICU_DATA_VERSION "52.1"
+#endif  /* U_HIDE_INTERNAL_API */
+
+/*===========================================================================
+ * ICU collation framework version information
+ * Version info that can be obtained from a collator is affected by these
+ * numbers in a secret and magic way. Please use collator version as whole
+ *===========================================================================
+ */
+
+/**
+ * Collation runtime version (sort key generator, strcoll).
+ * If the version is different, sort keys for the same string could be different.
+ * This value may change in subsequent releases of ICU.
+ * @stable ICU 2.4
+ */
+#define UCOL_RUNTIME_VERSION 7
+
+/**
+ * Collation builder code version.
+ * When this is different, the same tailoring might result
+ * in assigning different collation elements to code points.
+ * This value may change in subsequent releases of ICU.
+ * @stable ICU 2.4
+ */
+#define UCOL_BUILDER_VERSION 8
+
+/**
+ * This is the version of collation tailorings.
+ * This value may change in subsequent releases of ICU.
+ * @stable ICU 2.4
+ */
+#define UCOL_TAILORINGS_VERSION 1
+
+#endif
diff --git a/icu/unicode/uversion.h b/icu/unicode/uversion.h
new file mode 100644
index 0000000..74e3091
--- /dev/null
+++ b/icu/unicode/uversion.h
@@ -0,0 +1,193 @@
+/*
+*******************************************************************************
+*   Copyright (C) 2000-2011, International Business Machines
+*   Corporation and others.  All Rights Reserved.
+*******************************************************************************
+*
+*   file name:  uversion.h
+*   encoding:   US-ASCII
+*   tab size:   8 (not used)
+*   indentation:4
+*
+*   Created by: Vladimir Weinstein
+*
+*  Gets included by utypes.h and Windows .rc files
+*/
+
+/**
+ * \file
+ * \brief C API: API for accessing ICU version numbers. 
+ */
+/*===========================================================================*/
+/* Main ICU version information                                              */
+/*===========================================================================*/
+
+#ifndef UVERSION_H
+#define UVERSION_H
+
+#include "unicode/umachine.h"
+
+/* Actual version info lives in uvernum.h */
+#include "unicode/uvernum.h"
+
+/** Maximum length of the copyright string.
+ *  @stable ICU 2.4
+ */
+#define U_COPYRIGHT_STRING_LENGTH  128
+
+/** An ICU version consists of up to 4 numbers from 0..255.
+ *  @stable ICU 2.4
+ */
+#define U_MAX_VERSION_LENGTH 4
+
+/** In a string, ICU version fields are delimited by dots.
+ *  @stable ICU 2.4
+ */
+#define U_VERSION_DELIMITER '.'
+
+/** The maximum length of an ICU version string.
+ *  @stable ICU 2.4
+ */
+#define U_MAX_VERSION_STRING_LENGTH 20
+
+/** The binary form of a version on ICU APIs is an array of 4 uint8_t.
+ *  To compare two versions, use memcmp(v1,v2,sizeof(UVersionInfo)).
+ *  @stable ICU 2.4
+ */
+typedef uint8_t UVersionInfo[U_MAX_VERSION_LENGTH];
+
+/*===========================================================================*/
+/* C++ namespace if supported. Versioned unless versioning is disabled.      */
+/*===========================================================================*/
+
+/**
+ * \def U_NAMESPACE_BEGIN
+ * This is used to begin a declaration of a public ICU C++ API.
+ * When not compiling for C++, it does nothing.
+ * When compiling for C++, it begins an extern "C++" linkage block (to protect
+ * against cases in which an external client includes ICU header files inside
+ * an extern "C" linkage block).
+ *
+ * It also begins a versioned-ICU-namespace block.
+ * @stable ICU 2.4
+ */
+
+/**
+ * \def U_NAMESPACE_END
+ * This is used to end a declaration of a public ICU C++ API.
+ * When not compiling for C++, it does nothing.
+ * When compiling for C++, it ends the extern "C++" block begun by
+ * U_NAMESPACE_BEGIN.
+ *
+ * It also ends the versioned-ICU-namespace block begun by U_NAMESPACE_BEGIN.
+ * @stable ICU 2.4
+ */
+
+/**
+ * \def U_NAMESPACE_USE
+ * This is used to specify that the rest of the code uses the
+ * public ICU C++ API namespace.
+ * This is invoked by default; we recommend that you turn it off:
+ * See the "Recommended Build Options" section of the ICU4C readme
+ * (http://source.icu-project.org/repos/icu/icu/trunk/readme.html#RecBuild)
+ * @stable ICU 2.4
+ */
+
+/**
+ * \def U_NAMESPACE_QUALIFIER
+ * This is used to qualify that a function or class is part of
+ * the public ICU C++ API namespace.
+ *
+ * This macro is unnecessary since ICU 49 requires namespace support.
+ * You can just use "icu::" instead.
+ * @stable ICU 2.4
+ */
+
+/* Define namespace symbols if the compiler supports it. */
+#ifdef __cplusplus
+#   if U_DISABLE_RENAMING
+#       define U_ICU_NAMESPACE icu
+        namespace U_ICU_NAMESPACE { }
+#   else
+#       define U_ICU_NAMESPACE U_ICU_ENTRY_POINT_RENAME(icu)
+        namespace U_ICU_NAMESPACE { }
+        namespace icu = U_ICU_NAMESPACE;
+#   endif
+
+#   define U_NAMESPACE_BEGIN extern "C++" { namespace U_ICU_NAMESPACE {
+#   define U_NAMESPACE_END } }
+#   define U_NAMESPACE_USE using namespace U_ICU_NAMESPACE;
+#   define U_NAMESPACE_QUALIFIER U_ICU_NAMESPACE::
+
+#   ifndef U_USING_ICU_NAMESPACE
+#       define U_USING_ICU_NAMESPACE 1
+#   endif
+#   if U_USING_ICU_NAMESPACE
+        U_NAMESPACE_USE
+#   endif
+#else
+#   define U_NAMESPACE_BEGIN
+#   define U_NAMESPACE_END
+#   define U_NAMESPACE_USE
+#   define U_NAMESPACE_QUALIFIER
+#endif
+
+/*===========================================================================*/
+/* General version helper functions. Definitions in putil.c                  */
+/*===========================================================================*/
+
+/**
+ * Parse a string with dotted-decimal version information and
+ * fill in a UVersionInfo structure with the result.
+ * Definition of this function lives in putil.c
+ *
+ * @param versionArray The destination structure for the version information.
+ * @param versionString A string with dotted-decimal version information,
+ *                      with up to four non-negative number fields with
+ *                      values of up to 255 each.
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+u_versionFromString(UVersionInfo versionArray, const char *versionString);
+
+/**
+ * Parse a Unicode string with dotted-decimal version information and
+ * fill in a UVersionInfo structure with the result.
+ * Definition of this function lives in putil.c
+ *
+ * @param versionArray The destination structure for the version information.
+ * @param versionString A Unicode string with dotted-decimal version
+ *                      information, with up to four non-negative number
+ *                      fields with values of up to 255 each.
+ * @stable ICU 4.2
+ */
+U_STABLE void U_EXPORT2
+u_versionFromUString(UVersionInfo versionArray, const UChar *versionString);
+
+
+/**
+ * Write a string with dotted-decimal version information according
+ * to the input UVersionInfo.
+ * Definition of this function lives in putil.c
+ *
+ * @param versionArray The version information to be written as a string.
+ * @param versionString A string buffer that will be filled in with
+ *                      a string corresponding to the numeric version
+ *                      information in versionArray.
+ *                      The buffer size must be at least U_MAX_VERSION_STRING_LENGTH.
+ * @stable ICU 2.4
+ */
+U_STABLE void U_EXPORT2
+u_versionToString(const UVersionInfo versionArray, char *versionString);
+
+/**
+ * Gets the ICU release version.  The version array stores the version information
+ * for ICU.  For example, release "1.3.31.2" is then represented as 0x01031F02.
+ * Definition of this function lives in putil.c
+ *
+ * @param versionArray the version # information, the result will be filled in
+ * @stable ICU 2.0
+ */
+U_STABLE void U_EXPORT2
+u_getVersion(UVersionInfo versionArray);
+#endif
diff --git a/inspector/AsyncStackTrace.cpp b/inspector/AsyncStackTrace.cpp
new file mode 100644
index 0000000..880a362
--- /dev/null
+++ b/inspector/AsyncStackTrace.cpp
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AsyncStackTrace.h"
+
+#include "InspectorValues.h"
+#include "ScriptCallStack.h"
+
+namespace Inspector {
+
+RefPtr<AsyncStackTrace> AsyncStackTrace::create(RefPtr<ScriptCallStack> callStack, bool singleShot, RefPtr<AsyncStackTrace> parent)
+{
+    ASSERT(callStack && callStack->size());
+    return adoptRef(*new AsyncStackTrace(WTFMove(callStack), singleShot, WTFMove(parent)));
+}
+
+AsyncStackTrace::AsyncStackTrace(RefPtr<ScriptCallStack> callStack, bool singleShot, RefPtr<AsyncStackTrace> parent)
+    : m_callStack(callStack)
+    , m_parent(parent)
+    , m_singleShot(singleShot)
+{
+    if (m_parent)
+        m_parent->m_childCount++;
+}
+
+AsyncStackTrace::~AsyncStackTrace()
+{
+    if (m_parent)
+        remove();
+    ASSERT(!m_childCount);
+}
+
+bool AsyncStackTrace::isPending() const
+{
+    return m_state == State::Pending;
+}
+
+bool AsyncStackTrace::isLocked() const
+{
+    return m_state == State::Pending || m_state == State::Active || m_childCount > 1;
+}
+
+void AsyncStackTrace::willDispatchAsyncCall(size_t maxDepth)
+{
+    ASSERT(m_state == State::Pending);
+    m_state = State::Active;
+
+    truncate(maxDepth);
+}
+
+void AsyncStackTrace::didDispatchAsyncCall()
+{
+    ASSERT(m_state == State::Active || m_state == State::Canceled);
+
+    if (m_state == State::Active && !m_singleShot) {
+        m_state = State::Pending;
+        return;
+    }
+
+    m_state = State::Dispatched;
+
+    if (!m_childCount)
+        remove();
+}
+
+void AsyncStackTrace::didCancelAsyncCall()
+{
+    if (m_state == State::Canceled)
+        return;
+
+    if (m_state == State::Pending && !m_childCount)
+        remove();
+
+    m_state = State::Canceled;
+}
+
+RefPtr<Inspector::Protocol::Console::StackTrace> AsyncStackTrace::buildInspectorObject() const
+{
+    RefPtr<Inspector::Protocol::Console::StackTrace> topStackTrace;
+    RefPtr<Inspector::Protocol::Console::StackTrace> previousStackTrace;
+
+    auto* stackTrace = this;
+    while (stackTrace) {
+        auto callStack = stackTrace->m_callStack;
+        ASSERT(callStack && callStack->size());
+
+        RefPtr<Inspector::Protocol::Console::StackTrace> protocolObject = Inspector::Protocol::Console::StackTrace::create()
+            .setCallFrames(callStack->buildInspectorArray())
+            .release();
+
+        if (stackTrace->m_truncated)
+            protocolObject->setTruncated(true);
+        if (callStack->at(0).isNative())
+            protocolObject->setTopCallFrameIsBoundary(true);
+
+        if (!topStackTrace)
+            topStackTrace = protocolObject;
+
+        if (previousStackTrace)
+            previousStackTrace->setParentStackTrace(protocolObject);
+
+        previousStackTrace = protocolObject;
+        stackTrace = stackTrace->m_parent.get();
+    }
+
+    return topStackTrace;
+}
+
+void AsyncStackTrace::truncate(size_t maxDepth)
+{
+    AsyncStackTrace* lastUnlockedAncestor = nullptr;
+    size_t depth = 0;
+
+    auto* newStackTraceRoot = this;
+    while (newStackTraceRoot) {
+        depth += newStackTraceRoot->m_callStack->size();
+        if (depth >= maxDepth)
+            break;
+
+        auto* parent = newStackTraceRoot->m_parent.get();
+        if (!lastUnlockedAncestor && parent && parent->isLocked())
+            lastUnlockedAncestor = newStackTraceRoot;
+
+        newStackTraceRoot = parent;
+    }
+
+    if (!newStackTraceRoot || !newStackTraceRoot->m_parent)
+        return;
+
+    if (!lastUnlockedAncestor) {
+        // No locked nodes belong to the trace. The subtree at the new root
+        // is moved to a new tree, and marked as truncated if necessary.
+        newStackTraceRoot->m_truncated = true;
+        newStackTraceRoot->remove();
+        return;
+    }
+
+    // The new root has a locked descendent. Since truncating a stack trace
+    // cannot mutate locked nodes or their ancestors, a new tree is created by
+    // cloning the locked portion of the trace (the path from the locked node
+    // to the new root). The subtree rooted at the last unlocked ancestor is
+    // then appended to the new tree.
+    auto* currentNode = lastUnlockedAncestor;
+    while (currentNode->m_parent) {
+        auto& parentNode = currentNode->m_parent;
+        currentNode->m_parent = AsyncStackTrace::create(parentNode->m_callStack, true, parentNode->m_parent);
+        currentNode = currentNode->m_parent.get();
+
+        if (parentNode.get() == newStackTraceRoot)
+            break;
+    }
+
+    currentNode->m_truncated = true;
+    currentNode->remove();
+
+    // Decrement the child count of the first locked ancestor after removing its subtree.
+    auto& firstLockedAncestor = lastUnlockedAncestor->m_parent;
+    firstLockedAncestor->m_childCount--;
+}
+
+void AsyncStackTrace::remove()
+{
+    if (!m_parent)
+        return;
+
+    ASSERT(m_parent->m_childCount);
+    m_parent->m_childCount--;
+    m_parent = nullptr;
+}
+
+} // namespace Inspector
diff --git a/inspector/AsyncStackTrace.h b/inspector/AsyncStackTrace.h
new file mode 100644
index 0000000..2909672
--- /dev/null
+++ b/inspector/AsyncStackTrace.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorProtocolObjects.h"
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+
+namespace Inspector {
+
+class ScriptCallStack;
+
+class JS_EXPORT_PRIVATE AsyncStackTrace : public RefCounted<AsyncStackTrace> {
+public:
+    enum class State {
+        Pending,
+        Active,
+        Dispatched,
+        Canceled,
+    };
+
+    static RefPtr<AsyncStackTrace> create(RefPtr<ScriptCallStack>, bool singleShot, RefPtr<AsyncStackTrace> parent);
+
+    bool isPending() const;
+    bool isLocked() const;
+
+    void willDispatchAsyncCall(size_t maxDepth);
+    void didDispatchAsyncCall();
+    void didCancelAsyncCall();
+
+    RefPtr<Inspector::Protocol::Console::StackTrace> buildInspectorObject() const;
+
+    ~AsyncStackTrace();
+
+private:
+    AsyncStackTrace(RefPtr<ScriptCallStack>, bool, RefPtr<AsyncStackTrace>);
+
+    void truncate(size_t maxDepth);
+    void remove();
+
+    RefPtr<ScriptCallStack> m_callStack;
+    RefPtr<AsyncStackTrace> m_parent;
+    unsigned m_childCount { 0 };
+    State m_state { State::Pending };
+    bool m_truncated { false };
+    bool m_singleShot { true };
+};
+
+} // namespace Inspector
diff --git a/inspector/ConsoleMessage.cpp b/inspector/ConsoleMessage.cpp
new file mode 100644
index 0000000..133893f
--- /dev/null
+++ b/inspector/ConsoleMessage.cpp
@@ -0,0 +1,285 @@
+/*
+ * Copyright (C) 2007, 2008, 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ConsoleMessage.h"
+
+#include "IdentifiersFactory.h"
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
+#include "InspectorValues.h"
+#include "ScriptArguments.h"
+#include "ScriptCallFrame.h"
+#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
+#include "ScriptValue.h"
+
+namespace Inspector {
+
+ConsoleMessage::ConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned long requestIdentifier)
+    : m_source(source)
+    , m_type(type)
+    , m_level(level)
+    , m_message(message)
+    , m_url()
+    , m_requestId(IdentifiersFactory::requestId(requestIdentifier))
+{
+}
+
+ConsoleMessage::ConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& url, unsigned line, unsigned column, JSC::ExecState* state, unsigned long requestIdentifier)
+    : m_source(source)
+    , m_type(type)
+    , m_level(level)
+    , m_message(message)
+    , m_url(url)
+    , m_line(line)
+    , m_column(column)
+    , m_requestId(IdentifiersFactory::requestId(requestIdentifier))
+{
+    autogenerateMetadata(state);
+}
+
+ConsoleMessage::ConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptCallStack> callStack, unsigned long requestIdentifier)
+    : m_source(source)
+    , m_type(type)
+    , m_level(level)
+    , m_message(message)
+    , m_url()
+    , m_requestId(IdentifiersFactory::requestId(requestIdentifier))
+{
+    m_callStack = callStack;
+
+    const ScriptCallFrame* frame = m_callStack ? m_callStack->firstNonNativeCallFrame() : nullptr;
+    if (frame) {
+        m_url = frame->sourceURL();
+        m_line = frame->lineNumber();
+        m_column = frame->columnNumber();
+    }
+}
+
+ConsoleMessage::ConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, PassRefPtr<ScriptArguments> arguments, JSC::ExecState* state, unsigned long requestIdentifier)
+    : m_source(source)
+    , m_type(type)
+    , m_level(level)
+    , m_message(message)
+    , m_arguments(arguments)
+    , m_url()
+    , m_requestId(IdentifiersFactory::requestId(requestIdentifier))
+{
+    autogenerateMetadata(state);
+}
+
+ConsoleMessage::~ConsoleMessage()
+{
+}
+
+void ConsoleMessage::autogenerateMetadata(JSC::ExecState* state)
+{
+    if (!state)
+        return;
+
+    if (m_type == MessageType::EndGroup)
+        return;
+
+    // FIXME: Should this really be using "for console" in the generic ConsoleMessage autogeneration? This can skip the first frame.
+    m_callStack = createScriptCallStackForConsole(state, ScriptCallStack::maxCallStackSizeToCapture);
+
+    if (const ScriptCallFrame* frame = m_callStack->firstNonNativeCallFrame()) {
+        m_url = frame->sourceURL();
+        m_line = frame->lineNumber();
+        m_column = frame->columnNumber();
+        return;
+    }
+}
+
+static Inspector::Protocol::Console::ConsoleMessage::Source messageSourceValue(MessageSource source)
+{
+    switch (source) {
+    case MessageSource::XML: return Inspector::Protocol::Console::ConsoleMessage::Source::XML;
+    case MessageSource::JS: return Inspector::Protocol::Console::ConsoleMessage::Source::Javascript;
+    case MessageSource::Network: return Inspector::Protocol::Console::ConsoleMessage::Source::Network;
+    case MessageSource::ConsoleAPI: return Inspector::Protocol::Console::ConsoleMessage::Source::ConsoleAPI;
+    case MessageSource::Storage: return Inspector::Protocol::Console::ConsoleMessage::Source::Storage;
+    case MessageSource::AppCache: return Inspector::Protocol::Console::ConsoleMessage::Source::Appcache;
+    case MessageSource::Rendering: return Inspector::Protocol::Console::ConsoleMessage::Source::Rendering;
+    case MessageSource::CSS: return Inspector::Protocol::Console::ConsoleMessage::Source::CSS;
+    case MessageSource::Security: return Inspector::Protocol::Console::ConsoleMessage::Source::Security;
+    case MessageSource::ContentBlocker: return Inspector::Protocol::Console::ConsoleMessage::Source::ContentBlocker;
+    case MessageSource::Other: return Inspector::Protocol::Console::ConsoleMessage::Source::Other;
+    }
+    return Inspector::Protocol::Console::ConsoleMessage::Source::Other;
+}
+
+static Inspector::Protocol::Console::ConsoleMessage::Type messageTypeValue(MessageType type)
+{
+    switch (type) {
+    case MessageType::Log: return Inspector::Protocol::Console::ConsoleMessage::Type::Log;
+    case MessageType::Clear: return Inspector::Protocol::Console::ConsoleMessage::Type::Clear;
+    case MessageType::Dir: return Inspector::Protocol::Console::ConsoleMessage::Type::Dir;
+    case MessageType::DirXML: return Inspector::Protocol::Console::ConsoleMessage::Type::DirXML;
+    case MessageType::Table: return Inspector::Protocol::Console::ConsoleMessage::Type::Table;
+    case MessageType::Trace: return Inspector::Protocol::Console::ConsoleMessage::Type::Trace;
+    case MessageType::StartGroup: return Inspector::Protocol::Console::ConsoleMessage::Type::StartGroup;
+    case MessageType::StartGroupCollapsed: return Inspector::Protocol::Console::ConsoleMessage::Type::StartGroupCollapsed;
+    case MessageType::EndGroup: return Inspector::Protocol::Console::ConsoleMessage::Type::EndGroup;
+    case MessageType::Assert: return Inspector::Protocol::Console::ConsoleMessage::Type::Assert;
+    case MessageType::Timing: return Inspector::Protocol::Console::ConsoleMessage::Type::Timing;
+    case MessageType::Profile: return Inspector::Protocol::Console::ConsoleMessage::Type::Profile;
+    case MessageType::ProfileEnd: return Inspector::Protocol::Console::ConsoleMessage::Type::ProfileEnd;
+    }
+    return Inspector::Protocol::Console::ConsoleMessage::Type::Log;
+}
+
+static Inspector::Protocol::Console::ConsoleMessage::Level messageLevelValue(MessageLevel level)
+{
+    switch (level) {
+    case MessageLevel::Log: return Inspector::Protocol::Console::ConsoleMessage::Level::Log;
+    case MessageLevel::Info: return Inspector::Protocol::Console::ConsoleMessage::Level::Info;
+    case MessageLevel::Warning: return Inspector::Protocol::Console::ConsoleMessage::Level::Warning;
+    case MessageLevel::Error: return Inspector::Protocol::Console::ConsoleMessage::Level::Error;
+    case MessageLevel::Debug: return Inspector::Protocol::Console::ConsoleMessage::Level::Debug;
+    }
+    return Inspector::Protocol::Console::ConsoleMessage::Level::Log;
+}
+
+void ConsoleMessage::addToFrontend(ConsoleFrontendDispatcher& consoleFrontendDispatcher, InjectedScriptManager& injectedScriptManager, bool generatePreview)
+{
+    Ref<Inspector::Protocol::Console::ConsoleMessage> jsonObj = Inspector::Protocol::Console::ConsoleMessage::create()
+        .setSource(messageSourceValue(m_source))
+        .setLevel(messageLevelValue(m_level))
+        .setText(m_message)
+        .release();
+
+    // FIXME: only send out type for ConsoleAPI source messages.
+    jsonObj->setType(messageTypeValue(m_type));
+    jsonObj->setLine(static_cast<int>(m_line));
+    jsonObj->setColumn(static_cast<int>(m_column));
+    jsonObj->setUrl(m_url);
+    jsonObj->setRepeatCount(static_cast<int>(m_repeatCount));
+
+    if (m_source == MessageSource::Network && !m_requestId.isEmpty())
+        jsonObj->setNetworkRequestId(m_requestId);
+
+    if (m_arguments && m_arguments->argumentCount()) {
+        InjectedScript injectedScript = injectedScriptManager.injectedScriptFor(m_arguments->globalState());
+        if (!injectedScript.hasNoValue()) {
+            Ref<Inspector::Protocol::Array<Inspector::Protocol::Runtime::RemoteObject>> jsonArgs = Inspector::Protocol::Array<Inspector::Protocol::Runtime::RemoteObject>::create();
+            if (m_type == MessageType::Table && generatePreview && m_arguments->argumentCount()) {
+                Deprecated::ScriptValue table = m_arguments->argumentAt(0);
+                Deprecated::ScriptValue columns = m_arguments->argumentCount() > 1 ? m_arguments->argumentAt(1) : Deprecated::ScriptValue();
+                RefPtr<Inspector::Protocol::Runtime::RemoteObject> inspectorValue = injectedScript.wrapTable(table, columns);
+                if (!inspectorValue) {
+                    ASSERT_NOT_REACHED();
+                    return;
+                }
+                jsonArgs->addItem(inspectorValue.copyRef());
+                if (m_arguments->argumentCount() > 1)
+                    jsonArgs->addItem(injectedScript.wrapObject(columns, ASCIILiteral("console"), true));
+            } else {
+                for (unsigned i = 0; i < m_arguments->argumentCount(); ++i) {
+                    RefPtr<Inspector::Protocol::Runtime::RemoteObject> inspectorValue = injectedScript.wrapObject(m_arguments->argumentAt(i), ASCIILiteral("console"), generatePreview);
+                    if (!inspectorValue) {
+                        ASSERT_NOT_REACHED();
+                        return;
+                    }
+                    jsonArgs->addItem(inspectorValue.copyRef());
+                }
+            }
+            jsonObj->setParameters(WTFMove(jsonArgs));
+        }
+    }
+
+    if (m_callStack)
+        jsonObj->setStackTrace(m_callStack->buildInspectorArray());
+
+    consoleFrontendDispatcher.messageAdded(WTFMove(jsonObj));
+}
+
+void ConsoleMessage::updateRepeatCountInConsole(ConsoleFrontendDispatcher& consoleFrontendDispatcher)
+{
+    consoleFrontendDispatcher.messageRepeatCountUpdated(m_repeatCount);
+}
+
+bool ConsoleMessage::isEqual(ConsoleMessage* msg) const
+{
+    if (m_arguments) {
+        if (!m_arguments->isEqual(msg->m_arguments.get()))
+            return false;
+
+        // Never treat objects as equal - their properties might change over time.
+        for (size_t i = 0; i < m_arguments->argumentCount(); ++i) {
+            if (m_arguments->argumentAt(i).isObject())
+                return false;
+        }
+    } else if (msg->m_arguments)
+        return false;
+
+    if (m_callStack) {
+        if (!m_callStack->isEqual(msg->m_callStack.get()))
+            return false;
+    } else if (msg->m_callStack)
+        return false;
+
+    return msg->m_source == m_source
+        && msg->m_type == m_type
+        && msg->m_level == m_level
+        && msg->m_message == m_message
+        && msg->m_line == m_line
+        && msg->m_column == m_column
+        && msg->m_url == m_url
+        && msg->m_requestId == m_requestId;
+}
+
+void ConsoleMessage::clear()
+{
+    if (!m_message)
+        m_message = ASCIILiteral("<message collected>");
+
+    if (m_arguments)
+        m_arguments = nullptr;
+}
+
+JSC::ExecState* ConsoleMessage::scriptState() const
+{
+    if (m_arguments)
+        return m_arguments->globalState();
+
+    return nullptr;
+}
+
+unsigned ConsoleMessage::argumentCount() const
+{
+    if (m_arguments)
+        return m_arguments->argumentCount();
+
+    return 0;
+}
+
+} // namespace Inspector
diff --git a/inspector/ConsoleMessage.h b/inspector/ConsoleMessage.h
new file mode 100644
index 0000000..4f06081
--- /dev/null
+++ b/inspector/ConsoleMessage.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2007, 2008, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConsoleTypes.h"
+#include "InspectorFrontendDispatchers.h"
+#include <wtf/Forward.h>
+
+namespace JSC {
+class ExecState;
+}
+
+namespace Inspector {
+
+class InjectedScriptManager;
+class ScriptArguments;
+class ScriptCallStack;
+
+class JS_EXPORT_PRIVATE ConsoleMessage {
+    WTF_MAKE_NONCOPYABLE(ConsoleMessage);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, unsigned long requestIdentifier = 0);
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& url, unsigned line, unsigned column, JSC::ExecState* = nullptr, unsigned long requestIdentifier = 0);
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptCallStack>, unsigned long requestIdentifier = 0);
+    ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, PassRefPtr<ScriptArguments>, JSC::ExecState*, unsigned long requestIdentifier = 0);
+    ~ConsoleMessage();
+
+    void addToFrontend(ConsoleFrontendDispatcher&, InjectedScriptManager&, bool generatePreview);
+    void updateRepeatCountInConsole(ConsoleFrontendDispatcher&);
+
+    MessageSource source() const { return m_source; }
+    MessageType type() const { return m_type; }
+    MessageLevel level() const { return m_level; }
+    const String& message() const { return m_message; }
+    const String& url() const { return m_url; }
+    unsigned line() const { return m_line; }
+    unsigned column() const { return m_column; }
+
+    JSC::ExecState* scriptState() const;
+
+    void incrementCount() { ++m_repeatCount; }
+
+    unsigned argumentCount() const;
+
+    bool isEqual(ConsoleMessage* msg) const;
+
+    void clear();
+
+private:
+    void autogenerateMetadata(JSC::ExecState* = nullptr);
+
+    MessageSource m_source;
+    MessageType m_type;
+    MessageLevel m_level;
+    String m_message;
+    RefPtr<ScriptArguments> m_arguments;
+    RefPtr<ScriptCallStack> m_callStack;
+    String m_url;
+    unsigned m_line { 0 };
+    unsigned m_column { 0 };
+    unsigned m_repeatCount { 1 };
+    String m_requestId;
+};
+
+} // namespace Inspector
diff --git a/inspector/ContentSearchUtilities.cpp b/inspector/ContentSearchUtilities.cpp
new file mode 100644
index 0000000..7f45042
--- /dev/null
+++ b/inspector/ContentSearchUtilities.cpp
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
+ * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ContentSearchUtilities.h"
+
+#include "InspectorValues.h"
+#include "RegularExpression.h"
+#include "Yarr.h"
+#include "YarrInterpreter.h"
+#include <wtf/BumpPointerAllocator.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuilder.h>
+
+using namespace JSC::Yarr;
+
+namespace Inspector {
+namespace ContentSearchUtilities {
+
+static const char regexSpecialCharacters[] = "[](){}+-*.,?\\^$|";
+
+static String createSearchRegexSource(const String& text)
+{
+    StringBuilder result;
+
+    for (unsigned i = 0; i < text.length(); i++) {
+        UChar character = text[i];
+        if (isASCII(character) && strchr(regexSpecialCharacters, character))
+            result.append('\\');
+        result.append(character);
+    }
+
+    return result.toString();
+}
+
+static inline size_t sizetExtractor(const size_t* value)
+{
+    return *value;
+}
+
+TextPosition textPositionFromOffset(size_t offset, const Vector<size_t>& lineEndings)
+{
+    const size_t* foundNextStart = approximateBinarySearch<size_t, size_t>(lineEndings, lineEndings.size(), offset, sizetExtractor);
+    size_t lineIndex = foundNextStart - &lineEndings.at(0);
+    if (offset >= *foundNextStart)
+        ++lineIndex;
+    size_t lineStartOffset = lineIndex > 0 ? lineEndings.at(lineIndex - 1) : 0;
+    size_t column = offset - lineStartOffset;
+    return TextPosition(OrdinalNumber::fromZeroBasedInt(lineIndex), OrdinalNumber::fromZeroBasedInt(column));
+}
+
+static Vector<std::pair<size_t, String>> getRegularExpressionMatchesByLines(const JSC::Yarr::RegularExpression& regex, const String& text)
+{
+    Vector<std::pair<size_t, String>> result;
+    if (text.isEmpty())
+        return result;
+
+    std::unique_ptr<Vector<size_t>> endings(lineEndings(text));
+    size_t size = endings->size();
+    size_t start = 0;
+
+    for (size_t lineNumber = 0; lineNumber < size; ++lineNumber) {
+        size_t nextStart = endings->at(lineNumber);
+        String line = text.substring(start, nextStart - start);
+
+        int matchLength;
+        if (regex.match(line, 0, &matchLength) != -1)
+            result.append(std::pair<size_t, String>(lineNumber, line));
+
+        start = nextStart;
+    }
+
+    return result;
+}
+
+std::unique_ptr<Vector<size_t>> lineEndings(const String& text)
+{
+    auto result = std::make_unique<Vector<size_t>>();
+
+    size_t start = 0;
+    while (start < text.length()) {
+        size_t nextStart = text.find('\n', start);
+        if (nextStart == notFound || nextStart == (text.length() - 1)) {
+            result->append(text.length());
+            break;
+        }
+
+        nextStart += 1;
+        result->append(nextStart);
+        start = nextStart;
+    }
+
+    result->append(text.length());
+
+    return result;
+}
+
+static Ref<Inspector::Protocol::GenericTypes::SearchMatch> buildObjectForSearchMatch(size_t lineNumber, const String& lineContent)
+{
+    return Inspector::Protocol::GenericTypes::SearchMatch::create()
+        .setLineNumber(lineNumber)
+        .setLineContent(lineContent)
+        .release();
+}
+
+JSC::Yarr::RegularExpression createSearchRegex(const String& query, bool caseSensitive, bool isRegex)
+{
+    String regexSource = isRegex ? query : createSearchRegexSource(query);
+    return JSC::Yarr::RegularExpression(regexSource, caseSensitive ? TextCaseSensitive : TextCaseInsensitive);
+}
+
+int countRegularExpressionMatches(const JSC::Yarr::RegularExpression& regex, const String& content)
+{
+    if (content.isEmpty())
+        return 0;
+
+    int result = 0;
+    int position;
+    unsigned start = 0;
+    int matchLength;
+    while ((position = regex.match(content, start, &matchLength)) != -1) {
+        if (start >= content.length())
+            break;
+        if (matchLength > 0)
+            ++result;
+        start = position + 1;
+    }
+    return result;
+}
+
+Ref<Inspector::Protocol::Array<Inspector::Protocol::GenericTypes::SearchMatch>> searchInTextByLines(const String& text, const String& query, const bool caseSensitive, const bool isRegex)
+{
+    Ref<Inspector::Protocol::Array<Inspector::Protocol::GenericTypes::SearchMatch>> result = Inspector::Protocol::Array<Inspector::Protocol::GenericTypes::SearchMatch>::create();
+
+    JSC::Yarr::RegularExpression regex = ContentSearchUtilities::createSearchRegex(query, caseSensitive, isRegex);
+    Vector<std::pair<size_t, String>> matches = getRegularExpressionMatchesByLines(regex, text);
+
+    for (const auto& match : matches) {
+        Ref<Inspector::Protocol::GenericTypes::SearchMatch> matchObject = buildObjectForSearchMatch(match.first, match.second);
+        result->addItem(WTFMove(matchObject));
+    }
+
+    return result;
+}
+
+static String stylesheetCommentPattern(const String& name)
+{
+    // "/*# <name>=<value> */" and deprecated "/*@"
+    return "/\\*[#@][\040\t]" + name + "=[\040\t]*([^\\s\'\"]*)[\040\t]*\\*/";
+}
+
+static String findMagicComment(const String& content, const String& patternString)
+{
+    ASSERT(!content.isNull());
+    const char* error = nullptr;
+    JSC::Yarr::YarrPattern pattern(patternString, JSC::RegExpFlags::FlagMultiline, &error);
+    ASSERT(!error);
+    BumpPointerAllocator regexAllocator;
+    auto bytecodePattern = JSC::Yarr::byteCompile(pattern, &regexAllocator);
+    ASSERT(bytecodePattern);
+
+    ASSERT(pattern.m_numSubpatterns == 1);
+    Vector<int, 4> matches;
+    matches.resize(4);
+    unsigned result = JSC::Yarr::interpret(bytecodePattern.get(), content, 0, reinterpret_cast<unsigned*>(matches.data()));
+    if (result == JSC::Yarr::offsetNoMatch)
+        return String();
+
+    ASSERT(matches[2] > 0 && matches[3] > 0);
+    return content.substring(matches[2], matches[3] - matches[2]);
+}
+
+String findStylesheetSourceMapURL(const String& content)
+{
+    return findMagicComment(content, stylesheetCommentPattern(ASCIILiteral("sourceMappingURL")));
+}
+
+} // namespace ContentSearchUtilities
+} // namespace Inspector
diff --git a/inspector/ContentSearchUtilities.h b/inspector/ContentSearchUtilities.h
new file mode 100644
index 0000000..7c01b90
--- /dev/null
+++ b/inspector/ContentSearchUtilities.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
+ * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorProtocolObjects.h"
+#include <wtf/Vector.h>
+#include <wtf/text/TextPosition.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC { namespace Yarr {
+class RegularExpression;
+} }
+
+namespace Inspector {
+
+namespace ContentSearchUtilities {
+
+JS_EXPORT_PRIVATE JSC::Yarr::RegularExpression createSearchRegex(const String& query, bool caseSensitive, bool isRegex);
+JS_EXPORT_PRIVATE int countRegularExpressionMatches(const JSC::Yarr::RegularExpression&, const String&);
+JS_EXPORT_PRIVATE Ref<Inspector::Protocol::Array<Inspector::Protocol::GenericTypes::SearchMatch>> searchInTextByLines(const String& text, const String& query, const bool caseSensitive, const bool isRegex);
+JS_EXPORT_PRIVATE TextPosition textPositionFromOffset(size_t offset, const Vector<size_t>& lineEndings);
+JS_EXPORT_PRIVATE std::unique_ptr<Vector<size_t>> lineEndings(const String&);
+
+JS_EXPORT_PRIVATE String findStylesheetSourceMapURL(const String& content);
+
+} // namespace ContentSearchUtilities
+
+} // namespace Inspector
diff --git a/inspector/EventLoop.cpp b/inspector/EventLoop.cpp
new file mode 100644
index 0000000..b04ff1f
--- /dev/null
+++ b/inspector/EventLoop.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EventLoop.h"
+
+#if OS(WINDOWS)
+#include <windows.h>
+#elif PLATFORM(EFL)
+#include <Ecore.h>
+#elif PLATFORM(GTK)
+#include <glib.h>
+#endif
+
+namespace Inspector {
+
+#if USE(CF) && !OS(WINDOWS)
+CFStringRef EventLoop::remoteInspectorRunLoopMode()
+{
+    return CFSTR("com.apple.JavaScriptCore.remote-inspector-runloop-mode");
+}
+#endif
+
+void EventLoop::cycle()
+{
+#if OS(WINDOWS)
+    MSG msg;
+    if (!GetMessage(&msg, 0, 0, 0)) {
+        m_ended = true;
+        return;
+    }
+    TranslateMessage(&msg);
+    DispatchMessage(&msg);
+#elif PLATFORM(WATCHOS)
+    // FIXME: <rdar://problem/25972777>. In order for auto-attach to work, we need to
+    // run in the default run loop mode otherwise we do not receive the XPC messages
+    // necessary to setup the relay connection and negotiate an auto-attach debugger.
+    CFTimeInterval timeInterval = 0.05;
+    CFRunLoopRunInMode(kCFRunLoopDefaultMode, timeInterval, true);
+#elif USE(CF)
+    // Run the RunLoop in a custom run loop mode to prevent default observers
+    // to run and potentially evaluate JavaScript in this context while we are
+    // nested. Only the debugger should control things until we continue.
+    // FIXME: This is not a perfect solution, as background threads are not
+    // paused and can still access and evalute script in the JSContext.
+    CFTimeInterval timeInterval = 0.05;
+    CFRunLoopRunInMode(remoteInspectorRunLoopMode(), timeInterval, true);
+#elif PLATFORM(EFL)
+    ecore_main_loop_iterate();
+#elif PLATFORM(GTK)
+    g_main_context_iteration(NULL, FALSE);
+#endif
+}
+
+} // namespace Inspector
diff --git a/inspector/EventLoop.h b/inspector/EventLoop.h
new file mode 100644
index 0000000..1625a6b
--- /dev/null
+++ b/inspector/EventLoop.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Noncopyable.h>
+
+#if USE(CF) && !OS(WINDOWS)
+#include <CoreFoundation/CFRunLoop.h>
+#endif
+
+namespace Inspector {
+
+class EventLoop {
+    WTF_MAKE_NONCOPYABLE(EventLoop);
+public:
+    EventLoop()
+        : m_ended(false)
+    {
+    }
+
+    void cycle();
+    bool ended() const { return m_ended; }
+
+#if USE(CF) && !OS(WINDOWS)
+    static CFStringRef remoteInspectorRunLoopMode();
+#endif
+
+private:
+    bool m_ended;
+};
+
+} // namespace Inspector
diff --git a/inspector/IdentifiersFactory.cpp b/inspector/IdentifiersFactory.cpp
new file mode 100644
index 0000000..7e145be
--- /dev/null
+++ b/inspector/IdentifiersFactory.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IdentifiersFactory.h"
+
+#include <wtf/text/StringBuilder.h>
+
+namespace Inspector {
+
+namespace {
+static long s_lastUsedIdentifier = 0;
+}
+
+long IdentifiersFactory::s_processId = 0;
+
+String IdentifiersFactory::createIdentifier()
+{
+    return addProcessIdPrefixTo(String::number(++s_lastUsedIdentifier));
+}
+
+String IdentifiersFactory::requestId(unsigned long identifier)
+{
+    if (identifier)
+        return addProcessIdPrefixTo(String::number(identifier));
+    return String();
+}
+
+String IdentifiersFactory::addProcessIdPrefixTo(const String& id)
+{
+    StringBuilder builder;
+    builder.appendNumber(s_processId);
+    builder.append('.');
+    builder.append(id);
+    return builder.toString();
+}
+
+} // namespace Inspector
+
diff --git a/inspector/IdentifiersFactory.h b/inspector/IdentifiersFactory.h
new file mode 100644
index 0000000..3a3b75a
--- /dev/null
+++ b/inspector/IdentifiersFactory.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class JS_EXPORT_PRIVATE IdentifiersFactory {
+public:
+    static void setProcessId(long processId) { s_processId = processId; }
+    static String createIdentifier();
+    static String requestId(unsigned long identifier);
+
+private:
+    static String addProcessIdPrefixTo(const String& id);
+
+    static long s_processId;
+};
+
+} // namespace Inspector
diff --git a/inspector/InjectedScript.cpp b/inspector/InjectedScript.cpp
new file mode 100644
index 0000000..f7691af
--- /dev/null
+++ b/inspector/InjectedScript.cpp
@@ -0,0 +1,353 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScript.h"
+
+#include "InspectorValues.h"
+#include "JSCInlines.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+#include <wtf/text/WTFString.h>
+
+using Inspector::Protocol::Array;
+
+namespace Inspector {
+
+InjectedScript::InjectedScript()
+    : InjectedScriptBase(ASCIILiteral("InjectedScript"))
+{
+}
+
+InjectedScript::InjectedScript(Deprecated::ScriptObject injectedScriptObject, InspectorEnvironment* environment)
+    : InjectedScriptBase(ASCIILiteral("InjectedScript"), injectedScriptObject, environment)
+{
+}
+
+InjectedScript::~InjectedScript()
+{
+}
+
+void InjectedScript::evaluate(ErrorString& errorString, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, bool generatePreview, bool saveResult, RefPtr<Inspector::Protocol::Runtime::RemoteObject>* result, Inspector::Protocol::OptOutput<bool>* wasThrown, Inspector::Protocol::OptOutput<int>* savedResultIndex)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("evaluate"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(expression);
+    function.appendArgument(objectGroup);
+    function.appendArgument(includeCommandLineAPI);
+    function.appendArgument(returnByValue);
+    function.appendArgument(generatePreview);
+    function.appendArgument(saveResult);
+    makeEvalCall(errorString, function, result, wasThrown, savedResultIndex);
+}
+
+void InjectedScript::callFunctionOn(ErrorString& errorString, const String& objectId, const String& expression, const String& arguments, bool returnByValue, bool generatePreview, RefPtr<Inspector::Protocol::Runtime::RemoteObject>* result, Inspector::Protocol::OptOutput<bool>* wasThrown)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("callFunctionOn"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(objectId);
+    function.appendArgument(expression);
+    function.appendArgument(arguments);
+    function.appendArgument(returnByValue);
+    function.appendArgument(generatePreview);
+    makeEvalCall(errorString, function, result, wasThrown);
+}
+
+void InjectedScript::evaluateOnCallFrame(ErrorString& errorString, JSC::JSValue callFrames, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, bool generatePreview, bool saveResult, RefPtr<Inspector::Protocol::Runtime::RemoteObject>* result, Inspector::Protocol::OptOutput<bool>* wasThrown, Inspector::Protocol::OptOutput<int>* savedResultIndex)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("evaluateOnCallFrame"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(callFrames);
+    function.appendArgument(callFrameId);
+    function.appendArgument(expression);
+    function.appendArgument(objectGroup);
+    function.appendArgument(includeCommandLineAPI);
+    function.appendArgument(returnByValue);
+    function.appendArgument(generatePreview);
+    function.appendArgument(saveResult);
+    makeEvalCall(errorString, function, result, wasThrown, savedResultIndex);
+}
+
+void InjectedScript::getFunctionDetails(ErrorString& errorString, const String& functionId, RefPtr<Inspector::Protocol::Debugger::FunctionDetails>* result)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("getFunctionDetails"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(functionId);
+
+    RefPtr<InspectorValue> resultValue;
+    makeCall(function, &resultValue);
+    if (!resultValue || resultValue->type() != InspectorValue::Type::Object) {
+        if (!resultValue->asString(errorString))
+            errorString = ASCIILiteral("Internal error");
+        return;
+    }
+
+    *result = BindingTraits<Inspector::Protocol::Debugger::FunctionDetails>::runtimeCast(WTFMove(resultValue));
+}
+
+void InjectedScript::functionDetails(ErrorString& errorString, JSC::JSValue value, RefPtr<Protocol::Debugger::FunctionDetails>* result)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("functionDetails"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(value);
+    function.appendArgument(true); // Preview only.
+
+    RefPtr<InspectorValue> resultValue;
+    makeCall(function, &resultValue);
+    if (!resultValue || resultValue->type() != InspectorValue::Type::Object) {
+        if (!resultValue->asString(errorString))
+            errorString = ASCIILiteral("Internal error");
+        return;
+    }
+
+    *result = BindingTraits<Inspector::Protocol::Debugger::FunctionDetails>::runtimeCast(WTFMove(resultValue));
+}
+
+void InjectedScript::getProperties(ErrorString& errorString, const String& objectId, bool ownProperties, bool generatePreview, RefPtr<Array<Inspector::Protocol::Runtime::PropertyDescriptor>>* properties)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("getProperties"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(objectId);
+    function.appendArgument(ownProperties);
+    function.appendArgument(generatePreview);
+
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    if (!result || result->type() != InspectorValue::Type::Array) {
+        errorString = ASCIILiteral("Internal error");
+        return;
+    }
+
+    *properties = BindingTraits<Array<Inspector::Protocol::Runtime::PropertyDescriptor>>::runtimeCast(WTFMove(result));
+}
+
+void InjectedScript::getDisplayableProperties(ErrorString& errorString, const String& objectId, bool generatePreview, RefPtr<Array<Inspector::Protocol::Runtime::PropertyDescriptor>>* properties)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("getDisplayableProperties"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(objectId);
+    function.appendArgument(generatePreview);
+
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    if (!result || result->type() != InspectorValue::Type::Array) {
+        errorString = ASCIILiteral("Internal error");
+        return;
+    }
+
+    *properties = BindingTraits<Array<Inspector::Protocol::Runtime::PropertyDescriptor>>::runtimeCast(WTFMove(result));
+}
+
+void InjectedScript::getInternalProperties(ErrorString& errorString, const String& objectId, bool generatePreview, RefPtr<Array<Inspector::Protocol::Runtime::InternalPropertyDescriptor>>* properties)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("getInternalProperties"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(objectId);
+    function.appendArgument(generatePreview);
+
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    if (!result || result->type() != InspectorValue::Type::Array) {
+        errorString = ASCIILiteral("Internal error");
+        return;
+    }
+
+    auto array = BindingTraits<Array<Inspector::Protocol::Runtime::InternalPropertyDescriptor>>::runtimeCast(WTFMove(result));
+    *properties = array->length() > 0 ? array : nullptr;
+}
+
+void InjectedScript::getCollectionEntries(ErrorString& errorString, const String& objectId, const String& objectGroup, int startIndex, int numberToFetch, RefPtr<Protocol::Array<Protocol::Runtime::CollectionEntry>>* entries)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("getCollectionEntries"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(objectId);
+    function.appendArgument(objectGroup);
+    function.appendArgument(startIndex);
+    function.appendArgument(numberToFetch);
+
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    if (!result || result->type() != InspectorValue::Type::Array) {
+        errorString = ASCIILiteral("Internal error");
+        return;
+    }
+
+    *entries = BindingTraits<Array<Protocol::Runtime::CollectionEntry>>::runtimeCast(WTFMove(result));
+}
+
+void InjectedScript::saveResult(ErrorString& errorString, const String& callArgumentJSON, Inspector::Protocol::OptOutput<int>* savedResultIndex)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("saveResult"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(callArgumentJSON);
+
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    if (!result || result->type() != InspectorValue::Type::Integer) {
+        errorString = ASCIILiteral("Internal error");
+        return;
+    }
+
+    int savedResultIndexInt = 0;
+    if (result->asInteger(savedResultIndexInt) && savedResultIndexInt > 0)
+        *savedResultIndex = savedResultIndexInt;
+}
+
+Ref<Array<Inspector::Protocol::Debugger::CallFrame>> InjectedScript::wrapCallFrames(JSC::JSValue callFrames) const
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("wrapCallFrames"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(callFrames);
+
+    bool hadException = false;
+    auto callFramesValue = callFunctionWithEvalEnabled(function, hadException);
+    if (!callFramesValue)
+        return Array<Inspector::Protocol::Debugger::CallFrame>::create();
+    ASSERT(!hadException);
+    RefPtr<InspectorValue> result = toInspectorValue(*scriptState(), callFramesValue);
+    if (result->type() == InspectorValue::Type::Array)
+        return BindingTraits<Array<Inspector::Protocol::Debugger::CallFrame>>::runtimeCast(WTFMove(result)).releaseNonNull();
+
+    return Array<Inspector::Protocol::Debugger::CallFrame>::create();
+}
+
+RefPtr<Inspector::Protocol::Runtime::RemoteObject> InjectedScript::wrapObject(JSC::JSValue value, const String& groupName, bool generatePreview) const
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall wrapFunction(injectedScriptObject(), ASCIILiteral("wrapObject"), inspectorEnvironment()->functionCallHandler());
+    wrapFunction.appendArgument(value);
+    wrapFunction.appendArgument(groupName);
+    wrapFunction.appendArgument(hasAccessToInspectedScriptState());
+    wrapFunction.appendArgument(generatePreview);
+
+    bool hadException = false;
+    auto r = callFunctionWithEvalEnabled(wrapFunction, hadException);
+    if (hadException)
+        return nullptr;
+
+    RefPtr<InspectorObject> resultObject;
+    bool castSucceeded = toInspectorValue(*scriptState(), r)->asObject(resultObject);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return BindingTraits<Inspector::Protocol::Runtime::RemoteObject>::runtimeCast(resultObject);
+}
+
+RefPtr<Inspector::Protocol::Runtime::RemoteObject> InjectedScript::wrapTable(JSC::JSValue table, JSC::JSValue columns) const
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall wrapFunction(injectedScriptObject(), ASCIILiteral("wrapTable"), inspectorEnvironment()->functionCallHandler());
+    wrapFunction.appendArgument(hasAccessToInspectedScriptState());
+    wrapFunction.appendArgument(table);
+    if (!columns)
+        wrapFunction.appendArgument(false);
+    else
+        wrapFunction.appendArgument(columns);
+
+    bool hadException = false;
+    auto r = callFunctionWithEvalEnabled(wrapFunction, hadException);
+    if (hadException)
+        return nullptr;
+
+    RefPtr<InspectorObject> resultObject;
+    bool castSucceeded = toInspectorValue(*scriptState(), r)->asObject(resultObject);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return BindingTraits<Inspector::Protocol::Runtime::RemoteObject>::runtimeCast(resultObject);
+}
+
+RefPtr<Inspector::Protocol::Runtime::ObjectPreview> InjectedScript::previewValue(JSC::JSValue value) const
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall wrapFunction(injectedScriptObject(), ASCIILiteral("previewValue"), inspectorEnvironment()->functionCallHandler());
+    wrapFunction.appendArgument(value);
+
+    bool hadException = false;
+    auto r = callFunctionWithEvalEnabled(wrapFunction, hadException);
+    if (hadException)
+        return nullptr;
+
+    RefPtr<InspectorObject> resultObject;
+    bool castSucceeded = toInspectorValue(*scriptState(), r)->asObject(resultObject);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return BindingTraits<Inspector::Protocol::Runtime::ObjectPreview>::runtimeCast(resultObject);
+}
+
+void InjectedScript::setExceptionValue(JSC::JSValue value)
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("setExceptionValue"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(value);
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+}
+
+void InjectedScript::clearExceptionValue()
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("clearExceptionValue"), inspectorEnvironment()->functionCallHandler());
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+}
+
+JSC::JSValue InjectedScript::findObjectById(const String& objectId) const
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("findObjectById"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(objectId);
+
+    bool hadException = false;
+    auto resultValue = callFunctionWithEvalEnabled(function, hadException);
+    ASSERT(!hadException);
+
+    return resultValue;
+}
+
+void InjectedScript::inspectObject(JSC::JSValue value)
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("inspectObject"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(value);
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+}
+
+void InjectedScript::releaseObject(const String& objectId)
+{
+    Deprecated::ScriptFunctionCall function(injectedScriptObject(), ASCIILiteral("releaseObject"), inspectorEnvironment()->functionCallHandler());
+    function.appendArgument(objectId);
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+}
+
+void InjectedScript::releaseObjectGroup(const String& objectGroup)
+{
+    ASSERT(!hasNoValue());
+    Deprecated::ScriptFunctionCall releaseFunction(injectedScriptObject(), ASCIILiteral("releaseObjectGroup"), inspectorEnvironment()->functionCallHandler());
+    releaseFunction.appendArgument(objectGroup);
+
+    bool hadException = false;
+    callFunctionWithEvalEnabled(releaseFunction, hadException);
+    ASSERT(!hadException);
+}
+
+} // namespace Inspector
+
diff --git a/inspector/InjectedScript.h b/inspector/InjectedScript.h
new file mode 100644
index 0000000..4d22711
--- /dev/null
+++ b/inspector/InjectedScript.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InjectedScriptBase.h"
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+
+namespace Deprecated {
+class ScriptObject;
+}
+
+namespace Inspector {
+
+class InjectedScriptModule;
+class InspectorEnvironment;
+
+class JS_EXPORT_PRIVATE InjectedScript : public InjectedScriptBase {
+public:
+    InjectedScript();
+    InjectedScript(Deprecated::ScriptObject, InspectorEnvironment*);
+    virtual ~InjectedScript();
+
+    void evaluate(ErrorString&, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, bool generatePreview, bool saveResult, RefPtr<Protocol::Runtime::RemoteObject>* result, Protocol::OptOutput<bool>* wasThrown, Inspector::Protocol::OptOutput<int>* savedResultIndex);
+    void callFunctionOn(ErrorString&, const String& objectId, const String& expression, const String& arguments, bool returnByValue, bool generatePreview, RefPtr<Protocol::Runtime::RemoteObject>* result, Protocol::OptOutput<bool>* wasThrown);
+    void evaluateOnCallFrame(ErrorString&, JSC::JSValue callFrames, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, bool returnByValue, bool generatePreview, bool saveResult, RefPtr<Protocol::Runtime::RemoteObject>* result, Protocol::OptOutput<bool>* wasThrown, Inspector::Protocol::OptOutput<int>* savedResultIndex);
+    void getFunctionDetails(ErrorString&, const String& functionId, RefPtr<Protocol::Debugger::FunctionDetails>* result);
+    void functionDetails(ErrorString&, JSC::JSValue, RefPtr<Protocol::Debugger::FunctionDetails>* result);
+    void getProperties(ErrorString&, const String& objectId, bool ownProperties, bool generatePreview, RefPtr<Protocol::Array<Protocol::Runtime::PropertyDescriptor>>* result);
+    void getDisplayableProperties(ErrorString&, const String& objectId, bool generatePreview, RefPtr<Protocol::Array<Protocol::Runtime::PropertyDescriptor>>* result);
+    void getInternalProperties(ErrorString&, const String& objectId, bool generatePreview, RefPtr<Protocol::Array<Protocol::Runtime::InternalPropertyDescriptor>>* result);
+    void getCollectionEntries(ErrorString&, const String& objectId, const String& objectGroup, int startIndex, int numberToFetch, RefPtr<Protocol::Array<Protocol::Runtime::CollectionEntry>>* entries);
+    void saveResult(ErrorString&, const String& callArgumentJSON, Inspector::Protocol::OptOutput<int>* savedResultIndex);
+
+    Ref<Protocol::Array<Protocol::Debugger::CallFrame>> wrapCallFrames(JSC::JSValue) const;
+    RefPtr<Protocol::Runtime::RemoteObject> wrapObject(JSC::JSValue, const String& groupName, bool generatePreview = false) const;
+    RefPtr<Protocol::Runtime::RemoteObject> wrapTable(JSC::JSValue table, JSC::JSValue columns) const;
+    RefPtr<Protocol::Runtime::ObjectPreview> previewValue(JSC::JSValue) const;
+
+    void setExceptionValue(JSC::JSValue);
+    void clearExceptionValue();
+
+    JSC::JSValue findObjectById(const String& objectId) const;
+    void inspectObject(JSC::JSValue);
+    void releaseObject(const String& objectId);
+    void releaseObjectGroup(const String& objectGroup);
+
+private:
+    friend class InjectedScriptModule;
+};
+
+} // namespace Inspector
diff --git a/inspector/InjectedScriptBase.cpp b/inspector/InjectedScriptBase.cpp
new file mode 100644
index 0000000..9caa4eb
--- /dev/null
+++ b/inspector/InjectedScriptBase.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptBase.h"
+
+#include "DebuggerEvalEnabler.h"
+#include "InspectorValues.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "ScriptFunctionCall.h"
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+InjectedScriptBase::InjectedScriptBase(const String& name)
+    : m_name(name)
+    , m_environment(nullptr)
+{
+}
+
+InjectedScriptBase::InjectedScriptBase(const String& name, Deprecated::ScriptObject injectedScriptObject, InspectorEnvironment* environment)
+    : m_name(name)
+    , m_injectedScriptObject(injectedScriptObject)
+    , m_environment(environment)
+{
+}
+
+InjectedScriptBase::~InjectedScriptBase()
+{
+}
+
+bool InjectedScriptBase::hasAccessToInspectedScriptState() const
+{
+    return m_environment && m_environment->canAccessInspectedScriptState(m_injectedScriptObject.scriptState());
+}
+
+const Deprecated::ScriptObject& InjectedScriptBase::injectedScriptObject() const
+{
+    return m_injectedScriptObject;
+}
+
+JSC::JSValue InjectedScriptBase::callFunctionWithEvalEnabled(Deprecated::ScriptFunctionCall& function, bool& hadException) const
+{
+    JSC::ExecState* scriptState = m_injectedScriptObject.scriptState();
+    JSC::DebuggerEvalEnabler evalEnabler(scriptState);
+    return function.call(hadException);
+}
+
+void InjectedScriptBase::makeCall(Deprecated::ScriptFunctionCall& function, RefPtr<InspectorValue>* result)
+{
+    if (hasNoValue() || !hasAccessToInspectedScriptState()) {
+        *result = InspectorValue::null();
+        return;
+    }
+
+    bool hadException = false;
+    auto resultValue = callFunctionWithEvalEnabled(function, hadException);
+
+    ASSERT(!hadException);
+    if (!hadException) {
+        *result = toInspectorValue(*m_injectedScriptObject.scriptState(), resultValue);
+        if (!*result)
+            *result = InspectorValue::create(String::format("Object has too long reference chain (must not be longer than %d)", InspectorValue::maxDepth));
+    } else
+        *result = InspectorValue::create("Exception while making a call.");
+}
+
+void InjectedScriptBase::makeEvalCall(ErrorString& errorString, Deprecated::ScriptFunctionCall& function, RefPtr<Protocol::Runtime::RemoteObject>* objectResult, Protocol::OptOutput<bool>* wasThrown, Protocol::OptOutput<int>* savedResultIndex)
+{
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    if (!result) {
+        errorString = ASCIILiteral("Internal error: result value is empty");
+        return;
+    }
+
+    if (result->type() == InspectorValue::Type::String) {
+        result->asString(errorString);
+        ASSERT(errorString.length());
+        return;
+    }
+
+    RefPtr<InspectorObject> resultTuple;
+    if (!result->asObject(resultTuple)) {
+        errorString = ASCIILiteral("Internal error: result is not an Object");
+        return;
+    }
+
+    RefPtr<InspectorObject> resultObject;
+    if (!resultTuple->getObject(ASCIILiteral("result"), resultObject)) {
+        errorString = ASCIILiteral("Internal error: result is not a pair of value and wasThrown flag");
+        return;
+    }
+
+    bool wasThrownValue = false;
+    if (!resultTuple->getBoolean(ASCIILiteral("wasThrown"), wasThrownValue)) {
+        errorString = ASCIILiteral("Internal error: result is not a pair of value and wasThrown flag");
+        return;
+    }
+
+    *objectResult = BindingTraits<Protocol::Runtime::RemoteObject>::runtimeCast(resultObject);
+    *wasThrown = wasThrownValue;
+
+    if (savedResultIndex) {
+        int savedIndex = 0;
+        if (resultTuple->getInteger(ASCIILiteral("savedResultIndex"), savedIndex))
+            *savedResultIndex = savedIndex;
+    }
+}
+
+} // namespace Inspector
+
diff --git a/inspector/InjectedScriptBase.h b/inspector/InjectedScriptBase.h
new file mode 100644
index 0000000..55dd0e5
--- /dev/null
+++ b/inspector/InjectedScriptBase.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorEnvironment.h"
+#include "InspectorProtocolObjects.h"
+#include "bindings/ScriptObject.h"
+#include <wtf/Forward.h>
+#include <wtf/RefPtr.h>
+
+namespace Deprecated {
+class ScriptFunctionCall;
+}
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+class JS_EXPORT_PRIVATE InjectedScriptBase {
+public:
+    virtual ~InjectedScriptBase();
+
+    const String& name() const { return m_name; }
+    bool hasNoValue() const { return m_injectedScriptObject.hasNoValue(); }
+    JSC::ExecState* scriptState() const { return m_injectedScriptObject.scriptState(); }
+
+protected:
+    InjectedScriptBase(const String& name);
+    InjectedScriptBase(const String& name, Deprecated::ScriptObject, InspectorEnvironment*);
+
+    InspectorEnvironment* inspectorEnvironment() const { return m_environment; }
+
+    bool hasAccessToInspectedScriptState() const;
+
+    const Deprecated::ScriptObject& injectedScriptObject() const;
+    JSC::JSValue callFunctionWithEvalEnabled(Deprecated::ScriptFunctionCall&, bool& hadException) const;
+    void makeCall(Deprecated::ScriptFunctionCall&, RefPtr<InspectorValue>* result);
+    void makeEvalCall(ErrorString&, Deprecated::ScriptFunctionCall&, RefPtr<Protocol::Runtime::RemoteObject>* result, Protocol::OptOutput<bool>* wasThrown, Protocol::OptOutput<int>* savedResult = nullptr);
+
+private:
+    String m_name;
+    Deprecated::ScriptObject m_injectedScriptObject;
+    InspectorEnvironment* m_environment;
+};
+
+} // namespace Inspector
diff --git a/inspector/InjectedScriptHost.cpp b/inspector/InjectedScriptHost.cpp
new file mode 100644
index 0000000..433174f
--- /dev/null
+++ b/inspector/InjectedScriptHost.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptHost.h"
+
+#include "JSCInlines.h"
+#include "JSInjectedScriptHost.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+InjectedScriptHost::~InjectedScriptHost()
+{
+}
+
+JSValue InjectedScriptHost::wrapper(ExecState* exec, JSGlobalObject* globalObject)
+{
+    JSValue value = m_wrappers.getWrapper(globalObject);
+    if (value)
+        return value;
+
+    JSObject* prototype = JSInjectedScriptHost::createPrototype(exec->vm(), globalObject);
+    Structure* structure = JSInjectedScriptHost::createStructure(exec->vm(), globalObject, prototype);
+    JSInjectedScriptHost* injectedScriptHost = JSInjectedScriptHost::create(exec->vm(), structure, makeRef(*this));
+    m_wrappers.addWrapper(globalObject, injectedScriptHost);
+
+    return injectedScriptHost;
+}
+
+void InjectedScriptHost::clearAllWrappers()
+{
+    m_wrappers.clearAllWrappers();
+}
+
+} // namespace Inspector
diff --git a/inspector/InjectedScriptHost.h b/inspector/InjectedScriptHost.h
new file mode 100644
index 0000000..d7713ed
--- /dev/null
+++ b/inspector/InjectedScriptHost.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValueInlines.h"
+#include "inspector/PerGlobalObjectWrapperWorld.h"
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
+
+namespace Inspector {
+
+class JS_EXPORT_PRIVATE InjectedScriptHost : public RefCounted<InjectedScriptHost> {
+public:
+    static Ref<InjectedScriptHost> create() { return adoptRef(*new InjectedScriptHost); }
+    virtual ~InjectedScriptHost();
+
+    virtual JSC::JSValue subtype(JSC::ExecState*, JSC::JSValue) { return JSC::jsUndefined(); }
+    virtual bool isHTMLAllCollection(JSC::JSValue) { return false; }
+
+    JSC::JSValue wrapper(JSC::ExecState*, JSC::JSGlobalObject*);
+    void clearAllWrappers();
+
+private:
+    PerGlobalObjectWrapperWorld m_wrappers;
+};
+
+} // namespace Inspector
diff --git a/inspector/InjectedScriptManager.cpp b/inspector/InjectedScriptManager.cpp
new file mode 100644
index 0000000..bbfe954
--- /dev/null
+++ b/inspector/InjectedScriptManager.cpp
@@ -0,0 +1,198 @@
+/*
+ * Copyright (C) 2007, 2008, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptManager.h"
+
+#include "Completion.h"
+#include "InjectedScriptHost.h"
+#include "InjectedScriptSource.h"
+#include "InspectorValues.h"
+#include "JSCInlines.h"
+#include "JSInjectedScriptHost.h"
+#include "JSLock.h"
+#include "ScriptObject.h"
+#include "SourceCode.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+InjectedScriptManager::InjectedScriptManager(InspectorEnvironment& environment, PassRefPtr<InjectedScriptHost> injectedScriptHost)
+    : m_environment(environment)
+    , m_injectedScriptHost(injectedScriptHost)
+    , m_nextInjectedScriptId(1)
+{
+}
+
+InjectedScriptManager::~InjectedScriptManager()
+{
+}
+
+void InjectedScriptManager::disconnect()
+{
+    discardInjectedScripts();
+}
+
+void InjectedScriptManager::discardInjectedScripts()
+{
+    m_injectedScriptHost->clearAllWrappers();
+    m_idToInjectedScript.clear();
+    m_scriptStateToId.clear();
+}
+
+InjectedScriptHost* InjectedScriptManager::injectedScriptHost()
+{
+    return m_injectedScriptHost.get();
+}
+
+InjectedScript InjectedScriptManager::injectedScriptForId(int id)
+{
+    auto it = m_idToInjectedScript.find(id);
+    if (it != m_idToInjectedScript.end())
+        return it->value;
+
+    for (auto it = m_scriptStateToId.begin(); it != m_scriptStateToId.end(); ++it) {
+        if (it->value == id)
+            return injectedScriptFor(it->key);
+    }
+
+    return InjectedScript();
+}
+
+int InjectedScriptManager::injectedScriptIdFor(ExecState* scriptState)
+{
+    auto it = m_scriptStateToId.find(scriptState);
+    if (it != m_scriptStateToId.end())
+        return it->value;
+
+    int id = m_nextInjectedScriptId++;
+    m_scriptStateToId.set(scriptState, id);
+    return id;
+}
+
+InjectedScript InjectedScriptManager::injectedScriptForObjectId(const String& objectId)
+{
+    RefPtr<InspectorValue> parsedObjectId;
+    if (!InspectorValue::parseJSON(objectId, parsedObjectId))
+        return InjectedScript();
+
+    RefPtr<InspectorObject> resultObject;
+    if (!parsedObjectId->asObject(resultObject))
+        return InjectedScript();
+
+    long injectedScriptId = 0;
+    if (!resultObject->getInteger(ASCIILiteral("injectedScriptId"), injectedScriptId))
+        return InjectedScript();
+
+    return m_idToInjectedScript.get(injectedScriptId);
+}
+
+void InjectedScriptManager::releaseObjectGroup(const String& objectGroup)
+{
+    for (auto& injectedScript : m_idToInjectedScript.values())
+        injectedScript.releaseObjectGroup(objectGroup);
+}
+
+void InjectedScriptManager::clearExceptionValue()
+{
+    for (auto& injectedScript : m_idToInjectedScript.values())
+        injectedScript.clearExceptionValue();
+}
+
+String InjectedScriptManager::injectedScriptSource()
+{
+    return StringImpl::createWithoutCopying(InjectedScriptSource_js, sizeof(InjectedScriptSource_js));
+}
+
+JSC::JSObject* InjectedScriptManager::createInjectedScript(const String& source, ExecState* scriptState, int id)
+{
+    VM& vm = scriptState->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    SourceCode sourceCode = makeSource(source);
+    JSGlobalObject* globalObject = scriptState->lexicalGlobalObject();
+    JSValue globalThisValue = scriptState->globalThisValue();
+
+    NakedPtr<Exception> evaluationException;
+    InspectorEvaluateHandler evaluateHandler = m_environment.evaluateHandler();
+    JSValue functionValue = evaluateHandler(scriptState, sourceCode, globalThisValue, evaluationException);
+    if (evaluationException)
+        return nullptr;
+
+    CallData callData;
+    CallType callType = getCallData(functionValue, callData);
+    if (callType == CallType::None)
+        return nullptr;
+
+    MarkedArgumentBuffer args;
+    args.append(m_injectedScriptHost->wrapper(scriptState, globalObject));
+    args.append(globalThisValue);
+    args.append(jsNumber(id));
+
+    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);
+    scope.clearException();
+    return result.getObject();
+}
+
+InjectedScript InjectedScriptManager::injectedScriptFor(ExecState* inspectedExecState)
+{
+    auto it = m_scriptStateToId.find(inspectedExecState);
+    if (it != m_scriptStateToId.end()) {
+        auto it1 = m_idToInjectedScript.find(it->value);
+        if (it1 != m_idToInjectedScript.end())
+            return it1->value;
+    }
+
+    if (!m_environment.canAccessInspectedScriptState(inspectedExecState))
+        return InjectedScript();
+
+    int id = injectedScriptIdFor(inspectedExecState);
+    auto injectedScriptObject = createInjectedScript(injectedScriptSource(), inspectedExecState, id);
+    if (!injectedScriptObject) {
+        WTFLogAlways("Failed to parse/execute InjectedScriptSource.js!");
+        WTFLogAlways("%s\n", injectedScriptSource().ascii().data());
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    InjectedScript result({ inspectedExecState, injectedScriptObject }, &m_environment);
+    m_idToInjectedScript.set(id, result);
+    didCreateInjectedScript(result);
+    return result;
+}
+
+void InjectedScriptManager::didCreateInjectedScript(const InjectedScript&)
+{
+    // Intentionally empty. This allows for subclasses to inject additional scripts.
+}
+
+} // namespace Inspector
+
diff --git a/inspector/InjectedScriptManager.h b/inspector/InjectedScriptManager.h
new file mode 100644
index 0000000..f1b7808
--- /dev/null
+++ b/inspector/InjectedScriptManager.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2007, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "InspectorEnvironment.h"
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/text/WTFString.h>
+
+namespace Deprecated {
+class ScriptObject;
+}
+
+namespace JSC {
+class ExecState;
+}
+
+namespace Inspector {
+
+class JS_EXPORT_PRIVATE InjectedScriptManager {
+    WTF_MAKE_NONCOPYABLE(InjectedScriptManager); WTF_MAKE_FAST_ALLOCATED;
+public:
+    InjectedScriptManager(InspectorEnvironment&, PassRefPtr<InjectedScriptHost>);
+    virtual ~InjectedScriptManager();
+
+    virtual void disconnect();
+    virtual void discardInjectedScripts();
+
+    InjectedScriptHost* injectedScriptHost();
+    InspectorEnvironment& inspectorEnvironment() const { return m_environment; }
+
+    InjectedScript injectedScriptFor(JSC::ExecState*);
+    InjectedScript injectedScriptForId(int);
+    int injectedScriptIdFor(JSC::ExecState*);
+    InjectedScript injectedScriptForObjectId(const String& objectId);
+    void releaseObjectGroup(const String& objectGroup);
+    void clearExceptionValue();
+
+protected:
+    virtual void didCreateInjectedScript(const InjectedScript&);
+
+    HashMap<int, InjectedScript> m_idToInjectedScript;
+    HashMap<JSC::ExecState*, int> m_scriptStateToId;
+
+private:
+    String injectedScriptSource();
+    JSC::JSObject* createInjectedScript(const String& source, JSC::ExecState*, int id);
+
+    InspectorEnvironment& m_environment;
+    RefPtr<InjectedScriptHost> m_injectedScriptHost;
+    int m_nextInjectedScriptId;
+};
+
+} // namespace Inspector
diff --git a/inspector/InjectedScriptModule.cpp b/inspector/InjectedScriptModule.cpp
new file mode 100644
index 0000000..7e05fc9
--- /dev/null
+++ b/inspector/InjectedScriptModule.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptModule.h"
+
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+
+namespace Inspector {
+
+InjectedScriptModule::InjectedScriptModule(const String& name)
+    : InjectedScriptBase(name)
+{
+}
+
+InjectedScriptModule::~InjectedScriptModule()
+{
+}
+
+void InjectedScriptModule::ensureInjected(InjectedScriptManager* injectedScriptManager, JSC::ExecState* scriptState)
+{
+    InjectedScript injectedScript = injectedScriptManager->injectedScriptFor(scriptState);
+    ensureInjected(injectedScriptManager, injectedScript);
+}
+
+void InjectedScriptModule::ensureInjected(InjectedScriptManager* injectedScriptManager, const InjectedScript& injectedScript)
+{
+    ASSERT(!injectedScript.hasNoValue());
+    if (injectedScript.hasNoValue())
+        return;
+
+    // FIXME: Make the InjectedScript a module itself.
+    JSC::JSLockHolder locker(injectedScript.scriptState());
+    Deprecated::ScriptFunctionCall function(injectedScript.injectedScriptObject(), ASCIILiteral("module"), injectedScriptManager->inspectorEnvironment().functionCallHandler());
+    function.appendArgument(name());
+    bool hadException = false;
+    auto resultValue = injectedScript.callFunctionWithEvalEnabled(function, hadException);
+    ASSERT(!hadException);
+    if (hadException || !resultValue || !resultValue.isObject()) {
+        Deprecated::ScriptFunctionCall function(injectedScript.injectedScriptObject(), ASCIILiteral("injectModule"), injectedScriptManager->inspectorEnvironment().functionCallHandler());
+        function.appendArgument(name());
+        function.appendArgument(source());
+        function.appendArgument(host(injectedScriptManager, injectedScript.scriptState()));
+        resultValue = injectedScript.callFunctionWithEvalEnabled(function, hadException);
+        if (hadException) {
+            ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+}
+
+} // namespace Inspector
diff --git a/inspector/InjectedScriptModule.h b/inspector/InjectedScriptModule.h
new file mode 100644
index 0000000..1efc0ac
--- /dev/null
+++ b/inspector/InjectedScriptModule.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InjectedScriptBase.h"
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+class JSValue;
+}
+
+namespace Inspector {
+
+class InjectedScript;
+class InjectedScriptManager;
+
+class JS_EXPORT_PRIVATE InjectedScriptModule : public InjectedScriptBase {
+public:
+    virtual ~InjectedScriptModule();
+    virtual String source() const = 0;
+    virtual JSC::JSValue host(InjectedScriptManager*, JSC::ExecState*) const = 0;
+
+protected:
+    // Do not expose constructor in the child classes as well. Instead provide
+    // a static factory method that would create a new instance of the class
+    // and call its ensureInjected() method immediately.
+    explicit InjectedScriptModule(const String& name);
+    void ensureInjected(InjectedScriptManager*, JSC::ExecState*);
+    void ensureInjected(InjectedScriptManager*, const InjectedScript&);
+};
+
+} // namespace Inspector
diff --git a/inspector/InjectedScriptSource.js b/inspector/InjectedScriptSource.js
new file mode 100644
index 0000000..c9a515f
--- /dev/null
+++ b/inspector/InjectedScriptSource.js
@@ -0,0 +1,1396 @@
+/*
+ * Copyright (C) 2007, 2014-2015 Apple Inc.  All rights reserved.
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+//# sourceURL=__InjectedScript_InjectedScriptSource.js
+
+(function (InjectedScriptHost, inspectedGlobalObject, injectedScriptId) {
+
+// FIXME: <https://webkit.org/b/152294> Web Inspector: Parse InjectedScriptSource as a built-in to get guaranteed non-user-overriden built-ins
+
+var Object = {}.constructor;
+
+function toString(obj)
+{
+    return String(obj);
+}
+
+function toStringDescription(obj)
+{
+    if (obj === 0 && 1 / obj < 0)
+        return "-0";
+
+    return toString(obj);
+}
+
+function isUInt32(obj)
+{
+    if (typeof obj === "number")
+        return obj >>> 0 === obj && (obj > 0 || 1 / obj > 0);
+    return "" + (obj >>> 0) === obj;
+}
+
+function isSymbol(obj)
+{
+    return typeof obj === "symbol";
+}
+
+function isEmptyObject(object)
+{
+    for (let key in object)
+        return false;
+    return true;
+}
+
+var InjectedScript = function()
+{
+    this._lastBoundObjectId = 1;
+    this._idToWrappedObject = {};
+    this._idToObjectGroupName = {};
+    this._objectGroups = {};
+    this._modules = {};
+    this._nextSavedResultIndex = 1;
+    this._savedResults = [];
+}
+
+InjectedScript.primitiveTypes = {
+    undefined: true,
+    boolean: true,
+    number: true,
+    string: true,
+}
+
+InjectedScript.CollectionMode = {
+    OwnProperties: 1 << 0,          // own properties.
+    NativeGetterProperties: 1 << 1, // native getter properties in the prototype chain.
+    AllProperties: 1 << 2,          // all properties in the prototype chain.
+}
+
+InjectedScript.prototype = {
+    isPrimitiveValue: function(object)
+    {
+        // FIXME(33716): typeof document.all is always 'undefined'.
+        return InjectedScript.primitiveTypes[typeof object] && !this._isHTMLAllCollection(object);
+    },
+
+    previewValue: function(value)
+    {
+        return InjectedScript.RemoteObject.createObjectPreviewForValue(value, true);
+    },
+
+    functionDetails: function(func, previewOnly)
+    {
+        var details = InjectedScriptHost.functionDetails(func);
+        if (!details)
+            return "Cannot resolve function details.";
+
+        // FIXME: provide function scope data in "scopesRaw" property when JSC supports it.
+        // <https://webkit.org/b/87192> [JSC] expose function (closure) inner context to debugger
+        if ("rawScopes" in details) {
+            if (previewOnly)
+                delete details.rawScopes;
+            else {
+                var objectGroupName = this._idToObjectGroupName[parsedFunctionId.id];
+                var rawScopes = details.rawScopes;
+                var scopes = [];
+                delete details.rawScopes;
+                for (var i = 0; i < rawScopes.length; i++)
+                    scopes.push(InjectedScript.CallFrameProxy._createScopeJson(rawScopes[i].type, rawScopes[i].object, objectGroupName));
+                details.scopeChain = scopes;
+            }
+        }
+
+        return details;
+    },
+
+    wrapObject: function(object, groupName, canAccessInspectedGlobalObject, generatePreview)
+    {
+        if (canAccessInspectedGlobalObject)
+            return this._wrapObject(object, groupName, false, generatePreview);
+        return this._fallbackWrapper(object);
+    },
+
+    setExceptionValue: function(value)
+    {
+        this._exceptionValue = value;
+    },
+
+    clearExceptionValue: function()
+    {
+        delete this._exceptionValue;
+    },
+
+    _fallbackWrapper: function(object)
+    {
+        var result = {};
+        result.type = typeof object;
+        if (this.isPrimitiveValue(object))
+            result.value = object;
+        else
+            result.description = toString(object);
+        return result;
+    },
+
+    wrapTable: function(canAccessInspectedGlobalObject, table, columns)
+    {
+        if (!canAccessInspectedGlobalObject)
+            return this._fallbackWrapper(table);
+
+        // FIXME: Currently columns are ignored. Instead, the frontend filters all
+        // properties based on the provided column names and in the provided order.
+        // Should we filter here too?
+
+        var columnNames = null;
+        if (typeof columns === "string")
+            columns = [columns];
+
+        if (InjectedScriptHost.subtype(columns) === "array") {
+            columnNames = [];
+            for (var i = 0; i < columns.length; ++i)
+                columnNames.push(toString(columns[i]));
+        }
+
+        return this._wrapObject(table, "console", false, true, columnNames);
+    },
+
+    inspectObject: function(object)
+    {
+        if (this._commandLineAPIImpl)
+            this._commandLineAPIImpl.inspect(object);
+    },
+
+    _wrapObject: function(object, objectGroupName, forceValueType, generatePreview, columnNames)
+    {
+        try {
+            return new InjectedScript.RemoteObject(object, objectGroupName, forceValueType, generatePreview, columnNames);
+        } catch (e) {
+            try {
+                var description = injectedScript._describe(e);
+            } catch (ex) {
+                var description = "<failed to convert exception to string>";
+            }
+            return new InjectedScript.RemoteObject(description);
+        }
+    },
+
+    _bind: function(object, objectGroupName)
+    {
+        var id = this._lastBoundObjectId++;
+        this._idToWrappedObject[id] = object;
+        var objectId = "{\"injectedScriptId\":" + injectedScriptId + ",\"id\":" + id + "}";
+        if (objectGroupName) {
+            var group = this._objectGroups[objectGroupName];
+            if (!group) {
+                group = [];
+                this._objectGroups[objectGroupName] = group;
+            }
+            group.push(id);
+            this._idToObjectGroupName[id] = objectGroupName;
+        }
+        return objectId;
+    },
+
+    _parseObjectId: function(objectId)
+    {
+        return InjectedScriptHost.evaluate("(" + objectId + ")");
+    },
+
+    releaseObjectGroup: function(objectGroupName)
+    {
+        if (objectGroupName === "console") {
+            delete this._lastResult;
+            this._nextSavedResultIndex = 1;
+            this._savedResults = [];
+        }
+
+        var group = this._objectGroups[objectGroupName];
+        if (!group)
+            return;
+
+        for (var i = 0; i < group.length; i++)
+            this._releaseObject(group[i]);
+
+        delete this._objectGroups[objectGroupName];
+    },
+
+    dispatch: function(methodName, args)
+    {
+        var argsArray = InjectedScriptHost.evaluate("(" + args + ")");
+        var result = this[methodName].apply(this, argsArray);
+        if (typeof result === "undefined") {
+            if (inspectedGlobalObject.console)
+                inspectedGlobalObject.console.error("Web Inspector error: InjectedScript.%s returns undefined", methodName);
+            result = null;
+        }
+        return result;
+    },
+
+    _getProperties: function(objectId, collectionMode, generatePreview, nativeGettersAsValues)
+    {
+        var parsedObjectId = this._parseObjectId(objectId);
+        var object = this._objectForId(parsedObjectId);
+        var objectGroupName = this._idToObjectGroupName[parsedObjectId.id];
+
+        if (!this._isDefined(object))
+            return false;
+
+        if (isSymbol(object))
+            return false;
+
+        var descriptors = this._propertyDescriptors(object, collectionMode, nativeGettersAsValues);
+
+        // Go over properties, wrap object values.
+        for (var i = 0; i < descriptors.length; ++i) {
+            var descriptor = descriptors[i];
+            if ("get" in descriptor)
+                descriptor.get = this._wrapObject(descriptor.get, objectGroupName);
+            if ("set" in descriptor)
+                descriptor.set = this._wrapObject(descriptor.set, objectGroupName);
+            if ("value" in descriptor)
+                descriptor.value = this._wrapObject(descriptor.value, objectGroupName, false, generatePreview);
+            if (!("configurable" in descriptor))
+                descriptor.configurable = false;
+            if (!("enumerable" in descriptor))
+                descriptor.enumerable = false;
+            if ("symbol" in descriptor)
+                descriptor.symbol = this._wrapObject(descriptor.symbol, objectGroupName);
+        }
+
+        return descriptors;
+    },
+
+    getProperties: function(objectId, ownProperties, generatePreview)
+    {
+        var nativeGettersAsValues = false;
+        var collectionMode = ownProperties ? InjectedScript.CollectionMode.OwnProperties : InjectedScript.CollectionMode.AllProperties;
+        return this._getProperties(objectId, collectionMode, generatePreview, nativeGettersAsValues);
+    },
+
+    getDisplayableProperties: function(objectId, generatePreview)
+    {
+        var nativeGettersAsValues = true;
+        var collectionMode = InjectedScript.CollectionMode.OwnProperties | InjectedScript.CollectionMode.NativeGetterProperties;
+        return this._getProperties(objectId, collectionMode, generatePreview, nativeGettersAsValues);
+    },
+
+    getInternalProperties: function(objectId, generatePreview)
+    {
+        var parsedObjectId = this._parseObjectId(objectId);
+        var object = this._objectForId(parsedObjectId);
+        var objectGroupName = this._idToObjectGroupName[parsedObjectId.id];
+
+        if (!this._isDefined(object))
+            return false;
+
+        if (isSymbol(object))
+            return false;
+
+        var descriptors = this._internalPropertyDescriptors(object);
+        if (!descriptors)
+            return [];
+
+        // Go over properties, wrap object values.
+        for (var i = 0; i < descriptors.length; ++i) {
+            var descriptor = descriptors[i];
+            if ("value" in descriptor)
+                descriptor.value = this._wrapObject(descriptor.value, objectGroupName, false, generatePreview);
+        }
+
+        return descriptors;
+    },
+
+    getCollectionEntries: function(objectId, objectGroupName, startIndex, numberToFetch)
+    {
+        var parsedObjectId = this._parseObjectId(objectId);
+        var object = this._objectForId(parsedObjectId);
+        var objectGroupName = objectGroupName || this._idToObjectGroupName[parsedObjectId.id];
+
+        if (!this._isDefined(object))
+            return;
+
+        if (typeof object !== "object")
+            return;
+
+        var entries = this._entries(object, InjectedScriptHost.subtype(object), startIndex, numberToFetch);
+        return entries.map(function(entry) {
+            entry.value = injectedScript._wrapObject(entry.value, objectGroupName, false, true);
+            if ("key" in entry)
+                entry.key = injectedScript._wrapObject(entry.key, objectGroupName, false, true);
+            return entry;
+        });
+    },
+
+    saveResult: function(callArgumentJSON)
+    {
+        this._savedResultIndex = 0;
+
+        try {
+            var callArgument = InjectedScriptHost.evaluate("(" + callArgumentJSON + ")");
+            var value = this._resolveCallArgument(callArgument);
+            this._saveResult(value);
+        } catch (e) {}
+
+        return this._savedResultIndex;
+    },
+
+    getFunctionDetails: function(functionId)
+    {
+        var parsedFunctionId = this._parseObjectId(functionId);
+        var func = this._objectForId(parsedFunctionId);
+        if (typeof func !== "function")
+            return "Cannot resolve function by id.";
+        return injectedScript.functionDetails(func);
+    },
+
+    releaseObject: function(objectId)
+    {
+        var parsedObjectId = this._parseObjectId(objectId);
+        this._releaseObject(parsedObjectId.id);
+    },
+
+    _releaseObject: function(id)
+    {
+        delete this._idToWrappedObject[id];
+        delete this._idToObjectGroupName[id];
+    },
+
+    evaluate: function(expression, objectGroup, injectCommandLineAPI, returnByValue, generatePreview, saveResult)
+    {
+        return this._evaluateAndWrap(InjectedScriptHost.evaluateWithScopeExtension, InjectedScriptHost, expression, objectGroup, false, injectCommandLineAPI, returnByValue, generatePreview, saveResult);
+    },
+
+    callFunctionOn: function(objectId, expression, args, returnByValue, generatePreview)
+    {
+        var parsedObjectId = this._parseObjectId(objectId);
+        var object = this._objectForId(parsedObjectId);
+        if (!this._isDefined(object))
+            return "Could not find object with given id";
+
+        if (args) {
+            var resolvedArgs = [];
+            var callArgs = InjectedScriptHost.evaluate(args);
+            for (var i = 0; i < callArgs.length; ++i) {
+                try {
+                    resolvedArgs[i] = this._resolveCallArgument(callArgs[i]);
+                } catch (e) {
+                    return String(e);
+                }
+            }
+        }
+
+        try {
+            var objectGroup = this._idToObjectGroupName[parsedObjectId.id];
+            var func = InjectedScriptHost.evaluate("(" + expression + ")");
+            if (typeof func !== "function")
+                return "Given expression does not evaluate to a function";
+
+            return {
+                wasThrown: false,
+                result: this._wrapObject(func.apply(object, resolvedArgs), objectGroup, returnByValue, generatePreview)
+            };
+        } catch (e) {
+            return this._createThrownValue(e, objectGroup);
+        }
+    },
+
+    _resolveCallArgument: function(callArgumentJSON)
+    {
+        if ("value" in callArgumentJSON)
+            return callArgumentJSON.value;
+
+        var objectId = callArgumentJSON.objectId;
+        if (objectId) {
+            var parsedArgId = this._parseObjectId(objectId);
+            if (!parsedArgId || parsedArgId["injectedScriptId"] !== injectedScriptId)
+                throw "Arguments should belong to the same JavaScript world as the target object.";
+
+            var resolvedArg = this._objectForId(parsedArgId);
+            if (!this._isDefined(resolvedArg))
+                throw "Could not find object with given id";
+
+            return resolvedArg;
+        }
+
+        return undefined;
+    },
+
+    _evaluateAndWrap: function(evalFunction, object, expression, objectGroup, isEvalOnCallFrame, injectCommandLineAPI, returnByValue, generatePreview, saveResult)
+    {
+        try {
+            this._savedResultIndex = 0;
+
+            var returnObject = {
+                wasThrown: false,
+                result: this._wrapObject(this._evaluateOn(evalFunction, object, objectGroup, expression, isEvalOnCallFrame, injectCommandLineAPI, saveResult), objectGroup, returnByValue, generatePreview)
+            };
+
+            if (saveResult && this._savedResultIndex)
+                returnObject.savedResultIndex = this._savedResultIndex;
+
+            return returnObject;
+        } catch (e) {
+            return this._createThrownValue(e, objectGroup);
+        }
+    },
+
+    _createThrownValue: function(value, objectGroup)
+    {
+        var remoteObject = this._wrapObject(value, objectGroup);
+        try {
+            remoteObject.description = toStringDescription(value);
+        } catch (e) {}
+        return {
+            wasThrown: true,
+            result: remoteObject
+        };
+    },
+
+    _evaluateOn: function(evalFunction, object, objectGroup, expression, isEvalOnCallFrame, injectCommandLineAPI, saveResult)
+    {
+        var commandLineAPI = null;
+        if (injectCommandLineAPI) {
+            if (this.CommandLineAPI)
+                commandLineAPI = new this.CommandLineAPI(this._commandLineAPIImpl, isEvalOnCallFrame ? object : null);
+            else
+                commandLineAPI = new BasicCommandLineAPI(isEvalOnCallFrame ? object : null);
+        }
+
+        var result = evalFunction.call(object, expression, commandLineAPI);        
+        if (saveResult)
+            this._saveResult(result);
+        return result;
+    },
+
+    wrapCallFrames: function(callFrame)
+    {
+        if (!callFrame)
+            return false;
+
+        var result = [];
+        var depth = 0;
+        do {
+            result.push(new InjectedScript.CallFrameProxy(depth++, callFrame));
+            callFrame = callFrame.caller;
+        } while (callFrame);
+        return result;
+    },
+
+    evaluateOnCallFrame: function(topCallFrame, callFrameId, expression, objectGroup, injectCommandLineAPI, returnByValue, generatePreview, saveResult)
+    {
+        var callFrame = this._callFrameForId(topCallFrame, callFrameId);
+        if (!callFrame)
+            return "Could not find call frame with given id";
+        return this._evaluateAndWrap(callFrame.evaluateWithScopeExtension, callFrame, expression, objectGroup, true, injectCommandLineAPI, returnByValue, generatePreview, saveResult);
+    },
+
+    _callFrameForId: function(topCallFrame, callFrameId)
+    {
+        var parsedCallFrameId = InjectedScriptHost.evaluate("(" + callFrameId + ")");
+        var ordinal = parsedCallFrameId["ordinal"];
+        var callFrame = topCallFrame;
+        while (--ordinal >= 0 && callFrame)
+            callFrame = callFrame.caller;
+        return callFrame;
+    },
+
+    _objectForId: function(objectId)
+    {
+        return this._idToWrappedObject[objectId.id];
+    },
+
+    findObjectById: function(objectId)
+    {
+        var parsedObjectId = this._parseObjectId(objectId);
+        return this._objectForId(parsedObjectId);
+    },
+
+    module: function(name)
+    {
+        return this._modules[name];
+    },
+
+    injectModule: function(name, source, host)
+    {
+        delete this._modules[name];
+
+        var moduleFunction = InjectedScriptHost.evaluate("(" + source + ")");
+        if (typeof moduleFunction !== "function") {
+            if (inspectedGlobalObject.console)
+                inspectedGlobalObject.console.error("Web Inspector error: A function was expected for module %s evaluation", name);
+            return null;
+        }
+
+        var module = moduleFunction.call(inspectedGlobalObject, InjectedScriptHost, inspectedGlobalObject, injectedScriptId, this, host);
+        this._modules[name] = module;
+        return module;
+    },
+
+    _internalPropertyDescriptors: function(object, completeDescriptor)
+    {
+        var internalProperties = InjectedScriptHost.getInternalProperties(object);
+        if (!internalProperties)
+            return null;
+
+        var descriptors = [];
+        for (var i = 0; i < internalProperties.length; i++) {
+            var property = internalProperties[i];
+            var descriptor = {name: property.name, value: property.value};
+            if (completeDescriptor) {
+                descriptor.writable = false;
+                descriptor.configurable = false;
+                descriptor.enumerable = false;
+                descriptor.isOwn = true;
+            }
+            descriptors.push(descriptor);
+        }
+        return descriptors;
+    },
+
+    _propertyDescriptors: function(object, collectionMode, nativeGettersAsValues)
+    {
+        if (InjectedScriptHost.subtype(object) === "proxy")
+            return [];
+
+        var descriptors = [];
+        var nameProcessed = new Set;
+
+        function createFakeValueDescriptor(name, symbol, descriptor, isOwnProperty, possibleNativeBindingGetter)
+        {
+            try {
+                var descriptor = {name, value: object[name], writable: descriptor.writable || false, configurable: descriptor.configurable || false, enumerable: descriptor.enumerable || false};
+                if (possibleNativeBindingGetter)
+                    descriptor.nativeGetter = true;
+                if (isOwnProperty)
+                    descriptor.isOwn = true;
+                if (symbol)
+                    descriptor.symbol = symbol;
+                return descriptor;
+            } catch (e) {
+                var errorDescriptor = {name, value: e, wasThrown: true};
+                if (isOwnProperty)
+                    errorDescriptor.isOwn = true;
+                if (symbol)
+                    errorDescriptor.symbol = symbol;
+                return errorDescriptor;
+            }
+        }
+
+        function processDescriptor(descriptor, isOwnProperty, possibleNativeBindingGetter)
+        {
+            // All properties.
+            if (collectionMode & InjectedScript.CollectionMode.AllProperties) {
+                descriptors.push(descriptor);
+                return;
+            }
+
+            // Own properties.
+            if (collectionMode & InjectedScript.CollectionMode.OwnProperties && isOwnProperty) {
+                descriptors.push(descriptor);
+                return;
+            }
+
+            // Native Getter properties.
+            if (collectionMode & InjectedScript.CollectionMode.NativeGetterProperties) {
+                if (possibleNativeBindingGetter) {
+                    descriptors.push(descriptor);
+                    return;
+                }
+            }
+        }
+
+        function processProperties(o, properties, isOwnProperty)
+        {
+            for (var i = 0; i < properties.length; ++i) {
+                var property = properties[i];
+                if (nameProcessed.has(property) || property === "__proto__")
+                    continue;
+
+                nameProcessed.add(property);
+
+                var name = toString(property);
+                var symbol = isSymbol(property) ? property : null;
+
+                var descriptor = Object.getOwnPropertyDescriptor(o, property);
+                if (!descriptor) {
+                    // FIXME: Bad descriptor. Can we get here?
+                    // Fall back to very restrictive settings.
+                    var fakeDescriptor = createFakeValueDescriptor(name, symbol, {writable: false, configurable: false, enumerable: false}, isOwnProperty);
+                    processDescriptor(fakeDescriptor, isOwnProperty);
+                    continue;
+                }
+
+                if (nativeGettersAsValues) {
+                    if (String(descriptor.get).endsWith("[native code]\n}") || (!descriptor.get && descriptor.hasOwnProperty("get") && !descriptor.set && descriptor.hasOwnProperty("set"))) {
+                        // Developers may create such a descriptor, so we should be resilient:
+                        // var x = {}; Object.defineProperty(x, "p", {get:undefined}); Object.getOwnPropertyDescriptor(x, "p")
+                        var fakeDescriptor = createFakeValueDescriptor(name, symbol, descriptor, isOwnProperty, true);
+                        processDescriptor(fakeDescriptor, isOwnProperty, true);
+                        continue;
+                    }
+                }
+
+                descriptor.name = name;
+                if (isOwnProperty)
+                    descriptor.isOwn = true;
+                if (symbol)
+                    descriptor.symbol = symbol;
+                processDescriptor(descriptor, isOwnProperty);
+            }
+        }
+
+        function arrayIndexPropertyNames(o, length)
+        {
+            var array = [];
+            for (var i = 0; i < length; ++i) {
+                if (i in o)
+                    array.push("" + i);
+            }
+            return array;
+        }
+
+        // FIXME: <https://webkit.org/b/143589> Web Inspector: Better handling for large collections in Object Trees
+        // For array types with a large length we attempt to skip getOwnPropertyNames and instead just sublist of indexes.
+        var isArrayLike = false;
+        try {
+            isArrayLike = injectedScript._subtype(object) === "array" && isFinite(object.length) && object.length > 0;
+        } catch(e) {}
+
+        for (var o = object; this._isDefined(o); o = Object.getPrototypeOf(o)) {
+            var isOwnProperty = o === object;
+
+            if (isArrayLike && isOwnProperty)
+                processProperties(o, arrayIndexPropertyNames(o, Math.min(object.length, 100)), isOwnProperty);
+            else {
+                processProperties(o, Object.getOwnPropertyNames(o), isOwnProperty);
+                if (Object.getOwnPropertySymbols)
+                    processProperties(o, Object.getOwnPropertySymbols(o), isOwnProperty);
+            }
+
+            if (collectionMode === InjectedScript.CollectionMode.OwnProperties)
+                break;
+        }
+
+        // Always include __proto__ at the end.
+        try {
+            if (object.__proto__)
+                descriptors.push({name: "__proto__", value: object.__proto__, writable: true, configurable: true, enumerable: false, isOwn: true});
+        } catch (e) {}
+
+        return descriptors;
+    },
+
+    _isDefined: function(object)
+    {
+        return !!object || this._isHTMLAllCollection(object);
+    },
+
+    _isHTMLAllCollection: function(object)
+    {
+        // document.all is reported as undefined, but we still want to process it.
+        return (typeof object === "undefined") && InjectedScriptHost.isHTMLAllCollection(object);
+    },
+
+    _subtype: function(obj)
+    {
+        if (obj === null)
+            return "null";
+
+        if (this.isPrimitiveValue(obj) || isSymbol(obj))
+            return null;
+
+        if (this._isHTMLAllCollection(obj))
+            return "array";
+
+        var preciseType = InjectedScriptHost.subtype(obj);
+        if (preciseType)
+            return preciseType;
+
+        // FireBug's array detection.
+        try {
+            if (typeof obj.splice === "function" && isFinite(obj.length))
+                return "array";
+        } catch (e) {}
+
+        return null;
+    },
+
+    _classPreview: function(classConstructorValue)
+    {
+        return "class " + classConstructorValue.name;
+    },
+
+    _nodePreview: function(node)
+    {
+        var isXMLDocument = node.ownerDocument && !!node.ownerDocument.xmlVersion;
+        var nodeName = isXMLDocument ? node.nodeName : node.nodeName.toLowerCase();
+
+        switch (node.nodeType) {
+        case 1: // Node.ELEMENT_NODE
+            if (node.id)
+                return "<" + nodeName + " id=\"" + node.id + "\">";
+            if (node.classList.length)
+                return "<" + nodeName + " class=\"" + node.classList.toString().replace(/\s+/, " ") + "\">";
+            if (nodeName === "input" && node.type)
+                return "<" + nodeName + " type=\"" + node.type + "\">";
+            return "<" + nodeName + ">";
+
+        case 3: // Node.TEXT_NODE
+            return nodeName + " \"" + node.nodeValue + "\"";
+
+        case 8: // Node.COMMENT_NODE
+            return "<!--" + node.nodeValue + "-->";
+
+        case 10: // Node.DOCUMENT_TYPE_NODE
+            return "<!DOCTYPE " + nodeName + ">";
+
+        default:
+            return nodeName;
+        }
+    },
+
+    _describe: function(obj)
+    {
+        if (this.isPrimitiveValue(obj))
+            return null;
+
+        if (isSymbol(obj))
+            return toString(obj);
+
+        var subtype = this._subtype(obj);
+
+        if (subtype === "regexp")
+            return toString(obj);
+
+        if (subtype === "date")
+            return toString(obj);
+
+        if (subtype === "error")
+            return toString(obj);
+
+        if (subtype === "proxy")
+            return "Proxy";
+
+        if (subtype === "node")
+            return this._nodePreview(obj);
+
+        var className = InjectedScriptHost.internalConstructorName(obj);
+        if (subtype === "array")
+            return className;
+
+        if (subtype === "iterator" && Symbol.toStringTag in obj)
+            return obj[Symbol.toStringTag];
+
+        // NodeList in JSC is a function, check for array prior to this.
+        if (typeof obj === "function")
+            return obj.toString();
+
+        // If Object, try for a better name from the constructor.
+        if (className === "Object") {
+            var constructorName = obj.constructor && obj.constructor.name;
+            if (constructorName)
+                return constructorName;
+        }
+
+        return className;
+    },
+
+    _getSetEntries: function(object, skip, numberToFetch)
+    {
+        var entries = [];
+
+        for (var value of object) {
+            if (skip > 0) {
+                skip--;
+                continue;
+            }
+
+            entries.push({value});
+
+            if (numberToFetch && entries.length === numberToFetch)
+                break;
+        }
+
+        return entries;
+    },
+
+    _getMapEntries: function(object, skip, numberToFetch)
+    {
+        var entries = [];
+
+        for (var [key, value] of object) {
+            if (skip > 0) {
+                skip--;
+                continue;
+            }
+
+            entries.push({key, value});
+
+            if (numberToFetch && entries.length === numberToFetch)
+                break;
+        }
+
+        return entries;
+    },
+
+    _getWeakMapEntries: function(object, numberToFetch)
+    {
+        return InjectedScriptHost.weakMapEntries(object, numberToFetch);
+    },
+
+    _getWeakSetEntries: function(object, numberToFetch)
+    {
+        return InjectedScriptHost.weakSetEntries(object, numberToFetch);
+    },
+
+    _getIteratorEntries: function(object, numberToFetch)
+    {
+        return InjectedScriptHost.iteratorEntries(object, numberToFetch);
+    },
+
+    _entries: function(object, subtype, startIndex, numberToFetch)
+    {
+        if (subtype === "set")
+            return this._getSetEntries(object, startIndex, numberToFetch);
+        if (subtype === "map")
+            return this._getMapEntries(object, startIndex, numberToFetch);
+        if (subtype === "weakmap")
+            return this._getWeakMapEntries(object, numberToFetch);
+        if (subtype === "weakset")
+            return this._getWeakSetEntries(object, numberToFetch);
+        if (subtype === "iterator")
+            return this._getIteratorEntries(object, numberToFetch);
+
+        throw "unexpected type";
+    },
+
+    _saveResult: function(result)
+    {
+        this._lastResult = result;
+
+        if (result === undefined || result === null)
+            return;
+
+        var existingIndex = this._savedResults.indexOf(result);
+        if (existingIndex !== -1) {
+            this._savedResultIndex = existingIndex;
+            return;
+        }
+
+        this._savedResultIndex = this._nextSavedResultIndex;
+        this._savedResults[this._nextSavedResultIndex++] = result;
+
+        // $n is limited from $1-$99. $0 is special.
+        if (this._nextSavedResultIndex >= 100)
+            this._nextSavedResultIndex = 1;
+    },
+
+    _savedResult: function(index)
+    {
+        return this._savedResults[index];
+    }
+}
+
+var injectedScript = new InjectedScript;
+
+
+InjectedScript.RemoteObject = function(object, objectGroupName, forceValueType, generatePreview, columnNames)
+{
+    this.type = typeof object;
+
+    if (this.type === "undefined" && injectedScript._isHTMLAllCollection(object))
+        this.type = "object";
+
+    if (injectedScript.isPrimitiveValue(object) || object === null || forceValueType) {
+        // We don't send undefined values over JSON.
+        if (this.type !== "undefined")
+            this.value = object;
+
+        // Null object is object with 'null' subtype.
+        if (object === null)
+            this.subtype = "null";
+
+        // Provide user-friendly number values.
+        if (this.type === "number")
+            this.description = toStringDescription(object);
+        return;
+    }
+
+    this.objectId = injectedScript._bind(object, objectGroupName);
+
+    var subtype = injectedScript._subtype(object);
+    if (subtype)
+        this.subtype = subtype;
+
+    this.className = InjectedScriptHost.internalConstructorName(object);
+    this.description = injectedScript._describe(object);
+
+    if (subtype === "array")
+        this.size = typeof object.length === "number" ? object.length : 0;
+    else if (subtype === "set" || subtype === "map")
+        this.size = object.size;
+    else if (subtype === "weakmap")
+        this.size = InjectedScriptHost.weakMapSize(object);
+    else if (subtype === "weakset")
+        this.size = InjectedScriptHost.weakSetSize(object);
+    else if (subtype === "class") {
+        this.classPrototype = injectedScript._wrapObject(object.prototype, objectGroupName);
+        this.className = object.name;
+    }
+
+    if (generatePreview && this.type === "object") {
+        if (subtype === "proxy") {
+            this.preview = this._generatePreview(InjectedScriptHost.proxyTargetValue(object));
+            this.preview.lossless = false;
+        } else
+            this.preview = this._generatePreview(object, undefined, columnNames);
+    }
+};
+
+InjectedScript.RemoteObject.createObjectPreviewForValue = function(value, generatePreview)
+{
+    var remoteObject = new InjectedScript.RemoteObject(value, undefined, false, generatePreview, undefined);
+    if (remoteObject.objectId)
+        injectedScript.releaseObject(remoteObject.objectId);
+    if (remoteObject.classPrototype && remoteObject.classPrototype.objectId)
+        injectedScript.releaseObject(remoteObject.classPrototype.objectId);
+    return remoteObject.preview || remoteObject._emptyPreview();
+};
+
+InjectedScript.RemoteObject.prototype = {
+    _initialPreview: function()
+    {
+        var preview = {
+            type: this.type,
+            description: this.description || toString(this.value),
+            lossless: true,
+        };
+
+        if (this.subtype) {
+            preview.subtype = this.subtype;
+            if (this.subtype !== "null") {
+                preview.overflow = false;
+                preview.properties = [];
+            }
+        }
+
+        if ("size" in this)
+            preview.size = this.size;
+
+        return preview;
+    },
+
+    _emptyPreview: function()
+    {
+        var preview = this._initialPreview();
+
+        if (this.subtype === "map" || this.subtype === "set" || this.subtype === "weakmap" || this.subtype === "weakset" || this.subtype === "iterator") {
+            if (this.size) {
+                preview.entries = [];
+                preview.lossless = false;
+                preview.overflow = true;
+            }
+        }
+
+        return preview;
+    },
+
+    _generatePreview: function(object, firstLevelKeys, secondLevelKeys)
+    {
+        var preview = this._initialPreview();
+        var isTableRowsRequest = secondLevelKeys === null || secondLevelKeys;
+        var firstLevelKeysCount = firstLevelKeys ? firstLevelKeys.length : 0;
+
+        var propertiesThreshold = {
+            properties: isTableRowsRequest ? 1000 : Math.max(5, firstLevelKeysCount),
+            indexes: isTableRowsRequest ? 1000 : Math.max(10, firstLevelKeysCount)
+        };
+
+        try {
+            // Maps, Sets, and Iterators have entries.
+            if (this.subtype === "map" || this.subtype === "set" || this.subtype === "weakmap" || this.subtype === "weakset" || this.subtype === "iterator")
+                this._appendEntryPreviews(object, preview);
+
+            preview.properties = [];
+
+            // Internal Properties.
+            var internalPropertyDescriptors = injectedScript._internalPropertyDescriptors(object, true);
+            if (internalPropertyDescriptors) {
+                this._appendPropertyPreviews(object, preview, internalPropertyDescriptors, true, propertiesThreshold, firstLevelKeys, secondLevelKeys);
+                if (propertiesThreshold.indexes < 0 || propertiesThreshold.properties < 0)
+                    return preview;
+            }
+
+            if (preview.entries)
+                return preview;
+
+            // Properties.
+            var nativeGettersAsValues = true;
+            var descriptors = injectedScript._propertyDescriptors(object, InjectedScript.CollectionMode.AllProperties, nativeGettersAsValues);
+            this._appendPropertyPreviews(object, preview, descriptors, false, propertiesThreshold, firstLevelKeys, secondLevelKeys);
+            if (propertiesThreshold.indexes < 0 || propertiesThreshold.properties < 0)
+                return preview;
+        } catch (e) {
+            preview.lossless = false;
+        }
+
+        return preview;
+    },
+
+    _appendPropertyPreviews: function(object, preview, descriptors, internal, propertiesThreshold, firstLevelKeys, secondLevelKeys)
+    {
+        for (var descriptor of descriptors) {
+            // Seen enough.
+            if (propertiesThreshold.indexes < 0 || propertiesThreshold.properties < 0)
+                break;
+
+            // Error in descriptor.
+            if (descriptor.wasThrown) {
+                preview.lossless = false;
+                continue;
+            }
+
+            // Do not show "__proto__" in preview.
+            var name = descriptor.name;
+            if (name === "__proto__") {
+                // Non basic __proto__ objects may have interesting, non-enumerable, methods to show.
+                if (descriptor.value && descriptor.value.constructor
+                    && descriptor.value.constructor !== Object
+                    && descriptor.value.constructor !== Array
+                    && descriptor.value.constructor !== RegExp)
+                    preview.lossless = false;
+                continue;
+            }
+
+            // For arrays, only allow indexes.
+            if (this.subtype === "array" && !isUInt32(name))
+                continue;
+
+            // Do not show non-enumerable non-own properties.
+            // Special case to allow array indexes that may be on the prototype.
+            // Special case to allow native getters on non-RegExp objects.
+            if (!descriptor.enumerable && !descriptor.isOwn && !(this.subtype === "array" || (this.subtype !== "regexp" && descriptor.nativeGetter)))
+                continue;
+
+            // If we have a filter, only show properties in the filter.
+            // FIXME: Currently these filters do nothing on the backend.
+            if (firstLevelKeys && !firstLevelKeys.includes(name))
+                continue;
+
+            // Getter/setter.
+            if (!("value" in descriptor)) {
+                preview.lossless = false;
+                this._appendPropertyPreview(preview, internal, {name, type: "accessor"}, propertiesThreshold);
+                continue;
+            }
+
+            // Null value.
+            var value = descriptor.value;
+            if (value === null) {
+                this._appendPropertyPreview(preview, internal, {name, type: "object", subtype: "null", value: "null"}, propertiesThreshold);
+                continue;
+            }
+
+            // Ignore non-enumerable functions.
+            var type = typeof value;
+            if (!descriptor.enumerable && type === "function")
+                continue;
+
+            // Fix type of document.all.
+            if (type === "undefined" && injectedScript._isHTMLAllCollection(value))
+                type = "object";
+
+            // Primitive.
+            const maxLength = 100;
+            if (InjectedScript.primitiveTypes[type]) {
+                if (type === "string" && value.length > maxLength) {
+                    value = this._abbreviateString(value, maxLength, true);
+                    preview.lossless = false;
+                }
+                this._appendPropertyPreview(preview, internal, {name, type, value: toStringDescription(value)}, propertiesThreshold);
+                continue;
+            }
+
+            // Symbol.
+            if (isSymbol(value)) {
+                var symbolString = toString(value);
+                if (symbolString.length > maxLength) {
+                    symbolString = this._abbreviateString(symbolString, maxLength, true);
+                    preview.lossless = false;
+                }
+                this._appendPropertyPreview(preview, internal, {name, type, value: symbolString}, propertiesThreshold);
+                continue;
+            }
+
+            // Object.
+            var property = {name, type};
+            var subtype = injectedScript._subtype(value);
+            if (subtype)
+                property.subtype = subtype;
+
+            // Second level.
+            if ((secondLevelKeys === null || secondLevelKeys) || this._isPreviewableObject(value, object)) {
+                // FIXME: If we want secondLevelKeys filter to continue we would need some refactoring.
+                var subPreview = InjectedScript.RemoteObject.createObjectPreviewForValue(value, value !== object);
+                property.valuePreview = subPreview;
+                if (!subPreview.lossless)
+                    preview.lossless = false;
+                if (subPreview.overflow)
+                    preview.overflow = true;
+            } else {
+                var description = "";
+                if (type !== "function" || subtype === "class") {
+                    var fullDescription;
+                    if (subtype === "class")
+                        fullDescription = "class " + value.name;
+                    else if (subtype === "node")
+                        fullDescription = injectedScript._nodePreview(value);
+                    else
+                        fullDescription = injectedScript._describe(value);
+                    description = this._abbreviateString(fullDescription, maxLength, subtype === "regexp");
+                }
+                property.value = description;
+                preview.lossless = false;
+            }
+
+            this._appendPropertyPreview(preview, internal, property, propertiesThreshold);
+        }
+    },
+
+    _appendPropertyPreview: function(preview, internal, property, propertiesThreshold)
+    {
+        if (toString(property.name >>> 0) === property.name)
+            propertiesThreshold.indexes--;
+        else
+            propertiesThreshold.properties--;
+
+        if (propertiesThreshold.indexes < 0 || propertiesThreshold.properties < 0) {
+            preview.overflow = true;
+            preview.lossless = false;
+            return;
+        }
+
+        if (internal)
+            property.internal = true;
+
+        preview.properties.push(property);
+    },
+
+    _appendEntryPreviews: function(object, preview)
+    {
+        // Fetch 6, but only return 5, so we can tell if we overflowed.
+        var entries = injectedScript._entries(object, this.subtype, 0, 6);
+        if (!entries)
+            return;
+
+        if (entries.length > 5) {
+            entries.pop();
+            preview.overflow = true;
+            preview.lossless = false;
+        }
+
+        function updateMainPreview(subPreview) {
+            if (!subPreview.lossless)
+                preview.lossless = false;
+        }
+
+        preview.entries = entries.map(function(entry) {
+            entry.value = InjectedScript.RemoteObject.createObjectPreviewForValue(entry.value, entry.value !== object);
+            updateMainPreview(entry.value);
+            if ("key" in entry) {
+                entry.key = InjectedScript.RemoteObject.createObjectPreviewForValue(entry.key, entry.key !== object);
+                updateMainPreview(entry.key);
+            }
+            return entry;
+        }, this);
+    },
+
+    _isPreviewableObject: function(value, object)
+    {
+        return this._isPreviewableObjectInternal(value, new Set([object]), 1);
+    },
+
+    _isPreviewableObjectInternal: function(object, knownObjects, depth)
+    {
+        // Deep object.
+        if (depth > 3)
+            return false;
+
+        // Primitive.
+        if (injectedScript.isPrimitiveValue(object) || isSymbol(object))
+            return true;
+
+        // Null.
+        if (object === null)
+            return true;
+
+        // Cyclic objects.
+        if (knownObjects.has(object))
+            return false;
+
+        ++depth;
+        knownObjects.add(object);
+
+        // Arrays are simple if they have 5 or less simple objects.
+        var subtype = injectedScript._subtype(object);
+        if (subtype === "array") {
+            var length = object.length;
+            if (length > 5)
+                return false;
+            for (var i = 0; i < length; ++i) {
+                if (!this._isPreviewableObjectInternal(object[i], knownObjects, depth))
+                    return false;
+            }
+            return true;
+        }
+
+        // Not a basic object.
+        if (object.__proto__ && object.__proto__.__proto__)
+            return false;
+
+        // Objects are simple if they have 3 or less simple properties.
+        var ownPropertyNames = Object.getOwnPropertyNames(object);
+        if (ownPropertyNames.length > 3)
+            return false;
+        for (var propertyName of ownPropertyNames) {
+            if (!this._isPreviewableObjectInternal(object[propertyName], knownObjects, depth))
+                return false;
+        }
+
+        return true;
+    },
+
+    _abbreviateString: function(string, maxLength, middle)
+    {
+        if (string.length <= maxLength)
+            return string;
+
+        if (middle) {
+            var leftHalf = maxLength >> 1;
+            var rightHalf = maxLength - leftHalf - 1;
+            return string.substr(0, leftHalf) + "\u2026" + string.substr(string.length - rightHalf, rightHalf);
+        }
+
+        return string.substr(0, maxLength) + "\u2026";
+    }
+}
+
+InjectedScript.CallFrameProxy = function(ordinal, callFrame)
+{
+    this.callFrameId = "{\"ordinal\":" + ordinal + ",\"injectedScriptId\":" + injectedScriptId + "}";
+    this.functionName = callFrame.functionName;
+    this.location = {scriptId: String(callFrame.sourceID), lineNumber: callFrame.line, columnNumber: callFrame.column};
+    this.scopeChain = this._wrapScopeChain(callFrame);
+    this.this = injectedScript._wrapObject(callFrame.thisObject, "backtrace", false, true);
+    this.isTailDeleted = callFrame.isTailDeleted;
+}
+
+InjectedScript.CallFrameProxy.prototype = {
+    _wrapScopeChain: function(callFrame)
+    {
+        var scopeChain = callFrame.scopeChain;
+        var scopeDescriptions = callFrame.scopeDescriptions();
+
+        var scopeChainProxy = [];
+        for (var i = 0; i < scopeChain.length; i++)
+            scopeChainProxy[i] = InjectedScript.CallFrameProxy._createScopeJson(scopeChain[i], scopeDescriptions[i], "backtrace");
+        return scopeChainProxy;
+    }
+}
+
+InjectedScript.CallFrameProxy._scopeTypeNames = {
+    0: "global", // GLOBAL_SCOPE
+    1: "with", // WITH_SCOPE
+    2: "closure", // CLOSURE_SCOPE
+    3: "catch", // CATCH_SCOPE
+    4: "functionName", // FUNCTION_NAME_SCOPE
+    5: "globalLexicalEnvironment", // GLOBAL_LEXICAL_ENVIRONMENT_SCOPE
+    6: "nestedLexical", // NESTED_LEXICAL_SCOPE
+};
+
+InjectedScript.CallFrameProxy._createScopeJson = function(object, {name, type, location}, groupId)
+{
+    let scope = {
+        object: injectedScript._wrapObject(object, groupId),
+        type: InjectedScript.CallFrameProxy._scopeTypeNames[type],
+    };
+
+    if (name)
+        scope.name = name;
+
+    if (location)
+        scope.location = location;
+
+    if (isEmptyObject(object))
+        scope.empty = true;
+
+    return scope;
+}
+
+
+function bind(func, thisObject, ...outerArgs)
+{
+    return function(...innerArgs) {
+        return func.apply(thisObject, outerArgs.concat(innerArgs));
+    };
+}
+
+function BasicCommandLineAPI(callFrame)
+{
+    this.$_ = injectedScript._lastResult;
+    this.$exception = injectedScript._exceptionValue;
+
+    // $1-$99
+    for (let i = 1; i <= injectedScript._savedResults.length; ++i)
+        this.__defineGetter__("$" + i, bind(injectedScript._savedResult, injectedScript, i));
+
+    // Command Line API methods.
+    for (let method of BasicCommandLineAPI.methods)
+        this[method.name] = method;
+}
+
+BasicCommandLineAPI.methods = [
+    function dir() { return inspectedGlobalObject.console.dir(...arguments); },
+    function clear() { return inspectedGlobalObject.console.clear(...arguments); },
+    function table() { return inspectedGlobalObject.console.table(...arguments); },
+    function profile() { return inspectedGlobalObject.console.profile(...arguments); },
+    function profileEnd() { return inspectedGlobalObject.console.profileEnd(...arguments); },
+
+    function keys(object) { return Object.keys(object); },
+    function values(object) {
+        let result = [];
+        for (let key in object)
+            result.push(object[key]);
+        return result;
+    },
+];
+
+for (let method of BasicCommandLineAPI.methods)
+    method.toString = function() { return "function " + method.name + "() { [Command Line API] }"; };
+
+return injectedScript;
+})
diff --git a/inspector/InspectorAgentBase.h b/inspector/InspectorAgentBase.h
new file mode 100644
index 0000000..4edf783
--- /dev/null
+++ b/inspector/InspectorAgentBase.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+class JSGlobalObject;
+}
+
+namespace Inspector {
+
+class BackendDispatcher;
+class FrontendRouter;
+class InjectedScriptManager;
+class InspectorEnvironment;
+
+struct AgentContext {
+    InspectorEnvironment& environment;
+    InjectedScriptManager& injectedScriptManager;
+    FrontendRouter& frontendRouter;
+    BackendDispatcher& backendDispatcher;
+};
+
+struct JSAgentContext : public AgentContext {
+    JSAgentContext(AgentContext& context, JSC::JSGlobalObject& globalObject)
+        : AgentContext(context)
+        , inspectedGlobalObject(globalObject)
+    {
+    }
+
+    JSC::JSGlobalObject& inspectedGlobalObject;
+};
+
+enum class DisconnectReason {
+    InspectedTargetDestroyed,
+    InspectorDestroyed
+};
+
+class InspectorAgentBase {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    virtual ~InspectorAgentBase() { }
+
+    String domainName() const { return m_name; }
+
+    virtual void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*) = 0;
+    virtual void willDestroyFrontendAndBackend(DisconnectReason) = 0;
+    virtual void discardValues() { }
+    virtual void discardAgent() { }
+
+protected:
+    InspectorAgentBase(const String& name)
+        : m_name(name)
+    {
+    }
+
+    String m_name;
+};
+
+} // namespace Inspector
diff --git a/inspector/InspectorAgentRegistry.cpp b/inspector/InspectorAgentRegistry.cpp
new file mode 100644
index 0000000..b5e3474
--- /dev/null
+++ b/inspector/InspectorAgentRegistry.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorAgentRegistry.h"
+
+#include "InspectorAgentBase.h"
+
+namespace Inspector {
+
+AgentRegistry::AgentRegistry()
+{
+}
+
+AgentRegistry::~AgentRegistry()
+{
+    // Allow agents to remove cross-references to other agents that would otherwise
+    // make it difficult to establish a correct destruction order for all agents.
+    for (auto& agent : m_agents)
+        agent->discardAgent();
+}
+
+void AgentRegistry::append(std::unique_ptr<InspectorAgentBase> agent)
+{
+    m_agents.append(WTFMove(agent));
+}
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+void AgentRegistry::appendExtraAgent(std::unique_ptr<InspectorAgentBase> agent)
+{
+    m_extraDomains.append(agent->domainName());
+
+    append(WTFMove(agent));
+}
+#endif
+
+void AgentRegistry::didCreateFrontendAndBackend(FrontendRouter* frontendRouter, BackendDispatcher* backendDispatcher)
+{
+    for (auto& agent : m_agents)
+        agent->didCreateFrontendAndBackend(frontendRouter, backendDispatcher);
+}
+
+void AgentRegistry::willDestroyFrontendAndBackend(DisconnectReason reason)
+{
+    for (auto& agent : m_agents)
+        agent->willDestroyFrontendAndBackend(reason);
+}
+
+void AgentRegistry::discardValues()
+{
+    for (auto& agent : m_agents)
+        agent->discardValues();
+}
+
+} // namespace Inspector
diff --git a/inspector/InspectorAgentRegistry.h b/inspector/InspectorAgentRegistry.h
new file mode 100644
index 0000000..7f7017c
--- /dev/null
+++ b/inspector/InspectorAgentRegistry.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class BackendDispatcher;
+class FrontendRouter;
+class InspectorAgentBase;
+
+enum class DisconnectReason;
+
+class JS_EXPORT_PRIVATE AgentRegistry {
+public:
+    AgentRegistry();
+    ~AgentRegistry();
+
+    void append(std::unique_ptr<InspectorAgentBase>);
+
+    void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*);
+    void willDestroyFrontendAndBackend(DisconnectReason);
+    void discardValues();
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    void appendExtraAgent(std::unique_ptr<InspectorAgentBase>);
+    Vector<String> extraDomains() const { return m_extraDomains; }
+#endif
+
+private:
+    // These are declared here to avoid MSVC from trying to create default iplementations which would
+    // involve generating a copy constructor and copy assignment operator for the Vector of std::unique_ptrs.
+    AgentRegistry(const AgentRegistry&) = delete;
+    AgentRegistry& operator=(const AgentRegistry&) = delete;
+
+    Vector<std::unique_ptr<InspectorAgentBase>> m_agents;
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    Vector<String> m_extraDomains;
+#endif
+};
+
+} // namespace Inspector
diff --git a/inspector/InspectorBackendDispatcher.cpp b/inspector/InspectorBackendDispatcher.cpp
new file mode 100644
index 0000000..b1984a8
--- /dev/null
+++ b/inspector/InspectorBackendDispatcher.cpp
@@ -0,0 +1,349 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 The Chromium Authors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorBackendDispatcher.h"
+
+#include "InspectorFrontendRouter.h"
+#include "InspectorValues.h"
+#include <wtf/SetForScope.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+SupplementalBackendDispatcher::SupplementalBackendDispatcher(BackendDispatcher& backendDispatcher)
+    : m_backendDispatcher(backendDispatcher)
+{
+}
+
+SupplementalBackendDispatcher::~SupplementalBackendDispatcher()
+{
+}
+
+BackendDispatcher::CallbackBase::CallbackBase(Ref<BackendDispatcher>&& backendDispatcher, long requestId)
+    : m_backendDispatcher(WTFMove(backendDispatcher))
+    , m_requestId(requestId)
+{
+}
+
+bool BackendDispatcher::CallbackBase::isActive() const
+{
+    return !m_alreadySent && m_backendDispatcher->isActive();
+}
+
+void BackendDispatcher::CallbackBase::sendFailure(const ErrorString& error)
+{
+    ASSERT(error.length());
+
+    if (m_alreadySent)
+        return;
+
+    m_alreadySent = true;
+
+    // Immediately send an error message since this is an async response with a single error.
+    m_backendDispatcher->reportProtocolError(m_requestId, ServerError, error);
+    m_backendDispatcher->sendPendingErrors();
+}
+
+void BackendDispatcher::CallbackBase::sendSuccess(RefPtr<InspectorObject>&& partialMessage)
+{
+    if (m_alreadySent)
+        return;
+
+    m_alreadySent = true;
+    m_backendDispatcher->sendResponse(m_requestId, WTFMove(partialMessage));
+}
+
+BackendDispatcher::BackendDispatcher(Ref<FrontendRouter>&& router)
+    : m_frontendRouter(WTFMove(router))
+{
+}
+
+Ref<BackendDispatcher> BackendDispatcher::create(Ref<FrontendRouter>&& router)
+{
+    return adoptRef(*new BackendDispatcher(WTFMove(router)));
+}
+
+bool BackendDispatcher::isActive() const
+{
+    return m_frontendRouter->hasFrontends();
+}
+
+void BackendDispatcher::registerDispatcherForDomain(const String& domain, SupplementalBackendDispatcher* dispatcher)
+{
+    ASSERT_ARG(dispatcher, dispatcher);
+
+    // FIXME: <https://webkit.org/b/148492> Agents should only register with the backend once,
+    // and we should re-add the assertion that only one dispatcher is registered per domain.
+    m_dispatchers.set(domain, dispatcher);
+}
+
+void BackendDispatcher::dispatch(const String& message)
+{
+    Ref<BackendDispatcher> protect(*this);
+
+    ASSERT(!m_protocolErrors.size());
+
+    long requestId = 0;
+    RefPtr<InspectorObject> messageObject;
+
+    {
+        // In case this is a re-entrant call from a nested run loop, we don't want to lose
+        // the outer request's id just because the inner request is bogus.
+        SetForScope<std::optional<long>> scopedRequestId(m_currentRequestId, std::nullopt);
+
+        RefPtr<InspectorValue> parsedMessage;
+        if (!InspectorValue::parseJSON(message, parsedMessage)) {
+            reportProtocolError(ParseError, ASCIILiteral("Message must be in JSON format"));
+            sendPendingErrors();
+            return;
+        }
+
+        if (!parsedMessage->asObject(messageObject)) {
+            reportProtocolError(InvalidRequest, ASCIILiteral("Message must be a JSONified object"));
+            sendPendingErrors();
+            return;
+        }
+
+        RefPtr<InspectorValue> requestIdValue;
+        if (!messageObject->getValue(ASCIILiteral("id"), requestIdValue)) {
+            reportProtocolError(InvalidRequest, ASCIILiteral("'id' property was not found"));
+            sendPendingErrors();
+            return;
+        }
+
+        if (!requestIdValue->asInteger(requestId)) {
+            reportProtocolError(InvalidRequest, ASCIILiteral("The type of 'id' property must be integer"));
+            sendPendingErrors();
+            return;
+        }
+    }
+
+    {
+        // We could be called re-entrantly from a nested run loop, so restore the previous id.
+        SetForScope<std::optional<long>> scopedRequestId(m_currentRequestId, requestId);
+
+        RefPtr<InspectorValue> methodValue;
+        if (!messageObject->getValue(ASCIILiteral("method"), methodValue)) {
+            reportProtocolError(InvalidRequest, ASCIILiteral("'method' property wasn't found"));
+            sendPendingErrors();
+            return;
+        }
+
+        String methodString;
+        if (!methodValue->asString(methodString)) {
+            reportProtocolError(InvalidRequest, ASCIILiteral("The type of 'method' property must be string"));
+            sendPendingErrors();
+            return;
+        }
+
+        Vector<String> domainAndMethod;
+        methodString.split('.', true, domainAndMethod);
+        if (domainAndMethod.size() != 2 || !domainAndMethod[0].length() || !domainAndMethod[1].length()) {
+            reportProtocolError(InvalidRequest, ASCIILiteral("The 'method' property was formatted incorrectly. It should be 'Domain.method'"));
+            sendPendingErrors();
+            return;
+        }
+
+        String domain = domainAndMethod[0];
+        SupplementalBackendDispatcher* domainDispatcher = m_dispatchers.get(domain);
+        if (!domainDispatcher) {
+            reportProtocolError(MethodNotFound, "'" + domain + "' domain was not found");
+            sendPendingErrors();
+            return;
+        }
+
+        String method = domainAndMethod[1];
+        domainDispatcher->dispatch(requestId, method, messageObject.releaseNonNull());
+
+        if (m_protocolErrors.size())
+            sendPendingErrors();
+    }
+}
+
+void BackendDispatcher::sendResponse(long requestId, RefPtr<InspectorObject>&& result)
+{
+    ASSERT(!m_protocolErrors.size());
+
+    // The JSON-RPC 2.0 specification requires that the "error" member have the value 'null'
+    // if no error occurred during an invocation, but we do not include it at all.
+    Ref<InspectorObject> responseMessage = InspectorObject::create();
+    responseMessage->setObject(ASCIILiteral("result"), WTFMove(result));
+    responseMessage->setInteger(ASCIILiteral("id"), requestId);
+    m_frontendRouter->sendResponse(responseMessage->toJSONString());
+}
+
+void BackendDispatcher::sendPendingErrors()
+{
+    // These error codes are specified in JSON-RPC 2.0, Section 5.1.
+    static const int errorCodes[] = {
+        -32700, // ParseError
+        -32600, // InvalidRequest
+        -32601, // MethodNotFound
+        -32602, // InvalidParams
+        -32603, // InternalError
+        -32000, // ServerError
+    };
+
+    // To construct the error object, only use the last error's code and message.
+    // Per JSON-RPC 2.0, Section 5.1, the 'data' member may contain nested errors,
+    // but only one top-level Error object should be sent per request.
+    CommonErrorCode errorCode = InternalError;
+    String errorMessage;
+    Ref<InspectorArray> payload = InspectorArray::create();
+    
+    for (auto& data : m_protocolErrors) {
+        errorCode = std::get<0>(data);
+        errorMessage = std::get<1>(data);
+
+        ASSERT_ARG(errorCode, (unsigned)errorCode < WTF_ARRAY_LENGTH(errorCodes));
+        ASSERT_ARG(errorCode, errorCodes[errorCode]);
+
+        Ref<InspectorObject> error = InspectorObject::create();
+        error->setInteger(ASCIILiteral("code"), errorCodes[errorCode]);
+        error->setString(ASCIILiteral("message"), errorMessage);
+        payload->pushObject(WTFMove(error));
+    }
+
+    Ref<InspectorObject> topLevelError = InspectorObject::create();
+    topLevelError->setInteger(ASCIILiteral("code"), errorCodes[errorCode]);
+    topLevelError->setString(ASCIILiteral("message"), errorMessage);
+    topLevelError->setArray(ASCIILiteral("data"), WTFMove(payload));
+
+    Ref<InspectorObject> message = InspectorObject::create();
+    message->setObject(ASCIILiteral("error"), WTFMove(topLevelError));
+    if (m_currentRequestId)
+        message->setInteger(ASCIILiteral("id"), m_currentRequestId.value());
+    else {
+        // The 'null' value for an unknown id is specified in JSON-RPC 2.0, Section 5.
+        message->setValue(ASCIILiteral("id"), InspectorValue::null());
+    }
+
+    m_frontendRouter->sendResponse(message->toJSONString());
+
+    m_protocolErrors.clear();
+    m_currentRequestId = std::nullopt;
+}
+    
+void BackendDispatcher::reportProtocolError(CommonErrorCode errorCode, const String& errorMessage)
+{
+    reportProtocolError(m_currentRequestId, errorCode, errorMessage);
+}
+
+void BackendDispatcher::reportProtocolError(std::optional<long> relatedRequestId, CommonErrorCode errorCode, const String& errorMessage)
+{
+    ASSERT_ARG(errorCode, errorCode >= 0);
+
+    // If the error was reported from an async callback, then no request id will be registered yet.
+    if (!m_currentRequestId)
+        m_currentRequestId = relatedRequestId;
+
+    m_protocolErrors.append(std::tuple<CommonErrorCode, String>(errorCode, errorMessage));
+}
+
+#if PLATFORM(MAC)
+void BackendDispatcher::reportProtocolError(WTF::DeprecatedOptional<long> relatedRequestId, CommonErrorCode errorCode, const String& errorMessage)
+{
+    if (relatedRequestId)
+        reportProtocolError(relatedRequestId.value(), errorCode, errorMessage);
+    else
+        reportProtocolError(std::nullopt, errorCode, errorMessage);
+}
+#endif
+
+template<typename T>
+T BackendDispatcher::getPropertyValue(InspectorObject* object, const String& name, bool* out_optionalValueFound, T defaultValue, std::function<bool(InspectorValue&, T&)> asMethod, const char* typeName)
+{
+    T result(defaultValue);
+    // out_optionalValueFound signals to the caller whether an optional property was found.
+    // if out_optionalValueFound == nullptr, then this is a required property.
+    if (out_optionalValueFound)
+        *out_optionalValueFound = false;
+
+    if (!object) {
+        if (!out_optionalValueFound)
+            reportProtocolError(BackendDispatcher::InvalidParams, String::format("'params' object must contain required parameter '%s' with type '%s'.", name.utf8().data(), typeName));
+        return result;
+    }
+
+    auto findResult = object->find(name);
+    if (findResult == object->end()) {
+        if (!out_optionalValueFound)
+            reportProtocolError(BackendDispatcher::InvalidParams, String::format("Parameter '%s' with type '%s' was not found.", name.utf8().data(), typeName));
+        return result;
+    }
+
+    if (!asMethod(*findResult->value, result)) {
+        reportProtocolError(BackendDispatcher::InvalidParams, String::format("Parameter '%s' has wrong type. It must be '%s'.", name.utf8().data(), typeName));
+        return result;
+    }
+
+    if (out_optionalValueFound)
+        *out_optionalValueFound = true;
+
+    return result;
+}
+
+static bool castToInteger(InspectorValue& value, int& result) { return value.asInteger(result); }
+static bool castToNumber(InspectorValue& value, double& result) { return value.asDouble(result); }
+
+int BackendDispatcher::getInteger(InspectorObject* object, const String& name, bool* valueFound)
+{
+    return getPropertyValue<int>(object, name, valueFound, 0, &castToInteger, "Integer");
+}
+
+double BackendDispatcher::getDouble(InspectorObject* object, const String& name, bool* valueFound)
+{
+    return getPropertyValue<double>(object, name, valueFound, 0, &castToNumber, "Number");
+}
+
+String BackendDispatcher::getString(InspectorObject* object, const String& name, bool* valueFound)
+{
+    return getPropertyValue<String>(object, name, valueFound, "", &InspectorValue::asString, "String");
+}
+
+bool BackendDispatcher::getBoolean(InspectorObject* object, const String& name, bool* valueFound)
+{
+    return getPropertyValue<bool>(object, name, valueFound, false, &InspectorValue::asBoolean, "Boolean");
+}
+
+RefPtr<InspectorObject> BackendDispatcher::getObject(InspectorObject* object, const String& name, bool* valueFound)
+{
+    return getPropertyValue<RefPtr<InspectorObject>>(object, name, valueFound, nullptr, &InspectorValue::asObject, "Object");
+}
+
+RefPtr<InspectorArray> BackendDispatcher::getArray(InspectorObject* object, const String& name, bool* valueFound)
+{
+    return getPropertyValue<RefPtr<InspectorArray>>(object, name, valueFound, nullptr, &InspectorValue::asArray, "Array");
+}
+
+RefPtr<InspectorValue> BackendDispatcher::getValue(InspectorObject* object, const String& name, bool* valueFound)
+{
+    return getPropertyValue<RefPtr<InspectorValue>>(object, name, valueFound, nullptr, &InspectorValue::asValue, "Value");
+}
+
+} // namespace Inspector
diff --git a/inspector/InspectorBackendDispatcher.h b/inspector/InspectorBackendDispatcher.h
new file mode 100644
index 0000000..db976bd
--- /dev/null
+++ b/inspector/InspectorBackendDispatcher.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 The Chromium Authors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorFrontendRouter.h"
+#include "InspectorProtocolTypes.h"
+#include <wtf/DeprecatedOptional.h>
+#include <wtf/Optional.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class BackendDispatcher;
+
+typedef String ErrorString;
+
+class JS_EXPORT_PRIVATE SupplementalBackendDispatcher : public RefCounted<SupplementalBackendDispatcher> {
+public:
+    SupplementalBackendDispatcher(BackendDispatcher&);
+    virtual ~SupplementalBackendDispatcher();
+    virtual void dispatch(long requestId, const String& method, Ref<InspectorObject>&& message) = 0;
+protected:
+    Ref<BackendDispatcher> m_backendDispatcher;
+};
+
+class JS_EXPORT_PRIVATE BackendDispatcher : public RefCounted<BackendDispatcher> {
+public:
+    static Ref<BackendDispatcher> create(Ref<FrontendRouter>&&);
+
+    class JS_EXPORT_PRIVATE CallbackBase : public RefCounted<CallbackBase> {
+    public:
+        CallbackBase(Ref<BackendDispatcher>&&, long requestId);
+
+        bool isActive() const;
+        void disable() { m_alreadySent = true; }
+
+        void sendSuccess(RefPtr<InspectorObject>&&);
+        void sendFailure(const ErrorString&);
+
+    private:
+        Ref<BackendDispatcher> m_backendDispatcher;
+        long m_requestId;
+        bool m_alreadySent { false };
+    };
+
+    bool isActive() const;
+
+    bool hasProtocolErrors() const { return m_protocolErrors.size() > 0; }
+
+    enum CommonErrorCode {
+        ParseError = 0,
+        InvalidRequest,
+        MethodNotFound,
+        InvalidParams,
+        InternalError,
+        ServerError
+    };
+
+    void registerDispatcherForDomain(const String& domain, SupplementalBackendDispatcher*);
+    void dispatch(const String& message);
+
+    void sendResponse(long requestId, RefPtr<InspectorObject>&& result);
+    void sendPendingErrors();
+
+    void reportProtocolError(CommonErrorCode, const String& errorMessage);
+    void reportProtocolError(std::optional<long> relatedRequestId, CommonErrorCode, const String& errorMessage);
+
+    template<typename T>
+    WTF_HIDDEN_DECLARATION
+    T getPropertyValue(InspectorObject*, const String& name, bool* out_optionalValueFound, T defaultValue, std::function<bool(InspectorValue&, T&)>, const char* typeName);
+
+    int getInteger(InspectorObject*, const String& name, bool* valueFound);
+    double getDouble(InspectorObject*, const String& name, bool* valueFound);
+    String getString(InspectorObject*, const String& name, bool* valueFound);
+    bool getBoolean(InspectorObject*, const String& name, bool* valueFound);
+    RefPtr<InspectorValue> getValue(InspectorObject*, const String& name, bool* valueFound);
+    RefPtr<InspectorObject> getObject(InspectorObject*, const String& name, bool* valueFound);
+    RefPtr<InspectorArray> getArray(InspectorObject*, const String& name, bool* valueFound);
+
+private:
+    BackendDispatcher(Ref<FrontendRouter>&&);
+
+#if PLATFORM(MAC)
+    // This is necessary for some versions of Safari. Remove it when those versions of Safari are no longer supported.
+    void reportProtocolError(WTF::DeprecatedOptional<long> relatedRequestId, CommonErrorCode, const String& errorMessage);
+#endif
+
+    Ref<FrontendRouter> m_frontendRouter;
+    HashMap<String, SupplementalBackendDispatcher*> m_dispatchers;
+
+    // Protocol errors reported for the top-level request being processed.
+    // If processing a request triggers async responses, then any related errors will
+    // be attributed to the top-level request, but generate separate error messages.
+    Vector<std::tuple<CommonErrorCode, String>> m_protocolErrors;
+
+    // For synchronously handled requests, avoid plumbing requestId through every
+    // call that could potentially fail with a protocol error.
+    std::optional<long> m_currentRequestId { std::nullopt };
+};
+
+} // namespace Inspector
diff --git a/inspector/InspectorEnvironment.h b/inspector/InspectorEnvironment.h
new file mode 100644
index 0000000..3b60c1b
--- /dev/null
+++ b/inspector/InspectorEnvironment.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CallData.h"
+
+namespace WTF {
+class Stopwatch;
+}
+
+namespace JSC {
+class Exception;
+class SourceCode;
+class VM;
+}
+
+namespace Inspector {
+
+class ScriptDebugServer;
+typedef JSC::JSValue (*InspectorFunctionCallHandler)(JSC::ExecState* exec, JSC::JSValue functionObject, JSC::CallType callType, const JSC::CallData& callData, JSC::JSValue thisValue, const JSC::ArgList& args, NakedPtr<JSC::Exception>& returnedException);
+typedef JSC::JSValue (*InspectorEvaluateHandler)(JSC::ExecState*, const JSC::SourceCode&, JSC::JSValue thisValue, NakedPtr<JSC::Exception>& returnedException);
+
+class InspectorEnvironment {
+public:
+    virtual ~InspectorEnvironment() { }
+    virtual bool developerExtrasEnabled() const = 0;
+    virtual bool canAccessInspectedScriptState(JSC::ExecState*) const = 0;
+    virtual InspectorFunctionCallHandler functionCallHandler() const = 0;
+    virtual InspectorEvaluateHandler evaluateHandler() const = 0;
+    virtual void frontendInitialized() = 0;
+    virtual Ref<WTF::Stopwatch> executionStopwatch() = 0;
+    virtual ScriptDebugServer& scriptDebugServer() = 0;
+    virtual JSC::VM& vm() = 0;
+};
+
+} // namespace Inspector
diff --git a/inspector/InspectorFrontendChannel.h b/inspector/InspectorFrontendChannel.h
new file mode 100644
index 0000000..3abc1d2
--- /dev/null
+++ b/inspector/InspectorFrontendChannel.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+// Represents a one-way connection from an Inspection or Automation target to
+// a local or remote controller (such as a debugger or UI automation script).
+
+class FrontendChannel {
+public:
+
+    enum class ConnectionType {
+        Remote,
+        Local
+    };
+
+    virtual ~FrontendChannel() { }
+    virtual ConnectionType connectionType() const = 0;
+    virtual void sendMessageToFrontend(const String& message) = 0;
+};
+
+} // namespace Inspector
diff --git a/inspector/InspectorFrontendRouter.cpp b/inspector/InspectorFrontendRouter.cpp
new file mode 100644
index 0000000..65f8525
--- /dev/null
+++ b/inspector/InspectorFrontendRouter.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontendRouter.h"
+
+#include "InspectorFrontendChannel.h"
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+Ref<FrontendRouter> FrontendRouter::create()
+{
+    return adoptRef(*new FrontendRouter);
+}
+
+void FrontendRouter::connectFrontend(FrontendChannel* connection)
+{
+    ASSERT_ARG(connection, connection);
+
+    if (m_connections.contains(connection)) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    m_connections.append(connection);
+}
+
+void FrontendRouter::disconnectFrontend(FrontendChannel* connection)
+{
+    ASSERT_ARG(connection, connection);
+
+    if (!m_connections.contains(connection)) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    m_connections.removeFirst(connection);
+}
+
+void FrontendRouter::disconnectAllFrontends()
+{
+    m_connections.clear();
+}
+
+bool FrontendRouter::hasLocalFrontend() const
+{
+    for (auto* connection : m_connections) {
+        if (connection->connectionType() == FrontendChannel::ConnectionType::Local)
+            return true;
+    }
+
+    return false;
+}
+
+bool FrontendRouter::hasRemoteFrontend() const
+{
+    for (auto* connection : m_connections) {
+        if (connection->connectionType() == FrontendChannel::ConnectionType::Remote)
+            return true;
+    }
+
+    return false;
+}
+
+void FrontendRouter::sendEvent(const String& message) const
+{
+    for (auto* connection : m_connections)
+        connection->sendMessageToFrontend(message);
+}
+
+void FrontendRouter::sendResponse(const String& message) const
+{
+    // FIXME: send responses to the appropriate frontend.
+    for (auto* connection : m_connections)
+        connection->sendMessageToFrontend(message);
+}
+
+} // namespace Inspector
diff --git a/inspector/InspectorFrontendRouter.h b/inspector/InspectorFrontendRouter.h
new file mode 100644
index 0000000..5872b6d
--- /dev/null
+++ b/inspector/InspectorFrontendRouter.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendChannel;
+
+class JS_EXPORT_PRIVATE FrontendRouter : public RefCounted<FrontendRouter> {
+public:
+    static Ref<FrontendRouter> create();
+
+    bool hasFrontends() const { return !m_connections.isEmpty(); }
+    bool hasLocalFrontend() const;
+    bool hasRemoteFrontend() const;
+
+    unsigned frontendCount() const { return m_connections.size(); }
+
+    void connectFrontend(FrontendChannel*);
+    void disconnectFrontend(FrontendChannel*);
+    void disconnectAllFrontends();
+
+    void sendEvent(const String& message) const;
+    void sendResponse(const String& message) const;
+
+private:
+    Vector<FrontendChannel*, 2> m_connections;
+};
+
+} // namespace Inspector
diff --git a/inspector/InspectorProtocolTypes.h b/inspector/InspectorProtocolTypes.h
new file mode 100644
index 0000000..248e58a
--- /dev/null
+++ b/inspector/InspectorProtocolTypes.h
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 The Chromium Authors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorValues.h"
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+template<typename T> struct BindingTraits;
+
+template<typename T>
+class OptOutput {
+public:
+    OptOutput() : m_assigned(false) { }
+
+    void operator=(T value)
+    {
+        m_value = value;
+        m_assigned = true;
+    }
+
+    bool isAssigned() const { return m_assigned; }
+
+    T getValue()
+    {
+        ASSERT(isAssigned());
+        return m_value;
+    }
+
+private:
+    T m_value;
+    bool m_assigned;
+
+    WTF_MAKE_NONCOPYABLE(OptOutput);
+};
+
+template<typename T>
+class Array : public InspectorArrayBase {
+private:
+    Array() { }
+
+    InspectorArray& openAccessors()
+    {
+        COMPILE_ASSERT(sizeof(InspectorArray) == sizeof(Array<T>), cannot_cast);
+        return *static_cast<InspectorArray*>(static_cast<InspectorArrayBase*>(this));
+    }
+
+public:
+    void addItem(Ref<T>&& value)
+    {
+        openAccessors().pushValue(&value.get());
+    }
+
+    void addItem(RefPtr<T>&& value)
+    {
+        openAccessors().pushValue(WTFMove(value));
+    }
+    
+    void addItem(const String& value)
+    {
+        openAccessors().pushString(value);
+    }
+
+    void addItem(int value)
+    {
+        openAccessors().pushInteger(value);
+    }
+
+    void addItem(double value)
+    {
+        openAccessors().pushDouble(value);
+    }
+
+    static Ref<Array<T>> create()
+    {
+        return adoptRef(*new Array<T>());
+    }
+};
+
+// Helper methods for Protocol and other Inspector types are provided by
+// specializations of BindingTraits<T>. Some are generated for protocol types.
+
+template<typename T>
+struct BindingTraits {
+    typedef T BindingType;
+
+    static void push(InspectorArray&, BindingType&);
+    static InspectorValue::Type typeTag();
+    static RefPtr<T> runtimeCast(RefPtr<InspectorObject>&&);
+#if !ASSERT_DISABLED
+    static void assertValueHasExpectedType(InspectorValue*);
+#endif // !ASSERT_DISABLED
+};
+
+template<InspectorValue::Type TYPE>
+struct PrimitiveBindingTraits {
+#if !ASSERT_DISABLED
+    static void assertValueHasExpectedType(InspectorValue* value)
+    {
+        ASSERT_ARG(value, value && value->type() == TYPE);
+    }
+#endif // !ASSERT_DISABLED
+};
+
+template<typename T>
+struct BindingTraits<Protocol::Array<T>> {
+    static RefPtr<Array<T>> runtimeCast(RefPtr<InspectorValue>&& value)
+    {
+        ASSERT_ARG(value, value);
+        RefPtr<InspectorArray> array;
+        bool castSucceeded = value->asArray(array);
+        ASSERT_UNUSED(castSucceeded, castSucceeded);
+#if !ASSERT_DISABLED
+        assertValueHasExpectedType(array.get());
+#endif // !ASSERT_DISABLED
+        COMPILE_ASSERT(sizeof(Array<T>) == sizeof(InspectorArray), type_cast_problem);
+        return static_cast<Array<T>*>(static_cast<InspectorArrayBase*>(array.get()));
+    }
+
+#if !ASSERT_DISABLED
+    static void assertValueHasExpectedType(InspectorValue* value)
+    {
+        ASSERT_ARG(value, value);
+        RefPtr<InspectorArray> array;
+        bool castSucceeded = value->asArray(array);
+        ASSERT_UNUSED(castSucceeded, castSucceeded);
+        for (unsigned i = 0; i < array->length(); i++)
+            BindingTraits<T>::assertValueHasExpectedType(array->get(i).get());
+    }
+#endif // !ASSERT_DISABLED
+};
+
+template<>
+struct BindingTraits<InspectorValue> {
+#if !ASSERT_DISABLED
+    static void assertValueHasExpectedType(InspectorValue*)
+    {
+    }
+#endif // !ASSERT_DISABLED
+};
+
+template<> struct BindingTraits<InspectorArray> : public PrimitiveBindingTraits<InspectorValue::Type::Array> { };
+template<> struct BindingTraits<InspectorObject> : public PrimitiveBindingTraits<InspectorValue::Type::Object> { };
+template<> struct BindingTraits<String> : public PrimitiveBindingTraits<InspectorValue::Type::String> { };
+template<> struct BindingTraits<bool> : public PrimitiveBindingTraits<InspectorValue::Type::Boolean> { };
+template<> struct BindingTraits<double> : public PrimitiveBindingTraits<InspectorValue::Type::Double> { };
+template<> struct BindingTraits<int> : public PrimitiveBindingTraits<InspectorValue::Type::Integer> { };
+
+} // namespace Protocol
+
+using Protocol::BindingTraits;
+
+} // namespace Inspector
diff --git a/inspector/InspectorValues.cpp b/inspector/InspectorValues.cpp
new file mode 100644
index 0000000..14fb7e7
--- /dev/null
+++ b/inspector/InspectorValues.cpp
@@ -0,0 +1,821 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorValues.h"
+
+#include <wtf/DecimalNumber.h>
+#include <wtf/dtoa.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace Inspector {
+
+namespace {
+
+static const int stackLimit = 1000;
+
+enum Token {
+    OBJECT_BEGIN,
+    OBJECT_END,
+    ARRAY_BEGIN,
+    ARRAY_END,
+    STRING,
+    NUMBER,
+    BOOL_TRUE,
+    BOOL_FALSE,
+    NULL_TOKEN,
+    LIST_SEPARATOR,
+    OBJECT_PAIR_SEPARATOR,
+    INVALID_TOKEN,
+};
+
+const char* const nullString = "null";
+const char* const trueString = "true";
+const char* const falseString = "false";
+
+bool parseConstToken(const UChar* start, const UChar* end, const UChar** tokenEnd, const char* token)
+{
+    while (start < end && *token != '\0' && *start++ == *token++) { }
+
+    if (*token != '\0')
+        return false;
+
+    *tokenEnd = start;
+    return true;
+}
+
+bool readInt(const UChar* start, const UChar* end, const UChar** tokenEnd, bool canHaveLeadingZeros)
+{
+    if (start == end)
+        return false;
+
+    bool haveLeadingZero = '0' == *start;
+    int length = 0;
+    while (start < end && '0' <= *start && *start <= '9') {
+        ++start;
+        ++length;
+    }
+
+    if (!length)
+        return false;
+
+    if (!canHaveLeadingZeros && length > 1 && haveLeadingZero)
+        return false;
+
+    *tokenEnd = start;
+    return true;
+}
+
+bool parseNumberToken(const UChar* start, const UChar* end, const UChar** tokenEnd)
+{
+    // We just grab the number here.  We validate the size in DecodeNumber.
+    // According   to RFC4627, a valid number is: [minus] int [frac] [exp]
+    if (start == end)
+        return false;
+
+    UChar c = *start;
+    if ('-' == c)
+        ++start;
+
+    if (!readInt(start, end, &start, false))
+        return false;
+
+    if (start == end) {
+        *tokenEnd = start;
+        return true;
+    }
+
+    // Optional fraction part
+    c = *start;
+    if ('.' == c) {
+        ++start;
+        if (!readInt(start, end, &start, true))
+            return false;
+        if (start == end) {
+            *tokenEnd = start;
+            return true;
+        }
+        c = *start;
+    }
+
+    // Optional exponent part
+    if ('e' == c || 'E' == c) {
+        ++start;
+        if (start == end)
+            return false;
+        c = *start;
+        if ('-' == c || '+' == c) {
+            ++start;
+            if (start == end)
+                return false;
+        }
+        if (!readInt(start, end, &start, true))
+            return false;
+    }
+
+    *tokenEnd = start;
+    return true;
+}
+
+bool readHexDigits(const UChar* start, const UChar* end, const UChar** tokenEnd, int digits)
+{
+    if (end - start < digits)
+        return false;
+
+    for (int i = 0; i < digits; ++i) {
+        if (!isASCIIHexDigit(*start++))
+            return false;
+    }
+
+    *tokenEnd = start;
+    return true;
+}
+
+bool parseStringToken(const UChar* start, const UChar* end, const UChar** tokenEnd)
+{
+    while (start < end) {
+        UChar c = *start++;
+        if ('\\' == c) {
+            c = *start++;
+            // Make sure the escaped char is valid.
+            switch (c) {
+            case 'x':
+                if (!readHexDigits(start, end, &start, 2))
+                    return false;
+                break;
+            case 'u':
+                if (!readHexDigits(start, end, &start, 4))
+                    return false;
+                break;
+            case '\\':
+            case '/':
+            case 'b':
+            case 'f':
+            case 'n':
+            case 'r':
+            case 't':
+            case 'v':
+            case '"':
+                break;
+            default:
+                return false;
+            }
+        } else if ('"' == c) {
+            *tokenEnd = start;
+            return true;
+        }
+    }
+
+    return false;
+}
+
+Token parseToken(const UChar* start, const UChar* end, const UChar** tokenStart, const UChar** tokenEnd)
+{
+    while (start < end && isSpaceOrNewline(*start))
+        ++start;
+
+    if (start == end)
+        return INVALID_TOKEN;
+
+    *tokenStart = start;
+
+    switch (*start) {
+    case 'n':
+        if (parseConstToken(start, end, tokenEnd, nullString))
+            return NULL_TOKEN;
+        break;
+    case 't':
+        if (parseConstToken(start, end, tokenEnd, trueString))
+            return BOOL_TRUE;
+        break;
+    case 'f':
+        if (parseConstToken(start, end, tokenEnd, falseString))
+            return BOOL_FALSE;
+        break;
+    case '[':
+        *tokenEnd = start + 1;
+        return ARRAY_BEGIN;
+    case ']':
+        *tokenEnd = start + 1;
+        return ARRAY_END;
+    case ',':
+        *tokenEnd = start + 1;
+        return LIST_SEPARATOR;
+    case '{':
+        *tokenEnd = start + 1;
+        return OBJECT_BEGIN;
+    case '}':
+        *tokenEnd = start + 1;
+        return OBJECT_END;
+    case ':':
+        *tokenEnd = start + 1;
+        return OBJECT_PAIR_SEPARATOR;
+    case '0':
+    case '1':
+    case '2':
+    case '3':
+    case '4':
+    case '5':
+    case '6':
+    case '7':
+    case '8':
+    case '9':
+    case '-':
+        if (parseNumberToken(start, end, tokenEnd))
+            return NUMBER;
+        break;
+    case '"':
+        if (parseStringToken(start + 1, end, tokenEnd))
+            return STRING;
+        break;
+    }
+
+    return INVALID_TOKEN;
+}
+
+bool decodeString(const UChar* start, const UChar* end, StringBuilder& output)
+{
+    while (start < end) {
+        UChar c = *start++;
+        if ('\\' != c) {
+            output.append(c);
+            continue;
+        }
+        c = *start++;
+        switch (c) {
+        case '"':
+        case '/':
+        case '\\':
+            break;
+        case 'b':
+            c = '\b';
+            break;
+        case 'f':
+            c = '\f';
+            break;
+        case 'n':
+            c = '\n';
+            break;
+        case 'r':
+            c = '\r';
+            break;
+        case 't':
+            c = '\t';
+            break;
+        case 'v':
+            c = '\v';
+            break;
+        case 'x':
+            c = toASCIIHexValue(start[0], start[1]);
+            start += 2;
+            break;
+        case 'u':
+            c = toASCIIHexValue(start[0], start[1]) << 8 | toASCIIHexValue(start[2], start[3]);
+            start += 4;
+            break;
+        default:
+            return false;
+        }
+        output.append(c);
+    }
+
+    return true;
+}
+
+bool decodeString(const UChar* start, const UChar* end, String& output)
+{
+    if (start == end) {
+        output = emptyString();
+        return true;
+    }
+
+    if (start > end)
+        return false;
+
+    StringBuilder buffer;
+    buffer.reserveCapacity(end - start);
+    if (!decodeString(start, end, buffer))
+        return false;
+
+    output = buffer.toString();
+    return true;
+}
+
+RefPtr<InspectorValue> buildValue(const UChar* start, const UChar* end, const UChar** valueTokenEnd, int depth)
+{
+    if (depth > stackLimit)
+        return nullptr;
+
+    RefPtr<InspectorValue> result;
+    const UChar* tokenStart;
+    const UChar* tokenEnd;
+    Token token = parseToken(start, end, &tokenStart, &tokenEnd);
+    switch (token) {
+    case INVALID_TOKEN:
+        return nullptr;
+    case NULL_TOKEN:
+        result = InspectorValue::null();
+        break;
+    case BOOL_TRUE:
+        result = InspectorValue::create(true);
+        break;
+    case BOOL_FALSE:
+        result = InspectorValue::create(false);
+        break;
+    case NUMBER: {
+        bool ok;
+        double value = charactersToDouble(tokenStart, tokenEnd - tokenStart, &ok);
+        if (!ok)
+            return nullptr;
+        result = InspectorValue::create(value);
+        break;
+    }
+    case STRING: {
+        String value;
+        bool ok = decodeString(tokenStart + 1, tokenEnd - 1, value);
+        if (!ok)
+            return nullptr;
+        result = InspectorValue::create(value);
+        break;
+    }
+    case ARRAY_BEGIN: {
+        Ref<InspectorArray> array = InspectorArray::create();
+        start = tokenEnd;
+        token = parseToken(start, end, &tokenStart, &tokenEnd);
+        while (token != ARRAY_END) {
+            RefPtr<InspectorValue> arrayNode = buildValue(start, end, &tokenEnd, depth + 1);
+            if (!arrayNode)
+                return nullptr;
+            array->pushValue(WTFMove(arrayNode));
+
+            // After a list value, we expect a comma or the end of the list.
+            start = tokenEnd;
+            token = parseToken(start, end, &tokenStart, &tokenEnd);
+            if (token == LIST_SEPARATOR) {
+                start = tokenEnd;
+                token = parseToken(start, end, &tokenStart, &tokenEnd);
+                if (token == ARRAY_END)
+                    return nullptr;
+            } else if (token != ARRAY_END) {
+                // Unexpected value after list value.  Bail out.
+                return nullptr;
+            }
+        }
+        if (token != ARRAY_END)
+            return nullptr;
+        result = WTFMove(array);
+        break;
+    }
+    case OBJECT_BEGIN: {
+        Ref<InspectorObject> object = InspectorObject::create();
+        start = tokenEnd;
+        token = parseToken(start, end, &tokenStart, &tokenEnd);
+        while (token != OBJECT_END) {
+            if (token != STRING)
+                return nullptr;
+            String key;
+            if (!decodeString(tokenStart + 1, tokenEnd - 1, key))
+                return nullptr;
+            start = tokenEnd;
+
+            token = parseToken(start, end, &tokenStart, &tokenEnd);
+            if (token != OBJECT_PAIR_SEPARATOR)
+                return nullptr;
+            start = tokenEnd;
+
+            RefPtr<InspectorValue> value = buildValue(start, end, &tokenEnd, depth + 1);
+            if (!value)
+                return nullptr;
+            object->setValue(key, WTFMove(value));
+            start = tokenEnd;
+
+            // After a key/value pair, we expect a comma or the end of the
+            // object.
+            token = parseToken(start, end, &tokenStart, &tokenEnd);
+            if (token == LIST_SEPARATOR) {
+                start = tokenEnd;
+                token = parseToken(start, end, &tokenStart, &tokenEnd);
+                 if (token == OBJECT_END)
+                    return nullptr;
+            } else if (token != OBJECT_END) {
+                // Unexpected value after last object value.  Bail out.
+                return nullptr;
+            }
+        }
+        if (token != OBJECT_END)
+            return nullptr;
+        result = WTFMove(object);
+        break;
+    }
+
+    default:
+        // We got a token that's not a value.
+        return nullptr;
+    }
+    *valueTokenEnd = tokenEnd;
+    return result;
+}
+
+inline bool escapeChar(UChar c, StringBuilder& dst)
+{
+    switch (c) {
+    case '\b': dst.appendLiteral("\\b"); break;
+    case '\f': dst.appendLiteral("\\f"); break;
+    case '\n': dst.appendLiteral("\\n"); break;
+    case '\r': dst.appendLiteral("\\r"); break;
+    case '\t': dst.appendLiteral("\\t"); break;
+    case '\\': dst.appendLiteral("\\\\"); break;
+    case '"': dst.appendLiteral("\\\""); break;
+    default:
+        return false;
+    }
+    return true;
+}
+
+inline void doubleQuoteString(const String& str, StringBuilder& dst)
+{
+    dst.append('"');
+    for (unsigned i = 0; i < str.length(); ++i) {
+        UChar c = str[i];
+        if (!escapeChar(c, dst)) {
+            if (c < 32 || c > 126 || c == '<' || c == '>') {
+                // 1. Escaping <, > to prevent script execution.
+                // 2. Technically, we could also pass through c > 126 as UTF8, but this
+                //    is also optional.  It would also be a pain to implement here.
+                dst.append(String::format("\\u%04X", c));
+            } else
+                dst.append(c);
+        }
+    }
+    dst.append('"');
+}
+
+} // anonymous namespace
+
+Ref<InspectorValue> InspectorValue::null()
+{
+    return adoptRef(*new InspectorValue);
+}
+
+Ref<InspectorValue> InspectorValue::create(bool value)
+{
+    return adoptRef(*new InspectorValue(value));
+}
+
+Ref<InspectorValue> InspectorValue::create(int value)
+{
+    return adoptRef(*new InspectorValue(value));
+}
+
+Ref<InspectorValue> InspectorValue::create(double value)
+{
+    return adoptRef(*new InspectorValue(value));
+}
+
+Ref<InspectorValue> InspectorValue::create(const String& value)
+{
+    return adoptRef(*new InspectorValue(value));
+}
+
+Ref<InspectorValue> InspectorValue::create(const char* value)
+{
+    return adoptRef(*new InspectorValue(value));
+}
+
+bool InspectorValue::asValue(RefPtr<Inspector::InspectorValue> & value)
+{
+    value = this;
+    return true;
+}
+
+bool InspectorValue::asObject(RefPtr<InspectorObject>&)
+{
+    return false;
+}
+
+bool InspectorValue::asArray(RefPtr<InspectorArray>&)
+{
+    return false;
+}
+
+bool InspectorValue::parseJSON(const String& jsonInput, RefPtr<InspectorValue>& output)
+{
+    // FIXME: This whole file should just use StringView instead of UChar/length and avoid upconverting.
+    auto characters = StringView(jsonInput).upconvertedCharacters();
+    const UChar* start = characters;
+    const UChar* end = start + jsonInput.length();
+    const UChar* tokenEnd;
+    auto result = buildValue(start, end, &tokenEnd, 0);
+    if (!result || tokenEnd != end)
+        return false;
+
+    output = WTFMove(result);
+    return true;
+}
+
+String InspectorValue::toJSONString() const
+{
+    StringBuilder result;
+    result.reserveCapacity(512);
+    writeJSON(result);
+    return result.toString();
+}
+
+bool InspectorValue::asBoolean(bool& output) const
+{
+    if (type() != Type::Boolean)
+        return false;
+
+    output = m_value.boolean;
+    return true;
+}
+
+bool InspectorValue::asDouble(double& output) const
+{
+    if (type() != Type::Double)
+        return false;
+
+    output = m_value.number;
+    return true;
+}
+
+bool InspectorValue::asDouble(float& output) const
+{
+    if (type() != Type::Double)
+        return false;
+
+    output = static_cast<float>(m_value.number);
+    return true;
+}
+
+bool InspectorValue::asInteger(int& output) const
+{
+    if (type() != Type::Integer && type() != Type::Double)
+        return false;
+
+    output = static_cast<int>(m_value.number);
+    return true;
+}
+
+bool InspectorValue::asInteger(unsigned& output) const
+{
+    if (type() != Type::Integer && type() != Type::Double)
+        return false;
+
+    output = static_cast<unsigned>(m_value.number);
+    return true;
+}
+
+bool InspectorValue::asInteger(long& output) const
+{
+    if (type() != Type::Integer && type() != Type::Double)
+        return false;
+
+    output = static_cast<long>(m_value.number);
+    return true;
+}
+
+bool InspectorValue::asInteger(long long& output) const
+{
+    if (type() != Type::Integer && type() != Type::Double)
+        return false;
+
+    output = static_cast<long long>(m_value.number);
+    return true;
+}
+
+bool InspectorValue::asInteger(unsigned long& output) const
+{
+    if (type() != Type::Integer && type() != Type::Double)
+        return false;
+
+    output = static_cast<unsigned long>(m_value.number);
+    return true;
+}
+
+bool InspectorValue::asInteger(unsigned long long& output) const
+{
+    if (type() != Type::Integer && type() != Type::Double)
+        return false;
+
+    output = static_cast<unsigned long long>(m_value.number);
+    return true;
+}
+
+bool InspectorValue::asString(String& output) const
+{
+    if (type() != Type::String)
+        return false;
+
+    output = m_value.string;
+    return true;
+}
+
+void InspectorValue::writeJSON(StringBuilder& output) const
+{
+    switch (m_type) {
+    case Type::Null:
+        output.appendLiteral("null");
+        break;
+    case Type::Boolean:
+        if (m_value.boolean)
+            output.appendLiteral("true");
+        else
+            output.appendLiteral("false");
+        break;
+    case Type::String:
+        doubleQuoteString(m_value.string, output);
+        break;
+    case Type::Double:
+    case Type::Integer: {
+        NumberToLStringBuffer buffer;
+        if (!std::isfinite(m_value.number)) {
+            output.appendLiteral("null");
+            return;
+        }
+        DecimalNumber decimal = m_value.number;
+        unsigned length = 0;
+        if (decimal.bufferLengthForStringDecimal() > WTF::NumberToStringBufferLength) {
+            // Not enough room for decimal. Use exponential format.
+            if (decimal.bufferLengthForStringExponential() > WTF::NumberToStringBufferLength) {
+                // Fallback for an abnormal case if it's too little even for exponential.
+                output.appendLiteral("NaN");
+                return;
+            }
+            length = decimal.toStringExponential(buffer, WTF::NumberToStringBufferLength);
+        } else
+            length = decimal.toStringDecimal(buffer, WTF::NumberToStringBufferLength);
+        output.append(buffer, length);
+        break;
+    }
+    default:
+        ASSERT_NOT_REACHED();
+    }
+}
+
+InspectorObjectBase::~InspectorObjectBase()
+{
+}
+
+bool InspectorObjectBase::asObject(RefPtr<InspectorObject>& output)
+{
+    COMPILE_ASSERT(sizeof(InspectorObject) == sizeof(InspectorObjectBase), cannot_cast);
+
+    output = static_cast<InspectorObject*>(this);
+    return true;
+}
+
+InspectorObject* InspectorObjectBase::openAccessors()
+{
+    COMPILE_ASSERT(sizeof(InspectorObject) == sizeof(InspectorObjectBase), cannot_cast);
+
+    return static_cast<InspectorObject*>(this);
+}
+
+bool InspectorObjectBase::getBoolean(const String& name, bool& output) const
+{
+    RefPtr<InspectorValue> value;
+    if (!getValue(name, value))
+        return false;
+
+    return value->asBoolean(output);
+}
+
+bool InspectorObjectBase::getString(const String& name, String& output) const
+{
+    RefPtr<InspectorValue> value;
+    if (!getValue(name, value))
+        return false;
+
+    return value->asString(output);
+}
+
+bool InspectorObjectBase::getObject(const String& name, RefPtr<InspectorObject>& output) const
+{
+    RefPtr<InspectorValue> value;
+    if (!getValue(name, value))
+        return false;
+
+    return value->asObject(output);
+}
+
+bool InspectorObjectBase::getArray(const String& name, RefPtr<InspectorArray>& output) const
+{
+    RefPtr<InspectorValue> value;
+    if (!getValue(name, value))
+        return false;
+
+    return value->asArray(output);
+}
+
+bool InspectorObjectBase::getValue(const String& name, RefPtr<InspectorValue>& output) const
+{
+    Dictionary::const_iterator findResult = m_map.find(name);
+    if (findResult == m_map.end())
+        return false;
+
+    output = findResult->value;
+    return true;
+}
+
+void InspectorObjectBase::remove(const String& name)
+{
+    m_map.remove(name);
+    m_order.removeFirst(name);
+}
+
+void InspectorObjectBase::writeJSON(StringBuilder& output) const
+{
+    output.append('{');
+    for (size_t i = 0; i < m_order.size(); ++i) {
+        auto findResult = m_map.find(m_order[i]);
+        ASSERT(findResult != m_map.end());
+        if (i)
+            output.append(',');
+        doubleQuoteString(findResult->key, output);
+        output.append(':');
+        findResult->value->writeJSON(output);
+    }
+    output.append('}');
+}
+
+InspectorObjectBase::InspectorObjectBase()
+    : Inspector::InspectorValue(Type::Object)
+    , m_map()
+    , m_order()
+{
+}
+
+InspectorArrayBase::~InspectorArrayBase()
+{
+}
+
+bool InspectorArrayBase::asArray(RefPtr<InspectorArray>& output)
+{
+    COMPILE_ASSERT(sizeof(InspectorArrayBase) == sizeof(InspectorArray), cannot_cast);
+    output = static_cast<InspectorArray*>(this);
+    return true;
+}
+
+void InspectorArrayBase::writeJSON(StringBuilder& output) const
+{
+    output.append('[');
+    for (Vector<RefPtr<InspectorValue>>::const_iterator it = m_map.begin(); it != m_map.end(); ++it) {
+        if (it != m_map.begin())
+            output.append(',');
+        (*it)->writeJSON(output);
+    }
+    output.append(']');
+}
+
+InspectorArrayBase::InspectorArrayBase()
+    : InspectorValue(Type::Array)
+    , m_map()
+{
+}
+
+RefPtr<InspectorValue> InspectorArrayBase::get(size_t index) const
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(index < m_map.size());
+    return m_map[index];
+}
+
+Ref<InspectorObject> InspectorObject::create()
+{
+    return adoptRef(*new InspectorObject);
+}
+
+Ref<InspectorArray> InspectorArray::create()
+{
+    return adoptRef(*new InspectorArray);
+}
+
+} // namespace Inspector
diff --git a/inspector/InspectorValues.h b/inspector/InspectorValues.h
new file mode 100644
index 0000000..6687bba
--- /dev/null
+++ b/inspector/InspectorValues.h
@@ -0,0 +1,410 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSExportMacros.h"
+#include <wtf/Assertions.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class InspectorArray;
+class InspectorArrayBase;
+class InspectorObject;
+class InspectorObjectBase;
+
+class JS_EXPORT_PRIVATE InspectorValue : public RefCounted<InspectorValue> {
+public:
+    static const int maxDepth = 1000;
+
+    virtual ~InspectorValue()
+    {
+        switch (m_type) {
+        case Type::Null:
+        case Type::Boolean:
+        case Type::Double:
+        case Type::Integer:
+            break;
+        case Type::String:
+            if (m_value.string)
+                m_value.string->deref();
+            break;
+        case Type::Object:
+        case Type::Array:
+            break;
+        }
+    }
+
+    static Ref<InspectorValue> null();
+    static Ref<InspectorValue> create(bool);
+    static Ref<InspectorValue> create(int);
+    static Ref<InspectorValue> create(double);
+    static Ref<InspectorValue> create(const String&);
+    static Ref<InspectorValue> create(const char*);
+
+    enum class Type {
+        Null = 0,
+        Boolean,
+        Double,
+        Integer,
+        String,
+        Object,
+        Array,
+    };
+
+    Type type() const { return m_type; }
+    bool isNull() const { return m_type == Type::Null; }
+
+    bool asBoolean(bool&) const;
+    bool asInteger(int&) const;
+    bool asInteger(unsigned&) const;
+    bool asInteger(long&) const;
+    bool asInteger(long long&) const;
+    bool asInteger(unsigned long&) const;
+    bool asInteger(unsigned long long&) const;
+    bool asDouble(double&) const;
+    bool asDouble(float&) const;
+    bool asString(String&) const;
+    bool asValue(RefPtr<InspectorValue>&);
+
+    virtual bool asObject(RefPtr<InspectorObject>&);
+    virtual bool asArray(RefPtr<InspectorArray>&);
+
+    static bool parseJSON(const String& jsonInput, RefPtr<InspectorValue>& output);
+
+    String toJSONString() const;
+    virtual void writeJSON(StringBuilder& output) const;
+
+protected:
+    InspectorValue()
+        : m_type(Type::Null) { }
+
+    explicit InspectorValue(Type type)
+        : m_type(type) { }
+
+    explicit InspectorValue(bool value)
+        : m_type(Type::Boolean)
+    {
+        m_value.boolean = value;
+    }
+
+    explicit InspectorValue(int value)
+        : m_type(Type::Integer)
+    {
+        m_value.number = static_cast<double>(value);
+    }
+
+    explicit InspectorValue(double value)
+        : m_type(Type::Double)
+    {
+        m_value.number = value;
+    }
+
+    explicit InspectorValue(const String& value)
+        : m_type(Type::String)
+    {
+        m_value.string = value.impl();
+        if (m_value.string)
+            m_value.string->ref();
+    }
+
+    explicit InspectorValue(const char* value)
+        : m_type(Type::String)
+    {
+        String wrapper(value);
+        m_value.string = wrapper.impl();
+        if (m_value.string)
+            m_value.string->ref();
+    }
+
+private:
+    Type m_type { Type::Null };
+    union {
+        bool boolean;
+        double number;
+        StringImpl* string;
+    } m_value;
+};
+
+class JS_EXPORT_PRIVATE InspectorObjectBase : public InspectorValue {
+private:
+    typedef HashMap<String, RefPtr<InspectorValue>> Dictionary;
+
+public:
+    typedef Dictionary::iterator iterator;
+    typedef Dictionary::const_iterator const_iterator;
+
+    InspectorObject* openAccessors();
+
+protected:
+    virtual ~InspectorObjectBase();
+
+    bool asObject(RefPtr<InspectorObject>& output) override;
+
+    // FIXME: use templates to reduce the amount of duplicated set*() methods.
+    void setBoolean(const String& name, bool);
+    void setInteger(const String& name, int);
+    void setDouble(const String& name, double);
+    void setString(const String& name, const String&);
+    void setValue(const String& name, RefPtr<InspectorValue>&&);
+    void setObject(const String& name, RefPtr<InspectorObjectBase>&&);
+    void setArray(const String& name, RefPtr<InspectorArrayBase>&&);
+
+    iterator find(const String& name);
+    const_iterator find(const String& name) const;
+
+    // FIXME: use templates to reduce the amount of duplicated get*() methods.
+    bool getBoolean(const String& name, bool& output) const;
+    template<class T> bool getDouble(const String& name, T& output) const
+    {
+        RefPtr<InspectorValue> value;
+        if (!getValue(name, value))
+            return false;
+
+        return value->asDouble(output);
+    }
+    template<class T> bool getInteger(const String& name, T& output) const
+    {
+        RefPtr<InspectorValue> value;
+        if (!getValue(name, value))
+            return false;
+
+        return value->asInteger(output);
+    }
+
+    bool getString(const String& name, String& output) const;
+    bool getObject(const String& name, RefPtr<InspectorObject>&) const;
+    bool getArray(const String& name, RefPtr<InspectorArray>&) const;
+    bool getValue(const String& name, RefPtr<InspectorValue>&) const;
+
+    void remove(const String& name);
+
+    void writeJSON(StringBuilder& output) const override;
+
+    iterator begin() { return m_map.begin(); }
+    iterator end() { return m_map.end(); }
+    const_iterator begin() const { return m_map.begin(); }
+    const_iterator end() const { return m_map.end(); }
+
+    int size() const { return m_map.size(); }
+
+protected:
+    InspectorObjectBase();
+
+private:
+    Dictionary m_map;
+    Vector<String> m_order;
+};
+
+class InspectorObject : public InspectorObjectBase {
+public:
+    static JS_EXPORT_PRIVATE Ref<InspectorObject> create();
+
+    using InspectorObjectBase::asObject;
+
+    using InspectorObjectBase::setBoolean;
+    using InspectorObjectBase::setInteger;
+    using InspectorObjectBase::setDouble;
+    using InspectorObjectBase::setString;
+    using InspectorObjectBase::setValue;
+    using InspectorObjectBase::setObject;
+    using InspectorObjectBase::setArray;
+
+    using InspectorObjectBase::find;
+    using InspectorObjectBase::getBoolean;
+    using InspectorObjectBase::getInteger;
+    using InspectorObjectBase::getDouble;
+    using InspectorObjectBase::getString;
+    using InspectorObjectBase::getObject;
+    using InspectorObjectBase::getArray;
+    using InspectorObjectBase::getValue;
+
+    using InspectorObjectBase::remove;
+
+    using InspectorObjectBase::begin;
+    using InspectorObjectBase::end;
+
+    using InspectorObjectBase::size;
+};
+
+
+class JS_EXPORT_PRIVATE InspectorArrayBase : public InspectorValue {
+public:
+    typedef Vector<RefPtr<InspectorValue>>::iterator iterator;
+    typedef Vector<RefPtr<InspectorValue>>::const_iterator const_iterator;
+
+    unsigned length() const { return static_cast<unsigned>(m_map.size()); }
+
+protected:
+    virtual ~InspectorArrayBase();
+
+    bool asArray(RefPtr<InspectorArray>&) override;
+
+    void pushBoolean(bool);
+    void pushInteger(int);
+    void pushDouble(double);
+    void pushString(const String&);
+    void pushValue(RefPtr<InspectorValue>&&);
+    void pushObject(RefPtr<InspectorObjectBase>&&);
+    void pushArray(RefPtr<InspectorArrayBase>&&);
+
+    RefPtr<InspectorValue> get(size_t index) const;
+
+    void writeJSON(StringBuilder& output) const override;
+
+    iterator begin() { return m_map.begin(); }
+    iterator end() { return m_map.end(); }
+    const_iterator begin() const { return m_map.begin(); }
+    const_iterator end() const { return m_map.end(); }
+
+protected:
+    InspectorArrayBase();
+
+private:
+    Vector<RefPtr<InspectorValue>> m_map;
+};
+
+class InspectorArray : public InspectorArrayBase {
+public:
+    static JS_EXPORT_PRIVATE Ref<InspectorArray> create();
+
+    using InspectorArrayBase::asArray;
+
+    using InspectorArrayBase::pushBoolean;
+    using InspectorArrayBase::pushInteger;
+    using InspectorArrayBase::pushDouble;
+    using InspectorArrayBase::pushString;
+    using InspectorArrayBase::pushValue;
+    using InspectorArrayBase::pushObject;
+    using InspectorArrayBase::pushArray;
+
+    using InspectorArrayBase::get;
+
+    using InspectorArrayBase::begin;
+    using InspectorArrayBase::end;
+};
+
+
+inline InspectorObjectBase::iterator InspectorObjectBase::find(const String& name)
+{
+    return m_map.find(name);
+}
+
+inline InspectorObjectBase::const_iterator InspectorObjectBase::find(const String& name) const
+{
+    return m_map.find(name);
+}
+
+inline void InspectorObjectBase::setBoolean(const String& name, bool value)
+{
+    setValue(name, InspectorValue::create(value));
+}
+
+inline void InspectorObjectBase::setInteger(const String& name, int value)
+{
+    setValue(name, InspectorValue::create(value));
+}
+
+inline void InspectorObjectBase::setDouble(const String& name, double value)
+{
+    setValue(name, InspectorValue::create(value));
+}
+
+inline void InspectorObjectBase::setString(const String& name, const String& value)
+{
+    setValue(name, InspectorValue::create(value));
+}
+
+inline void InspectorObjectBase::setValue(const String& name, RefPtr<InspectorValue>&& value)
+{
+    ASSERT(value);
+    if (m_map.set(name, WTFMove(value)).isNewEntry)
+        m_order.append(name);
+}
+
+inline void InspectorObjectBase::setObject(const String& name, RefPtr<InspectorObjectBase>&& value)
+{
+    ASSERT(value);
+    if (m_map.set(name, WTFMove(value)).isNewEntry)
+        m_order.append(name);
+}
+
+inline void InspectorObjectBase::setArray(const String& name, RefPtr<InspectorArrayBase>&& value)
+{
+    ASSERT(value);
+    if (m_map.set(name, WTFMove(value)).isNewEntry)
+        m_order.append(name);
+}
+
+inline void InspectorArrayBase::pushBoolean(bool value)
+{
+    m_map.append(InspectorValue::create(value));
+}
+
+inline void InspectorArrayBase::pushInteger(int value)
+{
+    m_map.append(InspectorValue::create(value));
+}
+
+inline void InspectorArrayBase::pushDouble(double value)
+{
+    m_map.append(InspectorValue::create(value));
+}
+
+inline void InspectorArrayBase::pushString(const String& value)
+{
+    m_map.append(InspectorValue::create(value));
+}
+
+inline void InspectorArrayBase::pushValue(RefPtr<InspectorValue>&& value)
+{
+    ASSERT(value);
+    m_map.append(WTFMove(value));
+}
+
+inline void InspectorArrayBase::pushObject(RefPtr<InspectorObjectBase>&& value)
+{
+    ASSERT(value);
+    m_map.append(WTFMove(value));
+}
+
+inline void InspectorArrayBase::pushArray(RefPtr<InspectorArrayBase>&& value)
+{
+    ASSERT(value);
+    m_map.append(WTFMove(value));
+}
+
+} // namespace Inspector
diff --git a/inspector/JSGlobalObjectConsoleClient.cpp b/inspector/JSGlobalObjectConsoleClient.cpp
new file mode 100644
index 0000000..8763d27
--- /dev/null
+++ b/inspector/JSGlobalObjectConsoleClient.cpp
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGlobalObjectConsoleClient.h"
+
+#include "ConsoleMessage.h"
+#include "InspectorConsoleAgent.h"
+#include "InspectorDebuggerAgent.h"
+#include "InspectorScriptProfilerAgent.h"
+#include "ScriptArguments.h"
+#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+#if !LOG_DISABLED
+static bool sLogToSystemConsole = true;
+#else
+static bool sLogToSystemConsole = false;
+#endif
+
+bool JSGlobalObjectConsoleClient::logToSystemConsole()
+{
+    return sLogToSystemConsole;
+}
+
+void JSGlobalObjectConsoleClient::setLogToSystemConsole(bool shouldLog)
+{
+    sLogToSystemConsole = shouldLog;
+}
+
+JSGlobalObjectConsoleClient::JSGlobalObjectConsoleClient(InspectorConsoleAgent* consoleAgent, InspectorDebuggerAgent* debuggerAgent, InspectorScriptProfilerAgent* scriptProfilerAgent)
+    : ConsoleClient()
+    , m_consoleAgent(consoleAgent)
+    , m_debuggerAgent(debuggerAgent)
+    , m_scriptProfilerAgent(scriptProfilerAgent)
+{
+}
+
+void JSGlobalObjectConsoleClient::messageWithTypeAndLevel(MessageType type, MessageLevel level, JSC::ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    if (JSGlobalObjectConsoleClient::logToSystemConsole())
+        ConsoleClient::printConsoleMessageWithArguments(MessageSource::ConsoleAPI, type, level, exec, arguments.copyRef());
+
+    String message;
+    arguments->getFirstArgumentAsString(message);
+    m_consoleAgent->addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::ConsoleAPI, type, level, message, WTFMove(arguments), exec));
+}
+
+void JSGlobalObjectConsoleClient::count(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    m_consoleAgent->count(exec, arguments);
+}
+
+void JSGlobalObjectConsoleClient::profile(JSC::ExecState*, const String& title)
+{
+    if (!m_consoleAgent->enabled())
+        return;
+
+    // Allow duplicate unnamed profiles. Disallow duplicate named profiles.
+    if (!title.isEmpty()) {
+        for (auto& existingTitle : m_profiles) {
+            if (existingTitle == title) {
+                // FIXME: Send an enum to the frontend for localization?
+                String warning = title.isEmpty() ? ASCIILiteral("Unnamed Profile already exists") : makeString("Profile \"", title, "\" already exists");
+                m_consoleAgent->addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::ConsoleAPI, MessageType::Profile, MessageLevel::Warning, warning));
+                return;
+            }
+        }
+    }
+
+    m_profiles.append(title);
+    startConsoleProfile();
+}
+
+void JSGlobalObjectConsoleClient::profileEnd(JSC::ExecState*, const String& title)
+{
+    if (!m_consoleAgent->enabled())
+        return;
+
+    // Stop profiles in reverse order. If the title is empty, then stop the last profile.
+    // Otherwise, match the title of the profile to stop.
+    for (ptrdiff_t i = m_profiles.size() - 1; i >= 0; --i) {
+        if (title.isEmpty() || m_profiles[i] == title) {
+            m_profiles.remove(i);
+            if (m_profiles.isEmpty())
+                stopConsoleProfile();
+            return;
+        }
+    }
+
+    // FIXME: Send an enum to the frontend for localization?
+    String warning = title.isEmpty() ? ASCIILiteral("No profiles exist") : makeString("Profile \"", title, "\" does not exist");
+    m_consoleAgent->addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::ConsoleAPI, MessageType::ProfileEnd, MessageLevel::Warning, warning));
+}
+
+void JSGlobalObjectConsoleClient::startConsoleProfile()
+{
+    // FIXME: <https://webkit.org/b/158753> Generalize the concept of Instruments on the backend to work equally for JSContext and Web inspection
+    m_scriptProfilerAgent->programmaticCaptureStarted();
+
+    m_profileRestoreBreakpointActiveValue = m_debuggerAgent->breakpointsActive();
+
+    ErrorString unused;
+    m_debuggerAgent->setBreakpointsActive(unused, false);
+
+    const bool includeSamples = true;
+    m_scriptProfilerAgent->startTracking(unused, &includeSamples);
+}
+
+void JSGlobalObjectConsoleClient::stopConsoleProfile()
+{
+    ErrorString unused;
+    m_scriptProfilerAgent->stopTracking(unused);
+
+    m_debuggerAgent->setBreakpointsActive(unused, m_profileRestoreBreakpointActiveValue);
+
+    // FIXME: <https://webkit.org/b/158753> Generalize the concept of Instruments on the backend to work equally for JSContext and Web inspection
+    m_scriptProfilerAgent->programmaticCaptureStopped();
+}
+
+void JSGlobalObjectConsoleClient::takeHeapSnapshot(JSC::ExecState*, const String& title)
+{
+    m_consoleAgent->takeHeapSnapshot(title);
+}
+
+void JSGlobalObjectConsoleClient::time(ExecState*, const String& title)
+{
+    m_consoleAgent->startTiming(title);
+}
+
+void JSGlobalObjectConsoleClient::timeEnd(ExecState* exec, const String& title)
+{
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForConsole(exec, 1));
+    m_consoleAgent->stopTiming(title, WTFMove(callStack));
+}
+
+void JSGlobalObjectConsoleClient::timeStamp(ExecState*, RefPtr<ScriptArguments>&&)
+{
+    // FIXME: JSContext inspection needs a timeline.
+    warnUnimplemented(ASCIILiteral("console.timeStamp"));
+}
+
+void JSGlobalObjectConsoleClient::warnUnimplemented(const String& method)
+{
+    String message = method + " is currently ignored in JavaScript context inspection.";
+    m_consoleAgent->addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::ConsoleAPI, MessageType::Log, MessageLevel::Warning, message, nullptr, nullptr));
+}
+
+} // namespace Inspector
diff --git a/inspector/JSGlobalObjectConsoleClient.h b/inspector/JSGlobalObjectConsoleClient.h
new file mode 100644
index 0000000..527ffd9
--- /dev/null
+++ b/inspector/JSGlobalObjectConsoleClient.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConsoleClient.h"
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class InspectorConsoleAgent;
+class InspectorDebuggerAgent;
+class InspectorScriptProfilerAgent;
+
+class JSGlobalObjectConsoleClient final : public JSC::ConsoleClient {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    explicit JSGlobalObjectConsoleClient(InspectorConsoleAgent*, InspectorDebuggerAgent*, InspectorScriptProfilerAgent*);
+    virtual ~JSGlobalObjectConsoleClient() { }
+
+    static bool logToSystemConsole();
+    static void setLogToSystemConsole(bool);
+
+protected:
+    void messageWithTypeAndLevel(MessageType, MessageLevel, JSC::ExecState*, RefPtr<ScriptArguments>&&) override;
+    void count(JSC::ExecState*, RefPtr<ScriptArguments>&&) override;
+    void profile(JSC::ExecState*, const String& title) override;
+    void profileEnd(JSC::ExecState*, const String& title) override;
+    void takeHeapSnapshot(JSC::ExecState*, const String& title) override;
+    void time(JSC::ExecState*, const String& title) override;
+    void timeEnd(JSC::ExecState*, const String& title) override;
+    void timeStamp(JSC::ExecState*, RefPtr<ScriptArguments>&&) override;
+
+private:
+    void warnUnimplemented(const String& method);
+    void internalAddMessage(MessageType, MessageLevel, JSC::ExecState*, RefPtr<ScriptArguments>&&);
+
+    void startConsoleProfile();
+    void stopConsoleProfile();
+
+    InspectorConsoleAgent* m_consoleAgent;
+    InspectorDebuggerAgent* m_debuggerAgent;
+    InspectorScriptProfilerAgent* m_scriptProfilerAgent;
+    Vector<String> m_profiles;
+    bool m_profileRestoreBreakpointActiveValue { false };
+};
+
+}
diff --git a/inspector/JSGlobalObjectInspectorController.cpp b/inspector/JSGlobalObjectInspectorController.cpp
new file mode 100644
index 0000000..4fb7d79
--- /dev/null
+++ b/inspector/JSGlobalObjectInspectorController.cpp
@@ -0,0 +1,315 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGlobalObjectInspectorController.h"
+
+#include "Completion.h"
+#include "ConsoleMessage.h"
+#include "ErrorHandlingScope.h"
+#include "Exception.h"
+#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
+#include "InspectorAgent.h"
+#include "InspectorBackendDispatcher.h"
+#include "InspectorFrontendChannel.h"
+#include "InspectorFrontendRouter.h"
+#include "InspectorHeapAgent.h"
+#include "InspectorScriptProfilerAgent.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSGlobalObjectConsoleAgent.h"
+#include "JSGlobalObjectConsoleClient.h"
+#include "JSGlobalObjectDebuggerAgent.h"
+#include "JSGlobalObjectRuntimeAgent.h"
+#include "ScriptArguments.h"
+#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
+#include <wtf/Stopwatch.h>
+
+#if OS(DARWIN) || (OS(LINUX) && !PLATFORM(GTK))
+#include <cxxabi.h>
+#include <dlfcn.h>
+#include <execinfo.h>
+#endif
+
+#if ENABLE(REMOTE_INSPECTOR)
+#include "JSGlobalObjectDebuggable.h"
+#include "RemoteInspector.h"
+#endif
+
+using namespace JSC;
+
+namespace Inspector {
+
+JSGlobalObjectInspectorController::JSGlobalObjectInspectorController(JSGlobalObject& globalObject)
+    : m_globalObject(globalObject)
+    , m_injectedScriptManager(std::make_unique<InjectedScriptManager>(*this, InjectedScriptHost::create()))
+    , m_executionStopwatch(Stopwatch::create())
+    , m_scriptDebugServer(globalObject)
+    , m_frontendRouter(FrontendRouter::create())
+    , m_backendDispatcher(BackendDispatcher::create(m_frontendRouter.copyRef()))
+{
+    AgentContext baseContext = {
+        *this,
+        *m_injectedScriptManager,
+        m_frontendRouter.get(),
+        m_backendDispatcher.get()
+    };
+
+    JSAgentContext context = {
+        baseContext,
+        globalObject
+    };
+
+    auto inspectorAgent = std::make_unique<InspectorAgent>(context);
+    auto runtimeAgent = std::make_unique<JSGlobalObjectRuntimeAgent>(context);
+    auto heapAgent = std::make_unique<InspectorHeapAgent>(context);
+    auto consoleAgent = std::make_unique<JSGlobalObjectConsoleAgent>(context, heapAgent.get());
+    auto debuggerAgent = std::make_unique<JSGlobalObjectDebuggerAgent>(context, consoleAgent.get());
+    auto scriptProfilerAgent = std::make_unique<InspectorScriptProfilerAgent>(context);
+
+    m_inspectorAgent = inspectorAgent.get();
+    m_debuggerAgent = debuggerAgent.get();
+    m_consoleAgent = consoleAgent.get();
+    m_consoleClient = std::make_unique<JSGlobalObjectConsoleClient>(m_consoleAgent, m_debuggerAgent, scriptProfilerAgent.get());
+
+    m_agents.append(WTFMove(inspectorAgent));
+    m_agents.append(WTFMove(runtimeAgent));
+    m_agents.append(WTFMove(consoleAgent));
+    m_agents.append(WTFMove(debuggerAgent));
+    m_agents.append(WTFMove(heapAgent));
+    m_agents.append(WTFMove(scriptProfilerAgent));
+
+    m_executionStopwatch->start();
+}
+
+JSGlobalObjectInspectorController::~JSGlobalObjectInspectorController()
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_augmentingClient)
+        m_augmentingClient->inspectorControllerDestroyed();
+#endif
+}
+
+void JSGlobalObjectInspectorController::globalObjectDestroyed()
+{
+    ASSERT(!m_frontendRouter->hasFrontends());
+
+    m_injectedScriptManager->disconnect();
+
+    m_agents.discardValues();
+}
+
+void JSGlobalObjectInspectorController::connectFrontend(FrontendChannel* frontendChannel, bool isAutomaticInspection)
+{
+    ASSERT_ARG(frontendChannel, frontendChannel);
+
+    m_isAutomaticInspection = isAutomaticInspection;
+
+    bool connectedFirstFrontend = !m_frontendRouter->hasFrontends();
+    m_frontendRouter->connectFrontend(frontendChannel);
+
+    if (!connectedFirstFrontend)
+        return;
+
+    // Keep the JSGlobalObject and VM alive while we are debugging it.
+    m_strongVM = &m_globalObject.vm();
+    m_strongGlobalObject.set(m_globalObject.vm(), &m_globalObject);
+
+    // FIXME: change this to notify agents which frontend has connected (by id).
+    m_agents.didCreateFrontendAndBackend(nullptr, nullptr);
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    m_inspectorAgent->activateExtraDomains(m_agents.extraDomains());
+
+    if (m_augmentingClient)
+        m_augmentingClient->inspectorConnected();
+#endif
+}
+
+void JSGlobalObjectInspectorController::disconnectFrontend(FrontendChannel* frontendChannel)
+{
+    ASSERT_ARG(frontendChannel, frontendChannel);
+
+    // FIXME: change this to notify agents which frontend has disconnected (by id).
+    m_agents.willDestroyFrontendAndBackend(DisconnectReason::InspectorDestroyed);
+
+    m_frontendRouter->disconnectFrontend(frontendChannel);
+
+    m_isAutomaticInspection = false;
+
+    bool disconnectedLastFrontend = !m_frontendRouter->hasFrontends();
+    if (!disconnectedLastFrontend)
+        return;
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_augmentingClient)
+        m_augmentingClient->inspectorDisconnected();
+#endif
+
+    // Remove our JSGlobalObject and VM references, we are done debugging it.
+    m_strongGlobalObject.clear();
+    m_strongVM = nullptr;
+}
+
+void JSGlobalObjectInspectorController::dispatchMessageFromFrontend(const String& message)
+{
+    m_backendDispatcher->dispatch(message);
+}
+
+void JSGlobalObjectInspectorController::pause()
+{
+    ErrorString dummyError;
+    m_debuggerAgent->enable(dummyError);
+    m_debuggerAgent->pause(dummyError);
+}
+
+void JSGlobalObjectInspectorController::appendAPIBacktrace(ScriptCallStack* callStack)
+{
+#if OS(DARWIN) || (OS(LINUX) && !PLATFORM(GTK))
+    static const int framesToShow = 31;
+    static const int framesToSkip = 3; // WTFGetBacktrace, appendAPIBacktrace, reportAPIException.
+
+    void* samples[framesToShow + framesToSkip];
+    int frames = framesToShow + framesToSkip;
+    WTFGetBacktrace(samples, &frames);
+
+    void** stack = samples + framesToSkip;
+    int size = frames - framesToSkip;
+    for (int i = 0; i < size; ++i) {
+        const char* mangledName = nullptr;
+        char* cxaDemangled = nullptr;
+        Dl_info info;
+        if (dladdr(stack[i], &info) && info.dli_sname)
+            mangledName = info.dli_sname;
+        if (mangledName)
+            cxaDemangled = abi::__cxa_demangle(mangledName, nullptr, nullptr, nullptr);
+        if (mangledName || cxaDemangled)
+            callStack->append(ScriptCallFrame(cxaDemangled ? cxaDemangled : mangledName, ASCIILiteral("[native code]"), noSourceID, 0, 0));
+        else
+            callStack->append(ScriptCallFrame(ASCIILiteral("?"), ASCIILiteral("[native code]"), noSourceID, 0, 0));
+        free(cxaDemangled);
+    }
+#else
+    UNUSED_PARAM(callStack);
+#endif
+}
+
+void JSGlobalObjectInspectorController::reportAPIException(ExecState* exec, Exception* exception)
+{
+    if (isTerminatedExecutionException(exception))
+        return;
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    ErrorHandlingScope errorScope(vm);
+
+    RefPtr<ScriptCallStack> callStack = createScriptCallStackFromException(exec, exception, ScriptCallStack::maxCallStackSizeToCapture);
+    if (includesNativeCallStackWhenReportingExceptions())
+        appendAPIBacktrace(callStack.get());
+
+    // FIXME: <http://webkit.org/b/115087> Web Inspector: Should not evaluate JavaScript handling exceptions
+    // If this is a custom exception object, call toString on it to try and get a nice string representation for the exception.
+    String errorMessage = exception->value().toWTFString(exec);
+    scope.clearException();
+
+    if (JSGlobalObjectConsoleClient::logToSystemConsole()) {
+        if (callStack->size()) {
+            const ScriptCallFrame& callFrame = callStack->at(0);
+            ConsoleClient::printConsoleMessage(MessageSource::JS, MessageType::Log, MessageLevel::Error, errorMessage, callFrame.sourceURL(), callFrame.lineNumber(), callFrame.columnNumber());
+        } else
+            ConsoleClient::printConsoleMessage(MessageSource::JS, MessageType::Log, MessageLevel::Error, errorMessage, String(), 0, 0);
+    }
+
+    m_consoleAgent->addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::JS, MessageType::Log, MessageLevel::Error, errorMessage, callStack));
+}
+
+ConsoleClient* JSGlobalObjectInspectorController::consoleClient() const
+{
+    return m_consoleClient.get();
+}
+
+bool JSGlobalObjectInspectorController::developerExtrasEnabled() const
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    if (!RemoteInspector::singleton().enabled())
+        return false;
+
+    if (!m_globalObject.inspectorDebuggable().remoteDebuggingAllowed())
+        return false;
+#endif
+
+    return true;
+}
+
+InspectorFunctionCallHandler JSGlobalObjectInspectorController::functionCallHandler() const
+{
+    return JSC::call;
+}
+
+InspectorEvaluateHandler JSGlobalObjectInspectorController::evaluateHandler() const
+{
+    return JSC::evaluate;
+}
+
+void JSGlobalObjectInspectorController::frontendInitialized()
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    if (m_isAutomaticInspection)
+        m_globalObject.inspectorDebuggable().unpauseForInitializedInspector();
+#endif
+}
+
+Ref<Stopwatch> JSGlobalObjectInspectorController::executionStopwatch()
+{
+    return m_executionStopwatch.copyRef();
+}
+
+JSGlobalObjectScriptDebugServer& JSGlobalObjectInspectorController::scriptDebugServer()
+{
+    return m_scriptDebugServer;
+}
+
+VM& JSGlobalObjectInspectorController::vm()
+{
+    return m_globalObject.vm();
+}
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+void JSGlobalObjectInspectorController::appendExtraAgent(std::unique_ptr<InspectorAgentBase> agent)
+{
+    String domainName = agent->domainName();
+
+    // FIXME: change this to notify agents which frontend has connected (by id).
+    agent->didCreateFrontendAndBackend(nullptr, nullptr);
+
+    m_agents.appendExtraAgent(WTFMove(agent));
+
+    m_inspectorAgent->activateExtraDomain(domainName);
+}
+#endif
+
+} // namespace Inspector
diff --git a/inspector/JSGlobalObjectInspectorController.h b/inspector/JSGlobalObjectInspectorController.h
new file mode 100644
index 0000000..f3feafd
--- /dev/null
+++ b/inspector/JSGlobalObjectInspectorController.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorAgentRegistry.h"
+#include "InspectorEnvironment.h"
+#include "InspectorFrontendRouter.h"
+#include "JSGlobalObjectScriptDebugServer.h"
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "AugmentableInspectorController.h"
+#endif
+
+namespace JSC {
+class ConsoleClient;
+class Exception;
+class ExecState;
+class JSGlobalObject;
+}
+
+namespace Inspector {
+
+class BackendDispatcher;
+class FrontendChannel;
+class InjectedScriptManager;
+class InspectorAgent;
+class InspectorConsoleAgent;
+class InspectorDebuggerAgent;
+class InspectorScriptProfilerAgent;
+class JSGlobalObjectConsoleClient;
+class ScriptCallStack;
+
+class JSGlobalObjectInspectorController final
+    : public InspectorEnvironment
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    , public AugmentableInspectorController
+#endif
+{
+    WTF_MAKE_NONCOPYABLE(JSGlobalObjectInspectorController);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JSGlobalObjectInspectorController(JSC::JSGlobalObject&);
+    ~JSGlobalObjectInspectorController();
+
+    void connectFrontend(FrontendChannel*, bool isAutomaticInspection);
+    void disconnectFrontend(FrontendChannel*);
+
+    void dispatchMessageFromFrontend(const String&);
+
+    void globalObjectDestroyed();
+
+    bool includesNativeCallStackWhenReportingExceptions() const { return m_includeNativeCallStackWithExceptions; }
+    void setIncludesNativeCallStackWhenReportingExceptions(bool includesNativeCallStack) { m_includeNativeCallStackWithExceptions = includesNativeCallStack; }
+
+    void pause();
+    void reportAPIException(JSC::ExecState*, JSC::Exception*);
+
+    JSC::ConsoleClient* consoleClient() const;
+
+    bool developerExtrasEnabled() const override;
+    bool canAccessInspectedScriptState(JSC::ExecState*) const override { return true; }
+    InspectorFunctionCallHandler functionCallHandler() const override;
+    InspectorEvaluateHandler evaluateHandler() const override;
+    void frontendInitialized() override;
+    Ref<WTF::Stopwatch> executionStopwatch() override;
+    JSGlobalObjectScriptDebugServer& scriptDebugServer() override;
+    JSC::VM& vm() override;
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    AugmentableInspectorControllerClient* augmentableInspectorControllerClient() const override { return m_augmentingClient; } 
+    void setAugmentableInspectorControllerClient(AugmentableInspectorControllerClient* client) override { m_augmentingClient = client; }
+
+    const FrontendRouter& frontendRouter() const override { return m_frontendRouter.get(); }
+    BackendDispatcher& backendDispatcher() override { return m_backendDispatcher.get(); }
+    void appendExtraAgent(std::unique_ptr<InspectorAgentBase>) override;
+#endif
+
+private:
+    void appendAPIBacktrace(ScriptCallStack* callStack);
+
+    JSC::JSGlobalObject& m_globalObject;
+    std::unique_ptr<InjectedScriptManager> m_injectedScriptManager;
+    std::unique_ptr<JSGlobalObjectConsoleClient> m_consoleClient;
+    Ref<WTF::Stopwatch> m_executionStopwatch;
+    JSGlobalObjectScriptDebugServer m_scriptDebugServer;
+
+    AgentRegistry m_agents;
+    InspectorAgent* m_inspectorAgent { nullptr };
+    InspectorConsoleAgent* m_consoleAgent { nullptr };
+    InspectorDebuggerAgent* m_debuggerAgent { nullptr };
+
+    Ref<FrontendRouter> m_frontendRouter;
+    Ref<BackendDispatcher> m_backendDispatcher;
+
+    // Used to keep the JSGlobalObject and VM alive while we are debugging it.
+    JSC::Strong<JSC::JSGlobalObject> m_strongGlobalObject;
+    RefPtr<JSC::VM> m_strongVM;
+
+    bool m_includeNativeCallStackWithExceptions { true };
+    bool m_isAutomaticInspection { false };
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    AugmentableInspectorControllerClient* m_augmentingClient { nullptr };
+#endif
+};
+
+} // namespace Inspector
diff --git a/inspector/JSGlobalObjectScriptDebugServer.cpp b/inspector/JSGlobalObjectScriptDebugServer.cpp
new file mode 100644
index 0000000..667438b
--- /dev/null
+++ b/inspector/JSGlobalObjectScriptDebugServer.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGlobalObjectScriptDebugServer.h"
+
+#include "EventLoop.h"
+#include "JSCInlines.h"
+#include "JSLock.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+JSGlobalObjectScriptDebugServer::JSGlobalObjectScriptDebugServer(JSGlobalObject& globalObject)
+    : ScriptDebugServer(globalObject.vm())
+    , m_globalObject(globalObject)
+{
+}
+
+void JSGlobalObjectScriptDebugServer::attachDebugger()
+{
+    attach(&m_globalObject);
+}
+
+void JSGlobalObjectScriptDebugServer::detachDebugger(bool isBeingDestroyed)
+{
+    detach(&m_globalObject, isBeingDestroyed ? Debugger::GlobalObjectIsDestructing : Debugger::TerminatingDebuggingSession);
+    if (!isBeingDestroyed)
+        recompileAllJSFunctions();
+}
+
+void JSGlobalObjectScriptDebugServer::runEventLoopWhilePaused()
+{
+    // Drop all locks so another thread can work in the VM while we are nested.
+    JSC::JSLock::DropAllLocks dropAllLocks(&m_globalObject.vm());
+
+    EventLoop loop;
+    while (!m_doneProcessingDebuggerEvents && !loop.ended())
+        loop.cycle();
+}
+
+} // namespace Inspector
diff --git a/inspector/JSGlobalObjectScriptDebugServer.h b/inspector/JSGlobalObjectScriptDebugServer.h
new file mode 100644
index 0000000..6c63be0
--- /dev/null
+++ b/inspector/JSGlobalObjectScriptDebugServer.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ScriptDebugServer.h"
+
+namespace Inspector {
+
+class JSGlobalObjectScriptDebugServer final : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(JSGlobalObjectScriptDebugServer);
+public:
+    JSGlobalObjectScriptDebugServer(JSC::JSGlobalObject&);
+    virtual ~JSGlobalObjectScriptDebugServer() { }
+
+    JSC::JSGlobalObject& globalObject() const { return m_globalObject; }
+
+private:
+    void attachDebugger() override;
+    void detachDebugger(bool isBeingDestroyed) override;
+
+    void didPause(JSC::JSGlobalObject*) override { }
+    void didContinue(JSC::JSGlobalObject*) override { }
+    void runEventLoopWhilePaused() override;
+    bool isContentScript(JSC::ExecState*) const override { return false; }
+
+    // NOTE: Currently all exceptions are reported at the API boundary through reportAPIException.
+    // Until a time comes where an exception can be caused outside of the API (e.g. setTimeout
+    // or some other async operation in a pure JSContext) we can ignore exceptions reported here.
+    void reportException(JSC::ExecState*, JSC::Exception*) const override { }
+
+    JSC::JSGlobalObject& m_globalObject;
+};
+
+} // namespace Inspector
diff --git a/inspector/JSInjectedScriptHost.cpp b/inspector/JSInjectedScriptHost.cpp
new file mode 100644
index 0000000..eb59171
--- /dev/null
+++ b/inspector/JSInjectedScriptHost.cpp
@@ -0,0 +1,586 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInjectedScriptHost.h"
+
+#include "BuiltinNames.h"
+#include "Completion.h"
+#include "DateInstance.h"
+#include "DirectArguments.h"
+#include "Error.h"
+#include "InjectedScriptHost.h"
+#include "IteratorOperations.h"
+#include "JSArray.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSInjectedScriptHostPrototype.h"
+#include "JSMap.h"
+#include "JSMapIterator.h"
+#include "JSPromise.h"
+#include "JSPropertyNameIterator.h"
+#include "JSSet.h"
+#include "JSSetIterator.h"
+#include "JSStringIterator.h"
+#include "JSTypedArrays.h"
+#include "JSWeakMap.h"
+#include "JSWeakSet.h"
+#include "JSWithScope.h"
+#include "ObjectConstructor.h"
+#include "ProxyObject.h"
+#include "RegExpObject.h"
+#include "ScopedArguments.h"
+#include "SourceCode.h"
+#include "TypedArrayInlines.h"
+#include "WeakMapData.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+const ClassInfo JSInjectedScriptHost::s_info = { "InjectedScriptHost", &Base::s_info, 0, CREATE_METHOD_TABLE(JSInjectedScriptHost) };
+
+JSInjectedScriptHost::JSInjectedScriptHost(VM& vm, Structure* structure, Ref<InjectedScriptHost>&& impl)
+    : JSDestructibleObject(vm, structure)
+    , m_wrapped(WTFMove(impl))
+{
+}
+
+void JSInjectedScriptHost::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+JSObject* JSInjectedScriptHost::createPrototype(VM& vm, JSGlobalObject* globalObject)
+{
+    return JSInjectedScriptHostPrototype::create(vm, globalObject, JSInjectedScriptHostPrototype::createStructure(vm, globalObject, globalObject->objectPrototype()));
+}
+
+void JSInjectedScriptHost::destroy(JSC::JSCell* cell)
+{
+    JSInjectedScriptHost* thisObject = static_cast<JSInjectedScriptHost*>(cell);
+    thisObject->JSInjectedScriptHost::~JSInjectedScriptHost();
+}
+
+JSValue JSInjectedScriptHost::evaluate(ExecState* exec) const
+{
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return globalObject->evalFunction();
+}
+
+JSValue JSInjectedScriptHost::evaluateWithScopeExtension(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue scriptValue = exec->argument(0);
+    if (!scriptValue.isString())
+        return throwTypeError(exec, scope, ASCIILiteral("InjectedScriptHost.evaluateWithScopeExtension first argument must be a string."));
+
+    String program = asString(scriptValue)->value(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    NakedPtr<Exception> exception;
+    JSObject* scopeExtension = exec->argument(1).getObject();
+    JSValue result = JSC::evaluateWithScopeExtension(exec, makeSource(program), scopeExtension, exception);
+    if (exception)
+        throwException(exec, scope, exception);
+
+    return result;
+}
+
+JSValue JSInjectedScriptHost::internalConstructorName(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    JSObject* object = jsCast<JSObject*>(exec->uncheckedArgument(0).toThis(exec, NotStrictMode));
+    return jsString(exec, JSObject::calculatedClassName(object));
+}
+
+JSValue JSInjectedScriptHost::isHTMLAllCollection(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    JSValue value = exec->uncheckedArgument(0);
+    return jsBoolean(impl().isHTMLAllCollection(value));
+}
+
+JSValue JSInjectedScriptHost::subtype(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    JSValue value = exec->uncheckedArgument(0);
+    if (value.isString())
+        return exec->vm().smallStrings.stringString();
+    if (value.isBoolean())
+        return exec->vm().smallStrings.booleanString();
+    if (value.isNumber())
+        return exec->vm().smallStrings.numberString();
+    if (value.isSymbol())
+        return exec->vm().smallStrings.symbolString();
+
+    JSObject* object = asObject(value);
+    if (object) {
+        if (object->isErrorInstance())
+            return jsNontrivialString(exec, ASCIILiteral("error"));
+
+        // Consider class constructor functions class objects.
+        JSFunction* function = jsDynamicCast<JSFunction*>(value);
+        if (function && function->isClassConstructorFunction())
+            return jsNontrivialString(exec, ASCIILiteral("class"));
+    }
+
+    if (value.inherits(JSArray::info()))
+        return jsNontrivialString(exec, ASCIILiteral("array"));
+    if (value.inherits(DirectArguments::info()) || value.inherits(ScopedArguments::info()))
+        return jsNontrivialString(exec, ASCIILiteral("array"));
+
+    if (value.inherits(DateInstance::info()))
+        return jsNontrivialString(exec, ASCIILiteral("date"));
+    if (value.inherits(RegExpObject::info()))
+        return jsNontrivialString(exec, ASCIILiteral("regexp"));
+    if (value.inherits(ProxyObject::info()))
+        return jsNontrivialString(exec, ASCIILiteral("proxy"));
+
+    if (value.inherits(JSMap::info()))
+        return jsNontrivialString(exec, ASCIILiteral("map"));
+    if (value.inherits(JSSet::info()))
+        return jsNontrivialString(exec, ASCIILiteral("set"));
+    if (value.inherits(JSWeakMap::info()))
+        return jsNontrivialString(exec, ASCIILiteral("weakmap"));
+    if (value.inherits(JSWeakSet::info()))
+        return jsNontrivialString(exec, ASCIILiteral("weakset"));
+
+    if (value.inherits(JSMapIterator::info())
+        || value.inherits(JSSetIterator::info())
+        || value.inherits(JSStringIterator::info())
+        || value.inherits(JSPropertyNameIterator::info()))
+        return jsNontrivialString(exec, ASCIILiteral("iterator"));
+
+    if (object && object->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().arrayIteratorNextIndexPrivateName()))
+        return jsNontrivialString(exec, ASCIILiteral("iterator"));
+
+    if (value.inherits(JSInt8Array::info()) || value.inherits(JSInt16Array::info()) || value.inherits(JSInt32Array::info()))
+        return jsNontrivialString(exec, ASCIILiteral("array"));
+    if (value.inherits(JSUint8Array::info()) || value.inherits(JSUint16Array::info()) || value.inherits(JSUint32Array::info()))
+        return jsNontrivialString(exec, ASCIILiteral("array"));
+    if (value.inherits(JSFloat32Array::info()) || value.inherits(JSFloat64Array::info()))
+        return jsNontrivialString(exec, ASCIILiteral("array"));
+
+    return impl().subtype(exec, value);
+}
+
+JSValue JSInjectedScriptHost::functionDetails(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    JSValue value = exec->uncheckedArgument(0);
+    if (!value.asCell()->inherits(JSFunction::info()))
+        return jsUndefined();
+
+    // FIXME: This should provide better details for JSBoundFunctions.
+
+    JSFunction* function = jsCast<JSFunction*>(value);
+    const SourceCode* sourceCode = function->sourceCode();
+    if (!sourceCode)
+        return jsUndefined();
+
+    // In the inspector protocol all positions are 0-based while in SourceCode they are 1-based
+    int lineNumber = sourceCode->firstLine().oneBasedInt();
+    if (lineNumber)
+        lineNumber -= 1;
+    int columnNumber = sourceCode->startColumn().oneBasedInt();
+    if (columnNumber)
+        columnNumber -= 1;
+
+    VM& vm = exec->vm();
+    String scriptID = String::number(sourceCode->provider()->asID());
+    JSObject* location = constructEmptyObject(exec);
+    location->putDirect(vm, Identifier::fromString(exec, "scriptId"), jsString(exec, scriptID));
+    location->putDirect(vm, Identifier::fromString(exec, "lineNumber"), jsNumber(lineNumber));
+    location->putDirect(vm, Identifier::fromString(exec, "columnNumber"), jsNumber(columnNumber));
+
+    JSObject* result = constructEmptyObject(exec);
+    result->putDirect(vm, Identifier::fromString(exec, "location"), location);
+
+    String name = function->name(vm);
+    if (!name.isEmpty())
+        result->putDirect(vm, Identifier::fromString(exec, "name"), jsString(exec, name));
+
+    String displayName = function->displayName(vm);
+    if (!displayName.isEmpty())
+        result->putDirect(vm, Identifier::fromString(exec, "displayName"), jsString(exec, displayName));
+
+    // FIXME: provide function scope data in "scopesRaw" property when JSC supports it.
+    // <https://webkit.org/b/87192> [JSC] expose function (closure) inner context to debugger
+
+    return result;
+}
+
+static JSObject* constructInternalProperty(ExecState* exec, const String& name, JSValue value)
+{
+    JSObject* result = constructEmptyObject(exec);
+    result->putDirect(exec->vm(), Identifier::fromString(exec, "name"), jsString(exec, name));
+    result->putDirect(exec->vm(), Identifier::fromString(exec, "value"), value);
+    return result;
+}
+
+JSValue JSInjectedScriptHost::getInternalProperties(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue value = exec->uncheckedArgument(0);
+
+    if (JSPromise* promise = jsDynamicCast<JSPromise*>(value)) {
+        unsigned index = 0;
+        JSArray* array = constructEmptyArray(exec, nullptr);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        switch (promise->status(exec->vm())) {
+        case JSPromise::Status::Pending:
+            scope.release();
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("status"), jsNontrivialString(exec, ASCIILiteral("pending"))));
+            return array;
+        case JSPromise::Status::Fulfilled:
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("status"), jsNontrivialString(exec, ASCIILiteral("resolved"))));
+            RETURN_IF_EXCEPTION(scope, JSValue());
+            scope.release();
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("result"), promise->result(exec->vm())));
+            return array;
+        case JSPromise::Status::Rejected:
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("status"), jsNontrivialString(exec, ASCIILiteral("rejected"))));
+            RETURN_IF_EXCEPTION(scope, JSValue());
+            scope.release();
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("result"), promise->result(exec->vm())));
+            return array;
+        }
+        // FIXME: <https://webkit.org/b/141664> Web Inspector: ES6: Improved Support for Promises - Promise Reactions
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    if (JSBoundFunction* boundFunction = jsDynamicCast<JSBoundFunction*>(value)) {
+        unsigned index = 0;
+        JSArray* array = constructEmptyArray(exec, nullptr);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, "targetFunction", boundFunction->targetFunction()));
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, "boundThis", boundFunction->boundThis()));
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        if (boundFunction->boundArgs()) {
+            scope.release();
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, "boundArgs", boundFunction->boundArgs()));
+            return array;
+        }
+        return array;
+    }
+
+    if (ProxyObject* proxy = jsDynamicCast<ProxyObject*>(value)) {
+        unsigned index = 0;
+        JSArray* array = constructEmptyArray(exec, nullptr, 2);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("target"), proxy->target()));
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        scope.release();
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("handler"), proxy->handler()));
+        return array;
+    }
+
+    if (JSObject* iteratorObject = jsDynamicCast<JSObject*>(value)) {
+        if (iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().arrayIteratorNextIndexPrivateName())) {
+            JSValue iteratedValue = iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().iteratedObjectPrivateName());
+            JSValue kind = iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().arrayIteratorKindPrivateName());
+
+            unsigned index = 0;
+            JSArray* array = constructEmptyArray(exec, nullptr, 2);
+            RETURN_IF_EXCEPTION(scope, JSValue());
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, "array", iteratedValue));
+            RETURN_IF_EXCEPTION(scope, JSValue());
+            scope.release();
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, "kind", kind));
+            return array;
+        }
+    }
+
+    if (JSMapIterator* mapIterator = jsDynamicCast<JSMapIterator*>(value)) {
+        String kind;
+        switch (mapIterator->kind()) {
+        case IterateKey:
+            kind = ASCIILiteral("key");
+            break;
+        case IterateValue:
+            kind = ASCIILiteral("value");
+            break;
+        case IterateKeyValue:
+            kind = ASCIILiteral("key+value");
+            break;
+        }
+        unsigned index = 0;
+        JSArray* array = constructEmptyArray(exec, nullptr, 2);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, "map", mapIterator->iteratedValue()));
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        scope.release();
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, "kind", jsNontrivialString(exec, kind)));
+        return array;
+    }
+        
+    if (JSSetIterator* setIterator = jsDynamicCast<JSSetIterator*>(value)) {
+        String kind;
+        switch (setIterator->kind()) {
+        case IterateKey:
+            kind = ASCIILiteral("key");
+            break;
+        case IterateValue:
+            kind = ASCIILiteral("value");
+            break;
+        case IterateKeyValue:
+            kind = ASCIILiteral("key+value");
+            break;
+        }
+        unsigned index = 0;
+        JSArray* array = constructEmptyArray(exec, nullptr, 2);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, "set", setIterator->iteratedValue()));
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        scope.release();
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, "kind", jsNontrivialString(exec, kind)));
+        return array;
+    }
+
+    if (JSStringIterator* stringIterator = jsDynamicCast<JSStringIterator*>(value)) {
+        unsigned index = 0;
+        JSArray* array = constructEmptyArray(exec, nullptr, 1);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        scope.release();
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, "string", stringIterator->iteratedValue(exec)));
+        return array;
+    }
+
+    if (JSPropertyNameIterator* propertyNameIterator = jsDynamicCast<JSPropertyNameIterator*>(value)) {
+        unsigned index = 0;
+        JSArray* array = constructEmptyArray(exec, nullptr, 1);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        scope.release();
+        array->putDirectIndex(exec, index++, constructInternalProperty(exec, "object", propertyNameIterator->iteratedValue()));
+        return array;
+    }
+
+    return jsUndefined();
+}
+
+JSValue JSInjectedScriptHost::proxyTargetValue(ExecState *exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    JSValue value = exec->uncheckedArgument(0);
+    ProxyObject* proxy = jsDynamicCast<ProxyObject*>(value);
+    if (!proxy)
+        return jsUndefined();
+
+    JSObject* target = proxy->target();
+    while (ProxyObject* proxy = jsDynamicCast<ProxyObject*>(target))
+        target = proxy->target();
+
+    return target;
+}
+
+JSValue JSInjectedScriptHost::weakMapSize(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    JSValue value = exec->uncheckedArgument(0);
+    JSWeakMap* weakMap = jsDynamicCast<JSWeakMap*>(value);
+    if (!weakMap)
+        return jsUndefined();
+
+    return jsNumber(weakMap->weakMapData()->size());
+}
+
+JSValue JSInjectedScriptHost::weakMapEntries(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue value = exec->uncheckedArgument(0);
+    JSWeakMap* weakMap = jsDynamicCast<JSWeakMap*>(value);
+    if (!weakMap)
+        return jsUndefined();
+
+    unsigned fetched = 0;
+    unsigned numberToFetch = 100;
+
+    JSValue numberToFetchArg = exec->argument(1);
+    double fetchDouble = numberToFetchArg.toInteger(exec);
+    if (fetchDouble >= 0)
+        numberToFetch = static_cast<unsigned>(fetchDouble);
+
+    JSArray* array = constructEmptyArray(exec, nullptr);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    for (auto it = weakMap->weakMapData()->begin(); it != weakMap->weakMapData()->end(); ++it) {
+        JSObject* entry = constructEmptyObject(exec);
+        entry->putDirect(exec->vm(), Identifier::fromString(exec, "key"), it->key);
+        entry->putDirect(exec->vm(), Identifier::fromString(exec, "value"), it->value.get());
+        array->putDirectIndex(exec, fetched++, entry);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        if (numberToFetch && fetched >= numberToFetch)
+            break;
+    }
+
+    return array;
+}
+
+JSValue JSInjectedScriptHost::weakSetSize(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    JSValue value = exec->uncheckedArgument(0);
+    JSWeakSet* weakSet = jsDynamicCast<JSWeakSet*>(value);
+    if (!weakSet)
+        return jsUndefined();
+
+    return jsNumber(weakSet->weakMapData()->size());
+}
+
+JSValue JSInjectedScriptHost::weakSetEntries(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue value = exec->uncheckedArgument(0);
+    JSWeakSet* weakSet = jsDynamicCast<JSWeakSet*>(value);
+    if (!weakSet)
+        return jsUndefined();
+
+    unsigned fetched = 0;
+    unsigned numberToFetch = 100;
+
+    JSValue numberToFetchArg = exec->argument(1);
+    double fetchDouble = numberToFetchArg.toInteger(exec);
+    if (fetchDouble >= 0)
+        numberToFetch = static_cast<unsigned>(fetchDouble);
+
+    JSArray* array = constructEmptyArray(exec, nullptr);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    for (auto it = weakSet->weakMapData()->begin(); it != weakSet->weakMapData()->end(); ++it) {
+        JSObject* entry = constructEmptyObject(exec);
+        entry->putDirect(exec->vm(), Identifier::fromString(exec, "value"), it->key);
+        array->putDirectIndex(exec, fetched++, entry);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        if (numberToFetch && fetched >= numberToFetch)
+            break;
+    }
+
+    return array;
+}
+
+static JSObject* cloneArrayIteratorObject(ExecState* exec, VM& vm, JSObject* iteratorObject, JSValue nextIndex)
+{
+    ASSERT(iteratorObject->type() == FinalObjectType);
+    JSObject* clone = constructEmptyObject(exec, iteratorObject->structure());
+    clone->putDirect(vm, vm.propertyNames->builtinNames().arrayIteratorNextIndexPrivateName(), nextIndex);
+    clone->putDirect(vm, vm.propertyNames->builtinNames().iteratedObjectPrivateName(), iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().iteratedObjectPrivateName()));
+    clone->putDirect(vm, vm.propertyNames->builtinNames().arrayIteratorIsDonePrivateName(), iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().arrayIteratorIsDonePrivateName()));
+    clone->putDirect(vm, vm.propertyNames->builtinNames().arrayIteratorNextPrivateName(), iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().arrayIteratorNextPrivateName()));
+    return clone;
+}
+
+JSValue JSInjectedScriptHost::iteratorEntries(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue iterator;
+    JSValue value = exec->uncheckedArgument(0);
+    if (JSMapIterator* mapIterator = jsDynamicCast<JSMapIterator*>(value))
+        iterator = mapIterator->clone(exec);
+    else if (JSSetIterator* setIterator = jsDynamicCast<JSSetIterator*>(value))
+        iterator = setIterator->clone(exec);
+    else if (JSStringIterator* stringIterator = jsDynamicCast<JSStringIterator*>(value))
+        iterator = stringIterator->clone(exec);
+    else if (JSPropertyNameIterator* propertyNameIterator = jsDynamicCast<JSPropertyNameIterator*>(value)) {
+        iterator = propertyNameIterator->clone(exec);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+    } else {
+        if (JSObject* iteratorObject = jsDynamicCast<JSObject*>(value)) {
+            // Array Iterators are created in JS for performance reasons. Thus the only way to know we have one is to
+            // look for a property that is unique to them.
+            if (JSValue nextIndex = iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().arrayIteratorNextIndexPrivateName()))
+                iterator = cloneArrayIteratorObject(exec, vm, iteratorObject, nextIndex);
+        }
+    }
+    if (!iterator)
+        return jsUndefined();
+
+    unsigned numberToFetch = 5;
+    JSValue numberToFetchArg = exec->argument(1);
+    double fetchDouble = numberToFetchArg.toInteger(exec);
+    if (fetchDouble >= 0)
+        numberToFetch = static_cast<unsigned>(fetchDouble);
+
+    JSArray* array = constructEmptyArray(exec, nullptr);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    for (unsigned i = 0; i < numberToFetch; ++i) {
+        JSValue next = iteratorStep(exec, iterator);
+        if (UNLIKELY(scope.exception()))
+            break;
+        if (next.isFalse())
+            break;
+
+        JSValue nextValue = iteratorValue(exec, next);
+        if (UNLIKELY(scope.exception()))
+            break;
+
+        JSObject* entry = constructEmptyObject(exec);
+        entry->putDirect(exec->vm(), Identifier::fromString(exec, "value"), nextValue);
+        array->putDirectIndex(exec, i, entry);
+        if (UNLIKELY(scope.exception()))
+            break;
+    }
+
+    iteratorClose(exec, iterator);
+
+    return array;
+}
+
+} // namespace Inspector
diff --git a/inspector/JSInjectedScriptHost.h b/inspector/JSInjectedScriptHost.h
new file mode 100644
index 0000000..1bd4d77
--- /dev/null
+++ b/inspector/JSInjectedScriptHost.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSDestructibleObject.h"
+
+namespace Inspector {
+
+class InjectedScriptHost;
+
+class JSInjectedScriptHost : public JSC::JSDestructibleObject {
+public:
+    typedef JSC::JSDestructibleObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    DECLARE_INFO;
+
+    static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+
+    static JSInjectedScriptHost* create(JSC::VM& vm, JSC::Structure* structure, Ref<InjectedScriptHost>&& impl)
+    {
+        JSInjectedScriptHost* instance = new (NotNull, JSC::allocateCell<JSInjectedScriptHost>(vm.heap)) JSInjectedScriptHost(vm, structure, WTFMove(impl));
+        instance->finishCreation(vm);
+        return instance;
+    }
+
+    static JSC::JSObject* createPrototype(JSC::VM&, JSC::JSGlobalObject*);
+    static void destroy(JSC::JSCell*);
+
+    InjectedScriptHost& impl() const { return const_cast<InjectedScriptHost&>(m_wrapped.get()); }
+
+    // Attributes.
+    JSC::JSValue evaluate(JSC::ExecState*) const;
+
+    // Functions.
+    JSC::JSValue evaluateWithScopeExtension(JSC::ExecState*);
+    JSC::JSValue internalConstructorName(JSC::ExecState*);
+    JSC::JSValue isHTMLAllCollection(JSC::ExecState*);
+    JSC::JSValue subtype(JSC::ExecState*);
+    JSC::JSValue functionDetails(JSC::ExecState*);
+    JSC::JSValue getInternalProperties(JSC::ExecState*);
+    JSC::JSValue proxyTargetValue(JSC::ExecState*);
+    JSC::JSValue weakMapSize(JSC::ExecState*);
+    JSC::JSValue weakMapEntries(JSC::ExecState*);
+    JSC::JSValue weakSetSize(JSC::ExecState*);
+    JSC::JSValue weakSetEntries(JSC::ExecState*);
+    JSC::JSValue iteratorEntries(JSC::ExecState*);
+
+protected:
+    void finishCreation(JSC::VM&);
+
+private:
+    JSInjectedScriptHost(JSC::VM&, JSC::Structure*, Ref<InjectedScriptHost>&&);
+
+    Ref<InjectedScriptHost> m_wrapped;
+};
+
+} // namespace Inspector
diff --git a/inspector/JSInjectedScriptHostPrototype.cpp b/inspector/JSInjectedScriptHostPrototype.cpp
new file mode 100644
index 0000000..5da7e00
--- /dev/null
+++ b/inspector/JSInjectedScriptHostPrototype.cpp
@@ -0,0 +1,250 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInjectedScriptHostPrototype.h"
+
+#include "Error.h"
+#include "GetterSetter.h"
+#include "Identifier.h"
+#include "InjectedScriptHost.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSInjectedScriptHost.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionSubtype(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionFunctionDetails(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionGetInternalProperties(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionInternalConstructorName(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionProxyTargetValue(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakMapSize(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakMapEntries(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakSetSize(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakSetEntries(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionIteratorEntries(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension(ExecState*);
+
+static EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeAttributeEvaluate(ExecState*);
+
+const ClassInfo JSInjectedScriptHostPrototype::s_info = { "InjectedScriptHost", &Base::s_info, 0, CREATE_METHOD_TABLE(JSInjectedScriptHostPrototype) };
+
+void JSInjectedScriptHostPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("subtype", jsInjectedScriptHostPrototypeFunctionSubtype, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("functionDetails", jsInjectedScriptHostPrototypeFunctionFunctionDetails, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("getInternalProperties", jsInjectedScriptHostPrototypeFunctionGetInternalProperties, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("internalConstructorName", jsInjectedScriptHostPrototypeFunctionInternalConstructorName, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("isHTMLAllCollection", jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("proxyTargetValue", jsInjectedScriptHostPrototypeFunctionProxyTargetValue, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("weakMapSize", jsInjectedScriptHostPrototypeFunctionWeakMapSize, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("weakMapEntries", jsInjectedScriptHostPrototypeFunctionWeakMapEntries, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("weakSetSize", jsInjectedScriptHostPrototypeFunctionWeakSetSize, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("weakSetEntries", jsInjectedScriptHostPrototypeFunctionWeakSetEntries, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("iteratorEntries", jsInjectedScriptHostPrototypeFunctionIteratorEntries, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("evaluateWithScopeExtension", jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension, DontEnum, 1);
+
+    JSC_NATIVE_GETTER("evaluate", jsInjectedScriptHostPrototypeAttributeEvaluate, DontEnum | Accessor);
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeAttributeEvaluate(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->evaluate(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionInternalConstructorName(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->internalConstructorName(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->isHTMLAllCollection(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionProxyTargetValue(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->proxyTargetValue(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakMapSize(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->weakMapSize(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakMapEntries(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->weakMapEntries(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakSetSize(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->weakSetSize(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakSetEntries(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->weakSetEntries(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionIteratorEntries(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->iteratorEntries(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->evaluateWithScopeExtension(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionSubtype(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->subtype(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionFunctionDetails(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->functionDetails(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionGetInternalProperties(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSInjectedScriptHost* castedThis = jsDynamicCast<JSInjectedScriptHost*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->getInternalProperties(exec));
+}
+
+} // namespace Inspector
+
diff --git a/inspector/JSInjectedScriptHostPrototype.h b/inspector/JSInjectedScriptHostPrototype.h
new file mode 100644
index 0000000..58e9e55
--- /dev/null
+++ b/inspector/JSInjectedScriptHostPrototype.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace Inspector {
+
+class JSInjectedScriptHostPrototype : public JSC::JSNonFinalObject {
+public:
+    typedef JSC::JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | JSC::OverridesGetOwnPropertySlot;
+
+    DECLARE_INFO;
+
+    static JSInjectedScriptHostPrototype* create(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::Structure* structure)
+    {
+        JSInjectedScriptHostPrototype* ptr = new (NotNull, JSC::allocateCell<JSInjectedScriptHostPrototype>(vm.heap)) JSInjectedScriptHostPrototype(vm, globalObject, structure);
+        ptr->finishCreation(vm, globalObject);
+        return ptr;
+    }
+
+    static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+
+private:
+    JSInjectedScriptHostPrototype(JSC::VM& vm, JSC::JSGlobalObject*, JSC::Structure* structure)
+        : JSC::JSNonFinalObject(vm, structure)
+    {
+    }
+    void finishCreation(JSC::VM&, JSC::JSGlobalObject*);
+};
+
+} // namespace Inspector
diff --git a/inspector/JSJavaScriptCallFrame.cpp b/inspector/JSJavaScriptCallFrame.cpp
new file mode 100644
index 0000000..f4ed3f7
--- /dev/null
+++ b/inspector/JSJavaScriptCallFrame.cpp
@@ -0,0 +1,242 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSJavaScriptCallFrame.h"
+
+#include "DebuggerScope.h"
+#include "Error.h"
+#include "IdentifierInlines.h"
+#include "JSCInlines.h"
+#include "JSJavaScriptCallFramePrototype.h"
+#include "ObjectConstructor.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+const ClassInfo JSJavaScriptCallFrame::s_info = { "JavaScriptCallFrame", &Base::s_info, 0, CREATE_METHOD_TABLE(JSJavaScriptCallFrame) };
+
+JSJavaScriptCallFrame::JSJavaScriptCallFrame(VM& vm, Structure* structure, PassRefPtr<JavaScriptCallFrame> impl)
+    : JSDestructibleObject(vm, structure)
+    , m_impl(impl.leakRef())
+{
+}
+
+void JSJavaScriptCallFrame::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+JSObject* JSJavaScriptCallFrame::createPrototype(VM& vm, JSGlobalObject* globalObject)
+{
+    return JSJavaScriptCallFramePrototype::create(vm, globalObject, JSJavaScriptCallFramePrototype::createStructure(vm, globalObject, globalObject->objectPrototype()));
+}
+
+void JSJavaScriptCallFrame::destroy(JSC::JSCell* cell)
+{
+    JSJavaScriptCallFrame* thisObject = static_cast<JSJavaScriptCallFrame*>(cell);
+    thisObject->JSJavaScriptCallFrame::~JSJavaScriptCallFrame();
+}
+
+void JSJavaScriptCallFrame::releaseImpl()
+{
+    if (auto impl = std::exchange(m_impl, nullptr))
+        impl->deref();
+}
+
+JSJavaScriptCallFrame::~JSJavaScriptCallFrame()
+{
+    releaseImpl();
+}
+
+JSValue JSJavaScriptCallFrame::evaluateWithScopeExtension(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue scriptValue = exec->argument(0);
+    if (!scriptValue.isString())
+        return throwTypeError(exec, scope, ASCIILiteral("JSJavaScriptCallFrame.evaluateWithScopeExtension first argument must be a string."));
+
+    String script = asString(scriptValue)->value(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    NakedPtr<Exception> exception;
+    JSObject* scopeExtension = exec->argument(1).getObject();
+    JSValue result = impl().evaluateWithScopeExtension(script, scopeExtension, exception);
+    if (exception)
+        throwException(exec, scope, exception);
+
+    return result;
+}
+
+static JSValue valueForScopeType(DebuggerScope* scope)
+{
+    if (scope->isCatchScope())
+        return jsNumber(JSJavaScriptCallFrame::CATCH_SCOPE);
+    if (scope->isFunctionNameScope())
+        return jsNumber(JSJavaScriptCallFrame::FUNCTION_NAME_SCOPE);
+    if (scope->isWithScope())
+        return jsNumber(JSJavaScriptCallFrame::WITH_SCOPE);
+    if (scope->isNestedLexicalScope())
+        return jsNumber(JSJavaScriptCallFrame::NESTED_LEXICAL_SCOPE);
+    if (scope->isGlobalLexicalEnvironment())
+        return jsNumber(JSJavaScriptCallFrame::GLOBAL_LEXICAL_ENVIRONMENT_SCOPE);
+    if (scope->isGlobalScope())
+        return jsNumber(JSJavaScriptCallFrame::GLOBAL_SCOPE);
+
+    ASSERT(scope->isClosureScope());
+    return jsNumber(JSJavaScriptCallFrame::CLOSURE_SCOPE);
+}
+
+static JSValue valueForScopeLocation(ExecState* exec, const DebuggerLocation& location)
+{
+    if (location.sourceID == noSourceID)
+        return jsNull();
+
+    // Debugger.Location protocol object.
+    JSObject* result = constructEmptyObject(exec);
+    result->putDirect(exec->vm(), Identifier::fromString(exec, "scriptId"), jsString(exec, String::number(location.sourceID)));
+    result->putDirect(exec->vm(), Identifier::fromString(exec, "lineNumber"), jsNumber(location.line));
+    result->putDirect(exec->vm(), Identifier::fromString(exec, "columnNumber"), jsNumber(location.column));
+    return result;
+}
+
+JSValue JSJavaScriptCallFrame::scopeDescriptions(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    DebuggerScope* scopeChain = impl().scopeChain();
+    if (!scopeChain)
+        return jsUndefined();
+
+    int index = 0;
+    JSArray* array = constructEmptyArray(exec, nullptr);
+
+    DebuggerScope::iterator end = scopeChain->end();
+    for (DebuggerScope::iterator iter = scopeChain->begin(); iter != end; ++iter) {
+        DebuggerScope* scope = iter.get();
+        JSObject* description = constructEmptyObject(exec);
+        description->putDirect(exec->vm(), Identifier::fromString(exec, "type"), valueForScopeType(scope));
+        description->putDirect(exec->vm(), Identifier::fromString(exec, "name"), jsString(exec, scope->name()));
+        description->putDirect(exec->vm(), Identifier::fromString(exec, "location"), valueForScopeLocation(exec, scope->location()));
+        array->putDirectIndex(exec, index++, description);
+        RETURN_IF_EXCEPTION(throwScope, JSValue());
+    }
+
+    return array;
+}
+
+JSValue JSJavaScriptCallFrame::caller(ExecState* exec) const
+{
+    return toJS(exec, globalObject(), impl().caller());
+}
+
+JSValue JSJavaScriptCallFrame::sourceID(ExecState*) const
+{
+    return jsNumber(impl().sourceID());
+}
+
+JSValue JSJavaScriptCallFrame::line(ExecState*) const
+{
+    return jsNumber(impl().line());
+}
+
+JSValue JSJavaScriptCallFrame::column(ExecState*) const
+{
+    return jsNumber(impl().column());
+}
+
+JSValue JSJavaScriptCallFrame::functionName(ExecState* exec) const
+{
+    return jsString(exec, impl().functionName());
+}
+
+JSValue JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
+{
+    if (!impl().scopeChain())
+        return jsNull();
+
+    DebuggerScope* scopeChain = impl().scopeChain();
+    DebuggerScope::iterator iter = scopeChain->begin();
+    DebuggerScope::iterator end = scopeChain->end();
+
+    // We must always have something in the scope chain.
+    ASSERT(iter != end);
+
+    MarkedArgumentBuffer list;
+    do {
+        list.append(iter.get());
+        ++iter;
+    } while (iter != end);
+
+    return constructArray(exec, nullptr, globalObject(), list);
+}
+
+JSValue JSJavaScriptCallFrame::thisObject(ExecState*) const
+{
+    return impl().thisValue();
+}
+
+JSValue JSJavaScriptCallFrame::isTailDeleted(JSC::ExecState*) const
+{
+    return jsBoolean(impl().isTailDeleted());
+}
+
+JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
+{
+    switch (impl().type()) {
+    case DebuggerCallFrame::FunctionType:
+        return jsNontrivialString(exec, ASCIILiteral("function"));
+    case DebuggerCallFrame::ProgramType:
+        return jsNontrivialString(exec, ASCIILiteral("program"));
+    }
+
+    ASSERT_NOT_REACHED();
+    return jsNull();
+}
+
+JSValue toJS(ExecState* exec, JSGlobalObject* globalObject, JavaScriptCallFrame* impl)
+{
+    if (!impl)
+        return jsNull();
+
+    JSObject* prototype = JSJavaScriptCallFrame::createPrototype(exec->vm(), globalObject);
+    Structure* structure = JSJavaScriptCallFrame::createStructure(exec->vm(), globalObject, prototype);
+    JSJavaScriptCallFrame* javaScriptCallFrame = JSJavaScriptCallFrame::create(exec->vm(), structure, impl);
+
+    return javaScriptCallFrame;
+}
+
+JSJavaScriptCallFrame* toJSJavaScriptCallFrame(JSValue value)
+{
+    return value.inherits(JSJavaScriptCallFrame::info()) ? jsCast<JSJavaScriptCallFrame*>(value) : nullptr;
+}
+
+} // namespace Inspector
+
diff --git a/inspector/JSJavaScriptCallFrame.h b/inspector/JSJavaScriptCallFrame.h
new file mode 100644
index 0000000..ad16137
--- /dev/null
+++ b/inspector/JSJavaScriptCallFrame.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSDestructibleObject.h"
+#include "JavaScriptCallFrame.h"
+
+namespace Inspector {
+
+class JSJavaScriptCallFrame : public JSC::JSDestructibleObject {
+public:
+    typedef JSC::JSDestructibleObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    DECLARE_INFO;
+
+    static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+
+    static JSJavaScriptCallFrame* create(JSC::VM& vm, JSC::Structure* structure, PassRefPtr<JavaScriptCallFrame> impl)
+    {
+        JSJavaScriptCallFrame* instance = new (NotNull, JSC::allocateCell<JSJavaScriptCallFrame>(vm.heap)) JSJavaScriptCallFrame(vm, structure, impl);
+        instance->finishCreation(vm);
+        return instance;
+    }
+
+    static JSC::JSObject* createPrototype(JSC::VM&, JSC::JSGlobalObject*);
+    static void destroy(JSC::JSCell*);
+
+    JavaScriptCallFrame& impl() const { return *m_impl; }
+    void releaseImpl();
+
+    // Functions.
+    JSC::JSValue evaluateWithScopeExtension(JSC::ExecState*);
+    JSC::JSValue scopeDescriptions(JSC::ExecState*);
+
+    // Attributes.
+    JSC::JSValue caller(JSC::ExecState*) const;
+    JSC::JSValue sourceID(JSC::ExecState*) const;
+    JSC::JSValue line(JSC::ExecState*) const;
+    JSC::JSValue column(JSC::ExecState*) const;
+    JSC::JSValue functionName(JSC::ExecState*) const;
+    JSC::JSValue scopeChain(JSC::ExecState*) const;
+    JSC::JSValue thisObject(JSC::ExecState*) const;
+    JSC::JSValue type(JSC::ExecState*) const;
+    JSC::JSValue isTailDeleted(JSC::ExecState*) const;
+
+    // Constants.
+    static const unsigned short GLOBAL_SCOPE = 0;
+    static const unsigned short WITH_SCOPE = 1;
+    static const unsigned short CLOSURE_SCOPE = 2;
+    static const unsigned short CATCH_SCOPE = 3;
+    static const unsigned short FUNCTION_NAME_SCOPE = 4;
+    static const unsigned short GLOBAL_LEXICAL_ENVIRONMENT_SCOPE = 5;
+    static const unsigned short NESTED_LEXICAL_SCOPE = 6;
+
+protected:
+    void finishCreation(JSC::VM&);
+
+private:
+    JSJavaScriptCallFrame(JSC::VM&, JSC::Structure*, PassRefPtr<JavaScriptCallFrame>);
+    ~JSJavaScriptCallFrame();
+
+    JavaScriptCallFrame* m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, JSC::JSGlobalObject*, JavaScriptCallFrame*);
+JSJavaScriptCallFrame* toJSJavaScriptCallFrame(JSC::JSValue);
+
+} // namespace Inspector
diff --git a/inspector/JSJavaScriptCallFramePrototype.cpp b/inspector/JSJavaScriptCallFramePrototype.cpp
new file mode 100644
index 0000000..5948ace
--- /dev/null
+++ b/inspector/JSJavaScriptCallFramePrototype.cpp
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSJavaScriptCallFramePrototype.h"
+
+#include "Error.h"
+#include "Identifier.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSJavaScriptCallFrame.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+// Functions.
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionScopeDescriptions(ExecState*);
+
+// Attributes.
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeCaller(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeSourceID(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeLine(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeColumn(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeFunctionName(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeScopeChain(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeThisObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeType(ExecState*);
+static EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameIsTailDeleted(ExecState*);
+
+const ClassInfo JSJavaScriptCallFramePrototype::s_info = { "JavaScriptCallFrame", &Base::s_info, 0, CREATE_METHOD_TABLE(JSJavaScriptCallFramePrototype) };
+
+void JSJavaScriptCallFramePrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("evaluateWithScopeExtension", jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("scopeDescriptions", jsJavaScriptCallFramePrototypeFunctionScopeDescriptions, DontEnum, 0);
+
+    JSC_NATIVE_GETTER("caller", jsJavaScriptCallFrameAttributeCaller, DontEnum | Accessor);
+    JSC_NATIVE_GETTER("sourceID", jsJavaScriptCallFrameAttributeSourceID, DontEnum | Accessor);
+    JSC_NATIVE_GETTER("line", jsJavaScriptCallFrameAttributeLine, DontEnum | Accessor);
+    JSC_NATIVE_GETTER("column", jsJavaScriptCallFrameAttributeColumn, DontEnum | Accessor);
+    JSC_NATIVE_GETTER("functionName", jsJavaScriptCallFrameAttributeFunctionName, DontEnum | Accessor);
+    JSC_NATIVE_GETTER("scopeChain", jsJavaScriptCallFrameAttributeScopeChain, DontEnum | Accessor);
+    JSC_NATIVE_GETTER("thisObject", jsJavaScriptCallFrameAttributeThisObject, DontEnum | Accessor);
+    JSC_NATIVE_GETTER("type", jsJavaScriptCallFrameAttributeType, DontEnum | Accessor);
+    JSC_NATIVE_GETTER("isTailDeleted", jsJavaScriptCallFrameIsTailDeleted, DontEnum | Accessor);
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->evaluateWithScopeExtension(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionScopeDescriptions(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->scopeDescriptions(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeCaller(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->caller(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeSourceID(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->sourceID(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeLine(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->line(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeColumn(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->column(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeFunctionName(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->functionName(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeScopeChain(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->scopeChain(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeThisObject(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->thisObject(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeType(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->type(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameIsTailDeleted(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    JSJavaScriptCallFrame* castedThis = jsDynamicCast<JSJavaScriptCallFrame*>(thisValue);
+    if (!castedThis)
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(castedThis->isTailDeleted(exec));
+}
+
+} // namespace Inspector
diff --git a/inspector/JSJavaScriptCallFramePrototype.h b/inspector/JSJavaScriptCallFramePrototype.h
new file mode 100644
index 0000000..c69e94a
--- /dev/null
+++ b/inspector/JSJavaScriptCallFramePrototype.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace Inspector {
+
+class JSJavaScriptCallFramePrototype : public JSC::JSNonFinalObject {
+public:
+    typedef JSC::JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | JSC::OverridesGetOwnPropertySlot;
+
+    DECLARE_INFO;
+
+    static JSJavaScriptCallFramePrototype* create(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::Structure* structure)
+    {
+        JSJavaScriptCallFramePrototype* ptr = new (NotNull, JSC::allocateCell<JSJavaScriptCallFramePrototype>(vm.heap)) JSJavaScriptCallFramePrototype(vm, globalObject, structure);
+        ptr->finishCreation(vm, globalObject);
+        return ptr;
+    }
+
+    static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+
+private:
+    JSJavaScriptCallFramePrototype(JSC::VM& vm, JSC::JSGlobalObject*, JSC::Structure* structure)
+        : JSC::JSNonFinalObject(vm, structure)
+    {
+    }
+    void finishCreation(JSC::VM&, JSC::JSGlobalObject*);
+};
+
+} // namespace Inspector
diff --git a/inspector/JavaScriptCallFrame.cpp b/inspector/JavaScriptCallFrame.cpp
new file mode 100644
index 0000000..d5f73d5
--- /dev/null
+++ b/inspector/JavaScriptCallFrame.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2008, 2013 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JavaScriptCallFrame.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+JavaScriptCallFrame::JavaScriptCallFrame(PassRefPtr<DebuggerCallFrame> debuggerCallFrame)
+    : m_debuggerCallFrame(debuggerCallFrame)
+{
+}
+
+JavaScriptCallFrame* JavaScriptCallFrame::caller()
+{
+    if (m_caller)
+        return m_caller.get();
+
+    RefPtr<DebuggerCallFrame> debuggerCallerFrame = m_debuggerCallFrame->callerFrame();
+    if (!debuggerCallerFrame)
+        return nullptr;
+
+    m_caller = create(debuggerCallerFrame);
+    return m_caller.get();
+}
+
+} // namespace Inspector
+
diff --git a/inspector/JavaScriptCallFrame.h b/inspector/JavaScriptCallFrame.h
new file mode 100644
index 0000000..f9adbec
--- /dev/null
+++ b/inspector/JavaScriptCallFrame.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2008, 2013-2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValueInlines.h"
+#include "debugger/DebuggerCallFrame.h"
+#include "interpreter/CallFrame.h"
+#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/TextPosition.h>
+
+namespace Inspector {
+
+class JavaScriptCallFrame : public RefCounted<JavaScriptCallFrame> {
+public:
+    static Ref<JavaScriptCallFrame> create(PassRefPtr<JSC::DebuggerCallFrame> debuggerCallFrame)
+    {
+        return adoptRef(*new JavaScriptCallFrame(debuggerCallFrame));
+    }
+
+    JavaScriptCallFrame* caller();
+    intptr_t sourceID() const { return m_debuggerCallFrame->sourceID(); }
+    const TextPosition position() const { return m_debuggerCallFrame->position(); }
+    int line() const { return m_debuggerCallFrame->line(); }
+    int column() const { return m_debuggerCallFrame->column(); }
+
+    String functionName() const { return m_debuggerCallFrame->functionName(); }
+    JSC::DebuggerCallFrame::Type type() const { return m_debuggerCallFrame->type(); }
+    JSC::DebuggerScope* scopeChain() const { return m_debuggerCallFrame->scope(); }
+    JSC::JSGlobalObject* vmEntryGlobalObject() const { return m_debuggerCallFrame->vmEntryGlobalObject(); }
+    bool isTailDeleted() const { return m_debuggerCallFrame->isTailDeleted(); }
+
+    JSC::JSValue thisValue() const { return m_debuggerCallFrame->thisValue(); }
+    JSC::JSValue evaluateWithScopeExtension(const String& script, JSC::JSObject* scopeExtension, NakedPtr<JSC::Exception>& exception) const { return m_debuggerCallFrame->evaluateWithScopeExtension(script, scopeExtension, exception); }
+
+private:
+    JavaScriptCallFrame(PassRefPtr<JSC::DebuggerCallFrame>);
+
+    RefPtr<JSC::DebuggerCallFrame> m_debuggerCallFrame;
+    RefPtr<JavaScriptCallFrame> m_caller;
+};
+
+} // namespace Inspector
diff --git a/inspector/PerGlobalObjectWrapperWorld.cpp b/inspector/PerGlobalObjectWrapperWorld.cpp
new file mode 100644
index 0000000..c9b7abd
--- /dev/null
+++ b/inspector/PerGlobalObjectWrapperWorld.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PerGlobalObjectWrapperWorld.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+JSValue PerGlobalObjectWrapperWorld::getWrapper(JSGlobalObject* globalObject)
+{
+    auto it = m_wrappers.find(globalObject);
+    if (it != m_wrappers.end())
+        return it->value.get();
+    return JSValue();
+}
+
+void PerGlobalObjectWrapperWorld::addWrapper(JSGlobalObject* globalObject, JSObject* object)
+{
+    Strong<JSObject> wrapper(globalObject->vm(), object);
+    m_wrappers.add(globalObject, wrapper);
+}
+
+void PerGlobalObjectWrapperWorld::clearAllWrappers()
+{
+    m_wrappers.clear();
+}
+
+} // namespace Inspector
diff --git a/inspector/PerGlobalObjectWrapperWorld.h b/inspector/PerGlobalObjectWrapperWorld.h
new file mode 100644
index 0000000..51adaed
--- /dev/null
+++ b/inspector/PerGlobalObjectWrapperWorld.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValueInlines.h"
+#include "Strong.h"
+#include "StrongInlines.h"
+#include <wtf/HashMap.h>
+
+namespace Inspector {
+
+class JS_EXPORT_PRIVATE PerGlobalObjectWrapperWorld {
+public:
+    JSC::JSValue getWrapper(JSC::JSGlobalObject*);
+    void addWrapper(JSC::JSGlobalObject*, JSC::JSObject*);
+    void clearAllWrappers();
+
+private:
+    HashMap<JSC::JSGlobalObject*, JSC::Strong<JSC::JSObject>> m_wrappers;
+};
+
+} // namespace Inspector
diff --git a/inspector/ScriptArguments.cpp b/inspector/ScriptArguments.cpp
new file mode 100644
index 0000000..6ac6c4e
--- /dev/null
+++ b/inspector/ScriptArguments.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptArguments.h"
+
+#include "JSCInlines.h"
+#include "ProxyObject.h"
+#include "ScriptValue.h"
+
+namespace Inspector {
+
+Ref<ScriptArguments> ScriptArguments::create(JSC::ExecState* scriptState, Vector<Deprecated::ScriptValue>& arguments)
+{
+    return adoptRef(*new ScriptArguments(scriptState, arguments));
+}
+
+Ref<ScriptArguments> ScriptArguments::createEmpty(JSC::ExecState* scriptState)
+{
+    return adoptRef(*new ScriptArguments(scriptState));
+}
+
+ScriptArguments::ScriptArguments(JSC::ExecState* execState)
+    : m_globalObject(execState->vm(), execState->lexicalGlobalObject())
+{
+}
+
+ScriptArguments::ScriptArguments(JSC::ExecState* execState, Vector<Deprecated::ScriptValue>& arguments)
+    : m_globalObject(execState->vm(), execState->lexicalGlobalObject())
+{
+    m_arguments.swap(arguments);
+}
+
+ScriptArguments::~ScriptArguments()
+{
+}
+
+const Deprecated::ScriptValue& ScriptArguments::argumentAt(size_t index) const
+{
+    ASSERT(m_arguments.size() > index);
+    return m_arguments[index];
+}
+
+JSC::ExecState* ScriptArguments::globalState() const
+{
+    if (m_globalObject)
+        return const_cast<JSC::JSGlobalObject*>(m_globalObject.get())->globalExec();
+
+    return nullptr;
+}
+
+bool ScriptArguments::getFirstArgumentAsString(String& result)
+{
+    if (!argumentCount())
+        return false;
+
+    if (!globalState()) {
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    JSC::JSValue value = argumentAt(0).jsValue();
+    if (JSC::jsDynamicCast<JSC::ProxyObject*>(value)) {
+        result = ASCIILiteral("[object Proxy]");
+        return true;
+    }
+
+    result = argumentAt(0).toString(globalState());
+    return true;
+}
+
+bool ScriptArguments::isEqual(ScriptArguments* other) const
+{
+    if (!other)
+        return false;
+
+    if (m_arguments.size() != other->m_arguments.size())
+        return false;
+    if (!globalState() && m_arguments.size())
+        return false;
+
+    for (size_t i = 0; i < m_arguments.size(); ++i) {
+        if (!m_arguments[i].isEqual(other->globalState(), other->m_arguments[i]))
+            return false;
+    }
+
+    return true;
+}
+
+} // namespace Inspector
diff --git a/inspector/ScriptArguments.h b/inspector/ScriptArguments.h
new file mode 100644
index 0000000..50abd1b
--- /dev/null
+++ b/inspector/ScriptArguments.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <heap/Strong.h>
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace Deprecated {
+class ScriptValue;
+}
+
+namespace JSC {
+class ExecState;
+class JSGlobalObject;
+}
+
+namespace Inspector {
+
+class JS_EXPORT_PRIVATE ScriptArguments : public RefCounted<ScriptArguments> {
+public:
+    static Ref<ScriptArguments> create(JSC::ExecState*, Vector<Deprecated::ScriptValue>& arguments);
+    static Ref<ScriptArguments> createEmpty(JSC::ExecState*);
+    ~ScriptArguments();
+
+    const Deprecated::ScriptValue& argumentAt(size_t) const;
+    size_t argumentCount() const { return m_arguments.size(); }
+
+    JSC::ExecState* globalState() const;
+
+    bool getFirstArgumentAsString(String& result);
+    bool isEqual(ScriptArguments*) const;
+
+private:
+    ScriptArguments(JSC::ExecState*);
+    ScriptArguments(JSC::ExecState*, Vector<Deprecated::ScriptValue>& arguments);
+
+    JSC::Strong<JSC::JSGlobalObject> m_globalObject;
+    Vector<Deprecated::ScriptValue> m_arguments;
+};
+
+} // namespace Inspector
diff --git a/inspector/ScriptBreakpoint.h b/inspector/ScriptBreakpoint.h
new file mode 100644
index 0000000..5860417
--- /dev/null
+++ b/inspector/ScriptBreakpoint.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef enum {
+    ScriptBreakpointActionTypeLog,
+    ScriptBreakpointActionTypeEvaluate,
+    ScriptBreakpointActionTypeSound,
+    ScriptBreakpointActionTypeProbe
+} ScriptBreakpointActionType;
+
+struct ScriptBreakpointAction {
+    ScriptBreakpointAction(ScriptBreakpointActionType type, int identifier, const String& data)
+        : type(type)
+        , identifier(identifier)
+        , data(data)
+    {
+    }
+
+    ScriptBreakpointActionType type;
+    int identifier;
+    String data;
+};
+
+typedef Vector<ScriptBreakpointAction> BreakpointActions;
+
+struct ScriptBreakpoint {
+    ScriptBreakpoint()
+    {
+    }
+
+    ScriptBreakpoint(int lineNumber, int columnNumber, const String& condition, bool autoContinue, unsigned ignoreCount)
+        : lineNumber(lineNumber)
+        , columnNumber(columnNumber)
+        , condition(condition)
+        , autoContinue(autoContinue)
+        , ignoreCount(ignoreCount)
+    {
+    }
+
+    ScriptBreakpoint(int lineNumber, int columnNumber, const String& condition, BreakpointActions& actions, bool autoContinue, unsigned ignoreCount)
+        : lineNumber(lineNumber)
+        , columnNumber(columnNumber)
+        , condition(condition)
+        , actions(actions)
+        , autoContinue(autoContinue)
+        , ignoreCount(ignoreCount)
+    {
+    }
+
+    int lineNumber { 0 };
+    int columnNumber { 0 };
+    String condition;
+    BreakpointActions actions;
+    bool autoContinue { false };
+    unsigned ignoreCount { 0 };
+};
+
+} // namespace Inspector
diff --git a/inspector/ScriptCallFrame.cpp b/inspector/ScriptCallFrame.cpp
new file mode 100644
index 0000000..44627ab
--- /dev/null
+++ b/inspector/ScriptCallFrame.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptCallFrame.h"
+
+#include "InspectorValues.h"
+
+namespace Inspector {
+
+ScriptCallFrame::ScriptCallFrame(const String& functionName, const String& scriptName, JSC::SourceID sourceID, unsigned lineNumber, unsigned column)
+    : m_functionName(functionName)
+    , m_scriptName(scriptName)
+    , m_sourceID(sourceID)
+    , m_lineNumber(lineNumber)
+    , m_column(column)
+{
+}
+
+ScriptCallFrame::~ScriptCallFrame()
+{
+}
+
+bool ScriptCallFrame::isEqual(const ScriptCallFrame& o) const
+{
+    // Ignore sourceID in isEqual in case of identical scripts executed multiple times
+    // that would get different script identifiers, but are otherwise the same.
+    return m_functionName == o.m_functionName
+        && m_scriptName == o.m_scriptName
+        && m_lineNumber == o.m_lineNumber
+        && m_column == o.m_column;
+}
+
+bool ScriptCallFrame::isNative() const
+{
+    return m_scriptName == "[native code]";
+}
+
+Ref<Inspector::Protocol::Console::CallFrame> ScriptCallFrame::buildInspectorObject() const
+{
+    return Inspector::Protocol::Console::CallFrame::create()
+        .setFunctionName(m_functionName)
+        .setUrl(m_scriptName)
+        .setScriptId(String::number(m_sourceID))
+        .setLineNumber(m_lineNumber)
+        .setColumnNumber(m_column)
+        .release();
+}
+
+} // namespace Inspector
diff --git a/inspector/ScriptCallFrame.h b/inspector/ScriptCallFrame.h
new file mode 100644
index 0000000..f80b426
--- /dev/null
+++ b/inspector/ScriptCallFrame.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "DebuggerPrimitives.h"
+#include "InspectorProtocolObjects.h"
+#include <wtf/Forward.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class JS_EXPORT_PRIVATE ScriptCallFrame  {
+public:
+    ScriptCallFrame(const String& functionName, const String& scriptName, JSC::SourceID sourceID, unsigned lineNumber, unsigned column);
+    ~ScriptCallFrame();
+
+    const String& functionName() const { return m_functionName; }
+    const String& sourceURL() const { return m_scriptName; }
+    unsigned lineNumber() const { return m_lineNumber; }
+    unsigned columnNumber() const { return m_column; }
+    JSC::SourceID sourceID() const { return m_sourceID; }
+
+    bool isEqual(const ScriptCallFrame&) const;
+    bool isNative() const;
+
+    Ref<Inspector::Protocol::Console::CallFrame> buildInspectorObject() const;
+
+private:
+    String m_functionName;
+    String m_scriptName;
+    JSC::SourceID m_sourceID;
+    unsigned m_lineNumber;
+    unsigned m_column;
+};
+
+} // namespace Inspector
diff --git a/inspector/ScriptCallStack.cpp b/inspector/ScriptCallStack.cpp
new file mode 100644
index 0000000..2f8e0f6
--- /dev/null
+++ b/inspector/ScriptCallStack.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (c) 2008, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptCallStack.h"
+
+#include "InspectorValues.h"
+
+namespace Inspector {
+
+Ref<ScriptCallStack> ScriptCallStack::create()
+{
+    return adoptRef(*new ScriptCallStack);
+}
+
+Ref<ScriptCallStack> ScriptCallStack::create(Vector<ScriptCallFrame>& frames)
+{
+    return adoptRef(*new ScriptCallStack(frames));
+}
+
+ScriptCallStack::ScriptCallStack()
+{
+}
+
+ScriptCallStack::ScriptCallStack(Vector<ScriptCallFrame>& frames)
+{
+    m_frames.swap(frames);
+}
+
+ScriptCallStack::~ScriptCallStack()
+{
+}
+
+const ScriptCallFrame& ScriptCallStack::at(size_t index) const
+{
+    ASSERT(m_frames.size() > index);
+    return m_frames[index];
+}
+
+size_t ScriptCallStack::size() const
+{
+    return m_frames.size();
+}
+
+const ScriptCallFrame* ScriptCallStack::firstNonNativeCallFrame() const
+{
+    if (!m_frames.size())
+        return nullptr;
+
+    for (size_t i = 0; i < m_frames.size(); ++i) {
+        const ScriptCallFrame& frame = m_frames[i];
+        if (!frame.isNative())
+            return &frame;
+    }
+
+    return nullptr;
+}
+
+void ScriptCallStack::append(const ScriptCallFrame& frame)
+{
+    m_frames.append(frame);
+}
+
+bool ScriptCallStack::isEqual(ScriptCallStack* o) const
+{
+    if (!o)
+        return false;
+
+    size_t frameCount = o->m_frames.size();
+    if (frameCount != m_frames.size())
+        return false;
+
+    for (size_t i = 0; i < frameCount; ++i) {
+        if (!m_frames[i].isEqual(o->m_frames[i]))
+            return false;
+    }
+
+    return true;
+}
+
+Ref<Inspector::Protocol::Array<Inspector::Protocol::Console::CallFrame>> ScriptCallStack::buildInspectorArray() const
+{
+    auto frames = Inspector::Protocol::Array<Inspector::Protocol::Console::CallFrame>::create();
+    for (size_t i = 0; i < m_frames.size(); i++)
+        frames->addItem(m_frames.at(i).buildInspectorObject());
+    return frames;
+}
+
+} // namespace Inspector
diff --git a/inspector/ScriptCallStack.h b/inspector/ScriptCallStack.h
new file mode 100644
index 0000000..0f5e332
--- /dev/null
+++ b/inspector/ScriptCallStack.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (c) 2008, 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorProtocolObjects.h"
+#include "ScriptCallFrame.h"
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace Inspector {
+
+class JS_EXPORT_PRIVATE ScriptCallStack : public RefCounted<ScriptCallStack> {
+public:
+    static const size_t maxCallStackSizeToCapture = 200;
+    
+    static Ref<ScriptCallStack> create();
+    static Ref<ScriptCallStack> create(Vector<ScriptCallFrame>&);
+
+    ~ScriptCallStack();
+
+    const ScriptCallFrame& at(size_t) const;
+    size_t size() const;
+
+    const ScriptCallFrame* firstNonNativeCallFrame() const;
+
+    void append(const ScriptCallFrame&);
+
+    bool isEqual(ScriptCallStack*) const;
+
+    Ref<Inspector::Protocol::Array<Inspector::Protocol::Console::CallFrame>> buildInspectorArray() const;
+
+private:
+    ScriptCallStack();
+    ScriptCallStack(Vector<ScriptCallFrame>&);
+
+    Vector<ScriptCallFrame> m_frames;
+};
+
+} // namespace Inspector
diff --git a/inspector/ScriptCallStackFactory.cpp b/inspector/ScriptCallStackFactory.cpp
new file mode 100644
index 0000000..c47758f
--- /dev/null
+++ b/inspector/ScriptCallStackFactory.cpp
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptCallStackFactory.h"
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "Exception.h"
+#include "JSCJSValue.h"
+#include "JSCInlines.h"
+#include "ScriptArguments.h"
+#include "ScriptCallFrame.h"
+#include "ScriptCallStack.h"
+#include "ScriptValue.h"
+#include "StackVisitor.h"
+#include <wtf/text/WTFString.h>
+
+using namespace JSC;
+
+namespace Inspector {
+
+class CreateScriptCallStackFunctor {
+public:
+    CreateScriptCallStackFunctor(bool needToSkipAFrame, Vector<ScriptCallFrame>& frames, size_t remainingCapacity)
+        : m_needToSkipAFrame(needToSkipAFrame)
+        , m_frames(frames)
+        , m_remainingCapacityForFrameCapture(remainingCapacity)
+    {
+    }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        if (m_needToSkipAFrame) {
+            m_needToSkipAFrame = false;
+            return StackVisitor::Continue;
+        }
+
+        if (m_remainingCapacityForFrameCapture) {
+            unsigned line;
+            unsigned column;
+            visitor->computeLineAndColumn(line, column);
+            m_frames.append(ScriptCallFrame(visitor->functionName(), visitor->sourceURL(), static_cast<SourceID>(visitor->sourceID()), line, column));
+
+            m_remainingCapacityForFrameCapture--;
+            return StackVisitor::Continue;
+        }
+
+        return StackVisitor::Done;
+    }
+
+private:
+    mutable bool m_needToSkipAFrame;
+    Vector<ScriptCallFrame>& m_frames;
+    mutable size_t m_remainingCapacityForFrameCapture;
+};
+
+Ref<ScriptCallStack> createScriptCallStack(JSC::ExecState* exec, size_t maxStackSize)
+{
+    if (!exec)
+        return ScriptCallStack::create();
+
+    Vector<ScriptCallFrame> frames;
+
+    CallFrame* frame = exec->vm().topCallFrame;
+    CreateScriptCallStackFunctor functor(false, frames, maxStackSize);
+    frame->iterate(functor);
+
+    return ScriptCallStack::create(frames);
+}
+
+Ref<ScriptCallStack> createScriptCallStackForConsole(JSC::ExecState* exec, size_t maxStackSize)
+{
+    if (!exec)
+        return ScriptCallStack::create();
+
+    Vector<ScriptCallFrame> frames;
+
+    CallFrame* frame = exec->vm().topCallFrame;
+    CreateScriptCallStackFunctor functor(true, frames, maxStackSize);
+    frame->iterate(functor);
+
+    if (frames.isEmpty()) {
+        CreateScriptCallStackFunctor functor(false, frames, maxStackSize);
+        frame->iterate(functor);
+    }
+
+    return ScriptCallStack::create(frames);
+}
+
+static void extractSourceInformationFromException(JSC::ExecState* exec, JSObject* exceptionObject, int* lineNumber, int* columnNumber, String* sourceURL)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    // FIXME: <http://webkit.org/b/115087> Web Inspector: Should not need to evaluate JavaScript handling exceptions
+    JSValue lineValue = exceptionObject->getDirect(exec->vm(), Identifier::fromString(exec, "line"));
+    *lineNumber = lineValue && lineValue.isNumber() ? int(lineValue.toNumber(exec)) : 0;
+    JSValue columnValue = exceptionObject->getDirect(exec->vm(), Identifier::fromString(exec, "column"));
+    *columnNumber = columnValue && columnValue.isNumber() ? int(columnValue.toNumber(exec)) : 0;
+    JSValue sourceURLValue = exceptionObject->getDirect(exec->vm(), Identifier::fromString(exec, "sourceURL"));
+    *sourceURL = sourceURLValue && sourceURLValue.isString() ? sourceURLValue.toWTFString(exec) : ASCIILiteral("undefined");
+    scope.clearException();
+}
+
+Ref<ScriptCallStack> createScriptCallStackFromException(JSC::ExecState* exec, JSC::Exception* exception, size_t maxStackSize)
+{
+    Vector<ScriptCallFrame> frames;
+    auto& stackTrace = exception->stack();
+    VM& vm = exec->vm();
+    for (size_t i = 0; i < stackTrace.size() && i < maxStackSize; i++) {
+        unsigned line;
+        unsigned column;
+        stackTrace[i].computeLineAndColumn(line, column);
+        String functionName = stackTrace[i].functionName(vm);
+        frames.append(ScriptCallFrame(functionName, stackTrace[i].sourceURL(), static_cast<SourceID>(stackTrace[i].sourceID()), line, column));
+    }
+
+    // Fallback to getting at least the line and sourceURL from the exception object if it has values and the exceptionStack doesn't.
+    if (exception->value().isObject()) {
+        JSObject* exceptionObject = exception->value().toObject(exec);
+        ASSERT(exceptionObject);
+        int lineNumber;
+        int columnNumber;
+        String exceptionSourceURL;
+        if (!frames.size()) {
+            extractSourceInformationFromException(exec, exceptionObject, &lineNumber, &columnNumber, &exceptionSourceURL);
+            frames.append(ScriptCallFrame(String(), exceptionSourceURL, noSourceID, lineNumber, columnNumber));
+        } else {
+            if (!stackTrace[0].hasLineAndColumnInfo() || stackTrace[0].sourceURL().isEmpty()) {
+                const ScriptCallFrame& firstCallFrame = frames.first();
+                extractSourceInformationFromException(exec, exceptionObject, &lineNumber, &columnNumber, &exceptionSourceURL);
+                frames[0] = ScriptCallFrame(firstCallFrame.functionName(), exceptionSourceURL, stackTrace[0].sourceID(), lineNumber, columnNumber);
+            }
+        }
+    }
+
+    return ScriptCallStack::create(frames);
+}
+
+Ref<ScriptArguments> createScriptArguments(JSC::ExecState* exec, unsigned skipArgumentCount)
+{
+    Vector<Deprecated::ScriptValue> arguments;
+    size_t argumentCount = exec->argumentCount();
+    for (size_t i = skipArgumentCount; i < argumentCount; ++i)
+        arguments.append(Deprecated::ScriptValue(exec->vm(), exec->uncheckedArgument(i)));
+    return ScriptArguments::create(exec, arguments);
+}
+
+} // namespace Inspector
diff --git a/inspector/ScriptCallStackFactory.h b/inspector/ScriptCallStackFactory.h
new file mode 100644
index 0000000..d87edbe
--- /dev/null
+++ b/inspector/ScriptCallStackFactory.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Forward.h>
+
+namespace JSC {
+class Exception;
+class ExecState;
+class JSValue;
+}
+
+namespace Inspector {
+
+class ScriptArguments;
+class ScriptCallStack;
+
+// FIXME: The subtle differences between these should be eliminated.
+JS_EXPORT_PRIVATE Ref<ScriptCallStack> createScriptCallStack(JSC::ExecState*, size_t maxStackSize);
+JS_EXPORT_PRIVATE Ref<ScriptCallStack> createScriptCallStackForConsole(JSC::ExecState*, size_t maxStackSize);
+JS_EXPORT_PRIVATE Ref<ScriptCallStack> createScriptCallStackFromException(JSC::ExecState*, JSC::Exception*, size_t maxStackSize);
+JS_EXPORT_PRIVATE Ref<ScriptArguments> createScriptArguments(JSC::ExecState*, unsigned skipArgumentCount);
+
+} // namespace Inspector
diff --git a/inspector/ScriptDebugListener.h b/inspector/ScriptDebugListener.h
new file mode 100644
index 0000000..5b0bb9f
--- /dev/null
+++ b/inspector/ScriptDebugListener.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2008, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "debugger/Debugger.h"
+#include "parser/SourceProvider.h"
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+struct ScriptBreakpointAction;
+
+class ScriptDebugListener {
+public:
+    struct Script {
+        String url;
+        String source;
+        String sourceURL;
+        String sourceMappingURL;
+        RefPtr<JSC::SourceProvider> sourceProvider;
+        int startLine {0};
+        int startColumn {0};
+        int endLine {0};
+        int endColumn {0};
+        bool isContentScript {false};
+    };
+
+    virtual ~ScriptDebugListener() { }
+
+    virtual void didParseSource(JSC::SourceID, const Script&) = 0;
+    virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage) = 0;
+    virtual void didPause(JSC::ExecState&, JSC::JSValue callFrames, JSC::JSValue exception) = 0;
+    virtual void didContinue() = 0;
+
+    virtual void breakpointActionLog(JSC::ExecState&, const String&) = 0;
+    virtual void breakpointActionSound(int breakpointActionIdentifier) = 0;
+    virtual void breakpointActionProbe(JSC::ExecState&, const ScriptBreakpointAction&, unsigned batchId, unsigned sampleId, JSC::JSValue result) = 0;
+};
+
+} // namespace Inspector
diff --git a/inspector/ScriptDebugServer.cpp b/inspector/ScriptDebugServer.cpp
new file mode 100644
index 0000000..755f5b8
--- /dev/null
+++ b/inspector/ScriptDebugServer.cpp
@@ -0,0 +1,357 @@
+/*
+ * Copyright (C) 2008, 2009, 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
+ * Copyright (C) 2013 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptDebugServer.h"
+
+#include "DebuggerCallFrame.h"
+#include "DebuggerScope.h"
+#include "Exception.h"
+#include "JSCInlines.h"
+#include "JSJavaScriptCallFrame.h"
+#include "JavaScriptCallFrame.h"
+#include "ScriptValue.h"
+#include "SourceProvider.h"
+#include <wtf/NeverDestroyed.h>
+#include <wtf/SetForScope.h>
+
+using namespace JSC;
+
+namespace Inspector {
+
+ScriptDebugServer::ScriptDebugServer(VM& vm)
+    : Debugger(vm)
+{
+}
+
+ScriptDebugServer::~ScriptDebugServer()
+{
+}
+
+void ScriptDebugServer::setBreakpointActions(BreakpointID id, const ScriptBreakpoint& scriptBreakpoint)
+{
+    ASSERT(id != noBreakpointID);
+    ASSERT(!m_breakpointIDToActions.contains(id));
+
+    m_breakpointIDToActions.set(id, scriptBreakpoint.actions);
+}
+
+void ScriptDebugServer::removeBreakpointActions(BreakpointID id)
+{
+    ASSERT(id != noBreakpointID);
+
+    m_breakpointIDToActions.remove(id);
+}
+
+const BreakpointActions& ScriptDebugServer::getActionsForBreakpoint(BreakpointID id)
+{
+    ASSERT(id != noBreakpointID);
+
+    auto entry = m_breakpointIDToActions.find(id);
+    if (entry != m_breakpointIDToActions.end())
+        return entry->value;
+
+    static NeverDestroyed<BreakpointActions> emptyActionVector = BreakpointActions();
+    return emptyActionVector;
+}
+
+void ScriptDebugServer::clearBreakpointActions()
+{
+    m_breakpointIDToActions.clear();
+}
+
+bool ScriptDebugServer::evaluateBreakpointAction(const ScriptBreakpointAction& breakpointAction)
+{
+    DebuggerCallFrame* debuggerCallFrame = currentDebuggerCallFrame();
+
+    switch (breakpointAction.type) {
+    case ScriptBreakpointActionTypeLog: {
+        dispatchBreakpointActionLog(debuggerCallFrame->globalExec(), breakpointAction.data);
+        break;
+    }
+    case ScriptBreakpointActionTypeEvaluate: {
+        NakedPtr<Exception> exception;
+        JSObject* scopeExtensionObject = nullptr;
+        debuggerCallFrame->evaluateWithScopeExtension(breakpointAction.data, scopeExtensionObject, exception);
+        if (exception)
+            reportException(debuggerCallFrame->globalExec(), exception);
+        break;
+    }
+    case ScriptBreakpointActionTypeSound:
+        dispatchBreakpointActionSound(debuggerCallFrame->globalExec(), breakpointAction.identifier);
+        break;
+    case ScriptBreakpointActionTypeProbe: {
+        NakedPtr<Exception> exception;
+        JSObject* scopeExtensionObject = nullptr;
+        JSValue result = debuggerCallFrame->evaluateWithScopeExtension(breakpointAction.data, scopeExtensionObject, exception);
+        JSC::ExecState* exec = debuggerCallFrame->globalExec();
+        if (exception)
+            reportException(exec, exception);
+
+        dispatchBreakpointActionProbe(exec, breakpointAction, exception ? exception->value() : result);
+        break;
+    }
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    return true;
+}
+
+void ScriptDebugServer::dispatchDidPause(ScriptDebugListener* listener)
+{
+    ASSERT(isPaused());
+    DebuggerCallFrame* debuggerCallFrame = currentDebuggerCallFrame();
+    JSGlobalObject* globalObject = debuggerCallFrame->scope()->globalObject();
+    JSC::ExecState& state = *globalObject->globalExec();
+    JSValue jsCallFrame = toJS(&state, globalObject, JavaScriptCallFrame::create(debuggerCallFrame).ptr());
+    listener->didPause(state, jsCallFrame, exceptionOrCaughtValue(&state));
+}
+
+void ScriptDebugServer::dispatchBreakpointActionLog(ExecState* exec, const String& message)
+{
+    if (m_callingListeners)
+        return;
+
+    if (m_listeners.isEmpty())
+        return;
+
+    SetForScope<bool> change(m_callingListeners, true);
+
+    Vector<ScriptDebugListener*> listenersCopy;
+    copyToVector(m_listeners, listenersCopy);
+    for (auto* listener : listenersCopy)
+        listener->breakpointActionLog(*exec, message);
+}
+
+void ScriptDebugServer::dispatchBreakpointActionSound(ExecState*, int breakpointActionIdentifier)
+{
+    if (m_callingListeners)
+        return;
+
+    if (m_listeners.isEmpty())
+        return;
+
+    SetForScope<bool> change(m_callingListeners, true);
+
+    Vector<ScriptDebugListener*> listenersCopy;
+    copyToVector(m_listeners, listenersCopy);
+    for (auto* listener : listenersCopy)
+        listener->breakpointActionSound(breakpointActionIdentifier);
+}
+
+void ScriptDebugServer::dispatchBreakpointActionProbe(ExecState* exec, const ScriptBreakpointAction& action, JSC::JSValue sampleValue)
+{
+    if (m_callingListeners)
+        return;
+
+    if (m_listeners.isEmpty())
+        return;
+
+    SetForScope<bool> change(m_callingListeners, true);
+
+    unsigned sampleId = m_nextProbeSampleId++;
+
+    Vector<ScriptDebugListener*> listenersCopy;
+    copyToVector(m_listeners, listenersCopy);
+    for (auto* listener : listenersCopy)
+        listener->breakpointActionProbe(*exec, action, m_currentProbeBatchId, sampleId, sampleValue);
+}
+
+void ScriptDebugServer::dispatchDidContinue(ScriptDebugListener* listener)
+{
+    listener->didContinue();
+}
+
+void ScriptDebugServer::dispatchDidParseSource(const ListenerSet& listeners, SourceProvider* sourceProvider, bool isContentScript)
+{
+    JSC::SourceID sourceID = sourceProvider->asID();
+
+    // FIXME: <https://webkit.org/b/162773> Web Inspector: Simplify ScriptDebugListener::Script to use SourceProvider
+    ScriptDebugListener::Script script;
+    script.sourceProvider = sourceProvider;
+    script.url = sourceProvider->url();
+    script.source = sourceProvider->source().toString();
+    script.startLine = sourceProvider->startPosition().m_line.zeroBasedInt();
+    script.startColumn = sourceProvider->startPosition().m_column.zeroBasedInt();
+    script.isContentScript = isContentScript;
+    script.sourceURL = sourceProvider->sourceURL();
+    script.sourceMappingURL = sourceProvider->sourceMappingURL();
+
+    int sourceLength = script.source.length();
+    int lineCount = 1;
+    int lastLineStart = 0;
+    for (int i = 0; i < sourceLength; ++i) {
+        if (script.source[i] == '\n') {
+            lineCount += 1;
+            lastLineStart = i + 1;
+        }
+    }
+
+    script.endLine = script.startLine + lineCount - 1;
+    if (lineCount == 1)
+        script.endColumn = script.startColumn + sourceLength;
+    else
+        script.endColumn = sourceLength - lastLineStart;
+
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        copy[i]->didParseSource(sourceID, script);
+}
+
+void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners, SourceProvider* sourceProvider, int errorLine, const String& errorMessage)
+{
+    String url = sourceProvider->url();
+    String data = sourceProvider->source().toString();
+    int firstLine = sourceProvider->startPosition().m_line.oneBasedInt();
+
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        copy[i]->failedToParseSource(url, data, firstLine, errorLine, errorMessage);
+}
+
+void ScriptDebugServer::sourceParsed(ExecState* exec, SourceProvider* sourceProvider, int errorLine, const String& errorMessage)
+{
+    if (m_callingListeners)
+        return;
+
+    if (m_listeners.isEmpty())
+        return;
+
+    SetForScope<bool> change(m_callingListeners, true);
+
+    bool isError = errorLine != -1;
+    if (isError)
+        dispatchFailedToParseSource(m_listeners, sourceProvider, errorLine, errorMessage);
+    else
+        dispatchDidParseSource(m_listeners, sourceProvider, isContentScript(exec));
+}
+
+void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback)
+{
+    if (m_callingListeners)
+        return;
+
+    if (m_listeners.isEmpty())
+        return;
+
+    SetForScope<bool> change(m_callingListeners, true);
+
+    dispatchFunctionToListeners(m_listeners, callback);
+}
+
+void ScriptDebugServer::dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback)
+{
+    Vector<ScriptDebugListener*> copy;
+    copyToVector(listeners, copy);
+    for (size_t i = 0; i < copy.size(); ++i)
+        (this->*callback)(copy[i]);
+}
+
+void ScriptDebugServer::notifyDoneProcessingDebuggerEvents()
+{
+    m_doneProcessingDebuggerEvents = true;
+}
+
+void ScriptDebugServer::handleBreakpointHit(JSC::JSGlobalObject* globalObject, const JSC::Breakpoint& breakpoint)
+{
+    ASSERT(isAttached(globalObject));
+
+    m_currentProbeBatchId++;
+
+    auto entry = m_breakpointIDToActions.find(breakpoint.id);
+    if (entry != m_breakpointIDToActions.end()) {
+        BreakpointActions actions = entry->value;
+        for (size_t i = 0; i < actions.size(); ++i) {
+            if (!evaluateBreakpointAction(actions[i]))
+                return;
+            if (!isAttached(globalObject))
+                return;
+        }
+    }
+}
+
+void ScriptDebugServer::handleExceptionInBreakpointCondition(JSC::ExecState* exec, JSC::Exception* exception) const
+{
+    reportException(exec, exception);
+}
+
+void ScriptDebugServer::handlePause(JSGlobalObject* vmEntryGlobalObject, Debugger::ReasonForPause)
+{
+    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidPause);
+    didPause(vmEntryGlobalObject);
+
+    m_doneProcessingDebuggerEvents = false;
+    runEventLoopWhilePaused();
+
+    didContinue(vmEntryGlobalObject);
+    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidContinue);
+}
+
+void ScriptDebugServer::addListener(ScriptDebugListener* listener)
+{
+    ASSERT(listener);
+
+    bool wasEmpty = m_listeners.isEmpty();
+    m_listeners.add(listener);
+
+    // First listener. Attach the debugger.
+    if (wasEmpty)
+        attachDebugger();
+}
+
+void ScriptDebugServer::removeListener(ScriptDebugListener* listener, bool isBeingDestroyed)
+{
+    ASSERT(listener);
+
+    m_listeners.remove(listener);
+
+    // Last listener. Detach the debugger.
+    if (m_listeners.isEmpty())
+        detachDebugger(isBeingDestroyed);
+}
+
+JSC::JSValue ScriptDebugServer::exceptionOrCaughtValue(JSC::ExecState* state)
+{
+    if (reasonForPause() == PausedForException)
+        return currentException();
+
+    for (RefPtr<DebuggerCallFrame> frame = currentDebuggerCallFrame(); frame; frame = frame->callerFrame()) {
+        DebuggerScope& scope = *frame->scope();
+        if (scope.isCatchScope())
+            return scope.caughtValue(state);
+    }
+
+    return { };
+}
+
+} // namespace Inspector
diff --git a/inspector/ScriptDebugServer.h b/inspector/ScriptDebugServer.h
new file mode 100644
index 0000000..7e4c543
--- /dev/null
+++ b/inspector/ScriptDebugServer.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2008, 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ScriptBreakpoint.h"
+#include "ScriptDebugListener.h"
+#include "bindings/ScriptObject.h"
+#include "debugger/Debugger.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+class ExecState;
+class JSGlobalObject;
+class VM;
+}
+
+namespace Inspector {
+
+class JS_EXPORT_PRIVATE ScriptDebugServer : public JSC::Debugger {
+    WTF_MAKE_NONCOPYABLE(ScriptDebugServer);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+
+    // FIXME: Move BreakpointAction handling into JSC::Debugger or InspectorDebuggerAgent.
+    void setBreakpointActions(JSC::BreakpointID, const ScriptBreakpoint&);
+    void removeBreakpointActions(JSC::BreakpointID);
+    void clearBreakpointActions();
+
+    const BreakpointActions& getActionsForBreakpoint(JSC::BreakpointID);
+
+    void addListener(ScriptDebugListener*);
+    void removeListener(ScriptDebugListener*, bool isBeingDestroyed);
+
+protected:
+    typedef HashSet<ScriptDebugListener*> ListenerSet;
+    typedef void (ScriptDebugServer::*JavaScriptExecutionCallback)(ScriptDebugListener*);
+
+    ScriptDebugServer(JSC::VM&);
+    ~ScriptDebugServer();
+
+    virtual void attachDebugger() = 0;
+    virtual void detachDebugger(bool isBeingDestroyed) = 0;
+
+    virtual void didPause(JSC::JSGlobalObject*) = 0;
+    virtual void didContinue(JSC::JSGlobalObject*) = 0;
+    virtual void runEventLoopWhilePaused() = 0;
+    virtual bool isContentScript(JSC::ExecState*) const = 0;
+    virtual void reportException(JSC::ExecState*, JSC::Exception*) const = 0;
+
+    bool evaluateBreakpointAction(const ScriptBreakpointAction&);
+
+    void dispatchFunctionToListeners(JavaScriptExecutionCallback);
+    void dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback);
+    void dispatchDidPause(ScriptDebugListener*);
+    void dispatchDidContinue(ScriptDebugListener*);
+    void dispatchDidParseSource(const ListenerSet& listeners, JSC::SourceProvider*, bool isContentScript);
+    void dispatchFailedToParseSource(const ListenerSet& listeners, JSC::SourceProvider*, int errorLine, const String& errorMessage);
+    void dispatchBreakpointActionLog(JSC::ExecState*, const String&);
+    void dispatchBreakpointActionSound(JSC::ExecState*, int breakpointActionIdentifier);
+    void dispatchBreakpointActionProbe(JSC::ExecState*, const ScriptBreakpointAction&, JSC::JSValue sample);
+
+    bool m_doneProcessingDebuggerEvents { true };
+
+private:
+    typedef HashMap<JSC::BreakpointID, BreakpointActions> BreakpointIDToActionsMap;
+
+    void sourceParsed(JSC::ExecState*, JSC::SourceProvider*, int errorLine, const String& errorMsg) final;
+    void handleBreakpointHit(JSC::JSGlobalObject*, const JSC::Breakpoint&) final;
+    void handleExceptionInBreakpointCondition(JSC::ExecState*, JSC::Exception*) const final;
+    void handlePause(JSC::JSGlobalObject*, JSC::Debugger::ReasonForPause) final;
+    void notifyDoneProcessingDebuggerEvents() final;
+
+    JSC::JSValue exceptionOrCaughtValue(JSC::ExecState*);
+
+    BreakpointIDToActionsMap m_breakpointIDToActions;
+    ListenerSet m_listeners;
+    bool m_callingListeners { false };
+    unsigned m_nextProbeSampleId { 1 };
+    unsigned m_currentProbeBatchId { 0 };
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorAgent.cpp b/inspector/agents/InspectorAgent.cpp
new file mode 100644
index 0000000..f64baf3
--- /dev/null
+++ b/inspector/agents/InspectorAgent.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2007-2010, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorAgent.h"
+
+#include "InspectorEnvironment.h"
+#include "InspectorFrontendRouter.h"
+#include "InspectorValues.h"
+#include "ScriptValue.h"
+
+namespace Inspector {
+
+InspectorAgent::InspectorAgent(AgentContext& context)
+    : InspectorAgentBase(ASCIILiteral("Inspector"))
+    , m_environment(context.environment)
+    , m_frontendDispatcher(std::make_unique<InspectorFrontendDispatcher>(context.frontendRouter))
+    , m_backendDispatcher(InspectorBackendDispatcher::create(context.backendDispatcher, this))
+{
+}
+
+InspectorAgent::~InspectorAgent()
+{
+}
+
+void InspectorAgent::didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*)
+{
+}
+
+void InspectorAgent::willDestroyFrontendAndBackend(DisconnectReason)
+{
+    m_pendingEvaluateTestCommands.clear();
+
+    ErrorString unused;
+    disable(unused);
+}
+
+void InspectorAgent::enable(ErrorString&)
+{
+    m_enabled = true;
+
+    if (m_pendingInspectData.first)
+        inspect(m_pendingInspectData.first.copyRef(), m_pendingInspectData.second.copyRef());
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_pendingExtraDomainsData)
+        m_frontendDispatcher->activateExtraDomains(m_pendingExtraDomainsData);
+#endif
+
+    for (auto& testCommand : m_pendingEvaluateTestCommands)
+        m_frontendDispatcher->evaluateForTestInFrontend(testCommand);
+
+    m_pendingEvaluateTestCommands.clear();
+}
+
+void InspectorAgent::disable(ErrorString&)
+{
+    m_enabled = false;
+}
+
+void InspectorAgent::initialized(ErrorString&)
+{
+    m_environment.frontendInitialized();
+}
+
+void InspectorAgent::inspect(RefPtr<Protocol::Runtime::RemoteObject>&& objectToInspect, RefPtr<InspectorObject>&& hints)
+{
+    if (m_enabled) {
+        m_frontendDispatcher->inspect(objectToInspect, hints);
+        m_pendingInspectData.first = nullptr;
+        m_pendingInspectData.second = nullptr;
+        return;
+    }
+
+    m_pendingInspectData.first = objectToInspect;
+    m_pendingInspectData.second = hints;
+}
+
+void InspectorAgent::evaluateForTestInFrontend(const String& script)
+{
+    if (m_enabled)
+        m_frontendDispatcher->evaluateForTestInFrontend(script);
+    else
+        m_pendingEvaluateTestCommands.append(script);
+}
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+void InspectorAgent::activateExtraDomain(const String& domainName)
+{
+    if (!m_enabled) {
+        if (!m_pendingExtraDomainsData)
+            m_pendingExtraDomainsData = Inspector::Protocol::Array<String>::create();
+        m_pendingExtraDomainsData->addItem(domainName);
+        return;
+    }
+
+    auto domainNames = Inspector::Protocol::Array<String>::create();
+    domainNames->addItem(domainName);
+    m_frontendDispatcher->activateExtraDomains(WTFMove(domainNames));
+}
+
+void InspectorAgent::activateExtraDomains(const Vector<String>& extraDomains)
+{
+    if (extraDomains.isEmpty())
+        return;
+
+    auto domainNames = Inspector::Protocol::Array<String>::create();
+    for (auto domainName : extraDomains)
+        domainNames->addItem(domainName);
+
+    if (!m_enabled)
+        m_pendingExtraDomainsData = WTFMove(domainNames);
+    else
+        m_frontendDispatcher->activateExtraDomains(WTFMove(domainNames));
+}
+#endif
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorAgent.h b/inspector/agents/InspectorAgent.h
new file mode 100644
index 0000000..a9b0392
--- /dev/null
+++ b/inspector/agents/InspectorAgent.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2007-2010, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorBackendDispatchers.h"
+#include "InspectorFrontendDispatchers.h"
+#include "inspector/InspectorAgentBase.h"
+#include <wtf/Forward.h>
+#include <wtf/Vector.h>
+
+namespace Inspector {
+
+class BackendDispatcher;
+class InspectorEnvironment;
+class InspectorObject;
+
+typedef String ErrorString;
+
+class JS_EXPORT_PRIVATE InspectorAgent final : public InspectorAgentBase, public InspectorBackendDispatcherHandler {
+    WTF_MAKE_NONCOPYABLE(InspectorAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    InspectorAgent(AgentContext&);
+    virtual ~InspectorAgent();
+
+    void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*) override;
+    void willDestroyFrontendAndBackend(DisconnectReason) override;
+
+    void enable(ErrorString&) override;
+    void disable(ErrorString&) override;
+    void initialized(ErrorString&) override;
+
+    void inspect(RefPtr<Protocol::Runtime::RemoteObject>&& objectToInspect, RefPtr<InspectorObject>&& hints);
+    void evaluateForTestInFrontend(const String& script);
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    void activateExtraDomain(const String&);
+    void activateExtraDomains(const Vector<String>&);
+#endif
+
+private:
+    InspectorEnvironment& m_environment;
+    std::unique_ptr<InspectorFrontendDispatcher> m_frontendDispatcher;
+    Ref<InspectorBackendDispatcher> m_backendDispatcher;
+
+    Vector<String> m_pendingEvaluateTestCommands;
+    std::pair<RefPtr<Protocol::Runtime::RemoteObject>, RefPtr<InspectorObject>> m_pendingInspectData;
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    RefPtr<Inspector::Protocol::Array<String>> m_pendingExtraDomainsData;
+#endif
+    bool m_enabled { false };
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorConsoleAgent.cpp b/inspector/agents/InspectorConsoleAgent.cpp
new file mode 100644
index 0000000..e956ee5
--- /dev/null
+++ b/inspector/agents/InspectorConsoleAgent.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorConsoleAgent.h"
+
+#include "ConsoleMessage.h"
+#include "InjectedScriptManager.h"
+#include "InspectorFrontendRouter.h"
+#include "InspectorHeapAgent.h"
+#include "ScriptArguments.h"
+#include "ScriptCallFrame.h"
+#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
+#include "ScriptObject.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+static const unsigned maximumConsoleMessages = 100;
+static const int expireConsoleMessagesStep = 10;
+
+InspectorConsoleAgent::InspectorConsoleAgent(AgentContext& context, InspectorHeapAgent* heapAgent)
+    : InspectorAgentBase(ASCIILiteral("Console"))
+    , m_injectedScriptManager(context.injectedScriptManager)
+    , m_frontendDispatcher(std::make_unique<ConsoleFrontendDispatcher>(context.frontendRouter))
+    , m_backendDispatcher(ConsoleBackendDispatcher::create(context.backendDispatcher, this))
+    , m_heapAgent(heapAgent)
+{
+}
+
+InspectorConsoleAgent::~InspectorConsoleAgent()
+{
+}
+
+void InspectorConsoleAgent::didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*)
+{
+}
+
+void InspectorConsoleAgent::willDestroyFrontendAndBackend(DisconnectReason)
+{
+    String errorString;
+    disable(errorString);
+}
+
+void InspectorConsoleAgent::discardValues()
+{
+    m_consoleMessages.clear();
+}
+
+void InspectorConsoleAgent::enable(ErrorString&)
+{
+    if (m_enabled)
+        return;
+
+    m_enabled = true;
+
+    if (m_expiredConsoleMessageCount) {
+        ConsoleMessage expiredMessage(MessageSource::Other, MessageType::Log, MessageLevel::Warning, String::format("%d console messages are not shown.", m_expiredConsoleMessageCount));
+        expiredMessage.addToFrontend(*m_frontendDispatcher, m_injectedScriptManager, false);
+    }
+
+    size_t messageCount = m_consoleMessages.size();
+    for (size_t i = 0; i < messageCount; ++i)
+        m_consoleMessages[i]->addToFrontend(*m_frontendDispatcher, m_injectedScriptManager, false);
+}
+
+void InspectorConsoleAgent::disable(ErrorString&)
+{
+    if (!m_enabled)
+        return;
+
+    m_enabled = false;
+}
+
+void InspectorConsoleAgent::clearMessages(ErrorString&)
+{
+    m_consoleMessages.clear();
+    m_expiredConsoleMessageCount = 0;
+    m_previousMessage = nullptr;
+
+    m_injectedScriptManager.releaseObjectGroup(ASCIILiteral("console"));
+
+    if (m_enabled)
+        m_frontendDispatcher->messagesCleared();
+}
+
+void InspectorConsoleAgent::reset()
+{
+    ErrorString unused;
+    clearMessages(unused);
+
+    m_times.clear();
+    m_counts.clear();
+}
+
+void InspectorConsoleAgent::addMessageToConsole(std::unique_ptr<ConsoleMessage> message)
+{
+    if (!m_injectedScriptManager.inspectorEnvironment().developerExtrasEnabled())
+        return;
+
+    if (message->type() == MessageType::Clear) {
+        ErrorString unused;
+        clearMessages(unused);
+    }
+
+    addConsoleMessage(WTFMove(message));
+}
+
+void InspectorConsoleAgent::startTiming(const String& title)
+{
+    ASSERT(!title.isNull());
+    if (title.isNull())
+        return;
+
+    auto result = m_times.add(title, monotonicallyIncreasingTime());
+
+    if (!result.isNewEntry) {
+        // FIXME: Send an enum to the frontend for localization?
+        String warning = makeString("Timer \"", title, "\" already exists");
+        addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::ConsoleAPI, MessageType::Timing, MessageLevel::Warning, warning));
+    }
+}
+
+void InspectorConsoleAgent::stopTiming(const String& title, PassRefPtr<ScriptCallStack> callStack)
+{
+    ASSERT(!title.isNull());
+    if (title.isNull())
+        return;
+
+    auto it = m_times.find(title);
+    if (it == m_times.end()) {
+        // FIXME: Send an enum to the frontend for localization?
+        String warning = makeString("Timer \"", title, "\" does not exist");
+        addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::ConsoleAPI, MessageType::Timing, MessageLevel::Warning, warning));
+        return;
+    }
+
+    double startTime = it->value;
+    m_times.remove(it);
+
+    double elapsed = monotonicallyIncreasingTime() - startTime;
+    String message = title + String::format(": %.3fms", elapsed * 1000);
+    addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::ConsoleAPI, MessageType::Timing, MessageLevel::Debug, message, callStack));
+}
+
+void InspectorConsoleAgent::takeHeapSnapshot(const String& title)
+{
+    if (!m_injectedScriptManager.inspectorEnvironment().developerExtrasEnabled())
+        return;
+
+    ErrorString ignored;
+    double timestamp;
+    String snapshotData;
+    m_heapAgent->snapshot(ignored, &timestamp, &snapshotData);
+
+    m_frontendDispatcher->heapSnapshot(timestamp, snapshotData, title.isEmpty() ? nullptr : &title);
+}
+
+void InspectorConsoleAgent::count(JSC::ExecState* state, PassRefPtr<ScriptArguments> arguments)
+{
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForConsole(state, ScriptCallStack::maxCallStackSizeToCapture));
+
+    String title;
+    String identifier;
+    if (!arguments->argumentCount()) {
+        // '@' prefix for engine generated labels.
+        title = ASCIILiteral("Global");
+        identifier = makeString('@', title);
+    } else {
+        // '#' prefix for user labels.
+        arguments->getFirstArgumentAsString(title);
+        identifier = makeString('#', title);
+    }
+
+    auto result = m_counts.add(identifier, 1);
+    if (!result.isNewEntry)
+        result.iterator->value += 1;
+
+    // FIXME: Web Inspector should have a better UI for counters, but for now we just log an updated counter value.
+
+    String message = makeString(title, ": ", String::number(result.iterator->value));
+    addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::ConsoleAPI, MessageType::Log, MessageLevel::Debug, message, callStack));
+}
+
+static bool isGroupMessage(MessageType type)
+{
+    return type == MessageType::StartGroup
+        || type == MessageType::StartGroupCollapsed
+        || type == MessageType::EndGroup;
+}
+
+void InspectorConsoleAgent::addConsoleMessage(std::unique_ptr<ConsoleMessage> consoleMessage)
+{
+    ASSERT(m_injectedScriptManager.inspectorEnvironment().developerExtrasEnabled());
+    ASSERT_ARG(consoleMessage, consoleMessage);
+
+    if (m_previousMessage && !isGroupMessage(m_previousMessage->type()) && m_previousMessage->isEqual(consoleMessage.get())) {
+        m_previousMessage->incrementCount();
+        if (m_enabled)
+            m_previousMessage->updateRepeatCountInConsole(*m_frontendDispatcher);
+    } else {
+        m_previousMessage = consoleMessage.get();
+        m_consoleMessages.append(WTFMove(consoleMessage));
+        if (m_enabled)
+            m_previousMessage->addToFrontend(*m_frontendDispatcher, m_injectedScriptManager, true);
+    }
+
+    if (m_consoleMessages.size() >= maximumConsoleMessages) {
+        m_expiredConsoleMessageCount += expireConsoleMessagesStep;
+        m_consoleMessages.remove(0, expireConsoleMessagesStep);
+    }
+}
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorConsoleAgent.h b/inspector/agents/InspectorConsoleAgent.h
new file mode 100644
index 0000000..45840e6
--- /dev/null
+++ b/inspector/agents/InspectorConsoleAgent.h
@@ -0,0 +1,94 @@
+/*
+* Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+* Copyright (C) 2011 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+* 1.  Redistributions of source code must retain the above copyright
+*     notice, this list of conditions and the following disclaimer.
+* 2.  Redistributions in binary form must reproduce the above copyright
+*     notice, this list of conditions and the following disclaimer in the
+*     documentation and/or other materials provided with the distribution.
+*
+* THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+* ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#pragma once
+
+#include "InspectorBackendDispatchers.h"
+#include "InspectorFrontendDispatchers.h"
+#include "inspector/InspectorAgentBase.h"
+#include "runtime/ConsoleTypes.h"
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+namespace JSC {
+class ExecState;
+}
+
+namespace Inspector {
+
+class ConsoleMessage;
+class InjectedScriptManager;
+class InspectorHeapAgent;
+class ScriptArguments;
+class ScriptCallStack;
+typedef String ErrorString;
+
+class JS_EXPORT_PRIVATE InspectorConsoleAgent : public InspectorAgentBase, public ConsoleBackendDispatcherHandler {
+    WTF_MAKE_NONCOPYABLE(InspectorConsoleAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    InspectorConsoleAgent(AgentContext&, InspectorHeapAgent*);
+    virtual ~InspectorConsoleAgent();
+
+    void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*) override;
+    void willDestroyFrontendAndBackend(DisconnectReason) override;
+    void discardValues() override;
+
+    void enable(ErrorString&) override;
+    void disable(ErrorString&) override;
+    void clearMessages(ErrorString&) override;
+    void setMonitoringXHREnabled(ErrorString&, bool enabled) override = 0;
+    void addInspectedNode(ErrorString&, int nodeId) override = 0;
+
+    bool enabled() const { return m_enabled; }
+    void reset();
+
+    void addMessageToConsole(std::unique_ptr<ConsoleMessage>);
+
+    void startTiming(const String& title);
+    void stopTiming(const String& title, PassRefPtr<ScriptCallStack>);
+    void takeHeapSnapshot(const String& title);
+    void count(JSC::ExecState*, PassRefPtr<ScriptArguments>);
+
+protected:
+    void addConsoleMessage(std::unique_ptr<ConsoleMessage>);
+
+    InjectedScriptManager& m_injectedScriptManager;
+    std::unique_ptr<ConsoleFrontendDispatcher> m_frontendDispatcher;
+    RefPtr<ConsoleBackendDispatcher> m_backendDispatcher;
+    InspectorHeapAgent* m_heapAgent;
+
+    ConsoleMessage* m_previousMessage { nullptr };
+    Vector<std::unique_ptr<ConsoleMessage>> m_consoleMessages;
+    int m_expiredConsoleMessageCount { 0 };
+    HashMap<String, unsigned> m_counts;
+    HashMap<String, double> m_times;
+    bool m_enabled { false };
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorDebuggerAgent.cpp b/inspector/agents/InspectorDebuggerAgent.cpp
new file mode 100644
index 0000000..1ef7ed4
--- /dev/null
+++ b/inspector/agents/InspectorDebuggerAgent.cpp
@@ -0,0 +1,1141 @@
+/*
+ * Copyright (C) 2010, 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorDebuggerAgent.h"
+
+#include "AsyncStackTrace.h"
+#include "ContentSearchUtilities.h"
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
+#include "InspectorFrontendRouter.h"
+#include "InspectorValues.h"
+#include "JSCInlines.h"
+#include "RegularExpression.h"
+#include "ScriptCallStackFactory.h"
+#include "ScriptDebugServer.h"
+#include "ScriptObject.h"
+#include "ScriptValue.h"
+#include <wtf/NeverDestroyed.h>
+#include <wtf/Stopwatch.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+const char* InspectorDebuggerAgent::backtraceObjectGroup = "backtrace";
+
+// Objects created and retained by evaluating breakpoint actions are put into object groups
+// according to the breakpoint action identifier assigned by the frontend. A breakpoint may
+// have several object groups, and objects from several backend breakpoint action instances may
+// create objects in the same group.
+static String objectGroupForBreakpointAction(const ScriptBreakpointAction& action)
+{
+    static NeverDestroyed<String> objectGroup(ASCIILiteral("breakpoint-action-"));
+    return makeString(objectGroup.get(), String::number(action.identifier));
+}
+
+InspectorDebuggerAgent::InspectorDebuggerAgent(AgentContext& context)
+    : InspectorAgentBase(ASCIILiteral("Debugger"))
+    , m_injectedScriptManager(context.injectedScriptManager)
+    , m_frontendDispatcher(std::make_unique<DebuggerFrontendDispatcher>(context.frontendRouter))
+    , m_backendDispatcher(DebuggerBackendDispatcher::create(context.backendDispatcher, this))
+    , m_scriptDebugServer(context.environment.scriptDebugServer())
+    , m_continueToLocationBreakpointID(JSC::noBreakpointID)
+{
+    // FIXME: make breakReason optional so that there was no need to init it with "other".
+    clearBreakDetails();
+}
+
+InspectorDebuggerAgent::~InspectorDebuggerAgent()
+{
+}
+
+void InspectorDebuggerAgent::didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*)
+{
+}
+
+void InspectorDebuggerAgent::willDestroyFrontendAndBackend(DisconnectReason reason)
+{
+    bool skipRecompile = reason == DisconnectReason::InspectedTargetDestroyed;
+    disable(skipRecompile);
+}
+
+void InspectorDebuggerAgent::enable()
+{
+    if (m_enabled)
+        return;
+
+    m_scriptDebugServer.addListener(this);
+
+    if (m_listener)
+        m_listener->debuggerWasEnabled();
+
+    m_enabled = true;
+}
+
+void InspectorDebuggerAgent::disable(bool isBeingDestroyed)
+{
+    if (!m_enabled)
+        return;
+
+    m_scriptDebugServer.removeListener(this, isBeingDestroyed);
+    clearInspectorBreakpointState();
+
+    if (!isBeingDestroyed)
+        m_scriptDebugServer.deactivateBreakpoints();
+
+    ASSERT(m_javaScriptBreakpoints.isEmpty());
+
+    if (m_listener)
+        m_listener->debuggerWasDisabled();
+
+    clearAsyncStackTraceData();
+
+    m_pauseOnAssertionFailures = false;
+
+    m_enabled = false;
+}
+
+void InspectorDebuggerAgent::enable(ErrorString&)
+{
+    enable();
+}
+
+void InspectorDebuggerAgent::disable(ErrorString&)
+{
+    disable(false);
+}
+
+bool InspectorDebuggerAgent::breakpointsActive() const
+{
+    return m_scriptDebugServer.breakpointsActive();
+}
+
+void InspectorDebuggerAgent::setAsyncStackTraceDepth(ErrorString& errorString, int depth)
+{
+    if (m_asyncStackTraceDepth == depth)
+        return;
+
+    if (depth < 0) {
+        errorString = ASCIILiteral("depth must be a positive number.");
+        return;
+    }
+
+    m_asyncStackTraceDepth = depth;
+
+    if (!m_asyncStackTraceDepth)
+        clearAsyncStackTraceData();
+}
+
+void InspectorDebuggerAgent::setBreakpointsActive(ErrorString&, bool active)
+{
+    if (active)
+        m_scriptDebugServer.activateBreakpoints();
+    else
+        m_scriptDebugServer.deactivateBreakpoints();
+}
+
+bool InspectorDebuggerAgent::isPaused() const
+{
+    return m_scriptDebugServer.isPaused();
+}
+
+void InspectorDebuggerAgent::setSuppressAllPauses(bool suppress)
+{
+    m_scriptDebugServer.setSuppressAllPauses(suppress);
+}
+
+static RefPtr<InspectorObject> buildAssertPauseReason(const String& message)
+{
+    auto reason = Inspector::Protocol::Debugger::AssertPauseReason::create().release();
+    if (!message.isNull())
+        reason->setMessage(message);
+    return reason->openAccessors();
+}
+
+static RefPtr<InspectorObject> buildCSPViolationPauseReason(const String& directiveText)
+{
+    auto reason = Inspector::Protocol::Debugger::CSPViolationPauseReason::create()
+        .setDirective(directiveText)
+        .release();
+    return reason->openAccessors();
+}
+
+RefPtr<InspectorObject> InspectorDebuggerAgent::buildBreakpointPauseReason(JSC::BreakpointID debuggerBreakpointIdentifier)
+{
+    ASSERT(debuggerBreakpointIdentifier != JSC::noBreakpointID);
+    auto it = m_debuggerBreakpointIdentifierToInspectorBreakpointIdentifier.find(debuggerBreakpointIdentifier);
+    if (it == m_debuggerBreakpointIdentifierToInspectorBreakpointIdentifier.end())
+        return nullptr;
+
+    auto reason = Inspector::Protocol::Debugger::BreakpointPauseReason::create()
+        .setBreakpointId(it->value)
+        .release();
+    return reason->openAccessors();
+}
+
+RefPtr<InspectorObject> InspectorDebuggerAgent::buildExceptionPauseReason(JSC::JSValue exception, const InjectedScript& injectedScript)
+{
+    ASSERT(exception);
+    if (!exception)
+        return nullptr;
+
+    ASSERT(!injectedScript.hasNoValue());
+    if (injectedScript.hasNoValue())
+        return nullptr;
+
+    return injectedScript.wrapObject(exception, InspectorDebuggerAgent::backtraceObjectGroup)->openAccessors();
+}
+
+void InspectorDebuggerAgent::handleConsoleAssert(const String& message)
+{
+    if (!m_scriptDebugServer.breakpointsActive())
+        return;
+
+    if (m_pauseOnAssertionFailures)
+        breakProgram(DebuggerFrontendDispatcher::Reason::Assert, buildAssertPauseReason(message));
+}
+
+void InspectorDebuggerAgent::didScheduleAsyncCall(JSC::ExecState* exec, int asyncCallType, int callbackIdentifier, bool singleShot)
+{
+    if (!m_asyncStackTraceDepth)
+        return;
+
+    if (!m_scriptDebugServer.breakpointsActive())
+        return;
+
+    RefPtr<ScriptCallStack> callStack = createScriptCallStack(exec, m_asyncStackTraceDepth);
+    ASSERT(callStack && callStack->size());
+    if (!callStack || !callStack->size())
+        return;
+
+    RefPtr<AsyncStackTrace> parentStackTrace;
+    if (m_currentAsyncCallIdentifier) {
+        auto it = m_pendingAsyncCalls.find(m_currentAsyncCallIdentifier.value());
+        ASSERT(it != m_pendingAsyncCalls.end());
+        parentStackTrace = it->value;
+    }
+
+    auto identifier = std::make_pair(asyncCallType, callbackIdentifier);
+    auto asyncStackTrace = AsyncStackTrace::create(WTFMove(callStack), singleShot, WTFMove(parentStackTrace));
+
+    m_pendingAsyncCalls.set(identifier, WTFMove(asyncStackTrace));
+}
+
+void InspectorDebuggerAgent::didCancelAsyncCall(int asyncCallType, int callbackIdentifier)
+{
+    if (!m_asyncStackTraceDepth)
+        return;
+
+    auto identifier = std::make_pair(asyncCallType, callbackIdentifier);
+    auto it = m_pendingAsyncCalls.find(identifier);
+    if (it == m_pendingAsyncCalls.end())
+        return;
+
+    auto& asyncStackTrace = it->value;
+    asyncStackTrace->didCancelAsyncCall();
+
+    if (m_currentAsyncCallIdentifier && m_currentAsyncCallIdentifier.value() == identifier)
+        return;
+
+    m_pendingAsyncCalls.remove(identifier);
+}
+
+void InspectorDebuggerAgent::willDispatchAsyncCall(int asyncCallType, int callbackIdentifier)
+{
+    if (!m_asyncStackTraceDepth)
+        return;
+
+    if (m_currentAsyncCallIdentifier)
+        return;
+
+    // A call can be scheduled before the Inspector is opened, or while async stack
+    // traces are disabled. If no call data exists, do nothing.
+    auto identifier = std::make_pair(asyncCallType, callbackIdentifier);
+    auto it = m_pendingAsyncCalls.find(identifier);
+    if (it == m_pendingAsyncCalls.end())
+        return;
+
+    auto& asyncStackTrace = it->value;
+    asyncStackTrace->willDispatchAsyncCall(m_asyncStackTraceDepth);
+
+    m_currentAsyncCallIdentifier = identifier;
+}
+
+void InspectorDebuggerAgent::didDispatchAsyncCall()
+{
+    if (!m_asyncStackTraceDepth)
+        return;
+
+    if (!m_currentAsyncCallIdentifier)
+        return;
+
+    auto identifier = m_currentAsyncCallIdentifier.value();
+    auto it = m_pendingAsyncCalls.find(identifier);
+    ASSERT(it != m_pendingAsyncCalls.end());
+
+    auto& asyncStackTrace = it->value;
+    asyncStackTrace->didDispatchAsyncCall();
+
+    m_currentAsyncCallIdentifier = std::nullopt;
+
+    if (!asyncStackTrace->isPending())
+        m_pendingAsyncCalls.remove(identifier);
+}
+
+static Ref<InspectorObject> buildObjectForBreakpointCookie(const String& url, int lineNumber, int columnNumber, const String& condition, RefPtr<InspectorArray>& actions, bool isRegex, bool autoContinue, unsigned ignoreCount)
+{
+    Ref<InspectorObject> breakpointObject = InspectorObject::create();
+    breakpointObject->setString(ASCIILiteral("url"), url);
+    breakpointObject->setInteger(ASCIILiteral("lineNumber"), lineNumber);
+    breakpointObject->setInteger(ASCIILiteral("columnNumber"), columnNumber);
+    breakpointObject->setString(ASCIILiteral("condition"), condition);
+    breakpointObject->setBoolean(ASCIILiteral("isRegex"), isRegex);
+    breakpointObject->setBoolean(ASCIILiteral("autoContinue"), autoContinue);
+    breakpointObject->setInteger(ASCIILiteral("ignoreCount"), ignoreCount);
+
+    if (actions)
+        breakpointObject->setArray(ASCIILiteral("actions"), actions);
+
+    return breakpointObject;
+}
+
+static bool matches(const String& url, const String& pattern, bool isRegex)
+{
+    if (isRegex) {
+        JSC::Yarr::RegularExpression regex(pattern, TextCaseSensitive);
+        return regex.match(url) != -1;
+    }
+    return url == pattern;
+}
+
+static bool breakpointActionTypeForString(const String& typeString, ScriptBreakpointActionType* output)
+{
+    if (typeString == Inspector::Protocol::InspectorHelpers::getEnumConstantValue(Inspector::Protocol::Debugger::BreakpointAction::Type::Log)) {
+        *output = ScriptBreakpointActionTypeLog;
+        return true;
+    }
+    if (typeString == Inspector::Protocol::InspectorHelpers::getEnumConstantValue(Inspector::Protocol::Debugger::BreakpointAction::Type::Evaluate)) {
+        *output = ScriptBreakpointActionTypeEvaluate;
+        return true;
+    }
+    if (typeString == Inspector::Protocol::InspectorHelpers::getEnumConstantValue(Inspector::Protocol::Debugger::BreakpointAction::Type::Sound)) {
+        *output = ScriptBreakpointActionTypeSound;
+        return true;
+    }
+    if (typeString == Inspector::Protocol::InspectorHelpers::getEnumConstantValue(Inspector::Protocol::Debugger::BreakpointAction::Type::Probe)) {
+        *output = ScriptBreakpointActionTypeProbe;
+        return true;
+    }
+
+    return false;
+}
+
+bool InspectorDebuggerAgent::breakpointActionsFromProtocol(ErrorString& errorString, RefPtr<InspectorArray>& actions, BreakpointActions* result)
+{
+    if (!actions)
+        return true;
+
+    unsigned actionsLength = actions->length();
+    if (!actionsLength)
+        return true;
+
+    result->reserveCapacity(actionsLength);
+    for (unsigned i = 0; i < actionsLength; ++i) {
+        RefPtr<InspectorValue> value = actions->get(i);
+        RefPtr<InspectorObject> object;
+        if (!value->asObject(object)) {
+            errorString = ASCIILiteral("BreakpointAction of incorrect type, expected object");
+            return false;
+        }
+
+        String typeString;
+        if (!object->getString(ASCIILiteral("type"), typeString)) {
+            errorString = ASCIILiteral("BreakpointAction had type missing");
+            return false;
+        }
+
+        ScriptBreakpointActionType type;
+        if (!breakpointActionTypeForString(typeString, &type)) {
+            errorString = ASCIILiteral("BreakpointAction had unknown type");
+            return false;
+        }
+
+        // Specifying an identifier is optional. They are used to correlate probe samples
+        // in the frontend across multiple backend probe actions and segregate object groups.
+        int identifier = 0;
+        object->getInteger(ASCIILiteral("id"), identifier);
+
+        String data;
+        object->getString(ASCIILiteral("data"), data);
+
+        result->append(ScriptBreakpointAction(type, identifier, data));
+    }
+
+    return true;
+}
+
+static RefPtr<Inspector::Protocol::Debugger::Location> buildDebuggerLocation(const JSC::Breakpoint& breakpoint)
+{
+    ASSERT(breakpoint.resolved);
+
+    auto location = Inspector::Protocol::Debugger::Location::create()
+        .setScriptId(String::number(breakpoint.sourceID))
+        .setLineNumber(breakpoint.line)
+        .release();
+    location->setColumnNumber(breakpoint.column);
+
+    return WTFMove(location);
+}
+
+static bool parseLocation(ErrorString& errorString, const InspectorObject& location, JSC::SourceID& sourceID, unsigned& lineNumber, unsigned& columnNumber)
+{
+    String scriptIDStr;
+    if (!location.getString(ASCIILiteral("scriptId"), scriptIDStr) || !location.getInteger(ASCIILiteral("lineNumber"), lineNumber)) {
+        sourceID = JSC::noSourceID;
+        errorString = ASCIILiteral("scriptId and lineNumber are required.");
+        return false;
+    }
+
+    sourceID = scriptIDStr.toIntPtr();
+    columnNumber = 0;
+    location.getInteger(ASCIILiteral("columnNumber"), columnNumber);
+    return true;
+}
+
+void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString& errorString, int lineNumber, const String* const optionalURL, const String* const optionalURLRegex, const int* const optionalColumnNumber, const InspectorObject* options, Inspector::Protocol::Debugger::BreakpointId* outBreakpointIdentifier, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Debugger::Location>>& locations)
+{
+    locations = Inspector::Protocol::Array<Inspector::Protocol::Debugger::Location>::create();
+    if (!optionalURL == !optionalURLRegex) {
+        errorString = ASCIILiteral("Either url or urlRegex must be specified.");
+        return;
+    }
+
+    String url = optionalURL ? *optionalURL : *optionalURLRegex;
+    int columnNumber = optionalColumnNumber ? *optionalColumnNumber : 0;
+    bool isRegex = optionalURLRegex;
+
+    String breakpointIdentifier = (isRegex ? "/" + url + "/" : url) + ':' + String::number(lineNumber) + ':' + String::number(columnNumber);
+    if (m_javaScriptBreakpoints.contains(breakpointIdentifier)) {
+        errorString = ASCIILiteral("Breakpoint at specified location already exists.");
+        return;
+    }
+
+    String condition = emptyString();
+    bool autoContinue = false;
+    unsigned ignoreCount = 0;
+    RefPtr<InspectorArray> actions;
+    if (options) {
+        options->getString(ASCIILiteral("condition"), condition);
+        options->getBoolean(ASCIILiteral("autoContinue"), autoContinue);
+        options->getArray(ASCIILiteral("actions"), actions);
+        options->getInteger(ASCIILiteral("ignoreCount"), ignoreCount);
+    }
+
+    BreakpointActions breakpointActions;
+    if (!breakpointActionsFromProtocol(errorString, actions, &breakpointActions))
+        return;
+
+    m_javaScriptBreakpoints.set(breakpointIdentifier, buildObjectForBreakpointCookie(url, lineNumber, columnNumber, condition, actions, isRegex, autoContinue, ignoreCount));
+
+    for (auto& entry : m_scripts) {
+        Script& script = entry.value;
+        String scriptURLForBreakpoints = !script.sourceURL.isEmpty() ? script.sourceURL : script.url;
+        if (!matches(scriptURLForBreakpoints, url, isRegex))
+            continue;
+
+        JSC::SourceID sourceID = entry.key;
+        JSC::Breakpoint breakpoint(sourceID, lineNumber, columnNumber, condition, autoContinue, ignoreCount);
+        resolveBreakpoint(script, breakpoint);
+        if (!breakpoint.resolved)
+            continue;
+
+        bool existing;
+        setBreakpoint(breakpoint, existing);
+        if (existing)
+            continue;
+
+        ScriptBreakpoint scriptBreakpoint(breakpoint.line, breakpoint.column, condition, breakpointActions, autoContinue, ignoreCount);
+        didSetBreakpoint(breakpoint, breakpointIdentifier, scriptBreakpoint);
+
+        locations->addItem(buildDebuggerLocation(breakpoint));
+    }
+
+    *outBreakpointIdentifier = breakpointIdentifier;
+}
+
+void InspectorDebuggerAgent::setBreakpoint(ErrorString& errorString, const InspectorObject& location, const InspectorObject* options, Inspector::Protocol::Debugger::BreakpointId* outBreakpointIdentifier, RefPtr<Inspector::Protocol::Debugger::Location>& actualLocation)
+{
+    JSC::SourceID sourceID;
+    unsigned lineNumber;
+    unsigned columnNumber;
+    if (!parseLocation(errorString, location, sourceID, lineNumber, columnNumber))
+        return;
+
+    String condition = emptyString();
+    bool autoContinue = false;
+    unsigned ignoreCount = 0;
+    RefPtr<InspectorArray> actions;
+    if (options) {
+        options->getString(ASCIILiteral("condition"), condition);
+        options->getBoolean(ASCIILiteral("autoContinue"), autoContinue);
+        options->getArray(ASCIILiteral("actions"), actions);
+        options->getInteger(ASCIILiteral("ignoreCount"), ignoreCount);
+    }
+
+    BreakpointActions breakpointActions;
+    if (!breakpointActionsFromProtocol(errorString, actions, &breakpointActions))
+        return;
+
+    auto scriptIterator = m_scripts.find(sourceID);
+    if (scriptIterator == m_scripts.end()) {
+        errorString = ASCIILiteral("No script for id: ") + String::number(sourceID);
+        return;
+    }
+
+    Script& script = scriptIterator->value;
+    JSC::Breakpoint breakpoint(sourceID, lineNumber, columnNumber, condition, autoContinue, ignoreCount);
+    resolveBreakpoint(script, breakpoint);
+    if (!breakpoint.resolved) {
+        errorString = ASCIILiteral("Could not resolve breakpoint");
+        return;
+    }
+
+    bool existing;
+    setBreakpoint(breakpoint, existing);
+    if (existing) {
+        errorString = ASCIILiteral("Breakpoint at specified location already exists");
+        return;
+    }
+
+    String breakpointIdentifier = String::number(sourceID) + ':' + String::number(breakpoint.line) + ':' + String::number(breakpoint.column);
+    ScriptBreakpoint scriptBreakpoint(breakpoint.line, breakpoint.column, condition, breakpointActions, autoContinue, ignoreCount);
+    didSetBreakpoint(breakpoint, breakpointIdentifier, scriptBreakpoint);
+
+    actualLocation = buildDebuggerLocation(breakpoint);
+    *outBreakpointIdentifier = breakpointIdentifier;
+}
+
+void InspectorDebuggerAgent::didSetBreakpoint(const JSC::Breakpoint& breakpoint, const String& breakpointIdentifier, const ScriptBreakpoint& scriptBreakpoint)
+{
+    JSC::BreakpointID id = breakpoint.id;
+    m_scriptDebugServer.setBreakpointActions(id, scriptBreakpoint);
+
+    auto debugServerBreakpointIDsIterator = m_breakpointIdentifierToDebugServerBreakpointIDs.find(breakpointIdentifier);
+    if (debugServerBreakpointIDsIterator == m_breakpointIdentifierToDebugServerBreakpointIDs.end())
+        debugServerBreakpointIDsIterator = m_breakpointIdentifierToDebugServerBreakpointIDs.set(breakpointIdentifier, Vector<JSC::BreakpointID>()).iterator;
+    debugServerBreakpointIDsIterator->value.append(id);
+
+    m_debuggerBreakpointIdentifierToInspectorBreakpointIdentifier.set(id, breakpointIdentifier);
+}
+
+void InspectorDebuggerAgent::resolveBreakpoint(const Script& script, JSC::Breakpoint& breakpoint)
+{
+    if (breakpoint.line < static_cast<unsigned>(script.startLine) || static_cast<unsigned>(script.endLine) < breakpoint.line)
+        return;
+
+    m_scriptDebugServer.resolveBreakpoint(breakpoint, script.sourceProvider.get());
+}
+
+void InspectorDebuggerAgent::setBreakpoint(JSC::Breakpoint& breakpoint, bool& existing)
+{
+    JSC::JSLockHolder locker(m_scriptDebugServer.vm());
+    m_scriptDebugServer.setBreakpoint(breakpoint, existing);
+}
+
+void InspectorDebuggerAgent::removeBreakpoint(ErrorString&, const String& breakpointIdentifier)
+{
+    m_javaScriptBreakpoints.remove(breakpointIdentifier);
+
+    for (JSC::BreakpointID breakpointID : m_breakpointIdentifierToDebugServerBreakpointIDs.take(breakpointIdentifier)) {
+        m_debuggerBreakpointIdentifierToInspectorBreakpointIdentifier.remove(breakpointID);
+
+        const BreakpointActions& breakpointActions = m_scriptDebugServer.getActionsForBreakpoint(breakpointID);
+        for (auto& action : breakpointActions)
+            m_injectedScriptManager.releaseObjectGroup(objectGroupForBreakpointAction(action));
+
+        JSC::JSLockHolder locker(m_scriptDebugServer.vm());
+        m_scriptDebugServer.removeBreakpointActions(breakpointID);
+        m_scriptDebugServer.removeBreakpoint(breakpointID);
+    }
+}
+
+void InspectorDebuggerAgent::continueUntilNextRunLoop(ErrorString& errorString)
+{
+    if (!assertPaused(errorString))
+        return;
+
+    resume(errorString);
+
+    m_enablePauseWhenIdle = true;
+
+    registerIdleHandler();
+}
+
+void InspectorDebuggerAgent::continueToLocation(ErrorString& errorString, const InspectorObject& location)
+{
+    if (!assertPaused(errorString))
+        return;
+
+    if (m_continueToLocationBreakpointID != JSC::noBreakpointID) {
+        m_scriptDebugServer.removeBreakpoint(m_continueToLocationBreakpointID);
+        m_continueToLocationBreakpointID = JSC::noBreakpointID;
+    }
+
+    JSC::SourceID sourceID;
+    unsigned lineNumber;
+    unsigned columnNumber;
+    if (!parseLocation(errorString, location, sourceID, lineNumber, columnNumber))
+        return;
+
+    auto scriptIterator = m_scripts.find(sourceID);
+    if (scriptIterator == m_scripts.end()) {
+        m_scriptDebugServer.continueProgram();
+        m_frontendDispatcher->resumed();
+        errorString = ASCIILiteral("No script for id: ") + String::number(sourceID);
+        return;
+    }
+
+    String condition;
+    bool autoContinue = false;
+    unsigned ignoreCount = 0;
+    JSC::Breakpoint breakpoint(sourceID, lineNumber, columnNumber, condition, autoContinue, ignoreCount);
+    Script& script = scriptIterator->value;
+    resolveBreakpoint(script, breakpoint);
+    if (!breakpoint.resolved) {
+        m_scriptDebugServer.continueProgram();
+        m_frontendDispatcher->resumed();
+        errorString = ASCIILiteral("Could not resolve breakpoint");
+        return;
+    }
+
+    bool existing;
+    setBreakpoint(breakpoint, existing);
+    if (existing) {
+        // There is an existing breakpoint at this location. Instead of
+        // acting like a series of steps, just resume and we will either
+        // hit this new breakpoint or not.
+        m_scriptDebugServer.continueProgram();
+        m_frontendDispatcher->resumed();
+        return;
+    }
+
+    m_continueToLocationBreakpointID = breakpoint.id;
+
+    // Treat this as a series of steps until reaching the new breakpoint.
+    // So don't issue a resumed event unless we exit the VM without pausing.
+    willStepAndMayBecomeIdle();
+    m_scriptDebugServer.continueProgram();
+}
+
+void InspectorDebuggerAgent::searchInContent(ErrorString& error, const String& scriptIDStr, const String& query, const bool* optionalCaseSensitive, const bool* optionalIsRegex, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::GenericTypes::SearchMatch>>& results)
+{
+    JSC::SourceID sourceID = scriptIDStr.toIntPtr();
+    auto it = m_scripts.find(sourceID);
+    if (it == m_scripts.end()) {
+        error = ASCIILiteral("No script for id: ") + scriptIDStr;
+        return;
+    }
+
+    bool isRegex = optionalIsRegex ? *optionalIsRegex : false;
+    bool caseSensitive = optionalCaseSensitive ? *optionalCaseSensitive : false;
+    results = ContentSearchUtilities::searchInTextByLines(it->value.source, query, caseSensitive, isRegex);
+}
+
+void InspectorDebuggerAgent::getScriptSource(ErrorString& error, const String& scriptIDStr, String* scriptSource)
+{
+    JSC::SourceID sourceID = scriptIDStr.toIntPtr();
+    ScriptsMap::iterator it = m_scripts.find(sourceID);
+    if (it != m_scripts.end())
+        *scriptSource = it->value.source;
+    else
+        error = ASCIILiteral("No script for id: ") + scriptIDStr;
+}
+
+void InspectorDebuggerAgent::getFunctionDetails(ErrorString& errorString, const String& functionId, RefPtr<Inspector::Protocol::Debugger::FunctionDetails>& details)
+{
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptForObjectId(functionId);
+    if (injectedScript.hasNoValue()) {
+        errorString = ASCIILiteral("Function object id is obsolete");
+        return;
+    }
+
+    injectedScript.getFunctionDetails(errorString, functionId, &details);
+}
+
+void InspectorDebuggerAgent::schedulePauseOnNextStatement(DebuggerFrontendDispatcher::Reason breakReason, RefPtr<InspectorObject>&& data)
+{
+    if (m_javaScriptPauseScheduled)
+        return;
+
+    m_javaScriptPauseScheduled = true;
+
+    m_breakReason = breakReason;
+    m_breakAuxData = WTFMove(data);
+
+    JSC::JSLockHolder locker(m_scriptDebugServer.vm());
+    m_scriptDebugServer.setPauseOnNextStatement(true);
+}
+
+void InspectorDebuggerAgent::cancelPauseOnNextStatement()
+{
+    if (!m_javaScriptPauseScheduled)
+        return;
+
+    m_javaScriptPauseScheduled = false;
+
+    clearBreakDetails();
+    m_scriptDebugServer.setPauseOnNextStatement(false);
+    m_enablePauseWhenIdle = false;
+}
+
+void InspectorDebuggerAgent::pause(ErrorString&)
+{
+    schedulePauseOnNextStatement(DebuggerFrontendDispatcher::Reason::PauseOnNextStatement, nullptr);
+}
+
+void InspectorDebuggerAgent::resume(ErrorString& errorString)
+{
+    if (!m_pausedScriptState && !m_javaScriptPauseScheduled) {
+        errorString = ASCIILiteral("Was not paused or waiting to pause");
+        return;
+    }
+
+    cancelPauseOnNextStatement();
+    m_scriptDebugServer.continueProgram();
+    m_conditionToDispatchResumed = ShouldDispatchResumed::WhenContinued;
+}
+
+void InspectorDebuggerAgent::stepOver(ErrorString& errorString)
+{
+    if (!assertPaused(errorString))
+        return;
+
+    willStepAndMayBecomeIdle();
+    m_scriptDebugServer.stepOverStatement();
+}
+
+void InspectorDebuggerAgent::stepInto(ErrorString& errorString)
+{
+    if (!assertPaused(errorString))
+        return;
+
+    willStepAndMayBecomeIdle();
+    m_scriptDebugServer.stepIntoStatement();
+}
+
+void InspectorDebuggerAgent::stepOut(ErrorString& errorString)
+{
+    if (!assertPaused(errorString))
+        return;
+
+    willStepAndMayBecomeIdle();
+    m_scriptDebugServer.stepOutOfFunction();
+}
+
+void InspectorDebuggerAgent::registerIdleHandler()
+{
+    if (!m_registeredIdleCallback) {
+        m_registeredIdleCallback = true;
+        JSC::VM& vm = m_scriptDebugServer.vm();
+        vm.whenIdle([this]() {
+            didBecomeIdle();
+        });
+    }
+}
+
+void InspectorDebuggerAgent::willStepAndMayBecomeIdle()
+{
+    // When stepping the backend must eventually trigger a "paused" or "resumed" event.
+    // If the step causes us to exit the VM, then we should issue "resumed".
+    m_conditionToDispatchResumed = ShouldDispatchResumed::WhenIdle;
+
+    registerIdleHandler();
+}
+
+void InspectorDebuggerAgent::didBecomeIdle()
+{
+    m_registeredIdleCallback = false;
+
+    if (m_conditionToDispatchResumed == ShouldDispatchResumed::WhenIdle)
+        m_frontendDispatcher->resumed();
+
+    m_conditionToDispatchResumed = ShouldDispatchResumed::No;
+
+    if (m_enablePauseWhenIdle) {
+        ErrorString ignored;
+        pause(ignored);
+    }
+}
+
+void InspectorDebuggerAgent::setPauseOnExceptions(ErrorString& errorString, const String& stringPauseState)
+{
+    JSC::Debugger::PauseOnExceptionsState pauseState;
+    if (stringPauseState == "none")
+        pauseState = JSC::Debugger::DontPauseOnExceptions;
+    else if (stringPauseState == "all")
+        pauseState = JSC::Debugger::PauseOnAllExceptions;
+    else if (stringPauseState == "uncaught")
+        pauseState = JSC::Debugger::PauseOnUncaughtExceptions;
+    else {
+        errorString = ASCIILiteral("Unknown pause on exceptions mode: ") + stringPauseState;
+        return;
+    }
+
+    m_scriptDebugServer.setPauseOnExceptionsState(static_cast<JSC::Debugger::PauseOnExceptionsState>(pauseState));
+    if (m_scriptDebugServer.pauseOnExceptionsState() != pauseState)
+        errorString = ASCIILiteral("Internal error. Could not change pause on exceptions state");
+}
+
+void InspectorDebuggerAgent::setPauseOnAssertions(ErrorString&, bool enabled)
+{
+    m_pauseOnAssertionFailures = enabled;
+}
+
+void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString& errorString, const String& callFrameId, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const doNotPauseOnExceptionsAndMuteConsole, const bool* const returnByValue, const bool* generatePreview, const bool* saveResult, RefPtr<Inspector::Protocol::Runtime::RemoteObject>& result, Inspector::Protocol::OptOutput<bool>* wasThrown, Inspector::Protocol::OptOutput<int>* savedResultIndex)
+{
+    if (m_currentCallStack.hasNoValue()) {
+        errorString = ASCIILiteral("Not paused");
+        return;
+    }
+
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptForObjectId(callFrameId);
+    if (injectedScript.hasNoValue()) {
+        errorString = ASCIILiteral("Could not find InjectedScript for callFrameId");
+        return;
+    }
+
+    JSC::Debugger::PauseOnExceptionsState previousPauseOnExceptionsState = m_scriptDebugServer.pauseOnExceptionsState();
+    if (doNotPauseOnExceptionsAndMuteConsole ? *doNotPauseOnExceptionsAndMuteConsole : false) {
+        if (previousPauseOnExceptionsState != JSC::Debugger::DontPauseOnExceptions)
+            m_scriptDebugServer.setPauseOnExceptionsState(JSC::Debugger::DontPauseOnExceptions);
+        muteConsole();
+    }
+
+    injectedScript.evaluateOnCallFrame(errorString, m_currentCallStack, callFrameId, expression, objectGroup ? *objectGroup : "", includeCommandLineAPI ? *includeCommandLineAPI : false, returnByValue ? *returnByValue : false, generatePreview ? *generatePreview : false, saveResult ? *saveResult : false, &result, wasThrown, savedResultIndex);
+
+    if (doNotPauseOnExceptionsAndMuteConsole ? *doNotPauseOnExceptionsAndMuteConsole : false) {
+        unmuteConsole();
+        if (m_scriptDebugServer.pauseOnExceptionsState() != previousPauseOnExceptionsState)
+            m_scriptDebugServer.setPauseOnExceptionsState(previousPauseOnExceptionsState);
+    }
+}
+
+void InspectorDebuggerAgent::setOverlayMessage(ErrorString&, const String*)
+{
+}
+
+void InspectorDebuggerAgent::scriptExecutionBlockedByCSP(const String& directiveText)
+{
+    if (m_scriptDebugServer.pauseOnExceptionsState() != JSC::Debugger::DontPauseOnExceptions)
+        breakProgram(DebuggerFrontendDispatcher::Reason::CSPViolation, buildCSPViolationPauseReason(directiveText));
+}
+
+Ref<Inspector::Protocol::Array<Inspector::Protocol::Debugger::CallFrame>> InspectorDebuggerAgent::currentCallFrames(const InjectedScript& injectedScript)
+{
+    ASSERT(!injectedScript.hasNoValue());
+    if (injectedScript.hasNoValue())
+        return Inspector::Protocol::Array<Inspector::Protocol::Debugger::CallFrame>::create();
+
+    return injectedScript.wrapCallFrames(m_currentCallStack);
+}
+
+String InspectorDebuggerAgent::sourceMapURLForScript(const Script& script)
+{
+    return script.sourceMappingURL;
+}
+
+static bool isWebKitInjectedScript(const String& sourceURL)
+{
+    return sourceURL.startsWith("__InjectedScript_") && sourceURL.endsWith(".js");
+}
+
+void InspectorDebuggerAgent::didParseSource(JSC::SourceID sourceID, const Script& script)
+{
+    String scriptIDStr = String::number(sourceID);
+    bool hasSourceURL = !script.sourceURL.isEmpty();
+    String sourceURL = script.sourceURL;
+    String sourceMappingURL = sourceMapURLForScript(script);
+
+    const bool isModule = script.sourceProvider->sourceType() == JSC::SourceProviderSourceType::Module;
+    const bool* isContentScript = script.isContentScript ? &script.isContentScript : nullptr;
+    String* sourceURLParam = hasSourceURL ? &sourceURL : nullptr;
+    String* sourceMapURLParam = sourceMappingURL.isEmpty() ? nullptr : &sourceMappingURL;
+
+    m_frontendDispatcher->scriptParsed(scriptIDStr, script.url, script.startLine, script.startColumn, script.endLine, script.endColumn, isContentScript, sourceURLParam, sourceMapURLParam, isModule ? &isModule : nullptr);
+
+    m_scripts.set(sourceID, script);
+
+    if (hasSourceURL && isWebKitInjectedScript(sourceURL))
+        m_scriptDebugServer.addToBlacklist(sourceID);
+
+    String scriptURLForBreakpoints = hasSourceURL ? script.sourceURL : script.url;
+    if (scriptURLForBreakpoints.isEmpty())
+        return;
+
+    for (auto& entry : m_javaScriptBreakpoints) {
+        RefPtr<InspectorObject> breakpointObject = entry.value;
+
+        bool isRegex;
+        String url;
+        breakpointObject->getBoolean(ASCIILiteral("isRegex"), isRegex);
+        breakpointObject->getString(ASCIILiteral("url"), url);
+        if (!matches(scriptURLForBreakpoints, url, isRegex))
+            continue;
+
+        ScriptBreakpoint scriptBreakpoint;
+        breakpointObject->getInteger(ASCIILiteral("lineNumber"), scriptBreakpoint.lineNumber);
+        breakpointObject->getInteger(ASCIILiteral("columnNumber"), scriptBreakpoint.columnNumber);
+        breakpointObject->getString(ASCIILiteral("condition"), scriptBreakpoint.condition);
+        breakpointObject->getBoolean(ASCIILiteral("autoContinue"), scriptBreakpoint.autoContinue);
+        breakpointObject->getInteger(ASCIILiteral("ignoreCount"), scriptBreakpoint.ignoreCount);
+        ErrorString errorString;
+        RefPtr<InspectorArray> actions;
+        breakpointObject->getArray(ASCIILiteral("actions"), actions);
+        if (!breakpointActionsFromProtocol(errorString, actions, &scriptBreakpoint.actions)) {
+            ASSERT_NOT_REACHED();
+            continue;
+        }
+
+        JSC::Breakpoint breakpoint(sourceID, scriptBreakpoint.lineNumber, scriptBreakpoint.columnNumber, scriptBreakpoint.condition, scriptBreakpoint.autoContinue, scriptBreakpoint.ignoreCount);
+        resolveBreakpoint(script, breakpoint);
+        if (!breakpoint.resolved)
+            continue;
+
+        bool existing;
+        setBreakpoint(breakpoint, existing);
+        if (existing)
+            continue;
+
+        String breakpointIdentifier = entry.key;
+        didSetBreakpoint(breakpoint, breakpointIdentifier, scriptBreakpoint);
+
+        m_frontendDispatcher->breakpointResolved(breakpointIdentifier, buildDebuggerLocation(breakpoint));
+    }
+}
+
+void InspectorDebuggerAgent::failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage)
+{
+    m_frontendDispatcher->scriptFailedToParse(url, data, firstLine, errorLine, errorMessage);
+}
+
+void InspectorDebuggerAgent::didPause(JSC::ExecState& scriptState, JSC::JSValue callFrames, JSC::JSValue exceptionOrCaughtValue)
+{
+    ASSERT(!m_pausedScriptState);
+    m_pausedScriptState = &scriptState;
+    m_currentCallStack = { scriptState.vm(), callFrames };
+
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptFor(&scriptState);
+
+    // If a high level pause pause reason is not already set, try to infer a reason from the debugger.
+    if (m_breakReason == DebuggerFrontendDispatcher::Reason::Other) {
+        switch (m_scriptDebugServer.reasonForPause()) {
+        case JSC::Debugger::PausedForBreakpoint: {
+            JSC::BreakpointID debuggerBreakpointId = m_scriptDebugServer.pausingBreakpointID();
+            if (debuggerBreakpointId != m_continueToLocationBreakpointID) {
+                m_breakReason = DebuggerFrontendDispatcher::Reason::Breakpoint;
+                m_breakAuxData = buildBreakpointPauseReason(debuggerBreakpointId);
+            }
+            break;
+        }
+        case JSC::Debugger::PausedForDebuggerStatement:
+            m_breakReason = DebuggerFrontendDispatcher::Reason::DebuggerStatement;
+            m_breakAuxData = nullptr;
+            break;
+        case JSC::Debugger::PausedForException:
+            m_breakReason = DebuggerFrontendDispatcher::Reason::Exception;
+            m_breakAuxData = buildExceptionPauseReason(exceptionOrCaughtValue, injectedScript);
+            break;
+        case JSC::Debugger::PausedAtStatement:
+        case JSC::Debugger::PausedAtExpression:
+        case JSC::Debugger::PausedBeforeReturn:
+        case JSC::Debugger::PausedAtEndOfProgram:
+            // Pause was just stepping. Nothing to report.
+            break;
+        case JSC::Debugger::NotPaused:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+
+    // Set $exception to the exception or caught value.
+    if (exceptionOrCaughtValue && !injectedScript.hasNoValue()) {
+        injectedScript.setExceptionValue(exceptionOrCaughtValue);
+        m_hasExceptionValue = true;
+    }
+
+    m_conditionToDispatchResumed = ShouldDispatchResumed::No;
+    m_enablePauseWhenIdle = false;
+
+    RefPtr<Inspector::Protocol::Console::StackTrace> asyncStackTrace;
+    if (m_currentAsyncCallIdentifier) {
+        auto it = m_pendingAsyncCalls.find(m_currentAsyncCallIdentifier.value());
+        if (it != m_pendingAsyncCalls.end())
+            asyncStackTrace = it->value->buildInspectorObject();
+    }
+
+    m_frontendDispatcher->paused(currentCallFrames(injectedScript), m_breakReason, m_breakAuxData, asyncStackTrace);
+
+    m_javaScriptPauseScheduled = false;
+
+    if (m_continueToLocationBreakpointID != JSC::noBreakpointID) {
+        m_scriptDebugServer.removeBreakpoint(m_continueToLocationBreakpointID);
+        m_continueToLocationBreakpointID = JSC::noBreakpointID;
+    }
+
+    RefPtr<Stopwatch> stopwatch = m_injectedScriptManager.inspectorEnvironment().executionStopwatch();
+    if (stopwatch && stopwatch->isActive()) {
+        stopwatch->stop();
+        m_didPauseStopwatch = true;
+    }
+}
+
+void InspectorDebuggerAgent::breakpointActionSound(int breakpointActionIdentifier)
+{
+    m_frontendDispatcher->playBreakpointActionSound(breakpointActionIdentifier);
+}
+
+void InspectorDebuggerAgent::breakpointActionProbe(JSC::ExecState& scriptState, const ScriptBreakpointAction& action, unsigned batchId, unsigned sampleId, JSC::JSValue sample)
+{
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptFor(&scriptState);
+    auto payload = injectedScript.wrapObject(sample, objectGroupForBreakpointAction(action), true);
+    auto result = Protocol::Debugger::ProbeSample::create()
+        .setProbeId(action.identifier)
+        .setBatchId(batchId)
+        .setSampleId(sampleId)
+        .setTimestamp(m_injectedScriptManager.inspectorEnvironment().executionStopwatch()->elapsedTime())
+        .setPayload(WTFMove(payload))
+        .release();
+    m_frontendDispatcher->didSampleProbe(WTFMove(result));
+}
+
+void InspectorDebuggerAgent::didContinue()
+{
+    if (m_didPauseStopwatch) {
+        m_didPauseStopwatch = false;
+        m_injectedScriptManager.inspectorEnvironment().executionStopwatch()->start();
+    }
+
+    m_pausedScriptState = nullptr;
+    m_currentCallStack = { };
+    m_injectedScriptManager.releaseObjectGroup(InspectorDebuggerAgent::backtraceObjectGroup);
+    clearBreakDetails();
+    clearExceptionValue();
+
+    if (m_conditionToDispatchResumed == ShouldDispatchResumed::WhenContinued)
+        m_frontendDispatcher->resumed();
+}
+
+void InspectorDebuggerAgent::breakProgram(DebuggerFrontendDispatcher::Reason breakReason, RefPtr<InspectorObject>&& data)
+{
+    m_breakReason = breakReason;
+    m_breakAuxData = WTFMove(data);
+    m_scriptDebugServer.breakProgram();
+}
+
+void InspectorDebuggerAgent::clearInspectorBreakpointState()
+{
+    ErrorString dummyError;
+    Vector<String> breakpointIdentifiers;
+    copyKeysToVector(m_breakpointIdentifierToDebugServerBreakpointIDs, breakpointIdentifiers);
+    for (const String& identifier : breakpointIdentifiers)
+        removeBreakpoint(dummyError, identifier);
+
+    m_javaScriptBreakpoints.clear();
+
+    clearDebuggerBreakpointState();
+}
+
+void InspectorDebuggerAgent::clearDebuggerBreakpointState()
+{
+    {
+        JSC::JSLockHolder holder(m_scriptDebugServer.vm());
+        m_scriptDebugServer.clearBreakpointActions();
+        m_scriptDebugServer.clearBreakpoints();
+        m_scriptDebugServer.clearBlacklist();
+    }
+
+    m_pausedScriptState = nullptr;
+    m_currentCallStack = { };
+    m_scripts.clear();
+    m_breakpointIdentifierToDebugServerBreakpointIDs.clear();
+    m_debuggerBreakpointIdentifierToInspectorBreakpointIdentifier.clear();
+    m_continueToLocationBreakpointID = JSC::noBreakpointID;
+    clearBreakDetails();
+    m_javaScriptPauseScheduled = false;
+    m_hasExceptionValue = false;
+
+    if (isPaused()) {
+        m_scriptDebugServer.continueProgram();
+        m_frontendDispatcher->resumed();
+    }
+}
+
+void InspectorDebuggerAgent::didClearGlobalObject()
+{
+    // Clear breakpoints from the debugger, but keep the inspector's model of which
+    // pages have what breakpoints, as the mapping is only sent to DebuggerAgent once.
+    clearDebuggerBreakpointState();
+
+    clearAsyncStackTraceData();
+
+    m_frontendDispatcher->globalObjectCleared();
+}
+
+bool InspectorDebuggerAgent::assertPaused(ErrorString& errorString)
+{
+    if (!m_pausedScriptState) {
+        errorString = ASCIILiteral("Can only perform operation while paused.");
+        return false;
+    }
+
+    return true;
+}
+
+void InspectorDebuggerAgent::clearBreakDetails()
+{
+    m_breakReason = DebuggerFrontendDispatcher::Reason::Other;
+    m_breakAuxData = nullptr;
+}
+
+void InspectorDebuggerAgent::clearExceptionValue()
+{
+    if (m_hasExceptionValue) {
+        m_injectedScriptManager.clearExceptionValue();
+        m_hasExceptionValue = false;
+    }
+}
+
+void InspectorDebuggerAgent::clearAsyncStackTraceData()
+{
+    m_pendingAsyncCalls.clear();
+    m_currentAsyncCallIdentifier = std::nullopt;
+}
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorDebuggerAgent.h b/inspector/agents/InspectorDebuggerAgent.h
new file mode 100644
index 0000000..573155d
--- /dev/null
+++ b/inspector/agents/InspectorDebuggerAgent.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2010, 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorBackendDispatchers.h"
+#include "InspectorFrontendDispatchers.h"
+#include "bindings/ScriptValue.h"
+#include "debugger/Debugger.h"
+#include "inspector/InspectorAgentBase.h"
+#include "inspector/ScriptBreakpoint.h"
+#include "inspector/ScriptCallStack.h"
+#include "inspector/ScriptDebugListener.h"
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
+
+namespace Inspector {
+
+class AsyncStackTrace;
+class InjectedScript;
+class InjectedScriptManager;
+class InspectorArray;
+class InspectorObject;
+class ScriptDebugServer;
+typedef String ErrorString;
+
+class JS_EXPORT_PRIVATE InspectorDebuggerAgent : public InspectorAgentBase, public ScriptDebugListener, public DebuggerBackendDispatcherHandler {
+    WTF_MAKE_NONCOPYABLE(InspectorDebuggerAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static const char* backtraceObjectGroup;
+
+    virtual ~InspectorDebuggerAgent();
+
+    void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*) final;
+    void willDestroyFrontendAndBackend(DisconnectReason) final;
+
+    void enable(ErrorString&) final;
+    void disable(ErrorString&) final;
+    void setAsyncStackTraceDepth(ErrorString&, int depth) final;
+    void setBreakpointsActive(ErrorString&, bool active) final;
+    void setBreakpointByUrl(ErrorString&, int lineNumber, const String* optionalURL, const String* optionalURLRegex, const int* optionalColumnNumber, const Inspector::InspectorObject* options, Inspector::Protocol::Debugger::BreakpointId*, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Debugger::Location>>& locations) final;
+    void setBreakpoint(ErrorString&, const Inspector::InspectorObject& location, const Inspector::InspectorObject* options, Inspector::Protocol::Debugger::BreakpointId*, RefPtr<Inspector::Protocol::Debugger::Location>& actualLocation) final;
+    void removeBreakpoint(ErrorString&, const String& breakpointIdentifier) final;
+    void continueUntilNextRunLoop(ErrorString&) final;
+    void continueToLocation(ErrorString&, const InspectorObject& location) final;
+    void searchInContent(ErrorString&, const String& scriptID, const String& query, const bool* optionalCaseSensitive, const bool* optionalIsRegex, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::GenericTypes::SearchMatch>>&) final;
+    void getScriptSource(ErrorString&, const String& scriptID, String* scriptSource) final;
+    void getFunctionDetails(ErrorString&, const String& functionId, RefPtr<Inspector::Protocol::Debugger::FunctionDetails>&) final;
+    void pause(ErrorString&) final;
+    void resume(ErrorString&) final;
+    void stepOver(ErrorString&) final;
+    void stepInto(ErrorString&) final;
+    void stepOut(ErrorString&) final;
+    void setPauseOnExceptions(ErrorString&, const String& pauseState) final;
+    void setPauseOnAssertions(ErrorString&, bool enabled) final;
+    void evaluateOnCallFrame(ErrorString&, const String& callFrameId, const String& expression, const String* objectGroup, const bool* includeCommandLineAPI, const bool* doNotPauseOnExceptionsAndMuteConsole, const bool* returnByValue, const bool* generatePreview, const bool* saveResult, RefPtr<Inspector::Protocol::Runtime::RemoteObject>& result, Inspector::Protocol::OptOutput<bool>* wasThrown, Inspector::Protocol::OptOutput<int>* savedResultIndex) final;
+    void setOverlayMessage(ErrorString&, const String*) override;
+
+    bool isPaused() const;
+    bool breakpointsActive() const;
+
+    void setSuppressAllPauses(bool);
+
+    void handleConsoleAssert(const String& message);
+
+    void didScheduleAsyncCall(JSC::ExecState*, int asyncCallType, int callbackIdentifier, bool singleShot);
+    void didCancelAsyncCall(int asyncCallType, int callbackIdentifier);
+    void willDispatchAsyncCall(int asyncCallType, int callbackIdentifier);
+    void didDispatchAsyncCall();
+
+    void schedulePauseOnNextStatement(DebuggerFrontendDispatcher::Reason breakReason, RefPtr<InspectorObject>&& data);
+    void cancelPauseOnNextStatement();
+    bool pauseOnNextStatementEnabled() const { return m_javaScriptPauseScheduled; }
+
+    void breakProgram(DebuggerFrontendDispatcher::Reason breakReason, RefPtr<InspectorObject>&& data);
+    void scriptExecutionBlockedByCSP(const String& directiveText);
+
+    class Listener {
+    public:
+        virtual ~Listener() { }
+        virtual void debuggerWasEnabled() = 0;
+        virtual void debuggerWasDisabled() = 0;
+    };
+    void setListener(Listener* listener) { m_listener = listener; }
+
+protected:
+    InspectorDebuggerAgent(AgentContext&);
+
+    InjectedScriptManager& injectedScriptManager() const { return m_injectedScriptManager; }
+    virtual InjectedScript injectedScriptForEval(ErrorString&, const int* executionContextId) = 0;
+
+    ScriptDebugServer& scriptDebugServer() { return m_scriptDebugServer; }
+
+    virtual void muteConsole() = 0;
+    virtual void unmuteConsole() = 0;
+
+    virtual void enable();
+    virtual void disable(bool skipRecompile);
+    void didPause(JSC::ExecState&, JSC::JSValue callFrames, JSC::JSValue exceptionOrCaughtValue) final;
+    void didContinue() final;
+
+    virtual String sourceMapURLForScript(const Script&);
+
+    void didClearGlobalObject();
+
+private:
+    Ref<Inspector::Protocol::Array<Inspector::Protocol::Debugger::CallFrame>> currentCallFrames(const InjectedScript&);
+
+    void didParseSource(JSC::SourceID, const Script&) final;
+    void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage) final;
+
+    void breakpointActionSound(int breakpointActionIdentifier) final;
+    void breakpointActionProbe(JSC::ExecState&, const ScriptBreakpointAction&, unsigned batchId, unsigned sampleId, JSC::JSValue sample) final;
+
+    void resolveBreakpoint(const Script&, JSC::Breakpoint&);
+    void setBreakpoint(JSC::Breakpoint&, bool& existing);    
+    void didSetBreakpoint(const JSC::Breakpoint&, const String&, const ScriptBreakpoint&);
+
+    bool assertPaused(ErrorString&);
+    void clearDebuggerBreakpointState();
+    void clearInspectorBreakpointState();
+    void clearBreakDetails();
+    void clearExceptionValue();
+    void clearAsyncStackTraceData();
+
+    enum class ShouldDispatchResumed { No, WhenIdle, WhenContinued };
+    void registerIdleHandler();
+    void willStepAndMayBecomeIdle();
+    void didBecomeIdle();
+
+    RefPtr<InspectorObject> buildBreakpointPauseReason(JSC::BreakpointID);
+    RefPtr<InspectorObject> buildExceptionPauseReason(JSC::JSValue exception, const InjectedScript&);
+
+    bool breakpointActionsFromProtocol(ErrorString&, RefPtr<InspectorArray>& actions, BreakpointActions* result);
+
+    typedef std::pair<int, int> AsyncCallIdentifier;
+
+    typedef HashMap<JSC::SourceID, Script> ScriptsMap;
+    typedef HashMap<String, Vector<JSC::BreakpointID>> BreakpointIdentifierToDebugServerBreakpointIDsMap;
+    typedef HashMap<String, RefPtr<InspectorObject>> BreakpointIdentifierToBreakpointMap;
+    typedef HashMap<JSC::BreakpointID, String> DebugServerBreakpointIDToBreakpointIdentifier;
+
+    InjectedScriptManager& m_injectedScriptManager;
+    std::unique_ptr<DebuggerFrontendDispatcher> m_frontendDispatcher;
+    RefPtr<DebuggerBackendDispatcher> m_backendDispatcher;
+    ScriptDebugServer& m_scriptDebugServer;
+    Listener* m_listener { nullptr };
+    JSC::ExecState* m_pausedScriptState { nullptr };
+    Deprecated::ScriptValue m_currentCallStack;
+    ScriptsMap m_scripts;
+    BreakpointIdentifierToDebugServerBreakpointIDsMap m_breakpointIdentifierToDebugServerBreakpointIDs;
+    BreakpointIdentifierToBreakpointMap m_javaScriptBreakpoints;
+    DebugServerBreakpointIDToBreakpointIdentifier m_debuggerBreakpointIdentifierToInspectorBreakpointIdentifier;
+    JSC::BreakpointID m_continueToLocationBreakpointID;
+    DebuggerFrontendDispatcher::Reason m_breakReason;
+    RefPtr<InspectorObject> m_breakAuxData;
+    ShouldDispatchResumed m_conditionToDispatchResumed { ShouldDispatchResumed::No };
+    bool m_enablePauseWhenIdle { false };
+    HashMap<AsyncCallIdentifier, RefPtr<AsyncStackTrace>> m_pendingAsyncCalls;
+    std::optional<AsyncCallIdentifier> m_currentAsyncCallIdentifier { std::nullopt };
+    bool m_enabled { false };
+    bool m_javaScriptPauseScheduled { false };
+    bool m_hasExceptionValue { false };
+    bool m_didPauseStopwatch { false };
+    bool m_pauseOnAssertionFailures { false };
+    bool m_registeredIdleCallback { false };
+    int m_asyncStackTraceDepth { 0 };
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorHeapAgent.cpp b/inspector/agents/InspectorHeapAgent.cpp
new file mode 100644
index 0000000..ad86c07
--- /dev/null
+++ b/inspector/agents/InspectorHeapAgent.cpp
@@ -0,0 +1,385 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorHeapAgent.h"
+
+#include "HeapProfiler.h"
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
+#include "InspectorEnvironment.h"
+#include "JSCInlines.h"
+#include "VM.h"
+#include <wtf/RunLoop.h>
+#include <wtf/Stopwatch.h>
+
+using namespace JSC;
+
+namespace Inspector {
+
+struct GarbageCollectionData {
+    Inspector::Protocol::Heap::GarbageCollection::Type type;
+    double startTime;
+    double endTime;
+};
+
+class SendGarbageCollectionEventsTask {
+public:
+    SendGarbageCollectionEventsTask(HeapFrontendDispatcher&);
+    void addGarbageCollection(GarbageCollectionData&);
+    void reset();
+private:
+    void timerFired();
+
+    HeapFrontendDispatcher& m_frontendDispatcher;
+    Vector<GarbageCollectionData> m_collections;
+    RunLoop::Timer<SendGarbageCollectionEventsTask> m_timer;
+    Lock m_mutex;
+};
+
+SendGarbageCollectionEventsTask::SendGarbageCollectionEventsTask(HeapFrontendDispatcher& frontendDispatcher)
+    : m_frontendDispatcher(frontendDispatcher)
+    , m_timer(RunLoop::current(), this, &SendGarbageCollectionEventsTask::timerFired)
+{
+}
+
+void SendGarbageCollectionEventsTask::addGarbageCollection(GarbageCollectionData& collection)
+{
+    {
+        std::lock_guard<Lock> lock(m_mutex);
+        m_collections.append(collection);
+    }
+
+    if (!m_timer.isActive())
+        m_timer.startOneShot(0);
+}
+
+void SendGarbageCollectionEventsTask::reset()
+{
+    {
+        std::lock_guard<Lock> lock(m_mutex);
+        m_collections.clear();
+    }
+
+    m_timer.stop();
+}
+
+void SendGarbageCollectionEventsTask::timerFired()
+{
+    Vector<GarbageCollectionData> collectionsToSend;
+
+    {
+        std::lock_guard<Lock> lock(m_mutex);
+        m_collections.swap(collectionsToSend);
+    }
+
+    // The timer is stopped on agent destruction, so this method will never be called after agent has been destroyed.
+    for (auto& collection : collectionsToSend) {
+        auto protocolObject = Inspector::Protocol::Heap::GarbageCollection::create()
+            .setType(collection.type)
+            .setStartTime(collection.startTime)
+            .setEndTime(collection.endTime)
+            .release();
+        m_frontendDispatcher.garbageCollected(WTFMove(protocolObject));
+    }
+}
+
+InspectorHeapAgent::InspectorHeapAgent(AgentContext& context)
+    : InspectorAgentBase(ASCIILiteral("Heap"))
+    , m_injectedScriptManager(context.injectedScriptManager)
+    , m_frontendDispatcher(std::make_unique<HeapFrontendDispatcher>(context.frontendRouter))
+    , m_backendDispatcher(HeapBackendDispatcher::create(context.backendDispatcher, this))
+    , m_environment(context.environment)
+    , m_sendGarbageCollectionEventsTask(std::make_unique<SendGarbageCollectionEventsTask>(*m_frontendDispatcher))
+{
+}
+
+InspectorHeapAgent::~InspectorHeapAgent()
+{
+    m_sendGarbageCollectionEventsTask->reset();
+}
+
+void InspectorHeapAgent::didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*)
+{
+}
+
+void InspectorHeapAgent::willDestroyFrontendAndBackend(DisconnectReason)
+{
+    // Stop tracking without taking a snapshot.
+    m_tracking = false;
+
+    ErrorString ignored;
+    disable(ignored);
+}
+
+void InspectorHeapAgent::enable(ErrorString&)
+{
+    if (m_enabled)
+        return;
+
+    m_enabled = true;
+
+    m_environment.vm().heap.addObserver(this);
+}
+
+void InspectorHeapAgent::disable(ErrorString&)
+{
+    if (!m_enabled)
+        return;
+
+    m_enabled = false;
+
+    m_environment.vm().heap.removeObserver(this);
+    m_sendGarbageCollectionEventsTask->reset();
+
+    clearHeapSnapshots();
+}
+
+void InspectorHeapAgent::gc(ErrorString&)
+{
+    VM& vm = m_environment.vm();
+    JSLockHolder lock(vm);
+    sanitizeStackForVM(&vm);
+    vm.heap.collectAllGarbage();
+}
+
+void InspectorHeapAgent::snapshot(ErrorString&, double* timestamp, String* snapshotData)
+{
+    VM& vm = m_environment.vm();
+    JSLockHolder lock(vm);
+
+    HeapSnapshotBuilder snapshotBuilder(vm.ensureHeapProfiler());
+    snapshotBuilder.buildSnapshot();
+
+    *timestamp = m_environment.executionStopwatch()->elapsedTime();
+    *snapshotData = snapshotBuilder.json([&] (const HeapSnapshotNode& node) {
+        if (Structure* structure = node.cell->structure(vm)) {
+            if (JSGlobalObject* globalObject = structure->globalObject()) {
+                if (!m_environment.canAccessInspectedScriptState(globalObject->globalExec()))
+                    return false;
+            }
+        }
+        return true;
+    });
+}
+
+void InspectorHeapAgent::startTracking(ErrorString& errorString)
+{
+    if (m_tracking)
+        return;
+
+    m_tracking = true;
+
+    double timestamp;
+    String snapshotData;
+    snapshot(errorString, &timestamp, &snapshotData);
+
+    m_frontendDispatcher->trackingStart(timestamp, snapshotData);
+}
+
+void InspectorHeapAgent::stopTracking(ErrorString& errorString)
+{
+    if (!m_tracking)
+        return;
+
+    m_tracking = false;
+
+    double timestamp;
+    String snapshotData;
+    snapshot(errorString, &timestamp, &snapshotData);
+
+    m_frontendDispatcher->trackingComplete(timestamp, snapshotData);
+}
+
+std::optional<HeapSnapshotNode> InspectorHeapAgent::nodeForHeapObjectIdentifier(ErrorString& errorString, unsigned heapObjectIdentifier)
+{
+    HeapProfiler* heapProfiler = m_environment.vm().heapProfiler();
+    if (!heapProfiler) {
+        errorString = ASCIILiteral("No heap snapshot");
+        return std::nullopt;
+    }
+
+    HeapSnapshot* snapshot = heapProfiler->mostRecentSnapshot();
+    if (!snapshot) {
+        errorString = ASCIILiteral("No heap snapshot");
+        return std::nullopt;
+    }
+
+    const std::optional<HeapSnapshotNode> optionalNode = snapshot->nodeForObjectIdentifier(heapObjectIdentifier);
+    if (!optionalNode) {
+        errorString = ASCIILiteral("No object for identifier, it may have been collected");
+        return std::nullopt;
+    }
+
+    return optionalNode;
+}
+
+void InspectorHeapAgent::getPreview(ErrorString& errorString, int heapObjectId, Inspector::Protocol::OptOutput<String>* resultString, RefPtr<Inspector::Protocol::Debugger::FunctionDetails>& functionDetails, RefPtr<Inspector::Protocol::Runtime::ObjectPreview>& objectPreview)
+{
+    // Prevent the cell from getting collected as we look it up.
+    VM& vm = m_environment.vm();
+    JSLockHolder lock(vm);
+    DeferGC deferGC(vm.heap);
+
+    unsigned heapObjectIdentifier = static_cast<unsigned>(heapObjectId);
+    const std::optional<HeapSnapshotNode> optionalNode = nodeForHeapObjectIdentifier(errorString, heapObjectIdentifier);
+    if (!optionalNode)
+        return;
+
+    // String preview.
+    JSCell* cell = optionalNode->cell;
+    if (cell->isString()) {
+        *resultString = asString(cell)->tryGetValue();
+        return;
+    }
+
+    // FIXME: Provide preview information for Internal Objects? CodeBlock, Executable, etc.
+
+    Structure* structure = cell->structure(vm);
+    if (!structure) {
+        errorString = ASCIILiteral("Unable to get object details - Structure");
+        return;
+    }
+
+    JSGlobalObject* globalObject = structure->globalObject();
+    if (!globalObject) {
+        errorString = ASCIILiteral("Unable to get object details - GlobalObject");
+        return;
+    }
+
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptFor(globalObject->globalExec());
+    if (injectedScript.hasNoValue()) {
+        errorString = ASCIILiteral("Unable to get object details - InjectedScript");
+        return;
+    }
+
+    // Function preview.
+    if (cell->inherits(JSFunction::info())) {
+        injectedScript.functionDetails(errorString, cell, &functionDetails);
+        return;
+    }
+
+    // Object preview.
+    objectPreview = injectedScript.previewValue(cell);
+}
+
+void InspectorHeapAgent::getRemoteObject(ErrorString& errorString, int heapObjectId, const String* optionalObjectGroup, RefPtr<Inspector::Protocol::Runtime::RemoteObject>& result)
+{
+    // Prevent the cell from getting collected as we look it up.
+    VM& vm = m_environment.vm();
+    JSLockHolder lock(vm);
+    DeferGC deferGC(vm.heap);
+
+    unsigned heapObjectIdentifier = static_cast<unsigned>(heapObjectId);
+    const std::optional<HeapSnapshotNode> optionalNode = nodeForHeapObjectIdentifier(errorString, heapObjectIdentifier);
+    if (!optionalNode)
+        return;
+
+    JSCell* cell = optionalNode->cell;
+    Structure* structure = cell->structure(vm);
+    if (!structure) {
+        errorString = ASCIILiteral("Unable to get object details");
+        return;
+    }
+
+    JSGlobalObject* globalObject = structure->globalObject();
+    if (!globalObject) {
+        errorString = ASCIILiteral("Unable to get object details");
+        return;
+    }
+
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptFor(globalObject->globalExec());
+    if (injectedScript.hasNoValue()) {
+        errorString = ASCIILiteral("Unable to get object details - InjectedScript");
+        return;
+    }
+
+    String objectGroup = optionalObjectGroup ? *optionalObjectGroup : String();
+    result = injectedScript.wrapObject(cell, objectGroup, true);
+}
+
+static Inspector::Protocol::Heap::GarbageCollection::Type protocolTypeForHeapOperation(CollectionScope scope)
+{
+    switch (scope) {
+    case CollectionScope::Full:
+        return Inspector::Protocol::Heap::GarbageCollection::Type::Full;
+    case CollectionScope::Eden:
+        return Inspector::Protocol::Heap::GarbageCollection::Type::Partial;
+    }
+    ASSERT_NOT_REACHED();
+    return Inspector::Protocol::Heap::GarbageCollection::Type::Full;
+}
+
+void InspectorHeapAgent::willGarbageCollect()
+{
+    if (!m_enabled)
+        return;
+
+    m_gcStartTime = m_environment.executionStopwatch()->elapsedTime();
+}
+
+void InspectorHeapAgent::didGarbageCollect(CollectionScope scope)
+{
+    if (!m_enabled) {
+        m_gcStartTime = NAN;
+        return;
+    }
+
+    if (std::isnan(m_gcStartTime)) {
+        // We were not enabled when the GC began.
+        return;
+    }
+
+    // FIXME: Include number of bytes freed by collection.
+
+    // Dispatch the event asynchronously because this method may be
+    // called between collection and sweeping and we don't want to
+    // create unexpected JavaScript allocations that the Sweeper does
+    // not expect to encounter. JavaScript allocations could happen
+    // with WebKitLegacy's in process inspector which shares the same
+    // VM as the inspected page.
+
+    GarbageCollectionData data;
+    data.type = protocolTypeForHeapOperation(scope);
+    data.startTime = m_gcStartTime;
+    data.endTime = m_environment.executionStopwatch()->elapsedTime();
+
+    m_sendGarbageCollectionEventsTask->addGarbageCollection(data);
+
+    m_gcStartTime = NAN;
+}
+
+void InspectorHeapAgent::clearHeapSnapshots()
+{
+    VM& vm = m_environment.vm();
+    JSLockHolder lock(vm);
+
+    if (HeapProfiler* heapProfiler = vm.heapProfiler()) {
+        heapProfiler->clearSnapshots();
+        HeapSnapshotBuilder::resetNextAvailableObjectIdentifier();
+    }
+}
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorHeapAgent.h b/inspector/agents/InspectorHeapAgent.h
new file mode 100644
index 0000000..4757608
--- /dev/null
+++ b/inspector/agents/InspectorHeapAgent.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "HeapSnapshot.h"
+#include "InspectorBackendDispatchers.h"
+#include "InspectorFrontendDispatchers.h"
+#include "heap/HeapObserver.h"
+#include "inspector/InspectorAgentBase.h"
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+
+namespace Inspector {
+
+class InjectedScriptManager;
+class SendGarbageCollectionEventsTask;
+typedef String ErrorString;
+
+class JS_EXPORT_PRIVATE InspectorHeapAgent : public InspectorAgentBase, public HeapBackendDispatcherHandler, public JSC::HeapObserver {
+    WTF_MAKE_NONCOPYABLE(InspectorHeapAgent);
+public:
+    InspectorHeapAgent(AgentContext&);
+    virtual ~InspectorHeapAgent();
+
+    void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*) override;
+    void willDestroyFrontendAndBackend(DisconnectReason) override;
+
+    // HeapBackendDispatcherHandler
+    void enable(ErrorString&) override;
+    void disable(ErrorString&) override;
+    void gc(ErrorString&) final;
+    void snapshot(ErrorString&, double* timestamp, String* snapshotData) final;
+    void startTracking(ErrorString&) final;
+    void stopTracking(ErrorString&) final;
+    void getPreview(ErrorString&, int heapObjectId, Inspector::Protocol::OptOutput<String>* resultString, RefPtr<Inspector::Protocol::Debugger::FunctionDetails>& functionDetails, RefPtr<Inspector::Protocol::Runtime::ObjectPreview>& objectPreview) final;
+    void getRemoteObject(ErrorString&, int heapObjectId, const String* optionalObjectGroup, RefPtr<Inspector::Protocol::Runtime::RemoteObject>& result) final;
+
+    // HeapObserver
+    void willGarbageCollect() override;
+    void didGarbageCollect(JSC::CollectionScope) override;
+
+protected:
+    void clearHeapSnapshots();
+
+private:
+    std::optional<JSC::HeapSnapshotNode> nodeForHeapObjectIdentifier(ErrorString&, unsigned heapObjectIdentifier);
+
+    InjectedScriptManager& m_injectedScriptManager;
+    std::unique_ptr<HeapFrontendDispatcher> m_frontendDispatcher;
+    RefPtr<HeapBackendDispatcher> m_backendDispatcher;
+    InspectorEnvironment& m_environment;
+
+    std::unique_ptr<SendGarbageCollectionEventsTask> m_sendGarbageCollectionEventsTask;
+
+    bool m_enabled { false };
+    bool m_tracking { false };
+    double m_gcStartTime { NAN };
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorRuntimeAgent.cpp b/inspector/agents/InspectorRuntimeAgent.cpp
new file mode 100644
index 0000000..3ad0eb3
--- /dev/null
+++ b/inspector/agents/InspectorRuntimeAgent.cpp
@@ -0,0 +1,381 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorRuntimeAgent.h"
+
+#include "Completion.h"
+#include "DFGWorklist.h"
+#include "HeapIterationScope.h"
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
+#include "InspectorFrontendRouter.h"
+#include "InspectorValues.h"
+#include "JSLock.h"
+#include "ParserError.h"
+#include "ScriptDebugServer.h"
+#include "SourceCode.h"
+#include "TypeProfiler.h"
+#include "TypeProfilerLog.h"
+#include <wtf/CurrentTime.h>
+
+using namespace JSC;
+
+namespace Inspector {
+
+static bool asBool(const bool* const b)
+{
+    return b ? *b : false;
+}
+
+InspectorRuntimeAgent::InspectorRuntimeAgent(AgentContext& context)
+    : InspectorAgentBase(ASCIILiteral("Runtime"))
+    , m_injectedScriptManager(context.injectedScriptManager)
+    , m_scriptDebugServer(context.environment.scriptDebugServer())
+    , m_vm(context.environment.vm())
+{
+}
+
+InspectorRuntimeAgent::~InspectorRuntimeAgent()
+{
+}
+
+static ScriptDebugServer::PauseOnExceptionsState setPauseOnExceptionsState(ScriptDebugServer& scriptDebugServer, ScriptDebugServer::PauseOnExceptionsState newState)
+{
+    ScriptDebugServer::PauseOnExceptionsState presentState = scriptDebugServer.pauseOnExceptionsState();
+    if (presentState != newState)
+        scriptDebugServer.setPauseOnExceptionsState(newState);
+    return presentState;
+}
+
+static Ref<Inspector::Protocol::Runtime::ErrorRange> buildErrorRangeObject(const JSTokenLocation& tokenLocation)
+{
+    return Inspector::Protocol::Runtime::ErrorRange::create()
+        .setStartOffset(tokenLocation.startOffset)
+        .setEndOffset(tokenLocation.endOffset)
+        .release();
+}
+
+void InspectorRuntimeAgent::parse(ErrorString&, const String& expression, Inspector::Protocol::Runtime::SyntaxErrorType* result, Inspector::Protocol::OptOutput<String>* message, RefPtr<Inspector::Protocol::Runtime::ErrorRange>& range)
+{
+    JSLockHolder lock(m_vm);
+
+    ParserError error;
+    checkSyntax(m_vm, JSC::makeSource(expression), error);
+
+    switch (error.syntaxErrorType()) {
+    case ParserError::SyntaxErrorNone:
+        *result = Inspector::Protocol::Runtime::SyntaxErrorType::None;
+        break;
+    case ParserError::SyntaxErrorIrrecoverable:
+        *result = Inspector::Protocol::Runtime::SyntaxErrorType::Irrecoverable;
+        break;
+    case ParserError::SyntaxErrorUnterminatedLiteral:
+        *result = Inspector::Protocol::Runtime::SyntaxErrorType::UnterminatedLiteral;
+        break;
+    case ParserError::SyntaxErrorRecoverable:
+        *result = Inspector::Protocol::Runtime::SyntaxErrorType::Recoverable;
+        break;
+    }
+
+    if (error.syntaxErrorType() != ParserError::SyntaxErrorNone) {
+        *message = error.message();
+        range = buildErrorRangeObject(error.token().m_location);
+    }
+}
+
+void InspectorRuntimeAgent::evaluate(ErrorString& errorString, const String& expression, const String* const objectGroup, const bool* const includeCommandLineAPI, const bool* const doNotPauseOnExceptionsAndMuteConsole, const int* executionContextId, const bool* const returnByValue, const bool* generatePreview, const bool* saveResult, RefPtr<Inspector::Protocol::Runtime::RemoteObject>& result, Inspector::Protocol::OptOutput<bool>* wasThrown, Inspector::Protocol::OptOutput<int>* savedResultIndex)
+{
+    InjectedScript injectedScript = injectedScriptForEval(errorString, executionContextId);
+    if (injectedScript.hasNoValue())
+        return;
+
+    ScriptDebugServer::PauseOnExceptionsState previousPauseOnExceptionsState = ScriptDebugServer::DontPauseOnExceptions;
+    if (asBool(doNotPauseOnExceptionsAndMuteConsole))
+        previousPauseOnExceptionsState = setPauseOnExceptionsState(m_scriptDebugServer, ScriptDebugServer::DontPauseOnExceptions);
+    if (asBool(doNotPauseOnExceptionsAndMuteConsole))
+        muteConsole();
+
+    injectedScript.evaluate(errorString, expression, objectGroup ? *objectGroup : String(), asBool(includeCommandLineAPI), asBool(returnByValue), asBool(generatePreview), asBool(saveResult), &result, wasThrown, savedResultIndex);
+
+    if (asBool(doNotPauseOnExceptionsAndMuteConsole)) {
+        unmuteConsole();
+        setPauseOnExceptionsState(m_scriptDebugServer, previousPauseOnExceptionsState);
+    }
+}
+
+void InspectorRuntimeAgent::callFunctionOn(ErrorString& errorString, const String& objectId, const String& expression, const InspectorArray* optionalArguments, const bool* const doNotPauseOnExceptionsAndMuteConsole, const bool* const returnByValue, const bool* generatePreview, RefPtr<Inspector::Protocol::Runtime::RemoteObject>& result, Inspector::Protocol::OptOutput<bool>* wasThrown)
+{
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptForObjectId(objectId);
+    if (injectedScript.hasNoValue()) {
+        errorString = ASCIILiteral("Could not find InjectedScript for objectId");
+        return;
+    }
+
+    String arguments;
+    if (optionalArguments)
+        arguments = optionalArguments->toJSONString();
+
+    ScriptDebugServer::PauseOnExceptionsState previousPauseOnExceptionsState = ScriptDebugServer::DontPauseOnExceptions;
+    if (asBool(doNotPauseOnExceptionsAndMuteConsole))
+        previousPauseOnExceptionsState = setPauseOnExceptionsState(m_scriptDebugServer, ScriptDebugServer::DontPauseOnExceptions);
+    if (asBool(doNotPauseOnExceptionsAndMuteConsole))
+        muteConsole();
+
+    injectedScript.callFunctionOn(errorString, objectId, expression, arguments, asBool(returnByValue), asBool(generatePreview), &result, wasThrown);
+
+    if (asBool(doNotPauseOnExceptionsAndMuteConsole)) {
+        unmuteConsole();
+        setPauseOnExceptionsState(m_scriptDebugServer, previousPauseOnExceptionsState);
+    }
+}
+
+void InspectorRuntimeAgent::getProperties(ErrorString& errorString, const String& objectId, const bool* const ownProperties, const bool* const generatePreview, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::PropertyDescriptor>>& result, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::InternalPropertyDescriptor>>& internalProperties)
+{
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptForObjectId(objectId);
+    if (injectedScript.hasNoValue()) {
+        errorString = ASCIILiteral("Could not find InjectedScript for objectId");
+        return;
+    }
+
+    ScriptDebugServer::PauseOnExceptionsState previousPauseOnExceptionsState = setPauseOnExceptionsState(m_scriptDebugServer, ScriptDebugServer::DontPauseOnExceptions);
+    muteConsole();
+
+    injectedScript.getProperties(errorString, objectId, asBool(ownProperties), asBool(generatePreview), &result);
+    injectedScript.getInternalProperties(errorString, objectId, asBool(generatePreview), &internalProperties);
+
+    unmuteConsole();
+    setPauseOnExceptionsState(m_scriptDebugServer, previousPauseOnExceptionsState);
+}
+
+void InspectorRuntimeAgent::getDisplayableProperties(ErrorString& errorString, const String& objectId, const bool* const generatePreview, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::PropertyDescriptor>>& result, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::InternalPropertyDescriptor>>& internalProperties)
+{
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptForObjectId(objectId);
+    if (injectedScript.hasNoValue()) {
+        errorString = ASCIILiteral("Could not find InjectedScript for objectId");
+        return;
+    }
+
+    ScriptDebugServer::PauseOnExceptionsState previousPauseOnExceptionsState = setPauseOnExceptionsState(m_scriptDebugServer, ScriptDebugServer::DontPauseOnExceptions);
+    muteConsole();
+
+    injectedScript.getDisplayableProperties(errorString, objectId, asBool(generatePreview), &result);
+    injectedScript.getInternalProperties(errorString, objectId, asBool(generatePreview), &internalProperties);
+
+    unmuteConsole();
+    setPauseOnExceptionsState(m_scriptDebugServer, previousPauseOnExceptionsState);
+}
+
+void InspectorRuntimeAgent::getCollectionEntries(ErrorString& errorString, const String& objectId, const String* objectGroup, const int* startIndex, const int* numberToFetch, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::CollectionEntry>>& entries)
+{
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptForObjectId(objectId);
+    if (injectedScript.hasNoValue()) {
+        errorString = ASCIILiteral("Could not find InjectedScript for objectId");
+        return;
+    }
+
+    int start = startIndex && *startIndex >= 0 ? *startIndex : 0;
+    int fetch = numberToFetch && *numberToFetch >= 0 ? *numberToFetch : 0;
+
+    injectedScript.getCollectionEntries(errorString, objectId, objectGroup ? *objectGroup : String(), start, fetch, &entries);
+}
+
+void InspectorRuntimeAgent::saveResult(ErrorString& errorString, const Inspector::InspectorObject& callArgument, const int* executionContextId, Inspector::Protocol::OptOutput<int>* savedResultIndex)
+{
+    InjectedScript injectedScript;
+
+    String objectId;
+    if (callArgument.getString(ASCIILiteral("objectId"), objectId)) {
+        injectedScript = m_injectedScriptManager.injectedScriptForObjectId(objectId);
+        if (injectedScript.hasNoValue()) {
+            errorString = ASCIILiteral("Could not find InjectedScript for objectId");
+            return;
+        }
+    } else {
+        injectedScript = injectedScriptForEval(errorString, executionContextId);
+        if (injectedScript.hasNoValue())
+            return;
+    }
+
+    injectedScript.saveResult(errorString, callArgument.toJSONString(), savedResultIndex);
+}
+
+void InspectorRuntimeAgent::releaseObject(ErrorString&, const String& objectId)
+{
+    InjectedScript injectedScript = m_injectedScriptManager.injectedScriptForObjectId(objectId);
+    if (!injectedScript.hasNoValue())
+        injectedScript.releaseObject(objectId);
+}
+
+void InspectorRuntimeAgent::releaseObjectGroup(ErrorString&, const String& objectGroup)
+{
+    m_injectedScriptManager.releaseObjectGroup(objectGroup);
+}
+
+void InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets(ErrorString& errorString, const Inspector::InspectorArray& locations, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::TypeDescription>>& typeDescriptions)
+{
+    static const bool verbose = false;
+
+    typeDescriptions = Inspector::Protocol::Array<Inspector::Protocol::Runtime::TypeDescription>::create();
+    if (!m_vm.typeProfiler()) {
+        errorString = ASCIILiteral("The VM does not currently have Type Information.");
+        return;
+    }
+
+    double start = currentTimeMS();
+    m_vm.typeProfilerLog()->processLogEntries(ASCIILiteral("User Query"));
+
+    for (size_t i = 0; i < locations.length(); i++) {
+        RefPtr<Inspector::InspectorValue> value = locations.get(i);
+        RefPtr<InspectorObject> location;
+        if (!value->asObject(location)) {
+            errorString = ASCIILiteral("Array of TypeLocation objects has an object that does not have type of TypeLocation.");
+            return;
+        }
+
+        int descriptor;
+        String sourceIDAsString;
+        int divot;
+        location->getInteger(ASCIILiteral("typeInformationDescriptor"), descriptor);
+        location->getString(ASCIILiteral("sourceID"), sourceIDAsString);
+        location->getInteger(ASCIILiteral("divot"), divot);
+
+        bool okay;
+        TypeLocation* typeLocation = m_vm.typeProfiler()->findLocation(divot, sourceIDAsString.toIntPtrStrict(&okay), static_cast<TypeProfilerSearchDescriptor>(descriptor), m_vm);
+        ASSERT(okay);
+
+        RefPtr<TypeSet> typeSet;
+        if (typeLocation) {
+            if (typeLocation->m_globalTypeSet && typeLocation->m_globalVariableID != TypeProfilerNoGlobalIDExists)
+                typeSet = typeLocation->m_globalTypeSet;
+            else
+                typeSet = typeLocation->m_instructionTypeSet;
+        }
+
+        bool isValid = typeLocation && typeSet && !typeSet->isEmpty();
+        auto description = Inspector::Protocol::Runtime::TypeDescription::create()
+            .setIsValid(isValid)
+            .release();
+
+        if (isValid) {
+            description->setLeastCommonAncestor(typeSet->leastCommonAncestor());
+            description->setStructures(typeSet->allStructureRepresentations());
+            description->setTypeSet(typeSet->inspectorTypeSet());
+            description->setIsTruncated(typeSet->isOverflown());
+        }
+
+        typeDescriptions->addItem(WTFMove(description));
+    }
+
+    double end = currentTimeMS();
+    if (verbose)
+        dataLogF("Inspector::getRuntimeTypesForVariablesAtOffsets took %lfms\n", end - start);
+}
+
+void InspectorRuntimeAgent::willDestroyFrontendAndBackend(DisconnectReason reason)
+{
+    if (reason != DisconnectReason::InspectedTargetDestroyed && m_isTypeProfilingEnabled)
+        setTypeProfilerEnabledState(false);
+}
+
+void InspectorRuntimeAgent::enableTypeProfiler(ErrorString&)
+{
+    setTypeProfilerEnabledState(true);
+}
+
+void InspectorRuntimeAgent::disableTypeProfiler(ErrorString&)
+{
+    setTypeProfilerEnabledState(false);
+}
+
+void InspectorRuntimeAgent::enableControlFlowProfiler(ErrorString&)
+{
+    setControlFlowProfilerEnabledState(true);
+}
+
+void InspectorRuntimeAgent::disableControlFlowProfiler(ErrorString&)
+{
+    setControlFlowProfilerEnabledState(false);
+}
+
+void InspectorRuntimeAgent::setTypeProfilerEnabledState(bool isTypeProfilingEnabled)
+{
+    if (m_isTypeProfilingEnabled == isTypeProfilingEnabled)
+        return;
+    m_isTypeProfilingEnabled = isTypeProfilingEnabled;
+
+    VM& vm = m_vm;
+    vm.whenIdle([&vm, isTypeProfilingEnabled] () {
+        bool shouldRecompileFromTypeProfiler = (isTypeProfilingEnabled ? vm.enableTypeProfiler() : vm.disableTypeProfiler());
+        if (shouldRecompileFromTypeProfiler)
+            vm.deleteAllCode(PreventCollectionAndDeleteAllCode);
+    });
+}
+
+void InspectorRuntimeAgent::setControlFlowProfilerEnabledState(bool isControlFlowProfilingEnabled)
+{
+    if (m_isControlFlowProfilingEnabled == isControlFlowProfilingEnabled)
+        return;
+    m_isControlFlowProfilingEnabled = isControlFlowProfilingEnabled;
+
+    VM& vm = m_vm;
+    vm.whenIdle([&vm, isControlFlowProfilingEnabled] () {
+        bool shouldRecompileFromControlFlowProfiler = (isControlFlowProfilingEnabled ? vm.enableControlFlowProfiler() : vm.disableControlFlowProfiler());
+
+        if (shouldRecompileFromControlFlowProfiler)
+            vm.deleteAllCode(PreventCollectionAndDeleteAllCode);
+    });
+}
+
+void InspectorRuntimeAgent::getBasicBlocks(ErrorString& errorString, const String& sourceIDAsString, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::BasicBlock>>& basicBlocks)
+{
+    if (!m_vm.controlFlowProfiler()) {
+        errorString = ASCIILiteral("The VM does not currently have a Control Flow Profiler.");
+        return;
+    }
+
+    bool okay;
+    intptr_t sourceID = sourceIDAsString.toIntPtrStrict(&okay);
+    ASSERT(okay);
+    const Vector<BasicBlockRange>& basicBlockRanges = m_vm.controlFlowProfiler()->getBasicBlocksForSourceID(sourceID, m_vm);
+    basicBlocks = Inspector::Protocol::Array<Inspector::Protocol::Runtime::BasicBlock>::create();
+    for (const BasicBlockRange& block : basicBlockRanges) {
+        Ref<Inspector::Protocol::Runtime::BasicBlock> location = Inspector::Protocol::Runtime::BasicBlock::create()
+            .setStartOffset(block.m_startOffset)
+            .setEndOffset(block.m_endOffset)
+            .setHasExecuted(block.m_hasExecuted)
+            .setExecutionCount(block.m_executionCount)
+            .release();
+        basicBlocks->addItem(WTFMove(location));
+    }
+}
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorRuntimeAgent.h b/inspector/agents/InspectorRuntimeAgent.h
new file mode 100644
index 0000000..915118b
--- /dev/null
+++ b/inspector/agents/InspectorRuntimeAgent.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorBackendDispatchers.h"
+#include "InspectorFrontendDispatchers.h"
+#include "inspector/InspectorAgentBase.h"
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+class VM;
+}
+
+namespace Inspector {
+
+class InjectedScript;
+class InjectedScriptManager;
+class InspectorArray;
+class ScriptDebugServer;
+typedef String ErrorString;
+
+class JS_EXPORT_PRIVATE InspectorRuntimeAgent : public InspectorAgentBase, public RuntimeBackendDispatcherHandler {
+    WTF_MAKE_NONCOPYABLE(InspectorRuntimeAgent);
+public:
+    virtual ~InspectorRuntimeAgent();
+
+    void willDestroyFrontendAndBackend(DisconnectReason) override;
+
+    void enable(ErrorString&) override { m_enabled = true; }
+    void disable(ErrorString&) override { m_enabled = false; }
+    void parse(ErrorString&, const String& expression, Inspector::Protocol::Runtime::SyntaxErrorType* result, Inspector::Protocol::OptOutput<String>* message, RefPtr<Inspector::Protocol::Runtime::ErrorRange>&) final;
+    void evaluate(ErrorString&, const String& expression, const String* objectGroup, const bool* includeCommandLineAPI, const bool* doNotPauseOnExceptionsAndMuteConsole, const int* executionContextId, const bool* returnByValue, const bool* generatePreview, const bool* saveResult, RefPtr<Inspector::Protocol::Runtime::RemoteObject>& result, Inspector::Protocol::OptOutput<bool>* wasThrown, Inspector::Protocol::OptOutput<int>* savedResultIndex) final;
+    void callFunctionOn(ErrorString&, const String& objectId, const String& expression, const Inspector::InspectorArray* optionalArguments, const bool* doNotPauseOnExceptionsAndMuteConsole, const bool* returnByValue, const bool* generatePreview, RefPtr<Inspector::Protocol::Runtime::RemoteObject>& result, Inspector::Protocol::OptOutput<bool>* wasThrown) final;
+    void releaseObject(ErrorString&, const ErrorString& objectId) final;
+    void getProperties(ErrorString&, const String& objectId, const bool* ownProperties, const bool* generatePreview, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::PropertyDescriptor>>& result, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::InternalPropertyDescriptor>>& internalProperties) final;
+    void getDisplayableProperties(ErrorString&, const String& objectId, const bool* generatePreview, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::PropertyDescriptor>>& result, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::InternalPropertyDescriptor>>& internalProperties) final;
+    void getCollectionEntries(ErrorString&, const String& objectId, const String* objectGroup, const int* startIndex, const int* numberToFetch, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::CollectionEntry>>& entries) final;
+    void saveResult(ErrorString&, const Inspector::InspectorObject& callArgument, const int* executionContextId, Inspector::Protocol::OptOutput<int>* savedResultIndex) final;
+    void releaseObjectGroup(ErrorString&, const String& objectGroup) final;
+    void getRuntimeTypesForVariablesAtOffsets(ErrorString&, const Inspector::InspectorArray& locations, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::TypeDescription>>&) override;
+    void enableTypeProfiler(ErrorString&) override;
+    void disableTypeProfiler(ErrorString&) override;
+    void enableControlFlowProfiler(ErrorString&) override;
+    void disableControlFlowProfiler(ErrorString&) override;
+    void getBasicBlocks(ErrorString&, const String& in_sourceID, RefPtr<Inspector::Protocol::Array<Inspector::Protocol::Runtime::BasicBlock>>& out_basicBlocks) override;
+
+    bool enabled() const { return m_enabled; }
+
+protected:
+    InspectorRuntimeAgent(AgentContext&);
+
+    InjectedScriptManager& injectedScriptManager() { return m_injectedScriptManager; }
+
+    virtual InjectedScript injectedScriptForEval(ErrorString&, const int* executionContextId) = 0;
+
+    virtual void muteConsole() = 0;
+    virtual void unmuteConsole() = 0;
+
+private:
+    void setTypeProfilerEnabledState(bool);
+    void setControlFlowProfilerEnabledState(bool);
+
+    InjectedScriptManager& m_injectedScriptManager;
+    ScriptDebugServer& m_scriptDebugServer;
+    JSC::VM& m_vm;
+    bool m_enabled {false};
+    bool m_isTypeProfilingEnabled {false};
+    bool m_isControlFlowProfilingEnabled {false};
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorScriptProfilerAgent.cpp b/inspector/agents/InspectorScriptProfilerAgent.cpp
new file mode 100644
index 0000000..ffc299b
--- /dev/null
+++ b/inspector/agents/InspectorScriptProfilerAgent.cpp
@@ -0,0 +1,259 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorScriptProfilerAgent.h"
+
+#include "DeferGC.h"
+#include "HeapInlines.h"
+#include "InspectorEnvironment.h"
+#include "SamplingProfiler.h"
+#include <wtf/RunLoop.h>
+#include <wtf/Stopwatch.h>
+
+using namespace JSC;
+
+namespace Inspector {
+
+InspectorScriptProfilerAgent::InspectorScriptProfilerAgent(AgentContext& context)
+    : InspectorAgentBase(ASCIILiteral("ScriptProfiler"))
+    , m_frontendDispatcher(std::make_unique<ScriptProfilerFrontendDispatcher>(context.frontendRouter))
+    , m_backendDispatcher(ScriptProfilerBackendDispatcher::create(context.backendDispatcher, this))
+    , m_environment(context.environment)
+{
+}
+
+InspectorScriptProfilerAgent::~InspectorScriptProfilerAgent()
+{
+}
+
+void InspectorScriptProfilerAgent::didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*)
+{
+}
+
+void InspectorScriptProfilerAgent::willDestroyFrontendAndBackend(DisconnectReason)
+{
+    // Stop tracking without sending results.
+    if (m_tracking) {
+        m_tracking = false;
+        m_activeEvaluateScript = false;
+        m_environment.scriptDebugServer().setProfilingClient(nullptr);
+
+        // Stop sampling without processing the samples.
+        stopSamplingWhenDisconnecting();
+    }
+}
+
+void InspectorScriptProfilerAgent::startTracking(ErrorString&, const bool* includeSamples)
+{
+    if (m_tracking)
+        return;
+
+    m_tracking = true;
+
+#if ENABLE(SAMPLING_PROFILER)
+    if (includeSamples && *includeSamples) {
+        VM& vm = m_environment.scriptDebugServer().vm();
+        SamplingProfiler& samplingProfiler = vm.ensureSamplingProfiler(m_environment.executionStopwatch());
+
+        LockHolder locker(samplingProfiler.getLock());
+        samplingProfiler.setStopWatch(locker, m_environment.executionStopwatch());
+        samplingProfiler.noticeCurrentThreadAsJSCExecutionThread(locker);
+        samplingProfiler.start(locker);
+        m_enabledSamplingProfiler = true;
+    }
+#else
+    UNUSED_PARAM(includeSamples);
+#endif // ENABLE(SAMPLING_PROFILER)
+
+    m_environment.scriptDebugServer().setProfilingClient(this);
+
+    m_frontendDispatcher->trackingStart(m_environment.executionStopwatch()->elapsedTime());
+}
+
+void InspectorScriptProfilerAgent::stopTracking(ErrorString&)
+{
+    if (!m_tracking)
+        return;
+
+    m_tracking = false;
+    m_activeEvaluateScript = false;
+
+    m_environment.scriptDebugServer().setProfilingClient(nullptr);
+
+    trackingComplete();
+}
+
+bool InspectorScriptProfilerAgent::isAlreadyProfiling() const
+{
+    return m_activeEvaluateScript;
+}
+
+double InspectorScriptProfilerAgent::willEvaluateScript()
+{
+    m_activeEvaluateScript = true;
+
+#if ENABLE(SAMPLING_PROFILER)
+    if (m_enabledSamplingProfiler) {
+        SamplingProfiler* samplingProfiler = m_environment.scriptDebugServer().vm().samplingProfiler();
+        RELEASE_ASSERT(samplingProfiler);
+        samplingProfiler->noticeCurrentThreadAsJSCExecutionThread();
+    }
+#endif
+
+    return m_environment.executionStopwatch()->elapsedTime();
+}
+
+void InspectorScriptProfilerAgent::didEvaluateScript(double startTime, ProfilingReason reason)
+{
+    m_activeEvaluateScript = false;
+
+    double endTime = m_environment.executionStopwatch()->elapsedTime();
+
+    addEvent(startTime, endTime, reason);
+}
+
+static Inspector::Protocol::ScriptProfiler::EventType toProtocol(ProfilingReason reason)
+{
+    switch (reason) {
+    case ProfilingReason::API:
+        return Inspector::Protocol::ScriptProfiler::EventType::API;
+    case ProfilingReason::Microtask:
+        return Inspector::Protocol::ScriptProfiler::EventType::Microtask;
+    case ProfilingReason::Other:
+        return Inspector::Protocol::ScriptProfiler::EventType::Other;
+    }
+
+    ASSERT_NOT_REACHED();
+    return Inspector::Protocol::ScriptProfiler::EventType::Other;
+}
+
+void InspectorScriptProfilerAgent::addEvent(double startTime, double endTime, ProfilingReason reason)
+{
+    ASSERT(endTime >= startTime);
+
+    auto event = Inspector::Protocol::ScriptProfiler::Event::create()
+        .setStartTime(startTime)
+        .setEndTime(endTime)
+        .setType(toProtocol(reason))
+        .release();
+
+    m_frontendDispatcher->trackingUpdate(WTFMove(event));
+}
+
+#if ENABLE(SAMPLING_PROFILER)
+static Ref<Protocol::ScriptProfiler::Samples> buildSamples(VM& vm, Vector<SamplingProfiler::StackTrace>&& samplingProfilerStackTraces)
+{
+    Ref<Protocol::Array<Protocol::ScriptProfiler::StackTrace>> stackTraces = Protocol::Array<Protocol::ScriptProfiler::StackTrace>::create();
+    for (SamplingProfiler::StackTrace& stackTrace : samplingProfilerStackTraces) {
+        Ref<Protocol::Array<Protocol::ScriptProfiler::StackFrame>> frames = Protocol::Array<Protocol::ScriptProfiler::StackFrame>::create();
+        for (SamplingProfiler::StackFrame& stackFrame : stackTrace.frames) {
+            Ref<Protocol::ScriptProfiler::StackFrame> frame = Protocol::ScriptProfiler::StackFrame::create()
+                .setSourceID(String::number(stackFrame.sourceID()))
+                .setName(stackFrame.displayName(vm))
+                .setLine(stackFrame.functionStartLine())
+                .setColumn(stackFrame.functionStartColumn())
+                .setUrl(stackFrame.url())
+                .release();
+
+            if (stackFrame.hasExpressionInfo()) {
+                Ref<Protocol::ScriptProfiler::ExpressionLocation> expressionLocation = Protocol::ScriptProfiler::ExpressionLocation::create()
+                    .setLine(stackFrame.lineNumber)
+                    .setColumn(stackFrame.columnNumber)
+                    .release();
+                frame->setExpressionLocation(WTFMove(expressionLocation));
+            }
+
+            frames->addItem(WTFMove(frame));
+        }
+        Ref<Protocol::ScriptProfiler::StackTrace> inspectorStackTrace = Protocol::ScriptProfiler::StackTrace::create()
+            .setTimestamp(stackTrace.timestamp)
+            .setStackFrames(WTFMove(frames))
+            .release();
+        stackTraces->addItem(WTFMove(inspectorStackTrace));
+    }
+
+    return Protocol::ScriptProfiler::Samples::create()
+        .setStackTraces(WTFMove(stackTraces))
+        .release();
+}
+#endif // ENABLE(SAMPLING_PROFILER)
+
+void InspectorScriptProfilerAgent::trackingComplete()
+{
+#if ENABLE(SAMPLING_PROFILER)
+    if (m_enabledSamplingProfiler) {
+        VM& vm = m_environment.scriptDebugServer().vm();
+        JSLockHolder lock(vm);
+        DeferGC deferGC(vm.heap);
+        SamplingProfiler* samplingProfiler = vm.samplingProfiler();
+        RELEASE_ASSERT(samplingProfiler);
+
+        LockHolder locker(samplingProfiler->getLock());
+        samplingProfiler->pause(locker);
+        Vector<SamplingProfiler::StackTrace> stackTraces = samplingProfiler->releaseStackTraces(locker);
+        locker.unlockEarly();
+
+        Ref<Protocol::ScriptProfiler::Samples> samples = buildSamples(vm, WTFMove(stackTraces));
+
+        m_enabledSamplingProfiler = false;
+
+        m_frontendDispatcher->trackingComplete(WTFMove(samples));
+    } else
+        m_frontendDispatcher->trackingComplete(nullptr);
+#else
+    m_frontendDispatcher->trackingComplete(nullptr);
+#endif // ENABLE(SAMPLING_PROFILER)
+}
+
+void InspectorScriptProfilerAgent::stopSamplingWhenDisconnecting()
+{
+#if ENABLE(SAMPLING_PROFILER)
+    if (!m_enabledSamplingProfiler)
+        return;
+
+    VM& vm = m_environment.scriptDebugServer().vm();
+    JSLockHolder lock(vm);
+    SamplingProfiler* samplingProfiler = vm.samplingProfiler();
+    RELEASE_ASSERT(samplingProfiler);
+    LockHolder locker(samplingProfiler->getLock());
+    samplingProfiler->pause(locker);
+    samplingProfiler->clearData(locker);
+
+    m_enabledSamplingProfiler = false;
+#endif
+}
+
+void InspectorScriptProfilerAgent::programmaticCaptureStarted()
+{
+    m_frontendDispatcher->programmaticCaptureStarted();
+}
+
+void InspectorScriptProfilerAgent::programmaticCaptureStopped()
+{
+    m_frontendDispatcher->programmaticCaptureStopped();
+}
+
+} // namespace Inspector
diff --git a/inspector/agents/InspectorScriptProfilerAgent.h b/inspector/agents/InspectorScriptProfilerAgent.h
new file mode 100644
index 0000000..1c34ad4
--- /dev/null
+++ b/inspector/agents/InspectorScriptProfilerAgent.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorBackendDispatchers.h"
+#include "InspectorFrontendDispatchers.h"
+#include "inspector/InspectorAgentBase.h"
+#include "inspector/ScriptDebugServer.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+class Profile;
+}
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+class JS_EXPORT_PRIVATE InspectorScriptProfilerAgent final : public InspectorAgentBase, public ScriptProfilerBackendDispatcherHandler, public JSC::Debugger::ProfilingClient {
+    WTF_MAKE_NONCOPYABLE(InspectorScriptProfilerAgent);
+public:
+    InspectorScriptProfilerAgent(AgentContext&);
+    virtual ~InspectorScriptProfilerAgent();
+
+    void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*) override;
+    void willDestroyFrontendAndBackend(DisconnectReason) override;
+
+    // ScriptProfilerBackendDispatcherHandler
+    void startTracking(ErrorString&, const bool* includeSamples) override;
+    void stopTracking(ErrorString&) override;
+
+    void programmaticCaptureStarted();
+    void programmaticCaptureStopped();
+
+    // Debugger::ProfilingClient
+    bool isAlreadyProfiling() const override;
+    double willEvaluateScript() override;
+    void didEvaluateScript(double, JSC::ProfilingReason) override;
+
+private:
+    struct Event {
+        Event(double start, double end) : startTime(start), endTime(end) { }
+        double startTime { 0 };
+        double endTime { 0 };
+    };
+
+    void addEvent(double startTime, double endTime, JSC::ProfilingReason);
+    void trackingComplete();
+    void stopSamplingWhenDisconnecting();
+
+    std::unique_ptr<ScriptProfilerFrontendDispatcher> m_frontendDispatcher;
+    RefPtr<ScriptProfilerBackendDispatcher> m_backendDispatcher;
+    InspectorEnvironment& m_environment;
+    bool m_tracking { false };
+#if ENABLE(SAMPLING_PROFILER)
+    bool m_enabledSamplingProfiler { false };
+#endif
+    bool m_activeEvaluateScript { false };
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/JSGlobalObjectConsoleAgent.cpp b/inspector/agents/JSGlobalObjectConsoleAgent.cpp
new file mode 100644
index 0000000..401162b
--- /dev/null
+++ b/inspector/agents/JSGlobalObjectConsoleAgent.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGlobalObjectConsoleAgent.h"
+
+namespace Inspector {
+
+JSGlobalObjectConsoleAgent::JSGlobalObjectConsoleAgent(AgentContext& context, InspectorHeapAgent* heapAgent)
+    : InspectorConsoleAgent(context, heapAgent)
+{
+}
+
+void JSGlobalObjectConsoleAgent::setMonitoringXHREnabled(ErrorString& errorString, bool)
+{
+    errorString = ASCIILiteral("Not supported for JavaScript context");
+}
+
+void JSGlobalObjectConsoleAgent::addInspectedNode(ErrorString& errorString, int)
+{
+    errorString = ASCIILiteral("Not supported for JavaScript context");
+}
+
+} // namespace Inspector
diff --git a/inspector/agents/JSGlobalObjectConsoleAgent.h b/inspector/agents/JSGlobalObjectConsoleAgent.h
new file mode 100644
index 0000000..91dade3
--- /dev/null
+++ b/inspector/agents/JSGlobalObjectConsoleAgent.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorConsoleAgent.h"
+#include "JSGlobalObjectScriptDebugServer.h"
+
+namespace Inspector {
+
+class JSGlobalObjectConsoleAgent final : public InspectorConsoleAgent {
+    WTF_MAKE_NONCOPYABLE(JSGlobalObjectConsoleAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JSGlobalObjectConsoleAgent(AgentContext&, InspectorHeapAgent*);
+    virtual ~JSGlobalObjectConsoleAgent() { }
+
+    // FIXME: XHRs and Nodes only makes sense debugging a Web context. Can this be moved to a different agent?
+    void setMonitoringXHREnabled(ErrorString&, bool enabled) override;
+    void addInspectedNode(ErrorString&, int nodeId) override;
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/JSGlobalObjectDebuggerAgent.cpp b/inspector/agents/JSGlobalObjectDebuggerAgent.cpp
new file mode 100644
index 0000000..19ba13d
--- /dev/null
+++ b/inspector/agents/JSGlobalObjectDebuggerAgent.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGlobalObjectDebuggerAgent.h"
+
+#include "ConsoleMessage.h"
+#include "InjectedScriptManager.h"
+#include "InspectorConsoleAgent.h"
+#include "JSGlobalObject.h"
+#include "ScriptArguments.h"
+#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+JSGlobalObjectDebuggerAgent::JSGlobalObjectDebuggerAgent(JSAgentContext& context, InspectorConsoleAgent* consoleAgent)
+    : InspectorDebuggerAgent(context)
+    , m_consoleAgent(consoleAgent)
+{
+}
+
+InjectedScript JSGlobalObjectDebuggerAgent::injectedScriptForEval(ErrorString& error, const int* executionContextId)
+{
+    if (executionContextId) {
+        error = ASCIILiteral("Execution context id is not supported for JSContext inspection as there is only one execution context.");
+        return InjectedScript();
+    }
+
+    ExecState* exec = static_cast<JSGlobalObjectScriptDebugServer&>(scriptDebugServer()).globalObject().globalExec();
+    return injectedScriptManager().injectedScriptFor(exec);
+}
+
+void JSGlobalObjectDebuggerAgent::breakpointActionLog(JSC::ExecState& state, const String& message)
+{
+    m_consoleAgent->addMessageToConsole(std::make_unique<ConsoleMessage>(MessageSource::JS, MessageType::Log, MessageLevel::Log, message, createScriptCallStack(&state, ScriptCallStack::maxCallStackSizeToCapture), 0));
+}
+
+} // namespace Inspector
diff --git a/inspector/agents/JSGlobalObjectDebuggerAgent.h b/inspector/agents/JSGlobalObjectDebuggerAgent.h
new file mode 100644
index 0000000..5476f55
--- /dev/null
+++ b/inspector/agents/JSGlobalObjectDebuggerAgent.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorDebuggerAgent.h"
+#include "JSGlobalObjectScriptDebugServer.h"
+
+namespace Inspector {
+
+class InspectorConsoleAgent;
+
+class JSGlobalObjectDebuggerAgent final : public InspectorDebuggerAgent {
+    WTF_MAKE_NONCOPYABLE(JSGlobalObjectDebuggerAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JSGlobalObjectDebuggerAgent(JSAgentContext&, InspectorConsoleAgent*);
+    virtual ~JSGlobalObjectDebuggerAgent() { }
+
+    InjectedScript injectedScriptForEval(ErrorString&, const int* executionContextId) override;
+
+    void breakpointActionLog(JSC::ExecState&, const String&) final;
+
+    // NOTE: JavaScript inspector does not yet need to mute a console because no messages
+    // are sent to the console outside of the API boundary or console object.
+    void muteConsole() final { }
+    void unmuteConsole() final { }
+
+private:
+    InspectorConsoleAgent* m_consoleAgent { nullptr };
+};
+
+} // namespace Inspector
diff --git a/inspector/agents/JSGlobalObjectRuntimeAgent.cpp b/inspector/agents/JSGlobalObjectRuntimeAgent.cpp
new file mode 100644
index 0000000..b748eeb
--- /dev/null
+++ b/inspector/agents/JSGlobalObjectRuntimeAgent.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGlobalObjectRuntimeAgent.h"
+
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
+#include "JSGlobalObject.h"
+
+using namespace JSC;
+
+namespace Inspector {
+
+JSGlobalObjectRuntimeAgent::JSGlobalObjectRuntimeAgent(JSAgentContext& context)
+    : InspectorRuntimeAgent(context)
+    , m_frontendDispatcher(std::make_unique<RuntimeFrontendDispatcher>(context.frontendRouter))
+    , m_backendDispatcher(RuntimeBackendDispatcher::create(context.backendDispatcher, this))
+    , m_globalObject(context.inspectedGlobalObject)
+{
+}
+
+void JSGlobalObjectRuntimeAgent::didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*)
+{
+}
+
+InjectedScript JSGlobalObjectRuntimeAgent::injectedScriptForEval(ErrorString& errorString, const int* executionContextId)
+{
+    ASSERT_UNUSED(executionContextId, !executionContextId);
+
+    JSC::ExecState* scriptState = m_globalObject.globalExec();
+    InjectedScript injectedScript = injectedScriptManager().injectedScriptFor(scriptState);
+    if (injectedScript.hasNoValue())
+        errorString = ASCIILiteral("Internal error: main world execution context not found.");
+
+    return injectedScript;
+}
+
+} // namespace Inspector
diff --git a/inspector/agents/JSGlobalObjectRuntimeAgent.h b/inspector/agents/JSGlobalObjectRuntimeAgent.h
new file mode 100644
index 0000000..06809ad
--- /dev/null
+++ b/inspector/agents/JSGlobalObjectRuntimeAgent.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InspectorRuntimeAgent.h"
+
+namespace JSC {
+class JSGlobalObject;
+}
+
+namespace Inspector {
+
+class JSGlobalObjectRuntimeAgent final : public InspectorRuntimeAgent {
+public:
+    JSGlobalObjectRuntimeAgent(JSAgentContext&);
+
+    void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*) override;
+
+    InjectedScript injectedScriptForEval(ErrorString&, const int* executionContextId) override;
+
+    // NOTE: JavaScript inspector does not yet need to mute a console because no messages
+    // are sent to the console outside of the API boundary or console object.
+    void muteConsole() override { }
+    void unmuteConsole() override { }
+
+private:
+    std::unique_ptr<RuntimeFrontendDispatcher> m_frontendDispatcher;
+    RefPtr<RuntimeBackendDispatcher> m_backendDispatcher;
+    JSC::JSGlobalObject& m_globalObject;
+};
+
+} // namespace Inspector
diff --git a/inspector/augmentable/AlternateDispatchableAgent.h b/inspector/augmentable/AlternateDispatchableAgent.h
new file mode 100644
index 0000000..cd3f3c3
--- /dev/null
+++ b/inspector/augmentable/AlternateDispatchableAgent.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "InspectorAlternateBackendDispatchers.h"
+#include "InspectorBackendDispatchers.h"
+#include <JavaScriptCore/InspectorAgentBase.h>
+#include <wtf/Forward.h>
+
+namespace Inspector {
+
+template<typename TBackendDispatcher, typename TAlternateDispatcher>
+class AlternateDispatchableAgent final : public InspectorAgentBase {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    AlternateDispatchableAgent(const String& domainName, AugmentableInspectorController& controller, std::unique_ptr<TAlternateDispatcher> alternateDispatcher)
+        : InspectorAgentBase(domainName)
+        , m_alternateDispatcher(WTFMove(alternateDispatcher))
+        , m_backendDispatcher(TBackendDispatcher::create(controller.backendDispatcher(), nullptr))
+    {
+        m_backendDispatcher->setAlternateDispatcher(m_alternateDispatcher.get());
+        m_alternateDispatcher->setBackendDispatcher(&controller.backendDispatcher());
+    }
+
+    virtual ~AlternateDispatchableAgent()
+    {
+        m_alternateDispatcher->setBackendDispatcher(nullptr);
+    }
+
+    void didCreateFrontendAndBackend(FrontendRouter*, BackendDispatcher*) override
+    {
+    }
+
+    void willDestroyFrontendAndBackend(DisconnectReason) override
+    {
+    }
+
+private:
+    std::unique_ptr<TAlternateDispatcher> m_alternateDispatcher;
+    RefPtr<TBackendDispatcher> m_backendDispatcher;
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
diff --git a/inspector/augmentable/AugmentableInspectorController.h b/inspector/augmentable/AugmentableInspectorController.h
new file mode 100644
index 0000000..7025f23
--- /dev/null
+++ b/inspector/augmentable/AugmentableInspectorController.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include <JavaScriptCore/AugmentableInspectorControllerClient.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+#include <JavaScriptCore/InspectorFrontendRouter.h>
+
+namespace Inspector {
+
+class InspectorAgentBase;
+
+class AugmentableInspectorController {
+public:
+    virtual ~AugmentableInspectorController() { }
+
+    virtual AugmentableInspectorControllerClient* augmentableInspectorControllerClient() const = 0;
+    virtual void setAugmentableInspectorControllerClient(AugmentableInspectorControllerClient*) = 0;
+
+    virtual const FrontendRouter& frontendRouter() const = 0;
+    virtual BackendDispatcher& backendDispatcher() = 0;
+    virtual void appendExtraAgent(std::unique_ptr<InspectorAgentBase>) = 0;
+
+    bool connected() const { return frontendRouter().hasFrontends(); }
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
diff --git a/inspector/augmentable/AugmentableInspectorControllerClient.h b/inspector/augmentable/AugmentableInspectorControllerClient.h
new file mode 100644
index 0000000..7124fca
--- /dev/null
+++ b/inspector/augmentable/AugmentableInspectorControllerClient.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+namespace Inspector {
+
+class AugmentableInspectorControllerClient {
+public:
+    virtual ~AugmentableInspectorControllerClient() { }
+    virtual void inspectorControllerDestroyed() = 0;
+    virtual void inspectorConnected() = 0;
+    virtual void inspectorDisconnected() = 0;
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
diff --git a/inspector/protocol/ApplicationCache.json b/inspector/protocol/ApplicationCache.json
new file mode 100644
index 0000000..86a984a
--- /dev/null
+++ b/inspector/protocol/ApplicationCache.json
@@ -0,0 +1,87 @@
+{
+    "domain": "ApplicationCache",
+    "availability": "web",
+    "types": [
+        {
+            "id": "ApplicationCacheResource",
+            "type": "object",
+            "description": "Detailed application cache resource information.",
+            "properties": [
+                { "name": "url", "type": "string", "description": "Resource url." },
+                { "name": "size", "type": "integer", "description": "Resource size." },
+                { "name": "type", "type": "string", "description": "Resource type." }
+            ]
+        },
+        {
+            "id": "ApplicationCache",
+            "type": "object",
+            "description": "Detailed application cache information.",
+            "properties": [
+                { "name": "manifestURL", "type": "string", "description": "Manifest URL." },
+                { "name": "size", "type": "number", "description": "Application cache size." },
+                { "name": "creationTime", "type": "number", "description": "Application cache creation time." },
+                { "name": "updateTime", "type": "number", "description": "Application cache update time." },
+                { "name": "resources", "type": "array", "items": { "$ref": "ApplicationCacheResource" }, "description": "Application cache resources." }
+            ]
+        },
+        {
+            "id": "FrameWithManifest",
+            "type": "object",
+            "description": "Frame identifier - manifest URL pair.",
+            "properties": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Frame identifier." },
+                { "name": "manifestURL", "type": "string", "description": "Manifest URL." },
+                { "name": "status", "type": "integer", "description": "Application cache status." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "getFramesWithManifests",
+            "returns": [
+                { "name": "frameIds", "type": "array", "items": { "$ref": "FrameWithManifest" }, "description": "Array of frame identifiers with manifest urls for each frame containing a document associated with some application cache." }
+            ],
+            "description": "Returns array of frame identifiers with manifest urls for each frame containing a document associated with some application cache."
+        },
+        {
+            "name": "enable",
+            "description": "Enables application cache domain notifications."
+        },
+        {
+            "name": "getManifestForFrame",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Identifier of the frame containing document whose manifest is retrieved." }
+            ],
+            "returns": [
+                { "name": "manifestURL", "type": "string", "description": "Manifest URL for document in the given frame." }
+            ],
+            "description": "Returns manifest URL for document in the given frame."
+        },
+        {
+            "name": "getApplicationCacheForFrame",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Identifier of the frame containing document whose application cache is retrieved." }
+            ],
+            "returns": [
+                { "name": "applicationCache", "$ref": "ApplicationCache", "description": "Relevant application cache data for the document in given frame." }
+            ],
+            "description": "Returns relevant application cache data for the document in given frame."
+        }
+    ],
+    "events": [
+        {
+            "name": "applicationCacheStatusUpdated",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Identifier of the frame containing document whose application cache updated status." },
+                { "name": "manifestURL", "type": "string", "description": "Manifest URL." },
+                { "name": "status", "type": "integer", "description": "Updated application cache status." }
+            ]
+        },
+        {
+            "name": "networkStateUpdated",
+            "parameters": [
+                { "name": "isNowOnline", "type": "boolean" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/CSS.json b/inspector/protocol/CSS.json
new file mode 100644
index 0000000..7abbe22
--- /dev/null
+++ b/inspector/protocol/CSS.json
@@ -0,0 +1,457 @@
+{
+    "domain": "CSS",
+    "description": "This domain exposes CSS read/write operations. All CSS objects, like stylesheets, rules, and styles, have an associated <code>id</code> used in subsequent operations on the related object. Each object type has a specific <code>id</code> structure, and those are not interchangeable between objects of different kinds. CSS objects can be loaded using the <code>get*ForNode()</code> calls (which accept a DOM node id). Alternatively, a client can discover all the existing stylesheets with the <code>getAllStyleSheets()</code> method and subsequently load the required stylesheet contents using the <code>getStyleSheet[Text]()</code> methods.",
+    "availability": "web",
+    "types": [
+        {
+            "id": "StyleSheetId",
+            "type": "string"
+        },
+        {
+            "id": "CSSStyleId",
+            "type": "object",
+            "properties": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "Enclosing stylesheet identifier." },
+                { "name": "ordinal", "type": "integer", "description": "The style ordinal within the stylesheet." }
+            ],
+            "description": "This object identifies a CSS style in a unique way."
+        },
+        {
+            "id": "StyleSheetOrigin",
+            "type": "string",
+            "enum": ["user", "user-agent", "inspector", "regular"],
+            "description": "Stylesheet type: \"user\" for user stylesheets, \"user-agent\" for user-agent stylesheets, \"inspector\" for stylesheets created by the inspector (i.e. those holding the \"via inspector\" rules), \"regular\" for regular stylesheets."
+        },
+        {
+            "id": "CSSRuleId",
+            "type": "object",
+            "properties": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "Enclosing stylesheet identifier." },
+                { "name": "ordinal", "type": "integer", "description": "The rule ordinal within the stylesheet." }
+            ],
+            "description": "This object identifies a CSS rule in a unique way."
+        },
+        {
+            "id": "PseudoIdMatches",
+            "type": "object",
+            "properties": [
+                { "name": "pseudoId", "type": "integer", "description": "Pseudo style identifier (see <code>enum PseudoId</code> in <code>RenderStyleConstants.h</code>)."},
+                { "name": "matches", "type": "array", "items": { "$ref": "RuleMatch" }, "description": "Matches of CSS rules applicable to the pseudo style."}
+            ],
+            "description": "CSS rule collection for a single pseudo style."
+        },
+        {
+            "id": "InheritedStyleEntry",
+            "type": "object",
+            "properties": [
+                { "name": "inlineStyle", "$ref": "CSSStyle", "optional": true, "description": "The ancestor node's inline style, if any, in the style inheritance chain." },
+                { "name": "matchedCSSRules", "type": "array", "items": { "$ref": "RuleMatch" }, "description": "Matches of CSS rules matching the ancestor node in the style inheritance chain." }
+            ],
+            "description": "CSS rule collection for a single pseudo style."
+        },
+        {
+            "id": "RuleMatch",
+            "type": "object",
+            "properties": [
+                { "name": "rule", "$ref": "CSSRule", "description": "CSS rule in the match." },
+                { "name": "matchingSelectors", "type": "array", "items": { "type": "integer" }, "description": "Matching selector indices in the rule's selectorList selectors (0-based)." }
+            ],
+            "description": "Match data for a CSS rule."
+        },
+        {
+            "id": "CSSSelector",
+            "type": "object",
+            "properties": [
+                { "name": "text", "type": "string", "description": "Canonicalized selector text." },
+                { "name": "specificity", "optional": true, "type": "array", "items": { "type": "integer" }, "description": "Specificity (a, b, c) tuple. Included if the selector is sent in response to CSS.getMatchedStylesForNode which provides a context element." },
+                { "name": "dynamic", "optional": true, "type": "boolean", "description": "Whether or not the specificity can be dynamic. Included if the selector is sent in response to CSS.getMatchedStylesForNode which provides a context element." }
+            ],
+            "description": "CSS selector."
+        },
+        {
+            "id": "SelectorList",
+            "type": "object",
+            "properties": [
+                { "name": "selectors", "type": "array", "items": { "$ref": "CSSSelector" }, "description": "Selectors in the list." },
+                { "name": "text", "type": "string", "description": "Rule selector text." },
+                { "name": "range", "$ref": "SourceRange", "optional": true, "description": "Rule selector range in the underlying resource (if available)." }
+            ],
+            "description": "Selector list data."
+        },
+        {
+            "id": "CSSStyleAttribute",
+            "type": "object",
+            "properties": [
+                { "name": "name", "type": "string", "description": "DOM attribute name (e.g. \"width\")."},
+                { "name": "style", "$ref": "CSSStyle", "description": "CSS style generated by the respective DOM attribute."}
+            ],
+            "description": "CSS style information for a DOM style attribute."
+        },
+        {
+            "id": "CSSStyleSheetHeader",
+            "type": "object",
+            "properties": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "The stylesheet identifier."},
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Owner frame identifier."},
+                { "name": "sourceURL", "type": "string", "description": "Stylesheet resource URL."},
+                { "name": "origin", "$ref": "StyleSheetOrigin", "description": "Stylesheet origin."},
+                { "name": "title", "type": "string", "description": "Stylesheet title."},
+                { "name": "disabled", "type": "boolean", "description": "Denotes whether the stylesheet is disabled."},
+                { "name": "isInline", "type": "boolean", "description": "Whether this stylesheet is a <style> tag created by the parser. This is not set for document.written <style> tags." },
+                { "name": "startLine", "type": "number", "description": "Line offset of the stylesheet within the resource (zero based)." },
+                { "name": "startColumn", "type": "number", "description": "Column offset of the stylesheet within the resource (zero based)." }
+            ],
+            "description": "CSS stylesheet metainformation."
+        },
+        {
+            "id": "CSSStyleSheetBody",
+            "type": "object",
+            "properties": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "The stylesheet identifier."},
+                { "name": "rules", "type": "array", "items": { "$ref": "CSSRule" }, "description": "Stylesheet resource URL."},
+                { "name": "text", "type": "string", "optional": true, "description": "Stylesheet resource contents (if available)."}
+            ],
+            "description": "CSS stylesheet contents."
+        },
+        {
+            "id": "CSSRule",
+            "type": "object",
+            "properties": [
+                { "name": "ruleId", "$ref": "CSSRuleId", "optional": true, "description": "The CSS rule identifier (absent for user agent stylesheet and user-specified stylesheet rules)."},
+                { "name": "selectorList", "$ref": "SelectorList", "description": "Rule selector data." },
+                { "name": "sourceURL", "type": "string", "optional": true, "description": "Parent stylesheet resource URL (for regular rules)."},
+                { "name": "sourceLine", "type": "integer", "description": "Line ordinal of the rule selector start character in the resource."},
+                { "name": "origin", "$ref": "StyleSheetOrigin", "description": "Parent stylesheet's origin."},
+                { "name": "style", "$ref": "CSSStyle", "description": "Associated style declaration." },
+                { "name": "media", "type": "array", "items": { "$ref": "CSSMedia" }, "optional": true, "description": "Media list array (for rules involving media queries). The array enumerates media queries starting with the innermost one, going outwards." }
+            ],
+            "description": "CSS rule representation."
+        },
+        {
+            "id": "SourceRange",
+            "type": "object",
+            "properties": [
+                { "name": "startLine", "type": "integer", "description": "Start line of range." },
+                { "name": "startColumn", "type": "integer", "description": "Start column of range (inclusive)." },
+                { "name": "endLine", "type": "integer", "description": "End line of range" },
+                { "name": "endColumn", "type": "integer", "description": "End column of range (exclusive)." }
+            ],
+            "description": "Text range within a resource."
+        },
+        {
+            "id": "ShorthandEntry",
+            "type": "object",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Shorthand name." },
+                { "name": "value", "type": "string", "description": "Shorthand value." }
+            ]
+        },
+        {
+            "id": "CSSPropertyInfo",
+            "type": "object",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Property name." },
+                { "name": "longhands", "type": "array", "optional": true, "items": { "type": "string" }, "description": "Longhand property names." },
+                { "name": "values", "type": "array", "optional": true, "items": { "type": "string" }, "description": "Supported values for this property." }
+            ]
+        },
+        {
+            "id": "CSSComputedStyleProperty",
+            "type": "object",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Computed style property name." },
+                { "name": "value", "type": "string", "description": "Computed style property value." }
+            ]
+        },
+        {
+            "id": "CSSStyle",
+            "type": "object",
+            "properties": [
+                { "name": "styleId", "$ref": "CSSStyleId", "optional": true, "description": "The CSS style identifier (absent for attribute styles)." },
+                { "name": "cssProperties", "type": "array", "items": { "$ref": "CSSProperty" }, "description": "CSS properties in the style." },
+                { "name": "shorthandEntries", "type": "array", "items": { "$ref": "ShorthandEntry" }, "description": "Computed values for all shorthands found in the style." },
+                { "name": "cssText", "type": "string", "optional": true, "description": "Style declaration text (if available)." },
+                { "name": "range", "$ref": "SourceRange", "optional": true, "description": "Style declaration range in the enclosing stylesheet (if available)." },
+                { "name": "width", "type": "string", "optional": true, "description": "The effective \"width\" property value from this style." },
+                { "name": "height", "type": "string", "optional": true, "description": "The effective \"height\" property value from this style." }
+            ],
+            "description": "CSS style representation."
+        },
+        {
+            "id": "CSSPropertyStatus",
+	    "type": "string",
+            "enum": ["active", "inactive", "disabled", "style"],
+            "description": "The property status: \"active\" if the property is effective in the style, \"inactive\" if the property is overridden by a same-named property in this style later on, \"disabled\" if the property is disabled by the user, \"style\" (implied if absent) if the property is reported by the browser rather than by the CSS source parser."
+        },
+        {
+            "id": "CSSProperty",
+            "type": "object",
+            "properties": [
+                { "name": "name", "type": "string", "description": "The property name." },
+                { "name": "value", "type": "string", "description": "The property value." },
+                { "name": "priority", "type": "string", "optional": true, "description": "The property priority (implies \"\" if absent)." },
+                { "name": "implicit", "type": "boolean", "optional": true, "description": "Whether the property is implicit (implies <code>false</code> if absent)." },
+                { "name": "text", "type": "string", "optional": true, "description": "The full property text as specified in the style." },
+                { "name": "parsedOk", "type": "boolean", "optional": true, "description": "Whether the property is understood by the browser (implies <code>true</code> if absent)." },
+                { "name": "status", "$ref": "CSSPropertyStatus", "optional": true, "description": "Whether the property is active or disabled." },
+                { "name": "range", "$ref": "SourceRange", "optional": true, "description": "The entire property range in the enclosing style declaration (if available)." }
+            ],
+            "description": "CSS style effective visual dimensions and source offsets."
+        },
+        {
+            "id": "CSSMedia",
+            "type": "object",
+            "properties": [
+                { "name": "text", "type": "string", "description": "Media query text." },
+                { "name": "source", "type": "string", "enum": ["mediaRule", "importRule", "linkedSheet", "inlineSheet"], "description": "Source of the media query: \"mediaRule\" if specified by a @media rule, \"importRule\" if specified by an @import rule, \"linkedSheet\" if specified by a \"media\" attribute in a linked stylesheet's LINK tag, \"inlineSheet\" if specified by a \"media\" attribute in an inline stylesheet's STYLE tag." },
+                { "name": "sourceURL", "type": "string", "optional": true, "description": "URL of the document containing the media query description." },
+                { "name": "sourceLine", "type": "integer", "optional": true, "description": "Line in the document containing the media query (not defined for the \"stylesheet\" source)." }
+            ],
+            "description": "CSS media query descriptor."
+        },
+        {
+            "id": "Region",
+            "type": "object",
+            "properties": [
+                { "name": "regionOverset", "type": "string", "enum": ["overset", "fit", "empty"], "description": "The \"overset\" attribute of a Named Flow." },
+                { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The corresponding DOM node id." }
+            ],
+            "description": "This object represents a region that flows from a Named Flow."
+        },
+        {
+            "id": "NamedFlow",
+            "type": "object",
+            "properties": [
+                { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                { "name": "name", "type": "string", "description": "Named Flow identifier." },
+                { "name": "overset", "type": "boolean", "description": "The \"overset\" attribute of a Named Flow." },
+                { "name": "content", "type": "array", "items": { "$ref": "DOM.NodeId" }, "description": "An array of nodes that flow into the Named Flow." },
+                { "name": "regions", "type": "array", "items": { "$ref": "Region" }, "description": "An array of regions associated with the Named Flow." }
+            ],
+            "description": "This object represents a Named Flow."
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables the CSS agent for the given page. Clients should not assume that the CSS agent has been enabled until the result of this command is received."
+        },
+        {
+            "name": "disable",
+            "description": "Disables the CSS agent for the given page."
+        },
+        {
+            "name": "getMatchedStylesForNode",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId" },
+                { "name": "includePseudo", "type": "boolean", "optional": true, "description": "Whether to include pseudo styles (default: true)." },
+                { "name": "includeInherited", "type": "boolean", "optional": true, "description": "Whether to include inherited styles (default: true)." }
+            ],
+            "returns": [
+                { "name": "matchedCSSRules", "type": "array", "items": { "$ref": "RuleMatch" }, "optional": true, "description": "CSS rules matching this node, from all applicable stylesheets." },
+                { "name": "pseudoElements", "type": "array", "items": { "$ref": "PseudoIdMatches" }, "optional": true, "description": "Pseudo style matches for this node." },
+                { "name": "inherited", "type": "array", "items": { "$ref": "InheritedStyleEntry" }, "optional": true, "description": "A chain of inherited styles (from the immediate node parent up to the DOM tree root)." }
+            ],
+            "description": "Returns requested styles for a DOM node identified by <code>nodeId</code>."
+        },
+        {
+            "name": "getInlineStylesForNode",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId" }
+            ],
+            "returns": [
+                { "name": "inlineStyle", "$ref": "CSSStyle", "optional": true, "description": "Inline style for the specified DOM node." },
+                { "name": "attributesStyle", "$ref": "CSSStyle", "optional": true, "description": "Attribute-defined element style (e.g. resulting from \"width=20 height=100%\")."}
+            ],
+            "description": "Returns the styles defined inline (explicitly in the \"style\" attribute and implicitly, using DOM attributes) for a DOM node identified by <code>nodeId</code>."
+        },
+        {
+            "name": "getComputedStyleForNode",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId" }
+            ],
+            "returns": [
+                { "name": "computedStyle", "type": "array", "items": { "$ref": "CSSComputedStyleProperty" }, "description": "Computed style for the specified DOM node." }
+            ],
+            "description": "Returns the computed style for a DOM node identified by <code>nodeId</code>."
+        },
+        {
+            "name": "getAllStyleSheets",
+            "returns": [
+                { "name": "headers", "type": "array", "items": { "$ref": "CSSStyleSheetHeader" }, "description": "Descriptor entries for all available stylesheets." }
+            ],
+            "description": "Returns metainfo entries for all known stylesheets."
+        },
+        {
+            "name": "getStyleSheet",
+            "parameters": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId" }
+            ],
+            "returns": [
+                { "name": "styleSheet", "$ref": "CSSStyleSheetBody", "description": "Stylesheet contents for the specified <code>styleSheetId</code>." }
+            ],
+            "description": "Returns stylesheet data for the specified <code>styleSheetId</code>."
+        },
+        {
+            "name": "getStyleSheetText",
+            "parameters": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId" }
+            ],
+            "returns": [
+                { "name": "text", "type": "string", "description": "The stylesheet text." }
+            ],
+            "description": "Returns the current textual content and the URL for a stylesheet."
+        },
+        {
+            "name": "setStyleSheetText",
+            "parameters": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId" },
+                { "name": "text", "type": "string" }
+            ],
+            "description": "Sets the new stylesheet text, thereby invalidating all existing <code>CSSStyleId</code>'s and <code>CSSRuleId</code>'s contained by this stylesheet."
+        },
+        {
+            "name": "setStyleText",
+            "parameters": [
+                { "name": "styleId", "$ref": "CSSStyleId" },
+                { "name": "text", "type": "string" }
+            ],
+            "returns": [
+                { "name": "style", "$ref": "CSSStyle", "description": "The resulting style after the text modification." }
+            ],
+            "description": "Sets the new <code>text</code> for the respective style."
+        },
+        {
+            "name": "setRuleSelector",
+            "parameters": [
+                { "name": "ruleId", "$ref": "CSSRuleId" },
+                { "name": "selector", "type": "string" }
+            ],
+            "returns": [
+                { "name": "rule", "$ref": "CSSRule", "description": "The resulting rule after the selector modification." }
+            ],
+            "description": "Modifies the rule selector."
+        },
+        {
+            "name": "createStyleSheet",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Identifier of the frame where the new \"inspector\" stylesheet should be created." }
+            ],
+            "returns": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "Identifier of the created \"inspector\" stylesheet." }
+            ],
+            "description": "Creates a new special \"inspector\" stylesheet in the frame with given <code>frameId</code>."
+        },
+        {
+            "name": "addRule",
+            "parameters": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId" },
+                { "name": "selector", "type": "string" }
+            ],
+            "returns": [
+                { "name": "rule", "$ref": "CSSRule", "description": "The newly created rule." }
+            ],
+            "description": "Creates a new empty rule with the given <code>selector</code> in a stylesheet with given <code>styleSheetId</code>."
+        },
+        {
+            "name": "getSupportedCSSProperties",
+            "returns": [
+                { "name": "cssProperties", "type": "array", "items": { "$ref": "CSSPropertyInfo" }, "description": "Supported property metainfo." }
+            ],
+            "description": "Returns all supported CSS property names."
+        },
+        {
+            "name": "getSupportedSystemFontFamilyNames",
+            "returns": [
+                { "name": "fontFamilyNames", "type": "array", "items": { "type": "string" }, "description": "Supported system font families." }
+            ],
+            "description": "Returns all supported system font family names."
+        },
+        {
+            "name": "forcePseudoState",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The element id for which to force the pseudo state." },
+                { "name": "forcedPseudoClasses", "type": "array", "items": { "type": "string", "enum": ["active", "focus", "hover", "visited"] }, "description": "Element pseudo classes to force when computing the element's style." }
+            ],
+            "description": "Ensures that the given node will have specified pseudo-classes whenever its style is computed by the browser."
+        },
+        {
+            "name": "getNamedFlowCollection",
+            "parameters": [
+                { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id for which to get the Named Flow Collection." }
+            ],
+            "returns": [
+                { "name": "namedFlows", "type": "array", "items": { "$ref": "NamedFlow" }, "description": "An array containing the Named Flows in the document." }
+            ],
+            "description": "Returns the Named Flows from the document."
+        }
+    ],
+    "events": [
+        {
+            "name": "mediaQueryResultChanged",
+            "description": "Fires whenever a MediaQuery result changes (for example, after a browser window has been resized.) The current implementation considers only viewport-dependent media features."
+        },
+        {
+            "name": "styleSheetChanged",
+            "parameters": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId" }
+            ],
+            "description": "Fired whenever a stylesheet is changed as a result of the client operation."
+        },
+        {
+            "name": "styleSheetAdded",
+            "parameters": [
+                { "name": "header", "$ref": "CSSStyleSheetHeader", "description": "Added stylesheet metainfo." }
+            ],
+            "description": "Fired whenever an active document stylesheet is added."
+        },
+        {
+            "name": "styleSheetRemoved",
+            "parameters": [
+                { "name": "styleSheetId", "$ref": "StyleSheetId", "description": "Identifier of the removed stylesheet." }
+            ],
+            "description": "Fired whenever an active document stylesheet is removed."
+        },
+        {
+            "name": "namedFlowCreated",
+            "parameters": [
+                { "name": "namedFlow", "$ref": "NamedFlow", "description": "The new Named Flow." }
+            ],
+            "description": "Fires when a Named Flow is created."
+        },
+        {
+            "name": "namedFlowRemoved",
+            "parameters": [
+                { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                { "name": "flowName", "type": "string", "description": "Identifier of the removed Named Flow." }
+            ],
+            "description": "Fires when a Named Flow is removed: has no associated content nodes and regions."
+        },
+        {
+            "name": "regionOversetChanged",
+            "parameters": [
+                { "name": "namedFlow", "$ref": "NamedFlow", "description": "The Named Flow containing the regions whose regionOverset values changed." }
+            ],
+            "description": "Fires if any of the regionOverset values changed in a Named Flow's region chain."
+        },
+        {
+            "name": "registeredNamedFlowContentElement",
+            "parameters": [
+                { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                { "name": "flowName", "type": "string", "description": "Named Flow identifier for which the new content element was registered." },
+                { "name": "contentNodeId", "$ref": "DOM.NodeId", "description": "The node id of the registered content node." },
+                { "name": "nextContentNodeId", "$ref": "DOM.NodeId", "description": "The node id of the element following the registered content node." }
+            ],
+            "description": "Fires when a Named Flow's has been registered with a new content node."
+        },
+        {
+            "name": "unregisteredNamedFlowContentElement",
+            "parameters": [
+                { "name": "documentNodeId", "$ref": "DOM.NodeId", "description": "The document node id." },
+                { "name": "flowName", "type": "string", "description": "Named Flow identifier for which the new content element was unregistered." },
+                { "name": "contentNodeId", "$ref": "DOM.NodeId", "description": "The node id of the unregistered content node." }
+            ],
+            "description": "Fires when a Named Flow's has been registered with a new content node."
+        }
+    ]
+}
diff --git a/inspector/protocol/Console.json b/inspector/protocol/Console.json
new file mode 100644
index 0000000..93fff92
--- /dev/null
+++ b/inspector/protocol/Console.json
@@ -0,0 +1,104 @@
+{
+    "domain": "Console",
+    "description": "Console domain defines methods and events for interaction with the JavaScript console. Console collects messages created by means of the <a href='http://getfirebug.com/wiki/index.php/Console_API'>JavaScript Console API</a>. One needs to enable this domain using <code>enable</code> command in order to start receiving the console messages. Browser collects messages issued while console domain is not enabled as well and reports them using <code>messageAdded</code> notification upon enabling.",
+    "types": [
+        {
+            "id": "ConsoleMessage",
+            "type": "object",
+            "description": "Console message.",
+            "properties": [
+                { "name": "source", "type": "string", "enum": ["xml", "javascript", "network", "console-api", "storage", "appcache", "rendering", "css", "security", "content-blocker", "other"], "description": "Message source." },
+                { "name": "level", "type": "string", "enum": ["log", "info", "warning", "error", "debug"], "description": "Message severity." },
+                { "name": "text", "type": "string", "description": "Message text." },
+                { "name": "type", "type": "string", "optional": true, "enum": ["log", "dir", "dirxml", "table", "trace", "clear", "startGroup", "startGroupCollapsed", "endGroup", "assert", "timing", "profile", "profileEnd"], "description": "Console message type." },
+                { "name": "url", "type": "string", "optional": true, "description": "URL of the message origin." },
+                { "name": "line", "type": "integer", "optional": true, "description": "Line number in the resource that generated this message." },
+                { "name": "column", "type": "integer", "optional": true, "description": "Column number on the line in the resource that generated this message." },
+                { "name": "repeatCount", "type": "integer", "optional": true, "description": "Repeat count for repeated messages." },
+                { "name": "parameters", "type": "array", "items": { "$ref": "Runtime.RemoteObject" }, "optional": true, "description": "Message parameters in case of the formatted message." },
+                { "name": "stackTrace", "type": "array", "items": { "$ref": "CallFrame" }, "optional": true, "description": "JavaScript stack trace for assertions and error messages." },
+                { "name": "networkRequestId", "$ref": "Network.RequestId", "optional": true, "description": "Identifier of the network request associated with this message." }
+            ]
+        },
+        {
+            "id": "CallFrame",
+            "type": "object",
+            "description": "Stack entry for console errors and assertions.",
+            "properties": [
+                { "name": "functionName", "type": "string", "description": "JavaScript function name." },
+                { "name": "url", "type": "string", "description": "JavaScript script name or url." },
+                { "name": "scriptId", "$ref": "Debugger.ScriptId", "description": "Script identifier." },
+                { "name": "lineNumber", "type": "integer", "description": "JavaScript script line number." },
+                { "name": "columnNumber", "type": "integer", "description": "JavaScript script column number." }
+            ]
+        },
+        {
+            "id": "StackTrace",
+            "description": "Call frames for async function calls, console assertions, and error messages.",
+            "type": "object",
+            "properties": [
+                { "name": "callFrames", "type": "array", "items": { "$ref": "CallFrame" } },
+                { "name": "topCallFrameIsBoundary", "type": "boolean", "optional": true, "description": "Whether the first item in <code>callFrames</code> is the native function that scheduled the asynchronous operation (e.g. setTimeout)." },
+                { "name": "truncated", "type": "boolean", "optional": true, "description": "Whether one or more frames have been truncated from the bottom of the stack." },
+                { "name": "parentStackTrace", "$ref": "StackTrace", "optional": true, "description": "Parent StackTrace." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables console domain, sends the messages collected so far to the client by means of the <code>messageAdded</code> notification."
+        },
+        {
+            "name": "disable",
+            "description": "Disables console domain, prevents further console messages from being reported to the client."
+        },
+        {
+            "name": "clearMessages",
+            "description": "Clears console messages collected in the browser."
+        },
+        {
+            "name": "setMonitoringXHREnabled",
+            "parameters": [
+                { "name": "enabled", "type": "boolean", "description": "Monitoring enabled state." }
+            ],
+            "description": "Toggles monitoring of XMLHttpRequest. If <code>true</code>, console will receive messages upon each XHR issued."
+        },
+        {
+            "name": "addInspectedNode",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId", "description": "DOM node id to be accessible by means of $0 command line API." }
+            ],
+            "description": "Enables console to refer to the node with given id via $0 (see Command Line API for more details)."
+        }
+    ],
+    "events": [
+        {
+            "name": "messageAdded",
+            "parameters": [
+                { "name": "message", "$ref": "ConsoleMessage", "description": "Console message that has been added." }
+            ],
+            "description": "Issued when new console message is added."
+        },
+        {
+            "name": "messageRepeatCountUpdated",
+            "parameters": [
+                { "name": "count", "type": "integer", "description": "New repeat count value." }
+            ],
+            "description": "Issued when subsequent message(s) are equal to the previous one(s)."
+        },
+        {
+            "name": "messagesCleared",
+            "description": "Issued when console is cleared. This happens either upon <code>clearMessages</code> command or after page navigation."
+        },
+        {
+            "name": "heapSnapshot",
+            "description": "Issued from console.takeHeapSnapshot.",
+            "parameters": [
+                { "name": "timestamp", "type": "number" },
+                { "name": "snapshotData", "$ref": "Heap.HeapSnapshotData", "description": "Snapshot at the end of tracking." },
+                { "name": "title", "type": "string", "optional": true, "description": "Optional title provided to console.takeHeapSnapshot." }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/DOM.json b/inspector/protocol/DOM.json
new file mode 100644
index 0000000..a246336
--- /dev/null
+++ b/inspector/protocol/DOM.json
@@ -0,0 +1,581 @@
+{
+    "domain": "DOM",
+    "description": "This domain exposes DOM read/write operations. Each DOM Node is represented with its mirror object that has an <code>id</code>. This <code>id</code> can be used to get additional information on the Node, resolve it into the JavaScript object wrapper, etc. It is important that client receives DOM events only for the nodes that are known to the client. Backend keeps track of the nodes that were sent to the client and never sends the same node twice. It is client's responsibility to collect information about the nodes that were sent to the client.<p>Note that <code>iframe</code> owner elements will return corresponding document elements as their child nodes.</p>",
+    "availability": "web",
+    "types": [
+        {
+            "id": "NodeId",
+            "type": "integer",
+            "description": "Unique DOM node identifier."
+        },
+        {
+            "id": "BackendNodeId",
+            "type": "integer",
+            "description": "Unique DOM node identifier used to reference a node that may not have been pushed to the front-end."
+        },
+        {
+            "id": "PseudoType",
+            "type": "string",
+            "enum": ["before", "after"],
+            "description": "Pseudo element type."
+        },
+        {
+            "id": "ShadowRootType",
+            "type": "string",
+            "enum": ["user-agent", "open", "closed"],
+            "description": "Shadow root type."
+        },
+        {
+            "id": "CustomElementState",
+            "type": "string",
+            "enum": ["builtin", "custom", "waiting", "failed"],
+            "description": "Custom element state."
+        },
+        {
+            "id": "LiveRegionRelevant",
+            "type": "string",
+            "enum": ["additions", "removals", "text"],
+            "description": "Token values of @aria-relevant attribute."
+        },
+        {
+            "id": "Node",
+            "type": "object",
+            "properties": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Node identifier that is passed into the rest of the DOM messages as the <code>nodeId</code>. Backend will only push node with given <code>id</code> once. It is aware of all requested nodes and will only fire DOM events for nodes known to the client." },
+                { "name": "nodeType", "type": "integer", "description": "<code>Node</code>'s nodeType." },
+                { "name": "nodeName", "type": "string", "description": "<code>Node</code>'s nodeName." },
+                { "name": "localName", "type": "string", "description": "<code>Node</code>'s localName." },
+                { "name": "nodeValue", "type": "string", "description": "<code>Node</code>'s nodeValue." },
+                { "name": "childNodeCount", "type": "integer", "optional": true, "description": "Child count for <code>Container</code> nodes." },
+                { "name": "children", "type": "array", "optional": true, "items": { "$ref": "Node" }, "description": "Child nodes of this node when requested with children." },
+                { "name": "attributes", "type": "array", "optional": true, "items": { "type": "string" }, "description": "Attributes of the <code>Element</code> node in the form of flat array <code>[name1, value1, name2, value2]</code>." },
+                { "name": "documentURL", "type": "string", "optional": true, "description": "Document URL that <code>Document</code> or <code>FrameOwner</code> node points to." },
+                { "name": "baseURL", "type": "string", "optional": true, "description": "Base URL that <code>Document</code> or <code>FrameOwner</code> node uses for URL completion." },
+                { "name": "publicId", "type": "string", "optional": true, "description": "<code>DocumentType</code>'s publicId." },
+                { "name": "systemId", "type": "string", "optional": true, "description": "<code>DocumentType</code>'s systemId." },
+                { "name": "xmlVersion", "type": "string", "optional": true, "description": "<code>Document</code>'s XML version in case of XML documents." },
+                { "name": "name", "type": "string", "optional": true, "description": "<code>Attr</code>'s name." },
+                { "name": "value", "type": "string", "optional": true, "description": "<code>Attr</code>'s value." },
+                { "name": "pseudoType", "$ref": "PseudoType", "optional": true, "description": "Pseudo element type for this node." },
+                { "name": "shadowRootType", "$ref": "ShadowRootType", "optional": true, "description": "Shadow root type." },
+                { "name": "customElementState", "$ref": "CustomElementState", "optional": true, "description": "Custom element state." },
+                { "name": "frameId", "$ref": "Network.FrameId", "optional": true, "description": "Frame ID for frame owner elements." },
+                { "name": "contentDocument", "$ref": "Node", "optional": true, "description": "Content document for frame owner elements." },
+                { "name": "shadowRoots", "type": "array", "optional": true, "items": { "$ref": "Node" }, "description": "Shadow root list for given element host." },
+                { "name": "templateContent", "$ref": "Node", "optional": true, "description": "Content document fragment for template elements" },
+                { "name": "pseudoElements", "type": "array", "items": { "$ref": "Node" }, "optional": true, "description": "Pseudo elements associated with this node." },
+                { "name": "role", "type": "string", "optional": true, "description": "Computed value for first recognized role token, default role per element, or overridden role." },
+                { "name": "contentSecurityPolicyHash", "type": "string", "optional": true, "description": "Computed SHA-256 Content Security Policy hash source for given element." }
+            ],
+            "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
+        },
+        {
+            "id": "EventListener",
+            "type": "object",
+            "properties": [
+                { "name": "type", "type": "string", "description": "<code>EventListener</code>'s type." },
+                { "name": "useCapture", "type": "boolean", "description": "<code>EventListener</code>'s useCapture." },
+                { "name": "isAttribute", "type": "boolean", "description": "<code>EventListener</code>'s isAttribute." },
+                { "name": "nodeId", "$ref": "NodeId", "description": "Target <code>DOMNode</code> id." },
+                { "name": "handlerBody", "type": "string", "description": "Event handler function body." },
+                { "name": "location", "$ref": "Debugger.Location", "optional": true, "description": "Handler code location." },
+                { "name": "sourceName", "type": "string", "optional": true, "description": "Source script URL." },
+                { "name": "handler", "$ref": "Runtime.RemoteObject", "optional": true, "description": "Event handler function value." }
+            ],
+            "description": "A structure holding event listener properties."
+        },
+        {
+            "id": "AccessibilityProperties",
+            "description": "A structure holding accessibility properties.",
+            "type": "object",
+            "properties": [
+                { "name": "activeDescendantNodeId", "$ref": "NodeId", "optional": true, "description": "<code>DOMNode</code> id of the accessibility object referenced by aria-activedescendant." },
+                { "name": "busy", "type": "boolean", "optional": true, "description": "Value of @aria-busy on current or ancestor node." },
+                { "name": "checked", "type": "string", "optional": true, "enum": ["true", "false", "mixed"], "description": "Checked state of certain form controls." },
+                { "name": "childNodeIds", "type": "array", "items": { "$ref": "NodeId" }, "optional": true, "description": "Array of <code>DOMNode</code> ids of the accessibility tree children if available." },
+                { "name": "controlledNodeIds", "type": "array", "items": { "$ref": "NodeId" }, "optional": true, "description": "Array of <code>DOMNode</code> ids of any nodes referenced via @aria-controls." },
+                { "name": "current", "type": "string", "optional": true, "enum": ["true", "false", "page", "step", "location", "date", "time"], "description": "Current item within a container or set of related elements." },
+                { "name": "disabled", "type": "boolean", "optional": true, "description": "Disabled state of form controls." },
+                { "name": "headingLevel", "type": "number", "optional": true, "description": "Heading level of a heading element." },
+                { "name": "hierarchyLevel", "type": "number", "optional": true, "description": "The hierarchical level of an element." },
+                { "name": "isPopUpButton", "type": "boolean", "optional": true, "description": "Whether an element is a popup button." },
+                { "name": "exists", "type": "boolean", "description": "Indicates whether there is an existing AX object for the DOM node. If this is false, all the other properties will be default values." },
+                { "name": "expanded", "type": "boolean", "optional": true, "description": "Expanded state." },
+                { "name": "flowedNodeIds", "type": "array", "items": { "$ref": "NodeId" }, "optional": true, "description": "Array of <code>DOMNode</code> ids of any nodes referenced via @aria-flowto." },
+                { "name": "focused", "type": "boolean", "optional": true, "description": "Focused state. Only defined on focusable elements." },
+                { "name": "ignored", "type": "boolean", "optional": true, "description": "Indicates whether the accessibility of the associated AX object node is ignored, whether heuristically or explicitly." },
+                { "name": "ignoredByDefault", "type": "boolean", "optional": true, "description": "State indicating whether the accessibility of the associated AX object node is ignored by default for node type." },
+                { "name": "invalid", "type": "string", "optional": true, "enum": ["true", "false", "grammar", "spelling"], "description": "Invalid status of form controls." },
+                { "name": "hidden", "type": "boolean", "optional": true, "description": "Hidden state. True if node or an ancestor is hidden via CSS or explicit @aria-hidden, to clarify why the element is ignored." },
+                { "name": "label", "type": "string", "description": "Computed label value for the node, sometimes calculated by referencing other nodes." },
+                { "name": "liveRegionAtomic", "type": "boolean", "optional": true, "description": "Value of @aria-atomic." },
+                { "name": "liveRegionRelevant", "type": "array", "items": { "type": "string" }, "optional": true, "description": "Token value(s) of element's @aria-relevant attribute. Array of string values matching $ref LiveRegionRelevant. FIXME: Enum values blocked by http://webkit.org/b/133711" },
+                { "name": "liveRegionStatus", "type": "string", "optional": true, "enum": ["assertive", "polite", "off"], "description": "Value of element's @aria-live attribute." },
+                { "name": "mouseEventNodeId", "$ref": "NodeId", "optional": true, "description": "<code>DOMNode</code> id of node or closest ancestor node that has a mousedown, mouseup, or click event handler." },
+                { "name": "nodeId", "$ref": "NodeId", "description": "Target <code>DOMNode</code> id." },
+                { "name": "ownedNodeIds", "type": "array", "items": { "$ref": "NodeId" }, "optional": true, "description": "Array of <code>DOMNode</code> ids of any nodes referenced via @aria-owns." },
+                { "name": "parentNodeId", "$ref": "NodeId", "optional": true, "description": "<code>DOMNode</code> id of the accessibility tree parent object if available." },
+                { "name": "pressed", "type": "boolean", "optional": true, "description": "Pressed state for toggle buttons." },
+                { "name": "readonly", "type": "boolean", "optional": true, "description": "Readonly state of text controls." },
+                { "name": "required", "type": "boolean", "optional": true, "description": "Required state of form controls." },
+                { "name": "role", "type": "string", "description": "Computed value for first recognized role token, default role per element, or overridden role." },
+                { "name": "selected", "type": "boolean", "optional": true, "description": "Selected state of certain form controls." },
+                { "name": "selectedChildNodeIds", "type": "array", "items": { "$ref": "NodeId" }, "optional": true, "description": "Array of <code>DOMNode</code> ids of any children marked as selected." }
+            ]
+        },
+        {
+            "id": "RGBAColor",
+            "type": "object",
+            "properties": [
+                { "name": "r", "type": "integer", "description": "The red component, in the [0-255] range." },
+                { "name": "g", "type": "integer", "description": "The green component, in the [0-255] range." },
+                { "name": "b", "type": "integer", "description": "The blue component, in the [0-255] range." },
+                { "name": "a", "type": "number", "optional": true, "description": "The alpha component, in the [0-1] range (default: 1)." }
+            ],
+            "description": "A structure holding an RGBA color."
+        },
+        {
+            "id": "Quad",
+            "type": "array",
+            "items": { "type": "number" },
+            "minItems": 8,
+            "maxItems": 8,
+            "description": "An array of quad vertices, x immediately followed by y for each point, points clock-wise."
+        },
+        {
+            "id": "HighlightConfig",
+            "type": "object",
+            "properties": [
+                { "name": "showInfo", "type": "boolean", "optional": true, "description": "Whether the node info tooltip should be shown (default: false)." },
+                { "name": "contentColor", "$ref": "RGBAColor", "optional": true, "description": "The content box highlight fill color (default: transparent)." },
+                { "name": "paddingColor", "$ref": "RGBAColor", "optional": true, "description": "The padding highlight fill color (default: transparent)." },
+                { "name": "borderColor", "$ref": "RGBAColor", "optional": true, "description": "The border highlight fill color (default: transparent)." },
+                { "name": "marginColor", "$ref": "RGBAColor", "optional": true, "description": "The margin highlight fill color (default: transparent)." }
+            ],
+            "description": "Configuration data for the highlighting of page elements."
+        }
+    ],
+    "commands": [
+        {
+            "name": "getDocument",
+            "returns": [
+                { "name": "root", "$ref": "Node", "description": "Resulting node." }
+            ],
+            "description": "Returns the root DOM node to the caller."
+        },
+        {
+            "name": "requestChildNodes",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to get children for." },
+                { "name": "depth", "type": "integer", "optional": true, "description": "The maximum depth at which children should be retrieved, defaults to 1. Use -1 for the entire subtree or provide an integer larger than 0." }
+            ],
+            "description": "Requests that children of the node with given id are returned to the caller in form of <code>setChildNodes</code> events where not only immediate children are retrieved, but all children down to the specified depth."
+        },
+        {
+            "name": "querySelector",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to query upon." },
+                { "name": "selector", "type": "string", "description": "Selector string." }
+            ],
+            "returns": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Query selector result." }
+            ],
+            "description": "Executes <code>querySelector</code> on a given node."
+        },
+        {
+            "name": "querySelectorAll",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to query upon." },
+                { "name": "selector", "type": "string", "description": "Selector string." }
+            ],
+            "returns": [
+                { "name": "nodeIds", "type": "array", "items": { "$ref": "NodeId" }, "description": "Query selector result." }
+            ],
+            "description": "Executes <code>querySelectorAll</code> on a given node."
+        },
+        {
+            "name": "setNodeName",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to set name for." },
+                { "name": "name", "type": "string", "description": "New node's name." }
+            ],
+            "returns": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "New node's id." }
+            ],
+            "description": "Sets node name for a node with given id."
+        },
+        {
+            "name": "setNodeValue",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to set value for." },
+                { "name": "value", "type": "string", "description": "New node's value." }
+            ],
+            "description": "Sets node value for a node with given id."
+        },
+        {
+            "name": "removeNode",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to remove." }
+            ],
+            "description": "Removes node with given id."
+        },
+        {
+            "name": "setAttributeValue",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the element to set attribute for." },
+                { "name": "name", "type": "string", "description": "Attribute name." },
+                { "name": "value", "type": "string", "description": "Attribute value." }
+            ],
+            "description": "Sets attribute for an element with given id."
+        },
+        {
+            "name": "setAttributesAsText",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the element to set attributes for." },
+                { "name": "text", "type": "string", "description": "Text with a number of attributes. Will parse this text using HTML parser." },
+                { "name": "name", "type": "string", "optional": true, "description": "Attribute name to replace with new attributes derived from text in case text parsed successfully." }
+            ],
+            "description": "Sets attributes on element with given id. This method is useful when user edits some existing attribute value and types in several attribute name/value pairs."
+        },
+        {
+            "name": "removeAttribute",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the element to remove attribute from." },
+                { "name": "name", "type": "string", "description": "Name of the attribute to remove." }
+            ],
+            "description": "Removes attribute with given name from an element with given id."
+        },
+        {
+            "name": "getEventListenersForNode",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to get listeners for." },
+                { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name for handler value. Handler value is not returned without this parameter specified." }
+            ],
+            "returns": [
+                { "name": "listeners", "type": "array", "items": { "$ref": "EventListener"}, "description": "Array of relevant listeners." }
+            ],
+            "description": "Returns event listeners relevant to the node."
+        },
+        {
+            "name": "getAccessibilityPropertiesForNode",
+            "description": "Returns a dictionary of accessibility properties for the node.",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node for which to get accessibility properties." }
+            ],
+            "returns": [
+                { "name": "properties", "$ref": "AccessibilityProperties", "description": "Dictionary of relevant accessibility properties." }
+            ]
+        },
+        {
+            "name": "getOuterHTML",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to get markup for." }
+            ],
+            "returns": [
+                { "name": "outerHTML", "type": "string", "description": "Outer HTML markup." }
+            ],
+            "description": "Returns node's HTML markup."
+        },
+        {
+            "name": "setOuterHTML",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to set markup for." },
+                { "name": "outerHTML", "type": "string", "description": "Outer HTML markup to set." }
+            ],
+            "description": "Sets node HTML markup, returns new node id."
+        },
+        {
+            "name": "performSearch",
+            "parameters": [
+                { "name": "query", "type": "string", "description": "Plain text or query selector or XPath search query." },
+                { "name": "nodeIds", "type": "array", "items": { "$ref": "NodeId" }, "optional": true, "description": "Ids of nodes to use as starting points for the search." }
+            ],
+            "returns": [
+                { "name": "searchId", "type": "string", "description": "Unique search session identifier." },
+                { "name": "resultCount", "type": "integer", "description": "Number of search results." }
+            ],
+            "description": "Searches for a given string in the DOM tree. Use <code>getSearchResults</code> to access search results or <code>cancelSearch</code> to end this search session."
+        },
+        {
+            "name": "getSearchResults",
+            "parameters": [
+                { "name": "searchId", "type": "string", "description": "Unique search session identifier." },
+                { "name": "fromIndex", "type": "integer", "description": "Start index of the search result to be returned." },
+                { "name": "toIndex", "type": "integer", "description": "End index of the search result to be returned." }
+            ],
+            "returns": [
+                { "name": "nodeIds", "type": "array", "items": { "$ref": "NodeId" }, "description": "Ids of the search result nodes." }
+            ],
+            "description": "Returns search results from given <code>fromIndex</code> to given <code>toIndex</code> from the sarch with the given identifier."
+        },
+        {
+            "name": "discardSearchResults",
+            "parameters": [
+                { "name": "searchId", "type": "string", "description": "Unique search session identifier." }
+            ],
+            "description": "Discards search results from the session with the given id. <code>getSearchResults</code> should no longer be called for that search."
+        },
+        {
+            "name": "requestNode",
+            "parameters": [
+                { "name": "objectId", "$ref": "Runtime.RemoteObjectId", "description": "JavaScript object id to convert into node." }
+            ],
+            "returns": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Node id for given object." }
+            ],
+            "description": "Requests that the node is sent to the caller given the JavaScript node object reference. All nodes that form the path from the node to the root are also sent to the client as a series of <code>setChildNodes</code> notifications."
+        },
+        {
+            "name": "setInspectModeEnabled",
+            "parameters": [
+                { "name": "enabled", "type": "boolean", "description": "True to enable inspection mode, false to disable it." },
+                { "name": "highlightConfig", "$ref": "HighlightConfig", "optional": true, "description": "A descriptor for the highlight appearance of hovered-over nodes. May be omitted if <code>enabled == false</code>." }
+            ],
+            "description": "Enters the 'inspect' mode. In this mode, elements that user is hovering over are highlighted. Backend then generates 'inspect' command upon element selection."
+        },
+        {
+            "name": "highlightRect",
+            "parameters": [
+                { "name": "x", "type": "integer", "description": "X coordinate" },
+                { "name": "y", "type": "integer", "description": "Y coordinate" },
+                { "name": "width", "type": "integer", "description": "Rectangle width" },
+                { "name": "height", "type": "integer", "description": "Rectangle height" },
+                { "name": "color", "$ref": "RGBAColor", "optional": true, "description": "The highlight fill color (default: transparent)." },
+                { "name": "outlineColor", "$ref": "RGBAColor", "optional": true, "description": "The highlight outline color (default: transparent)." },
+                { "name": "usePageCoordinates", "type": "boolean", "optional": true, "description": "Indicates whether the provided parameters are in page coordinates or in viewport coordinates (the default)." }
+            ],
+            "description": "Highlights given rectangle. Coordinates are absolute with respect to the main frame viewport."
+        },
+        {
+            "name": "highlightQuad",
+            "parameters": [
+                { "name": "quad", "$ref": "Quad", "description": "Quad to highlight" },
+                { "name": "color", "$ref": "RGBAColor", "optional": true, "description": "The highlight fill color (default: transparent)." },
+                { "name": "outlineColor", "$ref": "RGBAColor", "optional": true, "description": "The highlight outline color (default: transparent)." },
+                { "name": "usePageCoordinates", "type": "boolean", "optional": true, "description": "Indicates whether the provided parameters are in page coordinates or in viewport coordinates (the default)." }
+            ],
+            "description": "Highlights given quad. Coordinates are absolute with respect to the main frame viewport."
+        },
+        {
+            "name": "highlightSelector",
+            "parameters": [
+                { "name": "highlightConfig", "$ref": "HighlightConfig", "description": "A descriptor for the highlight appearance." },
+                { "name": "selectorString", "type": "string", "description": "A CSS selector for finding matching nodes to highlight." },
+                { "name": "frameId", "type": "string", "optional": true, "description": "Identifier of the frame which will be searched using the selector.  If not provided, the main frame will be used." }
+            ],
+            "description": "Highlights all DOM nodes that match a given selector. A string containing a CSS selector must be specified."
+        },
+        {
+            "name": "highlightNode",
+            "parameters": [
+                { "name": "highlightConfig", "$ref": "HighlightConfig", "description": "A descriptor for the highlight appearance." },
+                { "name": "nodeId", "$ref": "NodeId", "optional": true, "description": "Identifier of the node to highlight." },
+                { "name": "objectId", "$ref": "Runtime.RemoteObjectId", "optional": true, "description": "JavaScript object id of the node to be highlighted." }
+            ],
+            "description": "Highlights DOM node with given id or with the given JavaScript object wrapper. Either nodeId or objectId must be specified."
+        },
+        {
+            "name": "hideHighlight",
+            "description": "Hides DOM node highlight."
+        },
+        {
+            "name": "highlightFrame",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Identifier of the frame to highlight." },
+                { "name": "contentColor", "$ref": "RGBAColor", "optional": true, "description": "The content box highlight fill color (default: transparent)." },
+                { "name": "contentOutlineColor", "$ref": "RGBAColor", "optional": true, "description": "The content box highlight outline color (default: transparent)." }
+            ],
+            "description": "Highlights owner element of the frame with given id."
+        },
+        {
+            "name": "pushNodeByPathToFrontend",
+            "parameters": [
+                { "name": "path", "type": "string", "description": "Path to node in the proprietary format." }
+            ],
+            "returns": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node for given path." }
+            ],
+            "description": "Requests that the node is sent to the caller given its path. // FIXME, use XPath"
+        },
+        {
+            "name": "pushNodeByBackendIdToFrontend",
+            "parameters": [
+                { "name": "backendNodeId", "$ref": "BackendNodeId", "description": "The backend node id of the node." }
+            ],
+            "returns": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "The pushed node's id." }
+            ],
+            "description": "Requests that the node is sent to the caller given its backend node id."
+        },
+        {
+            "name": "releaseBackendNodeIds",
+            "parameters": [
+                { "name": "nodeGroup", "type": "string", "description": "The backend node ids group name." }
+            ],
+            "description": "Requests that group of <code>BackendNodeIds</code> is released."
+        },
+        {
+            "name": "resolveNode",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to resolve." },
+                { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." }
+            ],
+            "returns": [
+                { "name": "object", "$ref": "Runtime.RemoteObject", "description": "JavaScript object wrapper for given node." }
+            ],
+            "description": "Resolves JavaScript node object for given node id."
+        },
+        {
+            "name": "getAttributes",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to retrieve attibutes for." }
+            ],
+            "returns": [
+                { "name": "attributes", "type": "array", "items": { "type": "string" }, "description": "An interleaved array of node attribute names and values." }
+            ],
+            "description": "Returns attributes for the specified node."
+        },
+        {
+            "name": "moveTo",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to drop." },
+                { "name": "targetNodeId", "$ref": "NodeId", "description": "Id of the element to drop into." },
+                { "name": "insertBeforeNodeId", "$ref": "NodeId", "optional": true, "description": "Drop node before given one." }
+            ],
+            "returns": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "New id of the moved node." }
+            ],
+            "description": "Moves node into the new container, places it before the given anchor."
+        },
+        {
+            "name": "undo",
+            "description": "Undoes the last performed action."
+        },
+        {
+            "name": "redo",
+            "description": "Re-does the last undone action."
+        },
+        {
+            "name": "markUndoableState",
+            "description": "Marks last undoable state."
+        },
+        {
+            "name": "focus",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node to focus." }
+            ],
+            "description": "Focuses the given element."
+        }
+    ],
+    "events": [
+        {
+            "name": "documentUpdated",
+            "description": "Fired when <code>Document</code> has been totally updated. Node ids are no longer valid."
+        },
+        {
+            "name": "setChildNodes",
+            "parameters": [
+                { "name": "parentId", "$ref": "NodeId", "description": "Parent node id to populate with children." },
+                { "name": "nodes", "type": "array", "items": { "$ref": "Node"}, "description": "Child nodes array." }
+            ],
+            "description": "Fired when backend wants to provide client with the missing DOM structure. This happens upon most of the calls requesting node ids."
+        },
+        {
+            "name": "attributeModified",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node that has changed." },
+                { "name": "name", "type": "string", "description": "Attribute name." },
+                { "name": "value", "type": "string", "description": "Attribute value." }
+            ],
+            "description": "Fired when <code>Element</code>'s attribute is modified."
+        },
+        {
+            "name": "attributeRemoved",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node that has changed." },
+                { "name": "name", "type": "string", "description": "A ttribute name." }
+            ],
+            "description": "Fired when <code>Element</code>'s attribute is removed."
+        },
+        {
+            "name": "inlineStyleInvalidated",
+            "parameters": [
+                { "name": "nodeIds", "type": "array", "items": { "$ref": "NodeId" }, "description": "Ids of the nodes for which the inline styles have been invalidated." }
+            ],
+            "description": "Fired when <code>Element</code>'s inline style is modified via a CSS property modification."
+        },
+        {
+            "name": "characterDataModified",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node that has changed." },
+                { "name": "characterData", "type": "string", "description": "New text value." }
+            ],
+            "description": "Mirrors <code>DOMCharacterDataModified</code> event."
+        },
+        {
+            "name": "childNodeCountUpdated",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node that has changed." },
+                { "name": "childNodeCount", "type": "integer", "description": "New node count." }
+            ],
+            "description": "Fired when <code>Container</code>'s child node count has changed."
+        },
+        {
+            "name": "childNodeInserted",
+            "parameters": [
+                { "name": "parentNodeId", "$ref": "NodeId", "description": "Id of the node that has changed." },
+                { "name": "previousNodeId", "$ref": "NodeId", "description": "If of the previous siblint." },
+                { "name": "node", "$ref": "Node", "description": "Inserted node data." }
+            ],
+            "description": "Mirrors <code>DOMNodeInserted</code> event."
+        },
+        {
+            "name": "childNodeRemoved",
+            "parameters": [
+                { "name": "parentNodeId", "$ref": "NodeId", "description": "Parent id." },
+                { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node that has been removed." }
+            ],
+            "description": "Mirrors <code>DOMNodeRemoved</code> event."
+        },
+        {
+            "name": "shadowRootPushed",
+            "parameters": [
+                { "name": "hostId", "$ref": "NodeId", "description": "Host element id." },
+                { "name": "root", "$ref": "Node", "description": "Shadow root." }
+            ],
+            "description": "Called when shadow root is pushed into the element."
+        },
+        {
+            "name": "shadowRootPopped",
+            "parameters": [
+                { "name": "hostId", "$ref": "NodeId", "description": "Host element id." },
+                { "name": "rootId", "$ref": "NodeId", "description": "Shadow root id." }
+            ],
+            "description": "Called when shadow root is popped from the element."
+        },
+        {
+            "name": "customElementStateChanged",
+            "parameters": [
+                { "name": "nodeId", "$ref": "NodeId", "description": "Element id." },
+                { "name": "customElementState", "$ref": "CustomElementState", "description": "Custom element state." }
+            ],
+            "description": "Called when the custom element state is changed."
+        },
+        {
+            "name": "pseudoElementAdded",
+            "parameters": [
+                { "name": "parentId", "$ref": "NodeId", "description": "Pseudo element's parent element id." },
+                { "name": "pseudoElement", "$ref": "Node", "description": "The added pseudo element." }
+            ],
+            "description": "Called when a pseudo element is added to an element."
+        },
+        {
+            "name": "pseudoElementRemoved",
+            "parameters": [
+                { "name": "parentId", "$ref": "NodeId", "description": "Pseudo element's parent element id." },
+                { "name": "pseudoElementId", "$ref": "NodeId", "description": "The removed pseudo element id." }
+            ],
+            "description": "Called when a pseudo element is removed from an element."
+        }
+    ]
+}
diff --git a/inspector/protocol/DOMDebugger.json b/inspector/protocol/DOMDebugger.json
new file mode 100644
index 0000000..bfab308
--- /dev/null
+++ b/inspector/protocol/DOMDebugger.json
@@ -0,0 +1,73 @@
+{
+    "domain": "DOMDebugger",
+    "description": "DOM debugging allows setting breakpoints on particular DOM operations and events. JavaScript execution will stop on these operations as if there was a regular breakpoint set.",
+    "availability": "web",
+    "types": [
+        {
+            "id": "DOMBreakpointType",
+            "type": "string",
+            "enum": ["subtree-modified", "attribute-modified", "node-removed"],
+            "description": "DOM breakpoint type."
+        }
+    ],
+    "commands": [
+        {
+            "name": "setDOMBreakpoint",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId", "description": "Identifier of the node to set breakpoint on." },
+                { "name": "type", "$ref": "DOMBreakpointType", "description": "Type of the operation to stop upon." }
+            ],
+            "description": "Sets breakpoint on particular operation with DOM."
+        },
+        {
+            "name": "removeDOMBreakpoint",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId", "description": "Identifier of the node to remove breakpoint from." },
+                { "name": "type", "$ref": "DOMBreakpointType", "description": "Type of the breakpoint to remove." }
+            ],
+            "description": "Removes DOM breakpoint that was set using <code>setDOMBreakpoint</code>."
+        },
+        {
+            "name": "setEventListenerBreakpoint",
+            "parameters": [
+                { "name": "eventName", "type": "string", "description": "DOM Event name to stop on (any DOM event will do)." }
+            ],
+            "description": "Sets breakpoint on particular DOM event."
+        },
+        {
+            "name": "removeEventListenerBreakpoint",
+            "parameters": [
+                { "name": "eventName", "type": "string", "description": "Event name." }
+            ],
+            "description": "Removes breakpoint on particular DOM event."
+        },
+        {
+            "name": "setInstrumentationBreakpoint",
+            "parameters": [
+                { "name": "eventName", "type": "string", "description": "Instrumentation name to stop on." }
+            ],
+            "description": "Sets breakpoint on particular native event."
+        },
+        {
+            "name": "removeInstrumentationBreakpoint",
+            "parameters": [
+                { "name": "eventName", "type": "string", "description": "Instrumentation name to stop on." }
+            ],
+            "description": "Sets breakpoint on particular native event."
+        },
+        {
+            "name": "setXHRBreakpoint",
+            "parameters": [
+                { "name": "url", "type": "string", "description": "Resource URL substring. All XHRs having this substring in the URL will get stopped upon." }
+            ],
+            "description": "Sets breakpoint on XMLHttpRequest."
+        },
+        {
+            "name": "removeXHRBreakpoint",
+            "parameters": [
+                { "name": "url", "type": "string", "description": "Resource URL substring." }
+            ],
+            "description": "Removes breakpoint from XMLHttpRequest."
+        }
+    ]
+}
diff --git a/inspector/protocol/DOMStorage.json b/inspector/protocol/DOMStorage.json
new file mode 100644
index 0000000..812e70d
--- /dev/null
+++ b/inspector/protocol/DOMStorage.json
@@ -0,0 +1,88 @@
+{
+    "domain": "DOMStorage",
+    "description": "Query and modify DOM storage.",
+    "availability": "web",
+    "types": [
+        {
+            "id": "StorageId",
+            "type": "object",
+            "description": "DOM Storage identifier.",
+            "properties": [
+                { "name": "securityOrigin", "type": "string", "description": "Security origin for the storage." },
+                { "name": "isLocalStorage", "type": "boolean", "description": "Whether the storage is local storage (not session storage)." }
+            ]
+        },
+        {
+            "id": "Item",
+            "type": "array",
+            "description": "DOM Storage item.",
+            "items": { "type": "string" }
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables storage tracking, storage events will now be delivered to the client."
+        },
+        {
+            "name": "disable",
+            "description": "Disables storage tracking, prevents storage events from being sent to the client."
+        },
+        {
+            "name": "getDOMStorageItems",
+            "parameters": [
+                { "name": "storageId", "$ref": "StorageId" }
+            ],
+            "returns": [
+                { "name": "entries", "type": "array", "items": { "$ref": "Item" } }
+            ]
+        },
+        {
+            "name": "setDOMStorageItem",
+            "parameters": [
+                { "name": "storageId", "$ref": "StorageId" },
+                { "name": "key", "type": "string" },
+                { "name": "value", "type": "string" }
+            ]
+        },
+        {
+            "name": "removeDOMStorageItem",
+            "parameters": [
+                { "name": "storageId", "$ref": "StorageId" },
+                { "name": "key", "type": "string" }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "domStorageItemsCleared",
+            "parameters": [
+                { "name": "storageId", "$ref": "StorageId" }
+            ]
+        },
+        {
+            "name": "domStorageItemRemoved",
+            "parameters": [
+                { "name": "storageId", "$ref": "StorageId" },
+                { "name": "key", "type": "string" }
+            ]
+        },
+        {
+            "name": "domStorageItemAdded",
+            "parameters": [
+                { "name": "storageId", "$ref": "StorageId" },
+                { "name": "key", "type": "string" },
+                { "name": "newValue", "type": "string" }
+            ]
+        },
+        {
+            "name": "domStorageItemUpdated",
+            "parameters": [
+                { "name": "storageId", "$ref": "StorageId" },
+                { "name": "key", "type": "string" },
+                { "name": "oldValue", "type": "string" },
+                { "name": "newValue", "type": "string" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/Database.json b/inspector/protocol/Database.json
new file mode 100644
index 0000000..b959e0f
--- /dev/null
+++ b/inspector/protocol/Database.json
@@ -0,0 +1,71 @@
+{
+    "domain": "Database",
+    "availability": "web",
+    "types": [
+        {
+            "id": "DatabaseId",
+            "type": "string",
+            "description": "Unique identifier of Database object."
+        },
+        {
+            "id": "Database",
+            "type": "object",
+            "description": "Database object.",
+            "properties": [
+                { "name": "id", "$ref": "DatabaseId", "description": "Database ID." },
+                { "name": "domain", "type": "string", "description": "Database domain." },
+                { "name": "name", "type": "string", "description": "Database name." },
+                { "name": "version", "type": "string", "description": "Database version." }
+            ]
+        },
+        {
+            "id": "Error",
+            "type": "object",
+            "description": "Database error.",
+            "properties": [
+                { "name": "message", "type": "string", "description": "Error message." },
+                { "name": "code", "type": "integer", "description": "Error code." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables database tracking, database events will now be delivered to the client."
+        },
+        {
+            "name": "disable",
+            "description": "Disables database tracking, prevents database events from being sent to the client."
+        },
+        {
+            "name": "getDatabaseTableNames",
+            "parameters": [
+                { "name": "databaseId", "$ref": "DatabaseId" }
+            ],
+            "returns": [
+                { "name": "tableNames", "type": "array", "items": { "type": "string" } }
+            ]
+        },
+        {
+            "name": "executeSQL",
+            "async": true,
+            "parameters": [
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "query", "type": "string" }
+            ],
+            "returns": [
+                { "name": "columnNames", "type": "array", "optional": true, "items": { "type": "string" } },
+                { "name": "values", "type": "array", "optional": true, "items": { "type": "any" }},
+                { "name": "sqlError", "$ref": "Error", "optional": true }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "addDatabase",
+            "parameters": [
+                { "name": "database", "$ref": "Database" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/Debugger.json b/inspector/protocol/Debugger.json
new file mode 100644
index 0000000..21a2d74
--- /dev/null
+++ b/inspector/protocol/Debugger.json
@@ -0,0 +1,360 @@
+{
+    "domain": "Debugger",
+    "description": "Debugger domain exposes JavaScript debugging capabilities. It allows setting and removing breakpoints, stepping through execution, exploring stack traces, etc.",
+    "types": [
+        {
+            "id": "BreakpointId",
+            "type": "string",
+            "description": "Breakpoint identifier."
+        },
+        {
+            "id": "BreakpointActionIdentifier",
+            "type": "integer",
+            "description": "Breakpoint action identifier."
+        },
+        {
+            "id": "ScriptId",
+            "type": "string",
+            "description": "Unique script identifier."
+        },
+        {
+            "id": "CallFrameId",
+            "type": "string",
+            "description": "Call frame identifier."
+        },
+        {
+            "id": "Location",
+            "type": "object",
+            "properties": [
+                { "name": "scriptId", "$ref": "ScriptId", "description": "Script identifier as reported in the <code>Debugger.scriptParsed</code>." },
+                { "name": "lineNumber", "type": "integer", "description": "Line number in the script." },
+                { "name": "columnNumber", "type": "integer", "optional": true, "description": "Column number in the script." }
+            ],
+            "description": "Location in the source code."
+        },
+        {
+            "id": "BreakpointAction",
+            "type": "object",
+            "properties": [
+                { "name": "type", "type": "string", "enum": ["log", "evaluate", "sound", "probe"], "description": "Different kinds of breakpoint actions." },
+                { "name": "data", "type": "string", "optional": true, "description": "Data associated with this breakpoint type (e.g. for type \"eval\" this is the JavaScript string to evalulate)." },
+                { "name": "id", "$ref": "BreakpointActionIdentifier", "optional": true, "description": "A frontend-assigned identifier for this breakpoint action." }
+            ],
+            "description": "Action to perform when a breakpoint is triggered."
+        },
+        {
+            "id": "BreakpointOptions",
+            "type": "object",
+            "properties": [
+                { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." },
+                { "name": "actions", "type": "array", "optional": true, "items": { "$ref": "BreakpointAction" }, "description": "Actions to perform automatically when the breakpoint is triggered." },
+                { "name": "autoContinue", "type": "boolean", "optional": true, "description": "Automatically continue after hitting this breakpoint and running actions." },
+                { "name": "ignoreCount", "type": "integer", "optional": true, "description": "Number of times to ignore this breakpoint, before stopping on the breakpoint and running actions." }
+            ],
+            "description": "Extra options that modify breakpoint behavior."
+        },
+        {
+            "id": "FunctionDetails",
+            "type": "object",
+            "properties": [
+                { "name": "location", "$ref": "Location", "description": "Location of the function." },
+                { "name": "name", "type": "string", "optional": true, "description": "Name of the function. Not present for anonymous functions." },
+                { "name": "displayName", "type": "string", "optional": true, "description": "Display name of the function(specified in 'displayName' property on the function object)." },
+                { "name": "scopeChain", "type": "array", "optional": true, "items": { "$ref": "Scope" }, "description": "Scope chain for this closure." }
+            ],
+            "description": "Information about the function."
+        },
+        {
+            "id": "CallFrame",
+            "type": "object",
+            "properties": [
+                { "name": "callFrameId", "$ref": "CallFrameId", "description": "Call frame identifier. This identifier is only valid while the virtual machine is paused." },
+                { "name": "functionName", "type": "string", "description": "Name of the JavaScript function called on this call frame." },
+                { "name": "location", "$ref": "Location", "description": "Location in the source code." },
+                { "name": "scopeChain", "type": "array", "items": { "$ref": "Scope" }, "description": "Scope chain for this call frame." },
+                { "name": "this", "$ref": "Runtime.RemoteObject", "description": "<code>this</code> object for this call frame." },
+                { "name": "isTailDeleted", "type": "boolean", "description": "Is the current frame tail deleted from a tail call." }
+            ],
+            "description": "JavaScript call frame. Array of call frames form the call stack."
+        },
+        {
+            "id": "Scope",
+            "type": "object",
+            "properties": [
+                { "name": "object", "$ref": "Runtime.RemoteObject", "description": "Object representing the scope. For <code>global</code> and <code>with</code> scopes it represents the actual object; for the rest of the scopes, it is artificial transient object enumerating scope variables as its properties." },
+                { "name": "type", "type": "string", "enum": ["global", "with", "closure", "catch", "functionName", "globalLexicalEnvironment", "nestedLexical"], "description": "Scope type." },
+                { "name": "name", "type": "string", "optional": true, "description": "Name associated with the scope." },
+                { "name": "location", "$ref": "Location", "optional": true, "description": "Location if available of the scope definition." },
+                { "name": "empty", "type": "boolean", "optional": true, "description": "Whether the scope has any variables." }
+            ],
+            "description": "Scope description."
+        },
+        {
+            "id": "ProbeSample",
+            "description": "A sample collected by evaluating a probe breakpoint action.",
+            "type": "object",
+            "properties": [
+                { "name": "probeId", "$ref": "BreakpointActionIdentifier", "description": "Identifier of the probe breakpoint action that created the sample." },
+                { "name": "sampleId", "type": "integer", "description": "Unique identifier for this sample." },
+                { "name": "batchId", "type": "integer", "description": "A batch identifier which is the same for all samples taken at the same breakpoint hit." },
+                { "name": "timestamp", "type": "number", "description": "Timestamp of when the sample was taken." },
+                { "name": "payload", "$ref": "Runtime.RemoteObject", "description": "Contents of the sample." }
+            ]
+        },
+        {
+            "id": "AssertPauseReason",
+            "description": "The pause reason auxiliary data when paused because of an assertion.",
+            "type": "object",
+            "properties": [
+                { "name": "message", "type": "string", "optional": true, "description": "The console.assert message string if provided." }
+            ]
+        },
+        {
+            "id": "BreakpointPauseReason",
+            "description": "The pause reason auxiliary data when paused because of hitting a breakpoint.",
+            "type": "object",
+            "properties": [
+                { "name": "breakpointId", "type": "string", "description": "The identifier of the breakpoint causing the pause." }
+            ]
+        },
+        {
+            "id": "CSPViolationPauseReason",
+            "description": "The pause reason auxiliary data when paused because of a Content Security Policy directive.",
+            "type": "object",
+            "properties": [
+                { "name": "directive", "type": "string", "description": "The CSP directive that blocked script execution." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables debugger for the given page. Clients should not assume that the debugging has been enabled until the result for this command is received."
+        },
+        {
+            "name": "disable",
+            "description": "Disables debugger for given page."
+        },
+        {
+            "name": "setAsyncStackTraceDepth",
+            "description": "Set the async stack trace depth for the page. A value of zero disables recording of async stack traces.",
+            "parameters": [
+                { "name": "depth", "type": "integer", "description": "Async stack trace depth." }
+            ]
+        },
+        {
+            "name": "setBreakpointsActive",
+            "parameters": [
+                { "name": "active", "type": "boolean", "description": "New value for breakpoints active state." }
+            ],
+            "description": "Activates / deactivates all breakpoints on the page."
+        },
+        {
+            "name": "setBreakpointByUrl",
+            "parameters": [
+                { "name": "lineNumber", "type": "integer", "description": "Line number to set breakpoint at." },
+                { "name": "url", "type": "string", "optional": true, "description": "URL of the resources to set breakpoint on." },
+                { "name": "urlRegex", "type": "string", "optional": true, "description": "Regex pattern for the URLs of the resources to set breakpoints on. Either <code>url</code> or <code>urlRegex</code> must be specified." },
+                { "name": "columnNumber", "type": "integer", "optional": true, "description": "Offset in the line to set breakpoint at." },
+                { "name": "options", "$ref": "BreakpointOptions", "optional": true, "description": "Options to apply to this breakpoint to modify its behavior." }
+            ],
+            "returns": [
+                { "name": "breakpointId", "$ref": "BreakpointId", "description": "Id of the created breakpoint for further reference." },
+                { "name": "locations", "type": "array", "items": { "$ref": "Location"}, "description": "List of the locations this breakpoint resolved into upon addition." }
+            ],
+            "description": "Sets JavaScript breakpoint at given location specified either by URL or URL regex. Once this command is issued, all existing parsed scripts will have breakpoints resolved and returned in <code>locations</code> property. Further matching script parsing will result in subsequent <code>breakpointResolved</code> events issued. This logical breakpoint will survive page reloads."
+        },
+        {
+            "name": "setBreakpoint",
+            "parameters": [
+                { "name": "location", "$ref": "Location", "description": "Location to set breakpoint in." },
+                { "name": "options", "$ref": "BreakpointOptions", "optional": true, "description": "Options to apply to this breakpoint to modify its behavior." }
+            ],
+            "returns": [
+                { "name": "breakpointId", "$ref": "BreakpointId", "description": "Id of the created breakpoint for further reference." },
+                { "name": "actualLocation", "$ref": "Location", "description": "Location this breakpoint resolved into." }
+            ],
+            "description": "Sets JavaScript breakpoint at a given location."
+        },
+        {
+            "name": "removeBreakpoint",
+            "parameters": [
+                { "name": "breakpointId", "$ref": "BreakpointId" }
+            ],
+            "description": "Removes JavaScript breakpoint."
+        },
+        {
+            "name": "continueUntilNextRunLoop",
+            "description": "Continues execution until the current evaluation completes. This will trigger either a Debugger.paused or Debugger.resumed event."
+        },
+        {
+            "name": "continueToLocation",
+            "description": "Continues execution until specific location is reached. This will trigger either a Debugger.paused or Debugger.resumed event.",
+            "parameters": [
+                { "name": "location", "$ref": "Location", "description": "Location to continue to." }
+            ]
+        },
+        {
+            "name": "stepOver",
+            "description": "Steps over the statement. This will trigger either a Debugger.paused or Debugger.resumed event."
+        },
+        {
+            "name": "stepInto",
+            "description": "Steps into the function call. This will trigger either a Debugger.paused or Debugger.resumed event."
+        },
+        {
+            "name": "stepOut",
+            "description": "Steps out of the function call. This will trigger either a Debugger.paused or Debugger.resumed event."
+        },
+        {
+            "name": "pause",
+            "description": "Stops on the next JavaScript statement."
+        },
+        {
+            "name": "resume",
+            "description": "Resumes JavaScript execution. This will trigger a Debugger.resumed event."
+        },
+        {
+            "name": "searchInContent",
+            "description": "Searches for given string in script content.",
+            "parameters": [
+                { "name": "scriptId", "$ref": "ScriptId", "description": "Id of the script to search in." },
+                { "name": "query", "type": "string", "description": "String to search for." },
+                { "name": "caseSensitive", "type": "boolean", "optional": true, "description": "If true, search is case sensitive." },
+                { "name": "isRegex", "type": "boolean", "optional": true, "description": "If true, treats string parameter as regex." }
+            ],
+            "returns": [
+                { "name": "result", "type": "array", "items": { "$ref": "GenericTypes.SearchMatch" }, "description": "List of search matches." }
+            ]
+        },
+        {
+            "name": "getScriptSource",
+            "parameters": [
+                { "name": "scriptId", "$ref": "ScriptId", "description": "Id of the script to get source for." }
+            ],
+            "returns": [
+                { "name": "scriptSource", "type": "string", "description": "Script source." }
+            ],
+            "description": "Returns source for the script with given id."
+        },
+        {
+            "name": "getFunctionDetails",
+            "parameters": [
+                { "name": "functionId", "$ref": "Runtime.RemoteObjectId", "description": "Id of the function to get location for." }
+            ],
+            "returns": [
+                { "name": "details", "$ref": "FunctionDetails", "description": "Information about the function." }
+            ],
+            "description": "Returns detailed information on given function."
+        },
+        {
+            "name": "setPauseOnExceptions",
+            "description": "Defines pause on exceptions state. Can be set to stop on all exceptions, uncaught exceptions or no exceptions. Initial pause on exceptions state is <code>none</code>.",
+            "parameters": [
+                { "name": "state", "type": "string", "enum": ["none", "uncaught", "all"], "description": "Pause on exceptions mode." }
+            ]
+        },
+        {
+            "name": "setPauseOnAssertions",
+            "description": "Set pause on assertions state. Assertions are console.assert assertions.",
+            "parameters": [
+                { "name": "enabled", "type": "boolean" }
+            ]
+        },
+        {
+            "name": "evaluateOnCallFrame",
+            "parameters": [
+                { "name": "callFrameId", "$ref": "CallFrameId", "description": "Call frame identifier to evaluate on." },
+                { "name": "expression", "type": "string", "description": "Expression to evaluate." },
+                { "name": "objectGroup", "type": "string", "optional": true, "description": "String object group name to put result into (allows rapid releasing resulting object handles using <code>releaseObjectGroup</code>)." },
+                { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Specifies whether command line API should be available to the evaluated expression, defaults to false." },
+                { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether evaluation should stop on exceptions and mute console. Overrides setPauseOnException state." },
+                { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." },
+                { "name": "generatePreview", "type": "boolean", "optional": true, "description": "Whether preview should be generated for the result." },
+                { "name": "saveResult", "type": "boolean", "optional": true, "description": "Whether the resulting value should be considered for saving in the $n history." }
+            ],
+            "returns": [
+                { "name": "result", "$ref": "Runtime.RemoteObject", "description": "Object wrapper for the evaluation result." },
+                { "name": "wasThrown", "type": "boolean", "optional": true, "description": "True if the result was thrown during the evaluation." },
+                { "name": "savedResultIndex", "type": "integer", "optional": true, "description": "If the result was saved, this is the $n index that can be used to access the value." }
+            ],
+            "description": "Evaluates expression on a given call frame."
+        },
+        {
+            "name": "setOverlayMessage",
+            "parameters": [
+                { "name": "message", "type": "string", "optional": true, "description": "Overlay message to display when paused in debugger." }
+            ],
+            "description": "Sets overlay message."
+        }
+    ],
+    "events": [
+        {
+            "name": "globalObjectCleared",
+            "description": "Called when global has been cleared and debugger client should reset its state. Happens upon navigation or reload."
+        },
+        {
+            "name": "scriptParsed",
+            "parameters": [
+                { "name": "scriptId", "$ref": "ScriptId", "description": "Identifier of the script parsed." },
+                { "name": "url", "type": "string", "description": "URL of the script parsed (if any)." },
+                { "name": "startLine", "type": "integer", "description": "Line offset of the script within the resource with given URL (for script tags)." },
+                { "name": "startColumn", "type": "integer", "description": "Column offset of the script within the resource with given URL." },
+                { "name": "endLine", "type": "integer", "description": "Last line of the script." },
+                { "name": "endColumn", "type": "integer", "description": "Length of the last line of the script." },
+                { "name": "isContentScript", "type": "boolean", "optional": true, "description": "Determines whether this script is a user extension script." },
+                { "name": "sourceURL", "type": "string", "optional": true, "description": "sourceURL name of the script (if any)." },
+                { "name": "sourceMapURL", "type": "string", "optional": true, "description": "URL of source map associated with script (if any)." },
+                { "name": "module", "type": "boolean", "optional": true, "description": "True if this script was parsed as a module." }
+            ],
+            "description": "Fired when virtual machine parses script. This event is also fired for all known and uncollected scripts upon enabling debugger."
+        },
+        {
+            "name": "scriptFailedToParse",
+            "parameters": [
+                { "name": "url", "type": "string", "description": "URL of the script that failed to parse." },
+                { "name": "scriptSource", "type": "string", "description": "Source text of the script that failed to parse." },
+                { "name": "startLine", "type": "integer", "description": "Line offset of the script within the resource." },
+                { "name": "errorLine", "type": "integer", "description": "Line with error." },
+                { "name": "errorMessage", "type": "string", "description": "Parse error message." }
+            ],
+            "description": "Fired when virtual machine fails to parse the script."
+        },
+        {
+            "name": "breakpointResolved",
+            "parameters": [
+                { "name": "breakpointId", "$ref": "BreakpointId", "description": "Breakpoint unique identifier." },
+                { "name": "location", "$ref": "Location", "description": "Actual breakpoint location." }
+            ],
+            "description": "Fired when breakpoint is resolved to an actual script and location."
+        },
+        {
+            "name": "paused",
+            "parameters": [
+                { "name": "callFrames", "type": "array", "items": { "$ref": "CallFrame" }, "description": "Call stack the virtual machine stopped on." },
+                { "name": "reason", "type": "string", "enum": ["XHR", "DOM", "EventListener", "exception", "assert", "CSPViolation", "DebuggerStatement", "Breakpoint", "PauseOnNextStatement", "other"], "description": "Pause reason." },
+                { "name": "data", "type": "object", "optional": true, "description": "Object containing break-specific auxiliary properties." },
+                { "name": "asyncStackTrace", "$ref": "Console.StackTrace", "optional": true, "description": "Linked list of asynchronous StackTraces." }
+            ],
+            "description": "Fired when the virtual machine stopped on breakpoint or exception or any other stop criteria."
+        },
+        {
+            "name": "resumed",
+            "description": "Fired when the virtual machine resumed execution."
+        },
+        {
+            "name": "didSampleProbe",
+            "description": "Fires when a new probe sample is collected.",
+            "parameters": [
+                { "name": "sample", "$ref": "ProbeSample", "description": "A collected probe sample." }
+            ]
+        },
+        {
+            "name": "playBreakpointActionSound",
+            "description": "Fired when a \"sound\" breakpoint action is triggered on a breakpoint.",
+            "parameters": [
+                { "name": "breakpointActionId", "$ref": "BreakpointActionIdentifier", "description": "Breakpoint action identifier." }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/GenericTypes.json b/inspector/protocol/GenericTypes.json
new file mode 100644
index 0000000..1a61257
--- /dev/null
+++ b/inspector/protocol/GenericTypes.json
@@ -0,0 +1,15 @@
+{
+    "domain": "GenericTypes",
+    "description": "Exposes generic types to be used by any domain.",
+    "types": [
+        {
+            "id": "SearchMatch",
+            "type": "object",
+            "description": "Search match in a resource.",
+            "properties": [
+                { "name": "lineNumber", "type": "number", "description": "Line number in resource content." },
+                { "name": "lineContent", "type": "string", "description": "Line with match content." }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/Heap.json b/inspector/protocol/Heap.json
new file mode 100644
index 0000000..c76e33f
--- /dev/null
+++ b/inspector/protocol/Heap.json
@@ -0,0 +1,99 @@
+{
+    "domain": "Heap",
+    "description": "Heap domain exposes JavaScript heap attributes and capabilities.",
+    "types": [
+        {
+            "id": "GarbageCollection",
+            "description": "Information about a garbage collection.",
+            "type": "object",
+            "properties": [
+                { "name": "type", "type": "string", "enum": ["full", "partial"], "description": "The type of garbage collection." },
+                { "name": "startTime", "type": "number" },
+                { "name": "endTime", "type": "number" }
+            ]
+        },
+        {
+            "id": "HeapSnapshotData",
+            "description": "JavaScriptCore HeapSnapshot JSON data.",
+            "type": "string"
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables Heap domain events."
+        },
+        {
+            "name": "disable",
+            "description": "Disables Heap domain events."
+        },
+        {
+            "name": "gc",
+            "description": "Trigger a full garbage collection."
+        },
+        {
+            "name": "snapshot",
+            "description": "Take a heap snapshot.",
+            "returns": [
+                { "name": "timestamp", "type": "number" },
+                { "name": "snapshotData", "$ref": "HeapSnapshotData" }
+            ]
+        },
+        {
+            "name": "startTracking",
+            "description": "Start tracking heap changes. This will produce a `trackingStart` event."
+        },
+        {
+            "name": "stopTracking",
+            "description": "Stop tracking heap changes. This will produce a `trackingComplete` event."
+        },
+        {
+            "name": "getPreview",
+            "description": "Returns a preview (string, Debugger.FunctionDetails, or Runtime.ObjectPreview) for a Heap.HeapObjectId.",
+            "parameters": [
+                { "name": "heapObjectId", "type": "integer", "description": "Identifier of the heap object within the snapshot." }
+            ],
+            "returns": [
+                { "name": "string", "type": "string", "optional": true, "description": "String value." },
+                { "name": "functionDetails", "$ref": "Debugger.FunctionDetails", "optional": true, "description": "Function details." },
+                { "name": "preview", "$ref": "Runtime.ObjectPreview", "optional": true, "description": "Object preview." }
+            ]
+        },
+        {
+            "name": "getRemoteObject",
+            "description": "Returns the strongly referenced Runtime.RemoteObject for a Heap.HeapObjectId.",
+            "parameters": [
+                { "name": "heapObjectId", "type": "integer", "description": "Identifier of the heap object within the snapshot." },
+                { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." }
+            ],
+            "returns": [
+                { "name": "result", "$ref": "Runtime.RemoteObject", "description": "Resulting object." }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "garbageCollected",
+            "description": "Information about the garbage collection.",
+            "parameters": [
+                { "name": "collection", "$ref": "GarbageCollection" }
+            ]
+        },
+        {
+            "name": "trackingStart",
+            "description": "Tracking started.",
+            "parameters": [
+                { "name": "timestamp", "type": "number" },
+                { "name": "snapshotData", "$ref": "HeapSnapshotData", "description": "Snapshot at the start of tracking." }
+            ]
+        },
+        {
+            "name": "trackingComplete",
+            "description": "Tracking stopped.",
+            "parameters": [
+                { "name": "timestamp", "type": "number" },
+                { "name": "snapshotData", "$ref": "HeapSnapshotData", "description": "Snapshot at the end of tracking." }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/IndexedDB.json b/inspector/protocol/IndexedDB.json
new file mode 100644
index 0000000..bc35008
--- /dev/null
+++ b/inspector/protocol/IndexedDB.json
@@ -0,0 +1,143 @@
+{
+    "domain": "IndexedDB",
+    "featureGuard": "ENABLE(INDEXED_DATABASE)",
+    "availability": "web",
+    "types": [
+        {
+            "id": "DatabaseWithObjectStores",
+            "type": "object",
+            "description": "Database with an array of object stores.",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Database name." },
+                { "name": "version", "type": "number", "description": "Database version." },
+                { "name": "objectStores", "type": "array", "items": { "$ref": "ObjectStore" }, "description": "Object stores in this database." }
+            ]
+        },
+        {
+            "id": "ObjectStore",
+            "type": "object",
+            "description": "Object store.",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Object store name." },
+                { "name": "keyPath", "$ref": "KeyPath", "description": "Object store key path." },
+                { "name": "autoIncrement", "type": "boolean", "description": "If true, object store has auto increment flag set." },
+                { "name": "indexes", "type": "array", "items": { "$ref": "ObjectStoreIndex" }, "description": "Indexes in this object store." }
+            ]
+        },
+        {
+            "id": "ObjectStoreIndex",
+            "type": "object",
+            "description": "Object store index.",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Index name." },
+                { "name": "keyPath", "$ref": "KeyPath", "description": "Index key path." },
+                { "name": "unique", "type": "boolean", "description": "If true, index is unique." },
+                { "name": "multiEntry", "type": "boolean", "description": "If true, index allows multiple entries for a key." }
+            ]
+        },
+        {
+            "id": "Key",
+            "type": "object",
+            "description": "Key.",
+            "properties": [
+                { "name": "type", "type": "string", "enum": ["number", "string", "date", "array"], "description": "Key type." },
+                { "name": "number", "type": "number", "optional": true, "description": "Number value." },
+                { "name": "string", "type": "string", "optional": true, "description": "String value." },
+                { "name": "date", "type": "number", "optional": true, "description": "Date value." },
+                { "name": "array", "type": "array", "optional": true, "items": { "$ref": "Key" }, "description": "Array value." }
+            ]
+        },
+        {
+            "id": "KeyRange",
+            "type": "object",
+            "description": "Key range.",
+            "properties": [
+                { "name": "lower", "$ref": "Key", "optional": true, "description": "Lower bound." },
+                { "name": "upper", "$ref": "Key", "optional": true, "description": "Upper bound." },
+                { "name": "lowerOpen", "type": "boolean", "description": "If true lower bound is open." },
+                { "name": "upperOpen", "type": "boolean", "description": "If true upper bound is open." }
+            ]
+        },
+        {
+            "id": "DataEntry",
+            "type": "object",
+            "description": "Data entry.",
+            "properties": [
+                { "name": "key", "$ref": "Runtime.RemoteObject", "description": "Key." },
+                { "name": "primaryKey", "$ref": "Runtime.RemoteObject", "description": "Primary key." },
+                { "name": "value", "$ref": "Runtime.RemoteObject", "description": "Value." }
+            ]
+        },
+        {
+            "id": "KeyPath",
+            "type": "object",
+            "description": "Key path.",
+            "properties": [
+                { "name": "type", "type": "string", "enum": ["null", "string", "array"], "description": "Key path type." },
+                { "name": "string", "type": "string", "optional": true, "description": "String value." },
+                { "name": "array", "type": "array", "optional": true, "items": { "type": "string" }, "description": "Array value." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables events from backend."
+        },
+        {
+            "name": "disable",
+            "description": "Disables events from backend."
+        },
+        {
+            "name": "requestDatabaseNames",
+            "description": "Requests database names for given security origin.",
+            "async": true,
+            "parameters": [
+                { "name": "securityOrigin", "type": "string", "description": "Security origin." }
+            ],
+            "returns": [
+                { "name": "databaseNames", "type": "array", "items": { "type": "string" }, "description": "Database names for origin." }
+            ]
+        },
+        {
+            "name": "requestDatabase",
+            "description": "Requests database with given name in given frame.",
+            "async": true,
+            "parameters": [
+                { "name": "securityOrigin", "type": "string", "description": "Security origin." },
+                { "name": "databaseName", "type": "string", "description": "Database name." }
+            ],
+            "returns": [
+                { "name": "databaseWithObjectStores", "$ref": "DatabaseWithObjectStores", "description": "Database with an array of object stores." }
+            ]
+        },
+        {
+            "name": "requestData",
+            "description": "Requests data from object store or index.",
+            "async": true,
+            "parameters": [
+                { "name": "securityOrigin", "type": "string", "description": "Security origin." },
+                { "name": "databaseName", "type": "string", "description": "Database name." },
+                { "name": "objectStoreName", "type": "string", "description": "Object store name." },
+                { "name": "indexName", "type": "string", "description": "Index name, empty string for object store data requests." },
+                { "name": "skipCount", "type": "integer", "description": "Number of records to skip." },
+                { "name": "pageSize", "type": "integer", "description": "Number of records to fetch." },
+                { "name": "keyRange", "$ref": "KeyRange", "optional": true, "description": "Key range." }
+            ],
+            "returns": [
+                { "name": "objectStoreDataEntries", "type": "array", "items": { "$ref": "DataEntry" }, "description": "Array of object store data entries." },
+                { "name": "hasMore", "type": "boolean", "description": "If true, there are more entries to fetch in the given range." }
+            ]
+        },
+        {
+            "name": "clearObjectStore",
+            "description": "Clears all entries from an object store.",
+            "async": true,
+            "parameters": [
+                { "name": "securityOrigin", "type": "string", "description": "Security origin." },
+                { "name": "databaseName", "type": "string", "description": "Database name." },
+                { "name": "objectStoreName", "type": "string", "description": "Object store name." }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/Inspector.json b/inspector/protocol/Inspector.json
new file mode 100644
index 0000000..0420ebd
--- /dev/null
+++ b/inspector/protocol/Inspector.json
@@ -0,0 +1,51 @@
+{
+    "domain": "Inspector",
+    "types": [],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables inspector domain notifications."
+        },
+        {
+            "name": "disable",
+            "description": "Disables inspector domain notifications."
+        },
+        {
+            "name": "initialized",
+            "description": "Sent by the frontend after all initialization messages have been sent."
+        }
+    ],
+    "events": [
+        {
+            "name": "evaluateForTestInFrontend",
+            "parameters": [
+                { "name": "script", "type": "string" }
+            ]
+        },
+        {
+            "name": "inspect",
+            "parameters": [
+                { "name": "object", "$ref": "Runtime.RemoteObject" },
+                { "name": "hints", "type": "object" }
+            ]
+        },
+        {
+            "name": "detached",
+            "description": "Fired when remote debugging connection is about to be terminated. Contains detach reason.",
+            "parameters": [
+                { "name": "reason", "type": "string", "description": "The reason why connection has been terminated." }
+            ]
+        },
+        {
+            "name": "activateExtraDomains",
+            "description": "Fired when the backend has alternate domains that need to be activated.",
+            "parameters": [
+                { "name": "domains", "type": "array", "items": { "type": "string" }, "description": "Domain names that need activation" }
+            ]
+        },
+        {
+            "name": "targetCrashed",
+            "description": "Fired when debugging target has crashed"
+        }
+    ]
+}
diff --git a/inspector/protocol/LayerTree.json b/inspector/protocol/LayerTree.json
new file mode 100644
index 0000000..4115cd4
--- /dev/null
+++ b/inspector/protocol/LayerTree.json
@@ -0,0 +1,114 @@
+{
+    "domain": "LayerTree",
+    "availability": "web",
+    "types": [
+        {
+            "id": "LayerId",
+            "type": "string",
+            "description": "Unique RenderLayer identifier."
+        },
+        {
+            "id": "PseudoElementId",
+            "type": "string",
+            "description": "Unique PseudoElement identifier."
+        },
+        {
+            "id": "IntRect",
+            "type": "object",
+            "description": "A rectangle.",
+            "properties": [
+                { "name": "x", "type": "integer", "description": "The x position." },
+                { "name": "y", "type": "integer", "description": "The y position." },
+                { "name": "width", "type": "integer", "description": "The width metric." },
+                { "name": "height", "type": "integer", "description": "The height metric." }
+            ]
+        },
+        {
+            "id": "Layer",
+            "type": "object",
+            "description": "Information about a compositing layer.",
+            "properties": [
+                { "name": "layerId", "$ref": "LayerId", "description": "The unique id for this layer." },
+                { "name": "nodeId", "$ref": "DOM.NodeId", "description": "The id for the node associated with this layer." },
+                { "name": "bounds", "$ref": "IntRect", "description": "Bounds of the layer in absolute page coordinates." },
+                { "name": "paintCount", "type": "integer", "description": "Indicates how many time this layer has painted." },
+                { "name": "memory", "type": "integer", "description": "Estimated memory used by this layer." },
+                { "name": "compositedBounds", "$ref": "IntRect", "description": "The bounds of the composited layer." },
+                { "name": "isInShadowTree", "type": "boolean", "optional": true, "description": "Indicates whether this layer is associated with an element hosted in a shadow tree." },
+                { "name": "isReflection", "type": "boolean", "optional": true, "description": "Indicates whether this layer was used to provide a reflection for the element." },
+                { "name": "isGeneratedContent", "type": "boolean", "optional": true, "description": "Indicates whether the layer is attached to a pseudo element that is CSS generated content." },
+                { "name": "isAnonymous", "type": "boolean", "optional": true, "description": "Indicates whether the layer was created for a CSS anonymous block or box." },
+                { "name": "pseudoElementId", "$ref": "PseudoElementId", "optional": true, "description": "The id for the pseudo element associated with this layer." },
+                { "name": "pseudoElement", "type": "string", "optional": true, "description": "The name of the CSS pseudo-element that prompted the layer to be generated." }
+            ]
+        },
+        {
+            "id": "CompositingReasons",
+            "type": "object",
+            "description": "An object containing the reasons why the layer was composited as properties.",
+            "properties": [
+                { "name": "transform3D", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a CSS 3D transform." },
+                { "name": "video", "type": "boolean", "optional": true, "description": "Composition due to association with a <video> element." },
+                { "name": "canvas", "type": "boolean", "optional": true, "description": "Composition due to the element being a <canvas> element." },
+                { "name": "plugin", "type": "boolean", "optional": true, "description": "Composition due to association with a plugin." },
+                { "name": "iFrame", "type": "boolean", "optional": true, "description": "Composition due to association with an <iframe> element." },
+                { "name": "backfaceVisibilityHidden", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a \"backface-visibility: hidden\" style." },
+                { "name": "clipsCompositingDescendants", "type": "boolean", "optional": true, "description": "Composition due to association with an element clipping compositing descendants." },
+                { "name": "animation", "type": "boolean", "optional": true, "description": "Composition due to association with an animated element." },
+                { "name": "filters", "type": "boolean", "optional": true, "description": "Composition due to association with an element with CSS filters applied." },
+                { "name": "positionFixed", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a \"position: fixed\" style." },
+                { "name": "positionSticky", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a \"position: sticky\" style." },
+                { "name": "overflowScrollingTouch", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a \"overflow-scrolling: touch\" style." },
+                { "name": "stacking", "type": "boolean", "optional": true, "description": "Composition due to association with an element establishing a stacking context." },
+                { "name": "overlap", "type": "boolean", "optional": true, "description": "Composition due to association with an element overlapping other composited elements." },
+                { "name": "negativeZIndexChildren", "type": "boolean", "optional": true, "description": "Composition due to association with an element with descendants that have a negative z-index." },
+                { "name": "transformWithCompositedDescendants", "type": "boolean", "optional": true, "description": "Composition due to association with an element with composited descendants." },
+                { "name": "opacityWithCompositedDescendants", "type": "boolean", "optional": true, "description": "Composition due to association with an element with opacity applied and composited descendants." },
+                { "name": "maskWithCompositedDescendants", "type": "boolean", "optional": true, "description": "Composition due to association with a masked element and composited descendants." },
+                { "name": "reflectionWithCompositedDescendants", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a reflection and composited descendants." },
+                { "name": "filterWithCompositedDescendants", "type": "boolean", "optional": true, "description": "Composition due to association with an element with CSS filters applied and composited descendants." },
+                { "name": "blendingWithCompositedDescendants", "type": "boolean", "optional": true, "description": "Composition due to association with an element with CSS blending applied and composited descendants." },
+                { "name": "isolatesCompositedBlendingDescendants", "type": "boolean", "optional": true, "description": "Composition due to association with an element isolating compositing descendants having CSS blending applied." },
+                { "name": "perspective", "type": "boolean", "optional": true, "description": "Composition due to association with an element with perspective applied." },
+                { "name": "preserve3D", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a \"transform-style: preserve-3d\" style." },
+                { "name": "willChange", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a \"will-change\" style." },
+                { "name": "root", "type": "boolean", "optional": true, "description": "Composition due to association with the root element." },
+                { "name": "blending", "type": "boolean", "optional": true, "description": "Composition due to association with an element with a \"blend-mode\" style." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables compositing tree inspection."
+        },
+        {
+            "name": "disable",
+            "description": "Disables compositing tree inspection."
+        },
+        {
+            "name": "layersForNode",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId", "description": "Root of the subtree for which we want to gather layers." }                ],
+            "description": "Returns the layer tree structure of the current page.",
+            "returns": [
+                { "name": "layers", "type": "array", "items": { "$ref": "Layer" }, "description": "Child layers." }
+            ]
+        },
+        {
+            "name": "reasonsForCompositingLayer",
+            "parameters": [
+                { "name": "layerId", "$ref": "LayerId", "description": "The id of the layer for which we want to get the reasons it was composited." }
+            ],
+            "description": "Provides the reasons why the given layer was composited.",
+            "returns": [
+                { "name": "compositingReasons", "$ref": "CompositingReasons", "description": "An object containing the reasons why the layer was composited as properties." }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "layerTreeDidChange"
+        }
+    ]
+}
diff --git a/inspector/protocol/Memory.json b/inspector/protocol/Memory.json
new file mode 100644
index 0000000..7dcfe59
--- /dev/null
+++ b/inspector/protocol/Memory.json
@@ -0,0 +1,70 @@
+{
+    "domain": "Memory",
+    "description": "Memory domain exposes page memory tracking.",
+    "featureGuard": "ENABLE(RESOURCE_USAGE)",
+    "availability": "web",
+    "types": [
+        {
+            "id": "Event",
+            "type": "object",
+            "properties": [
+                { "name": "timestamp", "type": "number" },
+                { "name": "categories", "type": "array", "items": { "$ref": "CategoryData" }, "description": "Breakdown of memory in categories." }
+            ]
+        },
+        {
+            "id": "CategoryData",
+            "type": "object",
+            "properties": [
+                { "name": "type", "type": "string", "enum": ["javascript", "jit", "images", "layers", "page", "other"], "description": "Category type." },
+                { "name": "size", "type": "number", "description": "Category size in bytes." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables Memory domain events."
+        },
+        {
+            "name": "disable",
+            "description": "Disables Memory domain events."
+        },
+        {
+            "name": "startTracking",
+            "description": "Start tracking memory. This will produce a `trackingStart` event."
+        },
+        {
+            "name": "stopTracking",
+            "description": "Stop tracking memory. This will produce a `trackingComplete` event."
+        }
+    ],
+    "events": [
+        {
+            "name": "memoryPressure",
+            "description": "Memory pressure was encountered.",
+            "parameters": [
+                { "name": "timestamp", "type": "number" },
+                { "name": "severity", "type": "string", "enum": ["critical", "non-critical"], "description": "The severity of the memory pressure event." }
+            ]
+        },
+        {
+            "name": "trackingStart",
+            "description": "Tracking started.",
+            "parameters": [
+                { "name": "timestamp", "type": "number" }
+            ]
+        },
+        {
+            "name": "trackingUpdate",
+            "description": "Periodic tracking updates with event data.",
+            "parameters": [
+                { "name": "event", "$ref": "Event" }
+            ]
+        },
+        {
+            "name": "trackingComplete",
+            "description": "Tracking stopped."
+        }
+    ]
+}
diff --git a/inspector/protocol/Network.json b/inspector/protocol/Network.json
new file mode 100644
index 0000000..5b159ab
--- /dev/null
+++ b/inspector/protocol/Network.json
@@ -0,0 +1,315 @@
+{
+    "domain": "Network",
+    "description": "Network domain allows tracking network activities of the page. It exposes information about http, file, data and other requests and responses, their headers, bodies, timing, etc.",
+    "availability": "web",
+    "types": [
+        {
+            "id": "LoaderId",
+            "type": "string",
+            "description": "Unique loader identifier."
+        },
+        {
+            "id": "FrameId",
+            "type": "string",
+            "description": "Unique frame identifier."
+        },
+        {
+            "id": "RequestId",
+            "type": "string",
+            "description": "Unique request identifier."
+        },
+        {
+            "id": "Timestamp",
+            "type": "number",
+            "description": "Number of seconds since epoch."
+        },
+        {
+            "id": "Headers",
+            "type": "object",
+            "description": "Request / response headers as keys / values of JSON object."
+        },
+        {
+            "id": "ResourceTiming",
+            "type": "object",
+            "description": "Timing information for the request.",
+            "properties": [
+                { "name": "startTime", "type": "number", "description": "Timing's startTime is a baseline in seconds, while the other numbers are ticks in milliseconds relatively to this." },
+                { "name": "domainLookupStart", "type": "number", "description": "Started DNS address resolve." },
+                { "name": "domainLookupEnd", "type": "number", "description": "Finished DNS address resolve." },
+                { "name": "connectStart", "type": "number", "description": "Started connecting to the remote host." },
+                { "name": "connectEnd", "type": "number", "description": "Connected to the remote host." },
+                { "name": "secureConnectionStart", "type": "number", "description": "Started SSL handshake." },
+                { "name": "requestStart", "type": "number", "description": "Started sending request." },
+                { "name": "responseStart", "type": "number", "description": "Started receiving response headers." }
+            ]
+        },
+        {
+            "id": "Request",
+            "type": "object",
+            "description": "HTTP request data.",
+            "properties": [
+                { "name": "url", "type": "string", "description": "Request URL." },
+                { "name": "method", "type": "string", "description": "HTTP request method." },
+                { "name": "headers", "$ref": "Headers", "description": "HTTP request headers." },
+                { "name": "postData", "type": "string", "optional": true, "description": "HTTP POST request data." }
+            ]
+        },
+        {
+            "id": "Response",
+            "type": "object",
+            "description": "HTTP response data.",
+            "properties": [
+                { "name": "url", "type": "string", "description": "Response URL. This URL can be different from CachedResource.url in case of redirect." },
+                { "name": "status", "type": "number", "description": "HTTP response status code." },
+                { "name": "statusText", "type": "string", "description": "HTTP response status text." },
+                { "name": "headers", "$ref": "Headers", "description": "HTTP response headers." },
+                { "name": "headersText", "type": "string", "optional": true, "description": "HTTP response headers text." },
+                { "name": "mimeType", "type": "string", "description": "Resource mimeType as determined by the browser." },
+                { "name": "requestHeaders", "$ref": "Headers", "optional": true, "description": "Refined HTTP request headers that were actually transmitted over the network." },
+                { "name": "requestHeadersText", "type": "string", "optional": true, "description": "HTTP request headers text." },
+                { "name": "fromDiskCache", "type": "boolean", "optional": true, "description": "Specifies that the request was served from the disk cache." },
+                { "name": "timing", "$ref": "ResourceTiming", "optional": true, "description": "Timing information for the given request." }
+            ]
+        },
+        {
+            "id": "WebSocketRequest",
+            "type": "object",
+            "description": "WebSocket request data.",
+            "properties": [
+                { "name": "headers", "$ref": "Headers", "description": "HTTP response headers." }
+            ]
+        },
+        {
+            "id": "WebSocketResponse",
+            "type": "object",
+            "description": "WebSocket response data.",
+            "properties": [
+                { "name": "status", "type": "number", "description": "HTTP response status code." },
+                { "name": "statusText", "type": "string", "description": "HTTP response status text." },
+                { "name": "headers", "$ref": "Headers", "description": "HTTP response headers." }
+            ]
+        },
+        {
+            "id": "WebSocketFrame",
+            "type": "object",
+            "description": "WebSocket frame data.",
+            "properties": [
+                { "name": "opcode", "type": "number", "description": "WebSocket frame opcode." },
+                { "name": "mask", "type": "boolean", "description": "WebSocket frame mask." },
+                { "name": "payloadData", "type": "string", "description": "WebSocket frame payload data." }
+            ]
+        },
+        {
+            "id": "CachedResource",
+            "type": "object",
+            "description": "Information about the cached resource.",
+            "properties": [
+                { "name": "url", "type": "string", "description": "Resource URL. This is the url of the original network request." },
+                { "name": "type", "$ref": "Page.ResourceType", "description": "Type of this resource." },
+                { "name": "response", "$ref": "Response", "optional": true, "description": "Cached response data." },
+                { "name": "bodySize", "type": "number", "description": "Cached response body size." },
+                { "name": "sourceMapURL", "type": "string", "optional": true, "description": "URL of source map associated with this resource (if any)." }
+            ]
+        },
+        {
+            "id": "Initiator",
+            "type": "object",
+            "description": "Information about the request initiator.",
+            "properties": [
+                { "name": "type", "type": "string", "enum": ["parser", "script", "other"], "description": "Type of this initiator." },
+                { "name": "stackTrace", "type": "array", "items": { "$ref": "Console.CallFrame" }, "optional": true, "description": "Initiator JavaScript stack trace, set for Script only." },
+                { "name": "url", "type": "string", "optional": true, "description": "Initiator URL, set for Parser type only." },
+                { "name": "lineNumber", "type": "number", "optional": true, "description": "Initiator line number, set for Parser type only." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables network tracking, network events will now be delivered to the client."
+        },
+        {
+            "name": "disable",
+            "description": "Disables network tracking, prevents network events from being sent to the client."
+        },
+        {
+            "name": "setExtraHTTPHeaders",
+            "description": "Specifies whether to always send extra HTTP headers with the requests from this page.",
+            "parameters": [
+                { "name": "headers", "$ref": "Headers", "description": "Map with extra HTTP headers." }
+            ]
+        },
+        {
+            "name": "getResponseBody",
+            "description": "Returns content served for the given request.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Identifier of the network request to get content for." }
+            ],
+            "returns": [
+                { "name": "body", "type": "string", "description": "Response body." },
+                { "name": "base64Encoded", "type": "boolean", "description": "True, if content was sent as base64." }
+            ]
+        },
+        {
+            "name": "setCacheDisabled",
+            "parameters": [
+                { "name": "cacheDisabled", "type": "boolean", "description": "Cache disabled state." }
+            ],
+            "description": "Toggles ignoring cache for each request. If <code>true</code>, cache will not be used."
+        },
+        {
+            "name": "loadResource",
+            "async": true,
+            "parameters": [
+                { "name": "frameId", "$ref": "FrameId", "description": "Frame to load the resource from." },
+                { "name": "url", "type": "string", "description": "URL of the resource to load." }
+            ],
+            "returns": [
+                { "name": "content", "type": "string", "description": "Resource content." },
+                { "name": "mimeType", "type": "string", "description": "Resource mimeType." },
+                { "name": "status", "type": "number", "description": "HTTP response status code." }
+            ],
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        }
+    ],
+    "events": [
+        {
+            "name": "requestWillBeSent",
+            "description": "Fired when page is about to send HTTP request.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "frameId", "$ref": "FrameId", "description": "Frame identifier." },
+                { "name": "loaderId", "$ref": "LoaderId", "description": "Loader identifier." },
+                { "name": "documentURL", "type": "string", "description": "URL of the document this request is loaded for." },
+                { "name": "request", "$ref": "Request", "description": "Request data." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "initiator", "$ref": "Initiator", "description": "Request initiator." },
+                { "name": "redirectResponse", "optional": true, "$ref": "Response", "description": "Redirect response data." },
+                { "name": "type", "$ref": "Page.ResourceType", "optional": true, "description": "Resource type." },
+                { "name": "targetId", "type": "string", "optional": true, "description": "Identifier for the context of where the load originated. In general this is the target identifier. For Workers this will be the workerId." }
+            ]
+        },
+        {
+            "name": "requestServedFromCache",
+            "description": "Fired if request ended up loading from cache.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." }
+            ]
+        },
+        {
+            "name": "responseReceived",
+            "description": "Fired when HTTP response is available.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "frameId", "$ref": "FrameId", "description": "Frame identifier." },
+                { "name": "loaderId", "$ref": "LoaderId", "description": "Loader identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "type", "$ref": "Page.ResourceType", "description": "Resource type." },
+                { "name": "response", "$ref": "Response", "description": "Response data." }
+            ]
+        },
+        {
+            "name": "dataReceived",
+            "description": "Fired when data chunk was received over the network.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "dataLength", "type": "integer", "description": "Data chunk length." },
+                { "name": "encodedDataLength", "type": "integer", "description": "Actual bytes received (might be less than dataLength for compressed encodings)." }
+            ]
+        },
+        {
+            "name": "loadingFinished",
+            "description": "Fired when HTTP request has finished loading.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "sourceMapURL", "type": "string", "optional": true, "description": "URL of source map associated with this resource (if any)." }
+            ]
+        },
+        {
+            "name": "loadingFailed",
+            "description": "Fired when HTTP request has failed to load.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "errorText", "type": "string", "description": "User friendly error message." },
+                { "name": "canceled", "type": "boolean", "optional": true, "description": "True if loading was canceled." }
+            ]
+        },
+        {
+            "name": "requestServedFromMemoryCache",
+            "description": "Fired when HTTP request has been served from memory cache.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "frameId", "$ref": "FrameId", "description": "Frame identifier." },
+                { "name": "loaderId", "$ref": "LoaderId", "description": "Loader identifier." },
+                { "name": "documentURL", "type": "string", "description": "URL of the document this request is loaded for." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "initiator", "$ref": "Initiator", "description": "Request initiator." },
+                { "name": "resource", "$ref": "CachedResource", "description": "Cached resource data." }
+            ]
+        },
+        {
+            "name": "webSocketWillSendHandshakeRequest",
+            "description": "Fired when WebSocket is about to initiate handshake.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "request", "$ref": "WebSocketRequest", "description": "WebSocket request data." }
+            ]
+        },
+        {
+            "name": "webSocketHandshakeResponseReceived",
+            "description": "Fired when WebSocket handshake response becomes available.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "response", "$ref": "WebSocketResponse", "description": "WebSocket response data." }
+            ]
+        },
+        {
+            "name": "webSocketCreated",
+            "description": "Fired upon WebSocket creation.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "url", "type": "string", "description": "WebSocket request URL." }
+            ]
+        },
+        {
+            "name": "webSocketClosed",
+            "description": "Fired when WebSocket is closed.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." }
+            ]
+        },
+        {
+            "name": "webSocketFrameReceived",
+            "description": "Fired when WebSocket frame is received.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "response", "$ref": "WebSocketFrame", "description": "WebSocket response data." }
+            ]
+        },
+        {
+            "name": "webSocketFrameError",
+            "description": "Fired when WebSocket frame error occurs.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "errorMessage", "type": "string", "description": "WebSocket frame error message." }
+            ]
+        },
+        {
+            "name": "webSocketFrameSent",
+            "description": "Fired when WebSocket frame is sent.",
+            "parameters": [
+                { "name": "requestId", "$ref": "RequestId", "description": "Request identifier." },
+                { "name": "timestamp", "$ref": "Timestamp", "description": "Timestamp." },
+                { "name": "response", "$ref": "WebSocketFrame", "description": "WebSocket response data." }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/OverlayTypes.json b/inspector/protocol/OverlayTypes.json
new file mode 100644
index 0000000..3a4b015
--- /dev/null
+++ b/inspector/protocol/OverlayTypes.json
@@ -0,0 +1,130 @@
+{
+    "domain": "OverlayTypes",
+    "description": "Exposes types to be used by the inspector overlay.",
+    "types": [
+        {
+            "id": "Point",
+            "type": "object",
+            "properties": [
+                { "name": "x", "type": "number" },
+                { "name": "y", "type": "number" }
+            ]
+        },
+        {
+            "id": "Size",
+            "type": "object",
+            "properties": [
+                { "name": "width", "type": "integer" },
+                { "name": "height", "type": "integer" }
+            ]
+        },
+        {
+            "id": "Quad",
+            "description": "A quad is a collection of 4 points. When initialized from a rect, the points are in clockwise order from top left.",
+            "type": "array",
+            "items": { "$ref": "Point" }
+        },
+        {
+            "id": "Rect",
+            "description": "A rectangle specified by a reference coordinate and width/height offsets.",
+            "type": "object",
+            "properties": [
+                { "name": "x", "type": "number" },
+                { "name": "y", "type": "number" },
+                { "name": "width", "type": "number" },
+                { "name": "height", "type": "number" }
+            ]
+        },
+        {
+            "id": "Region",
+            "description": "A single region in a flow thread.",
+            "type": "object",
+            "properties": [
+                { "name": "borderQuad", "$ref": "Quad" },
+                { "name": "incomingQuad", "$ref": "Quad" },
+                { "name": "outgoingQuad", "$ref": "Quad" },
+                { "name": "isHighlighted", "type": "boolean", "optional": true }
+            ]
+        },
+        {
+            "id": "DisplayPath",
+            "description": "A vector path described using SVG path syntax.",
+            "type": "array",
+            "items": { "type": "any" }
+        },
+        {
+            "id": "RegionFlowData",
+            "type": "object",
+            "properties": [
+                { "name": "regions", "type": "array", "items": { "$ref": "Region"} },
+                { "name": "name", "type": "string" }
+            ]
+        },
+        {
+            "id": "ContentFlowData",
+            "type": "object",
+            "properties": [
+                { "name": "name", "type": "string" }
+            ]
+        },
+        {
+            "id": "ShapeOutsideData",
+            "type": "object",
+            "properties": [
+                { "name": "bounds", "$ref": "Quad", "description": "Bounds for the shape-outside paths." },
+                { "name": "shape", "$ref": "DisplayPath", "description": "Path for the element's shape.", "optional": true },
+                { "name": "marginShape", "$ref": "DisplayPath", "description": "Path for the element's margin shape.", "optional": true }
+            ]
+        },
+        {
+            "id": "ElementData",
+            "description": "Data that describes an element to be highlighted.",
+            "type": "object",
+            "properties": [
+                { "name": "tagName", "type": "string" },
+                { "name": "idValue", "type": "string", "description": "The value of the element's 'id' attribute." },
+                { "name": "classes", "type": "array", "items": { "type": "string" }, "optional": true },
+                { "name": "size", "$ref": "Size", "optional": true },
+                { "name": "role", "type": "string", "description": "Computed accessibility role for the element.", "optional": true },
+                { "name": "pseudoElement", "type": "string", "optional": true },
+                { "name": "regionFlowData", "$ref": "RegionFlowData", "optional": true },
+                { "name": "contentFlowData", "$ref": "ContentFlowData", "optional": true },
+                { "name": "shapeOutsideData", "$ref": "ShapeOutsideData", "optional": true }
+            ]
+        },
+        {
+            "id": "FragmentHighlightData",
+            "description": "Data required to highlight multiple quads.",
+            "type": "object",
+            "properties": [
+                { "name": "quads", "type": "array", "items": { "$ref": "Quad" }, "description": "Quads for which the highlight should be applied."},
+                { "name": "contentColor", "type": "string" },
+                { "name": "contentOutlineColor", "type": "string" },
+                { "name": "paddingColor", "type": "string" },
+                { "name": "borderColor", "type": "string" },
+                { "name": "marginColor", "type": "string" },
+                { "name": "regionClippingArea", "$ref": "Quad", "optional": true }
+            ]
+        },
+        {
+            "id": "NodeHighlightData",
+            "description": "Data required to highlight a DOM node.",
+            "type": "object",
+            "properties": [
+                { "name": "scrollOffset", "$ref": "Point", "description": "Scroll offset for the MainFrame's FrameView that is shared across all quads." },
+                { "name": "fragments", "type": "array", "items": { "$ref": "FragmentHighlightData" } },
+                { "name": "elementData", "$ref": "ElementData", "optional": true }
+            ]
+        },
+        {
+            "id": "OverlayConfiguration",
+            "description": "Data required to configure the overlay's size and scaling behavior.",
+            "type": "object",
+            "properties": [
+                { "name": "deviceScaleFactor", "type": "number" },
+                { "name": "viewportSize", "$ref": "Size" },
+                { "name": "frameViewFullSize", "$ref": "Size" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/Page.json b/inspector/protocol/Page.json
new file mode 100644
index 0000000..8df0dbb
--- /dev/null
+++ b/inspector/protocol/Page.json
@@ -0,0 +1,305 @@
+{
+    "domain": "Page",
+    "description": "Actions and events related to the inspected page belong to the page domain.",
+    "availability": "web",
+    "types": [
+        {
+            "id": "ResourceType",
+            "type": "string",
+            "enum": ["Document", "Stylesheet", "Image", "Font", "Script", "XHR", "Fetch", "WebSocket", "Other"],
+            "description": "Resource type as it was perceived by the rendering engine."
+        },
+        {
+            "id": "CoordinateSystem",
+            "type": "string",
+            "enum": ["Viewport", "Page"],
+            "description": "Coordinate system used by supplied coordinates."
+        },
+        {
+            "id": "Frame",
+            "type": "object",
+            "description": "Information about the Frame on the page.",
+            "properties": [
+                { "name": "id", "type": "string", "description": "Frame unique identifier." },
+                { "name": "parentId", "type": "string", "optional": true, "description": "Parent frame identifier." },
+                { "name": "loaderId", "$ref": "Network.LoaderId", "description": "Identifier of the loader associated with this frame." },
+                { "name": "name", "type": "string", "optional": true, "description": "Frame's name as specified in the tag." },
+                { "name": "url", "type": "string", "description": "Frame document's URL." },
+                { "name": "securityOrigin", "type": "string", "description": "Frame document's security origin." },
+                { "name": "mimeType", "type": "string", "description": "Frame document's mimeType as determined by the browser." }
+            ]
+        },
+        {
+            "id": "FrameResource",
+            "type": "object",
+            "properties": [
+                { "name": "url", "type": "string", "description": "Resource URL." },
+                { "name": "type", "$ref": "ResourceType", "description": "Type of this resource." },
+                { "name": "mimeType", "type": "string", "description": "Resource mimeType as determined by the browser." },
+                { "name": "failed", "type": "boolean", "optional": true, "description": "True if the resource failed to load." },
+                { "name": "canceled", "type": "boolean", "optional": true, "description": "True if the resource was canceled during loading." },
+                { "name": "sourceMapURL", "type": "string", "optional": true, "description": "URL of source map associated with this resource (if any)." },
+                { "name": "targetId", "type": "string", "optional": true, "description": "Identifier for the context of where the load originated. In general this is the target identifier. For Workers this will be the workerId." }
+            ]
+        },
+        {
+            "id": "FrameResourceTree",
+            "type": "object",
+            "description": "Information about the Frame hierarchy along with their cached resources.",
+            "properties": [
+                { "name": "frame", "$ref": "Frame", "description": "Frame information for this tree item." },
+                { "name": "childFrames", "type": "array", "optional": true, "items": { "$ref": "FrameResourceTree" }, "description": "Child frames." },
+                { "name": "resources", "type": "array", "items": { "$ref": "FrameResource" }, "description": "Information about frame resources." }
+            ]
+        },
+        {
+            "id": "SearchResult",
+            "type": "object",
+            "description": "Search result for resource.",
+            "properties": [
+                { "name": "url", "type": "string", "description": "Resource URL." },
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Resource frame id." },
+                { "name": "matchesCount", "type": "number", "description": "Number of matches in the resource content." },
+                { "name": "requestId", "$ref": "Network.RequestId", "optional": true, "description": "Network request id." }
+            ]
+        },
+        {
+            "id": "Cookie",
+            "type": "object",
+            "description": "Cookie object",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Cookie name." },
+                { "name": "value", "type": "string", "description": "Cookie value." },
+                { "name": "domain", "type": "string", "description": "Cookie domain." },
+                { "name": "path", "type": "string", "description": "Cookie path." },
+                { "name": "expires", "type": "number", "description": "Cookie expires." },
+                { "name": "size", "type": "integer", "description": "Cookie size." },
+                { "name": "httpOnly", "type": "boolean", "description": "True if cookie is http-only." },
+                { "name": "secure", "type": "boolean", "description": "True if cookie is secure." },
+                { "name": "session", "type": "boolean", "description": "True in case of session cookie." }
+            ]
+        },
+        {
+            "id": "ScriptIdentifier",
+            "type": "string",
+            "description": "Unique script identifier."
+        }
+    ],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enables page domain notifications."
+        },
+        {
+            "name": "disable",
+            "description": "Disables page domain notifications."
+        },
+        {
+            "name": "addScriptToEvaluateOnLoad",
+            "parameters": [
+                { "name": "scriptSource", "type": "string" }
+            ],
+            "returns": [
+                { "name": "identifier", "$ref": "ScriptIdentifier", "description": "Identifier of the added script." }
+            ]
+        },
+        {
+            "name": "removeScriptToEvaluateOnLoad",
+            "parameters": [
+                { "name": "identifier", "$ref": "ScriptIdentifier" }
+            ]
+        },
+        {
+            "name": "reload",
+            "parameters": [
+                { "name": "ignoreCache", "type": "boolean", "optional": true, "description": "If true, browser cache is ignored (as if the user pressed Shift+refresh)." },
+                { "name": "scriptToEvaluateOnLoad", "type": "string", "optional": true, "description": "If set, the script will be injected into all frames of the inspected page after reload." }
+            ],
+            "description": "Reloads given page optionally ignoring the cache."
+        },
+        {
+            "name": "navigate",
+            "parameters": [
+                { "name": "url", "type": "string", "description": "URL to navigate the page to." }
+            ],
+            "description": "Navigates current page to the given URL."
+        },
+        {
+            "name": "getCookies",
+            "returns": [
+                { "name": "cookies", "type": "array", "items": { "$ref": "Cookie"}, "description": "Array of cookie objects." }
+            ],
+            "description": "Returns all browser cookies. Depending on the backend support, will return detailed cookie information in the <code>cookies</code> field."
+        },
+        {
+            "name": "deleteCookie",
+            "parameters": [
+                { "name": "cookieName", "type": "string", "description": "Name of the cookie to remove." },
+                { "name": "url", "type": "string", "description": "URL to match cooke domain and path." }
+            ],
+            "description": "Deletes browser cookie with given name, domain and path."
+        },
+        {
+            "name": "getResourceTree",
+            "description": "Returns present frame / resource tree structure.",
+            "returns": [
+                { "name": "frameTree", "$ref": "FrameResourceTree", "description": "Present frame / resource tree structure." }
+            ]
+        },
+        {
+            "name": "getResourceContent",
+            "description": "Returns content of the given resource.",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Frame id to get resource for." },
+                { "name": "url", "type": "string", "description": "URL of the resource to get content for." }
+            ],
+            "returns": [
+                { "name": "content", "type": "string", "description": "Resource content." },
+                { "name": "base64Encoded", "type": "boolean", "description": "True, if content was served as base64." }
+            ]
+        },
+        {
+            "name": "searchInResource",
+            "description": "Searches for given string in resource content.",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Frame id for resource to search in." },
+                { "name": "url", "type": "string", "description": "URL of the resource to search in." },
+                { "name": "query", "type": "string", "description": "String to search for." },
+                { "name": "caseSensitive", "type": "boolean", "optional": true, "description": "If true, search is case sensitive." },
+                { "name": "isRegex", "type": "boolean", "optional": true, "description": "If true, treats string parameter as regex." },
+                { "name": "requestId", "$ref": "Network.RequestId", "optional": true, "description": "Request id for resource to search in." }
+            ],
+            "returns": [
+                { "name": "result", "type": "array", "items": { "$ref": "GenericTypes.SearchMatch" }, "description": "List of search matches." }
+            ]
+        },
+        {
+            "name": "searchInResources",
+            "description": "Searches for given string in frame / resource tree structure.",
+            "parameters": [
+                { "name": "text", "type": "string", "description": "String to search for." },
+                { "name": "caseSensitive", "type": "boolean", "optional": true, "description": "If true, search is case sensitive." },
+                { "name": "isRegex", "type": "boolean", "optional": true, "description": "If true, treats string parameter as regex." }
+            ],
+            "returns": [
+                { "name": "result", "type": "array", "items": { "$ref": "SearchResult" }, "description": "List of search results." }
+            ]
+        },
+        {
+            "name": "setShowPaintRects",
+            "description": "Requests that backend shows paint rectangles",
+            "parameters": [
+                { "name": "result", "type": "boolean", "description": "True for showing paint rectangles" }
+            ]
+        },
+        {
+            "name": "setEmulatedMedia",
+            "description": "Emulates the given media for CSS media queries.",
+            "parameters": [
+                { "name": "media", "type": "string", "description": "Media type to emulate. Empty string disables the override." }
+            ]
+        },
+        {
+            "name": "getCompositingBordersVisible",
+            "description": "Indicates the visibility of compositing borders.",
+            "returns": [
+                { "name": "result", "type": "boolean", "description": "If true, compositing borders are visible." }
+            ]
+        },
+        {
+            "name": "setCompositingBordersVisible",
+            "description": "Controls the visibility of compositing borders.",
+            "parameters": [
+                { "name": "visible", "type": "boolean", "description": "True for showing compositing borders." }
+            ]
+        },
+        {
+            "name": "snapshotNode",
+            "description": "Capture a snapshot of the specified node that does not include unrelated layers.",
+            "parameters": [
+                { "name": "nodeId", "$ref": "DOM.NodeId", "description": "Id of the node to snapshot." }
+            ],
+            "returns": [
+                { "name": "dataURL", "type": "string", "description": "Base64-encoded image data (PNG)." }
+            ]
+        },
+        {
+            "name": "snapshotRect",
+            "description": "Capture a snapshot of the page within the specified rectangle and coordinate system.",
+            "parameters": [
+                { "name": "x", "type": "integer", "description": "X coordinate" },
+                { "name": "y", "type": "integer", "description": "Y coordinate" },
+                { "name": "width", "type": "integer", "description": "Rectangle width" },
+                { "name": "height", "type": "integer", "description": "Rectangle height" },
+                { "name": "coordinateSystem", "$ref": "CoordinateSystem", "description": "Indicates the coordinate system of the supplied rectangle." }
+            ],
+            "returns": [
+                { "name": "dataURL", "type": "string", "description": "Base64-encoded image data (PNG)." }
+            ]
+        },
+        {
+            "name": "archive",
+            "description": "Grab an archive of the page.",
+            "returns": [
+                { "name": "data", "type": "string", "description": "Base64-encoded web archive." }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "domContentEventFired",
+            "parameters": [
+                { "name": "timestamp", "type": "number" }
+            ]
+        },
+        {
+            "name": "loadEventFired",
+            "parameters": [
+                { "name": "timestamp", "type": "number" }
+            ]
+        },
+        {
+            "name": "frameNavigated",
+            "description": "Fired once navigation of the frame has completed. Frame is now associated with the new loader.",
+            "parameters": [
+                { "name": "frame", "$ref": "Frame", "description": "Frame object." }
+            ]
+        },
+        {
+            "name": "frameDetached",
+            "description": "Fired when frame has been detached from its parent.",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Id of the frame that has been detached." }
+            ]
+        },
+        {
+            "name": "frameStartedLoading",
+            "description": "Fired when frame has started loading.",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Id of the frame that has started loading." }
+            ]
+        },
+        {
+            "name": "frameStoppedLoading",
+            "description": "Fired when frame has stopped loading.",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Id of the frame that has stopped loading." }
+            ]
+        },
+        {
+            "name": "frameScheduledNavigation",
+            "description": "Fired when frame schedules a potential navigation.",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Id of the frame that has scheduled a navigation." },
+                { "name": "delay", "type": "number", "description": "Delay (in seconds) until the navigation is scheduled to begin. The navigation is not guaranteed to start." }
+            ]
+        },
+        {
+            "name": "frameClearedScheduledNavigation",
+            "description": "Fired when frame no longer has a scheduled navigation.",
+            "parameters": [
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Id of the frame that has cleared its scheduled navigation." }
+            ]
+        }
+    ]
+}
diff --git a/inspector/protocol/Replay.json b/inspector/protocol/Replay.json
new file mode 100644
index 0000000..7bc26bd
--- /dev/null
+++ b/inspector/protocol/Replay.json
@@ -0,0 +1,264 @@
+{
+    "domain": "Replay",
+    "description": "Controls web replay, and manages recording sessions and segments.",
+    "featureGuard": "ENABLE(WEB_REPLAY)",
+    "availability": "web",
+    "types": [
+        {
+            "id": "SessionIdentifier", "description": "Unique replay session identifier.",
+            "type": "integer"
+        },
+        {
+            "id": "SegmentIdentifier", "description": "Unique session segment identifier.",
+            "type": "integer"
+        },
+        {
+            "id": "SessionState", "description": "State machine's state for the session.",
+            "type": "string",
+            "enum": ["Capturing", "Inactive", "Replaying"]
+        },
+        {
+            "id": "SegmentState", "description": "State machine's state for the session segment.",
+            "type": "string",
+            "enum": ["Appending", "Unloaded", "Loaded", "Dispatching"]
+        },
+        {
+            "id": "ReplayPosition",
+            "type": "object",
+            "properties": [
+               { "name": "segmentOffset", "type": "integer", "description": "Offset for a segment within the currently-loaded replay session." },
+               { "name": "inputOffset", "type": "integer", "description": "Offset for an event loop input within the specified session segment." }
+            ]
+        },
+        {
+            "id": "ReplayInput",
+            "type": "object",
+            "properties": [
+                { "name": "type", "type": "string", "description": "Input type." },
+                { "name": "offset", "type": "integer", "description": "Offset of this input in its respective queue."},
+                { "name": "data", "type": "object", "description": "Per-input payload." }
+            ]
+        },
+        {
+            "id": "ReplayInputQueue",
+            "type": "object",
+            "properties": [
+                { "name": "type", "type": "string", "description": "Queue type" },
+                { "name": "inputs", "type": "array", "items": { "$ref": "ReplayInput"}, "description": "Inputs belonging to this queue." }
+            ]
+        },
+        {
+            "id": "SessionSegment", "description": "A standalone segment of a replay session that corresponds to a single main frame navigation and execution.",
+            "type": "object",
+            "properties": [
+                { "name": "id", "$ref": "SegmentIdentifier", "description": "Unique session segment identifier." },
+                { "name": "timestamp", "type": "number", "description": "Start time of the segment, in milliseconds since the epoch." },
+                { "name": "queues", "type": "array", "items": { "$ref": "ReplayInputQueue"} }
+            ]
+        },
+        {
+            "id": "ReplaySession", "description": "An ordered collection of replay session segments.",
+            "type": "object",
+            "properties": [
+                { "name": "id", "$ref": "SessionIdentifier", "description": "Unique replay session identifier." },
+                { "name": "timestamp", "type": "number", "description": "Creation time of session, in milliseconds since the epoch." },
+                { "name": "segments", "type": "array", "items": { "$ref": "SegmentIdentifier" }, "description": "An ordered list identifiers for the segments that comprise this replay session." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "startCapturing",
+            "description": "Starts capture of a new replay session."
+        },
+        {
+            "name": "stopCapturing",
+            "description": "Stops capture of the currently recording replay session."
+        },
+        {
+            "name": "replayToPosition",
+            "description": "Seek execution to a specific position within the replay session.",
+            "parameters": [
+                { "name": "position", "$ref": "ReplayPosition" },
+                { "name": "shouldFastForward", "type": "boolean" }
+            ]
+        },
+        {
+            "name": "replayToCompletion",
+            "description": "Replay all session segments completely.",
+            "parameters": [
+                { "name": "shouldFastForward", "type": "boolean" }
+            ]
+        },
+        {
+            "name": "pausePlayback",
+            "description": "Pauses playback in the current segment. Can be resumed by using a replay command."
+        },
+        {
+            "name": "cancelPlayback",
+            "description": "Cancels playback of the current segment. Further replaying will start from the beginning of the current segment."
+        },
+        {
+            "name": "switchSession",
+            "description": "Unloads the current replay session and loads the specified session",
+            "parameters": [
+                { "name": "sessionIdentifier", "$ref": "SessionIdentifier" }
+            ]
+        },
+        {
+            "name": "insertSessionSegment",
+            "description": "Splices the specified session segment into the session at the specified index.",
+            "parameters": [
+                { "name": "sessionIdentifier", "$ref": "SessionIdentifier" },
+                { "name": "segmentIdentifier", "$ref": "SegmentIdentifier" },
+                { "name": "segmentIndex", "type": "integer" }
+            ]
+        },
+        {
+            "name": "removeSessionSegment",
+            "description": "Removes the session segment at the specified position from the session.",
+            "parameters": [
+                { "name": "sessionIdentifier", "$ref": "SessionIdentifier" },
+                { "name": "segmentIndex", "type": "integer" }
+            ]
+        },
+        {
+            "name": "currentReplayState",
+            "description": "Returns the identifier, position, session state and segment state of the currently loaded session. This is necessary because the inspector may be closed and reopened in the middle of replay.",
+            "returns": [
+                { "name": "sessionIdentifier", "$ref": "SessionIdentifier" },
+                { "name": "segmentIdentifier", "$ref": "SegmentIdentifier", "optional": true, "description": "If no segment is currently loaded, then there is no valid segment identifier." },
+                { "name": "sessionState", "$ref": "SessionState" },
+                { "name": "segmentState", "$ref": "SegmentState" },
+                { "name": "replayPosition", "$ref": "ReplayPosition" }
+            ]
+        },
+        {
+            "name": "getAvailableSessions",
+            "description": "Returns identifiers of all available sessions.",
+            "returns": [
+                { "name": "ids", "type": "array", "items": { "$ref": "SessionIdentifier" } }
+            ]
+        },
+        {
+            "name": "getSessionData",
+            "description": "Returns an object for the specified session.",
+            "parameters": [
+                { "name": "sessionIdentifier", "$ref": "SessionIdentifier" }
+            ],
+            "returns": [
+                { "name": "session", "$ref": "ReplaySession", "optional": true, "description": "The requested serialized replay session." }
+            ]
+        },
+        {
+            "name": "getSegmentData",
+            "description": "Returns an object for the specified session segment.",
+            "parameters": [
+                { "name": "id", "$ref": "SegmentIdentifier" }
+            ],
+            "returns": [
+                { "name": "segment", "$ref": "SessionSegment",  "optional": true, "description": "The requested serialized session segment." }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "captureStarted",
+            "description": "Fired when capture has started."
+        },
+        {
+            "name": "captureStopped",
+            "description": "Fired when capture has stopped."
+        },
+        {
+            "name": "playbackHitPosition",
+            "description": "Playback within the session has progressed up to this position, and is about to replay the input at the specified offset.",
+            "parameters": [
+                { "name": "position", "$ref": "ReplayPosition", "description": "The playback position that was hit." },
+                { "name": "timestamp", "type": "number", "description": "A timestamp for the event." }
+            ]
+        },
+        {
+            "name": "playbackStarted",
+            "description": "Fired when session playback has started."
+        },
+        {
+            "name": "playbackPaused",
+            "description": "Fired when session playback has paused, but not finished.",
+            "parameters": [
+                { "name": "position", "$ref": "ReplayPosition", "description": "The playback position immediately prior to where playback is paused." }
+            ]
+        },
+        {
+            "name": "playbackFinished",
+            "description": "Fired when session playback has stopped."
+        },
+        {
+            "name": "inputSuppressionChanged",
+            "description": "Fired when the replay controller starts or stops suppressing user inputs.",
+            "parameters": [
+                { "name": "willSuppress", "type": "boolean", "description": "Whether user inputs will be suppressed during playback." }
+            ]
+        },
+        {
+            "name": "sessionCreated",
+            "description": "Fired when a new replay session is created",
+            "parameters": [
+                { "name": "id", "$ref": "SessionIdentifier", "description": "Identifier for the created session." }
+            ]
+        },
+        {
+            "name": "sessionModified",
+            "description": "Fired when a session's segments have changed.",
+            "parameters": [
+                { "name": "id", "$ref": "SessionIdentifier", "description": "Identifier for the session the segment was added to." }
+            ]
+        },
+        {
+            "name": "sessionRemoved",
+            "description": "Fired when a replay session is removed and can no longer be loaded.",
+            "parameters": [
+                { "name": "id", "$ref": "SessionIdentifier", "description": "Identifier for the removed session." }
+            ]
+        },
+        {
+            "name": "sessionLoaded",
+            "description": "Fired when a replay session is loaded.",
+            "parameters": [
+                { "name": "id", "$ref": "SessionIdentifier", "description": "Identifier for the loaded session." }
+            ]
+        },
+        {
+            "name": "segmentCreated",
+            "description": "Fired when a new session segment is created.",
+            "parameters": [
+                { "name": "id", "$ref": "SegmentIdentifier", "description": "Identifier for the created session segment." }
+            ]
+        },
+        {
+            "name": "segmentRemoved",
+            "description": "Fired when a session segment is removed and can no longer be replayed as part of a session.",
+            "parameters": [
+                { "name": "id", "$ref": "SegmentIdentifier", "description": "Identifier for the removed session segment." }
+            ]
+        },
+        {
+            "name": "segmentCompleted",
+            "description": "Fired when a session segment is completed and can no longer have inputs added to it.",
+            "parameters": [
+                { "name": "id", "$ref": "SegmentIdentifier", "description": "Identifier for the completed session segment." }
+            ]
+        },
+        {
+            "name": "segmentLoaded",
+            "description": "Fired when a segment is loaded.",
+            "parameters": [
+                { "name": "segmentIdentifier", "$ref": "SegmentIdentifier", "description": "Id for the loaded segment." }
+            ]
+        },
+        {
+            "name": "segmentUnloaded",
+            "description": "Fired when a segment is unloaded."
+        }
+    ]
+}
diff --git a/inspector/protocol/Runtime.json b/inspector/protocol/Runtime.json
new file mode 100644
index 0000000..8fcfa9e
--- /dev/null
+++ b/inspector/protocol/Runtime.json
@@ -0,0 +1,361 @@
+{
+    "domain": "Runtime",
+    "description": "Runtime domain exposes JavaScript runtime by means of remote evaluation and mirror objects. Evaluation results are returned as mirror object that expose object type, string representation and unique identifier that can be used for further object reference. Original objects are maintained in memory unless they are either explicitly released or are released along with the other objects in their object group.",
+    "types": [
+        {
+            "id": "RemoteObjectId",
+            "type": "string",
+            "description": "Unique object identifier."
+        },
+        {
+            "id": "RemoteObject",
+            "type": "object",
+            "description": "Mirror object referencing original JavaScript object.",
+            "properties": [
+                { "name": "type", "type": "string", "enum": ["object", "function", "undefined", "string", "number", "boolean", "symbol"], "description": "Object type." },
+                { "name": "subtype", "type": "string", "optional": true, "enum": ["array", "null", "node", "regexp", "date", "error", "map", "set", "weakmap", "weakset", "iterator", "class", "proxy"], "description": "Object subtype hint. Specified for <code>object</code> <code>function</code> (for class) type values only." },
+                { "name": "className", "type": "string", "optional": true, "description": "Object class (constructor) name. Specified for <code>object</code> type values only." },
+                { "name": "value", "type": "any", "optional": true, "description": "Remote object value (in case of primitive values or JSON values if it was requested)." },
+                { "name": "description", "type": "string", "optional": true, "description": "String representation of the object." },
+                { "name": "objectId", "$ref": "RemoteObjectId", "optional": true, "description": "Unique object identifier (for non-primitive values)." },
+                { "name": "size", "type": "integer", "optional": true, "description": "Size of the array/collection. Specified for array/map/set/weakmap/weakset object type values only." },
+                { "name": "classPrototype", "$ref": "RemoteObject", "optional": true, "description": "Remote object for the class prototype. Specified for class object type values only." },
+                { "name": "preview", "$ref": "ObjectPreview", "optional": true, "description": "Preview containing abbreviated property values. Specified for <code>object</code> type values only." }
+            ]
+        },
+        {
+            "id": "ObjectPreview",
+            "type": "object",
+            "description": "Object containing abbreviated remote object value.",
+            "properties": [
+                { "name": "type", "type": "string", "enum": ["object", "function", "undefined", "string", "number", "boolean", "symbol"], "description": "Object type." },
+                { "name": "subtype", "type": "string", "optional": true, "enum": ["array", "null", "node", "regexp", "date", "error", "map", "set", "weakmap", "weakset", "iterator", "class", "proxy"], "description": "Object subtype hint. Specified for <code>object</code> type values only." },
+                { "name": "description", "type": "string", "optional": true, "description": "String representation of the object." },
+                { "name": "lossless", "type": "boolean", "description": "Determines whether preview is lossless (contains all information of the original object)." },
+                { "name": "overflow", "type": "boolean", "optional": true, "description": "True iff some of the properties of the original did not fit." },
+                { "name": "properties", "type": "array", "items": { "$ref": "PropertyPreview" }, "optional": true, "description": "List of the properties." },
+                { "name": "entries", "type": "array", "items": { "$ref": "EntryPreview" }, "optional": true, "description": "List of the entries. Specified for <code>map</code> and <code>set</code> subtype values only." },
+                { "name": "size", "type": "integer", "optional": true, "description": "Size of the array/collection. Specified for array/map/set/weakmap/weakset object type values only." }
+            ]
+        },
+        {
+            "id": "PropertyPreview",
+            "type": "object",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Property name." },
+                { "name": "type", "type": "string", "enum": ["object", "function", "undefined", "string", "number", "boolean", "symbol", "accessor"], "description": "Object type." },
+                { "name": "subtype", "type": "string", "optional": true, "enum": ["array", "null", "node", "regexp", "date", "error", "map", "set", "weakmap", "weakset", "iterator", "class", "proxy"], "description": "Object subtype hint. Specified for <code>object</code> type values only." },
+                { "name": "value", "type": "string", "optional": true, "description": "User-friendly property value string." },
+                { "name": "valuePreview", "$ref": "ObjectPreview", "optional": true, "description": "Nested value preview." },
+                { "name": "internal", "type": "boolean", "optional": true, "description": "True if this is an internal property." }
+            ]
+        },
+        {
+            "id": "EntryPreview",
+            "type": "object",
+            "properties": [
+                { "name": "key", "$ref": "ObjectPreview", "optional": true, "description": "Entry key. Specified for map-like collection entries." },
+                { "name": "value", "$ref": "ObjectPreview", "description": "Entry value." }
+            ]
+        },
+        {
+            "id": "CollectionEntry",
+            "type": "object",
+            "properties": [
+                { "name": "key", "$ref": "Runtime.RemoteObject", "optional": true, "description": "Entry key of a map-like collection, otherwise not provided." },
+                { "name": "value", "$ref": "Runtime.RemoteObject", "description": "Entry value." }
+            ]
+        },
+        {
+            "id": "PropertyDescriptor",
+            "type": "object",
+            "description": "Object property descriptor.",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Property name or symbol description." },
+                { "name": "value", "$ref": "RemoteObject", "optional": true, "description": "The value associated with the property." },
+                { "name": "writable", "type": "boolean", "optional": true, "description": "True if the value associated with the property may be changed (data descriptors only)." },
+                { "name": "get", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a getter for the property, or <code>undefined</code> if there is no getter (accessor descriptors only)." },
+                { "name": "set", "$ref": "RemoteObject", "optional": true, "description": "A function which serves as a setter for the property, or <code>undefined</code> if there is no setter (accessor descriptors only)." },
+                { "name": "configurable", "type": "boolean", "description": "True if the type of this property descriptor may be changed and if the property may be deleted from the corresponding object." },
+                { "name": "enumerable", "type": "boolean", "description": "True if this property shows up during enumeration of the properties on the corresponding object." },
+                { "name": "wasThrown", "type": "boolean", "optional": true, "description": "True if the result was thrown during the evaluation." },
+                { "name": "isOwn", "optional": true, "type": "boolean", "description": "True if the property is owned for the object." },
+                { "name": "symbol", "optional": true, "$ref": "Runtime.RemoteObject", "description": "Property symbol object, if the property is a symbol." },
+                { "name": "nativeGetter", "optional": true, "type": "boolean", "description": "True if the property value came from a native getter." }
+            ]
+        },
+        {
+            "id": "InternalPropertyDescriptor",
+            "type": "object",
+            "description": "Object internal property descriptor. This property isn't normally visible in JavaScript code.",
+            "properties": [
+                { "name": "name", "type": "string", "description": "Conventional property name." },
+                { "name": "value", "$ref": "RemoteObject", "optional": true, "description": "The value associated with the property." }
+            ]
+        },
+        {
+            "id": "CallArgument",
+            "type": "object",
+            "description": "Represents function call argument. Either remote object id <code>objectId</code> or primitive <code>value</code> or neither of (for undefined) them should be specified.",
+            "properties": [
+                { "name": "value", "type": "any", "optional": true, "description": "Primitive value." },
+                { "name": "objectId", "$ref": "RemoteObjectId", "optional": true, "description": "Remote object handle." }
+            ]
+        },
+        {
+            "id": "ExecutionContextId",
+            "type": "integer",
+            "description": "Id of an execution context."
+        },
+        {
+            "id": "ExecutionContextDescription",
+            "type": "object",
+            "description": "Description of an isolated world.",
+            "properties": [
+                { "name": "id", "$ref": "ExecutionContextId", "description": "Unique id of the execution context. It can be used to specify in which execution context script evaluation should be performed." },
+                { "name": "isPageContext", "type": "boolean", "description": "True if this is a context where inpspected web page scripts run. False if it is a content script isolated context." },
+                { "name": "name", "type": "string", "description": "Human readable name describing given context."},
+                { "name": "frameId", "$ref": "Network.FrameId", "description": "Id of the owning frame." }
+            ]
+        },
+        {
+            "id": "SyntaxErrorType",
+            "type": "string",
+            "enum": ["none", "irrecoverable", "unterminated-literal", "recoverable"],
+            "description": "Syntax error type: \"none\" for no error, \"irrecoverable\" for unrecoverable errors, \"unterminated-literal\" for when there is an unterminated literal, \"recoverable\" for when the expression is unfinished but valid so far."
+        },
+        {
+            "id": "ErrorRange",
+            "type": "object",
+            "description": "Range of an error in source code.",
+            "properties": [
+                { "name": "startOffset", "type": "integer", "description": "Start offset of range (inclusive)." },
+                { "name": "endOffset", "type": "integer", "description": "End offset of range (exclusive)." }
+            ]
+        },
+        {
+            "id": "StructureDescription",
+            "type": "object",
+            "properties": [
+                { "name": "fields", "type": "array",  "items": { "type": "string" }, "optional": true, "description": "Array of strings, where the strings represent object properties." },
+                { "name": "optionalFields", "type": "array",  "items": { "type": "string" }, "optional": true, "description": "Array of strings, where the strings represent optional object properties." },
+                { "name": "constructorName", "type": "string", "optional": true, "description": "Name of the constructor." },
+                { "name": "prototypeStructure", "$ref": "StructureDescription", "optional": true, "description": "Pointer to the StructureRepresentation of the protoype if one exists." },
+                { "name": "isImprecise", "type": "boolean", "optional": true, "description": "If true, it indicates that the fields in this StructureDescription may be inaccurate. I.e, there might have been fields that have been deleted before it was profiled or it has fields we haven't profiled." }
+            ]
+        },
+        {
+            "id": "TypeSet",
+            "type": "object",
+            "properties": [
+                { "name": "isFunction", "type": "boolean", "description": "Indicates if this type description has been type Function." },
+                { "name": "isUndefined", "type": "boolean", "description": "Indicates if this type description has been type Undefined." },
+                { "name": "isNull", "type": "boolean", "description": "Indicates if this type description has been type Null." },
+                { "name": "isBoolean", "type": "boolean", "description": "Indicates if this type description has been type Boolean." },
+                { "name": "isInteger", "type": "boolean", "description": "Indicates if this type description has been type Integer." },
+                { "name": "isNumber", "type": "boolean", "description": "Indicates if this type description has been type Number." },
+                { "name": "isString", "type": "boolean", "description": "Indicates if this type description has been type String." },
+                { "name": "isObject", "type": "boolean", "description": "Indicates if this type description has been type Object." },
+                { "name": "isSymbol", "type": "boolean", "description": "Indicates if this type description has been type Symbol." }
+            ]
+        },
+        {
+            "id": "TypeDescription",
+            "type": "object",
+            "description": "Container for type information that has been gathered.",
+            "properties": [
+                { "name": "isValid", "type": "boolean", "description": "If true, we were able to correlate the offset successfuly with a program location. If false, the offset may be bogus or the offset may be from a CodeBlock that hasn't executed." },
+                { "name": "leastCommonAncestor", "type": "string", "optional": true, "description": "Least common ancestor of all Constructors if the TypeDescription has seen any structures. This string is the display name of the shared constructor function." },
+                { "name": "typeSet", "$ref": "TypeSet", "optional": true, "description": "Set of booleans for determining the aggregate type of this type description." },
+                { "name": "structures", "type": "array", "items": { "$ref": "StructureDescription" }, "optional": true, "description": "Array of descriptions for all structures seen for this variable." },
+                { "name": "isTruncated", "type": "boolean", "optional": true, "description": "If true, this indicates that no more structures are being profiled because some maximum threshold has been reached and profiling has stopped because of memory pressure." }
+            ]
+        },
+        {
+            "id": "TypeLocation",
+            "type": "object",
+            "description": "Describes the location of an expression we want type information for.",
+            "properties": [
+                { "name": "typeInformationDescriptor", "type": "integer", "description": "What kind of type information do we want (normal, function return values, 'this' statement)." },
+                { "name": "sourceID", "type": "string", "description": "sourceID uniquely identifying a script" },
+                { "name": "divot", "type": "integer", "description": "character offset for assignment range" }
+            ]
+        },
+        {
+            "id": "BasicBlock",
+            "type": "object",
+            "description": "From Wikipedia: a basic block is a portion of the code within a program with only one entry point and only one exit point. This type gives the location of a basic block and if that basic block has executed.",
+            "properties": [
+                { "name": "startOffset", "type": "integer", "description": "Start offset of the basic block." },
+                { "name": "endOffset", "type": "integer", "description": "End offset of the basic block." },
+                { "name": "hasExecuted", "type": "boolean", "description": "Indicates if the basic block has executed before." },
+                { "name": "executionCount", "type": "integer", "description": "Indicates how many times the basic block has executed." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "parse",
+            "parameters": [
+                { "name": "source", "type": "string", "description": "Source code to parse." }
+            ],
+            "returns": [
+                { "name": "result", "$ref": "SyntaxErrorType", "description": "Parse result." },
+                { "name": "message", "type": "string", "optional": true, "description": "Parse error message." },
+                { "name": "range", "$ref": "ErrorRange", "optional": true, "description": "Range in the source where the error occurred." }
+            ],
+            "description": "Parses JavaScript source code for errors."
+        },
+        {
+            "name": "evaluate",
+            "parameters": [
+                { "name": "expression", "type": "string", "description": "Expression to evaluate." },
+                { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." },
+                { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Determines whether Command Line API should be available during the evaluation." },
+                { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether evaluation should stop on exceptions and mute console. Overrides setPauseOnException state." },
+                { "name": "contextId", "$ref": "Runtime.ExecutionContextId", "optional": true, "description": "Specifies in which isolated context to perform evaluation. Each content script lives in an isolated context and this parameter may be used to specify one of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page." },
+                { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." },
+                { "name": "generatePreview", "type": "boolean", "optional": true, "description": "Whether preview should be generated for the result." },
+                { "name": "saveResult", "type": "boolean", "optional": true, "description": "Whether the resulting value should be considered for saving in the $n history." }
+            ],
+            "returns": [
+                { "name": "result", "$ref": "RemoteObject", "description": "Evaluation result." },
+                { "name": "wasThrown", "type": "boolean", "optional": true, "description": "True if the result was thrown during the evaluation." },
+                { "name": "savedResultIndex", "type": "integer", "optional": true, "description": "If the result was saved, this is the $n index that can be used to access the value." }
+            ],
+            "description": "Evaluates expression on global object."
+        },
+        {
+            "name": "callFunctionOn",
+            "parameters": [
+                { "name": "objectId", "$ref": "RemoteObjectId", "description": "Identifier of the object to call function on." },
+                { "name": "functionDeclaration", "type": "string", "description": "Declaration of the function to call." },
+                { "name": "arguments", "type": "array", "items": { "$ref": "CallArgument", "description": "Call argument." }, "optional": true, "description": "Call arguments. All call arguments must belong to the same JavaScript world as the target object." },
+                { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether function call should stop on exceptions and mute console. Overrides setPauseOnException state." },
+                { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object which should be sent by value." },
+                { "name": "generatePreview", "type": "boolean", "optional": true, "description": "Whether preview should be generated for the result." }
+            ],
+            "returns": [
+                { "name": "result", "$ref": "RemoteObject", "description": "Call result." },
+                { "name": "wasThrown", "type": "boolean", "optional": true, "description": "True if the result was thrown during the evaluation." }
+            ],
+            "description": "Calls function with given declaration on the given object. Object group of the result is inherited from the target object."
+        },
+        {
+            "name": "getProperties",
+            "parameters": [
+                { "name": "objectId", "$ref": "RemoteObjectId", "description": "Identifier of the object to return properties for." },
+                { "name": "ownProperties", "optional": true, "type": "boolean", "description": "If true, returns properties belonging only to the object itself, not to its prototype chain." },
+                { "name": "generatePreview", "type": "boolean", "optional": true, "description": "Whether preview should be generated for property values." }
+            ],
+            "returns": [
+                { "name": "result", "type": "array", "items": { "$ref": "PropertyDescriptor"}, "description": "Object properties." },
+                { "name": "internalProperties", "optional": true, "type": "array", "items": { "$ref": "InternalPropertyDescriptor"}, "description": "Internal object properties." }
+            ],
+            "description": "Returns properties of a given object. Object group of the result is inherited from the target object."
+        },
+        {
+            "name": "getDisplayableProperties",
+            "parameters": [
+                { "name": "objectId", "$ref": "RemoteObjectId", "description": "Identifier of the object to return properties for." },
+                { "name": "generatePreview", "type": "boolean", "optional": true, "description": "Whether preview should be generated for property values." }
+            ],
+            "returns": [
+                { "name": "properties", "type": "array", "items": { "$ref": "PropertyDescriptor"}, "description": "Object properties." },
+                { "name": "internalProperties", "optional": true, "type": "array", "items": { "$ref": "InternalPropertyDescriptor"}, "description": "Internal object properties." }
+            ],
+            "description": "Returns displayable properties of a given object. Object group of the result is inherited from the target object. Displayable properties are own properties, internal properties, and native getters in the prototype chain (assumed to be bindings and treated like own properties for the frontend)."
+        },
+        {
+            "name": "getCollectionEntries",
+            "description": "Returns entries of given Map / Set collection.",
+            "parameters": [
+                { "name": "objectId", "$ref": "Runtime.RemoteObjectId", "description": "Id of the collection to get entries for." },
+                { "name": "objectGroup", "optional": true, "type": "string", "description": "Symbolic group name that can be used to release multiple. If not provided, it will be the same objectGroup as the RemoteObject determined from <code>objectId</code>. This is useful for WeakMap to release the collection entries." },
+                { "name": "startIndex", "optional": true, "type": "integer", "description": "If provided skip to this index before collecting values. Otherwise, 0." },
+                { "name": "numberToFetch", "optional": true, "type": "integer", "description": "If provided only return <code>numberToFetch</code> values. Otherwise, return values all the way to the end." }
+            ],
+            "returns": [
+                { "name": "entries", "type": "array", "items": { "$ref": "CollectionEntry" }, "description": "Array of collection entries." }
+            ]
+        },
+        {
+            "name": "saveResult",
+            "parameters": [
+                { "name": "value", "$ref": "CallArgument", "description": "Id or value of the object to save." },
+                { "name": "contextId", "optional": true, "$ref": "ExecutionContextId", "description": "Unique id of the execution context. To specify in which execution context script evaluation should be performed. If not provided, determine from the CallArgument's objectId." }
+            ],
+            "returns": [
+                { "name": "savedResultIndex", "type": "integer", "optional": true, "description": "If the value was saved, this is the $n index that can be used to access the value." }
+            ],
+            "description": "Assign a saved result index to this value."
+        },
+        {
+            "name": "releaseObject",
+            "parameters": [
+                { "name": "objectId", "$ref": "RemoteObjectId", "description": "Identifier of the object to release." }
+            ],
+            "description": "Releases remote object with given id."
+        },
+        {
+            "name": "releaseObjectGroup",
+            "parameters": [
+                { "name": "objectGroup", "type": "string", "description": "Symbolic object group name." }
+            ],
+            "description": "Releases all remote objects that belong to a given group."
+        },
+        {
+            "name": "enable",
+            "description": "Enables reporting of execution contexts creation by means of <code>executionContextCreated</code> event. When the reporting gets enabled the event will be sent immediately for each existing execution context."
+        },
+        {
+            "name": "disable",
+            "description": "Disables reporting of execution contexts creation."
+        },
+        {
+            "name": "getRuntimeTypesForVariablesAtOffsets",
+            "parameters": [
+                { "name": "locations", "type": "array", "items": { "$ref": "TypeLocation" }, "description": "An array of type locations we're requesting information for. Results are expected in the same order they're sent in."}
+            ],
+            "returns": [
+                { "name": "types", "type": "array", "items": { "$ref": "TypeDescription", "description": "Types for requested variable." } }
+            ],
+            "description": "Returns detailed informtation on given function."
+        },
+        {
+            "name": "enableTypeProfiler",
+            "description": "Enables type profiling on the VM."
+        },
+        {
+            "name": "disableTypeProfiler",
+            "description": "Disables type profiling on the VM."
+        },
+        {
+            "name": "enableControlFlowProfiler",
+            "description": "Enables control flow profiling on the VM."
+        },
+        {
+            "name": "disableControlFlowProfiler",
+            "description": "Disables control flow profiling on the VM."
+        },
+        {
+            "name": "getBasicBlocks",
+            "parameters": [
+                { "name": "sourceID", "type": "string", "description": "Indicates which sourceID information is requested for." }
+            ],
+            "returns": [
+                { "name": "basicBlocks", "type": "array", "items": { "$ref": "BasicBlock", "description": "Array of basic blocks." } }
+            ],
+            "description": "Returns a list of basic blocks for the given sourceID with information about their text ranges and whether or not they have executed."
+        }
+    ],
+    "events": [
+        {
+            "name": "executionContextCreated",
+            "parameters": [
+                { "name": "context", "$ref": "ExecutionContextDescription", "description": "A newly created execution contex." }
+            ],
+            "description": "Issued when new execution context is created."
+        }
+    ]
+}
diff --git a/inspector/protocol/ScriptProfiler.json b/inspector/protocol/ScriptProfiler.json
new file mode 100644
index 0000000..d01258d
--- /dev/null
+++ b/inspector/protocol/ScriptProfiler.json
@@ -0,0 +1,99 @@
+{
+    "domain": "ScriptProfiler",
+    "description": "Profiler domain exposes JavaScript evaluation timing and profiling.",
+    "types": [
+        {
+            "id": "EventType",
+            "type": "string",
+            "enum": ["API", "Microtask", "Other"]
+        },
+        {
+            "id": "Event",
+            "type": "object",
+            "properties": [
+                { "name": "startTime", "type": "number" },
+                { "name": "endTime", "type": "number" },
+                { "name": "type", "$ref": "EventType" }
+            ]
+        },
+        {
+            "id": "ExpressionLocation",
+            "type": "object",
+            "properties": [
+                { "name": "line", "type": "integer", "description": "1-based." },
+                { "name": "column", "type": "integer", "description": "1-based." }
+            ]
+        },
+        {
+            "id": "StackFrame",
+            "type": "object",
+            "properties": [
+                { "name": "sourceID", "$ref": "Debugger.ScriptId", "description": "Unique script identifier." },
+                { "name": "name", "type": "string", "description": "A displayable name for the stack frame. i.e function name, (program), etc." },
+                { "name": "line", "type": "integer", "description": "-1 if unavailable. 1-based if available." },
+                { "name": "column", "type": "integer", "description": "-1 if unavailable. 1-based if available." },
+                { "name": "url", "type": "string" },
+                { "name": "expressionLocation", "$ref": "ExpressionLocation", "optional": true }
+            ]
+        },
+        {
+            "id": "StackTrace",
+            "type": "object",
+            "properties": [
+                { "name": "timestamp", "type": "number" },
+                { "name": "stackFrames", "type": "array", "items": { "$ref": "StackFrame" }, "description": "First array item is the bottom of the call stack and last array item is the top of the call stack." }
+            ]
+        },
+        {
+            "id": "Samples",
+            "type": "object",
+            "properties": [
+                { "name": "stackTraces", "type": "array", "items": { "$ref": "StackTrace" } }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "startTracking",
+            "description": "Start tracking script evaluations.",
+            "parameters": [
+                { "name": "includeSamples", "type": "boolean", "optional": true, "description": "Start the sampling profiler, defaults to false." }
+            ]
+        },
+        {
+            "name": "stopTracking",
+            "description": "Stop tracking script evaluations. This will produce a `trackingComplete` event."
+        }
+    ],
+    "events": [
+        {
+            "name": "trackingStart",
+            "description": "Tracking started.",
+            "parameters": [
+                { "name": "timestamp", "type": "number" }
+            ]
+        },
+        {
+            "name": "trackingUpdate",
+            "description": "Periodic tracking updates with event data.",
+            "parameters": [
+                { "name": "event", "$ref": "Event" }
+            ]
+        },
+        {
+            "name": "trackingComplete",
+            "description": "Tracking stopped. Includes any buffered data during tracking, such as profiling information.",
+            "parameters": [
+                { "name": "samples", "$ref": "Samples", "optional": true, "description": "Stack traces." }
+            ]
+        },
+        {
+            "name": "programmaticCaptureStarted",
+            "description": "Fired when programmatic capture starts (console.profile). JSContext inspection only."
+        },
+        {
+            "name": "programmaticCaptureStopped",
+            "description": "Fired when programmatic capture stops (console.profileEnd). JSContext inspection only."
+        }
+    ]
+}
diff --git a/inspector/protocol/Timeline.json b/inspector/protocol/Timeline.json
new file mode 100644
index 0000000..7739675
--- /dev/null
+++ b/inspector/protocol/Timeline.json
@@ -0,0 +1,118 @@
+{
+    "domain": "Timeline",
+    "description": "Timeline provides its clients with instrumentation records that are generated during the page runtime. Timeline instrumentation can be started and stopped using corresponding commands. While timeline is started, it is generating timeline event records.",
+    "availability": "web",
+    "types": [
+        {
+            "id": "EventType",
+            "type": "string",
+            "description": "Timeline record type.",
+            "enum": [
+                "EventDispatch",
+                "ScheduleStyleRecalculation",
+                "RecalculateStyles",
+                "InvalidateLayout",
+                "Layout",
+                "Paint",
+                "Composite",
+                "RenderingFrame",
+                "TimerInstall",
+                "TimerRemove",
+                "TimerFire",
+                "EvaluateScript",
+                "TimeStamp",
+                "Time",
+                "TimeEnd",
+                "FunctionCall",
+                "ProbeSample",
+                "ConsoleProfile",
+                "RequestAnimationFrame",
+                "CancelAnimationFrame",
+                "FireAnimationFrame"
+            ]
+        },
+        {
+            "id": "Instrument",
+            "type": "string",
+            "description": "Instrument types.",
+            "enum": [
+                "ScriptProfiler",
+                "Timeline",
+                "Memory",
+                "Heap"
+            ]
+        },
+        {
+            "id": "TimelineEvent",
+            "type": "object",
+            "description": "Timeline record contains information about the recorded activity.",
+            "properties": [
+                { "name": "type", "$ref": "EventType", "description": "Event type." },
+                { "name": "data", "type": "object", "description": "Event data." },
+                { "name": "children", "type": "array", "optional": true, "items": { "$ref": "TimelineEvent" }, "description": "Nested records." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "start",
+            "description": "Starts capturing instrumentation events.",
+            "parameters": [
+                { "name": "maxCallStackDepth", "optional": true, "type": "integer", "description": "Samples JavaScript stack traces up to <code>maxCallStackDepth</code>, defaults to 5." }
+            ]
+        },
+        {
+            "name": "stop",
+            "description": "Stops capturing instrumentation events."
+        },
+        {
+            "name": "setAutoCaptureEnabled",
+            "description": "Toggle auto capture state. If <code>true</code> the backend will disable breakpoints and start capturing on navigation. The backend will fire the <code>autoCaptureStarted</code> event when an auto capture starts. The frontend should stop the auto capture when appropriate and re-enable breakpoints.",
+            "parameters": [
+                { "name": "enabled", "type": "boolean", "description": "New auto capture state." }
+            ]
+        },
+        {
+            "name": "setInstruments",
+            "description": "Instruments to enable when capture starts on the backend (e.g. auto capture or programmatic capture).",
+            "parameters": [
+                { "name": "instruments", "type": "array", "items": { "$ref": "Instrument" }, "description": "Instruments to enable." }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "eventRecorded",
+            "description": "Fired for every instrumentation event while timeline is started.",
+            "parameters": [
+                { "name": "record", "$ref": "TimelineEvent", "description": "Timeline event record data." }
+            ]
+        },
+        {
+            "name": "recordingStarted",
+            "description": "Fired when recording has started.",
+            "parameters": [
+                { "name": "startTime", "type": "number", "description": "Start time of this new recording." }
+            ]
+        },
+        {
+            "name": "recordingStopped",
+            "description": "Fired when recording has stopped.",
+            "parameters": [
+                { "name": "endTime", "type": "number", "description": "End time of this recording." }
+            ]
+        },
+        {
+            "name": "autoCaptureStarted",
+            "description": "Fired when auto capture started."
+        },
+        {
+            "name": "programmaticCaptureStarted",
+            "description": "Fired when programmatic capture starts (console.profile)."
+        },
+        {
+            "name": "programmaticCaptureStopped",
+            "description": "Fired when programmatic capture stops (console.profileEnd)."
+        }
+    ]
+}
diff --git a/inspector/protocol/Worker.json b/inspector/protocol/Worker.json
new file mode 100644
index 0000000..a57fac0
--- /dev/null
+++ b/inspector/protocol/Worker.json
@@ -0,0 +1,52 @@
+{
+    "domain": "Worker",
+    "availability": "web",
+    "types": [],
+    "commands": [
+        {
+            "name": "enable",
+            "description": "Enable Worker domain events."
+        },
+        {
+            "name": "disable",
+            "description": "Disable Worker domain events."
+        },
+        {
+            "name": "initialized",
+            "description": "Sent after the frontend has sent all initialization messages and can resume this worker. This command is required to allow execution in the worker.",
+            "parameters": [
+                { "name": "workerId", "type": "string" }
+            ]            
+        },
+        {
+            "name": "sendMessageToWorker",
+            "description": "Send an Inspector Protocol message to be dispatched to a Worker's agents.",
+            "parameters": [
+                { "name": "workerId", "type": "string" },
+                { "name": "message", "type": "string", "description": "JSON Inspector Protocol message (command) to be dispatched on the backend." }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "workerCreated",
+            "parameters": [
+                { "name": "workerId", "type": "string" },
+                { "name": "url", "type": "string" }
+            ]
+        },
+        {
+            "name": "workerTerminated",
+            "parameters": [
+                { "name": "workerId", "type": "string" }
+            ]
+        },
+        {
+            "name": "dispatchMessageFromWorker",
+            "parameters": [
+                { "name": "workerId", "type": "string" },
+                { "name": "message", "type": "string", "description": "JSON Inspector Protocol message (response or event) to be dispatched on the frontend." }
+            ]
+        }
+    ]
+}
diff --git a/inspector/remote/RemoteAutomationTarget.cpp b/inspector/remote/RemoteAutomationTarget.cpp
new file mode 100644
index 0000000..565218c
--- /dev/null
+++ b/inspector/remote/RemoteAutomationTarget.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RemoteAutomationTarget.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#include "RemoteInspector.h"
+
+namespace Inspector {
+
+void RemoteAutomationTarget::setIsPaired(bool paired)
+{
+    if (m_paired == paired)
+        return;
+
+    m_paired = paired;
+
+    update();
+}
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteAutomationTarget.h b/inspector/remote/RemoteAutomationTarget.h
new file mode 100644
index 0000000..0b174fd
--- /dev/null
+++ b/inspector/remote/RemoteAutomationTarget.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#include "RemoteControllableTarget.h"
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendChannel;
+
+class JS_EXPORT_PRIVATE RemoteAutomationTarget : public RemoteControllableTarget {
+public:
+    virtual ~RemoteAutomationTarget() { }
+
+    bool isPaired() const { return m_paired; }
+    void setIsPaired(bool);
+
+    virtual String name() const = 0;
+    RemoteControllableTarget::Type type() const override { return RemoteControllableTarget::Type::Automation; }
+    bool remoteControlAllowed() const override { return !m_paired; };
+
+private:
+    bool m_paired { false };
+};
+
+} // namespace Inspector
+
+SPECIALIZE_TYPE_TRAITS_CONTROLLABLE_TARGET(Inspector::RemoteAutomationTarget, Automation)
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteConnectionToTarget.h b/inspector/remote/RemoteConnectionToTarget.h
new file mode 100644
index 0000000..dba0601
--- /dev/null
+++ b/inspector/remote/RemoteConnectionToTarget.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#import "InspectorFrontendChannel.h"
+#import "RemoteConnectionToTarget.h"
+#import "RemoteInspector.h"
+#import <mutex>
+#import <wtf/BlockPtr.h>
+#import <wtf/Lock.h>
+#import <wtf/RetainPtr.h>
+#import <wtf/ThreadSafeRefCounted.h>
+
+OBJC_CLASS NSString;
+
+namespace Inspector {
+
+typedef Vector<BlockPtr<void ()>> RemoteTargetQueue;
+
+class RemoteConnectionToTarget final : public ThreadSafeRefCounted<RemoteConnectionToTarget>, public FrontendChannel {
+public:
+    RemoteConnectionToTarget(RemoteControllableTarget*, NSString *connectionIdentifier, NSString *destination);
+    virtual ~RemoteConnectionToTarget();
+
+    // Main API.
+    bool setup(bool isAutomaticInspection = false, bool automaticallyPause = false);
+    void sendMessageToTarget(NSString *);
+    void close();
+    void targetClosed();
+
+    std::optional<unsigned> targetIdentifier() const;
+    NSString *connectionIdentifier() const;
+    NSString *destination() const;
+
+    Lock& queueMutex() { return m_queueMutex; }
+    const RemoteTargetQueue& queue() const { return m_queue; }
+    void clearQueue() { m_queue.clear(); }
+
+    // FrontendChannel overrides.
+    ConnectionType connectionType() const override { return ConnectionType::Remote; }
+    void sendMessageToFrontend(const String&) override;
+
+private:
+    void dispatchAsyncOnTarget(void (^block)());
+
+    void setupRunLoop();
+    void teardownRunLoop();
+    void queueTaskOnPrivateRunLoop(void (^block)());
+
+    // This connection from the RemoteInspector singleton to the InspectionTarget
+    // can be used on multiple threads. So any access to the target
+    // itself must take this mutex to ensure m_target is valid.
+    Lock m_targetMutex;
+
+    // If a target has a specific run loop it wants to evaluate on
+    // we setup our run loop sources on that specific run loop.
+    RetainPtr<CFRunLoopRef> m_runLoop;
+    RetainPtr<CFRunLoopSourceRef> m_runLoopSource;
+    RemoteTargetQueue m_queue;
+    Lock m_queueMutex;
+
+    RemoteControllableTarget* m_target { nullptr };
+    RetainPtr<NSString> m_connectionIdentifier;
+    RetainPtr<NSString> m_destination;
+    bool m_connected { false };
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteConnectionToTarget.mm b/inspector/remote/RemoteConnectionToTarget.mm
new file mode 100644
index 0000000..d60da48
--- /dev/null
+++ b/inspector/remote/RemoteConnectionToTarget.mm
@@ -0,0 +1,283 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "RemoteConnectionToTarget.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#import "EventLoop.h"
+#import "RemoteAutomationTarget.h"
+#import "RemoteInspectionTarget.h"
+#import <dispatch/dispatch.h>
+#import <wtf/Optional.h>
+
+#if PLATFORM(IOS)
+#import <wtf/ios/WebCoreThread.h>
+#endif
+
+namespace Inspector {
+
+static StaticLock rwiQueueMutex;
+static CFRunLoopSourceRef rwiRunLoopSource;
+static RemoteTargetQueue* rwiQueue;
+
+static void RemoteTargetHandleRunSourceGlobal(void*)
+{
+    ASSERT(CFRunLoopGetCurrent() == CFRunLoopGetMain());
+    ASSERT(rwiRunLoopSource);
+    ASSERT(rwiQueue);
+
+    RemoteTargetQueue queueCopy;
+    {
+        std::lock_guard<StaticLock> lock(rwiQueueMutex);
+        queueCopy = *rwiQueue;
+        rwiQueue->clear();
+    }
+
+    for (const auto& block : queueCopy)
+        block();
+}
+
+static void RemoteTargetQueueTaskOnGlobalQueue(void (^task)())
+{
+    ASSERT(rwiRunLoopSource);
+    ASSERT(rwiQueue);
+
+    {
+        std::lock_guard<StaticLock> lock(rwiQueueMutex);
+        rwiQueue->append(task);
+    }
+
+    CFRunLoopSourceSignal(rwiRunLoopSource);
+    CFRunLoopWakeUp(CFRunLoopGetMain());
+}
+
+static void RemoteTargetInitializeGlobalQueue()
+{
+    static dispatch_once_t pred;
+    dispatch_once(&pred, ^{
+        rwiQueue = new RemoteTargetQueue;
+
+        CFRunLoopSourceContext runLoopSourceContext = {0, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, RemoteTargetHandleRunSourceGlobal};
+        rwiRunLoopSource = CFRunLoopSourceCreate(kCFAllocatorDefault, 1, &runLoopSourceContext);
+
+        // Add to the default run loop mode for default handling, and the JSContext remote inspector run loop mode when paused.
+        CFRunLoopAddSource(CFRunLoopGetMain(), rwiRunLoopSource, kCFRunLoopDefaultMode);
+        CFRunLoopAddSource(CFRunLoopGetMain(), rwiRunLoopSource, EventLoop::remoteInspectorRunLoopMode());
+    });
+}
+
+static void RemoteTargetHandleRunSourceWithInfo(void* info)
+{
+    RemoteConnectionToTarget *connectionToTarget = static_cast<RemoteConnectionToTarget*>(info);
+
+    RemoteTargetQueue queueCopy;
+    {
+        std::lock_guard<Lock> lock(connectionToTarget->queueMutex());
+        queueCopy = connectionToTarget->queue();
+        connectionToTarget->clearQueue();
+    }
+
+    for (const auto& block : queueCopy)
+        block();
+}
+
+
+RemoteConnectionToTarget::RemoteConnectionToTarget(RemoteControllableTarget* target, NSString *connectionIdentifier, NSString *destination)
+    : m_target(target)
+    , m_connectionIdentifier(connectionIdentifier)
+    , m_destination(destination)
+{
+    setupRunLoop();
+}
+
+RemoteConnectionToTarget::~RemoteConnectionToTarget()
+{
+    teardownRunLoop();
+}
+
+std::optional<unsigned> RemoteConnectionToTarget::targetIdentifier() const
+{
+    return m_target ? std::optional<unsigned>(m_target->targetIdentifier()) : std::nullopt;
+}
+
+NSString *RemoteConnectionToTarget::connectionIdentifier() const
+{
+    return [[m_connectionIdentifier copy] autorelease];
+}
+
+NSString *RemoteConnectionToTarget::destination() const
+{
+    return [[m_destination copy] autorelease];
+}
+
+void RemoteConnectionToTarget::dispatchAsyncOnTarget(void (^block)())
+{
+    if (m_runLoop) {
+        queueTaskOnPrivateRunLoop(block);
+        return;
+    }
+
+#if PLATFORM(IOS)
+    if (WebCoreWebThreadIsEnabled && WebCoreWebThreadIsEnabled()) {
+        WebCoreWebThreadRun(block);
+        return;
+    }
+#endif
+
+    RemoteTargetQueueTaskOnGlobalQueue(block);
+}
+
+bool RemoteConnectionToTarget::setup(bool isAutomaticInspection, bool automaticallyPause)
+{
+    std::lock_guard<Lock> lock(m_targetMutex);
+
+    if (!m_target)
+        return false;
+
+    ref();
+    dispatchAsyncOnTarget(^{
+        {
+            std::lock_guard<Lock> lock(m_targetMutex);
+            if (!m_target || !m_target->remoteControlAllowed()) {
+                RemoteInspector::singleton().setupFailed(targetIdentifier().value_or(0));
+                m_target = nullptr;
+            } else if (is<RemoteInspectionTarget>(m_target)) {
+                auto castedTarget = downcast<RemoteInspectionTarget>(m_target);
+                castedTarget->connect(this, isAutomaticInspection);
+                m_connected = true;
+
+                if (automaticallyPause)
+                    castedTarget->pause();
+            } else if (is<RemoteAutomationTarget>(m_target)) {
+                auto castedTarget = downcast<RemoteAutomationTarget>(m_target);
+                castedTarget->connect(this);
+                m_connected = true;
+            }
+        }
+        deref();
+    });
+
+    return true;
+}
+
+void RemoteConnectionToTarget::targetClosed()
+{
+    std::lock_guard<Lock> lock(m_targetMutex);
+
+    m_target = nullptr;
+}
+
+void RemoteConnectionToTarget::close()
+{
+    ref();
+    dispatchAsyncOnTarget(^{
+        {
+            std::lock_guard<Lock> lock(m_targetMutex);
+
+            if (m_target) {
+                if (m_connected)
+                    m_target->disconnect(this);
+
+                m_target = nullptr;
+            }
+        }
+        deref();
+    });
+}
+
+void RemoteConnectionToTarget::sendMessageToTarget(NSString *message)
+{
+    ref();
+    dispatchAsyncOnTarget(^{
+        {
+            RemoteControllableTarget* target = nullptr;
+            {
+                std::lock_guard<Lock> lock(m_targetMutex);
+                if (!m_target)
+                    return;
+                target = m_target;
+            }
+
+            target->dispatchMessageFromRemote(message);
+        }
+        deref();
+    });
+}
+
+void RemoteConnectionToTarget::sendMessageToFrontend(const String& message)
+{
+    if (!targetIdentifier())
+        return;
+
+    RemoteInspector::singleton().sendMessageToRemote(targetIdentifier().value(), message);
+}
+
+void RemoteConnectionToTarget::setupRunLoop()
+{
+    CFRunLoopRef targetRunLoop = m_target->targetRunLoop();
+    if (!targetRunLoop) {
+        RemoteTargetInitializeGlobalQueue();
+        return;
+    }
+
+    m_runLoop = targetRunLoop;
+
+    CFRunLoopSourceContext runLoopSourceContext = {0, this, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, RemoteTargetHandleRunSourceWithInfo};
+    m_runLoopSource = adoptCF(CFRunLoopSourceCreate(kCFAllocatorDefault, 1, &runLoopSourceContext));
+
+    CFRunLoopAddSource(m_runLoop.get(), m_runLoopSource.get(), kCFRunLoopDefaultMode);
+    CFRunLoopAddSource(m_runLoop.get(), m_runLoopSource.get(), EventLoop::remoteInspectorRunLoopMode());
+}
+
+void RemoteConnectionToTarget::teardownRunLoop()
+{
+    if (!m_runLoop)
+        return;
+
+    CFRunLoopRemoveSource(m_runLoop.get(), m_runLoopSource.get(), kCFRunLoopDefaultMode);
+    CFRunLoopRemoveSource(m_runLoop.get(), m_runLoopSource.get(), EventLoop::remoteInspectorRunLoopMode());
+
+    m_runLoop = nullptr;
+    m_runLoopSource = nullptr;
+}
+
+void RemoteConnectionToTarget::queueTaskOnPrivateRunLoop(void (^block)())
+{
+    ASSERT(m_runLoop);
+
+    {
+        std::lock_guard<Lock> lock(m_queueMutex);
+        m_queue.append(block);
+    }
+
+    CFRunLoopSourceSignal(m_runLoopSource.get());
+    CFRunLoopWakeUp(m_runLoop.get());
+}
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteControllableTarget.cpp b/inspector/remote/RemoteControllableTarget.cpp
new file mode 100644
index 0000000..f52852b
--- /dev/null
+++ b/inspector/remote/RemoteControllableTarget.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RemoteControllableTarget.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#include "RemoteInspector.h"
+
+namespace Inspector {
+
+RemoteControllableTarget::~RemoteControllableTarget()
+{
+    RemoteInspector::singleton().unregisterTarget(this);
+}
+
+void RemoteControllableTarget::init()
+{
+    RemoteInspector::singleton().registerTarget(this);
+}
+
+void RemoteControllableTarget::update()
+{
+    RemoteInspector::singleton().updateTarget(this);
+}
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteControllableTarget.h b/inspector/remote/RemoteControllableTarget.h
new file mode 100644
index 0000000..d65faea
--- /dev/null
+++ b/inspector/remote/RemoteControllableTarget.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#include <CoreFoundation/CFRunLoop.h>
+#include <wtf/TypeCasts.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendChannel;
+
+class JS_EXPORT_PRIVATE RemoteControllableTarget {
+public:
+    virtual ~RemoteControllableTarget();
+
+    void init();
+    void update();
+
+    virtual void connect(FrontendChannel*, bool isAutomaticConnection = false) = 0;
+    virtual void disconnect(FrontendChannel*) = 0;
+
+    unsigned targetIdentifier() const { return m_identifier; }
+    void setTargetIdentifier(unsigned identifier) { m_identifier = identifier; }
+
+    enum class Type { JavaScript, Web, Automation };
+    virtual Type type() const = 0;
+    virtual bool remoteControlAllowed() const = 0;
+    virtual void dispatchMessageFromRemote(const String& message) = 0;
+
+    // The dispatch block will be scheduled on a global run loop if null is returned.
+    virtual CFRunLoopRef targetRunLoop() { return nullptr; }
+private:
+    unsigned m_identifier {0};
+};
+
+} // namespace Inspector
+
+#define SPECIALIZE_TYPE_TRAITS_CONTROLLABLE_TARGET(ToClassName, ToClassType) \
+SPECIALIZE_TYPE_TRAITS_BEGIN(ToClassName) \
+    static bool isType(const Inspector::RemoteControllableTarget& target) { return target.type() == Inspector::RemoteControllableTarget::Type::ToClassType; } \
+SPECIALIZE_TYPE_TRAITS_END()
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteInspectionTarget.cpp b/inspector/remote/RemoteInspectionTarget.cpp
new file mode 100644
index 0000000..5d5f3eb
--- /dev/null
+++ b/inspector/remote/RemoteInspectionTarget.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RemoteInspectionTarget.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#include "EventLoop.h"
+#include "RemoteInspector.h"
+
+namespace Inspector {
+
+bool RemoteInspectionTarget::remoteControlAllowed() const
+{
+    return remoteDebuggingAllowed() || hasLocalDebugger();
+}
+
+void RemoteInspectionTarget::setRemoteDebuggingAllowed(bool allowed)
+{
+    if (m_allowed == allowed)
+        return;
+
+    m_allowed = allowed;
+
+    if (m_allowed && automaticInspectionAllowed())
+        RemoteInspector::singleton().updateAutomaticInspectionCandidate(this);
+    else
+        RemoteInspector::singleton().updateTarget(this);
+}
+
+void RemoteInspectionTarget::pauseWaitingForAutomaticInspection()
+{
+    ASSERT(targetIdentifier());
+    ASSERT(m_allowed);
+    ASSERT(automaticInspectionAllowed());
+
+    EventLoop loop;
+    while (RemoteInspector::singleton().waitingForAutomaticInspection(targetIdentifier()) && !loop.ended())
+        loop.cycle();
+}
+
+void RemoteInspectionTarget::unpauseForInitializedInspector()
+{
+    RemoteInspector::singleton().setupCompleted(targetIdentifier());
+}
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteInspectionTarget.h b/inspector/remote/RemoteInspectionTarget.h
new file mode 100644
index 0000000..3852fcc
--- /dev/null
+++ b/inspector/remote/RemoteInspectionTarget.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#include "RemoteControllableTarget.h"
+#include <wtf/RetainPtr.h>
+#include <wtf/TypeCasts.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendChannel;
+
+class JS_EXPORT_PRIVATE RemoteInspectionTarget : public RemoteControllableTarget {
+public:
+    bool remoteDebuggingAllowed() const { return m_allowed; }
+    void setRemoteDebuggingAllowed(bool);
+
+    CFRunLoopRef targetRunLoop() override { return m_runLoop.get(); }
+    void setTargetRunLoop(CFRunLoopRef runLoop) { m_runLoop = runLoop; }
+
+    virtual String name() const { return String(); } // JavaScript and Web
+    virtual String url() const { return String(); } // Web
+    virtual bool hasLocalDebugger() const = 0;
+
+    virtual void setIndicating(bool) { } // Default is to do nothing.
+    virtual void pause() { };
+
+    virtual bool automaticInspectionAllowed() const { return false; }
+    virtual void pauseWaitingForAutomaticInspection();
+    virtual void unpauseForInitializedInspector();
+
+    // RemoteControllableTarget overrides.
+    bool remoteControlAllowed() const override;
+private:
+    bool m_allowed {false};
+    RetainPtr<CFRunLoopRef> m_runLoop;
+};
+
+} // namespace Inspector
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Inspector::RemoteInspectionTarget) \
+    static bool isType(const Inspector::RemoteControllableTarget& target) \
+    { \
+        return target.type() == Inspector::RemoteControllableTarget::Type::JavaScript \
+            || target.type() == Inspector::RemoteControllableTarget::Type::Web; \
+    }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteInspector.h b/inspector/remote/RemoteInspector.h
new file mode 100644
index 0000000..93fd1a7
--- /dev/null
+++ b/inspector/remote/RemoteInspector.h
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2013, 2015, 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#import "RemoteInspectorXPCConnection.h"
+#import <wtf/Forward.h>
+#import <wtf/HashMap.h>
+#import <wtf/Lock.h>
+#import <wtf/RetainPtr.h>
+
+OBJC_CLASS NSDictionary;
+OBJC_CLASS NSString;
+
+namespace Inspector {
+
+class RemoteAutomationTarget;
+class RemoteConnectionToTarget;
+class RemoteControllableTarget;
+class RemoteInspectionTarget;
+class RemoteInspectorClient;
+
+class JS_EXPORT_PRIVATE RemoteInspector final : public RemoteInspectorXPCConnection::Client {
+public:
+    class Client {
+    public:
+        struct Capabilities {
+            bool remoteAutomationAllowed : 1;
+        };
+
+        virtual ~Client() { }
+        virtual bool remoteAutomationAllowed() const = 0;
+        virtual void requestAutomationSession(const String& sessionIdentifier) = 0;
+    };
+
+    static void startDisabled();
+    static RemoteInspector& singleton();
+    friend class NeverDestroyed<RemoteInspector>;
+
+    void registerTarget(RemoteControllableTarget*);
+    void unregisterTarget(RemoteControllableTarget*);
+    void updateTarget(RemoteControllableTarget*);
+    void sendMessageToRemote(unsigned targetIdentifier, const String& message);
+
+    void setRemoteInspectorClient(RemoteInspector::Client*);
+    void clientCapabilitiesDidChange();
+
+    void setupFailed(unsigned targetIdentifier);
+    void setupCompleted(unsigned targetIdentifier);
+    bool waitingForAutomaticInspection(unsigned targetIdentifier);
+    void updateAutomaticInspectionCandidate(RemoteInspectionTarget*);
+
+    bool enabled() const { return m_enabled; }
+    bool hasActiveDebugSession() const { return m_hasActiveDebugSession; }
+
+    void start();
+    void stop();
+
+    bool hasParentProcessInformation() const { return m_parentProcessIdentifier != 0; }
+    pid_t parentProcessIdentifier() const { return m_parentProcessIdentifier; }
+    RetainPtr<CFDataRef> parentProcessAuditData() const { return m_parentProcessAuditData; }
+    void setParentProcessInformation(pid_t, RetainPtr<CFDataRef> auditData);
+    void setParentProcessInfomationIsDelayed();
+
+private:
+    RemoteInspector();
+
+    unsigned nextAvailableTargetIdentifier();
+
+    enum class StopSource { API, XPCMessage };
+    void stopInternal(StopSource);
+
+    void setupXPCConnectionIfNeeded();
+
+    RetainPtr<NSDictionary> listingForTarget(const RemoteControllableTarget&) const;
+    RetainPtr<NSDictionary> listingForInspectionTarget(const RemoteInspectionTarget&) const;
+    RetainPtr<NSDictionary> listingForAutomationTarget(const RemoteAutomationTarget&) const;
+    void pushListingsNow();
+    void pushListingsSoon();
+
+    void updateHasActiveDebugSession();
+    void updateClientCapabilities();
+
+    void sendAutomaticInspectionCandidateMessage();
+
+    void xpcConnectionReceivedMessage(RemoteInspectorXPCConnection*, NSString *messageName, NSDictionary *userInfo) override;
+    void xpcConnectionFailed(RemoteInspectorXPCConnection*) override;
+    void xpcConnectionUnhandledMessage(RemoteInspectorXPCConnection*, xpc_object_t) override;
+
+    void receivedSetupMessage(NSDictionary *userInfo);
+    void receivedDataMessage(NSDictionary *userInfo);
+    void receivedDidCloseMessage(NSDictionary *userInfo);
+    void receivedGetListingMessage(NSDictionary *userInfo);
+    void receivedIndicateMessage(NSDictionary *userInfo);
+    void receivedProxyApplicationSetupMessage(NSDictionary *userInfo);
+    void receivedConnectionDiedMessage(NSDictionary *userInfo);
+    void receivedAutomaticInspectionConfigurationMessage(NSDictionary *userInfo);
+    void receivedAutomaticInspectionRejectMessage(NSDictionary *userInfo);
+    void receivedAutomationSessionRequestMessage(NSDictionary *userInfo);
+
+    static bool startEnabled;
+
+    // Targets can be registered from any thread at any time.
+    // Any target can send messages over the XPC connection.
+    // So lock access to all maps and state as they can change
+    // from any thread.
+    Lock m_mutex;
+
+    HashMap<unsigned, RemoteControllableTarget*> m_targetMap;
+    HashMap<unsigned, RetainPtr<NSDictionary>> m_targetListingMap;
+    HashMap<unsigned, RefPtr<RemoteConnectionToTarget>> m_targetConnectionMap;
+
+    RefPtr<RemoteInspectorXPCConnection> m_relayConnection;
+
+    RemoteInspector::Client* m_client { nullptr };
+    std::optional<RemoteInspector::Client::Capabilities> m_clientCapabilities;
+
+    dispatch_queue_t m_xpcQueue;
+    unsigned m_nextAvailableTargetIdentifier { 1 };
+    int m_notifyToken { 0 };
+    bool m_enabled { false };
+    bool m_hasActiveDebugSession { false };
+    bool m_pushScheduled { false };
+
+    pid_t m_parentProcessIdentifier { 0 };
+    RetainPtr<CFDataRef> m_parentProcessAuditData;
+    bool m_shouldSendParentProcessInformation { false };
+    bool m_automaticInspectionEnabled { false };
+    bool m_automaticInspectionPaused { false };
+    unsigned m_automaticInspectionCandidateTargetIdentifier { 0 };
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteInspector.mm b/inspector/remote/RemoteInspector.mm
new file mode 100644
index 0000000..21cb232
--- /dev/null
+++ b/inspector/remote/RemoteInspector.mm
@@ -0,0 +1,835 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "RemoteInspector.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#import "InitializeThreading.h"
+#import "RemoteAutomationTarget.h"
+#import "RemoteConnectionToTarget.h"
+#import "RemoteInspectionTarget.h"
+#import "RemoteInspectorConstants.h"
+#import <Foundation/Foundation.h>
+#import <dispatch/dispatch.h>
+#import <notify.h>
+#import <wtf/Assertions.h>
+#import <wtf/MainThread.h>
+#import <wtf/NeverDestroyed.h>
+#import <wtf/spi/darwin/SandboxSPI.h>
+#import <wtf/spi/darwin/XPCSPI.h>
+#import <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+static bool canAccessWebInspectorMachPort()
+{
+    return sandbox_check(getpid(), "mach-lookup", static_cast<enum sandbox_filter_type>(SANDBOX_FILTER_GLOBAL_NAME | SANDBOX_CHECK_NO_REPORT), WIRXPCMachPortName) == 0;
+}
+
+static bool globalAutomaticInspectionState()
+{
+    int token = 0;
+    if (notify_register_check(WIRAutomaticInspectionEnabledState, &token) != NOTIFY_STATUS_OK)
+        return false;
+
+    uint64_t automaticInspectionEnabled = 0;
+    notify_get_state(token, &automaticInspectionEnabled);
+    return automaticInspectionEnabled == 1;
+}
+
+bool RemoteInspector::startEnabled = true;
+
+void RemoteInspector::startDisabled()
+{
+    RemoteInspector::startEnabled = false;
+}
+
+RemoteInspector& RemoteInspector::singleton()
+{
+    static NeverDestroyed<RemoteInspector> shared;
+
+    static dispatch_once_t once;
+    dispatch_once(&once, ^{
+        if (canAccessWebInspectorMachPort()) {
+            dispatch_block_t initialize = ^{
+                WTF::initializeMainThread();
+                JSC::initializeThreading();
+                if (RemoteInspector::startEnabled)
+                    shared.get().start();
+            };
+
+            if ([NSThread isMainThread])
+                initialize();
+            else {
+                // FIXME: This means that we may miss an auto-attach to a JSContext created on a non-main thread.
+                // The main thread initialization is required for certain WTF values that need to be initialized
+                // on the "real" main thread. We should investigate a better way to handle this.
+                dispatch_async(dispatch_get_main_queue(), initialize);
+            }
+        }
+    });
+
+    return shared;
+}
+
+RemoteInspector::RemoteInspector()
+    : m_xpcQueue(dispatch_queue_create("com.apple.JavaScriptCore.remote-inspector-xpc", DISPATCH_QUEUE_SERIAL))
+{
+}
+
+unsigned RemoteInspector::nextAvailableTargetIdentifier()
+{
+    unsigned nextValidTargetIdentifier;
+    do {
+        nextValidTargetIdentifier = m_nextAvailableTargetIdentifier++;
+    } while (!nextValidTargetIdentifier || nextValidTargetIdentifier == std::numeric_limits<unsigned>::max() || m_targetMap.contains(nextValidTargetIdentifier));
+    return nextValidTargetIdentifier;
+}
+
+void RemoteInspector::registerTarget(RemoteControllableTarget* target)
+{
+    ASSERT_ARG(target, target);
+
+    std::lock_guard<Lock> lock(m_mutex);
+
+    unsigned targetIdentifier = nextAvailableTargetIdentifier();
+    target->setTargetIdentifier(targetIdentifier);
+
+    {
+        auto result = m_targetMap.set(targetIdentifier, target);
+        ASSERT_UNUSED(result, result.isNewEntry);
+    }
+
+    // If remote control is not allowed, a null listing is returned.
+    if (RetainPtr<NSDictionary> targetListing = listingForTarget(*target)) {
+        auto result = m_targetListingMap.set(targetIdentifier, targetListing);
+        ASSERT_UNUSED(result, result.isNewEntry);
+    }
+
+    pushListingsSoon();
+}
+
+void RemoteInspector::unregisterTarget(RemoteControllableTarget* target)
+{
+    ASSERT_ARG(target, target);
+
+    std::lock_guard<Lock> lock(m_mutex);
+
+    unsigned targetIdentifier = target->targetIdentifier();
+    if (!targetIdentifier)
+        return;
+
+    bool wasRemoved = m_targetMap.remove(targetIdentifier);
+    ASSERT_UNUSED(wasRemoved, wasRemoved);
+
+    // The listing may never have been added if remote control isn't allowed.
+    m_targetListingMap.remove(targetIdentifier);
+
+    if (auto connectionToTarget = m_targetConnectionMap.take(targetIdentifier))
+        connectionToTarget->targetClosed();
+
+    pushListingsSoon();
+}
+
+void RemoteInspector::updateTarget(RemoteControllableTarget* target)
+{
+    ASSERT_ARG(target, target);
+
+    std::lock_guard<Lock> lock(m_mutex);
+
+    unsigned targetIdentifier = target->targetIdentifier();
+    if (!targetIdentifier)
+        return;
+
+    {
+        auto result = m_targetMap.set(targetIdentifier, target);
+        ASSERT_UNUSED(result, !result.isNewEntry);
+    }
+
+    // If the target has just allowed remote control, then the listing won't exist yet.
+    // If the target has no identifier remove the old listing.
+    if (RetainPtr<NSDictionary> targetListing = listingForTarget(*target))
+        m_targetListingMap.set(targetIdentifier, targetListing);
+    else
+        m_targetListingMap.remove(targetIdentifier);
+
+    pushListingsSoon();
+}
+
+void RemoteInspector::updateAutomaticInspectionCandidate(RemoteInspectionTarget* target)
+{
+    ASSERT_ARG(target, target);
+    {
+        std::lock_guard<Lock> lock(m_mutex);
+
+        unsigned targetIdentifier = target->targetIdentifier();
+        if (!targetIdentifier)
+            return;
+
+        auto result = m_targetMap.set(targetIdentifier, target);
+        ASSERT_UNUSED(result, !result.isNewEntry);
+
+        // If the target has just allowed remote control, then the listing won't exist yet.
+        // If the target has no identifier remove the old listing.
+        if (RetainPtr<NSDictionary> targetListing = listingForTarget(*target))
+            m_targetListingMap.set(targetIdentifier, targetListing);
+        else
+            m_targetListingMap.remove(targetIdentifier);
+
+        // Don't allow automatic inspection unless it is allowed or we are stopped.
+        if (!m_automaticInspectionEnabled || !m_enabled) {
+            pushListingsSoon();
+            return;
+        }
+
+        // FIXME: We should handle multiple debuggables trying to pause at the same time on different threads.
+        // To make this work we will need to change m_automaticInspectionCandidateTargetIdentifier to be a per-thread value.
+        // Multiple attempts on the same thread should not be possible because our nested run loop is in a special RWI mode.
+        if (m_automaticInspectionPaused) {
+            LOG_ERROR("Skipping Automatic Inspection Candidate with pageId(%u) because we are already paused waiting for pageId(%u)", targetIdentifier, m_automaticInspectionCandidateTargetIdentifier);
+            pushListingsSoon();
+            return;
+        }
+
+        m_automaticInspectionPaused = true;
+        m_automaticInspectionCandidateTargetIdentifier = targetIdentifier;
+
+        // If we are pausing before we have connected to webinspectord the candidate message will be sent as soon as the connection is established.
+        if (m_relayConnection) {
+            pushListingsNow();
+            sendAutomaticInspectionCandidateMessage();
+        }
+
+        // In case debuggers fail to respond, or we cannot connect to webinspectord, automatically continue after a short period of time.
+#if PLATFORM(WATCHOS)
+        int64_t debuggerTimeoutDelay = 5;
+#else
+        int64_t debuggerTimeoutDelay = 1;
+#endif
+        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, debuggerTimeoutDelay * NSEC_PER_SEC), dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
+            std::lock_guard<Lock> lock(m_mutex);
+            if (m_automaticInspectionCandidateTargetIdentifier == targetIdentifier) {
+                LOG_ERROR("Skipping Automatic Inspection Candidate with pageId(%u) because we failed to receive a response in time.", m_automaticInspectionCandidateTargetIdentifier);
+                m_automaticInspectionPaused = false;
+            }
+        });
+    }
+
+    target->pauseWaitingForAutomaticInspection();
+
+    {
+        std::lock_guard<Lock> lock(m_mutex);
+
+        ASSERT(m_automaticInspectionCandidateTargetIdentifier);
+        m_automaticInspectionCandidateTargetIdentifier = 0;
+    }
+}
+
+void RemoteInspector::updateClientCapabilities()
+{
+    ASSERT(isMainThread());
+
+    std::lock_guard<Lock> lock(m_mutex);
+
+    if (!m_client)
+        m_clientCapabilities = std::nullopt;
+    else {
+        RemoteInspector::Client::Capabilities updatedCapabilities = {
+            m_client->remoteAutomationAllowed() // remoteAutomationAllowed
+        };
+
+        m_clientCapabilities = updatedCapabilities;
+    }
+}
+
+void RemoteInspector::setRemoteInspectorClient(RemoteInspector::Client* client)
+{
+    ASSERT_ARG(client, client);
+    ASSERT(!m_client);
+
+    {
+        std::lock_guard<Lock> lock(m_mutex);
+        m_client = client;
+    }
+
+    // Send an updated listing that includes whether the client allows remote automation.
+    updateClientCapabilities();
+    pushListingsSoon();
+}
+
+void RemoteInspector::sendAutomaticInspectionCandidateMessage()
+{
+    ASSERT(m_enabled);
+    ASSERT(m_automaticInspectionEnabled);
+    ASSERT(m_automaticInspectionPaused);
+    ASSERT(m_automaticInspectionCandidateTargetIdentifier);
+    ASSERT(m_relayConnection);
+
+    NSDictionary *details = @{WIRTargetIdentifierKey: @(m_automaticInspectionCandidateTargetIdentifier)};
+    m_relayConnection->sendMessage(WIRAutomaticInspectionCandidateMessage, details);
+}
+
+void RemoteInspector::sendMessageToRemote(unsigned targetIdentifier, const String& message)
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    if (!m_relayConnection)
+        return;
+
+    auto targetConnection = m_targetConnectionMap.get(targetIdentifier);
+    if (!targetConnection)
+        return;
+
+    NSDictionary *userInfo = @{
+        WIRRawDataKey: [static_cast<NSString *>(message) dataUsingEncoding:NSUTF8StringEncoding],
+        WIRConnectionIdentifierKey: targetConnection->connectionIdentifier(),
+        WIRDestinationKey: targetConnection->destination()
+    };
+
+    m_relayConnection->sendMessage(WIRRawDataMessage, userInfo);
+}
+
+void RemoteInspector::setupFailed(unsigned targetIdentifier)
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    m_targetConnectionMap.remove(targetIdentifier);
+
+    updateHasActiveDebugSession();
+
+    if (targetIdentifier == m_automaticInspectionCandidateTargetIdentifier)
+        m_automaticInspectionPaused = false;
+
+    pushListingsSoon();
+}
+
+void RemoteInspector::setupCompleted(unsigned targetIdentifier)
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    if (targetIdentifier == m_automaticInspectionCandidateTargetIdentifier)
+        m_automaticInspectionPaused = false;
+}
+
+bool RemoteInspector::waitingForAutomaticInspection(unsigned)
+{
+    // We don't take the lock to check this because we assume it will be checked repeatedly.
+    return m_automaticInspectionPaused;
+}
+
+void RemoteInspector::clientCapabilitiesDidChange()
+{
+    updateClientCapabilities();
+    pushListingsSoon();
+}
+
+void RemoteInspector::start()
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    if (m_enabled)
+        return;
+
+    m_enabled = true;
+
+    // Load the initial automatic inspection state when first started, so we know it before we have even connected to webinspectord.
+    static dispatch_once_t once;
+    dispatch_once(&once, ^{
+        m_automaticInspectionEnabled = globalAutomaticInspectionState();
+    });
+
+    notify_register_dispatch(WIRServiceAvailableNotification, &m_notifyToken, m_xpcQueue, ^(int) {
+        RemoteInspector::singleton().setupXPCConnectionIfNeeded();
+    });
+
+    notify_post(WIRServiceAvailabilityCheckNotification);
+}
+
+void RemoteInspector::stop()
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    stopInternal(StopSource::API);
+}
+
+void RemoteInspector::stopInternal(StopSource source)
+{
+    if (!m_enabled)
+        return;
+
+    m_enabled = false;
+
+    m_pushScheduled = false;
+
+    for (auto targetConnection : m_targetConnectionMap.values())
+        targetConnection->close();
+    m_targetConnectionMap.clear();
+
+    updateHasActiveDebugSession();
+
+    m_automaticInspectionPaused = false;
+
+    if (m_relayConnection) {
+        switch (source) {
+        case StopSource::API:
+            m_relayConnection->close();
+            break;
+        case StopSource::XPCMessage:
+            m_relayConnection->closeFromMessage();
+            break;
+        }
+
+        m_relayConnection = nullptr;
+    }
+
+    notify_cancel(m_notifyToken);
+}
+
+void RemoteInspector::setupXPCConnectionIfNeeded()
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    if (m_relayConnection)
+        return;
+
+    xpc_connection_t connection = xpc_connection_create_mach_service(WIRXPCMachPortName, m_xpcQueue, 0);
+    if (!connection)
+        return;
+
+    m_relayConnection = adoptRef(new RemoteInspectorXPCConnection(connection, m_xpcQueue, this));
+    m_relayConnection->sendMessage(@"syn", nil); // Send a simple message to initialize the XPC connection.
+    xpc_release(connection);
+
+    if (m_automaticInspectionCandidateTargetIdentifier) {
+        // We already have a debuggable waiting to be automatically inspected.
+        pushListingsNow();
+        sendAutomaticInspectionCandidateMessage();
+    } else
+        pushListingsSoon();
+}
+
+#pragma mark - Proxy Application Information
+
+void RemoteInspector::setParentProcessInformation(pid_t pid, RetainPtr<CFDataRef> auditData)
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    if (m_parentProcessIdentifier || m_parentProcessAuditData)
+        return;
+
+    m_parentProcessIdentifier = pid;
+    m_parentProcessAuditData = auditData;
+
+    if (m_shouldSendParentProcessInformation)
+        receivedProxyApplicationSetupMessage(nil);
+}
+
+#pragma mark - RemoteInspectorXPCConnection::Client
+
+void RemoteInspector::xpcConnectionReceivedMessage(RemoteInspectorXPCConnection*, NSString *messageName, NSDictionary *userInfo)
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    if ([messageName isEqualToString:WIRPermissionDenied]) {
+        stopInternal(StopSource::XPCMessage);
+        return;
+    }
+
+    if ([messageName isEqualToString:WIRSocketDataMessage])
+        receivedDataMessage(userInfo);
+    else if ([messageName isEqualToString:WIRSocketSetupMessage])
+        receivedSetupMessage(userInfo);
+    else if ([messageName isEqualToString:WIRWebPageCloseMessage])
+        receivedDidCloseMessage(userInfo);
+    else if ([messageName isEqualToString:WIRApplicationGetListingMessage])
+        receivedGetListingMessage(userInfo);
+    else if ([messageName isEqualToString:WIRIndicateMessage])
+        receivedIndicateMessage(userInfo);
+    else if ([messageName isEqualToString:WIRProxyApplicationSetupMessage])
+        receivedProxyApplicationSetupMessage(userInfo);
+    else if ([messageName isEqualToString:WIRConnectionDiedMessage])
+        receivedConnectionDiedMessage(userInfo);
+    else if ([messageName isEqualToString:WIRAutomaticInspectionConfigurationMessage])
+        receivedAutomaticInspectionConfigurationMessage(userInfo);
+    else if ([messageName isEqualToString:WIRAutomaticInspectionRejectMessage])
+        receivedAutomaticInspectionRejectMessage(userInfo);
+    else if ([messageName isEqualToString:WIRAutomationSessionRequestMessage])
+        receivedAutomationSessionRequestMessage(userInfo);
+    else
+        NSLog(@"Unrecognized RemoteInspector XPC Message: %@", messageName);
+}
+
+void RemoteInspector::xpcConnectionFailed(RemoteInspectorXPCConnection* relayConnection)
+{
+    std::lock_guard<Lock> lock(m_mutex);
+
+    ASSERT(relayConnection == m_relayConnection);
+    if (relayConnection != m_relayConnection)
+        return;
+
+    m_pushScheduled = false;
+
+    for (auto targetConnection : m_targetConnectionMap.values())
+        targetConnection->close();
+    m_targetConnectionMap.clear();
+
+    updateHasActiveDebugSession();
+
+    m_automaticInspectionPaused = false;
+
+    // The XPC connection will close itself.
+    m_relayConnection = nullptr;
+}
+
+void RemoteInspector::xpcConnectionUnhandledMessage(RemoteInspectorXPCConnection*, xpc_object_t)
+{
+    // Intentionally ignored.
+}
+
+#pragma mark - Listings
+
+RetainPtr<NSDictionary> RemoteInspector::listingForTarget(const RemoteControllableTarget& target) const
+{
+    if (is<RemoteInspectionTarget>(target))
+        return listingForInspectionTarget(downcast<RemoteInspectionTarget>(target));
+    if (is<RemoteAutomationTarget>(target))
+        return listingForAutomationTarget(downcast<RemoteAutomationTarget>(target));
+
+    ASSERT_NOT_REACHED();
+    return nil;
+}
+
+RetainPtr<NSDictionary> RemoteInspector::listingForInspectionTarget(const RemoteInspectionTarget& target) const
+{
+    // Must collect target information on the WebThread, Main, or Worker thread since RemoteTargets are
+    // implemented by non-threadsafe JSC / WebCore classes such as JSGlobalObject or WebCore::Page.
+
+    if (!target.remoteDebuggingAllowed())
+        return nil;
+
+    RetainPtr<NSMutableDictionary> listing = adoptNS([[NSMutableDictionary alloc] init]);
+    [listing setObject:@(target.targetIdentifier()) forKey:WIRTargetIdentifierKey];
+
+    switch (target.type()) {
+    case RemoteInspectionTarget::Type::JavaScript:
+        [listing setObject:target.name() forKey:WIRTitleKey];
+        [listing setObject:WIRTypeJavaScript forKey:WIRTypeKey];
+        break;
+    case RemoteInspectionTarget::Type::Web:
+        [listing setObject:target.url() forKey:WIRURLKey];
+        [listing setObject:target.name() forKey:WIRTitleKey];
+        [listing setObject:WIRTypeWeb forKey:WIRTypeKey];
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+
+    if (auto* connectionToTarget = m_targetConnectionMap.get(target.targetIdentifier()))
+        [listing setObject:connectionToTarget->connectionIdentifier() forKey:WIRConnectionIdentifierKey];
+
+    if (target.hasLocalDebugger())
+        [listing setObject:@YES forKey:WIRHasLocalDebuggerKey];
+
+    return listing;
+}
+
+RetainPtr<NSDictionary> RemoteInspector::listingForAutomationTarget(const RemoteAutomationTarget& target) const
+{
+    // Must collect target information on the WebThread or Main thread since RemoteTargets are
+    // implemented by non-threadsafe JSC / WebCore classes such as JSGlobalObject or WebCore::Page.
+    ASSERT(isMainThread());
+
+    RetainPtr<NSMutableDictionary> listing = adoptNS([[NSMutableDictionary alloc] init]);
+    [listing setObject:@(target.targetIdentifier()) forKey:WIRTargetIdentifierKey];
+    [listing setObject:target.name() forKey:WIRSessionIdentifierKey];
+    [listing setObject:WIRTypeAutomation forKey:WIRTypeKey];
+    [listing setObject:@(target.isPaired()) forKey:WIRAutomationTargetIsPairedKey];
+
+    if (auto connectionToTarget = m_targetConnectionMap.get(target.targetIdentifier()))
+        [listing setObject:connectionToTarget->connectionIdentifier() forKey:WIRConnectionIdentifierKey];
+
+    return listing;
+}
+
+void RemoteInspector::pushListingsNow()
+{
+    ASSERT(m_relayConnection);
+    if (!m_relayConnection)
+        return;
+
+    m_pushScheduled = false;
+
+    RetainPtr<NSMutableDictionary> listings = adoptNS([[NSMutableDictionary alloc] init]);
+    for (RetainPtr<NSDictionary> listing : m_targetListingMap.values()) {
+        NSString *targetIdentifierString = [[listing.get() objectForKey:WIRTargetIdentifierKey] stringValue];
+        [listings setObject:listing.get() forKey:targetIdentifierString];
+    }
+
+    RetainPtr<NSMutableDictionary> message = adoptNS([[NSMutableDictionary alloc] init]);
+    [message setObject:listings.get() forKey:WIRListingKey];
+
+    BOOL isAllowed = m_clientCapabilities && m_clientCapabilities->remoteAutomationAllowed;
+    [message setObject:@(isAllowed) forKey:WIRRemoteAutomationEnabledKey];
+
+    m_relayConnection->sendMessage(WIRListingMessage, message.get());
+}
+
+void RemoteInspector::pushListingsSoon()
+{
+    if (!m_relayConnection)
+        return;
+
+    if (m_pushScheduled)
+        return;
+
+    m_pushScheduled = true;
+    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, 0.2 * NSEC_PER_SEC), dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
+        std::lock_guard<Lock> lock(m_mutex);
+        if (m_pushScheduled)
+            pushListingsNow();
+    });
+}
+
+#pragma mark - Active Debugger Sessions
+
+void RemoteInspector::updateHasActiveDebugSession()
+{
+    bool hasActiveDebuggerSession = !m_targetConnectionMap.isEmpty();
+    if (hasActiveDebuggerSession == m_hasActiveDebugSession)
+        return;
+
+    m_hasActiveDebugSession = hasActiveDebuggerSession;
+
+    // FIXME: Expose some way to access this state in an embedder.
+    // Legacy iOS WebKit 1 had a notification. This will need to be smarter with WebKit2.
+}
+
+
+#pragma mark - Received XPC Messages
+
+void RemoteInspector::receivedSetupMessage(NSDictionary *userInfo)
+{
+    unsigned targetIdentifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntegerValue];
+    if (!targetIdentifier)
+        return;
+
+    NSString *connectionIdentifier = [userInfo objectForKey:WIRConnectionIdentifierKey];
+    if (!connectionIdentifier)
+        return;
+
+    NSString *sender = [userInfo objectForKey:WIRSenderKey];
+    if (!sender)
+        return;
+
+    if (m_targetConnectionMap.contains(targetIdentifier))
+        return;
+
+    auto findResult = m_targetMap.find(targetIdentifier);
+    if (findResult == m_targetMap.end())
+        return;
+
+    // Attempt to create a connection. This may fail if the page already has an inspector or if it disallows inspection.
+    RemoteControllableTarget* target = findResult->value;
+    auto connectionToTarget = adoptRef(*new RemoteConnectionToTarget(target, connectionIdentifier, sender));
+
+    if (is<RemoteInspectionTarget>(target)) {
+        bool isAutomaticInspection = m_automaticInspectionCandidateTargetIdentifier == target->targetIdentifier();
+        bool automaticallyPause = [[userInfo objectForKey:WIRAutomaticallyPause] boolValue];
+
+        if (!connectionToTarget->setup(isAutomaticInspection, automaticallyPause)) {
+            connectionToTarget->close();
+            return;
+        }
+        m_targetConnectionMap.set(targetIdentifier, WTFMove(connectionToTarget));
+        updateHasActiveDebugSession();
+    } else if (is<RemoteAutomationTarget>(target)) {
+        if (!connectionToTarget->setup()) {
+            connectionToTarget->close();
+            return;
+        }
+        m_targetConnectionMap.set(targetIdentifier, WTFMove(connectionToTarget));
+        updateHasActiveDebugSession();
+    } else
+        ASSERT_NOT_REACHED();
+
+    pushListingsSoon();
+}
+
+void RemoteInspector::receivedDataMessage(NSDictionary *userInfo)
+{
+    unsigned targetIdentifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntegerValue];
+    if (!targetIdentifier)
+        return;
+
+    auto connectionToTarget = m_targetConnectionMap.get(targetIdentifier);
+    if (!connectionToTarget)
+        return;
+
+    NSData *data = [userInfo objectForKey:WIRSocketDataKey];
+    RetainPtr<NSString> message = adoptNS([[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding]);
+    connectionToTarget->sendMessageToTarget(message.get());
+}
+
+void RemoteInspector::receivedDidCloseMessage(NSDictionary *userInfo)
+{
+    unsigned targetIdentifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntegerValue];
+    if (!targetIdentifier)
+        return;
+
+    NSString *connectionIdentifier = [userInfo objectForKey:WIRConnectionIdentifierKey];
+    if (!connectionIdentifier)
+        return;
+
+    auto connectionToTarget = m_targetConnectionMap.get(targetIdentifier);
+    if (!connectionToTarget)
+        return;
+
+    if (![connectionIdentifier isEqualToString:connectionToTarget->connectionIdentifier()])
+        return;
+
+    connectionToTarget->close();
+    m_targetConnectionMap.remove(targetIdentifier);
+
+    updateHasActiveDebugSession();
+
+    pushListingsSoon();
+}
+
+void RemoteInspector::receivedGetListingMessage(NSDictionary *)
+{
+    pushListingsNow();
+}
+
+void RemoteInspector::receivedIndicateMessage(NSDictionary *userInfo)
+{
+    unsigned identifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntegerValue];
+    if (!identifier)
+        return;
+
+    BOOL indicateEnabled = [[userInfo objectForKey:WIRIndicateEnabledKey] boolValue];
+
+    callOnWebThreadOrDispatchAsyncOnMainThread(^{
+        RemoteControllableTarget* target = nullptr;
+        {
+            std::lock_guard<Lock> lock(m_mutex);
+
+            auto findResult = m_targetMap.find(identifier);
+            if (findResult == m_targetMap.end())
+                return;
+
+            target = findResult->value;
+        }
+        if (is<RemoteInspectionTarget>(target))
+            downcast<RemoteInspectionTarget>(target)->setIndicating(indicateEnabled);
+    });
+}
+
+void RemoteInspector::receivedProxyApplicationSetupMessage(NSDictionary *)
+{
+    ASSERT(m_relayConnection);
+    if (!m_relayConnection)
+        return;
+
+    if (!m_parentProcessIdentifier || !m_parentProcessAuditData) {
+        // We are a proxy application without parent process information.
+        // Wait a bit for the information, but give up after a second.
+        m_shouldSendParentProcessInformation = true;
+        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, 1 * NSEC_PER_SEC), dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
+            std::lock_guard<Lock> lock(m_mutex);
+            if (m_shouldSendParentProcessInformation)
+                stopInternal(StopSource::XPCMessage);
+        });
+        return;
+    }
+
+    m_shouldSendParentProcessInformation = false;
+
+    m_relayConnection->sendMessage(WIRProxyApplicationSetupResponseMessage, @{
+        WIRProxyApplicationParentPIDKey: @(m_parentProcessIdentifier),
+        WIRProxyApplicationParentAuditDataKey: (NSData *)m_parentProcessAuditData.get(),
+    });
+}
+
+void RemoteInspector::receivedConnectionDiedMessage(NSDictionary *userInfo)
+{
+    NSString *connectionIdentifier = [userInfo objectForKey:WIRConnectionIdentifierKey];
+    if (!connectionIdentifier)
+        return;
+
+    auto it = m_targetConnectionMap.begin();
+    auto end = m_targetConnectionMap.end();
+    for (; it != end; ++it) {
+        if ([connectionIdentifier isEqualToString:it->value->connectionIdentifier()])
+            break;
+    }
+
+    if (it == end)
+        return;
+
+    auto connection = it->value;
+    connection->close();
+    m_targetConnectionMap.remove(it);
+
+    updateHasActiveDebugSession();
+}
+
+void RemoteInspector::receivedAutomaticInspectionConfigurationMessage(NSDictionary *userInfo)
+{
+    m_automaticInspectionEnabled = [[userInfo objectForKey:WIRAutomaticInspectionEnabledKey] boolValue];
+
+    if (!m_automaticInspectionEnabled && m_automaticInspectionPaused)
+        m_automaticInspectionPaused = false;
+}
+
+void RemoteInspector::receivedAutomaticInspectionRejectMessage(NSDictionary *userInfo)
+{
+    unsigned rejectionIdentifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntValue];
+
+    ASSERT(rejectionIdentifier == m_automaticInspectionCandidateTargetIdentifier);
+    if (rejectionIdentifier == m_automaticInspectionCandidateTargetIdentifier)
+        m_automaticInspectionPaused = false;
+}
+
+void RemoteInspector::receivedAutomationSessionRequestMessage(NSDictionary *userInfo)
+{
+    if (!m_client)
+        return;
+
+    if (!m_clientCapabilities || !m_clientCapabilities->remoteAutomationAllowed)
+        return;
+
+    NSString *suggestedSessionIdentifier = [userInfo objectForKey:WIRSessionIdentifierKey];
+    if (!suggestedSessionIdentifier)
+        return;
+
+    m_client->requestAutomationSession(suggestedSessionIdentifier);
+}
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteInspectorConstants.h b/inspector/remote/RemoteInspectorConstants.h
new file mode 100644
index 0000000..700657b
--- /dev/null
+++ b/inspector/remote/RemoteInspectorConstants.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+// WIRConstants are "Web Inspector Relay" constants shared between
+// the WebInspector framework on the OS X side, webinspectord, and
+// iOS WebKit on the device side.
+
+#define WIRSimulatorTCPPortNumber               27753
+#define WIRXPCMachPortName                      "com.apple.webinspector"
+#define WIRXPCDebuggerServiceName               "com.apple.webinspector.debugger"
+#define WIRServiceAvailableNotification         "com.apple.webinspectord.available"
+#define WIRServiceAvailabilityCheckNotification "com.apple.webinspectord.availability_check"
+#define WIRServiceEnabledNotification           "com.apple.webinspectord.enabled"
+#define WIRServiceDisabledNotification          "com.apple.webinspectord.disabled"
+#define WIRAutomaticInspectionEnabledState      "com.apple.webinspectord.automatic_inspection_enabled"
+
+
+#define WIRApplicationIdentifierKey             @"WIRApplicationIdentifierKey"
+#define WIRApplicationBundleIdentifierKey       @"WIRApplicationBundleIdentifierKey"
+#define WIRApplicationNameKey                   @"WIRApplicationNameKey"
+#define WIRIsApplicationProxyKey                @"WIRIsApplicationProxyKey"
+#define WIRIsApplicationActiveKey               @"WIRIsApplicationActiveKey"
+#define WIRHostApplicationIdentifierKey         @"WIRHostApplicationIdentifierKey"
+#define WIRHostApplicationNameKey               @"WIRHostApplicationNameKey"
+#define WIRConnectionIdentifierKey              @"WIRConnectionIdentifierKey"
+// COMPATABILITY(iOS 9): The key string is intentionally mismatched to support old relays.
+#define WIRTargetIdentifierKey                  @"WIRPageIdentifierKey"
+#define WIRHasLocalDebuggerKey                  @"WIRHasLocalDebuggerKey"
+#define WIRTitleKey                             @"WIRTitleKey"
+#define WIRURLKey                               @"WIRURLKey"
+#define WIRUserInfoKey                          @"WIRUserInfoKey"
+#define WIRApplicationDictionaryKey             @"WIRApplicationDictionaryKey"
+#define WIRMessageDataKey                       @"WIRMessageDataKey"
+#define WIRApplicationGetListingMessage         @"WIRApplicationGetListingMessage"
+#define WIRIndicateMessage                      @"WIRIndicateMessage"
+#define WIRIndicateEnabledKey                   @"WIRIndicateEnabledKey"
+#define WIRSenderKey                            @"WIRSenderKey"
+#define WIRSocketDataKey                        @"WIRSocketDataKey"
+#define WIRSocketDataMessage                    @"WIRSocketDataMessage"
+#define WIRSocketSetupMessage                   @"WIRSocketSetupMessage"
+#define WIRWebPageCloseMessage                  @"WIRWebPageCloseMessage"
+#define WIRRawDataMessage                       @"WIRRawDataMessage"
+#define WIRRawDataKey                           @"WIRRawDataKey"
+#define WIRListingMessage                       @"WIRListingMessage"
+#define WIRListingKey                           @"WIRListingKey"
+#define WIRRemoteAutomationEnabledKey           @"WIRRemoteAutomationEnabledKey"
+#define WIRDestinationKey                       @"WIRDestinationKey"
+#define WIRConnectionDiedMessage                @"WIRConnectionDiedMessage"
+#define WIRTypeKey                              @"WIRTypeKey"
+#define WIRTypeJavaScript                       @"WIRTypeJavaScript"
+#define WIRTypeWeb                              @"WIRTypeWeb"
+#define WIRTypeAutomation                       @"WIRTypeAutomation"
+#define WIRAutomaticallyPause                   @"WIRAutomaticallyPause"
+
+#define WIRAutomaticInspectionEnabledKey           @"WIRAutomaticInspectionEnabledKey"
+#define WIRAutomaticInspectionSessionIdentifierKey @"WIRAutomaticInspectionSessionIdentifierKey"
+#define WIRAutomaticInspectionConfigurationMessage @"WIRAutomaticInspectionConfigurationMessage"
+#define WIRAutomaticInspectionRejectMessage        @"WIRAutomaticInspectionRejectMessage"
+#define WIRAutomaticInspectionCandidateMessage     @"WIRAutomaticInspectionCandidateMessage"
+
+#define WIRAutomationTargetIsPairedKey             @"WIRAutomationTargetIsPairedKey"
+#define WIRSessionIdentifierKey                    @"WIRSessionIdentifierKey"
+#define WIRAutomationSessionRequestMessage         @"WIRAutomationSessionRequestMessage"
+
+// These definitions are shared with a Simulator webinspectord and
+// OS X process communicating with it.
+
+#define WIRSimulatorBuildKey                    @"WIRSimulatorBuildKey"
+#define WIRSimulatorProductVersionKey           @"WIRSimulatorProductVersionKey"
+#define WIRSimulatorNameKey                     @"WIRSimulatorNameKey"
+
+// These definitions are shared between webinspectord and WebKit.
+
+#define WIRPermissionDenied                     @"WIRPermissionDenied"
+#define WIRProxyApplicationParentPIDKey         @"WIRProxyApplicationParentPID"
+#define WIRProxyApplicationParentAuditDataKey   @"WIRProxyApplicationParentAuditData"
+#define WIRProxyApplicationSetupMessage         @"WIRProxyApplicationSetupMessage"
+#define WIRProxyApplicationSetupResponseMessage @"WIRProxyApplicationSetupResponseMessage"
diff --git a/inspector/remote/RemoteInspectorXPCConnection.h b/inspector/remote/RemoteInspectorXPCConnection.h
new file mode 100644
index 0000000..10eac17
--- /dev/null
+++ b/inspector/remote/RemoteInspectorXPCConnection.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#import <dispatch/dispatch.h>
+#import <wtf/Lock.h>
+#import <wtf/ThreadSafeRefCounted.h>
+#import <wtf/spi/darwin/XPCSPI.h>
+
+OBJC_CLASS NSDictionary;
+OBJC_CLASS NSString;
+
+namespace Inspector {
+
+class RemoteInspectorXPCConnection : public ThreadSafeRefCounted<RemoteInspectorXPCConnection> {
+public:
+    class Client {
+    public:
+        virtual ~Client() { }
+        virtual void xpcConnectionReceivedMessage(RemoteInspectorXPCConnection*, NSString *messageName, NSDictionary *userInfo) = 0;
+        virtual void xpcConnectionFailed(RemoteInspectorXPCConnection*) = 0;
+        virtual void xpcConnectionUnhandledMessage(RemoteInspectorXPCConnection*, xpc_object_t) = 0;
+    };
+
+    RemoteInspectorXPCConnection(xpc_connection_t, dispatch_queue_t, Client*);
+    virtual ~RemoteInspectorXPCConnection();
+
+    void close();
+    void closeFromMessage();
+    void sendMessage(NSString *messageName, NSDictionary *userInfo);
+
+private:
+    NSDictionary *deserializeMessage(xpc_object_t);
+    void handleEvent(xpc_object_t);
+    void closeOnQueue();
+
+    // We handle XPC events on the queue, but a client may call close() on any queue.
+    // We make sure that m_client is thread safe and immediately cleared in close().
+    Lock m_mutex;
+
+    xpc_connection_t m_connection;
+    dispatch_queue_t m_queue;
+    Client* m_client;
+    bool m_closed { false };
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101200)
+    bool m_validated { false };
+#endif
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/remote/RemoteInspectorXPCConnection.mm b/inspector/remote/RemoteInspectorXPCConnection.mm
new file mode 100644
index 0000000..7660994
--- /dev/null
+++ b/inspector/remote/RemoteInspectorXPCConnection.mm
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "RemoteInspectorXPCConnection.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#import <Foundation/Foundation.h>
+#import <mutex>
+#import <wtf/Assertions.h>
+#import <wtf/Lock.h>
+#import <wtf/Ref.h>
+#import <wtf/RetainPtr.h>
+#import <wtf/spi/cocoa/SecuritySPI.h>
+#import <wtf/spi/darwin/XPCSPI.h>
+
+#if USE(APPLE_INTERNAL_SDK)
+#import <CoreFoundation/CFXPCBridge.h>
+#else
+extern "C" {
+    xpc_object_t _CFXPCCreateXPCMessageWithCFObject(CFTypeRef);
+    CFTypeRef _CFXPCCreateCFObjectFromXPCMessage(xpc_object_t);
+}
+#endif
+
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101200)
+static bool auditTokenHasEntitlement(audit_token_t token, NSString *entitlement)
+{
+    auto task = adoptCF(SecTaskCreateWithAuditToken(kCFAllocatorDefault, token));
+    if (!task)
+        return false;
+
+    auto value = adoptCF(SecTaskCopyValueForEntitlement(task.get(), (CFStringRef)entitlement, nullptr));
+    if (!value)
+        return false;
+
+    if (CFGetTypeID(value.get()) != CFBooleanGetTypeID())
+        return false;
+
+    return CFBooleanGetValue(static_cast<CFBooleanRef>(value.get()));
+}
+#endif
+
+namespace Inspector {
+
+// Constants private to this file for message serialization on both ends.
+#define RemoteInspectorXPCConnectionMessageNameKey @"messageName"
+#define RemoteInspectorXPCConnectionUserInfoKey @"userInfo"
+#define RemoteInspectorXPCConnectionSerializedMessageKey "msgData"
+
+RemoteInspectorXPCConnection::RemoteInspectorXPCConnection(xpc_connection_t connection, dispatch_queue_t queue, Client* client)
+    : m_connection(connection)
+    , m_queue(queue)
+    , m_client(client)
+{
+    dispatch_retain(m_queue);
+
+    xpc_retain(m_connection);
+    xpc_connection_set_target_queue(m_connection, m_queue);
+    xpc_connection_set_event_handler(m_connection, ^(xpc_object_t object) {
+        handleEvent(object);
+    });
+
+    // Balanced by deref when the xpc_connection receives XPC_ERROR_CONNECTION_INVALID.
+    ref();
+
+    xpc_connection_resume(m_connection);
+}
+
+RemoteInspectorXPCConnection::~RemoteInspectorXPCConnection()
+{
+    ASSERT(!m_client);
+    ASSERT(!m_connection);
+    ASSERT(m_closed);
+}
+
+void RemoteInspectorXPCConnection::close()
+{
+    std::lock_guard<Lock> lock(m_mutex);
+    closeFromMessage();
+}
+
+void RemoteInspectorXPCConnection::closeFromMessage()
+{
+    m_closed = true;
+    m_client = nullptr;
+
+    dispatch_async(m_queue, ^{
+        std::lock_guard<Lock> lock(m_mutex);
+        // This will trigger one last XPC_ERROR_CONNECTION_INVALID event on the queue and deref us.
+        closeOnQueue();
+    });
+}
+
+void RemoteInspectorXPCConnection::closeOnQueue()
+{
+    if (m_connection) {
+        xpc_connection_cancel(m_connection);
+        xpc_release(m_connection);
+        m_connection = nullptr;
+    }
+
+    if (m_queue) {
+        dispatch_release(m_queue);
+        m_queue = nullptr;
+    }
+}
+
+NSDictionary *RemoteInspectorXPCConnection::deserializeMessage(xpc_object_t object)
+{
+    if (xpc_get_type(object) != XPC_TYPE_DICTIONARY)
+        return nil;
+
+    xpc_object_t xpcDictionary = xpc_dictionary_get_value(object, RemoteInspectorXPCConnectionSerializedMessageKey);
+    if (!xpcDictionary || xpc_get_type(xpcDictionary) != XPC_TYPE_DICTIONARY) {
+        std::lock_guard<Lock> lock(m_mutex);
+        if (m_client)
+            m_client->xpcConnectionUnhandledMessage(this, object);
+        return nil;
+    }
+
+    RetainPtr<CFDictionaryRef> dictionary = adoptCF((CFDictionaryRef)_CFXPCCreateCFObjectFromXPCMessage(xpcDictionary));
+    ASSERT_WITH_MESSAGE(dictionary, "Unable to deserialize xpc message");
+    return (NSDictionary *)dictionary.autorelease();
+}
+
+void RemoteInspectorXPCConnection::handleEvent(xpc_object_t object)
+{
+    if (xpc_get_type(object) == XPC_TYPE_ERROR) {
+        {
+            std::lock_guard<Lock> lock(m_mutex);
+            if (m_client)
+                m_client->xpcConnectionFailed(this);
+
+            m_closed = true;
+            m_client = nullptr;
+            closeOnQueue();
+        }
+
+        if (object == XPC_ERROR_CONNECTION_INVALID) {
+            // This is the last event we will ever receive from the connection.
+            // This balances the ref() in the constructor.
+            deref();
+        }
+        return;
+    }
+
+#if (PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101200)
+    if (!m_validated) {
+        audit_token_t token;
+        xpc_connection_get_audit_token(m_connection, &token);
+        if (!auditTokenHasEntitlement(token, @"com.apple.private.webinspector.webinspectord")) {
+            std::lock_guard<Lock> lock(m_mutex);
+            // This will trigger one last XPC_ERROR_CONNECTION_INVALID event on the queue and deref us.
+            closeOnQueue();
+            return;
+        }
+        m_validated = true;
+    }
+#endif
+
+    NSDictionary *dataDictionary = deserializeMessage(object);
+    if (!dataDictionary)
+        return;
+
+    NSString *message = [dataDictionary objectForKey:RemoteInspectorXPCConnectionMessageNameKey];
+    NSDictionary *userInfo = [dataDictionary objectForKey:RemoteInspectorXPCConnectionUserInfoKey];
+    std::lock_guard<Lock> lock(m_mutex);
+    if (m_client)
+        m_client->xpcConnectionReceivedMessage(this, message, userInfo);
+}
+
+void RemoteInspectorXPCConnection::sendMessage(NSString *messageName, NSDictionary *userInfo)
+{
+    ASSERT(!m_closed);
+    if (m_closed)
+        return;
+
+    NSMutableDictionary *dictionary = [NSMutableDictionary dictionaryWithObject:messageName forKey:RemoteInspectorXPCConnectionMessageNameKey];
+    if (userInfo)
+        [dictionary setObject:userInfo forKey:RemoteInspectorXPCConnectionUserInfoKey];
+
+    xpc_object_t xpcDictionary = _CFXPCCreateXPCMessageWithCFObject((CFDictionaryRef)dictionary);
+    ASSERT_WITH_MESSAGE(xpcDictionary && xpc_get_type(xpcDictionary) == XPC_TYPE_DICTIONARY, "Unable to serialize xpc message");
+    if (!xpcDictionary)
+        return;
+
+    xpc_object_t msg = xpc_dictionary_create(nullptr, nullptr, 0);
+    xpc_dictionary_set_value(msg, RemoteInspectorXPCConnectionSerializedMessageKey, xpcDictionary);
+    xpc_release(xpcDictionary);
+
+    xpc_connection_send_message(m_connection, msg);
+
+    xpc_release(msg);
+}
+
+} // namespace Inspector
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/inspector/scripts/codegen/__init__.py b/inspector/scripts/codegen/__init__.py
new file mode 100644
index 0000000..37dbe94
--- /dev/null
+++ b/inspector/scripts/codegen/__init__.py
@@ -0,0 +1,25 @@
+# Required for Python to search this directory for module files
+
+from models import *
+from generator import *
+from cpp_generator import *
+from objc_generator import *
+
+from generate_cpp_alternate_backend_dispatcher_header import *
+from generate_cpp_backend_dispatcher_header import *
+from generate_cpp_backend_dispatcher_implementation import *
+from generate_cpp_frontend_dispatcher_header import *
+from generate_cpp_frontend_dispatcher_implementation import *
+from generate_cpp_protocol_types_header import *
+from generate_cpp_protocol_types_implementation import *
+from generate_js_backend_commands import *
+from generate_objc_backend_dispatcher_header import *
+from generate_objc_backend_dispatcher_implementation import *
+from generate_objc_configuration_header import *
+from generate_objc_configuration_implementation import *
+from generate_objc_frontend_dispatcher_implementation import *
+from generate_objc_header import *
+from generate_objc_internal_header import *
+from generate_objc_protocol_types_implementation import *
+from generate_objc_protocol_type_conversions_header import *
+from generate_objc_protocol_type_conversions_implementation import *
diff --git a/inspector/scripts/codegen/cpp_generator.py b/inspector/scripts/codegen/cpp_generator.py
new file mode 100644
index 0000000..347d0a2
--- /dev/null
+++ b/inspector/scripts/codegen/cpp_generator.py
@@ -0,0 +1,319 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+import logging
+import os.path
+import re
+
+from generator import ucfirst, Generator
+from models import PrimitiveType, ObjectType, ArrayType, EnumType, AliasedType, Frameworks
+
+log = logging.getLogger('global')
+
+_PRIMITIVE_TO_CPP_NAME_MAP = {
+    'boolean': 'bool',
+    'integer': 'int',
+    'number': 'double',
+    'string': 'String',
+    'object': 'Inspector::InspectorObject',
+    'array': 'Inspector::InspectorArray',
+    'any': 'Inspector::InspectorValue'
+}
+
+class CppGenerator(Generator):
+    def __init__(self, model, input_filepath):
+        Generator.__init__(self, model, input_filepath)
+
+    def protocol_name(self):
+        return self.model().framework.setting('cpp_protocol_group', '')
+
+    def helpers_namespace(self):
+        return '%sHelpers' % self.protocol_name()
+
+    # Miscellaneous text manipulation routines.
+    @staticmethod
+    def cpp_getter_method_for_type(_type):
+        if isinstance(_type, ObjectType):
+            return 'getObject'
+        if isinstance(_type, ArrayType):
+            return 'getArray'
+        if isinstance(_type, PrimitiveType):
+            if _type.raw_name() is 'integer':
+                return 'getInteger'
+            elif _type.raw_name() is 'number':
+                return 'getDouble'
+            elif _type.raw_name() is 'any':
+                return 'getValue'
+            else:
+                return 'get' + ucfirst(_type.raw_name())
+        if isinstance(_type, AliasedType):
+            return CppGenerator.cpp_getter_method_for_type(_type.aliased_type)
+        if isinstance(_type, EnumType):
+            return CppGenerator.cpp_getter_method_for_type(_type.primitive_type)
+
+    @staticmethod
+    def cpp_setter_method_for_type(_type):
+        if isinstance(_type, ObjectType):
+            return 'setObject'
+        if isinstance(_type, ArrayType):
+            return 'setArray'
+        if isinstance(_type, PrimitiveType):
+            if _type.raw_name() is 'integer':
+                return 'setInteger'
+            elif _type.raw_name() is 'number':
+                return 'setDouble'
+            elif _type.raw_name() is 'any':
+                return 'setValue'
+            else:
+                return 'set' + ucfirst(_type.raw_name())
+        if isinstance(_type, AliasedType):
+            return CppGenerator.cpp_setter_method_for_type(_type.aliased_type)
+        if isinstance(_type, EnumType):
+            return CppGenerator.cpp_setter_method_for_type(_type.primitive_type)
+
+    # Generate type representations for various situations.
+    @staticmethod
+    def cpp_protocol_type_for_type(_type):
+        if isinstance(_type, ObjectType) and len(_type.members) == 0:
+            return 'Inspector::InspectorObject'
+        if isinstance(_type, ArrayType):
+            if _type.raw_name() is None:  # Otherwise, fall through and use typedef'd name.
+                return 'Inspector::Protocol::Array<%s>' % CppGenerator.cpp_protocol_type_for_type(_type.element_type)
+        if isinstance(_type, (ObjectType, AliasedType, EnumType, ArrayType)):
+            return 'Inspector::Protocol::%s::%s' % (_type.type_domain().domain_name, _type.raw_name())
+        if isinstance(_type, PrimitiveType):
+            return CppGenerator.cpp_name_for_primitive_type(_type)
+
+    @staticmethod
+    def cpp_protocol_type_for_type_member(type_member, object_declaration):
+        if isinstance(type_member.type, EnumType) and type_member.type.is_anonymous:
+            return '::'.join([CppGenerator.cpp_protocol_type_for_type(object_declaration.type), ucfirst(type_member.member_name)])
+        else:
+            return CppGenerator.cpp_protocol_type_for_type(type_member.type)
+
+    @staticmethod
+    def cpp_type_for_unchecked_formal_in_parameter(parameter):
+        _type = parameter.type
+        if isinstance(_type, AliasedType):
+            _type = _type.aliased_type  # Fall through to enum or primitive.
+
+        if isinstance(_type, EnumType):
+            _type = _type.primitive_type  # Fall through to primitive.
+
+        # This handles the 'any' type and objects with defined properties.
+        if isinstance(_type, ObjectType) or _type.qualified_name() is 'object':
+            cpp_name = 'Inspector::InspectorObject'
+            if parameter.is_optional:
+                return 'const %s*' % cpp_name
+            else:
+                return 'const %s&' % cpp_name
+        if isinstance(_type, ArrayType):
+            cpp_name = 'Inspector::InspectorArray'
+            if parameter.is_optional:
+                return 'const %s*' % cpp_name
+            else:
+                return 'const %s&' % cpp_name
+        if isinstance(_type, PrimitiveType):
+            cpp_name = CppGenerator.cpp_name_for_primitive_type(_type)
+            if parameter.is_optional:
+                return 'const %s*' % cpp_name
+            elif _type.raw_name() in ['string']:
+                return 'const %s&' % cpp_name
+            else:
+                return cpp_name
+
+        return "unknown_unchecked_formal_in_parameter_type"
+
+    @staticmethod
+    def cpp_type_for_checked_formal_event_parameter(parameter):
+        return CppGenerator.cpp_type_for_type_with_name(parameter.type, parameter.parameter_name, parameter.is_optional)
+
+    @staticmethod
+    def cpp_type_for_type_member(member):
+        return CppGenerator.cpp_type_for_type_with_name(member.type, member.member_name, False)
+
+    @staticmethod
+    def cpp_type_for_type_with_name(_type, type_name, is_optional):
+        if isinstance(_type, (ArrayType, ObjectType)):
+            return 'RefPtr<%s>' % CppGenerator.cpp_protocol_type_for_type(_type)
+        if isinstance(_type, AliasedType):
+            builder_type = CppGenerator.cpp_protocol_type_for_type(_type)
+            if is_optional:
+                return 'const %s* const' % builder_type
+            elif _type.aliased_type.qualified_name() in ['integer', 'number']:
+                return CppGenerator.cpp_name_for_primitive_type(_type.aliased_type)
+            elif _type.aliased_type.qualified_name() in ['string']:
+                return 'const %s&' % builder_type
+            else:
+                return builder_type
+        if isinstance(_type, PrimitiveType):
+            cpp_name = CppGenerator.cpp_name_for_primitive_type(_type)
+            if _type.qualified_name() in ['object']:
+                return 'RefPtr<Inspector::InspectorObject>'
+            elif _type.qualified_name() in ['any']:
+                return 'RefPtr<Inspector::InspectorValue>'
+            elif is_optional:
+                return 'const %s* const' % cpp_name
+            elif _type.qualified_name() in ['string']:
+                return 'const %s&' % cpp_name
+            else:
+                return cpp_name
+        if isinstance(_type, EnumType):
+            if _type.is_anonymous:
+                enum_type_name = ucfirst(type_name)
+            else:
+                enum_type_name = 'Inspector::Protocol::%s::%s' % (_type.type_domain().domain_name, _type.raw_name())
+
+            if is_optional:
+                return '%s*' % enum_type_name
+            else:
+                return '%s' % enum_type_name
+
+    @staticmethod
+    def cpp_type_for_formal_out_parameter(parameter):
+        _type = parameter.type
+
+        if isinstance(_type, AliasedType):
+            _type = _type.aliased_type  # Fall through.
+
+        if isinstance(_type, (ObjectType, ArrayType)):
+            return 'RefPtr<%s>&' % CppGenerator.cpp_protocol_type_for_type(_type)
+        if isinstance(_type, PrimitiveType):
+            cpp_name = CppGenerator.cpp_name_for_primitive_type(_type)
+            if parameter.is_optional:
+                return "Inspector::Protocol::OptOutput<%s>*" % cpp_name
+            else:
+                return '%s*' % cpp_name
+        if isinstance(_type, EnumType):
+            if _type.is_anonymous:
+                return '%sBackendDispatcherHandler::%s*' % (_type.type_domain().domain_name, ucfirst(parameter.parameter_name))
+            else:
+                return 'Inspector::Protocol::%s::%s*' % (_type.type_domain().domain_name, _type.raw_name())
+
+        raise ValueError("unknown formal out parameter type.")
+
+    # FIXME: this is only slightly different from out parameters; they could be unified.
+    @staticmethod
+    def cpp_type_for_formal_async_parameter(parameter):
+        _type = parameter.type
+        if isinstance(_type, AliasedType):
+            _type = _type.aliased_type  # Fall through.
+
+        if isinstance(_type, EnumType):
+            _type = _type.primitive_type  # Fall through.
+
+        if isinstance(_type, (ObjectType, ArrayType)):
+            return 'RefPtr<%s>&&' % CppGenerator.cpp_protocol_type_for_type(_type)
+        if isinstance(_type, PrimitiveType):
+            cpp_name = CppGenerator.cpp_name_for_primitive_type(_type)
+            if parameter.is_optional:
+                return "Inspector::Protocol::OptOutput<%s>*" % cpp_name
+            elif _type.qualified_name() in ['integer', 'number']:
+                return CppGenerator.cpp_name_for_primitive_type(_type)
+            elif _type.qualified_name() in ['string']:
+                return 'const %s&' % cpp_name
+            else:
+                return cpp_name
+
+        raise ValueError("Unknown formal async parameter type.")
+
+    # In-parameters don't use builder types, because they could be passed
+    # "open types" that are manually constructed out of InspectorObjects.
+
+    # FIXME: Only parameters that are actually open types should need non-builder parameter types.
+    @staticmethod
+    def cpp_type_for_stack_in_parameter(parameter):
+        _type = parameter.type
+        if isinstance(_type, AliasedType):
+            _type = _type.aliased_type  # Fall through.
+
+        if isinstance(_type, EnumType):
+            _type = _type.primitive_type  # Fall through.
+
+        if isinstance(_type, ObjectType):
+            return "RefPtr<Inspector::InspectorObject>"
+        if isinstance(_type, ArrayType):
+            return "RefPtr<Inspector::InspectorArray>"
+        if isinstance(_type, PrimitiveType):
+            cpp_name = CppGenerator.cpp_name_for_primitive_type(_type)
+            if _type.qualified_name() in ['any', 'object']:
+                return "RefPtr<%s>" % CppGenerator.cpp_name_for_primitive_type(_type)
+            elif parameter.is_optional and _type.qualified_name() not in ['boolean', 'string', 'integer']:
+                return "Inspector::Protocol::OptOutput<%s>" % cpp_name
+            else:
+                return cpp_name
+
+    @staticmethod
+    def cpp_type_for_stack_out_parameter(parameter):
+        _type = parameter.type
+        if isinstance(_type, (ArrayType, ObjectType)):
+            return 'RefPtr<%s>' % CppGenerator.cpp_protocol_type_for_type(_type)
+        if isinstance(_type, AliasedType):
+            builder_type = CppGenerator.cpp_protocol_type_for_type(_type)
+            if parameter.is_optional:
+                return "Inspector::Protocol::OptOutput<%s>" % builder_type
+            return '%s' % builder_type
+        if isinstance(_type, PrimitiveType):
+            cpp_name = CppGenerator.cpp_name_for_primitive_type(_type)
+            if parameter.is_optional:
+                return "Inspector::Protocol::OptOutput<%s>" % cpp_name
+            else:
+                return cpp_name
+        if isinstance(_type, EnumType):
+            if _type.is_anonymous:
+                return '%sBackendDispatcherHandler::%s' % (_type.type_domain().domain_name, ucfirst(parameter.parameter_name))
+            else:
+                return 'Inspector::Protocol::%s::%s' % (_type.type_domain().domain_name, _type.raw_name())
+
+    @staticmethod
+    def cpp_assertion_method_for_type_member(type_member, object_declaration):
+
+        def assertion_method_for_type(_type):
+            return 'BindingTraits<%s>::assertValueHasExpectedType' % CppGenerator.cpp_protocol_type_for_type(_type)
+
+        if isinstance(type_member.type, AliasedType):
+            return assertion_method_for_type(type_member.type.aliased_type)
+        if isinstance(type_member.type, EnumType) and type_member.type.is_anonymous:
+            return 'BindingTraits<%s>::assertValueHasExpectedType' % CppGenerator.cpp_protocol_type_for_type_member(type_member, object_declaration)
+
+        return assertion_method_for_type(type_member.type)
+
+    @staticmethod
+    def cpp_name_for_primitive_type(_type):
+        return _PRIMITIVE_TO_CPP_NAME_MAP.get(_type.raw_name())
+
+    # Decide whether certain helpers are necessary in a situation.
+    @staticmethod
+    def should_use_wrapper_for_return_type(_type):
+        return not isinstance(_type, (ArrayType, ObjectType))
+
+    @staticmethod
+    def should_use_references_for_type(_type):
+        return isinstance(_type, (ArrayType, ObjectType)) or (isinstance(_type, (PrimitiveType)) and _type.qualified_name() in ["any", "object"])
+
+    @staticmethod
+    def should_pass_by_copy_for_return_type(_type):
+        return isinstance(_type, (ArrayType, ObjectType)) or (isinstance(_type, (PrimitiveType)) and _type.qualified_name() == "object")
diff --git a/inspector/scripts/codegen/cpp_generator_templates.py b/inspector/scripts/codegen/cpp_generator_templates.py
new file mode 100755
index 0000000..b2523ff
--- /dev/null
+++ b/inspector/scripts/codegen/cpp_generator_templates.py
@@ -0,0 +1,258 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2015 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Generator templates, which can be filled with string.Template.
+# Following are classes that fill the templates from the typechecked model.
+
+class CppGeneratorTemplates:
+
+    HeaderPrelude = (
+    """#pragma once
+
+${includes}
+
+namespace Inspector {
+
+${typedefs}""")
+
+    HeaderPostlude = (
+    """} // namespace Inspector""")
+
+    ImplementationPrelude = (
+    """#include "config.h"
+#include ${primaryInclude}
+
+${secondaryIncludes}
+
+namespace Inspector {""")
+
+    ImplementationPostlude = (
+    """} // namespace Inspector
+""")
+
+    AlternateDispatchersHeaderPrelude = (
+    """#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+${includes}
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+""")
+
+    AlternateDispatchersHeaderPostlude = (
+    """} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)""")
+
+    AlternateBackendDispatcherHeaderDomainHandlerInterfaceDeclaration = (
+    """class Alternate${domainName}BackendDispatcher : public AlternateBackendDispatcher {
+public:
+    virtual ~Alternate${domainName}BackendDispatcher() { }
+${commandDeclarations}
+};""")
+
+    BackendDispatcherHeaderDomainHandlerDeclaration = (
+    """${classAndExportMacro} ${domainName}BackendDispatcherHandler {
+public:
+${commandDeclarations}
+protected:
+    virtual ~${domainName}BackendDispatcherHandler();
+};""")
+
+    BackendDispatcherHeaderDomainDispatcherDeclaration = (
+    """${classAndExportMacro} ${domainName}BackendDispatcher final : public SupplementalBackendDispatcher {
+public:
+    static Ref<${domainName}BackendDispatcher> create(BackendDispatcher&, ${domainName}BackendDispatcherHandler*);
+    void dispatch(long requestId, const String& method, Ref<InspectorObject>&& message) override;
+${commandDeclarations}
+private:
+    ${domainName}BackendDispatcher(BackendDispatcher&, ${domainName}BackendDispatcherHandler*);
+    ${domainName}BackendDispatcherHandler* m_agent { nullptr };
+};""")
+
+    BackendDispatcherHeaderDomainDispatcherAlternatesDeclaration = (
+    """#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+public:
+    void setAlternateDispatcher(Alternate${domainName}BackendDispatcher* alternateDispatcher) { m_alternateDispatcher = alternateDispatcher; }
+private:
+    Alternate${domainName}BackendDispatcher* m_alternateDispatcher { nullptr };
+#endif""")
+
+    BackendDispatcherHeaderAsyncCommandDeclaration = (
+    """    ${classAndExportMacro} ${callbackName} : public BackendDispatcher::CallbackBase {
+    public:
+        ${callbackName}(Ref<BackendDispatcher>&&, int id);
+        void sendSuccess(${outParameters});
+    };
+    virtual void ${commandName}(${inParameters}) = 0;""")
+
+    BackendDispatcherImplementationSmallSwitch = (
+    """void ${domainName}BackendDispatcher::dispatch(long requestId, const String& method, Ref<InspectorObject>&& message)
+{
+    Ref<${domainName}BackendDispatcher> protect(*this);
+
+    RefPtr<InspectorObject> parameters;
+    message->getObject(ASCIILiteral("params"), parameters);
+
+${dispatchCases}
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::MethodNotFound, makeString('\\'', "${domainName}", '.', method, "' was not found"));
+}""")
+
+    BackendDispatcherImplementationLargeSwitch = (
+"""void ${domainName}BackendDispatcher::dispatch(long requestId, const String& method, Ref<InspectorObject>&& message)
+{
+    Ref<${domainName}BackendDispatcher> protect(*this);
+
+    RefPtr<InspectorObject> parameters;
+    message->getObject(ASCIILiteral("params"), parameters);
+
+    typedef void (${domainName}BackendDispatcher::*CallHandler)(long requestId, RefPtr<InspectorObject>&& message);
+    typedef HashMap<String, CallHandler> DispatchMap;
+    static NeverDestroyed<DispatchMap> dispatchMap;
+    if (dispatchMap.get().isEmpty()) {
+        static const struct MethodTable {
+            const char* name;
+            CallHandler handler;
+        } commands[] = {
+${dispatchCases}
+        };
+        size_t length = WTF_ARRAY_LENGTH(commands);
+        for (size_t i = 0; i < length; ++i)
+            dispatchMap.get().add(commands[i].name, commands[i].handler);
+    }
+
+    auto findResult = dispatchMap.get().find(method);
+    if (findResult == dispatchMap.get().end()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::MethodNotFound, makeString('\\'', "${domainName}", '.', method, "' was not found"));
+        return;
+    }
+
+    ((*this).*findResult->value)(requestId, WTFMove(parameters));
+}""")
+
+    BackendDispatcherImplementationDomainConstructor = (
+    """Ref<${domainName}BackendDispatcher> ${domainName}BackendDispatcher::create(BackendDispatcher& backendDispatcher, ${domainName}BackendDispatcherHandler* agent)
+{
+    return adoptRef(*new ${domainName}BackendDispatcher(backendDispatcher, agent));
+}
+
+${domainName}BackendDispatcher::${domainName}BackendDispatcher(BackendDispatcher& backendDispatcher, ${domainName}BackendDispatcherHandler* agent)
+    : SupplementalBackendDispatcher(backendDispatcher)
+    , m_agent(agent)
+{
+    m_backendDispatcher->registerDispatcherForDomain(ASCIILiteral("${domainName}"), this);
+}""")
+
+    BackendDispatcherImplementationPrepareCommandArguments = (
+"""${inParameterDeclarations}
+    if (m_backendDispatcher->hasProtocolErrors()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::InvalidParams, String::format("Some arguments of method \'%s\' can't be processed", "${domainName}.${commandName}"));
+        return;
+    }
+""")
+
+    BackendDispatcherImplementationAsyncCommand = (
+"""${domainName}BackendDispatcherHandler::${callbackName}::${callbackName}(Ref<BackendDispatcher>&& backendDispatcher, int id) : BackendDispatcher::CallbackBase(WTFMove(backendDispatcher), id) { }
+
+void ${domainName}BackendDispatcherHandler::${callbackName}::sendSuccess(${formalParameters})
+{
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+${outParameterAssignments}
+    CallbackBase::sendSuccess(WTFMove(jsonMessage));
+}""")
+
+    FrontendDispatcherDomainDispatcherDeclaration = (
+"""${classAndExportMacro} ${domainName}FrontendDispatcher {
+public:
+    ${domainName}FrontendDispatcher(FrontendRouter& frontendRouter) : m_frontendRouter(frontendRouter) { }
+${eventDeclarations}
+private:
+    FrontendRouter& m_frontendRouter;
+};""")
+
+    ProtocolObjectBuilderDeclarationPrelude = (
+"""    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*${objectType}*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class ${objectType};
+    public:""")
+
+    ProtocolObjectBuilderDeclarationPostlude = (
+"""
+        Ref<${objectType}> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(${objectType}) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<${objectType}>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+${constructorExample}
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }""")
+
+    ProtocolObjectRuntimeCast = (
+"""RefPtr<${objectType}> BindingTraits<${objectType}>::runtimeCast(RefPtr<InspectorValue>&& value)
+{
+    RefPtr<InspectorObject> result;
+    bool castSucceeded = value->asObject(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+#if !ASSERT_DISABLED
+    BindingTraits<${objectType}>::assertValueHasExpectedType(result.get());
+#endif  // !ASSERT_DISABLED
+    COMPILE_ASSERT(sizeof(${objectType}) == sizeof(InspectorObjectBase), type_cast_problem);
+    return static_cast<${objectType}*>(static_cast<InspectorObjectBase*>(result.get()));
+}
+""")
diff --git a/inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py b/inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py
new file mode 100755
index 0000000..2975615
--- /dev/null
+++ b/inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+import re
+from string import Template
+
+from cpp_generator import CppGenerator
+from cpp_generator_templates import CppGeneratorTemplates as CppTemplates
+
+log = logging.getLogger('global')
+
+
+class CppAlternateBackendDispatcherHeaderGenerator(CppGenerator):
+    def __init__(self, model, input_filepath):
+        CppGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sAlternateBackendDispatchers.h' % self.protocol_name()
+
+    def generate_output(self):
+        headers = [
+            '"%sProtocolTypes.h"' % self.protocol_name(),
+            '<inspector/InspectorFrontendRouter.h>',
+            '<JavaScriptCore/InspectorBackendDispatcher.h>',
+        ]
+
+        header_args = {
+            'includes': '\n'.join(['#include ' + header for header in headers]),
+        }
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(CppTemplates.AlternateDispatchersHeaderPrelude).substitute(None, **header_args))
+        sections.append('\n'.join(filter(None, map(self._generate_handler_declarations_for_domain, domains))))
+        sections.append(Template(CppTemplates.AlternateDispatchersHeaderPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_handler_declarations_for_domain(self, domain):
+        if not domain.commands:
+            return ''
+
+        command_declarations = []
+        for command in domain.commands:
+            command_declarations.append(self._generate_handler_declaration_for_command(command))
+
+        handler_args = {
+            'domainName': domain.domain_name,
+            'commandDeclarations': '\n'.join(command_declarations),
+        }
+
+        return self.wrap_with_guard_for_domain(domain, Template(CppTemplates.AlternateBackendDispatcherHeaderDomainHandlerInterfaceDeclaration).substitute(None, **handler_args))
+
+    def _generate_handler_declaration_for_command(self, command):
+        lines = []
+        parameters = ['long callId']
+        for _parameter in command.call_parameters:
+            parameters.append('%s in_%s' % (CppGenerator.cpp_type_for_unchecked_formal_in_parameter(_parameter), _parameter.parameter_name))
+
+        command_args = {
+            'commandName': command.command_name,
+            'parameters': ', '.join(parameters),
+        }
+        lines.append('    virtual void %(commandName)s(%(parameters)s) = 0;' % command_args)
+        return '\n'.join(lines)
diff --git a/inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py b/inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py
new file mode 100755
index 0000000..8503f6b
--- /dev/null
+++ b/inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py
@@ -0,0 +1,216 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014-2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import re
+import string
+from string import Template
+
+from cpp_generator import CppGenerator
+from cpp_generator_templates import CppGeneratorTemplates as CppTemplates
+from generator import Generator, ucfirst
+from models import EnumType
+
+log = logging.getLogger('global')
+
+
+class CppBackendDispatcherHeaderGenerator(CppGenerator):
+    def __init__(self, model, input_filepath):
+        CppGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return "%sBackendDispatchers.h" % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(lambda domain: len(domain.commands) > 0, Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        headers = [
+            '"%sProtocolObjects.h"' % self.protocol_name(),
+            '<inspector/InspectorBackendDispatcher.h>',
+            '<wtf/text/WTFString.h>']
+
+        typedefs = [('String', 'ErrorString')]
+
+        header_args = {
+            'includes': '\n'.join(['#include ' + header for header in headers]),
+            'typedefs': '\n'.join(['typedef %s %s;' % typedef for typedef in typedefs]),
+        }
+
+        domains = self.domains_to_generate()
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(CppTemplates.HeaderPrelude).substitute(None, **header_args))
+        if self.model().framework.setting('alternate_dispatchers', False):
+            sections.append(self._generate_alternate_handler_forward_declarations_for_domains(domains))
+        sections.extend(map(self._generate_handler_declarations_for_domain, domains))
+        sections.extend(map(self._generate_dispatcher_declarations_for_domain, domains))
+        sections.append(Template(CppTemplates.HeaderPostlude).substitute(None, **header_args))
+        return "\n\n".join(sections)
+
+    # Private methods.
+
+    def _generate_alternate_handler_forward_declarations_for_domains(self, domains):
+        if not domains:
+            return ''
+
+        lines = []
+        lines.append('#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)')
+        for domain in domains:
+            lines.append(self.wrap_with_guard_for_domain(domain, 'class Alternate%sBackendDispatcher;' % domain.domain_name))
+        lines.append('#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)')
+        return '\n'.join(lines)
+
+    def _generate_handler_declarations_for_domain(self, domain):
+        classComponents = ['class']
+        exportMacro = self.model().framework.setting('export_macro', None)
+        if exportMacro is not None:
+            classComponents.append(exportMacro)
+
+        used_enum_names = set()
+
+        command_declarations = []
+        for command in domain.commands:
+            command_declarations.append(self._generate_handler_declaration_for_command(command, used_enum_names))
+
+        handler_args = {
+            'classAndExportMacro': " ".join(classComponents),
+            'domainName': domain.domain_name,
+            'commandDeclarations': "\n".join(command_declarations)
+        }
+
+        return self.wrap_with_guard_for_domain(domain, Template(CppTemplates.BackendDispatcherHeaderDomainHandlerDeclaration).substitute(None, **handler_args))
+
+    def _generate_anonymous_enum_for_parameter(self, parameter, command):
+        enum_args = {
+            'parameterName': parameter.parameter_name,
+            'commandName': command.command_name
+        }
+
+        lines = []
+        lines.append('    // Named after parameter \'%(parameterName)s\' while generating command/event %(commandName)s.' % enum_args)
+        lines.append('    enum class %s {' % ucfirst(parameter.parameter_name))
+        for enum_value in parameter.type.enum_values():
+            lines.append('        %s = %d,' % (Generator.stylized_name_for_enum_value(enum_value), self.encoding_for_enum_value(enum_value)))
+        lines.append('    }; // enum class %s' % ucfirst(parameter.parameter_name))
+        return '\n'.join(lines)
+
+    def _generate_handler_declaration_for_command(self, command, used_enum_names):
+        if command.is_async:
+            return self._generate_async_handler_declaration_for_command(command)
+
+        lines = []
+        parameters = ['ErrorString&']
+        for _parameter in command.call_parameters:
+            parameter_name = 'in_' + _parameter.parameter_name
+            if _parameter.is_optional:
+                parameter_name = 'opt_' + parameter_name
+
+            parameters.append("%s %s" % (CppGenerator.cpp_type_for_unchecked_formal_in_parameter(_parameter), parameter_name))
+
+            if isinstance(_parameter.type, EnumType) and _parameter.type.is_anonymous and _parameter.parameter_name not in used_enum_names:
+                lines.append(self._generate_anonymous_enum_for_parameter(_parameter, command))
+                used_enum_names.add(_parameter.parameter_name)
+
+        for _parameter in command.return_parameters:
+            parameter_name = 'out_' + _parameter.parameter_name
+            if _parameter.is_optional:
+                parameter_name = 'opt_' + parameter_name
+            parameters.append("%s %s" % (CppGenerator.cpp_type_for_formal_out_parameter(_parameter), parameter_name))
+
+            if isinstance(_parameter.type, EnumType) and _parameter.type.is_anonymous and _parameter.parameter_name not in used_enum_names:
+                lines.append(self._generate_anonymous_enum_for_parameter(_parameter, command))
+                used_enum_names.add(_parameter.parameter_name)
+
+        command_args = {
+            'commandName': command.command_name,
+            'parameters': ", ".join(parameters)
+        }
+        lines.append('    virtual void %(commandName)s(%(parameters)s) = 0;' % command_args)
+        return '\n'.join(lines)
+
+    def _generate_async_handler_declaration_for_command(self, command):
+        callbackName = "%sCallback" % ucfirst(command.command_name)
+
+        in_parameters = ['ErrorString&']
+        for _parameter in command.call_parameters:
+            parameter_name = 'in_' + _parameter.parameter_name
+            if _parameter.is_optional:
+                parameter_name = 'opt_' + parameter_name
+
+            in_parameters.append("%s %s" % (CppGenerator.cpp_type_for_unchecked_formal_in_parameter(_parameter), parameter_name))
+        in_parameters.append("Ref<%s>&& callback" % callbackName)
+
+        out_parameters = []
+        for _parameter in command.return_parameters:
+            out_parameters.append("%s %s" % (CppGenerator.cpp_type_for_formal_async_parameter(_parameter), _parameter.parameter_name))
+
+        class_components = ['class']
+        export_macro = self.model().framework.setting('export_macro', None)
+        if export_macro:
+            class_components.append(export_macro)
+
+        command_args = {
+            'classAndExportMacro': ' '.join(class_components),
+            'callbackName': callbackName,
+            'commandName': command.command_name,
+            'inParameters': ", ".join(in_parameters),
+            'outParameters': ", ".join(out_parameters),
+        }
+
+        return Template(CppTemplates.BackendDispatcherHeaderAsyncCommandDeclaration).substitute(None, **command_args)
+
+    def _generate_dispatcher_declarations_for_domain(self, domain):
+        classComponents = ['class']
+        exportMacro = self.model().framework.setting('export_macro', None)
+        if exportMacro is not None:
+            classComponents.append(exportMacro)
+
+        declarations = []
+        if len(domain.commands) > 0:
+            declarations.append('private:')
+        declarations.extend(map(self._generate_dispatcher_declaration_for_command, domain.commands))
+
+        declaration_args = {
+            'domainName': domain.domain_name,
+        }
+
+        # Add in a few more declarations at the end if needed.
+        if self.model().framework.setting('alternate_dispatchers', False):
+            declarations.append(Template(CppTemplates.BackendDispatcherHeaderDomainDispatcherAlternatesDeclaration).substitute(None, **declaration_args))
+
+        handler_args = {
+            'classAndExportMacro': " ".join(classComponents),
+            'domainName': domain.domain_name,
+            'commandDeclarations': "\n".join(declarations)
+        }
+
+        return self.wrap_with_guard_for_domain(domain, Template(CppTemplates.BackendDispatcherHeaderDomainDispatcherDeclaration).substitute(None, **handler_args))
+
+    def _generate_dispatcher_declaration_for_command(self, command):
+        return "    void %s(long requestId, RefPtr<InspectorObject>&& parameters);" % command.command_name
diff --git a/inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py b/inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py
new file mode 100755
index 0000000..9aecc4b
--- /dev/null
+++ b/inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py
@@ -0,0 +1,318 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014-2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from cpp_generator import CppGenerator
+from cpp_generator_templates import CppGeneratorTemplates as CppTemplates
+from generator import Generator, ucfirst
+from models import ObjectType, ArrayType
+
+log = logging.getLogger('global')
+
+
+class CppBackendDispatcherImplementationGenerator(CppGenerator):
+    def __init__(self, model, input_filepath):
+        CppGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return "%sBackendDispatchers.cpp" % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(lambda domain: len(domain.commands) > 0, Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        secondary_headers = [
+            '<inspector/InspectorFrontendRouter.h>',
+            '<inspector/InspectorValues.h>',
+            '<wtf/NeverDestroyed.h>',
+            '<wtf/text/CString.h>']
+
+        secondary_includes = ['#include %s' % header for header in secondary_headers]
+
+        if self.model().framework.setting('alternate_dispatchers', False):
+            secondary_includes.append('')
+            secondary_includes.append('#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)')
+            secondary_includes.append('#include "%sAlternateBackendDispatchers.h"' % self.protocol_name())
+            secondary_includes.append('#endif')
+
+        header_args = {
+            'primaryInclude': '"%sBackendDispatchers.h"' % self.protocol_name(),
+            'secondaryIncludes': '\n'.join(secondary_includes),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(CppTemplates.ImplementationPrelude).substitute(None, **header_args))
+        sections.append("\n".join(map(self._generate_handler_class_destructor_for_domain, self.domains_to_generate())))
+        sections.extend(map(self._generate_dispatcher_implementations_for_domain, self.domains_to_generate()))
+        sections.append(Template(CppTemplates.ImplementationPostlude).substitute(None, **header_args))
+        return "\n\n".join(sections)
+
+    # Private methods.
+
+    def _generate_handler_class_destructor_for_domain(self, domain):
+        destructor_args = {
+            'domainName': domain.domain_name
+        }
+        destructor = '%(domainName)sBackendDispatcherHandler::~%(domainName)sBackendDispatcherHandler() { }' % destructor_args
+        return self.wrap_with_guard_for_domain(domain, destructor)
+
+    def _generate_dispatcher_implementations_for_domain(self, domain):
+        implementations = []
+
+        constructor_args = {
+            'domainName': domain.domain_name,
+        }
+        implementations.append(Template(CppTemplates.BackendDispatcherImplementationDomainConstructor).substitute(None, **constructor_args))
+
+        if len(domain.commands) <= 5:
+            implementations.append(self._generate_small_dispatcher_switch_implementation_for_domain(domain))
+        else:
+            implementations.append(self._generate_large_dispatcher_switch_implementation_for_domain(domain))
+
+        for command in domain.commands:
+            if command.is_async:
+                implementations.append(self._generate_async_dispatcher_class_for_domain(command, domain))
+            implementations.append(self._generate_dispatcher_implementation_for_command(command, domain))
+
+        return self.wrap_with_guard_for_domain(domain, '\n\n'.join(implementations))
+
+    def _generate_small_dispatcher_switch_implementation_for_domain(self, domain):
+        cases = []
+        cases.append('    if (method == "%s")' % domain.commands[0].command_name)
+        cases.append('        %s(requestId, WTFMove(parameters));' % domain.commands[0].command_name)
+        for command in domain.commands[1:]:
+            cases.append('    else if (method == "%s")' % command.command_name)
+            cases.append('        %s(requestId, WTFMove(parameters));' % command.command_name)
+
+        switch_args = {
+            'domainName': domain.domain_name,
+            'dispatchCases': "\n".join(cases)
+        }
+
+        return Template(CppTemplates.BackendDispatcherImplementationSmallSwitch).substitute(None, **switch_args)
+
+    def _generate_large_dispatcher_switch_implementation_for_domain(self, domain):
+        cases = []
+        for command in domain.commands:
+            args = {
+                'domainName': domain.domain_name,
+                'commandName': command.command_name
+            }
+            cases.append('            { "%(commandName)s", &%(domainName)sBackendDispatcher::%(commandName)s },' % args)
+
+        switch_args = {
+            'domainName': domain.domain_name,
+            'dispatchCases': "\n".join(cases)
+        }
+
+        return Template(CppTemplates.BackendDispatcherImplementationLargeSwitch).substitute(None, **switch_args)
+
+    def _generate_async_dispatcher_class_for_domain(self, command, domain):
+        out_parameter_assignments = []
+        formal_parameters = []
+
+        for parameter in command.return_parameters:
+            param_args = {
+                'keyedSetMethod': CppGenerator.cpp_setter_method_for_type(parameter.type),
+                'parameterKey': parameter.parameter_name,
+                'parameterName': parameter.parameter_name,
+                'parameterType': CppGenerator.cpp_type_for_stack_in_parameter(parameter),
+                'helpersNamespace': self.helpers_namespace(),
+            }
+
+            formal_parameters.append('%s %s' % (CppGenerator.cpp_type_for_formal_async_parameter(parameter), parameter.parameter_name))
+
+            if parameter.is_optional:
+                if CppGenerator.should_use_wrapper_for_return_type(parameter.type):
+                    out_parameter_assignments.append('    if (%(parameterName)s.isAssigned())' % param_args)
+                    out_parameter_assignments.append('        jsonMessage->%(keyedSetMethod)s(ASCIILiteral("%(parameterKey)s"), %(parameterName)s.getValue());' % param_args)
+                else:
+                    out_parameter_assignments.append('    if (%(parameterName)s)' % param_args)
+                    out_parameter_assignments.append('        jsonMessage->%(keyedSetMethod)s(ASCIILiteral("%(parameterKey)s"), %(parameterName)s);' % param_args)
+            elif parameter.type.is_enum():
+                out_parameter_assignments.append('    jsonMessage->%(keyedSetMethod)s(ASCIILiteral("%(parameterKey)s"), Inspector::Protocol::%(helpersNamespace)s::getEnumConstantValue(%(parameterName)s));' % param_args)
+            else:
+                out_parameter_assignments.append('    jsonMessage->%(keyedSetMethod)s(ASCIILiteral("%(parameterKey)s"), %(parameterName)s);' % param_args)
+
+        async_args = {
+            'domainName': domain.domain_name,
+            'callbackName': ucfirst(command.command_name) + 'Callback',
+            'formalParameters': ", ".join(formal_parameters),
+            'outParameterAssignments': "\n".join(out_parameter_assignments)
+        }
+        return Template(CppTemplates.BackendDispatcherImplementationAsyncCommand).substitute(None, **async_args)
+
+    def _generate_dispatcher_implementation_for_command(self, command, domain):
+        in_parameter_declarations = []
+        out_parameter_declarations = []
+        out_parameter_assignments = []
+        alternate_dispatcher_method_parameters = ['requestId']
+        method_parameters = ['error']
+
+        for parameter in command.call_parameters:
+            parameter_name = 'in_' + parameter.parameter_name
+            if parameter.is_optional:
+                parameter_name = 'opt_' + parameter_name
+
+            out_success_argument = 'nullptr'
+            if parameter.is_optional:
+                out_success_argument = '&%s_valueFound' % parameter_name
+                in_parameter_declarations.append('    bool %s_valueFound = false;' % parameter_name)
+
+            # Now add appropriate operators.
+            parameter_expression = parameter_name
+
+            if CppGenerator.should_use_references_for_type(parameter.type):
+                if parameter.is_optional:
+                    parameter_expression = '%s.get()' % parameter_expression
+                else:
+                    # This assumes that we have already proved the object is non-null.
+                    # If a required property is missing, InspectorBackend::getObject will
+                    # append a protocol error, and the method dispatcher will return without
+                    # invoking the backend method (and dereferencing the object).
+                    parameter_expression = '*%s' % parameter_expression
+            elif parameter.is_optional:
+                parameter_expression = '&%s' % parameter_expression
+
+            param_args = {
+                'parameterType': CppGenerator.cpp_type_for_stack_in_parameter(parameter),
+                'parameterKey': parameter.parameter_name,
+                'parameterName': parameter_name,
+                'parameterExpression': parameter_expression,
+                'keyedGetMethod': CppGenerator.cpp_getter_method_for_type(parameter.type),
+                'successOutParam': out_success_argument
+            }
+
+            in_parameter_declarations.append('    %(parameterType)s %(parameterName)s = m_backendDispatcher->%(keyedGetMethod)s(parameters.get(), ASCIILiteral("%(parameterKey)s"), %(successOutParam)s);' % param_args)
+
+            if parameter.is_optional:
+                optional_in_parameter_string = '%(parameterName)s_valueFound ? %(parameterExpression)s : nullptr' % param_args
+                alternate_dispatcher_method_parameters.append(optional_in_parameter_string)
+                method_parameters.append(optional_in_parameter_string)
+            else:
+                alternate_dispatcher_method_parameters.append(parameter_expression)
+                method_parameters.append(parameter_expression)
+
+        if command.is_async:
+            async_args = {
+                'domainName': domain.domain_name,
+                'callbackName': ucfirst(command.command_name) + 'Callback'
+            }
+
+            out_parameter_assignments.append('        callback->disable();')
+            out_parameter_assignments.append('        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, error);')
+            out_parameter_assignments.append('        return;')
+            method_parameters.append('callback.copyRef()')
+
+        else:
+            for parameter in command.return_parameters:
+                param_args = {
+                    'parameterType': CppGenerator.cpp_type_for_stack_out_parameter(parameter),
+                    'parameterKey': parameter.parameter_name,
+                    'parameterName': parameter.parameter_name,
+                    'keyedSetMethod': CppGenerator.cpp_setter_method_for_type(parameter.type),
+                    'helpersNamespace': self.helpers_namespace(),
+                }
+
+                out_parameter_declarations.append('    %(parameterType)s out_%(parameterName)s;' % param_args)
+                if parameter.is_optional:
+                    if CppGenerator.should_use_wrapper_for_return_type(parameter.type):
+                        out_parameter_assignments.append('        if (out_%(parameterName)s.isAssigned())' % param_args)
+                        out_parameter_assignments.append('            result->%(keyedSetMethod)s(ASCIILiteral("%(parameterKey)s"), out_%(parameterName)s.getValue());' % param_args)
+                    else:
+                        out_parameter_assignments.append('        if (out_%(parameterName)s)' % param_args)
+                        out_parameter_assignments.append('            result->%(keyedSetMethod)s(ASCIILiteral("%(parameterKey)s"), out_%(parameterName)s);' % param_args)
+                elif parameter.type.is_enum():
+                    out_parameter_assignments.append('        result->%(keyedSetMethod)s(ASCIILiteral("%(parameterKey)s"), Inspector::Protocol::%(helpersNamespace)s::getEnumConstantValue(out_%(parameterName)s));' % param_args)
+                else:
+                    out_parameter_assignments.append('        result->%(keyedSetMethod)s(ASCIILiteral("%(parameterKey)s"), out_%(parameterName)s);' % param_args)
+
+                if CppGenerator.should_pass_by_copy_for_return_type(parameter.type):
+                    method_parameters.append('out_' + parameter.parameter_name)
+                else:
+                    method_parameters.append('&out_' + parameter.parameter_name)
+
+        command_args = {
+            'domainName': domain.domain_name,
+            'callbackName': '%sCallback' % ucfirst(command.command_name),
+            'commandName': command.command_name,
+            'inParameterDeclarations': '\n'.join(in_parameter_declarations),
+            'invocationParameters': ', '.join(method_parameters),
+            'alternateInvocationParameters': ', '.join(alternate_dispatcher_method_parameters),
+        }
+
+        lines = []
+        if len(command.call_parameters) == 0:
+            lines.append('void %(domainName)sBackendDispatcher::%(commandName)s(long requestId, RefPtr<InspectorObject>&&)' % command_args)
+        else:
+            lines.append('void %(domainName)sBackendDispatcher::%(commandName)s(long requestId, RefPtr<InspectorObject>&& parameters)' % command_args)
+        lines.append('{')
+
+        if len(command.call_parameters) > 0:
+            lines.append(Template(CppTemplates.BackendDispatcherImplementationPrepareCommandArguments).substitute(None, **command_args))
+
+        if self.model().framework.setting('alternate_dispatchers', False):
+            lines.append('#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)')
+            lines.append('    if (m_alternateDispatcher) {')
+            lines.append('        m_alternateDispatcher->%(commandName)s(%(alternateInvocationParameters)s);' % command_args)
+            lines.append('        return;')
+            lines.append('    }')
+            lines.append('#endif')
+            lines.append('')
+
+        lines.append('    ErrorString error;')
+        lines.append('    Ref<InspectorObject> result = InspectorObject::create();')
+        if command.is_async:
+            lines.append('    Ref<%(domainName)sBackendDispatcherHandler::%(callbackName)s> callback = adoptRef(*new %(domainName)sBackendDispatcherHandler::%(callbackName)s(m_backendDispatcher.copyRef(), requestId));' % command_args)
+        if len(command.return_parameters) > 0:
+            lines.extend(out_parameter_declarations)
+        lines.append('    m_agent->%(commandName)s(%(invocationParameters)s);' % command_args)
+        lines.append('')
+        if command.is_async:
+            lines.append('    if (error.length()) {')
+            lines.extend(out_parameter_assignments)
+            lines.append('    }')
+        elif len(command.return_parameters) > 1:
+            lines.append('    if (!error.length()) {')
+            lines.extend(out_parameter_assignments)
+            lines.append('    }')
+        elif len(command.return_parameters) == 1:
+            lines.append('    if (!error.length())')
+            lines.extend(out_parameter_assignments)
+            lines.append('')
+
+        if not command.is_async:
+            lines.append('    if (!error.length())')
+            lines.append('        m_backendDispatcher->sendResponse(requestId, WTFMove(result));')
+            lines.append('    else')
+            lines.append('        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));')
+        lines.append('}')
+        return "\n".join(lines)
diff --git a/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py b/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py
new file mode 100755
index 0000000..f59b984
--- /dev/null
+++ b/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py
@@ -0,0 +1,115 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014-2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import re
+import string
+from string import Template
+
+from cpp_generator import CppGenerator
+from cpp_generator_templates import CppGeneratorTemplates as CppTemplates
+from generator import Generator, ucfirst
+from models import EnumType
+
+log = logging.getLogger('global')
+
+
+class CppFrontendDispatcherHeaderGenerator(CppGenerator):
+    def __init__(self, model, input_filepath):
+        CppGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return "%sFrontendDispatchers.h" % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(lambda domain: len(domain.events) > 0, Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        headers = [
+            '"%sProtocolObjects.h"' % self.protocol_name(),
+            '<inspector/InspectorValues.h>',
+            '<wtf/text/WTFString.h>']
+
+        header_args = {
+            'includes': '\n'.join(['#include ' + header for header in headers]),
+            'typedefs': 'class FrontendRouter;',
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(CppTemplates.HeaderPrelude).substitute(None, **header_args))
+        sections.extend(map(self._generate_dispatcher_declarations_for_domain, self.domains_to_generate()))
+        sections.append(Template(CppTemplates.HeaderPostlude).substitute(None, **header_args))
+        return "\n\n".join(sections)
+
+    # Private methods.
+
+    def _generate_anonymous_enum_for_parameter(self, parameter, event):
+        enum_args = {
+            'parameterName': parameter.parameter_name,
+            'eventName': event.event_name
+        }
+
+        lines = []
+        lines.append('        // Named after parameter \'%(parameterName)s\' while generating command/event %(eventName)s.' % enum_args)
+        lines.append('        enum class %s {' % ucfirst(parameter.parameter_name))
+        for enum_value in parameter.type.enum_values():
+            lines.append('            %s = %d,' % (Generator.stylized_name_for_enum_value(enum_value), self.encoding_for_enum_value(enum_value)))
+        lines.append('        }; // enum class %s' % ucfirst(parameter.parameter_name))
+        return "\n".join(lines)
+
+    def _generate_dispatcher_declarations_for_domain(self, domain):
+        classComponents = ['class']
+        exportMacro = self.model().framework.setting('export_macro', None)
+        if exportMacro is not None:
+            classComponents.append(exportMacro)
+
+        used_enum_names = set([])
+
+        event_declarations = []
+        for event in domain.events:
+            event_declarations.append(self._generate_dispatcher_declaration_for_event(event, domain, used_enum_names))
+
+        handler_args = {
+            'classAndExportMacro': " ".join(classComponents),
+            'domainName': domain.domain_name,
+            'eventDeclarations': "\n".join(event_declarations)
+        }
+
+        return self.wrap_with_guard_for_domain(domain, Template(CppTemplates.FrontendDispatcherDomainDispatcherDeclaration).substitute(None, **handler_args))
+
+    def _generate_dispatcher_declaration_for_event(self, event, domain, used_enum_names):
+        formal_parameters = []
+        lines = []
+        for parameter in event.event_parameters:
+            formal_parameters.append('%s %s' % (CppGenerator.cpp_type_for_checked_formal_event_parameter(parameter), parameter.parameter_name))
+            if isinstance(parameter.type, EnumType) and parameter.parameter_name not in used_enum_names:
+                lines.append(self._generate_anonymous_enum_for_parameter(parameter, event))
+                used_enum_names.add(parameter.parameter_name)
+
+        lines.append("    void %s(%s);" % (event.event_name, ", ".join(formal_parameters)))
+        return "\n".join(lines)
diff --git a/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py b/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py
new file mode 100755
index 0000000..71672c4
--- /dev/null
+++ b/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py
@@ -0,0 +1,124 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014-2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from cpp_generator import CppGenerator
+from cpp_generator_templates import CppGeneratorTemplates as CppTemplates
+from generator import Generator, ucfirst
+from models import ObjectType, ArrayType
+
+log = logging.getLogger('global')
+
+
+class CppFrontendDispatcherImplementationGenerator(CppGenerator):
+    def __init__(self, model, input_filepath):
+        CppGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return "%sFrontendDispatchers.cpp" % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(lambda domain: len(domain.events) > 0, Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        secondary_headers = [
+            '"InspectorFrontendRouter.h"',
+            '<wtf/text/CString.h>',
+        ]
+
+        header_args = {
+            'primaryInclude': '"%sFrontendDispatchers.h"' % self.protocol_name(),
+            'secondaryIncludes': "\n".join(['#include %s' % header for header in secondary_headers]),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(CppTemplates.ImplementationPrelude).substitute(None, **header_args))
+        sections.extend(map(self._generate_dispatcher_implementations_for_domain, self.domains_to_generate()))
+        sections.append(Template(CppTemplates.ImplementationPostlude).substitute(None, **header_args))
+        return "\n\n".join(sections)
+
+    # Private methods.
+
+    def _generate_dispatcher_implementations_for_domain(self, domain):
+        implementations = []
+        for event in domain.events:
+            implementations.append(self._generate_dispatcher_implementation_for_event(event, domain))
+
+        return self.wrap_with_guard_for_domain(domain, '\n\n'.join(implementations))
+
+    def _generate_dispatcher_implementation_for_event(self, event, domain):
+        lines = []
+        parameter_assignments = []
+        formal_parameters = []
+
+        for parameter in event.event_parameters:
+
+            parameter_value = parameter.parameter_name
+            if parameter.is_optional and not CppGenerator.should_pass_by_copy_for_return_type(parameter.type):
+                parameter_value = '*' + parameter_value
+            if parameter.type.is_enum():
+                parameter_value = 'Inspector::Protocol::%s::getEnumConstantValue(%s)' % (self.helpers_namespace(), parameter_value)
+
+            parameter_args = {
+                'parameterType': CppGenerator.cpp_type_for_stack_out_parameter(parameter),
+                'parameterName': parameter.parameter_name,
+                'parameterValue': parameter_value,
+                'keyedSetMethod': CppGenerator.cpp_setter_method_for_type(parameter.type),
+            }
+
+            if parameter.is_optional:
+                parameter_assignments.append('    if (%(parameterName)s)' % parameter_args)
+                parameter_assignments.append('        paramsObject->%(keyedSetMethod)s(ASCIILiteral("%(parameterName)s"), %(parameterValue)s);' % parameter_args)
+            else:
+                parameter_assignments.append('    paramsObject->%(keyedSetMethod)s(ASCIILiteral("%(parameterName)s"), %(parameterValue)s);' % parameter_args)
+
+            formal_parameters.append('%s %s' % (CppGenerator.cpp_type_for_checked_formal_event_parameter(parameter), parameter.parameter_name))
+
+        event_args = {
+            'domainName': domain.domain_name,
+            'eventName': event.event_name,
+            'formalParameters': ", ".join(formal_parameters)
+        }
+
+        lines.append('void %(domainName)sFrontendDispatcher::%(eventName)s(%(formalParameters)s)' % event_args)
+        lines.append('{')
+        lines.append('    Ref<InspectorObject> jsonMessage = InspectorObject::create();')
+        lines.append('    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("%(domainName)s.%(eventName)s"));' % event_args)
+
+        if len(parameter_assignments) > 0:
+            lines.append('    Ref<InspectorObject> paramsObject = InspectorObject::create();')
+            lines.extend(parameter_assignments)
+            lines.append('    jsonMessage->setObject(ASCIILiteral("params"), WTFMove(paramsObject));')
+
+        lines.append('')
+        lines.append('    m_frontendRouter.sendEvent(jsonMessage->toJSONString());')
+        lines.append('}')
+        return "\n".join(lines)
diff --git a/inspector/scripts/codegen/generate_cpp_protocol_types_header.py b/inspector/scripts/codegen/generate_cpp_protocol_types_header.py
new file mode 100755
index 0000000..0704b3e
--- /dev/null
+++ b/inspector/scripts/codegen/generate_cpp_protocol_types_header.py
@@ -0,0 +1,420 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import re
+import string
+from operator import methodcaller
+from string import Template
+
+from cpp_generator import CppGenerator
+from cpp_generator_templates import CppGeneratorTemplates as CppTemplates
+from generator import Generator, ucfirst
+from models import EnumType, ObjectType, PrimitiveType, AliasedType, ArrayType, Frameworks
+
+log = logging.getLogger('global')
+
+
+class CppProtocolTypesHeaderGenerator(CppGenerator):
+    def __init__(self, model, input_filepath):
+        CppGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return "%sProtocolObjects.h" % self.protocol_name()
+
+    def generate_output(self):
+        domains = self.domains_to_generate()
+        self.calculate_types_requiring_shape_assertions(domains)
+
+        headers = set([
+            '<inspector/InspectorProtocolTypes.h>',
+            '<wtf/Assertions.h>',
+        ])
+
+        header_args = {
+            'includes': '\n'.join(['#include ' + header for header in sorted(headers)]),
+            'typedefs': '',
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(CppTemplates.HeaderPrelude).substitute(None, **header_args))
+        sections.append('namespace Protocol {')
+        sections.append(self._generate_forward_declarations(domains))
+        sections.append(self._generate_typedefs(domains))
+        sections.extend(self._generate_enum_constant_value_conversion_methods())
+        builder_sections = map(self._generate_builders_for_domain, domains)
+        sections.extend(filter(lambda section: len(section) > 0, builder_sections))
+        sections.append(self._generate_forward_declarations_for_binding_traits())
+        sections.extend(self._generate_declarations_for_enum_conversion_methods())
+        sections.append('} // namespace Protocol')
+        sections.append(Template(CppTemplates.HeaderPostlude).substitute(None, **header_args))
+        return "\n\n".join(sections)
+
+    # Private methods.
+
+    # FIXME: move builders out of classes, uncomment forward declaration
+
+    def _generate_forward_declarations(self, domains):
+        sections = []
+
+        for domain in domains:
+            declaration_types = [decl.type for decl in domain.type_declarations]
+            object_types = filter(lambda _type: isinstance(_type, ObjectType), declaration_types)
+            enum_types = filter(lambda _type: isinstance(_type, EnumType), declaration_types)
+            sorted(object_types, key=methodcaller('raw_name'))
+            sorted(enum_types, key=methodcaller('raw_name'))
+
+            if len(object_types) + len(enum_types) == 0:
+                continue
+
+            domain_lines = []
+            domain_lines.append('namespace %s {' % domain.domain_name)
+
+            # Forward-declare all classes so the type builders won't break if rearranged.
+            domain_lines.extend('class %s;' % object_type.raw_name() for object_type in object_types)
+            domain_lines.extend('enum class %s;' % enum_type.raw_name() for enum_type in enum_types)
+            domain_lines.append('} // %s' % domain.domain_name)
+            sections.append(self.wrap_with_guard_for_domain(domain, '\n'.join(domain_lines)))
+
+        if len(sections) == 0:
+            return ''
+        else:
+            return """// Forward declarations.
+%s
+// End of forward declarations.
+""" % '\n\n'.join(sections)
+
+    def _generate_typedefs(self, domains):
+        sections = map(self._generate_typedefs_for_domain, domains)
+        sections = filter(lambda text: len(text) > 0, sections)
+
+        if len(sections) == 0:
+            return ''
+        else:
+            return """// Typedefs.
+%s
+// End of typedefs.""" % '\n\n'.join(sections)
+
+    def _generate_typedefs_for_domain(self, domain):
+        primitive_declarations = filter(lambda decl: isinstance(decl.type, AliasedType), domain.type_declarations)
+        array_declarations = filter(lambda decl: isinstance(decl.type, ArrayType), domain.type_declarations)
+        if len(primitive_declarations) == 0 and len(array_declarations) == 0:
+            return ''
+
+        sections = []
+        for declaration in primitive_declarations:
+            primitive_name = CppGenerator.cpp_name_for_primitive_type(declaration.type.aliased_type)
+            typedef_lines = []
+            if len(declaration.description) > 0:
+                typedef_lines.append('/* %s */' % declaration.description)
+            typedef_lines.append('typedef %s %s;' % (primitive_name, declaration.type_name))
+            sections.append('\n'.join(typedef_lines))
+
+        for declaration in array_declarations:
+            element_type = CppGenerator.cpp_protocol_type_for_type(declaration.type.element_type)
+            typedef_lines = []
+            if len(declaration.description) > 0:
+                typedef_lines.append('/* %s */' % declaration.description)
+            typedef_lines.append('typedef Inspector::Protocol::Array<%s> %s;' % (element_type, declaration.type_name))
+            sections.append('\n'.join(typedef_lines))
+
+        lines = []
+        lines.append('namespace %s {' % domain.domain_name)
+        lines.append('\n'.join(sections))
+        lines.append('} // %s' % domain.domain_name)
+        return self.wrap_with_guard_for_domain(domain, '\n'.join(lines))
+
+    def _generate_enum_constant_value_conversion_methods(self):
+        if not self.assigned_enum_values():
+            return []
+
+        return_type = 'String'
+        return_type_with_export_macro = [return_type]
+        export_macro = self.model().framework.setting('export_macro', None)
+        if export_macro is not None:
+            return_type_with_export_macro[:0] = [export_macro]
+
+        lines = []
+        lines.append('namespace %s {' % self.helpers_namespace())
+        lines.append('\n'.join([
+            '%s getEnumConstantValue(int code);' % ' '.join(return_type_with_export_macro),
+            '',
+            'template<typename T> %s getEnumConstantValue(T enumValue)' % return_type,
+            '{',
+            '    return getEnumConstantValue(static_cast<int>(enumValue));',
+            '}',
+        ]))
+        lines.append('} // namespace %s' % self.helpers_namespace())
+        return lines
+
+    def _generate_builders_for_domain(self, domain):
+        sections = []
+
+        for type_declaration in domain.type_declarations:
+            if isinstance(type_declaration.type, EnumType):
+                sections.append(self._generate_struct_for_enum_declaration(type_declaration))
+            elif isinstance(type_declaration.type, ObjectType):
+                sections.append(self._generate_class_for_object_declaration(type_declaration, domain))
+
+        sections = filter(lambda section: len(section) > 0, sections)
+        if len(sections) == 0:
+            return ''
+
+        lines = []
+        lines.append('namespace %s {' % domain.domain_name)
+        lines.append('\n'.join(sections))
+        lines.append('} // %s' % domain.domain_name)
+        return self.wrap_with_guard_for_domain(domain, '\n'.join(lines))
+
+    def _generate_class_for_object_declaration(self, type_declaration, domain):
+        if len(type_declaration.type_members) == 0:
+            return ''
+
+        enum_members = filter(lambda member: isinstance(member.type, EnumType) and member.type.is_anonymous, type_declaration.type_members)
+        required_members = filter(lambda member: not member.is_optional, type_declaration.type_members)
+        optional_members = filter(lambda member: member.is_optional, type_declaration.type_members)
+        object_name = type_declaration.type_name
+
+        lines = []
+        if len(type_declaration.description) > 0:
+            lines.append('/* %s */' % type_declaration.description)
+        base_class = 'Inspector::InspectorObject'
+        if not Generator.type_has_open_fields(type_declaration.type):
+            base_class = base_class + 'Base'
+        lines.append('class %s : public %s {' % (object_name, base_class))
+        lines.append('public:')
+        for enum_member in enum_members:
+            lines.append('    // Named after property name \'%s\' while generating %s.' % (enum_member.member_name, object_name))
+            lines.append(self._generate_struct_for_anonymous_enum_member(enum_member))
+        lines.append(self._generate_builder_state_enum(type_declaration))
+
+        constructor_example = []
+        constructor_example.append('     * Ref<%s> result = %s::create()' % (object_name, object_name))
+        for member in required_members:
+            constructor_example.append('     *     .set%s(...)' % ucfirst(member.member_name))
+        constructor_example.append('     *     .release()')
+
+        builder_args = {
+            'objectType': object_name,
+            'constructorExample': '\n'.join(constructor_example) + ';',
+        }
+
+        lines.append(Template(CppTemplates.ProtocolObjectBuilderDeclarationPrelude).substitute(None, **builder_args))
+        for type_member in required_members:
+            lines.append(self._generate_builder_setter_for_member(type_member, domain))
+        lines.append(Template(CppTemplates.ProtocolObjectBuilderDeclarationPostlude).substitute(None, **builder_args))
+        for member in optional_members:
+            lines.append(self._generate_unchecked_setter_for_member(member, domain))
+
+        if Generator.type_has_open_fields(type_declaration.type):
+            lines.append('')
+            lines.append('    // Property names for type generated as open.')
+            for type_member in type_declaration.type_members:
+                export_macro = self.model().framework.setting('export_macro', None)
+                lines.append('    %s static const char* %s;' % (export_macro, ucfirst(type_member.member_name)))
+
+        lines.append('};')
+        lines.append('')
+        return '\n'.join(lines)
+
+    def _generate_struct_for_enum_declaration(self, enum_declaration):
+        lines = []
+        lines.append('/* %s */' % enum_declaration.description)
+        lines.extend(self._generate_struct_for_enum_type(enum_declaration.type_name, enum_declaration.type))
+        return '\n'.join(lines)
+
+    def _generate_struct_for_anonymous_enum_member(self, enum_member):
+        def apply_indentation(line):
+            if line.startswith(('#', '/*', '*/', '//')) or len(line) is 0:
+                return line
+            else:
+                return '    ' + line
+
+        indented_lines = map(apply_indentation, self._generate_struct_for_enum_type(enum_member.member_name, enum_member.type))
+        return '\n'.join(indented_lines)
+
+    def _generate_struct_for_enum_type(self, enum_name, enum_type):
+        lines = []
+        enum_name = ucfirst(enum_name)
+        lines.append('enum class %s {' % enum_name)
+        for enum_value in enum_type.enum_values():
+            lines.append('    %s = %s,' % (Generator.stylized_name_for_enum_value(enum_value), self.encoding_for_enum_value(enum_value)))
+        lines.append('}; // enum class %s' % enum_name)
+        return lines  # The caller may want to adjust indentation, so don't join these lines.
+
+    def _generate_builder_state_enum(self, type_declaration):
+        lines = []
+        required_members = filter(lambda member: not member.is_optional, type_declaration.type_members)
+        enum_values = []
+
+        lines.append('    enum {')
+        lines.append('        NoFieldsSet = 0,')
+        for i in range(len(required_members)):
+            enum_value = "%sSet" % ucfirst(required_members[i].member_name)
+            enum_values.append(enum_value)
+            lines.append('        %s = 1 << %d,' % (enum_value, i))
+        if len(enum_values) > 0:
+            lines.append('        AllFieldsSet = (%s)' % ' | '.join(enum_values))
+        else:
+            lines.append('        AllFieldsSet = 0')
+        lines.append('    };')
+        lines.append('')
+        return '\n'.join(lines)
+
+    def _generate_builder_setter_for_member(self, type_member, domain):
+        setter_args = {
+            'camelName': ucfirst(type_member.member_name),
+            'keyedSet': CppGenerator.cpp_setter_method_for_type(type_member.type),
+            'name': type_member.member_name,
+            'parameterType': CppGenerator.cpp_type_for_type_member(type_member),
+            'helpersNamespace': self.helpers_namespace(),
+        }
+
+        lines = []
+        lines.append('')
+        lines.append('        Builder<STATE | %(camelName)sSet>& set%(camelName)s(%(parameterType)s value)' % setter_args)
+        lines.append('        {')
+        lines.append('            COMPILE_ASSERT(!(STATE & %(camelName)sSet), property_%(name)s_already_set);' % setter_args)
+
+        if isinstance(type_member.type, EnumType):
+            lines.append('            m_result->%(keyedSet)s(ASCIILiteral("%(name)s"), Inspector::Protocol::%(helpersNamespace)s::getEnumConstantValue(value));' % setter_args)
+        else:
+            lines.append('            m_result->%(keyedSet)s(ASCIILiteral("%(name)s"), value);' % setter_args)
+        lines.append('            return castState<%(camelName)sSet>();' % setter_args)
+        lines.append('        }')
+        return '\n'.join(lines)
+
+    def _generate_unchecked_setter_for_member(self, type_member, domain):
+        setter_args = {
+            'camelName': ucfirst(type_member.member_name),
+            'keyedSet': CppGenerator.cpp_setter_method_for_type(type_member.type),
+            'name': type_member.member_name,
+            'parameterType': CppGenerator.cpp_type_for_type_member(type_member),
+            'helpersNamespace': self.helpers_namespace(),
+        }
+
+        lines = []
+        lines.append('')
+        lines.append('    void set%(camelName)s(%(parameterType)s value)' % setter_args)
+        lines.append('    {')
+        if isinstance(type_member.type, EnumType):
+            lines.append('        InspectorObjectBase::%(keyedSet)s(ASCIILiteral("%(name)s"), Inspector::Protocol::%(helpersNamespace)s::getEnumConstantValue(value));' % setter_args)
+        elif CppGenerator.should_use_references_for_type(type_member.type):
+            lines.append('        InspectorObjectBase::%(keyedSet)s(ASCIILiteral("%(name)s"), WTFMove(value));' % setter_args)
+        else:
+            lines.append('        InspectorObjectBase::%(keyedSet)s(ASCIILiteral("%(name)s"), value);' % setter_args)
+        lines.append('    }')
+        return '\n'.join(lines)
+
+    def _generate_forward_declarations_for_binding_traits(self):
+        # A list of (builder_type, needs_runtime_cast)
+        type_arguments = []
+
+        for domain in self.domains_to_generate():
+            declarations_to_generate = filter(lambda decl: self.type_needs_shape_assertions(decl.type), domain.type_declarations)
+
+            for type_declaration in declarations_to_generate:
+                for type_member in type_declaration.type_members:
+                    if isinstance(type_member.type, EnumType):
+                        type_arguments.append((CppGenerator.cpp_protocol_type_for_type_member(type_member, type_declaration), False))
+
+                if isinstance(type_declaration.type, ObjectType):
+                    type_arguments.append((CppGenerator.cpp_protocol_type_for_type(type_declaration.type), Generator.type_needs_runtime_casts(type_declaration.type)))
+
+        struct_keywords = ['struct']
+        function_keywords = ['static void']
+        export_macro = self.model().framework.setting('export_macro', None)
+        if export_macro is not None:
+            struct_keywords.append(export_macro)
+            #function_keywords[1:1] = [export_macro]
+
+        lines = []
+        for argument in type_arguments:
+            lines.append('template<> %s BindingTraits<%s> {' % (' '.join(struct_keywords), argument[0]))
+            if argument[1]:
+                lines.append('static RefPtr<%s> runtimeCast(RefPtr<Inspector::InspectorValue>&& value);' % argument[0])
+            lines.append('#if !ASSERT_DISABLED')
+            lines.append('%s assertValueHasExpectedType(Inspector::InspectorValue*);' % ' '.join(function_keywords))
+            lines.append('#endif // !ASSERT_DISABLED')
+            lines.append('};')
+        return '\n'.join(lines)
+
+    def _generate_declarations_for_enum_conversion_methods(self):
+        sections = []
+        sections.append('\n'.join([
+            'namespace %s {' % self.helpers_namespace(),
+            '',
+            'template<typename ProtocolEnumType>',
+            'std::optional<ProtocolEnumType> parseEnumValueFromString(const String&);',
+        ]))
+
+        def return_type_with_export_macro(cpp_protocol_type):
+            enum_return_type = 'std::optional<%s>' % cpp_protocol_type
+            result_terms = [enum_return_type]
+            export_macro = self.model().framework.setting('export_macro', None)
+            if export_macro is not None:
+                result_terms[:0] = [export_macro]
+            return ' '.join(result_terms)
+
+        def type_member_is_anonymous_enum_type(type_member):
+            return isinstance(type_member.type, EnumType) and type_member.type.is_anonymous
+
+        for domain in self.domains_to_generate():
+            declaration_types = [decl.type for decl in domain.type_declarations]
+            object_types = filter(lambda _type: isinstance(_type, ObjectType), declaration_types)
+            enum_types = filter(lambda _type: isinstance(_type, EnumType), declaration_types)
+            if len(object_types) + len(enum_types) == 0:
+                continue
+
+            sorted(object_types, key=methodcaller('raw_name'))
+            sorted(enum_types, key=methodcaller('raw_name'))
+
+            domain_lines = []
+            domain_lines.append("// Enums in the '%s' Domain" % domain.domain_name)
+            for enum_type in enum_types:
+                cpp_protocol_type = CppGenerator.cpp_protocol_type_for_type(enum_type)
+                domain_lines.append('template<>')
+                domain_lines.append('%s parseEnumValueFromString<%s>(const String&);' % (return_type_with_export_macro(cpp_protocol_type), cpp_protocol_type))
+
+            for object_type in object_types:
+                for enum_member in filter(type_member_is_anonymous_enum_type, object_type.members):
+                    cpp_protocol_type = CppGenerator.cpp_protocol_type_for_type_member(enum_member, object_type.declaration())
+                    domain_lines.append('template<>')
+                    domain_lines.append('%s parseEnumValueFromString<%s>(const String&);' % (return_type_with_export_macro(cpp_protocol_type), cpp_protocol_type))
+
+            if len(domain_lines) == 1:
+                continue  # No real declarations to emit, just the domain comment. Skip.
+
+            sections.append(self.wrap_with_guard_for_domain(domain, '\n'.join(domain_lines)))
+
+        if len(sections) == 1:
+            return [] # No real sections to emit, just the namespace and template declaration. Skip.
+
+        sections.append('} // namespace %s' % self.helpers_namespace())
+
+        return ['\n\n'.join(sections)]
diff --git a/inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py b/inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py
new file mode 100755
index 0000000..7bbb903
--- /dev/null
+++ b/inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py
@@ -0,0 +1,257 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+from operator import methodcaller
+
+from cpp_generator import CppGenerator
+from cpp_generator_templates import CppGeneratorTemplates as CppTemplates
+from generator import Generator, ucfirst
+from models import AliasedType, ArrayType, EnumType, ObjectType
+
+log = logging.getLogger('global')
+
+
+class CppProtocolTypesImplementationGenerator(CppGenerator):
+    def __init__(self, model, input_filepath):
+        CppGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return "%sProtocolObjects.cpp" % self.protocol_name()
+
+    def generate_output(self):
+        domains = self.domains_to_generate()
+        self.calculate_types_requiring_shape_assertions(domains)
+
+        secondary_headers = [
+            '<wtf/Optional.h>',
+            '<wtf/text/CString.h>',
+        ]
+
+        header_args = {
+            'primaryInclude': '"%sProtocolObjects.h"' % self.protocol_name(),
+            'secondaryIncludes': "\n".join(['#include %s' % header for header in secondary_headers]),
+        }
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(CppTemplates.ImplementationPrelude).substitute(None, **header_args))
+        sections.append('namespace Protocol {')
+        sections.extend(self._generate_enum_mapping_and_conversion_methods(domains))
+        sections.append(self._generate_open_field_names())
+        builder_sections = map(self._generate_builders_for_domain, domains)
+        sections.extend(filter(lambda section: len(section) > 0, builder_sections))
+        sections.append('} // namespace Protocol')
+        sections.append(Template(CppTemplates.ImplementationPostlude).substitute(None, **header_args))
+
+        return "\n\n".join(sections)
+
+    # Private methods.
+
+    def _generate_enum_mapping(self):
+        if not self.assigned_enum_values():
+            return []
+
+        lines = []
+        lines.append('static const char* const enum_constant_values[] = {')
+        lines.extend(['    "%s",' % enum_value for enum_value in self.assigned_enum_values()])
+        lines.append('};')
+        lines.append('')
+        lines.append('String getEnumConstantValue(int code) {')
+        lines.append('    return enum_constant_values[code];')
+        lines.append('}')
+        return ['\n'.join(lines)]
+
+    def _generate_enum_conversion_methods_for_domain(self, domain):
+
+        def type_member_is_anonymous_enum_type(type_member):
+            return isinstance(type_member.type, EnumType) and type_member.type.is_anonymous
+
+        def generate_conversion_method_body(enum_type, cpp_protocol_type):
+            body_lines = []
+            body_lines.extend([
+                'template<>',
+                'std::optional<%s> parseEnumValueFromString<%s>(const String& protocolString)' % (cpp_protocol_type, cpp_protocol_type),
+                '{',
+                '    static const size_t constantValues[] = {',
+            ])
+
+            enum_values = enum_type.enum_values()
+            for enum_value in enum_values:
+                body_lines.append('        (size_t)%s::%s,' % (cpp_protocol_type, Generator.stylized_name_for_enum_value(enum_value)))
+
+            body_lines.extend([
+                '    };',
+                '    for (size_t i = 0; i < %d; ++i)' % len(enum_values),
+                '        if (protocolString == enum_constant_values[constantValues[i]])',
+                '            return (%s)constantValues[i];' % cpp_protocol_type,
+                '',
+                '    return std::nullopt;',
+                '}',
+                '',
+            ])
+            return body_lines
+
+        declaration_types = [decl.type for decl in domain.type_declarations]
+        object_types = filter(lambda _type: isinstance(_type, ObjectType), declaration_types)
+        enum_types = filter(lambda _type: isinstance(_type, EnumType), declaration_types)
+        if len(object_types) + len(enum_types) == 0:
+            return ''
+
+        sorted(object_types, key=methodcaller('raw_name'))
+        sorted(enum_types, key=methodcaller('raw_name'))
+
+        lines = []
+        lines.append("// Enums in the '%s' Domain" % domain.domain_name)
+        for enum_type in enum_types:
+            cpp_protocol_type = CppGenerator.cpp_protocol_type_for_type(enum_type)
+            lines.extend(generate_conversion_method_body(enum_type, cpp_protocol_type))
+
+        for object_type in object_types:
+            for enum_member in filter(type_member_is_anonymous_enum_type, object_type.members):
+                cpp_protocol_type = CppGenerator.cpp_protocol_type_for_type_member(enum_member, object_type.declaration())
+                lines.extend(generate_conversion_method_body(enum_member.type, cpp_protocol_type))
+
+        if len(lines) == 1:
+            return ''  # No real declarations to emit, just the domain comment.
+
+        return self.wrap_with_guard_for_domain(domain, '\n'.join(lines))
+
+    def _generate_enum_mapping_and_conversion_methods(self, domains):
+        sections = []
+        sections.append('namespace %s {' % self.helpers_namespace())
+        sections.extend(self._generate_enum_mapping())
+        enum_parser_sections = map(self._generate_enum_conversion_methods_for_domain, domains)
+        sections.extend(filter(lambda section: len(section) > 0, enum_parser_sections))
+        if len(sections) == 1:
+            return []  # No declarations to emit, just the namespace.
+
+        sections.append('} // namespace %s' % self.helpers_namespace())
+        return sections
+
+    def _generate_open_field_names(self):
+        lines = []
+        for domain in self.domains_to_generate():
+            for type_declaration in filter(lambda decl: Generator.type_has_open_fields(decl.type), domain.type_declarations):
+                for type_member in sorted(type_declaration.type_members, key=lambda member: member.member_name):
+                    field_name = '::'.join(['Inspector', 'Protocol', domain.domain_name, ucfirst(type_declaration.type_name), ucfirst(type_member.member_name)])
+                    lines.append('const char* %s = "%s";' % (field_name, type_member.member_name))
+
+        return '\n'.join(lines)
+
+    def _generate_builders_for_domain(self, domain):
+        sections = []
+        declarations_to_generate = filter(lambda decl: self.type_needs_shape_assertions(decl.type), domain.type_declarations)
+
+        for type_declaration in declarations_to_generate:
+            for type_member in type_declaration.type_members:
+                if isinstance(type_member.type, EnumType):
+                    sections.append(self._generate_assertion_for_enum(type_member, type_declaration))
+
+            if isinstance(type_declaration.type, ObjectType):
+                sections.append(self._generate_assertion_for_object_declaration(type_declaration))
+                if Generator.type_needs_runtime_casts(type_declaration.type):
+                    sections.append(self._generate_runtime_cast_for_object_declaration(type_declaration))
+
+        return '\n\n'.join(sections)
+
+    def _generate_runtime_cast_for_object_declaration(self, object_declaration):
+        args = {
+            'objectType': CppGenerator.cpp_protocol_type_for_type(object_declaration.type)
+        }
+        return Template(CppTemplates.ProtocolObjectRuntimeCast).substitute(None, **args)
+
+    def _generate_assertion_for_object_declaration(self, object_declaration):
+        required_members = filter(lambda member: not member.is_optional, object_declaration.type_members)
+        optional_members = filter(lambda member: member.is_optional, object_declaration.type_members)
+        should_count_properties = not Generator.type_has_open_fields(object_declaration.type)
+        lines = []
+
+        lines.append('#if !ASSERT_DISABLED')
+        lines.append('void BindingTraits<%s>::assertValueHasExpectedType(Inspector::InspectorValue* value)' % (CppGenerator.cpp_protocol_type_for_type(object_declaration.type)))
+        lines.append("""{
+    ASSERT_ARG(value, value);
+    RefPtr<InspectorObject> object;
+    bool castSucceeded = value->asObject(object);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);""")
+        for type_member in required_members:
+            args = {
+                'memberName': type_member.member_name,
+                'assertMethod': CppGenerator.cpp_assertion_method_for_type_member(type_member, object_declaration)
+            }
+
+            lines.append("""    {
+        InspectorObject::iterator %(memberName)sPos = object->find(ASCIILiteral("%(memberName)s"));
+        ASSERT(%(memberName)sPos != object->end());
+        %(assertMethod)s(%(memberName)sPos->value.get());
+    }""" % args)
+
+        if should_count_properties:
+            lines.append('')
+            lines.append('    int foundPropertiesCount = %s;' % len(required_members))
+
+        for type_member in optional_members:
+            args = {
+                'memberName': type_member.member_name,
+                'assertMethod': CppGenerator.cpp_assertion_method_for_type_member(type_member, object_declaration)
+            }
+
+            lines.append("""    {
+        InspectorObject::iterator %(memberName)sPos = object->find(ASCIILiteral("%(memberName)s"));
+        if (%(memberName)sPos != object->end()) {
+            %(assertMethod)s(%(memberName)sPos->value.get());""" % args)
+
+            if should_count_properties:
+                lines.append('            ++foundPropertiesCount;')
+            lines.append('        }')
+            lines.append('    }')
+
+        if should_count_properties:
+            lines.append('    if (foundPropertiesCount != object->size())')
+            lines.append('        FATAL("Unexpected properties in object: %s\\n", object->toJSONString().ascii().data());')
+        lines.append('}')
+        lines.append('#endif // !ASSERT_DISABLED')
+        return '\n'.join(lines)
+
+    def _generate_assertion_for_enum(self, enum_member, object_declaration):
+        lines = []
+        lines.append('#if !ASSERT_DISABLED')
+        lines.append('void %s(Inspector::InspectorValue* value)' % CppGenerator.cpp_assertion_method_for_type_member(enum_member, object_declaration))
+        lines.append('{')
+        lines.append('    ASSERT_ARG(value, value);')
+        lines.append('    String result;')
+        lines.append('    bool castSucceeded = value->asString(result);')
+        lines.append('    ASSERT(castSucceeded);')
+
+        assert_condition = ' || '.join(['result == "%s"' % enum_value for enum_value in enum_member.type.enum_values()])
+        lines.append('    ASSERT(%s);' % assert_condition)
+        lines.append('}')
+        lines.append('#endif // !ASSERT_DISABLED')
+
+        return '\n'.join(lines)
diff --git a/inspector/scripts/codegen/generate_js_backend_commands.py b/inspector/scripts/codegen/generate_js_backend_commands.py
new file mode 100755
index 0000000..3392c78
--- /dev/null
+++ b/inspector/scripts/codegen/generate_js_backend_commands.py
@@ -0,0 +1,137 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from generator import Generator, ucfirst
+from generator_templates import GeneratorTemplates as Templates
+from models import EnumType
+
+log = logging.getLogger('global')
+
+
+class JSBackendCommandsGenerator(Generator):
+    def __init__(self, model, input_filepath):
+        Generator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return "InspectorBackendCommands.js"
+
+    def domains_to_generate(self):
+        def should_generate_domain(domain):
+            domain_enum_types = filter(lambda declaration: isinstance(declaration.type, EnumType), domain.type_declarations)
+            return len(domain.commands) > 0 or len(domain.events) > 0 or len(domain_enum_types) > 0
+
+        return filter(should_generate_domain, Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        sections = []
+        sections.append(self.generate_license())
+        sections.extend(map(self.generate_domain, self.domains_to_generate()))
+        return "\n\n".join(sections)
+
+    def generate_domain(self, domain):
+        lines = []
+        args = {
+            'domain': domain.domain_name
+        }
+
+        lines.append('// %(domain)s.' % args)
+
+        has_async_commands = any(map(lambda command: command.is_async, domain.commands))
+        if len(domain.events) > 0 or has_async_commands:
+            lines.append('InspectorBackend.register%(domain)sDispatcher = InspectorBackend.registerDomainDispatcher.bind(InspectorBackend, "%(domain)s");' % args)
+
+        for declaration in domain.type_declarations:
+            if declaration.type.is_enum():
+                enum_args = {
+                    'domain': domain.domain_name,
+                    'enumName': declaration.type_name,
+                    'enumMap': ", ".join(['%s: "%s"' % (Generator.stylized_name_for_enum_value(enum_value), enum_value) for enum_value in declaration.type.enum_values()])
+                }
+                lines.append('InspectorBackend.registerEnum("%(domain)s.%(enumName)s", {%(enumMap)s});' % enum_args)
+
+            def is_anonymous_enum_member(type_member):
+                return isinstance(type_member.type, EnumType) and type_member.type.is_anonymous
+
+            for _member in filter(is_anonymous_enum_member, declaration.type_members):
+                enum_args = {
+                    'domain': domain.domain_name,
+                    'enumName': '%s%s' % (declaration.type_name, ucfirst(_member.member_name)),
+                    'enumMap': ", ".join(['%s: "%s"' % (Generator.stylized_name_for_enum_value(enum_value), enum_value) for enum_value in _member.type.enum_values()])
+                }
+                lines.append('InspectorBackend.registerEnum("%(domain)s.%(enumName)s", {%(enumMap)s});' % enum_args)
+
+        def is_anonymous_enum_param(param):
+            return isinstance(param.type, EnumType) and param.type.is_anonymous
+
+        for event in domain.events:
+            for param in filter(is_anonymous_enum_param, event.event_parameters):
+                enum_args = {
+                    'domain': domain.domain_name,
+                    'enumName': '%s%s' % (ucfirst(event.event_name), ucfirst(param.parameter_name)),
+                    'enumMap': ", ".join(['%s: "%s"' % (Generator.stylized_name_for_enum_value(enum_value), enum_value) for enum_value in param.type.enum_values()])
+                }
+                lines.append('InspectorBackend.registerEnum("%(domain)s.%(enumName)s", {%(enumMap)s});' % enum_args)
+
+            event_args = {
+                'domain': domain.domain_name,
+                'eventName': event.event_name,
+                'params': ", ".join(['"%s"' % parameter.parameter_name for parameter in event.event_parameters])
+            }
+            lines.append('InspectorBackend.registerEvent("%(domain)s.%(eventName)s", [%(params)s]);' % event_args)
+
+        for command in domain.commands:
+            def generate_parameter_object(parameter):
+                optional_string = "true" if parameter.is_optional else "false"
+                pairs = []
+                pairs.append('"name": "%s"' % parameter.parameter_name)
+                pairs.append('"type": "%s"' % Generator.js_name_for_parameter_type(parameter.type))
+                pairs.append('"optional": %s' % optional_string)
+                return "{%s}" % ", ".join(pairs)
+
+            command_args = {
+                'domain': domain.domain_name,
+                'commandName': command.command_name,
+                'callParams': ", ".join([generate_parameter_object(parameter) for parameter in command.call_parameters]),
+                'returnParams': ", ".join(['"%s"' % parameter.parameter_name for parameter in command.return_parameters]),
+            }
+            lines.append('InspectorBackend.registerCommand("%(domain)s.%(commandName)s", [%(callParams)s], [%(returnParams)s]);' % command_args)
+
+        if domain.commands or domain.events:
+            activate_args = {
+                'domain': domain.domain_name,
+                'availability': domain.availability,
+            }
+            if domain.availability:
+                lines.append('InspectorBackend.activateDomain("%(domain)s", "%(availability)s");' % activate_args)
+            else:
+                lines.append('InspectorBackend.activateDomain("%(domain)s");' % activate_args)
+
+        return "\n".join(lines)
diff --git a/inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py b/inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py
new file mode 100755
index 0000000..a552b46
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py
@@ -0,0 +1,105 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+import re
+from string import Template
+
+from cpp_generator import CppGenerator
+from generator import Generator
+from models import Frameworks
+from objc_generator import ObjCGenerator
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+class ObjCBackendDispatcherHeaderGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sBackendDispatchers.h' % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(ObjCGenerator.should_generate_domain_command_handler_filter(self.model()), Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        headers = [
+            '<JavaScriptCore/InspectorAlternateBackendDispatchers.h>',
+            '<wtf/RetainPtr.h>',
+        ]
+
+        header_args = {
+            'includes': '\n'.join(['#include ' + header for header in headers]),
+            'forwardDeclarations': self._generate_objc_forward_declarations(),
+        }
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.BackendDispatcherHeaderPrelude).substitute(None, **header_args))
+        sections.extend(map(self._generate_objc_handler_declarations_for_domain, domains))
+        sections.append(Template(ObjCTemplates.BackendDispatcherHeaderPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_objc_forward_declarations(self):
+        lines = []
+        for domain in self.domains_to_generate():
+            if domain.commands:
+                lines.append('@protocol %s%sDomainHandler;' % (self.objc_prefix(), domain.domain_name))
+        return '\n'.join(lines)
+
+    def _generate_objc_handler_declarations_for_domain(self, domain):
+        if not domain.commands:
+            return ''
+
+        command_declarations = []
+        for command in domain.commands:
+            command_declarations.append(self._generate_objc_handler_declaration_for_command(command))
+
+        handler_args = {
+            'domainName': domain.domain_name,
+            'commandDeclarations': '\n'.join(command_declarations),
+            'objcPrefix': self.objc_prefix(),
+        }
+
+        return self.wrap_with_guard_for_domain(domain, Template(ObjCTemplates.BackendDispatcherHeaderDomainHandlerObjCDeclaration).substitute(None, **handler_args))
+
+    def _generate_objc_handler_declaration_for_command(self, command):
+        lines = []
+        parameters = ['long requestId']
+        for _parameter in command.call_parameters:
+            parameters.append('%s in_%s' % (CppGenerator.cpp_type_for_unchecked_formal_in_parameter(_parameter), _parameter.parameter_name))
+
+        command_args = {
+            'commandName': command.command_name,
+            'parameters': ', '.join(parameters),
+        }
+        lines.append('    virtual void %(commandName)s(%(parameters)s) override;' % command_args)
+        return '\n'.join(lines)
diff --git a/inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py b/inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py
new file mode 100755
index 0000000..9d5f039
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_backend_dispatcher_implementation.py
@@ -0,0 +1,194 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014-2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+import re
+from string import Template
+
+from cpp_generator import CppGenerator
+from generator import Generator
+from models import PrimitiveType, EnumType, AliasedType, Frameworks
+from objc_generator import ObjCTypeCategory, ObjCGenerator, join_type_and_name
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+class ObjCConfigurationImplementationGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sBackendDispatchers.mm' % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(ObjCGenerator.should_generate_domain_command_handler_filter(self.model()), Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        secondary_headers = [
+            '"%sInternal.h"' % self.protocol_name(),
+            '"%sTypeConversions.h"' % self.protocol_name(),
+            '<JavaScriptCore/InspectorValues.h>',
+        ]
+
+        header_args = {
+            'primaryInclude': '"%sBackendDispatchers.h"' % self.protocol_name(),
+            'secondaryIncludes': '\n'.join(['#include %s' % header for header in secondary_headers]),
+        }
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.BackendDispatcherImplementationPrelude).substitute(None, **header_args))
+        sections.extend(map(self._generate_handler_implementation_for_domain, domains))
+        sections.append(Template(ObjCTemplates.BackendDispatcherImplementationPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_handler_implementation_for_domain(self, domain):
+        if not domain.commands:
+            return ''
+
+        command_declarations = []
+        for command in domain.commands:
+            command_declarations.append(self._generate_handler_implementation_for_command(domain, command))
+
+        return '\n'.join(command_declarations)
+
+    def _generate_handler_implementation_for_command(self, domain, command):
+        lines = []
+        parameters = ['long requestId']
+        for parameter in command.call_parameters:
+            parameters.append('%s in_%s' % (CppGenerator.cpp_type_for_unchecked_formal_in_parameter(parameter), parameter.parameter_name))
+
+        command_args = {
+            'domainName': domain.domain_name,
+            'commandName': command.command_name,
+            'parameters': ', '.join(parameters),
+            'successCallback': self._generate_success_block_for_command(domain, command),
+            'conversions': self._generate_conversions_for_command(domain, command),
+            'invocation': self._generate_invocation_for_command(domain, command),
+        }
+
+        return self.wrap_with_guard_for_domain(domain, Template(ObjCTemplates.BackendDispatcherHeaderDomainHandlerImplementation).substitute(None, **command_args))
+
+    def _generate_success_block_for_command(self, domain, command):
+        lines = []
+
+        if command.return_parameters:
+            success_block_parameters = []
+            for parameter in command.return_parameters:
+                objc_type = self.objc_type_for_param(domain, command.command_name, parameter)
+                var_name = ObjCGenerator.identifier_to_objc_identifier(parameter.parameter_name)
+                success_block_parameters.append(join_type_and_name(objc_type, var_name))
+            lines.append('    id successCallback = ^(%s) {' % ', '.join(success_block_parameters))
+        else:
+            lines.append('    id successCallback = ^{')
+
+        if command.return_parameters:
+            lines.append('        Ref<InspectorObject> resultObject = InspectorObject::create();')
+
+            required_pointer_parameters = filter(lambda parameter: not parameter.is_optional and ObjCGenerator.is_type_objc_pointer_type(parameter.type), command.return_parameters)
+            for parameter in required_pointer_parameters:
+                var_name = ObjCGenerator.identifier_to_objc_identifier(parameter.parameter_name)
+                lines.append('        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(%s, @"%s");' % (var_name, var_name))
+                objc_array_class = self.objc_class_for_array_type(parameter.type)
+                if objc_array_class and objc_array_class.startswith(self.objc_prefix()):
+                    lines.append('        THROW_EXCEPTION_FOR_BAD_TYPE_IN_ARRAY(%s, [%s class]);' % (var_name, objc_array_class))
+
+            optional_pointer_parameters = filter(lambda parameter: parameter.is_optional and ObjCGenerator.is_type_objc_pointer_type(parameter.type), command.return_parameters)
+            for parameter in optional_pointer_parameters:
+                var_name = ObjCGenerator.identifier_to_objc_identifier(parameter.parameter_name)
+                lines.append('        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(%s, @"%s");' % (var_name, var_name))
+                objc_array_class = self.objc_class_for_array_type(parameter.type)
+                if objc_array_class and objc_array_class.startswith(self.objc_prefix()):
+                    lines.append('        THROW_EXCEPTION_FOR_BAD_TYPE_IN_OPTIONAL_ARRAY(%s, [%s class]);' % (var_name, objc_array_class))
+
+            for parameter in command.return_parameters:
+                keyed_set_method = CppGenerator.cpp_setter_method_for_type(parameter.type)
+                var_name = ObjCGenerator.identifier_to_objc_identifier(parameter.parameter_name)
+                var_expression = '*%s' % var_name if parameter.is_optional else var_name
+                export_expression = self.objc_protocol_export_expression_for_variable(parameter.type, var_expression)
+                if not parameter.is_optional:
+                    lines.append('        resultObject->%s(ASCIILiteral("%s"), %s);' % (keyed_set_method, parameter.parameter_name, export_expression))
+                else:
+                    lines.append('        if (%s)' % var_name)
+                    lines.append('            resultObject->%s(ASCIILiteral("%s"), %s);' % (keyed_set_method, parameter.parameter_name, export_expression))
+            lines.append('        backendDispatcher()->sendResponse(requestId, WTFMove(resultObject));')
+        else:
+            lines.append('        backendDispatcher()->sendResponse(requestId, InspectorObject::create());')
+
+        lines.append('    };')
+        return '\n'.join(lines)
+
+    def _generate_conversions_for_command(self, domain, command):
+        lines = []
+        if command.call_parameters:
+            lines.append('')
+
+        def in_param_expression(param_name, parameter):
+            _type = parameter.type
+            if isinstance(_type, AliasedType):
+                _type = _type.aliased_type  # Fall through to enum or primitive.
+            if isinstance(_type, EnumType):
+                _type = _type.primitive_type  # Fall through to primitive.
+            if isinstance(_type, PrimitiveType):
+                if _type.raw_name() in ['array', 'any', 'object']:
+                    return '&%s' % param_name if not parameter.is_optional else param_name
+                return '*%s' % param_name if parameter.is_optional else param_name
+            return '&%s' % param_name if not parameter.is_optional else param_name
+
+        for parameter in command.call_parameters:
+            in_param_name = 'in_%s' % parameter.parameter_name
+            objc_in_param_name = 'o_%s' % in_param_name
+            objc_type = self.objc_type_for_param(domain, command.command_name, parameter, False)
+            param_expression = in_param_expression(in_param_name, parameter)
+            import_expression = self.objc_protocol_import_expression_for_parameter(param_expression, domain, command.command_name, parameter)
+            if not parameter.is_optional:
+                lines.append('    %s = %s;' % (join_type_and_name(objc_type, objc_in_param_name), import_expression))
+            else:
+                lines.append('    %s;' % join_type_and_name(objc_type, objc_in_param_name))
+                lines.append('    if (%s)' % in_param_name)
+                lines.append('        %s = %s;' % (objc_in_param_name, import_expression))
+
+        if lines:
+            lines.append('')
+        return '\n'.join(lines)
+
+    def _generate_invocation_for_command(self, domain, command):
+        pairs = []
+        pairs.append('WithErrorCallback:errorCallback')
+        pairs.append('successCallback:successCallback')
+        for parameter in command.call_parameters:
+            in_param_name = 'in_%s' % parameter.parameter_name
+            objc_in_param_name = 'o_%s' % in_param_name
+            if not parameter.is_optional:
+                pairs.append('%s:%s' % (parameter.parameter_name, objc_in_param_name))
+            else:
+                optional_expression = '(%s ? &%s : nil)' % (in_param_name, objc_in_param_name)
+                pairs.append('%s:%s' % (parameter.parameter_name, optional_expression))
+        return '    [m_delegate %s%s];' % (command.command_name, ' '.join(pairs))
diff --git a/inspector/scripts/codegen/generate_objc_configuration_header.py b/inspector/scripts/codegen/generate_objc_configuration_header.py
new file mode 100755
index 0000000..5e9c9e0
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_configuration_header.py
@@ -0,0 +1,87 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from generator import Generator
+from objc_generator import ObjCGenerator
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+class ObjCConfigurationHeaderGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sConfiguration.h' % self.protocol_name()
+
+    def generate_output(self):
+        headers = [
+            '<WebInspector/%s.h>' % self.protocol_name(),
+        ]
+
+        header_args = {
+            'includes': '\n'.join(['#import ' + header for header in headers]),
+        }
+
+        self._command_filter = ObjCGenerator.should_generate_domain_command_handler_filter(self.model())
+        self._event_filter = ObjCGenerator.should_generate_domain_event_dispatcher_filter(self.model())
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.GenericHeaderPrelude).substitute(None, **header_args))
+        sections.append(self._generate_configuration_interface_for_domains(domains))
+        sections.append(Template(ObjCTemplates.GenericHeaderPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_configuration_interface_for_domains(self, domains):
+        lines = []
+        lines.append('__attribute__((visibility ("default")))')
+        lines.append('@interface %sConfiguration : NSObject' % self.protocol_name())
+        for domain in domains:
+            lines.extend(self._generate_properties_for_domain(domain))
+        lines.append('@end')
+        return '\n'.join(lines)
+
+    def _generate_properties_for_domain(self, domain):
+        property_args = {
+            'objcPrefix': self.objc_prefix(),
+            'domainName': domain.domain_name,
+            'variableNamePrefix': ObjCGenerator.variable_name_prefix_for_domain(domain),
+        }
+
+        lines = []
+        if domain.commands and self._command_filter(domain):
+            lines.append(Template(ObjCTemplates.ConfigurationCommandProperty).substitute(None, **property_args))
+        if domain.events and self._event_filter(domain):
+            lines.append(Template(ObjCTemplates.ConfigurationEventProperty).substitute(None, **property_args))
+        return lines
diff --git a/inspector/scripts/codegen/generate_objc_configuration_implementation.py b/inspector/scripts/codegen/generate_objc_configuration_implementation.py
new file mode 100755
index 0000000..2a4822d
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_configuration_implementation.py
@@ -0,0 +1,150 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from generator import Generator
+from objc_generator import ObjCGenerator
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+class ObjCBackendDispatcherImplementationGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sConfiguration.mm' % self.protocol_name()
+
+    def generate_output(self):
+        secondary_headers = [
+            '"%sInternal.h"' % self.protocol_name(),
+            '"%sBackendDispatchers.h"' % self.protocol_name(),
+            '<JavaScriptCore/AlternateDispatchableAgent.h>',
+            '<JavaScriptCore/AugmentableInspectorController.h>',
+            '<JavaScriptCore/InspectorAlternateBackendDispatchers.h>',
+            '<JavaScriptCore/InspectorBackendDispatchers.h>',
+        ]
+
+        header_args = {
+            'primaryInclude': '"%sConfiguration.h"' % self.protocol_name(),
+            'secondaryIncludes': '\n'.join(['#import %s' % header for header in secondary_headers]),
+        }
+
+        self._command_filter = ObjCGenerator.should_generate_domain_command_handler_filter(self.model())
+        self._event_filter = ObjCGenerator.should_generate_domain_event_dispatcher_filter(self.model())
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.ImplementationPrelude).substitute(None, **header_args))
+        sections.append(self._generate_configuration_implementation_for_domains(domains))
+        sections.append(Template(ObjCTemplates.ImplementationPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_configuration_implementation_for_domains(self, domains):
+        lines = []
+        lines.append('@implementation %sConfiguration' % self.protocol_name())
+        lines.append('{')
+        lines.append('    AugmentableInspectorController* _controller;')
+        lines.extend(self._generate_ivars(domains))
+        lines.append('}')
+        lines.append('')
+        lines.append('- (instancetype)initWithController:(AugmentableInspectorController*)controller')
+        lines.append('{')
+        lines.append('    self = [super init];')
+        lines.append('    if (!self)')
+        lines.append('        return nil;')
+        lines.append('    ASSERT(controller);')
+        lines.append('    _controller = controller;')
+        lines.append('    return self;')
+        lines.append('}')
+        lines.append('')
+        lines.extend(self._generate_dealloc(domains))
+        lines.append('')
+        for domain in domains:
+            if domain.commands and self._command_filter(domain):
+                lines.append(self._generate_handler_setter_for_domain(domain))
+                lines.append('')
+            if domain.events and self._event_filter(domain):
+                lines.append(self._generate_event_dispatcher_getter_for_domain(domain))
+                lines.append('')
+        lines.append('@end')
+        return '\n'.join(lines)
+
+    def _generate_ivars(self, domains):
+        lines = []
+        for domain in domains:
+            if domain.commands and self._command_filter(domain):
+                objc_class_name = '%s%sDomainHandler' % (self.objc_prefix(), domain.domain_name)
+                ivar_name = '_%sHandler' % ObjCGenerator.variable_name_prefix_for_domain(domain)
+                lines.append('    id<%s> %s;' % (objc_class_name, ivar_name))
+            if domain.events and self._event_filter(domain):
+                objc_class_name = '%s%sDomainEventDispatcher' % (self.objc_prefix(), domain.domain_name)
+                ivar_name = '_%sEventDispatcher' % ObjCGenerator.variable_name_prefix_for_domain(domain)
+                lines.append('    %s *%s;' % (objc_class_name, ivar_name))
+        return lines
+
+    def _generate_dealloc(self, domains):
+        lines = []
+        lines.append('- (void)dealloc')
+        lines.append('{')
+        for domain in domains:
+            if domain.commands and self._command_filter(domain):
+                lines.append('    [_%sHandler release];' % ObjCGenerator.variable_name_prefix_for_domain(domain))
+            if domain.events and self._event_filter(domain):
+                lines.append('    [_%sEventDispatcher release];' % ObjCGenerator.variable_name_prefix_for_domain(domain))
+        lines.append('    [super dealloc];')
+        lines.append('}')
+        return lines
+
+    def _generate_handler_setter_for_domain(self, domain):
+        setter_args = {
+            'objcPrefix': self.objc_prefix(),
+            'domainName': domain.domain_name,
+            'variableNamePrefix': ObjCGenerator.variable_name_prefix_for_domain(domain),
+        }
+        return Template(ObjCTemplates.ConfigurationCommandPropertyImplementation).substitute(None, **setter_args)
+
+    def _generate_event_dispatcher_getter_for_domain(self, domain):
+        getter_args = {
+            'objcPrefix': self.objc_prefix(),
+            'domainName': domain.domain_name,
+            'variableNamePrefix': ObjCGenerator.variable_name_prefix_for_domain(domain),
+        }
+        return Template(ObjCTemplates.ConfigurationGetterImplementation).substitute(None, **getter_args)
+
+    def _variable_name_prefix_for_domain(self, domain):
+        domain_name = domain.domain_name
+        if domain_name.startswith('DOM'):
+            return 'dom' + domain_name[3:]
+        if domain_name.startswith('CSS'):
+            return 'css' + domain_name[3:]
+        return domain_name[:1].lower() + domain_name[1:]
diff --git a/inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py b/inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py
new file mode 100755
index 0000000..1407a60
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_frontend_dispatcher_implementation.py
@@ -0,0 +1,154 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014-2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from cpp_generator import CppGenerator
+from generator import Generator, ucfirst
+from objc_generator import ObjCGenerator
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+class ObjCFrontendDispatcherImplementationGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sEventDispatchers.mm' % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(ObjCGenerator.should_generate_domain_event_dispatcher_filter(self.model()), Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        secondary_headers = [
+            '"%sTypeConversions.h"' % self.protocol_name(),
+            '<JavaScriptCore/InspectorValues.h>',
+        ]
+
+        header_args = {
+            'primaryInclude': '"%sInternal.h"' % self.protocol_name(),
+            'secondaryIncludes': '\n'.join(['#import %s' % header for header in secondary_headers]),
+        }
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.ImplementationPrelude).substitute(None, **header_args))
+        sections.extend(map(self._generate_event_dispatcher_implementations, domains))
+        sections.append(Template(ObjCTemplates.ImplementationPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_event_dispatcher_implementations(self, domain):
+        if not domain.events:
+            return ''
+
+        lines = []
+        objc_name = '%s%sDomainEventDispatcher' % (self.objc_prefix(), domain.domain_name)
+        lines.append('@implementation %s' % objc_name)
+        lines.append('{')
+        lines.append('    AugmentableInspectorController* _controller;')
+        lines.append('}')
+        lines.append('')
+        lines.append('- (instancetype)initWithController:(AugmentableInspectorController*)controller;')
+        lines.append('{')
+        lines.append('    self = [super init];')
+        lines.append('    if (!self)')
+        lines.append('        return nil;')
+        lines.append('    ASSERT(controller);')
+        lines.append('    _controller = controller;')
+        lines.append('    return self;')
+        lines.append('}')
+        lines.append('')
+        for event in domain.events:
+            lines.append(self._generate_event(domain, event))
+            lines.append('')
+        lines.append('@end')
+        return '\n'.join(lines)
+
+    def _generate_event(self, domain, event):
+        lines = []
+        lines.append(self._generate_event_signature(domain, event))
+        lines.append('{')
+        lines.append('    const FrontendRouter& router = _controller->frontendRouter();')
+        lines.append('')
+
+        required_pointer_parameters = filter(lambda parameter: not parameter.is_optional and ObjCGenerator.is_type_objc_pointer_type(parameter.type), event.event_parameters)
+        for parameter in required_pointer_parameters:
+            var_name = ObjCGenerator.identifier_to_objc_identifier(parameter.parameter_name)
+            lines.append('    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(%s, @"%s");' % (var_name, var_name))
+            objc_array_class = self.objc_class_for_array_type(parameter.type)
+            if objc_array_class and objc_array_class.startswith(self.objc_prefix()):
+                lines.append('    THROW_EXCEPTION_FOR_BAD_TYPE_IN_ARRAY(%s, [%s class]);' % (var_name, objc_array_class))
+
+        optional_pointer_parameters = filter(lambda parameter: parameter.is_optional and ObjCGenerator.is_type_objc_pointer_type(parameter.type), event.event_parameters)
+        for parameter in optional_pointer_parameters:
+            var_name = ObjCGenerator.identifier_to_objc_identifier(parameter.parameter_name)
+            lines.append('    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(%s, @"%s");' % (var_name, var_name))
+            objc_array_class = self.objc_class_for_array_type(parameter.type)
+            if objc_array_class and objc_array_class.startswith(self.objc_prefix()):
+                lines.append('    THROW_EXCEPTION_FOR_BAD_TYPE_IN_OPTIONAL_ARRAY(%s, [%s class]);' % (var_name, objc_array_class))
+
+        if required_pointer_parameters or optional_pointer_parameters:
+            lines.append('')
+
+        lines.append('    Ref<InspectorObject> jsonMessage = InspectorObject::create();')
+        lines.append('    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("%s.%s"));' % (domain.domain_name, event.event_name))
+        if event.event_parameters:
+            lines.extend(self._generate_event_out_parameters(domain, event))
+        lines.append('    router.sendEvent(jsonMessage->toJSONString());')
+        lines.append('}')
+        return '\n'.join(lines)
+
+    def _generate_event_signature(self, domain, event):
+        if not event.event_parameters:
+            return '- (void)%s' % event.event_name
+        pairs = []
+        for parameter in event.event_parameters:
+            param_name = parameter.parameter_name
+            pairs.append('%s:(%s)%s' % (param_name, self.objc_type_for_param(domain, event.event_name, parameter), param_name))
+        pairs[0] = ucfirst(pairs[0])
+        return '- (void)%sWith%s' % (event.event_name, ' '.join(pairs))
+
+    def _generate_event_out_parameters(self, domain, event):
+        lines = []
+        lines.append('    Ref<InspectorObject> paramsObject = InspectorObject::create();')
+        for parameter in event.event_parameters:
+            keyed_set_method = CppGenerator.cpp_setter_method_for_type(parameter.type)
+            var_name = parameter.parameter_name
+            safe_var_name = '(*%s)' % var_name if parameter.is_optional else var_name
+            export_expression = self.objc_protocol_export_expression_for_variable(parameter.type, safe_var_name)
+            if not parameter.is_optional:
+                lines.append('    paramsObject->%s(ASCIILiteral("%s"), %s);' % (keyed_set_method, parameter.parameter_name, export_expression))
+            else:
+                lines.append('    if (%s)' % (parameter.parameter_name))
+                lines.append('        paramsObject->%s(ASCIILiteral("%s"), %s);' % (keyed_set_method, parameter.parameter_name, export_expression))
+        lines.append('    jsonMessage->setObject(ASCIILiteral("params"), WTFMove(paramsObject));')
+        return lines
diff --git a/inspector/scripts/codegen/generate_objc_header.py b/inspector/scripts/codegen/generate_objc_header.py
new file mode 100755
index 0000000..f5ba7ab
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_header.py
@@ -0,0 +1,238 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from generator import Generator, ucfirst
+from models import ObjectType, EnumType
+from objc_generator import ObjCGenerator, join_type_and_name
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+def add_newline(lines):
+    if lines and lines[-1] == '':
+        return
+    lines.append('')
+
+
+class ObjCHeaderGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%s.h' % self.protocol_name()
+
+    def generate_output(self):
+        headers = set([
+            '<WebInspector/%sJSONObject.h>' % ObjCGenerator.OBJC_STATIC_PREFIX,
+        ])
+
+        header_args = {
+            'includes': '\n'.join(['#import ' + header for header in sorted(headers)]),
+        }
+
+        domains = self.domains_to_generate()
+        type_domains = filter(ObjCGenerator.should_generate_domain_types_filter(self.model()), domains)
+        command_domains = filter(ObjCGenerator.should_generate_domain_command_handler_filter(self.model()), domains)
+        event_domains = filter(ObjCGenerator.should_generate_domain_event_dispatcher_filter(self.model()), domains)
+
+        # FIXME: <https://webkit.org/b/138222> Web Inspector: Reduce unnecessary enums/types generated in ObjC Protocol Interfaces
+        # Currently we generate enums/types for all types in the type_domains. For the built-in
+        # JSC domains (Debugger, Runtime) this produces extra unused types. We only need to
+        # generate these types if they are referenced by the command_domains or event_domains.
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.HeaderPrelude).substitute(None, **header_args))
+        sections.append('\n'.join(filter(None, map(self._generate_forward_declarations, type_domains))))
+        sections.append('\n'.join(filter(None, map(self._generate_enums, type_domains))))
+        sections.append('\n'.join(filter(None, map(self._generate_types, type_domains))))
+
+        if self.get_generator_setting('generate_backend', False):
+            sections.append('\n\n'.join(filter(None, map(self._generate_command_protocols, command_domains))))
+            sections.append('\n\n'.join(filter(None, map(self._generate_event_interfaces, event_domains))))
+
+        sections.append(Template(ObjCTemplates.HeaderPostlude).substitute(None))
+        return '\n\n'.join(sections)
+
+    def _generate_forward_declarations(self, domain):
+        lines = []
+        for declaration in domain.type_declarations:
+            if (isinstance(declaration.type, ObjectType)):
+                objc_name = self.objc_name_for_type(declaration.type)
+                lines.append('@class %s;' % objc_name)
+        return '\n'.join(lines)
+
+    def _generate_enums(self, domain):
+        lines = []
+
+        # Type enums and member enums.
+        for declaration in domain.type_declarations:
+            if isinstance(declaration.type, EnumType):
+                add_newline(lines)
+                lines.append(self._generate_anonymous_enum_for_declaration(domain, declaration))
+            else:
+                for member in declaration.type_members:
+                    if isinstance(member.type, EnumType) and member.type.is_anonymous:
+                        add_newline(lines)
+                        lines.append(self._generate_anonymous_enum_for_member(domain, declaration, member))
+
+        # Anonymous command enums.
+        for command in domain.commands:
+            for parameter in command.call_parameters:
+                if isinstance(parameter.type, EnumType) and parameter.type.is_anonymous:
+                    add_newline(lines)
+                    lines.append(self._generate_anonymous_enum_for_parameter(domain, command.command_name, parameter))
+            for parameter in command.return_parameters:
+                if isinstance(parameter.type, EnumType) and parameter.type.is_anonymous:
+                    add_newline(lines)
+                    lines.append(self._generate_anonymous_enum_for_parameter(domain, command.command_name, parameter))
+
+        # Anonymous event enums.
+        for event in domain.events:
+            for parameter in event.event_parameters:
+                if isinstance(parameter.type, EnumType) and parameter.type.is_anonymous:
+                    add_newline(lines)
+                    lines.append(self._generate_anonymous_enum_for_parameter(domain, event.event_name, parameter))
+
+        return '\n'.join(lines)
+
+    def _generate_types(self, domain):
+        lines = []
+        # Type interfaces.
+        for declaration in domain.type_declarations:
+            if isinstance(declaration.type, ObjectType):
+                add_newline(lines)
+                lines.append(self._generate_type_interface(domain, declaration))
+        return '\n'.join(lines)
+
+    def _generate_anonymous_enum_for_declaration(self, domain, declaration):
+        objc_enum_name = self.objc_enum_name_for_anonymous_enum_declaration(declaration)
+        return self._generate_enum(objc_enum_name, declaration.type.enum_values())
+
+    def _generate_anonymous_enum_for_member(self, domain, declaration, member):
+        objc_enum_name = self.objc_enum_name_for_anonymous_enum_member(declaration, member)
+        return self._generate_enum(objc_enum_name, member.type.enum_values())
+
+    def _generate_anonymous_enum_for_parameter(self, domain, event_or_command_name, parameter):
+        objc_enum_name = self.objc_enum_name_for_anonymous_enum_parameter(domain, event_or_command_name, parameter)
+        return self._generate_enum(objc_enum_name, parameter.type.enum_values())
+
+    def _generate_enum(self, enum_name, enum_values):
+        lines = []
+        lines.append('typedef NS_ENUM(NSInteger, %s) {' % enum_name)
+        for enum_value in enum_values:
+            lines.append('    %s%s,' % (enum_name, Generator.stylized_name_for_enum_value(enum_value)))
+        lines.append('};')
+        return '\n'.join(lines)
+
+    def _generate_type_interface(self, domain, declaration):
+        lines = []
+        objc_name = self.objc_name_for_type(declaration.type)
+        lines.append('__attribute__((visibility ("default")))')
+        lines.append('@interface %s : %sJSONObject' % (objc_name, ObjCGenerator.OBJC_STATIC_PREFIX))
+
+        # The initializers that take a payload or inspector object are only needed by the frontend.
+        if self.get_generator_setting('generate_frontend', False):
+            lines.append('- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;')
+            lines.append('- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;')
+
+        required_members = filter(lambda member: not member.is_optional, declaration.type_members)
+        optional_members = filter(lambda member: member.is_optional, declaration.type_members)
+        if required_members:
+            lines.append(self._generate_init_method_for_required_members(domain, declaration, required_members))
+        for member in required_members:
+            lines.append('/* required */ ' + self._generate_member_property(declaration, member))
+        for member in optional_members:
+            lines.append('/* optional */ ' + self._generate_member_property(declaration, member))
+        lines.append('@end')
+        return '\n'.join(lines)
+
+    def _generate_init_method_for_required_members(self, domain, declaration, required_members):
+        pairs = []
+        for member in required_members:
+            objc_type = self.objc_type_for_member(declaration, member)
+            var_name = ObjCGenerator.identifier_to_objc_identifier(member.member_name)
+            pairs.append('%s:(%s)%s' % (var_name, objc_type, var_name))
+        pairs[0] = ucfirst(pairs[0])
+        return '- (instancetype)initWith%s;' % ' '.join(pairs)
+
+    def _generate_member_property(self, declaration, member):
+        accessor_type = self.objc_accessor_type_for_member(member)
+        objc_type = self.objc_type_for_member(declaration, member)
+        return '@property (nonatomic, %s) %s;' % (accessor_type, join_type_and_name(objc_type, ObjCGenerator.identifier_to_objc_identifier(member.member_name)))
+
+    def _generate_command_protocols(self, domain):
+        lines = []
+        if domain.commands:
+            objc_name = '%s%sDomainHandler' % (self.objc_prefix(), domain.domain_name)
+            lines.append('@protocol %s <NSObject>' % objc_name)
+            lines.append('@required')
+            for command in domain.commands:
+                lines.append(self._generate_single_command_protocol(domain, command))
+            lines.append('@end')
+        return '\n'.join(lines)
+
+    def _generate_single_command_protocol(self, domain, command):
+        pairs = []
+        pairs.append('ErrorCallback:(void(^)(NSString *error))errorCallback')
+        pairs.append('successCallback:(%s)successCallback' % self._callback_block_for_command(domain, command))
+        for parameter in command.call_parameters:
+            param_name = parameter.parameter_name
+            pairs.append('%s:(%s)%s' % (param_name, self.objc_type_for_param(domain, command.command_name, parameter), param_name))
+        return '- (void)%sWith%s;' % (command.command_name, ' '.join(pairs))
+
+    def _callback_block_for_command(self, domain, command):
+        pairs = []
+        for parameter in command.return_parameters:
+            pairs.append(join_type_and_name(self.objc_type_for_param(domain, command.command_name, parameter), parameter.parameter_name))
+        return 'void(^)(%s)' % ', '.join(pairs)
+
+    def _generate_event_interfaces(self, domain):
+        lines = []
+        if domain.events:
+            objc_name = '%s%sDomainEventDispatcher' % (self.objc_prefix(), domain.domain_name)
+            lines.append('__attribute__((visibility ("default")))')
+            lines.append('@interface %s : NSObject' % objc_name)
+            for event in domain.events:
+                lines.append(self._generate_single_event_interface(domain, event))
+            lines.append('@end')
+        return '\n'.join(lines)
+
+    def _generate_single_event_interface(self, domain, event):
+        if not event.event_parameters:
+            return '- (void)%s;' % event.event_name
+        pairs = []
+        for parameter in event.event_parameters:
+            param_name = parameter.parameter_name
+            pairs.append('%s:(%s)%s' % (param_name, self.objc_type_for_param(domain, event.event_name, parameter), param_name))
+        pairs[0] = ucfirst(pairs[0])
+        return '- (void)%sWith%s;' % (event.event_name, ' '.join(pairs))
diff --git a/inspector/scripts/codegen/generate_objc_internal_header.py b/inspector/scripts/codegen/generate_objc_internal_header.py
new file mode 100755
index 0000000..47006cf
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_internal_header.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from generator import Generator, ucfirst
+from objc_generator import ObjCGenerator
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+class ObjCInternalHeaderGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sInternal.h' % self.protocol_name()
+
+    def generate_output(self):
+        headers = set([
+            '"%s.h"' % self.protocol_name(),
+            '"%sJSONObjectPrivate.h"' % self.protocol_name(),
+            '<JavaScriptCore/InspectorValues.h>',
+            '<JavaScriptCore/AugmentableInspectorController.h>',
+        ])
+
+        header_args = {
+            'includes': '\n'.join(['#import ' + header for header in sorted(headers)]),
+        }
+
+        domains = self.domains_to_generate()
+        event_domains = filter(ObjCGenerator.should_generate_domain_event_dispatcher_filter(self.model()), domains)
+
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.GenericHeaderPrelude).substitute(None, **header_args))
+        sections.append('\n\n'.join(filter(None, map(self._generate_event_dispatcher_private_interfaces, event_domains))))
+        sections.append(Template(ObjCTemplates.GenericHeaderPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_event_dispatcher_private_interfaces(self, domain):
+        lines = []
+        if domain.events:
+            objc_name = '%s%sDomainEventDispatcher' % (self.objc_prefix(), domain.domain_name)
+            lines.append('@interface %s (Private)' % objc_name)
+            lines.append('- (instancetype)initWithController:(Inspector::AugmentableInspectorController*)controller;')
+            lines.append('@end')
+        return '\n'.join(lines)
diff --git a/inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py b/inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py
new file mode 100755
index 0000000..55dabf4
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_protocol_type_conversions_header.py
@@ -0,0 +1,157 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from generator import Generator
+from models import EnumType, Frameworks
+from objc_generator import ObjCGenerator
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+def add_newline(lines):
+    if lines and lines[-1] == '':
+        return
+    lines.append('')
+
+
+class ObjCProtocolTypeConversionsHeaderGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sTypeConversions.h' % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(ObjCGenerator.should_generate_domain_types_filter(self.model()), Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        headers = [
+            '"%s.h"' % self.protocol_name(),
+            Generator.string_for_file_include('%sArrayConversions.h' % ObjCGenerator.OBJC_STATIC_PREFIX, Frameworks.WebInspector, self.model().framework),
+        ]
+        headers.sort()
+
+        header_args = {
+            'includes': '\n'.join(['#import ' + header for header in headers]),
+        }
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.TypeConversionsHeaderPrelude).substitute(None, **header_args))
+        sections.append(Template(ObjCTemplates.TypeConversionsHeaderStandard).substitute(None))
+        sections.extend(map(self._generate_enum_conversion_functions, domains))
+        sections.append(Template(ObjCTemplates.TypeConversionsHeaderPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_enum_conversion_functions(self, domain):
+        lines = []
+
+        # Type enums and member enums.
+        for declaration in domain.type_declarations:
+            if isinstance(declaration.type, EnumType):
+                add_newline(lines)
+                lines.append(self._generate_anonymous_enum_conversion_for_declaration(domain, declaration))
+            else:
+                for member in declaration.type_members:
+                    if (isinstance(member.type, EnumType) and member.type.is_anonymous):
+                        add_newline(lines)
+                        lines.append(self._generate_anonymous_enum_conversion_for_member(domain, declaration, member))
+
+        # Anonymous command enums.
+        for command in domain.commands:
+            for parameter in command.call_parameters:
+                if (isinstance(parameter.type, EnumType) and parameter.type.is_anonymous):
+                    add_newline(lines)
+                    lines.append(self._generate_anonymous_enum_conversion_for_parameter(domain, command.command_name, parameter))
+            for parameter in command.return_parameters:
+                if (isinstance(parameter.type, EnumType) and parameter.type.is_anonymous):
+                    add_newline(lines)
+                    lines.append(self._generate_anonymous_enum_conversion_for_parameter(domain, command.command_name, parameter))
+
+        # Anonymous event enums.
+        for event in domain.events:
+            for parameter in event.event_parameters:
+                if (isinstance(parameter.type, EnumType) and parameter.type.is_anonymous):
+                    add_newline(lines)
+                    lines.append(self._generate_anonymous_enum_conversion_for_parameter(domain, event.event_name, parameter))
+
+        return '\n'.join(lines)
+
+    def _generate_anonymous_enum_conversion_for_declaration(self, domain, declaration):
+        objc_enum_name = self.objc_enum_name_for_anonymous_enum_declaration(declaration)
+        enum_values = declaration.type.enum_values()
+        lines = []
+        lines.append(self._generate_enum_objc_to_protocol_string(objc_enum_name, enum_values))
+        lines.append(self._generate_enum_from_protocol_string(objc_enum_name, enum_values))
+        return '\n\n'.join(lines)
+
+    def _generate_anonymous_enum_conversion_for_member(self, domain, declaration, member):
+        objc_enum_name = self.objc_enum_name_for_anonymous_enum_member(declaration, member)
+        enum_values = member.type.enum_values()
+        lines = []
+        lines.append(self._generate_enum_objc_to_protocol_string(objc_enum_name, enum_values))
+        lines.append(self._generate_enum_from_protocol_string(objc_enum_name, enum_values))
+        return '\n\n'.join(lines)
+
+    def _generate_anonymous_enum_conversion_for_parameter(self, domain, event_or_command_name, parameter):
+        objc_enum_name = self.objc_enum_name_for_anonymous_enum_parameter(domain, event_or_command_name, parameter)
+        enum_values = parameter.type.enum_values()
+        lines = []
+        lines.append(self._generate_enum_objc_to_protocol_string(objc_enum_name, enum_values))
+        lines.append(self._generate_enum_from_protocol_string(objc_enum_name, enum_values))
+        return '\n\n'.join(lines)
+
+    def _generate_enum_objc_to_protocol_string(self, objc_enum_name, enum_values):
+        lines = []
+        lines.append('inline String toProtocolString(%s value)' % objc_enum_name)
+        lines.append('{')
+        lines.append('    switch(value) {')
+        for enum_value in enum_values:
+            lines.append('    case %s%s:' % (objc_enum_name, Generator.stylized_name_for_enum_value(enum_value)))
+            lines.append('        return ASCIILiteral("%s");' % enum_value)
+        lines.append('    }')
+        lines.append('}')
+        return '\n'.join(lines)
+
+    def _generate_enum_from_protocol_string(self, objc_enum_name, enum_values):
+        lines = []
+        lines.append('template<>')
+        lines.append('inline %s fromProtocolString(const String& value)' % objc_enum_name)
+        lines.append('{')
+        for enum_value in enum_values:
+            lines.append('    if (value == "%s")' % enum_value)
+            lines.append('        return %s%s;' % (objc_enum_name, Generator.stylized_name_for_enum_value(enum_value)))
+        lines.append('    ASSERT_NOT_REACHED();')
+        lines.append('    return %s%s;' % (objc_enum_name, Generator.stylized_name_for_enum_value(enum_values[0])))
+        lines.append('}')
+        return '\n'.join(lines)
diff --git a/inspector/scripts/codegen/generate_objc_protocol_type_conversions_implementation.py b/inspector/scripts/codegen/generate_objc_protocol_type_conversions_implementation.py
new file mode 100644
index 0000000..9722aa4
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_protocol_type_conversions_implementation.py
@@ -0,0 +1,136 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from generator import Generator
+from models import EnumType, ObjectType, ArrayType, AliasedType, PrimitiveType, Frameworks
+from objc_generator import ObjCGenerator
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+def add_newline(lines):
+    if lines and lines[-1] == '':
+        return
+    lines.append('')
+
+
+class ObjCProtocolTypeConversionsImplementationGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sTypeConversions.mm' % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(ObjCGenerator.should_generate_domain_types_filter(self.model()), Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        secondary_headers = [
+            '"%s.h"' % self.protocol_name(),
+            '"%sTypeParser.h"' % self.protocol_name(),
+            Generator.string_for_file_include('%sJSONObjectPrivate.h' % ObjCGenerator.OBJC_STATIC_PREFIX, Frameworks.WebInspector, self.model().framework),
+        ]
+        secondary_headers.sort()
+
+        header_args = {
+            'primaryInclude': '"%sTypeConversions.h"' % self.protocol_name(),
+            'secondaryIncludes': '\n'.join(['#import ' + header for header in secondary_headers]),
+        }
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.ImplementationPrelude).substitute(None, **header_args))
+        sections.append(self._generate_type_factory_category_interface(domains))
+        sections.append(self._generate_type_factory_category_implementation(domains))
+        sections.append(Template(ObjCTemplates.ImplementationPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def _generate_type_factory_category_interface(self, domains):
+        lines = []
+        for domain in domains:
+            lines.append('@interface %sTypeConversions (%sDomain)' % (self.protocol_name(), domain.domain_name))
+            lines.append('')
+
+            for declaration in domain.type_declarations:
+                lines.append(self._generate_type_factory_method_declaration(domain, declaration))
+
+            add_newline(lines)
+            lines.append('@end')
+
+        return '\n'.join(lines)
+
+    def _generate_type_factory_method_declaration(self, domain, declaration):
+        resolved_type = declaration.type
+        if isinstance(resolved_type, AliasedType):
+            resolved_type = resolved_type.aliased_type
+        if isinstance(resolved_type, (ObjectType, ArrayType, PrimitiveType)):
+            objc_type = self.objc_class_for_type(resolved_type)
+            return '+ (void)_parse%s:(%s **)outValue fromPayload:(id)payload;' % (declaration.type.raw_name(), objc_type)
+        if isinstance(resolved_type, EnumType):
+            return '+ (void)_parse%s:(NSNumber **)outValue fromPayload:(id)payload;' % declaration.type.raw_name()
+
+    def _generate_type_factory_category_implementation(self, domains):
+        lines = []
+        for domain in domains:
+            lines.append('@implementation %sTypeConversions (%sDomain)' % (self.protocol_name(), domain.domain_name))
+            lines.append('')
+
+            for declaration in domain.type_declarations:
+                lines.append(self._generate_type_factory_method_implementation(domain, declaration))
+                add_newline(lines)
+            lines.append('@end')
+        return '\n'.join(lines)
+
+    def _generate_type_factory_method_implementation(self, domain, declaration):
+        lines = []
+        resolved_type = declaration.type
+        if isinstance(resolved_type, AliasedType):
+            resolved_type = resolved_type.aliased_type
+
+        objc_class = self.objc_class_for_type(resolved_type)
+        if isinstance(resolved_type, (ObjectType, ArrayType, PrimitiveType)):
+            lines.append('+ (void)_parse%s:(%s **)outValue fromPayload:(id)payload' % (declaration.type.raw_name(), objc_class))
+        if isinstance(resolved_type, EnumType):
+            lines.append('+ (void)_parse%s:(NSNumber **)outValue fromPayload:(id)payload' % declaration.type.raw_name())
+
+        lines.append('{')
+        if isinstance(resolved_type, EnumType):
+            lines.append('    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);')
+            lines.append('    *outValue = @(Inspector::fromProtocolString<%s>(payload));' % self.objc_name_for_type(resolved_type))
+        elif isinstance(resolved_type, (ArrayType, PrimitiveType)):
+            lines.append('    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [%s class]);' % objc_class)
+            lines.append('    *outValue = (%s *)payload;' % objc_class)
+        elif isinstance(resolved_type, ObjectType):
+            lines.append('    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);')
+            lines.append('    *outValue = [[%s alloc] initWithPayload:payload];' % (objc_class))
+        lines.append('}')
+        return '\n'.join(lines)
diff --git a/inspector/scripts/codegen/generate_objc_protocol_types_implementation.py b/inspector/scripts/codegen/generate_objc_protocol_types_implementation.py
new file mode 100755
index 0000000..3663d6d
--- /dev/null
+++ b/inspector/scripts/codegen/generate_objc_protocol_types_implementation.py
@@ -0,0 +1,201 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+import logging
+import string
+from string import Template
+
+from generator import Generator, ucfirst
+from models import ObjectType, Frameworks
+from objc_generator import ObjCGenerator
+from objc_generator_templates import ObjCGeneratorTemplates as ObjCTemplates
+
+log = logging.getLogger('global')
+
+
+def add_newline(lines):
+    if lines and lines[-1] == '':
+        return
+    lines.append('')
+
+
+class ObjCProtocolTypesImplementationGenerator(ObjCGenerator):
+    def __init__(self, model, input_filepath):
+        ObjCGenerator.__init__(self, model, input_filepath)
+
+    def output_filename(self):
+        return '%sTypes.mm' % self.protocol_name()
+
+    def domains_to_generate(self):
+        return filter(ObjCGenerator.should_generate_domain_types_filter(self.model()), Generator.domains_to_generate(self))
+
+    def generate_output(self):
+        secondary_headers = [
+            '"%sTypeConversions.h"' % self.protocol_name(),
+            Generator.string_for_file_include('%sJSONObjectPrivate.h' % ObjCGenerator.OBJC_STATIC_PREFIX, Frameworks.WebInspector, self.model().framework),
+            '<JavaScriptCore/InspectorValues.h>',
+            '<wtf/Assertions.h>',
+        ]
+
+        # The FooProtocolInternal.h header is only needed to declare the backend-side event dispatcher bindings.
+        primaryIncludeName = self.protocol_name()
+        if self.get_generator_setting('generate_backend', False):
+            primaryIncludeName += 'Internal'
+
+        header_args = {
+            'primaryInclude': '"%s.h"' % primaryIncludeName,
+            'secondaryIncludes': '\n'.join(['#import %s' % header for header in secondary_headers]),
+        }
+
+        domains = self.domains_to_generate()
+        sections = []
+        sections.append(self.generate_license())
+        sections.append(Template(ObjCTemplates.ImplementationPrelude).substitute(None, **header_args))
+        sections.extend(map(self.generate_type_implementations, domains))
+        sections.append(Template(ObjCTemplates.ImplementationPostlude).substitute(None, **header_args))
+        return '\n\n'.join(sections)
+
+    def generate_type_implementations(self, domain):
+        lines = []
+        for declaration in domain.type_declarations:
+            if (isinstance(declaration.type, ObjectType)):
+                add_newline(lines)
+                lines.append(self.generate_type_implementation(domain, declaration))
+        return '\n'.join(lines)
+
+    def generate_type_implementation(self, domain, declaration):
+        lines = []
+        lines.append('@implementation %s' % self.objc_name_for_type(declaration.type))
+        # The initializer that takes a payload is only needed by the frontend.
+        if self.get_generator_setting('generate_frontend', False):
+            lines.append('')
+            lines.append(self._generate_init_method_for_payload(domain, declaration))
+            lines.append(self._generate_init_method_for_json_object(domain, declaration))
+        required_members = filter(lambda member: not member.is_optional, declaration.type_members)
+        if required_members:
+            lines.append('')
+            lines.append(self._generate_init_method_for_required_members(domain, declaration, required_members))
+        for member in declaration.type_members:
+            lines.append('')
+            lines.append(self._generate_setter_for_member(domain, declaration, member))
+            lines.append('')
+            lines.append(self._generate_getter_for_member(domain, declaration, member))
+        lines.append('')
+        lines.append('@end')
+        return '\n'.join(lines)
+
+    def _generate_init_method_for_json_object(self, domain, declaration):
+        lines = []
+        lines.append('- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject')
+        lines.append('{')
+        lines.append('    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))')
+        lines.append('        return nil;')
+        lines.append('')
+        lines.append('    return self;')
+        lines.append('}')
+        return '\n'.join(lines)
+
+    def _generate_init_method_for_payload(self, domain, declaration):
+        lines = []
+        lines.append('- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload')
+        lines.append('{')
+        lines.append('    if (!(self = [super init]))')
+        lines.append('        return nil;')
+        lines.append('')
+
+        for member in declaration.type_members:
+            var_name = ObjCGenerator.identifier_to_objc_identifier(member.member_name)
+            if not member.is_optional:
+                lines.append('    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"%s"], @"%s");' % (var_name, var_name))
+            conversion_expression = self.payload_to_objc_expression_for_member(declaration, member)
+            lines.append('    self.%s = %s;' % (var_name, conversion_expression))
+            lines.append('')
+
+        lines.append('    return self;')
+        lines.append('}')
+        return '\n'.join(lines)
+
+    def _generate_init_method_for_required_members(self, domain, declaration, required_members):
+        pairs = []
+        for member in required_members:
+            objc_type = self.objc_type_for_member(declaration, member)
+            var_name = ObjCGenerator.identifier_to_objc_identifier(member.member_name)
+            pairs.append('%s:(%s)%s' % (var_name, objc_type, var_name))
+        pairs[0] = ucfirst(pairs[0])
+        lines = []
+        lines.append('- (instancetype)initWith%s' % ' '.join(pairs))
+        lines.append('{')
+        lines.append('    if (!(self = [super init]))')
+        lines.append('        return nil;')
+        lines.append('')
+
+        required_pointer_members = filter(lambda member: ObjCGenerator.is_type_objc_pointer_type(member.type), required_members)
+        if required_pointer_members:
+            for member in required_pointer_members:
+                var_name = ObjCGenerator.identifier_to_objc_identifier(member.member_name)
+                lines.append('    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(%s, @"%s");' % (var_name, var_name))
+                objc_array_class = self.objc_class_for_array_type(member.type)
+                if objc_array_class and objc_array_class.startswith(self.objc_prefix()):
+                    lines.append('    THROW_EXCEPTION_FOR_BAD_TYPE_IN_ARRAY(%s, [%s class]);' % (var_name, objc_array_class))
+            lines.append('')
+
+        for member in required_members:
+            var_name = ObjCGenerator.identifier_to_objc_identifier(member.member_name)
+            lines.append('    self.%s = %s;' % (var_name, var_name))
+
+        lines.append('')
+        lines.append('    return self;')
+        lines.append('}')
+        return '\n'.join(lines)
+
+    def _generate_setter_for_member(self, domain, declaration, member):
+        objc_type = self.objc_type_for_member(declaration, member)
+        var_name = ObjCGenerator.identifier_to_objc_identifier(member.member_name)
+        setter_method = ObjCGenerator.objc_setter_method_for_member(declaration, member)
+        conversion_expression = self.objc_to_protocol_expression_for_member(declaration, member, var_name)
+        lines = []
+        lines.append('- (void)set%s:(%s)%s' % (ucfirst(var_name), objc_type, var_name))
+        lines.append('{')
+        objc_array_class = self.objc_class_for_array_type(member.type)
+        if objc_array_class and objc_array_class.startswith(self.objc_prefix()):
+            lines.append('    THROW_EXCEPTION_FOR_BAD_TYPE_IN_ARRAY(%s, [%s class]);' % (var_name, objc_array_class))
+        lines.append('    [super %s:%s forKey:@"%s"];' % (setter_method, conversion_expression, member.member_name))
+        lines.append('}')
+        return '\n'.join(lines)
+
+    def _generate_getter_for_member(self, domain, declaration, member):
+        objc_type = self.objc_type_for_member(declaration, member)
+        var_name = ObjCGenerator.identifier_to_objc_identifier(member.member_name)
+        getter_method = ObjCGenerator.objc_getter_method_for_member(declaration, member)
+        basic_expression = '[super %s:@"%s"]' % (getter_method, member.member_name)
+        conversion_expression = self.protocol_to_objc_expression_for_member(declaration, member, basic_expression)
+        lines = []
+        lines.append('- (%s)%s' % (objc_type, var_name))
+        lines.append('{')
+        lines.append('    return %s;' % conversion_expression)
+        lines.append('}')
+        return '\n'.join(lines)
diff --git a/inspector/scripts/codegen/generator.py b/inspector/scripts/codegen/generator.py
new file mode 100755
index 0000000..8550272
--- /dev/null
+++ b/inspector/scripts/codegen/generator.py
@@ -0,0 +1,257 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+import logging
+import os.path
+import re
+from string import Template
+
+from generator_templates import GeneratorTemplates as Templates
+from models import PrimitiveType, ObjectType, ArrayType, EnumType, AliasedType, Frameworks
+
+log = logging.getLogger('global')
+
+
+def ucfirst(str):
+    return str[:1].upper() + str[1:]
+
+_ALWAYS_UPPERCASED_ENUM_VALUE_SUBSTRINGS = set(['API', 'CSS', 'DOM', 'HTML', 'JIT', 'XHR', 'XML'])
+
+# These objects are built manually by creating and setting InspectorValues.
+# Before sending these over the protocol, their shapes are checked against the specification.
+# So, any types referenced by these types require debug-only assertions that check values.
+# Calculating necessary assertions is annoying, and adds a lot of complexity to the generator.
+
+# FIXME: This should be converted into a property in JSON.
+_TYPES_NEEDING_RUNTIME_CASTS = set([
+    "Runtime.ObjectPreview",
+    "Runtime.RemoteObject",
+    "Runtime.PropertyDescriptor",
+    "Runtime.InternalPropertyDescriptor",
+    "Runtime.CollectionEntry",
+    "Debugger.FunctionDetails",
+    "Debugger.CallFrame",
+    "Canvas.TraceLog",
+    "Canvas.ResourceInfo",
+    "Canvas.ResourceState",
+    # This should be a temporary hack. TimelineEvent should be created via generated C++ API.
+    "Timeline.TimelineEvent",
+    # For testing purposes only.
+    "Test.TypeNeedingCast"
+])
+
+# FIXME: This should be converted into a property in JSON.
+_TYPES_WITH_OPEN_FIELDS = set([
+    "Timeline.TimelineEvent",
+    # InspectorStyleSheet not only creates this property but wants to read it and modify it.
+    "CSS.CSSProperty",
+    # InspectorNetworkAgent needs to update mime-type.
+    "Network.Response",
+    # For testing purposes only.
+    "Test.OpenParameterBundle"
+])
+
+
+class Generator:
+    def __init__(self, model, input_filepath):
+        self._model = model
+        self._input_filepath = input_filepath
+        self._settings = {}
+
+    def model(self):
+        return self._model
+
+    def set_generator_setting(self, key, value):
+        self._settings[key] = value
+
+    # The goofy name is to disambiguate generator settings from framework settings.
+    def get_generator_setting(self, key, default=None):
+        return self._settings.get(key, default)
+
+    def generate_license(self):
+        return Template(Templates.CopyrightBlock).substitute(None, inputFilename=os.path.basename(self._input_filepath))
+
+    # These methods are overridden by subclasses.
+    def non_supplemental_domains(self):
+        return filter(lambda domain: not domain.is_supplemental, self.model().domains)
+
+    def domains_to_generate(self):
+        return self.non_supplemental_domains()
+
+    def generate_output(self):
+        pass
+
+    def output_filename(self):
+        pass
+
+    def encoding_for_enum_value(self, enum_value):
+        if not hasattr(self, "_assigned_enum_values"):
+            self._traverse_and_assign_enum_values()
+
+        return self._enum_value_encodings[enum_value]
+
+    def assigned_enum_values(self):
+        if not hasattr(self, "_assigned_enum_values"):
+            self._traverse_and_assign_enum_values()
+
+        return self._assigned_enum_values[:]  # Slice.
+
+    @staticmethod
+    def type_needs_runtime_casts(_type):
+        return _type.qualified_name() in _TYPES_NEEDING_RUNTIME_CASTS
+
+    @staticmethod
+    def type_has_open_fields(_type):
+        return _type.qualified_name() in _TYPES_WITH_OPEN_FIELDS
+
+    def type_needs_shape_assertions(self, _type):
+        if not hasattr(self, "_types_needing_shape_assertions"):
+            self.calculate_types_requiring_shape_assertions(self.model().domains)
+
+        return _type in self._types_needing_shape_assertions
+
+    # To restrict the domains over which we compute types needing assertions, call this method
+    # before generating any output with the desired domains parameter. The computed
+    # set of types will not be automatically regenerated on subsequent calls to
+    # Generator.types_needing_shape_assertions().
+    def calculate_types_requiring_shape_assertions(self, domains):
+        domain_names = map(lambda domain: domain.domain_name, domains)
+        log.debug("> Calculating types that need shape assertions (eligible domains: %s)" % ", ".join(domain_names))
+
+        # Mutates the passed-in set; this simplifies checks to prevent infinite recursion.
+        def gather_transitively_referenced_types(_type, gathered_types):
+            if _type in gathered_types:
+                return
+
+            if isinstance(_type, ObjectType):
+                log.debug("> Adding type %s to list of types needing shape assertions." % _type.qualified_name())
+                gathered_types.add(_type)
+                for type_member in _type.members:
+                    gather_transitively_referenced_types(type_member.type, gathered_types)
+            elif isinstance(_type, EnumType):
+                log.debug("> Adding type %s to list of types needing shape assertions." % _type.qualified_name())
+                gathered_types.add(_type)
+            elif isinstance(_type, AliasedType):
+                gather_transitively_referenced_types(_type.aliased_type, gathered_types)
+            elif isinstance(_type, ArrayType):
+                gather_transitively_referenced_types(_type.element_type, gathered_types)
+
+        found_types = set()
+        for domain in domains:
+            for declaration in domain.type_declarations:
+                if declaration.type.qualified_name() in _TYPES_NEEDING_RUNTIME_CASTS:
+                    log.debug("> Gathering types referenced by %s to generate shape assertions." % declaration.type.qualified_name())
+                    gather_transitively_referenced_types(declaration.type, found_types)
+
+        self._types_needing_shape_assertions = found_types
+
+    # Private helper instance methods.
+    def _traverse_and_assign_enum_values(self):
+        self._enum_value_encodings = {}
+        self._assigned_enum_values = []
+        all_types = []
+
+        domains = self.non_supplemental_domains()
+
+        for domain in domains:
+            for type_declaration in domain.type_declarations:
+                all_types.append(type_declaration.type)
+                for type_member in type_declaration.type_members:
+                    all_types.append(type_member.type)
+
+        for domain in domains:
+            for event in domain.events:
+                all_types.extend([parameter.type for parameter in event.event_parameters])
+
+        for domain in domains:
+            for command in domain.commands:
+                all_types.extend([parameter.type for parameter in command.call_parameters])
+                all_types.extend([parameter.type for parameter in command.return_parameters])
+
+        for _type in all_types:
+            if not isinstance(_type, EnumType):
+                continue
+            map(self._assign_encoding_for_enum_value, _type.enum_values())
+
+    def _assign_encoding_for_enum_value(self, enum_value):
+        if enum_value in self._enum_value_encodings:
+            return
+
+        self._enum_value_encodings[enum_value] = len(self._assigned_enum_values)
+        self._assigned_enum_values.append(enum_value)
+
+    # Miscellaneous text manipulation routines.
+    def wrap_with_guard_for_domain(self, domain, text):
+        if self.model().framework is Frameworks.WebInspector:
+            return text
+        guard = domain.feature_guard
+        if guard:
+            return Generator.wrap_with_guard(guard, text)
+        return text
+
+    @staticmethod
+    def wrap_with_guard(guard, text):
+        return '\n'.join([
+            '#if %s' % guard,
+            text,
+            '#endif // %s' % guard,
+        ])
+
+    @staticmethod
+    def stylized_name_for_enum_value(enum_value):
+        regex = '(%s)' % "|".join(_ALWAYS_UPPERCASED_ENUM_VALUE_SUBSTRINGS)
+
+        def replaceCallback(match):
+            return match.group(1).upper()
+
+        # Split on hyphen, introduce camelcase, and force uppercasing of acronyms.
+        subwords = map(ucfirst, enum_value.split('-'))
+        return re.sub(re.compile(regex, re.IGNORECASE), replaceCallback, "".join(subwords))
+
+    @staticmethod
+    def js_name_for_parameter_type(_type):
+        _type = _type
+        if isinstance(_type, AliasedType):
+            _type = _type.aliased_type  # Fall through.
+        if isinstance(_type, EnumType):
+            _type = _type.primitive_type  # Fall through.
+
+        if isinstance(_type, (ArrayType, ObjectType)):
+            return 'object'
+        if isinstance(_type, PrimitiveType):
+            if _type.qualified_name() in ['object', 'any']:
+                return 'object'
+            elif _type.qualified_name() in ['integer', 'number']:
+                return 'number'
+            else:
+                return _type.qualified_name()
+
+    @staticmethod
+    def string_for_file_include(filename, file_framework, target_framework):
+        if file_framework is target_framework:
+            return '"%s"' % filename
+        else:
+            return '<%s/%s>' % (file_framework.name, filename)
diff --git a/inspector/scripts/codegen/generator_templates.py b/inspector/scripts/codegen/generator_templates.py
new file mode 100644
index 0000000..891681f
--- /dev/null
+++ b/inspector/scripts/codegen/generator_templates.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Generator templates, which can be filled with string.Template.
+# Following are classes that fill the templates from the typechecked model.
+
+
+class GeneratorTemplates:
+    CopyrightBlock = (
+    """/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from ${inputFilename}
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py""")
diff --git a/inspector/scripts/codegen/models.py b/inspector/scripts/codegen/models.py
new file mode 100755
index 0000000..7144a98
--- /dev/null
+++ b/inspector/scripts/codegen/models.py
@@ -0,0 +1,625 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+import logging
+import collections
+
+log = logging.getLogger('global')
+
+
+def ucfirst(str):
+    return str[:1].upper() + str[1:]
+
+
+def find_duplicates(l):
+    return [key for key, count in collections.Counter(l).items() if count > 1]
+
+
+_FRAMEWORK_CONFIG_MAP = {
+    "Global": {
+    },
+    "JavaScriptCore": {
+        "cpp_protocol_group": "Inspector",
+        "export_macro": "JS_EXPORT_PRIVATE",
+        "alternate_dispatchers": True,
+    },
+    "WebKit": {
+        "cpp_protocol_group": "Automation",
+        "objc_protocol_group": "WD",
+        "objc_prefix": "WD",
+    },
+    "WebInspector": {
+        "objc_protocol_group": "RWI",
+        "objc_prefix": "RWI",
+    },
+    # Used for code generator tests.
+    "Test": {
+        "alternate_dispatchers": True,
+        "cpp_protocol_group": "Test",
+        "objc_protocol_group": "Test",
+        "objc_prefix": "Test",
+    }
+}
+
+
+class ParseException(Exception):
+    pass
+
+
+class TypecheckException(Exception):
+    pass
+
+
+class Framework:
+    def __init__(self, name):
+        self._settings = _FRAMEWORK_CONFIG_MAP[name]
+        self.name = name
+
+    def setting(self, key, default=''):
+        return self._settings.get(key, default)
+
+    @staticmethod
+    def fromString(frameworkString):
+        if frameworkString == "Global":
+            return Frameworks.Global
+
+        if frameworkString == "JavaScriptCore":
+            return Frameworks.JavaScriptCore
+
+        if frameworkString == "WebKit":
+            return Frameworks.WebKit
+
+        if frameworkString == "WebInspector":
+            return Frameworks.WebInspector
+
+        if frameworkString == "Test":
+            return Frameworks.Test
+
+        raise ParseException("Unknown framework: %s" % frameworkString)
+
+
+class Frameworks:
+    Global = Framework("Global")
+    JavaScriptCore = Framework("JavaScriptCore")
+    WebKit = Framework("WebKit")
+    WebInspector = Framework("WebInspector")
+    Test = Framework("Test")
+
+
+class TypeReference:
+    def __init__(self, type_kind, referenced_type_name, enum_values, array_items):
+        self.type_kind = type_kind
+        self.referenced_type_name = referenced_type_name
+        self.enum_values = enum_values
+        if array_items is None:
+            self.array_type_ref = None
+        else:
+            self.array_type_ref = TypeReference(array_items.get('type'), array_items.get('$ref'), array_items.get('enum'), array_items.get('items'))
+
+        if type_kind is not None and referenced_type_name is not None:
+            raise ParseException("Type reference cannot have both 'type' and '$ref' keys.")
+
+        all_primitive_types = ["integer", "number", "string", "boolean", "enum", "object", "array", "any"]
+        if type_kind is not None and type_kind not in all_primitive_types:
+            raise ParseException("Type reference '%s' is not a primitive type. Allowed values: %s" % (type_kind, ', '.join(all_primitive_types)))
+
+        if type_kind == "array" and array_items is None:
+            raise ParseException("Type reference with type 'array' must have key 'items' to define array element type.")
+
+        if enum_values is not None and len(enum_values) == 0:
+            raise ParseException("Type reference with enum values must have at least one enum value.")
+
+    def referenced_name(self):
+        if self.referenced_type_name is not None:
+            return self.referenced_type_name
+        else:
+            return self.type_kind  # one of all_primitive_types
+
+
+class Type:
+    def __init__(self):
+        pass
+
+    def __eq__(self, other):
+        return self.qualified_name() == other.qualified_name()
+
+    def __hash__(self):
+        return self.qualified_name().__hash__()
+
+    def raw_name(self):
+        return self._name
+
+    # These methods should be overridden by subclasses.
+    def is_enum(self):
+        return False
+
+    def type_domain(self):
+        pass
+
+    def qualified_name(self):
+        pass
+
+    # This is used to resolve nested types after instances are created.
+    def resolve_type_references(self, protocol):
+        pass
+
+
+class PrimitiveType(Type):
+    def __init__(self, name):
+        self._name = name
+
+    def __repr__(self):
+        return 'PrimitiveType[%s]' % self.qualified_name()
+
+    def type_domain(self):
+        return None
+
+    def qualified_name(self):
+        return self.raw_name()
+
+
+class AliasedType(Type):
+    def __init__(self, declaration, domain, aliased_type_ref):
+        self._name = declaration.type_name
+        self._declaration = declaration
+        self._domain = domain
+        self._aliased_type_ref = aliased_type_ref
+        self.aliased_type = None
+
+    def __repr__(self):
+        if self.aliased_type is not None:
+            return 'AliasedType[%s -> %r]' % (self.qualified_name(), self.aliased_type)
+        else:
+            return 'AliasedType[%s -> (unresolved)]' % self.qualified_name()
+
+    def is_enum(self):
+        return self.aliased_type.is_enum()
+
+    def type_domain(self):
+        return self._domain
+
+    def qualified_name(self):
+        return  ".".join([self.type_domain().domain_name, self.raw_name()])
+
+    def resolve_type_references(self, protocol):
+        if self.aliased_type is not None:
+            return
+
+        self.aliased_type = protocol.lookup_type_reference(self._aliased_type_ref, self.type_domain())
+        log.debug("< Resolved type reference for aliased type in %s: %s" % (self.qualified_name(), self.aliased_type.qualified_name()))
+
+
+class EnumType(Type):
+    def __init__(self, declaration, domain, values, primitive_type_ref, is_anonymous=False):
+        self._name = "(anonymous)" if declaration is None else declaration.type_name
+        self._declaration = declaration
+        self._domain = domain
+        self._values = values
+        self._primitive_type_ref = primitive_type_ref
+        self.primitive_type = None
+        self.is_anonymous = is_anonymous
+
+    def __repr__(self):
+        return 'EnumType[value_type=%s; values=%s]' % (self.qualified_name(), ', '.join(map(str, self.enum_values())))
+
+    def is_enum(self):
+        return True
+
+    def enum_values(self):
+        return self._values
+
+    def type_domain(self):
+        return self._domain
+
+    def declaration(self):
+        return self._declaration
+
+    def qualified_name(self):
+        return  ".".join([self.type_domain().domain_name, self.raw_name()])
+
+    def resolve_type_references(self, protocol):
+        if self.primitive_type is not None:
+            return
+
+        self.primitive_type = protocol.lookup_type_reference(self._primitive_type_ref, Domains.GLOBAL)
+        log.debug("< Resolved type reference for enum type in %s: %s" % (self.qualified_name(), self.primitive_type.qualified_name()))
+        log.debug("<< enum values: %s" % self.enum_values())
+
+
+class ArrayType(Type):
+    def __init__(self, declaration, element_type_ref, domain):
+        self._name = None if declaration is None else declaration.type_name
+        self._declaration = declaration
+        self._domain = domain
+        self._element_type_ref = element_type_ref
+        self.element_type = None
+
+    def __repr__(self):
+        if self.element_type is not None:
+            return 'ArrayType[element_type=%r]' % self.element_type
+        else:
+            return 'ArrayType[element_type=(unresolved)]'
+
+    def declaration(self):
+        return self._declaration
+
+    def type_domain(self):
+        return self._domain
+
+    def qualified_name(self):
+        return  ".".join(["array", self.element_type.qualified_name()])
+
+    def resolve_type_references(self, protocol):
+        if self.element_type is not None:
+            return
+
+        self.element_type = protocol.lookup_type_reference(self._element_type_ref, self.type_domain())
+        log.debug("< Resolved type reference for element type in %s: %s" % (self.qualified_name(), self.element_type.qualified_name()))
+
+
+class ObjectType(Type):
+    def __init__(self, declaration, domain):
+        self._name = declaration.type_name
+        self._declaration = declaration
+        self._domain = domain
+        self.members = declaration.type_members
+
+    def __repr__(self):
+        return 'ObjectType[%s]' % self.qualified_name()
+
+    def declaration(self):
+        return self._declaration
+
+    def type_domain(self):
+        return self._domain
+
+    def qualified_name(self):
+        return  ".".join([self.type_domain().domain_name, self.raw_name()])
+
+
+def check_for_required_properties(props, obj, what):
+    for prop in props:
+        if prop not in obj:
+            raise ParseException("When parsing %s, required property missing: %s" % (what, prop))
+
+
+class Protocol:
+    def __init__(self, framework_name):
+        self.domains = []
+        self.types_by_name = {}
+        self.framework = Framework.fromString(framework_name)
+
+    def parse_specification(self, json, isSupplemental):
+        log.debug("parse toplevel")
+
+        if isinstance(json, dict) and 'domains' in json:
+            json = json['domains']
+        if not isinstance(json, list):
+            json = [json]
+
+        for domain in json:
+            self.parse_domain(domain, isSupplemental)
+
+    def parse_domain(self, json, isSupplemental):
+        check_for_required_properties(['domain'], json, "domain")
+        log.debug("parse domain " + json['domain'])
+
+        types = []
+        commands = []
+        events = []
+
+        if 'types' in json:
+            if not isinstance(json['types'], list):
+                raise ParseException("Malformed domain specification: types is not an array")
+            types.extend([self.parse_type_declaration(declaration) for declaration in json['types']])
+
+        if 'commands' in json:
+            if not isinstance(json['commands'], list):
+                raise ParseException("Malformed domain specification: commands is not an array")
+            commands.extend([self.parse_command(command) for command in json['commands']])
+
+        if 'events' in json:
+            if not isinstance(json['events'], list):
+                raise ParseException("Malformed domain specification: events is not an array")
+            events.extend([self.parse_event(event) for event in json['events']])
+
+        if 'availability' in json:
+            if not commands and not events:
+                raise ParseException("Malformed domain specification: availability should only be included if there are commands or events.")
+            allowed_activation_strings = set(['web'])
+            if json['availability'] not in allowed_activation_strings:
+                raise ParseException('Malformed domain specification: availability is an unsupported string. Was: "%s", Allowed values: %s' % (json['availability'], ', '.join(allowed_activation_strings)))
+
+        self.domains.append(Domain(json['domain'], json.get('description', ''), json.get('featureGuard'), json.get('availability'), isSupplemental, types, commands, events))
+
+    def parse_type_declaration(self, json):
+        check_for_required_properties(['id', 'type'], json, "type")
+        log.debug("parse type %s" % json['id'])
+
+        type_members = []
+
+        if 'properties' in json:
+            if not isinstance(json['properties'], list):
+                raise ParseException("Malformed type specification: properties is not an array")
+            type_members.extend([self.parse_type_member(member) for member in json['properties']])
+
+        duplicate_names = find_duplicates([member.member_name for member in type_members])
+        if len(duplicate_names) > 0:
+            raise ParseException("Malformed domain specification: type declaration for %s has duplicate member names" % json['id'])
+
+        type_ref = TypeReference(json['type'], json.get('$ref'), json.get('enum'), json.get('items'))
+        return TypeDeclaration(json['id'], type_ref, json.get("description", ""), type_members)
+
+    def parse_type_member(self, json):
+        check_for_required_properties(['name'], json, "type member")
+        log.debug("parse type member %s" % json['name'])
+
+        type_ref = TypeReference(json.get('type'), json.get('$ref'), json.get('enum'), json.get('items'))
+        return TypeMember(json['name'], type_ref, json.get('optional', False), json.get('description', ""))
+
+    def parse_command(self, json):
+        check_for_required_properties(['name'], json, "command")
+        log.debug("parse command %s" % json['name'])
+
+        call_parameters = []
+        return_parameters = []
+
+        if 'parameters' in json:
+            if not isinstance(json['parameters'], list):
+                raise ParseException("Malformed command specification: parameters is not an array")
+            call_parameters.extend([self.parse_call_or_return_parameter(parameter) for parameter in json['parameters']])
+
+            duplicate_names = find_duplicates([param.parameter_name for param in call_parameters])
+            if len(duplicate_names) > 0:
+                raise ParseException("Malformed domain specification: call parameter list for command %s has duplicate parameter names" % json['name'])
+
+        if 'returns' in json:
+            if not isinstance(json['returns'], list):
+                raise ParseException("Malformed command specification: returns is not an array")
+            return_parameters.extend([self.parse_call_or_return_parameter(parameter) for parameter in json['returns']])
+
+            duplicate_names = find_duplicates([param.parameter_name for param in return_parameters])
+            if len(duplicate_names) > 0:
+                raise ParseException("Malformed domain specification: return parameter list for command %s has duplicate parameter names" % json['name'])
+
+        return Command(json['name'], call_parameters, return_parameters, json.get('description', ""), json.get('async', False))
+
+    def parse_event(self, json):
+        check_for_required_properties(['name'], json, "event")
+        log.debug("parse event %s" % json['name'])
+
+        event_parameters = []
+
+        if 'parameters' in json:
+            if not isinstance(json['parameters'], list):
+                raise ParseException("Malformed event specification: parameters is not an array")
+            event_parameters.extend([self.parse_call_or_return_parameter(parameter) for parameter in json['parameters']])
+
+            duplicate_names = find_duplicates([param.parameter_name for param in event_parameters])
+            if len(duplicate_names) > 0:
+                raise ParseException("Malformed domain specification: parameter list for event %s has duplicate parameter names" % json['name'])
+
+        return Event(json['name'], event_parameters, json.get('description', ""))
+
+    def parse_call_or_return_parameter(self, json):
+        check_for_required_properties(['name'], json, "parameter")
+        log.debug("parse parameter %s" % json['name'])
+
+        type_ref = TypeReference(json.get('type'), json.get('$ref'), json.get('enum'), json.get('items'))
+        return Parameter(json['name'], type_ref, json.get('optional', False), json.get('description', ""))
+
+    def resolve_types(self):
+        qualified_declared_type_names = set(['boolean', 'string', 'integer', 'number', 'enum', 'array', 'object', 'any'])
+
+        self.types_by_name['string'] = PrimitiveType('string')
+        for _primitive_type in ['boolean', 'integer', 'number']:
+            self.types_by_name[_primitive_type] = PrimitiveType(_primitive_type)
+        for _object_type in ['any', 'object']:
+            self.types_by_name[_object_type] = PrimitiveType(_object_type)
+
+        # Gather qualified type names from type declarations in each domain.
+        for domain in self.domains:
+            for declaration in domain.type_declarations:
+                # Basic sanity checking.
+                if declaration.type_ref.referenced_type_name is not None:
+                    raise TypecheckException("Type declarations must name a base type, not a type reference.")
+
+                # Find duplicate qualified type names.
+                qualified_type_name = ".".join([domain.domain_name, declaration.type_name])
+                if qualified_type_name in qualified_declared_type_names:
+                    raise TypecheckException("Duplicate type declaration: %s" % qualified_type_name)
+
+                qualified_declared_type_names.add(qualified_type_name)
+
+                type_instance = None
+
+                kind = declaration.type_ref.type_kind
+                if declaration.type_ref.enum_values is not None:
+                    primitive_type_ref = TypeReference(declaration.type_ref.type_kind, None, None, None)
+                    type_instance = EnumType(declaration, domain, declaration.type_ref.enum_values, primitive_type_ref)
+                elif kind == "array":
+                    type_instance = ArrayType(declaration, declaration.type_ref.array_type_ref, domain)
+                elif kind == "object":
+                    type_instance = ObjectType(declaration, domain)
+                else:
+                    type_instance = AliasedType(declaration, domain, declaration.type_ref)
+
+                log.debug("< Created fresh type %r for declaration %s" % (type_instance, qualified_type_name))
+                self.types_by_name[qualified_type_name] = type_instance
+
+        # Resolve all type references recursively.
+        for domain in self.domains:
+            domain.resolve_type_references(self)
+
+    def lookup_type_for_declaration(self, declaration, domain):
+        # This will only match a type defined in the same domain, where prefixes aren't required.
+        qualified_name = ".".join([domain.domain_name, declaration.type_name])
+        if qualified_name in self.types_by_name:
+            found_type = self.types_by_name[qualified_name]
+            found_type.resolve_type_references(self)
+            return found_type
+
+        raise TypecheckException("Lookup failed for type declaration: %s (referenced from domain: %s)" % (declaration.type_name, domain.domain_name))
+
+    def lookup_type_reference(self, type_ref, domain):
+        # If reference is to an anonymous array type, create a fresh instance.
+        if type_ref.type_kind == "array":
+            type_instance = ArrayType(None, type_ref.array_type_ref, domain)
+            type_instance.resolve_type_references(self)
+            log.debug("< Created fresh type instance for anonymous array type: %s" % type_instance.qualified_name())
+            return type_instance
+
+        # If reference is to an anonymous enum type, create a fresh instance.
+        if type_ref.enum_values is not None:
+            # We need to create a type reference without enum values as the enum's nested type.
+            primitive_type_ref = TypeReference(type_ref.type_kind, None, None, None)
+            type_instance = EnumType(None, domain, type_ref.enum_values, primitive_type_ref, True)
+            type_instance.resolve_type_references(self)
+            log.debug("< Created fresh type instance for anonymous enum type: %s" % type_instance.qualified_name())
+            return type_instance
+
+        # This will match when referencing a type defined in the same domain, where prefixes aren't required.
+        qualified_name = ".".join([domain.domain_name, type_ref.referenced_name()])
+        if qualified_name in self.types_by_name:
+            found_type = self.types_by_name[qualified_name]
+            found_type.resolve_type_references(self)
+            log.debug("< Lookup succeeded for unqualified type: %s" % found_type.qualified_name())
+            return found_type
+
+        # This will match primitive types and fully-qualified types from a different domain.
+        if type_ref.referenced_name() in self.types_by_name:
+            found_type = self.types_by_name[type_ref.referenced_name()]
+            found_type.resolve_type_references(self)
+            log.debug("< Lookup succeeded for primitive or qualified type: %s" % found_type.qualified_name())
+            return found_type
+
+        raise TypecheckException("Lookup failed for type reference: %s (referenced from domain: %s)" % (type_ref.referenced_name(), domain.domain_name))
+
+
+class Domain:
+    def __init__(self, domain_name, description, feature_guard, availability, isSupplemental, type_declarations, commands, events):
+        self.domain_name = domain_name
+        self.description = description
+        self.feature_guard = feature_guard
+        self.availability = availability
+        self.is_supplemental = isSupplemental
+        self.type_declarations = type_declarations
+        self.commands = commands
+        self.events = events
+
+    def resolve_type_references(self, protocol):
+        log.debug("> Resolving type declarations for domain: %s" % self.domain_name)
+        for declaration in self.type_declarations:
+            declaration.resolve_type_references(protocol, self)
+
+        log.debug("> Resolving types in commands for domain: %s" % self.domain_name)
+        for command in self.commands:
+            command.resolve_type_references(protocol, self)
+
+        log.debug("> Resolving types in events for domain: %s" % self.domain_name)
+        for event in self.events:
+            event.resolve_type_references(protocol, self)
+
+
+class Domains:
+    GLOBAL = Domain("", "The global domain, in which primitive types are implicitly declared.", None, None, True, [], [], [])
+
+
+class TypeDeclaration:
+    def __init__(self, type_name, type_ref, description, type_members):
+        self.type_name = type_name
+        self.type_ref = type_ref
+        self.description = description
+        self.type_members = type_members
+
+        if self.type_name != ucfirst(self.type_name):
+            raise ParseException("Types must begin with an uppercase character.")
+
+    def resolve_type_references(self, protocol, domain):
+        log.debug(">> Resolving type references for type declaration: %s" % self.type_name)
+        self.type = protocol.lookup_type_for_declaration(self, domain)
+        for member in self.type_members:
+            member.resolve_type_references(protocol, domain)
+
+
+class TypeMember:
+    def __init__(self, member_name, type_ref, is_optional, description):
+        self.member_name = member_name
+        self.type_ref = type_ref
+        self.is_optional = is_optional
+        self.description = description
+
+        if not isinstance(self.is_optional, bool):
+            raise ParseException("The 'optional' flag for a type member must be a boolean literal.")
+
+    def resolve_type_references(self, protocol, domain):
+        log.debug(">>> Resolving type references for type member: %s" % self.member_name)
+        self.type = protocol.lookup_type_reference(self.type_ref, domain)
+
+
+class Parameter:
+    def __init__(self, parameter_name, type_ref, is_optional, description):
+        self.parameter_name = parameter_name
+        self.type_ref = type_ref
+        self.is_optional = is_optional
+        self.description = description
+
+        if not isinstance(self.is_optional, bool):
+            raise ParseException("The 'optional' flag for a parameter must be a boolean literal.")
+
+    def resolve_type_references(self, protocol, domain):
+        log.debug(">>> Resolving type references for parameter: %s" % self.parameter_name)
+        self.type = protocol.lookup_type_reference(self.type_ref, domain)
+
+
+class Command:
+    def __init__(self, command_name, call_parameters, return_parameters, description, is_async):
+        self.command_name = command_name
+        self.call_parameters = call_parameters
+        self.return_parameters = return_parameters
+        self.description = description
+        self.is_async = is_async
+
+    def resolve_type_references(self, protocol, domain):
+        log.debug(">> Resolving type references for call parameters in command: %s" % self.command_name)
+        for parameter in self.call_parameters:
+            parameter.resolve_type_references(protocol, domain)
+
+        log.debug(">> Resolving type references for return parameters in command: %s" % self.command_name)
+        for parameter in self.return_parameters:
+            parameter.resolve_type_references(protocol, domain)
+
+
+class Event:
+    def __init__(self, event_name, event_parameters, description):
+        self.event_name = event_name
+        self.event_parameters = event_parameters
+        self.description = description
+
+    def resolve_type_references(self, protocol, domain):
+        log.debug(">> Resolving type references for parameters in event: %s" % self.event_name)
+        for parameter in self.event_parameters:
+            parameter.resolve_type_references(protocol, domain)
diff --git a/inspector/scripts/codegen/objc_generator.py b/inspector/scripts/codegen/objc_generator.py
new file mode 100755
index 0000000..cad872d
--- /dev/null
+++ b/inspector/scripts/codegen/objc_generator.py
@@ -0,0 +1,551 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014, 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+import logging
+from generator import Generator, ucfirst
+from models import PrimitiveType, ObjectType, ArrayType, EnumType, AliasedType, Frameworks
+
+log = logging.getLogger('global')
+
+
+def join_type_and_name(type_str, name_str):
+    if type_str.endswith('*'):
+        return type_str + name_str
+    return type_str + ' ' + name_str
+
+
+def strip_block_comment_markers(str):
+    return str.replace('/*', '').replace('*/', '')
+
+
+def remove_duplicate_from_str(str, possible_duplicate):
+    return str.replace(possible_duplicate + possible_duplicate, possible_duplicate)
+
+
+_OBJC_IDENTIFIER_RENAME_MAP = {
+    'this': 'thisObject',  # Debugger.CallFrame.this
+    'description': 'stringRepresentation',  # Runtime.RemoteObject.description
+    'id': 'identifier',  # Page.Frame.id, Runtime.ExecutionContextDescription.id, Debugger.BreakpointAction.id
+}
+
+_OBJC_IDENTIFIER_REVERSE_RENAME_MAP = dict((v, k) for k, v in _OBJC_IDENTIFIER_RENAME_MAP.iteritems())
+
+
+class ObjCTypeCategory:
+    Simple = 0
+    String = 1
+    Object = 2
+    Array = 3
+
+    @staticmethod
+    def category_for_type(_type):
+        if (isinstance(_type, PrimitiveType)):
+            if _type.raw_name() is 'string':
+                return ObjCTypeCategory.String
+            if  _type.raw_name() in ['object', 'any']:
+                return ObjCTypeCategory.Object
+            if _type.raw_name() is 'array':
+                return ObjCTypeCategory.Array
+            return ObjCTypeCategory.Simple
+        if (isinstance(_type, ObjectType)):
+            return ObjCTypeCategory.Object
+        if (isinstance(_type, ArrayType)):
+            return ObjCTypeCategory.Array
+        if (isinstance(_type, AliasedType)):
+            return ObjCTypeCategory.category_for_type(_type.aliased_type)
+        if (isinstance(_type, EnumType)):
+            return ObjCTypeCategory.category_for_type(_type.primitive_type)
+        return None
+
+# Almost all Objective-C class names require the use of a prefix that depends on the
+# target framework's 'objc_prefix' setting. So, most helpers are instance methods.
+
+class ObjCGenerator(Generator):
+    # Do not use a dynamic prefix for RWIProtocolJSONObject since it's used as a common
+    # base class and needs a consistent Objective-C prefix to be in a reusable framework.
+    OBJC_HELPER_PREFIX = 'RWI'
+    OBJC_SHARED_PREFIX = 'Protocol'
+    OBJC_STATIC_PREFIX = '%s%s' % (OBJC_HELPER_PREFIX, OBJC_SHARED_PREFIX)
+
+    def __init__(self, model, input_filepath):
+        Generator.__init__(self, model, input_filepath)
+
+    # The 'protocol name' is used to prefix filenames for a protocol group (a set of domains generated together).
+    def protocol_name(self):
+        protocol_group = self.model().framework.setting('objc_protocol_group', '')
+        return '%s%s' % (protocol_group, ObjCGenerator.OBJC_SHARED_PREFIX)
+
+    # The 'ObjC prefix' is used to prefix Objective-C class names and enums with a
+    # framework-specific prefix. It is separate from filename prefixes.
+    def objc_prefix(self):
+        framework_prefix = self.model().framework.setting('objc_prefix', None)
+        if not framework_prefix:
+            return ''
+        else:
+            return '%s%s' % (framework_prefix, ObjCGenerator.OBJC_SHARED_PREFIX)
+
+    # Adjust identifier names that collide with ObjC keywords.
+
+    @staticmethod
+    def identifier_to_objc_identifier(name):
+        return _OBJC_IDENTIFIER_RENAME_MAP.get(name, name)
+
+    @staticmethod
+    def objc_identifier_to_identifier(name):
+        return _OBJC_IDENTIFIER_REVERSE_RENAME_MAP.get(name, name)
+
+    # Generate ObjC types, command handlers, and event dispatchers for a subset of domains.
+
+    DOMAINS_TO_GENERATE = ['CSS', 'DOM', 'DOMStorage', 'Network', 'Page', 'Automation', 'GenericTypes']
+
+    @staticmethod
+    def should_generate_domain_types_filter(model):
+        def should_generate_domain_types(domain):
+            if model.framework is Frameworks.Test:
+                return True
+            whitelist = set(ObjCGenerator.DOMAINS_TO_GENERATE)
+            whitelist.update(set(['Console', 'Debugger', 'Runtime']))
+            return domain.domain_name in whitelist
+        return should_generate_domain_types
+
+    @staticmethod
+    def should_generate_domain_command_handler_filter(model):
+        def should_generate_domain_command_handler(domain):
+            if model.framework is Frameworks.Test:
+                return True
+            whitelist = set(ObjCGenerator.DOMAINS_TO_GENERATE)
+            return domain.domain_name in whitelist
+        return should_generate_domain_command_handler
+
+    @staticmethod
+    def should_generate_domain_event_dispatcher_filter(model):
+        def should_generate_domain_event_dispatcher(domain):
+            if model.framework is Frameworks.Test:
+                return True
+            whitelist = set(ObjCGenerator.DOMAINS_TO_GENERATE)
+            whitelist.add('Console')
+            return domain.domain_name in whitelist
+        return should_generate_domain_event_dispatcher
+
+    # ObjC enum and type names.
+
+    def objc_name_for_type(self, type):
+        name = type.qualified_name().replace('.', '')
+        name = remove_duplicate_from_str(name, type.type_domain().domain_name)
+        return '%s%s' % (self.objc_prefix(), name)
+
+    def objc_enum_name_for_anonymous_enum_declaration(self, declaration):
+        domain_name = declaration.type.type_domain().domain_name
+        name = '%s%s' % (domain_name, declaration.type.raw_name())
+        name = remove_duplicate_from_str(name, domain_name)
+        return '%s%s' % (self.objc_prefix(), name)
+
+    def objc_enum_name_for_anonymous_enum_member(self, declaration, member):
+        domain_name = member.type.type_domain().domain_name
+        name = '%s%s%s' % (domain_name, declaration.type.raw_name(), ucfirst(member.member_name))
+        name = remove_duplicate_from_str(name, domain_name)
+        return '%s%s' % (self.objc_prefix(), name)
+
+    def objc_enum_name_for_anonymous_enum_parameter(self, domain, event_or_command_name, parameter):
+        domain_name = domain.domain_name
+        name = '%s%s%s' % (domain_name, ucfirst(event_or_command_name), ucfirst(parameter.parameter_name))
+        name = remove_duplicate_from_str(name, domain_name)
+        return '%s%s' % (self.objc_prefix(), name)
+
+    def objc_enum_name_for_non_anonymous_enum(self, _type):
+        domain_name = _type.type_domain().domain_name
+        name = _type.qualified_name().replace('.', '')
+        name = remove_duplicate_from_str(name, domain_name)
+        return '%s%s' % (self.objc_prefix(), name)
+
+    # Miscellaneous name handling.
+
+    @staticmethod
+    def variable_name_prefix_for_domain(domain):
+        domain_name = domain.domain_name
+        if domain_name.startswith('DOM'):
+            return 'dom' + domain_name[3:]
+        if domain_name.startswith('CSS'):
+            return 'css' + domain_name[3:]
+        return domain_name[:1].lower() + domain_name[1:]
+
+    # Type basics.
+
+    @staticmethod
+    def objc_accessor_type_for_raw_name(raw_name):
+        if raw_name in ['string', 'array']:
+            return 'copy'
+        if raw_name in ['integer', 'number', 'boolean']:
+            return 'assign'
+        if raw_name in ['any', 'object']:
+            return 'retain'
+        return None
+
+    @staticmethod
+    def objc_type_for_raw_name(raw_name):
+        if raw_name is 'string':
+            return 'NSString *'
+        if raw_name is 'array':
+            return 'NSArray *'
+        if raw_name is 'integer':
+            return 'int'
+        if raw_name is 'number':
+            return 'double'
+        if raw_name is 'boolean':
+            return 'BOOL'
+        if raw_name in ['any', 'object']:
+            return '%sJSONObject *' % ObjCGenerator.OBJC_STATIC_PREFIX
+        return None
+
+    @staticmethod
+    def objc_class_for_raw_name(raw_name):
+        if raw_name is 'string':
+            return 'NSString'
+        if raw_name is 'array':
+            return 'NSArray'
+        if raw_name in ['integer', 'number', 'boolean']:
+            return 'NSNumber'
+        if raw_name in ['any', 'object']:
+            return '%sJSONObject' % ObjCGenerator.OBJC_STATIC_PREFIX
+        return None
+
+    # FIXME: Can these protocol_type functions be removed in favor of C++ generators functions?
+
+    @staticmethod
+    def protocol_type_for_raw_name(raw_name):
+        if raw_name is 'string':
+            return 'String'
+        if raw_name is 'integer':
+            return 'int'
+        if raw_name is 'number':
+            return 'double'
+        if raw_name is 'boolean':
+            return 'bool'
+        if raw_name in ['any', 'object']:
+            return 'InspectorObject'
+        return None
+
+    @staticmethod
+    def protocol_type_for_type(_type):
+        if (isinstance(_type, AliasedType)):
+            _type = _type.aliased_type
+        if (isinstance(_type, PrimitiveType)):
+            return ObjCGenerator.protocol_type_for_raw_name(_type.raw_name())
+        if (isinstance(_type, EnumType)):
+            return ObjCGenerator.protocol_type_for_type(_type.primitive_type)
+        if (isinstance(_type, ObjectType)):
+            return 'Inspector::Protocol::%s::%s' % (_type.type_domain().domain_name, _type.raw_name())
+        if (isinstance(_type, ArrayType)):
+            sub_type = ObjCGenerator.protocol_type_for_type(_type.element_type)
+            return 'Inspector::Protocol::Array<%s>' % sub_type
+        return None
+
+    @staticmethod
+    def is_type_objc_pointer_type(_type):
+        if (isinstance(_type, AliasedType)):
+            _type = _type.aliased_type
+        if (isinstance(_type, PrimitiveType)):
+            return _type.raw_name() in ['string', 'array', 'any', 'object']
+        if (isinstance(_type, EnumType)):
+            return False
+        if (isinstance(_type, ObjectType)):
+            return True
+        if (isinstance(_type, ArrayType)):
+            return True
+        return None
+
+    def objc_class_for_type(self, _type):
+        if (isinstance(_type, AliasedType)):
+            _type = _type.aliased_type
+        if (isinstance(_type, PrimitiveType)):
+            return ObjCGenerator.objc_class_for_raw_name(_type.raw_name())
+        if (isinstance(_type, EnumType)):
+            return ObjCGenerator.objc_class_for_raw_name(_type.primitive_type.raw_name())
+        if (isinstance(_type, ObjectType)):
+            return self.objc_name_for_type(_type)
+        if (isinstance(_type, ArrayType)):
+            sub_type = strip_block_comment_markers(self.objc_class_for_type(_type.element_type))
+            return 'NSArray/*<%s>*/' % sub_type
+        return None
+
+    def objc_class_for_array_type(self, _type):
+        if isinstance(_type, AliasedType):
+            _type = _type.aliased_type
+        if isinstance(_type, ArrayType):
+            return self.objc_class_for_type(_type.element_type)
+        return None
+
+    def objc_accessor_type_for_member(self, member):
+        return self.objc_accessor_type_for_member_internal(member.type)
+
+    def objc_accessor_type_for_member_internal(self, _type):
+        if (isinstance(_type, AliasedType)):
+            _type = _type.aliased_type
+        if (isinstance(_type, PrimitiveType)):
+            return self.objc_accessor_type_for_raw_name(_type.raw_name())
+        if (isinstance(_type, EnumType)):
+            return 'assign'
+        if (isinstance(_type, ObjectType)):
+            return 'retain'
+        if (isinstance(_type, ArrayType)):
+            return 'copy'
+        return None
+
+    def objc_type_for_member(self, declaration, member):
+        return self.objc_type_for_member_internal(member.type, declaration, member)
+
+    def objc_type_for_member_internal(self, _type, declaration, member):
+        if (isinstance(_type, AliasedType)):
+            _type = _type.aliased_type
+        if (isinstance(_type, PrimitiveType)):
+            return self.objc_type_for_raw_name(_type.raw_name())
+        if (isinstance(_type, EnumType)):
+            if (_type.is_anonymous):
+                return self.objc_enum_name_for_anonymous_enum_member(declaration, member)
+            return self.objc_enum_name_for_non_anonymous_enum(_type)
+        if (isinstance(_type, ObjectType)):
+            return self.objc_name_for_type(_type) + ' *'
+        if (isinstance(_type, ArrayType)):
+            sub_type = strip_block_comment_markers(self.objc_class_for_type(_type.element_type))
+            return 'NSArray/*<%s>*/ *' % sub_type
+        return None
+
+    def objc_type_for_param(self, domain, event_or_command_name, parameter, respect_optional=True):
+        objc_type = self.objc_type_for_param_internal(parameter.type, domain, event_or_command_name, parameter)
+        if respect_optional and parameter.is_optional:
+            if objc_type.endswith('*'):
+                return objc_type + '*'
+            return objc_type + ' *'
+        return objc_type
+
+    def objc_type_for_param_internal(self, _type, domain, event_or_command_name, parameter):
+        if (isinstance(_type, AliasedType)):
+            _type = _type.aliased_type
+        if (isinstance(_type, PrimitiveType)):
+            return self.objc_type_for_raw_name(_type.raw_name())
+        if (isinstance(_type, EnumType)):
+            if _type.is_anonymous:
+                return self.objc_enum_name_for_anonymous_enum_parameter(domain, event_or_command_name, parameter)
+            return self.objc_enum_name_for_non_anonymous_enum(_type)
+        if (isinstance(_type, ObjectType)):
+            return self.objc_name_for_type(_type) + ' *'
+        if (isinstance(_type, ArrayType)):
+            sub_type = strip_block_comment_markers(self.objc_class_for_type(_type.element_type))
+            return 'NSArray/*<%s>*/ *' % sub_type
+        return None
+
+    # ObjC <-> Protocol conversion for commands and events.
+    #   - convert a command call parameter received from Protocol to ObjC for handler
+    #   - convert a command return parameter in callback block from ObjC to Protocol to send
+    #   - convert an event parameter from ObjC API to Protocol to send
+
+    def objc_protocol_export_expression_for_variable(self, var_type, var_name):
+        category = ObjCTypeCategory.category_for_type(var_type)
+        if category in [ObjCTypeCategory.Simple, ObjCTypeCategory.String]:
+            if isinstance(var_type, EnumType):
+                return 'toProtocolString(%s)' % var_name
+            return var_name
+        if category is ObjCTypeCategory.Object:
+            return '[%s toInspectorObject]' % var_name
+        if category is ObjCTypeCategory.Array:
+            protocol_type = ObjCGenerator.protocol_type_for_type(var_type.element_type)
+            objc_class = self.objc_class_for_type(var_type.element_type)
+            if protocol_type == 'Inspector::Protocol::Array<String>':
+                return 'inspectorStringArrayArray(%s)' % var_name
+            if protocol_type is 'String' and objc_class is 'NSString':
+                return 'inspectorStringArray(%s)' % var_name
+            if protocol_type is 'int' and objc_class is 'NSNumber':
+                return 'inspectorIntegerArray(%s)' % var_name
+            if protocol_type is 'double' and objc_class is 'NSNumber':
+                return 'inspectorDoubleArray(%s)' % var_name
+            return 'inspectorObjectArray(%s)' % var_name
+
+    def objc_protocol_import_expression_for_member(self, name, declaration, member):
+        if isinstance(member.type, EnumType):
+            if member.type.is_anonymous:
+                return 'fromProtocolString<%s>(%s)' % (self.objc_enum_name_for_anonymous_enum_member(declaration, member), name)
+            return 'fromProtocolString<%s>(%s)' % (self.objc_enum_name_for_non_anonymous_enum(member.type), name)
+        return self.objc_protocol_import_expression_for_variable(member.type, name)
+
+    def objc_protocol_import_expression_for_parameter(self, name, domain, event_or_command_name, parameter):
+        if isinstance(parameter.type, EnumType):
+            if parameter.type.is_anonymous:
+                return 'fromProtocolString<%s>(%s)' % (self.objc_enum_name_for_anonymous_enum_parameter(domain, event_or_command_name, parameter), name)
+            return 'fromProtocolString<%s>(%s)' % (self.objc_enum_name_for_non_anonymous_enum(parameter.type), name)
+        return self.objc_protocol_import_expression_for_variable(parameter.type, name)
+
+    def objc_protocol_import_expression_for_variable(self, var_type, var_name):
+        category = ObjCTypeCategory.category_for_type(var_type)
+        if category in [ObjCTypeCategory.Simple, ObjCTypeCategory.String]:
+            return var_name
+        if category is ObjCTypeCategory.Object:
+            objc_class = self.objc_class_for_type(var_type)
+            return '[[[%s alloc] initWithInspectorObject:%s] autorelease]' % (objc_class, var_name)
+        if category is ObjCTypeCategory.Array:
+            objc_class = self.objc_class_for_type(var_type.element_type)
+            if objc_class is 'NSString':
+                return 'objcStringArray(%s)' % var_name
+            if objc_class is 'NSNumber':  # FIXME: Integer or Double?
+                return 'objcIntegerArray(%s)' % var_name
+            return 'objcArray<%s>(%s)' % (objc_class, var_name)
+
+    # ObjC <-> JSON object conversion for types getters/setters.
+    #   - convert a member setter from ObjC API to JSON object setter
+    #   - convert a member getter from JSON object to ObjC API
+
+    def objc_to_protocol_expression_for_member(self, declaration, member, sub_expression):
+        category = ObjCTypeCategory.category_for_type(member.type)
+        if category in [ObjCTypeCategory.Simple, ObjCTypeCategory.String]:
+            if isinstance(member.type, EnumType):
+                return 'toProtocolString(%s)' % sub_expression
+            return sub_expression
+        if category is ObjCTypeCategory.Object:
+            return sub_expression
+        if category is ObjCTypeCategory.Array:
+            objc_class = self.objc_class_for_type(member.type.element_type)
+            if objc_class is 'NSString':
+                return 'inspectorStringArray(%s)' % sub_expression
+            if objc_class is 'NSNumber':
+                protocol_type = ObjCGenerator.protocol_type_for_type(member.type.element_type)
+                if protocol_type is 'double':
+                    return 'inspectorDoubleArray(%s)' % sub_expression
+                return 'inspectorIntegerArray(%s)' % sub_expression
+            return 'inspectorObjectArray(%s)' % sub_expression
+
+    def protocol_to_objc_expression_for_member(self, declaration, member, sub_expression):
+        category = ObjCTypeCategory.category_for_type(member.type)
+        if category in [ObjCTypeCategory.Simple, ObjCTypeCategory.String]:
+            if isinstance(member.type, EnumType):
+                if member.type.is_anonymous:
+                    return 'fromProtocolString<%s>(%s)' % (self.objc_enum_name_for_anonymous_enum_member(declaration, member), sub_expression)
+                return 'fromProtocolString<%s>(%s)' % (self.objc_enum_name_for_non_anonymous_enum(member.type), sub_expression)
+            return sub_expression
+        if category is ObjCTypeCategory.Object:
+            objc_class = self.objc_class_for_type(member.type)
+            return '[[%s alloc] initWithInspectorObject:[%s toInspectorObject].get()]' % (objc_class, sub_expression)
+        if category is ObjCTypeCategory.Array:
+            protocol_type = ObjCGenerator.protocol_type_for_type(member.type.element_type)
+            objc_class = self.objc_class_for_type(member.type.element_type)
+            if objc_class is 'NSString':
+                return 'objcStringArray(%s)' % sub_expression
+            if objc_class is 'NSNumber':
+                protocol_type = ObjCGenerator.protocol_type_for_type(member.type.element_type)
+                if protocol_type is 'double':
+                    return 'objcDoubleArray(%s)' % sub_expression
+                return 'objcIntegerArray(%s)' % sub_expression
+            return 'objcArray<%s>(%s)' % (objc_class, sub_expression)
+
+    def payload_to_objc_expression_for_member(self, declaration, member):
+        _type = member.type
+        if isinstance(_type, AliasedType):
+            _type = _type.aliased_type
+        if isinstance(_type, PrimitiveType):
+            sub_expression = 'payload[@"%s"]' % member.member_name
+            raw_name = _type.raw_name()
+            if raw_name is 'boolean':
+                return '[%s boolValue]' % sub_expression
+            if raw_name is 'integer':
+                return '[%s integerValue]' % sub_expression
+            if raw_name is 'number':
+                return '[%s doubleValue]' % sub_expression
+            if raw_name in ['any', 'object', 'array', 'string']:
+                return sub_expression  # The setter will check the incoming value.
+            return None
+        if isinstance(member.type, EnumType):
+            sub_expression = 'payload[@"%s"]' % member.member_name
+            if member.type.is_anonymous:
+                return 'fromProtocolString<%s>(%s)' % (self.objc_enum_name_for_anonymous_enum_member(declaration, member), sub_expression)
+            else:
+                return 'fromProtocolString<%s>(%s)' % (self.objc_enum_name_for_non_anonymous_enum(member.type), sub_expression)
+        if isinstance(_type, ObjectType):
+            objc_class = self.objc_class_for_type(member.type)
+            return '[[%s alloc] initWithPayload:payload[@"%s"]]' % (objc_class, member.member_name)
+        if isinstance(_type, ArrayType):
+            objc_class = self.objc_class_for_type(member.type.element_type)
+            return 'objcArrayFromPayload<%s>(payload[@"%s"])' % (objc_class, member.member_name)
+
+    # JSON object setter/getter selectors for types.
+
+    @staticmethod
+    def objc_setter_method_for_member(declaration, member):
+        return ObjCGenerator.objc_setter_method_for_member_internal(member.type, declaration, member)
+
+    @staticmethod
+    def objc_setter_method_for_member_internal(_type, declaration, member):
+        if (isinstance(_type, AliasedType)):
+            _type = _type.aliased_type
+        if (isinstance(_type, PrimitiveType)):
+            raw_name = _type.raw_name()
+            if raw_name is 'boolean':
+                return 'setBool'
+            if raw_name is 'integer':
+                return 'setInteger'
+            if raw_name is 'number':
+                return 'setDouble'
+            if raw_name is 'string':
+                return 'setString'
+            if raw_name in ['any', 'object']:
+                return 'setObject'
+            if raw_name is 'array':
+                return 'setInspectorArray'
+            return None
+        if (isinstance(_type, EnumType)):
+            return 'setString'
+        if (isinstance(_type, ObjectType)):
+            return 'setObject'
+        if (isinstance(_type, ArrayType)):
+            return 'setInspectorArray'
+        return None
+
+    @staticmethod
+    def objc_getter_method_for_member(declaration, member):
+        return ObjCGenerator.objc_getter_method_for_member_internal(member.type, declaration, member)
+
+    @staticmethod
+    def objc_getter_method_for_member_internal(_type, declaration, member):
+        if (isinstance(_type, AliasedType)):
+            _type = _type.aliased_type
+        if (isinstance(_type, PrimitiveType)):
+            raw_name = _type.raw_name()
+            if raw_name is 'boolean':
+                return 'boolForKey'
+            if raw_name is 'integer':
+                return 'integerForKey'
+            if raw_name is 'number':
+                return 'doubleForKey'
+            if raw_name is 'string':
+                return 'stringForKey'
+            if raw_name in ['any', 'object']:
+                return 'objectForKey'
+            if raw_name is 'array':
+                return 'inspectorArrayForKey'
+            return None
+        if (isinstance(_type, EnumType)):
+            return 'stringForKey'
+        if (isinstance(_type, ObjectType)):
+            return 'objectForKey'
+        if (isinstance(_type, ArrayType)):
+            return 'inspectorArrayForKey'
+        return None
diff --git a/inspector/scripts/codegen/objc_generator_templates.py b/inspector/scripts/codegen/objc_generator_templates.py
new file mode 100755
index 0000000..80f5cbc
--- /dev/null
+++ b/inspector/scripts/codegen/objc_generator_templates.py
@@ -0,0 +1,156 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Generator templates, which can be filled with string.Template.
+# Following are classes that fill the templates from the typechecked model.
+
+class ObjCGeneratorTemplates:
+
+    HeaderPrelude = (
+    """#import <Foundation/Foundation.h>
+
+${includes}
+""")
+
+    HeaderPostlude = (
+    """""")
+
+    TypeConversionsHeaderPrelude = (
+    """${includes}
+
+namespace Inspector {""")
+
+    TypeConversionsHeaderPostlude = (
+    """} // namespace Inspector
+""")
+
+    GenericHeaderPrelude = (
+    """${includes}""")
+
+    GenericHeaderPostlude = (
+    """""")
+
+    TypeConversionsHeaderStandard = (
+    """template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);""")
+
+    BackendDispatcherHeaderPrelude = (
+    """${includes}
+
+${forwardDeclarations}
+
+namespace Inspector {
+""")
+
+    BackendDispatcherHeaderPostlude = (
+    """} // namespace Inspector
+""")
+
+    BackendDispatcherImplementationPrelude = (
+    """#import "config.h"
+#import ${primaryInclude}
+
+${secondaryIncludes}
+
+namespace Inspector {""")
+
+    BackendDispatcherImplementationPostlude = (
+    """} // namespace Inspector
+""")
+
+    ImplementationPrelude = (
+    """#import "config.h"
+#import ${primaryInclude}
+
+${secondaryIncludes}
+
+using namespace Inspector;""")
+
+    ImplementationPostlude = (
+    """""")
+
+    BackendDispatcherHeaderDomainHandlerInterfaceDeclaration = (
+    """class Alternate${domainName}BackendDispatcher : public AlternateBackendDispatcher {
+public:
+    virtual ~Alternate${domainName}BackendDispatcher() { }
+${commandDeclarations}
+};""")
+
+    BackendDispatcherHeaderDomainHandlerObjCDeclaration = (
+    """class ObjCInspector${domainName}BackendDispatcher final : public Alternate${domainName}BackendDispatcher {
+public:
+    ObjCInspector${domainName}BackendDispatcher(id<${objcPrefix}${domainName}DomainHandler> handler) { m_delegate = handler; }
+${commandDeclarations}
+private:
+    RetainPtr<id<${objcPrefix}${domainName}DomainHandler>> m_delegate;
+};""")
+
+    BackendDispatcherHeaderDomainHandlerImplementation = (
+    """void ObjCInspector${domainName}BackendDispatcher::${commandName}(${parameters})
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+${successCallback}
+${conversions}
+${invocation}
+}
+""")
+
+    ConfigurationCommandProperty = (
+    """@property (nonatomic, retain, setter=set${domainName}Handler:) id<${objcPrefix}${domainName}DomainHandler> ${variableNamePrefix}Handler;""")
+
+    ConfigurationEventProperty = (
+    """@property (nonatomic, readonly) ${objcPrefix}${domainName}DomainEventDispatcher *${variableNamePrefix}EventDispatcher;""")
+
+    ConfigurationCommandPropertyImplementation = (
+    """- (void)set${domainName}Handler:(id<${objcPrefix}${domainName}DomainHandler>)handler
+{
+    if (handler == _${variableNamePrefix}Handler)
+        return;
+
+    [_${variableNamePrefix}Handler release];
+    _${variableNamePrefix}Handler = [handler retain];
+
+    auto alternateDispatcher = std::make_unique<ObjCInspector${domainName}BackendDispatcher>(handler);
+    auto alternateAgent = std::make_unique<AlternateDispatchableAgent<${domainName}BackendDispatcher, Alternate${domainName}BackendDispatcher>>(ASCIILiteral("${domainName}"), *_controller, WTFMove(alternateDispatcher));
+    _controller->appendExtraAgent(WTFMove(alternateAgent));
+}
+
+- (id<${objcPrefix}${domainName}DomainHandler>)${variableNamePrefix}Handler
+{
+    return _${variableNamePrefix}Handler;
+}""")
+
+    ConfigurationGetterImplementation = (
+    """- (${objcPrefix}${domainName}DomainEventDispatcher *)${variableNamePrefix}EventDispatcher
+{
+    if (!_${variableNamePrefix}EventDispatcher)
+        _${variableNamePrefix}EventDispatcher = [[${objcPrefix}${domainName}DomainEventDispatcher alloc] initWithController:_controller];
+    return _${variableNamePrefix}EventDispatcher;
+}""")
diff --git a/inspector/scripts/generate-inspector-protocol-bindings.py b/inspector/scripts/generate-inspector-protocol-bindings.py
new file mode 100755
index 0000000..4af0787
--- /dev/null
+++ b/inspector/scripts/generate-inspector-protocol-bindings.py
@@ -0,0 +1,263 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2014 Apple Inc. All rights reserved.
+# Copyright (c) 2014 University of Washington. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# This script generates JS, Objective C, and C++ bindings for the inspector protocol.
+# Generators for individual files are located in the codegen/ directory.
+
+import os.path
+import re
+import sys
+import string
+from string import Template
+import optparse
+import logging
+
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+logging.basicConfig(format='%(levelname)s: %(message)s', level=logging.ERROR)
+log = logging.getLogger('global')
+
+try:
+    from codegen import *
+
+# When copying generator files to JavaScriptCore's private headers on Mac,
+# the codegen/ module directory is flattened. So, import directly.
+except ImportError, e:
+    # log.error(e) # Uncomment this to debug early import errors.
+    import models
+    from models import *
+    from generator import *
+    from cpp_generator import *
+    from objc_generator import *
+
+    from generate_cpp_alternate_backend_dispatcher_header import *
+    from generate_cpp_backend_dispatcher_header import *
+    from generate_cpp_backend_dispatcher_implementation import *
+    from generate_cpp_frontend_dispatcher_header import *
+    from generate_cpp_frontend_dispatcher_implementation import *
+    from generate_cpp_protocol_types_header import *
+    from generate_cpp_protocol_types_implementation import *
+    from generate_js_backend_commands import *
+    from generate_objc_backend_dispatcher_header import *
+    from generate_objc_backend_dispatcher_implementation import *
+    from generate_objc_configuration_header import *
+    from generate_objc_configuration_implementation import *
+    from generate_objc_frontend_dispatcher_implementation import *
+    from generate_objc_header import *
+    from generate_objc_internal_header import *
+    from generate_objc_protocol_type_conversions_header import *
+    from generate_objc_protocol_type_conversions_implementation import *
+    from generate_objc_protocol_types_implementation import *
+
+
+# A writer that only updates file if it actually changed.
+class IncrementalFileWriter:
+    def __init__(self, filepath, force_output):
+        self._filepath = filepath
+        self._output = ""
+        self.force_output = force_output
+
+    def write(self, text):
+        self._output += text
+
+    def close(self):
+        text_changed = True
+        self._output = self._output.rstrip() + "\n"
+
+        try:
+            if self.force_output:
+                raise
+
+            read_file = open(self._filepath, "r")
+            old_text = read_file.read()
+            read_file.close()
+            text_changed = old_text != self._output
+        except:
+            # Ignore, just overwrite by default
+            pass
+
+        if text_changed or self.force_output:
+            out_file = open(self._filepath, "w")
+            out_file.write(self._output)
+            out_file.close()
+
+
+def generate_from_specification(primary_specification_filepath=None,
+                                supplemental_specification_filepaths=[],
+                                concatenate_output=False,
+                                output_dirpath=None,
+                                force_output=False,
+                                framework_name="",
+                                generate_frontend=True,
+                                generate_backend=True):
+
+    def load_specification(protocol, filepath, isSupplemental=False):
+        try:
+            with open(filepath, "r") as input_file:
+                parsed_json = json.load(input_file)
+                protocol.parse_specification(parsed_json, isSupplemental)
+        except ValueError as e:
+            raise Exception("Error parsing valid JSON in file: " + filepath + "\nParse error: " + str(e))
+
+    protocol = models.Protocol(framework_name)
+    for specification in supplemental_specification_filepaths:
+        load_specification(protocol, specification, isSupplemental=True)
+    load_specification(protocol, primary_specification_filepath, isSupplemental=False)
+
+    protocol.resolve_types()
+
+    generators = []
+    if protocol.framework is Frameworks.Test:
+        generators.append(JSBackendCommandsGenerator(protocol, primary_specification_filepath))
+        generators.append(CppAlternateBackendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppBackendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppBackendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(CppFrontendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppFrontendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(CppProtocolTypesHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppProtocolTypesImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCBackendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCBackendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCConfigurationHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCConfigurationImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCFrontendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCInternalHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCProtocolTypeConversionsHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCProtocolTypeConversionsImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCProtocolTypesImplementationGenerator(protocol, primary_specification_filepath))
+
+    elif protocol.framework is Frameworks.JavaScriptCore:
+        generators.append(JSBackendCommandsGenerator(protocol, primary_specification_filepath))
+        generators.append(CppAlternateBackendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppBackendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppBackendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(CppFrontendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppFrontendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(CppProtocolTypesHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppProtocolTypesImplementationGenerator(protocol, primary_specification_filepath))
+
+    elif protocol.framework is Frameworks.WebKit and generate_backend:
+        generators.append(CppBackendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppBackendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(CppProtocolTypesHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(CppProtocolTypesImplementationGenerator(protocol, primary_specification_filepath))
+
+    elif protocol.framework is Frameworks.WebKit and generate_frontend:
+        generators.append(ObjCHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCProtocolTypeConversionsHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCProtocolTypeConversionsImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCProtocolTypesImplementationGenerator(protocol, primary_specification_filepath))
+
+    elif protocol.framework is Frameworks.WebInspector:
+        generators.append(ObjCBackendDispatcherHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCBackendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCConfigurationHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCConfigurationImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCFrontendDispatcherImplementationGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCInternalHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCProtocolTypeConversionsHeaderGenerator(protocol, primary_specification_filepath))
+        generators.append(ObjCProtocolTypesImplementationGenerator(protocol, primary_specification_filepath))
+
+    single_output_file_contents = []
+
+    for generator in generators:
+        # Only some generators care whether frontend or backend was specified, but it is
+        # set on all of them to avoid adding more constructor arguments or thinking too hard.
+        if generate_backend:
+            generator.set_generator_setting('generate_backend', True)
+        if generate_frontend:
+            generator.set_generator_setting('generate_frontend', True)
+
+        output = generator.generate_output()
+        if concatenate_output:
+            single_output_file_contents.append('### Begin File: %s' % generator.output_filename())
+            single_output_file_contents.append(output)
+            single_output_file_contents.append('### End File: %s' % generator.output_filename())
+            single_output_file_contents.append('')
+        else:
+            output_file = IncrementalFileWriter(os.path.join(output_dirpath, generator.output_filename()), force_output)
+            output_file.write(output)
+            output_file.close()
+
+    if concatenate_output:
+        filename = os.path.join(os.path.basename(primary_specification_filepath) + '-result')
+        output_file = IncrementalFileWriter(os.path.join(output_dirpath, filename), force_output)
+        output_file.write('\n'.join(single_output_file_contents))
+        output_file.close()
+
+
+if __name__ == '__main__':
+    allowed_framework_names = ['JavaScriptCore', 'WebInspector', 'WebKit', 'Test']
+    cli_parser = optparse.OptionParser(usage="usage: %prog [options] PrimaryProtocol.json [SupplementalProtocol.json ...]")
+    cli_parser.add_option("-o", "--outputDir", help="Directory where generated files should be written.")
+    cli_parser.add_option("--framework", type="choice", choices=allowed_framework_names, help="The framework that the primary specification belongs to.")
+    cli_parser.add_option("--force", action="store_true", help="Force output of generated scripts, even if nothing changed.")
+    cli_parser.add_option("-v", "--debug", action="store_true", help="Log extra output for debugging the generator itself.")
+    cli_parser.add_option("-t", "--test", action="store_true", help="Enable test mode. Use unique output filenames created by prepending the input filename.")
+    cli_parser.add_option("--frontend", action="store_true", help="Generate code for the frontend-side of the protocol only.")
+    cli_parser.add_option("--backend", action="store_true", help="Generate code for the backend-side of the protocol only.")
+    options = None
+
+    arg_options, arg_values = cli_parser.parse_args()
+    if (len(arg_values) < 1):
+        raise ParseException("At least one plain argument expected")
+
+    if not arg_options.outputDir:
+        raise ParseException("Missing output directory")
+
+    if arg_options.debug:
+        log.setLevel(logging.DEBUG)
+
+    generate_backend = arg_options.backend;
+    generate_frontend = arg_options.frontend;
+    # Default to generating both the frontend and backend if neither is specified.
+    if not generate_backend and not generate_frontend:
+        generate_backend = True
+        generate_frontend = True
+
+    options = {
+        'primary_specification_filepath': arg_values[0],
+        'supplemental_specification_filepaths': arg_values[1:],
+        'output_dirpath': arg_options.outputDir,
+        'concatenate_output': arg_options.test,
+        'framework_name': arg_options.framework,
+        'force_output': arg_options.force,
+        'generate_backend': generate_backend,
+        'generate_frontend': generate_frontend,
+    }
+
+    try:
+        generate_from_specification(**options)
+    except (ParseException, TypecheckException) as e:
+        if arg_options.test:
+            log.error(e.message)
+        else:
+            raise  # Force the build to fail.
diff --git a/inspector/scripts/tests/commands-with-async-attribute.json b/inspector/scripts/tests/commands-with-async-attribute.json
new file mode 100644
index 0000000..11262e8
--- /dev/null
+++ b/inspector/scripts/tests/commands-with-async-attribute.json
@@ -0,0 +1,109 @@
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "DatabaseId",
+            "type": "integer",
+            "description": "Unique identifier of Database object."
+        },
+        {
+            "id": "PrimaryColors",
+            "type": "string",
+            "enum": ["red", "green", "blue"]
+        },
+        {
+            "id": "ColorList",
+            "type": "array",
+            "items": { "$ref": "PrimaryColors" }
+        },
+        {
+            "id": "Error",
+            "type": "object",
+            "description": "Database error.",
+            "properties": [
+                { "name": "message", "type": "string", "description": "Error message." },
+                { "name": "code", "type": "integer", "description": "Error code." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "executeSQLSyncOptionalReturnValues",
+            "parameters": [
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "query", "type": "string" }
+            ],
+            "returns": [
+                { "name": "columnNames", "type": "array", "optional": true, "items": { "type": "string" } },
+                { "name": "notes", "type": "string", "optional": true },
+                { "name": "timestamp", "type": "number", "optional": true },
+                { "name": "values", "type": "object", "optional": true },
+                { "name": "payload", "type": "any", "optional": true },
+                { "name": "databaseId", "$ref": "DatabaseId", "optional": true },
+                { "name": "sqlError", "$ref": "Error", "optional": true },
+                { "name": "screenColor", "$ref": "PrimaryColors", "optional": true },
+                { "name": "alternateColors", "$ref": "ColorList", "optional": true },
+                { "name": "printColor", "type": "string", "enum": ["cyan", "magenta", "yellow", "black"], "optional": true }
+            ]
+        },
+        {
+            "name": "executeSQLAsyncOptionalReturnValues",
+            "async": true,
+            "parameters": [
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "query", "type": "string" }
+            ],
+            "returns": [
+                { "name": "columnNames", "type": "array", "optional": true, "items": { "type": "string" } },
+                { "name": "notes", "type": "string", "optional": true },
+                { "name": "timestamp", "type": "number", "optional": true },
+                { "name": "values", "type": "object", "optional": true },
+                { "name": "payload", "type": "any", "optional": true },
+                { "name": "databaseId", "$ref": "DatabaseId", "optional": true },
+                { "name": "sqlError", "$ref": "Error", "optional": true },
+                { "name": "screenColor", "$ref": "PrimaryColors", "optional": true },
+                { "name": "alternateColors", "$ref": "ColorList", "optional": true },
+                { "name": "printColor", "type": "string", "enum": ["cyan", "magenta", "yellow", "black"], "optional": true }
+            ]
+        },
+        {
+            "name": "executeSQLSync",
+            "parameters": [
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "query", "type": "string" }
+            ],
+            "returns": [
+                { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                { "name": "notes", "type": "string" },
+                { "name": "timestamp", "type": "number" },
+                { "name": "values", "type": "object" },
+                { "name": "payload", "type": "any" },
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "sqlError", "$ref": "Error" },
+                { "name": "alternateColors", "$ref": "ColorList" },
+                { "name": "screenColor", "$ref": "PrimaryColors" },
+                { "name": "printColor", "type": "string", "enum": ["cyan", "magenta", "yellow", "black"] }
+            ]
+        },
+        {
+            "name": "executeSQLAsync",
+            "async": true,
+            "parameters": [
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "query", "type": "string" }
+            ],
+            "returns": [
+                { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                { "name": "notes", "type": "string" },
+                { "name": "timestamp", "type": "number" },
+                { "name": "values", "type": "object" },
+                { "name": "payload", "type": "any" },
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "sqlError", "$ref": "Error" },
+                { "name": "screenColor", "$ref": "PrimaryColors" },
+                { "name": "alternateColors", "$ref": "ColorList" },
+                { "name": "printColor", "type": "string", "enum": ["cyan", "magenta", "yellow", "black"] }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/commands-with-optional-call-return-parameters.json b/inspector/scripts/tests/commands-with-optional-call-return-parameters.json
new file mode 100644
index 0000000..361d57d
--- /dev/null
+++ b/inspector/scripts/tests/commands-with-optional-call-return-parameters.json
@@ -0,0 +1,85 @@
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "DatabaseId",
+            "type": "integer",
+            "description": "Unique identifier of Database object."
+        },
+        {
+            "id": "PrimaryColors",
+            "type": "string",
+            "enum": ["red", "green", "blue"]
+        },
+        {
+            "id": "ColorList",
+            "type": "array",
+            "items": { "$ref": "PrimaryColors" }
+        },
+        {
+            "id": "Error",
+            "type": "object",
+            "description": "Database error.",
+            "properties": [
+                { "name": "message", "type": "string", "description": "Error message." },
+                { "name": "code", "type": "integer", "description": "Error code." }
+            ]
+        }
+    ],
+    "commands": [
+        {
+            "name": "executeAllOptionalParameters",
+            "parameters": [
+                { "name": "columnNames", "type": "array", "optional": true, "items": { "type": "string" } },
+                { "name": "notes", "type": "string", "optional": true },
+                { "name": "timestamp", "type": "number", "optional": true },
+                { "name": "values", "type": "object", "optional": true },
+                { "name": "payload", "type": "any", "optional": true },
+                { "name": "databaseId", "$ref": "DatabaseId", "optional": true },
+                { "name": "sqlError", "$ref": "Error", "optional": true },
+                { "name": "screenColor", "$ref": "PrimaryColors", "optional": true },
+                { "name": "alternateColors", "$ref": "ColorList", "optional": true },
+                { "name": "printColor", "type": "string", "enum": ["cyan", "magenta", "yellow", "black"], "optional": true }
+            ],
+            "returns": [
+                { "name": "columnNames", "type": "array", "optional": true, "items": { "type": "string" } },
+                { "name": "notes", "type": "string", "optional": true },
+                { "name": "timestamp", "type": "number", "optional": true },
+                { "name": "values", "type": "object", "optional": true },
+                { "name": "payload", "type": "any", "optional": true },
+                { "name": "databaseId", "$ref": "DatabaseId", "optional": true },
+                { "name": "sqlError", "$ref": "Error", "optional": true },
+                { "name": "screenColor", "$ref": "PrimaryColors", "optional": true },
+                { "name": "alternateColors", "$ref": "ColorList", "optional": true },
+                { "name": "printColor", "type": "string", "enum": ["cyan", "magenta", "yellow", "black"], "optional": true }
+            ]
+        },
+        {
+            "name": "executeNoOptionalParameters",
+            "parameters": [
+                { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                { "name": "notes", "type": "string" },
+                { "name": "timestamp", "type": "number" },
+                { "name": "values", "type": "object" },
+                { "name": "payload", "type": "any" },
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "sqlError", "$ref": "Error" },
+                { "name": "screenColor", "$ref": "PrimaryColors" },
+                { "name": "alternateColors", "$ref": "ColorList" },
+                { "name": "printColor", "type": "string", "enum": ["cyan", "magenta", "yellow", "black"] }
+            ],
+            "returns": [
+                { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                { "name": "notes", "type": "string" },
+                { "name": "timestamp", "type": "number" },
+                { "name": "values", "type": "object" },
+                { "name": "payload", "type": "any" },
+                { "name": "databaseId", "$ref": "DatabaseId" },
+                { "name": "sqlError", "$ref": "Error" },
+                { "name": "screenColor", "$ref": "PrimaryColors" },
+                { "name": "alternateColors", "$ref": "ColorList" },
+                { "name": "printColor", "type": "string", "enum": ["cyan", "magenta", "yellow", "black"] }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/domains-with-varying-command-sizes.json b/inspector/scripts/tests/domains-with-varying-command-sizes.json
new file mode 100644
index 0000000..94a8ecb
--- /dev/null
+++ b/inspector/scripts/tests/domains-with-varying-command-sizes.json
@@ -0,0 +1,54 @@
+[
+{
+    "domain": "Network1",
+    "commands": [
+        {
+            "name": "loadResource1",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        }
+    ]
+},
+{
+    "domain": "Network2",
+    "types": [
+        {
+            "id": "LoaderId",
+            "type": "string",
+            "description": "Unique loader identifier."
+        }
+    ]
+},
+{
+    "domain": "Network3",
+    "commands": [
+        {
+            "name": "loadResource1",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        },
+        {
+            "name": "loadResource2",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        },
+        {
+            "name": "loadResource3",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        },
+        {
+            "name": "loadResource4",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        },
+        {
+            "name": "loadResource5",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        },
+        {
+            "name": "loadResource6",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        },
+        {
+            "name": "loadResource7",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/enum-values.json b/inspector/scripts/tests/enum-values.json
new file mode 100644
index 0000000..cdad61d
--- /dev/null
+++ b/inspector/scripts/tests/enum-values.json
@@ -0,0 +1,35 @@
+{"domains":[
+{
+    "domain": "TypeDomain",
+    "types": [
+        {
+            "id": "TypeDomainEnum",
+            "type": "string",
+            "enum": ["shared", "red", "green", "blue"]
+        }
+    ]
+},
+{
+    "domain": "CommandDomain",
+    "commands": [
+        {
+            "name": "commandWithEnumReturnValue",
+            "parameters": [],
+            "returns": [
+                { "name": "returnValue", "type": "string", "enum": ["shared", "cyan", "magenta", "yellow"] }
+            ]
+        }
+    ]
+},
+{
+    "domain": "EventDomain",
+    "events": [
+        {
+            "name": "eventWithEnumParameter",
+            "parameters": [
+                { "name": "parameter", "type": "string", "enum": ["shared", "black", "white"] }
+            ]
+        }
+    ]
+}
+]}
diff --git a/inspector/scripts/tests/events-with-optional-parameters.json b/inspector/scripts/tests/events-with-optional-parameters.json
new file mode 100644
index 0000000..cabbf10
--- /dev/null
+++ b/inspector/scripts/tests/events-with-optional-parameters.json
@@ -0,0 +1,59 @@
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "DatabaseId",
+            "type": "string",
+            "description": "Unique identifier of Database object."
+        },
+        {
+            "id": "PrimaryColors",
+            "type": "string",
+            "values": ["red", "green", "blue"]
+        },
+        {
+            "id": "ColorList",
+            "type": "array",
+            "items": { "$ref": "PrimaryColors" }
+        },
+        {
+            "id": "Error",
+            "type": "object",
+            "description": "Database error.",
+            "properties": [
+                { "name": "message", "type": "string", "description": "Error message." },
+                { "name": "code", "type": "integer", "description": "Error code." }
+            ]
+        }
+    ],
+    "events": [
+        {
+            "name": "didExecuteOptionalParameters",
+            "parameters": [
+                { "name": "columnNames", "type": "array", "optional": true, "items": { "type": "string" } },
+                { "name": "notes", "type": "string", "optional": true },
+                { "name": "timestamp", "type": "number", "optional": true },
+                { "name": "values", "type": "object", "optional": true },
+                { "name": "payload", "type": "any", "optional": true },
+                { "name": "sqlError", "$ref": "Error", "optional": true },
+                { "name": "screenColor", "$ref": "PrimaryColors", "optional": true },
+                { "name": "alternateColors", "$ref": "ColorList", "optional": true },
+                { "name": "printColor", "type": "string", "values": ["cyan", "magenta", "yellow", "black"], "optional": true }
+            ]
+        },
+        {
+            "name": "didExecuteNoOptionalParameters",
+            "parameters": [
+                { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                { "name": "notes", "type": "string" },
+                { "name": "timestamp", "type": "number" },
+                { "name": "values", "type": "object" },
+                { "name": "payload", "type": "any" },
+                { "name": "sqlError", "$ref": "Error" },
+                { "name": "screenColor", "$ref": "PrimaryColors" },
+                { "name": "alternateColors", "$ref": "ColorList" },
+                { "name": "printColor", "type": "string", "values": ["cyan", "magenta", "yellow", "black"] }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/expected/commands-with-async-attribute.json-result b/inspector/scripts/tests/expected/commands-with-async-attribute.json-result
new file mode 100644
index 0000000..6d5c44c
--- /dev/null
+++ b/inspector/scripts/tests/expected/commands-with-async-attribute.json-result
@@ -0,0 +1,1754 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// Database.
+InspectorBackend.registerDatabaseDispatcher = InspectorBackend.registerDomainDispatcher.bind(InspectorBackend, "Database");
+InspectorBackend.registerEnum("Database.PrimaryColors", {Red: "red", Green: "green", Blue: "blue"});
+InspectorBackend.registerCommand("Database.executeSQLSyncOptionalReturnValues", [{"name": "databaseId", "type": "number", "optional": false}, {"name": "query", "type": "string", "optional": false}], ["columnNames", "notes", "timestamp", "values", "payload", "databaseId", "sqlError", "screenColor", "alternateColors", "printColor"]);
+InspectorBackend.registerCommand("Database.executeSQLAsyncOptionalReturnValues", [{"name": "databaseId", "type": "number", "optional": false}, {"name": "query", "type": "string", "optional": false}], ["columnNames", "notes", "timestamp", "values", "payload", "databaseId", "sqlError", "screenColor", "alternateColors", "printColor"]);
+InspectorBackend.registerCommand("Database.executeSQLSync", [{"name": "databaseId", "type": "number", "optional": false}, {"name": "query", "type": "string", "optional": false}], ["columnNames", "notes", "timestamp", "values", "payload", "databaseId", "sqlError", "alternateColors", "screenColor", "printColor"]);
+InspectorBackend.registerCommand("Database.executeSQLAsync", [{"name": "databaseId", "type": "number", "optional": false}, {"name": "query", "type": "string", "optional": false}], ["columnNames", "notes", "timestamp", "values", "payload", "databaseId", "sqlError", "screenColor", "alternateColors", "printColor"]);
+InspectorBackend.activateDomain("Database");
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+class AlternateDatabaseBackendDispatcher : public AlternateBackendDispatcher {
+public:
+    virtual ~AlternateDatabaseBackendDispatcher() { }
+    virtual void executeSQLSyncOptionalReturnValues(long callId, int in_databaseId, const String& in_query) = 0;
+    virtual void executeSQLAsyncOptionalReturnValues(long callId, int in_databaseId, const String& in_query) = 0;
+    virtual void executeSQLSync(long callId, int in_databaseId, const String& in_query) = 0;
+    virtual void executeSQLAsync(long callId, int in_databaseId, const String& in_query) = 0;
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+class AlternateDatabaseBackendDispatcher;
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+class DatabaseBackendDispatcherHandler {
+public:
+    // Named after parameter 'printColor' while generating command/event executeSQLSyncOptionalReturnValues.
+    enum class PrintColor {
+        Cyan = 3,
+        Magenta = 4,
+        Yellow = 5,
+        Black = 6,
+    }; // enum class PrintColor
+    virtual void executeSQLSyncOptionalReturnValues(ErrorString&, int in_databaseId, const String& in_query, RefPtr<Inspector::Protocol::Array<String>>& opt_out_columnNames, Inspector::Protocol::OptOutput<String>* opt_out_notes, Inspector::Protocol::OptOutput<double>* opt_out_timestamp, Inspector::Protocol::OptOutput<Inspector::InspectorObject>* opt_out_values, Inspector::Protocol::OptOutput<Inspector::InspectorValue>* opt_out_payload, Inspector::Protocol::OptOutput<int>* opt_out_databaseId, RefPtr<Inspector::Protocol::Database::Error>& opt_out_sqlError, Inspector::Protocol::Database::PrimaryColors* opt_out_screenColor, RefPtr<Inspector::Protocol::Database::ColorList>& opt_out_alternateColors, DatabaseBackendDispatcherHandler::PrintColor* opt_out_printColor) = 0;
+    class ExecuteSQLAsyncOptionalReturnValuesCallback : public BackendDispatcher::CallbackBase {
+    public:
+        ExecuteSQLAsyncOptionalReturnValuesCallback(Ref<BackendDispatcher>&&, int id);
+        void sendSuccess(RefPtr<Inspector::Protocol::Array<String>>&& columnNames, Inspector::Protocol::OptOutput<String>* notes, Inspector::Protocol::OptOutput<double>* timestamp, Inspector::Protocol::OptOutput<Inspector::InspectorObject>* values, Inspector::Protocol::OptOutput<Inspector::InspectorValue>* payload, Inspector::Protocol::OptOutput<int>* databaseId, RefPtr<Inspector::Protocol::Database::Error>&& sqlError, Inspector::Protocol::OptOutput<String>* screenColor, RefPtr<Inspector::Protocol::Database::ColorList>&& alternateColors, Inspector::Protocol::OptOutput<String>* printColor);
+    };
+    virtual void executeSQLAsyncOptionalReturnValues(ErrorString&, int in_databaseId, const String& in_query, Ref<ExecuteSQLAsyncOptionalReturnValuesCallback>&& callback) = 0;
+    virtual void executeSQLSync(ErrorString&, int in_databaseId, const String& in_query, RefPtr<Inspector::Protocol::Array<String>>& out_columnNames, String* out_notes, double* out_timestamp, Inspector::InspectorObject* out_values, Inspector::InspectorValue* out_payload, int* out_databaseId, RefPtr<Inspector::Protocol::Database::Error>& out_sqlError, RefPtr<Inspector::Protocol::Database::ColorList>& out_alternateColors, Inspector::Protocol::Database::PrimaryColors* out_screenColor, DatabaseBackendDispatcherHandler::PrintColor* out_printColor) = 0;
+    class ExecuteSQLAsyncCallback : public BackendDispatcher::CallbackBase {
+    public:
+        ExecuteSQLAsyncCallback(Ref<BackendDispatcher>&&, int id);
+        void sendSuccess(RefPtr<Inspector::Protocol::Array<String>>&& columnNames, const String& notes, double timestamp, Inspector::InspectorObject values, Inspector::InspectorValue payload, int databaseId, RefPtr<Inspector::Protocol::Database::Error>&& sqlError, const String& screenColor, RefPtr<Inspector::Protocol::Database::ColorList>&& alternateColors, const String& printColor);
+    };
+    virtual void executeSQLAsync(ErrorString&, int in_databaseId, const String& in_query, Ref<ExecuteSQLAsyncCallback>&& callback) = 0;
+protected:
+    virtual ~DatabaseBackendDispatcherHandler();
+};
+
+class DatabaseBackendDispatcher final : public SupplementalBackendDispatcher {
+public:
+    static Ref<DatabaseBackendDispatcher> create(BackendDispatcher&, DatabaseBackendDispatcherHandler*);
+    void dispatch(long requestId, const String& method, Ref<InspectorObject>&& message) override;
+private:
+    void executeSQLSyncOptionalReturnValues(long requestId, RefPtr<InspectorObject>&& parameters);
+    void executeSQLAsyncOptionalReturnValues(long requestId, RefPtr<InspectorObject>&& parameters);
+    void executeSQLSync(long requestId, RefPtr<InspectorObject>&& parameters);
+    void executeSQLAsync(long requestId, RefPtr<InspectorObject>&& parameters);
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+public:
+    void setAlternateDispatcher(AlternateDatabaseBackendDispatcher* alternateDispatcher) { m_alternateDispatcher = alternateDispatcher; }
+private:
+    AlternateDatabaseBackendDispatcher* m_alternateDispatcher { nullptr };
+#endif
+private:
+    DatabaseBackendDispatcher(BackendDispatcher&, DatabaseBackendDispatcherHandler*);
+    DatabaseBackendDispatcherHandler* m_agent { nullptr };
+};
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+DatabaseBackendDispatcherHandler::~DatabaseBackendDispatcherHandler() { }
+
+Ref<DatabaseBackendDispatcher> DatabaseBackendDispatcher::create(BackendDispatcher& backendDispatcher, DatabaseBackendDispatcherHandler* agent)
+{
+    return adoptRef(*new DatabaseBackendDispatcher(backendDispatcher, agent));
+}
+
+DatabaseBackendDispatcher::DatabaseBackendDispatcher(BackendDispatcher& backendDispatcher, DatabaseBackendDispatcherHandler* agent)
+    : SupplementalBackendDispatcher(backendDispatcher)
+    , m_agent(agent)
+{
+    m_backendDispatcher->registerDispatcherForDomain(ASCIILiteral("Database"), this);
+}
+
+void DatabaseBackendDispatcher::dispatch(long requestId, const String& method, Ref<InspectorObject>&& message)
+{
+    Ref<DatabaseBackendDispatcher> protect(*this);
+
+    RefPtr<InspectorObject> parameters;
+    message->getObject(ASCIILiteral("params"), parameters);
+
+    if (method == "executeSQLSyncOptionalReturnValues")
+        executeSQLSyncOptionalReturnValues(requestId, WTFMove(parameters));
+    else if (method == "executeSQLAsyncOptionalReturnValues")
+        executeSQLAsyncOptionalReturnValues(requestId, WTFMove(parameters));
+    else if (method == "executeSQLSync")
+        executeSQLSync(requestId, WTFMove(parameters));
+    else if (method == "executeSQLAsync")
+        executeSQLAsync(requestId, WTFMove(parameters));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::MethodNotFound, makeString('\'', "Database", '.', method, "' was not found"));
+}
+
+void DatabaseBackendDispatcher::executeSQLSyncOptionalReturnValues(long requestId, RefPtr<InspectorObject>&& parameters)
+{
+    int in_databaseId = m_backendDispatcher->getInteger(parameters.get(), ASCIILiteral("databaseId"), nullptr);
+    String in_query = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("query"), nullptr);
+    if (m_backendDispatcher->hasProtocolErrors()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::InvalidParams, String::format("Some arguments of method '%s' can't be processed", "Database.executeSQLSyncOptionalReturnValues"));
+        return;
+    }
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->executeSQLSyncOptionalReturnValues(requestId, in_databaseId, in_query);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    RefPtr<Inspector::Protocol::Array<String>> out_columnNames;
+    Inspector::Protocol::OptOutput<String> out_notes;
+    Inspector::Protocol::OptOutput<double> out_timestamp;
+    Inspector::Protocol::OptOutput<Inspector::InspectorObject> out_values;
+    Inspector::Protocol::OptOutput<Inspector::InspectorValue> out_payload;
+    Inspector::Protocol::OptOutput<Inspector::Protocol::Database::DatabaseId> out_databaseId;
+    RefPtr<Inspector::Protocol::Database::Error> out_sqlError;
+    Inspector::Protocol::Database::PrimaryColors out_screenColor;
+    RefPtr<Inspector::Protocol::Database::ColorList> out_alternateColors;
+    DatabaseBackendDispatcherHandler::PrintColor out_printColor;
+    m_agent->executeSQLSyncOptionalReturnValues(error, in_databaseId, in_query, out_columnNames, &out_notes, &out_timestamp, out_values, &out_payload, &out_databaseId, out_sqlError, &out_screenColor, out_alternateColors, &out_printColor);
+
+    if (!error.length()) {
+        if (out_columnNames)
+            result->setArray(ASCIILiteral("columnNames"), out_columnNames);
+        if (out_notes.isAssigned())
+            result->setString(ASCIILiteral("notes"), out_notes.getValue());
+        if (out_timestamp.isAssigned())
+            result->setDouble(ASCIILiteral("timestamp"), out_timestamp.getValue());
+        if (out_values.isAssigned())
+            result->setObject(ASCIILiteral("values"), out_values.getValue());
+        if (out_payload.isAssigned())
+            result->setValue(ASCIILiteral("payload"), out_payload.getValue());
+        if (out_databaseId.isAssigned())
+            result->setInteger(ASCIILiteral("databaseId"), out_databaseId.getValue());
+        if (out_sqlError)
+            result->setObject(ASCIILiteral("sqlError"), out_sqlError);
+        if (out_screenColor.isAssigned())
+            result->setString(ASCIILiteral("screenColor"), out_screenColor.getValue());
+        if (out_alternateColors)
+            result->setArray(ASCIILiteral("alternateColors"), out_alternateColors);
+        if (out_printColor.isAssigned())
+            result->setString(ASCIILiteral("printColor"), out_printColor.getValue());
+    }
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+DatabaseBackendDispatcherHandler::ExecuteSQLAsyncOptionalReturnValuesCallback::ExecuteSQLAsyncOptionalReturnValuesCallback(Ref<BackendDispatcher>&& backendDispatcher, int id) : BackendDispatcher::CallbackBase(WTFMove(backendDispatcher), id) { }
+
+void DatabaseBackendDispatcherHandler::ExecuteSQLAsyncOptionalReturnValuesCallback::sendSuccess(RefPtr<Inspector::Protocol::Array<String>>&& columnNames, Inspector::Protocol::OptOutput<String>* notes, Inspector::Protocol::OptOutput<double>* timestamp, Inspector::Protocol::OptOutput<Inspector::InspectorObject>* values, Inspector::Protocol::OptOutput<Inspector::InspectorValue>* payload, Inspector::Protocol::OptOutput<int>* databaseId, RefPtr<Inspector::Protocol::Database::Error>&& sqlError, Inspector::Protocol::OptOutput<String>* screenColor, RefPtr<Inspector::Protocol::Database::ColorList>&& alternateColors, Inspector::Protocol::OptOutput<String>* printColor)
+{
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    if (columnNames)
+        jsonMessage->setArray(ASCIILiteral("columnNames"), columnNames);
+    if (notes.isAssigned())
+        jsonMessage->setString(ASCIILiteral("notes"), notes.getValue());
+    if (timestamp.isAssigned())
+        jsonMessage->setDouble(ASCIILiteral("timestamp"), timestamp.getValue());
+    if (values.isAssigned())
+        jsonMessage->setObject(ASCIILiteral("values"), values.getValue());
+    if (payload.isAssigned())
+        jsonMessage->setValue(ASCIILiteral("payload"), payload.getValue());
+    if (databaseId.isAssigned())
+        jsonMessage->setInteger(ASCIILiteral("databaseId"), databaseId.getValue());
+    if (sqlError)
+        jsonMessage->setObject(ASCIILiteral("sqlError"), sqlError);
+    if (screenColor.isAssigned())
+        jsonMessage->setString(ASCIILiteral("screenColor"), screenColor.getValue());
+    if (alternateColors)
+        jsonMessage->setArray(ASCIILiteral("alternateColors"), alternateColors);
+    if (printColor.isAssigned())
+        jsonMessage->setString(ASCIILiteral("printColor"), printColor.getValue());
+    CallbackBase::sendSuccess(WTFMove(jsonMessage));
+}
+
+void DatabaseBackendDispatcher::executeSQLAsyncOptionalReturnValues(long requestId, RefPtr<InspectorObject>&& parameters)
+{
+    int in_databaseId = m_backendDispatcher->getInteger(parameters.get(), ASCIILiteral("databaseId"), nullptr);
+    String in_query = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("query"), nullptr);
+    if (m_backendDispatcher->hasProtocolErrors()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::InvalidParams, String::format("Some arguments of method '%s' can't be processed", "Database.executeSQLAsyncOptionalReturnValues"));
+        return;
+    }
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->executeSQLAsyncOptionalReturnValues(requestId, in_databaseId, in_query);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    Ref<DatabaseBackendDispatcherHandler::ExecuteSQLAsyncOptionalReturnValuesCallback> callback = adoptRef(*new DatabaseBackendDispatcherHandler::ExecuteSQLAsyncOptionalReturnValuesCallback(m_backendDispatcher.copyRef(), requestId));
+    m_agent->executeSQLAsyncOptionalReturnValues(error, in_databaseId, in_query, callback.copyRef());
+
+    if (error.length()) {
+        callback->disable();
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, error);
+        return;
+    }
+}
+
+void DatabaseBackendDispatcher::executeSQLSync(long requestId, RefPtr<InspectorObject>&& parameters)
+{
+    int in_databaseId = m_backendDispatcher->getInteger(parameters.get(), ASCIILiteral("databaseId"), nullptr);
+    String in_query = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("query"), nullptr);
+    if (m_backendDispatcher->hasProtocolErrors()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::InvalidParams, String::format("Some arguments of method '%s' can't be processed", "Database.executeSQLSync"));
+        return;
+    }
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->executeSQLSync(requestId, in_databaseId, in_query);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    RefPtr<Inspector::Protocol::Array<String>> out_columnNames;
+    String out_notes;
+    double out_timestamp;
+    Inspector::InspectorObject out_values;
+    Inspector::InspectorValue out_payload;
+    Inspector::Protocol::Database::DatabaseId out_databaseId;
+    RefPtr<Inspector::Protocol::Database::Error> out_sqlError;
+    RefPtr<Inspector::Protocol::Database::ColorList> out_alternateColors;
+    Inspector::Protocol::Database::PrimaryColors out_screenColor;
+    DatabaseBackendDispatcherHandler::PrintColor out_printColor;
+    m_agent->executeSQLSync(error, in_databaseId, in_query, out_columnNames, &out_notes, &out_timestamp, out_values, &out_payload, &out_databaseId, out_sqlError, out_alternateColors, &out_screenColor, &out_printColor);
+
+    if (!error.length()) {
+        result->setArray(ASCIILiteral("columnNames"), out_columnNames);
+        result->setString(ASCIILiteral("notes"), out_notes);
+        result->setDouble(ASCIILiteral("timestamp"), out_timestamp);
+        result->setObject(ASCIILiteral("values"), out_values);
+        result->setValue(ASCIILiteral("payload"), out_payload);
+        result->setInteger(ASCIILiteral("databaseId"), out_databaseId);
+        result->setObject(ASCIILiteral("sqlError"), out_sqlError);
+        result->setArray(ASCIILiteral("alternateColors"), out_alternateColors);
+        result->setString(ASCIILiteral("screenColor"), Inspector::Protocol::TestHelpers::getEnumConstantValue(out_screenColor));
+        result->setString(ASCIILiteral("printColor"), Inspector::Protocol::TestHelpers::getEnumConstantValue(out_printColor));
+    }
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+DatabaseBackendDispatcherHandler::ExecuteSQLAsyncCallback::ExecuteSQLAsyncCallback(Ref<BackendDispatcher>&& backendDispatcher, int id) : BackendDispatcher::CallbackBase(WTFMove(backendDispatcher), id) { }
+
+void DatabaseBackendDispatcherHandler::ExecuteSQLAsyncCallback::sendSuccess(RefPtr<Inspector::Protocol::Array<String>>&& columnNames, const String& notes, double timestamp, Inspector::InspectorObject values, Inspector::InspectorValue payload, int databaseId, RefPtr<Inspector::Protocol::Database::Error>&& sqlError, const String& screenColor, RefPtr<Inspector::Protocol::Database::ColorList>&& alternateColors, const String& printColor)
+{
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setArray(ASCIILiteral("columnNames"), columnNames);
+    jsonMessage->setString(ASCIILiteral("notes"), notes);
+    jsonMessage->setDouble(ASCIILiteral("timestamp"), timestamp);
+    jsonMessage->setObject(ASCIILiteral("values"), values);
+    jsonMessage->setValue(ASCIILiteral("payload"), payload);
+    jsonMessage->setInteger(ASCIILiteral("databaseId"), databaseId);
+    jsonMessage->setObject(ASCIILiteral("sqlError"), sqlError);
+    jsonMessage->setString(ASCIILiteral("screenColor"), Inspector::Protocol::TestHelpers::getEnumConstantValue(screenColor));
+    jsonMessage->setArray(ASCIILiteral("alternateColors"), alternateColors);
+    jsonMessage->setString(ASCIILiteral("printColor"), Inspector::Protocol::TestHelpers::getEnumConstantValue(printColor));
+    CallbackBase::sendSuccess(WTFMove(jsonMessage));
+}
+
+void DatabaseBackendDispatcher::executeSQLAsync(long requestId, RefPtr<InspectorObject>&& parameters)
+{
+    int in_databaseId = m_backendDispatcher->getInteger(parameters.get(), ASCIILiteral("databaseId"), nullptr);
+    String in_query = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("query"), nullptr);
+    if (m_backendDispatcher->hasProtocolErrors()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::InvalidParams, String::format("Some arguments of method '%s' can't be processed", "Database.executeSQLAsync"));
+        return;
+    }
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->executeSQLAsync(requestId, in_databaseId, in_query);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    Ref<DatabaseBackendDispatcherHandler::ExecuteSQLAsyncCallback> callback = adoptRef(*new DatabaseBackendDispatcherHandler::ExecuteSQLAsyncCallback(m_backendDispatcher.copyRef(), requestId));
+    m_agent->executeSQLAsync(error, in_databaseId, in_query, callback.copyRef());
+
+    if (error.length()) {
+        callback->disable();
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, error);
+        return;
+    }
+}
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace Database {
+class Error;
+enum class PrimaryColors;
+} // Database
+// End of forward declarations.
+
+
+// Typedefs.
+namespace Database {
+/* Unique identifier of Database object. */
+typedef int DatabaseId;
+typedef Inspector::Protocol::Array<Inspector::Protocol::Database::PrimaryColors> ColorList;
+} // Database
+// End of typedefs.
+
+namespace TestHelpers {
+
+String getEnumConstantValue(int code);
+
+template<typename T> String getEnumConstantValue(T enumValue)
+{
+    return getEnumConstantValue(static_cast<int>(enumValue));
+}
+
+} // namespace TestHelpers
+
+namespace Database {
+/*  */
+enum class PrimaryColors {
+    Red = 0,
+    Green = 1,
+    Blue = 2,
+}; // enum class PrimaryColors
+/* Database error. */
+class Error : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        MessageSet = 1 << 0,
+        CodeSet = 1 << 1,
+        AllFieldsSet = (MessageSet | CodeSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*Error*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class Error;
+    public:
+
+        Builder<STATE | MessageSet>& setMessage(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & MessageSet), property_message_already_set);
+            m_result->setString(ASCIILiteral("message"), value);
+            return castState<MessageSet>();
+        }
+
+        Builder<STATE | CodeSet>& setCode(int value)
+        {
+            COMPILE_ASSERT(!(STATE & CodeSet), property_code_already_set);
+            m_result->setInteger(ASCIILiteral("code"), value);
+            return castState<CodeSet>();
+        }
+
+        Ref<Error> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(Error) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<Error>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<Error> result = Error::create()
+     *     .setMessage(...)
+     *     .setCode(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+} // Database
+
+
+
+namespace TestHelpers {
+
+template<typename ProtocolEnumType>
+std::optional<ProtocolEnumType> parseEnumValueFromString(const String&);
+
+// Enums in the 'Database' Domain
+template<>
+std::optional<Inspector::Protocol::Database::PrimaryColors> parseEnumValueFromString<Inspector::Protocol::Database::PrimaryColors>(const String&);
+
+} // namespace TestHelpers
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+namespace TestHelpers {
+
+static const char* const enum_constant_values[] = {
+    "red",
+    "green",
+    "blue",
+    "cyan",
+    "magenta",
+    "yellow",
+    "black",
+};
+
+String getEnumConstantValue(int code) {
+    return enum_constant_values[code];
+}
+
+// Enums in the 'Database' Domain
+template<>
+std::optional<Inspector::Protocol::Database::PrimaryColors> parseEnumValueFromString<Inspector::Protocol::Database::PrimaryColors>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::Database::PrimaryColors::Red,
+        (size_t)Inspector::Protocol::Database::PrimaryColors::Green,
+        (size_t)Inspector::Protocol::Database::PrimaryColors::Blue,
+    };
+    for (size_t i = 0; i < 3; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::Database::PrimaryColors)constantValues[i];
+
+    return std::nullopt;
+}
+
+
+} // namespace TestHelpers
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+@protocol TestProtocolDatabaseDomainHandler;
+
+namespace Inspector {
+
+
+class ObjCInspectorDatabaseBackendDispatcher final : public AlternateDatabaseBackendDispatcher {
+public:
+    ObjCInspectorDatabaseBackendDispatcher(id<TestProtocolDatabaseDomainHandler> handler) { m_delegate = handler; }
+    virtual void executeSQLSyncOptionalReturnValues(long requestId, int in_databaseId, const String& in_query) override;
+    virtual void executeSQLAsyncOptionalReturnValues(long requestId, int in_databaseId, const String& in_query) override;
+    virtual void executeSQLSync(long requestId, int in_databaseId, const String& in_query) override;
+    virtual void executeSQLAsync(long requestId, int in_databaseId, const String& in_query) override;
+private:
+    RetainPtr<id<TestProtocolDatabaseDomainHandler>> m_delegate;
+};
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+    id<TestProtocolDatabaseDomainHandler> _databaseHandler;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [_databaseHandler release];
+    [super dealloc];
+}
+
+- (void)setDatabaseHandler:(id<TestProtocolDatabaseDomainHandler>)handler
+{
+    if (handler == _databaseHandler)
+        return;
+
+    [_databaseHandler release];
+    _databaseHandler = [handler retain];
+
+    auto alternateDispatcher = std::make_unique<ObjCInspectorDatabaseBackendDispatcher>(handler);
+    auto alternateAgent = std::make_unique<AlternateDispatchableAgent<DatabaseBackendDispatcher, AlternateDatabaseBackendDispatcher>>(ASCIILiteral("Database"), *_controller, WTFMove(alternateDispatcher));
+    _controller->appendExtraAgent(WTFMove(alternateAgent));
+}
+
+- (id<TestProtocolDatabaseDomainHandler>)databaseHandler
+{
+    return _databaseHandler;
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@property (nonatomic, retain, setter=setDatabaseHandler:) id<TestProtocolDatabaseDomainHandler> databaseHandler;
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+void ObjCInspectorDatabaseBackendDispatcher::executeSQLSyncOptionalReturnValues(long requestId, int in_databaseId, const String& in_query)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^(NSArray/*<NSString>*/ **columnNames, NSString **notes, double *timestamp, RWIProtocolJSONObject **values, RWIProtocolJSONObject **payload, int *databaseId, TestProtocolDatabaseError **sqlError, TestProtocolDatabasePrimaryColors *screenColor, NSArray/*<NSString>*/ **alternateColors, TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColor *printColor) {
+        Ref<InspectorObject> resultObject = InspectorObject::create();
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(columnNames, @"columnNames");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(notes, @"notes");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(values, @"values");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(payload, @"payload");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(sqlError, @"sqlError");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(alternateColors, @"alternateColors");
+        if (columnNames)
+            resultObject->setArray(ASCIILiteral("columnNames"), inspectorStringArray(*columnNames));
+        if (notes)
+            resultObject->setString(ASCIILiteral("notes"), *notes);
+        if (timestamp)
+            resultObject->setDouble(ASCIILiteral("timestamp"), *timestamp);
+        if (values)
+            resultObject->setObject(ASCIILiteral("values"), [*values toInspectorObject]);
+        if (payload)
+            resultObject->setValue(ASCIILiteral("payload"), [*payload toInspectorObject]);
+        if (databaseId)
+            resultObject->setInteger(ASCIILiteral("databaseId"), *databaseId);
+        if (sqlError)
+            resultObject->setObject(ASCIILiteral("sqlError"), [*sqlError toInspectorObject]);
+        if (screenColor)
+            resultObject->setString(ASCIILiteral("screenColor"), toProtocolString(*screenColor));
+        if (alternateColors)
+            resultObject->setArray(ASCIILiteral("alternateColors"), inspectorStringArray(*alternateColors));
+        if (printColor)
+            resultObject->setString(ASCIILiteral("printColor"), toProtocolString(*printColor));
+        backendDispatcher()->sendResponse(requestId, WTFMove(resultObject));
+    };
+
+    int o_in_databaseId = in_databaseId;
+    NSString *o_in_query = in_query;
+
+    [m_delegate executeSQLSyncOptionalReturnValuesWithErrorCallback:errorCallback successCallback:successCallback databaseId:o_in_databaseId query:o_in_query];
+}
+
+void ObjCInspectorDatabaseBackendDispatcher::executeSQLAsyncOptionalReturnValues(long requestId, int in_databaseId, const String& in_query)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^(NSArray/*<NSString>*/ **columnNames, NSString **notes, double *timestamp, RWIProtocolJSONObject **values, RWIProtocolJSONObject **payload, int *databaseId, TestProtocolDatabaseError **sqlError, TestProtocolDatabasePrimaryColors *screenColor, NSArray/*<NSString>*/ **alternateColors, TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColor *printColor) {
+        Ref<InspectorObject> resultObject = InspectorObject::create();
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(columnNames, @"columnNames");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(notes, @"notes");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(values, @"values");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(payload, @"payload");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(sqlError, @"sqlError");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(alternateColors, @"alternateColors");
+        if (columnNames)
+            resultObject->setArray(ASCIILiteral("columnNames"), inspectorStringArray(*columnNames));
+        if (notes)
+            resultObject->setString(ASCIILiteral("notes"), *notes);
+        if (timestamp)
+            resultObject->setDouble(ASCIILiteral("timestamp"), *timestamp);
+        if (values)
+            resultObject->setObject(ASCIILiteral("values"), [*values toInspectorObject]);
+        if (payload)
+            resultObject->setValue(ASCIILiteral("payload"), [*payload toInspectorObject]);
+        if (databaseId)
+            resultObject->setInteger(ASCIILiteral("databaseId"), *databaseId);
+        if (sqlError)
+            resultObject->setObject(ASCIILiteral("sqlError"), [*sqlError toInspectorObject]);
+        if (screenColor)
+            resultObject->setString(ASCIILiteral("screenColor"), toProtocolString(*screenColor));
+        if (alternateColors)
+            resultObject->setArray(ASCIILiteral("alternateColors"), inspectorStringArray(*alternateColors));
+        if (printColor)
+            resultObject->setString(ASCIILiteral("printColor"), toProtocolString(*printColor));
+        backendDispatcher()->sendResponse(requestId, WTFMove(resultObject));
+    };
+
+    int o_in_databaseId = in_databaseId;
+    NSString *o_in_query = in_query;
+
+    [m_delegate executeSQLAsyncOptionalReturnValuesWithErrorCallback:errorCallback successCallback:successCallback databaseId:o_in_databaseId query:o_in_query];
+}
+
+void ObjCInspectorDatabaseBackendDispatcher::executeSQLSync(long requestId, int in_databaseId, const String& in_query)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^(NSArray/*<NSString>*/ *columnNames, NSString *notes, double timestamp, RWIProtocolJSONObject *values, RWIProtocolJSONObject *payload, int databaseId, TestProtocolDatabaseError *sqlError, NSArray/*<NSString>*/ *alternateColors, TestProtocolDatabasePrimaryColors screenColor, TestProtocolDatabaseExecuteSQLSyncPrintColor printColor) {
+        Ref<InspectorObject> resultObject = InspectorObject::create();
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(columnNames, @"columnNames");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(notes, @"notes");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(values, @"values");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(payload, @"payload");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(sqlError, @"sqlError");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(alternateColors, @"alternateColors");
+        resultObject->setArray(ASCIILiteral("columnNames"), inspectorStringArray(columnNames));
+        resultObject->setString(ASCIILiteral("notes"), notes);
+        resultObject->setDouble(ASCIILiteral("timestamp"), timestamp);
+        resultObject->setObject(ASCIILiteral("values"), [values toInspectorObject]);
+        resultObject->setValue(ASCIILiteral("payload"), [payload toInspectorObject]);
+        resultObject->setInteger(ASCIILiteral("databaseId"), databaseId);
+        resultObject->setObject(ASCIILiteral("sqlError"), [sqlError toInspectorObject]);
+        resultObject->setArray(ASCIILiteral("alternateColors"), inspectorStringArray(alternateColors));
+        resultObject->setString(ASCIILiteral("screenColor"), toProtocolString(screenColor));
+        resultObject->setString(ASCIILiteral("printColor"), toProtocolString(printColor));
+        backendDispatcher()->sendResponse(requestId, WTFMove(resultObject));
+    };
+
+    int o_in_databaseId = in_databaseId;
+    NSString *o_in_query = in_query;
+
+    [m_delegate executeSQLSyncWithErrorCallback:errorCallback successCallback:successCallback databaseId:o_in_databaseId query:o_in_query];
+}
+
+void ObjCInspectorDatabaseBackendDispatcher::executeSQLAsync(long requestId, int in_databaseId, const String& in_query)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^(NSArray/*<NSString>*/ *columnNames, NSString *notes, double timestamp, RWIProtocolJSONObject *values, RWIProtocolJSONObject *payload, int databaseId, TestProtocolDatabaseError *sqlError, TestProtocolDatabasePrimaryColors screenColor, NSArray/*<NSString>*/ *alternateColors, TestProtocolDatabaseExecuteSQLAsyncPrintColor printColor) {
+        Ref<InspectorObject> resultObject = InspectorObject::create();
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(columnNames, @"columnNames");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(notes, @"notes");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(values, @"values");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(payload, @"payload");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(sqlError, @"sqlError");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(alternateColors, @"alternateColors");
+        resultObject->setArray(ASCIILiteral("columnNames"), inspectorStringArray(columnNames));
+        resultObject->setString(ASCIILiteral("notes"), notes);
+        resultObject->setDouble(ASCIILiteral("timestamp"), timestamp);
+        resultObject->setObject(ASCIILiteral("values"), [values toInspectorObject]);
+        resultObject->setValue(ASCIILiteral("payload"), [payload toInspectorObject]);
+        resultObject->setInteger(ASCIILiteral("databaseId"), databaseId);
+        resultObject->setObject(ASCIILiteral("sqlError"), [sqlError toInspectorObject]);
+        resultObject->setString(ASCIILiteral("screenColor"), toProtocolString(screenColor));
+        resultObject->setArray(ASCIILiteral("alternateColors"), inspectorStringArray(alternateColors));
+        resultObject->setString(ASCIILiteral("printColor"), toProtocolString(printColor));
+        backendDispatcher()->sendResponse(requestId, WTFMove(resultObject));
+    };
+
+    int o_in_databaseId = in_databaseId;
+    NSString *o_in_query = in_query;
+
+    [m_delegate executeSQLAsyncWithErrorCallback:errorCallback successCallback:successCallback databaseId:o_in_databaseId query:o_in_query];
+}
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+@class TestProtocolDatabaseError;
+
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabasePrimaryColors) {
+    TestProtocolDatabasePrimaryColorsRed,
+    TestProtocolDatabasePrimaryColorsGreen,
+    TestProtocolDatabasePrimaryColorsBlue,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColor) {
+    TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorCyan,
+    TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorMagenta,
+    TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorYellow,
+    TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorBlack,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColor) {
+    TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorCyan,
+    TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorMagenta,
+    TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorYellow,
+    TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorBlack,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabaseExecuteSQLSyncPrintColor) {
+    TestProtocolDatabaseExecuteSQLSyncPrintColorCyan,
+    TestProtocolDatabaseExecuteSQLSyncPrintColorMagenta,
+    TestProtocolDatabaseExecuteSQLSyncPrintColorYellow,
+    TestProtocolDatabaseExecuteSQLSyncPrintColorBlack,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabaseExecuteSQLAsyncPrintColor) {
+    TestProtocolDatabaseExecuteSQLAsyncPrintColorCyan,
+    TestProtocolDatabaseExecuteSQLAsyncPrintColorMagenta,
+    TestProtocolDatabaseExecuteSQLAsyncPrintColorYellow,
+    TestProtocolDatabaseExecuteSQLAsyncPrintColorBlack,
+};
+
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseError : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithMessage:(NSString *)message code:(int)code;
+/* required */ @property (nonatomic, copy) NSString *message;
+/* required */ @property (nonatomic, assign) int code;
+@end
+
+@protocol TestProtocolDatabaseDomainHandler <NSObject>
+@required
+- (void)executeSQLSyncOptionalReturnValuesWithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)(NSArray/*<NSString>*/ **columnNames, NSString **notes, double *timestamp, RWIProtocolJSONObject **values, RWIProtocolJSONObject **payload, int *databaseId, TestProtocolDatabaseError **sqlError, TestProtocolDatabasePrimaryColors *screenColor, NSArray/*<NSString>*/ **alternateColors, TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColor *printColor))successCallback databaseId:(int)databaseId query:(NSString *)query;
+- (void)executeSQLAsyncOptionalReturnValuesWithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)(NSArray/*<NSString>*/ **columnNames, NSString **notes, double *timestamp, RWIProtocolJSONObject **values, RWIProtocolJSONObject **payload, int *databaseId, TestProtocolDatabaseError **sqlError, TestProtocolDatabasePrimaryColors *screenColor, NSArray/*<NSString>*/ **alternateColors, TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColor *printColor))successCallback databaseId:(int)databaseId query:(NSString *)query;
+- (void)executeSQLSyncWithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)(NSArray/*<NSString>*/ *columnNames, NSString *notes, double timestamp, RWIProtocolJSONObject *values, RWIProtocolJSONObject *payload, int databaseId, TestProtocolDatabaseError *sqlError, NSArray/*<NSString>*/ *alternateColors, TestProtocolDatabasePrimaryColors screenColor, TestProtocolDatabaseExecuteSQLSyncPrintColor printColor))successCallback databaseId:(int)databaseId query:(NSString *)query;
+- (void)executeSQLAsyncWithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)(NSArray/*<NSString>*/ *columnNames, NSString *notes, double timestamp, RWIProtocolJSONObject *values, RWIProtocolJSONObject *payload, int databaseId, TestProtocolDatabaseError *sqlError, TestProtocolDatabasePrimaryColors screenColor, NSArray/*<NSString>*/ *alternateColors, TestProtocolDatabaseExecuteSQLAsyncPrintColor printColor))successCallback databaseId:(int)databaseId query:(NSString *)query;
+@end
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+inline String toProtocolString(TestProtocolDatabasePrimaryColors value)
+{
+    switch(value) {
+    case TestProtocolDatabasePrimaryColorsRed:
+        return ASCIILiteral("red");
+    case TestProtocolDatabasePrimaryColorsGreen:
+        return ASCIILiteral("green");
+    case TestProtocolDatabasePrimaryColorsBlue:
+        return ASCIILiteral("blue");
+    }
+}
+
+template<>
+inline TestProtocolDatabasePrimaryColors fromProtocolString(const String& value)
+{
+    if (value == "red")
+        return TestProtocolDatabasePrimaryColorsRed;
+    if (value == "green")
+        return TestProtocolDatabasePrimaryColorsGreen;
+    if (value == "blue")
+        return TestProtocolDatabasePrimaryColorsBlue;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabasePrimaryColorsRed;
+}
+
+inline String toProtocolString(TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColor value)
+{
+    switch(value) {
+    case TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorYellow:
+        return ASCIILiteral("yellow");
+    case TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorBlack:
+        return ASCIILiteral("black");
+    }
+}
+
+template<>
+inline TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColor fromProtocolString(const String& value)
+{
+    if (value == "cyan")
+        return TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorCyan;
+    if (value == "magenta")
+        return TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorMagenta;
+    if (value == "yellow")
+        return TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorYellow;
+    if (value == "black")
+        return TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorBlack;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabaseExecuteSQLSyncOptionalReturnValuesPrintColorCyan;
+}
+
+inline String toProtocolString(TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColor value)
+{
+    switch(value) {
+    case TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorYellow:
+        return ASCIILiteral("yellow");
+    case TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorBlack:
+        return ASCIILiteral("black");
+    }
+}
+
+template<>
+inline TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColor fromProtocolString(const String& value)
+{
+    if (value == "cyan")
+        return TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorCyan;
+    if (value == "magenta")
+        return TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorMagenta;
+    if (value == "yellow")
+        return TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorYellow;
+    if (value == "black")
+        return TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorBlack;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabaseExecuteSQLAsyncOptionalReturnValuesPrintColorCyan;
+}
+
+inline String toProtocolString(TestProtocolDatabaseExecuteSQLSyncPrintColor value)
+{
+    switch(value) {
+    case TestProtocolDatabaseExecuteSQLSyncPrintColorCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolDatabaseExecuteSQLSyncPrintColorMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolDatabaseExecuteSQLSyncPrintColorYellow:
+        return ASCIILiteral("yellow");
+    case TestProtocolDatabaseExecuteSQLSyncPrintColorBlack:
+        return ASCIILiteral("black");
+    }
+}
+
+template<>
+inline TestProtocolDatabaseExecuteSQLSyncPrintColor fromProtocolString(const String& value)
+{
+    if (value == "cyan")
+        return TestProtocolDatabaseExecuteSQLSyncPrintColorCyan;
+    if (value == "magenta")
+        return TestProtocolDatabaseExecuteSQLSyncPrintColorMagenta;
+    if (value == "yellow")
+        return TestProtocolDatabaseExecuteSQLSyncPrintColorYellow;
+    if (value == "black")
+        return TestProtocolDatabaseExecuteSQLSyncPrintColorBlack;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabaseExecuteSQLSyncPrintColorCyan;
+}
+
+inline String toProtocolString(TestProtocolDatabaseExecuteSQLAsyncPrintColor value)
+{
+    switch(value) {
+    case TestProtocolDatabaseExecuteSQLAsyncPrintColorCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolDatabaseExecuteSQLAsyncPrintColorMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolDatabaseExecuteSQLAsyncPrintColorYellow:
+        return ASCIILiteral("yellow");
+    case TestProtocolDatabaseExecuteSQLAsyncPrintColorBlack:
+        return ASCIILiteral("black");
+    }
+}
+
+template<>
+inline TestProtocolDatabaseExecuteSQLAsyncPrintColor fromProtocolString(const String& value)
+{
+    if (value == "cyan")
+        return TestProtocolDatabaseExecuteSQLAsyncPrintColorCyan;
+    if (value == "magenta")
+        return TestProtocolDatabaseExecuteSQLAsyncPrintColorMagenta;
+    if (value == "yellow")
+        return TestProtocolDatabaseExecuteSQLAsyncPrintColorYellow;
+    if (value == "black")
+        return TestProtocolDatabaseExecuteSQLAsyncPrintColorBlack;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabaseExecuteSQLAsyncPrintColorCyan;
+}
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (DatabaseDomain)
+
++ (void)_parseDatabaseId:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parsePrimaryColors:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseColorList:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload;
++ (void)_parseError:(TestProtocolDatabaseError **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (DatabaseDomain)
+
++ (void)_parseDatabaseId:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSNumber class]);
+    *outValue = (NSNumber *)payload;
+}
+
++ (void)_parsePrimaryColors:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = @(Inspector::fromProtocolString<TestProtocolDatabasePrimaryColors>(payload));
+}
+
++ (void)_parseColorList:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<NSString>*/ class]);
+    *outValue = (NSArray/*<NSString>*/ *)payload;
+}
+
++ (void)_parseError:(TestProtocolDatabaseError **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolDatabaseError alloc] initWithPayload:payload];
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-async-attribute.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+@implementation TestProtocolDatabaseError
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"message"], @"message");
+    self.message = payload[@"message"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"code"], @"code");
+    self.code = [payload[@"code"] integerValue];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithMessage:(NSString *)message code:(int)code
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(message, @"message");
+
+    self.message = message;
+    self.code = code;
+
+    return self;
+}
+
+- (void)setMessage:(NSString *)message
+{
+    [super setString:message forKey:@"message"];
+}
+
+- (NSString *)message
+{
+    return [super stringForKey:@"message"];
+}
+
+- (void)setCode:(int)code
+{
+    [super setInteger:code forKey:@"code"];
+}
+
+- (int)code
+{
+    return [super integerForKey:@"code"];
+}
+
+@end
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result b/inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result
new file mode 100644
index 0000000..ec9b4e8
--- /dev/null
+++ b/inspector/scripts/tests/expected/commands-with-optional-call-return-parameters.json-result
@@ -0,0 +1,1609 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// Database.
+InspectorBackend.registerEnum("Database.PrimaryColors", {Red: "red", Green: "green", Blue: "blue"});
+InspectorBackend.registerCommand("Database.executeAllOptionalParameters", [{"name": "columnNames", "type": "object", "optional": true}, {"name": "notes", "type": "string", "optional": true}, {"name": "timestamp", "type": "number", "optional": true}, {"name": "values", "type": "object", "optional": true}, {"name": "payload", "type": "object", "optional": true}, {"name": "databaseId", "type": "number", "optional": true}, {"name": "sqlError", "type": "object", "optional": true}, {"name": "screenColor", "type": "string", "optional": true}, {"name": "alternateColors", "type": "object", "optional": true}, {"name": "printColor", "type": "string", "optional": true}], ["columnNames", "notes", "timestamp", "values", "payload", "databaseId", "sqlError", "screenColor", "alternateColors", "printColor"]);
+InspectorBackend.registerCommand("Database.executeNoOptionalParameters", [{"name": "columnNames", "type": "object", "optional": false}, {"name": "notes", "type": "string", "optional": false}, {"name": "timestamp", "type": "number", "optional": false}, {"name": "values", "type": "object", "optional": false}, {"name": "payload", "type": "object", "optional": false}, {"name": "databaseId", "type": "number", "optional": false}, {"name": "sqlError", "type": "object", "optional": false}, {"name": "screenColor", "type": "string", "optional": false}, {"name": "alternateColors", "type": "object", "optional": false}, {"name": "printColor", "type": "string", "optional": false}], ["columnNames", "notes", "timestamp", "values", "payload", "databaseId", "sqlError", "screenColor", "alternateColors", "printColor"]);
+InspectorBackend.activateDomain("Database");
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+class AlternateDatabaseBackendDispatcher : public AlternateBackendDispatcher {
+public:
+    virtual ~AlternateDatabaseBackendDispatcher() { }
+    virtual void executeAllOptionalParameters(long callId, const Inspector::InspectorArray* in_columnNames, const String* in_notes, const double* in_timestamp, const Inspector::InspectorObject* in_values, const Inspector::InspectorValue* in_payload, const int* in_databaseId, const Inspector::InspectorObject* in_sqlError, const String* in_screenColor, const Inspector::InspectorArray* in_alternateColors, const String* in_printColor) = 0;
+    virtual void executeNoOptionalParameters(long callId, const Inspector::InspectorArray& in_columnNames, const String& in_notes, double in_timestamp, const Inspector::InspectorObject& in_values, Inspector::InspectorValue in_payload, int in_databaseId, const Inspector::InspectorObject& in_sqlError, const String& in_screenColor, const Inspector::InspectorArray& in_alternateColors, const String& in_printColor) = 0;
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+class AlternateDatabaseBackendDispatcher;
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+class DatabaseBackendDispatcherHandler {
+public:
+    // Named after parameter 'printColor' while generating command/event executeAllOptionalParameters.
+    enum class PrintColor {
+        Cyan = 3,
+        Magenta = 4,
+        Yellow = 5,
+        Black = 6,
+    }; // enum class PrintColor
+    virtual void executeAllOptionalParameters(ErrorString&, const Inspector::InspectorArray* opt_in_columnNames, const String* opt_in_notes, const double* opt_in_timestamp, const Inspector::InspectorObject* opt_in_values, const Inspector::InspectorValue* opt_in_payload, const int* opt_in_databaseId, const Inspector::InspectorObject* opt_in_sqlError, const String* opt_in_screenColor, const Inspector::InspectorArray* opt_in_alternateColors, const String* opt_in_printColor, RefPtr<Inspector::Protocol::Array<String>>& opt_out_columnNames, Inspector::Protocol::OptOutput<String>* opt_out_notes, Inspector::Protocol::OptOutput<double>* opt_out_timestamp, Inspector::Protocol::OptOutput<Inspector::InspectorObject>* opt_out_values, Inspector::Protocol::OptOutput<Inspector::InspectorValue>* opt_out_payload, Inspector::Protocol::OptOutput<int>* opt_out_databaseId, RefPtr<Inspector::Protocol::Database::Error>& opt_out_sqlError, Inspector::Protocol::Database::PrimaryColors* opt_out_screenColor, RefPtr<Inspector::Protocol::Database::ColorList>& opt_out_alternateColors, DatabaseBackendDispatcherHandler::PrintColor* opt_out_printColor) = 0;
+    virtual void executeNoOptionalParameters(ErrorString&, const Inspector::InspectorArray& in_columnNames, const String& in_notes, double in_timestamp, const Inspector::InspectorObject& in_values, Inspector::InspectorValue in_payload, int in_databaseId, const Inspector::InspectorObject& in_sqlError, const String& in_screenColor, const Inspector::InspectorArray& in_alternateColors, const String& in_printColor, RefPtr<Inspector::Protocol::Array<String>>& out_columnNames, String* out_notes, double* out_timestamp, Inspector::InspectorObject* out_values, Inspector::InspectorValue* out_payload, int* out_databaseId, RefPtr<Inspector::Protocol::Database::Error>& out_sqlError, Inspector::Protocol::Database::PrimaryColors* out_screenColor, RefPtr<Inspector::Protocol::Database::ColorList>& out_alternateColors, DatabaseBackendDispatcherHandler::PrintColor* out_printColor) = 0;
+protected:
+    virtual ~DatabaseBackendDispatcherHandler();
+};
+
+class DatabaseBackendDispatcher final : public SupplementalBackendDispatcher {
+public:
+    static Ref<DatabaseBackendDispatcher> create(BackendDispatcher&, DatabaseBackendDispatcherHandler*);
+    void dispatch(long requestId, const String& method, Ref<InspectorObject>&& message) override;
+private:
+    void executeAllOptionalParameters(long requestId, RefPtr<InspectorObject>&& parameters);
+    void executeNoOptionalParameters(long requestId, RefPtr<InspectorObject>&& parameters);
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+public:
+    void setAlternateDispatcher(AlternateDatabaseBackendDispatcher* alternateDispatcher) { m_alternateDispatcher = alternateDispatcher; }
+private:
+    AlternateDatabaseBackendDispatcher* m_alternateDispatcher { nullptr };
+#endif
+private:
+    DatabaseBackendDispatcher(BackendDispatcher&, DatabaseBackendDispatcherHandler*);
+    DatabaseBackendDispatcherHandler* m_agent { nullptr };
+};
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+DatabaseBackendDispatcherHandler::~DatabaseBackendDispatcherHandler() { }
+
+Ref<DatabaseBackendDispatcher> DatabaseBackendDispatcher::create(BackendDispatcher& backendDispatcher, DatabaseBackendDispatcherHandler* agent)
+{
+    return adoptRef(*new DatabaseBackendDispatcher(backendDispatcher, agent));
+}
+
+DatabaseBackendDispatcher::DatabaseBackendDispatcher(BackendDispatcher& backendDispatcher, DatabaseBackendDispatcherHandler* agent)
+    : SupplementalBackendDispatcher(backendDispatcher)
+    , m_agent(agent)
+{
+    m_backendDispatcher->registerDispatcherForDomain(ASCIILiteral("Database"), this);
+}
+
+void DatabaseBackendDispatcher::dispatch(long requestId, const String& method, Ref<InspectorObject>&& message)
+{
+    Ref<DatabaseBackendDispatcher> protect(*this);
+
+    RefPtr<InspectorObject> parameters;
+    message->getObject(ASCIILiteral("params"), parameters);
+
+    if (method == "executeAllOptionalParameters")
+        executeAllOptionalParameters(requestId, WTFMove(parameters));
+    else if (method == "executeNoOptionalParameters")
+        executeNoOptionalParameters(requestId, WTFMove(parameters));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::MethodNotFound, makeString('\'', "Database", '.', method, "' was not found"));
+}
+
+void DatabaseBackendDispatcher::executeAllOptionalParameters(long requestId, RefPtr<InspectorObject>&& parameters)
+{
+    bool opt_in_columnNames_valueFound = false;
+    RefPtr<Inspector::InspectorArray> opt_in_columnNames = m_backendDispatcher->getArray(parameters.get(), ASCIILiteral("columnNames"), &opt_in_columnNames_valueFound);
+    bool opt_in_notes_valueFound = false;
+    String opt_in_notes = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("notes"), &opt_in_notes_valueFound);
+    bool opt_in_timestamp_valueFound = false;
+    Inspector::Protocol::OptOutput<double> opt_in_timestamp = m_backendDispatcher->getDouble(parameters.get(), ASCIILiteral("timestamp"), &opt_in_timestamp_valueFound);
+    bool opt_in_values_valueFound = false;
+    RefPtr<Inspector::InspectorObject> opt_in_values = m_backendDispatcher->getObject(parameters.get(), ASCIILiteral("values"), &opt_in_values_valueFound);
+    bool opt_in_payload_valueFound = false;
+    RefPtr<Inspector::InspectorValue> opt_in_payload = m_backendDispatcher->getValue(parameters.get(), ASCIILiteral("payload"), &opt_in_payload_valueFound);
+    bool opt_in_databaseId_valueFound = false;
+    int opt_in_databaseId = m_backendDispatcher->getInteger(parameters.get(), ASCIILiteral("databaseId"), &opt_in_databaseId_valueFound);
+    bool opt_in_sqlError_valueFound = false;
+    RefPtr<Inspector::InspectorObject> opt_in_sqlError = m_backendDispatcher->getObject(parameters.get(), ASCIILiteral("sqlError"), &opt_in_sqlError_valueFound);
+    bool opt_in_screenColor_valueFound = false;
+    String opt_in_screenColor = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("screenColor"), &opt_in_screenColor_valueFound);
+    bool opt_in_alternateColors_valueFound = false;
+    RefPtr<Inspector::InspectorArray> opt_in_alternateColors = m_backendDispatcher->getArray(parameters.get(), ASCIILiteral("alternateColors"), &opt_in_alternateColors_valueFound);
+    bool opt_in_printColor_valueFound = false;
+    String opt_in_printColor = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("printColor"), &opt_in_printColor_valueFound);
+    if (m_backendDispatcher->hasProtocolErrors()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::InvalidParams, String::format("Some arguments of method '%s' can't be processed", "Database.executeAllOptionalParameters"));
+        return;
+    }
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->executeAllOptionalParameters(requestId, opt_in_columnNames_valueFound ? opt_in_columnNames.get() : nullptr, opt_in_notes_valueFound ? &opt_in_notes : nullptr, opt_in_timestamp_valueFound ? &opt_in_timestamp : nullptr, opt_in_values_valueFound ? opt_in_values.get() : nullptr, opt_in_payload_valueFound ? opt_in_payload.get() : nullptr, opt_in_databaseId_valueFound ? &opt_in_databaseId : nullptr, opt_in_sqlError_valueFound ? opt_in_sqlError.get() : nullptr, opt_in_screenColor_valueFound ? &opt_in_screenColor : nullptr, opt_in_alternateColors_valueFound ? opt_in_alternateColors.get() : nullptr, opt_in_printColor_valueFound ? &opt_in_printColor : nullptr);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    RefPtr<Inspector::Protocol::Array<String>> out_columnNames;
+    Inspector::Protocol::OptOutput<String> out_notes;
+    Inspector::Protocol::OptOutput<double> out_timestamp;
+    Inspector::Protocol::OptOutput<Inspector::InspectorObject> out_values;
+    Inspector::Protocol::OptOutput<Inspector::InspectorValue> out_payload;
+    Inspector::Protocol::OptOutput<Inspector::Protocol::Database::DatabaseId> out_databaseId;
+    RefPtr<Inspector::Protocol::Database::Error> out_sqlError;
+    Inspector::Protocol::Database::PrimaryColors out_screenColor;
+    RefPtr<Inspector::Protocol::Database::ColorList> out_alternateColors;
+    DatabaseBackendDispatcherHandler::PrintColor out_printColor;
+    m_agent->executeAllOptionalParameters(error, opt_in_columnNames_valueFound ? opt_in_columnNames.get() : nullptr, opt_in_notes_valueFound ? &opt_in_notes : nullptr, opt_in_timestamp_valueFound ? &opt_in_timestamp : nullptr, opt_in_values_valueFound ? opt_in_values.get() : nullptr, opt_in_payload_valueFound ? opt_in_payload.get() : nullptr, opt_in_databaseId_valueFound ? &opt_in_databaseId : nullptr, opt_in_sqlError_valueFound ? opt_in_sqlError.get() : nullptr, opt_in_screenColor_valueFound ? &opt_in_screenColor : nullptr, opt_in_alternateColors_valueFound ? opt_in_alternateColors.get() : nullptr, opt_in_printColor_valueFound ? &opt_in_printColor : nullptr, out_columnNames, &out_notes, &out_timestamp, out_values, &out_payload, &out_databaseId, out_sqlError, &out_screenColor, out_alternateColors, &out_printColor);
+
+    if (!error.length()) {
+        if (out_columnNames)
+            result->setArray(ASCIILiteral("columnNames"), out_columnNames);
+        if (out_notes.isAssigned())
+            result->setString(ASCIILiteral("notes"), out_notes.getValue());
+        if (out_timestamp.isAssigned())
+            result->setDouble(ASCIILiteral("timestamp"), out_timestamp.getValue());
+        if (out_values.isAssigned())
+            result->setObject(ASCIILiteral("values"), out_values.getValue());
+        if (out_payload.isAssigned())
+            result->setValue(ASCIILiteral("payload"), out_payload.getValue());
+        if (out_databaseId.isAssigned())
+            result->setInteger(ASCIILiteral("databaseId"), out_databaseId.getValue());
+        if (out_sqlError)
+            result->setObject(ASCIILiteral("sqlError"), out_sqlError);
+        if (out_screenColor.isAssigned())
+            result->setString(ASCIILiteral("screenColor"), out_screenColor.getValue());
+        if (out_alternateColors)
+            result->setArray(ASCIILiteral("alternateColors"), out_alternateColors);
+        if (out_printColor.isAssigned())
+            result->setString(ASCIILiteral("printColor"), out_printColor.getValue());
+    }
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+void DatabaseBackendDispatcher::executeNoOptionalParameters(long requestId, RefPtr<InspectorObject>&& parameters)
+{
+    RefPtr<Inspector::InspectorArray> in_columnNames = m_backendDispatcher->getArray(parameters.get(), ASCIILiteral("columnNames"), nullptr);
+    String in_notes = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("notes"), nullptr);
+    double in_timestamp = m_backendDispatcher->getDouble(parameters.get(), ASCIILiteral("timestamp"), nullptr);
+    RefPtr<Inspector::InspectorObject> in_values = m_backendDispatcher->getObject(parameters.get(), ASCIILiteral("values"), nullptr);
+    RefPtr<Inspector::InspectorValue> in_payload = m_backendDispatcher->getValue(parameters.get(), ASCIILiteral("payload"), nullptr);
+    int in_databaseId = m_backendDispatcher->getInteger(parameters.get(), ASCIILiteral("databaseId"), nullptr);
+    RefPtr<Inspector::InspectorObject> in_sqlError = m_backendDispatcher->getObject(parameters.get(), ASCIILiteral("sqlError"), nullptr);
+    String in_screenColor = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("screenColor"), nullptr);
+    RefPtr<Inspector::InspectorArray> in_alternateColors = m_backendDispatcher->getArray(parameters.get(), ASCIILiteral("alternateColors"), nullptr);
+    String in_printColor = m_backendDispatcher->getString(parameters.get(), ASCIILiteral("printColor"), nullptr);
+    if (m_backendDispatcher->hasProtocolErrors()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::InvalidParams, String::format("Some arguments of method '%s' can't be processed", "Database.executeNoOptionalParameters"));
+        return;
+    }
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->executeNoOptionalParameters(requestId, *in_columnNames, in_notes, in_timestamp, *in_values, *in_payload, in_databaseId, *in_sqlError, in_screenColor, *in_alternateColors, in_printColor);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    RefPtr<Inspector::Protocol::Array<String>> out_columnNames;
+    String out_notes;
+    double out_timestamp;
+    Inspector::InspectorObject out_values;
+    Inspector::InspectorValue out_payload;
+    Inspector::Protocol::Database::DatabaseId out_databaseId;
+    RefPtr<Inspector::Protocol::Database::Error> out_sqlError;
+    Inspector::Protocol::Database::PrimaryColors out_screenColor;
+    RefPtr<Inspector::Protocol::Database::ColorList> out_alternateColors;
+    DatabaseBackendDispatcherHandler::PrintColor out_printColor;
+    m_agent->executeNoOptionalParameters(error, *in_columnNames, in_notes, in_timestamp, *in_values, *in_payload, in_databaseId, *in_sqlError, in_screenColor, *in_alternateColors, in_printColor, out_columnNames, &out_notes, &out_timestamp, out_values, &out_payload, &out_databaseId, out_sqlError, &out_screenColor, out_alternateColors, &out_printColor);
+
+    if (!error.length()) {
+        result->setArray(ASCIILiteral("columnNames"), out_columnNames);
+        result->setString(ASCIILiteral("notes"), out_notes);
+        result->setDouble(ASCIILiteral("timestamp"), out_timestamp);
+        result->setObject(ASCIILiteral("values"), out_values);
+        result->setValue(ASCIILiteral("payload"), out_payload);
+        result->setInteger(ASCIILiteral("databaseId"), out_databaseId);
+        result->setObject(ASCIILiteral("sqlError"), out_sqlError);
+        result->setString(ASCIILiteral("screenColor"), Inspector::Protocol::TestHelpers::getEnumConstantValue(out_screenColor));
+        result->setArray(ASCIILiteral("alternateColors"), out_alternateColors);
+        result->setString(ASCIILiteral("printColor"), Inspector::Protocol::TestHelpers::getEnumConstantValue(out_printColor));
+    }
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace Database {
+class Error;
+enum class PrimaryColors;
+} // Database
+// End of forward declarations.
+
+
+// Typedefs.
+namespace Database {
+/* Unique identifier of Database object. */
+typedef int DatabaseId;
+typedef Inspector::Protocol::Array<Inspector::Protocol::Database::PrimaryColors> ColorList;
+} // Database
+// End of typedefs.
+
+namespace TestHelpers {
+
+String getEnumConstantValue(int code);
+
+template<typename T> String getEnumConstantValue(T enumValue)
+{
+    return getEnumConstantValue(static_cast<int>(enumValue));
+}
+
+} // namespace TestHelpers
+
+namespace Database {
+/*  */
+enum class PrimaryColors {
+    Red = 0,
+    Green = 1,
+    Blue = 2,
+}; // enum class PrimaryColors
+/* Database error. */
+class Error : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        MessageSet = 1 << 0,
+        CodeSet = 1 << 1,
+        AllFieldsSet = (MessageSet | CodeSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*Error*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class Error;
+    public:
+
+        Builder<STATE | MessageSet>& setMessage(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & MessageSet), property_message_already_set);
+            m_result->setString(ASCIILiteral("message"), value);
+            return castState<MessageSet>();
+        }
+
+        Builder<STATE | CodeSet>& setCode(int value)
+        {
+            COMPILE_ASSERT(!(STATE & CodeSet), property_code_already_set);
+            m_result->setInteger(ASCIILiteral("code"), value);
+            return castState<CodeSet>();
+        }
+
+        Ref<Error> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(Error) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<Error>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<Error> result = Error::create()
+     *     .setMessage(...)
+     *     .setCode(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+} // Database
+
+
+
+namespace TestHelpers {
+
+template<typename ProtocolEnumType>
+std::optional<ProtocolEnumType> parseEnumValueFromString(const String&);
+
+// Enums in the 'Database' Domain
+template<>
+std::optional<Inspector::Protocol::Database::PrimaryColors> parseEnumValueFromString<Inspector::Protocol::Database::PrimaryColors>(const String&);
+
+} // namespace TestHelpers
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+namespace TestHelpers {
+
+static const char* const enum_constant_values[] = {
+    "red",
+    "green",
+    "blue",
+    "cyan",
+    "magenta",
+    "yellow",
+    "black",
+};
+
+String getEnumConstantValue(int code) {
+    return enum_constant_values[code];
+}
+
+// Enums in the 'Database' Domain
+template<>
+std::optional<Inspector::Protocol::Database::PrimaryColors> parseEnumValueFromString<Inspector::Protocol::Database::PrimaryColors>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::Database::PrimaryColors::Red,
+        (size_t)Inspector::Protocol::Database::PrimaryColors::Green,
+        (size_t)Inspector::Protocol::Database::PrimaryColors::Blue,
+    };
+    for (size_t i = 0; i < 3; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::Database::PrimaryColors)constantValues[i];
+
+    return std::nullopt;
+}
+
+
+} // namespace TestHelpers
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+@protocol TestProtocolDatabaseDomainHandler;
+
+namespace Inspector {
+
+
+class ObjCInspectorDatabaseBackendDispatcher final : public AlternateDatabaseBackendDispatcher {
+public:
+    ObjCInspectorDatabaseBackendDispatcher(id<TestProtocolDatabaseDomainHandler> handler) { m_delegate = handler; }
+    virtual void executeAllOptionalParameters(long requestId, const Inspector::InspectorArray* in_columnNames, const String* in_notes, const double* in_timestamp, const Inspector::InspectorObject* in_values, const Inspector::InspectorValue* in_payload, const int* in_databaseId, const Inspector::InspectorObject* in_sqlError, const String* in_screenColor, const Inspector::InspectorArray* in_alternateColors, const String* in_printColor) override;
+    virtual void executeNoOptionalParameters(long requestId, const Inspector::InspectorArray& in_columnNames, const String& in_notes, double in_timestamp, const Inspector::InspectorObject& in_values, Inspector::InspectorValue in_payload, int in_databaseId, const Inspector::InspectorObject& in_sqlError, const String& in_screenColor, const Inspector::InspectorArray& in_alternateColors, const String& in_printColor) override;
+private:
+    RetainPtr<id<TestProtocolDatabaseDomainHandler>> m_delegate;
+};
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+    id<TestProtocolDatabaseDomainHandler> _databaseHandler;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [_databaseHandler release];
+    [super dealloc];
+}
+
+- (void)setDatabaseHandler:(id<TestProtocolDatabaseDomainHandler>)handler
+{
+    if (handler == _databaseHandler)
+        return;
+
+    [_databaseHandler release];
+    _databaseHandler = [handler retain];
+
+    auto alternateDispatcher = std::make_unique<ObjCInspectorDatabaseBackendDispatcher>(handler);
+    auto alternateAgent = std::make_unique<AlternateDispatchableAgent<DatabaseBackendDispatcher, AlternateDatabaseBackendDispatcher>>(ASCIILiteral("Database"), *_controller, WTFMove(alternateDispatcher));
+    _controller->appendExtraAgent(WTFMove(alternateAgent));
+}
+
+- (id<TestProtocolDatabaseDomainHandler>)databaseHandler
+{
+    return _databaseHandler;
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@property (nonatomic, retain, setter=setDatabaseHandler:) id<TestProtocolDatabaseDomainHandler> databaseHandler;
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+void ObjCInspectorDatabaseBackendDispatcher::executeAllOptionalParameters(long requestId, const Inspector::InspectorArray* in_columnNames, const String* in_notes, const double* in_timestamp, const Inspector::InspectorObject* in_values, const Inspector::InspectorValue* in_payload, const int* in_databaseId, const Inspector::InspectorObject* in_sqlError, const String* in_screenColor, const Inspector::InspectorArray* in_alternateColors, const String* in_printColor)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^(NSArray/*<NSString>*/ **columnNames, NSString **notes, double *timestamp, RWIProtocolJSONObject **values, RWIProtocolJSONObject **payload, int *databaseId, TestProtocolDatabaseError **sqlError, TestProtocolDatabasePrimaryColors *screenColor, NSArray/*<NSString>*/ **alternateColors, TestProtocolDatabaseExecuteAllOptionalParametersPrintColor *printColor) {
+        Ref<InspectorObject> resultObject = InspectorObject::create();
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(columnNames, @"columnNames");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(notes, @"notes");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(values, @"values");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(payload, @"payload");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(sqlError, @"sqlError");
+        THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(alternateColors, @"alternateColors");
+        if (columnNames)
+            resultObject->setArray(ASCIILiteral("columnNames"), inspectorStringArray(*columnNames));
+        if (notes)
+            resultObject->setString(ASCIILiteral("notes"), *notes);
+        if (timestamp)
+            resultObject->setDouble(ASCIILiteral("timestamp"), *timestamp);
+        if (values)
+            resultObject->setObject(ASCIILiteral("values"), [*values toInspectorObject]);
+        if (payload)
+            resultObject->setValue(ASCIILiteral("payload"), [*payload toInspectorObject]);
+        if (databaseId)
+            resultObject->setInteger(ASCIILiteral("databaseId"), *databaseId);
+        if (sqlError)
+            resultObject->setObject(ASCIILiteral("sqlError"), [*sqlError toInspectorObject]);
+        if (screenColor)
+            resultObject->setString(ASCIILiteral("screenColor"), toProtocolString(*screenColor));
+        if (alternateColors)
+            resultObject->setArray(ASCIILiteral("alternateColors"), inspectorStringArray(*alternateColors));
+        if (printColor)
+            resultObject->setString(ASCIILiteral("printColor"), toProtocolString(*printColor));
+        backendDispatcher()->sendResponse(requestId, WTFMove(resultObject));
+    };
+
+    NSArray/*<NSString>*/ *o_in_columnNames;
+    if (in_columnNames)
+        o_in_columnNames = objcStringArray(in_columnNames);
+    NSString *o_in_notes;
+    if (in_notes)
+        o_in_notes = *in_notes;
+    double o_in_timestamp;
+    if (in_timestamp)
+        o_in_timestamp = *in_timestamp;
+    RWIProtocolJSONObject *o_in_values;
+    if (in_values)
+        o_in_values = [[[RWIProtocolJSONObject alloc] initWithInspectorObject:in_values] autorelease];
+    RWIProtocolJSONObject *o_in_payload;
+    if (in_payload)
+        o_in_payload = [[[RWIProtocolJSONObject alloc] initWithInspectorObject:in_payload] autorelease];
+    int o_in_databaseId;
+    if (in_databaseId)
+        o_in_databaseId = *in_databaseId;
+    TestProtocolDatabaseError *o_in_sqlError;
+    if (in_sqlError)
+        o_in_sqlError = [[[TestProtocolDatabaseError alloc] initWithInspectorObject:in_sqlError] autorelease];
+    TestProtocolDatabasePrimaryColors o_in_screenColor;
+    if (in_screenColor)
+        o_in_screenColor = fromProtocolString<TestProtocolDatabasePrimaryColors>(*in_screenColor);
+    NSArray/*<NSString>*/ *o_in_alternateColors;
+    if (in_alternateColors)
+        o_in_alternateColors = objcStringArray(in_alternateColors);
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColor o_in_printColor;
+    if (in_printColor)
+        o_in_printColor = fromProtocolString<TestProtocolDatabaseExecuteAllOptionalParametersPrintColor>(*in_printColor);
+
+    [m_delegate executeAllOptionalParametersWithErrorCallback:errorCallback successCallback:successCallback columnNames:(in_columnNames ? &o_in_columnNames : nil) notes:(in_notes ? &o_in_notes : nil) timestamp:(in_timestamp ? &o_in_timestamp : nil) values:(in_values ? &o_in_values : nil) payload:(in_payload ? &o_in_payload : nil) databaseId:(in_databaseId ? &o_in_databaseId : nil) sqlError:(in_sqlError ? &o_in_sqlError : nil) screenColor:(in_screenColor ? &o_in_screenColor : nil) alternateColors:(in_alternateColors ? &o_in_alternateColors : nil) printColor:(in_printColor ? &o_in_printColor : nil)];
+}
+
+void ObjCInspectorDatabaseBackendDispatcher::executeNoOptionalParameters(long requestId, const Inspector::InspectorArray& in_columnNames, const String& in_notes, double in_timestamp, const Inspector::InspectorObject& in_values, Inspector::InspectorValue in_payload, int in_databaseId, const Inspector::InspectorObject& in_sqlError, const String& in_screenColor, const Inspector::InspectorArray& in_alternateColors, const String& in_printColor)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^(NSArray/*<NSString>*/ *columnNames, NSString *notes, double timestamp, RWIProtocolJSONObject *values, RWIProtocolJSONObject *payload, int databaseId, TestProtocolDatabaseError *sqlError, TestProtocolDatabasePrimaryColors screenColor, NSArray/*<NSString>*/ *alternateColors, TestProtocolDatabaseExecuteNoOptionalParametersPrintColor printColor) {
+        Ref<InspectorObject> resultObject = InspectorObject::create();
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(columnNames, @"columnNames");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(notes, @"notes");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(values, @"values");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(payload, @"payload");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(sqlError, @"sqlError");
+        THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(alternateColors, @"alternateColors");
+        resultObject->setArray(ASCIILiteral("columnNames"), inspectorStringArray(columnNames));
+        resultObject->setString(ASCIILiteral("notes"), notes);
+        resultObject->setDouble(ASCIILiteral("timestamp"), timestamp);
+        resultObject->setObject(ASCIILiteral("values"), [values toInspectorObject]);
+        resultObject->setValue(ASCIILiteral("payload"), [payload toInspectorObject]);
+        resultObject->setInteger(ASCIILiteral("databaseId"), databaseId);
+        resultObject->setObject(ASCIILiteral("sqlError"), [sqlError toInspectorObject]);
+        resultObject->setString(ASCIILiteral("screenColor"), toProtocolString(screenColor));
+        resultObject->setArray(ASCIILiteral("alternateColors"), inspectorStringArray(alternateColors));
+        resultObject->setString(ASCIILiteral("printColor"), toProtocolString(printColor));
+        backendDispatcher()->sendResponse(requestId, WTFMove(resultObject));
+    };
+
+    NSArray/*<NSString>*/ *o_in_columnNames = objcStringArray(&in_columnNames);
+    NSString *o_in_notes = in_notes;
+    double o_in_timestamp = in_timestamp;
+    RWIProtocolJSONObject *o_in_values = [[[RWIProtocolJSONObject alloc] initWithInspectorObject:&in_values] autorelease];
+    RWIProtocolJSONObject *o_in_payload = [[[RWIProtocolJSONObject alloc] initWithInspectorObject:&in_payload] autorelease];
+    int o_in_databaseId = in_databaseId;
+    TestProtocolDatabaseError *o_in_sqlError = [[[TestProtocolDatabaseError alloc] initWithInspectorObject:&in_sqlError] autorelease];
+    TestProtocolDatabasePrimaryColors o_in_screenColor = fromProtocolString<TestProtocolDatabasePrimaryColors>(in_screenColor);
+    NSArray/*<NSString>*/ *o_in_alternateColors = objcStringArray(&in_alternateColors);
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColor o_in_printColor = fromProtocolString<TestProtocolDatabaseExecuteNoOptionalParametersPrintColor>(in_printColor);
+
+    [m_delegate executeNoOptionalParametersWithErrorCallback:errorCallback successCallback:successCallback columnNames:o_in_columnNames notes:o_in_notes timestamp:o_in_timestamp values:o_in_values payload:o_in_payload databaseId:o_in_databaseId sqlError:o_in_sqlError screenColor:o_in_screenColor alternateColors:o_in_alternateColors printColor:o_in_printColor];
+}
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+@class TestProtocolDatabaseError;
+
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabasePrimaryColors) {
+    TestProtocolDatabasePrimaryColorsRed,
+    TestProtocolDatabasePrimaryColorsGreen,
+    TestProtocolDatabasePrimaryColorsBlue,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabaseExecuteAllOptionalParametersPrintColor) {
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColorCyan,
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColorMagenta,
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColorYellow,
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColorBlack,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabaseExecuteAllOptionalParametersPrintColor) {
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColorCyan,
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColorMagenta,
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColorYellow,
+    TestProtocolDatabaseExecuteAllOptionalParametersPrintColorBlack,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabaseExecuteNoOptionalParametersPrintColor) {
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColorCyan,
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColorMagenta,
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColorYellow,
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColorBlack,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolDatabaseExecuteNoOptionalParametersPrintColor) {
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColorCyan,
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColorMagenta,
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColorYellow,
+    TestProtocolDatabaseExecuteNoOptionalParametersPrintColorBlack,
+};
+
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseError : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithMessage:(NSString *)message code:(int)code;
+/* required */ @property (nonatomic, copy) NSString *message;
+/* required */ @property (nonatomic, assign) int code;
+@end
+
+@protocol TestProtocolDatabaseDomainHandler <NSObject>
+@required
+- (void)executeAllOptionalParametersWithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)(NSArray/*<NSString>*/ **columnNames, NSString **notes, double *timestamp, RWIProtocolJSONObject **values, RWIProtocolJSONObject **payload, int *databaseId, TestProtocolDatabaseError **sqlError, TestProtocolDatabasePrimaryColors *screenColor, NSArray/*<NSString>*/ **alternateColors, TestProtocolDatabaseExecuteAllOptionalParametersPrintColor *printColor))successCallback columnNames:(NSArray/*<NSString>*/ **)columnNames notes:(NSString **)notes timestamp:(double *)timestamp values:(RWIProtocolJSONObject **)values payload:(RWIProtocolJSONObject **)payload databaseId:(int *)databaseId sqlError:(TestProtocolDatabaseError **)sqlError screenColor:(TestProtocolDatabasePrimaryColors *)screenColor alternateColors:(NSArray/*<NSString>*/ **)alternateColors printColor:(TestProtocolDatabaseExecuteAllOptionalParametersPrintColor *)printColor;
+- (void)executeNoOptionalParametersWithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)(NSArray/*<NSString>*/ *columnNames, NSString *notes, double timestamp, RWIProtocolJSONObject *values, RWIProtocolJSONObject *payload, int databaseId, TestProtocolDatabaseError *sqlError, TestProtocolDatabasePrimaryColors screenColor, NSArray/*<NSString>*/ *alternateColors, TestProtocolDatabaseExecuteNoOptionalParametersPrintColor printColor))successCallback columnNames:(NSArray/*<NSString>*/ *)columnNames notes:(NSString *)notes timestamp:(double)timestamp values:(RWIProtocolJSONObject *)values payload:(RWIProtocolJSONObject *)payload databaseId:(int)databaseId sqlError:(TestProtocolDatabaseError *)sqlError screenColor:(TestProtocolDatabasePrimaryColors)screenColor alternateColors:(NSArray/*<NSString>*/ *)alternateColors printColor:(TestProtocolDatabaseExecuteNoOptionalParametersPrintColor)printColor;
+@end
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+inline String toProtocolString(TestProtocolDatabasePrimaryColors value)
+{
+    switch(value) {
+    case TestProtocolDatabasePrimaryColorsRed:
+        return ASCIILiteral("red");
+    case TestProtocolDatabasePrimaryColorsGreen:
+        return ASCIILiteral("green");
+    case TestProtocolDatabasePrimaryColorsBlue:
+        return ASCIILiteral("blue");
+    }
+}
+
+template<>
+inline TestProtocolDatabasePrimaryColors fromProtocolString(const String& value)
+{
+    if (value == "red")
+        return TestProtocolDatabasePrimaryColorsRed;
+    if (value == "green")
+        return TestProtocolDatabasePrimaryColorsGreen;
+    if (value == "blue")
+        return TestProtocolDatabasePrimaryColorsBlue;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabasePrimaryColorsRed;
+}
+
+inline String toProtocolString(TestProtocolDatabaseExecuteAllOptionalParametersPrintColor value)
+{
+    switch(value) {
+    case TestProtocolDatabaseExecuteAllOptionalParametersPrintColorCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolDatabaseExecuteAllOptionalParametersPrintColorMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolDatabaseExecuteAllOptionalParametersPrintColorYellow:
+        return ASCIILiteral("yellow");
+    case TestProtocolDatabaseExecuteAllOptionalParametersPrintColorBlack:
+        return ASCIILiteral("black");
+    }
+}
+
+template<>
+inline TestProtocolDatabaseExecuteAllOptionalParametersPrintColor fromProtocolString(const String& value)
+{
+    if (value == "cyan")
+        return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorCyan;
+    if (value == "magenta")
+        return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorMagenta;
+    if (value == "yellow")
+        return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorYellow;
+    if (value == "black")
+        return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorBlack;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorCyan;
+}
+
+inline String toProtocolString(TestProtocolDatabaseExecuteAllOptionalParametersPrintColor value)
+{
+    switch(value) {
+    case TestProtocolDatabaseExecuteAllOptionalParametersPrintColorCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolDatabaseExecuteAllOptionalParametersPrintColorMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolDatabaseExecuteAllOptionalParametersPrintColorYellow:
+        return ASCIILiteral("yellow");
+    case TestProtocolDatabaseExecuteAllOptionalParametersPrintColorBlack:
+        return ASCIILiteral("black");
+    }
+}
+
+template<>
+inline TestProtocolDatabaseExecuteAllOptionalParametersPrintColor fromProtocolString(const String& value)
+{
+    if (value == "cyan")
+        return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorCyan;
+    if (value == "magenta")
+        return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorMagenta;
+    if (value == "yellow")
+        return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorYellow;
+    if (value == "black")
+        return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorBlack;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabaseExecuteAllOptionalParametersPrintColorCyan;
+}
+
+inline String toProtocolString(TestProtocolDatabaseExecuteNoOptionalParametersPrintColor value)
+{
+    switch(value) {
+    case TestProtocolDatabaseExecuteNoOptionalParametersPrintColorCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolDatabaseExecuteNoOptionalParametersPrintColorMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolDatabaseExecuteNoOptionalParametersPrintColorYellow:
+        return ASCIILiteral("yellow");
+    case TestProtocolDatabaseExecuteNoOptionalParametersPrintColorBlack:
+        return ASCIILiteral("black");
+    }
+}
+
+template<>
+inline TestProtocolDatabaseExecuteNoOptionalParametersPrintColor fromProtocolString(const String& value)
+{
+    if (value == "cyan")
+        return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorCyan;
+    if (value == "magenta")
+        return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorMagenta;
+    if (value == "yellow")
+        return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorYellow;
+    if (value == "black")
+        return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorBlack;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorCyan;
+}
+
+inline String toProtocolString(TestProtocolDatabaseExecuteNoOptionalParametersPrintColor value)
+{
+    switch(value) {
+    case TestProtocolDatabaseExecuteNoOptionalParametersPrintColorCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolDatabaseExecuteNoOptionalParametersPrintColorMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolDatabaseExecuteNoOptionalParametersPrintColorYellow:
+        return ASCIILiteral("yellow");
+    case TestProtocolDatabaseExecuteNoOptionalParametersPrintColorBlack:
+        return ASCIILiteral("black");
+    }
+}
+
+template<>
+inline TestProtocolDatabaseExecuteNoOptionalParametersPrintColor fromProtocolString(const String& value)
+{
+    if (value == "cyan")
+        return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorCyan;
+    if (value == "magenta")
+        return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorMagenta;
+    if (value == "yellow")
+        return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorYellow;
+    if (value == "black")
+        return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorBlack;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDatabaseExecuteNoOptionalParametersPrintColorCyan;
+}
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (DatabaseDomain)
+
++ (void)_parseDatabaseId:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parsePrimaryColors:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseColorList:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload;
++ (void)_parseError:(TestProtocolDatabaseError **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (DatabaseDomain)
+
++ (void)_parseDatabaseId:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSNumber class]);
+    *outValue = (NSNumber *)payload;
+}
+
++ (void)_parsePrimaryColors:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = @(Inspector::fromProtocolString<TestProtocolDatabasePrimaryColors>(payload));
+}
+
++ (void)_parseColorList:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<NSString>*/ class]);
+    *outValue = (NSArray/*<NSString>*/ *)payload;
+}
+
++ (void)_parseError:(TestProtocolDatabaseError **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolDatabaseError alloc] initWithPayload:payload];
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from commands-with-optional-call-return-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+@implementation TestProtocolDatabaseError
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"message"], @"message");
+    self.message = payload[@"message"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"code"], @"code");
+    self.code = [payload[@"code"] integerValue];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithMessage:(NSString *)message code:(int)code
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(message, @"message");
+
+    self.message = message;
+    self.code = code;
+
+    return self;
+}
+
+- (void)setMessage:(NSString *)message
+{
+    [super setString:message forKey:@"message"];
+}
+
+- (NSString *)message
+{
+    return [super stringForKey:@"message"];
+}
+
+- (void)setCode:(int)code
+{
+    [super setInteger:code forKey:@"code"];
+}
+
+- (int)code
+{
+    return [super integerForKey:@"code"];
+}
+
+@end
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result b/inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result
new file mode 100644
index 0000000..98e1ce6
--- /dev/null
+++ b/inspector/scripts/tests/expected/domains-with-varying-command-sizes.json-result
@@ -0,0 +1,1398 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// Network1.
+InspectorBackend.registerCommand("Network1.loadResource1", [], []);
+InspectorBackend.activateDomain("Network1");
+
+// Network3.
+InspectorBackend.registerCommand("Network3.loadResource1", [], []);
+InspectorBackend.registerCommand("Network3.loadResource2", [], []);
+InspectorBackend.registerCommand("Network3.loadResource3", [], []);
+InspectorBackend.registerCommand("Network3.loadResource4", [], []);
+InspectorBackend.registerCommand("Network3.loadResource5", [], []);
+InspectorBackend.registerCommand("Network3.loadResource6", [], []);
+InspectorBackend.registerCommand("Network3.loadResource7", [], []);
+InspectorBackend.activateDomain("Network3");
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+class AlternateNetwork1BackendDispatcher : public AlternateBackendDispatcher {
+public:
+    virtual ~AlternateNetwork1BackendDispatcher() { }
+    virtual void loadResource1(long callId) = 0;
+};
+class AlternateNetwork3BackendDispatcher : public AlternateBackendDispatcher {
+public:
+    virtual ~AlternateNetwork3BackendDispatcher() { }
+    virtual void loadResource1(long callId) = 0;
+    virtual void loadResource2(long callId) = 0;
+    virtual void loadResource3(long callId) = 0;
+    virtual void loadResource4(long callId) = 0;
+    virtual void loadResource5(long callId) = 0;
+    virtual void loadResource6(long callId) = 0;
+    virtual void loadResource7(long callId) = 0;
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+class AlternateNetwork1BackendDispatcher;
+class AlternateNetwork3BackendDispatcher;
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+class Network1BackendDispatcherHandler {
+public:
+    virtual void loadResource1(ErrorString&) = 0;
+protected:
+    virtual ~Network1BackendDispatcherHandler();
+};
+
+class Network3BackendDispatcherHandler {
+public:
+    virtual void loadResource1(ErrorString&) = 0;
+    virtual void loadResource2(ErrorString&) = 0;
+    virtual void loadResource3(ErrorString&) = 0;
+    virtual void loadResource4(ErrorString&) = 0;
+    virtual void loadResource5(ErrorString&) = 0;
+    virtual void loadResource6(ErrorString&) = 0;
+    virtual void loadResource7(ErrorString&) = 0;
+protected:
+    virtual ~Network3BackendDispatcherHandler();
+};
+
+class Network1BackendDispatcher final : public SupplementalBackendDispatcher {
+public:
+    static Ref<Network1BackendDispatcher> create(BackendDispatcher&, Network1BackendDispatcherHandler*);
+    void dispatch(long requestId, const String& method, Ref<InspectorObject>&& message) override;
+private:
+    void loadResource1(long requestId, RefPtr<InspectorObject>&& parameters);
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+public:
+    void setAlternateDispatcher(AlternateNetwork1BackendDispatcher* alternateDispatcher) { m_alternateDispatcher = alternateDispatcher; }
+private:
+    AlternateNetwork1BackendDispatcher* m_alternateDispatcher { nullptr };
+#endif
+private:
+    Network1BackendDispatcher(BackendDispatcher&, Network1BackendDispatcherHandler*);
+    Network1BackendDispatcherHandler* m_agent { nullptr };
+};
+
+class Network3BackendDispatcher final : public SupplementalBackendDispatcher {
+public:
+    static Ref<Network3BackendDispatcher> create(BackendDispatcher&, Network3BackendDispatcherHandler*);
+    void dispatch(long requestId, const String& method, Ref<InspectorObject>&& message) override;
+private:
+    void loadResource1(long requestId, RefPtr<InspectorObject>&& parameters);
+    void loadResource2(long requestId, RefPtr<InspectorObject>&& parameters);
+    void loadResource3(long requestId, RefPtr<InspectorObject>&& parameters);
+    void loadResource4(long requestId, RefPtr<InspectorObject>&& parameters);
+    void loadResource5(long requestId, RefPtr<InspectorObject>&& parameters);
+    void loadResource6(long requestId, RefPtr<InspectorObject>&& parameters);
+    void loadResource7(long requestId, RefPtr<InspectorObject>&& parameters);
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+public:
+    void setAlternateDispatcher(AlternateNetwork3BackendDispatcher* alternateDispatcher) { m_alternateDispatcher = alternateDispatcher; }
+private:
+    AlternateNetwork3BackendDispatcher* m_alternateDispatcher { nullptr };
+#endif
+private:
+    Network3BackendDispatcher(BackendDispatcher&, Network3BackendDispatcherHandler*);
+    Network3BackendDispatcherHandler* m_agent { nullptr };
+};
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+Network1BackendDispatcherHandler::~Network1BackendDispatcherHandler() { }
+Network3BackendDispatcherHandler::~Network3BackendDispatcherHandler() { }
+
+Ref<Network1BackendDispatcher> Network1BackendDispatcher::create(BackendDispatcher& backendDispatcher, Network1BackendDispatcherHandler* agent)
+{
+    return adoptRef(*new Network1BackendDispatcher(backendDispatcher, agent));
+}
+
+Network1BackendDispatcher::Network1BackendDispatcher(BackendDispatcher& backendDispatcher, Network1BackendDispatcherHandler* agent)
+    : SupplementalBackendDispatcher(backendDispatcher)
+    , m_agent(agent)
+{
+    m_backendDispatcher->registerDispatcherForDomain(ASCIILiteral("Network1"), this);
+}
+
+void Network1BackendDispatcher::dispatch(long requestId, const String& method, Ref<InspectorObject>&& message)
+{
+    Ref<Network1BackendDispatcher> protect(*this);
+
+    RefPtr<InspectorObject> parameters;
+    message->getObject(ASCIILiteral("params"), parameters);
+
+    if (method == "loadResource1")
+        loadResource1(requestId, WTFMove(parameters));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::MethodNotFound, makeString('\'', "Network1", '.', method, "' was not found"));
+}
+
+void Network1BackendDispatcher::loadResource1(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource1(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource1(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+Ref<Network3BackendDispatcher> Network3BackendDispatcher::create(BackendDispatcher& backendDispatcher, Network3BackendDispatcherHandler* agent)
+{
+    return adoptRef(*new Network3BackendDispatcher(backendDispatcher, agent));
+}
+
+Network3BackendDispatcher::Network3BackendDispatcher(BackendDispatcher& backendDispatcher, Network3BackendDispatcherHandler* agent)
+    : SupplementalBackendDispatcher(backendDispatcher)
+    , m_agent(agent)
+{
+    m_backendDispatcher->registerDispatcherForDomain(ASCIILiteral("Network3"), this);
+}
+
+void Network3BackendDispatcher::dispatch(long requestId, const String& method, Ref<InspectorObject>&& message)
+{
+    Ref<Network3BackendDispatcher> protect(*this);
+
+    RefPtr<InspectorObject> parameters;
+    message->getObject(ASCIILiteral("params"), parameters);
+
+    typedef void (Network3BackendDispatcher::*CallHandler)(long requestId, RefPtr<InspectorObject>&& message);
+    typedef HashMap<String, CallHandler> DispatchMap;
+    static NeverDestroyed<DispatchMap> dispatchMap;
+    if (dispatchMap.get().isEmpty()) {
+        static const struct MethodTable {
+            const char* name;
+            CallHandler handler;
+        } commands[] = {
+            { "loadResource1", &Network3BackendDispatcher::loadResource1 },
+            { "loadResource2", &Network3BackendDispatcher::loadResource2 },
+            { "loadResource3", &Network3BackendDispatcher::loadResource3 },
+            { "loadResource4", &Network3BackendDispatcher::loadResource4 },
+            { "loadResource5", &Network3BackendDispatcher::loadResource5 },
+            { "loadResource6", &Network3BackendDispatcher::loadResource6 },
+            { "loadResource7", &Network3BackendDispatcher::loadResource7 },
+        };
+        size_t length = WTF_ARRAY_LENGTH(commands);
+        for (size_t i = 0; i < length; ++i)
+            dispatchMap.get().add(commands[i].name, commands[i].handler);
+    }
+
+    auto findResult = dispatchMap.get().find(method);
+    if (findResult == dispatchMap.get().end()) {
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::MethodNotFound, makeString('\'', "Network3", '.', method, "' was not found"));
+        return;
+    }
+
+    ((*this).*findResult->value)(requestId, WTFMove(parameters));
+}
+
+void Network3BackendDispatcher::loadResource1(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource1(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource1(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+void Network3BackendDispatcher::loadResource2(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource2(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource2(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+void Network3BackendDispatcher::loadResource3(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource3(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource3(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+void Network3BackendDispatcher::loadResource4(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource4(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource4(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+void Network3BackendDispatcher::loadResource5(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource5(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource5(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+void Network3BackendDispatcher::loadResource6(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource6(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource6(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+void Network3BackendDispatcher::loadResource7(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource7(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource7(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+
+
+// Typedefs.
+namespace Network2 {
+/* Unique loader identifier. */
+typedef String LoaderId;
+} // Network2
+// End of typedefs.
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+@protocol TestProtocolNetwork1DomainHandler;
+@protocol TestProtocolNetwork3DomainHandler;
+
+namespace Inspector {
+
+
+class ObjCInspectorNetwork1BackendDispatcher final : public AlternateNetwork1BackendDispatcher {
+public:
+    ObjCInspectorNetwork1BackendDispatcher(id<TestProtocolNetwork1DomainHandler> handler) { m_delegate = handler; }
+    virtual void loadResource1(long requestId) override;
+private:
+    RetainPtr<id<TestProtocolNetwork1DomainHandler>> m_delegate;
+};
+
+
+
+class ObjCInspectorNetwork3BackendDispatcher final : public AlternateNetwork3BackendDispatcher {
+public:
+    ObjCInspectorNetwork3BackendDispatcher(id<TestProtocolNetwork3DomainHandler> handler) { m_delegate = handler; }
+    virtual void loadResource1(long requestId) override;
+    virtual void loadResource2(long requestId) override;
+    virtual void loadResource3(long requestId) override;
+    virtual void loadResource4(long requestId) override;
+    virtual void loadResource5(long requestId) override;
+    virtual void loadResource6(long requestId) override;
+    virtual void loadResource7(long requestId) override;
+private:
+    RetainPtr<id<TestProtocolNetwork3DomainHandler>> m_delegate;
+};
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+    id<TestProtocolNetwork1DomainHandler> _network1Handler;
+    id<TestProtocolNetwork3DomainHandler> _network3Handler;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [_network1Handler release];
+    [_network3Handler release];
+    [super dealloc];
+}
+
+- (void)setNetwork1Handler:(id<TestProtocolNetwork1DomainHandler>)handler
+{
+    if (handler == _network1Handler)
+        return;
+
+    [_network1Handler release];
+    _network1Handler = [handler retain];
+
+    auto alternateDispatcher = std::make_unique<ObjCInspectorNetwork1BackendDispatcher>(handler);
+    auto alternateAgent = std::make_unique<AlternateDispatchableAgent<Network1BackendDispatcher, AlternateNetwork1BackendDispatcher>>(ASCIILiteral("Network1"), *_controller, WTFMove(alternateDispatcher));
+    _controller->appendExtraAgent(WTFMove(alternateAgent));
+}
+
+- (id<TestProtocolNetwork1DomainHandler>)network1Handler
+{
+    return _network1Handler;
+}
+
+- (void)setNetwork3Handler:(id<TestProtocolNetwork3DomainHandler>)handler
+{
+    if (handler == _network3Handler)
+        return;
+
+    [_network3Handler release];
+    _network3Handler = [handler retain];
+
+    auto alternateDispatcher = std::make_unique<ObjCInspectorNetwork3BackendDispatcher>(handler);
+    auto alternateAgent = std::make_unique<AlternateDispatchableAgent<Network3BackendDispatcher, AlternateNetwork3BackendDispatcher>>(ASCIILiteral("Network3"), *_controller, WTFMove(alternateDispatcher));
+    _controller->appendExtraAgent(WTFMove(alternateAgent));
+}
+
+- (id<TestProtocolNetwork3DomainHandler>)network3Handler
+{
+    return _network3Handler;
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@property (nonatomic, retain, setter=setNetwork1Handler:) id<TestProtocolNetwork1DomainHandler> network1Handler;
+@property (nonatomic, retain, setter=setNetwork3Handler:) id<TestProtocolNetwork3DomainHandler> network3Handler;
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+void ObjCInspectorNetwork1BackendDispatcher::loadResource1(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResource1WithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+
+
+
+void ObjCInspectorNetwork3BackendDispatcher::loadResource1(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResource1WithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+void ObjCInspectorNetwork3BackendDispatcher::loadResource2(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResource2WithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+void ObjCInspectorNetwork3BackendDispatcher::loadResource3(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResource3WithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+void ObjCInspectorNetwork3BackendDispatcher::loadResource4(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResource4WithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+void ObjCInspectorNetwork3BackendDispatcher::loadResource5(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResource5WithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+void ObjCInspectorNetwork3BackendDispatcher::loadResource6(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResource6WithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+void ObjCInspectorNetwork3BackendDispatcher::loadResource7(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResource7WithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+
+
+
+
+
+
+@protocol TestProtocolNetwork1DomainHandler <NSObject>
+@required
+- (void)loadResource1WithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+@end
+
+@protocol TestProtocolNetwork3DomainHandler <NSObject>
+@required
+- (void)loadResource1WithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+- (void)loadResource2WithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+- (void)loadResource3WithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+- (void)loadResource4WithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+- (void)loadResource5WithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+- (void)loadResource6WithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+- (void)loadResource7WithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+@end
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (Network1Domain)
+
+@end
+@interface TestProtocolTypeConversions (Network2Domain)
+
++ (void)_parseLoaderId:(NSString **)outValue fromPayload:(id)payload;
+
+@end
+@interface TestProtocolTypeConversions (Network3Domain)
+
+@end
+
+@implementation TestProtocolTypeConversions (Network1Domain)
+
+@end
+@implementation TestProtocolTypeConversions (Network2Domain)
+
++ (void)_parseLoaderId:(NSString **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = (NSString *)payload;
+}
+
+@end
+@implementation TestProtocolTypeConversions (Network3Domain)
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from domains-with-varying-command-sizes.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+
+
+
+
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/enum-values.json-result b/inspector/scripts/tests/expected/enum-values.json-result
new file mode 100644
index 0000000..fa0553c
--- /dev/null
+++ b/inspector/scripts/tests/expected/enum-values.json-result
@@ -0,0 +1,1273 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// TypeDomain.
+InspectorBackend.registerEnum("TypeDomain.TypeDomainEnum", {Shared: "shared", Red: "red", Green: "green", Blue: "blue"});
+
+// CommandDomain.
+InspectorBackend.registerCommand("CommandDomain.commandWithEnumReturnValue", [], ["returnValue"]);
+InspectorBackend.activateDomain("CommandDomain");
+
+// EventDomain.
+InspectorBackend.registerEventDomainDispatcher = InspectorBackend.registerDomainDispatcher.bind(InspectorBackend, "EventDomain");
+InspectorBackend.registerEnum("EventDomain.EventWithEnumParameterParameter", {Shared: "shared", Black: "black", White: "white"});
+InspectorBackend.registerEvent("EventDomain.eventWithEnumParameter", ["parameter"]);
+InspectorBackend.activateDomain("EventDomain");
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+class AlternateCommandDomainBackendDispatcher : public AlternateBackendDispatcher {
+public:
+    virtual ~AlternateCommandDomainBackendDispatcher() { }
+    virtual void commandWithEnumReturnValue(long callId) = 0;
+};
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+class AlternateCommandDomainBackendDispatcher;
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+class CommandDomainBackendDispatcherHandler {
+public:
+    // Named after parameter 'returnValue' while generating command/event commandWithEnumReturnValue.
+    enum class ReturnValue {
+        Shared = 0,
+        Cyan = 6,
+        Magenta = 7,
+        Yellow = 8,
+    }; // enum class ReturnValue
+    virtual void commandWithEnumReturnValue(ErrorString&, CommandDomainBackendDispatcherHandler::ReturnValue* out_returnValue) = 0;
+protected:
+    virtual ~CommandDomainBackendDispatcherHandler();
+};
+
+class CommandDomainBackendDispatcher final : public SupplementalBackendDispatcher {
+public:
+    static Ref<CommandDomainBackendDispatcher> create(BackendDispatcher&, CommandDomainBackendDispatcherHandler*);
+    void dispatch(long requestId, const String& method, Ref<InspectorObject>&& message) override;
+private:
+    void commandWithEnumReturnValue(long requestId, RefPtr<InspectorObject>&& parameters);
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+public:
+    void setAlternateDispatcher(AlternateCommandDomainBackendDispatcher* alternateDispatcher) { m_alternateDispatcher = alternateDispatcher; }
+private:
+    AlternateCommandDomainBackendDispatcher* m_alternateDispatcher { nullptr };
+#endif
+private:
+    CommandDomainBackendDispatcher(BackendDispatcher&, CommandDomainBackendDispatcherHandler*);
+    CommandDomainBackendDispatcherHandler* m_agent { nullptr };
+};
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+CommandDomainBackendDispatcherHandler::~CommandDomainBackendDispatcherHandler() { }
+
+Ref<CommandDomainBackendDispatcher> CommandDomainBackendDispatcher::create(BackendDispatcher& backendDispatcher, CommandDomainBackendDispatcherHandler* agent)
+{
+    return adoptRef(*new CommandDomainBackendDispatcher(backendDispatcher, agent));
+}
+
+CommandDomainBackendDispatcher::CommandDomainBackendDispatcher(BackendDispatcher& backendDispatcher, CommandDomainBackendDispatcherHandler* agent)
+    : SupplementalBackendDispatcher(backendDispatcher)
+    , m_agent(agent)
+{
+    m_backendDispatcher->registerDispatcherForDomain(ASCIILiteral("CommandDomain"), this);
+}
+
+void CommandDomainBackendDispatcher::dispatch(long requestId, const String& method, Ref<InspectorObject>&& message)
+{
+    Ref<CommandDomainBackendDispatcher> protect(*this);
+
+    RefPtr<InspectorObject> parameters;
+    message->getObject(ASCIILiteral("params"), parameters);
+
+    if (method == "commandWithEnumReturnValue")
+        commandWithEnumReturnValue(requestId, WTFMove(parameters));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::MethodNotFound, makeString('\'', "CommandDomain", '.', method, "' was not found"));
+}
+
+void CommandDomainBackendDispatcher::commandWithEnumReturnValue(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->commandWithEnumReturnValue(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    CommandDomainBackendDispatcherHandler::ReturnValue out_returnValue;
+    m_agent->commandWithEnumReturnValue(error, &out_returnValue);
+
+    if (!error.length())
+        result->setString(ASCIILiteral("returnValue"), Inspector::Protocol::TestHelpers::getEnumConstantValue(out_returnValue));
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+class EventDomainFrontendDispatcher {
+public:
+    EventDomainFrontendDispatcher(FrontendRouter& frontendRouter) : m_frontendRouter(frontendRouter) { }
+        // Named after parameter 'parameter' while generating command/event eventWithEnumParameter.
+        enum class Parameter {
+            Shared = 0,
+            Black = 4,
+            White = 5,
+        }; // enum class Parameter
+    void eventWithEnumParameter(Parameter parameter);
+private:
+    FrontendRouter& m_frontendRouter;
+};
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+void EventDomainFrontendDispatcher::eventWithEnumParameter(Parameter parameter)
+{
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("EventDomain.eventWithEnumParameter"));
+    Ref<InspectorObject> paramsObject = InspectorObject::create();
+    paramsObject->setString(ASCIILiteral("parameter"), Inspector::Protocol::TestHelpers::getEnumConstantValue(parameter));
+    jsonMessage->setObject(ASCIILiteral("params"), WTFMove(paramsObject));
+
+    m_frontendRouter.sendEvent(jsonMessage->toJSONString());
+}
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace TypeDomain {
+enum class TypeDomainEnum;
+} // TypeDomain
+// End of forward declarations.
+
+
+
+
+namespace TestHelpers {
+
+String getEnumConstantValue(int code);
+
+template<typename T> String getEnumConstantValue(T enumValue)
+{
+    return getEnumConstantValue(static_cast<int>(enumValue));
+}
+
+} // namespace TestHelpers
+
+namespace TypeDomain {
+/*  */
+enum class TypeDomainEnum {
+    Shared = 0,
+    Red = 1,
+    Green = 2,
+    Blue = 3,
+}; // enum class TypeDomainEnum
+} // TypeDomain
+
+
+
+namespace TestHelpers {
+
+template<typename ProtocolEnumType>
+std::optional<ProtocolEnumType> parseEnumValueFromString(const String&);
+
+// Enums in the 'TypeDomain' Domain
+template<>
+std::optional<Inspector::Protocol::TypeDomain::TypeDomainEnum> parseEnumValueFromString<Inspector::Protocol::TypeDomain::TypeDomainEnum>(const String&);
+
+} // namespace TestHelpers
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+namespace TestHelpers {
+
+static const char* const enum_constant_values[] = {
+    "shared",
+    "red",
+    "green",
+    "blue",
+    "black",
+    "white",
+    "cyan",
+    "magenta",
+    "yellow",
+};
+
+String getEnumConstantValue(int code) {
+    return enum_constant_values[code];
+}
+
+// Enums in the 'TypeDomain' Domain
+template<>
+std::optional<Inspector::Protocol::TypeDomain::TypeDomainEnum> parseEnumValueFromString<Inspector::Protocol::TypeDomain::TypeDomainEnum>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::TypeDomain::TypeDomainEnum::Shared,
+        (size_t)Inspector::Protocol::TypeDomain::TypeDomainEnum::Red,
+        (size_t)Inspector::Protocol::TypeDomain::TypeDomainEnum::Green,
+        (size_t)Inspector::Protocol::TypeDomain::TypeDomainEnum::Blue,
+    };
+    for (size_t i = 0; i < 4; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::TypeDomain::TypeDomainEnum)constantValues[i];
+
+    return std::nullopt;
+}
+
+
+} // namespace TestHelpers
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+@protocol TestProtocolCommandDomainDomainHandler;
+
+namespace Inspector {
+
+
+
+
+class ObjCInspectorCommandDomainBackendDispatcher final : public AlternateCommandDomainBackendDispatcher {
+public:
+    ObjCInspectorCommandDomainBackendDispatcher(id<TestProtocolCommandDomainDomainHandler> handler) { m_delegate = handler; }
+    virtual void commandWithEnumReturnValue(long requestId) override;
+private:
+    RetainPtr<id<TestProtocolCommandDomainDomainHandler>> m_delegate;
+};
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+    id<TestProtocolCommandDomainDomainHandler> _commandDomainHandler;
+    TestProtocolEventDomainDomainEventDispatcher *_eventDomainEventDispatcher;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [_commandDomainHandler release];
+    [_eventDomainEventDispatcher release];
+    [super dealloc];
+}
+
+- (void)setCommandDomainHandler:(id<TestProtocolCommandDomainDomainHandler>)handler
+{
+    if (handler == _commandDomainHandler)
+        return;
+
+    [_commandDomainHandler release];
+    _commandDomainHandler = [handler retain];
+
+    auto alternateDispatcher = std::make_unique<ObjCInspectorCommandDomainBackendDispatcher>(handler);
+    auto alternateAgent = std::make_unique<AlternateDispatchableAgent<CommandDomainBackendDispatcher, AlternateCommandDomainBackendDispatcher>>(ASCIILiteral("CommandDomain"), *_controller, WTFMove(alternateDispatcher));
+    _controller->appendExtraAgent(WTFMove(alternateAgent));
+}
+
+- (id<TestProtocolCommandDomainDomainHandler>)commandDomainHandler
+{
+    return _commandDomainHandler;
+}
+
+- (TestProtocolEventDomainDomainEventDispatcher *)eventDomainEventDispatcher
+{
+    if (!_eventDomainEventDispatcher)
+        _eventDomainEventDispatcher = [[TestProtocolEventDomainDomainEventDispatcher alloc] initWithController:_controller];
+    return _eventDomainEventDispatcher;
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@property (nonatomic, retain, setter=setCommandDomainHandler:) id<TestProtocolCommandDomainDomainHandler> commandDomainHandler;
+@property (nonatomic, readonly) TestProtocolEventDomainDomainEventDispatcher *eventDomainEventDispatcher;
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+void ObjCInspectorCommandDomainBackendDispatcher::commandWithEnumReturnValue(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^(TestProtocolCommandDomainCommandWithEnumReturnValueReturnValue returnValue) {
+        Ref<InspectorObject> resultObject = InspectorObject::create();
+        resultObject->setString(ASCIILiteral("returnValue"), toProtocolString(returnValue));
+        backendDispatcher()->sendResponse(requestId, WTFMove(resultObject));
+    };
+
+    [m_delegate commandWithEnumReturnValueWithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+
+@implementation TestProtocolEventDomainDomainEventDispatcher
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller;
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)eventWithEnumParameterWithParameter:(TestProtocolEventDomainEventWithEnumParameterParameter)parameter
+{
+    const FrontendRouter& router = _controller->frontendRouter();
+
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("EventDomain.eventWithEnumParameter"));
+    Ref<InspectorObject> paramsObject = InspectorObject::create();
+    paramsObject->setString(ASCIILiteral("parameter"), toProtocolString(parameter));
+    jsonMessage->setObject(ASCIILiteral("params"), WTFMove(paramsObject));
+    router.sendEvent(jsonMessage->toJSONString());
+}
+
+@end
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+
+
+
+typedef NS_ENUM(NSInteger, TestProtocolTypeDomainEnum) {
+    TestProtocolTypeDomainEnumShared,
+    TestProtocolTypeDomainEnumRed,
+    TestProtocolTypeDomainEnumGreen,
+    TestProtocolTypeDomainEnumBlue,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolCommandDomainCommandWithEnumReturnValueReturnValue) {
+    TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueShared,
+    TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueCyan,
+    TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueMagenta,
+    TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueYellow,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolEventDomainEventWithEnumParameterParameter) {
+    TestProtocolEventDomainEventWithEnumParameterParameterShared,
+    TestProtocolEventDomainEventWithEnumParameterParameterBlack,
+    TestProtocolEventDomainEventWithEnumParameterParameterWhite,
+};
+
+
+
+@protocol TestProtocolCommandDomainDomainHandler <NSObject>
+@required
+- (void)commandWithEnumReturnValueWithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)(TestProtocolCommandDomainCommandWithEnumReturnValueReturnValue returnValue))successCallback;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolEventDomainDomainEventDispatcher : NSObject
+- (void)eventWithEnumParameterWithParameter:(TestProtocolEventDomainEventWithEnumParameterParameter)parameter;
+@end
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+@interface TestProtocolEventDomainDomainEventDispatcher (Private)
+- (instancetype)initWithController:(Inspector::AugmentableInspectorController*)controller;
+@end
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+inline String toProtocolString(TestProtocolTypeDomainEnum value)
+{
+    switch(value) {
+    case TestProtocolTypeDomainEnumShared:
+        return ASCIILiteral("shared");
+    case TestProtocolTypeDomainEnumRed:
+        return ASCIILiteral("red");
+    case TestProtocolTypeDomainEnumGreen:
+        return ASCIILiteral("green");
+    case TestProtocolTypeDomainEnumBlue:
+        return ASCIILiteral("blue");
+    }
+}
+
+template<>
+inline TestProtocolTypeDomainEnum fromProtocolString(const String& value)
+{
+    if (value == "shared")
+        return TestProtocolTypeDomainEnumShared;
+    if (value == "red")
+        return TestProtocolTypeDomainEnumRed;
+    if (value == "green")
+        return TestProtocolTypeDomainEnumGreen;
+    if (value == "blue")
+        return TestProtocolTypeDomainEnumBlue;
+    ASSERT_NOT_REACHED();
+    return TestProtocolTypeDomainEnumShared;
+}
+
+
+inline String toProtocolString(TestProtocolCommandDomainCommandWithEnumReturnValueReturnValue value)
+{
+    switch(value) {
+    case TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueShared:
+        return ASCIILiteral("shared");
+    case TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueCyan:
+        return ASCIILiteral("cyan");
+    case TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueMagenta:
+        return ASCIILiteral("magenta");
+    case TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueYellow:
+        return ASCIILiteral("yellow");
+    }
+}
+
+template<>
+inline TestProtocolCommandDomainCommandWithEnumReturnValueReturnValue fromProtocolString(const String& value)
+{
+    if (value == "shared")
+        return TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueShared;
+    if (value == "cyan")
+        return TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueCyan;
+    if (value == "magenta")
+        return TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueMagenta;
+    if (value == "yellow")
+        return TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueYellow;
+    ASSERT_NOT_REACHED();
+    return TestProtocolCommandDomainCommandWithEnumReturnValueReturnValueShared;
+}
+
+
+inline String toProtocolString(TestProtocolEventDomainEventWithEnumParameterParameter value)
+{
+    switch(value) {
+    case TestProtocolEventDomainEventWithEnumParameterParameterShared:
+        return ASCIILiteral("shared");
+    case TestProtocolEventDomainEventWithEnumParameterParameterBlack:
+        return ASCIILiteral("black");
+    case TestProtocolEventDomainEventWithEnumParameterParameterWhite:
+        return ASCIILiteral("white");
+    }
+}
+
+template<>
+inline TestProtocolEventDomainEventWithEnumParameterParameter fromProtocolString(const String& value)
+{
+    if (value == "shared")
+        return TestProtocolEventDomainEventWithEnumParameterParameterShared;
+    if (value == "black")
+        return TestProtocolEventDomainEventWithEnumParameterParameterBlack;
+    if (value == "white")
+        return TestProtocolEventDomainEventWithEnumParameterParameterWhite;
+    ASSERT_NOT_REACHED();
+    return TestProtocolEventDomainEventWithEnumParameterParameterShared;
+}
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (TypeDomainDomain)
+
++ (void)_parseTypeDomainEnum:(NSNumber **)outValue fromPayload:(id)payload;
+
+@end
+@interface TestProtocolTypeConversions (CommandDomainDomain)
+
+@end
+@interface TestProtocolTypeConversions (EventDomainDomain)
+
+@end
+
+@implementation TestProtocolTypeConversions (TypeDomainDomain)
+
++ (void)_parseTypeDomainEnum:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = @(Inspector::fromProtocolString<TestProtocolTypeDomainEnum>(payload));
+}
+
+@end
+@implementation TestProtocolTypeConversions (CommandDomainDomain)
+
+@end
+@implementation TestProtocolTypeConversions (EventDomainDomain)
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from enum-values.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+
+
+
+
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/events-with-optional-parameters.json-result b/inspector/scripts/tests/expected/events-with-optional-parameters.json-result
new file mode 100644
index 0000000..c31d684
--- /dev/null
+++ b/inspector/scripts/tests/expected/events-with-optional-parameters.json-result
@@ -0,0 +1,1183 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// Database.
+InspectorBackend.registerDatabaseDispatcher = InspectorBackend.registerDomainDispatcher.bind(InspectorBackend, "Database");
+InspectorBackend.registerEvent("Database.didExecuteOptionalParameters", ["columnNames", "notes", "timestamp", "values", "payload", "sqlError", "screenColor", "alternateColors", "printColor"]);
+InspectorBackend.registerEvent("Database.didExecuteNoOptionalParameters", ["columnNames", "notes", "timestamp", "values", "payload", "sqlError", "screenColor", "alternateColors", "printColor"]);
+InspectorBackend.activateDomain("Database");
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+class DatabaseFrontendDispatcher {
+public:
+    DatabaseFrontendDispatcher(FrontendRouter& frontendRouter) : m_frontendRouter(frontendRouter) { }
+    void didExecuteOptionalParameters(RefPtr<Inspector::Protocol::Array<String>> columnNames, const String* const notes, const double* const timestamp, RefPtr<Inspector::InspectorObject> values, RefPtr<Inspector::InspectorValue> payload, RefPtr<Inspector::Protocol::Database::Error> sqlError, const Inspector::Protocol::Database::PrimaryColors* const screenColor, RefPtr<Inspector::Protocol::Database::ColorList> alternateColors, const String* const printColor);
+    void didExecuteNoOptionalParameters(RefPtr<Inspector::Protocol::Array<String>> columnNames, const String& notes, double timestamp, RefPtr<Inspector::InspectorObject> values, RefPtr<Inspector::InspectorValue> payload, RefPtr<Inspector::Protocol::Database::Error> sqlError, const Inspector::Protocol::Database::PrimaryColors& screenColor, RefPtr<Inspector::Protocol::Database::ColorList> alternateColors, const String& printColor);
+private:
+    FrontendRouter& m_frontendRouter;
+};
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+void DatabaseFrontendDispatcher::didExecuteOptionalParameters(RefPtr<Inspector::Protocol::Array<String>> columnNames, const String* const notes, const double* const timestamp, RefPtr<Inspector::InspectorObject> values, RefPtr<Inspector::InspectorValue> payload, RefPtr<Inspector::Protocol::Database::Error> sqlError, const Inspector::Protocol::Database::PrimaryColors* const screenColor, RefPtr<Inspector::Protocol::Database::ColorList> alternateColors, const String* const printColor)
+{
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("Database.didExecuteOptionalParameters"));
+    Ref<InspectorObject> paramsObject = InspectorObject::create();
+    if (columnNames)
+        paramsObject->setArray(ASCIILiteral("columnNames"), columnNames);
+    if (notes)
+        paramsObject->setString(ASCIILiteral("notes"), *notes);
+    if (timestamp)
+        paramsObject->setDouble(ASCIILiteral("timestamp"), *timestamp);
+    if (values)
+        paramsObject->setObject(ASCIILiteral("values"), values);
+    if (payload)
+        paramsObject->setValue(ASCIILiteral("payload"), *payload);
+    if (sqlError)
+        paramsObject->setObject(ASCIILiteral("sqlError"), sqlError);
+    if (screenColor)
+        paramsObject->setString(ASCIILiteral("screenColor"), *screenColor);
+    if (alternateColors)
+        paramsObject->setArray(ASCIILiteral("alternateColors"), alternateColors);
+    if (printColor)
+        paramsObject->setString(ASCIILiteral("printColor"), *printColor);
+    jsonMessage->setObject(ASCIILiteral("params"), WTFMove(paramsObject));
+
+    m_frontendRouter.sendEvent(jsonMessage->toJSONString());
+}
+
+void DatabaseFrontendDispatcher::didExecuteNoOptionalParameters(RefPtr<Inspector::Protocol::Array<String>> columnNames, const String& notes, double timestamp, RefPtr<Inspector::InspectorObject> values, RefPtr<Inspector::InspectorValue> payload, RefPtr<Inspector::Protocol::Database::Error> sqlError, const Inspector::Protocol::Database::PrimaryColors& screenColor, RefPtr<Inspector::Protocol::Database::ColorList> alternateColors, const String& printColor)
+{
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("Database.didExecuteNoOptionalParameters"));
+    Ref<InspectorObject> paramsObject = InspectorObject::create();
+    paramsObject->setArray(ASCIILiteral("columnNames"), columnNames);
+    paramsObject->setString(ASCIILiteral("notes"), notes);
+    paramsObject->setDouble(ASCIILiteral("timestamp"), timestamp);
+    paramsObject->setObject(ASCIILiteral("values"), values);
+    paramsObject->setValue(ASCIILiteral("payload"), payload);
+    paramsObject->setObject(ASCIILiteral("sqlError"), sqlError);
+    paramsObject->setString(ASCIILiteral("screenColor"), screenColor);
+    paramsObject->setArray(ASCIILiteral("alternateColors"), alternateColors);
+    paramsObject->setString(ASCIILiteral("printColor"), printColor);
+    jsonMessage->setObject(ASCIILiteral("params"), WTFMove(paramsObject));
+
+    m_frontendRouter.sendEvent(jsonMessage->toJSONString());
+}
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace Database {
+class Error;
+} // Database
+// End of forward declarations.
+
+
+// Typedefs.
+namespace Database {
+/* Unique identifier of Database object. */
+typedef String DatabaseId;
+typedef String PrimaryColors;
+typedef Inspector::Protocol::Array<Inspector::Protocol::Database::PrimaryColors> ColorList;
+} // Database
+// End of typedefs.
+
+namespace Database {
+/* Database error. */
+class Error : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        MessageSet = 1 << 0,
+        CodeSet = 1 << 1,
+        AllFieldsSet = (MessageSet | CodeSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*Error*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class Error;
+    public:
+
+        Builder<STATE | MessageSet>& setMessage(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & MessageSet), property_message_already_set);
+            m_result->setString(ASCIILiteral("message"), value);
+            return castState<MessageSet>();
+        }
+
+        Builder<STATE | CodeSet>& setCode(int value)
+        {
+            COMPILE_ASSERT(!(STATE & CodeSet), property_code_already_set);
+            m_result->setInteger(ASCIILiteral("code"), value);
+            return castState<CodeSet>();
+        }
+
+        Ref<Error> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(Error) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<Error>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<Error> result = Error::create()
+     *     .setMessage(...)
+     *     .setCode(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+} // Database
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+
+
+namespace Inspector {
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+    TestProtocolDatabaseDomainEventDispatcher *_databaseEventDispatcher;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [_databaseEventDispatcher release];
+    [super dealloc];
+}
+
+- (TestProtocolDatabaseDomainEventDispatcher *)databaseEventDispatcher
+{
+    if (!_databaseEventDispatcher)
+        _databaseEventDispatcher = [[TestProtocolDatabaseDomainEventDispatcher alloc] initWithController:_controller];
+    return _databaseEventDispatcher;
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@property (nonatomic, readonly) TestProtocolDatabaseDomainEventDispatcher *databaseEventDispatcher;
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolDatabaseDomainEventDispatcher
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller;
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)didExecuteOptionalParametersWithColumnNames:(NSArray/*<NSString>*/ **)columnNames notes:(NSString **)notes timestamp:(double *)timestamp values:(RWIProtocolJSONObject **)values payload:(RWIProtocolJSONObject **)payload sqlError:(TestProtocolDatabaseError **)sqlError screenColor:(NSString **)screenColor alternateColors:(NSArray/*<NSString>*/ **)alternateColors printColor:(NSString **)printColor
+{
+    const FrontendRouter& router = _controller->frontendRouter();
+
+    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(columnNames, @"columnNames");
+    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(notes, @"notes");
+    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(values, @"values");
+    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(payload, @"payload");
+    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(sqlError, @"sqlError");
+    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(screenColor, @"screenColor");
+    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(alternateColors, @"alternateColors");
+    THROW_EXCEPTION_FOR_BAD_OPTIONAL_PARAMETER(printColor, @"printColor");
+
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("Database.didExecuteOptionalParameters"));
+    Ref<InspectorObject> paramsObject = InspectorObject::create();
+    if (columnNames)
+        paramsObject->setArray(ASCIILiteral("columnNames"), inspectorStringArray((*columnNames)));
+    if (notes)
+        paramsObject->setString(ASCIILiteral("notes"), (*notes));
+    if (timestamp)
+        paramsObject->setDouble(ASCIILiteral("timestamp"), (*timestamp));
+    if (values)
+        paramsObject->setObject(ASCIILiteral("values"), [(*values) toInspectorObject]);
+    if (payload)
+        paramsObject->setValue(ASCIILiteral("payload"), [(*payload) toInspectorObject]);
+    if (sqlError)
+        paramsObject->setObject(ASCIILiteral("sqlError"), [(*sqlError) toInspectorObject]);
+    if (screenColor)
+        paramsObject->setString(ASCIILiteral("screenColor"), (*screenColor));
+    if (alternateColors)
+        paramsObject->setArray(ASCIILiteral("alternateColors"), inspectorStringArray((*alternateColors)));
+    if (printColor)
+        paramsObject->setString(ASCIILiteral("printColor"), (*printColor));
+    jsonMessage->setObject(ASCIILiteral("params"), WTFMove(paramsObject));
+    router.sendEvent(jsonMessage->toJSONString());
+}
+
+- (void)didExecuteNoOptionalParametersWithColumnNames:(NSArray/*<NSString>*/ *)columnNames notes:(NSString *)notes timestamp:(double)timestamp values:(RWIProtocolJSONObject *)values payload:(RWIProtocolJSONObject *)payload sqlError:(TestProtocolDatabaseError *)sqlError screenColor:(NSString *)screenColor alternateColors:(NSArray/*<NSString>*/ *)alternateColors printColor:(NSString *)printColor
+{
+    const FrontendRouter& router = _controller->frontendRouter();
+
+    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(columnNames, @"columnNames");
+    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(notes, @"notes");
+    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(values, @"values");
+    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(payload, @"payload");
+    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(sqlError, @"sqlError");
+    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(screenColor, @"screenColor");
+    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(alternateColors, @"alternateColors");
+    THROW_EXCEPTION_FOR_REQUIRED_PARAMETER(printColor, @"printColor");
+
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("Database.didExecuteNoOptionalParameters"));
+    Ref<InspectorObject> paramsObject = InspectorObject::create();
+    paramsObject->setArray(ASCIILiteral("columnNames"), inspectorStringArray(columnNames));
+    paramsObject->setString(ASCIILiteral("notes"), notes);
+    paramsObject->setDouble(ASCIILiteral("timestamp"), timestamp);
+    paramsObject->setObject(ASCIILiteral("values"), [values toInspectorObject]);
+    paramsObject->setValue(ASCIILiteral("payload"), [payload toInspectorObject]);
+    paramsObject->setObject(ASCIILiteral("sqlError"), [sqlError toInspectorObject]);
+    paramsObject->setString(ASCIILiteral("screenColor"), screenColor);
+    paramsObject->setArray(ASCIILiteral("alternateColors"), inspectorStringArray(alternateColors));
+    paramsObject->setString(ASCIILiteral("printColor"), printColor);
+    jsonMessage->setObject(ASCIILiteral("params"), WTFMove(paramsObject));
+    router.sendEvent(jsonMessage->toJSONString());
+}
+
+@end
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+@class TestProtocolDatabaseError;
+
+
+
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseError : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithMessage:(NSString *)message code:(int)code;
+/* required */ @property (nonatomic, copy) NSString *message;
+/* required */ @property (nonatomic, assign) int code;
+@end
+
+
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseDomainEventDispatcher : NSObject
+- (void)didExecuteOptionalParametersWithColumnNames:(NSArray/*<NSString>*/ **)columnNames notes:(NSString **)notes timestamp:(double *)timestamp values:(RWIProtocolJSONObject **)values payload:(RWIProtocolJSONObject **)payload sqlError:(TestProtocolDatabaseError **)sqlError screenColor:(NSString **)screenColor alternateColors:(NSArray/*<NSString>*/ **)alternateColors printColor:(NSString **)printColor;
+- (void)didExecuteNoOptionalParametersWithColumnNames:(NSArray/*<NSString>*/ *)columnNames notes:(NSString *)notes timestamp:(double)timestamp values:(RWIProtocolJSONObject *)values payload:(RWIProtocolJSONObject *)payload sqlError:(TestProtocolDatabaseError *)sqlError screenColor:(NSString *)screenColor alternateColors:(NSArray/*<NSString>*/ *)alternateColors printColor:(NSString *)printColor;
+@end
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+@interface TestProtocolDatabaseDomainEventDispatcher (Private)
+- (instancetype)initWithController:(Inspector::AugmentableInspectorController*)controller;
+@end
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (DatabaseDomain)
+
++ (void)_parseDatabaseId:(NSString **)outValue fromPayload:(id)payload;
++ (void)_parsePrimaryColors:(NSString **)outValue fromPayload:(id)payload;
++ (void)_parseColorList:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload;
++ (void)_parseError:(TestProtocolDatabaseError **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (DatabaseDomain)
+
++ (void)_parseDatabaseId:(NSString **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = (NSString *)payload;
+}
+
++ (void)_parsePrimaryColors:(NSString **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = (NSString *)payload;
+}
+
++ (void)_parseColorList:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<NSString>*/ class]);
+    *outValue = (NSArray/*<NSString>*/ *)payload;
+}
+
++ (void)_parseError:(TestProtocolDatabaseError **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolDatabaseError alloc] initWithPayload:payload];
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from events-with-optional-parameters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+@implementation TestProtocolDatabaseError
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"message"], @"message");
+    self.message = payload[@"message"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"code"], @"code");
+    self.code = [payload[@"code"] integerValue];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithMessage:(NSString *)message code:(int)code
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(message, @"message");
+
+    self.message = message;
+    self.code = code;
+
+    return self;
+}
+
+- (void)setMessage:(NSString *)message
+{
+    [super setString:message forKey:@"message"];
+}
+
+- (NSString *)message
+{
+    return [super stringForKey:@"message"];
+}
+
+- (void)setCode:(int)code
+{
+    [super setInteger:code forKey:@"code"];
+}
+
+- (int)code
+{
+    return [super integerForKey:@"code"];
+}
+
+@end
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/fail-on-domain-availability.json-error b/inspector/scripts/tests/expected/fail-on-domain-availability.json-error
new file mode 100644
index 0000000..90d7195
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-domain-availability.json-error
@@ -0,0 +1 @@
+ERROR: Malformed domain specification: availability is an unsupported string. Was: "webb", Allowed values: web
diff --git a/inspector/scripts/tests/expected/fail-on-duplicate-command-call-parameter-names.json-error b/inspector/scripts/tests/expected/fail-on-duplicate-command-call-parameter-names.json-error
new file mode 100644
index 0000000..3f756de
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-duplicate-command-call-parameter-names.json-error
@@ -0,0 +1 @@
+ERROR: Malformed domain specification: call parameter list for command processPoints has duplicate parameter names
diff --git a/inspector/scripts/tests/expected/fail-on-duplicate-command-return-parameter-names.json-error b/inspector/scripts/tests/expected/fail-on-duplicate-command-return-parameter-names.json-error
new file mode 100644
index 0000000..ea148ff
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-duplicate-command-return-parameter-names.json-error
@@ -0,0 +1 @@
+ERROR: Malformed domain specification: return parameter list for command processPoints has duplicate parameter names
diff --git a/inspector/scripts/tests/expected/fail-on-duplicate-event-parameter-names.json-error b/inspector/scripts/tests/expected/fail-on-duplicate-event-parameter-names.json-error
new file mode 100644
index 0000000..c71bbd2
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-duplicate-event-parameter-names.json-error
@@ -0,0 +1 @@
+ERROR: Malformed domain specification: parameter list for event processedPoints has duplicate parameter names
diff --git a/inspector/scripts/tests/expected/fail-on-duplicate-type-declarations.json-error b/inspector/scripts/tests/expected/fail-on-duplicate-type-declarations.json-error
new file mode 100644
index 0000000..447cdf8
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-duplicate-type-declarations.json-error
@@ -0,0 +1 @@
+ERROR: Duplicate type declaration: Runtime.RemoteObjectId
diff --git a/inspector/scripts/tests/expected/fail-on-duplicate-type-member-names.json-error b/inspector/scripts/tests/expected/fail-on-duplicate-type-member-names.json-error
new file mode 100644
index 0000000..d5376a7
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-duplicate-type-member-names.json-error
@@ -0,0 +1 @@
+ERROR: Malformed domain specification: type declaration for Point has duplicate member names
diff --git a/inspector/scripts/tests/expected/fail-on-enum-with-no-values.json-error b/inspector/scripts/tests/expected/fail-on-enum-with-no-values.json-error
new file mode 100644
index 0000000..2655c2b
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-enum-with-no-values.json-error
@@ -0,0 +1 @@
+ERROR: Type reference with enum values must have at least one enum value.
diff --git a/inspector/scripts/tests/expected/fail-on-number-typed-optional-parameter-flag.json-error b/inspector/scripts/tests/expected/fail-on-number-typed-optional-parameter-flag.json-error
new file mode 100644
index 0000000..97b2af0
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-number-typed-optional-parameter-flag.json-error
@@ -0,0 +1 @@
+ERROR: The 'optional' flag for a parameter must be a boolean literal.
diff --git a/inspector/scripts/tests/expected/fail-on-number-typed-optional-type-member.json-error b/inspector/scripts/tests/expected/fail-on-number-typed-optional-type-member.json-error
new file mode 100644
index 0000000..86df375
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-number-typed-optional-type-member.json-error
@@ -0,0 +1 @@
+ERROR: The 'optional' flag for a type member must be a boolean literal.
diff --git a/inspector/scripts/tests/expected/fail-on-string-typed-optional-parameter-flag.json-error b/inspector/scripts/tests/expected/fail-on-string-typed-optional-parameter-flag.json-error
new file mode 100644
index 0000000..97b2af0
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-string-typed-optional-parameter-flag.json-error
@@ -0,0 +1 @@
+ERROR: The 'optional' flag for a parameter must be a boolean literal.
diff --git a/inspector/scripts/tests/expected/fail-on-string-typed-optional-type-member.json-error b/inspector/scripts/tests/expected/fail-on-string-typed-optional-type-member.json-error
new file mode 100644
index 0000000..86df375
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-string-typed-optional-type-member.json-error
@@ -0,0 +1 @@
+ERROR: The 'optional' flag for a type member must be a boolean literal.
diff --git a/inspector/scripts/tests/expected/fail-on-type-declaration-using-type-reference.json-error b/inspector/scripts/tests/expected/fail-on-type-declaration-using-type-reference.json-error
new file mode 100644
index 0000000..42f5753
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-type-declaration-using-type-reference.json-error
@@ -0,0 +1 @@
+ERROR: Type reference cannot have both 'type' and '$ref' keys.
diff --git a/inspector/scripts/tests/expected/fail-on-type-reference-as-primitive-type.json-error b/inspector/scripts/tests/expected/fail-on-type-reference-as-primitive-type.json-error
new file mode 100644
index 0000000..d76bc1c
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-type-reference-as-primitive-type.json-error
@@ -0,0 +1 @@
+ERROR: Type reference 'DatabaseId' is not a primitive type. Allowed values: integer, number, string, boolean, enum, object, array, any
diff --git a/inspector/scripts/tests/expected/fail-on-type-with-lowercase-name.json-error b/inspector/scripts/tests/expected/fail-on-type-with-lowercase-name.json-error
new file mode 100644
index 0000000..4e46225
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-type-with-lowercase-name.json-error
@@ -0,0 +1 @@
+ERROR: Types must begin with an uppercase character.
diff --git a/inspector/scripts/tests/expected/fail-on-unknown-type-reference-in-type-declaration.json-error b/inspector/scripts/tests/expected/fail-on-unknown-type-reference-in-type-declaration.json-error
new file mode 100644
index 0000000..2d38e64
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-unknown-type-reference-in-type-declaration.json-error
@@ -0,0 +1 @@
+ERROR: Type reference 'dragon' is not a primitive type. Allowed values: integer, number, string, boolean, enum, object, array, any
diff --git a/inspector/scripts/tests/expected/fail-on-unknown-type-reference-in-type-member.json-error b/inspector/scripts/tests/expected/fail-on-unknown-type-reference-in-type-member.json-error
new file mode 100644
index 0000000..faf6672
--- /dev/null
+++ b/inspector/scripts/tests/expected/fail-on-unknown-type-reference-in-type-member.json-error
@@ -0,0 +1 @@
+ERROR: Lookup failed for type reference: Color (referenced from domain: Fantasy)
diff --git a/inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result b/inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result
new file mode 100644
index 0000000..794666d
--- /dev/null
+++ b/inspector/scripts/tests/expected/generate-domains-with-feature-guards.json-result
@@ -0,0 +1,1231 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// Network1.
+InspectorBackend.registerCommand("Network1.loadResource", [], []);
+InspectorBackend.activateDomain("Network1");
+
+// Network3.
+InspectorBackend.registerNetwork3Dispatcher = InspectorBackend.registerDomainDispatcher.bind(InspectorBackend, "Network3");
+InspectorBackend.registerEvent("Network3.resourceLoaded", []);
+InspectorBackend.activateDomain("Network3");
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+#if PLATFORM(WEB_COMMANDS)
+class AlternateNetwork1BackendDispatcher : public AlternateBackendDispatcher {
+public:
+    virtual ~AlternateNetwork1BackendDispatcher() { }
+    virtual void loadResource(long callId) = 0;
+};
+#endif // PLATFORM(WEB_COMMANDS)
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#if PLATFORM(WEB_COMMANDS)
+class AlternateNetwork1BackendDispatcher;
+#endif // PLATFORM(WEB_COMMANDS)
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#if PLATFORM(WEB_COMMANDS)
+class Network1BackendDispatcherHandler {
+public:
+    virtual void loadResource(ErrorString&) = 0;
+protected:
+    virtual ~Network1BackendDispatcherHandler();
+};
+#endif // PLATFORM(WEB_COMMANDS)
+
+#if PLATFORM(WEB_COMMANDS)
+class Network1BackendDispatcher final : public SupplementalBackendDispatcher {
+public:
+    static Ref<Network1BackendDispatcher> create(BackendDispatcher&, Network1BackendDispatcherHandler*);
+    void dispatch(long requestId, const String& method, Ref<InspectorObject>&& message) override;
+private:
+    void loadResource(long requestId, RefPtr<InspectorObject>&& parameters);
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+public:
+    void setAlternateDispatcher(AlternateNetwork1BackendDispatcher* alternateDispatcher) { m_alternateDispatcher = alternateDispatcher; }
+private:
+    AlternateNetwork1BackendDispatcher* m_alternateDispatcher { nullptr };
+#endif
+private:
+    Network1BackendDispatcher(BackendDispatcher&, Network1BackendDispatcherHandler*);
+    Network1BackendDispatcherHandler* m_agent { nullptr };
+};
+#endif // PLATFORM(WEB_COMMANDS)
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+#if PLATFORM(WEB_COMMANDS)
+Network1BackendDispatcherHandler::~Network1BackendDispatcherHandler() { }
+#endif // PLATFORM(WEB_COMMANDS)
+
+#if PLATFORM(WEB_COMMANDS)
+Ref<Network1BackendDispatcher> Network1BackendDispatcher::create(BackendDispatcher& backendDispatcher, Network1BackendDispatcherHandler* agent)
+{
+    return adoptRef(*new Network1BackendDispatcher(backendDispatcher, agent));
+}
+
+Network1BackendDispatcher::Network1BackendDispatcher(BackendDispatcher& backendDispatcher, Network1BackendDispatcherHandler* agent)
+    : SupplementalBackendDispatcher(backendDispatcher)
+    , m_agent(agent)
+{
+    m_backendDispatcher->registerDispatcherForDomain(ASCIILiteral("Network1"), this);
+}
+
+void Network1BackendDispatcher::dispatch(long requestId, const String& method, Ref<InspectorObject>&& message)
+{
+    Ref<Network1BackendDispatcher> protect(*this);
+
+    RefPtr<InspectorObject> parameters;
+    message->getObject(ASCIILiteral("params"), parameters);
+
+    if (method == "loadResource")
+        loadResource(requestId, WTFMove(parameters));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::MethodNotFound, makeString('\'', "Network1", '.', method, "' was not found"));
+}
+
+void Network1BackendDispatcher::loadResource(long requestId, RefPtr<InspectorObject>&&)
+{
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+    if (m_alternateDispatcher) {
+        m_alternateDispatcher->loadResource(requestId);
+        return;
+    }
+#endif
+
+    ErrorString error;
+    Ref<InspectorObject> result = InspectorObject::create();
+    m_agent->loadResource(error);
+
+    if (!error.length())
+        m_backendDispatcher->sendResponse(requestId, WTFMove(result));
+    else
+        m_backendDispatcher->reportProtocolError(BackendDispatcher::ServerError, WTFMove(error));
+}
+#endif // PLATFORM(WEB_COMMANDS)
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+#if PLATFORM(WEB_EVENTS)
+class Network3FrontendDispatcher {
+public:
+    Network3FrontendDispatcher(FrontendRouter& frontendRouter) : m_frontendRouter(frontendRouter) { }
+    void resourceLoaded();
+private:
+    FrontendRouter& m_frontendRouter;
+};
+#endif // PLATFORM(WEB_EVENTS)
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+#if PLATFORM(WEB_EVENTS)
+void Network3FrontendDispatcher::resourceLoaded()
+{
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("Network3.resourceLoaded"));
+
+    m_frontendRouter.sendEvent(jsonMessage->toJSONString());
+}
+#endif // PLATFORM(WEB_EVENTS)
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+#if PLATFORM(WEB_TYPES)
+namespace Network2 {
+class NetworkError;
+} // Network2
+#endif // PLATFORM(WEB_TYPES)
+// End of forward declarations.
+
+
+
+
+#if PLATFORM(WEB_TYPES)
+namespace Network2 {
+class NetworkError : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        MessageSet = 1 << 0,
+        CodeSet = 1 << 1,
+        AllFieldsSet = (MessageSet | CodeSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*NetworkError*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class NetworkError;
+    public:
+
+        Builder<STATE | MessageSet>& setMessage(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & MessageSet), property_message_already_set);
+            m_result->setString(ASCIILiteral("message"), value);
+            return castState<MessageSet>();
+        }
+
+        Builder<STATE | CodeSet>& setCode(int value)
+        {
+            COMPILE_ASSERT(!(STATE & CodeSet), property_code_already_set);
+            m_result->setInteger(ASCIILiteral("code"), value);
+            return castState<CodeSet>();
+        }
+
+        Ref<NetworkError> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(NetworkError) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<NetworkError>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<NetworkError> result = NetworkError::create()
+     *     .setMessage(...)
+     *     .setCode(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+} // Network2
+#endif // PLATFORM(WEB_TYPES)
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+@protocol TestProtocolNetwork1DomainHandler;
+
+namespace Inspector {
+
+
+#if PLATFORM(WEB_COMMANDS)
+class ObjCInspectorNetwork1BackendDispatcher final : public AlternateNetwork1BackendDispatcher {
+public:
+    ObjCInspectorNetwork1BackendDispatcher(id<TestProtocolNetwork1DomainHandler> handler) { m_delegate = handler; }
+    virtual void loadResource(long requestId) override;
+private:
+    RetainPtr<id<TestProtocolNetwork1DomainHandler>> m_delegate;
+};
+#endif // PLATFORM(WEB_COMMANDS)
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+    id<TestProtocolNetwork1DomainHandler> _network1Handler;
+    TestProtocolNetwork3DomainEventDispatcher *_network3EventDispatcher;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [_network1Handler release];
+    [_network3EventDispatcher release];
+    [super dealloc];
+}
+
+- (void)setNetwork1Handler:(id<TestProtocolNetwork1DomainHandler>)handler
+{
+    if (handler == _network1Handler)
+        return;
+
+    [_network1Handler release];
+    _network1Handler = [handler retain];
+
+    auto alternateDispatcher = std::make_unique<ObjCInspectorNetwork1BackendDispatcher>(handler);
+    auto alternateAgent = std::make_unique<AlternateDispatchableAgent<Network1BackendDispatcher, AlternateNetwork1BackendDispatcher>>(ASCIILiteral("Network1"), *_controller, WTFMove(alternateDispatcher));
+    _controller->appendExtraAgent(WTFMove(alternateAgent));
+}
+
+- (id<TestProtocolNetwork1DomainHandler>)network1Handler
+{
+    return _network1Handler;
+}
+
+- (TestProtocolNetwork3DomainEventDispatcher *)network3EventDispatcher
+{
+    if (!_network3EventDispatcher)
+        _network3EventDispatcher = [[TestProtocolNetwork3DomainEventDispatcher alloc] initWithController:_controller];
+    return _network3EventDispatcher;
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@property (nonatomic, retain, setter=setNetwork1Handler:) id<TestProtocolNetwork1DomainHandler> network1Handler;
+@property (nonatomic, readonly) TestProtocolNetwork3DomainEventDispatcher *network3EventDispatcher;
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+#if PLATFORM(WEB_COMMANDS)
+void ObjCInspectorNetwork1BackendDispatcher::loadResource(long requestId)
+{
+    id errorCallback = ^(NSString *error) {
+        backendDispatcher()->reportProtocolError(requestId, BackendDispatcher::ServerError, error);
+        backendDispatcher()->sendPendingErrors();
+    };
+
+    id successCallback = ^{
+        backendDispatcher()->sendResponse(requestId, InspectorObject::create());
+    };
+
+    [m_delegate loadResourceWithErrorCallback:errorCallback successCallback:successCallback];
+}
+
+#endif // PLATFORM(WEB_COMMANDS)
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+
+@implementation TestProtocolNetwork3DomainEventDispatcher
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller;
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)resourceLoaded
+{
+    const FrontendRouter& router = _controller->frontendRouter();
+
+    Ref<InspectorObject> jsonMessage = InspectorObject::create();
+    jsonMessage->setString(ASCIILiteral("method"), ASCIILiteral("Network3.resourceLoaded"));
+    router.sendEvent(jsonMessage->toJSONString());
+}
+
+@end
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+@class TestProtocolNetwork2NetworkError;
+
+
+
+
+__attribute__((visibility ("default")))
+@interface TestProtocolNetwork2NetworkError : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithMessage:(NSString *)message code:(int)code;
+/* required */ @property (nonatomic, copy) NSString *message;
+/* required */ @property (nonatomic, assign) int code;
+@end
+
+@protocol TestProtocolNetwork1DomainHandler <NSObject>
+@required
+- (void)loadResourceWithErrorCallback:(void(^)(NSString *error))errorCallback successCallback:(void(^)())successCallback;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolNetwork3DomainEventDispatcher : NSObject
+- (void)resourceLoaded;
+@end
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+@interface TestProtocolNetwork3DomainEventDispatcher (Private)
+- (instancetype)initWithController:(Inspector::AugmentableInspectorController*)controller;
+@end
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (Network1Domain)
+
+@end
+@interface TestProtocolTypeConversions (Network2Domain)
+
++ (void)_parseNetworkError:(TestProtocolNetwork2NetworkError **)outValue fromPayload:(id)payload;
+
+@end
+@interface TestProtocolTypeConversions (Network3Domain)
+
+@end
+
+@implementation TestProtocolTypeConversions (Network1Domain)
+
+@end
+@implementation TestProtocolTypeConversions (Network2Domain)
+
++ (void)_parseNetworkError:(TestProtocolNetwork2NetworkError **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolNetwork2NetworkError alloc] initWithPayload:payload];
+}
+
+@end
+@implementation TestProtocolTypeConversions (Network3Domain)
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-domains-with-feature-guards.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+
+
+@implementation TestProtocolNetwork2NetworkError
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"message"], @"message");
+    self.message = payload[@"message"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"code"], @"code");
+    self.code = [payload[@"code"] integerValue];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithMessage:(NSString *)message code:(int)code
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(message, @"message");
+
+    self.message = message;
+    self.code = code;
+
+    return self;
+}
+
+- (void)setMessage:(NSString *)message
+{
+    [super setString:message forKey:@"message"];
+}
+
+- (NSString *)message
+{
+    return [super stringForKey:@"message"];
+}
+
+- (void)setCode:(int)code
+{
+    [super setInteger:code forKey:@"code"];
+}
+
+- (int)code
+{
+    return [super integerForKey:@"code"];
+}
+
+@end
+
+
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/same-type-id-different-domain.json-result b/inspector/scripts/tests/expected/same-type-id-different-domain.json-result
new file mode 100644
index 0000000..8aed2b7
--- /dev/null
+++ b/inspector/scripts/tests/expected/same-type-id-different-domain.json-result
@@ -0,0 +1,891 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+
+
+// Typedefs.
+namespace Runtime {
+/* Unique object identifier. */
+typedef String RemoteObjectId;
+} // Runtime
+
+namespace Runtime2 {
+/* Unique object identifier. */
+typedef String RemoteObjectId;
+} // Runtime2
+// End of typedefs.
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+
+
+namespace Inspector {
+
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [super dealloc];
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+
+
+
+
+
+
+
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseRemoteObjectId:(NSString **)outValue fromPayload:(id)payload;
+
+@end
+@interface TestProtocolTypeConversions (Runtime2Domain)
+
++ (void)_parseRemoteObjectId:(NSString **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseRemoteObjectId:(NSString **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = (NSString *)payload;
+}
+
+@end
+@implementation TestProtocolTypeConversions (Runtime2Domain)
+
++ (void)_parseRemoteObjectId:(NSString **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = (NSString *)payload;
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from same-type-id-different-domain.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+
+
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result b/inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result
new file mode 100644
index 0000000..4aa5a11
--- /dev/null
+++ b/inspector/scripts/tests/expected/shadowed-optional-type-setters.json-result
@@ -0,0 +1,1093 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace Runtime {
+class KeyPath;
+} // Runtime
+// End of forward declarations.
+
+
+
+
+namespace TestHelpers {
+
+String getEnumConstantValue(int code);
+
+template<typename T> String getEnumConstantValue(T enumValue)
+{
+    return getEnumConstantValue(static_cast<int>(enumValue));
+}
+
+} // namespace TestHelpers
+
+namespace Runtime {
+/* Key path. */
+class KeyPath : public Inspector::InspectorObjectBase {
+public:
+    // Named after property name 'type' while generating KeyPath.
+    enum class Type {
+        Null = 0,
+        String = 1,
+        Array = 2,
+    }; // enum class Type
+    enum {
+        NoFieldsSet = 0,
+        TypeSet = 1 << 0,
+        AllFieldsSet = (TypeSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*KeyPath*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class KeyPath;
+    public:
+
+        Builder<STATE | TypeSet>& setType(Type value)
+        {
+            COMPILE_ASSERT(!(STATE & TypeSet), property_type_already_set);
+            m_result->setString(ASCIILiteral("type"), Inspector::Protocol::TestHelpers::getEnumConstantValue(value));
+            return castState<TypeSet>();
+        }
+
+        Ref<KeyPath> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(KeyPath) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<KeyPath>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<KeyPath> result = KeyPath::create()
+     *     .setType(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+
+    void setString(const String& value)
+    {
+        InspectorObjectBase::setString(ASCIILiteral("string"), value);
+    }
+
+    void setArray(RefPtr<Inspector::Protocol::Array<String>> value)
+    {
+        InspectorObjectBase::setArray(ASCIILiteral("array"), WTFMove(value));
+    }
+};
+
+} // Runtime
+
+
+
+namespace TestHelpers {
+
+template<typename ProtocolEnumType>
+std::optional<ProtocolEnumType> parseEnumValueFromString(const String&);
+
+// Enums in the 'Runtime' Domain
+template<>
+std::optional<Inspector::Protocol::Runtime::KeyPath::Type> parseEnumValueFromString<Inspector::Protocol::Runtime::KeyPath::Type>(const String&);
+
+} // namespace TestHelpers
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+namespace TestHelpers {
+
+static const char* const enum_constant_values[] = {
+    "null",
+    "string",
+    "array",
+};
+
+String getEnumConstantValue(int code) {
+    return enum_constant_values[code];
+}
+
+// Enums in the 'Runtime' Domain
+template<>
+std::optional<Inspector::Protocol::Runtime::KeyPath::Type> parseEnumValueFromString<Inspector::Protocol::Runtime::KeyPath::Type>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::Runtime::KeyPath::Type::Null,
+        (size_t)Inspector::Protocol::Runtime::KeyPath::Type::String,
+        (size_t)Inspector::Protocol::Runtime::KeyPath::Type::Array,
+    };
+    for (size_t i = 0; i < 3; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::Runtime::KeyPath::Type)constantValues[i];
+
+    return std::nullopt;
+}
+
+
+} // namespace TestHelpers
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+
+
+namespace Inspector {
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [super dealloc];
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+@class TestProtocolRuntimeKeyPath;
+
+
+typedef NS_ENUM(NSInteger, TestProtocolRuntimeKeyPathType) {
+    TestProtocolRuntimeKeyPathTypeNull,
+    TestProtocolRuntimeKeyPathTypeString,
+    TestProtocolRuntimeKeyPathTypeArray,
+};
+
+
+__attribute__((visibility ("default")))
+@interface TestProtocolRuntimeKeyPath : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithType:(TestProtocolRuntimeKeyPathType)type;
+/* required */ @property (nonatomic, assign) TestProtocolRuntimeKeyPathType type;
+/* optional */ @property (nonatomic, copy) NSString *string;
+/* optional */ @property (nonatomic, copy) NSArray/*<NSString>*/ *array;
+@end
+
+
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+inline String toProtocolString(TestProtocolRuntimeKeyPathType value)
+{
+    switch(value) {
+    case TestProtocolRuntimeKeyPathTypeNull:
+        return ASCIILiteral("null");
+    case TestProtocolRuntimeKeyPathTypeString:
+        return ASCIILiteral("string");
+    case TestProtocolRuntimeKeyPathTypeArray:
+        return ASCIILiteral("array");
+    }
+}
+
+template<>
+inline TestProtocolRuntimeKeyPathType fromProtocolString(const String& value)
+{
+    if (value == "null")
+        return TestProtocolRuntimeKeyPathTypeNull;
+    if (value == "string")
+        return TestProtocolRuntimeKeyPathTypeString;
+    if (value == "array")
+        return TestProtocolRuntimeKeyPathTypeArray;
+    ASSERT_NOT_REACHED();
+    return TestProtocolRuntimeKeyPathTypeNull;
+}
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseKeyPath:(TestProtocolRuntimeKeyPath **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseKeyPath:(TestProtocolRuntimeKeyPath **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolRuntimeKeyPath alloc] initWithPayload:payload];
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from shadowed-optional-type-setters.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+@implementation TestProtocolRuntimeKeyPath
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"type"], @"type");
+    self.type = fromProtocolString<TestProtocolRuntimeKeyPathType>(payload[@"type"]);
+
+    self.string = payload[@"string"];
+
+    self.array = objcArrayFromPayload<NSString>(payload[@"array"]);
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithType:(TestProtocolRuntimeKeyPathType)type
+{
+    if (!(self = [super init]))
+        return nil;
+
+    self.type = type;
+
+    return self;
+}
+
+- (void)setType:(TestProtocolRuntimeKeyPathType)type
+{
+    [super setString:toProtocolString(type) forKey:@"type"];
+}
+
+- (TestProtocolRuntimeKeyPathType)type
+{
+    return fromProtocolString<TestProtocolRuntimeKeyPathType>([super stringForKey:@"type"]);
+}
+
+- (void)setString:(NSString *)string
+{
+    [super setString:string forKey:@"string"];
+}
+
+- (NSString *)string
+{
+    return [super stringForKey:@"string"];
+}
+
+- (void)setArray:(NSArray/*<NSString>*/ *)array
+{
+    [super setInspectorArray:inspectorStringArray(array) forKey:@"array"];
+}
+
+- (NSArray/*<NSString>*/ *)array
+{
+    return objcStringArray([super inspectorArrayForKey:@"array"]);
+}
+
+@end
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result b/inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result
new file mode 100644
index 0000000..167d501
--- /dev/null
+++ b/inspector/scripts/tests/expected/type-declaration-aliased-primitive-type.json-result
@@ -0,0 +1,862 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+
+
+// Typedefs.
+namespace Runtime {
+/* Unique object identifier. */
+typedef int RemoteObjectId;
+} // Runtime
+// End of typedefs.
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+
+
+namespace Inspector {
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [super dealloc];
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+
+
+
+
+
+
+
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseRemoteObjectId:(NSNumber **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseRemoteObjectId:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSNumber class]);
+    *outValue = (NSNumber *)payload;
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-aliased-primitive-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/type-declaration-array-type.json-result b/inspector/scripts/tests/expected/type-declaration-array-type.json-result
new file mode 100644
index 0000000..c467fac
--- /dev/null
+++ b/inspector/scripts/tests/expected/type-declaration-array-type.json-result
@@ -0,0 +1,1035 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// Debugger.
+InspectorBackend.registerEnum("Debugger.Reason", {Died: "Died", Fainted: "Fainted", Hungry: "Hungry"});
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace Debugger {
+enum class Reason;
+} // Debugger
+// End of forward declarations.
+
+
+// Typedefs.
+namespace Debugger {
+typedef int BreakpointId;
+} // Debugger
+
+namespace Runtime {
+typedef int ObjectId;
+typedef Inspector::Protocol::Array<int> LuckyNumbers;
+typedef Inspector::Protocol::Array<String> BabyNames;
+typedef Inspector::Protocol::Array<Inspector::Protocol::Runtime::ObjectId> NewObjects;
+typedef Inspector::Protocol::Array<Inspector::Protocol::Debugger::BreakpointId> OldObjects;
+typedef Inspector::Protocol::Array<Inspector::Protocol::Debugger::Reason> StopReasons;
+} // Runtime
+// End of typedefs.
+
+namespace TestHelpers {
+
+String getEnumConstantValue(int code);
+
+template<typename T> String getEnumConstantValue(T enumValue)
+{
+    return getEnumConstantValue(static_cast<int>(enumValue));
+}
+
+} // namespace TestHelpers
+
+namespace Debugger {
+/*  */
+enum class Reason {
+    Died = 0,
+    Fainted = 1,
+    Hungry = 2,
+}; // enum class Reason
+} // Debugger
+
+
+
+namespace TestHelpers {
+
+template<typename ProtocolEnumType>
+std::optional<ProtocolEnumType> parseEnumValueFromString(const String&);
+
+// Enums in the 'Debugger' Domain
+template<>
+std::optional<Inspector::Protocol::Debugger::Reason> parseEnumValueFromString<Inspector::Protocol::Debugger::Reason>(const String&);
+
+} // namespace TestHelpers
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+namespace TestHelpers {
+
+static const char* const enum_constant_values[] = {
+    "Died",
+    "Fainted",
+    "Hungry",
+};
+
+String getEnumConstantValue(int code) {
+    return enum_constant_values[code];
+}
+
+// Enums in the 'Debugger' Domain
+template<>
+std::optional<Inspector::Protocol::Debugger::Reason> parseEnumValueFromString<Inspector::Protocol::Debugger::Reason>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::Debugger::Reason::Died,
+        (size_t)Inspector::Protocol::Debugger::Reason::Fainted,
+        (size_t)Inspector::Protocol::Debugger::Reason::Hungry,
+    };
+    for (size_t i = 0; i < 3; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::Debugger::Reason)constantValues[i];
+
+    return std::nullopt;
+}
+
+
+} // namespace TestHelpers
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+
+
+namespace Inspector {
+
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [super dealloc];
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+
+
+
+typedef NS_ENUM(NSInteger, TestProtocolDebuggerReason) {
+    TestProtocolDebuggerReasonDied,
+    TestProtocolDebuggerReasonFainted,
+    TestProtocolDebuggerReasonHungry,
+};
+
+
+
+
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+inline String toProtocolString(TestProtocolDebuggerReason value)
+{
+    switch(value) {
+    case TestProtocolDebuggerReasonDied:
+        return ASCIILiteral("Died");
+    case TestProtocolDebuggerReasonFainted:
+        return ASCIILiteral("Fainted");
+    case TestProtocolDebuggerReasonHungry:
+        return ASCIILiteral("Hungry");
+    }
+}
+
+template<>
+inline TestProtocolDebuggerReason fromProtocolString(const String& value)
+{
+    if (value == "Died")
+        return TestProtocolDebuggerReasonDied;
+    if (value == "Fainted")
+        return TestProtocolDebuggerReasonFainted;
+    if (value == "Hungry")
+        return TestProtocolDebuggerReasonHungry;
+    ASSERT_NOT_REACHED();
+    return TestProtocolDebuggerReasonDied;
+}
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (DebuggerDomain)
+
++ (void)_parseBreakpointId:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseReason:(NSNumber **)outValue fromPayload:(id)payload;
+
+@end
+@interface TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseObjectId:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseLuckyNumbers:(NSArray/*<NSNumber>*/ **)outValue fromPayload:(id)payload;
++ (void)_parseBabyNames:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload;
++ (void)_parseNewObjects:(NSArray/*<NSNumber>*/ **)outValue fromPayload:(id)payload;
++ (void)_parseOldObjects:(NSArray/*<NSNumber>*/ **)outValue fromPayload:(id)payload;
++ (void)_parseStopReasons:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (DebuggerDomain)
+
++ (void)_parseBreakpointId:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSNumber class]);
+    *outValue = (NSNumber *)payload;
+}
+
++ (void)_parseReason:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = @(Inspector::fromProtocolString<TestProtocolDebuggerReason>(payload));
+}
+
+@end
+@implementation TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseObjectId:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSNumber class]);
+    *outValue = (NSNumber *)payload;
+}
+
++ (void)_parseLuckyNumbers:(NSArray/*<NSNumber>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<NSNumber>*/ class]);
+    *outValue = (NSArray/*<NSNumber>*/ *)payload;
+}
+
++ (void)_parseBabyNames:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<NSString>*/ class]);
+    *outValue = (NSArray/*<NSString>*/ *)payload;
+}
+
++ (void)_parseNewObjects:(NSArray/*<NSNumber>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<NSNumber>*/ class]);
+    *outValue = (NSArray/*<NSNumber>*/ *)payload;
+}
+
++ (void)_parseOldObjects:(NSArray/*<NSNumber>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<NSNumber>*/ class]);
+    *outValue = (NSArray/*<NSNumber>*/ *)payload;
+}
+
++ (void)_parseStopReasons:(NSArray/*<NSString>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<NSString>*/ class]);
+    *outValue = (NSArray/*<NSString>*/ *)payload;
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-array-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+
+
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/type-declaration-enum-type.json-result b/inspector/scripts/tests/expected/type-declaration-enum-type.json-result
new file mode 100644
index 0000000..2e64005
--- /dev/null
+++ b/inspector/scripts/tests/expected/type-declaration-enum-type.json-result
@@ -0,0 +1,1037 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// Runtime.
+InspectorBackend.registerEnum("Runtime.FarmAnimals", {Pigs: "Pigs", Cows: "Cows", Cats: "Cats", Hens: "Hens"});
+InspectorBackend.registerEnum("Runtime.TwoLeggedAnimals", {Ducks: "Ducks", Hens: "Hens", Crows: "Crows", Flamingos: "Flamingos"});
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace Runtime {
+enum class FarmAnimals;
+enum class TwoLeggedAnimals;
+} // Runtime
+// End of forward declarations.
+
+
+
+
+namespace TestHelpers {
+
+String getEnumConstantValue(int code);
+
+template<typename T> String getEnumConstantValue(T enumValue)
+{
+    return getEnumConstantValue(static_cast<int>(enumValue));
+}
+
+} // namespace TestHelpers
+
+namespace Runtime {
+/*  */
+enum class FarmAnimals {
+    Pigs = 0,
+    Cows = 1,
+    Cats = 2,
+    Hens = 3,
+}; // enum class FarmAnimals
+/*  */
+enum class TwoLeggedAnimals {
+    Ducks = 4,
+    Hens = 3,
+    Crows = 5,
+    Flamingos = 6,
+}; // enum class TwoLeggedAnimals
+} // Runtime
+
+
+
+namespace TestHelpers {
+
+template<typename ProtocolEnumType>
+std::optional<ProtocolEnumType> parseEnumValueFromString(const String&);
+
+// Enums in the 'Runtime' Domain
+template<>
+std::optional<Inspector::Protocol::Runtime::FarmAnimals> parseEnumValueFromString<Inspector::Protocol::Runtime::FarmAnimals>(const String&);
+template<>
+std::optional<Inspector::Protocol::Runtime::TwoLeggedAnimals> parseEnumValueFromString<Inspector::Protocol::Runtime::TwoLeggedAnimals>(const String&);
+
+} // namespace TestHelpers
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+namespace TestHelpers {
+
+static const char* const enum_constant_values[] = {
+    "Pigs",
+    "Cows",
+    "Cats",
+    "Hens",
+    "Ducks",
+    "Crows",
+    "Flamingos",
+};
+
+String getEnumConstantValue(int code) {
+    return enum_constant_values[code];
+}
+
+// Enums in the 'Runtime' Domain
+template<>
+std::optional<Inspector::Protocol::Runtime::FarmAnimals> parseEnumValueFromString<Inspector::Protocol::Runtime::FarmAnimals>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::Runtime::FarmAnimals::Pigs,
+        (size_t)Inspector::Protocol::Runtime::FarmAnimals::Cows,
+        (size_t)Inspector::Protocol::Runtime::FarmAnimals::Cats,
+        (size_t)Inspector::Protocol::Runtime::FarmAnimals::Hens,
+    };
+    for (size_t i = 0; i < 4; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::Runtime::FarmAnimals)constantValues[i];
+
+    return std::nullopt;
+}
+
+template<>
+std::optional<Inspector::Protocol::Runtime::TwoLeggedAnimals> parseEnumValueFromString<Inspector::Protocol::Runtime::TwoLeggedAnimals>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::Runtime::TwoLeggedAnimals::Ducks,
+        (size_t)Inspector::Protocol::Runtime::TwoLeggedAnimals::Hens,
+        (size_t)Inspector::Protocol::Runtime::TwoLeggedAnimals::Crows,
+        (size_t)Inspector::Protocol::Runtime::TwoLeggedAnimals::Flamingos,
+    };
+    for (size_t i = 0; i < 4; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::Runtime::TwoLeggedAnimals)constantValues[i];
+
+    return std::nullopt;
+}
+
+
+} // namespace TestHelpers
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+
+
+namespace Inspector {
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [super dealloc];
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+
+
+
+typedef NS_ENUM(NSInteger, TestProtocolRuntimeFarmAnimals) {
+    TestProtocolRuntimeFarmAnimalsPigs,
+    TestProtocolRuntimeFarmAnimalsCows,
+    TestProtocolRuntimeFarmAnimalsCats,
+    TestProtocolRuntimeFarmAnimalsHens,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolRuntimeTwoLeggedAnimals) {
+    TestProtocolRuntimeTwoLeggedAnimalsDucks,
+    TestProtocolRuntimeTwoLeggedAnimalsHens,
+    TestProtocolRuntimeTwoLeggedAnimalsCrows,
+    TestProtocolRuntimeTwoLeggedAnimalsFlamingos,
+};
+
+
+
+
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+inline String toProtocolString(TestProtocolRuntimeFarmAnimals value)
+{
+    switch(value) {
+    case TestProtocolRuntimeFarmAnimalsPigs:
+        return ASCIILiteral("Pigs");
+    case TestProtocolRuntimeFarmAnimalsCows:
+        return ASCIILiteral("Cows");
+    case TestProtocolRuntimeFarmAnimalsCats:
+        return ASCIILiteral("Cats");
+    case TestProtocolRuntimeFarmAnimalsHens:
+        return ASCIILiteral("Hens");
+    }
+}
+
+template<>
+inline TestProtocolRuntimeFarmAnimals fromProtocolString(const String& value)
+{
+    if (value == "Pigs")
+        return TestProtocolRuntimeFarmAnimalsPigs;
+    if (value == "Cows")
+        return TestProtocolRuntimeFarmAnimalsCows;
+    if (value == "Cats")
+        return TestProtocolRuntimeFarmAnimalsCats;
+    if (value == "Hens")
+        return TestProtocolRuntimeFarmAnimalsHens;
+    ASSERT_NOT_REACHED();
+    return TestProtocolRuntimeFarmAnimalsPigs;
+}
+
+inline String toProtocolString(TestProtocolRuntimeTwoLeggedAnimals value)
+{
+    switch(value) {
+    case TestProtocolRuntimeTwoLeggedAnimalsDucks:
+        return ASCIILiteral("Ducks");
+    case TestProtocolRuntimeTwoLeggedAnimalsHens:
+        return ASCIILiteral("Hens");
+    case TestProtocolRuntimeTwoLeggedAnimalsCrows:
+        return ASCIILiteral("Crows");
+    case TestProtocolRuntimeTwoLeggedAnimalsFlamingos:
+        return ASCIILiteral("Flamingos");
+    }
+}
+
+template<>
+inline TestProtocolRuntimeTwoLeggedAnimals fromProtocolString(const String& value)
+{
+    if (value == "Ducks")
+        return TestProtocolRuntimeTwoLeggedAnimalsDucks;
+    if (value == "Hens")
+        return TestProtocolRuntimeTwoLeggedAnimalsHens;
+    if (value == "Crows")
+        return TestProtocolRuntimeTwoLeggedAnimalsCrows;
+    if (value == "Flamingos")
+        return TestProtocolRuntimeTwoLeggedAnimalsFlamingos;
+    ASSERT_NOT_REACHED();
+    return TestProtocolRuntimeTwoLeggedAnimalsDucks;
+}
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseFarmAnimals:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseTwoLeggedAnimals:(NSNumber **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (RuntimeDomain)
+
++ (void)_parseFarmAnimals:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = @(Inspector::fromProtocolString<TestProtocolRuntimeFarmAnimals>(payload));
+}
+
++ (void)_parseTwoLeggedAnimals:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = @(Inspector::fromProtocolString<TestProtocolRuntimeTwoLeggedAnimals>(payload));
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-enum-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/type-declaration-object-type.json-result b/inspector/scripts/tests/expected/type-declaration-object-type.json-result
new file mode 100644
index 0000000..a9c066f
--- /dev/null
+++ b/inspector/scripts/tests/expected/type-declaration-object-type.json-result
@@ -0,0 +1,1993 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace Database {
+class Error;
+class OptionalParameterBundle;
+class ParameterBundle;
+class ObjectWithPropertyNameConflicts;
+class DummyObject;
+} // Database
+
+namespace Test {
+class ParameterBundle;
+} // Test
+// End of forward declarations.
+
+
+// Typedefs.
+namespace Database {
+typedef Inspector::Protocol::Array<Inspector::Protocol::Database::Error> ErrorList;
+} // Database
+// End of typedefs.
+
+namespace Database {
+/* Database error. */
+class Error : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        MessageSet = 1 << 0,
+        CodeSet = 1 << 1,
+        AllFieldsSet = (MessageSet | CodeSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*Error*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class Error;
+    public:
+
+        Builder<STATE | MessageSet>& setMessage(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & MessageSet), property_message_already_set);
+            m_result->setString(ASCIILiteral("message"), value);
+            return castState<MessageSet>();
+        }
+
+        Builder<STATE | CodeSet>& setCode(int value)
+        {
+            COMPILE_ASSERT(!(STATE & CodeSet), property_code_already_set);
+            m_result->setInteger(ASCIILiteral("code"), value);
+            return castState<CodeSet>();
+        }
+
+        Ref<Error> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(Error) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<Error>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<Error> result = Error::create()
+     *     .setMessage(...)
+     *     .setCode(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+class OptionalParameterBundle : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        AllFieldsSet = 0
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*OptionalParameterBundle*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class OptionalParameterBundle;
+    public:
+
+        Ref<OptionalParameterBundle> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(OptionalParameterBundle) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<OptionalParameterBundle>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<OptionalParameterBundle> result = OptionalParameterBundle::create()
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+
+    void setColumnNames(RefPtr<Inspector::Protocol::Array<String>> value)
+    {
+        InspectorObjectBase::setArray(ASCIILiteral("columnNames"), WTFMove(value));
+    }
+
+    void setNotes(const String& value)
+    {
+        InspectorObjectBase::setString(ASCIILiteral("notes"), value);
+    }
+
+    void setTimestamp(double value)
+    {
+        InspectorObjectBase::setDouble(ASCIILiteral("timestamp"), value);
+    }
+
+    void setValues(RefPtr<Inspector::InspectorObject> value)
+    {
+        InspectorObjectBase::setObject(ASCIILiteral("values"), WTFMove(value));
+    }
+
+    void setPayload(RefPtr<Inspector::InspectorValue> value)
+    {
+        InspectorObjectBase::setValue(ASCIILiteral("payload"), WTFMove(value));
+    }
+
+    void setError(RefPtr<Inspector::Protocol::Database::Error> value)
+    {
+        InspectorObjectBase::setObject(ASCIILiteral("error"), WTFMove(value));
+    }
+
+    void setErrorList(RefPtr<Inspector::Protocol::Database::ErrorList> value)
+    {
+        InspectorObjectBase::setArray(ASCIILiteral("errorList"), WTFMove(value));
+    }
+};
+
+class ParameterBundle : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        ColumnNamesSet = 1 << 0,
+        NotesSet = 1 << 1,
+        TimestampSet = 1 << 2,
+        ValuesSet = 1 << 3,
+        PayloadSet = 1 << 4,
+        ErrorSet = 1 << 5,
+        ErrorListSet = 1 << 6,
+        AllFieldsSet = (ColumnNamesSet | NotesSet | TimestampSet | ValuesSet | PayloadSet | ErrorSet | ErrorListSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*ParameterBundle*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class ParameterBundle;
+    public:
+
+        Builder<STATE | ColumnNamesSet>& setColumnNames(RefPtr<Inspector::Protocol::Array<String>> value)
+        {
+            COMPILE_ASSERT(!(STATE & ColumnNamesSet), property_columnNames_already_set);
+            m_result->setArray(ASCIILiteral("columnNames"), value);
+            return castState<ColumnNamesSet>();
+        }
+
+        Builder<STATE | NotesSet>& setNotes(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & NotesSet), property_notes_already_set);
+            m_result->setString(ASCIILiteral("notes"), value);
+            return castState<NotesSet>();
+        }
+
+        Builder<STATE | TimestampSet>& setTimestamp(double value)
+        {
+            COMPILE_ASSERT(!(STATE & TimestampSet), property_timestamp_already_set);
+            m_result->setDouble(ASCIILiteral("timestamp"), value);
+            return castState<TimestampSet>();
+        }
+
+        Builder<STATE | ValuesSet>& setValues(RefPtr<Inspector::InspectorObject> value)
+        {
+            COMPILE_ASSERT(!(STATE & ValuesSet), property_values_already_set);
+            m_result->setObject(ASCIILiteral("values"), value);
+            return castState<ValuesSet>();
+        }
+
+        Builder<STATE | PayloadSet>& setPayload(RefPtr<Inspector::InspectorValue> value)
+        {
+            COMPILE_ASSERT(!(STATE & PayloadSet), property_payload_already_set);
+            m_result->setValue(ASCIILiteral("payload"), value);
+            return castState<PayloadSet>();
+        }
+
+        Builder<STATE | ErrorSet>& setError(RefPtr<Inspector::Protocol::Database::Error> value)
+        {
+            COMPILE_ASSERT(!(STATE & ErrorSet), property_error_already_set);
+            m_result->setObject(ASCIILiteral("error"), value);
+            return castState<ErrorSet>();
+        }
+
+        Builder<STATE | ErrorListSet>& setErrorList(RefPtr<Inspector::Protocol::Database::ErrorList> value)
+        {
+            COMPILE_ASSERT(!(STATE & ErrorListSet), property_errorList_already_set);
+            m_result->setArray(ASCIILiteral("errorList"), value);
+            return castState<ErrorListSet>();
+        }
+
+        Ref<ParameterBundle> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(ParameterBundle) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<ParameterBundle>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<ParameterBundle> result = ParameterBundle::create()
+     *     .setColumnNames(...)
+     *     .setNotes(...)
+     *     .setTimestamp(...)
+     *     .setValues(...)
+     *     .setPayload(...)
+     *     .setError(...)
+     *     .setErrorList(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+/* Conflicted names may cause generated getters/setters to clash with built-in InspectorObject methods. */
+class ObjectWithPropertyNameConflicts : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        IntegerSet = 1 << 0,
+        ArraySet = 1 << 1,
+        StringSet = 1 << 2,
+        ValueSet = 1 << 3,
+        ObjectSet = 1 << 4,
+        AllFieldsSet = (IntegerSet | ArraySet | StringSet | ValueSet | ObjectSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*ObjectWithPropertyNameConflicts*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class ObjectWithPropertyNameConflicts;
+    public:
+
+        Builder<STATE | IntegerSet>& setInteger(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & IntegerSet), property_integer_already_set);
+            m_result->setString(ASCIILiteral("integer"), value);
+            return castState<IntegerSet>();
+        }
+
+        Builder<STATE | ArraySet>& setArray(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & ArraySet), property_array_already_set);
+            m_result->setString(ASCIILiteral("array"), value);
+            return castState<ArraySet>();
+        }
+
+        Builder<STATE | StringSet>& setString(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & StringSet), property_string_already_set);
+            m_result->setString(ASCIILiteral("string"), value);
+            return castState<StringSet>();
+        }
+
+        Builder<STATE | ValueSet>& setValue(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & ValueSet), property_value_already_set);
+            m_result->setString(ASCIILiteral("value"), value);
+            return castState<ValueSet>();
+        }
+
+        Builder<STATE | ObjectSet>& setObject(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & ObjectSet), property_object_already_set);
+            m_result->setString(ASCIILiteral("object"), value);
+            return castState<ObjectSet>();
+        }
+
+        Ref<ObjectWithPropertyNameConflicts> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(ObjectWithPropertyNameConflicts) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<ObjectWithPropertyNameConflicts>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<ObjectWithPropertyNameConflicts> result = ObjectWithPropertyNameConflicts::create()
+     *     .setInteger(...)
+     *     .setArray(...)
+     *     .setString(...)
+     *     .setValue(...)
+     *     .setObject(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+} // Database
+
+namespace Test {
+class ParameterBundle : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        ColumnNamesSet = 1 << 0,
+        NotesSet = 1 << 1,
+        TimestampSet = 1 << 2,
+        ValuesSet = 1 << 3,
+        PayloadSet = 1 << 4,
+        ErrorSet = 1 << 5,
+        AllFieldsSet = (ColumnNamesSet | NotesSet | TimestampSet | ValuesSet | PayloadSet | ErrorSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*ParameterBundle*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class ParameterBundle;
+    public:
+
+        Builder<STATE | ColumnNamesSet>& setColumnNames(RefPtr<Inspector::Protocol::Array<String>> value)
+        {
+            COMPILE_ASSERT(!(STATE & ColumnNamesSet), property_columnNames_already_set);
+            m_result->setArray(ASCIILiteral("columnNames"), value);
+            return castState<ColumnNamesSet>();
+        }
+
+        Builder<STATE | NotesSet>& setNotes(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & NotesSet), property_notes_already_set);
+            m_result->setString(ASCIILiteral("notes"), value);
+            return castState<NotesSet>();
+        }
+
+        Builder<STATE | TimestampSet>& setTimestamp(double value)
+        {
+            COMPILE_ASSERT(!(STATE & TimestampSet), property_timestamp_already_set);
+            m_result->setDouble(ASCIILiteral("timestamp"), value);
+            return castState<TimestampSet>();
+        }
+
+        Builder<STATE | ValuesSet>& setValues(RefPtr<Inspector::InspectorObject> value)
+        {
+            COMPILE_ASSERT(!(STATE & ValuesSet), property_values_already_set);
+            m_result->setObject(ASCIILiteral("values"), value);
+            return castState<ValuesSet>();
+        }
+
+        Builder<STATE | PayloadSet>& setPayload(RefPtr<Inspector::InspectorValue> value)
+        {
+            COMPILE_ASSERT(!(STATE & PayloadSet), property_payload_already_set);
+            m_result->setValue(ASCIILiteral("payload"), value);
+            return castState<PayloadSet>();
+        }
+
+        Builder<STATE | ErrorSet>& setError(RefPtr<Inspector::Protocol::Database::Error> value)
+        {
+            COMPILE_ASSERT(!(STATE & ErrorSet), property_error_already_set);
+            m_result->setObject(ASCIILiteral("error"), value);
+            return castState<ErrorSet>();
+        }
+
+        Ref<ParameterBundle> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(ParameterBundle) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<ParameterBundle>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<ParameterBundle> result = ParameterBundle::create()
+     *     .setColumnNames(...)
+     *     .setNotes(...)
+     *     .setTimestamp(...)
+     *     .setValues(...)
+     *     .setPayload(...)
+     *     .setError(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+} // Test
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+
+
+namespace Inspector {
+
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [super dealloc];
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+@class TestProtocolDatabaseError;
+@class TestProtocolDatabaseOptionalParameterBundle;
+@class TestProtocolDatabaseParameterBundle;
+@class TestProtocolDatabaseObjectWithPropertyNameConflicts;
+@class TestProtocolDatabaseDummyObject;
+@class TestProtocolTestParameterBundle;
+
+
+
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseError : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithMessage:(NSString *)message code:(int)code;
+/* required */ @property (nonatomic, copy) NSString *message;
+/* required */ @property (nonatomic, assign) int code;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseOptionalParameterBundle : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+/* optional */ @property (nonatomic, copy) NSArray/*<NSString>*/ *columnNames;
+/* optional */ @property (nonatomic, copy) NSString *notes;
+/* optional */ @property (nonatomic, assign) double timestamp;
+/* optional */ @property (nonatomic, retain) RWIProtocolJSONObject *values;
+/* optional */ @property (nonatomic, retain) RWIProtocolJSONObject *payload;
+/* optional */ @property (nonatomic, retain) TestProtocolDatabaseError *error;
+/* optional */ @property (nonatomic, copy) NSArray/*<TestProtocolDatabaseError>*/ *errorList;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseParameterBundle : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithColumnNames:(NSArray/*<NSString>*/ *)columnNames notes:(NSString *)notes timestamp:(double)timestamp values:(RWIProtocolJSONObject *)values payload:(RWIProtocolJSONObject *)payload error:(TestProtocolDatabaseError *)error errorList:(NSArray/*<TestProtocolDatabaseError>*/ *)errorList;
+/* required */ @property (nonatomic, copy) NSArray/*<NSString>*/ *columnNames;
+/* required */ @property (nonatomic, copy) NSString *notes;
+/* required */ @property (nonatomic, assign) double timestamp;
+/* required */ @property (nonatomic, retain) RWIProtocolJSONObject *values;
+/* required */ @property (nonatomic, retain) RWIProtocolJSONObject *payload;
+/* required */ @property (nonatomic, retain) TestProtocolDatabaseError *error;
+/* required */ @property (nonatomic, copy) NSArray/*<TestProtocolDatabaseError>*/ *errorList;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseObjectWithPropertyNameConflicts : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithInteger:(NSString *)integer array:(NSString *)array string:(NSString *)string value:(NSString *)value object:(NSString *)object;
+/* required */ @property (nonatomic, copy) NSString *integer;
+/* required */ @property (nonatomic, copy) NSString *array;
+/* required */ @property (nonatomic, copy) NSString *string;
+/* required */ @property (nonatomic, copy) NSString *value;
+/* required */ @property (nonatomic, copy) NSString *object;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolDatabaseDummyObject : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolTestParameterBundle : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithColumnNames:(NSArray/*<NSString>*/ *)columnNames notes:(NSString *)notes timestamp:(double)timestamp values:(RWIProtocolJSONObject *)values payload:(RWIProtocolJSONObject *)payload error:(TestProtocolDatabaseError *)error;
+/* required */ @property (nonatomic, copy) NSArray/*<NSString>*/ *columnNames;
+/* required */ @property (nonatomic, copy) NSString *notes;
+/* required */ @property (nonatomic, assign) double timestamp;
+/* required */ @property (nonatomic, retain) RWIProtocolJSONObject *values;
+/* required */ @property (nonatomic, retain) RWIProtocolJSONObject *payload;
+/* required */ @property (nonatomic, retain) TestProtocolDatabaseError *error;
+@end
+
+
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (DatabaseDomain)
+
++ (void)_parseError:(TestProtocolDatabaseError **)outValue fromPayload:(id)payload;
++ (void)_parseErrorList:(NSArray/*<TestProtocolDatabaseError>*/ **)outValue fromPayload:(id)payload;
++ (void)_parseOptionalParameterBundle:(TestProtocolDatabaseOptionalParameterBundle **)outValue fromPayload:(id)payload;
++ (void)_parseParameterBundle:(TestProtocolDatabaseParameterBundle **)outValue fromPayload:(id)payload;
++ (void)_parseObjectWithPropertyNameConflicts:(TestProtocolDatabaseObjectWithPropertyNameConflicts **)outValue fromPayload:(id)payload;
++ (void)_parseDummyObject:(TestProtocolDatabaseDummyObject **)outValue fromPayload:(id)payload;
+
+@end
+@interface TestProtocolTypeConversions (TestDomain)
+
++ (void)_parseParameterBundle:(TestProtocolTestParameterBundle **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (DatabaseDomain)
+
++ (void)_parseError:(TestProtocolDatabaseError **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolDatabaseError alloc] initWithPayload:payload];
+}
+
++ (void)_parseErrorList:(NSArray/*<TestProtocolDatabaseError>*/ **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSArray/*<TestProtocolDatabaseError>*/ class]);
+    *outValue = (NSArray/*<TestProtocolDatabaseError>*/ *)payload;
+}
+
++ (void)_parseOptionalParameterBundle:(TestProtocolDatabaseOptionalParameterBundle **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolDatabaseOptionalParameterBundle alloc] initWithPayload:payload];
+}
+
++ (void)_parseParameterBundle:(TestProtocolDatabaseParameterBundle **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolDatabaseParameterBundle alloc] initWithPayload:payload];
+}
+
++ (void)_parseObjectWithPropertyNameConflicts:(TestProtocolDatabaseObjectWithPropertyNameConflicts **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolDatabaseObjectWithPropertyNameConflicts alloc] initWithPayload:payload];
+}
+
++ (void)_parseDummyObject:(TestProtocolDatabaseDummyObject **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolDatabaseDummyObject alloc] initWithPayload:payload];
+}
+
+@end
+@implementation TestProtocolTypeConversions (TestDomain)
+
++ (void)_parseParameterBundle:(TestProtocolTestParameterBundle **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolTestParameterBundle alloc] initWithPayload:payload];
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-declaration-object-type.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+@implementation TestProtocolDatabaseError
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"message"], @"message");
+    self.message = payload[@"message"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"code"], @"code");
+    self.code = [payload[@"code"] integerValue];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithMessage:(NSString *)message code:(int)code
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(message, @"message");
+
+    self.message = message;
+    self.code = code;
+
+    return self;
+}
+
+- (void)setMessage:(NSString *)message
+{
+    [super setString:message forKey:@"message"];
+}
+
+- (NSString *)message
+{
+    return [super stringForKey:@"message"];
+}
+
+- (void)setCode:(int)code
+{
+    [super setInteger:code forKey:@"code"];
+}
+
+- (int)code
+{
+    return [super integerForKey:@"code"];
+}
+
+@end
+
+@implementation TestProtocolDatabaseOptionalParameterBundle
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    self.columnNames = objcArrayFromPayload<NSString>(payload[@"columnNames"]);
+
+    self.notes = payload[@"notes"];
+
+    self.timestamp = [payload[@"timestamp"] doubleValue];
+
+    self.values = payload[@"values"];
+
+    self.payload = payload[@"payload"];
+
+    self.error = [[TestProtocolDatabaseError alloc] initWithPayload:payload[@"error"]];
+
+    self.errorList = objcArrayFromPayload<TestProtocolDatabaseError>(payload[@"errorList"]);
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (void)setColumnNames:(NSArray/*<NSString>*/ *)columnNames
+{
+    [super setInspectorArray:inspectorStringArray(columnNames) forKey:@"columnNames"];
+}
+
+- (NSArray/*<NSString>*/ *)columnNames
+{
+    return objcStringArray([super inspectorArrayForKey:@"columnNames"]);
+}
+
+- (void)setNotes:(NSString *)notes
+{
+    [super setString:notes forKey:@"notes"];
+}
+
+- (NSString *)notes
+{
+    return [super stringForKey:@"notes"];
+}
+
+- (void)setTimestamp:(double)timestamp
+{
+    [super setDouble:timestamp forKey:@"timestamp"];
+}
+
+- (double)timestamp
+{
+    return [super doubleForKey:@"timestamp"];
+}
+
+- (void)setValues:(RWIProtocolJSONObject *)values
+{
+    [super setObject:values forKey:@"values"];
+}
+
+- (RWIProtocolJSONObject *)values
+{
+    return [[RWIProtocolJSONObject alloc] initWithInspectorObject:[[super objectForKey:@"values"] toInspectorObject].get()];
+}
+
+- (void)setPayload:(RWIProtocolJSONObject *)payload
+{
+    [super setObject:payload forKey:@"payload"];
+}
+
+- (RWIProtocolJSONObject *)payload
+{
+    return [[RWIProtocolJSONObject alloc] initWithInspectorObject:[[super objectForKey:@"payload"] toInspectorObject].get()];
+}
+
+- (void)setError:(TestProtocolDatabaseError *)error
+{
+    [super setObject:error forKey:@"error"];
+}
+
+- (TestProtocolDatabaseError *)error
+{
+    return [[TestProtocolDatabaseError alloc] initWithInspectorObject:[[super objectForKey:@"error"] toInspectorObject].get()];
+}
+
+- (void)setErrorList:(NSArray/*<TestProtocolDatabaseError>*/ *)errorList
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE_IN_ARRAY(errorList, [TestProtocolDatabaseError class]);
+    [super setInspectorArray:inspectorObjectArray(errorList) forKey:@"errorList"];
+}
+
+- (NSArray/*<TestProtocolDatabaseError>*/ *)errorList
+{
+    return objcArray<TestProtocolDatabaseError>([super inspectorArrayForKey:@"errorList"]);
+}
+
+@end
+
+@implementation TestProtocolDatabaseParameterBundle
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"columnNames"], @"columnNames");
+    self.columnNames = objcArrayFromPayload<NSString>(payload[@"columnNames"]);
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"notes"], @"notes");
+    self.notes = payload[@"notes"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"timestamp"], @"timestamp");
+    self.timestamp = [payload[@"timestamp"] doubleValue];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"values"], @"values");
+    self.values = payload[@"values"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"payload"], @"payload");
+    self.payload = payload[@"payload"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"error"], @"error");
+    self.error = [[TestProtocolDatabaseError alloc] initWithPayload:payload[@"error"]];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"errorList"], @"errorList");
+    self.errorList = objcArrayFromPayload<TestProtocolDatabaseError>(payload[@"errorList"]);
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithColumnNames:(NSArray/*<NSString>*/ *)columnNames notes:(NSString *)notes timestamp:(double)timestamp values:(RWIProtocolJSONObject *)values payload:(RWIProtocolJSONObject *)payload error:(TestProtocolDatabaseError *)error errorList:(NSArray/*<TestProtocolDatabaseError>*/ *)errorList
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(columnNames, @"columnNames");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(notes, @"notes");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(values, @"values");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload, @"payload");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(error, @"error");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(errorList, @"errorList");
+    THROW_EXCEPTION_FOR_BAD_TYPE_IN_ARRAY(errorList, [TestProtocolDatabaseError class]);
+
+    self.columnNames = columnNames;
+    self.notes = notes;
+    self.timestamp = timestamp;
+    self.values = values;
+    self.payload = payload;
+    self.error = error;
+    self.errorList = errorList;
+
+    return self;
+}
+
+- (void)setColumnNames:(NSArray/*<NSString>*/ *)columnNames
+{
+    [super setInspectorArray:inspectorStringArray(columnNames) forKey:@"columnNames"];
+}
+
+- (NSArray/*<NSString>*/ *)columnNames
+{
+    return objcStringArray([super inspectorArrayForKey:@"columnNames"]);
+}
+
+- (void)setNotes:(NSString *)notes
+{
+    [super setString:notes forKey:@"notes"];
+}
+
+- (NSString *)notes
+{
+    return [super stringForKey:@"notes"];
+}
+
+- (void)setTimestamp:(double)timestamp
+{
+    [super setDouble:timestamp forKey:@"timestamp"];
+}
+
+- (double)timestamp
+{
+    return [super doubleForKey:@"timestamp"];
+}
+
+- (void)setValues:(RWIProtocolJSONObject *)values
+{
+    [super setObject:values forKey:@"values"];
+}
+
+- (RWIProtocolJSONObject *)values
+{
+    return [[RWIProtocolJSONObject alloc] initWithInspectorObject:[[super objectForKey:@"values"] toInspectorObject].get()];
+}
+
+- (void)setPayload:(RWIProtocolJSONObject *)payload
+{
+    [super setObject:payload forKey:@"payload"];
+}
+
+- (RWIProtocolJSONObject *)payload
+{
+    return [[RWIProtocolJSONObject alloc] initWithInspectorObject:[[super objectForKey:@"payload"] toInspectorObject].get()];
+}
+
+- (void)setError:(TestProtocolDatabaseError *)error
+{
+    [super setObject:error forKey:@"error"];
+}
+
+- (TestProtocolDatabaseError *)error
+{
+    return [[TestProtocolDatabaseError alloc] initWithInspectorObject:[[super objectForKey:@"error"] toInspectorObject].get()];
+}
+
+- (void)setErrorList:(NSArray/*<TestProtocolDatabaseError>*/ *)errorList
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE_IN_ARRAY(errorList, [TestProtocolDatabaseError class]);
+    [super setInspectorArray:inspectorObjectArray(errorList) forKey:@"errorList"];
+}
+
+- (NSArray/*<TestProtocolDatabaseError>*/ *)errorList
+{
+    return objcArray<TestProtocolDatabaseError>([super inspectorArrayForKey:@"errorList"]);
+}
+
+@end
+
+@implementation TestProtocolDatabaseObjectWithPropertyNameConflicts
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"integer"], @"integer");
+    self.integer = payload[@"integer"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"array"], @"array");
+    self.array = payload[@"array"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"string"], @"string");
+    self.string = payload[@"string"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"value"], @"value");
+    self.value = payload[@"value"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"object"], @"object");
+    self.object = payload[@"object"];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithInteger:(NSString *)integer array:(NSString *)array string:(NSString *)string value:(NSString *)value object:(NSString *)object
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(integer, @"integer");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(array, @"array");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(string, @"string");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(value, @"value");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(object, @"object");
+
+    self.integer = integer;
+    self.array = array;
+    self.string = string;
+    self.value = value;
+    self.object = object;
+
+    return self;
+}
+
+- (void)setInteger:(NSString *)integer
+{
+    [super setString:integer forKey:@"integer"];
+}
+
+- (NSString *)integer
+{
+    return [super stringForKey:@"integer"];
+}
+
+- (void)setArray:(NSString *)array
+{
+    [super setString:array forKey:@"array"];
+}
+
+- (NSString *)array
+{
+    return [super stringForKey:@"array"];
+}
+
+- (void)setString:(NSString *)string
+{
+    [super setString:string forKey:@"string"];
+}
+
+- (NSString *)string
+{
+    return [super stringForKey:@"string"];
+}
+
+- (void)setValue:(NSString *)value
+{
+    [super setString:value forKey:@"value"];
+}
+
+- (NSString *)value
+{
+    return [super stringForKey:@"value"];
+}
+
+- (void)setObject:(NSString *)object
+{
+    [super setString:object forKey:@"object"];
+}
+
+- (NSString *)object
+{
+    return [super stringForKey:@"object"];
+}
+
+@end
+
+@implementation TestProtocolDatabaseDummyObject
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+@end
+
+
+@implementation TestProtocolTestParameterBundle
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"columnNames"], @"columnNames");
+    self.columnNames = objcArrayFromPayload<NSString>(payload[@"columnNames"]);
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"notes"], @"notes");
+    self.notes = payload[@"notes"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"timestamp"], @"timestamp");
+    self.timestamp = [payload[@"timestamp"] doubleValue];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"values"], @"values");
+    self.values = payload[@"values"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"payload"], @"payload");
+    self.payload = payload[@"payload"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"error"], @"error");
+    self.error = [[TestProtocolDatabaseError alloc] initWithPayload:payload[@"error"]];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithColumnNames:(NSArray/*<NSString>*/ *)columnNames notes:(NSString *)notes timestamp:(double)timestamp values:(RWIProtocolJSONObject *)values payload:(RWIProtocolJSONObject *)payload error:(TestProtocolDatabaseError *)error
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(columnNames, @"columnNames");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(notes, @"notes");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(values, @"values");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload, @"payload");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(error, @"error");
+
+    self.columnNames = columnNames;
+    self.notes = notes;
+    self.timestamp = timestamp;
+    self.values = values;
+    self.payload = payload;
+    self.error = error;
+
+    return self;
+}
+
+- (void)setColumnNames:(NSArray/*<NSString>*/ *)columnNames
+{
+    [super setInspectorArray:inspectorStringArray(columnNames) forKey:@"columnNames"];
+}
+
+- (NSArray/*<NSString>*/ *)columnNames
+{
+    return objcStringArray([super inspectorArrayForKey:@"columnNames"]);
+}
+
+- (void)setNotes:(NSString *)notes
+{
+    [super setString:notes forKey:@"notes"];
+}
+
+- (NSString *)notes
+{
+    return [super stringForKey:@"notes"];
+}
+
+- (void)setTimestamp:(double)timestamp
+{
+    [super setDouble:timestamp forKey:@"timestamp"];
+}
+
+- (double)timestamp
+{
+    return [super doubleForKey:@"timestamp"];
+}
+
+- (void)setValues:(RWIProtocolJSONObject *)values
+{
+    [super setObject:values forKey:@"values"];
+}
+
+- (RWIProtocolJSONObject *)values
+{
+    return [[RWIProtocolJSONObject alloc] initWithInspectorObject:[[super objectForKey:@"values"] toInspectorObject].get()];
+}
+
+- (void)setPayload:(RWIProtocolJSONObject *)payload
+{
+    [super setObject:payload forKey:@"payload"];
+}
+
+- (RWIProtocolJSONObject *)payload
+{
+    return [[RWIProtocolJSONObject alloc] initWithInspectorObject:[[super objectForKey:@"payload"] toInspectorObject].get()];
+}
+
+- (void)setError:(TestProtocolDatabaseError *)error
+{
+    [super setObject:error forKey:@"error"];
+}
+
+- (TestProtocolDatabaseError *)error
+{
+    return [[TestProtocolDatabaseError alloc] initWithInspectorObject:[[super objectForKey:@"error"] toInspectorObject].get()];
+}
+
+@end
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result b/inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result
new file mode 100644
index 0000000..f1fd2ac
--- /dev/null
+++ b/inspector/scripts/tests/expected/type-requiring-runtime-casts.json-result
@@ -0,0 +1,1588 @@
+### Begin File: InspectorBackendCommands.js
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+// Test.
+InspectorBackend.registerEnum("Test.UncastedAnimals", {Pigs: "Pigs", Cows: "Cows", Cats: "Cats", Hens: "Hens"});
+InspectorBackend.registerEnum("Test.CastedAnimals", {Ducks: "Ducks", Hens: "Hens", Crows: "Crows", Flamingos: "Flamingos"});
+### End File: InspectorBackendCommands.js
+
+### Begin File: TestAlternateBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+
+#include "TestProtocolTypes.h"
+#include <inspector/InspectorFrontendRouter.h>
+#include <JavaScriptCore/InspectorBackendDispatcher.h>
+
+namespace Inspector {
+
+class AlternateBackendDispatcher {
+public:
+    void setBackendDispatcher(RefPtr<BackendDispatcher>&& dispatcher) { m_backendDispatcher = WTFMove(dispatcher); }
+    BackendDispatcher* backendDispatcher() const { return m_backendDispatcher.get(); }
+private:
+    RefPtr<BackendDispatcher> m_backendDispatcher;
+};
+
+
+
+
+} // namespace Inspector
+
+#endif // ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+### End File: TestAlternateBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorBackendDispatcher.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+typedef String ErrorString;
+
+
+
+} // namespace Inspector
+### End File: TestBackendDispatchers.h
+
+### Begin File: TestBackendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestBackendDispatchers.h"
+
+#include <inspector/InspectorFrontendRouter.h>
+#include <inspector/InspectorValues.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
+#include "TestAlternateBackendDispatchers.h"
+#endif
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestBackendDispatchers.cpp
+
+### Begin File: TestFrontendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include "TestProtocolObjects.h"
+#include <inspector/InspectorValues.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector {
+
+class FrontendRouter;
+
+} // namespace Inspector
+### End File: TestFrontendDispatchers.h
+
+### Begin File: TestFrontendDispatchers.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestFrontendDispatchers.h"
+
+#include "InspectorFrontendRouter.h"
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+} // namespace Inspector
+
+### End File: TestFrontendDispatchers.cpp
+
+### Begin File: TestProtocolObjects.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#pragma once
+
+#include <inspector/InspectorProtocolTypes.h>
+#include <wtf/Assertions.h>
+
+namespace Inspector {
+
+
+
+namespace Protocol {
+
+// Forward declarations.
+namespace Test {
+class TypeNeedingCast;
+class RecursiveObject1;
+class RecursiveObject2;
+enum class UncastedAnimals;
+enum class CastedAnimals;
+} // Test
+// End of forward declarations.
+
+
+// Typedefs.
+namespace Test {
+typedef int CastedObjectId;
+typedef int UncastedObjectId;
+} // Test
+// End of typedefs.
+
+namespace TestHelpers {
+
+String getEnumConstantValue(int code);
+
+template<typename T> String getEnumConstantValue(T enumValue)
+{
+    return getEnumConstantValue(static_cast<int>(enumValue));
+}
+
+} // namespace TestHelpers
+
+namespace Test {
+/* A dummy type that requires runtime casts, and forces non-primitive referenced types to also emit runtime cast helpers. */
+class TypeNeedingCast : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        StringSet = 1 << 0,
+        NumberSet = 1 << 1,
+        AnimalsSet = 1 << 2,
+        IdSet = 1 << 3,
+        TreeSet = 1 << 4,
+        AllFieldsSet = (StringSet | NumberSet | AnimalsSet | IdSet | TreeSet)
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*TypeNeedingCast*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class TypeNeedingCast;
+    public:
+
+        Builder<STATE | StringSet>& setString(const String& value)
+        {
+            COMPILE_ASSERT(!(STATE & StringSet), property_string_already_set);
+            m_result->setString(ASCIILiteral("string"), value);
+            return castState<StringSet>();
+        }
+
+        Builder<STATE | NumberSet>& setNumber(int value)
+        {
+            COMPILE_ASSERT(!(STATE & NumberSet), property_number_already_set);
+            m_result->setInteger(ASCIILiteral("number"), value);
+            return castState<NumberSet>();
+        }
+
+        Builder<STATE | AnimalsSet>& setAnimals(Inspector::Protocol::Test::CastedAnimals value)
+        {
+            COMPILE_ASSERT(!(STATE & AnimalsSet), property_animals_already_set);
+            m_result->setString(ASCIILiteral("animals"), Inspector::Protocol::TestHelpers::getEnumConstantValue(value));
+            return castState<AnimalsSet>();
+        }
+
+        Builder<STATE | IdSet>& setId(int value)
+        {
+            COMPILE_ASSERT(!(STATE & IdSet), property_id_already_set);
+            m_result->setInteger(ASCIILiteral("id"), value);
+            return castState<IdSet>();
+        }
+
+        Builder<STATE | TreeSet>& setTree(RefPtr<Inspector::Protocol::Test::RecursiveObject1> value)
+        {
+            COMPILE_ASSERT(!(STATE & TreeSet), property_tree_already_set);
+            m_result->setObject(ASCIILiteral("tree"), value);
+            return castState<TreeSet>();
+        }
+
+        Ref<TypeNeedingCast> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(TypeNeedingCast) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<TypeNeedingCast>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<TypeNeedingCast> result = TypeNeedingCast::create()
+     *     .setString(...)
+     *     .setNumber(...)
+     *     .setAnimals(...)
+     *     .setId(...)
+     *     .setTree(...)
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+};
+
+/*  */
+enum class UncastedAnimals {
+    Pigs = 4,
+    Cows = 5,
+    Cats = 6,
+    Hens = 1,
+}; // enum class UncastedAnimals
+/*  */
+enum class CastedAnimals {
+    Ducks = 0,
+    Hens = 1,
+    Crows = 2,
+    Flamingos = 3,
+}; // enum class CastedAnimals
+class RecursiveObject1 : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        AllFieldsSet = 0
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*RecursiveObject1*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class RecursiveObject1;
+    public:
+
+        Ref<RecursiveObject1> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(RecursiveObject1) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<RecursiveObject1>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<RecursiveObject1> result = RecursiveObject1::create()
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+
+    void setObj(RefPtr<Inspector::Protocol::Test::RecursiveObject2> value)
+    {
+        InspectorObjectBase::setObject(ASCIILiteral("obj"), WTFMove(value));
+    }
+};
+
+class RecursiveObject2 : public Inspector::InspectorObjectBase {
+public:
+    enum {
+        NoFieldsSet = 0,
+        AllFieldsSet = 0
+    };
+
+    template<int STATE>
+    class Builder {
+    private:
+        RefPtr<InspectorObject> m_result;
+
+        template<int STEP> Builder<STATE | STEP>& castState()
+        {
+            return *reinterpret_cast<Builder<STATE | STEP>*>(this);
+        }
+
+        Builder(Ref</*RecursiveObject2*/InspectorObject>&& object)
+            : m_result(WTFMove(object))
+        {
+            COMPILE_ASSERT(STATE == NoFieldsSet, builder_created_in_non_init_state);
+        }
+        friend class RecursiveObject2;
+    public:
+
+        Ref<RecursiveObject2> release()
+        {
+            COMPILE_ASSERT(STATE == AllFieldsSet, result_is_not_ready);
+            COMPILE_ASSERT(sizeof(RecursiveObject2) == sizeof(InspectorObject), cannot_cast);
+
+            Ref<InspectorObject> result = m_result.releaseNonNull();
+            return WTFMove(*reinterpret_cast<Ref<RecursiveObject2>*>(&result));
+        }
+    };
+
+    /*
+     * Synthetic constructor:
+     * Ref<RecursiveObject2> result = RecursiveObject2::create()
+     *     .release();
+     */
+    static Builder<NoFieldsSet> create()
+    {
+        return Builder<NoFieldsSet>(InspectorObject::create());
+    }
+
+    void setObj(RefPtr<Inspector::Protocol::Test::RecursiveObject1> value)
+    {
+        InspectorObjectBase::setObject(ASCIILiteral("obj"), WTFMove(value));
+    }
+};
+
+} // Test
+
+template<> struct BindingTraits<Inspector::Protocol::Test::CastedAnimals> {
+#if !ASSERT_DISABLED
+static void assertValueHasExpectedType(Inspector::InspectorValue*);
+#endif // !ASSERT_DISABLED
+};
+template<> struct BindingTraits<Inspector::Protocol::Test::TypeNeedingCast> {
+static RefPtr<Inspector::Protocol::Test::TypeNeedingCast> runtimeCast(RefPtr<Inspector::InspectorValue>&& value);
+#if !ASSERT_DISABLED
+static void assertValueHasExpectedType(Inspector::InspectorValue*);
+#endif // !ASSERT_DISABLED
+};
+template<> struct BindingTraits<Inspector::Protocol::Test::RecursiveObject1> {
+#if !ASSERT_DISABLED
+static void assertValueHasExpectedType(Inspector::InspectorValue*);
+#endif // !ASSERT_DISABLED
+};
+template<> struct BindingTraits<Inspector::Protocol::Test::RecursiveObject2> {
+#if !ASSERT_DISABLED
+static void assertValueHasExpectedType(Inspector::InspectorValue*);
+#endif // !ASSERT_DISABLED
+};
+
+namespace TestHelpers {
+
+template<typename ProtocolEnumType>
+std::optional<ProtocolEnumType> parseEnumValueFromString(const String&);
+
+// Enums in the 'Test' Domain
+template<>
+std::optional<Inspector::Protocol::Test::UncastedAnimals> parseEnumValueFromString<Inspector::Protocol::Test::UncastedAnimals>(const String&);
+template<>
+std::optional<Inspector::Protocol::Test::CastedAnimals> parseEnumValueFromString<Inspector::Protocol::Test::CastedAnimals>(const String&);
+
+} // namespace TestHelpers
+
+} // namespace Protocol
+
+} // namespace Inspector
+### End File: TestProtocolObjects.h
+
+### Begin File: TestProtocolObjects.cpp
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include "config.h"
+#include "TestProtocolObjects.h"
+
+#include <wtf/Optional.h>
+#include <wtf/text/CString.h>
+
+namespace Inspector {
+
+namespace Protocol {
+
+namespace TestHelpers {
+
+static const char* const enum_constant_values[] = {
+    "Ducks",
+    "Hens",
+    "Crows",
+    "Flamingos",
+    "Pigs",
+    "Cows",
+    "Cats",
+};
+
+String getEnumConstantValue(int code) {
+    return enum_constant_values[code];
+}
+
+// Enums in the 'Test' Domain
+template<>
+std::optional<Inspector::Protocol::Test::UncastedAnimals> parseEnumValueFromString<Inspector::Protocol::Test::UncastedAnimals>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::Test::UncastedAnimals::Pigs,
+        (size_t)Inspector::Protocol::Test::UncastedAnimals::Cows,
+        (size_t)Inspector::Protocol::Test::UncastedAnimals::Cats,
+        (size_t)Inspector::Protocol::Test::UncastedAnimals::Hens,
+    };
+    for (size_t i = 0; i < 4; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::Test::UncastedAnimals)constantValues[i];
+
+    return std::nullopt;
+}
+
+template<>
+std::optional<Inspector::Protocol::Test::CastedAnimals> parseEnumValueFromString<Inspector::Protocol::Test::CastedAnimals>(const String& protocolString)
+{
+    static const size_t constantValues[] = {
+        (size_t)Inspector::Protocol::Test::CastedAnimals::Ducks,
+        (size_t)Inspector::Protocol::Test::CastedAnimals::Hens,
+        (size_t)Inspector::Protocol::Test::CastedAnimals::Crows,
+        (size_t)Inspector::Protocol::Test::CastedAnimals::Flamingos,
+    };
+    for (size_t i = 0; i < 4; ++i)
+        if (protocolString == enum_constant_values[constantValues[i]])
+            return (Inspector::Protocol::Test::CastedAnimals)constantValues[i];
+
+    return std::nullopt;
+}
+
+
+} // namespace TestHelpers
+
+
+
+#if !ASSERT_DISABLED
+void BindingTraits<Inspector::Protocol::Test::CastedAnimals>::assertValueHasExpectedType(Inspector::InspectorValue* value)
+{
+    ASSERT_ARG(value, value);
+    String result;
+    bool castSucceeded = value->asString(result);
+    ASSERT(castSucceeded);
+    ASSERT(result == "Ducks" || result == "Hens" || result == "Crows" || result == "Flamingos");
+}
+#endif // !ASSERT_DISABLED
+
+#if !ASSERT_DISABLED
+void BindingTraits<Inspector::Protocol::Test::TypeNeedingCast>::assertValueHasExpectedType(Inspector::InspectorValue* value)
+{
+    ASSERT_ARG(value, value);
+    RefPtr<InspectorObject> object;
+    bool castSucceeded = value->asObject(object);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+    {
+        InspectorObject::iterator stringPos = object->find(ASCIILiteral("string"));
+        ASSERT(stringPos != object->end());
+        BindingTraits<String>::assertValueHasExpectedType(stringPos->value.get());
+    }
+    {
+        InspectorObject::iterator numberPos = object->find(ASCIILiteral("number"));
+        ASSERT(numberPos != object->end());
+        BindingTraits<int>::assertValueHasExpectedType(numberPos->value.get());
+    }
+    {
+        InspectorObject::iterator animalsPos = object->find(ASCIILiteral("animals"));
+        ASSERT(animalsPos != object->end());
+        BindingTraits<Inspector::Protocol::Test::CastedAnimals>::assertValueHasExpectedType(animalsPos->value.get());
+    }
+    {
+        InspectorObject::iterator idPos = object->find(ASCIILiteral("id"));
+        ASSERT(idPos != object->end());
+        BindingTraits<int>::assertValueHasExpectedType(idPos->value.get());
+    }
+    {
+        InspectorObject::iterator treePos = object->find(ASCIILiteral("tree"));
+        ASSERT(treePos != object->end());
+        BindingTraits<Inspector::Protocol::Test::RecursiveObject1>::assertValueHasExpectedType(treePos->value.get());
+    }
+
+    int foundPropertiesCount = 5;
+    if (foundPropertiesCount != object->size())
+        FATAL("Unexpected properties in object: %s\n", object->toJSONString().ascii().data());
+}
+#endif // !ASSERT_DISABLED
+
+RefPtr<Inspector::Protocol::Test::TypeNeedingCast> BindingTraits<Inspector::Protocol::Test::TypeNeedingCast>::runtimeCast(RefPtr<InspectorValue>&& value)
+{
+    RefPtr<InspectorObject> result;
+    bool castSucceeded = value->asObject(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+#if !ASSERT_DISABLED
+    BindingTraits<Inspector::Protocol::Test::TypeNeedingCast>::assertValueHasExpectedType(result.get());
+#endif  // !ASSERT_DISABLED
+    COMPILE_ASSERT(sizeof(Inspector::Protocol::Test::TypeNeedingCast) == sizeof(InspectorObjectBase), type_cast_problem);
+    return static_cast<Inspector::Protocol::Test::TypeNeedingCast*>(static_cast<InspectorObjectBase*>(result.get()));
+}
+
+
+#if !ASSERT_DISABLED
+void BindingTraits<Inspector::Protocol::Test::RecursiveObject1>::assertValueHasExpectedType(Inspector::InspectorValue* value)
+{
+    ASSERT_ARG(value, value);
+    RefPtr<InspectorObject> object;
+    bool castSucceeded = value->asObject(object);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    int foundPropertiesCount = 0;
+    {
+        InspectorObject::iterator objPos = object->find(ASCIILiteral("obj"));
+        if (objPos != object->end()) {
+            BindingTraits<Inspector::Protocol::Test::RecursiveObject2>::assertValueHasExpectedType(objPos->value.get());
+            ++foundPropertiesCount;
+        }
+    }
+    if (foundPropertiesCount != object->size())
+        FATAL("Unexpected properties in object: %s\n", object->toJSONString().ascii().data());
+}
+#endif // !ASSERT_DISABLED
+
+#if !ASSERT_DISABLED
+void BindingTraits<Inspector::Protocol::Test::RecursiveObject2>::assertValueHasExpectedType(Inspector::InspectorValue* value)
+{
+    ASSERT_ARG(value, value);
+    RefPtr<InspectorObject> object;
+    bool castSucceeded = value->asObject(object);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    int foundPropertiesCount = 0;
+    {
+        InspectorObject::iterator objPos = object->find(ASCIILiteral("obj"));
+        if (objPos != object->end()) {
+            BindingTraits<Inspector::Protocol::Test::RecursiveObject1>::assertValueHasExpectedType(objPos->value.get());
+            ++foundPropertiesCount;
+        }
+    }
+    if (foundPropertiesCount != object->size())
+        FATAL("Unexpected properties in object: %s\n", object->toJSONString().ascii().data());
+}
+#endif // !ASSERT_DISABLED
+
+} // namespace Protocol
+
+} // namespace Inspector
+
+### End File: TestProtocolObjects.cpp
+
+### Begin File: TestProtocolBackendDispatchers.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#include <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#include <wtf/RetainPtr.h>
+
+
+
+namespace Inspector {
+
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.h
+
+### Begin File: TestProtocolConfiguration.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolConfiguration.h"
+
+#import "TestProtocolInternal.h"
+#import "TestProtocolBackendDispatchers.h"
+#import <JavaScriptCore/AlternateDispatchableAgent.h>
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorAlternateBackendDispatchers.h>
+#import <JavaScriptCore/InspectorBackendDispatchers.h>
+
+using namespace Inspector;
+
+@implementation TestProtocolConfiguration
+{
+    AugmentableInspectorController* _controller;
+}
+
+- (instancetype)initWithController:(AugmentableInspectorController*)controller
+{
+    self = [super init];
+    if (!self)
+        return nil;
+    ASSERT(controller);
+    _controller = controller;
+    return self;
+}
+
+- (void)dealloc
+{
+    [super dealloc];
+}
+
+@end
+
+
+### End File: TestProtocolConfiguration.mm
+
+### Begin File: TestProtocolConfiguration.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <WebInspector/TestProtocol.h>
+
+__attribute__((visibility ("default")))
+@interface TestProtocolConfiguration : NSObject
+@end
+
+
+### End File: TestProtocolConfiguration.h
+
+### Begin File: TestProtocolBackendDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolBackendDispatchers.h"
+
+#include "TestProtocolInternal.h"
+#include "TestProtocolTypeConversions.h"
+#include <JavaScriptCore/InspectorValues.h>
+
+namespace Inspector {
+
+
+
+} // namespace Inspector
+
+### End File: TestProtocolBackendDispatchers.mm
+
+### Begin File: TestProtocolEventDispatchers.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <JavaScriptCore/InspectorValues.h>
+
+using namespace Inspector;
+
+
+
+
+### End File: TestProtocolEventDispatchers.mm
+
+### Begin File: TestProtocol.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import <Foundation/Foundation.h>
+
+#import <WebInspector/RWIProtocolJSONObject.h>
+
+
+@class TestProtocolTestTypeNeedingCast;
+@class TestProtocolTestRecursiveObject1;
+@class TestProtocolTestRecursiveObject2;
+
+
+typedef NS_ENUM(NSInteger, TestProtocolTestUncastedAnimals) {
+    TestProtocolTestUncastedAnimalsPigs,
+    TestProtocolTestUncastedAnimalsCows,
+    TestProtocolTestUncastedAnimalsCats,
+    TestProtocolTestUncastedAnimalsHens,
+};
+
+typedef NS_ENUM(NSInteger, TestProtocolTestCastedAnimals) {
+    TestProtocolTestCastedAnimalsDucks,
+    TestProtocolTestCastedAnimalsHens,
+    TestProtocolTestCastedAnimalsCrows,
+    TestProtocolTestCastedAnimalsFlamingos,
+};
+
+
+__attribute__((visibility ("default")))
+@interface TestProtocolTestTypeNeedingCast : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+- (instancetype)initWithString:(NSString *)string number:(int)number animals:(TestProtocolTestCastedAnimals)animals identifier:(int)identifier tree:(TestProtocolTestRecursiveObject1 *)tree;
+/* required */ @property (nonatomic, copy) NSString *string;
+/* required */ @property (nonatomic, assign) int number;
+/* required */ @property (nonatomic, assign) TestProtocolTestCastedAnimals animals;
+/* required */ @property (nonatomic, assign) int identifier;
+/* required */ @property (nonatomic, retain) TestProtocolTestRecursiveObject1 *tree;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolTestRecursiveObject1 : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+/* optional */ @property (nonatomic, retain) TestProtocolTestRecursiveObject2 *obj;
+@end
+
+__attribute__((visibility ("default")))
+@interface TestProtocolTestRecursiveObject2 : RWIProtocolJSONObject
+- (instancetype)initWithPayload:(NSDictionary<NSString *, id> *)payload;
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject;
+/* optional */ @property (nonatomic, retain) TestProtocolTestRecursiveObject1 *obj;
+@end
+
+
+
+
+
+
+### End File: TestProtocol.h
+
+### Begin File: TestProtocolInternal.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import "TestProtocolJSONObjectPrivate.h"
+#import <JavaScriptCore/AugmentableInspectorController.h>
+#import <JavaScriptCore/InspectorValues.h>
+
+
+
+
+### End File: TestProtocolInternal.h
+
+### Begin File: TestProtocolTypeConversions.h
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "TestProtocol.h"
+#import <WebInspector/RWIProtocolArrayConversions.h>
+
+namespace Inspector {
+
+template<typename ObjCEnumType>
+ObjCEnumType fromProtocolString(const String& value);
+
+
+inline String toProtocolString(TestProtocolTestUncastedAnimals value)
+{
+    switch(value) {
+    case TestProtocolTestUncastedAnimalsPigs:
+        return ASCIILiteral("Pigs");
+    case TestProtocolTestUncastedAnimalsCows:
+        return ASCIILiteral("Cows");
+    case TestProtocolTestUncastedAnimalsCats:
+        return ASCIILiteral("Cats");
+    case TestProtocolTestUncastedAnimalsHens:
+        return ASCIILiteral("Hens");
+    }
+}
+
+template<>
+inline TestProtocolTestUncastedAnimals fromProtocolString(const String& value)
+{
+    if (value == "Pigs")
+        return TestProtocolTestUncastedAnimalsPigs;
+    if (value == "Cows")
+        return TestProtocolTestUncastedAnimalsCows;
+    if (value == "Cats")
+        return TestProtocolTestUncastedAnimalsCats;
+    if (value == "Hens")
+        return TestProtocolTestUncastedAnimalsHens;
+    ASSERT_NOT_REACHED();
+    return TestProtocolTestUncastedAnimalsPigs;
+}
+
+inline String toProtocolString(TestProtocolTestCastedAnimals value)
+{
+    switch(value) {
+    case TestProtocolTestCastedAnimalsDucks:
+        return ASCIILiteral("Ducks");
+    case TestProtocolTestCastedAnimalsHens:
+        return ASCIILiteral("Hens");
+    case TestProtocolTestCastedAnimalsCrows:
+        return ASCIILiteral("Crows");
+    case TestProtocolTestCastedAnimalsFlamingos:
+        return ASCIILiteral("Flamingos");
+    }
+}
+
+template<>
+inline TestProtocolTestCastedAnimals fromProtocolString(const String& value)
+{
+    if (value == "Ducks")
+        return TestProtocolTestCastedAnimalsDucks;
+    if (value == "Hens")
+        return TestProtocolTestCastedAnimalsHens;
+    if (value == "Crows")
+        return TestProtocolTestCastedAnimalsCrows;
+    if (value == "Flamingos")
+        return TestProtocolTestCastedAnimalsFlamingos;
+    ASSERT_NOT_REACHED();
+    return TestProtocolTestCastedAnimalsDucks;
+}
+
+} // namespace Inspector
+
+### End File: TestProtocolTypeConversions.h
+
+### Begin File: TestProtocolTypeConversions.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolTypeConversions.h"
+
+#import "TestProtocol.h"
+#import "TestProtocolTypeParser.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+
+using namespace Inspector;
+
+@interface TestProtocolTypeConversions (TestDomain)
+
++ (void)_parseTypeNeedingCast:(TestProtocolTestTypeNeedingCast **)outValue fromPayload:(id)payload;
++ (void)_parseCastedObjectId:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseUncastedObjectId:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseUncastedAnimals:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseCastedAnimals:(NSNumber **)outValue fromPayload:(id)payload;
++ (void)_parseRecursiveObject1:(TestProtocolTestRecursiveObject1 **)outValue fromPayload:(id)payload;
++ (void)_parseRecursiveObject2:(TestProtocolTestRecursiveObject2 **)outValue fromPayload:(id)payload;
+
+@end
+
+@implementation TestProtocolTypeConversions (TestDomain)
+
++ (void)_parseTypeNeedingCast:(TestProtocolTestTypeNeedingCast **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolTestTypeNeedingCast alloc] initWithPayload:payload];
+}
+
++ (void)_parseCastedObjectId:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSNumber class]);
+    *outValue = (NSNumber *)payload;
+}
+
++ (void)_parseUncastedObjectId:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSNumber class]);
+    *outValue = (NSNumber *)payload;
+}
+
++ (void)_parseUncastedAnimals:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = @(Inspector::fromProtocolString<TestProtocolTestUncastedAnimals>(payload));
+}
+
++ (void)_parseCastedAnimals:(NSNumber **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSString class]);
+    *outValue = @(Inspector::fromProtocolString<TestProtocolTestCastedAnimals>(payload));
+}
+
++ (void)_parseRecursiveObject1:(TestProtocolTestRecursiveObject1 **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolTestRecursiveObject1 alloc] initWithPayload:payload];
+}
+
++ (void)_parseRecursiveObject2:(TestProtocolTestRecursiveObject2 **)outValue fromPayload:(id)payload
+{
+    THROW_EXCEPTION_FOR_BAD_TYPE(payload, [NSDictionary class]);
+    *outValue = [[TestProtocolTestRecursiveObject2 alloc] initWithPayload:payload];
+}
+
+@end
+
+
+### End File: TestProtocolTypeConversions.mm
+
+### Begin File: TestProtocolTypes.mm
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 University of Washington. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from type-requiring-runtime-casts.json
+// by the script: Source/JavaScriptCore/inspector/scripts/generate-inspector-protocol-bindings.py
+
+#import "config.h"
+#import "TestProtocolInternal.h"
+
+#import "TestProtocolTypeConversions.h"
+#import <WebInspector/RWIProtocolJSONObjectPrivate.h>
+#import <JavaScriptCore/InspectorValues.h>
+#import <wtf/Assertions.h>
+
+using namespace Inspector;
+
+
+@implementation TestProtocolTestTypeNeedingCast
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"string"], @"string");
+    self.string = payload[@"string"];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"number"], @"number");
+    self.number = [payload[@"number"] integerValue];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"animals"], @"animals");
+    self.animals = fromProtocolString<TestProtocolTestCastedAnimals>(payload[@"animals"]);
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"identifier"], @"identifier");
+    self.identifier = [payload[@"id"] integerValue];
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(payload[@"tree"], @"tree");
+    self.tree = [[TestProtocolTestRecursiveObject1 alloc] initWithPayload:payload[@"tree"]];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (instancetype)initWithString:(NSString *)string number:(int)number animals:(TestProtocolTestCastedAnimals)animals identifier:(int)identifier tree:(TestProtocolTestRecursiveObject1 *)tree
+{
+    if (!(self = [super init]))
+        return nil;
+
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(string, @"string");
+    THROW_EXCEPTION_FOR_REQUIRED_PROPERTY(tree, @"tree");
+
+    self.string = string;
+    self.number = number;
+    self.animals = animals;
+    self.identifier = identifier;
+    self.tree = tree;
+
+    return self;
+}
+
+- (void)setString:(NSString *)string
+{
+    [super setString:string forKey:@"string"];
+}
+
+- (NSString *)string
+{
+    return [super stringForKey:@"string"];
+}
+
+- (void)setNumber:(int)number
+{
+    [super setInteger:number forKey:@"number"];
+}
+
+- (int)number
+{
+    return [super integerForKey:@"number"];
+}
+
+- (void)setAnimals:(TestProtocolTestCastedAnimals)animals
+{
+    [super setString:toProtocolString(animals) forKey:@"animals"];
+}
+
+- (TestProtocolTestCastedAnimals)animals
+{
+    return fromProtocolString<TestProtocolTestCastedAnimals>([super stringForKey:@"animals"]);
+}
+
+- (void)setIdentifier:(int)identifier
+{
+    [super setInteger:identifier forKey:@"id"];
+}
+
+- (int)identifier
+{
+    return [super integerForKey:@"id"];
+}
+
+- (void)setTree:(TestProtocolTestRecursiveObject1 *)tree
+{
+    [super setObject:tree forKey:@"tree"];
+}
+
+- (TestProtocolTestRecursiveObject1 *)tree
+{
+    return [[TestProtocolTestRecursiveObject1 alloc] initWithInspectorObject:[[super objectForKey:@"tree"] toInspectorObject].get()];
+}
+
+@end
+
+@implementation TestProtocolTestRecursiveObject1
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    self.obj = [[TestProtocolTestRecursiveObject2 alloc] initWithPayload:payload[@"obj"]];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (void)setObj:(TestProtocolTestRecursiveObject2 *)obj
+{
+    [super setObject:obj forKey:@"obj"];
+}
+
+- (TestProtocolTestRecursiveObject2 *)obj
+{
+    return [[TestProtocolTestRecursiveObject2 alloc] initWithInspectorObject:[[super objectForKey:@"obj"] toInspectorObject].get()];
+}
+
+@end
+
+@implementation TestProtocolTestRecursiveObject2
+
+- (instancetype)initWithPayload:(nonnull NSDictionary<NSString *, id> *)payload
+{
+    if (!(self = [super init]))
+        return nil;
+
+    self.obj = [[TestProtocolTestRecursiveObject1 alloc] initWithPayload:payload[@"obj"]];
+
+    return self;
+}
+- (instancetype)initWithJSONObject:(RWIProtocolJSONObject *)jsonObject
+{
+    if (!(self = [super initWithInspectorObject:[jsonObject toInspectorObject].get()]))
+        return nil;
+
+    return self;
+}
+
+- (void)setObj:(TestProtocolTestRecursiveObject1 *)obj
+{
+    [super setObject:obj forKey:@"obj"];
+}
+
+- (TestProtocolTestRecursiveObject1 *)obj
+{
+    return [[TestProtocolTestRecursiveObject1 alloc] initWithInspectorObject:[[super objectForKey:@"obj"] toInspectorObject].get()];
+}
+
+@end
+
+
+### End File: TestProtocolTypes.mm
diff --git a/inspector/scripts/tests/fail-on-domain-availability.json b/inspector/scripts/tests/fail-on-domain-availability.json
new file mode 100644
index 0000000..36ee2c6
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-domain-availability.json
@@ -0,0 +1,9 @@
+{
+    "domain": "WebOnly",
+    "availability": "webb",
+    "commands": [
+        {
+            "name": "enable"
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-duplicate-command-call-parameter-names.json b/inspector/scripts/tests/fail-on-duplicate-command-call-parameter-names.json
new file mode 100644
index 0000000..bab76ca
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-duplicate-command-call-parameter-names.json
@@ -0,0 +1,16 @@
+{
+    "domain": "Overlay",
+    "commands": [
+        {
+            "name": "processPoints",
+            "parameters": [
+                { "name": "point", "type": "number" },
+                { "name": "point", "type": "number" }
+            ],
+            "returns": [
+                { "name": "result1", "type": "string" },
+                { "name": "result2", "type": "string" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-duplicate-command-return-parameter-names.json b/inspector/scripts/tests/fail-on-duplicate-command-return-parameter-names.json
new file mode 100644
index 0000000..c8bb15c
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-duplicate-command-return-parameter-names.json
@@ -0,0 +1,16 @@
+{
+    "domain": "Overlay",
+    "commands": [
+        {
+            "name": "processPoints",
+            "parameters": [
+                { "name": "point1", "type": "number" },
+                { "name": "point2", "type": "number" }
+            ],
+            "returns": [
+                { "name": "result", "type": "string" },
+                { "name": "result", "type": "string" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-duplicate-event-parameter-names.json b/inspector/scripts/tests/fail-on-duplicate-event-parameter-names.json
new file mode 100644
index 0000000..d3d3b3c
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-duplicate-event-parameter-names.json
@@ -0,0 +1,12 @@
+{
+    "domain": "Overlay",
+    "events": [
+        {
+            "name": "processedPoints",
+            "parameters": [
+                { "name": "point", "type": "number" },
+                { "name": "point", "type": "number" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-duplicate-type-declarations.json b/inspector/scripts/tests/fail-on-duplicate-type-declarations.json
new file mode 100644
index 0000000..702fc6a
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-duplicate-type-declarations.json
@@ -0,0 +1,15 @@
+{
+    "domain": "Runtime",
+    "types": [
+        {
+            "id": "RemoteObjectId",
+            "type": "string",
+            "description": "Unique object identifier."
+        },
+        {
+            "id": "RemoteObjectId",
+            "type": "string",
+            "description": "Unique object identifier."
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-duplicate-type-member-names.json b/inspector/scripts/tests/fail-on-duplicate-type-member-names.json
new file mode 100644
index 0000000..aebacee
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-duplicate-type-member-names.json
@@ -0,0 +1,15 @@
+[
+{
+    "domain": "OverlayTypes",
+    "types": [
+        {
+            "id": "Point",
+            "type": "object",
+            "properties": [
+                { "name": "x", "type": "integer" },
+                { "name": "x", "type": "integer" }
+            ]
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/fail-on-enum-with-no-values.json b/inspector/scripts/tests/fail-on-enum-with-no-values.json
new file mode 100644
index 0000000..232a7c3
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-enum-with-no-values.json
@@ -0,0 +1,10 @@
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "PrimaryColors",
+            "type": "string",
+            "enum": []
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-number-typed-optional-parameter-flag.json b/inspector/scripts/tests/fail-on-number-typed-optional-parameter-flag.json
new file mode 100644
index 0000000..7308db9
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-number-typed-optional-parameter-flag.json
@@ -0,0 +1,18 @@
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "DatabaseId",
+            "type": "string",
+            "description": "Unique identifier of Database object."
+        }
+    ],
+    "events": [
+        {
+            "name": "didExecuteOptionalParameters",
+            "parameters": [
+                { "name": "columnNames", "type": "string", "optional": 0 }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-number-typed-optional-type-member.json b/inspector/scripts/tests/fail-on-number-typed-optional-type-member.json
new file mode 100644
index 0000000..afea555
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-number-typed-optional-type-member.json
@@ -0,0 +1,16 @@
+[
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "Error",
+            "type": "object",
+            "description": "Database error.",
+            "properties": [
+                { "name": "message", "type": "string", "description": "Error message." },
+                { "name": "code", "type": "integer", "description": "Error code.", "optional": 0 }
+            ]
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/fail-on-string-typed-optional-parameter-flag.json b/inspector/scripts/tests/fail-on-string-typed-optional-parameter-flag.json
new file mode 100644
index 0000000..4012c79
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-string-typed-optional-parameter-flag.json
@@ -0,0 +1,18 @@
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "DatabaseId",
+            "type": "string",
+            "description": "Unique identifier of Database object."
+        }
+    ],
+    "events": [
+        {
+            "name": "didExecuteOptionalParameters",
+            "parameters": [
+                { "name": "columnNames", "type": "string", "optional": "true" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-string-typed-optional-type-member.json b/inspector/scripts/tests/fail-on-string-typed-optional-type-member.json
new file mode 100644
index 0000000..ca3ef28
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-string-typed-optional-type-member.json
@@ -0,0 +1,16 @@
+[
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "Error",
+            "type": "object",
+            "description": "Database error.",
+            "properties": [
+                { "name": "message", "type": "string", "description": "Error message." },
+                { "name": "code", "type": "integer", "description": "Error code.", "optional": "false" }
+            ]
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/fail-on-type-declaration-using-type-reference.json b/inspector/scripts/tests/fail-on-type-declaration-using-type-reference.json
new file mode 100644
index 0000000..19b7590
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-type-declaration-using-type-reference.json
@@ -0,0 +1,13 @@
+[
+{
+    "domain": "Runtime",
+    "types": [
+        {
+            "id": "RemoteObjectId",
+            "type": "object",
+            "$ref": "SomeType",
+            "description": "Unique object identifier."
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/fail-on-type-reference-as-primitive-type.json b/inspector/scripts/tests/fail-on-type-reference-as-primitive-type.json
new file mode 100644
index 0000000..8c83bbf
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-type-reference-as-primitive-type.json
@@ -0,0 +1,18 @@
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "DatabaseId",
+            "type": "string",
+            "description": "Unique identifier of Database object."
+        }
+    ],
+    "events": [
+        {
+            "name": "didExecuteOptionalParameters",
+            "parameters": [
+                { "name": "columnNames", "type": "DatabaseId" }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-type-with-lowercase-name.json b/inspector/scripts/tests/fail-on-type-with-lowercase-name.json
new file mode 100644
index 0000000..531901e
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-type-with-lowercase-name.json
@@ -0,0 +1,10 @@
+{
+    "domain": "Database",
+    "types": [
+        {
+            "id": "databaseId",
+            "type": "integer",
+            "description": "Unique identifier of Database object."
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/fail-on-unknown-type-reference-in-type-declaration.json b/inspector/scripts/tests/fail-on-unknown-type-reference-in-type-declaration.json
new file mode 100644
index 0000000..d6887a2
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-unknown-type-reference-in-type-declaration.json
@@ -0,0 +1,12 @@
+[
+{
+    "domain": "Runtime",
+    "types": [
+        {
+            "id": "RemoteObjectId",
+            "type": "dragon",
+            "description": "Unique object identifier."
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/fail-on-unknown-type-reference-in-type-member.json b/inspector/scripts/tests/fail-on-unknown-type-reference-in-type-member.json
new file mode 100644
index 0000000..b817db5
--- /dev/null
+++ b/inspector/scripts/tests/fail-on-unknown-type-reference-in-type-member.json
@@ -0,0 +1,15 @@
+[
+{
+    "domain": "Fantasy",
+    "types": [
+        {
+            "id": "DragonEgg",
+            "type": "object",
+            "description": "A dragon egg.",
+            "properties": [
+                { "name": "color", "$ref": "Color" }
+            ]
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/generate-domains-with-feature-guards.json b/inspector/scripts/tests/generate-domains-with-feature-guards.json
new file mode 100644
index 0000000..67cf8e5
--- /dev/null
+++ b/inspector/scripts/tests/generate-domains-with-feature-guards.json
@@ -0,0 +1,36 @@
+[
+{
+    "domain": "Network1",
+    "featureGuard": "PLATFORM(WEB_COMMANDS)",
+    "commands": [
+        {
+            "name": "loadResource",
+            "description": "Loads a resource in the context of a frame on the inspected page without cross origin checks."
+        }
+    ]
+},
+{
+    "domain": "Network2",
+    "featureGuard": "PLATFORM(WEB_TYPES)",
+    "types": [
+        {
+            "id": "NetworkError",
+            "type": "object",
+            "properties": [
+                { "name": "message", "type": "string", "description": "Error message." },
+                { "name": "code", "type": "integer", "description": "Error code." }
+            ]
+        }
+    ]
+},
+{
+    "domain": "Network3",
+    "featureGuard": "PLATFORM(WEB_EVENTS)",
+    "events": [
+        {
+            "name": "resourceLoaded",
+            "description": "A resource was loaded."
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/same-type-id-different-domain.json b/inspector/scripts/tests/same-type-id-different-domain.json
new file mode 100644
index 0000000..3bf4dff
--- /dev/null
+++ b/inspector/scripts/tests/same-type-id-different-domain.json
@@ -0,0 +1,22 @@
+[
+{
+    "domain": "Runtime",
+    "types": [
+        {
+            "id": "RemoteObjectId",
+            "type": "string",
+            "description": "Unique object identifier."
+        }
+    ]
+},
+{
+    "domain": "Runtime2",
+    "types": [
+        {
+            "id": "RemoteObjectId",
+            "type": "string",
+            "description": "Unique object identifier."
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/shadowed-optional-type-setters.json b/inspector/scripts/tests/shadowed-optional-type-setters.json
new file mode 100644
index 0000000..20a0c15
--- /dev/null
+++ b/inspector/scripts/tests/shadowed-optional-type-setters.json
@@ -0,0 +1,31 @@
+{
+    "domain": "Runtime",
+    "types": [
+        {
+            "id": "KeyPath",
+            "type": "object",
+            "description": "Key path.",
+            "properties": [
+                {
+                    "name": "type",
+                    "type": "string",
+                    "enum": ["null", "string", "array"],
+                    "description": "Key path type."
+                },
+                {
+                    "name": "string",
+                    "type": "string",
+                    "optional": true,
+                    "description": "String value."
+                },
+                {
+                    "name": "array",
+                    "type": "array",
+                    "optional": true,
+                    "items": { "type": "string" },
+                    "description": "Array value."
+                }
+            ]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/type-declaration-aliased-primitive-type.json b/inspector/scripts/tests/type-declaration-aliased-primitive-type.json
new file mode 100644
index 0000000..cbc9d53
--- /dev/null
+++ b/inspector/scripts/tests/type-declaration-aliased-primitive-type.json
@@ -0,0 +1,10 @@
+{
+    "domain": "Runtime",
+    "types": [
+        {
+            "id": "RemoteObjectId",
+            "type": "integer",
+            "description": "Unique object identifier."
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/type-declaration-array-type.json b/inspector/scripts/tests/type-declaration-array-type.json
new file mode 100644
index 0000000..cfb08bd
--- /dev/null
+++ b/inspector/scripts/tests/type-declaration-array-type.json
@@ -0,0 +1,50 @@
+[
+{
+    "domain": "Debugger",
+    "types": [
+        {
+            "id": "BreakpointId",
+            "type": "integer"
+        },
+        {
+            "id": "Reason",
+            "type": "string",
+            "enum": ["Died", "Fainted", "Hungry"]
+        }
+    ]
+},
+{
+    "domain": "Runtime",
+    "types": [
+        {
+            "id": "ObjectId",
+            "type": "integer"
+        },
+        {
+            "id": "LuckyNumbers",
+            "type": "array",
+            "items": { "type": "integer" }
+        },
+        {
+            "id": "BabyNames",
+            "type": "array",
+            "items": { "type": "string" }
+        },
+        {
+            "id": "NewObjects",
+            "type": "array",
+            "items": { "$ref": "ObjectId" }
+        },
+        {
+            "id": "OldObjects",
+            "type": "array",
+            "items": { "$ref": "Debugger.BreakpointId" }
+        },
+        {
+            "id": "StopReasons",
+            "type": "array",
+            "items": { "$ref": "Debugger.Reason" }
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/type-declaration-enum-type.json b/inspector/scripts/tests/type-declaration-enum-type.json
new file mode 100644
index 0000000..9f0aee9
--- /dev/null
+++ b/inspector/scripts/tests/type-declaration-enum-type.json
@@ -0,0 +1,15 @@
+{
+    "domain": "Runtime",
+    "types": [
+        {
+            "id": "FarmAnimals",
+            "type": "string",
+            "enum": ["Pigs", "Cows", "Cats", "Hens"]
+        },
+        {
+            "id": "TwoLeggedAnimals",
+            "type": "string",
+            "enum": ["Ducks", "Hens", "Crows", "Flamingos"]
+        }
+    ]
+}
diff --git a/inspector/scripts/tests/type-declaration-object-type.json b/inspector/scripts/tests/type-declaration-object-type.json
new file mode 100644
index 0000000..1783091
--- /dev/null
+++ b/inspector/scripts/tests/type-declaration-object-type.json
@@ -0,0 +1,83 @@
+[
+{
+    "domain": "Database",
+    "description": "Test type builder generation of various object types.",
+    "types": [
+        {
+            "id": "Error",
+            "type": "object",
+            "description": "Database error.",
+            "properties": [
+                { "name": "message", "type": "string", "description": "Error message." },
+                { "name": "code", "type": "integer", "description": "Error code." }
+            ]
+        },
+        {
+            "id": "ErrorList",
+            "type": "array",
+            "items": { "$ref": "Error" }
+        },
+        {
+            "id": "OptionalParameterBundle",
+            "type": "object",
+            "properties": [
+                { "name": "columnNames", "type": "array", "optional": true, "items": { "type": "string" } },
+                { "name": "notes", "type": "string", "optional": true },
+                { "name": "timestamp", "type": "number", "optional": true },
+                { "name": "values", "type": "object", "optional": true },
+                { "name": "payload", "type": "any", "optional": true },
+                { "name": "error", "$ref": "Error", "optional": true },
+                { "name": "errorList", "$ref": "ErrorList", "optional": true }
+            ]
+        },
+        {
+            "id": "ParameterBundle",
+            "type": "object",
+            "properties": [
+                { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                { "name": "notes", "type": "string" },
+                { "name": "timestamp", "type": "number" },
+                { "name": "values", "type": "object" },
+                { "name": "payload", "type": "any" },
+                { "name": "error", "$ref": "Error" },
+                { "name": "errorList", "$ref": "ErrorList" }
+            ]
+        },
+        {
+            "id": "ObjectWithPropertyNameConflicts",
+            "description": "Conflicted names may cause generated getters/setters to clash with built-in InspectorObject methods.",
+            "type": "object",
+            "properties": [
+                { "name": "integer", "type": "string" },
+                { "name": "array", "type": "string" },
+                { "name": "string", "type": "string" },
+                { "name": "value", "type": "string" },
+                { "name": "object", "type": "string" }
+            ]
+        },
+        {
+            "id": "DummyObject",
+            "description": "An open object that doesn't have any predefined fields.",
+            "type": "object"
+        }
+    ]
+},
+{
+    "domain": "Test",
+    "description": "Test the generation of special behaviors that only apply to specific classes.",
+    "types": [
+        {
+            "id": "ParameterBundle",
+            "type": "object",
+            "properties": [
+                { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                { "name": "notes", "type": "string" },
+                { "name": "timestamp", "type": "number" },
+                { "name": "values", "type": "object" },
+                { "name": "payload", "type": "any" },
+                { "name": "error", "$ref": "Database.Error" }
+            ]
+        }
+    ]
+}
+]
diff --git a/inspector/scripts/tests/type-requiring-runtime-casts.json b/inspector/scripts/tests/type-requiring-runtime-casts.json
new file mode 100644
index 0000000..83d94be
--- /dev/null
+++ b/inspector/scripts/tests/type-requiring-runtime-casts.json
@@ -0,0 +1,51 @@
+[
+{
+    "domain": "Test",
+    "types": [
+        {
+            "id": "TypeNeedingCast",
+            "type": "object",
+            "description": "A dummy type that requires runtime casts, and forces non-primitive referenced types to also emit runtime cast helpers.",
+            "properties": [
+                { "name": "string", "type": "string", "description": "String member." },
+                { "name": "number", "type": "integer", "description": "Number member." },
+                { "name": "animals", "$ref": "CastedAnimals", "description": "Enum member." },
+                { "name": "id", "$ref": "CastedObjectId", "description": "Aliased member." },
+                { "name": "tree", "$ref": "RecursiveObject1", "description": "Recursive object member." }
+            ]
+        },
+        {
+            "id": "CastedObjectId",
+            "type": "integer"
+        },
+        {
+            "id": "UncastedObjectId",
+            "type": "integer"
+        },
+        {
+            "id": "UncastedAnimals",
+            "type": "string",
+            "enum": ["Pigs", "Cows", "Cats", "Hens"]
+        },
+        {
+            "id": "CastedAnimals",
+            "type": "string",
+            "enum": ["Ducks", "Hens", "Crows", "Flamingos"]
+        },
+        {
+            "id": "RecursiveObject1",
+            "type": "object",
+            "properties": [
+                { "name": "obj", "$ref": "RecursiveObject2", "optional": true }
+            ]
+        },
+        {
+            "id": "RecursiveObject2",
+            "type": "object",
+            "properties": [
+                { "name": "obj", "$ref": "RecursiveObject1", "optional": true }
+            ]
+        }
+    ]
+}
+]
diff --git a/interpreter/AbstractPC.cpp b/interpreter/AbstractPC.cpp
new file mode 100644
index 0000000..09b24d5
--- /dev/null
+++ b/interpreter/AbstractPC.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AbstractPC.h"
+
+#include "CallFrame.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "VM.h"
+
+namespace JSC {
+
+AbstractPC::AbstractPC(VM& vm, ExecState* exec)
+{
+    UNUSED_PARAM(vm);
+    UNUSED_PARAM(exec);
+    
+#if ENABLE(JIT)
+    if (vm.canUseJIT()) {
+        m_pointer = exec->returnPC().value();
+        m_mode = JIT;
+        return;
+    }
+#endif
+}
+
+} // namespace JSC
+
diff --git a/interpreter/AbstractPC.h b/interpreter/AbstractPC.h
new file mode 100644
index 0000000..fc432eb
--- /dev/null
+++ b/interpreter/AbstractPC.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+class VM;
+class ExecState;
+struct Instruction;
+
+class AbstractPC {
+public:
+    AbstractPC()
+        : m_pointer(0)
+        , m_mode(None)
+    {
+    }
+    
+    AbstractPC(VM&, ExecState*);
+    
+#if ENABLE(JIT)
+    AbstractPC(ReturnAddressPtr ptr)
+        : m_pointer(ptr.value())
+        , m_mode(JIT)
+    {
+    }
+    
+    bool hasJITReturnAddress() const { return m_mode == JIT; }
+    ReturnAddressPtr jitReturnAddress() const
+    {
+        ASSERT(hasJITReturnAddress());
+        return ReturnAddressPtr(m_pointer);
+    }
+#endif
+
+    bool isSet() const { return m_mode != None; }
+    bool operator!() const { return !isSet(); }
+
+private:
+    void* m_pointer;
+    
+    enum Mode { None, JIT, Interpreter };
+    Mode m_mode;
+};
+
+} // namespace JSC
diff --git a/interpreter/CLoopStack.cpp b/interpreter/CLoopStack.cpp
new file mode 100644
index 0000000..f688e88
--- /dev/null
+++ b/interpreter/CLoopStack.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2008, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CLoopStack.h"
+
+#if !ENABLE(JIT)
+
+#include "CLoopStackInlines.h"
+#include "ConservativeRoots.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "Options.h"
+#include <wtf/Lock.h>
+
+namespace JSC {
+
+static size_t committedBytesCount = 0;
+
+static size_t commitSize()
+{
+    static size_t size = std::max<size_t>(16 * 1024, pageSize());
+    return size;
+}
+
+static StaticLock stackStatisticsMutex;
+
+CLoopStack::CLoopStack(VM& vm)
+    : m_vm(vm)
+    , m_topCallFrame(vm.topCallFrame)
+    , m_end(0)
+    , m_softReservedZoneSizeInRegisters(0)
+{
+    size_t capacity = Options::maxPerThreadStackUsage();
+    ASSERT(capacity && isPageAligned(capacity));
+
+    m_reservation = PageReservation::reserve(WTF::roundUpToMultipleOf(commitSize(), capacity), OSAllocator::JSVMStackPages);
+    setCLoopStackLimit(highAddress());
+    m_commitTop = highAddress();
+    
+    m_lastStackTop = baseOfStack();
+
+    m_topCallFrame = 0;
+}
+
+CLoopStack::~CLoopStack()
+{
+    ptrdiff_t sizeToDecommit = reinterpret_cast<char*>(highAddress()) - reinterpret_cast<char*>(m_commitTop);
+    m_reservation.decommit(reinterpret_cast<void*>(m_commitTop), sizeToDecommit);
+    addToCommittedByteCount(-sizeToDecommit);
+    m_reservation.deallocate();
+}
+
+bool CLoopStack::grow(Register* newTopOfStack)
+{
+    Register* newTopOfStackWithReservedZone = newTopOfStack - m_softReservedZoneSizeInRegisters;
+
+    // If we have already committed enough memory to satisfy this request,
+    // just update the end pointer and return.
+    if (newTopOfStackWithReservedZone >= m_commitTop) {
+        setCLoopStackLimit(newTopOfStack);
+        return true;
+    }
+
+    // Compute the chunk size of additional memory to commit, and see if we
+    // have it still within our budget. If not, we'll fail to grow and
+    // return false.
+    ptrdiff_t delta = reinterpret_cast<char*>(m_commitTop) - reinterpret_cast<char*>(newTopOfStackWithReservedZone);
+    delta = WTF::roundUpToMultipleOf(commitSize(), delta);
+    Register* newCommitTop = m_commitTop - (delta / sizeof(Register));
+    if (newCommitTop < reservationTop())
+        return false;
+
+    // Otherwise, the growth is still within our budget. Commit it and return true.
+    m_reservation.commit(newCommitTop, delta);
+    addToCommittedByteCount(delta);
+    m_commitTop = newCommitTop;
+    setCLoopStackLimit(newTopOfStack);
+    return true;
+}
+
+void CLoopStack::gatherConservativeRoots(ConservativeRoots& conservativeRoots, JITStubRoutineSet& jitStubRoutines, CodeBlockSet& codeBlocks)
+{
+    conservativeRoots.add(topOfStack() + 1, highAddress(), jitStubRoutines, codeBlocks);
+}
+
+void CLoopStack::sanitizeStack()
+{
+#if !ASAN_ENABLED
+    ASSERT(topOfStack() <= baseOfStack());
+    
+    if (m_lastStackTop < topOfStack()) {
+        char* begin = reinterpret_cast<char*>(m_lastStackTop + 1);
+        char* end = reinterpret_cast<char*>(topOfStack() + 1);
+        memset(begin, 0, end - begin);
+    }
+    
+    m_lastStackTop = topOfStack();
+#endif
+}
+
+void CLoopStack::releaseExcessCapacity()
+{
+    Register* highAddressWithReservedZone = highAddress() - m_softReservedZoneSizeInRegisters;
+    ptrdiff_t delta = reinterpret_cast<char*>(highAddressWithReservedZone) - reinterpret_cast<char*>(m_commitTop);
+    m_reservation.decommit(m_commitTop, delta);
+    addToCommittedByteCount(-delta);
+    m_commitTop = highAddressWithReservedZone;
+}
+
+void CLoopStack::addToCommittedByteCount(long byteCount)
+{
+    LockHolder locker(stackStatisticsMutex);
+    ASSERT(static_cast<long>(committedBytesCount) + byteCount > -1);
+    committedBytesCount += byteCount;
+}
+
+void CLoopStack::setSoftReservedZoneSize(size_t reservedZoneSize)
+{
+    m_softReservedZoneSizeInRegisters = reservedZoneSize / sizeof(Register);
+    if (m_commitTop >= (m_end + 1) - m_softReservedZoneSizeInRegisters)
+        grow(m_end + 1);
+}
+
+bool CLoopStack::isSafeToRecurse() const
+{
+    void* reservationLimit = reinterpret_cast<int8_t*>(reservationTop() + m_softReservedZoneSizeInRegisters);
+    return !m_topCallFrame || (m_topCallFrame->topOfFrame() > reservationLimit);
+}
+
+size_t CLoopStack::committedByteCount()
+{
+    LockHolder locker(stackStatisticsMutex);
+    return committedBytesCount;
+}
+
+} // namespace JSC
+
+#endif // !ENABLE(JIT)
diff --git a/interpreter/CLoopStack.h b/interpreter/CLoopStack.h
new file mode 100644
index 0000000..de7bba6
--- /dev/null
+++ b/interpreter/CLoopStack.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2008-2009, 2013-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if !ENABLE(JIT)
+
+#include "Register.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PageReservation.h>
+#include <wtf/VMTags.h>
+
+namespace JSC {
+
+    class CodeBlockSet;
+    class ConservativeRoots;
+    class JITStubRoutineSet;
+    class VM;
+    class LLIntOffsetsExtractor;
+
+    class CLoopStack {
+        WTF_MAKE_NONCOPYABLE(CLoopStack);
+    public:
+        // Allow 8k of excess registers before we start trying to reap the stack
+        static const ptrdiff_t maxExcessCapacity = 8 * 1024;
+
+        CLoopStack(VM&);
+        ~CLoopStack();
+        
+        bool ensureCapacityFor(Register* newTopOfStack);
+
+        bool containsAddress(Register* address) { return (lowAddress() <= address && address < highAddress()); }
+        static size_t committedByteCount();
+
+        void gatherConservativeRoots(ConservativeRoots&, JITStubRoutineSet&, CodeBlockSet&);
+        void sanitizeStack();
+
+        Register* baseOfStack() const
+        {
+            return highAddress() - 1;
+        }
+
+        size_t size() const { return highAddress() - lowAddress(); }
+
+        void setSoftReservedZoneSize(size_t);
+        bool isSafeToRecurse() const;
+        inline Register* topOfStack();
+
+    private:
+
+        Register* lowAddress() const
+        {
+            return m_end + 1;
+        }
+
+        Register* highAddress() const
+        {
+            return reinterpret_cast_ptr<Register*>(static_cast<char*>(m_reservation.base()) + m_reservation.size());
+        }
+
+        inline Register* topOfFrameFor(CallFrame*);
+
+        Register* reservationTop() const
+        {
+            char* reservationTop = static_cast<char*>(m_reservation.base());
+            return reinterpret_cast_ptr<Register*>(reservationTop);
+        }
+
+        bool grow(Register* newTopOfStack);
+        void shrink(Register* newTopOfStack);
+        void releaseExcessCapacity();
+        void addToCommittedByteCount(long);
+
+        void setCLoopStackLimit(Register* newTopOfStack);
+
+        VM& m_vm;
+        CallFrame*& m_topCallFrame;
+        Register* m_end;
+        Register* m_commitTop;
+        PageReservation m_reservation;
+        Register* m_lastStackTop;
+        ptrdiff_t m_softReservedZoneSizeInRegisters;
+
+        friend class LLIntOffsetsExtractor;
+    };
+
+} // namespace JSC
+
+#endif // !ENABLE(JIT)
diff --git a/interpreter/CLoopStackInlines.h b/interpreter/CLoopStackInlines.h
new file mode 100644
index 0000000..44e385b
--- /dev/null
+++ b/interpreter/CLoopStackInlines.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if !ENABLE(JIT)
+
+#include "CLoopStack.h"
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "VM.h"
+
+namespace JSC {
+
+inline bool CLoopStack::ensureCapacityFor(Register* newTopOfStack)
+{
+    Register* newEnd = newTopOfStack - 1;
+    if (newEnd >= m_end)
+        return true;
+    return grow(newTopOfStack);
+}
+
+inline Register* CLoopStack::topOfFrameFor(CallFrame* frame)
+{
+    if (UNLIKELY(!frame))
+        return baseOfStack();
+    return frame->topOfFrame() - 1;
+}
+
+inline Register* CLoopStack::topOfStack()
+{
+    return topOfFrameFor(m_topCallFrame);
+}
+
+inline void CLoopStack::shrink(Register* newTopOfStack)
+{
+    Register* newEnd = newTopOfStack - 1;
+    if (newEnd >= m_end)
+        return;
+    setCLoopStackLimit(newTopOfStack);
+    // Note: Clang complains of an unresolved linkage to maxExcessCapacity if
+    // invoke std::max() with it as an argument. To work around this, we first
+    // assign the constant to a local variable, and use the local instead.
+    ptrdiff_t maxExcessCapacity = CLoopStack::maxExcessCapacity;
+    ptrdiff_t maxExcessInRegisters = std::max(maxExcessCapacity, m_softReservedZoneSizeInRegisters);
+    if (m_end == baseOfStack() && (highAddress() - m_commitTop) >= maxExcessInRegisters)
+        releaseExcessCapacity();
+}
+
+inline void CLoopStack::setCLoopStackLimit(Register* newTopOfStack)
+{
+    Register* newEnd = newTopOfStack - 1;
+    m_end = newEnd;
+    m_vm.setCLoopStackLimit(newTopOfStack);
+}
+
+} // namespace JSC
+
+#endif // !ENABLE(JIT)
diff --git a/interpreter/CachedCall.h b/interpreter/CachedCall.h
new file mode 100644
index 0000000..fb770cb
--- /dev/null
+++ b/interpreter/CachedCall.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallFrameClosure.h"
+#include "ExceptionHelpers.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "Interpreter.h"
+#include "ProtoCallFrame.h"
+#include "VMEntryScope.h"
+#include "VMInlines.h"
+#include <wtf/ForbidHeapAllocation.h>
+
+namespace JSC {
+    class CachedCall {
+        WTF_MAKE_NONCOPYABLE(CachedCall);
+        WTF_FORBID_HEAP_ALLOCATION;
+    public:
+        CachedCall(CallFrame* callFrame, JSFunction* function, int argumentCount)
+            : m_valid(false)
+            , m_interpreter(callFrame->interpreter())
+            , m_vm(callFrame->vm())
+            , m_entryScope(m_vm, function->scope()->globalObject(m_vm))
+        {
+            VM& vm = m_entryScope.vm();
+            auto scope = DECLARE_THROW_SCOPE(vm);
+
+            ASSERT(!function->isHostFunctionNonInline());
+            if (UNLIKELY(vm.isSafeToRecurseSoft())) {
+                m_arguments.ensureCapacity(argumentCount);
+                m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, &m_protoCallFrame, function, argumentCount + 1, function->scope(), m_arguments);
+            } else
+                throwStackOverflowError(callFrame, scope);
+            m_valid = !scope.exception();
+        }
+        
+        JSValue call()
+        { 
+            ASSERT(m_valid);
+            ASSERT(m_arguments.size() == static_cast<size_t>(m_protoCallFrame.argumentCount()));
+            return m_interpreter->execute(m_closure);
+        }
+        void setThis(JSValue v) { m_protoCallFrame.setThisValue(v); }
+
+        void clearArguments() { m_arguments.clear(); }
+        void appendArgument(JSValue v) { m_arguments.append(v); }
+
+    private:
+        bool m_valid;
+        Interpreter* m_interpreter;
+        VM& m_vm;
+        VMEntryScope m_entryScope;
+        ProtoCallFrame m_protoCallFrame;
+        MarkedArgumentBuffer m_arguments;
+        CallFrameClosure m_closure;
+    };
+}
diff --git a/interpreter/CallFrame.cpp b/interpreter/CallFrame.cpp
new file mode 100644
index 0000000..7ca5b9a
--- /dev/null
+++ b/interpreter/CallFrame.cpp
@@ -0,0 +1,280 @@
+/*
+ * Copyright (C) 2008, 2013-2014, 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallFrame.h"
+
+#include "CodeBlock.h"
+#include "InlineCallFrame.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "VMEntryScope.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+void ExecState::initGlobalExec(ExecState* globalExec, JSCallee* globalCallee)
+{
+    globalExec->setCodeBlock(nullptr);
+    globalExec->setCallerFrame(noCaller());
+    globalExec->setReturnPC(0);
+    globalExec->setArgumentCountIncludingThis(0);
+    globalExec->setCallee(globalCallee);
+}
+
+bool CallFrame::callSiteBitsAreBytecodeOffset() const
+{
+    ASSERT(codeBlock());
+    switch (codeBlock()->jitType()) {
+    case JITCode::InterpreterThunk:
+    case JITCode::BaselineJIT:
+        return true;
+    case JITCode::None:
+    case JITCode::HostCallThunk:
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    default:
+        return false;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool CallFrame::callSiteBitsAreCodeOriginIndex() const
+{
+    ASSERT(codeBlock());
+    switch (codeBlock()->jitType()) {
+    case JITCode::DFGJIT:
+    case JITCode::FTLJIT:
+        return true;
+    case JITCode::None:
+    case JITCode::HostCallThunk:
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    default:
+        return false;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+unsigned CallFrame::callSiteAsRawBits() const
+{
+    return this[CallFrameSlot::argumentCount].tag();
+}
+
+SUPPRESS_ASAN unsigned CallFrame::unsafeCallSiteAsRawBits() const
+{
+    return this[CallFrameSlot::argumentCount].unsafeTag();
+}
+
+CallSiteIndex CallFrame::callSiteIndex() const
+{
+    return CallSiteIndex(callSiteAsRawBits());
+}
+
+SUPPRESS_ASAN CallSiteIndex CallFrame::unsafeCallSiteIndex() const
+{
+    return CallSiteIndex(unsafeCallSiteAsRawBits());
+}
+
+#if USE(JSVALUE32_64)
+Instruction* CallFrame::currentVPC() const
+{
+    return bitwise_cast<Instruction*>(callSiteIndex().bits());
+}
+
+void CallFrame::setCurrentVPC(Instruction* vpc)
+{
+    CallSiteIndex callSite(vpc);
+    this[CallFrameSlot::argumentCount].tag() = callSite.bits();
+}
+
+unsigned CallFrame::callSiteBitsAsBytecodeOffset() const
+{
+    ASSERT(codeBlock());
+    ASSERT(callSiteBitsAreBytecodeOffset());
+    return currentVPC() - codeBlock()->instructions().begin();     
+}
+
+#else // USE(JSVALUE32_64)
+Instruction* CallFrame::currentVPC() const
+{
+    ASSERT(callSiteBitsAreBytecodeOffset());
+    return codeBlock()->instructions().begin() + callSiteBitsAsBytecodeOffset();
+}
+
+void CallFrame::setCurrentVPC(Instruction* vpc)
+{
+    CallSiteIndex callSite(vpc - codeBlock()->instructions().begin());
+    this[CallFrameSlot::argumentCount].tag() = static_cast<int32_t>(callSite.bits());
+}
+
+unsigned CallFrame::callSiteBitsAsBytecodeOffset() const
+{
+    ASSERT(codeBlock());
+    ASSERT(callSiteBitsAreBytecodeOffset());
+    return callSiteIndex().bits();
+}
+
+#endif
+    
+unsigned CallFrame::bytecodeOffset()
+{
+    if (!codeBlock())
+        return 0;
+#if ENABLE(DFG_JIT)
+    if (callSiteBitsAreCodeOriginIndex()) {
+        ASSERT(codeBlock());
+        CodeOrigin codeOrigin = this->codeOrigin();
+        for (InlineCallFrame* inlineCallFrame = codeOrigin.inlineCallFrame; inlineCallFrame;) {
+            codeOrigin = inlineCallFrame->directCaller;
+            inlineCallFrame = codeOrigin.inlineCallFrame;
+        }
+        return codeOrigin.bytecodeIndex;
+    }
+#endif
+    ASSERT(callSiteBitsAreBytecodeOffset());
+    return callSiteBitsAsBytecodeOffset();
+}
+
+CodeOrigin CallFrame::codeOrigin()
+{
+    if (!codeBlock())
+        return CodeOrigin(0);
+#if ENABLE(DFG_JIT)
+    if (callSiteBitsAreCodeOriginIndex()) {
+        CallSiteIndex index = callSiteIndex();
+        ASSERT(codeBlock()->canGetCodeOrigin(index));
+        return codeBlock()->codeOrigin(index);
+    }
+#endif
+    return CodeOrigin(callSiteBitsAsBytecodeOffset());
+}
+
+Register* CallFrame::topOfFrameInternal()
+{
+    CodeBlock* codeBlock = this->codeBlock();
+    ASSERT(codeBlock);
+    return registers() + codeBlock->stackPointerOffset();
+}
+
+JSGlobalObject* CallFrame::vmEntryGlobalObject()
+{
+    if (callee()->isObject()) { 
+        if (this == lexicalGlobalObject()->globalExec())
+            return lexicalGlobalObject();
+    }
+    // If we're not an object, we're wasm, and therefore we're executing code and the below is safe.
+
+    // For any ExecState that's not a globalExec, the 
+    // dynamic global object must be set since code is running
+    ASSERT(vm().entryScope);
+    return vm().entryScope->globalObject();
+}
+
+CallFrame* CallFrame::callerFrame(VMEntryFrame*& currVMEntryFrame)
+{
+    if (callerFrameOrVMEntryFrame() == currVMEntryFrame) {
+        VMEntryRecord* currVMEntryRecord = vmEntryRecord(currVMEntryFrame);
+        currVMEntryFrame = currVMEntryRecord->prevTopVMEntryFrame();
+        return currVMEntryRecord->prevTopCallFrame();
+    }
+    return static_cast<CallFrame*>(callerFrameOrVMEntryFrame());
+}
+
+SUPPRESS_ASAN CallFrame* CallFrame::unsafeCallerFrame(VMEntryFrame*& currVMEntryFrame)
+{
+    if (unsafeCallerFrameOrVMEntryFrame() == currVMEntryFrame) {
+        VMEntryRecord* currVMEntryRecord = vmEntryRecord(currVMEntryFrame);
+        currVMEntryFrame = currVMEntryRecord->unsafePrevTopVMEntryFrame();
+        return currVMEntryRecord->unsafePrevTopCallFrame();
+    }
+    return static_cast<CallFrame*>(unsafeCallerFrameOrVMEntryFrame());
+}
+
+String CallFrame::friendlyFunctionName()
+{
+    CodeBlock* codeBlock = this->codeBlock();
+    if (!codeBlock)
+        return emptyString();
+
+    switch (codeBlock->codeType()) {
+    case EvalCode:
+        return ASCIILiteral("eval code");
+    case ModuleCode:
+        return ASCIILiteral("module code");
+    case GlobalCode:
+        return ASCIILiteral("global code");
+    case FunctionCode:
+        if (jsCallee())
+            return getCalculatedDisplayName(vm(), jsCallee());
+        return emptyString();
+    }
+
+    ASSERT_NOT_REACHED();
+    return emptyString();
+}
+
+void CallFrame::dump(PrintStream& out)
+{
+    if (CodeBlock* codeBlock = this->codeBlock()) {
+        out.print(codeBlock->inferredName(), "#", codeBlock->hashAsStringIfPossible(), " [", codeBlock->jitType(), "]");
+
+        out.print("(");
+        thisValue().dumpForBacktrace(out);
+
+        for (size_t i = 0; i < argumentCount(); ++i) {
+            out.print(", ");
+            JSValue value = argument(i);
+            value.dumpForBacktrace(out);
+        }
+
+        out.print(")");
+
+        return;
+    }
+
+    out.print(returnPC());
+}
+
+const char* CallFrame::describeFrame()
+{
+    const size_t bufferSize = 200;
+    static char buffer[bufferSize + 1];
+    
+    WTF::StringPrintStream stringStream;
+
+    dump(stringStream);
+
+    strncpy(buffer, stringStream.toCString().data(), bufferSize);
+    buffer[bufferSize] = '\0';
+    
+    return buffer;
+}
+
+} // namespace JSC
diff --git a/interpreter/CallFrame.h b/interpreter/CallFrame.h
new file mode 100644
index 0000000..4cc8e40
--- /dev/null
+++ b/interpreter/CallFrame.h
@@ -0,0 +1,298 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "AbstractPC.h"
+#include "MacroAssemblerCodeRef.h"
+#include "Register.h"
+#include "StackVisitor.h"
+#include "VM.h"
+#include "VMEntryRecord.h"
+
+namespace JSC  {
+
+    class Arguments;
+    class ExecState;
+    class Interpreter;
+    class JSCallee;
+    class JSScope;
+
+    struct Instruction;
+
+    typedef ExecState CallFrame;
+
+    struct CallSiteIndex {
+        CallSiteIndex()
+            : m_bits(UINT_MAX)
+        {
+        }
+        
+        explicit CallSiteIndex(uint32_t bits)
+            : m_bits(bits)
+        { }
+#if USE(JSVALUE32_64)
+        explicit CallSiteIndex(Instruction* instruction)
+            : m_bits(bitwise_cast<uint32_t>(instruction))
+        { }
+#endif
+
+        explicit operator bool() const { return m_bits != UINT_MAX; }
+        bool operator==(const CallSiteIndex& other) const { return m_bits == other.m_bits; }
+        
+        inline uint32_t bits() const { return m_bits; }
+
+    private:
+        uint32_t m_bits;
+    };
+
+    struct CallerFrameAndPC {
+        CallFrame* callerFrame;
+        Instruction* pc;
+        static const int sizeInRegisters = 2 * sizeof(void*) / sizeof(Register);
+    };
+    static_assert(CallerFrameAndPC::sizeInRegisters == sizeof(CallerFrameAndPC) / sizeof(Register), "CallerFrameAndPC::sizeInRegisters is incorrect.");
+
+    struct CallFrameSlot {
+        static const int codeBlock = CallerFrameAndPC::sizeInRegisters;
+        static const int callee = codeBlock + 1;
+        static const int argumentCount = callee + 1;
+        static const int thisArgument = argumentCount + 1;
+        static const int firstArgument = thisArgument + 1;
+    };
+
+    // Represents the current state of script execution.
+    // Passed as the first argument to most functions.
+    class ExecState : private Register {
+    public:
+        static const int headerSizeInRegisters = CallFrameSlot::argumentCount + 1;
+
+        JSValue calleeAsValue() const { return this[CallFrameSlot::callee].jsValue(); }
+        JSObject* jsCallee() const { return this[CallFrameSlot::callee].object(); }
+        JSCell* callee() const { return this[CallFrameSlot::callee].unboxedCell(); }
+        SUPPRESS_ASAN JSValue unsafeCallee() const { return this[CallFrameSlot::callee].asanUnsafeJSValue(); }
+        CodeBlock* codeBlock() const { return this[CallFrameSlot::codeBlock].Register::codeBlock(); }
+        CodeBlock** addressOfCodeBlock() const { return bitwise_cast<CodeBlock**>(this + CallFrameSlot::codeBlock); }
+        SUPPRESS_ASAN CodeBlock* unsafeCodeBlock() const { return this[CallFrameSlot::codeBlock].Register::asanUnsafeCodeBlock(); }
+        JSScope* scope(int scopeRegisterOffset) const
+        {
+            ASSERT(this[scopeRegisterOffset].Register::scope());
+            return this[scopeRegisterOffset].Register::scope();
+        }
+
+        // Global object in which execution began.
+        JS_EXPORT_PRIVATE JSGlobalObject* vmEntryGlobalObject();
+
+        // Global object in which the currently executing code was defined.
+        // Differs from vmEntryGlobalObject() during function calls across web browser frames.
+        JSGlobalObject* lexicalGlobalObject() const;
+
+        // Differs from lexicalGlobalObject because this will have DOM window shell rather than
+        // the actual DOM window, which can't be "this" for security reasons.
+        JSObject* globalThisValue() const;
+
+        VM& vm() const;
+
+        // Convenience functions for access to global data.
+        // It takes a few memory references to get from a call frame to the global data
+        // pointer, so these are inefficient, and should be used sparingly in new code.
+        // But they're used in many places in legacy code, so they're not going away any time soon.
+
+        AtomicStringTable* atomicStringTable() const { return vm().atomicStringTable(); }
+        const CommonIdentifiers& propertyNames() const { return *vm().propertyNames; }
+        const ArgList& emptyList() const { return *vm().emptyList; }
+        Interpreter* interpreter() { return vm().interpreter; }
+        Heap* heap() { return &vm().heap; }
+
+
+        static CallFrame* create(Register* callFrameBase) { return static_cast<CallFrame*>(callFrameBase); }
+        Register* registers() { return this; }
+        const Register* registers() const { return this; }
+
+        CallFrame& operator=(const Register& r) { *static_cast<Register*>(this) = r; return *this; }
+
+        CallFrame* callerFrame() const { return static_cast<CallFrame*>(callerFrameOrVMEntryFrame()); }
+        void* callerFrameOrVMEntryFrame() const { return callerFrameAndPC().callerFrame; }
+        SUPPRESS_ASAN void* unsafeCallerFrameOrVMEntryFrame() const { return unsafeCallerFrameAndPC().callerFrame; }
+
+        CallFrame* unsafeCallerFrame(VMEntryFrame*&);
+        JS_EXPORT_PRIVATE CallFrame* callerFrame(VMEntryFrame*&);
+
+        static ptrdiff_t callerFrameOffset() { return OBJECT_OFFSETOF(CallerFrameAndPC, callerFrame); }
+
+        ReturnAddressPtr returnPC() const { return ReturnAddressPtr(callerFrameAndPC().pc); }
+        bool hasReturnPC() const { return !!callerFrameAndPC().pc; }
+        void clearReturnPC() { callerFrameAndPC().pc = 0; }
+        static ptrdiff_t returnPCOffset() { return OBJECT_OFFSETOF(CallerFrameAndPC, pc); }
+        AbstractPC abstractReturnPC(VM& vm) { return AbstractPC(vm, this); }
+
+        bool callSiteBitsAreBytecodeOffset() const;
+        bool callSiteBitsAreCodeOriginIndex() const;
+
+        unsigned callSiteAsRawBits() const;
+        unsigned unsafeCallSiteAsRawBits() const;
+        CallSiteIndex callSiteIndex() const;
+        CallSiteIndex unsafeCallSiteIndex() const;
+    private:
+        unsigned callSiteBitsAsBytecodeOffset() const;
+    public:
+
+        // This will try to get you the bytecode offset, but you should be aware that
+        // this bytecode offset may be bogus in the presence of inlining. This will
+        // also return 0 if the call frame has no notion of bytecode offsets (for
+        // example if it's native code).
+        // https://bugs.webkit.org/show_bug.cgi?id=121754
+        unsigned bytecodeOffset();
+        
+        // This will get you a CodeOrigin. It will always succeed. May return
+        // CodeOrigin(0) if we're in native code.
+        JS_EXPORT_PRIVATE CodeOrigin codeOrigin();
+
+        Register* topOfFrame()
+        {
+            if (!codeBlock())
+                return registers();
+            return topOfFrameInternal();
+        }
+    
+        Instruction* currentVPC() const; // This only makes sense in the LLInt and baseline.
+        void setCurrentVPC(Instruction* vpc);
+
+        void setCallerFrame(CallFrame* frame) { callerFrameAndPC().callerFrame = frame; }
+        void setScope(int scopeRegisterOffset, JSScope* scope) { static_cast<Register*>(this)[scopeRegisterOffset] = scope; }
+
+        static void initGlobalExec(ExecState* globalExec, JSCallee* globalCallee);
+
+        // Read a register from the codeframe (or constant from the CodeBlock).
+        Register& r(int);
+        Register& r(VirtualRegister);
+        // Read a register for a non-constant
+        Register& uncheckedR(int);
+        Register& uncheckedR(VirtualRegister);
+
+        // Access to arguments as passed. (After capture, arguments may move to a different location.)
+        size_t argumentCount() const { return argumentCountIncludingThis() - 1; }
+        size_t argumentCountIncludingThis() const { return this[CallFrameSlot::argumentCount].payload(); }
+        static int argumentOffset(int argument) { return (CallFrameSlot::firstArgument + argument); }
+        static int argumentOffsetIncludingThis(int argument) { return (CallFrameSlot::thisArgument + argument); }
+
+        // In the following (argument() and setArgument()), the 'argument'
+        // parameter is the index of the arguments of the target function of
+        // this frame. The index starts at 0 for the first arg, 1 for the
+        // second, etc.
+        //
+        // The arguments (in this case) do not include the 'this' value.
+        // arguments(0) will not fetch the 'this' value. To get/set 'this',
+        // use thisValue() and setThisValue() below.
+
+        JSValue* addressOfArgumentsStart() const { return bitwise_cast<JSValue*>(this + argumentOffset(0)); }
+        JSValue argument(size_t argument)
+        {
+            if (argument >= argumentCount())
+                 return jsUndefined();
+            return getArgumentUnsafe(argument);
+        }
+        JSValue uncheckedArgument(size_t argument)
+        {
+            ASSERT(argument < argumentCount());
+            return getArgumentUnsafe(argument);
+        }
+        void setArgument(size_t argument, JSValue value)
+        {
+            this[argumentOffset(argument)] = value;
+        }
+
+        JSValue getArgumentUnsafe(size_t argIndex)
+        {
+            // User beware! This method does not verify that there is a valid
+            // argument at the specified argIndex. This is used for debugging
+            // and verification code only. The caller is expected to know what
+            // he/she is doing when calling this method.
+            return this[argumentOffset(argIndex)].jsValue();
+        }
+
+        static int thisArgumentOffset() { return argumentOffsetIncludingThis(0); }
+        JSValue thisValue() { return this[thisArgumentOffset()].jsValue(); }
+        void setThisValue(JSValue value) { this[thisArgumentOffset()] = value; }
+
+        // Under the constructor implemented in C++, thisValue holds the newTarget instead of the automatically constructed value.
+        // The result of this function is only effective under the "construct" context.
+        JSValue newTarget() { return thisValue(); }
+
+        JSValue argumentAfterCapture(size_t argument);
+
+        static int offsetFor(size_t argumentCountIncludingThis) { return argumentCountIncludingThis + CallFrameSlot::thisArgument - 1; }
+
+        static CallFrame* noCaller() { return 0; }
+
+        void setArgumentCountIncludingThis(int count) { static_cast<Register*>(this)[CallFrameSlot::argumentCount].payload() = count; }
+        void setCallee(JSObject* callee) { static_cast<Register*>(this)[CallFrameSlot::callee] = callee; }
+        void setCodeBlock(CodeBlock* codeBlock) { static_cast<Register*>(this)[CallFrameSlot::codeBlock] = codeBlock; }
+        void setReturnPC(void* value) { callerFrameAndPC().pc = reinterpret_cast<Instruction*>(value); }
+
+        String friendlyFunctionName();
+
+        // CallFrame::iterate() expects a Functor that implements the following method:
+        //     StackVisitor::Status operator()(StackVisitor&) const;
+        // FIXME: This method is improper. We rely on the fact that we can call it with a null
+        // receiver. We should always be using StackVisitor directly.
+        template <typename Functor> void iterate(const Functor& functor)
+        {
+            StackVisitor::visit<Functor>(this, functor);
+        }
+
+        void dump(PrintStream&);
+        JS_EXPORT_PRIVATE const char* describeFrame();
+
+    private:
+
+        ExecState();
+        ~ExecState();
+
+        Register* topOfFrameInternal();
+
+        // The following are for internal use in debugging and verification
+        // code only and not meant as an API for general usage:
+
+        size_t argIndexForRegister(Register* reg)
+        {
+            // The register at 'offset' number of slots from the frame pointer
+            // i.e.
+            //       reg = frame[offset];
+            //   ==> reg = frame + offset;
+            //   ==> offset = reg - frame;
+            int offset = reg - this->registers();
+
+            // The offset is defined (based on argumentOffset()) to be:
+            //       offset = CallFrameSlot::firstArgument - argIndex;
+            // Hence:
+            //       argIndex = CallFrameSlot::firstArgument - offset;
+            size_t argIndex = offset - CallFrameSlot::firstArgument;
+            return argIndex;
+        }
+
+        CallerFrameAndPC& callerFrameAndPC() { return *reinterpret_cast<CallerFrameAndPC*>(this); }
+        const CallerFrameAndPC& callerFrameAndPC() const { return *reinterpret_cast<const CallerFrameAndPC*>(this); }
+        SUPPRESS_ASAN const CallerFrameAndPC& unsafeCallerFrameAndPC() const { return *reinterpret_cast<const CallerFrameAndPC*>(this); }
+    };
+
+} // namespace JSC
diff --git a/interpreter/CallFrameClosure.h b/interpreter/CallFrameClosure.h
new file mode 100644
index 0000000..a625caf
--- /dev/null
+++ b/interpreter/CallFrameClosure.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ProtoCallFrame.h"
+
+namespace JSC {
+
+struct CallFrameClosure {
+    CallFrame* oldCallFrame;
+    ProtoCallFrame* protoCallFrame;
+    JSFunction* function;
+    FunctionExecutable* functionExecutable;
+    VM* vm;
+    JSScope* scope;
+    int parameterCountIncludingThis;
+    int argumentCountIncludingThis;
+    
+    void setThis(JSValue value)
+    {
+        protoCallFrame->setThisValue(value);
+    }
+
+    void setArgument(int argument, JSValue value)
+    {
+        protoCallFrame->setArgument(argument, value);
+    }
+};
+
+}
diff --git a/interpreter/FrameTracers.h b/interpreter/FrameTracers.h
new file mode 100644
index 0000000..c5b6b83
--- /dev/null
+++ b/interpreter/FrameTracers.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CatchScope.h"
+#include "VM.h"
+
+namespace JSC {
+
+struct VMEntryFrame;
+
+class SuspendExceptionScope {
+public:
+    SuspendExceptionScope(VM* vm)
+        : m_vm(vm)
+    {
+        auto scope = DECLARE_CATCH_SCOPE(*vm);
+        oldException = scope.exception();
+        scope.clearException();
+    }
+    ~SuspendExceptionScope()
+    {
+        m_vm->restorePreviousException(oldException);
+    }
+private:
+    Exception* oldException;
+    VM* m_vm;
+};
+
+class TopCallFrameSetter {
+public:
+    TopCallFrameSetter(VM& currentVM, CallFrame* callFrame)
+        : vm(currentVM)
+        , oldCallFrame(currentVM.topCallFrame)
+    {
+        currentVM.topCallFrame = callFrame;
+    }
+
+    ~TopCallFrameSetter()
+    {
+        vm.topCallFrame = oldCallFrame;
+    }
+private:
+    VM& vm;
+    CallFrame* oldCallFrame;
+};
+
+class NativeCallFrameTracer {
+public:
+    ALWAYS_INLINE NativeCallFrameTracer(VM* vm, CallFrame* callFrame)
+    {
+        ASSERT(vm);
+        ASSERT(callFrame);
+        ASSERT(reinterpret_cast<void*>(callFrame) < reinterpret_cast<void*>(vm->topVMEntryFrame));
+        vm->topCallFrame = callFrame;
+    }
+};
+
+class NativeCallFrameTracerWithRestore {
+public:
+    ALWAYS_INLINE NativeCallFrameTracerWithRestore(VM* vm, VMEntryFrame* vmEntryFrame, CallFrame* callFrame)
+        : m_vm(vm)
+    {
+        ASSERT(vm);
+        ASSERT(callFrame);
+        m_savedTopVMEntryFrame = vm->topVMEntryFrame;
+        m_savedTopCallFrame = vm->topCallFrame;
+        vm->topVMEntryFrame = vmEntryFrame;
+        vm->topCallFrame = callFrame;
+    }
+
+    ALWAYS_INLINE ~NativeCallFrameTracerWithRestore()
+    {
+        m_vm->topVMEntryFrame = m_savedTopVMEntryFrame;
+        m_vm->topCallFrame = m_savedTopCallFrame;
+    }
+
+private:
+    VM* m_vm;
+    VMEntryFrame* m_savedTopVMEntryFrame;
+    CallFrame* m_savedTopCallFrame;
+};
+
+}
diff --git a/interpreter/Interpreter.cpp b/interpreter/Interpreter.cpp
new file mode 100644
index 0000000..fd2dc2d
--- /dev/null
+++ b/interpreter/Interpreter.cpp
@@ -0,0 +1,1243 @@
+/*
+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Interpreter.h"
+
+#include "BatchedTransitionOptimizer.h"
+#include "CallFrameClosure.h"
+#include "CodeBlock.h"
+#include "DirectArguments.h"
+#include "Heap.h"
+#include "Debugger.h"
+#include "DebuggerCallFrame.h"
+#include "DirectEvalCodeCache.h"
+#include "ErrorInstance.h"
+#include "EvalCodeBlock.h"
+#include "Exception.h"
+#include "ExceptionHelpers.h"
+#include "FunctionCodeBlock.h"
+#include "JSArrayInlines.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "JSLexicalEnvironment.h"
+#include "JSModuleEnvironment.h"
+#include "JSString.h"
+#include "JSWithScope.h"
+#include "LLIntCLoop.h"
+#include "LLIntData.h"
+#include "LLIntThunks.h"
+#include "LiteralParser.h"
+#include "ModuleProgramCodeBlock.h"
+#include "ObjectPrototype.h"
+#include "Parser.h"
+#include "ProgramCodeBlock.h"
+#include "ProtoCallFrame.h"
+#include "RegExpObject.h"
+#include "Register.h"
+#include "ScopedArguments.h"
+#include "StackAlignment.h"
+#include "StackFrame.h"
+#include "StackVisitor.h"
+#include "StrictEvalActivation.h"
+#include "StrongInlines.h"
+#include "Symbol.h"
+#include "VMEntryScope.h"
+#include "VMInlines.h"
+#include "VirtualRegister.h"
+
+#include <limits.h>
+#include <stdio.h>
+#include <wtf/StackStats.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/StringPrintStream.h>
+#include <wtf/Threading.h>
+#include <wtf/text/StringBuilder.h>
+
+#if ENABLE(JIT)
+#include "JIT.h"
+#endif
+
+using namespace std;
+
+namespace JSC {
+
+JSValue eval(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!callFrame->argumentCount())
+        return jsUndefined();
+
+    JSValue program = callFrame->argument(0);
+    if (!program.isString())
+        return program;
+
+    TopCallFrameSetter topCallFrame(vm, callFrame);
+    JSGlobalObject* globalObject = callFrame->lexicalGlobalObject();
+    if (!globalObject->evalEnabled()) {
+        throwException(callFrame, scope, createEvalError(callFrame, globalObject->evalDisabledErrorMessage()));
+        return jsUndefined();
+    }
+    String programSource = asString(program)->value(callFrame);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    
+    CallFrame* callerFrame = callFrame->callerFrame();
+    CallSiteIndex callerCallSiteIndex = callerFrame->callSiteIndex();
+    CodeBlock* callerCodeBlock = callerFrame->codeBlock();
+    JSScope* callerScopeChain = callerFrame->uncheckedR(callerCodeBlock->scopeRegister().offset()).Register::scope();
+    UnlinkedCodeBlock* callerUnlinkedCodeBlock = callerCodeBlock->unlinkedCodeBlock();
+
+    bool isArrowFunctionContext = callerUnlinkedCodeBlock->isArrowFunction() || callerUnlinkedCodeBlock->isArrowFunctionContext();
+
+    DerivedContextType derivedContextType = callerUnlinkedCodeBlock->derivedContextType();
+    if (!isArrowFunctionContext && callerUnlinkedCodeBlock->isClassContext()) {
+        derivedContextType = callerUnlinkedCodeBlock->isConstructor()
+            ? DerivedContextType::DerivedConstructorContext
+            : DerivedContextType::DerivedMethodContext;
+    }
+
+    EvalContextType evalContextType;
+    if (isFunctionParseMode(callerUnlinkedCodeBlock->parseMode()))
+        evalContextType = EvalContextType::FunctionEvalContext;
+    else if (callerUnlinkedCodeBlock->codeType() == EvalCode)
+        evalContextType = callerUnlinkedCodeBlock->evalContextType();
+    else
+        evalContextType = EvalContextType::None;
+
+    DirectEvalExecutable* eval = callerCodeBlock->directEvalCodeCache().tryGet(programSource, callerCallSiteIndex);
+    if (!eval) {
+        if (!callerCodeBlock->isStrictMode()) {
+            if (programSource.is8Bit()) {
+                LiteralParser<LChar> preparser(callFrame, programSource.characters8(), programSource.length(), NonStrictJSON);
+                if (JSValue parsedObject = preparser.tryLiteralParse())
+                    return parsedObject;
+            } else {
+                LiteralParser<UChar> preparser(callFrame, programSource.characters16(), programSource.length(), NonStrictJSON);
+                if (JSValue parsedObject = preparser.tryLiteralParse())
+                    return parsedObject;                
+            }
+        }
+        
+        // If the literal parser bailed, it should not have thrown exceptions.
+        ASSERT(!scope.exception());
+
+        VariableEnvironment variablesUnderTDZ;
+        JSScope::collectClosureVariablesUnderTDZ(callerScopeChain, variablesUnderTDZ);
+        eval = DirectEvalExecutable::create(callFrame, makeSource(programSource), callerCodeBlock->isStrictMode(), derivedContextType, isArrowFunctionContext, evalContextType, &variablesUnderTDZ);
+        if (!eval)
+            return jsUndefined();
+
+        callerCodeBlock->directEvalCodeCache().set(callFrame, callerCodeBlock, programSource, callerCallSiteIndex, eval);
+    }
+
+    JSValue thisValue = callerFrame->thisValue();
+    Interpreter* interpreter = vm.interpreter;
+    return interpreter->execute(eval, callFrame, thisValue, callerScopeChain);
+}
+
+unsigned sizeOfVarargs(CallFrame* callFrame, JSValue arguments, uint32_t firstVarArgOffset)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (UNLIKELY(!arguments.isCell())) {
+        if (arguments.isUndefinedOrNull())
+            return 0;
+        
+        throwException(callFrame, scope, createInvalidFunctionApplyParameterError(callFrame, arguments));
+        return 0;
+    }
+    
+    JSCell* cell = arguments.asCell();
+    unsigned length;
+    switch (cell->type()) {
+    case DirectArgumentsType:
+        length = jsCast<DirectArguments*>(cell)->length(callFrame);
+        break;
+    case ScopedArgumentsType:
+        length = jsCast<ScopedArguments*>(cell)->length(callFrame);
+        break;
+    case StringType:
+    case SymbolType:
+        throwException(callFrame, scope, createInvalidFunctionApplyParameterError(callFrame,  arguments));
+        return 0;
+        
+    default:
+        RELEASE_ASSERT(arguments.isObject());
+        length = getLength(callFrame, jsCast<JSObject*>(cell));
+        RETURN_IF_EXCEPTION(scope, 0);
+        break;
+    }
+
+    
+    if (length >= firstVarArgOffset)
+        length -= firstVarArgOffset;
+    else
+        length = 0;
+    
+    return length;
+}
+
+unsigned sizeFrameForForwardArguments(CallFrame* callFrame, VM& vm, unsigned numUsedStackSlots)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    unsigned length = callFrame->argumentCount();
+    CallFrame* calleeFrame = calleeFrameForVarargs(callFrame, numUsedStackSlots, length + 1);
+    if (UNLIKELY(!vm.ensureStackCapacityFor(calleeFrame->registers())))
+        throwStackOverflowError(callFrame, scope);
+
+    return length;
+}
+
+unsigned sizeFrameForVarargs(CallFrame* callFrame, VM& vm, JSValue arguments, unsigned numUsedStackSlots, uint32_t firstVarArgOffset)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    unsigned length = sizeOfVarargs(callFrame, arguments, firstVarArgOffset);
+    
+    CallFrame* calleeFrame = calleeFrameForVarargs(callFrame, numUsedStackSlots, length + 1);
+    if (UNLIKELY(length > maxArguments || !vm.ensureStackCapacityFor(calleeFrame->registers()))) {
+        throwStackOverflowError(callFrame, scope);
+        return 0;
+    }
+    
+    return length;
+}
+
+void loadVarargs(CallFrame* callFrame, VirtualRegister firstElementDest, JSValue arguments, uint32_t offset, uint32_t length)
+{
+    if (UNLIKELY(!arguments.isCell()) || !length)
+        return;
+    
+    JSCell* cell = arguments.asCell();
+
+    switch (cell->type()) {
+    case DirectArgumentsType:
+        jsCast<DirectArguments*>(cell)->copyToArguments(callFrame, firstElementDest, offset, length);
+        return;
+    case ScopedArgumentsType:
+        jsCast<ScopedArguments*>(cell)->copyToArguments(callFrame, firstElementDest, offset, length);
+        return;
+    default: {
+        ASSERT(arguments.isObject());
+        JSObject* object = jsCast<JSObject*>(cell);
+        if (isJSArray(object)) {
+            jsCast<JSArray*>(object)->copyToArguments(callFrame, firstElementDest, offset, length);
+            return;
+        }
+        unsigned i;
+        for (i = 0; i < length && object->canGetIndexQuickly(i + offset); ++i)
+            callFrame->r(firstElementDest + i) = object->getIndexQuickly(i + offset);
+        for (; i < length; ++i)
+            callFrame->r(firstElementDest + i) = object->get(callFrame, i + offset);
+        return;
+    } }
+}
+
+void setupVarargsFrame(CallFrame* callFrame, CallFrame* newCallFrame, JSValue arguments, uint32_t offset, uint32_t length)
+{
+    VirtualRegister calleeFrameOffset(newCallFrame - callFrame);
+    
+    loadVarargs(
+        callFrame,
+        calleeFrameOffset + CallFrame::argumentOffset(0),
+        arguments, offset, length);
+    
+    newCallFrame->setArgumentCountIncludingThis(length + 1);
+}
+
+void setupVarargsFrameAndSetThis(CallFrame* callFrame, CallFrame* newCallFrame, JSValue thisValue, JSValue arguments, uint32_t firstVarArgOffset, uint32_t length)
+{
+    setupVarargsFrame(callFrame, newCallFrame, arguments, firstVarArgOffset, length);
+    newCallFrame->setThisValue(thisValue);
+}
+
+void setupForwardArgumentsFrame(CallFrame* execCaller, CallFrame* execCallee, uint32_t length)
+{
+    ASSERT(length == execCaller->argumentCount());
+    unsigned offset = execCaller->argumentOffset(0) * sizeof(Register);
+    memcpy(reinterpret_cast<char*>(execCallee) + offset, reinterpret_cast<char*>(execCaller) + offset, length * sizeof(Register));
+    execCallee->setArgumentCountIncludingThis(length + 1);
+}
+
+void setupForwardArgumentsFrameAndSetThis(CallFrame* execCaller, CallFrame* execCallee, JSValue thisValue, uint32_t length)
+{
+    setupForwardArgumentsFrame(execCaller, execCallee, length);
+    execCallee->setThisValue(thisValue);
+}
+
+    
+
+Interpreter::Interpreter(VM& vm)
+    : m_vm(vm)
+#if !ENABLE(JIT)
+    , m_cloopStack(vm)
+#endif
+    , m_errorHandlingModeReentry(0)
+#if !ASSERT_DISABLED
+    , m_initialized(false)
+#endif
+{
+}
+
+Interpreter::~Interpreter()
+{
+}
+
+void Interpreter::initialize()
+{
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+    m_opcodeTable = LLInt::opcodeMap();
+    for (int i = 0; i < numOpcodeIDs; ++i)
+        m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
+#endif
+
+#if !ASSERT_DISABLED
+    m_initialized = true;
+#endif
+}
+
+#ifdef NDEBUG
+
+void Interpreter::dumpCallFrame(CallFrame*)
+{
+}
+
+#else
+
+void Interpreter::dumpCallFrame(CallFrame* callFrame)
+{
+    callFrame->codeBlock()->dumpBytecode();
+    dumpRegisters(callFrame);
+}
+
+class DumpRegisterFunctor {
+public:
+    DumpRegisterFunctor(const Register*& it)
+        : m_hasSkippedFirstFrame(false)
+        , m_it(it)
+    {
+    }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        if (!m_hasSkippedFirstFrame) {
+            m_hasSkippedFirstFrame = true;
+            return StackVisitor::Continue;
+        }
+
+        unsigned line = 0;
+        unsigned unusedColumn = 0;
+        visitor->computeLineAndColumn(line, unusedColumn);
+        dataLogF("[ReturnVPC]                | %10p | %d (line %d)\n", m_it, visitor->bytecodeOffset(), line);
+        --m_it;
+        return StackVisitor::Done;
+    }
+
+private:
+    mutable bool m_hasSkippedFirstFrame;
+    const Register*& m_it;
+};
+
+void Interpreter::dumpRegisters(CallFrame* callFrame)
+{
+    dataLogF("Register frame: \n\n");
+    dataLogF("-----------------------------------------------------------------------------\n");
+    dataLogF("            use            |   address  |                value               \n");
+    dataLogF("-----------------------------------------------------------------------------\n");
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    const Register* it;
+    const Register* end;
+
+    it = callFrame->registers() + CallFrameSlot::thisArgument + callFrame->argumentCount();
+    end = callFrame->registers() + CallFrameSlot::thisArgument - 1;
+    while (it > end) {
+        JSValue v = it->jsValue();
+        int registerNumber = it - callFrame->registers();
+        String name = codeBlock->nameForRegister(VirtualRegister(registerNumber));
+        dataLogF("[r% 3d %14s]      | %10p | %-16s 0x%lld \n", registerNumber, name.ascii().data(), it, toCString(v).data(), (long long)JSValue::encode(v));
+        --it;
+    }
+    
+    dataLogF("-----------------------------------------------------------------------------\n");
+    dataLogF("[ArgumentCount]            | %10p | %lu \n", it, (unsigned long) callFrame->argumentCount());
+    --it;
+    dataLogF("[CallerFrame]              | %10p | %p \n", it, callFrame->callerFrame());
+    --it;
+    dataLogF("[Callee]                   | %10p | %p \n", it, callFrame->jsCallee());
+    --it;
+    // FIXME: Remove the next decrement when the ScopeChain slot is removed from the call header
+    --it;
+#if ENABLE(JIT)
+    AbstractPC pc = callFrame->abstractReturnPC(callFrame->vm());
+    if (pc.hasJITReturnAddress())
+        dataLogF("[ReturnJITPC]              | %10p | %p \n", it, pc.jitReturnAddress().value());
+#endif
+
+    DumpRegisterFunctor functor(it);
+    callFrame->iterate(functor);
+
+    dataLogF("[CodeBlock]                | %10p | %p \n", it, callFrame->codeBlock());
+    --it;
+    dataLogF("-----------------------------------------------------------------------------\n");
+
+    end = it - codeBlock->m_numVars;
+    if (it != end) {
+        do {
+            JSValue v = it->jsValue();
+            int registerNumber = it - callFrame->registers();
+            String name = codeBlock->nameForRegister(VirtualRegister(registerNumber));
+            dataLogF("[r% 3d %14s]      | %10p | %-16s 0x%lld \n", registerNumber, name.ascii().data(), it, toCString(v).data(), (long long)JSValue::encode(v));
+            --it;
+        } while (it != end);
+    }
+    dataLogF("-----------------------------------------------------------------------------\n");
+
+    end = it - codeBlock->m_numCalleeLocals + codeBlock->m_numVars;
+    if (it != end) {
+        do {
+            JSValue v = (*it).jsValue();
+            int registerNumber = it - callFrame->registers();
+            dataLogF("[r% 3d]                     | %10p | %-16s 0x%lld \n", registerNumber, it, toCString(v).data(), (long long)JSValue::encode(v));
+            --it;
+        } while (it != end);
+    }
+    dataLogF("-----------------------------------------------------------------------------\n");
+}
+
+#endif
+
+bool Interpreter::isOpcode(Opcode opcode)
+{
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+    return opcode != HashTraits<Opcode>::emptyValue()
+        && !HashTraits<Opcode>::isDeletedValue(opcode)
+        && m_opcodeIDTable.contains(opcode);
+#else
+    return opcode >= 0 && opcode <= op_end;
+#endif
+}
+
+class GetStackTraceFunctor {
+public:
+    GetStackTraceFunctor(VM& vm, Vector<StackFrame>& results, size_t framesToSkip, size_t capacity)
+        : m_vm(vm)
+        , m_results(results)
+        , m_framesToSkip(framesToSkip)
+        , m_remainingCapacityForFrameCapture(capacity)
+    {
+        m_results.reserveInitialCapacity(capacity);
+    }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        if (m_framesToSkip > 0) {
+            m_framesToSkip--;
+            return StackVisitor::Continue;
+        }
+
+        if (m_remainingCapacityForFrameCapture) {
+            if (!visitor->isWasmFrame()
+                && !!visitor->codeBlock()
+                && !visitor->codeBlock()->unlinkedCodeBlock()->isBuiltinFunction()) {
+                m_results.append(
+                    StackFrame(m_vm, visitor->callee(), visitor->codeBlock(), visitor->bytecodeOffset()));
+            } else {
+                m_results.append(
+                    StackFrame(m_vm,  visitor->callee()));
+            }
+    
+            m_remainingCapacityForFrameCapture--;
+            return StackVisitor::Continue;
+        }
+        return StackVisitor::Done;
+    }
+
+private:
+    VM& m_vm;
+    Vector<StackFrame>& m_results;
+    mutable size_t m_framesToSkip;
+    mutable size_t m_remainingCapacityForFrameCapture;
+};
+
+void Interpreter::getStackTrace(Vector<StackFrame>& results, size_t framesToSkip, size_t maxStackSize)
+{
+    VM& vm = m_vm;
+    CallFrame* callFrame = vm.topCallFrame;
+    if (!callFrame)
+        return;
+
+    size_t framesCount = 0;
+    callFrame->iterate([&] (StackVisitor&) -> StackVisitor::Status {
+        framesCount++;
+        return StackVisitor::Continue;
+    });
+    if (framesCount <= framesToSkip)
+        return;
+
+    framesCount -= framesToSkip;
+    framesCount = std::min(maxStackSize, framesCount);
+
+    GetStackTraceFunctor functor(vm, results, framesToSkip, framesCount);
+    callFrame->iterate(functor);
+    ASSERT(results.size() == results.capacity());
+}
+
+JSString* Interpreter::stackTraceAsString(VM& vm, const Vector<StackFrame>& stackTrace)
+{
+    // FIXME: JSStringJoiner could be more efficient than StringBuilder here.
+    StringBuilder builder;
+    for (unsigned i = 0; i < stackTrace.size(); i++) {
+        builder.append(String(stackTrace[i].toString(vm)));
+        if (i != stackTrace.size() - 1)
+            builder.append('\n');
+    }
+    return jsString(&vm, builder.toString());
+}
+
+ALWAYS_INLINE static HandlerInfo* findExceptionHandler(StackVisitor& visitor, CodeBlock* codeBlock, RequiredHandler requiredHandler)
+{
+    ASSERT(codeBlock);
+#if ENABLE(DFG_JIT)
+    ASSERT(!visitor->isInlinedFrame());
+#endif
+
+    CallFrame* callFrame = visitor->callFrame();
+    unsigned exceptionHandlerIndex;
+    if (JITCode::isOptimizingJIT(codeBlock->jitType()))
+        exceptionHandlerIndex = callFrame->callSiteIndex().bits();
+    else
+        exceptionHandlerIndex = callFrame->bytecodeOffset();
+
+    return codeBlock->handlerForIndex(exceptionHandlerIndex, requiredHandler);
+}
+
+class GetCatchHandlerFunctor {
+public:
+    GetCatchHandlerFunctor()
+        : m_handler(0)
+    {
+    }
+
+    HandlerInfo* handler() { return m_handler; }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        visitor.unwindToMachineCodeBlockFrame();
+
+        CodeBlock* codeBlock = visitor->codeBlock();
+        if (!codeBlock)
+            return StackVisitor::Continue;
+
+        m_handler = findExceptionHandler(visitor, codeBlock, RequiredHandler::CatchHandler);
+        if (m_handler)
+            return StackVisitor::Done;
+
+        return StackVisitor::Continue;
+    }
+
+private:
+    mutable HandlerInfo* m_handler;
+};
+
+ALWAYS_INLINE static void notifyDebuggerOfUnwinding(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto catchScope = DECLARE_CATCH_SCOPE(vm);
+    if (Debugger* debugger = callFrame->vmEntryGlobalObject()->debugger()) {
+        SuspendExceptionScope scope(&vm);
+        if (jsDynamicCast<JSFunction*>(callFrame->jsCallee()))
+            debugger->unwindEvent(callFrame);
+        else
+            debugger->didExecuteProgram(callFrame);
+        ASSERT_UNUSED(catchScope, !catchScope.exception());
+    }
+}
+
+class UnwindFunctor {
+public:
+    UnwindFunctor(CallFrame*& callFrame, bool isTermination, CodeBlock*& codeBlock, HandlerInfo*& handler)
+        : m_callFrame(callFrame)
+        , m_isTermination(isTermination)
+        , m_codeBlock(codeBlock)
+        , m_handler(handler)
+    {
+    }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        visitor.unwindToMachineCodeBlockFrame();
+        m_callFrame = visitor->callFrame();
+        m_codeBlock = visitor->codeBlock();
+
+        m_handler = nullptr;
+        if (!m_isTermination) {
+            if (m_codeBlock) {
+                m_handler = findExceptionHandler(visitor, m_codeBlock, RequiredHandler::AnyHandler);
+                if (m_handler)
+                    return StackVisitor::Done;
+            }
+        }
+
+        notifyDebuggerOfUnwinding(m_callFrame);
+
+        copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(visitor);
+
+        bool shouldStopUnwinding = visitor->callerIsVMEntryFrame();
+        if (shouldStopUnwinding)
+            return StackVisitor::Done;
+
+        return StackVisitor::Continue;
+    }
+
+private:
+    void copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(StackVisitor& visitor) const
+    {
+#if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+        RegisterAtOffsetList* currentCalleeSaves = visitor->calleeSaveRegisters();
+
+        if (!currentCalleeSaves)
+            return;
+
+        VM& vm = m_callFrame->vm();
+        RegisterAtOffsetList* allCalleeSaves = vm.getAllCalleeSaveRegisterOffsets();
+        RegisterSet dontCopyRegisters = RegisterSet::stackRegisters();
+        intptr_t* frame = reinterpret_cast<intptr_t*>(m_callFrame->registers());
+
+        unsigned registerCount = currentCalleeSaves->size();
+        VMEntryRecord* record = vmEntryRecord(vm.topVMEntryFrame);
+        for (unsigned i = 0; i < registerCount; i++) {
+            RegisterAtOffset currentEntry = currentCalleeSaves->at(i);
+            if (dontCopyRegisters.get(currentEntry.reg()))
+                continue;
+            RegisterAtOffset* calleeSavesEntry = allCalleeSaves->find(currentEntry.reg());
+            
+            record->calleeSaveRegistersBuffer[calleeSavesEntry->offsetAsIndex()] = *(frame + currentEntry.offsetAsIndex());
+        }
+#else
+        UNUSED_PARAM(visitor);
+#endif
+    }
+
+    CallFrame*& m_callFrame;
+    bool m_isTermination;
+    CodeBlock*& m_codeBlock;
+    HandlerInfo*& m_handler;
+};
+
+NEVER_INLINE HandlerInfo* Interpreter::unwind(VM& vm, CallFrame*& callFrame, Exception* exception, UnwindStart unwindStart)
+{
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    if (unwindStart == UnwindFromCallerFrame) {
+        if (callFrame->callerFrameOrVMEntryFrame() == vm.topVMEntryFrame)
+            return nullptr;
+
+        callFrame = callFrame->callerFrame();
+        vm.topCallFrame = callFrame;
+    }
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    JSValue exceptionValue = exception->value();
+    ASSERT(!exceptionValue.isEmpty());
+    ASSERT(!exceptionValue.isCell() || exceptionValue.asCell());
+    // This shouldn't be possible (hence the assertions), but we're already in the slowest of
+    // slow cases, so let's harden against it anyway to be safe.
+    if (exceptionValue.isEmpty() || (exceptionValue.isCell() && !exceptionValue.asCell()))
+        exceptionValue = jsNull();
+
+    ASSERT_UNUSED(scope, scope.exception() && scope.exception()->stack().size());
+
+    // Calculate an exception handler vPC, unwinding call frames as necessary.
+    HandlerInfo* handler = nullptr;
+    UnwindFunctor functor(callFrame, isTerminatedExecutionException(exception), codeBlock, handler);
+    callFrame->iterate(functor);
+    if (!handler)
+        return nullptr;
+
+    return handler;
+}
+
+void Interpreter::notifyDebuggerOfExceptionToBeThrown(CallFrame* callFrame, Exception* exception)
+{
+    Debugger* debugger = callFrame->vmEntryGlobalObject()->debugger();
+    if (debugger && debugger->needsExceptionCallbacks() && !exception->didNotifyInspectorOfThrow()) {
+        // This code assumes that if the debugger is enabled then there is no inlining.
+        // If that assumption turns out to be false then we'll ignore the inlined call
+        // frames.
+        // https://bugs.webkit.org/show_bug.cgi?id=121754
+
+        bool hasCatchHandler;
+        bool isTermination = isTerminatedExecutionException(exception);
+        if (isTermination)
+            hasCatchHandler = false;
+        else {
+            GetCatchHandlerFunctor functor;
+            callFrame->iterate(functor);
+            HandlerInfo* handler = functor.handler();
+            ASSERT(!handler || handler->isCatchHandler());
+            hasCatchHandler = !!handler;
+        }
+
+        debugger->exception(callFrame, exception->value(), hasCatchHandler);
+    }
+    exception->setDidNotifyInspectorOfThrow();
+}
+
+static inline JSValue checkedReturn(JSValue returnValue)
+{
+    ASSERT(returnValue);
+    return returnValue;
+}
+
+static inline JSObject* checkedReturn(JSObject* returnValue)
+{
+    ASSERT(returnValue);
+    return returnValue;
+}
+
+JSValue Interpreter::executeProgram(const SourceCode& source, CallFrame* callFrame, JSObject* thisObj)
+{
+    JSScope* scope = thisObj->globalObject()->globalScope();
+    VM& vm = *scope->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    ProgramExecutable* program = ProgramExecutable::create(callFrame, source);
+    ASSERT(throwScope.exception() || program);
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    ASSERT(!throwScope.exception());
+    ASSERT(!vm.isCollectorBusyOnCurrentThread());
+    RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
+    if (vm.isCollectorBusyOnCurrentThread())
+        return jsNull();
+
+    if (UNLIKELY(!vm.isSafeToRecurseSoft()))
+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
+
+    // First check if the "program" is actually just a JSON object. If so,
+    // we'll handle the JSON object here. Else, we'll handle real JS code
+    // below at failedJSONP.
+
+    Vector<JSONPData> JSONPData;
+    bool parseResult;
+    StringView programSource = program->source().view();
+    if (programSource.isNull())
+        return jsUndefined();
+    if (programSource.is8Bit()) {
+        LiteralParser<LChar> literalParser(callFrame, programSource.characters8(), programSource.length(), JSONP);
+        parseResult = literalParser.tryJSONPParse(JSONPData, scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()));
+    } else {
+        LiteralParser<UChar> literalParser(callFrame, programSource.characters16(), programSource.length(), JSONP);
+        parseResult = literalParser.tryJSONPParse(JSONPData, scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()));
+    }
+
+    if (parseResult) {
+        JSGlobalObject* globalObject = scope->globalObject();
+        JSValue result;
+        for (unsigned entry = 0; entry < JSONPData.size(); entry++) {
+            Vector<JSONPPathEntry> JSONPPath;
+            JSONPPath.swap(JSONPData[entry].m_path);
+            JSValue JSONPValue = JSONPData[entry].m_value.get();
+            if (JSONPPath.size() == 1 && JSONPPath[0].m_type == JSONPPathEntryTypeDeclare) {
+                globalObject->addVar(callFrame, JSONPPath[0].m_pathEntryName);
+                PutPropertySlot slot(globalObject);
+                globalObject->methodTable()->put(globalObject, callFrame, JSONPPath[0].m_pathEntryName, JSONPValue, slot);
+                result = jsUndefined();
+                continue;
+            }
+            JSValue baseObject(globalObject);
+            for (unsigned i = 0; i < JSONPPath.size() - 1; i++) {
+                ASSERT(JSONPPath[i].m_type != JSONPPathEntryTypeDeclare);
+                switch (JSONPPath[i].m_type) {
+                case JSONPPathEntryTypeDot: {
+                    if (i == 0) {
+                        PropertySlot slot(globalObject, PropertySlot::InternalMethodType::Get);
+                        if (!globalObject->getPropertySlot(callFrame, JSONPPath[i].m_pathEntryName, slot)) {
+                            RETURN_IF_EXCEPTION(throwScope, JSValue());
+                            if (entry)
+                                return throwException(callFrame, throwScope, createUndefinedVariableError(callFrame, JSONPPath[i].m_pathEntryName));
+                            goto failedJSONP;
+                        }
+                        baseObject = slot.getValue(callFrame, JSONPPath[i].m_pathEntryName);
+                    } else
+                        baseObject = baseObject.get(callFrame, JSONPPath[i].m_pathEntryName);
+                    RETURN_IF_EXCEPTION(throwScope, JSValue());
+                    continue;
+                }
+                case JSONPPathEntryTypeLookup: {
+                    baseObject = baseObject.get(callFrame, static_cast<unsigned>(JSONPPath[i].m_pathIndex));
+                    RETURN_IF_EXCEPTION(throwScope, JSValue());
+                    continue;
+                }
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                    return jsUndefined();
+                }
+            }
+            PutPropertySlot slot(baseObject);
+            switch (JSONPPath.last().m_type) {
+            case JSONPPathEntryTypeCall: {
+                JSValue function = baseObject.get(callFrame, JSONPPath.last().m_pathEntryName);
+                RETURN_IF_EXCEPTION(throwScope, JSValue());
+                CallData callData;
+                CallType callType = getCallData(function, callData);
+                if (callType == CallType::None)
+                    return throwException(callFrame, throwScope, createNotAFunctionError(callFrame, function));
+                MarkedArgumentBuffer jsonArg;
+                jsonArg.append(JSONPValue);
+                JSValue thisValue = JSONPPath.size() == 1 ? jsUndefined(): baseObject;
+                JSONPValue = JSC::call(callFrame, function, callType, callData, thisValue, jsonArg);
+                RETURN_IF_EXCEPTION(throwScope, JSValue());
+                break;
+            }
+            case JSONPPathEntryTypeDot: {
+                baseObject.put(callFrame, JSONPPath.last().m_pathEntryName, JSONPValue, slot);
+                RETURN_IF_EXCEPTION(throwScope, JSValue());
+                break;
+            }
+            case JSONPPathEntryTypeLookup: {
+                baseObject.putByIndex(callFrame, JSONPPath.last().m_pathIndex, JSONPValue, slot.isStrictMode());
+                RETURN_IF_EXCEPTION(throwScope, JSValue());
+                break;
+            }
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+                    return jsUndefined();
+            }
+            result = JSONPValue;
+        }
+        return result;
+    }
+failedJSONP:
+    // If we get here, then we have already proven that the script is not a JSON
+    // object.
+
+    VMEntryScope entryScope(vm, scope->globalObject());
+
+    // Compile source to bytecode if necessary:
+    if (JSObject* error = program->initializeGlobalProperties(vm, callFrame, scope))
+        return checkedReturn(throwException(callFrame, throwScope, error));
+
+    ProgramCodeBlock* codeBlock;
+    {
+        CodeBlock* tempCodeBlock;
+        JSObject* error = program->prepareForExecution<ProgramExecutable>(vm, nullptr, scope, CodeForCall, tempCodeBlock);
+        ASSERT(!throwScope.exception() || throwScope.exception() == jsDynamicCast<Exception*>(error));
+        if (error)
+            return checkedReturn(throwException(callFrame, throwScope, error));
+        codeBlock = jsCast<ProgramCodeBlock*>(tempCodeBlock);
+    }
+
+    if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
+        return throwTerminatedExecutionException(callFrame, throwScope);
+
+    if (scope->structure()->isUncacheableDictionary())
+        scope->flattenDictionaryObject(vm);
+
+    ASSERT(codeBlock->numParameters() == 1); // 1 parameter for 'this'.
+
+    ProtoCallFrame protoCallFrame;
+    protoCallFrame.init(codeBlock, JSCallee::create(vm, scope->globalObject(), scope), thisObj, 1);
+
+    // Execute the code:
+    JSValue result = program->generatedJITCode()->execute(&vm, &protoCallFrame);
+    throwScope.release();
+    return checkedReturn(result);
+}
+
+JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
+{
+    VM& vm = callFrame->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT(!throwScope.exception());
+    ASSERT(!vm.isCollectorBusyOnCurrentThread());
+    if (vm.isCollectorBusyOnCurrentThread())
+        return jsNull();
+
+    bool isJSCall = (callType == CallType::JS);
+    JSScope* scope = nullptr;
+    CodeBlock* newCodeBlock;
+    size_t argsCount = 1 + args.size(); // implicit "this" parameter
+
+    JSGlobalObject* globalObject;
+
+    if (isJSCall) {
+        scope = callData.js.scope;
+        globalObject = scope->globalObject();
+    } else {
+        ASSERT(callType == CallType::Host);
+        globalObject = function->globalObject();
+    }
+
+    VMEntryScope entryScope(vm, globalObject);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft()))
+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
+
+    if (isJSCall) {
+        // Compile the callee:
+        JSObject* compileError = callData.js.functionExecutable->prepareForExecution<FunctionExecutable>(vm, jsCast<JSFunction*>(function), scope, CodeForCall, newCodeBlock);
+        ASSERT(throwScope.exception() == reinterpret_cast<Exception*>(compileError));
+        if (UNLIKELY(!!compileError))
+            return checkedReturn(throwException(callFrame, throwScope, compileError));
+
+        ASSERT(!!newCodeBlock);
+        newCodeBlock->m_shouldAlwaysBeInlined = false;
+    } else
+        newCodeBlock = 0;
+
+    if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
+        return throwTerminatedExecutionException(callFrame, throwScope);
+
+    ProtoCallFrame protoCallFrame;
+    protoCallFrame.init(newCodeBlock, function, thisValue, argsCount, args.data());
+
+    JSValue result;
+    {
+        // Execute the code:
+        if (isJSCall) {
+            result = callData.js.functionExecutable->generatedJITCodeForCall()->execute(&vm, &protoCallFrame);
+            throwScope.release();
+        } else {
+            result = JSValue::decode(vmEntryToNative(reinterpret_cast<void*>(callData.native.function), &vm, &protoCallFrame));
+            RETURN_IF_EXCEPTION(throwScope, JSValue());
+        }
+    }
+
+    return checkedReturn(result);
+}
+
+JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* constructor, ConstructType constructType, const ConstructData& constructData, const ArgList& args, JSValue newTarget)
+{
+    VM& vm = callFrame->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT(!throwScope.exception());
+    ASSERT(!vm.isCollectorBusyOnCurrentThread());
+    // We throw in this case because we have to return something "valid" but we're
+    // already in an invalid state.
+    if (vm.isCollectorBusyOnCurrentThread())
+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
+
+    bool isJSConstruct = (constructType == ConstructType::JS);
+    JSScope* scope = nullptr;
+    CodeBlock* newCodeBlock;
+    size_t argsCount = 1 + args.size(); // implicit "this" parameter
+
+    JSGlobalObject* globalObject;
+
+    if (isJSConstruct) {
+        scope = constructData.js.scope;
+        globalObject = scope->globalObject();
+    } else {
+        ASSERT(constructType == ConstructType::Host);
+        globalObject = constructor->globalObject();
+    }
+
+    VMEntryScope entryScope(vm, globalObject);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft()))
+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
+
+    if (isJSConstruct) {
+        // Compile the callee:
+        JSObject* compileError = constructData.js.functionExecutable->prepareForExecution<FunctionExecutable>(vm, jsCast<JSFunction*>(constructor), scope, CodeForConstruct, newCodeBlock);
+        if (UNLIKELY(!!compileError))
+            return checkedReturn(throwException(callFrame, throwScope, compileError));
+
+        ASSERT(!!newCodeBlock);
+        newCodeBlock->m_shouldAlwaysBeInlined = false;
+    } else
+        newCodeBlock = 0;
+
+    if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
+        return throwTerminatedExecutionException(callFrame, throwScope);
+
+    ProtoCallFrame protoCallFrame;
+    protoCallFrame.init(newCodeBlock, constructor, newTarget, argsCount, args.data());
+
+    JSValue result;
+    {
+        // Execute the code.
+        if (isJSConstruct)
+            result = constructData.js.functionExecutable->generatedJITCodeForConstruct()->execute(&vm, &protoCallFrame);
+        else {
+            result = JSValue::decode(vmEntryToNative(reinterpret_cast<void*>(constructData.native.function), &vm, &protoCallFrame));
+
+            if (LIKELY(!throwScope.exception()))
+                RELEASE_ASSERT(result.isObject());
+        }
+    }
+
+    RETURN_IF_EXCEPTION(throwScope, 0);
+    ASSERT(result.isObject());
+    return checkedReturn(asObject(result));
+}
+
+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionExecutable, CallFrame* callFrame, ProtoCallFrame* protoCallFrame, JSFunction* function, int argumentCountIncludingThis, JSScope* scope, const ArgList& args)
+{
+    VM& vm = *scope->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    ASSERT(!throwScope.exception());
+    
+    if (vm.isCollectorBusyOnCurrentThread())
+        return CallFrameClosure();
+
+    // Compile the callee:
+    CodeBlock* newCodeBlock;
+    JSObject* error = functionExecutable->prepareForExecution<FunctionExecutable>(vm, function, scope, CodeForCall, newCodeBlock);
+    if (error) {
+        throwException(callFrame, throwScope, error);
+        return CallFrameClosure();
+    }
+    newCodeBlock->m_shouldAlwaysBeInlined = false;
+
+    size_t argsCount = argumentCountIncludingThis;
+
+    protoCallFrame->init(newCodeBlock, function, jsUndefined(), argsCount, args.data());
+    // Return the successful closure:
+    CallFrameClosure result = { callFrame, protoCallFrame, function, functionExecutable, &vm, scope, newCodeBlock->numParameters(), argumentCountIncludingThis };
+    return result;
+}
+
+JSValue Interpreter::execute(CallFrameClosure& closure) 
+{
+    VM& vm = *closure.vm;
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT(!vm.isCollectorBusyOnCurrentThread());
+    RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
+    if (vm.isCollectorBusyOnCurrentThread())
+        return jsNull();
+
+    StackStats::CheckPoint stackCheckPoint;
+
+    if (UNLIKELY(vm.shouldTriggerTermination(closure.oldCallFrame)))
+        return throwTerminatedExecutionException(closure.oldCallFrame, throwScope);
+
+    // Execute the code:
+    JSValue result = closure.functionExecutable->generatedJITCodeForCall()->execute(&vm, closure.protoCallFrame);
+
+    return checkedReturn(result);
+}
+
+JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue thisValue, JSScope* scope)
+{
+    VM& vm = *scope->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT(scope->vm() == &callFrame->vm());
+    ASSERT(!throwScope.exception());
+    ASSERT(!vm.isCollectorBusyOnCurrentThread());
+    RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
+    if (vm.isCollectorBusyOnCurrentThread())
+        return jsNull();
+
+    VMEntryScope entryScope(vm, scope->globalObject());
+    if (UNLIKELY(!vm.isSafeToRecurseSoft()))
+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
+
+    unsigned numVariables = eval->numVariables();
+    int numFunctions = eval->numberOfFunctionDecls();
+
+    JSScope* variableObject;
+    if ((numVariables || numFunctions) && eval->isStrictMode()) {
+        scope = StrictEvalActivation::create(callFrame, scope);
+        variableObject = scope;
+    } else {
+        for (JSScope* node = scope; ; node = node->next()) {
+            RELEASE_ASSERT(node);
+            if (node->isGlobalObject()) {
+                variableObject = node;
+                break;
+            } 
+            if (node->isJSLexicalEnvironment()) {
+                JSLexicalEnvironment* lexicalEnvironment = jsCast<JSLexicalEnvironment*>(node);
+                if (lexicalEnvironment->symbolTable()->scopeType() == SymbolTable::ScopeType::VarScope) {
+                    variableObject = node;
+                    break;
+                }
+            }
+        }
+    }
+
+    EvalCodeBlock* codeBlock;
+    {
+        CodeBlock* tempCodeBlock;
+        JSObject* compileError = eval->prepareForExecution<EvalExecutable>(vm, nullptr, scope, CodeForCall, tempCodeBlock);
+        if (UNLIKELY(!!compileError))
+            return checkedReturn(throwException(callFrame, throwScope, compileError));
+        codeBlock = jsCast<EvalCodeBlock*>(tempCodeBlock);
+    }
+
+    // We can't declare a "var"/"function" that overwrites a global "let"/"const"/"class" in a sloppy-mode eval.
+    if (variableObject->isGlobalObject() && !eval->isStrictMode() && (numVariables || numFunctions)) {
+        JSGlobalLexicalEnvironment* globalLexicalEnvironment = jsCast<JSGlobalObject*>(variableObject)->globalLexicalEnvironment();
+        for (unsigned i = 0; i < numVariables; ++i) {
+            const Identifier& ident = codeBlock->variable(i);
+            PropertySlot slot(globalLexicalEnvironment, PropertySlot::InternalMethodType::VMInquiry);
+            if (JSGlobalLexicalEnvironment::getOwnPropertySlot(globalLexicalEnvironment, callFrame, ident, slot)) {
+                return checkedReturn(throwTypeError(callFrame, throwScope, makeString("Can't create duplicate global variable in eval: '", String(ident.impl()), "'")));
+            }
+        }
+
+        for (int i = 0; i < numFunctions; ++i) {
+            FunctionExecutable* function = codeBlock->functionDecl(i);
+            PropertySlot slot(globalLexicalEnvironment, PropertySlot::InternalMethodType::VMInquiry);
+            if (JSGlobalLexicalEnvironment::getOwnPropertySlot(globalLexicalEnvironment, callFrame, function->name(), slot)) {
+                return checkedReturn(throwTypeError(callFrame, throwScope, makeString("Can't create duplicate global variable in eval: '", String(function->name().impl()), "'")));
+            }
+        }
+    }
+
+    if (variableObject->structure()->isUncacheableDictionary())
+        variableObject->flattenDictionaryObject(vm);
+
+    if (numVariables || numFunctions) {
+        BatchedTransitionOptimizer optimizer(vm, variableObject);
+        if (variableObject->next() && !eval->isStrictMode())
+            variableObject->globalObject()->varInjectionWatchpoint()->fireAll(vm, "Executed eval, fired VarInjection watchpoint");
+
+        for (unsigned i = 0; i < numVariables; ++i) {
+            const Identifier& ident = codeBlock->variable(i);
+            if (!variableObject->hasProperty(callFrame, ident)) {
+                PutPropertySlot slot(variableObject);
+                variableObject->methodTable()->put(variableObject, callFrame, ident, jsUndefined(), slot);
+            }
+        }
+
+        for (int i = 0; i < numFunctions; ++i) {
+            FunctionExecutable* function = codeBlock->functionDecl(i);
+            PutPropertySlot slot(variableObject);
+            variableObject->methodTable()->put(variableObject, callFrame, function->name(), JSFunction::create(vm, function, scope), slot);
+        }
+    }
+
+    if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
+        return throwTerminatedExecutionException(callFrame, throwScope);
+
+    ASSERT(codeBlock->numParameters() == 1); // 1 parameter for 'this'.
+
+    ProtoCallFrame protoCallFrame;
+    protoCallFrame.init(codeBlock, JSCallee::create(vm, scope->globalObject(), scope), thisValue, 1);
+
+    // Execute the code:
+    JSValue result = eval->generatedJITCode()->execute(&vm, &protoCallFrame);
+
+    return checkedReturn(result);
+}
+
+JSValue Interpreter::execute(ModuleProgramExecutable* executable, CallFrame* callFrame, JSModuleEnvironment* scope)
+{
+    VM& vm = *scope->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT(scope->vm() == &callFrame->vm());
+    ASSERT(!throwScope.exception());
+    ASSERT(!vm.isCollectorBusyOnCurrentThread());
+    RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
+    if (vm.isCollectorBusyOnCurrentThread())
+        return jsNull();
+
+    VMEntryScope entryScope(vm, scope->globalObject());
+    if (UNLIKELY(!vm.isSafeToRecurseSoft()))
+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
+
+    ModuleProgramCodeBlock* codeBlock;
+    {
+        CodeBlock* tempCodeBlock;
+        JSObject* compileError = executable->prepareForExecution<ModuleProgramExecutable>(vm, nullptr, scope, CodeForCall, tempCodeBlock);
+        if (UNLIKELY(!!compileError))
+            return checkedReturn(throwException(callFrame, throwScope, compileError));
+        codeBlock = jsCast<ModuleProgramCodeBlock*>(tempCodeBlock);
+    }
+
+    if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
+        return throwTerminatedExecutionException(callFrame, throwScope);
+
+    if (scope->structure()->isUncacheableDictionary())
+        scope->flattenDictionaryObject(vm);
+
+    ASSERT(codeBlock->numParameters() == 1); // 1 parameter for 'this'.
+
+    // The |this| of the module is always `undefined`.
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-environment-records-hasthisbinding
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-environment-records-getthisbinding
+    ProtoCallFrame protoCallFrame;
+    protoCallFrame.init(codeBlock, JSCallee::create(vm, scope->globalObject(), scope), jsUndefined(), 1);
+
+    // Execute the code:
+    JSValue result = executable->generatedJITCode()->execute(&vm, &protoCallFrame);
+
+    return checkedReturn(result);
+}
+
+NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookType debugHookType)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    Debugger* debugger = callFrame->vmEntryGlobalObject()->debugger();
+    if (!debugger)
+        return;
+
+    ASSERT(callFrame->codeBlock()->hasDebuggerRequests());
+    ASSERT_UNUSED(scope, !scope.exception());
+
+    switch (debugHookType) {
+        case DidEnterCallFrame:
+            debugger->callEvent(callFrame);
+            break;
+        case WillLeaveCallFrame:
+            debugger->returnEvent(callFrame);
+            break;
+        case WillExecuteStatement:
+            debugger->atStatement(callFrame);
+            break;
+        case WillExecuteExpression:
+            debugger->atExpression(callFrame);
+            break;
+        case WillExecuteProgram:
+            debugger->willExecuteProgram(callFrame);
+            break;
+        case DidExecuteProgram:
+            debugger->didExecuteProgram(callFrame);
+            break;
+        case DidReachBreakpoint:
+            debugger->didReachBreakpoint(callFrame);
+            break;
+    }
+    ASSERT(!scope.exception());
+}
+
+} // namespace JSC
diff --git a/interpreter/Interpreter.h b/interpreter/Interpreter.h
new file mode 100644
index 0000000..26a1024
--- /dev/null
+++ b/interpreter/Interpreter.h
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ArgList.h"
+#include "CatchScope.h"
+#include "FrameTracers.h"
+#include "JSCJSValue.h"
+#include "JSCell.h"
+#include "JSObject.h"
+#include "Opcode.h"
+#include "StackAlignment.h"
+#include <wtf/HashMap.h>
+
+#if !ENABLE(JIT)
+#include "CLoopStack.h"
+#endif
+
+
+namespace JSC {
+
+    class CodeBlock;
+    class EvalExecutable;
+    class FunctionExecutable;
+    class VM;
+    class JSFunction;
+    class JSGlobalObject;
+    class JSModuleEnvironment;
+    class JSModuleRecord;
+    class LLIntOffsetsExtractor;
+    class ProgramExecutable;
+    class ModuleProgramExecutable;
+    class Register;
+    class JSScope;
+    class StackFrame;
+    struct CallFrameClosure;
+    struct HandlerInfo;
+    struct Instruction;
+    struct ProtoCallFrame;
+    struct UnlinkedInstruction;
+
+    enum UnwindStart : uint8_t { UnwindFromCurrentFrame, UnwindFromCallerFrame };
+
+    enum DebugHookType {
+        WillExecuteProgram,
+        DidExecuteProgram,
+        DidEnterCallFrame,
+        DidReachBreakpoint,
+        WillLeaveCallFrame,
+        WillExecuteStatement,
+        WillExecuteExpression,
+    };
+
+    enum StackFrameCodeType {
+        StackFrameGlobalCode,
+        StackFrameEvalCode,
+        StackFrameModuleCode,
+        StackFrameFunctionCode,
+        StackFrameNativeCode
+    };
+
+    class Interpreter {
+        WTF_MAKE_FAST_ALLOCATED;
+        friend class CachedCall;
+        friend class LLIntOffsetsExtractor;
+        friend class JIT;
+        friend class VM;
+
+    public:
+        Interpreter(VM &);
+        ~Interpreter();
+        
+        void initialize();
+
+#if !ENABLE(JIT)
+        CLoopStack& cloopStack() { return m_cloopStack; }
+#endif
+        
+        Opcode getOpcode(OpcodeID id)
+        {
+            ASSERT(m_initialized);
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+            return m_opcodeTable[id];
+#else
+            return id;
+#endif
+        }
+
+        OpcodeID getOpcodeID(Opcode opcode)
+        {
+            ASSERT(m_initialized);
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+            ASSERT(isOpcode(opcode));
+            return m_opcodeIDTable.get(opcode);
+#else
+            return opcode;
+#endif
+        }
+
+        OpcodeID getOpcodeID(const Instruction&);
+        OpcodeID getOpcodeID(const UnlinkedInstruction&);
+
+        bool isOpcode(Opcode);
+
+        JSValue executeProgram(const SourceCode&, CallFrame*, JSObject* thisObj);
+        JSValue executeCall(CallFrame*, JSObject* function, CallType, const CallData&, JSValue thisValue, const ArgList&);
+        JSObject* executeConstruct(CallFrame*, JSObject* function, ConstructType, const ConstructData&, const ArgList&, JSValue newTarget);
+        JSValue execute(EvalExecutable*, CallFrame*, JSValue thisValue, JSScope*);
+        JSValue execute(ModuleProgramExecutable*, CallFrame*, JSModuleEnvironment*);
+
+        void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
+        
+        NEVER_INLINE HandlerInfo* unwind(VM&, CallFrame*&, Exception*, UnwindStart);
+        void notifyDebuggerOfExceptionToBeThrown(CallFrame*, Exception*);
+        NEVER_INLINE void debug(CallFrame*, DebugHookType);
+        static JSString* stackTraceAsString(VM&, const Vector<StackFrame>&);
+
+        static EncodedJSValue JSC_HOST_CALL constructWithErrorConstructor(ExecState*);
+        static EncodedJSValue JSC_HOST_CALL callErrorConstructor(ExecState*);
+        static EncodedJSValue JSC_HOST_CALL constructWithNativeErrorConstructor(ExecState*);
+        static EncodedJSValue JSC_HOST_CALL callNativeErrorConstructor(ExecState*);
+
+        JS_EXPORT_PRIVATE void dumpCallFrame(CallFrame*);
+
+        void getStackTrace(Vector<StackFrame>& results, size_t framesToSkip = 0, size_t maxStackSize = std::numeric_limits<size_t>::max());
+
+    private:
+        enum ExecutionFlag { Normal, InitializeAndReturn };
+
+        CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, ProtoCallFrame*, JSFunction*, int argumentCountIncludingThis, JSScope*, const ArgList&);
+
+        JSValue execute(CallFrameClosure&);
+
+
+
+        void dumpRegisters(CallFrame*);
+        
+        bool isCallBytecode(Opcode opcode) { return opcode == getOpcode(op_call) || opcode == getOpcode(op_construct) || opcode == getOpcode(op_call_eval) || opcode == getOpcode(op_tail_call); }
+
+        VM& m_vm;
+#if !ENABLE(JIT)
+        CLoopStack m_cloopStack;
+#endif
+        int m_errorHandlingModeReentry;
+        
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+        Opcode* m_opcodeTable; // Maps OpcodeID => Opcode for compiling
+        HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
+#endif
+
+#if !ASSERT_DISABLED
+        bool m_initialized;
+#endif
+    };
+
+    JSValue eval(CallFrame*);
+
+    inline CallFrame* calleeFrameForVarargs(CallFrame* callFrame, unsigned numUsedStackSlots, unsigned argumentCountIncludingThis)
+    {
+        // We want the new frame to be allocated on a stack aligned offset with a stack
+        // aligned size. Align the size here.
+        argumentCountIncludingThis = WTF::roundUpToMultipleOf(
+            stackAlignmentRegisters(),
+            argumentCountIncludingThis + CallFrame::headerSizeInRegisters) - CallFrame::headerSizeInRegisters;
+
+        // Align the frame offset here.
+        unsigned paddedCalleeFrameOffset = WTF::roundUpToMultipleOf(
+            stackAlignmentRegisters(),
+            numUsedStackSlots + argumentCountIncludingThis + CallFrame::headerSizeInRegisters);
+        return CallFrame::create(callFrame->registers() - paddedCalleeFrameOffset);
+    }
+
+    unsigned sizeOfVarargs(CallFrame* exec, JSValue arguments, uint32_t firstVarArgOffset);
+    static const unsigned maxArguments = 0x10000;
+    unsigned sizeFrameForVarargs(CallFrame* exec, VM&, JSValue arguments, unsigned numUsedStackSlots, uint32_t firstVarArgOffset);
+    unsigned sizeFrameForForwardArguments(CallFrame* exec, VM&, unsigned numUsedStackSlots);
+    void loadVarargs(CallFrame* execCaller, VirtualRegister firstElementDest, JSValue source, uint32_t offset, uint32_t length);
+    void setupVarargsFrame(CallFrame* execCaller, CallFrame* execCallee, JSValue arguments, uint32_t firstVarArgOffset, uint32_t length);
+    void setupVarargsFrameAndSetThis(CallFrame* execCaller, CallFrame* execCallee, JSValue thisValue, JSValue arguments, uint32_t firstVarArgOffset, uint32_t length);
+    void setupForwardArgumentsFrame(CallFrame* execCaller, CallFrame* execCallee, uint32_t length);
+    void setupForwardArgumentsFrameAndSetThis(CallFrame* execCaller, CallFrame* execCallee, JSValue thisValue, uint32_t length);
+    
+} // namespace JSC
diff --git a/interpreter/InterpreterInlines.h b/interpreter/InterpreterInlines.h
new file mode 100644
index 0000000..177c154
--- /dev/null
+++ b/interpreter/InterpreterInlines.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Instruction.h"
+#include "Interpreter.h"
+#include "UnlinkedCodeBlock.h"
+
+namespace JSC {
+
+inline OpcodeID Interpreter::getOpcodeID(const Instruction& instruction)
+{
+    return getOpcodeID(instruction.u.opcode);
+}
+
+inline OpcodeID Interpreter::getOpcodeID(const UnlinkedInstruction& instruction)
+{
+    return instruction.u.opcode;
+}
+
+} // namespace JSC
diff --git a/interpreter/ProtoCallFrame.cpp b/interpreter/ProtoCallFrame.cpp
new file mode 100644
index 0000000..eb80b2c
--- /dev/null
+++ b/interpreter/ProtoCallFrame.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProtoCallFrame.h"
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+#include "StackAlignment.h"
+
+namespace JSC {
+
+void ProtoCallFrame::init(CodeBlock* codeBlock, JSObject* callee, JSValue thisValue, int argCountIncludingThis, JSValue* otherArgs)
+{
+    this->args = otherArgs;
+    this->setCodeBlock(codeBlock);
+    this->setCallee(callee);
+    this->setArgumentCountIncludingThis(argCountIncludingThis);
+    if (codeBlock && argCountIncludingThis < codeBlock->numParameters())
+        this->arityMissMatch = true;
+    else
+        this->arityMissMatch = false;
+
+    // Round up argCountIncludingThis to keep the stack frame size aligned.
+    size_t paddedArgsCount = roundArgumentCountToAlignFrame(argCountIncludingThis);
+    this->setPaddedArgCount(paddedArgsCount);
+    this->clearCurrentVPC();
+    this->setThisValue(thisValue);
+}
+
+} // namespace JSC
diff --git a/interpreter/ProtoCallFrame.h b/interpreter/ProtoCallFrame.h
new file mode 100644
index 0000000..e41de5f
--- /dev/null
+++ b/interpreter/ProtoCallFrame.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Register.h"
+#include <wtf/ForbidHeapAllocation.h>
+
+namespace JSC {
+
+struct JS_EXPORT_PRIVATE ProtoCallFrame {
+    WTF_FORBID_HEAP_ALLOCATION;
+public:
+    Register codeBlockValue;
+    Register calleeValue;
+    Register argCountAndCodeOriginValue;
+    Register thisArg;
+    uint32_t paddedArgCount;
+    bool arityMissMatch;
+    JSValue *args;
+
+    void init(CodeBlock*, JSObject*, JSValue, int, JSValue* otherArgs = 0);
+
+    CodeBlock* codeBlock() const { return codeBlockValue.Register::codeBlock(); }
+    void setCodeBlock(CodeBlock* codeBlock) { codeBlockValue = codeBlock; }
+
+    JSObject* callee() const { return calleeValue.Register::object(); }
+    void setCallee(JSObject* callee) { calleeValue = callee; }
+
+    int argumentCountIncludingThis() const { return argCountAndCodeOriginValue.payload(); }
+    int argumentCount() const { return argumentCountIncludingThis() - 1; }
+    void setArgumentCountIncludingThis(int count) { argCountAndCodeOriginValue.payload() = count; }
+    void setPaddedArgCount(uint32_t argCount) { paddedArgCount = argCount; }
+
+    void clearCurrentVPC() { argCountAndCodeOriginValue.tag() = 0; }
+    
+    JSValue thisValue() const { return thisArg.Register::jsValue(); }
+    void setThisValue(JSValue value) { thisArg = value; }
+
+    bool needArityCheck() { return arityMissMatch; }
+
+    JSValue argument(size_t argumentIndex)
+    {
+        ASSERT(static_cast<int>(argumentIndex) < argumentCount());
+        return args[argumentIndex];
+    }
+    void setArgument(size_t argumentIndex, JSValue value)
+    {
+        ASSERT(static_cast<int>(argumentIndex) < argumentCount());
+        args[argumentIndex] = value;
+    }
+};
+
+} // namespace JSC
diff --git a/interpreter/Register.h b/interpreter/Register.h
new file mode 100644
index 0000000..30d120d
--- /dev/null
+++ b/interpreter/Register.h
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include <wtf/Assertions.h>
+#include <wtf/VectorTraits.h>
+
+namespace JSC {
+
+    class CodeBlock;
+    class ExecState;
+    class JSLexicalEnvironment;
+    class JSObject;
+    class JSScope;
+
+    typedef ExecState CallFrame;
+
+    class Register {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        Register();
+
+        Register(const JSValue&);
+        Register& operator=(const JSValue&);
+        JSValue jsValue() const;
+        JSValue asanUnsafeJSValue() const;
+        EncodedJSValue encodedJSValue() const;
+        
+        Register& operator=(CallFrame*);
+        Register& operator=(CodeBlock*);
+        Register& operator=(JSScope*);
+        Register& operator=(JSObject*);
+
+        int32_t i() const;
+        CallFrame* callFrame() const;
+        CodeBlock* codeBlock() const;
+        CodeBlock* asanUnsafeCodeBlock() const;
+        JSObject* object() const;
+        JSScope* scope() const;
+        int32_t unboxedInt32() const;
+        int64_t unboxedInt52() const;
+        int64_t unboxedStrictInt52() const;
+        bool unboxedBoolean() const;
+        double unboxedDouble() const;
+        JSCell* unboxedCell() const;
+        int32_t payload() const;
+        int32_t tag() const;
+        int32_t unsafeTag() const;
+        int32_t& payload();
+        int32_t& tag();
+
+        static Register withInt(int32_t i)
+        {
+            Register r = jsNumber(i);
+            return r;
+        }
+
+    private:
+        union {
+            EncodedJSValue value;
+            CallFrame* callFrame;
+            CodeBlock* codeBlock;
+            EncodedValueDescriptor encodedValue;
+            double number;
+            int64_t integer;
+        } u;
+    };
+
+    ALWAYS_INLINE Register::Register()
+    {
+#ifndef NDEBUG
+        *this = JSValue();
+#endif
+    }
+
+    ALWAYS_INLINE Register::Register(const JSValue& v)
+    {
+        u.value = JSValue::encode(v);
+    }
+
+    ALWAYS_INLINE Register& Register::operator=(const JSValue& v)
+    {
+        u.value = JSValue::encode(v);
+        return *this;
+    }
+
+    // FIXME (rdar://problem/19379214): ASan only needs to be suppressed for Register::jsValue() when called from prepareOSREntry(), but there is currently no way to express this short of adding a separate copy of the function.
+    SUPPRESS_ASAN ALWAYS_INLINE JSValue Register::asanUnsafeJSValue() const
+    {
+        return JSValue::decode(u.value);
+    }
+
+    ALWAYS_INLINE JSValue Register::jsValue() const
+    {
+        return JSValue::decode(u.value);
+    }
+
+    ALWAYS_INLINE EncodedJSValue Register::encodedJSValue() const
+    {
+        return u.value;
+    }
+
+    // Interpreter functions
+
+    ALWAYS_INLINE Register& Register::operator=(CallFrame* callFrame)
+    {
+        u.callFrame = callFrame;
+        return *this;
+    }
+
+    ALWAYS_INLINE Register& Register::operator=(CodeBlock* codeBlock)
+    {
+        u.codeBlock = codeBlock;
+        return *this;
+    }
+
+    ALWAYS_INLINE int32_t Register::i() const
+    {
+        return jsValue().asInt32();
+    }
+
+    ALWAYS_INLINE CallFrame* Register::callFrame() const
+    {
+        return u.callFrame;
+    }
+    
+    ALWAYS_INLINE CodeBlock* Register::codeBlock() const
+    {
+        return u.codeBlock;
+    }
+
+    SUPPRESS_ASAN ALWAYS_INLINE CodeBlock* Register::asanUnsafeCodeBlock() const
+    {
+        return u.codeBlock;
+    }
+
+    ALWAYS_INLINE int32_t Register::unboxedInt32() const
+    {
+        return payload();
+    }
+
+    ALWAYS_INLINE int64_t Register::unboxedInt52() const
+    {
+        return u.integer >> JSValue::int52ShiftAmount;
+    }
+
+    ALWAYS_INLINE int64_t Register::unboxedStrictInt52() const
+    {
+        return u.integer;
+    }
+
+    ALWAYS_INLINE bool Register::unboxedBoolean() const
+    {
+        return !!payload();
+    }
+
+    ALWAYS_INLINE double Register::unboxedDouble() const
+    {
+        return u.number;
+    }
+
+    ALWAYS_INLINE JSCell* Register::unboxedCell() const
+    {
+#if USE(JSVALUE64)
+        return u.encodedValue.ptr;
+#else
+        return bitwise_cast<JSCell*>(payload());
+#endif
+    }
+
+    ALWAYS_INLINE int32_t Register::payload() const
+    {
+        return u.encodedValue.asBits.payload;
+    }
+
+    ALWAYS_INLINE int32_t Register::tag() const
+    {
+        return u.encodedValue.asBits.tag;
+    }
+
+    SUPPRESS_ASAN ALWAYS_INLINE int32_t Register::unsafeTag() const
+    {
+        return u.encodedValue.asBits.tag;
+    }
+
+    ALWAYS_INLINE int32_t& Register::payload()
+    {
+        return u.encodedValue.asBits.payload;
+    }
+
+    ALWAYS_INLINE int32_t& Register::tag()
+    {
+        return u.encodedValue.asBits.tag;
+    }
+
+} // namespace JSC
+
+namespace WTF {
+
+    template<> struct VectorTraits<JSC::Register> : VectorTraitsBase<true, JSC::Register> { };
+
+} // namespace WTF
diff --git a/interpreter/ShadowChicken.cpp b/interpreter/ShadowChicken.cpp
new file mode 100644
index 0000000..5038d45
--- /dev/null
+++ b/interpreter/ShadowChicken.cpp
@@ -0,0 +1,468 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ShadowChicken.h"
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+#include "ShadowChickenInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+static const bool verbose = false;
+
+void ShadowChicken::Packet::dump(PrintStream& out) const
+{
+    if (!*this) {
+        out.print("empty");
+        return;
+    }
+    
+    if (isPrologue()) {
+        out.print(
+            "{callee = ", RawPointer(callee), ", frame = ", RawPointer(frame), ", callerFrame = ",
+            RawPointer(callerFrame), "}");
+        return;
+    }
+    
+    if (isTail()) {
+        out.print("tail-packet:{frame = ", RawPointer(frame), "}");
+        return;
+    }
+    
+    ASSERT(isThrow());
+    out.print("throw");
+}
+
+void ShadowChicken::Frame::dump(PrintStream& out) const
+{
+    out.print(
+        "{callee = ", RawPointer(callee), ", frame = ", RawPointer(frame), ", isTailDeleted = ",
+        isTailDeleted, "}");
+}
+
+ShadowChicken::ShadowChicken()
+    : m_logSize(Options::shadowChickenLogSize())
+{
+    m_log = static_cast<Packet*>(fastZeroedMalloc(sizeof(Packet) * m_logSize));
+    m_logCursor = m_log;
+    m_logEnd = m_log + m_logSize;
+}
+
+ShadowChicken::~ShadowChicken()
+{
+    fastFree(m_log);
+}
+
+void ShadowChicken::log(VM& vm, ExecState* exec, const Packet& packet)
+{
+    update(vm, exec);
+    *m_logCursor++ = packet;
+}
+
+void ShadowChicken::update(VM&, ExecState* exec)
+{
+    if (verbose) {
+        dataLog("Running update on: ", *this, "\n");
+        WTFReportBacktrace();
+    }
+    
+    const unsigned logCursorIndex = m_logCursor - m_log;
+    
+    // We need to figure out how to reconcile the current machine stack with our shadow stack. We do
+    // that by figuring out how much of the shadow stack to pop. We apply three different rules. The
+    // precise rule relies on the log. The log contains caller frames, which means that we know
+    // where we bottomed out after making any call. If we bottomed out but made no calls then 'exec'
+    // will tell us. That's why "highestPointSinceLastTime" will go no lower than exec. The third
+    // rule, based on comparing to the current real stack, is executed in a later loop.
+    CallFrame* highestPointSinceLastTime = exec;
+    for (unsigned i = logCursorIndex; i--;) {
+        Packet packet = m_log[i];
+        if (packet.isPrologue()) {
+            CallFrame* watermark;
+            if (i && m_log[i - 1].isTail())
+                watermark = packet.frame;
+            else
+                watermark = packet.callerFrame;
+            highestPointSinceLastTime = std::max(highestPointSinceLastTime, watermark);
+        }
+    }
+    
+    if (verbose)
+        dataLog("Highest point since last time: ", RawPointer(highestPointSinceLastTime), "\n");
+    
+    while (!m_stack.isEmpty() && (m_stack.last().frame < highestPointSinceLastTime || m_stack.last().isTailDeleted))
+        m_stack.removeLast();
+    
+    if (verbose)
+        dataLog("    Revised stack: ", listDump(m_stack), "\n");
+    
+    // It's possible that the top of stack is now tail-deleted. The stack no longer contains any
+    // frames below the log's high watermark. That means that we just need to look for the first
+    // occurence of a tail packet for the current stack top.
+    if (!m_stack.isEmpty()) {
+        ASSERT(!m_stack.last().isTailDeleted);
+        for (unsigned i = 0; i < logCursorIndex; ++i) {
+            Packet& packet = m_log[i];
+            if (packet.isTail() && packet.frame == m_stack.last().frame) {
+                Frame& frame = m_stack.last();
+                frame.thisValue = packet.thisValue;
+                frame.scope = packet.scope;
+                frame.codeBlock = packet.codeBlock;
+                frame.callSiteIndex = packet.callSiteIndex;
+                frame.isTailDeleted = true;
+                break;
+            }
+        }
+    }
+
+    
+    if (verbose)
+        dataLog("    Revised stack: ", listDump(m_stack), "\n");
+    
+    // The log-based and exec-based rules require that ShadowChicken was enabled. The point of
+    // ShadowChicken is to give sensible-looking results even if we had not logged. This means that
+    // we need to reconcile the shadow stack and the real stack by actually looking at the real
+    // stack. This reconciliation allows the shadow stack to have extra tail-deleted frames, but it
+    // forbids it from diverging from the real stack on normal frames.
+    if (!m_stack.isEmpty()) {
+        Vector<Frame> stackRightNow;
+        StackVisitor::visit(
+            exec, [&] (StackVisitor& visitor) -> StackVisitor::Status {
+                if (visitor->isInlinedFrame())
+                    return StackVisitor::Continue;
+                if (visitor->isWasmFrame()) {
+                    // FIXME: Make shadow chicken work with Wasm.
+                    // https://bugs.webkit.org/show_bug.cgi?id=165441
+                    return StackVisitor::Continue;
+                }
+
+                bool isTailDeleted = false;
+                // FIXME: Make shadow chicken work with Wasm.
+                // https://bugs.webkit.org/show_bug.cgi?id=165441
+                stackRightNow.append(Frame(jsCast<JSObject*>(visitor->callee()), visitor->callFrame(), isTailDeleted));
+                return StackVisitor::Continue;
+            });
+        stackRightNow.reverse();
+        
+        if (verbose)
+            dataLog("    Stack right now: ", listDump(stackRightNow), "\n");
+        
+        unsigned shadowIndex = 0;
+        unsigned rightNowIndex = 0;
+        while (shadowIndex < m_stack.size() && rightNowIndex < stackRightNow.size()) {
+            if (m_stack[shadowIndex].isTailDeleted) {
+                shadowIndex++;
+                continue;
+            }
+
+            // We specifically don't use operator== here because we are using a less
+            // strict filter on equality of frames. For example, the scope pointer
+            // could change, but we wouldn't want to consider the frames different entities
+            // because of that because it's natural for the program to change scopes.
+            if (m_stack[shadowIndex].frame == stackRightNow[rightNowIndex].frame
+                && m_stack[shadowIndex].callee == stackRightNow[rightNowIndex].callee) {
+                shadowIndex++;
+                rightNowIndex++;
+                continue;
+            }
+            break;
+        }
+        m_stack.resize(shadowIndex);
+        
+        if (verbose)
+            dataLog("    Revised stack: ", listDump(m_stack), "\n");
+    }
+    
+    // It's possible that the top stack frame is actually lower than highestPointSinceLastTime.
+    // Account for that here.
+    highestPointSinceLastTime = nullptr;
+    for (unsigned i = m_stack.size(); i--;) {
+        if (!m_stack[i].isTailDeleted) {
+            highestPointSinceLastTime = m_stack[i].frame;
+            break;
+        }
+    }
+    
+    if (verbose)
+        dataLog("    Highest point since last time: ", RawPointer(highestPointSinceLastTime), "\n");
+    
+    // Set everything up so that we know where the top frame is in the log.
+    unsigned indexInLog = logCursorIndex;
+    
+    auto advanceIndexInLogTo = [&] (CallFrame* frame, JSObject* callee, CallFrame* callerFrame) -> bool {
+        if (verbose)
+            dataLog("    Advancing to frame = ", RawPointer(frame), " from indexInLog = ", indexInLog, "\n");
+        if (indexInLog > logCursorIndex) {
+            if (verbose)
+                dataLog("    Bailing.\n");
+            return false;
+        }
+        
+        unsigned oldIndexInLog = indexInLog;
+        
+        while (indexInLog--) {
+            Packet packet = m_log[indexInLog];
+            
+            // If all callees opt into ShadowChicken, then this search will rapidly terminate when
+            // we find our frame. But if our frame's callee didn't emit a prologue packet because it
+            // didn't opt in, then we will keep looking backwards until we *might* find a different
+            // frame. If we've been given the callee and callerFrame as a filter, then it's unlikely
+            // that we will hit the wrong frame. But we don't always have that information.
+            //
+            // This means it's worth adding other filters. For example, we could track changes in
+            // stack size. Once we've seen a frame at some height, we're no longer interested in
+            // frames below that height. Also, we can break as soon as we see a frame higher than
+            // the one we're looking for.
+            // FIXME: Add more filters.
+            // https://bugs.webkit.org/show_bug.cgi?id=155685
+            
+            if (packet.isPrologue() && packet.frame == frame
+                && (!callee || packet.callee == callee)
+                && (!callerFrame || packet.callerFrame == callerFrame)) {
+                if (verbose)
+                    dataLog("    Found at indexInLog = ", indexInLog, "\n");
+                return true;
+            }
+        }
+        
+        // This is an interesting eventuality. We will see this if ShadowChicken was not
+        // consistently enabled. We have a choice between:
+        //
+        // - Leaving the log index at -1, which will prevent the log from being considered. This is
+        //   the most conservative. It means that we will not be able to recover tail-deleted frames
+        //   from anything that sits above a frame that didn't log a prologue packet. This means
+        //   that everyone who creates prologues must log prologue packets.
+        //
+        // - Restoring the log index to what it was before. This prevents us from considering
+        //   whether this frame has tail-deleted frames behind it, but that's about it. The problem
+        //   with this approach is that it might recover tail-deleted frames that aren't relevant.
+        //   I haven't thought about this too deeply, though.
+        //
+        // It seems like the latter option is less harmful, so that's what we do.
+        indexInLog = oldIndexInLog;
+        
+        if (verbose)
+            dataLog("    Didn't find it.\n");
+        return false;
+    };
+    
+    Vector<Frame> toPush;
+    StackVisitor::visit(
+        exec, [&] (StackVisitor& visitor) -> StackVisitor::Status {
+            if (visitor->isInlinedFrame()) {
+                // FIXME: Handle inlining.
+                // https://bugs.webkit.org/show_bug.cgi?id=155686
+                return StackVisitor::Continue;
+            }
+
+            if (visitor->isWasmFrame()) {
+                // FIXME: Make shadow chicken work with Wasm.
+                return StackVisitor::Continue;
+            }
+
+            CallFrame* callFrame = visitor->callFrame();
+            if (verbose)
+                dataLog("    Examining ", RawPointer(callFrame), "\n");
+            if (callFrame == highestPointSinceLastTime) {
+                if (verbose)
+                    dataLog("    Bailing at ", RawPointer(callFrame), " because it's the highest point since last time.\n");
+                return StackVisitor::Done;
+            }
+
+            bool foundFrame = advanceIndexInLogTo(callFrame, callFrame->jsCallee(), callFrame->callerFrame());
+            bool isTailDeleted = false;
+            JSScope* scope = nullptr;
+            CodeBlock* codeBlock = callFrame->codeBlock();
+            if (codeBlock && codeBlock->wasCompiledWithDebuggingOpcodes() && codeBlock->scopeRegister().isValid()) {
+                scope = callFrame->scope(codeBlock->scopeRegister().offset());
+                RELEASE_ASSERT(scope->inherits(JSScope::info()));
+            } else if (foundFrame) {
+                scope = m_log[indexInLog].scope;
+                if (scope)
+                    RELEASE_ASSERT(scope->inherits(JSScope::info()));
+            }
+            toPush.append(Frame(jsCast<JSObject*>(visitor->callee()), callFrame, isTailDeleted, callFrame->thisValue(), scope, codeBlock, callFrame->callSiteIndex()));
+
+            if (indexInLog < logCursorIndex
+                // This condition protects us from the case where advanceIndexInLogTo didn't find
+                // anything.
+                && m_log[indexInLog].frame == toPush.last().frame) {
+                if (verbose)
+                    dataLog("    Going to loop through to find tail deleted frames with indexInLog = ", indexInLog, " and push-stack top = ", toPush.last(), "\n");
+                for (;;) {
+                    ASSERT(m_log[indexInLog].frame == toPush.last().frame);
+                    
+                    // Right now the index is pointing at a prologue packet of the last frame that
+                    // we pushed. Peek behind that packet to see if there is a tail packet. If there
+                    // is one then we know that there is a corresponding prologue packet that will
+                    // tell us about a tail-deleted frame.
+                    
+                    if (!indexInLog)
+                        break;
+                    Packet tailPacket = m_log[indexInLog - 1];
+                    if (!tailPacket.isTail()) {
+                        // Last frame that we recorded was not the outcome of a tail call. So, there
+                        // will not be any more deleted frames.
+                        // FIXME: We might want to have a filter here. Consider that this was a tail
+                        // marker for a tail call to something that didn't log anything. It should
+                        // be sufficient to give the tail marker a copy of the caller frame.
+                        // https://bugs.webkit.org/show_bug.cgi?id=155687
+                        break;
+                    }
+                    indexInLog--; // Skip over the tail packet.
+                    
+                    if (!advanceIndexInLogTo(tailPacket.frame, nullptr, nullptr)) {
+                        if (verbose)
+                            dataLog("Can't find prologue packet for tail: ", RawPointer(tailPacket.frame), "\n");
+                        // We were unable to locate the prologue packet for this tail packet.
+                        // This is rare but can happen in a situation like:
+                        // function foo() {
+                        //     ... call some deeply tail-recursive function, causing a random number of log processings.
+                        //     return bar(); // tail call
+                        // }
+                        break;
+                    }
+                    Packet packet = m_log[indexInLog];
+                    bool isTailDeleted = true;
+                    RELEASE_ASSERT(tailPacket.scope->inherits(JSScope::info()));
+                    toPush.append(Frame(packet.callee, packet.frame, isTailDeleted, tailPacket.thisValue, tailPacket.scope, tailPacket.codeBlock, tailPacket.callSiteIndex));
+                }
+            }
+
+            return StackVisitor::Continue;
+        });
+
+    if (verbose)
+        dataLog("    Pushing: ", listDump(toPush), "\n");
+    
+    for (unsigned i = toPush.size(); i--;)
+        m_stack.append(toPush[i]);
+    
+    // We want to reset the log. There is a fun corner-case: there could be a tail marker at the end
+    // of this log. We could make that work by setting isTailDeleted on the top of stack, but that
+    // would require more corner cases in the complicated reconciliation code above. That code
+    // already knows how to handle a tail packet at the beginning, so we just leverage that here.
+    if (logCursorIndex && m_log[logCursorIndex - 1].isTail()) {
+        m_log[0] = m_log[logCursorIndex - 1];
+        m_logCursor = m_log + 1;
+    } else
+        m_logCursor = m_log;
+
+    if (verbose)
+        dataLog("    After pushing: ", *this, "\n");
+
+    // Remove tail frames until the number of tail deleted frames is small enough.
+    const unsigned maxTailDeletedFrames = Options::shadowChickenMaxTailDeletedFramesSize();
+    if (m_stack.size() > maxTailDeletedFrames) {
+        unsigned numberOfTailDeletedFrames = 0;
+        for (const Frame& frame : m_stack) {
+            if (frame.isTailDeleted)
+                numberOfTailDeletedFrames++;
+        }
+        if (numberOfTailDeletedFrames > maxTailDeletedFrames) {
+            unsigned dstIndex = 0;
+            unsigned srcIndex = 0;
+            while (srcIndex < m_stack.size()) {
+                Frame frame = m_stack[srcIndex++];
+                if (numberOfTailDeletedFrames > maxTailDeletedFrames && frame.isTailDeleted) {
+                    numberOfTailDeletedFrames--;
+                    continue;
+                }
+                m_stack[dstIndex++] = frame;
+            }
+            m_stack.resize(dstIndex);
+        }
+    }
+
+    if (verbose)
+        dataLog("    After clean-up: ", *this, "\n");
+}
+
+void ShadowChicken::visitChildren(SlotVisitor& visitor)
+{
+    for (unsigned i = m_logCursor - m_log; i--;) {
+        JSObject* callee = m_log[i].callee;
+        if (callee != Packet::tailMarker() && callee != Packet::throwMarker())
+            visitor.appendUnbarriered(callee);
+        if (callee != Packet::throwMarker())
+            visitor.appendUnbarriered(m_log[i].scope);
+        if (callee == Packet::tailMarker()) {
+            visitor.appendUnbarriered(m_log[i].thisValue);
+            visitor.appendUnbarriered(m_log[i].codeBlock);
+        }
+    }
+    
+    for (unsigned i = m_stack.size(); i--; ) {
+        Frame& frame = m_stack[i];
+        visitor.appendUnbarriered(frame.thisValue);
+        visitor.appendUnbarriered(frame.callee);
+        if (frame.scope)
+            visitor.appendUnbarriered(frame.scope);
+        if (frame.codeBlock)
+            visitor.appendUnbarriered(frame.codeBlock);
+    }
+}
+
+void ShadowChicken::reset()
+{
+    m_logCursor = m_log;
+    m_stack.clear();
+}
+
+void ShadowChicken::dump(PrintStream& out) const
+{
+    out.print("{stack = [", listDump(m_stack), "], log = [");
+    
+    CommaPrinter comma;
+    unsigned limit = static_cast<unsigned>(m_logCursor - m_log);
+    out.print("\n");
+    for (unsigned i = 0; i < limit; ++i)
+        out.print("\t", comma, m_log[i], "\n");
+    out.print("]}");
+}
+
+JSArray* ShadowChicken::functionsOnStack(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSArray* result = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    iterate(
+        vm, exec,
+        [&] (const Frame& frame) -> bool {
+            result->push(exec, frame.callee);
+            RELEASE_ASSERT(!scope.exception()); // This function is only called from tests.
+            return true;
+        });
+    
+    return result;
+}
+
+} // namespace JSC
+
diff --git a/interpreter/ShadowChicken.h b/interpreter/ShadowChicken.h
new file mode 100644
index 0000000..d7455a6
--- /dev/null
+++ b/interpreter/ShadowChicken.h
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "JSCJSValue.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CodeBlock;
+class ExecState;
+class JSArray;
+class JSObject;
+class JSScope;
+class LLIntOffsetsExtractor;
+class SlotVisitor;
+class VM;
+
+typedef ExecState CallFrame;
+
+// ShadowChicken is a log that can be used to produce a shadow stack of CHICKEN-style stack frames.
+// This enables the debugger to almost always see the tail-deleted stack frames, so long as we have
+// memory inside ShadowChicken to remember them.
+//
+// The ShadowChicken log comprises packets that have one of two shapes:
+//
+// Prologue Packet, which has:
+//     - Callee object.
+//     - Frame pointer.
+//     - Caller frame pointer.
+//
+// Tail Call Packet, which has just:
+//     - Frame pointer.
+//
+// Prologue Packets are placed into the log in any JS function's prologue. Tail Call Packets are
+// placed into the log just before making a proper tail call. We never log returns, since that would
+// require a lot of infrastructure (unwinding, multiple ways of returning, etc). We don't need to
+// see the returns because the prologue packets have a frame pointer. The tail call packets tell us
+// when there was a tail call, and record the FP *before* the tail call.
+//
+// At any time it is possible to construct a shadow stack from the log and the actual machine stack.
+
+class ShadowChicken {
+    WTF_MAKE_NONCOPYABLE(ShadowChicken);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    struct Packet {
+        Packet()
+        {
+        }
+        
+        static const unsigned unlikelyValue = 0x7a11;
+        
+        static JSObject* tailMarker()
+        {
+            return bitwise_cast<JSObject*>(static_cast<intptr_t>(unlikelyValue));
+        }
+        
+        static JSObject* throwMarker()
+        {
+            return bitwise_cast<JSObject*>(static_cast<intptr_t>(unlikelyValue + 1));
+        }
+        
+        static Packet prologue(JSObject* callee, CallFrame* frame, CallFrame* callerFrame, JSScope* scope)
+        {
+            Packet result;
+            result.callee = callee;
+            result.frame = frame;
+            result.callerFrame = callerFrame;
+            result.scope = scope;
+            return result;
+        }
+        
+        static Packet tail(CallFrame* frame, JSValue thisValue, JSScope* scope, CodeBlock* codeBlock, CallSiteIndex callSiteIndex)
+        {
+            Packet result;
+            result.callee = tailMarker();
+            result.frame = frame;
+            result.thisValue = thisValue;
+            result.scope = scope;
+            result.codeBlock = codeBlock;
+            result.callSiteIndex = callSiteIndex;
+            return result;
+        }
+        
+        static Packet throwPacket()
+        {
+            Packet result;
+            result.callee = throwMarker();
+            return result;
+        }
+        
+        explicit operator bool() const { return !!callee; }
+        
+        bool isPrologue() const { return *this && callee != tailMarker() && callee != throwMarker(); }
+        bool isTail() const { return *this && callee == tailMarker(); }
+        bool isThrow() const { return *this && callee == throwMarker(); }
+        
+        void dump(PrintStream&) const;
+        
+        // Only tail packets have a valid thisValue, CodeBlock*, and CallSiteIndex. We grab 'this' and CodeBlock* from non tail-deleted frames from the machine frame.
+        JSValue thisValue { JSValue() };
+        JSObject* callee { nullptr };
+        CallFrame* frame { nullptr };
+        CallFrame* callerFrame { nullptr };
+        JSScope* scope { nullptr };
+        CodeBlock* codeBlock { nullptr };
+        CallSiteIndex callSiteIndex;
+    };
+    
+    struct Frame {
+        Frame()
+        {
+        }
+        
+        Frame(JSObject* callee, CallFrame* frame, bool isTailDeleted, JSValue thisValue = JSValue(), JSScope* scope = nullptr, CodeBlock* codeBlock = nullptr, CallSiteIndex callSiteIndex = CallSiteIndex())
+            : callee(callee)
+            , frame(frame)
+            , thisValue(thisValue)
+            , scope(scope)
+            , codeBlock(codeBlock)
+            , callSiteIndex(callSiteIndex)
+            , isTailDeleted(isTailDeleted)
+        {
+        }
+        
+        bool operator==(const Frame& other) const
+        {
+            return callee == other.callee
+                && frame == other.frame
+                && thisValue == other.thisValue
+                && scope == other.scope
+                && codeBlock == other.codeBlock
+                && callSiteIndex.bits() == other.callSiteIndex.bits()
+                && isTailDeleted == other.isTailDeleted;
+        }
+        
+        bool operator!=(const Frame& other) const
+        {
+            return !(*this == other);
+        }
+        
+        void dump(PrintStream&) const;
+        
+        // FIXME: This should be able to hold the moral equivalent of StackVisitor::Frame, so that
+        // we can support inlining.
+        // https://bugs.webkit.org/show_bug.cgi?id=155686
+        JSObject* callee { nullptr };
+        CallFrame* frame { nullptr };
+        JSValue thisValue { JSValue() };
+        JSScope* scope { nullptr };
+        CodeBlock* codeBlock { nullptr };
+        CallSiteIndex callSiteIndex;
+        bool isTailDeleted { false };
+    };
+    
+    ShadowChicken();
+    ~ShadowChicken();
+    
+    void log(VM& vm, ExecState* exec, const Packet&);
+    
+    void update(VM&, ExecState*);
+    
+    // Expects this signature: (const Frame& frame) -> bool. Return true to keep iterating. Return false to stop iterating.
+    // Note that this only works right with inlining disabled, but that's OK since for now we
+    // disable inlining when the inspector is attached. It would be easy to make this work with
+    // inlining, and would mostly require that we can request that StackVisitor doesn't skip tail
+    // frames.
+    template<typename Functor>
+    void iterate(VM&, ExecState*, const Functor&);
+    
+    void visitChildren(SlotVisitor&);
+    void reset();
+    
+    // JIT support.
+    Packet* log() const { return m_log; }
+    unsigned logSize() const { return m_logSize; }
+    Packet** addressOfLogCursor() { return &m_logCursor; }
+    Packet* logEnd() { return m_logEnd; }
+    
+    void dump(PrintStream&) const;
+    
+    JS_EXPORT_PRIVATE JSArray* functionsOnStack(ExecState*);
+
+private:
+    friend class LLIntOffsetsExtractor;
+    
+    Packet* m_log { nullptr };
+    unsigned m_logSize { 0 };
+    Packet* m_logCursor { nullptr };
+    Packet* m_logEnd { nullptr };
+    
+    Vector<Frame> m_stack;
+};
+
+} // namespace JSC
+
diff --git a/interpreter/ShadowChickenInlines.h b/interpreter/ShadowChickenInlines.h
new file mode 100644
index 0000000..88d3dd3
--- /dev/null
+++ b/interpreter/ShadowChickenInlines.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCInlines.h"
+#include "ShadowChicken.h"
+
+namespace JSC {
+
+template<typename Functor>
+void ShadowChicken::iterate(VM& vm, ExecState* exec, const Functor& functor)
+{
+    DeferGC deferGC(exec->vm().heap);
+
+    update(vm, exec);
+    
+    for (unsigned i = m_stack.size(); i--;) {
+        if (!functor(m_stack[i]))
+            break;
+    }
+}
+
+} // namespace JSC
+
diff --git a/interpreter/StackVisitor.cpp b/interpreter/StackVisitor.cpp
new file mode 100644
index 0000000..2276bb9
--- /dev/null
+++ b/interpreter/StackVisitor.cpp
@@ -0,0 +1,505 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "StackVisitor.h"
+
+#include "ClonedArguments.h"
+#include "DebuggerPrimitives.h"
+#include "InlineCallFrame.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyCallee.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+StackVisitor::StackVisitor(CallFrame* startFrame)
+{
+    m_frame.m_index = 0;
+    m_frame.m_isWasmFrame = false;
+    CallFrame* topFrame;
+    if (startFrame) {
+        m_frame.m_VMEntryFrame = startFrame->vm().topVMEntryFrame;
+        topFrame = startFrame->vm().topCallFrame;
+        
+        if (topFrame && static_cast<void*>(m_frame.m_VMEntryFrame) == static_cast<void*>(topFrame)) {
+            topFrame = vmEntryRecord(m_frame.m_VMEntryFrame)->m_prevTopCallFrame;
+            m_frame.m_VMEntryFrame = vmEntryRecord(m_frame.m_VMEntryFrame)->m_prevTopVMEntryFrame;
+        }
+    } else {
+        m_frame.m_VMEntryFrame = 0;
+        topFrame = 0;
+    }
+    m_frame.m_callerIsVMEntryFrame = false;
+    readFrame(topFrame);
+
+    // Find the frame the caller wants to start unwinding from.
+    while (m_frame.callFrame() && m_frame.callFrame() != startFrame)
+        gotoNextFrame();
+}
+
+void StackVisitor::gotoNextFrame()
+{
+    m_frame.m_index++;
+#if ENABLE(DFG_JIT)
+    if (m_frame.isInlinedFrame()) {
+        InlineCallFrame* inlineCallFrame = m_frame.inlineCallFrame();
+        CodeOrigin* callerCodeOrigin = inlineCallFrame->getCallerSkippingTailCalls();
+        if (!callerCodeOrigin) {
+            while (inlineCallFrame) {
+                readInlinedFrame(m_frame.callFrame(), &inlineCallFrame->directCaller);
+                inlineCallFrame = m_frame.inlineCallFrame();
+            }
+            m_frame.m_VMEntryFrame = m_frame.m_CallerVMEntryFrame;
+            readFrame(m_frame.callerFrame());
+        } else
+            readInlinedFrame(m_frame.callFrame(), callerCodeOrigin);
+        return;
+    }
+#endif // ENABLE(DFG_JIT)
+    m_frame.m_VMEntryFrame = m_frame.m_CallerVMEntryFrame;
+    readFrame(m_frame.callerFrame());
+}
+
+void StackVisitor::unwindToMachineCodeBlockFrame()
+{
+#if ENABLE(DFG_JIT)
+    if (m_frame.isInlinedFrame()) {
+        CodeOrigin codeOrigin = m_frame.inlineCallFrame()->directCaller;
+        while (codeOrigin.inlineCallFrame)
+            codeOrigin = codeOrigin.inlineCallFrame->directCaller;
+        readNonInlinedFrame(m_frame.callFrame(), &codeOrigin);
+    }
+#endif
+}
+
+void StackVisitor::readFrame(CallFrame* callFrame)
+{
+    if (!callFrame) {
+        m_frame.setToEnd();
+        return;
+    }
+
+    if (callFrame->callee()->isAnyWasmCallee()) {
+        readNonInlinedFrame(callFrame);
+        return;
+    }
+
+#if !ENABLE(DFG_JIT)
+    readNonInlinedFrame(callFrame);
+
+#else // !ENABLE(DFG_JIT)
+    // If the frame doesn't have a code block, then it's not a DFG frame.
+    // Hence, we're not at an inlined frame.
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    if (!codeBlock) {
+        readNonInlinedFrame(callFrame);
+        return;
+    }
+
+    // If the code block does not have any code origins, then there's no
+    // inlining. Hence, we're not at an inlined frame.
+    if (!codeBlock->hasCodeOrigins()) {
+        readNonInlinedFrame(callFrame);
+        return;
+    }
+
+    CallSiteIndex index = callFrame->callSiteIndex();
+    ASSERT(codeBlock->canGetCodeOrigin(index));
+    if (!codeBlock->canGetCodeOrigin(index)) {
+        // See assertion above. In release builds, we try to protect ourselves
+        // from crashing even though stack walking will be goofed up.
+        m_frame.setToEnd();
+        return;
+    }
+
+    CodeOrigin codeOrigin = codeBlock->codeOrigin(index);
+    if (!codeOrigin.inlineCallFrame) {
+        readNonInlinedFrame(callFrame, &codeOrigin);
+        return;
+    }
+
+    readInlinedFrame(callFrame, &codeOrigin);
+#endif // !ENABLE(DFG_JIT)
+}
+
+void StackVisitor::readNonInlinedFrame(CallFrame* callFrame, CodeOrigin* codeOrigin)
+{
+    m_frame.m_callFrame = callFrame;
+    m_frame.m_argumentCountIncludingThis = callFrame->argumentCountIncludingThis();
+    m_frame.m_CallerVMEntryFrame = m_frame.m_VMEntryFrame;
+    m_frame.m_callerFrame = callFrame->callerFrame(m_frame.m_CallerVMEntryFrame);
+    m_frame.m_callerIsVMEntryFrame = m_frame.m_CallerVMEntryFrame != m_frame.m_VMEntryFrame;
+    m_frame.m_isWasmFrame = false;
+
+    JSCell* callee = callFrame->callee();
+    m_frame.m_callee = callee;
+
+    if (callee->isAnyWasmCallee()) {
+        m_frame.m_isWasmFrame = true;
+        m_frame.m_codeBlock = nullptr;
+        m_frame.m_bytecodeOffset = 0;
+    } else {
+        m_frame.m_codeBlock = callFrame->codeBlock();
+        m_frame.m_bytecodeOffset = !m_frame.codeBlock() ? 0
+            : codeOrigin ? codeOrigin->bytecodeIndex
+            : callFrame->bytecodeOffset();
+
+    }
+
+#if ENABLE(DFG_JIT)
+    m_frame.m_inlineCallFrame = 0;
+#endif
+}
+
+#if ENABLE(DFG_JIT)
+static int inlinedFrameOffset(CodeOrigin* codeOrigin)
+{
+    InlineCallFrame* inlineCallFrame = codeOrigin->inlineCallFrame;
+    int frameOffset = inlineCallFrame ? inlineCallFrame->stackOffset : 0;
+    return frameOffset;
+}
+
+void StackVisitor::readInlinedFrame(CallFrame* callFrame, CodeOrigin* codeOrigin)
+{
+    ASSERT(codeOrigin);
+    m_frame.m_isWasmFrame = false;
+
+    int frameOffset = inlinedFrameOffset(codeOrigin);
+    bool isInlined = !!frameOffset;
+    if (isInlined) {
+        InlineCallFrame* inlineCallFrame = codeOrigin->inlineCallFrame;
+
+        m_frame.m_callFrame = callFrame;
+        m_frame.m_inlineCallFrame = inlineCallFrame;
+        if (inlineCallFrame->argumentCountRegister.isValid())
+            m_frame.m_argumentCountIncludingThis = callFrame->r(inlineCallFrame->argumentCountRegister.offset()).unboxedInt32();
+        else
+            m_frame.m_argumentCountIncludingThis = inlineCallFrame->arguments.size();
+        m_frame.m_codeBlock = inlineCallFrame->baselineCodeBlock.get();
+        m_frame.m_bytecodeOffset = codeOrigin->bytecodeIndex;
+
+        JSFunction* callee = inlineCallFrame->calleeForCallFrame(callFrame);
+        m_frame.m_callee = callee;
+        ASSERT(m_frame.callee());
+
+        // The callerFrame just needs to be non-null to indicate that we
+        // haven't reached the last frame yet. Setting it to the root
+        // frame (i.e. the callFrame that this inlined frame is called from)
+        // would work just fine.
+        m_frame.m_callerFrame = callFrame;
+        return;
+    }
+
+    readNonInlinedFrame(callFrame, codeOrigin);
+}
+#endif // ENABLE(DFG_JIT)
+
+bool StackVisitor::Frame::isWasmFrame() const
+{
+    return m_isWasmFrame;
+}
+
+StackVisitor::Frame::CodeType StackVisitor::Frame::codeType() const
+{
+    if (isWasmFrame())
+        return CodeType::Wasm;
+
+    if (!codeBlock())
+        return CodeType::Native;
+
+    switch (codeBlock()->codeType()) {
+    case EvalCode:
+        return CodeType::Eval;
+    case ModuleCode:
+        return CodeType::Module;
+    case FunctionCode:
+        return CodeType::Function;
+    case GlobalCode:
+        return CodeType::Global;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return CodeType::Global;
+}
+
+RegisterAtOffsetList* StackVisitor::Frame::calleeSaveRegisters()
+{
+    if (isInlinedFrame())
+        return nullptr;
+
+#if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+
+#if ENABLE(WEBASSEMBLY)
+    if (isWasmFrame()) {
+        if (JSCell* callee = this->callee()) {
+            if (JSWebAssemblyCallee* wasmCallee = jsDynamicCast<JSWebAssemblyCallee*>(callee))
+                return wasmCallee->calleeSaveRegisters();
+            // Other wasm callees (e.g, stubs) don't use callee save registers, so nothing needs
+            // to be restored for them.
+        }
+
+        return nullptr;
+    }
+#endif // ENABLE(WEBASSEMBLY)
+
+    if (CodeBlock* codeBlock = this->codeBlock())
+        return codeBlock->calleeSaveRegisters();
+
+#endif // ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+
+    return nullptr;
+}
+
+String StackVisitor::Frame::functionName() const
+{
+    String traceLine;
+    JSCell* callee = this->callee();
+
+    switch (codeType()) {
+    case CodeType::Wasm:
+        traceLine = ASCIILiteral("wasm code");
+        break;
+    case CodeType::Eval:
+        traceLine = ASCIILiteral("eval code");
+        break;
+    case CodeType::Module:
+        traceLine = ASCIILiteral("module code");
+        break;
+    case CodeType::Native:
+        if (callee)
+            traceLine = getCalculatedDisplayName(callFrame()->vm(), jsCast<JSObject*>(callee)).impl();
+        break;
+    case CodeType::Function:
+        traceLine = getCalculatedDisplayName(callFrame()->vm(), jsCast<JSObject*>(callee)).impl();
+        break;
+    case CodeType::Global:
+        traceLine = ASCIILiteral("global code");
+        break;
+    }
+    return traceLine.isNull() ? emptyString() : traceLine;
+}
+
+String StackVisitor::Frame::sourceURL() const
+{
+    String traceLine;
+
+    switch (codeType()) {
+    case CodeType::Eval:
+    case CodeType::Module:
+    case CodeType::Function:
+    case CodeType::Global: {
+        String sourceURL = codeBlock()->ownerScriptExecutable()->sourceURL();
+        if (!sourceURL.isEmpty())
+            traceLine = sourceURL.impl();
+        break;
+    }
+    case CodeType::Native:
+        traceLine = ASCIILiteral("[native code]");
+        break;
+    case CodeType::Wasm:
+        traceLine = ASCIILiteral("[wasm code]");
+        break;
+    }
+    return traceLine.isNull() ? emptyString() : traceLine;
+}
+
+String StackVisitor::Frame::toString() const
+{
+    StringBuilder traceBuild;
+    String functionName = this->functionName();
+    String sourceURL = this->sourceURL();
+    traceBuild.append(functionName);
+    if (!sourceURL.isEmpty()) {
+        if (!functionName.isEmpty())
+            traceBuild.append('@');
+        traceBuild.append(sourceURL);
+        if (hasLineAndColumnInfo()) {
+            unsigned line = 0;
+            unsigned column = 0;
+            computeLineAndColumn(line, column);
+            traceBuild.append(':');
+            traceBuild.appendNumber(line);
+            traceBuild.append(':');
+            traceBuild.appendNumber(column);
+        }
+    }
+    return traceBuild.toString().impl();
+}
+
+intptr_t StackVisitor::Frame::sourceID()
+{
+    if (CodeBlock* codeBlock = this->codeBlock())
+        return codeBlock->ownerScriptExecutable()->sourceID();
+    return noSourceID;
+}
+
+ClonedArguments* StackVisitor::Frame::createArguments()
+{
+    ASSERT(m_callFrame);
+    CallFrame* physicalFrame = m_callFrame;
+    ClonedArguments* arguments;
+    ArgumentsMode mode;
+    if (Options::useFunctionDotArguments())
+        mode = ArgumentsMode::Cloned;
+    else
+        mode = ArgumentsMode::FakeValues;
+#if ENABLE(DFG_JIT)
+    if (isInlinedFrame()) {
+        ASSERT(m_inlineCallFrame);
+        arguments = ClonedArguments::createWithInlineFrame(physicalFrame, physicalFrame, m_inlineCallFrame, mode);
+    } else 
+#endif
+        arguments = ClonedArguments::createWithMachineFrame(physicalFrame, physicalFrame, mode);
+    return arguments;
+}
+
+bool StackVisitor::Frame::hasLineAndColumnInfo() const
+{
+    return !!codeBlock();
+}
+
+void StackVisitor::Frame::computeLineAndColumn(unsigned& line, unsigned& column) const
+{
+    CodeBlock* codeBlock = this->codeBlock();
+    if (!codeBlock) {
+        line = 0;
+        column = 0;
+        return;
+    }
+
+    int divot = 0;
+    int unusedStartOffset = 0;
+    int unusedEndOffset = 0;
+    unsigned divotLine = 0;
+    unsigned divotColumn = 0;
+    retrieveExpressionInfo(divot, unusedStartOffset, unusedEndOffset, divotLine, divotColumn);
+
+    line = divotLine + codeBlock->ownerScriptExecutable()->firstLine();
+    column = divotColumn + (divotLine ? 1 : codeBlock->firstLineColumnOffset());
+
+    if (codeBlock->ownerScriptExecutable()->hasOverrideLineNumber())
+        line = codeBlock->ownerScriptExecutable()->overrideLineNumber();
+}
+
+void StackVisitor::Frame::retrieveExpressionInfo(int& divot, int& startOffset, int& endOffset, unsigned& line, unsigned& column) const
+{
+    CodeBlock* codeBlock = this->codeBlock();
+    codeBlock->unlinkedCodeBlock()->expressionRangeForBytecodeOffset(bytecodeOffset(), divot, startOffset, endOffset, line, column);
+    divot += codeBlock->sourceOffset();
+}
+
+void StackVisitor::Frame::setToEnd()
+{
+    m_callFrame = 0;
+#if ENABLE(DFG_JIT)
+    m_inlineCallFrame = 0;
+#endif
+    m_isWasmFrame = false;
+}
+
+void StackVisitor::Frame::dump(PrintStream& out, Indenter indent) const
+{
+    dump(out, indent, [] (PrintStream&) { });
+}
+
+void StackVisitor::Frame::dump(PrintStream& out, Indenter indent, std::function<void(PrintStream&)> prefix) const
+{
+    if (!this->callFrame()) {
+        out.print(indent, "frame 0x0\n");
+        return;
+    }
+
+    CodeBlock* codeBlock = this->codeBlock();
+    out.print(indent);
+    prefix(out);
+    out.print("frame ", RawPointer(this->callFrame()), " {\n");
+
+    {
+        indent++;
+
+        CallFrame* callFrame = m_callFrame;
+        CallFrame* callerFrame = this->callerFrame();
+        void* returnPC = callFrame->hasReturnPC() ? callFrame->returnPC().value() : nullptr;
+
+        out.print(indent, "name: ", functionName(), "\n");
+        out.print(indent, "sourceURL: ", sourceURL(), "\n");
+
+        bool isInlined = false;
+#if ENABLE(DFG_JIT)
+        isInlined = isInlinedFrame();
+        out.print(indent, "isInlinedFrame: ", isInlinedFrame(), "\n");
+        if (isInlinedFrame())
+            out.print(indent, "InlineCallFrame: ", RawPointer(m_inlineCallFrame), "\n");
+#endif
+
+        out.print(indent, "callee: ", RawPointer(callee()), "\n");
+        out.print(indent, "returnPC: ", RawPointer(returnPC), "\n");
+        out.print(indent, "callerFrame: ", RawPointer(callerFrame), "\n");
+        unsigned locationRawBits = callFrame->callSiteAsRawBits();
+        out.print(indent, "rawLocationBits: ", static_cast<uintptr_t>(locationRawBits),
+            " ", RawPointer(reinterpret_cast<void*>(locationRawBits)), "\n");
+        out.print(indent, "codeBlock: ", RawPointer(codeBlock));
+        if (codeBlock)
+            out.print(" ", *codeBlock);
+        out.print("\n");
+        if (codeBlock && !isInlined) {
+            indent++;
+
+            if (callFrame->callSiteBitsAreBytecodeOffset()) {
+                unsigned bytecodeOffset = callFrame->bytecodeOffset();
+                out.print(indent, "bytecodeOffset: ", bytecodeOffset, " of ", codeBlock->instructions().size(), "\n");
+#if ENABLE(DFG_JIT)
+            } else {
+                out.print(indent, "hasCodeOrigins: ", codeBlock->hasCodeOrigins(), "\n");
+                if (codeBlock->hasCodeOrigins()) {
+                    CallSiteIndex callSiteIndex = callFrame->callSiteIndex();
+                    out.print(indent, "callSiteIndex: ", callSiteIndex.bits(), " of ", codeBlock->codeOrigins().size(), "\n");
+
+                    JITCode::JITType jitType = codeBlock->jitType();
+                    if (jitType != JITCode::FTLJIT) {
+                        JITCode* jitCode = codeBlock->jitCode().get();
+                        out.print(indent, "jitCode: ", RawPointer(jitCode),
+                            " start ", RawPointer(jitCode->start()),
+                            " end ", RawPointer(jitCode->end()), "\n");
+                    }
+                }
+#endif
+            }
+            unsigned line = 0;
+            unsigned column = 0;
+            computeLineAndColumn(line, column);
+            out.print(indent, "line: ", line, "\n");
+            out.print(indent, "column: ", column, "\n");
+
+            indent--;
+        }
+        out.print(indent, "vmEntryFrame: ", RawPointer(vmEntryFrame()), "\n");
+        indent--;
+    }
+    out.print(indent, "}\n");
+}
+
+} // namespace JSC
diff --git a/interpreter/StackVisitor.h b/interpreter/StackVisitor.h
new file mode 100644
index 0000000..81a9c7b
--- /dev/null
+++ b/interpreter/StackVisitor.h
@@ -0,0 +1,188 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "VMEntryRecord.h"
+#include <functional>
+#include <wtf/Indenter.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+struct CodeOrigin;
+struct InlineCallFrame;
+
+class CodeBlock;
+class ExecState;
+class JSCell;
+class JSFunction;
+class ClonedArguments;
+class Register;
+class RegisterAtOffsetList;
+
+typedef ExecState CallFrame;
+
+class StackVisitor {
+public:
+    class Frame {
+    public:
+        enum CodeType {
+            Global,
+            Eval,
+            Function,
+            Module,
+            Native,
+            Wasm
+        };
+
+        size_t index() const { return m_index; }
+        size_t argumentCountIncludingThis() const { return m_argumentCountIncludingThis; }
+        bool callerIsVMEntryFrame() const { return m_callerIsVMEntryFrame; }
+        CallFrame* callerFrame() const { return m_callerFrame; }
+        JSCell* callee() const { return m_callee; }
+        CodeBlock* codeBlock() const { return m_codeBlock; }
+        unsigned bytecodeOffset() const { return m_bytecodeOffset; }
+        InlineCallFrame* inlineCallFrame() const {
+#if ENABLE(DFG_JIT)
+            return m_inlineCallFrame;
+#else
+            return nullptr;
+#endif
+        }
+
+        bool isNativeFrame() const { return !codeBlock() && !isWasmFrame(); }
+        bool isInlinedFrame() const { return !!inlineCallFrame(); }
+        bool isWasmFrame() const;
+
+        JS_EXPORT_PRIVATE String functionName() const;
+        JS_EXPORT_PRIVATE String sourceURL() const;
+        JS_EXPORT_PRIVATE String toString() const;
+
+        intptr_t sourceID();
+
+        CodeType codeType() const;
+        bool hasLineAndColumnInfo() const;
+        JS_EXPORT_PRIVATE void computeLineAndColumn(unsigned& line, unsigned& column) const;
+
+        RegisterAtOffsetList* calleeSaveRegisters();
+
+        ClonedArguments* createArguments();
+        VMEntryFrame* vmEntryFrame() const { return m_VMEntryFrame; }
+        CallFrame* callFrame() const { return m_callFrame; }
+        
+        void dump(PrintStream&, Indenter = Indenter()) const;
+        void dump(PrintStream&, Indenter, std::function<void(PrintStream&)> prefix) const;
+
+    private:
+        Frame() { }
+        ~Frame() { }
+
+        void retrieveExpressionInfo(int& divot, int& startOffset, int& endOffset, unsigned& line, unsigned& column) const;
+        void setToEnd();
+
+#if ENABLE(DFG_JIT)
+        InlineCallFrame* m_inlineCallFrame;
+#endif
+        CallFrame* m_callFrame;
+        VMEntryFrame* m_VMEntryFrame;
+        VMEntryFrame* m_CallerVMEntryFrame;
+        CallFrame* m_callerFrame;
+        JSCell* m_callee;
+        CodeBlock* m_codeBlock;
+        size_t m_index;
+        size_t m_argumentCountIncludingThis;
+        unsigned m_bytecodeOffset;
+        bool m_callerIsVMEntryFrame : 1;
+        bool m_isWasmFrame : 1;
+
+        friend class StackVisitor;
+    };
+
+    enum Status {
+        Continue = 0,
+        Done = 1
+    };
+
+    // StackVisitor::visit() expects a Functor that implements the following method:
+    //     Status operator()(StackVisitor&) const;
+
+    template <typename Functor>
+    static void visit(CallFrame* startFrame, const Functor& functor)
+    {
+        StackVisitor visitor(startFrame);
+        while (visitor->callFrame()) {
+            Status status = functor(visitor);
+            if (status != Continue)
+                break;
+            visitor.gotoNextFrame();
+        }
+    }
+
+    Frame& operator*() { return m_frame; }
+    ALWAYS_INLINE Frame* operator->() { return &m_frame; }
+    void unwindToMachineCodeBlockFrame();
+
+private:
+    JS_EXPORT_PRIVATE StackVisitor(CallFrame* startFrame);
+
+    JS_EXPORT_PRIVATE void gotoNextFrame();
+
+    void readFrame(CallFrame*);
+    void readNonInlinedFrame(CallFrame*, CodeOrigin* = 0);
+#if ENABLE(DFG_JIT)
+    void readInlinedFrame(CallFrame*, CodeOrigin*);
+#endif
+
+    Frame m_frame;
+};
+
+class CallerFunctor {
+public:
+    CallerFunctor()
+        : m_hasSkippedFirstFrame(false)
+        , m_callerFrame(0)
+    {
+    }
+
+    CallFrame* callerFrame() const { return m_callerFrame; }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        if (!m_hasSkippedFirstFrame) {
+            m_hasSkippedFirstFrame = true;
+            return StackVisitor::Continue;
+        }
+
+        m_callerFrame = visitor->callFrame();
+        return StackVisitor::Done;
+    }
+    
+private:
+    mutable bool m_hasSkippedFirstFrame;
+    mutable CallFrame* m_callerFrame;
+};
+
+} // namespace JSC
diff --git a/interpreter/VMEntryRecord.h b/interpreter/VMEntryRecord.h
new file mode 100644
index 0000000..f36c2be
--- /dev/null
+++ b/interpreter/VMEntryRecord.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GPRInfo.h"
+
+namespace JSC {
+
+struct VMEntryFrame;
+class ExecState;
+class VM;
+
+struct VMEntryRecord {
+    /*
+     * This record stored in a vmEntryTo{JavaScript,Host} allocated frame. It is allocated on the stack
+     * after callee save registers where local variables would go.
+     */
+    VM* m_vm;
+    ExecState* m_prevTopCallFrame;
+    VMEntryFrame* m_prevTopVMEntryFrame;
+
+#if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+    intptr_t calleeSaveRegistersBuffer[NUMBER_OF_CALLEE_SAVES_REGISTERS];
+#endif
+
+    ExecState* prevTopCallFrame() { return m_prevTopCallFrame; }
+    SUPPRESS_ASAN ExecState* unsafePrevTopCallFrame() { return m_prevTopCallFrame; }
+
+    VMEntryFrame* prevTopVMEntryFrame() { return m_prevTopVMEntryFrame; }
+    SUPPRESS_ASAN VMEntryFrame* unsafePrevTopVMEntryFrame() { return m_prevTopVMEntryFrame; }
+};
+
+extern "C" VMEntryRecord* vmEntryRecord(VMEntryFrame*);
+
+struct VMEntryFrame {
+#if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+    static ptrdiff_t vmEntryRecordOffset()
+    {
+        VMEntryFrame* fakeVMEntryFrame = reinterpret_cast<VMEntryFrame*>(0x1000);
+        VMEntryRecord* record = vmEntryRecord(fakeVMEntryFrame);
+        return static_cast<ptrdiff_t>(
+            reinterpret_cast<char*>(record) - reinterpret_cast<char*>(fakeVMEntryFrame));
+    }
+
+    static ptrdiff_t calleeSaveRegistersBufferOffset()
+    {
+        return vmEntryRecordOffset() + OBJECT_OFFSETOF(VMEntryRecord, calleeSaveRegistersBuffer);
+    }
+#endif
+};
+
+} // namespace JSC
diff --git a/javascriptcoregtk.pc.in b/javascriptcoregtk.pc.in
new file mode 100644
index 0000000..b2afb26
--- /dev/null
+++ b/javascriptcoregtk.pc.in
@@ -0,0 +1,11 @@
+prefix=@CMAKE_INSTALL_PREFIX@
+exec_prefix=${prefix}
+libdir=@LIB_INSTALL_DIR@
+includedir=${prefix}/include
+
+Name: JavaScriptCoreGTK+
+Description: GTK+ version of the JavaScriptCore engine
+Version: @PROJECT_VERSION@
+Requires: glib-2.0
+Libs: -L${libdir} -ljavascriptcoregtk-@WEBKITGTK_API_VERSION@
+Cflags: -I${includedir}/webkitgtk-@WEBKITGTK_API_VERSION@
diff --git a/jit/AssemblyHelpers.cpp b/jit/AssemblyHelpers.cpp
new file mode 100644
index 0000000..ba017e8
--- /dev/null
+++ b/jit/AssemblyHelpers.cpp
@@ -0,0 +1,767 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AssemblyHelpers.h"
+
+#if ENABLE(JIT)
+
+#include "JITOperations.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+
+namespace JSC {
+
+ExecutableBase* AssemblyHelpers::executableFor(const CodeOrigin& codeOrigin)
+{
+    if (!codeOrigin.inlineCallFrame)
+        return m_codeBlock->ownerExecutable();
+    
+    return codeOrigin.inlineCallFrame->baselineCodeBlock->ownerExecutable();
+}
+
+Vector<BytecodeAndMachineOffset>& AssemblyHelpers::decodedCodeMapFor(CodeBlock* codeBlock)
+{
+    ASSERT(codeBlock == codeBlock->baselineVersion());
+    ASSERT(codeBlock->jitType() == JITCode::BaselineJIT);
+    ASSERT(codeBlock->jitCodeMap());
+    
+    HashMap<CodeBlock*, Vector<BytecodeAndMachineOffset>>::AddResult result = m_decodedCodeMaps.add(codeBlock, Vector<BytecodeAndMachineOffset>());
+    
+    if (result.isNewEntry)
+        codeBlock->jitCodeMap()->decode(result.iterator->value);
+    
+    return result.iterator->value;
+}
+
+AssemblyHelpers::JumpList AssemblyHelpers::branchIfNotType(
+    JSValueRegs regs, GPRReg tempGPR, const InferredType::Descriptor& descriptor, TagRegistersMode mode)
+{
+    AssemblyHelpers::JumpList result;
+
+    switch (descriptor.kind()) {
+    case InferredType::Bottom:
+        result.append(jump());
+        break;
+
+    case InferredType::Boolean:
+        result.append(branchIfNotBoolean(regs, tempGPR));
+        break;
+
+    case InferredType::Other:
+        result.append(branchIfNotOther(regs, tempGPR));
+        break;
+
+    case InferredType::Int32:
+        result.append(branchIfNotInt32(regs, mode));
+        break;
+
+    case InferredType::Number:
+        result.append(branchIfNotNumber(regs, tempGPR, mode));
+        break;
+
+    case InferredType::String:
+        result.append(branchIfNotCell(regs, mode));
+        result.append(branchIfNotString(regs.payloadGPR()));
+        break;
+
+    case InferredType::Symbol:
+        result.append(branchIfNotCell(regs, mode));
+        result.append(branchIfNotSymbol(regs.payloadGPR()));
+        break;
+
+    case InferredType::ObjectWithStructure:
+        result.append(branchIfNotCell(regs, mode));
+        result.append(
+            branchStructure(
+                NotEqual,
+                Address(regs.payloadGPR(), JSCell::structureIDOffset()),
+                descriptor.structure()));
+        break;
+
+    case InferredType::ObjectWithStructureOrOther: {
+        Jump ok = branchIfOther(regs, tempGPR);
+        result.append(branchIfNotCell(regs, mode));
+        result.append(
+            branchStructure(
+                NotEqual,
+                Address(regs.payloadGPR(), JSCell::structureIDOffset()),
+                descriptor.structure()));
+        ok.link(this);
+        break;
+    }
+
+    case InferredType::Object:
+        result.append(branchIfNotCell(regs, mode));
+        result.append(branchIfNotObject(regs.payloadGPR()));
+        break;
+
+    case InferredType::ObjectOrOther: {
+        Jump ok = branchIfOther(regs, tempGPR);
+        result.append(branchIfNotCell(regs, mode));
+        result.append(branchIfNotObject(regs.payloadGPR()));
+        ok.link(this);
+        break;
+    }
+
+    case InferredType::Top:
+        break;
+    }
+
+    return result;
+}
+
+AssemblyHelpers::Jump AssemblyHelpers::branchIfFastTypedArray(GPRReg baseGPR)
+{
+    return branch32(
+        Equal,
+        Address(baseGPR, JSArrayBufferView::offsetOfMode()),
+        TrustedImm32(FastTypedArray));
+}
+
+AssemblyHelpers::Jump AssemblyHelpers::branchIfNotFastTypedArray(GPRReg baseGPR)
+{
+    return branch32(
+        NotEqual,
+        Address(baseGPR, JSArrayBufferView::offsetOfMode()),
+        TrustedImm32(FastTypedArray));
+}
+
+void AssemblyHelpers::incrementSuperSamplerCount()
+{
+    add32(TrustedImm32(1), AbsoluteAddress(bitwise_cast<const void*>(&g_superSamplerCount)));
+}
+
+void AssemblyHelpers::decrementSuperSamplerCount()
+{
+    sub32(TrustedImm32(1), AbsoluteAddress(bitwise_cast<const void*>(&g_superSamplerCount)));
+}
+    
+void AssemblyHelpers::purifyNaN(FPRReg fpr)
+{
+    MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);
+    static const double NaN = PNaN;
+    loadDouble(TrustedImmPtr(&NaN), fpr);
+    notNaN.link(this);
+}
+
+#if ENABLE(SAMPLING_FLAGS)
+void AssemblyHelpers::setSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    or32(TrustedImm32(1u << (flag - 1)), AbsoluteAddress(SamplingFlags::addressOfFlags()));
+}
+
+void AssemblyHelpers::clearSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    and32(TrustedImm32(~(1u << (flag - 1))), AbsoluteAddress(SamplingFlags::addressOfFlags()));
+}
+#endif
+
+#if !ASSERT_DISABLED
+#if USE(JSVALUE64)
+void AssemblyHelpers::jitAssertIsInt32(GPRReg gpr)
+{
+#if CPU(X86_64)
+    Jump checkInt32 = branch64(BelowOrEqual, gpr, TrustedImm64(static_cast<uintptr_t>(0xFFFFFFFFu)));
+    abortWithReason(AHIsNotInt32);
+    checkInt32.link(this);
+#else
+    UNUSED_PARAM(gpr);
+#endif
+}
+
+void AssemblyHelpers::jitAssertIsJSInt32(GPRReg gpr)
+{
+    Jump checkJSInt32 = branch64(AboveOrEqual, gpr, GPRInfo::tagTypeNumberRegister);
+    abortWithReason(AHIsNotJSInt32);
+    checkJSInt32.link(this);
+}
+
+void AssemblyHelpers::jitAssertIsJSNumber(GPRReg gpr)
+{
+    Jump checkJSNumber = branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagTypeNumberRegister);
+    abortWithReason(AHIsNotJSNumber);
+    checkJSNumber.link(this);
+}
+
+void AssemblyHelpers::jitAssertIsJSDouble(GPRReg gpr)
+{
+    Jump checkJSInt32 = branch64(AboveOrEqual, gpr, GPRInfo::tagTypeNumberRegister);
+    Jump checkJSNumber = branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagTypeNumberRegister);
+    checkJSInt32.link(this);
+    abortWithReason(AHIsNotJSDouble);
+    checkJSNumber.link(this);
+}
+
+void AssemblyHelpers::jitAssertIsCell(GPRReg gpr)
+{
+    Jump checkCell = branchTest64(MacroAssembler::Zero, gpr, GPRInfo::tagMaskRegister);
+    abortWithReason(AHIsNotCell);
+    checkCell.link(this);
+}
+
+void AssemblyHelpers::jitAssertTagsInPlace()
+{
+    Jump ok = branch64(Equal, GPRInfo::tagTypeNumberRegister, TrustedImm64(TagTypeNumber));
+    abortWithReason(AHTagTypeNumberNotInPlace);
+    breakpoint();
+    ok.link(this);
+    
+    ok = branch64(Equal, GPRInfo::tagMaskRegister, TrustedImm64(TagMask));
+    abortWithReason(AHTagMaskNotInPlace);
+    ok.link(this);
+}
+#elif USE(JSVALUE32_64)
+void AssemblyHelpers::jitAssertIsInt32(GPRReg gpr)
+{
+    UNUSED_PARAM(gpr);
+}
+
+void AssemblyHelpers::jitAssertIsJSInt32(GPRReg gpr)
+{
+    Jump checkJSInt32 = branch32(Equal, gpr, TrustedImm32(JSValue::Int32Tag));
+    abortWithReason(AHIsNotJSInt32);
+    checkJSInt32.link(this);
+}
+
+void AssemblyHelpers::jitAssertIsJSNumber(GPRReg gpr)
+{
+    Jump checkJSInt32 = branch32(Equal, gpr, TrustedImm32(JSValue::Int32Tag));
+    Jump checkJSDouble = branch32(Below, gpr, TrustedImm32(JSValue::LowestTag));
+    abortWithReason(AHIsNotJSNumber);
+    checkJSInt32.link(this);
+    checkJSDouble.link(this);
+}
+
+void AssemblyHelpers::jitAssertIsJSDouble(GPRReg gpr)
+{
+    Jump checkJSDouble = branch32(Below, gpr, TrustedImm32(JSValue::LowestTag));
+    abortWithReason(AHIsNotJSDouble);
+    checkJSDouble.link(this);
+}
+
+void AssemblyHelpers::jitAssertIsCell(GPRReg gpr)
+{
+    Jump checkCell = branch32(Equal, gpr, TrustedImm32(JSValue::CellTag));
+    abortWithReason(AHIsNotCell);
+    checkCell.link(this);
+}
+
+void AssemblyHelpers::jitAssertTagsInPlace()
+{
+}
+#endif // USE(JSVALUE32_64)
+
+void AssemblyHelpers::jitAssertHasValidCallFrame()
+{
+    Jump checkCFR = branchTestPtr(Zero, GPRInfo::callFrameRegister, TrustedImm32(7));
+    abortWithReason(AHCallFrameMisaligned);
+    checkCFR.link(this);
+}
+
+void AssemblyHelpers::jitAssertIsNull(GPRReg gpr)
+{
+    Jump checkNull = branchTestPtr(Zero, gpr);
+    abortWithReason(AHIsNotNull);
+    checkNull.link(this);
+}
+
+void AssemblyHelpers::jitAssertArgumentCountSane()
+{
+    Jump ok = branch32(Below, payloadFor(CallFrameSlot::argumentCount), TrustedImm32(10000000));
+    abortWithReason(AHInsaneArgumentCount);
+    ok.link(this);
+}
+
+#endif // !ASSERT_DISABLED
+
+void AssemblyHelpers::jitReleaseAssertNoException()
+{
+    Jump noException;
+#if USE(JSVALUE64)
+    noException = branchTest64(Zero, AbsoluteAddress(vm()->addressOfException()));
+#elif USE(JSVALUE32_64)
+    noException = branch32(Equal, AbsoluteAddress(vm()->addressOfException()), TrustedImm32(0));
+#endif
+    abortWithReason(JITUncoughtExceptionAfterCall);
+    noException.link(this);
+}
+
+void AssemblyHelpers::callExceptionFuzz()
+{
+    if (!Options::useExceptionFuzz())
+        return;
+
+    EncodedJSValue* buffer = vm()->exceptionFuzzingBuffer(sizeof(EncodedJSValue) * (GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters));
+
+    for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
+#if USE(JSVALUE64)
+        store64(GPRInfo::toRegister(i), buffer + i);
+#else
+        store32(GPRInfo::toRegister(i), buffer + i);
+#endif
+    }
+    for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
+        move(TrustedImmPtr(buffer + GPRInfo::numberOfRegisters + i), GPRInfo::regT0);
+        storeDouble(FPRInfo::toRegister(i), Address(GPRInfo::regT0));
+    }
+
+    // Set up one argument.
+#if CPU(X86)
+    poke(GPRInfo::callFrameRegister, 0);
+#else
+    move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+#endif
+    move(TrustedImmPtr(bitwise_cast<void*>(operationExceptionFuzz)), GPRInfo::nonPreservedNonReturnGPR);
+    call(GPRInfo::nonPreservedNonReturnGPR);
+
+    for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
+        move(TrustedImmPtr(buffer + GPRInfo::numberOfRegisters + i), GPRInfo::regT0);
+        loadDouble(Address(GPRInfo::regT0), FPRInfo::toRegister(i));
+    }
+    for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
+#if USE(JSVALUE64)
+        load64(buffer + i, GPRInfo::toRegister(i));
+#else
+        load32(buffer + i, GPRInfo::toRegister(i));
+#endif
+    }
+}
+
+AssemblyHelpers::Jump AssemblyHelpers::emitExceptionCheck(ExceptionCheckKind kind, ExceptionJumpWidth width)
+{
+    callExceptionFuzz();
+
+    if (width == FarJumpWidth)
+        kind = (kind == NormalExceptionCheck ? InvertedExceptionCheck : NormalExceptionCheck);
+    
+    Jump result;
+#if USE(JSVALUE64)
+    result = branchTest64(kind == NormalExceptionCheck ? NonZero : Zero, AbsoluteAddress(vm()->addressOfException()));
+#elif USE(JSVALUE32_64)
+    result = branch32(kind == NormalExceptionCheck ? NotEqual : Equal, AbsoluteAddress(vm()->addressOfException()), TrustedImm32(0));
+#endif
+    
+    if (width == NormalJumpWidth)
+        return result;
+
+    PatchableJump realJump = patchableJump();
+    result.link(this);
+    
+    return realJump.m_jump;
+}
+
+AssemblyHelpers::Jump AssemblyHelpers::emitNonPatchableExceptionCheck()
+{
+    callExceptionFuzz();
+
+    Jump result;
+#if USE(JSVALUE64)
+    result = branchTest64(NonZero, AbsoluteAddress(vm()->addressOfException()));
+#elif USE(JSVALUE32_64)
+    result = branch32(NotEqual, AbsoluteAddress(vm()->addressOfException()), TrustedImm32(0));
+#endif
+    
+    return result;
+}
+
+void AssemblyHelpers::emitStoreStructureWithTypeInfo(AssemblyHelpers& jit, TrustedImmPtr structure, RegisterID dest)
+{
+    const Structure* structurePtr = static_cast<const Structure*>(structure.m_value);
+#if USE(JSVALUE64)
+    jit.store64(TrustedImm64(structurePtr->idBlob()), MacroAssembler::Address(dest, JSCell::structureIDOffset()));
+    if (!ASSERT_DISABLED) {
+        Jump correctStructure = jit.branch32(Equal, MacroAssembler::Address(dest, JSCell::structureIDOffset()), TrustedImm32(structurePtr->id()));
+        jit.abortWithReason(AHStructureIDIsValid);
+        correctStructure.link(&jit);
+
+        Jump correctIndexingType = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::indexingTypeAndMiscOffset()), TrustedImm32(structurePtr->indexingTypeIncludingHistory()));
+        jit.abortWithReason(AHIndexingTypeIsValid);
+        correctIndexingType.link(&jit);
+
+        Jump correctType = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::typeInfoTypeOffset()), TrustedImm32(structurePtr->typeInfo().type()));
+        jit.abortWithReason(AHTypeInfoIsValid);
+        correctType.link(&jit);
+
+        Jump correctFlags = jit.branch8(Equal, MacroAssembler::Address(dest, JSCell::typeInfoFlagsOffset()), TrustedImm32(structurePtr->typeInfo().inlineTypeFlags()));
+        jit.abortWithReason(AHTypeInfoInlineTypeFlagsAreValid);
+        correctFlags.link(&jit);
+    }
+#else
+    // Do a 32-bit wide store to initialize the cell's fields.
+    jit.store32(TrustedImm32(structurePtr->objectInitializationBlob()), MacroAssembler::Address(dest, JSCell::indexingTypeAndMiscOffset()));
+    jit.storePtr(structure, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
+#endif
+}
+
+void AssemblyHelpers::loadProperty(GPRReg object, GPRReg offset, JSValueRegs result)
+{
+    Jump isInline = branch32(LessThan, offset, TrustedImm32(firstOutOfLineOffset));
+    
+    loadPtr(Address(object, JSObject::butterflyOffset()), result.payloadGPR());
+    neg32(offset);
+    signExtend32ToPtr(offset, offset);
+    Jump ready = jump();
+    
+    isInline.link(this);
+    addPtr(
+        TrustedImm32(
+            static_cast<int32_t>(sizeof(JSObject)) -
+            (static_cast<int32_t>(firstOutOfLineOffset) - 2) * static_cast<int32_t>(sizeof(EncodedJSValue))),
+        object, result.payloadGPR());
+    
+    ready.link(this);
+    
+    loadValue(
+        BaseIndex(
+            result.payloadGPR(), offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)),
+        result);
+}
+
+void AssemblyHelpers::emitLoadStructure(RegisterID source, RegisterID dest, RegisterID scratch)
+{
+#if USE(JSVALUE64)
+    ASSERT(dest != scratch);
+    load32(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);
+    loadPtr(vm()->heap.structureIDTable().base(), scratch);
+    loadPtr(MacroAssembler::BaseIndex(scratch, dest, MacroAssembler::TimesEight), dest);
+#else
+    UNUSED_PARAM(scratch);
+    loadPtr(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);
+#endif
+}
+
+void AssemblyHelpers::makeSpaceOnStackForCCall()
+{
+    unsigned stackOffset = WTF::roundUpToMultipleOf(stackAlignmentBytes(), maxFrameExtentForSlowPathCall);
+    if (stackOffset)
+        subPtr(TrustedImm32(stackOffset), stackPointerRegister);
+}
+
+void AssemblyHelpers::reclaimSpaceOnStackForCCall()
+{
+    unsigned stackOffset = WTF::roundUpToMultipleOf(stackAlignmentBytes(), maxFrameExtentForSlowPathCall);
+    if (stackOffset)
+        addPtr(TrustedImm32(stackOffset), stackPointerRegister);
+}
+
+#if USE(JSVALUE64)
+template<typename LoadFromHigh, typename StoreToHigh, typename LoadFromLow, typename StoreToLow>
+void emitRandomThunkImpl(AssemblyHelpers& jit, GPRReg scratch0, GPRReg scratch1, GPRReg scratch2, FPRReg result, const LoadFromHigh& loadFromHigh, const StoreToHigh& storeToHigh, const LoadFromLow& loadFromLow, const StoreToLow& storeToLow)
+{
+    // Inlined WeakRandom::advance().
+    // uint64_t x = m_low;
+    loadFromLow(scratch0);
+    // uint64_t y = m_high;
+    loadFromHigh(scratch1);
+    // m_low = y;
+    storeToLow(scratch1);
+
+    // x ^= x << 23;
+    jit.move(scratch0, scratch2);
+    jit.lshift64(AssemblyHelpers::TrustedImm32(23), scratch2);
+    jit.xor64(scratch2, scratch0);
+
+    // x ^= x >> 17;
+    jit.move(scratch0, scratch2);
+    jit.rshift64(AssemblyHelpers::TrustedImm32(17), scratch2);
+    jit.xor64(scratch2, scratch0);
+
+    // x ^= y ^ (y >> 26);
+    jit.move(scratch1, scratch2);
+    jit.rshift64(AssemblyHelpers::TrustedImm32(26), scratch2);
+    jit.xor64(scratch1, scratch2);
+    jit.xor64(scratch2, scratch0);
+
+    // m_high = x;
+    storeToHigh(scratch0);
+
+    // return x + y;
+    jit.add64(scratch1, scratch0);
+
+    // Extract random 53bit. [0, 53] bit is safe integer number ranges in double representation.
+    jit.move(AssemblyHelpers::TrustedImm64((1ULL << 53) - 1), scratch1);
+    jit.and64(scratch1, scratch0);
+    // Now, scratch0 is always in range of int64_t. Safe to convert it to double with cvtsi2sdq.
+    jit.convertInt64ToDouble(scratch0, result);
+
+    // Convert `(53bit double integer value) / (1 << 53)` to `(53bit double integer value) * (1.0 / (1 << 53))`.
+    // In latter case, `1.0 / (1 << 53)` will become a double value represented as (mantissa = 0 & exp = 970, it means 1e-(2**54)).
+    static const double scale = 1.0 / (1ULL << 53);
+
+    // Multiplying 1e-(2**54) with the double integer does not change anything of the mantissa part of the double integer.
+    // It just reduces the exp part of the given 53bit double integer.
+    // (Except for 0.0. This is specially handled and in this case, exp just becomes 0.)
+    // Now we get 53bit precision random double value in [0, 1).
+    jit.move(AssemblyHelpers::TrustedImmPtr(&scale), scratch1);
+    jit.mulDouble(AssemblyHelpers::Address(scratch1), result);
+}
+
+void AssemblyHelpers::emitRandomThunk(JSGlobalObject* globalObject, GPRReg scratch0, GPRReg scratch1, GPRReg scratch2, FPRReg result)
+{
+    void* lowAddress = reinterpret_cast<uint8_t*>(globalObject) + JSGlobalObject::weakRandomOffset() + WeakRandom::lowOffset();
+    void* highAddress = reinterpret_cast<uint8_t*>(globalObject) + JSGlobalObject::weakRandomOffset() + WeakRandom::highOffset();
+
+    auto loadFromHigh = [&](GPRReg high) {
+        load64(highAddress, high);
+    };
+    auto storeToHigh = [&](GPRReg high) {
+        store64(high, highAddress);
+    };
+    auto loadFromLow = [&](GPRReg low) {
+        load64(lowAddress, low);
+    };
+    auto storeToLow = [&](GPRReg low) {
+        store64(low, lowAddress);
+    };
+
+    emitRandomThunkImpl(*this, scratch0, scratch1, scratch2, result, loadFromHigh, storeToHigh, loadFromLow, storeToLow);
+}
+
+void AssemblyHelpers::emitRandomThunk(GPRReg scratch0, GPRReg scratch1, GPRReg scratch2, GPRReg scratch3, FPRReg result)
+{
+    emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, scratch3);
+    emitLoadStructure(scratch3, scratch3, scratch0);
+    loadPtr(Address(scratch3, Structure::globalObjectOffset()), scratch3);
+    // Now, scratch3 holds JSGlobalObject*.
+
+    auto loadFromHigh = [&](GPRReg high) {
+        load64(Address(scratch3, JSGlobalObject::weakRandomOffset() + WeakRandom::highOffset()), high);
+    };
+    auto storeToHigh = [&](GPRReg high) {
+        store64(high, Address(scratch3, JSGlobalObject::weakRandomOffset() + WeakRandom::highOffset()));
+    };
+    auto loadFromLow = [&](GPRReg low) {
+        load64(Address(scratch3, JSGlobalObject::weakRandomOffset() + WeakRandom::lowOffset()), low);
+    };
+    auto storeToLow = [&](GPRReg low) {
+        store64(low, Address(scratch3, JSGlobalObject::weakRandomOffset() + WeakRandom::lowOffset()));
+    };
+
+    emitRandomThunkImpl(*this, scratch0, scratch1, scratch2, result, loadFromHigh, storeToHigh, loadFromLow, storeToLow);
+}
+#endif
+
+void AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer()
+{
+#if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+    RegisterAtOffsetList* allCalleeSaves = m_vm->getAllCalleeSaveRegisterOffsets();
+    RegisterSet dontRestoreRegisters = RegisterSet::stackRegisters();
+    unsigned registerCount = allCalleeSaves->size();
+
+    GPRReg scratch = InvalidGPRReg;
+    unsigned scratchGPREntryIndex = 0;
+
+    // Use the first GPR entry's register as our scratch.
+    for (unsigned i = 0; i < registerCount; i++) {
+        RegisterAtOffset entry = allCalleeSaves->at(i);
+        if (dontRestoreRegisters.get(entry.reg()))
+            continue;
+        if (entry.reg().isGPR()) {
+            scratchGPREntryIndex = i;
+            scratch = entry.reg().gpr();
+            break;
+        }
+    }
+    ASSERT(scratch != InvalidGPRReg);
+
+    loadPtr(&m_vm->topVMEntryFrame, scratch);
+    addPtr(TrustedImm32(VMEntryFrame::calleeSaveRegistersBufferOffset()), scratch);
+
+    // Restore all callee saves except for the scratch.
+    for (unsigned i = 0; i < registerCount; i++) {
+        RegisterAtOffset entry = allCalleeSaves->at(i);
+        if (dontRestoreRegisters.get(entry.reg()))
+            continue;
+        if (entry.reg().isGPR()) {
+            if (i != scratchGPREntryIndex)
+                loadPtr(Address(scratch, entry.offset()), entry.reg().gpr());
+        } else
+            loadDouble(Address(scratch, entry.offset()), entry.reg().fpr());
+    }
+
+    // Restore the callee save value of the scratch.
+    RegisterAtOffset entry = allCalleeSaves->at(scratchGPREntryIndex);
+    ASSERT(!dontRestoreRegisters.get(entry.reg()));
+    ASSERT(entry.reg().isGPR());
+    ASSERT(scratch == entry.reg().gpr());
+    loadPtr(Address(scratch, entry.offset()), scratch);
+#endif
+}
+
+void AssemblyHelpers::emitDumbVirtualCall(CallLinkInfo* info)
+{
+    move(TrustedImmPtr(info), GPRInfo::regT2);
+    Call call = nearCall();
+    addLinkTask(
+        [=] (LinkBuffer& linkBuffer) {
+            MacroAssemblerCodeRef virtualThunk = virtualThunkFor(&linkBuffer.vm(), *info);
+            info->setSlowStub(createJITStubRoutine(virtualThunk, linkBuffer.vm(), nullptr, true));
+            linkBuffer.link(call, CodeLocationLabel(virtualThunk.code()));
+        });
+}
+
+#if USE(JSVALUE64)
+void AssemblyHelpers::wangsInt64Hash(GPRReg inputAndResult, GPRReg scratch)
+{
+    GPRReg input = inputAndResult;
+    // key += ~(key << 32);
+    move(input, scratch);
+    lshift64(TrustedImm32(32), scratch);
+    not64(scratch);
+    add64(scratch, input);
+    // key ^= (key >> 22);
+    move(input, scratch);
+    urshift64(TrustedImm32(22), scratch);
+    xor64(scratch, input);
+    // key += ~(key << 13);
+    move(input, scratch);
+    lshift64(TrustedImm32(13), scratch);
+    not64(scratch);
+    add64(scratch, input);
+    // key ^= (key >> 8);
+    move(input, scratch);
+    urshift64(TrustedImm32(8), scratch);
+    xor64(scratch, input);
+    // key += (key << 3);
+    move(input, scratch);
+    lshift64(TrustedImm32(3), scratch);
+    add64(scratch, input);
+    // key ^= (key >> 15);
+    move(input, scratch);
+    urshift64(TrustedImm32(15), scratch);
+    xor64(scratch, input);
+    // key += ~(key << 27);
+    move(input, scratch);
+    lshift64(TrustedImm32(27), scratch);
+    not64(scratch);
+    add64(scratch, input);
+    // key ^= (key >> 31);
+    move(input, scratch);
+    urshift64(TrustedImm32(31), scratch);
+    xor64(scratch, input);
+
+    // return static_cast<unsigned>(result)
+    void* mask = bitwise_cast<void*>(static_cast<uintptr_t>(UINT_MAX));
+    and64(TrustedImmPtr(mask), inputAndResult);
+}
+#endif // USE(JSVALUE64)
+
+void AssemblyHelpers::emitConvertValueToBoolean(JSValueRegs value, GPRReg result, GPRReg scratch, FPRReg valueAsFPR, FPRReg tempFPR, bool shouldCheckMasqueradesAsUndefined, JSGlobalObject* globalObject, bool negateResult)
+{
+    // Implements the following control flow structure:
+    // if (value is boolean) {
+    //     result = value === true
+    // } else if (value is integer) {
+    //     result = value !== 0
+    // } else if (value is double) {
+    //     result = value !== 0.0 && !isNaN(value);
+    // } else if (value is cell) {
+    //     if (value is string) {
+    //          result = value.length() !== 0;
+    //     } else {
+    //          do crazy things for masquerades as undefined
+    //     }
+    // } else {
+    //     result = false;
+    // }
+    //
+    // if (negateResult)
+    //     result = !result;
+
+    JumpList done;
+    auto notBoolean = branchIfNotBoolean(value, result);
+#if USE(JSVALUE64)
+    compare32(negateResult ? NotEqual : Equal, value.gpr(), TrustedImm32(ValueTrue), result);
+#else
+    compare32(negateResult ? Equal : NotEqual, value.payloadGPR(), TrustedImm32(0), result);
+#endif
+    done.append(jump());
+
+    notBoolean.link(this);
+#if USE(JSVALUE64)
+    auto isNotNumber = branchIfNotNumber(value.gpr());
+#else
+    ASSERT(scratch != InvalidGPRReg);
+    auto isNotNumber = branchIfNotNumber(value, scratch);
+#endif
+    auto isDouble = branchIfNotInt32(value);
+
+    // It's an int32.
+    compare32(negateResult ? Equal : NotEqual, value.payloadGPR(), TrustedImm32(0), result);
+    done.append(jump());
+
+    isDouble.link(this);
+#if USE(JSVALUE64)
+    unboxDouble(value.gpr(), result, valueAsFPR);
+#else
+    unboxDouble(value, valueAsFPR, tempFPR);
+#endif
+    auto isZeroOrNaN = branchDoubleZeroOrNaN(valueAsFPR, tempFPR);
+    move(negateResult ? TrustedImm32(0) : TrustedImm32(1), result);
+    done.append(jump());
+    isZeroOrNaN.link(this);
+    move(negateResult ? TrustedImm32(1) : TrustedImm32(0), result);
+    done.append(jump());
+
+    isNotNumber.link(this);
+    auto isNotCellAndIsNotNumberAndIsNotBoolean = branchIfNotCell(value);
+    auto isCellButNotString = branch8(NotEqual,
+        Address(value.payloadGPR(), JSCell::typeInfoTypeOffset()), TrustedImm32(StringType));
+    load32(Address(value.payloadGPR(), JSString::offsetOfLength()), result);
+    compare32(negateResult ? Equal : NotEqual, result, TrustedImm32(0), result);
+    done.append(jump());
+
+    isCellButNotString.link(this);
+    if (shouldCheckMasqueradesAsUndefined) {
+        ASSERT(scratch != InvalidGPRReg);
+        JumpList isNotMasqueradesAsUndefined;
+        isNotMasqueradesAsUndefined.append(branchTest8(Zero, Address(value.payloadGPR(), JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)));
+        emitLoadStructure(value.payloadGPR(), result, scratch);
+        move(TrustedImmPtr(globalObject), scratch);
+        isNotMasqueradesAsUndefined.append(branchPtr(NotEqual, Address(result, Structure::globalObjectOffset()), scratch));
+        // We act like we are "undefined" here.
+        move(negateResult ? TrustedImm32(1) : TrustedImm32(0), result);
+        done.append(jump());
+        isNotMasqueradesAsUndefined.link(this);
+    }
+    move(negateResult ? TrustedImm32(0) : TrustedImm32(1), result);
+    done.append(jump());
+
+    // null or undefined.
+    isNotCellAndIsNotNumberAndIsNotBoolean.link(this); 
+    move(negateResult ? TrustedImm32(1) : TrustedImm32(0), result);
+
+    done.link(this);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/AssemblyHelpers.h b/jit/AssemblyHelpers.h
new file mode 100644
index 0000000..007509a
--- /dev/null
+++ b/jit/AssemblyHelpers.h
@@ -0,0 +1,1674 @@
+/*
+ * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "Heap.h"
+#include "InlineCallFrame.h"
+#include "JITCode.h"
+#include "MacroAssembler.h"
+#include "MarkedSpace.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "RegisterAtOffsetList.h"
+#include "RegisterSet.h"
+#include "SuperSampler.h"
+#include "TypeofType.h"
+#include "VM.h"
+
+namespace JSC {
+
+typedef void (*V_DebugOperation_EPP)(ExecState*, void*, void*);
+
+class AssemblyHelpers : public MacroAssembler {
+public:
+    AssemblyHelpers(VM* vm, CodeBlock* codeBlock)
+        : m_vm(vm)
+        , m_codeBlock(codeBlock)
+        , m_baselineCodeBlock(codeBlock ? codeBlock->baselineAlternative() : 0)
+    {
+        if (m_codeBlock) {
+            ASSERT(m_baselineCodeBlock);
+            ASSERT(!m_baselineCodeBlock->alternative());
+            ASSERT(m_baselineCodeBlock->jitType() == JITCode::None || JITCode::isBaselineCode(m_baselineCodeBlock->jitType()));
+        }
+    }
+
+    CodeBlock* codeBlock() { return m_codeBlock; }
+    VM* vm() { return m_vm; }
+    AssemblerType_T& assembler() { return m_assembler; }
+
+    void checkStackPointerAlignment()
+    {
+        // This check is both unneeded and harder to write correctly for ARM64
+#if !defined(NDEBUG) && !CPU(ARM64)
+        Jump stackPointerAligned = branchTestPtr(Zero, stackPointerRegister, TrustedImm32(0xf));
+        abortWithReason(AHStackPointerMisaligned);
+        stackPointerAligned.link(this);
+#endif
+    }
+    
+    template<typename T>
+    void storeCell(T cell, Address address)
+    {
+#if USE(JSVALUE64)
+        store64(cell, address);
+#else
+        store32(cell, address.withOffset(PayloadOffset));
+        store32(TrustedImm32(JSValue::CellTag), address.withOffset(TagOffset));
+#endif
+    }
+    
+    void loadCell(Address address, GPRReg gpr)
+    {
+#if USE(JSVALUE64)
+        load64(address, gpr);
+#else
+        load32(address.withOffset(PayloadOffset), gpr);
+#endif
+    }
+    
+    void storeValue(JSValueRegs regs, Address address)
+    {
+#if USE(JSVALUE64)
+        store64(regs.gpr(), address);
+#else
+        store32(regs.payloadGPR(), address.withOffset(PayloadOffset));
+        store32(regs.tagGPR(), address.withOffset(TagOffset));
+#endif
+    }
+    
+    void storeValue(JSValueRegs regs, BaseIndex address)
+    {
+#if USE(JSVALUE64)
+        store64(regs.gpr(), address);
+#else
+        store32(regs.payloadGPR(), address.withOffset(PayloadOffset));
+        store32(regs.tagGPR(), address.withOffset(TagOffset));
+#endif
+    }
+    
+    void storeValue(JSValueRegs regs, void* address)
+    {
+#if USE(JSVALUE64)
+        store64(regs.gpr(), address);
+#else
+        store32(regs.payloadGPR(), bitwise_cast<void*>(bitwise_cast<uintptr_t>(address) + PayloadOffset));
+        store32(regs.tagGPR(), bitwise_cast<void*>(bitwise_cast<uintptr_t>(address) + TagOffset));
+#endif
+    }
+    
+    void loadValue(Address address, JSValueRegs regs)
+    {
+#if USE(JSVALUE64)
+        load64(address, regs.gpr());
+#else
+        if (address.base == regs.payloadGPR()) {
+            load32(address.withOffset(TagOffset), regs.tagGPR());
+            load32(address.withOffset(PayloadOffset), regs.payloadGPR());
+        } else {
+            load32(address.withOffset(PayloadOffset), regs.payloadGPR());
+            load32(address.withOffset(TagOffset), regs.tagGPR());
+        }
+#endif
+    }
+    
+    void loadValue(BaseIndex address, JSValueRegs regs)
+    {
+#if USE(JSVALUE64)
+        load64(address, regs.gpr());
+#else
+        if (address.base == regs.payloadGPR() || address.index == regs.payloadGPR()) {
+            // We actually could handle the case where the registers are aliased to both
+            // tag and payload, but we don't for now.
+            RELEASE_ASSERT(address.base != regs.tagGPR());
+            RELEASE_ASSERT(address.index != regs.tagGPR());
+            
+            load32(address.withOffset(TagOffset), regs.tagGPR());
+            load32(address.withOffset(PayloadOffset), regs.payloadGPR());
+        } else {
+            load32(address.withOffset(PayloadOffset), regs.payloadGPR());
+            load32(address.withOffset(TagOffset), regs.tagGPR());
+        }
+#endif
+    }
+    
+    // Note that this clobbers offset.
+    void loadProperty(GPRReg object, GPRReg offset, JSValueRegs result);
+
+    void moveValueRegs(JSValueRegs srcRegs, JSValueRegs destRegs)
+    {
+#if USE(JSVALUE32_64)
+        if (destRegs.tagGPR() == srcRegs.payloadGPR()) {
+            if (destRegs.payloadGPR() == srcRegs.tagGPR()) {
+                swap(srcRegs.payloadGPR(), srcRegs.tagGPR());
+                return;
+            }
+            move(srcRegs.payloadGPR(), destRegs.payloadGPR());
+            move(srcRegs.tagGPR(), destRegs.tagGPR());
+            return;
+        }
+        move(srcRegs.tagGPR(), destRegs.tagGPR());
+        move(srcRegs.payloadGPR(), destRegs.payloadGPR());
+#else
+        move(srcRegs.gpr(), destRegs.gpr());
+#endif
+    }
+
+    void moveValue(JSValue value, JSValueRegs regs)
+    {
+#if USE(JSVALUE64)
+        move(Imm64(JSValue::encode(value)), regs.gpr());
+#else
+        move(Imm32(value.tag()), regs.tagGPR());
+        move(Imm32(value.payload()), regs.payloadGPR());
+#endif
+    }
+
+    void moveTrustedValue(JSValue value, JSValueRegs regs)
+    {
+#if USE(JSVALUE64)
+        move(TrustedImm64(JSValue::encode(value)), regs.gpr());
+#else
+        move(TrustedImm32(value.tag()), regs.tagGPR());
+        move(TrustedImm32(value.payload()), regs.payloadGPR());
+#endif
+    }
+    
+    void storeTrustedValue(JSValue value, Address address)
+    {
+#if USE(JSVALUE64)
+        store64(TrustedImm64(JSValue::encode(value)), address);
+#else
+        store32(TrustedImm32(value.tag()), address.withOffset(TagOffset));
+        store32(TrustedImm32(value.payload()), address.withOffset(PayloadOffset));
+#endif
+    }
+
+    void storeTrustedValue(JSValue value, BaseIndex address)
+    {
+#if USE(JSVALUE64)
+        store64(TrustedImm64(JSValue::encode(value)), address);
+#else
+        store32(TrustedImm32(value.tag()), address.withOffset(TagOffset));
+        store32(TrustedImm32(value.payload()), address.withOffset(PayloadOffset));
+#endif
+    }
+
+    void emitSaveCalleeSavesFor(CodeBlock* codeBlock)
+    {
+        ASSERT(codeBlock);
+
+        RegisterAtOffsetList* calleeSaves = codeBlock->calleeSaveRegisters();
+        RegisterSet dontSaveRegisters = RegisterSet(RegisterSet::stackRegisters(), RegisterSet::allFPRs());
+        unsigned registerCount = calleeSaves->size();
+
+        for (unsigned i = 0; i < registerCount; i++) {
+            RegisterAtOffset entry = calleeSaves->at(i);
+            if (dontSaveRegisters.get(entry.reg()))
+                continue;
+            storePtr(entry.reg().gpr(), Address(framePointerRegister, entry.offset()));
+        }
+    }
+    
+    enum RestoreTagRegisterMode { UseExistingTagRegisterContents, CopyBaselineCalleeSavedRegistersFromBaseFrame };
+
+    void emitSaveOrCopyCalleeSavesFor(CodeBlock* codeBlock, VirtualRegister offsetVirtualRegister, RestoreTagRegisterMode tagRegisterMode, GPRReg temp)
+    {
+        ASSERT(codeBlock);
+        
+        RegisterAtOffsetList* calleeSaves = codeBlock->calleeSaveRegisters();
+        RegisterSet dontSaveRegisters = RegisterSet(RegisterSet::stackRegisters(), RegisterSet::allFPRs());
+        unsigned registerCount = calleeSaves->size();
+
+#if USE(JSVALUE64)
+        RegisterSet baselineCalleeSaves = RegisterSet::llintBaselineCalleeSaveRegisters();
+#endif
+        
+        for (unsigned i = 0; i < registerCount; i++) {
+            RegisterAtOffset entry = calleeSaves->at(i);
+            if (dontSaveRegisters.get(entry.reg()))
+                continue;
+            
+            GPRReg registerToWrite;
+            
+#if USE(JSVALUE32_64)
+            UNUSED_PARAM(tagRegisterMode);
+            UNUSED_PARAM(temp);
+#else
+            if (tagRegisterMode == CopyBaselineCalleeSavedRegistersFromBaseFrame && baselineCalleeSaves.get(entry.reg())) {
+                registerToWrite = temp;
+                loadPtr(AssemblyHelpers::Address(GPRInfo::callFrameRegister, entry.offset()), registerToWrite);
+            } else
+#endif
+                registerToWrite = entry.reg().gpr();
+
+            storePtr(registerToWrite, Address(framePointerRegister, offsetVirtualRegister.offsetInBytes() + entry.offset()));
+        }
+    }
+    
+    void emitRestoreCalleeSavesFor(CodeBlock* codeBlock)
+    {
+        ASSERT(codeBlock);
+
+        RegisterAtOffsetList* calleeSaves = codeBlock->calleeSaveRegisters();
+        RegisterSet dontRestoreRegisters = RegisterSet(RegisterSet::stackRegisters(), RegisterSet::allFPRs());
+        unsigned registerCount = calleeSaves->size();
+        
+        for (unsigned i = 0; i < registerCount; i++) {
+            RegisterAtOffset entry = calleeSaves->at(i);
+            if (dontRestoreRegisters.get(entry.reg()))
+                continue;
+            loadPtr(Address(framePointerRegister, entry.offset()), entry.reg().gpr());
+        }
+    }
+
+    void emitSaveCalleeSaves()
+    {
+        emitSaveCalleeSavesFor(codeBlock());
+    }
+
+    void emitSaveThenMaterializeTagRegisters()
+    {
+#if USE(JSVALUE64)
+#if CPU(ARM64)
+        pushPair(GPRInfo::tagTypeNumberRegister, GPRInfo::tagMaskRegister);
+#else
+        push(GPRInfo::tagTypeNumberRegister);
+        push(GPRInfo::tagMaskRegister);
+#endif
+        emitMaterializeTagCheckRegisters();
+#endif
+    }
+    
+    void emitRestoreCalleeSaves()
+    {
+        emitRestoreCalleeSavesFor(codeBlock());
+    }
+
+    void emitRestoreSavedTagRegisters()
+    {
+#if USE(JSVALUE64)
+#if CPU(ARM64)
+        popPair(GPRInfo::tagTypeNumberRegister, GPRInfo::tagMaskRegister);
+#else
+        pop(GPRInfo::tagMaskRegister);
+        pop(GPRInfo::tagTypeNumberRegister);
+#endif
+#endif
+    }
+
+    void copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(const TempRegisterSet& usedRegisters = { RegisterSet::stubUnavailableRegisters() })
+    {
+#if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+        GPRReg temp1 = usedRegisters.getFreeGPR(0);
+
+        loadPtr(&m_vm->topVMEntryFrame, temp1);
+        addPtr(TrustedImm32(VMEntryFrame::calleeSaveRegistersBufferOffset()), temp1);
+
+        RegisterAtOffsetList* allCalleeSaves = m_vm->getAllCalleeSaveRegisterOffsets();
+        RegisterSet dontCopyRegisters = RegisterSet::stackRegisters();
+        unsigned registerCount = allCalleeSaves->size();
+        
+        for (unsigned i = 0; i < registerCount; i++) {
+            RegisterAtOffset entry = allCalleeSaves->at(i);
+            if (dontCopyRegisters.get(entry.reg()))
+                continue;
+            if (entry.reg().isGPR())
+                storePtr(entry.reg().gpr(), Address(temp1, entry.offset()));
+            else
+                storeDouble(entry.reg().fpr(), Address(temp1, entry.offset()));
+        }
+#else
+        UNUSED_PARAM(usedRegisters);
+#endif
+    }
+
+    void restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer();
+
+    void copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer(const TempRegisterSet& usedRegisters = { RegisterSet::stubUnavailableRegisters() })
+    {
+#if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
+        GPRReg temp1 = usedRegisters.getFreeGPR(0);
+        GPRReg temp2 = usedRegisters.getFreeGPR(1);
+        FPRReg fpTemp = usedRegisters.getFreeFPR();
+        ASSERT(temp2 != InvalidGPRReg);
+
+        ASSERT(codeBlock());
+
+        // Copy saved calleeSaves on stack or unsaved calleeSaves in register to vm calleeSave buffer
+        loadPtr(&m_vm->topVMEntryFrame, temp1);
+        addPtr(TrustedImm32(VMEntryFrame::calleeSaveRegistersBufferOffset()), temp1);
+
+        RegisterAtOffsetList* allCalleeSaves = m_vm->getAllCalleeSaveRegisterOffsets();
+        RegisterAtOffsetList* currentCalleeSaves = codeBlock()->calleeSaveRegisters();
+        RegisterSet dontCopyRegisters = RegisterSet::stackRegisters();
+        unsigned registerCount = allCalleeSaves->size();
+
+        for (unsigned i = 0; i < registerCount; i++) {
+            RegisterAtOffset vmEntry = allCalleeSaves->at(i);
+            if (dontCopyRegisters.get(vmEntry.reg()))
+                continue;
+            RegisterAtOffset* currentFrameEntry = currentCalleeSaves->find(vmEntry.reg());
+
+            if (vmEntry.reg().isGPR()) {
+                GPRReg regToStore;
+                if (currentFrameEntry) {
+                    // Load calleeSave from stack into temp register
+                    regToStore = temp2;
+                    loadPtr(Address(framePointerRegister, currentFrameEntry->offset()), regToStore);
+                } else
+                    // Just store callee save directly
+                    regToStore = vmEntry.reg().gpr();
+
+                storePtr(regToStore, Address(temp1, vmEntry.offset()));
+            } else {
+                FPRReg fpRegToStore;
+                if (currentFrameEntry) {
+                    // Load calleeSave from stack into temp register
+                    fpRegToStore = fpTemp;
+                    loadDouble(Address(framePointerRegister, currentFrameEntry->offset()), fpRegToStore);
+                } else
+                    // Just store callee save directly
+                    fpRegToStore = vmEntry.reg().fpr();
+
+                storeDouble(fpRegToStore, Address(temp1, vmEntry.offset()));
+            }
+        }
+#else
+        UNUSED_PARAM(usedRegisters);
+#endif
+    }
+
+    void emitMaterializeTagCheckRegisters()
+    {
+#if USE(JSVALUE64)
+        move(MacroAssembler::TrustedImm64(TagTypeNumber), GPRInfo::tagTypeNumberRegister);
+        orPtr(MacroAssembler::TrustedImm32(TagBitTypeOther), GPRInfo::tagTypeNumberRegister, GPRInfo::tagMaskRegister);
+#endif
+    }
+
+#if CPU(X86_64) || CPU(X86)
+    static size_t prologueStackPointerDelta()
+    {
+        // Prologue only saves the framePointerRegister
+        return sizeof(void*);
+    }
+
+    void emitFunctionPrologue()
+    {
+        push(framePointerRegister);
+        move(stackPointerRegister, framePointerRegister);
+    }
+
+    void emitFunctionEpilogueWithEmptyFrame()
+    {
+        pop(framePointerRegister);
+    }
+
+    void emitFunctionEpilogue()
+    {
+        move(framePointerRegister, stackPointerRegister);
+        pop(framePointerRegister);
+    }
+
+    void preserveReturnAddressAfterCall(GPRReg reg)
+    {
+        pop(reg);
+    }
+
+    void restoreReturnAddressBeforeReturn(GPRReg reg)
+    {
+        push(reg);
+    }
+
+    void restoreReturnAddressBeforeReturn(Address address)
+    {
+        push(address);
+    }
+#endif // CPU(X86_64) || CPU(X86)
+
+#if CPU(ARM) || CPU(ARM64)
+    static size_t prologueStackPointerDelta()
+    {
+        // Prologue saves the framePointerRegister and linkRegister
+        return 2 * sizeof(void*);
+    }
+
+    void emitFunctionPrologue()
+    {
+        pushPair(framePointerRegister, linkRegister);
+        move(stackPointerRegister, framePointerRegister);
+    }
+
+    void emitFunctionEpilogueWithEmptyFrame()
+    {
+        popPair(framePointerRegister, linkRegister);
+    }
+
+    void emitFunctionEpilogue()
+    {
+        move(framePointerRegister, stackPointerRegister);
+        emitFunctionEpilogueWithEmptyFrame();
+    }
+
+    ALWAYS_INLINE void preserveReturnAddressAfterCall(RegisterID reg)
+    {
+        move(linkRegister, reg);
+    }
+
+    ALWAYS_INLINE void restoreReturnAddressBeforeReturn(RegisterID reg)
+    {
+        move(reg, linkRegister);
+    }
+
+    ALWAYS_INLINE void restoreReturnAddressBeforeReturn(Address address)
+    {
+        loadPtr(address, linkRegister);
+    }
+#endif
+
+#if CPU(MIPS)
+    static size_t prologueStackPointerDelta()
+    {
+        // Prologue saves the framePointerRegister and returnAddressRegister
+        return 2 * sizeof(void*);
+    }
+
+    void emitFunctionPrologue()
+    {
+        pushPair(framePointerRegister, returnAddressRegister);
+        move(stackPointerRegister, framePointerRegister);
+    }
+
+    void emitFunctionEpilogueWithEmptyFrame()
+    {
+        popPair(framePointerRegister, returnAddressRegister);
+    }
+
+    void emitFunctionEpilogue()
+    {
+        move(framePointerRegister, stackPointerRegister);
+        emitFunctionEpilogueWithEmptyFrame();
+    }
+
+    ALWAYS_INLINE void preserveReturnAddressAfterCall(RegisterID reg)
+    {
+        move(returnAddressRegister, reg);
+    }
+
+    ALWAYS_INLINE void restoreReturnAddressBeforeReturn(RegisterID reg)
+    {
+        move(reg, returnAddressRegister);
+    }
+
+    ALWAYS_INLINE void restoreReturnAddressBeforeReturn(Address address)
+    {
+        loadPtr(address, returnAddressRegister);
+    }
+#endif
+
+#if CPU(SH4)
+    static size_t prologueStackPointerDelta()
+    {
+        // Prologue saves the framePointerRegister and link register
+        return 2 * sizeof(void*);
+    }
+
+    void emitFunctionPrologue()
+    {
+        push(linkRegister);
+        push(framePointerRegister);
+        move(stackPointerRegister, framePointerRegister);
+    }
+
+    void emitFunctionEpilogue()
+    {
+        move(framePointerRegister, stackPointerRegister);
+        pop(framePointerRegister);
+        pop(linkRegister);
+    }
+
+    ALWAYS_INLINE void preserveReturnAddressAfterCall(RegisterID reg)
+    {
+        m_assembler.stspr(reg);
+    }
+
+    ALWAYS_INLINE void restoreReturnAddressBeforeReturn(RegisterID reg)
+    {
+        m_assembler.ldspr(reg);
+    }
+
+    ALWAYS_INLINE void restoreReturnAddressBeforeReturn(Address address)
+    {
+        loadPtrLinkReg(address);
+    }
+#endif
+
+    void emitGetFromCallFrameHeaderPtr(int entry, GPRReg to, GPRReg from = GPRInfo::callFrameRegister)
+    {
+        loadPtr(Address(from, entry * sizeof(Register)), to);
+    }
+    void emitGetFromCallFrameHeader32(int entry, GPRReg to, GPRReg from = GPRInfo::callFrameRegister)
+    {
+        load32(Address(from, entry * sizeof(Register)), to);
+    }
+#if USE(JSVALUE64)
+    void emitGetFromCallFrameHeader64(int entry, GPRReg to, GPRReg from = GPRInfo::callFrameRegister)
+    {
+        load64(Address(from, entry * sizeof(Register)), to);
+    }
+#endif // USE(JSVALUE64)
+    void emitPutToCallFrameHeader(GPRReg from, int entry)
+    {
+        storePtr(from, Address(GPRInfo::callFrameRegister, entry * sizeof(Register)));
+    }
+
+    void emitPutToCallFrameHeader(void* value, int entry)
+    {
+        storePtr(TrustedImmPtr(value), Address(GPRInfo::callFrameRegister, entry * sizeof(Register)));
+    }
+
+    void emitGetCallerFrameFromCallFrameHeaderPtr(RegisterID to)
+    {
+        loadPtr(Address(GPRInfo::callFrameRegister, CallFrame::callerFrameOffset()), to);
+    }
+    void emitPutCallerFrameToCallFrameHeader(RegisterID from)
+    {
+        storePtr(from, Address(GPRInfo::callFrameRegister, CallFrame::callerFrameOffset()));
+    }
+
+    void emitPutReturnPCToCallFrameHeader(RegisterID from)
+    {
+        storePtr(from, Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()));
+    }
+    void emitPutReturnPCToCallFrameHeader(TrustedImmPtr from)
+    {
+        storePtr(from, Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()));
+    }
+
+    // emitPutToCallFrameHeaderBeforePrologue() and related are used to access callee frame header
+    // fields before the code from emitFunctionPrologue() has executed.
+    // First, the access is via the stack pointer. Second, the address calculation must also take
+    // into account that the stack pointer may not have been adjusted down for the return PC and/or
+    // caller's frame pointer. On some platforms, the callee is responsible for pushing the
+    // "link register" containing the return address in the function prologue.
+#if USE(JSVALUE64)
+    void emitPutToCallFrameHeaderBeforePrologue(GPRReg from, int entry)
+    {
+        storePtr(from, Address(stackPointerRegister, entry * static_cast<ptrdiff_t>(sizeof(Register)) - prologueStackPointerDelta()));
+    }
+#else
+    void emitPutPayloadToCallFrameHeaderBeforePrologue(GPRReg from, int entry)
+    {
+        storePtr(from, Address(stackPointerRegister, entry * static_cast<ptrdiff_t>(sizeof(Register)) - prologueStackPointerDelta() + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+    }
+
+    void emitPutTagToCallFrameHeaderBeforePrologue(TrustedImm32 tag, int entry)
+    {
+        storePtr(tag, Address(stackPointerRegister, entry * static_cast<ptrdiff_t>(sizeof(Register)) - prologueStackPointerDelta() + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    }
+#endif
+    
+    JumpList branchIfNotEqual(JSValueRegs regs, JSValue value)
+    {
+#if USE(JSVALUE64)
+        return branch64(NotEqual, regs.gpr(), TrustedImm64(JSValue::encode(value)));
+#else
+        JumpList result;
+        result.append(branch32(NotEqual, regs.tagGPR(), TrustedImm32(value.tag())));
+        if (value.isEmpty() || value.isUndefinedOrNull())
+            return result; // These don't have anything interesting in the payload.
+        result.append(branch32(NotEqual, regs.payloadGPR(), TrustedImm32(value.payload())));
+        return result;
+#endif
+    }
+    
+    Jump branchIfEqual(JSValueRegs regs, JSValue value)
+    {
+#if USE(JSVALUE64)
+        return branch64(Equal, regs.gpr(), TrustedImm64(JSValue::encode(value)));
+#else
+        Jump notEqual;
+        // These don't have anything interesting in the payload.
+        if (!value.isEmpty() && !value.isUndefinedOrNull())
+            notEqual = branch32(NotEqual, regs.payloadGPR(), TrustedImm32(value.payload()));
+        Jump result = branch32(Equal, regs.tagGPR(), TrustedImm32(value.tag()));
+        if (notEqual.isSet())
+            notEqual.link(this);
+        return result;
+#endif
+    }
+
+    Jump branchIfNotCell(GPRReg reg, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        if (mode == HaveTagRegisters)
+            return branchTest64(NonZero, reg, GPRInfo::tagMaskRegister);
+        return branchTest64(NonZero, reg, TrustedImm64(TagMask));
+#else
+        UNUSED_PARAM(mode);
+        return branch32(MacroAssembler::NotEqual, reg, TrustedImm32(JSValue::CellTag));
+#endif
+    }
+    Jump branchIfNotCell(JSValueRegs regs, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        return branchIfNotCell(regs.gpr(), mode);
+#else
+        return branchIfNotCell(regs.tagGPR(), mode);
+#endif
+    }
+    
+    Jump branchIfCell(GPRReg reg, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        if (mode == HaveTagRegisters)
+            return branchTest64(Zero, reg, GPRInfo::tagMaskRegister);
+        return branchTest64(Zero, reg, TrustedImm64(TagMask));
+#else
+        UNUSED_PARAM(mode);
+        return branch32(MacroAssembler::Equal, reg, TrustedImm32(JSValue::CellTag));
+#endif
+    }
+    Jump branchIfCell(JSValueRegs regs, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        return branchIfCell(regs.gpr(), mode);
+#else
+        return branchIfCell(regs.tagGPR(), mode);
+#endif
+    }
+    
+    Jump branchIfOther(JSValueRegs regs, GPRReg tempGPR)
+    {
+#if USE(JSVALUE64)
+        move(regs.gpr(), tempGPR);
+        and64(TrustedImm32(~TagBitUndefined), tempGPR);
+        return branch64(Equal, tempGPR, TrustedImm64(ValueNull));
+#else
+        or32(TrustedImm32(1), regs.tagGPR(), tempGPR);
+        return branch32(Equal, tempGPR, TrustedImm32(JSValue::NullTag));
+#endif
+    }
+    
+    Jump branchIfNotOther(JSValueRegs regs, GPRReg tempGPR)
+    {
+#if USE(JSVALUE64)
+        move(regs.gpr(), tempGPR);
+        and64(TrustedImm32(~TagBitUndefined), tempGPR);
+        return branch64(NotEqual, tempGPR, TrustedImm64(ValueNull));
+#else
+        or32(TrustedImm32(1), regs.tagGPR(), tempGPR);
+        return branch32(NotEqual, tempGPR, TrustedImm32(JSValue::NullTag));
+#endif
+    }
+    
+    Jump branchIfInt32(JSValueRegs regs, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        if (mode == HaveTagRegisters)
+            return branch64(AboveOrEqual, regs.gpr(), GPRInfo::tagTypeNumberRegister);
+        return branch64(AboveOrEqual, regs.gpr(), TrustedImm64(TagTypeNumber));
+#else
+        UNUSED_PARAM(mode);
+        return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::Int32Tag));
+#endif
+    }
+
+#if USE(JSVALUE64)
+    Jump branchIfNotInt32(GPRReg gpr, TagRegistersMode mode = HaveTagRegisters)
+    {
+        if (mode == HaveTagRegisters)
+            return branch64(Below, gpr, GPRInfo::tagTypeNumberRegister);
+        return branch64(Below, gpr, TrustedImm64(TagTypeNumber));
+    }
+#endif
+
+    Jump branchIfNotInt32(JSValueRegs regs, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        return branchIfNotInt32(regs.gpr(), mode);
+#else
+        UNUSED_PARAM(mode);
+        return branch32(NotEqual, regs.tagGPR(), TrustedImm32(JSValue::Int32Tag));
+#endif
+    }
+
+    // Note that the tempGPR is not used in 64-bit mode.
+    Jump branchIfNumber(JSValueRegs regs, GPRReg tempGPR, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        UNUSED_PARAM(tempGPR);
+        return branchIfNumber(regs.gpr(), mode);
+#else
+        UNUSED_PARAM(mode);
+        add32(TrustedImm32(1), regs.tagGPR(), tempGPR);
+        return branch32(Below, tempGPR, TrustedImm32(JSValue::LowestTag + 1));
+#endif
+    }
+
+#if USE(JSVALUE64)
+    Jump branchIfNumber(GPRReg reg, TagRegistersMode mode = HaveTagRegisters)
+    {
+        if (mode == HaveTagRegisters)
+            return branchTest64(NonZero, reg, GPRInfo::tagTypeNumberRegister);
+        return branchTest64(NonZero, reg, TrustedImm64(TagTypeNumber));
+    }
+#endif
+    
+    // Note that the tempGPR is not used in 64-bit mode.
+    Jump branchIfNotNumber(JSValueRegs regs, GPRReg tempGPR, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        UNUSED_PARAM(tempGPR);
+        return branchIfNotNumber(regs.gpr(), mode);
+#else
+        UNUSED_PARAM(mode);
+        add32(TrustedImm32(1), regs.tagGPR(), tempGPR);
+        return branch32(AboveOrEqual, tempGPR, TrustedImm32(JSValue::LowestTag + 1));
+#endif
+    }
+
+#if USE(JSVALUE64)
+    Jump branchIfNotNumber(GPRReg reg, TagRegistersMode mode = HaveTagRegisters)
+    {
+        if (mode == HaveTagRegisters)
+            return branchTest64(Zero, reg, GPRInfo::tagTypeNumberRegister);
+        return branchTest64(Zero, reg, TrustedImm64(TagTypeNumber));
+    }
+#endif
+
+    Jump branchIfNotDoubleKnownNotInt32(JSValueRegs regs, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        if (mode == HaveTagRegisters)
+            return branchTest64(Zero, regs.gpr(), GPRInfo::tagTypeNumberRegister);
+        return branchTest64(Zero, regs.gpr(), TrustedImm64(TagTypeNumber));
+#else
+        UNUSED_PARAM(mode);
+        return branch32(AboveOrEqual, regs.tagGPR(), TrustedImm32(JSValue::LowestTag));
+#endif
+    }
+
+    // Note that the tempGPR is not used in 32-bit mode.
+    Jump branchIfBoolean(JSValueRegs regs, GPRReg tempGPR)
+    {
+#if USE(JSVALUE64)
+        move(regs.gpr(), tempGPR);
+        xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), tempGPR);
+        return branchTest64(Zero, tempGPR, TrustedImm32(static_cast<int32_t>(~1)));
+#else
+        UNUSED_PARAM(tempGPR);
+        return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::BooleanTag));
+#endif
+    }
+    
+    // Note that the tempGPR is not used in 32-bit mode.
+    Jump branchIfNotBoolean(JSValueRegs regs, GPRReg tempGPR)
+    {
+#if USE(JSVALUE64)
+        move(regs.gpr(), tempGPR);
+        xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), tempGPR);
+        return branchTest64(NonZero, tempGPR, TrustedImm32(static_cast<int32_t>(~1)));
+#else
+        UNUSED_PARAM(tempGPR);
+        return branch32(NotEqual, regs.tagGPR(), TrustedImm32(JSValue::BooleanTag));
+#endif
+    }
+    
+    Jump branchIfObject(GPRReg cellGPR)
+    {
+        return branch8(
+            AboveOrEqual, Address(cellGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+    }
+    
+    Jump branchIfNotObject(GPRReg cellGPR)
+    {
+        return branch8(
+            Below, Address(cellGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+    }
+    
+    Jump branchIfType(GPRReg cellGPR, JSType type)
+    {
+        return branch8(Equal, Address(cellGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(type));
+    }
+    
+    Jump branchIfNotType(GPRReg cellGPR, JSType type)
+    {
+        return branch8(NotEqual, Address(cellGPR, JSCell::typeInfoTypeOffset()), TrustedImm32(type));
+    }
+    
+    Jump branchIfString(GPRReg cellGPR) { return branchIfType(cellGPR, StringType); }
+    Jump branchIfNotString(GPRReg cellGPR) { return branchIfNotType(cellGPR, StringType); }
+    Jump branchIfSymbol(GPRReg cellGPR) { return branchIfType(cellGPR, SymbolType); }
+    Jump branchIfNotSymbol(GPRReg cellGPR) { return branchIfNotType(cellGPR, SymbolType); }
+    Jump branchIfFunction(GPRReg cellGPR) { return branchIfType(cellGPR, JSFunctionType); }
+    Jump branchIfNotFunction(GPRReg cellGPR) { return branchIfNotType(cellGPR, JSFunctionType); }
+    
+    Jump branchIfEmpty(JSValueRegs regs)
+    {
+#if USE(JSVALUE64)
+        return branchTest64(Zero, regs.gpr());
+#else
+        return branch32(Equal, regs.tagGPR(), TrustedImm32(JSValue::EmptyValueTag));
+#endif
+    }
+
+    JumpList branchIfNotType(
+        JSValueRegs, GPRReg tempGPR, const InferredType::Descriptor&,
+        TagRegistersMode = HaveTagRegisters);
+
+    template<typename T>
+    Jump branchStructure(RelationalCondition condition, T leftHandSide, Structure* structure)
+    {
+#if USE(JSVALUE64)
+        return branch32(condition, leftHandSide, TrustedImm32(structure->id()));
+#else
+        return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
+#endif
+    }
+
+    Jump branchIfFastTypedArray(GPRReg baseGPR);
+    Jump branchIfNotFastTypedArray(GPRReg baseGPR);
+
+    static Address addressForByteOffset(ptrdiff_t byteOffset)
+    {
+        return Address(GPRInfo::callFrameRegister, byteOffset);
+    }
+    static Address addressFor(VirtualRegister virtualRegister, GPRReg baseReg)
+    {
+        ASSERT(virtualRegister.isValid());
+        return Address(baseReg, virtualRegister.offset() * sizeof(Register));
+    }
+    static Address addressFor(VirtualRegister virtualRegister)
+    {
+        // NB. It's tempting on some architectures to sometimes use an offset from the stack
+        // register because for some offsets that will encode to a smaller instruction. But we
+        // cannot do this. We use this in places where the stack pointer has been moved to some
+        // unpredictable location.
+        ASSERT(virtualRegister.isValid());
+        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register));
+    }
+    static Address addressFor(int operand)
+    {
+        return addressFor(static_cast<VirtualRegister>(operand));
+    }
+
+    static Address tagFor(VirtualRegister virtualRegister)
+    {
+        ASSERT(virtualRegister.isValid());
+        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + TagOffset);
+    }
+    static Address tagFor(int operand)
+    {
+        return tagFor(static_cast<VirtualRegister>(operand));
+    }
+
+    static Address payloadFor(VirtualRegister virtualRegister)
+    {
+        ASSERT(virtualRegister.isValid());
+        return Address(GPRInfo::callFrameRegister, virtualRegister.offset() * sizeof(Register) + PayloadOffset);
+    }
+    static Address payloadFor(int operand)
+    {
+        return payloadFor(static_cast<VirtualRegister>(operand));
+    }
+
+    // Access to our fixed callee CallFrame.
+    static Address calleeFrameSlot(int slot)
+    {
+        ASSERT(slot >= CallerFrameAndPC::sizeInRegisters);
+        return Address(stackPointerRegister, sizeof(Register) * (slot - CallerFrameAndPC::sizeInRegisters));
+    }
+
+    // Access to our fixed callee CallFrame.
+    static Address calleeArgumentSlot(int argument)
+    {
+        return calleeFrameSlot(virtualRegisterForArgument(argument).offset());
+    }
+
+    static Address calleeFrameTagSlot(int slot)
+    {
+        return calleeFrameSlot(slot).withOffset(TagOffset);
+    }
+
+    static Address calleeFramePayloadSlot(int slot)
+    {
+        return calleeFrameSlot(slot).withOffset(PayloadOffset);
+    }
+
+    static Address calleeArgumentTagSlot(int argument)
+    {
+        return calleeArgumentSlot(argument).withOffset(TagOffset);
+    }
+
+    static Address calleeArgumentPayloadSlot(int argument)
+    {
+        return calleeArgumentSlot(argument).withOffset(PayloadOffset);
+    }
+
+    static Address calleeFrameCallerFrame()
+    {
+        return calleeFrameSlot(0).withOffset(CallFrame::callerFrameOffset());
+    }
+
+    static GPRReg selectScratchGPR(GPRReg preserve1 = InvalidGPRReg, GPRReg preserve2 = InvalidGPRReg, GPRReg preserve3 = InvalidGPRReg, GPRReg preserve4 = InvalidGPRReg, GPRReg preserve5 = InvalidGPRReg)
+    {
+        if (preserve1 != GPRInfo::regT0 && preserve2 != GPRInfo::regT0 && preserve3 != GPRInfo::regT0 && preserve4 != GPRInfo::regT0 && preserve5 != GPRInfo::regT0)
+            return GPRInfo::regT0;
+
+        if (preserve1 != GPRInfo::regT1 && preserve2 != GPRInfo::regT1 && preserve3 != GPRInfo::regT1 && preserve4 != GPRInfo::regT1 && preserve5 != GPRInfo::regT1)
+            return GPRInfo::regT1;
+
+        if (preserve1 != GPRInfo::regT2 && preserve2 != GPRInfo::regT2 && preserve3 != GPRInfo::regT2 && preserve4 != GPRInfo::regT2 && preserve5 != GPRInfo::regT2)
+            return GPRInfo::regT2;
+
+        if (preserve1 != GPRInfo::regT3 && preserve2 != GPRInfo::regT3 && preserve3 != GPRInfo::regT3 && preserve4 != GPRInfo::regT3 && preserve5 != GPRInfo::regT3)
+            return GPRInfo::regT3;
+
+        if (preserve1 != GPRInfo::regT4 && preserve2 != GPRInfo::regT4 && preserve3 != GPRInfo::regT4 && preserve4 != GPRInfo::regT4 && preserve5 != GPRInfo::regT4)
+            return GPRInfo::regT4;
+
+        return GPRInfo::regT5;
+    }
+
+    // Add a debug call. This call has no effect on JIT code execution state.
+    void debugCall(V_DebugOperation_EPP function, void* argument)
+    {
+        size_t scratchSize = sizeof(EncodedJSValue) * (GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters);
+        ScratchBuffer* scratchBuffer = m_vm->scratchBufferForSize(scratchSize);
+        EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
+
+        for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
+#if USE(JSVALUE64)
+            store64(GPRInfo::toRegister(i), buffer + i);
+#else
+            store32(GPRInfo::toRegister(i), buffer + i);
+#endif
+        }
+
+        for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
+            move(TrustedImmPtr(buffer + GPRInfo::numberOfRegisters + i), GPRInfo::regT0);
+            storeDouble(FPRInfo::toRegister(i), GPRInfo::regT0);
+        }
+
+        // Tell GC mark phase how much of the scratch buffer is active during call.
+        move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT0);
+        storePtr(TrustedImmPtr(scratchSize), GPRInfo::regT0);
+
+#if CPU(X86_64) || CPU(ARM) || CPU(ARM64) || CPU(MIPS) || CPU(SH4)
+        move(TrustedImmPtr(buffer), GPRInfo::argumentGPR2);
+        move(TrustedImmPtr(argument), GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+        GPRReg scratch = selectScratchGPR(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, GPRInfo::argumentGPR2);
+#elif CPU(X86)
+        poke(GPRInfo::callFrameRegister, 0);
+        poke(TrustedImmPtr(argument), 1);
+        poke(TrustedImmPtr(buffer), 2);
+        GPRReg scratch = GPRInfo::regT0;
+#else
+#error "JIT not supported on this platform."
+#endif
+        move(TrustedImmPtr(reinterpret_cast<void*>(function)), scratch);
+        call(scratch);
+
+        move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT0);
+        storePtr(TrustedImmPtr(0), GPRInfo::regT0);
+
+        for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
+            move(TrustedImmPtr(buffer + GPRInfo::numberOfRegisters + i), GPRInfo::regT0);
+            loadDouble(GPRInfo::regT0, FPRInfo::toRegister(i));
+        }
+        for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
+#if USE(JSVALUE64)
+            load64(buffer + i, GPRInfo::toRegister(i));
+#else
+            load32(buffer + i, GPRInfo::toRegister(i));
+#endif
+        }
+    }
+
+    // These methods JIT generate dynamic, debug-only checks - akin to ASSERTs.
+#if !ASSERT_DISABLED
+    void jitAssertIsInt32(GPRReg);
+    void jitAssertIsJSInt32(GPRReg);
+    void jitAssertIsJSNumber(GPRReg);
+    void jitAssertIsJSDouble(GPRReg);
+    void jitAssertIsCell(GPRReg);
+    void jitAssertHasValidCallFrame();
+    void jitAssertIsNull(GPRReg);
+    void jitAssertTagsInPlace();
+    void jitAssertArgumentCountSane();
+#else
+    void jitAssertIsInt32(GPRReg) { }
+    void jitAssertIsJSInt32(GPRReg) { }
+    void jitAssertIsJSNumber(GPRReg) { }
+    void jitAssertIsJSDouble(GPRReg) { }
+    void jitAssertIsCell(GPRReg) { }
+    void jitAssertHasValidCallFrame() { }
+    void jitAssertIsNull(GPRReg) { }
+    void jitAssertTagsInPlace() { }
+    void jitAssertArgumentCountSane() { }
+#endif
+
+    void jitReleaseAssertNoException();
+
+    void incrementSuperSamplerCount();
+    void decrementSuperSamplerCount();
+    
+    void purifyNaN(FPRReg);
+
+    // These methods convert between doubles, and doubles boxed and JSValues.
+#if USE(JSVALUE64)
+    GPRReg boxDouble(FPRReg fpr, GPRReg gpr)
+    {
+        moveDoubleTo64(fpr, gpr);
+        sub64(GPRInfo::tagTypeNumberRegister, gpr);
+        jitAssertIsJSDouble(gpr);
+        return gpr;
+    }
+    FPRReg unboxDoubleWithoutAssertions(GPRReg gpr, GPRReg resultGPR, FPRReg fpr)
+    {
+        add64(GPRInfo::tagTypeNumberRegister, gpr, resultGPR);
+        move64ToDouble(resultGPR, fpr);
+        return fpr;
+    }
+    FPRReg unboxDouble(GPRReg gpr, GPRReg resultGPR, FPRReg fpr)
+    {
+        jitAssertIsJSDouble(gpr);
+        return unboxDoubleWithoutAssertions(gpr, resultGPR, fpr);
+    }
+    
+    void boxDouble(FPRReg fpr, JSValueRegs regs)
+    {
+        boxDouble(fpr, regs.gpr());
+    }
+
+    void unboxDoubleNonDestructive(JSValueRegs regs, FPRReg destFPR, GPRReg resultGPR, FPRReg)
+    {
+        unboxDouble(regs.payloadGPR(), resultGPR, destFPR);
+    }
+
+    // Here are possible arrangements of source, target, scratch:
+    // - source, target, scratch can all be separate registers.
+    // - source and target can be the same but scratch is separate.
+    // - target and scratch can be the same but source is separate.
+    void boxInt52(GPRReg source, GPRReg target, GPRReg scratch, FPRReg fpScratch)
+    {
+        // Is it an int32?
+        signExtend32ToPtr(source, scratch);
+        Jump isInt32 = branch64(Equal, source, scratch);
+        
+        // Nope, it's not, but regT0 contains the int64 value.
+        convertInt64ToDouble(source, fpScratch);
+        boxDouble(fpScratch, target);
+        Jump done = jump();
+        
+        isInt32.link(this);
+        zeroExtend32ToPtr(source, target);
+        or64(GPRInfo::tagTypeNumberRegister, target);
+        
+        done.link(this);
+    }
+#endif
+
+#if USE(JSVALUE32_64)
+    void boxDouble(FPRReg fpr, GPRReg tagGPR, GPRReg payloadGPR)
+    {
+        moveDoubleToInts(fpr, payloadGPR, tagGPR);
+    }
+    void unboxDouble(GPRReg tagGPR, GPRReg payloadGPR, FPRReg fpr, FPRReg scratchFPR)
+    {
+        moveIntsToDouble(payloadGPR, tagGPR, fpr, scratchFPR);
+    }
+    
+    void boxDouble(FPRReg fpr, JSValueRegs regs)
+    {
+        boxDouble(fpr, regs.tagGPR(), regs.payloadGPR());
+    }
+    void unboxDouble(JSValueRegs regs, FPRReg fpr, FPRReg scratchFPR)
+    {
+        unboxDouble(regs.tagGPR(), regs.payloadGPR(), fpr, scratchFPR);
+    }
+
+    void unboxDoubleNonDestructive(const JSValueRegs regs, FPRReg destFPR, GPRReg, FPRReg scratchFPR)
+    {
+        unboxDouble(regs, destFPR, scratchFPR);
+    }
+#endif
+    
+    void boxBooleanPayload(GPRReg boolGPR, GPRReg payloadGPR)
+    {
+#if USE(JSVALUE64)
+        add32(TrustedImm32(ValueFalse), boolGPR, payloadGPR);
+#else
+        move(boolGPR, payloadGPR);
+#endif
+    }
+
+    void boxBooleanPayload(bool value, GPRReg payloadGPR)
+    {
+#if USE(JSVALUE64)
+        move(TrustedImm32(ValueFalse + value), payloadGPR);
+#else
+        move(TrustedImm32(value), payloadGPR);
+#endif
+    }
+
+    void boxBoolean(GPRReg boolGPR, JSValueRegs boxedRegs)
+    {
+        boxBooleanPayload(boolGPR, boxedRegs.payloadGPR());
+#if USE(JSVALUE32_64)
+        move(TrustedImm32(JSValue::BooleanTag), boxedRegs.tagGPR());
+#endif
+    }
+
+    void boxInt32(GPRReg intGPR, JSValueRegs boxedRegs, TagRegistersMode mode = HaveTagRegisters)
+    {
+#if USE(JSVALUE64)
+        if (mode == DoNotHaveTagRegisters) {
+            move(intGPR, boxedRegs.gpr());
+            or64(TrustedImm64(TagTypeNumber), boxedRegs.gpr());
+        } else
+            or64(GPRInfo::tagTypeNumberRegister, intGPR, boxedRegs.gpr());
+#else
+        UNUSED_PARAM(mode);
+        move(intGPR, boxedRegs.payloadGPR());
+        move(TrustedImm32(JSValue::Int32Tag), boxedRegs.tagGPR());
+#endif
+    }
+
+    void boxCell(GPRReg cellGPR, JSValueRegs boxedRegs)
+    {
+#if USE(JSVALUE64)
+        move(cellGPR, boxedRegs.gpr());
+#else
+        move(cellGPR, boxedRegs.payloadGPR());
+        move(TrustedImm32(JSValue::CellTag), boxedRegs.tagGPR());
+#endif
+    }
+    
+    void callExceptionFuzz();
+    
+    enum ExceptionCheckKind { NormalExceptionCheck, InvertedExceptionCheck };
+    enum ExceptionJumpWidth { NormalJumpWidth, FarJumpWidth };
+    JS_EXPORT_PRIVATE Jump emitExceptionCheck(
+        ExceptionCheckKind = NormalExceptionCheck, ExceptionJumpWidth = NormalJumpWidth);
+    JS_EXPORT_PRIVATE Jump emitNonPatchableExceptionCheck();
+
+#if ENABLE(SAMPLING_COUNTERS)
+    static void emitCount(MacroAssembler& jit, AbstractSamplingCounter& counter, int32_t increment = 1)
+    {
+        jit.add64(TrustedImm32(increment), AbsoluteAddress(counter.addressOfCounter()));
+    }
+    void emitCount(AbstractSamplingCounter& counter, int32_t increment = 1)
+    {
+        add64(TrustedImm32(increment), AbsoluteAddress(counter.addressOfCounter()));
+    }
+#endif
+
+#if ENABLE(SAMPLING_FLAGS)
+    void setSamplingFlag(int32_t);
+    void clearSamplingFlag(int32_t flag);
+#endif
+
+    JSGlobalObject* globalObjectFor(CodeOrigin codeOrigin)
+    {
+        return codeBlock()->globalObjectFor(codeOrigin);
+    }
+    
+    bool isStrictModeFor(CodeOrigin codeOrigin)
+    {
+        if (!codeOrigin.inlineCallFrame)
+            return codeBlock()->isStrictMode();
+        return codeOrigin.inlineCallFrame->isStrictMode();
+    }
+    
+    ECMAMode ecmaModeFor(CodeOrigin codeOrigin)
+    {
+        return isStrictModeFor(codeOrigin) ? StrictMode : NotStrictMode;
+    }
+    
+    ExecutableBase* executableFor(const CodeOrigin& codeOrigin);
+    
+    CodeBlock* baselineCodeBlockFor(const CodeOrigin& codeOrigin)
+    {
+        return baselineCodeBlockForOriginAndBaselineCodeBlock(codeOrigin, baselineCodeBlock());
+    }
+    
+    CodeBlock* baselineCodeBlockFor(InlineCallFrame* inlineCallFrame)
+    {
+        if (!inlineCallFrame)
+            return baselineCodeBlock();
+        return baselineCodeBlockForInlineCallFrame(inlineCallFrame);
+    }
+    
+    CodeBlock* baselineCodeBlock()
+    {
+        return m_baselineCodeBlock;
+    }
+    
+    static VirtualRegister argumentsStart(InlineCallFrame* inlineCallFrame)
+    {
+        if (!inlineCallFrame)
+            return VirtualRegister(CallFrame::argumentOffset(0));
+        if (inlineCallFrame->arguments.size() <= 1)
+            return virtualRegisterForLocal(0);
+        ValueRecovery recovery = inlineCallFrame->arguments[1];
+        RELEASE_ASSERT(recovery.technique() == DisplacedInJSStack);
+        return recovery.virtualRegister();
+    }
+    
+    static VirtualRegister argumentsStart(const CodeOrigin& codeOrigin)
+    {
+        return argumentsStart(codeOrigin.inlineCallFrame);
+    }
+
+    static VirtualRegister argumentCount(InlineCallFrame* inlineCallFrame)
+    {
+        ASSERT(!inlineCallFrame || inlineCallFrame->isVarargs());
+        if (!inlineCallFrame)
+            return VirtualRegister(CallFrameSlot::argumentCount);
+        return inlineCallFrame->argumentCountRegister;
+    }
+
+    static VirtualRegister argumentCount(const CodeOrigin& codeOrigin)
+    {
+        return argumentCount(codeOrigin.inlineCallFrame);
+    }
+    
+    void emitLoadStructure(RegisterID source, RegisterID dest, RegisterID scratch);
+
+    void emitStoreStructureWithTypeInfo(TrustedImmPtr structure, RegisterID dest, RegisterID)
+    {
+        emitStoreStructureWithTypeInfo(*this, structure, dest);
+    }
+
+    void emitStoreStructureWithTypeInfo(RegisterID structure, RegisterID dest, RegisterID scratch)
+    {
+#if USE(JSVALUE64)
+        load64(MacroAssembler::Address(structure, Structure::structureIDOffset()), scratch);
+        store64(scratch, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
+#else
+        // Store all the info flags using a single 32-bit wide load and store.
+        load32(MacroAssembler::Address(structure, Structure::indexingTypeIncludingHistoryOffset()), scratch);
+        store32(scratch, MacroAssembler::Address(dest, JSCell::indexingTypeAndMiscOffset()));
+
+        // Store the StructureID
+        storePtr(structure, MacroAssembler::Address(dest, JSCell::structureIDOffset()));
+#endif
+    }
+
+    static void emitStoreStructureWithTypeInfo(AssemblyHelpers& jit, TrustedImmPtr structure, RegisterID dest);
+
+    Jump barrierBranchWithoutFence(GPRReg cell)
+    {
+        return branch8(Above, Address(cell, JSCell::cellStateOffset()), TrustedImm32(blackThreshold));
+    }
+
+    Jump barrierBranchWithoutFence(JSCell* cell)
+    {
+        uint8_t* address = reinterpret_cast<uint8_t*>(cell) + JSCell::cellStateOffset();
+        return branch8(Above, AbsoluteAddress(address), TrustedImm32(blackThreshold));
+    }
+    
+    Jump barrierBranch(GPRReg cell, GPRReg scratchGPR)
+    {
+        load8(Address(cell, JSCell::cellStateOffset()), scratchGPR);
+        return branch32(Above, scratchGPR, AbsoluteAddress(vm()->heap.addressOfBarrierThreshold()));
+    }
+
+    Jump barrierBranch(JSCell* cell, GPRReg scratchGPR)
+    {
+        uint8_t* address = reinterpret_cast<uint8_t*>(cell) + JSCell::cellStateOffset();
+        load8(address, scratchGPR);
+        return branch32(Above, scratchGPR, AbsoluteAddress(vm()->heap.addressOfBarrierThreshold()));
+    }
+    
+    void barrierStoreLoadFence()
+    {
+        if (!Options::useConcurrentBarriers())
+            return;
+        Jump ok = jumpIfMutatorFenceNotNeeded();
+        memoryFence();
+        ok.link(this);
+    }
+    
+    void mutatorFence()
+    {
+        if (isX86())
+            return;
+        Jump ok = jumpIfMutatorFenceNotNeeded();
+        storeFence();
+        ok.link(this);
+    }
+    
+    void storeButterfly(GPRReg butterfly, GPRReg object)
+    {
+        if (isX86()) {
+            storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
+            return;
+        }
+        
+        Jump ok = jumpIfMutatorFenceNotNeeded();
+        storeFence();
+        storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
+        storeFence();
+        Jump done = jump();
+        ok.link(this);
+        storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
+        done.link(this);
+    }
+    
+    void nukeStructureAndStoreButterfly(GPRReg butterfly, GPRReg object)
+    {
+        if (isX86()) {
+            or32(TrustedImm32(bitwise_cast<int32_t>(nukedStructureIDBit())), Address(object, JSCell::structureIDOffset()));
+            storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
+            return;
+        }
+        
+        Jump ok = jumpIfMutatorFenceNotNeeded();
+        or32(TrustedImm32(bitwise_cast<int32_t>(nukedStructureIDBit())), Address(object, JSCell::structureIDOffset()));
+        storeFence();
+        storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
+        storeFence();
+        Jump done = jump();
+        ok.link(this);
+        storePtr(butterfly, Address(object, JSObject::butterflyOffset()));
+        done.link(this);
+    }
+    
+    Jump jumpIfMutatorFenceNotNeeded()
+    {
+        return branchTest8(Zero, AbsoluteAddress(vm()->heap.addressOfMutatorShouldBeFenced()));
+    }
+    
+    // Emits the branch structure for typeof. The code emitted by this doesn't fall through. The
+    // functor is called at those points where we have pinpointed a type. One way to use this is to
+    // have the functor emit the code to put the type string into an appropriate register and then
+    // jump out. A secondary functor is used for the call trap and masquerades-as-undefined slow
+    // case. It is passed the unlinked jump to the slow case.
+    template<typename Functor, typename SlowPathFunctor>
+    void emitTypeOf(
+        JSValueRegs regs, GPRReg tempGPR, const Functor& functor,
+        const SlowPathFunctor& slowPathFunctor)
+    {
+        // Implements the following branching structure:
+        //
+        // if (is cell) {
+        //     if (is object) {
+        //         if (is function) {
+        //             return function;
+        //         } else if (doesn't have call trap and doesn't masquerade as undefined) {
+        //             return object
+        //         } else {
+        //             return slowPath();
+        //         }
+        //     } else if (is string) {
+        //         return string
+        //     } else {
+        //         return symbol
+        //     }
+        // } else if (is number) {
+        //     return number
+        // } else if (is null) {
+        //     return object
+        // } else if (is boolean) {
+        //     return boolean
+        // } else {
+        //     return undefined
+        // }
+        
+        Jump notCell = branchIfNotCell(regs);
+        
+        GPRReg cellGPR = regs.payloadGPR();
+        Jump notObject = branchIfNotObject(cellGPR);
+        
+        Jump notFunction = branchIfNotFunction(cellGPR);
+        functor(TypeofType::Function, false);
+        
+        notFunction.link(this);
+        slowPathFunctor(
+            branchTest8(
+                NonZero,
+                Address(cellGPR, JSCell::typeInfoFlagsOffset()),
+                TrustedImm32(MasqueradesAsUndefined | TypeOfShouldCallGetCallData)));
+        functor(TypeofType::Object, false);
+        
+        notObject.link(this);
+        
+        Jump notString = branchIfNotString(cellGPR);
+        functor(TypeofType::String, false);
+        notString.link(this);
+        functor(TypeofType::Symbol, false);
+        
+        notCell.link(this);
+
+        Jump notNumber = branchIfNotNumber(regs, tempGPR);
+        functor(TypeofType::Number, false);
+        notNumber.link(this);
+        
+        JumpList notNull = branchIfNotEqual(regs, jsNull());
+        functor(TypeofType::Object, false);
+        notNull.link(this);
+        
+        Jump notBoolean = branchIfNotBoolean(regs, tempGPR);
+        functor(TypeofType::Boolean, false);
+        notBoolean.link(this);
+        
+        functor(TypeofType::Undefined, true);
+    }
+    
+    void emitDumbVirtualCall(CallLinkInfo*);
+    
+    Vector<BytecodeAndMachineOffset>& decodedCodeMapFor(CodeBlock*);
+
+    void makeSpaceOnStackForCCall();
+    void reclaimSpaceOnStackForCCall();
+
+#if USE(JSVALUE64)
+    void emitRandomThunk(JSGlobalObject*, GPRReg scratch0, GPRReg scratch1, GPRReg scratch2, FPRReg result);
+    void emitRandomThunk(GPRReg scratch0, GPRReg scratch1, GPRReg scratch2, GPRReg scratch3, FPRReg result);
+#endif
+
+    // Call this if you know that the value held in allocatorGPR is non-null. This DOES NOT mean
+    // that allocator is non-null; allocator can be null as a signal that we don't know what the
+    // value of allocatorGPR is.
+    void emitAllocateWithNonNullAllocator(GPRReg resultGPR, MarkedAllocator* allocator, GPRReg allocatorGPR, GPRReg scratchGPR, JumpList& slowPath)
+    {
+        // NOTE: This is carefully written so that we can call it while we disallow scratch
+        // register usage.
+        
+        if (Options::forceGCSlowPaths()) {
+            slowPath.append(jump());
+            return;
+        }
+        
+        Jump popPath;
+        Jump done;
+        
+        load32(Address(allocatorGPR, MarkedAllocator::offsetOfFreeList() + OBJECT_OFFSETOF(FreeList, remaining)), resultGPR);
+        popPath = branchTest32(Zero, resultGPR);
+        if (allocator)
+            add32(TrustedImm32(-allocator->cellSize()), resultGPR, scratchGPR);
+        else {
+            if (isX86()) {
+                move(resultGPR, scratchGPR);
+                sub32(Address(allocatorGPR, MarkedAllocator::offsetOfCellSize()), scratchGPR);
+            } else {
+                load32(Address(allocatorGPR, MarkedAllocator::offsetOfCellSize()), scratchGPR);
+                sub32(resultGPR, scratchGPR, scratchGPR);
+            }
+        }
+        negPtr(resultGPR);
+        store32(scratchGPR, Address(allocatorGPR, MarkedAllocator::offsetOfFreeList() + OBJECT_OFFSETOF(FreeList, remaining)));
+        Address payloadEndAddr = Address(allocatorGPR, MarkedAllocator::offsetOfFreeList() + OBJECT_OFFSETOF(FreeList, payloadEnd));
+        if (isX86())
+            addPtr(payloadEndAddr, resultGPR);
+        else {
+            loadPtr(payloadEndAddr, scratchGPR);
+            addPtr(scratchGPR, resultGPR);
+        }
+        
+        done = jump();
+        
+        popPath.link(this);
+        
+        loadPtr(Address(allocatorGPR, MarkedAllocator::offsetOfFreeList() + OBJECT_OFFSETOF(FreeList, head)), resultGPR);
+        slowPath.append(branchTestPtr(Zero, resultGPR));
+        
+        // The object is half-allocated: we have what we know is a fresh object, but
+        // it's still on the GC's free list.
+        loadPtr(Address(resultGPR), scratchGPR);
+        storePtr(scratchGPR, Address(allocatorGPR, MarkedAllocator::offsetOfFreeList() + OBJECT_OFFSETOF(FreeList, head)));
+        
+        done.link(this);
+    }
+    
+    void emitAllocate(GPRReg resultGPR, MarkedAllocator* allocator, GPRReg allocatorGPR, GPRReg scratchGPR, JumpList& slowPath)
+    {
+        if (!allocator)
+            slowPath.append(branchTestPtr(Zero, allocatorGPR));
+        emitAllocateWithNonNullAllocator(resultGPR, allocator, allocatorGPR, scratchGPR, slowPath);
+    }
+    
+    template<typename StructureType>
+    void emitAllocateJSCell(GPRReg resultGPR, MarkedAllocator* allocator, GPRReg allocatorGPR, StructureType structure, GPRReg scratchGPR, JumpList& slowPath)
+    {
+        emitAllocate(resultGPR, allocator, allocatorGPR, scratchGPR, slowPath);
+        emitStoreStructureWithTypeInfo(structure, resultGPR, scratchGPR);
+    }
+    
+    template<typename StructureType, typename StorageType>
+    void emitAllocateJSObject(GPRReg resultGPR, MarkedAllocator* allocator, GPRReg allocatorGPR, StructureType structure, StorageType storage, GPRReg scratchGPR, JumpList& slowPath)
+    {
+        emitAllocateJSCell(resultGPR, allocator, allocatorGPR, structure, scratchGPR, slowPath);
+        storePtr(storage, Address(resultGPR, JSObject::butterflyOffset()));
+    }
+    
+    template<typename ClassType, typename StructureType, typename StorageType>
+    void emitAllocateJSObjectWithKnownSize(
+        GPRReg resultGPR, StructureType structure, StorageType storage, GPRReg scratchGPR1,
+        GPRReg scratchGPR2, JumpList& slowPath, size_t size)
+    {
+        MarkedAllocator* allocator = subspaceFor<ClassType>(*vm())->allocatorFor(size);
+        if (!allocator) {
+            slowPath.append(jump());
+            return;
+        }
+        move(TrustedImmPtr(allocator), scratchGPR1);
+        emitAllocateJSObject(resultGPR, allocator, scratchGPR1, structure, storage, scratchGPR2, slowPath);
+    }
+    
+    template<typename ClassType, typename StructureType, typename StorageType>
+    void emitAllocateJSObject(GPRReg resultGPR, StructureType structure, StorageType storage, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
+    {
+        emitAllocateJSObjectWithKnownSize<ClassType>(resultGPR, structure, storage, scratchGPR1, scratchGPR2, slowPath, ClassType::allocationSize(0));
+    }
+    
+    // allocationSize can be aliased with any of the other input GPRs. If it's not aliased then it
+    // won't be clobbered.
+    void emitAllocateVariableSized(GPRReg resultGPR, Subspace& subspace, GPRReg allocationSize, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
+    {
+        static_assert(!(MarkedSpace::sizeStep & (MarkedSpace::sizeStep - 1)), "MarkedSpace::sizeStep must be a power of two.");
+        
+        unsigned stepShift = getLSBSet(MarkedSpace::sizeStep);
+        
+        add32(TrustedImm32(MarkedSpace::sizeStep - 1), allocationSize, scratchGPR1);
+        urshift32(TrustedImm32(stepShift), scratchGPR1);
+        slowPath.append(branch32(Above, scratchGPR1, TrustedImm32(MarkedSpace::largeCutoff >> stepShift)));
+        move(TrustedImmPtr(subspace.allocatorForSizeStep() - 1), scratchGPR2);
+        loadPtr(BaseIndex(scratchGPR2, scratchGPR1, timesPtr()), scratchGPR1);
+        
+        emitAllocate(resultGPR, nullptr, scratchGPR1, scratchGPR2, slowPath);
+    }
+    
+    template<typename ClassType, typename StructureType>
+    void emitAllocateVariableSizedCell(GPRReg resultGPR, StructureType structure, GPRReg allocationSize, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
+    {
+        Subspace& subspace = *subspaceFor<ClassType>(*vm());
+        emitAllocateVariableSized(resultGPR, subspace, allocationSize, scratchGPR1, scratchGPR2, slowPath);
+        emitStoreStructureWithTypeInfo(structure, resultGPR, scratchGPR2);
+    }
+
+    template<typename ClassType, typename StructureType>
+    void emitAllocateVariableSizedJSObject(GPRReg resultGPR, StructureType structure, GPRReg allocationSize, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
+    {
+        emitAllocateVariableSizedCell<ClassType>(resultGPR, structure, allocationSize, scratchGPR1, scratchGPR2, slowPath);
+        storePtr(TrustedImmPtr(0), Address(resultGPR, JSObject::butterflyOffset()));
+    }
+
+    void emitConvertValueToBoolean(JSValueRegs value, GPRReg result, GPRReg scratchIfShouldCheckMasqueradesAsUndefined, FPRReg, FPRReg, bool shouldCheckMasqueradesAsUndefined, JSGlobalObject*, bool negateResult = false);
+    
+    template<typename ClassType>
+    void emitAllocateDestructibleObject(GPRReg resultGPR, Structure* structure, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
+    {
+        emitAllocateJSObject<ClassType>(resultGPR, TrustedImmPtr(structure), TrustedImmPtr(0), scratchGPR1, scratchGPR2, slowPath);
+        storePtr(TrustedImmPtr(structure->classInfo()), Address(resultGPR, JSDestructibleObject::classInfoOffset()));
+    }
+    
+    void emitInitializeInlineStorage(GPRReg baseGPR, unsigned inlineCapacity)
+    {
+        for (unsigned i = 0; i < inlineCapacity; ++i)
+            storeTrustedValue(JSValue(), Address(baseGPR, JSObject::offsetOfInlineStorage() + i * sizeof(EncodedJSValue)));
+    }
+
+    void emitInitializeInlineStorage(GPRReg baseGPR, GPRReg inlineCapacity)
+    {
+        Jump empty = branchTest32(Zero, inlineCapacity);
+        Label loop = label();
+        sub32(TrustedImm32(1), inlineCapacity);
+        storeTrustedValue(JSValue(), BaseIndex(baseGPR, inlineCapacity, TimesEight, JSObject::offsetOfInlineStorage()));
+        branchTest32(NonZero, inlineCapacity).linkTo(loop, this);
+        empty.link(this);
+    }
+
+    void emitInitializeOutOfLineStorage(GPRReg butterflyGPR, unsigned outOfLineCapacity)
+    {
+        for (unsigned i = 0; i < outOfLineCapacity; ++i)
+            storeTrustedValue(JSValue(), Address(butterflyGPR, -sizeof(IndexingHeader) - (i + 1) * sizeof(EncodedJSValue)));
+    }
+    
+#if USE(JSVALUE64)
+    void wangsInt64Hash(GPRReg inputAndResult, GPRReg scratch);
+#endif
+    
+protected:
+    VM* m_vm;
+    CodeBlock* m_codeBlock;
+    CodeBlock* m_baselineCodeBlock;
+
+    HashMap<CodeBlock*, Vector<BytecodeAndMachineOffset>> m_decodedCodeMaps;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/BinarySwitch.cpp b/jit/BinarySwitch.cpp
new file mode 100644
index 0000000..f3ddcfc
--- /dev/null
+++ b/jit/BinarySwitch.cpp
@@ -0,0 +1,391 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "BinarySwitch.h"
+
+#if ENABLE(JIT)
+
+#include "JSCInlines.h"
+#include <wtf/ListDump.h>
+
+namespace JSC {
+
+static const bool verbose = false;
+
+static unsigned globalCounter; // We use a different seed every time we are invoked.
+
+BinarySwitch::BinarySwitch(GPRReg value, const Vector<int64_t>& cases, Type type)
+    : m_value(value)
+    , m_weakRandom(globalCounter++)
+    , m_index(0)
+    , m_caseIndex(UINT_MAX)
+    , m_type(type)
+{
+    if (cases.isEmpty())
+        return;
+
+    if (verbose)
+        dataLog("Original cases: ", listDump(cases), "\n");
+    
+    for (unsigned i = 0; i < cases.size(); ++i)
+        m_cases.append(Case(cases[i], i));
+    
+    std::sort(m_cases.begin(), m_cases.end());
+
+    if (verbose)
+        dataLog("Sorted cases: ", listDump(m_cases), "\n");
+    
+    for (unsigned i = 1; i < m_cases.size(); ++i)
+        RELEASE_ASSERT(m_cases[i - 1] < m_cases[i]);
+    
+    build(0, false, m_cases.size());
+}
+
+BinarySwitch::~BinarySwitch()
+{
+}
+
+bool BinarySwitch::advance(MacroAssembler& jit)
+{
+    if (m_cases.isEmpty()) {
+        m_fallThrough.append(jit.jump());
+        return false;
+    }
+    
+    if (m_index == m_branches.size()) {
+        RELEASE_ASSERT(m_jumpStack.isEmpty());
+        return false;
+    }
+    
+    for (;;) {
+        const BranchCode& code = m_branches[m_index++];
+        switch (code.kind) {
+        case NotEqualToFallThrough:
+            switch (m_type) {
+            case Int32:
+                m_fallThrough.append(jit.branch32(
+                    MacroAssembler::NotEqual, m_value,
+                    MacroAssembler::Imm32(static_cast<int32_t>(m_cases[code.index].value))));
+                break;
+            case IntPtr:
+                m_fallThrough.append(jit.branchPtr(
+                    MacroAssembler::NotEqual, m_value,
+                    MacroAssembler::ImmPtr(bitwise_cast<const void*>(static_cast<intptr_t>(m_cases[code.index].value)))));
+                break;
+            }
+            break;
+        case NotEqualToPush:
+            switch (m_type) {
+            case Int32:
+                m_jumpStack.append(jit.branch32(
+                    MacroAssembler::NotEqual, m_value,
+                    MacroAssembler::Imm32(static_cast<int32_t>(m_cases[code.index].value))));
+                break;
+            case IntPtr:
+                m_jumpStack.append(jit.branchPtr(
+                    MacroAssembler::NotEqual, m_value,
+                    MacroAssembler::ImmPtr(bitwise_cast<const void*>(static_cast<intptr_t>(m_cases[code.index].value)))));
+                break;
+            }
+            break;
+        case LessThanToPush:
+            switch (m_type) {
+            case Int32:
+                m_jumpStack.append(jit.branch32(
+                    MacroAssembler::LessThan, m_value,
+                    MacroAssembler::Imm32(static_cast<int32_t>(m_cases[code.index].value))));
+                break;
+            case IntPtr:
+                m_jumpStack.append(jit.branchPtr(
+                    MacroAssembler::LessThan, m_value,
+                    MacroAssembler::ImmPtr(bitwise_cast<const void*>(static_cast<intptr_t>(m_cases[code.index].value)))));
+                break;
+            }
+            break;
+        case Pop:
+            m_jumpStack.takeLast().link(&jit);
+            break;
+        case ExecuteCase:
+            m_caseIndex = code.index;
+            return true;
+        }
+    }
+}
+
+void BinarySwitch::build(unsigned start, bool hardStart, unsigned end)
+{
+    if (verbose)
+        dataLog("Building with start = ", start, ", hardStart = ", hardStart, ", end = ", end, "\n");
+
+    auto append = [&] (const BranchCode& code) {
+        if (verbose)
+            dataLog("==> ", code, "\n");
+        m_branches.append(code);
+    };
+    
+    unsigned size = end - start;
+    
+    RELEASE_ASSERT(size);
+    
+    // This code uses some random numbers to keep things balanced. It's important to keep in mind
+    // that this does not improve average-case throughput under the assumption that all cases fire
+    // with equal probability. It just ensures that there will not be some switch structure that
+    // when combined with some input will always produce pathologically good or pathologically bad
+    // performance.
+    
+    const unsigned leafThreshold = 3;
+    
+    if (size <= leafThreshold) {
+        if (verbose)
+            dataLog("It's a leaf.\n");
+        
+        // It turns out that for exactly three cases or less, it's better to just compare each
+        // case individually. This saves 1/6 of a branch on average, and up to 1/3 of a branch in
+        // extreme cases where the divide-and-conquer bottoms out in a lot of 3-case subswitches.
+        //
+        // This assumes that we care about the cost of hitting some case more than we care about
+        // bottoming out in a default case. I believe that in most places where we use switch
+        // statements, we are more likely to hit one of the cases than we are to fall through to
+        // default. Intuitively, if we wanted to improve the performance of default, we would
+        // reduce the value of leafThreshold to 2 or even to 1. See below for a deeper discussion.
+        
+        bool allConsecutive = false;
+        
+        if ((hardStart || (start && m_cases[start - 1].value == m_cases[start].value - 1))
+            && start + size < m_cases.size()
+            && m_cases[start + size - 1].value == m_cases[start + size].value - 1) {
+            allConsecutive = true;
+            for (unsigned i = 0; i < size - 1; ++i) {
+                if (m_cases[start + i].value + 1 != m_cases[start + i + 1].value) {
+                    allConsecutive = false;
+                    break;
+                }
+            }
+        }
+
+        if (verbose)
+            dataLog("allConsecutive = ", allConsecutive, "\n");
+        
+        Vector<unsigned, 3> localCaseIndices;
+        for (unsigned i = 0; i < size; ++i)
+            localCaseIndices.append(start + i);
+        
+        std::random_shuffle(
+            localCaseIndices.begin(), localCaseIndices.end(),
+            [this] (unsigned n) {
+                // We use modulo to get a random number in the range we want fully knowing that
+                // this introduces a tiny amount of bias, but we're fine with such tiny bias.
+                return m_weakRandom.getUint32() % n;
+            });
+        
+        for (unsigned i = 0; i < size - 1; ++i) {
+            append(BranchCode(NotEqualToPush, localCaseIndices[i]));
+            append(BranchCode(ExecuteCase, localCaseIndices[i]));
+            append(BranchCode(Pop));
+        }
+        
+        if (!allConsecutive)
+            append(BranchCode(NotEqualToFallThrough, localCaseIndices.last()));
+        
+        append(BranchCode(ExecuteCase, localCaseIndices.last()));
+        return;
+    }
+
+    if (verbose)
+        dataLog("It's not a leaf.\n");
+        
+    // There are two different strategies we could consider here:
+    //
+    // Isolate median and split: pick a median and check if the comparison value is equal to it;
+    // if so, execute the median case. Otherwise check if the value is less than the median, and
+    // recurse left or right based on this. This has two subvariants: we could either first test
+    // equality for the median and then do the less-than, or we could first do the less-than and
+    // then check equality on the not-less-than path.
+    //
+    // Ignore median and split: do a less-than comparison on a value that splits the cases in two
+    // equal-sized halves. Recurse left or right based on the comparison. Do not test for equality
+    // against the median (or anything else); let the recursion handle those equality comparisons
+    // once we bottom out in a list that case 3 cases or less (see above).
+    //
+    // I'll refer to these strategies as Isolate and Ignore. I initially believed that Isolate
+    // would be faster since it leads to less branching for some lucky cases. It turns out that
+    // Isolate is almost a total fail in the average, assuming all cases are equally likely. How
+    // bad Isolate is depends on whether you believe that doing two consecutive branches based on
+    // the same comparison is cheaper than doing the compare/branches separately. This is
+    // difficult to evaluate. For small immediates that aren't blinded, we just care about
+    // avoiding a second compare instruction. For large immediates or when blinding is in play, we
+    // also care about the instructions used to materialize the immediate a second time. Isolate
+    // can help with both costs since it involves first doing a < compare+branch on some value,
+    // followed by a == compare+branch on the same exact value (or vice-versa). Ignore will do a <
+    // compare+branch on some value, and then the == compare+branch on that same value will happen
+    // much later.
+    //
+    // To evaluate these costs, I wrote the recurrence relation for Isolate and Ignore, assuming
+    // that ComparisonCost is the cost of a compare+branch and ChainedComparisonCost is the cost
+    // of a compare+branch on some value that you've just done another compare+branch for. These
+    // recurrence relations compute the total cost incurred if you executed the switch statement
+    // on each matching value. So the average cost of hitting some case can be computed as
+    // Isolate[n]/n or Ignore[n]/n, respectively for the two relations.
+    //
+    // Isolate[1] = ComparisonCost
+    // Isolate[2] = (2 + 1) * ComparisonCost
+    // Isolate[3] = (3 + 2 + 1) * ComparisonCost
+    // Isolate[n_] := With[
+    //     {medianIndex = Floor[n/2] + If[EvenQ[n], RandomInteger[], 1]},
+    //     ComparisonCost + ChainedComparisonCost +
+    //     (ComparisonCost * (medianIndex - 1) + Isolate[medianIndex - 1]) +
+    //     (2 * ComparisonCost * (n - medianIndex) + Isolate[n - medianIndex])]
+    //
+    // Ignore[1] = ComparisonCost
+    // Ignore[2] = (2 + 1) * ComparisonCost
+    // Ignore[3] = (3 + 2 + 1) * ComparisonCost
+    // Ignore[n_] := With[
+    //     {medianIndex = If[EvenQ[n], n/2, Floor[n/2] + RandomInteger[]]},
+    //     (medianIndex * ComparisonCost + Ignore[medianIndex]) +
+    //     ((n - medianIndex) * ComparisonCost + Ignore[n - medianIndex])]
+    //
+    // This does not account for the average cost of hitting the default case. See further below
+    // for a discussion of that.
+    //
+    // It turns out that for ComparisonCost = 1 and ChainedComparisonCost = 1, Ignore is always
+    // better than Isolate. If we assume that ChainedComparisonCost = 0, then Isolate wins for
+    // switch statements that have 20 cases or fewer, though the margin of victory is never large
+    // - it might sometimes save an average of 0.3 ComparisonCost. For larger switch statements,
+    // we see divergence between the two with Ignore winning. This is of course rather
+    // unrealistic since the chained comparison is never free. For ChainedComparisonCost = 0.5, we
+    // see Isolate winning for 10 cases or fewer, by maybe 0.2 ComparisonCost. Again we see
+    // divergence for large switches with Ignore winning, for example if a switch statement has
+    // 100 cases then Ignore saves one branch on average.
+    //
+    // Our current JIT backends don't provide for optimization for chained comparisons, except for
+    // reducing the code for materializing the immediate if the immediates are large or blinding
+    // comes into play. Probably our JIT backends live somewhere north of
+    // ChainedComparisonCost = 0.5.
+    //
+    // This implies that using the Ignore strategy is likely better. If we wanted to incorporate
+    // the Isolate strategy, we'd want to determine the switch size threshold at which the two
+    // cross over and then use Isolate for switches that are smaller than that size.
+    //
+    // The average cost of hitting the default case is similar, but involves a different cost for
+    // the base cases: you have to assume that you will always fail each branch. For the Ignore
+    // strategy we would get this recurrence relation; the same kind of thing happens to the
+    // Isolate strategy:
+    //
+    // Ignore[1] = ComparisonCost
+    // Ignore[2] = (2 + 2) * ComparisonCost
+    // Ignore[3] = (3 + 3 + 3) * ComparisonCost
+    // Ignore[n_] := With[
+    //     {medianIndex = If[EvenQ[n], n/2, Floor[n/2] + RandomInteger[]]},
+    //     (medianIndex * ComparisonCost + Ignore[medianIndex]) +
+    //     ((n - medianIndex) * ComparisonCost + Ignore[n - medianIndex])]
+    //
+    // This means that if we cared about the default case more, we would likely reduce
+    // leafThreshold. Reducing it to 2 would reduce the average cost of the default case by 1/3
+    // in the most extreme cases (num switch cases = 3, 6, 12, 24, ...). But it would also
+    // increase the average cost of taking one of the non-default cases by 1/3. Typically the
+    // difference is 1/6 in either direction. This makes it a very simple trade-off: if we believe
+    // that the default case is more important then we would want leafThreshold to be 2, and the
+    // default case would become 1/6 faster on average. But we believe that most switch statements
+    // are more likely to take one of the cases than the default, so we use leafThreshold = 3
+    // and get a 1/6 speed-up on average for taking an explicit case.
+        
+    unsigned medianIndex = (start + end) / 2;
+
+    if (verbose)
+        dataLog("medianIndex = ", medianIndex, "\n");
+
+    // We want medianIndex to point to the thing we will do a less-than compare against. We want
+    // this less-than compare to split the current sublist into equal-sized sublists, or
+    // nearly-equal-sized with some randomness if we're in the odd case. With the above
+    // calculation, in the odd case we will have medianIndex pointing at either the element we
+    // want or the element to the left of the one we want. Consider the case of five elements:
+    //
+    //     0 1 2 3 4
+    //
+    // start will be 0, end will be 5. The average is 2.5, which rounds down to 2. If we do
+    // value < 2, then we will split the list into 2 elements on the left and three on the right.
+    // That's pretty good, but in this odd case we'd like to at random choose 3 instead to ensure
+    // that we don't become unbalanced on the right. This does not improve throughput since one
+    // side will always get shafted, and that side might still be odd, in which case it will also
+    // have two sides and one of them will get shafted - and so on. We just want to avoid
+    // deterministic pathologies.
+    //
+    // In the even case, we will always end up pointing at the element we want:
+    //
+    //     0 1 2 3
+    //
+    // start will be 0, end will be 4. So, the average is 2, which is what we'd like.
+    if (size & 1) {
+        RELEASE_ASSERT(medianIndex - start + 1 == end - medianIndex);
+        medianIndex += m_weakRandom.getUint32() & 1;
+    } else
+        RELEASE_ASSERT(medianIndex - start == end - medianIndex);
+        
+    RELEASE_ASSERT(medianIndex > start);
+    RELEASE_ASSERT(medianIndex + 1 < end);
+        
+    if (verbose)
+        dataLog("fixed medianIndex = ", medianIndex, "\n");
+
+    append(BranchCode(LessThanToPush, medianIndex));
+    build(medianIndex, true, end);
+    append(BranchCode(Pop));
+    build(start, hardStart, medianIndex);
+}
+
+void BinarySwitch::Case::dump(PrintStream& out) const
+{
+    out.print("<value: " , value, ", index: ", index, ">");
+}
+
+void BinarySwitch::BranchCode::dump(PrintStream& out) const
+{
+    switch (kind) {
+    case NotEqualToFallThrough:
+        out.print("NotEqualToFallThrough");
+        break;
+    case NotEqualToPush:
+        out.print("NotEqualToPush");
+        break;
+    case LessThanToPush:
+        out.print("LessThanToPush");
+        break;
+    case Pop:
+        out.print("Pop");
+        break;
+    case ExecuteCase:
+        out.print("ExecuteCase");
+        break;
+    }
+
+    if (index != UINT_MAX)
+        out.print("(", index, ")");
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/BinarySwitch.h b/jit/BinarySwitch.h
new file mode 100644
index 0000000..c2569d3
--- /dev/null
+++ b/jit/BinarySwitch.h
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "GPRInfo.h"
+#include "MacroAssembler.h"
+#include <wtf/WeakRandom.h>
+
+namespace JSC {
+
+// The BinarySwitch class makes it easy to emit a switch statement over either
+// 32-bit integers or pointers, where the switch uses a tree of branches
+// rather than a jump table. This makes it particularly useful if the case
+// values are too far apart to make a jump table practical, or if there are
+// sufficiently few cases that the total cost of log(numCases) branches is
+// less than the cost of an indirected jump.
+//
+// In an effort to simplify the logic of emitting code for each case, this
+// uses an iterator style, rather than a functor callback style. This makes
+// sense because even the iterator implementation found herein is relatively
+// simple, whereas the code it's used from is usually quite complex - one
+// example being the trie-of-trees string switch implementation, where the
+// code emitted for each case involves recursing to emit code for a sub-trie.
+//
+// Use this like so:
+//
+// BinarySwitch switch(valueReg, casesVector, BinarySwitch::Int32);
+// while (switch.advance(jit)) {
+//     int value = switch.caseValue();
+//     unsigned index = switch.caseIndex(); // index into casesVector, above
+//     ... // generate code for this case
+//     ... = jit.jump(); // you have to jump out yourself; falling through causes undefined behavior
+// }
+// switch.fallThrough().link(&jit);
+
+class BinarySwitch {
+public:
+    enum Type {
+        Int32,
+        IntPtr
+    };
+    
+    BinarySwitch(GPRReg value, const Vector<int64_t>& cases, Type);
+    ~BinarySwitch();
+    
+    unsigned caseIndex() const { return m_cases[m_caseIndex].index; }
+    int64_t caseValue() const { return m_cases[m_caseIndex].value; }
+    
+    bool advance(MacroAssembler&);
+    
+    MacroAssembler::JumpList& fallThrough() { return m_fallThrough; }
+    
+private:
+    void build(unsigned start, bool hardStart, unsigned end);
+    
+    GPRReg m_value;
+    
+    struct Case {
+        Case() { }
+
+        Case(int64_t value, unsigned index)
+            : value(value)
+            , index(index)
+        {
+        }
+        
+        bool operator<(const Case& other) const
+        {
+            return value < other.value;
+        }
+
+        void dump(PrintStream& out) const;
+        
+        int64_t value;
+        unsigned index;
+    };
+    
+    Vector<Case> m_cases;
+    
+    enum BranchKind {
+        NotEqualToFallThrough,
+        NotEqualToPush,
+        LessThanToPush,
+        Pop,
+        ExecuteCase
+    };
+        
+    struct BranchCode {
+        BranchCode() { }
+        
+        BranchCode(BranchKind kind, unsigned index = UINT_MAX)
+            : kind(kind)
+            , index(index)
+        {
+        }
+
+        void dump(PrintStream& out) const;
+        
+        BranchKind kind;
+        unsigned index;
+    };
+    
+    WeakRandom m_weakRandom;
+    
+    Vector<BranchCode> m_branches;
+
+    unsigned m_index;
+    unsigned m_caseIndex;
+    Vector<MacroAssembler::Jump> m_jumpStack;
+    
+    MacroAssembler::JumpList m_fallThrough;
+    
+    Type m_type;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CCallHelpers.cpp b/jit/CCallHelpers.cpp
new file mode 100644
index 0000000..3c3df61
--- /dev/null
+++ b/jit/CCallHelpers.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CCallHelpers.h"
+
+#if ENABLE(JIT)
+
+#include "ShadowChicken.h"
+
+namespace JSC {
+
+void CCallHelpers::logShadowChickenProloguePacket(GPRReg shadowPacket, GPRReg scratch1, GPRReg scope)
+{
+    storePtr(GPRInfo::callFrameRegister, Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, frame)));
+    loadPtr(Address(GPRInfo::callFrameRegister, OBJECT_OFFSETOF(CallerFrameAndPC, callerFrame)), scratch1);
+    storePtr(scratch1, Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, callerFrame)));
+    loadPtr(addressFor(CallFrameSlot::callee), scratch1);
+    storePtr(scratch1, Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, callee)));
+    storePtr(scope, Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, scope)));
+}
+
+void CCallHelpers::logShadowChickenTailPacket(GPRReg shadowPacket, JSValueRegs thisRegs, GPRReg scope, CodeBlock* codeBlock, CallSiteIndex callSiteIndex)
+{
+    storePtr(GPRInfo::callFrameRegister, Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, frame)));
+    storePtr(TrustedImmPtr(ShadowChicken::Packet::tailMarker()), Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, callee)));
+    storeValue(thisRegs, Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, thisValue)));
+    storePtr(scope, Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, scope)));
+    storePtr(TrustedImmPtr(codeBlock), Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, codeBlock)));
+    store32(TrustedImm32(callSiteIndex.bits()), Address(shadowPacket, OBJECT_OFFSETOF(ShadowChicken::Packet, callSiteIndex)));
+}
+
+void CCallHelpers::ensureShadowChickenPacket(GPRReg shadowPacket, GPRReg scratch1NonArgGPR, GPRReg scratch2)
+{
+    ASSERT(!RegisterSet::argumentGPRS().get(scratch1NonArgGPR));
+    move(TrustedImmPtr(vm()->shadowChicken().addressOfLogCursor()), scratch1NonArgGPR);
+    loadPtr(Address(scratch1NonArgGPR), shadowPacket);
+    Jump ok = branchPtr(Below, shadowPacket, TrustedImmPtr(vm()->shadowChicken().logEnd()));
+    setupArgumentsExecState();
+    move(TrustedImmPtr(bitwise_cast<void*>(operationProcessShadowChickenLog)), scratch1NonArgGPR);
+    call(scratch1NonArgGPR);
+    move(TrustedImmPtr(vm()->shadowChicken().addressOfLogCursor()), scratch1NonArgGPR);
+    loadPtr(Address(scratch1NonArgGPR), shadowPacket);
+    ok.link(this);
+    addPtr(TrustedImm32(sizeof(ShadowChicken::Packet)), shadowPacket, scratch2);
+    storePtr(scratch2, Address(scratch1NonArgGPR));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CCallHelpers.h b/jit/CCallHelpers.h
new file mode 100644
index 0000000..2e2e824
--- /dev/null
+++ b/jit/CCallHelpers.h
@@ -0,0 +1,2605 @@
+/*
+ * Copyright (C) 2011, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "AssemblyHelpers.h"
+#include "GPRInfo.h"
+#include "RegisterMap.h"
+#include "StackAlignment.h"
+
+namespace JSC {
+
+#if CPU(MIPS) || (OS(WINDOWS) && CPU(X86_64))
+#define POKE_ARGUMENT_OFFSET 4
+#else
+#define POKE_ARGUMENT_OFFSET 0
+#endif
+
+// EncodedJSValue in JSVALUE32_64 is a 64-bit integer. When being compiled in ARM EABI, it must be aligned even-numbered register (r0, r2 or [sp]).
+// To avoid assemblies from using wrong registers, let's occupy r1 or r3 with a dummy argument when necessary.
+#if (COMPILER_SUPPORTS(EABI) && CPU(ARM)) || CPU(MIPS)
+#define EABI_32BIT_DUMMY_ARG      CCallHelpers::TrustedImm32(0),
+#else
+#define EABI_32BIT_DUMMY_ARG
+#endif
+
+// JSVALUE32_64 is a 64-bit integer that cannot be put half in an argument register and half on stack when using SH4 architecture.
+// To avoid this, let's occupy the 4th argument register (r7) with a dummy argument when necessary. This must only be done when there
+// is no other 32-bit value argument behind this 64-bit JSValue.
+#if CPU(SH4)
+#define SH4_32BIT_DUMMY_ARG      CCallHelpers::TrustedImm32(0),
+#else
+#define SH4_32BIT_DUMMY_ARG
+#endif
+
+class CCallHelpers : public AssemblyHelpers {
+public:
+    CCallHelpers(VM* vm, CodeBlock* codeBlock = 0)
+        : AssemblyHelpers(vm, codeBlock)
+    {
+    }
+    
+    // The most general helper for setting arguments that fit in a GPR, if you can compute each
+    // argument without using any argument registers. You usually want one of the setupArguments*()
+    // methods below instead of this. This thing is most useful if you have *a lot* of arguments.
+    template<typename Functor>
+    void setupArgument(unsigned argumentIndex, const Functor& functor)
+    {
+        unsigned numberOfRegs = GPRInfo::numberOfArgumentRegisters; // Disguise the constant from clang's tautological compare warning.
+        if (argumentIndex < numberOfRegs) {
+            functor(GPRInfo::toArgumentRegister(argumentIndex));
+            return;
+        }
+        
+        functor(GPRInfo::nonArgGPR0);
+        poke(GPRInfo::nonArgGPR0, POKE_ARGUMENT_OFFSET + argumentIndex - GPRInfo::numberOfArgumentRegisters);
+    }
+
+    void setupArgumentsWithExecState() { setupArgumentsExecState(); }
+
+    // These methods used to sort arguments into the correct registers.
+    // On X86 we use cdecl calling conventions, which pass all arguments on the
+    // stack. On other architectures we may need to sort values into the
+    // correct registers.
+#if !NUMBER_OF_ARGUMENT_REGISTERS
+    unsigned m_callArgumentOffset;
+    void resetCallArguments() { m_callArgumentOffset = 0; }
+
+    // These methods are using internally to implement the callOperation methods.
+    void addCallArgument(GPRReg value)
+    {
+        poke(value, m_callArgumentOffset++);
+    }
+    void addCallArgument(TrustedImm32 imm)
+    {
+        poke(imm, m_callArgumentOffset++);
+    }
+    void addCallArgument(TrustedImmPtr pointer)
+    {
+        poke(pointer, m_callArgumentOffset++);
+    }
+    void addCallArgument(FPRReg value)
+    {
+        storeDouble(value, Address(stackPointerRegister, m_callArgumentOffset * sizeof(void*)));
+        m_callArgumentOffset += sizeof(double) / sizeof(void*);
+    }
+
+    ALWAYS_INLINE void setupArguments(FPRReg arg1)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+    }
+
+    ALWAYS_INLINE void setupArguments(FPRReg arg1, FPRReg arg2)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArguments(GPRReg arg1)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+    }
+
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+    
+    ALWAYS_INLINE void setupArguments(TrustedImmPtr arg1, GPRReg arg2)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImmPtr arg4)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4, GPRReg arg5)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4, GPRReg arg5, GPRReg arg6)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+    }
+    
+    ALWAYS_INLINE void setupArguments(TrustedImmPtr arg1)
+    {
+        resetCallArguments();
+        addCallArgument(arg1);
+    }
+
+    ALWAYS_INLINE void setupArgumentsExecState()
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImm32 arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImmPtr arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImm32 arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImm32 arg2, TrustedImm32 arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImm32 arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, GPRReg arg3, TrustedImm32 arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImmPtr arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, TrustedImmPtr arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, TrustedImm32 arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    { 
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, GPRReg arg5, TrustedImm32 arg6)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImm32 arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImmPtr arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImmPtr arg2, TrustedImm32 arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImmPtr arg2, TrustedImmPtr arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImmPtr arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImm32 arg3, GPRReg arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImm32 arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImmPtr arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImm32 arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4, TrustedImm32 arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3, GPRReg arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, GPRReg arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImm32 arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImm32 arg2, GPRReg arg3, GPRReg arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImmPtr arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, TrustedImmPtr arg6)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImm32 arg5, TrustedImmPtr arg6)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImmPtr arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, TrustedImmPtr arg3, GPRReg arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, GPRReg arg3, GPRReg arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, GPRReg arg3, GPRReg arg4)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImmPtr arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImmPtr arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+    }
+    
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, TrustedImm32 arg6)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImmPtr arg5, TrustedImmPtr arg6)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6, TrustedImmPtr arg7)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+        addCallArgument(arg7);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(FPRReg arg1, GPRReg arg2)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, FPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6, GPRReg arg7, GPRReg arg8)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+        addCallArgument(arg4);
+        addCallArgument(arg5);
+        addCallArgument(arg6);
+        addCallArgument(arg7);
+        addCallArgument(arg8);
+    }
+
+#endif // !NUMBER_OF_ARGUMENT_REGISTERS
+    // These methods are suitable for any calling convention that provides for
+    // at least 4 argument registers, e.g. X86_64, ARMv7.
+#if NUMBER_OF_ARGUMENT_REGISTERS >= 4
+    template<GPRReg destA, GPRReg destB>
+    void setupTwoStubArgsGPR(GPRReg srcA, GPRReg srcB)
+    {
+        // Assuming that srcA != srcB, there are 7 interesting states the registers may be in:
+        // (1) both are already in arg regs, the right way around.
+        // (2) both are already in arg regs, the wrong way around.
+        // (3) neither are currently in arg registers.
+        // (4) srcA in in its correct reg.
+        // (5) srcA in in the incorrect reg.
+        // (6) srcB in in its correct reg.
+        // (7) srcB in in the incorrect reg.
+        //
+        // The trivial approach is to simply emit two moves, to put srcA in place then srcB in
+        // place (the MacroAssembler will omit redundant moves). This apporach will be safe in
+        // cases 1, 3, 4, 5, 6, and in cases where srcA==srcB. The two problem cases are 2
+        // (requires a swap) and 7 (must move srcB first, to avoid trampling.)
+
+        if (srcB != destA) {
+            // Handle the easy cases - two simple moves.
+            move(srcA, destA);
+            move(srcB, destB);
+        } else if (srcA != destB) {
+            // Handle the non-swap case - just put srcB in place first.
+            move(srcB, destB);
+            move(srcA, destA);
+        } else
+            swap(destA, destB);
+    }
+
+    template<GPRReg destA, GPRReg destB, GPRReg destC>
+    void setupThreeStubArgsGPR(GPRReg srcA, GPRReg srcB, GPRReg srcC)
+    {
+        // If neither of srcB/srcC are in our way, then we can move srcA into place.
+        // Then we can use setupTwoStubArgs to fix srcB/srcC.
+        if (srcB != destA && srcC != destA) {
+            move(srcA, destA);
+            setupTwoStubArgsGPR<destB, destC>(srcB, srcC);
+            return;
+        }
+        
+        // If neither of srcA/srcC are in our way, then we can move srcB into place.
+        // Then we can use setupTwoStubArgs to fix srcA/srcC.
+        if (srcA != destB && srcC != destB) {
+            move(srcB, destB);
+            setupTwoStubArgsGPR<destA, destC>(srcA, srcC);
+            return;
+        }
+        
+        // If neither of srcA/srcB are in our way, then we can move srcC into place.
+        // Then we can use setupTwoStubArgs to fix srcA/srcB.
+        if (srcA != destC && srcB != destC) {
+            move(srcC, destC);
+            setupTwoStubArgsGPR<destA, destB>(srcA, srcB);
+            return;
+        }
+        
+        // If we get here, we haven't been able to move any of srcA/srcB/srcC.
+        // Since all three are blocked, then all three must already be in the argument register.
+        // But are they in the right ones?
+        
+        // First, ensure srcA is in place.
+        if (srcA != destA) {
+            swap(srcA, destA);
+            
+            // If srcA wasn't in argumentGPR1, one of srcB/srcC must be.
+            ASSERT(srcB == destA || srcC == destA);
+            // If srcB was in argumentGPR1 it no longer is (due to the swap).
+            // Otherwise srcC must have been. Mark him as moved.
+            if (srcB == destA)
+                srcB = srcA;
+            else
+                srcC = srcA;
+        }
+        
+        // Either srcB & srcC need swapping, or we're all done.
+        ASSERT((srcB == destB || srcC == destC)
+            || (srcB == destC || srcC == destB));
+        
+        if (srcB != destB)
+            swap(destB, destC);
+    }
+
+    void setupFourStubArgsGPR(GPRReg destA, GPRReg destB, GPRReg destC, GPRReg destD, GPRReg srcA, GPRReg srcB, GPRReg srcC, GPRReg srcD)
+    {
+        setupStubArgsGPR<4>({ { destA, destB, destC, destD } }, { { srcA, srcB, srcC, srcD } });
+    }
+    void setupFiveStubArgsGPR(GPRReg destA, GPRReg destB, GPRReg destC, GPRReg destD, GPRReg destE, GPRReg srcA, GPRReg srcB, GPRReg srcC, GPRReg srcD, GPRReg srcE)
+    {
+        setupStubArgsGPR<5>({ { destA, destB, destC, destD, destE } }, { { srcA, srcB, srcC, srcD, srcE } });
+    }
+
+#if CPU(X86_64) || CPU(ARM64)
+    template<FPRReg destA, FPRReg destB>
+    void setupTwoStubArgsFPR(FPRReg srcA, FPRReg srcB)
+    {
+        // Assuming that srcA != srcB, there are 7 interesting states the registers may be in:
+        // (1) both are already in arg regs, the right way around.
+        // (2) both are already in arg regs, the wrong way around.
+        // (3) neither are currently in arg registers.
+        // (4) srcA in in its correct reg.
+        // (5) srcA in in the incorrect reg.
+        // (6) srcB in in its correct reg.
+        // (7) srcB in in the incorrect reg.
+        //
+        // The trivial approach is to simply emit two moves, to put srcA in place then srcB in
+        // place (the MacroAssembler will omit redundant moves). This apporach will be safe in
+        // cases 1, 3, 4, 5, 6, and in cases where srcA==srcB. The two problem cases are 2
+        // (requires a swap) and 7 (must move srcB first, to avoid trampling.)
+
+        if (srcB != destA) {
+            // Handle the easy cases - two simple moves.
+            moveDouble(srcA, destA);
+            moveDouble(srcB, destB);
+            return;
+        }
+        
+        if (srcA != destB) {
+            // Handle the non-swap case - just put srcB in place first.
+            moveDouble(srcB, destB);
+            moveDouble(srcA, destA);
+            return;
+        }
+
+        ASSERT(srcB == destA && srcA == destB);
+        // Need to swap; pick a temporary register.
+        FPRReg temp;
+        if (destA != FPRInfo::argumentFPR3 && destA != FPRInfo::argumentFPR3)
+            temp = FPRInfo::argumentFPR3;
+        else if (destA != FPRInfo::argumentFPR2 && destA != FPRInfo::argumentFPR2)
+            temp = FPRInfo::argumentFPR2;
+        else {
+            ASSERT(destA != FPRInfo::argumentFPR1 && destA != FPRInfo::argumentFPR1);
+            temp = FPRInfo::argumentFPR1;
+        }
+        moveDouble(destA, temp);
+        moveDouble(destB, destA);
+        moveDouble(temp, destB);
+    }
+#endif
+    void setupStubArguments(GPRReg arg1, GPRReg arg2)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR2>(arg1, arg2);
+    }
+
+    void setupStubArguments(GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR2, GPRInfo::argumentGPR3>(arg1, arg2, arg3);
+    }
+
+#if CPU(X86_64) || CPU(ARM64)
+    ALWAYS_INLINE void setupArguments(FPRReg arg1)
+    {
+        moveDouble(arg1, FPRInfo::argumentFPR0);
+    }
+
+    ALWAYS_INLINE void setupArguments(FPRReg arg1, FPRReg arg2)
+    {
+        setupTwoStubArgsFPR<FPRInfo::argumentFPR0, FPRInfo::argumentFPR1>(arg1, arg2);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(FPRReg arg1, GPRReg arg2)
+    {
+#if OS(WINDOWS) && CPU(X86_64)
+        // On Windows, arguments map to designated registers based on the argument positions, even when there are interlaced scalar and floating point arguments.
+        // See http://msdn.microsoft.com/en-us/library/zthk2dkh.aspx
+        moveDouble(arg1, FPRInfo::argumentFPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+#else
+        moveDouble(arg1, FPRInfo::argumentFPR0);
+        move(arg2, GPRInfo::argumentGPR1);
+#endif
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, FPRReg arg3)
+    {
+#if OS(WINDOWS) && CPU(X86_64)
+        // On Windows, arguments map to designated registers based on the argument positions, even when there are interlaced scalar and floating point arguments.
+        // See http://msdn.microsoft.com/en-us/library/zthk2dkh.aspx
+        moveDouble(arg3, FPRInfo::argumentFPR3);
+#else
+        moveDouble(arg3, FPRInfo::argumentFPR0);
+#endif
+        setupStubArguments(arg1, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+#elif CPU(ARM)
+#if CPU(ARM_HARDFP)
+    ALWAYS_INLINE void setupArguments(FPRReg arg1)
+    {
+        moveDouble(arg1, FPRInfo::argumentFPR0);
+    }
+
+    ALWAYS_INLINE void setupArguments(FPRReg arg1, FPRReg arg2)
+    {
+        if (arg2 != FPRInfo::argumentFPR0) {
+            moveDouble(arg1, FPRInfo::argumentFPR0);
+            moveDouble(arg2, FPRInfo::argumentFPR1);
+        } else if (arg1 != FPRInfo::argumentFPR1) {
+            moveDouble(arg2, FPRInfo::argumentFPR1);
+            moveDouble(arg1, FPRInfo::argumentFPR0);
+        } else {
+            // Swap arg1, arg2.
+            moveDouble(FPRInfo::argumentFPR0, ARMRegisters::d2);
+            moveDouble(FPRInfo::argumentFPR1, FPRInfo::argumentFPR0);
+            moveDouble(ARMRegisters::d2, FPRInfo::argumentFPR1);
+        }
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(FPRReg arg1, GPRReg arg2)
+    {
+        moveDouble(arg1, FPRInfo::argumentFPR0);
+        move(arg2, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, FPRReg arg3)
+    {
+        moveDouble(arg3, FPRInfo::argumentFPR0);
+        setupStubArguments(arg1, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32, FPRReg arg2, GPRReg arg3)
+    {
+        moveDouble(arg2, FPRInfo::argumentFPR0);
+        move(arg3, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32, FPRReg arg4)
+    {
+        moveDouble(arg4, FPRInfo::argumentFPR0);
+        setupStubArguments(arg1, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+#else
+    ALWAYS_INLINE void setupArguments(FPRReg arg1)
+    {
+        assembler().vmov(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, arg1);
+    }
+
+    ALWAYS_INLINE void setupArguments(FPRReg arg1, FPRReg arg2)
+    {
+        assembler().vmov(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, arg1);
+        assembler().vmov(GPRInfo::argumentGPR2, GPRInfo::argumentGPR3, arg2);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(FPRReg arg1, GPRReg arg2)
+    {
+        move(arg2, GPRInfo::argumentGPR3);
+        assembler().vmov(GPRInfo::argumentGPR1, GPRInfo::argumentGPR2, arg1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, FPRReg arg3)
+    {
+        setupStubArguments(arg1, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+        assembler().vmov(GPRInfo::argumentGPR3, GPRInfo::nonArgGPR0, arg3);
+        poke(GPRInfo::nonArgGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, FPRReg arg2, GPRReg arg3)
+    {
+        poke(arg3, POKE_ARGUMENT_OFFSET);
+        move(arg1, GPRInfo::argumentGPR1);
+        assembler().vmov(GPRInfo::argumentGPR2, GPRInfo::argumentGPR3, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, FPRReg arg4)
+    {
+        setupStubArguments(arg1, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+        move(arg3, GPRInfo::argumentGPR3);
+        assembler().vmov(GPRInfo::nonArgGPR0, GPRInfo::nonArgGPR1, arg4);
+        poke(GPRInfo::nonArgGPR0, POKE_ARGUMENT_OFFSET);
+        poke(GPRInfo::nonArgGPR1, POKE_ARGUMENT_OFFSET + 1);
+    }
+#endif // CPU(ARM_HARDFP)
+#elif CPU(MIPS)
+    ALWAYS_INLINE void setupArguments(FPRReg arg1)
+    {
+        moveDouble(arg1, FPRInfo::argumentFPR0);
+    }
+
+    ALWAYS_INLINE void setupArguments(FPRReg arg1, FPRReg arg2)
+    {
+        if (arg2 != FPRInfo::argumentFPR0) {
+            moveDouble(arg1, FPRInfo::argumentFPR0);
+            moveDouble(arg2, FPRInfo::argumentFPR1);
+        } else if (arg1 != FPRInfo::argumentFPR1) {
+            moveDouble(arg2, FPRInfo::argumentFPR1);
+            moveDouble(arg1, FPRInfo::argumentFPR0);
+        } else {
+            // Swap arg1, arg2.
+            swapDouble(FPRInfo::argumentFPR0, FPRInfo::argumentFPR1);
+        }
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(FPRReg arg1, GPRReg arg2)
+    {
+        assembler().vmov(GPRInfo::argumentGPR2, GPRInfo::argumentGPR3, arg1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+        poke(arg2, 4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, FPRReg arg3)
+    {
+        setupStubArguments(arg1, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+        poke(arg3, 4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32, FPRReg arg2, GPRReg arg3)
+    {
+        setupArgumentsWithExecState(arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32, FPRReg arg4)
+    {
+        setupArgumentsWithExecState(arg1, arg2, arg4);
+    }
+#elif CPU(SH4)
+    ALWAYS_INLINE void setupArguments(FPRReg arg1)
+    {
+        moveDouble(arg1, FPRInfo::argumentFPR0);
+    }
+
+    ALWAYS_INLINE void setupArguments(FPRReg arg1, FPRReg arg2)
+    {
+        if (arg2 != FPRInfo::argumentFPR0) {
+            moveDouble(arg1, FPRInfo::argumentFPR0);
+            moveDouble(arg2, FPRInfo::argumentFPR1);
+        } else if (arg1 != FPRInfo::argumentFPR1) {
+            moveDouble(arg2, FPRInfo::argumentFPR1);
+            moveDouble(arg1, FPRInfo::argumentFPR0);
+        } else
+            swapDouble(FPRInfo::argumentFPR0, FPRInfo::argumentFPR1);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(FPRReg arg1, GPRReg arg2)
+    {
+        moveDouble(arg1, FPRInfo::argumentFPR0);
+        move(arg2, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, FPRReg arg3)
+    {
+        moveDouble(arg3, FPRInfo::argumentFPR0);
+        setupStubArguments(arg1, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+#else
+#error "JIT not supported on this platform."
+#endif
+
+    ALWAYS_INLINE void setupArguments(GPRReg arg1)
+    {
+        move(arg1, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArguments(TrustedImmPtr arg1, GPRReg arg2)
+    {
+        move(arg2, GPRInfo::argumentGPR1);
+        move(arg1, GPRInfo::argumentGPR0);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR1>(arg1, arg2);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, GPRInfo::argumentGPR2>(arg1, arg2, arg3);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImmPtr arg4)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR1>(arg1, arg2);
+        move(arg3, GPRInfo::argumentGPR2);
+        move(arg4, GPRInfo::argumentGPR3);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, GPRInfo::argumentGPR2>(arg1, arg2, arg3);
+        move(arg4, GPRInfo::argumentGPR3);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, TrustedImmPtr arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR2>(arg1, arg3);
+        move(arg2, GPRInfo::argumentGPR1);
+        move(arg4, GPRInfo::argumentGPR3);
+    }
+    
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4, GPRReg arg5, GPRReg arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg5, POKE_ARGUMENT_OFFSET);
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR1>(arg1, arg2);
+        move(arg3, GPRInfo::argumentGPR2);
+        move(arg4, GPRInfo::argumentGPR3);
+    }
+
+    ALWAYS_INLINE void setupArguments(TrustedImmPtr arg1)
+    {
+        move(arg1, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsExecState()
+    {
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+#if OS(WINDOWS) && CPU(X86_64)
+    ALWAYS_INLINE void setupArgumentsWithExecStateForCallWithSlowPathReturnType(TrustedImm32 arg1)
+    {
+        move(arg1, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+    }
+#endif
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2)
+    {
+        setupStubArguments(arg1, arg2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+#if CPU(X86_64) || CPU(ARM64)
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm64 arg2)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm64 arg1, GPRReg arg2)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // Move this first, so setting arg1 does not trample!
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+#endif
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, ImmPtr arg2)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // Move this first, so setting arg1 does not trample!
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // Move this first, so setting arg1 does not trample!
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(ImmPtr arg1, GPRReg arg2)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // Move this first, so setting arg1 does not trample!
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImm32 arg2)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImmPtr arg2)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImm32 arg2)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImm32 arg2, GPRReg arg3)
+    {
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImm32 arg2, TrustedImm32 arg3)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3)
+    {
+        setupStubArguments(arg1, arg2, arg3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3)
+    {
+        setupStubArguments(arg1, arg2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, GPRReg arg3)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR3>(arg1, arg3);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, GPRReg arg3)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR3>(arg1, arg3);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, TrustedImmPtr arg3)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImm32 arg3)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, TrustedImm32 arg3)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImmPtr arg3)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3)
+    {
+        setupStubArguments(arg1, arg2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImm32 arg2, GPRReg arg3)
+    {
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImmPtr arg2, GPRReg arg3)
+    {
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3)
+    {
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, TrustedImm32 arg3)
+    {
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3)
+    {
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR2, GPRInfo::argumentGPR3>(arg2, arg3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR2, GPRInfo::argumentGPR3>(arg2, arg3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImm32 arg3)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // In case arg2 is argumentGPR1.
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImmPtr arg3)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // In case arg2 is argumentGPR1.
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImmPtr arg2, TrustedImm32 arg3)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImmPtr arg2, TrustedImmPtr arg3)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImm32 arg2, TrustedImm32 arg3)
+    {
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+#endif // NUMBER_OF_ARGUMENT_REGISTERS >= 4
+    // These methods are suitable for any calling convention that provides for
+    // exactly 4 argument registers, e.g. ARMv7.
+#if NUMBER_OF_ARGUMENT_REGISTERS == 4
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImmPtr arg5, TrustedImmPtr arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImmPtr arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, GPRReg arg3,  GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImm32 arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImm32 arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+#if CPU(X86_64)
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm64 arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+#endif
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImmPtr arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5, TrustedImm32 arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImmPtr arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImm32 arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, TrustedImmPtr arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImm32 arg2, GPRReg arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImmPtr arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+    
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImmPtr arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImmPtr arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImm32 arg2, GPRReg arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImmPtr arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3, GPRReg arg4)
+    {
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImm32 arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, TrustedImmPtr arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4, TrustedImmPtr arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, TrustedImm32 arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5, TrustedImm32 arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6, TrustedImmPtr arg7)
+    {
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, GPRReg arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, TrustedImm32 arg5, TrustedImmPtr arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, TrustedImmPtr arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImm32 arg5, TrustedImmPtr arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, TrustedImm32 arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, GPRReg arg5, GPRReg arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, GPRReg arg5, TrustedImm32 arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, TrustedImmPtr arg6)
+    {
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6, GPRReg arg7)
+    {
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6, GPRReg arg7)
+    {
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, TrustedImmPtr arg6, TrustedImmPtr arg7)
+    {
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6, GPRReg arg7, TrustedImmPtr arg8)
+    {
+        poke(arg8, POKE_ARGUMENT_OFFSET + 4);
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6, GPRReg arg7, GPRReg arg8)
+    {
+        poke(arg8, POKE_ARGUMENT_OFFSET + 4);
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5, GPRReg arg6, GPRReg arg7, GPRReg arg8, GPRReg arg9)
+    {
+        poke(arg9, POKE_ARGUMENT_OFFSET + 5);
+        poke(arg8, POKE_ARGUMENT_OFFSET + 4);
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImm32 arg5, GPRReg arg6, GPRReg arg7)
+    {
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, TrustedImm32 arg5, GPRReg arg6, GPRReg arg7)
+    {
+        poke(arg7, POKE_ARGUMENT_OFFSET + 3);
+        poke(arg6, POKE_ARGUMENT_OFFSET + 2);
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET);
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR1>(arg1, arg2);
+        move(arg3, GPRInfo::argumentGPR2);
+        move(arg4, GPRInfo::argumentGPR3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImmPtr arg4, GPRReg arg5)
+    {
+        poke(arg5, POKE_ARGUMENT_OFFSET + 1);
+        poke(arg4, POKE_ARGUMENT_OFFSET);
+        setupArgumentsWithExecState(arg1, arg2, arg3);
+    }
+#endif // NUMBER_OF_ARGUMENT_REGISTERS == 4
+
+#if NUMBER_OF_ARGUMENT_REGISTERS >= 5
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4)
+    {
+        setupFourStubArgsGPR(GPRInfo::argumentGPR1, GPRInfo::argumentGPR2, GPRInfo::argumentGPR3, GPRInfo::argumentGPR4, arg1, arg2, arg3, arg4);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    void setupStubArguments134(GPRReg arg1, GPRReg arg3, GPRReg arg4)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR3, GPRInfo::argumentGPR4>(arg1, arg3, arg4);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR2, GPRInfo::argumentGPR3>(arg1, arg2, arg3);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImm32 arg3, GPRReg arg4)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR4>(arg1, arg4);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR2>(arg1, arg2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImmPtr arg4)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR2>(arg1, arg2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, TrustedImm32 arg3, GPRReg arg4, GPRReg arg5)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR4, GPRInfo::argumentGPR5>(arg1, arg4, arg5);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, GPRReg arg4, GPRReg arg5)
+    {
+        setupFiveStubArgsGPR(GPRInfo::argumentGPR1, GPRInfo::argumentGPR2, GPRInfo::argumentGPR3, GPRInfo::argumentGPR4, GPRInfo::argumentGPR5, arg1, arg2, arg3, arg4, arg5);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, TrustedImmPtr arg2, GPRReg arg3, GPRReg arg4)
+    {
+        setupStubArguments134(arg1, arg3, arg4);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR2, GPRInfo::argumentGPR3>(arg2, arg3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImm32 arg3, TrustedImm32 arg4)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // In case arg2 is argumentGPR1.
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm64 arg4)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // In case arg2 is argumentGPR1.
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        move(arg2, GPRInfo::argumentGPR2); // In case arg2 is argumentGPR1.
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(arg5, GPRInfo::argumentGPR5);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(arg5, GPRInfo::argumentGPR5);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4, TrustedImm32 arg5)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR2, GPRInfo::argumentGPR4>(arg2, arg4);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg5, GPRInfo::argumentGPR5);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImmPtr arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4, TrustedImm32 arg5)
+    {
+        setupTwoStubArgsGPR<GPRInfo::argumentGPR2, GPRInfo::argumentGPR3>(arg2, arg3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(arg5, GPRInfo::argumentGPR5);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImm32 arg4)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR2, GPRInfo::argumentGPR3>(arg1, arg2, arg3);
+        move(arg4, GPRInfo::argumentGPR4);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, TrustedImm32 arg3, GPRReg arg4)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR1, GPRInfo::argumentGPR2, GPRInfo::argumentGPR4>(arg1, arg2, arg4);
+        move(arg3, GPRInfo::argumentGPR3);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, TrustedImmPtr arg2, GPRReg arg3, GPRReg arg4, TrustedImmPtr arg5)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR2, GPRInfo::argumentGPR3>(arg1, arg3, arg4);
+        move(arg2, GPRInfo::argumentGPR1);
+        move(arg5, GPRInfo::argumentGPR4);
+    }
+
+    ALWAYS_INLINE void setupArguments(GPRReg arg1, GPRReg arg2, TrustedImmPtr arg3, TrustedImm32 arg4, GPRReg arg5)
+    {
+        setupThreeStubArgsGPR<GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, GPRInfo::argumentGPR4>(arg1, arg2, arg5);
+        move(arg3, GPRInfo::argumentGPR2);
+        move(arg4, GPRInfo::argumentGPR3);
+    }
+#endif
+
+    void setupArgumentsWithExecState(JSValueRegs arg)
+    {
+#if USE(JSVALUE64)
+        setupArgumentsWithExecState(arg.gpr());
+#else
+        setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg.payloadGPR(), arg.tagGPR());
+#endif
+    }
+    
+    void setupArgumentsWithExecState(JSValueRegs arg1, JSValueRegs arg2)
+    {
+#if USE(JSVALUE64)
+        setupArgumentsWithExecState(arg1.gpr(), arg2.gpr());
+#else
+        setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR());
+#endif
+    }
+
+    void setupArgumentsWithExecState(JSValueRegs arg1, TrustedImmPtr arg2)
+    {
+#if USE(JSVALUE64)
+        setupArgumentsWithExecState(arg1.gpr(), arg2);
+#else
+        setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2);
+#endif
+    }
+
+    void setupArgumentsWithExecState(JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr arg3)
+    {
+#if USE(JSVALUE64)
+        setupArgumentsWithExecState(arg1.gpr(), arg2.gpr(), arg3);
+#else
+        setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR(), arg3);
+#endif
+    }
+
+    void setupArgumentsWithExecState(JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr arg3, TrustedImmPtr arg4)
+    {
+#if USE(JSVALUE64)
+        setupArgumentsWithExecState(arg1.gpr(), arg2.gpr(), arg3, arg4);
+#else
+        setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2.payloadGPR(), arg2.tagGPR(), arg3, arg4);
+#endif
+    }
+
+    void setupArgumentsWithExecState(JSValueRegs arg1, TrustedImmPtr arg2, TrustedImmPtr arg3)
+    {
+#if USE(JSVALUE64)
+        setupArgumentsWithExecState(arg1.gpr(), arg2, arg3);
+#else
+        setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1.payloadGPR(), arg1.tagGPR(), arg2, arg3);
+#endif
+    }
+    
+    void setupArguments(JSValueRegs arg1)
+    {
+#if USE(JSVALUE64)
+        setupArguments(arg1.gpr());
+#else
+        setupArguments(arg1.payloadGPR(), arg1.tagGPR());
+#endif
+    }
+
+    void setupResults(GPRReg destA, GPRReg destB)
+    {
+        GPRReg srcA = GPRInfo::returnValueGPR;
+        GPRReg srcB = GPRInfo::returnValueGPR2;
+
+        if (destA == InvalidGPRReg)
+            move(srcB, destB);
+        else if (destB == InvalidGPRReg)
+            move(srcA, destA);
+        else if (srcB != destA) {
+            // Handle the easy cases - two simple moves.
+            move(srcA, destA);
+            move(srcB, destB);
+        } else if (srcA != destB) {
+            // Handle the non-swap case - just put srcB in place first.
+            move(srcB, destB);
+            move(srcA, destA);
+        } else
+            swap(destA, destB);
+    }
+    
+    void setupResults(JSValueRegs regs)
+    {
+#if USE(JSVALUE64)
+        move(GPRInfo::returnValueGPR, regs.gpr());
+#else
+        setupResults(regs.payloadGPR(), regs.tagGPR());
+#endif
+    }
+    
+    void jumpToExceptionHandler()
+    {
+        // genericUnwind() leaves the handler CallFrame* in vm->callFrameForCatch,
+        // and the address of the handler in vm->targetMachinePCForThrow.
+        loadPtr(&vm()->targetMachinePCForThrow, GPRInfo::regT1);
+        jump(GPRInfo::regT1);
+    }
+
+    void prepareForTailCallSlow(GPRReg calleeGPR = InvalidGPRReg)
+    {
+        GPRReg temp1 = calleeGPR == GPRInfo::regT0 ? GPRInfo::regT3 : GPRInfo::regT0;
+        GPRReg temp2 = calleeGPR == GPRInfo::regT1 ? GPRInfo::regT3 : GPRInfo::regT1;
+        GPRReg temp3 = calleeGPR == GPRInfo::regT2 ? GPRInfo::regT3 : GPRInfo::regT2;
+
+        GPRReg newFramePointer = temp1;
+        GPRReg newFrameSizeGPR = temp2;
+        {
+            // The old frame size is its number of arguments (or number of
+            // parameters in case of arity fixup), plus the frame header size,
+            // aligned
+            GPRReg oldFrameSizeGPR = temp2;
+            {
+                GPRReg argCountGPR = oldFrameSizeGPR;
+                load32(Address(framePointerRegister, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset), argCountGPR);
+
+                {
+                    GPRReg numParametersGPR = temp1;
+                    {
+                        GPRReg codeBlockGPR = numParametersGPR;
+                        loadPtr(Address(framePointerRegister, CallFrameSlot::codeBlock * static_cast<int>(sizeof(Register))), codeBlockGPR);
+                        load32(Address(codeBlockGPR, CodeBlock::offsetOfNumParameters()), numParametersGPR);
+                    }
+
+                    ASSERT(numParametersGPR != argCountGPR);
+                    Jump argumentCountWasNotFixedUp = branch32(BelowOrEqual, numParametersGPR, argCountGPR);
+                    move(numParametersGPR, argCountGPR);
+                    argumentCountWasNotFixedUp.link(this);
+                }
+
+                add32(TrustedImm32(stackAlignmentRegisters() + CallFrame::headerSizeInRegisters - 1), argCountGPR, oldFrameSizeGPR);
+                and32(TrustedImm32(-stackAlignmentRegisters()), oldFrameSizeGPR);
+                // We assume < 2^28 arguments
+                mul32(TrustedImm32(sizeof(Register)), oldFrameSizeGPR, oldFrameSizeGPR);
+            }
+
+            // The new frame pointer is at framePointer + oldFrameSize - newFrameSize
+            ASSERT(newFramePointer != oldFrameSizeGPR);
+            addPtr(framePointerRegister, oldFrameSizeGPR, newFramePointer);
+
+            // The new frame size is just the number of arguments plus the
+            // frame header size, aligned
+            ASSERT(newFrameSizeGPR != newFramePointer);
+            load32(Address(stackPointerRegister, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset - sizeof(CallerFrameAndPC)),
+                newFrameSizeGPR);
+            add32(TrustedImm32(stackAlignmentRegisters() + CallFrame::headerSizeInRegisters - 1), newFrameSizeGPR);
+            and32(TrustedImm32(-stackAlignmentRegisters()), newFrameSizeGPR);
+            // We assume < 2^28 arguments
+            mul32(TrustedImm32(sizeof(Register)), newFrameSizeGPR, newFrameSizeGPR);
+        }
+
+        GPRReg tempGPR = temp3;
+        ASSERT(tempGPR != newFramePointer && tempGPR != newFrameSizeGPR);
+
+        // We don't need the current frame beyond this point. Masquerade as our
+        // caller.
+#if CPU(ARM) || CPU(SH4) || CPU(ARM64)
+        loadPtr(Address(framePointerRegister, sizeof(void*)), linkRegister);
+        subPtr(TrustedImm32(2 * sizeof(void*)), newFrameSizeGPR);
+#elif CPU(MIPS)
+        loadPtr(Address(framePointerRegister, sizeof(void*)), returnAddressRegister);
+        subPtr(TrustedImm32(2 * sizeof(void*)), newFrameSizeGPR);
+#elif CPU(X86) || CPU(X86_64)
+        loadPtr(Address(framePointerRegister, sizeof(void*)), tempGPR);
+        push(tempGPR);
+        subPtr(TrustedImm32(sizeof(void*)), newFrameSizeGPR);
+#else
+        UNREACHABLE_FOR_PLATFORM();
+#endif
+        subPtr(newFrameSizeGPR, newFramePointer);
+        loadPtr(Address(framePointerRegister), framePointerRegister);
+
+
+        // We need to move the newFrameSizeGPR slots above the stack pointer by
+        // newFramePointer registers. We use pointer-sized chunks.
+        MacroAssembler::Label copyLoop(label());
+
+        subPtr(TrustedImm32(sizeof(void*)), newFrameSizeGPR);
+        loadPtr(BaseIndex(stackPointerRegister, newFrameSizeGPR, TimesOne), tempGPR);
+        storePtr(tempGPR, BaseIndex(newFramePointer, newFrameSizeGPR, TimesOne));
+
+        branchTest32(MacroAssembler::NonZero, newFrameSizeGPR).linkTo(copyLoop, this);
+
+        // Ready for a jump!
+        move(newFramePointer, stackPointerRegister);
+    }
+
+#if NUMBER_OF_ARGUMENT_REGISTERS >= 4
+    template<unsigned NumberOfRegisters>
+    void setupStubArgsGPR(std::array<GPRReg, NumberOfRegisters> destinations, std::array<GPRReg, NumberOfRegisters> sources)
+    {
+        if (!ASSERT_DISABLED) {
+            RegisterSet set;
+            for (GPRReg dest : destinations)
+                set.set(dest);
+            ASSERT_WITH_MESSAGE(set.numberOfSetGPRs() == NumberOfRegisters, "Destinations should not be aliased.");
+        }
+
+        typedef std::pair<GPRReg, GPRReg> RegPair;
+        Vector<RegPair, NumberOfRegisters> pairs;
+
+        for (unsigned i = 0; i < NumberOfRegisters; ++i) {
+            if (sources[i] != destinations[i])
+                pairs.append(std::make_pair(sources[i], destinations[i]));
+        }
+
+#if !ASSERT_DISABLED
+        auto numUniqueSources = [&] () -> unsigned {
+            RegisterSet set;
+            for (auto& pair : pairs) {
+                GPRReg source = pair.first;
+                set.set(source);
+            }
+            return set.numberOfSetGPRs();
+        };
+
+        auto numUniqueDests = [&] () -> unsigned {
+            RegisterSet set;
+            for (auto& pair : pairs) {
+                GPRReg dest = pair.second;
+                set.set(dest);
+            }
+            return set.numberOfSetGPRs();
+        };
+#endif
+
+        while (pairs.size()) {
+            RegisterSet freeDestinations;
+            for (auto& pair : pairs) {
+                GPRReg dest = pair.second;
+                freeDestinations.set(dest);
+            }
+            for (auto& pair : pairs) {
+                GPRReg source = pair.first;
+                freeDestinations.clear(source);
+            }
+
+            if (freeDestinations.numberOfSetGPRs()) {
+                bool madeMove = false;
+                for (unsigned i = 0; i < pairs.size(); i++) {
+                    auto& pair = pairs[i];
+                    GPRReg source = pair.first;
+                    GPRReg dest = pair.second;
+                    if (freeDestinations.get(dest)) {
+                        move(source, dest);
+                        pairs.remove(i);
+                        madeMove = true;
+                        break;
+                    }
+                }
+                ASSERT_UNUSED(madeMove, madeMove);
+                continue;
+            }
+
+            ASSERT(numUniqueDests() == numUniqueSources());
+            ASSERT(numUniqueDests() == pairs.size());
+            // The set of source and destination registers are equivalent sets. This means we don't have
+            // any free destination registers that won't also clobber a source. We get around this by
+            // exchanging registers.
+
+            GPRReg source = pairs[0].first;
+            GPRReg dest = pairs[0].second;
+            swap(source, dest);
+            pairs.remove(0);
+
+            GPRReg newSource = source;
+            for (auto& pair : pairs) {
+                GPRReg source = pair.first;
+                if (source == dest) {
+                    pair.first = newSource;
+                    break;
+                }
+            }
+
+            // We may have introduced pairs that have the same source and destination. Remove those now.
+            for (unsigned i = 0; i < pairs.size(); i++) {
+                auto& pair = pairs[i];
+                if (pair.first == pair.second) {
+                    pairs.remove(i);
+                    i--;
+                }
+            }
+        }
+    }
+#endif // NUMBER_OF_ARGUMENT_REGISTERS >= 4
+    
+    // These operations clobber all volatile registers. They assume that there is room on the top of
+    // stack to marshall call arguments.
+    void logShadowChickenProloguePacket(GPRReg shadowPacket, GPRReg scratch1, GPRReg scope);
+    void logShadowChickenTailPacket(GPRReg shadowPacket, JSValueRegs thisRegs, GPRReg scope, CodeBlock*, CallSiteIndex);
+    // Leaves behind a pointer to the Packet we should write to in shadowPacket.
+    void ensureShadowChickenPacket(GPRReg shadowPacket, GPRReg scratch1NonArgGPR, GPRReg scratch2);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CachedRecovery.cpp b/jit/CachedRecovery.cpp
new file mode 100644
index 0000000..f4aacc6
--- /dev/null
+++ b/jit/CachedRecovery.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CachedRecovery.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+// We prefer loading doubles and undetermined JSValues into FPRs
+// because it would otherwise use up GPRs.  Two in JSVALUE32_64.
+bool CachedRecovery::loadsIntoFPR() const
+{
+    switch (recovery().technique()) {
+    case DoubleDisplacedInJSStack:
+    case DisplacedInJSStack:
+#if USE(JSVALUE64)
+    case CellDisplacedInJSStack:
+#endif
+        return true;
+
+    default:
+        return false;
+    }
+}
+
+// Integers, booleans and cells can be loaded into GPRs
+bool CachedRecovery::loadsIntoGPR() const
+{
+    switch (recovery().technique()) {
+    case Int32DisplacedInJSStack:
+#if USE(JSVALUE64)
+    case Int52DisplacedInJSStack:
+    case StrictInt52DisplacedInJSStack:
+    case DisplacedInJSStack:
+#endif
+    case BooleanDisplacedInJSStack:
+    case CellDisplacedInJSStack:
+        return true;
+
+    default:
+        return false;
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CachedRecovery.h b/jit/CachedRecovery.h
new file mode 100644
index 0000000..f627ac9
--- /dev/null
+++ b/jit/CachedRecovery.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "ValueRecovery.h"
+#include "VirtualRegister.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+// A CachedRecovery is a wrapper around a ValueRecovery that records where said
+// value should go on the stack and/or in registers. Whenever we perform an
+// operation changing the ValueRecovery, we update the CachedRecovery's member
+// in place.
+class CachedRecovery {
+public:
+    CachedRecovery(ValueRecovery recovery)
+        : m_recovery { recovery }
+    {
+    }
+
+    CachedRecovery(CachedRecovery&) = delete;
+    CachedRecovery(CachedRecovery&&) = delete;
+    CachedRecovery& operator=(CachedRecovery&) = delete;
+    CachedRecovery& operator=(CachedRecovery&&) = delete;
+
+    const Vector<VirtualRegister, 1>& targets() const { return m_targets; }
+
+    void addTarget(VirtualRegister reg)
+    {
+        ASSERT(m_targets.isEmpty() || m_targets.last() < reg);
+        m_targets.append(reg);
+    }
+
+    void removeTarget(VirtualRegister reg)
+    {
+        ASSERT_UNUSED(reg, m_targets.last() == reg);
+        m_targets.shrink(m_targets.size() - 1);
+    }
+
+    void clearTargets()
+    {
+        m_targets.clear();
+    }
+
+    void setWantedJSValueRegs(JSValueRegs jsValueRegs)
+    {
+        ASSERT(m_wantedFPR == InvalidFPRReg);
+        m_wantedJSValueRegs = jsValueRegs;
+    }
+
+    void setWantedFPR(FPRReg fpr)
+    {
+        ASSERT(!m_wantedJSValueRegs);
+        m_wantedFPR = fpr;
+    }
+
+    // Determine whether converting this recovery into a JSValue will
+    // require additional GPRs and/or FPRs.
+    // This is guaranteed to only depend on the DataFormat, and the
+    // result of these calls will stay valid after loads and/or stores.
+    bool boxingRequiresGPR() const
+    {
+#if USE(JSVALUE64)
+        return recovery().dataFormat() == DataFormatDouble;
+#else
+        return false;
+#endif
+    }
+    bool boxingRequiresFPR() const
+    {
+#if USE(JSVALUE64)
+        switch (recovery().dataFormat()) {
+        case DataFormatInt52:
+        case DataFormatStrictInt52:
+            return true;
+
+        default:
+            return false;
+        }
+#else
+        return false;
+#endif
+    }
+    
+    // This is used to determine what kind of register we need to be
+    // able to load a recovery. We only use it when a direct load is
+    // currently impossible, to determine whether we should spill a
+    // GPR or an FPR for loading this value.
+    bool loadsIntoGPR() const;
+    bool loadsIntoFPR() const;
+
+    ValueRecovery recovery() const { return m_recovery; }
+
+    void setRecovery(ValueRecovery recovery) { m_recovery = recovery; }
+
+    JSValueRegs wantedJSValueRegs() const { return m_wantedJSValueRegs; }
+
+    FPRReg wantedFPR() const { return m_wantedFPR; }
+private:
+    ValueRecovery m_recovery;
+    JSValueRegs m_wantedJSValueRegs;
+    FPRReg m_wantedFPR { InvalidFPRReg };
+    Vector<VirtualRegister, 1> m_targets;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CallFrameShuffleData.cpp b/jit/CallFrameShuffleData.cpp
new file mode 100644
index 0000000..567202c
--- /dev/null
+++ b/jit/CallFrameShuffleData.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallFrameShuffleData.h"
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "CodeBlock.h"
+
+namespace JSC {
+
+#if USE(JSVALUE64)
+
+void CallFrameShuffleData::setupCalleeSaveRegisters(CodeBlock* codeBlock)
+{
+    RegisterSet calleeSaveRegisters { RegisterSet::vmCalleeSaveRegisters() };
+    RegisterAtOffsetList* registerSaveLocations = codeBlock->calleeSaveRegisters();
+
+    for (size_t i = 0; i < registerSaveLocations->size(); ++i) {
+        RegisterAtOffset entry { registerSaveLocations->at(i) };
+        if (!calleeSaveRegisters.get(entry.reg()))
+            continue;
+
+        VirtualRegister saveSlot { entry.offsetAsIndex() };
+        registers[entry.reg()]
+            = ValueRecovery::displacedInJSStack(saveSlot, DataFormatJS);
+    }
+
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        if (!calleeSaveRegisters.get(reg))
+            continue;
+
+        if (registers[reg])
+            continue;
+
+        registers[reg] = ValueRecovery::inRegister(reg, DataFormatJS);
+    }
+}
+
+#endif // USE(JSVALUE64)
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CallFrameShuffleData.h b/jit/CallFrameShuffleData.h
new file mode 100644
index 0000000..7e3ad5f
--- /dev/null
+++ b/jit/CallFrameShuffleData.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "RegisterMap.h"
+#include "ValueRecovery.h"
+
+namespace JSC {
+
+struct CallFrameShuffleData {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    unsigned numLocals { UINT_MAX };
+    ValueRecovery callee;
+    Vector<ValueRecovery> args;
+    unsigned numPassedArgs { UINT_MAX };
+#if USE(JSVALUE64)
+    RegisterMap<ValueRecovery> registers;
+    GPRReg tagTypeNumber { InvalidGPRReg };
+
+    void setupCalleeSaveRegisters(CodeBlock*);
+#endif
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CallFrameShuffler.cpp b/jit/CallFrameShuffler.cpp
new file mode 100644
index 0000000..9203e43
--- /dev/null
+++ b/jit/CallFrameShuffler.cpp
@@ -0,0 +1,776 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallFrameShuffler.h"
+
+#if ENABLE(JIT)
+
+#include "CachedRecovery.h"
+#include "CCallHelpers.h"
+#include "CodeBlock.h"
+
+namespace JSC {
+
+CallFrameShuffler::CallFrameShuffler(CCallHelpers& jit, const CallFrameShuffleData& data)
+    : m_jit(jit)
+    , m_oldFrame(data.numLocals + CallerFrameAndPC::sizeInRegisters, nullptr)
+    , m_newFrame(data.args.size() + CallFrame::headerSizeInRegisters, nullptr)
+    , m_alignedOldFrameSize(CallFrame::headerSizeInRegisters
+        + roundArgumentCountToAlignFrame(jit.codeBlock()->numParameters()))
+    , m_alignedNewFrameSize(CallFrame::headerSizeInRegisters
+        + roundArgumentCountToAlignFrame(data.args.size()))
+    , m_frameDelta(m_alignedNewFrameSize - m_alignedOldFrameSize)
+    , m_lockedRegisters(RegisterSet::allRegisters())
+    , m_numPassedArgs(data.numPassedArgs)
+{
+    // We are allowed all the usual registers...
+    for (unsigned i = GPRInfo::numberOfRegisters; i--; )
+        m_lockedRegisters.clear(GPRInfo::toRegister(i));
+    for (unsigned i = FPRInfo::numberOfRegisters; i--; )
+        m_lockedRegisters.clear(FPRInfo::toRegister(i));
+    // ... as well as the runtime registers.
+    m_lockedRegisters.exclude(RegisterSet::vmCalleeSaveRegisters());
+
+    ASSERT(!data.callee.isInJSStack() || data.callee.virtualRegister().isLocal());
+    addNew(VirtualRegister(CallFrameSlot::callee), data.callee);
+
+    for (size_t i = 0; i < data.args.size(); ++i) {
+        ASSERT(!data.args[i].isInJSStack() || data.args[i].virtualRegister().isLocal());
+        addNew(virtualRegisterForArgument(i), data.args[i]);
+    }
+
+#if USE(JSVALUE64)
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        if (!data.registers[reg].isSet())
+            continue;
+
+        if (reg.isGPR())
+            addNew(JSValueRegs(reg.gpr()), data.registers[reg]);
+        else
+            addNew(reg.fpr(), data.registers[reg]);
+    }
+
+    m_tagTypeNumber = data.tagTypeNumber;
+    if (m_tagTypeNumber != InvalidGPRReg)
+        lockGPR(m_tagTypeNumber);
+#endif
+}
+
+void CallFrameShuffler::dump(PrintStream& out) const
+{
+    static const char* delimiter             = " +-------------------------------+ ";
+    static const char* dangerDelimiter       = " X-------------------------------X ";
+    static const char* dangerBoundsDelimiter = " XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX ";
+    static const char* emptySpace            = "                                   ";
+    out.print("          ");
+    out.print("           Old frame               ");
+    out.print("           New frame               ");
+    out.print("\n");
+    int totalSize = m_alignedOldFrameSize + std::max(numLocals(), m_alignedNewFrameSize) + 3;
+    for (int i = 0; i < totalSize; ++i) {
+        VirtualRegister old { m_alignedOldFrameSize - i - 1 };
+        VirtualRegister newReg { old + m_frameDelta };
+
+        if (!isValidOld(old) && old != firstOld() - 1
+            && !isValidNew(newReg) && newReg != firstNew() - 1)
+            continue;
+
+        out.print("        ");
+        if (dangerFrontier() >= firstNew()
+            && (newReg == dangerFrontier() || newReg == firstNew() - 1))
+            out.print(dangerBoundsDelimiter);
+        else if (isValidOld(old))
+            out.print(isValidNew(newReg) && isDangerNew(newReg) ? dangerDelimiter : delimiter);
+        else if (old == firstOld() - 1)
+            out.print(delimiter);
+        else
+            out.print(emptySpace);
+        if (dangerFrontier() >= firstNew()
+            && (newReg == dangerFrontier() || newReg == firstNew() - 1))
+            out.print(dangerBoundsDelimiter);
+        else if (isValidNew(newReg) || newReg == firstNew() - 1)
+            out.print(isDangerNew(newReg) ? dangerDelimiter : delimiter);
+        else
+            out.print(emptySpace);
+        out.print("\n");
+        if (old == firstOld())
+            out.print(" sp --> ");
+        else if (!old.offset())
+            out.print(" fp --> ");
+        else
+            out.print("        ");
+        if (isValidOld(old)) {
+            if (getOld(old)) {
+                auto str = toCString(old);
+                if (isValidNew(newReg) && isDangerNew(newReg))
+                    out.printf(" X      %18s       X ", str.data());
+                else
+                    out.printf(" |      %18s       | ", str.data());
+            } else if (isValidNew(newReg) && isDangerNew(newReg))
+                out.printf(" X%30s X ", "");
+            else
+                out.printf(" |%30s | ", "");
+        } else
+            out.print(emptySpace);
+        if (isValidNew(newReg)) {
+            const char d = isDangerNew(newReg) ? 'X' : '|';
+            auto str = toCString(newReg);
+            if (getNew(newReg)) {
+                if (getNew(newReg)->recovery().isConstant())
+                    out.printf(" %c%8s <-           constant %c ", d, str.data(), d);
+                else {
+                    auto recoveryStr = toCString(getNew(newReg)->recovery());
+                    out.printf(" %c%8s <- %18s %c ", d, str.data(),
+                        recoveryStr.data(), d);
+                }
+            } else if (newReg == VirtualRegister { CallFrameSlot::argumentCount })
+                out.printf(" %c%8s <- %18zu %c ", d, str.data(), argCount(), d);
+            else
+                out.printf(" %c%30s %c ", d, "", d);
+        } else
+            out.print(emptySpace);
+        if (newReg == firstNew() - m_newFrameOffset && !isSlowPath())
+            out.print(" <-- new sp before jump (current ", m_newFrameBase, ") ");
+        if (newReg == firstNew())
+            out.print(" <-- new fp after prologue");
+        out.print("\n");
+    }
+    out.print("          ");
+    out.print("        Live registers             ");
+    out.print("        Wanted registers           ");
+    out.print("\n");
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        CachedRecovery* oldCachedRecovery { m_registers[reg] };
+        CachedRecovery* newCachedRecovery { m_newRegisters[reg] };
+        if (!oldCachedRecovery && !newCachedRecovery)
+            continue;
+        out.print("          ");
+        if (oldCachedRecovery) {
+            auto str = toCString(reg);
+            out.printf("         %8s                  ", str.data());
+        } else
+            out.print(emptySpace);
+#if USE(JSVALUE32_64)
+        if (newCachedRecovery) {
+            JSValueRegs wantedJSValueRegs { newCachedRecovery->wantedJSValueRegs() };
+            if (reg.isFPR())
+                out.print(reg, " <- ", newCachedRecovery->recovery());
+            else {
+                if (reg.gpr() == wantedJSValueRegs.tagGPR())
+                    out.print(reg.gpr(), " <- tag(", newCachedRecovery->recovery(), ")");
+                else
+                    out.print(reg.gpr(), " <- payload(", newCachedRecovery->recovery(), ")");
+            }
+        }
+#else
+        if (newCachedRecovery)
+            out.print("         ", reg, " <- ", newCachedRecovery->recovery());
+#endif
+        out.print("\n");
+    }
+    out.print("  Locked registers: ");
+    bool firstLocked { true };
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        if (m_lockedRegisters.get(reg)) {
+            out.print(firstLocked ? "" : ", ", reg);
+            firstLocked = false;
+        }
+    }
+    out.print("\n");
+
+    if (isSlowPath())
+        out.print("  Using fp-relative addressing for slow path call\n");
+    else
+        out.print("  Using sp-relative addressing for jump (using ", m_newFrameBase, " as new sp)\n");
+    if (m_oldFrameOffset)
+        out.print("   Old frame offset is ", m_oldFrameOffset, "\n");
+    if (m_newFrameOffset)
+        out.print("   New frame offset is ", m_newFrameOffset, "\n");
+#if USE(JSVALUE64)
+    if (m_tagTypeNumber != InvalidGPRReg)
+        out.print("   TagTypeNumber is currently in ", m_tagTypeNumber, "\n");
+#endif
+}
+
+CachedRecovery* CallFrameShuffler::getCachedRecovery(ValueRecovery recovery)
+{
+    ASSERT(!recovery.isConstant());
+    if (recovery.isInGPR())
+        return m_registers[recovery.gpr()];
+    if (recovery.isInFPR())
+        return m_registers[recovery.fpr()];
+#if USE(JSVALUE32_64)
+    if (recovery.technique() == InPair) {
+        ASSERT(m_registers[recovery.tagGPR()] == m_registers[recovery.payloadGPR()]);
+        return m_registers[recovery.payloadGPR()];
+    }
+#endif
+    ASSERT(recovery.isInJSStack());
+    return getOld(recovery.virtualRegister());
+}
+
+CachedRecovery* CallFrameShuffler::setCachedRecovery(ValueRecovery recovery, CachedRecovery* cachedRecovery)
+{
+    ASSERT(!recovery.isConstant());
+    if (recovery.isInGPR())
+        return m_registers[recovery.gpr()] = cachedRecovery;
+    if (recovery.isInFPR())
+        return m_registers[recovery.fpr()] = cachedRecovery;
+#if USE(JSVALUE32_64)
+    if (recovery.technique() == InPair) {
+        m_registers[recovery.tagGPR()] = cachedRecovery;
+        return m_registers[recovery.payloadGPR()] = cachedRecovery;
+    }
+#endif
+    ASSERT(recovery.isInJSStack());
+    setOld(recovery.virtualRegister(), cachedRecovery);
+    return cachedRecovery;
+}
+
+void CallFrameShuffler::spill(CachedRecovery& cachedRecovery)
+{
+    ASSERT(!isSlowPath());
+    ASSERT(cachedRecovery.recovery().isInRegisters());
+
+    VirtualRegister spillSlot { 0 };
+    for (VirtualRegister slot = firstOld(); slot <= lastOld(); slot += 1) {
+        if (slot >= newAsOld(firstNew()))
+            break;
+
+        if (getOld(slot))
+            continue;
+
+        spillSlot = slot;
+        break;
+    }
+    // We must have enough slots to be able to fit the whole callee's
+    // frame for the slow path - unless we are in the FTL. In that
+    // case, we are allowed to extend the frame *once*, since we are
+    // guaranteed to have enough available space for that.
+    if (spillSlot >= newAsOld(firstNew()) || !spillSlot.isLocal()) {
+        RELEASE_ASSERT(!m_didExtendFrame);
+        extendFrameIfNeeded();
+        spill(cachedRecovery);
+        return;
+    }
+
+    if (verbose)
+        dataLog("   * Spilling ", cachedRecovery.recovery(), " into ", spillSlot, "\n");
+    auto format = emitStore(cachedRecovery, addressForOld(spillSlot));
+    ASSERT(format != DataFormatNone);
+    updateRecovery(cachedRecovery, ValueRecovery::displacedInJSStack(spillSlot, format));
+}
+
+void CallFrameShuffler::emitDeltaCheck()
+{
+    if (ASSERT_DISABLED)
+        return;
+
+    GPRReg scratchGPR { getFreeGPR() };
+    if (scratchGPR != InvalidGPRReg) {
+        if (verbose)
+            dataLog("  Using ", scratchGPR, " for the fp-sp delta check\n");
+        m_jit.move(MacroAssembler::stackPointerRegister, scratchGPR);
+        m_jit.subPtr(GPRInfo::callFrameRegister, scratchGPR);
+        MacroAssembler::Jump ok = m_jit.branch32(
+            MacroAssembler::Equal, scratchGPR,
+            MacroAssembler::TrustedImm32(-numLocals() * sizeof(Register)));
+        m_jit.abortWithReason(JITUnexpectedCallFrameSize);
+        ok.link(&m_jit);
+    } else if (verbose)
+        dataLog("  Skipping the fp-sp delta check since there is too much pressure");
+}
+
+void CallFrameShuffler::extendFrameIfNeeded()
+{
+    ASSERT(!m_didExtendFrame);
+
+    VirtualRegister firstRead { firstOld() };
+    for (; firstRead <= virtualRegisterForLocal(0); firstRead += 1) {
+        if (getOld(firstRead))
+            break;
+    }
+    size_t availableSize = static_cast<size_t>(firstRead.offset() - firstOld().offset());
+    size_t wantedSize = m_newFrame.size() + m_newFrameOffset;
+
+    if (availableSize < wantedSize) {
+        size_t delta = WTF::roundUpToMultipleOf(stackAlignmentRegisters(), wantedSize - availableSize);
+        m_oldFrame.grow(m_oldFrame.size() + delta);
+        for (size_t i = 0; i < delta; ++i)
+            m_oldFrame[m_oldFrame.size() - i - 1] = nullptr;
+        m_jit.subPtr(MacroAssembler::TrustedImm32(delta * sizeof(Register)), MacroAssembler::stackPointerRegister);
+
+        if (isSlowPath())
+            m_frameDelta = numLocals() + CallerFrameAndPC::sizeInRegisters;
+        else
+            m_oldFrameOffset = numLocals();
+
+        if (verbose)
+            dataLogF("  Not enough space - extending the old frame %zu slot\n", delta);
+    }
+
+    m_didExtendFrame = true;
+}
+
+void CallFrameShuffler::prepareForSlowPath()
+{
+    ASSERT(isUndecided());
+    emitDeltaCheck();
+
+    m_frameDelta = numLocals() + CallerFrameAndPC::sizeInRegisters;
+    m_newFrameBase = MacroAssembler::stackPointerRegister;
+    m_newFrameOffset = -CallerFrameAndPC::sizeInRegisters;
+
+    if (verbose)
+        dataLog("\n\nPreparing frame for slow path call:\n");
+
+    // When coming from the FTL, we need to extend the frame. In other
+    // cases, we may end up extending the frame if we previously
+    // spilled things (e.g. in polymorphic cache).
+    extendFrameIfNeeded();
+
+    if (verbose)
+        dataLog(*this);
+
+    prepareAny();
+
+    if (verbose)
+        dataLog("Ready for slow path call!\n");
+}
+
+void CallFrameShuffler::prepareForTailCall()
+{
+    ASSERT(isUndecided());
+    emitDeltaCheck();
+
+    // We'll use sp-based indexing so that we can load the
+    // caller's frame pointer into the fpr immediately
+    m_oldFrameBase = MacroAssembler::stackPointerRegister;
+    m_oldFrameOffset = numLocals();
+    m_newFrameBase = acquireGPR();
+#if CPU(X86)
+    // We load the frame pointer manually, but we need to ask the
+    // algorithm to move the return PC for us (it'd probably
+    // require a write to the danger zone). Since it'd be awkward
+    // to ask for half a value move, we ask that the whole thing
+    // be moved for us.
+    addNew(VirtualRegister { 0 },
+        ValueRecovery::displacedInJSStack(VirtualRegister(0), DataFormatJS));
+
+    // sp will point to head0 and we will move it up half a slot
+    // manually
+    m_newFrameOffset = 0;
+#elif CPU(ARM) || CPU(SH4) || CPU(MIPS)
+    // We load the the frame pointer and link register
+    // manually. We could ask the algorithm to load them for us,
+    // and it would allow us to use the link register as an extra
+    // temporary - but it'd mean that the frame pointer can also
+    // be used as an extra temporary, so we keep the link register
+    // locked instead.
+
+    // sp will point to head1 since the callee's prologue pushes
+    // the call frame and link register.
+    m_newFrameOffset = -1;
+#elif CPU(ARM64)
+    // We load the frame pointer and link register manually. We
+    // could ask the algorithm to load the link register for us
+    // (which would allow for its use as an extra temporary), but
+    // since its not in GPRInfo, we can't do it.
+
+    // sp will point to head2 since the callee's prologue pushes the
+    // call frame and link register
+    m_newFrameOffset = -2;
+#elif CPU(X86_64)
+    // We load the frame pointer manually, but we ask the
+    // algorithm to move the return PC for us (it'd probably
+    // require a write in the danger zone)
+    addNew(VirtualRegister { 1 },
+        ValueRecovery::displacedInJSStack(VirtualRegister(1), DataFormatJS));
+
+    // sp will point to head1 since the callee's prologue pushes
+    // the call frame register
+    m_newFrameOffset = -1;
+#else
+    UNREACHABLE_FOR_PLATFORM();
+#endif
+
+    if (verbose)
+        dataLog("  Emitting code for computing the new frame base\n");
+
+    // We compute the new frame base by first computing the top of the
+    // old frame (taking into account an argument count higher than
+    // the number of parameters), then substracting to it the aligned
+    // new frame size (adjusted).
+    m_jit.load32(MacroAssembler::Address(GPRInfo::callFrameRegister, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset), m_newFrameBase);
+    MacroAssembler::Jump argumentCountOK =
+        m_jit.branch32(MacroAssembler::BelowOrEqual, m_newFrameBase,
+            MacroAssembler::TrustedImm32(m_jit.codeBlock()->numParameters()));
+    m_jit.add32(MacroAssembler::TrustedImm32(stackAlignmentRegisters() - 1 + CallFrame::headerSizeInRegisters), m_newFrameBase);
+    m_jit.and32(MacroAssembler::TrustedImm32(-stackAlignmentRegisters()), m_newFrameBase);
+    m_jit.mul32(MacroAssembler::TrustedImm32(sizeof(Register)), m_newFrameBase, m_newFrameBase);
+    MacroAssembler::Jump done = m_jit.jump();
+    argumentCountOK.link(&m_jit);
+    m_jit.move(
+        MacroAssembler::TrustedImm32(m_alignedOldFrameSize * sizeof(Register)),
+        m_newFrameBase);
+    done.link(&m_jit);
+
+    m_jit.addPtr(GPRInfo::callFrameRegister, m_newFrameBase);
+    m_jit.subPtr(
+        MacroAssembler::TrustedImm32(
+            (m_alignedNewFrameSize + m_newFrameOffset) * sizeof(Register)), 
+        m_newFrameBase);
+
+    // We load the link register manually for architectures that have one
+#if CPU(ARM) || CPU(SH4) || CPU(ARM64)
+    m_jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister, sizeof(void*)),
+        MacroAssembler::linkRegister);
+#elif CPU(MIPS)
+    m_jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister, sizeof(void*)),
+        MacroAssembler::returnAddressRegister);
+#endif
+
+    // We want the frame pointer to always point to a valid frame, and
+    // we are going to trash the current one. Let's make it point to
+    // our caller's frame, since that's what we want to end up with.
+    m_jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister),
+        MacroAssembler::framePointerRegister);
+
+    if (verbose)
+        dataLog("Preparing frame for tail call:\n", *this);
+
+    prepareAny();
+
+#if CPU(X86)
+    if (verbose)
+        dataLog("  Simulating pop of the call frame register\n");
+    m_jit.addPtr(MacroAssembler::TrustedImm32(sizeof(void*)), MacroAssembler::stackPointerRegister);
+#endif
+
+    if (verbose)
+        dataLog("Ready for tail call!\n");
+}
+
+bool CallFrameShuffler::tryWrites(CachedRecovery& cachedRecovery)
+{
+    ASSERT(m_newFrameBase != InvalidGPRReg);
+
+    // If the value is already set up correctly, we don't have
+    // anything to do.
+    if (isSlowPath() && cachedRecovery.recovery().isInJSStack()
+        && cachedRecovery.targets().size() == 1
+        && newAsOld(cachedRecovery.targets()[0]) == cachedRecovery.recovery().virtualRegister()) {
+        cachedRecovery.clearTargets();
+        if (!cachedRecovery.wantedJSValueRegs() && cachedRecovery.wantedFPR() == InvalidFPRReg)
+            clearCachedRecovery(cachedRecovery.recovery());
+        return true;
+    }
+
+    if (!canLoadAndBox(cachedRecovery))
+        return false;
+
+    emitLoad(cachedRecovery);
+    emitBox(cachedRecovery);
+    ASSERT(cachedRecovery.recovery().isInRegisters()
+        || cachedRecovery.recovery().isConstant());
+
+    if (verbose)
+        dataLog("   * Storing ", cachedRecovery.recovery());
+    for (size_t i = 0; i < cachedRecovery.targets().size(); ++i) {
+        VirtualRegister target { cachedRecovery.targets()[i] };
+        ASSERT(!isDangerNew(target));
+        if (verbose)
+            dataLog(!i ? " into " : ", and ", "NEW ", target);
+        emitStore(cachedRecovery, addressForNew(target));
+        setNew(target, nullptr);
+    }
+    if (verbose)
+        dataLog("\n");
+    cachedRecovery.clearTargets();
+    if (!cachedRecovery.wantedJSValueRegs() && cachedRecovery.wantedFPR() == InvalidFPRReg)
+        clearCachedRecovery(cachedRecovery.recovery());
+
+    return true;
+}
+
+bool CallFrameShuffler::performSafeWrites()
+{
+    VirtualRegister firstSafe;
+    VirtualRegister end { lastNew() + 1 };
+    Vector<VirtualRegister> failures;
+
+    // For all cachedRecoveries that writes to the safe zone, if it
+    // doesn't also write to the danger zone, we try to perform
+    // the writes. This may free up danger slots, so we iterate
+    // again until it doesn't happen anymore.
+    //
+    // Note that even though we have a while block, we look at
+    // each slot of the new call frame at most once since in each
+    // iteration beyond the first, we only load up the portion of
+    // the new call frame that was dangerous and became safe due
+    // to the previous iteration.
+    do {
+        firstSafe = dangerFrontier() + 1;
+        if (verbose)
+            dataLog("  Trying safe writes (between NEW ", firstSafe, " and NEW ", end - 1, ")\n");
+        bool didProgress = false;
+        for (VirtualRegister reg = firstSafe; reg < end; reg += 1) {
+            CachedRecovery* cachedRecovery = getNew(reg);
+            if (!cachedRecovery) {
+                if (verbose)
+                    dataLog("   + ", reg, " is OK.\n");
+                continue;
+            }
+            if (!hasOnlySafeWrites(*cachedRecovery)) {
+                if (verbose) {
+                    dataLog("   - ", cachedRecovery->recovery(), " writes to NEW ", reg,
+                        " but also has dangerous writes.\n");
+                }
+                continue;
+            }
+            if (cachedRecovery->wantedJSValueRegs()) {
+                if (verbose) {
+                    dataLog("   - ", cachedRecovery->recovery(), " writes to NEW ", reg,
+                        " but is also needed in registers.\n");
+                }
+                continue;
+            }
+            if (cachedRecovery->wantedFPR() != InvalidFPRReg) {
+                if (verbose) {
+                    dataLog("   - ", cachedRecovery->recovery(), " writes to NEW ", reg,
+                        " but is also needed in an FPR.\n");
+                }
+                continue;
+            }
+            if (!tryWrites(*cachedRecovery)) {
+                if (verbose)
+                    dataLog("   - Unable to write to NEW ", reg, " from ", cachedRecovery->recovery(), "\n");
+                failures.append(reg);
+            }
+            didProgress = true;
+        }
+        end = firstSafe;
+
+        // If we have cachedRecoveries that failed to write, it is
+        // because they are on the stack and we didn't have enough
+        // registers available at the time to load them into. If
+        // we have a free register, we should try again because it
+        // could free up some danger slots.
+        if (didProgress && hasFreeRegister()) {
+            Vector<VirtualRegister> stillFailing;
+            for (VirtualRegister failed : failures) {
+                CachedRecovery* cachedRecovery = getNew(failed);
+                // It could have been handled later if it had
+                // several targets
+                if (!cachedRecovery)
+                    continue;
+
+                ASSERT(hasOnlySafeWrites(*cachedRecovery)
+                    && !cachedRecovery->wantedJSValueRegs()
+                    && cachedRecovery->wantedFPR() == InvalidFPRReg);
+                if (!tryWrites(*cachedRecovery))
+                    stillFailing.append(failed);
+            }
+            failures = WTFMove(stillFailing);
+        }
+        if (verbose && firstSafe != dangerFrontier() + 1)
+            dataLog("  We freed up danger slots!\n");
+    } while (firstSafe != dangerFrontier() + 1);
+
+    return failures.isEmpty();
+}
+
+void CallFrameShuffler::prepareAny()
+{
+    ASSERT(!isUndecided());
+
+    updateDangerFrontier();
+
+    // First, we try to store any value that goes above the danger
+    // frontier. This will never use more registers since we are only
+    // loading+storing if we ensure that any register used for the load
+    // will be freed up after the stores (i.e., all stores are above
+    // the danger frontier, and there is no wanted register).
+    performSafeWrites();
+
+    // At this point, we couldn't have more available registers than
+    // we have withouth spilling: all values currently in registers
+    // either require a write to the danger zone, or have a wanted
+    // register, which means that in any case they will have to go
+    // through registers again.
+
+    // We now slowly free up the danger zone by first loading the old
+    // value on the danger frontier, spilling as many registers as
+    // needed to do so and ensuring that the corresponding slot in the
+    // new frame is now ready to be written. Then, we store the old
+    // value to its target location if possible (we could have failed
+    // to load it previously due to high pressure). Finally, we write
+    // to any of the newly safe slots that we can, which could free up
+    // registers (hence why we do it eagerly).
+    for (VirtualRegister reg = dangerFrontier(); reg >= firstNew(); reg -= 1) {
+        if (reg == dangerFrontier()) {
+            if (verbose)
+                dataLog("  Next slot (NEW ", reg, ") is the danger frontier\n");
+            CachedRecovery* cachedRecovery { getOld(newAsOld(dangerFrontier())) };
+            ASSERT(cachedRecovery);
+            ensureLoad(*cachedRecovery);
+            emitLoad(*cachedRecovery);
+            ensureBox(*cachedRecovery);
+            emitBox(*cachedRecovery);
+            if (hasOnlySafeWrites(*cachedRecovery))
+                tryWrites(*cachedRecovery);
+        } else if (verbose)
+            dataLog("  Next slot is NEW ", reg, "\n");
+
+        ASSERT(!isDangerNew(reg));
+        CachedRecovery* cachedRecovery = getNew(reg);
+        // This could be one of the header slots we don't care about.
+        if (!cachedRecovery) {
+            if (verbose)
+                dataLog("   + ", reg, " is OK\n");
+            continue;
+        }
+
+        if (canLoadAndBox(*cachedRecovery) && hasOnlySafeWrites(*cachedRecovery)
+            && !cachedRecovery->wantedJSValueRegs()
+            && cachedRecovery->wantedFPR() == InvalidFPRReg) {
+            emitLoad(*cachedRecovery);
+            emitBox(*cachedRecovery);
+            bool writesOK = tryWrites(*cachedRecovery);
+            ASSERT_UNUSED(writesOK, writesOK);
+        } else if (verbose)
+            dataLog("   - ", cachedRecovery->recovery(), " can't be handled just yet.\n");
+    }
+    ASSERT(dangerFrontier() < firstNew());
+
+    // Now, the danger zone is empty, but we still have a couple of
+    // things to do:
+    //
+    // 1) There could be remaining safe writes that failed earlier due
+    //    to high register pressure and had nothing to do with the
+    //    danger zone whatsoever.
+    //
+    // 2) Some wanted registers could have to be loaded (this could
+    //    happen either when making a call to a new function with a
+    //    lower number of arguments - since above here, we only load
+    //    wanted registers when they are at the danger frontier -, or
+    //    if a wanted register got spilled).
+    //
+    // 3) Some wanted registers could have been loaded in the wrong
+    //    registers
+    //
+    // 4) We have to take care of some bookkeeping - namely, storing
+    //    the argument count and updating the stack pointer.
+
+    // At this point, we must have enough registers available for
+    // handling 1). None of the loads can fail because we have been
+    // eagerly freeing up registers in all the previous phases - so
+    // the only values that are in registers at this point must have
+    // wanted registers.
+    if (verbose)
+        dataLog("  Danger zone is clear, performing remaining writes.\n");
+    for (VirtualRegister reg = firstNew(); reg <= lastNew(); reg += 1) {
+        CachedRecovery* cachedRecovery { getNew(reg) };
+        if (!cachedRecovery)
+            continue;
+
+        emitLoad(*cachedRecovery);
+        emitBox(*cachedRecovery);
+        bool writesOK = tryWrites(*cachedRecovery);
+        ASSERT_UNUSED(writesOK, writesOK);
+    }
+
+#if USE(JSVALUE64)
+    if (m_tagTypeNumber != InvalidGPRReg && m_newRegisters[m_tagTypeNumber])
+        releaseGPR(m_tagTypeNumber);
+#endif
+
+    // Handle 2) by loading all registers. We don't have to do any
+    // writes, since they have been taken care of above.
+    if (verbose)
+        dataLog("  Loading wanted registers into registers\n");
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        CachedRecovery* cachedRecovery { m_newRegisters[reg] };
+        if (!cachedRecovery)
+            continue;
+
+        emitLoad(*cachedRecovery);
+        emitBox(*cachedRecovery);
+        ASSERT(cachedRecovery->targets().isEmpty());
+    }
+
+#if USE(JSVALUE64)
+    if (m_tagTypeNumber != InvalidGPRReg)
+        releaseGPR(m_tagTypeNumber);
+#endif
+
+    // At this point, we have read everything we cared about from the
+    // stack, and written everything we had to to the stack.
+    if (verbose)
+        dataLog("  Callee frame is fully set up\n");
+    if (!ASSERT_DISABLED) {
+        for (VirtualRegister reg = firstNew(); reg <= lastNew(); reg += 1)
+            ASSERT_UNUSED(reg, !getNew(reg));
+
+        for (CachedRecovery* cachedRecovery : m_cachedRecoveries) {
+            ASSERT_UNUSED(cachedRecovery, cachedRecovery->targets().isEmpty());
+            ASSERT(!cachedRecovery->recovery().isInJSStack());
+        }
+    }
+
+    // We need to handle 4) first because it implies releasing
+    // m_newFrameBase, which could be a wanted register.
+    if (verbose)
+        dataLog("   * Storing the argument count into ", VirtualRegister { CallFrameSlot::argumentCount }, "\n");
+    m_jit.store32(MacroAssembler::TrustedImm32(0),
+        addressForNew(VirtualRegister { CallFrameSlot::argumentCount }).withOffset(TagOffset));
+    RELEASE_ASSERT(m_numPassedArgs != UINT_MAX);
+    m_jit.store32(MacroAssembler::TrustedImm32(m_numPassedArgs),
+        addressForNew(VirtualRegister { CallFrameSlot::argumentCount }).withOffset(PayloadOffset));
+
+    if (!isSlowPath()) {
+        ASSERT(m_newFrameBase != MacroAssembler::stackPointerRegister);
+        if (verbose)
+            dataLog("  Releasing the new frame base pointer\n");
+        m_jit.move(m_newFrameBase, MacroAssembler::stackPointerRegister);
+        releaseGPR(m_newFrameBase);
+    }
+
+    // Finally we handle 3)
+    if (verbose)
+        dataLog("  Ensuring wanted registers are in the right register\n");
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        CachedRecovery* cachedRecovery { m_newRegisters[reg] };
+        if (!cachedRecovery)
+            continue;
+
+        emitDisplace(*cachedRecovery);
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CallFrameShuffler.h b/jit/CallFrameShuffler.h
new file mode 100644
index 0000000..6c0ea33
--- /dev/null
+++ b/jit/CallFrameShuffler.h
@@ -0,0 +1,804 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CachedRecovery.h"
+#include "CallFrameShuffleData.h"
+#include "MacroAssembler.h"
+#include "RegisterSet.h"
+#include "StackAlignment.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CallFrameShuffler {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    CallFrameShuffler(CCallHelpers&, const CallFrameShuffleData&);
+
+    void dump(PrintStream&) const;
+
+    // Any register that has been locked or acquired must be released
+    // before calling prepareForTailCall() or prepareForSlowPath().
+    void lockGPR(GPRReg gpr)
+    {
+        ASSERT(!m_lockedRegisters.get(gpr));
+        m_lockedRegisters.set(gpr);
+        if (verbose)
+            dataLog("   * Locking ", gpr, "\n");
+    }
+
+    GPRReg acquireGPR()
+    {
+        ensureGPR();
+        GPRReg gpr { getFreeGPR() };
+        ASSERT(!m_registers[gpr]);
+        lockGPR(gpr);
+        return gpr;
+    }
+
+    void releaseGPR(GPRReg gpr)
+    {
+        if (verbose) {
+            if (m_lockedRegisters.get(gpr))
+                dataLog("   * Releasing ", gpr, "\n");
+            else
+                dataLog("   * ", gpr, " was not locked\n");
+        }
+        m_lockedRegisters.clear(gpr);
+    }
+
+    void restoreGPR(GPRReg gpr)
+    {
+        if (!m_newRegisters[gpr])
+            return;
+
+        ensureGPR();
+#if USE(JSVALUE32_64)
+        GPRReg tempGPR { getFreeGPR() };
+        lockGPR(tempGPR);
+        ensureGPR();
+        releaseGPR(tempGPR);
+#endif
+        emitDisplace(*m_newRegisters[gpr]);
+    }
+
+    // You can only take a snapshot if the recovery has not started
+    // yet. The only operations that are valid before taking a
+    // snapshot are lockGPR(), acquireGPR() and releaseGPR().
+    //
+    // Locking status is *NOT* preserved by the snapshot: it only
+    // contains information about where the
+    // arguments/callee/callee-save registers are by taking into
+    // account any spilling that acquireGPR() could have done.
+    CallFrameShuffleData snapshot() const
+    {
+        ASSERT(isUndecided());
+
+        CallFrameShuffleData data;
+        data.numLocals = numLocals();
+        data.numPassedArgs = m_numPassedArgs;
+        data.callee = getNew(VirtualRegister { CallFrameSlot::callee })->recovery();
+        data.args.resize(argCount());
+        for (size_t i = 0; i < argCount(); ++i)
+            data.args[i] = getNew(virtualRegisterForArgument(i))->recovery();
+        for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+            CachedRecovery* cachedRecovery { m_newRegisters[reg] };
+            if (!cachedRecovery)
+                continue;
+
+#if USE(JSVALUE64)
+            data.registers[reg] = cachedRecovery->recovery();
+#else
+            RELEASE_ASSERT_NOT_REACHED();
+#endif
+        }
+        return data;
+    }
+
+    // Ask the shuffler to put the callee into some registers once the
+    // shuffling is done. You should call this before any of the
+    // prepare() methods, and must not take a snapshot afterwards, as
+    // this would crash 32bits platforms.
+    void setCalleeJSValueRegs(JSValueRegs jsValueRegs)
+    {
+        ASSERT(isUndecided());
+        ASSERT(!getNew(jsValueRegs));
+        CachedRecovery* cachedRecovery { getNew(VirtualRegister(CallFrameSlot::callee)) };
+        ASSERT(cachedRecovery);
+        addNew(jsValueRegs, cachedRecovery->recovery());
+    }
+
+    // Ask the suhffler to assume the callee has already be checked to
+    // be a cell. This is a no-op on 64bit platforms, but allows to
+    // free up a GPR on 32bit platforms.
+    // You obviously must have ensured that this is the case before
+    // running any of the prepare methods.
+    void assumeCalleeIsCell()
+    {
+#if USE(JSVALUE32_64)
+        CachedRecovery& calleeCachedRecovery = *getNew(VirtualRegister(CallFrameSlot::callee));
+        switch (calleeCachedRecovery.recovery().technique()) {
+        case InPair:
+            updateRecovery(
+                calleeCachedRecovery,
+                ValueRecovery::inGPR(
+                    calleeCachedRecovery.recovery().payloadGPR(),
+                    DataFormatCell));
+            break;
+        case DisplacedInJSStack:
+            updateRecovery(
+                calleeCachedRecovery,
+                ValueRecovery::displacedInJSStack(
+                    calleeCachedRecovery.recovery().virtualRegister(),
+                    DataFormatCell));
+            break;
+        case InFPR:
+        case UnboxedCellInGPR:
+        case CellDisplacedInJSStack:
+            break;
+        case Constant:
+            ASSERT(calleeCachedRecovery.recovery().constant().isCell());
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+#endif
+    }
+
+    // This will emit code to build the new frame over the old one.
+    void prepareForTailCall();
+
+    // This will emit code to build the new frame as if performing a
+    // regular call. However, the callee save registers will be
+    // restored, and any locals (not the header or arguments) of the
+    // current frame can be overwritten.
+    //
+    // A frame built using prepareForSlowPath() should be used either
+    // to throw an exception in, or destroyed using
+    // CCallHelpers::prepareForTailCallSlow() followed by a tail call.
+    void prepareForSlowPath();
+
+private:
+    static const bool verbose = false;
+
+    CCallHelpers& m_jit;
+
+    void prepareAny();
+
+    void spill(CachedRecovery&);
+
+    // "box" is arguably a bad name here. The meaning is that after
+    // calling emitBox(), your ensure that subsequently calling
+    // emitStore() will be able to store the value without additional
+    // transformation. In particular, this is a no-op for constants,
+    // and is a complete no-op on 32bits since any unboxed value can
+    // still be stored by storing the payload and a statically known
+    // tag.
+    void emitBox(CachedRecovery&);
+
+    bool canBox(CachedRecovery& cachedRecovery)
+    {
+        if (cachedRecovery.boxingRequiresGPR() && getFreeGPR() == InvalidGPRReg)
+            return false;
+
+        if (cachedRecovery.boxingRequiresFPR() && getFreeFPR() == InvalidFPRReg)
+            return false;
+
+        return true;
+    }
+
+    void ensureBox(CachedRecovery& cachedRecovery)
+    {
+        if (canBox(cachedRecovery))
+            return;
+
+        if (cachedRecovery.boxingRequiresGPR())
+            ensureGPR();
+
+        if (cachedRecovery.boxingRequiresFPR())
+            ensureFPR();
+    }
+
+    void emitLoad(CachedRecovery&);
+
+    bool canLoad(CachedRecovery&);
+
+    void ensureLoad(CachedRecovery& cachedRecovery)
+    {
+        if (canLoad(cachedRecovery))
+            return;
+
+        ASSERT(cachedRecovery.loadsIntoGPR() || cachedRecovery.loadsIntoFPR());
+
+        if (cachedRecovery.loadsIntoFPR()) {
+            if (cachedRecovery.loadsIntoGPR())
+                ensureRegister();
+            else
+                ensureFPR();
+        } else
+            ensureGPR();
+    }
+
+    bool canLoadAndBox(CachedRecovery& cachedRecovery)
+    {
+        // We don't have interfering loads & boxes
+        ASSERT(!cachedRecovery.loadsIntoFPR() || !cachedRecovery.boxingRequiresFPR());
+        ASSERT(!cachedRecovery.loadsIntoGPR() || !cachedRecovery.boxingRequiresGPR());
+
+        return canLoad(cachedRecovery) && canBox(cachedRecovery);
+    }
+
+    DataFormat emitStore(CachedRecovery&, MacroAssembler::Address);
+
+    void emitDisplace(CachedRecovery&);
+
+    void emitDeltaCheck();
+
+    Bag<CachedRecovery> m_cachedRecoveries;
+
+    void updateRecovery(CachedRecovery& cachedRecovery, ValueRecovery recovery)
+    {
+        clearCachedRecovery(cachedRecovery.recovery());
+        cachedRecovery.setRecovery(recovery);
+        setCachedRecovery(recovery, &cachedRecovery);
+    }
+
+    CachedRecovery* getCachedRecovery(ValueRecovery);
+
+    CachedRecovery* setCachedRecovery(ValueRecovery, CachedRecovery*);
+
+    void clearCachedRecovery(ValueRecovery recovery)
+    {
+        if (!recovery.isConstant())
+            setCachedRecovery(recovery, nullptr);
+    }
+
+    CachedRecovery* addCachedRecovery(ValueRecovery recovery)
+    {
+        if (recovery.isConstant())
+            return m_cachedRecoveries.add(recovery);
+        CachedRecovery* cachedRecovery = getCachedRecovery(recovery);
+        if (!cachedRecovery)
+            return setCachedRecovery(recovery, m_cachedRecoveries.add(recovery));
+        return cachedRecovery;
+    }
+
+    // This is the current recoveries present in the old frame's
+    // slots. A null CachedRecovery means we can trash the current
+    // value as we don't care about it.
+    Vector<CachedRecovery*> m_oldFrame;
+
+    int numLocals() const
+    {
+        return m_oldFrame.size() - CallerFrameAndPC::sizeInRegisters;
+    }
+
+    CachedRecovery* getOld(VirtualRegister reg) const
+    {
+        return m_oldFrame[CallerFrameAndPC::sizeInRegisters - reg.offset() - 1];
+    }
+
+    void setOld(VirtualRegister reg, CachedRecovery* cachedRecovery)
+    {
+        m_oldFrame[CallerFrameAndPC::sizeInRegisters - reg.offset() - 1] = cachedRecovery;
+    }
+
+    VirtualRegister firstOld() const
+    {
+        return VirtualRegister { static_cast<int>(-numLocals()) };
+    }
+
+    VirtualRegister lastOld() const
+    {
+        return VirtualRegister { CallerFrameAndPC::sizeInRegisters - 1 };
+    }
+
+    bool isValidOld(VirtualRegister reg) const
+    {
+        return reg >= firstOld() && reg <= lastOld();
+    }
+
+    bool m_didExtendFrame { false };
+
+    void extendFrameIfNeeded();
+
+    // This stores, for each slot in the new frame, information about
+    // the recovery for the value that should eventually go into that
+    // slot.
+    //
+    // Once the slot has been written, the corresponding entry in
+    // m_newFrame will be empty.
+    Vector<CachedRecovery*> m_newFrame;
+
+    size_t argCount() const
+    {
+        return m_newFrame.size() - CallFrame::headerSizeInRegisters;
+    }
+
+    CachedRecovery* getNew(VirtualRegister newRegister) const
+    {
+        return m_newFrame[newRegister.offset()];
+    }
+
+    void setNew(VirtualRegister newRegister, CachedRecovery* cachedRecovery)
+    {
+        m_newFrame[newRegister.offset()] = cachedRecovery;
+    }
+
+    void addNew(VirtualRegister newRegister, ValueRecovery recovery)
+    {
+        CachedRecovery* cachedRecovery = addCachedRecovery(recovery);
+        cachedRecovery->addTarget(newRegister);
+        setNew(newRegister, cachedRecovery);
+    }
+
+    VirtualRegister firstNew() const
+    {
+        return VirtualRegister { 0 };
+    }
+
+    VirtualRegister lastNew() const
+    {
+        return VirtualRegister { static_cast<int>(m_newFrame.size()) - 1 };
+    }
+
+    bool isValidNew(VirtualRegister reg) const
+    {
+        return reg >= firstNew() && reg <= lastNew();
+    }
+
+
+    int m_alignedOldFrameSize;
+    int m_alignedNewFrameSize;
+
+    // This is the distance, in slots, between the base of the new
+    // frame and the base of the old frame. It could be negative when
+    // preparing for a tail call to a function with smaller argument
+    // count.
+    //
+    // We will overwrite this appropriately for slow path calls, but
+    // we initialize it as if doing a fast path for the spills we
+    // could do while undecided (typically while calling acquireGPR()
+    // for a polymorphic call).
+    int m_frameDelta;
+
+    VirtualRegister newAsOld(VirtualRegister reg) const
+    {
+        return reg - m_frameDelta;
+    }
+
+    // This stores the set of locked registers, i.e. registers for
+    // which we have an implicit requirement that they are not changed.
+    //
+    // This will usually contains the link register on architectures
+    // that have one, any scratch register used by the macro assembler
+    // (e.g. r11 on X86_64), as well as any register that we use for
+    // addressing (see m_oldFrameBase and m_newFrameBase).
+    //
+    // We also use this to lock registers temporarily, for instance to
+    // ensure that we have at least 2 available registers for loading
+    // a pair on 32bits.
+    mutable RegisterSet m_lockedRegisters;
+
+    // This stores the current recoveries present in registers. A null
+    // CachedRecovery means we can trash the current value as we don't
+    // care about it. 
+    RegisterMap<CachedRecovery*> m_registers;
+
+#if USE(JSVALUE64)
+    mutable GPRReg m_tagTypeNumber;
+
+    bool tryAcquireTagTypeNumber();
+#endif
+
+    // This stores, for each register, information about the recovery
+    // for the value that should eventually go into that register. The
+    // only registers that have a target recovery will be callee-save
+    // registers, as well as possibly one JSValueRegs for holding the
+    // callee.
+    //
+    // Once the correct value has been put into the registers, and
+    // contrary to what we do with m_newFrame, we keep the entry in
+    // m_newRegisters to simplify spilling.
+    RegisterMap<CachedRecovery*> m_newRegisters;
+
+    template<typename CheckFunctor>
+    Reg getFreeRegister(const CheckFunctor& check) const
+    {
+        Reg nonTemp { };
+        for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+            if (m_lockedRegisters.get(reg))
+                continue;
+
+            if (!check(reg))
+                continue;
+
+            if (!m_registers[reg]) {
+                if (!m_newRegisters[reg])
+                    return reg;
+                if (!nonTemp)
+                    nonTemp = reg;
+            }
+        }
+
+#if USE(JSVALUE64)
+        if (!nonTemp && m_tagTypeNumber != InvalidGPRReg && check(Reg { m_tagTypeNumber })) {
+            ASSERT(m_lockedRegisters.get(m_tagTypeNumber));
+            m_lockedRegisters.clear(m_tagTypeNumber);
+            nonTemp = Reg { m_tagTypeNumber };
+            m_tagTypeNumber = InvalidGPRReg;
+        }
+#endif
+        return nonTemp;
+    }
+
+    GPRReg getFreeTempGPR() const
+    {
+        Reg freeTempGPR { getFreeRegister([this] (Reg reg) { return reg.isGPR() && !m_newRegisters[reg]; }) };
+        if (!freeTempGPR)
+            return InvalidGPRReg;
+        return freeTempGPR.gpr();
+    }
+
+    GPRReg getFreeGPR() const
+    {
+        Reg freeGPR { getFreeRegister([] (Reg reg) { return reg.isGPR(); }) };
+        if (!freeGPR)
+            return InvalidGPRReg;
+        return freeGPR.gpr();
+    }
+
+    FPRReg getFreeFPR() const
+    {
+        Reg freeFPR { getFreeRegister([] (Reg reg) { return reg.isFPR(); }) };
+        if (!freeFPR)
+            return InvalidFPRReg;
+        return freeFPR.fpr();
+    }
+
+    bool hasFreeRegister() const
+    {
+        return static_cast<bool>(getFreeRegister([] (Reg) { return true; }));
+    }
+
+    // This frees up a register satisfying the check functor (this
+    // functor could theoretically have any kind of logic, but it must
+    // ensure that it will only return true for registers - spill
+    // assumes and asserts that it is passed a cachedRecovery stored in a
+    // register).
+    template<typename CheckFunctor>
+    void ensureRegister(const CheckFunctor& check)
+    {
+        // If we can spill a callee-save, that's best, because it will
+        // free up a register that would otherwise been taken for the
+        // longest amount of time.
+        //
+        // We could try to bias towards those that are not in their
+        // target registers yet, but the gain is probably super
+        // small. Unless you have a huge number of argument (at least
+        // around twice the number of available registers on your
+        // architecture), no spilling is going to take place anyways.
+        for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+            if (m_lockedRegisters.get(reg))
+                continue;
+
+            CachedRecovery* cachedRecovery { m_newRegisters[reg] };
+            if (!cachedRecovery)
+                continue;
+
+            if (check(*cachedRecovery)) {
+                if (verbose)
+                    dataLog("  ", cachedRecovery->recovery(), " looks like a good spill candidate\n");
+                spill(*cachedRecovery);
+                return;
+            }
+        }
+
+        // We use the cachedRecovery associated with the first new slot we
+        // can, because that is the one for which a write will be
+        // possible the latest, i.e. that is the one that we would
+        // have had to retain in registers for the longest.
+        for (VirtualRegister reg = firstNew(); reg <= lastNew(); reg += 1) {
+            CachedRecovery* cachedRecovery { getNew(reg) };
+            if (!cachedRecovery)
+                continue;
+
+            if (check(*cachedRecovery)) {
+                spill(*cachedRecovery);
+                return;
+            }
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    void ensureRegister()
+    {
+        if (hasFreeRegister())
+            return;
+
+        if (verbose)
+            dataLog("  Finding a register to spill\n");
+        ensureRegister(
+            [this] (const CachedRecovery& cachedRecovery) {
+                if (cachedRecovery.recovery().isInGPR())
+                    return !m_lockedRegisters.get(cachedRecovery.recovery().gpr());
+                if (cachedRecovery.recovery().isInFPR())
+                    return !m_lockedRegisters.get(cachedRecovery.recovery().fpr());
+#if USE(JSVALUE32_64)
+                if (cachedRecovery.recovery().technique() == InPair) {
+                    return !m_lockedRegisters.get(cachedRecovery.recovery().tagGPR())
+                        && !m_lockedRegisters.get(cachedRecovery.recovery().payloadGPR());
+                }
+#endif
+                return false;
+            });
+    }
+
+    void ensureTempGPR()
+    {
+        if (getFreeTempGPR() != InvalidGPRReg)
+            return;
+
+        if (verbose)
+            dataLog("  Finding a temp GPR to spill\n");
+        ensureRegister(
+            [this] (const CachedRecovery& cachedRecovery) {
+                if (cachedRecovery.recovery().isInGPR()) {
+                    return !m_lockedRegisters.get(cachedRecovery.recovery().gpr()) 
+                        && !m_newRegisters[cachedRecovery.recovery().gpr()];
+                }
+#if USE(JSVALUE32_64)
+                if (cachedRecovery.recovery().technique() == InPair) {
+                    return !m_lockedRegisters.get(cachedRecovery.recovery().tagGPR())
+                        && !m_lockedRegisters.get(cachedRecovery.recovery().payloadGPR())
+                        && !m_newRegisters[cachedRecovery.recovery().tagGPR()]
+                        && !m_newRegisters[cachedRecovery.recovery().payloadGPR()];
+                }
+#endif
+                return false;
+            });
+    }
+
+    void ensureGPR()
+    {
+        if (getFreeGPR() != InvalidGPRReg)
+            return;
+
+        if (verbose)
+            dataLog("  Finding a GPR to spill\n");
+        ensureRegister(
+            [this] (const CachedRecovery& cachedRecovery) {
+                if (cachedRecovery.recovery().isInGPR())
+                    return !m_lockedRegisters.get(cachedRecovery.recovery().gpr());
+#if USE(JSVALUE32_64)
+                if (cachedRecovery.recovery().technique() == InPair) {
+                    return !m_lockedRegisters.get(cachedRecovery.recovery().tagGPR())
+                        && !m_lockedRegisters.get(cachedRecovery.recovery().payloadGPR());
+                }
+#endif
+                return false;
+            });
+    }
+
+    void ensureFPR()
+    {
+        if (getFreeFPR() != InvalidFPRReg)
+            return;
+
+        if (verbose)
+            dataLog("  Finding an FPR to spill\n");
+        ensureRegister(
+            [this] (const CachedRecovery& cachedRecovery) {
+                if (cachedRecovery.recovery().isInFPR())
+                    return !m_lockedRegisters.get(cachedRecovery.recovery().fpr());
+                return false;
+            });
+    }
+
+    CachedRecovery* getNew(JSValueRegs jsValueRegs) const
+    {
+#if USE(JSVALUE64)
+        return m_newRegisters[jsValueRegs.gpr()];
+#else
+        ASSERT(
+            jsValueRegs.tagGPR() == InvalidGPRReg || jsValueRegs.payloadGPR() == InvalidGPRReg
+            || m_newRegisters[jsValueRegs.payloadGPR()] == m_newRegisters[jsValueRegs.tagGPR()]);
+        if (jsValueRegs.payloadGPR() == InvalidGPRReg)
+            return m_newRegisters[jsValueRegs.tagGPR()];
+        return m_newRegisters[jsValueRegs.payloadGPR()];
+#endif
+    }
+
+    void addNew(JSValueRegs jsValueRegs, ValueRecovery recovery)
+    {
+        ASSERT(jsValueRegs && !getNew(jsValueRegs));
+        CachedRecovery* cachedRecovery = addCachedRecovery(recovery);
+#if USE(JSVALUE64)
+        if (cachedRecovery->wantedJSValueRegs())
+            m_newRegisters[cachedRecovery->wantedJSValueRegs().gpr()] = nullptr;
+        m_newRegisters[jsValueRegs.gpr()] = cachedRecovery;
+#else
+        if (JSValueRegs oldRegs { cachedRecovery->wantedJSValueRegs() }) {
+            if (oldRegs.payloadGPR())
+                m_newRegisters[oldRegs.payloadGPR()] = nullptr;
+            if (oldRegs.tagGPR())
+                m_newRegisters[oldRegs.tagGPR()] = nullptr;
+        }
+        if (jsValueRegs.payloadGPR() != InvalidGPRReg)
+            m_newRegisters[jsValueRegs.payloadGPR()] = cachedRecovery;
+        if (jsValueRegs.tagGPR() != InvalidGPRReg)
+            m_newRegisters[jsValueRegs.tagGPR()] = cachedRecovery;
+#endif
+        ASSERT(!cachedRecovery->wantedJSValueRegs());
+        cachedRecovery->setWantedJSValueRegs(jsValueRegs);
+    }
+
+    void addNew(FPRReg fpr, ValueRecovery recovery)
+    {
+        ASSERT(fpr != InvalidFPRReg && !m_newRegisters[fpr]);
+        CachedRecovery* cachedRecovery = addCachedRecovery(recovery);
+        m_newRegisters[fpr] = cachedRecovery;
+        ASSERT(cachedRecovery->wantedFPR() == InvalidFPRReg);
+        cachedRecovery->setWantedFPR(fpr);
+    }
+
+    // m_oldFrameBase is the register relative to which we access
+    // slots in the old call frame, with an additional offset of
+    // m_oldFrameOffset.
+    //
+    //  - For an actual tail call, m_oldFrameBase is the stack
+    //    pointer, and m_oldFrameOffset is the number of locals of the
+    //    tail caller's frame. We use such stack pointer-based
+    //    addressing because it allows us to load the tail caller's
+    //    caller's frame pointer in the frame pointer register
+    //    immediately instead of awkwardly keeping it around on the
+    //    stack.
+    //
+    //  - For a slow path call, m_oldFrameBase is just the frame
+    //    pointer, and m_oldFrameOffset is 0.
+    GPRReg m_oldFrameBase { MacroAssembler::framePointerRegister };
+    int m_oldFrameOffset { 0 };
+
+    MacroAssembler::Address addressForOld(VirtualRegister reg) const
+    {
+        return MacroAssembler::Address(m_oldFrameBase,
+            (m_oldFrameOffset + reg.offset()) * sizeof(Register));
+    }
+
+    // m_newFrameBase is the register relative to which we access
+    // slots in the new call frame, and we always make it point to
+    // wherever the stack pointer will be right before making the
+    // actual call/jump. The actual base of the new frame is at offset
+    // m_newFrameOffset relative to m_newFrameBase.
+    //
+    //  - For an actual tail call, m_newFrameBase is computed
+    //    dynamically, and m_newFrameOffset varies between 0 and -2
+    //    depending on the architecture's calling convention (see
+    //    prepareForTailCall).
+    //
+    //  - For a slow path call, m_newFrameBase is the actual stack
+    //    pointer, and m_newFrameOffset is - CallerFrameAndPCSize,
+    //    following the convention for a regular call.
+    GPRReg m_newFrameBase { InvalidGPRReg };
+    int m_newFrameOffset { 0};
+
+    bool isUndecided() const
+    {
+        return m_newFrameBase == InvalidGPRReg;
+    }
+
+    bool isSlowPath() const
+    {
+        return m_newFrameBase == MacroAssembler::stackPointerRegister;
+    }
+
+    MacroAssembler::Address addressForNew(VirtualRegister reg) const
+    {
+        return MacroAssembler::Address(m_newFrameBase,
+            (m_newFrameOffset + reg.offset()) * sizeof(Register));
+    }
+
+    // We use a concept of "danger zone". The danger zone consists of
+    // all the writes in the new frame that could overlap with reads
+    // in the old frame.
+    //
+    // Because we could have a higher actual number of arguments than
+    // parameters, when preparing a tail call, we need to assume that
+    // writing to a slot on the new frame could overlap not only with
+    // the corresponding slot in the old frame, but also with any slot
+    // above it. Thus, the danger zone consists of all writes between
+    // the first write and what I call the "danger frontier": the
+    // highest slot in the old frame we still care about. Thus, the
+    // danger zone contains all the slots between the first slot of
+    // the new frame and the danger frontier. Because the danger
+    // frontier is related to the new frame, it is stored as a virtual
+    // register *in the new frame*.
+    VirtualRegister m_dangerFrontier;
+
+    VirtualRegister dangerFrontier() const
+    {
+        ASSERT(!isUndecided());
+
+        return m_dangerFrontier;
+    }
+
+    bool isDangerNew(VirtualRegister reg) const
+    {
+        ASSERT(!isUndecided() && isValidNew(reg));
+        return reg <= dangerFrontier();
+    }
+
+    void updateDangerFrontier()
+    {
+        ASSERT(!isUndecided());
+
+        m_dangerFrontier = firstNew() - 1;
+        for (VirtualRegister reg = lastNew(); reg >= firstNew(); reg -= 1) {
+            if (!getNew(reg) || !isValidOld(newAsOld(reg)) || !getOld(newAsOld(reg)))
+                continue;
+
+            m_dangerFrontier = reg;
+            if (verbose)
+                dataLog("  Danger frontier now at NEW ", m_dangerFrontier, "\n");
+            break;
+        }
+        if (verbose)
+            dataLog("  All clear! Danger zone is empty.\n");
+    }
+
+    // A safe write is a write that never writes into the danger zone.
+    bool hasOnlySafeWrites(CachedRecovery& cachedRecovery) const
+    {
+        for (VirtualRegister target : cachedRecovery.targets()) {
+            if (isDangerNew(target))
+                return false;
+        }
+        return true;
+    }
+
+    // You must ensure that there is no dangerous writes before
+    // calling this function.
+    bool tryWrites(CachedRecovery&);
+
+    // This function tries to ensure that there is no longer any
+    // possible safe write, i.e. all remaining writes are either to
+    // the danger zone or callee save restorations.
+    //
+    // It returns false if it was unable to perform some safe writes
+    // due to high register pressure.
+    bool performSafeWrites();
+    
+    unsigned m_numPassedArgs { UINT_MAX };
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/CallFrameShuffler32_64.cpp b/jit/CallFrameShuffler32_64.cpp
new file mode 100644
index 0000000..5dfe96e
--- /dev/null
+++ b/jit/CallFrameShuffler32_64.cpp
@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CallFrameShuffler.h"
+
+#if ENABLE(JIT) && USE(JSVALUE32_64)
+
+#include "CCallHelpers.h"
+#include "DataFormat.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+DataFormat CallFrameShuffler::emitStore(CachedRecovery& location, MacroAssembler::Address address)
+{
+    ASSERT(!location.recovery().isInJSStack());
+
+    switch (location.recovery().technique()) {
+    case UnboxedInt32InGPR:
+        m_jit.store32(MacroAssembler::TrustedImm32(JSValue::Int32Tag),
+            address.withOffset(TagOffset));
+        m_jit.store32(location.recovery().gpr(), address.withOffset(PayloadOffset));
+        return DataFormatInt32;
+    case UnboxedCellInGPR:
+        m_jit.store32(MacroAssembler::TrustedImm32(JSValue::CellTag),
+            address.withOffset(TagOffset));
+        m_jit.store32(location.recovery().gpr(), address.withOffset(PayloadOffset));
+        return DataFormatCell;
+    case Constant:
+        m_jit.storeTrustedValue(location.recovery().constant(), address);
+        return DataFormatJS;
+    case InPair:
+        m_jit.storeValue(location.recovery().jsValueRegs(), address);
+        return DataFormatJS;
+    case UnboxedBooleanInGPR:
+        m_jit.store32(MacroAssembler::TrustedImm32(JSValue::BooleanTag),
+            address.withOffset(TagOffset));
+        m_jit.store32(location.recovery().gpr(), address.withOffset(PayloadOffset));
+        return DataFormatBoolean;
+    case InFPR:
+    case UnboxedDoubleInFPR:
+        m_jit.storeDouble(location.recovery().fpr(), address);
+        return DataFormatJS;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+
+void CallFrameShuffler::emitBox(CachedRecovery& location)
+{
+    // Nothing to do, we're good! JSValues and doubles can be stored
+    // immediately, and other formats don't need any transformation -
+    // just storing a constant tag separately.
+    ASSERT_UNUSED(location, canBox(location));
+}
+
+void CallFrameShuffler::emitLoad(CachedRecovery& location)
+{
+    if (!location.recovery().isInJSStack())
+        return;
+
+    if (verbose)
+        dataLog("   * Loading ", location.recovery(), " into ");
+    VirtualRegister reg { location.recovery().virtualRegister() };
+    MacroAssembler::Address address { addressForOld(reg) };
+
+    bool tryFPR { true };
+    JSValueRegs wantedJSValueRegs { location.wantedJSValueRegs() };
+    if (wantedJSValueRegs) {
+        if (wantedJSValueRegs.payloadGPR() != InvalidGPRReg
+            && !m_registers[wantedJSValueRegs.payloadGPR()]
+            && !m_lockedRegisters.get(wantedJSValueRegs.payloadGPR()))
+            tryFPR = false;
+        if (wantedJSValueRegs.tagGPR() != InvalidGPRReg
+            && !m_registers[wantedJSValueRegs.tagGPR()]
+            && !m_lockedRegisters.get(wantedJSValueRegs.tagGPR()))
+            tryFPR = false;
+    }
+
+    if (tryFPR && location.loadsIntoFPR()) {
+        FPRReg resultFPR = location.wantedFPR();
+        if (resultFPR == InvalidFPRReg || m_registers[resultFPR] || m_lockedRegisters.get(resultFPR))
+            resultFPR = getFreeFPR();
+        if (resultFPR != InvalidFPRReg) {
+            m_jit.loadDouble(address, resultFPR);
+            DataFormat dataFormat = DataFormatJS;
+            if (location.recovery().dataFormat() == DataFormatDouble)
+                dataFormat = DataFormatDouble;
+            updateRecovery(location, 
+                ValueRecovery::inFPR(resultFPR, dataFormat));
+            if (verbose)
+                dataLog(location.recovery(), "\n");
+            if (reg == newAsOld(dangerFrontier()))
+                updateDangerFrontier();
+            return;
+        }
+    }
+
+    if (location.loadsIntoGPR()) {
+        GPRReg resultGPR { wantedJSValueRegs.payloadGPR() };
+        if (resultGPR == InvalidGPRReg || m_registers[resultGPR] || m_lockedRegisters.get(resultGPR))
+            resultGPR = getFreeGPR();
+        ASSERT(resultGPR != InvalidGPRReg);
+        m_jit.loadPtr(address.withOffset(PayloadOffset), resultGPR);
+        updateRecovery(location, 
+            ValueRecovery::inGPR(resultGPR, location.recovery().dataFormat()));
+        if (verbose)
+            dataLog(location.recovery(), "\n");
+        if (reg == newAsOld(dangerFrontier()))
+            updateDangerFrontier();
+        return;
+    }
+
+    ASSERT(location.recovery().technique() == DisplacedInJSStack);
+    GPRReg payloadGPR { wantedJSValueRegs.payloadGPR() };
+    GPRReg tagGPR { wantedJSValueRegs.tagGPR() };
+    if (payloadGPR == InvalidGPRReg || m_registers[payloadGPR] || m_lockedRegisters.get(payloadGPR))
+        payloadGPR = getFreeGPR();
+    m_lockedRegisters.set(payloadGPR);
+    if (tagGPR == InvalidGPRReg || m_registers[tagGPR] || m_lockedRegisters.get(tagGPR))
+        tagGPR = getFreeGPR();
+    m_lockedRegisters.clear(payloadGPR);
+    ASSERT(payloadGPR != InvalidGPRReg && tagGPR != InvalidGPRReg && tagGPR != payloadGPR);
+    m_jit.loadPtr(address.withOffset(PayloadOffset), payloadGPR);
+    m_jit.loadPtr(address.withOffset(TagOffset), tagGPR);
+    updateRecovery(location, 
+        ValueRecovery::inPair(tagGPR, payloadGPR));
+    if (verbose)
+        dataLog(location.recovery(), "\n");
+    if (reg == newAsOld(dangerFrontier()))
+        updateDangerFrontier();
+}
+
+bool CallFrameShuffler::canLoad(CachedRecovery& location)
+{
+    if (!location.recovery().isInJSStack())
+        return true;
+
+    if (location.loadsIntoFPR() && getFreeFPR() != InvalidFPRReg)
+        return true;
+
+    if (location.loadsIntoGPR() && getFreeGPR() != InvalidGPRReg)
+        return true;
+
+    if (location.recovery().technique() == DisplacedInJSStack) {
+        GPRReg payloadGPR { getFreeGPR() };
+        if (payloadGPR == InvalidGPRReg)
+            return false;
+        m_lockedRegisters.set(payloadGPR);
+        GPRReg tagGPR { getFreeGPR() };
+        m_lockedRegisters.clear(payloadGPR);
+        return tagGPR != InvalidGPRReg;
+    }
+
+    return false;
+}
+
+void CallFrameShuffler::emitDisplace(CachedRecovery& location)
+{
+    ASSERT(location.recovery().isInRegisters());
+    JSValueRegs wantedJSValueRegs { location.wantedJSValueRegs() };
+    ASSERT(wantedJSValueRegs); // We don't support wanted FPRs on 32bit platforms
+
+    GPRReg wantedTagGPR { wantedJSValueRegs.tagGPR() };
+    GPRReg wantedPayloadGPR { wantedJSValueRegs.payloadGPR() };
+    
+    if (wantedTagGPR != InvalidGPRReg) {
+        ASSERT(!m_lockedRegisters.get(wantedTagGPR));
+        if (CachedRecovery* currentTag { m_registers[wantedTagGPR] }) {
+            if (currentTag == &location) {
+                if (verbose)
+                    dataLog("   + ", wantedTagGPR, " is OK\n");
+            } else {
+                // This can never happen on 32bit platforms since we
+                // have at most one wanted JSValueRegs, for the
+                // callee, and no callee-save registers.
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+    }
+
+    if (wantedPayloadGPR != InvalidGPRReg) {
+        ASSERT(!m_lockedRegisters.get(wantedPayloadGPR));
+        if (CachedRecovery* currentPayload { m_registers[wantedPayloadGPR] }) {
+            if (currentPayload == &location) {
+                if (verbose)
+                    dataLog("   + ", wantedPayloadGPR, " is OK\n");
+            } else {
+                // See above
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+    }
+
+    if (location.recovery().technique() == InPair
+        || location.recovery().isInGPR()) {
+        GPRReg payloadGPR;
+        if (location.recovery().technique() == InPair)
+            payloadGPR = location.recovery().payloadGPR();
+        else
+            payloadGPR = location.recovery().gpr();
+
+        if (wantedPayloadGPR == InvalidGPRReg)
+            wantedPayloadGPR = payloadGPR;
+
+        if (payloadGPR != wantedPayloadGPR) {
+            if (location.recovery().technique() == InPair
+                && wantedPayloadGPR == location.recovery().tagGPR()) {
+                if (verbose)
+                    dataLog("   * Swapping ", payloadGPR, " and ", wantedPayloadGPR, "\n");
+                m_jit.swap(payloadGPR, wantedPayloadGPR);
+                updateRecovery(location, 
+                    ValueRecovery::inPair(payloadGPR, wantedPayloadGPR));
+            } else {
+                if (verbose)
+                    dataLog("   * Moving ", payloadGPR, " into ", wantedPayloadGPR, "\n");
+                m_jit.move(payloadGPR, wantedPayloadGPR);
+                if (location.recovery().technique() == InPair) {
+                    updateRecovery(location,
+                        ValueRecovery::inPair(location.recovery().tagGPR(),
+                            wantedPayloadGPR));
+                } else {
+                    updateRecovery(location, 
+                        ValueRecovery::inGPR(wantedPayloadGPR, location.recovery().dataFormat()));
+                }
+            }
+        }
+
+        if (wantedTagGPR == InvalidGPRReg)
+            wantedTagGPR = getFreeGPR();
+        switch (location.recovery().dataFormat()) {
+        case DataFormatInt32:
+            if (verbose)
+                dataLog("   * Moving int32 tag into ", wantedTagGPR, "\n");
+            m_jit.move(MacroAssembler::TrustedImm32(JSValue::Int32Tag),
+                wantedTagGPR);
+            break;
+        case DataFormatCell:
+            if (verbose)
+                dataLog("   * Moving cell tag into ", wantedTagGPR, "\n");
+            m_jit.move(MacroAssembler::TrustedImm32(JSValue::CellTag),
+                wantedTagGPR);
+            break;
+        case DataFormatBoolean:
+            if (verbose)
+                dataLog("   * Moving boolean tag into ", wantedTagGPR, "\n");
+            m_jit.move(MacroAssembler::TrustedImm32(JSValue::BooleanTag),
+                wantedTagGPR);
+            break;
+        case DataFormatJS:
+            ASSERT(wantedTagGPR != location.recovery().payloadGPR());
+            if (wantedTagGPR != location.recovery().tagGPR()) {
+                if (verbose)
+                    dataLog("   * Moving ", location.recovery().tagGPR(), " into ", wantedTagGPR, "\n");
+                m_jit.move(location.recovery().tagGPR(), wantedTagGPR);
+            }
+            break;
+
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    } else {
+        ASSERT(location.recovery().isInFPR());
+        if (wantedTagGPR == InvalidGPRReg) {
+            ASSERT(wantedPayloadGPR != InvalidGPRReg);
+            m_lockedRegisters.set(wantedPayloadGPR);
+            wantedTagGPR = getFreeGPR();
+            m_lockedRegisters.clear(wantedPayloadGPR);
+        }
+        if (wantedPayloadGPR == InvalidGPRReg) {
+            m_lockedRegisters.set(wantedTagGPR);
+            wantedPayloadGPR = getFreeGPR();
+            m_lockedRegisters.clear(wantedTagGPR);
+        }
+        m_jit.boxDouble(location.recovery().fpr(), wantedTagGPR, wantedPayloadGPR);
+    }
+    updateRecovery(location, ValueRecovery::inPair(wantedTagGPR, wantedPayloadGPR));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT) && USE(JSVALUE32_64)
diff --git a/jit/CallFrameShuffler64.cpp b/jit/CallFrameShuffler64.cpp
new file mode 100644
index 0000000..2ef6ed1
--- /dev/null
+++ b/jit/CallFrameShuffler64.cpp
@@ -0,0 +1,369 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallFrameShuffler.h"
+
+#if ENABLE(JIT) && USE(JSVALUE64)
+
+#include "CCallHelpers.h"
+#include "DataFormat.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+DataFormat CallFrameShuffler::emitStore(
+    CachedRecovery& cachedRecovery, MacroAssembler::Address address)
+{
+    ASSERT(!cachedRecovery.recovery().isInJSStack());
+
+    switch (cachedRecovery.recovery().technique()) {
+    case InGPR:
+        m_jit.storePtr(cachedRecovery.recovery().gpr(), address);
+        return DataFormatJS;
+    case UnboxedInt32InGPR:
+        m_jit.store32(cachedRecovery.recovery().gpr(), address.withOffset(PayloadOffset));
+        return DataFormatInt32;
+    case UnboxedInt52InGPR:
+        m_jit.rshift64(MacroAssembler::TrustedImm32(JSValue::int52ShiftAmount),
+            cachedRecovery.recovery().gpr());
+        FALLTHROUGH;
+    case UnboxedStrictInt52InGPR:
+        m_jit.storePtr(cachedRecovery.recovery().gpr(), address);
+        return DataFormatStrictInt52;
+    case UnboxedBooleanInGPR:
+        m_jit.storePtr(cachedRecovery.recovery().gpr(), address);
+        return DataFormatBoolean;
+    case UnboxedCellInGPR:
+        m_jit.storePtr(cachedRecovery.recovery().gpr(), address);
+        return DataFormatCell;
+    case UnboxedDoubleInFPR:
+        m_jit.storeDouble(cachedRecovery.recovery().fpr(), address);
+        return DataFormatDouble;
+    case InFPR:
+        m_jit.storeDouble(cachedRecovery.recovery().fpr(), address);
+        return DataFormatJS;
+    case Constant:
+        m_jit.storeTrustedValue(cachedRecovery.recovery().constant(), address);
+        return DataFormatJS;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+
+void CallFrameShuffler::emitBox(CachedRecovery& cachedRecovery)
+{
+    ASSERT(canBox(cachedRecovery));
+    if (cachedRecovery.recovery().isConstant())
+        return;
+
+    if (cachedRecovery.recovery().isInGPR()) {
+        switch (cachedRecovery.recovery().dataFormat()) {
+        case DataFormatInt32:
+            if (verbose)
+                dataLog("   * Boxing ", cachedRecovery.recovery());
+            m_jit.zeroExtend32ToPtr(
+                cachedRecovery.recovery().gpr(),
+                cachedRecovery.recovery().gpr());
+            m_lockedRegisters.set(cachedRecovery.recovery().gpr());
+            if (tryAcquireTagTypeNumber())
+                m_jit.or64(m_tagTypeNumber, cachedRecovery.recovery().gpr());
+            else {
+                // We have to do this the hard way
+                m_jit.or64(MacroAssembler::TrustedImm64(TagTypeNumber),
+                    cachedRecovery.recovery().gpr());
+            }
+            m_lockedRegisters.clear(cachedRecovery.recovery().gpr());
+            cachedRecovery.setRecovery(
+                ValueRecovery::inGPR(cachedRecovery.recovery().gpr(), DataFormatJS));
+            if (verbose)
+                dataLog(" into ", cachedRecovery.recovery(), "\n");
+            return;
+        case DataFormatInt52:
+            if (verbose)
+                dataLog("   * Boxing ", cachedRecovery.recovery());
+            m_jit.rshift64(MacroAssembler::TrustedImm32(JSValue::int52ShiftAmount),
+                cachedRecovery.recovery().gpr());
+            cachedRecovery.setRecovery(
+                ValueRecovery::inGPR(cachedRecovery.recovery().gpr(), DataFormatStrictInt52));
+            if (verbose)
+                dataLog(" into ", cachedRecovery.recovery(), "\n");
+            FALLTHROUGH;
+        case DataFormatStrictInt52: {
+            if (verbose)
+                dataLog("   * Boxing ", cachedRecovery.recovery());
+            FPRReg resultFPR = getFreeFPR();
+            ASSERT(resultFPR != InvalidFPRReg);
+            m_jit.convertInt64ToDouble(cachedRecovery.recovery().gpr(), resultFPR);
+            updateRecovery(cachedRecovery, ValueRecovery::inFPR(resultFPR, DataFormatDouble));
+            if (verbose)
+                dataLog(" into ", cachedRecovery.recovery(), "\n");
+            break;
+        }
+        case DataFormatBoolean:
+            if (verbose)
+                dataLog("   * Boxing ", cachedRecovery.recovery());
+            m_jit.add32(MacroAssembler::TrustedImm32(ValueFalse),
+                cachedRecovery.recovery().gpr());
+            cachedRecovery.setRecovery(
+                ValueRecovery::inGPR(cachedRecovery.recovery().gpr(), DataFormatJS));
+            if (verbose)
+                dataLog(" into ", cachedRecovery.recovery(), "\n");
+            return;
+        default:
+            return;
+        }
+    }
+
+    if (cachedRecovery.recovery().isInFPR()) {
+        if (cachedRecovery.recovery().dataFormat() == DataFormatDouble) {
+            if (verbose)
+                dataLog("   * Boxing ", cachedRecovery.recovery());
+            GPRReg resultGPR = cachedRecovery.wantedJSValueRegs().gpr();
+            if (resultGPR == InvalidGPRReg || m_registers[resultGPR])
+                resultGPR = getFreeGPR();
+            ASSERT(resultGPR != InvalidGPRReg);
+            m_jit.purifyNaN(cachedRecovery.recovery().fpr());
+            m_jit.moveDoubleTo64(cachedRecovery.recovery().fpr(), resultGPR);
+            m_lockedRegisters.set(resultGPR);
+            if (tryAcquireTagTypeNumber())
+                m_jit.sub64(m_tagTypeNumber, resultGPR);
+            else
+                m_jit.sub64(MacroAssembler::TrustedImm64(TagTypeNumber), resultGPR);
+            m_lockedRegisters.clear(resultGPR);
+            updateRecovery(cachedRecovery, ValueRecovery::inGPR(resultGPR, DataFormatJS));
+            if (verbose)
+                dataLog(" into ", cachedRecovery.recovery(), "\n");
+            return;
+        }
+        ASSERT(cachedRecovery.recovery().dataFormat() == DataFormatJS);
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void CallFrameShuffler::emitLoad(CachedRecovery& cachedRecovery)
+{
+    if (!cachedRecovery.recovery().isInJSStack())
+        return;
+
+    if (verbose)
+        dataLog("   * Loading ", cachedRecovery.recovery(), " into ");
+
+    VirtualRegister reg = cachedRecovery.recovery().virtualRegister();
+    MacroAssembler::Address address { addressForOld(reg) };
+    bool tryFPR { true };
+    GPRReg resultGPR { cachedRecovery.wantedJSValueRegs().gpr() };
+
+    // If we want a GPR and it's available, that's better than loading
+    // into an FPR.
+    if (resultGPR != InvalidGPRReg && !m_registers[resultGPR]
+        && !m_lockedRegisters.get(resultGPR) && cachedRecovery.loadsIntoGPR())
+        tryFPR = false;
+
+    // Otherwise, we prefer loading into FPRs if possible
+    if (tryFPR && cachedRecovery.loadsIntoFPR()) {
+        FPRReg resultFPR { cachedRecovery.wantedFPR() };
+        if (resultFPR == InvalidFPRReg || m_registers[resultFPR] || m_lockedRegisters.get(resultFPR))
+            resultFPR = getFreeFPR();
+        if (resultFPR != InvalidFPRReg) {
+            m_jit.loadDouble(address, resultFPR);
+            DataFormat dataFormat = DataFormatJS;
+            // We could be transforming a DataFormatCell into a
+            // DataFormatJS here - but that's OK.
+            if (cachedRecovery.recovery().dataFormat() == DataFormatDouble)
+                dataFormat = DataFormatDouble;
+            updateRecovery(cachedRecovery,
+                ValueRecovery::inFPR(resultFPR, dataFormat));
+            if (verbose)
+                dataLog(cachedRecovery.recovery(), "\n");
+            if (reg == newAsOld(dangerFrontier()))
+                updateDangerFrontier();
+            return;
+        }
+    }
+
+    ASSERT(cachedRecovery.loadsIntoGPR());
+    if (resultGPR == InvalidGPRReg || m_registers[resultGPR] || m_lockedRegisters.get(resultGPR))
+        resultGPR = getFreeGPR();
+    ASSERT(resultGPR != InvalidGPRReg);
+    m_jit.loadPtr(address, resultGPR);
+    updateRecovery(cachedRecovery,
+        ValueRecovery::inGPR(resultGPR, cachedRecovery.recovery().dataFormat()));
+    if (verbose)
+        dataLog(cachedRecovery.recovery(), "\n");
+    if (reg == newAsOld(dangerFrontier()))
+        updateDangerFrontier();
+}
+
+bool CallFrameShuffler::canLoad(CachedRecovery& cachedRecovery)
+{
+    if (!cachedRecovery.recovery().isInJSStack())
+        return true;
+
+    ASSERT(cachedRecovery.loadsIntoFPR() || cachedRecovery.loadsIntoGPR());
+
+    if (cachedRecovery.loadsIntoFPR() && getFreeFPR() != InvalidFPRReg)
+        return true;
+
+    if (cachedRecovery.loadsIntoGPR() && getFreeGPR() != InvalidGPRReg)
+        return true;
+
+    return false;
+}
+
+void CallFrameShuffler::emitDisplace(CachedRecovery& cachedRecovery)
+{
+    Reg wantedReg;
+    if (!(wantedReg = Reg { cachedRecovery.wantedJSValueRegs().gpr() }))
+        wantedReg = Reg { cachedRecovery.wantedFPR() };
+    ASSERT(wantedReg);
+    ASSERT(!m_lockedRegisters.get(wantedReg));
+
+    if (CachedRecovery* current = m_registers[wantedReg]) {
+        if (current == &cachedRecovery) {
+            if (verbose)
+                dataLog("   + ", wantedReg, " is OK\n");
+            return;
+        }
+        // We could do a more complex thing by finding cycles
+        // etc. in that case.
+        // However, ending up in this situation will be super
+        // rare, and should actually be outright impossible for
+        // non-FTL tiers, since:
+        //  (a) All doubles have been converted into JSValues with
+        //      ValueRep nodes, so FPRs are initially free
+        //
+        //  (b) The only recoveries with wanted registers are the
+        //      callee (which always starts out in a register) and
+        //      the callee-save registers
+        //
+        //  (c) The callee-save registers are the first things we
+        //      load (after the return PC), and they are loaded as JSValues
+        //
+        //  (d) We prefer loading JSValues into FPRs if their
+        //      wanted GPR is not available
+        //
+        //  (e) If we end up spilling some registers with a
+        //      target, we won't load them again before the very
+        //      end of the algorithm
+        //
+        // Combined, this means that we will never load a recovery
+        // with a wanted GPR into any GPR other than its wanted
+        // GPR. The callee could however have been initially in
+        // one of the callee-save registers - but since the wanted
+        // GPR for the callee is always regT0, it will be the
+        // first one to be displaced, and we won't see it when
+        // handling any of the callee-save registers.
+        //
+        // Thus, the only way we could ever reach this path is in
+        // the FTL, when there is so much pressure that we
+        // absolutely need to load the callee-save registers into
+        // different GPRs initially but not enough pressure to
+        // then have to spill all of them. And even in that case,
+        // depending on the order in which B3 saves the
+        // callee-saves, we will probably still be safe. Anyway,
+        // the couple extra move instructions compared to an
+        // efficient cycle-based algorithm are not going to hurt
+        // us.
+        if (wantedReg.isFPR()) {
+            FPRReg tempFPR = getFreeFPR();
+            if (verbose)
+                dataLog("  * Moving ", wantedReg, " into ", tempFPR, "\n");
+            m_jit.moveDouble(wantedReg.fpr(), tempFPR);
+            updateRecovery(*current,
+                ValueRecovery::inFPR(tempFPR, current->recovery().dataFormat()));
+        } else {
+            GPRReg tempGPR = getFreeGPR();
+            if (verbose)
+                dataLog("  * Moving ", wantedReg.gpr(), " into ", tempGPR, "\n");
+            m_jit.move(wantedReg.gpr(), tempGPR);
+            updateRecovery(*current,
+                ValueRecovery::inGPR(tempGPR, current->recovery().dataFormat()));
+        }
+    }
+    ASSERT(!m_registers[wantedReg]);
+
+    if (cachedRecovery.recovery().isConstant()) {
+        // We only care about callee saves for wanted FPRs, and those are never constants
+        ASSERT(wantedReg.isGPR());
+        if (verbose)
+            dataLog("   * Loading ", cachedRecovery.recovery().constant(), " into ", wantedReg, "\n");
+        m_jit.moveTrustedValue(cachedRecovery.recovery().constant(), JSValueRegs { wantedReg.gpr() });
+        updateRecovery(
+            cachedRecovery,
+            ValueRecovery::inRegister(wantedReg, DataFormatJS));
+    } else if (cachedRecovery.recovery().isInGPR()) {
+        if (verbose)
+            dataLog("   * Moving ", cachedRecovery.recovery(), " into ", wantedReg, "\n");
+        if (wantedReg.isGPR())
+            m_jit.move(cachedRecovery.recovery().gpr(), wantedReg.gpr());
+        else
+            m_jit.move64ToDouble(cachedRecovery.recovery().gpr(), wantedReg.fpr());
+        RELEASE_ASSERT(cachedRecovery.recovery().dataFormat() == DataFormatJS);
+        updateRecovery(cachedRecovery,
+            ValueRecovery::inRegister(wantedReg, DataFormatJS));
+    } else {
+        ASSERT(cachedRecovery.recovery().isInFPR());
+        if (cachedRecovery.recovery().dataFormat() == DataFormatDouble) {
+            // We only care about callee saves for wanted FPRs, and those are always DataFormatJS
+            ASSERT(wantedReg.isGPR());
+            // This will automatically pick the wanted GPR
+            emitBox(cachedRecovery);
+        } else {
+            if (verbose)
+                dataLog("   * Moving ", cachedRecovery.recovery().fpr(), " into ", wantedReg, "\n");
+            if (wantedReg.isGPR())
+                m_jit.moveDoubleTo64(cachedRecovery.recovery().fpr(), wantedReg.gpr());
+            else
+                m_jit.moveDouble(cachedRecovery.recovery().fpr(), wantedReg.fpr());
+            RELEASE_ASSERT(cachedRecovery.recovery().dataFormat() == DataFormatJS);
+            updateRecovery(cachedRecovery,
+                ValueRecovery::inRegister(wantedReg, DataFormatJS));
+        }
+    }
+
+    ASSERT(m_registers[wantedReg] == &cachedRecovery);
+}
+    
+bool CallFrameShuffler::tryAcquireTagTypeNumber()
+{
+    if (m_tagTypeNumber != InvalidGPRReg)
+        return true;
+
+    m_tagTypeNumber = getFreeGPR();
+
+    if (m_tagTypeNumber == InvalidGPRReg)
+        return false;
+
+    m_lockedRegisters.set(m_tagTypeNumber);
+    m_jit.move(MacroAssembler::TrustedImm64(TagTypeNumber), m_tagTypeNumber);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT) && USE(JSVALUE64)
diff --git a/jit/CompactJITCodeMap.h b/jit/CompactJITCodeMap.h
new file mode 100644
index 0000000..01f8faf
--- /dev/null
+++ b/jit/CompactJITCodeMap.h
@@ -0,0 +1,292 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Assertions.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+// Gives you a compressed map between between bytecode indices and machine code
+// entry points. The compression simply tries to use either 1, 2, or 4 bytes for
+// any given offset. The largest offset that can be stored is 2^30.
+
+// Example use:
+//
+// CompactJITCodeMap::Encoder encoder(map);
+// encoder.append(a, b);
+// encoder.append(c, d); // preconditions: c >= a, d >= b
+// auto map = encoder.finish();
+//
+// At some later time:
+//
+// Vector<BytecodeAndMachineOffset> decoded;
+// map->decode(decoded);
+
+struct BytecodeAndMachineOffset {
+    BytecodeAndMachineOffset() { }
+    
+    BytecodeAndMachineOffset(unsigned bytecodeIndex, unsigned machineCodeOffset)
+        : m_bytecodeIndex(bytecodeIndex)
+        , m_machineCodeOffset(machineCodeOffset)
+    {
+    }
+    
+    unsigned m_bytecodeIndex;
+    unsigned m_machineCodeOffset;
+    
+    static inline unsigned getBytecodeIndex(BytecodeAndMachineOffset* mapping)
+    {
+        return mapping->m_bytecodeIndex;
+    }
+    
+    static inline unsigned getMachineCodeOffset(BytecodeAndMachineOffset* mapping)
+    {
+        return mapping->m_machineCodeOffset;
+    }
+};
+
+class CompactJITCodeMap {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    CompactJITCodeMap(uint8_t* buffer, unsigned size, unsigned numberOfEntries)
+        : m_buffer(buffer)
+#if !ASSERT_DISABLED
+        , m_size(size)
+#endif
+        , m_numberOfEntries(numberOfEntries)
+    {
+        UNUSED_PARAM(size);
+    }
+
+    ~CompactJITCodeMap()
+    {
+        if (m_buffer)
+            fastFree(m_buffer);
+    }
+    
+    unsigned numberOfEntries() const
+    {
+        return m_numberOfEntries;
+    }
+    
+    void decode(Vector<BytecodeAndMachineOffset>& result) const;
+    
+private:
+    uint8_t at(unsigned index) const
+    {
+        ASSERT(index < m_size);
+        return m_buffer[index];
+    }
+    
+    unsigned decodeNumber(unsigned& index) const
+    {
+        uint8_t headValue = at(index++);
+        if (!(headValue & 128))
+            return headValue;
+        if (!(headValue & 64))
+            return (static_cast<unsigned>(headValue & ~128) << 8) | at(index++);
+        unsigned second = at(index++);
+        unsigned third  = at(index++);
+        unsigned fourth = at(index++);
+        return (static_cast<unsigned>(headValue & ~(128 + 64)) << 24) | (second << 16) | (third << 8) | fourth;
+    }
+    
+    uint8_t* m_buffer;
+#if !ASSERT_DISABLED
+    unsigned m_size;
+#endif
+    unsigned m_numberOfEntries;
+    
+public:
+    class Encoder {
+        WTF_MAKE_NONCOPYABLE(Encoder);
+    public:
+        Encoder();
+        ~Encoder();
+        
+        void ensureCapacityFor(unsigned numberOfEntriesToAdd);
+        void append(unsigned bytecodeIndex, unsigned machineCodeOffset);
+        std::unique_ptr<CompactJITCodeMap> finish();
+
+    private:
+        void appendByte(uint8_t value);
+        void encodeNumber(uint32_t value);
+    
+        uint8_t* m_buffer;
+        unsigned m_size;
+        unsigned m_capacity;
+        unsigned m_numberOfEntries;
+        
+        unsigned m_previousBytecodeIndex;
+        unsigned m_previousMachineCodeOffset;
+    };
+    
+    class Decoder {
+        WTF_MAKE_NONCOPYABLE(Decoder);
+    public:
+        Decoder(const CompactJITCodeMap*);
+        
+        unsigned numberOfEntriesRemaining() const;
+        void read(unsigned& bytecodeIndex, unsigned& machineCodeOffset);
+        
+    private:
+        const CompactJITCodeMap* m_jitCodeMap;
+        unsigned m_previousBytecodeIndex;
+        unsigned m_previousMachineCodeOffset;
+        unsigned m_numberOfEntriesRemaining;
+        unsigned m_bufferIndex;
+    };
+
+private:
+    friend class Encoder;
+    friend class Decoder;
+};
+
+inline void CompactJITCodeMap::decode(Vector<BytecodeAndMachineOffset>& result) const
+{
+    Decoder decoder(this);
+    result.resize(decoder.numberOfEntriesRemaining());
+    for (unsigned i = 0; i < result.size(); ++i)
+        decoder.read(result[i].m_bytecodeIndex, result[i].m_machineCodeOffset);
+    
+    ASSERT(!decoder.numberOfEntriesRemaining());
+}
+
+inline CompactJITCodeMap::Encoder::Encoder()
+    : m_buffer(0)
+    , m_size(0)
+    , m_capacity(0)
+    , m_numberOfEntries(0)
+    , m_previousBytecodeIndex(0)
+    , m_previousMachineCodeOffset(0)
+{
+}
+
+inline CompactJITCodeMap::Encoder::~Encoder()
+{
+    if (m_buffer)
+        fastFree(m_buffer);
+}
+        
+inline void CompactJITCodeMap::Encoder::append(unsigned bytecodeIndex, unsigned machineCodeOffset)
+{
+    ASSERT(bytecodeIndex >= m_previousBytecodeIndex);
+    ASSERT(machineCodeOffset >= m_previousMachineCodeOffset);
+    ensureCapacityFor(1);
+    encodeNumber(bytecodeIndex - m_previousBytecodeIndex);
+    encodeNumber(machineCodeOffset - m_previousMachineCodeOffset);
+    m_previousBytecodeIndex = bytecodeIndex;
+    m_previousMachineCodeOffset = machineCodeOffset;
+    m_numberOfEntries++;
+}
+
+inline std::unique_ptr<CompactJITCodeMap> CompactJITCodeMap::Encoder::finish()
+{
+    m_capacity = m_size;
+    m_buffer = static_cast<uint8_t*>(fastRealloc(m_buffer, m_capacity));
+    auto result = std::make_unique<CompactJITCodeMap>(m_buffer, m_size, m_numberOfEntries);
+    m_buffer = 0;
+    m_size = 0;
+    m_capacity = 0;
+    m_numberOfEntries = 0;
+    m_previousBytecodeIndex = 0;
+    m_previousMachineCodeOffset = 0;
+    return result;
+}
+        
+inline void CompactJITCodeMap::Encoder::appendByte(uint8_t value)
+{
+    ASSERT(m_size + 1 <= m_capacity);
+    m_buffer[m_size++] = value;
+}
+    
+inline void CompactJITCodeMap::Encoder::encodeNumber(uint32_t value)
+{
+    ASSERT(m_size + 4 <= m_capacity);
+    ASSERT(value < (1 << 30));
+    if (value <= 127) {
+        uint8_t headValue = static_cast<uint8_t>(value);
+        ASSERT(!(headValue & 128));
+        appendByte(headValue);
+    } else if (value <= 16383) {
+        uint8_t headValue = static_cast<uint8_t>(value >> 8);
+        ASSERT(!(headValue & 128));
+        ASSERT(!(headValue & 64));
+        appendByte(headValue | 128);
+        appendByte(static_cast<uint8_t>(value));
+    } else {
+        uint8_t headValue = static_cast<uint8_t>(value >> 24);
+        ASSERT(!(headValue & 128));
+        ASSERT(!(headValue & 64));
+        appendByte(headValue | 128 | 64);
+        appendByte(static_cast<uint8_t>(value >> 16));
+        appendByte(static_cast<uint8_t>(value >> 8));
+        appendByte(static_cast<uint8_t>(value));
+    }
+}
+
+inline void CompactJITCodeMap::Encoder::ensureCapacityFor(unsigned numberOfEntriesToAdd)
+{
+    unsigned capacityNeeded = m_size + numberOfEntriesToAdd * 2 * 4;
+    if (capacityNeeded > m_capacity) {
+        m_capacity = capacityNeeded * 2;
+        m_buffer = static_cast<uint8_t*>(fastRealloc(m_buffer, m_capacity));
+    }
+}
+
+inline CompactJITCodeMap::Decoder::Decoder(const CompactJITCodeMap* jitCodeMap)
+    : m_jitCodeMap(jitCodeMap)
+    , m_previousBytecodeIndex(0)
+    , m_previousMachineCodeOffset(0)
+    , m_numberOfEntriesRemaining(jitCodeMap->m_numberOfEntries)
+    , m_bufferIndex(0)
+{
+}
+
+inline unsigned CompactJITCodeMap::Decoder::numberOfEntriesRemaining() const
+{
+    ASSERT(m_numberOfEntriesRemaining || m_bufferIndex == m_jitCodeMap->m_size);
+    return m_numberOfEntriesRemaining;
+}
+
+inline void CompactJITCodeMap::Decoder::read(unsigned& bytecodeIndex, unsigned& machineCodeOffset)
+{
+    ASSERT(numberOfEntriesRemaining());
+    
+    m_previousBytecodeIndex += m_jitCodeMap->decodeNumber(m_bufferIndex);
+    m_previousMachineCodeOffset += m_jitCodeMap->decodeNumber(m_bufferIndex);
+    bytecodeIndex = m_previousBytecodeIndex;
+    machineCodeOffset = m_previousMachineCodeOffset;
+    m_numberOfEntriesRemaining--;
+}
+
+} // namespace JSC
diff --git a/jit/ExecutableAllocationFuzz.cpp b/jit/ExecutableAllocationFuzz.cpp
new file mode 100644
index 0000000..b4f5665
--- /dev/null
+++ b/jit/ExecutableAllocationFuzz.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ExecutableAllocationFuzz.h"
+
+#include "TestRunnerUtils.h"
+#include <wtf/Atomics.h>
+#include <wtf/DataLog.h>
+
+namespace JSC {
+
+static Atomic<unsigned> s_numberOfExecutableAllocationFuzzChecks;
+unsigned numberOfExecutableAllocationFuzzChecks()
+{
+    return s_numberOfExecutableAllocationFuzzChecks.load();
+}
+
+ExecutableAllocationFuzzResult doExecutableAllocationFuzzing()
+{
+    ASSERT(Options::useExecutableAllocationFuzz());
+    
+    unsigned oldValue;
+    unsigned newValue;
+    do {
+        oldValue = s_numberOfExecutableAllocationFuzzChecks.load();
+        newValue = oldValue + 1;
+    } while (!s_numberOfExecutableAllocationFuzzChecks.compareExchangeWeak(oldValue, newValue));
+    
+    if (newValue == Options::fireExecutableAllocationFuzzAt()) {
+        if (Options::verboseExecutableAllocationFuzz()) {
+            dataLog("Will pretend to fail executable allocation.\n");
+            WTFReportBacktrace();
+        }
+        return PretendToFailExecutableAllocation;
+    }
+    
+    if (Options::fireExecutableAllocationFuzzAtOrAfter()
+        && newValue >= Options::fireExecutableAllocationFuzzAtOrAfter()) {
+        if (Options::verboseExecutableAllocationFuzz()) {
+            dataLog("Will pretend to fail executable allocation.\n");
+            WTFReportBacktrace();
+        }
+        return PretendToFailExecutableAllocation;
+    }
+    
+    return AllowNormalExecutableAllocation;
+}
+
+} // namespace JSC
+
diff --git a/jit/ExecutableAllocationFuzz.h b/jit/ExecutableAllocationFuzz.h
new file mode 100644
index 0000000..176e172
--- /dev/null
+++ b/jit/ExecutableAllocationFuzz.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Options.h"
+
+namespace JSC {
+
+enum ExecutableAllocationFuzzResult {
+    AllowNormalExecutableAllocation,
+    PretendToFailExecutableAllocation
+};
+
+ExecutableAllocationFuzzResult doExecutableAllocationFuzzing();
+
+inline ExecutableAllocationFuzzResult doExecutableAllocationFuzzingIfEnabled()
+{
+    if (LIKELY(!Options::useExecutableAllocationFuzz()))
+        return AllowNormalExecutableAllocation;
+    
+    return doExecutableAllocationFuzzing();
+}
+
+} // namespace JSC
diff --git a/jit/ExecutableAllocator.cpp b/jit/ExecutableAllocator.cpp
new file mode 100644
index 0000000..41f002e
--- /dev/null
+++ b/jit/ExecutableAllocator.cpp
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ExecutableAllocator.h"
+
+#include "JSCInlines.h"
+
+#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
+#include "CodeProfiling.h"
+#include <wtf/HashSet.h>
+#include <wtf/Lock.h>
+#include <wtf/MetaAllocator.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/PageReservation.h>
+#include <wtf/VMTags.h>
+#endif
+
+// Uncomment to create an artificial executable memory usage limit. This limit
+// is imperfect and is primarily useful for testing the VM's ability to handle
+// out-of-executable-memory situations.
+// #define EXECUTABLE_MEMORY_LIMIT 1000000
+
+#if ENABLE(ASSEMBLER)
+
+using namespace WTF;
+
+namespace JSC {
+
+#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
+
+class DemandExecutableAllocator : public MetaAllocator {
+public:
+    DemandExecutableAllocator()
+        : MetaAllocator(jitAllocationGranule)
+    {
+        std::lock_guard<StaticLock> lock(allocatorsMutex());
+        allocators().add(this);
+        // Don't preallocate any memory here.
+    }
+    
+    virtual ~DemandExecutableAllocator()
+    {
+        {
+            std::lock_guard<StaticLock> lock(allocatorsMutex());
+            allocators().remove(this);
+        }
+        for (unsigned i = 0; i < reservations.size(); ++i)
+            reservations.at(i).deallocate();
+    }
+
+    static size_t bytesAllocatedByAllAllocators()
+    {
+        size_t total = 0;
+        std::lock_guard<StaticLock> lock(allocatorsMutex());
+        for (HashSet<DemandExecutableAllocator*>::const_iterator allocator = allocators().begin(); allocator != allocators().end(); ++allocator)
+            total += (*allocator)->bytesAllocated();
+        return total;
+    }
+
+    static size_t bytesCommittedByAllocactors()
+    {
+        size_t total = 0;
+        std::lock_guard<StaticLock> lock(allocatorsMutex());
+        for (HashSet<DemandExecutableAllocator*>::const_iterator allocator = allocators().begin(); allocator != allocators().end(); ++allocator)
+            total += (*allocator)->bytesCommitted();
+        return total;
+    }
+
+#if ENABLE(META_ALLOCATOR_PROFILE)
+    static void dumpProfileFromAllAllocators()
+    {
+        std::lock_guard<StaticLock> lock(allocatorsMutex());
+        for (HashSet<DemandExecutableAllocator*>::const_iterator allocator = allocators().begin(); allocator != allocators().end(); ++allocator)
+            (*allocator)->dumpProfile();
+    }
+#endif
+
+protected:
+    virtual void* allocateNewSpace(size_t& numPages)
+    {
+        size_t newNumPages = (((numPages * pageSize() + JIT_ALLOCATOR_LARGE_ALLOC_SIZE - 1) / JIT_ALLOCATOR_LARGE_ALLOC_SIZE * JIT_ALLOCATOR_LARGE_ALLOC_SIZE) + pageSize() - 1) / pageSize();
+        
+        ASSERT(newNumPages >= numPages);
+        
+        numPages = newNumPages;
+        
+#ifdef EXECUTABLE_MEMORY_LIMIT
+        if (bytesAllocatedByAllAllocators() >= EXECUTABLE_MEMORY_LIMIT)
+            return 0;
+#endif
+        
+        PageReservation reservation = PageReservation::reserve(numPages * pageSize(), OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
+        RELEASE_ASSERT(reservation);
+        
+        reservations.append(reservation);
+        
+        return reservation.base();
+    }
+    
+    virtual void notifyNeedPage(void* page)
+    {
+        OSAllocator::commit(page, pageSize(), EXECUTABLE_POOL_WRITABLE, true);
+    }
+    
+    virtual void notifyPageIsFree(void* page)
+    {
+        OSAllocator::decommit(page, pageSize());
+    }
+
+private:
+    Vector<PageReservation, 16> reservations;
+    static HashSet<DemandExecutableAllocator*>& allocators()
+    {
+        static NeverDestroyed<HashSet<DemandExecutableAllocator*>> set;
+        return set;
+    }
+
+    static StaticLock& allocatorsMutex()
+    {
+        static StaticLock mutex;
+
+        return mutex;
+    }
+};
+
+static DemandExecutableAllocator* gAllocator;
+
+namespace {
+static inline DemandExecutableAllocator* allocator()
+{
+    return gAllocator;
+}
+}
+
+void ExecutableAllocator::initializeAllocator()
+{
+    ASSERT(!gAllocator);
+    gAllocator = new DemandExecutableAllocator();
+    CodeProfiling::notifyAllocator(gAllocator);
+}
+
+ExecutableAllocator::ExecutableAllocator(VM&)
+{
+    ASSERT(allocator());
+}
+
+ExecutableAllocator::~ExecutableAllocator()
+{
+}
+
+bool ExecutableAllocator::isValid() const
+{
+    return true;
+}
+
+bool ExecutableAllocator::underMemoryPressure()
+{
+#ifdef EXECUTABLE_MEMORY_LIMIT
+    return DemandExecutableAllocator::bytesAllocatedByAllAllocators() > EXECUTABLE_MEMORY_LIMIT / 2;
+#else
+    return false;
+#endif
+}
+
+double ExecutableAllocator::memoryPressureMultiplier(size_t addedMemoryUsage)
+{
+    double result;
+#ifdef EXECUTABLE_MEMORY_LIMIT
+    size_t bytesAllocated = DemandExecutableAllocator::bytesAllocatedByAllAllocators() + addedMemoryUsage;
+    if (bytesAllocated >= EXECUTABLE_MEMORY_LIMIT)
+        bytesAllocated = EXECUTABLE_MEMORY_LIMIT;
+    result = static_cast<double>(EXECUTABLE_MEMORY_LIMIT) /
+        (EXECUTABLE_MEMORY_LIMIT - bytesAllocated);
+#else
+    UNUSED_PARAM(addedMemoryUsage);
+    result = 1.0;
+#endif
+    if (result < 1.0)
+        result = 1.0;
+    return result;
+
+}
+
+RefPtr<ExecutableMemoryHandle> ExecutableAllocator::allocate(VM&, size_t sizeInBytes, void* ownerUID, JITCompilationEffort effort)
+{
+    RefPtr<ExecutableMemoryHandle> result = allocator()->allocate(sizeInBytes, ownerUID);
+    RELEASE_ASSERT(result || effort != JITCompilationMustSucceed);
+    return result;
+}
+
+size_t ExecutableAllocator::committedByteCount()
+{
+    return DemandExecutableAllocator::bytesCommittedByAllocactors();
+}
+
+#if ENABLE(META_ALLOCATOR_PROFILE)
+void ExecutableAllocator::dumpProfile()
+{
+    DemandExecutableAllocator::dumpProfileFromAllAllocators();
+}
+#endif
+
+Lock& ExecutableAllocator::getLock() const
+{
+    return gAllocator->getLock();
+}
+
+bool ExecutableAllocator::isValidExecutableMemory(const LockHolder& locker, void* address)
+{
+    return gAllocator->isInAllocatedMemory(locker, address);
+}
+
+#endif // ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
+
+}
+
+#endif // HAVE(ASSEMBLER)
diff --git a/jit/ExecutableAllocator.h b/jit/ExecutableAllocator.h
new file mode 100644
index 0000000..3df33f9
--- /dev/null
+++ b/jit/ExecutableAllocator.h
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JITCompilationEffort.h"
+#include <stddef.h> // for ptrdiff_t
+#include <limits>
+#include <wtf/Assertions.h>
+#include <wtf/Lock.h>
+#include <wtf/MetaAllocatorHandle.h>
+#include <wtf/MetaAllocator.h>
+#include <wtf/PageAllocation.h>
+
+#if OS(IOS)
+#include <libkern/OSCacheControl.h>
+#endif
+
+#if OS(IOS)
+#include <sys/mman.h>
+#endif
+
+#if CPU(MIPS) && OS(LINUX)
+#include <sys/cachectl.h>
+#endif
+
+#if CPU(SH4) && OS(LINUX)
+#include <asm/cachectl.h>
+#include <asm/unistd.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+#endif
+
+#define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (pageSize() * 4)
+
+#define EXECUTABLE_POOL_WRITABLE true
+
+namespace JSC {
+
+class VM;
+
+static const unsigned jitAllocationGranule = 32;
+
+typedef WTF::MetaAllocatorHandle ExecutableMemoryHandle;
+
+#if ENABLE(ASSEMBLER)
+
+#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
+class DemandExecutableAllocator;
+#endif
+
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+#if defined(FIXED_EXECUTABLE_MEMORY_POOL_SIZE_IN_MB) && FIXED_EXECUTABLE_MEMORY_POOL_SIZE_IN_MB > 0
+static const size_t fixedExecutableMemoryPoolSize = FIXED_EXECUTABLE_MEMORY_POOL_SIZE_IN_MB * 1024 * 1024;
+#elif CPU(ARM)
+static const size_t fixedExecutableMemoryPoolSize = 16 * 1024 * 1024;
+#elif CPU(ARM64)
+static const size_t fixedExecutableMemoryPoolSize = 32 * 1024 * 1024;
+#elif CPU(X86_64)
+static const size_t fixedExecutableMemoryPoolSize = 1024 * 1024 * 1024;
+#else
+static const size_t fixedExecutableMemoryPoolSize = 32 * 1024 * 1024;
+#endif
+#if CPU(ARM)
+static const double executablePoolReservationFraction = 0.15;
+#else
+static const double executablePoolReservationFraction = 0.25;
+#endif
+
+extern JS_EXPORTDATA uintptr_t startOfFixedExecutableMemoryPool;
+extern JS_EXPORTDATA uintptr_t endOfFixedExecutableMemoryPool;
+
+typedef void (*JITWriteFunction)(off_t, const void*, size_t);
+extern JS_EXPORTDATA JITWriteFunction jitWriteFunction;
+
+static inline void* performJITMemcpy(void *dst, const void *src, size_t n)
+{
+    // Use execute-only write thunk for writes inside the JIT region. This is a variant of
+    // memcpy that takes an offset into the JIT region as its destination (first) parameter.
+    if (jitWriteFunction && (uintptr_t)dst >= startOfFixedExecutableMemoryPool && (uintptr_t)dst <= endOfFixedExecutableMemoryPool) {
+        off_t offset = (off_t)((uintptr_t)dst - startOfFixedExecutableMemoryPool);
+        jitWriteFunction(offset, src, n);
+        return dst;
+    }
+
+    // Use regular memcpy for writes outside the JIT region.
+    return memcpy(dst, src, n);
+}
+
+#else // ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+static inline void* performJITMemcpy(void *dst, const void *src, size_t n)
+{
+    return memcpy(dst, src, n);
+}
+#endif
+
+class ExecutableAllocator {
+    enum ProtectionSetting { Writable, Executable };
+
+public:
+    ExecutableAllocator(VM&);
+    ~ExecutableAllocator();
+    
+    static void initializeAllocator();
+
+    bool isValid() const;
+
+    static bool underMemoryPressure();
+    
+    static double memoryPressureMultiplier(size_t addedMemoryUsage);
+    
+#if ENABLE(META_ALLOCATOR_PROFILE)
+    static void dumpProfile();
+#else
+    static void dumpProfile() { }
+#endif
+
+    RefPtr<ExecutableMemoryHandle> allocate(VM&, size_t sizeInBytes, void* ownerUID, JITCompilationEffort);
+
+    bool isValidExecutableMemory(const LockHolder&, void* address);
+
+    static size_t committedByteCount();
+
+    Lock& getLock() const;
+};
+
+#endif // ENABLE(JIT) && ENABLE(ASSEMBLER)
+
+} // namespace JSC
diff --git a/jit/ExecutableAllocatorFixedVMPool.cpp b/jit/ExecutableAllocatorFixedVMPool.cpp
new file mode 100644
index 0000000..dd301e9
--- /dev/null
+++ b/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -0,0 +1,416 @@
+/*
+ * Copyright (C) 2009, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ExecutableAllocator.h"
+
+#include "JSCInlines.h"
+
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+
+#include "CodeProfiling.h"
+#include "ExecutableAllocationFuzz.h"
+#include <wtf/MetaAllocator.h>
+#include <wtf/PageReservation.h>
+
+#if OS(DARWIN)
+#include <sys/mman.h>
+#endif
+
+#include "LinkBuffer.h"
+#include "MacroAssembler.h"
+
+#if PLATFORM(MAC) || (PLATFORM(IOS) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 100000)
+#define HAVE_REMAP_JIT 1
+#endif
+
+#if HAVE(REMAP_JIT)
+#if CPU(ARM64) && PLATFORM(IOS) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 100000
+#define USE_EXECUTE_ONLY_JIT_WRITE_FUNCTION 1
+#endif
+#endif
+
+#if OS(DARWIN)
+#include <mach/mach.h>
+extern "C" {
+    /* Routine mach_vm_remap */
+#ifdef mig_external
+    mig_external
+#else
+    extern
+#endif /* mig_external */
+    kern_return_t mach_vm_remap
+    (
+     vm_map_t target_task,
+     mach_vm_address_t *target_address,
+     mach_vm_size_t size,
+     mach_vm_offset_t mask,
+     int flags,
+     vm_map_t src_task,
+     mach_vm_address_t src_address,
+     boolean_t copy,
+     vm_prot_t *cur_protection,
+     vm_prot_t *max_protection,
+     vm_inherit_t inheritance
+     );
+}
+
+#endif
+
+using namespace WTF;
+
+namespace JSC {
+
+JS_EXPORTDATA uintptr_t startOfFixedExecutableMemoryPool;
+JS_EXPORTDATA uintptr_t endOfFixedExecutableMemoryPool;
+
+JS_EXPORTDATA JITWriteFunction jitWriteFunction;
+
+#if !USE(EXECUTE_ONLY_JIT_WRITE_FUNCTION) && HAVE(REMAP_JIT)
+static uintptr_t startOfFixedWritableMemoryPool;
+#endif
+
+class FixedVMPoolExecutableAllocator : public MetaAllocator {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    FixedVMPoolExecutableAllocator()
+        : MetaAllocator(jitAllocationGranule) // round up all allocations to 32 bytes
+    {
+        size_t reservationSize;
+        if (Options::jitMemoryReservationSize())
+            reservationSize = Options::jitMemoryReservationSize();
+        else
+            reservationSize = fixedExecutableMemoryPoolSize;
+        reservationSize = roundUpToMultipleOf(pageSize(), reservationSize);
+        m_reservation = PageReservation::reserveWithGuardPages(reservationSize, OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
+        if (m_reservation) {
+            ASSERT(m_reservation.size() == reservationSize);
+            void* reservationBase = m_reservation.base();
+
+            if (Options::useSeparatedWXHeap()) {
+                // First page of our JIT allocation is reserved.
+                ASSERT(reservationSize >= pageSize() * 2);
+                reservationBase = (void*)((uintptr_t)reservationBase + pageSize());
+                reservationSize -= pageSize();
+                initializeSeparatedWXHeaps(m_reservation.base(), pageSize(), reservationBase, reservationSize);
+            }
+
+            addFreshFreeSpace(reservationBase, reservationSize);
+
+            startOfFixedExecutableMemoryPool = reinterpret_cast<uintptr_t>(reservationBase);
+            endOfFixedExecutableMemoryPool = startOfFixedExecutableMemoryPool + reservationSize;
+        }
+    }
+
+    virtual ~FixedVMPoolExecutableAllocator();
+    
+protected:
+    void* allocateNewSpace(size_t&) override
+    {
+        // We're operating in a fixed pool, so new allocation is always prohibited.
+        return 0;
+    }
+    
+    void notifyNeedPage(void* page) override
+    {
+#if USE(MADV_FREE_FOR_JIT_MEMORY)
+        UNUSED_PARAM(page);
+#else
+        m_reservation.commit(page, pageSize());
+#endif
+    }
+    
+    void notifyPageIsFree(void* page) override
+    {
+#if USE(MADV_FREE_FOR_JIT_MEMORY)
+        for (;;) {
+            int result = madvise(page, pageSize(), MADV_FREE);
+            if (!result)
+                return;
+            ASSERT(result == -1);
+            if (errno != EAGAIN) {
+                RELEASE_ASSERT_NOT_REACHED(); // In debug mode, this should be a hard failure.
+                break; // In release mode, we should just ignore the error - not returning memory to the OS is better than crashing, especially since we _will_ be able to reuse the memory internally anyway.
+            }
+        }
+#else
+        m_reservation.decommit(page, pageSize());
+#endif
+    }
+
+private:
+#if OS(DARWIN) && HAVE(REMAP_JIT)
+    void initializeSeparatedWXHeaps(void* stubBase, size_t stubSize, void* jitBase, size_t jitSize)
+    {
+        mach_vm_address_t writableAddr = 0;
+
+        // Create a second mapping of the JIT region at a random address.
+        vm_prot_t cur, max;
+        int remapFlags = VM_FLAGS_ANYWHERE;
+#if defined(VM_FLAGS_RANDOM_ADDR)
+        remapFlags |= VM_FLAGS_RANDOM_ADDR;
+#endif
+        kern_return_t ret = mach_vm_remap(mach_task_self(), &writableAddr, jitSize, 0,
+            remapFlags,
+            mach_task_self(), (mach_vm_address_t)jitBase, FALSE,
+            &cur, &max, VM_INHERIT_DEFAULT);
+
+        bool remapSucceeded = (ret == KERN_SUCCESS);
+        if (!remapSucceeded)
+            return;
+
+        // Assemble a thunk that will serve as the means for writing into the JIT region.
+        MacroAssemblerCodeRef writeThunk = jitWriteThunkGenerator(reinterpret_cast<void*>(writableAddr), stubBase, stubSize);
+
+        int result = 0;
+
+#if USE(EXECUTE_ONLY_JIT_WRITE_FUNCTION)
+        // Prevent reading the write thunk code.
+        result = mprotect(stubBase, stubSize, VM_PROT_EXECUTE_ONLY);
+        RELEASE_ASSERT(!result);
+#endif
+
+        // Prevent writing into the executable JIT mapping.
+        result = mprotect(jitBase, jitSize, VM_PROT_READ | VM_PROT_EXECUTE);
+        RELEASE_ASSERT(!result);
+
+        // Prevent execution in the writable JIT mapping.
+        result = mprotect((void*)writableAddr, jitSize, VM_PROT_READ | VM_PROT_WRITE);
+        RELEASE_ASSERT(!result);
+
+        // Zero out writableAddr to avoid leaking the address of the writable mapping.
+        memset_s(&writableAddr, sizeof(writableAddr), 0, sizeof(writableAddr));
+
+        jitWriteFunction = reinterpret_cast<JITWriteFunction>(writeThunk.code().executableAddress());
+    }
+
+#if CPU(ARM64) && USE(EXECUTE_ONLY_JIT_WRITE_FUNCTION)
+    MacroAssemblerCodeRef jitWriteThunkGenerator(void* writableAddr, void* stubBase, size_t stubSize)
+    {
+        using namespace ARM64Registers;
+        using TrustedImm32 = MacroAssembler::TrustedImm32;
+
+        MacroAssembler jit;
+
+        jit.move(MacroAssembler::TrustedImmPtr(writableAddr), x7);
+        jit.addPtr(x7, x0);
+
+        jit.move(x0, x3);
+        MacroAssembler::Jump smallCopy = jit.branch64(MacroAssembler::Below, x2, MacroAssembler::TrustedImm64(64));
+
+        jit.add64(TrustedImm32(32), x3);
+        jit.and64(TrustedImm32(-32), x3);
+        jit.loadPair64(x1, x12, x13);
+        jit.loadPair64(x1, TrustedImm32(16), x14, x15);
+        jit.sub64(x3, x0, x5);
+        jit.addPtr(x5, x1);
+
+        jit.loadPair64(x1, x8, x9);
+        jit.loadPair64(x1, TrustedImm32(16), x10, x11);
+        jit.add64(TrustedImm32(32), x1);
+        jit.sub64(x5, x2);
+        jit.storePair64(x12, x13, x0);
+        jit.storePair64(x14, x15, x0, TrustedImm32(16));
+        MacroAssembler::Jump cleanup = jit.branchSub64(MacroAssembler::BelowOrEqual, TrustedImm32(64), x2);
+
+        MacroAssembler::Label copyLoop = jit.label();
+        jit.storePair64WithNonTemporalAccess(x8, x9, x3);
+        jit.storePair64WithNonTemporalAccess(x10, x11, x3, TrustedImm32(16));
+        jit.add64(TrustedImm32(32), x3);
+        jit.loadPair64WithNonTemporalAccess(x1, x8, x9);
+        jit.loadPair64WithNonTemporalAccess(x1, TrustedImm32(16), x10, x11);
+        jit.add64(TrustedImm32(32), x1);
+        jit.branchSub64(MacroAssembler::Above, TrustedImm32(32), x2).linkTo(copyLoop, &jit);
+
+        cleanup.link(&jit);
+        jit.add64(x2, x1);
+        jit.loadPair64(x1, x12, x13);
+        jit.loadPair64(x1, TrustedImm32(16), x14, x15);
+        jit.storePair64(x8, x9, x3);
+        jit.storePair64(x10, x11, x3, TrustedImm32(16));
+        jit.addPtr(x2, x3);
+        jit.storePair64(x12, x13, x3, TrustedImm32(32));
+        jit.storePair64(x14, x15, x3, TrustedImm32(48));
+        jit.ret();
+
+        MacroAssembler::Label local0 = jit.label();
+        jit.load64(x1, PostIndex(8), x6);
+        jit.store64(x6, x3, PostIndex(8));
+        smallCopy.link(&jit);
+        jit.branchSub64(MacroAssembler::AboveOrEqual, TrustedImm32(8), x2).linkTo(local0, &jit);
+        MacroAssembler::Jump local2 = jit.branchAdd64(MacroAssembler::Equal, TrustedImm32(8), x2);
+        MacroAssembler::Label local1 = jit.label();
+        jit.load8(x1, PostIndex(1), x6);
+        jit.store8(x6, x3, PostIndex(1));
+        jit.branchSub64(MacroAssembler::NotEqual, TrustedImm32(1), x2).linkTo(local1, &jit);
+        local2.link(&jit);
+        jit.ret();
+
+        LinkBuffer linkBuffer(jit, stubBase, stubSize);
+        return FINALIZE_CODE(linkBuffer, ("Bulletproof JIT write thunk"));
+    }
+#else // CPU(ARM64) && USE(EXECUTE_ONLY_JIT_WRITE_FUNCTION)
+    static void genericWriteToJITRegion(off_t offset, const void* data, size_t dataSize)
+    {
+        memcpy((void*)(startOfFixedWritableMemoryPool + offset), data, dataSize);
+    }
+
+    MacroAssemblerCodeRef jitWriteThunkGenerator(void* address, void*, size_t)
+    {
+        startOfFixedWritableMemoryPool = reinterpret_cast<uintptr_t>(address);
+        uintptr_t function = (uintptr_t)((void*)&genericWriteToJITRegion);
+#if CPU(ARM_THUMB2)
+        // Handle thumb offset
+        function -= 1;
+#endif
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(MacroAssemblerCodePtr((void*)function));
+    }
+#endif
+
+#else // OS(DARWIN) && HAVE(REMAP_JIT)
+    void initializeSeparatedWXHeaps(void*, size_t, void*, size_t)
+    {
+    }
+#endif
+
+private:
+    PageReservation m_reservation;
+};
+
+static FixedVMPoolExecutableAllocator* allocator;
+
+void ExecutableAllocator::initializeAllocator()
+{
+    ASSERT(!allocator);
+    allocator = new FixedVMPoolExecutableAllocator();
+    CodeProfiling::notifyAllocator(allocator);
+}
+
+ExecutableAllocator::ExecutableAllocator(VM&)
+{
+    ASSERT(allocator);
+}
+
+ExecutableAllocator::~ExecutableAllocator()
+{
+}
+
+FixedVMPoolExecutableAllocator::~FixedVMPoolExecutableAllocator()
+{
+    m_reservation.deallocate();
+}
+
+bool ExecutableAllocator::isValid() const
+{
+    return !!allocator->bytesReserved();
+}
+
+bool ExecutableAllocator::underMemoryPressure()
+{
+    MetaAllocator::Statistics statistics = allocator->currentStatistics();
+    return statistics.bytesAllocated > statistics.bytesReserved / 2;
+}
+
+double ExecutableAllocator::memoryPressureMultiplier(size_t addedMemoryUsage)
+{
+    MetaAllocator::Statistics statistics = allocator->currentStatistics();
+    ASSERT(statistics.bytesAllocated <= statistics.bytesReserved);
+    size_t bytesAllocated = statistics.bytesAllocated + addedMemoryUsage;
+    size_t bytesAvailable = static_cast<size_t>(
+        statistics.bytesReserved * (1 - executablePoolReservationFraction));
+    if (bytesAllocated >= bytesAvailable)
+        bytesAllocated = bytesAvailable;
+    double result = 1.0;
+    size_t divisor = bytesAvailable - bytesAllocated;
+    if (divisor)
+        result = static_cast<double>(bytesAvailable) / divisor;
+    if (result < 1.0)
+        result = 1.0;
+    return result;
+}
+
+RefPtr<ExecutableMemoryHandle> ExecutableAllocator::allocate(VM&, size_t sizeInBytes, void* ownerUID, JITCompilationEffort effort)
+{
+    if (Options::logExecutableAllocation()) {
+        MetaAllocator::Statistics stats = allocator->currentStatistics();
+        dataLog("Allocating ", sizeInBytes, " bytes of executable memory with ", stats.bytesAllocated, " bytes allocated, ", stats.bytesReserved, " bytes reserved, and ", stats.bytesCommitted, " committed.\n");
+    }
+    
+    if (effort != JITCompilationCanFail && Options::reportMustSucceedExecutableAllocations()) {
+        dataLog("Allocating ", sizeInBytes, " bytes of executable memory with JITCompilationMustSucceed.\n");
+        WTFReportBacktrace();
+    }
+    
+    if (effort == JITCompilationCanFail
+        && doExecutableAllocationFuzzingIfEnabled() == PretendToFailExecutableAllocation)
+        return nullptr;
+    
+    if (effort == JITCompilationCanFail) {
+        // Don't allow allocations if we are down to reserve.
+        MetaAllocator::Statistics statistics = allocator->currentStatistics();
+        size_t bytesAllocated = statistics.bytesAllocated + sizeInBytes;
+        size_t bytesAvailable = static_cast<size_t>(
+            statistics.bytesReserved * (1 - executablePoolReservationFraction));
+        if (bytesAllocated > bytesAvailable)
+            return nullptr;
+    }
+    
+    RefPtr<ExecutableMemoryHandle> result = allocator->allocate(sizeInBytes, ownerUID);
+    if (!result) {
+        if (effort != JITCompilationCanFail) {
+            dataLog("Ran out of executable memory while allocating ", sizeInBytes, " bytes.\n");
+            CRASH();
+        }
+        return nullptr;
+    }
+    return result;
+}
+
+bool ExecutableAllocator::isValidExecutableMemory(const LockHolder& locker, void* address)
+{
+    return allocator->isInAllocatedMemory(locker, address);
+}
+
+Lock& ExecutableAllocator::getLock() const
+{
+    return allocator->getLock();
+}
+
+size_t ExecutableAllocator::committedByteCount()
+{
+    return allocator->bytesCommitted();
+}
+
+#if ENABLE(META_ALLOCATOR_PROFILE)
+void ExecutableAllocator::dumpProfile()
+{
+    allocator->dumpProfile();
+}
+#endif
+
+}
+
+
+#endif // ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
diff --git a/jit/FPRInfo.h b/jit/FPRInfo.h
new file mode 100644
index 0000000..f769133
--- /dev/null
+++ b/jit/FPRInfo.h
@@ -0,0 +1,428 @@
+/*
+ * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MacroAssembler.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+typedef MacroAssembler::FPRegisterID FPRReg;
+#define InvalidFPRReg ((::JSC::FPRReg)-1)
+
+#if ENABLE(JIT)
+
+#if CPU(X86) || CPU(X86_64)
+
+class FPRInfo {
+public:
+    typedef FPRReg RegisterType;
+    static const unsigned numberOfRegisters = 6;
+    static const unsigned numberOfArgumentRegisters = 8;
+
+    // Temporary registers.
+    static const FPRReg fpRegT0 = X86Registers::xmm0;
+    static const FPRReg fpRegT1 = X86Registers::xmm1;
+    static const FPRReg fpRegT2 = X86Registers::xmm2;
+    static const FPRReg fpRegT3 = X86Registers::xmm3;
+    static const FPRReg fpRegT4 = X86Registers::xmm4;
+    static const FPRReg fpRegT5 = X86Registers::xmm5;
+#if CPU(X86_64)
+    // Only X86_64 passes aguments in xmm registers
+    static const FPRReg argumentFPR0 = X86Registers::xmm0; // fpRegT0
+    static const FPRReg argumentFPR1 = X86Registers::xmm1; // fpRegT1
+    static const FPRReg argumentFPR2 = X86Registers::xmm2; // fpRegT2
+    static const FPRReg argumentFPR3 = X86Registers::xmm3; // fpRegT3
+    static const FPRReg argumentFPR4 = X86Registers::xmm4; // fpRegT4
+    static const FPRReg argumentFPR5 = X86Registers::xmm5; // fpRegT5
+    static const FPRReg argumentFPR6 = X86Registers::xmm6;
+    static const FPRReg argumentFPR7 = X86Registers::xmm7;
+#endif
+    // On X86 the return will actually be on the x87 stack,
+    // so we'll copy to xmm0 for sanity!
+    static const FPRReg returnValueFPR = X86Registers::xmm0; // fpRegT0
+
+    // FPRReg mapping is direct, the machine regsiter numbers can
+    // be used directly as indices into the FPR RegisterBank.
+    COMPILE_ASSERT(X86Registers::xmm0 == 0, xmm0_is_0);
+    COMPILE_ASSERT(X86Registers::xmm1 == 1, xmm1_is_1);
+    COMPILE_ASSERT(X86Registers::xmm2 == 2, xmm2_is_2);
+    COMPILE_ASSERT(X86Registers::xmm3 == 3, xmm3_is_3);
+    COMPILE_ASSERT(X86Registers::xmm4 == 4, xmm4_is_4);
+    COMPILE_ASSERT(X86Registers::xmm5 == 5, xmm5_is_5);
+    static FPRReg toRegister(unsigned index)
+    {
+        return (FPRReg)index;
+    }
+    static unsigned toIndex(FPRReg reg)
+    {
+        unsigned result = (unsigned)reg;
+        if (result >= numberOfRegisters)
+            return InvalidIndex;
+        return result;
+    }
+    
+    static FPRReg toArgumentRegister(unsigned index)
+    {
+        return (FPRReg)index;
+    }
+
+    static const char* debugName(FPRReg reg)
+    {
+        ASSERT(reg != InvalidFPRReg);
+#if CPU(X86_64)
+        ASSERT(static_cast<int>(reg) < 16);
+        static const char* nameForRegister[16] = {
+            "xmm0", "xmm1", "xmm2", "xmm3",
+            "xmm4", "xmm5", "xmm6", "xmm7",
+            "xmm8", "xmm9", "xmm10", "xmm11",
+            "xmm12", "xmm13", "xmm14", "xmm15"
+        };
+#elif CPU(X86)
+        ASSERT(static_cast<int>(reg) < 8);
+        static const char* nameForRegister[8] = {
+            "xmm0", "xmm1", "xmm2", "xmm3",
+            "xmm4", "xmm5", "xmm6", "xmm7"
+        };
+#endif
+        return nameForRegister[reg];
+    }
+    
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(X86) || CPU(X86_64)
+
+#if CPU(ARM)
+
+class FPRInfo {
+public:
+    typedef FPRReg RegisterType;
+    static const unsigned numberOfRegisters = 6;
+
+    // Temporary registers.
+    // d7 is use by the MacroAssembler as fpTempRegister.
+    static const FPRReg fpRegT0 = ARMRegisters::d0;
+    static const FPRReg fpRegT1 = ARMRegisters::d1;
+    static const FPRReg fpRegT2 = ARMRegisters::d2;
+    static const FPRReg fpRegT3 = ARMRegisters::d3;
+    static const FPRReg fpRegT4 = ARMRegisters::d4;
+    static const FPRReg fpRegT5 = ARMRegisters::d5;
+    // ARMv7 doesn't pass arguments in fp registers. The return
+    // value is also actually in integer registers, for now
+    // we'll return in d0 for simplicity.
+    static const FPRReg returnValueFPR = ARMRegisters::d0; // fpRegT0
+
+#if CPU(ARM_HARDFP)
+    static const FPRReg argumentFPR0 = ARMRegisters::d0; // fpRegT0
+    static const FPRReg argumentFPR1 = ARMRegisters::d1; // fpRegT1
+#endif
+
+    // FPRReg mapping is direct, the machine regsiter numbers can
+    // be used directly as indices into the FPR RegisterBank.
+    COMPILE_ASSERT(ARMRegisters::d0 == 0, d0_is_0);
+    COMPILE_ASSERT(ARMRegisters::d1 == 1, d1_is_1);
+    COMPILE_ASSERT(ARMRegisters::d2 == 2, d2_is_2);
+    COMPILE_ASSERT(ARMRegisters::d3 == 3, d3_is_3);
+    COMPILE_ASSERT(ARMRegisters::d4 == 4, d4_is_4);
+    COMPILE_ASSERT(ARMRegisters::d5 == 5, d5_is_5);
+    static FPRReg toRegister(unsigned index)
+    {
+        return (FPRReg)index;
+    }
+    static unsigned toIndex(FPRReg reg)
+    {
+        return (unsigned)reg;
+    }
+
+    static const char* debugName(FPRReg reg)
+    {
+        ASSERT(reg != InvalidFPRReg);
+        ASSERT(static_cast<int>(reg) < 32);
+        static const char* nameForRegister[32] = {
+            "d0", "d1", "d2", "d3",
+            "d4", "d5", "d6", "d7",
+            "d8", "d9", "d10", "d11",
+            "d12", "d13", "d14", "d15",
+            "d16", "d17", "d18", "d19",
+            "d20", "d21", "d22", "d23",
+            "d24", "d25", "d26", "d27",
+            "d28", "d29", "d30", "d31"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(ARM)
+
+#if CPU(ARM64)
+
+class FPRInfo {
+public:
+    typedef FPRReg RegisterType;
+    static const unsigned numberOfRegisters = 23;
+    static const unsigned numberOfArgumentRegisters = 8;
+
+    // Temporary registers.
+    // q8-q15 are callee saved, q31 is use by the MacroAssembler as fpTempRegister.
+    static const FPRReg fpRegT0 = ARM64Registers::q0;
+    static const FPRReg fpRegT1 = ARM64Registers::q1;
+    static const FPRReg fpRegT2 = ARM64Registers::q2;
+    static const FPRReg fpRegT3 = ARM64Registers::q3;
+    static const FPRReg fpRegT4 = ARM64Registers::q4;
+    static const FPRReg fpRegT5 = ARM64Registers::q5;
+    static const FPRReg fpRegT6 = ARM64Registers::q6;
+    static const FPRReg fpRegT7 = ARM64Registers::q7;
+    static const FPRReg fpRegT8 = ARM64Registers::q16;
+    static const FPRReg fpRegT9 = ARM64Registers::q17;
+    static const FPRReg fpRegT10 = ARM64Registers::q18;
+    static const FPRReg fpRegT11 = ARM64Registers::q19;
+    static const FPRReg fpRegT12 = ARM64Registers::q20;
+    static const FPRReg fpRegT13 = ARM64Registers::q21;
+    static const FPRReg fpRegT14 = ARM64Registers::q22;
+    static const FPRReg fpRegT15 = ARM64Registers::q23;
+    static const FPRReg fpRegT16 = ARM64Registers::q24;
+    static const FPRReg fpRegT17 = ARM64Registers::q25;
+    static const FPRReg fpRegT18 = ARM64Registers::q26;
+    static const FPRReg fpRegT19 = ARM64Registers::q27;
+    static const FPRReg fpRegT20 = ARM64Registers::q28;
+    static const FPRReg fpRegT21 = ARM64Registers::q29;
+    static const FPRReg fpRegT22 = ARM64Registers::q30;
+    static const FPRReg fpRegCS0 = ARM64Registers::q8;
+    static const FPRReg fpRegCS1 = ARM64Registers::q9;
+    static const FPRReg fpRegCS2 = ARM64Registers::q10;
+    static const FPRReg fpRegCS3 = ARM64Registers::q11;
+    static const FPRReg fpRegCS4 = ARM64Registers::q12;
+    static const FPRReg fpRegCS5 = ARM64Registers::q13;
+    static const FPRReg fpRegCS6 = ARM64Registers::q14;
+    static const FPRReg fpRegCS7 = ARM64Registers::q15;
+
+    static const FPRReg argumentFPR0 = ARM64Registers::q0; // fpRegT0
+    static const FPRReg argumentFPR1 = ARM64Registers::q1; // fpRegT1
+    static const FPRReg argumentFPR2 = ARM64Registers::q2; // fpRegT2
+    static const FPRReg argumentFPR3 = ARM64Registers::q3; // fpRegT3
+    static const FPRReg argumentFPR4 = ARM64Registers::q4; // fpRegT4
+    static const FPRReg argumentFPR5 = ARM64Registers::q5; // fpRegT5
+    static const FPRReg argumentFPR6 = ARM64Registers::q6; // fpRegT6
+    static const FPRReg argumentFPR7 = ARM64Registers::q7; // fpRegT7
+
+    static const FPRReg returnValueFPR = ARM64Registers::q0; // fpRegT0
+
+    static FPRReg toRegister(unsigned index)
+    {
+        ASSERT(index < numberOfRegisters);
+        static const FPRReg registerForIndex[numberOfRegisters] = {
+            fpRegT0, fpRegT1, fpRegT2, fpRegT3, fpRegT4, fpRegT5, fpRegT6, fpRegT7,
+            fpRegT8, fpRegT9, fpRegT10, fpRegT11, fpRegT12, fpRegT13, fpRegT14, fpRegT15,
+            fpRegT16, fpRegT17, fpRegT18, fpRegT19, fpRegT20, fpRegT21, fpRegT22
+        };
+        return registerForIndex[index];
+    }
+
+    static unsigned toIndex(FPRReg reg)
+    {
+        ASSERT(reg != InvalidFPRReg);
+        ASSERT(static_cast<int>(reg) < 32);
+        static const unsigned indexForRegister[32] = {
+            0, 1, 2, 3, 4, 5, 6, 7,
+            InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex,
+            8, 9, 10, 11, 12, 13, 14, 15,
+            16, 17, 18, 19, 20, 21, 22, InvalidIndex
+        };
+        unsigned result = indexForRegister[reg];
+        return result;
+    }
+
+    static FPRReg toArgumentRegister(unsigned index)
+    {
+        ASSERT(index < 8);
+        return static_cast<FPRReg>(index);
+    }
+
+    static const char* debugName(FPRReg reg)
+    {
+        ASSERT(reg != InvalidFPRReg);
+        ASSERT(static_cast<int>(reg) < 32);
+        static const char* nameForRegister[32] = {
+            "q0", "q1", "q2", "q3", "q4", "q5", "q6", "q7",
+            "q8", "q9", "q10", "q11", "q12", "q13", "q14", "q15",
+            "q16", "q17", "q18", "q19", "q20", "q21", "q22", "q23",
+            "q24", "q25", "q26", "q27", "q28", "q29", "q30", "q31"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(ARM64)
+
+#if CPU(MIPS)
+
+class FPRInfo {
+public:
+    typedef FPRReg RegisterType;
+    static const unsigned numberOfRegisters = 7;
+
+    // Temporary registers.
+    static const FPRReg fpRegT0 = MIPSRegisters::f0;
+    static const FPRReg fpRegT1 = MIPSRegisters::f2;
+    static const FPRReg fpRegT2 = MIPSRegisters::f4;
+    static const FPRReg fpRegT3 = MIPSRegisters::f6;
+    static const FPRReg fpRegT4 = MIPSRegisters::f8;
+    static const FPRReg fpRegT5 = MIPSRegisters::f10;
+    static const FPRReg fpRegT6 = MIPSRegisters::f18;
+
+    static const FPRReg returnValueFPR = MIPSRegisters::f0;
+
+    static const FPRReg argumentFPR0 = MIPSRegisters::f12;
+    static const FPRReg argumentFPR1 = MIPSRegisters::f14;
+
+    static FPRReg toRegister(unsigned index)
+    {
+        static const FPRReg registerForIndex[numberOfRegisters] = {
+            fpRegT0, fpRegT1, fpRegT2, fpRegT3, fpRegT4, fpRegT5, fpRegT6 };
+
+        ASSERT(index < numberOfRegisters);
+        return registerForIndex[index];
+    }
+
+    static unsigned toIndex(FPRReg reg)
+    {
+        ASSERT(reg != InvalidFPRReg);
+        ASSERT(reg < 20);
+        static const unsigned indexForRegister[20] = {
+            0, InvalidIndex, 1, InvalidIndex,
+            2, InvalidIndex, 3, InvalidIndex,
+            4, InvalidIndex, 5, InvalidIndex,
+            InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex,
+            InvalidIndex, InvalidIndex, 6, InvalidIndex,
+        };
+        unsigned result = indexForRegister[reg];
+        return result;
+    }
+
+    static const char* debugName(FPRReg reg)
+    {
+        ASSERT(reg != InvalidFPRReg);
+        ASSERT(reg < 32);
+        static const char* nameForRegister[32] = {
+            "f0", "f1", "f2", "f3",
+            "f4", "f5", "f6", "f7",
+            "f8", "f9", "f10", "f11",
+            "f12", "f13", "f14", "f15"
+            "f16", "f17", "f18", "f19"
+            "f20", "f21", "f22", "f23"
+            "f24", "f25", "f26", "f27"
+            "f28", "f29", "f30", "f31"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(MIPS)
+
+#if CPU(SH4)
+
+class FPRInfo {
+public:
+    typedef FPRReg RegisterType;
+    static const unsigned numberOfRegisters = 6;
+
+    // Temporary registers.
+    static const FPRReg fpRegT0 = SH4Registers::dr0;
+    static const FPRReg fpRegT1 = SH4Registers::dr2;
+    static const FPRReg fpRegT2 = SH4Registers::dr4;
+    static const FPRReg fpRegT3 = SH4Registers::dr6;
+    static const FPRReg fpRegT4 = SH4Registers::dr8;
+    static const FPRReg fpRegT5 = SH4Registers::dr10;
+
+    static const FPRReg returnValueFPR = SH4Registers::dr0;
+
+    static const FPRReg argumentFPR0 = SH4Registers::dr4;
+    static const FPRReg argumentFPR1 = SH4Registers::dr6;
+
+    static FPRReg toRegister(unsigned index)
+    {
+        static const FPRReg registerForIndex[numberOfRegisters] = {
+            fpRegT0, fpRegT1, fpRegT2, fpRegT3, fpRegT4, fpRegT5 };
+
+        ASSERT(index < numberOfRegisters);
+        return registerForIndex[index];
+    }
+
+    static unsigned toIndex(FPRReg reg)
+    {
+        ASSERT(reg != InvalidFPRReg);
+        ASSERT(reg < 16);
+        static const unsigned indexForRegister[16] = {
+            0, InvalidIndex, 1, InvalidIndex,
+            2, InvalidIndex, 3, InvalidIndex,
+            4, InvalidIndex, 5, InvalidIndex,
+            InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex
+        };
+        unsigned result = indexForRegister[reg];
+        return result;
+    }
+
+    static const char* debugName(FPRReg reg)
+    {
+        ASSERT(reg != InvalidFPRReg);
+        ASSERT(reg < 16);
+        static const char* nameForRegister[16] = {
+            "dr0", "fr1", "dr2", "fr3",
+            "dr4", "fr5", "dr6", "fr7",
+            "dr8", "fr9", "dr10", "fr11",
+            "dr12", "fr13", "dr14", "fr15"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(SH4)
+
+#endif // ENABLE(JIT)
+
+} // namespace JSC
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::FPRReg reg)
+{
+#if ENABLE(JIT)
+    out.print("%", JSC::FPRInfo::debugName(reg));
+#else
+    out.printf("%%fr%d", reg);
+#endif
+}
+
+} // namespace WTF
diff --git a/jit/GCAwareJITStubRoutine.cpp b/jit/GCAwareJITStubRoutine.cpp
new file mode 100644
index 0000000..31a2ae1
--- /dev/null
+++ b/jit/GCAwareJITStubRoutine.cpp
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GCAwareJITStubRoutine.h"
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "DFGCommonData.h"
+#include "Heap.h"
+#include "VM.h"
+#include "JITStubRoutineSet.h"
+#include "JSCInlines.h"
+#include "SlotVisitor.h"
+#include "Structure.h"
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+GCAwareJITStubRoutine::GCAwareJITStubRoutine(
+    const MacroAssemblerCodeRef& code, VM& vm)
+    : JITStubRoutine(code)
+    , m_mayBeExecuting(false)
+    , m_isJettisoned(false)
+{
+    vm.heap.m_jitStubRoutines->add(this);
+}
+
+GCAwareJITStubRoutine::~GCAwareJITStubRoutine() { }
+
+void GCAwareJITStubRoutine::observeZeroRefCount()
+{
+    if (m_isJettisoned) {
+        // This case is needed for when the system shuts down. It may be that
+        // the JIT stub routine set gets deleted before we get around to deleting
+        // this guy. In that case the GC informs us that we're jettisoned already
+        // and that we should delete ourselves as soon as the ref count reaches
+        // zero.
+        delete this;
+        return;
+    }
+    
+    RELEASE_ASSERT(!m_refCount);
+
+    m_isJettisoned = true;
+}
+
+void GCAwareJITStubRoutine::deleteFromGC()
+{
+    ASSERT(m_isJettisoned);
+    ASSERT(!m_refCount);
+    ASSERT(!m_mayBeExecuting);
+    
+    delete this;
+}
+
+void GCAwareJITStubRoutine::markRequiredObjectsInternal(SlotVisitor&)
+{
+}
+
+MarkingGCAwareJITStubRoutine::MarkingGCAwareJITStubRoutine(
+    const MacroAssemblerCodeRef& code, VM& vm, const JSCell* owner,
+    const Vector<JSCell*>& cells)
+    : GCAwareJITStubRoutine(code, vm)
+    , m_cells(cells.size())
+{
+    for (unsigned i = cells.size(); i--;)
+        m_cells[i].set(vm, owner, cells[i]);
+}
+
+MarkingGCAwareJITStubRoutine::~MarkingGCAwareJITStubRoutine()
+{
+}
+
+void MarkingGCAwareJITStubRoutine::markRequiredObjectsInternal(SlotVisitor& visitor)
+{
+    for (auto& entry : m_cells)
+        visitor.append(entry);
+}
+
+
+GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler(
+    const MacroAssemblerCodeRef& code, VM& vm,  const JSCell* owner, const Vector<JSCell*>& cells,
+    CodeBlock* codeBlockForExceptionHandlers, CallSiteIndex exceptionHandlerCallSiteIndex)
+    : MarkingGCAwareJITStubRoutine(code, vm, owner, cells)
+    , m_codeBlockWithExceptionHandler(codeBlockForExceptionHandlers)
+    , m_exceptionHandlerCallSiteIndex(exceptionHandlerCallSiteIndex)
+{
+    RELEASE_ASSERT(m_codeBlockWithExceptionHandler);
+    ASSERT(!!m_codeBlockWithExceptionHandler->handlerForIndex(exceptionHandlerCallSiteIndex.bits()));
+}
+
+void GCAwareJITStubRoutineWithExceptionHandler::aboutToDie()
+{
+    m_codeBlockWithExceptionHandler = nullptr;
+}
+
+void GCAwareJITStubRoutineWithExceptionHandler::observeZeroRefCount()
+{
+#if ENABLE(DFG_JIT)
+    if (m_codeBlockWithExceptionHandler) {
+        m_codeBlockWithExceptionHandler->jitCode()->dfgCommon()->removeCallSiteIndex(m_exceptionHandlerCallSiteIndex);
+        m_codeBlockWithExceptionHandler->removeExceptionHandlerForCallSite(m_exceptionHandlerCallSiteIndex);
+        m_codeBlockWithExceptionHandler = nullptr;
+    }
+#endif
+
+    Base::observeZeroRefCount();
+}
+
+
+PassRefPtr<JITStubRoutine> createJITStubRoutine(
+    const MacroAssemblerCodeRef& code,
+    VM& vm,
+    const JSCell* owner,
+    bool makesCalls,
+    const Vector<JSCell*>& cells,
+    CodeBlock* codeBlockForExceptionHandlers,
+    CallSiteIndex exceptionHandlerCallSiteIndex)
+{
+    if (!makesCalls)
+        return adoptRef(new JITStubRoutine(code));
+    
+    if (codeBlockForExceptionHandlers) {
+        RELEASE_ASSERT(JITCode::isOptimizingJIT(codeBlockForExceptionHandlers->jitType()));
+        return adoptRef(new GCAwareJITStubRoutineWithExceptionHandler(code, vm, owner, cells, codeBlockForExceptionHandlers, exceptionHandlerCallSiteIndex));
+    }
+
+    if (cells.isEmpty())
+        return adoptRef(new GCAwareJITStubRoutine(code, vm));
+    
+    return adoptRef(new MarkingGCAwareJITStubRoutine(code, vm, owner, cells));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/GCAwareJITStubRoutine.h b/jit/GCAwareJITStubRoutine.h
new file mode 100644
index 0000000..a253da3
--- /dev/null
+++ b/jit/GCAwareJITStubRoutine.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2012, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JITStubRoutine.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "WriteBarrier.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JITStubRoutineSet;
+
+// Use this stub routine if you know that your code might be on stack when
+// either GC or other kinds of stub deletion happen. Basicaly, if your stub
+// routine makes calls (either to JS code or to C++ code) then you should
+// assume that it's possible for that JS or C++ code to do something that
+// causes the system to try to delete your routine. Using this routine type
+// ensures that the actual deletion is delayed until the GC proves that the
+// routine is no longer running. You can also subclass this routine if you
+// want to mark additional objects during GC in those cases where the
+// routine is known to be executing, or if you want to force this routine to
+// keep other routines alive (for example due to the use of a slow-path
+// list which does not get reclaimed all at once).
+class GCAwareJITStubRoutine : public JITStubRoutine {
+public:
+    GCAwareJITStubRoutine(const MacroAssemblerCodeRef&, VM&);
+    virtual ~GCAwareJITStubRoutine();
+    
+    void markRequiredObjects(SlotVisitor& visitor)
+    {
+        markRequiredObjectsInternal(visitor);
+    }
+    
+    void deleteFromGC();
+    
+protected:
+    void observeZeroRefCount() override;
+    
+    virtual void markRequiredObjectsInternal(SlotVisitor&);
+
+private:
+    friend class JITStubRoutineSet;
+
+    bool m_mayBeExecuting;
+    bool m_isJettisoned;
+};
+
+// Use this if you want to mark one additional object during GC if your stub
+// routine is known to be executing.
+class MarkingGCAwareJITStubRoutine : public GCAwareJITStubRoutine {
+public:
+    MarkingGCAwareJITStubRoutine(
+        const MacroAssemblerCodeRef&, VM&, const JSCell* owner, const Vector<JSCell*>&);
+    virtual ~MarkingGCAwareJITStubRoutine();
+    
+protected:
+    void markRequiredObjectsInternal(SlotVisitor&) override;
+
+private:
+    Vector<WriteBarrier<JSCell>> m_cells;
+};
+
+
+// The stub has exception handlers in it. So it clears itself from exception
+// handling table when it dies. It also frees space in CodeOrigin table
+// for new exception handlers to use the same CallSiteIndex.
+class GCAwareJITStubRoutineWithExceptionHandler : public MarkingGCAwareJITStubRoutine {
+public:
+    typedef GCAwareJITStubRoutine Base;
+
+    GCAwareJITStubRoutineWithExceptionHandler(const MacroAssemblerCodeRef&, VM&, const JSCell* owner, const Vector<JSCell*>&, CodeBlock*, CallSiteIndex);
+
+    void aboutToDie() override;
+    void observeZeroRefCount() override;
+
+private:
+    CodeBlock* m_codeBlockWithExceptionHandler;
+    CallSiteIndex m_exceptionHandlerCallSiteIndex;
+};
+
+// Helper for easily creating a GC-aware JIT stub routine. For the varargs,
+// pass zero or more JSCell*'s. This will either create a JITStubRoutine, a
+// GCAwareJITStubRoutine, or an ObjectMarkingGCAwareJITStubRoutine as
+// appropriate. Generally you only need to pass pointers that will be used
+// after the first call to C++ or JS.
+// 
+// PassRefPtr<JITStubRoutine> createJITStubRoutine(
+//    const MacroAssemblerCodeRef& code,
+//    VM& vm,
+//    const JSCell* owner,
+//    bool makesCalls,
+//    ...);
+//
+// Note that we don't actually use C-style varargs because that leads to
+// strange type-related problems. For example it would preclude us from using
+// our custom of passing '0' as NULL pointer. Besides, when I did try to write
+// this function using varargs, I ended up with more code than this simple
+// way.
+
+PassRefPtr<JITStubRoutine> createJITStubRoutine(
+    const MacroAssemblerCodeRef&, VM&, const JSCell* owner, bool makesCalls,
+    const Vector<JSCell*>& = { }, 
+    CodeBlock* codeBlockForExceptionHandlers = nullptr, CallSiteIndex exceptionHandlingCallSiteIndex = CallSiteIndex(std::numeric_limits<unsigned>::max()));
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/GPRInfo.cpp b/jit/GPRInfo.cpp
new file mode 100644
index 0000000..5a8005f
--- /dev/null
+++ b/jit/GPRInfo.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GPRInfo.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+void JSValueRegs::dump(PrintStream& out) const
+{
+#if USE(JSVALUE64)
+    out.print(m_gpr);
+#else
+    out.print("(tag:", tagGPR(), ", payload:", payloadGPR(), ")");
+#endif
+}
+
+// This is in the .cpp file to work around clang issues.
+#if CPU(X86_64)
+const GPRReg GPRInfo::patchpointScratchRegister = MacroAssembler::s_scratchRegister;
+#elif CPU(ARM64)
+const GPRReg GPRInfo::patchpointScratchRegister = ARM64Registers::ip0;
+#endif
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/GPRInfo.h b/jit/GPRInfo.h
new file mode 100644
index 0000000..3d6a4c6
--- /dev/null
+++ b/jit/GPRInfo.h
@@ -0,0 +1,925 @@
+/*
+ * Copyright (C) 2011, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MacroAssembler.h"
+#include <array>
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum NoResultTag { NoResult };
+
+// We use the same conventions in the basline JIT as in the LLint. If you
+// change mappings in the GPRInfo, you should change them in the offlineasm
+// compiler adequately. The register naming conventions are described at the
+// top of the LowLevelInterpreter.asm file.
+
+typedef MacroAssembler::RegisterID GPRReg;
+#define InvalidGPRReg ((::JSC::GPRReg)-1)
+
+#if ENABLE(JIT)
+
+#if USE(JSVALUE64)
+class JSValueRegs {
+public:
+    JSValueRegs()
+        : m_gpr(InvalidGPRReg)
+    {
+    }
+    
+    explicit JSValueRegs(GPRReg gpr)
+        : m_gpr(gpr)
+    {
+    }
+    
+    static JSValueRegs payloadOnly(GPRReg gpr)
+    {
+        return JSValueRegs(gpr);
+    }
+    
+    static JSValueRegs withTwoAvailableRegs(GPRReg gpr, GPRReg)
+    {
+        return JSValueRegs(gpr);
+    }
+    
+    bool operator!() const { return m_gpr == InvalidGPRReg; }
+    explicit operator bool() const { return m_gpr != InvalidGPRReg; }
+
+    bool operator==(JSValueRegs other) { return m_gpr == other.m_gpr; }
+    bool operator!=(JSValueRegs other) { return !(*this == other); }
+    
+    GPRReg gpr() const { return m_gpr; }
+    GPRReg tagGPR() const { return InvalidGPRReg; }
+    GPRReg payloadGPR() const { return m_gpr; }
+    
+    bool uses(GPRReg gpr) const { return m_gpr == gpr; }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    GPRReg m_gpr;
+};
+
+class JSValueSource {
+public:
+    JSValueSource()
+        : m_offset(notAddress())
+        , m_base(InvalidGPRReg)
+    {
+    }
+    
+    JSValueSource(JSValueRegs regs)
+        : m_offset(notAddress())
+        , m_base(regs.gpr())
+    {
+    }
+    
+    explicit JSValueSource(GPRReg gpr)
+        : m_offset(notAddress())
+        , m_base(gpr)
+    {
+    }
+    
+    JSValueSource(MacroAssembler::Address address)
+        : m_offset(address.offset)
+        , m_base(address.base)
+    {
+        ASSERT(m_offset != notAddress());
+        ASSERT(m_base != InvalidGPRReg);
+    }
+    
+    static JSValueSource unboxedCell(GPRReg payloadGPR)
+    {
+        return JSValueSource(payloadGPR);
+    }
+    
+    bool operator!() const { return m_base == InvalidGPRReg; }
+    explicit operator bool() const { return m_base != InvalidGPRReg; }
+    
+    bool isAddress() const { return m_offset != notAddress(); }
+    
+    int32_t offset() const
+    {
+        ASSERT(isAddress());
+        return m_offset;
+    }
+    
+    GPRReg base() const
+    {
+        ASSERT(isAddress());
+        return m_base;
+    }
+    
+    GPRReg gpr() const
+    {
+        ASSERT(!isAddress());
+        return m_base;
+    }
+    
+    JSValueRegs regs() const
+    {
+        return JSValueRegs(gpr());
+    }
+    
+    MacroAssembler::Address asAddress() const { return MacroAssembler::Address(base(), offset()); }
+    
+private:
+    static inline int32_t notAddress() { return 0x80000000; }     
+          
+    int32_t m_offset;
+    GPRReg m_base;
+};
+#endif // USE(JSVALUE64)
+
+#if USE(JSVALUE32_64)
+class JSValueRegs {
+public:
+    JSValueRegs()
+        : m_tagGPR(static_cast<int8_t>(InvalidGPRReg))
+        , m_payloadGPR(static_cast<int8_t>(InvalidGPRReg))
+    {
+    }
+    
+    JSValueRegs(GPRReg tagGPR, GPRReg payloadGPR)
+        : m_tagGPR(tagGPR)
+        , m_payloadGPR(payloadGPR)
+    {
+    }
+    
+    static JSValueRegs withTwoAvailableRegs(GPRReg gpr1, GPRReg gpr2)
+    {
+        return JSValueRegs(gpr1, gpr2);
+    }
+    
+    static JSValueRegs payloadOnly(GPRReg gpr)
+    {
+        return JSValueRegs(InvalidGPRReg, gpr);
+    }
+    
+    bool operator!() const { return !static_cast<bool>(*this); }
+    explicit operator bool() const
+    {
+        return static_cast<GPRReg>(m_tagGPR) != InvalidGPRReg
+            || static_cast<GPRReg>(m_payloadGPR) != InvalidGPRReg;
+    }
+
+    bool operator==(JSValueRegs other) const
+    {
+        return m_tagGPR == other.m_tagGPR
+            && m_payloadGPR == other.m_payloadGPR;
+    }
+    bool operator!=(JSValueRegs other) const { return !(*this == other); }
+    
+    GPRReg tagGPR() const { return static_cast<GPRReg>(m_tagGPR); }
+    GPRReg payloadGPR() const { return static_cast<GPRReg>(m_payloadGPR); }
+    GPRReg gpr(WhichValueWord which) const
+    {
+        switch (which) {
+        case TagWord:
+            return tagGPR();
+        case PayloadWord:
+            return payloadGPR();
+        }
+        ASSERT_NOT_REACHED();
+        return tagGPR();
+    }
+
+    bool uses(GPRReg gpr) const { return m_tagGPR == gpr || m_payloadGPR == gpr; }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    int8_t m_tagGPR;
+    int8_t m_payloadGPR;
+};
+
+class JSValueSource {
+public:
+    JSValueSource()
+        : m_offset(notAddress())
+        , m_baseOrTag(static_cast<int8_t>(InvalidGPRReg))
+        , m_payload(static_cast<int8_t>(InvalidGPRReg))
+        , m_tagType(0)
+    {
+    }
+    
+    JSValueSource(JSValueRegs regs)
+        : m_offset(notAddress())
+        , m_baseOrTag(regs.tagGPR())
+        , m_payload(regs.payloadGPR())
+        , m_tagType(0)
+    {
+    }
+    
+    JSValueSource(GPRReg tagGPR, GPRReg payloadGPR)
+        : m_offset(notAddress())
+        , m_baseOrTag(static_cast<int8_t>(tagGPR))
+        , m_payload(static_cast<int8_t>(payloadGPR))
+        , m_tagType(0)
+    {
+    }
+    
+    JSValueSource(MacroAssembler::Address address)
+        : m_offset(address.offset)
+        , m_baseOrTag(static_cast<int8_t>(address.base))
+        , m_payload(static_cast<int8_t>(InvalidGPRReg))
+        , m_tagType(0)
+    {
+        ASSERT(m_offset != notAddress());
+        ASSERT(static_cast<GPRReg>(m_baseOrTag) != InvalidGPRReg);
+    }
+    
+    static JSValueSource unboxedCell(GPRReg payloadGPR)
+    {
+        JSValueSource result;
+        result.m_offset = notAddress();
+        result.m_baseOrTag = static_cast<int8_t>(InvalidGPRReg);
+        result.m_payload = static_cast<int8_t>(payloadGPR);
+        result.m_tagType = static_cast<int8_t>(JSValue::CellTag);
+        return result;
+    }
+
+    bool operator!() const { return !static_cast<bool>(*this); }
+    explicit operator bool() const
+    {
+        return static_cast<GPRReg>(m_baseOrTag) != InvalidGPRReg
+            || static_cast<GPRReg>(m_payload) != InvalidGPRReg;
+    }
+    
+    bool isAddress() const
+    {
+        ASSERT(!!*this);
+        return m_offset != notAddress();
+    }
+    
+    int32_t offset() const
+    {
+        ASSERT(isAddress());
+        return m_offset;
+    }
+    
+    GPRReg base() const
+    {
+        ASSERT(isAddress());
+        return static_cast<GPRReg>(m_baseOrTag);
+    }
+    
+    GPRReg tagGPR() const
+    {
+        ASSERT(!isAddress() && static_cast<GPRReg>(m_baseOrTag) != InvalidGPRReg);
+        return static_cast<GPRReg>(m_baseOrTag);
+    }
+    
+    GPRReg payloadGPR() const
+    {
+        ASSERT(!isAddress());
+        return static_cast<GPRReg>(m_payload);
+    }
+    
+    bool hasKnownTag() const
+    {
+        ASSERT(!!*this);
+        ASSERT(!isAddress());
+        return static_cast<GPRReg>(m_baseOrTag) == InvalidGPRReg;
+    }
+    
+    uint32_t tag() const
+    {
+        return static_cast<int32_t>(m_tagType);
+    }
+    
+    JSValueRegs regs() const
+    {
+        return JSValueRegs(tagGPR(), payloadGPR());
+    }
+    
+    MacroAssembler::Address asAddress(unsigned additionalOffset = 0) const { return MacroAssembler::Address(base(), offset() + additionalOffset); }
+    
+private:
+    static inline int32_t notAddress() { return 0x80000000; }     
+          
+    int32_t m_offset;
+    int8_t m_baseOrTag;
+    int8_t m_payload; 
+    int8_t m_tagType; // Contains the low bits of the tag.
+};
+#endif // USE(JSVALUE32_64)
+
+#if CPU(X86)
+#define NUMBER_OF_ARGUMENT_REGISTERS 0u
+#define NUMBER_OF_CALLEE_SAVES_REGISTERS 0u
+
+class GPRInfo {
+public:
+    typedef GPRReg RegisterType;
+    static const unsigned numberOfRegisters = 6;
+    static const unsigned numberOfArgumentRegisters = NUMBER_OF_ARGUMENT_REGISTERS;
+
+    // Temporary registers.
+    static const GPRReg regT0 = X86Registers::eax;
+    static const GPRReg regT1 = X86Registers::edx;
+    static const GPRReg regT2 = X86Registers::ecx;
+    static const GPRReg regT3 = X86Registers::ebx; // Callee-save
+    static const GPRReg regT4 = X86Registers::esi; // Callee-save
+    static const GPRReg regT5 = X86Registers::edi; // Callee-save
+    static const GPRReg callFrameRegister = X86Registers::ebp;
+    // These constants provide the names for the general purpose argument & return value registers.
+    static const GPRReg argumentGPR0 = X86Registers::ecx; // regT2
+    static const GPRReg argumentGPR1 = X86Registers::edx; // regT1
+    static const GPRReg argumentGPR2 = X86Registers::eax; // regT0
+    static const GPRReg argumentGPR3 = X86Registers::ebx; // regT3
+    static const GPRReg nonArgGPR0 = X86Registers::esi; // regT4
+    static const GPRReg returnValueGPR = X86Registers::eax; // regT0
+    static const GPRReg returnValueGPR2 = X86Registers::edx; // regT1
+    static const GPRReg nonPreservedNonReturnGPR = X86Registers::ecx;
+
+    static GPRReg toRegister(unsigned index)
+    {
+        ASSERT(index < numberOfRegisters);
+        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5 };
+        return registerForIndex[index];
+    }
+
+    static GPRReg toArgumentRegister(unsigned)
+    {
+        UNREACHABLE_FOR_PLATFORM();
+        return InvalidGPRReg;
+    }
+
+    static unsigned toIndex(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(static_cast<int>(reg) < 8);
+        static const unsigned indexForRegister[8] = { 0, 2, 1, 3, InvalidIndex, InvalidIndex, 4, 5 };
+        unsigned result = indexForRegister[reg];
+        return result;
+    }
+
+    static const char* debugName(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(static_cast<int>(reg) < 8);
+        static const char* nameForRegister[8] = {
+            "eax", "ecx", "edx", "ebx",
+            "esp", "ebp", "esi", "edi",
+        };
+        return nameForRegister[reg];
+    }
+
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(X86)
+
+#if CPU(X86_64)
+#if !OS(WINDOWS)
+#define NUMBER_OF_ARGUMENT_REGISTERS 6u
+#define NUMBER_OF_CALLEE_SAVES_REGISTERS 5u
+#else
+#define NUMBER_OF_ARGUMENT_REGISTERS 4u
+#define NUMBER_OF_CALLEE_SAVES_REGISTERS 7u
+#endif
+
+class GPRInfo {
+public:
+    typedef GPRReg RegisterType;
+    static const unsigned numberOfRegisters = 11;
+    static const unsigned numberOfArgumentRegisters = NUMBER_OF_ARGUMENT_REGISTERS;
+
+    // These registers match the baseline JIT.
+    static const GPRReg callFrameRegister = X86Registers::ebp;
+    static const GPRReg tagTypeNumberRegister = X86Registers::r14;
+    static const GPRReg tagMaskRegister = X86Registers::r15;
+
+    // Temporary registers.
+    static const GPRReg regT0 = X86Registers::eax;
+#if !OS(WINDOWS)
+    static const GPRReg regT1 = X86Registers::esi;
+    static const GPRReg regT2 = X86Registers::edx;
+    static const GPRReg regT3 = X86Registers::ecx;
+    static const GPRReg regT4 = X86Registers::r8;
+    static const GPRReg regT5 = X86Registers::r10;
+    static const GPRReg regT6 = X86Registers::edi;
+    static const GPRReg regT7 = X86Registers::r9;
+#else
+    static const GPRReg regT1 = X86Registers::edx;
+    static const GPRReg regT2 = X86Registers::r8;
+    static const GPRReg regT3 = X86Registers::r9;
+    static const GPRReg regT4 = X86Registers::r10;
+    static const GPRReg regT5 = X86Registers::ecx;
+#endif
+
+    static const GPRReg regCS0 = X86Registers::ebx;
+
+#if !OS(WINDOWS)
+    static const GPRReg regCS1 = X86Registers::r12;
+    static const GPRReg regCS2 = X86Registers::r13;
+    static const GPRReg regCS3 = X86Registers::r14;
+    static const GPRReg regCS4 = X86Registers::r15;
+#else
+    static const GPRReg regCS1 = X86Registers::esi;
+    static const GPRReg regCS2 = X86Registers::edi;
+    static const GPRReg regCS3 = X86Registers::r12;
+    static const GPRReg regCS4 = X86Registers::r13;
+    static const GPRReg regCS5 = X86Registers::r14;
+    static const GPRReg regCS6 = X86Registers::r15;
+#endif
+
+    // These constants provide the names for the general purpose argument & return value registers.
+#if !OS(WINDOWS)
+    static const GPRReg argumentGPR0 = X86Registers::edi; // regT6
+    static const GPRReg argumentGPR1 = X86Registers::esi; // regT1
+    static const GPRReg argumentGPR2 = X86Registers::edx; // regT2
+    static const GPRReg argumentGPR3 = X86Registers::ecx; // regT3
+    static const GPRReg argumentGPR4 = X86Registers::r8; // regT4
+    static const GPRReg argumentGPR5 = X86Registers::r9; // regT7
+#else
+    static const GPRReg argumentGPR0 = X86Registers::ecx; // regT5
+    static const GPRReg argumentGPR1 = X86Registers::edx; // regT1
+    static const GPRReg argumentGPR2 = X86Registers::r8; // regT2
+    static const GPRReg argumentGPR3 = X86Registers::r9; // regT3
+#endif
+    static const GPRReg nonArgGPR0 = X86Registers::r10; // regT5 (regT4 on Windows)
+    static const GPRReg returnValueGPR = X86Registers::eax; // regT0
+    static const GPRReg returnValueGPR2 = X86Registers::edx; // regT1 or regT2
+    static const GPRReg nonPreservedNonReturnGPR = X86Registers::r10; // regT5 (regT4 on Windows)
+    static const GPRReg nonPreservedNonArgumentGPR = X86Registers::r10; // regT5 (regT4 on Windows)
+
+    // FIXME: I believe that all uses of this are dead in the sense that it just causes the scratch
+    // register allocator to select a different register and potentially spill things. It would be better
+    // if we instead had a more explicit way of saying that we don't have a scratch register.
+    static const GPRReg patchpointScratchRegister;
+
+    static GPRReg toRegister(unsigned index)
+    {
+        ASSERT(index < numberOfRegisters);
+#if !OS(WINDOWS)
+        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regT6, regT7, regCS0, regCS1, regCS2 };
+#else
+        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regCS0, regCS1, regCS2, regCS3, regCS4 };
+#endif
+        return registerForIndex[index];
+    }
+    
+    static GPRReg toArgumentRegister(unsigned index)
+    {
+        ASSERT(index < numberOfArgumentRegisters);
+#if !OS(WINDOWS)
+        static const GPRReg registerForIndex[numberOfArgumentRegisters] = { argumentGPR0, argumentGPR1, argumentGPR2, argumentGPR3, argumentGPR4, argumentGPR5 };
+#else
+        static const GPRReg registerForIndex[numberOfArgumentRegisters] = { argumentGPR0, argumentGPR1, argumentGPR2, argumentGPR3 };
+#endif
+        return registerForIndex[index];
+    }
+    
+    static unsigned toIndex(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(static_cast<int>(reg) < 16);
+#if !OS(WINDOWS)
+        static const unsigned indexForRegister[16] = { 0, 3, 2, 8, InvalidIndex, InvalidIndex, 1, 6, 4, 7, 5, InvalidIndex, 9, 10, InvalidIndex, InvalidIndex };
+#else
+        static const unsigned indexForRegister[16] = { 0, 5, 1, 6, InvalidIndex, InvalidIndex, 7, 8, 2, 3, 4, InvalidIndex, 9, 10, InvalidIndex, InvalidIndex };
+#endif
+        return indexForRegister[reg];
+    }
+
+    static const char* debugName(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(static_cast<int>(reg) < 16);
+        static const char* nameForRegister[16] = {
+            "rax", "rcx", "rdx", "rbx",
+            "rsp", "rbp", "rsi", "rdi",
+            "r8", "r9", "r10", "r11",
+            "r12", "r13", "r14", "r15"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const std::array<GPRReg, 3>& reservedRegisters()
+    {
+        static const std::array<GPRReg, 3> reservedRegisters { {
+            MacroAssembler::s_scratchRegister,
+            tagTypeNumberRegister,
+            tagMaskRegister,
+        } };
+        return reservedRegisters;
+    }
+    
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(X86_64)
+
+#if CPU(ARM)
+#define NUMBER_OF_ARGUMENT_REGISTERS 4u
+#define NUMBER_OF_CALLEE_SAVES_REGISTERS 0u
+
+class GPRInfo {
+public:
+    typedef GPRReg RegisterType;
+    static const unsigned numberOfRegisters = 9;
+    static const unsigned numberOfArgumentRegisters = NUMBER_OF_ARGUMENT_REGISTERS;
+
+    // Temporary registers.
+    static const GPRReg regT0 = ARMRegisters::r0;
+    static const GPRReg regT1 = ARMRegisters::r1;
+    static const GPRReg regT2 = ARMRegisters::r2;
+    static const GPRReg regT3 = ARMRegisters::r3;
+    static const GPRReg regT4 = ARMRegisters::r8;
+    static const GPRReg regT5 = ARMRegisters::r9;
+    static const GPRReg regT6 = ARMRegisters::r10;
+#if CPU(ARM_THUMB2)
+    static const GPRReg regT7 = ARMRegisters::r11;
+#else 
+    static const GPRReg regT7 = ARMRegisters::r7;
+#endif
+    static const GPRReg regT8 = ARMRegisters::r4;
+    // These registers match the baseline JIT.
+    static const GPRReg callFrameRegister = ARMRegisters::fp;
+    // These constants provide the names for the general purpose argument & return value registers.
+    static const GPRReg argumentGPR0 = ARMRegisters::r0; // regT0
+    static const GPRReg argumentGPR1 = ARMRegisters::r1; // regT1
+    static const GPRReg argumentGPR2 = ARMRegisters::r2; // regT2
+    static const GPRReg argumentGPR3 = ARMRegisters::r3; // regT3
+    static const GPRReg nonArgGPR0 = ARMRegisters::r4; // regT8
+    static const GPRReg nonArgGPR1 = ARMRegisters::r8; // regT4
+    static const GPRReg returnValueGPR = ARMRegisters::r0; // regT0
+    static const GPRReg returnValueGPR2 = ARMRegisters::r1; // regT1
+    static const GPRReg nonPreservedNonReturnGPR = ARMRegisters::r5;
+
+    static GPRReg toRegister(unsigned index)
+    {
+        ASSERT(index < numberOfRegisters);
+        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regT6, regT7, regT8 };
+        return registerForIndex[index];
+    }
+
+    static GPRReg toArgumentRegister(unsigned index)
+    {
+        ASSERT(index < numberOfArgumentRegisters);
+        static const GPRReg registerForIndex[numberOfArgumentRegisters] = { argumentGPR0, argumentGPR1, argumentGPR2, argumentGPR3 };
+        return registerForIndex[index];
+    }
+
+    static unsigned toIndex(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(static_cast<int>(reg) < 16);
+        static const unsigned indexForRegister[16] =
+#if CPU(ARM_THUMB2)
+            { 0, 1, 2, 3, 8, InvalidIndex, InvalidIndex, InvalidIndex, 4, 5, 6, 7, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex };
+#else
+            { 0, 1, 2, 3, 8, InvalidIndex, InvalidIndex, 7, 4, 5, 6, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex };
+#endif
+        unsigned result = indexForRegister[reg];
+        return result;
+    }
+
+    static const char* debugName(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(static_cast<int>(reg) < 16);
+        static const char* nameForRegister[16] = {
+            "r0", "r1", "r2", "r3",
+            "r4", "r5", "r6", "r7",
+            "r8", "r9", "r10", "r11",
+            "r12", "r13", "r14", "r15"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(ARM)
+
+#if CPU(ARM64)
+#define NUMBER_OF_ARGUMENT_REGISTERS 8u
+// Callee Saves includes x19..x28 and FP registers q8..q15
+#define NUMBER_OF_CALLEE_SAVES_REGISTERS 18u
+
+class GPRInfo {
+public:
+    typedef GPRReg RegisterType;
+    static const unsigned numberOfRegisters = 16;
+    static const unsigned numberOfArgumentRegisters = 8;
+
+    // These registers match the baseline JIT.
+    static const GPRReg callFrameRegister = ARM64Registers::fp;
+    static const GPRReg tagTypeNumberRegister = ARM64Registers::x27;
+    static const GPRReg tagMaskRegister = ARM64Registers::x28;
+    static const GPRReg dataTempRegister = MacroAssembler::dataTempRegister;
+    static const GPRReg memoryTempRegister = MacroAssembler::memoryTempRegister;
+    // Temporary registers.
+    static const GPRReg regT0 = ARM64Registers::x0;
+    static const GPRReg regT1 = ARM64Registers::x1;
+    static const GPRReg regT2 = ARM64Registers::x2;
+    static const GPRReg regT3 = ARM64Registers::x3;
+    static const GPRReg regT4 = ARM64Registers::x4;
+    static const GPRReg regT5 = ARM64Registers::x5;
+    static const GPRReg regT6 = ARM64Registers::x6;
+    static const GPRReg regT7 = ARM64Registers::x7;
+    static const GPRReg regT8 = ARM64Registers::x8;
+    static const GPRReg regT9 = ARM64Registers::x9;
+    static const GPRReg regT10 = ARM64Registers::x10;
+    static const GPRReg regT11 = ARM64Registers::x11;
+    static const GPRReg regT12 = ARM64Registers::x12;
+    static const GPRReg regT13 = ARM64Registers::x13;
+    static const GPRReg regT14 = ARM64Registers::x14;
+    static const GPRReg regT15 = ARM64Registers::x15;
+    static const GPRReg regCS0 = ARM64Registers::x19; // Used by FTL only
+    static const GPRReg regCS1 = ARM64Registers::x20; // Used by FTL only
+    static const GPRReg regCS2 = ARM64Registers::x21; // Used by FTL only
+    static const GPRReg regCS3 = ARM64Registers::x22; // Used by FTL only
+    static const GPRReg regCS4 = ARM64Registers::x23; // Used by FTL only
+    static const GPRReg regCS5 = ARM64Registers::x24; // Used by FTL only
+    static const GPRReg regCS6 = ARM64Registers::x25; // Used by FTL only
+    static const GPRReg regCS7 = ARM64Registers::x26;
+    static const GPRReg regCS8 = ARM64Registers::x27; // tagTypeNumber
+    static const GPRReg regCS9 = ARM64Registers::x28; // tagMask
+    // These constants provide the names for the general purpose argument & return value registers.
+    static const GPRReg argumentGPR0 = ARM64Registers::x0; // regT0
+    static const GPRReg argumentGPR1 = ARM64Registers::x1; // regT1
+    static const GPRReg argumentGPR2 = ARM64Registers::x2; // regT2
+    static const GPRReg argumentGPR3 = ARM64Registers::x3; // regT3
+    static const GPRReg argumentGPR4 = ARM64Registers::x4; // regT4
+    static const GPRReg argumentGPR5 = ARM64Registers::x5; // regT5
+    static const GPRReg argumentGPR6 = ARM64Registers::x6; // regT6
+    static const GPRReg argumentGPR7 = ARM64Registers::x7; // regT7
+    static const GPRReg nonArgGPR0 = ARM64Registers::x8; // regT8
+    static const GPRReg nonArgGPR1 = ARM64Registers::x9; // regT9
+    static const GPRReg returnValueGPR = ARM64Registers::x0; // regT0
+    static const GPRReg returnValueGPR2 = ARM64Registers::x1; // regT1
+    static const GPRReg nonPreservedNonReturnGPR = ARM64Registers::x2;
+    static const GPRReg nonPreservedNonArgumentGPR = ARM64Registers::x8;
+    static const GPRReg patchpointScratchRegister;
+
+    // GPRReg mapping is direct, the machine register numbers can
+    // be used directly as indices into the GPR RegisterBank.
+    COMPILE_ASSERT(ARM64Registers::q0 == 0, q0_is_0);
+    COMPILE_ASSERT(ARM64Registers::q1 == 1, q1_is_1);
+    COMPILE_ASSERT(ARM64Registers::q2 == 2, q2_is_2);
+    COMPILE_ASSERT(ARM64Registers::q3 == 3, q3_is_3);
+    COMPILE_ASSERT(ARM64Registers::q4 == 4, q4_is_4);
+    COMPILE_ASSERT(ARM64Registers::q5 == 5, q5_is_5);
+    COMPILE_ASSERT(ARM64Registers::q6 == 6, q6_is_6);
+    COMPILE_ASSERT(ARM64Registers::q7 == 7, q7_is_7);
+    COMPILE_ASSERT(ARM64Registers::q8 == 8, q8_is_8);
+    COMPILE_ASSERT(ARM64Registers::q9 == 9, q9_is_9);
+    COMPILE_ASSERT(ARM64Registers::q10 == 10, q10_is_10);
+    COMPILE_ASSERT(ARM64Registers::q11 == 11, q11_is_11);
+    COMPILE_ASSERT(ARM64Registers::q12 == 12, q12_is_12);
+    COMPILE_ASSERT(ARM64Registers::q13 == 13, q13_is_13);
+    COMPILE_ASSERT(ARM64Registers::q14 == 14, q14_is_14);
+    COMPILE_ASSERT(ARM64Registers::q15 == 15, q15_is_15);
+    static GPRReg toRegister(unsigned index)
+    {
+        return (GPRReg)index;
+    }
+    static unsigned toIndex(GPRReg reg)
+    {
+        if (reg > regT15)
+            return InvalidIndex;
+        return (unsigned)reg;
+    }
+
+    static GPRReg toArgumentRegister(unsigned index)
+    {
+        ASSERT(index < numberOfArgumentRegisters);
+        return toRegister(index);
+    }
+
+    static const char* debugName(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(static_cast<unsigned>(reg) < 32);
+        static const char* nameForRegister[32] = {
+            "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
+            "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15",
+            "r16", "r17", "r18", "r19", "r20", "r21", "r22", "r23",
+            "r24", "r25", "r26", "r27", "r28", "fp", "lr", "sp"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const std::array<GPRReg, 4>& reservedRegisters()
+    {
+        static const std::array<GPRReg, 4> reservedRegisters { {
+            dataTempRegister,
+            memoryTempRegister,
+            tagTypeNumberRegister,
+            tagMaskRegister,
+        } };
+        return reservedRegisters;
+    }
+    
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(ARM64)
+
+#if CPU(MIPS)
+#define NUMBER_OF_ARGUMENT_REGISTERS 4u
+#define NUMBER_OF_CALLEE_SAVES_REGISTERS 0u
+
+class GPRInfo {
+public:
+    typedef GPRReg RegisterType;
+    static const unsigned numberOfRegisters = 7;
+    static const unsigned numberOfArgumentRegisters = NUMBER_OF_ARGUMENT_REGISTERS;
+
+    // regT0 must be v0 for returning a 32-bit value.
+    // regT1 must be v1 for returning a pair of 32-bit value.
+
+    // Temporary registers.
+    static const GPRReg regT0 = MIPSRegisters::v0;
+    static const GPRReg regT1 = MIPSRegisters::v1;
+    static const GPRReg regT2 = MIPSRegisters::t2;
+    static const GPRReg regT3 = MIPSRegisters::t3;
+    static const GPRReg regT4 = MIPSRegisters::t4;
+    static const GPRReg regT5 = MIPSRegisters::t5;
+    static const GPRReg regT6 = MIPSRegisters::t6;
+    // These registers match the baseline JIT.
+    static const GPRReg callFrameRegister = MIPSRegisters::fp;
+    // These constants provide the names for the general purpose argument & return value registers.
+    static const GPRReg argumentGPR0 = MIPSRegisters::a0;
+    static const GPRReg argumentGPR1 = MIPSRegisters::a1;
+    static const GPRReg argumentGPR2 = MIPSRegisters::a2;
+    static const GPRReg argumentGPR3 = MIPSRegisters::a3;
+    static const GPRReg nonArgGPR0 = regT4;
+    static const GPRReg returnValueGPR = regT0;
+    static const GPRReg returnValueGPR2 = regT1;
+    static const GPRReg nonPreservedNonReturnGPR = regT2;
+
+    static GPRReg toRegister(unsigned index)
+    {
+        ASSERT(index < numberOfRegisters);
+        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regT6 };
+        return registerForIndex[index];
+    }
+
+    static GPRReg toArgumentRegister(unsigned index)
+    {
+        ASSERT(index < numberOfArgumentRegisters);
+        static const GPRReg registerForIndex[numberOfArgumentRegisters] = { argumentGPR0, argumentGPR1, argumentGPR2, argumentGPR3 };
+        return registerForIndex[index];
+    }
+
+    static unsigned toIndex(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(reg < 32);
+        static const unsigned indexForRegister[32] = {
+            InvalidIndex, InvalidIndex, 0, 1, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex,
+            InvalidIndex, InvalidIndex, 2, 3, 4, 5, 6, InvalidIndex,
+            InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex,
+            InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex
+        };
+        unsigned result = indexForRegister[reg];
+        return result;
+    }
+
+    static const char* debugName(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(reg < 16);
+        static const char* nameForRegister[16] = {
+            "zero", "at", "v0", "v1",
+            "a0", "a1", "a2", "a3",
+            "t0", "t1", "t2", "t3",
+            "t4", "t5", "t6", "t7"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(MIPS)
+
+#if CPU(SH4)
+#define NUMBER_OF_ARGUMENT_REGISTERS 4u
+#define NUMBER_OF_CALLEE_SAVES_REGISTERS 0u
+
+class GPRInfo {
+public:
+    typedef GPRReg RegisterType;
+    static const unsigned numberOfRegisters = 10;
+
+    // Note: regT3 is required to be callee-preserved.
+
+    // Temporary registers.
+    static const GPRReg regT0 = SH4Registers::r0;
+    static const GPRReg regT1 = SH4Registers::r1;
+    static const GPRReg regT2 = SH4Registers::r6;
+    static const GPRReg regT3 = SH4Registers::r7;
+    static const GPRReg regT4 = SH4Registers::r2;
+    static const GPRReg regT5 = SH4Registers::r3;
+    static const GPRReg regT6 = SH4Registers::r4;
+    static const GPRReg regT7 = SH4Registers::r5;
+    static const GPRReg regT8 = SH4Registers::r8;
+    static const GPRReg regT9 = SH4Registers::r9;
+    // These registers match the baseline JIT.
+    static const GPRReg cachedResultRegister = regT0;
+    static const GPRReg cachedResultRegister2 = regT1;
+    static const GPRReg callFrameRegister = SH4Registers::fp;
+    // These constants provide the names for the general purpose argument & return value registers.
+    static const GPRReg argumentGPR0 = SH4Registers::r4; // regT6
+    static const GPRReg argumentGPR1 = SH4Registers::r5; // regT7
+    static const GPRReg argumentGPR2 = SH4Registers::r6; // regT2
+    static const GPRReg argumentGPR3 = SH4Registers::r7; // regT3
+    static const GPRReg nonArgGPR0 = regT4;
+    static const GPRReg returnValueGPR = regT0;
+    static const GPRReg returnValueGPR2 = regT1;
+    static const GPRReg nonPreservedNonReturnGPR = regT2;
+
+    static GPRReg toRegister(unsigned index)
+    {
+        ASSERT(index < numberOfRegisters);
+        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regT6, regT7, regT8, regT9 };
+        return registerForIndex[index];
+    }
+
+    static unsigned toIndex(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(reg < 14);
+        static const unsigned indexForRegister[14] = { 0, 1, 4, 5, 6, 7, 2, 3, 8, 9, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex };
+        unsigned result = indexForRegister[reg];
+        return result;
+    }
+
+    static const char* debugName(GPRReg reg)
+    {
+        ASSERT(reg != InvalidGPRReg);
+        ASSERT(reg < 16);
+        static const char* nameForRegister[16] = {
+            "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7",
+            "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
+        };
+        return nameForRegister[reg];
+    }
+
+    static const unsigned InvalidIndex = 0xffffffff;
+};
+
+#endif // CPU(SH4)
+
+// The baseline JIT uses "accumulator" style execution with regT0 (for 64-bit)
+// and regT0 + regT1 (for 32-bit) serving as the accumulator register(s) for
+// passing results of one opcode to the next. Hence:
+COMPILE_ASSERT(GPRInfo::regT0 == GPRInfo::returnValueGPR, regT0_must_equal_returnValueGPR);
+#if USE(JSVALUE32_64)
+COMPILE_ASSERT(GPRInfo::regT1 == GPRInfo::returnValueGPR2, regT1_must_equal_returnValueGPR2);
+#endif
+
+inline GPRReg extractResult(GPRReg result) { return result; }
+#if USE(JSVALUE64)
+inline GPRReg extractResult(JSValueRegs result) { return result.gpr(); }
+#else
+inline JSValueRegs extractResult(JSValueRegs result) { return result; }
+#endif
+inline NoResultTag extractResult(NoResultTag) { return NoResult; }
+
+#endif // ENABLE(JIT)
+
+} // namespace JSC
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::GPRReg reg)
+{
+#if ENABLE(JIT)
+    out.print("%", JSC::GPRInfo::debugName(reg));
+#else
+    out.printf("%%r%d", reg);
+#endif
+}
+
+} // namespace WTF
diff --git a/jit/HostCallReturnValue.cpp b/jit/HostCallReturnValue.cpp
new file mode 100644
index 0000000..e8d0191
--- /dev/null
+++ b/jit/HostCallReturnValue.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HostCallReturnValue.h"
+
+#include "CallFrame.h"
+#include "JSCJSValueInlines.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include <wtf/InlineASM.h>
+
+
+namespace JSC {
+
+// Nothing to see here.
+
+} // namespace JSC
+
diff --git a/jit/HostCallReturnValue.h b/jit/HostCallReturnValue.h
new file mode 100644
index 0000000..eb61161
--- /dev/null
+++ b/jit/HostCallReturnValue.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "MacroAssemblerCodeRef.h"
+
+#if ENABLE(JIT)
+
+#if CALLING_CONVENTION_IS_STDCALL
+#define HOST_CALL_RETURN_VALUE_OPTION CDECL
+#else
+#define HOST_CALL_RETURN_VALUE_OPTION
+#endif
+
+namespace JSC {
+
+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValue() REFERENCED_FROM_ASM WTF_INTERNAL;
+
+#if COMPILER(GCC_OR_CLANG)
+
+// This is a public declaration only to convince CLANG not to elide it.
+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWithExecState(ExecState*) REFERENCED_FROM_ASM WTF_INTERNAL;
+
+inline void initializeHostCallReturnValue()
+{
+    getHostCallReturnValueWithExecState(0);
+}
+
+#else // COMPILER(GCC_OR_CLANG)
+
+inline void initializeHostCallReturnValue() { }
+
+#endif // COMPILER(GCC_OR_CLANG)
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/ICStats.cpp b/jit/ICStats.cpp
new file mode 100644
index 0000000..2080cd9
--- /dev/null
+++ b/jit/ICStats.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ICStats.h"
+
+namespace JSC {
+
+bool ICEvent::operator<(const ICEvent& other) const
+{
+    if (m_classInfo != other.m_classInfo) {
+        if (!m_classInfo)
+            return true;
+        if (!other.m_classInfo)
+            return false;
+        return strcmp(m_classInfo->className, other.m_classInfo->className) < 0;
+    }
+    
+    if (m_propertyName != other.m_propertyName)
+        return codePointCompare(m_propertyName.string(), other.m_propertyName.string()) < 0;
+    
+    return m_kind < other.m_kind;
+}
+
+void ICEvent::dump(PrintStream& out) const
+{
+    out.print(m_kind, "(", m_classInfo ? m_classInfo->className : "<null>", ", ", m_propertyName, ")");
+}
+
+void ICEvent::log() const
+{
+    ICStats::instance().add(*this);
+}
+
+Atomic<ICStats*> ICStats::s_instance;
+
+ICStats::ICStats()
+{
+    m_thread = createThread(
+        "JSC ICStats",
+        [this] () {
+            LockHolder locker(m_lock);
+            for (;;) {
+                m_condition.waitFor(
+                    m_lock, Seconds(1), [this] () -> bool { return m_shouldStop; });
+                if (m_shouldStop)
+                    break;
+                
+                dataLog("ICStats:\n");
+                auto list = m_spectrum.buildList();
+                for (unsigned i = list.size(); i--;)
+                    dataLog("    ", list[i].key, ": ", list[i].count, "\n");
+            }
+        });
+}
+
+ICStats::~ICStats()
+{
+    {
+        LockHolder locker(m_lock);
+        m_shouldStop = true;
+        m_condition.notifyAll();
+    }
+    
+    waitForThreadCompletion(m_thread);
+}
+
+void ICStats::add(const ICEvent& event)
+{
+    m_spectrum.add(event);
+}
+
+ICStats& ICStats::instance()
+{
+    for (;;) {
+        ICStats* result = s_instance.load();
+        if (result)
+            return *result;
+        
+        ICStats* newStats = new ICStats();
+        if (s_instance.compareExchangeWeak(nullptr, newStats))
+            return *newStats;
+        
+        delete newStats;
+    }
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, ICEvent::Kind kind)
+{
+    switch (kind) {
+#define ICEVENT_KIND_DUMP(name) case ICEvent::name: out.print(#name); return;
+        FOR_EACH_ICEVENT_KIND(ICEVENT_KIND_DUMP);
+#undef ICEVENT_KIND_DUMP
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+
diff --git a/jit/ICStats.h b/jit/ICStats.h
new file mode 100644
index 0000000..9499c91
--- /dev/null
+++ b/jit/ICStats.h
@@ -0,0 +1,194 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ClassInfo.h"
+#include "Identifier.h"
+#include <wtf/Condition.h>
+#include <wtf/HashTable.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/Lock.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PrintStream.h>
+#include <wtf/Spectrum.h>
+
+namespace JSC {
+
+#define FOR_EACH_ICEVENT_KIND(macro) \
+    macro(InvalidKind) \
+    macro(GetByIdAddAccessCase) \
+    macro(GetByIdReplaceWithJump) \
+    macro(GetByIdSelfPatch) \
+    macro(InAddAccessCase) \
+    macro(InReplaceWithJump) \
+    macro(OperationGetById) \
+    macro(OperationGetByIdGeneric) \
+    macro(OperationGetByIdBuildList) \
+    macro(OperationGetByIdOptimize) \
+    macro(OperationInOptimize) \
+    macro(OperationIn) \
+    macro(OperationGenericIn) \
+    macro(OperationPutByIdStrict) \
+    macro(OperationPutByIdNonStrict) \
+    macro(OperationPutByIdDirectStrict) \
+    macro(OperationPutByIdDirectNonStrict) \
+    macro(OperationPutByIdStrictOptimize) \
+    macro(OperationPutByIdNonStrictOptimize) \
+    macro(OperationPutByIdDirectStrictOptimize) \
+    macro(OperationPutByIdDirectNonStrictOptimize) \
+    macro(OperationPutByIdStrictBuildList) \
+    macro(OperationPutByIdNonStrictBuildList) \
+    macro(OperationPutByIdDirectStrictBuildList) \
+    macro(OperationPutByIdDirectNonStrictBuildList) \
+    macro(PutByIdAddAccessCase) \
+    macro(PutByIdReplaceWithJump) \
+    macro(PutByIdSelfPatch)
+
+class ICEvent {
+public:
+    enum Kind {
+#define ICEVENT_KIND_DECLARATION(name) name,
+        FOR_EACH_ICEVENT_KIND(ICEVENT_KIND_DECLARATION)
+#undef ICEVENT_KIND_DECLARATION
+    };
+    
+    ICEvent()
+    {
+    }
+    
+    ICEvent(Kind kind, const ClassInfo* classInfo, const Identifier propertyName)
+        : m_kind(kind)
+        , m_classInfo(classInfo)
+        , m_propertyName(propertyName)
+    {
+    }
+
+    ICEvent(WTF::HashTableDeletedValueType)
+        : m_kind(OperationGetById)
+    {
+    }
+    
+    bool operator==(const ICEvent& other) const
+    {
+        return m_kind == other.m_kind
+            && m_classInfo == other.m_classInfo
+            && m_propertyName == other.m_propertyName;
+    }
+    
+    bool operator!=(const ICEvent& other) const
+    {
+        return !(*this == other);
+    }
+    
+    bool operator<(const ICEvent& other) const;
+    bool operator>(const ICEvent& other) const { return other < *this; }
+    bool operator<=(const ICEvent& other) const { return !(*this > other); }
+    bool operator>=(const ICEvent& other) const { return !(*this < other); }
+    
+    explicit operator bool() const
+    {
+        return *this != ICEvent();
+    }
+    
+    Kind kind() const { return m_kind; }
+    const ClassInfo* classInfo() const { return m_classInfo; }
+    const Identifier& propertyName() const { return m_propertyName; }
+    
+    unsigned hash() const
+    {
+        return m_kind + WTF::PtrHash<const ClassInfo*>::hash(m_classInfo) + StringHash::hash(m_propertyName.string());
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return *this == ICEvent(WTF::HashTableDeletedValue);
+    }
+    
+    void dump(PrintStream&) const;
+    
+    void log() const;
+    
+private:
+    
+    Kind m_kind { InvalidKind };
+    const ClassInfo* m_classInfo { nullptr };
+    Identifier m_propertyName;
+};
+
+struct ICEventHash {
+    static unsigned hash(const ICEvent& key) { return key.hash(); }
+    static bool equal(const ICEvent& a, const ICEvent& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::ICEvent::Kind);
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::ICEvent> {
+    typedef JSC::ICEventHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::ICEvent> : SimpleClassHashTraits<JSC::ICEvent> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+namespace JSC {
+
+class ICStats {
+    WTF_MAKE_NONCOPYABLE(ICStats);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ICStats();
+    ~ICStats();
+    
+    void add(const ICEvent& event);
+    
+    static ICStats& instance();
+    
+private:
+
+    Spectrum<ICEvent, uint64_t> m_spectrum;
+    ThreadIdentifier m_thread;
+    Lock m_lock;
+    Condition m_condition;
+    bool m_shouldStop { false };
+    
+    static Atomic<ICStats*> s_instance;
+};
+
+#define LOG_IC(arguments) do {                  \
+        if (Options::useICStats())              \
+            (ICEvent arguments).log();          \
+    } while (false)
+
+} // namespace JSC
diff --git a/jit/IntrinsicEmitter.cpp b/jit/IntrinsicEmitter.cpp
new file mode 100644
index 0000000..c82b8a3
--- /dev/null
+++ b/jit/IntrinsicEmitter.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "JSArrayBufferView.h"
+#include "JSCJSValueInlines.h"
+#include "JSCellInlines.h"
+#include "PolymorphicAccess.h"
+#include "StructureStubInfo.h"
+
+namespace JSC {
+
+typedef CCallHelpers::TrustedImm32 TrustedImm32;
+typedef CCallHelpers::Imm32 Imm32;
+typedef CCallHelpers::TrustedImmPtr TrustedImmPtr;
+typedef CCallHelpers::ImmPtr ImmPtr;
+typedef CCallHelpers::TrustedImm64 TrustedImm64;
+typedef CCallHelpers::Imm64 Imm64;
+
+bool AccessCase::canEmitIntrinsicGetter(JSFunction* getter, Structure* structure)
+{
+
+    switch (getter->intrinsic()) {
+    case TypedArrayByteOffsetIntrinsic:
+    case TypedArrayByteLengthIntrinsic:
+    case TypedArrayLengthIntrinsic: {
+        TypedArrayType type = structure->classInfo()->typedArrayStorageType;
+
+        if (!isTypedView(type))
+            return false;
+        
+        return true;
+    }
+    default:
+        return false;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void AccessCase::emitIntrinsicGetter(AccessGenerationState& state)
+{
+    CCallHelpers& jit = *state.jit;
+    JSValueRegs valueRegs = state.valueRegs;
+    GPRReg baseGPR = state.baseGPR;
+    GPRReg valueGPR = valueRegs.payloadGPR();
+
+    switch (intrinsic()) {
+    case TypedArrayLengthIntrinsic: {
+        jit.load32(MacroAssembler::Address(state.baseGPR, JSArrayBufferView::offsetOfLength()), valueGPR);
+        jit.boxInt32(valueGPR, valueRegs);
+        state.succeed();
+        return;
+    }
+
+    case TypedArrayByteLengthIntrinsic: {
+        TypedArrayType type = structure()->classInfo()->typedArrayStorageType;
+
+        jit.load32(MacroAssembler::Address(state.baseGPR, JSArrayBufferView::offsetOfLength()), valueGPR);
+
+        if (elementSize(type) > 1) {
+            // We can use a bitshift here since we TypedArrays cannot have byteLength that overflows an int32.
+            jit.lshift32(valueGPR, Imm32(logElementSize(type)), valueGPR);
+        }
+
+        jit.boxInt32(valueGPR, valueRegs);
+        state.succeed();
+        return;
+    }
+
+    case TypedArrayByteOffsetIntrinsic: {
+        GPRReg scratchGPR = state.scratchGPR;
+
+        CCallHelpers::Jump emptyByteOffset = jit.branch32(
+            MacroAssembler::NotEqual,
+            MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfMode()),
+            TrustedImm32(WastefulTypedArray));
+
+        jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
+        jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfVector()), valueGPR);
+        jit.loadPtr(MacroAssembler::Address(scratchGPR, Butterfly::offsetOfArrayBuffer()), scratchGPR);
+        jit.loadPtr(MacroAssembler::Address(scratchGPR, ArrayBuffer::offsetOfData()), scratchGPR);
+        jit.subPtr(scratchGPR, valueGPR);
+
+        CCallHelpers::Jump done = jit.jump();
+        
+        emptyByteOffset.link(&jit);
+        jit.move(TrustedImmPtr(0), valueGPR);
+        
+        done.link(&jit);
+        
+        jit.boxInt32(valueGPR, valueRegs);
+        state.succeed();
+        return;
+    }
+
+    default:
+        break;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JIT.cpp b/jit/JIT.cpp
new file mode 100644
index 0000000..0ecc2be
--- /dev/null
+++ b/jit/JIT.cpp
@@ -0,0 +1,957 @@
+/*
+ * Copyright (C) 2008, 2009, 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+
+#include "JIT.h"
+
+#include "BytecodeGraph.h"
+#include "CodeBlock.h"
+#include "CodeBlockWithJITType.h"
+#include "DFGCapabilities.h"
+#include "Interpreter.h"
+#include "JITInlines.h"
+#include "JITOperations.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "LinkBuffer.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "PCToCodeOriginMap.h"
+#include "ProfilerDatabase.h"
+#include "ProgramCodeBlock.h"
+#include "ResultType.h"
+#include "SlowPathCall.h"
+#include "StackAlignment.h"
+#include "TypeProfilerLog.h"
+#include <wtf/CryptographicallyRandomNumber.h>
+#include <wtf/GraphNodeWorklist.h>
+#include <wtf/SimpleStats.h>
+
+using namespace std;
+
+namespace JSC {
+
+double totalBaselineCompileTime;
+double totalDFGCompileTime;
+double totalFTLCompileTime;
+double totalFTLDFGCompileTime;
+double totalFTLB3CompileTime;
+
+void ctiPatchCallByReturnAddress(ReturnAddressPtr returnAddress, FunctionPtr newCalleeFunction)
+{
+    MacroAssembler::repatchCall(
+        CodeLocationCall(MacroAssemblerCodePtr(returnAddress)),
+        newCalleeFunction);
+}
+
+JIT::CodeRef JIT::compileCTINativeCall(VM* vm, NativeFunction func)
+{
+    if (!vm->canUseJIT())
+        return CodeRef::createLLIntCodeRef(llint_native_call_trampoline);
+    JIT jit(vm, 0);
+    return jit.privateCompileCTINativeCall(vm, func);
+}
+
+JIT::JIT(VM* vm, CodeBlock* codeBlock, unsigned loopOSREntryBytecodeOffset)
+    : JSInterfaceJIT(vm, codeBlock)
+    , m_interpreter(vm->interpreter)
+    , m_labels(codeBlock ? codeBlock->numberOfInstructions() : 0)
+    , m_bytecodeOffset(std::numeric_limits<unsigned>::max())
+    , m_getByIdIndex(UINT_MAX)
+    , m_putByIdIndex(UINT_MAX)
+    , m_byValInstructionIndex(UINT_MAX)
+    , m_callLinkInfoIndex(UINT_MAX)
+    , m_randomGenerator(cryptographicallyRandomNumber())
+    , m_pcToCodeOriginMapBuilder(*vm)
+    , m_canBeOptimized(false)
+    , m_shouldEmitProfiling(false)
+    , m_loopOSREntryBytecodeOffset(loopOSREntryBytecodeOffset)
+{
+}
+
+JIT::~JIT()
+{
+}
+
+#if ENABLE(DFG_JIT)
+void JIT::emitEnterOptimizationCheck()
+{
+    if (!canBeOptimized())
+        return;
+
+    JumpList skipOptimize;
+    
+    skipOptimize.append(branchAdd32(Signed, TrustedImm32(Options::executionCounterIncrementForEntry()), AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter())));
+    ASSERT(!m_bytecodeOffset);
+
+    copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer();
+
+    callOperation(operationOptimize, m_bytecodeOffset);
+    skipOptimize.append(branchTestPtr(Zero, returnValueGPR));
+    move(returnValueGPR2, stackPointerRegister);
+    jump(returnValueGPR);
+    skipOptimize.link(this);
+}
+#endif
+
+void JIT::emitNotifyWrite(WatchpointSet* set)
+{
+    if (!set || set->state() == IsInvalidated) {
+        addSlowCase(Jump());
+        return;
+    }
+    
+    addSlowCase(branch8(NotEqual, AbsoluteAddress(set->addressOfState()), TrustedImm32(IsInvalidated)));
+}
+
+void JIT::emitNotifyWrite(GPRReg pointerToSet)
+{
+    addSlowCase(branch8(NotEqual, Address(pointerToSet, WatchpointSet::offsetOfState()), TrustedImm32(IsInvalidated)));
+}
+
+void JIT::assertStackPointerOffset()
+{
+    if (ASSERT_DISABLED)
+        return;
+    
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, regT0);
+    Jump ok = branchPtr(Equal, regT0, stackPointerRegister);
+    breakpoint();
+    ok.link(this);
+}
+
+#define NEXT_OPCODE(name) \
+    m_bytecodeOffset += OPCODE_LENGTH(name); \
+    break;
+
+#define DEFINE_SLOW_OP(name) \
+    case op_##name: { \
+        if (m_bytecodeOffset >= startBytecodeOffset) { \
+            JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_##name); \
+            slowPathCall.call(); \
+        } \
+        NEXT_OPCODE(op_##name); \
+    }
+
+#define DEFINE_OP(name) \
+    case name: { \
+        if (m_bytecodeOffset >= startBytecodeOffset) { \
+            emit_##name(currentInstruction); \
+        } \
+        NEXT_OPCODE(name); \
+    }
+
+#define DEFINE_SLOWCASE_OP(name) \
+    case name: { \
+        emitSlow_##name(currentInstruction, iter); \
+        NEXT_OPCODE(name); \
+    }
+
+void JIT::privateCompileMainPass()
+{
+    if (false)
+        dataLog("Compiling ", *m_codeBlock, "\n");
+    
+    jitAssertTagsInPlace();
+    jitAssertArgumentCountSane();
+    
+    Instruction* instructionsBegin = m_codeBlock->instructions().begin();
+    unsigned instructionCount = m_instructions.size();
+
+    m_callLinkInfoIndex = 0;
+
+    unsigned startBytecodeOffset = 0;
+    if (m_loopOSREntryBytecodeOffset && m_codeBlock->inherits(ProgramCodeBlock::info())) {
+        // We can only do this optimization because we execute ProgramCodeBlock's exactly once.
+        // This optimization would be invalid otherwise. When the LLInt determines it wants to
+        // do OSR entry into the baseline JIT in a loop, it will pass in the bytecode offset it
+        // was executing at when it kicked off our compilation. We only need to compile code for
+        // anything reachable from that bytecode offset.
+
+        // We only bother building the bytecode graph if it could save time and executable
+        // memory. We pick an arbitrary offset where we deem this is profitable.
+        if (m_loopOSREntryBytecodeOffset >= 200) {
+            // As a simplification, we don't find all bytecode ranges that are unreachable.
+            // Instead, we just find the minimum bytecode offset that is reachable, and
+            // compile code from that bytecode offset onwards.
+
+            BytecodeGraph<CodeBlock> graph(m_codeBlock, m_instructions);
+            BytecodeBasicBlock* block = graph.findBasicBlockForBytecodeOffset(m_loopOSREntryBytecodeOffset);
+            RELEASE_ASSERT(block);
+
+            GraphNodeWorklist<BytecodeBasicBlock*> worklist;
+            startBytecodeOffset = UINT_MAX;
+            worklist.push(block);
+            while (BytecodeBasicBlock* block = worklist.pop()) {
+                startBytecodeOffset = std::min(startBytecodeOffset, block->leaderOffset());
+                worklist.pushAll(block->successors());
+            }
+        }
+    }
+
+    for (m_bytecodeOffset = 0; m_bytecodeOffset < instructionCount; ) {
+        if (m_bytecodeOffset == startBytecodeOffset && startBytecodeOffset > 0) {
+            // We've proven all bytecode instructions up until here are unreachable.
+            // Let's ensure that by crashing if it's ever hit.
+            breakpoint();
+        }
+
+        if (m_disassembler)
+            m_disassembler->setForBytecodeMainPath(m_bytecodeOffset, label());
+        Instruction* currentInstruction = instructionsBegin + m_bytecodeOffset;
+        ASSERT_WITH_MESSAGE(m_interpreter->isOpcode(currentInstruction->u.opcode), "privateCompileMainPass gone bad @ %d", m_bytecodeOffset);
+
+        m_pcToCodeOriginMapBuilder.appendItem(label(), CodeOrigin(m_bytecodeOffset));
+
+#if ENABLE(OPCODE_SAMPLING)
+        if (m_bytecodeOffset > 0) // Avoid the overhead of sampling op_enter twice.
+            sampleInstruction(currentInstruction);
+#endif
+
+        m_labels[m_bytecodeOffset] = label();
+
+#if ENABLE(JIT_VERBOSE)
+        dataLogF("Old JIT emitting code for bc#%u at offset 0x%lx.\n", m_bytecodeOffset, (long)debugOffset());
+#endif
+        
+        OpcodeID opcodeID = m_interpreter->getOpcodeID(currentInstruction->u.opcode);
+
+        if (m_compilation) {
+            add64(
+                TrustedImm32(1),
+                AbsoluteAddress(m_compilation->executionCounterFor(Profiler::OriginStack(Profiler::Origin(
+                    m_compilation->bytecodes(), m_bytecodeOffset)))->address()));
+        }
+        
+        if (Options::eagerlyUpdateTopCallFrame())
+            updateTopCallFrame();
+
+        unsigned bytecodeOffset = m_bytecodeOffset;
+
+        switch (opcodeID) {
+        DEFINE_SLOW_OP(in)
+        DEFINE_SLOW_OP(less)
+        DEFINE_SLOW_OP(lesseq)
+        DEFINE_SLOW_OP(greater)
+        DEFINE_SLOW_OP(greatereq)
+        DEFINE_SLOW_OP(is_function)
+        DEFINE_SLOW_OP(is_object_or_null)
+        DEFINE_SLOW_OP(typeof)
+
+        DEFINE_OP(op_add)
+        DEFINE_OP(op_bitand)
+        DEFINE_OP(op_bitor)
+        DEFINE_OP(op_bitxor)
+        DEFINE_OP(op_call)
+        DEFINE_OP(op_tail_call)
+        DEFINE_OP(op_call_eval)
+        DEFINE_OP(op_call_varargs)
+        DEFINE_OP(op_tail_call_varargs)
+        DEFINE_OP(op_tail_call_forward_arguments)
+        DEFINE_OP(op_construct_varargs)
+        DEFINE_OP(op_catch)
+        DEFINE_OP(op_construct)
+        DEFINE_OP(op_create_this)
+        DEFINE_OP(op_to_this)
+        DEFINE_OP(op_create_direct_arguments)
+        DEFINE_OP(op_create_scoped_arguments)
+        DEFINE_OP(op_create_cloned_arguments)
+        DEFINE_OP(op_get_argument)
+        DEFINE_OP(op_argument_count)
+        DEFINE_OP(op_create_rest)
+        DEFINE_OP(op_get_rest_length)
+        DEFINE_OP(op_check_tdz)
+        DEFINE_OP(op_assert)
+        DEFINE_OP(op_debug)
+        DEFINE_OP(op_del_by_id)
+        DEFINE_OP(op_del_by_val)
+        DEFINE_OP(op_div)
+        DEFINE_OP(op_end)
+        DEFINE_OP(op_enter)
+        DEFINE_OP(op_get_scope)
+        DEFINE_OP(op_eq)
+        DEFINE_OP(op_eq_null)
+        DEFINE_OP(op_try_get_by_id)
+        case op_get_array_length:
+        case op_get_by_id_proto_load:
+        case op_get_by_id_unset:
+        DEFINE_OP(op_get_by_id)
+        DEFINE_OP(op_get_by_id_with_this)
+        DEFINE_OP(op_get_by_val)
+        DEFINE_OP(op_get_by_val_with_this)
+        DEFINE_OP(op_overrides_has_instance)
+        DEFINE_OP(op_instanceof)
+        DEFINE_OP(op_instanceof_custom)
+        DEFINE_OP(op_is_empty)
+        DEFINE_OP(op_is_undefined)
+        DEFINE_OP(op_is_boolean)
+        DEFINE_OP(op_is_number)
+        DEFINE_OP(op_is_object)
+        DEFINE_OP(op_is_cell_with_type)
+        DEFINE_OP(op_jeq_null)
+        DEFINE_OP(op_jfalse)
+        DEFINE_OP(op_jmp)
+        DEFINE_OP(op_jneq_null)
+        DEFINE_OP(op_jneq_ptr)
+        DEFINE_OP(op_jless)
+        DEFINE_OP(op_jlesseq)
+        DEFINE_OP(op_jgreater)
+        DEFINE_OP(op_jgreatereq)
+        DEFINE_OP(op_jnless)
+        DEFINE_OP(op_jnlesseq)
+        DEFINE_OP(op_jngreater)
+        DEFINE_OP(op_jngreatereq)
+        DEFINE_OP(op_jtrue)
+        DEFINE_OP(op_loop_hint)
+        DEFINE_OP(op_watchdog)
+        DEFINE_OP(op_lshift)
+        DEFINE_OP(op_mod)
+        DEFINE_OP(op_mov)
+        DEFINE_OP(op_mul)
+        DEFINE_OP(op_negate)
+        DEFINE_OP(op_neq)
+        DEFINE_OP(op_neq_null)
+        DEFINE_OP(op_new_array)
+        DEFINE_OP(op_new_array_with_size)
+        DEFINE_OP(op_new_array_buffer)
+        DEFINE_OP(op_new_array_with_spread)
+        DEFINE_OP(op_spread)
+        DEFINE_OP(op_new_func)
+        DEFINE_OP(op_new_func_exp)
+        DEFINE_OP(op_new_generator_func)
+        DEFINE_OP(op_new_generator_func_exp)
+        DEFINE_OP(op_new_async_func)
+        DEFINE_OP(op_new_async_func_exp)
+        DEFINE_OP(op_new_object)
+        DEFINE_OP(op_new_regexp)
+        DEFINE_OP(op_not)
+        DEFINE_OP(op_nstricteq)
+        DEFINE_OP(op_dec)
+        DEFINE_OP(op_inc)
+        DEFINE_OP(op_pow)
+        DEFINE_OP(op_profile_type)
+        DEFINE_OP(op_profile_control_flow)
+        DEFINE_OP(op_push_with_scope)
+        DEFINE_OP(op_create_lexical_environment)
+        DEFINE_OP(op_get_parent_scope)
+        DEFINE_OP(op_put_by_id)
+        DEFINE_OP(op_put_by_id_with_this)
+        DEFINE_OP(op_put_by_index)
+        case op_put_by_val_direct:
+        DEFINE_OP(op_put_by_val)
+        DEFINE_OP(op_put_by_val_with_this)
+        DEFINE_OP(op_put_getter_by_id)
+        DEFINE_OP(op_put_setter_by_id)
+        DEFINE_OP(op_put_getter_setter_by_id)
+        DEFINE_OP(op_put_getter_by_val)
+        DEFINE_OP(op_put_setter_by_val)
+        DEFINE_OP(op_define_data_property)
+        DEFINE_OP(op_define_accessor_property)
+
+        DEFINE_OP(op_ret)
+        DEFINE_OP(op_rshift)
+        DEFINE_OP(op_unsigned)
+        DEFINE_OP(op_urshift)
+        DEFINE_OP(op_set_function_name)
+        DEFINE_OP(op_strcat)
+        DEFINE_OP(op_stricteq)
+        DEFINE_OP(op_sub)
+        DEFINE_OP(op_switch_char)
+        DEFINE_OP(op_switch_imm)
+        DEFINE_OP(op_switch_string)
+        DEFINE_OP(op_throw)
+        DEFINE_OP(op_throw_static_error)
+        DEFINE_OP(op_to_number)
+        DEFINE_OP(op_to_string)
+        DEFINE_OP(op_to_primitive)
+
+        DEFINE_OP(op_resolve_scope)
+        DEFINE_OP(op_get_from_scope)
+        DEFINE_OP(op_put_to_scope)
+        DEFINE_OP(op_get_from_arguments)
+        DEFINE_OP(op_put_to_arguments)
+
+        DEFINE_OP(op_get_enumerable_length)
+        DEFINE_OP(op_has_generic_property)
+        DEFINE_OP(op_has_structure_property)
+        DEFINE_OP(op_has_indexed_property)
+        DEFINE_OP(op_get_direct_pname)
+        DEFINE_OP(op_get_property_enumerator)
+        DEFINE_OP(op_enumerator_structure_pname)
+        DEFINE_OP(op_enumerator_generic_pname)
+        DEFINE_OP(op_to_index_string)
+            
+        DEFINE_OP(op_log_shadow_chicken_prologue)
+        DEFINE_OP(op_log_shadow_chicken_tail)
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        if (false)
+            dataLog("At ", bytecodeOffset, ": ", m_slowCases.size(), "\n");
+    }
+
+    RELEASE_ASSERT(m_callLinkInfoIndex == m_callCompilationInfo.size());
+
+#ifndef NDEBUG
+    // Reset this, in order to guard its use with ASSERTs.
+    m_bytecodeOffset = std::numeric_limits<unsigned>::max();
+#endif
+}
+
+void JIT::privateCompileLinkPass()
+{
+    unsigned jmpTableCount = m_jmpTable.size();
+    for (unsigned i = 0; i < jmpTableCount; ++i)
+        m_jmpTable[i].from.linkTo(m_labels[m_jmpTable[i].toBytecodeOffset], this);
+    m_jmpTable.clear();
+}
+
+void JIT::privateCompileSlowCases()
+{
+    Instruction* instructionsBegin = m_codeBlock->instructions().begin();
+
+    m_getByIdIndex = 0;
+    m_putByIdIndex = 0;
+    m_byValInstructionIndex = 0;
+    m_callLinkInfoIndex = 0;
+    
+    // Use this to assert that slow-path code associates new profiling sites with existing
+    // ValueProfiles rather than creating new ones. This ensures that for a given instruction
+    // (say, get_by_id) we get combined statistics for both the fast-path executions of that
+    // instructions and the slow-path executions. Furthermore, if the slow-path code created
+    // new ValueProfiles then the ValueProfiles would no longer be sorted by bytecode offset,
+    // which would break the invariant necessary to use CodeBlock::valueProfileForBytecodeOffset().
+    unsigned numberOfValueProfiles = m_codeBlock->numberOfValueProfiles();
+
+    for (Vector<SlowCaseEntry>::iterator iter = m_slowCases.begin(); iter != m_slowCases.end();) {
+        m_bytecodeOffset = iter->to;
+
+        m_pcToCodeOriginMapBuilder.appendItem(label(), CodeOrigin(m_bytecodeOffset));
+
+        unsigned firstTo = m_bytecodeOffset;
+
+        Instruction* currentInstruction = instructionsBegin + m_bytecodeOffset;
+        
+        RareCaseProfile* rareCaseProfile = 0;
+        if (shouldEmitProfiling())
+            rareCaseProfile = m_codeBlock->addRareCaseProfile(m_bytecodeOffset);
+
+#if ENABLE(JIT_VERBOSE)
+        dataLogF("Old JIT emitting slow code for bc#%u at offset 0x%lx.\n", m_bytecodeOffset, (long)debugOffset());
+#endif
+        
+        if (m_disassembler)
+            m_disassembler->setForBytecodeSlowPath(m_bytecodeOffset, label());
+
+        switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+        DEFINE_SLOWCASE_OP(op_add)
+        DEFINE_SLOWCASE_OP(op_bitand)
+        DEFINE_SLOWCASE_OP(op_bitor)
+        DEFINE_SLOWCASE_OP(op_bitxor)
+        DEFINE_SLOWCASE_OP(op_call)
+        DEFINE_SLOWCASE_OP(op_tail_call)
+        DEFINE_SLOWCASE_OP(op_call_eval)
+        DEFINE_SLOWCASE_OP(op_call_varargs)
+        DEFINE_SLOWCASE_OP(op_tail_call_varargs)
+        DEFINE_SLOWCASE_OP(op_tail_call_forward_arguments)
+        DEFINE_SLOWCASE_OP(op_construct_varargs)
+        DEFINE_SLOWCASE_OP(op_construct)
+        DEFINE_SLOWCASE_OP(op_to_this)
+        DEFINE_SLOWCASE_OP(op_check_tdz)
+        DEFINE_SLOWCASE_OP(op_create_this)
+        DEFINE_SLOWCASE_OP(op_div)
+        DEFINE_SLOWCASE_OP(op_eq)
+        DEFINE_SLOWCASE_OP(op_try_get_by_id)
+        case op_get_array_length:
+        case op_get_by_id_proto_load:
+        case op_get_by_id_unset:
+        DEFINE_SLOWCASE_OP(op_get_by_id)
+        DEFINE_SLOWCASE_OP(op_get_by_val)
+        DEFINE_SLOWCASE_OP(op_instanceof)
+        DEFINE_SLOWCASE_OP(op_instanceof_custom)
+        DEFINE_SLOWCASE_OP(op_jless)
+        DEFINE_SLOWCASE_OP(op_jlesseq)
+        DEFINE_SLOWCASE_OP(op_jgreater)
+        DEFINE_SLOWCASE_OP(op_jgreatereq)
+        DEFINE_SLOWCASE_OP(op_jnless)
+        DEFINE_SLOWCASE_OP(op_jnlesseq)
+        DEFINE_SLOWCASE_OP(op_jngreater)
+        DEFINE_SLOWCASE_OP(op_jngreatereq)
+        DEFINE_SLOWCASE_OP(op_loop_hint)
+        DEFINE_SLOWCASE_OP(op_watchdog)
+        DEFINE_SLOWCASE_OP(op_lshift)
+        DEFINE_SLOWCASE_OP(op_mod)
+        DEFINE_SLOWCASE_OP(op_mul)
+        DEFINE_SLOWCASE_OP(op_negate)
+        DEFINE_SLOWCASE_OP(op_neq)
+        DEFINE_SLOWCASE_OP(op_new_object)
+        DEFINE_SLOWCASE_OP(op_not)
+        DEFINE_SLOWCASE_OP(op_nstricteq)
+        DEFINE_SLOWCASE_OP(op_dec)
+        DEFINE_SLOWCASE_OP(op_inc)
+        DEFINE_SLOWCASE_OP(op_put_by_id)
+        case op_put_by_val_direct:
+        DEFINE_SLOWCASE_OP(op_put_by_val)
+        DEFINE_SLOWCASE_OP(op_rshift)
+        DEFINE_SLOWCASE_OP(op_unsigned)
+        DEFINE_SLOWCASE_OP(op_urshift)
+        DEFINE_SLOWCASE_OP(op_stricteq)
+        DEFINE_SLOWCASE_OP(op_sub)
+        DEFINE_SLOWCASE_OP(op_to_number)
+        DEFINE_SLOWCASE_OP(op_to_string)
+        DEFINE_SLOWCASE_OP(op_to_primitive)
+        DEFINE_SLOWCASE_OP(op_has_indexed_property)
+        DEFINE_SLOWCASE_OP(op_has_structure_property)
+        DEFINE_SLOWCASE_OP(op_get_direct_pname)
+
+        DEFINE_SLOWCASE_OP(op_resolve_scope)
+        DEFINE_SLOWCASE_OP(op_get_from_scope)
+        DEFINE_SLOWCASE_OP(op_put_to_scope)
+
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        if (false)
+            dataLog("At ", firstTo, " slow: ", iter - m_slowCases.begin(), "\n");
+
+        RELEASE_ASSERT_WITH_MESSAGE(iter == m_slowCases.end() || firstTo != iter->to, "Not enough jumps linked in slow case codegen.");
+        RELEASE_ASSERT_WITH_MESSAGE(firstTo == (iter - 1)->to, "Too many jumps linked in slow case codegen.");
+        
+        if (shouldEmitProfiling())
+            add32(TrustedImm32(1), AbsoluteAddress(&rareCaseProfile->m_counter));
+
+        emitJumpSlowToHot(jump(), 0);
+    }
+
+    RELEASE_ASSERT(m_getByIdIndex == m_getByIds.size());
+    RELEASE_ASSERT(m_putByIdIndex == m_putByIds.size());
+    RELEASE_ASSERT(m_callLinkInfoIndex == m_callCompilationInfo.size());
+    RELEASE_ASSERT(numberOfValueProfiles == m_codeBlock->numberOfValueProfiles());
+
+#ifndef NDEBUG
+    // Reset this, in order to guard its use with ASSERTs.
+    m_bytecodeOffset = std::numeric_limits<unsigned>::max();
+#endif
+}
+
+void JIT::compileWithoutLinking(JITCompilationEffort effort)
+{
+    double before = 0;
+    if (UNLIKELY(computeCompileTimes()))
+        before = monotonicallyIncreasingTimeMS();
+    
+    {
+        ConcurrentJSLocker locker(m_codeBlock->m_lock);
+        m_instructions = m_codeBlock->instructions().clone();
+    }
+
+    DFG::CapabilityLevel level = m_codeBlock->capabilityLevel();
+    switch (level) {
+    case DFG::CannotCompile:
+        m_canBeOptimized = false;
+        m_canBeOptimizedOrInlined = false;
+        m_shouldEmitProfiling = false;
+        break;
+    case DFG::CanCompile:
+    case DFG::CanCompileAndInline:
+        m_canBeOptimized = true;
+        m_canBeOptimizedOrInlined = true;
+        m_shouldEmitProfiling = true;
+        break;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    
+    switch (m_codeBlock->codeType()) {
+    case GlobalCode:
+    case ModuleCode:
+    case EvalCode:
+        m_codeBlock->m_shouldAlwaysBeInlined = false;
+        break;
+    case FunctionCode:
+        // We could have already set it to false because we detected an uninlineable call.
+        // Don't override that observation.
+        m_codeBlock->m_shouldAlwaysBeInlined &= canInline(level) && DFG::mightInlineFunction(m_codeBlock);
+        break;
+    }
+
+    if (Options::dumpDisassembly() || (m_vm->m_perBytecodeProfiler && Options::disassembleBaselineForProfiler()))
+        m_disassembler = std::make_unique<JITDisassembler>(m_codeBlock);
+    if (m_vm->m_perBytecodeProfiler) {
+        m_compilation = adoptRef(
+            new Profiler::Compilation(
+                m_vm->m_perBytecodeProfiler->ensureBytecodesFor(m_codeBlock),
+                Profiler::Baseline));
+        m_compilation->addProfiledBytecodes(*m_vm->m_perBytecodeProfiler, m_codeBlock);
+    }
+    
+    m_pcToCodeOriginMapBuilder.appendItem(label(), CodeOrigin(0, nullptr));
+
+    if (m_disassembler)
+        m_disassembler->setStartOfCode(label());
+
+    // Just add a little bit of randomness to the codegen
+    if (m_randomGenerator.getUint32() & 1)
+        nop();
+
+    emitFunctionPrologue();
+    emitPutToCallFrameHeader(m_codeBlock, CallFrameSlot::codeBlock);
+
+    Label beginLabel(this);
+
+    sampleCodeBlock(m_codeBlock);
+#if ENABLE(OPCODE_SAMPLING)
+    sampleInstruction(m_codeBlock->instructions().begin());
+#endif
+
+    if (m_codeBlock->codeType() == FunctionCode) {
+        ASSERT(m_bytecodeOffset == std::numeric_limits<unsigned>::max());
+        if (shouldEmitProfiling()) {
+            for (int argument = 0; argument < m_codeBlock->numParameters(); ++argument) {
+                // If this is a constructor, then we want to put in a dummy profiling site (to
+                // keep things consistent) but we don't actually want to record the dummy value.
+                if (m_codeBlock->m_isConstructor && !argument)
+                    continue;
+                int offset = CallFrame::argumentOffsetIncludingThis(argument) * static_cast<int>(sizeof(Register));
+#if USE(JSVALUE64)
+                load64(Address(callFrameRegister, offset), regT0);
+#elif USE(JSVALUE32_64)
+                load32(Address(callFrameRegister, offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
+                load32(Address(callFrameRegister, offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
+#endif
+                emitValueProfilingSite(m_codeBlock->valueProfileForArgument(argument));
+            }
+        }
+    }
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, regT1);
+    Jump stackOverflow = branchPtr(Above, AbsoluteAddress(m_vm->addressOfSoftStackLimit()), regT1);
+
+    move(regT1, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    emitSaveCalleeSaves();
+    emitMaterializeTagCheckRegisters();
+    
+    RELEASE_ASSERT(!JITCode::isJIT(m_codeBlock->jitType()));
+
+    privateCompileMainPass();
+    privateCompileLinkPass();
+    privateCompileSlowCases();
+    
+    if (m_disassembler)
+        m_disassembler->setEndOfSlowPath(label());
+    m_pcToCodeOriginMapBuilder.appendItem(label(), PCToCodeOriginMapBuilder::defaultCodeOrigin());
+
+    stackOverflow.link(this);
+    m_bytecodeOffset = 0;
+    if (maxFrameExtentForSlowPathCall)
+        addPtr(TrustedImm32(-maxFrameExtentForSlowPathCall), stackPointerRegister);
+    callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, m_codeBlock);
+
+    if (m_codeBlock->codeType() == FunctionCode) {
+        m_arityCheck = label();
+        store8(TrustedImm32(0), &m_codeBlock->m_shouldAlwaysBeInlined);
+        emitFunctionPrologue();
+        emitPutToCallFrameHeader(m_codeBlock, CallFrameSlot::codeBlock);
+
+        load32(payloadFor(CallFrameSlot::argumentCount), regT1);
+        branch32(AboveOrEqual, regT1, TrustedImm32(m_codeBlock->m_numParameters)).linkTo(beginLabel, this);
+
+        m_bytecodeOffset = 0;
+
+        if (maxFrameExtentForSlowPathCall)
+            addPtr(TrustedImm32(-maxFrameExtentForSlowPathCall), stackPointerRegister);
+        callOperationWithCallFrameRollbackOnException(m_codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck);
+        if (maxFrameExtentForSlowPathCall)
+            addPtr(TrustedImm32(maxFrameExtentForSlowPathCall), stackPointerRegister);
+        branchTest32(Zero, returnValueGPR).linkTo(beginLabel, this);
+        move(returnValueGPR, GPRInfo::argumentGPR0);
+        emitNakedCall(m_vm->getCTIStub(arityFixupGenerator).code());
+
+#if !ASSERT_DISABLED
+        m_bytecodeOffset = std::numeric_limits<unsigned>::max(); // Reset this, in order to guard its use with ASSERTs.
+#endif
+
+        jump(beginLabel);
+    }
+
+    ASSERT(m_jmpTable.isEmpty());
+    
+    privateCompileExceptionHandlers();
+    
+    if (m_disassembler)
+        m_disassembler->setEndOfCode(label());
+    m_pcToCodeOriginMapBuilder.appendItem(label(), PCToCodeOriginMapBuilder::defaultCodeOrigin());
+
+    m_linkBuffer = std::unique_ptr<LinkBuffer>(new LinkBuffer(*m_vm, *this, m_codeBlock, effort));
+
+    double after = 0;
+    if (UNLIKELY(computeCompileTimes())) {
+        after = monotonicallyIncreasingTimeMS();
+
+        if (Options::reportTotalCompileTimes())
+            totalBaselineCompileTime += after - before;
+    }
+    if (UNLIKELY(reportCompileTimes())) {
+        CString codeBlockName = toCString(*m_codeBlock);
+        
+        dataLog("Optimized ", codeBlockName, " with Baseline JIT into ", m_linkBuffer->size(), " bytes in ", after - before, " ms.\n");
+    }
+}
+
+CompilationResult JIT::link()
+{
+    LinkBuffer& patchBuffer = *m_linkBuffer;
+    
+    if (patchBuffer.didFailToAllocate())
+        return CompilationFailed;
+
+    // Translate vPC offsets into addresses in JIT generated code, for switch tables.
+    for (unsigned i = 0; i < m_switches.size(); ++i) {
+        SwitchRecord record = m_switches[i];
+        unsigned bytecodeOffset = record.bytecodeOffset;
+
+        if (record.type != SwitchRecord::String) {
+            ASSERT(record.type == SwitchRecord::Immediate || record.type == SwitchRecord::Character); 
+            ASSERT(record.jumpTable.simpleJumpTable->branchOffsets.size() == record.jumpTable.simpleJumpTable->ctiOffsets.size());
+
+            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeOffset + record.defaultOffset]);
+
+            for (unsigned j = 0; j < record.jumpTable.simpleJumpTable->branchOffsets.size(); ++j) {
+                unsigned offset = record.jumpTable.simpleJumpTable->branchOffsets[j];
+                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeOffset + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
+            }
+        } else {
+            ASSERT(record.type == SwitchRecord::String);
+
+            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeOffset + record.defaultOffset]);
+
+            StringJumpTable::StringOffsetTable::iterator end = record.jumpTable.stringJumpTable->offsetTable.end();            
+            for (StringJumpTable::StringOffsetTable::iterator it = record.jumpTable.stringJumpTable->offsetTable.begin(); it != end; ++it) {
+                unsigned offset = it->value.branchOffset;
+                it->value.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeOffset + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
+            }
+        }
+    }
+
+    for (size_t i = 0; i < m_codeBlock->numberOfExceptionHandlers(); ++i) {
+        HandlerInfo& handler = m_codeBlock->exceptionHandler(i);
+        handler.nativeCode = patchBuffer.locationOf(m_labels[handler.target]);
+    }
+
+    for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
+        if (iter->to)
+            patchBuffer.link(iter->from, FunctionPtr(iter->to));
+    }
+
+    for (unsigned i = m_getByIds.size(); i--;)
+        m_getByIds[i].finalize(patchBuffer);
+    for (unsigned i = m_putByIds.size(); i--;)
+        m_putByIds[i].finalize(patchBuffer);
+
+    if (m_byValCompilationInfo.size()) {
+        CodeLocationLabel exceptionHandler = patchBuffer.locationOf(m_exceptionHandler);
+
+        for (const auto& byValCompilationInfo : m_byValCompilationInfo) {
+            PatchableJump patchableNotIndexJump = byValCompilationInfo.notIndexJump;
+            CodeLocationJump notIndexJump = CodeLocationJump();
+            if (Jump(patchableNotIndexJump).isSet())
+                notIndexJump = CodeLocationJump(patchBuffer.locationOf(patchableNotIndexJump));
+            CodeLocationJump badTypeJump = CodeLocationJump(patchBuffer.locationOf(byValCompilationInfo.badTypeJump));
+            CodeLocationLabel doneTarget = patchBuffer.locationOf(byValCompilationInfo.doneTarget);
+            CodeLocationLabel nextHotPathTarget = patchBuffer.locationOf(byValCompilationInfo.nextHotPathTarget);
+            CodeLocationLabel slowPathTarget = patchBuffer.locationOf(byValCompilationInfo.slowPathTarget);
+            CodeLocationCall returnAddress = patchBuffer.locationOf(byValCompilationInfo.returnAddress);
+
+            *byValCompilationInfo.byValInfo = ByValInfo(
+                byValCompilationInfo.bytecodeIndex,
+                notIndexJump,
+                badTypeJump,
+                exceptionHandler,
+                byValCompilationInfo.arrayMode,
+                byValCompilationInfo.arrayProfile,
+                differenceBetweenCodePtr(badTypeJump, doneTarget),
+                differenceBetweenCodePtr(badTypeJump, nextHotPathTarget),
+                differenceBetweenCodePtr(returnAddress, slowPathTarget));
+        }
+    }
+
+    for (unsigned i = 0; i < m_callCompilationInfo.size(); ++i) {
+        CallCompilationInfo& compilationInfo = m_callCompilationInfo[i];
+        CallLinkInfo& info = *compilationInfo.callLinkInfo;
+        info.setCallLocations(
+            CodeLocationLabel(patchBuffer.locationOfNearCall(compilationInfo.callReturnLocation)),
+            CodeLocationLabel(patchBuffer.locationOf(compilationInfo.hotPathBegin)),
+            patchBuffer.locationOfNearCall(compilationInfo.hotPathOther));
+    }
+
+    CompactJITCodeMap::Encoder jitCodeMapEncoder;
+    for (unsigned bytecodeOffset = 0; bytecodeOffset < m_labels.size(); ++bytecodeOffset) {
+        if (m_labels[bytecodeOffset].isSet())
+            jitCodeMapEncoder.append(bytecodeOffset, patchBuffer.offsetOf(m_labels[bytecodeOffset]));
+    }
+    m_codeBlock->setJITCodeMap(jitCodeMapEncoder.finish());
+
+    MacroAssemblerCodePtr withArityCheck;
+    if (m_codeBlock->codeType() == FunctionCode)
+        withArityCheck = patchBuffer.locationOf(m_arityCheck);
+
+    if (Options::dumpDisassembly()) {
+        m_disassembler->dump(patchBuffer);
+        patchBuffer.didAlreadyDisassemble();
+    }
+    if (m_compilation) {
+        if (Options::disassembleBaselineForProfiler())
+            m_disassembler->reportToProfiler(m_compilation.get(), patchBuffer);
+        m_vm->m_perBytecodeProfiler->addCompilation(m_codeBlock, m_compilation);
+    }
+
+    if (m_pcToCodeOriginMapBuilder.didBuildMapping())
+        m_codeBlock->setPCToCodeOriginMap(std::make_unique<PCToCodeOriginMap>(WTFMove(m_pcToCodeOriginMapBuilder), patchBuffer));
+    
+    CodeRef result = FINALIZE_CODE(
+        patchBuffer,
+        ("Baseline JIT code for %s", toCString(CodeBlockWithJITType(m_codeBlock, JITCode::BaselineJIT)).data()));
+    
+    m_vm->machineCodeBytesPerBytecodeWordForBaselineJIT->add(
+        static_cast<double>(result.size()) /
+        static_cast<double>(m_instructions.size()));
+
+    m_codeBlock->shrinkToFit(CodeBlock::LateShrink);
+    m_codeBlock->setJITCode(
+        adoptRef(new DirectJITCode(result, withArityCheck, JITCode::BaselineJIT)));
+
+#if ENABLE(JIT_VERBOSE)
+    dataLogF("JIT generated code for %p at [%p, %p).\n", m_codeBlock, result.executableMemory()->start(), result.executableMemory()->end());
+#endif
+    
+    return CompilationSuccessful;
+}
+
+CompilationResult JIT::privateCompile(JITCompilationEffort effort)
+{
+    doMainThreadPreparationBeforeCompile();
+    compileWithoutLinking(effort);
+    return link();
+}
+
+void JIT::privateCompileExceptionHandlers()
+{
+    if (!m_exceptionChecksWithCallFrameRollback.empty()) {
+        m_exceptionChecksWithCallFrameRollback.link(this);
+
+        copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+
+        // lookupExceptionHandlerFromCallerFrame is passed two arguments, the VM and the exec (the CallFrame*).
+
+        move(TrustedImmPtr(vm()), GPRInfo::argumentGPR0);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+
+#if CPU(X86)
+        // FIXME: should use the call abstraction, but this is currently in the SpeculativeJIT layer!
+        poke(GPRInfo::argumentGPR0);
+        poke(GPRInfo::argumentGPR1, 1);
+#endif
+        m_calls.append(CallRecord(call(), std::numeric_limits<unsigned>::max(), FunctionPtr(lookupExceptionHandlerFromCallerFrame).value()));
+        jumpToExceptionHandler();
+    }
+
+    if (!m_exceptionChecks.empty() || m_byValCompilationInfo.size()) {
+        m_exceptionHandler = label();
+        m_exceptionChecks.link(this);
+
+        copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+
+        // lookupExceptionHandler is passed two arguments, the VM and the exec (the CallFrame*).
+        move(TrustedImmPtr(vm()), GPRInfo::argumentGPR0);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+
+#if CPU(X86)
+        // FIXME: should use the call abstraction, but this is currently in the SpeculativeJIT layer!
+        poke(GPRInfo::argumentGPR0);
+        poke(GPRInfo::argumentGPR1, 1);
+#endif
+        m_calls.append(CallRecord(call(), std::numeric_limits<unsigned>::max(), FunctionPtr(lookupExceptionHandler).value()));
+        jumpToExceptionHandler();
+    }
+}
+
+void JIT::doMainThreadPreparationBeforeCompile()
+{
+    // This ensures that we have the most up to date type information when performing typecheck optimizations for op_profile_type.
+    if (m_vm->typeProfiler())
+        m_vm->typeProfilerLog()->processLogEntries(ASCIILiteral("Preparing for JIT compilation."));
+}
+
+unsigned JIT::frameRegisterCountFor(CodeBlock* codeBlock)
+{
+    ASSERT(static_cast<unsigned>(codeBlock->m_numCalleeLocals) == WTF::roundUpToMultipleOf(stackAlignmentRegisters(), static_cast<unsigned>(codeBlock->m_numCalleeLocals)));
+
+    return roundLocalRegisterCountForFramePointerOffset(codeBlock->m_numCalleeLocals + maxFrameExtentForSlowPathCallInRegisters);
+}
+
+int JIT::stackPointerOffsetFor(CodeBlock* codeBlock)
+{
+    return virtualRegisterForLocal(frameRegisterCountFor(codeBlock) - 1).offset();
+}
+
+bool JIT::reportCompileTimes()
+{
+    return Options::reportCompileTimes() || Options::reportBaselineCompileTimes();
+}
+
+bool JIT::computeCompileTimes()
+{
+    return reportCompileTimes() || Options::reportTotalCompileTimes();
+}
+
+HashMap<CString, double> JIT::compileTimeStats()
+{
+    HashMap<CString, double> result;
+    if (Options::reportTotalCompileTimes()) {
+        result.add("Total Compile Time", totalBaselineCompileTime + totalDFGCompileTime + totalFTLCompileTime);
+        result.add("Baseline Compile Time", totalBaselineCompileTime);
+#if ENABLE(DFG_JIT)
+        result.add("DFG Compile Time", totalDFGCompileTime);
+#if ENABLE(FTL_JIT)
+        result.add("FTL Compile Time", totalFTLCompileTime);
+        result.add("FTL (DFG) Compile Time", totalFTLDFGCompileTime);
+        result.add("FTL (B3) Compile Time", totalFTLB3CompileTime);
+#endif // ENABLE(FTL_JIT)
+#endif // ENABLE(DFG_JIT)
+    }
+    return result;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JIT.h b/jit/JIT.h
new file mode 100644
index 0000000..d8e74d4
--- /dev/null
+++ b/jit/JIT.h
@@ -0,0 +1,974 @@
+/*
+ * Copyright (C) 2008, 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+// We've run into some problems where changing the size of the class JIT leads to
+// performance fluctuations.  Try forcing alignment in an attempt to stabalize this.
+#if COMPILER(GCC_OR_CLANG)
+#define JIT_CLASS_ALIGNMENT __attribute__ ((aligned (32)))
+#else
+#define JIT_CLASS_ALIGNMENT
+#endif
+
+#define ASSERT_JIT_OFFSET(actual, expected) ASSERT_WITH_MESSAGE(actual == expected, "JIT Offset \"%s\" should be %d, not %d.\n", #expected, static_cast<int>(expected), static_cast<int>(actual));
+
+#include "CodeBlock.h"
+#include "CompactJITCodeMap.h"
+#include "JITDisassembler.h"
+#include "JITInlineCacheGenerator.h"
+#include "JITMathIC.h"
+#include "JSInterfaceJIT.h"
+#include "PCToCodeOriginMap.h"
+#include "UnusedPointer.h"
+
+namespace JSC {
+
+    enum OpcodeID : unsigned;
+
+    class ArrayAllocationProfile;
+    class CallLinkInfo;
+    class CodeBlock;
+    class FunctionExecutable;
+    class JIT;
+    class Identifier;
+    class Interpreter;
+    class MarkedAllocator;
+    class Register;
+    class StructureChain;
+    class StructureStubInfo;
+
+    struct Instruction;
+    struct OperandTypes;
+    struct SimpleJumpTable;
+    struct StringJumpTable;
+
+    struct CallRecord {
+        MacroAssembler::Call from;
+        unsigned bytecodeOffset;
+        void* to;
+
+        CallRecord()
+        {
+        }
+
+        CallRecord(MacroAssembler::Call from, unsigned bytecodeOffset, void* to = 0)
+            : from(from)
+            , bytecodeOffset(bytecodeOffset)
+            , to(to)
+        {
+        }
+    };
+
+    struct JumpTable {
+        MacroAssembler::Jump from;
+        unsigned toBytecodeOffset;
+
+        JumpTable(MacroAssembler::Jump f, unsigned t)
+            : from(f)
+            , toBytecodeOffset(t)
+        {
+        }
+    };
+
+    struct SlowCaseEntry {
+        MacroAssembler::Jump from;
+        unsigned to;
+        
+        SlowCaseEntry(MacroAssembler::Jump f, unsigned t)
+            : from(f)
+            , to(t)
+        {
+        }
+    };
+
+    struct SwitchRecord {
+        enum Type {
+            Immediate,
+            Character,
+            String
+        };
+
+        Type type;
+
+        union {
+            SimpleJumpTable* simpleJumpTable;
+            StringJumpTable* stringJumpTable;
+        } jumpTable;
+
+        unsigned bytecodeOffset;
+        unsigned defaultOffset;
+
+        SwitchRecord(SimpleJumpTable* jumpTable, unsigned bytecodeOffset, unsigned defaultOffset, Type type)
+            : type(type)
+            , bytecodeOffset(bytecodeOffset)
+            , defaultOffset(defaultOffset)
+        {
+            this->jumpTable.simpleJumpTable = jumpTable;
+        }
+
+        SwitchRecord(StringJumpTable* jumpTable, unsigned bytecodeOffset, unsigned defaultOffset)
+            : type(String)
+            , bytecodeOffset(bytecodeOffset)
+            , defaultOffset(defaultOffset)
+        {
+            this->jumpTable.stringJumpTable = jumpTable;
+        }
+    };
+
+    struct ByValCompilationInfo {
+        ByValCompilationInfo() { }
+        
+        ByValCompilationInfo(ByValInfo* byValInfo, unsigned bytecodeIndex, MacroAssembler::PatchableJump notIndexJump, MacroAssembler::PatchableJump badTypeJump, JITArrayMode arrayMode, ArrayProfile* arrayProfile, MacroAssembler::Label doneTarget, MacroAssembler::Label nextHotPathTarget)
+            : byValInfo(byValInfo)
+            , bytecodeIndex(bytecodeIndex)
+            , notIndexJump(notIndexJump)
+            , badTypeJump(badTypeJump)
+            , arrayMode(arrayMode)
+            , arrayProfile(arrayProfile)
+            , doneTarget(doneTarget)
+            , nextHotPathTarget(nextHotPathTarget)
+        {
+        }
+
+        ByValInfo* byValInfo;
+        unsigned bytecodeIndex;
+        MacroAssembler::PatchableJump notIndexJump;
+        MacroAssembler::PatchableJump badTypeJump;
+        JITArrayMode arrayMode;
+        ArrayProfile* arrayProfile;
+        MacroAssembler::Label doneTarget;
+        MacroAssembler::Label nextHotPathTarget;
+        MacroAssembler::Label slowPathTarget;
+        MacroAssembler::Call returnAddress;
+    };
+
+    struct CallCompilationInfo {
+        MacroAssembler::DataLabelPtr hotPathBegin;
+        MacroAssembler::Call hotPathOther;
+        MacroAssembler::Call callReturnLocation;
+        CallLinkInfo* callLinkInfo;
+    };
+
+    void ctiPatchCallByReturnAddress(ReturnAddressPtr, FunctionPtr newCalleeFunction);
+
+    class JIT : private JSInterfaceJIT {
+        friend class JITSlowPathCall;
+        friend class JITStubCall;
+
+        using MacroAssembler::Jump;
+        using MacroAssembler::JumpList;
+        using MacroAssembler::Label;
+
+        static const uintptr_t patchGetByIdDefaultStructure = unusedPointer;
+        static const int patchGetByIdDefaultOffset = 0;
+        // Magic number - initial offset cannot be representable as a signed 8bit value, or the X86Assembler
+        // will compress the displacement, and we may not be able to fit a patched offset.
+        static const int patchPutByIdDefaultOffset = 256;
+
+    public:
+        JIT(VM*, CodeBlock* = 0, unsigned loopOSREntryBytecodeOffset = 0);
+        ~JIT();
+
+        void compileWithoutLinking(JITCompilationEffort);
+        CompilationResult link();
+
+        void doMainThreadPreparationBeforeCompile();
+        
+        static CompilationResult compile(VM* vm, CodeBlock* codeBlock, JITCompilationEffort effort, unsigned bytecodeOffset = 0)
+        {
+            return JIT(vm, codeBlock, bytecodeOffset).privateCompile(effort);
+        }
+        
+        static void compileGetByVal(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
+        {
+            JIT jit(vm, codeBlock);
+            jit.m_bytecodeOffset = byValInfo->bytecodeIndex;
+            jit.privateCompileGetByVal(byValInfo, returnAddress, arrayMode);
+        }
+
+        static void compileGetByValWithCachedId(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, const Identifier& propertyName)
+        {
+            JIT jit(vm, codeBlock);
+            jit.m_bytecodeOffset = byValInfo->bytecodeIndex;
+            jit.privateCompileGetByValWithCachedId(byValInfo, returnAddress, propertyName);
+        }
+
+        static void compilePutByVal(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
+        {
+            JIT jit(vm, codeBlock);
+            jit.m_bytecodeOffset = byValInfo->bytecodeIndex;
+            jit.privateCompilePutByVal(byValInfo, returnAddress, arrayMode);
+        }
+        
+        static void compileDirectPutByVal(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
+        {
+            JIT jit(vm, codeBlock);
+            jit.m_bytecodeOffset = byValInfo->bytecodeIndex;
+            jit.privateCompilePutByVal(byValInfo, returnAddress, arrayMode);
+        }
+
+        static void compilePutByValWithCachedId(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, PutKind putKind, const Identifier& propertyName)
+        {
+            JIT jit(vm, codeBlock);
+            jit.m_bytecodeOffset = byValInfo->bytecodeIndex;
+            jit.privateCompilePutByValWithCachedId(byValInfo, returnAddress, putKind, propertyName);
+        }
+
+        static void compileHasIndexedProperty(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
+        {
+            JIT jit(vm, codeBlock);
+            jit.m_bytecodeOffset = byValInfo->bytecodeIndex;
+            jit.privateCompileHasIndexedProperty(byValInfo, returnAddress, arrayMode);
+        }
+
+        static CodeRef compileCTINativeCall(VM*, NativeFunction);
+
+        static unsigned frameRegisterCountFor(CodeBlock*);
+        static int stackPointerOffsetFor(CodeBlock*);
+
+        JS_EXPORT_PRIVATE static HashMap<CString, double> compileTimeStats();
+
+    private:
+        void privateCompileMainPass();
+        void privateCompileLinkPass();
+        void privateCompileSlowCases();
+        CompilationResult privateCompile(JITCompilationEffort);
+        
+        void privateCompileGetByVal(ByValInfo*, ReturnAddressPtr, JITArrayMode);
+        void privateCompileGetByValWithCachedId(ByValInfo*, ReturnAddressPtr, const Identifier&);
+        void privateCompilePutByVal(ByValInfo*, ReturnAddressPtr, JITArrayMode);
+        void privateCompilePutByValWithCachedId(ByValInfo*, ReturnAddressPtr, PutKind, const Identifier&);
+
+        void privateCompileHasIndexedProperty(ByValInfo*, ReturnAddressPtr, JITArrayMode);
+
+        Label privateCompileCTINativeCall(VM*, bool isConstruct = false);
+        CodeRef privateCompileCTINativeCall(VM*, NativeFunction);
+        void privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress);
+
+        // Add a call out from JIT code, without an exception check.
+        Call appendCall(const FunctionPtr& function)
+        {
+            Call functionCall = call();
+            m_calls.append(CallRecord(functionCall, m_bytecodeOffset, function.value()));
+            return functionCall;
+        }
+
+#if OS(WINDOWS) && CPU(X86_64)
+        Call appendCallWithSlowPathReturnType(const FunctionPtr& function)
+        {
+            Call functionCall = callWithSlowPathReturnType();
+            m_calls.append(CallRecord(functionCall, m_bytecodeOffset, function.value()));
+            return functionCall;
+        }
+#endif
+
+        void exceptionCheck(Jump jumpToHandler)
+        {
+            m_exceptionChecks.append(jumpToHandler);
+        }
+
+        void exceptionCheck()
+        {
+            m_exceptionChecks.append(emitExceptionCheck());
+        }
+
+        void exceptionCheckWithCallFrameRollback()
+        {
+            m_exceptionChecksWithCallFrameRollback.append(emitExceptionCheck());
+        }
+
+        void privateCompileExceptionHandlers();
+
+        void addSlowCase(Jump);
+        void addSlowCase(const JumpList&);
+        void addSlowCase();
+        void addJump(Jump, int);
+        void emitJumpSlowToHot(Jump, int);
+
+        void compileOpCall(OpcodeID, Instruction*, unsigned callLinkInfoIndex);
+        void compileOpCallSlowCase(OpcodeID, Instruction*, Vector<SlowCaseEntry>::iterator&, unsigned callLinkInfoIndex);
+        void compileSetupVarargsFrame(OpcodeID, Instruction*, CallLinkInfo*);
+        void compileCallEval(Instruction*);
+        void compileCallEvalSlowCase(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitPutCallResult(Instruction*);
+
+        enum CompileOpStrictEqType { OpStrictEq, OpNStrictEq };
+        void compileOpStrictEq(Instruction* instruction, CompileOpStrictEqType type);
+        bool isOperandConstantDouble(int src);
+        
+        void emitLoadDouble(int index, FPRegisterID value);
+        void emitLoadInt32ToDouble(int index, FPRegisterID value);
+        Jump emitJumpIfCellObject(RegisterID cellReg);
+        Jump emitJumpIfCellNotObject(RegisterID cellReg);
+
+        enum WriteBarrierMode { UnconditionalWriteBarrier, ShouldFilterBase, ShouldFilterValue, ShouldFilterBaseAndValue };
+        // value register in write barrier is used before any scratch registers
+        // so may safely be the same as either of the scratch registers.
+        void emitWriteBarrier(unsigned owner, unsigned value, WriteBarrierMode);
+        void emitWriteBarrier(JSCell* owner, unsigned value, WriteBarrierMode);
+        void emitWriteBarrier(JSCell* owner);
+
+        // This assumes that the value to profile is in regT0 and that regT3 is available for
+        // scratch.
+        void emitValueProfilingSite(ValueProfile*);
+        void emitValueProfilingSite(unsigned bytecodeOffset);
+        void emitValueProfilingSite();
+        void emitArrayProfilingSiteWithCell(RegisterID cell, RegisterID indexingType, ArrayProfile*);
+        void emitArrayProfilingSiteForBytecodeIndexWithCell(RegisterID cell, RegisterID indexingType, unsigned bytecodeIndex);
+        void emitArrayProfileStoreToHoleSpecialCase(ArrayProfile*);
+        void emitArrayProfileOutOfBoundsSpecialCase(ArrayProfile*);
+        
+        JITArrayMode chooseArrayMode(ArrayProfile*);
+        
+        // Property is in regT1, base is in regT0. regT2 contains indexing type.
+        // Property is int-checked and zero extended. Base is cell checked.
+        // Structure is already profiled. Returns the slow cases. Fall-through
+        // case contains result in regT0, and it is not yet profiled.
+        JumpList emitInt32Load(Instruction* instruction, PatchableJump& badType) { return emitContiguousLoad(instruction, badType, Int32Shape); }
+        JumpList emitDoubleLoad(Instruction*, PatchableJump& badType);
+        JumpList emitContiguousLoad(Instruction*, PatchableJump& badType, IndexingType expectedShape = ContiguousShape);
+        JumpList emitArrayStorageLoad(Instruction*, PatchableJump& badType);
+        JumpList emitLoadForArrayMode(Instruction*, JITArrayMode, PatchableJump& badType);
+
+        JumpList emitInt32GetByVal(Instruction* instruction, PatchableJump& badType) { return emitContiguousGetByVal(instruction, badType, Int32Shape); }
+        JumpList emitDoubleGetByVal(Instruction*, PatchableJump& badType);
+        JumpList emitContiguousGetByVal(Instruction*, PatchableJump& badType, IndexingType expectedShape = ContiguousShape);
+        JumpList emitArrayStorageGetByVal(Instruction*, PatchableJump& badType);
+        JumpList emitDirectArgumentsGetByVal(Instruction*, PatchableJump& badType);
+        JumpList emitScopedArgumentsGetByVal(Instruction*, PatchableJump& badType);
+        JumpList emitIntTypedArrayGetByVal(Instruction*, PatchableJump& badType, TypedArrayType);
+        JumpList emitFloatTypedArrayGetByVal(Instruction*, PatchableJump& badType, TypedArrayType);
+        
+        // Property is in regT1, base is in regT0. regT2 contains indecing type.
+        // The value to store is not yet loaded. Property is int-checked and
+        // zero-extended. Base is cell checked. Structure is already profiled.
+        // returns the slow cases.
+        JumpList emitInt32PutByVal(Instruction* currentInstruction, PatchableJump& badType)
+        {
+            return emitGenericContiguousPutByVal(currentInstruction, badType, Int32Shape);
+        }
+        JumpList emitDoublePutByVal(Instruction* currentInstruction, PatchableJump& badType)
+        {
+            return emitGenericContiguousPutByVal(currentInstruction, badType, DoubleShape);
+        }
+        JumpList emitContiguousPutByVal(Instruction* currentInstruction, PatchableJump& badType)
+        {
+            return emitGenericContiguousPutByVal(currentInstruction, badType);
+        }
+        JumpList emitGenericContiguousPutByVal(Instruction*, PatchableJump& badType, IndexingType indexingShape = ContiguousShape);
+        JumpList emitArrayStoragePutByVal(Instruction*, PatchableJump& badType);
+        JumpList emitIntTypedArrayPutByVal(Instruction*, PatchableJump& badType, TypedArrayType);
+        JumpList emitFloatTypedArrayPutByVal(Instruction*, PatchableJump& badType, TypedArrayType);
+
+        // Identifier check helper for GetByVal and PutByVal.
+        void emitByValIdentifierCheck(ByValInfo*, RegisterID cell, RegisterID scratch, const Identifier&, JumpList& slowCases);
+
+        JITGetByIdGenerator emitGetByValWithCachedId(ByValInfo*, Instruction*, const Identifier&, Jump& fastDoneCase, Jump& slowDoneCase, JumpList& slowCases);
+        JITPutByIdGenerator emitPutByValWithCachedId(ByValInfo*, Instruction*, PutKind, const Identifier&, JumpList& doneCases, JumpList& slowCases);
+
+        enum FinalObjectMode { MayBeFinal, KnownNotFinal };
+
+        void emitGetVirtualRegister(int src, JSValueRegs dst);
+        void emitPutVirtualRegister(int dst, JSValueRegs src);
+
+        int32_t getOperandConstantInt(int src);
+        double getOperandConstantDouble(int src);
+
+#if USE(JSVALUE32_64)
+        bool getOperandConstantInt(int op1, int op2, int& op, int32_t& constant);
+
+        void emitLoadTag(int index, RegisterID tag);
+        void emitLoadPayload(int index, RegisterID payload);
+
+        void emitLoad(const JSValue& v, RegisterID tag, RegisterID payload);
+        void emitLoad(int index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
+        void emitLoad2(int index1, RegisterID tag1, RegisterID payload1, int index2, RegisterID tag2, RegisterID payload2);
+
+        void emitStore(int index, RegisterID tag, RegisterID payload, RegisterID base = callFrameRegister);
+        void emitStore(int index, const JSValue constant, RegisterID base = callFrameRegister);
+        void emitStoreInt32(int index, RegisterID payload, bool indexIsInt32 = false);
+        void emitStoreInt32(int index, TrustedImm32 payload, bool indexIsInt32 = false);
+        void emitStoreCell(int index, RegisterID payload, bool indexIsCell = false);
+        void emitStoreBool(int index, RegisterID payload, bool indexIsBool = false);
+        void emitStoreDouble(int index, FPRegisterID value);
+
+        void emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex);
+        void emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex, RegisterID tag);
+
+        void compileGetByIdHotPath(const Identifier*);
+
+        // Arithmetic opcode helpers
+        void emitBinaryDoubleOp(OpcodeID, int dst, int op1, int op2, OperandTypes, JumpList& notInt32Op1, JumpList& notInt32Op2, bool op1IsInRegisters = true, bool op2IsInRegisters = true);
+
+#else // USE(JSVALUE32_64)
+        void emitGetVirtualRegister(int src, RegisterID dst);
+        void emitGetVirtualRegister(VirtualRegister src, RegisterID dst);
+        void emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2);
+        void emitGetVirtualRegisters(VirtualRegister src1, RegisterID dst1, VirtualRegister src2, RegisterID dst2);
+        void emitPutVirtualRegister(int dst, RegisterID from = regT0);
+        void emitPutVirtualRegister(VirtualRegister dst, RegisterID from = regT0);
+        void emitStoreCell(int dst, RegisterID payload, bool /* only used in JSValue32_64 */ = false)
+        {
+            emitPutVirtualRegister(dst, payload);
+        }
+        void emitStoreCell(VirtualRegister dst, RegisterID payload)
+        {
+            emitPutVirtualRegister(dst, payload);
+        }
+
+        Jump emitJumpIfJSCell(RegisterID);
+        Jump emitJumpIfBothJSCells(RegisterID, RegisterID, RegisterID);
+        void emitJumpSlowCaseIfJSCell(RegisterID);
+        void emitJumpSlowCaseIfNotJSCell(RegisterID);
+        void emitJumpSlowCaseIfNotJSCell(RegisterID, int VReg);
+        Jump emitJumpIfInt(RegisterID);
+        Jump emitJumpIfNotInt(RegisterID);
+        Jump emitJumpIfNotInt(RegisterID, RegisterID, RegisterID scratch);
+        PatchableJump emitPatchableJumpIfNotInt(RegisterID);
+        void emitJumpSlowCaseIfNotInt(RegisterID);
+        void emitJumpSlowCaseIfNotNumber(RegisterID);
+        void emitJumpSlowCaseIfNotInt(RegisterID, RegisterID, RegisterID scratch);
+
+        void emitTagBool(RegisterID);
+
+        void compileGetByIdHotPath(int baseVReg, const Identifier*);
+
+#endif // USE(JSVALUE32_64)
+
+        void emit_compareAndJump(OpcodeID, int op1, int op2, unsigned target, RelationalCondition);
+        void emit_compareAndJumpSlow(int op1, int op2, unsigned target, DoubleCondition, size_t (JIT_OPERATION *operation)(ExecState*, EncodedJSValue, EncodedJSValue), bool invert, Vector<SlowCaseEntry>::iterator&);
+        
+        void assertStackPointerOffset();
+
+        void emit_op_add(Instruction*);
+        void emit_op_bitand(Instruction*);
+        void emit_op_bitor(Instruction*);
+        void emit_op_bitxor(Instruction*);
+        void emit_op_call(Instruction*);
+        void emit_op_tail_call(Instruction*);
+        void emit_op_call_eval(Instruction*);
+        void emit_op_call_varargs(Instruction*);
+        void emit_op_tail_call_varargs(Instruction*);
+        void emit_op_tail_call_forward_arguments(Instruction*);
+        void emit_op_construct_varargs(Instruction*);
+        void emit_op_catch(Instruction*);
+        void emit_op_construct(Instruction*);
+        void emit_op_create_this(Instruction*);
+        void emit_op_to_this(Instruction*);
+        void emit_op_create_direct_arguments(Instruction*);
+        void emit_op_create_scoped_arguments(Instruction*);
+        void emit_op_create_cloned_arguments(Instruction*);
+        void emit_op_get_argument(Instruction*);
+        void emit_op_argument_count(Instruction*);
+        void emit_op_create_rest(Instruction*);
+        void emit_op_get_rest_length(Instruction*);
+        void emit_op_check_tdz(Instruction*);
+        void emit_op_assert(Instruction*);
+        void emit_op_debug(Instruction*);
+        void emit_op_del_by_id(Instruction*);
+        void emit_op_del_by_val(Instruction*);
+        void emit_op_div(Instruction*);
+        void emit_op_end(Instruction*);
+        void emit_op_enter(Instruction*);
+        void emit_op_get_scope(Instruction*);
+        void emit_op_eq(Instruction*);
+        void emit_op_eq_null(Instruction*);
+        void emit_op_try_get_by_id(Instruction*);
+        void emit_op_get_by_id(Instruction*);
+        void emit_op_get_by_id_with_this(Instruction*);
+        void emit_op_get_by_val_with_this(Instruction*);
+        void emit_op_get_arguments_length(Instruction*);
+        void emit_op_get_by_val(Instruction*);
+        void emit_op_get_argument_by_val(Instruction*);
+        void emit_op_init_lazy_reg(Instruction*);
+        void emit_op_overrides_has_instance(Instruction*);
+        void emit_op_instanceof(Instruction*);
+        void emit_op_instanceof_custom(Instruction*);
+        void emit_op_is_empty(Instruction*);
+        void emit_op_is_undefined(Instruction*);
+        void emit_op_is_boolean(Instruction*);
+        void emit_op_is_number(Instruction*);
+        void emit_op_is_object(Instruction*);
+        void emit_op_is_cell_with_type(Instruction*);
+        void emit_op_jeq_null(Instruction*);
+        void emit_op_jfalse(Instruction*);
+        void emit_op_jmp(Instruction*);
+        void emit_op_jneq_null(Instruction*);
+        void emit_op_jneq_ptr(Instruction*);
+        void emit_op_jless(Instruction*);
+        void emit_op_jlesseq(Instruction*);
+        void emit_op_jgreater(Instruction*);
+        void emit_op_jgreatereq(Instruction*);
+        void emit_op_jnless(Instruction*);
+        void emit_op_jnlesseq(Instruction*);
+        void emit_op_jngreater(Instruction*);
+        void emit_op_jngreatereq(Instruction*);
+        void emit_op_jtrue(Instruction*);
+        void emit_op_loop_hint(Instruction*);
+        void emit_op_watchdog(Instruction*);
+        void emit_op_lshift(Instruction*);
+        void emit_op_mod(Instruction*);
+        void emit_op_mov(Instruction*);
+        void emit_op_mul(Instruction*);
+        void emit_op_negate(Instruction*);
+        void emit_op_neq(Instruction*);
+        void emit_op_neq_null(Instruction*);
+        void emit_op_new_array(Instruction*);
+        void emit_op_new_array_with_size(Instruction*);
+        void emit_op_new_array_buffer(Instruction*);
+        void emit_op_new_array_with_spread(Instruction*);
+        void emit_op_spread(Instruction*);
+        void emit_op_new_func(Instruction*);
+        void emit_op_new_func_exp(Instruction*);
+        void emit_op_new_generator_func(Instruction*);
+        void emit_op_new_generator_func_exp(Instruction*);
+        void emit_op_new_async_func(Instruction*);
+        void emit_op_new_async_func_exp(Instruction*);
+        void emit_op_new_object(Instruction*);
+        void emit_op_new_regexp(Instruction*);
+        void emit_op_not(Instruction*);
+        void emit_op_nstricteq(Instruction*);
+        void emit_op_dec(Instruction*);
+        void emit_op_inc(Instruction*);
+        void emit_op_pow(Instruction*);
+        void emit_op_profile_type(Instruction*);
+        void emit_op_profile_control_flow(Instruction*);
+        void emit_op_push_with_scope(Instruction*);
+        void emit_op_create_lexical_environment(Instruction*);
+        void emit_op_get_parent_scope(Instruction*);
+        void emit_op_put_by_id(Instruction*);
+        void emit_op_put_by_id_with_this(Instruction*);
+        void emit_op_put_by_index(Instruction*);
+        void emit_op_put_by_val(Instruction*);
+        void emit_op_put_by_val_with_this(Instruction*);
+        void emit_op_put_getter_by_id(Instruction*);
+        void emit_op_put_setter_by_id(Instruction*);
+        void emit_op_put_getter_setter_by_id(Instruction*);
+        void emit_op_put_getter_by_val(Instruction*);
+        void emit_op_put_setter_by_val(Instruction*);
+        void emit_op_define_data_property(Instruction*);
+        void emit_op_define_accessor_property(Instruction*);
+        void emit_op_ret(Instruction*);
+        void emit_op_rshift(Instruction*);
+        void emit_op_set_function_name(Instruction*);
+        void emit_op_strcat(Instruction*);
+        void emit_op_stricteq(Instruction*);
+        void emit_op_sub(Instruction*);
+        void emit_op_switch_char(Instruction*);
+        void emit_op_switch_imm(Instruction*);
+        void emit_op_switch_string(Instruction*);
+        void emit_op_tear_off_arguments(Instruction*);
+        void emit_op_throw(Instruction*);
+        void emit_op_throw_static_error(Instruction*);
+        void emit_op_to_number(Instruction*);
+        void emit_op_to_string(Instruction*);
+        void emit_op_to_primitive(Instruction*);
+        void emit_op_unexpected_load(Instruction*);
+        void emit_op_unsigned(Instruction*);
+        void emit_op_urshift(Instruction*);
+        void emit_op_get_enumerable_length(Instruction*);
+        void emit_op_has_generic_property(Instruction*);
+        void emit_op_has_structure_property(Instruction*);
+        void emit_op_has_indexed_property(Instruction*);
+        void emit_op_get_direct_pname(Instruction*);
+        void emit_op_get_property_enumerator(Instruction*);
+        void emit_op_enumerator_structure_pname(Instruction*);
+        void emit_op_enumerator_generic_pname(Instruction*);
+        void emit_op_to_index_string(Instruction*);
+        void emit_op_log_shadow_chicken_prologue(Instruction*);
+        void emit_op_log_shadow_chicken_tail(Instruction*);
+
+        void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitxor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_tail_call(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_eval(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_tail_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_tail_call_forward_arguments(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_create_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_check_tdz(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_div(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_callee(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_try_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_arguments_length(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_argument_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_instanceof_custom(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jgreater(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jgreatereq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jngreater(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jngreatereq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_hint(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_watchdog(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_negate(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_neq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_new_object(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_not(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_nstricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_rshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_stricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_number(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_string(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_primitive(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_unsigned(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_urshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_has_indexed_property(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_has_structure_property(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_direct_pname(Instruction*, Vector<SlowCaseEntry>::iterator&);
+
+        void emit_op_resolve_scope(Instruction*);
+        void emit_op_get_from_scope(Instruction*);
+        void emit_op_put_to_scope(Instruction*);
+        void emit_op_get_from_arguments(Instruction*);
+        void emit_op_put_to_arguments(Instruction*);
+        void emitSlow_op_resolve_scope(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_from_scope(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_to_scope(Instruction*, Vector<SlowCaseEntry>::iterator&);
+
+        void emitRightShift(Instruction*, bool isUnsigned);
+        void emitRightShiftSlowCase(Instruction*, Vector<SlowCaseEntry>::iterator&, bool isUnsigned);
+
+        void emitNewFuncCommon(Instruction*);
+        void emitNewFuncExprCommon(Instruction*);
+        void emitVarInjectionCheck(bool needsVarInjectionChecks);
+        void emitResolveClosure(int dst, int scope, bool needsVarInjectionChecks, unsigned depth);
+        void emitLoadWithStructureCheck(int scope, Structure** structureSlot);
+#if USE(JSVALUE64)
+        void emitGetVarFromPointer(JSValue* operand, GPRReg);
+        void emitGetVarFromIndirectPointer(JSValue** operand, GPRReg);
+#else
+        void emitGetVarFromIndirectPointer(JSValue** operand, GPRReg tag, GPRReg payload);
+        void emitGetVarFromPointer(JSValue* operand, GPRReg tag, GPRReg payload);
+#endif
+        void emitGetClosureVar(int scope, uintptr_t operand);
+        void emitNotifyWrite(WatchpointSet*);
+        void emitNotifyWrite(GPRReg pointerToSet);
+        void emitPutGlobalVariable(JSValue* operand, int value, WatchpointSet*);
+        void emitPutGlobalVariableIndirect(JSValue** addressOfOperand, int value, WatchpointSet**);
+        void emitPutClosureVar(int scope, uintptr_t operand, int value, WatchpointSet*);
+
+        void emitInitRegister(int dst);
+
+        void emitPutIntToCallFrameHeader(RegisterID from, int entry);
+
+        JSValue getConstantOperand(int src);
+        bool isOperandConstantInt(int src);
+        bool isOperandConstantChar(int src);
+
+        template <typename Generator, typename ProfiledFunction, typename NonProfiledFunction>
+        void emitMathICFast(JITUnaryMathIC<Generator>*, Instruction*, ProfiledFunction, NonProfiledFunction);
+        template <typename Generator, typename ProfiledFunction, typename NonProfiledFunction>
+        void emitMathICFast(JITBinaryMathIC<Generator>*, Instruction*, ProfiledFunction, NonProfiledFunction);
+
+        template <typename Generator, typename ProfiledRepatchFunction, typename ProfiledFunction, typename RepatchFunction>
+        void emitMathICSlow(JITBinaryMathIC<Generator>*, Instruction*, ProfiledRepatchFunction, ProfiledFunction, RepatchFunction);
+        template <typename Generator, typename ProfiledRepatchFunction, typename ProfiledFunction, typename RepatchFunction>
+        void emitMathICSlow(JITUnaryMathIC<Generator>*, Instruction*, ProfiledRepatchFunction, ProfiledFunction, RepatchFunction);
+
+        Jump getSlowCase(Vector<SlowCaseEntry>::iterator& iter)
+        {
+            return iter++->from;
+        }
+        void linkSlowCase(Vector<SlowCaseEntry>::iterator& iter)
+        {
+            if (iter->from.isSet())
+                iter->from.link(this);
+            ++iter;
+        }
+        void linkDummySlowCase(Vector<SlowCaseEntry>::iterator& iter)
+        {
+            ASSERT(!iter->from.isSet());
+            ++iter;
+        }
+        void linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator&, int virtualRegisterIndex);
+        void linkAllSlowCasesForBytecodeOffset(Vector<SlowCaseEntry>& slowCases,
+            Vector<SlowCaseEntry>::iterator&, unsigned bytecodeOffset);
+
+        MacroAssembler::Call appendCallWithExceptionCheck(const FunctionPtr&);
+#if OS(WINDOWS) && CPU(X86_64)
+        MacroAssembler::Call appendCallWithExceptionCheckAndSlowPathReturnType(const FunctionPtr&);
+#endif
+        MacroAssembler::Call appendCallWithCallFrameRollbackOnException(const FunctionPtr&);
+        MacroAssembler::Call appendCallWithExceptionCheckSetJSValueResult(const FunctionPtr&, int);
+        MacroAssembler::Call appendCallWithExceptionCheckSetJSValueResultWithProfile(const FunctionPtr&, int);
+        
+        enum WithProfileTag { WithProfile };
+        
+        MacroAssembler::Call callOperation(C_JITOperation_E);
+        MacroAssembler::Call callOperation(C_JITOperation_EO, GPRReg);
+        MacroAssembler::Call callOperation(C_JITOperation_EL, GPRReg);
+        MacroAssembler::Call callOperation(C_JITOperation_EL, TrustedImmPtr);
+        MacroAssembler::Call callOperation(C_JITOperation_ESt, Structure*);
+        MacroAssembler::Call callOperation(C_JITOperation_EZ, int32_t);
+        MacroAssembler::Call callOperation(Z_JITOperation_EJZZ, GPRReg, int32_t, int32_t);
+        MacroAssembler::Call callOperation(J_JITOperation_E, int);
+        MacroAssembler::Call callOperation(J_JITOperation_EAapJ, int, ArrayAllocationProfile*, GPRReg);
+        MacroAssembler::Call callOperation(J_JITOperation_EAapJcpZ, int, ArrayAllocationProfile*, GPRReg, int32_t);
+        MacroAssembler::Call callOperation(J_JITOperation_EAapJcpZ, int, ArrayAllocationProfile*, const JSValue*, int32_t);
+        MacroAssembler::Call callOperation(J_JITOperation_EC, int, JSCell*);
+        MacroAssembler::Call callOperation(V_JITOperation_EC, JSCell*);
+        MacroAssembler::Call callOperation(J_JITOperation_EJ, int, GPRReg);
+        MacroAssembler::Call callOperation(J_JITOperation_EJ, JSValueRegs, JSValueRegs);
+#if USE(JSVALUE64)
+        MacroAssembler::Call callOperation(J_JITOperation_ESsiJI, int, StructureStubInfo*, GPRReg, UniquedStringImpl*);
+        MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_ESsiJI, int, StructureStubInfo*, GPRReg, UniquedStringImpl*);
+#else
+        MacroAssembler::Call callOperation(J_JITOperation_ESsiJI, int, StructureStubInfo*, GPRReg, GPRReg, UniquedStringImpl*);
+        MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_ESsiJI, int, StructureStubInfo*, GPRReg, GPRReg, UniquedStringImpl*);
+#endif
+        MacroAssembler::Call callOperation(J_JITOperation_EJI, int, GPRReg, UniquedStringImpl*);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJ, int, GPRReg, GPRReg);
+        MacroAssembler::Call callOperation(J_JITOperation_EJArp, JSValueRegs, JSValueRegs, ArithProfile*);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJArp, JSValueRegs, JSValueRegs, JSValueRegs, ArithProfile*);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJ, JSValueRegs, JSValueRegs, JSValueRegs);
+        MacroAssembler::Call callOperation(J_JITOperation_EJMic, JSValueRegs, JSValueRegs, TrustedImmPtr);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJMic, JSValueRegs, JSValueRegs, JSValueRegs, TrustedImmPtr);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJAp, int, GPRReg, GPRReg, ArrayProfile*);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJBy, int, GPRReg, GPRReg, ByValInfo*);
+        MacroAssembler::Call callOperation(Z_JITOperation_EJOJ, GPRReg, GPRReg, GPRReg);
+        MacroAssembler::Call callOperation(C_JITOperation_EJsc, GPRReg);
+        MacroAssembler::Call callOperation(J_JITOperation_EJscC, int, GPRReg, JSCell*);
+        MacroAssembler::Call callOperation(J_JITOperation_EJscCJ, int, GPRReg, JSCell*, GPRReg);
+        MacroAssembler::Call callOperation(C_JITOperation_EJscZ, GPRReg, int32_t);
+        MacroAssembler::Call callOperation(C_JITOperation_EJscZ, int, GPRReg, int32_t);
+#if USE(JSVALUE64)
+        MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EJJ, int, GPRReg, GPRReg);
+#else
+        MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EJJ, int, GPRReg, GPRReg, GPRReg, GPRReg);
+#endif
+        MacroAssembler::Call callOperation(J_JITOperation_EP, int, void*);
+        MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_EPc, int, Instruction*);
+        MacroAssembler::Call callOperation(J_JITOperation_EPc, int, Instruction*);
+        MacroAssembler::Call callOperation(J_JITOperation_EZ, int, int32_t);
+        MacroAssembler::Call callOperation(J_JITOperation_EZZ, int, int32_t, int32_t);
+        MacroAssembler::Call callOperation(P_JITOperation_E);
+        MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, size_t);
+        MacroAssembler::Call callOperation(S_JITOperation_ECC, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID);
+        MacroAssembler::Call callOperation(S_JITOperation_EJI, GPRReg, UniquedStringImpl*);
+        MacroAssembler::Call callOperation(S_JITOperation_EJJ, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(S_JITOperation_EOJss, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(Sprt_JITOperation_EZ, int32_t);
+        MacroAssembler::Call callOperation(V_JITOperation_E);
+        MacroAssembler::Call callOperation(V_JITOperation_EC, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_ECC, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_ECIZC, RegisterID, UniquedStringImpl*, int32_t, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_ECIZCC, RegisterID, UniquedStringImpl*, int32_t, RegisterID, RegisterID);
+#if USE(JSVALUE64)
+        MacroAssembler::Call callOperation(V_JITOperation_ECJZC, RegisterID, RegisterID, int32_t, RegisterID);
+#else
+        MacroAssembler::Call callOperation(V_JITOperation_ECJZC, RegisterID, RegisterID, RegisterID, int32_t, RegisterID);
+#endif
+        MacroAssembler::Call callOperation(J_JITOperation_EE, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EZSymtabJ, int, SymbolTable*, RegisterID);
+        MacroAssembler::Call callOperation(J_JITOperation_EZSymtabJ, int, SymbolTable*, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EJ, RegisterID);
+        MacroAssembler::Call callOperationNoExceptionCheck(Z_JITOperation_E);
+#if USE(JSVALUE64)
+        MacroAssembler::Call callOperationNoExceptionCheck(V_JITOperation_EJ, RegisterID);
+#else
+        MacroAssembler::Call callOperationNoExceptionCheck(V_JITOperation_EJ, RegisterID, RegisterID);
+#endif
+#if USE(JSVALUE64)
+        MacroAssembler::Call callOperation(F_JITOperation_EFJZZ, RegisterID, RegisterID, int32_t, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_ESsiJJI, StructureStubInfo*, RegisterID, RegisterID, UniquedStringImpl*);
+        MacroAssembler::Call callOperation(V_JITOperation_ECIZJJ, RegisterID, UniquedStringImpl*, int32_t, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_ECJ, RegisterID, RegisterID);
+#else
+        MacroAssembler::Call callOperation(V_JITOperation_ESsiJJI, StructureStubInfo*, RegisterID, RegisterID, RegisterID, RegisterID, UniquedStringImpl*);
+        MacroAssembler::Call callOperation(V_JITOperation_ECJ, RegisterID, RegisterID, RegisterID);
+#endif
+        MacroAssembler::Call callOperation(V_JITOperation_EJJJ, RegisterID, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EJJJAp, RegisterID, RegisterID, RegisterID, ArrayProfile*);
+        MacroAssembler::Call callOperation(V_JITOperation_EJJJBy, RegisterID, RegisterID, RegisterID, ByValInfo*);
+        MacroAssembler::Call callOperation(V_JITOperation_EJZJ, RegisterID, int32_t, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EJZ, RegisterID, int32_t);
+        MacroAssembler::Call callOperation(V_JITOperation_EPc, Instruction*);
+        MacroAssembler::Call callOperation(V_JITOperation_EZ, int32_t);
+        MacroAssembler::Call callOperation(V_JITOperation_EZJ, int, GPRReg);
+        MacroAssembler::Call callOperationWithCallFrameRollbackOnException(J_JITOperation_E);
+        MacroAssembler::Call callOperationWithCallFrameRollbackOnException(V_JITOperation_ECb, CodeBlock*);
+        MacroAssembler::Call callOperationWithCallFrameRollbackOnException(Z_JITOperation_E);
+#if USE(JSVALUE32_64)
+        MacroAssembler::Call callOperation(F_JITOperation_EFJZZ, RegisterID, RegisterID, RegisterID, int32_t, RegisterID);
+        MacroAssembler::Call callOperation(Z_JITOperation_EJZZ, GPRReg, GPRReg, int32_t, int32_t);
+        MacroAssembler::Call callOperation(J_JITOperation_EAapJ, int, ArrayAllocationProfile*, GPRReg, GPRReg);
+        MacroAssembler::Call callOperation(J_JITOperation_EJ, int, GPRReg, GPRReg);
+        MacroAssembler::Call callOperation(J_JITOperation_EJI, int, GPRReg, GPRReg, UniquedStringImpl*);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJ, int, GPRReg, GPRReg, GPRReg, GPRReg);
+        MacroAssembler::Call callOperation(Z_JITOperation_EJOJ, GPRReg, GPRReg, GPRReg, GPRReg, GPRReg);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJAp, int, GPRReg, GPRReg, GPRReg, GPRReg, ArrayProfile*);
+        MacroAssembler::Call callOperation(J_JITOperation_EJJBy, int, GPRReg, GPRReg, GPRReg, GPRReg, ByValInfo*);
+        MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, GPRReg, size_t);
+        MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(S_JITOperation_EJI, GPRReg, GPRReg, UniquedStringImpl*);
+        MacroAssembler::Call callOperation(S_JITOperation_EJJ, RegisterID, RegisterID, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EZSymtabJ, int, SymbolTable*, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EJ, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EJJJ, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EJJJAp, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, ArrayProfile*);
+        MacroAssembler::Call callOperation(V_JITOperation_EJJJBy, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, ByValInfo*);
+        MacroAssembler::Call callOperation(V_JITOperation_EJZ, RegisterID, RegisterID, int32_t);
+        MacroAssembler::Call callOperation(V_JITOperation_EJZJ, RegisterID, RegisterID, int32_t, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(V_JITOperation_EZJ, int32_t, RegisterID, RegisterID);
+        MacroAssembler::Call callOperation(J_JITOperation_EJscCJ, int, GPRReg, JSCell*, GPRReg, GPRReg);
+#endif
+
+        template<typename SnippetGenerator>
+        void emitBitBinaryOpFastPath(Instruction* currentInstruction);
+
+        void emitRightShiftFastPath(Instruction* currentInstruction, OpcodeID);
+
+        Jump checkStructure(RegisterID reg, Structure* structure);
+
+        void updateTopCallFrame();
+
+        Call emitNakedCall(CodePtr function = CodePtr());
+        Call emitNakedTailCall(CodePtr function = CodePtr());
+
+        // Loads the character value of a single character string into dst.
+        void emitLoadCharacterString(RegisterID src, RegisterID dst, JumpList& failures);
+        
+#if ENABLE(DFG_JIT)
+        void emitEnterOptimizationCheck();
+#else
+        void emitEnterOptimizationCheck() { }
+#endif
+
+#ifndef NDEBUG
+        void printBytecodeOperandTypes(int src1, int src2);
+#endif
+
+#if ENABLE(SAMPLING_FLAGS)
+        void setSamplingFlag(int32_t);
+        void clearSamplingFlag(int32_t);
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+        void emitCount(AbstractSamplingCounter&, int32_t = 1);
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+        void sampleInstruction(Instruction*, bool = false);
+#endif
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+        void sampleCodeBlock(CodeBlock*);
+#else
+        void sampleCodeBlock(CodeBlock*) {}
+#endif
+
+#if ENABLE(DFG_JIT)
+        bool canBeOptimized() { return m_canBeOptimized; }
+        bool canBeOptimizedOrInlined() { return m_canBeOptimizedOrInlined; }
+        bool shouldEmitProfiling() { return m_shouldEmitProfiling; }
+#else
+        bool canBeOptimized() { return false; }
+        bool canBeOptimizedOrInlined() { return false; }
+        // Enables use of value profiler with tiered compilation turned off,
+        // in which case all code gets profiled.
+        bool shouldEmitProfiling() { return false; }
+#endif
+
+        static bool reportCompileTimes();
+        static bool computeCompileTimes();
+        
+        // If you need to check the value of an instruction multiple times and the instruction is
+        // part of a LLInt inline cache, then you want to use this. It will give you the value of
+        // the instruction at the start of JITing.
+        Instruction* copiedInstruction(Instruction*);
+
+        Interpreter* m_interpreter;
+        
+        RefCountedArray<Instruction> m_instructions;
+
+        Vector<CallRecord> m_calls;
+        Vector<Label> m_labels;
+        Vector<JITGetByIdGenerator> m_getByIds;
+        Vector<JITPutByIdGenerator> m_putByIds;
+        Vector<ByValCompilationInfo> m_byValCompilationInfo;
+        Vector<CallCompilationInfo> m_callCompilationInfo;
+        Vector<JumpTable> m_jmpTable;
+
+        unsigned m_bytecodeOffset;
+        Vector<SlowCaseEntry> m_slowCases;
+        Vector<SwitchRecord> m_switches;
+
+        JumpList m_exceptionChecks;
+        JumpList m_exceptionChecksWithCallFrameRollback;
+        Label m_exceptionHandler;
+
+        unsigned m_getByIdIndex;
+        unsigned m_putByIdIndex;
+        unsigned m_byValInstructionIndex;
+        unsigned m_callLinkInfoIndex;
+        
+        Label m_arityCheck;
+        std::unique_ptr<LinkBuffer> m_linkBuffer;
+
+        std::unique_ptr<JITDisassembler> m_disassembler;
+        RefPtr<Profiler::Compilation> m_compilation;
+        WeakRandom m_randomGenerator;
+        static CodeRef stringGetByValStubGenerator(VM*);
+
+        PCToCodeOriginMapBuilder m_pcToCodeOriginMapBuilder;
+
+        HashMap<Instruction*, void*> m_instructionToMathIC;
+        HashMap<Instruction*, MathICGenerationState> m_instructionToMathICGenerationState;
+
+        bool m_canBeOptimized;
+        bool m_canBeOptimizedOrInlined;
+        bool m_shouldEmitProfiling;
+        unsigned m_loopOSREntryBytecodeOffset { 0 };
+    } JIT_CLASS_ALIGNMENT;
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITAddGenerator.cpp b/jit/JITAddGenerator.cpp
new file mode 100644
index 0000000..627af27
--- /dev/null
+++ b/jit/JITAddGenerator.cpp
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITAddGenerator.h"
+
+#include "ArithProfile.h"
+#include "JITMathIC.h"
+#include "LinkBuffer.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+JITMathICInlineResult JITAddGenerator::generateInline(CCallHelpers& jit, MathICGenerationState& state, const ArithProfile* arithProfile)
+{
+    // We default to speculating int32.
+    ObservedType lhs = ObservedType().withInt32();
+    ObservedType rhs = ObservedType().withInt32();
+    if (arithProfile) {
+        lhs = arithProfile->lhsObservedType();
+        rhs = arithProfile->rhsObservedType();
+    }
+
+    if (lhs.isOnlyNonNumber() && rhs.isOnlyNonNumber())
+        return JITMathICInlineResult::DontGenerate;
+
+    if ((lhs.isOnlyInt32() || m_leftOperand.isConstInt32()) && (rhs.isOnlyInt32() || m_rightOperand.isConstInt32())) {
+        ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+        if (!m_leftOperand.isConstInt32())
+            state.slowPathJumps.append(jit.branchIfNotInt32(m_left));
+        if (!m_rightOperand.isConstInt32())
+            state.slowPathJumps.append(jit.branchIfNotInt32(m_right));
+
+        GPRReg scratch = m_scratchGPR;
+        if (m_leftOperand.isConstInt32() || m_rightOperand.isConstInt32()) {
+            JSValueRegs var = m_leftOperand.isConstInt32() ? m_right : m_left;
+            int32_t constValue = m_leftOperand.isConstInt32() ? m_leftOperand.asConstInt32() : m_rightOperand.asConstInt32();
+            if (var.payloadGPR() != m_result.payloadGPR())
+                scratch = m_result.payloadGPR();
+            state.slowPathJumps.append(jit.branchAdd32(CCallHelpers::Overflow, var.payloadGPR(), CCallHelpers::Imm32(constValue), scratch));
+        } else {
+            if (m_left.payloadGPR() != m_result.payloadGPR() && m_right.payloadGPR() != m_result.payloadGPR())
+                scratch = m_result.payloadGPR();
+            state.slowPathJumps.append(jit.branchAdd32(CCallHelpers::Overflow, m_right.payloadGPR(), m_left.payloadGPR(), scratch));
+        }
+        jit.boxInt32(scratch, m_result);
+        return JITMathICInlineResult::GeneratedFastPath;
+    }
+
+    return JITMathICInlineResult::GenerateFullSnippet;
+}
+
+bool JITAddGenerator::generateFastPath(CCallHelpers& jit, CCallHelpers::JumpList& endJumpList, CCallHelpers::JumpList& slowPathJumpList, const ArithProfile* arithProfile, bool shouldEmitProfiling)
+{
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_left.payloadGPR());
+    ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE32_64)
+    ASSERT(m_scratchGPR != m_left.tagGPR());
+    ASSERT(m_scratchGPR != m_right.tagGPR());
+    ASSERT(m_scratchFPR != InvalidFPRReg);
+#endif
+
+    ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+    
+    if (!m_leftOperand.mightBeNumber() || !m_rightOperand.mightBeNumber())
+        return false;
+
+    if (m_leftOperand.isConstInt32() || m_rightOperand.isConstInt32()) {
+        JSValueRegs var = m_leftOperand.isConstInt32() ? m_right : m_left;
+        SnippetOperand& varOpr = m_leftOperand.isConstInt32() ? m_rightOperand : m_leftOperand;
+        SnippetOperand& constOpr = m_leftOperand.isConstInt32() ? m_leftOperand : m_rightOperand;
+
+        // Try to do intVar + intConstant.
+        CCallHelpers::Jump notInt32 = jit.branchIfNotInt32(var);
+
+        GPRReg scratch = m_scratchGPR;
+        if (var.payloadGPR() != m_result.payloadGPR())
+            scratch = m_result.payloadGPR();
+        slowPathJumpList.append(jit.branchAdd32(CCallHelpers::Overflow, var.payloadGPR(), CCallHelpers::Imm32(constOpr.asConstInt32()), scratch));
+
+        jit.boxInt32(scratch, m_result);
+        endJumpList.append(jit.jump());
+
+        if (!jit.supportsFloatingPoint()) {
+            slowPathJumpList.append(notInt32);
+            return true;
+        }
+
+        // Try to do doubleVar + double(intConstant).
+        notInt32.link(&jit);
+        if (!varOpr.definitelyIsNumber())
+            slowPathJumpList.append(jit.branchIfNotNumber(var, m_scratchGPR));
+
+        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR, m_scratchFPR);
+
+        jit.move(CCallHelpers::Imm32(constOpr.asConstInt32()), m_scratchGPR);
+        jit.convertInt32ToDouble(m_scratchGPR, m_rightFPR);
+
+        // Fall thru to doubleVar + doubleVar.
+
+    } else {
+        ASSERT(!m_leftOperand.isConstInt32() && !m_rightOperand.isConstInt32());
+        CCallHelpers::Jump leftNotInt;
+        CCallHelpers::Jump rightNotInt;
+
+        // Try to do intVar + intVar.
+        leftNotInt = jit.branchIfNotInt32(m_left);
+        rightNotInt = jit.branchIfNotInt32(m_right);
+
+        GPRReg scratch = m_scratchGPR;
+        if (m_left.payloadGPR() != m_result.payloadGPR() && m_right.payloadGPR() != m_result.payloadGPR())
+            scratch = m_result.payloadGPR();
+        slowPathJumpList.append(jit.branchAdd32(CCallHelpers::Overflow, m_right.payloadGPR(), m_left.payloadGPR(), scratch));
+
+        jit.boxInt32(scratch, m_result);
+        endJumpList.append(jit.jump());
+
+
+        if (!jit.supportsFloatingPoint()) {
+            slowPathJumpList.append(leftNotInt);
+            slowPathJumpList.append(rightNotInt);
+            return true;
+        }
+
+        leftNotInt.link(&jit);
+        if (!m_leftOperand.definitelyIsNumber())
+            slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+        if (!m_rightOperand.definitelyIsNumber())
+            slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
+
+        jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
+        CCallHelpers::Jump rightWasInteger = jit.jump();
+
+        rightNotInt.link(&jit);
+        if (!m_rightOperand.definitelyIsNumber())
+            slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+        jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
+
+        rightIsDouble.link(&jit);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+
+        rightWasInteger.link(&jit);
+
+        // Fall thru to doubleVar + doubleVar.
+    }
+
+    // Do doubleVar + doubleVar.
+    jit.addDouble(m_rightFPR, m_leftFPR);
+    if (arithProfile && shouldEmitProfiling)
+        arithProfile->emitSetDouble(jit);
+
+    jit.boxDouble(m_leftFPR, m_result);
+
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITAddGenerator.h b/jit/JITAddGenerator.h
new file mode 100644
index 0000000..48e1b16
--- /dev/null
+++ b/jit/JITAddGenerator.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "JITMathICInlineResult.h"
+#include "JITOperations.h"
+#include "SnippetOperand.h"
+
+namespace JSC {
+
+struct MathICGenerationState;
+
+class JITAddGenerator {
+public:
+    JITAddGenerator() { }
+
+    JITAddGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right,
+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
+        : m_leftOperand(leftOperand)
+        , m_rightOperand(rightOperand)
+        , m_result(result)
+        , m_left(left)
+        , m_right(right)
+        , m_leftFPR(leftFPR)
+        , m_rightFPR(rightFPR)
+        , m_scratchGPR(scratchGPR)
+        , m_scratchFPR(scratchFPR)
+    {
+        ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+    }
+
+    JITMathICInlineResult generateInline(CCallHelpers&, MathICGenerationState&, const ArithProfile*);
+    bool generateFastPath(CCallHelpers&, CCallHelpers::JumpList& endJumpList, CCallHelpers::JumpList& slowPathJumpList, const ArithProfile*, bool shouldEmitProfiling);
+
+    static bool isLeftOperandValidConstant(SnippetOperand leftOperand) { return leftOperand.isPositiveConstInt32(); }
+    static bool isRightOperandValidConstant(SnippetOperand rightOperand) { return rightOperand.isPositiveConstInt32(); }
+
+private:
+    SnippetOperand m_leftOperand;
+    SnippetOperand m_rightOperand;
+    JSValueRegs m_result;
+    JSValueRegs m_left;
+    JSValueRegs m_right;
+    FPRReg m_leftFPR;
+    FPRReg m_rightFPR;
+    GPRReg m_scratchGPR;
+    FPRReg m_scratchFPR;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITArithmetic.cpp b/jit/JITArithmetic.cpp
new file mode 100644
index 0000000..58fdb10
--- /dev/null
+++ b/jit/JITArithmetic.cpp
@@ -0,0 +1,1030 @@
+/*
+ * Copyright (C) 2008, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+#include "JIT.h"
+
+#include "ArithProfile.h"
+#include "CodeBlock.h"
+#include "JITAddGenerator.h"
+#include "JITBitAndGenerator.h"
+#include "JITBitOrGenerator.h"
+#include "JITBitXorGenerator.h"
+#include "JITDivGenerator.h"
+#include "JITInlines.h"
+#include "JITLeftShiftGenerator.h"
+#include "JITMathIC.h"
+#include "JITMulGenerator.h"
+#include "JITNegGenerator.h"
+#include "JITOperations.h"
+#include "JITRightShiftGenerator.h"
+#include "JITSubGenerator.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "ResultType.h"
+#include "SlowPathCall.h"
+
+namespace JSC {
+
+void JIT::emit_op_jless(Instruction* currentInstruction)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJump(op_jless, op1, op2, target, LessThan);
+}
+
+void JIT::emit_op_jlesseq(Instruction* currentInstruction)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJump(op_jlesseq, op1, op2, target, LessThanOrEqual);
+}
+
+void JIT::emit_op_jgreater(Instruction* currentInstruction)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJump(op_jgreater, op1, op2, target, GreaterThan);
+}
+
+void JIT::emit_op_jgreatereq(Instruction* currentInstruction)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJump(op_jgreatereq, op1, op2, target, GreaterThanOrEqual);
+}
+
+void JIT::emit_op_jnless(Instruction* currentInstruction)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJump(op_jnless, op1, op2, target, GreaterThanOrEqual);
+}
+
+void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJump(op_jnlesseq, op1, op2, target, GreaterThan);
+}
+
+void JIT::emit_op_jngreater(Instruction* currentInstruction)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJump(op_jngreater, op1, op2, target, LessThanOrEqual);
+}
+
+void JIT::emit_op_jngreatereq(Instruction* currentInstruction)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJump(op_jngreatereq, op1, op2, target, LessThan);
+}
+
+void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJumpSlow(op1, op2, target, DoubleLessThan, operationCompareLess, false, iter);
+}
+
+void JIT::emitSlow_op_jlesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJumpSlow(op1, op2, target, DoubleLessThanOrEqual, operationCompareLessEq, false, iter);
+}
+
+void JIT::emitSlow_op_jgreater(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJumpSlow(op1, op2, target, DoubleGreaterThan, operationCompareGreater, false, iter);
+}
+
+void JIT::emitSlow_op_jgreatereq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJumpSlow(op1, op2, target, DoubleGreaterThanOrEqual, operationCompareGreaterEq, false, iter);
+}
+
+void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJumpSlow(op1, op2, target, DoubleGreaterThanOrEqualOrUnordered, operationCompareLess, true, iter);
+}
+
+void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJumpSlow(op1, op2, target, DoubleGreaterThanOrUnordered, operationCompareLessEq, true, iter);
+}
+
+void JIT::emitSlow_op_jngreater(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJumpSlow(op1, op2, target, DoubleLessThanOrEqualOrUnordered, operationCompareGreater, true, iter);
+}
+
+void JIT::emitSlow_op_jngreatereq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int op1 = currentInstruction[1].u.operand;
+    int op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emit_compareAndJumpSlow(op1, op2, target, DoubleLessThanOrUnordered, operationCompareGreaterEq, true, iter);
+}
+
+#if USE(JSVALUE64)
+
+void JIT::emit_op_unsigned(Instruction* currentInstruction)
+{
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    
+    emitGetVirtualRegister(op1, regT0);
+    emitJumpSlowCaseIfNotInt(regT0);
+    addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
+    emitTagInt(regT0, regT0);
+    emitPutVirtualRegister(result, regT0);
+}
+
+void JIT::emitSlow_op_unsigned(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_unsigned);
+    slowPathCall.call();
+}
+
+void JIT::emit_compareAndJump(OpcodeID, int op1, int op2, unsigned target, RelationalCondition condition)
+{
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantChar(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        addSlowCase(emitJumpIfNotJSCell(regT0));
+        JumpList failures;
+        emitLoadCharacterString(regT0, regT0, failures);
+        addSlowCase(failures);
+        addJump(branch32(commute(condition), regT0, Imm32(asString(getConstantOperand(op1))->tryGetValue()[0])), target);
+        return;
+    }
+    if (isOperandConstantChar(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        addSlowCase(emitJumpIfNotJSCell(regT0));
+        JumpList failures;
+        emitLoadCharacterString(regT0, regT0, failures);
+        addSlowCase(failures);
+        addJump(branch32(condition, regT0, Imm32(asString(getConstantOperand(op2))->tryGetValue()[0])), target);
+        return;
+    }
+    if (isOperandConstantInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotInt(regT0);
+        int32_t op2imm = getOperandConstantInt(op2);
+        addJump(branch32(condition, regT0, Imm32(op2imm)), target);
+    } else if (isOperandConstantInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotInt(regT1);
+        int32_t op1imm = getOperandConstantInt(op1);
+        addJump(branch32(commute(condition), regT1, Imm32(op1imm)), target);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotInt(regT0);
+        emitJumpSlowCaseIfNotInt(regT1);
+
+        addJump(branch32(condition, regT0, regT1), target);
+    }
+}
+
+void JIT::emit_compareAndJumpSlow(int op1, int op2, unsigned target, DoubleCondition condition, size_t (JIT_OPERATION *operation)(ExecState*, EncodedJSValue, EncodedJSValue), bool invert, Vector<SlowCaseEntry>::iterator& iter)
+{
+    COMPILE_ASSERT(OPCODE_LENGTH(op_jless) == OPCODE_LENGTH(op_jlesseq), OPCODE_LENGTH_op_jlesseq_equals_op_jless);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_jless) == OPCODE_LENGTH(op_jnless), OPCODE_LENGTH_op_jnless_equals_op_jless);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_jless) == OPCODE_LENGTH(op_jnlesseq), OPCODE_LENGTH_op_jnlesseq_equals_op_jless);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_jless) == OPCODE_LENGTH(op_jgreater), OPCODE_LENGTH_op_jgreater_equals_op_jless);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_jless) == OPCODE_LENGTH(op_jgreatereq), OPCODE_LENGTH_op_jgreatereq_equals_op_jless);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_jless) == OPCODE_LENGTH(op_jngreater), OPCODE_LENGTH_op_jngreater_equals_op_jless);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_jless) == OPCODE_LENGTH(op_jngreatereq), OPCODE_LENGTH_op_jngreatereq_equals_op_jless);
+    
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+    if (isOperandConstantChar(op1) || isOperandConstantChar(op2)) {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+
+        emitGetVirtualRegister(op1, argumentGPR0);
+        emitGetVirtualRegister(op2, argumentGPR1);
+        callOperation(operation, argumentGPR0, argumentGPR1);
+        emitJumpSlowToHot(branchTest32(invert ? Zero : NonZero, returnValueGPR), target);
+        return;
+    }
+
+    if (isOperandConstantInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+            Jump fail1 = emitJumpIfNotNumber(regT0);
+            add64(tagTypeNumberRegister, regT0);
+            move64ToDouble(regT0, fpRegT0);
+
+            int32_t op2imm = getConstantOperand(op2).asInt32();
+
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(condition, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jless));
+
+            fail1.link(this);
+        }
+
+        emitGetVirtualRegister(op2, regT1);
+        callOperation(operation, regT0, regT1);
+        emitJumpSlowToHot(branchTest32(invert ? Zero : NonZero, returnValueGPR), target);
+    } else if (isOperandConstantInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+            Jump fail1 = emitJumpIfNotNumber(regT1);
+            add64(tagTypeNumberRegister, regT1);
+            move64ToDouble(regT1, fpRegT1);
+
+            int32_t op1imm = getConstantOperand(op1).asInt32();
+
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(condition, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jless));
+
+            fail1.link(this);
+        }
+
+        emitGetVirtualRegister(op1, regT2);
+        callOperation(operation, regT2, regT1);
+        emitJumpSlowToHot(branchTest32(invert ? Zero : NonZero, returnValueGPR), target);
+    } else {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+            Jump fail1 = emitJumpIfNotNumber(regT0);
+            Jump fail2 = emitJumpIfNotNumber(regT1);
+            Jump fail3 = emitJumpIfInt(regT1);
+            add64(tagTypeNumberRegister, regT0);
+            add64(tagTypeNumberRegister, regT1);
+            move64ToDouble(regT0, fpRegT0);
+            move64ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(condition, fpRegT0, fpRegT1), target);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jless));
+
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+        }
+
+        linkSlowCase(iter);
+        callOperation(operation, regT0, regT1);
+        emitJumpSlowToHot(branchTest32(invert ? Zero : NonZero, returnValueGPR), target);
+    }
+}
+
+void JIT::emit_op_inc(Instruction* currentInstruction)
+{
+    int srcDst = currentInstruction[1].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    emitJumpSlowCaseIfNotInt(regT0);
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
+    emitTagInt(regT0, regT0);
+    emitPutVirtualRegister(srcDst);
+}
+
+void JIT::emitSlow_op_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_inc);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_dec(Instruction* currentInstruction)
+{
+    int srcDst = currentInstruction[1].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    emitJumpSlowCaseIfNotInt(regT0);
+    addSlowCase(branchSub32(Overflow, TrustedImm32(1), regT0));
+    emitTagInt(regT0, regT0);
+    emitPutVirtualRegister(srcDst);
+}
+
+void JIT::emitSlow_op_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_dec);
+    slowPathCall.call();
+}
+
+/* ------------------------------ BEGIN: OP_MOD ------------------------------ */
+
+#if CPU(X86) || CPU(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+
+    // Make sure registers are correct for x86 IDIV instructions.
+    ASSERT(regT0 == X86Registers::eax);
+    auto edx = X86Registers::edx;
+    auto ecx = X86Registers::ecx;
+    ASSERT(regT4 != edx);
+    ASSERT(regT4 != ecx);
+
+    emitGetVirtualRegisters(op1, regT4, op2, ecx);
+    emitJumpSlowCaseIfNotInt(regT4);
+    emitJumpSlowCaseIfNotInt(ecx);
+
+    move(regT4, regT0);
+    addSlowCase(branchTest32(Zero, ecx));
+    Jump denominatorNotNeg1 = branch32(NotEqual, ecx, TrustedImm32(-1));
+    addSlowCase(branch32(Equal, regT0, TrustedImm32(-2147483647-1)));
+    denominatorNotNeg1.link(this);
+    x86ConvertToDoubleWord32();
+    x86Div32(ecx);
+    Jump numeratorPositive = branch32(GreaterThanOrEqual, regT4, TrustedImm32(0));
+    addSlowCase(branchTest32(Zero, edx));
+    numeratorPositive.link(this);
+    emitTagInt(edx, regT0);
+    emitPutVirtualRegister(result);
+}
+
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mod);
+    slowPathCall.call();
+}
+
+#else // CPU(X86) || CPU(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mod);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    UNREACHABLE_FOR_PLATFORM();
+}
+
+#endif // CPU(X86) || CPU(X86_64)
+
+/* ------------------------------ END: OP_MOD ------------------------------ */
+
+#endif // USE(JSVALUE64)
+
+void JIT::emit_op_negate(Instruction* currentInstruction)
+{
+    ArithProfile* arithProfile = m_codeBlock->arithProfileForPC(currentInstruction);
+    JITNegIC* negateIC = m_codeBlock->addJITNegIC(arithProfile);
+    m_instructionToMathIC.add(currentInstruction, negateIC);
+    emitMathICFast(negateIC, currentInstruction, operationArithNegateProfiled, operationArithNegate);
+}
+
+void JIT::emitSlow_op_negate(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITNegIC* negIC = bitwise_cast<JITNegIC*>(m_instructionToMathIC.get(currentInstruction));
+    emitMathICSlow(negIC, currentInstruction, operationArithNegateProfiledOptimize, operationArithNegateProfiled, operationArithNegateOptimize);
+}
+
+template<typename SnippetGenerator>
+void JIT::emitBitBinaryOpFastPath(Instruction* currentInstruction)
+{
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+
+#if USE(JSVALUE64)
+    JSValueRegs leftRegs = JSValueRegs(regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT1);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT2;
+#else
+    JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT4;
+#endif
+
+    SnippetOperand leftOperand;
+    SnippetOperand rightOperand;
+
+    if (isOperandConstantInt(op1))
+        leftOperand.setConstInt32(getOperandConstantInt(op1));
+    else if (isOperandConstantInt(op2))
+        rightOperand.setConstInt32(getOperandConstantInt(op2));
+
+    RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
+
+    if (!leftOperand.isConst())
+        emitGetVirtualRegister(op1, leftRegs);
+    if (!rightOperand.isConst())
+        emitGetVirtualRegister(op2, rightRegs);
+
+    SnippetGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, scratchGPR);
+
+    gen.generateFastPath(*this);
+
+    ASSERT(gen.didEmitFastPath());
+    gen.endJumpList().link(this);
+    emitPutVirtualRegister(result, resultRegs);
+
+    addSlowCase(gen.slowPathJumpList());
+}
+
+void JIT::emit_op_bitand(Instruction* currentInstruction)
+{
+    emitBitBinaryOpFastPath<JITBitAndGenerator>(currentInstruction);
+}
+
+void JIT::emitSlow_op_bitand(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_bitand);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_bitor(Instruction* currentInstruction)
+{
+    emitBitBinaryOpFastPath<JITBitOrGenerator>(currentInstruction);
+}
+
+void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_bitor);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_bitxor(Instruction* currentInstruction)
+{
+    emitBitBinaryOpFastPath<JITBitXorGenerator>(currentInstruction);
+}
+
+void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_bitxor);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_lshift(Instruction* currentInstruction)
+{
+    emitBitBinaryOpFastPath<JITLeftShiftGenerator>(currentInstruction);
+}
+
+void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_lshift);
+    slowPathCall.call();
+}
+
+void JIT::emitRightShiftFastPath(Instruction* currentInstruction, OpcodeID opcodeID)
+{
+    ASSERT(opcodeID == op_rshift || opcodeID == op_urshift);
+
+    JITRightShiftGenerator::ShiftType snippetShiftType = opcodeID == op_rshift ?
+        JITRightShiftGenerator::SignedShift : JITRightShiftGenerator::UnsignedShift;
+
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+
+#if USE(JSVALUE64)
+    JSValueRegs leftRegs = JSValueRegs(regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT1);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT2;
+    FPRReg scratchFPR = InvalidFPRReg;
+#else
+    JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT4;
+    FPRReg scratchFPR = fpRegT2;
+#endif
+
+    SnippetOperand leftOperand;
+    SnippetOperand rightOperand;
+
+    if (isOperandConstantInt(op1))
+        leftOperand.setConstInt32(getOperandConstantInt(op1));
+    else if (isOperandConstantInt(op2))
+        rightOperand.setConstInt32(getOperandConstantInt(op2));
+
+    RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
+
+    if (!leftOperand.isConst())
+        emitGetVirtualRegister(op1, leftRegs);
+    if (!rightOperand.isConst())
+        emitGetVirtualRegister(op2, rightRegs);
+
+    JITRightShiftGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
+        fpRegT0, scratchGPR, scratchFPR, snippetShiftType);
+
+    gen.generateFastPath(*this);
+
+    ASSERT(gen.didEmitFastPath());
+    gen.endJumpList().link(this);
+    emitPutVirtualRegister(result, resultRegs);
+
+    addSlowCase(gen.slowPathJumpList());
+}
+
+void JIT::emit_op_rshift(Instruction* currentInstruction)
+{
+    emitRightShiftFastPath(currentInstruction, op_rshift);
+}
+
+void JIT::emitSlow_op_rshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_rshift);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_urshift(Instruction* currentInstruction)
+{
+    emitRightShiftFastPath(currentInstruction, op_urshift);
+}
+
+void JIT::emitSlow_op_urshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_urshift);
+    slowPathCall.call();
+}
+
+ALWAYS_INLINE static OperandTypes getOperandTypes(Instruction* instruction)
+{
+    return OperandTypes(ArithProfile::fromInt(instruction[4].u.operand).lhsResultType(), ArithProfile::fromInt(instruction[4].u.operand).rhsResultType());
+}
+
+void JIT::emit_op_add(Instruction* currentInstruction)
+{
+    ArithProfile* arithProfile = m_codeBlock->arithProfileForPC(currentInstruction);
+    JITAddIC* addIC = m_codeBlock->addJITAddIC(arithProfile);
+    m_instructionToMathIC.add(currentInstruction, addIC);
+    emitMathICFast(addIC, currentInstruction, operationValueAddProfiled, operationValueAdd);
+}
+
+void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITAddIC* addIC = bitwise_cast<JITAddIC*>(m_instructionToMathIC.get(currentInstruction));
+    emitMathICSlow(addIC, currentInstruction, operationValueAddProfiledOptimize, operationValueAddProfiled, operationValueAddOptimize);
+}
+
+template <typename Generator, typename ProfiledFunction, typename NonProfiledFunction>
+void JIT::emitMathICFast(JITUnaryMathIC<Generator>* mathIC, Instruction* currentInstruction, ProfiledFunction profiledFunction, NonProfiledFunction nonProfiledFunction)
+{
+    int result = currentInstruction[1].u.operand;
+    int operand = currentInstruction[2].u.operand;
+
+#if USE(JSVALUE64)
+    // ArithNegate benefits from using the same register as src and dst.
+    // Since regT1==argumentGPR1, using regT1 avoid shuffling register to call the slow path.
+    JSValueRegs srcRegs = JSValueRegs(regT1);
+    JSValueRegs resultRegs = JSValueRegs(regT1);
+    GPRReg scratchGPR = regT2;
+#else
+    JSValueRegs srcRegs = JSValueRegs(regT1, regT0);
+    JSValueRegs resultRegs = JSValueRegs(regT3, regT2);
+    GPRReg scratchGPR = regT4;
+#endif
+
+#if ENABLE(MATH_IC_STATS)
+    auto inlineStart = label();
+#endif
+
+    mathIC->m_generator = Generator(resultRegs, srcRegs, scratchGPR);
+
+    emitGetVirtualRegister(operand, srcRegs);
+
+    MathICGenerationState& mathICGenerationState = m_instructionToMathICGenerationState.add(currentInstruction, MathICGenerationState()).iterator->value;
+
+    bool generatedInlineCode = mathIC->generateInline(*this, mathICGenerationState);
+    if (!generatedInlineCode) {
+        ArithProfile* arithProfile = mathIC->arithProfile();
+        if (arithProfile && shouldEmitProfiling())
+            callOperation(profiledFunction, resultRegs, srcRegs, arithProfile);
+        else
+            callOperation(nonProfiledFunction, resultRegs, srcRegs);
+    } else
+        addSlowCase(mathICGenerationState.slowPathJumps);
+
+#if ENABLE(MATH_IC_STATS)
+    auto inlineEnd = label();
+    addLinkTask([=] (LinkBuffer& linkBuffer) {
+        size_t size = static_cast<char*>(linkBuffer.locationOf(inlineEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(inlineStart).executableAddress());
+        mathIC->m_generatedCodeSize += size;
+    });
+#endif
+
+    emitPutVirtualRegister(result, resultRegs);
+}
+
+template <typename Generator, typename ProfiledFunction, typename NonProfiledFunction>
+void JIT::emitMathICFast(JITBinaryMathIC<Generator>* mathIC, Instruction* currentInstruction, ProfiledFunction profiledFunction, NonProfiledFunction nonProfiledFunction)
+{
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+
+#if USE(JSVALUE64)
+    OperandTypes types = getOperandTypes(copiedInstruction(currentInstruction));
+    JSValueRegs leftRegs = JSValueRegs(regT1);
+    JSValueRegs rightRegs = JSValueRegs(regT2);
+    JSValueRegs resultRegs = JSValueRegs(regT0);
+    GPRReg scratchGPR = regT3;
+    FPRReg scratchFPR = fpRegT2;
+#else
+    OperandTypes types = getOperandTypes(currentInstruction);
+    JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT4;
+    FPRReg scratchFPR = fpRegT2;
+#endif
+
+    SnippetOperand leftOperand(types.first());
+    SnippetOperand rightOperand(types.second());
+
+    if (isOperandConstantInt(op1))
+        leftOperand.setConstInt32(getOperandConstantInt(op1));
+    else if (isOperandConstantInt(op2))
+        rightOperand.setConstInt32(getOperandConstantInt(op2));
+
+    RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
+
+    mathIC->m_generator = Generator(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs, fpRegT0, fpRegT1, scratchGPR, scratchFPR);
+    
+    ASSERT(!(Generator::isLeftOperandValidConstant(leftOperand) && Generator::isRightOperandValidConstant(rightOperand)));
+    
+    if (!Generator::isLeftOperandValidConstant(leftOperand))
+        emitGetVirtualRegister(op1, leftRegs);
+    if (!Generator::isRightOperandValidConstant(rightOperand))
+        emitGetVirtualRegister(op2, rightRegs);
+
+#if ENABLE(MATH_IC_STATS)
+    auto inlineStart = label();
+#endif
+
+    MathICGenerationState& mathICGenerationState = m_instructionToMathICGenerationState.add(currentInstruction, MathICGenerationState()).iterator->value;
+
+    bool generatedInlineCode = mathIC->generateInline(*this, mathICGenerationState);
+    if (!generatedInlineCode) {
+        if (leftOperand.isConst())
+            emitGetVirtualRegister(op1, leftRegs);
+        else if (rightOperand.isConst())
+            emitGetVirtualRegister(op2, rightRegs);
+        ArithProfile* arithProfile = mathIC->arithProfile();
+        if (arithProfile && shouldEmitProfiling())
+            callOperation(profiledFunction, resultRegs, leftRegs, rightRegs, arithProfile);
+        else
+            callOperation(nonProfiledFunction, resultRegs, leftRegs, rightRegs);
+    } else
+        addSlowCase(mathICGenerationState.slowPathJumps);
+
+#if ENABLE(MATH_IC_STATS)
+    auto inlineEnd = label();
+    addLinkTask([=] (LinkBuffer& linkBuffer) {
+        size_t size = static_cast<char*>(linkBuffer.locationOf(inlineEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(inlineStart).executableAddress());
+        mathIC->m_generatedCodeSize += size;
+    });
+#endif
+
+    emitPutVirtualRegister(result, resultRegs);
+}
+
+template <typename Generator, typename ProfiledRepatchFunction, typename ProfiledFunction, typename RepatchFunction>
+void JIT::emitMathICSlow(JITUnaryMathIC<Generator>* mathIC, Instruction* currentInstruction, ProfiledRepatchFunction profiledRepatchFunction, ProfiledFunction profiledFunction, RepatchFunction repatchFunction)
+{
+    MathICGenerationState& mathICGenerationState = m_instructionToMathICGenerationState.find(currentInstruction)->value;
+    mathICGenerationState.slowPathStart = label();
+
+    int result = currentInstruction[1].u.operand;
+
+#if USE(JSVALUE64)
+    JSValueRegs srcRegs = JSValueRegs(regT1);
+    JSValueRegs resultRegs = JSValueRegs(regT0);
+#else
+    JSValueRegs srcRegs = JSValueRegs(regT1, regT0);
+    JSValueRegs resultRegs = JSValueRegs(regT3, regT2);
+#endif
+
+#if ENABLE(MATH_IC_STATS)
+    auto slowPathStart = label();
+#endif
+
+    ArithProfile* arithProfile = mathIC->arithProfile();
+    if (arithProfile && shouldEmitProfiling()) {
+        if (mathICGenerationState.shouldSlowPathRepatch)
+            mathICGenerationState.slowPathCall = callOperation(reinterpret_cast<J_JITOperation_EJMic>(profiledRepatchFunction), resultRegs, srcRegs, TrustedImmPtr(mathIC));
+        else
+            mathICGenerationState.slowPathCall = callOperation(profiledFunction, resultRegs, srcRegs, arithProfile);
+    } else
+        mathICGenerationState.slowPathCall = callOperation(reinterpret_cast<J_JITOperation_EJMic>(repatchFunction), resultRegs, srcRegs, TrustedImmPtr(mathIC));
+
+#if ENABLE(MATH_IC_STATS)
+    auto slowPathEnd = label();
+    addLinkTask([=] (LinkBuffer& linkBuffer) {
+        size_t size = static_cast<char*>(linkBuffer.locationOf(slowPathEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(slowPathStart).executableAddress());
+        mathIC->m_generatedCodeSize += size;
+    });
+#endif
+
+    emitPutVirtualRegister(result, resultRegs);
+
+    addLinkTask([=] (LinkBuffer& linkBuffer) {
+        MathICGenerationState& mathICGenerationState = m_instructionToMathICGenerationState.find(currentInstruction)->value;
+        mathIC->finalizeInlineCode(mathICGenerationState, linkBuffer);
+    });
+}
+
+template <typename Generator, typename ProfiledRepatchFunction, typename ProfiledFunction, typename RepatchFunction>
+void JIT::emitMathICSlow(JITBinaryMathIC<Generator>* mathIC, Instruction* currentInstruction, ProfiledRepatchFunction profiledRepatchFunction, ProfiledFunction profiledFunction, RepatchFunction repatchFunction)
+{
+    MathICGenerationState& mathICGenerationState = m_instructionToMathICGenerationState.find(currentInstruction)->value;
+    mathICGenerationState.slowPathStart = label();
+
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+
+#if USE(JSVALUE64)
+    OperandTypes types = getOperandTypes(copiedInstruction(currentInstruction));
+    JSValueRegs leftRegs = JSValueRegs(regT1);
+    JSValueRegs rightRegs = JSValueRegs(regT2);
+    JSValueRegs resultRegs = JSValueRegs(regT0);
+#else
+    OperandTypes types = getOperandTypes(currentInstruction);
+    JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
+    JSValueRegs resultRegs = leftRegs;
+#endif
+    
+    SnippetOperand leftOperand(types.first());
+    SnippetOperand rightOperand(types.second());
+
+    if (isOperandConstantInt(op1))
+        leftOperand.setConstInt32(getOperandConstantInt(op1));
+    else if (isOperandConstantInt(op2))
+        rightOperand.setConstInt32(getOperandConstantInt(op2));
+
+    ASSERT(!(Generator::isLeftOperandValidConstant(leftOperand) && Generator::isRightOperandValidConstant(rightOperand)));
+
+    if (Generator::isLeftOperandValidConstant(leftOperand))
+        emitGetVirtualRegister(op1, leftRegs);
+    else if (Generator::isRightOperandValidConstant(rightOperand))
+        emitGetVirtualRegister(op2, rightRegs);
+
+#if ENABLE(MATH_IC_STATS)
+    auto slowPathStart = label();
+#endif
+
+    ArithProfile* arithProfile = mathIC->arithProfile();
+    if (arithProfile && shouldEmitProfiling()) {
+        if (mathICGenerationState.shouldSlowPathRepatch)
+            mathICGenerationState.slowPathCall = callOperation(bitwise_cast<J_JITOperation_EJJMic>(profiledRepatchFunction), resultRegs, leftRegs, rightRegs, TrustedImmPtr(mathIC));
+        else
+            mathICGenerationState.slowPathCall = callOperation(profiledFunction, resultRegs, leftRegs, rightRegs, arithProfile);
+    } else
+        mathICGenerationState.slowPathCall = callOperation(bitwise_cast<J_JITOperation_EJJMic>(repatchFunction), resultRegs, leftRegs, rightRegs, TrustedImmPtr(mathIC));
+
+#if ENABLE(MATH_IC_STATS)
+    auto slowPathEnd = label();
+    addLinkTask([=] (LinkBuffer& linkBuffer) {
+        size_t size = static_cast<char*>(linkBuffer.locationOf(slowPathEnd).executableAddress()) - static_cast<char*>(linkBuffer.locationOf(slowPathStart).executableAddress());
+        mathIC->m_generatedCodeSize += size;
+    });
+#endif
+
+    emitPutVirtualRegister(result, resultRegs);
+
+    addLinkTask([=] (LinkBuffer& linkBuffer) {
+        MathICGenerationState& mathICGenerationState = m_instructionToMathICGenerationState.find(currentInstruction)->value;
+        mathIC->finalizeInlineCode(mathICGenerationState, linkBuffer);
+    });
+}
+
+void JIT::emit_op_div(Instruction* currentInstruction)
+{
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+
+#if USE(JSVALUE64)
+    OperandTypes types = getOperandTypes(copiedInstruction(currentInstruction));
+    JSValueRegs leftRegs = JSValueRegs(regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT1);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT2;
+#else
+    OperandTypes types = getOperandTypes(currentInstruction);
+    JSValueRegs leftRegs = JSValueRegs(regT1, regT0);
+    JSValueRegs rightRegs = JSValueRegs(regT3, regT2);
+    JSValueRegs resultRegs = leftRegs;
+    GPRReg scratchGPR = regT4;
+#endif
+    FPRReg scratchFPR = fpRegT2;
+
+    ArithProfile* arithProfile = nullptr;
+    if (shouldEmitProfiling())
+        arithProfile = m_codeBlock->arithProfileForPC(currentInstruction);
+
+    SnippetOperand leftOperand(types.first());
+    SnippetOperand rightOperand(types.second());
+
+    if (isOperandConstantInt(op1))
+        leftOperand.setConstInt32(getOperandConstantInt(op1));
+#if USE(JSVALUE64)
+    else if (isOperandConstantDouble(op1))
+        leftOperand.setConstDouble(getOperandConstantDouble(op1));
+#endif
+    else if (isOperandConstantInt(op2))
+        rightOperand.setConstInt32(getOperandConstantInt(op2));
+#if USE(JSVALUE64)
+    else if (isOperandConstantDouble(op2))
+        rightOperand.setConstDouble(getOperandConstantDouble(op2));
+#endif
+
+    RELEASE_ASSERT(!leftOperand.isConst() || !rightOperand.isConst());
+
+    if (!leftOperand.isConst())
+        emitGetVirtualRegister(op1, leftRegs);
+    if (!rightOperand.isConst())
+        emitGetVirtualRegister(op2, rightRegs);
+
+    JITDivGenerator gen(leftOperand, rightOperand, resultRegs, leftRegs, rightRegs,
+        fpRegT0, fpRegT1, scratchGPR, scratchFPR, arithProfile);
+
+    gen.generateFastPath(*this);
+
+    if (gen.didEmitFastPath()) {
+        gen.endJumpList().link(this);
+        emitPutVirtualRegister(result, resultRegs);
+
+        addSlowCase(gen.slowPathJumpList());
+    } else {
+        ASSERT(gen.endJumpList().empty());
+        ASSERT(gen.slowPathJumpList().empty());
+        JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_div);
+        slowPathCall.call();
+    }
+}
+
+void JIT::emitSlow_op_div(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_div);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    ArithProfile* arithProfile = m_codeBlock->arithProfileForPC(currentInstruction);
+    JITMulIC* mulIC = m_codeBlock->addJITMulIC(arithProfile);
+    m_instructionToMathIC.add(currentInstruction, mulIC);
+    emitMathICFast(mulIC, currentInstruction, operationValueMulProfiled, operationValueMul);
+}
+
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+
+    JITMulIC* mulIC = bitwise_cast<JITMulIC*>(m_instructionToMathIC.get(currentInstruction));
+    emitMathICSlow(mulIC, currentInstruction, operationValueMulProfiledOptimize, operationValueMulProfiled, operationValueMulOptimize);
+}
+
+void JIT::emit_op_sub(Instruction* currentInstruction)
+{
+    ArithProfile* arithProfile = m_codeBlock->arithProfileForPC(currentInstruction);
+    JITSubIC* subIC = m_codeBlock->addJITSubIC(arithProfile);
+    m_instructionToMathIC.add(currentInstruction, subIC);
+    emitMathICFast(subIC, currentInstruction, operationValueSubProfiled, operationValueSub);
+}
+
+void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkAllSlowCasesForBytecodeOffset(m_slowCases, iter, m_bytecodeOffset);
+    JITSubIC* subIC = bitwise_cast<JITSubIC*>(m_instructionToMathIC.get(currentInstruction));
+    emitMathICSlow(subIC, currentInstruction, operationValueSubProfiledOptimize, operationValueSubProfiled, operationValueSubOptimize);
+}
+
+void JIT::emit_op_pow(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_pow);
+    slowPathCall.call();
+}
+
+/* ------------------------------ END: OP_ADD, OP_SUB, OP_MUL, OP_POW ------------------------------ */
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITArithmetic32_64.cpp b/jit/JITArithmetic32_64.cpp
new file mode 100644
index 0000000..d271d48
--- /dev/null
+++ b/jit/JITArithmetic32_64.cpp
@@ -0,0 +1,374 @@
+/*
+* Copyright (C) 2008, 2015 Apple Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+* 1. Redistributions of source code must retain the above copyright
+*    notice, this list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright
+*    notice, this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+*
+* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+
+#if ENABLE(JIT)
+#if USE(JSVALUE32_64)
+#include "JIT.h"
+
+#include "CodeBlock.h"
+#include "JITInlines.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "ResultType.h"
+#include "SlowPathCall.h"
+
+
+namespace JSC {
+
+void JIT::emit_compareAndJump(OpcodeID opcode, int op1, int op2, unsigned target, RelationalCondition condition)
+{
+    JumpList notInt32Op1;
+    JumpList notInt32Op2;
+
+    // Character less.
+    if (isOperandConstantChar(op1)) {
+        emitLoad(op2, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
+        JumpList failures;
+        emitLoadCharacterString(regT0, regT0, failures);
+        addSlowCase(failures);
+        addJump(branch32(commute(condition), regT0, Imm32(asString(getConstantOperand(op1))->tryGetValue()[0])), target);
+        return;
+    }
+    if (isOperandConstantChar(op2)) {
+        emitLoad(op1, regT1, regT0);
+        addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
+        JumpList failures;
+        emitLoadCharacterString(regT0, regT0, failures);
+        addSlowCase(failures);
+        addJump(branch32(condition, regT0, Imm32(asString(getConstantOperand(op2))->tryGetValue()[0])), target);
+        return;
+    } 
+    if (isOperandConstantInt(op1)) {
+        emitLoad(op2, regT3, regT2);
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
+        addJump(branch32(commute(condition), regT2, Imm32(getConstantOperand(op1).asInt32())), target);
+    } else if (isOperandConstantInt(op2)) {
+        emitLoad(op1, regT1, regT0);
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        addJump(branch32(condition, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
+    } else {
+        emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
+        notInt32Op1.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        notInt32Op2.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
+        addJump(branch32(condition, regT0, regT2), target);
+    }
+
+    if (!supportsFloatingPoint()) {
+        addSlowCase(notInt32Op1);
+        addSlowCase(notInt32Op2);
+        return;
+    }
+    Jump end = jump();
+
+    // Double less.
+    emitBinaryDoubleOp(opcode, target, op1, op2, OperandTypes(), notInt32Op1, notInt32Op2, !isOperandConstantInt(op1), isOperandConstantInt(op1) || !isOperandConstantInt(op2));
+    end.link(this);
+}
+
+void JIT::emit_compareAndJumpSlow(int op1, int op2, unsigned target, DoubleCondition, size_t (JIT_OPERATION *operation)(ExecState*, EncodedJSValue, EncodedJSValue), bool invert, Vector<SlowCaseEntry>::iterator& iter)
+{
+    if (isOperandConstantChar(op1) || isOperandConstantChar(op2)) {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+    } else {
+        if (!supportsFloatingPoint()) {
+            if (!isOperandConstantInt(op1) && !isOperandConstantInt(op2))
+                linkSlowCase(iter); // int32 check
+            linkSlowCase(iter); // int32 check
+        } else {
+            if (!isOperandConstantInt(op1)) {
+                linkSlowCase(iter); // double check
+                linkSlowCase(iter); // int32 check
+            }
+            if (isOperandConstantInt(op1) || !isOperandConstantInt(op2))
+                linkSlowCase(iter); // double check
+        }
+    }
+    emitLoad(op1, regT1, regT0);
+    emitLoad(op2, regT3, regT2);
+    callOperation(operation, regT1, regT0, regT3, regT2);
+    emitJumpSlowToHot(branchTest32(invert ? Zero : NonZero, returnValueGPR), target);
+}
+
+void JIT::emit_op_unsigned(Instruction* currentInstruction)
+{
+    int result = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    
+    emitLoad(op1, regT1, regT0);
+    
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(LessThan, regT0, TrustedImm32(0)));
+    emitStoreInt32(result, regT0, result == op1);
+}
+
+void JIT::emitSlow_op_unsigned(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_unsigned);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_inc(Instruction* currentInstruction)
+{
+    int srcDst = currentInstruction[1].u.operand;
+
+    emitLoad(srcDst, regT1, regT0);
+
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branchAdd32(Overflow, TrustedImm32(1), regT0));
+    emitStoreInt32(srcDst, regT0, true);
+}
+
+void JIT::emitSlow_op_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // overflow check
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_inc);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_dec(Instruction* currentInstruction)
+{
+    int srcDst = currentInstruction[1].u.operand;
+
+    emitLoad(srcDst, regT1, regT0);
+
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branchSub32(Overflow, TrustedImm32(1), regT0));
+    emitStoreInt32(srcDst, regT0, true);
+}
+
+void JIT::emitSlow_op_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter); // int32 check
+    linkSlowCase(iter); // overflow check
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_dec);
+    slowPathCall.call();
+}
+
+void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, int dst, int op1, int op2, OperandTypes types, JumpList& notInt32Op1, JumpList& notInt32Op2, bool op1IsInRegisters, bool op2IsInRegisters)
+{
+    JumpList end;
+
+    if (!notInt32Op1.empty()) {
+        // Double case 1: Op1 is not int32; Op2 is unknown.
+        notInt32Op1.link(this);
+
+        ASSERT(op1IsInRegisters);
+
+        // Verify Op1 is double.
+        if (!types.first().definitelyIsNumber())
+            addSlowCase(branch32(Above, regT1, TrustedImm32(JSValue::LowestTag)));
+
+        if (!op2IsInRegisters)
+            emitLoad(op2, regT3, regT2);
+
+        Jump doubleOp2 = branch32(Below, regT3, TrustedImm32(JSValue::LowestTag));
+
+        if (!types.second().definitelyIsNumber())
+            addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
+
+        convertInt32ToDouble(regT2, fpRegT0);
+        Jump doTheMath = jump();
+
+        // Load Op2 as double into double register.
+        doubleOp2.link(this);
+        emitLoadDouble(op2, fpRegT0);
+
+        // Do the math.
+        doTheMath.link(this);
+        switch (opcodeID) {
+            case op_jless:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThan, fpRegT2, fpRegT0), dst);
+                break;
+            case op_jlesseq:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT2, fpRegT0), dst);
+                break;
+            case op_jgreater:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleGreaterThan, fpRegT2, fpRegT0), dst);
+                break;
+            case op_jgreatereq:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleGreaterThanOrEqual, fpRegT2, fpRegT0), dst);
+                break;
+            case op_jnless:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT0, fpRegT2), dst);
+                break;
+            case op_jnlesseq:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT0, fpRegT2), dst);
+                break;
+            case op_jngreater:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleGreaterThanOrEqualOrUnordered, fpRegT0, fpRegT2), dst);
+                break;
+            case op_jngreatereq:
+                emitLoadDouble(op1, fpRegT2);
+                addJump(branchDouble(DoubleGreaterThanOrUnordered, fpRegT0, fpRegT2), dst);
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        if (!notInt32Op2.empty())
+            end.append(jump());
+    }
+
+    if (!notInt32Op2.empty()) {
+        // Double case 2: Op1 is int32; Op2 is not int32.
+        notInt32Op2.link(this);
+
+        ASSERT(op2IsInRegisters);
+
+        if (!op1IsInRegisters)
+            emitLoadPayload(op1, regT0);
+
+        convertInt32ToDouble(regT0, fpRegT0);
+
+        // Verify op2 is double.
+        if (!types.second().definitelyIsNumber())
+            addSlowCase(branch32(Above, regT3, TrustedImm32(JSValue::LowestTag)));
+
+        // Do the math.
+        switch (opcodeID) {
+            case op_jless:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), dst);
+                break;
+            case op_jlesseq:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT1), dst);
+                break;
+            case op_jgreater:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleGreaterThan, fpRegT0, fpRegT1), dst);
+                break;
+            case op_jgreatereq:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleGreaterThanOrEqual, fpRegT0, fpRegT1), dst);
+                break;
+            case op_jnless:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), dst);
+                break;
+            case op_jnlesseq:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleLessThanOrUnordered, fpRegT1, fpRegT0), dst);
+                break;
+            case op_jngreater:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleGreaterThanOrEqualOrUnordered, fpRegT1, fpRegT0), dst);
+                break;
+            case op_jngreatereq:
+                emitLoadDouble(op2, fpRegT1);
+                addJump(branchDouble(DoubleGreaterThanOrUnordered, fpRegT1, fpRegT0), dst);
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    end.link(this);
+}
+
+// Mod (%)
+
+/* ------------------------------ BEGIN: OP_MOD ------------------------------ */
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+#if CPU(X86)
+    int dst = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+
+    // Make sure registers are correct for x86 IDIV instructions.
+    ASSERT(regT0 == X86Registers::eax);
+    ASSERT(regT1 == X86Registers::edx);
+    ASSERT(regT2 == X86Registers::ecx);
+    ASSERT(regT3 == X86Registers::ebx);
+
+    emitLoad2(op1, regT0, regT3, op2, regT1, regT2);
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+    addSlowCase(branch32(NotEqual, regT0, TrustedImm32(JSValue::Int32Tag)));
+
+    move(regT3, regT0);
+    addSlowCase(branchTest32(Zero, regT2));
+    Jump denominatorNotNeg1 = branch32(NotEqual, regT2, TrustedImm32(-1));
+    addSlowCase(branch32(Equal, regT0, TrustedImm32(-2147483647-1)));
+    denominatorNotNeg1.link(this);
+    x86ConvertToDoubleWord32();
+    x86Div32(regT2);
+    Jump numeratorPositive = branch32(GreaterThanOrEqual, regT3, TrustedImm32(0));
+    addSlowCase(branchTest32(Zero, regT1));
+    numeratorPositive.link(this);
+    emitStoreInt32(dst, regT1, (op1 == dst || op2 == dst));
+#else
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mod);
+    slowPathCall.call();
+#endif
+}
+
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+#if CPU(X86) || CPU(X86_64)
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_mod);
+    slowPathCall.call();
+#else
+    UNUSED_PARAM(currentInstruction);
+    UNUSED_PARAM(iter);
+    // We would have really useful assertions here if it wasn't for the compiler's
+    // insistence on attribute noreturn.
+    // RELEASE_ASSERT_NOT_REACHED();
+#endif
+}
+
+/* ------------------------------ END: OP_MOD ------------------------------ */
+
+} // namespace JSC
+
+#endif // USE(JSVALUE32_64)
+#endif // ENABLE(JIT)
diff --git a/jit/JITBitAndGenerator.cpp b/jit/JITBitAndGenerator.cpp
new file mode 100644
index 0000000..715b503
--- /dev/null
+++ b/jit/JITBitAndGenerator.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITBitAndGenerator.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+void JITBitAndGenerator::generateFastPath(CCallHelpers& jit)
+{
+#if USE(JSVALUE64)
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_left.payloadGPR());
+    ASSERT(m_scratchGPR != m_right.payloadGPR());
+#else
+    UNUSED_PARAM(m_scratchGPR);
+#endif
+
+    ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+
+    m_didEmitFastPath = true;
+
+    if (m_leftOperand.isConstInt32() || m_rightOperand.isConstInt32()) {
+        JSValueRegs var = m_leftOperand.isConstInt32() ? m_right : m_left;
+        SnippetOperand& constOpr = m_leftOperand.isConstInt32() ? m_leftOperand : m_rightOperand;
+        
+        // Try to do intVar & intConstant.
+        m_slowPathJumpList.append(jit.branchIfNotInt32(var));
+        
+        jit.moveValueRegs(var, m_result);
+        if (constOpr.asConstInt32() != static_cast<int32_t>(0xffffffff)) {
+#if USE(JSVALUE64)
+            jit.and64(CCallHelpers::Imm32(constOpr.asConstInt32()), m_result.payloadGPR());
+            if (constOpr.asConstInt32() >= 0)
+                jit.or64(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR());
+#else
+            jit.and32(CCallHelpers::Imm32(constOpr.asConstInt32()), m_result.payloadGPR());
+#endif
+        }
+
+    } else {
+        ASSERT(!m_leftOperand.isConstInt32() && !m_rightOperand.isConstInt32());
+        
+        // Try to do intVar & intVar.
+#if USE(JSVALUE64)
+        jit.move(m_left.payloadGPR(), m_scratchGPR);
+        jit.and64(m_right.payloadGPR(), m_scratchGPR);
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_scratchGPR));
+        jit.move(m_scratchGPR, m_result.payloadGPR());
+#else
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_left));
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_right));
+        jit.moveValueRegs(m_left, m_result);
+        jit.and32(m_right.payloadGPR(), m_result.payloadGPR());
+#endif
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITBitAndGenerator.h b/jit/JITBitAndGenerator.h
new file mode 100644
index 0000000..7536e86
--- /dev/null
+++ b/jit/JITBitAndGenerator.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JITBitBinaryOpGenerator.h"
+
+namespace JSC {
+
+class JITBitAndGenerator : public JITBitBinaryOpGenerator {
+public:
+    JITBitAndGenerator(const SnippetOperand& leftOperand, const SnippetOperand& rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right, GPRReg scratchGPR)
+        : JITBitBinaryOpGenerator(leftOperand, rightOperand, result, left, right, scratchGPR)
+    { }
+
+    void generateFastPath(CCallHelpers&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITBitBinaryOpGenerator.h b/jit/JITBitBinaryOpGenerator.h
new file mode 100644
index 0000000..128ae18
--- /dev/null
+++ b/jit/JITBitBinaryOpGenerator.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "SnippetOperand.h"
+
+namespace JSC {
+
+class JITBitBinaryOpGenerator {
+public:
+    JITBitBinaryOpGenerator(const SnippetOperand& leftOperand, const SnippetOperand& rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right, GPRReg scratchGPR)
+        : m_leftOperand(leftOperand)
+        , m_rightOperand(rightOperand)
+        , m_result(result)
+        , m_left(left)
+        , m_right(right)
+        , m_scratchGPR(scratchGPR)
+    {
+        ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+    }
+
+    bool didEmitFastPath() const { return m_didEmitFastPath; }
+    CCallHelpers::JumpList& endJumpList() { return m_endJumpList; }
+    CCallHelpers::JumpList& slowPathJumpList() { return m_slowPathJumpList; }
+
+protected:
+    SnippetOperand m_leftOperand;
+    SnippetOperand m_rightOperand;
+    JSValueRegs m_result;
+    JSValueRegs m_left;
+    JSValueRegs m_right;
+    GPRReg m_scratchGPR;
+    bool m_didEmitFastPath { false };
+
+    CCallHelpers::JumpList m_endJumpList;
+    CCallHelpers::JumpList m_slowPathJumpList;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITBitOrGenerator.cpp b/jit/JITBitOrGenerator.cpp
new file mode 100644
index 0000000..9f843c1
--- /dev/null
+++ b/jit/JITBitOrGenerator.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITBitOrGenerator.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+void JITBitOrGenerator::generateFastPath(CCallHelpers& jit)
+{
+    ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+    
+    m_didEmitFastPath = true;
+    
+    if (m_leftOperand.isConstInt32() || m_rightOperand.isConstInt32()) {
+        JSValueRegs var = m_leftOperand.isConstInt32() ? m_right : m_left;
+        SnippetOperand& constOpr = m_leftOperand.isConstInt32() ? m_leftOperand : m_rightOperand;
+        
+        // Try to do intVar | intConstant.
+        m_slowPathJumpList.append(jit.branchIfNotInt32(var));
+        
+        jit.moveValueRegs(var, m_result);
+        if (constOpr.asConstInt32()) {
+#if USE(JSVALUE64)
+            jit.or32(CCallHelpers::Imm32(constOpr.asConstInt32()), m_result.payloadGPR());
+            jit.or64(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR());
+#else
+            jit.or32(CCallHelpers::Imm32(constOpr.asConstInt32()), m_result.payloadGPR());
+#endif
+        }
+
+    } else {
+        ASSERT(!m_leftOperand.isConstInt32() && !m_rightOperand.isConstInt32());
+        
+        // Try to do intVar | intVar.
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_left));
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_right));
+
+        jit.moveValueRegs(m_left, m_result);
+#if USE(JSVALUE64)
+        jit.or64(m_right.payloadGPR(), m_result.payloadGPR());
+#else
+        jit.or32(m_right.payloadGPR(), m_result.payloadGPR());
+#endif
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITBitOrGenerator.h b/jit/JITBitOrGenerator.h
new file mode 100644
index 0000000..1f1d91a
--- /dev/null
+++ b/jit/JITBitOrGenerator.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JITBitBinaryOpGenerator.h"
+
+namespace JSC {
+
+class JITBitOrGenerator : public JITBitBinaryOpGenerator {
+public:
+    JITBitOrGenerator(const SnippetOperand& leftOperand, const SnippetOperand& rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right, GPRReg unused = InvalidGPRReg)
+        : JITBitBinaryOpGenerator(leftOperand, rightOperand, result, left, right, unused)
+    { }
+
+    void generateFastPath(CCallHelpers&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITBitXorGenerator.cpp b/jit/JITBitXorGenerator.cpp
new file mode 100644
index 0000000..8ccf1b5
--- /dev/null
+++ b/jit/JITBitXorGenerator.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITBitXorGenerator.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+void JITBitXorGenerator::generateFastPath(CCallHelpers& jit)
+{
+    ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+    
+    m_didEmitFastPath = true;
+    
+    if (m_leftOperand.isConstInt32() || m_rightOperand.isConstInt32()) {
+        JSValueRegs var = m_leftOperand.isConstInt32() ? m_right : m_left;
+        SnippetOperand& constOpr = m_leftOperand.isConstInt32() ? m_leftOperand : m_rightOperand;
+        
+        // Try to do intVar ^ intConstant.
+        m_slowPathJumpList.append(jit.branchIfNotInt32(var));
+        
+        jit.moveValueRegs(var, m_result);
+#if USE(JSVALUE64)
+        jit.xor32(CCallHelpers::Imm32(constOpr.asConstInt32()), m_result.payloadGPR());
+        jit.or64(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR());
+#else
+        jit.xor32(CCallHelpers::Imm32(constOpr.asConstInt32()), m_result.payloadGPR());
+#endif
+        
+    } else {
+        ASSERT(!m_leftOperand.isConstInt32() && !m_rightOperand.isConstInt32());
+        
+        // Try to do intVar ^ intVar.
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_left));
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_right));
+        
+        jit.moveValueRegs(m_left, m_result);
+#if USE(JSVALUE64)
+        jit.xor64(m_right.payloadGPR(), m_result.payloadGPR());
+        jit.or64(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR());
+#else
+        jit.xor32(m_right.payloadGPR(), m_result.payloadGPR());
+#endif
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITBitXorGenerator.h b/jit/JITBitXorGenerator.h
new file mode 100644
index 0000000..e5b5fb2
--- /dev/null
+++ b/jit/JITBitXorGenerator.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JITBitBinaryOpGenerator.h"
+
+namespace JSC {
+
+class JITBitXorGenerator : public JITBitBinaryOpGenerator {
+public:
+    JITBitXorGenerator(const SnippetOperand& leftOperand, const SnippetOperand& rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right, GPRReg unused = InvalidGPRReg)
+        : JITBitBinaryOpGenerator(leftOperand, rightOperand, result, left, right, unused)
+    { }
+
+    void generateFastPath(CCallHelpers&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITCall.cpp b/jit/JITCall.cpp
new file mode 100644
index 0000000..ff1cc61
--- /dev/null
+++ b/jit/JITCall.cpp
@@ -0,0 +1,350 @@
+/*
+ * Copyright (C) 2008, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+#if USE(JSVALUE64)
+#include "JIT.h"
+
+#include "CallFrameShuffler.h"
+#include "CodeBlock.h"
+#include "JITInlines.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "ResultType.h"
+#include "SetupVarargsFrame.h"
+#include "StackAlignment.h"
+#include "ThunkGenerators.h"
+#include <wtf/StringPrintStream.h>
+
+
+namespace JSC {
+
+void JIT::emitPutCallResult(Instruction* instruction)
+{
+    int dst = instruction[1].u.operand;
+    emitValueProfilingSite();
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::compileSetupVarargsFrame(OpcodeID opcode, Instruction* instruction, CallLinkInfo* info)
+{
+    int thisValue = instruction[3].u.operand;
+    int arguments = instruction[4].u.operand;
+    int firstFreeRegister = instruction[5].u.operand;
+    int firstVarArgOffset = instruction[6].u.operand;
+
+    emitGetVirtualRegister(arguments, regT1);
+    Z_JITOperation_EJZZ sizeOperation;
+    if (opcode == op_tail_call_forward_arguments)
+        sizeOperation = operationSizeFrameForForwardArguments;
+    else
+        sizeOperation = operationSizeFrameForVarargs;
+    callOperation(sizeOperation, regT1, -firstFreeRegister, firstVarArgOffset);
+    move(TrustedImm32(-firstFreeRegister), regT1);
+    emitSetVarargsFrame(*this, returnValueGPR, false, regT1, regT1);
+    addPtr(TrustedImm32(-(sizeof(CallerFrameAndPC) + WTF::roundUpToMultipleOf(stackAlignmentBytes(), 5 * sizeof(void*)))), regT1, stackPointerRegister);
+    emitGetVirtualRegister(arguments, regT2);
+    F_JITOperation_EFJZZ setupOperation;
+    if (opcode == op_tail_call_forward_arguments)
+        setupOperation = operationSetupForwardArgumentsFrame;
+    else
+        setupOperation = operationSetupVarargsFrame;
+    callOperation(setupOperation, regT1, regT2, firstVarArgOffset, regT0);
+    move(returnValueGPR, regT1);
+
+    // Profile the argument count.
+    load32(Address(regT1, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset), regT2);
+    load32(info->addressOfMaxNumArguments(), regT0);
+    Jump notBiggest = branch32(Above, regT0, regT2);
+    store32(regT2, info->addressOfMaxNumArguments());
+    notBiggest.link(this);
+    
+    // Initialize 'this'.
+    emitGetVirtualRegister(thisValue, regT0);
+    store64(regT0, Address(regT1, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))));
+
+    addPtr(TrustedImm32(sizeof(CallerFrameAndPC)), regT1, stackPointerRegister);
+}
+
+void JIT::compileCallEval(Instruction* instruction)
+{
+    addPtr(TrustedImm32(-static_cast<ptrdiff_t>(sizeof(CallerFrameAndPC))), stackPointerRegister, regT1);
+    storePtr(callFrameRegister, Address(regT1, CallFrame::callerFrameOffset()));
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    callOperation(operationCallEval, regT1);
+
+    addSlowCase(branch64(Equal, regT0, TrustedImm64(JSValue::encode(JSValue()))));
+
+    sampleCodeBlock(m_codeBlock);
+    
+    emitPutCallResult(instruction);
+}
+
+void JIT::compileCallEvalSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    CallLinkInfo* info = m_codeBlock->addCallLinkInfo();
+    info->setUpCall(CallLinkInfo::Call, CodeOrigin(m_bytecodeOffset), regT0);
+
+    linkSlowCase(iter);
+    int registerOffset = -instruction[4].u.operand;
+
+    addPtr(TrustedImm32(registerOffset * sizeof(Register) + sizeof(CallerFrameAndPC)), callFrameRegister, stackPointerRegister);
+
+    load64(Address(stackPointerRegister, sizeof(Register) * CallFrameSlot::callee - sizeof(CallerFrameAndPC)), regT0);
+    emitDumbVirtualCall(info);
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    sampleCodeBlock(m_codeBlock);
+    
+    emitPutCallResult(instruction);
+}
+
+void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned callLinkInfoIndex)
+{
+    int callee = instruction[2].u.operand;
+
+    /* Caller always:
+        - Updates callFrameRegister to callee callFrame.
+        - Initializes ArgumentCount; CallerFrame; Callee.
+
+       For a JS call:
+        - Callee initializes ReturnPC; CodeBlock.
+        - Callee restores callFrameRegister before return.
+
+       For a non-JS call:
+        - Caller initializes ReturnPC; CodeBlock.
+        - Caller restores callFrameRegister after return.
+    */
+    COMPILE_ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_construct), call_and_construct_opcodes_must_be_same_length);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_call_varargs), call_and_call_varargs_opcodes_must_be_same_length);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_construct_varargs), call_and_construct_varargs_opcodes_must_be_same_length);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_tail_call), call_and_tail_call_opcodes_must_be_same_length);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_tail_call_varargs), call_and_tail_call_varargs_opcodes_must_be_same_length);
+    COMPILE_ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_tail_call_forward_arguments), call_and_tail_call_forward_arguments_opcodes_must_be_same_length);
+
+    CallLinkInfo* info = nullptr;
+    if (opcodeID != op_call_eval)
+        info = m_codeBlock->addCallLinkInfo();
+    if (opcodeID == op_call_varargs || opcodeID == op_construct_varargs || opcodeID == op_tail_call_varargs || opcodeID == op_tail_call_forward_arguments)
+        compileSetupVarargsFrame(opcodeID, instruction, info);
+    else {
+        int argCount = instruction[3].u.operand;
+        int registerOffset = -instruction[4].u.operand;
+
+        if (opcodeID == op_call && shouldEmitProfiling()) {
+            emitGetVirtualRegister(registerOffset + CallFrame::argumentOffsetIncludingThis(0), regT0);
+            Jump done = emitJumpIfNotJSCell(regT0);
+            load32(Address(regT0, JSCell::structureIDOffset()), regT0);
+            store32(regT0, instruction[OPCODE_LENGTH(op_call) - 2].u.arrayProfile->addressOfLastSeenStructureID());
+            done.link(this);
+        }
+    
+        addPtr(TrustedImm32(registerOffset * sizeof(Register) + sizeof(CallerFrameAndPC)), callFrameRegister, stackPointerRegister);
+        store32(TrustedImm32(argCount), Address(stackPointerRegister, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset - sizeof(CallerFrameAndPC)));
+    } // SP holds newCallFrame + sizeof(CallerFrameAndPC), with ArgumentCount initialized.
+    
+    uint32_t bytecodeOffset = instruction - m_codeBlock->instructions().begin();
+    uint32_t locationBits = CallSiteIndex(bytecodeOffset).bits();
+    store32(TrustedImm32(locationBits), Address(callFrameRegister, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + TagOffset));
+
+    emitGetVirtualRegister(callee, regT0); // regT0 holds callee.
+    store64(regT0, Address(stackPointerRegister, CallFrameSlot::callee * static_cast<int>(sizeof(Register)) - sizeof(CallerFrameAndPC)));
+
+    if (opcodeID == op_call_eval) {
+        compileCallEval(instruction);
+        return;
+    }
+
+    DataLabelPtr addressOfLinkedFunctionCheck;
+    Jump slowCase = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, TrustedImmPtr(0));
+    addSlowCase(slowCase);
+
+    ASSERT(m_callCompilationInfo.size() == callLinkInfoIndex);
+    info->setUpCall(CallLinkInfo::callTypeFor(opcodeID), CodeOrigin(m_bytecodeOffset), regT0);
+    m_callCompilationInfo.append(CallCompilationInfo());
+    m_callCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
+    m_callCompilationInfo[callLinkInfoIndex].callLinkInfo = info;
+
+    if (opcodeID == op_tail_call) {
+        CallFrameShuffleData shuffleData;
+        shuffleData.numPassedArgs = instruction[3].u.operand;
+        shuffleData.tagTypeNumber = GPRInfo::tagTypeNumberRegister;
+        shuffleData.numLocals =
+            instruction[4].u.operand - sizeof(CallerFrameAndPC) / sizeof(Register);
+        shuffleData.args.resize(instruction[3].u.operand);
+        for (int i = 0; i < instruction[3].u.operand; ++i) {
+            shuffleData.args[i] =
+                ValueRecovery::displacedInJSStack(
+                    virtualRegisterForArgument(i) - instruction[4].u.operand,
+                    DataFormatJS);
+        }
+        shuffleData.callee =
+            ValueRecovery::inGPR(regT0, DataFormatJS);
+        shuffleData.setupCalleeSaveRegisters(m_codeBlock);
+        info->setFrameShuffleData(shuffleData);
+        CallFrameShuffler(*this, shuffleData).prepareForTailCall();
+        m_callCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedTailCall();
+        return;
+    }
+
+    if (opcodeID == op_tail_call_varargs || opcodeID == op_tail_call_forward_arguments) {
+        emitRestoreCalleeSaves();
+        prepareForTailCallSlow();
+        m_callCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedTailCall();
+        return;
+    }
+
+    m_callCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    sampleCodeBlock(m_codeBlock);
+    
+    emitPutCallResult(instruction);
+}
+
+void JIT::compileOpCallSlowCase(OpcodeID opcodeID, Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex)
+{
+    if (opcodeID == op_call_eval) {
+        compileCallEvalSlowCase(instruction, iter);
+        return;
+    }
+
+    linkSlowCase(iter);
+
+    if (opcodeID == op_tail_call || opcodeID == op_tail_call_varargs || opcodeID == op_tail_call_forward_arguments)
+        emitRestoreCalleeSaves();
+
+    move(TrustedImmPtr(m_callCompilationInfo[callLinkInfoIndex].callLinkInfo), regT2);
+
+    m_callCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_vm->getCTIStub(linkCallThunkGenerator).code());
+
+    if (opcodeID == op_tail_call || opcodeID == op_tail_call_varargs) {
+        abortWithReason(JITDidReturnFromTailCall);
+        return;
+    }
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    sampleCodeBlock(m_codeBlock);
+    
+    emitPutCallResult(instruction);
+}
+
+void JIT::emit_op_call(Instruction* currentInstruction)
+{
+    compileOpCall(op_call, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_tail_call(Instruction* currentInstruction)
+{
+    compileOpCall(op_tail_call, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_call_eval(Instruction* currentInstruction)
+{
+    compileOpCall(op_call_eval, currentInstruction, m_callLinkInfoIndex);
+}
+
+void JIT::emit_op_call_varargs(Instruction* currentInstruction)
+{
+    compileOpCall(op_call_varargs, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_tail_call_varargs(Instruction* currentInstruction)
+{
+    compileOpCall(op_tail_call_varargs, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_tail_call_forward_arguments(Instruction* currentInstruction)
+{
+    compileOpCall(op_tail_call_forward_arguments, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_construct_varargs(Instruction* currentInstruction)
+{
+    compileOpCall(op_construct_varargs, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_construct(Instruction* currentInstruction)
+{
+    compileOpCall(op_construct, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_call, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_tail_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_tail_call, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_call_eval(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_call_eval, currentInstruction, iter, m_callLinkInfoIndex);
+}
+ 
+void JIT::emitSlow_op_call_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_call_varargs, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_tail_call_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_tail_call_varargs, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_tail_call_forward_arguments(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_tail_call_forward_arguments, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+    
+void JIT::emitSlow_op_construct_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_construct_varargs, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+    
+void JIT::emitSlow_op_construct(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_construct, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+} // namespace JSC
+
+#endif // USE(JSVALUE64)
+#endif // ENABLE(JIT)
diff --git a/jit/JITCall32_64.cpp b/jit/JITCall32_64.cpp
new file mode 100644
index 0000000..573b062
--- /dev/null
+++ b/jit/JITCall32_64.cpp
@@ -0,0 +1,342 @@
+/*
+ * Copyright (C) 2008, 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+#if USE(JSVALUE32_64)
+#include "JIT.h"
+
+#include "CodeBlock.h"
+#include "Interpreter.h"
+#include "JITInlines.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "ResultType.h"
+#include "SetupVarargsFrame.h"
+#include "StackAlignment.h"
+#include <wtf/StringPrintStream.h>
+
+
+namespace JSC {
+
+void JIT::emitPutCallResult(Instruction* instruction)
+{
+    int dst = instruction[1].u.operand;
+    emitValueProfilingSite();
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emit_op_ret(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+
+    emitLoad(dst, regT1, regT0);
+
+    checkStackPointerAlignment();
+    emitRestoreCalleeSaves();
+    emitFunctionEpilogue();
+    ret();
+}
+
+void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_call, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_tail_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_tail_call, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_call_eval(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_call_eval, currentInstruction, iter, m_callLinkInfoIndex);
+}
+ 
+void JIT::emitSlow_op_call_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_call_varargs, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_tail_call_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_tail_call_varargs, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emitSlow_op_tail_call_forward_arguments(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_tail_call_forward_arguments, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+    
+void JIT::emitSlow_op_construct_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_construct_varargs, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+    
+void JIT::emitSlow_op_construct(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(op_construct, currentInstruction, iter, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_call(Instruction* currentInstruction)
+{
+    compileOpCall(op_call, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_tail_call(Instruction* currentInstruction)
+{
+    compileOpCall(op_tail_call, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_call_eval(Instruction* currentInstruction)
+{
+    compileOpCall(op_call_eval, currentInstruction, m_callLinkInfoIndex);
+}
+
+void JIT::emit_op_call_varargs(Instruction* currentInstruction)
+{
+    compileOpCall(op_call_varargs, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_tail_call_varargs(Instruction* currentInstruction)
+{
+    compileOpCall(op_tail_call_varargs, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_tail_call_forward_arguments(Instruction* currentInstruction)
+{
+    compileOpCall(op_tail_call_forward_arguments, currentInstruction, m_callLinkInfoIndex++);
+}
+    
+void JIT::emit_op_construct_varargs(Instruction* currentInstruction)
+{
+    compileOpCall(op_construct_varargs, currentInstruction, m_callLinkInfoIndex++);
+}
+    
+void JIT::emit_op_construct(Instruction* currentInstruction)
+{
+    compileOpCall(op_construct, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::compileSetupVarargsFrame(OpcodeID opcode, Instruction* instruction, CallLinkInfo* info)
+{
+    int thisValue = instruction[3].u.operand;
+    int arguments = instruction[4].u.operand;
+    int firstFreeRegister = instruction[5].u.operand;
+    int firstVarArgOffset = instruction[6].u.operand;
+
+    emitLoad(arguments, regT1, regT0);
+    Z_JITOperation_EJZZ sizeOperation;
+    if (opcode == op_tail_call_forward_arguments)
+        sizeOperation = operationSizeFrameForForwardArguments;
+    else
+        sizeOperation = operationSizeFrameForVarargs;
+    callOperation(sizeOperation, regT1, regT0, -firstFreeRegister, firstVarArgOffset);
+    move(TrustedImm32(-firstFreeRegister), regT1);
+    emitSetVarargsFrame(*this, returnValueGPR, false, regT1, regT1);
+    addPtr(TrustedImm32(-(sizeof(CallerFrameAndPC) + WTF::roundUpToMultipleOf(stackAlignmentBytes(), 6 * sizeof(void*)))), regT1, stackPointerRegister);
+    emitLoad(arguments, regT2, regT4);
+    F_JITOperation_EFJZZ setupOperation;
+    if (opcode == op_tail_call_forward_arguments)
+        setupOperation = operationSetupForwardArgumentsFrame;
+    else
+        setupOperation = operationSetupVarargsFrame;
+    callOperation(setupOperation, regT1, regT2, regT4, firstVarArgOffset, regT0);
+    move(returnValueGPR, regT1);
+
+    // Profile the argument count.
+    load32(Address(regT1, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset), regT2);
+    load32(info->addressOfMaxNumArguments(), regT0);
+    Jump notBiggest = branch32(Above, regT0, regT2);
+    store32(regT2, info->addressOfMaxNumArguments());
+    notBiggest.link(this);
+    
+    // Initialize 'this'.
+    emitLoad(thisValue, regT2, regT0);
+    store32(regT0, Address(regT1, PayloadOffset + (CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)))));
+    store32(regT2, Address(regT1, TagOffset + (CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)))));
+    
+    addPtr(TrustedImm32(sizeof(CallerFrameAndPC)), regT1, stackPointerRegister);
+}
+
+void JIT::compileCallEval(Instruction* instruction)
+{
+    addPtr(TrustedImm32(-static_cast<ptrdiff_t>(sizeof(CallerFrameAndPC))), stackPointerRegister, regT1);
+    storePtr(callFrameRegister, Address(regT1, CallFrame::callerFrameOffset()));
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+
+    callOperation(operationCallEval, regT1);
+
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
+
+    sampleCodeBlock(m_codeBlock);
+    
+    emitPutCallResult(instruction);
+}
+
+void JIT::compileCallEvalSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    CallLinkInfo* info = m_codeBlock->addCallLinkInfo();
+    info->setUpCall(CallLinkInfo::Call, CodeOrigin(m_bytecodeOffset), regT0);
+
+    linkSlowCase(iter);
+
+    int registerOffset = -instruction[4].u.operand;
+
+    addPtr(TrustedImm32(registerOffset * sizeof(Register) + sizeof(CallerFrameAndPC)), callFrameRegister, stackPointerRegister);
+
+    move(TrustedImmPtr(info), regT2);
+
+    emitLoad(CallFrameSlot::callee, regT1, regT0);
+    MacroAssemblerCodeRef virtualThunk = virtualThunkFor(m_vm, *info);
+    info->setSlowStub(createJITStubRoutine(virtualThunk, *m_vm, nullptr, true));
+    emitNakedCall(virtualThunk.code());
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    sampleCodeBlock(m_codeBlock);
+    
+    emitPutCallResult(instruction);
+}
+
+void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned callLinkInfoIndex)
+{
+    int callee = instruction[2].u.operand;
+
+    /* Caller always:
+        - Updates callFrameRegister to callee callFrame.
+        - Initializes ArgumentCount; CallerFrame; Callee.
+
+       For a JS call:
+        - Callee initializes ReturnPC; CodeBlock.
+        - Callee restores callFrameRegister before return.
+
+       For a non-JS call:
+        - Caller initializes ReturnPC; CodeBlock.
+        - Caller restores callFrameRegister after return.
+    */
+    CallLinkInfo* info = nullptr;
+    if (opcodeID != op_call_eval)
+        info = m_codeBlock->addCallLinkInfo();
+    if (opcodeID == op_call_varargs || opcodeID == op_construct_varargs || opcodeID == op_tail_call_varargs || opcodeID == op_tail_call_forward_arguments)
+        compileSetupVarargsFrame(opcodeID, instruction, info);
+    else {
+        int argCount = instruction[3].u.operand;
+        int registerOffset = -instruction[4].u.operand;
+        
+        if (opcodeID == op_call && shouldEmitProfiling()) {
+            emitLoad(registerOffset + CallFrame::argumentOffsetIncludingThis(0), regT0, regT1);
+            Jump done = branch32(NotEqual, regT0, TrustedImm32(JSValue::CellTag));
+            loadPtr(Address(regT1, JSCell::structureIDOffset()), regT1);
+            storePtr(regT1, instruction[OPCODE_LENGTH(op_call) - 2].u.arrayProfile->addressOfLastSeenStructureID());
+            done.link(this);
+        }
+    
+        addPtr(TrustedImm32(registerOffset * sizeof(Register) + sizeof(CallerFrameAndPC)), callFrameRegister, stackPointerRegister);
+
+        store32(TrustedImm32(argCount), Address(stackPointerRegister, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset - sizeof(CallerFrameAndPC)));
+    } // SP holds newCallFrame + sizeof(CallerFrameAndPC), with ArgumentCount initialized.
+    
+    uint32_t locationBits = CallSiteIndex(instruction).bits();
+    store32(TrustedImm32(locationBits), tagFor(CallFrameSlot::argumentCount, callFrameRegister));
+    emitLoad(callee, regT1, regT0); // regT1, regT0 holds callee.
+
+    store32(regT0, Address(stackPointerRegister, CallFrameSlot::callee * static_cast<int>(sizeof(Register)) + PayloadOffset - sizeof(CallerFrameAndPC)));
+    store32(regT1, Address(stackPointerRegister, CallFrameSlot::callee * static_cast<int>(sizeof(Register)) + TagOffset - sizeof(CallerFrameAndPC)));
+
+    if (opcodeID == op_call_eval) {
+        compileCallEval(instruction);
+        return;
+    }
+
+    if (opcodeID == op_tail_call || opcodeID == op_tail_call_varargs)
+        emitRestoreCalleeSaves();
+
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
+
+    DataLabelPtr addressOfLinkedFunctionCheck;
+    Jump slowCase = branchPtrWithPatch(NotEqual, regT0, addressOfLinkedFunctionCheck, TrustedImmPtr(0));
+
+    addSlowCase(slowCase);
+
+    ASSERT(m_callCompilationInfo.size() == callLinkInfoIndex);
+    info->setUpCall(CallLinkInfo::callTypeFor(opcodeID), CodeOrigin(m_bytecodeOffset), regT0);
+    m_callCompilationInfo.append(CallCompilationInfo());
+    m_callCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
+    m_callCompilationInfo[callLinkInfoIndex].callLinkInfo = info;
+
+    checkStackPointerAlignment();
+    if (opcodeID == op_tail_call || opcodeID == op_tail_call_varargs || opcodeID == op_tail_call_forward_arguments) {
+        prepareForTailCallSlow();
+        m_callCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedTailCall();
+        return;
+    }
+
+    m_callCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    sampleCodeBlock(m_codeBlock);
+    emitPutCallResult(instruction);
+}
+
+void JIT::compileOpCallSlowCase(OpcodeID opcodeID, Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex)
+{
+    if (opcodeID == op_call_eval) {
+        compileCallEvalSlowCase(instruction, iter);
+        return;
+    }
+
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    move(TrustedImmPtr(m_callCompilationInfo[callLinkInfoIndex].callLinkInfo), regT2);
+
+    if (opcodeID == op_tail_call || opcodeID == op_tail_call_varargs)
+        emitRestoreCalleeSaves();
+
+    m_callCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_vm->getCTIStub(linkCallThunkGenerator).code());
+
+    if (opcodeID == op_tail_call || opcodeID == op_tail_call_varargs) {
+        abortWithReason(JITDidReturnFromTailCall);
+        return;
+    }
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+    checkStackPointerAlignment();
+
+    sampleCodeBlock(m_codeBlock);
+    emitPutCallResult(instruction);
+}
+
+} // namespace JSC
+
+#endif // USE(JSVALUE32_64)
+#endif // ENABLE(JIT)
diff --git a/jit/JITCode.cpp b/jit/JITCode.cpp
new file mode 100644
index 0000000..9c92552
--- /dev/null
+++ b/jit/JITCode.cpp
@@ -0,0 +1,239 @@
+/*
+ * Copyright (C) 2008, 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITCode.h"
+
+#include "LLIntThunks.h"
+#include "JSCInlines.h"
+#include "ProtoCallFrame.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+JITCode::JITCode(JITType jitType)
+    : m_jitType(jitType)
+{
+}
+
+JITCode::~JITCode()
+{
+}
+
+const char* JITCode::typeName(JITType jitType)
+{
+    switch (jitType) {
+    case None:
+        return "None";
+    case HostCallThunk:
+        return "Host";
+    case InterpreterThunk:
+        return "LLInt";
+    case BaselineJIT:
+        return "Baseline";
+    case DFGJIT:
+        return "DFG";
+    case FTLJIT:
+        return "FTL";
+    default:
+        CRASH();
+        return "";
+    }
+}
+
+void JITCode::validateReferences(const TrackedReferences&)
+{
+}
+
+JSValue JITCode::execute(VM* vm, ProtoCallFrame* protoCallFrame)
+{
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    void* entryAddress;
+    JSFunction* function = jsDynamicCast<JSFunction*>(protoCallFrame->callee());
+
+    if (!function || !protoCallFrame->needArityCheck()) {
+        ASSERT(!protoCallFrame->needArityCheck());
+        entryAddress = executableAddress();
+    } else
+        entryAddress = addressForCall(MustCheckArity).executableAddress();
+    JSValue result = JSValue::decode(vmEntryToJavaScript(entryAddress, vm, protoCallFrame));
+    return scope.exception() ? jsNull() : result;
+}
+
+DFG::CommonData* JITCode::dfgCommon()
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+DFG::JITCode* JITCode::dfg()
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+FTL::JITCode* JITCode::ftl()
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+FTL::ForOSREntryJITCode* JITCode::ftlForOSREntry()
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+JITCodeWithCodeRef::JITCodeWithCodeRef(JITType jitType)
+    : JITCode(jitType)
+{
+}
+
+JITCodeWithCodeRef::JITCodeWithCodeRef(CodeRef ref, JITType jitType)
+    : JITCode(jitType)
+    , m_ref(ref)
+{
+}
+
+JITCodeWithCodeRef::~JITCodeWithCodeRef()
+{
+    if ((Options::dumpDisassembly() || (isOptimizingJIT(jitType()) && Options::dumpDFGDisassembly()))
+        && m_ref.executableMemory())
+        dataLog("Destroying JIT code at ", pointerDump(m_ref.executableMemory()), "\n");
+}
+
+void* JITCodeWithCodeRef::executableAddressAtOffset(size_t offset)
+{
+    RELEASE_ASSERT(m_ref);
+    return reinterpret_cast<char*>(m_ref.code().executableAddress()) + offset;
+}
+
+void* JITCodeWithCodeRef::dataAddressAtOffset(size_t offset)
+{
+    RELEASE_ASSERT(m_ref);
+    ASSERT(offset <= size()); // use <= instead of < because it is valid to ask for an address at the exclusive end of the code.
+    return reinterpret_cast<char*>(m_ref.code().dataLocation()) + offset;
+}
+
+unsigned JITCodeWithCodeRef::offsetOf(void* pointerIntoCode)
+{
+    RELEASE_ASSERT(m_ref);
+    intptr_t result = reinterpret_cast<intptr_t>(pointerIntoCode) - reinterpret_cast<intptr_t>(m_ref.code().executableAddress());
+    ASSERT(static_cast<intptr_t>(static_cast<unsigned>(result)) == result);
+    return static_cast<unsigned>(result);
+}
+
+size_t JITCodeWithCodeRef::size()
+{
+    RELEASE_ASSERT(m_ref);
+    return m_ref.size();
+}
+
+bool JITCodeWithCodeRef::contains(void* address)
+{
+    RELEASE_ASSERT(m_ref);
+    return m_ref.executableMemory()->contains(address);
+}
+
+DirectJITCode::DirectJITCode(JITType jitType)
+    : JITCodeWithCodeRef(jitType)
+{
+}
+
+DirectJITCode::DirectJITCode(JITCode::CodeRef ref, JITCode::CodePtr withArityCheck, JITType jitType)
+    : JITCodeWithCodeRef(ref, jitType)
+    , m_withArityCheck(withArityCheck)
+{
+}
+
+DirectJITCode::~DirectJITCode()
+{
+}
+
+void DirectJITCode::initializeCodeRef(JITCode::CodeRef ref, JITCode::CodePtr withArityCheck)
+{
+    RELEASE_ASSERT(!m_ref);
+    m_ref = ref;
+    m_withArityCheck = withArityCheck;
+}
+
+JITCode::CodePtr DirectJITCode::addressForCall(ArityCheckMode arity)
+{
+    switch (arity) {
+    case ArityCheckNotRequired:
+        RELEASE_ASSERT(m_ref);
+        return m_ref.code();
+    case MustCheckArity:
+        RELEASE_ASSERT(m_withArityCheck);
+        return m_withArityCheck;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return CodePtr();
+}
+
+NativeJITCode::NativeJITCode(JITType jitType)
+    : JITCodeWithCodeRef(jitType)
+{
+}
+
+NativeJITCode::NativeJITCode(CodeRef ref, JITType jitType)
+    : JITCodeWithCodeRef(ref, jitType)
+{
+}
+
+NativeJITCode::~NativeJITCode()
+{
+}
+
+void NativeJITCode::initializeCodeRef(CodeRef ref)
+{
+    ASSERT(!m_ref);
+    m_ref = ref;
+}
+
+JITCode::CodePtr NativeJITCode::addressForCall(ArityCheckMode)
+{
+    RELEASE_ASSERT(!!m_ref);
+    return m_ref.code();
+}
+
+#if ENABLE(JIT)
+RegisterSet JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite(CodeBlock*, CallSiteIndex)
+{
+    return RegisterSet();
+}
+#endif
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::JITCode::JITType type)
+{
+    out.print(JSC::JITCode::typeName(type));
+}
+
+} // namespace WTF
+
diff --git a/jit/JITCode.h b/jit/JITCode.h
new file mode 100644
index 0000000..75c70c7
--- /dev/null
+++ b/jit/JITCode.h
@@ -0,0 +1,256 @@
+/*
+ * Copyright (C) 2008, 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArityCheckMode.h"
+#include "CallFrame.h"
+#include "CodeOrigin.h"
+#include "Disassembler.h"
+#include "JSCJSValue.h"
+#include "MacroAssemblerCodeRef.h"
+#include "RegisterSet.h"
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+namespace DFG {
+class CommonData;
+class JITCode;
+}
+namespace FTL {
+class ForOSREntryJITCode;
+class JITCode;
+}
+
+struct ProtoCallFrame;
+class TrackedReferences;
+class VM;
+
+class JITCode : public ThreadSafeRefCounted<JITCode> {
+public:
+    typedef MacroAssemblerCodeRef CodeRef;
+    typedef MacroAssemblerCodePtr CodePtr;
+
+    enum JITType : uint8_t {
+        None,
+        HostCallThunk,
+        InterpreterThunk,
+        BaselineJIT,
+        DFGJIT,
+        FTLJIT
+    };
+    
+    static const char* typeName(JITType);
+
+    static JITType bottomTierJIT()
+    {
+        return BaselineJIT;
+    }
+    
+    static JITType topTierJIT()
+    {
+        return FTLJIT;
+    }
+    
+    static JITType nextTierJIT(JITType jitType)
+    {
+        switch (jitType) {
+        case BaselineJIT:
+            return DFGJIT;
+        case DFGJIT:
+            return FTLJIT;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return None;
+        }
+    }
+    
+    static bool isExecutableScript(JITType jitType)
+    {
+        switch (jitType) {
+        case None:
+        case HostCallThunk:
+            return false;
+        default:
+            return true;
+        }
+    }
+    
+    static bool couldBeInterpreted(JITType jitType)
+    {
+        switch (jitType) {
+        case InterpreterThunk:
+        case BaselineJIT:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    static bool isJIT(JITType jitType)
+    {
+        switch (jitType) {
+        case BaselineJIT:
+        case DFGJIT:
+        case FTLJIT:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    static bool isLowerTier(JITType expectedLower, JITType expectedHigher)
+    {
+        RELEASE_ASSERT(isExecutableScript(expectedLower));
+        RELEASE_ASSERT(isExecutableScript(expectedHigher));
+        return expectedLower < expectedHigher;
+    }
+    
+    static bool isHigherTier(JITType expectedHigher, JITType expectedLower)
+    {
+        return isLowerTier(expectedLower, expectedHigher);
+    }
+    
+    static bool isLowerOrSameTier(JITType expectedLower, JITType expectedHigher)
+    {
+        return !isHigherTier(expectedLower, expectedHigher);
+    }
+    
+    static bool isHigherOrSameTier(JITType expectedHigher, JITType expectedLower)
+    {
+        return isLowerOrSameTier(expectedLower, expectedHigher);
+    }
+    
+    static bool isOptimizingJIT(JITType jitType)
+    {
+        return jitType == DFGJIT || jitType == FTLJIT;
+    }
+    
+    static bool isBaselineCode(JITType jitType)
+    {
+        return jitType == InterpreterThunk || jitType == BaselineJIT;
+    }
+    
+protected:
+    JITCode(JITType);
+    
+public:
+    virtual ~JITCode();
+    
+    JITType jitType() const
+    {
+        return m_jitType;
+    }
+    
+    template<typename PointerType>
+    static JITType jitTypeFor(PointerType jitCode)
+    {
+        if (!jitCode)
+            return None;
+        return jitCode->jitType();
+    }
+    
+    virtual CodePtr addressForCall(ArityCheckMode) = 0;
+    virtual void* executableAddressAtOffset(size_t offset) = 0;
+    void* executableAddress() { return executableAddressAtOffset(0); }
+    virtual void* dataAddressAtOffset(size_t offset) = 0;
+    virtual unsigned offsetOf(void* pointerIntoCode) = 0;
+    
+    virtual DFG::CommonData* dfgCommon();
+    virtual DFG::JITCode* dfg();
+    virtual FTL::JITCode* ftl();
+    virtual FTL::ForOSREntryJITCode* ftlForOSREntry();
+    
+    virtual void validateReferences(const TrackedReferences&);
+    
+    JSValue execute(VM*, ProtoCallFrame*);
+    
+    void* start() { return dataAddressAtOffset(0); }
+    virtual size_t size() = 0;
+    void* end() { return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(start()) + size()); }
+    
+    virtual bool contains(void*) = 0;
+
+#if ENABLE(JIT)
+    virtual RegisterSet liveRegistersToPreserveAtExceptionHandlingCallSite(CodeBlock*, CallSiteIndex);
+    virtual std::optional<CodeOrigin> findPC(CodeBlock*, void* pc) { UNUSED_PARAM(pc); return std::nullopt; }
+#endif
+
+private:
+    JITType m_jitType;
+};
+
+class JITCodeWithCodeRef : public JITCode {
+protected:
+    JITCodeWithCodeRef(JITType);
+    JITCodeWithCodeRef(CodeRef, JITType);
+
+public:
+    virtual ~JITCodeWithCodeRef();
+
+    void* executableAddressAtOffset(size_t offset) override;
+    void* dataAddressAtOffset(size_t offset) override;
+    unsigned offsetOf(void* pointerIntoCode) override;
+    size_t size() override;
+    bool contains(void*) override;
+
+protected:
+    CodeRef m_ref;
+};
+
+class DirectJITCode : public JITCodeWithCodeRef {
+public:
+    DirectJITCode(JITType);
+    DirectJITCode(CodeRef, CodePtr withArityCheck, JITType);
+    virtual ~DirectJITCode();
+    
+    void initializeCodeRef(CodeRef, CodePtr withArityCheck);
+
+    CodePtr addressForCall(ArityCheckMode) override;
+
+private:
+    CodePtr m_withArityCheck;
+};
+
+class NativeJITCode : public JITCodeWithCodeRef {
+public:
+    NativeJITCode(JITType);
+    NativeJITCode(CodeRef, JITType);
+    virtual ~NativeJITCode();
+    
+    void initializeCodeRef(CodeRef);
+
+    CodePtr addressForCall(ArityCheckMode) override;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::JITCode::JITType);
+
+} // namespace WTF
diff --git a/jit/JITCompilationEffort.h b/jit/JITCompilationEffort.h
new file mode 100644
index 0000000..18d53d5
--- /dev/null
+++ b/jit/JITCompilationEffort.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum JITCompilationEffort {
+    JITCompilationCanFail,
+    JITCompilationMustSucceed
+};
+
+} // namespace JSC
diff --git a/jit/JITDisassembler.cpp b/jit/JITDisassembler.cpp
new file mode 100644
index 0000000..7aa21d0
--- /dev/null
+++ b/jit/JITDisassembler.cpp
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2012-2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITDisassembler.h"
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "CodeBlockWithJITType.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "ProfilerCompilation.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+JITDisassembler::JITDisassembler(CodeBlock *codeBlock)
+    : m_codeBlock(codeBlock)
+    , m_labelForBytecodeIndexInMainPath(codeBlock->instructionCount())
+    , m_labelForBytecodeIndexInSlowPath(codeBlock->instructionCount())
+{
+}
+
+JITDisassembler::~JITDisassembler()
+{
+}
+
+void JITDisassembler::dump(PrintStream& out, LinkBuffer& linkBuffer)
+{
+    dumpHeader(out, linkBuffer);
+    dumpDisassembly(out, linkBuffer, m_startOfCode, m_labelForBytecodeIndexInMainPath[0]);
+    
+    dumpForInstructions(out, linkBuffer, "    ", m_labelForBytecodeIndexInMainPath, firstSlowLabel());
+    out.print("    (End Of Main Path)\n");
+    dumpForInstructions(out, linkBuffer, "    (S) ", m_labelForBytecodeIndexInSlowPath, m_endOfSlowPath);
+    out.print("    (End Of Slow Path)\n");
+
+    dumpDisassembly(out, linkBuffer, m_endOfSlowPath, m_endOfCode);
+}
+
+void JITDisassembler::dump(LinkBuffer& linkBuffer)
+{
+    dump(WTF::dataFile(), linkBuffer);
+}
+
+void JITDisassembler::reportToProfiler(Profiler::Compilation* compilation, LinkBuffer& linkBuffer)
+{
+    StringPrintStream out;
+    
+    dumpHeader(out, linkBuffer);
+    compilation->addDescription(Profiler::CompiledBytecode(Profiler::OriginStack(), out.toCString()));
+    out.reset();
+    dumpDisassembly(out, linkBuffer, m_startOfCode, m_labelForBytecodeIndexInMainPath[0]);
+    compilation->addDescription(Profiler::CompiledBytecode(Profiler::OriginStack(), out.toCString()));
+    
+    reportInstructions(compilation, linkBuffer, "    ", m_labelForBytecodeIndexInMainPath, firstSlowLabel());
+    compilation->addDescription(Profiler::CompiledBytecode(Profiler::OriginStack(), "    (End Of Main Path)\n"));
+    reportInstructions(compilation, linkBuffer, "    (S) ", m_labelForBytecodeIndexInSlowPath, m_endOfSlowPath);
+    compilation->addDescription(Profiler::CompiledBytecode(Profiler::OriginStack(), "    (End Of Slow Path)\n"));
+    out.reset();
+    dumpDisassembly(out, linkBuffer, m_endOfSlowPath, m_endOfCode);
+    compilation->addDescription(Profiler::CompiledBytecode(Profiler::OriginStack(), out.toCString()));
+}
+
+void JITDisassembler::dumpHeader(PrintStream& out, LinkBuffer& linkBuffer)
+{
+    out.print("Generated Baseline JIT code for ", CodeBlockWithJITType(m_codeBlock, JITCode::BaselineJIT), ", instruction count = ", m_codeBlock->instructionCount(), "\n");
+    out.print("   Source: ", m_codeBlock->sourceCodeOnOneLine(), "\n");
+    out.print("   Code at [", RawPointer(linkBuffer.debugAddress()), ", ", RawPointer(static_cast<char*>(linkBuffer.debugAddress()) + linkBuffer.size()), "):\n");
+}
+
+MacroAssembler::Label JITDisassembler::firstSlowLabel()
+{
+    MacroAssembler::Label firstSlowLabel;
+    for (unsigned i = 0; i < m_labelForBytecodeIndexInSlowPath.size(); ++i) {
+        if (m_labelForBytecodeIndexInSlowPath[i].isSet()) {
+            firstSlowLabel = m_labelForBytecodeIndexInSlowPath[i];
+            break;
+        }
+    }
+    return firstSlowLabel.isSet() ? firstSlowLabel : m_endOfSlowPath;
+}
+
+Vector<JITDisassembler::DumpedOp> JITDisassembler::dumpVectorForInstructions(LinkBuffer& linkBuffer, const char* prefix, Vector<MacroAssembler::Label>& labels, MacroAssembler::Label endLabel)
+{
+    StringPrintStream out;
+    Vector<DumpedOp> result;
+    
+    for (unsigned i = 0; i < labels.size();) {
+        if (!labels[i].isSet()) {
+            i++;
+            continue;
+        }
+        out.reset();
+        result.append(DumpedOp());
+        result.last().index = i;
+        out.print(prefix);
+        m_codeBlock->dumpBytecode(out, i);
+        for (unsigned nextIndex = i + 1; ; nextIndex++) {
+            if (nextIndex >= labels.size()) {
+                dumpDisassembly(out, linkBuffer, labels[i], endLabel);
+                result.last().disassembly = out.toCString();
+                return result;
+            }
+            if (labels[nextIndex].isSet()) {
+                dumpDisassembly(out, linkBuffer, labels[i], labels[nextIndex]);
+                result.last().disassembly = out.toCString();
+                i = nextIndex;
+                break;
+            }
+        }
+    }
+    
+    return result;
+}
+
+void JITDisassembler::dumpForInstructions(PrintStream& out, LinkBuffer& linkBuffer, const char* prefix, Vector<MacroAssembler::Label>& labels, MacroAssembler::Label endLabel)
+{
+    Vector<DumpedOp> dumpedOps = dumpVectorForInstructions(linkBuffer, prefix, labels, endLabel);
+    
+    for (unsigned i = 0; i < dumpedOps.size(); ++i)
+        out.print(dumpedOps[i].disassembly);
+}
+
+void JITDisassembler::reportInstructions(Profiler::Compilation* compilation, LinkBuffer& linkBuffer, const char* prefix, Vector<MacroAssembler::Label>& labels, MacroAssembler::Label endLabel)
+{
+    Vector<DumpedOp> dumpedOps = dumpVectorForInstructions(linkBuffer, prefix, labels, endLabel);
+    
+    for (unsigned i = 0; i < dumpedOps.size(); ++i) {
+        compilation->addDescription(
+            Profiler::CompiledBytecode(
+                Profiler::OriginStack(Profiler::Origin(compilation->bytecodes(), dumpedOps[i].index)),
+                dumpedOps[i].disassembly));
+    }
+}
+
+void JITDisassembler::dumpDisassembly(PrintStream& out, LinkBuffer& linkBuffer, MacroAssembler::Label from, MacroAssembler::Label to)
+{
+    CodeLocationLabel fromLocation = linkBuffer.locationOf(from);
+    CodeLocationLabel toLocation = linkBuffer.locationOf(to);
+    disassemble(fromLocation, bitwise_cast<uintptr_t>(toLocation.executableAddress()) - bitwise_cast<uintptr_t>(fromLocation.executableAddress()), "        ", out);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/JITDisassembler.h b/jit/JITDisassembler.h
new file mode 100644
index 0000000..5e32286
--- /dev/null
+++ b/jit/JITDisassembler.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "MacroAssembler.h"
+#include <wtf/Vector.h>
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+class CodeBlock;
+class LinkBuffer;
+
+namespace Profiler {
+class Compilation;
+}
+
+class JITDisassembler {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JITDisassembler(CodeBlock*);
+    ~JITDisassembler();
+    
+    void setStartOfCode(MacroAssembler::Label label) { m_startOfCode = label; }
+    void setForBytecodeMainPath(unsigned bytecodeIndex, MacroAssembler::Label label)
+    {
+        m_labelForBytecodeIndexInMainPath[bytecodeIndex] = label;
+    }
+    void setForBytecodeSlowPath(unsigned bytecodeIndex, MacroAssembler::Label label)
+    {
+        m_labelForBytecodeIndexInSlowPath[bytecodeIndex] = label;
+    }
+    void setEndOfSlowPath(MacroAssembler::Label label) { m_endOfSlowPath = label; }
+    void setEndOfCode(MacroAssembler::Label label) { m_endOfCode = label; }
+    
+    void dump(LinkBuffer&);
+    void dump(PrintStream&, LinkBuffer&);
+    void reportToProfiler(Profiler::Compilation*, LinkBuffer&);
+
+private:
+    void dumpHeader(PrintStream&, LinkBuffer&);
+    MacroAssembler::Label firstSlowLabel();
+    
+    struct DumpedOp {
+        unsigned index;
+        CString disassembly;
+    };
+    Vector<DumpedOp> dumpVectorForInstructions(LinkBuffer&, const char* prefix, Vector<MacroAssembler::Label>& labels, MacroAssembler::Label endLabel);
+        
+    void dumpForInstructions(PrintStream&, LinkBuffer&, const char* prefix, Vector<MacroAssembler::Label>& labels, MacroAssembler::Label endLabel);
+    void reportInstructions(Profiler::Compilation*, LinkBuffer&, const char* prefix, Vector<MacroAssembler::Label>& labels, MacroAssembler::Label endLabel);
+    
+    void dumpDisassembly(PrintStream&, LinkBuffer&, MacroAssembler::Label from, MacroAssembler::Label to);
+    
+    CodeBlock* m_codeBlock;
+    MacroAssembler::Label m_startOfCode;
+    Vector<MacroAssembler::Label> m_labelForBytecodeIndexInMainPath;
+    Vector<MacroAssembler::Label> m_labelForBytecodeIndexInSlowPath;
+    MacroAssembler::Label m_endOfSlowPath;
+    MacroAssembler::Label m_endOfCode;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITDivGenerator.cpp b/jit/JITDivGenerator.cpp
new file mode 100644
index 0000000..a5db7e1
--- /dev/null
+++ b/jit/JITDivGenerator.cpp
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITDivGenerator.h"
+
+#if ENABLE(JIT)
+
+#include "ArithProfile.h"
+#include "JSCJSValueInlines.h"
+#include "MathCommon.h"
+
+namespace JSC {
+
+void JITDivGenerator::loadOperand(CCallHelpers& jit, SnippetOperand& opr, JSValueRegs oprRegs, FPRReg destFPR)
+{
+    if (opr.isConstInt32()) {
+        // FIXME: this does not looks right.
+        //     -On x86_64, CVTSI2SD has partial register stall on its FPR.
+        //      A move or load might be a tiny bit larger but safer.
+        //     -On ARM64 we also have FMOV that can load small immediates.
+        jit.move(CCallHelpers::Imm32(opr.asConstInt32()), m_scratchGPR);
+        jit.convertInt32ToDouble(m_scratchGPR, destFPR);
+#if USE(JSVALUE64)
+    } else if (opr.isConstDouble()) {
+        jit.move(CCallHelpers::Imm64(opr.asRawBits()), m_scratchGPR);
+        jit.move64ToDouble(m_scratchGPR, destFPR);
+#endif
+    } else {
+        if (!opr.definitelyIsNumber())
+            m_slowPathJumpList.append(jit.branchIfNotNumber(oprRegs, m_scratchGPR));
+        CCallHelpers::Jump notInt32 = jit.branchIfNotInt32(oprRegs);
+        jit.convertInt32ToDouble(oprRegs.payloadGPR(), destFPR);
+        CCallHelpers::Jump oprIsLoaded = jit.jump();
+        notInt32.link(&jit);
+        jit.unboxDoubleNonDestructive(oprRegs, destFPR, m_scratchGPR, m_scratchFPR);
+        oprIsLoaded.link(&jit);
+    }
+}
+
+void JITDivGenerator::generateFastPath(CCallHelpers& jit)
+{
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_left.payloadGPR());
+    ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE32_64)
+    ASSERT(m_scratchGPR != m_left.tagGPR());
+    ASSERT(m_scratchGPR != m_right.tagGPR());
+    ASSERT(m_scratchFPR != InvalidFPRReg);
+#endif
+
+    ASSERT(!m_didEmitFastPath);
+    if (!jit.supportsFloatingPoint())
+        return;
+    if (!m_leftOperand.mightBeNumber() || !m_rightOperand.mightBeNumber())
+        return;
+
+    ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+    m_didEmitFastPath = true;
+    loadOperand(jit, m_leftOperand, m_left, m_leftFPR);
+
+#if USE(JSVALUE64)
+    std::optional<double> safeReciprocal;
+    if (m_rightOperand.isConst()) {
+        double constant = m_rightOperand.asConstNumber();
+        safeReciprocal = safeReciprocalForDivByConst(constant);
+    }
+
+    if (safeReciprocal) {
+        jit.move(CCallHelpers::Imm64(bitwise_cast<int64_t>(*safeReciprocal)), m_scratchGPR);
+        jit.move64ToDouble(m_scratchGPR, m_rightFPR);
+
+        jit.mulDouble(m_rightFPR, m_leftFPR);
+    } else
+#endif
+    {
+        loadOperand(jit, m_rightOperand, m_right, m_rightFPR);
+
+        jit.divDouble(m_rightFPR, m_leftFPR);
+    }
+
+    // Is the result actually an integer? The DFG JIT would really like to know. If it's
+    // not an integer, we set a bit. If this together with the slow case counter are below
+    // threshold then the DFG JIT will compile this division with a speculation that the
+    // remainder is zero.
+
+    // As well, there are cases where a double result here would cause an important field
+    // in the heap to sometimes have doubles in it, resulting in double predictions getting
+    // propagated to a use site where it might cause damage (such as the index to an array
+    // access). So if we are DFG compiling anything in the program, we want this code to
+    // ensure that it produces integers whenever possible.
+    
+    CCallHelpers::JumpList notInt32;
+    jit.branchConvertDoubleToInt32(m_leftFPR, m_scratchGPR, notInt32, m_scratchFPR);
+
+    // If we've got an integer, we might as well make that the result of the division.
+    jit.boxInt32(m_scratchGPR, m_result);
+    m_endJumpList.append(jit.jump());
+
+    notInt32.link(&jit);
+#if USE(JSVALUE64)
+    jit.moveDoubleTo64(m_leftFPR, m_scratchGPR);
+    CCallHelpers::Jump notDoubleZero = jit.branchTest64(CCallHelpers::NonZero, m_scratchGPR);
+
+    jit.move(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR());
+    m_endJumpList.append(jit.jump());
+
+    notDoubleZero.link(&jit);
+#endif
+    if (m_arithProfile)
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::specialFastPathBit), CCallHelpers::AbsoluteAddress(m_arithProfile->addressOfBits()));
+    jit.boxDouble(m_leftFPR, m_result);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITDivGenerator.h b/jit/JITDivGenerator.h
new file mode 100644
index 0000000..7a03cc7
--- /dev/null
+++ b/jit/JITDivGenerator.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "SnippetOperand.h"
+
+namespace JSC {
+
+class JITDivGenerator {
+public:
+    JITDivGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right,
+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR,
+        ArithProfile* arithProfile = nullptr)
+        : m_leftOperand(leftOperand)
+        , m_rightOperand(rightOperand)
+        , m_result(result)
+        , m_left(left)
+        , m_right(right)
+        , m_leftFPR(leftFPR)
+        , m_rightFPR(rightFPR)
+        , m_scratchGPR(scratchGPR)
+        , m_scratchFPR(scratchFPR)
+        , m_arithProfile(arithProfile)
+    {
+        ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+    }
+
+    void generateFastPath(CCallHelpers&);
+
+    bool didEmitFastPath() const { return m_didEmitFastPath; }
+    CCallHelpers::JumpList& endJumpList() { return m_endJumpList; }
+    CCallHelpers::JumpList& slowPathJumpList() { return m_slowPathJumpList; }
+
+private:
+    void loadOperand(CCallHelpers&, SnippetOperand&, JSValueRegs opRegs, FPRReg destFPR);
+
+    SnippetOperand m_leftOperand;
+    SnippetOperand m_rightOperand;
+    JSValueRegs m_result;
+    JSValueRegs m_left;
+    JSValueRegs m_right;
+    FPRReg m_leftFPR;
+    FPRReg m_rightFPR;
+    GPRReg m_scratchGPR;
+    FPRReg m_scratchFPR;
+    ArithProfile* m_arithProfile;
+    bool m_didEmitFastPath { false };
+
+    CCallHelpers::JumpList m_endJumpList;
+    CCallHelpers::JumpList m_slowPathJumpList;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITExceptions.cpp b/jit/JITExceptions.cpp
new file mode 100644
index 0000000..501d48b
--- /dev/null
+++ b/jit/JITExceptions.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012-2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITExceptions.h"
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "LLIntData.h"
+#include "LLIntOpcode.h"
+#include "LLIntThunks.h"
+#include "Opcode.h"
+#include "ShadowChicken.h"
+#include "VM.h"
+
+namespace JSC {
+
+void genericUnwind(VM* vm, ExecState* callFrame, UnwindStart unwindStart)
+{
+    auto scope = DECLARE_CATCH_SCOPE(*vm);
+    if (Options::breakOnThrow()) {
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        if (codeBlock)
+            dataLog("In call frame ", RawPointer(callFrame), " for code block ", *codeBlock, "\n");
+        else
+            dataLog("In call frame ", RawPointer(callFrame), " with null CodeBlock\n");
+        CRASH();
+    }
+    
+    ExecState* shadowChickenTopFrame = callFrame;
+    if (unwindStart == UnwindFromCallerFrame) {
+        VMEntryFrame* topVMEntryFrame = vm->topVMEntryFrame;
+        shadowChickenTopFrame = callFrame->callerFrame(topVMEntryFrame);
+    }
+    vm->shadowChicken().log(*vm, shadowChickenTopFrame, ShadowChicken::Packet::throwPacket());
+    
+    Exception* exception = scope.exception();
+    RELEASE_ASSERT(exception);
+    HandlerInfo* handler = vm->interpreter->unwind(*vm, callFrame, exception, unwindStart); // This may update callFrame.
+
+    void* catchRoutine;
+    Instruction* catchPCForInterpreter = 0;
+    if (handler) {
+        // handler->target is meaningless for getting a code offset when catching
+        // the exception in a DFG/FTL frame. This bytecode target offset could be
+        // something that's in an inlined frame, which means an array access
+        // with this bytecode offset in the machine frame is utterly meaningless
+        // and can cause an overflow. OSR exit properly exits to handler->target
+        // in the proper frame.
+        if (!JITCode::isOptimizingJIT(callFrame->codeBlock()->jitType()))
+            catchPCForInterpreter = &callFrame->codeBlock()->instructions()[handler->target];
+#if ENABLE(JIT)
+        catchRoutine = handler->nativeCode.executableAddress();
+#else
+        catchRoutine = catchPCForInterpreter->u.pointer;
+#endif
+    } else
+        catchRoutine = LLInt::getCodePtr(handleUncaughtException);
+    
+    ASSERT(bitwise_cast<uintptr_t>(callFrame) < bitwise_cast<uintptr_t>(vm->topVMEntryFrame));
+
+    vm->callFrameForCatch = callFrame;
+    vm->targetMachinePCForThrow = catchRoutine;
+    vm->targetInterpreterPCForThrow = catchPCForInterpreter;
+    
+    RELEASE_ASSERT(catchRoutine);
+}
+
+void genericUnwind(VM* vm, ExecState* callFrame)
+{
+    genericUnwind(vm, callFrame, UnwindFromCurrentFrame);
+}
+
+} // namespace JSC
diff --git a/jit/JITExceptions.h b/jit/JITExceptions.h
new file mode 100644
index 0000000..8549d94
--- /dev/null
+++ b/jit/JITExceptions.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum UnwindStart : uint8_t;
+
+class ExecState;
+class VM;
+
+void genericUnwind(VM*, ExecState*, UnwindStart);
+void genericUnwind(VM*, ExecState*);
+
+} // namespace JSC
diff --git a/jit/JITInlineCacheGenerator.cpp b/jit/JITInlineCacheGenerator.cpp
new file mode 100644
index 0000000..0417939
--- /dev/null
+++ b/jit/JITInlineCacheGenerator.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITInlineCacheGenerator.h"
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "InlineAccess.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+#include "StructureStubInfo.h"
+
+namespace JSC {
+
+static StructureStubInfo* garbageStubInfo()
+{
+    static StructureStubInfo* stubInfo = new StructureStubInfo(AccessType::Get);
+    return stubInfo;
+}
+
+JITInlineCacheGenerator::JITInlineCacheGenerator(
+    CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSite, AccessType accessType)
+    : m_codeBlock(codeBlock)
+{
+    m_stubInfo = m_codeBlock ? m_codeBlock->addStubInfo(accessType) : garbageStubInfo();
+    m_stubInfo->codeOrigin = codeOrigin;
+    m_stubInfo->callSiteIndex = callSite;
+}
+
+JITByIdGenerator::JITByIdGenerator(
+    CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSite, AccessType accessType,
+    const RegisterSet& usedRegisters, JSValueRegs base, JSValueRegs value)
+    : JITInlineCacheGenerator(codeBlock, codeOrigin, callSite, accessType)
+    , m_base(base)
+    , m_value(value)
+{
+    m_stubInfo->patch.usedRegisters = usedRegisters;
+    
+    m_stubInfo->patch.baseGPR = static_cast<int8_t>(base.payloadGPR());
+    m_stubInfo->patch.valueGPR = static_cast<int8_t>(value.payloadGPR());
+#if USE(JSVALUE32_64)
+    m_stubInfo->patch.baseTagGPR = static_cast<int8_t>(base.tagGPR());
+    m_stubInfo->patch.valueTagGPR = static_cast<int8_t>(value.tagGPR());
+#endif
+}
+
+void JITByIdGenerator::finalize(LinkBuffer& fastPath, LinkBuffer& slowPath)
+{
+    ASSERT(m_start.isSet());
+    CodeLocationLabel start = fastPath.locationOf(m_start);
+    m_stubInfo->patch.start = start;
+
+    int32_t inlineSize = MacroAssembler::differenceBetweenCodePtr(
+        start, fastPath.locationOf(m_done));
+    ASSERT(inlineSize > 0);
+    m_stubInfo->patch.inlineSize = inlineSize;
+
+    m_stubInfo->patch.deltaFromStartToSlowPathCallLocation = MacroAssembler::differenceBetweenCodePtr(
+        start, slowPath.locationOf(m_slowPathCall));
+    m_stubInfo->patch.deltaFromStartToSlowPathStart = MacroAssembler::differenceBetweenCodePtr(
+        start, slowPath.locationOf(m_slowPathBegin));
+}
+
+void JITByIdGenerator::finalize(LinkBuffer& linkBuffer)
+{
+    finalize(linkBuffer, linkBuffer);
+}
+
+void JITByIdGenerator::generateFastCommon(MacroAssembler& jit, size_t inlineICSize)
+{
+    m_start = jit.label();
+    size_t startSize = jit.m_assembler.buffer().codeSize();
+    m_slowPathJump = jit.jump();
+    size_t jumpSize = jit.m_assembler.buffer().codeSize() - startSize;
+    size_t nopsToEmitInBytes = inlineICSize - jumpSize;
+    jit.emitNops(nopsToEmitInBytes);
+    ASSERT(jit.m_assembler.buffer().codeSize() - startSize == inlineICSize);
+    m_done = jit.label();
+}
+
+JITGetByIdGenerator::JITGetByIdGenerator(
+    CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSite, const RegisterSet& usedRegisters,
+    UniquedStringImpl* propertyName, JSValueRegs base, JSValueRegs value, AccessType accessType)
+    : JITByIdGenerator(codeBlock, codeOrigin, callSite, accessType, usedRegisters, base, value)
+    , m_isLengthAccess(propertyName == codeBlock->vm()->propertyNames->length.impl())
+{
+    RELEASE_ASSERT(base.payloadGPR() != value.tagGPR());
+}
+
+void JITGetByIdGenerator::generateFastPath(MacroAssembler& jit)
+{
+    generateFastCommon(jit, m_isLengthAccess ? InlineAccess::sizeForLengthAccess() : InlineAccess::sizeForPropertyAccess());
+}
+
+JITPutByIdGenerator::JITPutByIdGenerator(
+    CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSite, const RegisterSet& usedRegisters,
+    JSValueRegs base, JSValueRegs value, GPRReg scratch, 
+    ECMAMode ecmaMode, PutKind putKind)
+    : JITByIdGenerator(
+        codeBlock, codeOrigin, callSite, AccessType::Put, usedRegisters, base, value)
+    , m_ecmaMode(ecmaMode)
+    , m_putKind(putKind)
+{
+    m_stubInfo->patch.usedRegisters.clear(scratch);
+}
+
+void JITPutByIdGenerator::generateFastPath(MacroAssembler& jit)
+{
+    generateFastCommon(jit, InlineAccess::sizeForPropertyReplace());
+}
+
+V_JITOperation_ESsiJJI JITPutByIdGenerator::slowPathFunction()
+{
+    if (m_ecmaMode == StrictMode) {
+        if (m_putKind == Direct)
+            return operationPutByIdDirectStrictOptimize;
+        return operationPutByIdStrictOptimize;
+    }
+    if (m_putKind == Direct)
+        return operationPutByIdDirectNonStrictOptimize;
+    return operationPutByIdNonStrictOptimize;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/JITInlineCacheGenerator.h b/jit/JITInlineCacheGenerator.h
new file mode 100644
index 0000000..469290d
--- /dev/null
+++ b/jit/JITInlineCacheGenerator.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CodeOrigin.h"
+#include "JITOperations.h"
+#include "JSCJSValue.h"
+#include "PutKind.h"
+#include "RegisterSet.h"
+
+namespace JSC {
+
+class CodeBlock;
+class StructureStubInfo;
+
+struct CallSiteIndex;
+
+enum class AccessType : int8_t;
+
+class JITInlineCacheGenerator {
+protected:
+    JITInlineCacheGenerator() { }
+    JITInlineCacheGenerator(CodeBlock*, CodeOrigin, CallSiteIndex, AccessType);
+    
+public:
+    StructureStubInfo* stubInfo() const { return m_stubInfo; }
+
+protected:
+    CodeBlock* m_codeBlock;
+    StructureStubInfo* m_stubInfo;
+};
+
+class JITByIdGenerator : public JITInlineCacheGenerator {
+protected:
+    JITByIdGenerator() { }
+
+    JITByIdGenerator(
+        CodeBlock*, CodeOrigin, CallSiteIndex, AccessType, const RegisterSet&, JSValueRegs base,
+        JSValueRegs value);
+    
+public:
+    void reportSlowPathCall(MacroAssembler::Label slowPathBegin, MacroAssembler::Call call)
+    {
+        m_slowPathBegin = slowPathBegin;
+        m_slowPathCall = call;
+    }
+    
+    MacroAssembler::Label slowPathBegin() const { return m_slowPathBegin; }
+    MacroAssembler::Jump slowPathJump() const
+    {
+        ASSERT(m_slowPathJump.isSet());
+        return m_slowPathJump;
+    }
+
+    void finalize(LinkBuffer& fastPathLinkBuffer, LinkBuffer& slowPathLinkBuffer);
+    void finalize(LinkBuffer&);
+    
+protected:
+    void generateFastCommon(MacroAssembler&, size_t size);
+    
+    JSValueRegs m_base;
+    JSValueRegs m_value;
+    
+    MacroAssembler::Label m_start;
+    MacroAssembler::Label m_done;
+    MacroAssembler::Label m_slowPathBegin;
+    MacroAssembler::Call m_slowPathCall;
+    MacroAssembler::Jump m_slowPathJump;
+};
+
+class JITGetByIdGenerator : public JITByIdGenerator {
+public:
+    JITGetByIdGenerator() { }
+
+    JITGetByIdGenerator(
+        CodeBlock*, CodeOrigin, CallSiteIndex, const RegisterSet& usedRegisters, UniquedStringImpl* propertyName,
+        JSValueRegs base, JSValueRegs value, AccessType);
+    
+    void generateFastPath(MacroAssembler&);
+
+private:
+    bool m_isLengthAccess;
+};
+
+class JITPutByIdGenerator : public JITByIdGenerator {
+public:
+    JITPutByIdGenerator() { }
+
+    JITPutByIdGenerator(
+        CodeBlock*, CodeOrigin, CallSiteIndex, const RegisterSet& usedRegisters, JSValueRegs base,
+        JSValueRegs, GPRReg scratch, ECMAMode, PutKind);
+    
+    void generateFastPath(MacroAssembler&);
+    
+    V_JITOperation_ESsiJJI slowPathFunction();
+
+private:
+    ECMAMode m_ecmaMode;
+    PutKind m_putKind;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITInlines.h b/jit/JITInlines.h
new file mode 100644
index 0000000..eade9af
--- /dev/null
+++ b/jit/JITInlines.h
@@ -0,0 +1,1386 @@
+/*
+ * Copyright (C) 2008, 2012-2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+#if USE(JSVALUE64)
+inline MacroAssembler::JumpList JIT::emitDoubleGetByVal(Instruction* instruction, PatchableJump& badType)
+{
+    JumpList slowCases = emitDoubleLoad(instruction, badType);
+    moveDoubleTo64(fpRegT0, regT0);
+    sub64(tagTypeNumberRegister, regT0);
+    return slowCases;
+}
+#else
+inline MacroAssembler::JumpList JIT::emitDoubleGetByVal(Instruction* instruction, PatchableJump& badType)
+{
+    JumpList slowCases = emitDoubleLoad(instruction, badType);
+    moveDoubleToInts(fpRegT0, regT0, regT1);
+    return slowCases;
+}
+#endif // USE(JSVALUE64)
+
+ALWAYS_INLINE MacroAssembler::JumpList JIT::emitLoadForArrayMode(Instruction* currentInstruction, JITArrayMode arrayMode, PatchableJump& badType)
+{
+    switch (arrayMode) {
+    case JITInt32:
+        return emitInt32Load(currentInstruction, badType);
+    case JITDouble:
+        return emitDoubleLoad(currentInstruction, badType);
+    case JITContiguous:
+        return emitContiguousLoad(currentInstruction, badType);
+    case JITArrayStorage:
+        return emitArrayStorageLoad(currentInstruction, badType);
+    default:
+        break;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return MacroAssembler::JumpList();
+}
+
+inline MacroAssembler::JumpList JIT::emitContiguousGetByVal(Instruction* instruction, PatchableJump& badType, IndexingType expectedShape)
+{
+    return emitContiguousLoad(instruction, badType, expectedShape);
+}
+
+inline MacroAssembler::JumpList JIT::emitArrayStorageGetByVal(Instruction* instruction, PatchableJump& badType)
+{
+    return emitArrayStorageLoad(instruction, badType);
+}
+
+ALWAYS_INLINE bool JIT::isOperandConstantDouble(int src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isDouble();
+}
+
+ALWAYS_INLINE JSValue JIT::getConstantOperand(int src)
+{
+    ASSERT(m_codeBlock->isConstantRegisterIndex(src));
+    return m_codeBlock->getConstant(src);
+}
+
+ALWAYS_INLINE void JIT::emitPutIntToCallFrameHeader(RegisterID from, int entry)
+{
+#if USE(JSVALUE32_64)
+    store32(TrustedImm32(Int32Tag), intTagFor(entry, callFrameRegister));
+    store32(from, intPayloadFor(entry, callFrameRegister));
+#else
+    store64(from, addressFor(entry, callFrameRegister));
+#endif
+}
+
+ALWAYS_INLINE void JIT::emitLoadCharacterString(RegisterID src, RegisterID dst, JumpList& failures)
+{
+    failures.append(branchStructure(NotEqual, Address(src, JSCell::structureIDOffset()), m_vm->stringStructure.get()));
+    failures.append(branch32(NotEqual, MacroAssembler::Address(src, ThunkHelpers::jsStringLengthOffset()), TrustedImm32(1)));
+    loadPtr(MacroAssembler::Address(src, ThunkHelpers::jsStringValueOffset()), dst);
+    failures.append(branchTest32(Zero, dst));
+    loadPtr(MacroAssembler::Address(dst, StringImpl::flagsOffset()), regT1);
+    loadPtr(MacroAssembler::Address(dst, StringImpl::dataOffset()), dst);
+
+    JumpList is16Bit;
+    JumpList cont8Bit;
+    is16Bit.append(branchTest32(Zero, regT1, TrustedImm32(StringImpl::flagIs8Bit())));
+    load8(MacroAssembler::Address(dst, 0), dst);
+    cont8Bit.append(jump());
+    is16Bit.link(this);
+    load16(MacroAssembler::Address(dst, 0), dst);
+    cont8Bit.link(this);
+}
+
+ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
+{
+    ASSERT(m_bytecodeOffset != std::numeric_limits<unsigned>::max()); // This method should only be called during hot/cold path generation, so that m_bytecodeOffset is set.
+    Call nakedCall = nearCall();
+    m_calls.append(CallRecord(nakedCall, m_bytecodeOffset, function.executableAddress()));
+    return nakedCall;
+}
+
+ALWAYS_INLINE JIT::Call JIT::emitNakedTailCall(CodePtr function)
+{
+    ASSERT(m_bytecodeOffset != std::numeric_limits<unsigned>::max()); // This method should only be called during hot/cold path generation, so that m_bytecodeOffset is set.
+    Call nakedCall = nearTailCall();
+    m_calls.append(CallRecord(nakedCall, m_bytecodeOffset, function.executableAddress()));
+    return nakedCall;
+}
+
+ALWAYS_INLINE void JIT::updateTopCallFrame()
+{
+    ASSERT(static_cast<int>(m_bytecodeOffset) >= 0);
+#if USE(JSVALUE32_64)
+    Instruction* instruction = m_codeBlock->instructions().begin() + m_bytecodeOffset; 
+    uint32_t locationBits = CallSiteIndex(instruction).bits();
+#else
+    uint32_t locationBits = CallSiteIndex(m_bytecodeOffset).bits();
+#endif
+    store32(TrustedImm32(locationBits), intTagFor(CallFrameSlot::argumentCount));
+    
+    // FIXME: It's not clear that this is needed. JITOperations tend to update the top call frame on
+    // the C++ side.
+    // https://bugs.webkit.org/show_bug.cgi?id=155693
+    storePtr(callFrameRegister, &m_vm->topCallFrame);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::appendCallWithExceptionCheck(const FunctionPtr& function)
+{
+    updateTopCallFrame();
+    MacroAssembler::Call call = appendCall(function);
+    exceptionCheck();
+    return call;
+}
+
+#if OS(WINDOWS) && CPU(X86_64)
+ALWAYS_INLINE MacroAssembler::Call JIT::appendCallWithExceptionCheckAndSlowPathReturnType(const FunctionPtr& function)
+{
+    updateTopCallFrame();
+    MacroAssembler::Call call = appendCallWithSlowPathReturnType(function);
+    exceptionCheck();
+    return call;
+}
+#endif
+
+ALWAYS_INLINE MacroAssembler::Call JIT::appendCallWithCallFrameRollbackOnException(const FunctionPtr& function)
+{
+    updateTopCallFrame(); // The callee is responsible for setting topCallFrame to their caller
+    MacroAssembler::Call call = appendCall(function);
+    exceptionCheckWithCallFrameRollback();
+    return call;
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::appendCallWithExceptionCheckSetJSValueResult(const FunctionPtr& function, int dst)
+{
+    MacroAssembler::Call call = appendCallWithExceptionCheck(function);
+#if USE(JSVALUE64)
+    emitPutVirtualRegister(dst, returnValueGPR);
+#else
+    emitStore(dst, returnValueGPR2, returnValueGPR);
+#endif
+    return call;
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile(const FunctionPtr& function, int dst)
+{
+    MacroAssembler::Call call = appendCallWithExceptionCheck(function);
+    emitValueProfilingSite();
+#if USE(JSVALUE64)
+    emitPutVirtualRegister(dst, returnValueGPR);
+#else
+    emitStore(dst, returnValueGPR2, returnValueGPR);
+#endif
+    return call;
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(P_JITOperation_E operation)
+{
+    setupArgumentsExecState();
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperationNoExceptionCheck(Z_JITOperation_E operation)
+{
+    setupArgumentsExecState();
+    updateTopCallFrame();
+    return appendCall(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(C_JITOperation_E operation)
+{
+    setupArgumentsExecState();
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(C_JITOperation_EJsc operation, GPRReg arg1)
+{
+    setupArgumentsWithExecState(arg1);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(C_JITOperation_EJscZ operation, GPRReg arg1, int32_t arg2)
+{
+    setupArgumentsWithExecState(arg1, TrustedImm32(arg2));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(C_JITOperation_EL operation, GPRReg arg1)
+{
+    setupArgumentsWithExecState(arg1);
+    return appendCallWithExceptionCheck(operation);
+}
+    
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(C_JITOperation_EL operation, TrustedImmPtr arg1)
+{
+    setupArgumentsWithExecState(arg1);
+    return appendCallWithExceptionCheck(operation);
+}
+    
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(C_JITOperation_EO operation, GPRReg arg)
+{
+    setupArgumentsWithExecState(arg);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(C_JITOperation_ESt operation, Structure* structure)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(structure));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(C_JITOperation_EZ operation, int32_t arg)
+{
+    setupArgumentsWithExecState(TrustedImm32(arg));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_E operation, int dst)
+{
+    setupArgumentsExecState();
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EAapJcpZ operation, int dst, ArrayAllocationProfile* arg1, GPRReg arg2, int32_t arg3)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(arg1), arg2, TrustedImm32(arg3));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EAapJcpZ operation, int dst, ArrayAllocationProfile* arg1, const JSValue* arg2, int32_t arg3)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(arg1), TrustedImmPtr(arg2), TrustedImm32(arg3));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EC operation, int dst, JSCell* cell)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(cell));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EC operation, JSCell* cell)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(cell));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJscC operation, int dst, GPRReg arg1, JSCell* cell)
+{
+    setupArgumentsWithExecState(arg1, TrustedImmPtr(cell));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJscCJ operation, int dst, GPRReg arg1, JSCell* cell, GPRReg arg2)
+{
+    setupArgumentsWithExecState(arg1, TrustedImmPtr(cell), arg2);
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+    
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EP operation, int dst, void* pointer)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(pointer));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(WithProfileTag, J_JITOperation_EPc operation, int dst, Instruction* bytecodePC)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(bytecodePC));
+    return appendCallWithExceptionCheckSetJSValueResultWithProfile(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EPc operation, int dst, Instruction* bytecodePC)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(bytecodePC));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EZ operation, int dst, int32_t arg)
+{
+    setupArgumentsWithExecState(TrustedImm32(arg));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EZZ operation, int dst, int32_t arg1, int32_t arg2)
+{
+    setupArgumentsWithExecState(TrustedImm32(arg1), TrustedImm32(arg2));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_ECC operation, RegisterID regOp1, RegisterID regOp2)
+{
+    setupArgumentsWithExecState(regOp1, regOp2);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_EOJss operation, RegisterID regOp1, RegisterID regOp2)
+{
+    setupArgumentsWithExecState(regOp1, regOp2);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(Sprt_JITOperation_EZ operation, int32_t op)
+{
+#if OS(WINDOWS) && CPU(X86_64)
+    setupArgumentsWithExecStateForCallWithSlowPathReturnType(TrustedImm32(op));
+    return appendCallWithExceptionCheckAndSlowPathReturnType(operation);
+#else
+    setupArgumentsWithExecState(TrustedImm32(op));
+    return appendCallWithExceptionCheck(operation);
+#endif
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_E operation)
+{
+    setupArgumentsExecState();
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EC operation, RegisterID regOp)
+{
+    setupArgumentsWithExecState(regOp);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ECC operation, RegisterID regOp1, RegisterID regOp2)
+{
+    setupArgumentsWithExecState(regOp1, regOp2);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EE operation, RegisterID regOp)
+{
+    setupArgumentsWithExecState(regOp);
+    updateTopCallFrame();
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EPc operation, Instruction* bytecodePC)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(bytecodePC));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EZ operation, int32_t op)
+{
+    setupArgumentsWithExecState(TrustedImm32(op));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperationWithCallFrameRollbackOnException(J_JITOperation_E operation)
+{
+    setupArgumentsExecState();
+    return appendCallWithCallFrameRollbackOnException(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperationWithCallFrameRollbackOnException(V_JITOperation_ECb operation, CodeBlock* pointer)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(pointer));
+    return appendCallWithCallFrameRollbackOnException(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperationWithCallFrameRollbackOnException(Z_JITOperation_E operation)
+{
+    setupArgumentsExecState();
+    return appendCallWithCallFrameRollbackOnException(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ECIZC operation, RegisterID regOp1, UniquedStringImpl* identOp2, int32_t op3, RegisterID regOp4)
+{
+    setupArgumentsWithExecState(regOp1, TrustedImmPtr(identOp2), TrustedImm32(op3), regOp4);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJ operation, JSValueRegs result, JSValueRegs arg)
+{
+    setupArgumentsWithExecState(arg);
+    Call call = appendCallWithExceptionCheck(operation);
+    setupResults(result);
+    return call;
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJ operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2)
+{
+    setupArgumentsWithExecState(arg1, arg2);
+    Call call = appendCallWithExceptionCheck(operation);
+    setupResults(result);
+    return call;
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJArp operation, JSValueRegs result, JSValueRegs operand, ArithProfile* arithProfile)
+{
+    setupArgumentsWithExecState(operand, TrustedImmPtr(arithProfile));
+    Call call = appendCallWithExceptionCheck(operation);
+    setupResults(result);
+    return call;
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJArp operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, ArithProfile* arithProfile)
+{
+    setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(arithProfile));
+    Call call = appendCallWithExceptionCheck(operation);
+    setupResults(result);
+    return call;
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJMic operation, JSValueRegs result, JSValueRegs arg, TrustedImmPtr mathIC)
+{
+    setupArgumentsWithExecState(arg, mathIC);
+    Call call = appendCallWithExceptionCheck(operation);
+    setupResults(result);
+    return call;
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJMic operation, JSValueRegs result, JSValueRegs arg1, JSValueRegs arg2, TrustedImmPtr mathIC)
+{
+    setupArgumentsWithExecState(arg1, arg2, mathIC);
+    Call call = appendCallWithExceptionCheck(operation);
+    setupResults(result);
+    return call;
+}
+
+#if USE(JSVALUE64)
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(Z_JITOperation_EJZZ operation, GPRReg arg1, int32_t arg2, int32_t arg3)
+{
+    setupArgumentsWithExecState(arg1, TrustedImm32(arg2), TrustedImm32(arg3));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(F_JITOperation_EFJZZ operation, GPRReg arg1, GPRReg arg2, int32_t arg3, GPRReg arg4)
+{
+    setupArgumentsWithExecState(arg1, arg2, TrustedImm32(arg3), arg4);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ESsiJJI operation, StructureStubInfo* stubInfo, RegisterID regOp1, RegisterID regOp2, UniquedStringImpl* uid)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(stubInfo), regOp1, regOp2, TrustedImmPtr(uid));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJ operation, RegisterID regOp1, RegisterID regOp2, RegisterID regOp3)
+{
+    setupArgumentsWithExecState(regOp1, regOp2, regOp3);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJAp operation, RegisterID regOp1, RegisterID regOp2, RegisterID regOp3, ArrayProfile* arrayProfile)
+{
+    setupArgumentsWithExecState(regOp1, regOp2, regOp3, TrustedImmPtr(arrayProfile));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJBy operation, RegisterID regOp1, RegisterID regOp2, RegisterID regOp3, ByValInfo* byValInfo)
+{
+    setupArgumentsWithExecState(regOp1, regOp2, regOp3, TrustedImmPtr(byValInfo));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EZJ operation, int dst, GPRReg arg)
+{
+    setupArgumentsWithExecState(TrustedImm32(dst), arg);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESsiJI operation, int dst, StructureStubInfo* stubInfo, GPRReg arg1, UniquedStringImpl* uid)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, TrustedImmPtr(uid));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(JIT::WithProfileTag, J_JITOperation_ESsiJI operation, int dst, StructureStubInfo* stubInfo, GPRReg arg1, UniquedStringImpl* uid)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, TrustedImmPtr(uid));
+    return appendCallWithExceptionCheckSetJSValueResultWithProfile(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(JIT::WithProfileTag, J_JITOperation_EJJ operation, int dst, GPRReg arg1, GPRReg arg2)
+{
+    setupArgumentsWithExecState(arg1, arg2);
+    return appendCallWithExceptionCheckSetJSValueResultWithProfile(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EAapJ operation, int dst, ArrayAllocationProfile* arg1, GPRReg arg2)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(arg1), arg2);
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJ operation, int dst, GPRReg arg1)
+{
+    setupArgumentsWithExecState(arg1);
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJI operation, int dst, GPRReg arg1, UniquedStringImpl* arg2)
+{
+    setupArgumentsWithExecState(arg1, TrustedImmPtr(arg2));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJ operation, int dst, GPRReg arg1, GPRReg arg2)
+{
+    setupArgumentsWithExecState(arg1, arg2);
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJAp operation, int dst, GPRReg arg1, GPRReg arg2, ArrayProfile* arrayProfile)
+{
+    setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(arrayProfile));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJBy operation, int dst, GPRReg arg1, GPRReg arg2, ByValInfo* byValInfo)
+{
+    setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(byValInfo));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(Z_JITOperation_EJOJ operation, GPRReg arg1, GPRReg arg2, GPRReg arg3)
+{
+    setupArgumentsWithExecState(arg1, arg2, arg3);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperationNoExceptionCheck(V_JITOperation_EJ operation, GPRReg arg1)
+{
+    setupArgumentsWithExecState(arg1);
+    updateTopCallFrame();
+    return appendCall(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(P_JITOperation_EJS operation, GPRReg arg1, size_t arg2)
+{
+    setupArgumentsWithExecState(arg1, TrustedImmPtr(arg2));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_EJ operation, RegisterID regOp)
+{
+    setupArgumentsWithExecState(regOp);
+    return appendCallWithExceptionCheck(operation);
+}
+
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_EJI operation, GPRReg arg1, UniquedStringImpl* arg2)
+{
+    setupArgumentsWithExecState(arg1, TrustedImmPtr(arg2));
+    return appendCallWithExceptionCheck(operation);
+}
+
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_EJJ operation, RegisterID regOp1, RegisterID regOp2)
+{
+    setupArgumentsWithExecState(regOp1, regOp2);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EZSymtabJ operation, int op1, SymbolTable* symbolTable, RegisterID regOp3)
+{
+    setupArgumentsWithExecState(TrustedImm32(op1), TrustedImmPtr(symbolTable), regOp3);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EZSymtabJ operation, int op1, SymbolTable* symbolTable, RegisterID regOp3)
+{
+    setupArgumentsWithExecState(TrustedImm32(op1), TrustedImmPtr(symbolTable), regOp3);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJ operation, RegisterID regOp)
+{
+    setupArgumentsWithExecState(regOp);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ECIZJJ operation, RegisterID regOp1, UniquedStringImpl* identOp2, int32_t op3, RegisterID regOp4, RegisterID regOp5)
+{
+    setupArgumentsWithExecState(regOp1, TrustedImmPtr(identOp2), TrustedImm32(op3), regOp4, regOp5);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ECJ operation, RegisterID arg1, RegisterID arg2)
+{
+    setupArgumentsWithExecState(arg1, arg2);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ECJZC operation, RegisterID regOp1, RegisterID regOp2, int32_t op3, RegisterID regOp4)
+{
+    setupArgumentsWithExecState(regOp1, regOp2, TrustedImm32(op3), regOp4);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJZ operation, RegisterID regOp1, int32_t op2)
+{
+    setupArgumentsWithExecState(regOp1, TrustedImm32(op2));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJZJ operation, RegisterID regOp1, int32_t op2, RegisterID regOp3)
+{
+    setupArgumentsWithExecState(regOp1, TrustedImm32(op2), regOp3);
+    return appendCallWithExceptionCheck(operation);
+}
+
+#else // USE(JSVALUE32_64)
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperationNoExceptionCheck(V_JITOperation_EJ operation, GPRReg arg1Tag, GPRReg arg1Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag);
+    updateTopCallFrame();
+    return appendCall(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(Z_JITOperation_EJOJ operation, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2, GPRReg arg3Tag, GPRReg arg3Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, arg2, EABI_32BIT_DUMMY_ARG arg3Payload, arg3Tag);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(Z_JITOperation_EJZZ operation, GPRReg arg1Tag, GPRReg arg1Payload, int32_t arg2, int32_t arg3)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, TrustedImm32(arg2), TrustedImm32(arg3));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(F_JITOperation_EFJZZ operation, GPRReg arg1, GPRReg arg2Tag, GPRReg arg2Payload, int32_t arg3, GPRReg arg4)
+{
+    setupArgumentsWithExecState(arg1, arg2Payload, arg2Tag, TrustedImm32(arg3), arg4);
+    return appendCallWithExceptionCheck(operation);
+}
+    
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EAapJ operation, int dst, ArrayAllocationProfile* arg1, GPRReg arg2Tag, GPRReg arg2Payload)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(arg1), arg2Payload, arg2Tag);
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJ operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag);
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESsiJI operation, int dst, StructureStubInfo* stubInfo, GPRReg arg1Tag, GPRReg arg1Payload, UniquedStringImpl* uid)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1Payload, arg1Tag, TrustedImmPtr(uid));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(JIT::WithProfileTag, J_JITOperation_ESsiJI operation, int dst, StructureStubInfo* stubInfo, GPRReg arg1Tag, GPRReg arg1Payload, UniquedStringImpl* uid)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1Payload, arg1Tag, TrustedImmPtr(uid));
+    return appendCallWithExceptionCheckSetJSValueResultWithProfile(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJI operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, UniquedStringImpl* arg2)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, TrustedImmPtr(arg2));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJ operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, SH4_32BIT_DUMMY_ARG arg2Payload, arg2Tag);
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJAp operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload, ArrayProfile* arrayProfile)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, SH4_32BIT_DUMMY_ARG arg2Payload, arg2Tag, TrustedImmPtr(arrayProfile));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJBy operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload, ByValInfo* byValInfo)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, SH4_32BIT_DUMMY_ARG arg2Payload, arg2Tag, TrustedImmPtr(byValInfo));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(JIT::WithProfileTag, J_JITOperation_EJJ operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, SH4_32BIT_DUMMY_ARG arg2Payload, arg2Tag);
+    return appendCallWithExceptionCheckSetJSValueResultWithProfile(operation, dst);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(P_JITOperation_EJS operation, GPRReg arg1Tag, GPRReg arg1Payload, size_t arg2)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, TrustedImmPtr(arg2));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_EJ operation, RegisterID argTag, RegisterID argPayload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG argPayload, argTag);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_EJI operation, GPRReg arg1Tag, GPRReg arg1Payload, UniquedStringImpl* arg2)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, TrustedImmPtr(arg2));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(S_JITOperation_EJJ operation, RegisterID arg1Tag, RegisterID arg1Payload, RegisterID arg2Tag, RegisterID arg2Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, SH4_32BIT_DUMMY_ARG arg2Payload, arg2Tag);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ECIZCC operation, RegisterID regOp1, UniquedStringImpl* identOp2, int32_t op3, RegisterID regOp4, RegisterID regOp5)
+{
+    setupArgumentsWithExecState(regOp1, TrustedImmPtr(identOp2), TrustedImm32(op3), regOp4, regOp5);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ECJ operation, RegisterID arg1, RegisterID arg2Tag, RegisterID arg2Payload)
+{
+    setupArgumentsWithExecState(arg1, arg2Payload, arg2Tag);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ECJZC operation, RegisterID arg1, RegisterID arg2Tag, RegisterID arg2Payload, int32_t arg3, RegisterID arg4)
+{
+    setupArgumentsWithExecState(arg1, arg2Payload, arg2Tag, TrustedImm32(arg3), arg4);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJ operation, RegisterID regOp1Tag, RegisterID regOp1Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EZSymtabJ operation, int32_t op1, SymbolTable* symbolTable, RegisterID regOp3Tag, RegisterID regOp3Payload)
+{
+    setupArgumentsWithExecState(TrustedImm32(op1), TrustedImmPtr(symbolTable), EABI_32BIT_DUMMY_ARG regOp3Payload, regOp3Tag);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_ESsiJJI operation, StructureStubInfo* stubInfo, RegisterID regOp1Tag, RegisterID regOp1Payload, RegisterID regOp2Tag, RegisterID regOp2Payload, UniquedStringImpl* uid)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(stubInfo), regOp1Payload, regOp1Tag, regOp2Payload, regOp2Tag, TrustedImmPtr(uid));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJ operation, RegisterID regOp1Tag, RegisterID regOp1Payload, RegisterID regOp2Tag, RegisterID regOp2Payload, RegisterID regOp3Tag, RegisterID regOp3Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag, SH4_32BIT_DUMMY_ARG regOp2Payload, regOp2Tag, regOp3Payload, regOp3Tag);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJAp operation, RegisterID regOp1Tag, RegisterID regOp1Payload, RegisterID regOp2Tag, RegisterID regOp2Payload, RegisterID regOp3Tag, RegisterID regOp3Payload, ArrayProfile* arrayProfile)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag, SH4_32BIT_DUMMY_ARG regOp2Payload, regOp2Tag, regOp3Payload, regOp3Tag, TrustedImmPtr(arrayProfile));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJBy operation, RegisterID regOp1Tag, RegisterID regOp1Payload, RegisterID regOp2Tag, RegisterID regOp2Payload, RegisterID regOp3Tag, RegisterID regOp3Payload, ByValInfo* byValInfo)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag, SH4_32BIT_DUMMY_ARG regOp2Payload, regOp2Tag, regOp3Payload, regOp3Tag, TrustedImmPtr(byValInfo));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EZJ operation, int dst, RegisterID regOp1Tag, RegisterID regOp1Payload)
+{
+    setupArgumentsWithExecState(TrustedImm32(dst), regOp1Payload, regOp1Tag);
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJZ operation, RegisterID regOp1Tag, RegisterID regOp1Payload, int32_t op2)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag, TrustedImm32(op2));
+    return appendCallWithExceptionCheck(operation);
+}
+
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJZJ operation, RegisterID regOp1Tag, RegisterID regOp1Payload, int32_t op2, RegisterID regOp3Tag, RegisterID regOp3Payload)
+{
+    setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag, TrustedImm32(op2), EABI_32BIT_DUMMY_ARG regOp3Payload, regOp3Tag);
+    return appendCallWithExceptionCheck(operation);
+}
+    
+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJscCJ operation, int dst, GPRReg arg1, JSCell* cell, GPRReg arg2Tag, GPRReg arg2Payload)
+{
+    setupArgumentsWithExecState(arg1, TrustedImmPtr(cell), EABI_32BIT_DUMMY_ARG arg2Payload, arg2Tag);
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
+#endif // USE(JSVALUE32_64)
+
+ALWAYS_INLINE JIT::Jump JIT::checkStructure(RegisterID reg, Structure* structure)
+{
+    return branchStructure(NotEqual, Address(reg, JSCell::structureIDOffset()), structure);
+}
+
+ALWAYS_INLINE void JIT::linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator& iter, int vReg)
+{
+    if (!m_codeBlock->isKnownNotImmediate(vReg))
+        linkSlowCase(iter);
+}
+
+ALWAYS_INLINE void JIT::linkAllSlowCasesForBytecodeOffset(Vector<SlowCaseEntry>& slowCases, Vector<SlowCaseEntry>::iterator& iter, unsigned bytecodeOffset)
+{
+    while (iter != slowCases.end() && iter->to == bytecodeOffset) {
+        iter->from.link(this);
+        ++iter;
+    }
+}
+
+ALWAYS_INLINE void JIT::addSlowCase(Jump jump)
+{
+    ASSERT(m_bytecodeOffset != std::numeric_limits<unsigned>::max()); // This method should only be called during hot/cold path generation, so that m_bytecodeOffset is set.
+
+    m_slowCases.append(SlowCaseEntry(jump, m_bytecodeOffset));
+}
+
+ALWAYS_INLINE void JIT::addSlowCase(const JumpList& jumpList)
+{
+    ASSERT(m_bytecodeOffset != std::numeric_limits<unsigned>::max()); // This method should only be called during hot/cold path generation, so that m_bytecodeOffset is set.
+
+    for (const Jump& jump : jumpList.jumps())
+        m_slowCases.append(SlowCaseEntry(jump, m_bytecodeOffset));
+}
+
+ALWAYS_INLINE void JIT::addSlowCase()
+{
+    ASSERT(m_bytecodeOffset != std::numeric_limits<unsigned>::max()); // This method should only be called during hot/cold path generation, so that m_bytecodeOffset is set.
+    
+    Jump emptyJump; // Doing it this way to make Windows happy.
+    m_slowCases.append(SlowCaseEntry(emptyJump, m_bytecodeOffset));
+}
+
+ALWAYS_INLINE void JIT::addJump(Jump jump, int relativeOffset)
+{
+    ASSERT(m_bytecodeOffset != std::numeric_limits<unsigned>::max()); // This method should only be called during hot/cold path generation, so that m_bytecodeOffset is set.
+
+    m_jmpTable.append(JumpTable(jump, m_bytecodeOffset + relativeOffset));
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowToHot(Jump jump, int relativeOffset)
+{
+    ASSERT(m_bytecodeOffset != std::numeric_limits<unsigned>::max()); // This method should only be called during hot/cold path generation, so that m_bytecodeOffset is set.
+
+    jump.linkTo(m_labels[m_bytecodeOffset + relativeOffset], this);
+}
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfCellObject(RegisterID cellReg)
+{
+    return branch8(AboveOrEqual, Address(cellReg, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+}
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfCellNotObject(RegisterID cellReg)
+{
+    return branch8(Below, Address(cellReg, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType));
+}
+
+#if ENABLE(SAMPLING_FLAGS)
+ALWAYS_INLINE void JIT::setSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    or32(TrustedImm32(1u << (flag - 1)), AbsoluteAddress(SamplingFlags::addressOfFlags()));
+}
+
+ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    and32(TrustedImm32(~(1u << (flag - 1))), AbsoluteAddress(SamplingFlags::addressOfFlags()));
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, int32_t count)
+{
+    add64(TrustedImm32(count), AbsoluteAddress(counter.addressOfCounter()));
+}
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+#if CPU(X86_64)
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    move(TrustedImmPtr(m_interpreter->sampler()->sampleSlot()), X86Registers::ecx);
+    storePtr(TrustedImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86Registers::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    storePtr(TrustedImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
+}
+#endif
+#endif
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+#if CPU(X86_64)
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    move(TrustedImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86Registers::ecx);
+    storePtr(TrustedImmPtr(codeBlock), X86Registers::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    storePtr(TrustedImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
+}
+#endif
+#endif
+
+ALWAYS_INLINE bool JIT::isOperandConstantChar(int src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isString() && asString(getConstantOperand(src).asCell())->length() == 1;
+}
+
+inline void JIT::emitValueProfilingSite(ValueProfile* valueProfile)
+{
+    ASSERT(shouldEmitProfiling());
+    ASSERT(valueProfile);
+
+    const RegisterID value = regT0;
+#if USE(JSVALUE32_64)
+    const RegisterID valueTag = regT1;
+#endif
+    
+    // We're in a simple configuration: only one bucket, so we can just do a direct
+    // store.
+#if USE(JSVALUE64)
+    store64(value, valueProfile->m_buckets);
+#else
+    EncodedValueDescriptor* descriptor = bitwise_cast<EncodedValueDescriptor*>(valueProfile->m_buckets);
+    store32(value, &descriptor->asBits.payload);
+    store32(valueTag, &descriptor->asBits.tag);
+#endif
+}
+
+inline void JIT::emitValueProfilingSite(unsigned bytecodeOffset)
+{
+    if (!shouldEmitProfiling())
+        return;
+    emitValueProfilingSite(m_codeBlock->valueProfileForBytecodeOffset(bytecodeOffset));
+}
+
+inline void JIT::emitValueProfilingSite()
+{
+    emitValueProfilingSite(m_bytecodeOffset);
+}
+
+inline void JIT::emitArrayProfilingSiteWithCell(RegisterID cell, RegisterID indexingType, ArrayProfile* arrayProfile)
+{
+    if (shouldEmitProfiling()) {
+        load32(MacroAssembler::Address(cell, JSCell::structureIDOffset()), indexingType);
+        store32(indexingType, arrayProfile->addressOfLastSeenStructureID());
+    }
+
+    load8(Address(cell, JSCell::indexingTypeAndMiscOffset()), indexingType);
+}
+
+inline void JIT::emitArrayProfilingSiteForBytecodeIndexWithCell(RegisterID cell, RegisterID indexingType, unsigned bytecodeIndex)
+{
+    emitArrayProfilingSiteWithCell(cell, indexingType, m_codeBlock->getOrAddArrayProfile(bytecodeIndex));
+}
+
+inline void JIT::emitArrayProfileStoreToHoleSpecialCase(ArrayProfile* arrayProfile)
+{
+    store8(TrustedImm32(1), arrayProfile->addressOfMayStoreToHole());
+}
+
+inline void JIT::emitArrayProfileOutOfBoundsSpecialCase(ArrayProfile* arrayProfile)
+{
+    store8(TrustedImm32(1), arrayProfile->addressOfOutOfBounds());
+}
+
+static inline bool arrayProfileSaw(ArrayModes arrayModes, IndexingType capability)
+{
+    return arrayModesInclude(arrayModes, capability);
+}
+
+inline JITArrayMode JIT::chooseArrayMode(ArrayProfile* profile)
+{
+    ConcurrentJSLocker locker(m_codeBlock->m_lock);
+    profile->computeUpdatedPrediction(locker, m_codeBlock);
+    ArrayModes arrayModes = profile->observedArrayModes(locker);
+    if (arrayProfileSaw(arrayModes, DoubleShape))
+        return JITDouble;
+    if (arrayProfileSaw(arrayModes, Int32Shape))
+        return JITInt32;
+    if (arrayProfileSaw(arrayModes, ArrayStorageShape))
+        return JITArrayStorage;
+    return JITContiguous;
+}
+
+ALWAYS_INLINE int32_t JIT::getOperandConstantInt(int src)
+{
+    return getConstantOperand(src).asInt32();
+}
+
+ALWAYS_INLINE double JIT::getOperandConstantDouble(int src)
+{
+    return getConstantOperand(src).asDouble();
+}
+
+#if USE(JSVALUE32_64)
+
+inline void JIT::emitLoadTag(int index, RegisterID tag)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        move(Imm32(getConstantOperand(index).tag()), tag);
+        return;
+    }
+
+    load32(tagFor(index), tag);
+}
+
+inline void JIT::emitLoadPayload(int index, RegisterID payload)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        move(Imm32(getConstantOperand(index).payload()), payload);
+        return;
+    }
+
+    load32(payloadFor(index), payload);
+}
+
+inline void JIT::emitLoad(const JSValue& v, RegisterID tag, RegisterID payload)
+{
+    move(Imm32(v.payload()), payload);
+    move(Imm32(v.tag()), tag);
+}
+
+ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, JSValueRegs dst)
+{
+    emitLoad(src, dst.tagGPR(), dst.payloadGPR());
+}
+
+ALWAYS_INLINE void JIT::emitPutVirtualRegister(int dst, JSValueRegs from)
+{
+    emitStore(dst, from.tagGPR(), from.payloadGPR());
+}
+
+inline void JIT::emitLoad(int index, RegisterID tag, RegisterID payload, RegisterID base)
+{
+    RELEASE_ASSERT(tag != payload);
+
+    if (base == callFrameRegister) {
+        RELEASE_ASSERT(payload != base);
+        emitLoadPayload(index, payload);
+        emitLoadTag(index, tag);
+        return;
+    }
+
+    if (payload == base) { // avoid stomping base
+        load32(tagFor(index, base), tag);
+        load32(payloadFor(index, base), payload);
+        return;
+    }
+
+    load32(payloadFor(index, base), payload);
+    load32(tagFor(index, base), tag);
+}
+
+inline void JIT::emitLoad2(int index1, RegisterID tag1, RegisterID payload1, int index2, RegisterID tag2, RegisterID payload2)
+{
+    emitLoad(index2, tag2, payload2);
+    emitLoad(index1, tag1, payload1);
+}
+
+inline void JIT::emitLoadDouble(int index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
+        loadDouble(TrustedImmPtr(&inConstantPool), value);
+    } else
+        loadDouble(addressFor(index), value);
+}
+
+inline void JIT::emitLoadInt32ToDouble(int index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
+        char* bytePointer = reinterpret_cast<char*>(&inConstantPool);
+        convertInt32ToDouble(AbsoluteAddress(bytePointer + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), value);
+    } else
+        convertInt32ToDouble(payloadFor(index), value);
+}
+
+inline void JIT::emitStore(int index, RegisterID tag, RegisterID payload, RegisterID base)
+{
+    store32(payload, payloadFor(index, base));
+    store32(tag, tagFor(index, base));
+}
+
+inline void JIT::emitStoreInt32(int index, RegisterID payload, bool indexIsInt32)
+{
+    store32(payload, payloadFor(index, callFrameRegister));
+    if (!indexIsInt32)
+        store32(TrustedImm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
+}
+
+inline void JIT::emitStoreInt32(int index, TrustedImm32 payload, bool indexIsInt32)
+{
+    store32(payload, payloadFor(index, callFrameRegister));
+    if (!indexIsInt32)
+        store32(TrustedImm32(JSValue::Int32Tag), tagFor(index, callFrameRegister));
+}
+
+inline void JIT::emitStoreCell(int index, RegisterID payload, bool indexIsCell)
+{
+    store32(payload, payloadFor(index, callFrameRegister));
+    if (!indexIsCell)
+        store32(TrustedImm32(JSValue::CellTag), tagFor(index, callFrameRegister));
+}
+
+inline void JIT::emitStoreBool(int index, RegisterID payload, bool indexIsBool)
+{
+    store32(payload, payloadFor(index, callFrameRegister));
+    if (!indexIsBool)
+        store32(TrustedImm32(JSValue::BooleanTag), tagFor(index, callFrameRegister));
+}
+
+inline void JIT::emitStoreDouble(int index, FPRegisterID value)
+{
+    storeDouble(value, addressFor(index));
+}
+
+inline void JIT::emitStore(int index, const JSValue constant, RegisterID base)
+{
+    store32(Imm32(constant.payload()), payloadFor(index, base));
+    store32(Imm32(constant.tag()), tagFor(index, base));
+}
+
+ALWAYS_INLINE void JIT::emitInitRegister(int dst)
+{
+    emitStore(dst, jsUndefined());
+}
+
+inline void JIT::emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex)
+{
+    if (!m_codeBlock->isKnownNotImmediate(virtualRegisterIndex)) {
+        if (m_codeBlock->isConstantRegisterIndex(virtualRegisterIndex))
+            addSlowCase(jump());
+        else
+            addSlowCase(emitJumpIfNotJSCell(virtualRegisterIndex));
+    }
+}
+
+inline void JIT::emitJumpSlowCaseIfNotJSCell(int virtualRegisterIndex, RegisterID tag)
+{
+    if (!m_codeBlock->isKnownNotImmediate(virtualRegisterIndex)) {
+        if (m_codeBlock->isConstantRegisterIndex(virtualRegisterIndex))
+            addSlowCase(jump());
+        else
+            addSlowCase(branch32(NotEqual, tag, TrustedImm32(JSValue::CellTag)));
+    }
+}
+
+ALWAYS_INLINE bool JIT::isOperandConstantInt(int src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isInt32();
+}
+
+ALWAYS_INLINE bool JIT::getOperandConstantInt(int op1, int op2, int& op, int32_t& constant)
+{
+    if (isOperandConstantInt(op1)) {
+        constant = getConstantOperand(op1).asInt32();
+        op = op2;
+        return true;
+    }
+
+    if (isOperandConstantInt(op2)) {
+        constant = getConstantOperand(op2).asInt32();
+        op = op1;
+        return true;
+    }
+    
+    return false;
+}
+
+#else // USE(JSVALUE32_64)
+
+// get arg puts an arg from the SF register array into a h/w register
+ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
+{
+    ASSERT(m_bytecodeOffset != std::numeric_limits<unsigned>::max()); // This method should only be called during hot/cold path generation, so that m_bytecodeOffset is set.
+
+    // TODO: we want to reuse values that are already in registers if we can - add a register allocator!
+    if (m_codeBlock->isConstantRegisterIndex(src)) {
+        JSValue value = m_codeBlock->getConstant(src);
+        if (!value.isNumber())
+            move(TrustedImm64(JSValue::encode(value)), dst);
+        else
+            move(Imm64(JSValue::encode(value)), dst);
+        return;
+    }
+
+    load64(Address(callFrameRegister, src * sizeof(Register)), dst);
+}
+
+ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, JSValueRegs dst)
+{
+    emitGetVirtualRegister(src, dst.payloadGPR());
+}
+
+ALWAYS_INLINE void JIT::emitGetVirtualRegister(VirtualRegister src, RegisterID dst)
+{
+    emitGetVirtualRegister(src.offset(), dst);
+}
+
+ALWAYS_INLINE void JIT::emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2)
+{
+    emitGetVirtualRegister(src1, dst1);
+    emitGetVirtualRegister(src2, dst2);
+}
+
+ALWAYS_INLINE void JIT::emitGetVirtualRegisters(VirtualRegister src1, RegisterID dst1, VirtualRegister src2, RegisterID dst2)
+{
+    emitGetVirtualRegisters(src1.offset(), dst1, src2.offset(), dst2);
+}
+
+ALWAYS_INLINE bool JIT::isOperandConstantInt(int src)
+{
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isInt32();
+}
+
+ALWAYS_INLINE void JIT::emitPutVirtualRegister(int dst, RegisterID from)
+{
+    store64(from, Address(callFrameRegister, dst * sizeof(Register)));
+}
+
+ALWAYS_INLINE void JIT::emitPutVirtualRegister(int dst, JSValueRegs from)
+{
+    emitPutVirtualRegister(dst, from.payloadGPR());
+}
+
+ALWAYS_INLINE void JIT::emitPutVirtualRegister(VirtualRegister dst, RegisterID from)
+{
+    emitPutVirtualRegister(dst.offset(), from);
+}
+
+ALWAYS_INLINE void JIT::emitInitRegister(int dst)
+{
+    store64(TrustedImm64(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
+}
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
+{
+    return branchTest64(Zero, reg, tagMaskRegister);
+}
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfBothJSCells(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+{
+    move(reg1, scratch);
+    or64(reg2, scratch);
+    return emitJumpIfJSCell(scratch);
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfJSCell(RegisterID reg)
+{
+    addSlowCase(emitJumpIfJSCell(reg));
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotJSCell(RegisterID reg)
+{
+    addSlowCase(emitJumpIfNotJSCell(reg));
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotJSCell(RegisterID reg, int vReg)
+{
+    if (!m_codeBlock->isKnownNotImmediate(vReg))
+        emitJumpSlowCaseIfNotJSCell(reg);
+}
+
+inline void JIT::emitLoadDouble(int index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        WriteBarrier<Unknown>& inConstantPool = m_codeBlock->constantRegister(index);
+        loadDouble(TrustedImmPtr(&inConstantPool), value);
+    } else
+        loadDouble(addressFor(index), value);
+}
+
+inline void JIT::emitLoadInt32ToDouble(int index, FPRegisterID value)
+{
+    if (m_codeBlock->isConstantRegisterIndex(index)) {
+        ASSERT(isOperandConstantInt(index));
+        convertInt32ToDouble(Imm32(getConstantOperand(index).asInt32()), value);
+    } else
+        convertInt32ToDouble(addressFor(index), value);
+}
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfInt(RegisterID reg)
+{
+    return branch64(AboveOrEqual, reg, tagTypeNumberRegister);
+}
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotInt(RegisterID reg)
+{
+    return branch64(Below, reg, tagTypeNumberRegister);
+}
+
+ALWAYS_INLINE JIT::PatchableJump JIT::emitPatchableJumpIfNotInt(RegisterID reg)
+{
+    return patchableBranch64(Below, reg, tagTypeNumberRegister);
+}
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotInt(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+{
+    move(reg1, scratch);
+    and64(reg2, scratch);
+    return emitJumpIfNotInt(scratch);
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotInt(RegisterID reg)
+{
+    addSlowCase(emitJumpIfNotInt(reg));
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotInt(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+{
+    addSlowCase(emitJumpIfNotInt(reg1, reg2, scratch));
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotNumber(RegisterID reg)
+{
+    addSlowCase(emitJumpIfNotNumber(reg));
+}
+
+ALWAYS_INLINE void JIT::emitTagBool(RegisterID reg)
+{
+    or32(TrustedImm32(static_cast<int32_t>(ValueFalse)), reg);
+}
+
+inline Instruction* JIT::copiedInstruction(Instruction* inst)
+{
+    ASSERT(inst >= m_codeBlock->instructions().begin() && inst < m_codeBlock->instructions().end());
+    return m_instructions.begin() + (inst - m_codeBlock->instructions().begin());
+}
+
+#endif // USE(JSVALUE32_64)
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITLeftShiftGenerator.cpp b/jit/JITLeftShiftGenerator.cpp
new file mode 100644
index 0000000..1ddaa6a
--- /dev/null
+++ b/jit/JITLeftShiftGenerator.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITLeftShiftGenerator.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+void JITLeftShiftGenerator::generateFastPath(CCallHelpers& jit)
+{
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_left.payloadGPR());
+    ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE32_64)
+    ASSERT(m_scratchGPR != m_left.tagGPR());
+    ASSERT(m_scratchGPR != m_right.tagGPR());
+#endif
+
+    ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+
+    m_didEmitFastPath = true;
+
+    if (m_rightOperand.isConstInt32()) {
+        // Try to do (intVar << intConstant).
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_left));
+
+        jit.moveValueRegs(m_left, m_result);
+        jit.lshift32(CCallHelpers::Imm32(m_rightOperand.asConstInt32()), m_result.payloadGPR());
+
+    } else {
+        // Try to do (intConstant << intVar) or (intVar << intVar).
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_right));
+
+        GPRReg rightOperandGPR = m_right.payloadGPR();
+        if (rightOperandGPR == m_result.payloadGPR()) {
+            jit.move(rightOperandGPR, m_scratchGPR);
+            rightOperandGPR = m_scratchGPR;
+        }
+
+        if (m_leftOperand.isConstInt32()) {
+#if USE(JSVALUE32_64)
+            jit.move(m_right.tagGPR(), m_result.tagGPR());
+#endif
+            jit.move(CCallHelpers::Imm32(m_leftOperand.asConstInt32()), m_result.payloadGPR());
+        } else {
+            m_slowPathJumpList.append(jit.branchIfNotInt32(m_left));
+            jit.moveValueRegs(m_left, m_result);
+        }
+
+        jit.lshift32(rightOperandGPR, m_result.payloadGPR());
+    }
+
+#if USE(JSVALUE64)
+    jit.or64(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR());
+#endif
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITLeftShiftGenerator.h b/jit/JITLeftShiftGenerator.h
new file mode 100644
index 0000000..07f97a5
--- /dev/null
+++ b/jit/JITLeftShiftGenerator.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JITBitBinaryOpGenerator.h"
+
+namespace JSC {
+
+class JITLeftShiftGenerator : public JITBitBinaryOpGenerator {
+public:
+    JITLeftShiftGenerator(const SnippetOperand& leftOperand, const SnippetOperand& rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right, GPRReg scratchGPR)
+        : JITBitBinaryOpGenerator(leftOperand, rightOperand, result, left, right, scratchGPR)
+    { }
+
+    void generateFastPath(CCallHelpers&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITMathIC.h b/jit/JITMathIC.h
new file mode 100644
index 0000000..3806f3a
--- /dev/null
+++ b/jit/JITMathIC.h
@@ -0,0 +1,290 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "ArithProfile.h"
+#include "CCallHelpers.h"
+#include "JITAddGenerator.h"
+#include "JITMathICInlineResult.h"
+#include "JITMulGenerator.h"
+#include "JITNegGenerator.h"
+#include "JITSubGenerator.h"
+#include "LinkBuffer.h"
+#include "Repatch.h"
+#include "SnippetOperand.h"
+
+namespace JSC {
+
+class LinkBuffer;
+
+struct MathICGenerationState {
+    MacroAssembler::Label fastPathStart;
+    MacroAssembler::Label fastPathEnd;
+    MacroAssembler::Label slowPathStart;
+    MacroAssembler::Call slowPathCall;
+    MacroAssembler::JumpList slowPathJumps;
+    bool shouldSlowPathRepatch;
+};
+
+#define ENABLE_MATH_IC_STATS 0
+
+template <typename GeneratorType, bool(*isProfileEmpty)(ArithProfile&)>
+class JITMathIC {
+public:
+    JITMathIC(ArithProfile* arithProfile)
+        : m_arithProfile(arithProfile)
+    {
+    }
+
+    CodeLocationLabel doneLocation() { return m_inlineStart.labelAtOffset(m_inlineSize); }
+    CodeLocationLabel slowPathStartLocation() { return m_inlineStart.labelAtOffset(m_deltaFromStartToSlowPathStart); }
+    CodeLocationCall slowPathCallLocation() { return m_inlineStart.callAtOffset(m_deltaFromStartToSlowPathCallLocation); }
+    
+    bool generateInline(CCallHelpers& jit, MathICGenerationState& state, bool shouldEmitProfiling = true)
+    {
+#if CPU(ARM_TRADITIONAL)
+        // FIXME: Remove this workaround once the proper fixes are landed.
+        // [ARM] Disable Inline Caching on ARMv7 traditional until proper fix
+        // https://bugs.webkit.org/show_bug.cgi?id=159759
+        return false;
+#endif
+
+        state.fastPathStart = jit.label();
+        size_t startSize = jit.m_assembler.buffer().codeSize();
+
+        if (m_arithProfile) {
+            if (isProfileEmpty(*m_arithProfile)) {
+                // It looks like the MathIC has yet to execute. We don't want to emit code in this
+                // case for a couple reasons. First, the operation may never execute, so if we don't emit
+                // code, it's a win. Second, if the operation does execute, we can emit better code
+                // once we have an idea about the types.
+                state.slowPathJumps.append(jit.patchableJump());
+                size_t inlineSize = jit.m_assembler.buffer().codeSize() - startSize;
+                ASSERT_UNUSED(inlineSize, static_cast<ptrdiff_t>(inlineSize) <= MacroAssembler::patchableJumpSize());
+                state.shouldSlowPathRepatch = true;
+                state.fastPathEnd = jit.label();
+                ASSERT(!m_generateFastPathOnRepatch); // We should have gathered some observed type info about the types before trying to regenerate again.
+                m_generateFastPathOnRepatch = true;
+                return true;
+            }
+        }
+
+        JITMathICInlineResult result = m_generator.generateInline(jit, state, m_arithProfile);
+
+        switch (result) {
+        case JITMathICInlineResult::GeneratedFastPath: {
+            size_t inlineSize = jit.m_assembler.buffer().codeSize() - startSize;
+            if (static_cast<ptrdiff_t>(inlineSize) < MacroAssembler::patchableJumpSize()) {
+                size_t nopsToEmitInBytes = MacroAssembler::patchableJumpSize() - inlineSize;
+                jit.emitNops(nopsToEmitInBytes);
+            }
+            state.shouldSlowPathRepatch = true;
+            state.fastPathEnd = jit.label();
+            return true;
+        }
+        case JITMathICInlineResult::GenerateFullSnippet: {
+            MacroAssembler::JumpList endJumpList;
+            bool result = m_generator.generateFastPath(jit, endJumpList, state.slowPathJumps, m_arithProfile, shouldEmitProfiling);
+            if (result) {
+                state.fastPathEnd = jit.label();
+                state.shouldSlowPathRepatch = false;
+                endJumpList.link(&jit);
+                return true;
+            }
+            return false;
+        }
+        case JITMathICInlineResult::DontGenerate: {
+            return false;
+        }
+        default:
+            ASSERT_NOT_REACHED();
+        }
+
+        return false;
+    }
+
+    void generateOutOfLine(VM& vm, CodeBlock* codeBlock, FunctionPtr callReplacement)
+    {
+        auto linkJumpToOutOfLineSnippet = [&] () {
+            CCallHelpers jit(&vm, codeBlock);
+            auto jump = jit.jump();
+            // We don't need a nop sled here because nobody should be jumping into the middle of an IC.
+            bool needsBranchCompaction = false;
+            RELEASE_ASSERT(jit.m_assembler.buffer().codeSize() <= static_cast<size_t>(m_inlineSize));
+            LinkBuffer linkBuffer(jit, m_inlineStart.dataLocation(), jit.m_assembler.buffer().codeSize(), JITCompilationMustSucceed, needsBranchCompaction);
+            RELEASE_ASSERT(linkBuffer.isValid());
+            linkBuffer.link(jump, CodeLocationLabel(m_code.code()));
+            FINALIZE_CODE(linkBuffer, ("JITMathIC: linking constant jump to out of line stub"));
+        };
+
+        auto replaceCall = [&] () {
+            ftlThunkAwareRepatchCall(codeBlock, slowPathCallLocation(), callReplacement);
+        };
+
+        bool shouldEmitProfiling = !JITCode::isOptimizingJIT(codeBlock->jitType());
+
+        if (m_generateFastPathOnRepatch) {
+
+            CCallHelpers jit(&vm, codeBlock);
+            MathICGenerationState generationState;
+            bool generatedInline = generateInline(jit, generationState, shouldEmitProfiling);
+
+            // We no longer want to try to regenerate the fast path.
+            m_generateFastPathOnRepatch = false;
+
+            if (generatedInline) {
+                auto jumpToDone = jit.jump();
+
+                LinkBuffer linkBuffer(vm, jit, codeBlock, JITCompilationCanFail);
+                if (!linkBuffer.didFailToAllocate()) {
+                    linkBuffer.link(generationState.slowPathJumps, slowPathStartLocation());
+                    linkBuffer.link(jumpToDone, doneLocation());
+
+                    m_code = FINALIZE_CODE_FOR(
+                        codeBlock, linkBuffer, ("JITMathIC: generating out of line fast IC snippet"));
+
+                    if (!generationState.shouldSlowPathRepatch) {
+                        // We won't need to regenerate, so we can wire the slow path call
+                        // to a non repatching variant.
+                        replaceCall();
+                    }
+
+                    linkJumpToOutOfLineSnippet();
+
+                    return;
+                }
+            }
+            
+            // We weren't able to generate an out of line fast path.
+            // We just generate the snippet in its full generality.
+        }
+
+        // We rewire to the alternate regardless of whether or not we can allocate the out of line path
+        // because if we fail allocating the out of line path, we don't want to waste time trying to
+        // allocate it in the future.
+        replaceCall();
+
+        {
+            CCallHelpers jit(&vm, codeBlock);
+
+            MacroAssembler::JumpList endJumpList; 
+            MacroAssembler::JumpList slowPathJumpList; 
+
+            bool emittedFastPath = m_generator.generateFastPath(jit, endJumpList, slowPathJumpList, m_arithProfile, shouldEmitProfiling);
+            if (!emittedFastPath)
+                return;
+            endJumpList.append(jit.jump());
+
+            LinkBuffer linkBuffer(vm, jit, codeBlock, JITCompilationCanFail);
+            if (linkBuffer.didFailToAllocate())
+                return;
+
+            linkBuffer.link(endJumpList, doneLocation());
+            linkBuffer.link(slowPathJumpList, slowPathStartLocation());
+
+            m_code = FINALIZE_CODE_FOR(
+                codeBlock, linkBuffer, ("JITMathIC: generating out of line IC snippet"));
+        }
+
+        linkJumpToOutOfLineSnippet();
+    }
+
+    void finalizeInlineCode(const MathICGenerationState& state, LinkBuffer& linkBuffer)
+    {
+        CodeLocationLabel start = linkBuffer.locationOf(state.fastPathStart);
+        m_inlineStart = start;
+
+        m_inlineSize = MacroAssembler::differenceBetweenCodePtr(
+            start, linkBuffer.locationOf(state.fastPathEnd));
+        ASSERT(m_inlineSize > 0);
+
+        m_deltaFromStartToSlowPathCallLocation = MacroAssembler::differenceBetweenCodePtr(
+            start, linkBuffer.locationOf(state.slowPathCall));
+        m_deltaFromStartToSlowPathStart = MacroAssembler::differenceBetweenCodePtr(
+            start, linkBuffer.locationOf(state.slowPathStart));
+    }
+
+    ArithProfile* arithProfile() const { return m_arithProfile; }
+
+#if ENABLE(MATH_IC_STATS)
+    size_t m_generatedCodeSize { 0 };
+    size_t codeSize() const
+    {
+        size_t result = m_generatedCodeSize;
+        if (m_code)
+            result += m_code.size();
+        return result;
+    }
+#endif
+
+    ArithProfile* m_arithProfile;
+    MacroAssemblerCodeRef m_code;
+    CodeLocationLabel m_inlineStart;
+    int32_t m_inlineSize;
+    int32_t m_deltaFromStartToSlowPathCallLocation;
+    int32_t m_deltaFromStartToSlowPathStart;
+    bool m_generateFastPathOnRepatch { false };
+    GeneratorType m_generator;
+};
+
+inline bool isBinaryProfileEmpty(ArithProfile& arithProfile)
+{
+    return arithProfile.lhsObservedType().isEmpty() || arithProfile.rhsObservedType().isEmpty();
+}
+template <typename GeneratorType>
+class JITBinaryMathIC : public JITMathIC<GeneratorType, isBinaryProfileEmpty> {
+public:
+    JITBinaryMathIC(ArithProfile* arithProfile)
+        : JITMathIC<GeneratorType, isBinaryProfileEmpty>(arithProfile)
+    {
+    }
+};
+
+typedef JITBinaryMathIC<JITAddGenerator> JITAddIC;
+typedef JITBinaryMathIC<JITMulGenerator> JITMulIC;
+typedef JITBinaryMathIC<JITSubGenerator> JITSubIC;
+
+
+inline bool isUnaryProfileEmpty(ArithProfile& arithProfile)
+{
+    return arithProfile.lhsObservedType().isEmpty();
+}
+template <typename GeneratorType>
+class JITUnaryMathIC : public JITMathIC<GeneratorType, isUnaryProfileEmpty> {
+public:
+    JITUnaryMathIC(ArithProfile* arithProfile)
+        : JITMathIC<GeneratorType, isUnaryProfileEmpty>(arithProfile)
+    {
+    }
+};
+
+typedef JITUnaryMathIC<JITNegGenerator> JITNegIC;
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITMathICForwards.h b/jit/JITMathICForwards.h
new file mode 100644
index 0000000..08bfd13
--- /dev/null
+++ b/jit/JITMathICForwards.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+template <typename Generator> class JITBinaryMathIC;
+template <typename Generator> class JITUnaryMathIC;
+class JITAddGenerator;
+class JITMulGenerator;
+class JITNegGenerator;
+class JITSubGenerator;
+
+typedef JITBinaryMathIC<JITAddGenerator> JITAddIC;
+typedef JITBinaryMathIC<JITMulGenerator> JITMulIC;
+typedef JITUnaryMathIC<JITNegGenerator> JITNegIC;
+typedef JITBinaryMathIC<JITSubGenerator> JITSubIC;
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITMathICInlineResult.h b/jit/JITMathICInlineResult.h
new file mode 100644
index 0000000..0189c13
--- /dev/null
+++ b/jit/JITMathICInlineResult.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+enum class JITMathICInlineResult {
+    GeneratedFastPath,
+    GenerateFullSnippet,
+    DontGenerate
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITMulGenerator.cpp b/jit/JITMulGenerator.cpp
new file mode 100644
index 0000000..93c69e2
--- /dev/null
+++ b/jit/JITMulGenerator.cpp
@@ -0,0 +1,254 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITMulGenerator.h"
+
+#if ENABLE(JIT)
+
+#include "ArithProfile.h"
+#include "JITMathIC.h"
+
+namespace JSC {
+
+JITMathICInlineResult JITMulGenerator::generateInline(CCallHelpers& jit, MathICGenerationState& state, const ArithProfile* arithProfile)
+{
+    // We default to speculating int32.
+    ObservedType lhs = ObservedType().withInt32();
+    ObservedType rhs = ObservedType().withInt32();
+    if (arithProfile) {
+        lhs = arithProfile->lhsObservedType();
+        rhs = arithProfile->rhsObservedType();
+    }
+
+    if (lhs.isOnlyNonNumber() && rhs.isOnlyNonNumber())
+        return JITMathICInlineResult::DontGenerate;
+
+    if (lhs.isOnlyNumber() && rhs.isOnlyNumber()) {
+        if (!jit.supportsFloatingPoint())
+            return JITMathICInlineResult::DontGenerate;
+
+        if (!m_leftOperand.definitelyIsNumber())
+            state.slowPathJumps.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+        if (!m_rightOperand.definitelyIsNumber())
+            state.slowPathJumps.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+        state.slowPathJumps.append(jit.branchIfInt32(m_left));
+        state.slowPathJumps.append(jit.branchIfInt32(m_right));
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+        jit.mulDouble(m_rightFPR, m_leftFPR);
+        jit.boxDouble(m_leftFPR, m_result);
+
+        return JITMathICInlineResult::GeneratedFastPath;
+    }
+
+    if ((lhs.isOnlyInt32() || m_leftOperand.isPositiveConstInt32()) && (rhs.isOnlyInt32() || m_rightOperand.isPositiveConstInt32())) {
+        ASSERT(!m_leftOperand.isPositiveConstInt32() || !m_rightOperand.isPositiveConstInt32());
+        if (!m_leftOperand.isPositiveConstInt32())
+            state.slowPathJumps.append(jit.branchIfNotInt32(m_left));
+        if (!m_rightOperand.isPositiveConstInt32())
+            state.slowPathJumps.append(jit.branchIfNotInt32(m_right));
+
+        if (m_leftOperand.isPositiveConstInt32() || m_rightOperand.isPositiveConstInt32()) {
+            JSValueRegs var = m_leftOperand.isPositiveConstInt32() ? m_right : m_left;
+            int32_t constValue = m_leftOperand.isPositiveConstInt32() ? m_leftOperand.asConstInt32() : m_rightOperand.asConstInt32();
+            state.slowPathJumps.append(jit.branchMul32(CCallHelpers::Overflow, var.payloadGPR(), CCallHelpers::Imm32(constValue), m_scratchGPR));
+        } else {
+            state.slowPathJumps.append(jit.branchMul32(CCallHelpers::Overflow, m_right.payloadGPR(), m_left.payloadGPR(), m_scratchGPR));
+            state.slowPathJumps.append(jit.branchTest32(CCallHelpers::Zero, m_scratchGPR)); // Go slow if potential negative zero.
+        }
+        jit.boxInt32(m_scratchGPR, m_result);
+
+        return JITMathICInlineResult::GeneratedFastPath;
+    }
+
+    return JITMathICInlineResult::GenerateFullSnippet;
+}
+
+bool JITMulGenerator::generateFastPath(CCallHelpers& jit, CCallHelpers::JumpList& endJumpList, CCallHelpers::JumpList& slowPathJumpList, const ArithProfile* arithProfile, bool shouldEmitProfiling)
+{
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_left.payloadGPR());
+    ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE64)
+    ASSERT(m_scratchGPR != m_result.payloadGPR());
+#else
+    ASSERT(m_scratchGPR != m_left.tagGPR());
+    ASSERT(m_scratchGPR != m_right.tagGPR());
+    ASSERT(m_scratchFPR != InvalidFPRReg);
+#endif
+
+    ASSERT(!m_leftOperand.isPositiveConstInt32() || !m_rightOperand.isPositiveConstInt32());
+
+    if (!m_leftOperand.mightBeNumber() || !m_rightOperand.mightBeNumber())
+        return false;
+
+    if (m_leftOperand.isPositiveConstInt32() || m_rightOperand.isPositiveConstInt32()) {
+        JSValueRegs var = m_leftOperand.isPositiveConstInt32() ? m_right : m_left;
+        SnippetOperand& varOpr = m_leftOperand.isPositiveConstInt32() ? m_rightOperand : m_leftOperand;
+        SnippetOperand& constOpr = m_leftOperand.isPositiveConstInt32() ? m_leftOperand : m_rightOperand;
+
+        // Try to do intVar * intConstant.
+        CCallHelpers::Jump notInt32 = jit.branchIfNotInt32(var);
+
+        GPRReg multiplyResultGPR = m_result.payloadGPR();
+        if (multiplyResultGPR == var.payloadGPR())
+            multiplyResultGPR = m_scratchGPR;
+
+        slowPathJumpList.append(jit.branchMul32(CCallHelpers::Overflow, var.payloadGPR(), CCallHelpers::Imm32(constOpr.asConstInt32()), multiplyResultGPR));
+
+        jit.boxInt32(multiplyResultGPR, m_result);
+        endJumpList.append(jit.jump());
+
+        if (!jit.supportsFloatingPoint()) {
+            slowPathJumpList.append(notInt32);
+            return true;
+        }
+
+        // Try to do doubleVar * double(intConstant).
+        notInt32.link(&jit);
+        if (!varOpr.definitelyIsNumber())
+            slowPathJumpList.append(jit.branchIfNotNumber(var, m_scratchGPR));
+
+        jit.unboxDoubleNonDestructive(var, m_leftFPR, m_scratchGPR, m_scratchFPR);
+
+        jit.move(CCallHelpers::Imm32(constOpr.asConstInt32()), m_scratchGPR);
+        jit.convertInt32ToDouble(m_scratchGPR, m_rightFPR);
+
+        // Fall thru to doubleVar * doubleVar.
+
+    } else {
+        ASSERT(!m_leftOperand.isPositiveConstInt32() && !m_rightOperand.isPositiveConstInt32());
+
+        CCallHelpers::Jump leftNotInt;
+        CCallHelpers::Jump rightNotInt;
+
+        // Try to do intVar * intVar.
+        leftNotInt = jit.branchIfNotInt32(m_left);
+        rightNotInt = jit.branchIfNotInt32(m_right);
+
+        slowPathJumpList.append(jit.branchMul32(CCallHelpers::Overflow, m_right.payloadGPR(), m_left.payloadGPR(), m_scratchGPR));
+        slowPathJumpList.append(jit.branchTest32(CCallHelpers::Zero, m_scratchGPR)); // Go slow if potential negative zero.
+
+        jit.boxInt32(m_scratchGPR, m_result);
+        endJumpList.append(jit.jump());
+
+        if (!jit.supportsFloatingPoint()) {
+            slowPathJumpList.append(leftNotInt);
+            slowPathJumpList.append(rightNotInt);
+            return true;
+        }
+
+        leftNotInt.link(&jit);
+        if (!m_leftOperand.definitelyIsNumber())
+            slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+        if (!m_rightOperand.definitelyIsNumber())
+            slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
+
+        jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
+        CCallHelpers::Jump rightWasInteger = jit.jump();
+
+        rightNotInt.link(&jit);
+        if (!m_rightOperand.definitelyIsNumber())
+            slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+        jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
+
+        rightIsDouble.link(&jit);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+
+        rightWasInteger.link(&jit);
+
+        // Fall thru to doubleVar * doubleVar.
+    }
+
+    // Do doubleVar * doubleVar.
+    jit.mulDouble(m_rightFPR, m_leftFPR);
+
+    if (!arithProfile || !shouldEmitProfiling)
+        jit.boxDouble(m_leftFPR, m_result);
+    else {
+        // The Int52 overflow check below intentionally omits 1ll << 51 as a valid negative Int52 value.
+        // Therefore, we will get a false positive if the result is that value. This is intentionally
+        // done to simplify the checking algorithm.
+
+        const int64_t negativeZeroBits = 1ll << 63;
+#if USE(JSVALUE64)
+        jit.moveDoubleTo64(m_leftFPR, m_result.payloadGPR());
+
+        CCallHelpers::Jump notNegativeZero = jit.branch64(CCallHelpers::NotEqual, m_result.payloadGPR(), CCallHelpers::TrustedImm64(negativeZeroBits));
+
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::NegZeroDouble), CCallHelpers::AbsoluteAddress(arithProfile->addressOfBits()));
+        CCallHelpers::Jump done = jit.jump();
+
+        notNegativeZero.link(&jit);
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::NonNegZeroDouble), CCallHelpers::AbsoluteAddress(arithProfile->addressOfBits()));
+
+        jit.move(m_result.payloadGPR(), m_scratchGPR);
+        jit.urshiftPtr(CCallHelpers::Imm32(52), m_scratchGPR);
+        jit.and32(CCallHelpers::Imm32(0x7ff), m_scratchGPR);
+        CCallHelpers::Jump noInt52Overflow = jit.branch32(CCallHelpers::LessThanOrEqual, m_scratchGPR, CCallHelpers::TrustedImm32(0x431));
+
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::Int52Overflow), CCallHelpers::AbsoluteAddress(arithProfile->addressOfBits()));
+        noInt52Overflow.link(&jit);
+
+        done.link(&jit);
+        jit.sub64(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR()); // Box the double.
+#else
+        jit.boxDouble(m_leftFPR, m_result);
+        CCallHelpers::JumpList notNegativeZero;
+        notNegativeZero.append(jit.branch32(CCallHelpers::NotEqual, m_result.payloadGPR(), CCallHelpers::TrustedImm32(0)));
+        notNegativeZero.append(jit.branch32(CCallHelpers::NotEqual, m_result.tagGPR(), CCallHelpers::TrustedImm32(negativeZeroBits >> 32)));
+
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::NegZeroDouble), CCallHelpers::AbsoluteAddress(arithProfile->addressOfBits()));
+        CCallHelpers::Jump done = jit.jump();
+
+        notNegativeZero.link(&jit);
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::NonNegZeroDouble), CCallHelpers::AbsoluteAddress(arithProfile->addressOfBits()));
+
+        jit.move(m_result.tagGPR(), m_scratchGPR);
+        jit.urshiftPtr(CCallHelpers::Imm32(52 - 32), m_scratchGPR);
+        jit.and32(CCallHelpers::Imm32(0x7ff), m_scratchGPR);
+        CCallHelpers::Jump noInt52Overflow = jit.branch32(CCallHelpers::LessThanOrEqual, m_scratchGPR, CCallHelpers::TrustedImm32(0x431));
+        
+        jit.or32(CCallHelpers::TrustedImm32(ArithProfile::Int52Overflow), CCallHelpers::AbsoluteAddress(arithProfile->addressOfBits()));
+
+        endJumpList.append(noInt52Overflow);
+        if (m_scratchGPR == m_result.tagGPR() || m_scratchGPR == m_result.payloadGPR())
+            jit.boxDouble(m_leftFPR, m_result);
+
+        endJumpList.append(done);
+#endif
+    }
+
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITMulGenerator.h b/jit/JITMulGenerator.h
new file mode 100644
index 0000000..36d26ea
--- /dev/null
+++ b/jit/JITMulGenerator.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "JITMathICInlineResult.h"
+#include "SnippetOperand.h"
+
+namespace JSC {
+
+struct MathICGenerationState;
+
+class JITMulGenerator {
+public:
+    JITMulGenerator()
+    { }
+
+    JITMulGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right,
+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
+        : m_leftOperand(leftOperand)
+        , m_rightOperand(rightOperand)
+        , m_result(result)
+        , m_left(left)
+        , m_right(right)
+        , m_leftFPR(leftFPR)
+        , m_rightFPR(rightFPR)
+        , m_scratchGPR(scratchGPR)
+        , m_scratchFPR(scratchFPR)
+    {
+        ASSERT(!m_leftOperand.isPositiveConstInt32() || !m_rightOperand.isPositiveConstInt32());
+    }
+
+    JITMathICInlineResult generateInline(CCallHelpers&, MathICGenerationState&, const ArithProfile*);
+    bool generateFastPath(CCallHelpers&, CCallHelpers::JumpList& endJumpList, CCallHelpers::JumpList& slowJumpList, const ArithProfile*, bool shouldEmitProfiling);
+
+    static bool isLeftOperandValidConstant(SnippetOperand leftOperand) { return leftOperand.isPositiveConstInt32(); }
+    static bool isRightOperandValidConstant(SnippetOperand rightOperand) { return rightOperand.isPositiveConstInt32(); }
+    
+private:
+    SnippetOperand m_leftOperand;
+    SnippetOperand m_rightOperand;
+    JSValueRegs m_result;
+    JSValueRegs m_left;
+    JSValueRegs m_right;
+    FPRReg m_leftFPR;
+    FPRReg m_rightFPR;
+    GPRReg m_scratchGPR;
+    FPRReg m_scratchFPR;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITNegGenerator.cpp b/jit/JITNegGenerator.cpp
new file mode 100644
index 0000000..92c29dd
--- /dev/null
+++ b/jit/JITNegGenerator.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITNegGenerator.h"
+
+#include "ArithProfile.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+JITMathICInlineResult JITNegGenerator::generateInline(CCallHelpers& jit, MathICGenerationState& state, const ArithProfile* arithProfile)
+{
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_src.payloadGPR());
+    ASSERT(m_scratchGPR != m_result.payloadGPR());
+#if USE(JSVALUE32_64)
+    ASSERT(m_scratchGPR != m_src.tagGPR());
+    ASSERT(m_scratchGPR != m_result.tagGPR());
+#endif
+
+    // We default to speculating int32.
+    ObservedType observedTypes = ObservedType().withInt32();
+    if (arithProfile)
+        observedTypes = arithProfile->lhsObservedType();
+    ASSERT_WITH_MESSAGE(!observedTypes.isEmpty(), "We should not attempt to generate anything if we do not have a profile.");
+
+    if (observedTypes.isOnlyNonNumber())
+        return JITMathICInlineResult::DontGenerate;
+
+    if (observedTypes.isOnlyInt32()) {
+        jit.moveValueRegs(m_src, m_result);
+        state.slowPathJumps.append(jit.branchIfNotInt32(m_src));
+        state.slowPathJumps.append(jit.branchTest32(CCallHelpers::Zero, m_src.payloadGPR(), CCallHelpers::TrustedImm32(0x7fffffff)));
+        jit.neg32(m_result.payloadGPR());
+#if USE(JSVALUE64)
+        jit.boxInt32(m_result.payloadGPR(), m_result);
+#endif
+
+        return JITMathICInlineResult::GeneratedFastPath;
+    }
+    if (observedTypes.isOnlyNumber()) {
+        state.slowPathJumps.append(jit.branchIfInt32(m_src));
+        state.slowPathJumps.append(jit.branchIfNotNumber(m_src, m_scratchGPR));
+#if USE(JSVALUE64)
+        if (m_src.payloadGPR() != m_result.payloadGPR()) {
+            jit.move(CCallHelpers::TrustedImm64(static_cast<int64_t>(1ull << 63)), m_result.payloadGPR());
+            jit.xor64(m_src.payloadGPR(), m_result.payloadGPR());
+        } else {
+            jit.move(CCallHelpers::TrustedImm64(static_cast<int64_t>(1ull << 63)), m_scratchGPR);
+            jit.xor64(m_scratchGPR, m_result.payloadGPR());
+        }
+#else
+        jit.moveValueRegs(m_src, m_result);
+        jit.xor32(CCallHelpers::TrustedImm32(1 << 31), m_result.tagGPR());
+#endif
+        return JITMathICInlineResult::GeneratedFastPath;
+    }
+    return JITMathICInlineResult::GenerateFullSnippet;
+}
+
+bool JITNegGenerator::generateFastPath(CCallHelpers& jit, CCallHelpers::JumpList& endJumpList, CCallHelpers::JumpList& slowPathJumpList, const ArithProfile* arithProfile, bool shouldEmitProfiling)
+{
+    ASSERT(m_scratchGPR != m_src.payloadGPR());
+    ASSERT(m_scratchGPR != m_result.payloadGPR());
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+#if USE(JSVALUE32_64)
+    ASSERT(m_scratchGPR != m_src.tagGPR());
+    ASSERT(m_scratchGPR != m_result.tagGPR());
+#endif
+
+    jit.moveValueRegs(m_src, m_result);
+    CCallHelpers::Jump srcNotInt = jit.branchIfNotInt32(m_src);
+
+    // -0 should produce a double, and hence cannot be negated as an int.
+    // The negative int32 0x80000000 doesn't have a positive int32 representation, and hence cannot be negated as an int.
+    slowPathJumpList.append(jit.branchTest32(CCallHelpers::Zero, m_src.payloadGPR(), CCallHelpers::TrustedImm32(0x7fffffff)));
+
+    jit.neg32(m_result.payloadGPR());
+#if USE(JSVALUE64)
+    jit.boxInt32(m_result.payloadGPR(), m_result);
+#endif
+    endJumpList.append(jit.jump());
+
+    srcNotInt.link(&jit);
+    slowPathJumpList.append(jit.branchIfNotNumber(m_src, m_scratchGPR));
+
+    // For a double, all we need to do is to invert the sign bit.
+#if USE(JSVALUE64)
+    jit.move(CCallHelpers::TrustedImm64((int64_t)(1ull << 63)), m_scratchGPR);
+    jit.xor64(m_scratchGPR, m_result.payloadGPR());
+#else
+    jit.xor32(CCallHelpers::TrustedImm32(1 << 31), m_result.tagGPR());
+#endif
+    // The flags of ArithNegate are basic in DFG.
+    // We only need to know if we ever produced a number.
+    if (shouldEmitProfiling && arithProfile && !arithProfile->lhsObservedType().sawNumber() && !arithProfile->didObserveDouble())
+        arithProfile->emitSetDouble(jit);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITNegGenerator.h b/jit/JITNegGenerator.h
new file mode 100644
index 0000000..8a0c2d5
--- /dev/null
+++ b/jit/JITNegGenerator.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "JITMathIC.h"
+#include "JITMathICInlineResult.h"
+
+namespace JSC {
+
+class JITNegGenerator {
+public:
+    JITNegGenerator() = default;
+
+    JITNegGenerator(JSValueRegs result, JSValueRegs src, GPRReg scratchGPR)
+        : m_result(result)
+        , m_src(src)
+        , m_scratchGPR(scratchGPR)
+    { }
+
+    JITMathICInlineResult generateInline(CCallHelpers&, MathICGenerationState&, const ArithProfile*);
+    bool generateFastPath(CCallHelpers&, CCallHelpers::JumpList& endJumpList, CCallHelpers::JumpList& slowPathJumpList, const ArithProfile*, bool shouldEmitProfiling);
+
+private:
+    JSValueRegs m_result;
+    JSValueRegs m_src;
+    GPRReg m_scratchGPR;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITOpcodes.cpp b/jit/JITOpcodes.cpp
new file mode 100644
index 0000000..337e0b7
--- /dev/null
+++ b/jit/JITOpcodes.cpp
@@ -0,0 +1,1523 @@
+/*
+ * Copyright (C) 2009, 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#if ENABLE(JIT)
+#include "JIT.h"
+
+#include "BasicBlockLocation.h"
+#include "Exception.h"
+#include "Heap.h"
+#include "Interpreter.h"
+#include "JITInlines.h"
+#include "JSArray.h"
+#include "JSCell.h"
+#include "JSFunction.h"
+#include "JSPropertyNameEnumerator.h"
+#include "LinkBuffer.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "SlowPathCall.h"
+#include "TypeLocation.h"
+#include "TypeProfilerLog.h"
+#include "VirtualRegister.h"
+#include "Watchdog.h"
+
+namespace JSC {
+
+#if USE(JSVALUE64)
+
+JIT::CodeRef JIT::privateCompileCTINativeCall(VM* vm, NativeFunction)
+{
+    return vm->getCTIStub(nativeCallGenerator);
+}
+
+void JIT::emit_op_mov(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    emitPutVirtualRegister(dst);
+}
+
+
+void JIT::emit_op_end(Instruction* currentInstruction)
+{
+    RELEASE_ASSERT(returnValueGPR != callFrameRegister);
+    emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
+    emitRestoreCalleeSaves();
+    emitFunctionEpilogue();
+    ret();
+}
+
+void JIT::emit_op_jmp(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target);
+}
+
+void JIT::emit_op_new_object(Instruction* currentInstruction)
+{
+    Structure* structure = currentInstruction[3].u.objectAllocationProfile->structure();
+    size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
+    MarkedAllocator* allocator = subspaceFor<JSFinalObject>(*m_vm)->allocatorFor(allocationSize);
+
+    RegisterID resultReg = regT0;
+    RegisterID allocatorReg = regT1;
+    RegisterID scratchReg = regT2;
+
+    move(TrustedImmPtr(allocator), allocatorReg);
+    if (allocator)
+        addSlowCase(Jump());
+    JumpList slowCases;
+    emitAllocateJSObject(resultReg, allocator, allocatorReg, TrustedImmPtr(structure), TrustedImmPtr(0), scratchReg, slowCases);
+    emitInitializeInlineStorage(resultReg, structure->inlineCapacity());
+    addSlowCase(slowCases);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_new_object(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    int dst = currentInstruction[1].u.operand;
+    Structure* structure = currentInstruction[3].u.objectAllocationProfile->structure();
+    callOperation(operationNewObject, structure);
+    emitStoreCell(dst, returnValueGPR);
+}
+
+void JIT::emit_op_overrides_has_instance(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int constructor = currentInstruction[2].u.operand;
+    int hasInstanceValue = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegister(hasInstanceValue, regT0);
+
+    // We don't jump if we know what Symbol.hasInstance would do.
+    Jump customhasInstanceValue = branchPtr(NotEqual, regT0, TrustedImmPtr(m_codeBlock->globalObject()->functionProtoHasInstanceSymbolFunction()));
+
+    emitGetVirtualRegister(constructor, regT0);
+
+    // Check that constructor 'ImplementsDefaultHasInstance' i.e. the object is not a C-API user nor a bound function.
+    test8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(ImplementsDefaultHasInstance), regT0);
+    emitTagBool(regT0);
+    Jump done = jump();
+
+    customhasInstanceValue.link(this);
+    move(TrustedImm32(ValueTrue), regT0);
+
+    done.link(this);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_instanceof(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    int proto = currentInstruction[3].u.operand;
+
+    // Load the operands (baseVal, proto, and value respectively) into registers.
+    // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
+    emitGetVirtualRegister(value, regT2);
+    emitGetVirtualRegister(proto, regT1);
+
+    // Check that proto are cells. baseVal must be a cell - this is checked by the get_by_id for Symbol.hasInstance.
+    emitJumpSlowCaseIfNotJSCell(regT2, value);
+    emitJumpSlowCaseIfNotJSCell(regT1, proto);
+
+    // Check that prototype is an object
+    addSlowCase(emitJumpIfCellNotObject(regT1));
+    
+    // Optimistically load the result true, and start looping.
+    // Initially, regT1 still contains proto and regT2 still contains value.
+    // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
+    move(TrustedImm64(JSValue::encode(jsBoolean(true))), regT0);
+    Label loop(this);
+
+    addSlowCase(branch8(Equal, Address(regT2, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType)));
+
+    // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
+    // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
+    emitLoadStructure(regT2, regT2, regT3);
+    load64(Address(regT2, Structure::prototypeOffset()), regT2);
+    Jump isInstance = branchPtr(Equal, regT2, regT1);
+    emitJumpIfJSCell(regT2).linkTo(loop, this);
+
+    // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
+    move(TrustedImm64(JSValue::encode(jsBoolean(false))), regT0);
+
+    // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
+    isInstance.link(this);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_instanceof_custom(Instruction*)
+{
+    // This always goes to slow path since we expect it to be rare.
+    addSlowCase(jump());
+}
+    
+void JIT::emit_op_is_empty(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(value, regT0);
+    compare64(Equal, regT0, TrustedImm32(JSValue::encode(JSValue())), regT0);
+
+    emitTagBool(regT0);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_is_undefined(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    
+    emitGetVirtualRegister(value, regT0);
+    Jump isCell = emitJumpIfJSCell(regT0);
+
+    compare64(Equal, regT0, TrustedImm32(ValueUndefined), regT0);
+    Jump done = jump();
+    
+    isCell.link(this);
+    Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+    move(TrustedImm32(0), regT0);
+    Jump notMasqueradesAsUndefined = jump();
+
+    isMasqueradesAsUndefined.link(this);
+    emitLoadStructure(regT0, regT1, regT2);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    loadPtr(Address(regT1, Structure::globalObjectOffset()), regT1);
+    comparePtr(Equal, regT0, regT1, regT0);
+
+    notMasqueradesAsUndefined.link(this);
+    done.link(this);
+    emitTagBool(regT0);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_is_boolean(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    
+    emitGetVirtualRegister(value, regT0);
+    xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), regT0);
+    test64(Zero, regT0, TrustedImm32(static_cast<int32_t>(~1)), regT0);
+    emitTagBool(regT0);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_is_number(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    
+    emitGetVirtualRegister(value, regT0);
+    test64(NonZero, regT0, tagTypeNumberRegister, regT0);
+    emitTagBool(regT0);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_is_cell_with_type(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    int type = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegister(value, regT0);
+    Jump isNotCell = emitJumpIfNotJSCell(regT0);
+
+    compare8(Equal, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(type), regT0);
+    emitTagBool(regT0);
+    Jump done = jump();
+
+    isNotCell.link(this);
+    move(TrustedImm32(ValueFalse), regT0);
+
+    done.link(this);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_is_object(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(value, regT0);
+    Jump isNotCell = emitJumpIfNotJSCell(regT0);
+
+    compare8(AboveOrEqual, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType), regT0);
+    emitTagBool(regT0);
+    Jump done = jump();
+
+    isNotCell.link(this);
+    move(TrustedImm32(ValueFalse), regT0);
+
+    done.link(this);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_ret(Instruction* currentInstruction)
+{
+    ASSERT(callFrameRegister != regT1);
+    ASSERT(regT1 != returnValueGPR);
+    ASSERT(returnValueGPR != callFrameRegister);
+
+    // Return the result in %eax.
+    emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
+
+    checkStackPointerAlignment();
+    emitRestoreCalleeSaves();
+    emitFunctionEpilogue();
+    ret();
+}
+
+void JIT::emit_op_to_primitive(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    
+    Jump isImm = emitJumpIfNotJSCell(regT0);
+    addSlowCase(emitJumpIfCellObject(regT0));
+    isImm.link(this);
+
+    if (dst != src)
+        emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_set_function_name(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT1);
+    callOperation(operationSetFunctionName, regT0, regT1);
+}
+
+void JIT::emit_op_strcat(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_strcat);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_not(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+
+    // Invert against JSValue(false); if the value was tagged as a boolean, then all bits will be
+    // clear other than the low bit (which will be 0 or 1 for false or true inputs respectively).
+    // Then invert against JSValue(true), which will add the tag back in, and flip the low bit.
+    xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), regT0);
+    addSlowCase(branchTestPtr(NonZero, regT0, TrustedImm32(static_cast<int32_t>(~1))));
+    xor64(TrustedImm32(static_cast<int32_t>(ValueTrue)), regT0);
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jfalse(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[2].u.operand;
+
+    GPRReg value = regT0;
+    GPRReg result = regT1;
+    GPRReg scratch = regT2;
+    bool shouldCheckMasqueradesAsUndefined = true;
+
+    emitGetVirtualRegister(currentInstruction[1].u.operand, value);
+    emitConvertValueToBoolean(JSValueRegs(value), result, scratch, fpRegT0, fpRegT1, shouldCheckMasqueradesAsUndefined, m_codeBlock->globalObject());
+
+    addJump(branchTest32(Zero, result), target);
+}
+
+void JIT::emit_op_jeq_null(Instruction* currentInstruction)
+{
+    int src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    Jump isNotMasqueradesAsUndefined = branchTest8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+    emitLoadStructure(regT0, regT2, regT1);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    addJump(branchPtr(Equal, Address(regT2, Structure::globalObjectOffset()), regT0), target);
+    Jump masqueradesGlobalObjectIsForeign = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    and64(TrustedImm32(~TagBitUndefined), regT0);
+    addJump(branch64(Equal, regT0, TrustedImm64(JSValue::encode(jsNull()))), target);            
+
+    isNotMasqueradesAsUndefined.link(this);
+    masqueradesGlobalObjectIsForeign.link(this);
+};
+void JIT::emit_op_jneq_null(Instruction* currentInstruction)
+{
+    int src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    addJump(branchTest8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
+    emitLoadStructure(regT0, regT2, regT1);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    addJump(branchPtr(NotEqual, Address(regT2, Structure::globalObjectOffset()), regT0), target);
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    and64(TrustedImm32(~TagBitUndefined), regT0);
+    addJump(branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsNull()))), target);            
+
+    wasNotImmediate.link(this);
+}
+
+void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
+{
+    int src = currentInstruction[1].u.operand;
+    Special::Pointer ptr = currentInstruction[2].u.specialPointer;
+    unsigned target = currentInstruction[3].u.operand;
+    
+    emitGetVirtualRegister(src, regT0);
+    CCallHelpers::Jump equal = branchPtr(Equal, regT0, TrustedImmPtr(actualPointerFor(m_codeBlock, ptr)));
+    store32(TrustedImm32(1), &currentInstruction[4].u.operand);
+    addJump(jump(), target);
+    equal.link(this);
+}
+
+void JIT::emit_op_eq(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotInt(regT0, regT1, regT2);
+    compare32(Equal, regT1, regT0, regT0);
+    emitTagBool(regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jtrue(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[2].u.operand;
+
+    GPRReg value = regT0;
+    GPRReg result = regT1;
+    GPRReg scratch = regT2;
+    bool shouldCheckMasqueradesAsUndefined = true;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, value);
+    emitConvertValueToBoolean(JSValueRegs(value), result, scratch, fpRegT0, fpRegT1, shouldCheckMasqueradesAsUndefined, m_codeBlock->globalObject());
+    addJump(branchTest32(NonZero, result), target);
+}
+
+void JIT::emit_op_neq(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotInt(regT0, regT1, regT2);
+    compare32(NotEqual, regT1, regT0, regT0);
+    emitTagBool(regT0);
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+
+}
+
+void JIT::emit_op_throw(Instruction* currentInstruction)
+{
+    ASSERT(regT0 == returnValueGPR);
+    copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    callOperationNoExceptionCheck(operationThrow, regT0);
+    jumpToExceptionHandler();
+}
+
+void JIT::emit_op_push_with_scope(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_push_with_scope);
+    slowPathCall.call();
+}
+
+void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqType type)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src1 = currentInstruction[2].u.operand;
+    int src2 = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(src1, regT0, src2, regT1);
+    
+    // Jump slow if both are cells (to cover strings).
+    move(regT0, regT2);
+    or64(regT1, regT2);
+    addSlowCase(emitJumpIfJSCell(regT2));
+    
+    // Jump slow if either is a double. First test if it's an integer, which is fine, and then test
+    // if it's a double.
+    Jump leftOK = emitJumpIfInt(regT0);
+    addSlowCase(emitJumpIfNumber(regT0));
+    leftOK.link(this);
+    Jump rightOK = emitJumpIfInt(regT1);
+    addSlowCase(emitJumpIfNumber(regT1));
+    rightOK.link(this);
+
+    if (type == OpStrictEq)
+        compare64(Equal, regT1, regT0, regT0);
+    else
+        compare64(NotEqual, regT1, regT0, regT0);
+    emitTagBool(regT0);
+
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_stricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpStrictEq);
+}
+
+void JIT::emit_op_nstricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpNStrictEq);
+}
+
+void JIT::emit_op_to_number(Instruction* currentInstruction)
+{
+    int dstVReg = currentInstruction[1].u.operand;
+    int srcVReg = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(srcVReg, regT0);
+    
+    addSlowCase(emitJumpIfNotNumber(regT0));
+
+    emitValueProfilingSite();
+    if (srcVReg != dstVReg)
+        emitPutVirtualRegister(dstVReg);
+}
+
+void JIT::emit_op_to_string(Instruction* currentInstruction)
+{
+    int srcVReg = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(srcVReg, regT0);
+
+    addSlowCase(emitJumpIfNotJSCell(regT0));
+    addSlowCase(branch8(NotEqual, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_catch(Instruction* currentInstruction)
+{
+    restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer();
+
+    move(TrustedImmPtr(m_vm), regT3);
+    load64(Address(regT3, VM::callFrameForCatchOffset()), callFrameRegister);
+    storePtr(TrustedImmPtr(nullptr), Address(regT3, VM::callFrameForCatchOffset()));
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(codeBlock()) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+
+    callOperationNoExceptionCheck(operationCheckIfExceptionIsUncatchableAndNotifyProfiler);
+    Jump isCatchableException = branchTest32(Zero, returnValueGPR);
+    jumpToExceptionHandler();
+    isCatchableException.link(this);
+
+    move(TrustedImmPtr(m_vm), regT3);
+    load64(Address(regT3, VM::exceptionOffset()), regT0);
+    store64(TrustedImm64(JSValue::encode(JSValue())), Address(regT3, VM::exceptionOffset()));
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+
+    load64(Address(regT0, Exception::valueOffset()), regT0);
+    emitPutVirtualRegister(currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_assert(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_assert);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_create_lexical_environment(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_lexical_environment);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_get_parent_scope(Instruction* currentInstruction)
+{
+    int currentScope = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentScope, regT0);
+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
+    emitStoreCell(currentInstruction[1].u.operand, regT0);
+}
+
+void JIT::emit_op_switch_imm(Instruction* currentInstruction)
+{
+    size_t tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->switchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset, SwitchRecord::Immediate));
+    jumpTable->ensureCTITable();
+
+    emitGetVirtualRegister(scrutinee, regT0);
+    callOperation(operationSwitchImmWithUnknownKeyType, regT0, tableIndex);
+    jump(returnValueGPR);
+}
+
+void JIT::emit_op_switch_char(Instruction* currentInstruction)
+{
+    size_t tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->switchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset, SwitchRecord::Character));
+    jumpTable->ensureCTITable();
+
+    emitGetVirtualRegister(scrutinee, regT0);
+    callOperation(operationSwitchCharWithUnknownKeyType, regT0, tableIndex);
+    jump(returnValueGPR);
+}
+
+void JIT::emit_op_switch_string(Instruction* currentInstruction)
+{
+    size_t tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset));
+
+    emitGetVirtualRegister(scrutinee, regT0);
+    callOperation(operationSwitchStringWithUnknownKeyType, regT0, tableIndex);
+    jump(returnValueGPR);
+}
+
+void JIT::emit_op_debug(Instruction* currentInstruction)
+{
+    load32(codeBlock()->debuggerRequestsAddress(), regT0);
+    Jump noDebuggerRequests = branchTest32(Zero, regT0);
+    callOperation(operationDebug, currentInstruction[1].u.operand);
+    noDebuggerRequests.link(this);
+}
+
+void JIT::emit_op_eq_null(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src1 = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src1, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+    move(TrustedImm32(0), regT0);
+    Jump wasNotMasqueradesAsUndefined = jump();
+
+    isMasqueradesAsUndefined.link(this);
+    emitLoadStructure(regT0, regT2, regT1);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
+    comparePtr(Equal, regT0, regT2, regT0);
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    and64(TrustedImm32(~TagBitUndefined), regT0);
+    compare64(Equal, regT0, TrustedImm32(ValueNull), regT0);
+
+    wasNotImmediate.link(this);
+    wasNotMasqueradesAsUndefined.link(this);
+
+    emitTagBool(regT0);
+    emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_neq_null(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src1 = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src1, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+    move(TrustedImm32(1), regT0);
+    Jump wasNotMasqueradesAsUndefined = jump();
+
+    isMasqueradesAsUndefined.link(this);
+    emitLoadStructure(regT0, regT2, regT1);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
+    comparePtr(NotEqual, regT0, regT2, regT0);
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    and64(TrustedImm32(~TagBitUndefined), regT0);
+    compare64(NotEqual, regT0, TrustedImm32(ValueNull), regT0);
+
+    wasNotImmediate.link(this);
+    wasNotMasqueradesAsUndefined.link(this);
+
+    emitTagBool(regT0);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_enter(Instruction*)
+{
+    // Even though CTI doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    size_t count = m_codeBlock->m_numVars;
+    for (size_t j = CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters(); j < count; ++j)
+        emitInitRegister(virtualRegisterForLocal(j).offset());
+
+    emitWriteBarrier(m_codeBlock);
+
+    emitEnterOptimizationCheck();
+}
+
+void JIT::emit_op_get_scope(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, regT0);
+    loadPtr(Address(regT0, JSFunction::offsetOfScopeChain()), regT0);
+    emitStoreCell(dst, regT0);
+}
+
+void JIT::emit_op_to_this(Instruction* currentInstruction)
+{
+    WriteBarrierBase<Structure>* cachedStructure = &currentInstruction[2].u.structure;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT1);
+
+    emitJumpSlowCaseIfNotJSCell(regT1);
+
+    addSlowCase(branch8(NotEqual, Address(regT1, JSCell::typeInfoTypeOffset()), TrustedImm32(FinalObjectType)));
+    loadPtr(cachedStructure, regT2);
+    addSlowCase(branchTestPtr(Zero, regT2));
+    load32(Address(regT2, Structure::structureIDOffset()), regT2);
+    addSlowCase(branch32(NotEqual, Address(regT1, JSCell::structureIDOffset()), regT2));
+}
+
+void JIT::emit_op_create_this(Instruction* currentInstruction)
+{
+    int callee = currentInstruction[2].u.operand;
+    WriteBarrierBase<JSCell>* cachedFunction = &currentInstruction[4].u.jsCell;
+    RegisterID calleeReg = regT0;
+    RegisterID rareDataReg = regT4;
+    RegisterID resultReg = regT0;
+    RegisterID allocatorReg = regT1;
+    RegisterID structureReg = regT2;
+    RegisterID cachedFunctionReg = regT4;
+    RegisterID scratchReg = regT3;
+
+    emitGetVirtualRegister(callee, calleeReg);
+    addSlowCase(branch8(NotEqual, Address(calleeReg, JSCell::typeInfoTypeOffset()), TrustedImm32(JSFunctionType)));
+    loadPtr(Address(calleeReg, JSFunction::offsetOfRareData()), rareDataReg);
+    addSlowCase(branchTestPtr(Zero, rareDataReg));
+    loadPtr(Address(rareDataReg, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorReg);
+    loadPtr(Address(rareDataReg, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureReg);
+    addSlowCase(branchTestPtr(Zero, allocatorReg));
+
+    loadPtr(cachedFunction, cachedFunctionReg);
+    Jump hasSeenMultipleCallees = branchPtr(Equal, cachedFunctionReg, TrustedImmPtr(JSCell::seenMultipleCalleeObjects()));
+    addSlowCase(branchPtr(NotEqual, calleeReg, cachedFunctionReg));
+    hasSeenMultipleCallees.link(this);
+
+    JumpList slowCases;
+    emitAllocateJSObject(resultReg, nullptr, allocatorReg, structureReg, TrustedImmPtr(0), scratchReg, slowCases);
+    emitGetVirtualRegister(callee, scratchReg);
+    loadPtr(Address(scratchReg, JSFunction::offsetOfRareData()), scratchReg);
+    load32(Address(scratchReg, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfInlineCapacity()), scratchReg);
+    emitInitializeInlineStorage(resultReg, scratchReg);
+    addSlowCase(slowCases);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_create_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter); // Callee::m_type != JSFunctionType.
+    linkSlowCase(iter); // doesn't have rare data
+    linkSlowCase(iter); // doesn't have an allocation profile
+    linkSlowCase(iter); // allocation failed (no allocator)
+    linkSlowCase(iter); // allocation failed (allocator empty)
+    linkSlowCase(iter); // cached function didn't match
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_this);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_check_tdz(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    addSlowCase(branchTest64(Zero, regT0));
+}
+
+void JIT::emitSlow_op_check_tdz(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_throw_tdz_error);
+    slowPathCall.call();
+}
+
+
+// Slow cases
+
+void JIT::emitSlow_op_to_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_this);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_primitive);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_not);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    callOperation(operationCompareEq, regT0, regT1);
+    emitTagBool(returnValueGPR);
+    emitPutVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
+}
+
+void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    callOperation(operationCompareEq, regT0, regT1);
+    xor32(TrustedImm32(0x1), regT0);
+    emitTagBool(returnValueGPR);
+    emitPutVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
+}
+
+void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_stricteq);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_nstricteq);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    int proto = currentInstruction[3].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, value);
+    linkSlowCaseIfNotJSCell(iter, proto);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitGetVirtualRegister(value, regT0);
+    emitGetVirtualRegister(proto, regT1);
+    callOperation(operationInstanceOf, dst, regT0, regT1);
+}
+
+void JIT::emitSlow_op_instanceof_custom(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    int constructor = currentInstruction[3].u.operand;
+    int hasInstanceValue = currentInstruction[4].u.operand;
+
+    linkSlowCase(iter);
+    emitGetVirtualRegister(value, regT0);
+    emitGetVirtualRegister(constructor, regT1);
+    emitGetVirtualRegister(hasInstanceValue, regT2);
+    callOperation(operationInstanceOfCustom, regT0, regT1, regT2);
+    emitTagBool(returnValueGPR);
+    emitPutVirtualRegister(dst, returnValueGPR);
+}
+
+void JIT::emitSlow_op_to_number(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_number);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_to_string(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter); // Not JSCell.
+    linkSlowCase(iter); // Not JSString.
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_string);
+    slowPathCall.call();
+}
+
+#endif // USE(JSVALUE64)
+
+void JIT::emit_op_loop_hint(Instruction*)
+{
+    // Emit the JIT optimization check: 
+    if (canBeOptimized()) {
+        addSlowCase(branchAdd32(PositiveOrZero, TrustedImm32(Options::executionCounterIncrementForLoop()),
+            AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter())));
+    }
+}
+
+void JIT::emitSlow_op_loop_hint(Instruction*, Vector<SlowCaseEntry>::iterator& iter)
+{
+#if ENABLE(DFG_JIT)
+    // Emit the slow path for the JIT optimization check:
+    if (canBeOptimized()) {
+        linkSlowCase(iter);
+
+        copyCalleeSavesFromFrameOrRegisterToVMEntryFrameCalleeSavesBuffer();
+
+        callOperation(operationOptimize, m_bytecodeOffset);
+        Jump noOptimizedEntry = branchTestPtr(Zero, returnValueGPR);
+        if (!ASSERT_DISABLED) {
+            Jump ok = branchPtr(MacroAssembler::Above, returnValueGPR, TrustedImmPtr(bitwise_cast<void*>(static_cast<intptr_t>(1000))));
+            abortWithReason(JITUnreasonableLoopHintJumpTarget);
+            ok.link(this);
+        }
+        jump(returnValueGPR);
+        noOptimizedEntry.link(this);
+
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_loop_hint));
+    }
+#else
+    UNUSED_PARAM(iter);
+#endif
+}
+
+void JIT::emit_op_throw_static_error(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_throw_static_error);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_watchdog(Instruction*)
+{
+    ASSERT(m_vm->watchdog());
+    addSlowCase(branchTest8(NonZero, AbsoluteAddress(m_vm->watchdog()->timerDidFireAddress())));
+}
+
+void JIT::emitSlow_op_watchdog(Instruction*, Vector<SlowCaseEntry>::iterator& iter)
+{
+    ASSERT(m_vm->watchdog());
+    linkSlowCase(iter);
+    callOperation(operationHandleWatchdogTimer);
+}
+
+void JIT::emit_op_new_regexp(Instruction* currentInstruction)
+{
+    callOperation(operationNewRegexp, currentInstruction[1].u.operand, m_codeBlock->regexp(currentInstruction[2].u.operand));
+}
+
+void JIT::emitNewFuncCommon(Instruction* currentInstruction)
+{
+    Jump lazyJump;
+    int dst = currentInstruction[1].u.operand;
+
+#if USE(JSVALUE64)
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+#else
+    emitLoadPayload(currentInstruction[2].u.operand, regT0);
+#endif
+    FunctionExecutable* funcExec = m_codeBlock->functionDecl(currentInstruction[3].u.operand);
+
+    OpcodeID opcodeID = m_vm->interpreter->getOpcodeID(currentInstruction->u.opcode);
+    if (opcodeID == op_new_func)
+        callOperation(operationNewFunction, dst, regT0, funcExec);
+    else if (opcodeID == op_new_generator_func)
+        callOperation(operationNewGeneratorFunction, dst, regT0, funcExec);
+    else {
+        ASSERT(opcodeID == op_new_async_func);
+        callOperation(operationNewAsyncFunction, dst, regT0, funcExec);
+    }
+}
+
+void JIT::emit_op_new_func(Instruction* currentInstruction)
+{
+    emitNewFuncCommon(currentInstruction);
+}
+
+void JIT::emit_op_new_generator_func(Instruction* currentInstruction)
+{
+    emitNewFuncCommon(currentInstruction);
+}
+
+void JIT::emit_op_new_async_func(Instruction* currentInstruction)
+{
+    emitNewFuncCommon(currentInstruction);
+}
+
+void JIT::emitNewFuncExprCommon(Instruction* currentInstruction)
+{
+    Jump notUndefinedScope;
+    int dst = currentInstruction[1].u.operand;
+#if USE(JSVALUE64)
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    notUndefinedScope = branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsUndefined())));
+    store64(TrustedImm64(JSValue::encode(jsUndefined())), Address(callFrameRegister, sizeof(Register) * dst));
+#else
+    emitLoadPayload(currentInstruction[2].u.operand, regT0);
+    notUndefinedScope = branch32(NotEqual, tagFor(currentInstruction[2].u.operand), TrustedImm32(JSValue::UndefinedTag));
+    emitStore(dst, jsUndefined());
+#endif
+    Jump done = jump();
+    notUndefinedScope.link(this);
+        
+    FunctionExecutable* function = m_codeBlock->functionExpr(currentInstruction[3].u.operand);
+    OpcodeID opcodeID = m_vm->interpreter->getOpcodeID(currentInstruction->u.opcode);
+
+    if (opcodeID == op_new_func_exp)
+        callOperation(operationNewFunction, dst, regT0, function);
+    else if (opcodeID == op_new_generator_func_exp)
+        callOperation(operationNewGeneratorFunction, dst, regT0, function);
+    else {
+        ASSERT(opcodeID == op_new_async_func_exp);
+        callOperation(operationNewAsyncFunction, dst, regT0, function);
+    }
+
+    done.link(this);
+}
+
+void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
+{
+    emitNewFuncExprCommon(currentInstruction);
+}
+
+void JIT::emit_op_new_generator_func_exp(Instruction* currentInstruction)
+{
+    emitNewFuncExprCommon(currentInstruction);
+}
+
+void JIT::emit_op_new_async_func_exp(Instruction* currentInstruction)
+{
+    emitNewFuncExprCommon(currentInstruction);
+}
+
+void JIT::emit_op_new_array(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int valuesIndex = currentInstruction[2].u.operand;
+    int size = currentInstruction[3].u.operand;
+    addPtr(TrustedImm32(valuesIndex * sizeof(Register)), callFrameRegister, regT0);
+    callOperation(operationNewArrayWithProfile, dst,
+        currentInstruction[4].u.arrayAllocationProfile, regT0, size);
+}
+
+void JIT::emit_op_new_array_with_size(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int sizeIndex = currentInstruction[2].u.operand;
+#if USE(JSVALUE64)
+    emitGetVirtualRegister(sizeIndex, regT0);
+    callOperation(operationNewArrayWithSizeAndProfile, dst,
+        currentInstruction[3].u.arrayAllocationProfile, regT0);
+#else
+    emitLoad(sizeIndex, regT1, regT0);
+    callOperation(operationNewArrayWithSizeAndProfile, dst,
+        currentInstruction[3].u.arrayAllocationProfile, regT1, regT0);
+#endif
+}
+
+void JIT::emit_op_new_array_buffer(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int valuesIndex = currentInstruction[2].u.operand;
+    int size = currentInstruction[3].u.operand;
+    const JSValue* values = codeBlock()->constantBuffer(valuesIndex);
+    callOperation(operationNewArrayBufferWithProfile, dst, currentInstruction[4].u.arrayAllocationProfile, values, size);
+}
+
+void JIT::emit_op_new_array_with_spread(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_new_array_with_spread);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_spread(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_spread);
+    slowPathCall.call();
+}
+
+#if USE(JSVALUE64)
+void JIT::emit_op_has_structure_property(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int enumerator = currentInstruction[4].u.operand;
+
+    emitGetVirtualRegister(base, regT0);
+    emitGetVirtualRegister(enumerator, regT1);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
+
+    load32(Address(regT0, JSCell::structureIDOffset()), regT0);
+    addSlowCase(branch32(NotEqual, regT0, Address(regT1, JSPropertyNameEnumerator::cachedStructureIDOffset())));
+    
+    move(TrustedImm64(JSValue::encode(jsBoolean(true))), regT0);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::privateCompileHasIndexedProperty(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
+{
+    Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
+    
+    PatchableJump badType;
+    
+    // FIXME: Add support for other types like TypedArrays and Arguments.
+    // See https://bugs.webkit.org/show_bug.cgi?id=135033 and https://bugs.webkit.org/show_bug.cgi?id=135034.
+    JumpList slowCases = emitLoadForArrayMode(currentInstruction, arrayMode, badType);
+    move(TrustedImm64(JSValue::encode(jsBoolean(true))), regT0);
+    Jump done = jump();
+
+    LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
+    
+    patchBuffer.link(badType, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    
+    patchBuffer.link(done, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
+    
+    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
+        m_codeBlock, patchBuffer,
+        ("Baseline has_indexed_property stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value()));
+    
+    MacroAssembler::repatchJump(byValInfo->badTypeJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
+    MacroAssembler::repatchCall(CodeLocationCall(MacroAssemblerCodePtr(returnAddress)), FunctionPtr(operationHasIndexedPropertyGeneric));
+}
+
+void JIT::emit_op_has_indexed_property(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ByValInfo* byValInfo = m_codeBlock->addByValInfo();
+    
+    emitGetVirtualRegisters(base, regT0, property, regT1);
+
+    // This is technically incorrect - we're zero-extending an int32. On the hot path this doesn't matter.
+    // We check the value as if it was a uint32 against the m_vectorLength - which will always fail if
+    // number was signed since m_vectorLength is always less than intmax (since the total allocation
+    // size is always less than 4Gb). As such zero extending will have been correct (and extending the value
+    // to 64-bits is necessary since it's used in the address calculation. We zero extend rather than sign
+    // extending since it makes it easier to re-tag the value in the slow case.
+    zeroExtend32ToPtr(regT1, regT1);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
+    emitArrayProfilingSiteWithCell(regT0, regT2, profile);
+    and32(TrustedImm32(IndexingShapeMask), regT2);
+
+    JITArrayMode mode = chooseArrayMode(profile);
+    PatchableJump badType;
+
+    // FIXME: Add support for other types like TypedArrays and Arguments.
+    // See https://bugs.webkit.org/show_bug.cgi?id=135033 and https://bugs.webkit.org/show_bug.cgi?id=135034.
+    JumpList slowCases = emitLoadForArrayMode(currentInstruction, mode, badType);
+    
+    move(TrustedImm64(JSValue::encode(jsBoolean(true))), regT0);
+
+    addSlowCase(badType);
+    addSlowCase(slowCases);
+    
+    Label done = label();
+    
+    emitPutVirtualRegister(dst);
+
+    Label nextHotPath = label();
+    
+    m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done, nextHotPath));
+}
+
+void JIT::emitSlow_op_has_indexed_property(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
+    
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
+    
+    Label slowPath = label();
+    
+    emitGetVirtualRegister(base, regT0);
+    emitGetVirtualRegister(property, regT1);
+    Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT0, regT1, byValInfo);
+
+    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
+    m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
+    m_byValInstructionIndex++;
+}
+
+void JIT::emit_op_get_direct_pname(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int index = currentInstruction[4].u.operand;
+    int enumerator = currentInstruction[5].u.operand;
+
+    // Check that base is a cell
+    emitGetVirtualRegister(base, regT0);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
+
+    // Check the structure
+    emitGetVirtualRegister(enumerator, regT2);
+    load32(Address(regT0, JSCell::structureIDOffset()), regT1);
+    addSlowCase(branch32(NotEqual, regT1, Address(regT2, JSPropertyNameEnumerator::cachedStructureIDOffset())));
+
+    // Compute the offset
+    emitGetVirtualRegister(index, regT1);
+    // If index is less than the enumerator's cached inline storage, then it's an inline access
+    Jump outOfLineAccess = branch32(AboveOrEqual, regT1, Address(regT2, JSPropertyNameEnumerator::cachedInlineCapacityOffset()));
+    addPtr(TrustedImm32(JSObject::offsetOfInlineStorage()), regT0);
+    signExtend32ToPtr(regT1, regT1);
+    load64(BaseIndex(regT0, regT1, TimesEight), regT0);
+    
+    Jump done = jump();
+
+    // Otherwise it's out of line
+    outOfLineAccess.link(this);
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
+    sub32(Address(regT2, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), regT1);
+    neg32(regT1);
+    signExtend32ToPtr(regT1, regT1);
+    int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
+    load64(BaseIndex(regT0, regT1, TimesEight, offsetOfFirstProperty), regT0);
+    
+    done.link(this);
+    emitValueProfilingSite();
+    emitPutVirtualRegister(dst, regT0);
+}
+
+void JIT::emitSlow_op_get_direct_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[2].u.operand;
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_direct_pname);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_enumerator_structure_pname(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int enumerator = currentInstruction[2].u.operand;
+    int index = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegister(index, regT0);
+    emitGetVirtualRegister(enumerator, regT1);
+    Jump inBounds = branch32(Below, regT0, Address(regT1, JSPropertyNameEnumerator::endStructurePropertyIndexOffset()));
+
+    move(TrustedImm64(JSValue::encode(jsNull())), regT0);
+
+    Jump done = jump();
+    inBounds.link(this);
+
+    loadPtr(Address(regT1, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), regT1);
+    signExtend32ToPtr(regT0, regT0);
+    load64(BaseIndex(regT1, regT0, TimesEight), regT0);
+
+    done.link(this);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_enumerator_generic_pname(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int enumerator = currentInstruction[2].u.operand;
+    int index = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegister(index, regT0);
+    emitGetVirtualRegister(enumerator, regT1);
+    Jump inBounds = branch32(Below, regT0, Address(regT1, JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
+
+    move(TrustedImm64(JSValue::encode(jsNull())), regT0);
+
+    Jump done = jump();
+    inBounds.link(this);
+
+    loadPtr(Address(regT1, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), regT1);
+    signExtend32ToPtr(regT0, regT0);
+    load64(BaseIndex(regT1, regT0, TimesEight), regT0);
+    
+    done.link(this);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_profile_type(Instruction* currentInstruction)
+{
+    TypeLocation* cachedTypeLocation = currentInstruction[2].u.location;
+    int valueToProfile = currentInstruction[1].u.operand;
+
+    emitGetVirtualRegister(valueToProfile, regT0);
+
+    JumpList jumpToEnd;
+
+    jumpToEnd.append(branchTest64(Zero, regT0));
+
+    // Compile in a predictive type check, if possible, to see if we can skip writing to the log.
+    // These typechecks are inlined to match those of the 64-bit JSValue type checks.
+    if (cachedTypeLocation->m_lastSeenType == TypeUndefined)
+        jumpToEnd.append(branch64(Equal, regT0, TrustedImm64(JSValue::encode(jsUndefined()))));
+    else if (cachedTypeLocation->m_lastSeenType == TypeNull)
+        jumpToEnd.append(branch64(Equal, regT0, TrustedImm64(JSValue::encode(jsNull()))));
+    else if (cachedTypeLocation->m_lastSeenType == TypeBoolean) {
+        move(regT0, regT1);
+        and64(TrustedImm32(~1), regT1);
+        jumpToEnd.append(branch64(Equal, regT1, TrustedImm64(ValueFalse)));
+    } else if (cachedTypeLocation->m_lastSeenType == TypeAnyInt)
+        jumpToEnd.append(emitJumpIfInt(regT0));
+    else if (cachedTypeLocation->m_lastSeenType == TypeNumber)
+        jumpToEnd.append(emitJumpIfNumber(regT0));
+    else if (cachedTypeLocation->m_lastSeenType == TypeString) {
+        Jump isNotCell = emitJumpIfNotJSCell(regT0);
+        jumpToEnd.append(branch8(Equal, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+        isNotCell.link(this);
+    }
+
+    // Load the type profiling log into T2.
+    TypeProfilerLog* cachedTypeProfilerLog = m_vm->typeProfilerLog();
+    move(TrustedImmPtr(cachedTypeProfilerLog), regT2);
+    // Load the next log entry into T1.
+    loadPtr(Address(regT2, TypeProfilerLog::currentLogEntryOffset()), regT1);
+
+    // Store the JSValue onto the log entry.
+    store64(regT0, Address(regT1, TypeProfilerLog::LogEntry::valueOffset()));
+
+    // Store the structureID of the cell if T0 is a cell, otherwise, store 0 on the log entry.
+    Jump notCell = emitJumpIfNotJSCell(regT0);
+    load32(Address(regT0, JSCell::structureIDOffset()), regT0);
+    store32(regT0, Address(regT1, TypeProfilerLog::LogEntry::structureIDOffset()));
+    Jump skipIsCell = jump();
+    notCell.link(this);
+    store32(TrustedImm32(0), Address(regT1, TypeProfilerLog::LogEntry::structureIDOffset()));
+    skipIsCell.link(this);
+
+    // Store the typeLocation on the log entry.
+    move(TrustedImmPtr(cachedTypeLocation), regT0);
+    store64(regT0, Address(regT1, TypeProfilerLog::LogEntry::locationOffset()));
+
+    // Increment the current log entry.
+    addPtr(TrustedImm32(sizeof(TypeProfilerLog::LogEntry)), regT1);
+    store64(regT1, Address(regT2, TypeProfilerLog::currentLogEntryOffset()));
+    Jump skipClearLog = branchPtr(NotEqual, regT1, TrustedImmPtr(cachedTypeProfilerLog->logEndPtr()));
+    // Clear the log if we're at the end of the log.
+    callOperation(operationProcessTypeProfilerLog);
+    skipClearLog.link(this);
+
+    jumpToEnd.link(this);
+}
+
+void JIT::emit_op_log_shadow_chicken_prologue(Instruction* currentInstruction)
+{
+    updateTopCallFrame();
+    static_assert(nonArgGPR0 != regT0 && nonArgGPR0 != regT2, "we will have problems if this is true.");
+    GPRReg shadowPacketReg = regT0;
+    GPRReg scratch1Reg = nonArgGPR0; // This must be a non-argument register.
+    GPRReg scratch2Reg = regT2;
+    ensureShadowChickenPacket(shadowPacketReg, scratch1Reg, scratch2Reg);
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT3);
+    logShadowChickenProloguePacket(shadowPacketReg, scratch1Reg, regT3);
+}
+
+void JIT::emit_op_log_shadow_chicken_tail(Instruction* currentInstruction)
+{
+    updateTopCallFrame();
+    static_assert(nonArgGPR0 != regT0 && nonArgGPR0 != regT2, "we will have problems if this is true.");
+    GPRReg shadowPacketReg = regT0;
+    GPRReg scratch1Reg = nonArgGPR0; // This must be a non-argument register.
+    GPRReg scratch2Reg = regT2;
+    ensureShadowChickenPacket(shadowPacketReg, scratch1Reg, scratch2Reg);
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT2);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT3);
+    logShadowChickenTailPacket(shadowPacketReg, JSValueRegs(regT2), regT3, m_codeBlock, CallSiteIndex(m_bytecodeOffset));
+}
+
+#endif // USE(JSVALUE64)
+
+void JIT::emit_op_get_enumerable_length(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_enumerable_length);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_has_structure_property(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_has_structure_property);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_has_generic_property(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_has_generic_property);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_get_property_enumerator(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_property_enumerator);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_to_index_string(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_index_string);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_profile_control_flow(Instruction* currentInstruction)
+{
+    BasicBlockLocation* basicBlockLocation = currentInstruction[1].u.basicBlockLocation;
+#if USE(JSVALUE64)
+    basicBlockLocation->emitExecuteCode(*this);
+#else
+    basicBlockLocation->emitExecuteCode(*this, regT0);
+#endif
+}
+
+void JIT::emit_op_create_direct_arguments(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_direct_arguments);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_create_scoped_arguments(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_scoped_arguments);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_create_cloned_arguments(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_cloned_arguments);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_argument_count(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    load32(payloadFor(CallFrameSlot::argumentCount), regT0);
+    sub32(TrustedImm32(1), regT0);
+    JSValueRegs result = JSValueRegs::withTwoAvailableRegs(regT0, regT1);
+    boxInt32(regT0, result);
+    emitPutVirtualRegister(dst, result);
+}
+
+void JIT::emit_op_create_rest(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_rest);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_get_rest_length(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    unsigned numParamsToSkip = currentInstruction[2].u.unsignedValue;
+    load32(payloadFor(CallFrameSlot::argumentCount), regT0);
+    sub32(TrustedImm32(1), regT0);
+    Jump zeroLength = branch32(LessThanOrEqual, regT0, Imm32(numParamsToSkip));
+    sub32(Imm32(numParamsToSkip), regT0);
+#if USE(JSVALUE64)
+    boxInt32(regT0, JSValueRegs(regT0));
+#endif
+    Jump done = jump();
+
+    zeroLength.link(this);
+#if USE(JSVALUE64)
+    move(TrustedImm64(JSValue::encode(jsNumber(0))), regT0);
+#else
+    move(TrustedImm32(0), regT0);
+#endif
+
+    done.link(this);
+#if USE(JSVALUE64)
+    emitPutVirtualRegister(dst, regT0);
+#else
+    move(TrustedImm32(JSValue::Int32Tag), regT1);
+    emitPutVirtualRegister(dst, JSValueRegs(regT1, regT0));
+#endif
+}
+
+void JIT::emit_op_get_argument(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int index = currentInstruction[2].u.operand;
+#if USE(JSVALUE64)
+    JSValueRegs resultRegs(regT0);
+#else
+    JSValueRegs resultRegs(regT1, regT0);
+#endif
+
+    load32(payloadFor(CallFrameSlot::argumentCount), regT2);
+    Jump argumentOutOfBounds = branch32(LessThanOrEqual, regT2, TrustedImm32(index));
+    loadValue(addressFor(CallFrameSlot::thisArgument + index), resultRegs);
+    Jump done = jump();
+
+    argumentOutOfBounds.link(this);
+    moveValue(jsUndefined(), resultRegs);
+
+    done.link(this);
+    emitValueProfilingSite();
+    emitPutVirtualRegister(dst, resultRegs);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITOpcodes32_64.cpp b/jit/JITOpcodes32_64.cpp
new file mode 100644
index 0000000..e4b90b5
--- /dev/null
+++ b/jit/JITOpcodes32_64.cpp
@@ -0,0 +1,1343 @@
+/*
+ * Copyright (C) 2009, 2012-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+#if USE(JSVALUE32_64)
+#include "JIT.h"
+
+#include "CCallHelpers.h"
+#include "Exception.h"
+#include "JITInlines.h"
+#include "JSArray.h"
+#include "JSCell.h"
+#include "JSFunction.h"
+#include "JSPropertyNameEnumerator.h"
+#include "LinkBuffer.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "Opcode.h"
+#include "SlowPathCall.h"
+#include "TypeProfilerLog.h"
+#include "VirtualRegister.h"
+
+namespace JSC {
+
+JIT::CodeRef JIT::privateCompileCTINativeCall(VM* vm, NativeFunction func)
+{
+    // FIXME: This should be able to log ShadowChicken prologue packets.
+    // https://bugs.webkit.org/show_bug.cgi?id=155689
+    
+    Call nativeCall;
+
+    emitFunctionPrologue();
+    emitPutToCallFrameHeader(0, CallFrameSlot::codeBlock);
+    storePtr(callFrameRegister, &m_vm->topCallFrame);
+
+#if CPU(X86)
+    // Calling convention:      f(ecx, edx, ...);
+    // Host function signature: f(ExecState*);
+    move(callFrameRegister, X86Registers::ecx);
+
+    subPtr(TrustedImm32(8), stackPointerRegister); // Align stack for call.
+    storePtr(X86Registers::ecx, Address(stackPointerRegister));
+
+    // call the function
+    nativeCall = call();
+
+    addPtr(TrustedImm32(8), stackPointerRegister);
+
+#elif CPU(ARM) || CPU(SH4) || CPU(MIPS)
+#if CPU(MIPS)
+    // Allocate stack space for (unused) 16 bytes (8-byte aligned) for 4 arguments.
+    subPtr(TrustedImm32(16), stackPointerRegister);
+#endif
+
+    // Calling convention is f(argumentGPR0, argumentGPR1, ...).
+    // Host function signature is f(ExecState*).
+    move(callFrameRegister, argumentGPR0);
+
+    emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, argumentGPR1);
+    loadPtr(Address(argumentGPR1, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    // call the function
+    nativeCall = call();
+
+#if CPU(MIPS)
+    // Restore stack space
+    addPtr(TrustedImm32(16), stackPointerRegister);
+#endif
+
+    restoreReturnAddressBeforeReturn(regT3);
+#else
+#error "JIT not supported on this platform."
+    abortWithReason(JITNotSupported);
+#endif // CPU(X86)
+
+    // Check for an exception
+    Jump sawException = branch32(NotEqual, AbsoluteAddress(vm->addressOfException()), TrustedImm32(0));
+
+    emitFunctionEpilogue();
+    // Return.
+    ret();
+
+    // Handle an exception
+    sawException.link(this);
+
+    storePtr(callFrameRegister, &m_vm->topCallFrame);
+
+#if CPU(X86)
+    addPtr(TrustedImm32(-4), stackPointerRegister);
+    move(callFrameRegister, X86Registers::ecx);
+    push(X86Registers::ecx);
+#else
+    move(callFrameRegister, argumentGPR0);
+#endif
+    move(TrustedImmPtr(FunctionPtr(operationVMHandleException).value()), regT3);
+    call(regT3);
+
+#if CPU(X86)
+    addPtr(TrustedImm32(8), stackPointerRegister);
+#endif
+
+    jumpToExceptionHandler();
+
+    // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
+    LinkBuffer patchBuffer(*m_vm, *this, GLOBAL_THUNK_ID);
+
+    patchBuffer.link(nativeCall, FunctionPtr(func));
+    return FINALIZE_CODE(patchBuffer, ("JIT CTI native call"));
+}
+
+void JIT::emit_op_mov(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+    
+    if (m_codeBlock->isConstantRegisterIndex(src))
+        emitStore(dst, getConstantOperand(src));
+    else {
+        emitLoad(src, regT1, regT0);
+        emitStore(dst, regT1, regT0);
+    }
+}
+
+void JIT::emit_op_end(Instruction* currentInstruction)
+{
+    ASSERT(returnValueGPR != callFrameRegister);
+    emitLoad(currentInstruction[1].u.operand, regT1, returnValueGPR);
+    emitRestoreCalleeSaves();
+    emitFunctionEpilogue();
+    ret();
+}
+
+void JIT::emit_op_jmp(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target);
+}
+
+void JIT::emit_op_new_object(Instruction* currentInstruction)
+{
+    Structure* structure = currentInstruction[3].u.objectAllocationProfile->structure();
+    size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
+    MarkedAllocator* allocator = subspaceFor<JSFinalObject>(*m_vm)->allocatorFor(allocationSize);
+
+    RegisterID resultReg = returnValueGPR;
+    RegisterID allocatorReg = regT1;
+    RegisterID scratchReg = regT3;
+
+    move(TrustedImmPtr(allocator), allocatorReg);
+    if (allocator)
+        addSlowCase(Jump());
+    JumpList slowCases;
+    emitAllocateJSObject(resultReg, allocator, allocatorReg, TrustedImmPtr(structure), TrustedImmPtr(0), scratchReg, slowCases);
+    emitInitializeInlineStorage(resultReg, structure->inlineCapacity());
+    addSlowCase(slowCases);
+    emitStoreCell(currentInstruction[1].u.operand, resultReg);
+}
+
+void JIT::emitSlow_op_new_object(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    int dst = currentInstruction[1].u.operand;
+    Structure* structure = currentInstruction[3].u.objectAllocationProfile->structure();
+    callOperation(operationNewObject, structure);
+    emitStoreCell(dst, returnValueGPR);
+}
+
+void JIT::emit_op_overrides_has_instance(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int constructor = currentInstruction[2].u.operand;
+    int hasInstanceValue = currentInstruction[3].u.operand;
+
+    emitLoadPayload(hasInstanceValue, regT0);
+    // We don't jump if we know what Symbol.hasInstance would do.
+    Jump hasInstanceValueNotCell = emitJumpIfNotJSCell(hasInstanceValue);
+    Jump customhasInstanceValue = branchPtr(NotEqual, regT0, TrustedImmPtr(m_codeBlock->globalObject()->functionProtoHasInstanceSymbolFunction()));
+
+    // We know that constructor is an object from the way bytecode is emitted for instanceof expressions.
+    emitLoadPayload(constructor, regT0);
+
+    // Check that constructor 'ImplementsDefaultHasInstance' i.e. the object is not a C-API user nor a bound function.
+    test8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(ImplementsDefaultHasInstance), regT0);
+    Jump done = jump();
+
+    hasInstanceValueNotCell.link(this);
+    customhasInstanceValue.link(this);
+    move(TrustedImm32(1), regT0);
+
+    done.link(this);
+    emitStoreBool(dst, regT0);
+
+}
+
+void JIT::emit_op_instanceof(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    int proto = currentInstruction[3].u.operand;
+
+    // Load the operands into registers.
+    // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
+    emitLoadPayload(value, regT2);
+    emitLoadPayload(proto, regT1);
+
+    // Check that proto are cells. baseVal must be a cell - this is checked by the get_by_id for Symbol.hasInstance.
+    emitJumpSlowCaseIfNotJSCell(value);
+    emitJumpSlowCaseIfNotJSCell(proto);
+    
+    // Check that prototype is an object
+    addSlowCase(emitJumpIfCellNotObject(regT1));
+
+    // Optimistically load the result true, and start looping.
+    // Initially, regT1 still contains proto and regT2 still contains value.
+    // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
+    move(TrustedImm32(1), regT0);
+    Label loop(this);
+
+    addSlowCase(branch8(Equal, Address(regT2, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType)));
+
+    // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!
+    // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
+    loadPtr(Address(regT2, JSCell::structureIDOffset()), regT2);
+    load32(Address(regT2, Structure::prototypeOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    Jump isInstance = branchPtr(Equal, regT2, regT1);
+    branchTest32(NonZero, regT2).linkTo(loop, this);
+
+    // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
+    move(TrustedImm32(0), regT0);
+
+    // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
+    isInstance.link(this);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_instanceof_custom(Instruction*)
+{
+    // This always goes to slow path since we expect it to be rare.
+    addSlowCase(jump());
+}
+
+void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    int proto = currentInstruction[3].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, value);
+    linkSlowCaseIfNotJSCell(iter, proto);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    emitLoad(value, regT1, regT0);
+    emitLoad(proto, regT3, regT2);
+    callOperation(operationInstanceOf, dst, regT1, regT0, regT3, regT2);
+}
+
+void JIT::emitSlow_op_instanceof_custom(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    int constructor = currentInstruction[3].u.operand;
+    int hasInstanceValue = currentInstruction[4].u.operand;
+
+    linkSlowCase(iter);
+
+    emitLoad(value, regT1, regT0);
+    emitLoadPayload(constructor, regT2);
+    emitLoad(hasInstanceValue, regT4, regT3);
+    callOperation(operationInstanceOfCustom, regT1, regT0, regT2, regT4, regT3);
+    emitStoreBool(dst, returnValueGPR);
+}
+    
+void JIT::emit_op_is_empty(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    
+    emitLoad(value, regT1, regT0);
+    compare32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag), regT0);
+
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_is_undefined(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    
+    emitLoad(value, regT1, regT0);
+    Jump isCell = branch32(Equal, regT1, TrustedImm32(JSValue::CellTag));
+
+    compare32(Equal, regT1, TrustedImm32(JSValue::UndefinedTag), regT0);
+    Jump done = jump();
+    
+    isCell.link(this);
+    Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+    move(TrustedImm32(0), regT0);
+    Jump notMasqueradesAsUndefined = jump();
+    
+    isMasqueradesAsUndefined.link(this);
+    loadPtr(Address(regT0, JSCell::structureIDOffset()), regT1);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    loadPtr(Address(regT1, Structure::globalObjectOffset()), regT1);
+    compare32(Equal, regT0, regT1, regT0);
+
+    notMasqueradesAsUndefined.link(this);
+    done.link(this);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_is_boolean(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    
+    emitLoadTag(value, regT0);
+    compare32(Equal, regT0, TrustedImm32(JSValue::BooleanTag), regT0);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_is_number(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    
+    emitLoadTag(value, regT0);
+    add32(TrustedImm32(1), regT0);
+    compare32(Below, regT0, TrustedImm32(JSValue::LowestTag + 1), regT0);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_is_cell_with_type(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+    int type = currentInstruction[3].u.operand;
+
+    emitLoad(value, regT1, regT0);
+    Jump isNotCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+
+    compare8(Equal, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(type), regT0);
+    Jump done = jump();
+
+    isNotCell.link(this);
+    move(TrustedImm32(0), regT0);
+
+    done.link(this);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_is_object(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int value = currentInstruction[2].u.operand;
+
+    emitLoad(value, regT1, regT0);
+    Jump isNotCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+
+    compare8(AboveOrEqual, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(ObjectType), regT0);
+    Jump done = jump();
+
+    isNotCell.link(this);
+    move(TrustedImm32(0), regT0);
+
+    done.link(this);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_to_primitive(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump isImm = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    addSlowCase(emitJumpIfCellObject(regT0));
+    isImm.link(this);
+
+    if (dst != src)
+        emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_primitive);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_set_function_name(Instruction* currentInstruction)
+{
+    int func = currentInstruction[1].u.operand;
+    int name = currentInstruction[2].u.operand;
+    emitLoadPayload(func, regT1);
+    emitLoad(name, regT3, regT2);
+    callOperation(operationSetFunctionName, regT1, regT3, regT2);
+}
+
+void JIT::emit_op_strcat(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_strcat);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_not(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitLoadTag(src, regT0);
+
+    emitLoad(src, regT1, regT0);
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::BooleanTag)));
+    xor32(TrustedImm32(1), regT0);
+
+    emitStoreBool(dst, regT0, (dst == src));
+}
+
+void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_not);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_jfalse(Instruction* currentInstruction)
+{
+    int cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitLoad(cond, regT1, regT0);
+
+    JSValueRegs value(regT1, regT0);
+    GPRReg scratch = regT2;
+    GPRReg result = regT3;
+    bool shouldCheckMasqueradesAsUndefined = true;
+    emitConvertValueToBoolean(value, result, scratch, fpRegT0, fpRegT1, shouldCheckMasqueradesAsUndefined, m_codeBlock->globalObject());
+
+    addJump(branchTest32(Zero, result), target);
+}
+
+void JIT::emit_op_jtrue(Instruction* currentInstruction)
+{
+    int cond = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitLoad(cond, regT1, regT0);
+    bool shouldCheckMasqueradesAsUndefined = true;
+    JSValueRegs value(regT1, regT0);
+    GPRReg scratch = regT2;
+    GPRReg result = regT3;
+    emitConvertValueToBoolean(value, result, scratch, fpRegT0, fpRegT1, shouldCheckMasqueradesAsUndefined, m_codeBlock->globalObject());
+
+    addJump(branchTest32(NonZero, result), target);
+}
+
+void JIT::emit_op_jeq_null(Instruction* currentInstruction)
+{
+    int src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+
+    Jump isNotMasqueradesAsUndefined = branchTest8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+    loadPtr(Address(regT0, JSCell::structureIDOffset()), regT2);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    addJump(branchPtr(Equal, Address(regT2, Structure::globalObjectOffset()), regT0), target);
+    Jump masqueradesGlobalObjectIsForeign = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && (JSValue::NullTag & 0x1));
+    or32(TrustedImm32(1), regT1);
+    addJump(branch32(Equal, regT1, TrustedImm32(JSValue::NullTag)), target);
+
+    isNotMasqueradesAsUndefined.link(this);
+    masqueradesGlobalObjectIsForeign.link(this);
+}
+
+void JIT::emit_op_jneq_null(Instruction* currentInstruction)
+{
+    int src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+
+    addJump(branchTest8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
+    loadPtr(Address(regT0, JSCell::structureIDOffset()), regT2);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    addJump(branchPtr(NotEqual, Address(regT2, Structure::globalObjectOffset()), regT0), target);
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+
+    ASSERT((JSValue::UndefinedTag + 1 == JSValue::NullTag) && (JSValue::NullTag & 0x1));
+    or32(TrustedImm32(1), regT1);
+    addJump(branch32(NotEqual, regT1, TrustedImm32(JSValue::NullTag)), target);
+
+    wasNotImmediate.link(this);
+}
+
+void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
+{
+    int src = currentInstruction[1].u.operand;
+    Special::Pointer ptr = currentInstruction[2].u.specialPointer;
+    unsigned target = currentInstruction[3].u.operand;
+
+    emitLoad(src, regT1, regT0);
+    CCallHelpers::Jump notCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    CCallHelpers::Jump equal = branchPtr(Equal, regT0, TrustedImmPtr(actualPointerFor(m_codeBlock, ptr)));
+    notCell.link(this);
+    store32(TrustedImm32(1), &currentInstruction[4].u.operand);
+    addJump(jump(), target);
+    equal.link(this);
+}
+
+void JIT::emit_op_eq(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src1 = currentInstruction[2].u.operand;
+    int src2 = currentInstruction[3].u.operand;
+
+    emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, regT3));
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
+
+    compare32(Equal, regT0, regT2, regT0);
+
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int op1 = currentInstruction[2].u.operand;
+    int op2 = currentInstruction[3].u.operand;
+
+    JumpList storeResult;
+    JumpList genericCase;
+
+    genericCase.append(getSlowCase(iter)); // tags not equal
+
+    linkSlowCase(iter); // tags equal and JSCell
+    genericCase.append(branchPtr(NotEqual, Address(regT0, JSCell::structureIDOffset()), TrustedImmPtr(m_vm->stringStructure.get())));
+    genericCase.append(branchPtr(NotEqual, Address(regT2, JSCell::structureIDOffset()), TrustedImmPtr(m_vm->stringStructure.get())));
+
+    // String case.
+    callOperation(operationCompareStringEq, regT0, regT2);
+    storeResult.append(jump());
+
+    // Generic case.
+    genericCase.append(getSlowCase(iter)); // doubles
+    genericCase.link(this);
+    emitLoad(op1, regT1, regT0);
+    emitLoad(op2, regT3, regT2);
+    callOperation(operationCompareEq, regT1, regT0, regT3, regT2);
+
+    storeResult.link(this);
+    emitStoreBool(dst, returnValueGPR);
+}
+
+void JIT::emit_op_neq(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src1 = currentInstruction[2].u.operand;
+    int src2 = currentInstruction[3].u.operand;
+
+    emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
+    addSlowCase(branch32(NotEqual, regT1, regT3));
+    addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::CellTag)));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
+
+    compare32(NotEqual, regT0, regT2, regT0);
+
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+
+    JumpList storeResult;
+    JumpList genericCase;
+
+    genericCase.append(getSlowCase(iter)); // tags not equal
+
+    linkSlowCase(iter); // tags equal and JSCell
+    genericCase.append(branchPtr(NotEqual, Address(regT0, JSCell::structureIDOffset()), TrustedImmPtr(m_vm->stringStructure.get())));
+    genericCase.append(branchPtr(NotEqual, Address(regT2, JSCell::structureIDOffset()), TrustedImmPtr(m_vm->stringStructure.get())));
+
+    // String case.
+    callOperation(operationCompareStringEq, regT0, regT2);
+    storeResult.append(jump());
+
+    // Generic case.
+    genericCase.append(getSlowCase(iter)); // doubles
+    genericCase.link(this);
+    callOperation(operationCompareEq, regT1, regT0, regT3, regT2);
+
+    storeResult.link(this);
+    xor32(TrustedImm32(0x1), returnValueGPR);
+    emitStoreBool(dst, returnValueGPR);
+}
+
+void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqType type)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src1 = currentInstruction[2].u.operand;
+    int src2 = currentInstruction[3].u.operand;
+
+    emitLoad2(src1, regT1, regT0, src2, regT3, regT2);
+
+    // Bail if the tags differ, or are double.
+    addSlowCase(branch32(NotEqual, regT1, regT3));
+    addSlowCase(branch32(Below, regT1, TrustedImm32(JSValue::LowestTag)));
+
+    // Jump to a slow case if both are strings or symbols (non object).
+    Jump notCell = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+    Jump firstIsObject = emitJumpIfCellObject(regT0);
+    addSlowCase(emitJumpIfCellNotObject(regT2));
+    notCell.link(this);
+    firstIsObject.link(this);
+
+    // Simply compare the payloads.
+    if (type == OpStrictEq)
+        compare32(Equal, regT0, regT2, regT0);
+    else
+        compare32(NotEqual, regT0, regT2, regT0);
+
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::emit_op_stricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpStrictEq);
+}
+
+void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_stricteq);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_nstricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpNStrictEq);
+}
+
+void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_nstricteq);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_eq_null(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+
+    Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+    move(TrustedImm32(0), regT1);
+    Jump wasNotMasqueradesAsUndefined = jump();
+
+    isMasqueradesAsUndefined.link(this);
+    loadPtr(Address(regT0, JSCell::structureIDOffset()), regT2);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
+    compare32(Equal, regT0, regT2, regT1);
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    compare32(Equal, regT1, TrustedImm32(JSValue::NullTag), regT2);
+    compare32(Equal, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
+    or32(regT2, regT1);
+
+    wasNotImmediate.link(this);
+    wasNotMasqueradesAsUndefined.link(this);
+
+    emitStoreBool(dst, regT1);
+}
+
+void JIT::emit_op_neq_null(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+    Jump isImmediate = branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag));
+
+    Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+    move(TrustedImm32(1), regT1);
+    Jump wasNotMasqueradesAsUndefined = jump();
+
+    isMasqueradesAsUndefined.link(this);
+    loadPtr(Address(regT0, JSCell::structureIDOffset()), regT2);
+    move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
+    loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
+    compare32(NotEqual, regT0, regT2, regT1);
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    compare32(NotEqual, regT1, TrustedImm32(JSValue::NullTag), regT2);
+    compare32(NotEqual, regT1, TrustedImm32(JSValue::UndefinedTag), regT1);
+    and32(regT2, regT1);
+
+    wasNotImmediate.link(this);
+    wasNotMasqueradesAsUndefined.link(this);
+
+    emitStoreBool(dst, regT1);
+}
+
+void JIT::emit_op_throw(Instruction* currentInstruction)
+{
+    ASSERT(regT0 == returnValueGPR);
+    copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+    emitLoad(currentInstruction[1].u.operand, regT1, regT0);
+    callOperationNoExceptionCheck(operationThrow, regT1, regT0);
+    jumpToExceptionHandler();
+}
+
+void JIT::emit_op_push_with_scope(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_push_with_scope);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_to_number(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    Jump isInt32 = branch32(Equal, regT1, TrustedImm32(JSValue::Int32Tag));
+    addSlowCase(branch32(AboveOrEqual, regT1, TrustedImm32(JSValue::LowestTag)));
+    isInt32.link(this);
+
+    emitValueProfilingSite();
+    if (src != dst)
+        emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_to_number(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_number);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_to_string(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitLoad(src, regT1, regT0);
+
+    addSlowCase(branch32(NotEqual, regT1, TrustedImm32(JSValue::CellTag)));
+    addSlowCase(branch8(NotEqual, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+
+    if (src != dst)
+        emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_to_string(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter); // Not JSCell.
+    linkSlowCase(iter); // Not JSString.
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_string);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_catch(Instruction* currentInstruction)
+{
+    restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer();
+
+    move(TrustedImmPtr(m_vm), regT3);
+    // operationThrow returns the callFrame for the handler.
+    load32(Address(regT3, VM::callFrameForCatchOffset()), callFrameRegister);
+    storePtr(TrustedImmPtr(nullptr), Address(regT3, VM::callFrameForCatchOffset()));
+
+    addPtr(TrustedImm32(stackPointerOffsetFor(codeBlock()) * sizeof(Register)), callFrameRegister, stackPointerRegister);
+
+    callOperationNoExceptionCheck(operationCheckIfExceptionIsUncatchableAndNotifyProfiler);
+    Jump isCatchableException = branchTest32(Zero, returnValueGPR);
+    jumpToExceptionHandler();
+    isCatchableException.link(this);
+
+    move(TrustedImmPtr(m_vm), regT3);
+
+    // Now store the exception returned by operationThrow.
+    load32(Address(regT3, VM::exceptionOffset()), regT2);
+    move(TrustedImm32(JSValue::CellTag), regT1);
+
+    store32(TrustedImm32(0), Address(regT3, VM::exceptionOffset()));
+
+    unsigned exception = currentInstruction[1].u.operand;
+    emitStore(exception, regT1, regT2);
+
+    load32(Address(regT2, Exception::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
+    load32(Address(regT2, Exception::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
+
+    unsigned thrownValue = currentInstruction[2].u.operand;
+    emitStore(thrownValue, regT1, regT0);
+}
+
+void JIT::emit_op_assert(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_assert);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_create_lexical_environment(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_lexical_environment);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_get_parent_scope(Instruction* currentInstruction)
+{
+    int currentScope = currentInstruction[2].u.operand;
+    emitLoadPayload(currentScope, regT0);
+    loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
+    emitStoreCell(currentInstruction[1].u.operand, regT0);
+}
+
+void JIT::emit_op_switch_imm(Instruction* currentInstruction)
+{
+    size_t tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->switchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset, SwitchRecord::Immediate));
+    jumpTable->ensureCTITable();
+
+    emitLoad(scrutinee, regT1, regT0);
+    callOperation(operationSwitchImmWithUnknownKeyType, regT1, regT0, tableIndex);
+    jump(returnValueGPR);
+}
+
+void JIT::emit_op_switch_char(Instruction* currentInstruction)
+{
+    size_t tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->switchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset, SwitchRecord::Character));
+    jumpTable->ensureCTITable();
+
+    emitLoad(scrutinee, regT1, regT0);
+    callOperation(operationSwitchCharWithUnknownKeyType, regT1, regT0, tableIndex);
+    jump(returnValueGPR);
+}
+
+void JIT::emit_op_switch_string(Instruction* currentInstruction)
+{
+    size_t tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset));
+
+    emitLoad(scrutinee, regT1, regT0);
+    callOperation(operationSwitchStringWithUnknownKeyType, regT1, regT0, tableIndex);
+    jump(returnValueGPR);
+}
+
+void JIT::emit_op_debug(Instruction* currentInstruction)
+{
+    load32(codeBlock()->debuggerRequestsAddress(), regT0);
+    Jump noDebuggerRequests = branchTest32(Zero, regT0);
+    callOperation(operationDebug, currentInstruction[1].u.operand);
+    noDebuggerRequests.link(this);
+}
+
+
+void JIT::emit_op_enter(Instruction* currentInstruction)
+{
+    emitEnterOptimizationCheck();
+    
+    // Even though JIT code doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    for (int i = 0; i < m_codeBlock->m_numVars; ++i)
+        emitStore(virtualRegisterForLocal(i).offset(), jsUndefined());
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_enter);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_get_scope(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, regT0);
+    loadPtr(Address(regT0, JSFunction::offsetOfScopeChain()), regT0);
+    emitStoreCell(dst, regT0);
+}
+
+void JIT::emit_op_create_this(Instruction* currentInstruction)
+{
+    int callee = currentInstruction[2].u.operand;
+    WriteBarrierBase<JSCell>* cachedFunction = &currentInstruction[4].u.jsCell;
+    RegisterID calleeReg = regT0;
+    RegisterID rareDataReg = regT4;
+    RegisterID resultReg = regT0;
+    RegisterID allocatorReg = regT1;
+    RegisterID structureReg = regT2;
+    RegisterID cachedFunctionReg = regT4;
+    RegisterID scratchReg = regT3;
+
+    emitLoadPayload(callee, calleeReg);
+    addSlowCase(branch8(NotEqual, Address(calleeReg, JSCell::typeInfoTypeOffset()), TrustedImm32(JSFunctionType)));
+    loadPtr(Address(calleeReg, JSFunction::offsetOfRareData()), rareDataReg);
+    addSlowCase(branchTestPtr(Zero, rareDataReg));
+    loadPtr(Address(rareDataReg, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorReg);
+    loadPtr(Address(rareDataReg, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureReg);
+    addSlowCase(branchTestPtr(Zero, allocatorReg));
+
+    loadPtr(cachedFunction, cachedFunctionReg);
+    Jump hasSeenMultipleCallees = branchPtr(Equal, cachedFunctionReg, TrustedImmPtr(JSCell::seenMultipleCalleeObjects()));
+    addSlowCase(branchPtr(NotEqual, calleeReg, cachedFunctionReg));
+    hasSeenMultipleCallees.link(this);
+
+    JumpList slowCases;
+    emitAllocateJSObject(resultReg, nullptr, allocatorReg, structureReg, TrustedImmPtr(0), scratchReg, slowCases);
+    addSlowCase(slowCases);
+    emitStoreCell(currentInstruction[1].u.operand, resultReg);
+}
+
+void JIT::emitSlow_op_create_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter); // Callee::m_type != JSFunctionType.
+    linkSlowCase(iter); // doesn't have rare data
+    linkSlowCase(iter); // doesn't have an allocation profile
+    linkSlowCase(iter); // allocation failed (no allocator)
+    linkSlowCase(iter); // allocation failed (allocator empty)
+    linkSlowCase(iter); // cached function didn't match
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_this);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_to_this(Instruction* currentInstruction)
+{
+    WriteBarrierBase<Structure>* cachedStructure = &currentInstruction[2].u.structure;
+    int thisRegister = currentInstruction[1].u.operand;
+
+    emitLoad(thisRegister, regT3, regT2);
+
+    addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::CellTag)));
+    addSlowCase(branch8(NotEqual, Address(regT2, JSCell::typeInfoTypeOffset()), TrustedImm32(FinalObjectType)));
+    loadPtr(Address(regT2, JSCell::structureIDOffset()), regT0);
+    loadPtr(cachedStructure, regT2);
+    addSlowCase(branchPtr(NotEqual, regT0, regT2));
+}
+
+void JIT::emitSlow_op_to_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_this);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_check_tdz(Instruction* currentInstruction)
+{
+    emitLoadTag(currentInstruction[1].u.operand, regT0);
+    addSlowCase(branch32(Equal, regT0, TrustedImm32(JSValue::EmptyValueTag)));
+}
+
+void JIT::emitSlow_op_check_tdz(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_throw_tdz_error);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_has_structure_property(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int enumerator = currentInstruction[4].u.operand;
+
+    emitLoadPayload(base, regT0);
+    emitJumpSlowCaseIfNotJSCell(base);
+
+    emitLoadPayload(enumerator, regT1);
+
+    load32(Address(regT0, JSCell::structureIDOffset()), regT0);
+    addSlowCase(branch32(NotEqual, regT0, Address(regT1, JSPropertyNameEnumerator::cachedStructureIDOffset())));
+    
+    move(TrustedImm32(1), regT0);
+    emitStoreBool(dst, regT0);
+}
+
+void JIT::privateCompileHasIndexedProperty(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
+{
+    Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
+    
+    PatchableJump badType;
+    
+    // FIXME: Add support for other types like TypedArrays and Arguments.
+    // See https://bugs.webkit.org/show_bug.cgi?id=135033 and https://bugs.webkit.org/show_bug.cgi?id=135034.
+    JumpList slowCases = emitLoadForArrayMode(currentInstruction, arrayMode, badType);
+    move(TrustedImm32(1), regT0);
+    Jump done = jump();
+
+    LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
+    
+    patchBuffer.link(badType, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    
+    patchBuffer.link(done, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
+    
+    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
+        m_codeBlock, patchBuffer,
+        ("Baseline has_indexed_property stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value()));
+    
+    MacroAssembler::repatchJump(byValInfo->badTypeJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
+    MacroAssembler::repatchCall(CodeLocationCall(MacroAssemblerCodePtr(returnAddress)), FunctionPtr(operationHasIndexedPropertyGeneric));
+}
+
+void JIT::emit_op_has_indexed_property(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ByValInfo* byValInfo = m_codeBlock->addByValInfo();
+    
+    emitLoadPayload(base, regT0);
+    emitJumpSlowCaseIfNotJSCell(base);
+
+    emitLoadPayload(property, regT1);
+
+    // This is technically incorrect - we're zero-extending an int32. On the hot path this doesn't matter.
+    // We check the value as if it was a uint32 against the m_vectorLength - which will always fail if
+    // number was signed since m_vectorLength is always less than intmax (since the total allocation
+    // size is always less than 4Gb). As such zero extending will have been correct (and extending the value
+    // to 64-bits is necessary since it's used in the address calculation. We zero extend rather than sign
+    // extending since it makes it easier to re-tag the value in the slow case.
+    zeroExtend32ToPtr(regT1, regT1);
+
+    emitArrayProfilingSiteWithCell(regT0, regT2, profile);
+    and32(TrustedImm32(IndexingShapeMask), regT2);
+
+    JITArrayMode mode = chooseArrayMode(profile);
+    PatchableJump badType;
+
+    // FIXME: Add support for other types like TypedArrays and Arguments.
+    // See https://bugs.webkit.org/show_bug.cgi?id=135033 and https://bugs.webkit.org/show_bug.cgi?id=135034.
+    JumpList slowCases = emitLoadForArrayMode(currentInstruction, mode, badType);
+    move(TrustedImm32(1), regT0);
+
+    addSlowCase(badType);
+    addSlowCase(slowCases);
+    
+    Label done = label();
+    
+    emitStoreBool(dst, regT0);
+
+    Label nextHotPath = label();
+    
+    m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done, nextHotPath));
+}
+
+void JIT::emitSlow_op_has_indexed_property(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
+    
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // base array check
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
+
+    Label slowPath = label();
+    
+    emitLoad(base, regT1, regT0);
+    emitLoad(property, regT3, regT2);
+    Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT1, regT0, regT3, regT2, byValInfo);
+
+    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
+    m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
+    m_byValInstructionIndex++;
+}
+
+void JIT::emit_op_get_direct_pname(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int index = currentInstruction[4].u.operand;
+    int enumerator = currentInstruction[5].u.operand;
+
+    // Check that base is a cell
+    emitLoadPayload(base, regT0);
+    emitJumpSlowCaseIfNotJSCell(base);
+
+    // Check the structure
+    emitLoadPayload(enumerator, regT1);
+    load32(Address(regT0, JSCell::structureIDOffset()), regT2);
+    addSlowCase(branch32(NotEqual, regT2, Address(regT1, JSPropertyNameEnumerator::cachedStructureIDOffset())));
+
+    // Compute the offset
+    emitLoadPayload(index, regT2);
+    // If index is less than the enumerator's cached inline storage, then it's an inline access
+    Jump outOfLineAccess = branch32(AboveOrEqual, regT2, Address(regT1, JSPropertyNameEnumerator::cachedInlineCapacityOffset()));
+    addPtr(TrustedImm32(JSObject::offsetOfInlineStorage()), regT0);
+    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
+    load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
+    
+    Jump done = jump();
+
+    // Otherwise it's out of line
+    outOfLineAccess.link(this);
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
+    sub32(Address(regT1, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), regT2);
+    neg32(regT2);
+    int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
+    load32(BaseIndex(regT0, regT2, TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1);
+    load32(BaseIndex(regT0, regT2, TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0);
+    
+    done.link(this);
+    emitValueProfilingSite();
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_direct_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[2].u.operand;
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_direct_pname);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_enumerator_structure_pname(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int enumerator = currentInstruction[2].u.operand;
+    int index = currentInstruction[3].u.operand;
+
+    emitLoadPayload(index, regT0);
+    emitLoadPayload(enumerator, regT1);
+    Jump inBounds = branch32(Below, regT0, Address(regT1, JSPropertyNameEnumerator::endStructurePropertyIndexOffset()));
+
+    move(TrustedImm32(JSValue::NullTag), regT2);
+    move(TrustedImm32(0), regT0);
+
+    Jump done = jump();
+    inBounds.link(this);
+
+    loadPtr(Address(regT1, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), regT1);
+    loadPtr(BaseIndex(regT1, regT0, timesPtr()), regT0);
+    move(TrustedImm32(JSValue::CellTag), regT2);
+
+    done.link(this);
+    emitStore(dst, regT2, regT0);
+}
+
+void JIT::emit_op_enumerator_generic_pname(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int enumerator = currentInstruction[2].u.operand;
+    int index = currentInstruction[3].u.operand;
+
+    emitLoadPayload(index, regT0);
+    emitLoadPayload(enumerator, regT1);
+    Jump inBounds = branch32(Below, regT0, Address(regT1, JSPropertyNameEnumerator::endGenericPropertyIndexOffset()));
+
+    move(TrustedImm32(JSValue::NullTag), regT2);
+    move(TrustedImm32(0), regT0);
+
+    Jump done = jump();
+    inBounds.link(this);
+
+    loadPtr(Address(regT1, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()), regT1);
+    loadPtr(BaseIndex(regT1, regT0, timesPtr()), regT0);
+    move(TrustedImm32(JSValue::CellTag), regT2);
+    
+    done.link(this);
+    emitStore(dst, regT2, regT0);
+}
+
+void JIT::emit_op_profile_type(Instruction* currentInstruction)
+{
+    TypeLocation* cachedTypeLocation = currentInstruction[2].u.location;
+    int valueToProfile = currentInstruction[1].u.operand;
+
+    // Load payload in T0. Load tag in T3.
+    emitLoadPayload(valueToProfile, regT0);
+    emitLoadTag(valueToProfile, regT3);
+
+    JumpList jumpToEnd;
+
+    jumpToEnd.append(branch32(Equal, regT3, TrustedImm32(JSValue::EmptyValueTag)));
+
+    // Compile in a predictive type check, if possible, to see if we can skip writing to the log.
+    // These typechecks are inlined to match those of the 32-bit JSValue type checks.
+    if (cachedTypeLocation->m_lastSeenType == TypeUndefined)
+        jumpToEnd.append(branch32(Equal, regT3, TrustedImm32(JSValue::UndefinedTag)));
+    else if (cachedTypeLocation->m_lastSeenType == TypeNull)
+        jumpToEnd.append(branch32(Equal, regT3, TrustedImm32(JSValue::NullTag)));
+    else if (cachedTypeLocation->m_lastSeenType == TypeBoolean)
+        jumpToEnd.append(branch32(Equal, regT3, TrustedImm32(JSValue::BooleanTag)));
+    else if (cachedTypeLocation->m_lastSeenType == TypeAnyInt)
+        jumpToEnd.append(branch32(Equal, regT3, TrustedImm32(JSValue::Int32Tag)));
+    else if (cachedTypeLocation->m_lastSeenType == TypeNumber) {
+        jumpToEnd.append(branch32(Below, regT3, TrustedImm32(JSValue::LowestTag)));
+        jumpToEnd.append(branch32(Equal, regT3, TrustedImm32(JSValue::Int32Tag)));
+    } else if (cachedTypeLocation->m_lastSeenType == TypeString) {
+        Jump isNotCell = branch32(NotEqual, regT3, TrustedImm32(JSValue::CellTag));
+        jumpToEnd.append(branch8(Equal, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType)));
+        isNotCell.link(this);
+    }
+
+    // Load the type profiling log into T2.
+    TypeProfilerLog* cachedTypeProfilerLog = m_vm->typeProfilerLog();
+    move(TrustedImmPtr(cachedTypeProfilerLog), regT2);
+
+    // Load the next log entry into T1.
+    loadPtr(Address(regT2, TypeProfilerLog::currentLogEntryOffset()), regT1);
+
+    // Store the JSValue onto the log entry.
+    store32(regT0, Address(regT1, TypeProfilerLog::LogEntry::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+    store32(regT3, Address(regT1, TypeProfilerLog::LogEntry::valueOffset() + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+
+    // Store the structureID of the cell if argument is a cell, otherwise, store 0 on the log entry.
+    Jump notCell = branch32(NotEqual, regT3, TrustedImm32(JSValue::CellTag));
+    load32(Address(regT0, JSCell::structureIDOffset()), regT0);
+    store32(regT0, Address(regT1, TypeProfilerLog::LogEntry::structureIDOffset()));
+    Jump skipNotCell = jump();
+    notCell.link(this);
+    store32(TrustedImm32(0), Address(regT1, TypeProfilerLog::LogEntry::structureIDOffset()));
+    skipNotCell.link(this);
+
+    // Store the typeLocation on the log entry.
+    move(TrustedImmPtr(cachedTypeLocation), regT0);
+    store32(regT0, Address(regT1, TypeProfilerLog::LogEntry::locationOffset()));
+
+    // Increment the current log entry.
+    addPtr(TrustedImm32(sizeof(TypeProfilerLog::LogEntry)), regT1);
+    store32(regT1, Address(regT2, TypeProfilerLog::currentLogEntryOffset()));
+    jumpToEnd.append(branchPtr(NotEqual, regT1, TrustedImmPtr(cachedTypeProfilerLog->logEndPtr())));
+    // Clear the log if we're at the end of the log.
+    callOperation(operationProcessTypeProfilerLog);
+
+    jumpToEnd.link(this);
+}
+
+void JIT::emit_op_log_shadow_chicken_prologue(Instruction* currentInstruction)
+{
+    updateTopCallFrame();
+    static_assert(nonArgGPR0 != regT0 && nonArgGPR0 != regT2, "we will have problems if this is true.");
+    GPRReg shadowPacketReg = regT0;
+    GPRReg scratch1Reg = nonArgGPR0; // This must be a non-argument register.
+    GPRReg scratch2Reg = regT2;
+    ensureShadowChickenPacket(shadowPacketReg, scratch1Reg, scratch2Reg);
+
+    scratch1Reg = regT4;
+    emitLoadPayload(currentInstruction[1].u.operand, regT3);
+    logShadowChickenProloguePacket(shadowPacketReg, scratch1Reg, regT3);
+}
+
+void JIT::emit_op_log_shadow_chicken_tail(Instruction* currentInstruction)
+{
+    updateTopCallFrame();
+    static_assert(nonArgGPR0 != regT0 && nonArgGPR0 != regT2, "we will have problems if this is true.");
+    GPRReg shadowPacketReg = regT0;
+    GPRReg scratch1Reg = nonArgGPR0; // This must be a non-argument register.
+    GPRReg scratch2Reg = regT2;
+    ensureShadowChickenPacket(shadowPacketReg, scratch1Reg, scratch2Reg);
+
+    emitLoadPayload(currentInstruction[1].u.operand, regT2);
+    emitLoadTag(currentInstruction[1].u.operand, regT1);
+    JSValueRegs thisRegs(regT1, regT2);
+    emitLoadPayload(currentInstruction[2].u.operand, regT3);
+    logShadowChickenTailPacket(shadowPacketReg, thisRegs, regT3, m_codeBlock, CallSiteIndex(currentInstruction));
+}
+
+} // namespace JSC
+
+#endif // USE(JSVALUE32_64)
+#endif // ENABLE(JIT)
diff --git a/jit/JITOperations.cpp b/jit/JITOperations.cpp
new file mode 100644
index 0000000..109c74c
--- /dev/null
+++ b/jit/JITOperations.cpp
@@ -0,0 +1,2842 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITOperations.h"
+
+#if ENABLE(JIT)
+
+#include "ArithProfile.h"
+#include "ArrayConstructor.h"
+#include "CommonSlowPaths.h"
+#include "DFGCompilationMode.h"
+#include "DFGDriver.h"
+#include "DFGOSREntry.h"
+#include "DFGThunks.h"
+#include "DFGWorklist.h"
+#include "Debugger.h"
+#include "DirectArguments.h"
+#include "Error.h"
+#include "ErrorHandlingScope.h"
+#include "EvalCodeBlock.h"
+#include "ExceptionFuzz.h"
+#include "FunctionCodeBlock.h"
+#include "GetterSetter.h"
+#include "HostCallReturnValue.h"
+#include "ICStats.h"
+#include "Interpreter.h"
+#include "JIT.h"
+#include "JITExceptions.h"
+#include "JITToDFGDeferredCompilationCallback.h"
+#include "JSAsyncFunction.h"
+#include "JSCInlines.h"
+#include "JSGeneratorFunction.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSLexicalEnvironment.h"
+#include "JSPropertyNameEnumerator.h"
+#include "ModuleProgramCodeBlock.h"
+#include "ObjectConstructor.h"
+#include "PolymorphicAccess.h"
+#include "ProgramCodeBlock.h"
+#include "PropertyName.h"
+#include "RegExpObject.h"
+#include "Repatch.h"
+#include "ScopedArguments.h"
+#include "ShadowChicken.h"
+#include "StructureStubInfo.h"
+#include "SuperSampler.h"
+#include "TestRunnerUtils.h"
+#include "TypeProfilerLog.h"
+#include "VMInlines.h"
+#include <wtf/InlineASM.h>
+
+namespace JSC {
+
+extern "C" {
+
+#if COMPILER(MSVC)
+void * _ReturnAddress(void);
+#pragma intrinsic(_ReturnAddress)
+
+#define OUR_RETURN_ADDRESS _ReturnAddress()
+#else
+#define OUR_RETURN_ADDRESS __builtin_return_address(0)
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+#define CTI_SAMPLER vm->interpreter->sampler()
+#else
+#define CTI_SAMPLER 0
+#endif
+
+
+void JIT_OPERATION operationThrowStackOverflowError(ExecState* exec, CodeBlock* codeBlock)
+{
+    // We pass in our own code block, because the callframe hasn't been populated.
+    VM* vm = codeBlock->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    VMEntryFrame* vmEntryFrame = vm->topVMEntryFrame;
+    CallFrame* callerFrame = exec->callerFrame(vmEntryFrame);
+    if (!callerFrame) {
+        callerFrame = exec;
+        vmEntryFrame = vm->topVMEntryFrame;
+    }
+
+    NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
+    throwStackOverflowError(callerFrame, scope);
+}
+
+#if ENABLE(WEBASSEMBLY)
+void JIT_OPERATION operationThrowDivideError(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    VMEntryFrame* vmEntryFrame = vm->topVMEntryFrame;
+    CallFrame* callerFrame = exec->callerFrame(vmEntryFrame);
+
+    NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
+    ErrorHandlingScope errorScope(*vm);
+    throwException(callerFrame, scope, createError(callerFrame, ASCIILiteral("Division by zero or division overflow.")));
+}
+
+void JIT_OPERATION operationThrowOutOfBoundsAccessError(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    VMEntryFrame* vmEntryFrame = vm->topVMEntryFrame;
+    CallFrame* callerFrame = exec->callerFrame(vmEntryFrame);
+
+    NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
+    ErrorHandlingScope errorScope(*vm);
+    throwException(callerFrame, scope, createError(callerFrame, ASCIILiteral("Out-of-bounds access.")));
+}
+#endif
+
+int32_t JIT_OPERATION operationCallArityCheck(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForCall);
+    if (missingArgCount < 0) {
+        VMEntryFrame* vmEntryFrame = vm->topVMEntryFrame;
+        CallFrame* callerFrame = exec->callerFrame(vmEntryFrame);
+        NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
+        throwStackOverflowError(callerFrame, scope);
+    }
+
+    return missingArgCount;
+}
+
+int32_t JIT_OPERATION operationConstructArityCheck(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForConstruct);
+    if (missingArgCount < 0) {
+        VMEntryFrame* vmEntryFrame = vm->topVMEntryFrame;
+        CallFrame* callerFrame = exec->callerFrame(vmEntryFrame);
+        NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
+        throwStackOverflowError(callerFrame, scope);
+    }
+
+    return missingArgCount;
+}
+
+EncodedJSValue JIT_OPERATION operationTryGetById(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    Identifier ident = Identifier::fromUid(vm, uid);
+    stubInfo->tookSlowPath = true;
+
+    JSValue baseValue = JSValue::decode(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
+    baseValue.getPropertySlot(exec, ident, slot);
+
+    return JSValue::encode(slot.getPureResult());
+}
+
+
+EncodedJSValue JIT_OPERATION operationTryGetByIdGeneric(ExecState* exec, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    Identifier ident = Identifier::fromUid(vm, uid);
+
+    JSValue baseValue = JSValue::decode(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
+    baseValue.getPropertySlot(exec, ident, slot);
+
+    return JSValue::encode(slot.getPureResult());
+}
+
+EncodedJSValue JIT_OPERATION operationTryGetByIdOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    Identifier ident = Identifier::fromUid(vm, uid);
+
+    JSValue baseValue = JSValue::decode(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
+
+    baseValue.getPropertySlot(exec, ident, slot);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (stubInfo->considerCaching(exec->codeBlock(), baseValue.structureOrNull()) && !slot.isTaintedByOpaqueObject() && (slot.isCacheableValue() || slot.isCacheableGetter() || slot.isUnset()))
+        repatchGetByID(exec, baseValue, ident, slot, *stubInfo, GetByIDKind::Pure);
+
+    return JSValue::encode(slot.getPureResult());
+}
+
+EncodedJSValue JIT_OPERATION operationGetById(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    stubInfo->tookSlowPath = true;
+    
+    JSValue baseValue = JSValue::decode(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
+    Identifier ident = Identifier::fromUid(vm, uid);
+    
+    LOG_IC((ICEvent::OperationGetById, baseValue.classInfoOrNull(), ident));
+    return JSValue::encode(baseValue.get(exec, ident, slot));
+}
+
+EncodedJSValue JIT_OPERATION operationGetByIdGeneric(ExecState* exec, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue baseValue = JSValue::decode(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
+    Identifier ident = Identifier::fromUid(vm, uid);
+    LOG_IC((ICEvent::OperationGetByIdGeneric, baseValue.classInfoOrNull(), ident));
+    return JSValue::encode(baseValue.get(exec, ident, slot));
+}
+
+EncodedJSValue JIT_OPERATION operationGetByIdOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    Identifier ident = Identifier::fromUid(vm, uid);
+
+    JSValue baseValue = JSValue::decode(base);
+    LOG_IC((ICEvent::OperationGetByIdOptimize, baseValue.classInfoOrNull(), ident));
+
+    return JSValue::encode(baseValue.getPropertySlot(exec, ident, [&] (bool found, PropertySlot& slot) -> JSValue {
+        if (stubInfo->considerCaching(exec->codeBlock(), baseValue.structureOrNull()))
+            repatchGetByID(exec, baseValue, ident, slot, *stubInfo, GetByIDKind::Normal);
+        return found ? slot.getValue(exec, ident) : jsUndefined();
+    }));
+}
+
+EncodedJSValue JIT_OPERATION operationInOptimize(ExecState* exec, StructureStubInfo* stubInfo, JSCell* base, UniquedStringImpl* key)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    if (!base->isObject()) {
+        throwException(exec, scope, createInvalidInParameterError(exec, base));
+        return JSValue::encode(jsUndefined());
+    }
+    
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
+    Identifier ident = Identifier::fromUid(vm, key);
+    LOG_IC((ICEvent::OperationInOptimize, base->classInfo(), ident));
+    PropertySlot slot(base, PropertySlot::InternalMethodType::HasProperty);
+    bool result = asObject(base)->getPropertySlot(exec, ident, slot);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    RELEASE_ASSERT(accessType == stubInfo->accessType);
+    
+    if (stubInfo->considerCaching(exec->codeBlock(), asObject(base)->structure()))
+        repatchIn(exec, base, ident, result, slot, *stubInfo);
+    
+    return JSValue::encode(jsBoolean(result));
+}
+
+EncodedJSValue JIT_OPERATION operationIn(ExecState* exec, StructureStubInfo* stubInfo, JSCell* base, UniquedStringImpl* key)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    stubInfo->tookSlowPath = true;
+
+    if (!base->isObject()) {
+        throwException(exec, scope, createInvalidInParameterError(exec, base));
+        return JSValue::encode(jsUndefined());
+    }
+
+    Identifier ident = Identifier::fromUid(vm, key);
+    LOG_IC((ICEvent::OperationIn, base->classInfo(), ident));
+    return JSValue::encode(jsBoolean(asObject(base)->hasProperty(exec, ident)));
+}
+
+EncodedJSValue JIT_OPERATION operationGenericIn(ExecState* exec, JSCell* base, EncodedJSValue key)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return JSValue::encode(jsBoolean(CommonSlowPaths::opIn(exec, JSValue::decode(key), base)));
+}
+
+void JIT_OPERATION operationPutByIdStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    stubInfo->tookSlowPath = true;
+    
+    JSValue baseValue = JSValue::decode(encodedBase);
+    Identifier ident = Identifier::fromUid(vm, uid);
+    LOG_IC((ICEvent::OperationPutByIdStrict, baseValue.classInfoOrNull(), ident));
+
+    PutPropertySlot slot(baseValue, true, exec->codeBlock()->putByIdContext());
+    baseValue.putInline(exec, ident, JSValue::decode(encodedValue), slot);
+}
+
+void JIT_OPERATION operationPutByIdNonStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    stubInfo->tookSlowPath = true;
+    
+    JSValue baseValue = JSValue::decode(encodedBase);
+    Identifier ident = Identifier::fromUid(vm, uid);
+    LOG_IC((ICEvent::OperationPutByIdNonStrict, baseValue.classInfoOrNull(), ident));
+    PutPropertySlot slot(baseValue, false, exec->codeBlock()->putByIdContext());
+    baseValue.putInline(exec, ident, JSValue::decode(encodedValue), slot);
+}
+
+void JIT_OPERATION operationPutByIdDirectStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    stubInfo->tookSlowPath = true;
+    
+    JSValue baseValue = JSValue::decode(encodedBase);
+    Identifier ident = Identifier::fromUid(vm, uid);
+    LOG_IC((ICEvent::OperationPutByIdDirectStrict, baseValue.classInfoOrNull(), ident));
+    PutPropertySlot slot(baseValue, true, exec->codeBlock()->putByIdContext());
+    asObject(baseValue)->putDirect(exec->vm(), ident, JSValue::decode(encodedValue), slot);
+}
+
+void JIT_OPERATION operationPutByIdDirectNonStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    stubInfo->tookSlowPath = true;
+    
+    JSValue baseValue = JSValue::decode(encodedBase);
+    Identifier ident = Identifier::fromUid(vm, uid);
+    LOG_IC((ICEvent::OperationPutByIdDirectNonStrict, baseValue.classInfoOrNull(), ident));
+    PutPropertySlot slot(baseValue, false, exec->codeBlock()->putByIdContext());
+    asObject(baseValue)->putDirect(exec->vm(), ident, JSValue::decode(encodedValue), slot);
+}
+
+void JIT_OPERATION operationPutByIdStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    Identifier ident = Identifier::fromUid(vm, uid);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
+    JSValue value = JSValue::decode(encodedValue);
+    JSValue baseValue = JSValue::decode(encodedBase);
+    LOG_IC((ICEvent::OperationPutByIdStrictOptimize, baseValue.classInfoOrNull(), ident));
+    CodeBlock* codeBlock = exec->codeBlock();
+    PutPropertySlot slot(baseValue, true, codeBlock->putByIdContext());
+
+    Structure* structure = baseValue.isCell() ? baseValue.asCell()->structure(*vm) : nullptr;
+    baseValue.putInline(exec, ident, value, slot);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    if (accessType != static_cast<AccessType>(stubInfo->accessType))
+        return;
+    
+    if (stubInfo->considerCaching(codeBlock, structure))
+        repatchPutByID(exec, baseValue, structure, ident, slot, *stubInfo, NotDirect);
+}
+
+void JIT_OPERATION operationPutByIdNonStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    Identifier ident = Identifier::fromUid(vm, uid);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
+    JSValue value = JSValue::decode(encodedValue);
+    JSValue baseValue = JSValue::decode(encodedBase);
+    LOG_IC((ICEvent::OperationPutByIdNonStrictOptimize, baseValue.classInfoOrNull(), ident));
+    CodeBlock* codeBlock = exec->codeBlock();
+    PutPropertySlot slot(baseValue, false, codeBlock->putByIdContext());
+
+    Structure* structure = baseValue.isCell() ? baseValue.asCell()->structure(*vm) : nullptr;    
+    baseValue.putInline(exec, ident, value, slot);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    if (accessType != static_cast<AccessType>(stubInfo->accessType))
+        return;
+    
+    if (stubInfo->considerCaching(codeBlock, structure))
+        repatchPutByID(exec, baseValue, structure, ident, slot, *stubInfo, NotDirect);
+}
+
+void JIT_OPERATION operationPutByIdDirectStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    Identifier ident = Identifier::fromUid(vm, uid);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
+    JSValue value = JSValue::decode(encodedValue);
+    JSObject* baseObject = asObject(JSValue::decode(encodedBase));
+    LOG_IC((ICEvent::OperationPutByIdDirectStrictOptimize, baseObject->classInfo(), ident));
+    CodeBlock* codeBlock = exec->codeBlock();
+    PutPropertySlot slot(baseObject, true, codeBlock->putByIdContext());
+    
+    Structure* structure = baseObject->structure(*vm);
+    baseObject->putDirect(exec->vm(), ident, value, slot);
+    
+    if (accessType != static_cast<AccessType>(stubInfo->accessType))
+        return;
+    
+    if (stubInfo->considerCaching(codeBlock, structure))
+        repatchPutByID(exec, baseObject, structure, ident, slot, *stubInfo, Direct);
+}
+
+void JIT_OPERATION operationPutByIdDirectNonStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    SuperSamplerScope superSamplerScope(false);
+    
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    Identifier ident = Identifier::fromUid(vm, uid);
+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
+
+    JSValue value = JSValue::decode(encodedValue);
+    JSObject* baseObject = asObject(JSValue::decode(encodedBase));
+    LOG_IC((ICEvent::OperationPutByIdDirectNonStrictOptimize, baseObject->classInfo(), ident));
+    CodeBlock* codeBlock = exec->codeBlock();
+    PutPropertySlot slot(baseObject, false, codeBlock->putByIdContext());
+    
+    Structure* structure = baseObject->structure(*vm);
+    baseObject->putDirect(exec->vm(), ident, value, slot);
+    
+    if (accessType != static_cast<AccessType>(stubInfo->accessType))
+        return;
+    
+    if (stubInfo->considerCaching(codeBlock, structure))
+        repatchPutByID(exec, baseObject, structure, ident, slot, *stubInfo, Direct);
+}
+
+ALWAYS_INLINE static bool isStringOrSymbol(JSValue value)
+{
+    return value.isString() || value.isSymbol();
+}
+
+static void putByVal(CallFrame* callFrame, JSValue baseValue, JSValue subscript, JSValue value, ByValInfo* byValInfo)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (LIKELY(subscript.isUInt32())) {
+        byValInfo->tookSlowPath = true;
+        uint32_t i = subscript.asUInt32();
+        if (baseValue.isObject()) {
+            JSObject* object = asObject(baseValue);
+            if (object->canSetIndexQuickly(i))
+                object->setIndexQuickly(callFrame->vm(), i, value);
+            else {
+                // FIXME: This will make us think that in-bounds typed array accesses are actually
+                // out-of-bounds.
+                // https://bugs.webkit.org/show_bug.cgi?id=149886
+                byValInfo->arrayProfile->setOutOfBounds();
+                object->methodTable(vm)->putByIndex(object, callFrame, i, value, callFrame->codeBlock()->isStrictMode());
+            }
+        } else
+            baseValue.putByIndex(callFrame, i, value, callFrame->codeBlock()->isStrictMode());
+        return;
+    }
+
+    auto property = subscript.toPropertyKey(callFrame);
+    // Don't put to an object if toString threw an exception.
+    RETURN_IF_EXCEPTION(scope, void());
+
+    if (byValInfo->stubInfo && (!isStringOrSymbol(subscript) || byValInfo->cachedId != property))
+        byValInfo->tookSlowPath = true;
+
+    scope.release();
+    PutPropertySlot slot(baseValue, callFrame->codeBlock()->isStrictMode());
+    baseValue.putInline(callFrame, property, value, slot);
+}
+
+static void directPutByVal(CallFrame* callFrame, JSObject* baseObject, JSValue subscript, JSValue value, ByValInfo* byValInfo)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    bool isStrictMode = callFrame->codeBlock()->isStrictMode();
+    if (LIKELY(subscript.isUInt32())) {
+        // Despite its name, JSValue::isUInt32 will return true only for positive boxed int32_t; all those values are valid array indices.
+        byValInfo->tookSlowPath = true;
+        uint32_t index = subscript.asUInt32();
+        ASSERT(isIndex(index));
+        if (baseObject->canSetIndexQuicklyForPutDirect(index)) {
+            baseObject->setIndexQuickly(callFrame->vm(), index, value);
+            return;
+        }
+
+        // FIXME: This will make us think that in-bounds typed array accesses are actually
+        // out-of-bounds.
+        // https://bugs.webkit.org/show_bug.cgi?id=149886
+        byValInfo->arrayProfile->setOutOfBounds();
+        baseObject->putDirectIndex(callFrame, index, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+        return;
+    }
+
+    if (subscript.isDouble()) {
+        double subscriptAsDouble = subscript.asDouble();
+        uint32_t subscriptAsUInt32 = static_cast<uint32_t>(subscriptAsDouble);
+        if (subscriptAsDouble == subscriptAsUInt32 && isIndex(subscriptAsUInt32)) {
+            byValInfo->tookSlowPath = true;
+            baseObject->putDirectIndex(callFrame, subscriptAsUInt32, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+            return;
+        }
+    }
+
+    // Don't put to an object if toString threw an exception.
+    auto property = subscript.toPropertyKey(callFrame);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    if (std::optional<uint32_t> index = parseIndex(property)) {
+        byValInfo->tookSlowPath = true;
+        baseObject->putDirectIndex(callFrame, index.value(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+        return;
+    }
+
+    if (byValInfo->stubInfo && (!isStringOrSymbol(subscript) || byValInfo->cachedId != property))
+        byValInfo->tookSlowPath = true;
+
+    PutPropertySlot slot(baseObject, isStrictMode);
+    baseObject->putDirect(callFrame->vm(), property, value, slot);
+}
+
+enum class OptimizationResult {
+    NotOptimized,
+    SeenOnce,
+    Optimized,
+    GiveUp,
+};
+
+static OptimizationResult tryPutByValOptimize(ExecState* exec, JSValue baseValue, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
+{
+    // See if it's worth optimizing at all.
+    OptimizationResult optimizationResult = OptimizationResult::NotOptimized;
+
+    VM& vm = exec->vm();
+
+    if (baseValue.isObject() && subscript.isInt32()) {
+        JSObject* object = asObject(baseValue);
+
+        ASSERT(exec->bytecodeOffset());
+        ASSERT(!byValInfo->stubRoutine);
+
+        Structure* structure = object->structure(vm);
+        if (hasOptimizableIndexing(structure)) {
+            // Attempt to optimize.
+            JITArrayMode arrayMode = jitArrayModeForStructure(structure);
+            if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo->arrayMode) {
+                CodeBlock* codeBlock = exec->codeBlock();
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+                byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
+
+                JIT::compilePutByVal(&vm, codeBlock, byValInfo, returnAddress, arrayMode);
+                optimizationResult = OptimizationResult::Optimized;
+            }
+        }
+
+        // If we failed to patch and we have some object that intercepts indexed get, then don't even wait until 10 times.
+        if (optimizationResult != OptimizationResult::Optimized && object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
+            optimizationResult = OptimizationResult::GiveUp;
+    }
+
+    if (baseValue.isObject() && isStringOrSymbol(subscript)) {
+        const Identifier propertyName = subscript.toPropertyKey(exec);
+        if (subscript.isSymbol() || !parseIndex(propertyName)) {
+            ASSERT(exec->bytecodeOffset());
+            ASSERT(!byValInfo->stubRoutine);
+            if (byValInfo->seen) {
+                if (byValInfo->cachedId == propertyName) {
+                    JIT::compilePutByValWithCachedId(&vm, exec->codeBlock(), byValInfo, returnAddress, NotDirect, propertyName);
+                    optimizationResult = OptimizationResult::Optimized;
+                } else {
+                    // Seem like a generic property access site.
+                    optimizationResult = OptimizationResult::GiveUp;
+                }
+            } else {
+                CodeBlock* codeBlock = exec->codeBlock();
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+                byValInfo->seen = true;
+                byValInfo->cachedId = propertyName;
+                if (subscript.isSymbol())
+                    byValInfo->cachedSymbol.set(vm, codeBlock, asSymbol(subscript));
+                optimizationResult = OptimizationResult::SeenOnce;
+            }
+        }
+    }
+
+    if (optimizationResult != OptimizationResult::Optimized && optimizationResult != OptimizationResult::SeenOnce) {
+        // If we take slow path more than 10 times without patching then make sure we
+        // never make that mistake again. For cases where we see non-index-intercepting
+        // objects, this gives 10 iterations worth of opportunity for us to observe
+        // that the put_by_val may be polymorphic. We count up slowPathCount even if
+        // the result is GiveUp.
+        if (++byValInfo->slowPathCount >= 10)
+            optimizationResult = OptimizationResult::GiveUp;
+    }
+
+    return optimizationResult;
+}
+
+void JIT_OPERATION operationPutByValOptimize(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue baseValue = JSValue::decode(encodedBaseValue);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+    JSValue value = JSValue::decode(encodedValue);
+    if (tryPutByValOptimize(exec, baseValue, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS)) == OptimizationResult::GiveUp) {
+        // Don't ever try to optimize.
+        byValInfo->tookSlowPath = true;
+        ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationPutByValGeneric));
+    }
+    putByVal(exec, baseValue, subscript, value, byValInfo);
+}
+
+static OptimizationResult tryDirectPutByValOptimize(ExecState* exec, JSObject* object, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
+{
+    // See if it's worth optimizing at all.
+    OptimizationResult optimizationResult = OptimizationResult::NotOptimized;
+
+    VM& vm = exec->vm();
+
+    if (subscript.isInt32()) {
+        ASSERT(exec->bytecodeOffset());
+        ASSERT(!byValInfo->stubRoutine);
+
+        Structure* structure = object->structure(vm);
+        if (hasOptimizableIndexing(structure)) {
+            // Attempt to optimize.
+            JITArrayMode arrayMode = jitArrayModeForStructure(structure);
+            if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo->arrayMode) {
+                CodeBlock* codeBlock = exec->codeBlock();
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+                byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
+
+                JIT::compileDirectPutByVal(&vm, codeBlock, byValInfo, returnAddress, arrayMode);
+                optimizationResult = OptimizationResult::Optimized;
+            }
+        }
+
+        // If we failed to patch and we have some object that intercepts indexed get, then don't even wait until 10 times.
+        if (optimizationResult != OptimizationResult::Optimized && object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
+            optimizationResult = OptimizationResult::GiveUp;
+    } else if (isStringOrSymbol(subscript)) {
+        const Identifier propertyName = subscript.toPropertyKey(exec);
+        if (subscript.isSymbol() || !parseIndex(propertyName)) {
+            ASSERT(exec->bytecodeOffset());
+            ASSERT(!byValInfo->stubRoutine);
+            if (byValInfo->seen) {
+                if (byValInfo->cachedId == propertyName) {
+                    JIT::compilePutByValWithCachedId(&vm, exec->codeBlock(), byValInfo, returnAddress, Direct, propertyName);
+                    optimizationResult = OptimizationResult::Optimized;
+                } else {
+                    // Seem like a generic property access site.
+                    optimizationResult = OptimizationResult::GiveUp;
+                }
+            } else {
+                CodeBlock* codeBlock = exec->codeBlock();
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+                byValInfo->seen = true;
+                byValInfo->cachedId = propertyName;
+                if (subscript.isSymbol())
+                    byValInfo->cachedSymbol.set(vm, codeBlock, asSymbol(subscript));
+                optimizationResult = OptimizationResult::SeenOnce;
+            }
+        }
+    }
+
+    if (optimizationResult != OptimizationResult::Optimized && optimizationResult != OptimizationResult::SeenOnce) {
+        // If we take slow path more than 10 times without patching then make sure we
+        // never make that mistake again. For cases where we see non-index-intercepting
+        // objects, this gives 10 iterations worth of opportunity for us to observe
+        // that the get_by_val may be polymorphic. We count up slowPathCount even if
+        // the result is GiveUp.
+        if (++byValInfo->slowPathCount >= 10)
+            optimizationResult = OptimizationResult::GiveUp;
+    }
+
+    return optimizationResult;
+}
+
+void JIT_OPERATION operationDirectPutByValOptimize(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue baseValue = JSValue::decode(encodedBaseValue);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+    JSValue value = JSValue::decode(encodedValue);
+    RELEASE_ASSERT(baseValue.isObject());
+    JSObject* object = asObject(baseValue);
+    if (tryDirectPutByValOptimize(exec, object, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS)) == OptimizationResult::GiveUp) {
+        // Don't ever try to optimize.
+        byValInfo->tookSlowPath = true;
+        ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationDirectPutByValGeneric));
+    }
+
+    directPutByVal(exec, object, subscript, value, byValInfo);
+}
+
+void JIT_OPERATION operationPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    JSValue baseValue = JSValue::decode(encodedBaseValue);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+    JSValue value = JSValue::decode(encodedValue);
+
+    putByVal(exec, baseValue, subscript, value, byValInfo);
+}
+
+
+void JIT_OPERATION operationDirectPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    JSValue baseValue = JSValue::decode(encodedBaseValue);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+    JSValue value = JSValue::decode(encodedValue);
+    RELEASE_ASSERT(baseValue.isObject());
+    directPutByVal(exec, asObject(baseValue), subscript, value, byValInfo);
+}
+
+EncodedJSValue JIT_OPERATION operationCallEval(ExecState* exec, ExecState* execCallee)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    execCallee->setCodeBlock(0);
+    
+    if (!isHostFunction(execCallee->calleeAsValue(), globalFuncEval))
+        return JSValue::encode(JSValue());
+
+    JSValue result = eval(execCallee);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    return JSValue::encode(result);
+}
+
+static SlowPathReturnType handleHostCall(ExecState* execCallee, JSValue callee, CallLinkInfo* callLinkInfo)
+{
+    ExecState* exec = execCallee->callerFrame();
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    execCallee->setCodeBlock(0);
+
+    if (callLinkInfo->specializationKind() == CodeForCall) {
+        CallData callData;
+        CallType callType = getCallData(callee, callData);
+    
+        ASSERT(callType != CallType::JS);
+    
+        if (callType == CallType::Host) {
+            NativeCallFrameTracer tracer(vm, execCallee);
+            execCallee->setCallee(asObject(callee));
+            vm->hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
+            if (UNLIKELY(scope.exception())) {
+                return encodeResult(
+                    vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
+                    reinterpret_cast<void*>(KeepTheFrame));
+            }
+
+            return encodeResult(
+                bitwise_cast<void*>(getHostCallReturnValue),
+                reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
+        }
+    
+        ASSERT(callType == CallType::None);
+        throwException(exec, scope, createNotAFunctionError(exec, callee));
+        return encodeResult(
+            vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
+            reinterpret_cast<void*>(KeepTheFrame));
+    }
+
+    ASSERT(callLinkInfo->specializationKind() == CodeForConstruct);
+    
+    ConstructData constructData;
+    ConstructType constructType = getConstructData(callee, constructData);
+    
+    ASSERT(constructType != ConstructType::JS);
+    
+    if (constructType == ConstructType::Host) {
+        NativeCallFrameTracer tracer(vm, execCallee);
+        execCallee->setCallee(asObject(callee));
+        vm->hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
+        if (UNLIKELY(scope.exception())) {
+            return encodeResult(
+                vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
+                reinterpret_cast<void*>(KeepTheFrame));
+        }
+
+        return encodeResult(bitwise_cast<void*>(getHostCallReturnValue), reinterpret_cast<void*>(KeepTheFrame));
+    }
+    
+    ASSERT(constructType == ConstructType::None);
+    throwException(exec, scope, createNotAConstructorError(exec, callee));
+    return encodeResult(
+        vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
+        reinterpret_cast<void*>(KeepTheFrame));
+}
+
+SlowPathReturnType JIT_OPERATION operationLinkCall(ExecState* execCallee, CallLinkInfo* callLinkInfo)
+{
+    ExecState* exec = execCallee->callerFrame();
+    VM* vm = &exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(*vm);
+
+    CodeSpecializationKind kind = callLinkInfo->specializationKind();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    RELEASE_ASSERT(!callLinkInfo->isDirect());
+    
+    JSValue calleeAsValue = execCallee->calleeAsValue();
+    JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
+    if (!calleeAsFunctionCell) {
+        // FIXME: We should cache these kinds of calls. They can be common and currently they are
+        // expensive.
+        // https://bugs.webkit.org/show_bug.cgi?id=144458
+        throwScope.release();
+        return handleHostCall(execCallee, calleeAsValue, callLinkInfo);
+    }
+
+    JSFunction* callee = jsCast<JSFunction*>(calleeAsFunctionCell);
+    JSScope* scope = callee->scopeUnchecked();
+    ExecutableBase* executable = callee->executable();
+
+    MacroAssemblerCodePtr codePtr;
+    CodeBlock* codeBlock = 0;
+    if (executable->isHostFunction()) {
+        codePtr = executable->entrypointFor(kind, MustCheckArity);
+    } else {
+        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
+
+        if (!isCall(kind) && functionExecutable->constructAbility() == ConstructAbility::CannotConstruct) {
+            throwException(exec, throwScope, createNotAConstructorError(exec, callee));
+            return encodeResult(
+                vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
+                reinterpret_cast<void*>(KeepTheFrame));
+        }
+
+        CodeBlock** codeBlockSlot = execCallee->addressOfCodeBlock();
+        JSObject* error = functionExecutable->prepareForExecution<FunctionExecutable>(*vm, callee, scope, kind, *codeBlockSlot);
+        ASSERT(throwScope.exception() == reinterpret_cast<Exception*>(error));
+        if (error) {
+            throwException(exec, throwScope, error);
+            return encodeResult(
+                vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
+                reinterpret_cast<void*>(KeepTheFrame));
+        }
+        codeBlock = *codeBlockSlot;
+        ArityCheckMode arity;
+        if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()) || callLinkInfo->isVarargs())
+            arity = MustCheckArity;
+        else
+            arity = ArityCheckNotRequired;
+        codePtr = functionExecutable->entrypointFor(kind, arity);
+    }
+    if (!callLinkInfo->seenOnce())
+        callLinkInfo->setSeen();
+    else
+        linkFor(execCallee, *callLinkInfo, codeBlock, callee, codePtr);
+    
+    return encodeResult(codePtr.executableAddress(), reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
+}
+
+void JIT_OPERATION operationLinkDirectCall(ExecState* exec, CallLinkInfo* callLinkInfo, JSFunction* callee)
+{
+    VM* vm = &exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(*vm);
+
+    CodeSpecializationKind kind = callLinkInfo->specializationKind();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    RELEASE_ASSERT(callLinkInfo->isDirect());
+    
+    // This would happen if the executable died during GC but the CodeBlock did not die. That should
+    // not happen because the CodeBlock should have a weak reference to any executable it uses for
+    // this purpose.
+    RELEASE_ASSERT(callLinkInfo->executable());
+    
+    // Having a CodeBlock indicates that this is linked. We shouldn't be taking this path if it's
+    // linked.
+    RELEASE_ASSERT(!callLinkInfo->codeBlock());
+    
+    // We just don't support this yet.
+    RELEASE_ASSERT(!callLinkInfo->isVarargs());
+    
+    ExecutableBase* executable = callLinkInfo->executable();
+    RELEASE_ASSERT(callee->executable() == callLinkInfo->executable());
+
+    JSScope* scope = callee->scopeUnchecked();
+
+    MacroAssemblerCodePtr codePtr;
+    CodeBlock* codeBlock = nullptr;
+    if (executable->isHostFunction())
+        codePtr = executable->entrypointFor(kind, MustCheckArity);
+    else {
+        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
+
+        RELEASE_ASSERT(isCall(kind) || functionExecutable->constructAbility() != ConstructAbility::CannotConstruct);
+        
+        JSObject* error = functionExecutable->prepareForExecution<FunctionExecutable>(*vm, callee, scope, kind, codeBlock);
+        ASSERT(throwScope.exception() == reinterpret_cast<Exception*>(error));
+        if (error) {
+            throwException(exec, throwScope, error);
+            return;
+        }
+        ArityCheckMode arity;
+        unsigned argumentStackSlots = callLinkInfo->maxNumArguments();
+        if (argumentStackSlots < static_cast<size_t>(codeBlock->numParameters()))
+            arity = MustCheckArity;
+        else
+            arity = ArityCheckNotRequired;
+        codePtr = functionExecutable->entrypointFor(kind, arity);
+    }
+    
+    linkDirectFor(exec, *callLinkInfo, codeBlock, codePtr);
+}
+
+inline SlowPathReturnType virtualForWithFunction(
+    ExecState* execCallee, CallLinkInfo* callLinkInfo, JSCell*& calleeAsFunctionCell)
+{
+    ExecState* exec = execCallee->callerFrame();
+    VM* vm = &exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(*vm);
+
+    CodeSpecializationKind kind = callLinkInfo->specializationKind();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    JSValue calleeAsValue = execCallee->calleeAsValue();
+    calleeAsFunctionCell = getJSFunction(calleeAsValue);
+    if (UNLIKELY(!calleeAsFunctionCell))
+        return handleHostCall(execCallee, calleeAsValue, callLinkInfo);
+    
+    JSFunction* function = jsCast<JSFunction*>(calleeAsFunctionCell);
+    JSScope* scope = function->scopeUnchecked();
+    ExecutableBase* executable = function->executable();
+    if (UNLIKELY(!executable->hasJITCodeFor(kind))) {
+        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
+
+        if (!isCall(kind) && functionExecutable->constructAbility() == ConstructAbility::CannotConstruct) {
+            throwException(exec, throwScope, createNotAConstructorError(exec, function));
+            return encodeResult(
+                vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
+                reinterpret_cast<void*>(KeepTheFrame));
+        }
+
+        CodeBlock** codeBlockSlot = execCallee->addressOfCodeBlock();
+        JSObject* error = functionExecutable->prepareForExecution<FunctionExecutable>(*vm, function, scope, kind, *codeBlockSlot);
+        if (error) {
+            throwException(exec, throwScope, error);
+            return encodeResult(
+                vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
+                reinterpret_cast<void*>(KeepTheFrame));
+        }
+    }
+    return encodeResult(executable->entrypointFor(
+        kind, MustCheckArity).executableAddress(),
+        reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
+}
+
+SlowPathReturnType JIT_OPERATION operationLinkPolymorphicCall(ExecState* execCallee, CallLinkInfo* callLinkInfo)
+{
+    ASSERT(callLinkInfo->specializationKind() == CodeForCall);
+    JSCell* calleeAsFunctionCell;
+    SlowPathReturnType result = virtualForWithFunction(execCallee, callLinkInfo, calleeAsFunctionCell);
+
+    linkPolymorphicCall(execCallee, *callLinkInfo, CallVariant(calleeAsFunctionCell));
+    
+    return result;
+}
+
+SlowPathReturnType JIT_OPERATION operationVirtualCall(ExecState* execCallee, CallLinkInfo* callLinkInfo)
+{
+    JSCell* calleeAsFunctionCellIgnored;
+    return virtualForWithFunction(execCallee, callLinkInfo, calleeAsFunctionCellIgnored);
+}
+
+size_t JIT_OPERATION operationCompareLess(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    return jsLess<true>(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+size_t JIT_OPERATION operationCompareLessEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return jsLessEq<true>(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+size_t JIT_OPERATION operationCompareGreater(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return jsLess<false>(exec, JSValue::decode(encodedOp2), JSValue::decode(encodedOp1));
+}
+
+size_t JIT_OPERATION operationCompareGreaterEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return jsLessEq<false>(exec, JSValue::decode(encodedOp2), JSValue::decode(encodedOp1));
+}
+
+size_t JIT_OPERATION operationCompareEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return JSValue::equalSlowCaseInline(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+}
+
+#if USE(JSVALUE64)
+EncodedJSValue JIT_OPERATION operationCompareStringEq(ExecState* exec, JSCell* left, JSCell* right)
+#else
+size_t JIT_OPERATION operationCompareStringEq(ExecState* exec, JSCell* left, JSCell* right)
+#endif
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    bool result = asString(left)->equal(exec, asString(right));
+#if USE(JSVALUE64)
+    return JSValue::encode(jsBoolean(result));
+#else
+    return result;
+#endif
+}
+
+EncodedJSValue JIT_OPERATION operationNewArrayWithProfile(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, int size)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    return JSValue::encode(constructArrayNegativeIndexed(exec, profile, values, size));
+}
+
+EncodedJSValue JIT_OPERATION operationNewArrayBufferWithProfile(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, int size)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    return JSValue::encode(constructArray(exec, profile, values, size));
+}
+
+EncodedJSValue JIT_OPERATION operationNewArrayWithSizeAndProfile(ExecState* exec, ArrayAllocationProfile* profile, EncodedJSValue size)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    JSValue sizeValue = JSValue::decode(size);
+    return JSValue::encode(constructArrayWithSizeQuirk(exec, profile, exec->lexicalGlobalObject(), sizeValue));
+}
+
+}
+
+template<typename FunctionType>
+static EncodedJSValue operationNewFunctionCommon(ExecState* exec, JSScope* scope, JSCell* functionExecutable, bool isInvalidated)
+{
+    ASSERT(functionExecutable->inherits(FunctionExecutable::info()));
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    if (isInvalidated)
+        return JSValue::encode(FunctionType::createWithInvalidatedReallocationWatchpoint(vm, static_cast<FunctionExecutable*>(functionExecutable), scope));
+    return JSValue::encode(FunctionType::create(vm, static_cast<FunctionExecutable*>(functionExecutable), scope));
+}
+
+extern "C" {
+
+EncodedJSValue JIT_OPERATION operationNewFunction(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
+{
+    return operationNewFunctionCommon<JSFunction>(exec, scope, functionExecutable, false);
+}
+
+EncodedJSValue JIT_OPERATION operationNewFunctionWithInvalidatedReallocationWatchpoint(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
+{
+    return operationNewFunctionCommon<JSFunction>(exec, scope, functionExecutable, true);
+}
+
+EncodedJSValue JIT_OPERATION operationNewGeneratorFunction(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
+{
+    return operationNewFunctionCommon<JSGeneratorFunction>(exec, scope, functionExecutable, false);
+}
+
+EncodedJSValue JIT_OPERATION operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
+{
+    return operationNewFunctionCommon<JSGeneratorFunction>(exec, scope, functionExecutable, true);
+}
+
+EncodedJSValue JIT_OPERATION operationNewAsyncFunction(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
+{
+    return operationNewFunctionCommon<JSAsyncFunction>(exec, scope, functionExecutable, false);
+}
+
+EncodedJSValue JIT_OPERATION operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
+{
+    return operationNewFunctionCommon<JSAsyncFunction>(exec, scope, functionExecutable, true);
+}
+
+void JIT_OPERATION operationSetFunctionName(ExecState* exec, JSCell* funcCell, EncodedJSValue encodedName)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    JSFunction* func = jsCast<JSFunction*>(funcCell);
+    JSValue name = JSValue::decode(encodedName);
+    func->setFunctionName(exec, name);
+}
+
+JSCell* JIT_OPERATION operationNewObject(ExecState* exec, Structure* structure)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return constructEmptyObject(exec, structure);
+}
+
+EncodedJSValue JIT_OPERATION operationNewRegexp(ExecState* exec, void* regexpPtr)
+{
+    SuperSamplerScope superSamplerScope(false);
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    RegExp* regexp = static_cast<RegExp*>(regexpPtr);
+    if (!regexp->isValid()) {
+        throwException(exec, scope, createSyntaxError(exec, regexp->errorMessage()));
+        return JSValue::encode(jsUndefined());
+    }
+
+    return JSValue::encode(RegExpObject::create(vm, exec->lexicalGlobalObject()->regExpStructure(), regexp));
+}
+
+// The only reason for returning an UnusedPtr (instead of void) is so that we can reuse the
+// existing DFG slow path generator machinery when creating the slow path for CheckWatchdogTimer
+// in the DFG. If a DFG slow path generator that supports a void return type is added in the
+// future, we can switch to using that then.
+UnusedPtr JIT_OPERATION operationHandleWatchdogTimer(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (UNLIKELY(vm.shouldTriggerTermination(exec)))
+        throwException(exec, scope, createTerminatedExecutionException(&vm));
+
+    return nullptr;
+}
+
+void JIT_OPERATION operationDebug(ExecState* exec, int32_t debugHookType)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    vm.interpreter->debug(exec, static_cast<DebugHookType>(debugHookType));
+}
+
+#if ENABLE(DFG_JIT)
+static void updateAllPredictionsAndOptimizeAfterWarmUp(CodeBlock* codeBlock)
+{
+    codeBlock->updateAllPredictions();
+    codeBlock->optimizeAfterWarmUp();
+}
+
+SlowPathReturnType JIT_OPERATION operationOptimize(ExecState* exec, int32_t bytecodeIndex)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    // Defer GC for a while so that it doesn't run between when we enter into this
+    // slow path and when we figure out the state of our code block. This prevents
+    // a number of awkward reentrancy scenarios, including:
+    //
+    // - The optimized version of our code block being jettisoned by GC right after
+    //   we concluded that we wanted to use it, but have not planted it into the JS
+    //   stack yet.
+    //
+    // - An optimized version of our code block being installed just as we decided
+    //   that it wasn't ready yet.
+    //
+    // Note that jettisoning won't happen if we already initiated OSR, because in
+    // that case we would have already planted the optimized code block into the JS
+    // stack.
+    DeferGCForAWhile deferGC(vm.heap);
+    
+    CodeBlock* codeBlock = exec->codeBlock();
+    if (codeBlock->jitType() != JITCode::BaselineJIT) {
+        dataLog("Unexpected code block in Baseline->DFG tier-up: ", *codeBlock, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    if (bytecodeIndex) {
+        // If we're attempting to OSR from a loop, assume that this should be
+        // separately optimized.
+        codeBlock->m_shouldAlwaysBeInlined = false;
+    }
+
+    if (Options::verboseOSR()) {
+        dataLog(
+            *codeBlock, ": Entered optimize with bytecodeIndex = ", bytecodeIndex,
+            ", executeCounter = ", codeBlock->jitExecuteCounter(),
+            ", optimizationDelayCounter = ", codeBlock->reoptimizationRetryCounter(),
+            ", exitCounter = ");
+        if (codeBlock->hasOptimizedReplacement())
+            dataLog(codeBlock->replacement()->osrExitCounter());
+        else
+            dataLog("N/A");
+        dataLog("\n");
+    }
+
+    if (!codeBlock->checkIfOptimizationThresholdReached()) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("counter = ", codeBlock->jitExecuteCounter()));
+        codeBlock->updateAllPredictions();
+        if (Options::verboseOSR())
+            dataLog("Choosing not to optimize ", *codeBlock, " yet, because the threshold hasn't been reached.\n");
+        return encodeResult(0, 0);
+    }
+    
+    Debugger* debugger = codeBlock->globalObject()->debugger();
+    if (debugger && (debugger->isStepping() || codeBlock->baselineAlternative()->hasDebuggerRequests())) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("debugger is stepping or has requests"));
+        updateAllPredictionsAndOptimizeAfterWarmUp(codeBlock);
+        return encodeResult(0, 0);
+    }
+
+    if (codeBlock->m_shouldAlwaysBeInlined) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should always be inlined"));
+        updateAllPredictionsAndOptimizeAfterWarmUp(codeBlock);
+        if (Options::verboseOSR())
+            dataLog("Choosing not to optimize ", *codeBlock, " yet, because m_shouldAlwaysBeInlined == true.\n");
+        return encodeResult(0, 0);
+    }
+
+    // We cannot be in the process of asynchronous compilation and also have an optimized
+    // replacement.
+    DFG::Worklist* worklist = DFG::existingGlobalDFGWorklistOrNull();
+    ASSERT(
+        !worklist
+        || !(worklist->compilationState(DFG::CompilationKey(codeBlock, DFG::DFGMode)) != DFG::Worklist::NotKnown
+        && codeBlock->hasOptimizedReplacement()));
+
+    DFG::Worklist::State worklistState;
+    if (worklist) {
+        // The call to DFG::Worklist::completeAllReadyPlansForVM() will complete all ready
+        // (i.e. compiled) code blocks. But if it completes ours, we also need to know
+        // what the result was so that we don't plow ahead and attempt OSR or immediate
+        // reoptimization. This will have already also set the appropriate JIT execution
+        // count threshold depending on what happened, so if the compilation was anything
+        // but successful we just want to return early. See the case for worklistState ==
+        // DFG::Worklist::Compiled, below.
+        
+        // Note that we could have alternatively just called Worklist::compilationState()
+        // here, and if it returned Compiled, we could have then called
+        // completeAndScheduleOSR() below. But that would have meant that it could take
+        // longer for code blocks to be completed: they would only complete when *their*
+        // execution count trigger fired; but that could take a while since the firing is
+        // racy. It could also mean that code blocks that never run again after being
+        // compiled would sit on the worklist until next GC. That's fine, but it's
+        // probably a waste of memory. Our goal here is to complete code blocks as soon as
+        // possible in order to minimize the chances of us executing baseline code after
+        // optimized code is already available.
+        worklistState = worklist->completeAllReadyPlansForVM(
+            vm, DFG::CompilationKey(codeBlock, DFG::DFGMode));
+    } else
+        worklistState = DFG::Worklist::NotKnown;
+
+    if (worklistState == DFG::Worklist::Compiling) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compiling"));
+        // We cannot be in the process of asynchronous compilation and also have an optimized
+        // replacement.
+        RELEASE_ASSERT(!codeBlock->hasOptimizedReplacement());
+        codeBlock->setOptimizationThresholdBasedOnCompilationResult(CompilationDeferred);
+        return encodeResult(0, 0);
+    }
+
+    if (worklistState == DFG::Worklist::Compiled) {
+        // If we don't have an optimized replacement but we did just get compiled, then
+        // the compilation failed or was invalidated, in which case the execution count
+        // thresholds have already been set appropriately by
+        // CodeBlock::setOptimizationThresholdBasedOnCompilationResult() and we have
+        // nothing left to do.
+        if (!codeBlock->hasOptimizedReplacement()) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compiled and failed"));
+            codeBlock->updateAllPredictions();
+            if (Options::verboseOSR())
+                dataLog("Code block ", *codeBlock, " was compiled but it doesn't have an optimized replacement.\n");
+            return encodeResult(0, 0);
+        }
+    } else if (codeBlock->hasOptimizedReplacement()) {
+        if (Options::verboseOSR())
+            dataLog("Considering OSR ", *codeBlock, " -> ", *codeBlock->replacement(), ".\n");
+        // If we have an optimized replacement, then it must be the case that we entered
+        // cti_optimize from a loop. That's because if there's an optimized replacement,
+        // then all calls to this function will be relinked to the replacement and so
+        // the prologue OSR will never fire.
+        
+        // This is an interesting threshold check. Consider that a function OSR exits
+        // in the middle of a loop, while having a relatively low exit count. The exit
+        // will reset the execution counter to some target threshold, meaning that this
+        // code won't be reached until that loop heats up for >=1000 executions. But then
+        // we do a second check here, to see if we should either reoptimize, or just
+        // attempt OSR entry. Hence it might even be correct for
+        // shouldReoptimizeFromLoopNow() to always return true. But we make it do some
+        // additional checking anyway, to reduce the amount of recompilation thrashing.
+        if (codeBlock->replacement()->shouldReoptimizeFromLoopNow()) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize from loop now"));
+            if (Options::verboseOSR()) {
+                dataLog(
+                    "Triggering reoptimization of ", *codeBlock,
+                    "(", *codeBlock->replacement(), ") (in loop).\n");
+            }
+            codeBlock->replacement()->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTrigger, CountReoptimization);
+            return encodeResult(0, 0);
+        }
+    } else {
+        if (!codeBlock->shouldOptimizeNow()) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("insufficient profiling"));
+            if (Options::verboseOSR()) {
+                dataLog(
+                    "Delaying optimization for ", *codeBlock,
+                    " because of insufficient profiling.\n");
+            }
+            return encodeResult(0, 0);
+        }
+
+        if (Options::verboseOSR())
+            dataLog("Triggering optimized compilation of ", *codeBlock, "\n");
+
+        unsigned numVarsWithValues;
+        if (bytecodeIndex)
+            numVarsWithValues = codeBlock->m_numCalleeLocals;
+        else
+            numVarsWithValues = 0;
+        Operands<JSValue> mustHandleValues(codeBlock->numParameters(), numVarsWithValues);
+        int localsUsedForCalleeSaves = static_cast<int>(CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters());
+        for (size_t i = 0; i < mustHandleValues.size(); ++i) {
+            int operand = mustHandleValues.operandForIndex(i);
+            if (operandIsLocal(operand) && VirtualRegister(operand).toLocal() < localsUsedForCalleeSaves)
+                continue;
+            mustHandleValues[i] = exec->uncheckedR(operand).jsValue();
+        }
+
+        CodeBlock* replacementCodeBlock = codeBlock->newReplacement();
+        CompilationResult result = DFG::compile(
+            vm, replacementCodeBlock, nullptr, DFG::DFGMode, bytecodeIndex,
+            mustHandleValues, JITToDFGDeferredCompilationCallback::create());
+        
+        if (result != CompilationSuccessful) {
+            CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compilation failed"));
+            return encodeResult(0, 0);
+        }
+    }
+    
+    CodeBlock* optimizedCodeBlock = codeBlock->replacement();
+    ASSERT(JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));
+    
+    if (void* dataBuffer = DFG::prepareOSREntry(exec, optimizedCodeBlock, bytecodeIndex)) {
+        CODEBLOCK_LOG_EVENT(optimizedCodeBlock, "osrEntry", ("at bc#", bytecodeIndex));
+        if (Options::verboseOSR()) {
+            dataLog(
+                "Performing OSR ", *codeBlock, " -> ", *optimizedCodeBlock, ".\n");
+        }
+
+        codeBlock->optimizeSoon();
+        codeBlock->unlinkedCodeBlock()->setDidOptimize(TrueTriState);
+        return encodeResult(vm.getCTIStub(DFG::osrEntryThunkGenerator).code().executableAddress(), dataBuffer);
+    }
+
+    if (Options::verboseOSR()) {
+        dataLog(
+            "Optimizing ", *codeBlock, " -> ", *codeBlock->replacement(),
+            " succeeded, OSR failed, after a delay of ",
+            codeBlock->optimizationDelayCounter(), ".\n");
+    }
+
+    // Count the OSR failure as a speculation failure. If this happens a lot, then
+    // reoptimize.
+    optimizedCodeBlock->countOSRExit();
+
+    // We are a lot more conservative about triggering reoptimization after OSR failure than
+    // before it. If we enter the optimize_from_loop trigger with a bucket full of fail
+    // already, then we really would like to reoptimize immediately. But this case covers
+    // something else: there weren't many (or any) speculation failures before, but we just
+    // failed to enter the speculative code because some variable had the wrong value or
+    // because the OSR code decided for any spurious reason that it did not want to OSR
+    // right now. So, we only trigger reoptimization only upon the more conservative (non-loop)
+    // reoptimization trigger.
+    if (optimizedCodeBlock->shouldReoptimizeNow()) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize now"));
+        if (Options::verboseOSR()) {
+            dataLog(
+                "Triggering reoptimization of ", *codeBlock, " -> ",
+                *codeBlock->replacement(), " (after OSR fail).\n");
+        }
+        optimizedCodeBlock->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTriggerOnOSREntryFail, CountReoptimization);
+        return encodeResult(0, 0);
+    }
+
+    // OSR failed this time, but it might succeed next time! Let the code run a bit
+    // longer and then try again.
+    codeBlock->optimizeAfterWarmUp();
+    
+    CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("OSR failed"));
+    return encodeResult(0, 0);
+}
+#endif
+
+void JIT_OPERATION operationPutByIndex(ExecState* exec, EncodedJSValue encodedArrayValue, int32_t index, EncodedJSValue encodedValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue arrayValue = JSValue::decode(encodedArrayValue);
+    ASSERT(isJSArray(arrayValue));
+    asArray(arrayValue)->putDirectIndex(exec, index, JSValue::decode(encodedValue));
+}
+
+enum class AccessorType {
+    Getter,
+    Setter
+};
+
+static void putAccessorByVal(ExecState* exec, JSObject* base, JSValue subscript, int32_t attribute, JSObject* accessor, AccessorType accessorType)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    auto propertyKey = subscript.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    if (accessorType == AccessorType::Getter)
+        base->putGetter(exec, propertyKey, accessor, attribute);
+    else
+        base->putSetter(exec, propertyKey, accessor, attribute);
+}
+
+void JIT_OPERATION operationPutGetterById(ExecState* exec, JSCell* object, UniquedStringImpl* uid, int32_t options, JSCell* getter)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(object && object->isObject());
+    JSObject* baseObj = object->getObject();
+
+    ASSERT(getter->isObject());
+    baseObj->putGetter(exec, uid, getter, options);
+}
+
+void JIT_OPERATION operationPutSetterById(ExecState* exec, JSCell* object, UniquedStringImpl* uid, int32_t options, JSCell* setter)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(object && object->isObject());
+    JSObject* baseObj = object->getObject();
+
+    ASSERT(setter->isObject());
+    baseObj->putSetter(exec, uid, setter, options);
+}
+
+void JIT_OPERATION operationPutGetterByVal(ExecState* exec, JSCell* base, EncodedJSValue encodedSubscript, int32_t attribute, JSCell* getter)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    putAccessorByVal(exec, asObject(base), JSValue::decode(encodedSubscript), attribute, asObject(getter), AccessorType::Getter);
+}
+
+void JIT_OPERATION operationPutSetterByVal(ExecState* exec, JSCell* base, EncodedJSValue encodedSubscript, int32_t attribute, JSCell* setter)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    putAccessorByVal(exec, asObject(base), JSValue::decode(encodedSubscript), attribute, asObject(setter), AccessorType::Setter);
+}
+
+#if USE(JSVALUE64)
+void JIT_OPERATION operationPutGetterSetter(ExecState* exec, JSCell* object, UniquedStringImpl* uid, int32_t attribute, EncodedJSValue encodedGetterValue, EncodedJSValue encodedSetterValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(object && object->isObject());
+    JSObject* baseObj = asObject(object);
+
+    GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
+
+    JSValue getter = JSValue::decode(encodedGetterValue);
+    JSValue setter = JSValue::decode(encodedSetterValue);
+    ASSERT(getter.isObject() || getter.isUndefined());
+    ASSERT(setter.isObject() || setter.isUndefined());
+    ASSERT(getter.isObject() || setter.isObject());
+
+    if (!getter.isUndefined())
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), asObject(getter));
+    if (!setter.isUndefined())
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), asObject(setter));
+    baseObj->putDirectAccessor(exec, uid, accessor, attribute);
+}
+
+#else
+void JIT_OPERATION operationPutGetterSetter(ExecState* exec, JSCell* object, UniquedStringImpl* uid, int32_t attribute, JSCell* getter, JSCell* setter)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(object && object->isObject());
+    JSObject* baseObj = asObject(object);
+
+    GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
+
+    ASSERT(!getter || getter->isObject());
+    ASSERT(!setter || setter->isObject());
+    ASSERT(getter || setter);
+
+    if (getter)
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), getter->getObject());
+    if (setter)
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), setter->getObject());
+    baseObj->putDirectAccessor(exec, uid, accessor, attribute);
+}
+#endif
+
+void JIT_OPERATION operationPopScope(ExecState* exec, int32_t scopeReg)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSScope* scope = exec->uncheckedR(scopeReg).Register::scope();
+    exec->uncheckedR(scopeReg) = scope->next();
+}
+
+int32_t JIT_OPERATION operationInstanceOfCustom(ExecState* exec, EncodedJSValue encodedValue, JSObject* constructor, EncodedJSValue encodedHasInstance)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue value = JSValue::decode(encodedValue);
+    JSValue hasInstanceValue = JSValue::decode(encodedHasInstance);
+
+    ASSERT(hasInstanceValue != exec->lexicalGlobalObject()->functionProtoHasInstanceSymbolFunction() || !constructor->structure()->typeInfo().implementsDefaultHasInstance());
+
+    if (constructor->hasInstance(exec, value, hasInstanceValue))
+        return 1;
+    return 0;
+}
+
+}
+
+static bool canAccessArgumentIndexQuickly(JSObject& object, uint32_t index)
+{
+    switch (object.structure()->typeInfo().type()) {
+    case DirectArgumentsType: {
+        DirectArguments* directArguments = jsCast<DirectArguments*>(&object);
+        if (directArguments->canAccessArgumentIndexQuicklyInDFG(index))
+            return true;
+        break;
+    }
+    case ScopedArgumentsType: {
+        ScopedArguments* scopedArguments = jsCast<ScopedArguments*>(&object);
+        if (scopedArguments->canAccessArgumentIndexQuicklyInDFG(index))
+            return true;
+        break;
+    }
+    default:
+        break;
+    }
+    return false;
+}
+
+static JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (LIKELY(baseValue.isCell() && subscript.isString())) {
+        Structure& structure = *baseValue.asCell()->structure(vm);
+        if (JSCell::canUseFastGetOwnProperty(structure)) {
+            if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
+                if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get())) {
+                    ASSERT(exec->bytecodeOffset());
+                    if (byValInfo->stubInfo && byValInfo->cachedId.impl() != existingAtomicString)
+                        byValInfo->tookSlowPath = true;
+                    return result;
+                }
+            }
+        }
+    }
+
+    if (subscript.isUInt32()) {
+        ASSERT(exec->bytecodeOffset());
+        byValInfo->tookSlowPath = true;
+
+        uint32_t i = subscript.asUInt32();
+        if (isJSString(baseValue)) {
+            if (asString(baseValue)->canGetIndex(i)) {
+                ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(operationGetByValString));
+                return asString(baseValue)->getIndex(exec, i);
+            }
+            byValInfo->arrayProfile->setOutOfBounds();
+        } else if (baseValue.isObject()) {
+            JSObject* object = asObject(baseValue);
+            if (object->canGetIndexQuickly(i))
+                return object->getIndexQuickly(i);
+
+            if (!canAccessArgumentIndexQuickly(*object, i)) {
+                // FIXME: This will make us think that in-bounds typed array accesses are actually
+                // out-of-bounds.
+                // https://bugs.webkit.org/show_bug.cgi?id=149886
+                byValInfo->arrayProfile->setOutOfBounds();
+            }
+        }
+
+        return baseValue.get(exec, i);
+    }
+
+    baseValue.requireObjectCoercible(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    auto property = subscript.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    ASSERT(exec->bytecodeOffset());
+    if (byValInfo->stubInfo && (!isStringOrSymbol(subscript) || byValInfo->cachedId != property))
+        byValInfo->tookSlowPath = true;
+
+    return baseValue.get(exec, property);
+}
+
+static OptimizationResult tryGetByValOptimize(ExecState* exec, JSValue baseValue, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
+{
+    // See if it's worth optimizing this at all.
+    OptimizationResult optimizationResult = OptimizationResult::NotOptimized;
+
+    VM& vm = exec->vm();
+
+    if (baseValue.isObject() && subscript.isInt32()) {
+        JSObject* object = asObject(baseValue);
+
+        ASSERT(exec->bytecodeOffset());
+        ASSERT(!byValInfo->stubRoutine);
+
+        if (hasOptimizableIndexing(object->structure(vm))) {
+            // Attempt to optimize.
+            Structure* structure = object->structure(vm);
+            JITArrayMode arrayMode = jitArrayModeForStructure(structure);
+            if (arrayMode != byValInfo->arrayMode) {
+                // If we reached this case, we got an interesting array mode we did not expect when we compiled.
+                // Let's update the profile to do better next time.
+                CodeBlock* codeBlock = exec->codeBlock();
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+                byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
+
+                JIT::compileGetByVal(&vm, exec->codeBlock(), byValInfo, returnAddress, arrayMode);
+                optimizationResult = OptimizationResult::Optimized;
+            }
+        }
+
+        // If we failed to patch and we have some object that intercepts indexed get, then don't even wait until 10 times.
+        if (optimizationResult != OptimizationResult::Optimized && object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
+            optimizationResult = OptimizationResult::GiveUp;
+    }
+
+    if (baseValue.isObject() && isStringOrSymbol(subscript)) {
+        const Identifier propertyName = subscript.toPropertyKey(exec);
+        if (subscript.isSymbol() || !parseIndex(propertyName)) {
+            ASSERT(exec->bytecodeOffset());
+            ASSERT(!byValInfo->stubRoutine);
+            if (byValInfo->seen) {
+                if (byValInfo->cachedId == propertyName) {
+                    JIT::compileGetByValWithCachedId(&vm, exec->codeBlock(), byValInfo, returnAddress, propertyName);
+                    optimizationResult = OptimizationResult::Optimized;
+                } else {
+                    // Seem like a generic property access site.
+                    optimizationResult = OptimizationResult::GiveUp;
+                }
+            } else {
+                CodeBlock* codeBlock = exec->codeBlock();
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+                byValInfo->seen = true;
+                byValInfo->cachedId = propertyName;
+                if (subscript.isSymbol())
+                    byValInfo->cachedSymbol.set(vm, codeBlock, asSymbol(subscript));
+                optimizationResult = OptimizationResult::SeenOnce;
+            }
+        }
+    }
+
+    if (optimizationResult != OptimizationResult::Optimized && optimizationResult != OptimizationResult::SeenOnce) {
+        // If we take slow path more than 10 times without patching then make sure we
+        // never make that mistake again. For cases where we see non-index-intercepting
+        // objects, this gives 10 iterations worth of opportunity for us to observe
+        // that the get_by_val may be polymorphic. We count up slowPathCount even if
+        // the result is GiveUp.
+        if (++byValInfo->slowPathCount >= 10)
+            optimizationResult = OptimizationResult::GiveUp;
+    }
+
+    return optimizationResult;
+}
+
+extern "C" {
+
+EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+
+    JSValue result = getByVal(exec, baseValue, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS));
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+    ReturnAddressPtr returnAddress = ReturnAddressPtr(OUR_RETURN_ADDRESS);
+    if (tryGetByValOptimize(exec, baseValue, subscript, byValInfo, returnAddress) == OptimizationResult::GiveUp) {
+        // Don't ever try to optimize.
+        byValInfo->tookSlowPath = true;
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(operationGetByValGeneric));
+    }
+
+    return JSValue::encode(getByVal(exec, baseValue, subscript, byValInfo, returnAddress));
+}
+
+EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+    
+    ASSERT(baseValue.isObject());
+    ASSERT(subscript.isUInt32());
+
+    JSObject* object = asObject(baseValue);
+    bool didOptimize = false;
+
+    ASSERT(exec->bytecodeOffset());
+    ASSERT(!byValInfo->stubRoutine);
+    
+    if (hasOptimizableIndexing(object->structure(vm))) {
+        // Attempt to optimize.
+        JITArrayMode arrayMode = jitArrayModeForStructure(object->structure(vm));
+        if (arrayMode != byValInfo->arrayMode) {
+            JIT::compileHasIndexedProperty(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
+            didOptimize = true;
+        }
+    }
+    
+    if (!didOptimize) {
+        // If we take slow path more than 10 times without patching then make sure we
+        // never make that mistake again. Or, if we failed to patch and we have some object
+        // that intercepts indexed get, then don't even wait until 10 times. For cases
+        // where we see non-index-intercepting objects, this gives 10 iterations worth of
+        // opportunity for us to observe that the get_by_val may be polymorphic.
+        if (++byValInfo->slowPathCount >= 10
+            || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
+            // Don't ever try to optimize.
+            ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationHasIndexedPropertyGeneric));
+        }
+    }
+
+    uint32_t index = subscript.asUInt32();
+    if (object->canGetIndexQuickly(index))
+        return JSValue::encode(JSValue(JSValue::JSTrue));
+
+    if (!canAccessArgumentIndexQuickly(*object, index)) {
+        // FIXME: This will make us think that in-bounds typed array accesses are actually
+        // out-of-bounds.
+        // https://bugs.webkit.org/show_bug.cgi?id=149886
+        byValInfo->arrayProfile->setOutOfBounds();
+    }
+    return JSValue::encode(jsBoolean(object->hasPropertyGeneric(exec, index, PropertySlot::InternalMethodType::GetOwnProperty)));
+}
+    
+EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+    
+    ASSERT(baseValue.isObject());
+    ASSERT(subscript.isUInt32());
+
+    JSObject* object = asObject(baseValue);
+    uint32_t index = subscript.asUInt32();
+    if (object->canGetIndexQuickly(index))
+        return JSValue::encode(JSValue(JSValue::JSTrue));
+
+    if (!canAccessArgumentIndexQuickly(*object, index)) {
+        // FIXME: This will make us think that in-bounds typed array accesses are actually
+        // out-of-bounds.
+        // https://bugs.webkit.org/show_bug.cgi?id=149886
+        byValInfo->arrayProfile->setOutOfBounds();
+    }
+    return JSValue::encode(jsBoolean(object->hasPropertyGeneric(exec, subscript.asUInt32(), PropertySlot::InternalMethodType::GetOwnProperty)));
+}
+    
+EncodedJSValue JIT_OPERATION operationGetByValString(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue baseValue = JSValue::decode(encodedBase);
+    JSValue subscript = JSValue::decode(encodedSubscript);
+    
+    JSValue result;
+    if (LIKELY(subscript.isUInt32())) {
+        uint32_t i = subscript.asUInt32();
+        if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
+            result = asString(baseValue)->getIndex(exec, i);
+        else {
+            result = baseValue.get(exec, i);
+            if (!isJSString(baseValue)) {
+                ASSERT(exec->bytecodeOffset());
+                ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(byValInfo->stubRoutine ? operationGetByValGeneric : operationGetByValOptimize));
+            }
+        }
+    } else {
+        baseValue.requireObjectCoercible(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        auto property = subscript.toPropertyKey(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        result = baseValue.get(exec, property);
+    }
+
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationDeleteByIdJSResult(ExecState* exec, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    return JSValue::encode(jsBoolean(operationDeleteById(exec, base, uid)));
+}
+
+size_t JIT_OPERATION operationDeleteById(ExecState* exec, EncodedJSValue encodedBase, UniquedStringImpl* uid)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* baseObj = JSValue::decode(encodedBase).toObject(exec);
+    if (!baseObj)
+        return false;
+    bool couldDelete = baseObj->methodTable(vm)->deleteProperty(baseObj, exec, Identifier::fromUid(&vm, uid));
+    if (!couldDelete && exec->codeBlock()->isStrictMode())
+        throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+    return couldDelete;
+}
+
+EncodedJSValue JIT_OPERATION operationDeleteByValJSResult(ExecState* exec, EncodedJSValue base,  EncodedJSValue key)
+{
+    return JSValue::encode(jsBoolean(operationDeleteByVal(exec, base, key)));
+}
+
+size_t JIT_OPERATION operationDeleteByVal(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedKey)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* baseObj = JSValue::decode(encodedBase).toObject(exec);
+    JSValue key = JSValue::decode(encodedKey);
+    if (!baseObj)
+        return false;
+
+    bool couldDelete;
+    uint32_t index;
+    if (key.getUInt32(index))
+        couldDelete = baseObj->methodTable(vm)->deletePropertyByIndex(baseObj, exec, index);
+    else {
+        RETURN_IF_EXCEPTION(scope, false);
+        Identifier property = key.toPropertyKey(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        couldDelete = baseObj->methodTable(vm)->deleteProperty(baseObj, exec, property);
+    }
+    if (!couldDelete && exec->codeBlock()->isStrictMode())
+        throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+    return couldDelete;
+}
+
+EncodedJSValue JIT_OPERATION operationInstanceOf(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedProto)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue value = JSValue::decode(encodedValue);
+    JSValue proto = JSValue::decode(encodedProto);
+    
+    bool result = JSObject::defaultHasInstance(exec, value, proto);
+    return JSValue::encode(jsBoolean(result));
+}
+
+int32_t JIT_OPERATION operationSizeFrameForForwardArguments(ExecState* exec, EncodedJSValue, int32_t numUsedStackSlots, int32_t)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return sizeFrameForForwardArguments(exec, vm, numUsedStackSlots);
+}
+
+int32_t JIT_OPERATION operationSizeFrameForVarargs(ExecState* exec, EncodedJSValue encodedArguments, int32_t numUsedStackSlots, int32_t firstVarArgOffset)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue arguments = JSValue::decode(encodedArguments);
+    return sizeFrameForVarargs(exec, vm, arguments, numUsedStackSlots, firstVarArgOffset);
+}
+
+CallFrame* JIT_OPERATION operationSetupForwardArgumentsFrame(ExecState* exec, CallFrame* newCallFrame, EncodedJSValue, int32_t, int32_t length)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    setupForwardArgumentsFrame(exec, newCallFrame, length);
+    return newCallFrame;
+}
+
+CallFrame* JIT_OPERATION operationSetupVarargsFrame(ExecState* exec, CallFrame* newCallFrame, EncodedJSValue encodedArguments, int32_t firstVarArgOffset, int32_t length)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue arguments = JSValue::decode(encodedArguments);
+    setupVarargsFrame(exec, newCallFrame, arguments, firstVarArgOffset, length);
+    return newCallFrame;
+}
+
+EncodedJSValue JIT_OPERATION operationToObject(ExecState* exec, EncodedJSValue value)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSObject* obj = JSValue::decode(value).toObject(exec);
+    if (!obj)
+        return JSValue::encode(JSValue());
+    return JSValue::encode(obj);
+}
+
+char* JIT_OPERATION operationSwitchCharWithUnknownKeyType(ExecState* exec, EncodedJSValue encodedKey, size_t tableIndex)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue key = JSValue::decode(encodedKey);
+    CodeBlock* codeBlock = exec->codeBlock();
+
+    SimpleJumpTable& jumpTable = codeBlock->switchJumpTable(tableIndex);
+    void* result = jumpTable.ctiDefault.executableAddress();
+
+    if (key.isString()) {
+        StringImpl* value = asString(key)->value(exec).impl();
+        if (value->length() == 1)
+            result = jumpTable.ctiForValue((*value)[0]).executableAddress();
+    }
+
+    return reinterpret_cast<char*>(result);
+}
+
+char* JIT_OPERATION operationSwitchImmWithUnknownKeyType(ExecState* exec, EncodedJSValue encodedKey, size_t tableIndex)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue key = JSValue::decode(encodedKey);
+    CodeBlock* codeBlock = exec->codeBlock();
+
+    SimpleJumpTable& jumpTable = codeBlock->switchJumpTable(tableIndex);
+    void* result;
+    if (key.isInt32())
+        result = jumpTable.ctiForValue(key.asInt32()).executableAddress();
+    else if (key.isDouble() && key.asDouble() == static_cast<int32_t>(key.asDouble()))
+        result = jumpTable.ctiForValue(static_cast<int32_t>(key.asDouble())).executableAddress();
+    else
+        result = jumpTable.ctiDefault.executableAddress();
+    return reinterpret_cast<char*>(result);
+}
+
+char* JIT_OPERATION operationSwitchStringWithUnknownKeyType(ExecState* exec, EncodedJSValue encodedKey, size_t tableIndex)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue key = JSValue::decode(encodedKey);
+    CodeBlock* codeBlock = exec->codeBlock();
+
+    void* result;
+    StringJumpTable& jumpTable = codeBlock->stringSwitchJumpTable(tableIndex);
+
+    if (key.isString()) {
+        StringImpl* value = asString(key)->value(exec).impl();
+        result = jumpTable.ctiForValue(value).executableAddress();
+    } else
+        result = jumpTable.ctiDefault.executableAddress();
+
+    return reinterpret_cast<char*>(result);
+}
+
+EncodedJSValue JIT_OPERATION operationGetFromScope(ExecState* exec, Instruction* bytecodePC)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    CodeBlock* codeBlock = exec->codeBlock();
+    Instruction* pc = bytecodePC;
+
+    const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
+    JSObject* scope = jsCast<JSObject*>(exec->uncheckedR(pc[2].u.operand).jsValue());
+    GetPutInfo getPutInfo(pc[4].u.operand);
+
+    // ModuleVar is always converted to ClosureVar for get_from_scope.
+    ASSERT(getPutInfo.resolveType() != ModuleVar);
+
+    return JSValue::encode(scope->getPropertySlot(exec, ident, [&] (bool found, PropertySlot& slot) -> JSValue {
+        if (!found) {
+            if (getPutInfo.resolveMode() == ThrowIfNotFound)
+                throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
+            return jsUndefined();
+        }
+
+        JSValue result = JSValue();
+        if (scope->isGlobalLexicalEnvironment()) {
+            // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
+            result = slot.getValue(exec, ident);
+            if (result == jsTDZValue()) {
+                throwException(exec, throwScope, createTDZError(exec));
+                return jsUndefined();
+            }
+        }
+
+        CommonSlowPaths::tryCacheGetFromScopeGlobal(exec, vm, pc, scope, slot, ident);
+
+        if (!result)
+            return slot.getValue(exec, ident);
+        return result;
+    }));
+}
+
+void JIT_OPERATION operationPutToScope(ExecState* exec, Instruction* bytecodePC)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    Instruction* pc = bytecodePC;
+
+    CodeBlock* codeBlock = exec->codeBlock();
+    const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
+    JSObject* scope = jsCast<JSObject*>(exec->uncheckedR(pc[1].u.operand).jsValue());
+    JSValue value = exec->r(pc[3].u.operand).jsValue();
+    GetPutInfo getPutInfo = GetPutInfo(pc[4].u.operand);
+
+    // ModuleVar does not keep the scope register value alive in DFG.
+    ASSERT(getPutInfo.resolveType() != ModuleVar);
+
+    if (getPutInfo.resolveType() == LocalClosureVar) {
+        JSLexicalEnvironment* environment = jsCast<JSLexicalEnvironment*>(scope);
+        environment->variableAt(ScopeOffset(pc[6].u.operand)).set(vm, environment, value);
+        if (WatchpointSet* set = pc[5].u.watchpointSet)
+            set->touch(vm, "Executed op_put_scope<LocalClosureVar>");
+        return;
+    }
+
+    bool hasProperty = scope->hasProperty(exec, ident);
+    if (hasProperty
+        && scope->isGlobalLexicalEnvironment()
+        && !isInitialization(getPutInfo.initializationMode())) {
+        // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
+        PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
+        JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
+        if (slot.getValue(exec, ident) == jsTDZValue()) {
+            throwException(exec, throwScope, createTDZError(exec));
+            return;
+        }
+    }
+
+    if (getPutInfo.resolveMode() == ThrowIfNotFound && !hasProperty) {
+        throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
+        return;
+    }
+
+    PutPropertySlot slot(scope, codeBlock->isStrictMode(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
+    scope->methodTable()->put(scope, exec, ident, value, slot);
+    
+    RETURN_IF_EXCEPTION(throwScope, void());
+
+    CommonSlowPaths::tryCachePutToScopeGlobal(exec, codeBlock, pc, scope, getPutInfo, slot, ident);
+}
+
+void JIT_OPERATION operationThrow(ExecState* exec, EncodedJSValue encodedExceptionValue)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    JSValue exceptionValue = JSValue::decode(encodedExceptionValue);
+    throwException(exec, scope, exceptionValue);
+
+    // Results stored out-of-band in vm.targetMachinePCForThrow & vm.callFrameForCatch
+    genericUnwind(vm, exec);
+}
+
+char* JIT_OPERATION operationReallocateButterflyToHavePropertyStorageWithInitialCapacity(ExecState* exec, JSObject* object)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    ASSERT(!object->structure()->outOfLineCapacity());
+    Butterfly* result = object->allocateMoreOutOfLineStorage(vm, 0, initialOutOfLineCapacity);
+    object->nukeStructureAndSetButterfly(vm, object->structureID(), result);
+    return reinterpret_cast<char*>(result);
+}
+
+char* JIT_OPERATION operationReallocateButterflyToGrowPropertyStorage(ExecState* exec, JSObject* object, size_t newSize)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    Butterfly* result = object->allocateMoreOutOfLineStorage(vm, object->structure()->outOfLineCapacity(), newSize);
+    object->nukeStructureAndSetButterfly(vm, object->structureID(), result);
+    return reinterpret_cast<char*>(result);
+}
+
+void JIT_OPERATION operationOSRWriteBarrier(ExecState* exec, JSCell* cell)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    vm->heap.writeBarrier(cell);
+}
+
+void JIT_OPERATION operationWriteBarrierSlowPath(ExecState* exec, JSCell* cell)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    vm->heap.writeBarrierSlowPath(cell);
+}
+
+void JIT_OPERATION lookupExceptionHandler(VM* vm, ExecState* exec)
+{
+    NativeCallFrameTracer tracer(vm, exec);
+    genericUnwind(vm, exec);
+    ASSERT(vm->targetMachinePCForThrow);
+}
+
+void JIT_OPERATION lookupExceptionHandlerFromCallerFrame(VM* vm, ExecState* exec)
+{
+    vm->topCallFrame = exec->callerFrame();
+    genericUnwind(vm, exec, UnwindFromCallerFrame);
+    ASSERT(vm->targetMachinePCForThrow);
+}
+
+void JIT_OPERATION operationVMHandleException(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    genericUnwind(vm, exec);
+}
+
+// This function "should" just take the ExecState*, but doing so would make it more difficult
+// to call from exception check sites. So, unlike all of our other functions, we allow
+// ourselves to play some gnarly ABI tricks just to simplify the calling convention. This is
+// particularly safe here since this is never called on the critical path - it's only for
+// testing.
+void JIT_OPERATION operationExceptionFuzz(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    UNUSED_PARAM(scope);
+#if COMPILER(GCC_OR_CLANG)
+    void* returnPC = __builtin_return_address(0);
+    doExceptionFuzzing(exec, scope, "JITOperations", returnPC);
+#endif // COMPILER(GCC_OR_CLANG)
+}
+
+EncodedJSValue JIT_OPERATION operationHasGenericProperty(ExecState* exec, EncodedJSValue encodedBaseValue, JSCell* propertyName)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSValue baseValue = JSValue::decode(encodedBaseValue);
+    if (baseValue.isUndefinedOrNull())
+        return JSValue::encode(jsBoolean(false));
+
+    JSObject* base = baseValue.toObject(exec);
+    if (!base)
+        return JSValue::encode(JSValue());
+    return JSValue::encode(jsBoolean(base->hasPropertyGeneric(exec, asString(propertyName)->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty)));
+}
+
+EncodedJSValue JIT_OPERATION operationHasIndexedProperty(ExecState* exec, JSCell* baseCell, int32_t subscript)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSObject* object = baseCell->toObject(exec, exec->lexicalGlobalObject());
+    return JSValue::encode(jsBoolean(object->hasPropertyGeneric(exec, subscript, PropertySlot::InternalMethodType::GetOwnProperty)));
+}
+    
+JSCell* JIT_OPERATION operationGetPropertyEnumerator(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSObject* base = cell->toObject(exec, exec->lexicalGlobalObject());
+
+    return propertyNameEnumerator(exec, base);
+}
+
+EncodedJSValue JIT_OPERATION operationNextEnumeratorPname(ExecState* exec, JSCell* enumeratorCell, int32_t index)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    JSPropertyNameEnumerator* enumerator = jsCast<JSPropertyNameEnumerator*>(enumeratorCell);
+    JSString* propertyName = enumerator->propertyNameAtIndex(index);
+    return JSValue::encode(propertyName ? propertyName : jsNull());
+}
+
+JSCell* JIT_OPERATION operationToIndexString(ExecState* exec, int32_t index)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    return jsString(exec, Identifier::from(exec, index).string());
+}
+
+ALWAYS_INLINE static EncodedJSValue unprofiledAdd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+    
+    return JSValue::encode(jsAdd(exec, op1, op2));
+}
+
+ALWAYS_INLINE static EncodedJSValue profiledAdd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile& arithProfile)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    arithProfile.observeLHSAndRHS(op1, op2);
+    JSValue result = jsAdd(exec, op1, op2);
+    arithProfile.observeResult(result);
+
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationValueAdd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    return unprofiledAdd(exec, encodedOp1, encodedOp2);
+}
+
+EncodedJSValue JIT_OPERATION operationValueAddProfiled(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile* arithProfile)
+{
+    ASSERT(arithProfile);
+    return profiledAdd(exec, encodedOp1, encodedOp2, *arithProfile);
+}
+
+EncodedJSValue JIT_OPERATION operationValueAddProfiledOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    ArithProfile* arithProfile = addIC->arithProfile();
+    ASSERT(arithProfile);
+    arithProfile->observeLHSAndRHS(op1, op2);
+    auto nonOptimizeVariant = operationValueAddProfiledNoOptimize;
+    addIC->generateOutOfLine(*vm, exec->codeBlock(), nonOptimizeVariant);
+
+#if ENABLE(MATH_IC_STATS)
+    exec->codeBlock()->dumpMathICStats();
+#endif
+    
+    JSValue result = jsAdd(exec, op1, op2);
+    arithProfile->observeResult(result);
+
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationValueAddProfiledNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    ArithProfile* arithProfile = addIC->arithProfile();
+    ASSERT(arithProfile);
+    return profiledAdd(exec, encodedOp1, encodedOp2, *arithProfile);
+}
+
+EncodedJSValue JIT_OPERATION operationValueAddOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    auto nonOptimizeVariant = operationValueAddNoOptimize;
+    if (ArithProfile* arithProfile = addIC->arithProfile())
+        arithProfile->observeLHSAndRHS(op1, op2);
+    addIC->generateOutOfLine(*vm, exec->codeBlock(), nonOptimizeVariant);
+
+#if ENABLE(MATH_IC_STATS)
+    exec->codeBlock()->dumpMathICStats();
+#endif
+
+    return JSValue::encode(jsAdd(exec, op1, op2));
+}
+
+EncodedJSValue JIT_OPERATION operationValueAddNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC*)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+    
+    JSValue result = jsAdd(exec, op1, op2);
+
+    return JSValue::encode(result);
+}
+
+ALWAYS_INLINE static EncodedJSValue unprofiledMul(VM& vm, ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    double b = op2.toNumber(exec);
+    return JSValue::encode(jsNumber(a * b));
+}
+
+ALWAYS_INLINE static EncodedJSValue profiledMul(VM& vm, ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile& arithProfile, bool shouldObserveLHSAndRHSTypes = true)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    if (shouldObserveLHSAndRHSTypes)
+        arithProfile.observeLHSAndRHS(op1, op2);
+
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    double b = op2.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    JSValue result = jsNumber(a * b);
+    arithProfile.observeResult(result);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationValueMul(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return unprofiledMul(*vm, exec, encodedOp1, encodedOp2);
+}
+
+EncodedJSValue JIT_OPERATION operationValueMulNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC*)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return unprofiledMul(*vm, exec, encodedOp1, encodedOp2);
+}
+
+EncodedJSValue JIT_OPERATION operationValueMulOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    auto nonOptimizeVariant = operationValueMulNoOptimize;
+    if (ArithProfile* arithProfile = mulIC->arithProfile())
+        arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+    mulIC->generateOutOfLine(*vm, exec->codeBlock(), nonOptimizeVariant);
+
+#if ENABLE(MATH_IC_STATS)
+    exec->codeBlock()->dumpMathICStats();
+#endif
+
+    return unprofiledMul(*vm, exec, encodedOp1, encodedOp2);
+}
+
+EncodedJSValue JIT_OPERATION operationValueMulProfiled(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile* arithProfile)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    ASSERT(arithProfile);
+    return profiledMul(*vm, exec, encodedOp1, encodedOp2, *arithProfile);
+}
+
+EncodedJSValue JIT_OPERATION operationValueMulProfiledOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    ArithProfile* arithProfile = mulIC->arithProfile();
+    ASSERT(arithProfile);
+    arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+    auto nonOptimizeVariant = operationValueMulProfiledNoOptimize;
+    mulIC->generateOutOfLine(*vm, exec->codeBlock(), nonOptimizeVariant);
+
+#if ENABLE(MATH_IC_STATS)
+    exec->codeBlock()->dumpMathICStats();
+#endif
+
+    return profiledMul(*vm, exec, encodedOp1, encodedOp2, *arithProfile, false);
+}
+
+EncodedJSValue JIT_OPERATION operationValueMulProfiledNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    ArithProfile* arithProfile = mulIC->arithProfile();
+    ASSERT(arithProfile);
+    return profiledMul(*vm, exec, encodedOp1, encodedOp2, *arithProfile);
+}
+
+ALWAYS_INLINE static EncodedJSValue unprofiledNegate(ExecState* exec, EncodedJSValue encodedOperand)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    JSValue operand = JSValue::decode(encodedOperand);
+    double number = operand.toNumber(exec);
+    if (UNLIKELY(scope.exception()))
+        return JSValue::encode(JSValue());
+    return JSValue::encode(jsNumber(-number));
+}
+
+ALWAYS_INLINE static EncodedJSValue profiledNegate(ExecState* exec, EncodedJSValue encodedOperand, ArithProfile& arithProfile)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue operand = JSValue::decode(encodedOperand);
+    arithProfile.observeLHS(operand);
+    double number = operand.toNumber(exec);
+    if (UNLIKELY(scope.exception()))
+        return JSValue::encode(JSValue());
+
+    JSValue result = jsNumber(-number);
+    arithProfile.observeResult(result);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationArithNegate(ExecState* exec, EncodedJSValue operand)
+{
+    return unprofiledNegate(exec, operand);
+}
+
+EncodedJSValue JIT_OPERATION operationArithNegateProfiled(ExecState* exec, EncodedJSValue operand, ArithProfile* arithProfile)
+{
+    ASSERT(arithProfile);
+    return profiledNegate(exec, operand, *arithProfile);
+}
+
+EncodedJSValue JIT_OPERATION operationArithNegateProfiledOptimize(ExecState* exec, EncodedJSValue encodedOperand, JITNegIC* negIC)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    JSValue operand = JSValue::decode(encodedOperand);
+
+    ArithProfile* arithProfile = negIC->arithProfile();
+    ASSERT(arithProfile);
+    arithProfile->observeLHS(operand);
+    negIC->generateOutOfLine(vm, exec->codeBlock(), operationArithNegateProfiled);
+
+#if ENABLE(MATH_IC_STATS)
+    exec->codeBlock()->dumpMathICStats();
+#endif
+    
+    double number = operand.toNumber(exec);
+    if (UNLIKELY(scope.exception()))
+        return JSValue::encode(JSValue());
+    JSValue result = jsNumber(-number);
+    arithProfile->observeResult(result);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationArithNegateOptimize(ExecState* exec, EncodedJSValue encodedOperand, JITNegIC* negIC)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    NativeCallFrameTracer tracer(&vm, exec);
+
+    JSValue operand = JSValue::decode(encodedOperand);
+
+    if (ArithProfile* arithProfile = negIC->arithProfile())
+        arithProfile->observeLHS(operand);
+    negIC->generateOutOfLine(vm, exec->codeBlock(), operationArithNegate);
+
+#if ENABLE(MATH_IC_STATS)
+    exec->codeBlock()->dumpMathICStats();
+#endif
+
+    double number = operand.toNumber(exec);
+    if (UNLIKELY(scope.exception()))
+        return JSValue::encode(JSValue());
+    return JSValue::encode(jsNumber(-number));
+}
+
+ALWAYS_INLINE static EncodedJSValue unprofiledSub(VM& vm, ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    double b = op2.toNumber(exec);
+    return JSValue::encode(jsNumber(a - b));
+}
+
+ALWAYS_INLINE static EncodedJSValue profiledSub(VM& vm, ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile& arithProfile, bool shouldObserveLHSAndRHSTypes = true)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue op1 = JSValue::decode(encodedOp1);
+    JSValue op2 = JSValue::decode(encodedOp2);
+
+    if (shouldObserveLHSAndRHSTypes)
+        arithProfile.observeLHSAndRHS(op1, op2);
+
+    double a = op1.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    double b = op2.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    JSValue result = jsNumber(a - b);
+    arithProfile.observeResult(result);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JIT_OPERATION operationValueSub(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    return unprofiledSub(*vm, exec, encodedOp1, encodedOp2);
+}
+
+EncodedJSValue JIT_OPERATION operationValueSubProfiled(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile* arithProfile)
+{
+    ASSERT(arithProfile);
+
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return profiledSub(*vm, exec, encodedOp1, encodedOp2, *arithProfile);
+}
+
+EncodedJSValue JIT_OPERATION operationValueSubOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    auto nonOptimizeVariant = operationValueSubNoOptimize;
+    if (ArithProfile* arithProfile = subIC->arithProfile())
+        arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+    subIC->generateOutOfLine(*vm, exec->codeBlock(), nonOptimizeVariant);
+
+#if ENABLE(MATH_IC_STATS)
+    exec->codeBlock()->dumpMathICStats();
+#endif
+
+    return unprofiledSub(*vm, exec, encodedOp1, encodedOp2);
+}
+
+EncodedJSValue JIT_OPERATION operationValueSubNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC*)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    return unprofiledSub(*vm, exec, encodedOp1, encodedOp2);
+}
+
+EncodedJSValue JIT_OPERATION operationValueSubProfiledOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    ArithProfile* arithProfile = subIC->arithProfile();
+    ASSERT(arithProfile);
+    arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
+    auto nonOptimizeVariant = operationValueSubProfiledNoOptimize;
+    subIC->generateOutOfLine(*vm, exec->codeBlock(), nonOptimizeVariant);
+
+#if ENABLE(MATH_IC_STATS)
+    exec->codeBlock()->dumpMathICStats();
+#endif
+
+    return profiledSub(*vm, exec, encodedOp1, encodedOp2, *arithProfile, false);
+}
+
+EncodedJSValue JIT_OPERATION operationValueSubProfiledNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+
+    ArithProfile* arithProfile = subIC->arithProfile();
+    ASSERT(arithProfile);
+    return profiledSub(*vm, exec, encodedOp1, encodedOp2, *arithProfile);
+}
+
+void JIT_OPERATION operationProcessTypeProfilerLog(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    vm.typeProfilerLog()->processLogEntries(ASCIILiteral("Log Full, called from inside baseline JIT"));
+}
+
+void JIT_OPERATION operationProcessShadowChickenLog(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    vm.shadowChicken().update(vm, exec);
+}
+
+int32_t JIT_OPERATION operationCheckIfExceptionIsUncatchableAndNotifyProfiler(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    RELEASE_ASSERT(!!scope.exception());
+
+    if (isTerminatedExecutionException(scope.exception())) {
+        genericUnwind(&vm, exec);
+        return 1;
+    }
+    return 0;
+}
+
+} // extern "C"
+
+// Note: getHostCallReturnValueWithExecState() needs to be placed before the
+// definition of getHostCallReturnValue() below because the Windows build
+// requires it.
+extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWithExecState(ExecState* exec)
+{
+    if (!exec)
+        return JSValue::encode(JSValue());
+    return JSValue::encode(exec->vm().hostCallReturnValue);
+}
+
+#if COMPILER(GCC_OR_CLANG) && CPU(X86_64)
+asm (
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "lea -8(%rsp), %rdi\n"
+    "jmp " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+);
+
+#elif COMPILER(GCC_OR_CLANG) && CPU(X86)
+asm (
+".text" "\n" \
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "push %ebp\n"
+    "mov %esp, %eax\n"
+    "leal -4(%esp), %esp\n"
+    "push %eax\n"
+    "call " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+    "leal 8(%esp), %esp\n"
+    "pop %ebp\n"
+    "ret\n"
+);
+
+#elif COMPILER(GCC_OR_CLANG) && CPU(ARM_THUMB2)
+asm (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+".thumb" "\n"
+".thumb_func " THUMB_FUNC_PARAM(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "sub r0, sp, #8" "\n"
+    "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+);
+
+#elif COMPILER(GCC_OR_CLANG) && CPU(ARM_TRADITIONAL)
+asm (
+".text" "\n"
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+INLINE_ARM_FUNCTION(getHostCallReturnValue)
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "sub r0, sp, #8" "\n"
+    "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+);
+
+#elif CPU(ARM64)
+asm (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+     "sub x0, sp, #16" "\n"
+     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+);
+
+#elif COMPILER(GCC_OR_CLANG) && CPU(MIPS)
+
+#if WTF_MIPS_PIC
+#define LOAD_FUNCTION_TO_T9(function) \
+        ".set noreorder" "\n" \
+        ".cpload $25" "\n" \
+        ".set reorder" "\n" \
+        "la $t9, " LOCAL_REFERENCE(function) "\n"
+#else
+#define LOAD_FUNCTION_TO_T9(function) "" "\n"
+#endif
+
+asm (
+".text" "\n"
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    LOAD_FUNCTION_TO_T9(getHostCallReturnValueWithExecState)
+    "addi $a0, $sp, -8" "\n"
+    "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+);
+
+#elif COMPILER(GCC_OR_CLANG) && CPU(SH4)
+
+#define SH4_SCRATCH_REGISTER "r11"
+
+asm (
+".text" "\n"
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "mov r15, r4" "\n"
+    "add -8, r4" "\n"
+    "mov.l 2f, " SH4_SCRATCH_REGISTER "\n"
+    "braf " SH4_SCRATCH_REGISTER "\n"
+    "nop" "\n"
+    "1: .balign 4" "\n"
+    "2: .long " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "-1b\n"
+);
+
+#elif COMPILER(MSVC) && CPU(X86)
+extern "C" {
+    __declspec(naked) EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValue()
+    {
+        __asm lea eax, [esp - 4]
+        __asm mov [esp + 4], eax;
+        __asm jmp getHostCallReturnValueWithExecState
+    }
+}
+#endif
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITOperations.h b/jit/JITOperations.h
new file mode 100644
index 0000000..34b762a
--- /dev/null
+++ b/jit/JITOperations.h
@@ -0,0 +1,473 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JITMathICForwards.h"
+#include "MacroAssemblerCodeRef.h"
+#include "PropertyOffset.h"
+#include "SlowPathReturnType.h"
+#include "TypedArrayType.h"
+#include <wtf/Platform.h>
+#include <wtf/text/UniquedStringImpl.h>
+
+namespace JSC {
+
+typedef int64_t EncodedJSValue;
+    
+class ArrayAllocationProfile;
+class ArrayProfile;
+class Butterfly;
+class CallLinkInfo;
+class CodeBlock;
+class ExecState;
+class JSArray;
+class JSCell;
+class JSFunction;
+class JSGlobalObject;
+class JSLexicalEnvironment;
+class JSObject;
+class JSScope;
+class JSString;
+class JSValue;
+class RegExpObject;
+class Register;
+class Structure;
+class StructureStubInfo;
+class Symbol;
+class SymbolTable;
+class WatchpointSet;
+
+struct ByValInfo;
+struct InlineCallFrame;
+struct Instruction;
+struct ArithProfile;
+
+typedef ExecState CallFrame;
+
+extern "C" {
+
+typedef char* UnusedPtr;
+
+// These typedefs provide typechecking when generating calls out to helper routines;
+// this helps prevent calling a helper routine with the wrong arguments!
+/*
+    Key:
+    A: JSArray*
+    Aap: ArrayAllocationProfile*
+    Ap: ArrayProfile*
+    Arp: ArithProfile*
+    B: Butterfly*
+    By: ByValInfo*
+    C: JSCell*
+    Cb: CodeBlock*
+    Cli: CallLinkInfo*
+    D: double
+    E: ExecState*
+    F: CallFrame*
+    G: JSGlobalObject*
+    I: UniquedStringImpl*
+    Icf: InlineCallFrame*
+    Idc: const Identifier*
+    J: EncodedJSValue
+    Mic: JITMathIC* (can be JITAddIC*, JITMulIC*, etc).
+    Jcp: const JSValue*
+    Jsc: JSScope*
+    Jsf: JSFunction*
+    Jss: JSString*
+    L: JSLexicalEnvironment*
+    O: JSObject*
+    P: pointer (char*)
+    Pc: Instruction* i.e. bytecode PC
+    Q: int64_t
+    R: Register
+    Reo: RegExpObject*
+    S: size_t
+    Sprt: SlowPathReturnType
+    Ssi: StructureStubInfo*
+    St: Structure*
+    Symtab: SymbolTable*
+    Sym: Symbol*
+    T: StringImpl*
+    V: void
+    Vm: VM*
+    Ws: WatchpointSet*
+    Z: int32_t
+    Ui: uint32_t
+*/
+
+typedef CallFrame* (JIT_OPERATION *F_JITOperation_EFJZZ)(ExecState*, CallFrame*, EncodedJSValue, int32_t, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_E)(ExecState*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EA)(ExecState*, JSArray*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EAZ)(ExecState*, JSArray*, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EAapJ)(ExecState*, ArrayAllocationProfile*, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EAapJcpZ)(ExecState*, ArrayAllocationProfile*, const JSValue*, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EC)(ExecState*, JSCell*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ECC)(ExecState*, JSCell*, JSCell*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ECI)(ExecState*, JSCell*, UniquedStringImpl*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ECJ)(ExecState*, JSCell*, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ECZ)(ExecState*, JSCell*, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EDA)(ExecState*, double, JSArray*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EE)(ExecState*, ExecState*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EGReoJ)(ExecState*, JSGlobalObject*, RegExpObject*, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EGReoJss)(ExecState*, JSGlobalObject*, RegExpObject*, JSString*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EGJJ)(ExecState*, JSGlobalObject*, EncodedJSValue, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EI)(ExecState*, UniquedStringImpl*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJ)(ExecState*, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJZ)(ExecState*, EncodedJSValue, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJC)(ExecState*, EncodedJSValue, JSCell*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJA)(ExecState*, EncodedJSValue, JSArray*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJArp)(ExecState*, EncodedJSValue, ArithProfile*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJI)(ExecState*, EncodedJSValue, UniquedStringImpl*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJAp)(ExecState*, EncodedJSValue, EncodedJSValue, ArrayProfile*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJBy)(ExecState*, EncodedJSValue, EncodedJSValue, ByValInfo*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJArp)(ExecState*, EncodedJSValue, EncodedJSValue, ArithProfile*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJMic)(ExecState*, EncodedJSValue, EncodedJSValue, void*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJMic)(ExecState*, EncodedJSValue, void*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJssZ)(ExecState*, JSString*, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJssReo)(ExecState*, JSString*, RegExpObject*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJssReoJss)(ExecState*, JSString*, RegExpObject*, JSString*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJP)(ExecState*, EncodedJSValue, void*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EGP)(ExecState*, JSGlobalObject*, void*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EP)(ExecState*, void*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EPP)(ExecState*, void*, void*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EPPP)(ExecState*, void*, void*, void*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EPS)(ExecState*, void*, size_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EPc)(ExecState*, Instruction*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJscC)(ExecState*, JSScope*, JSCell*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJscCJ)(ExecState*, JSScope*, JSCell*, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EReoJ)(ExecState*, RegExpObject*, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EReoJss)(ExecState*, RegExpObject*, JSString*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ESS)(ExecState*, size_t, size_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ESsiCI)(ExecState*, StructureStubInfo*, JSCell*, UniquedStringImpl*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_ESsiJI)(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EZ)(ExecState*, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EZIcfZ)(ExecState*, int32_t, InlineCallFrame*, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EZZ)(ExecState*, int32_t, int32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EZSymtabJ)(ExecState*, int32_t, SymbolTable*, EncodedJSValue);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EOIUi)(ExecState*, JSObject*, UniquedStringImpl*, uint32_t);
+typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJI)(ExecState*, EncodedJSValue, EncodedJSValue, UniquedStringImpl*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EPUi)(ExecState*, void*, uint32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_E)(ExecState*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EZ)(ExecState*, int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EC)(ExecState*, JSCell*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_ECZ)(ExecState*, JSCell*, int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_ECZC)(ExecState*, JSCell*, int32_t, JSCell*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_ECC)(ExecState*, JSCell*, JSCell*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EGC)(ExecState*, JSGlobalObject*, JSCell*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EGJ)(ExecState*, JSGlobalObject*, EncodedJSValue);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EIcf)(ExecState*, InlineCallFrame*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJ)(ExecState*, EncodedJSValue);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJsc)(ExecState*, JSScope*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJscC)(ExecState*, JSScope*, JSCell*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJZ)(ExecState*, EncodedJSValue, int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJZC)(ExecState*, EncodedJSValue, int32_t, JSCell*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJJC)(ExecState*, EncodedJSValue, EncodedJSValue, JSCell*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJscZ)(ExecState*, JSScope*, int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJssSt)(ExecState*, JSString*, Structure*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJssJss)(ExecState*, JSString*, JSString*);
+typedef uintptr_t (JIT_OPERATION *C_JITOperation_B_EJssJss)(ExecState*, JSString*, JSString*);
+typedef uintptr_t (JIT_OPERATION *C_JITOperation_TT)(StringImpl*, StringImpl*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJssJssJss)(ExecState*, JSString*, JSString*, JSString*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EL)(ExecState*, JSLexicalEnvironment*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EO)(ExecState*, JSObject*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EOZ)(ExecState*, JSObject*, int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_ESt)(ExecState*, Structure*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EStJscSymtabJ)(ExecState*, Structure*, JSScope*, SymbolTable*, EncodedJSValue);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EStRZJsfL)(ExecState*, Structure*, Register*, int32_t, JSFunction*, JSLexicalEnvironment*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EStRZJsf)(ExecState*, Structure*, Register*, int32_t, JSFunction*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EStZ)(ExecState*, Structure*, int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EStZZ)(ExecState*, Structure*, int32_t, int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EZ)(ExecState*, int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_EJscI)(ExecState*, JSScope*, UniquedStringImpl*);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_ECJZ)(ExecState*, JSCell*, EncodedJSValue, int32_t);
+typedef double (JIT_OPERATION *D_JITOperation_D)(double);
+typedef double (JIT_OPERATION *D_JITOperation_G)(JSGlobalObject*);
+typedef double (JIT_OPERATION *D_JITOperation_DD)(double, double);
+typedef double (JIT_OPERATION *D_JITOperation_ZZ)(int32_t, int32_t);
+typedef double (JIT_OPERATION *D_JITOperation_EJ)(ExecState*, EncodedJSValue);
+typedef int64_t (JIT_OPERATION *Q_JITOperation_J)(EncodedJSValue);
+typedef int64_t (JIT_OPERATION *Q_JITOperation_D)(double);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_D)(double);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_E)(ExecState*);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_EC)(ExecState*, JSCell*);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_EGC)(ExecState*, JSGlobalObject*, JSCell*);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_ESJss)(ExecState*, size_t, JSString*);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_EJ)(ExecState*, EncodedJSValue);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_EJOJ)(ExecState*, EncodedJSValue, JSObject*, EncodedJSValue);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_EJZ)(ExecState*, EncodedJSValue, int32_t);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_EJZZ)(ExecState*, EncodedJSValue, int32_t, int32_t);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_EOI)(ExecState*, JSObject*, UniquedStringImpl*);
+typedef int32_t (JIT_OPERATION *Z_JITOperation_EOJ)(ExecState*, JSObject*, EncodedJSValue);
+typedef size_t (JIT_OPERATION *S_JITOperation_ECC)(ExecState*, JSCell*, JSCell*);
+typedef size_t (JIT_OPERATION *S_JITOperation_EGC)(ExecState*, JSGlobalObject*, JSCell*);
+typedef size_t (JIT_OPERATION *S_JITOperation_EGJJ)(ExecState*, JSGlobalObject*, EncodedJSValue, EncodedJSValue);
+typedef size_t (JIT_OPERATION *S_JITOperation_EGReoJ)(ExecState*, JSGlobalObject*, RegExpObject*, EncodedJSValue);
+typedef size_t (JIT_OPERATION *S_JITOperation_EGReoJss)(ExecState*, JSGlobalObject*, RegExpObject*, JSString*);
+typedef size_t (JIT_OPERATION *S_JITOperation_EJ)(ExecState*, EncodedJSValue);
+typedef size_t (JIT_OPERATION *S_JITOperation_EJI)(ExecState*, EncodedJSValue, UniquedStringImpl*);
+typedef size_t (JIT_OPERATION *S_JITOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
+typedef size_t (JIT_OPERATION *S_JITOperation_EOJss)(ExecState*, JSObject*, JSString*);
+typedef size_t (JIT_OPERATION *S_JITOperation_EReoJ)(ExecState*, RegExpObject*, EncodedJSValue);
+typedef size_t (JIT_OPERATION *S_JITOperation_EReoJss)(ExecState*, RegExpObject*, JSString*);
+typedef size_t (JIT_OPERATION *S_JITOperation_J)(EncodedJSValue);
+typedef SlowPathReturnType (JIT_OPERATION *Sprt_JITOperation_EZ)(ExecState*, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation)();
+typedef void (JIT_OPERATION *V_JITOperation_E)(ExecState*);
+typedef void (JIT_OPERATION *V_JITOperation_EC)(ExecState*, JSCell*);
+typedef void (JIT_OPERATION *V_JITOperation_ECb)(ExecState*, CodeBlock*);
+typedef void (JIT_OPERATION *V_JITOperation_ECC)(ExecState*, JSCell*, JSCell*);
+typedef void (JIT_OPERATION *V_JITOperation_ECIcf)(ExecState*, JSCell*, InlineCallFrame*);
+typedef void (JIT_OPERATION *V_JITOperation_ECIZC)(ExecState*, JSCell*, UniquedStringImpl*, int32_t, JSCell*);
+typedef void (JIT_OPERATION *V_JITOperation_ECIZCC)(ExecState*, JSCell*, UniquedStringImpl*, int32_t, JSCell*, JSCell*);
+typedef void (JIT_OPERATION *V_JITOperation_ECIZJJ)(ExecState*, JSCell*, UniquedStringImpl*, int32_t, EncodedJSValue, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_ECJZC)(ExecState*, JSCell*, EncodedJSValue, int32_t, JSCell*);
+typedef void (JIT_OPERATION *V_JITOperation_ECCIcf)(ExecState*, JSCell*, JSCell*, InlineCallFrame*);
+typedef void (JIT_OPERATION *V_JITOperation_ECJ)(ExecState*, JSCell*, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_ECJJ)(ExecState*, JSCell*, EncodedJSValue, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_ECPSPS)(ExecState*, JSCell*, void*, size_t, void*, size_t);
+typedef void (JIT_OPERATION *V_JITOperation_ECZ)(ExecState*, JSCell*, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_ECC)(ExecState*, JSCell*, JSCell*);
+typedef void (JIT_OPERATION *V_JITOperation_ECliJsf)(ExecState*, CallLinkInfo*, JSFunction*);
+typedef void (JIT_OPERATION *V_JITOperation_EZSymtabJ)(ExecState*, int32_t, SymbolTable*, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_EJ)(ExecState*, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_EJCI)(ExecState*, EncodedJSValue, JSCell*, UniquedStringImpl*);
+typedef void (JIT_OPERATION *V_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_EJJJAp)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*);
+typedef void (JIT_OPERATION *V_JITOperation_EJJJBy)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*);
+typedef void (JIT_OPERATION *V_JITOperation_EJPP)(ExecState*, EncodedJSValue, void*, void*);
+typedef void (JIT_OPERATION *V_JITOperation_EJZJ)(ExecState*, EncodedJSValue, int32_t, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_EJZ)(ExecState*, EncodedJSValue, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOZD)(ExecState*, JSObject*, int32_t, double);
+typedef void (JIT_OPERATION *V_JITOperation_EOZJ)(ExecState*, JSObject*, int32_t, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_EPc)(ExecState*, Instruction*);
+typedef void (JIT_OPERATION *V_JITOperation_EPZJ)(ExecState*, void*, int32_t, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_ESsiJJI)(ExecState*, StructureStubInfo*, EncodedJSValue, EncodedJSValue, UniquedStringImpl*);
+typedef void (JIT_OPERATION *V_JITOperation_EJJJI)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, UniquedStringImpl*);
+typedef void (JIT_OPERATION *V_JITOperation_EJJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_EOJJZ)(ExecState*, JSObject*, EncodedJSValue, EncodedJSValue, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOJssJZ)(ExecState*, JSObject*, JSString*, EncodedJSValue, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOIJZ)(ExecState*, JSObject*, UniquedStringImpl*, EncodedJSValue, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOSymJZ)(ExecState*, JSObject*, Symbol*, EncodedJSValue, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOJOOZ)(ExecState*, JSObject*, EncodedJSValue, JSObject*, JSObject*, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOJssOOZ)(ExecState*, JSObject*, JSString*, JSObject*, JSObject*, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOIOOZ)(ExecState*, JSObject*, UniquedStringImpl*, JSObject*, JSObject*, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOSymOOZ)(ExecState*, JSObject*, Symbol*, JSObject*, JSObject*, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EWs)(ExecState*, WatchpointSet*);
+typedef void (JIT_OPERATION *V_JITOperation_EZ)(ExecState*, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EZJ)(ExecState*, int32_t, EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_EZJZZZ)(ExecState*, int32_t, EncodedJSValue, int32_t, int32_t, int32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EVm)(ExecState*, VM*);
+typedef void (JIT_OPERATION *V_JITOperation_J)(EncodedJSValue);
+typedef void (JIT_OPERATION *V_JITOperation_Z)(int32_t);
+typedef JSCell* (JIT_OPERATION *C_JITOperation_ERUiUi)(ExecState*, Register*, uint32_t, uint32_t);
+typedef void (JIT_OPERATION *V_JITOperation_EOJIUi)(ExecState*, JSObject*, EncodedJSValue, UniquedStringImpl*, uint32_t);
+typedef char* (JIT_OPERATION *P_JITOperation_E)(ExecState*);
+typedef char* (JIT_OPERATION *P_JITOperation_EC)(ExecState*, JSCell*);
+typedef char* (JIT_OPERATION *P_JITOperation_ECli)(ExecState*, CallLinkInfo*);
+typedef char* (JIT_OPERATION *P_JITOperation_EJS)(ExecState*, EncodedJSValue, size_t);
+typedef char* (JIT_OPERATION *P_JITOperation_EO)(ExecState*, JSObject*);
+typedef char* (JIT_OPERATION *P_JITOperation_EOS)(ExecState*, JSObject*, size_t);
+typedef char* (JIT_OPERATION *P_JITOperation_EOZ)(ExecState*, JSObject*, int32_t);
+typedef char* (JIT_OPERATION *P_JITOperation_EPS)(ExecState*, void*, size_t);
+typedef char* (JIT_OPERATION *P_JITOperation_ES)(ExecState*, size_t);
+typedef char* (JIT_OPERATION *P_JITOperation_ESJss)(ExecState*, size_t, JSString*);
+typedef char* (JIT_OPERATION *P_JITOperation_ESt)(ExecState*, Structure*);
+typedef char* (JIT_OPERATION *P_JITOperation_EStJ)(ExecState*, Structure*, EncodedJSValue);
+typedef char* (JIT_OPERATION *P_JITOperation_EStPS)(ExecState*, Structure*, void*, size_t);
+typedef char* (JIT_OPERATION *P_JITOperation_EStSS)(ExecState*, Structure*, size_t, size_t);
+typedef char* (JIT_OPERATION *P_JITOperation_EStZ)(ExecState*, Structure*, int32_t);
+typedef char* (JIT_OPERATION *P_JITOperation_EStZB)(ExecState*, Structure*, int32_t, Butterfly*);
+typedef char* (JIT_OPERATION *P_JITOperation_EStZP)(ExecState*, Structure*, int32_t, char*);
+typedef char* (JIT_OPERATION *P_JITOperation_EZZ)(ExecState*, int32_t, int32_t);
+typedef SlowPathReturnType (JIT_OPERATION *Sprt_JITOperation_ECli)(ExecState*, CallLinkInfo*);
+typedef StringImpl* (JIT_OPERATION *T_JITOperation_EJss)(ExecState*, JSString*);
+typedef JSString* (JIT_OPERATION *Jss_JITOperation_EZ)(ExecState*, int32_t);
+typedef JSString* (JIT_OPERATION *Jss_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
+typedef JSString* (JIT_OPERATION *Jss_JITOperation_EJssUi)(ExecState*, JSString*, uint32_t);
+
+// This method is used to lookup an exception hander, keyed by faultLocation, which is
+// the return location from one of the calls out to one of the helper operations above.
+
+void JIT_OPERATION lookupExceptionHandler(VM*, ExecState*) WTF_INTERNAL;
+void JIT_OPERATION lookupExceptionHandlerFromCallerFrame(VM*, ExecState*) WTF_INTERNAL;
+void JIT_OPERATION operationVMHandleException(ExecState*) WTF_INTERNAL;
+
+void JIT_OPERATION operationThrowStackOverflowError(ExecState*, CodeBlock*) WTF_INTERNAL;
+#if ENABLE(WEBASSEMBLY)
+void JIT_OPERATION operationThrowDivideError(ExecState*) WTF_INTERNAL;
+void JIT_OPERATION operationThrowOutOfBoundsAccessError(ExecState*) WTF_INTERNAL;
+#endif
+int32_t JIT_OPERATION operationCallArityCheck(ExecState*) WTF_INTERNAL;
+int32_t JIT_OPERATION operationConstructArityCheck(ExecState*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationTryGetById(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationTryGetByIdGeneric(ExecState*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationTryGetByIdOptimize(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetById(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByIdGeneric(ExecState*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByIdOptimize(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationInOptimize(ExecState*, StructureStubInfo*, JSCell*, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationIn(ExecState*, StructureStubInfo*, JSCell*, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGenericIn(ExecState*, JSCell*, EncodedJSValue) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdStrict(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdNonStrict(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdDirectStrict(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdDirectNonStrict(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdStrictOptimize(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdNonStrictOptimize(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdDirectStrictOptimize(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdDirectNonStrictOptimize(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdStrictBuildList(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdNonStrictBuildList(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdDirectStrictBuildList(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByIdDirectNonStrictBuildList(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValOptimize(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
+void JIT_OPERATION operationDirectPutByValOptimize(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
+void JIT_OPERATION operationDirectPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationCallEval(ExecState*, ExecState*) WTF_INTERNAL;
+SlowPathReturnType JIT_OPERATION operationLinkCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+void JIT_OPERATION operationLinkDirectCall(ExecState*, CallLinkInfo*, JSFunction*) WTF_INTERNAL;
+SlowPathReturnType JIT_OPERATION operationLinkPolymorphicCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+SlowPathReturnType JIT_OPERATION operationVirtualCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
+
+size_t JIT_OPERATION operationCompareLess(ExecState*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+size_t JIT_OPERATION operationCompareLessEq(ExecState*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+size_t JIT_OPERATION operationCompareGreater(ExecState*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+size_t JIT_OPERATION operationCompareGreaterEq(ExecState*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+size_t JIT_OPERATION operationCompareEq(ExecState*, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+#if USE(JSVALUE64)
+EncodedJSValue JIT_OPERATION operationCompareStringEq(ExecState*, JSCell* left, JSCell* right) WTF_INTERNAL;
+#else
+size_t JIT_OPERATION operationCompareStringEq(ExecState*, JSCell* left, JSCell* right) WTF_INTERNAL;
+#endif
+EncodedJSValue JIT_OPERATION operationNewArrayWithProfile(ExecState*, ArrayAllocationProfile*, const JSValue* values, int32_t size) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewArrayBufferWithProfile(ExecState*, ArrayAllocationProfile*, const JSValue* values, int32_t size) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewArrayWithSizeAndProfile(ExecState*, ArrayAllocationProfile*, EncodedJSValue size) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewFunction(ExecState*, JSScope*, JSCell*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewFunctionWithInvalidatedReallocationWatchpoint(ExecState*, JSScope*, JSCell*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewGeneratorFunction(ExecState*, JSScope*, JSCell*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint(ExecState*, JSScope*, JSCell*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewAsyncFunction(ExecState*, JSScope*, JSCell*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint(ExecState*, JSScope*, JSCell*) WTF_INTERNAL;
+void JIT_OPERATION operationSetFunctionName(ExecState*, JSCell*, EncodedJSValue) WTF_INTERNAL;
+JSCell* JIT_OPERATION operationNewObject(ExecState*, Structure*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationNewRegexp(ExecState*, void*) WTF_INTERNAL;
+UnusedPtr JIT_OPERATION operationHandleWatchdogTimer(ExecState*) WTF_INTERNAL;
+void JIT_OPERATION operationThrow(ExecState*, EncodedJSValue) WTF_INTERNAL;
+void JIT_OPERATION operationDebug(ExecState*, int32_t) WTF_INTERNAL;
+#if ENABLE(DFG_JIT)
+SlowPathReturnType JIT_OPERATION operationOptimize(ExecState*, int32_t) WTF_INTERNAL;
+#endif
+void JIT_OPERATION operationPutByIndex(ExecState*, EncodedJSValue, int32_t, EncodedJSValue);
+void JIT_OPERATION operationPutGetterById(ExecState*, JSCell*, UniquedStringImpl*, int32_t options, JSCell*) WTF_INTERNAL;
+void JIT_OPERATION operationPutSetterById(ExecState*, JSCell*, UniquedStringImpl*, int32_t options, JSCell*) WTF_INTERNAL;
+void JIT_OPERATION operationPutGetterByVal(ExecState*, JSCell*, EncodedJSValue, int32_t attribute, JSCell*) WTF_INTERNAL;
+void JIT_OPERATION operationPutSetterByVal(ExecState*, JSCell*, EncodedJSValue, int32_t attribute, JSCell*) WTF_INTERNAL;
+#if USE(JSVALUE64)
+void JIT_OPERATION operationPutGetterSetter(ExecState*, JSCell*, UniquedStringImpl*, int32_t attribute, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
+#else
+void JIT_OPERATION operationPutGetterSetter(ExecState*, JSCell*, UniquedStringImpl*, int32_t attribute, JSCell*, JSCell*) WTF_INTERNAL;
+#endif
+void JIT_OPERATION operationPushFunctionNameScope(ExecState*, int32_t, SymbolTable*, EncodedJSValue) WTF_INTERNAL;
+void JIT_OPERATION operationPopScope(ExecState*, int32_t) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValString(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationDeleteByIdJSResult(ExecState*, EncodedJSValue base, UniquedStringImpl*) WTF_INTERNAL;
+size_t JIT_OPERATION operationDeleteById(ExecState*, EncodedJSValue base, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationDeleteByValJSResult(ExecState*, EncodedJSValue base, EncodedJSValue target) WTF_INTERNAL;
+size_t JIT_OPERATION operationDeleteByVal(ExecState*, EncodedJSValue base, EncodedJSValue target) WTF_INTERNAL;
+JSCell* JIT_OPERATION operationGetPNames(ExecState*, JSObject*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationInstanceOf(ExecState*, EncodedJSValue, EncodedJSValue proto) WTF_INTERNAL;
+int32_t JIT_OPERATION operationSizeFrameForForwardArguments(ExecState*, EncodedJSValue arguments, int32_t numUsedStackSlots, int32_t firstVarArgOffset) WTF_INTERNAL;
+int32_t JIT_OPERATION operationSizeFrameForVarargs(ExecState*, EncodedJSValue arguments, int32_t numUsedStackSlots, int32_t firstVarArgOffset) WTF_INTERNAL;
+CallFrame* JIT_OPERATION operationSetupForwardArgumentsFrame(ExecState*, CallFrame*, EncodedJSValue, int32_t, int32_t length) WTF_INTERNAL;
+CallFrame* JIT_OPERATION operationSetupVarargsFrame(ExecState*, CallFrame*, EncodedJSValue arguments, int32_t firstVarArgOffset, int32_t length) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationToObject(ExecState*, EncodedJSValue) WTF_INTERNAL;
+
+char* JIT_OPERATION operationSwitchCharWithUnknownKeyType(ExecState*, EncodedJSValue key, size_t tableIndex) WTF_INTERNAL;
+char* JIT_OPERATION operationSwitchImmWithUnknownKeyType(ExecState*, EncodedJSValue key, size_t tableIndex) WTF_INTERNAL;
+char* JIT_OPERATION operationSwitchStringWithUnknownKeyType(ExecState*, EncodedJSValue key, size_t tableIndex) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetFromScope(ExecState*, Instruction* bytecodePC) WTF_INTERNAL;
+void JIT_OPERATION operationPutToScope(ExecState*, Instruction* bytecodePC) WTF_INTERNAL;
+
+char* JIT_OPERATION operationReallocateButterflyToHavePropertyStorageWithInitialCapacity(ExecState*, JSObject*) WTF_INTERNAL;
+char* JIT_OPERATION operationReallocateButterflyToGrowPropertyStorage(ExecState*, JSObject*, size_t newSize) WTF_INTERNAL;
+
+void JIT_OPERATION operationWriteBarrierSlowPath(ExecState*, JSCell*);
+void JIT_OPERATION operationOSRWriteBarrier(ExecState*, JSCell*);
+
+void JIT_OPERATION operationExceptionFuzz(ExecState*);
+
+int32_t JIT_OPERATION operationCheckIfExceptionIsUncatchableAndNotifyProfiler(ExecState*);
+int32_t JIT_OPERATION operationInstanceOfCustom(ExecState*, EncodedJSValue encodedValue, JSObject* constructor, EncodedJSValue encodedHasInstance) WTF_INTERNAL;
+
+EncodedJSValue JIT_OPERATION operationHasGenericProperty(ExecState*, EncodedJSValue, JSCell*);
+EncodedJSValue JIT_OPERATION operationHasIndexedProperty(ExecState*, JSCell*, int32_t);
+JSCell* JIT_OPERATION operationGetPropertyEnumerator(ExecState*, JSCell*);
+EncodedJSValue JIT_OPERATION operationNextEnumeratorPname(ExecState*, JSCell*, int32_t);
+JSCell* JIT_OPERATION operationToIndexString(ExecState*, int32_t);
+
+EncodedJSValue JIT_OPERATION operationValueAdd(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueAddProfiled(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueAddProfiledOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueAddProfiledNoOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueAddOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueAddNoOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueMul(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueMulOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueMulNoOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueMulProfiledOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueMulProfiledNoOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueMulProfiled(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationArithNegate(ExecState*, EncodedJSValue operand);
+EncodedJSValue JIT_OPERATION operationArithNegateProfiled(ExecState*, EncodedJSValue operand, ArithProfile*);
+EncodedJSValue JIT_OPERATION operationArithNegateProfiledOptimize(ExecState*, EncodedJSValue encodedOperand, JITNegIC*);
+EncodedJSValue JIT_OPERATION operationArithNegateOptimize(ExecState*, EncodedJSValue encodedOperand, JITNegIC*);
+EncodedJSValue JIT_OPERATION operationValueSub(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueSubProfiled(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueSubOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueSubNoOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueSubProfiledOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationValueSubProfiledNoOptimize(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC*) WTF_INTERNAL;
+
+void JIT_OPERATION operationProcessTypeProfilerLog(ExecState*) WTF_INTERNAL;
+void JIT_OPERATION operationProcessShadowChickenLog(ExecState*) WTF_INTERNAL;
+
+} // extern "C"
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITOperationsMSVC64.cpp b/jit/JITOperationsMSVC64.cpp
new file mode 100644
index 0000000..544bca3
--- /dev/null
+++ b/jit/JITOperationsMSVC64.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if !ENABLE(JIT) && COMPILER(MSVC) && CPU(X86_64)
+
+#include "CallFrame.h"
+#include "JSCJSValue.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+// FIXME: The following is a workaround that is only needed because JITStubsMSVC64.asm
+// is built unconditionally even when the JIT is disable, and it references this function.
+// We only need to provide a stub to satisfy the linkage. It will never be called.
+extern "C" EncodedJSValue getHostCallReturnValueWithExecState(ExecState*)
+{
+    return JSValue::encode(JSValue());
+}
+
+} // namespace JSC
+
+#endif // !ENABLE(JIT) && COMPILER(MSVC) && CPU(X86_64)
diff --git a/jit/JITPropertyAccess.cpp b/jit/JITPropertyAccess.cpp
new file mode 100644
index 0000000..7ea1e20
--- /dev/null
+++ b/jit/JITPropertyAccess.cpp
@@ -0,0 +1,1787 @@
+/*
+ * Copyright (C) 2008, 2009, 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+#include "JIT.h"
+
+#include "CodeBlock.h"
+#include "DirectArguments.h"
+#include "GCAwareJITStubRoutine.h"
+#include "GetterSetter.h"
+#include "Interpreter.h"
+#include "JITInlines.h"
+#include "JSArray.h"
+#include "JSEnvironmentRecord.h"
+#include "JSFunction.h"
+#include "LinkBuffer.h"
+#include "ResultType.h"
+#include "ScopedArguments.h"
+#include "ScopedArgumentsTable.h"
+#include "SlowPathCall.h"
+#include "StructureStubInfo.h"
+#include <wtf/StringPrintStream.h>
+
+
+namespace JSC {
+#if USE(JSVALUE64)
+
+JIT::CodeRef JIT::stringGetByValStubGenerator(VM* vm)
+{
+    JSInterfaceJIT jit(vm);
+    JumpList failures;
+    failures.append(jit.branchStructure(
+        NotEqual, 
+        Address(regT0, JSCell::structureIDOffset()), 
+        vm->stringStructure.get()));
+
+    // Load string length to regT2, and start the process of loading the data pointer into regT0
+    jit.load32(Address(regT0, ThunkHelpers::jsStringLengthOffset()), regT2);
+    jit.loadPtr(Address(regT0, ThunkHelpers::jsStringValueOffset()), regT0);
+    failures.append(jit.branchTest32(Zero, regT0));
+
+    // Do an unsigned compare to simultaneously filter negative indices as well as indices that are too large
+    failures.append(jit.branch32(AboveOrEqual, regT1, regT2));
+    
+    // Load the character
+    JumpList is16Bit;
+    JumpList cont8Bit;
+    // Load the string flags
+    jit.loadPtr(Address(regT0, StringImpl::flagsOffset()), regT2);
+    jit.loadPtr(Address(regT0, StringImpl::dataOffset()), regT0);
+    is16Bit.append(jit.branchTest32(Zero, regT2, TrustedImm32(StringImpl::flagIs8Bit())));
+    jit.load8(BaseIndex(regT0, regT1, TimesOne, 0), regT0);
+    cont8Bit.append(jit.jump());
+    is16Bit.link(&jit);
+    jit.load16(BaseIndex(regT0, regT1, TimesTwo, 0), regT0);
+    cont8Bit.link(&jit);
+
+    failures.append(jit.branch32(AboveOrEqual, regT0, TrustedImm32(0x100)));
+    jit.move(TrustedImmPtr(vm->smallStrings.singleCharacterStrings()), regT1);
+    jit.loadPtr(BaseIndex(regT1, regT0, ScalePtr, 0), regT0);
+    jit.ret();
+    
+    failures.link(&jit);
+    jit.move(TrustedImm32(0), regT0);
+    jit.ret();
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("String get_by_val stub"));
+}
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ByValInfo* byValInfo = m_codeBlock->addByValInfo();
+
+    emitGetVirtualRegister(base, regT0);
+    bool propertyNameIsIntegerConstant = isOperandConstantInt(property);
+    if (propertyNameIsIntegerConstant)
+        move(Imm32(getOperandConstantInt(property)), regT1);
+    else
+        emitGetVirtualRegister(property, regT1);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
+
+    PatchableJump notIndex;
+    if (!propertyNameIsIntegerConstant) {
+        notIndex = emitPatchableJumpIfNotInt(regT1);
+        addSlowCase(notIndex);
+
+        // This is technically incorrect - we're zero-extending an int32. On the hot path this doesn't matter.
+        // We check the value as if it was a uint32 against the m_vectorLength - which will always fail if
+        // number was signed since m_vectorLength is always less than intmax (since the total allocation
+        // size is always less than 4Gb). As such zero extending will have been correct (and extending the value
+        // to 64-bits is necessary since it's used in the address calculation). We zero extend rather than sign
+        // extending since it makes it easier to re-tag the value in the slow case.
+        zeroExtend32ToPtr(regT1, regT1);
+    }
+
+    emitArrayProfilingSiteWithCell(regT0, regT2, profile);
+    and32(TrustedImm32(IndexingShapeMask), regT2);
+
+    PatchableJump badType;
+    JumpList slowCases;
+
+    JITArrayMode mode = chooseArrayMode(profile);
+    switch (mode) {
+    case JITInt32:
+        slowCases = emitInt32GetByVal(currentInstruction, badType);
+        break;
+    case JITDouble:
+        slowCases = emitDoubleGetByVal(currentInstruction, badType);
+        break;
+    case JITContiguous:
+        slowCases = emitContiguousGetByVal(currentInstruction, badType);
+        break;
+    case JITArrayStorage:
+        slowCases = emitArrayStorageGetByVal(currentInstruction, badType);
+        break;
+    default:
+        CRASH();
+        break;
+    }
+    
+    addSlowCase(badType);
+    addSlowCase(slowCases);
+    
+    Label done = label();
+    
+    if (!ASSERT_DISABLED) {
+        Jump resultOK = branchTest64(NonZero, regT0);
+        abortWithReason(JITGetByValResultIsNotEmpty);
+        resultOK.link(this);
+    }
+
+    emitValueProfilingSite();
+    emitPutVirtualRegister(dst);
+
+    Label nextHotPath = label();
+
+    m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, notIndex, badType, mode, profile, done, nextHotPath));
+}
+
+JIT::JumpList JIT::emitDoubleLoad(Instruction*, PatchableJump& badType)
+{
+    JumpList slowCases;
+    
+    badType = patchableBranch32(NotEqual, regT2, TrustedImm32(DoubleShape));
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
+    slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())));
+    loadDouble(BaseIndex(regT2, regT1, TimesEight), fpRegT0);
+    slowCases.append(branchDouble(DoubleNotEqualOrUnordered, fpRegT0, fpRegT0));
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitContiguousLoad(Instruction*, PatchableJump& badType, IndexingType expectedShape)
+{
+    JumpList slowCases;
+    
+    badType = patchableBranch32(NotEqual, regT2, TrustedImm32(expectedShape));
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
+    slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())));
+    load64(BaseIndex(regT2, regT1, TimesEight), regT0);
+    slowCases.append(branchTest64(Zero, regT0));
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitArrayStorageLoad(Instruction*, PatchableJump& badType)
+{
+    JumpList slowCases;
+
+    add32(TrustedImm32(-ArrayStorageShape), regT2, regT3);
+    badType = patchableBranch32(Above, regT3, TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape));
+
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
+    slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset())));
+
+    load64(BaseIndex(regT2, regT1, TimesEight, ArrayStorage::vectorOffset()), regT0);
+    slowCases.append(branchTest64(Zero, regT0));
+    
+    return slowCases;
+}
+
+JITGetByIdGenerator JIT::emitGetByValWithCachedId(ByValInfo* byValInfo, Instruction* currentInstruction, const Identifier& propertyName, Jump& fastDoneCase, Jump& slowDoneCase, JumpList& slowCases)
+{
+    // base: regT0
+    // property: regT1
+    // scratch: regT3
+
+    int dst = currentInstruction[1].u.operand;
+
+    slowCases.append(emitJumpIfNotJSCell(regT1));
+    emitByValIdentifierCheck(byValInfo, regT1, regT3, propertyName, slowCases);
+
+    JITGetByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(m_bytecodeOffset), RegisterSet::stubUnavailableRegisters(),
+        propertyName.impl(), JSValueRegs(regT0), JSValueRegs(regT0), AccessType::Get);
+    gen.generateFastPath(*this);
+
+    fastDoneCase = jump();
+
+    Label coldPathBegin = label();
+    gen.slowPathJump().link(this);
+
+    Call call = callOperation(WithProfile, operationGetByIdOptimize, dst, gen.stubInfo(), regT0, propertyName.impl());
+    gen.reportSlowPathCall(coldPathBegin, call);
+    slowDoneCase = jump();
+
+    return gen;
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
+    
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+
+    if (!isOperandConstantInt(property))
+        linkSlowCase(iter); // property int32 check
+    Jump nonCell = jump();
+    linkSlowCase(iter); // base array check
+    Jump notString = branchStructure(NotEqual, 
+        Address(regT0, JSCell::structureIDOffset()), 
+        m_vm->stringStructure.get());
+    emitNakedCall(CodeLocationLabel(m_vm->getCTIStub(stringGetByValStubGenerator).code()));
+    Jump failed = branchTest64(Zero, regT0);
+    emitPutVirtualRegister(dst, regT0);
+    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
+    failed.link(this);
+    notString.link(this);
+    nonCell.link(this);
+    
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
+    
+    Label slowPath = label();
+    
+    emitGetVirtualRegister(base, regT0);
+    emitGetVirtualRegister(property, regT1);
+    Call call = callOperation(operationGetByValOptimize, dst, regT0, regT1, byValInfo);
+
+    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
+    m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
+    m_byValInstructionIndex++;
+
+    emitValueProfilingSite();
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ByValInfo* byValInfo = m_codeBlock->addByValInfo();
+
+    emitGetVirtualRegister(base, regT0);
+    bool propertyNameIsIntegerConstant = isOperandConstantInt(property);
+    if (propertyNameIsIntegerConstant)
+        move(Imm32(getOperandConstantInt(property)), regT1);
+    else
+        emitGetVirtualRegister(property, regT1);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
+    PatchableJump notIndex;
+    if (!propertyNameIsIntegerConstant) {
+        notIndex = emitPatchableJumpIfNotInt(regT1);
+        addSlowCase(notIndex);
+        // See comment in op_get_by_val.
+        zeroExtend32ToPtr(regT1, regT1);
+    }
+    emitArrayProfilingSiteWithCell(regT0, regT2, profile);
+    and32(TrustedImm32(IndexingShapeMask), regT2);
+    
+    PatchableJump badType;
+    JumpList slowCases;
+    
+    JITArrayMode mode = chooseArrayMode(profile);
+    switch (mode) {
+    case JITInt32:
+        slowCases = emitInt32PutByVal(currentInstruction, badType);
+        break;
+    case JITDouble:
+        slowCases = emitDoublePutByVal(currentInstruction, badType);
+        break;
+    case JITContiguous:
+        slowCases = emitContiguousPutByVal(currentInstruction, badType);
+        break;
+    case JITArrayStorage:
+        slowCases = emitArrayStoragePutByVal(currentInstruction, badType);
+        break;
+    default:
+        CRASH();
+        break;
+    }
+    
+    addSlowCase(badType);
+    addSlowCase(slowCases);
+    
+    Label done = label();
+    
+    m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, notIndex, badType, mode, profile, done, done));
+}
+
+void JIT::emit_op_put_by_val_with_this(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_put_by_val_with_this);
+    slowPathCall.call();
+}
+
+JIT::JumpList JIT::emitGenericContiguousPutByVal(Instruction* currentInstruction, PatchableJump& badType, IndexingType indexingShape)
+{
+    int value = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    
+    JumpList slowCases;
+
+    badType = patchableBranch32(NotEqual, regT2, TrustedImm32(indexingShape));
+    
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
+    Jump outOfBounds = branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength()));
+
+    Label storeResult = label();
+    emitGetVirtualRegister(value, regT3);
+    switch (indexingShape) {
+    case Int32Shape:
+        slowCases.append(emitJumpIfNotInt(regT3));
+        store64(regT3, BaseIndex(regT2, regT1, TimesEight));
+        break;
+    case DoubleShape: {
+        Jump notInt = emitJumpIfNotInt(regT3);
+        convertInt32ToDouble(regT3, fpRegT0);
+        Jump ready = jump();
+        notInt.link(this);
+        add64(tagTypeNumberRegister, regT3);
+        move64ToDouble(regT3, fpRegT0);
+        slowCases.append(branchDouble(DoubleNotEqualOrUnordered, fpRegT0, fpRegT0));
+        ready.link(this);
+        storeDouble(fpRegT0, BaseIndex(regT2, regT1, TimesEight));
+        break;
+    }
+    case ContiguousShape:
+        store64(regT3, BaseIndex(regT2, regT1, TimesEight));
+        emitWriteBarrier(currentInstruction[1].u.operand, value, ShouldFilterValue);
+        break;
+    default:
+        CRASH();
+        break;
+    }
+    
+    Jump done = jump();
+    outOfBounds.link(this);
+    
+    slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfVectorLength())));
+    
+    emitArrayProfileStoreToHoleSpecialCase(profile);
+    
+    add32(TrustedImm32(1), regT1, regT3);
+    store32(regT3, Address(regT2, Butterfly::offsetOfPublicLength()));
+    jump().linkTo(storeResult, this);
+    
+    done.link(this);
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitArrayStoragePutByVal(Instruction* currentInstruction, PatchableJump& badType)
+{
+    int value = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    
+    JumpList slowCases;
+    
+    badType = patchableBranch32(NotEqual, regT2, TrustedImm32(ArrayStorageShape));
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
+    slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset())));
+
+    Jump empty = branchTest64(Zero, BaseIndex(regT2, regT1, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+
+    Label storeResult(this);
+    emitGetVirtualRegister(value, regT3);
+    store64(regT3, BaseIndex(regT2, regT1, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+    emitWriteBarrier(currentInstruction[1].u.operand, value, ShouldFilterValue);
+    Jump end = jump();
+    
+    empty.link(this);
+    emitArrayProfileStoreToHoleSpecialCase(profile);
+    add32(TrustedImm32(1), Address(regT2, ArrayStorage::numValuesInVectorOffset()));
+    branch32(Below, regT1, Address(regT2, ArrayStorage::lengthOffset())).linkTo(storeResult, this);
+
+    add32(TrustedImm32(1), regT1);
+    store32(regT1, Address(regT2, ArrayStorage::lengthOffset()));
+    sub32(TrustedImm32(1), regT1);
+    jump().linkTo(storeResult, this);
+
+    end.link(this);
+    
+    return slowCases;
+}
+
+JITPutByIdGenerator JIT::emitPutByValWithCachedId(ByValInfo* byValInfo, Instruction* currentInstruction, PutKind putKind, const Identifier& propertyName, JumpList& doneCases, JumpList& slowCases)
+{
+    // base: regT0
+    // property: regT1
+    // scratch: regT2
+
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+
+    slowCases.append(emitJumpIfNotJSCell(regT1));
+    emitByValIdentifierCheck(byValInfo, regT1, regT1, propertyName, slowCases);
+
+    // Write barrier breaks the registers. So after issuing the write barrier,
+    // reload the registers.
+    emitGetVirtualRegisters(base, regT0, value, regT1);
+
+    JITPutByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(m_bytecodeOffset), RegisterSet::stubUnavailableRegisters(),
+        JSValueRegs(regT0), JSValueRegs(regT1), regT2, m_codeBlock->ecmaMode(), putKind);
+    gen.generateFastPath(*this);
+    emitWriteBarrier(base, value, ShouldFilterBase);
+    doneCases.append(jump());
+
+    Label coldPathBegin = label();
+    gen.slowPathJump().link(this);
+
+    Call call = callOperation(gen.slowPathFunction(), gen.stubInfo(), regT1, regT0, propertyName.impl());
+    gen.reportSlowPathCall(coldPathBegin, call);
+    doneCases.append(jump());
+
+    return gen;
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+    JITArrayMode mode = m_byValCompilationInfo[m_byValInstructionIndex].arrayMode;
+    ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
+
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    if (!isOperandConstantInt(property))
+        linkSlowCase(iter); // property int32 check
+    linkSlowCase(iter); // base not array check
+    
+    linkSlowCase(iter); // out of bounds
+    
+    switch (mode) {
+    case JITInt32:
+    case JITDouble:
+        linkSlowCase(iter); // value type check
+        break;
+    default:
+        break;
+    }
+    
+    Label slowPath = label();
+
+    emitGetVirtualRegister(base, regT0);
+    emitGetVirtualRegister(property, regT1);
+    emitGetVirtualRegister(value, regT2);
+    bool isDirect = m_interpreter->getOpcodeID(currentInstruction->u.opcode) == op_put_by_val_direct;
+    Call call = callOperation(isDirect ? operationDirectPutByValOptimize : operationPutByValOptimize, regT0, regT1, regT2, byValInfo);
+
+    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
+    m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
+    m_byValInstructionIndex++;
+}
+
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT1);
+    callOperation(operationPutByIndex, regT0, currentInstruction[2].u.operand, regT1);
+}
+
+void JIT::emit_op_put_getter_by_id(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    int32_t options = currentInstruction[3].u.operand;
+    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
+    callOperation(operationPutGetterById, regT0, m_codeBlock->identifier(currentInstruction[2].u.operand).impl(), options, regT1);
+}
+
+void JIT::emit_op_put_setter_by_id(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    int32_t options = currentInstruction[3].u.operand;
+    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
+    callOperation(operationPutSetterById, regT0, m_codeBlock->identifier(currentInstruction[2].u.operand).impl(), options, regT1);
+}
+
+void JIT::emit_op_put_getter_setter_by_id(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    int32_t attribute = currentInstruction[3].u.operand;
+    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
+    emitGetVirtualRegister(currentInstruction[5].u.operand, regT2);
+    callOperation(operationPutGetterSetter, regT0, m_codeBlock->identifier(currentInstruction[2].u.operand).impl(), attribute, regT1, regT2);
+}
+
+void JIT::emit_op_put_getter_by_val(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT1);
+    int32_t attributes = currentInstruction[3].u.operand;
+    emitGetVirtualRegister(currentInstruction[4].u.operand, regT2);
+    callOperation(operationPutGetterByVal, regT0, regT1, attributes, regT2);
+}
+
+void JIT::emit_op_put_setter_by_val(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT1);
+    int32_t attributes = currentInstruction[3].u.operand;
+    emitGetVirtualRegister(currentInstruction[4].u.operand, regT2);
+    callOperation(operationPutSetterByVal, regT0, regT1, attributes, regT2);
+}
+
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    emitGetVirtualRegister(base, regT0);
+    callOperation(operationDeleteByIdJSResult, dst, regT0, m_codeBlock->identifier(property).impl());
+}
+
+void JIT::emit_op_del_by_val(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    emitGetVirtualRegister(base, regT0);
+    emitGetVirtualRegister(property, regT1);
+    callOperation(operationDeleteByValJSResult, dst, regT0, regT1);
+}
+
+void JIT::emit_op_try_get_by_id(Instruction* currentInstruction)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
+
+    JITGetByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(m_bytecodeOffset), RegisterSet::stubUnavailableRegisters(),
+        ident->impl(), JSValueRegs(regT0), JSValueRegs(regT0), AccessType::GetPure);
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    m_getByIds.append(gen);
+    
+    emitValueProfilingSite();
+    emitPutVirtualRegister(resultVReg);
+}
+
+void JIT::emitSlow_op_try_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    linkSlowCaseIfNotJSCell(iter, baseVReg);
+    linkSlowCase(iter);
+
+    JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];
+
+    Label coldPathBegin = label();
+
+    Call call = callOperation(operationTryGetByIdOptimize, resultVReg, gen.stubInfo(), regT0, ident->impl());
+    
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+    
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
+    
+    if (*ident == m_vm->propertyNames->length && shouldEmitProfiling())
+        emitArrayProfilingSiteForBytecodeIndexWithCell(regT0, regT1, m_bytecodeOffset);
+
+    JITGetByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(m_bytecodeOffset), RegisterSet::stubUnavailableRegisters(),
+        ident->impl(), JSValueRegs(regT0), JSValueRegs(regT0), AccessType::Get);
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    m_getByIds.append(gen);
+
+    emitValueProfilingSite();
+    emitPutVirtualRegister(resultVReg);
+}
+
+void JIT::emit_op_get_by_id_with_this(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_by_id_with_this);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_get_by_val_with_this(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_by_val_with_this);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    linkSlowCaseIfNotJSCell(iter, baseVReg);
+    linkSlowCase(iter);
+
+    JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];
+    
+    Label coldPathBegin = label();
+    
+    Call call = callOperation(WithProfile, operationGetByIdOptimize, resultVReg, gen.stubInfo(), regT0, ident->impl());
+
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    int baseVReg = currentInstruction[1].u.operand;
+    int valueVReg = currentInstruction[3].u.operand;
+    unsigned direct = currentInstruction[8].u.putByIdFlags & PutByIdIsDirect;
+
+    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
+    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
+    // such that the Structure & offset are always at the same distance from this.
+
+    emitGetVirtualRegisters(baseVReg, regT0, valueVReg, regT1);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
+
+    JITPutByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(m_bytecodeOffset), RegisterSet::stubUnavailableRegisters(),
+        JSValueRegs(regT0), JSValueRegs(regT1), regT2, m_codeBlock->ecmaMode(),
+        direct ? Direct : NotDirect);
+    
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    
+    emitWriteBarrier(baseVReg, valueVReg, ShouldFilterBase);
+
+    m_putByIds.append(gen);
+}
+
+void JIT::emit_op_put_by_id_with_this(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_put_by_id_with_this);
+    slowPathCall.call();
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int baseVReg = currentInstruction[1].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
+
+    linkSlowCaseIfNotJSCell(iter, baseVReg);
+    linkSlowCase(iter);
+
+    Label coldPathBegin(this);
+    
+    JITPutByIdGenerator& gen = m_putByIds[m_putByIdIndex++];
+
+    Call call = callOperation(
+        gen.slowPathFunction(), gen.stubInfo(), regT1, regT0, ident->impl());
+
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+void JIT::emitVarInjectionCheck(bool needsVarInjectionChecks)
+{
+    if (!needsVarInjectionChecks)
+        return;
+    addSlowCase(branch8(Equal, AbsoluteAddress(m_codeBlock->globalObject()->varInjectionWatchpoint()->addressOfState()), TrustedImm32(IsInvalidated)));
+}
+
+void JIT::emitResolveClosure(int dst, int scope, bool needsVarInjectionChecks, unsigned depth)
+{
+    emitVarInjectionCheck(needsVarInjectionChecks);
+    emitGetVirtualRegister(scope, regT0);
+    for (unsigned i = 0; i < depth; ++i)
+        loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_resolve_scope(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int scope = currentInstruction[2].u.operand;
+    ResolveType resolveType = static_cast<ResolveType>(copiedInstruction(currentInstruction)[4].u.operand);
+    unsigned depth = currentInstruction[5].u.operand;
+
+    auto emitCode = [&] (ResolveType resolveType) {
+        switch (resolveType) {
+        case GlobalProperty:
+        case GlobalVar:
+        case GlobalPropertyWithVarInjectionChecks:
+        case GlobalVarWithVarInjectionChecks:
+        case GlobalLexicalVar:
+        case GlobalLexicalVarWithVarInjectionChecks: {
+            JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
+            RELEASE_ASSERT(constantScope);
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            move(TrustedImmPtr(constantScope), regT0);
+            emitPutVirtualRegister(dst);
+            break;
+        }
+        case ClosureVar:
+        case ClosureVarWithVarInjectionChecks:
+            emitResolveClosure(dst, scope, needsVarInjectionChecks(resolveType), depth);
+            break;
+        case ModuleVar:
+            move(TrustedImmPtr(currentInstruction[6].u.jsCell.get()), regT0);
+            emitPutVirtualRegister(dst);
+            break;
+        case Dynamic:
+            addSlowCase(jump());
+            break;
+        case LocalClosureVar:
+        case UnresolvedProperty:
+        case UnresolvedPropertyWithVarInjectionChecks:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    };
+
+    switch (resolveType) {
+    case UnresolvedProperty:
+    case UnresolvedPropertyWithVarInjectionChecks: {
+        JumpList skipToEnd;
+        load32(&currentInstruction[4], regT0);
+
+        Jump notGlobalProperty = branch32(NotEqual, regT0, TrustedImm32(GlobalProperty));
+        emitCode(GlobalProperty);
+        skipToEnd.append(jump());
+        notGlobalProperty.link(this);
+
+        Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+        emitCode(GlobalPropertyWithVarInjectionChecks);
+        skipToEnd.append(jump());
+        notGlobalPropertyWithVarInjections.link(this);
+
+        Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+        emitCode(GlobalLexicalVar);
+        skipToEnd.append(jump());
+        notGlobalLexicalVar.link(this);
+
+        Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+        emitCode(GlobalLexicalVarWithVarInjectionChecks);
+        skipToEnd.append(jump());
+        notGlobalLexicalVarWithVarInjections.link(this);
+
+        addSlowCase(jump());
+        skipToEnd.link(this);
+        break;
+    }
+
+    default:
+        emitCode(resolveType);
+        break;
+    }
+}
+
+void JIT::emitSlow_op_resolve_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    ResolveType resolveType = static_cast<ResolveType>(copiedInstruction(currentInstruction)[4].u.operand);
+    if (resolveType == GlobalProperty || resolveType == GlobalVar || resolveType == ClosureVar || resolveType == GlobalLexicalVar || resolveType == ModuleVar)
+        return;
+
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        linkSlowCase(iter); // var injections check for GlobalPropertyWithVarInjectionChecks.
+        linkSlowCase(iter); // var injections check for GlobalLexicalVarWithVarInjectionChecks.
+    }
+
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_resolve_scope);
+    slowPathCall.call();
+}
+
+void JIT::emitLoadWithStructureCheck(int scope, Structure** structureSlot)
+{
+    loadPtr(structureSlot, regT1);
+    emitGetVirtualRegister(scope, regT0);
+    addSlowCase(branchTestPtr(Zero, regT1));
+    load32(Address(regT1, Structure::structureIDOffset()), regT1);
+    addSlowCase(branch32(NotEqual, Address(regT0, JSCell::structureIDOffset()), regT1));
+}
+
+void JIT::emitGetVarFromPointer(JSValue* operand, GPRReg reg)
+{
+    loadPtr(operand, reg);
+}
+
+void JIT::emitGetVarFromIndirectPointer(JSValue** operand, GPRReg reg)
+{
+    loadPtr(operand, reg);
+    loadPtr(reg, reg);
+}
+
+void JIT::emitGetClosureVar(int scope, uintptr_t operand)
+{
+    emitGetVirtualRegister(scope, regT0);
+    loadPtr(Address(regT0, JSEnvironmentRecord::offsetOfVariables() + operand * sizeof(Register)), regT0);
+}
+
+void JIT::emit_op_get_from_scope(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int scope = currentInstruction[2].u.operand;
+    ResolveType resolveType = GetPutInfo(copiedInstruction(currentInstruction)[4].u.operand).resolveType();
+    Structure** structureSlot = currentInstruction[5].u.structure.slot();
+    uintptr_t* operandSlot = reinterpret_cast<uintptr_t*>(&currentInstruction[6].u.pointer);
+
+    auto emitCode = [&] (ResolveType resolveType, bool indirectLoadForOperand) {
+        switch (resolveType) {
+        case GlobalProperty:
+        case GlobalPropertyWithVarInjectionChecks: {
+            emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+            GPRReg base = regT0;
+            GPRReg result = regT0;
+            GPRReg offset = regT1;
+            GPRReg scratch = regT2;
+            
+            load32(operandSlot, offset);
+            if (!ASSERT_DISABLED) {
+                Jump isOutOfLine = branch32(GreaterThanOrEqual, offset, TrustedImm32(firstOutOfLineOffset));
+                abortWithReason(JITOffsetIsNotOutOfLine);
+                isOutOfLine.link(this);
+            }
+            loadPtr(Address(base, JSObject::butterflyOffset()), scratch);
+            neg32(offset);
+            signExtend32ToPtr(offset, offset);
+            load64(BaseIndex(scratch, offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)), result);
+            break;
+        }
+        case GlobalVar:
+        case GlobalVarWithVarInjectionChecks:
+        case GlobalLexicalVar:
+        case GlobalLexicalVarWithVarInjectionChecks:
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            if (indirectLoadForOperand)
+                emitGetVarFromIndirectPointer(bitwise_cast<JSValue**>(operandSlot), regT0);
+            else
+                emitGetVarFromPointer(bitwise_cast<JSValue*>(*operandSlot), regT0);
+            if (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks) // TDZ check.
+                addSlowCase(branchTest64(Zero, regT0));
+            break;
+        case ClosureVar:
+        case ClosureVarWithVarInjectionChecks:
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            emitGetClosureVar(scope, *operandSlot);
+            break;
+        case Dynamic:
+            addSlowCase(jump());
+            break;
+        case LocalClosureVar:
+        case ModuleVar:
+        case UnresolvedProperty:
+        case UnresolvedPropertyWithVarInjectionChecks:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    };
+
+    switch (resolveType) {
+    case UnresolvedProperty:
+    case UnresolvedPropertyWithVarInjectionChecks: {
+        JumpList skipToEnd;
+        load32(&currentInstruction[4], regT0);
+        and32(TrustedImm32(GetPutInfo::typeBits), regT0); // Load ResolveType into T0
+
+        Jump isGlobalProperty = branch32(Equal, regT0, TrustedImm32(GlobalProperty));
+        Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+        isGlobalProperty.link(this);
+        emitCode(GlobalProperty, false);
+        skipToEnd.append(jump());
+        notGlobalPropertyWithVarInjections.link(this);
+
+        Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+        emitCode(GlobalLexicalVar, true);
+        skipToEnd.append(jump());
+        notGlobalLexicalVar.link(this);
+
+        Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+        emitCode(GlobalLexicalVarWithVarInjectionChecks, true);
+        skipToEnd.append(jump());
+        notGlobalLexicalVarWithVarInjections.link(this);
+
+        addSlowCase(jump());
+
+        skipToEnd.link(this);
+        break;
+    }
+
+    default:
+        emitCode(resolveType, false);
+        break;
+    }
+    emitPutVirtualRegister(dst);
+    emitValueProfilingSite();
+}
+
+void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    ResolveType resolveType = GetPutInfo(copiedInstruction(currentInstruction)[4].u.operand).resolveType();
+
+    if (resolveType == GlobalVar || resolveType == ClosureVar)
+        return;
+
+    if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
+        linkSlowCase(iter); // bad structure
+
+    if (resolveType == GlobalLexicalVarWithVarInjectionChecks) // Var injections check.
+        linkSlowCase(iter);
+
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        // GlobalProperty/GlobalPropertyWithVarInjectionChecks
+        linkSlowCase(iter); // emitLoadWithStructureCheck
+        linkSlowCase(iter); // emitLoadWithStructureCheck
+        // GlobalLexicalVar
+        linkSlowCase(iter); // TDZ check.
+        // GlobalLexicalVarWithVarInjectionChecks.
+        linkSlowCase(iter); // var injection check.
+        linkSlowCase(iter); // TDZ check.
+    }
+
+    linkSlowCase(iter);
+
+    callOperation(WithProfile, operationGetFromScope, dst, currentInstruction);
+}
+
+void JIT::emitPutGlobalVariable(JSValue* operand, int value, WatchpointSet* set)
+{
+    emitGetVirtualRegister(value, regT0);
+    emitNotifyWrite(set);
+    storePtr(regT0, operand);
+}
+void JIT::emitPutGlobalVariableIndirect(JSValue** addressOfOperand, int value, WatchpointSet** indirectWatchpointSet)
+{
+    emitGetVirtualRegister(value, regT0);
+    loadPtr(indirectWatchpointSet, regT1);
+    emitNotifyWrite(regT1);
+    loadPtr(addressOfOperand, regT1);
+    storePtr(regT0, regT1);
+}
+
+void JIT::emitPutClosureVar(int scope, uintptr_t operand, int value, WatchpointSet* set)
+{
+    emitGetVirtualRegister(value, regT1);
+    emitGetVirtualRegister(scope, regT0);
+    emitNotifyWrite(set);
+    storePtr(regT1, Address(regT0, JSEnvironmentRecord::offsetOfVariables() + operand * sizeof(Register)));
+}
+
+void JIT::emit_op_put_to_scope(Instruction* currentInstruction)
+{
+    int scope = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+    GetPutInfo getPutInfo = GetPutInfo(copiedInstruction(currentInstruction)[4].u.operand);
+    ResolveType resolveType = getPutInfo.resolveType();
+    Structure** structureSlot = currentInstruction[5].u.structure.slot();
+    uintptr_t* operandSlot = reinterpret_cast<uintptr_t*>(&currentInstruction[6].u.pointer);
+
+    auto emitCode = [&] (ResolveType resolveType, bool indirectLoadForOperand) {
+        switch (resolveType) {
+        case GlobalProperty:
+        case GlobalPropertyWithVarInjectionChecks: {
+            emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+            emitGetVirtualRegister(value, regT2);
+            
+            loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
+            loadPtr(operandSlot, regT1);
+            negPtr(regT1);
+            storePtr(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));
+            emitWriteBarrier(m_codeBlock->globalObject(), value, ShouldFilterValue);
+            break;
+        }
+        case GlobalVar:
+        case GlobalVarWithVarInjectionChecks:
+        case GlobalLexicalVar:
+        case GlobalLexicalVarWithVarInjectionChecks: {
+            JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
+            RELEASE_ASSERT(constantScope);
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            if (!isInitialization(getPutInfo.initializationMode()) && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) {
+                // We need to do a TDZ check here because we can't always prove we need to emit TDZ checks statically.
+                if (indirectLoadForOperand)
+                    emitGetVarFromIndirectPointer(bitwise_cast<JSValue**>(operandSlot), regT0);
+                else
+                    emitGetVarFromPointer(bitwise_cast<JSValue*>(*operandSlot), regT0);
+                addSlowCase(branchTest64(Zero, regT0));
+            }
+            if (indirectLoadForOperand)
+                emitPutGlobalVariableIndirect(bitwise_cast<JSValue**>(operandSlot), value, bitwise_cast<WatchpointSet**>(&currentInstruction[5]));
+            else
+                emitPutGlobalVariable(bitwise_cast<JSValue*>(*operandSlot), value, currentInstruction[5].u.watchpointSet);
+            emitWriteBarrier(constantScope, value, ShouldFilterValue);
+            break;
+        }
+        case LocalClosureVar:
+        case ClosureVar:
+        case ClosureVarWithVarInjectionChecks:
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            emitPutClosureVar(scope, *operandSlot, value, currentInstruction[5].u.watchpointSet);
+            emitWriteBarrier(scope, value, ShouldFilterValue);
+            break;
+        case ModuleVar:
+        case Dynamic:
+            addSlowCase(jump());
+            break;
+        case UnresolvedProperty:
+        case UnresolvedPropertyWithVarInjectionChecks:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    };
+
+    switch (resolveType) {
+    case UnresolvedProperty:
+    case UnresolvedPropertyWithVarInjectionChecks: {
+        JumpList skipToEnd;
+        load32(&currentInstruction[4], regT0);
+        and32(TrustedImm32(GetPutInfo::typeBits), regT0); // Load ResolveType into T0
+
+        Jump isGlobalProperty = branch32(Equal, regT0, TrustedImm32(GlobalProperty));
+        Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+        isGlobalProperty.link(this);
+        emitCode(GlobalProperty, false);
+        skipToEnd.append(jump());
+        notGlobalPropertyWithVarInjections.link(this);
+
+        Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+        emitCode(GlobalLexicalVar, true);
+        skipToEnd.append(jump());
+        notGlobalLexicalVar.link(this);
+
+        Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+        emitCode(GlobalLexicalVarWithVarInjectionChecks, true);
+        skipToEnd.append(jump());
+        notGlobalLexicalVarWithVarInjections.link(this);
+
+        addSlowCase(jump());
+
+        skipToEnd.link(this);
+        break;
+    }
+
+    default:
+        emitCode(resolveType, false);
+        break;
+    }
+}
+
+void JIT::emitSlow_op_put_to_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    GetPutInfo getPutInfo = GetPutInfo(copiedInstruction(currentInstruction)[4].u.operand);
+    ResolveType resolveType = getPutInfo.resolveType();
+    unsigned linkCount = 0;
+    if (resolveType != GlobalVar && resolveType != ClosureVar && resolveType != LocalClosureVar && resolveType != GlobalLexicalVar)
+        linkCount++;
+    if (resolveType == GlobalVar || resolveType == GlobalVarWithVarInjectionChecks 
+        || resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks 
+        || resolveType == ClosureVar || resolveType == ClosureVarWithVarInjectionChecks
+        || resolveType == LocalClosureVar)
+        linkCount++;
+    if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
+        linkCount++; // bad structure
+    if (!isInitialization(getPutInfo.initializationMode()) && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) // TDZ check.
+        linkCount++;
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        // GlobalProperty/GlobalPropertyWithVarInjectionsCheck
+        linkCount++; // emitLoadWithStructureCheck
+        linkCount++; // emitLoadWithStructureCheck
+
+        // GlobalLexicalVar
+        bool needsTDZCheck = !isInitialization(getPutInfo.initializationMode());
+        if (needsTDZCheck)
+            linkCount++;
+        linkCount++; // Notify write check.
+
+        // GlobalLexicalVarWithVarInjectionsCheck
+        linkCount++; // var injection check.
+        if (needsTDZCheck)
+            linkCount++;
+        linkCount++; // Notify write check.
+    }
+    if (!linkCount)
+        return;
+    while (linkCount--)
+        linkSlowCase(iter);
+
+    if (resolveType == ModuleVar) {
+        JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_throw_strict_mode_readonly_property_write_error);
+        slowPathCall.call();
+    } else
+        callOperation(operationPutToScope, currentInstruction);
+}
+
+void JIT::emit_op_get_from_arguments(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int arguments = currentInstruction[2].u.operand;
+    int index = currentInstruction[3].u.operand;
+    
+    emitGetVirtualRegister(arguments, regT0);
+    load64(Address(regT0, DirectArguments::storageOffset() + index * sizeof(WriteBarrier<Unknown>)), regT0);
+    emitValueProfilingSite();
+    emitPutVirtualRegister(dst);
+}
+
+void JIT::emit_op_put_to_arguments(Instruction* currentInstruction)
+{
+    int arguments = currentInstruction[1].u.operand;
+    int index = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+    
+    emitGetVirtualRegister(arguments, regT0);
+    emitGetVirtualRegister(value, regT1);
+    store64(regT1, Address(regT0, DirectArguments::storageOffset() + index * sizeof(WriteBarrier<Unknown>)));
+
+    emitWriteBarrier(arguments, value, ShouldFilterValue);
+}
+
+#endif // USE(JSVALUE64)
+
+#if USE(JSVALUE64)
+void JIT::emitWriteBarrier(unsigned owner, unsigned value, WriteBarrierMode mode)
+{
+    Jump valueNotCell;
+    if (mode == ShouldFilterValue || mode == ShouldFilterBaseAndValue) {
+        emitGetVirtualRegister(value, regT0);
+        valueNotCell = branchTest64(NonZero, regT0, tagMaskRegister);
+    }
+    
+    emitGetVirtualRegister(owner, regT0);
+    Jump ownerNotCell;
+    if (mode == ShouldFilterBaseAndValue || mode == ShouldFilterBase)
+        ownerNotCell = branchTest64(NonZero, regT0, tagMaskRegister);
+
+    Jump ownerIsRememberedOrInEden = barrierBranch(regT0, regT1);
+    callOperation(operationWriteBarrierSlowPath, regT0);
+    ownerIsRememberedOrInEden.link(this);
+
+    if (mode == ShouldFilterBaseAndValue || mode == ShouldFilterBase)
+        ownerNotCell.link(this);
+    if (mode == ShouldFilterValue || mode == ShouldFilterBaseAndValue) 
+        valueNotCell.link(this);
+}
+
+void JIT::emitWriteBarrier(JSCell* owner, unsigned value, WriteBarrierMode mode)
+{
+    emitGetVirtualRegister(value, regT0);
+    Jump valueNotCell;
+    if (mode == ShouldFilterValue)
+        valueNotCell = branchTest64(NonZero, regT0, tagMaskRegister);
+
+    emitWriteBarrier(owner);
+
+    if (mode == ShouldFilterValue) 
+        valueNotCell.link(this);
+}
+
+#else // USE(JSVALUE64)
+
+void JIT::emitWriteBarrier(unsigned owner, unsigned value, WriteBarrierMode mode)
+{
+    Jump valueNotCell;
+    if (mode == ShouldFilterValue || mode == ShouldFilterBaseAndValue) {
+        emitLoadTag(value, regT0);
+        valueNotCell = branch32(NotEqual, regT0, TrustedImm32(JSValue::CellTag));
+    }
+    
+    emitLoad(owner, regT0, regT1);
+    Jump ownerNotCell;
+    if (mode == ShouldFilterBase || mode == ShouldFilterBaseAndValue)
+        ownerNotCell = branch32(NotEqual, regT0, TrustedImm32(JSValue::CellTag));
+
+    Jump ownerIsRememberedOrInEden = barrierBranch(regT1, regT2);
+    callOperation(operationWriteBarrierSlowPath, regT1);
+    ownerIsRememberedOrInEden.link(this);
+
+    if (mode == ShouldFilterBase || mode == ShouldFilterBaseAndValue)
+        ownerNotCell.link(this);
+    if (mode == ShouldFilterValue || mode == ShouldFilterBaseAndValue) 
+        valueNotCell.link(this);
+}
+
+void JIT::emitWriteBarrier(JSCell* owner, unsigned value, WriteBarrierMode mode)
+{
+    Jump valueNotCell;
+    if (mode == ShouldFilterValue) {
+        emitLoadTag(value, regT0);
+        valueNotCell = branch32(NotEqual, regT0, TrustedImm32(JSValue::CellTag));
+    }
+
+    emitWriteBarrier(owner);
+
+    if (mode == ShouldFilterValue) 
+        valueNotCell.link(this);
+}
+
+#endif // USE(JSVALUE64)
+
+void JIT::emitWriteBarrier(JSCell* owner)
+{
+    Jump ownerIsRememberedOrInEden = barrierBranch(owner, regT0);
+    callOperation(operationWriteBarrierSlowPath, owner);
+    ownerIsRememberedOrInEden.link(this);
+}
+
+void JIT::emitByValIdentifierCheck(ByValInfo* byValInfo, RegisterID cell, RegisterID scratch, const Identifier& propertyName, JumpList& slowCases)
+{
+    if (propertyName.isSymbol())
+        slowCases.append(branchPtr(NotEqual, cell, TrustedImmPtr(byValInfo->cachedSymbol.get())));
+    else {
+        slowCases.append(branchStructure(NotEqual, Address(cell, JSCell::structureIDOffset()), m_vm->stringStructure.get()));
+        loadPtr(Address(cell, JSString::offsetOfValue()), scratch);
+        slowCases.append(branchPtr(NotEqual, scratch, TrustedImmPtr(propertyName.impl())));
+    }
+}
+
+void JIT::privateCompileGetByVal(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
+{
+    Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
+    
+    PatchableJump badType;
+    JumpList slowCases;
+    
+    switch (arrayMode) {
+    case JITInt32:
+        slowCases = emitInt32GetByVal(currentInstruction, badType);
+        break;
+    case JITDouble:
+        slowCases = emitDoubleGetByVal(currentInstruction, badType);
+        break;
+    case JITContiguous:
+        slowCases = emitContiguousGetByVal(currentInstruction, badType);
+        break;
+    case JITArrayStorage:
+        slowCases = emitArrayStorageGetByVal(currentInstruction, badType);
+        break;
+    case JITDirectArguments:
+        slowCases = emitDirectArgumentsGetByVal(currentInstruction, badType);
+        break;
+    case JITScopedArguments:
+        slowCases = emitScopedArgumentsGetByVal(currentInstruction, badType);
+        break;
+    default:
+        TypedArrayType type = typedArrayTypeForJITArrayMode(arrayMode);
+        if (isInt(type))
+            slowCases = emitIntTypedArrayGetByVal(currentInstruction, badType, type);
+        else 
+            slowCases = emitFloatTypedArrayGetByVal(currentInstruction, badType, type);
+        break;
+    }
+    
+    Jump done = jump();
+
+    LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
+    
+    patchBuffer.link(badType, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    
+    patchBuffer.link(done, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
+    
+    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
+        m_codeBlock, patchBuffer,
+        ("Baseline get_by_val stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value()));
+    
+    MacroAssembler::repatchJump(byValInfo->badTypeJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
+    MacroAssembler::repatchCall(CodeLocationCall(MacroAssemblerCodePtr(returnAddress)), FunctionPtr(operationGetByValGeneric));
+}
+
+void JIT::privateCompileGetByValWithCachedId(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, const Identifier& propertyName)
+{
+    Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
+
+    Jump fastDoneCase;
+    Jump slowDoneCase;
+    JumpList slowCases;
+
+    JITGetByIdGenerator gen = emitGetByValWithCachedId(byValInfo, currentInstruction, propertyName, fastDoneCase, slowDoneCase, slowCases);
+
+    ConcurrentJSLocker locker(m_codeBlock->m_lock);
+    LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
+    patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(fastDoneCase, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
+    patchBuffer.link(slowDoneCase, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToNextHotPath));
+    if (!m_exceptionChecks.empty())
+        patchBuffer.link(m_exceptionChecks, byValInfo->exceptionHandler);
+
+    for (const auto& callSite : m_calls) {
+        if (callSite.to)
+            patchBuffer.link(callSite.from, FunctionPtr(callSite.to));
+    }
+    gen.finalize(patchBuffer);
+
+    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
+        m_codeBlock, patchBuffer,
+        ("Baseline get_by_val with cached property name '%s' stub for %s, return point %p", propertyName.impl()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.value()));
+    byValInfo->stubInfo = gen.stubInfo();
+
+    MacroAssembler::repatchJump(byValInfo->notIndexJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
+    MacroAssembler::repatchCall(CodeLocationCall(MacroAssemblerCodePtr(returnAddress)), FunctionPtr(operationGetByValGeneric));
+}
+
+void JIT::privateCompilePutByVal(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
+{
+    Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
+    
+    PatchableJump badType;
+    JumpList slowCases;
+
+    bool needsLinkForWriteBarrier = false;
+
+    switch (arrayMode) {
+    case JITInt32:
+        slowCases = emitInt32PutByVal(currentInstruction, badType);
+        break;
+    case JITDouble:
+        slowCases = emitDoublePutByVal(currentInstruction, badType);
+        break;
+    case JITContiguous:
+        slowCases = emitContiguousPutByVal(currentInstruction, badType);
+        needsLinkForWriteBarrier = true;
+        break;
+    case JITArrayStorage:
+        slowCases = emitArrayStoragePutByVal(currentInstruction, badType);
+        needsLinkForWriteBarrier = true;
+        break;
+    default:
+        TypedArrayType type = typedArrayTypeForJITArrayMode(arrayMode);
+        if (isInt(type))
+            slowCases = emitIntTypedArrayPutByVal(currentInstruction, badType, type);
+        else 
+            slowCases = emitFloatTypedArrayPutByVal(currentInstruction, badType, type);
+        break;
+    }
+    
+    Jump done = jump();
+
+    LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
+    patchBuffer.link(badType, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(done, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
+    if (needsLinkForWriteBarrier) {
+        ASSERT(m_calls.last().to == operationWriteBarrierSlowPath);
+        patchBuffer.link(m_calls.last().from, operationWriteBarrierSlowPath);
+    }
+    
+    bool isDirect = m_interpreter->getOpcodeID(currentInstruction->u.opcode) == op_put_by_val_direct;
+    if (!isDirect) {
+        byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
+            m_codeBlock, patchBuffer,
+            ("Baseline put_by_val stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value()));
+        
+    } else {
+        byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
+            m_codeBlock, patchBuffer,
+            ("Baseline put_by_val_direct stub for %s, return point %p", toCString(*m_codeBlock).data(), returnAddress.value()));
+    }
+    MacroAssembler::repatchJump(byValInfo->badTypeJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
+    MacroAssembler::repatchCall(CodeLocationCall(MacroAssemblerCodePtr(returnAddress)), FunctionPtr(isDirect ? operationDirectPutByValGeneric : operationPutByValGeneric));
+}
+
+void JIT::privateCompilePutByValWithCachedId(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, PutKind putKind, const Identifier& propertyName)
+{
+    Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
+
+    JumpList doneCases;
+    JumpList slowCases;
+
+    JITPutByIdGenerator gen = emitPutByValWithCachedId(byValInfo, currentInstruction, putKind, propertyName, doneCases, slowCases);
+
+    ConcurrentJSLocker locker(m_codeBlock->m_lock);
+    LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
+    patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
+    patchBuffer.link(doneCases, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
+    if (!m_exceptionChecks.empty())
+        patchBuffer.link(m_exceptionChecks, byValInfo->exceptionHandler);
+
+    for (const auto& callSite : m_calls) {
+        if (callSite.to)
+            patchBuffer.link(callSite.from, FunctionPtr(callSite.to));
+    }
+    gen.finalize(patchBuffer);
+
+    byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
+        m_codeBlock, patchBuffer,
+        ("Baseline put_by_val%s with cached property name '%s' stub for %s, return point %p", (putKind == Direct) ? "_direct" : "", propertyName.impl()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.value()));
+    byValInfo->stubInfo = gen.stubInfo();
+
+    MacroAssembler::repatchJump(byValInfo->notIndexJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
+    MacroAssembler::repatchCall(CodeLocationCall(MacroAssemblerCodePtr(returnAddress)), FunctionPtr(putKind == Direct ? operationDirectPutByValGeneric : operationPutByValGeneric));
+}
+
+
+JIT::JumpList JIT::emitDirectArgumentsGetByVal(Instruction*, PatchableJump& badType)
+{
+    JumpList slowCases;
+    
+#if USE(JSVALUE64)
+    RegisterID base = regT0;
+    RegisterID property = regT1;
+    JSValueRegs result = JSValueRegs(regT0);
+    RegisterID scratch = regT3;
+#else
+    RegisterID base = regT0;
+    RegisterID property = regT2;
+    JSValueRegs result = JSValueRegs(regT1, regT0);
+    RegisterID scratch = regT3;
+#endif
+
+    load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
+    badType = patchableBranch32(NotEqual, scratch, TrustedImm32(DirectArgumentsType));
+    
+    slowCases.append(branch32(AboveOrEqual, property, Address(base, DirectArguments::offsetOfLength())));
+    slowCases.append(branchTestPtr(NonZero, Address(base, DirectArguments::offsetOfOverrides())));
+    
+    zeroExtend32ToPtr(property, scratch);
+    loadValue(BaseIndex(base, scratch, TimesEight, DirectArguments::storageOffset()), result);
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitScopedArgumentsGetByVal(Instruction*, PatchableJump& badType)
+{
+    JumpList slowCases;
+    
+#if USE(JSVALUE64)
+    RegisterID base = regT0;
+    RegisterID property = regT1;
+    JSValueRegs result = JSValueRegs(regT0);
+    RegisterID scratch = regT3;
+    RegisterID scratch2 = regT4;
+#else
+    RegisterID base = regT0;
+    RegisterID property = regT2;
+    JSValueRegs result = JSValueRegs(regT1, regT0);
+    RegisterID scratch = regT3;
+    RegisterID scratch2 = regT4;
+#endif
+
+    load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
+    badType = patchableBranch32(NotEqual, scratch, TrustedImm32(ScopedArgumentsType));
+    slowCases.append(branch32(AboveOrEqual, property, Address(base, ScopedArguments::offsetOfTotalLength())));
+    
+    loadPtr(Address(base, ScopedArguments::offsetOfTable()), scratch);
+    load32(Address(scratch, ScopedArgumentsTable::offsetOfLength()), scratch2);
+    Jump overflowCase = branch32(AboveOrEqual, property, scratch2);
+    loadPtr(Address(base, ScopedArguments::offsetOfScope()), scratch2);
+    loadPtr(Address(scratch, ScopedArgumentsTable::offsetOfArguments()), scratch);
+    load32(BaseIndex(scratch, property, TimesFour), scratch);
+    slowCases.append(branch32(Equal, scratch, TrustedImm32(ScopeOffset::invalidOffset)));
+    loadValue(BaseIndex(scratch2, scratch, TimesEight, JSEnvironmentRecord::offsetOfVariables()), result);
+    Jump done = jump();
+    overflowCase.link(this);
+    sub32(property, scratch2);
+    neg32(scratch2);
+    loadValue(BaseIndex(base, scratch2, TimesEight, ScopedArguments::overflowStorageOffset()), result);
+    slowCases.append(branchIfEmpty(result));
+    done.link(this);
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitIntTypedArrayGetByVal(Instruction*, PatchableJump& badType, TypedArrayType type)
+{
+    ASSERT(isInt(type));
+    
+    // The best way to test the array type is to use the classInfo. We need to do so without
+    // clobbering the register that holds the indexing type, base, and property.
+
+#if USE(JSVALUE64)
+    RegisterID base = regT0;
+    RegisterID property = regT1;
+    RegisterID resultPayload = regT0;
+    RegisterID scratch = regT3;
+#else
+    RegisterID base = regT0;
+    RegisterID property = regT2;
+    RegisterID resultPayload = regT0;
+    RegisterID resultTag = regT1;
+    RegisterID scratch = regT3;
+#endif
+    
+    JumpList slowCases;
+    
+    load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
+    badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
+    slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
+    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
+    
+    switch (elementSize(type)) {
+    case 1:
+        if (JSC::isSigned(type))
+            load8SignedExtendTo32(BaseIndex(scratch, property, TimesOne), resultPayload);
+        else
+            load8(BaseIndex(scratch, property, TimesOne), resultPayload);
+        break;
+    case 2:
+        if (JSC::isSigned(type))
+            load16SignedExtendTo32(BaseIndex(scratch, property, TimesTwo), resultPayload);
+        else
+            load16(BaseIndex(scratch, property, TimesTwo), resultPayload);
+        break;
+    case 4:
+        load32(BaseIndex(scratch, property, TimesFour), resultPayload);
+        break;
+    default:
+        CRASH();
+    }
+    
+    Jump done;
+    if (type == TypeUint32) {
+        Jump canBeInt = branch32(GreaterThanOrEqual, resultPayload, TrustedImm32(0));
+        
+        convertInt32ToDouble(resultPayload, fpRegT0);
+        addDouble(AbsoluteAddress(&twoToThe32), fpRegT0);
+#if USE(JSVALUE64)
+        moveDoubleTo64(fpRegT0, resultPayload);
+        sub64(tagTypeNumberRegister, resultPayload);
+#else
+        moveDoubleToInts(fpRegT0, resultPayload, resultTag);
+#endif
+        
+        done = jump();
+        canBeInt.link(this);
+    }
+
+#if USE(JSVALUE64)
+    or64(tagTypeNumberRegister, resultPayload);
+#else
+    move(TrustedImm32(JSValue::Int32Tag), resultTag);
+#endif
+    if (done.isSet())
+        done.link(this);
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitFloatTypedArrayGetByVal(Instruction*, PatchableJump& badType, TypedArrayType type)
+{
+    ASSERT(isFloat(type));
+    
+#if USE(JSVALUE64)
+    RegisterID base = regT0;
+    RegisterID property = regT1;
+    RegisterID resultPayload = regT0;
+    RegisterID scratch = regT3;
+#else
+    RegisterID base = regT0;
+    RegisterID property = regT2;
+    RegisterID resultPayload = regT0;
+    RegisterID resultTag = regT1;
+    RegisterID scratch = regT3;
+#endif
+    
+    JumpList slowCases;
+
+    load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
+    badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
+    slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
+    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
+    
+    switch (elementSize(type)) {
+    case 4:
+        loadFloat(BaseIndex(scratch, property, TimesFour), fpRegT0);
+        convertFloatToDouble(fpRegT0, fpRegT0);
+        break;
+    case 8: {
+        loadDouble(BaseIndex(scratch, property, TimesEight), fpRegT0);
+        break;
+    }
+    default:
+        CRASH();
+    }
+    
+    Jump notNaN = branchDouble(DoubleEqual, fpRegT0, fpRegT0);
+    static const double NaN = PNaN;
+    loadDouble(TrustedImmPtr(&NaN), fpRegT0);
+    notNaN.link(this);
+    
+#if USE(JSVALUE64)
+    moveDoubleTo64(fpRegT0, resultPayload);
+    sub64(tagTypeNumberRegister, resultPayload);
+#else
+    moveDoubleToInts(fpRegT0, resultPayload, resultTag);
+#endif
+    return slowCases;    
+}
+
+JIT::JumpList JIT::emitIntTypedArrayPutByVal(Instruction* currentInstruction, PatchableJump& badType, TypedArrayType type)
+{
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ASSERT(isInt(type));
+    
+    int value = currentInstruction[3].u.operand;
+
+#if USE(JSVALUE64)
+    RegisterID base = regT0;
+    RegisterID property = regT1;
+    RegisterID earlyScratch = regT3;
+    RegisterID lateScratch = regT2;
+#else
+    RegisterID base = regT0;
+    RegisterID property = regT2;
+    RegisterID earlyScratch = regT3;
+    RegisterID lateScratch = regT1;
+#endif
+    
+    JumpList slowCases;
+    
+    load8(Address(base, JSCell::typeInfoTypeOffset()), earlyScratch);
+    badType = patchableBranch32(NotEqual, earlyScratch, TrustedImm32(typeForTypedArrayType(type)));
+    Jump inBounds = branch32(Below, property, Address(base, JSArrayBufferView::offsetOfLength()));
+    emitArrayProfileOutOfBoundsSpecialCase(profile);
+    slowCases.append(jump());
+    inBounds.link(this);
+    
+#if USE(JSVALUE64)
+    emitGetVirtualRegister(value, earlyScratch);
+    slowCases.append(emitJumpIfNotInt(earlyScratch));
+#else
+    emitLoad(value, lateScratch, earlyScratch);
+    slowCases.append(branch32(NotEqual, lateScratch, TrustedImm32(JSValue::Int32Tag)));
+#endif
+    
+    // We would be loading this into base as in get_by_val, except that the slow
+    // path expects the base to be unclobbered.
+    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
+    
+    if (isClamped(type)) {
+        ASSERT(elementSize(type) == 1);
+        ASSERT(!JSC::isSigned(type));
+        Jump inBounds = branch32(BelowOrEqual, earlyScratch, TrustedImm32(0xff));
+        Jump tooBig = branch32(GreaterThan, earlyScratch, TrustedImm32(0xff));
+        xor32(earlyScratch, earlyScratch);
+        Jump clamped = jump();
+        tooBig.link(this);
+        move(TrustedImm32(0xff), earlyScratch);
+        clamped.link(this);
+        inBounds.link(this);
+    }
+    
+    switch (elementSize(type)) {
+    case 1:
+        store8(earlyScratch, BaseIndex(lateScratch, property, TimesOne));
+        break;
+    case 2:
+        store16(earlyScratch, BaseIndex(lateScratch, property, TimesTwo));
+        break;
+    case 4:
+        store32(earlyScratch, BaseIndex(lateScratch, property, TimesFour));
+        break;
+    default:
+        CRASH();
+    }
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitFloatTypedArrayPutByVal(Instruction* currentInstruction, PatchableJump& badType, TypedArrayType type)
+{
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ASSERT(isFloat(type));
+    
+    int value = currentInstruction[3].u.operand;
+
+#if USE(JSVALUE64)
+    RegisterID base = regT0;
+    RegisterID property = regT1;
+    RegisterID earlyScratch = regT3;
+    RegisterID lateScratch = regT2;
+#else
+    RegisterID base = regT0;
+    RegisterID property = regT2;
+    RegisterID earlyScratch = regT3;
+    RegisterID lateScratch = regT1;
+#endif
+    
+    JumpList slowCases;
+    
+    load8(Address(base, JSCell::typeInfoTypeOffset()), earlyScratch);
+    badType = patchableBranch32(NotEqual, earlyScratch, TrustedImm32(typeForTypedArrayType(type)));
+    Jump inBounds = branch32(Below, property, Address(base, JSArrayBufferView::offsetOfLength()));
+    emitArrayProfileOutOfBoundsSpecialCase(profile);
+    slowCases.append(jump());
+    inBounds.link(this);
+    
+#if USE(JSVALUE64)
+    emitGetVirtualRegister(value, earlyScratch);
+    Jump doubleCase = emitJumpIfNotInt(earlyScratch);
+    convertInt32ToDouble(earlyScratch, fpRegT0);
+    Jump ready = jump();
+    doubleCase.link(this);
+    slowCases.append(emitJumpIfNotNumber(earlyScratch));
+    add64(tagTypeNumberRegister, earlyScratch);
+    move64ToDouble(earlyScratch, fpRegT0);
+    ready.link(this);
+#else
+    emitLoad(value, lateScratch, earlyScratch);
+    Jump doubleCase = branch32(NotEqual, lateScratch, TrustedImm32(JSValue::Int32Tag));
+    convertInt32ToDouble(earlyScratch, fpRegT0);
+    Jump ready = jump();
+    doubleCase.link(this);
+    slowCases.append(branch32(Above, lateScratch, TrustedImm32(JSValue::LowestTag)));
+    moveIntsToDouble(earlyScratch, lateScratch, fpRegT0, fpRegT1);
+    ready.link(this);
+#endif
+    
+    // We would be loading this into base as in get_by_val, except that the slow
+    // path expects the base to be unclobbered.
+    loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
+    
+    switch (elementSize(type)) {
+    case 4:
+        convertDoubleToFloat(fpRegT0, fpRegT0);
+        storeFloat(fpRegT0, BaseIndex(lateScratch, property, TimesFour));
+        break;
+    case 8:
+        storeDouble(fpRegT0, BaseIndex(lateScratch, property, TimesEight));
+        break;
+    default:
+        CRASH();
+    }
+    
+    return slowCases;
+}
+
+void JIT::emit_op_define_data_property(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_define_data_property);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_define_accessor_property(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_define_accessor_property);
+    slowPathCall.call();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITPropertyAccess32_64.cpp b/jit/JITPropertyAccess32_64.cpp
new file mode 100644
index 0000000..5f14e90
--- /dev/null
+++ b/jit/JITPropertyAccess32_64.cpp
@@ -0,0 +1,1196 @@
+/*
+ * Copyright (C) 2008, 2009, 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(JIT)
+#if USE(JSVALUE32_64)
+#include "JIT.h"
+
+#include "CodeBlock.h"
+#include "DirectArguments.h"
+#include "GCAwareJITStubRoutine.h"
+#include "Interpreter.h"
+#include "JITInlines.h"
+#include "JSArray.h"
+#include "JSEnvironmentRecord.h"
+#include "JSFunction.h"
+#include "LinkBuffer.h"
+#include "ResultType.h"
+#include "SlowPathCall.h"
+#include "StructureStubInfo.h"
+#include <wtf/StringPrintStream.h>
+
+
+namespace JSC {
+    
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+
+    emitLoad(base, regT1, regT0);
+    emitLoad(value, regT3, regT2);
+    callOperation(operationPutByIndex, regT1, regT0, property, regT3, regT2);
+}
+
+void JIT::emit_op_put_getter_by_id(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    int options = currentInstruction[3].u.operand;
+    int getter = currentInstruction[4].u.operand;
+
+    emitLoadPayload(base, regT1);
+    emitLoadPayload(getter, regT3);
+    callOperation(operationPutGetterById, regT1, m_codeBlock->identifier(property).impl(), options, regT3);
+}
+
+void JIT::emit_op_put_setter_by_id(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    unsigned options = currentInstruction[3].u.operand;
+    int setter = currentInstruction[4].u.operand;
+
+    emitLoadPayload(base, regT1);
+    emitLoadPayload(setter, regT3);
+    callOperation(operationPutSetterById, regT1, m_codeBlock->identifier(property).impl(), options, regT3);
+}
+
+void JIT::emit_op_put_getter_setter_by_id(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    unsigned attribute = currentInstruction[3].u.operand;
+    int getter = currentInstruction[4].u.operand;
+    int setter = currentInstruction[5].u.operand;
+
+    emitLoadPayload(base, regT1);
+    emitLoadPayload(getter, regT3);
+    emitLoadPayload(setter, regT4);
+    callOperation(operationPutGetterSetter, regT1, m_codeBlock->identifier(property).impl(), attribute, regT3, regT4);
+}
+
+void JIT::emit_op_put_getter_by_val(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    int32_t attributes = currentInstruction[3].u.operand;
+    int getter = currentInstruction[4].u.operand;
+
+    emitLoadPayload(base, regT2);
+    emitLoad(property, regT1, regT0);
+    emitLoadPayload(getter, regT3);
+    callOperation(operationPutGetterByVal, regT2, regT1, regT0, attributes, regT3);
+}
+
+void JIT::emit_op_put_setter_by_val(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    int32_t attributes = currentInstruction[3].u.operand;
+    int getter = currentInstruction[4].u.operand;
+
+    emitLoadPayload(base, regT2);
+    emitLoad(property, regT1, regT0);
+    emitLoadPayload(getter, regT3);
+    callOperation(operationPutSetterByVal, regT2, regT1, regT0, attributes, regT3);
+}
+
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    emitLoad(base, regT1, regT0);
+    callOperation(operationDeleteByIdJSResult, dst, regT1, regT0, m_codeBlock->identifier(property).impl());
+}
+
+void JIT::emit_op_del_by_val(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    callOperation(operationDeleteByValJSResult, dst, regT1, regT0, regT3, regT2);
+}
+
+JIT::CodeRef JIT::stringGetByValStubGenerator(VM* vm)
+{
+    JSInterfaceJIT jit(vm);
+    JumpList failures;
+    failures.append(jit.branchStructure(NotEqual, Address(regT0, JSCell::structureIDOffset()), vm->stringStructure.get()));
+    
+    // Load string length to regT1, and start the process of loading the data pointer into regT0
+    jit.load32(Address(regT0, ThunkHelpers::jsStringLengthOffset()), regT1);
+    jit.loadPtr(Address(regT0, ThunkHelpers::jsStringValueOffset()), regT0);
+    failures.append(jit.branchTest32(Zero, regT0));
+    
+    // Do an unsigned compare to simultaneously filter negative indices as well as indices that are too large
+    failures.append(jit.branch32(AboveOrEqual, regT2, regT1));
+    
+    // Load the character
+    JumpList is16Bit;
+    JumpList cont8Bit;
+    // Load the string flags
+    jit.loadPtr(Address(regT0, StringImpl::flagsOffset()), regT1);
+    jit.loadPtr(Address(regT0, StringImpl::dataOffset()), regT0);
+    is16Bit.append(jit.branchTest32(Zero, regT1, TrustedImm32(StringImpl::flagIs8Bit())));
+    jit.load8(BaseIndex(regT0, regT2, TimesOne, 0), regT0);
+    cont8Bit.append(jit.jump());
+    is16Bit.link(&jit);
+    jit.load16(BaseIndex(regT0, regT2, TimesTwo, 0), regT0);
+
+    cont8Bit.link(&jit);
+    
+    failures.append(jit.branch32(AboveOrEqual, regT0, TrustedImm32(0x100)));
+    jit.move(TrustedImmPtr(vm->smallStrings.singleCharacterStrings()), regT1);
+    jit.loadPtr(BaseIndex(regT1, regT0, ScalePtr, 0), regT0);
+    jit.move(TrustedImm32(JSValue::CellTag), regT1); // We null check regT0 on return so this is safe
+    jit.ret();
+
+    failures.link(&jit);
+    jit.move(TrustedImm32(0), regT0);
+    jit.ret();
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("String get_by_val stub"));
+}
+
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ByValInfo* byValInfo = m_codeBlock->addByValInfo();
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    PatchableJump notIndex = patchableBranch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag));
+    addSlowCase(notIndex);
+    emitArrayProfilingSiteWithCell(regT0, regT1, profile);
+    and32(TrustedImm32(IndexingShapeMask), regT1);
+
+    PatchableJump badType;
+    JumpList slowCases;
+    
+    JITArrayMode mode = chooseArrayMode(profile);
+    switch (mode) {
+    case JITInt32:
+        slowCases = emitInt32GetByVal(currentInstruction, badType);
+        break;
+    case JITDouble:
+        slowCases = emitDoubleGetByVal(currentInstruction, badType);
+        break;
+    case JITContiguous:
+        slowCases = emitContiguousGetByVal(currentInstruction, badType);
+        break;
+    case JITArrayStorage:
+        slowCases = emitArrayStorageGetByVal(currentInstruction, badType);
+        break;
+    default:
+        CRASH();
+    }
+    
+    addSlowCase(badType);
+    addSlowCase(slowCases);
+    
+    Label done = label();
+
+    if (!ASSERT_DISABLED) {
+        Jump resultOK = branch32(NotEqual, regT1, TrustedImm32(JSValue::EmptyValueTag));
+        abortWithReason(JITGetByValResultIsNotEmpty);
+        resultOK.link(this);
+    }
+
+    emitValueProfilingSite();
+    emitStore(dst, regT1, regT0);
+
+    Label nextHotPath = label();
+    
+    m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, notIndex, badType, mode, profile, done, nextHotPath));
+}
+
+JIT::JumpList JIT::emitContiguousLoad(Instruction*, PatchableJump& badType, IndexingType expectedShape)
+{
+    JumpList slowCases;
+    
+    badType = patchableBranch32(NotEqual, regT1, TrustedImm32(expectedShape));
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT3);
+    slowCases.append(branch32(AboveOrEqual, regT2, Address(regT3, Butterfly::offsetOfPublicLength())));
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1); // tag
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0); // payload
+    slowCases.append(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitDoubleLoad(Instruction*, PatchableJump& badType)
+{
+    JumpList slowCases;
+    
+    badType = patchableBranch32(NotEqual, regT1, TrustedImm32(DoubleShape));
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT3);
+    slowCases.append(branch32(AboveOrEqual, regT2, Address(regT3, Butterfly::offsetOfPublicLength())));
+    loadDouble(BaseIndex(regT3, regT2, TimesEight), fpRegT0);
+    slowCases.append(branchDouble(DoubleNotEqualOrUnordered, fpRegT0, fpRegT0));
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitArrayStorageLoad(Instruction*, PatchableJump& badType)
+{
+    JumpList slowCases;
+    
+    add32(TrustedImm32(-ArrayStorageShape), regT1, regT3);
+    badType = patchableBranch32(Above, regT3, TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape));
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT3);
+    slowCases.append(branch32(AboveOrEqual, regT2, Address(regT3, ArrayStorage::vectorLengthOffset())));
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1); // tag
+    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0); // payload
+    slowCases.append(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
+    
+    return slowCases;
+}
+
+JITGetByIdGenerator JIT::emitGetByValWithCachedId(ByValInfo* byValInfo, Instruction* currentInstruction, const Identifier& propertyName, Jump& fastDoneCase, Jump& slowDoneCase, JumpList& slowCases)
+{
+    int dst = currentInstruction[1].u.operand;
+
+    // base: tag(regT1), payload(regT0)
+    // property: tag(regT3), payload(regT2)
+    // scratch: regT4
+
+    slowCases.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::CellTag)));
+    emitByValIdentifierCheck(byValInfo, regT2, regT4, propertyName, slowCases);
+
+    JITGetByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(currentInstruction), RegisterSet::stubUnavailableRegisters(),
+        propertyName.impl(), JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0), AccessType::Get);
+    gen.generateFastPath(*this);
+
+    fastDoneCase = jump();
+
+    Label coldPathBegin = label();
+    gen.slowPathJump().link(this);
+
+    Call call = callOperation(WithProfile, operationGetByIdOptimize, dst, gen.stubInfo(), regT1, regT0, propertyName.impl());
+    gen.reportSlowPathCall(coldPathBegin, call);
+    slowDoneCase = jump();
+
+    return gen;
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int property = currentInstruction[3].u.operand;
+    ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
+
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // property int32 check
+
+    Jump nonCell = jump();
+    linkSlowCase(iter); // base array check
+    Jump notString = branchStructure(NotEqual, Address(regT0, JSCell::structureIDOffset()), m_vm->stringStructure.get());
+    emitNakedCall(m_vm->getCTIStub(stringGetByValStubGenerator).code());
+    Jump failed = branchTestPtr(Zero, regT0);
+    emitStore(dst, regT1, regT0);
+    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
+    failed.link(this);
+    notString.link(this);
+    nonCell.link(this);
+
+    linkSlowCase(iter); // vector length check
+    linkSlowCase(iter); // empty value
+    
+    Label slowPath = label();
+    
+    emitLoad(base, regT1, regT0);
+    emitLoad(property, regT3, regT2);
+    Call call = callOperation(operationGetByValOptimize, dst, regT1, regT0, regT3, regT2, byValInfo);
+
+    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
+    m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
+    m_byValInstructionIndex++;
+
+    emitValueProfilingSite();
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ByValInfo* byValInfo = m_codeBlock->addByValInfo();
+    
+    emitLoad2(base, regT1, regT0, property, regT3, regT2);
+    
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+    PatchableJump notIndex = patchableBranch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag));
+    addSlowCase(notIndex);
+    emitArrayProfilingSiteWithCell(regT0, regT1, profile);
+    and32(TrustedImm32(IndexingShapeMask), regT1);
+    
+    PatchableJump badType;
+    JumpList slowCases;
+    
+    JITArrayMode mode = chooseArrayMode(profile);
+    switch (mode) {
+    case JITInt32:
+        slowCases = emitInt32PutByVal(currentInstruction, badType);
+        break;
+    case JITDouble:
+        slowCases = emitDoublePutByVal(currentInstruction, badType);
+        break;
+    case JITContiguous:
+        slowCases = emitContiguousPutByVal(currentInstruction, badType);
+        break;
+    case JITArrayStorage:
+        slowCases = emitArrayStoragePutByVal(currentInstruction, badType);
+        break;
+    default:
+        CRASH();
+        break;
+    }
+    
+    addSlowCase(badType);
+    addSlowCase(slowCases);
+    
+    Label done = label();
+    
+    m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, notIndex, badType, mode, profile, done, done));
+}
+
+JIT::JumpList JIT::emitGenericContiguousPutByVal(Instruction* currentInstruction, PatchableJump& badType, IndexingType indexingShape)
+{
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    
+    JumpList slowCases;
+    
+    badType = patchableBranch32(NotEqual, regT1, TrustedImm32(ContiguousShape));
+    
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT3);
+    Jump outOfBounds = branch32(AboveOrEqual, regT2, Address(regT3, Butterfly::offsetOfPublicLength()));
+    
+    Label storeResult = label();
+    emitLoad(value, regT1, regT0);
+    switch (indexingShape) {
+    case Int32Shape:
+        slowCases.append(branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag)));
+        store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+        store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+        break;
+    case ContiguousShape:
+        store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+        store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+        emitLoad(base, regT2, regT3);
+        emitWriteBarrier(base, value, ShouldFilterValue);
+        break;
+    case DoubleShape: {
+        Jump notInt = branch32(NotEqual, regT1, TrustedImm32(JSValue::Int32Tag));
+        convertInt32ToDouble(regT0, fpRegT0);
+        Jump ready = jump();
+        notInt.link(this);
+        moveIntsToDouble(regT0, regT1, fpRegT0, fpRegT1);
+        slowCases.append(branchDouble(DoubleNotEqualOrUnordered, fpRegT0, fpRegT0));
+        ready.link(this);
+        storeDouble(fpRegT0, BaseIndex(regT3, regT2, TimesEight));
+        break;
+    }
+    default:
+        CRASH();
+        break;
+    }
+        
+    Jump done = jump();
+    
+    outOfBounds.link(this);
+    slowCases.append(branch32(AboveOrEqual, regT2, Address(regT3, Butterfly::offsetOfVectorLength())));
+    
+    emitArrayProfileStoreToHoleSpecialCase(profile);
+    
+    add32(TrustedImm32(1), regT2, regT1);
+    store32(regT1, Address(regT3, Butterfly::offsetOfPublicLength()));
+    jump().linkTo(storeResult, this);
+    
+    done.link(this);
+    
+    return slowCases;
+}
+
+JIT::JumpList JIT::emitArrayStoragePutByVal(Instruction* currentInstruction, PatchableJump& badType)
+{
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    
+    JumpList slowCases;
+    
+    badType = patchableBranch32(NotEqual, regT1, TrustedImm32(ArrayStorageShape));
+    
+    loadPtr(Address(regT0, JSObject::butterflyOffset()), regT3);
+    slowCases.append(branch32(AboveOrEqual, regT2, Address(regT3, ArrayStorage::vectorLengthOffset())));
+
+    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
+    
+    Label storeResult(this);
+    emitLoad(value, regT1, regT0);
+    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload))); // payload
+    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag))); // tag
+    Jump end = jump();
+    
+    empty.link(this);
+    emitArrayProfileStoreToHoleSpecialCase(profile);
+    add32(TrustedImm32(1), Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+    branch32(Below, regT2, Address(regT3, ArrayStorage::lengthOffset())).linkTo(storeResult, this);
+    
+    add32(TrustedImm32(1), regT2, regT0);
+    store32(regT0, Address(regT3, ArrayStorage::lengthOffset()));
+    jump().linkTo(storeResult, this);
+    
+    end.link(this);
+    
+    emitWriteBarrier(base, value, ShouldFilterValue);
+    
+    return slowCases;
+}
+
+JITPutByIdGenerator JIT::emitPutByValWithCachedId(ByValInfo* byValInfo, Instruction* currentInstruction, PutKind putKind, const Identifier& propertyName, JumpList& doneCases, JumpList& slowCases)
+{
+    // base: tag(regT1), payload(regT0)
+    // property: tag(regT3), payload(regT2)
+
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+
+    slowCases.append(branch32(NotEqual, regT3, TrustedImm32(JSValue::CellTag)));
+    emitByValIdentifierCheck(byValInfo, regT2, regT2, propertyName, slowCases);
+
+    // Write barrier breaks the registers. So after issuing the write barrier,
+    // reload the registers.
+    emitWriteBarrier(base, value, ShouldFilterBase);
+    emitLoadPayload(base, regT0);
+    emitLoad(value, regT3, regT2);
+
+    JITPutByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(currentInstruction), RegisterSet::stubUnavailableRegisters(),
+        JSValueRegs::payloadOnly(regT0), JSValueRegs(regT3, regT2), regT1, m_codeBlock->ecmaMode(), putKind);
+    gen.generateFastPath(*this);
+    doneCases.append(jump());
+
+    Label coldPathBegin = label();
+    gen.slowPathJump().link(this);
+
+    // JITPutByIdGenerator only preserve the value and the base's payload, we have to reload the tag.
+    emitLoadTag(base, regT1);
+
+    Call call = callOperation(gen.slowPathFunction(), gen.stubInfo(), regT3, regT2, regT1, regT0, propertyName.impl());
+    gen.reportSlowPathCall(coldPathBegin, call);
+    doneCases.append(jump());
+
+    return gen;
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[1].u.operand;
+    int property = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+    ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+    ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
+    
+    linkSlowCaseIfNotJSCell(iter, base); // base cell check
+    linkSlowCase(iter); // property int32 check
+    linkSlowCase(iter); // base not array check
+    
+    JITArrayMode mode = chooseArrayMode(profile);
+    switch (mode) {
+    case JITInt32:
+    case JITDouble:
+        linkSlowCase(iter); // value type check
+        break;
+    default:
+        break;
+    }
+    
+    Jump skipProfiling = jump();
+    linkSlowCase(iter); // out of bounds
+    emitArrayProfileOutOfBoundsSpecialCase(profile);
+    skipProfiling.link(this);
+
+    Label slowPath = label();
+    
+    bool isDirect = m_interpreter->getOpcodeID(currentInstruction->u.opcode) == op_put_by_val_direct;
+
+#if CPU(X86)
+    // FIXME: We only have 5 temp registers, but need 6 to make this call, therefore we materialize
+    // our own call. When we finish moving JSC to the C call stack, we'll get another register so
+    // we can use the normal case.
+    resetCallArguments();
+    addCallArgument(GPRInfo::callFrameRegister);
+    emitLoad(base, regT0, regT1);
+    addCallArgument(regT1);
+    addCallArgument(regT0);
+    emitLoad(property, regT0, regT1);
+    addCallArgument(regT1);
+    addCallArgument(regT0);
+    emitLoad(value, regT0, regT1);
+    addCallArgument(regT1);
+    addCallArgument(regT0);
+    addCallArgument(TrustedImmPtr(byValInfo));
+    Call call = appendCallWithExceptionCheck(isDirect ? operationDirectPutByValOptimize : operationPutByValOptimize);
+#else
+    // The register selection below is chosen to reduce register swapping on ARM.
+    // Swapping shouldn't happen on other platforms.
+    emitLoad(base, regT2, regT1);
+    emitLoad(property, regT3, regT0);
+    emitLoad(value, regT5, regT4);
+    Call call = callOperation(isDirect ? operationDirectPutByValOptimize : operationPutByValOptimize, regT2, regT1, regT3, regT0, regT5, regT4, byValInfo);
+#endif
+
+    m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
+    m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
+    m_byValInstructionIndex++;
+}
+
+void JIT::emit_op_try_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+
+    JITGetByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(currentInstruction), RegisterSet::stubUnavailableRegisters(),
+        ident->impl(), JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0), AccessType::GetPure);
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    m_getByIds.append(gen);
+    
+    emitValueProfilingSite();
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_try_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    linkSlowCaseIfNotJSCell(iter, baseVReg);
+    linkSlowCase(iter);
+
+    JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];
+
+    Label coldPathBegin = label();
+
+    Call call = callOperation(operationTryGetByIdOptimize, resultVReg, gen.stubInfo(), regT1, regT0, ident->impl());
+    
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+    
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+
+    if (*ident == m_vm->propertyNames->length && shouldEmitProfiling())
+        emitArrayProfilingSiteForBytecodeIndexWithCell(regT0, regT2, m_bytecodeOffset);
+
+    JITGetByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(currentInstruction), RegisterSet::stubUnavailableRegisters(),
+        ident->impl(), JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0), AccessType::Get);
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    m_getByIds.append(gen);
+
+    emitValueProfilingSite();
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    linkSlowCaseIfNotJSCell(iter, baseVReg);
+    linkSlowCase(iter);
+
+    JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];
+    
+    Label coldPathBegin = label();
+    
+    Call call = callOperation(WithProfile, operationGetByIdOptimize, resultVReg, gen.stubInfo(), regT1, regT0, ident->impl());
+    
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
+{
+    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
+    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
+    // such that the Structure & offset are always at the same distance from this.
+    
+    int base = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+    int direct = currentInstruction[8].u.putByIdFlags & PutByIdIsDirect;
+    
+    emitLoad2(base, regT1, regT0, value, regT3, regT2);
+    
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+
+    JITPutByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(currentInstruction), RegisterSet::stubUnavailableRegisters(),
+        JSValueRegs::payloadOnly(regT0), JSValueRegs(regT3, regT2),
+        regT1, m_codeBlock->ecmaMode(), direct ? Direct : NotDirect);
+    
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    
+    emitWriteBarrier(base, value, ShouldFilterBase);
+
+    m_putByIds.append(gen);
+}
+
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int base = currentInstruction[1].u.operand;
+    const Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
+
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    
+    Label coldPathBegin(this);
+
+    // JITPutByIdGenerator only preserve the value and the base's payload, we have to reload the tag.
+    emitLoadTag(base, regT1);
+
+    JITPutByIdGenerator& gen = m_putByIds[m_putByIdIndex++];
+    
+    Call call = callOperation(
+        gen.slowPathFunction(), gen.stubInfo(), regT3, regT2, regT1, regT0, ident->impl());
+    
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+void JIT::emitVarInjectionCheck(bool needsVarInjectionChecks)
+{
+    if (!needsVarInjectionChecks)
+        return;
+    addSlowCase(branch8(Equal, AbsoluteAddress(m_codeBlock->globalObject()->varInjectionWatchpoint()->addressOfState()), TrustedImm32(IsInvalidated)));
+}
+
+void JIT::emitResolveClosure(int dst, int scope, bool needsVarInjectionChecks, unsigned depth)
+{
+    emitVarInjectionCheck(needsVarInjectionChecks);
+    move(TrustedImm32(JSValue::CellTag), regT1);
+    emitLoadPayload(scope, regT0);
+    for (unsigned i = 0; i < depth; ++i)
+        loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emit_op_resolve_scope(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int scope = currentInstruction[2].u.operand;
+    ResolveType resolveType = static_cast<ResolveType>(currentInstruction[4].u.operand);
+    unsigned depth = currentInstruction[5].u.operand;
+    auto emitCode = [&] (ResolveType resolveType) {
+        switch (resolveType) {
+        case GlobalProperty:
+        case GlobalVar:
+        case GlobalLexicalVar:
+        case GlobalPropertyWithVarInjectionChecks:
+        case GlobalVarWithVarInjectionChecks: 
+        case GlobalLexicalVarWithVarInjectionChecks: {
+            JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
+            RELEASE_ASSERT(constantScope);
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            move(TrustedImm32(JSValue::CellTag), regT1);
+            move(TrustedImmPtr(constantScope), regT0);
+            emitStore(dst, regT1, regT0);
+            break;
+        }
+        case ClosureVar:
+        case ClosureVarWithVarInjectionChecks:
+            emitResolveClosure(dst, scope, needsVarInjectionChecks(resolveType), depth);
+            break;
+        case ModuleVar:
+            move(TrustedImm32(JSValue::CellTag), regT1);
+            move(TrustedImmPtr(currentInstruction[6].u.jsCell.get()), regT0);
+            emitStore(dst, regT1, regT0);
+            break;
+        case Dynamic:
+            addSlowCase(jump());
+            break;
+        case LocalClosureVar:
+        case UnresolvedProperty:
+        case UnresolvedPropertyWithVarInjectionChecks:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    };
+    switch (resolveType) {
+    case UnresolvedProperty:
+    case UnresolvedPropertyWithVarInjectionChecks: {
+        JumpList skipToEnd;
+        load32(&currentInstruction[4], regT0);
+
+        Jump notGlobalProperty = branch32(NotEqual, regT0, TrustedImm32(GlobalProperty));
+        emitCode(GlobalProperty);
+        skipToEnd.append(jump());
+        notGlobalProperty.link(this);
+
+        Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+        emitCode(GlobalPropertyWithVarInjectionChecks);
+        skipToEnd.append(jump());
+        notGlobalPropertyWithVarInjections.link(this);
+
+        Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+        emitCode(GlobalLexicalVar);
+        skipToEnd.append(jump());
+        notGlobalLexicalVar.link(this);
+
+        Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+        emitCode(GlobalLexicalVarWithVarInjectionChecks);
+        skipToEnd.append(jump());
+        notGlobalLexicalVarWithVarInjections.link(this);
+
+        addSlowCase(jump());
+        skipToEnd.link(this);
+        break;
+    }
+
+    default:
+        emitCode(resolveType);
+        break;
+    }
+}
+
+void JIT::emitSlow_op_resolve_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    ResolveType resolveType = static_cast<ResolveType>(currentInstruction[4].u.operand);
+
+    if (resolveType == GlobalProperty || resolveType == GlobalVar || resolveType == ClosureVar || resolveType == GlobalLexicalVar || resolveType == ModuleVar)
+        return;
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        linkSlowCase(iter); // Var injections check for GlobalPropertyWithVarInjectionChecks.
+        linkSlowCase(iter); // Var injections check for GlobalLexicalVarWithVarInjectionChecks.
+    }
+
+    linkSlowCase(iter);
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_resolve_scope);
+    slowPathCall.call();
+}
+
+void JIT::emitLoadWithStructureCheck(int scope, Structure** structureSlot)
+{
+    emitLoad(scope, regT1, regT0);
+    loadPtr(structureSlot, regT2);
+    addSlowCase(branchPtr(NotEqual, Address(regT0, JSCell::structureIDOffset()), regT2));
+}
+
+void JIT::emitGetVarFromPointer(JSValue* operand, GPRReg tag, GPRReg payload)
+{
+    uintptr_t rawAddress = bitwise_cast<uintptr_t>(operand);
+    load32(bitwise_cast<void*>(rawAddress + TagOffset), tag);
+    load32(bitwise_cast<void*>(rawAddress + PayloadOffset), payload);
+}
+void JIT::emitGetVarFromIndirectPointer(JSValue** operand, GPRReg tag, GPRReg payload)
+{
+    loadPtr(operand, payload);
+    load32(Address(payload, TagOffset), tag);
+    load32(Address(payload, PayloadOffset), payload);
+}
+
+void JIT::emitGetClosureVar(int scope, uintptr_t operand)
+{
+    emitLoad(scope, regT1, regT0);
+    load32(Address(regT0, JSEnvironmentRecord::offsetOfVariables() + operand * sizeof(Register) + TagOffset), regT1);
+    load32(Address(regT0, JSEnvironmentRecord::offsetOfVariables() + operand * sizeof(Register) + PayloadOffset), regT0);
+}
+
+void JIT::emit_op_get_from_scope(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int scope = currentInstruction[2].u.operand;
+    ResolveType resolveType = GetPutInfo(currentInstruction[4].u.operand).resolveType();
+    Structure** structureSlot = currentInstruction[5].u.structure.slot();
+    uintptr_t* operandSlot = reinterpret_cast<uintptr_t*>(&currentInstruction[6].u.pointer);
+    
+    auto emitCode = [&] (ResolveType resolveType, bool indirectLoadForOperand) {
+        switch (resolveType) {
+        case GlobalProperty:
+        case GlobalPropertyWithVarInjectionChecks: {
+            emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+            GPRReg base = regT2;
+            GPRReg resultTag = regT1;
+            GPRReg resultPayload = regT0;
+            GPRReg offset = regT3;
+            
+            move(regT0, base);
+            load32(operandSlot, offset);
+            if (!ASSERT_DISABLED) {
+                Jump isOutOfLine = branch32(GreaterThanOrEqual, offset, TrustedImm32(firstOutOfLineOffset));
+                abortWithReason(JITOffsetIsNotOutOfLine);
+                isOutOfLine.link(this);
+            }
+            loadPtr(Address(base, JSObject::butterflyOffset()), base);
+            neg32(offset);
+            load32(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload) + (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)), resultPayload);
+            load32(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag) + (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)), resultTag);
+            break;
+        }
+        case GlobalVar:
+        case GlobalVarWithVarInjectionChecks:
+        case GlobalLexicalVar:
+        case GlobalLexicalVarWithVarInjectionChecks:
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            if (indirectLoadForOperand)
+                emitGetVarFromIndirectPointer(bitwise_cast<JSValue**>(operandSlot), regT1, regT0);
+            else
+                emitGetVarFromPointer(bitwise_cast<JSValue*>(*operandSlot), regT1, regT0);
+            if (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks) // TDZ check.
+                addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
+            break;
+        case ClosureVar:
+        case ClosureVarWithVarInjectionChecks:
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            emitGetClosureVar(scope, *operandSlot);
+            break;
+        case Dynamic:
+            addSlowCase(jump());
+            break;
+        case ModuleVar:
+        case LocalClosureVar:
+        case UnresolvedProperty:
+        case UnresolvedPropertyWithVarInjectionChecks:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    };
+
+    switch (resolveType) {
+    case UnresolvedProperty:
+    case UnresolvedPropertyWithVarInjectionChecks: {
+        JumpList skipToEnd;
+        load32(&currentInstruction[4], regT0);
+        and32(TrustedImm32(GetPutInfo::typeBits), regT0); // Load ResolveType into T0
+
+        Jump isGlobalProperty = branch32(Equal, regT0, TrustedImm32(GlobalProperty));
+        Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+        isGlobalProperty.link(this);
+        emitCode(GlobalProperty, false);
+        skipToEnd.append(jump());
+        notGlobalPropertyWithVarInjections.link(this);
+
+        Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+        emitCode(GlobalLexicalVar, true);
+        skipToEnd.append(jump());
+        notGlobalLexicalVar.link(this);
+
+        Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+        emitCode(GlobalLexicalVarWithVarInjectionChecks, true);
+        skipToEnd.append(jump());
+        notGlobalLexicalVarWithVarInjections.link(this);
+
+        addSlowCase(jump());
+
+        skipToEnd.link(this);
+        break;
+    }
+
+    default:
+        emitCode(resolveType, false);
+        break;
+    }
+    emitValueProfilingSite();
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_from_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = currentInstruction[1].u.operand;
+    ResolveType resolveType = GetPutInfo(currentInstruction[4].u.operand).resolveType();
+
+    if (resolveType == GlobalVar || resolveType == ClosureVar)
+        return;
+
+    if (resolveType == GlobalLexicalVarWithVarInjectionChecks) // Var Injections check.
+        linkSlowCase(iter);
+
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        // GlobalProperty/GlobalPropertyWithVarInjectionChecks
+        linkSlowCase(iter); // emitLoadWithStructureCheck
+        // GlobalLexicalVar
+        linkSlowCase(iter); // TDZ check.
+        // GlobalLexicalVarWithVarInjectionChecks.
+        linkSlowCase(iter); // var injection check.
+        linkSlowCase(iter); // TDZ check.
+    }
+
+    linkSlowCase(iter);
+    callOperation(WithProfile, operationGetFromScope, dst, currentInstruction);
+}
+
+void JIT::emitPutGlobalVariable(JSValue* operand, int value, WatchpointSet* set)
+{
+    emitLoad(value, regT1, regT0);
+    emitNotifyWrite(set);
+    uintptr_t rawAddress = bitwise_cast<uintptr_t>(operand);
+    store32(regT1, bitwise_cast<void*>(rawAddress + TagOffset));
+    store32(regT0, bitwise_cast<void*>(rawAddress + PayloadOffset));
+}
+
+void JIT::emitPutGlobalVariableIndirect(JSValue** addressOfOperand, int value, WatchpointSet** indirectWatchpointSet)
+{
+    emitLoad(value, regT1, regT0);
+    loadPtr(indirectWatchpointSet, regT2);
+    emitNotifyWrite(regT2);
+    loadPtr(addressOfOperand, regT2);
+    store32(regT1, Address(regT2, TagOffset));
+    store32(regT0, Address(regT2, PayloadOffset));
+}
+
+void JIT::emitPutClosureVar(int scope, uintptr_t operand, int value, WatchpointSet* set)
+{
+    emitLoad(value, regT3, regT2);
+    emitLoad(scope, regT1, regT0);
+    emitNotifyWrite(set);
+    store32(regT3, Address(regT0, JSEnvironmentRecord::offsetOfVariables() + operand * sizeof(Register) + TagOffset));
+    store32(regT2, Address(regT0, JSEnvironmentRecord::offsetOfVariables() + operand * sizeof(Register) + PayloadOffset));
+}
+
+void JIT::emit_op_put_to_scope(Instruction* currentInstruction)
+{
+    int scope = currentInstruction[1].u.operand;
+    int value = currentInstruction[3].u.operand;
+    GetPutInfo getPutInfo = GetPutInfo(currentInstruction[4].u.operand);
+    ResolveType resolveType = getPutInfo.resolveType();
+    Structure** structureSlot = currentInstruction[5].u.structure.slot();
+    uintptr_t* operandSlot = reinterpret_cast<uintptr_t*>(&currentInstruction[6].u.pointer);
+    
+    auto emitCode = [&] (ResolveType resolveType, bool indirectLoadForOperand) {
+        switch (resolveType) {
+        case GlobalProperty:
+        case GlobalPropertyWithVarInjectionChecks: {
+            emitWriteBarrier(m_codeBlock->globalObject(), value, ShouldFilterValue);
+            emitLoadWithStructureCheck(scope, structureSlot); // Structure check covers var injection.
+            emitLoad(value, regT3, regT2);
+            
+            loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
+            loadPtr(operandSlot, regT1);
+            negPtr(regT1);
+            store32(regT3, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+            store32(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+            break;
+        }
+        case GlobalVar:
+        case GlobalVarWithVarInjectionChecks:
+        case GlobalLexicalVar:
+        case GlobalLexicalVarWithVarInjectionChecks: {
+            JSScope* constantScope = JSScope::constantScopeForCodeBlock(resolveType, m_codeBlock);
+            RELEASE_ASSERT(constantScope);
+            emitWriteBarrier(constantScope, value, ShouldFilterValue);
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            if (!isInitialization(getPutInfo.initializationMode()) && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) {
+                // We need to do a TDZ check here because we can't always prove we need to emit TDZ checks statically.
+                if (indirectLoadForOperand)
+                    emitGetVarFromIndirectPointer(bitwise_cast<JSValue**>(operandSlot), regT1, regT0);
+                else
+                    emitGetVarFromPointer(bitwise_cast<JSValue*>(*operandSlot), regT1, regT0);
+                addSlowCase(branch32(Equal, regT1, TrustedImm32(JSValue::EmptyValueTag)));
+            }
+            if (indirectLoadForOperand)
+                emitPutGlobalVariableIndirect(bitwise_cast<JSValue**>(operandSlot), value, bitwise_cast<WatchpointSet**>(&currentInstruction[5]));
+            else
+                emitPutGlobalVariable(bitwise_cast<JSValue*>(*operandSlot), value, currentInstruction[5].u.watchpointSet);
+            break;
+        }
+        case LocalClosureVar:
+        case ClosureVar:
+        case ClosureVarWithVarInjectionChecks:
+            emitWriteBarrier(scope, value, ShouldFilterValue);
+            emitVarInjectionCheck(needsVarInjectionChecks(resolveType));
+            emitPutClosureVar(scope, *operandSlot, value, currentInstruction[5].u.watchpointSet);
+            break;
+        case ModuleVar:
+        case Dynamic:
+            addSlowCase(jump());
+            break;
+        case UnresolvedProperty:
+        case UnresolvedPropertyWithVarInjectionChecks:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    };
+
+    switch (resolveType) {
+    case UnresolvedProperty:
+    case UnresolvedPropertyWithVarInjectionChecks: {
+        JumpList skipToEnd;
+        load32(&currentInstruction[4], regT0);
+        and32(TrustedImm32(GetPutInfo::typeBits), regT0); // Load ResolveType into T0
+
+        Jump isGlobalProperty = branch32(Equal, regT0, TrustedImm32(GlobalProperty));
+        Jump notGlobalPropertyWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalPropertyWithVarInjectionChecks));
+        isGlobalProperty.link(this);
+        emitCode(GlobalProperty, false);
+        skipToEnd.append(jump());
+        notGlobalPropertyWithVarInjections.link(this);
+
+        Jump notGlobalLexicalVar = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVar));
+        emitCode(GlobalLexicalVar, true);
+        skipToEnd.append(jump());
+        notGlobalLexicalVar.link(this);
+
+        Jump notGlobalLexicalVarWithVarInjections = branch32(NotEqual, regT0, TrustedImm32(GlobalLexicalVarWithVarInjectionChecks));
+        emitCode(GlobalLexicalVarWithVarInjectionChecks, true);
+        skipToEnd.append(jump());
+        notGlobalLexicalVarWithVarInjections.link(this);
+
+        addSlowCase(jump());
+
+        skipToEnd.link(this);
+        break;
+    }
+
+    default:
+        emitCode(resolveType, false);
+        break;
+    }
+}
+
+void JIT::emitSlow_op_put_to_scope(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    GetPutInfo getPutInfo = GetPutInfo(currentInstruction[4].u.operand);
+    ResolveType resolveType = getPutInfo.resolveType();
+    unsigned linkCount = 0;
+    if (resolveType != GlobalVar && resolveType != ClosureVar && resolveType != LocalClosureVar && resolveType != GlobalLexicalVar)
+        linkCount++;
+    if (resolveType == GlobalVar || resolveType == GlobalVarWithVarInjectionChecks 
+        || resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks 
+        || resolveType == ClosureVar || resolveType == ClosureVarWithVarInjectionChecks
+        || resolveType == LocalClosureVar)
+        linkCount++;
+    if (!isInitialization(getPutInfo.initializationMode()) && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) // TDZ check.
+        linkCount++;
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        // GlobalProperty/GlobalPropertyWithVarInjectionsCheck
+        linkCount++; // emitLoadWithStructureCheck
+
+        // GlobalLexicalVar
+        bool needsTDZCheck = !isInitialization(getPutInfo.initializationMode());
+        if (needsTDZCheck)
+            linkCount++;
+        linkCount++; // Notify write check.
+
+        // GlobalLexicalVarWithVarInjectionsCheck
+        linkCount++; // var injection check.
+        if (needsTDZCheck)
+            linkCount++;
+        linkCount++; // Notify write check.
+    }
+    if (!linkCount)
+        return;
+    while (linkCount--)
+        linkSlowCase(iter);
+
+    if (resolveType == ModuleVar) {
+        JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_throw_strict_mode_readonly_property_write_error);
+        slowPathCall.call();
+    } else
+        callOperation(operationPutToScope, currentInstruction);
+}
+
+void JIT::emit_op_get_from_arguments(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int arguments = currentInstruction[2].u.operand;
+    int index = currentInstruction[3].u.operand;
+    
+    emitLoadPayload(arguments, regT0);
+    load32(Address(regT0, DirectArguments::storageOffset() + index * sizeof(WriteBarrier<Unknown>) + TagOffset), regT1);
+    load32(Address(regT0, DirectArguments::storageOffset() + index * sizeof(WriteBarrier<Unknown>) + PayloadOffset), regT0);
+    emitValueProfilingSite();
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emit_op_put_to_arguments(Instruction* currentInstruction)
+{
+    int arguments = currentInstruction[1].u.operand;
+    int index = currentInstruction[2].u.operand;
+    int value = currentInstruction[3].u.operand;
+    
+    emitWriteBarrier(arguments, value, ShouldFilterValue);
+    
+    emitLoadPayload(arguments, regT0);
+    emitLoad(value, regT1, regT2);
+    store32(regT1, Address(regT0, DirectArguments::storageOffset() + index * sizeof(WriteBarrier<Unknown>) + TagOffset));
+    store32(regT2, Address(regT0, DirectArguments::storageOffset() + index * sizeof(WriteBarrier<Unknown>) + PayloadOffset));
+}
+
+void JIT::emit_op_get_by_id_with_this(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_by_id_with_this);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_get_by_val_with_this(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_by_val_with_this);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_put_by_id_with_this(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_put_by_id_with_this);
+    slowPathCall.call();
+}
+
+void JIT::emit_op_put_by_val_with_this(Instruction* currentInstruction)
+{
+    JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_put_by_val_with_this);
+    slowPathCall.call();
+}
+
+} // namespace JSC
+
+#endif // USE(JSVALUE32_64)
+#endif // ENABLE(JIT)
diff --git a/jit/JITRightShiftGenerator.cpp b/jit/JITRightShiftGenerator.cpp
new file mode 100644
index 0000000..4e75faf
--- /dev/null
+++ b/jit/JITRightShiftGenerator.cpp
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITRightShiftGenerator.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+void JITRightShiftGenerator::generateFastPath(CCallHelpers& jit)
+{
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_left.payloadGPR());
+    ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE32_64)
+    ASSERT(m_scratchGPR != m_left.tagGPR());
+    ASSERT(m_scratchGPR != m_right.tagGPR());
+    ASSERT(m_scratchFPR != InvalidFPRReg);
+#endif
+
+    ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+
+    m_didEmitFastPath = true;
+
+    if (m_rightOperand.isConstInt32()) {
+        // Try to do (intVar >> intConstant).
+        CCallHelpers::Jump notInt = jit.branchIfNotInt32(m_left);
+
+        jit.moveValueRegs(m_left, m_result);
+        int32_t shiftAmount = m_rightOperand.asConstInt32() & 0x1f;
+        if (shiftAmount) {
+            if (m_shiftType == SignedShift)
+                jit.rshift32(CCallHelpers::Imm32(shiftAmount), m_result.payloadGPR());
+            else
+                jit.urshift32(CCallHelpers::Imm32(shiftAmount), m_result.payloadGPR());
+#if USE(JSVALUE64)
+            jit.or64(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR());
+#endif
+        }
+
+        if (jit.supportsFloatingPointTruncate()) {
+            m_endJumpList.append(jit.jump()); // Terminate the above case before emitting more code.
+
+            // Try to do (doubleVar >> intConstant).
+            notInt.link(&jit);
+
+            m_slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+
+            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+            m_slowPathJumpList.append(jit.branchTruncateDoubleToInt32(m_leftFPR, m_scratchGPR));
+
+            if (shiftAmount) {
+                if (m_shiftType == SignedShift)
+                    jit.rshift32(CCallHelpers::Imm32(shiftAmount), m_scratchGPR);
+                else
+                    jit.urshift32(CCallHelpers::Imm32(shiftAmount), m_scratchGPR);
+            }
+            jit.boxInt32(m_scratchGPR, m_result);
+
+        } else
+            m_slowPathJumpList.append(notInt);
+
+    } else {
+        // Try to do (intConstant >> intVar) or (intVar >> intVar).
+        m_slowPathJumpList.append(jit.branchIfNotInt32(m_right));
+
+        GPRReg rightOperandGPR = m_right.payloadGPR();
+        if (rightOperandGPR == m_result.payloadGPR())
+            rightOperandGPR = m_scratchGPR;
+
+        CCallHelpers::Jump leftNotInt;
+        if (m_leftOperand.isConstInt32()) {
+            jit.move(m_right.payloadGPR(), rightOperandGPR);
+#if USE(JSVALUE32_64)
+            jit.move(m_right.tagGPR(), m_result.tagGPR());
+#endif
+            jit.move(CCallHelpers::Imm32(m_leftOperand.asConstInt32()), m_result.payloadGPR());
+        } else {
+            leftNotInt = jit.branchIfNotInt32(m_left);
+            jit.move(m_right.payloadGPR(), rightOperandGPR);
+            jit.moveValueRegs(m_left, m_result);
+        }
+
+        if (m_shiftType == SignedShift)
+            jit.rshift32(rightOperandGPR, m_result.payloadGPR());
+        else
+            jit.urshift32(rightOperandGPR, m_result.payloadGPR());
+#if USE(JSVALUE64)
+        jit.or64(GPRInfo::tagTypeNumberRegister, m_result.payloadGPR());
+#endif
+        if (m_leftOperand.isConstInt32())
+            return;
+
+        if (jit.supportsFloatingPointTruncate()) {
+            m_endJumpList.append(jit.jump()); // Terminate the above case before emitting more code.
+
+            // Try to do (doubleVar >> intVar).
+            leftNotInt.link(&jit);
+
+            m_slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+            jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+            m_slowPathJumpList.append(jit.branchTruncateDoubleToInt32(m_leftFPR, m_scratchGPR));
+
+            if (m_shiftType == SignedShift)
+                jit.rshift32(m_right.payloadGPR(), m_scratchGPR);
+            else
+                jit.urshift32(m_right.payloadGPR(), m_scratchGPR);
+            jit.boxInt32(m_scratchGPR, m_result);
+
+        } else
+            m_slowPathJumpList.append(leftNotInt);
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITRightShiftGenerator.h b/jit/JITRightShiftGenerator.h
new file mode 100644
index 0000000..fa8c3e3
--- /dev/null
+++ b/jit/JITRightShiftGenerator.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JITBitBinaryOpGenerator.h"
+
+namespace JSC {
+
+class JITRightShiftGenerator : public JITBitBinaryOpGenerator {
+public:
+    enum ShiftType {
+        SignedShift,
+        UnsignedShift
+    };
+
+    JITRightShiftGenerator(const SnippetOperand& leftOperand, const SnippetOperand& rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right,
+        FPRReg leftFPR, GPRReg scratchGPR, FPRReg scratchFPR, ShiftType type = SignedShift)
+        : JITBitBinaryOpGenerator(leftOperand, rightOperand, result, left, right, scratchGPR)
+        , m_shiftType(type)
+        , m_leftFPR(leftFPR)
+        , m_scratchFPR(scratchFPR)
+    { }
+
+    void generateFastPath(CCallHelpers&);
+
+private:
+    ShiftType m_shiftType;
+    FPRReg m_leftFPR;
+    FPRReg m_scratchFPR;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITStubRoutine.cpp b/jit/JITStubRoutine.cpp
new file mode 100644
index 0000000..74e5377
--- /dev/null
+++ b/jit/JITStubRoutine.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITStubRoutine.h"
+
+#if ENABLE(JIT)
+
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "SlotVisitor.h"
+
+namespace JSC {
+
+JITStubRoutine::~JITStubRoutine() { }
+
+bool JITStubRoutine::visitWeak(VM&)
+{
+    return true;
+}
+
+void JITStubRoutine::observeZeroRefCount()
+{
+    RELEASE_ASSERT(!m_refCount);
+    delete this;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/JITStubRoutine.h b/jit/JITStubRoutine.h
new file mode 100644
index 0000000..3047212
--- /dev/null
+++ b/jit/JITStubRoutine.h
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "ExecutableAllocator.h"
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+class JITStubRoutineSet;
+
+// This is a base-class for JIT stub routines, and also the class you want
+// to instantiate directly if you have a routine that does not need any
+// help from the GC. If in doubt, use one of the other stub routines. But
+// if you know for sure that the stub routine cannot be on the stack while
+// someone triggers a stub routine reset, then using this will speed up
+// memory reclamation. One case where a stub routine satisfies this
+// condition is if it doesn't make any calls, to either C++ or JS code. In
+// such a routine you know that it cannot be on the stack when anything
+// interesting happens.
+// See GCAwareJITStubRoutine.h for the other stub routines.
+class JITStubRoutine {
+    WTF_MAKE_NONCOPYABLE(JITStubRoutine);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JITStubRoutine(const MacroAssemblerCodeRef& code)
+        : m_code(code)
+        , m_refCount(1)
+    {
+    }
+    
+    // Use this if you want to pass a CodePtr to someone who insists on taking
+    // a RefPtr<JITStubRoutine>.
+    static Ref<JITStubRoutine> createSelfManagedRoutine(
+        MacroAssemblerCodePtr rawCodePointer)
+    {
+        return adoptRef(*new JITStubRoutine(MacroAssemblerCodeRef::createSelfManagedCodeRef(rawCodePointer)));
+    }
+    
+    virtual ~JITStubRoutine();
+    virtual void aboutToDie() { }
+    
+    // MacroAssemblerCodeRef is copyable, but at the cost of reference
+    // counting churn. Returning a reference is a good way of reducing
+    // the churn.
+    const MacroAssemblerCodeRef& code() const { return m_code; }
+    
+    static MacroAssemblerCodePtr asCodePtr(PassRefPtr<JITStubRoutine> stubRoutine)
+    {
+        if (!stubRoutine)
+            return MacroAssemblerCodePtr();
+        
+        MacroAssemblerCodePtr result = stubRoutine->code().code();
+        ASSERT(!!result);
+        return result;
+    }
+    
+    void ref()
+    {
+        m_refCount++;
+    }
+    
+    void deref()
+    {
+        if (--m_refCount)
+            return;
+        observeZeroRefCount();
+    }
+    
+    // Helpers for the GC to determine how to deal with marking JIT stub
+    // routines.
+    uintptr_t startAddress() const { return m_code.executableMemory()->startAsInteger(); }
+    uintptr_t endAddress() const { return m_code.executableMemory()->endAsInteger(); }
+    static uintptr_t addressStep() { return jitAllocationGranule; }
+    
+    static bool canPerformRangeFilter()
+    {
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+        return true;
+#else
+        return false;
+#endif
+    }
+    static uintptr_t filteringStartAddress()
+    {
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+        return startOfFixedExecutableMemoryPool;
+#else
+        UNREACHABLE_FOR_PLATFORM();
+        return 0;
+#endif
+    }
+    static size_t filteringExtentSize()
+    {
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+        return fixedExecutableMemoryPoolSize;
+#else
+        UNREACHABLE_FOR_PLATFORM();
+        return 0;
+#endif
+    }
+    static bool passesFilter(uintptr_t address)
+    {
+        if (!canPerformRangeFilter()) {
+            // Just check that the address doesn't use any special values that would make
+            // our hashtables upset.
+            return address >= jitAllocationGranule && address != std::numeric_limits<uintptr_t>::max();
+        }
+        
+        if (address - filteringStartAddress() >= filteringExtentSize())
+            return false;
+        
+        return true;
+    }
+    
+    // Return true if you are still valid after. Return false if you are now invalid. If you return
+    // false, you will usually not do any clearing because the idea is that you will simply be
+    // destroyed.
+    virtual bool visitWeak(VM&);
+
+protected:
+    virtual void observeZeroRefCount();
+
+    MacroAssemblerCodeRef m_code;
+    unsigned m_refCount;
+};
+
+// Helper for the creation of simple stub routines that need no help from the GC.
+#define FINALIZE_CODE_FOR_STUB(codeBlock, patchBuffer, dataLogFArguments) \
+    (adoptRef(new JITStubRoutine(FINALIZE_CODE_FOR((codeBlock), (patchBuffer), dataLogFArguments))))
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITStubsMSVC64.asm b/jit/JITStubsMSVC64.asm
new file mode 100644
index 0000000..ef9cd4e
--- /dev/null
+++ b/jit/JITStubsMSVC64.asm
@@ -0,0 +1,44 @@
+;/*
+; Copyright (C) 2014 Apple Inc. All rights reserved.
+;
+; Redistribution and use in source and binary forms, with or without
+; modification, are permitted provided that the following conditions
+; are met:
+; 1. Redistributions of source code must retain the above copyright
+;    notice, this list of conditions and the following disclaimer.
+; 2. Redistributions in binary form must reproduce the above copyright
+;    notice, this list of conditions and the following disclaimer in the
+;    documentation and/or other materials provided with the distribution.
+;
+; THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+; EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+; IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+; PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+; CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+; EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+; PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+; PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+; OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+; (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+; OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+;*/
+
+EXTERN getHostCallReturnValueWithExecState : near
+
+PUBLIC getHostCallReturnValue
+
+_TEXT   SEGMENT
+
+getHostCallReturnValue PROC
+    lea rcx, [rsp - 8]
+    ; Allocate space for all 4 parameter registers, and align stack pointer to 16 bytes boundary by allocating another 8 bytes.
+    ; The stack alignment is needed to fix a crash in the CRT library on a floating point instruction.
+    sub rsp, 40
+    call getHostCallReturnValueWithExecState
+    add rsp, 40
+    ret
+getHostCallReturnValue ENDP
+
+_TEXT   ENDS
+
+END
diff --git a/jit/JITSubGenerator.cpp b/jit/JITSubGenerator.cpp
new file mode 100644
index 0000000..795c275
--- /dev/null
+++ b/jit/JITSubGenerator.cpp
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITSubGenerator.h"
+
+#include "ArithProfile.h"
+#include "JITMathIC.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+JITMathICInlineResult JITSubGenerator::generateInline(CCallHelpers& jit, MathICGenerationState& state, const ArithProfile* arithProfile)
+{
+    // We default to speculating int32.
+    ObservedType lhs = ObservedType().withInt32();
+    ObservedType rhs = ObservedType().withInt32();
+    if (arithProfile) {
+        lhs = arithProfile->lhsObservedType();
+        rhs = arithProfile->rhsObservedType();
+    }
+
+    if (lhs.isOnlyNonNumber() && rhs.isOnlyNonNumber())
+        return JITMathICInlineResult::DontGenerate;
+
+    if (lhs.isOnlyNumber() && rhs.isOnlyNumber()) {
+        if (!jit.supportsFloatingPoint())
+            return JITMathICInlineResult::DontGenerate;
+
+        if (!m_leftOperand.definitelyIsNumber())
+            state.slowPathJumps.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+        if (!m_rightOperand.definitelyIsNumber())
+            state.slowPathJumps.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+        state.slowPathJumps.append(jit.branchIfInt32(m_left));
+        state.slowPathJumps.append(jit.branchIfInt32(m_right));
+        jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+        jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+        jit.subDouble(m_rightFPR, m_leftFPR);
+        jit.boxDouble(m_leftFPR, m_result);
+
+        return JITMathICInlineResult::GeneratedFastPath;
+    }
+    if (lhs.isOnlyInt32() && rhs.isOnlyInt32()) {
+        ASSERT(!m_leftOperand.isConstInt32() || !m_rightOperand.isConstInt32());
+        state.slowPathJumps.append(jit.branchIfNotInt32(m_left));
+        state.slowPathJumps.append(jit.branchIfNotInt32(m_right));
+
+        jit.move(m_left.payloadGPR(), m_scratchGPR);
+        state.slowPathJumps.append(jit.branchSub32(CCallHelpers::Overflow, m_right.payloadGPR(), m_scratchGPR));
+
+        jit.boxInt32(m_scratchGPR, m_result);
+        return JITMathICInlineResult::GeneratedFastPath;
+    }
+
+    return JITMathICInlineResult::GenerateFullSnippet;
+}
+
+bool JITSubGenerator::generateFastPath(CCallHelpers& jit, CCallHelpers::JumpList& endJumpList, CCallHelpers::JumpList& slowPathJumpList, const ArithProfile* arithProfile, bool shouldEmitProfiling)
+{
+    ASSERT(m_scratchGPR != InvalidGPRReg);
+    ASSERT(m_scratchGPR != m_left.payloadGPR());
+    ASSERT(m_scratchGPR != m_right.payloadGPR());
+#if USE(JSVALUE32_64)
+    ASSERT(m_scratchGPR != m_left.tagGPR());
+    ASSERT(m_scratchGPR != m_right.tagGPR());
+    ASSERT(m_scratchFPR != InvalidFPRReg);
+#endif
+
+    CCallHelpers::Jump leftNotInt = jit.branchIfNotInt32(m_left);
+    CCallHelpers::Jump rightNotInt = jit.branchIfNotInt32(m_right);
+
+    jit.move(m_left.payloadGPR(), m_scratchGPR);
+    slowPathJumpList.append(jit.branchSub32(CCallHelpers::Overflow, m_right.payloadGPR(), m_scratchGPR));
+
+    jit.boxInt32(m_scratchGPR, m_result);
+
+    endJumpList.append(jit.jump());
+
+    if (!jit.supportsFloatingPoint()) {
+        slowPathJumpList.append(leftNotInt);
+        slowPathJumpList.append(rightNotInt);
+        return true;
+    }
+
+    leftNotInt.link(&jit);
+    if (!m_leftOperand.definitelyIsNumber())
+        slowPathJumpList.append(jit.branchIfNotNumber(m_left, m_scratchGPR));
+    if (!m_rightOperand.definitelyIsNumber())
+        slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+    jit.unboxDoubleNonDestructive(m_left, m_leftFPR, m_scratchGPR, m_scratchFPR);
+    CCallHelpers::Jump rightIsDouble = jit.branchIfNotInt32(m_right);
+
+    jit.convertInt32ToDouble(m_right.payloadGPR(), m_rightFPR);
+    CCallHelpers::Jump rightWasInteger = jit.jump();
+
+    rightNotInt.link(&jit);
+    if (!m_rightOperand.definitelyIsNumber())
+        slowPathJumpList.append(jit.branchIfNotNumber(m_right, m_scratchGPR));
+
+    jit.convertInt32ToDouble(m_left.payloadGPR(), m_leftFPR);
+
+    rightIsDouble.link(&jit);
+    jit.unboxDoubleNonDestructive(m_right, m_rightFPR, m_scratchGPR, m_scratchFPR);
+
+    rightWasInteger.link(&jit);
+
+    jit.subDouble(m_rightFPR, m_leftFPR);
+    if (arithProfile && shouldEmitProfiling)
+        arithProfile->emitSetDouble(jit);
+
+    jit.boxDouble(m_leftFPR, m_result);
+
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITSubGenerator.h b/jit/JITSubGenerator.h
new file mode 100644
index 0000000..561f633
--- /dev/null
+++ b/jit/JITSubGenerator.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "JITMathICInlineResult.h"
+#include "SnippetOperand.h"
+
+namespace JSC {
+
+struct MathICGenerationState;
+
+class JITSubGenerator {
+public:
+    JITSubGenerator() { }
+
+    JITSubGenerator(SnippetOperand leftOperand, SnippetOperand rightOperand,
+        JSValueRegs result, JSValueRegs left, JSValueRegs right,
+        FPRReg leftFPR, FPRReg rightFPR, GPRReg scratchGPR, FPRReg scratchFPR)
+        : m_leftOperand(leftOperand)
+        , m_rightOperand(rightOperand)
+        , m_result(result)
+        , m_left(left)
+        , m_right(right)
+        , m_leftFPR(leftFPR)
+        , m_rightFPR(rightFPR)
+        , m_scratchGPR(scratchGPR)
+        , m_scratchFPR(scratchFPR)
+    { }
+
+    JITMathICInlineResult generateInline(CCallHelpers&, MathICGenerationState&, const ArithProfile*);
+    bool generateFastPath(CCallHelpers&, CCallHelpers::JumpList& endJumpList, CCallHelpers::JumpList& slowPathJumpList, const ArithProfile*, bool shouldEmitProfiling);
+
+    static bool isLeftOperandValidConstant(SnippetOperand) { return false; }
+    static bool isRightOperandValidConstant(SnippetOperand) { return false; }
+
+private:
+    SnippetOperand m_leftOperand;
+    SnippetOperand m_rightOperand;
+    JSValueRegs m_result;
+    JSValueRegs m_left;
+    JSValueRegs m_right;
+    FPRReg m_leftFPR;
+    FPRReg m_rightFPR;
+    GPRReg m_scratchGPR;
+    FPRReg m_scratchFPR;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITThunks.cpp b/jit/JITThunks.cpp
new file mode 100644
index 0000000..60c3cc7
--- /dev/null
+++ b/jit/JITThunks.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2012, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITThunks.h"
+
+#if ENABLE(JIT)
+
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "LLIntData.h"
+#include "VM.h"
+
+namespace JSC {
+
+JITThunks::JITThunks()
+    : m_hostFunctionStubMap(std::make_unique<HostFunctionStubMap>())
+{
+}
+
+JITThunks::~JITThunks()
+{
+}
+
+MacroAssemblerCodePtr JITThunks::ctiNativeCall(VM* vm)
+{
+    if (!vm->canUseJIT())
+        return MacroAssemblerCodePtr::createLLIntCodePtr(llint_native_call_trampoline);
+    return ctiStub(vm, nativeCallGenerator).code();
+}
+
+MacroAssemblerCodePtr JITThunks::ctiNativeConstruct(VM* vm)
+{
+    if (!vm->canUseJIT())
+        return MacroAssemblerCodePtr::createLLIntCodePtr(llint_native_construct_trampoline);
+    return ctiStub(vm, nativeConstructGenerator).code();
+}
+
+MacroAssemblerCodePtr JITThunks::ctiNativeTailCall(VM* vm)
+{
+    ASSERT(vm->canUseJIT());
+    return ctiStub(vm, nativeTailCallGenerator).code();
+}
+
+MacroAssemblerCodePtr JITThunks::ctiNativeTailCallWithoutSavedTags(VM* vm)
+{
+    ASSERT(vm->canUseJIT());
+    return ctiStub(vm, nativeTailCallWithoutSavedTagsGenerator).code();
+}
+
+MacroAssemblerCodeRef JITThunks::ctiStub(VM* vm, ThunkGenerator generator)
+{
+    LockHolder locker(m_lock);
+    CTIStubMap::AddResult entry = m_ctiStubMap.add(generator, MacroAssemblerCodeRef());
+    if (entry.isNewEntry) {
+        // Compilation thread can only retrieve existing entries.
+        ASSERT(!isCompilationThread());
+        entry.iterator->value = generator(vm);
+    }
+    return entry.iterator->value;
+}
+
+void JITThunks::finalize(Handle<Unknown> handle, void*)
+{
+    auto* nativeExecutable = static_cast<NativeExecutable*>(handle.get().asCell());
+    weakRemove(*m_hostFunctionStubMap, std::make_tuple(nativeExecutable->function(), nativeExecutable->constructor(), nativeExecutable->name()), nativeExecutable);
+}
+
+NativeExecutable* JITThunks::hostFunctionStub(VM* vm, NativeFunction function, NativeFunction constructor, const String& name)
+{
+    return hostFunctionStub(vm, function, constructor, nullptr, NoIntrinsic, nullptr, name);
+}
+
+NativeExecutable* JITThunks::hostFunctionStub(VM* vm, NativeFunction function, NativeFunction constructor, ThunkGenerator generator, Intrinsic intrinsic, const DOMJIT::Signature* signature, const String& name)
+{
+    ASSERT(!isCompilationThread());    
+    ASSERT(vm->canUseJIT());
+
+    if (NativeExecutable* nativeExecutable = m_hostFunctionStubMap->get(std::make_tuple(function, constructor, name)))
+        return nativeExecutable;
+
+    RefPtr<JITCode> forCall;
+    if (generator) {
+        MacroAssemblerCodeRef entry = generator(vm);
+        forCall = adoptRef(new DirectJITCode(entry, entry.code(), JITCode::HostCallThunk));
+    } else
+        forCall = adoptRef(new NativeJITCode(JIT::compileCTINativeCall(vm, function), JITCode::HostCallThunk));
+    
+    RefPtr<JITCode> forConstruct = adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct(vm)), JITCode::HostCallThunk));
+    
+    NativeExecutable* nativeExecutable = NativeExecutable::create(*vm, forCall, function, forConstruct, constructor, intrinsic, signature, name);
+    weakAdd(*m_hostFunctionStubMap, std::make_tuple(function, constructor, name), Weak<NativeExecutable>(nativeExecutable, this));
+    return nativeExecutable;
+}
+
+NativeExecutable* JITThunks::hostFunctionStub(VM* vm, NativeFunction function, ThunkGenerator generator, Intrinsic intrinsic, const String& name)
+{
+    return hostFunctionStub(vm, function, callHostFunctionAsConstructor, generator, intrinsic, nullptr, name);
+}
+
+void JITThunks::clearHostFunctionStubs()
+{
+    m_hostFunctionStubMap = nullptr;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITThunks.h b/jit/JITThunks.h
new file mode 100644
index 0000000..addcf23
--- /dev/null
+++ b/jit/JITThunks.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CallData.h"
+#include "Intrinsic.h"
+#include "MacroAssemblerCodeRef.h"
+#include "ThunkGenerator.h"
+#include "Weak.h"
+#include "WeakHandleOwner.h"
+#include <tuple>
+#include <wtf/HashMap.h>
+#include <wtf/ThreadingPrimitives.h>
+#include <wtf/text/StringHash.h>
+
+namespace JSC {
+namespace DOMJIT {
+class Signature;
+}
+
+class VM;
+class NativeExecutable;
+
+class JITThunks final : private WeakHandleOwner {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JITThunks();
+    virtual ~JITThunks();
+
+    MacroAssemblerCodePtr ctiNativeCall(VM*);
+    MacroAssemblerCodePtr ctiNativeConstruct(VM*);
+    MacroAssemblerCodePtr ctiNativeTailCall(VM*);    
+    MacroAssemblerCodePtr ctiNativeTailCallWithoutSavedTags(VM*);    
+
+    MacroAssemblerCodeRef ctiStub(VM*, ThunkGenerator);
+
+    NativeExecutable* hostFunctionStub(VM*, NativeFunction, NativeFunction constructor, const String& name);
+    NativeExecutable* hostFunctionStub(VM*, NativeFunction, NativeFunction constructor, ThunkGenerator, Intrinsic, const DOMJIT::Signature*, const String& name);
+    NativeExecutable* hostFunctionStub(VM*, NativeFunction, ThunkGenerator, Intrinsic, const String& name);
+
+    void clearHostFunctionStubs();
+
+private:
+    void finalize(Handle<Unknown>, void* context) override;
+    
+    typedef HashMap<ThunkGenerator, MacroAssemblerCodeRef> CTIStubMap;
+    CTIStubMap m_ctiStubMap;
+
+    typedef std::tuple<NativeFunction, NativeFunction, String> HostFunctionKey;
+
+    struct HostFunctionHash {
+        static unsigned hash(const HostFunctionKey& key)
+        {
+            unsigned hash = WTF::pairIntHash(hashPointer(std::get<0>(key)), hashPointer(std::get<1>(key)));
+            if (!std::get<2>(key).isNull())
+                hash = WTF::pairIntHash(hash, DefaultHash<String>::Hash::hash(std::get<2>(key)));
+            return hash;
+        }
+        static bool equal(const HostFunctionKey& a, const HostFunctionKey& b)
+        {
+            return (std::get<0>(a) == std::get<0>(b)) && (std::get<1>(a) == std::get<1>(b)) && (std::get<2>(a) == std::get<2>(b));
+        }
+        static const bool safeToCompareToEmptyOrDeleted = true;
+
+    private:
+        static inline unsigned hashPointer(NativeFunction p)
+        {
+            return DefaultHash<NativeFunction>::Hash::hash(p);
+        }
+    };
+
+    struct HostFunctionHashTrait : WTF::GenericHashTraits<HostFunctionKey> {
+        static const bool emptyValueIsZero = true;
+        static EmptyValueType emptyValue() { return std::make_tuple(nullptr, nullptr, String()); }
+
+        static void constructDeletedValue(HostFunctionKey& slot) { std::get<0>(slot) = reinterpret_cast<NativeFunction>(-1); }
+        static bool isDeletedValue(const HostFunctionKey& value) { return std::get<0>(value) == reinterpret_cast<NativeFunction>(-1); }
+    };
+    
+    typedef HashMap<HostFunctionKey, Weak<NativeExecutable>, HostFunctionHash, HostFunctionHashTrait> HostFunctionStubMap;
+    std::unique_ptr<HostFunctionStubMap> m_hostFunctionStubMap;
+    Lock m_lock;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JITToDFGDeferredCompilationCallback.cpp b/jit/JITToDFGDeferredCompilationCallback.cpp
new file mode 100644
index 0000000..471af9b
--- /dev/null
+++ b/jit/JITToDFGDeferredCompilationCallback.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITToDFGDeferredCompilationCallback.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+JITToDFGDeferredCompilationCallback::JITToDFGDeferredCompilationCallback() { }
+JITToDFGDeferredCompilationCallback::~JITToDFGDeferredCompilationCallback() { }
+
+Ref<JITToDFGDeferredCompilationCallback> JITToDFGDeferredCompilationCallback::create()
+{
+    return adoptRef(*new JITToDFGDeferredCompilationCallback());
+}
+
+void JITToDFGDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously(
+    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock)
+{
+    ASSERT_UNUSED(profiledDFGCodeBlock, !profiledDFGCodeBlock);
+    ASSERT(codeBlock->alternative()->jitType() == JITCode::BaselineJIT);
+    
+    if (Options::verboseOSR())
+        dataLog("Optimizing compilation of ", *codeBlock, " did become ready.\n");
+    
+    codeBlock->alternative()->forceOptimizationSlowPathConcurrently();
+}
+
+void JITToDFGDeferredCompilationCallback::compilationDidComplete(
+    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationResult result)
+{
+    ASSERT(!profiledDFGCodeBlock);
+    ASSERT(codeBlock->alternative()->jitType() == JITCode::BaselineJIT);
+    
+    if (Options::verboseOSR())
+        dataLog("Optimizing compilation of ", *codeBlock, " result: ", result, "\n");
+    
+    if (result == CompilationSuccessful)
+        codeBlock->ownerScriptExecutable()->installCode(codeBlock);
+    
+    codeBlock->alternative()->setOptimizationThresholdBasedOnCompilationResult(result);
+
+    DeferredCompilationCallback::compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
+}
+
+} // JSC
+
+#endif // ENABLE(DFG_JIT)
diff --git a/jit/JITToDFGDeferredCompilationCallback.h b/jit/JITToDFGDeferredCompilationCallback.h
new file mode 100644
index 0000000..ec53d75
--- /dev/null
+++ b/jit/JITToDFGDeferredCompilationCallback.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(DFG_JIT)
+
+#include "DeferredCompilationCallback.h"
+
+namespace JSC {
+
+class ScriptExecutable;
+
+class JITToDFGDeferredCompilationCallback : public DeferredCompilationCallback {
+protected:
+    JITToDFGDeferredCompilationCallback();
+
+public:
+    virtual ~JITToDFGDeferredCompilationCallback();
+
+    static Ref<JITToDFGDeferredCompilationCallback> create();
+    
+    void compilationDidBecomeReadyAsynchronously(CodeBlock*, CodeBlock* profiledDFGCodeBlock) override;
+    void compilationDidComplete(CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationResult) override;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(DFG_JIT)
diff --git a/jit/JITWorklist.cpp b/jit/JITWorklist.cpp
new file mode 100644
index 0000000..a013e1a
--- /dev/null
+++ b/jit/JITWorklist.cpp
@@ -0,0 +1,330 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITWorklist.h"
+
+#if ENABLE(JIT)
+
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "VMInlines.h"
+
+namespace JSC {
+
+class JITWorklist::Plan : public ThreadSafeRefCounted<JITWorklist::Plan> {
+public:
+    Plan(CodeBlock* codeBlock, unsigned loopOSREntryBytecodeOffset)
+        : m_codeBlock(codeBlock)
+        , m_jit(codeBlock->vm(), codeBlock, loopOSREntryBytecodeOffset)
+    {
+        m_jit.doMainThreadPreparationBeforeCompile();
+    }
+    
+    void compileInThread()
+    {
+        m_jit.compileWithoutLinking(JITCompilationCanFail);
+        
+        LockHolder locker(m_lock);
+        m_isFinishedCompiling = true;
+    }
+    
+    void finalize()
+    {
+        CompilationResult result = m_jit.link();
+        switch (result) {
+        case CompilationFailed:
+            CODEBLOCK_LOG_EVENT(m_codeBlock, "delayJITCompile", ("compilation failed"));
+            if (Options::verboseOSR())
+                dataLogF("    JIT compilation failed.\n");
+            m_codeBlock->dontJITAnytimeSoon();
+            m_codeBlock->m_didFailJITCompilation = true;
+            return;
+        case CompilationSuccessful:
+            if (Options::verboseOSR())
+                dataLogF("    JIT compilation successful.\n");
+            m_codeBlock->ownerScriptExecutable()->installCode(m_codeBlock);
+            m_codeBlock->jitSoon();
+            return;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+    
+    CodeBlock* codeBlock() { return m_codeBlock; }
+    VM* vm() { return m_codeBlock->vm(); }
+    
+    bool isFinishedCompiling()
+    {
+        LockHolder locker(m_lock);
+        return m_isFinishedCompiling;
+    }
+    
+    static void compileNow(CodeBlock* codeBlock, unsigned loopOSREntryBytecodeOffset)
+    {
+        Plan plan(codeBlock, loopOSREntryBytecodeOffset);
+        plan.compileInThread();
+        plan.finalize();
+    }
+    
+private:
+    CodeBlock* m_codeBlock;
+    JIT m_jit;
+    Lock m_lock;
+    bool m_isFinishedCompiling { false };
+};
+
+class JITWorklist::Thread : public AutomaticThread {
+public:
+    Thread(const LockHolder& locker, JITWorklist& worklist)
+        : AutomaticThread(locker, worklist.m_lock, worklist.m_condition)
+        , m_worklist(worklist)
+    {
+        m_worklist.m_numAvailableThreads++;
+    }
+    
+protected:
+    PollResult poll(const LockHolder&) override
+    {
+        RELEASE_ASSERT(m_worklist.m_numAvailableThreads);
+        
+        if (m_worklist.m_queue.isEmpty())
+            return PollResult::Wait;
+        
+        m_myPlans = WTFMove(m_worklist.m_queue);
+        m_worklist.m_numAvailableThreads--;
+        return PollResult::Work;
+    }
+    
+    WorkResult work() override
+    {
+        RELEASE_ASSERT(!m_myPlans.isEmpty());
+        
+        for (RefPtr<Plan>& plan : m_myPlans) {
+            plan->compileInThread();
+            plan = nullptr;
+            
+            // Make sure that the main thread realizes that we just compiled something. Notifying
+            // a condition is basically free if nobody is waiting.
+            LockHolder locker(*m_worklist.m_lock);
+            m_worklist.m_condition->notifyAll(locker);
+        }
+        
+        m_myPlans.clear();
+        
+        LockHolder locker(*m_worklist.m_lock);
+        m_worklist.m_numAvailableThreads++;
+        return WorkResult::Continue;
+    }
+    
+private:
+    JITWorklist& m_worklist;
+    Plans m_myPlans;
+};
+
+JITWorklist::JITWorklist()
+    : m_lock(Box<Lock>::create())
+    , m_condition(AutomaticThreadCondition::create())
+{
+    LockHolder locker(*m_lock);
+    m_thread = new Thread(locker, *this);
+}
+
+JITWorklist::~JITWorklist()
+{
+    UNREACHABLE_FOR_PLATFORM();
+}
+
+bool JITWorklist::completeAllForVM(VM& vm)
+{
+    bool result = false;
+    DeferGC deferGC(vm.heap);
+    for (;;) {
+        Vector<RefPtr<Plan>, 32> myPlans;
+        {
+            LockHolder locker(*m_lock);
+            for (;;) {
+                bool didFindUnfinishedPlan = false;
+                m_plans.removeAllMatching(
+                    [&] (RefPtr<Plan>& plan) {
+                        if (plan->vm() != &vm)
+                            return false;
+                        if (!plan->isFinishedCompiling()) {
+                            didFindUnfinishedPlan = true;
+                            return false;
+                        }
+                        myPlans.append(WTFMove(plan));
+                        return true;
+                    });
+                
+                // If we found plans then we should finalize them now.
+                if (!myPlans.isEmpty())
+                    break;
+                
+                // If we don't find plans, then we're either done or we need to wait, depending on
+                // whether we found some unfinished plans.
+                if (!didFindUnfinishedPlan)
+                    return result;
+                
+                m_condition->wait(*m_lock);
+            }
+        }
+        
+        RELEASE_ASSERT(!myPlans.isEmpty());
+        result = true;
+        finalizePlans(myPlans);
+    }
+}
+
+void JITWorklist::poll(VM& vm)
+{
+    DeferGC deferGC(vm.heap);
+    Plans myPlans;
+    {
+        LockHolder locker(*m_lock);
+        m_plans.removeAllMatching(
+            [&] (RefPtr<Plan>& plan) {
+                if (plan->vm() != &vm)
+                    return false;
+                if (!plan->isFinishedCompiling())
+                    return false;
+                myPlans.append(WTFMove(plan));
+                return true;
+            });
+    }
+    
+    finalizePlans(myPlans);
+}
+
+void JITWorklist::compileLater(CodeBlock* codeBlock, unsigned loopOSREntryBytecodeOffset)
+{
+    DeferGC deferGC(codeBlock->vm()->heap);
+    RELEASE_ASSERT(codeBlock->jitType() == JITCode::InterpreterThunk);
+    
+    if (codeBlock->m_didFailJITCompilation) {
+        codeBlock->dontJITAnytimeSoon();
+        return;
+    }
+    
+    if (!Options::useConcurrentJIT()) {
+        Plan::compileNow(codeBlock, loopOSREntryBytecodeOffset);
+        return;
+    }
+    
+    codeBlock->jitSoon();
+
+    {
+        LockHolder locker(*m_lock);
+        
+        if (m_planned.contains(codeBlock))
+            return;
+        
+        if (m_numAvailableThreads) {
+            m_planned.add(codeBlock);
+            RefPtr<Plan> plan = adoptRef(new Plan(codeBlock, loopOSREntryBytecodeOffset));
+            m_plans.append(plan);
+            m_queue.append(plan);
+            m_condition->notifyAll(locker);
+            return;
+        }
+    }
+
+    // Compiling on the main thread if the helper thread isn't available is a defense against this
+    // pathology:
+    //
+    // 1) Do something that is allowed to take a while, like load a giant piece of initialization
+    //    code. This plans the compile of the init code, but doesn't finish it. It will take a
+    //    while.
+    //
+    // 2) Do something that is supposed to be quick. Now all baseline compiles, and so all DFG and
+    //    FTL compiles, of everything is blocked on the long-running baseline compile of that
+    //    initialization code.
+    //
+    // The single-threaded concurrent JIT has this tendency to convoy everything while at the same
+    // time postponing when it happens, which means that the convoy delays are less predictable.
+    // This works around the issue. If the concurrent JIT thread is convoyed, we revert to main
+    // thread compiles. This is probably not as good as if we had multiple JIT threads. Maybe we
+    // can do that someday.
+    Plan::compileNow(codeBlock, loopOSREntryBytecodeOffset);
+}
+
+void JITWorklist::compileNow(CodeBlock* codeBlock, unsigned loopOSREntryBytecodeOffset)
+{
+    DeferGC deferGC(codeBlock->vm()->heap);
+    if (codeBlock->jitType() != JITCode::InterpreterThunk)
+        return;
+    
+    bool isPlanned;
+    {
+        LockHolder locker(*m_lock);
+        isPlanned = m_planned.contains(codeBlock);
+    }
+    
+    if (isPlanned) {
+        RELEASE_ASSERT(Options::useConcurrentJIT());
+        // This is expensive, but probably good enough.
+        completeAllForVM(*codeBlock->vm());
+    }
+    
+    // Now it might be compiled!
+    if (codeBlock->jitType() != JITCode::InterpreterThunk)
+        return;
+    
+    // We do this in case we had previously attempted, and then failed, to compile with the
+    // baseline JIT.
+    codeBlock->resetJITData();
+    
+    // OK, just compile it.
+    JIT::compile(codeBlock->vm(), codeBlock, JITCompilationMustSucceed, loopOSREntryBytecodeOffset);
+    codeBlock->ownerScriptExecutable()->installCode(codeBlock);
+}
+
+void JITWorklist::finalizePlans(Plans& myPlans)
+{
+    for (RefPtr<Plan>& plan : myPlans) {
+        plan->finalize();
+        
+        LockHolder locker(*m_lock);
+        m_planned.remove(plan->codeBlock());
+    }
+}
+
+JITWorklist* JITWorklist::instance()
+{
+    static JITWorklist* worklist;
+    static std::once_flag once;
+    std::call_once(
+        once,
+        [] {
+            worklist = new JITWorklist();
+        });
+    return worklist;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/JITWorklist.h b/jit/JITWorklist.h
new file mode 100644
index 0000000..7ea1c1e
--- /dev/null
+++ b/jit/JITWorklist.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include <wtf/AutomaticThread.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/HashSet.h>
+#include <wtf/Lock.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CodeBlock;
+class VM;
+
+class JITWorklist {
+    WTF_MAKE_NONCOPYABLE(JITWorklist);
+    WTF_MAKE_FAST_ALLOCATED;
+
+    class Plan;
+    typedef Vector<RefPtr<Plan>, 32> Plans;
+    
+public:
+    ~JITWorklist();
+    
+    bool completeAllForVM(VM&); // Return true if any JIT work happened.
+    void poll(VM&);
+    
+    void compileLater(CodeBlock*, unsigned loopOSREntryBytecodeOffset = 0);
+    
+    void compileNow(CodeBlock*, unsigned loopOSREntryBytecodeOffset = 0);
+    
+    static JITWorklist* instance();
+    
+private:
+    JITWorklist();
+    
+    class Thread;
+    friend class Thread;
+    
+    void finalizePlans(Plans&);
+    
+    Plans m_queue;
+    Plans m_plans;
+    HashSet<CodeBlock*> m_planned;
+    
+    Box<Lock> m_lock;
+    RefPtr<AutomaticThreadCondition> m_condition; // We use One True Condition for everything because that's easier.
+    RefPtr<AutomaticThread> m_thread;
+    
+    unsigned m_numAvailableThreads { 0 };
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/JSInterfaceJIT.h b/jit/JSInterfaceJIT.h
new file mode 100644
index 0000000..dc0cc1a
--- /dev/null
+++ b/jit/JSInterfaceJIT.h
@@ -0,0 +1,258 @@
+/*
+ * Copyright (C) 2010, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BytecodeConventions.h"
+#include "CCallHelpers.h"
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "JITCode.h"
+#include "JITOperations.h"
+#include "JSCJSValue.h"
+#include "JSString.h"
+#include "MacroAssembler.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+    class JSInterfaceJIT : public CCallHelpers, public GPRInfo, public FPRInfo {
+    public:
+        JSInterfaceJIT(VM* vm, CodeBlock* codeBlock = 0)
+            : CCallHelpers(vm, codeBlock)
+        {
+        }
+
+#if USE(JSVALUE32_64)
+        static const unsigned Int32Tag = static_cast<unsigned>(JSValue::Int32Tag);
+#else
+        static const unsigned Int32Tag = static_cast<unsigned>(TagTypeNumber >> 32);
+#endif
+        inline Jump emitLoadJSCell(unsigned virtualRegisterIndex, RegisterID payload);
+        inline Jump emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst);
+        inline Jump emitLoadDouble(unsigned virtualRegisterIndex, FPRegisterID dst, RegisterID scratch);
+
+#if USE(JSVALUE32_64)
+        inline Jump emitJumpIfNotJSCell(unsigned virtualRegisterIndex);
+        inline Address tagFor(int index, RegisterID base = callFrameRegister);
+#endif
+
+#if USE(JSVALUE64)
+        Jump emitJumpIfNotJSCell(RegisterID);
+        Jump emitJumpIfNumber(RegisterID);
+        Jump emitJumpIfNotNumber(RegisterID);
+        void emitTagInt(RegisterID src, RegisterID dest);
+#endif
+
+        Jump emitJumpIfNotType(RegisterID baseReg, JSType);
+
+        void emitGetFromCallFrameHeaderPtr(int entry, RegisterID to, RegisterID from = callFrameRegister);
+        void emitPutToCallFrameHeader(RegisterID from, int entry);
+        void emitPutToCallFrameHeader(void* value, int entry);
+        void emitPutCellToCallFrameHeader(RegisterID from, int entry);
+
+        inline Address payloadFor(int index, RegisterID base = callFrameRegister);
+        inline Address intPayloadFor(int index, RegisterID base = callFrameRegister);
+        inline Address intTagFor(int index, RegisterID base = callFrameRegister);
+        inline Address addressFor(int index, RegisterID base = callFrameRegister);
+    };
+
+    struct ThunkHelpers {
+        static unsigned jsStringLengthOffset() { return OBJECT_OFFSETOF(JSString, m_length); }
+        static unsigned jsStringValueOffset() { return OBJECT_OFFSETOF(JSString, m_value); }
+    };
+
+#if USE(JSVALUE32_64)
+    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadJSCell(unsigned virtualRegisterIndex, RegisterID payload)
+    {
+        loadPtr(payloadFor(virtualRegisterIndex), payload);
+        return emitJumpIfNotJSCell(virtualRegisterIndex);
+    }
+
+    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitJumpIfNotJSCell(unsigned virtualRegisterIndex)
+    {
+        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
+        return branch32(NotEqual, tagFor(virtualRegisterIndex), TrustedImm32(JSValue::CellTag));
+    }
+    
+    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst)
+    {
+        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
+        loadPtr(payloadFor(virtualRegisterIndex), dst);
+        return branch32(NotEqual, tagFor(static_cast<int>(virtualRegisterIndex)), TrustedImm32(JSValue::Int32Tag));
+    }
+    
+    inline JSInterfaceJIT::Address JSInterfaceJIT::tagFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.tag));
+    }
+    
+    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(JSValue, u.asBits.payload));
+    }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intPayloadFor(int virtualRegisterIndex, RegisterID base)
+    {
+        return payloadFor(virtualRegisterIndex, base);
+    }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intTagFor(int virtualRegisterIndex, RegisterID base)
+    {
+        return tagFor(virtualRegisterIndex, base);
+    }
+
+    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadDouble(unsigned virtualRegisterIndex, FPRegisterID dst, RegisterID scratch)
+    {
+        ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
+        loadPtr(tagFor(virtualRegisterIndex), scratch);
+        Jump isDouble = branch32(Below, scratch, TrustedImm32(JSValue::LowestTag));
+        Jump notInt = branch32(NotEqual, scratch, TrustedImm32(JSValue::Int32Tag));
+        loadPtr(payloadFor(virtualRegisterIndex), scratch);
+        convertInt32ToDouble(scratch, dst);
+        Jump done = jump();
+        isDouble.link(this);
+        loadDouble(addressFor(virtualRegisterIndex), dst);
+        done.link(this);
+        return notInt;
+    }
+
+#endif
+
+#if USE(JSVALUE64)
+    ALWAYS_INLINE JSInterfaceJIT::Jump JSInterfaceJIT::emitJumpIfNotJSCell(RegisterID reg)
+    {
+        return branchTest64(NonZero, reg, tagMaskRegister);
+    }
+
+    ALWAYS_INLINE JSInterfaceJIT::Jump JSInterfaceJIT::emitJumpIfNumber(RegisterID reg)
+    {
+        return branchTest64(NonZero, reg, tagTypeNumberRegister);
+    }
+    ALWAYS_INLINE JSInterfaceJIT::Jump JSInterfaceJIT::emitJumpIfNotNumber(RegisterID reg)
+    {
+        return branchTest64(Zero, reg, tagTypeNumberRegister);
+    }
+    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadJSCell(unsigned virtualRegisterIndex, RegisterID dst)
+    {
+        load64(addressFor(virtualRegisterIndex), dst);
+        return branchTest64(NonZero, dst, tagMaskRegister);
+    }
+    
+    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst)
+    {
+        load64(addressFor(virtualRegisterIndex), dst);
+        Jump result = branch64(Below, dst, tagTypeNumberRegister);
+        zeroExtend32ToPtr(dst, dst);
+        return result;
+    }
+
+    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadDouble(unsigned virtualRegisterIndex, FPRegisterID dst, RegisterID scratch)
+    {
+        load64(addressFor(virtualRegisterIndex), scratch);
+        Jump notNumber = emitJumpIfNotNumber(scratch);
+        Jump notInt = branch64(Below, scratch, tagTypeNumberRegister);
+        convertInt32ToDouble(scratch, dst);
+        Jump done = jump();
+        notInt.link(this);
+        add64(tagTypeNumberRegister, scratch);
+        move64ToDouble(scratch, dst);
+        done.link(this);
+        return notNumber;
+    }
+
+    // operand is int32_t, must have been zero-extended if register is 64-bit.
+    ALWAYS_INLINE void JSInterfaceJIT::emitTagInt(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+        or64(tagTypeNumberRegister, dest);
+    }
+#endif
+
+#if USE(JSVALUE64)
+    inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return addressFor(virtualRegisterIndex, base);
+    }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intPayloadFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+    }
+    inline JSInterfaceJIT::Address JSInterfaceJIT::intTagFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+    }
+#endif
+
+    ALWAYS_INLINE JSInterfaceJIT::Jump JSInterfaceJIT::emitJumpIfNotType(RegisterID baseReg, JSType type)
+    {
+        return branch8(NotEqual, Address(baseReg, JSCell::typeInfoTypeOffset()), TrustedImm32(type));
+    }
+
+    ALWAYS_INLINE void JSInterfaceJIT::emitGetFromCallFrameHeaderPtr(int entry, RegisterID to, RegisterID from)
+    {
+        loadPtr(Address(from, entry * sizeof(Register)), to);
+    }
+
+    ALWAYS_INLINE void JSInterfaceJIT::emitPutToCallFrameHeader(RegisterID from, int entry)
+    {
+#if USE(JSVALUE32_64)
+        storePtr(from, payloadFor(entry, callFrameRegister));
+#else
+        store64(from, addressFor(entry, callFrameRegister));
+#endif
+    }
+
+    ALWAYS_INLINE void JSInterfaceJIT::emitPutToCallFrameHeader(void* value, int entry)
+    {
+        storePtr(TrustedImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
+    }
+
+    ALWAYS_INLINE void JSInterfaceJIT::emitPutCellToCallFrameHeader(RegisterID from, int entry)
+    {
+#if USE(JSVALUE32_64)
+        store32(TrustedImm32(JSValue::CellTag), tagFor(entry, callFrameRegister));
+        store32(from, payloadFor(entry, callFrameRegister));
+#else
+        store64(from, addressFor(entry, callFrameRegister));
+#endif
+    }
+
+    inline JSInterfaceJIT::Address JSInterfaceJIT::addressFor(int virtualRegisterIndex, RegisterID base)
+    {
+        ASSERT(virtualRegisterIndex < FirstConstantRegisterIndex);
+        return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)));
+    }
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/PCToCodeOriginMap.cpp b/jit/PCToCodeOriginMap.cpp
new file mode 100644
index 0000000..410009a
--- /dev/null
+++ b/jit/PCToCodeOriginMap.cpp
@@ -0,0 +1,306 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PCToCodeOriginMap.h"
+
+#if ENABLE(JIT)
+
+#include "B3PCToOriginMap.h"
+#include "DFGNode.h"
+#include "LinkBuffer.h"
+
+#if COMPILER(MSVC)
+// See https://msdn.microsoft.com/en-us/library/4wz07268.aspx
+#pragma warning(disable: 4333)
+#endif
+
+namespace JSC {
+
+namespace {
+
+class DeltaCompressionBuilder {
+public:
+    DeltaCompressionBuilder(size_t maxSize)
+        : m_offset(0)
+        , m_maxSize(maxSize)
+    {
+        m_buffer = static_cast<uint8_t*>(fastMalloc(m_maxSize));
+    }
+
+    template <typename T>
+    void write(T item)
+    {
+        RELEASE_ASSERT(m_offset + sizeof(T) <= m_maxSize);
+        static const uint8_t mask = std::numeric_limits<uint8_t>::max();
+        for (unsigned i = 0; i < sizeof(T); i++) {
+            *(m_buffer + m_offset) = static_cast<uint8_t>(item & mask);
+            item = item >> (sizeof(uint8_t) * 8);
+            m_offset += 1;
+        }
+    }
+
+    uint8_t* m_buffer; 
+    size_t m_offset;
+    size_t m_maxSize;
+};
+
+class DeltaCompresseionReader {
+public:
+    DeltaCompresseionReader(uint8_t* buffer, size_t size)
+        : m_buffer(buffer)
+        , m_size(size)
+        , m_offset(0)
+    { }
+
+    template <typename T>
+    T read()
+    {
+        RELEASE_ASSERT(m_offset + sizeof(T) <= m_size);
+        T result = 0;
+        for (unsigned i = 0; i < sizeof(T); i++) {
+            uint8_t bitsAsInt8 = *(m_buffer + m_offset);
+            T bits = static_cast<T>(bitsAsInt8);
+            bits = bits << (sizeof(uint8_t) * 8 * i);
+            result |= bits;
+            m_offset += 1;
+        }
+        return result;
+    }
+
+private:
+    uint8_t* m_buffer;
+    size_t m_size;
+    size_t m_offset;
+};
+
+} // anonymous namespace
+
+PCToCodeOriginMapBuilder::PCToCodeOriginMapBuilder(VM& vm)
+    : m_vm(vm)
+    , m_shouldBuildMapping(vm.shouldBuilderPCToCodeOriginMapping())
+{ }
+
+PCToCodeOriginMapBuilder::PCToCodeOriginMapBuilder(PCToCodeOriginMapBuilder&& other)
+    : m_vm(other.m_vm)
+    , m_codeRanges(WTFMove(other.m_codeRanges))
+    , m_shouldBuildMapping(other.m_shouldBuildMapping)
+{ }
+
+#if ENABLE(FTL_JIT)
+PCToCodeOriginMapBuilder::PCToCodeOriginMapBuilder(VM& vm, B3::PCToOriginMap&& b3PCToOriginMap)
+    : m_vm(vm)
+    , m_shouldBuildMapping(vm.shouldBuilderPCToCodeOriginMapping())
+{
+    if (!m_shouldBuildMapping)
+        return;
+
+    for (const B3::PCToOriginMap::OriginRange& originRange : b3PCToOriginMap.ranges()) {
+        DFG::Node* node = bitwise_cast<DFG::Node*>(originRange.origin.data());
+        if (node)
+            appendItem(originRange.label, node->origin.semantic);
+        else
+            appendItem(originRange.label, PCToCodeOriginMapBuilder::defaultCodeOrigin());
+    }
+}
+#endif
+
+void PCToCodeOriginMapBuilder::appendItem(MacroAssembler::Label label, const CodeOrigin& codeOrigin)
+{
+    if (!m_shouldBuildMapping)
+        return;
+
+    if (m_codeRanges.size()) {
+        if (m_codeRanges.last().end == label)
+            return;
+        m_codeRanges.last().end = label;
+        if (m_codeRanges.last().codeOrigin == codeOrigin || !codeOrigin)
+            return;
+    }
+
+    m_codeRanges.append(CodeRange{label, label, codeOrigin});
+}
+
+
+static const uint8_t sentinelPCDelta = 0;
+static const int8_t sentinelBytecodeDelta = 0;
+
+PCToCodeOriginMap::PCToCodeOriginMap(PCToCodeOriginMapBuilder&& builder, LinkBuffer& linkBuffer)
+{
+    RELEASE_ASSERT(builder.didBuildMapping());
+
+    if (!builder.m_codeRanges.size()) {
+        m_pcRangeStart = std::numeric_limits<uintptr_t>::max();
+        m_pcRangeEnd = std::numeric_limits<uintptr_t>::max();
+
+        m_compressedPCBufferSize = 0;
+        m_compressedPCs = nullptr;
+
+        m_compressedCodeOriginsSize = 0;
+        m_compressedCodeOrigins = nullptr;
+
+        return;
+    }
+
+    // We do a final touch-up on the last range here because of how we generate the table.
+    // The final range (if non empty) would be ignored if we didn't append any (arbitrary)
+    // range as the last item of the vector.
+    PCToCodeOriginMapBuilder::CodeRange& last = builder.m_codeRanges.last();
+    if (!(last.start == last.end))
+        builder.m_codeRanges.append(PCToCodeOriginMapBuilder::CodeRange{ last.end, last.end, last.codeOrigin }); // This range will never actually be found, but it ensures the real last range is found.
+
+    DeltaCompressionBuilder pcCompressor((sizeof(uintptr_t) + sizeof(uint8_t)) * builder.m_codeRanges.size());
+    void* lastPCValue = nullptr;
+    auto buildPCTable = [&] (void* pcValue) {
+        RELEASE_ASSERT(pcValue > lastPCValue);
+        uintptr_t delta = bitwise_cast<uintptr_t>(pcValue) - bitwise_cast<uintptr_t>(lastPCValue);
+        RELEASE_ASSERT(delta != sentinelPCDelta);
+        lastPCValue = pcValue;
+        if (delta > std::numeric_limits<uint8_t>::max()) {
+            pcCompressor.write<uint8_t>(sentinelPCDelta);
+            pcCompressor.write<uintptr_t>(delta);
+            return;
+        }
+
+        pcCompressor.write<uint8_t>(static_cast<uint8_t>(delta));
+    };
+
+    DeltaCompressionBuilder codeOriginCompressor((sizeof(intptr_t) + sizeof(int8_t) + sizeof(int8_t) + sizeof(InlineCallFrame*)) * builder.m_codeRanges.size());
+    CodeOrigin lastCodeOrigin(0, nullptr);
+    auto buildCodeOriginTable = [&] (const CodeOrigin& codeOrigin) {
+        intptr_t delta = static_cast<intptr_t>(codeOrigin.bytecodeIndex) - static_cast<intptr_t>(lastCodeOrigin.bytecodeIndex);
+        lastCodeOrigin = codeOrigin;
+        if (delta > std::numeric_limits<int8_t>::max() || delta < std::numeric_limits<int8_t>::min() || delta == sentinelBytecodeDelta) {
+            codeOriginCompressor.write<int8_t>(sentinelBytecodeDelta);
+            codeOriginCompressor.write<intptr_t>(delta);
+        } else
+            codeOriginCompressor.write<int8_t>(static_cast<int8_t>(delta));
+
+        int8_t hasInlineCallFrameByte = codeOrigin.inlineCallFrame ? 1 : 0;
+        codeOriginCompressor.write<int8_t>(hasInlineCallFrameByte);
+        if (hasInlineCallFrameByte)
+            codeOriginCompressor.write<uintptr_t>(bitwise_cast<uintptr_t>(codeOrigin.inlineCallFrame));
+    };
+
+    m_pcRangeStart = bitwise_cast<uintptr_t>(linkBuffer.locationOf(builder.m_codeRanges.first().start).dataLocation());
+    m_pcRangeEnd = bitwise_cast<uintptr_t>(linkBuffer.locationOf(builder.m_codeRanges.last().end).dataLocation());
+    m_pcRangeEnd -= 1;
+
+    for (unsigned i = 0; i < builder.m_codeRanges.size(); i++) {
+        PCToCodeOriginMapBuilder::CodeRange& codeRange = builder.m_codeRanges[i];
+        void* start = linkBuffer.locationOf(codeRange.start).dataLocation();
+        void* end = linkBuffer.locationOf(codeRange.end).dataLocation();
+        ASSERT(m_pcRangeStart <= bitwise_cast<uintptr_t>(start));
+        ASSERT(m_pcRangeEnd >= bitwise_cast<uintptr_t>(end) - 1);
+        if (start == end)
+            ASSERT(i == builder.m_codeRanges.size() - 1);
+        if (i > 0)
+            ASSERT(linkBuffer.locationOf(builder.m_codeRanges[i - 1].end).dataLocation() == start);
+
+        buildPCTable(start);
+        buildCodeOriginTable(codeRange.codeOrigin);
+    }
+
+    m_compressedPCBufferSize = pcCompressor.m_offset;
+    m_compressedPCs = static_cast<uint8_t*>(fastRealloc(pcCompressor.m_buffer, m_compressedPCBufferSize));
+
+    m_compressedCodeOriginsSize = codeOriginCompressor.m_offset;
+    m_compressedCodeOrigins = static_cast<uint8_t*>(fastRealloc(codeOriginCompressor.m_buffer, m_compressedCodeOriginsSize));
+}
+
+PCToCodeOriginMap::~PCToCodeOriginMap()
+{
+    if (m_compressedPCs)
+        fastFree(m_compressedPCs);
+    if (m_compressedCodeOrigins)
+        fastFree(m_compressedCodeOrigins);
+}
+
+double PCToCodeOriginMap::memorySize()
+{
+    double size = 0;
+    size += m_compressedPCBufferSize;
+    size += m_compressedCodeOriginsSize;
+    return size;
+}
+
+std::optional<CodeOrigin> PCToCodeOriginMap::findPC(void* pc) const
+{
+    uintptr_t pcAsInt = bitwise_cast<uintptr_t>(pc);
+    if (!(m_pcRangeStart <= pcAsInt && pcAsInt <= m_pcRangeEnd))
+        return std::nullopt;
+
+    uintptr_t currentPC = 0;
+    CodeOrigin currentCodeOrigin(0, nullptr);
+
+    DeltaCompresseionReader pcReader(m_compressedPCs, m_compressedPCBufferSize);
+    DeltaCompresseionReader codeOriginReader(m_compressedCodeOrigins, m_compressedCodeOriginsSize);
+    while (true) {
+        uintptr_t previousPC = currentPC;
+        {
+            uint8_t value = pcReader.read<uint8_t>();
+            uintptr_t delta;
+            if (value == sentinelPCDelta)
+                delta = pcReader.read<uintptr_t>();
+            else
+                delta = value;
+            currentPC += delta;
+        }
+
+        CodeOrigin previousOrigin = currentCodeOrigin;
+        {
+            int8_t value = codeOriginReader.read<int8_t>();
+            intptr_t delta;
+            if (value == sentinelBytecodeDelta)
+                delta = codeOriginReader.read<intptr_t>();
+            else
+                delta = static_cast<intptr_t>(value);
+
+            currentCodeOrigin.bytecodeIndex = static_cast<unsigned>(static_cast<intptr_t>(currentCodeOrigin.bytecodeIndex) + delta);
+
+            int8_t hasInlineFrame = codeOriginReader.read<int8_t>();
+            ASSERT(hasInlineFrame == 0 || hasInlineFrame == 1);
+            if (hasInlineFrame)
+                currentCodeOrigin.inlineCallFrame = bitwise_cast<InlineCallFrame*>(codeOriginReader.read<uintptr_t>());
+            else
+                currentCodeOrigin.inlineCallFrame = nullptr;
+        }
+
+        if (previousPC) {
+            uintptr_t startOfRange = previousPC;
+            // We subtract 1 because we generate end points inclusively in this table, even though we are interested in ranges of the form: [previousPC, currentPC)
+            uintptr_t endOfRange = currentPC - 1;
+            if (startOfRange <= pcAsInt && pcAsInt <= endOfRange)
+                return std::optional<CodeOrigin>(previousOrigin); // We return previousOrigin here because CodeOrigin's are mapped to the startValue of the range.
+        }
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return std::nullopt;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/PCToCodeOriginMap.h b/jit/PCToCodeOriginMap.h
new file mode 100644
index 0000000..c01c441
--- /dev/null
+++ b/jit/PCToCodeOriginMap.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CodeOrigin.h"
+#include "DFGCommon.h"
+#include "MacroAssembler.h"
+#include "VM.h"
+#include <wtf/Bag.h>
+#include <wtf/Optional.h>
+#include <wtf/RedBlackTree.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+#if ENABLE(FTL_JIT)
+namespace B3 {
+class PCToOriginMap;
+}
+#endif
+
+class LinkBuffer;
+class PCToCodeOriginMapBuilder;
+
+class PCToCodeOriginMapBuilder {
+    WTF_MAKE_NONCOPYABLE(PCToCodeOriginMapBuilder);
+    friend class PCToCodeOriginMap;
+
+public:
+    PCToCodeOriginMapBuilder(VM&);
+    PCToCodeOriginMapBuilder(PCToCodeOriginMapBuilder&& other);
+
+#if ENABLE(FTL_JIT)
+    PCToCodeOriginMapBuilder(VM&, B3::PCToOriginMap&&);
+#endif
+
+    void appendItem(MacroAssembler::Label, const CodeOrigin&);
+    static CodeOrigin defaultCodeOrigin() { return CodeOrigin(0, nullptr); }
+
+    bool didBuildMapping() const { return m_shouldBuildMapping; }
+
+private:
+
+    struct CodeRange {
+        MacroAssembler::Label start;
+        MacroAssembler::Label end;
+        CodeOrigin codeOrigin;
+    };
+
+    VM& m_vm;
+    Vector<CodeRange> m_codeRanges;
+    bool m_shouldBuildMapping;
+};
+
+class PCToCodeOriginMap {
+    WTF_MAKE_NONCOPYABLE(PCToCodeOriginMap);
+public:
+    PCToCodeOriginMap(PCToCodeOriginMapBuilder&&, LinkBuffer&);
+    ~PCToCodeOriginMap();
+
+    std::optional<CodeOrigin> findPC(void* pc) const;
+
+    double memorySize();
+
+private:
+    size_t m_compressedPCBufferSize;
+    size_t m_compressedCodeOriginsSize;
+    uint8_t* m_compressedPCs;
+    uint8_t* m_compressedCodeOrigins;
+    uintptr_t m_pcRangeStart;
+    uintptr_t m_pcRangeEnd;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/PolymorphicCallStubRoutine.cpp b/jit/PolymorphicCallStubRoutine.cpp
new file mode 100644
index 0000000..0b24b02
--- /dev/null
+++ b/jit/PolymorphicCallStubRoutine.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PolymorphicCallStubRoutine.h"
+
+#if ENABLE(JIT)
+
+#include "CallLinkInfo.h"
+#include "CodeBlock.h"
+#include "JSCInlines.h"
+#include "LinkBuffer.h"
+
+namespace JSC {
+
+PolymorphicCallNode::~PolymorphicCallNode()
+{
+    if (isOnList())
+        remove();
+}
+
+void PolymorphicCallNode::unlink(VM& vm)
+{
+    if (m_callLinkInfo) {
+        if (Options::dumpDisassembly())
+            dataLog("Unlinking polymorphic call at ", m_callLinkInfo->callReturnLocation(), ", ", m_callLinkInfo->codeOrigin(), "\n");
+
+        m_callLinkInfo->unlink(vm);
+    }
+
+    if (isOnList())
+        remove();
+}
+
+void PolymorphicCallNode::clearCallLinkInfo()
+{
+    if (Options::dumpDisassembly())
+        dataLog("Clearing call link info for polymorphic call at ", m_callLinkInfo->callReturnLocation(), ", ", m_callLinkInfo->codeOrigin(), "\n");
+
+    m_callLinkInfo = nullptr;
+}
+
+void PolymorphicCallCase::dump(PrintStream& out) const
+{
+    out.print("<variant = ", m_variant, ", codeBlock = ", pointerDump(m_codeBlock), ">");
+}
+
+PolymorphicCallStubRoutine::PolymorphicCallStubRoutine(
+    const MacroAssemblerCodeRef& codeRef, VM& vm, const JSCell* owner, ExecState* callerFrame,
+    CallLinkInfo& info, const Vector<PolymorphicCallCase>& cases,
+    std::unique_ptr<uint32_t[]> fastCounts)
+    : GCAwareJITStubRoutine(codeRef, vm)
+    , m_fastCounts(WTFMove(fastCounts))
+{
+    for (PolymorphicCallCase callCase : cases) {
+        m_variants.append(WriteBarrier<JSCell>(vm, owner, callCase.variant().rawCalleeCell()));
+        if (shouldDumpDisassemblyFor(callerFrame->codeBlock()))
+            dataLog("Linking polymorphic call in ", *callerFrame->codeBlock(), " at ", callerFrame->codeOrigin(), " to ", callCase.variant(), ", codeBlock = ", pointerDump(callCase.codeBlock()), "\n");
+        if (CodeBlock* codeBlock = callCase.codeBlock())
+            codeBlock->linkIncomingPolymorphicCall(callerFrame, m_callNodes.add(&info));
+    }
+    m_variants.shrinkToFit();
+    WTF::storeStoreFence();
+}
+
+PolymorphicCallStubRoutine::~PolymorphicCallStubRoutine() { }
+
+CallVariantList PolymorphicCallStubRoutine::variants() const
+{
+    CallVariantList result;
+    for (size_t i = 0; i < m_variants.size(); ++i)
+        result.append(CallVariant(m_variants[i].get()));
+    return result;
+}
+
+CallEdgeList PolymorphicCallStubRoutine::edges() const
+{
+    // We wouldn't have these if this was an FTL stub routine. We shouldn't be asking for profiling
+    // from the FTL.
+    RELEASE_ASSERT(m_fastCounts);
+    
+    CallEdgeList result;
+    for (size_t i = 0; i < m_variants.size(); ++i)
+        result.append(CallEdge(CallVariant(m_variants[i].get()), m_fastCounts[i]));
+    return result;
+}
+
+void PolymorphicCallStubRoutine::clearCallNodesFor(CallLinkInfo* info)
+{
+    for (Bag<PolymorphicCallNode>::iterator iter = m_callNodes.begin(); !!iter; ++iter) {
+        PolymorphicCallNode& node = **iter;
+        // All nodes should point to info, but okay to be a little paranoid.
+        if (node.hasCallLinkInfo(info))
+            node.clearCallLinkInfo();
+    }
+}
+
+bool PolymorphicCallStubRoutine::visitWeak(VM&)
+{
+    for (auto& variant : m_variants) {
+        if (!Heap::isMarked(variant.get()))
+            return false;
+    }
+    return true;
+}
+
+void PolymorphicCallStubRoutine::markRequiredObjectsInternal(SlotVisitor& visitor)
+{
+    for (auto& variant : m_variants)
+        visitor.append(variant);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/PolymorphicCallStubRoutine.h b/jit/PolymorphicCallStubRoutine.h
new file mode 100644
index 0000000..3bfd2d6
--- /dev/null
+++ b/jit/PolymorphicCallStubRoutine.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CallEdge.h"
+#include "CallVariant.h"
+#include "CodeOrigin.h"
+#include "GCAwareJITStubRoutine.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CallLinkInfo;
+
+class PolymorphicCallNode : public BasicRawSentinelNode<PolymorphicCallNode> {
+    WTF_MAKE_NONCOPYABLE(PolymorphicCallNode);
+public:
+    PolymorphicCallNode(CallLinkInfo* info)
+        : m_callLinkInfo(info)
+    {
+    }
+    
+    ~PolymorphicCallNode();
+    
+    void unlink(VM&);
+
+    bool hasCallLinkInfo(CallLinkInfo* info) { return m_callLinkInfo == info; }
+    void clearCallLinkInfo();
+    
+private:
+    CallLinkInfo* m_callLinkInfo;
+};
+
+class PolymorphicCallCase {
+public:
+    PolymorphicCallCase()
+        : m_codeBlock(nullptr)
+    {
+    }
+    
+    PolymorphicCallCase(CallVariant variant, CodeBlock* codeBlock)
+        : m_variant(variant)
+        , m_codeBlock(codeBlock)
+    {
+    }
+    
+    CallVariant variant() const { return m_variant; }
+    CodeBlock* codeBlock() const { return m_codeBlock; }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    CallVariant m_variant;
+    CodeBlock* m_codeBlock;
+};
+
+class PolymorphicCallStubRoutine : public GCAwareJITStubRoutine {
+public:
+    PolymorphicCallStubRoutine(
+        const MacroAssemblerCodeRef&, VM&, const JSCell* owner,
+        ExecState* callerFrame, CallLinkInfo&, const Vector<PolymorphicCallCase>&,
+        std::unique_ptr<uint32_t[]> fastCounts);
+    
+    virtual ~PolymorphicCallStubRoutine();
+    
+    CallVariantList variants() const;
+    CallEdgeList edges() const;
+
+    void clearCallNodesFor(CallLinkInfo*);
+    
+    bool visitWeak(VM&) override;
+
+protected:
+    void markRequiredObjectsInternal(SlotVisitor&) override;
+
+private:
+    Vector<WriteBarrier<JSCell>, 2> m_variants;
+    std::unique_ptr<uint32_t[]> m_fastCounts;
+    Bag<PolymorphicCallNode> m_callNodes;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/Reg.cpp b/jit/Reg.cpp
new file mode 100644
index 0000000..4aa9653
--- /dev/null
+++ b/jit/Reg.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Reg.h"
+
+#if ENABLE(JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+
+namespace JSC {
+
+const char* Reg::debugName() const
+{
+    if (!*this)
+        return nullptr;
+    if (isGPR())
+        return GPRInfo::debugName(gpr());
+    return FPRInfo::debugName(fpr());
+}
+
+void Reg::dump(PrintStream& out) const
+{
+    if (!*this)
+        out.print("<none>");
+    else if (isGPR())
+        out.print(gpr());
+    else
+        out.print(fpr());
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/Reg.h b/jit/Reg.h
new file mode 100644
index 0000000..84ae359
--- /dev/null
+++ b/jit/Reg.h
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "MacroAssembler.h"
+
+namespace JSC {
+
+// Reg is a polymorphic register class. It can refer to either integer or float registers.
+// Here are some use cases:
+//
+// GPRReg gpr;
+// Reg reg = gpr;
+// reg.isSet() == true
+// reg.isGPR() == true
+// reg.isFPR() == false
+//
+// for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+//     if (reg.isGPR()) {
+//     } else /* reg.isFPR() */ {
+//     }
+// }
+//
+// The above loop could have also used !!reg or reg.isSet() as a condition.
+
+class Reg {
+public:
+    Reg()
+        : m_index(invalid())
+    {
+    }
+
+    Reg(WTF::HashTableDeletedValueType)
+        : m_index(deleted())
+    {
+    }
+    
+    Reg(MacroAssembler::RegisterID reg)
+        : m_index(MacroAssembler::registerIndex(reg))
+    {
+    }
+    
+    Reg(MacroAssembler::FPRegisterID reg)
+        : m_index(MacroAssembler::registerIndex(reg))
+    {
+    }
+    
+    static Reg fromIndex(unsigned index)
+    {
+        Reg result;
+        result.m_index = index;
+        return result;
+    }
+    
+    static Reg first()
+    {
+        Reg result;
+        result.m_index = 0;
+        return result;
+    }
+    
+    static Reg last()
+    {
+        Reg result;
+        result.m_index = MacroAssembler::numberOfRegisters() + MacroAssembler::numberOfFPRegisters() - 1;
+        return result;
+    }
+    
+    Reg next() const
+    {
+        ASSERT(!!*this);
+        if (*this == last())
+            return Reg();
+        Reg result;
+        result.m_index = m_index + 1;
+        return result;
+    }
+    
+    unsigned index() const { return m_index; }
+
+    static unsigned maxIndex()
+    {
+        return last().index();
+    }
+    
+    bool isSet() const { return m_index != invalid(); }
+    explicit operator bool() const { return isSet(); }
+
+    bool isHashTableDeletedValue() const { return m_index == deleted(); }
+    
+    bool isGPR() const
+    {
+        return m_index < MacroAssembler::numberOfRegisters();
+    }
+    
+    bool isFPR() const
+    {
+        return (m_index - MacroAssembler::numberOfRegisters()) < MacroAssembler::numberOfFPRegisters();
+    }
+    
+    MacroAssembler::RegisterID gpr() const
+    {
+        ASSERT(isGPR());
+        return static_cast<MacroAssembler::RegisterID>(MacroAssembler::firstRegister() + m_index);
+    }
+    
+    MacroAssembler::FPRegisterID fpr() const
+    {
+        ASSERT(isFPR());
+        return static_cast<MacroAssembler::FPRegisterID>(
+            MacroAssembler::firstFPRegister() + (m_index - MacroAssembler::numberOfRegisters()));
+    }
+    
+    bool operator==(const Reg& other) const
+    {
+        return m_index == other.m_index;
+    }
+    
+    bool operator!=(const Reg& other) const
+    {
+        return m_index != other.m_index;
+    }
+    
+    bool operator<(const Reg& other) const
+    {
+        return m_index < other.m_index;
+    }
+    
+    bool operator>(const Reg& other) const
+    {
+        return m_index > other.m_index;
+    }
+    
+    bool operator<=(const Reg& other) const
+    {
+        return m_index <= other.m_index;
+    }
+    
+    bool operator>=(const Reg& other) const
+    {
+        return m_index >= other.m_index;
+    }
+    
+    unsigned hash() const
+    {
+        return m_index;
+    }
+    
+    const char* debugName() const;
+    
+    void dump(PrintStream&) const;
+
+    class AllRegsIterable {
+    public:
+
+        class iterator {
+        public:
+            iterator() { }
+
+            explicit iterator(Reg reg)
+                : m_regIndex(reg.index())
+            {
+            }
+
+            Reg operator*() const { return Reg::fromIndex(m_regIndex); }
+
+            iterator& operator++()
+            {
+                m_regIndex = Reg::fromIndex(m_regIndex).next().index();
+                return *this;
+            }
+
+            bool operator==(const iterator& other) const
+            {
+                return m_regIndex == other.m_regIndex;
+            }
+
+            bool operator!=(const iterator& other) const
+            {
+                return !(*this == other);
+            }
+
+        private:
+            unsigned m_regIndex;
+        };
+
+        iterator begin() const { return iterator(Reg::first()); }
+        iterator end() const { return iterator(Reg()); }
+    };
+
+    static AllRegsIterable all() { return AllRegsIterable(); }
+
+private:
+    static uint8_t invalid() { return 0xff; }
+
+    static uint8_t deleted() { return 0xfe; }
+    
+    uint8_t m_index;
+};
+
+struct RegHash {
+    static unsigned hash(const Reg& key) { return key.hash(); }
+    static bool equal(const Reg& a, const Reg& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::Reg> {
+    typedef JSC::RegHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::Reg> : SimpleClassHashTraits<JSC::Reg> {
+    static const bool emptyValueIsZero = false;
+ };
+
+} // namespace WTF
+
+#endif // ENABLE(JIT)
diff --git a/jit/RegisterAtOffset.cpp b/jit/RegisterAtOffset.cpp
new file mode 100644
index 0000000..16a639c
--- /dev/null
+++ b/jit/RegisterAtOffset.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegisterAtOffset.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+#if !COMPILER(MSVC)
+static_assert(sizeof(RegisterAtOffset) == sizeof(ptrdiff_t), "RegisterAtOffset should be small.");
+#endif
+
+void RegisterAtOffset::dump(PrintStream& out) const
+{
+    out.print(reg(), " at ", offset());
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/RegisterAtOffset.h b/jit/RegisterAtOffset.h
new file mode 100644
index 0000000..0db8da4
--- /dev/null
+++ b/jit/RegisterAtOffset.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "Reg.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class RegisterAtOffset {
+public:
+    RegisterAtOffset()
+        : m_offset(0)
+    {
+    }
+    
+    RegisterAtOffset(Reg reg, ptrdiff_t offset)
+        : m_reg(reg)
+        , m_offset(offset)
+    {
+    }
+    
+    bool operator!() const { return !m_reg; }
+    
+    Reg reg() const { return m_reg; }
+    ptrdiff_t offset() const { return m_offset; }
+    int offsetAsIndex() const { return offset() / sizeof(void*); }
+    
+    bool operator==(const RegisterAtOffset& other) const
+    {
+        return reg() == other.reg() && offset() == other.offset();
+    }
+    
+    bool operator<(const RegisterAtOffset& other) const
+    {
+        if (reg() != other.reg())
+            return reg() < other.reg();
+        return offset() < other.offset();
+    }
+    
+    static Reg getReg(RegisterAtOffset* value) { return value->reg(); }
+    
+    void dump(PrintStream& out) const;
+
+private:
+    Reg m_reg;
+    ptrdiff_t m_offset : sizeof(ptrdiff_t) * 8 - sizeof(Reg) * 8;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/RegisterAtOffsetList.cpp b/jit/RegisterAtOffsetList.cpp
new file mode 100644
index 0000000..dd5b5b3
--- /dev/null
+++ b/jit/RegisterAtOffsetList.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegisterAtOffsetList.h"
+
+#if ENABLE(JIT)
+
+#include <wtf/ListDump.h>
+
+namespace JSC {
+    
+RegisterAtOffsetList::RegisterAtOffsetList() { }
+
+RegisterAtOffsetList::RegisterAtOffsetList(RegisterSet registerSet, OffsetBaseType offsetBaseType)
+{
+    size_t numberOfRegisters = registerSet.numberOfSetRegisters();
+    ptrdiff_t offset = 0;
+    
+    if (offsetBaseType == FramePointerBased)
+        offset = -(static_cast<ptrdiff_t>(numberOfRegisters) * sizeof(void*));
+
+    m_registers.reserveInitialCapacity(numberOfRegisters);
+    registerSet.forEach([&] (Reg reg) {
+        m_registers.append(RegisterAtOffset(reg, offset));
+        offset += sizeof(void*);
+    });
+}
+
+void RegisterAtOffsetList::dump(PrintStream& out) const
+{
+    out.print(listDump(m_registers));
+}
+
+RegisterAtOffset* RegisterAtOffsetList::find(Reg reg) const
+{
+    return tryBinarySearch<RegisterAtOffset, Reg>(m_registers, m_registers.size(), reg, RegisterAtOffset::getReg);
+}
+
+unsigned RegisterAtOffsetList::indexOf(Reg reg) const
+{
+    if (RegisterAtOffset* pointer = find(reg))
+        return pointer - m_registers.begin();
+    return UINT_MAX;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/RegisterAtOffsetList.h b/jit/RegisterAtOffsetList.h
new file mode 100644
index 0000000..875a591
--- /dev/null
+++ b/jit/RegisterAtOffsetList.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "RegisterAtOffset.h"
+#include "RegisterSet.h"
+
+namespace JSC {
+
+class RegisterAtOffsetList {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    enum OffsetBaseType { FramePointerBased, ZeroBased };
+
+    RegisterAtOffsetList();
+    RegisterAtOffsetList(RegisterSet, OffsetBaseType = FramePointerBased);
+
+    void dump(PrintStream&) const;
+
+    void clear()
+    {
+        m_registers.clear();
+    }
+
+    size_t size() const
+    {
+        return m_registers.size();
+    }
+
+    RegisterAtOffset& at(size_t index)
+    {
+        return m_registers.at(index);
+    }
+    
+    RegisterAtOffset* find(Reg) const;
+    unsigned indexOf(Reg) const; // Returns UINT_MAX if not found.
+
+    Vector<RegisterAtOffset>::const_iterator begin() const { return m_registers.begin(); }
+    Vector<RegisterAtOffset>::const_iterator end() const { return m_registers.end(); }
+
+private:
+    Vector<RegisterAtOffset> m_registers;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/RegisterMap.h b/jit/RegisterMap.h
new file mode 100644
index 0000000..0f3f957
--- /dev/null
+++ b/jit/RegisterMap.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "MacroAssembler.h"
+#include "Reg.h"
+
+namespace JSC {
+
+template<typename T>
+class RegisterMap {
+public:
+    T& operator[](Reg reg)
+    {
+        return m_map[reg.index()];
+    }
+
+    T& operator[](GPRReg gpr)
+    {
+        return m_map[MacroAssembler::registerIndex(gpr)];
+    }
+
+    T& operator[](FPRReg fpr)
+    {
+        return m_map[MacroAssembler::registerIndex(fpr)];
+    }
+
+    const T& operator[](Reg reg) const
+    {
+        return m_map[reg.index()];
+    }
+
+    const T& operator[](GPRReg gpr) const
+    {
+        return m_map[MacroAssembler::registerIndex(gpr)];
+    }
+
+    const T& operator[](FPRReg fpr) const
+    {
+        return m_map[MacroAssembler::registerIndex(fpr)];
+    }
+
+private:
+    std::array<T, MacroAssembler::totalNumberOfRegisters()> m_map { { } };
+};
+
+template<typename T>
+class GPRMap {
+public:
+    T& operator[](GPRReg gpr)
+    {
+        return m_map[MacroAssembler::registerIndex(gpr)];
+    }
+
+    const T& operator[](GPRReg gpr) const
+    {
+        return m_map[MacroAssembler::registerIndex(gpr)];
+    }
+
+private:
+    std::array<T, MacroAssembler::numberOfRegisters()> m_map { { } };
+};
+
+template<typename T>
+class FPRMap {
+public:
+    T& operator[](FPRReg fpr)
+    {
+        return m_map[MacroAssembler::fpRegisterIndex(fpr)];
+    }
+
+    const T& operator[](FPRReg fpr) const
+    {
+        return m_map[MacroAssembler::fpRegisterIndex(fpr)];
+    }
+
+private:
+    std::array<T, MacroAssembler::numberOfFPRegisters()> m_map { { } };
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/RegisterSet.cpp b/jit/RegisterSet.cpp
new file mode 100644
index 0000000..721a4ea
--- /dev/null
+++ b/jit/RegisterSet.cpp
@@ -0,0 +1,381 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegisterSet.h"
+
+#if ENABLE(JIT)
+
+#include "GPRInfo.h"
+#include "MacroAssembler.h"
+#include "JSCInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+RegisterSet RegisterSet::stackRegisters()
+{
+    return RegisterSet(
+        MacroAssembler::stackPointerRegister,
+        MacroAssembler::framePointerRegister);
+}
+
+RegisterSet RegisterSet::reservedHardwareRegisters()
+{
+#if CPU(ARM64)
+#if PLATFORM(IOS)
+    return RegisterSet(ARM64Registers::x18, ARM64Registers::lr);
+#else
+    return RegisterSet(ARM64Registers::lr);
+#endif // PLATFORM(IOS)
+#else
+    return RegisterSet();
+#endif
+}
+
+RegisterSet RegisterSet::runtimeRegisters()
+{
+#if USE(JSVALUE64)
+    return RegisterSet(GPRInfo::tagTypeNumberRegister, GPRInfo::tagMaskRegister);
+#else
+    return RegisterSet();
+#endif
+}
+
+RegisterSet RegisterSet::specialRegisters()
+{
+    return RegisterSet(
+        stackRegisters(), reservedHardwareRegisters(), runtimeRegisters());
+}
+
+RegisterSet RegisterSet::volatileRegistersForJSCall()
+{
+    RegisterSet volatileRegisters = allRegisters();
+    volatileRegisters.exclude(RegisterSet::stackRegisters());
+    volatileRegisters.exclude(RegisterSet::reservedHardwareRegisters());
+    volatileRegisters.exclude(RegisterSet::vmCalleeSaveRegisters());
+    return volatileRegisters;
+}
+
+RegisterSet RegisterSet::stubUnavailableRegisters()
+{
+    return RegisterSet(specialRegisters(), vmCalleeSaveRegisters());
+}
+
+RegisterSet RegisterSet::macroScratchRegisters()
+{
+#if CPU(X86_64)
+    return RegisterSet(MacroAssembler::s_scratchRegister);
+#elif CPU(ARM64)
+    return RegisterSet(MacroAssembler::dataTempRegister, MacroAssembler::memoryTempRegister);
+#elif CPU(MIPS)
+    RegisterSet result;
+    result.set(MacroAssembler::immTempRegister);
+    result.set(MacroAssembler::dataTempRegister);
+    result.set(MacroAssembler::addrTempRegister);
+    result.set(MacroAssembler::cmpTempRegister);
+    return result;
+#else
+    return RegisterSet();
+#endif
+}
+
+RegisterSet RegisterSet::calleeSaveRegisters()
+{
+    RegisterSet result;
+#if CPU(X86)
+    result.set(X86Registers::ebx);
+    result.set(X86Registers::ebp);
+    result.set(X86Registers::edi);
+    result.set(X86Registers::esi);
+#elif CPU(X86_64)
+    result.set(X86Registers::ebx);
+    result.set(X86Registers::ebp);
+    result.set(X86Registers::r12);
+    result.set(X86Registers::r13);
+    result.set(X86Registers::r14);
+    result.set(X86Registers::r15);
+#elif CPU(ARM_THUMB2)
+    result.set(ARMRegisters::r4);
+    result.set(ARMRegisters::r5);
+    result.set(ARMRegisters::r6);
+    result.set(ARMRegisters::r8);
+#if !PLATFORM(IOS)
+    result.set(ARMRegisters::r9);
+#endif
+    result.set(ARMRegisters::r10);
+    result.set(ARMRegisters::r11);
+#elif CPU(ARM_TRADITIONAL)
+    result.set(ARMRegisters::r4);
+    result.set(ARMRegisters::r5);
+    result.set(ARMRegisters::r6);
+    result.set(ARMRegisters::r7);
+    result.set(ARMRegisters::r8);
+    result.set(ARMRegisters::r9);
+    result.set(ARMRegisters::r10);
+    result.set(ARMRegisters::r11);
+#elif CPU(ARM64)
+    // We don't include LR in the set of callee-save registers even though it technically belongs
+    // there. This is because we use this set to describe the set of registers that need to be saved
+    // beyond what you would save by the platform-agnostic "preserve return address" and "restore
+    // return address" operations in CCallHelpers.
+    for (
+        ARM64Registers::RegisterID reg = ARM64Registers::x19;
+        reg <= ARM64Registers::x28;
+        reg = static_cast<ARM64Registers::RegisterID>(reg + 1))
+        result.set(reg);
+    result.set(ARM64Registers::fp);
+    for (
+        ARM64Registers::FPRegisterID reg = ARM64Registers::q8;
+        reg <= ARM64Registers::q15;
+        reg = static_cast<ARM64Registers::FPRegisterID>(reg + 1))
+        result.set(reg);
+#elif CPU(MIPS)
+#else
+    UNREACHABLE_FOR_PLATFORM();
+#endif
+    return result;
+}
+
+RegisterSet RegisterSet::vmCalleeSaveRegisters()
+{
+    RegisterSet result;
+#if CPU(X86_64)
+    result.set(GPRInfo::regCS0);
+    result.set(GPRInfo::regCS1);
+    result.set(GPRInfo::regCS2);
+    result.set(GPRInfo::regCS3);
+    result.set(GPRInfo::regCS4);
+#if OS(WINDOWS)
+    result.set(GPRInfo::regCS5);
+    result.set(GPRInfo::regCS6);
+#endif
+#elif CPU(ARM64)
+    result.set(GPRInfo::regCS0);
+    result.set(GPRInfo::regCS1);
+    result.set(GPRInfo::regCS2);
+    result.set(GPRInfo::regCS3);
+    result.set(GPRInfo::regCS4);
+    result.set(GPRInfo::regCS5);
+    result.set(GPRInfo::regCS6);
+    result.set(GPRInfo::regCS7);
+    result.set(GPRInfo::regCS8);
+    result.set(GPRInfo::regCS9);
+    result.set(FPRInfo::fpRegCS0);
+    result.set(FPRInfo::fpRegCS1);
+    result.set(FPRInfo::fpRegCS2);
+    result.set(FPRInfo::fpRegCS3);
+    result.set(FPRInfo::fpRegCS4);
+    result.set(FPRInfo::fpRegCS5);
+    result.set(FPRInfo::fpRegCS6);
+    result.set(FPRInfo::fpRegCS7);
+#endif
+    return result;
+}
+
+RegisterSet RegisterSet::llintBaselineCalleeSaveRegisters()
+{
+    RegisterSet result;
+#if CPU(X86)
+#elif CPU(X86_64)
+#if !OS(WINDOWS)
+    result.set(GPRInfo::regCS2);
+    ASSERT(GPRInfo::regCS3 == GPRInfo::tagTypeNumberRegister);
+    ASSERT(GPRInfo::regCS4 == GPRInfo::tagMaskRegister);
+    result.set(GPRInfo::regCS3);
+    result.set(GPRInfo::regCS4);
+#else
+    result.set(GPRInfo::regCS4);
+    ASSERT(GPRInfo::regCS5 == GPRInfo::tagTypeNumberRegister);
+    ASSERT(GPRInfo::regCS6 == GPRInfo::tagMaskRegister);
+    result.set(GPRInfo::regCS5);
+    result.set(GPRInfo::regCS6);
+#endif
+#elif CPU(ARM_THUMB2)
+#elif CPU(ARM_TRADITIONAL)
+#elif CPU(ARM64)
+    result.set(GPRInfo::regCS7);
+    ASSERT(GPRInfo::regCS8 == GPRInfo::tagTypeNumberRegister);
+    ASSERT(GPRInfo::regCS9 == GPRInfo::tagMaskRegister);
+    result.set(GPRInfo::regCS8);
+    result.set(GPRInfo::regCS9);
+#elif CPU(MIPS)
+#elif CPU(SH4)
+#else
+    UNREACHABLE_FOR_PLATFORM();
+#endif
+    return result;
+}
+
+RegisterSet RegisterSet::dfgCalleeSaveRegisters()
+{
+    RegisterSet result;
+#if CPU(X86)
+#elif CPU(X86_64)
+    result.set(GPRInfo::regCS0);
+    result.set(GPRInfo::regCS1);
+    result.set(GPRInfo::regCS2);
+#if !OS(WINDOWS)
+    ASSERT(GPRInfo::regCS3 == GPRInfo::tagTypeNumberRegister);
+    ASSERT(GPRInfo::regCS4 == GPRInfo::tagMaskRegister);
+    result.set(GPRInfo::regCS3);
+    result.set(GPRInfo::regCS4);
+#else
+    result.set(GPRInfo::regCS3);
+    result.set(GPRInfo::regCS4);
+    ASSERT(GPRInfo::regCS5 == GPRInfo::tagTypeNumberRegister);
+    ASSERT(GPRInfo::regCS6 == GPRInfo::tagMaskRegister);
+    result.set(GPRInfo::regCS5);
+    result.set(GPRInfo::regCS6);
+#endif
+#elif CPU(ARM_THUMB2)
+#elif CPU(ARM_TRADITIONAL)
+#elif CPU(ARM64)
+    ASSERT(GPRInfo::regCS8 == GPRInfo::tagTypeNumberRegister);
+    ASSERT(GPRInfo::regCS9 == GPRInfo::tagMaskRegister);
+    result.set(GPRInfo::regCS8);
+    result.set(GPRInfo::regCS9);
+#elif CPU(MIPS)
+#elif CPU(SH4)
+#else
+    UNREACHABLE_FOR_PLATFORM();
+#endif
+    return result;
+}
+
+RegisterSet RegisterSet::ftlCalleeSaveRegisters()
+{
+    RegisterSet result;
+#if ENABLE(FTL_JIT)
+#if CPU(X86_64) && !OS(WINDOWS)
+    result.set(GPRInfo::regCS0);
+    result.set(GPRInfo::regCS1);
+    result.set(GPRInfo::regCS2);
+    ASSERT(GPRInfo::regCS3 == GPRInfo::tagTypeNumberRegister);
+    ASSERT(GPRInfo::regCS4 == GPRInfo::tagMaskRegister);
+    result.set(GPRInfo::regCS3);
+    result.set(GPRInfo::regCS4);
+#elif CPU(ARM64)
+    // B3 might save and use all ARM64 callee saves specified in the ABI.
+    result.set(GPRInfo::regCS0);
+    result.set(GPRInfo::regCS1);
+    result.set(GPRInfo::regCS2);
+    result.set(GPRInfo::regCS3);
+    result.set(GPRInfo::regCS4);
+    result.set(GPRInfo::regCS5);
+    result.set(GPRInfo::regCS6);
+    result.set(GPRInfo::regCS7);
+    ASSERT(GPRInfo::regCS8 == GPRInfo::tagTypeNumberRegister);
+    ASSERT(GPRInfo::regCS9 == GPRInfo::tagMaskRegister);
+    result.set(GPRInfo::regCS8);
+    result.set(GPRInfo::regCS9);
+    result.set(FPRInfo::fpRegCS0);
+    result.set(FPRInfo::fpRegCS1);
+    result.set(FPRInfo::fpRegCS2);
+    result.set(FPRInfo::fpRegCS3);
+    result.set(FPRInfo::fpRegCS4);
+    result.set(FPRInfo::fpRegCS5);
+    result.set(FPRInfo::fpRegCS6);
+    result.set(FPRInfo::fpRegCS7);
+#else
+    UNREACHABLE_FOR_PLATFORM();
+#endif
+#endif
+    return result;
+}
+
+RegisterSet RegisterSet::argumentGPRS()
+{
+    RegisterSet result;
+#if NUMBER_OF_ARGUMENT_REGISTERS
+    for (unsigned i = 0; i < GPRInfo::numberOfArgumentRegisters; i++)
+        result.set(GPRInfo::toArgumentRegister(i));
+#endif
+    return result;
+}
+
+RegisterSet RegisterSet::registersToNotSaveForJSCall()
+{
+    return RegisterSet(RegisterSet::vmCalleeSaveRegisters(), RegisterSet::stackRegisters(), RegisterSet::reservedHardwareRegisters());
+}
+
+RegisterSet RegisterSet::registersToNotSaveForCCall()
+{
+    return RegisterSet(RegisterSet::calleeSaveRegisters(), RegisterSet::stackRegisters(), RegisterSet::reservedHardwareRegisters());
+}
+
+RegisterSet RegisterSet::allGPRs()
+{
+    RegisterSet result;
+    for (MacroAssembler::RegisterID reg = MacroAssembler::firstRegister(); reg <= MacroAssembler::lastRegister(); reg = static_cast<MacroAssembler::RegisterID>(reg + 1))
+        result.set(reg);
+    return result;
+}
+
+RegisterSet RegisterSet::allFPRs()
+{
+    RegisterSet result;
+    for (MacroAssembler::FPRegisterID reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = static_cast<MacroAssembler::FPRegisterID>(reg + 1))
+        result.set(reg);
+    return result;
+}
+
+RegisterSet RegisterSet::allRegisters()
+{
+    RegisterSet result;
+    result.merge(allGPRs());
+    result.merge(allFPRs());
+    return result;
+}
+
+size_t RegisterSet::numberOfSetGPRs() const
+{
+    RegisterSet temp = *this;
+    temp.filter(allGPRs());
+    return temp.numberOfSetRegisters();
+}
+
+size_t RegisterSet::numberOfSetFPRs() const
+{
+    RegisterSet temp = *this;
+    temp.filter(allFPRs());
+    return temp.numberOfSetRegisters();
+}
+
+void RegisterSet::dump(PrintStream& out) const
+{
+    CommaPrinter comma;
+    out.print("[");
+    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
+        if (get(reg))
+            out.print(comma, reg);
+    }
+    out.print("]");
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/RegisterSet.h b/jit/RegisterSet.h
new file mode 100644
index 0000000..0359066
--- /dev/null
+++ b/jit/RegisterSet.h
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+#include "MacroAssembler.h"
+#include "Reg.h"
+#include "TempRegisterSet.h"
+#include <wtf/Bitmap.h>
+
+namespace JSC {
+
+class RegisterSet {
+public:
+    template<typename... Regs>
+    explicit RegisterSet(Regs... regs)
+    {
+        setMany(regs...);
+    }
+    
+    JS_EXPORT_PRIVATE static RegisterSet stackRegisters();
+    JS_EXPORT_PRIVATE static RegisterSet reservedHardwareRegisters();
+    static RegisterSet runtimeRegisters();
+    static RegisterSet specialRegisters(); // The union of stack, reserved hardware, and runtime registers.
+    JS_EXPORT_PRIVATE static RegisterSet calleeSaveRegisters();
+    static RegisterSet vmCalleeSaveRegisters(); // Callee save registers that might be saved and used by any tier.
+    static RegisterSet llintBaselineCalleeSaveRegisters(); // Registers saved and used by the LLInt.
+    static RegisterSet dfgCalleeSaveRegisters(); // Registers saved and used by the DFG JIT.
+    static RegisterSet ftlCalleeSaveRegisters(); // Registers that might be saved and used by the FTL JIT.
+#if ENABLE(WEBASSEMBLY)
+    static RegisterSet webAssemblyCalleeSaveRegisters(); // Registers saved and used by the WebAssembly JIT.
+#endif
+    static RegisterSet volatileRegistersForJSCall();
+    static RegisterSet stubUnavailableRegisters(); // The union of callee saves and special registers.
+    JS_EXPORT_PRIVATE static RegisterSet macroScratchRegisters();
+    JS_EXPORT_PRIVATE static RegisterSet allGPRs();
+    JS_EXPORT_PRIVATE static RegisterSet allFPRs();
+    static RegisterSet allRegisters();
+    static RegisterSet argumentGPRS();
+
+    static RegisterSet registersToNotSaveForJSCall();
+    static RegisterSet registersToNotSaveForCCall();
+    
+    void set(Reg reg, bool value = true)
+    {
+        ASSERT(!!reg);
+        m_bits.set(reg.index(), value);
+    }
+    
+    void set(JSValueRegs regs, bool value = true)
+    {
+        if (regs.tagGPR() != InvalidGPRReg)
+            set(regs.tagGPR(), value);
+        set(regs.payloadGPR(), value);
+    }
+    
+    void clear(Reg reg)
+    {
+        ASSERT(!!reg);
+        set(reg, false);
+    }
+    
+    bool get(Reg reg) const
+    {
+        ASSERT(!!reg);
+        return m_bits.get(reg.index());
+    }
+    
+    template<typename Iterable>
+    void setAll(const Iterable& iterable)
+    {
+        for (Reg reg : iterable)
+            set(reg);
+    }
+    
+    void merge(const RegisterSet& other) { m_bits.merge(other.m_bits); }
+    void filter(const RegisterSet& other) { m_bits.filter(other.m_bits); }
+    void exclude(const RegisterSet& other) { m_bits.exclude(other.m_bits); }
+    
+    size_t numberOfSetGPRs() const;
+    size_t numberOfSetFPRs() const;
+    size_t numberOfSetRegisters() const { return m_bits.count(); }
+    
+    bool isEmpty() const { return m_bits.isEmpty(); }
+    
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+    
+    enum EmptyValueTag { EmptyValue };
+    enum DeletedValueTag { DeletedValue };
+    
+    RegisterSet(EmptyValueTag)
+    {
+        m_bits.set(hashSpecialBitIndex);
+    }
+    
+    RegisterSet(DeletedValueTag)
+    {
+        m_bits.set(hashSpecialBitIndex);
+        m_bits.set(deletedBitIndex);
+    }
+    
+    bool isEmptyValue() const
+    {
+        return m_bits.get(hashSpecialBitIndex) && !m_bits.get(deletedBitIndex);
+    }
+    
+    bool isDeletedValue() const
+    {
+        return m_bits.get(hashSpecialBitIndex) && m_bits.get(deletedBitIndex);
+    }
+    
+    bool operator==(const RegisterSet& other) const { return m_bits == other.m_bits; }
+    bool operator!=(const RegisterSet& other) const { return m_bits != other.m_bits; }
+    
+    unsigned hash() const { return m_bits.hash(); }
+    
+    template<typename Func>
+    void forEach(const Func& func) const
+    {
+        m_bits.forEachSetBit(
+            [&] (size_t index) {
+                func(Reg::fromIndex(index));
+            });
+    }
+    
+private:
+    void setAny(Reg reg) { set(reg); }
+    void setAny(const RegisterSet& set) { merge(set); }
+    void setMany() { }
+    template<typename RegType, typename... Regs>
+    void setMany(RegType reg, Regs... regs)
+    {
+        setAny(reg);
+        setMany(regs...);
+    }
+
+    // These offsets mirror the logic in Reg.h.
+    static const unsigned gprOffset = 0;
+    static const unsigned fprOffset = gprOffset + MacroAssembler::numGPRs;
+    static const unsigned hashSpecialBitIndex = fprOffset + MacroAssembler::numFPRs;
+    static const unsigned deletedBitIndex = 0;
+    
+    Bitmap<MacroAssembler::numGPRs + MacroAssembler::numFPRs + 1> m_bits;
+};
+
+struct RegisterSetHash {
+    static unsigned hash(const RegisterSet& set) { return set.hash(); }
+    static bool equal(const RegisterSet& a, const RegisterSet& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = false;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::RegisterSet> {
+    typedef JSC::RegisterSetHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::RegisterSet> : public CustomHashTraits<JSC::RegisterSet> { };
+
+} // namespace WTF
+
+#endif // ENABLE(JIT)
diff --git a/jit/Repatch.cpp b/jit/Repatch.cpp
new file mode 100644
index 0000000..d4f98f8
--- /dev/null
+++ b/jit/Repatch.cpp
@@ -0,0 +1,1004 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Repatch.h"
+
+#if ENABLE(JIT)
+
+#include "BinarySwitch.h"
+#include "CCallHelpers.h"
+#include "CallFrameShuffler.h"
+#include "DFGOperations.h"
+#include "DFGSpeculativeJIT.h"
+#include "DOMJITGetterSetter.h"
+#include "DirectArguments.h"
+#include "FTLThunks.h"
+#include "FunctionCodeBlock.h"
+#include "GCAwareJITStubRoutine.h"
+#include "GetterSetter.h"
+#include "ICStats.h"
+#include "InlineAccess.h"
+#include "JIT.h"
+#include "JITInlines.h"
+#include "JSCInlines.h"
+#include "JSWebAssembly.h"
+#include "LinkBuffer.h"
+#include "PolymorphicAccess.h"
+#include "ScopedArguments.h"
+#include "ScratchRegisterAllocator.h"
+#include "StackAlignment.h"
+#include "StructureRareDataInlines.h"
+#include "StructureStubClearingWatchpoint.h"
+#include "StructureStubInfo.h"
+#include "ThunkGenerators.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/ListDump.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+static FunctionPtr readCallTarget(CodeBlock* codeBlock, CodeLocationCall call)
+{
+    FunctionPtr result = MacroAssembler::readCallTarget(call);
+#if ENABLE(FTL_JIT)
+    if (codeBlock->jitType() == JITCode::FTLJIT) {
+        return FunctionPtr(codeBlock->vm()->ftlThunks->keyForSlowPathCallThunk(
+            MacroAssemblerCodePtr::createFromExecutableAddress(
+                result.executableAddress())).callTarget());
+    }
+#else
+    UNUSED_PARAM(codeBlock);
+#endif // ENABLE(FTL_JIT)
+    return result;
+}
+
+void ftlThunkAwareRepatchCall(CodeBlock* codeBlock, CodeLocationCall call, FunctionPtr newCalleeFunction)
+{
+#if ENABLE(FTL_JIT)
+    if (codeBlock->jitType() == JITCode::FTLJIT) {
+        VM& vm = *codeBlock->vm();
+        FTL::Thunks& thunks = *vm.ftlThunks;
+        FTL::SlowPathCallKey key = thunks.keyForSlowPathCallThunk(
+            MacroAssemblerCodePtr::createFromExecutableAddress(
+                MacroAssembler::readCallTarget(call).executableAddress()));
+        key = key.withCallTarget(newCalleeFunction.executableAddress());
+        newCalleeFunction = FunctionPtr(
+            thunks.getSlowPathCallThunk(vm, key).code().executableAddress());
+    }
+#else // ENABLE(FTL_JIT)
+    UNUSED_PARAM(codeBlock);
+#endif // ENABLE(FTL_JIT)
+    MacroAssembler::repatchCall(call, newCalleeFunction);
+}
+
+enum InlineCacheAction {
+    GiveUpOnCache,
+    RetryCacheLater,
+    AttemptToCache
+};
+
+static InlineCacheAction actionForCell(VM& vm, JSCell* cell)
+{
+    Structure* structure = cell->structure(vm);
+
+    TypeInfo typeInfo = structure->typeInfo();
+    if (typeInfo.prohibitsPropertyCaching())
+        return GiveUpOnCache;
+
+    if (structure->isUncacheableDictionary()) {
+        if (structure->hasBeenFlattenedBefore())
+            return GiveUpOnCache;
+        // Flattening could have changed the offset, so return early for another try.
+        asObject(cell)->flattenDictionaryObject(vm);
+        return RetryCacheLater;
+    }
+    
+    if (!structure->propertyAccessesAreCacheable())
+        return GiveUpOnCache;
+
+    return AttemptToCache;
+}
+
+static bool forceICFailure(ExecState*)
+{
+#if CPU(ARM_TRADITIONAL)
+    // FIXME: Remove this workaround once the proper fixes are landed.
+    // [ARM] Disable Inline Caching on ARMv7 traditional until proper fix
+    // https://bugs.webkit.org/show_bug.cgi?id=159759
+    return true;
+#else
+    return Options::forceICFailure();
+#endif
+}
+
+inline J_JITOperation_ESsiJI appropriateOptimizingGetByIdFunction(GetByIDKind kind)
+{
+    if (kind == GetByIDKind::Normal)
+        return operationGetByIdOptimize;
+    return operationTryGetByIdOptimize;
+}
+
+inline J_JITOperation_ESsiJI appropriateGenericGetByIdFunction(GetByIDKind kind)
+{
+    if (kind == GetByIDKind::Normal)
+        return operationGetById;
+    return operationTryGetById;
+}
+
+static InlineCacheAction tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot, StructureStubInfo& stubInfo, GetByIDKind kind)
+{
+    if (forceICFailure(exec))
+        return GiveUpOnCache;
+    
+    // FIXME: Cache property access for immediates.
+    if (!baseValue.isCell())
+        return GiveUpOnCache;
+
+    CodeBlock* codeBlock = exec->codeBlock();
+    VM& vm = exec->vm();
+
+    std::unique_ptr<AccessCase> newCase;
+
+    if (propertyName == vm.propertyNames->length) {
+        if (isJSArray(baseValue)) {
+            if (stubInfo.cacheType == CacheType::Unset
+                && slot.slotBase() == baseValue
+                && InlineAccess::isCacheableArrayLength(stubInfo, jsCast<JSArray*>(baseValue))) {
+
+                bool generatedCodeInline = InlineAccess::generateArrayLength(*codeBlock->vm(), stubInfo, jsCast<JSArray*>(baseValue));
+                if (generatedCodeInline) {
+                    ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation(), appropriateOptimizingGetByIdFunction(kind));
+                    stubInfo.initArrayLength();
+                    return RetryCacheLater;
+                }
+            }
+
+            newCase = AccessCase::getLength(vm, codeBlock, AccessCase::ArrayLength);
+        } else if (isJSString(baseValue))
+            newCase = AccessCase::getLength(vm, codeBlock, AccessCase::StringLength);
+        else if (DirectArguments* arguments = jsDynamicCast<DirectArguments*>(baseValue)) {
+            // If there were overrides, then we can handle this as a normal property load! Guarding
+            // this with such a check enables us to add an IC case for that load if needed.
+            if (!arguments->overrodeThings())
+                newCase = AccessCase::getLength(vm, codeBlock, AccessCase::DirectArgumentsLength);
+        } else if (ScopedArguments* arguments = jsDynamicCast<ScopedArguments*>(baseValue)) {
+            // Ditto.
+            if (!arguments->overrodeThings())
+                newCase = AccessCase::getLength(vm, codeBlock, AccessCase::ScopedArgumentsLength);
+        }
+    }
+    
+    if (!newCase) {
+        if (!slot.isCacheable() && !slot.isUnset())
+            return GiveUpOnCache;
+
+        ObjectPropertyConditionSet conditionSet;
+        JSCell* baseCell = baseValue.asCell();
+        Structure* structure = baseCell->structure(vm);
+
+        bool loadTargetFromProxy = false;
+        if (baseCell->type() == PureForwardingProxyType) {
+            baseValue = jsCast<JSProxy*>(baseCell)->target();
+            baseCell = baseValue.asCell();
+            structure = baseCell->structure(vm);
+            loadTargetFromProxy = true;
+        }
+
+        InlineCacheAction action = actionForCell(vm, baseCell);
+        if (action != AttemptToCache)
+            return action;
+
+        // Optimize self access.
+        if (stubInfo.cacheType == CacheType::Unset
+            && slot.isCacheableValue()
+            && slot.slotBase() == baseValue
+            && !slot.watchpointSet()
+            && !structure->needImpurePropertyWatchpoint()
+            && !loadTargetFromProxy) {
+
+            bool generatedCodeInline = InlineAccess::generateSelfPropertyAccess(*codeBlock->vm(), stubInfo, structure, slot.cachedOffset());
+            if (generatedCodeInline) {
+                LOG_IC((ICEvent::GetByIdSelfPatch, structure->classInfo(), propertyName));
+                structure->startWatchingPropertyForReplacements(vm, slot.cachedOffset());
+                ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation(), appropriateOptimizingGetByIdFunction(kind));
+                stubInfo.initGetByIdSelf(codeBlock, structure, slot.cachedOffset());
+                return RetryCacheLater;
+            }
+        }
+
+        PropertyOffset offset = slot.isUnset() ? invalidOffset : slot.cachedOffset();
+
+        if (slot.isUnset() || slot.slotBase() != baseValue) {
+            if (structure->typeInfo().prohibitsPropertyCaching())
+                return GiveUpOnCache;
+
+            if (structure->isDictionary()) {
+                if (structure->hasBeenFlattenedBefore())
+                    return GiveUpOnCache;
+                structure->flattenDictionaryStructure(vm, jsCast<JSObject*>(baseCell));
+            }
+            
+            if (slot.isUnset() && structure->typeInfo().getOwnPropertySlotIsImpureForPropertyAbsence())
+                return GiveUpOnCache;
+
+            if (slot.isUnset()) {
+                conditionSet = generateConditionsForPropertyMiss(
+                    vm, codeBlock, exec, structure, propertyName.impl());
+            } else {
+                conditionSet = generateConditionsForPrototypePropertyHit(
+                    vm, codeBlock, exec, structure, slot.slotBase(),
+                    propertyName.impl());
+            }
+            
+            if (!conditionSet.isValid())
+                return GiveUpOnCache;
+
+            offset = slot.isUnset() ? invalidOffset : conditionSet.slotBaseCondition().offset();
+        }
+
+        JSFunction* getter = nullptr;
+        if (slot.isCacheableGetter())
+            getter = jsDynamicCast<JSFunction*>(slot.getterSetter()->getter());
+
+        DOMJIT::GetterSetter* domJIT = nullptr;
+        if (slot.isCacheableCustom() && slot.domJIT())
+            domJIT = slot.domJIT();
+
+        if (kind == GetByIDKind::Pure) {
+            AccessCase::AccessType type;
+            if (slot.isCacheableValue())
+                type = AccessCase::Load;
+            else if (slot.isUnset())
+                type = AccessCase::Miss;
+            else if (slot.isCacheableGetter())
+                type = AccessCase::GetGetter;
+            else
+                RELEASE_ASSERT_NOT_REACHED();
+
+            newCase = AccessCase::tryGet(vm, codeBlock, type, offset, structure, conditionSet, loadTargetFromProxy, slot.watchpointSet());
+        } else if (!loadTargetFromProxy && getter && AccessCase::canEmitIntrinsicGetter(getter, structure))
+            newCase = AccessCase::getIntrinsic(vm, codeBlock, getter, slot.cachedOffset(), structure, conditionSet);
+        else {
+            AccessCase::AccessType type;
+            if (slot.isCacheableValue())
+                type = AccessCase::Load;
+            else if (slot.isUnset())
+                type = AccessCase::Miss;
+            else if (slot.isCacheableGetter())
+                type = AccessCase::Getter;
+            else if (slot.attributes() & CustomAccessor)
+                type = AccessCase::CustomAccessorGetter;
+            else
+                type = AccessCase::CustomValueGetter;
+
+            newCase = AccessCase::get(
+                vm, codeBlock, type, offset, structure, conditionSet, loadTargetFromProxy,
+                slot.watchpointSet(), slot.isCacheableCustom() ? slot.customGetter() : nullptr,
+                slot.isCacheableCustom() ? slot.slotBase() : nullptr,
+                domJIT);
+        }
+    }
+
+    LOG_IC((ICEvent::GetByIdAddAccessCase, baseValue.classInfoOrNull(), propertyName));
+
+    AccessGenerationResult result = stubInfo.addAccessCase(codeBlock, propertyName, WTFMove(newCase));
+
+    if (result.generatedSomeCode()) {
+        LOG_IC((ICEvent::GetByIdReplaceWithJump, baseValue.classInfoOrNull(), propertyName));
+        
+        RELEASE_ASSERT(result.code());
+        InlineAccess::rewireStubAsJump(exec->vm(), stubInfo, CodeLocationLabel(result.code()));
+    }
+    
+    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
+}
+
+void repatchGetByID(ExecState* exec, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot, StructureStubInfo& stubInfo, GetByIDKind kind)
+{
+    SuperSamplerScope superSamplerScope(false);
+    GCSafeConcurrentJSLocker locker(exec->codeBlock()->m_lock, exec->vm().heap);
+    
+    if (tryCacheGetByID(exec, baseValue, propertyName, slot, stubInfo, kind) == GiveUpOnCache)
+        ftlThunkAwareRepatchCall(exec->codeBlock(), stubInfo.slowPathCallLocation(), appropriateGenericGetByIdFunction(kind));
+}
+
+static V_JITOperation_ESsiJJI appropriateGenericPutByIdFunction(const PutPropertySlot &slot, PutKind putKind)
+{
+    if (slot.isStrictMode()) {
+        if (putKind == Direct)
+            return operationPutByIdDirectStrict;
+        return operationPutByIdStrict;
+    }
+    if (putKind == Direct)
+        return operationPutByIdDirectNonStrict;
+    return operationPutByIdNonStrict;
+}
+
+static V_JITOperation_ESsiJJI appropriateOptimizingPutByIdFunction(const PutPropertySlot &slot, PutKind putKind)
+{
+    if (slot.isStrictMode()) {
+        if (putKind == Direct)
+            return operationPutByIdDirectStrictOptimize;
+        return operationPutByIdStrictOptimize;
+    }
+    if (putKind == Direct)
+        return operationPutByIdDirectNonStrictOptimize;
+    return operationPutByIdNonStrictOptimize;
+}
+
+static InlineCacheAction tryCachePutByID(ExecState* exec, JSValue baseValue, Structure* structure, const Identifier& ident, const PutPropertySlot& slot, StructureStubInfo& stubInfo, PutKind putKind)
+{
+    if (forceICFailure(exec))
+        return GiveUpOnCache;
+    
+    CodeBlock* codeBlock = exec->codeBlock();
+    VM& vm = exec->vm();
+
+    if (!baseValue.isCell())
+        return GiveUpOnCache;
+    
+    if (!slot.isCacheablePut() && !slot.isCacheableCustom() && !slot.isCacheableSetter())
+        return GiveUpOnCache;
+
+    if (!structure->propertyAccessesAreCacheable())
+        return GiveUpOnCache;
+
+    std::unique_ptr<AccessCase> newCase;
+
+    if (slot.base() == baseValue && slot.isCacheablePut()) {
+        if (slot.type() == PutPropertySlot::ExistingProperty) {
+            structure->didCachePropertyReplacement(vm, slot.cachedOffset());
+        
+            if (stubInfo.cacheType == CacheType::Unset
+                && InlineAccess::canGenerateSelfPropertyReplace(stubInfo, slot.cachedOffset())
+                && !structure->needImpurePropertyWatchpoint()
+                && !structure->inferredTypeFor(ident.impl())) {
+                
+                bool generatedCodeInline = InlineAccess::generateSelfPropertyReplace(vm, stubInfo, structure, slot.cachedOffset());
+                if (generatedCodeInline) {
+                    LOG_IC((ICEvent::PutByIdSelfPatch, structure->classInfo(), ident));
+                    ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation(), appropriateOptimizingPutByIdFunction(slot, putKind));
+                    stubInfo.initPutByIdReplace(codeBlock, structure, slot.cachedOffset());
+                    return RetryCacheLater;
+                }
+            }
+
+            newCase = AccessCase::replace(vm, codeBlock, structure, slot.cachedOffset());
+        } else {
+            ASSERT(slot.type() == PutPropertySlot::NewProperty);
+
+            if (!structure->isObject())
+                return GiveUpOnCache;
+
+            if (structure->isDictionary()) {
+                if (structure->hasBeenFlattenedBefore())
+                    return GiveUpOnCache;
+                structure->flattenDictionaryStructure(vm, jsCast<JSObject*>(baseValue));
+            }
+
+            PropertyOffset offset;
+            Structure* newStructure =
+                Structure::addPropertyTransitionToExistingStructureConcurrently(
+                    structure, ident.impl(), 0, offset);
+            if (!newStructure || !newStructure->propertyAccessesAreCacheable())
+                return GiveUpOnCache;
+
+            ASSERT(newStructure->previousID() == structure);
+            ASSERT(!newStructure->isDictionary());
+            ASSERT(newStructure->isObject());
+            
+            ObjectPropertyConditionSet conditionSet;
+            if (putKind == NotDirect) {
+                conditionSet =
+                    generateConditionsForPropertySetterMiss(
+                        vm, codeBlock, exec, newStructure, ident.impl());
+                if (!conditionSet.isValid())
+                    return GiveUpOnCache;
+            }
+
+            newCase = AccessCase::transition(vm, codeBlock, structure, newStructure, offset, conditionSet);
+        }
+    } else if (slot.isCacheableCustom() || slot.isCacheableSetter()) {
+        if (slot.isCacheableCustom()) {
+            ObjectPropertyConditionSet conditionSet;
+
+            if (slot.base() != baseValue) {
+                conditionSet =
+                    generateConditionsForPrototypePropertyHitCustom(
+                        vm, codeBlock, exec, structure, slot.base(), ident.impl());
+                if (!conditionSet.isValid())
+                    return GiveUpOnCache;
+            }
+
+            newCase = AccessCase::setter(
+                vm, codeBlock, slot.isCustomAccessor() ? AccessCase::CustomAccessorSetter : AccessCase::CustomValueSetter, structure, invalidOffset, conditionSet,
+                slot.customSetter(), slot.base());
+        } else {
+            ObjectPropertyConditionSet conditionSet;
+            PropertyOffset offset;
+
+            if (slot.base() != baseValue) {
+                conditionSet =
+                    generateConditionsForPrototypePropertyHit(
+                        vm, codeBlock, exec, structure, slot.base(), ident.impl());
+                if (!conditionSet.isValid())
+                    return GiveUpOnCache;
+                offset = conditionSet.slotBaseCondition().offset();
+            } else
+                offset = slot.cachedOffset();
+
+            newCase = AccessCase::setter(
+                vm, codeBlock, AccessCase::Setter, structure, offset, conditionSet);
+        }
+    }
+
+    LOG_IC((ICEvent::PutByIdAddAccessCase, structure->classInfo(), ident));
+    
+    AccessGenerationResult result = stubInfo.addAccessCase(codeBlock, ident, WTFMove(newCase));
+    
+    if (result.generatedSomeCode()) {
+        LOG_IC((ICEvent::PutByIdReplaceWithJump, structure->classInfo(), ident));
+        
+        RELEASE_ASSERT(result.code());
+
+        InlineAccess::rewireStubAsJump(vm, stubInfo, CodeLocationLabel(result.code()));
+    }
+    
+    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
+}
+
+void repatchPutByID(ExecState* exec, JSValue baseValue, Structure* structure, const Identifier& propertyName, const PutPropertySlot& slot, StructureStubInfo& stubInfo, PutKind putKind)
+{
+    SuperSamplerScope superSamplerScope(false);
+    GCSafeConcurrentJSLocker locker(exec->codeBlock()->m_lock, exec->vm().heap);
+    
+    if (tryCachePutByID(exec, baseValue, structure, propertyName, slot, stubInfo, putKind) == GiveUpOnCache)
+        ftlThunkAwareRepatchCall(exec->codeBlock(), stubInfo.slowPathCallLocation(), appropriateGenericPutByIdFunction(slot, putKind));
+}
+
+static InlineCacheAction tryRepatchIn(
+    ExecState* exec, JSCell* base, const Identifier& ident, bool wasFound,
+    const PropertySlot& slot, StructureStubInfo& stubInfo)
+{
+    if (forceICFailure(exec))
+        return GiveUpOnCache;
+    
+    if (!base->structure()->propertyAccessesAreCacheable() || (!wasFound && !base->structure()->propertyAccessesAreCacheableForAbsence()))
+        return GiveUpOnCache;
+    
+    if (wasFound) {
+        if (!slot.isCacheable())
+            return GiveUpOnCache;
+    }
+    
+    CodeBlock* codeBlock = exec->codeBlock();
+    VM& vm = exec->vm();
+    Structure* structure = base->structure(vm);
+    
+    ObjectPropertyConditionSet conditionSet;
+    if (wasFound) {
+        if (slot.slotBase() != base) {
+            conditionSet = generateConditionsForPrototypePropertyHit(
+                vm, codeBlock, exec, structure, slot.slotBase(), ident.impl());
+        }
+    } else {
+        conditionSet = generateConditionsForPropertyMiss(
+            vm, codeBlock, exec, structure, ident.impl());
+    }
+    if (!conditionSet.isValid())
+        return GiveUpOnCache;
+
+    LOG_IC((ICEvent::InAddAccessCase, structure->classInfo(), ident));
+
+    std::unique_ptr<AccessCase> newCase = AccessCase::in(
+        vm, codeBlock, wasFound ? AccessCase::InHit : AccessCase::InMiss, structure, conditionSet);
+
+    AccessGenerationResult result = stubInfo.addAccessCase(codeBlock, ident, WTFMove(newCase));
+    
+    if (result.generatedSomeCode()) {
+        LOG_IC((ICEvent::InReplaceWithJump, structure->classInfo(), ident));
+        
+        RELEASE_ASSERT(result.code());
+
+        MacroAssembler::repatchJump(
+            stubInfo.patchableJumpForIn(),
+            CodeLocationLabel(result.code()));
+    }
+    
+    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
+}
+
+void repatchIn(
+    ExecState* exec, JSCell* base, const Identifier& ident, bool wasFound,
+    const PropertySlot& slot, StructureStubInfo& stubInfo)
+{
+    SuperSamplerScope superSamplerScope(false);
+    if (tryRepatchIn(exec, base, ident, wasFound, slot, stubInfo) == GiveUpOnCache)
+        ftlThunkAwareRepatchCall(exec->codeBlock(), stubInfo.slowPathCallLocation(), operationIn);
+}
+
+static void linkSlowFor(VM*, CallLinkInfo& callLinkInfo, MacroAssemblerCodeRef codeRef)
+{
+    MacroAssembler::repatchNearCall(callLinkInfo.callReturnLocation(), CodeLocationLabel(codeRef.code()));
+}
+
+static void linkSlowFor(VM* vm, CallLinkInfo& callLinkInfo, ThunkGenerator generator)
+{
+    linkSlowFor(vm, callLinkInfo, vm->getCTIStub(generator));
+}
+
+static void linkSlowFor(VM* vm, CallLinkInfo& callLinkInfo)
+{
+    MacroAssemblerCodeRef virtualThunk = virtualThunkFor(vm, callLinkInfo);
+    linkSlowFor(vm, callLinkInfo, virtualThunk);
+    callLinkInfo.setSlowStub(createJITStubRoutine(virtualThunk, *vm, nullptr, true));
+}
+
+static bool isWebAssemblyToJSCallee(VM& vm, JSCell* callee)
+{
+#if ENABLE(WEBASSEMBLY)
+    // The WebAssembly -> JS stub sets it caller frame's callee to a singleton which lives on the VM.
+    return callee == vm.webAssemblyToJSCallee.get();
+#else
+    UNUSED_PARAM(vm);
+    UNUSED_PARAM(callee);
+    return false;
+#endif // ENABLE(WEBASSEMBLY)
+}
+
+static JSCell* webAssemblyOwner(VM& vm)
+{
+#if ENABLE(WEBASSEMBLY)
+    // Each WebAssembly.Instance shares the stubs from their WebAssembly.Module, which are therefore the appropriate owner.
+    return vm.topJSWebAssemblyInstance->module();
+#else
+    UNUSED_PARAM(vm);
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+#endif // ENABLE(WEBASSEMBLY)
+}
+
+void linkFor(
+    ExecState* exec, CallLinkInfo& callLinkInfo, CodeBlock* calleeCodeBlock,
+    JSFunction* callee, MacroAssemblerCodePtr codePtr)
+{
+    ASSERT(!callLinkInfo.stub());
+
+    CallFrame* callerFrame = exec->callerFrame();
+    VM& vm = callerFrame->vm();
+    CodeBlock* callerCodeBlock = callerFrame->codeBlock();
+
+    // WebAssembly -> JS stubs don't have a valid CodeBlock.
+    JSCell* owner = isWebAssemblyToJSCallee(vm, callerFrame->callee()) ? webAssemblyOwner(vm) : callerCodeBlock;
+    ASSERT(owner);
+
+    ASSERT(!callLinkInfo.isLinked());
+    callLinkInfo.setCallee(vm, owner, callee);
+    callLinkInfo.setLastSeenCallee(vm, owner, callee);
+    if (shouldDumpDisassemblyFor(callerCodeBlock))
+        dataLog("Linking call in ", *callerCodeBlock, " at ", callLinkInfo.codeOrigin(), " to ", pointerDump(calleeCodeBlock), ", entrypoint at ", codePtr, "\n");
+    MacroAssembler::repatchNearCall(callLinkInfo.hotPathOther(), CodeLocationLabel(codePtr));
+
+    if (calleeCodeBlock)
+        calleeCodeBlock->linkIncomingCall(callerFrame, &callLinkInfo);
+
+    if (callLinkInfo.specializationKind() == CodeForCall && callLinkInfo.allowStubs()) {
+        linkSlowFor(&vm, callLinkInfo, linkPolymorphicCallThunkGenerator);
+        return;
+    }
+    
+    linkSlowFor(&vm, callLinkInfo);
+}
+
+void linkDirectFor(
+    ExecState* exec, CallLinkInfo& callLinkInfo, CodeBlock* calleeCodeBlock,
+    MacroAssemblerCodePtr codePtr)
+{
+    ASSERT(!callLinkInfo.stub());
+    
+    CodeBlock* callerCodeBlock = exec->codeBlock();
+
+    VM* vm = callerCodeBlock->vm();
+    
+    ASSERT(!callLinkInfo.isLinked());
+    callLinkInfo.setCodeBlock(*vm, callerCodeBlock, jsCast<FunctionCodeBlock*>(calleeCodeBlock));
+    if (shouldDumpDisassemblyFor(callerCodeBlock))
+        dataLog("Linking call in ", *callerCodeBlock, " at ", callLinkInfo.codeOrigin(), " to ", pointerDump(calleeCodeBlock), ", entrypoint at ", codePtr, "\n");
+    if (callLinkInfo.callType() == CallLinkInfo::DirectTailCall)
+        MacroAssembler::repatchJumpToNop(callLinkInfo.patchableJump());
+    MacroAssembler::repatchNearCall(callLinkInfo.hotPathOther(), CodeLocationLabel(codePtr));
+    
+    if (calleeCodeBlock)
+        calleeCodeBlock->linkIncomingCall(exec, &callLinkInfo);
+}
+
+void linkSlowFor(
+    ExecState* exec, CallLinkInfo& callLinkInfo)
+{
+    CodeBlock* callerCodeBlock = exec->callerFrame()->codeBlock();
+    VM* vm = callerCodeBlock->vm();
+    
+    linkSlowFor(vm, callLinkInfo);
+}
+
+static void revertCall(VM* vm, CallLinkInfo& callLinkInfo, MacroAssemblerCodeRef codeRef)
+{
+    if (callLinkInfo.isDirect()) {
+        callLinkInfo.clearCodeBlock();
+        if (callLinkInfo.callType() == CallLinkInfo::DirectTailCall)
+            MacroAssembler::repatchJump(callLinkInfo.patchableJump(), callLinkInfo.slowPathStart());
+        else
+            MacroAssembler::repatchNearCall(callLinkInfo.hotPathOther(), callLinkInfo.slowPathStart());
+    } else {
+        MacroAssembler::revertJumpReplacementToBranchPtrWithPatch(
+            MacroAssembler::startOfBranchPtrWithPatchOnRegister(callLinkInfo.hotPathBegin()),
+            static_cast<MacroAssembler::RegisterID>(callLinkInfo.calleeGPR()), 0);
+        linkSlowFor(vm, callLinkInfo, codeRef);
+        callLinkInfo.clearCallee();
+    }
+    callLinkInfo.clearSeen();
+    callLinkInfo.clearStub();
+    callLinkInfo.clearSlowStub();
+    if (callLinkInfo.isOnList())
+        callLinkInfo.remove();
+}
+
+void unlinkFor(VM& vm, CallLinkInfo& callLinkInfo)
+{
+    if (Options::dumpDisassembly())
+        dataLog("Unlinking call at ", callLinkInfo.hotPathOther(), "\n");
+    
+    revertCall(&vm, callLinkInfo, vm.getCTIStub(linkCallThunkGenerator));
+}
+
+void linkVirtualFor(ExecState* exec, CallLinkInfo& callLinkInfo)
+{
+    CallFrame* callerFrame = exec->callerFrame();
+    VM& vm = callerFrame->vm();
+    CodeBlock* callerCodeBlock = callerFrame->codeBlock();
+
+    if (shouldDumpDisassemblyFor(callerCodeBlock))
+        dataLog("Linking virtual call at ", *callerCodeBlock, " ", callerFrame->codeOrigin(), "\n");
+
+    MacroAssemblerCodeRef virtualThunk = virtualThunkFor(&vm, callLinkInfo);
+    revertCall(&vm, callLinkInfo, virtualThunk);
+    callLinkInfo.setSlowStub(createJITStubRoutine(virtualThunk, vm, nullptr, true));
+}
+
+namespace {
+struct CallToCodePtr {
+    CCallHelpers::Call call;
+    MacroAssemblerCodePtr codePtr;
+};
+} // annonymous namespace
+
+void linkPolymorphicCall(
+    ExecState* exec, CallLinkInfo& callLinkInfo, CallVariant newVariant)
+{
+    RELEASE_ASSERT(callLinkInfo.allowStubs());
+    
+    // Currently we can't do anything for non-function callees.
+    // https://bugs.webkit.org/show_bug.cgi?id=140685
+    if (!newVariant || !newVariant.executable()) {
+        linkVirtualFor(exec, callLinkInfo);
+        return;
+    }
+
+    CallFrame* callerFrame = exec->callerFrame();
+    VM& vm = callerFrame->vm();
+    CodeBlock* callerCodeBlock = callerFrame->codeBlock();
+    bool isWebAssembly = isWebAssemblyToJSCallee(vm, callerFrame->callee());
+
+    // WebAssembly -> JS stubs don't have a valid CodeBlock.
+    JSCell* owner = isWebAssembly ? webAssemblyOwner(vm) : callerCodeBlock;
+    ASSERT(owner);
+
+    CallVariantList list;
+    if (PolymorphicCallStubRoutine* stub = callLinkInfo.stub())
+        list = stub->variants();
+    else if (JSFunction* oldCallee = callLinkInfo.callee())
+        list = CallVariantList{ CallVariant(oldCallee) };
+    
+    list = variantListWithVariant(list, newVariant);
+
+    // If there are any closure calls then it makes sense to treat all of them as closure calls.
+    // This makes switching on callee cheaper. It also produces profiling that's easier on the DFG;
+    // the DFG doesn't really want to deal with a combination of closure and non-closure callees.
+    bool isClosureCall = false;
+    for (CallVariant variant : list)  {
+        if (variant.isClosureCall()) {
+            list = despecifiedVariantList(list);
+            isClosureCall = true;
+            break;
+        }
+    }
+    
+    if (isClosureCall)
+        callLinkInfo.setHasSeenClosure();
+    
+    Vector<PolymorphicCallCase> callCases;
+    
+    // Figure out what our cases are.
+    for (CallVariant variant : list) {
+        CodeBlock* codeBlock;
+        if (isWebAssembly || variant.executable()->isHostFunction())
+            codeBlock = nullptr;
+        else {
+            ExecutableBase* executable = variant.executable();
+            codeBlock = jsCast<FunctionExecutable*>(executable)->codeBlockForCall();
+            // If we cannot handle a callee, either because we don't have a CodeBlock or because arity mismatch,
+            // assume that it's better for this whole thing to be a virtual call.
+            if (!codeBlock || exec->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()) || callLinkInfo.isVarargs()) {
+                linkVirtualFor(exec, callLinkInfo);
+                return;
+            }
+        }
+        
+        callCases.append(PolymorphicCallCase(variant, codeBlock));
+    }
+    
+    // If we are over the limit, just use a normal virtual call.
+    unsigned maxPolymorphicCallVariantListSize;
+    if (isWebAssembly)
+        maxPolymorphicCallVariantListSize = Options::maxPolymorphicCallVariantListSizeForWebAssemblyToJS();
+    else if (callerCodeBlock->jitType() == JITCode::topTierJIT())
+        maxPolymorphicCallVariantListSize = Options::maxPolymorphicCallVariantListSizeForTopTier();
+    else
+        maxPolymorphicCallVariantListSize = Options::maxPolymorphicCallVariantListSize();
+
+    if (list.size() > maxPolymorphicCallVariantListSize) {
+        linkVirtualFor(exec, callLinkInfo);
+        return;
+    }
+    
+    GPRReg calleeGPR = static_cast<GPRReg>(callLinkInfo.calleeGPR());
+    
+    CCallHelpers stubJit(&vm, callerCodeBlock);
+    
+    CCallHelpers::JumpList slowPath;
+    
+    std::unique_ptr<CallFrameShuffler> frameShuffler;
+    if (callLinkInfo.frameShuffleData()) {
+        ASSERT(callLinkInfo.isTailCall());
+        frameShuffler = std::make_unique<CallFrameShuffler>(stubJit, *callLinkInfo.frameShuffleData());
+#if USE(JSVALUE32_64)
+        // We would have already checked that the callee is a cell, and we can
+        // use the additional register this buys us.
+        frameShuffler->assumeCalleeIsCell();
+#endif
+        frameShuffler->lockGPR(calleeGPR);
+    }
+    GPRReg comparisonValueGPR;
+    
+    if (isClosureCall) {
+        GPRReg scratchGPR;
+        if (frameShuffler)
+            scratchGPR = frameShuffler->acquireGPR();
+        else
+            scratchGPR = AssemblyHelpers::selectScratchGPR(calleeGPR);
+        // Verify that we have a function and stash the executable in scratchGPR.
+
+#if USE(JSVALUE64)
+        slowPath.append(stubJit.branchTest64(CCallHelpers::NonZero, calleeGPR, GPRInfo::tagMaskRegister));
+#else
+        // We would have already checked that the callee is a cell.
+#endif
+    
+        slowPath.append(
+            stubJit.branch8(
+                CCallHelpers::NotEqual,
+                CCallHelpers::Address(calleeGPR, JSCell::typeInfoTypeOffset()),
+                CCallHelpers::TrustedImm32(JSFunctionType)));
+    
+        stubJit.loadPtr(
+            CCallHelpers::Address(calleeGPR, JSFunction::offsetOfExecutable()),
+            scratchGPR);
+        
+        comparisonValueGPR = scratchGPR;
+    } else
+        comparisonValueGPR = calleeGPR;
+    
+    Vector<int64_t> caseValues(callCases.size());
+    Vector<CallToCodePtr> calls(callCases.size());
+    std::unique_ptr<uint32_t[]> fastCounts;
+    
+    if (!isWebAssembly && callerCodeBlock->jitType() != JITCode::topTierJIT())
+        fastCounts = std::make_unique<uint32_t[]>(callCases.size());
+    
+    for (size_t i = 0; i < callCases.size(); ++i) {
+        if (fastCounts)
+            fastCounts[i] = 0;
+        
+        CallVariant variant = callCases[i].variant();
+        int64_t newCaseValue;
+        if (isClosureCall)
+            newCaseValue = bitwise_cast<intptr_t>(variant.executable());
+        else
+            newCaseValue = bitwise_cast<intptr_t>(variant.function());
+        
+        if (!ASSERT_DISABLED) {
+            for (size_t j = 0; j < i; ++j) {
+                if (caseValues[j] != newCaseValue)
+                    continue;
+
+                dataLog("ERROR: Attempt to add duplicate case value.\n");
+                dataLog("Existing case values: ");
+                CommaPrinter comma;
+                for (size_t k = 0; k < i; ++k)
+                    dataLog(comma, caseValues[k]);
+                dataLog("\n");
+                dataLog("Attempting to add: ", newCaseValue, "\n");
+                dataLog("Variant list: ", listDump(callCases), "\n");
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
+        
+        caseValues[i] = newCaseValue;
+    }
+    
+    GPRReg fastCountsBaseGPR;
+    if (frameShuffler)
+        fastCountsBaseGPR = frameShuffler->acquireGPR();
+    else {
+        fastCountsBaseGPR =
+            AssemblyHelpers::selectScratchGPR(calleeGPR, comparisonValueGPR, GPRInfo::regT3);
+    }
+    stubJit.move(CCallHelpers::TrustedImmPtr(fastCounts.get()), fastCountsBaseGPR);
+    if (!frameShuffler && callLinkInfo.isTailCall())
+        stubJit.emitRestoreCalleeSaves();
+    BinarySwitch binarySwitch(comparisonValueGPR, caseValues, BinarySwitch::IntPtr);
+    CCallHelpers::JumpList done;
+    while (binarySwitch.advance(stubJit)) {
+        size_t caseIndex = binarySwitch.caseIndex();
+        
+        CallVariant variant = callCases[caseIndex].variant();
+        
+        ASSERT(variant.executable()->hasJITCodeForCall());
+        MacroAssemblerCodePtr codePtr =
+            variant.executable()->generatedJITCodeForCall()->addressForCall(ArityCheckNotRequired);
+        
+        if (fastCounts) {
+            stubJit.add32(
+                CCallHelpers::TrustedImm32(1),
+                CCallHelpers::Address(fastCountsBaseGPR, caseIndex * sizeof(uint32_t)));
+        }
+        if (frameShuffler) {
+            CallFrameShuffler(stubJit, frameShuffler->snapshot()).prepareForTailCall();
+            calls[caseIndex].call = stubJit.nearTailCall();
+        } else if (callLinkInfo.isTailCall()) {
+            stubJit.prepareForTailCallSlow();
+            calls[caseIndex].call = stubJit.nearTailCall();
+        } else
+            calls[caseIndex].call = stubJit.nearCall();
+        calls[caseIndex].codePtr = codePtr;
+        done.append(stubJit.jump());
+    }
+    
+    slowPath.link(&stubJit);
+    binarySwitch.fallThrough().link(&stubJit);
+
+    if (frameShuffler) {
+        frameShuffler->releaseGPR(calleeGPR);
+        frameShuffler->releaseGPR(comparisonValueGPR);
+        frameShuffler->releaseGPR(fastCountsBaseGPR);
+#if USE(JSVALUE32_64)
+        frameShuffler->setCalleeJSValueRegs(JSValueRegs(GPRInfo::regT1, GPRInfo::regT0));
+#else
+        frameShuffler->setCalleeJSValueRegs(JSValueRegs(GPRInfo::regT0));
+#endif
+        frameShuffler->prepareForSlowPath();
+    } else {
+        stubJit.move(calleeGPR, GPRInfo::regT0);
+#if USE(JSVALUE32_64)
+        stubJit.move(CCallHelpers::TrustedImm32(JSValue::CellTag), GPRInfo::regT1);
+#endif
+    }
+    stubJit.move(CCallHelpers::TrustedImmPtr(&callLinkInfo), GPRInfo::regT2);
+    stubJit.move(CCallHelpers::TrustedImmPtr(callLinkInfo.callReturnLocation().executableAddress()), GPRInfo::regT4);
+    
+    stubJit.restoreReturnAddressBeforeReturn(GPRInfo::regT4);
+    AssemblyHelpers::Jump slow = stubJit.jump();
+        
+    LinkBuffer patchBuffer(vm, stubJit, owner, JITCompilationCanFail);
+    if (patchBuffer.didFailToAllocate()) {
+        linkVirtualFor(exec, callLinkInfo);
+        return;
+    }
+    
+    RELEASE_ASSERT(callCases.size() == calls.size());
+    for (CallToCodePtr callToCodePtr : calls) {
+        // Tail call special-casing ensures proper linking on ARM Thumb2, where a tail call jumps to an address
+        // with a non-decorated bottom bit but a normal call calls an address with a decorated bottom bit.
+        bool isTailCall = callToCodePtr.call.isFlagSet(CCallHelpers::Call::Tail);
+        patchBuffer.link(
+            callToCodePtr.call, FunctionPtr(isTailCall ? callToCodePtr.codePtr.dataLocation() : callToCodePtr.codePtr.executableAddress()));
+    }
+    if (isWebAssembly || JITCode::isOptimizingJIT(callerCodeBlock->jitType()))
+        patchBuffer.link(done, callLinkInfo.callReturnLocation().labelAtOffset(0));
+    else
+        patchBuffer.link(done, callLinkInfo.hotPathOther().labelAtOffset(0));
+    patchBuffer.link(slow, CodeLocationLabel(vm.getCTIStub(linkPolymorphicCallThunkGenerator).code()));
+    
+    auto stubRoutine = adoptRef(*new PolymorphicCallStubRoutine(
+        FINALIZE_CODE_FOR(
+            callerCodeBlock, patchBuffer,
+            ("Polymorphic call stub for %s, return point %p, targets %s",
+                isWebAssembly ? "WebAssembly" : toCString(*callerCodeBlock).data(), callLinkInfo.callReturnLocation().labelAtOffset(0).executableAddress(),
+                toCString(listDump(callCases)).data())),
+        vm, owner, exec->callerFrame(), callLinkInfo, callCases,
+        WTFMove(fastCounts)));
+    
+    MacroAssembler::replaceWithJump(
+        MacroAssembler::startOfBranchPtrWithPatchOnRegister(callLinkInfo.hotPathBegin()),
+        CodeLocationLabel(stubRoutine->code().code()));
+    // The original slow path is unreachable on 64-bits, but still
+    // reachable on 32-bits since a non-cell callee will always
+    // trigger the slow path
+    linkSlowFor(&vm, callLinkInfo);
+    
+    // If there had been a previous stub routine, that one will die as soon as the GC runs and sees
+    // that it's no longer on stack.
+    callLinkInfo.setStub(WTFMove(stubRoutine));
+    
+    // The call link info no longer has a call cache apart from the jump to the polymorphic call
+    // stub.
+    if (callLinkInfo.isOnList())
+        callLinkInfo.remove();
+}
+
+void resetGetByID(CodeBlock* codeBlock, StructureStubInfo& stubInfo, GetByIDKind kind)
+{
+    ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation(), appropriateOptimizingGetByIdFunction(kind));
+    InlineAccess::rewireStubAsJump(*codeBlock->vm(), stubInfo, stubInfo.slowPathStartLocation());
+}
+
+void resetPutByID(CodeBlock* codeBlock, StructureStubInfo& stubInfo)
+{
+    V_JITOperation_ESsiJJI unoptimizedFunction = bitwise_cast<V_JITOperation_ESsiJJI>(readCallTarget(codeBlock, stubInfo.slowPathCallLocation()).executableAddress());
+    V_JITOperation_ESsiJJI optimizedFunction;
+    if (unoptimizedFunction == operationPutByIdStrict || unoptimizedFunction == operationPutByIdStrictOptimize)
+        optimizedFunction = operationPutByIdStrictOptimize;
+    else if (unoptimizedFunction == operationPutByIdNonStrict || unoptimizedFunction == operationPutByIdNonStrictOptimize)
+        optimizedFunction = operationPutByIdNonStrictOptimize;
+    else if (unoptimizedFunction == operationPutByIdDirectStrict || unoptimizedFunction == operationPutByIdDirectStrictOptimize)
+        optimizedFunction = operationPutByIdDirectStrictOptimize;
+    else {
+        ASSERT(unoptimizedFunction == operationPutByIdDirectNonStrict || unoptimizedFunction == operationPutByIdDirectNonStrictOptimize);
+        optimizedFunction = operationPutByIdDirectNonStrictOptimize;
+    }
+
+    ftlThunkAwareRepatchCall(codeBlock, stubInfo.slowPathCallLocation(), optimizedFunction);
+    InlineAccess::rewireStubAsJump(*codeBlock->vm(), stubInfo, stubInfo.slowPathStartLocation());
+}
+
+void resetIn(CodeBlock*, StructureStubInfo& stubInfo)
+{
+    MacroAssembler::repatchJump(stubInfo.patchableJumpForIn(), stubInfo.slowPathStartLocation());
+}
+
+} // namespace JSC
+
+#endif
diff --git a/jit/Repatch.h b/jit/Repatch.h
new file mode 100644
index 0000000..e176768
--- /dev/null
+++ b/jit/Repatch.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2011, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "CallVariant.h"
+#include "JITOperations.h"
+#include "PutKind.h"
+
+namespace JSC {
+
+enum class GetByIDKind {
+    Normal,
+    Pure
+};
+
+void repatchGetByID(ExecState*, JSValue, const Identifier&, const PropertySlot&, StructureStubInfo&, GetByIDKind);
+void buildGetByIDList(ExecState*, JSValue, const Identifier&, const PropertySlot&, StructureStubInfo&);
+void buildGetByIDProtoList(ExecState*, JSValue, const Identifier&, const PropertySlot&, StructureStubInfo&);
+void repatchPutByID(ExecState*, JSValue, Structure*, const Identifier&, const PutPropertySlot&, StructureStubInfo&, PutKind);
+void buildPutByIdList(ExecState*, JSValue, Structure*, const Identifier&, const PutPropertySlot&, StructureStubInfo&, PutKind);
+void repatchIn(ExecState*, JSCell*, const Identifier&, bool wasFound, const PropertySlot&, StructureStubInfo&);
+void linkFor(ExecState*, CallLinkInfo&, CodeBlock*, JSFunction* callee, MacroAssemblerCodePtr);
+void linkDirectFor(ExecState*, CallLinkInfo&, CodeBlock*, MacroAssemblerCodePtr);
+void linkSlowFor(ExecState*, CallLinkInfo&);
+void unlinkFor(VM&, CallLinkInfo&);
+void linkVirtualFor(ExecState*, CallLinkInfo&);
+void linkPolymorphicCall(ExecState*, CallLinkInfo&, CallVariant);
+void resetGetByID(CodeBlock*, StructureStubInfo&, GetByIDKind);
+void resetPutByID(CodeBlock*, StructureStubInfo&);
+void resetIn(CodeBlock*, StructureStubInfo&);
+void ftlThunkAwareRepatchCall(CodeBlock*, CodeLocationCall, FunctionPtr newCalleeFunction);
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/ScratchRegisterAllocator.cpp b/jit/ScratchRegisterAllocator.cpp
new file mode 100644
index 0000000..93d670d
--- /dev/null
+++ b/jit/ScratchRegisterAllocator.cpp
@@ -0,0 +1,302 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScratchRegisterAllocator.h"
+
+#if ENABLE(JIT)
+
+#include "JSCInlines.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "VM.h"
+
+namespace JSC {
+
+ScratchRegisterAllocator::ScratchRegisterAllocator(const RegisterSet& usedRegisters)
+    : m_usedRegisters(usedRegisters)
+    , m_numberOfReusedRegisters(0)
+{
+}
+
+ScratchRegisterAllocator::~ScratchRegisterAllocator() { }
+
+void ScratchRegisterAllocator::lock(GPRReg reg)
+{
+    if (reg == InvalidGPRReg)
+        return;
+    unsigned index = GPRInfo::toIndex(reg);
+    if (index == GPRInfo::InvalidIndex)
+        return;
+    m_lockedRegisters.setGPRByIndex(index);
+}
+
+void ScratchRegisterAllocator::lock(FPRReg reg)
+{
+    if (reg == InvalidFPRReg)
+        return;
+    unsigned index = FPRInfo::toIndex(reg);
+    if (index == FPRInfo::InvalidIndex)
+        return;
+    m_lockedRegisters.setFPRByIndex(index);
+}
+
+void ScratchRegisterAllocator::lock(JSValueRegs regs)
+{
+    lock(regs.tagGPR());
+    lock(regs.payloadGPR());
+}
+
+template<typename BankInfo>
+typename BankInfo::RegisterType ScratchRegisterAllocator::allocateScratch()
+{
+    // First try to allocate a register that is totally free.
+    for (unsigned i = 0; i < BankInfo::numberOfRegisters; ++i) {
+        typename BankInfo::RegisterType reg = BankInfo::toRegister(i);
+        if (!m_lockedRegisters.get(reg)
+            && !m_usedRegisters.get(reg)
+            && !m_scratchRegisters.get(reg)) {
+            m_scratchRegisters.set(reg);
+            return reg;
+        }
+    }
+    
+    // Since that failed, try to allocate a register that is not yet
+    // locked or used for scratch.
+    for (unsigned i = 0; i < BankInfo::numberOfRegisters; ++i) {
+        typename BankInfo::RegisterType reg = BankInfo::toRegister(i);
+        if (!m_lockedRegisters.get(reg) && !m_scratchRegisters.get(reg)) {
+            m_scratchRegisters.set(reg);
+            m_numberOfReusedRegisters++;
+            return reg;
+        }
+    }
+        
+    // We failed.
+    CRASH();
+    // Make some silly compilers happy.
+    return static_cast<typename BankInfo::RegisterType>(-1);
+}
+
+GPRReg ScratchRegisterAllocator::allocateScratchGPR() { return allocateScratch<GPRInfo>(); }
+FPRReg ScratchRegisterAllocator::allocateScratchFPR() { return allocateScratch<FPRInfo>(); }
+
+ScratchRegisterAllocator::PreservedState ScratchRegisterAllocator::preserveReusedRegistersByPushing(MacroAssembler& jit, ExtraStackSpace extraStackSpace)
+{
+    if (!didReuseRegisters())
+        return PreservedState(0, extraStackSpace);
+
+    RegisterSet registersToSpill;
+    for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
+        FPRReg reg = FPRInfo::toRegister(i);
+        if (m_scratchRegisters.getFPRByIndex(i) && m_usedRegisters.get(reg))
+            registersToSpill.set(reg);
+    }
+    for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
+        GPRReg reg = GPRInfo::toRegister(i);
+        if (m_scratchRegisters.getGPRByIndex(i) && m_usedRegisters.get(reg))
+            registersToSpill.set(reg);
+    }
+
+    unsigned extraStackBytesAtTopOfStack = extraStackSpace == ExtraStackSpace::SpaceForCCall ? maxFrameExtentForSlowPathCall : 0;
+    unsigned stackAdjustmentSize = ScratchRegisterAllocator::preserveRegistersToStackForCall(jit, registersToSpill, extraStackBytesAtTopOfStack);
+
+    return PreservedState(stackAdjustmentSize, extraStackSpace);
+}
+
+void ScratchRegisterAllocator::restoreReusedRegistersByPopping(MacroAssembler& jit, const ScratchRegisterAllocator::PreservedState& preservedState)
+{
+    RELEASE_ASSERT(preservedState);
+    if (!didReuseRegisters())
+        return;
+
+    RegisterSet registersToFill;
+    for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
+        GPRReg reg = GPRInfo::toRegister(i);
+        if (m_scratchRegisters.getGPRByIndex(i) && m_usedRegisters.get(reg))
+            registersToFill.set(reg);
+    }
+    for (unsigned i = FPRInfo::numberOfRegisters; i--;) {
+        FPRReg reg = FPRInfo::toRegister(i);
+        if (m_scratchRegisters.getFPRByIndex(i) && m_usedRegisters.get(reg))
+            registersToFill.set(reg);
+    }
+
+    unsigned extraStackBytesAtTopOfStack =
+        preservedState.extraStackSpaceRequirement == ExtraStackSpace::SpaceForCCall ? maxFrameExtentForSlowPathCall : 0;
+    RegisterSet dontRestore; // Empty set. We want to restore everything.
+    ScratchRegisterAllocator::restoreRegistersFromStackForCall(jit, registersToFill, dontRestore,
+        preservedState.numberOfBytesPreserved, extraStackBytesAtTopOfStack);
+}
+
+RegisterSet ScratchRegisterAllocator::usedRegistersForCall() const
+{
+    RegisterSet result = m_usedRegisters;
+    result.exclude(RegisterSet::registersToNotSaveForJSCall());
+    return result;
+}
+
+unsigned ScratchRegisterAllocator::desiredScratchBufferSizeForCall() const
+{
+    return usedRegistersForCall().numberOfSetRegisters() * sizeof(JSValue);
+}
+
+void ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall(MacroAssembler& jit, ScratchBuffer* scratchBuffer, GPRReg scratchGPR)
+{
+    RegisterSet usedRegisters = usedRegistersForCall();
+    if (!usedRegisters.numberOfSetRegisters())
+        return;
+    
+    unsigned count = 0;
+    for (GPRReg reg = MacroAssembler::firstRegister(); reg <= MacroAssembler::lastRegister(); reg = MacroAssembler::nextRegister(reg)) {
+        if (usedRegisters.get(reg)) {
+            jit.storePtr(reg, static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) + count);
+            count++;
+        }
+        if (GPRInfo::toIndex(reg) != GPRInfo::InvalidIndex
+            && scratchGPR == InvalidGPRReg
+            && !m_lockedRegisters.get(reg) && !m_scratchRegisters.get(reg))
+            scratchGPR = reg;
+    }
+    RELEASE_ASSERT(scratchGPR != InvalidGPRReg);
+    for (FPRReg reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = MacroAssembler::nextFPRegister(reg)) {
+        if (usedRegisters.get(reg)) {
+            jit.move(MacroAssembler::TrustedImmPtr(static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) + count), scratchGPR);
+            count++;
+            jit.storeDouble(reg, scratchGPR);
+        }
+    }
+    RELEASE_ASSERT(count * sizeof(JSValue) == desiredScratchBufferSizeForCall());
+    
+    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratchGPR);
+    jit.storePtr(MacroAssembler::TrustedImmPtr(static_cast<size_t>(count * sizeof(JSValue))), scratchGPR);
+}
+
+void ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall(MacroAssembler& jit, ScratchBuffer* scratchBuffer, GPRReg scratchGPR)
+{
+    RegisterSet usedRegisters = usedRegistersForCall();
+    if (!usedRegisters.numberOfSetRegisters())
+        return;
+    
+    if (scratchGPR == InvalidGPRReg) {
+        // Find a scratch register.
+        for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
+            if (m_lockedRegisters.getGPRByIndex(i) || m_scratchRegisters.getGPRByIndex(i))
+                continue;
+            scratchGPR = GPRInfo::toRegister(i);
+            break;
+        }
+    }
+    RELEASE_ASSERT(scratchGPR != InvalidGPRReg);
+    
+    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratchGPR);
+    jit.storePtr(MacroAssembler::TrustedImmPtr(0), scratchGPR);
+
+    // Restore double registers first.
+    unsigned count = usedRegisters.numberOfSetGPRs();
+    for (FPRReg reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = MacroAssembler::nextFPRegister(reg)) {
+        if (usedRegisters.get(reg)) {
+            jit.move(MacroAssembler::TrustedImmPtr(static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) + (count++)), scratchGPR);
+            jit.loadDouble(scratchGPR, reg);
+        }
+    }
+        
+    count = 0;
+    for (GPRReg reg = MacroAssembler::firstRegister(); reg <= MacroAssembler::lastRegister(); reg = MacroAssembler::nextRegister(reg)) {
+        if (usedRegisters.get(reg))
+            jit.loadPtr(static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) + (count++), reg);
+    }
+}
+
+unsigned ScratchRegisterAllocator::preserveRegistersToStackForCall(MacroAssembler& jit, const RegisterSet& usedRegisters, unsigned extraBytesAtTopOfStack)
+{
+    RELEASE_ASSERT(extraBytesAtTopOfStack % sizeof(void*) == 0);
+    if (!usedRegisters.numberOfSetRegisters())
+        return 0;
+    
+    unsigned stackOffset = (usedRegisters.numberOfSetRegisters()) * sizeof(EncodedJSValue);
+    stackOffset += extraBytesAtTopOfStack;
+    stackOffset = WTF::roundUpToMultipleOf(stackAlignmentBytes(), stackOffset);
+    jit.subPtr(
+        MacroAssembler::TrustedImm32(stackOffset),
+        MacroAssembler::stackPointerRegister);
+
+    unsigned count = 0;
+    for (GPRReg reg = MacroAssembler::firstRegister(); reg <= MacroAssembler::lastRegister(); reg = MacroAssembler::nextRegister(reg)) {
+        if (usedRegisters.get(reg)) {
+            jit.storePtr(reg, MacroAssembler::Address(MacroAssembler::stackPointerRegister, extraBytesAtTopOfStack + (count * sizeof(EncodedJSValue))));
+            count++;
+        }
+    }
+    for (FPRReg reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = MacroAssembler::nextFPRegister(reg)) {
+        if (usedRegisters.get(reg)) {
+            jit.storeDouble(reg, MacroAssembler::Address(MacroAssembler::stackPointerRegister, extraBytesAtTopOfStack + (count * sizeof(EncodedJSValue))));
+            count++;
+        }
+    }
+
+    RELEASE_ASSERT(count == usedRegisters.numberOfSetRegisters());
+
+    return stackOffset;
+}
+
+void ScratchRegisterAllocator::restoreRegistersFromStackForCall(MacroAssembler& jit, const RegisterSet& usedRegisters, const RegisterSet& ignore, unsigned numberOfStackBytesUsedForRegisterPreservation, unsigned extraBytesAtTopOfStack)
+{
+    RELEASE_ASSERT(extraBytesAtTopOfStack % sizeof(void*) == 0);
+    if (!usedRegisters.numberOfSetRegisters()) {
+        RELEASE_ASSERT(numberOfStackBytesUsedForRegisterPreservation == 0);
+        return;
+    }
+
+    unsigned count = 0;
+    for (GPRReg reg = MacroAssembler::firstRegister(); reg <= MacroAssembler::lastRegister(); reg = MacroAssembler::nextRegister(reg)) {
+        if (usedRegisters.get(reg)) {
+            if (!ignore.get(reg))
+                jit.loadPtr(MacroAssembler::Address(MacroAssembler::stackPointerRegister, extraBytesAtTopOfStack + (sizeof(EncodedJSValue) * count)), reg);
+            count++;
+        }
+    }
+    for (FPRReg reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = MacroAssembler::nextFPRegister(reg)) {
+        if (usedRegisters.get(reg)) {
+            if (!ignore.get(reg))
+                jit.loadDouble(MacroAssembler::Address(MacroAssembler::stackPointerRegister, extraBytesAtTopOfStack + (sizeof(EncodedJSValue) * count)), reg);
+            count++;
+        }
+    }
+
+    unsigned stackOffset = (usedRegisters.numberOfSetRegisters()) * sizeof(EncodedJSValue);
+    stackOffset += extraBytesAtTopOfStack;
+    stackOffset = WTF::roundUpToMultipleOf(stackAlignmentBytes(), stackOffset);
+
+    RELEASE_ASSERT(count == usedRegisters.numberOfSetRegisters());
+    RELEASE_ASSERT(stackOffset == numberOfStackBytesUsedForRegisterPreservation);
+
+    jit.addPtr(
+        MacroAssembler::TrustedImm32(stackOffset),
+        MacroAssembler::stackPointerRegister);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/ScratchRegisterAllocator.h b/jit/ScratchRegisterAllocator.h
new file mode 100644
index 0000000..5805c2f
--- /dev/null
+++ b/jit/ScratchRegisterAllocator.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "MacroAssembler.h"
+#include "RegisterSet.h"
+#include "TempRegisterSet.h"
+
+namespace JSC {
+
+struct ScratchBuffer;
+
+// This class provides a low-level register allocator for use in stubs.
+
+class ScratchRegisterAllocator {
+public:
+    ScratchRegisterAllocator() { }
+    ScratchRegisterAllocator(const RegisterSet& usedRegisters);
+    ~ScratchRegisterAllocator();
+
+    void lock(GPRReg);
+    void lock(FPRReg);
+    void lock(JSValueRegs);
+    
+    template<typename BankInfo>
+    typename BankInfo::RegisterType allocateScratch();
+    
+    GPRReg allocateScratchGPR();
+    FPRReg allocateScratchFPR();
+    
+    bool didReuseRegisters() const
+    {
+        return !!m_numberOfReusedRegisters;
+    }
+    
+    unsigned numberOfReusedRegisters() const
+    {
+        return m_numberOfReusedRegisters;
+    }
+
+    RegisterSet usedRegisters() const { return m_usedRegisters; }
+    
+    enum class ExtraStackSpace { SpaceForCCall, NoExtraSpace };
+
+    struct PreservedState {
+        PreservedState()
+            : numberOfBytesPreserved(std::numeric_limits<unsigned>::max())
+            , extraStackSpaceRequirement(ExtraStackSpace::SpaceForCCall)
+        { }
+
+        PreservedState(unsigned numberOfBytes, ExtraStackSpace extraStackSpace)
+            : numberOfBytesPreserved(numberOfBytes)
+            , extraStackSpaceRequirement(extraStackSpace)
+        { }
+
+        explicit operator bool() const { return numberOfBytesPreserved != std::numeric_limits<unsigned>::max(); }
+
+        unsigned numberOfBytesPreserved;
+        ExtraStackSpace extraStackSpaceRequirement;
+    };
+
+    PreservedState preserveReusedRegistersByPushing(MacroAssembler& jit, ExtraStackSpace);
+    void restoreReusedRegistersByPopping(MacroAssembler& jit, const PreservedState&);
+    
+    RegisterSet usedRegistersForCall() const;
+    
+    unsigned desiredScratchBufferSizeForCall() const;
+    
+    void preserveUsedRegistersToScratchBufferForCall(MacroAssembler& jit, ScratchBuffer* scratchBuffer, GPRReg scratchGPR = InvalidGPRReg);
+    void restoreUsedRegistersFromScratchBufferForCall(MacroAssembler& jit, ScratchBuffer* scratchBuffer, GPRReg scratchGPR = InvalidGPRReg);
+
+    static unsigned preserveRegistersToStackForCall(MacroAssembler& jit, const RegisterSet& usedRegisters, unsigned extraPaddingInBytes);
+    static void restoreRegistersFromStackForCall(MacroAssembler& jit, const RegisterSet& usedRegisters, const RegisterSet& ignore, unsigned numberOfStackBytesUsedForRegisterPreservation, unsigned extraPaddingInBytes);
+
+private:
+    RegisterSet m_usedRegisters;
+    TempRegisterSet m_lockedRegisters;
+    TempRegisterSet m_scratchRegisters;
+    unsigned m_numberOfReusedRegisters;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/SetupVarargsFrame.cpp b/jit/SetupVarargsFrame.cpp
new file mode 100644
index 0000000..a177b0c
--- /dev/null
+++ b/jit/SetupVarargsFrame.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SetupVarargsFrame.h"
+
+#if ENABLE(JIT)
+
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "StackAlignment.h"
+
+namespace JSC {
+
+void emitSetVarargsFrame(CCallHelpers& jit, GPRReg lengthGPR, bool lengthIncludesThis, GPRReg numUsedSlotsGPR, GPRReg resultGPR)
+{
+    jit.move(numUsedSlotsGPR, resultGPR);
+    // We really want to make sure the size of the new call frame is a multiple of
+    // stackAlignmentRegisters(), however it is easier to accomplish this by
+    // rounding numUsedSlotsGPR to the next multiple of stackAlignmentRegisters().
+    // Together with the rounding below, we will assure that the new call frame is
+    // located on a stackAlignmentRegisters() boundary and a multiple of
+    // stackAlignmentRegisters() in size.
+    jit.addPtr(CCallHelpers::TrustedImm32(stackAlignmentRegisters() - 1), resultGPR);
+    jit.andPtr(CCallHelpers::TrustedImm32(~(stackAlignmentRegisters() - 1)), resultGPR);
+
+    jit.addPtr(lengthGPR, resultGPR);
+    jit.addPtr(CCallHelpers::TrustedImm32(CallFrame::headerSizeInRegisters + (lengthIncludesThis ? 0 : 1)), resultGPR);
+    
+    // resultGPR now has the required frame size in Register units
+    // Round resultGPR to next multiple of stackAlignmentRegisters()
+    jit.addPtr(CCallHelpers::TrustedImm32(stackAlignmentRegisters() - 1), resultGPR);
+    jit.andPtr(CCallHelpers::TrustedImm32(~(stackAlignmentRegisters() - 1)), resultGPR);
+    
+    // Now resultGPR has the right stack frame offset in Register units.
+    jit.negPtr(resultGPR);
+    jit.lshiftPtr(CCallHelpers::Imm32(3), resultGPR);
+    jit.addPtr(GPRInfo::callFrameRegister, resultGPR);
+}
+
+void emitSetupVarargsFrameFastCase(CCallHelpers& jit, GPRReg numUsedSlotsGPR, GPRReg scratchGPR1, GPRReg scratchGPR2, GPRReg scratchGPR3, ValueRecovery argCountRecovery, VirtualRegister firstArgumentReg, unsigned firstVarArgOffset, CCallHelpers::JumpList& slowCase)
+{
+    CCallHelpers::JumpList end;
+    
+    if (argCountRecovery.isConstant()) {
+        // FIXME: We could constant-fold a lot of the computation below in this case.
+        // https://bugs.webkit.org/show_bug.cgi?id=141486
+        jit.move(CCallHelpers::TrustedImm32(argCountRecovery.constant().asInt32()), scratchGPR1);
+    } else
+        jit.load32(CCallHelpers::payloadFor(argCountRecovery.virtualRegister()), scratchGPR1);
+    if (firstVarArgOffset) {
+        CCallHelpers::Jump sufficientArguments = jit.branch32(CCallHelpers::GreaterThan, scratchGPR1, CCallHelpers::TrustedImm32(firstVarArgOffset + 1));
+        jit.move(CCallHelpers::TrustedImm32(1), scratchGPR1);
+        CCallHelpers::Jump endVarArgs = jit.jump();
+        sufficientArguments.link(&jit);
+        jit.sub32(CCallHelpers::TrustedImm32(firstVarArgOffset), scratchGPR1);
+        endVarArgs.link(&jit);
+    }
+    slowCase.append(jit.branch32(CCallHelpers::Above, scratchGPR1, CCallHelpers::TrustedImm32(JSC::maxArguments + 1)));
+    
+    emitSetVarargsFrame(jit, scratchGPR1, true, numUsedSlotsGPR, scratchGPR2);
+
+    slowCase.append(jit.branchPtr(CCallHelpers::Above, CCallHelpers::AbsoluteAddress(jit.vm()->addressOfSoftStackLimit()), scratchGPR2));
+
+    // Initialize ArgumentCount.
+    jit.store32(scratchGPR1, CCallHelpers::Address(scratchGPR2, CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset));
+
+    // Copy arguments.
+    jit.signExtend32ToPtr(scratchGPR1, scratchGPR1);
+    CCallHelpers::Jump done = jit.branchSubPtr(CCallHelpers::Zero, CCallHelpers::TrustedImm32(1), scratchGPR1);
+    // scratchGPR1: argumentCount
+
+    CCallHelpers::Label copyLoop = jit.label();
+    int argOffset = (firstArgumentReg.offset() - 1 + firstVarArgOffset) * static_cast<int>(sizeof(Register));
+#if USE(JSVALUE64)
+    jit.load64(CCallHelpers::BaseIndex(GPRInfo::callFrameRegister, scratchGPR1, CCallHelpers::TimesEight, argOffset), scratchGPR3);
+    jit.store64(scratchGPR3, CCallHelpers::BaseIndex(scratchGPR2, scratchGPR1, CCallHelpers::TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))));
+#else // USE(JSVALUE64), so this begins the 32-bit case
+    jit.load32(CCallHelpers::BaseIndex(GPRInfo::callFrameRegister, scratchGPR1, CCallHelpers::TimesEight, argOffset + TagOffset), scratchGPR3);
+    jit.store32(scratchGPR3, CCallHelpers::BaseIndex(scratchGPR2, scratchGPR1, CCallHelpers::TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)) + TagOffset));
+    jit.load32(CCallHelpers::BaseIndex(GPRInfo::callFrameRegister, scratchGPR1, CCallHelpers::TimesEight, argOffset + PayloadOffset), scratchGPR3);
+    jit.store32(scratchGPR3, CCallHelpers::BaseIndex(scratchGPR2, scratchGPR1, CCallHelpers::TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register)) + PayloadOffset));
+#endif // USE(JSVALUE64), end of 32-bit case
+    jit.branchSubPtr(CCallHelpers::NonZero, CCallHelpers::TrustedImm32(1), scratchGPR1).linkTo(copyLoop, &jit);
+    
+    done.link(&jit);
+}
+
+void emitSetupVarargsFrameFastCase(CCallHelpers& jit, GPRReg numUsedSlotsGPR, GPRReg scratchGPR1, GPRReg scratchGPR2, GPRReg scratchGPR3, unsigned firstVarArgOffset, CCallHelpers::JumpList& slowCase)
+{
+    emitSetupVarargsFrameFastCase(jit, numUsedSlotsGPR, scratchGPR1, scratchGPR2, scratchGPR3, nullptr, firstVarArgOffset, slowCase);
+}
+
+void emitSetupVarargsFrameFastCase(CCallHelpers& jit, GPRReg numUsedSlotsGPR, GPRReg scratchGPR1, GPRReg scratchGPR2, GPRReg scratchGPR3, InlineCallFrame* inlineCallFrame, unsigned firstVarArgOffset, CCallHelpers::JumpList& slowCase)
+{
+    ValueRecovery argumentCountRecovery;
+    VirtualRegister firstArgumentReg;
+    if (inlineCallFrame) {
+        if (inlineCallFrame->isVarargs()) {
+            argumentCountRecovery = ValueRecovery::displacedInJSStack(
+                inlineCallFrame->argumentCountRegister, DataFormatInt32);
+        } else {
+            argumentCountRecovery = ValueRecovery::constant(
+                jsNumber(inlineCallFrame->arguments.size()));
+        }
+        if (inlineCallFrame->arguments.size() > 1)
+            firstArgumentReg = inlineCallFrame->arguments[1].virtualRegister();
+        else
+            firstArgumentReg = VirtualRegister(0);
+    } else {
+        argumentCountRecovery = ValueRecovery::displacedInJSStack(
+            VirtualRegister(CallFrameSlot::argumentCount), DataFormatInt32);
+        firstArgumentReg = VirtualRegister(CallFrame::argumentOffset(0));
+    }
+    emitSetupVarargsFrameFastCase(jit, numUsedSlotsGPR, scratchGPR1, scratchGPR2, scratchGPR3, argumentCountRecovery, firstArgumentReg, firstVarArgOffset, slowCase);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/jit/SetupVarargsFrame.h b/jit/SetupVarargsFrame.h
new file mode 100644
index 0000000..72e5d77
--- /dev/null
+++ b/jit/SetupVarargsFrame.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "CCallHelpers.h"
+#include "VirtualRegister.h"
+
+namespace JSC {
+
+void emitSetVarargsFrame(CCallHelpers&, GPRReg lengthGPR, bool lengthIncludesThis, GPRReg numUsedSlotsGPR, GPRReg resultGPR);
+
+// Assumes that SP refers to the last in-use stack location, and after this returns SP will point to
+// the newly created frame plus the native header. scratchGPR2 may be the same as numUsedSlotsGPR.
+void emitSetupVarargsFrameFastCase(CCallHelpers&, GPRReg numUsedSlotsGPR, GPRReg scratchGPR1, GPRReg scratchGPR2, GPRReg scratchGPR3, ValueRecovery argCountRecovery, VirtualRegister firstArgumentReg, unsigned firstVarArgOffset, CCallHelpers::JumpList& slowCase);
+
+// Variant that assumes normal stack frame.
+void emitSetupVarargsFrameFastCase(CCallHelpers&, GPRReg numUsedSlotsGPR, GPRReg scratchGPR1, GPRReg scratchGPR2, GPRReg scratchGPR3, unsigned firstVarArgOffset, CCallHelpers::JumpList& slowCase);
+
+// Variant for potentially inlined stack frames.
+void emitSetupVarargsFrameFastCase(CCallHelpers&, GPRReg numUsedSlotsGPR, GPRReg scratchGPR1, GPRReg scratchGPR2, GPRReg scratchGPR3, InlineCallFrame*, unsigned firstVarArgOffset, CCallHelpers::JumpList& slowCase);
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/SlowPathCall.h b/jit/SlowPathCall.h
new file mode 100644
index 0000000..1dfc21a
--- /dev/null
+++ b/jit/SlowPathCall.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CommonSlowPaths.h"
+#include "MacroAssemblerCodeRef.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+class JITSlowPathCall {
+public:
+    JITSlowPathCall(JIT* jit, Instruction* pc, SlowPathReturnType (SLOW_PATH *stub)(ExecState* exec, Instruction* pc))
+        : m_jit(jit)
+        , m_stub(stub)
+        , m_pc(pc)
+    {
+    }
+
+    JIT::Call call()
+    {
+#if ENABLE(OPCODE_SAMPLING)
+        if (m_jit->m_bytecodeOffset != std::numeric_limits<unsigned>::max())
+            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeOffset, true);
+#endif
+        m_jit->updateTopCallFrame();
+#if CPU(X86) && USE(JSVALUE32_64)
+        m_jit->addPtr(MacroAssembler::TrustedImm32(-8), MacroAssembler::stackPointerRegister);
+        m_jit->push(JIT::TrustedImm32(JIT::TrustedImmPtr(m_pc)));
+        m_jit->push(JIT::callFrameRegister);
+#elif CPU(X86_64) && OS(WINDOWS)
+        m_jit->addPtr(MacroAssembler::TrustedImm32(-16), MacroAssembler::stackPointerRegister);
+        m_jit->move(MacroAssembler::stackPointerRegister, JIT::argumentGPR0);
+        m_jit->move(JIT::callFrameRegister, JIT::argumentGPR1);
+        m_jit->move(JIT::TrustedImmPtr(m_pc), JIT::argumentGPR2);
+#else
+        m_jit->move(JIT::callFrameRegister, JIT::argumentGPR0);
+        m_jit->move(JIT::TrustedImmPtr(m_pc), JIT::argumentGPR1);
+#endif
+        JIT::Call call = m_jit->call();
+        m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeOffset, m_stub.value()));
+
+#if CPU(X86) && USE(JSVALUE32_64)
+        m_jit->addPtr(MacroAssembler::TrustedImm32(16), MacroAssembler::stackPointerRegister);
+#elif CPU(X86_64) && OS(WINDOWS)
+        m_jit->pop(JIT::regT0); // vPC
+        m_jit->pop(JIT::regT1); // callFrame register
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+        if (m_jit->m_bytecodeOffset != std::numeric_limits<unsigned>::max())
+            m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeOffset, false);
+#endif
+        
+        m_jit->exceptionCheck();
+        return call;
+    }
+
+private:
+    JIT* m_jit;
+    FunctionPtr m_stub;
+    Instruction* m_pc;
+};
+
+} // namespace JS
+
+#endif // ENABLE(JIT)
diff --git a/jit/SnippetOperand.h b/jit/SnippetOperand.h
new file mode 100644
index 0000000..5da3ec0
--- /dev/null
+++ b/jit/SnippetOperand.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "ResultType.h"
+
+namespace JSC {
+
+class SnippetOperand {
+    enum ConstOrVarType {
+        Variable,
+        ConstInt32,
+        ConstDouble
+    };
+
+public:
+    SnippetOperand()
+        : m_resultType(ResultType::unknownType())
+    { }
+
+    SnippetOperand(ResultType resultType)
+        : m_resultType(resultType)
+    { }
+
+    bool mightBeNumber() const { return m_resultType.mightBeNumber(); }
+    bool definitelyIsNumber() const { return m_resultType.definitelyIsNumber(); }
+
+    bool isConst() const { return m_type != Variable; }
+    bool isConstInt32() const { return m_type == ConstInt32; }
+    bool isConstDouble() const { return m_type == ConstDouble; }
+    bool isPositiveConstInt32() const { return isConstInt32() && asConstInt32() > 0; }
+
+    int64_t asRawBits() const { return m_val.rawBits; }
+
+    int32_t asConstInt32() const
+    {
+        ASSERT(m_type == ConstInt32);
+        return m_val.int32Val;
+    }
+
+    double asConstDouble() const
+    {
+        ASSERT(m_type == ConstDouble);
+        return m_val.doubleVal;
+    }
+
+    double asConstNumber() const
+    {
+        if (isConstInt32())
+            return asConstInt32();
+        ASSERT(isConstDouble());
+        return asConstDouble();
+    }
+
+    void setConstInt32(int32_t value)
+    {
+        m_type = ConstInt32;
+        m_val.int32Val = value;
+    }
+
+    void setConstDouble(double value)
+    {
+        m_type = ConstDouble;
+        m_val.doubleVal = value;
+    }
+
+private:
+    ResultType m_resultType;
+    ConstOrVarType m_type { Variable };
+    union {
+        int32_t int32Val;
+        double doubleVal;
+        int64_t rawBits;
+    } m_val;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/SpecializedThunkJIT.h b/jit/SpecializedThunkJIT.h
new file mode 100644
index 0000000..05f41f4
--- /dev/null
+++ b/jit/SpecializedThunkJIT.h
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2010, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "JIT.h"
+#include "JITInlines.h"
+#include "JSInterfaceJIT.h"
+#include "LinkBuffer.h"
+
+namespace JSC {
+
+    class SpecializedThunkJIT : public JSInterfaceJIT {
+    public:
+        static const int ThisArgument = -1;
+        SpecializedThunkJIT(VM* vm, int expectedArgCount)
+            : JSInterfaceJIT(vm)
+        {
+            emitFunctionPrologue();
+            emitSaveThenMaterializeTagRegisters();
+            // Check that we have the expected number of arguments
+            m_failures.append(branch32(NotEqual, payloadFor(CallFrameSlot::argumentCount), TrustedImm32(expectedArgCount + 1)));
+        }
+        
+        explicit SpecializedThunkJIT(VM* vm)
+            : JSInterfaceJIT(vm)
+        {
+            emitFunctionPrologue();
+            emitSaveThenMaterializeTagRegisters();
+        }
+        
+        void loadDoubleArgument(int argument, FPRegisterID dst, RegisterID scratch)
+        {
+            unsigned src = CallFrame::argumentOffset(argument);
+            m_failures.append(emitLoadDouble(src, dst, scratch));
+        }
+        
+        void loadCellArgument(int argument, RegisterID dst)
+        {
+            unsigned src = CallFrame::argumentOffset(argument);
+            m_failures.append(emitLoadJSCell(src, dst));
+        }
+        
+        void loadJSStringArgument(VM& vm, int argument, RegisterID dst)
+        {
+            loadCellArgument(argument, dst);
+            m_failures.append(branchStructure(NotEqual, 
+                Address(dst, JSCell::structureIDOffset()), 
+                vm.stringStructure.get()));
+        }
+        
+        void loadArgumentWithSpecificClass(const ClassInfo* classInfo, int argument, RegisterID dst, RegisterID scratch)
+        {
+            loadCellArgument(argument, dst);
+            emitLoadStructure(dst, scratch, dst);
+            appendFailure(branchPtr(NotEqual, Address(scratch, Structure::classInfoOffset()), TrustedImmPtr(classInfo)));
+            // We have to reload the argument since emitLoadStructure clobbered it.
+            loadCellArgument(argument, dst);
+        }
+        
+        void loadInt32Argument(int argument, RegisterID dst, Jump& failTarget)
+        {
+            unsigned src = CallFrame::argumentOffset(argument);
+            failTarget = emitLoadInt32(src, dst);
+        }
+        
+        void loadInt32Argument(int argument, RegisterID dst)
+        {
+            Jump conversionFailed;
+            loadInt32Argument(argument, dst, conversionFailed);
+            m_failures.append(conversionFailed);
+        }
+        
+        void appendFailure(const Jump& failure)
+        {
+            m_failures.append(failure);
+        }
+#if USE(JSVALUE64)
+        void returnJSValue(RegisterID src)
+        {
+            if (src != regT0)
+                move(src, regT0);
+            
+            emitRestoreSavedTagRegisters();
+            emitFunctionEpilogue();
+            ret();
+        }
+#else
+        void returnJSValue(RegisterID payload, RegisterID tag)
+        {
+            ASSERT_UNUSED(payload, payload == regT0);
+            ASSERT_UNUSED(tag, tag == regT1);
+            emitRestoreSavedTagRegisters();
+            emitFunctionEpilogue();
+            ret();
+        }
+#endif
+        
+        void returnDouble(FPRegisterID src)
+        {
+#if USE(JSVALUE64)
+            moveDoubleTo64(src, regT0);
+            Jump zero = branchTest64(Zero, regT0);
+            sub64(tagTypeNumberRegister, regT0);
+            Jump done = jump();
+            zero.link(this);
+            move(tagTypeNumberRegister, regT0);
+            done.link(this);
+#else
+            moveDoubleToInts(src, regT0, regT1);
+            Jump lowNonZero = branchTestPtr(NonZero, regT1);
+            Jump highNonZero = branchTestPtr(NonZero, regT0);
+            move(TrustedImm32(0), regT0);
+            move(TrustedImm32(Int32Tag), regT1);
+            lowNonZero.link(this);
+            highNonZero.link(this);
+#endif
+            emitRestoreSavedTagRegisters();
+            emitFunctionEpilogue();
+            ret();
+        }
+
+        void returnInt32(RegisterID src)
+        {
+            if (src != regT0)
+                move(src, regT0);
+            tagReturnAsInt32();
+            emitRestoreSavedTagRegisters();
+            emitFunctionEpilogue();
+            ret();
+        }
+
+        void returnJSCell(RegisterID src)
+        {
+            if (src != regT0)
+                move(src, regT0);
+            tagReturnAsJSCell();
+            emitRestoreSavedTagRegisters();
+            emitFunctionEpilogue();
+            ret();
+        }
+        
+        MacroAssemblerCodeRef finalize(MacroAssemblerCodePtr fallback, const char* thunkKind)
+        {
+            LinkBuffer patchBuffer(*m_vm, *this, GLOBAL_THUNK_ID);
+            patchBuffer.link(m_failures, CodeLocationLabel(fallback));
+            for (unsigned i = 0; i < m_calls.size(); i++)
+                patchBuffer.link(m_calls[i].first, m_calls[i].second);
+            return FINALIZE_CODE(patchBuffer, ("Specialized thunk for %s", thunkKind));
+        }
+
+        // Assumes that the target function uses fpRegister0 as the first argument
+        // and return value. Like any sensible architecture would.
+        void callDoubleToDouble(FunctionPtr function)
+        {
+            m_calls.append(std::make_pair(call(), function));
+        }
+        
+        void callDoubleToDoublePreservingReturn(FunctionPtr function)
+        {
+            if (!isX86())
+                preserveReturnAddressAfterCall(regT3);
+            callDoubleToDouble(function);
+            if (!isX86())
+                restoreReturnAddressBeforeReturn(regT3);
+        }
+
+    private:
+        void tagReturnAsInt32()
+        {
+#if USE(JSVALUE64)
+            or64(tagTypeNumberRegister, regT0);
+#else
+            move(TrustedImm32(JSValue::Int32Tag), regT1);
+#endif
+        }
+
+        void tagReturnAsJSCell()
+        {
+#if USE(JSVALUE32_64)
+            move(TrustedImm32(JSValue::CellTag), regT1);
+#endif
+        }
+        
+        MacroAssembler::JumpList m_failures;
+        Vector<std::pair<Call, FunctionPtr>> m_calls;
+    };
+
+}
+
+#endif // ENABLE(JIT)
diff --git a/jit/SpillRegistersMode.h b/jit/SpillRegistersMode.h
new file mode 100644
index 0000000..4f95375
--- /dev/null
+++ b/jit/SpillRegistersMode.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum SpillRegistersMode { NeedToSpill, DontSpill };
+
+}
diff --git a/jit/TagRegistersMode.cpp b/jit/TagRegistersMode.cpp
new file mode 100644
index 0000000..deb6913
--- /dev/null
+++ b/jit/TagRegistersMode.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TagRegistersMode.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, TagRegistersMode mode)
+{
+    switch (mode) {
+    case DoNotHaveTagRegisters:
+        out.print("DoNotHaveTagRegisters");
+        return;
+    case HaveTagRegisters:
+        out.print("HaveTagRegisters");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/jit/TagRegistersMode.h b/jit/TagRegistersMode.h
new file mode 100644
index 0000000..b46e780
--- /dev/null
+++ b/jit/TagRegistersMode.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum TagRegistersMode {
+    DoNotHaveTagRegisters,
+    HaveTagRegisters
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::TagRegistersMode);
+
+} // namespace WTF
diff --git a/jit/TempRegisterSet.cpp b/jit/TempRegisterSet.cpp
new file mode 100644
index 0000000..9c2e73d
--- /dev/null
+++ b/jit/TempRegisterSet.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TempRegisterSet.h"
+
+#if ENABLE(JIT)
+
+#include "JSCInlines.h"
+#include "RegisterSet.h"
+
+namespace JSC {
+
+TempRegisterSet::TempRegisterSet(const RegisterSet& other)
+{
+    clearAll();
+
+    for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
+        GPRReg reg = GPRInfo::toRegister(i);
+        if (other.get(reg))
+            set(reg);
+    }
+    for (unsigned i = FPRInfo::numberOfRegisters; i--;) {
+        FPRReg reg = FPRInfo::toRegister(i);
+        if (other.get(reg))
+            set(reg);
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/TempRegisterSet.h b/jit/TempRegisterSet.h
new file mode 100644
index 0000000..9983229
--- /dev/null
+++ b/jit/TempRegisterSet.h
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+#include "FPRInfo.h"
+#include "GPRInfo.h"
+
+namespace JSC {
+
+class RegisterSet;
+
+class TempRegisterSet {
+public:
+    TempRegisterSet()
+    {
+        clearAll();
+    }
+    
+    TempRegisterSet(const RegisterSet&);
+    
+    void set(GPRReg reg)
+    {
+        setBit(GPRInfo::toIndex(reg));
+    }
+    
+    void set(JSValueRegs regs)
+    {
+        if (regs.tagGPR() != InvalidGPRReg)
+            set(regs.tagGPR());
+        set(regs.payloadGPR());
+    }
+    
+    void setGPRByIndex(unsigned index)
+    {
+        ASSERT(index < GPRInfo::numberOfRegisters);
+        setBit(index);
+    }
+    
+    void clear(GPRReg reg)
+    {
+        clearBit(GPRInfo::toIndex(reg));
+    }
+    
+    bool get(GPRReg reg) const
+    {
+        return getBit(GPRInfo::toIndex(reg));
+    }
+    
+    bool getGPRByIndex(unsigned index) const
+    {
+        ASSERT(index < GPRInfo::numberOfRegisters);
+        return getBit(index);
+    }
+    
+    // Return the index'th free GPR.
+    GPRReg getFreeGPR(unsigned index = 0) const
+    {
+        for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
+            if (!getGPRByIndex(i) && !index--)
+                return GPRInfo::toRegister(i);
+        }
+        return InvalidGPRReg;
+    }
+    
+    void set(FPRReg reg)
+    {
+        setBit(GPRInfo::numberOfRegisters + FPRInfo::toIndex(reg));
+    }
+    
+    void setFPRByIndex(unsigned index)
+    {
+        ASSERT(index < FPRInfo::numberOfRegisters);
+        setBit(GPRInfo::numberOfRegisters + index);
+    }
+    
+    void clear(FPRReg reg)
+    {
+        clearBit(GPRInfo::numberOfRegisters + FPRInfo::toIndex(reg));
+    }
+    
+    bool get(FPRReg reg) const
+    {
+        return getBit(GPRInfo::numberOfRegisters + FPRInfo::toIndex(reg));
+    }
+    
+    bool getFPRByIndex(unsigned index) const
+    {
+        ASSERT(index < FPRInfo::numberOfRegisters);
+        return getBit(GPRInfo::numberOfRegisters + index);
+    }
+    
+    // Return the index'th free FPR.
+    FPRReg getFreeFPR(unsigned index = 0) const
+    {
+        for (unsigned i = FPRInfo::numberOfRegisters; i--;) {
+            if (!getFPRByIndex(i) && !index--)
+                return FPRInfo::toRegister(i);
+        }
+        return InvalidFPRReg;
+    }
+
+    template<typename BankInfo>
+    void setByIndex(unsigned index)
+    {
+        set(BankInfo::toRegister(index));
+    }
+    
+    template<typename BankInfo>
+    bool getByIndex(unsigned index)
+    {
+        return get(BankInfo::toRegister(index));
+    }
+    
+    unsigned numberOfSetGPRs() const
+    {
+        unsigned result = 0;
+        for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
+            if (!getBit(i))
+                continue;
+            result++;
+        }
+        return result;
+    }
+    
+    unsigned numberOfSetFPRs() const
+    {
+        unsigned result = 0;
+        for (unsigned i = FPRInfo::numberOfRegisters; i--;) {
+            if (!getBit(GPRInfo::numberOfRegisters + i))
+                continue;
+            result++;
+        }
+        return result;
+    }
+    
+    unsigned numberOfSetRegisters() const
+    {
+        unsigned result = 0;
+        for (unsigned i = totalNumberOfRegisters; i--;) {
+            if (!getBit(i))
+                continue;
+            result++;
+        }
+        return result;
+    }
+    
+private:
+    void clearAll()
+    {
+        for (unsigned i = numberOfBytesInTempRegisterSet; i--;)
+            m_set[i] = 0;
+    }
+
+    void setBit(unsigned i)
+    {
+        ASSERT(i < totalNumberOfRegisters);
+        m_set[i >> 3] |= (1 << (i & 7));
+    }
+    
+    void clearBit(unsigned i)
+    {
+        ASSERT(i < totalNumberOfRegisters);
+        m_set[i >> 3] &= ~(1 << (i & 7));
+    }
+    
+    bool getBit(unsigned i) const
+    {
+        ASSERT(i < totalNumberOfRegisters);
+        return !!(m_set[i >> 3] & (1 << (i & 7)));
+    }
+    
+    static const unsigned totalNumberOfRegisters =
+        GPRInfo::numberOfRegisters + FPRInfo::numberOfRegisters;
+    
+    static const unsigned numberOfBytesInTempRegisterSet =
+        (totalNumberOfRegisters + 7) >> 3;
+
+    uint8_t m_set[numberOfBytesInTempRegisterSet];
+};
+
+} // namespace JSC
+
+#else // ENABLE(JIT) -> so if JIT is disabled
+
+namespace JSC {
+
+// Define TempRegisterSet to something, to make it easier to refer to this type in code that
+// make be compiled when the JIT is disabled.
+
+struct TempRegisterSet { };
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/ThunkGenerator.h b/jit/ThunkGenerator.h
new file mode 100644
index 0000000..d38ec23
--- /dev/null
+++ b/jit/ThunkGenerator.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(JIT)
+
+namespace JSC {
+class VM;
+class MacroAssemblerCodeRef;
+
+typedef MacroAssemblerCodeRef (*ThunkGenerator)(VM*);
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/ThunkGenerators.cpp b/jit/ThunkGenerators.cpp
new file mode 100644
index 0000000..95551c8
--- /dev/null
+++ b/jit/ThunkGenerators.cpp
@@ -0,0 +1,1176 @@
+/*
+ * Copyright (C) 2010, 2012-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ThunkGenerators.h"
+
+#include "CodeBlock.h"
+#include "DFGSpeculativeJIT.h"
+#include "JITExceptions.h"
+#include "JITOperations.h"
+#include "JSArray.h"
+#include "JSBoundFunction.h"
+#include "MathCommon.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyInstance.h"
+#include "JSWebAssemblyRuntimeError.h"
+#include "SpecializedThunkJIT.h"
+#include "WasmExceptionType.h"
+#include <wtf/InlineASM.h>
+#include <wtf/StringPrintStream.h>
+#include <wtf/text/StringImpl.h>
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+inline void emitPointerValidation(CCallHelpers& jit, GPRReg pointerGPR)
+{
+    if (ASSERT_DISABLED)
+        return;
+    CCallHelpers::Jump isNonZero = jit.branchTestPtr(CCallHelpers::NonZero, pointerGPR);
+    jit.abortWithReason(TGInvalidPointer);
+    isNonZero.link(&jit);
+    jit.pushToSave(pointerGPR);
+    jit.load8(pointerGPR, pointerGPR);
+    jit.popToRestore(pointerGPR);
+}
+
+// We will jump here if the JIT code tries to make a call, but the
+// linking helper (C++ code) decides to throw an exception instead.
+MacroAssemblerCodeRef throwExceptionFromCallSlowPathGenerator(VM* vm)
+{
+    CCallHelpers jit(vm);
+    
+    // The call pushed a return address, so we need to pop it back off to re-align the stack,
+    // even though we won't use it.
+    jit.preserveReturnAddressAfterCall(GPRInfo::nonPreservedNonReturnGPR);
+
+    jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+
+    jit.setupArguments(CCallHelpers::TrustedImmPtr(vm), GPRInfo::callFrameRegister);
+    jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(lookupExceptionHandler)), GPRInfo::nonArgGPR0);
+    emitPointerValidation(jit, GPRInfo::nonArgGPR0);
+    jit.call(GPRInfo::nonArgGPR0);
+    jit.jumpToExceptionHandler();
+
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("Throw exception from call slow path thunk"));
+}
+
+static void slowPathFor(
+    CCallHelpers& jit, VM* vm, Sprt_JITOperation_ECli slowPathFunction)
+{
+    jit.emitFunctionPrologue();
+    jit.storePtr(GPRInfo::callFrameRegister, &vm->topCallFrame);
+#if OS(WINDOWS) && CPU(X86_64)
+    // Windows X86_64 needs some space pointed to by arg0 for return types larger than 64 bits.
+    // Other argument values are shift by 1. Use space on the stack for our two return values.
+    // Moving the stack down maxFrameExtentForSlowPathCall bytes gives us room for our 3 arguments
+    // and space for the 16 byte return area.
+    jit.addPtr(CCallHelpers::TrustedImm32(-maxFrameExtentForSlowPathCall), CCallHelpers::stackPointerRegister);
+    jit.move(GPRInfo::regT2, GPRInfo::argumentGPR2);
+    jit.addPtr(CCallHelpers::TrustedImm32(32), CCallHelpers::stackPointerRegister, GPRInfo::argumentGPR0);
+    jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
+    jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(slowPathFunction)), GPRInfo::nonArgGPR0);
+    emitPointerValidation(jit, GPRInfo::nonArgGPR0);
+    jit.call(GPRInfo::nonArgGPR0);
+    jit.loadPtr(CCallHelpers::Address(GPRInfo::returnValueGPR, 8), GPRInfo::returnValueGPR2);
+    jit.loadPtr(CCallHelpers::Address(GPRInfo::returnValueGPR), GPRInfo::returnValueGPR);
+    jit.addPtr(CCallHelpers::TrustedImm32(maxFrameExtentForSlowPathCall), CCallHelpers::stackPointerRegister);
+#else
+    if (maxFrameExtentForSlowPathCall)
+        jit.addPtr(CCallHelpers::TrustedImm32(-maxFrameExtentForSlowPathCall), CCallHelpers::stackPointerRegister);
+    jit.setupArgumentsWithExecState(GPRInfo::regT2);
+    jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(slowPathFunction)), GPRInfo::nonArgGPR0);
+    emitPointerValidation(jit, GPRInfo::nonArgGPR0);
+    jit.call(GPRInfo::nonArgGPR0);
+    if (maxFrameExtentForSlowPathCall)
+        jit.addPtr(CCallHelpers::TrustedImm32(maxFrameExtentForSlowPathCall), CCallHelpers::stackPointerRegister);
+#endif
+
+    // This slow call will return the address of one of the following:
+    // 1) Exception throwing thunk.
+    // 2) Host call return value returner thingy.
+    // 3) The function to call.
+    // The second return value GPR will hold a non-zero value for tail calls.
+
+    emitPointerValidation(jit, GPRInfo::returnValueGPR);
+    jit.emitFunctionEpilogue();
+
+    RELEASE_ASSERT(reinterpret_cast<void*>(KeepTheFrame) == reinterpret_cast<void*>(0));
+    CCallHelpers::Jump doNotTrash = jit.branchTestPtr(CCallHelpers::Zero, GPRInfo::returnValueGPR2);
+
+    jit.preserveReturnAddressAfterCall(GPRInfo::nonPreservedNonReturnGPR);
+    jit.prepareForTailCallSlow(GPRInfo::returnValueGPR);
+
+    doNotTrash.link(&jit);
+    jit.jump(GPRInfo::returnValueGPR);
+}
+
+MacroAssemblerCodeRef linkCallThunkGenerator(VM* vm)
+{
+    // The return address is on the stack or in the link register. We will hence
+    // save the return address to the call frame while we make a C++ function call
+    // to perform linking and lazy compilation if necessary. We expect the callee
+    // to be in regT0/regT1 (payload/tag), the CallFrame to have already
+    // been adjusted, and all other registers to be available for use.
+    CCallHelpers jit(vm);
+    
+    slowPathFor(jit, vm, operationLinkCall);
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("Link call slow path thunk"));
+}
+
+// For closure optimizations, we only include calls, since if you're using closures for
+// object construction then you're going to lose big time anyway.
+MacroAssemblerCodeRef linkPolymorphicCallThunkGenerator(VM* vm)
+{
+    CCallHelpers jit(vm);
+    
+    slowPathFor(jit, vm, operationLinkPolymorphicCall);
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("Link polymorphic call slow path thunk"));
+}
+
+// FIXME: We should distinguish between a megamorphic virtual call vs. a slow
+// path virtual call so that we can enable fast tail calls for megamorphic
+// virtual calls by using the shuffler.
+// https://bugs.webkit.org/show_bug.cgi?id=148831
+MacroAssemblerCodeRef virtualThunkFor(VM* vm, CallLinkInfo& callLinkInfo)
+{
+    // The callee is in regT0 (for JSVALUE32_64, the tag is in regT1).
+    // The return address is on the stack, or in the link register. We will hence
+    // jump to the callee, or save the return address to the call frame while we
+    // make a C++ function call to the appropriate JIT operation.
+
+    CCallHelpers jit(vm);
+    
+    CCallHelpers::JumpList slowCase;
+    
+    // This is a slow path execution, and regT2 contains the CallLinkInfo. Count the
+    // slow path execution for the profiler.
+    jit.add32(
+        CCallHelpers::TrustedImm32(1),
+        CCallHelpers::Address(GPRInfo::regT2, CallLinkInfo::offsetOfSlowPathCount()));
+
+    // FIXME: we should have a story for eliminating these checks. In many cases,
+    // the DFG knows that the value is definitely a cell, or definitely a function.
+    
+#if USE(JSVALUE64)
+    slowCase.append(
+        jit.branchTest64(
+            CCallHelpers::NonZero, GPRInfo::regT0, GPRInfo::tagMaskRegister));
+#else
+    slowCase.append(
+        jit.branch32(
+            CCallHelpers::NotEqual, GPRInfo::regT1,
+            CCallHelpers::TrustedImm32(JSValue::CellTag)));
+#endif
+    slowCase.append(jit.branchIfNotType(GPRInfo::regT0, JSFunctionType));
+    
+    // Now we know we have a JSFunction.
+    
+    jit.loadPtr(
+        CCallHelpers::Address(GPRInfo::regT0, JSFunction::offsetOfExecutable()),
+        GPRInfo::regT4);
+    jit.loadPtr(
+        CCallHelpers::Address(
+            GPRInfo::regT4, ExecutableBase::offsetOfJITCodeWithArityCheckFor(
+                callLinkInfo.specializationKind())),
+        GPRInfo::regT4);
+    slowCase.append(jit.branchTestPtr(CCallHelpers::Zero, GPRInfo::regT4));
+    
+    // Now we know that we have a CodeBlock, and we're committed to making a fast
+    // call.
+    
+    // Make a tail call. This will return back to JIT code.
+    emitPointerValidation(jit, GPRInfo::regT4);
+    if (callLinkInfo.isTailCall()) {
+        jit.preserveReturnAddressAfterCall(GPRInfo::regT0);
+        jit.prepareForTailCallSlow(GPRInfo::regT4);
+    }
+    jit.jump(GPRInfo::regT4);
+
+    slowCase.link(&jit);
+    
+    // Here we don't know anything, so revert to the full slow path.
+    
+    slowPathFor(jit, vm, operationVirtualCall);
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(
+        patchBuffer,
+        ("Virtual %s slow path thunk",
+        callLinkInfo.callMode() == CallMode::Regular ? "call" : callLinkInfo.callMode() == CallMode::Tail ? "tail call" : "construct"));
+}
+
+enum ThunkEntryType { EnterViaCall, EnterViaJumpWithSavedTags, EnterViaJumpWithoutSavedTags };
+
+static MacroAssemblerCodeRef nativeForGenerator(VM* vm, CodeSpecializationKind kind, ThunkEntryType entryType = EnterViaCall)
+{
+    // FIXME: This should be able to log ShadowChicken prologue packets.
+    // https://bugs.webkit.org/show_bug.cgi?id=155689
+    
+    int executableOffsetToFunction = NativeExecutable::offsetOfNativeFunctionFor(kind);
+    
+    JSInterfaceJIT jit(vm);
+
+    switch (entryType) {
+    case EnterViaCall:
+        jit.emitFunctionPrologue();
+        break;
+    case EnterViaJumpWithSavedTags:
+#if USE(JSVALUE64)
+        // We're coming from a specialized thunk that has saved the prior tag registers' contents.
+        // Restore them now.
+#if CPU(ARM64)
+        jit.popPair(JSInterfaceJIT::tagTypeNumberRegister, JSInterfaceJIT::tagMaskRegister);
+#else
+        jit.pop(JSInterfaceJIT::tagMaskRegister);
+        jit.pop(JSInterfaceJIT::tagTypeNumberRegister);
+#endif
+#endif
+        break;
+    case EnterViaJumpWithoutSavedTags:
+        jit.move(JSInterfaceJIT::framePointerRegister, JSInterfaceJIT::stackPointerRegister);
+        break;
+    }
+
+    jit.emitPutToCallFrameHeader(0, CallFrameSlot::codeBlock);
+    jit.storePtr(JSInterfaceJIT::callFrameRegister, &vm->topCallFrame);
+
+#if CPU(X86)
+    // Calling convention:      f(ecx, edx, ...);
+    // Host function signature: f(ExecState*);
+    jit.move(JSInterfaceJIT::callFrameRegister, X86Registers::ecx);
+
+    jit.subPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::stackPointerRegister); // Align stack after prologue.
+
+    // call the function
+    jit.emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, JSInterfaceJIT::regT1);
+    jit.loadPtr(JSInterfaceJIT::Address(JSInterfaceJIT::regT1, JSFunction::offsetOfExecutable()), JSInterfaceJIT::regT1);
+    jit.call(JSInterfaceJIT::Address(JSInterfaceJIT::regT1, executableOffsetToFunction));
+
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::stackPointerRegister);
+
+#elif CPU(X86_64)
+#if !OS(WINDOWS)
+    // Calling convention:      f(edi, esi, edx, ecx, ...);
+    // Host function signature: f(ExecState*);
+    jit.move(JSInterfaceJIT::callFrameRegister, X86Registers::edi);
+
+    jit.emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, X86Registers::esi);
+    jit.loadPtr(JSInterfaceJIT::Address(X86Registers::esi, JSFunction::offsetOfExecutable()), X86Registers::r9);
+    jit.call(JSInterfaceJIT::Address(X86Registers::r9, executableOffsetToFunction));
+
+#else
+    // Calling convention:      f(ecx, edx, r8, r9, ...);
+    // Host function signature: f(ExecState*);
+    jit.move(JSInterfaceJIT::callFrameRegister, X86Registers::ecx);
+
+    // Leave space for the callee parameter home addresses.
+    // At this point the stack is aligned to 16 bytes, but if this changes at some point, we need to emit code to align it.
+    jit.subPtr(JSInterfaceJIT::TrustedImm32(4 * sizeof(int64_t)), JSInterfaceJIT::stackPointerRegister);
+
+    jit.emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, X86Registers::edx);
+    jit.loadPtr(JSInterfaceJIT::Address(X86Registers::edx, JSFunction::offsetOfExecutable()), X86Registers::r9);
+    jit.call(JSInterfaceJIT::Address(X86Registers::r9, executableOffsetToFunction));
+
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(4 * sizeof(int64_t)), JSInterfaceJIT::stackPointerRegister);
+#endif
+
+#elif CPU(ARM64)
+    COMPILE_ASSERT(ARM64Registers::x0 != JSInterfaceJIT::regT3, T3_not_trampled_by_arg_0);
+    COMPILE_ASSERT(ARM64Registers::x1 != JSInterfaceJIT::regT3, T3_not_trampled_by_arg_1);
+    COMPILE_ASSERT(ARM64Registers::x2 != JSInterfaceJIT::regT3, T3_not_trampled_by_arg_2);
+
+    // Host function signature: f(ExecState*);
+    jit.move(JSInterfaceJIT::callFrameRegister, ARM64Registers::x0);
+
+    jit.emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, ARM64Registers::x1);
+    jit.loadPtr(JSInterfaceJIT::Address(ARM64Registers::x1, JSFunction::offsetOfExecutable()), ARM64Registers::x2);
+    jit.call(JSInterfaceJIT::Address(ARM64Registers::x2, executableOffsetToFunction));
+#elif CPU(ARM) || CPU(SH4) || CPU(MIPS)
+#if CPU(MIPS)
+    // Allocate stack space for (unused) 16 bytes (8-byte aligned) for 4 arguments.
+    jit.subPtr(JSInterfaceJIT::TrustedImm32(16), JSInterfaceJIT::stackPointerRegister);
+#endif
+
+    // Calling convention is f(argumentGPR0, argumentGPR1, ...).
+    // Host function signature is f(ExecState*).
+    jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR0);
+
+    jit.emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, JSInterfaceJIT::argumentGPR1);
+    jit.loadPtr(JSInterfaceJIT::Address(JSInterfaceJIT::argumentGPR1, JSFunction::offsetOfExecutable()), JSInterfaceJIT::regT2);
+    jit.call(JSInterfaceJIT::Address(JSInterfaceJIT::regT2, executableOffsetToFunction));
+
+#if CPU(MIPS)
+    // Restore stack space
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(16), JSInterfaceJIT::stackPointerRegister);
+#endif
+#else
+#error "JIT not supported on this platform."
+    UNUSED_PARAM(executableOffsetToFunction);
+    abortWithReason(TGNotSupported);
+#endif
+
+    // Check for an exception
+#if USE(JSVALUE64)
+    jit.load64(vm->addressOfException(), JSInterfaceJIT::regT2);
+    JSInterfaceJIT::Jump exceptionHandler = jit.branchTest64(JSInterfaceJIT::NonZero, JSInterfaceJIT::regT2);
+#else
+    JSInterfaceJIT::Jump exceptionHandler = jit.branch32(
+        JSInterfaceJIT::NotEqual,
+        JSInterfaceJIT::AbsoluteAddress(vm->addressOfException()),
+        JSInterfaceJIT::TrustedImm32(0));
+#endif
+
+    jit.emitFunctionEpilogue();
+    // Return.
+    jit.ret();
+
+    // Handle an exception
+    exceptionHandler.link(&jit);
+
+    jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
+    jit.storePtr(JSInterfaceJIT::callFrameRegister, &vm->topCallFrame);
+
+#if CPU(X86) && USE(JSVALUE32_64)
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(-12), JSInterfaceJIT::stackPointerRegister);
+    jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT0);
+    jit.push(JSInterfaceJIT::regT0);
+#else
+#if OS(WINDOWS)
+    // Allocate space on stack for the 4 parameter registers.
+    jit.subPtr(JSInterfaceJIT::TrustedImm32(4 * sizeof(int64_t)), JSInterfaceJIT::stackPointerRegister);
+#endif
+    jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR0);
+#endif
+    jit.move(JSInterfaceJIT::TrustedImmPtr(FunctionPtr(operationVMHandleException).value()), JSInterfaceJIT::regT3);
+    jit.call(JSInterfaceJIT::regT3);
+#if CPU(X86) && USE(JSVALUE32_64)
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(16), JSInterfaceJIT::stackPointerRegister);
+#elif OS(WINDOWS)
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(4 * sizeof(int64_t)), JSInterfaceJIT::stackPointerRegister);
+#endif
+
+    jit.jumpToExceptionHandler();
+
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("native %s%s trampoline", entryType == EnterViaJumpWithSavedTags ? "Tail With Saved Tags " : entryType == EnterViaJumpWithoutSavedTags ? "Tail Without Saved Tags " : "", toCString(kind).data()));
+}
+
+MacroAssemblerCodeRef nativeCallGenerator(VM* vm)
+{
+    return nativeForGenerator(vm, CodeForCall);
+}
+
+MacroAssemblerCodeRef nativeTailCallGenerator(VM* vm)
+{
+    return nativeForGenerator(vm, CodeForCall, EnterViaJumpWithSavedTags);
+}
+
+MacroAssemblerCodeRef nativeTailCallWithoutSavedTagsGenerator(VM* vm)
+{
+    return nativeForGenerator(vm, CodeForCall, EnterViaJumpWithoutSavedTags);
+}
+
+MacroAssemblerCodeRef nativeConstructGenerator(VM* vm)
+{
+    return nativeForGenerator(vm, CodeForConstruct);
+}
+
+MacroAssemblerCodeRef arityFixupGenerator(VM* vm)
+{
+    JSInterfaceJIT jit(vm);
+
+    // We enter with fixup count in argumentGPR0
+    // We have the guarantee that a0, a1, a2, t3, t4 and t5 (or t0 for Windows) are all distinct :-)
+#if USE(JSVALUE64)
+#if OS(WINDOWS)
+    const GPRReg extraTemp = JSInterfaceJIT::regT0;
+#else
+    const GPRReg extraTemp = JSInterfaceJIT::regT5;
+#endif
+#  if CPU(X86_64)
+    jit.pop(JSInterfaceJIT::regT4);
+#  endif
+    jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
+    jit.load32(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, CallFrameSlot::argumentCount * sizeof(Register)), JSInterfaceJIT::argumentGPR2);
+    jit.add32(JSInterfaceJIT::TrustedImm32(CallFrame::headerSizeInRegisters), JSInterfaceJIT::argumentGPR2);
+
+    // Check to see if we have extra slots we can use
+    jit.move(JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::argumentGPR1);
+    jit.and32(JSInterfaceJIT::TrustedImm32(stackAlignmentRegisters() - 1), JSInterfaceJIT::argumentGPR1);
+    JSInterfaceJIT::Jump noExtraSlot = jit.branchTest32(MacroAssembler::Zero, JSInterfaceJIT::argumentGPR1);
+    jit.move(JSInterfaceJIT::TrustedImm64(ValueUndefined), extraTemp);
+    JSInterfaceJIT::Label fillExtraSlots(jit.label());
+    jit.store64(extraTemp, MacroAssembler::BaseIndex(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR2, JSInterfaceJIT::TimesEight));
+    jit.add32(JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2);
+    jit.branchSub32(JSInterfaceJIT::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR1).linkTo(fillExtraSlots, &jit);
+    jit.and32(JSInterfaceJIT::TrustedImm32(-stackAlignmentRegisters()), JSInterfaceJIT::argumentGPR0);
+    JSInterfaceJIT::Jump done = jit.branchTest32(MacroAssembler::Zero, JSInterfaceJIT::argumentGPR0);
+    noExtraSlot.link(&jit);
+
+    jit.neg64(JSInterfaceJIT::argumentGPR0);
+
+    // Move current frame down argumentGPR0 number of slots
+    JSInterfaceJIT::Label copyLoop(jit.label());
+    jit.load64(JSInterfaceJIT::regT3, extraTemp);
+    jit.store64(extraTemp, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight));
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
+    jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2).linkTo(copyLoop, &jit);
+
+    // Fill in argumentGPR0 missing arg slots with undefined
+    jit.move(JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::argumentGPR2);
+    jit.move(JSInterfaceJIT::TrustedImm64(ValueUndefined), extraTemp);
+    JSInterfaceJIT::Label fillUndefinedLoop(jit.label());
+    jit.store64(extraTemp, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight));
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
+    jit.branchAdd32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2).linkTo(fillUndefinedLoop, &jit);
+    
+    // Adjust call frame register and stack pointer to account for missing args
+    jit.move(JSInterfaceJIT::argumentGPR0, extraTemp);
+    jit.lshift64(JSInterfaceJIT::TrustedImm32(3), extraTemp);
+    jit.addPtr(extraTemp, JSInterfaceJIT::callFrameRegister);
+    jit.addPtr(extraTemp, JSInterfaceJIT::stackPointerRegister);
+
+    done.link(&jit);
+
+#  if CPU(X86_64)
+    jit.push(JSInterfaceJIT::regT4);
+#  endif
+    jit.ret();
+#else
+#  if CPU(X86)
+    jit.pop(JSInterfaceJIT::regT4);
+#  endif
+    jit.move(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::regT3);
+    jit.load32(JSInterfaceJIT::Address(JSInterfaceJIT::callFrameRegister, CallFrameSlot::argumentCount * sizeof(Register)), JSInterfaceJIT::argumentGPR2);
+    jit.add32(JSInterfaceJIT::TrustedImm32(CallFrame::headerSizeInRegisters), JSInterfaceJIT::argumentGPR2);
+
+    // Check to see if we have extra slots we can use
+    jit.move(JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::argumentGPR1);
+    jit.and32(JSInterfaceJIT::TrustedImm32(stackAlignmentRegisters() - 1), JSInterfaceJIT::argumentGPR1);
+    JSInterfaceJIT::Jump noExtraSlot = jit.branchTest32(MacroAssembler::Zero, JSInterfaceJIT::argumentGPR1);
+    JSInterfaceJIT::Label fillExtraSlots(jit.label());
+    jit.move(JSInterfaceJIT::TrustedImm32(0), JSInterfaceJIT::regT5);
+    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR2, JSInterfaceJIT::TimesEight, PayloadOffset));
+    jit.move(JSInterfaceJIT::TrustedImm32(JSValue::UndefinedTag), JSInterfaceJIT::regT5);
+    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::callFrameRegister, JSInterfaceJIT::argumentGPR2, JSInterfaceJIT::TimesEight, TagOffset));
+    jit.add32(JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2);
+    jit.branchSub32(JSInterfaceJIT::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR1).linkTo(fillExtraSlots, &jit);
+    jit.and32(JSInterfaceJIT::TrustedImm32(-stackAlignmentRegisters()), JSInterfaceJIT::argumentGPR0);
+    JSInterfaceJIT::Jump done = jit.branchTest32(MacroAssembler::Zero, JSInterfaceJIT::argumentGPR0);
+    noExtraSlot.link(&jit);
+
+    jit.neg32(JSInterfaceJIT::argumentGPR0);
+
+    // Move current frame down argumentGPR0 number of slots
+    JSInterfaceJIT::Label copyLoop(jit.label());
+    jit.load32(MacroAssembler::Address(JSInterfaceJIT::regT3, PayloadOffset), JSInterfaceJIT::regT5);
+    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight, PayloadOffset));
+    jit.load32(MacroAssembler::Address(JSInterfaceJIT::regT3, TagOffset), JSInterfaceJIT::regT5);
+    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight, TagOffset));
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
+    jit.branchSub32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2).linkTo(copyLoop, &jit);
+
+    // Fill in argumentGPR0 missing arg slots with undefined
+    jit.move(JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::argumentGPR2);
+    JSInterfaceJIT::Label fillUndefinedLoop(jit.label());
+    jit.move(JSInterfaceJIT::TrustedImm32(0), JSInterfaceJIT::regT5);
+    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight, PayloadOffset));
+    jit.move(JSInterfaceJIT::TrustedImm32(JSValue::UndefinedTag), JSInterfaceJIT::regT5);
+    jit.store32(JSInterfaceJIT::regT5, MacroAssembler::BaseIndex(JSInterfaceJIT::regT3, JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::TimesEight, TagOffset));
+
+    jit.addPtr(JSInterfaceJIT::TrustedImm32(8), JSInterfaceJIT::regT3);
+    jit.branchAdd32(MacroAssembler::NonZero, JSInterfaceJIT::TrustedImm32(1), JSInterfaceJIT::argumentGPR2).linkTo(fillUndefinedLoop, &jit);
+
+    // Adjust call frame register and stack pointer to account for missing args
+    jit.move(JSInterfaceJIT::argumentGPR0, JSInterfaceJIT::regT5);
+    jit.lshift32(JSInterfaceJIT::TrustedImm32(3), JSInterfaceJIT::regT5);
+    jit.addPtr(JSInterfaceJIT::regT5, JSInterfaceJIT::callFrameRegister);
+    jit.addPtr(JSInterfaceJIT::regT5, JSInterfaceJIT::stackPointerRegister);
+
+    done.link(&jit);
+
+#  if CPU(X86)
+    jit.push(JSInterfaceJIT::regT4);
+#  endif
+    jit.ret();
+#endif
+
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("fixup arity"));
+}
+
+MacroAssemblerCodeRef unreachableGenerator(VM* vm)
+{
+    JSInterfaceJIT jit(vm);
+
+    jit.breakpoint();
+
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("unreachable thunk"));
+}
+
+static void stringCharLoad(SpecializedThunkJIT& jit, VM* vm)
+{
+    // load string
+    jit.loadJSStringArgument(*vm, SpecializedThunkJIT::ThisArgument, SpecializedThunkJIT::regT0);
+
+    // Load string length to regT2, and start the process of loading the data pointer into regT0
+    jit.load32(MacroAssembler::Address(SpecializedThunkJIT::regT0, ThunkHelpers::jsStringLengthOffset()), SpecializedThunkJIT::regT2);
+    jit.loadPtr(MacroAssembler::Address(SpecializedThunkJIT::regT0, ThunkHelpers::jsStringValueOffset()), SpecializedThunkJIT::regT0);
+    jit.appendFailure(jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT0));
+
+    // load index
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT1); // regT1 contains the index
+
+    // Do an unsigned compare to simultaneously filter negative indices as well as indices that are too large
+    jit.appendFailure(jit.branch32(MacroAssembler::AboveOrEqual, SpecializedThunkJIT::regT1, SpecializedThunkJIT::regT2));
+
+    // Load the character
+    SpecializedThunkJIT::JumpList is16Bit;
+    SpecializedThunkJIT::JumpList cont8Bit;
+    // Load the string flags
+    jit.loadPtr(MacroAssembler::Address(SpecializedThunkJIT::regT0, StringImpl::flagsOffset()), SpecializedThunkJIT::regT2);
+    jit.loadPtr(MacroAssembler::Address(SpecializedThunkJIT::regT0, StringImpl::dataOffset()), SpecializedThunkJIT::regT0);
+    is16Bit.append(jit.branchTest32(MacroAssembler::Zero, SpecializedThunkJIT::regT2, MacroAssembler::TrustedImm32(StringImpl::flagIs8Bit())));
+    jit.load8(MacroAssembler::BaseIndex(SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1, MacroAssembler::TimesOne, 0), SpecializedThunkJIT::regT0);
+    cont8Bit.append(jit.jump());
+    is16Bit.link(&jit);
+    jit.load16(MacroAssembler::BaseIndex(SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1, MacroAssembler::TimesTwo, 0), SpecializedThunkJIT::regT0);
+    cont8Bit.link(&jit);
+}
+
+static void charToString(SpecializedThunkJIT& jit, VM* vm, MacroAssembler::RegisterID src, MacroAssembler::RegisterID dst, MacroAssembler::RegisterID scratch)
+{
+    jit.appendFailure(jit.branch32(MacroAssembler::AboveOrEqual, src, MacroAssembler::TrustedImm32(0x100)));
+    jit.move(MacroAssembler::TrustedImmPtr(vm->smallStrings.singleCharacterStrings()), scratch);
+    jit.loadPtr(MacroAssembler::BaseIndex(scratch, src, MacroAssembler::ScalePtr, 0), dst);
+    jit.appendFailure(jit.branchTestPtr(MacroAssembler::Zero, dst));
+}
+
+MacroAssemblerCodeRef charCodeAtThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    stringCharLoad(jit, vm);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "charCodeAt");
+}
+
+MacroAssemblerCodeRef charAtThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    stringCharLoad(jit, vm);
+    charToString(jit, vm, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1);
+    jit.returnJSCell(SpecializedThunkJIT::regT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "charAt");
+}
+
+MacroAssemblerCodeRef fromCharCodeThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    // load char code
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT0);
+    charToString(jit, vm, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1);
+    jit.returnJSCell(SpecializedThunkJIT::regT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "fromCharCode");
+}
+
+MacroAssemblerCodeRef clz32ThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    MacroAssembler::Jump nonIntArgJump;
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntArgJump);
+
+    SpecializedThunkJIT::Label convertedArgumentReentry(&jit);
+    jit.countLeadingZeros32(SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1);
+    jit.returnInt32(SpecializedThunkJIT::regT1);
+
+    if (jit.supportsFloatingPointTruncate()) {
+        nonIntArgJump.link(&jit);
+        jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+        jit.branchTruncateDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0, SpecializedThunkJIT::BranchIfTruncateSuccessful).linkTo(convertedArgumentReentry, &jit);
+        jit.appendFailure(jit.jump());
+    } else
+        jit.appendFailure(nonIntArgJump);
+
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "clz32");
+}
+
+MacroAssemblerCodeRef sqrtThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    if (!jit.supportsFloatingPointSqrt())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+
+    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+    jit.sqrtDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT0);
+    jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "sqrt");
+}
+
+
+#define UnaryDoubleOpWrapper(function) function##Wrapper
+enum MathThunkCallingConvention { };
+typedef MathThunkCallingConvention(*MathThunk)(MathThunkCallingConvention);
+
+#if CPU(X86_64) && COMPILER(GCC_OR_CLANG) && (OS(DARWIN) || OS(LINUX))
+
+#define defineUnaryDoubleOpWrapper(function) \
+    asm( \
+        ".text\n" \
+        ".globl " SYMBOL_STRING(function##Thunk) "\n" \
+        HIDE_SYMBOL(function##Thunk) "\n" \
+        SYMBOL_STRING(function##Thunk) ":" "\n" \
+        "pushq %rax\n" \
+        "call " GLOBAL_REFERENCE(function) "\n" \
+        "popq %rcx\n" \
+        "ret\n" \
+    );\
+    extern "C" { \
+        MathThunkCallingConvention function##Thunk(MathThunkCallingConvention); \
+    } \
+    static MathThunk UnaryDoubleOpWrapper(function) = &function##Thunk;
+
+#elif CPU(X86) && COMPILER(GCC_OR_CLANG) && OS(LINUX) && defined(__PIC__)
+#define defineUnaryDoubleOpWrapper(function) \
+    asm( \
+        ".text\n" \
+        ".globl " SYMBOL_STRING(function##Thunk) "\n" \
+        HIDE_SYMBOL(function##Thunk) "\n" \
+        SYMBOL_STRING(function##Thunk) ":" "\n" \
+        "pushl %ebx\n" \
+        "subl $20, %esp\n" \
+        "movsd %xmm0, (%esp) \n" \
+        "call __x86.get_pc_thunk.bx\n" \
+        "addl $_GLOBAL_OFFSET_TABLE_, %ebx\n" \
+        "call " GLOBAL_REFERENCE(function) "\n" \
+        "fstpl (%esp) \n" \
+        "movsd (%esp), %xmm0 \n" \
+        "addl $20, %esp\n" \
+        "popl %ebx\n" \
+        "ret\n" \
+    );\
+    extern "C" { \
+        MathThunkCallingConvention function##Thunk(MathThunkCallingConvention); \
+    } \
+    static MathThunk UnaryDoubleOpWrapper(function) = &function##Thunk;
+
+#elif CPU(X86) && COMPILER(GCC_OR_CLANG) && (OS(DARWIN) || OS(LINUX))
+#define defineUnaryDoubleOpWrapper(function) \
+    asm( \
+        ".text\n" \
+        ".globl " SYMBOL_STRING(function##Thunk) "\n" \
+        HIDE_SYMBOL(function##Thunk) "\n" \
+        SYMBOL_STRING(function##Thunk) ":" "\n" \
+        "subl $20, %esp\n" \
+        "movsd %xmm0, (%esp) \n" \
+        "call " GLOBAL_REFERENCE(function) "\n" \
+        "fstpl (%esp) \n" \
+        "movsd (%esp), %xmm0 \n" \
+        "addl $20, %esp\n" \
+        "ret\n" \
+    );\
+    extern "C" { \
+        MathThunkCallingConvention function##Thunk(MathThunkCallingConvention); \
+    } \
+    static MathThunk UnaryDoubleOpWrapper(function) = &function##Thunk;
+
+#elif CPU(ARM_THUMB2) && COMPILER(GCC_OR_CLANG) && PLATFORM(IOS)
+
+#define defineUnaryDoubleOpWrapper(function) \
+    asm( \
+        ".text\n" \
+        ".align 2\n" \
+        ".globl " SYMBOL_STRING(function##Thunk) "\n" \
+        HIDE_SYMBOL(function##Thunk) "\n" \
+        ".thumb\n" \
+        ".thumb_func " THUMB_FUNC_PARAM(function##Thunk) "\n" \
+        SYMBOL_STRING(function##Thunk) ":" "\n" \
+        "push {lr}\n" \
+        "vmov r0, r1, d0\n" \
+        "blx " GLOBAL_REFERENCE(function) "\n" \
+        "vmov d0, r0, r1\n" \
+        "pop {lr}\n" \
+        "bx lr\n" \
+    ); \
+    extern "C" { \
+        MathThunkCallingConvention function##Thunk(MathThunkCallingConvention); \
+    } \
+    static MathThunk UnaryDoubleOpWrapper(function) = &function##Thunk;
+
+#elif CPU(ARM64)
+
+#define defineUnaryDoubleOpWrapper(function) \
+    asm( \
+        ".text\n" \
+        ".align 2\n" \
+        ".globl " SYMBOL_STRING(function##Thunk) "\n" \
+        HIDE_SYMBOL(function##Thunk) "\n" \
+        SYMBOL_STRING(function##Thunk) ":" "\n" \
+        "b " GLOBAL_REFERENCE(function) "\n" \
+        ".previous" \
+    ); \
+    extern "C" { \
+        MathThunkCallingConvention function##Thunk(MathThunkCallingConvention); \
+    } \
+    static MathThunk UnaryDoubleOpWrapper(function) = &function##Thunk;
+
+#elif CPU(X86) && COMPILER(MSVC) && OS(WINDOWS)
+
+// MSVC does not accept floor, etc, to be called directly from inline assembly, so we need to wrap these functions.
+static double (_cdecl *floorFunction)(double) = floor;
+static double (_cdecl *ceilFunction)(double) = ceil;
+static double (_cdecl *truncFunction)(double) = trunc;
+static double (_cdecl *expFunction)(double) = exp;
+static double (_cdecl *logFunction)(double) = log;
+static double (_cdecl *jsRoundFunction)(double) = jsRound;
+
+#define defineUnaryDoubleOpWrapper(function) \
+    extern "C" __declspec(naked) MathThunkCallingConvention function##Thunk(MathThunkCallingConvention) \
+    { \
+        __asm \
+        { \
+        __asm sub esp, 20 \
+        __asm movsd mmword ptr [esp], xmm0  \
+        __asm call function##Function \
+        __asm fstp qword ptr [esp] \
+        __asm movsd xmm0, mmword ptr [esp] \
+        __asm add esp, 20 \
+        __asm ret \
+        } \
+    } \
+    static MathThunk UnaryDoubleOpWrapper(function) = &function##Thunk;
+
+#else
+
+#define defineUnaryDoubleOpWrapper(function) \
+    static MathThunk UnaryDoubleOpWrapper(function) = 0
+#endif
+
+defineUnaryDoubleOpWrapper(jsRound);
+defineUnaryDoubleOpWrapper(exp);
+defineUnaryDoubleOpWrapper(log);
+defineUnaryDoubleOpWrapper(floor);
+defineUnaryDoubleOpWrapper(ceil);
+defineUnaryDoubleOpWrapper(trunc);
+
+static const double halfConstant = 0.5;
+    
+MacroAssemblerCodeRef floorThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    MacroAssembler::Jump nonIntJump;
+    if (!UnaryDoubleOpWrapper(floor) || !jit.supportsFloatingPoint())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    nonIntJump.link(&jit);
+    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+
+    if (jit.supportsFloatingPointRounding()) {
+        SpecializedThunkJIT::JumpList doubleResult;
+        jit.floorDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT0);
+        jit.branchConvertDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0, doubleResult, SpecializedThunkJIT::fpRegT1);
+        jit.returnInt32(SpecializedThunkJIT::regT0);
+        doubleResult.link(&jit);
+        jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+        return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "floor");
+    }
+
+    SpecializedThunkJIT::Jump intResult;
+    SpecializedThunkJIT::JumpList doubleResult;
+    if (jit.supportsFloatingPointTruncate()) {
+        jit.moveZeroToDouble(SpecializedThunkJIT::fpRegT1);
+        doubleResult.append(jit.branchDouble(MacroAssembler::DoubleEqual, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1));
+        SpecializedThunkJIT::JumpList slowPath;
+        // Handle the negative doubles in the slow path for now.
+        slowPath.append(jit.branchDouble(MacroAssembler::DoubleLessThanOrUnordered, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1));
+        slowPath.append(jit.branchTruncateDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0));
+        intResult = jit.jump();
+        slowPath.link(&jit);
+    }
+    jit.callDoubleToDoublePreservingReturn(UnaryDoubleOpWrapper(floor));
+    jit.branchConvertDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0, doubleResult, SpecializedThunkJIT::fpRegT1);
+    if (jit.supportsFloatingPointTruncate())
+        intResult.link(&jit);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    doubleResult.link(&jit);
+    jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "floor");
+}
+
+MacroAssemblerCodeRef ceilThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    if (!UnaryDoubleOpWrapper(ceil) || !jit.supportsFloatingPoint())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+    MacroAssembler::Jump nonIntJump;
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    nonIntJump.link(&jit);
+    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+    if (jit.supportsFloatingPointRounding())
+        jit.ceilDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT0);
+    else
+        jit.callDoubleToDoublePreservingReturn(UnaryDoubleOpWrapper(ceil));
+
+    SpecializedThunkJIT::JumpList doubleResult;
+    jit.branchConvertDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0, doubleResult, SpecializedThunkJIT::fpRegT1);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    doubleResult.link(&jit);
+    jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "ceil");
+}
+
+MacroAssemblerCodeRef truncThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    if (!UnaryDoubleOpWrapper(trunc) || !jit.supportsFloatingPoint())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+    MacroAssembler::Jump nonIntJump;
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    nonIntJump.link(&jit);
+    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+    if (jit.supportsFloatingPointRounding())
+        jit.roundTowardZeroDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT0);
+    else
+        jit.callDoubleToDoublePreservingReturn(UnaryDoubleOpWrapper(trunc));
+
+    SpecializedThunkJIT::JumpList doubleResult;
+    jit.branchConvertDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0, doubleResult, SpecializedThunkJIT::fpRegT1);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    doubleResult.link(&jit);
+    jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "trunc");
+}
+
+MacroAssemblerCodeRef roundThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    if (!UnaryDoubleOpWrapper(jsRound) || !jit.supportsFloatingPoint())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+    MacroAssembler::Jump nonIntJump;
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    nonIntJump.link(&jit);
+    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+    SpecializedThunkJIT::Jump intResult;
+    SpecializedThunkJIT::JumpList doubleResult;
+    if (jit.supportsFloatingPointTruncate()) {
+        jit.moveZeroToDouble(SpecializedThunkJIT::fpRegT1);
+        doubleResult.append(jit.branchDouble(MacroAssembler::DoubleEqual, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1));
+        SpecializedThunkJIT::JumpList slowPath;
+        // Handle the negative doubles in the slow path for now.
+        slowPath.append(jit.branchDouble(MacroAssembler::DoubleLessThanOrUnordered, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1));
+        jit.loadDouble(MacroAssembler::TrustedImmPtr(&halfConstant), SpecializedThunkJIT::fpRegT1);
+        jit.addDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1);
+        slowPath.append(jit.branchTruncateDoubleToInt32(SpecializedThunkJIT::fpRegT1, SpecializedThunkJIT::regT0));
+        intResult = jit.jump();
+        slowPath.link(&jit);
+    }
+    jit.callDoubleToDoublePreservingReturn(UnaryDoubleOpWrapper(jsRound));
+    jit.branchConvertDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0, doubleResult, SpecializedThunkJIT::fpRegT1);
+    if (jit.supportsFloatingPointTruncate())
+        intResult.link(&jit);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    doubleResult.link(&jit);
+    jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "round");
+}
+
+MacroAssemblerCodeRef expThunkGenerator(VM* vm)
+{
+    if (!UnaryDoubleOpWrapper(exp))
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+    SpecializedThunkJIT jit(vm, 1);
+    if (!jit.supportsFloatingPoint())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+    jit.callDoubleToDoublePreservingReturn(UnaryDoubleOpWrapper(exp));
+    jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "exp");
+}
+
+MacroAssemblerCodeRef logThunkGenerator(VM* vm)
+{
+    if (!UnaryDoubleOpWrapper(log))
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+    SpecializedThunkJIT jit(vm, 1);
+    if (!jit.supportsFloatingPoint())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+    jit.callDoubleToDoublePreservingReturn(UnaryDoubleOpWrapper(log));
+    jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "log");
+}
+
+MacroAssemblerCodeRef absThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 1);
+    if (!jit.supportsFloatingPointAbs())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+
+#if USE(JSVALUE64)
+    unsigned virtualRegisterIndex = CallFrame::argumentOffset(0);
+    jit.load64(AssemblyHelpers::addressFor(virtualRegisterIndex), GPRInfo::regT0);
+    MacroAssembler::Jump notInteger = jit.branch64(MacroAssembler::Below, GPRInfo::regT0, GPRInfo::tagTypeNumberRegister);
+
+    // Abs Int32.
+    jit.rshift32(GPRInfo::regT0, MacroAssembler::TrustedImm32(31), GPRInfo::regT1);
+    jit.add32(GPRInfo::regT1, GPRInfo::regT0);
+    jit.xor32(GPRInfo::regT1, GPRInfo::regT0);
+
+    // IntMin cannot be inverted.
+    MacroAssembler::Jump integerIsIntMin = jit.branchTest32(MacroAssembler::Signed, GPRInfo::regT0);
+
+    // Box and finish.
+    jit.or64(GPRInfo::tagTypeNumberRegister, GPRInfo::regT0);
+    MacroAssembler::Jump doneWithIntegers = jit.jump();
+
+    // Handle Doubles.
+    notInteger.link(&jit);
+    jit.appendFailure(jit.branchTest64(MacroAssembler::Zero, GPRInfo::regT0, GPRInfo::tagTypeNumberRegister));
+    jit.unboxDoubleWithoutAssertions(GPRInfo::regT0, GPRInfo::regT0, FPRInfo::fpRegT0);
+    MacroAssembler::Label absFPR0Label = jit.label();
+    jit.absDouble(FPRInfo::fpRegT0, FPRInfo::fpRegT1);
+    jit.boxDouble(FPRInfo::fpRegT1, GPRInfo::regT0);
+
+    // Tail.
+    doneWithIntegers.link(&jit);
+    jit.returnJSValue(GPRInfo::regT0);
+
+    // We know the value of regT0 is IntMin. We could load that value from memory but
+    // it is simpler to just convert it.
+    integerIsIntMin.link(&jit);
+    jit.convertInt32ToDouble(GPRInfo::regT0, FPRInfo::fpRegT0);
+    jit.jump().linkTo(absFPR0Label, &jit);
+#else
+    MacroAssembler::Jump nonIntJump;
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
+    jit.rshift32(SpecializedThunkJIT::regT0, MacroAssembler::TrustedImm32(31), SpecializedThunkJIT::regT1);
+    jit.add32(SpecializedThunkJIT::regT1, SpecializedThunkJIT::regT0);
+    jit.xor32(SpecializedThunkJIT::regT1, SpecializedThunkJIT::regT0);
+    jit.appendFailure(jit.branchTest32(MacroAssembler::Signed, SpecializedThunkJIT::regT0));
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+    nonIntJump.link(&jit);
+    // Shame about the double int conversion here.
+    jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+    jit.absDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT1);
+    jit.returnDouble(SpecializedThunkJIT::fpRegT1);
+#endif
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "abs");
+}
+
+MacroAssemblerCodeRef imulThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 2);
+    MacroAssembler::Jump nonIntArg0Jump;
+    jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntArg0Jump);
+    SpecializedThunkJIT::Label doneLoadingArg0(&jit);
+    MacroAssembler::Jump nonIntArg1Jump;
+    jit.loadInt32Argument(1, SpecializedThunkJIT::regT1, nonIntArg1Jump);
+    SpecializedThunkJIT::Label doneLoadingArg1(&jit);
+    jit.mul32(SpecializedThunkJIT::regT1, SpecializedThunkJIT::regT0);
+    jit.returnInt32(SpecializedThunkJIT::regT0);
+
+    if (jit.supportsFloatingPointTruncate()) {
+        nonIntArg0Jump.link(&jit);
+        jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
+        jit.branchTruncateDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0, SpecializedThunkJIT::BranchIfTruncateSuccessful).linkTo(doneLoadingArg0, &jit);
+        jit.appendFailure(jit.jump());
+    } else
+        jit.appendFailure(nonIntArg0Jump);
+
+    if (jit.supportsFloatingPointTruncate()) {
+        nonIntArg1Jump.link(&jit);
+        jit.loadDoubleArgument(1, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT1);
+        jit.branchTruncateDoubleToInt32(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT1, SpecializedThunkJIT::BranchIfTruncateSuccessful).linkTo(doneLoadingArg1, &jit);
+        jit.appendFailure(jit.jump());
+    } else
+        jit.appendFailure(nonIntArg1Jump);
+
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "imul");
+}
+
+MacroAssemblerCodeRef randomThunkGenerator(VM* vm)
+{
+    SpecializedThunkJIT jit(vm, 0);
+    if (!jit.supportsFloatingPoint())
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+
+#if USE(JSVALUE64)
+    jit.emitRandomThunk(SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1, SpecializedThunkJIT::regT2, SpecializedThunkJIT::regT3, SpecializedThunkJIT::fpRegT0);
+    jit.returnDouble(SpecializedThunkJIT::fpRegT0);
+
+    return jit.finalize(vm->jitStubs->ctiNativeTailCall(vm), "random");
+#else
+    return MacroAssemblerCodeRef::createSelfManagedCodeRef(vm->jitStubs->ctiNativeCall(vm));
+#endif
+}
+
+MacroAssemblerCodeRef boundThisNoArgsFunctionCallGenerator(VM* vm)
+{
+    CCallHelpers jit(vm);
+    
+    jit.emitFunctionPrologue();
+    
+    // Set up our call frame.
+    jit.storePtr(CCallHelpers::TrustedImmPtr(nullptr), CCallHelpers::addressFor(CallFrameSlot::codeBlock));
+    jit.store32(CCallHelpers::TrustedImm32(0), CCallHelpers::tagFor(CallFrameSlot::argumentCount));
+
+    unsigned extraStackNeeded = 0;
+    if (unsigned stackMisalignment = sizeof(CallerFrameAndPC) % stackAlignmentBytes())
+        extraStackNeeded = stackAlignmentBytes() - stackMisalignment;
+    
+    // We need to forward all of the arguments that we were passed. We aren't allowed to do a tail
+    // call here as far as I can tell. At least not so long as the generic path doesn't do a tail
+    // call, since that would be way too weird.
+    
+    // The formula for the number of stack bytes needed given some number of parameters (including
+    // this) is:
+    //
+    //     stackAlign((numParams + CallFrameHeaderSize) * sizeof(Register) - sizeof(CallerFrameAndPC))
+    //
+    // Probably we want to write this as:
+    //
+    //     stackAlign((numParams + (CallFrameHeaderSize - CallerFrameAndPCSize)) * sizeof(Register))
+    //
+    // That's really all there is to this. We have all the registers we need to do it.
+    
+    jit.load32(CCallHelpers::payloadFor(CallFrameSlot::argumentCount), GPRInfo::regT1);
+    jit.add32(CCallHelpers::TrustedImm32(CallFrame::headerSizeInRegisters - CallerFrameAndPC::sizeInRegisters), GPRInfo::regT1, GPRInfo::regT2);
+    jit.lshift32(CCallHelpers::TrustedImm32(3), GPRInfo::regT2);
+    jit.add32(CCallHelpers::TrustedImm32(stackAlignmentBytes() - 1), GPRInfo::regT2);
+    jit.and32(CCallHelpers::TrustedImm32(-stackAlignmentBytes()), GPRInfo::regT2);
+    
+    if (extraStackNeeded)
+        jit.add32(CCallHelpers::TrustedImm32(extraStackNeeded), GPRInfo::regT2);
+    
+    // At this point regT1 has the actual argument count and regT2 has the amount of stack we will
+    // need.
+    
+    jit.subPtr(GPRInfo::regT2, CCallHelpers::stackPointerRegister);
+
+    // Do basic callee frame setup, including 'this'.
+    
+    jit.loadCell(CCallHelpers::addressFor(CallFrameSlot::callee), GPRInfo::regT3);
+
+    jit.store32(GPRInfo::regT1, CCallHelpers::calleeFramePayloadSlot(CallFrameSlot::argumentCount));
+    
+    JSValueRegs valueRegs = JSValueRegs::withTwoAvailableRegs(GPRInfo::regT0, GPRInfo::regT2);
+    jit.loadValue(CCallHelpers::Address(GPRInfo::regT3, JSBoundFunction::offsetOfBoundThis()), valueRegs);
+    jit.storeValue(valueRegs, CCallHelpers::calleeArgumentSlot(0));
+
+    jit.loadPtr(CCallHelpers::Address(GPRInfo::regT3, JSBoundFunction::offsetOfTargetFunction()), GPRInfo::regT3);
+    jit.storeCell(GPRInfo::regT3, CCallHelpers::calleeFrameSlot(CallFrameSlot::callee));
+    
+    // OK, now we can start copying. This is a simple matter of copying parameters from the caller's
+    // frame to the callee's frame. Note that we know that regT1 (the argument count) must be at
+    // least 1.
+    jit.sub32(CCallHelpers::TrustedImm32(1), GPRInfo::regT1);
+    CCallHelpers::Jump done = jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT1);
+    
+    CCallHelpers::Label loop = jit.label();
+    jit.sub32(CCallHelpers::TrustedImm32(1), GPRInfo::regT1);
+    jit.loadValue(CCallHelpers::addressFor(virtualRegisterForArgument(1)).indexedBy(GPRInfo::regT1, CCallHelpers::TimesEight), valueRegs);
+    jit.storeValue(valueRegs, CCallHelpers::calleeArgumentSlot(1).indexedBy(GPRInfo::regT1, CCallHelpers::TimesEight));
+    jit.branchTest32(CCallHelpers::NonZero, GPRInfo::regT1).linkTo(loop, &jit);
+    
+    done.link(&jit);
+    
+    jit.loadPtr(
+        CCallHelpers::Address(GPRInfo::regT3, JSFunction::offsetOfExecutable()),
+        GPRInfo::regT0);
+    jit.loadPtr(
+        CCallHelpers::Address(
+            GPRInfo::regT0, ExecutableBase::offsetOfJITCodeWithArityCheckFor(CodeForCall)),
+        GPRInfo::regT0);
+    CCallHelpers::Jump noCode = jit.branchTestPtr(CCallHelpers::Zero, GPRInfo::regT0);
+    
+    emitPointerValidation(jit, GPRInfo::regT0);
+    jit.call(GPRInfo::regT0);
+    
+    jit.emitFunctionEpilogue();
+    jit.ret();
+    
+    LinkBuffer linkBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    linkBuffer.link(noCode, CodeLocationLabel(vm->jitStubs->ctiNativeTailCallWithoutSavedTags(vm)));
+    return FINALIZE_CODE(
+        linkBuffer, ("Specialized thunk for bound function calls with no arguments"));
+}
+
+#if ENABLE(WEBASSEMBLY)
+MacroAssemblerCodeRef throwExceptionFromWasmThunkGenerator(VM* vm)
+{
+    CCallHelpers jit(vm);
+
+    // The thing that jumps here must move ExceptionType into the argumentGPR1 and jump here.
+    // We're allowed to use temp registers here, but not callee saves.
+    {
+        RegisterSet usedRegisters = RegisterSet::stubUnavailableRegisters();
+        usedRegisters.set(GPRInfo::argumentGPR1);
+        jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(usedRegisters);
+    }
+
+    jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    CCallHelpers::Call call = jit.call();
+    jit.jumpToExceptionHandler();
+
+    void (*throwWasmException)(ExecState*, Wasm::ExceptionType) = [] (ExecState* exec, Wasm::ExceptionType type) {
+        VM* vm = &exec->vm();
+        NativeCallFrameTracer tracer(vm, exec);
+
+        {
+            auto throwScope = DECLARE_THROW_SCOPE(*vm);
+            JSGlobalObject* globalObject = vm->topJSWebAssemblyInstance->globalObject();
+
+            JSWebAssemblyRuntimeError* error = JSWebAssemblyRuntimeError::create(
+                exec, globalObject->WebAssemblyRuntimeErrorStructure(), Wasm::errorMessageForExceptionType(type));
+            throwException(exec, throwScope, error);
+        }
+
+        genericUnwind(vm, exec);
+        ASSERT(!!vm->callFrameForCatch);
+    };
+
+    LinkBuffer linkBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    linkBuffer.link(call, throwWasmException);
+    return FINALIZE_CODE(
+        linkBuffer, ("Throw exception from Wasm"));
+}
+#endif // ENABLE(WEBASSEMBLY)
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/jit/ThunkGenerators.h b/jit/ThunkGenerators.h
new file mode 100644
index 0000000..90740c0
--- /dev/null
+++ b/jit/ThunkGenerators.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2010, 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeSpecializationKind.h"
+#include "ThunkGenerator.h"
+
+#if ENABLE(JIT)
+namespace JSC {
+
+class CallLinkInfo;
+
+MacroAssemblerCodeRef throwExceptionFromCallSlowPathGenerator(VM*);
+
+MacroAssemblerCodeRef linkCallThunk(VM*, CallLinkInfo&, CodeSpecializationKind);
+MacroAssemblerCodeRef linkCallThunkGenerator(VM*);
+MacroAssemblerCodeRef linkPolymorphicCallThunkGenerator(VM*);
+
+MacroAssemblerCodeRef virtualThunkFor(VM*, CallLinkInfo&);
+
+MacroAssemblerCodeRef nativeCallGenerator(VM*);
+MacroAssemblerCodeRef nativeConstructGenerator(VM*);
+MacroAssemblerCodeRef nativeTailCallGenerator(VM*);
+MacroAssemblerCodeRef nativeTailCallWithoutSavedTagsGenerator(VM*);
+MacroAssemblerCodeRef arityFixupGenerator(VM*);
+MacroAssemblerCodeRef unreachableGenerator(VM*);
+
+MacroAssemblerCodeRef charCodeAtThunkGenerator(VM*);
+MacroAssemblerCodeRef charAtThunkGenerator(VM*);
+MacroAssemblerCodeRef clz32ThunkGenerator(VM*);
+MacroAssemblerCodeRef fromCharCodeThunkGenerator(VM*);
+MacroAssemblerCodeRef absThunkGenerator(VM*);
+MacroAssemblerCodeRef ceilThunkGenerator(VM*);
+MacroAssemblerCodeRef expThunkGenerator(VM*);
+MacroAssemblerCodeRef floorThunkGenerator(VM*);
+MacroAssemblerCodeRef logThunkGenerator(VM*);
+MacroAssemblerCodeRef roundThunkGenerator(VM*);
+MacroAssemblerCodeRef sqrtThunkGenerator(VM*);
+MacroAssemblerCodeRef imulThunkGenerator(VM*);
+MacroAssemblerCodeRef randomThunkGenerator(VM*);
+MacroAssemblerCodeRef truncThunkGenerator(VM*);
+
+MacroAssemblerCodeRef boundThisNoArgsFunctionCallGenerator(VM*);
+
+#if ENABLE(WEBASSEMBLY)
+MacroAssemblerCodeRef throwExceptionFromWasmThunkGenerator(VM*);
+#endif
+
+}
+#endif // ENABLE(JIT)
diff --git a/jit/UnusedPointer.h b/jit/UnusedPointer.h
new file mode 100644
index 0000000..631d7d6
--- /dev/null
+++ b/jit/UnusedPointer.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+static const uintptr_t unusedPointer = 0xd1e7beef;
+
+} // namespace JSC
+
+using JSC::unusedPointer;
diff --git a/jsc.cpp b/jsc.cpp
new file mode 100644
index 0000000..b207cda
--- /dev/null
+++ b/jsc.cpp
@@ -0,0 +1,3716 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004-2017 Apple Inc. All rights reserved.
+ *  Copyright (C) 2006 Bjoern Graf (bjoern.graf@gmail.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#include "ArrayBuffer.h"
+#include "ArrayPrototype.h"
+#include "BuiltinExecutableCreator.h"
+#include "ButterflyInlines.h"
+#include "CodeBlock.h"
+#include "Completion.h"
+#include "DOMJITGetterSetter.h"
+#include "DOMJITPatchpoint.h"
+#include "DOMJITPatchpointParams.h"
+#include "Disassembler.h"
+#include "Exception.h"
+#include "ExceptionHelpers.h"
+#include "GetterSetter.h"
+#include "HeapProfiler.h"
+#include "HeapSnapshotBuilder.h"
+#include "HeapStatistics.h"
+#include "InitializeThreading.h"
+#include "Interpreter.h"
+#include "JIT.h"
+#include "JSArray.h"
+#include "JSArrayBuffer.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSInternalPromise.h"
+#include "JSInternalPromiseDeferred.h"
+#include "JSLock.h"
+#include "JSNativeStdFunction.h"
+#include "JSONObject.h"
+#include "JSProxy.h"
+#include "JSString.h"
+#include "JSTypedArrays.h"
+#include "JSWebAssemblyCallee.h"
+#include "LLIntData.h"
+#include "LLIntThunks.h"
+#include "ObjectConstructor.h"
+#include "ParserError.h"
+#include "ProfilerDatabase.h"
+#include "ProtoCallFrame.h"
+#include "ReleaseHeapAccessScope.h"
+#include "SamplingProfiler.h"
+#include "ShadowChicken.h"
+#include "StackVisitor.h"
+#include "StructureInlines.h"
+#include "StructureRareDataInlines.h"
+#include "SuperSampler.h"
+#include "TestRunnerUtils.h"
+#include "TypeProfilerLog.h"
+#include "WasmPlan.h"
+#include "WasmMemory.h"
+#include <locale.h>
+#include <math.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <thread>
+#include <type_traits>
+#include <wtf/CommaPrinter.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/MainThread.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/StringPrintStream.h>
+#include <wtf/text/StringBuilder.h>
+
+#if OS(WINDOWS)
+#include <direct.h>
+#else
+#include <unistd.h>
+#endif
+
+#if HAVE(READLINE)
+// readline/history.h has a Function typedef which conflicts with the WTF::Function template from WTF/Forward.h
+// We #define it to something else to avoid this conflict.
+#define Function ReadlineFunction
+#include <readline/history.h>
+#include <readline/readline.h>
+#undef Function
+#endif
+
+#if HAVE(SYS_TIME_H)
+#include <sys/time.h>
+#endif
+
+#if HAVE(SIGNAL_H)
+#include <signal.h>
+#endif
+
+#if COMPILER(MSVC)
+#include <crtdbg.h>
+#include <mmsystem.h>
+#include <windows.h>
+#endif
+
+#if PLATFORM(IOS) && CPU(ARM_THUMB2)
+#include <fenv.h>
+#include <arm/arch.h>
+#endif
+
+#if PLATFORM(EFL)
+#include <Ecore.h>
+#endif
+
+#if !defined(PATH_MAX)
+#define PATH_MAX 4096
+#endif
+
+using namespace JSC;
+using namespace WTF;
+
+namespace {
+
+NO_RETURN_WITH_VALUE static void jscExit(int status)
+{
+    waitForAsynchronousDisassembly();
+    
+#if ENABLE(DFG_JIT)
+    if (DFG::isCrashing()) {
+        for (;;) {
+#if OS(WINDOWS)
+            Sleep(1000);
+#else
+            pause();
+#endif
+        }
+    }
+#endif // ENABLE(DFG_JIT)
+    exit(status);
+}
+
+class Element;
+class ElementHandleOwner;
+class Masuqerader;
+class Root;
+class RuntimeArray;
+
+class Element : public JSNonFinalObject {
+public:
+    Element(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    typedef JSNonFinalObject Base;
+
+    Root* root() const { return m_root.get(); }
+    void setRoot(VM& vm, Root* root) { m_root.set(vm, this, root); }
+
+    static Element* create(VM& vm, JSGlobalObject* globalObject, Root* root)
+    {
+        Structure* structure = createStructure(vm, globalObject, jsNull());
+        Element* element = new (NotNull, allocateCell<Element>(vm.heap, sizeof(Element))) Element(vm, structure);
+        element->finishCreation(vm, root);
+        return element;
+    }
+
+    void finishCreation(VM&, Root*);
+
+    static void visitChildren(JSCell* cell, SlotVisitor& visitor)
+    {
+        Element* thisObject = jsCast<Element*>(cell);
+        ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+        Base::visitChildren(thisObject, visitor);
+        visitor.append(thisObject->m_root);
+    }
+
+    static ElementHandleOwner* handleOwner();
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+private:
+    WriteBarrier<Root> m_root;
+};
+
+class ElementHandleOwner : public WeakHandleOwner {
+public:
+    bool isReachableFromOpaqueRoots(Handle<JSC::Unknown> handle, void*, SlotVisitor& visitor) override
+    {
+        Element* element = jsCast<Element*>(handle.slot()->asCell());
+        return visitor.containsOpaqueRoot(element->root());
+    }
+};
+
+class Masquerader : public JSNonFinalObject {
+public:
+    Masquerader(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | JSC::MasqueradesAsUndefined;
+
+    static Masquerader* create(VM& vm, JSGlobalObject* globalObject)
+    {
+        globalObject->masqueradesAsUndefinedWatchpoint()->fireAll(vm, "Masquerading object allocated");
+        Structure* structure = createStructure(vm, globalObject, jsNull());
+        Masquerader* result = new (NotNull, allocateCell<Masquerader>(vm.heap, sizeof(Masquerader))) Masquerader(vm, structure);
+        result->finishCreation(vm);
+        return result;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+};
+
+class Root : public JSDestructibleObject {
+public:
+    Root(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    Element* element()
+    {
+        return m_element.get();
+    }
+
+    void setElement(Element* element)
+    {
+        Weak<Element> newElement(element, Element::handleOwner());
+        m_element.swap(newElement);
+    }
+
+    static Root* create(VM& vm, JSGlobalObject* globalObject)
+    {
+        Structure* structure = createStructure(vm, globalObject, jsNull());
+        Root* root = new (NotNull, allocateCell<Root>(vm.heap, sizeof(Root))) Root(vm, structure);
+        root->finishCreation(vm);
+        return root;
+    }
+
+    typedef JSDestructibleObject Base;
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static void visitChildren(JSCell* thisObject, SlotVisitor& visitor)
+    {
+        Base::visitChildren(thisObject, visitor);
+        visitor.addOpaqueRoot(thisObject);
+    }
+
+private:
+    Weak<Element> m_element;
+};
+
+class ImpureGetter : public JSNonFinalObject {
+public:
+    ImpureGetter(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    DECLARE_INFO;
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | JSC::GetOwnPropertySlotIsImpure | JSC::OverridesGetOwnPropertySlot;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static ImpureGetter* create(VM& vm, Structure* structure, JSObject* delegate)
+    {
+        ImpureGetter* getter = new (NotNull, allocateCell<ImpureGetter>(vm.heap, sizeof(ImpureGetter))) ImpureGetter(vm, structure);
+        getter->finishCreation(vm, delegate);
+        return getter;
+    }
+
+    void finishCreation(VM& vm, JSObject* delegate)
+    {
+        Base::finishCreation(vm);
+        if (delegate)
+            m_delegate.set(vm, this, delegate);
+    }
+
+    static bool getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName name, PropertySlot& slot)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        ImpureGetter* thisObject = jsCast<ImpureGetter*>(object);
+        
+        if (thisObject->m_delegate) {
+            if (thisObject->m_delegate->getPropertySlot(exec, name, slot))
+                return true;
+            RETURN_IF_EXCEPTION(scope, false);
+        }
+
+        return Base::getOwnPropertySlot(object, exec, name, slot);
+    }
+
+    static void visitChildren(JSCell* cell, SlotVisitor& visitor)
+    {
+        Base::visitChildren(cell, visitor);
+        ImpureGetter* thisObject = jsCast<ImpureGetter*>(cell);
+        visitor.append(thisObject->m_delegate);
+    }
+
+    void setDelegate(VM& vm, JSObject* delegate)
+    {
+        m_delegate.set(vm, this, delegate);
+    }
+
+private:
+    WriteBarrier<JSObject> m_delegate;
+};
+
+class CustomGetter : public JSNonFinalObject {
+public:
+    CustomGetter(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    DECLARE_INFO;
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | JSC::OverridesGetOwnPropertySlot;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static CustomGetter* create(VM& vm, Structure* structure)
+    {
+        CustomGetter* getter = new (NotNull, allocateCell<CustomGetter>(vm.heap, sizeof(CustomGetter))) CustomGetter(vm, structure);
+        getter->finishCreation(vm);
+        return getter;
+    }
+
+    static bool getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+    {
+        CustomGetter* thisObject = jsCast<CustomGetter*>(object);
+        if (propertyName == PropertyName(Identifier::fromString(exec, "customGetter"))) {
+            slot.setCacheableCustom(thisObject, DontDelete | ReadOnly | DontEnum, thisObject->customGetter);
+            return true;
+        }
+        return JSObject::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+    }
+
+private:
+    static EncodedJSValue customGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        CustomGetter* thisObject = jsDynamicCast<CustomGetter*>(JSValue::decode(thisValue));
+        if (!thisObject)
+            return throwVMTypeError(exec, scope);
+        bool shouldThrow = thisObject->get(exec, PropertyName(Identifier::fromString(exec, "shouldThrow"))).toBoolean(exec);
+        if (shouldThrow)
+            return throwVMTypeError(exec, scope);
+        return JSValue::encode(jsNumber(100));
+    }
+};
+
+class RuntimeArray : public JSArray {
+public:
+    typedef JSArray Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
+
+    static RuntimeArray* create(ExecState* exec)
+    {
+        VM& vm = exec->vm();
+        JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+        Structure* structure = createStructure(vm, globalObject, createPrototype(vm, globalObject));
+        RuntimeArray* runtimeArray = new (NotNull, allocateCell<RuntimeArray>(*exec->heap())) RuntimeArray(exec, structure);
+        runtimeArray->finishCreation(exec);
+        vm.heap.addFinalizer(runtimeArray, destroy);
+        return runtimeArray;
+    }
+
+    ~RuntimeArray() { }
+
+    static void destroy(JSCell* cell)
+    {
+        static_cast<RuntimeArray*>(cell)->RuntimeArray::~RuntimeArray();
+    }
+
+    static const bool needsDestruction = false;
+
+    static bool getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+    {
+        RuntimeArray* thisObject = jsCast<RuntimeArray*>(object);
+        if (propertyName == exec->propertyNames().length) {
+            slot.setCacheableCustom(thisObject, DontDelete | ReadOnly | DontEnum, thisObject->lengthGetter);
+            return true;
+        }
+
+        std::optional<uint32_t> index = parseIndex(propertyName);
+        if (index && index.value() < thisObject->getLength()) {
+            slot.setValue(thisObject, DontDelete | DontEnum, jsNumber(thisObject->m_vector[index.value()]));
+            return true;
+        }
+
+        return JSObject::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+    }
+
+    static bool getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned index, PropertySlot& slot)
+    {
+        RuntimeArray* thisObject = jsCast<RuntimeArray*>(object);
+        if (index < thisObject->getLength()) {
+            slot.setValue(thisObject, DontDelete | DontEnum, jsNumber(thisObject->m_vector[index]));
+            return true;
+        }
+
+        return JSObject::getOwnPropertySlotByIndex(thisObject, exec, index, slot);
+    }
+
+    static NO_RETURN_DUE_TO_CRASH bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&)
+    {
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    static NO_RETURN_DUE_TO_CRASH bool deleteProperty(JSCell*, ExecState*, PropertyName)
+    {
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    unsigned getLength() const { return m_vector.size(); }
+
+    DECLARE_INFO;
+
+    static ArrayPrototype* createPrototype(VM&, JSGlobalObject* globalObject)
+    {
+        return globalObject->arrayPrototype();
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(DerivedArrayType, StructureFlags), info(), ArrayClass);
+    }
+
+protected:
+    void finishCreation(ExecState* exec)
+    {
+        Base::finishCreation(exec->vm());
+        ASSERT(inherits(info()));
+
+        for (size_t i = 0; i < exec->argumentCount(); i++)
+            m_vector.append(exec->argument(i).toInt32(exec));
+    }
+
+private:
+    RuntimeArray(ExecState* exec, Structure* structure)
+        : JSArray(exec->vm(), structure, 0)
+    {
+    }
+
+    static EncodedJSValue lengthGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        RuntimeArray* thisObject = jsDynamicCast<RuntimeArray*>(JSValue::decode(thisValue));
+        if (!thisObject)
+            return throwVMTypeError(exec, scope);
+        return JSValue::encode(jsNumber(thisObject->getLength()));
+    }
+
+    Vector<int> m_vector;
+};
+
+class SimpleObject : public JSNonFinalObject {
+public:
+    SimpleObject(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    typedef JSNonFinalObject Base;
+    static const bool needsDestruction = false;
+
+    static SimpleObject* create(VM& vm, JSGlobalObject* globalObject)
+    {
+        Structure* structure = createStructure(vm, globalObject, jsNull());
+        SimpleObject* simpleObject = new (NotNull, allocateCell<SimpleObject>(vm.heap, sizeof(SimpleObject))) SimpleObject(vm, structure);
+        simpleObject->finishCreation(vm);
+        return simpleObject;
+    }
+
+    static void visitChildren(JSCell* cell, SlotVisitor& visitor)
+    {
+        SimpleObject* thisObject = jsCast<SimpleObject*>(cell);
+        ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+        Base::visitChildren(thisObject, visitor);
+        visitor.append(thisObject->m_hiddenValue);
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    JSValue hiddenValue()
+    {
+        return m_hiddenValue.get();
+    }
+
+    void setHiddenValue(VM& vm, JSValue value)
+    {
+        ASSERT(value.isCell());
+        m_hiddenValue.set(vm, this, value);
+    }
+
+    DECLARE_INFO;
+
+private:
+    WriteBarrier<JSC::Unknown> m_hiddenValue;
+};
+
+class DOMJITNode : public JSNonFinalObject {
+public:
+    DOMJITNode(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    DECLARE_INFO;
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSC::JSType(LastJSCObjectType + 1), StructureFlags), info());
+    }
+
+#if ENABLE(JIT)
+    static Ref<DOMJIT::Patchpoint> checkDOMJITNode()
+    {
+        Ref<DOMJIT::Patchpoint> patchpoint = DOMJIT::Patchpoint::create();
+        patchpoint->setGenerator([=](CCallHelpers& jit, DOMJIT::PatchpointParams& params) {
+            CCallHelpers::JumpList failureCases;
+            failureCases.append(jit.branch8(
+                CCallHelpers::NotEqual,
+                CCallHelpers::Address(params[0].gpr(), JSCell::typeInfoTypeOffset()),
+                CCallHelpers::TrustedImm32(JSC::JSType(LastJSCObjectType + 1))));
+            return failureCases;
+        });
+        return patchpoint;
+    }
+#endif
+
+    static DOMJITNode* create(VM& vm, Structure* structure)
+    {
+        DOMJITNode* getter = new (NotNull, allocateCell<DOMJITNode>(vm.heap, sizeof(DOMJITNode))) DOMJITNode(vm, structure);
+        getter->finishCreation(vm);
+        return getter;
+    }
+
+    int32_t value() const
+    {
+        return m_value;
+    }
+
+    static ptrdiff_t offsetOfValue() { return OBJECT_OFFSETOF(DOMJITNode, m_value); }
+
+private:
+    int32_t m_value { 42 };
+};
+
+class DOMJITGetter : public DOMJITNode {
+public:
+    DOMJITGetter(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    DECLARE_INFO;
+    typedef DOMJITNode Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSC::JSType(LastJSCObjectType + 1), StructureFlags), info());
+    }
+
+    static DOMJITGetter* create(VM& vm, Structure* structure)
+    {
+        DOMJITGetter* getter = new (NotNull, allocateCell<DOMJITGetter>(vm.heap, sizeof(DOMJITGetter))) DOMJITGetter(vm, structure);
+        getter->finishCreation(vm);
+        return getter;
+    }
+
+    class DOMJITNodeDOMJIT : public DOMJIT::GetterSetter {
+    public:
+        DOMJITNodeDOMJIT()
+            : DOMJIT::GetterSetter(DOMJITGetter::customGetter, nullptr, DOMJITNode::info(), SpecInt32Only)
+        {
+        }
+
+#if ENABLE(JIT)
+        Ref<DOMJIT::Patchpoint> checkDOM() override
+        {
+            return DOMJITNode::checkDOMJITNode();
+        }
+
+        static EncodedJSValue JIT_OPERATION slowCall(ExecState* exec, void* pointer)
+        {
+            NativeCallFrameTracer tracer(&exec->vm(), exec);
+            return JSValue::encode(jsNumber(static_cast<DOMJITGetter*>(pointer)->value()));
+        }
+
+        Ref<DOMJIT::CallDOMGetterPatchpoint> callDOMGetter() override
+        {
+            Ref<DOMJIT::CallDOMGetterPatchpoint> patchpoint = DOMJIT::CallDOMGetterPatchpoint::create();
+            patchpoint->requireGlobalObject = false;
+            patchpoint->setGenerator([=](CCallHelpers& jit, DOMJIT::PatchpointParams& params) {
+                JSValueRegs results = params[0].jsValueRegs();
+                GPRReg dom = params[1].gpr();
+                params.addSlowPathCall(jit.jump(), jit, slowCall, results, dom);
+                return CCallHelpers::JumpList();
+
+            });
+            return patchpoint;
+        }
+#endif
+    };
+
+    static DOMJIT::GetterSetter* domJITNodeGetterSetter()
+    {
+        static NeverDestroyed<DOMJITNodeDOMJIT> graph;
+        return &graph.get();
+    }
+
+private:
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        DOMJIT::GetterSetter* domJIT = domJITNodeGetterSetter();
+        CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, domJIT->getter(), domJIT->setter(), domJIT);
+        putDirectCustomAccessor(vm, Identifier::fromString(&vm, "customGetter"), customGetterSetter, ReadOnly | CustomAccessor);
+    }
+
+    static EncodedJSValue customGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        DOMJITNode* thisObject = jsDynamicCast<DOMJITNode*>(JSValue::decode(thisValue));
+        if (!thisObject)
+            return throwVMTypeError(exec, scope);
+        return JSValue::encode(jsNumber(thisObject->value()));
+    }
+};
+
+class DOMJITGetterComplex : public DOMJITNode {
+public:
+    DOMJITGetterComplex(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    DECLARE_INFO;
+    typedef DOMJITNode Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSC::JSType(LastJSCObjectType + 1), StructureFlags), info());
+    }
+
+    static DOMJITGetterComplex* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        DOMJITGetterComplex* getter = new (NotNull, allocateCell<DOMJITGetterComplex>(vm.heap, sizeof(DOMJITGetterComplex))) DOMJITGetterComplex(vm, structure);
+        getter->finishCreation(vm, globalObject);
+        return getter;
+    }
+
+    class DOMJITNodeDOMJIT : public DOMJIT::GetterSetter {
+    public:
+        DOMJITNodeDOMJIT()
+            : DOMJIT::GetterSetter(DOMJITGetterComplex::customGetter, nullptr, DOMJITNode::info(), SpecInt32Only)
+        {
+        }
+
+#if ENABLE(JIT)
+        Ref<DOMJIT::Patchpoint> checkDOM() override
+        {
+            return DOMJITNode::checkDOMJITNode();
+        }
+
+        static EncodedJSValue JIT_OPERATION slowCall(ExecState* exec, void* pointer)
+        {
+            VM& vm = exec->vm();
+            NativeCallFrameTracer tracer(&vm, exec);
+            auto scope = DECLARE_THROW_SCOPE(vm);
+            auto* object = static_cast<DOMJITNode*>(pointer);
+            auto* domjitGetterComplex = jsDynamicCast<DOMJITGetterComplex*>(object);
+            if (domjitGetterComplex) {
+                if (domjitGetterComplex->m_enableException)
+                    return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("DOMJITGetterComplex slow call exception"))));
+            }
+            return JSValue::encode(jsNumber(object->value()));
+        }
+
+        Ref<DOMJIT::CallDOMGetterPatchpoint> callDOMGetter() override
+        {
+            RefPtr<DOMJIT::CallDOMGetterPatchpoint> patchpoint = DOMJIT::CallDOMGetterPatchpoint::create();
+            static_assert(GPRInfo::numberOfRegisters >= 4, "Number of registers should be larger or equal to 4.");
+            patchpoint->numGPScratchRegisters = GPRInfo::numberOfRegisters - 4;
+            patchpoint->numFPScratchRegisters = 3;
+            patchpoint->setGenerator([=](CCallHelpers& jit, DOMJIT::PatchpointParams& params) {
+                JSValueRegs results = params[0].jsValueRegs();
+                GPRReg domGPR = params[1].gpr();
+                for (unsigned i = 0; i < patchpoint->numGPScratchRegisters; ++i)
+                    jit.move(CCallHelpers::TrustedImm32(42), params.gpScratch(i));
+
+                params.addSlowPathCall(jit.jump(), jit, slowCall, results, domGPR);
+                return CCallHelpers::JumpList();
+
+            });
+            return *patchpoint.get();
+        }
+#endif
+    };
+
+    static DOMJIT::GetterSetter* domJITNodeGetterSetter()
+    {
+        static NeverDestroyed<DOMJITNodeDOMJIT> graph;
+        return &graph.get();
+    }
+
+private:
+    void finishCreation(VM& vm, JSGlobalObject* globalObject)
+    {
+        Base::finishCreation(vm);
+        DOMJIT::GetterSetter* domJIT = domJITNodeGetterSetter();
+        CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, domJIT->getter(), domJIT->setter(), domJIT);
+        putDirectCustomAccessor(vm, Identifier::fromString(&vm, "customGetter"), customGetterSetter, ReadOnly | CustomAccessor);
+        putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "enableException"), 0, functionEnableException, NoIntrinsic, 0);
+    }
+
+    static EncodedJSValue JSC_HOST_CALL functionEnableException(ExecState* exec)
+    {
+        auto* object = jsDynamicCast<DOMJITGetterComplex*>(exec->thisValue());
+        if (object)
+            object->m_enableException = true;
+        return JSValue::encode(jsUndefined());
+    }
+
+    static EncodedJSValue customGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        auto* thisObject = jsDynamicCast<DOMJITNode*>(JSValue::decode(thisValue));
+        if (!thisObject)
+            return throwVMTypeError(exec, scope);
+        if (auto* domjitGetterComplex = jsDynamicCast<DOMJITGetterComplex*>(JSValue::decode(thisValue))) {
+            if (domjitGetterComplex->m_enableException)
+                return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("DOMJITGetterComplex slow call exception"))));
+        }
+        return JSValue::encode(jsNumber(thisObject->value()));
+    }
+
+    bool m_enableException { false };
+};
+
+class DOMJITFunctionObject : public DOMJITNode {
+public:
+    DOMJITFunctionObject(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    DECLARE_INFO;
+    typedef DOMJITNode Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSC::JSType(LastJSCObjectType + 1), StructureFlags), info());
+    }
+
+    static DOMJITFunctionObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        DOMJITFunctionObject* object = new (NotNull, allocateCell<DOMJITFunctionObject>(vm.heap, sizeof(DOMJITFunctionObject))) DOMJITFunctionObject(vm, structure);
+        object->finishCreation(vm, globalObject);
+        return object;
+    }
+
+    static EncodedJSValue JSC_HOST_CALL safeFunction(ExecState* exec)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        DOMJITNode* thisObject = jsDynamicCast<DOMJITNode*>(exec->thisValue());
+        if (!thisObject)
+            return throwVMTypeError(exec, scope);
+        return JSValue::encode(jsNumber(thisObject->value()));
+    }
+
+#if ENABLE(JIT)
+    static EncodedJSValue JIT_OPERATION unsafeFunction(ExecState* exec, DOMJITNode* node)
+    {
+        NativeCallFrameTracer tracer(&exec->vm(), exec);
+        return JSValue::encode(jsNumber(node->value()));
+    }
+
+    static Ref<DOMJIT::Patchpoint> checkDOMJITNode()
+    {
+        static const double value = 42.0;
+        Ref<DOMJIT::Patchpoint> patchpoint = DOMJIT::Patchpoint::create();
+        patchpoint->numFPScratchRegisters = 1;
+        patchpoint->setGenerator([=](CCallHelpers& jit, DOMJIT::PatchpointParams& params) {
+            CCallHelpers::JumpList failureCases;
+            // May use scratch registers.
+            jit.loadDouble(CCallHelpers::TrustedImmPtr(&value), params.fpScratch(0));
+            failureCases.append(jit.branch8(
+                CCallHelpers::NotEqual,
+                CCallHelpers::Address(params[0].gpr(), JSCell::typeInfoTypeOffset()),
+                CCallHelpers::TrustedImm32(JSC::JSType(LastJSCObjectType + 1))));
+            return failureCases;
+        });
+        return patchpoint;
+    }
+#endif
+
+private:
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+#if ENABLE(JIT)
+static const DOMJIT::Signature DOMJITFunctionObjectSignature((uintptr_t)DOMJITFunctionObject::unsafeFunction, DOMJITFunctionObject::checkDOMJITNode, DOMJITFunctionObject::info(), DOMJIT::Effect::forRead(DOMJIT::HeapRange::top()), SpecInt32Only);
+#endif
+
+void DOMJITFunctionObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+#if ENABLE(JIT)
+    putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "func"), 0, safeFunction, NoIntrinsic, &DOMJITFunctionObjectSignature, ReadOnly);
+#else
+    putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "func"), 0, safeFunction, NoIntrinsic, nullptr, ReadOnly);
+#endif
+}
+
+
+const ClassInfo Element::s_info = { "Element", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Element) };
+const ClassInfo Masquerader::s_info = { "Masquerader", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Masquerader) };
+const ClassInfo Root::s_info = { "Root", &Base::s_info, nullptr, CREATE_METHOD_TABLE(Root) };
+const ClassInfo ImpureGetter::s_info = { "ImpureGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(ImpureGetter) };
+const ClassInfo CustomGetter::s_info = { "CustomGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(CustomGetter) };
+const ClassInfo DOMJITNode::s_info = { "DOMJITNode", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITNode) };
+const ClassInfo DOMJITGetter::s_info = { "DOMJITGetter", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITGetter) };
+const ClassInfo DOMJITGetterComplex::s_info = { "DOMJITGetterComplex", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITGetterComplex) };
+const ClassInfo DOMJITFunctionObject::s_info = { "DOMJITFunctionObject", &Base::s_info, nullptr, CREATE_METHOD_TABLE(DOMJITFunctionObject) };
+const ClassInfo RuntimeArray::s_info = { "RuntimeArray", &Base::s_info, nullptr, CREATE_METHOD_TABLE(RuntimeArray) };
+const ClassInfo SimpleObject::s_info = { "SimpleObject", &Base::s_info, nullptr, CREATE_METHOD_TABLE(SimpleObject) };
+static bool test262AsyncPassed { false };
+static bool test262AsyncTest { false };
+
+ElementHandleOwner* Element::handleOwner()
+{
+    static ElementHandleOwner* owner = 0;
+    if (!owner)
+        owner = new ElementHandleOwner();
+    return owner;
+}
+
+void Element::finishCreation(VM& vm, Root* root)
+{
+    Base::finishCreation(vm);
+    setRoot(vm, root);
+    m_root->setElement(this);
+}
+
+}
+
+static bool fillBufferWithContentsOfFile(const String& fileName, Vector<char>& buffer);
+
+class CommandLine;
+class GlobalObject;
+class Workers;
+
+template<typename Func>
+int runJSC(CommandLine, const Func&);
+static void checkException(GlobalObject*, bool isLastFile, bool hasException, JSValue, const String& uncaughtExceptionName, bool alwaysDumpUncaughtException, bool dump, bool& success);
+
+class Message : public ThreadSafeRefCounted<Message> {
+public:
+    Message(ArrayBufferContents&&, int32_t);
+    ~Message();
+    
+    ArrayBufferContents&& releaseContents() { return WTFMove(m_contents); }
+    int32_t index() const { return m_index; }
+
+private:
+    ArrayBufferContents m_contents;
+    int32_t m_index { 0 };
+};
+
+class Worker : public BasicRawSentinelNode<Worker> {
+public:
+    Worker(Workers&);
+    ~Worker();
+    
+    void enqueue(const AbstractLocker&, RefPtr<Message>);
+    RefPtr<Message> dequeue();
+    
+    static Worker& current();
+
+private:
+    static ThreadSpecific<Worker*>& currentWorker();
+
+    Workers& m_workers;
+    Deque<RefPtr<Message>> m_messages;
+};
+
+class Workers {
+public:
+    Workers();
+    ~Workers();
+    
+    template<typename Func>
+    void broadcast(const Func&);
+    
+    void report(String);
+    String tryGetReport();
+    String getReport();
+    
+    static Workers& singleton();
+    
+private:
+    friend class Worker;
+    
+    Lock m_lock;
+    Condition m_condition;
+    SentinelLinkedList<Worker, BasicRawSentinelNode<Worker>> m_workers;
+    Deque<String> m_reports;
+};
+
+static EncodedJSValue JSC_HOST_CALL functionCreateProxy(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateRuntimeArray(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateImpureGetter(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateCustomGetterObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITNodeObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterComplexObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateDOMJITFunctionObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateBuiltin(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateGlobalObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionSetImpureGetterDelegate(ExecState*);
+
+static EncodedJSValue JSC_HOST_CALL functionSetElementRoot(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateRoot(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateElement(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionGetElement(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCreateSimpleObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionGetHiddenValue(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionSetHiddenValue(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionPrintStdOut(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionPrintStdErr(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDebug(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDescribe(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDescribeArray(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionSleepSeconds(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionGCAndSweep(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionFullGC(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionEdenGC(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionForceGCSlowPaths(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionHeapSize(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionAddressOf(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionGetGetterSetter(ExecState*);
+#ifndef NDEBUG
+static EncodedJSValue JSC_HOST_CALL functionDumpCallFrame(ExecState*);
+#endif
+static EncodedJSValue JSC_HOST_CALL functionVersion(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionRun(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionRunString(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionLoad(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionLoadString(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionReadFile(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCheckSyntax(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionReadline(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionPreciseTime(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionNeverInlineFunction(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionNoDFG(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionNoFTL(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionNoOSRExitFuzzing(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionOptimizeNextInvocation(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionNumberOfDFGCompiles(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionJSCOptions(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionReoptimizationRetryCount(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionTransferArrayBuffer(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionFailNextNewCodeBlock(ExecState*);
+static NO_RETURN_WITH_VALUE EncodedJSValue JSC_HOST_CALL functionQuit(ExecState*);
+static NO_RETURN_DUE_TO_CRASH EncodedJSValue JSC_HOST_CALL functionAbort(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionFalse1(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionFalse2(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionUndefined1(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionUndefined2(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionIsInt32(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionEffectful42(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionIdentity(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionMakeMasquerader(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionHasCustomProperties(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionFindTypeForExpression(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionReturnTypeFor(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDumpBasicBlockExecutionRanges(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionHasBasicBlockExecuted(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionBasicBlockExecutionCount(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionEnableExceptionFuzz(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDrainMicrotasks(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionIs32BitPlatform(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionLoadModule(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionCheckModuleSyntax(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionPlatformSupportsSamplingProfiler(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionGenerateHeapSnapshot(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionResetSuperSamplerState(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionEnsureArrayStorage(ExecState*);
+#if ENABLE(SAMPLING_PROFILER)
+static EncodedJSValue JSC_HOST_CALL functionStartSamplingProfiler(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionSamplingProfilerStackTraces(ExecState*);
+#endif
+
+static EncodedJSValue JSC_HOST_CALL functionMaxArguments(ExecState*);
+
+#if ENABLE(WEBASSEMBLY)
+static EncodedJSValue JSC_HOST_CALL functionTestWasmModuleFunctions(ExecState*);
+#endif
+
+#if ENABLE(SAMPLING_FLAGS)
+static EncodedJSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState*);
+#endif
+
+static EncodedJSValue JSC_HOST_CALL functionShadowChickenFunctionsOnStack(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionSetGlobalConstRedeclarationShouldNotThrow(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionGetRandomSeed(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionSetRandomSeed(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionIsRope(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionGlobalObjectForObject(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarCreateRealm(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarDetachArrayBuffer(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarEvalScript(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarAgentStart(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarAgentReceiveBroadcast(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarAgentReport(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarAgentSleep(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarAgentBroadcast(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarAgentGetReport(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDollarAgentLeaving(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionWaitForReport(ExecState*);
+
+struct Script {
+    enum class StrictMode {
+        Strict,
+        Sloppy
+    };
+
+    enum class ScriptType {
+        Script,
+        Module
+    };
+
+    enum class CodeSource {
+        File,
+        CommandLine
+    };
+
+    StrictMode strictMode;
+    CodeSource codeSource;
+    ScriptType scriptType;
+    char* argument;
+
+    Script(StrictMode strictMode, CodeSource codeSource, ScriptType scriptType, char *argument)
+        : strictMode(strictMode)
+        , codeSource(codeSource)
+        , scriptType(scriptType)
+        , argument(argument)
+    {
+        if (strictMode == StrictMode::Strict)
+            ASSERT(codeSource == CodeSource::File);
+    }
+};
+
+class CommandLine {
+public:
+    CommandLine(int argc, char** argv)
+    {
+        parseArguments(argc, argv);
+    }
+
+    bool m_interactive { false };
+    bool m_dump { false };
+    bool m_module { false };
+    bool m_exitCode { false };
+    Vector<Script> m_scripts;
+    Vector<String> m_arguments;
+    bool m_profile { false };
+    String m_profilerOutput;
+    String m_uncaughtExceptionName;
+    bool m_alwaysDumpUncaughtException { false };
+    bool m_dumpSamplingProfilerData { false };
+    bool m_enableRemoteDebugging { false };
+
+    void parseArguments(int, char**);
+};
+
+static const char interactivePrompt[] = ">>> ";
+
+class StopWatch {
+public:
+    void start();
+    void stop();
+    long getElapsedMS(); // call stop() first
+
+private:
+    double m_startTime;
+    double m_stopTime;
+};
+
+void StopWatch::start()
+{
+    m_startTime = monotonicallyIncreasingTime();
+}
+
+void StopWatch::stop()
+{
+    m_stopTime = monotonicallyIncreasingTime();
+}
+
+long StopWatch::getElapsedMS()
+{
+    return static_cast<long>((m_stopTime - m_startTime) * 1000);
+}
+
+template<typename Vector>
+static inline String stringFromUTF(const Vector& utf8)
+{
+    return String::fromUTF8WithLatin1Fallback(utf8.data(), utf8.size());
+}
+
+template<typename Vector>
+static inline SourceCode jscSource(const Vector& utf8, const String& filename)
+{
+    String str = stringFromUTF(utf8);
+    return makeSource(str, filename);
+}
+
+class GlobalObject : public JSGlobalObject {
+private:
+    GlobalObject(VM&, Structure*);
+
+public:
+    typedef JSGlobalObject Base;
+
+    static GlobalObject* create(VM& vm, Structure* structure, const Vector<String>& arguments)
+    {
+        GlobalObject* object = new (NotNull, allocateCell<GlobalObject>(vm.heap)) GlobalObject(vm, structure);
+        object->finishCreation(vm, arguments);
+        vm.heap.addFinalizer(object, destroy);
+        return object;
+    }
+
+    static const bool needsDestruction = false;
+
+    DECLARE_INFO;
+    static const GlobalObjectMethodTable s_globalObjectMethodTable;
+
+    static Structure* createStructure(VM& vm, JSValue prototype)
+    {
+        return Structure::create(vm, 0, prototype, TypeInfo(GlobalObjectType, StructureFlags), info());
+    }
+
+    static RuntimeFlags javaScriptRuntimeFlags(const JSGlobalObject*) { return RuntimeFlags::createAllEnabled(); }
+
+protected:
+    void finishCreation(VM& vm, const Vector<String>& arguments)
+    {
+        Base::finishCreation(vm);
+        
+        addFunction(vm, "debug", functionDebug, 1);
+        addFunction(vm, "describe", functionDescribe, 1);
+        addFunction(vm, "describeArray", functionDescribeArray, 1);
+        addFunction(vm, "print", functionPrintStdOut, 1);
+        addFunction(vm, "printErr", functionPrintStdErr, 1);
+        addFunction(vm, "quit", functionQuit, 0);
+        addFunction(vm, "abort", functionAbort, 0);
+        addFunction(vm, "gc", functionGCAndSweep, 0);
+        addFunction(vm, "fullGC", functionFullGC, 0);
+        addFunction(vm, "edenGC", functionEdenGC, 0);
+        addFunction(vm, "forceGCSlowPaths", functionForceGCSlowPaths, 0);
+        addFunction(vm, "gcHeapSize", functionHeapSize, 0);
+        addFunction(vm, "addressOf", functionAddressOf, 1);
+        addFunction(vm, "getGetterSetter", functionGetGetterSetter, 2);
+#ifndef NDEBUG
+        addFunction(vm, "dumpCallFrame", functionDumpCallFrame, 0);
+#endif
+        addFunction(vm, "version", functionVersion, 1);
+        addFunction(vm, "run", functionRun, 1);
+        addFunction(vm, "runString", functionRunString, 1);
+        addFunction(vm, "load", functionLoad, 1);
+        addFunction(vm, "loadString", functionLoadString, 1);
+        addFunction(vm, "readFile", functionReadFile, 2);
+        addFunction(vm, "read", functionReadFile, 2);
+        addFunction(vm, "checkSyntax", functionCheckSyntax, 1);
+        addFunction(vm, "sleepSeconds", functionSleepSeconds, 1);
+        addFunction(vm, "jscStack", functionJSCStack, 1);
+        addFunction(vm, "readline", functionReadline, 0);
+        addFunction(vm, "preciseTime", functionPreciseTime, 0);
+        addFunction(vm, "neverInlineFunction", functionNeverInlineFunction, 1);
+        addFunction(vm, "noInline", functionNeverInlineFunction, 1);
+        addFunction(vm, "noDFG", functionNoDFG, 1);
+        addFunction(vm, "noFTL", functionNoFTL, 1);
+        addFunction(vm, "noOSRExitFuzzing", functionNoOSRExitFuzzing, 1);
+        addFunction(vm, "numberOfDFGCompiles", functionNumberOfDFGCompiles, 1);
+        addFunction(vm, "jscOptions", functionJSCOptions, 0);
+        addFunction(vm, "optimizeNextInvocation", functionOptimizeNextInvocation, 1);
+        addFunction(vm, "reoptimizationRetryCount", functionReoptimizationRetryCount, 1);
+        addFunction(vm, "transferArrayBuffer", functionTransferArrayBuffer, 1);
+        addFunction(vm, "failNextNewCodeBlock", functionFailNextNewCodeBlock, 1);
+#if ENABLE(SAMPLING_FLAGS)
+        addFunction(vm, "setSamplingFlags", functionSetSamplingFlags, 1);
+        addFunction(vm, "clearSamplingFlags", functionClearSamplingFlags, 1);
+#endif
+        addFunction(vm, "shadowChickenFunctionsOnStack", functionShadowChickenFunctionsOnStack, 0);
+        addFunction(vm, "setGlobalConstRedeclarationShouldNotThrow", functionSetGlobalConstRedeclarationShouldNotThrow, 0);
+        addConstructableFunction(vm, "Root", functionCreateRoot, 0);
+        addConstructableFunction(vm, "Element", functionCreateElement, 1);
+        addFunction(vm, "getElement", functionGetElement, 1);
+        addFunction(vm, "setElementRoot", functionSetElementRoot, 2);
+        
+        addConstructableFunction(vm, "SimpleObject", functionCreateSimpleObject, 0);
+        addFunction(vm, "getHiddenValue", functionGetHiddenValue, 1);
+        addFunction(vm, "setHiddenValue", functionSetHiddenValue, 2);
+        
+        putDirectNativeFunction(vm, this, Identifier::fromString(&vm, "DFGTrue"), 0, functionFalse1, DFGTrueIntrinsic, DontEnum);
+        putDirectNativeFunction(vm, this, Identifier::fromString(&vm, "OSRExit"), 0, functionUndefined1, OSRExitIntrinsic, DontEnum);
+        putDirectNativeFunction(vm, this, Identifier::fromString(&vm, "isFinalTier"), 0, functionFalse2, IsFinalTierIntrinsic, DontEnum);
+        putDirectNativeFunction(vm, this, Identifier::fromString(&vm, "predictInt32"), 0, functionUndefined2, SetInt32HeapPredictionIntrinsic, DontEnum);
+        putDirectNativeFunction(vm, this, Identifier::fromString(&vm, "isInt32"), 0, functionIsInt32, CheckInt32Intrinsic, DontEnum);
+        putDirectNativeFunction(vm, this, Identifier::fromString(&vm, "fiatInt52"), 0, functionIdentity, FiatInt52Intrinsic, DontEnum);
+        
+        addFunction(vm, "effectful42", functionEffectful42, 0);
+        addFunction(vm, "makeMasquerader", functionMakeMasquerader, 0);
+        addFunction(vm, "hasCustomProperties", functionHasCustomProperties, 0);
+
+        addFunction(vm, "createProxy", functionCreateProxy, 1);
+        addFunction(vm, "createRuntimeArray", functionCreateRuntimeArray, 0);
+
+        addFunction(vm, "createImpureGetter", functionCreateImpureGetter, 1);
+        addFunction(vm, "createCustomGetterObject", functionCreateCustomGetterObject, 0);
+        addFunction(vm, "createDOMJITNodeObject", functionCreateDOMJITNodeObject, 0);
+        addFunction(vm, "createDOMJITGetterObject", functionCreateDOMJITGetterObject, 0);
+        addFunction(vm, "createDOMJITGetterComplexObject", functionCreateDOMJITGetterComplexObject, 0);
+        addFunction(vm, "createDOMJITFunctionObject", functionCreateDOMJITFunctionObject, 0);
+        addFunction(vm, "createBuiltin", functionCreateBuiltin, 2);
+        addFunction(vm, "createGlobalObject", functionCreateGlobalObject, 0);
+        addFunction(vm, "setImpureGetterDelegate", functionSetImpureGetterDelegate, 2);
+
+        addFunction(vm, "dumpTypesForAllVariables", functionDumpTypesForAllVariables , 0);
+        addFunction(vm, "findTypeForExpression", functionFindTypeForExpression, 2);
+        addFunction(vm, "returnTypeFor", functionReturnTypeFor, 1);
+
+        addFunction(vm, "dumpBasicBlockExecutionRanges", functionDumpBasicBlockExecutionRanges , 0);
+        addFunction(vm, "hasBasicBlockExecuted", functionHasBasicBlockExecuted, 2);
+        addFunction(vm, "basicBlockExecutionCount", functionBasicBlockExecutionCount, 2);
+
+        addFunction(vm, "enableExceptionFuzz", functionEnableExceptionFuzz, 0);
+
+        addFunction(vm, "drainMicrotasks", functionDrainMicrotasks, 0);
+
+        addFunction(vm, "getRandomSeed", functionGetRandomSeed, 0);
+        addFunction(vm, "setRandomSeed", functionSetRandomSeed, 1);
+        addFunction(vm, "isRope", functionIsRope, 1);
+
+        addFunction(vm, "globalObjectForObject", functionGlobalObjectForObject, 1);
+
+        addFunction(vm, "is32BitPlatform", functionIs32BitPlatform, 0);
+
+        addFunction(vm, "loadModule", functionLoadModule, 1);
+        addFunction(vm, "checkModuleSyntax", functionCheckModuleSyntax, 1);
+
+        addFunction(vm, "platformSupportsSamplingProfiler", functionPlatformSupportsSamplingProfiler, 0);
+        addFunction(vm, "generateHeapSnapshot", functionGenerateHeapSnapshot, 0);
+        addFunction(vm, "resetSuperSamplerState", functionResetSuperSamplerState, 0);
+        addFunction(vm, "ensureArrayStorage", functionEnsureArrayStorage, 0);
+#if ENABLE(SAMPLING_PROFILER)
+        addFunction(vm, "startSamplingProfiler", functionStartSamplingProfiler, 0);
+        addFunction(vm, "samplingProfilerStackTraces", functionSamplingProfilerStackTraces, 0);
+#endif
+
+        addFunction(vm, "maxArguments", functionMaxArguments, 0);
+
+#if ENABLE(WEBASSEMBLY)
+        addFunction(vm, "testWasmModuleFunctions", functionTestWasmModuleFunctions, 0);
+#endif
+
+        if (!arguments.isEmpty()) {
+            JSArray* array = constructEmptyArray(globalExec(), 0);
+            for (size_t i = 0; i < arguments.size(); ++i)
+                array->putDirectIndex(globalExec(), i, jsString(globalExec(), arguments[i]));
+            putDirect(vm, Identifier::fromString(globalExec(), "arguments"), array);
+        }
+
+        putDirect(vm, Identifier::fromString(globalExec(), "console"), jsUndefined());
+        
+        Structure* plainObjectStructure = JSFinalObject::createStructure(vm, this, objectPrototype(), 0);
+        
+        JSObject* dollar = JSFinalObject::create(vm, plainObjectStructure);
+        putDirect(vm, Identifier::fromString(globalExec(), "$"), dollar);
+        
+        addFunction(vm, dollar, "createRealm", functionDollarCreateRealm, 0);
+        addFunction(vm, dollar, "detachArrayBuffer", functionDollarDetachArrayBuffer, 1);
+        addFunction(vm, dollar, "evalScript", functionDollarEvalScript, 1);
+        
+        dollar->putDirect(vm, Identifier::fromString(globalExec(), "global"), this);
+        
+        JSObject* agent = JSFinalObject::create(vm, plainObjectStructure);
+        dollar->putDirect(vm, Identifier::fromString(globalExec(), "agent"), agent);
+        
+        // The test262 INTERPRETING.md document says that some of these functions are just in the main
+        // thread and some are in the other threads. We just put them in all threads.
+        addFunction(vm, agent, "start", functionDollarAgentStart, 1);
+        addFunction(vm, agent, "receiveBroadcast", functionDollarAgentReceiveBroadcast, 1);
+        addFunction(vm, agent, "report", functionDollarAgentReport, 1);
+        addFunction(vm, agent, "sleep", functionDollarAgentSleep, 1);
+        addFunction(vm, agent, "broadcast", functionDollarAgentBroadcast, 1);
+        addFunction(vm, agent, "getReport", functionDollarAgentGetReport, 0);
+        addFunction(vm, agent, "leaving", functionDollarAgentLeaving, 0);
+        
+        addFunction(vm, "waitForReport", functionWaitForReport, 0);
+    }
+    
+    void addFunction(VM& vm, JSObject* object, const char* name, NativeFunction function, unsigned arguments)
+    {
+        Identifier identifier = Identifier::fromString(&vm, name);
+        object->putDirect(vm, identifier, JSFunction::create(vm, this, arguments, identifier.string(), function));
+    }
+
+    void addFunction(VM& vm, const char* name, NativeFunction function, unsigned arguments)
+    {
+        addFunction(vm, this, name, function, arguments);
+    }
+    
+    void addConstructableFunction(VM& vm, const char* name, NativeFunction function, unsigned arguments)
+    {
+        Identifier identifier = Identifier::fromString(&vm, name);
+        putDirect(vm, identifier, JSFunction::create(vm, this, arguments, identifier.string(), function, NoIntrinsic, function));
+    }
+
+    static JSInternalPromise* moduleLoaderResolve(JSGlobalObject*, ExecState*, JSModuleLoader*, JSValue, JSValue, JSValue);
+    static JSInternalPromise* moduleLoaderFetch(JSGlobalObject*, ExecState*, JSModuleLoader*, JSValue, JSValue);
+};
+
+const ClassInfo GlobalObject::s_info = { "global", &JSGlobalObject::s_info, nullptr, CREATE_METHOD_TABLE(GlobalObject) };
+const GlobalObjectMethodTable GlobalObject::s_globalObjectMethodTable = {
+    &supportsRichSourceInfo,
+    &shouldInterruptScript,
+    &javaScriptRuntimeFlags,
+    nullptr,
+    &shouldInterruptScriptBeforeTimeout,
+    &moduleLoaderResolve,
+    &moduleLoaderFetch,
+    nullptr,
+    nullptr,
+    nullptr
+};
+
+GlobalObject::GlobalObject(VM& vm, Structure* structure)
+    : JSGlobalObject(vm, structure, &s_globalObjectMethodTable)
+{
+}
+
+static UChar pathSeparator()
+{
+#if OS(WINDOWS)
+    return '\\';
+#else
+    return '/';
+#endif
+}
+
+struct DirectoryName {
+    // In unix, it is "/". In Windows, it becomes a drive letter like "C:\"
+    String rootName;
+
+    // If the directory name is "/home/WebKit", this becomes "home/WebKit". If the directory name is "/", this becomes "".
+    String queryName;
+};
+
+struct ModuleName {
+    ModuleName(const String& moduleName);
+
+    bool startsWithRoot() const
+    {
+        return !queries.isEmpty() && queries[0].isEmpty();
+    }
+
+    Vector<String> queries;
+};
+
+ModuleName::ModuleName(const String& moduleName)
+{
+    // A module name given from code is represented as the UNIX style path. Like, `./A/B.js`.
+    moduleName.split('/', true, queries);
+}
+
+static bool extractDirectoryName(const String& absolutePathToFile, DirectoryName& directoryName)
+{
+    size_t firstSeparatorPosition = absolutePathToFile.find(pathSeparator());
+    if (firstSeparatorPosition == notFound)
+        return false;
+    directoryName.rootName = absolutePathToFile.substring(0, firstSeparatorPosition + 1); // Include the separator.
+    size_t lastSeparatorPosition = absolutePathToFile.reverseFind(pathSeparator());
+    ASSERT_WITH_MESSAGE(lastSeparatorPosition != notFound, "If the separator is not found, this function already returns when performing the forward search.");
+    if (firstSeparatorPosition == lastSeparatorPosition)
+        directoryName.queryName = StringImpl::empty();
+    else {
+        size_t queryStartPosition = firstSeparatorPosition + 1;
+        size_t queryLength = lastSeparatorPosition - queryStartPosition; // Not include the last separator.
+        directoryName.queryName = absolutePathToFile.substring(queryStartPosition, queryLength);
+    }
+    return true;
+}
+
+static bool currentWorkingDirectory(DirectoryName& directoryName)
+{
+#if OS(WINDOWS)
+    // https://msdn.microsoft.com/en-us/library/windows/desktop/aa364934.aspx
+    // https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247.aspx#maxpath
+    // The _MAX_PATH in Windows is 260. If the path of the current working directory is longer than that, _getcwd truncates the result.
+    // And other I/O functions taking a path name also truncate it. To avoid this situation,
+    //
+    // (1). When opening the file in Windows for modules, we always use the abosolute path and add "\\?\" prefix to the path name.
+    // (2). When retrieving the current working directory, use GetCurrentDirectory instead of _getcwd.
+    //
+    // In the path utility functions inside the JSC shell, we does not handle the UNC and UNCW including the network host name.
+    DWORD bufferLength = ::GetCurrentDirectoryW(0, nullptr);
+    if (!bufferLength)
+        return false;
+    // In Windows, wchar_t is the UTF-16LE.
+    // https://msdn.microsoft.com/en-us/library/dd374081.aspx
+    // https://msdn.microsoft.com/en-us/library/windows/desktop/ff381407.aspx
+    auto buffer = std::make_unique<wchar_t[]>(bufferLength);
+    DWORD lengthNotIncludingNull = ::GetCurrentDirectoryW(bufferLength, buffer.get());
+    static_assert(sizeof(wchar_t) == sizeof(UChar), "In Windows, both are UTF-16LE");
+    String directoryString = String(reinterpret_cast<UChar*>(buffer.get()));
+    // We don't support network path like \\host\share\<path name>.
+    if (directoryString.startsWith("\\\\"))
+        return false;
+#else
+    auto buffer = std::make_unique<char[]>(PATH_MAX);
+    if (!getcwd(buffer.get(), PATH_MAX))
+        return false;
+    String directoryString = String::fromUTF8(buffer.get());
+#endif
+    if (directoryString.isEmpty())
+        return false;
+
+    if (directoryString[directoryString.length() - 1] == pathSeparator())
+        return extractDirectoryName(directoryString, directoryName);
+    // Append the seperator to represents the file name. extractDirectoryName only accepts the absolute file name.
+    return extractDirectoryName(makeString(directoryString, pathSeparator()), directoryName);
+}
+
+static String resolvePath(const DirectoryName& directoryName, const ModuleName& moduleName)
+{
+    Vector<String> directoryPieces;
+    directoryName.queryName.split(pathSeparator(), false, directoryPieces);
+
+    // Only first '/' is recognized as the path from the root.
+    if (moduleName.startsWithRoot())
+        directoryPieces.clear();
+
+    for (const auto& query : moduleName.queries) {
+        if (query == String(ASCIILiteral(".."))) {
+            if (!directoryPieces.isEmpty())
+                directoryPieces.removeLast();
+        } else if (!query.isEmpty() && query != String(ASCIILiteral(".")))
+            directoryPieces.append(query);
+    }
+
+    StringBuilder builder;
+    builder.append(directoryName.rootName);
+    for (size_t i = 0; i < directoryPieces.size(); ++i) {
+        builder.append(directoryPieces[i]);
+        if (i + 1 != directoryPieces.size())
+            builder.append(pathSeparator());
+    }
+    return builder.toString();
+}
+
+JSInternalPromise* GlobalObject::moduleLoaderResolve(JSGlobalObject* globalObject, ExecState* exec, JSModuleLoader*, JSValue keyValue, JSValue referrerValue, JSValue)
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    const Identifier key = keyValue.toPropertyKey(exec);
+    if (UNLIKELY(scope.exception())) {
+        JSValue exception = scope.exception();
+        scope.clearException();
+        return deferred->reject(exec, exception);
+    }
+
+    if (key.isSymbol())
+        return deferred->resolve(exec, keyValue);
+
+    DirectoryName directoryName;
+    if (referrerValue.isUndefined()) {
+        if (!currentWorkingDirectory(directoryName))
+            return deferred->reject(exec, createError(exec, ASCIILiteral("Could not resolve the current working directory.")));
+    } else {
+        const Identifier referrer = referrerValue.toPropertyKey(exec);
+        if (UNLIKELY(scope.exception())) {
+            JSValue exception = scope.exception();
+            scope.clearException();
+            return deferred->reject(exec, exception);
+        }
+        if (referrer.isSymbol()) {
+            if (!currentWorkingDirectory(directoryName))
+                return deferred->reject(exec, createError(exec, ASCIILiteral("Could not resolve the current working directory.")));
+        } else {
+            // If the referrer exists, we assume that the referrer is the correct absolute path.
+            if (!extractDirectoryName(referrer.impl(), directoryName))
+                return deferred->reject(exec, createError(exec, makeString("Could not resolve the referrer name '", String(referrer.impl()), "'.")));
+        }
+    }
+
+    return deferred->resolve(exec, jsString(exec, resolvePath(directoryName, ModuleName(key.impl()))));
+}
+
+static void convertShebangToJSComment(Vector<char>& buffer)
+{
+    if (buffer.size() >= 2) {
+        if (buffer[0] == '#' && buffer[1] == '!')
+            buffer[0] = buffer[1] = '/';
+    }
+}
+
+static bool fillBufferWithContentsOfFile(FILE* file, Vector<char>& buffer)
+{
+    // We might have injected "use strict"; at the top.
+    size_t initialSize = buffer.size();
+    fseek(file, 0, SEEK_END);
+    size_t bufferCapacity = ftell(file);
+    fseek(file, 0, SEEK_SET);
+    buffer.resize(bufferCapacity + initialSize);
+    size_t readSize = fread(buffer.data() + initialSize, 1, buffer.size(), file);
+    return readSize == buffer.size() - initialSize;
+}
+
+static bool fillBufferWithContentsOfFile(const String& fileName, Vector<char>& buffer)
+{
+    FILE* f = fopen(fileName.utf8().data(), "rb");
+    if (!f) {
+        fprintf(stderr, "Could not open file: %s\n", fileName.utf8().data());
+        return false;
+    }
+
+    bool result = fillBufferWithContentsOfFile(f, buffer);
+    fclose(f);
+
+    return result;
+}
+
+static bool fetchScriptFromLocalFileSystem(const String& fileName, Vector<char>& buffer)
+{
+    if (!fillBufferWithContentsOfFile(fileName, buffer))
+        return false;
+    convertShebangToJSComment(buffer);
+    return true;
+}
+
+static bool fetchModuleFromLocalFileSystem(const String& fileName, Vector<char>& buffer)
+{
+    // We assume that fileName is always an absolute path.
+#if OS(WINDOWS)
+    // https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247.aspx#maxpath
+    // Use long UNC to pass the long path name to the Windows APIs.
+    String longUNCPathName = WTF::makeString("\\\\?\\", fileName);
+    static_assert(sizeof(wchar_t) == sizeof(UChar), "In Windows, both are UTF-16LE");
+    auto utf16Vector = longUNCPathName.charactersWithNullTermination();
+    FILE* f = _wfopen(reinterpret_cast<wchar_t*>(utf16Vector.data()), L"rb");
+#else
+    FILE* f = fopen(fileName.utf8().data(), "r");
+#endif
+    if (!f) {
+        fprintf(stderr, "Could not open file: %s\n", fileName.utf8().data());
+        return false;
+    }
+
+    bool result = fillBufferWithContentsOfFile(f, buffer);
+    if (result)
+        convertShebangToJSComment(buffer);
+    fclose(f);
+
+    return result;
+}
+
+JSInternalPromise* GlobalObject::moduleLoaderFetch(JSGlobalObject* globalObject, ExecState* exec, JSModuleLoader*, JSValue key, JSValue)
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    String moduleKey = key.toWTFString(exec);
+    if (UNLIKELY(scope.exception())) {
+        JSValue exception = scope.exception();
+        scope.clearException();
+        return deferred->reject(exec, exception);
+    }
+
+    // Here, now we consider moduleKey as the fileName.
+    Vector<char> utf8;
+    if (!fetchModuleFromLocalFileSystem(moduleKey, utf8))
+        return deferred->reject(exec, createError(exec, makeString("Could not open file '", moduleKey, "'.")));
+
+    return deferred->resolve(exec, jsString(exec, stringFromUTF(utf8)));
+}
+
+
+static EncodedJSValue printInternal(ExecState* exec, FILE* out)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (test262AsyncTest) {
+        JSValue value = exec->argument(0);
+        if (value.isString() && WTF::equal(asString(value)->value(exec).impl(), "Test262:AsyncTestComplete"))
+            test262AsyncPassed = true;
+        return JSValue::encode(jsUndefined());
+    }
+
+    for (unsigned i = 0; i < exec->argumentCount(); ++i) {
+        if (i)
+            if (EOF == fputc(' ', out))
+                goto fail;
+
+        auto viewWithString = exec->uncheckedArgument(i).toString(exec)->viewWithUnderlyingString(*exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (fprintf(out, "%s", viewWithString.view.utf8().data()) < 0)
+            goto fail;
+    }
+
+    fputc('\n', out);
+fail:
+    fflush(out);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionPrintStdOut(ExecState* exec) { return printInternal(exec, stdout); }
+EncodedJSValue JSC_HOST_CALL functionPrintStdErr(ExecState* exec) { return printInternal(exec, stderr); }
+
+#ifndef NDEBUG
+EncodedJSValue JSC_HOST_CALL functionDumpCallFrame(ExecState* exec)
+{
+    VMEntryFrame* topVMEntryFrame = exec->vm().topVMEntryFrame;
+    ExecState* callerFrame = exec->callerFrame(topVMEntryFrame);
+    if (callerFrame)
+        exec->vm().interpreter->dumpCallFrame(callerFrame);
+    return JSValue::encode(jsUndefined());
+}
+#endif
+
+EncodedJSValue JSC_HOST_CALL functionDebug(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    auto viewWithString = exec->argument(0).toString(exec)->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    fprintf(stderr, "--> %s\n", viewWithString.view.utf8().data());
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionDescribe(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(jsString(exec, toString(exec->argument(0))));
+}
+
+EncodedJSValue JSC_HOST_CALL functionDescribeArray(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return JSValue::encode(jsUndefined());
+    JSObject* object = jsDynamicCast<JSObject*>(exec->argument(0));
+    if (!object)
+        return JSValue::encode(jsNontrivialString(exec, ASCIILiteral("<not object>")));
+    return JSValue::encode(jsNontrivialString(exec, toString("<Butterfly: ", RawPointer(object->butterfly()), "; public length: ", object->getArrayLength(), "; vector length: ", object->getVectorLength(), ">")));
+}
+
+EncodedJSValue JSC_HOST_CALL functionSleepSeconds(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (exec->argumentCount() >= 1) {
+        Seconds seconds = Seconds(exec->argument(0).toNumber(exec));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        sleep(seconds);
+    }
+    
+    return JSValue::encode(jsUndefined());
+}
+
+class FunctionJSCStackFunctor {
+public:
+    FunctionJSCStackFunctor(StringBuilder& trace)
+        : m_trace(trace)
+    {
+    }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        m_trace.append(String::format("    %zu   %s\n", visitor->index(), visitor->toString().utf8().data()));
+        return StackVisitor::Continue;
+    }
+
+private:
+    StringBuilder& m_trace;
+};
+
+EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState* exec)
+{
+    StringBuilder trace;
+    trace.appendLiteral("--> Stack trace:\n");
+
+    FunctionJSCStackFunctor functor(trace);
+    exec->iterate(functor);
+    fprintf(stderr, "%s", trace.toString().utf8().data());
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateRoot(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    return JSValue::encode(Root::create(exec->vm(), exec->lexicalGlobalObject()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateElement(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Root* root = jsDynamicCast<Root*>(exec->argument(0));
+    if (!root)
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Cannot create Element without a Root."))));
+    return JSValue::encode(Element::create(vm, exec->lexicalGlobalObject(), root));
+}
+
+EncodedJSValue JSC_HOST_CALL functionGetElement(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    Root* root = jsDynamicCast<Root*>(exec->argument(0));
+    if (!root)
+        return JSValue::encode(jsUndefined());
+    Element* result = root->element();
+    return JSValue::encode(result ? result : jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionSetElementRoot(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    Element* element = jsDynamicCast<Element*>(exec->argument(0));
+    Root* root = jsDynamicCast<Root*>(exec->argument(1));
+    if (element && root)
+        element->setRoot(exec->vm(), root);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateSimpleObject(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    return JSValue::encode(SimpleObject::create(exec->vm(), exec->lexicalGlobalObject()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionGetHiddenValue(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    SimpleObject* simpleObject = jsDynamicCast<SimpleObject*>(exec->argument(0));
+    if (UNLIKELY(!simpleObject)) {
+        throwTypeError(exec, scope, ASCIILiteral("Invalid use of getHiddenValue test function"));
+        return encodedJSValue();
+    }
+    return JSValue::encode(simpleObject->hiddenValue());
+}
+
+EncodedJSValue JSC_HOST_CALL functionSetHiddenValue(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    SimpleObject* simpleObject = jsDynamicCast<SimpleObject*>(exec->argument(0));
+    if (UNLIKELY(!simpleObject)) {
+        throwTypeError(exec, scope, ASCIILiteral("Invalid use of setHiddenValue test function"));
+        return encodedJSValue();
+    }
+    JSValue value = exec->argument(1);
+    simpleObject->setHiddenValue(exec->vm(), value);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateProxy(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(jsUndefined());
+    JSObject* jsTarget = asObject(target.asCell());
+    Structure* structure = JSProxy::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsTarget->getPrototypeDirect(), ImpureProxyType);
+    JSProxy* proxy = JSProxy::create(exec->vm(), structure, jsTarget);
+    return JSValue::encode(proxy);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateRuntimeArray(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    RuntimeArray* array = RuntimeArray::create(exec);
+    return JSValue::encode(array);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateImpureGetter(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    JSValue target = exec->argument(0);
+    JSObject* delegate = nullptr;
+    if (target.isObject())
+        delegate = asObject(target.asCell());
+    Structure* structure = ImpureGetter::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
+    ImpureGetter* result = ImpureGetter::create(exec->vm(), structure, delegate);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateCustomGetterObject(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    Structure* structure = CustomGetter::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
+    CustomGetter* result = CustomGetter::create(exec->vm(), structure);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateDOMJITNodeObject(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    Structure* structure = DOMJITNode::createStructure(exec->vm(), exec->lexicalGlobalObject(), DOMJITGetter::create(exec->vm(), DOMJITGetter::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull())));
+    DOMJITNode* result = DOMJITNode::create(exec->vm(), structure);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterObject(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    Structure* structure = DOMJITGetter::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
+    DOMJITGetter* result = DOMJITGetter::create(exec->vm(), structure);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterComplexObject(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    Structure* structure = DOMJITGetterComplex::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
+    DOMJITGetterComplex* result = DOMJITGetterComplex::create(exec->vm(), exec->lexicalGlobalObject(), structure);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateDOMJITFunctionObject(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    Structure* structure = DOMJITFunctionObject::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
+    DOMJITFunctionObject* result = DOMJITFunctionObject::create(exec->vm(), exec->lexicalGlobalObject(), structure);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionSetImpureGetterDelegate(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue base = exec->argument(0);
+    if (!base.isObject())
+        return JSValue::encode(jsUndefined());
+    JSValue delegate = exec->argument(1);
+    if (!delegate.isObject())
+        return JSValue::encode(jsUndefined());
+    ImpureGetter* impureGetter = jsDynamicCast<ImpureGetter*>(asObject(base.asCell()));
+    if (UNLIKELY(!impureGetter)) {
+        throwTypeError(exec, scope, ASCIILiteral("argument is not an ImpureGetter"));
+        return encodedJSValue();
+    }
+    impureGetter->setDelegate(vm, asObject(delegate.asCell()));
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionGCAndSweep(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    exec->heap()->collectAllGarbage();
+    return JSValue::encode(jsNumber(exec->heap()->sizeAfterLastFullCollection()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionFullGC(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    exec->heap()->collectSync(CollectionScope::Full);
+    return JSValue::encode(jsNumber(exec->heap()->sizeAfterLastFullCollection()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionEdenGC(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    exec->heap()->collectSync(CollectionScope::Eden);
+    return JSValue::encode(jsNumber(exec->heap()->sizeAfterLastEdenCollection()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionForceGCSlowPaths(ExecState*)
+{
+    // It's best for this to be the first thing called in the 
+    // JS program so the option is set to true before we JIT.
+    Options::forceGCSlowPaths() = true;
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionHeapSize(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    return JSValue::encode(jsNumber(exec->heap()->size()));
+}
+
+// This function is not generally very helpful in 64-bit code as the tag and payload
+// share a register. But in 32-bit JITed code the tag may not be checked if an
+// optimization removes type checking requirements, such as in ===.
+EncodedJSValue JSC_HOST_CALL functionAddressOf(ExecState* exec)
+{
+    JSValue value = exec->argument(0);
+    if (!value.isCell())
+        return JSValue::encode(jsUndefined());
+    // Need to cast to uint64_t so bitwise_cast will play along.
+    uint64_t asNumber = reinterpret_cast<uint64_t>(value.asCell());
+    EncodedJSValue returnValue = JSValue::encode(jsNumber(bitwise_cast<double>(asNumber)));
+    return returnValue;
+}
+
+static EncodedJSValue JSC_HOST_CALL functionGetGetterSetter(ExecState* exec)
+{
+    JSValue value = exec->argument(0);
+    if (!value.isObject())
+        return JSValue::encode(jsUndefined());
+
+    JSValue property = exec->argument(1);
+    if (!property.isString())
+        return JSValue::encode(jsUndefined());
+
+    PropertySlot slot(value, PropertySlot::InternalMethodType::VMInquiry);
+    value.getPropertySlot(exec, asString(property)->toIdentifier(exec), slot);
+
+    JSValue result;
+    if (slot.isCacheableGetter())
+        result = slot.getterSetter();
+    else
+        result = jsNull();
+
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionVersion(ExecState*)
+{
+    // We need this function for compatibility with the Mozilla JS tests but for now
+    // we don't actually do any version-specific handling
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionRun(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String fileName = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    Vector<char> script;
+    if (!fetchScriptFromLocalFileSystem(fileName, script))
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Could not open file."))));
+
+    GlobalObject* globalObject = GlobalObject::create(vm, GlobalObject::createStructure(vm, jsNull()), Vector<String>());
+
+    JSArray* array = constructEmptyArray(globalObject->globalExec(), 0);
+    for (unsigned i = 1; i < exec->argumentCount(); ++i)
+        array->putDirectIndex(globalObject->globalExec(), i - 1, exec->uncheckedArgument(i));
+    globalObject->putDirect(
+        vm, Identifier::fromString(globalObject->globalExec(), "arguments"), array);
+
+    NakedPtr<Exception> exception;
+    StopWatch stopWatch;
+    stopWatch.start();
+    evaluate(globalObject->globalExec(), jscSource(script, fileName), JSValue(), exception);
+    stopWatch.stop();
+
+    if (exception) {
+        throwException(globalObject->globalExec(), scope, exception);
+        return JSValue::encode(jsUndefined());
+    }
+    
+    return JSValue::encode(jsNumber(stopWatch.getElapsedMS()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionRunString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String source = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    GlobalObject* globalObject = GlobalObject::create(vm, GlobalObject::createStructure(vm, jsNull()), Vector<String>());
+
+    JSArray* array = constructEmptyArray(globalObject->globalExec(), 0);
+    for (unsigned i = 1; i < exec->argumentCount(); ++i)
+        array->putDirectIndex(globalObject->globalExec(), i - 1, exec->uncheckedArgument(i));
+    globalObject->putDirect(
+        vm, Identifier::fromString(globalObject->globalExec(), "arguments"), array);
+
+    NakedPtr<Exception> exception;
+    evaluate(globalObject->globalExec(), makeSource(source), JSValue(), exception);
+
+    if (exception) {
+        scope.throwException(globalObject->globalExec(), exception);
+        return JSValue::encode(jsUndefined());
+    }
+    
+    return JSValue::encode(globalObject);
+}
+
+EncodedJSValue JSC_HOST_CALL functionLoad(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String fileName = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    Vector<char> script;
+    if (!fetchScriptFromLocalFileSystem(fileName, script))
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Could not open file."))));
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    
+    NakedPtr<Exception> evaluationException;
+    JSValue result = evaluate(globalObject->globalExec(), jscSource(script, fileName), JSValue(), evaluationException);
+    if (evaluationException)
+        throwException(exec, scope, evaluationException);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionLoadString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String sourceCode = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+
+    NakedPtr<Exception> evaluationException;
+    JSValue result = evaluate(globalObject->globalExec(), makeSource(sourceCode), JSValue(), evaluationException);
+    if (evaluationException)
+        throwException(exec, scope, evaluationException);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionReadFile(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String fileName = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    bool isBinary = false;
+    if (exec->argumentCount() > 1) {
+        String type = exec->argument(1).toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (type != "binary")
+            return throwVMError(exec, scope, "Expected 'binary' as second argument.");
+        isBinary = true;
+    }
+
+    Vector<char> content;
+    if (!fillBufferWithContentsOfFile(fileName, content))
+        return throwVMError(exec, scope, "Could not open file.");
+
+    if (!isBinary)
+        return JSValue::encode(jsString(exec, stringFromUTF(content)));
+
+    Structure* structure = exec->lexicalGlobalObject()->typedArrayStructure(TypeUint8);
+    auto length = content.size();
+    JSObject* result = createUint8TypedArray(exec, structure, ArrayBuffer::createFromBytes(content.releaseBuffer().leakPtr(), length, [] (void* p) { fastFree(p); }), 0, length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCheckSyntax(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String fileName = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    Vector<char> script;
+    if (!fetchScriptFromLocalFileSystem(fileName, script))
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Could not open file."))));
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+
+    StopWatch stopWatch;
+    stopWatch.start();
+
+    JSValue syntaxException;
+    bool validSyntax = checkSyntax(globalObject->globalExec(), jscSource(script, fileName), &syntaxException);
+    stopWatch.stop();
+
+    if (!validSyntax)
+        throwException(exec, scope, syntaxException);
+    return JSValue::encode(jsNumber(stopWatch.getElapsedMS()));
+}
+
+#if ENABLE(SAMPLING_FLAGS)
+EncodedJSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState* exec)
+{
+    for (unsigned i = 0; i < exec->argumentCount(); ++i) {
+        unsigned flag = static_cast<unsigned>(exec->uncheckedArgument(i).toNumber(exec));
+        if ((flag >= 1) && (flag <= 32))
+            SamplingFlags::setFlag(flag);
+    }
+    return JSValue::encode(jsNull());
+}
+
+EncodedJSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState* exec)
+{
+    for (unsigned i = 0; i < exec->argumentCount(); ++i) {
+        unsigned flag = static_cast<unsigned>(exec->uncheckedArgument(i).toNumber(exec));
+        if ((flag >= 1) && (flag <= 32))
+            SamplingFlags::clearFlag(flag);
+    }
+    return JSValue::encode(jsNull());
+}
+#endif
+
+EncodedJSValue JSC_HOST_CALL functionShadowChickenFunctionsOnStack(ExecState* exec)
+{
+    return JSValue::encode(exec->vm().shadowChicken().functionsOnStack(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL functionSetGlobalConstRedeclarationShouldNotThrow(ExecState* exec)
+{
+    exec->vm().setGlobalConstRedeclarationShouldThrow(false);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionGetRandomSeed(ExecState* exec)
+{
+    return JSValue::encode(jsNumber(exec->lexicalGlobalObject()->weakRandom().seed()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionSetRandomSeed(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    unsigned seed = exec->argument(0).toUInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    exec->lexicalGlobalObject()->weakRandom().setSeed(seed);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionIsRope(ExecState* exec)
+{
+    JSValue argument = exec->argument(0);
+    if (!argument.isString())
+        return JSValue::encode(jsBoolean(false));
+    const StringImpl* impl = asString(argument)->tryGetValueImpl();
+    return JSValue::encode(jsBoolean(!impl));
+}
+
+EncodedJSValue JSC_HOST_CALL functionGlobalObjectForObject(ExecState* exec)
+{
+    JSValue value = exec->argument(0);
+    RELEASE_ASSERT(value.isObject());
+    JSGlobalObject* globalObject = jsCast<JSObject*>(value)->globalObject();
+    RELEASE_ASSERT(globalObject);
+    return JSValue::encode(globalObject);
+}
+
+EncodedJSValue JSC_HOST_CALL functionReadline(ExecState* exec)
+{
+    Vector<char, 256> line;
+    int c;
+    while ((c = getchar()) != EOF) {
+        // FIXME: Should we also break on \r? 
+        if (c == '\n')
+            break;
+        line.append(c);
+    }
+    line.append('\0');
+    return JSValue::encode(jsString(exec, line.data()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionPreciseTime(ExecState*)
+{
+    return JSValue::encode(jsNumber(currentTime()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionNeverInlineFunction(ExecState* exec)
+{
+    return JSValue::encode(setNeverInline(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL functionNoDFG(ExecState* exec)
+{
+    return JSValue::encode(setNeverOptimize(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL functionNoFTL(ExecState* exec)
+{
+    if (JSFunction* function = jsDynamicCast<JSFunction*>(exec->argument(0))) {
+        FunctionExecutable* executable = function->jsExecutable();
+        executable->setNeverFTLOptimize(true);
+    }
+
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionNoOSRExitFuzzing(ExecState* exec)
+{
+    return JSValue::encode(setCannotUseOSRExitFuzzing(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL functionOptimizeNextInvocation(ExecState* exec)
+{
+    return JSValue::encode(optimizeNextInvocation(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL functionNumberOfDFGCompiles(ExecState* exec)
+{
+    return JSValue::encode(numberOfDFGCompiles(exec));
+}
+
+Message::Message(ArrayBufferContents&& contents, int32_t index)
+    : m_contents(WTFMove(contents))
+    , m_index(index)
+{
+}
+
+Message::~Message()
+{
+}
+
+Worker::Worker(Workers& workers)
+    : m_workers(workers)
+{
+    auto locker = holdLock(m_workers.m_lock);
+    m_workers.m_workers.append(this);
+    
+    *currentWorker() = this;
+}
+
+Worker::~Worker()
+{
+    auto locker = holdLock(m_workers.m_lock);
+    RELEASE_ASSERT(isOnList());
+    remove();
+}
+
+void Worker::enqueue(const AbstractLocker&, RefPtr<Message> message)
+{
+    m_messages.append(message);
+}
+
+RefPtr<Message> Worker::dequeue()
+{
+    auto locker = holdLock(m_workers.m_lock);
+    while (m_messages.isEmpty())
+        m_workers.m_condition.wait(m_workers.m_lock);
+    return m_messages.takeFirst();
+}
+
+Worker& Worker::current()
+{
+    return **currentWorker();
+}
+
+ThreadSpecific<Worker*>& Worker::currentWorker()
+{
+    static ThreadSpecific<Worker*>* result;
+    static std::once_flag flag;
+    std::call_once(
+        flag,
+        [] () {
+            result = new ThreadSpecific<Worker*>();
+        });
+    return *result;
+}
+
+Workers::Workers()
+{
+}
+
+Workers::~Workers()
+{
+    UNREACHABLE_FOR_PLATFORM();
+}
+
+template<typename Func>
+void Workers::broadcast(const Func& func)
+{
+    auto locker = holdLock(m_lock);
+    for (Worker* worker = m_workers.begin(); worker != m_workers.end(); worker = worker->next()) {
+        if (worker != &Worker::current())
+            func(locker, *worker);
+    }
+    m_condition.notifyAll();
+}
+
+void Workers::report(String string)
+{
+    auto locker = holdLock(m_lock);
+    m_reports.append(string.isolatedCopy());
+    m_condition.notifyAll();
+}
+
+String Workers::tryGetReport()
+{
+    auto locker = holdLock(m_lock);
+    if (m_reports.isEmpty())
+        return String();
+    return m_reports.takeFirst();
+}
+
+String Workers::getReport()
+{
+    auto locker = holdLock(m_lock);
+    while (m_reports.isEmpty())
+        m_condition.wait(m_lock);
+    return m_reports.takeFirst();
+}
+
+Workers& Workers::singleton()
+{
+    static Workers* result;
+    static std::once_flag flag;
+    std::call_once(
+        flag,
+        [] {
+            result = new Workers();
+        });
+    return *result;
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarCreateRealm(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    GlobalObject* result = GlobalObject::create(vm, GlobalObject::createStructure(vm, jsNull()), Vector<String>());
+    return JSValue::encode(result->getDirect(vm, Identifier::fromString(exec, "$")));
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarDetachArrayBuffer(ExecState* exec)
+{
+    return functionTransferArrayBuffer(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarEvalScript(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String sourceCode = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    GlobalObject* globalObject = jsDynamicCast<GlobalObject*>(
+        exec->thisValue().get(exec, Identifier::fromString(exec, "global")));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (!globalObject)
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Expected global to point to a global object"))));
+    
+    NakedPtr<Exception> evaluationException;
+    JSValue result = evaluate(globalObject->globalExec(), makeSource(sourceCode), JSValue(), evaluationException);
+    if (evaluationException)
+        throwException(exec, scope, evaluationException);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarAgentStart(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String sourceCode = exec->argument(0).toWTFString(exec).isolatedCopy();
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    Lock didStartLock;
+    Condition didStartCondition;
+    bool didStart = false;
+    
+    ThreadIdentifier thread = createThread(
+        "JSC Agent",
+        [sourceCode, &didStartLock, &didStartCondition, &didStart] () {
+            CommandLine commandLine(0, nullptr);
+            commandLine.m_interactive = false;
+            runJSC(
+                commandLine,
+                [&] (VM&, GlobalObject* globalObject) {
+                    // Notify the thread that started us that we have registered a worker.
+                    {
+                        auto locker = holdLock(didStartLock);
+                        didStart = true;
+                        didStartCondition.notifyOne();
+                    }
+                    
+                    NakedPtr<Exception> evaluationException;
+                    bool success = true;
+                    JSValue result;
+                    result = evaluate(globalObject->globalExec(), makeSource(sourceCode), JSValue(), evaluationException);
+                    if (evaluationException)
+                        result = evaluationException->value();
+                    checkException(globalObject, true, evaluationException, result, String(), false, false, success);
+                    if (!success)
+                        exit(1);
+                    return success;
+                });
+        });
+    detachThread(thread);
+    
+    {
+        auto locker = holdLock(didStartLock);
+        while (!didStart)
+            didStartCondition.wait(didStartLock);
+    }
+    
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarAgentReceiveBroadcast(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue callback = exec->argument(0);
+    CallData callData;
+    CallType callType = getCallData(callback, callData);
+    if (callType == CallType::None)
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Expected callback"))));
+    
+    RefPtr<Message> message;
+    {
+        ReleaseHeapAccessScope releaseAccess(vm.heap);
+        message = Worker::current().dequeue();
+    }
+    
+    RefPtr<ArrayBuffer> nativeBuffer = ArrayBuffer::create(message->releaseContents());
+    JSArrayBuffer* jsBuffer = JSArrayBuffer::create(vm, exec->lexicalGlobalObject()->arrayBufferStructure(nativeBuffer->sharingMode()), nativeBuffer);
+    
+    MarkedArgumentBuffer args;
+    args.append(jsBuffer);
+    args.append(jsNumber(message->index()));
+    return JSValue::encode(call(exec, callback, callType, callData, jsNull(), args));
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarAgentReport(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String report = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    Workers::singleton().report(report);
+    
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarAgentSleep(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (exec->argumentCount() >= 1) {
+        Seconds seconds = Seconds::fromMilliseconds(exec->argument(0).toNumber(exec));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        sleep(seconds);
+    }
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarAgentBroadcast(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(exec->argument(0));
+    if (!jsBuffer || !jsBuffer->isShared())
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Expected SharedArrayBuffer"))));
+    
+    int32_t index = exec->argument(1).toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    Workers::singleton().broadcast(
+        [&] (const AbstractLocker& locker, Worker& worker) {
+            ArrayBuffer* nativeBuffer = jsBuffer->impl();
+            ArrayBufferContents contents;
+            nativeBuffer->transferTo(contents); // "transferTo" means "share" if the buffer is shared.
+            RefPtr<Message> message = adoptRef(new Message(WTFMove(contents), index));
+            worker.enqueue(locker, message);
+        });
+    
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarAgentGetReport(ExecState* exec)
+{
+    VM& vm = exec->vm();
+
+    String string = Workers::singleton().tryGetReport();
+    if (!string)
+        return JSValue::encode(jsNull());
+    
+    return JSValue::encode(jsString(&vm, string));
+}
+
+EncodedJSValue JSC_HOST_CALL functionDollarAgentLeaving(ExecState*)
+{
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionWaitForReport(ExecState* exec)
+{
+    VM& vm = exec->vm();
+
+    String string;
+    {
+        ReleaseHeapAccessScope releaseAccess(vm.heap);
+        string = Workers::singleton().getReport();
+    }
+    if (!string)
+        return JSValue::encode(jsNull());
+    
+    return JSValue::encode(jsString(&vm, string));
+}
+
+template<typename ValueType>
+typename std::enable_if<!std::is_fundamental<ValueType>::value>::type addOption(VM&, JSObject*, Identifier, ValueType) { }
+
+template<typename ValueType>
+typename std::enable_if<std::is_fundamental<ValueType>::value>::type addOption(VM& vm, JSObject* optionsObject, Identifier identifier, ValueType value)
+{
+    optionsObject->putDirect(vm, identifier, JSValue(value));
+}
+
+EncodedJSValue JSC_HOST_CALL functionJSCOptions(ExecState* exec)
+{
+    JSObject* optionsObject = constructEmptyObject(exec);
+#define FOR_EACH_OPTION(type_, name_, defaultValue_, availability_, description_) \
+    addOption(exec->vm(), optionsObject, Identifier::fromString(exec, #name_), Options::name_());
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+    return JSValue::encode(optionsObject);
+}
+
+EncodedJSValue JSC_HOST_CALL functionReoptimizationRetryCount(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return JSValue::encode(jsUndefined());
+    
+    CodeBlock* block = getSomeBaselineCodeBlockForFunction(exec->argument(0));
+    if (!block)
+        return JSValue::encode(jsNumber(0));
+    
+    return JSValue::encode(jsNumber(block->reoptimizationRetryCounter()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionTransferArrayBuffer(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (exec->argumentCount() < 1)
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Not enough arguments"))));
+    
+    JSArrayBuffer* buffer = jsDynamicCast<JSArrayBuffer*>(exec->argument(0));
+    if (!buffer)
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Expected an array buffer"))));
+    
+    ArrayBufferContents dummyContents;
+    buffer->impl()->transferTo(dummyContents);
+    
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionFailNextNewCodeBlock(ExecState* exec)
+{
+    exec->vm().setFailNextNewCodeBlock();
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionQuit(ExecState*)
+{
+    jscExit(EXIT_SUCCESS);
+
+#if COMPILER(MSVC)
+    // Without this, Visual Studio will complain that this method does not return a value.
+    return JSValue::encode(jsUndefined());
+#endif
+}
+
+EncodedJSValue JSC_HOST_CALL functionAbort(ExecState*)
+{
+    CRASH();
+}
+
+EncodedJSValue JSC_HOST_CALL functionFalse1(ExecState*) { return JSValue::encode(jsBoolean(false)); }
+EncodedJSValue JSC_HOST_CALL functionFalse2(ExecState*) { return JSValue::encode(jsBoolean(false)); }
+
+EncodedJSValue JSC_HOST_CALL functionUndefined1(ExecState*) { return JSValue::encode(jsUndefined()); }
+EncodedJSValue JSC_HOST_CALL functionUndefined2(ExecState*) { return JSValue::encode(jsUndefined()); }
+EncodedJSValue JSC_HOST_CALL functionIsInt32(ExecState* exec)
+{
+    for (size_t i = 0; i < exec->argumentCount(); ++i) {
+        if (!exec->argument(i).isInt32())
+            return JSValue::encode(jsBoolean(false));
+    }
+    return JSValue::encode(jsBoolean(true));
+}
+
+EncodedJSValue JSC_HOST_CALL functionIdentity(ExecState* exec) { return JSValue::encode(exec->argument(0)); }
+
+EncodedJSValue JSC_HOST_CALL functionEffectful42(ExecState*)
+{
+    return JSValue::encode(jsNumber(42));
+}
+
+EncodedJSValue JSC_HOST_CALL functionMakeMasquerader(ExecState* exec)
+{
+    return JSValue::encode(Masquerader::create(exec->vm(), exec->lexicalGlobalObject()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionHasCustomProperties(ExecState* exec)
+{
+    JSValue value = exec->argument(0);
+    if (value.isObject())
+        return JSValue::encode(jsBoolean(asObject(value)->hasCustomProperties()));
+    return JSValue::encode(jsBoolean(false));
+}
+
+EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables(ExecState* exec)
+{
+    exec->vm().dumpTypeProfilerData();
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionFindTypeForExpression(ExecState* exec)
+{
+    RELEASE_ASSERT(exec->vm().typeProfiler());
+    exec->vm().typeProfilerLog()->processLogEntries(ASCIILiteral("jsc Testing API: functionFindTypeForExpression"));
+
+    JSValue functionValue = exec->argument(0);
+    RELEASE_ASSERT(functionValue.isFunction());
+    FunctionExecutable* executable = (jsDynamicCast<JSFunction*>(functionValue.asCell()->getObject()))->jsExecutable();
+
+    RELEASE_ASSERT(exec->argument(1).isString());
+    String substring = asString(exec->argument(1))->value(exec);
+    String sourceCodeText = executable->source().view().toString();
+    unsigned offset = static_cast<unsigned>(sourceCodeText.find(substring) + executable->source().startOffset());
+    
+    String jsonString = exec->vm().typeProfiler()->typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptorNormal, offset, executable->sourceID(), exec->vm());
+    return JSValue::encode(JSONParse(exec, jsonString));
+}
+
+EncodedJSValue JSC_HOST_CALL functionReturnTypeFor(ExecState* exec)
+{
+    RELEASE_ASSERT(exec->vm().typeProfiler());
+    exec->vm().typeProfilerLog()->processLogEntries(ASCIILiteral("jsc Testing API: functionReturnTypeFor"));
+
+    JSValue functionValue = exec->argument(0);
+    RELEASE_ASSERT(functionValue.isFunction());
+    FunctionExecutable* executable = (jsDynamicCast<JSFunction*>(functionValue.asCell()->getObject()))->jsExecutable();
+
+    unsigned offset = executable->typeProfilingStartOffset();
+    String jsonString = exec->vm().typeProfiler()->typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptorFunctionReturn, offset, executable->sourceID(), exec->vm());
+    return JSValue::encode(JSONParse(exec, jsonString));
+}
+
+EncodedJSValue JSC_HOST_CALL functionDumpBasicBlockExecutionRanges(ExecState* exec)
+{
+    RELEASE_ASSERT(exec->vm().controlFlowProfiler());
+    exec->vm().controlFlowProfiler()->dumpData();
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionHasBasicBlockExecuted(ExecState* exec)
+{
+    RELEASE_ASSERT(exec->vm().controlFlowProfiler());
+
+    JSValue functionValue = exec->argument(0);
+    RELEASE_ASSERT(functionValue.isFunction());
+    FunctionExecutable* executable = (jsDynamicCast<JSFunction*>(functionValue.asCell()->getObject()))->jsExecutable();
+
+    RELEASE_ASSERT(exec->argument(1).isString());
+    String substring = asString(exec->argument(1))->value(exec);
+    String sourceCodeText = executable->source().view().toString();
+    RELEASE_ASSERT(sourceCodeText.contains(substring));
+    int offset = sourceCodeText.find(substring) + executable->source().startOffset();
+    
+    bool hasExecuted = exec->vm().controlFlowProfiler()->hasBasicBlockAtTextOffsetBeenExecuted(offset, executable->sourceID(), exec->vm());
+    return JSValue::encode(jsBoolean(hasExecuted));
+}
+
+EncodedJSValue JSC_HOST_CALL functionBasicBlockExecutionCount(ExecState* exec)
+{
+    RELEASE_ASSERT(exec->vm().controlFlowProfiler());
+
+    JSValue functionValue = exec->argument(0);
+    RELEASE_ASSERT(functionValue.isFunction());
+    FunctionExecutable* executable = (jsDynamicCast<JSFunction*>(functionValue.asCell()->getObject()))->jsExecutable();
+
+    RELEASE_ASSERT(exec->argument(1).isString());
+    String substring = asString(exec->argument(1))->value(exec);
+    String sourceCodeText = executable->source().view().toString();
+    RELEASE_ASSERT(sourceCodeText.contains(substring));
+    int offset = sourceCodeText.find(substring) + executable->source().startOffset();
+    
+    size_t executionCount = exec->vm().controlFlowProfiler()->basicBlockExecutionCountAtTextOffset(offset, executable->sourceID(), exec->vm());
+    return JSValue::encode(JSValue(executionCount));
+}
+
+EncodedJSValue JSC_HOST_CALL functionEnableExceptionFuzz(ExecState*)
+{
+    Options::useExceptionFuzz() = true;
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionDrainMicrotasks(ExecState* exec)
+{
+    exec->vm().drainMicrotasks();
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionIs32BitPlatform(ExecState*)
+{
+#if USE(JSVALUE64)
+    return JSValue::encode(JSValue(JSC::JSValue::JSFalse));
+#else
+    return JSValue::encode(JSValue(JSC::JSValue::JSTrue));
+#endif
+}
+
+EncodedJSValue JSC_HOST_CALL functionLoadModule(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String fileName = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    Vector<char> script;
+    if (!fetchScriptFromLocalFileSystem(fileName, script))
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Could not open file."))));
+
+    JSInternalPromise* promise = loadAndEvaluateModule(exec, fileName);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue error;
+    JSFunction* errorHandler = JSNativeStdFunction::create(vm, exec->lexicalGlobalObject(), 1, String(), [&](ExecState* exec) {
+        error = exec->argument(0);
+        return JSValue::encode(jsUndefined());
+    });
+
+    promise->then(exec, nullptr, errorHandler);
+    vm.drainMicrotasks();
+    if (error)
+        return JSValue::encode(throwException(exec, scope, error));
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateBuiltin(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (exec->argumentCount() < 1 || !exec->argument(0).isString())
+        return JSValue::encode(jsUndefined());
+
+    String functionText = asString(exec->argument(0))->value(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    const SourceCode& source = makeSource(functionText);
+    JSFunction* func = JSFunction::createBuiltinFunction(vm, createBuiltinExecutable(vm, source, Identifier::fromString(&vm, "foo"), ConstructorKind::None, ConstructAbility::CannotConstruct)->link(vm, source), exec->lexicalGlobalObject());
+
+    return JSValue::encode(func);
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateGlobalObject(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    return JSValue::encode(GlobalObject::create(vm, GlobalObject::createStructure(vm, jsNull()), Vector<String>()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionCheckModuleSyntax(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String source = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    StopWatch stopWatch;
+    stopWatch.start();
+
+    ParserError error;
+    bool validSyntax = checkModuleSyntax(exec, makeSource(source, String(), TextPosition(), SourceProviderSourceType::Module), error);
+    stopWatch.stop();
+
+    if (!validSyntax)
+        throwException(exec, scope, jsNontrivialString(exec, toString("SyntaxError: ", error.message(), ":", error.line())));
+    return JSValue::encode(jsNumber(stopWatch.getElapsedMS()));
+}
+
+EncodedJSValue JSC_HOST_CALL functionPlatformSupportsSamplingProfiler(ExecState*)
+{
+#if ENABLE(SAMPLING_PROFILER)
+    return JSValue::encode(JSValue(JSC::JSValue::JSTrue));
+#else
+    return JSValue::encode(JSValue(JSC::JSValue::JSFalse));
+#endif
+}
+
+EncodedJSValue JSC_HOST_CALL functionGenerateHeapSnapshot(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    HeapSnapshotBuilder snapshotBuilder(exec->vm().ensureHeapProfiler());
+    snapshotBuilder.buildSnapshot();
+
+    String jsonString = snapshotBuilder.json();
+    EncodedJSValue result = JSValue::encode(JSONParse(exec, jsonString));
+    RELEASE_ASSERT(!scope.exception());
+    return result;
+}
+
+EncodedJSValue JSC_HOST_CALL functionResetSuperSamplerState(ExecState*)
+{
+    resetSuperSamplerState();
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionEnsureArrayStorage(ExecState* exec)
+{
+    for (unsigned i = 0; i < exec->argumentCount(); ++i) {
+        if (JSObject* object = jsDynamicCast<JSObject*>(exec->argument(0)))
+            object->ensureArrayStorage(exec->vm());
+    }
+    return JSValue::encode(jsUndefined());
+}
+
+#if ENABLE(SAMPLING_PROFILER)
+EncodedJSValue JSC_HOST_CALL functionStartSamplingProfiler(ExecState* exec)
+{
+    SamplingProfiler& samplingProfiler = exec->vm().ensureSamplingProfiler(WTF::Stopwatch::create());
+    samplingProfiler.noticeCurrentThreadAsJSCExecutionThread();
+    samplingProfiler.start();
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionSamplingProfilerStackTraces(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!vm.samplingProfiler())
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral("Sampling profiler was never started"))));
+
+    String jsonString = vm.samplingProfiler()->stackTracesAsJSON();
+    EncodedJSValue result = JSValue::encode(JSONParse(exec, jsonString));
+    RELEASE_ASSERT(!scope.exception());
+    return result;
+}
+#endif // ENABLE(SAMPLING_PROFILER)
+
+EncodedJSValue JSC_HOST_CALL functionMaxArguments(ExecState*)
+{
+    return JSValue::encode(jsNumber(JSC::maxArguments));
+}
+
+#if ENABLE(WEBASSEMBLY)
+
+static CString valueWithTypeOfWasmValue(ExecState* exec, VM& vm, JSValue value, JSValue wasmValue)
+{
+    JSString* type = asString(wasmValue.get(exec, makeIdentifier(vm, "type")));
+
+    const String& typeString = type->value(exec);
+    if (typeString == "i64" || typeString == "i32")
+        return toCString(typeString, " ", RawPointer(bitwise_cast<void*>(value)));
+    if (typeString == "f32")
+        return toCString(typeString, " hex: ", RawPointer(bitwise_cast<void*>(value)), ", float: ", bitwise_cast<float>(static_cast<uint32_t>(JSValue::encode(value))));
+    return toCString(typeString, " hex: ", RawPointer(bitwise_cast<void*>(value)), ", double: ", bitwise_cast<double>(value));
+}
+
+static JSValue box(ExecState* exec, VM& vm, JSValue wasmValue)
+{
+
+    JSString* type = asString(wasmValue.get(exec, makeIdentifier(vm, "type")));
+    JSValue value = wasmValue.get(exec, makeIdentifier(vm, "value"));
+
+    auto unboxString = [&] (const char* hexFormat, const char* decFormat, auto& result) {
+        if (!value.isString())
+            return false;
+
+        const char* str = toCString(asString(value)->value(exec)).data();
+        int scanResult;
+        int length = std::strlen(str);
+        if ((length > 2 && (str[0] == '0' && str[1] == 'x'))
+            || (length > 3 && (str[0] == '-' && str[1] == '0' && str[2] == 'x')))
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
+            scanResult = sscanf(str, hexFormat, &result);
+        else
+            scanResult = sscanf(str, decFormat, &result);
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
+        RELEASE_ASSERT(scanResult != EOF);
+        return true;
+    };
+
+    const String& typeString = type->value(exec);
+    if (typeString == "i64") {
+        int64_t result;
+        if (!unboxString("%llx", "%lld", result))
+            CRASH();
+        return JSValue::decode(result);
+    }
+
+    if (typeString == "i32") {
+        int32_t result;
+        if (!unboxString("%x", "%d", result))
+            result = value.asInt32();
+        return JSValue::decode(static_cast<uint32_t>(result));
+    }
+
+    if (typeString == "f32") {
+        float result;
+        if (!unboxString("%a", "%f", result))
+            result = value.toFloat(exec);
+        return JSValue::decode(bitwise_cast<uint32_t>(result));
+    }
+
+    RELEASE_ASSERT(typeString == "f64");
+    double result;
+    if (!unboxString("%la", "%lf", result))
+        result = value.asNumber();
+    return JSValue::decode(bitwise_cast<uint64_t>(result));
+}
+
+static JSValue callWasmFunction(VM* vm, JSGlobalObject* globalObject, JSWebAssemblyCallee* wasmCallee, Vector<JSValue>& boxedArgs)
+{
+    JSValue firstArgument;
+    int argCount = 1;
+    JSValue* remainingArgs = nullptr;
+    if (boxedArgs.size()) {
+        remainingArgs = boxedArgs.data();
+        firstArgument = *remainingArgs;
+        remainingArgs++;
+        argCount = boxedArgs.size();
+    }
+
+    ProtoCallFrame protoCallFrame;
+    protoCallFrame.init(nullptr, globalObject->globalExec()->jsCallee(), firstArgument, argCount, remainingArgs);
+
+    return JSValue::decode(vmEntryToWasm(wasmCallee->entrypoint(), vm, &protoCallFrame));
+}
+
+// testWasmModule(JSArrayBufferView source, number functionCount, ...[[WasmValue, [WasmValue]]]) where the ith copy of [[result, [args]]] is a list
+// of arguments to be passed to the ith wasm function as well as the expected result. WasmValue is an object with "type" and "value" properties.
+static EncodedJSValue JSC_HOST_CALL functionTestWasmModuleFunctions(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!Options::useWebAssembly())
+        return throwVMTypeError(exec, scope, ASCIILiteral("testWasmModule should only be called if the useWebAssembly option is set"));
+
+    JSArrayBufferView* source = jsCast<JSArrayBufferView*>(exec->argument(0));
+    uint32_t functionCount = exec->argument(1).toUInt32(exec);
+
+    if (exec->argumentCount() != functionCount + 2)
+        CRASH();
+
+    Wasm::Plan plan(&vm, static_cast<uint8_t*>(source->vector()), source->length());
+    plan.run();
+    if (plan.failed()) {
+        dataLogLn("failed to parse module: ", plan.errorMessage());
+        CRASH();
+    }
+
+    if (plan.internalFunctionCount() != functionCount)
+        CRASH();
+
+    MarkedArgumentBuffer callees;
+    MarkedArgumentBuffer keepAlive;
+    {
+        unsigned lastIndex = UINT_MAX;
+        plan.initializeCallees(exec->lexicalGlobalObject(),
+            [&] (unsigned calleeIndex, JSWebAssemblyCallee* jsEntrypointCallee, JSWebAssemblyCallee* wasmEntrypointCallee) {
+                RELEASE_ASSERT(!calleeIndex || (calleeIndex - 1 == lastIndex));
+                callees.append(jsEntrypointCallee);
+                keepAlive.append(wasmEntrypointCallee);
+                lastIndex = calleeIndex;
+            });
+    }
+
+    void* memoryBytes = nullptr;
+    uint32_t memorySize = 0;
+    std::unique_ptr<Wasm::Memory> memory;
+    std::unique_ptr<Wasm::ModuleInformation> moduleInformation = plan.takeModuleInformation();
+
+    if (!!moduleInformation->memory) {
+        memory = std::make_unique<Wasm::Memory>(moduleInformation->memory.initial(), moduleInformation->memory.maximum());
+        RELEASE_ASSERT(memory->isValid());
+        memoryBytes = memory->memory();
+        memorySize = memory->size();
+    }
+    vm.topWasmMemoryPointer = memoryBytes;
+    vm.topWasmMemorySize = memorySize;
+
+    for (uint32_t i = 0; i < functionCount; ++i) {
+        JSArray* testCases = jsCast<JSArray*>(exec->argument(i + 2));
+        for (unsigned testIndex = 0; testIndex < testCases->length(); ++testIndex) {
+            JSArray* test = jsCast<JSArray*>(testCases->getIndexQuickly(testIndex));
+            JSObject* result = jsCast<JSObject*>(test->getIndexQuickly(0));
+            JSArray* arguments = jsCast<JSArray*>(test->getIndexQuickly(1));
+
+            Vector<JSValue> boxedArgs;
+            for (unsigned argIndex = 0; argIndex < arguments->length(); ++argIndex)
+                boxedArgs.append(box(exec, vm, arguments->getIndexQuickly(argIndex)));
+
+            JSValue callResult;
+            {
+                auto scope = DECLARE_THROW_SCOPE(vm);
+                callResult = callWasmFunction(&vm, exec->lexicalGlobalObject(), jsCast<JSWebAssemblyCallee*>(callees.at(i)), boxedArgs);
+                RETURN_IF_EXCEPTION(scope, { });
+            }
+            JSValue expected = box(exec, vm, result);
+            if (callResult != expected) {
+                dataLog("Arguments: ");
+                CommaPrinter comma(", ");
+                for (unsigned argIndex = 0; argIndex < arguments->length(); ++argIndex)
+                    dataLog(comma, valueWithTypeOfWasmValue(exec, vm, boxedArgs[argIndex], arguments->getIndexQuickly(argIndex)));
+                dataLogLn();
+
+                WTFReportAssertionFailure(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, toCString(" (callResult == ", valueWithTypeOfWasmValue(exec, vm, callResult, result), ", expected == ", valueWithTypeOfWasmValue(exec, vm, expected, result), ")").data());
+                CRASH();
+            }
+        }
+    }
+
+    return encodedJSUndefined();
+}
+
+#endif // ENABLE(WEBASSEBLY)
+
+// Use SEH for Release builds only to get rid of the crash report dialog
+// (luckily the same tests fail in Release and Debug builds so far). Need to
+// be in a separate main function because the jscmain function requires object
+// unwinding.
+
+#if COMPILER(MSVC) && !defined(_DEBUG)
+#define TRY       __try {
+#define EXCEPT(x) } __except (EXCEPTION_EXECUTE_HANDLER) { x; }
+#else
+#define TRY
+#define EXCEPT(x)
+#endif
+
+int jscmain(int argc, char** argv);
+
+static double s_desiredTimeout;
+static double s_timeoutMultiplier = 1.0;
+
+static NO_RETURN_DUE_TO_CRASH void timeoutThreadMain(void*)
+{
+    Seconds timeoutDuration(s_desiredTimeout * s_timeoutMultiplier);
+    sleep(timeoutDuration);
+    dataLog("Timed out after ", timeoutDuration, " seconds!\n");
+    CRASH();
+}
+
+static void startTimeoutThreadIfNeeded()
+{
+    if (char* timeoutString = getenv("JSCTEST_timeout")) {
+        if (sscanf(timeoutString, "%lf", &s_desiredTimeout) != 1) {
+            dataLog("WARNING: timeout string is malformed, got ", timeoutString,
+                " but expected a number. Not using a timeout.\n");
+        } else
+            createThread(timeoutThreadMain, 0, "jsc Timeout Thread");
+    }
+}
+
+int main(int argc, char** argv)
+{
+#if PLATFORM(IOS) && CPU(ARM_THUMB2)
+    // Enabled IEEE754 denormal support.
+    fenv_t env;
+    fegetenv( &env );
+    env.__fpscr &= ~0x01000000u;
+    fesetenv( &env );
+#endif
+
+#if OS(WINDOWS)
+    // Cygwin calls ::SetErrorMode(SEM_FAILCRITICALERRORS), which we will inherit. This is bad for
+    // testing/debugging, as it causes the post-mortem debugger not to be invoked. We reset the
+    // error mode here to work around Cygwin's behavior. See <http://webkit.org/b/55222>.
+    ::SetErrorMode(0);
+
+#if defined(_DEBUG)
+    _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
+    _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
+    _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
+    _CrtSetReportMode(_CRT_ERROR, _CRTDBG_MODE_FILE);
+    _CrtSetReportFile(_CRT_ASSERT, _CRTDBG_FILE_STDERR);
+    _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
+#endif
+
+    timeBeginPeriod(1);
+#endif
+
+#if PLATFORM(EFL)
+    ecore_init();
+#endif
+
+#if PLATFORM(GTK)
+    if (!setlocale(LC_ALL, ""))
+        WTFLogAlways("Locale not supported by C library.\n\tUsing the fallback 'C' locale.");
+#endif
+
+    // Need to initialize WTF threading before we start any threads. Cannot initialize JSC
+    // threading yet, since that would do somethings that we'd like to defer until after we
+    // have a chance to parse options.
+    WTF::initializeThreading();
+
+#if PLATFORM(IOS)
+    Options::crashIfCantAllocateJITMemory() = true;
+#endif
+
+    // We can't use destructors in the following code because it uses Windows
+    // Structured Exception Handling
+    int res = 0;
+    TRY
+        res = jscmain(argc, argv);
+    EXCEPT(res = 3)
+    finalizeStatsAtEndOfTesting();
+
+#if PLATFORM(EFL)
+    ecore_shutdown();
+#endif
+
+    jscExit(res);
+}
+
+static void dumpException(GlobalObject* globalObject, JSValue exception)
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+#define CHECK_EXCEPTION() do { \
+        if (scope.exception()) { \
+            scope.clearException(); \
+            return; \
+        } \
+    } while (false)
+
+    printf("Exception: %s\n", exception.toWTFString(globalObject->globalExec()).utf8().data());
+
+    Identifier nameID = Identifier::fromString(globalObject->globalExec(), "name");
+    Identifier fileNameID = Identifier::fromString(globalObject->globalExec(), "sourceURL");
+    Identifier lineNumberID = Identifier::fromString(globalObject->globalExec(), "line");
+    Identifier stackID = Identifier::fromString(globalObject->globalExec(), "stack");
+    
+    JSValue nameValue = exception.get(globalObject->globalExec(), nameID);
+    CHECK_EXCEPTION();
+    JSValue fileNameValue = exception.get(globalObject->globalExec(), fileNameID);
+    CHECK_EXCEPTION();
+    JSValue lineNumberValue = exception.get(globalObject->globalExec(), lineNumberID);
+    CHECK_EXCEPTION();
+    JSValue stackValue = exception.get(globalObject->globalExec(), stackID);
+    CHECK_EXCEPTION();
+    
+    if (nameValue.toWTFString(globalObject->globalExec()) == "SyntaxError"
+        && (!fileNameValue.isUndefinedOrNull() || !lineNumberValue.isUndefinedOrNull())) {
+        printf(
+            "at %s:%s\n",
+            fileNameValue.toWTFString(globalObject->globalExec()).utf8().data(),
+            lineNumberValue.toWTFString(globalObject->globalExec()).utf8().data());
+    }
+    
+    if (!stackValue.isUndefinedOrNull())
+        printf("%s\n", stackValue.toWTFString(globalObject->globalExec()).utf8().data());
+
+#undef CHECK_EXCEPTION
+}
+
+static bool checkUncaughtException(VM& vm, GlobalObject* globalObject, JSValue exception, const String& expectedExceptionName, bool alwaysDumpException)
+{
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    scope.clearException();
+    if (!exception) {
+        printf("Expected uncaught exception with name '%s' but none was thrown\n", expectedExceptionName.utf8().data());
+        return false;
+    }
+
+    ExecState* exec = globalObject->globalExec();
+    JSValue exceptionClass = globalObject->get(exec, Identifier::fromString(exec, expectedExceptionName));
+    if (!exceptionClass.isObject() || scope.exception()) {
+        printf("Expected uncaught exception with name '%s' but given exception class is not defined\n", expectedExceptionName.utf8().data());
+        return false;
+    }
+
+    bool isInstanceOfExpectedException = jsCast<JSObject*>(exceptionClass)->hasInstance(exec, exception);
+    if (scope.exception()) {
+        printf("Expected uncaught exception with name '%s' but given exception class fails performing hasInstance\n", expectedExceptionName.utf8().data());
+        return false;
+    }
+    if (isInstanceOfExpectedException) {
+        if (alwaysDumpException)
+            dumpException(globalObject, exception);
+        return true;
+    }
+
+    printf("Expected uncaught exception with name '%s' but exception value is not instance of this exception class\n", expectedExceptionName.utf8().data());
+    dumpException(globalObject, exception);
+    return false;
+}
+
+static void checkException(GlobalObject* globalObject, bool isLastFile, bool hasException, JSValue value, const String& uncaughtExceptionName, bool alwaysDumpUncaughtException, bool dump, bool& success)
+{
+    VM& vm = globalObject->vm();
+    if (!uncaughtExceptionName || !isLastFile) {
+        success = success && !hasException;
+        if (dump && !hasException)
+            printf("End: %s\n", value.toWTFString(globalObject->globalExec()).utf8().data());
+        if (hasException)
+            dumpException(globalObject, value);
+    } else
+        success = success && checkUncaughtException(vm, globalObject, (hasException) ? value : JSValue(), uncaughtExceptionName, alwaysDumpUncaughtException);
+}
+
+static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scripts, const String& uncaughtExceptionName, bool alwaysDumpUncaughtException, bool dump, bool module)
+{
+    String fileName;
+    Vector<char> scriptBuffer;
+
+    if (dump)
+        JSC::Options::dumpGeneratedBytecodes() = true;
+
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    bool success = true;
+
+#if ENABLE(SAMPLING_FLAGS)
+    SamplingFlags::start();
+#endif
+
+    for (size_t i = 0; i < scripts.size(); i++) {
+        JSInternalPromise* promise = nullptr;
+        bool isModule = module || scripts[i].scriptType == Script::ScriptType::Module;
+        if (scripts[i].codeSource == Script::CodeSource::File) {
+            fileName = scripts[i].argument;
+            if (scripts[i].strictMode == Script::StrictMode::Strict)
+                scriptBuffer.append("\"use strict\";\n", strlen("\"use strict\";\n"));
+
+            if (isModule)
+                promise = loadAndEvaluateModule(globalObject->globalExec(), fileName);
+            else {
+                if (!fetchScriptFromLocalFileSystem(fileName, scriptBuffer))
+                    return false; // fail early so we can catch missing files
+            }
+        } else {
+            size_t commandLineLength = strlen(scripts[i].argument);
+            scriptBuffer.resize(commandLineLength);
+            std::copy(scripts[i].argument, scripts[i].argument + commandLineLength, scriptBuffer.begin());
+            fileName = ASCIILiteral("[Command Line]");
+        }
+
+        bool isLastFile = i == scripts.size() - 1;
+        if (isModule) {
+            if (!promise)
+                promise = loadAndEvaluateModule(globalObject->globalExec(), jscSource(scriptBuffer, fileName));
+            scope.clearException();
+
+            JSFunction* fulfillHandler = JSNativeStdFunction::create(vm, globalObject, 1, String(), [&, isLastFile](ExecState* exec) {
+                checkException(globalObject, isLastFile, false, exec->argument(0), uncaughtExceptionName, alwaysDumpUncaughtException, dump, success);
+                return JSValue::encode(jsUndefined());
+            });
+
+            JSFunction* rejectHandler = JSNativeStdFunction::create(vm, globalObject, 1, String(), [&, isLastFile](ExecState* exec) {
+                checkException(globalObject, isLastFile, true, exec->argument(0), uncaughtExceptionName, alwaysDumpUncaughtException, dump, success);
+                return JSValue::encode(jsUndefined());
+            });
+
+            promise->then(globalObject->globalExec(), fulfillHandler, rejectHandler);
+            vm.drainMicrotasks();
+        } else {
+            NakedPtr<Exception> evaluationException;
+            JSValue returnValue = evaluate(globalObject->globalExec(), jscSource(scriptBuffer, fileName), JSValue(), evaluationException);
+            ASSERT(!scope.exception());
+            if (evaluationException)
+                returnValue = evaluationException->value();
+            checkException(globalObject, isLastFile, evaluationException, returnValue, uncaughtExceptionName, alwaysDumpUncaughtException, dump, success);
+        }
+
+        scriptBuffer.clear();
+        scope.clearException();
+    }
+
+#if ENABLE(REGEXP_TRACING)
+    vm.dumpRegExpTrace();
+#endif
+    return success;
+}
+
+#define RUNNING_FROM_XCODE 0
+
+static void runInteractive(GlobalObject* globalObject)
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    String interpreterName(ASCIILiteral("Interpreter"));
+    
+    bool shouldQuit = false;
+    while (!shouldQuit) {
+#if HAVE(READLINE) && !RUNNING_FROM_XCODE
+        ParserError error;
+        String source;
+        do {
+            error = ParserError();
+            char* line = readline(source.isEmpty() ? interactivePrompt : "... ");
+            shouldQuit = !line;
+            if (!line)
+                break;
+            source = source + line;
+            source = source + '\n';
+            checkSyntax(globalObject->vm(), makeSource(source, interpreterName), error);
+            if (!line[0]) {
+                free(line);
+                break;
+            }
+            add_history(line);
+            free(line);
+        } while (error.syntaxErrorType() == ParserError::SyntaxErrorRecoverable);
+        
+        if (error.isValid()) {
+            printf("%s:%d\n", error.message().utf8().data(), error.line());
+            continue;
+        }
+        
+        
+        NakedPtr<Exception> evaluationException;
+        JSValue returnValue = evaluate(globalObject->globalExec(), makeSource(source, interpreterName), JSValue(), evaluationException);
+#else
+        printf("%s", interactivePrompt);
+        Vector<char, 256> line;
+        int c;
+        while ((c = getchar()) != EOF) {
+            // FIXME: Should we also break on \r? 
+            if (c == '\n')
+                break;
+            line.append(c);
+        }
+        if (line.isEmpty())
+            break;
+
+        NakedPtr<Exception> evaluationException;
+        JSValue returnValue = evaluate(globalObject->globalExec(), jscSource(line, interpreterName), JSValue(), evaluationException);
+#endif
+        if (evaluationException)
+            printf("Exception: %s\n", evaluationException->value().toWTFString(globalObject->globalExec()).utf8().data());
+        else
+            printf("%s\n", returnValue.toWTFString(globalObject->globalExec()).utf8().data());
+
+        scope.clearException();
+        globalObject->vm().drainMicrotasks();
+    }
+    printf("\n");
+}
+
+static NO_RETURN void printUsageStatement(bool help = false)
+{
+    fprintf(stderr, "Usage: jsc [options] [files] [-- arguments]\n");
+    fprintf(stderr, "  -d         Dumps bytecode (debug builds only)\n");
+    fprintf(stderr, "  -e         Evaluate argument as script code\n");
+    fprintf(stderr, "  -f         Specifies a source file (deprecated)\n");
+    fprintf(stderr, "  -h|--help  Prints this help message\n");
+    fprintf(stderr, "  -i         Enables interactive mode (default if no files are specified)\n");
+    fprintf(stderr, "  -m         Execute as a module\n");
+#if HAVE(SIGNAL_H)
+    fprintf(stderr, "  -s         Installs signal handlers that exit on a crash (Unix platforms only)\n");
+#endif
+    fprintf(stderr, "  -p <file>  Outputs profiling data to a file\n");
+    fprintf(stderr, "  -x         Output exit code before terminating\n");
+    fprintf(stderr, "\n");
+    fprintf(stderr, "  --sample                   Collects and outputs sampling profiler data\n");
+    fprintf(stderr, "  --test262-async            Check that some script calls the print function with the string 'Test262:AsyncTestComplete'\n");
+    fprintf(stderr, "  --strict-file=<file>       Parse the given file as if it were in strict mode (this option may be passed more than once)\n");
+    fprintf(stderr, "  --module-file=<file>       Parse and evaluate the given file as module (this option may be passed more than once)\n");
+    fprintf(stderr, "  --exception=<name>         Check the last script exits with an uncaught exception with the specified name\n");
+    fprintf(stderr, "  --dumpException            Dump uncaught exception text\n");
+    fprintf(stderr, "  --options                  Dumps all JSC VM options and exits\n");
+    fprintf(stderr, "  --dumpOptions              Dumps all non-default JSC VM options before continuing\n");
+    fprintf(stderr, "  --<jsc VM option>=<value>  Sets the specified JSC VM option\n");
+    fprintf(stderr, "\n");
+
+    jscExit(help ? EXIT_SUCCESS : EXIT_FAILURE);
+}
+
+void CommandLine::parseArguments(int argc, char** argv)
+{
+    Options::initialize();
+    
+    int i = 1;
+    JSC::Options::DumpLevel dumpOptionsLevel = JSC::Options::DumpLevel::None;
+    bool needToExit = false;
+
+    bool hasBadJSCOptions = false;
+    for (; i < argc; ++i) {
+        const char* arg = argv[i];
+        if (!strcmp(arg, "-f")) {
+            if (++i == argc)
+                printUsageStatement();
+            m_scripts.append(Script(Script::StrictMode::Sloppy, Script::CodeSource::File, Script::ScriptType::Script, argv[i]));
+            continue;
+        }
+        if (!strcmp(arg, "-e")) {
+            if (++i == argc)
+                printUsageStatement();
+            m_scripts.append(Script(Script::StrictMode::Sloppy, Script::CodeSource::CommandLine, Script::ScriptType::Script, argv[i]));
+            continue;
+        }
+        if (!strcmp(arg, "-i")) {
+            m_interactive = true;
+            continue;
+        }
+        if (!strcmp(arg, "-d")) {
+            m_dump = true;
+            continue;
+        }
+        if (!strcmp(arg, "-p")) {
+            if (++i == argc)
+                printUsageStatement();
+            m_profile = true;
+            m_profilerOutput = argv[i];
+            continue;
+        }
+        if (!strcmp(arg, "-m")) {
+            m_module = true;
+            continue;
+        }
+        if (!strcmp(arg, "-s")) {
+#if HAVE(SIGNAL_H)
+            signal(SIGILL, _exit);
+            signal(SIGFPE, _exit);
+            signal(SIGBUS, _exit);
+            signal(SIGSEGV, _exit);
+#endif
+            continue;
+        }
+        if (!strcmp(arg, "-x")) {
+            m_exitCode = true;
+            continue;
+        }
+        if (!strcmp(arg, "--")) {
+            ++i;
+            break;
+        }
+        if (!strcmp(arg, "-h") || !strcmp(arg, "--help"))
+            printUsageStatement(true);
+
+        if (!strcmp(arg, "--options")) {
+            dumpOptionsLevel = JSC::Options::DumpLevel::Verbose;
+            needToExit = true;
+            continue;
+        }
+        if (!strcmp(arg, "--dumpOptions")) {
+            dumpOptionsLevel = JSC::Options::DumpLevel::Overridden;
+            continue;
+        }
+        if (!strcmp(arg, "--sample")) {
+            JSC::Options::useSamplingProfiler() = true;
+            JSC::Options::collectSamplingProfilerDataForJSCShell() = true;
+            m_dumpSamplingProfilerData = true;
+            continue;
+        }
+
+        static const char* timeoutMultiplierOptStr = "--timeoutMultiplier=";
+        static const unsigned timeoutMultiplierOptStrLength = strlen(timeoutMultiplierOptStr);
+        if (!strncmp(arg, timeoutMultiplierOptStr, timeoutMultiplierOptStrLength)) {
+            const char* valueStr = &arg[timeoutMultiplierOptStrLength];
+            if (sscanf(valueStr, "%lf", &s_timeoutMultiplier) != 1)
+                dataLog("WARNING: --timeoutMultiplier=", valueStr, " is invalid. Expects a numeric ratio.\n");
+            continue;
+        }
+
+        if (!strcmp(arg, "--test262-async")) {
+            test262AsyncTest = true;
+            continue;
+        }
+
+        if (!strcmp(arg, "--remote-debug")) {
+            m_enableRemoteDebugging = true;
+            continue;
+        }
+
+        static const unsigned strictFileStrLength = strlen("--strict-file=");
+        if (!strncmp(arg, "--strict-file=", strictFileStrLength)) {
+            m_scripts.append(Script(Script::StrictMode::Strict, Script::CodeSource::File, Script::ScriptType::Script, argv[i] + strictFileStrLength));
+            continue;
+        }
+
+        static const unsigned moduleFileStrLength = strlen("--module-file=");
+        if (!strncmp(arg, "--module-file=", moduleFileStrLength)) {
+            m_scripts.append(Script(Script::StrictMode::Sloppy, Script::CodeSource::File, Script::ScriptType::Module, argv[i] + moduleFileStrLength));
+            continue;
+        }
+
+        if (!strcmp(arg, "--dumpException")) {
+            m_alwaysDumpUncaughtException = true;
+            continue;
+        }
+
+        static const unsigned exceptionStrLength = strlen("--exception=");
+        if (!strncmp(arg, "--exception=", exceptionStrLength)) {
+            m_uncaughtExceptionName = String(arg + exceptionStrLength);
+            continue;
+        }
+
+        // See if the -- option is a JSC VM option.
+        if (strstr(arg, "--") == arg) {
+            if (!JSC::Options::setOption(&arg[2])) {
+                hasBadJSCOptions = true;
+                dataLog("ERROR: invalid option: ", arg, "\n");
+            }
+            continue;
+        }
+
+        // This arg is not recognized by the VM nor by jsc. Pass it on to the
+        // script.
+        m_scripts.append(Script(Script::StrictMode::Sloppy, Script::CodeSource::File, Script::ScriptType::Script, argv[i]));
+    }
+
+    if (hasBadJSCOptions && JSC::Options::validateOptions())
+        CRASH();
+
+    if (m_scripts.isEmpty())
+        m_interactive = true;
+
+    for (; i < argc; ++i)
+        m_arguments.append(argv[i]);
+
+    if (dumpOptionsLevel != JSC::Options::DumpLevel::None) {
+        const char* optionsTitle = (dumpOptionsLevel == JSC::Options::DumpLevel::Overridden)
+            ? "Modified JSC runtime options:"
+            : "All JSC runtime options:";
+        JSC::Options::dumpAllOptions(stderr, dumpOptionsLevel, optionsTitle);
+    }
+    JSC::Options::ensureOptionsAreCoherent();
+    if (needToExit)
+        jscExit(EXIT_SUCCESS);
+}
+
+template<typename Func>
+int runJSC(CommandLine options, const Func& func)
+{
+    Worker worker(Workers::singleton());
+    
+    VM& vm = VM::create(LargeHeap).leakRef();
+    JSLockHolder locker(&vm);
+
+    int result;
+    if (options.m_profile && !vm.m_perBytecodeProfiler)
+        vm.m_perBytecodeProfiler = std::make_unique<Profiler::Database>(vm);
+
+    GlobalObject* globalObject = GlobalObject::create(vm, GlobalObject::createStructure(vm, jsNull()), options.m_arguments);
+    globalObject->setRemoteDebuggingEnabled(options.m_enableRemoteDebugging);
+    bool success = func(vm, globalObject);
+    if (options.m_interactive && success)
+        runInteractive(globalObject);
+
+    vm.drainMicrotasks();
+    result = success && (test262AsyncTest == test262AsyncPassed) ? 0 : 3;
+
+    if (options.m_exitCode)
+        printf("jsc exiting %d\n", result);
+
+    if (options.m_profile) {
+        if (!vm.m_perBytecodeProfiler->save(options.m_profilerOutput.utf8().data()))
+            fprintf(stderr, "could not save profiler output.\n");
+    }
+
+#if ENABLE(JIT)
+    if (Options::useExceptionFuzz())
+        printf("JSC EXCEPTION FUZZ: encountered %u checks.\n", numberOfExceptionFuzzChecks());
+    bool fireAtEnabled =
+    Options::fireExecutableAllocationFuzzAt() || Options::fireExecutableAllocationFuzzAtOrAfter();
+    if (Options::useExecutableAllocationFuzz() && (!fireAtEnabled || Options::verboseExecutableAllocationFuzz()))
+        printf("JSC EXECUTABLE ALLOCATION FUZZ: encountered %u checks.\n", numberOfExecutableAllocationFuzzChecks());
+    if (Options::useOSRExitFuzz()) {
+        printf("JSC OSR EXIT FUZZ: encountered %u static checks.\n", numberOfStaticOSRExitFuzzChecks());
+        printf("JSC OSR EXIT FUZZ: encountered %u dynamic checks.\n", numberOfOSRExitFuzzChecks());
+    }
+
+    auto compileTimeStats = JIT::compileTimeStats();
+    Vector<CString> compileTimeKeys;
+    for (auto& entry : compileTimeStats)
+        compileTimeKeys.append(entry.key);
+    std::sort(compileTimeKeys.begin(), compileTimeKeys.end());
+    for (CString key : compileTimeKeys)
+        printf("%40s: %.3lf ms\n", key.data(), compileTimeStats.get(key));
+#endif
+
+    if (Options::gcAtEnd()) {
+        // We need to hold the API lock to do a GC.
+        JSLockHolder locker(&vm);
+        vm.heap.collectAllGarbage();
+    }
+
+    if (options.m_dumpSamplingProfilerData) {
+#if ENABLE(SAMPLING_PROFILER)
+        JSLockHolder locker(&vm);
+        vm.samplingProfiler()->reportTopFunctions();
+        vm.samplingProfiler()->reportTopBytecodes();
+#else
+        dataLog("Sampling profiler is not enabled on this platform\n");
+#endif
+    }
+
+    return result;
+}
+
+int jscmain(int argc, char** argv)
+{
+    // Need to override and enable restricted options before we start parsing options below.
+    Options::enableRestrictedOptions(true);
+
+    // Note that the options parsing can affect VM creation, and thus
+    // comes first.
+    CommandLine options(argc, argv);
+
+    // Initialize JSC before getting VM.
+    WTF::initializeMainThread();
+    JSC::initializeThreading();
+    startTimeoutThreadIfNeeded();
+
+    int result;
+    result = runJSC(
+        options,
+        [&] (VM&, GlobalObject* globalObject) {
+            return runWithScripts(globalObject, options.m_scripts, options.m_uncaughtExceptionName, options.m_alwaysDumpUncaughtException, options.m_dump, options.m_module);
+        });
+
+    printSuperSamplerState();
+
+    return result;
+}
+
+#if OS(WINDOWS)
+extern "C" __declspec(dllexport) int WINAPI dllLauncherEntryPoint(int argc, const char* argv[])
+{
+    return main(argc, const_cast<char**>(argv));
+}
+#endif
diff --git a/llint/LLIntCLoop.cpp b/llint/LLIntCLoop.cpp
new file mode 100644
index 0000000..e3c6c6c
--- /dev/null
+++ b/llint/LLIntCLoop.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntCLoop.h"
+
+#if !ENABLE(JIT)
+
+#include "LLIntData.h"
+
+namespace JSC {
+namespace LLInt {
+
+void CLoop::initialize()
+{
+    execute(llint_entry, 0, 0, 0, true);
+}
+
+} // namespace LLInt
+} // namespace JSC
+
+#endif // !ENABLE(JIT)
diff --git a/llint/LLIntCLoop.h b/llint/LLIntCLoop.h
new file mode 100644
index 0000000..886fe1a
--- /dev/null
+++ b/llint/LLIntCLoop.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if !ENABLE(JIT)
+
+#include "CallFrame.h"
+#include "JSCJSValue.h"
+#include "Opcode.h"
+#include "ProtoCallFrame.h"
+
+namespace JSC {
+namespace LLInt {
+
+class CLoop {
+public:
+    static void initialize();
+    static JSValue execute(OpcodeID entryOpcodeID, void* executableAddress, VM*, ProtoCallFrame*, bool isInitializationPass = false);
+};
+
+} } // namespace JSC::LLInt
+
+using JSC::LLInt::CLoop;
+
+#endif // !ENABLE(JIT)
diff --git a/llint/LLIntCommon.h b/llint/LLIntCommon.h
new file mode 100644
index 0000000..5da516a
--- /dev/null
+++ b/llint/LLIntCommon.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012-2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+// Enables LLINT stats collection.
+#define ENABLE_LLINT_STATS 0
+
+// Print every instruction executed.
+#define LLINT_EXECUTION_TRACING 0
+
+// Print some information for some of the more subtle slow paths.
+#define LLINT_SLOW_PATH_TRACING 0
+
+// Disable inline allocation in the interpreter. This is great if you're changing
+// how the GC allocates.
+#if ENABLE(ALLOCATION_LOGGING)
+#define LLINT_ALWAYS_ALLOCATE_SLOW 1
+#else
+#define LLINT_ALWAYS_ALLOCATE_SLOW 0
+#endif
+
+// Disable inline caching of get_by_id and put_by_id.
+#define LLINT_ALWAYS_ACCESS_SLOW 0
diff --git a/llint/LLIntData.cpp b/llint/LLIntData.cpp
new file mode 100644
index 0000000..7553573
--- /dev/null
+++ b/llint/LLIntData.cpp
@@ -0,0 +1,417 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntData.h"
+
+#include "ArithProfile.h"
+#include "BytecodeConventions.h"
+#include "CodeBlock.h"
+#include "CodeType.h"
+#include "InitializeThreading.h"
+#include "Instruction.h"
+#include "JSScope.h"
+#include "LLIntCLoop.h"
+#include "LLIntCommon.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "Opcode.h"
+#include "PropertyOffset.h"
+#include "ShadowChicken.h"
+#include "WriteBarrier.h"
+#include <string>
+#include <wtf/NeverDestroyed.h>
+
+#define STATIC_ASSERT(cond) static_assert(cond, "LLInt assumes " #cond)
+
+namespace JSC { namespace LLInt {
+
+Instruction* Data::s_exceptionInstructions = 0;
+Opcode Data::s_opcodeMap[numOpcodeIDs] = { };
+OpcodeStatsArray* Data::s_opcodeStatsArray = nullptr;
+
+#if ENABLE(JIT)
+extern "C" void llint_entry(void*);
+#endif
+
+void initialize()
+{
+    Data::s_exceptionInstructions = new Instruction[maxOpcodeLength + 1];
+
+#if !ENABLE(JIT)
+    CLoop::initialize();
+
+#else // ENABLE(JIT)
+    llint_entry(&Data::s_opcodeMap);
+
+    for (int i = 0; i < maxOpcodeLength + 1; ++i)
+        Data::s_exceptionInstructions[i].u.pointer =
+            LLInt::getCodePtr(llint_throw_from_slow_path_trampoline);
+#endif // ENABLE(JIT)
+
+#if ENABLE(LLINT_STATS)
+    Data::ensureStats();
+#endif
+}
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wmissing-noreturn"
+#endif
+void Data::performAssertions(VM& vm)
+{
+    UNUSED_PARAM(vm);
+    
+    // Assertions to match LowLevelInterpreter.asm.  If you change any of this code, be
+    // prepared to change LowLevelInterpreter.asm as well!!
+
+#if USE(JSVALUE64)
+    const ptrdiff_t PtrSize = 8;
+    const ptrdiff_t CallFrameHeaderSlots = 5;
+#else // USE(JSVALUE64) // i.e. 32-bit version
+    const ptrdiff_t PtrSize = 4;
+    const ptrdiff_t CallFrameHeaderSlots = 4;
+#endif
+    const ptrdiff_t SlotSize = 8;
+
+    STATIC_ASSERT(sizeof(void*) == PtrSize);
+    STATIC_ASSERT(sizeof(Register) == SlotSize);
+    STATIC_ASSERT(CallFrame::headerSizeInRegisters == CallFrameHeaderSlots);
+
+    ASSERT(!CallFrame::callerFrameOffset());
+    STATIC_ASSERT(CallerFrameAndPC::sizeInRegisters == (PtrSize * 2) / SlotSize);
+    ASSERT(CallFrame::returnPCOffset() == CallFrame::callerFrameOffset() + PtrSize);
+    ASSERT(CallFrameSlot::codeBlock * sizeof(Register) == CallFrame::returnPCOffset() + PtrSize);
+    STATIC_ASSERT(CallFrameSlot::callee * sizeof(Register) == CallFrameSlot::codeBlock * sizeof(Register) + SlotSize);
+    STATIC_ASSERT(CallFrameSlot::argumentCount * sizeof(Register) == CallFrameSlot::callee * sizeof(Register) + SlotSize);
+    STATIC_ASSERT(CallFrameSlot::thisArgument * sizeof(Register) == CallFrameSlot::argumentCount * sizeof(Register) + SlotSize);
+    STATIC_ASSERT(CallFrame::headerSizeInRegisters == CallFrameSlot::thisArgument);
+
+    ASSERT(CallFrame::argumentOffsetIncludingThis(0) == CallFrameSlot::thisArgument);
+
+#if CPU(BIG_ENDIAN)
+    ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) == 0);
+    ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) == 4);
+#else
+    ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) == 4);
+    ASSERT(OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) == 0);
+#endif
+#if USE(JSVALUE32_64)
+    STATIC_ASSERT(JSValue::Int32Tag == static_cast<unsigned>(-1));
+    STATIC_ASSERT(JSValue::BooleanTag == static_cast<unsigned>(-2));
+    STATIC_ASSERT(JSValue::NullTag == static_cast<unsigned>(-3));
+    STATIC_ASSERT(JSValue::UndefinedTag == static_cast<unsigned>(-4));
+    STATIC_ASSERT(JSValue::CellTag == static_cast<unsigned>(-5));
+    STATIC_ASSERT(JSValue::EmptyValueTag == static_cast<unsigned>(-6));
+    STATIC_ASSERT(JSValue::DeletedValueTag == static_cast<unsigned>(-7));
+    STATIC_ASSERT(JSValue::LowestTag == static_cast<unsigned>(-7));
+#else
+    STATIC_ASSERT(TagBitTypeOther == 0x2);
+    STATIC_ASSERT(TagBitBool == 0x4);
+    STATIC_ASSERT(TagBitUndefined == 0x8);
+    STATIC_ASSERT(ValueEmpty == 0x0);
+    STATIC_ASSERT(ValueFalse == (TagBitTypeOther | TagBitBool));
+    STATIC_ASSERT(ValueTrue == (TagBitTypeOther | TagBitBool | 1));
+    STATIC_ASSERT(ValueUndefined == (TagBitTypeOther | TagBitUndefined));
+    STATIC_ASSERT(ValueNull == TagBitTypeOther);
+#endif
+#if (CPU(X86_64) && !OS(WINDOWS)) || CPU(ARM64) || !ENABLE(JIT)
+    STATIC_ASSERT(!maxFrameExtentForSlowPathCall);
+#elif CPU(ARM) || CPU(SH4)
+    STATIC_ASSERT(maxFrameExtentForSlowPathCall == 24);
+#elif CPU(X86) || CPU(MIPS)
+    STATIC_ASSERT(maxFrameExtentForSlowPathCall == 40);
+#elif CPU(X86_64) && OS(WINDOWS)
+    STATIC_ASSERT(maxFrameExtentForSlowPathCall == 64);
+#endif
+
+#if !ENABLE(JIT) || USE(JSVALUE32_64)
+    ASSERT(!CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters());
+#elif (CPU(X86_64) && !OS(WINDOWS))  || CPU(ARM64)
+    ASSERT(CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters() == 3);
+#elif (CPU(X86_64) && OS(WINDOWS))
+    ASSERT(CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters() == 3);
+#endif
+    
+    STATIC_ASSERT(StringType == 6);
+    STATIC_ASSERT(SymbolType == 7);
+    STATIC_ASSERT(ObjectType == 21);
+    STATIC_ASSERT(FinalObjectType == 22);
+    STATIC_ASSERT(JSFunctionType == 24);
+    STATIC_ASSERT(ArrayType == 32);
+    STATIC_ASSERT(DerivedArrayType == 33);
+    STATIC_ASSERT(ProxyObjectType == 51);
+    STATIC_ASSERT(Int8ArrayType == 34);
+    STATIC_ASSERT(Int16ArrayType == 35);
+    STATIC_ASSERT(Int32ArrayType == 36);
+    STATIC_ASSERT(Uint8ArrayType == 37);
+    STATIC_ASSERT(Uint8ClampedArrayType == 38);
+    STATIC_ASSERT(Uint16ArrayType == 39);
+    STATIC_ASSERT(Uint32ArrayType == 40);
+    STATIC_ASSERT(Float32ArrayType == 41);
+    STATIC_ASSERT(Float64ArrayType == 42);
+    STATIC_ASSERT(MasqueradesAsUndefined == 1);
+    STATIC_ASSERT(ImplementsDefaultHasInstance == 2);
+    STATIC_ASSERT(FirstConstantRegisterIndex == 0x40000000);
+    STATIC_ASSERT(GlobalCode == 0);
+    STATIC_ASSERT(EvalCode == 1);
+    STATIC_ASSERT(FunctionCode == 2);
+    STATIC_ASSERT(ModuleCode == 3);
+    
+    STATIC_ASSERT(IsArray == 0x01);
+    STATIC_ASSERT(IndexingShapeMask == 0x0E);
+    STATIC_ASSERT(NoIndexingShape == 0x00);
+    STATIC_ASSERT(Int32Shape == 0x04);
+    STATIC_ASSERT(DoubleShape == 0x06);
+    STATIC_ASSERT(ContiguousShape == 0x08);
+    STATIC_ASSERT(ArrayStorageShape == 0x0A);
+    STATIC_ASSERT(SlowPutArrayStorageShape == 0x0C);
+
+    ASSERT(!(reinterpret_cast<ptrdiff_t>((reinterpret_cast<WriteBarrier<JSCell>*>(0x4000)->slot())) - 0x4000));
+    static_assert(PutByIdPrimaryTypeMask == 0x6, "LLInt assumes PutByIdPrimaryTypeMask is == 0x6");
+    static_assert(PutByIdPrimaryTypeSecondary == 0x0, "LLInt assumes PutByIdPrimaryTypeSecondary is == 0x0");
+    static_assert(PutByIdPrimaryTypeObjectWithStructure == 0x2, "LLInt assumes PutByIdPrimaryTypeObjectWithStructure is == 0x2");
+    static_assert(PutByIdPrimaryTypeObjectWithStructureOrOther == 0x4, "LLInt assumes PutByIdPrimaryTypeObjectWithStructureOrOther is == 0x4");
+    static_assert(PutByIdSecondaryTypeMask == -0x8, "LLInt assumes PutByIdSecondaryTypeMask is == -0x8");
+    static_assert(PutByIdSecondaryTypeBottom == 0x0, "LLInt assumes PutByIdSecondaryTypeBottom is == 0x0");
+    static_assert(PutByIdSecondaryTypeBoolean == 0x8, "LLInt assumes PutByIdSecondaryTypeBoolean is == 0x8");
+    static_assert(PutByIdSecondaryTypeOther == 0x10, "LLInt assumes PutByIdSecondaryTypeOther is == 0x10");
+    static_assert(PutByIdSecondaryTypeInt32 == 0x18, "LLInt assumes PutByIdSecondaryTypeInt32 is == 0x18");
+    static_assert(PutByIdSecondaryTypeNumber == 0x20, "LLInt assumes PutByIdSecondaryTypeNumber is == 0x20");
+    static_assert(PutByIdSecondaryTypeString == 0x28, "LLInt assumes PutByIdSecondaryTypeString is == 0x28");
+    static_assert(PutByIdSecondaryTypeSymbol == 0x30, "LLInt assumes PutByIdSecondaryTypeSymbol is == 0x30");
+    static_assert(PutByIdSecondaryTypeObject == 0x38, "LLInt assumes PutByIdSecondaryTypeObject is == 0x38");
+    static_assert(PutByIdSecondaryTypeObjectOrOther == 0x40, "LLInt assumes PutByIdSecondaryTypeObjectOrOther is == 0x40");
+    static_assert(PutByIdSecondaryTypeTop == 0x48, "LLInt assumes PutByIdSecondaryTypeTop is == 0x48");
+
+    static_assert(GlobalProperty == 0, "LLInt assumes GlobalProperty ResultType is == 0");
+    static_assert(GlobalVar == 1, "LLInt assumes GlobalVar ResultType is == 1");
+    static_assert(GlobalLexicalVar == 2, "LLInt assumes GlobalLexicalVar ResultType is == 2");
+    static_assert(ClosureVar == 3, "LLInt assumes ClosureVar ResultType is == 3");
+    static_assert(LocalClosureVar == 4, "LLInt assumes LocalClosureVar ResultType is == 4");
+    static_assert(ModuleVar == 5, "LLInt assumes ModuleVar ResultType is == 5");
+    static_assert(GlobalPropertyWithVarInjectionChecks == 6, "LLInt assumes GlobalPropertyWithVarInjectionChecks ResultType is == 6");
+    static_assert(GlobalVarWithVarInjectionChecks == 7, "LLInt assumes GlobalVarWithVarInjectionChecks ResultType is == 7");
+    static_assert(GlobalLexicalVarWithVarInjectionChecks == 8, "LLInt assumes GlobalLexicalVarWithVarInjectionChecks ResultType is == 8");
+    static_assert(ClosureVarWithVarInjectionChecks == 9, "LLInt assumes ClosureVarWithVarInjectionChecks ResultType is == 9");
+
+    static_assert(static_cast<unsigned>(InitializationMode::NotInitialization) == 2, "LLInt assumes that InitializationMode::NotInitialization is 0");
+    
+    STATIC_ASSERT(GetPutInfo::typeBits == 0x3ff);
+    STATIC_ASSERT(GetPutInfo::initializationShift == 10);
+    STATIC_ASSERT(GetPutInfo::initializationBits == 0xffc00);
+
+    STATIC_ASSERT(MarkedBlock::blockSize == 16 * 1024);
+    STATIC_ASSERT(blackThreshold == 0);
+
+    ASSERT(bitwise_cast<uintptr_t>(ShadowChicken::Packet::tailMarker()) == static_cast<uintptr_t>(0x7a11));
+
+    // FIXME: make these assertions less horrible.
+#if !ASSERT_DISABLED
+    Vector<int> testVector;
+    testVector.resize(42);
+    ASSERT(bitwise_cast<uint32_t*>(&testVector)[sizeof(void*)/sizeof(uint32_t) + 1] == 42);
+    ASSERT(bitwise_cast<int**>(&testVector)[0] == testVector.begin());
+#endif
+
+    ASSERT(StringImpl::s_hashFlag8BitBuffer == 8);
+
+    {
+        uint32_t bits = 0x120000;
+        UNUSED_PARAM(bits);
+        ArithProfile arithProfile;
+        arithProfile.lhsSawInt32();
+        arithProfile.rhsSawInt32();
+        ASSERT(arithProfile.bits() == bits);
+        ASSERT(ArithProfile::fromInt(bits).lhsObservedType().isOnlyInt32());
+        ASSERT(ArithProfile::fromInt(bits).rhsObservedType().isOnlyInt32());
+    }
+    {
+        uint32_t bits = 0x220000;
+        UNUSED_PARAM(bits);
+        ArithProfile arithProfile;
+        arithProfile.lhsSawNumber();
+        arithProfile.rhsSawInt32();
+        ASSERT(arithProfile.bits() == bits);
+        ASSERT(ArithProfile::fromInt(bits).lhsObservedType().isOnlyNumber());
+        ASSERT(ArithProfile::fromInt(bits).rhsObservedType().isOnlyInt32());
+    }
+    {
+        uint32_t bits = 0x240000;
+        UNUSED_PARAM(bits);
+        ArithProfile arithProfile;
+        arithProfile.lhsSawNumber();
+        arithProfile.rhsSawNumber();
+        ASSERT(arithProfile.bits() == bits);
+        ASSERT(ArithProfile::fromInt(bits).lhsObservedType().isOnlyNumber());
+        ASSERT(ArithProfile::fromInt(bits).rhsObservedType().isOnlyNumber());
+    }
+    {
+        uint32_t bits = 0x140000;
+        UNUSED_PARAM(bits);
+        ArithProfile arithProfile;
+        arithProfile.lhsSawInt32();
+        arithProfile.rhsSawNumber();
+        ASSERT(arithProfile.bits() == bits);
+        ASSERT(ArithProfile::fromInt(bits).lhsObservedType().isOnlyInt32());
+        ASSERT(ArithProfile::fromInt(bits).rhsObservedType().isOnlyNumber());
+    }
+}
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
+
+void Data::finalizeStats()
+{
+#if ENABLE(LLINT_STATS)
+    if (!Options::reportLLIntStats())
+        return;
+    
+    if (Options::llintStatsFile())
+        saveStats();
+    
+    dumpStats();
+#endif
+}
+
+#if ENABLE(LLINT_STATS)
+static const bool verboseStats = false;
+
+static bool compareStats(const OpcodeStats& a, const OpcodeStats& b)
+{
+    if (a.count > b.count)
+        return true;
+    if (a.count < b.count)
+        return false;
+    return a.slowPathCount > b.slowPathCount;
+}
+
+void Data::dumpStats()
+{
+    ASSERT(Options::reportLLIntStats());
+    auto statsCopy = *s_opcodeStatsArray;
+    std::sort(statsCopy.begin(), statsCopy.end(), compareStats);
+
+    dataLog("Opcode stats:\n");
+    unsigned i = 0;
+    for (auto& stats : statsCopy) {
+        if (stats.count || stats.slowPathCount)
+            dataLog("   [", i++, "]: fast:", stats.count, " slow:", stats.slowPathCount, " ", opcodeNames[stats.id], "\n");
+    }
+}
+
+void Data::ensureStats()
+{
+    static std::once_flag initializeOptionsOnceFlag;
+    std::call_once(initializeOptionsOnceFlag, [] {
+        s_opcodeStatsArray = new OpcodeStatsArray();
+        resetStats();
+    });
+}
+
+void Data::loadStats()
+{
+    static NeverDestroyed<std::string> installedStatsFile;
+    if (!Options::llintStatsFile() || !installedStatsFile.get().compare(Options::llintStatsFile()))
+        return;
+
+    Options::reportLLIntStats() = true; // Force stats collection.
+    installedStatsFile.get() = Options::llintStatsFile();
+
+    ensureStats();
+
+    const char* filename = Options::llintStatsFile();
+    FILE* file = fopen(filename, "r");
+    if (!file) {
+        dataLogF("Failed to open file %s. Did you add the file-read-write-data entitlement to WebProcess.sb?\n", filename);
+        return;
+    }
+
+    resetStats();
+
+    OpcodeStats loaded;
+    unsigned index;
+    char opcodeName[100];
+    while (fscanf(file, "[%u]: fast:%zu slow:%zu id:%u %s\n", &index, &loaded.count, &loaded.slowPathCount, &loaded.id, opcodeName) != EOF) {
+        if (verboseStats)
+            dataLogF("loaded [%u]: fast %zu slow %zu id:%u %s\n", index, loaded.count, loaded.slowPathCount, loaded.id, opcodeName);
+
+        OpcodeStats& stats = opcodeStats(loaded.id);
+        stats.count = loaded.count;
+        stats.slowPathCount = loaded.slowPathCount;
+    }
+
+    if (verboseStats) {
+        dataLogF("After loading from %s, ", filename);
+        dumpStats();
+    }
+
+    int result = fclose(file);
+    if (result)
+        dataLogF("Failed to close file %s: %s\n", filename, strerror(errno));
+}
+
+void Data::resetStats()
+{
+    unsigned i = 0;
+    for (auto& stats : *s_opcodeStatsArray) {
+        stats.id = static_cast<OpcodeID>(i++);
+        stats.count = 0;
+        stats.slowPathCount = 0;
+    }
+}
+
+void Data::saveStats()
+{
+    ASSERT(Options::reportLLIntStats() && Options::llintStatsFile());
+    const char* filename = Options::llintStatsFile();
+
+    FILE* file = fopen(filename, "w");
+    if (!file) {
+        dataLogF("Failed to open file %s. Did you add the file-read-write-data entitlement to WebProcess.sb?\n", filename);
+        return;
+    }
+
+    auto statsCopy = *s_opcodeStatsArray;
+    std::sort(statsCopy.begin(), statsCopy.end(), compareStats);
+
+    int index = 0;
+    for (auto& stats : statsCopy) {
+        if (!stats.count && !stats.slowPathCount)
+            break; // stats are sorted. If we encountered 0 counts, then there are no more non-zero counts.
+
+        if (verboseStats)
+            dataLogF("saved [%u]: fast:%zu slow:%zu id:%u %s\n", index, stats.count, stats.slowPathCount, stats.id, opcodeNames[stats.id]);
+
+        fprintf(file, "[%u]: fast:%zu slow:%zu id:%u %s\n", index, stats.count, stats.slowPathCount, stats.id, opcodeNames[stats.id]);
+        index++;
+    }
+
+    int result = fclose(file);
+    if (result)
+        dataLogF("Failed to close file %s: %s\n", filename, strerror(errno));
+}
+#endif
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntData.h b/llint/LLIntData.h
new file mode 100644
index 0000000..441a2cf
--- /dev/null
+++ b/llint/LLIntData.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "Opcode.h"
+#include <array>
+
+namespace JSC {
+
+class VM;
+struct Instruction;
+
+#if !ENABLE(JIT)
+typedef OpcodeID LLIntCode;
+#else
+typedef void (*LLIntCode)();
+#endif
+
+namespace LLInt {
+
+struct OpcodeStats {
+    OpcodeID id;
+    size_t count { 0 };
+    size_t slowPathCount { 0 };
+};
+typedef std::array<OpcodeStats, numOpcodeIDs> OpcodeStatsArray;
+
+class Data {
+public:
+
+    static void performAssertions(VM&);
+    static OpcodeStats& opcodeStats(OpcodeID id) { return (*s_opcodeStatsArray)[id]; }
+
+    JS_EXPORT_PRIVATE static void finalizeStats();
+
+    static void dumpStats();
+    static void loadStats();
+
+private:
+    static void ensureStats();
+    static void resetStats();
+    static void saveStats();
+
+    static Instruction* s_exceptionInstructions;
+    static Opcode s_opcodeMap[numOpcodeIDs];
+    static OpcodeStatsArray* s_opcodeStatsArray;
+
+    friend void initialize();
+
+    friend Instruction* exceptionInstructions();
+    friend Opcode* opcodeMap();
+    friend Opcode getOpcode(OpcodeID);
+    friend void* getCodePtr(OpcodeID);
+};
+
+void initialize();
+
+inline Instruction* exceptionInstructions()
+{
+    return Data::s_exceptionInstructions;
+}
+    
+inline Opcode* opcodeMap()
+{
+    return Data::s_opcodeMap;
+}
+
+inline Opcode getOpcode(OpcodeID id)
+{
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+    return Data::s_opcodeMap[id];
+#else
+    return static_cast<Opcode>(id);
+#endif
+}
+
+ALWAYS_INLINE void* getCodePtr(OpcodeID id)
+{
+    return reinterpret_cast<void*>(getOpcode(id));
+}
+
+#if ENABLE(JIT)
+ALWAYS_INLINE LLIntCode getCodeFunctionPtr(OpcodeID codeId)
+{
+    return reinterpret_cast<LLIntCode>(getCodePtr(codeId));
+}
+#endif
+
+ALWAYS_INLINE void* getCodePtr(JSC::EncodedJSValue glueHelper())
+{
+    return bitwise_cast<void*>(glueHelper);
+}
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntEntrypoint.cpp b/llint/LLIntEntrypoint.cpp
new file mode 100644
index 0000000..f5918b7
--- /dev/null
+++ b/llint/LLIntEntrypoint.cpp
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntEntrypoint.h"
+#include "CodeBlock.h"
+#include "HeapInlines.h"
+#include "JITCode.h"
+#include "JSCellInlines.h"
+#include "JSObject.h"
+#include "LLIntThunks.h"
+#include "LowLevelInterpreter.h"
+#include "MaxFrameExtentForSlowPathCall.h"
+#include "StackAlignment.h"
+#include "VM.h"
+
+namespace JSC { namespace LLInt {
+
+static void setFunctionEntrypoint(VM& vm, CodeBlock* codeBlock)
+{
+    CodeSpecializationKind kind = codeBlock->specializationKind();
+    
+#if ENABLE(JIT)
+    if (vm.canUseJIT()) {
+        if (kind == CodeForCall) {
+            codeBlock->setJITCode(
+                adoptRef(new DirectJITCode(vm.getCTIStub(functionForCallEntryThunkGenerator), vm.getCTIStub(functionForCallArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
+            return;
+        }
+        ASSERT(kind == CodeForConstruct);
+        codeBlock->setJITCode(
+            adoptRef(new DirectJITCode(vm.getCTIStub(functionForConstructEntryThunkGenerator), vm.getCTIStub(functionForConstructArityCheckThunkGenerator).code(), JITCode::InterpreterThunk)));
+        return;
+    }
+#endif // ENABLE(JIT)
+
+    UNUSED_PARAM(vm);
+    if (kind == CodeForCall) {
+        codeBlock->setJITCode(
+            adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_call_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_call_arity_check), JITCode::InterpreterThunk)));
+        return;
+    }
+    ASSERT(kind == CodeForConstruct);
+    codeBlock->setJITCode(
+        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_function_for_construct_prologue), MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_construct_arity_check), JITCode::InterpreterThunk)));
+}
+
+static void setEvalEntrypoint(VM& vm, CodeBlock* codeBlock)
+{
+#if ENABLE(JIT)
+    if (vm.canUseJIT()) {
+        codeBlock->setJITCode(
+            adoptRef(new DirectJITCode(vm.getCTIStub(evalEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+        return;
+    }
+#endif // ENABLE(JIT)
+
+    UNUSED_PARAM(vm);
+    codeBlock->setJITCode(
+        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_eval_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+}
+
+static void setProgramEntrypoint(VM& vm, CodeBlock* codeBlock)
+{
+#if ENABLE(JIT)
+    if (vm.canUseJIT()) {
+        codeBlock->setJITCode(
+            adoptRef(new DirectJITCode(vm.getCTIStub(programEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+        return;
+    }
+#endif // ENABLE(JIT)
+
+    UNUSED_PARAM(vm);
+    codeBlock->setJITCode(
+        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+}
+
+static void setModuleProgramEntrypoint(VM& vm, CodeBlock* codeBlock)
+{
+#if ENABLE(JIT)
+    if (vm.canUseJIT()) {
+        codeBlock->setJITCode(
+            adoptRef(new DirectJITCode(vm.getCTIStub(moduleProgramEntryThunkGenerator), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+        return;
+    }
+#endif // ENABLE(JIT)
+
+    UNUSED_PARAM(vm);
+    codeBlock->setJITCode(
+        adoptRef(new DirectJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_module_program_prologue), MacroAssemblerCodePtr(), JITCode::InterpreterThunk)));
+}
+
+void setEntrypoint(VM& vm, CodeBlock* codeBlock)
+{
+    switch (codeBlock->codeType()) {
+    case GlobalCode:
+        setProgramEntrypoint(vm, codeBlock);
+        return;
+    case ModuleCode:
+        setModuleProgramEntrypoint(vm, codeBlock);
+        return;
+    case EvalCode:
+        setEvalEntrypoint(vm, codeBlock);
+        return;
+    case FunctionCode:
+        setFunctionEntrypoint(vm, codeBlock);
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+unsigned frameRegisterCountFor(CodeBlock* codeBlock)
+{
+    ASSERT(static_cast<unsigned>(codeBlock->m_numCalleeLocals) == WTF::roundUpToMultipleOf(stackAlignmentRegisters(), static_cast<unsigned>(codeBlock->m_numCalleeLocals)));
+
+    return roundLocalRegisterCountForFramePointerOffset(codeBlock->m_numCalleeLocals + maxFrameExtentForSlowPathCallInRegisters);
+}
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntEntrypoint.h b/llint/LLIntEntrypoint.h
new file mode 100644
index 0000000..392a0b9
--- /dev/null
+++ b/llint/LLIntEntrypoint.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeSpecializationKind.h"
+
+namespace JSC {
+
+class CodeBlock;
+class VM;
+
+namespace LLInt {
+
+void setEntrypoint(VM&, CodeBlock*);
+
+unsigned frameRegisterCountFor(CodeBlock*);
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntExceptions.cpp b/llint/LLIntExceptions.cpp
new file mode 100644
index 0000000..f8abd3a
--- /dev/null
+++ b/llint/LLIntExceptions.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntExceptions.h"
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "Instruction.h"
+#include "LLIntCommon.h"
+#include "LLIntData.h"
+#include "LowLevelInterpreter.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace LLInt {
+
+Instruction* returnToThrowForThrownException(ExecState* exec)
+{
+    UNUSED_PARAM(exec);
+    return LLInt::exceptionInstructions();
+}
+
+Instruction* returnToThrow(ExecState* exec)
+{
+    UNUSED_PARAM(exec);
+#if LLINT_SLOW_PATH_TRACING
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    dataLog("Throwing exception ", scope.exception(), " (returnToThrow).\n");
+#endif
+    return LLInt::exceptionInstructions();
+}
+
+void* callToThrow(ExecState* exec)
+{
+    UNUSED_PARAM(exec);
+#if LLINT_SLOW_PATH_TRACING
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    dataLog("Throwing exception ", scope.exception(), " (callToThrow).\n");
+#endif
+    return LLInt::getCodePtr(llint_throw_during_call_trampoline);
+}
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntExceptions.h b/llint/LLIntExceptions.h
new file mode 100644
index 0000000..f471ff8
--- /dev/null
+++ b/llint/LLIntExceptions.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/StdLibExtras.h>
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+class ExecState;
+struct Instruction;
+
+namespace LLInt {
+
+// Tells you where to jump to if you want to return-to-throw, after you've already
+// set up all information needed to throw the exception.
+Instruction* returnToThrowForThrownException(ExecState*);
+
+// Gives you a PC that you can tell the interpreter to go to, which when advanced
+// between 1 and 9 slots will give you an "instruction" that threads to the
+// interpreter's exception handler.
+Instruction* returnToThrow(ExecState*);
+
+// Use this when you're throwing to a call thunk.
+void* callToThrow(ExecState*);
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntOfflineAsmConfig.h b/llint/LLIntOfflineAsmConfig.h
new file mode 100644
index 0000000..1b09ee7
--- /dev/null
+++ b/llint/LLIntOfflineAsmConfig.h
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "LLIntCommon.h"
+#include <wtf/Assertions.h>
+#include <wtf/InlineASM.h>
+
+#if !ENABLE(JIT)
+#define OFFLINE_ASM_C_LOOP 1
+#define OFFLINE_ASM_X86 0
+#define OFFLINE_ASM_X86_WIN 0
+#define OFFLINE_ASM_ARM 0
+#define OFFLINE_ASM_ARMv7 0
+#define OFFLINE_ASM_ARMv7_TRADITIONAL 0
+#define OFFLINE_ASM_ARM64 0
+#define OFFLINE_ASM_X86_64 0
+#define OFFLINE_ASM_X86_64_WIN 0
+#define OFFLINE_ASM_ARMv7k 0
+#define OFFLINE_ASM_ARMv7s 0
+#define OFFLINE_ASM_MIPS 0
+#define OFFLINE_ASM_SH4 0
+
+#else // ENABLE(JIT)
+
+#define OFFLINE_ASM_C_LOOP 0
+
+#if CPU(X86) && !PLATFORM(WIN)
+#define OFFLINE_ASM_X86 1
+#else
+#define OFFLINE_ASM_X86 0
+#endif
+
+#if CPU(X86) && PLATFORM(WIN)
+#define OFFLINE_ASM_X86_WIN 1
+#else
+#define OFFLINE_ASM_X86_WIN 0
+#endif
+
+#ifdef __ARM_ARCH_7K__
+#define OFFLINE_ASM_ARMv7k 1
+#else
+#define OFFLINE_ASM_ARMv7k 0
+#endif
+
+#ifdef __ARM_ARCH_7S__
+#define OFFLINE_ASM_ARMv7s 1
+#else
+#define OFFLINE_ASM_ARMv7s 0
+#endif
+
+#if CPU(ARM_THUMB2)
+#define OFFLINE_ASM_ARMv7 1
+#else
+#define OFFLINE_ASM_ARMv7 0
+#endif
+
+#if CPU(ARM_TRADITIONAL)
+#if WTF_ARM_ARCH_AT_LEAST(7)
+#define OFFLINE_ASM_ARMv7_TRADITIONAL 1
+#define OFFLINE_ASM_ARM 0
+#else
+#define OFFLINE_ASM_ARM 1
+#define OFFLINE_ASM_ARMv7_TRADITIONAL 0
+#endif
+#else
+#define OFFLINE_ASM_ARMv7_TRADITIONAL 0
+#define OFFLINE_ASM_ARM 0
+#endif
+
+#if CPU(X86_64) && !PLATFORM(WIN)
+#define OFFLINE_ASM_X86_64 1
+#else
+#define OFFLINE_ASM_X86_64 0
+#endif
+
+#if CPU(X86_64) && PLATFORM(WIN)
+#define OFFLINE_ASM_X86_64_WIN 1
+#else
+#define OFFLINE_ASM_X86_64_WIN 0
+#endif
+
+#if CPU(MIPS)
+#define OFFLINE_ASM_MIPS 1
+#else
+#define OFFLINE_ASM_MIPS 0
+#endif
+
+#if CPU(SH4)
+#define OFFLINE_ASM_SH4 1
+#else
+#define OFFLINE_ASM_SH4 0
+#endif
+
+#if CPU(ARM64)
+#define OFFLINE_ASM_ARM64 1
+#else
+#define OFFLINE_ASM_ARM64 0
+#endif
+
+#if CPU(MIPS)
+#ifdef WTF_MIPS_PIC
+#define S(x) #x
+#define SX(x) S(x)
+#define OFFLINE_ASM_CPLOAD(reg) \
+    ".set noreorder\n" \
+    ".cpload " SX(reg) "\n" \
+    ".set reorder\n"
+#else
+#define OFFLINE_ASM_CPLOAD(reg)
+#endif
+#endif
+
+#endif // ENABLE(JIT)
+
+#if USE(JSVALUE64)
+#define OFFLINE_ASM_JSVALUE64 1
+#else
+#define OFFLINE_ASM_JSVALUE64 0
+#endif
+
+#if !ASSERT_DISABLED
+#define OFFLINE_ASM_ASSERT_ENABLED 1
+#else
+#define OFFLINE_ASM_ASSERT_ENABLED 0
+#endif
+
+#if CPU(BIG_ENDIAN)
+#define OFFLINE_ASM_BIG_ENDIAN 1
+#else
+#define OFFLINE_ASM_BIG_ENDIAN 0
+#endif
+
+#if ENABLE(LLINT_STATS)
+#define OFFLINE_ASM_COLLECT_STATS 1
+#else
+#define OFFLINE_ASM_COLLECT_STATS 0
+#endif
+
+#if LLINT_EXECUTION_TRACING
+#define OFFLINE_ASM_EXECUTION_TRACING 1
+#else
+#define OFFLINE_ASM_EXECUTION_TRACING 0
+#endif
diff --git a/llint/LLIntOffsetsExtractor.cpp b/llint/LLIntOffsetsExtractor.cpp
new file mode 100644
index 0000000..90e48b4
--- /dev/null
+++ b/llint/LLIntOffsetsExtractor.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2012, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "ArrayProfile.h"
+#include "CodeBlock.h"
+#include "CommonSlowPaths.h"
+#include "DirectArguments.h"
+#include "DirectEvalExecutable.h"
+#include "EvalExecutable.h"
+#include "Exception.h"
+#include "Heap.h"
+#include "IndirectEvalExecutable.h"
+#include "Interpreter.h"
+#include "JSArray.h"
+#include "JSArrayBufferView.h"
+#include "JSCell.h"
+#include "JSEnvironmentRecord.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSModuleRecord.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "JSTypeInfo.h"
+#include "JumpTable.h"
+#include "LLIntOfflineAsmConfig.h"
+#include "MarkedSpace.h"
+#include "NativeExecutable.h"
+#include "ProtoCallFrame.h"
+#include "ShadowChicken.h"
+#include "Structure.h"
+#include "StructureChain.h"
+#include "TypeProfiler.h"
+#include "TypeProfilerLog.h"
+#include "VM.h"
+#include "VMEntryRecord.h"
+#include "ValueProfile.h"
+#include "Watchdog.h"
+#include <wtf/text/StringImpl.h>
+
+namespace JSC {
+
+#define OFFLINE_ASM_OFFSETOF(clazz, field) (static_cast<unsigned>(OBJECT_OFFSETOF(clazz, field)))
+
+class LLIntOffsetsExtractor {
+public:
+    static const unsigned* dummy();
+};
+
+const unsigned* LLIntOffsetsExtractor::dummy()
+{
+// This is a file generated by offlineasm/generate_offsets_extractor.rb, and contains code
+// to create a table of offsets, sizes, and a header identifying what combination of
+// Platform.h macros we have set. We include it inside of a method on LLIntOffsetsExtractor
+// because the fields whose offsets we're extracting are mostly private. So we make their
+// classes friends with LLIntOffsetsExtractor, and include the header here, to get the C++
+// compiler to kindly step aside and yield to our best intentions.
+#include "LLIntDesiredOffsets.h"
+    return extractorTable;
+}
+
+} // namespace JSC
+
+int main(int, char**)
+{
+    // Out of an abundance of caution, make sure that LLIntOffsetsExtractor::dummy() is live,
+    // and the extractorTable is live, too.
+    printf("%p\n", JSC::LLIntOffsetsExtractor::dummy());
+    return 0;
+}
+
+
diff --git a/llint/LLIntOpcode.h b/llint/LLIntOpcode.h
new file mode 100644
index 0000000..85905e3
--- /dev/null
+++ b/llint/LLIntOpcode.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if !ENABLE(JIT)
+
+#define FOR_EACH_LLINT_NOJIT_NATIVE_HELPER(macro) \
+    FOR_EACH_CLOOP_BYTECODE_HELPER_ID(macro)
+
+#else // ENABLE(JIT)
+
+#define FOR_EACH_LLINT_NOJIT_NATIVE_HELPER(macro) \
+    // Nothing to do here. Use the JIT impl instead.
+
+#endif // !ENABLE(JIT)
+
+
+#define FOR_EACH_LLINT_NATIVE_HELPER(macro) \
+    FOR_EACH_LLINT_NOJIT_NATIVE_HELPER(macro) \
+    \
+    FOR_EACH_BYTECODE_HELPER_ID(macro)
+
+
+#define FOR_EACH_LLINT_OPCODE_EXTENSION(macro) FOR_EACH_LLINT_NATIVE_HELPER(macro)
diff --git a/llint/LLIntPCRanges.h b/llint/LLIntPCRanges.h
new file mode 100644
index 0000000..a24a9c0
--- /dev/null
+++ b/llint/LLIntPCRanges.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+namespace LLInt {
+
+// These are used just to denote where LLInt code begins and where it ends.
+extern "C" {
+    void llintPCRangeStart();
+    void llintPCRangeEnd();
+}
+
+ALWAYS_INLINE bool isLLIntPC(void* pc)
+{
+    uintptr_t pcAsInt = bitwise_cast<uintptr_t>(pc);
+    uintptr_t llintStart = bitwise_cast<uintptr_t>(llintPCRangeStart);
+    uintptr_t llintEnd = bitwise_cast<uintptr_t>(llintPCRangeEnd);
+    RELEASE_ASSERT(llintStart < llintEnd);
+    return llintStart <= pcAsInt && pcAsInt <= llintEnd;
+}
+
+#if ENABLE(JIT)
+static const GPRReg LLIntPC = GPRInfo::regT4;
+#endif
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntSlowPaths.cpp b/llint/LLIntSlowPaths.cpp
new file mode 100644
index 0000000..55235a3
--- /dev/null
+++ b/llint/LLIntSlowPaths.cpp
@@ -0,0 +1,1684 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntSlowPaths.h"
+
+#include "ArrayConstructor.h"
+#include "CallFrame.h"
+#include "CommonSlowPaths.h"
+#include "CommonSlowPathsExceptions.h"
+#include "Error.h"
+#include "ErrorHandlingScope.h"
+#include "EvalCodeBlock.h"
+#include "Exception.h"
+#include "ExceptionFuzz.h"
+#include "FunctionCodeBlock.h"
+#include "FunctionWhitelist.h"
+#include "GetterSetter.h"
+#include "HostCallReturnValue.h"
+#include "Interpreter.h"
+#include "IteratorOperations.h"
+#include "JIT.h"
+#include "JITExceptions.h"
+#include "JITWorklist.h"
+#include "JSAsyncFunction.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSFixedArray.h"
+#include "JSGeneratorFunction.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSLexicalEnvironment.h"
+#include "JSString.h"
+#include "JSWithScope.h"
+#include "LLIntCommon.h"
+#include "LLIntData.h"
+#include "LLIntExceptions.h"
+#include "LowLevelInterpreter.h"
+#include "ModuleProgramCodeBlock.h"
+#include "ObjectConstructor.h"
+#include "ObjectPropertyConditionSet.h"
+#include "ProgramCodeBlock.h"
+#include "ProtoCallFrame.h"
+#include "RegExpObject.h"
+#include "ShadowChicken.h"
+#include "StructureRareDataInlines.h"
+#include "VMInlines.h"
+#include <wtf/NeverDestroyed.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace LLInt {
+
+#define LLINT_BEGIN_NO_SET_PC() \
+    VM& vm = exec->vm();      \
+    NativeCallFrameTracer tracer(&vm, exec); \
+    auto throwScope = DECLARE_THROW_SCOPE(vm)
+
+#ifndef NDEBUG
+#define LLINT_SET_PC_FOR_STUBS() do { \
+        exec->codeBlock()->bytecodeOffset(pc); \
+        exec->setCurrentVPC(pc); \
+    } while (false)
+#else
+#define LLINT_SET_PC_FOR_STUBS() do { \
+        exec->setCurrentVPC(pc); \
+    } while (false)
+#endif
+
+#define LLINT_BEGIN()                           \
+    LLINT_BEGIN_NO_SET_PC();                    \
+    LLINT_SET_PC_FOR_STUBS()
+
+#define LLINT_OP(index) (exec->uncheckedR(pc[index].u.operand))
+#define LLINT_OP_C(index) (exec->r(pc[index].u.operand))
+
+#define LLINT_RETURN_TWO(first, second) do {       \
+        return encodeResult(first, second);        \
+    } while (false)
+
+#define LLINT_END_IMPL() LLINT_RETURN_TWO(pc, 0)
+
+#define LLINT_THROW(exceptionToThrow) do {                        \
+        throwException(exec, throwScope, exceptionToThrow);       \
+        pc = returnToThrow(exec);                                 \
+        LLINT_END_IMPL();                                         \
+    } while (false)
+
+#define LLINT_CHECK_EXCEPTION() do {                    \
+        doExceptionFuzzingIfEnabled(exec, throwScope, "LLIntSlowPaths", pc);    \
+        if (UNLIKELY(throwScope.exception())) {         \
+            pc = returnToThrow(exec);                   \
+            LLINT_END_IMPL();                           \
+        }                                               \
+    } while (false)
+
+#define LLINT_END() do {                        \
+        LLINT_CHECK_EXCEPTION();                \
+        LLINT_END_IMPL();                       \
+    } while (false)
+
+#define LLINT_BRANCH(opcode, condition) do {                      \
+        bool __b_condition = (condition);                         \
+        LLINT_CHECK_EXCEPTION();                                  \
+        if (__b_condition)                                        \
+            pc += pc[OPCODE_LENGTH(opcode) - 1].u.operand;        \
+        else                                                      \
+            pc += OPCODE_LENGTH(opcode);                          \
+        LLINT_END_IMPL();                                         \
+    } while (false)
+
+#define LLINT_RETURN(value) do {                \
+        JSValue __r_returnValue = (value);      \
+        LLINT_CHECK_EXCEPTION();                \
+        LLINT_OP(1) = __r_returnValue;          \
+        LLINT_END_IMPL();                       \
+    } while (false)
+
+#define LLINT_RETURN_WITH_PC_ADJUSTMENT(value, pcAdjustment) do { \
+        JSValue __r_returnValue = (value);      \
+        LLINT_CHECK_EXCEPTION();                \
+        LLINT_OP(1) = __r_returnValue;          \
+        pc += (pcAdjustment);                   \
+        LLINT_END_IMPL();                       \
+    } while (false)
+
+#define LLINT_RETURN_PROFILED(opcode, value) do {               \
+        JSValue __rp_returnValue = (value);                     \
+        LLINT_CHECK_EXCEPTION();                                \
+        LLINT_OP(1) = __rp_returnValue;                         \
+        LLINT_PROFILE_VALUE(opcode, __rp_returnValue);          \
+        LLINT_END_IMPL();                                       \
+    } while (false)
+
+#define LLINT_PROFILE_VALUE(opcode, value) do { \
+        pc[OPCODE_LENGTH(opcode) - 1].u.profile->m_buckets[0] = \
+        JSValue::encode(value);                  \
+    } while (false)
+
+#define LLINT_CALL_END_IMPL(exec, callTarget) LLINT_RETURN_TWO((callTarget), (exec))
+
+#define LLINT_CALL_THROW(exec, exceptionToThrow) do {                   \
+        ExecState* __ct_exec = (exec);                                  \
+        throwException(__ct_exec, throwScope, exceptionToThrow);        \
+        LLINT_CALL_END_IMPL(0, callToThrow(__ct_exec));                 \
+    } while (false)
+
+#define LLINT_CALL_CHECK_EXCEPTION(exec, execCallee) do {               \
+        ExecState* __cce_exec = (exec);                                 \
+        ExecState* __cce_execCallee = (execCallee);                     \
+        doExceptionFuzzingIfEnabled(__cce_exec, throwScope, "LLIntSlowPaths/call", nullptr); \
+        if (UNLIKELY(throwScope.exception()))                           \
+            LLINT_CALL_END_IMPL(0, callToThrow(__cce_execCallee));      \
+    } while (false)
+
+#define LLINT_CALL_RETURN(exec, execCallee, callTarget) do {            \
+        ExecState* __cr_exec = (exec);                                  \
+        ExecState* __cr_execCallee = (execCallee);                      \
+        void* __cr_callTarget = (callTarget);                           \
+        LLINT_CALL_CHECK_EXCEPTION(__cr_exec, __cr_execCallee);         \
+        LLINT_CALL_END_IMPL(__cr_execCallee, __cr_callTarget);          \
+    } while (false)
+
+#define LLINT_RETURN_CALLEE_FRAME(execCallee) do {                      \
+        ExecState* __rcf_exec = (execCallee);                           \
+        LLINT_RETURN_TWO(pc, __rcf_exec);                               \
+    } while (false)
+    
+extern "C" SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
+{
+    LLINT_BEGIN();
+    dataLogF("%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d\n",
+            exec->codeBlock(),
+            exec,
+            static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
+            exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
+            fromWhere,
+            operand,
+            pc[operand].u.operand);
+    LLINT_END();
+}
+
+extern "C" SlowPathReturnType llint_trace_value(ExecState* exec, Instruction* pc, int fromWhere, int operand)
+{
+    JSValue value = LLINT_OP_C(operand).jsValue();
+    union {
+        struct {
+            uint32_t tag;
+            uint32_t payload;
+        } bits;
+        EncodedJSValue asValue;
+    } u;
+    u.asValue = JSValue::encode(value);
+    dataLogF(
+        "%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d: %08x:%08x: %s\n",
+        exec->codeBlock(),
+        exec,
+        static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
+        exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
+        fromWhere,
+        operand,
+        pc[operand].u.operand,
+        u.bits.tag,
+        u.bits.payload,
+        toCString(value).data());
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(trace_prologue)
+{
+    dataLogF("%p / %p: in prologue.\n", exec->codeBlock(), exec);
+    LLINT_END_IMPL();
+}
+
+static void traceFunctionPrologue(ExecState* exec, const char* comment, CodeSpecializationKind kind)
+{
+    JSFunction* callee = jsCast<JSFunction*>(exec->jsCallee());
+    FunctionExecutable* executable = callee->jsExecutable();
+    CodeBlock* codeBlock = executable->codeBlockFor(kind);
+    dataLogF("%p / %p: in %s of function %p, executable %p; numVars = %u, numParameters = %u, numCalleeLocals = %u, caller = %p.\n",
+            codeBlock, exec, comment, callee, executable,
+            codeBlock->m_numVars, codeBlock->numParameters(), codeBlock->m_numCalleeLocals,
+            exec->callerFrame());
+}
+
+LLINT_SLOW_PATH_DECL(trace_prologue_function_for_call)
+{
+    traceFunctionPrologue(exec, "call prologue", CodeForCall);
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(trace_prologue_function_for_construct)
+{
+    traceFunctionPrologue(exec, "construct prologue", CodeForConstruct);
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(trace_arityCheck_for_call)
+{
+    traceFunctionPrologue(exec, "call arity check", CodeForCall);
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(trace_arityCheck_for_construct)
+{
+    traceFunctionPrologue(exec, "construct arity check", CodeForConstruct);
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(trace)
+{
+    dataLogF("%p / %p: executing bc#%zu, %s, pc = %p\n",
+            exec->codeBlock(),
+            exec,
+            static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
+            opcodeNames[exec->vm().interpreter->getOpcodeID(pc[0].u.opcode)], pc);
+    if (exec->vm().interpreter->getOpcodeID(pc[0].u.opcode) == op_enter) {
+        dataLogF("Frame will eventually return to %p\n", exec->returnPC().value());
+        *bitwise_cast<volatile char*>(exec->returnPC().value());
+    }
+    if (exec->vm().interpreter->getOpcodeID(pc[0].u.opcode) == op_ret) {
+        dataLogF("Will be returning to %p\n", exec->returnPC().value());
+        dataLogF("The new cfr will be %p\n", exec->callerFrame());
+    }
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(special_trace)
+{
+    dataLogF("%p / %p: executing special case bc#%zu, op#%u, return PC is %p\n",
+            exec->codeBlock(),
+            exec,
+            static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
+            exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
+            exec->returnPC().value());
+    LLINT_END_IMPL();
+}
+
+enum EntryKind { Prologue, ArityCheck };
+
+#if ENABLE(JIT)
+static FunctionWhitelist& ensureGlobalJITWhitelist()
+{
+    static LazyNeverDestroyed<FunctionWhitelist> baselineWhitelist;
+    static std::once_flag initializeWhitelistFlag;
+    std::call_once(initializeWhitelistFlag, [] {
+        const char* functionWhitelistFile = Options::jitWhitelist();
+        baselineWhitelist.construct(functionWhitelistFile);
+    });
+    return baselineWhitelist;
+}
+
+inline bool shouldJIT(ExecState* exec, CodeBlock* codeBlock)
+{
+    if (!Options::bytecodeRangeToJITCompile().isInRange(codeBlock->instructionCount())
+        || !ensureGlobalJITWhitelist().contains(codeBlock))
+        return false;
+
+    // You can modify this to turn off JITting without rebuilding the world.
+    return exec->vm().canUseJIT();
+}
+
+// Returns true if we should try to OSR.
+inline bool jitCompileAndSetHeuristics(CodeBlock* codeBlock, ExecState* exec, unsigned loopOSREntryBytecodeOffset = 0)
+{
+    VM& vm = exec->vm();
+    DeferGCForAWhile deferGC(vm.heap); // My callers don't set top callframe, so we don't want to GC here at all.
+    
+    codeBlock->updateAllValueProfilePredictions();
+
+    if (!codeBlock->checkIfJITThresholdReached()) {
+        CODEBLOCK_LOG_EVENT(codeBlock, "delayJITCompile", ("threshold not reached, counter = ", codeBlock->llintExecuteCounter()));
+        if (Options::verboseOSR())
+            dataLogF("    JIT threshold should be lifted.\n");
+        return false;
+    }
+    
+    JITWorklist::instance()->poll(vm);
+    
+    switch (codeBlock->jitType()) {
+    case JITCode::BaselineJIT: {
+        if (Options::verboseOSR())
+            dataLogF("    Code was already compiled.\n");
+        codeBlock->jitSoon();
+        return true;
+    }
+    case JITCode::InterpreterThunk: {
+        JITWorklist::instance()->compileLater(codeBlock, loopOSREntryBytecodeOffset);
+        return codeBlock->jitType() == JITCode::BaselineJIT;
+    }
+    default:
+        dataLog("Unexpected code block in LLInt: ", *codeBlock, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
+static SlowPathReturnType entryOSR(ExecState* exec, Instruction*, CodeBlock* codeBlock, const char *name, EntryKind kind)
+{
+    if (Options::verboseOSR()) {
+        dataLog(
+            *codeBlock, ": Entered ", name, " with executeCounter = ",
+            codeBlock->llintExecuteCounter(), "\n");
+    }
+    
+    if (!shouldJIT(exec, codeBlock)) {
+        codeBlock->dontJITAnytimeSoon();
+        LLINT_RETURN_TWO(0, 0);
+    }
+    if (!jitCompileAndSetHeuristics(codeBlock, exec))
+        LLINT_RETURN_TWO(0, 0);
+    
+    CODEBLOCK_LOG_EVENT(codeBlock, "OSR entry", ("in prologue"));
+    
+    if (kind == Prologue)
+        LLINT_RETURN_TWO(codeBlock->jitCode()->executableAddress(), 0);
+    ASSERT(kind == ArityCheck);
+    LLINT_RETURN_TWO(codeBlock->jitCode()->addressForCall(MustCheckArity).executableAddress(), 0);
+}
+#else // ENABLE(JIT)
+static SlowPathReturnType entryOSR(ExecState* exec, Instruction*, CodeBlock* codeBlock, const char*, EntryKind)
+{
+    codeBlock->dontJITAnytimeSoon();
+    LLINT_RETURN_TWO(0, exec);
+}
+#endif // ENABLE(JIT)
+
+LLINT_SLOW_PATH_DECL(entry_osr)
+{
+    return entryOSR(exec, pc, exec->codeBlock(), "entry_osr", Prologue);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_call)
+{
+    return entryOSR(exec, pc, jsCast<JSFunction*>(exec->jsCallee())->jsExecutable()->codeBlockForCall(), "entry_osr_function_for_call", Prologue);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct)
+{
+    return entryOSR(exec, pc, jsCast<JSFunction*>(exec->jsCallee())->jsExecutable()->codeBlockForConstruct(), "entry_osr_function_for_construct", Prologue);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_call_arityCheck)
+{
+    return entryOSR(exec, pc, jsCast<JSFunction*>(exec->jsCallee())->jsExecutable()->codeBlockForCall(), "entry_osr_function_for_call_arityCheck", ArityCheck);
+}
+
+LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct_arityCheck)
+{
+    return entryOSR(exec, pc, jsCast<JSFunction*>(exec->jsCallee())->jsExecutable()->codeBlockForConstruct(), "entry_osr_function_for_construct_arityCheck", ArityCheck);
+}
+
+LLINT_SLOW_PATH_DECL(loop_osr)
+{
+    CodeBlock* codeBlock = exec->codeBlock();
+
+#if ENABLE(JIT)
+    if (Options::verboseOSR()) {
+        dataLog(
+            *codeBlock, ": Entered loop_osr with executeCounter = ",
+            codeBlock->llintExecuteCounter(), "\n");
+    }
+    
+    unsigned loopOSREntryBytecodeOffset = pc - codeBlock->instructions().begin();
+
+    if (!shouldJIT(exec, codeBlock)) {
+        codeBlock->dontJITAnytimeSoon();
+        LLINT_RETURN_TWO(0, 0);
+    }
+    
+    if (!jitCompileAndSetHeuristics(codeBlock, exec, loopOSREntryBytecodeOffset))
+        LLINT_RETURN_TWO(0, 0);
+    
+    CODEBLOCK_LOG_EVENT(codeBlock, "osrEntry", ("at bc#", pc - codeBlock->instructions().begin()));
+
+    ASSERT(codeBlock->jitType() == JITCode::BaselineJIT);
+    
+    Vector<BytecodeAndMachineOffset> map;
+    codeBlock->jitCodeMap()->decode(map);
+    BytecodeAndMachineOffset* mapping = binarySearch<BytecodeAndMachineOffset, unsigned>(map, map.size(), pc - codeBlock->instructions().begin(), BytecodeAndMachineOffset::getBytecodeIndex);
+    ASSERT(mapping);
+    ASSERT(mapping->m_bytecodeIndex == static_cast<unsigned>(pc - codeBlock->instructions().begin()));
+    
+    void* jumpTarget = codeBlock->jitCode()->executableAddressAtOffset(mapping->m_machineCodeOffset);
+    ASSERT(jumpTarget);
+    
+    LLINT_RETURN_TWO(jumpTarget, exec->topOfFrame());
+#else // ENABLE(JIT)
+    UNUSED_PARAM(pc);
+    codeBlock->dontJITAnytimeSoon();
+    LLINT_RETURN_TWO(0, 0);
+#endif // ENABLE(JIT)
+}
+
+LLINT_SLOW_PATH_DECL(replace)
+{
+    CodeBlock* codeBlock = exec->codeBlock();
+
+#if ENABLE(JIT)
+    if (Options::verboseOSR()) {
+        dataLog(
+            *codeBlock, ": Entered replace with executeCounter = ",
+            codeBlock->llintExecuteCounter(), "\n");
+    }
+    
+    if (shouldJIT(exec, codeBlock))
+        jitCompileAndSetHeuristics(codeBlock, exec);
+    else
+        codeBlock->dontJITAnytimeSoon();
+    LLINT_END_IMPL();
+#else // ENABLE(JIT)
+    codeBlock->dontJITAnytimeSoon();
+    LLINT_END_IMPL();
+#endif // ENABLE(JIT)
+}
+
+LLINT_SLOW_PATH_DECL(stack_check)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    VMEntryFrame* vmEntryFrame = vm.topVMEntryFrame;
+    CallFrame* callerFrame = exec->callerFrame(vmEntryFrame);
+    if (!callerFrame) {
+        callerFrame = exec;
+        vmEntryFrame = vm.topVMEntryFrame;
+    }
+    NativeCallFrameTracerWithRestore tracer(&vm, vmEntryFrame, callerFrame);
+
+    LLINT_SET_PC_FOR_STUBS();
+
+#if LLINT_SLOW_PATH_TRACING
+    dataLogF("Checking stack height with exec = %p.\n", exec);
+    dataLogF("CodeBlock = %p.\n", exec->codeBlock());
+    dataLogF("Num callee registers = %u.\n", exec->codeBlock()->m_numCalleeLocals);
+    dataLogF("Num vars = %u.\n", exec->codeBlock()->m_numVars);
+
+    dataLogF("Current OS stack end is at %p.\n", vm.softStackLimit());
+#if !ENABLE(JIT)
+    dataLogF("Current C Loop stack end is at %p.\n", vm.cloopStackLimit());
+#endif
+
+#endif
+    // If the stack check succeeds and we don't need to throw the error, then
+    // we'll return 0 instead. The prologue will check for a non-zero value
+    // when determining whether to set the callFrame or not.
+
+    // For JIT enabled builds which uses the C stack, the stack is not growable.
+    // Hence, if we get here, then we know a stack overflow is imminent. So, just
+    // throw the StackOverflowError unconditionally.
+#if !ENABLE(JIT)
+    ASSERT(!vm.interpreter->cloopStack().containsAddress(exec->topOfFrame()));
+    if (LIKELY(vm.ensureStackCapacityFor(exec->topOfFrame())))
+        LLINT_RETURN_TWO(pc, 0);
+#endif
+
+    ErrorHandlingScope errorScope(vm);
+    throwStackOverflowError(callerFrame, throwScope);
+    pc = returnToThrow(callerFrame);
+    LLINT_RETURN_TWO(pc, exec);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_object)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(constructEmptyObject(exec, pc[3].u.objectAllocationProfile->structure()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_array)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(constructArrayNegativeIndexed(exec, pc[4].u.arrayAllocationProfile, bitwise_cast<JSValue*>(&LLINT_OP(2)), pc[3].u.operand));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_array_with_size)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(constructArrayWithSizeQuirk(exec, pc[3].u.arrayAllocationProfile, exec->lexicalGlobalObject(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_array_buffer)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(constructArray(exec, pc[4].u.arrayAllocationProfile, exec->codeBlock()->constantBuffer(pc[2].u.operand), pc[3].u.operand));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_regexp)
+{
+    LLINT_BEGIN();
+    RegExp* regExp = exec->codeBlock()->regexp(pc[2].u.operand);
+    if (!regExp->isValid())
+        LLINT_THROW(createSyntaxError(exec, regExp->errorMessage()));
+    LLINT_RETURN(RegExpObject::create(vm, exec->lexicalGlobalObject()->regExpStructure(), regExp));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_instanceof)
+{
+    LLINT_BEGIN();
+    JSValue value = LLINT_OP_C(2).jsValue();
+    JSValue proto = LLINT_OP_C(3).jsValue();
+    LLINT_RETURN(jsBoolean(JSObject::defaultHasInstance(exec, value, proto)));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_instanceof_custom)
+{
+    LLINT_BEGIN();
+
+    JSValue value = LLINT_OP_C(2).jsValue();
+    JSValue constructor = LLINT_OP_C(3).jsValue();
+    JSValue hasInstanceValue = LLINT_OP_C(4).jsValue();
+
+    ASSERT(constructor.isObject());
+    ASSERT(hasInstanceValue != exec->lexicalGlobalObject()->functionProtoHasInstanceSymbolFunction() || !constructor.getObject()->structure()->typeInfo().implementsDefaultHasInstance());
+
+    JSValue result = jsBoolean(constructor.getObject()->hasInstance(exec, value, hasInstanceValue));
+    LLINT_RETURN(result);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_try_get_by_id)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
+    JSValue baseValue = LLINT_OP_C(2).jsValue();
+    PropertySlot slot(baseValue, PropertySlot::PropertySlot::InternalMethodType::VMInquiry);
+
+    baseValue.getPropertySlot(exec, ident, slot);
+    JSValue result = slot.getPureResult();
+
+    LLINT_RETURN_PROFILED(op_try_get_by_id, result);
+}
+
+static void setupGetByIdPrototypeCache(ExecState* exec, VM& vm, Instruction* pc, JSCell* baseCell, PropertySlot& slot, const Identifier& ident)
+{
+    CodeBlock* codeBlock = exec->codeBlock();
+    Structure* structure = baseCell->structure();
+
+    if (structure->typeInfo().prohibitsPropertyCaching())
+        return;
+    
+    if (structure->needImpurePropertyWatchpoint())
+        return;
+
+    if (structure->isDictionary()) {
+        if (structure->hasBeenFlattenedBefore())
+            return;
+        structure->flattenDictionaryStructure(vm, jsCast<JSObject*>(baseCell));
+    }
+
+    ObjectPropertyConditionSet conditions;
+    if (slot.isUnset())
+        conditions = generateConditionsForPropertyMiss(vm, codeBlock, exec, structure, ident.impl());
+    else
+        conditions = generateConditionsForPrototypePropertyHit(vm, codeBlock, exec, structure, slot.slotBase(), ident.impl());
+
+    if (!conditions.isValid())
+        return;
+
+    PropertyOffset offset = invalidOffset;
+    CodeBlock::StructureWatchpointMap& watchpointMap = codeBlock->llintGetByIdWatchpointMap();
+    auto result = watchpointMap.add(structure, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>());
+    for (ObjectPropertyCondition condition : conditions) {
+        if (!condition.isWatchable())
+            return;
+        if (condition.condition().kind() == PropertyCondition::Presence)
+            offset = condition.condition().offset();
+        result.iterator->value.add(condition, pc)->install();
+    }
+    ASSERT((offset == invalidOffset) == slot.isUnset());
+
+    ConcurrentJSLocker locker(codeBlock->m_lock);
+
+    if (slot.isUnset()) {
+        pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_unset);
+        pc[4].u.structureID = structure->id();
+        return;
+    }
+    ASSERT(slot.isValue());
+
+    pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_proto_load);
+    pc[4].u.structureID = structure->id();
+    pc[5].u.operand = offset;
+    // We know that this pointer will remain valid because it will be cleared by either a watchpoint fire or
+    // during GC when we clear the LLInt caches.
+    pc[6].u.pointer = slot.slotBase();
+}
+
+
+LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
+    JSValue baseValue = LLINT_OP_C(2).jsValue();
+    PropertySlot slot(baseValue, PropertySlot::PropertySlot::InternalMethodType::Get);
+
+    JSValue result = baseValue.get(exec, ident, slot);
+    LLINT_CHECK_EXCEPTION();
+    LLINT_OP(1) = result;
+    
+    if (!LLINT_ALWAYS_ACCESS_SLOW
+        && baseValue.isCell()
+        && slot.isCacheable()) {
+
+        JSCell* baseCell = baseValue.asCell();
+        Structure* structure = baseCell->structure();
+        if (slot.isValue() && slot.slotBase() == baseValue) {
+            // Start out by clearing out the old cache.
+            pc[0].u.opcode = LLInt::getOpcode(op_get_by_id);
+            pc[4].u.pointer = nullptr; // old structure
+            pc[5].u.pointer = nullptr; // offset
+
+            // Prevent the prototype cache from ever happening.
+            pc[7].u.operand = 0;
+        
+            if (structure->propertyAccessesAreCacheable()) {
+                vm.heap.writeBarrier(codeBlock);
+                
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+
+                pc[4].u.structureID = structure->id();
+                pc[5].u.operand = slot.cachedOffset();
+            }
+        } else if (UNLIKELY(pc[7].u.operand && (slot.isValue() || slot.isUnset()))) {
+            ASSERT(slot.slotBase() != baseValue);
+
+            if (!(--pc[7].u.operand))
+                setupGetByIdPrototypeCache(exec, vm, pc, baseCell, slot, ident);
+        }
+    } else if (!LLINT_ALWAYS_ACCESS_SLOW
+        && isJSArray(baseValue)
+        && ident == exec->propertyNames().length) {
+        pc[0].u.opcode = LLInt::getOpcode(op_get_array_length);
+        ArrayProfile* arrayProfile = codeBlock->getOrAddArrayProfile(pc - codeBlock->instructions().begin());
+        arrayProfile->observeStructure(baseValue.asCell()->structure());
+        pc[4].u.arrayProfile = arrayProfile;
+
+        // Prevent the prototype cache from ever happening.
+        pc[7].u.operand = 0;
+    }
+
+    pc[OPCODE_LENGTH(op_get_by_id) - 1].u.profile->m_buckets[0] = JSValue::encode(result);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_arguments_length)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
+    JSValue baseValue = LLINT_OP(2).jsValue();
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
+    LLINT_RETURN(baseValue.get(exec, ident, slot));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
+    
+    JSValue baseValue = LLINT_OP_C(1).jsValue();
+    PutPropertySlot slot(baseValue, codeBlock->isStrictMode(), codeBlock->putByIdContext());
+    if (pc[8].u.putByIdFlags & PutByIdIsDirect)
+        asObject(baseValue)->putDirect(vm, ident, LLINT_OP_C(3).jsValue(), slot);
+    else
+        baseValue.putInline(exec, ident, LLINT_OP_C(3).jsValue(), slot);
+    LLINT_CHECK_EXCEPTION();
+    
+    if (!LLINT_ALWAYS_ACCESS_SLOW
+        && baseValue.isCell()
+        && slot.isCacheablePut()) {
+
+        // Start out by clearing out the old cache.
+        pc[4].u.pointer = nullptr; // old structure
+        pc[5].u.pointer = nullptr; // offset
+        pc[6].u.pointer = nullptr; // new structure
+        pc[7].u.pointer = nullptr; // structure chain
+        pc[8].u.putByIdFlags =
+            static_cast<PutByIdFlags>(pc[8].u.putByIdFlags & PutByIdPersistentFlagsMask);
+        
+        JSCell* baseCell = baseValue.asCell();
+        Structure* structure = baseCell->structure();
+        
+        if (!structure->isUncacheableDictionary()
+            && !structure->typeInfo().prohibitsPropertyCaching()
+            && baseCell == slot.base()) {
+
+            vm.heap.writeBarrier(codeBlock);
+            
+            if (slot.type() == PutPropertySlot::NewProperty) {
+                GCSafeConcurrentJSLocker locker(codeBlock->m_lock, vm.heap);
+            
+                if (!structure->isDictionary() && structure->previousID()->outOfLineCapacity() == structure->outOfLineCapacity()) {
+                    ASSERT(structure->previousID()->transitionWatchpointSetHasBeenInvalidated());
+
+                    if (normalizePrototypeChain(exec, structure) != InvalidPrototypeChain) {
+                        ASSERT(structure->previousID()->isObject());
+                        pc[4].u.structureID = structure->previousID()->id();
+                        pc[5].u.operand = slot.cachedOffset();
+                        pc[6].u.structureID = structure->id();
+                        if (!(pc[8].u.putByIdFlags & PutByIdIsDirect)) {
+                            StructureChain* chain = structure->prototypeChain(exec);
+                            ASSERT(chain);
+                            pc[7].u.structureChain.set(
+                                vm, codeBlock, chain);
+                        }
+                        pc[8].u.putByIdFlags = static_cast<PutByIdFlags>(
+                            pc[8].u.putByIdFlags |
+                            structure->inferredTypeDescriptorFor(ident.impl()).putByIdFlags());
+                    }
+                }
+            } else {
+                structure->didCachePropertyReplacement(vm, slot.cachedOffset());
+                pc[4].u.structureID = structure->id();
+                pc[5].u.operand = slot.cachedOffset();
+                pc[8].u.putByIdFlags = static_cast<PutByIdFlags>(
+                    pc[8].u.putByIdFlags |
+                    structure->inferredTypeDescriptorFor(ident.impl()).putByIdFlags());
+            }
+        }
+    }
+    
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_del_by_id)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSObject* baseObject = LLINT_OP_C(2).jsValue().toObject(exec);
+    LLINT_CHECK_EXCEPTION();
+    bool couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
+    LLINT_CHECK_EXCEPTION();
+    if (!couldDelete && codeBlock->isStrictMode())
+        LLINT_THROW(createTypeError(exec, UnableToDeletePropertyError));
+    LLINT_RETURN(jsBoolean(couldDelete));
+}
+
+static ALWAYS_INLINE JSValue getByVal(VM& vm, ExecState* exec, JSValue baseValue, JSValue subscript)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (LIKELY(baseValue.isCell() && subscript.isString())) {
+        Structure& structure = *baseValue.asCell()->structure(vm);
+        if (JSCell::canUseFastGetOwnProperty(structure)) {
+            if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
+                if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
+                    return result;
+            }
+        }
+    }
+    
+    if (subscript.isUInt32()) {
+        uint32_t i = subscript.asUInt32();
+        if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
+            return asString(baseValue)->getIndex(exec, i);
+        scope.release();
+        return baseValue.get(exec, i);
+    }
+
+    baseValue.requireObjectCoercible(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    auto property = subscript.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    scope.release();
+    return baseValue.get(exec, property);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_by_val)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN_PROFILED(op_get_by_val, getByVal(vm, exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_by_val)
+{
+    LLINT_BEGIN();
+    
+    JSValue baseValue = LLINT_OP_C(1).jsValue();
+    JSValue subscript = LLINT_OP_C(2).jsValue();
+    JSValue value = LLINT_OP_C(3).jsValue();
+    bool isStrictMode = exec->codeBlock()->isStrictMode();
+    
+    if (LIKELY(subscript.isUInt32())) {
+        uint32_t i = subscript.asUInt32();
+        if (baseValue.isObject()) {
+            JSObject* object = asObject(baseValue);
+            if (object->canSetIndexQuickly(i))
+                object->setIndexQuickly(vm, i, value);
+            else
+                object->methodTable()->putByIndex(object, exec, i, value, isStrictMode);
+            LLINT_END();
+        }
+        baseValue.putByIndex(exec, i, value, isStrictMode);
+        LLINT_END();
+    }
+
+    auto property = subscript.toPropertyKey(exec);
+    LLINT_CHECK_EXCEPTION();
+    PutPropertySlot slot(baseValue, isStrictMode);
+    baseValue.put(exec, property, value, slot);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_by_val_direct)
+{
+    LLINT_BEGIN();
+    
+    JSValue baseValue = LLINT_OP_C(1).jsValue();
+    JSValue subscript = LLINT_OP_C(2).jsValue();
+    JSValue value = LLINT_OP_C(3).jsValue();
+    RELEASE_ASSERT(baseValue.isObject());
+    JSObject* baseObject = asObject(baseValue);
+    bool isStrictMode = exec->codeBlock()->isStrictMode();
+    if (LIKELY(subscript.isUInt32())) {
+        // Despite its name, JSValue::isUInt32 will return true only for positive boxed int32_t; all those values are valid array indices.
+        ASSERT(isIndex(subscript.asUInt32()));
+        baseObject->putDirectIndex(exec, subscript.asUInt32(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+        LLINT_END();
+    }
+
+    if (subscript.isDouble()) {
+        double subscriptAsDouble = subscript.asDouble();
+        uint32_t subscriptAsUInt32 = static_cast<uint32_t>(subscriptAsDouble);
+        if (subscriptAsDouble == subscriptAsUInt32 && isIndex(subscriptAsUInt32)) {
+            baseObject->putDirectIndex(exec, subscriptAsUInt32, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+            LLINT_END();
+        }
+    }
+
+    // Don't put to an object if toString threw an exception.
+    auto property = subscript.toPropertyKey(exec);
+    if (UNLIKELY(throwScope.exception()))
+        LLINT_END();
+
+    if (std::optional<uint32_t> index = parseIndex(property))
+        baseObject->putDirectIndex(exec, index.value(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+    else {
+        PutPropertySlot slot(baseObject, isStrictMode);
+        baseObject->putDirect(exec->vm(), property, value, slot);
+    }
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_del_by_val)
+{
+    LLINT_BEGIN();
+    JSValue baseValue = LLINT_OP_C(2).jsValue();
+    JSObject* baseObject = baseValue.toObject(exec);
+    LLINT_CHECK_EXCEPTION();
+
+    JSValue subscript = LLINT_OP_C(3).jsValue();
+    
+    bool couldDelete;
+    
+    uint32_t i;
+    if (subscript.getUInt32(i))
+        couldDelete = baseObject->methodTable()->deletePropertyByIndex(baseObject, exec, i);
+    else {
+        LLINT_CHECK_EXCEPTION();
+        auto property = subscript.toPropertyKey(exec);
+        LLINT_CHECK_EXCEPTION();
+        couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, property);
+    }
+    
+    if (!couldDelete && exec->codeBlock()->isStrictMode())
+        LLINT_THROW(createTypeError(exec, UnableToDeletePropertyError));
+    
+    LLINT_RETURN(jsBoolean(couldDelete));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_by_index)
+{
+    LLINT_BEGIN();
+    JSValue arrayValue = LLINT_OP_C(1).jsValue();
+    ASSERT(isJSArray(arrayValue));
+    asArray(arrayValue)->putDirectIndex(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue());
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_getter_by_id)
+{
+    LLINT_BEGIN();
+    ASSERT(LLINT_OP(1).jsValue().isObject());
+    JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
+
+    unsigned options = pc[3].u.operand;
+
+    JSValue getter = LLINT_OP(4).jsValue();
+    ASSERT(getter.isObject());
+
+    baseObj->putGetter(exec, exec->codeBlock()->identifier(pc[2].u.operand), asObject(getter), options);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_setter_by_id)
+{
+    LLINT_BEGIN();
+    ASSERT(LLINT_OP(1).jsValue().isObject());
+    JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
+
+    unsigned options = pc[3].u.operand;
+
+    JSValue setter = LLINT_OP(4).jsValue();
+    ASSERT(setter.isObject());
+
+    baseObj->putSetter(exec, exec->codeBlock()->identifier(pc[2].u.operand), asObject(setter), options);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_getter_setter_by_id)
+{
+    LLINT_BEGIN();
+    ASSERT(LLINT_OP(1).jsValue().isObject());
+    JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
+    
+    GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
+    LLINT_CHECK_EXCEPTION();
+
+    JSValue getter = LLINT_OP(4).jsValue();
+    JSValue setter = LLINT_OP(5).jsValue();
+    ASSERT(getter.isObject() || getter.isUndefined());
+    ASSERT(setter.isObject() || setter.isUndefined());
+    ASSERT(getter.isObject() || setter.isObject());
+    
+    if (!getter.isUndefined())
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), asObject(getter));
+    if (!setter.isUndefined())
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), asObject(setter));
+    baseObj->putDirectAccessor(
+        exec,
+        exec->codeBlock()->identifier(pc[2].u.operand),
+        accessor, pc[3].u.operand);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_getter_by_val)
+{
+    LLINT_BEGIN();
+    ASSERT(LLINT_OP(1).jsValue().isObject());
+    JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
+    JSValue subscript = LLINT_OP_C(2).jsValue();
+
+    unsigned options = pc[3].u.operand;
+
+    JSValue getter = LLINT_OP(4).jsValue();
+    ASSERT(getter.isObject());
+
+    auto property = subscript.toPropertyKey(exec);
+    LLINT_CHECK_EXCEPTION();
+
+    baseObj->putGetter(exec, property, asObject(getter), options);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_setter_by_val)
+{
+    LLINT_BEGIN();
+    ASSERT(LLINT_OP(1).jsValue().isObject());
+    JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
+    JSValue subscript = LLINT_OP_C(2).jsValue();
+
+    unsigned options = pc[3].u.operand;
+
+    JSValue setter = LLINT_OP(4).jsValue();
+    ASSERT(setter.isObject());
+
+    auto property = subscript.toPropertyKey(exec);
+    LLINT_CHECK_EXCEPTION();
+
+    baseObj->putSetter(exec, property, asObject(setter), options);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jtrue)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jtrue, LLINT_OP_C(1).jsValue().toBoolean(exec));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jfalse)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jfalse, !LLINT_OP_C(1).jsValue().toBoolean(exec));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jless)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jless, jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jnless)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jnless, !jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jgreater)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jgreater, jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jngreater)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jngreater, !jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jlesseq)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jlesseq, jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jnlesseq)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jnlesseq, !jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jgreatereq)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jgreatereq, jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_jngreatereq)
+{
+    LLINT_BEGIN();
+    LLINT_BRANCH(op_jngreatereq, !jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_switch_imm)
+{
+    LLINT_BEGIN();
+    JSValue scrutinee = LLINT_OP_C(3).jsValue();
+    ASSERT(scrutinee.isDouble());
+    double value = scrutinee.asDouble();
+    int32_t intValue = static_cast<int32_t>(value);
+    int defaultOffset = pc[2].u.operand;
+    if (value == intValue) {
+        CodeBlock* codeBlock = exec->codeBlock();
+        pc += codeBlock->switchJumpTable(pc[1].u.operand).offsetForValue(intValue, defaultOffset);
+    } else
+        pc += defaultOffset;
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_switch_char)
+{
+    LLINT_BEGIN();
+    JSValue scrutinee = LLINT_OP_C(3).jsValue();
+    ASSERT(scrutinee.isString());
+    JSString* string = asString(scrutinee);
+    ASSERT(string->length() == 1);
+    int defaultOffset = pc[2].u.operand;
+    StringImpl* impl = string->value(exec).impl();
+    CodeBlock* codeBlock = exec->codeBlock();
+    pc += codeBlock->switchJumpTable(pc[1].u.operand).offsetForValue((*impl)[0], defaultOffset);
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_switch_string)
+{
+    LLINT_BEGIN();
+    JSValue scrutinee = LLINT_OP_C(3).jsValue();
+    int defaultOffset = pc[2].u.operand;
+    if (!scrutinee.isString())
+        pc += defaultOffset;
+    else {
+        CodeBlock* codeBlock = exec->codeBlock();
+        pc += codeBlock->stringSwitchJumpTable(pc[1].u.operand).offsetForValue(asString(scrutinee)->value(exec).impl(), defaultOffset);
+    }
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_func)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
+#if LLINT_SLOW_PATH_TRACING
+    dataLogF("Creating function!\n");
+#endif
+    LLINT_RETURN(JSFunction::create(vm, codeBlock->functionDecl(pc[3].u.operand), scope));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_generator_func)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
+#if LLINT_SLOW_PATH_TRACING
+    dataLogF("Creating function!\n");
+#endif
+    LLINT_RETURN(JSGeneratorFunction::create(vm, codeBlock->functionDecl(pc[3].u.operand), scope));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_async_func)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
+#if LLINT_SLOW_PATH_TRACING
+    dataLogF("Creating async function!\n");
+#endif
+    LLINT_RETURN(JSAsyncFunction::create(vm, codeBlock->functionDecl(pc[3].u.operand), scope));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_func_exp)
+{
+    LLINT_BEGIN();
+    
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
+    FunctionExecutable* executable = codeBlock->functionExpr(pc[3].u.operand);
+    
+    LLINT_RETURN(JSFunction::create(vm, executable, scope));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_generator_func_exp)
+{
+    LLINT_BEGIN();
+
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
+    FunctionExecutable* executable = codeBlock->functionExpr(pc[3].u.operand);
+
+    LLINT_RETURN(JSGeneratorFunction::create(vm, executable, scope));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_new_async_func_exp)
+{
+    LLINT_BEGIN();
+    
+    CodeBlock* codeBlock = exec->codeBlock();
+    JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
+    FunctionExecutable* executable = codeBlock->functionExpr(pc[3].u.operand);
+    
+    LLINT_RETURN(JSAsyncFunction::create(vm, executable, scope));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_set_function_name)
+{
+    LLINT_BEGIN();
+    JSFunction* func = jsCast<JSFunction*>(LLINT_OP(1).Register::unboxedCell());
+    JSValue name = LLINT_OP_C(2).Register::jsValue();
+    func->setFunctionName(exec, name);
+    LLINT_END();
+}
+
+static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc, JSValue callee, CodeSpecializationKind kind)
+{
+    UNUSED_PARAM(pc);
+
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Performing host call.\n");
+#endif
+    
+    ExecState* exec = execCallee->callerFrame();
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    execCallee->setCodeBlock(0);
+    execCallee->clearReturnPC();
+
+    if (kind == CodeForCall) {
+        CallData callData;
+        CallType callType = getCallData(callee, callData);
+    
+        ASSERT(callType != CallType::JS);
+    
+        if (callType == CallType::Host) {
+            NativeCallFrameTracer tracer(&vm, execCallee);
+            execCallee->setCallee(asObject(callee));
+            vm.hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
+            
+            LLINT_CALL_RETURN(execCallee, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
+        }
+        
+#if LLINT_SLOW_PATH_TRACING
+        dataLog("Call callee is not a function: ", callee, "\n");
+#endif
+
+        ASSERT(callType == CallType::None);
+        LLINT_CALL_THROW(exec, createNotAFunctionError(exec, callee));
+    }
+
+    ASSERT(kind == CodeForConstruct);
+    
+    ConstructData constructData;
+    ConstructType constructType = getConstructData(callee, constructData);
+    
+    ASSERT(constructType != ConstructType::JS);
+    
+    if (constructType == ConstructType::Host) {
+        NativeCallFrameTracer tracer(&vm, execCallee);
+        execCallee->setCallee(asObject(callee));
+        vm.hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
+
+        LLINT_CALL_RETURN(execCallee, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
+    }
+    
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Constructor callee is not a function: ", callee, "\n");
+#endif
+
+    ASSERT(constructType == ConstructType::None);
+    LLINT_CALL_THROW(exec, createNotAConstructorError(exec, callee));
+}
+
+inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, CodeSpecializationKind kind, JSValue calleeAsValue, LLIntCallLinkInfo* callLinkInfo = 0)
+{
+    ExecState* exec = execCallee->callerFrame();
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+#if LLINT_SLOW_PATH_TRACING
+    dataLogF("Performing call with recorded PC = %p\n", exec->currentVPC());
+#endif
+    
+    JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
+    if (!calleeAsFunctionCell) {
+        throwScope.release();
+        return handleHostCall(execCallee, pc, calleeAsValue, kind);
+    }
+    JSFunction* callee = jsCast<JSFunction*>(calleeAsFunctionCell);
+    JSScope* scope = callee->scopeUnchecked();
+    ExecutableBase* executable = callee->executable();
+
+    MacroAssemblerCodePtr codePtr;
+    CodeBlock* codeBlock = 0;
+    if (executable->isHostFunction()) {
+        codePtr = executable->entrypointFor(kind, MustCheckArity);
+    } else {
+        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
+
+        if (!isCall(kind) && functionExecutable->constructAbility() == ConstructAbility::CannotConstruct)
+            LLINT_CALL_THROW(exec, createNotAConstructorError(exec, callee));
+
+        CodeBlock** codeBlockSlot = execCallee->addressOfCodeBlock();
+        JSObject* error = functionExecutable->prepareForExecution<FunctionExecutable>(vm, callee, scope, kind, *codeBlockSlot);
+        ASSERT(throwScope.exception() == error);
+        if (UNLIKELY(error))
+            LLINT_CALL_THROW(exec, error);
+        codeBlock = *codeBlockSlot;
+        ASSERT(codeBlock);
+        ArityCheckMode arity;
+        if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
+            arity = MustCheckArity;
+        else
+            arity = ArityCheckNotRequired;
+        codePtr = functionExecutable->entrypointFor(kind, arity);
+    }
+
+    ASSERT(!!codePtr);
+    
+    if (!LLINT_ALWAYS_ACCESS_SLOW && callLinkInfo) {
+        CodeBlock* callerCodeBlock = exec->codeBlock();
+
+        ConcurrentJSLocker locker(callerCodeBlock->m_lock);
+        
+        if (callLinkInfo->isOnList())
+            callLinkInfo->remove();
+        callLinkInfo->callee.set(vm, callerCodeBlock, callee);
+        callLinkInfo->lastSeenCallee.set(vm, callerCodeBlock, callee);
+        callLinkInfo->machineCodeTarget = codePtr;
+        if (codeBlock)
+            codeBlock->linkIncomingCall(exec, callLinkInfo);
+    }
+
+    LLINT_CALL_RETURN(exec, execCallee, codePtr.executableAddress());
+}
+
+inline SlowPathReturnType genericCall(ExecState* exec, Instruction* pc, CodeSpecializationKind kind)
+{
+    // This needs to:
+    // - Set up a call frame.
+    // - Figure out what to call and compile it if necessary.
+    // - If possible, link the call's inline cache.
+    // - Return a tuple of machine code address to call and the new call frame.
+    
+    JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
+    
+    ExecState* execCallee = exec - pc[4].u.operand;
+    
+    execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
+    execCallee->uncheckedR(CallFrameSlot::callee) = calleeAsValue;
+    execCallee->setCallerFrame(exec);
+    
+    ASSERT(pc[5].u.callLinkInfo);
+    return setUpCall(execCallee, pc, kind, calleeAsValue, pc[5].u.callLinkInfo);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_call)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    throwScope.release();
+    return genericCall(exec, pc, CodeForCall);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_construct)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    throwScope.release();
+    return genericCall(exec, pc, CodeForConstruct);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_size_frame_for_varargs)
+{
+    LLINT_BEGIN();
+    // This needs to:
+    // - Set up a call frame while respecting the variable arguments.
+    
+    unsigned numUsedStackSlots = -pc[5].u.operand;
+    unsigned length = sizeFrameForVarargs(exec, vm,
+        LLINT_OP_C(4).jsValue(), numUsedStackSlots, pc[6].u.operand);
+    LLINT_CALL_CHECK_EXCEPTION(exec, exec);
+    
+    ExecState* execCallee = calleeFrameForVarargs(exec, numUsedStackSlots, length + 1);
+    vm.varargsLength = length;
+    vm.newCallFrameReturnValue = execCallee;
+
+    LLINT_RETURN_CALLEE_FRAME(execCallee);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_size_frame_for_forward_arguments)
+{
+    LLINT_BEGIN();
+    // This needs to:
+    // - Set up a call frame with the same arguments as the current frame.
+
+    unsigned numUsedStackSlots = -pc[5].u.operand;
+
+    unsigned arguments = sizeFrameForForwardArguments(exec, vm, numUsedStackSlots);
+    LLINT_CALL_CHECK_EXCEPTION(exec, exec);
+
+    ExecState* execCallee = calleeFrameForVarargs(exec, numUsedStackSlots, arguments + 1);
+
+    vm.varargsLength = arguments;
+    vm.newCallFrameReturnValue = execCallee;
+
+    LLINT_RETURN_CALLEE_FRAME(execCallee);
+}
+
+enum class SetArgumentsWith {
+    Object,
+    CurrentArguments
+};
+
+inline SlowPathReturnType varargsSetup(ExecState* exec, Instruction* pc, CodeSpecializationKind kind, SetArgumentsWith set)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    // This needs to:
+    // - Figure out what to call and compile it if necessary.
+    // - Return a tuple of machine code address to call and the new call frame.
+
+    JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
+
+    ExecState* execCallee = vm.newCallFrameReturnValue;
+
+    if (set == SetArgumentsWith::Object) {
+        setupVarargsFrameAndSetThis(exec, execCallee, LLINT_OP_C(3).jsValue(), LLINT_OP_C(4).jsValue(), pc[6].u.operand, vm.varargsLength);
+        LLINT_CALL_CHECK_EXCEPTION(exec, exec);
+    } else
+        setupForwardArgumentsFrameAndSetThis(exec, execCallee, LLINT_OP_C(3).jsValue(), vm.varargsLength);
+
+    execCallee->setCallerFrame(exec);
+    execCallee->uncheckedR(CallFrameSlot::callee) = calleeAsValue;
+    exec->setCurrentVPC(pc);
+
+    throwScope.release();
+    return setUpCall(execCallee, pc, kind, calleeAsValue);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_call_varargs)
+{
+    return varargsSetup(exec, pc, CodeForCall, SetArgumentsWith::Object);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_tail_call_forward_arguments)
+{
+    return varargsSetup(exec, pc, CodeForCall, SetArgumentsWith::CurrentArguments);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_construct_varargs)
+{
+    return varargsSetup(exec, pc, CodeForConstruct, SetArgumentsWith::Object);
+}
+
+    
+LLINT_SLOW_PATH_DECL(slow_path_call_eval)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    JSValue calleeAsValue = LLINT_OP(2).jsValue();
+    
+    ExecState* execCallee = exec - pc[4].u.operand;
+    
+    execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
+    execCallee->setCallerFrame(exec);
+    execCallee->uncheckedR(CallFrameSlot::callee) = calleeAsValue;
+    execCallee->setReturnPC(LLInt::getCodePtr(llint_generic_return_point));
+    execCallee->setCodeBlock(0);
+    exec->setCurrentVPC(pc);
+    
+    if (!isHostFunction(calleeAsValue, globalFuncEval)) {
+        throwScope.release();
+        return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
+    }
+    
+    vm.hostCallReturnValue = eval(execCallee);
+    LLINT_CALL_RETURN(exec, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_strcat)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(jsStringFromRegisterArray(exec, &LLINT_OP(2), pc[3].u.operand));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_to_primitive)
+{
+    LLINT_BEGIN();
+    LLINT_RETURN(LLINT_OP_C(2).jsValue().toPrimitive(exec));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_throw)
+{
+    LLINT_BEGIN();
+    LLINT_THROW(LLINT_OP_C(1).jsValue());
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_handle_watchdog_timer)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    ASSERT(vm.watchdog());
+    if (UNLIKELY(vm.shouldTriggerTermination(exec)))
+        LLINT_THROW(createTerminatedExecutionException(&vm));
+    LLINT_RETURN_TWO(0, exec);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_debug)
+{
+    LLINT_BEGIN();
+    int debugHookType = pc[1].u.operand;
+    vm.interpreter->debug(exec, static_cast<DebugHookType>(debugHookType));
+    
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_handle_exception)
+{
+    LLINT_BEGIN_NO_SET_PC();
+    UNUSED_PARAM(throwScope);
+    genericUnwind(&vm, exec);
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_get_from_scope)
+{
+    LLINT_BEGIN();
+    const Identifier& ident = exec->codeBlock()->identifier(pc[3].u.operand);
+    JSObject* scope = jsCast<JSObject*>(LLINT_OP(2).jsValue());
+    GetPutInfo getPutInfo(pc[4].u.operand);
+
+    // ModuleVar is always converted to ClosureVar for get_from_scope.
+    ASSERT(getPutInfo.resolveType() != ModuleVar);
+
+    LLINT_RETURN(scope->getPropertySlot(exec, ident, [&] (bool found, PropertySlot& slot) -> JSValue {
+        if (!found) {
+            if (getPutInfo.resolveMode() == ThrowIfNotFound)
+                return throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
+            return jsUndefined();
+        }
+
+        JSValue result = JSValue();
+        if (scope->isGlobalLexicalEnvironment()) {
+            // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
+            result = slot.getValue(exec, ident);
+            if (result == jsTDZValue())
+                return throwException(exec, throwScope, createTDZError(exec));
+        }
+
+        CommonSlowPaths::tryCacheGetFromScopeGlobal(exec, vm, pc, scope, slot, ident);
+
+        if (!result)
+            return slot.getValue(exec, ident);
+        return result;
+    }));
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
+{
+    LLINT_BEGIN();
+
+    CodeBlock* codeBlock = exec->codeBlock();
+    const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
+    JSObject* scope = jsCast<JSObject*>(LLINT_OP(1).jsValue());
+    JSValue value = LLINT_OP_C(3).jsValue();
+    GetPutInfo getPutInfo = GetPutInfo(pc[4].u.operand);
+    if (getPutInfo.resolveType() == LocalClosureVar) {
+        JSLexicalEnvironment* environment = jsCast<JSLexicalEnvironment*>(scope);
+        environment->variableAt(ScopeOffset(pc[6].u.operand)).set(vm, environment, value);
+        
+        // Have to do this *after* the write, because if this puts the set into IsWatched, then we need
+        // to have already changed the value of the variable. Otherwise we might watch and constant-fold
+        // to the Undefined value from before the assignment.
+        if (WatchpointSet* set = pc[5].u.watchpointSet)
+            set->touch(vm, "Executed op_put_scope<LocalClosureVar>");
+        LLINT_END();
+    }
+
+    bool hasProperty = scope->hasProperty(exec, ident);
+    LLINT_CHECK_EXCEPTION();
+    if (hasProperty
+        && scope->isGlobalLexicalEnvironment()
+        && !isInitialization(getPutInfo.initializationMode())) {
+        // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
+        PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
+        JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
+        if (slot.getValue(exec, ident) == jsTDZValue())
+            LLINT_THROW(createTDZError(exec));
+    }
+
+    if (getPutInfo.resolveMode() == ThrowIfNotFound && !hasProperty)
+        LLINT_THROW(createUndefinedVariableError(exec, ident));
+
+    PutPropertySlot slot(scope, codeBlock->isStrictMode(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
+    scope->methodTable()->put(scope, exec, ident, value, slot);
+    
+    CommonSlowPaths::tryCachePutToScopeGlobal(exec, codeBlock, pc, scope, getPutInfo, slot, ident);
+
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_check_if_exception_is_uncatchable_and_notify_profiler)
+{
+    LLINT_BEGIN();
+    RELEASE_ASSERT(!!throwScope.exception());
+
+    if (isTerminatedExecutionException(throwScope.exception()))
+        LLINT_RETURN_TWO(pc, bitwise_cast<void*>(static_cast<uintptr_t>(1)));
+    LLINT_RETURN_TWO(pc, 0);
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_log_shadow_chicken_prologue)
+{
+    LLINT_BEGIN();
+    
+    JSScope* scope = exec->uncheckedR(pc[1].u.operand).Register::scope();
+    vm.shadowChicken().log(vm, exec, ShadowChicken::Packet::prologue(exec->jsCallee(), exec, exec->callerFrame(), scope));
+    
+    LLINT_END();
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_log_shadow_chicken_tail)
+{
+    LLINT_BEGIN();
+
+    JSValue thisValue = LLINT_OP(1).jsValue();
+    JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
+    
+#if USE(JSVALUE64)
+    CallSiteIndex callSiteIndex(exec->codeBlock()->bytecodeOffset(pc));
+#else
+    CallSiteIndex callSiteIndex(pc);
+#endif
+    vm.shadowChicken().log(vm, exec, ShadowChicken::Packet::tail(exec, thisValue, scope, exec->codeBlock(), callSiteIndex));
+    
+    LLINT_END();
+}
+
+extern "C" SlowPathReturnType llint_throw_stack_overflow_error(VM* vm, ProtoCallFrame* protoFrame)
+{
+    ExecState* exec = vm->topCallFrame;
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    if (!exec)
+        exec = protoFrame->callee()->globalObject()->globalExec();
+    throwStackOverflowError(exec, scope);
+    return encodeResult(0, 0);
+}
+
+#if !ENABLE(JIT)
+extern "C" SlowPathReturnType llint_stack_check_at_vm_entry(VM* vm, Register* newTopOfStack)
+{
+    bool success = vm->ensureStackCapacityFor(newTopOfStack);
+    return encodeResult(reinterpret_cast<void*>(success), 0);
+}
+#endif
+
+extern "C" void llint_write_barrier_slow(ExecState* exec, JSCell* cell)
+{
+    VM& vm = exec->vm();
+    vm.heap.writeBarrier(cell);
+}
+
+extern "C" NO_RETURN_DUE_TO_CRASH void llint_crash()
+{
+    CRASH();
+}
+
+#if ENABLE(LLINT_STATS)
+
+LLINT_SLOW_PATH_DECL(count_opcode)
+{
+    OpcodeID opcodeID = exec->vm().interpreter->getOpcodeID(pc[0].u.opcode);
+    Data::opcodeStats(opcodeID).count++;
+    LLINT_END_IMPL();
+}
+
+LLINT_SLOW_PATH_DECL(count_opcode_slow_path)
+{
+    OpcodeID opcodeID = exec->vm().interpreter->getOpcodeID(pc[0].u.opcode);
+    Data::opcodeStats(opcodeID).slowPathCount++;
+    LLINT_END_IMPL();
+}
+
+#endif // ENABLE(LLINT_STATS)
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntSlowPaths.h b/llint/LLIntSlowPaths.h
new file mode 100644
index 0000000..d76138c
--- /dev/null
+++ b/llint/LLIntSlowPaths.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2011, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CommonSlowPaths.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class ExecState;
+struct Instruction;
+struct ProtoCallFrame;
+
+namespace LLInt {
+
+extern "C" SlowPathReturnType llint_trace_operand(ExecState*, Instruction*, int fromWhere, int operand);
+extern "C" SlowPathReturnType llint_trace_value(ExecState*, Instruction*, int fromWhere, int operand);
+extern "C" void llint_write_barrier_slow(ExecState*, JSCell*) WTF_INTERNAL;
+
+#define LLINT_SLOW_PATH_DECL(name) \
+    extern "C" SlowPathReturnType llint_##name(ExecState* exec, Instruction* pc)
+
+#define LLINT_SLOW_PATH_HIDDEN_DECL(name) \
+    LLINT_SLOW_PATH_DECL(name) WTF_INTERNAL
+
+LLINT_SLOW_PATH_HIDDEN_DECL(trace_prologue);
+LLINT_SLOW_PATH_HIDDEN_DECL(trace_prologue_function_for_call);
+LLINT_SLOW_PATH_HIDDEN_DECL(trace_prologue_function_for_construct);
+LLINT_SLOW_PATH_HIDDEN_DECL(trace_arityCheck_for_call);
+LLINT_SLOW_PATH_HIDDEN_DECL(trace_arityCheck_for_construct);
+LLINT_SLOW_PATH_HIDDEN_DECL(trace);
+LLINT_SLOW_PATH_HIDDEN_DECL(special_trace);
+LLINT_SLOW_PATH_HIDDEN_DECL(count_opcode);
+LLINT_SLOW_PATH_HIDDEN_DECL(count_opcode_slow_path);
+LLINT_SLOW_PATH_HIDDEN_DECL(entry_osr);
+LLINT_SLOW_PATH_HIDDEN_DECL(entry_osr_function_for_call);
+LLINT_SLOW_PATH_HIDDEN_DECL(entry_osr_function_for_construct);
+LLINT_SLOW_PATH_HIDDEN_DECL(entry_osr_function_for_call_arityCheck);
+LLINT_SLOW_PATH_HIDDEN_DECL(entry_osr_function_for_construct_arityCheck);
+LLINT_SLOW_PATH_HIDDEN_DECL(loop_osr);
+LLINT_SLOW_PATH_HIDDEN_DECL(replace);
+LLINT_SLOW_PATH_HIDDEN_DECL(stack_check);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_object);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_array);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_array_with_size);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_array_buffer);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_regexp);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_instanceof);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_instanceof_custom);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_try_get_by_id);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_by_id);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_arguments_length);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_by_id);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_del_by_id);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_by_val);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_argument_by_val);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_by_val);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_by_val_direct);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_del_by_val);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_by_index);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_getter_by_id);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_setter_by_id);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_getter_setter_by_id);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_getter_by_val);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_setter_by_val);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jtrue);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jfalse);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jless);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jnless);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jgreater);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jngreater);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jlesseq);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jnlesseq);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jgreatereq);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_jngreatereq);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_switch_imm);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_switch_char);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_switch_string);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_func);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_func_exp);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_generator_func);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_generator_func_exp);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_async_func);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_async_func_exp);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_set_function_name);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_call);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_construct);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_size_frame_for_varargs);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_size_frame_for_forward_arguments);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_call_varargs);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_tail_call_forward_arguments);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_construct_varargs);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_call_eval);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_tear_off_arguments);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_strcat);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to_primitive);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_handle_watchdog_timer);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_debug);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_handle_exception);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_from_scope);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_check_if_exception_is_uncatchable_and_notify_profiler);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_log_shadow_chicken_prologue);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_log_shadow_chicken_tail);
+extern "C" SlowPathReturnType llint_throw_stack_overflow_error(VM*, ProtoCallFrame*) WTF_INTERNAL;
+#if !ENABLE(JIT)
+extern "C" SlowPathReturnType llint_stack_check_at_vm_entry(VM*, Register*) WTF_INTERNAL;
+#endif
+extern "C" NO_RETURN_DUE_TO_CRASH void llint_crash() WTF_INTERNAL;
+
+} } // namespace JSC::LLInt
diff --git a/llint/LLIntThunks.cpp b/llint/LLIntThunks.cpp
new file mode 100644
index 0000000..a9fa7dd
--- /dev/null
+++ b/llint/LLIntThunks.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2012-2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntThunks.h"
+
+#include "CallData.h"
+#include "ExceptionHelpers.h"
+#include "Interpreter.h"
+#include "JSCJSValueInlines.h"
+#include "JSInterfaceJIT.h"
+#include "JSObject.h"
+#include "LLIntCLoop.h"
+#include "LLIntData.h"
+#include "LinkBuffer.h"
+#include "LowLevelInterpreter.h"
+#include "ProtoCallFrame.h"
+#include "StackAlignment.h"
+#include "VM.h"
+
+namespace JSC {
+
+EncodedJSValue JS_EXPORT_PRIVATE vmEntryToWasm(void* code, VM* vm, ProtoCallFrame* frame)
+{
+    return vmEntryToJavaScript(code, vm, frame);
+}
+    
+#if ENABLE(JIT)
+
+namespace LLInt {
+
+static MacroAssemblerCodeRef generateThunkWithJumpTo(VM* vm, void (*target)(), const char *thunkKind)
+{
+    JSInterfaceJIT jit(vm);
+    
+    // FIXME: there's probably a better way to do it on X86, but I'm not sure I care.
+    jit.move(JSInterfaceJIT::TrustedImmPtr(bitwise_cast<void*>(target)), JSInterfaceJIT::regT0);
+    jit.jump(JSInterfaceJIT::regT0);
+    
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    return FINALIZE_CODE(patchBuffer, ("LLInt %s prologue thunk", thunkKind));
+}
+
+MacroAssemblerCodeRef functionForCallEntryThunkGenerator(VM* vm)
+{
+    return generateThunkWithJumpTo(vm, LLInt::getCodeFunctionPtr(llint_function_for_call_prologue), "function for call");
+}
+
+MacroAssemblerCodeRef functionForConstructEntryThunkGenerator(VM* vm)
+{
+    return generateThunkWithJumpTo(vm, LLInt::getCodeFunctionPtr(llint_function_for_construct_prologue), "function for construct");
+}
+
+MacroAssemblerCodeRef functionForCallArityCheckThunkGenerator(VM* vm)
+{
+    return generateThunkWithJumpTo(vm, LLInt::getCodeFunctionPtr(llint_function_for_call_arity_check), "function for call with arity check");
+}
+
+MacroAssemblerCodeRef functionForConstructArityCheckThunkGenerator(VM* vm)
+{
+    return generateThunkWithJumpTo(vm, LLInt::getCodeFunctionPtr(llint_function_for_construct_arity_check), "function for construct with arity check");
+}
+
+MacroAssemblerCodeRef evalEntryThunkGenerator(VM* vm)
+{
+    return generateThunkWithJumpTo(vm, LLInt::getCodeFunctionPtr(llint_eval_prologue), "eval");
+}
+
+MacroAssemblerCodeRef programEntryThunkGenerator(VM* vm)
+{
+    return generateThunkWithJumpTo(vm, LLInt::getCodeFunctionPtr(llint_program_prologue), "program");
+}
+
+MacroAssemblerCodeRef moduleProgramEntryThunkGenerator(VM* vm)
+{
+    return generateThunkWithJumpTo(vm, LLInt::getCodeFunctionPtr(llint_module_program_prologue), "module_program");
+}
+
+} // namespace LLInt
+
+#else // ENABLE(JIT)
+
+// Non-JIT (i.e. C Loop LLINT) case:
+
+EncodedJSValue vmEntryToJavaScript(void* executableAddress, VM* vm, ProtoCallFrame* protoCallFrame)
+{
+    JSValue result = CLoop::execute(llint_vm_entry_to_javascript, executableAddress, vm, protoCallFrame);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue vmEntryToNative(void* executableAddress, VM* vm, ProtoCallFrame* protoCallFrame)
+{
+    JSValue result = CLoop::execute(llint_vm_entry_to_native, executableAddress, vm, protoCallFrame);
+    return JSValue::encode(result);
+}
+
+extern "C" VMEntryRecord* vmEntryRecord(VMEntryFrame* entryFrame)
+{
+    // The C Loop doesn't have any callee save registers, so the VMEntryRecord is allocated at the base of the frame.
+    intptr_t stackAlignment = stackAlignmentBytes();
+    intptr_t VMEntryTotalFrameSize = (sizeof(VMEntryRecord) + (stackAlignment - 1)) & ~(stackAlignment - 1);
+    return reinterpret_cast<VMEntryRecord*>(reinterpret_cast<char*>(entryFrame) - VMEntryTotalFrameSize);
+}
+
+
+#endif // ENABLE(JIT)
+
+} // namespace JSC
diff --git a/llint/LLIntThunks.h b/llint/LLIntThunks.h
new file mode 100644
index 0000000..fc9742c
--- /dev/null
+++ b/llint/LLIntThunks.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MacroAssemblerCodeRef.h"
+
+namespace JSC {
+
+class VM;
+struct ProtoCallFrame;
+typedef int64_t EncodedJSValue;
+
+extern "C" {
+    EncodedJSValue vmEntryToJavaScript(void*, VM*, ProtoCallFrame*);
+    EncodedJSValue vmEntryToNative(void*, VM*, ProtoCallFrame*);
+}
+
+EncodedJSValue JS_EXPORT_PRIVATE vmEntryToWasm(void*, VM*, ProtoCallFrame*);
+
+namespace LLInt {
+
+MacroAssemblerCodeRef functionForCallEntryThunkGenerator(VM*);
+MacroAssemblerCodeRef functionForConstructEntryThunkGenerator(VM*);
+MacroAssemblerCodeRef functionForCallArityCheckThunkGenerator(VM*);
+MacroAssemblerCodeRef functionForConstructArityCheckThunkGenerator(VM*);
+MacroAssemblerCodeRef evalEntryThunkGenerator(VM*);
+MacroAssemblerCodeRef programEntryThunkGenerator(VM*);
+MacroAssemblerCodeRef moduleProgramEntryThunkGenerator(VM*);
+
+} } // namespace JSC::LLInt
diff --git a/llint/LowLevelInterpreter.asm b/llint/LowLevelInterpreter.asm
new file mode 100644
index 0000000..b37979f
--- /dev/null
+++ b/llint/LowLevelInterpreter.asm
@@ -0,0 +1,1880 @@
+# Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Crash course on the language that this is written in (which I just call
+# "assembly" even though it's more than that):
+#
+# - Mostly gas-style operand ordering. The last operand tends to be the
+#   destination. So "a := b" is written as "mov b, a". But unlike gas,
+#   comparisons are in-order, so "if (a < b)" is written as
+#   "bilt a, b, ...".
+#
+# - "b" = byte, "h" = 16-bit word, "i" = 32-bit word, "p" = pointer.
+#   For 32-bit, "i" and "p" are interchangeable except when an op supports one
+#   but not the other.
+#
+# - In general, valid operands for macro invocations and instructions are
+#   registers (eg "t0"), addresses (eg "4[t0]"), base-index addresses
+#   (eg "7[t0, t1, 2]"), absolute addresses (eg "0xa0000000[]"), or labels
+#   (eg "_foo" or ".foo"). Macro invocations can also take anonymous
+#   macros as operands. Instructions cannot take anonymous macros.
+#
+# - Labels must have names that begin with either "_" or ".".  A "." label
+#   is local and gets renamed before code gen to minimize namespace
+#   pollution. A "_" label is an extern symbol (i.e. ".globl"). The "_"
+#   may or may not be removed during code gen depending on whether the asm
+#   conventions for C name mangling on the target platform mandate a "_"
+#   prefix.
+#
+# - A "macro" is a lambda expression, which may be either anonymous or
+#   named. But this has caveats. "macro" can take zero or more arguments,
+#   which may be macros or any valid operands, but it can only return
+#   code. But you can do Turing-complete things via continuation passing
+#   style: "macro foo (a, b) b(a, a) end foo(foo, foo)". Actually, don't do
+#   that, since you'll just crash the assembler.
+#
+# - An "if" is a conditional on settings. Any identifier supplied in the
+#   predicate of an "if" is assumed to be a #define that is available
+#   during code gen. So you can't use "if" for computation in a macro, but
+#   you can use it to select different pieces of code for different
+#   platforms.
+#
+# - Arguments to macros follow lexical scoping rather than dynamic scoping.
+#   Const's also follow lexical scoping and may override (hide) arguments
+#   or other consts. All variables (arguments and constants) can be bound
+#   to operands. Additionally, arguments (but not constants) can be bound
+#   to macros.
+
+# The following general-purpose registers are available:
+#
+#  - cfr and sp hold the call frame and (native) stack pointer respectively.
+#  They are callee-save registers, and guaranteed to be distinct from all other
+#  registers on all architectures.
+#
+#  - lr is defined on non-X86 architectures (ARM64, ARMv7, ARM,
+#  ARMv7_TRADITIONAL, MIPS, SH4 and CLOOP) and holds the return PC
+#
+#  - pc holds the (native) program counter on 32-bits ARM architectures (ARM,
+#  ARMv7, ARMv7_TRADITIONAL)
+#
+#  - t0, t1, t2, t3, t4 and optionally t5 are temporary registers that can get trashed on
+#  calls, and are pairwise distinct registers. t4 holds the JS program counter, so use
+#  with caution in opcodes (actually, don't use it in opcodes at all, except as PC).
+#
+#  - r0 and r1 are the platform's customary return registers, and thus are
+#  two distinct registers
+#
+#  - a0, a1, a2 and a3 are the platform's customary argument registers, and
+#  thus are pairwise distinct registers. Be mindful that:
+#    + On X86, there are no argument registers. a0 and a1 are edx and
+#    ecx following the fastcall convention, but you should still use the stack
+#    to pass your arguments. The cCall2 and cCall4 macros do this for you.
+#    + On X86_64_WIN, you should allocate space on the stack for the arguments,
+#    and the return convention is weird for > 8 bytes types. The only place we
+#    use > 8 bytes return values is on a cCall, and cCall2 and cCall4 handle
+#    this for you.
+#
+#  - The only registers guaranteed to be caller-saved are r0, r1, a0, a1 and a2, and
+#  you should be mindful of that in functions that are called directly from C.
+#  If you need more registers, you should push and pop them like a good
+#  assembly citizen, because any other register will be callee-saved on X86.
+#
+# You can additionally assume:
+#
+#  - a3, t2, t3, t4 and t5 are never return registers; t0, t1, a0, a1 and a2
+#  can be return registers.
+#
+#  - t4 and t5 are never argument registers, t3 can only be a3, t1 can only be
+#  a1; but t0 and t2 can be either a0 or a2.
+#
+#  - On 64 bits, there are callee-save registers named csr0, csr1, ... csrN.
+#  The last three csr registers are used used to store the PC base and
+#  two special tag values. Don't use them for anything else.
+#
+# Additional platform-specific details (you shouldn't rely on this remaining
+# true):
+#
+#  - For consistency with the baseline JIT, t0 is always r0 (and t1 is always
+#  r1 on 32 bits platforms). You should use the r version when you need return
+#  registers, and the t version otherwise: code using t0 (or t1) should still
+#  work if swapped with e.g. t3, while code using r0 (or r1) should not. There
+#  *may* be legacy code relying on this.
+#
+#  - On all platforms other than X86, t0 can only be a0 and t2 can only be a2.
+#
+#  - On all platforms other than X86 and X86_64, a2 is not a return register.
+#  a2 is r0 on X86 (because we have so few registers) and r1 on X86_64 (because
+#  the ABI enforces it).
+#
+# The following floating-point registers are available:
+#
+#  - ft0-ft5 are temporary floating-point registers that get trashed on calls,
+#  and are pairwise distinct.
+#
+#  - fa0 and fa1 are the platform's customary floating-point argument
+#  registers, and are both distinct. On 64-bits platforms, fa2 and fa3 are
+#  additional floating-point argument registers.
+#
+#  - fr is the platform's customary floating-point return register
+#
+# You can assume that ft1-ft5 or fa1-fa3 are never fr, and that ftX is never
+# faY if X != Y.
+
+# First come the common protocols that both interpreters use. Note that each
+# of these must have an ASSERT() in LLIntData.cpp
+
+# Work-around for the fact that the toolchain's awareness of armv7k / armv7s
+# results in a separate slab in the fat binary, yet the offlineasm doesn't know
+# to expect it.
+if ARMv7k
+end
+if ARMv7s
+end
+
+# These declarations must match interpreter/JSStack.h.
+
+if JSVALUE64
+    const PtrSize = 8
+    const CallFrameHeaderSlots = 5
+else
+    const PtrSize = 4
+    const CallFrameHeaderSlots = 4
+    const CallFrameAlignSlots = 1
+end
+const SlotSize = 8
+
+const JSEnvironmentRecord_variables = (sizeof JSEnvironmentRecord + SlotSize - 1) & ~(SlotSize - 1)
+const DirectArguments_storage = (sizeof DirectArguments + SlotSize - 1) & ~(SlotSize - 1)
+
+const StackAlignment = 16
+const StackAlignmentSlots = 2
+const StackAlignmentMask = StackAlignment - 1
+
+const CallerFrameAndPCSize = 2 * PtrSize
+
+const CallerFrame = 0
+const ReturnPC = CallerFrame + PtrSize
+const CodeBlock = ReturnPC + PtrSize
+const Callee = CodeBlock + SlotSize
+const ArgumentCount = Callee + SlotSize
+const ThisArgumentOffset = ArgumentCount + SlotSize
+const FirstArgumentOffset = ThisArgumentOffset + SlotSize
+const CallFrameHeaderSize = ThisArgumentOffset
+
+# Some value representation constants.
+if JSVALUE64
+    const TagBitTypeOther = 0x2
+    const TagBitBool      = 0x4
+    const TagBitUndefined = 0x8
+    const ValueEmpty      = 0x0
+    const ValueFalse      = TagBitTypeOther | TagBitBool
+    const ValueTrue       = TagBitTypeOther | TagBitBool | 1
+    const ValueUndefined  = TagBitTypeOther | TagBitUndefined
+    const ValueNull       = TagBitTypeOther
+    const TagTypeNumber   = 0xffff000000000000
+    const TagMask         = TagTypeNumber | TagBitTypeOther
+else
+    const Int32Tag = -1
+    const BooleanTag = -2
+    const NullTag = -3
+    const UndefinedTag = -4
+    const CellTag = -5
+    const EmptyValueTag = -6
+    const DeletedValueTag = -7
+    const LowestTag = DeletedValueTag
+end
+
+# NOTE: The values below must be in sync with what is in PutByIdFlags.h.
+const PutByIdPrimaryTypeMask = 0x6
+const PutByIdPrimaryTypeSecondary = 0x0
+const PutByIdPrimaryTypeObjectWithStructure = 0x2
+const PutByIdPrimaryTypeObjectWithStructureOrOther = 0x4
+const PutByIdSecondaryTypeMask = -0x8
+const PutByIdSecondaryTypeBottom = 0x0
+const PutByIdSecondaryTypeBoolean = 0x8
+const PutByIdSecondaryTypeOther = 0x10
+const PutByIdSecondaryTypeInt32 = 0x18
+const PutByIdSecondaryTypeNumber = 0x20
+const PutByIdSecondaryTypeString = 0x28
+const PutByIdSecondaryTypeSymbol = 0x30
+const PutByIdSecondaryTypeObject = 0x38
+const PutByIdSecondaryTypeObjectOrOther = 0x40
+const PutByIdSecondaryTypeTop = 0x48
+
+const CallOpCodeSize = 9
+
+if X86_64 or ARM64 or C_LOOP
+    const maxFrameExtentForSlowPathCall = 0
+elsif ARM or ARMv7_TRADITIONAL or ARMv7 or SH4
+    const maxFrameExtentForSlowPathCall = 24
+elsif X86 or X86_WIN
+    const maxFrameExtentForSlowPathCall = 40
+elsif MIPS
+    const maxFrameExtentForSlowPathCall = 40
+elsif X86_64_WIN
+    const maxFrameExtentForSlowPathCall = 64
+end
+
+if X86_64 or X86_64_WIN or ARM64
+    const CalleeSaveSpaceAsVirtualRegisters = 3
+else
+    const CalleeSaveSpaceAsVirtualRegisters = 0
+end
+
+const CalleeSaveSpaceStackAligned = (CalleeSaveSpaceAsVirtualRegisters * SlotSize + StackAlignment - 1) & ~StackAlignmentMask
+
+
+# Watchpoint states
+const ClearWatchpoint = 0
+const IsWatched = 1
+const IsInvalidated = 2
+
+# ShadowChicken data
+const ShadowChickenTailMarker = 0x7a11
+
+# ArithProfile data
+const ArithProfileInt = 0x100000
+const ArithProfileIntInt = 0x120000
+const ArithProfileNumber = 0x200000
+const ArithProfileNumberInt = 0x220000
+const ArithProfileNumberNumber = 0x240000
+const ArithProfileIntNumber = 0x140000
+
+# Some register conventions.
+if JSVALUE64
+    # - Use a pair of registers to represent the PC: one register for the
+    #   base of the bytecodes, and one register for the index.
+    # - The PC base (or PB for short) must be stored in a callee-save register.
+    # - C calls are still given the Instruction* rather than the PC index.
+    #   This requires an add before the call, and a sub after.
+    const PC = t4 # When changing this, make sure LLIntPC is up to date in LLIntPCRanges.h
+    if ARM64
+        const PB = csr7
+        const tagTypeNumber = csr8
+        const tagMask = csr9
+    elsif X86_64
+        const PB = csr2
+        const tagTypeNumber = csr3
+        const tagMask = csr4
+    elsif X86_64_WIN
+        const PB = csr4
+        const tagTypeNumber = csr5
+        const tagMask = csr6
+    elsif C_LOOP
+        const PB = csr0
+        const tagTypeNumber = csr1
+        const tagMask = csr2
+    end
+
+    macro loadisFromInstruction(offset, dest)
+        loadis offset * 8[PB, PC, 8], dest
+    end
+    
+    macro loadpFromInstruction(offset, dest)
+        loadp offset * 8[PB, PC, 8], dest
+    end
+    
+    macro storeisToInstruction(value, offset)
+        storei value, offset * 8[PB, PC, 8]
+    end
+
+    macro storepToInstruction(value, offset)
+        storep value, offset * 8[PB, PC, 8]
+    end
+
+else
+    const PC = t4 # When changing this, make sure LLIntPC is up to date in LLIntPCRanges.h
+    macro loadisFromInstruction(offset, dest)
+        loadis offset * 4[PC], dest
+    end
+    
+    macro loadpFromInstruction(offset, dest)
+        loadp offset * 4[PC], dest
+    end
+
+    macro storeisToInstruction(value, offset)
+        storei value, offset * 4[PC]
+    end
+end
+
+if X86_64_WIN
+    const extraTempReg = t0
+else
+    const extraTempReg = t5
+end
+
+# Constants for reasoning about value representation.
+if BIG_ENDIAN
+    const TagOffset = 0
+    const PayloadOffset = 4
+else
+    const TagOffset = 4
+    const PayloadOffset = 0
+end
+
+# Constant for reasoning about butterflies.
+const IsArray                  = 0x01
+const IndexingShapeMask        = 0x0E
+const NoIndexingShape          = 0x00
+const Int32Shape               = 0x04
+const DoubleShape              = 0x06
+const ContiguousShape          = 0x08
+const ArrayStorageShape        = 0x0A
+const SlowPutArrayStorageShape = 0x0C
+
+# Type constants.
+const StringType = 6
+const SymbolType = 7
+const ObjectType = 21
+const FinalObjectType = 22
+const JSFunctionType = 24
+const ArrayType = 32
+const DerivedArrayType = 33
+const ProxyObjectType = 51
+
+# The typed array types need to be numbered in a particular order because of the manually written
+# switch statement in get_by_val and put_by_val.
+const Int8ArrayType = 34
+const Int16ArrayType = 35
+const Int32ArrayType = 36
+const Uint8ArrayType = 37
+const Uint8ClampedArrayType = 38
+const Uint16ArrayType = 39
+const Uint32ArrayType = 40
+const Float32ArrayType = 41
+const Float64ArrayType = 42
+
+const FirstArrayType = Int8ArrayType
+const LastArrayType = Float64ArrayType
+
+# Type flags constants.
+const MasqueradesAsUndefined = 1
+const ImplementsDefaultHasInstance = 2
+
+# Bytecode operand constants.
+const FirstConstantRegisterIndex = 0x40000000
+
+# Code type constants.
+const GlobalCode = 0
+const EvalCode = 1
+const FunctionCode = 2
+const ModuleCode = 3
+
+# The interpreter steals the tag word of the argument count.
+const LLIntReturnPC = ArgumentCount + TagOffset
+
+# String flags.
+const HashFlags8BitBuffer = 8
+
+# Copied from PropertyOffset.h
+const firstOutOfLineOffset = 100
+
+# ResolveType
+const GlobalProperty = 0
+const GlobalVar = 1
+const GlobalLexicalVar = 2
+const ClosureVar = 3
+const LocalClosureVar = 4
+const ModuleVar = 5
+const GlobalPropertyWithVarInjectionChecks = 6
+const GlobalVarWithVarInjectionChecks = 7
+const GlobalLexicalVarWithVarInjectionChecks = 8
+const ClosureVarWithVarInjectionChecks = 9
+
+const ResolveTypeMask = 0x3ff
+const InitializationModeMask = 0xffc00
+const InitializationModeShift = 10
+const NotInitialization = 2
+
+const MarkedBlockSize = 16 * 1024
+const MarkedBlockMask = ~(MarkedBlockSize - 1)
+
+const BlackThreshold = 0
+
+# Allocation constants
+if JSVALUE64
+    const JSFinalObjectSizeClassIndex = 1
+else
+    const JSFinalObjectSizeClassIndex = 3
+end
+
+# This must match wtf/Vector.h
+const VectorBufferOffset = 0
+if JSVALUE64
+    const VectorSizeOffset = 12
+else
+    const VectorSizeOffset = 8
+end
+
+# Some common utilities.
+macro crash()
+    if C_LOOP
+        cloopCrash
+    else
+        call _llint_crash
+    end
+end
+
+macro assert(assertion)
+    if ASSERT_ENABLED
+        assertion(.ok)
+        crash()
+    .ok:
+    end
+end
+
+# The probe macro can be used to insert some debugging code without perturbing scalar
+# registers. Presently, the probe macro only preserves scalar registers. Hence, the
+# C probe callback function should not trash floating point registers.
+#
+# The macro you pass to probe() can pass whatever registers you like to your probe
+# callback function. However, you need to be mindful of which of the registers are
+# also used as argument registers, and ensure that you don't trash the register value
+# before storing it in the probe callback argument register that you desire.
+#
+# Here's an example of how it's used:
+#
+#     probe(
+#         macro()
+#             move cfr, a0 # pass the ExecState* as arg0.
+#             move t0, a1 # pass the value of register t0 as arg1.
+#             call _cProbeCallbackFunction # to do whatever you want.
+#         end
+#     )
+#
+if X86_64
+    macro probe(action)
+        # save all the registers that the LLInt may use.
+        push a0, a1
+        push a2, a3
+        push t0, t1
+        push t2, t3
+        push t4, t5
+
+        action()
+
+        # restore all the registers we saved previously.
+        pop t5, t4
+        pop t3, t2
+        pop t1, t0
+        pop a3, a2
+        pop a1, a0
+    end
+end
+
+macro checkStackPointerAlignment(tempReg, location)
+    if ARM64 or C_LOOP or SH4
+        # ARM64 will check for us!
+        # C_LOOP does not need the alignment, and can use a little perf
+        # improvement from avoiding useless work.
+        # SH4 does not need specific alignment (4 bytes).
+    else
+        if ARM or ARMv7 or ARMv7_TRADITIONAL
+            # ARM can't do logical ops with the sp as a source
+            move sp, tempReg
+            andp StackAlignmentMask, tempReg
+        else
+            andp sp, StackAlignmentMask, tempReg
+        end
+        btpz tempReg, .stackPointerOkay
+        move location, tempReg
+        break
+    .stackPointerOkay:
+    end
+end
+
+if C_LOOP or ARM64 or X86_64 or X86_64_WIN
+    const CalleeSaveRegisterCount = 0
+elsif ARM or ARMv7_TRADITIONAL or ARMv7
+    const CalleeSaveRegisterCount = 7
+elsif SH4
+    const CalleeSaveRegisterCount = 5
+elsif MIPS
+    const CalleeSaveRegisterCount = 1
+elsif X86 or X86_WIN
+    const CalleeSaveRegisterCount = 3
+end
+
+const CalleeRegisterSaveSize = CalleeSaveRegisterCount * PtrSize
+
+# VMEntryTotalFrameSize includes the space for struct VMEntryRecord and the
+# callee save registers rounded up to keep the stack aligned
+const VMEntryTotalFrameSize = (CalleeRegisterSaveSize + sizeof VMEntryRecord + StackAlignment - 1) & ~StackAlignmentMask
+
+macro pushCalleeSaves()
+    if C_LOOP or ARM64 or X86_64 or X86_64_WIN
+    elsif ARM or ARMv7_TRADITIONAL
+        emit "push {r4-r10}"
+    elsif ARMv7
+        emit "push {r4-r6, r8-r11}"
+    elsif MIPS
+        emit "addiu $sp, $sp, -4"
+        emit "sw $s4, 0($sp)"
+        # save $gp to $s4 so that we can restore it after a function call
+        emit "move $s4, $gp"
+    elsif SH4
+        emit "mov.l r13, @-r15"
+        emit "mov.l r11, @-r15"
+        emit "mov.l r10, @-r15"
+        emit "mov.l r9, @-r15"
+        emit "mov.l r8, @-r15"
+    elsif X86
+        emit "push %esi"
+        emit "push %edi"
+        emit "push %ebx"
+    elsif X86_WIN
+        emit "push esi"
+        emit "push edi"
+        emit "push ebx"
+    end
+end
+
+macro popCalleeSaves()
+    if C_LOOP or ARM64 or X86_64 or X86_64_WIN
+    elsif ARM or ARMv7_TRADITIONAL
+        emit "pop {r4-r10}"
+    elsif ARMv7
+        emit "pop {r4-r6, r8-r11}"
+    elsif MIPS
+        emit "lw $s4, 0($sp)"
+        emit "addiu $sp, $sp, 4"
+    elsif SH4
+        emit "mov.l @r15+, r8"
+        emit "mov.l @r15+, r9"
+        emit "mov.l @r15+, r10"
+        emit "mov.l @r15+, r11"
+        emit "mov.l @r15+, r13"
+    elsif X86
+        emit "pop %ebx"
+        emit "pop %edi"
+        emit "pop %esi"
+    elsif X86_WIN
+        emit "pop ebx"
+        emit "pop edi"
+        emit "pop esi"
+    end
+end
+
+macro preserveCallerPCAndCFR()
+    if C_LOOP or ARM or ARMv7 or ARMv7_TRADITIONAL or MIPS or SH4
+        push lr
+        push cfr
+    elsif X86 or X86_WIN or X86_64 or X86_64_WIN
+        push cfr
+    elsif ARM64
+        push cfr, lr
+    else
+        error
+    end
+    move sp, cfr
+end
+
+macro restoreCallerPCAndCFR()
+    move cfr, sp
+    if C_LOOP or ARM or ARMv7 or ARMv7_TRADITIONAL or MIPS or SH4
+        pop cfr
+        pop lr
+    elsif X86 or X86_WIN or X86_64 or X86_64_WIN
+        pop cfr
+    elsif ARM64
+        pop lr, cfr
+    end
+end
+
+macro preserveCalleeSavesUsedByLLInt()
+    subp CalleeSaveSpaceStackAligned, sp
+    if C_LOOP
+    elsif ARM or ARMv7_TRADITIONAL
+    elsif ARMv7
+    elsif ARM64
+        emit "stp x27, x28, [x29, #-16]"
+        emit "stp xzr, x26, [x29, #-32]"
+    elsif MIPS
+    elsif SH4
+    elsif X86
+    elsif X86_WIN
+    elsif X86_64
+        storep csr4, -8[cfr]
+        storep csr3, -16[cfr]
+        storep csr2, -24[cfr]
+    elsif X86_64_WIN
+        storep csr6, -8[cfr]
+        storep csr5, -16[cfr]
+        storep csr4, -24[cfr]
+    end
+end
+
+macro restoreCalleeSavesUsedByLLInt()
+    if C_LOOP
+    elsif ARM or ARMv7_TRADITIONAL
+    elsif ARMv7
+    elsif ARM64
+        emit "ldp xzr, x26, [x29, #-32]"
+        emit "ldp x27, x28, [x29, #-16]"
+    elsif MIPS
+    elsif SH4
+    elsif X86
+    elsif X86_WIN
+    elsif X86_64
+        loadp -24[cfr], csr2
+        loadp -16[cfr], csr3
+        loadp -8[cfr], csr4
+    elsif X86_64_WIN
+        loadp -24[cfr], csr4
+        loadp -16[cfr], csr5
+        loadp -8[cfr], csr6
+    end
+end
+
+macro copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(vm, temp)
+    if ARM64 or X86_64 or X86_64_WIN
+        loadp VM::topVMEntryFrame[vm], temp
+        vmEntryRecord(temp, temp)
+        leap VMEntryRecord::calleeSaveRegistersBuffer[temp], temp
+        if ARM64
+            storep csr0, [temp]
+            storep csr1, 8[temp]
+            storep csr2, 16[temp]
+            storep csr3, 24[temp]
+            storep csr4, 32[temp]
+            storep csr5, 40[temp]
+            storep csr6, 48[temp]
+            storep csr7, 56[temp]
+            storep csr8, 64[temp]
+            storep csr9, 72[temp]
+            stored csfr0, 80[temp]
+            stored csfr1, 88[temp]
+            stored csfr2, 96[temp]
+            stored csfr3, 104[temp]
+            stored csfr4, 112[temp]
+            stored csfr5, 120[temp]
+            stored csfr6, 128[temp]
+            stored csfr7, 136[temp]
+        elsif X86_64
+            storep csr0, [temp]
+            storep csr1, 8[temp]
+            storep csr2, 16[temp]
+            storep csr3, 24[temp]
+            storep csr4, 32[temp]
+        elsif X86_64_WIN
+            storep csr0, [temp]
+            storep csr1, 8[temp]
+            storep csr2, 16[temp]
+            storep csr3, 24[temp]
+            storep csr4, 32[temp]
+            storep csr5, 40[temp]
+            storep csr6, 48[temp]
+        end
+    end
+end
+
+macro restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(vm, temp)
+    if ARM64 or X86_64 or X86_64_WIN
+        loadp VM::topVMEntryFrame[vm], temp
+        vmEntryRecord(temp, temp)
+        leap VMEntryRecord::calleeSaveRegistersBuffer[temp], temp
+        if ARM64
+            loadp [temp], csr0
+            loadp 8[temp], csr1
+            loadp 16[temp], csr2
+            loadp 24[temp], csr3
+            loadp 32[temp], csr4
+            loadp 40[temp], csr5
+            loadp 48[temp], csr6
+            loadp 56[temp], csr7
+            loadp 64[temp], csr8
+            loadp 72[temp], csr9
+            loadd 80[temp], csfr0
+            loadd 88[temp], csfr1
+            loadd 96[temp], csfr2
+            loadd 104[temp], csfr3
+            loadd 112[temp], csfr4
+            loadd 120[temp], csfr5
+            loadd 128[temp], csfr6
+            loadd 136[temp], csfr7
+        elsif X86_64
+            loadp [temp], csr0
+            loadp 8[temp], csr1
+            loadp 16[temp], csr2
+            loadp 24[temp], csr3
+            loadp 32[temp], csr4
+        elsif X86_64_WIN
+            loadp [temp], csr0
+            loadp 8[temp], csr1
+            loadp 16[temp], csr2
+            loadp 24[temp], csr3
+            loadp 32[temp], csr4
+            loadp 40[temp], csr5
+            loadp 48[temp], csr6
+        end
+    end
+end
+
+macro preserveReturnAddressAfterCall(destinationRegister)
+    if C_LOOP or ARM or ARMv7 or ARMv7_TRADITIONAL or ARM64 or MIPS or SH4
+        # In C_LOOP case, we're only preserving the bytecode vPC.
+        move lr, destinationRegister
+    elsif X86 or X86_WIN or X86_64 or X86_64_WIN
+        pop destinationRegister
+    else
+        error
+    end
+end
+
+macro functionPrologue()
+    if X86 or X86_WIN or X86_64 or X86_64_WIN
+        push cfr
+    elsif ARM64
+        push cfr, lr
+    elsif C_LOOP or ARM or ARMv7 or ARMv7_TRADITIONAL or MIPS or SH4
+        push lr
+        push cfr
+    end
+    move sp, cfr
+end
+
+macro functionEpilogue()
+    if X86 or X86_WIN or X86_64 or X86_64_WIN
+        pop cfr
+    elsif ARM64
+        pop lr, cfr
+    elsif C_LOOP or ARM or ARMv7 or ARMv7_TRADITIONAL or MIPS or SH4
+        pop cfr
+        pop lr
+    end
+end
+
+macro vmEntryRecord(entryFramePointer, resultReg)
+    subp entryFramePointer, VMEntryTotalFrameSize, resultReg
+end
+
+macro getFrameRegisterSizeForCodeBlock(codeBlock, size)
+    loadi CodeBlock::m_numCalleeLocals[codeBlock], size
+    lshiftp 3, size
+    addp maxFrameExtentForSlowPathCall, size
+end
+
+macro restoreStackPointerAfterCall()
+    loadp CodeBlock[cfr], t2
+    getFrameRegisterSizeForCodeBlock(t2, t2)
+    if ARMv7
+        subp cfr, t2, t2
+        move t2, sp
+    else
+        subp cfr, t2, sp
+    end
+end
+
+macro traceExecution()
+    if COLLECT_STATS
+        callSlowPath(_llint_count_opcode)
+    end
+    if EXECUTION_TRACING
+        callSlowPath(_llint_trace)
+    end
+end
+
+macro traceSlowPathExecution()
+    if COLLECT_STATS
+        callSlowPath(_llint_count_opcode_slow_path)
+    end
+end
+
+macro callOpcodeSlowPath(slowPath)
+    traceSlowPathExecution()
+    callSlowPath(slowPath)
+end
+
+macro callTargetFunction(callee)
+    if C_LOOP
+        cloopCallJSFunction callee
+    else
+        call callee
+    end
+    restoreStackPointerAfterCall()
+    dispatchAfterCall()
+end
+
+macro prepareForRegularCall(callee, temp1, temp2, temp3)
+    addp CallerFrameAndPCSize, sp
+end
+
+# sp points to the new frame
+macro prepareForTailCall(callee, temp1, temp2, temp3)
+    restoreCalleeSavesUsedByLLInt()
+
+    loadi PayloadOffset + ArgumentCount[cfr], temp2
+    loadp CodeBlock[cfr], temp1
+    loadp CodeBlock::m_numParameters[temp1], temp1
+    bilteq temp1, temp2, .noArityFixup
+    move temp1, temp2
+
+.noArityFixup:
+    # We assume < 2^28 arguments
+    muli SlotSize, temp2
+    addi StackAlignment - 1 + CallFrameHeaderSize, temp2
+    andi ~StackAlignmentMask, temp2
+
+    move cfr, temp1
+    addp temp2, temp1
+
+    loadi PayloadOffset + ArgumentCount[sp], temp2
+    # We assume < 2^28 arguments
+    muli SlotSize, temp2
+    addi StackAlignment - 1 + CallFrameHeaderSize, temp2
+    andi ~StackAlignmentMask, temp2
+
+    if ARM or ARMv7_TRADITIONAL or ARMv7 or SH4 or ARM64 or C_LOOP or MIPS
+        addp 2 * PtrSize, sp
+        subi 2 * PtrSize, temp2
+        loadp PtrSize[cfr], lr
+    else
+        addp PtrSize, sp
+        subi PtrSize, temp2
+        loadp PtrSize[cfr], temp3
+        storep temp3, [sp]
+    end
+
+    subp temp2, temp1
+    loadp [cfr], cfr
+
+.copyLoop:
+    subi PtrSize, temp2
+    loadp [sp, temp2, 1], temp3
+    storep temp3, [temp1, temp2, 1]
+    btinz temp2, .copyLoop
+
+    move temp1, sp
+    jmp callee
+end
+
+macro slowPathForCall(slowPath, prepareCall)
+    traceSlowPathExecution()
+    callCallSlowPath(
+        slowPath,
+        # Those are r0 and r1
+        macro (callee, calleeFramePtr)
+            btpz calleeFramePtr, .dontUpdateSP
+            move calleeFramePtr, sp
+            prepareCall(callee, t2, t3, t4)
+        .dontUpdateSP:
+            callTargetFunction(callee)
+        end)
+end
+
+macro arrayProfile(cellAndIndexingType, profile, scratch)
+    const cell = cellAndIndexingType
+    const indexingType = cellAndIndexingType 
+    loadi JSCell::m_structureID[cell], scratch
+    storei scratch, ArrayProfile::m_lastSeenStructureID[profile]
+    loadb JSCell::m_indexingTypeAndMisc[cell], indexingType
+end
+
+macro skipIfIsRememberedOrInEden(cell, slowPath)
+    memfence
+    bba JSCell::m_cellState[cell], BlackThreshold, .done
+    slowPath()
+.done:
+end
+
+macro notifyWrite(set, slow)
+    bbneq WatchpointSet::m_state[set], IsInvalidated, slow
+end
+
+macro checkSwitchToJIT(increment, action)
+    loadp CodeBlock[cfr], t0
+    baddis increment, CodeBlock::m_llintExecuteCounter + BaselineExecutionCounter::m_counter[t0], .continue
+    action()
+    .continue:
+end
+
+macro checkSwitchToJITForEpilogue()
+    checkSwitchToJIT(
+        10,
+        macro ()
+            callOpcodeSlowPath(_llint_replace)
+        end)
+end
+
+macro assertNotConstant(index)
+    assert(macro (ok) bilt index, FirstConstantRegisterIndex, ok end)
+end
+
+macro functionForCallCodeBlockGetter(targetRegister)
+    if JSVALUE64
+        loadp Callee[cfr], targetRegister
+    else
+        loadp Callee + PayloadOffset[cfr], targetRegister
+    end
+    loadp JSFunction::m_executable[targetRegister], targetRegister
+    loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
+end
+
+macro functionForConstructCodeBlockGetter(targetRegister)
+    if JSVALUE64
+        loadp Callee[cfr], targetRegister
+    else
+        loadp Callee + PayloadOffset[cfr], targetRegister
+    end
+    loadp JSFunction::m_executable[targetRegister], targetRegister
+    loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
+end
+
+macro notFunctionCodeBlockGetter(targetRegister)
+    loadp CodeBlock[cfr], targetRegister
+end
+
+macro functionCodeBlockSetter(sourceRegister)
+    storep sourceRegister, CodeBlock[cfr]
+end
+
+macro notFunctionCodeBlockSetter(sourceRegister)
+    # Nothing to do!
+end
+
+# Do the bare minimum required to execute code. Sets up the PC, leave the CodeBlock*
+# in t1. May also trigger prologue entry OSR.
+macro prologue(codeBlockGetter, codeBlockSetter, osrSlowPath, traceSlowPath)
+    # Set up the call frame and check if we should OSR.
+    preserveCallerPCAndCFR()
+
+    if EXECUTION_TRACING
+        subp maxFrameExtentForSlowPathCall, sp
+        callSlowPath(traceSlowPath)
+        addp maxFrameExtentForSlowPathCall, sp
+    end
+    codeBlockGetter(t1)
+    if not C_LOOP
+        baddis 5, CodeBlock::m_llintExecuteCounter + BaselineExecutionCounter::m_counter[t1], .continue
+        if JSVALUE64
+            move cfr, a0
+            move PC, a1
+            cCall2(osrSlowPath)
+        else
+            # We are after the function prologue, but before we have set up sp from the CodeBlock.
+            # Temporarily align stack pointer for this call.
+            subp 8, sp
+            move cfr, a0
+            move PC, a1
+            cCall2(osrSlowPath)
+            addp 8, sp
+        end
+        btpz r0, .recover
+        move cfr, sp # restore the previous sp
+        # pop the callerFrame since we will jump to a function that wants to save it
+        if ARM64
+            pop lr, cfr
+        elsif ARM or ARMv7 or ARMv7_TRADITIONAL or MIPS or SH4
+            pop cfr
+            pop lr
+        else
+            pop cfr
+        end
+        jmp r0
+    .recover:
+        codeBlockGetter(t1)
+    .continue:
+    end
+
+    codeBlockSetter(t1)
+
+    preserveCalleeSavesUsedByLLInt()
+
+    # Set up the PC.
+    if JSVALUE64
+        loadp CodeBlock::m_instructions[t1], PB
+        move 0, PC
+    else
+        loadp CodeBlock::m_instructions[t1], PC
+    end
+
+    # Get new sp in t0 and check stack height.
+    getFrameRegisterSizeForCodeBlock(t1, t0)
+    subp cfr, t0, t0
+    loadp CodeBlock::m_vm[t1], t2
+    if C_LOOP
+        bpbeq VM::m_cloopStackLimit[t2], t0, .stackHeightOK
+    else
+        bpbeq VM::m_softStackLimit[t2], t0, .stackHeightOK
+    end
+
+    # Stack height check failed - need to call a slow_path.
+    # Set up temporary stack pointer for call including callee saves
+    subp maxFrameExtentForSlowPathCall, sp
+    callSlowPath(_llint_stack_check)
+    bpeq r1, 0, .stackHeightOKGetCodeBlock
+    move r1, cfr
+    dispatch(0) # Go to exception handler in PC
+
+.stackHeightOKGetCodeBlock:
+    # Stack check slow path returned that the stack was ok.
+    # Since they were clobbered, need to get CodeBlock and new sp
+    codeBlockGetter(t1)
+    getFrameRegisterSizeForCodeBlock(t1, t0)
+    subp cfr, t0, t0
+
+.stackHeightOK:
+    move t0, sp
+
+    if JSVALUE64
+        move TagTypeNumber, tagTypeNumber
+        addp TagBitTypeOther, tagTypeNumber, tagMask
+    end
+end
+
+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
+# Must call dispatch(0) after calling this.
+macro functionInitialization(profileArgSkip)
+    # Profile the arguments. Unfortunately, we have no choice but to do this. This
+    # code is pretty horrendous because of the difference in ordering between
+    # arguments and value profiles, the desire to have a simple loop-down-to-zero
+    # loop, and the desire to use only three registers so as to preserve the PC and
+    # the code block. It is likely that this code should be rewritten in a more
+    # optimal way for architectures that have more than five registers available
+    # for arbitrary use in the interpreter.
+    loadi CodeBlock::m_numParameters[t1], t0
+    addp -profileArgSkip, t0 # Use addi because that's what has the peephole
+    assert(macro (ok) bpgteq t0, 0, ok end)
+    btpz t0, .argumentProfileDone
+    loadp CodeBlock::m_argumentValueProfiles + VectorBufferOffset[t1], t3
+    mulp sizeof ValueProfile, t0, t2 # Aaaaahhhh! Need strength reduction!
+    lshiftp 3, t0
+    addp t2, t3
+.argumentProfileLoop:
+    if JSVALUE64
+        loadq ThisArgumentOffset - 8 + profileArgSkip * 8[cfr, t0], t2
+        subp sizeof ValueProfile, t3
+        storeq t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets[t3]
+    else
+        loadi ThisArgumentOffset + TagOffset - 8 + profileArgSkip * 8[cfr, t0], t2
+        subp sizeof ValueProfile, t3
+        storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + TagOffset[t3]
+        loadi ThisArgumentOffset + PayloadOffset - 8 + profileArgSkip * 8[cfr, t0], t2
+        storei t2, profileArgSkip * sizeof ValueProfile + ValueProfile::m_buckets + PayloadOffset[t3]
+    end
+    baddpnz -8, t0, .argumentProfileLoop
+.argumentProfileDone:
+end
+
+macro doReturn()
+    restoreCalleeSavesUsedByLLInt()
+    restoreCallerPCAndCFR()
+    ret
+end
+
+# stub to call into JavaScript or Native functions
+# EncodedJSValue vmEntryToJavaScript(void* code, VM* vm, ProtoCallFrame* protoFrame)
+# EncodedJSValue vmEntryToNativeFunction(void* code, VM* vm, ProtoCallFrame* protoFrame)
+
+if C_LOOP
+    _llint_vm_entry_to_javascript:
+else
+    global _vmEntryToJavaScript
+    _vmEntryToJavaScript:
+end
+    doVMEntry(makeJavaScriptCall)
+
+
+if C_LOOP
+    _llint_vm_entry_to_native:
+else
+    global _vmEntryToNative
+    _vmEntryToNative:
+end
+    doVMEntry(makeHostFunctionCall)
+
+
+if not C_LOOP
+    # void sanitizeStackForVMImpl(VM* vm)
+    global _sanitizeStackForVMImpl
+    _sanitizeStackForVMImpl:
+        # We need three non-aliased caller-save registers. We are guaranteed
+        # this for a0, a1 and a2 on all architectures.
+        if X86 or X86_WIN
+            loadp 4[sp], a0
+        end
+        const vm = a0
+        const address = a1
+        const zeroValue = a2
+    
+        loadp VM::m_lastStackTop[vm], address
+        bpbeq sp, address, .zeroFillDone
+    
+        move 0, zeroValue
+    .zeroFillLoop:
+        storep zeroValue, [address]
+        addp PtrSize, address
+        bpa sp, address, .zeroFillLoop
+    
+    .zeroFillDone:
+        move sp, address
+        storep address, VM::m_lastStackTop[vm]
+        ret
+    
+    # VMEntryRecord* vmEntryRecord(const VMEntryFrame* entryFrame)
+    global _vmEntryRecord
+    _vmEntryRecord:
+        if X86 or X86_WIN
+            loadp 4[sp], a0
+        end
+
+        vmEntryRecord(a0, r0)
+        ret
+end
+
+if C_LOOP
+    # Dummy entry point the C Loop uses to initialize.
+    _llint_entry:
+        crash()
+else
+    macro initPCRelative(pcBase)
+        if X86_64 or X86_64_WIN or X86 or X86_WIN
+            call _relativePCBase
+        _relativePCBase:
+            pop pcBase
+        elsif ARM64
+        elsif ARMv7
+        _relativePCBase:
+            move pc, pcBase
+            subp 3, pcBase   # Need to back up the PC and set the Thumb2 bit
+        elsif ARM or ARMv7_TRADITIONAL
+        _relativePCBase:
+            move pc, pcBase
+            subp 8, pcBase
+        elsif MIPS
+            la _relativePCBase, pcBase
+            setcallreg pcBase # needed to set $t9 to the right value for the .cpload created by the label.
+        _relativePCBase:
+        elsif SH4
+            mova _relativePCBase, t0
+            move t0, pcBase
+            alignformova
+        _relativePCBase:
+        end
+end
+
+# The PC base is in t1, as this is what _llint_entry leaves behind through
+# initPCRelative(t1)
+macro setEntryAddress(index, label)
+    if X86_64 or X86_64_WIN
+        leap (label - _relativePCBase)[t1], t3
+        move index, t4
+        storep t3, [a0, t4, 8]
+    elsif X86 or X86_WIN
+        leap (label - _relativePCBase)[t1], t3
+        move index, t4
+        storep t3, [a0, t4, 4]
+    elsif ARM64
+        pcrtoaddr label, t1
+        move index, t4
+        storep t1, [a0, t4, 8]
+    elsif ARM or ARMv7 or ARMv7_TRADITIONAL
+        mvlbl (label - _relativePCBase), t4
+        addp t4, t1, t4
+        move index, t3
+        storep t4, [a0, t3, 4]
+    elsif SH4
+        move (label - _relativePCBase), t4
+        addp t4, t1, t4
+        move index, t3
+        storep t4, [a0, t3, 4]
+        flushcp # Force constant pool flush to avoid "pcrel too far" link error.
+    elsif MIPS
+        la label, t4
+        la _relativePCBase, t3
+        subp t3, t4
+        addp t4, t1, t4
+        move index, t3
+        storep t4, [a0, t3, 4]
+    end
+end
+
+global _llint_entry
+# Entry point for the llint to initialize.
+_llint_entry:
+    functionPrologue()
+    pushCalleeSaves()
+    if X86 or X86_WIN
+        loadp 20[sp], a0
+    end
+    initPCRelative(t1)
+
+    # Include generated bytecode initialization file.
+    include InitBytecodes
+
+    popCalleeSaves()
+    functionEpilogue()
+    ret
+end
+
+_llint_program_prologue:
+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
+    dispatch(0)
+
+
+_llint_module_program_prologue:
+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
+    dispatch(0)
+
+
+_llint_eval_prologue:
+    prologue(notFunctionCodeBlockGetter, notFunctionCodeBlockSetter, _llint_entry_osr, _llint_trace_prologue)
+    dispatch(0)
+
+
+_llint_function_for_call_prologue:
+    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call, _llint_trace_prologue_function_for_call)
+    functionInitialization(0)
+    dispatch(0)
+    
+
+_llint_function_for_construct_prologue:
+    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct, _llint_trace_prologue_function_for_construct)
+    functionInitialization(1)
+    dispatch(0)
+    
+
+_llint_function_for_call_arity_check:
+    prologue(functionForCallCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_call_arityCheck, _llint_trace_arityCheck_for_call)
+    functionArityCheck(.functionForCallBegin, _slow_path_call_arityCheck)
+.functionForCallBegin:
+    functionInitialization(0)
+    dispatch(0)
+
+
+_llint_function_for_construct_arity_check:
+    prologue(functionForConstructCodeBlockGetter, functionCodeBlockSetter, _llint_entry_osr_function_for_construct_arityCheck, _llint_trace_arityCheck_for_construct)
+    functionArityCheck(.functionForConstructBegin, _slow_path_construct_arityCheck)
+.functionForConstructBegin:
+    functionInitialization(1)
+    dispatch(0)
+
+
+# Value-representation-specific code.
+if JSVALUE64
+    include LowLevelInterpreter64
+else
+    include LowLevelInterpreter32_64
+end
+
+
+# Value-representation-agnostic code.
+_llint_op_create_direct_arguments:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_create_direct_arguments)
+    dispatch(2)
+
+
+_llint_op_create_scoped_arguments:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_create_scoped_arguments)
+    dispatch(3)
+
+
+_llint_op_create_cloned_arguments:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_create_cloned_arguments)
+    dispatch(2)
+
+
+_llint_op_create_this:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_create_this)
+    dispatch(5)
+
+
+_llint_op_new_object:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_object)
+    dispatch(4)
+
+
+_llint_op_new_func:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_func)
+    dispatch(4)
+
+
+_llint_op_new_generator_func:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_generator_func)
+    dispatch(4)
+
+
+_llint_op_new_async_func:
+    traceExecution()
+    callSlowPath(_llint_slow_path_new_async_func)
+    dispatch(4)
+
+
+_llint_op_new_array:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_array)
+    dispatch(5)
+
+
+_llint_op_new_array_with_spread:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_new_array_with_spread)
+    dispatch(5)
+
+
+_llint_op_spread:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_spread)
+    dispatch(3)
+
+
+_llint_op_new_array_with_size:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_array_with_size)
+    dispatch(4)
+
+
+_llint_op_new_array_buffer:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_array_buffer)
+    dispatch(5)
+
+
+_llint_op_new_regexp:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_regexp)
+    dispatch(3)
+
+
+_llint_op_less:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_less)
+    dispatch(4)
+
+
+_llint_op_lesseq:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_lesseq)
+    dispatch(4)
+
+
+_llint_op_greater:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_greater)
+    dispatch(4)
+
+
+_llint_op_greatereq:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_greatereq)
+    dispatch(4)
+
+
+_llint_op_mod:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_mod)
+    dispatch(4)
+
+
+_llint_op_pow:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_pow)
+    dispatch(4)
+
+
+_llint_op_typeof:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_typeof)
+    dispatch(3)
+
+
+_llint_op_is_object_or_null:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_is_object_or_null)
+    dispatch(3)
+
+_llint_op_is_function:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_is_function)
+    dispatch(3)
+
+
+_llint_op_in:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_in)
+    dispatch(4)
+
+
+_llint_op_try_get_by_id:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_try_get_by_id)
+    dispatch(5)
+
+
+_llint_op_del_by_id:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_del_by_id)
+    dispatch(4)
+
+
+_llint_op_del_by_val:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_del_by_val)
+    dispatch(4)
+
+
+_llint_op_put_by_index:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_put_by_index)
+    dispatch(4)
+
+
+_llint_op_put_getter_by_id:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_put_getter_by_id)
+    dispatch(5)
+
+
+_llint_op_put_setter_by_id:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_put_setter_by_id)
+    dispatch(5)
+
+
+_llint_op_put_getter_setter_by_id:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_put_getter_setter_by_id)
+    dispatch(6)
+
+
+_llint_op_put_getter_by_val:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_put_getter_by_val)
+    dispatch(5)
+
+
+_llint_op_put_setter_by_val:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_put_setter_by_val)
+    dispatch(5)
+
+
+_llint_op_define_data_property:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_define_data_property)
+    dispatch(5)
+
+
+_llint_op_define_accessor_property:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_define_accessor_property)
+    dispatch(6)
+
+
+_llint_op_jtrue:
+    traceExecution()
+    jumpTrueOrFalse(
+        macro (value, target) btinz value, target end,
+        _llint_slow_path_jtrue)
+
+
+_llint_op_jfalse:
+    traceExecution()
+    jumpTrueOrFalse(
+        macro (value, target) btiz value, target end,
+        _llint_slow_path_jfalse)
+
+
+_llint_op_jless:
+    traceExecution()
+    compare(
+        macro (left, right, target) bilt left, right, target end,
+        macro (left, right, target) bdlt left, right, target end,
+        _llint_slow_path_jless)
+
+
+_llint_op_jnless:
+    traceExecution()
+    compare(
+        macro (left, right, target) bigteq left, right, target end,
+        macro (left, right, target) bdgtequn left, right, target end,
+        _llint_slow_path_jnless)
+
+
+_llint_op_jgreater:
+    traceExecution()
+    compare(
+        macro (left, right, target) bigt left, right, target end,
+        macro (left, right, target) bdgt left, right, target end,
+        _llint_slow_path_jgreater)
+
+
+_llint_op_jngreater:
+    traceExecution()
+    compare(
+        macro (left, right, target) bilteq left, right, target end,
+        macro (left, right, target) bdltequn left, right, target end,
+        _llint_slow_path_jngreater)
+
+
+_llint_op_jlesseq:
+    traceExecution()
+    compare(
+        macro (left, right, target) bilteq left, right, target end,
+        macro (left, right, target) bdlteq left, right, target end,
+        _llint_slow_path_jlesseq)
+
+
+_llint_op_jnlesseq:
+    traceExecution()
+    compare(
+        macro (left, right, target) bigt left, right, target end,
+        macro (left, right, target) bdgtun left, right, target end,
+        _llint_slow_path_jnlesseq)
+
+
+_llint_op_jgreatereq:
+    traceExecution()
+    compare(
+        macro (left, right, target) bigteq left, right, target end,
+        macro (left, right, target) bdgteq left, right, target end,
+        _llint_slow_path_jgreatereq)
+
+
+_llint_op_jngreatereq:
+    traceExecution()
+    compare(
+        macro (left, right, target) bilt left, right, target end,
+        macro (left, right, target) bdltun left, right, target end,
+        _llint_slow_path_jngreatereq)
+
+
+_llint_op_loop_hint:
+    traceExecution()
+    checkSwitchToJITForLoop()
+    dispatch(1)
+
+
+_llint_op_watchdog:
+    traceExecution()
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_vm[t1], t1
+    loadp VM::m_watchdog[t1], t0
+    btpnz t0, .handleWatchdogTimer
+.afterWatchdogTimerCheck:
+    dispatch(1)
+.handleWatchdogTimer:
+    loadb Watchdog::m_timerDidFire[t0], t0
+    btbz t0, .afterWatchdogTimerCheck
+    callWatchdogTimerHandler(.throwHandler)
+    jmp .afterWatchdogTimerCheck
+.throwHandler:
+    jmp _llint_throw_from_slow_path_trampoline
+
+
+# Returns the packet pointer in t0.
+macro acquireShadowChickenPacket(slow)
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_vm[t1], t1
+    loadp VM::m_shadowChicken[t1], t2
+    loadp ShadowChicken::m_logCursor[t2], t0
+    bpaeq t0, ShadowChicken::m_logEnd[t2], slow
+    addp sizeof ShadowChicken::Packet, t0, t1
+    storep t1, ShadowChicken::m_logCursor[t2]
+end
+
+
+_llint_op_switch_string:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_switch_string)
+    dispatch(0)
+
+
+_llint_op_new_func_exp:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_func_exp)
+    dispatch(4)
+
+_llint_op_new_generator_func_exp:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_new_generator_func_exp)
+    dispatch(4)
+
+_llint_op_new_async_func_exp:
+    traceExecution()
+    callSlowPath(_llint_slow_path_new_async_func_exp)
+    dispatch(4)
+
+
+_llint_op_set_function_name:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_set_function_name)
+    dispatch(3)
+
+_llint_op_call:
+    traceExecution()
+    arrayProfileForCall()
+    doCall(_llint_slow_path_call, prepareForRegularCall)
+
+_llint_op_tail_call:
+    traceExecution()
+    arrayProfileForCall()
+    checkSwitchToJITForEpilogue()
+    doCall(_llint_slow_path_call, prepareForTailCall)
+
+_llint_op_construct:
+    traceExecution()
+    doCall(_llint_slow_path_construct, prepareForRegularCall)
+
+macro doCallVarargs(frameSlowPath, slowPath, prepareCall)
+    callOpcodeSlowPath(frameSlowPath)
+    branchIfException(_llint_throw_from_slow_path_trampoline)
+    # calleeFrame in r1
+    if JSVALUE64
+        move r1, sp
+    else
+        # The calleeFrame is not stack aligned, move down by CallerFrameAndPCSize to align
+        if ARMv7
+            subp r1, CallerFrameAndPCSize, t2
+            move t2, sp
+        else
+            subp r1, CallerFrameAndPCSize, sp
+        end
+    end
+    slowPathForCall(slowPath, prepareCall)
+end
+
+_llint_op_call_varargs:
+    traceExecution()
+    doCallVarargs(_llint_slow_path_size_frame_for_varargs, _llint_slow_path_call_varargs, prepareForRegularCall)
+
+_llint_op_tail_call_varargs:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    # We lie and perform the tail call instead of preparing it since we can't
+    # prepare the frame for a call opcode
+    doCallVarargs(_llint_slow_path_size_frame_for_varargs, _llint_slow_path_call_varargs, prepareForTailCall)
+
+
+_llint_op_tail_call_forward_arguments:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    # We lie and perform the tail call instead of preparing it since we can't
+    # prepare the frame for a call opcode
+    doCallVarargs(_llint_slow_path_size_frame_for_forward_arguments, _llint_slow_path_tail_call_forward_arguments, prepareForTailCall)
+
+
+_llint_op_construct_varargs:
+    traceExecution()
+    doCallVarargs(_llint_slow_path_size_frame_for_varargs, _llint_slow_path_construct_varargs, prepareForRegularCall)
+
+
+_llint_op_call_eval:
+    traceExecution()
+    
+    # Eval is executed in one of two modes:
+    #
+    # 1) We find that we're really invoking eval() in which case the
+    #    execution is perfomed entirely inside the slow_path, and it
+    #    returns the PC of a function that just returns the return value
+    #    that the eval returned.
+    #
+    # 2) We find that we're invoking something called eval() that is not
+    #    the real eval. Then the slow_path returns the PC of the thing to
+    #    call, and we call it.
+    #
+    # This allows us to handle two cases, which would require a total of
+    # up to four pieces of state that cannot be easily packed into two
+    # registers (C functions can return up to two registers, easily):
+    #
+    # - The call frame register. This may or may not have been modified
+    #   by the slow_path, but the convention is that it returns it. It's not
+    #   totally clear if that's necessary, since the cfr is callee save.
+    #   But that's our style in this here interpreter so we stick with it.
+    #
+    # - A bit to say if the slow_path successfully executed the eval and has
+    #   the return value, or did not execute the eval but has a PC for us
+    #   to call.
+    #
+    # - Either:
+    #   - The JS return value (two registers), or
+    #
+    #   - The PC to call.
+    #
+    # It turns out to be easier to just always have this return the cfr
+    # and a PC to call, and that PC may be a dummy thunk that just
+    # returns the JS value that the eval returned.
+    
+    slowPathForCall(_llint_slow_path_call_eval, prepareForRegularCall)
+
+
+_llint_generic_return_point:
+    dispatchAfterCall()
+
+
+_llint_op_strcat:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_strcat)
+    dispatch(4)
+
+
+_llint_op_push_with_scope:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_push_with_scope)
+    dispatch(4)
+
+
+_llint_op_assert:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_assert)
+    dispatch(3)
+
+
+_llint_op_yield:
+    notSupported()
+
+
+_llint_op_create_lexical_environment:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_create_lexical_environment)
+    dispatch(5)
+
+
+_llint_op_throw:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_throw)
+    dispatch(2)
+
+
+_llint_op_throw_static_error:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_throw_static_error)
+    dispatch(3)
+
+
+_llint_op_debug:
+    traceExecution()
+    loadp CodeBlock[cfr], t0
+    loadi CodeBlock::m_debuggerRequests[t0], t0
+    btiz t0, .opDebugDone
+    callOpcodeSlowPath(_llint_slow_path_debug)
+.opDebugDone:                    
+    dispatch(3)
+
+
+_llint_native_call_trampoline:
+    nativeCallTrampoline(NativeExecutable::m_function)
+
+
+_llint_native_construct_trampoline:
+    nativeCallTrampoline(NativeExecutable::m_constructor)
+
+_llint_op_get_enumerable_length:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_get_enumerable_length)
+    dispatch(3)
+
+_llint_op_has_indexed_property:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_has_indexed_property)
+    dispatch(5)
+
+_llint_op_has_structure_property:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_has_structure_property)
+    dispatch(5)
+
+_llint_op_has_generic_property:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_has_generic_property)
+    dispatch(4)
+
+_llint_op_get_direct_pname:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_get_direct_pname)
+    dispatch(7)
+
+_llint_op_get_property_enumerator:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_get_property_enumerator)
+    dispatch(3)
+
+_llint_op_enumerator_structure_pname:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_next_structure_enumerator_pname)
+    dispatch(4)
+
+_llint_op_enumerator_generic_pname:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_next_generic_enumerator_pname)
+    dispatch(4)
+
+_llint_op_to_index_string:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_to_index_string)
+    dispatch(3)
+
+_llint_op_create_rest:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_create_rest)
+    dispatch(4)
+
+_llint_op_instanceof:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_instanceof)
+    dispatch(4)
+
+_llint_op_get_by_id_with_this:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_get_by_id_with_this)
+    dispatch(6)
+
+_llint_op_get_by_val_with_this:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_get_by_val_with_this)
+    dispatch(6)
+
+_llint_op_put_by_id_with_this:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_put_by_id_with_this)
+    dispatch(5)
+
+_llint_op_put_by_val_with_this:
+    traceExecution()
+    callOpcodeSlowPath(_slow_path_put_by_val_with_this)
+    dispatch(5)
+
+# Lastly, make sure that we can link even though we don't support all opcodes.
+# These opcodes should never arise when using LLInt or either JIT. We assert
+# as much.
+
+macro notSupported()
+    if ASSERT_ENABLED
+        crash()
+    else
+        # We should use whatever the smallest possible instruction is, just to
+        # ensure that there is a gap between instruction labels. If multiple
+        # smallest instructions exist, we should pick the one that is most
+        # likely result in execution being halted. Currently that is the break
+        # instruction on all architectures we're interested in. (Break is int3
+        # on Intel, which is 1 byte, and bkpt on ARMv7, which is 2 bytes.)
+        break
+    end
+end
diff --git a/llint/LowLevelInterpreter.cpp b/llint/LowLevelInterpreter.cpp
new file mode 100644
index 0000000..59a250f
--- /dev/null
+++ b/llint/LowLevelInterpreter.cpp
@@ -0,0 +1,533 @@
+/*
+ * Copyright (C) 2012, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LowLevelInterpreter.h"
+
+#include "LLIntOfflineAsmConfig.h"
+#include <wtf/InlineASM.h>
+
+#if !ENABLE(JIT)
+#include "CLoopStackInlines.h"
+#include "CodeBlock.h"
+#include "CommonSlowPaths.h"
+#include "Interpreter.h"
+#include "LLIntCLoop.h"
+#include "LLIntData.h"
+#include "LLIntSlowPaths.h"
+#include "JSCInlines.h"
+#include <wtf/Assertions.h>
+#include <wtf/MathExtras.h>
+
+using namespace JSC::LLInt;
+
+// LLInt C Loop opcodes
+// ====================
+// In the implementation of the C loop, the LLint trampoline glue functions
+// (e.g. llint_program_prologue, llint_eval_prologue, etc) are addressed as
+// if they are bytecode handlers. That means the names of the trampoline
+// functions will be added to the OpcodeID list via the
+// FOR_EACH_LLINT_OPCODE_EXTENSION() macro that FOR_EACH_OPCODE_ID()
+// includes.
+//
+// In addition, some JIT trampoline functions which are needed by LLInt
+// (e.g. getHostCallReturnValue, ctiOpThrowNotCaught) are also added as
+// bytecodes, and the CLoop will provide bytecode handlers for them.
+//
+// In the CLoop, we can only dispatch indirectly to these bytecodes
+// (including the LLInt and JIT extensions). All other dispatches
+// (i.e. goto's) must be to a known label (i.e. local / global labels).
+
+
+// How are the opcodes named?
+// ==========================
+// Here is a table to show examples of how each of the manifestation of the
+// opcodes are named:
+//
+//   Type:                        Opcode            Trampoline Glue
+//                                ======            ===============
+//   [In the llint .asm files]
+//   llint labels:                llint_op_enter    llint_program_prologue
+//
+//   OpcodeID:                    op_enter          llint_program
+//                                [in Opcode.h]     [in LLIntOpcode.h]
+//
+//   When using a switch statement dispatch in the CLoop, each "opcode" is
+//   a case statement:
+//   Opcode:                      case op_enter:    case llint_program_prologue:
+//
+//   When using a computed goto dispatch in the CLoop, each opcode is a label:
+//   Opcode:                      op_enter:         llint_program_prologue:
+
+
+//============================================================================
+// Define the opcode dispatch mechanism when using the C loop:
+//
+
+// These are for building a C Loop interpreter:
+#define OFFLINE_ASM_BEGIN
+#define OFFLINE_ASM_END
+
+#if ENABLE(OPCODE_TRACING)
+#define TRACE_OPCODE(opcode) dataLogF("   op %s\n", #opcode)
+#else
+#define TRACE_OPCODE(opcode)
+#endif
+
+// To keep compilers happy in case of unused labels, force usage of the label:
+#define USE_LABEL(label) \
+    do { \
+        if (false) \
+            goto label; \
+    } while (false)
+
+#define OFFLINE_ASM_OPCODE_LABEL(opcode) DEFINE_OPCODE(opcode) USE_LABEL(opcode); TRACE_OPCODE(opcode);
+
+#define OFFLINE_ASM_GLOBAL_LABEL(label)  OFFLINE_ASM_GLUE_LABEL(label)
+
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+#define OFFLINE_ASM_GLUE_LABEL(label)  label: USE_LABEL(label);
+#else
+#define OFFLINE_ASM_GLUE_LABEL(label)  case label: label: USE_LABEL(label);
+#endif
+
+#define OFFLINE_ASM_LOCAL_LABEL(label) label: USE_LABEL(label);
+
+
+//============================================================================
+// Some utilities:
+//
+
+namespace JSC {
+namespace LLInt {
+
+#if USE(JSVALUE32_64)
+static double Ints2Double(uint32_t lo, uint32_t hi)
+{
+    union {
+        double dval;
+        uint64_t ival64;
+    } u;
+    u.ival64 = (static_cast<uint64_t>(hi) << 32) | lo;
+    return u.dval;
+}
+
+static void Double2Ints(double val, uint32_t& lo, uint32_t& hi)
+{
+    union {
+        double dval;
+        uint64_t ival64;
+    } u;
+    u.dval = val;
+    hi = static_cast<uint32_t>(u.ival64 >> 32);
+    lo = static_cast<uint32_t>(u.ival64);
+}
+#endif // USE(JSVALUE32_64)
+
+} // namespace LLint
+
+
+//============================================================================
+// CLoopRegister is the storage for an emulated CPU register.
+// It defines the policy of how ints smaller than intptr_t are packed into the
+// pseudo register, as well as hides endianness differences.
+
+struct CLoopRegister {
+    CLoopRegister() { i = static_cast<intptr_t>(0xbadbeef0baddbeef); }
+    union {
+        intptr_t i;
+        uintptr_t u;
+#if USE(JSVALUE64)
+#if CPU(BIG_ENDIAN)
+        struct {
+            int32_t i32padding;
+            int32_t i32;
+        };
+        struct {
+            uint32_t u32padding;
+            uint32_t u32;
+        };
+        struct {
+            int8_t i8padding[7];
+            int8_t i8;
+        };
+        struct {
+            uint8_t u8padding[7];
+            uint8_t u8;
+        };
+#else // !CPU(BIG_ENDIAN)
+        struct {
+            int32_t i32;
+            int32_t i32padding;
+        };
+        struct {
+            uint32_t u32;
+            uint32_t u32padding;
+        };
+        struct {
+            int8_t i8;
+            int8_t i8padding[7];
+        };
+        struct {
+            uint8_t u8;
+            uint8_t u8padding[7];
+        };
+#endif // !CPU(BIG_ENDIAN)
+#else // !USE(JSVALUE64)
+        int32_t i32;
+        uint32_t u32;
+
+#if CPU(BIG_ENDIAN)
+        struct {
+            int8_t i8padding[3];
+            int8_t i8;
+        };
+        struct {
+            uint8_t u8padding[3];
+            uint8_t u8;
+        };
+
+#else // !CPU(BIG_ENDIAN)
+        struct {
+            int8_t i8;
+            int8_t i8padding[3];
+        };
+        struct {
+            uint8_t u8;
+            uint8_t u8padding[3];
+        };
+#endif // !CPU(BIG_ENDIAN)
+#endif // !USE(JSVALUE64)
+
+        intptr_t* ip;
+        int8_t* i8p;
+        void* vp;
+        CallFrame* callFrame;
+        ExecState* execState;
+        void* instruction;
+        VM* vm;
+        JSCell* cell;
+        ProtoCallFrame* protoCallFrame;
+        NativeFunction nativeFunc;
+#if USE(JSVALUE64)
+        int64_t i64;
+        uint64_t u64;
+        EncodedJSValue encodedJSValue;
+        double castToDouble;
+#endif
+        Opcode opcode;
+    };
+
+    operator ExecState*() { return execState; }
+    operator Instruction*() { return reinterpret_cast<Instruction*>(instruction); }
+    operator VM*() { return vm; }
+    operator ProtoCallFrame*() { return protoCallFrame; }
+    operator Register*() { return reinterpret_cast<Register*>(vp); }
+    operator JSCell*() { return cell; }
+
+#if USE(JSVALUE64)
+    inline void clearHighWord() { i32padding = 0; }
+#else
+    inline void clearHighWord() { }
+#endif
+};
+
+//============================================================================
+// The llint C++ interpreter loop:
+//
+
+JSValue CLoop::execute(OpcodeID entryOpcodeID, void* executableAddress, VM* vm, ProtoCallFrame* protoCallFrame, bool isInitializationPass)
+{
+    #define CAST reinterpret_cast
+    #define SIGN_BIT32(x) ((x) & 0x80000000)
+
+    // One-time initialization of our address tables. We have to put this code
+    // here because our labels are only in scope inside this function. The
+    // caller (or one of its ancestors) is responsible for ensuring that this
+    // is only called once during the initialization of the VM before threads
+    // are at play.
+    if (UNLIKELY(isInitializationPass)) {
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+        Opcode* opcodeMap = LLInt::opcodeMap();
+        #define OPCODE_ENTRY(__opcode, length) \
+            opcodeMap[__opcode] = bitwise_cast<void*>(&&__opcode);
+        FOR_EACH_OPCODE_ID(OPCODE_ENTRY)
+        #undef OPCODE_ENTRY
+
+        #define LLINT_OPCODE_ENTRY(__opcode, length) \
+            opcodeMap[__opcode] = bitwise_cast<void*>(&&__opcode);
+
+        FOR_EACH_LLINT_NATIVE_HELPER(LLINT_OPCODE_ENTRY)
+        #undef LLINT_OPCODE_ENTRY
+#endif
+        // Note: we can only set the exceptionInstructions after we have
+        // initialized the opcodeMap above. This is because getCodePtr()
+        // can depend on the opcodeMap.
+        Instruction* exceptionInstructions = LLInt::exceptionInstructions();
+        for (int i = 0; i < maxOpcodeLength + 1; ++i)
+            exceptionInstructions[i].u.pointer =
+                LLInt::getCodePtr(llint_throw_from_slow_path_trampoline);
+
+        return JSValue();
+    }
+
+    // Define the pseudo registers used by the LLINT C Loop backend:
+    ASSERT(sizeof(CLoopRegister) == sizeof(intptr_t));
+
+    union CLoopDoubleRegister {
+        double d;
+#if USE(JSVALUE64)
+        int64_t castToInt64;
+#endif
+    };
+
+    // The CLoop llint backend is initially based on the ARMv7 backend, and
+    // then further enhanced with a few instructions from the x86 backend to
+    // support building for X64 targets. Hence, the shape of the generated
+    // code and the usage convention of registers will look a lot like the
+    // ARMv7 backend's.
+    //
+    // For example, on a 32-bit build:
+    // 1. Outgoing args will be set up as follows:
+    //    arg1 in t0 (r0 on ARM)
+    //    arg2 in t1 (r1 on ARM)
+    // 2. 32 bit return values will be in t0 (r0 on ARM).
+    // 3. 64 bit return values (e.g. doubles) will be in t0,t1 (r0,r1 on ARM).
+    //
+    // But instead of naming these simulator registers based on their ARM
+    // counterparts, we'll name them based on their original llint asm names.
+    // This will make it easier to correlate the generated code with the
+    // original llint asm code.
+    //
+    // On a 64-bit build, it more like x64 in that the registers are 64 bit.
+    // Hence:
+    // 1. Outgoing args are still the same: arg1 in t0, arg2 in t1, etc.
+    // 2. 32 bit result values will be in the low 32-bit of t0.
+    // 3. 64 bit result values will be in t0.
+
+    CLoopRegister t0, t1, t2, t3, t5, t7, sp, cfr, lr, pc;
+#if USE(JSVALUE64)
+    CLoopRegister pcBase, tagTypeNumber, tagMask;
+#endif
+    CLoopDoubleRegister d0, d1;
+
+    lr.opcode = getOpcode(llint_return_to_host);
+    sp.vp = vm->interpreter->cloopStack().topOfStack() + 1;
+    cfr.callFrame = vm->topCallFrame;
+#ifndef NDEBUG
+    void* startSP = sp.vp;
+    CallFrame* startCFR = cfr.callFrame;
+#endif
+
+    // Initialize the incoming args for doVMEntryToJavaScript:
+    t0.vp = executableAddress;
+    t1.vm = vm;
+    t2.protoCallFrame = protoCallFrame;
+
+#if USE(JSVALUE64)
+    // For the ASM llint, JITStubs takes care of this initialization. We do
+    // it explicitly here for the C loop:
+    tagTypeNumber.i = 0xFFFF000000000000;
+    tagMask.i = 0xFFFF000000000002;
+#endif // USE(JSVALUE64)
+
+    // Interpreter variables for value passing between opcodes and/or helpers:
+    NativeFunction nativeFunc = 0;
+    JSValue functionReturnValue;
+    Opcode opcode = getOpcode(entryOpcodeID);
+
+#define PUSH(cloopReg) \
+    do { \
+        sp.ip--; \
+        *sp.ip = cloopReg.i; \
+    } while (false)
+
+#define POP(cloopReg) \
+    do { \
+        cloopReg.i = *sp.ip; \
+        sp.ip++; \
+    } while (false)
+
+#if ENABLE(OPCODE_STATS)
+#define RECORD_OPCODE_STATS(__opcode) OpcodeStats::recordInstruction(__opcode)
+#else
+#define RECORD_OPCODE_STATS(__opcode)
+#endif
+
+#if USE(JSVALUE32_64)
+#define FETCH_OPCODE() pc.opcode
+#else // USE(JSVALUE64)
+#define FETCH_OPCODE() *bitwise_cast<Opcode*>(pcBase.i8p + pc.i * 8)
+#endif // USE(JSVALUE64)
+
+#define NEXT_INSTRUCTION() \
+    do {                         \
+        opcode = FETCH_OPCODE(); \
+        DISPATCH_OPCODE();       \
+    } while (false)
+
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+
+    //========================================================================
+    // Loop dispatch mechanism using computed goto statements:
+
+    #define DISPATCH_OPCODE() goto *opcode
+
+    #define DEFINE_OPCODE(__opcode) \
+        __opcode: \
+            RECORD_OPCODE_STATS(__opcode);
+
+    // Dispatch to the current PC's bytecode:
+    DISPATCH_OPCODE();
+
+#else // !ENABLE(COMPUTED_GOTO_OPCODES)
+    //========================================================================
+    // Loop dispatch mechanism using a C switch statement:
+
+    #define DISPATCH_OPCODE() goto dispatchOpcode
+
+    #define DEFINE_OPCODE(__opcode) \
+        case __opcode: \
+        __opcode: \
+            RECORD_OPCODE_STATS(__opcode);
+
+    // Dispatch to the current PC's bytecode:
+    dispatchOpcode:
+    switch (opcode)
+
+#endif // !ENABLE(COMPUTED_GOTO_OPCODES)
+
+    //========================================================================
+    // Bytecode handlers:
+    {
+        // This is the file generated by offlineasm, which contains all of the
+        // bytecode handlers for the interpreter, as compiled from
+        // LowLevelInterpreter.asm and its peers.
+
+        #include "LLIntAssembly.h"
+
+        OFFLINE_ASM_GLUE_LABEL(llint_return_to_host)
+        {
+            ASSERT(startSP == sp.vp);
+            ASSERT(startCFR == cfr.callFrame);
+#if USE(JSVALUE32_64)
+            return JSValue(t1.i, t0.i); // returning JSValue(tag, payload);
+#else
+            return JSValue::decode(t0.encodedJSValue);
+#endif
+        }
+
+        // In the ASM llint, getHostCallReturnValue() is a piece of glue
+        // function provided by the JIT (see jit/JITOperations.cpp).
+        // We simulate it here with a pseduo-opcode handler.
+        OFFLINE_ASM_GLUE_LABEL(getHostCallReturnValue)
+        {
+            // The part in getHostCallReturnValueWithExecState():
+            JSValue result = vm->hostCallReturnValue;
+#if USE(JSVALUE32_64)
+            t1.i = result.tag();
+            t0.i = result.payload();
+#else
+            t0.encodedJSValue = JSValue::encode(result);
+#endif
+            opcode = lr.opcode;
+            DISPATCH_OPCODE();
+        }
+
+#if !ENABLE(COMPUTED_GOTO_OPCODES)
+    default:
+        ASSERT(false);
+#endif
+
+    } // END bytecode handler cases.
+
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+    // Keep the compiler happy so that it doesn't complain about unused
+    // labels for the LLInt trampoline glue. The labels are automatically
+    // emitted by label macros above, and some of them are referenced by
+    // the llint generated code. Since we can't tell ahead of time which
+    // will be referenced and which will be not, we'll just passify the
+    // compiler on all such labels:
+    #define LLINT_OPCODE_ENTRY(__opcode, length) \
+        UNUSED_LABEL(__opcode);
+        FOR_EACH_OPCODE_ID(LLINT_OPCODE_ENTRY);
+    #undef LLINT_OPCODE_ENTRY
+#endif
+
+    #undef NEXT_INSTRUCTION
+    #undef DEFINE_OPCODE
+    #undef CHECK_FOR_TIMEOUT
+    #undef CAST
+    #undef SIGN_BIT32
+
+    return JSValue(); // to suppress a compiler warning.
+} // Interpreter::llintCLoopExecute()
+
+} // namespace JSC
+
+#elif !COMPILER(MSVC)
+
+//============================================================================
+// Define the opcode dispatch mechanism when using an ASM loop:
+//
+
+// These are for building an interpreter from generated assembly code:
+#define OFFLINE_ASM_BEGIN   asm (
+#define OFFLINE_ASM_END     );
+
+#define OFFLINE_ASM_OPCODE_LABEL(__opcode) OFFLINE_ASM_LOCAL_LABEL(llint_##__opcode)
+#define OFFLINE_ASM_GLUE_LABEL(__opcode)   OFFLINE_ASM_LOCAL_LABEL(__opcode)
+
+#if CPU(ARM_THUMB2)
+#define OFFLINE_ASM_GLOBAL_LABEL(label)          \
+    ".text\n"                                    \
+    ".align 4\n"                                 \
+    ".globl " SYMBOL_STRING(label) "\n"          \
+    HIDE_SYMBOL(label) "\n"                      \
+    ".thumb\n"                                   \
+    ".thumb_func " THUMB_FUNC_PARAM(label) "\n"  \
+    SYMBOL_STRING(label) ":\n"
+#elif CPU(ARM64)
+#define OFFLINE_ASM_GLOBAL_LABEL(label)         \
+    ".text\n"                                   \
+    ".align 4\n"                                \
+    ".globl " SYMBOL_STRING(label) "\n"         \
+    HIDE_SYMBOL(label) "\n"                     \
+    SYMBOL_STRING(label) ":\n"
+#else
+#define OFFLINE_ASM_GLOBAL_LABEL(label)         \
+    ".text\n"                                   \
+    ".globl " SYMBOL_STRING(label) "\n"         \
+    HIDE_SYMBOL(label) "\n"                     \
+    SYMBOL_STRING(label) ":\n"
+#endif
+
+#define OFFLINE_ASM_LOCAL_LABEL(label)   LOCAL_LABEL_STRING(label) ":\n"
+
+// This is a file generated by offlineasm, which contains all of the assembly code
+// for the interpreter, as compiled from LowLevelInterpreter.asm.
+#include "LLIntAssembly.h"
+
+#endif // ENABLE(JIT)
diff --git a/llint/LowLevelInterpreter.h b/llint/LowLevelInterpreter.h
new file mode 100644
index 0000000..83008e1
--- /dev/null
+++ b/llint/LowLevelInterpreter.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Opcode.h"
+
+#if !ENABLE(JIT)
+
+namespace JSC {
+
+// The following is a set of alias for the opcode names. This is needed
+// because there is code (e.g. in GetByIdStatus.cpp and PutByIdStatus.cpp)
+// which refers to the opcodes expecting them to be prefixed with "llint_".
+// In the CLoop implementation, the 2 are equivalent. Hence, we set up this
+// alias here.
+
+#define LLINT_OPCODE_ALIAS(opcode, length) \
+    const OpcodeID llint_##opcode = opcode;
+FOR_EACH_CORE_OPCODE_ID(LLINT_OPCODE_ALIAS)
+#undef LLINT_OPCODE_ALIAS
+
+} // namespace JSC
+
+#endif // !ENABLE(JIT)
diff --git a/llint/LowLevelInterpreter32_64.asm b/llint/LowLevelInterpreter32_64.asm
new file mode 100644
index 0000000..7be0da1
--- /dev/null
+++ b/llint/LowLevelInterpreter32_64.asm
@@ -0,0 +1,2533 @@
+# Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# Utilities
+macro dispatch(advance)
+    addp advance * 4, PC
+    jmp [PC]
+end
+
+macro dispatchBranchWithOffset(pcOffset)
+    lshifti 2, pcOffset
+    addp pcOffset, PC
+    jmp [PC]
+end
+
+macro dispatchBranch(pcOffset)
+    loadi pcOffset, t0
+    dispatchBranchWithOffset(t0)
+end
+
+macro dispatchAfterCall()
+    loadi ArgumentCount + TagOffset[cfr], PC
+    loadi 4[PC], t3
+    storei r1, TagOffset[cfr, t3, 8]
+    storei r0, PayloadOffset[cfr, t3, 8]
+    valueProfile(r1, r0, 4 * (CallOpCodeSize - 1), t3)
+    dispatch(CallOpCodeSize)
+end
+
+macro cCall2(function)
+    if ARM or ARMv7 or ARMv7_TRADITIONAL or MIPS or SH4
+        call function
+    elsif X86 or X86_WIN
+        subp 8, sp
+        push a1
+        push a0
+        call function
+        addp 16, sp
+    elsif C_LOOP
+        cloopCallSlowPath function, a0, a1
+    else
+        error
+    end
+end
+
+macro cCall2Void(function)
+    if C_LOOP
+        cloopCallSlowPathVoid function, a0, a1
+    else
+        cCall2(function)
+    end
+end
+
+macro cCall4(function)
+    if ARM or ARMv7 or ARMv7_TRADITIONAL or MIPS or SH4
+        call function
+    elsif X86 or X86_WIN
+        push a3
+        push a2
+        push a1
+        push a0
+        call function
+        addp 16, sp
+    elsif C_LOOP
+        error
+    else
+        error
+    end
+end
+
+macro callSlowPath(slowPath)
+    move cfr, a0
+    move PC, a1
+    cCall2(slowPath)
+    move r0, PC
+end
+
+macro doVMEntry(makeCall)
+    functionPrologue()
+    pushCalleeSaves()
+
+    # x86 needs to load arguments from the stack
+    if X86 or X86_WIN
+        loadp 16[cfr], a2
+        loadp 12[cfr], a1
+        loadp 8[cfr], a0
+    end
+
+    const entry = a0
+    const vm = a1
+    const protoCallFrame = a2
+
+    # We are using t3, t4 and t5 as temporaries through the function.
+    # Since we have the guarantee that tX != aY when X != Y, we are safe from
+    # aliasing problems with our arguments.
+
+    if ARMv7
+        vmEntryRecord(cfr, t3)
+        move t3, sp
+    else
+        vmEntryRecord(cfr, sp)
+    end
+
+    storep vm, VMEntryRecord::m_vm[sp]
+    loadp VM::topCallFrame[vm], t4
+    storep t4, VMEntryRecord::m_prevTopCallFrame[sp]
+    loadp VM::topVMEntryFrame[vm], t4
+    storep t4, VMEntryRecord::m_prevTopVMEntryFrame[sp]
+
+    # Align stack pointer
+    if X86_WIN or MIPS
+        addp CallFrameAlignSlots * SlotSize, sp, t3
+        andp ~StackAlignmentMask, t3
+        subp t3, CallFrameAlignSlots * SlotSize, sp
+    elsif ARM or ARMv7 or ARMv7_TRADITIONAL
+        addp CallFrameAlignSlots * SlotSize, sp, t3
+        clrbp t3, StackAlignmentMask, t3
+        if ARMv7
+            subp t3, CallFrameAlignSlots * SlotSize, t3
+            move t3, sp
+        else
+            subp t3, CallFrameAlignSlots * SlotSize, sp
+        end
+    end
+
+    loadi ProtoCallFrame::paddedArgCount[protoCallFrame], t4
+    addp CallFrameHeaderSlots, t4, t4
+    lshiftp 3, t4
+    subp sp, t4, t3
+
+    # Ensure that we have enough additional stack capacity for the incoming args,
+    # and the frame for the JS code we're executing. We need to do this check
+    # before we start copying the args from the protoCallFrame below.
+    if C_LOOP
+        bpaeq t3, VM::m_cloopStackLimit[vm], .stackHeightOK
+    else
+        bpaeq t3, VM::m_softStackLimit[vm], .stackHeightOK
+    end
+
+    if C_LOOP
+        move entry, t4
+        move vm, t5
+        cloopCallSlowPath _llint_stack_check_at_vm_entry, vm, t3
+        bpeq t0, 0, .stackCheckFailed
+        move t4, entry
+        move t5, vm
+        jmp .stackHeightOK
+
+.stackCheckFailed:
+        move t4, entry
+        move t5, vm
+    end
+
+    subp 8, sp # Align stack for cCall2() to make a call.
+    move vm, a0
+    move protoCallFrame, a1
+    cCall2(_llint_throw_stack_overflow_error)
+
+    if ARMv7
+        vmEntryRecord(cfr, t3)
+        move t3, sp
+    else
+        vmEntryRecord(cfr, sp)
+    end
+
+    loadp VMEntryRecord::m_vm[sp], t5
+    loadp VMEntryRecord::m_prevTopCallFrame[sp], t4
+    storep t4, VM::topCallFrame[t5]
+    loadp VMEntryRecord::m_prevTopVMEntryFrame[sp], t4
+    storep t4, VM::topVMEntryFrame[t5]
+
+    if ARMv7
+        subp cfr, CalleeRegisterSaveSize, t5
+        move t5, sp
+    else
+        subp cfr, CalleeRegisterSaveSize, sp
+    end
+
+    popCalleeSaves()
+    functionEpilogue()
+    ret
+
+.stackHeightOK:
+    move t3, sp
+    move 4, t3
+
+.copyHeaderLoop:
+    subi 1, t3
+    loadi TagOffset[protoCallFrame, t3, 8], t5
+    storei t5, TagOffset + CodeBlock[sp, t3, 8]
+    loadi PayloadOffset[protoCallFrame, t3, 8], t5
+    storei t5, PayloadOffset + CodeBlock[sp, t3, 8]
+    btinz t3, .copyHeaderLoop
+
+    loadi PayloadOffset + ProtoCallFrame::argCountAndCodeOriginValue[protoCallFrame], t4
+    subi 1, t4
+    loadi ProtoCallFrame::paddedArgCount[protoCallFrame], t5
+    subi 1, t5
+
+    bieq t4, t5, .copyArgs
+.fillExtraArgsLoop:
+    subi 1, t5
+    storei UndefinedTag, ThisArgumentOffset + 8 + TagOffset[sp, t5, 8]
+    storei 0, ThisArgumentOffset + 8 + PayloadOffset[sp, t5, 8]
+    bineq t4, t5, .fillExtraArgsLoop
+
+.copyArgs:
+    loadp ProtoCallFrame::args[protoCallFrame], t3
+
+.copyArgsLoop:
+    btiz t4, .copyArgsDone
+    subi 1, t4
+    loadi TagOffset[t3, t4, 8], t5
+    storei t5, ThisArgumentOffset + 8 + TagOffset[sp, t4, 8]
+    loadi PayloadOffset[t3, t4, 8], t5
+    storei t5, ThisArgumentOffset + 8 + PayloadOffset[sp, t4, 8]
+    jmp .copyArgsLoop
+
+.copyArgsDone:
+    storep sp, VM::topCallFrame[vm]
+    storep cfr, VM::topVMEntryFrame[vm]
+
+    makeCall(entry, t3, t4)
+
+    if ARMv7
+        vmEntryRecord(cfr, t3)
+        move t3, sp
+    else
+        vmEntryRecord(cfr, sp)
+    end
+
+    loadp VMEntryRecord::m_vm[sp], t5
+    loadp VMEntryRecord::m_prevTopCallFrame[sp], t4
+    storep t4, VM::topCallFrame[t5]
+    loadp VMEntryRecord::m_prevTopVMEntryFrame[sp], t4
+    storep t4, VM::topVMEntryFrame[t5]
+
+    if ARMv7
+        subp cfr, CalleeRegisterSaveSize, t5
+        move t5, sp
+    else
+        subp cfr, CalleeRegisterSaveSize, sp
+    end
+
+    popCalleeSaves()
+    functionEpilogue()
+    ret
+end
+
+macro makeJavaScriptCall(entry, temp, unused)
+    addp CallerFrameAndPCSize, sp
+    checkStackPointerAlignment(temp, 0xbad0dc02)
+    if C_LOOP
+        cloopCallJSFunction entry
+    else
+        call entry
+    end
+    checkStackPointerAlignment(temp, 0xbad0dc03)
+    subp CallerFrameAndPCSize, sp
+end
+
+macro makeHostFunctionCall(entry, temp1, temp2)
+    move entry, temp1
+    storep cfr, [sp]
+    if C_LOOP
+        move sp, a0
+        storep lr, PtrSize[sp]
+        cloopCallNative temp1
+    elsif X86 or X86_WIN
+        # Put callee frame pointer on stack as arg0, also put it in ecx for "fastcall" targets
+        move 0, temp2
+        move temp2, 4[sp] # put 0 in ReturnPC
+        move sp, a0 # a0 is ecx
+        push temp2 # Push dummy arg1
+        push a0
+        call temp1
+        addp 8, sp
+    else
+        move sp, a0
+        call temp1
+    end
+end
+
+_handleUncaughtException:
+    loadp Callee + PayloadOffset[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+    restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(t3, t0)
+    loadp VM::callFrameForCatch[t3], cfr
+    storep 0, VM::callFrameForCatch[t3]
+
+    loadp CallerFrame[cfr], cfr
+
+    if ARMv7
+        vmEntryRecord(cfr, t3)
+        move t3, sp
+    else
+        vmEntryRecord(cfr, sp)
+    end
+
+    loadp VMEntryRecord::m_vm[sp], t3
+    loadp VMEntryRecord::m_prevTopCallFrame[sp], t5
+    storep t5, VM::topCallFrame[t3]
+    loadp VMEntryRecord::m_prevTopVMEntryFrame[sp], t5
+    storep t5, VM::topVMEntryFrame[t3]
+
+    if ARMv7
+        subp cfr, CalleeRegisterSaveSize, t3
+        move t3, sp
+    else
+        subp cfr, CalleeRegisterSaveSize, sp
+    end
+
+    popCalleeSaves()
+    functionEpilogue()
+    ret
+
+macro doReturnFromHostFunction(extraStackSpace)
+    functionEpilogue(extraStackSpace)
+    ret
+end
+
+# Debugging operation if you'd like to print an operand in the instruction stream. fromWhere
+# should be an immediate integer - any integer you like; use it to identify the place you're
+# debugging from. operand should likewise be an immediate, and should identify the operand
+# in the instruction stream you'd like to print out.
+macro traceOperand(fromWhere, operand)
+    move fromWhere, a2
+    move operand, a3
+    move cfr, a0
+    move PC, a1
+    cCall4(_llint_trace_operand)
+    move r0, PC
+    move r1, cfr
+end
+
+# Debugging operation if you'd like to print the value of an operand in the instruction
+# stream. Same as traceOperand(), but assumes that the operand is a register, and prints its
+# value.
+macro traceValue(fromWhere, operand)
+    move fromWhere, a2
+    move operand, a3
+    move cfr, a0
+    move PC, a1
+    cCall4(_llint_trace_value)
+    move r0, PC
+    move r1, cfr
+end
+
+# Call a slowPath for call opcodes.
+macro callCallSlowPath(slowPath, action)
+    storep PC, ArgumentCount + TagOffset[cfr]
+    move cfr, a0
+    move PC, a1
+    cCall2(slowPath)
+    action(r0, r1)
+end
+
+macro callWatchdogTimerHandler(throwHandler)
+    storei PC, ArgumentCount + TagOffset[cfr]
+    move cfr, a0
+    move PC, a1
+    cCall2(_llint_slow_path_handle_watchdog_timer)
+    btpnz r0, throwHandler
+    loadi ArgumentCount + TagOffset[cfr], PC
+end
+
+macro checkSwitchToJITForLoop()
+    checkSwitchToJIT(
+        1,
+        macro ()
+            storei PC, ArgumentCount + TagOffset[cfr]
+            move cfr, a0
+            move PC, a1
+            cCall2(_llint_loop_osr)
+            btpz r0, .recover
+            move r1, sp
+            jmp r0
+        .recover:
+            loadi ArgumentCount + TagOffset[cfr], PC
+        end)
+end
+
+macro loadVariable(operand, index, tag, payload)
+    loadisFromInstruction(operand, index)
+    loadi TagOffset[cfr, index, 8], tag
+    loadi PayloadOffset[cfr, index, 8], payload
+end
+
+# Index, tag, and payload must be different registers. Index is not
+# changed.
+macro loadConstantOrVariable(index, tag, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    loadi TagOffset[cfr, index, 8], tag
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], payload
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    loadp TagOffset[payload, index, 8], tag
+    loadp PayloadOffset[payload, index, 8], payload
+.done:
+end
+
+macro loadConstantOrVariableTag(index, tag)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    loadi TagOffset[cfr, index, 8], tag
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], tag
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[tag], tag
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    loadp TagOffset[tag, index, 8], tag
+.done:
+end
+
+# Index and payload may be the same register. Index may be clobbered.
+macro loadConstantOrVariable2Reg(index, tag, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    loadi TagOffset[cfr, index, 8], tag
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], tag
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[tag], tag
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    lshifti 3, index
+    addp index, tag
+    loadp PayloadOffset[tag], payload
+    loadp TagOffset[tag], tag
+.done:
+end
+
+macro loadConstantOrVariablePayloadTagCustom(index, tagCheck, payload)
+    bigteq index, FirstConstantRegisterIndex, .constant
+    tagCheck(TagOffset[cfr, index, 8])
+    loadi PayloadOffset[cfr, index, 8], payload
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], payload
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[payload], payload
+    # There is a bit of evil here: if the index contains a value >= FirstConstantRegisterIndex,
+    # then value << 3 will be equal to (value - FirstConstantRegisterIndex) << 3.
+    tagCheck(TagOffset[payload, index, 8])
+    loadp PayloadOffset[payload, index, 8], payload
+.done:
+end
+
+# Index and payload must be different registers. Index is not mutated. Use
+# this if you know what the tag of the variable should be. Doing the tag
+# test as part of loading the variable reduces register use, but may not
+# be faster than doing loadConstantOrVariable followed by a branch on the
+# tag.
+macro loadConstantOrVariablePayload(index, expectedTag, payload, slow)
+    loadConstantOrVariablePayloadTagCustom(
+        index,
+        macro (actualTag) bineq actualTag, expectedTag, slow end,
+        payload)
+end
+
+macro loadConstantOrVariablePayloadUnchecked(index, payload)
+    loadConstantOrVariablePayloadTagCustom(
+        index,
+        macro (actualTag) end,
+        payload)
+end
+
+macro writeBarrierOnOperand(cellOperand)
+    loadisFromInstruction(cellOperand, t1)
+    loadConstantOrVariablePayload(t1, CellTag, t2, .writeBarrierDone)
+    skipIfIsRememberedOrInEden(
+        t2, 
+        macro()
+            push cfr, PC
+            # We make two extra slots because cCall2 will poke.
+            subp 8, sp
+            move t2, a1 # t2 can be a0 on x86
+            move cfr, a0
+            cCall2Void(_llint_write_barrier_slow)
+            addp 8, sp
+            pop PC, cfr
+        end)
+.writeBarrierDone:
+end
+
+macro writeBarrierOnOperands(cellOperand, valueOperand)
+    loadisFromInstruction(valueOperand, t1)
+    loadConstantOrVariableTag(t1, t0)
+    bineq t0, CellTag, .writeBarrierDone
+
+    writeBarrierOnOperand(cellOperand)
+.writeBarrierDone:
+end
+
+macro writeBarrierOnGlobal(valueOperand, loadHelper)
+    loadisFromInstruction(valueOperand, t1)
+    loadConstantOrVariableTag(t1, t0)
+    bineq t0, CellTag, .writeBarrierDone
+
+    loadHelper(t3)
+
+    skipIfIsRememberedOrInEden(
+        t3,
+        macro()
+            push cfr, PC
+            # We make two extra slots because cCall2 will poke.
+            subp 8, sp
+            move cfr, a0
+            move t3, a1
+            cCall2Void(_llint_write_barrier_slow)
+            addp 8, sp
+            pop PC, cfr
+        end)
+.writeBarrierDone:
+end
+
+macro writeBarrierOnGlobalObject(valueOperand)
+    writeBarrierOnGlobal(valueOperand,
+        macro(registerToStoreGlobal)
+            loadp CodeBlock[cfr], registerToStoreGlobal
+            loadp CodeBlock::m_globalObject[registerToStoreGlobal], registerToStoreGlobal
+        end)
+end
+
+macro writeBarrierOnGlobalLexicalEnvironment(valueOperand)
+    writeBarrierOnGlobal(valueOperand,
+        macro(registerToStoreGlobal)
+            loadp CodeBlock[cfr], registerToStoreGlobal
+            loadp CodeBlock::m_globalObject[registerToStoreGlobal], registerToStoreGlobal
+            loadp JSGlobalObject::m_globalLexicalEnvironment[registerToStoreGlobal], registerToStoreGlobal
+        end)
+end
+
+macro valueProfile(tag, payload, operand, scratch)
+    loadp operand[PC], scratch
+    storei tag, ValueProfile::m_buckets + TagOffset[scratch]
+    storei payload, ValueProfile::m_buckets + PayloadOffset[scratch]
+end
+
+
+# Entrypoints into the interpreter
+
+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
+macro functionArityCheck(doneLabel, slowPath)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    biaeq t0, CodeBlock::m_numParameters[t1], doneLabel
+    move cfr, a0
+    move PC, a1
+    cCall2(slowPath)   # This slowPath has a simple protocol: t0 = 0 => no error, t0 != 0 => error
+    btiz r0, .noError
+    move r1, cfr   # r1 contains caller frame
+    jmp _llint_throw_from_slow_path_trampoline
+
+.noError:
+    # r1 points to ArityCheckData.
+    loadp CommonSlowPaths::ArityCheckData::thunkToCall[r1], t3
+    btpz t3, .proceedInline
+    
+    loadp CommonSlowPaths::ArityCheckData::paddedStackSpace[r1], a0
+    call t3
+    if ASSERT_ENABLED
+        loadp ReturnPC[cfr], t0
+        loadp [t0], t0
+    end
+    jmp .continue
+
+.proceedInline:
+    loadi CommonSlowPaths::ArityCheckData::paddedStackSpace[r1], t1
+    btiz t1, .continue
+    loadi PayloadOffset + ArgumentCount[cfr], t2
+    addi CallFrameHeaderSlots, t2
+
+    // Check if there are some unaligned slots we can use
+    move t1, t3
+    andi StackAlignmentSlots - 1, t3
+    btiz t3, .noExtraSlot
+.fillExtraSlots:
+    move 0, t0
+    storei t0, PayloadOffset[cfr, t2, 8]
+    move UndefinedTag, t0
+    storei t0, TagOffset[cfr, t2, 8]
+    addi 1, t2
+    bsubinz 1, t3, .fillExtraSlots
+    andi ~(StackAlignmentSlots - 1), t1
+    btiz t1, .continue
+
+.noExtraSlot:
+    // Move frame up t1 slots
+    negi t1
+    move cfr, t3
+.copyLoop:
+    loadi PayloadOffset[t3], t0
+    storei t0, PayloadOffset[t3, t1, 8]
+    loadi TagOffset[t3], t0
+    storei t0, TagOffset[t3, t1, 8]
+    addp 8, t3
+    bsubinz 1, t2, .copyLoop
+
+    // Fill new slots with JSUndefined
+    move t1, t2
+.fillLoop:
+    move 0, t0
+    storei t0, PayloadOffset[t3, t1, 8]
+    move UndefinedTag, t0
+    storei t0, TagOffset[t3, t1, 8]
+    addp 8, t3
+    baddinz 1, t2, .fillLoop
+
+    lshiftp 3, t1
+    addp t1, cfr
+    addp t1, sp
+.continue:
+    # Reload CodeBlock and PC, since the slow_path clobbered it.
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_instructions[t1], PC
+    jmp doneLabel
+end
+
+macro branchIfException(label)
+    loadp Callee + PayloadOffset[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+    btiz VM::m_exception[t3], .noException
+    jmp label
+.noException:
+end
+
+
+# Instruction implementations
+
+_llint_op_enter:
+    traceExecution()
+    checkStackPointerAlignment(t2, 0xdead00e1)
+    loadp CodeBlock[cfr], t2                // t2<CodeBlock> = cfr.CodeBlock
+    loadi CodeBlock::m_numVars[t2], t2      // t2<size_t> = t2<CodeBlock>.m_numVars
+    btiz t2, .opEnterDone
+    move UndefinedTag, t0
+    move 0, t1
+    negi t2
+.opEnterLoop:
+    storei t0, TagOffset[cfr, t2, 8]
+    storei t1, PayloadOffset[cfr, t2, 8]
+    addi 1, t2
+    btinz t2, .opEnterLoop
+.opEnterDone:
+    callOpcodeSlowPath(_slow_path_enter)
+    dispatch(1)
+
+
+_llint_op_get_argument:
+    traceExecution()
+    loadisFromInstruction(1, t1)
+    loadisFromInstruction(2, t2)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    bilteq t0, t2, .opGetArgumentOutOfBounds
+    loadi ThisArgumentOffset + TagOffset[cfr, t2, 8], t0
+    loadi ThisArgumentOffset + PayloadOffset[cfr, t2, 8], t3
+    storei t0, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    valueProfile(t0, t3, 12, t1)
+    dispatch(4)
+
+.opGetArgumentOutOfBounds:
+    storei UndefinedTag, TagOffset[cfr, t1, 8]
+    storei 0, PayloadOffset[cfr, t1, 8]
+    valueProfile(UndefinedTag, 0, 12, t1)
+    dispatch(4)
+
+
+_llint_op_argument_count:
+    traceExecution()
+    loadisFromInstruction(1, t2)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    subi 1, t0
+    move Int32Tag, t1
+    storei t1, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(2)
+
+
+_llint_op_get_scope:
+    traceExecution()
+    loadi Callee + PayloadOffset[cfr], t0
+    loadi JSCallee::m_scope[t0], t0
+    loadisFromInstruction(1, t1)
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    dispatch(2)
+
+
+_llint_op_to_this:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], CellTag, .opToThisSlow
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bbneq JSCell::m_type[t0], FinalObjectType, .opToThisSlow
+    loadpFromInstruction(2, t2)
+    bpneq JSCell::m_structureID[t0], t2, .opToThisSlow
+    dispatch(4)
+
+.opToThisSlow:
+    callOpcodeSlowPath(_slow_path_to_this)
+    dispatch(4)
+
+
+_llint_op_check_tdz:
+    traceExecution()
+    loadisFromInstruction(1, t0)
+    loadConstantOrVariableTag(t0, t1)
+    bineq t1, EmptyValueTag, .opNotTDZ
+    callOpcodeSlowPath(_slow_path_throw_tdz_error)
+
+.opNotTDZ:
+    dispatch(2)
+
+
+_llint_op_mov:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t0
+    loadConstantOrVariable(t1, t2, t3)
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    dispatch(3)
+
+
+_llint_op_not:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    loadConstantOrVariable(t0, t2, t3)
+    bineq t2, BooleanTag, .opNotSlow
+    xori 1, t3
+    storei t2, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+.opNotSlow:
+    callOpcodeSlowPath(_slow_path_not)
+    dispatch(3)
+
+
+_llint_op_eq:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .opEqSlow
+    bieq t2, CellTag, .opEqSlow
+    bib t2, LowestTag, .opEqSlow
+    loadi 4[PC], t2
+    cieq t0, t1, t0
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.opEqSlow:
+    callOpcodeSlowPath(_slow_path_eq)
+    dispatch(4)
+
+
+_llint_op_eq_null:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .opEqNullImmediate
+    btbnz JSCell::m_flags[t0], MasqueradesAsUndefined, .opEqNullMasqueradesAsUndefined
+    move 0, t1
+    jmp .opEqNullNotImmediate
+.opEqNullMasqueradesAsUndefined:
+    loadp JSCell::m_structureID[t0], t1
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    cpeq Structure::m_globalObject[t1], t0, t1
+    jmp .opEqNullNotImmediate
+.opEqNullImmediate:
+    cieq t1, NullTag, t2
+    cieq t1, UndefinedTag, t1
+    ori t2, t1
+.opEqNullNotImmediate:
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+
+_llint_op_neq:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .opNeqSlow
+    bieq t2, CellTag, .opNeqSlow
+    bib t2, LowestTag, .opNeqSlow
+    loadi 4[PC], t2
+    cineq t0, t1, t0
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.opNeqSlow:
+    callOpcodeSlowPath(_slow_path_neq)
+    dispatch(4)
+    
+
+_llint_op_neq_null:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .opNeqNullImmediate
+    btbnz JSCell::m_flags[t0], MasqueradesAsUndefined, .opNeqNullMasqueradesAsUndefined
+    move 1, t1
+    jmp .opNeqNullNotImmediate
+.opNeqNullMasqueradesAsUndefined:
+    loadp JSCell::m_structureID[t0], t1
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    cpneq Structure::m_globalObject[t1], t0, t1
+    jmp .opNeqNullNotImmediate
+.opNeqNullImmediate:
+    cineq t1, NullTag, t2
+    cineq t1, UndefinedTag, t1
+    andi t2, t1
+.opNeqNullNotImmediate:
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+    storei t1, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+
+macro strictEq(equalityOperation, slowPath)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, t3, .slow
+    bib t2, LowestTag, .slow
+    bineq t2, CellTag, .notStringOrSymbol
+    bbaeq JSCell::m_type[t0], ObjectType, .notStringOrSymbol
+    bbb JSCell::m_type[t1], ObjectType, .slow
+.notStringOrSymbol:
+    loadi 4[PC], t2
+    equalityOperation(t0, t1, t0)
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(4)
+end
+
+_llint_op_stricteq:
+    traceExecution()
+    strictEq(macro (left, right, result) cieq left, right, result end, _slow_path_stricteq)
+
+
+_llint_op_nstricteq:
+    traceExecution()
+    strictEq(macro (left, right, result) cineq left, right, result end, _slow_path_nstricteq)
+
+
+_llint_op_inc:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opIncSlow
+    loadi PayloadOffset[cfr, t0, 8], t1
+    baddio 1, t1, .opIncSlow
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+.opIncSlow:
+    callOpcodeSlowPath(_slow_path_inc)
+    dispatch(2)
+
+
+_llint_op_dec:
+    traceExecution()
+    loadi 4[PC], t0
+    bineq TagOffset[cfr, t0, 8], Int32Tag, .opDecSlow
+    loadi PayloadOffset[cfr, t0, 8], t1
+    bsubio 1, t1, .opDecSlow
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(2)
+
+.opDecSlow:
+    callOpcodeSlowPath(_slow_path_dec)
+    dispatch(2)
+
+
+_llint_op_to_number:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    loadConstantOrVariable(t0, t2, t3)
+    bieq t2, Int32Tag, .opToNumberIsInt
+    biaeq t2, LowestTag, .opToNumberSlow
+.opToNumberIsInt:
+    storei t2, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    valueProfile(t2, t3, 12, t1)
+    dispatch(4)
+
+.opToNumberSlow:
+    callOpcodeSlowPath(_slow_path_to_number)
+    dispatch(4)
+
+
+_llint_op_to_string:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t1
+    loadConstantOrVariable(t0, t2, t3)
+    bineq t2, CellTag, .opToStringSlow
+    bbneq JSCell::m_type[t3], StringType, .opToStringSlow
+.opToStringIsString:
+    storei t2, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+.opToStringSlow:
+    callOpcodeSlowPath(_slow_path_to_string)
+    dispatch(3)
+
+
+_llint_op_negate:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 4[PC], t3
+    loadConstantOrVariable(t0, t1, t2)
+    loadisFromInstruction(3, t0)
+    bineq t1, Int32Tag, .opNegateSrcNotInt
+    btiz t2, 0x7fffffff, .opNegateSlow
+    negi t2
+    ori ArithProfileInt, t0
+    storei Int32Tag, TagOffset[cfr, t3, 8]
+    storeisToInstruction(t0, 3)
+    storei t2, PayloadOffset[cfr, t3, 8]
+    dispatch(4)
+.opNegateSrcNotInt:
+    bia t1, LowestTag, .opNegateSlow
+    xori 0x80000000, t1
+    ori ArithProfileNumber, t0
+    storei t2, PayloadOffset[cfr, t3, 8]
+    storeisToInstruction(t0, 3)
+    storei t1, TagOffset[cfr, t3, 8]
+    dispatch(4)
+
+.opNegateSlow:
+    callOpcodeSlowPath(_slow_path_negate)
+    dispatch(4)
+
+
+macro binaryOpCustomStore(integerOperationAndStore, doubleOperation, slowPath)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t2, Int32Tag, .op1NotInt
+    bineq t3, Int32Tag, .op2NotInt
+    loadisFromInstruction(4, t5)
+    ori ArithProfileIntInt, t5
+    storeisToInstruction(t5, 4)
+    loadi 4[PC], t2
+    integerOperationAndStore(t3, t1, t0, .slow, t2)
+    dispatch(5)
+
+.op1NotInt:
+    # First operand is definitely not an int, the second operand could be anything.
+    bia t2, LowestTag, .slow
+    bib t3, LowestTag, .op1NotIntOp2Double
+    bineq t3, Int32Tag, .slow
+    loadisFromInstruction(4, t5)
+    ori ArithProfileNumberInt, t5
+    storeisToInstruction(t5, 4)
+    ci2d t1, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2Double:
+    fii2d t1, t3, ft1
+    loadisFromInstruction(4, t5)
+    ori ArithProfileNumberNumber, t5
+    storeisToInstruction(t5, 4)
+.op1NotIntReady:
+    loadi 4[PC], t1
+    fii2d t0, t2, ft0
+    doubleOperation(ft1, ft0)
+    stored ft0, [cfr, t1, 8]
+    dispatch(5)
+
+.op2NotInt:
+    # First operand is definitely an int, the second operand is definitely not.
+    loadi 4[PC], t2
+    bia t3, LowestTag, .slow
+    loadisFromInstruction(4, t5)
+    ori ArithProfileIntNumber, t5
+    storeisToInstruction(t5, 4)
+    ci2d t0, ft0
+    fii2d t1, t3, ft1
+    doubleOperation(ft1, ft0)
+    stored ft0, [cfr, t2, 8]
+    dispatch(5)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(5)
+end
+
+macro binaryOp(integerOperation, doubleOperation, slowPath)
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            integerOperation(left, right, slow)
+            storei int32Tag, TagOffset[cfr, index, 8]
+            storei right, PayloadOffset[cfr, index, 8]
+        end,
+        doubleOperation, slowPath)
+end
+
+_llint_op_add:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) baddio left, right, slow end,
+        macro (left, right) addd left, right end,
+        _slow_path_add)
+
+
+_llint_op_mul:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            const scratch = int32Tag   # We know that we can reuse the int32Tag register since it has a constant.
+            move right, scratch
+            bmulio left, scratch, slow
+            btinz scratch, .done
+            bilt left, 0, slow
+            bilt right, 0, slow
+        .done:
+            storei Int32Tag, TagOffset[cfr, index, 8]
+            storei scratch, PayloadOffset[cfr, index, 8]
+        end,
+        macro (left, right) muld left, right end,
+        _slow_path_mul)
+
+
+_llint_op_sub:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) bsubio left, right, slow end,
+        macro (left, right) subd left, right end,
+        _slow_path_sub)
+
+
+_llint_op_div:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (int32Tag, left, right, slow, index)
+            ci2d left, ft0
+            ci2d right, ft1
+            divd ft0, ft1
+            bcd2i ft1, right, .notInt
+            storei int32Tag, TagOffset[cfr, index, 8]
+            storei right, PayloadOffset[cfr, index, 8]
+            jmp .done
+        .notInt:
+            stored ft1, [cfr, index, 8]
+        .done:
+        end,
+        macro (left, right) divd left, right end,
+        _slow_path_div)
+
+
+macro bitOp(operation, slowPath, advance)
+    loadi 12[PC], t2
+    loadi 8[PC], t0
+    loadConstantOrVariable(t2, t3, t1)
+    loadConstantOrVariable2Reg(t0, t2, t0)
+    bineq t3, Int32Tag, .slow
+    bineq t2, Int32Tag, .slow
+    loadi 4[PC], t2
+    operation(t1, t0)
+    storei t3, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(advance)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(advance)
+end
+
+_llint_op_lshift:
+    traceExecution()
+    bitOp(
+        macro (left, right) lshifti left, right end,
+        _slow_path_lshift,
+        4)
+
+
+_llint_op_rshift:
+    traceExecution()
+    bitOp(
+        macro (left, right) rshifti left, right end,
+        _slow_path_rshift,
+        4)
+
+
+_llint_op_urshift:
+    traceExecution()
+    bitOp(
+        macro (left, right) urshifti left, right end,
+        _slow_path_urshift,
+        4)
+
+
+_llint_op_unsigned:
+    traceExecution()
+    loadi 4[PC], t0
+    loadi 8[PC], t1
+    loadConstantOrVariablePayload(t1, Int32Tag, t2, .opUnsignedSlow)
+    bilt t2, 0, .opUnsignedSlow
+    storei t2, PayloadOffset[cfr, t0, 8]
+    storei Int32Tag, TagOffset[cfr, t0, 8]
+    dispatch(3)
+.opUnsignedSlow:
+    callOpcodeSlowPath(_slow_path_unsigned)
+    dispatch(3)
+
+
+_llint_op_bitand:
+    traceExecution()
+    bitOp(
+        macro (left, right) andi left, right end,
+        _slow_path_bitand,
+        5)
+
+
+_llint_op_bitxor:
+    traceExecution()
+    bitOp(
+        macro (left, right) xori left, right end,
+        _slow_path_bitxor,
+        5)
+
+
+_llint_op_bitor:
+    traceExecution()
+    bitOp(
+        macro (left, right) ori left, right end,
+        _slow_path_bitor,
+        5)
+
+
+_llint_op_overrides_has_instance:
+    traceExecution()
+
+    loadisFromInstruction(1, t3)
+    storei BooleanTag, TagOffset[cfr, t3, 8]
+
+    # First check if hasInstanceValue is the one on Function.prototype[Symbol.hasInstance]
+    loadisFromInstruction(3, t0)
+    loadConstantOrVariablePayload(t0, CellTag, t2, .opOverrideshasInstanceValueNotCell)
+    loadConstantOrVariable(t0, t1, t2)
+    bineq t1, CellTag, .opOverrideshasInstanceValueNotCell
+
+    # We don't need hasInstanceValue's tag register anymore.
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_globalObject[t1], t1
+    loadp JSGlobalObject::m_functionProtoHasInstanceSymbolFunction[t1], t1
+    bineq t1, t2, .opOverrideshasInstanceValueNotDefault
+
+    # We know the constructor is a cell.
+    loadisFromInstruction(2, t0)
+    loadConstantOrVariablePayloadUnchecked(t0, t1)
+    tbz JSCell::m_flags[t1], ImplementsDefaultHasInstance, t0
+    storei t0, PayloadOffset[cfr, t3, 8]
+    dispatch(4)
+
+.opOverrideshasInstanceValueNotCell:
+.opOverrideshasInstanceValueNotDefault:
+    storei 1, PayloadOffset[cfr, t3, 8]
+    dispatch(4)
+
+_llint_op_instanceof_custom:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_instanceof_custom)
+    dispatch(5)
+
+
+_llint_op_is_empty:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t0
+    loadConstantOrVariable(t1, t2, t3)
+    cieq t2, EmptyValueTag, t3
+    storei BooleanTag, TagOffset[cfr, t0, 8]
+    storei t3, PayloadOffset[cfr, t0, 8]
+    dispatch(3)
+
+
+_llint_op_is_undefined:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t0
+    loadConstantOrVariable(t1, t2, t3)
+    storei BooleanTag, TagOffset[cfr, t0, 8]
+    bieq t2, CellTag, .opIsUndefinedCell
+    cieq t2, UndefinedTag, t3
+    storei t3, PayloadOffset[cfr, t0, 8]
+    dispatch(3)
+.opIsUndefinedCell:
+    btbnz JSCell::m_flags[t3], MasqueradesAsUndefined, .opIsUndefinedMasqueradesAsUndefined
+    move 0, t1
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(3)
+.opIsUndefinedMasqueradesAsUndefined:
+    loadp JSCell::m_structureID[t3], t1
+    loadp CodeBlock[cfr], t3
+    loadp CodeBlock::m_globalObject[t3], t3
+    cpeq Structure::m_globalObject[t1], t3, t1
+    storei t1, PayloadOffset[cfr, t0, 8]
+    dispatch(3)
+
+
+_llint_op_is_boolean:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t2
+    loadConstantOrVariableTag(t1, t0)
+    cieq t0, BooleanTag, t0
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    storei t0, PayloadOffset[cfr, t2, 8]
+    dispatch(3)
+
+
+_llint_op_is_number:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t2
+    loadConstantOrVariableTag(t1, t0)
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    addi 1, t0
+    cib t0, LowestTag + 1, t1
+    storei t1, PayloadOffset[cfr, t2, 8]
+    dispatch(3)
+
+
+_llint_op_is_cell_with_type:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t2
+    loadConstantOrVariable(t1, t0, t3)
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    bineq t0, CellTag, .notCellCase
+    loadi 12[PC], t0
+    cbeq JSCell::m_type[t3], t0, t1
+    storei t1, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+.notCellCase:
+    storep 0, PayloadOffset[cfr, t2, 8]
+    dispatch(4)
+
+
+_llint_op_is_object:
+    traceExecution()
+    loadi 8[PC], t1
+    loadi 4[PC], t2
+    loadConstantOrVariable(t1, t0, t3)
+    storei BooleanTag, TagOffset[cfr, t2, 8]
+    bineq t0, CellTag, .opIsObjectNotCell
+    cbaeq JSCell::m_type[t3], ObjectType, t1
+    storei t1, PayloadOffset[cfr, t2, 8]
+    dispatch(3)
+.opIsObjectNotCell:
+    storep 0, PayloadOffset[cfr, t2, 8]
+    dispatch(3)
+
+
+macro loadPropertyAtVariableOffsetKnownNotInline(propertyOffset, objectAndStorage, tag, payload)
+    assert(macro (ok) bigteq propertyOffset, firstOutOfLineOffset, ok end)
+    negi propertyOffset
+    loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
+    loadi TagOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffset, 8], tag
+    loadi PayloadOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffset, 8], payload
+end
+
+macro loadPropertyAtVariableOffset(propertyOffset, objectAndStorage, tag, payload)
+    bilt propertyOffset, firstOutOfLineOffset, .isInline
+    loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
+    negi propertyOffset
+    jmp .ready
+.isInline:
+    addp sizeof JSObject - (firstOutOfLineOffset - 2) * 8, objectAndStorage
+.ready:
+    loadi TagOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffset, 8], tag
+    loadi PayloadOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffset, 8], payload
+end
+
+macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, tag, payload)
+    bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
+    loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
+    negi propertyOffsetAsInt
+    jmp .ready
+.isInline:
+    addp sizeof JSObject - (firstOutOfLineOffset - 2) * 8, objectAndStorage
+.ready:
+    storei tag, TagOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8]
+    storei payload, PayloadOffset + (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8]
+end
+
+
+# We only do monomorphic get_by_id caching for now, and we do not modify the
+# opcode for own properties. We also allow for the cache to change anytime it fails,
+# since ping-ponging is free. At best we get lucky and the get_by_id will continue
+# to take fast path on the new cache. At worst we take slow path, which is what
+# we would have been doing anyway. For prototype/unset properties, we will attempt to
+# convert opcode into a get_by_id_proto_load/get_by_id_unset, respectively, after an
+# execution counter hits zero.
+
+_llint_op_get_by_id:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdSlow)
+    loadi 20[PC], t2
+    bineq JSCell::m_structureID[t3], t1, .opGetByIdSlow
+    loadPropertyAtVariableOffset(t2, t3, t0, t1)
+    loadi 4[PC], t2
+    storei t0, TagOffset[cfr, t2, 8]
+    storei t1, PayloadOffset[cfr, t2, 8]
+    valueProfile(t0, t1, 32, t2)
+    dispatch(9)
+
+.opGetByIdSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_by_id_proto_load:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdProtoSlow)
+    loadi 20[PC], t2
+    bineq JSCell::m_structureID[t3], t1, .opGetByIdProtoSlow
+    loadpFromInstruction(6, t3)
+    loadPropertyAtVariableOffset(t2, t3, t0, t1)
+    loadi 4[PC], t2
+    storei t0, TagOffset[cfr, t2, 8]
+    storei t1, PayloadOffset[cfr, t2, 8]
+    valueProfile(t0, t1, 32, t2)
+    dispatch(9)
+
+.opGetByIdProtoSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_by_id_unset:
+    traceExecution()
+    loadi 8[PC], t0
+    loadi 16[PC], t1
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdUnsetSlow)
+    bineq JSCell::m_structureID[t3], t1, .opGetByIdUnsetSlow
+    loadi 4[PC], t2
+    storei UndefinedTag, TagOffset[cfr, t2, 8]
+    storei 0, PayloadOffset[cfr, t2, 8]
+    valueProfile(UndefinedTag, 0, 32, t2)
+    dispatch(9)
+
+.opGetByIdUnsetSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_array_length:
+    traceExecution()
+    loadi 8[PC], t0
+    loadp 16[PC], t1
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetArrayLengthSlow)
+    move t3, t2
+    arrayProfile(t2, t1, t0)
+    btiz t2, IsArray, .opGetArrayLengthSlow
+    btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
+    loadi 4[PC], t1
+    loadp JSObject::m_butterfly[t3], t0
+    loadi -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], t0
+    bilt t0, 0, .opGetArrayLengthSlow
+    valueProfile(Int32Tag, t0, 32, t2)
+    storep t0, PayloadOffset[cfr, t1, 8]
+    storep Int32Tag, TagOffset[cfr, t1, 8]
+    dispatch(9)
+
+.opGetArrayLengthSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_put_by_id:
+    traceExecution()
+    writeBarrierOnOperands(1, 3)
+    loadi 4[PC], t3
+    loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
+    loadi JSCell::m_structureID[t0], t2
+    bineq t2, 16[PC], .opPutByIdSlow
+
+    # At this point, we have:
+    # t2 -> currentStructureID
+    # t0 -> object base
+    # We will lose currentStructureID in the shenanigans below.
+
+    loadi 12[PC], t1
+    loadConstantOrVariable(t1, t2, t3)
+    loadi 32[PC], t1
+
+    # At this point, we have:
+    # t0 -> object base
+    # t1 -> put by id flags
+    # t2 -> value tag
+    # t3 -> value payload
+
+    btinz t1, PutByIdPrimaryTypeMask, .opPutByIdTypeCheckObjectWithStructureOrOther
+
+    # We have one of the non-structure type checks. Find out which one.
+    andi PutByIdSecondaryTypeMask, t1
+    bilt t1, PutByIdSecondaryTypeString, .opPutByIdTypeCheckLessThanString
+
+    # We are one of the following: String, Symbol, Object, ObjectOrOther, Top
+    bilt t1, PutByIdSecondaryTypeObjectOrOther, .opPutByIdTypeCheckLessThanObjectOrOther
+
+    # We are either ObjectOrOther or Top.
+    bieq t1, PutByIdSecondaryTypeTop, .opPutByIdDoneCheckingTypes
+
+    # Check if we are ObjectOrOther.
+    bieq t2, CellTag, .opPutByIdTypeCheckObject
+.opPutByIdTypeCheckOther:
+    bieq t2, NullTag, .opPutByIdDoneCheckingTypes
+    bieq t2, UndefinedTag, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckLessThanObjectOrOther:
+    # We are either String, Symbol or Object.
+    bineq t2, CellTag, .opPutByIdSlow
+    bieq t1, PutByIdSecondaryTypeObject, .opPutByIdTypeCheckObject
+    bieq t1, PutByIdSecondaryTypeSymbol, .opPutByIdTypeCheckSymbol
+    bbeq JSCell::m_type[t3], StringType, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+.opPutByIdTypeCheckObject:
+    bbaeq JSCell::m_type[t3], ObjectType, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+.opPutByIdTypeCheckSymbol:
+    bbeq JSCell::m_type[t3], SymbolType, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckLessThanString:
+    # We are one of the following: Bottom, Boolean, Other, Int32, Number.
+    bilt t1, PutByIdSecondaryTypeInt32, .opPutByIdTypeCheckLessThanInt32
+
+    # We are either Int32 or Number.
+    bieq t1, PutByIdSecondaryTypeNumber, .opPutByIdTypeCheckNumber
+
+    bieq t2, Int32Tag, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckNumber:
+    bib t2, LowestTag + 1, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckLessThanInt32:
+    # We are one of the following: Bottom, Boolean, Other
+    bineq t1, PutByIdSecondaryTypeBoolean, .opPutByIdTypeCheckBottomOrOther
+    bieq t2, BooleanTag, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckBottomOrOther:
+    bieq t1, PutByIdSecondaryTypeOther, .opPutByIdTypeCheckOther
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckObjectWithStructureOrOther:
+    bieq t2, CellTag, .opPutByIdTypeCheckObjectWithStructure
+    btinz t1, PutByIdPrimaryTypeObjectWithStructureOrOther, .opPutByIdTypeCheckOther
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckObjectWithStructure:
+    andi PutByIdSecondaryTypeMask, t1
+    bineq t1, JSCell::m_structureID[t3], .opPutByIdSlow
+
+.opPutByIdDoneCheckingTypes:
+    loadi 24[PC], t1
+
+    btiz t1, .opPutByIdNotTransition
+
+    # This is the transition case. t1 holds the new Structure*. If we have a chain, we need to
+    # check it. t0 is the base. We may clobber t1 to use it as scratch.
+    loadp 28[PC], t3
+    btpz t3, .opPutByIdTransitionDirect
+
+    loadi 16[PC], t2 # Need old structure again.
+    loadp StructureChain::m_vector[t3], t3
+    assert(macro (ok) btpnz t3, ok end)
+
+    loadp Structure::m_prototype[t2], t2
+    btpz t2, .opPutByIdTransitionChainDone
+.opPutByIdTransitionChainLoop:
+    loadp [t3], t1
+    bpneq t1, JSCell::m_structureID[t2], .opPutByIdSlow
+    addp 4, t3
+    loadp Structure::m_prototype[t1], t2
+    btpnz t2, .opPutByIdTransitionChainLoop
+
+.opPutByIdTransitionChainDone:
+    loadi 24[PC], t1
+
+.opPutByIdTransitionDirect:
+    storei t1, JSCell::m_structureID[t0]
+    loadi 12[PC], t1
+    loadConstantOrVariable(t1, t2, t3)
+    loadi 20[PC], t1
+    storePropertyAtVariableOffset(t1, t0, t2, t3)
+    writeBarrierOnOperand(1)
+    dispatch(9)
+
+.opPutByIdNotTransition:
+    # The only thing live right now is t0, which holds the base.
+    loadi 12[PC], t1
+    loadConstantOrVariable(t1, t2, t3)
+    loadi 20[PC], t1
+    storePropertyAtVariableOffset(t1, t0, t2, t3)
+    dispatch(9)
+
+.opPutByIdSlow:
+    callOpcodeSlowPath(_llint_slow_path_put_by_id)
+    dispatch(9)
+
+
+_llint_op_get_by_val:
+    traceExecution()
+    loadi 8[PC], t2
+    loadConstantOrVariablePayload(t2, CellTag, t0, .opGetByValSlow)
+    move t0, t2
+    loadp 16[PC], t3
+    arrayProfile(t2, t3, t1)
+    loadi 12[PC], t3
+    loadConstantOrVariablePayload(t3, Int32Tag, t1, .opGetByValSlow)
+    loadp JSObject::m_butterfly[t0], t3
+    andi IndexingShapeMask, t2
+    bieq t2, Int32Shape, .opGetByValIsContiguous
+    bineq t2, ContiguousShape, .opGetByValNotContiguous
+.opGetByValIsContiguous:
+    
+    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValOutOfBounds
+    loadi TagOffset[t3, t1, 8], t2
+    loadi PayloadOffset[t3, t1, 8], t1
+    jmp .opGetByValDone
+
+.opGetByValNotContiguous:
+    bineq t2, DoubleShape, .opGetByValNotDouble
+    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValOutOfBounds
+    loadd [t3, t1, 8], ft0
+    bdnequn ft0, ft0, .opGetByValSlow
+    # FIXME: This could be massively optimized.
+    fd2ii ft0, t1, t2
+    loadi 4[PC], t0
+    jmp .opGetByValNotEmpty
+
+.opGetByValNotDouble:
+    subi ArrayStorageShape, t2
+    bia t2, SlowPutArrayStorageShape - ArrayStorageShape, .opGetByValSlow
+    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t3], .opGetByValOutOfBounds
+    loadi ArrayStorage::m_vector + TagOffset[t3, t1, 8], t2
+    loadi ArrayStorage::m_vector + PayloadOffset[t3, t1, 8], t1
+
+.opGetByValDone:
+    loadi 4[PC], t0
+    bieq t2, EmptyValueTag, .opGetByValOutOfBounds
+.opGetByValNotEmpty:
+    storei t2, TagOffset[cfr, t0, 8]
+    storei t1, PayloadOffset[cfr, t0, 8]
+    valueProfile(t2, t1, 20, t0)
+    dispatch(6)
+
+.opGetByValOutOfBounds:
+    loadpFromInstruction(4, t0)
+    storeb 1, ArrayProfile::m_outOfBounds[t0]
+.opGetByValSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_val)
+    dispatch(6)
+
+
+macro contiguousPutByVal(storeCallback)
+    biaeq t3, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], .outOfBounds
+.storeResult:
+    loadi 12[PC], t2
+    storeCallback(t2, t1, t0, t3)
+    dispatch(5)
+
+.outOfBounds:
+    biaeq t3, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t0], .opPutByValOutOfBounds
+    loadp 16[PC], t2
+    storeb 1, ArrayProfile::m_mayStoreToHole[t2]
+    addi 1, t3, t2
+    storei t2, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0]
+    jmp .storeResult
+end
+
+macro putByVal(slowPath)
+    traceExecution()
+    writeBarrierOnOperands(1, 3)
+    loadi 4[PC], t0
+    loadConstantOrVariablePayload(t0, CellTag, t1, .opPutByValSlow)
+    move t1, t2
+    loadp 16[PC], t3
+    arrayProfile(t2, t3, t0)
+    loadi 8[PC], t0
+    loadConstantOrVariablePayload(t0, Int32Tag, t3, .opPutByValSlow)
+    loadp JSObject::m_butterfly[t1], t0
+    andi IndexingShapeMask, t2
+    bineq t2, Int32Shape, .opPutByValNotInt32
+    contiguousPutByVal(
+        macro (operand, scratch, base, index)
+            loadConstantOrVariablePayload(operand, Int32Tag, scratch, .opPutByValSlow)
+            storei Int32Tag, TagOffset[base, index, 8]
+            storei scratch, PayloadOffset[base, index, 8]
+        end)
+
+.opPutByValNotInt32:
+    bineq t2, DoubleShape, .opPutByValNotDouble
+    contiguousPutByVal(
+        macro (operand, scratch, base, index)
+            const tag = scratch
+            const payload = operand
+            loadConstantOrVariable2Reg(operand, tag, payload)
+            bineq tag, Int32Tag, .notInt
+            ci2d payload, ft0
+            jmp .ready
+        .notInt:
+            fii2d payload, tag, ft0
+            bdnequn ft0, ft0, .opPutByValSlow
+        .ready:
+            stored ft0, [base, index, 8]
+        end)
+
+.opPutByValNotDouble:
+    bineq t2, ContiguousShape, .opPutByValNotContiguous
+    contiguousPutByVal(
+        macro (operand, scratch, base, index)
+            const tag = scratch
+            const payload = operand
+            loadConstantOrVariable2Reg(operand, tag, payload)
+            storei tag, TagOffset[base, index, 8]
+            storei payload, PayloadOffset[base, index, 8]
+        end)
+
+.opPutByValNotContiguous:
+    bineq t2, ArrayStorageShape, .opPutByValSlow
+    biaeq t3, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t0], .opPutByValOutOfBounds
+    bieq ArrayStorage::m_vector + TagOffset[t0, t3, 8], EmptyValueTag, .opPutByValArrayStorageEmpty
+.opPutByValArrayStorageStoreResult:
+    loadi 12[PC], t2
+    loadConstantOrVariable2Reg(t2, t1, t2)
+    storei t1, ArrayStorage::m_vector + TagOffset[t0, t3, 8]
+    storei t2, ArrayStorage::m_vector + PayloadOffset[t0, t3, 8]
+    dispatch(5)
+
+.opPutByValArrayStorageEmpty:
+    loadp 16[PC], t1
+    storeb 1, ArrayProfile::m_mayStoreToHole[t1]
+    addi 1, ArrayStorage::m_numValuesInVector[t0]
+    bib t3, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], .opPutByValArrayStorageStoreResult
+    addi 1, t3, t1
+    storei t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0]
+    jmp .opPutByValArrayStorageStoreResult
+
+.opPutByValOutOfBounds:
+    loadpFromInstruction(4, t0)
+    storeb 1, ArrayProfile::m_outOfBounds[t0]
+.opPutByValSlow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(5)
+end
+
+_llint_op_put_by_val:
+    putByVal(_llint_slow_path_put_by_val)
+
+_llint_op_put_by_val_direct:
+    putByVal(_llint_slow_path_put_by_val_direct)
+
+_llint_op_jmp:
+    traceExecution()
+    dispatchBranch(4[PC])
+
+
+macro jumpTrueOrFalse(conditionOp, slow)
+    loadi 4[PC], t1
+    loadConstantOrVariablePayload(t1, BooleanTag, t0, .slow)
+    conditionOp(t0, .target)
+    dispatch(3)
+
+.target:
+    dispatchBranch(8[PC])
+
+.slow:
+    callOpcodeSlowPath(slow)
+    dispatch(0)
+end
+
+
+macro equalNull(cellHandler, immediateHandler)
+    loadi 4[PC], t0
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    bineq t1, CellTag, .immediate
+    loadp JSCell::m_structureID[t0], t2
+    cellHandler(t2, JSCell::m_flags[t0], .target)
+    dispatch(3)
+
+.target:
+    dispatchBranch(8[PC])
+
+.immediate:
+    ori 1, t1
+    immediateHandler(t1, .target)
+    dispatch(3)
+end
+
+_llint_op_jeq_null:
+    traceExecution()
+    equalNull(
+        macro (structure, value, target) 
+            btbz value, MasqueradesAsUndefined, .opJeqNullNotMasqueradesAsUndefined
+            loadp CodeBlock[cfr], t0
+            loadp CodeBlock::m_globalObject[t0], t0
+            bpeq Structure::m_globalObject[structure], t0, target
+.opJeqNullNotMasqueradesAsUndefined:
+        end,
+        macro (value, target) bieq value, NullTag, target end)
+    
+
+_llint_op_jneq_null:
+    traceExecution()
+    equalNull(
+        macro (structure, value, target) 
+            btbz value, MasqueradesAsUndefined, target 
+            loadp CodeBlock[cfr], t0
+            loadp CodeBlock::m_globalObject[t0], t0
+            bpneq Structure::m_globalObject[structure], t0, target
+        end,
+        macro (value, target) bineq value, NullTag, target end)
+
+
+_llint_op_jneq_ptr:
+    traceExecution()
+    loadi 4[PC], t0
+    loadi 8[PC], t1
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_globalObject[t2], t2
+    bineq TagOffset[cfr, t0, 8], CellTag, .opJneqPtrBranch
+    loadp JSGlobalObject::m_specialPointers[t2, t1, 4], t1
+    bpeq PayloadOffset[cfr, t0, 8], t1, .opJneqPtrFallThrough
+.opJneqPtrBranch:
+    storei 1, 16[PC]
+    dispatchBranch(12[PC])
+.opJneqPtrFallThrough:
+    dispatch(5)
+
+
+macro compare(integerCompare, doubleCompare, slowPath)
+    loadi 4[PC], t2
+    loadi 8[PC], t3
+    loadConstantOrVariable(t2, t0, t1)
+    loadConstantOrVariable2Reg(t3, t2, t3)
+    bineq t0, Int32Tag, .op1NotInt
+    bineq t2, Int32Tag, .op2NotInt
+    integerCompare(t1, t3, .jumpTarget)
+    dispatch(4)
+
+.op1NotInt:
+    bia t0, LowestTag, .slow
+    bib t2, LowestTag, .op1NotIntOp2Double
+    bineq t2, Int32Tag, .slow
+    ci2d t3, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2Double:
+    fii2d t3, t2, ft1
+.op1NotIntReady:
+    fii2d t1, t0, ft0
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.op2NotInt:
+    ci2d t1, ft0
+    bia t2, LowestTag, .slow
+    fii2d t3, t2, ft1
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.jumpTarget:
+    dispatchBranch(12[PC])
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(0)
+end
+
+
+_llint_op_switch_imm:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3   # FIXME: would be nice to peephole this!
+    loadp CodeBlock::RareData::m_switchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    bineq t1, Int32Tag, .opSwitchImmNotInt
+    subi SimpleJumpTable::min[t2], t0
+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchImmFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t3
+    loadi [t3, t0, 4], t1
+    btiz t1, .opSwitchImmFallThrough
+    dispatchBranchWithOffset(t1)
+
+.opSwitchImmNotInt:
+    bib t1, LowestTag, .opSwitchImmSlow  # Go to slow path if it's a double.
+.opSwitchImmFallThrough:
+    dispatchBranch(8[PC])
+
+.opSwitchImmSlow:
+    callOpcodeSlowPath(_llint_slow_path_switch_imm)
+    dispatch(0)
+
+
+_llint_op_switch_char:
+    traceExecution()
+    loadi 12[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3
+    loadp CodeBlock::RareData::m_switchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    bineq t1, CellTag, .opSwitchCharFallThrough
+    bbneq JSCell::m_type[t0], StringType, .opSwitchCharFallThrough
+    bineq JSString::m_length[t0], 1, .opSwitchCharFallThrough
+    loadp JSString::m_value[t0], t0
+    btpz  t0, .opSwitchOnRope
+    loadp StringImpl::m_data8[t0], t1
+    btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit
+    loadh [t1], t0
+    jmp .opSwitchCharReady
+.opSwitchChar8Bit:
+    loadb [t1], t0
+.opSwitchCharReady:
+    subi SimpleJumpTable::min[t2], t0
+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchCharFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t2
+    loadi [t2, t0, 4], t1
+    btiz t1, .opSwitchCharFallThrough
+    dispatchBranchWithOffset(t1)
+
+.opSwitchCharFallThrough:
+    dispatchBranch(8[PC])
+
+.opSwitchOnRope:
+    callOpcodeSlowPath(_llint_slow_path_switch_char)
+    dispatch(0)
+
+
+macro arrayProfileForCall()
+    loadi 16[PC], t3
+    negi t3
+    bineq ThisArgumentOffset + TagOffset[cfr, t3, 8], CellTag, .done
+    loadi ThisArgumentOffset + PayloadOffset[cfr, t3, 8], t0
+    loadp JSCell::m_structureID[t0], t0
+    loadpFromInstruction(CallOpCodeSize - 2, t1)
+    storep t0, ArrayProfile::m_lastSeenStructureID[t1]
+.done:
+end
+
+macro doCall(slowPath, prepareCall)
+    loadi 8[PC], t0
+    loadi 20[PC], t1
+    loadp LLIntCallLinkInfo::callee[t1], t2
+    loadConstantOrVariablePayload(t0, CellTag, t3, .opCallSlow)
+    bineq t3, t2, .opCallSlow
+    loadi 16[PC], t3
+    lshifti 3, t3
+    negi t3
+    addp cfr, t3  # t3 contains the new value of cfr
+    storei t2, Callee + PayloadOffset[t3]
+    loadi 12[PC], t2
+    storei PC, ArgumentCount + TagOffset[cfr]
+    storei t2, ArgumentCount + PayloadOffset[t3]
+    storei CellTag, Callee + TagOffset[t3]
+    move t3, sp
+    prepareCall(LLIntCallLinkInfo::machineCodeTarget[t1], t2, t3, t4)
+    callTargetFunction(LLIntCallLinkInfo::machineCodeTarget[t1])
+
+.opCallSlow:
+    slowPathForCall(slowPath, prepareCall)
+end
+
+_llint_op_ret:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadi 4[PC], t2
+    loadConstantOrVariable(t2, t1, t0)
+    doReturn()
+
+
+_llint_op_to_primitive:
+    traceExecution()
+    loadi 8[PC], t2
+    loadi 4[PC], t3
+    loadConstantOrVariable(t2, t1, t0)
+    bineq t1, CellTag, .opToPrimitiveIsImm
+    bbaeq JSCell::m_type[t0], ObjectType, .opToPrimitiveSlowCase
+.opToPrimitiveIsImm:
+    storei t1, TagOffset[cfr, t3, 8]
+    storei t0, PayloadOffset[cfr, t3, 8]
+    dispatch(3)
+
+.opToPrimitiveSlowCase:
+    callOpcodeSlowPath(_slow_path_to_primitive)
+    dispatch(3)
+
+
+_llint_op_catch:
+    # This is where we end up from the JIT's throw trampoline (because the
+    # machine code return address will be set to _llint_op_catch), and from
+    # the interpreter's throw trampoline (see _llint_throw_trampoline).
+    # The throwing code must have known that we were throwing to the interpreter,
+    # and have set VM::targetInterpreterPCForThrow.
+    loadp Callee + PayloadOffset[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+    restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(t3, t0)
+    loadp VM::callFrameForCatch[t3], cfr
+    storep 0, VM::callFrameForCatch[t3]
+    restoreStackPointerAfterCall()
+
+    loadi VM::targetInterpreterPCForThrow[t3], PC
+
+    callOpcodeSlowPath(_llint_slow_path_check_if_exception_is_uncatchable_and_notify_profiler)
+    bpeq r1, 0, .isCatchableException
+    jmp _llint_throw_from_slow_path_trampoline
+
+.isCatchableException:
+    loadp Callee + PayloadOffset[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+
+    loadi VM::m_exception[t3], t0
+    storei 0, VM::m_exception[t3]
+    loadi 4[PC], t2
+    storei t0, PayloadOffset[cfr, t2, 8]
+    storei CellTag, TagOffset[cfr, t2, 8]
+
+    loadi Exception::m_value + TagOffset[t0], t1
+    loadi Exception::m_value + PayloadOffset[t0], t0
+    loadi 8[PC], t2
+    storei t0, PayloadOffset[cfr, t2, 8]
+    storei t1, TagOffset[cfr, t2, 8]
+
+    traceExecution()  # This needs to be here because we don't want to clobber t0, t1, t2, t3 above.
+    dispatch(3)
+
+_llint_op_end:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadi 4[PC], t0
+    assertNotConstant(t0)
+    loadi TagOffset[cfr, t0, 8], t1
+    loadi PayloadOffset[cfr, t0, 8], t0
+    doReturn()
+
+
+_llint_throw_from_slow_path_trampoline:
+    callSlowPath(_llint_slow_path_handle_exception)
+
+    # When throwing from the interpreter (i.e. throwing from LLIntSlowPaths), so
+    # the throw target is not necessarily interpreted code, we come to here.
+    # This essentially emulates the JIT's throwing protocol.
+    loadp Callee[cfr], t1
+    andp MarkedBlockMask, t1
+    loadp MarkedBlock::m_vm[t1], t1
+    copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(t1, t2)
+    jmp VM::targetMachinePCForThrow[t1]
+
+
+_llint_throw_during_call_trampoline:
+    preserveReturnAddressAfterCall(t2)
+    jmp _llint_throw_from_slow_path_trampoline
+
+
+macro nativeCallTrampoline(executableOffsetToFunction)
+
+    functionPrologue()
+    storep 0, CodeBlock[cfr]
+    loadi Callee + PayloadOffset[cfr], t1
+    // Callee is still in t1 for code below
+    if X86 or X86_WIN
+        subp 8, sp # align stack pointer
+        andp MarkedBlockMask, t1
+        loadp MarkedBlock::m_vm[t1], t3
+        storep cfr, VM::topCallFrame[t3]
+        move cfr, a0  # a0 = ecx
+        storep a0, [sp]
+        loadi Callee + PayloadOffset[cfr], t1
+        loadp JSFunction::m_executable[t1], t1
+        checkStackPointerAlignment(t3, 0xdead0001)
+        call executableOffsetToFunction[t1]
+        loadp Callee + PayloadOffset[cfr], t3
+        andp MarkedBlockMask, t3
+        loadp MarkedBlock::m_vm[t3], t3
+        addp 8, sp
+    elsif ARM or ARMv7 or ARMv7_TRADITIONAL or C_LOOP or MIPS or SH4
+        subp 8, sp # align stack pointer
+        # t1 already contains the Callee.
+        andp MarkedBlockMask, t1
+        loadp MarkedBlock::m_vm[t1], t1
+        storep cfr, VM::topCallFrame[t1]
+        move cfr, a0
+        loadi Callee + PayloadOffset[cfr], t1
+        loadp JSFunction::m_executable[t1], t1
+        checkStackPointerAlignment(t3, 0xdead0001)
+        if C_LOOP
+            cloopCallNative executableOffsetToFunction[t1]
+        else
+            call executableOffsetToFunction[t1]
+        end
+        loadp Callee + PayloadOffset[cfr], t3
+        andp MarkedBlockMask, t3
+        loadp MarkedBlock::m_vm[t3], t3
+        addp 8, sp
+    else
+        error
+    end
+    
+    btinz VM::m_exception[t3], .handleException
+
+    functionEpilogue()
+    ret
+
+.handleException:
+    storep cfr, VM::topCallFrame[t3]
+    jmp _llint_throw_from_slow_path_trampoline
+end
+
+
+macro getConstantScope(dst)
+    loadpFromInstruction(6, t0)
+    loadisFromInstruction(dst, t1)
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+end
+
+macro varInjectionCheck(slowPath)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_varInjectionWatchpoint[t0], t0
+    bbeq WatchpointSet::m_state[t0], IsInvalidated, slowPath
+end
+
+macro resolveScope()
+    loadp CodeBlock[cfr], t0
+    loadisFromInstruction(5, t2)
+
+    loadisFromInstruction(2, t0)
+    loadp PayloadOffset[cfr, t0, 8], t0
+    btiz t2, .resolveScopeLoopEnd
+
+.resolveScopeLoop:
+    loadp JSScope::m_next[t0], t0
+    subi 1, t2
+    btinz t2, .resolveScopeLoop
+
+.resolveScopeLoopEnd:
+    loadisFromInstruction(1, t1)
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+end
+
+
+_llint_op_resolve_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+
+#rGlobalProperty:
+    bineq t0, GlobalProperty, .rGlobalVar
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalVar:
+    bineq t0, GlobalVar, .rGlobalLexicalVar
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalLexicalVar:
+    bineq t0, GlobalLexicalVar, .rClosureVar
+    getConstantScope(1)
+    dispatch(7)
+
+.rClosureVar:
+    bineq t0, ClosureVar, .rModuleVar
+    resolveScope()
+    dispatch(7)
+
+.rModuleVar:
+    bineq t0, ModuleVar, .rGlobalPropertyWithVarInjectionChecks
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .rGlobalVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .rGlobalLexicalVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalLexicalVarWithVarInjectionChecks:
+    bineq t0, GlobalLexicalVarWithVarInjectionChecks, .rClosureVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getConstantScope(1)
+    dispatch(7)
+
+.rClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .rDynamic
+    varInjectionCheck(.rDynamic)
+    resolveScope()
+    dispatch(7)
+
+.rDynamic:
+    callOpcodeSlowPath(_slow_path_resolve_scope)
+    dispatch(7)
+
+
+macro loadWithStructureCheck(operand, slowPath)
+    loadisFromInstruction(operand, t0)
+    loadp PayloadOffset[cfr, t0, 8], t0
+    loadpFromInstruction(5, t1)
+    bpneq JSCell::m_structureID[t0], t1, slowPath
+end
+
+macro getProperty()
+    loadisFromInstruction(6, t3)
+    loadPropertyAtVariableOffset(t3, t0, t1, t2)
+    valueProfile(t1, t2, 28, t0)
+    loadisFromInstruction(1, t0)
+    storei t1, TagOffset[cfr, t0, 8]
+    storei t2, PayloadOffset[cfr, t0, 8]
+end
+
+macro getGlobalVar(tdzCheckIfNecessary)
+    loadpFromInstruction(6, t0)
+    loadp TagOffset[t0], t1
+    loadp PayloadOffset[t0], t2
+    tdzCheckIfNecessary(t1)
+    valueProfile(t1, t2, 28, t0)
+    loadisFromInstruction(1, t0)
+    storei t1, TagOffset[cfr, t0, 8]
+    storei t2, PayloadOffset[cfr, t0, 8]
+end
+
+macro getClosureVar()
+    loadisFromInstruction(6, t3)
+    loadp JSEnvironmentRecord_variables + TagOffset[t0, t3, 8], t1
+    loadp JSEnvironmentRecord_variables + PayloadOffset[t0, t3, 8], t2
+    valueProfile(t1, t2, 28, t0)
+    loadisFromInstruction(1, t0)
+    storei t1, TagOffset[cfr, t0, 8]
+    storei t2, PayloadOffset[cfr, t0, 8]
+end
+
+_llint_op_get_from_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+    andi ResolveTypeMask, t0
+
+#gGlobalProperty:
+    bineq t0, GlobalProperty, .gGlobalVar
+    loadWithStructureCheck(2, .gDynamic)
+    getProperty()
+    dispatch(8)
+
+.gGlobalVar:
+    bineq t0, GlobalVar, .gGlobalLexicalVar
+    getGlobalVar(macro(t) end)
+    dispatch(8)
+
+.gGlobalLexicalVar:
+    bineq t0, GlobalLexicalVar, .gClosureVar
+    getGlobalVar(
+        macro(tag)
+            bieq tag, EmptyValueTag, .gDynamic
+        end)
+    dispatch(8)
+
+.gClosureVar:
+    bineq t0, ClosureVar, .gGlobalPropertyWithVarInjectionChecks
+    loadVariable(2, t2, t1, t0)
+    getClosureVar()
+    dispatch(8)
+
+.gGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
+    loadWithStructureCheck(2, .gDynamic)
+    getProperty()
+    dispatch(8)
+
+.gGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .gGlobalLexicalVarWithVarInjectionChecks
+    varInjectionCheck(.gDynamic)
+    getGlobalVar(macro(t) end)
+    dispatch(8)
+
+.gGlobalLexicalVarWithVarInjectionChecks:
+    bineq t0, GlobalLexicalVarWithVarInjectionChecks, .gClosureVarWithVarInjectionChecks
+    varInjectionCheck(.gDynamic)
+    getGlobalVar(
+        macro(tag)
+            bieq tag, EmptyValueTag, .gDynamic
+        end)
+    dispatch(8)
+
+.gClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .gDynamic
+    varInjectionCheck(.gDynamic)
+    loadVariable(2, t2, t1, t0)
+    getClosureVar()
+    dispatch(8)
+
+.gDynamic:
+    callOpcodeSlowPath(_llint_slow_path_get_from_scope)
+    dispatch(8)
+
+
+macro putProperty()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2, t3)
+    loadisFromInstruction(6, t1)
+    storePropertyAtVariableOffset(t1, t0, t2, t3)
+end
+
+macro putGlobalVariable()
+    loadisFromInstruction(3, t0)
+    loadConstantOrVariable(t0, t1, t2)
+    loadpFromInstruction(5, t3)
+    notifyWrite(t3, .pDynamic)
+    loadpFromInstruction(6, t0)
+    storei t1, TagOffset[t0]
+    storei t2, PayloadOffset[t0]
+end
+
+macro putClosureVar()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2, t3)
+    loadisFromInstruction(6, t1)
+    storei t2, JSEnvironmentRecord_variables + TagOffset[t0, t1, 8]
+    storei t3, JSEnvironmentRecord_variables + PayloadOffset[t0, t1, 8]
+end
+
+macro putLocalClosureVar()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2, t3)
+    loadpFromInstruction(5, t5)
+    btpz t5, .noVariableWatchpointSet
+    notifyWrite(t5, .pDynamic)
+.noVariableWatchpointSet:
+    loadisFromInstruction(6, t1)
+    storei t2, JSEnvironmentRecord_variables + TagOffset[t0, t1, 8]
+    storei t3, JSEnvironmentRecord_variables + PayloadOffset[t0, t1, 8]
+end
+
+
+_llint_op_put_to_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+    andi ResolveTypeMask, t0
+
+#pLocalClosureVar:
+    bineq t0, LocalClosureVar, .pGlobalProperty
+    writeBarrierOnOperands(1, 3)
+    loadVariable(1, t2, t1, t0)
+    putLocalClosureVar()
+    dispatch(7)
+
+.pGlobalProperty:
+    bineq t0, GlobalProperty, .pGlobalVar
+    writeBarrierOnOperands(1, 3)
+    loadWithStructureCheck(1, .pDynamic)
+    putProperty()
+    dispatch(7)
+
+.pGlobalVar:
+    bineq t0, GlobalVar, .pGlobalLexicalVar
+    writeBarrierOnGlobalObject(3)
+    putGlobalVariable()
+    dispatch(7)
+
+.pGlobalLexicalVar:
+    bineq t0, GlobalLexicalVar, .pClosureVar
+    writeBarrierOnGlobalLexicalEnvironment(3)
+    putGlobalVariable()
+    dispatch(7)
+
+.pClosureVar:
+    bineq t0, ClosureVar, .pGlobalPropertyWithVarInjectionChecks
+    writeBarrierOnOperands(1, 3)
+    loadVariable(1, t2, t1, t0)
+    putClosureVar()
+    dispatch(7)
+
+.pGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .pGlobalVarWithVarInjectionChecks
+    writeBarrierOnOperands(1, 3)
+    loadWithStructureCheck(1, .pDynamic)
+    putProperty()
+    dispatch(7)
+
+.pGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .pGlobalLexicalVarWithVarInjectionChecks
+    writeBarrierOnGlobalObject(3)
+    varInjectionCheck(.pDynamic)
+    putGlobalVariable()
+    dispatch(7)
+
+.pGlobalLexicalVarWithVarInjectionChecks:
+    bineq t0, GlobalLexicalVarWithVarInjectionChecks, .pClosureVarWithVarInjectionChecks
+    writeBarrierOnGlobalLexicalEnvironment(3)
+    varInjectionCheck(.pDynamic)
+    putGlobalVariable()
+    dispatch(7)
+
+.pClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .pModuleVar
+    writeBarrierOnOperands(1, 3)
+    varInjectionCheck(.pDynamic)
+    loadVariable(1, t2, t1, t0)
+    putClosureVar()
+    dispatch(7)
+
+.pModuleVar:
+    bineq t0, ModuleVar, .pDynamic
+    callOpcodeSlowPath(_slow_path_throw_strict_mode_readonly_property_write_error)
+    dispatch(7)
+
+.pDynamic:
+    callOpcodeSlowPath(_llint_slow_path_put_to_scope)
+    dispatch(7)
+
+
+_llint_op_get_from_arguments:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadi PayloadOffset[cfr, t0, 8], t0
+    loadi 12[PC], t1
+    loadi DirectArguments_storage + TagOffset[t0, t1, 8], t2
+    loadi DirectArguments_storage + PayloadOffset[t0, t1, 8], t3
+    loadisFromInstruction(1, t1)
+    valueProfile(t2, t3, 16, t0)
+    storei t2, TagOffset[cfr, t1, 8]
+    storei t3, PayloadOffset[cfr, t1, 8]
+    dispatch(5)
+
+
+_llint_op_put_to_arguments:
+    traceExecution()
+    writeBarrierOnOperands(1, 3)
+    loadisFromInstruction(1, t0)
+    loadi PayloadOffset[cfr, t0, 8], t0
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2, t3)
+    loadi 8[PC], t1
+    storei t2, DirectArguments_storage + TagOffset[t0, t1, 8]
+    storei t3, DirectArguments_storage + PayloadOffset[t0, t1, 8]
+    dispatch(4)
+
+
+_llint_op_get_parent_scope:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadp PayloadOffset[cfr, t0, 8], t0
+    loadp JSScope::m_next[t0], t0
+    loadisFromInstruction(1, t1)
+    storei CellTag, TagOffset[cfr, t1, 8]
+    storei t0, PayloadOffset[cfr, t1, 8]
+    dispatch(3)
+
+
+_llint_op_profile_type:
+    traceExecution()
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_vm[t1], t1
+    # t1 is holding the pointer to the typeProfilerLog.
+    loadp VM::m_typeProfilerLog[t1], t1
+
+    # t0 is holding the payload, t5 is holding the tag.
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t2, t5, t0)
+
+    bieq t5, EmptyValueTag, .opProfileTypeDone
+
+    # t2 is holding the pointer to the current log entry.
+    loadp TypeProfilerLog::m_currentLogEntryPtr[t1], t2
+
+    # Store the JSValue onto the log entry.
+    storei t5, TypeProfilerLog::LogEntry::value + TagOffset[t2]
+    storei t0, TypeProfilerLog::LogEntry::value + PayloadOffset[t2]
+
+    # Store the TypeLocation onto the log entry.
+    loadpFromInstruction(2, t3)
+    storep t3, TypeProfilerLog::LogEntry::location[t2]
+
+    bieq t5, CellTag, .opProfileTypeIsCell
+    storei 0, TypeProfilerLog::LogEntry::structureID[t2]
+    jmp .opProfileTypeSkipIsCell
+.opProfileTypeIsCell:
+    loadi JSCell::m_structureID[t0], t3
+    storei t3, TypeProfilerLog::LogEntry::structureID[t2]
+.opProfileTypeSkipIsCell:
+    
+    # Increment the current log entry.
+    addp sizeof TypeProfilerLog::LogEntry, t2
+    storep t2, TypeProfilerLog::m_currentLogEntryPtr[t1]
+
+    loadp TypeProfilerLog::m_logEndPtr[t1], t1
+    bpneq t2, t1, .opProfileTypeDone
+    callOpcodeSlowPath(_slow_path_profile_type_clear_log)
+
+.opProfileTypeDone:
+    dispatch(6)
+
+
+_llint_op_profile_control_flow:
+    traceExecution()
+    loadpFromInstruction(1, t0)
+    loadi BasicBlockLocation::m_executionCount[t0], t1
+    addi 1, t1
+    bieq t1, 0, .done # We overflowed.
+    storei t1, BasicBlockLocation::m_executionCount[t0]
+.done:
+    dispatch(2)
+
+
+_llint_op_get_rest_length:
+    traceExecution()
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    subi 1, t0
+    loadisFromInstruction(2, t1)
+    bilteq t0, t1, .storeZero
+    subi t1, t0
+    jmp .finish
+.storeZero:
+    move 0, t0
+.finish:
+    loadisFromInstruction(1, t1)
+    storei t0, PayloadOffset[cfr, t1, 8]
+    storei Int32Tag, TagOffset[cfr, t1, 8]
+    dispatch(3)
+
+
+_llint_op_log_shadow_chicken_prologue:
+    traceExecution()
+    acquireShadowChickenPacket(.opLogShadowChickenPrologueSlow)
+    storep cfr, ShadowChicken::Packet::frame[t0]
+    loadp CallerFrame[cfr], t1
+    storep t1, ShadowChicken::Packet::callerFrame[t0]
+    loadp Callee + PayloadOffset[cfr], t1
+    storep t1, ShadowChicken::Packet::callee[t0]
+    loadisFromInstruction(1, t1)
+    loadi PayloadOffset[cfr, t1, 8], t1
+    storep t1, ShadowChicken::Packet::scope[t0]
+    dispatch(2)
+.opLogShadowChickenPrologueSlow:
+    callOpcodeSlowPath(_llint_slow_path_log_shadow_chicken_prologue)
+    dispatch(2)
+
+
+_llint_op_log_shadow_chicken_tail:
+    traceExecution()
+    acquireShadowChickenPacket(.opLogShadowChickenTailSlow)
+    storep cfr, ShadowChicken::Packet::frame[t0]
+    storep ShadowChickenTailMarker, ShadowChicken::Packet::callee[t0]
+    loadVariable(1, t3, t2, t1)
+    storei t2, TagOffset + ShadowChicken::Packet::thisValue[t0]
+    storei t1, PayloadOffset + ShadowChicken::Packet::thisValue[t0]
+    loadisFromInstruction(2, t1)
+    loadi PayloadOffset[cfr, t1, 8], t1
+    storep t1, ShadowChicken::Packet::scope[t0]
+    loadp CodeBlock[cfr], t1
+    storep t1, ShadowChicken::Packet::codeBlock[t0]
+    storei PC, ShadowChicken::Packet::callSiteIndex[t0]
+    dispatch(3)
+.opLogShadowChickenTailSlow:
+    callOpcodeSlowPath(_llint_slow_path_log_shadow_chicken_tail)
+    dispatch(3)
diff --git a/llint/LowLevelInterpreter64.asm b/llint/LowLevelInterpreter64.asm
new file mode 100644
index 0000000..28101f1
--- /dev/null
+++ b/llint/LowLevelInterpreter64.asm
@@ -0,0 +1,2474 @@
+# Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# Utilities.
+macro jumpToInstruction()
+    jmp [PB, PC, 8]
+end
+
+macro dispatch(advance)
+    addp advance, PC
+    jumpToInstruction()
+end
+
+macro dispatchInt(advance)
+    addi advance, PC
+    jumpToInstruction()
+end
+
+macro dispatchIntIndirect(offset)
+    dispatchInt(offset * 8[PB, PC, 8])
+end
+
+macro dispatchAfterCall()
+    loadi ArgumentCount + TagOffset[cfr], PC
+    loadp CodeBlock[cfr], PB
+    loadp CodeBlock::m_instructions[PB], PB
+    loadisFromInstruction(1, t1)
+    storeq r0, [cfr, t1, 8]
+    valueProfile(r0, (CallOpCodeSize - 1), t3)
+    dispatch(CallOpCodeSize)
+end
+
+macro cCall2(function)
+    checkStackPointerAlignment(t4, 0xbad0c002)
+    if X86_64 or ARM64
+        call function
+    elsif X86_64_WIN
+        # Note: this implementation is only correct if the return type size is > 8 bytes.
+        # See macro cCall2Void for an implementation when the return type <= 8 bytes.
+        # On Win64, when the return type is larger than 8 bytes, we need to allocate space on the stack for the return value.
+        # On entry rcx (a0), should contain a pointer to this stack space. The other parameters are shifted to the right,
+        # rdx (a1) should contain the first argument, and r8 (a2) should contain the second argument.
+        # On return, rax contains a pointer to this stack value, and we then need to copy the 16 byte return value into rax (r0) and rdx (r1)
+        # since the return value is expected to be split between the two.
+        # See http://msdn.microsoft.com/en-us/library/7572ztz4.aspx
+        move a1, a2
+        move a0, a1
+        subp 48, sp
+        move sp, a0
+        addp 32, a0
+        call function
+        addp 48, sp
+        move 8[r0], r1
+        move [r0], r0
+    elsif C_LOOP
+        cloopCallSlowPath function, a0, a1
+    else
+        error
+    end
+end
+
+macro cCall2Void(function)
+    if C_LOOP
+        cloopCallSlowPathVoid function, a0, a1
+    elsif X86_64_WIN
+        # Note: we cannot use the cCall2 macro for Win64 in this case,
+        # as the Win64 cCall2 implemenation is only correct when the return type size is > 8 bytes.
+        # On Win64, rcx and rdx are used for passing the first two parameters.
+        # We also need to make room on the stack for all four parameter registers.
+        # See http://msdn.microsoft.com/en-us/library/ms235286.aspx
+        subp 32, sp 
+        call function
+        addp 32, sp 
+    else
+        cCall2(function)
+    end
+end
+
+# This barely works. arg3 and arg4 should probably be immediates.
+macro cCall4(function)
+    checkStackPointerAlignment(t4, 0xbad0c004)
+    if X86_64 or ARM64
+        call function
+    elsif X86_64_WIN
+        # On Win64, rcx, rdx, r8, and r9 are used for passing the first four parameters.
+        # We also need to make room on the stack for all four parameter registers.
+        # See http://msdn.microsoft.com/en-us/library/ms235286.aspx
+        subp 64, sp
+        call function
+        addp 64, sp
+    else
+        error
+    end
+end
+
+macro doVMEntry(makeCall)
+    functionPrologue()
+    pushCalleeSaves()
+
+    const entry = a0
+    const vm = a1
+    const protoCallFrame = a2
+
+    vmEntryRecord(cfr, sp)
+
+    checkStackPointerAlignment(t4, 0xbad0dc01)
+
+    storep vm, VMEntryRecord::m_vm[sp]
+    loadp VM::topCallFrame[vm], t4
+    storep t4, VMEntryRecord::m_prevTopCallFrame[sp]
+    loadp VM::topVMEntryFrame[vm], t4
+    storep t4, VMEntryRecord::m_prevTopVMEntryFrame[sp]
+
+    loadi ProtoCallFrame::paddedArgCount[protoCallFrame], t4
+    addp CallFrameHeaderSlots, t4, t4
+    lshiftp 3, t4
+    subp sp, t4, t3
+
+    # Ensure that we have enough additional stack capacity for the incoming args,
+    # and the frame for the JS code we're executing. We need to do this check
+    # before we start copying the args from the protoCallFrame below.
+    if C_LOOP
+        bpaeq t3, VM::m_cloopStackLimit[vm], .stackHeightOK
+    else
+        bpaeq t3, VM::m_softStackLimit[vm], .stackHeightOK
+    end
+
+    if C_LOOP
+        move entry, t4
+        move vm, t5
+        cloopCallSlowPath _llint_stack_check_at_vm_entry, vm, t3
+        bpeq t0, 0, .stackCheckFailed
+        move t4, entry
+        move t5, vm
+        jmp .stackHeightOK
+
+.stackCheckFailed:
+        move t4, entry
+        move t5, vm
+    end
+
+    move vm, a0
+    move protoCallFrame, a1
+    cCall2(_llint_throw_stack_overflow_error)
+
+    vmEntryRecord(cfr, t4)
+
+    loadp VMEntryRecord::m_vm[t4], vm
+    loadp VMEntryRecord::m_prevTopCallFrame[t4], extraTempReg
+    storep extraTempReg, VM::topCallFrame[vm]
+    loadp VMEntryRecord::m_prevTopVMEntryFrame[t4], extraTempReg
+    storep extraTempReg, VM::topVMEntryFrame[vm]
+
+    subp cfr, CalleeRegisterSaveSize, sp
+
+    popCalleeSaves()
+    functionEpilogue()
+    ret
+
+.stackHeightOK:
+    move t3, sp
+    move 4, t3
+
+.copyHeaderLoop:
+    # Copy the CodeBlock/Callee/ArgumentCount/|this| from protoCallFrame into the callee frame.
+    subi 1, t3
+    loadq [protoCallFrame, t3, 8], extraTempReg
+    storeq extraTempReg, CodeBlock[sp, t3, 8]
+    btinz t3, .copyHeaderLoop
+
+    loadi PayloadOffset + ProtoCallFrame::argCountAndCodeOriginValue[protoCallFrame], t4
+    subi 1, t4
+    loadi ProtoCallFrame::paddedArgCount[protoCallFrame], extraTempReg
+    subi 1, extraTempReg
+
+    bieq t4, extraTempReg, .copyArgs
+    move ValueUndefined, t3
+.fillExtraArgsLoop:
+    subi 1, extraTempReg
+    storeq t3, ThisArgumentOffset + 8[sp, extraTempReg, 8]
+    bineq t4, extraTempReg, .fillExtraArgsLoop
+
+.copyArgs:
+    loadp ProtoCallFrame::args[protoCallFrame], t3
+
+.copyArgsLoop:
+    btiz t4, .copyArgsDone
+    subi 1, t4
+    loadq [t3, t4, 8], extraTempReg
+    storeq extraTempReg, ThisArgumentOffset + 8[sp, t4, 8]
+    jmp .copyArgsLoop
+
+.copyArgsDone:
+    if ARM64
+        move sp, t4
+        storep t4, VM::topCallFrame[vm]
+    else
+        storep sp, VM::topCallFrame[vm]
+    end
+    storep cfr, VM::topVMEntryFrame[vm]
+
+    checkStackPointerAlignment(extraTempReg, 0xbad0dc02)
+
+    makeCall(entry, t3)
+
+    # We may have just made a call into a JS function, so we can't rely on sp
+    # for anything but the fact that our own locals (ie the VMEntryRecord) are
+    # not below it. It also still has to be aligned, though.
+    checkStackPointerAlignment(t2, 0xbad0dc03)
+
+    vmEntryRecord(cfr, t4)
+
+    loadp VMEntryRecord::m_vm[t4], vm
+    loadp VMEntryRecord::m_prevTopCallFrame[t4], t2
+    storep t2, VM::topCallFrame[vm]
+    loadp VMEntryRecord::m_prevTopVMEntryFrame[t4], t2
+    storep t2, VM::topVMEntryFrame[vm]
+
+    subp cfr, CalleeRegisterSaveSize, sp
+
+    popCalleeSaves()
+    functionEpilogue()
+
+    ret
+end
+
+
+macro makeJavaScriptCall(entry, temp)
+    addp 16, sp
+    if C_LOOP
+        cloopCallJSFunction entry
+    else
+        call entry
+    end
+    subp 16, sp
+end
+
+
+macro makeHostFunctionCall(entry, temp)
+    move entry, temp
+    storep cfr, [sp]
+    move sp, a0
+    if C_LOOP
+        storep lr, 8[sp]
+        cloopCallNative temp
+    elsif X86_64_WIN
+        # We need to allocate 32 bytes on the stack for the shadow space.
+        subp 32, sp
+        call temp
+        addp 32, sp
+    else
+        call temp
+    end
+end
+
+
+_handleUncaughtException:
+    loadp Callee[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+    restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(t3, t0)
+    loadp VM::callFrameForCatch[t3], cfr
+    storep 0, VM::callFrameForCatch[t3]
+
+    loadp CallerFrame[cfr], cfr
+    vmEntryRecord(cfr, t2)
+
+    loadp VMEntryRecord::m_vm[t2], t3
+    loadp VMEntryRecord::m_prevTopCallFrame[t2], extraTempReg
+    storep extraTempReg, VM::topCallFrame[t3]
+    loadp VMEntryRecord::m_prevTopVMEntryFrame[t2], extraTempReg
+    storep extraTempReg, VM::topVMEntryFrame[t3]
+
+    subp cfr, CalleeRegisterSaveSize, sp
+
+    popCalleeSaves()
+    functionEpilogue()
+    ret
+
+
+macro prepareStateForCCall()
+    leap [PB, PC, 8], PC
+end
+
+macro restoreStateAfterCCall()
+    move r0, PC
+    subp PB, PC
+    rshiftp 3, PC
+end
+
+macro callSlowPath(slowPath)
+    prepareStateForCCall()
+    move cfr, a0
+    move PC, a1
+    cCall2(slowPath)
+    restoreStateAfterCCall()
+end
+
+macro traceOperand(fromWhere, operand)
+    prepareStateForCCall()
+    move fromWhere, a2
+    move operand, a3
+    move cfr, a0
+    move PC, a1
+    cCall4(_llint_trace_operand)
+    restoreStateAfterCCall()
+end
+
+macro traceValue(fromWhere, operand)
+    prepareStateForCCall()
+    move fromWhere, a2
+    move operand, a3
+    move cfr, a0
+    move PC, a1
+    cCall4(_llint_trace_value)
+    restoreStateAfterCCall()
+end
+
+# Call a slow path for call call opcodes.
+macro callCallSlowPath(slowPath, action)
+    storei PC, ArgumentCount + TagOffset[cfr]
+    prepareStateForCCall()
+    move cfr, a0
+    move PC, a1
+    cCall2(slowPath)
+    action(r0, r1)
+end
+
+macro callWatchdogTimerHandler(throwHandler)
+    storei PC, ArgumentCount + TagOffset[cfr]
+    prepareStateForCCall()
+    move cfr, a0
+    move PC, a1
+    cCall2(_llint_slow_path_handle_watchdog_timer)
+    btpnz r0, throwHandler
+    loadi ArgumentCount + TagOffset[cfr], PC
+end
+
+macro checkSwitchToJITForLoop()
+    checkSwitchToJIT(
+        1,
+        macro()
+            storei PC, ArgumentCount + TagOffset[cfr]
+            prepareStateForCCall()
+            move cfr, a0
+            move PC, a1
+            cCall2(_llint_loop_osr)
+            btpz r0, .recover
+            move r1, sp
+            jmp r0
+        .recover:
+            loadi ArgumentCount + TagOffset[cfr], PC
+        end)
+end
+
+macro loadVariable(operand, value)
+    loadisFromInstruction(operand, value)
+    loadq [cfr, value, 8], value
+end
+
+# Index and value must be different registers. Index may be clobbered.
+macro loadConstantOrVariable(index, value)
+    bpgteq index, FirstConstantRegisterIndex, .constant
+    loadq [cfr, index, 8], value
+    jmp .done
+.constant:
+    loadp CodeBlock[cfr], value
+    loadp CodeBlock::m_constantRegisters + VectorBufferOffset[value], value
+    subp FirstConstantRegisterIndex, index
+    loadq [value, index, 8], value
+.done:
+end
+
+macro loadConstantOrVariableInt32(index, value, slow)
+    loadConstantOrVariable(index, value)
+    bqb value, tagTypeNumber, slow
+end
+
+macro loadConstantOrVariableCell(index, value, slow)
+    loadConstantOrVariable(index, value)
+    btqnz value, tagMask, slow
+end
+
+macro writeBarrierOnOperand(cellOperand)
+    loadisFromInstruction(cellOperand, t1)
+    loadConstantOrVariableCell(t1, t2, .writeBarrierDone)
+    skipIfIsRememberedOrInEden(
+        t2,
+        macro()
+            push PB, PC
+            move t2, a1 # t2 can be a0 (not on 64 bits, but better safe than sorry)
+            move cfr, a0
+            cCall2Void(_llint_write_barrier_slow)
+            pop PC, PB
+        end)
+.writeBarrierDone:
+end
+
+macro writeBarrierOnOperands(cellOperand, valueOperand)
+    loadisFromInstruction(valueOperand, t1)
+    loadConstantOrVariableCell(t1, t0, .writeBarrierDone)
+    btpz t0, .writeBarrierDone
+
+    writeBarrierOnOperand(cellOperand)
+.writeBarrierDone:
+end
+
+macro writeBarrierOnGlobal(valueOperand, loadHelper)
+    loadisFromInstruction(valueOperand, t1)
+    loadConstantOrVariableCell(t1, t0, .writeBarrierDone)
+    btpz t0, .writeBarrierDone
+
+    loadHelper(t3)
+    skipIfIsRememberedOrInEden(
+        t3,
+        macro()
+            push PB, PC
+            move cfr, a0
+            move t3, a1
+            cCall2Void(_llint_write_barrier_slow)
+            pop PC, PB
+        end
+    )
+.writeBarrierDone:
+end
+
+macro writeBarrierOnGlobalObject(valueOperand)
+    writeBarrierOnGlobal(valueOperand,
+        macro(registerToStoreGlobal)
+            loadp CodeBlock[cfr], registerToStoreGlobal
+            loadp CodeBlock::m_globalObject[registerToStoreGlobal], registerToStoreGlobal
+        end)
+end
+
+macro writeBarrierOnGlobalLexicalEnvironment(valueOperand)
+    writeBarrierOnGlobal(valueOperand,
+        macro(registerToStoreGlobal)
+            loadp CodeBlock[cfr], registerToStoreGlobal
+            loadp CodeBlock::m_globalObject[registerToStoreGlobal], registerToStoreGlobal
+            loadp JSGlobalObject::m_globalLexicalEnvironment[registerToStoreGlobal], registerToStoreGlobal
+        end)
+end
+
+macro valueProfile(value, operand, scratch)
+    loadpFromInstruction(operand, scratch)
+    storeq value, ValueProfile::m_buckets[scratch]
+end
+
+macro structureIDToStructureWithScratch(structureIDThenStructure, scratch)
+    loadp CodeBlock[cfr], scratch
+    loadp CodeBlock::m_vm[scratch], scratch
+    loadp VM::heap + Heap::m_structureIDTable + StructureIDTable::m_table[scratch], scratch
+    loadp [scratch, structureIDThenStructure, 8], structureIDThenStructure
+end
+
+macro loadStructureWithScratch(cell, structure, scratch)
+    loadi JSCell::m_structureID[cell], structure
+    structureIDToStructureWithScratch(structure, scratch)
+end
+
+macro loadStructureAndClobberFirstArg(cell, structure)
+    loadi JSCell::m_structureID[cell], structure
+    loadp CodeBlock[cfr], cell
+    loadp CodeBlock::m_vm[cell], cell
+    loadp VM::heap + Heap::m_structureIDTable + StructureIDTable::m_table[cell], cell
+    loadp [cell, structure, 8], structure
+end
+
+# Entrypoints into the interpreter.
+
+# Expects that CodeBlock is in t1, which is what prologue() leaves behind.
+macro functionArityCheck(doneLabel, slowPath)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    biaeq t0, CodeBlock::m_numParameters[t1], doneLabel
+    prepareStateForCCall()
+    move cfr, a0
+    move PC, a1
+    cCall2(slowPath)   # This slowPath has the protocol: r0 = 0 => no error, r0 != 0 => error
+    btiz r0, .noError
+    move r1, cfr   # r1 contains caller frame
+    jmp _llint_throw_from_slow_path_trampoline
+
+.noError:
+    loadi CommonSlowPaths::ArityCheckData::paddedStackSpace[r1], t1
+    btiz t1, .continue
+    loadi PayloadOffset + ArgumentCount[cfr], t2
+    addi CallFrameHeaderSlots, t2
+
+    // Check if there are some unaligned slots we can use
+    move t1, t3
+    andi StackAlignmentSlots - 1, t3
+    btiz t3, .noExtraSlot
+    move ValueUndefined, t0
+.fillExtraSlots:
+    storeq t0, [cfr, t2, 8]
+    addi 1, t2
+    bsubinz 1, t3, .fillExtraSlots
+    andi ~(StackAlignmentSlots - 1), t1
+    btiz t1, .continue
+
+.noExtraSlot:
+    // Move frame up t1 slots
+    negq t1
+    move cfr, t3
+    subp CalleeSaveSpaceAsVirtualRegisters * 8, t3
+    addi CalleeSaveSpaceAsVirtualRegisters, t2
+.copyLoop:
+    loadq [t3], t0
+    storeq t0, [t3, t1, 8]
+    addp 8, t3
+    bsubinz 1, t2, .copyLoop
+
+    // Fill new slots with JSUndefined
+    move t1, t2
+    move ValueUndefined, t0
+.fillLoop:
+    storeq t0, [t3, t1, 8]
+    addp 8, t3
+    baddinz 1, t2, .fillLoop
+
+    lshiftp 3, t1
+    addp t1, cfr
+    addp t1, sp
+
+.continue:
+    # Reload CodeBlock and reset PC, since the slow_path clobbered them.
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_instructions[t1], PB
+    move 0, PC
+    jmp doneLabel
+end
+
+macro branchIfException(label)
+    loadp Callee[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+    btqz VM::m_exception[t3], .noException
+    jmp label
+.noException:
+end
+
+
+# Instruction implementations
+_llint_op_enter:
+    traceExecution()
+    checkStackPointerAlignment(t2, 0xdead00e1)
+    loadp CodeBlock[cfr], t2                // t2<CodeBlock> = cfr.CodeBlock
+    loadi CodeBlock::m_numVars[t2], t2      // t2<size_t> = t2<CodeBlock>.m_numVars
+    subq CalleeSaveSpaceAsVirtualRegisters, t2
+    move cfr, t1
+    subq CalleeSaveSpaceAsVirtualRegisters * 8, t1
+    btiz t2, .opEnterDone
+    move ValueUndefined, t0
+    negi t2
+    sxi2q t2, t2
+.opEnterLoop:
+    storeq t0, [t1, t2, 8]
+    addq 1, t2
+    btqnz t2, .opEnterLoop
+.opEnterDone:
+    callOpcodeSlowPath(_slow_path_enter)
+    dispatch(1)
+
+
+_llint_op_get_argument:
+    traceExecution()
+    loadisFromInstruction(1, t1)
+    loadisFromInstruction(2, t2)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    bilteq t0, t2, .opGetArgumentOutOfBounds
+    loadq ThisArgumentOffset[cfr, t2, 8], t0
+    storeq t0, [cfr, t1, 8]
+    valueProfile(t0, 3, t2)
+    dispatch(4)
+
+.opGetArgumentOutOfBounds:
+    storeq ValueUndefined, [cfr, t1, 8]
+    valueProfile(ValueUndefined, 3, t2)
+    dispatch(4)
+
+
+_llint_op_argument_count:
+    traceExecution()
+    loadisFromInstruction(1, t1)
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    subi 1, t0
+    orq TagTypeNumber, t0
+    storeq t0, [cfr, t1, 8]
+    dispatch(2)
+
+
+_llint_op_get_scope:
+    traceExecution()
+    loadp Callee[cfr], t0
+    loadp JSCallee::m_scope[t0], t0
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+    dispatch(2)
+
+
+_llint_op_to_this:
+    traceExecution()
+    loadisFromInstruction(1, t0)
+    loadq [cfr, t0, 8], t0
+    btqnz t0, tagMask, .opToThisSlow
+    bbneq JSCell::m_type[t0], FinalObjectType, .opToThisSlow
+    loadStructureWithScratch(t0, t1, t2)
+    loadpFromInstruction(2, t2)
+    bpneq t1, t2, .opToThisSlow
+    dispatch(4)
+
+.opToThisSlow:
+    callOpcodeSlowPath(_slow_path_to_this)
+    dispatch(4)
+
+
+_llint_op_check_tdz:
+    traceExecution()
+    loadisFromInstruction(1, t0)
+    loadConstantOrVariable(t0, t1)
+    bqneq t1, ValueEmpty, .opNotTDZ
+    callOpcodeSlowPath(_slow_path_throw_tdz_error)
+
+.opNotTDZ:
+    dispatch(2)
+
+
+_llint_op_mov:
+    traceExecution()
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t0)
+    loadConstantOrVariable(t1, t2)
+    storeq t2, [cfr, t0, 8]
+    dispatch(3)
+
+
+_llint_op_not:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(1, t1)
+    loadConstantOrVariable(t0, t2)
+    xorq ValueFalse, t2
+    btqnz t2, ~1, .opNotSlow
+    xorq ValueTrue, t2
+    storeq t2, [cfr, t1, 8]
+    dispatch(3)
+
+.opNotSlow:
+    callOpcodeSlowPath(_slow_path_not)
+    dispatch(3)
+
+
+macro equalityComparison(integerComparison, slowPath)
+    traceExecution()
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t2)
+    loadisFromInstruction(1, t3)
+    loadConstantOrVariableInt32(t0, t1, .slow)
+    loadConstantOrVariableInt32(t2, t0, .slow)
+    integerComparison(t0, t1, t0)
+    orq ValueFalse, t0
+    storeq t0, [cfr, t3, 8]
+    dispatch(4)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(4)
+end
+
+_llint_op_eq:
+    equalityComparison(
+        macro (left, right, result) cieq left, right, result end,
+        _slow_path_eq)
+
+
+_llint_op_neq:
+    equalityComparison(
+        macro (left, right, result) cineq left, right, result end,
+        _slow_path_neq)
+
+
+macro equalNullComparison()
+    loadisFromInstruction(2, t0)
+    loadq [cfr, t0, 8], t0
+    btqnz t0, tagMask, .immediate
+    btbnz JSCell::m_flags[t0], MasqueradesAsUndefined, .masqueradesAsUndefined
+    move 0, t0
+    jmp .done
+.masqueradesAsUndefined:
+    loadStructureWithScratch(t0, t2, t1)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    cpeq Structure::m_globalObject[t2], t0, t0
+    jmp .done
+.immediate:
+    andq ~TagBitUndefined, t0
+    cqeq t0, ValueNull, t0
+.done:
+end
+
+_llint_op_eq_null:
+    traceExecution()
+    equalNullComparison()
+    loadisFromInstruction(1, t1)
+    orq ValueFalse, t0
+    storeq t0, [cfr, t1, 8]
+    dispatch(3)
+
+
+_llint_op_neq_null:
+    traceExecution()
+    equalNullComparison()
+    loadisFromInstruction(1, t1)
+    xorq ValueTrue, t0
+    storeq t0, [cfr, t1, 8]
+    dispatch(3)
+
+
+macro strictEq(equalityOperation, slowPath)
+    traceExecution()
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t2)
+    loadConstantOrVariable(t0, t1)
+    loadConstantOrVariable(t2, t0)
+    move t0, t2
+    orq t1, t2
+    btqz t2, tagMask, .slow
+    bqaeq t0, tagTypeNumber, .leftOK
+    btqnz t0, tagTypeNumber, .slow
+.leftOK:
+    bqaeq t1, tagTypeNumber, .rightOK
+    btqnz t1, tagTypeNumber, .slow
+.rightOK:
+    equalityOperation(t0, t1, t0)
+    loadisFromInstruction(1, t1)
+    orq ValueFalse, t0
+    storeq t0, [cfr, t1, 8]
+    dispatch(4)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(4)
+end
+
+_llint_op_stricteq:
+    strictEq(
+        macro (left, right, result) cqeq left, right, result end,
+        _slow_path_stricteq)
+
+
+_llint_op_nstricteq:
+    strictEq(
+        macro (left, right, result) cqneq left, right, result end,
+        _slow_path_nstricteq)
+
+
+macro preOp(arithmeticOperation, slowPath)
+    traceExecution()
+    loadisFromInstruction(1, t0)
+    loadq [cfr, t0, 8], t1
+    bqb t1, tagTypeNumber, .slow
+    arithmeticOperation(t1, .slow)
+    orq tagTypeNumber, t1
+    storeq t1, [cfr, t0, 8]
+    dispatch(2)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(2)
+end
+
+_llint_op_inc:
+    preOp(
+        macro (value, slow) baddio 1, value, slow end,
+        _slow_path_inc)
+
+
+_llint_op_dec:
+    preOp(
+        macro (value, slow) bsubio 1, value, slow end,
+        _slow_path_dec)
+
+
+_llint_op_to_number:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(1, t1)
+    loadConstantOrVariable(t0, t2)
+    bqaeq t2, tagTypeNumber, .opToNumberIsImmediate
+    btqz t2, tagTypeNumber, .opToNumberSlow
+.opToNumberIsImmediate:
+    storeq t2, [cfr, t1, 8]
+    valueProfile(t2, 3, t0)
+    dispatch(4)
+
+.opToNumberSlow:
+    callOpcodeSlowPath(_slow_path_to_number)
+    dispatch(4)
+
+
+_llint_op_to_string:
+    traceExecution()
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t1, t0)
+    btqnz t0, tagMask, .opToStringSlow
+    bbneq JSCell::m_type[t0], StringType, .opToStringSlow
+.opToStringIsString:
+    storeq t0, [cfr, t2, 8]
+    dispatch(3)
+
+.opToStringSlow:
+    callOpcodeSlowPath(_slow_path_to_string)
+    dispatch(3)
+
+
+_llint_op_negate:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadisFromInstruction(1, t1)
+    loadConstantOrVariable(t0, t3)
+    loadisFromInstruction(3, t2)
+    bqb t3, tagTypeNumber, .opNegateNotInt
+    btiz t3, 0x7fffffff, .opNegateSlow
+    negi t3
+    ori ArithProfileInt, t2
+    orq tagTypeNumber, t3
+    storeisToInstruction(t2, 3)
+    storeq t3, [cfr, t1, 8]
+    dispatch(4)
+.opNegateNotInt:
+    btqz t3, tagTypeNumber, .opNegateSlow
+    xorq 0x8000000000000000, t3
+    ori ArithProfileNumber, t2
+    storeq t3, [cfr, t1, 8]
+    storeisToInstruction(t2, 3)
+    dispatch(4)
+
+.opNegateSlow:
+    callOpcodeSlowPath(_slow_path_negate)
+    dispatch(4)
+
+
+macro binaryOpCustomStore(integerOperationAndStore, doubleOperation, slowPath)
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t2)
+    loadConstantOrVariable(t0, t1)
+    loadConstantOrVariable(t2, t0)
+    bqb t0, tagTypeNumber, .op1NotInt
+    bqb t1, tagTypeNumber, .op2NotInt
+    loadisFromInstruction(1, t2)
+    integerOperationAndStore(t1, t0, .slow, t2)
+    loadisFromInstruction(4, t1)
+    ori ArithProfileIntInt, t1
+    storeisToInstruction(t1, 4)
+    dispatch(5)
+
+.op1NotInt:
+    # First operand is definitely not an int, the second operand could be anything.
+    btqz t0, tagTypeNumber, .slow
+    bqaeq t1, tagTypeNumber, .op1NotIntOp2Int
+    btqz t1, tagTypeNumber, .slow
+    addq tagTypeNumber, t1
+    fq2d t1, ft1
+    loadisFromInstruction(4, t2)
+    ori ArithProfileNumberNumber, t2
+    storeisToInstruction(t2, 4)
+    jmp .op1NotIntReady
+.op1NotIntOp2Int:
+    loadisFromInstruction(4, t2)
+    ori ArithProfileNumberInt, t2
+    storeisToInstruction(t2, 4)
+    ci2d t1, ft1
+.op1NotIntReady:
+    loadisFromInstruction(1, t2)
+    addq tagTypeNumber, t0
+    fq2d t0, ft0
+    doubleOperation(ft1, ft0)
+    fd2q ft0, t0
+    subq tagTypeNumber, t0
+    storeq t0, [cfr, t2, 8]
+    dispatch(5)
+
+.op2NotInt:
+    # First operand is definitely an int, the second is definitely not.
+    loadisFromInstruction(1, t2)
+    btqz t1, tagTypeNumber, .slow
+    loadisFromInstruction(4, t3)
+    ori ArithProfileIntNumber, t3
+    storeisToInstruction(t3, 4)
+    ci2d t0, ft0
+    addq tagTypeNumber, t1
+    fq2d t1, ft1
+    doubleOperation(ft1, ft0)
+    fd2q ft0, t0
+    subq tagTypeNumber, t0
+    storeq t0, [cfr, t2, 8]
+    dispatch(5)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(5)
+end
+
+macro binaryOp(integerOperation, doubleOperation, slowPath)
+    binaryOpCustomStore(
+        macro (left, right, slow, index)
+            integerOperation(left, right, slow)
+            orq tagTypeNumber, right
+            storeq right, [cfr, index, 8]
+        end,
+        doubleOperation, slowPath)
+end
+
+_llint_op_add:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) baddio left, right, slow end,
+        macro (left, right) addd left, right end,
+        _slow_path_add)
+
+
+_llint_op_mul:
+    traceExecution()
+    binaryOpCustomStore(
+        macro (left, right, slow, index)
+            # Assume t3 is scratchable.
+            move right, t3
+            bmulio left, t3, slow
+            btinz t3, .done
+            bilt left, 0, slow
+            bilt right, 0, slow
+        .done:
+            orq tagTypeNumber, t3
+            storeq t3, [cfr, index, 8]
+        end,
+        macro (left, right) muld left, right end,
+        _slow_path_mul)
+
+
+_llint_op_sub:
+    traceExecution()
+    binaryOp(
+        macro (left, right, slow) bsubio left, right, slow end,
+        macro (left, right) subd left, right end,
+        _slow_path_sub)
+
+
+_llint_op_div:
+    traceExecution()
+    if X86_64 or X86_64_WIN
+        binaryOpCustomStore(
+            macro (left, right, slow, index)
+                # Assume t3 is scratchable.
+                btiz left, slow
+                bineq left, -1, .notNeg2TwoThe31DivByNeg1
+                bieq right, -2147483648, .slow
+            .notNeg2TwoThe31DivByNeg1:
+                btinz right, .intOK
+                bilt left, 0, slow
+            .intOK:
+                move left, t3
+                move right, t0
+                cdqi
+                idivi t3
+                btinz t1, slow
+                orq tagTypeNumber, t0
+                storeq t0, [cfr, index, 8]
+            end,
+            macro (left, right) divd left, right end,
+            _slow_path_div)
+    else
+        callOpcodeSlowPath(_slow_path_div)
+        dispatch(5)
+    end
+
+
+macro bitOp(operation, slowPath, advance)
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t2)
+    loadisFromInstruction(1, t3)
+    loadConstantOrVariable(t0, t1)
+    loadConstantOrVariable(t2, t0)
+    bqb t0, tagTypeNumber, .slow
+    bqb t1, tagTypeNumber, .slow
+    operation(t1, t0)
+    orq tagTypeNumber, t0
+    storeq t0, [cfr, t3, 8]
+    dispatch(advance)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(advance)
+end
+
+_llint_op_lshift:
+    traceExecution()
+    bitOp(
+        macro (left, right) lshifti left, right end,
+        _slow_path_lshift,
+        4)
+
+
+_llint_op_rshift:
+    traceExecution()
+    bitOp(
+        macro (left, right) rshifti left, right end,
+        _slow_path_rshift,
+        4)
+
+
+_llint_op_urshift:
+    traceExecution()
+    bitOp(
+        macro (left, right) urshifti left, right end,
+        _slow_path_urshift,
+        4)
+
+
+_llint_op_unsigned:
+    traceExecution()
+    loadisFromInstruction(1, t0)
+    loadisFromInstruction(2, t1)
+    loadConstantOrVariable(t1, t2)
+    bilt t2, 0, .opUnsignedSlow
+    storeq t2, [cfr, t0, 8]
+    dispatch(3)
+.opUnsignedSlow:
+    callOpcodeSlowPath(_slow_path_unsigned)
+    dispatch(3)
+
+
+_llint_op_bitand:
+    traceExecution()
+    bitOp(
+        macro (left, right) andi left, right end,
+        _slow_path_bitand,
+        5)
+
+
+_llint_op_bitxor:
+    traceExecution()
+    bitOp(
+        macro (left, right) xori left, right end,
+        _slow_path_bitxor,
+        5)
+
+
+_llint_op_bitor:
+    traceExecution()
+    bitOp(
+        macro (left, right) ori left, right end,
+        _slow_path_bitor,
+        5)
+
+
+_llint_op_overrides_has_instance:
+    traceExecution()
+    loadisFromInstruction(1, t3)
+
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t0)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_globalObject[t2], t2
+    loadp JSGlobalObject::m_functionProtoHasInstanceSymbolFunction[t2], t2
+    bqneq t0, t2, .opOverridesHasInstanceNotDefaultSymbol
+
+    loadisFromInstruction(2, t1)
+    loadConstantOrVariable(t1, t0)
+    tbz JSCell::m_flags[t0], ImplementsDefaultHasInstance, t1
+    orq ValueFalse, t1
+    storeq t1, [cfr, t3, 8]
+    dispatch(4)
+
+.opOverridesHasInstanceNotDefaultSymbol:
+    storeq ValueTrue, [cfr, t3, 8]
+    dispatch(4)
+
+
+_llint_op_instanceof_custom:
+    traceExecution()
+    callOpcodeSlowPath(_llint_slow_path_instanceof_custom)
+    dispatch(5)
+
+
+_llint_op_is_empty:
+    traceExecution()
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t1, t0)
+    cqeq t0, ValueEmpty, t3
+    orq ValueFalse, t3
+    storeq t3, [cfr, t2, 8]
+    dispatch(3)
+
+
+_llint_op_is_undefined:
+    traceExecution()
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t1, t0)
+    btqz t0, tagMask, .opIsUndefinedCell
+    cqeq t0, ValueUndefined, t3
+    orq ValueFalse, t3
+    storeq t3, [cfr, t2, 8]
+    dispatch(3)
+.opIsUndefinedCell:
+    btbnz JSCell::m_flags[t0], MasqueradesAsUndefined, .masqueradesAsUndefined
+    move ValueFalse, t1
+    storeq t1, [cfr, t2, 8]
+    dispatch(3)
+.masqueradesAsUndefined:
+    loadStructureWithScratch(t0, t3, t1)
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_globalObject[t1], t1
+    cpeq Structure::m_globalObject[t3], t1, t0
+    orq ValueFalse, t0
+    storeq t0, [cfr, t2, 8]
+    dispatch(3)
+
+
+_llint_op_is_boolean:
+    traceExecution()
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t1, t0)
+    xorq ValueFalse, t0
+    tqz t0, ~1, t0
+    orq ValueFalse, t0
+    storeq t0, [cfr, t2, 8]
+    dispatch(3)
+
+
+_llint_op_is_number:
+    traceExecution()
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t1, t0)
+    tqnz t0, tagTypeNumber, t1
+    orq ValueFalse, t1
+    storeq t1, [cfr, t2, 8]
+    dispatch(3)
+
+
+_llint_op_is_cell_with_type:
+    traceExecution()
+    loadisFromInstruction(3, t0)
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t1, t3)
+    btqnz t3, tagMask, .notCellCase
+    cbeq JSCell::m_type[t3], t0, t1
+    orq ValueFalse, t1
+    storeq t1, [cfr, t2, 8]
+    dispatch(4)
+.notCellCase:
+    storeq ValueFalse, [cfr, t2, 8]
+    dispatch(4)
+
+
+_llint_op_is_object:
+    traceExecution()
+    loadisFromInstruction(2, t1)
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t1, t0)
+    btqnz t0, tagMask, .opIsObjectNotCell
+    cbaeq JSCell::m_type[t0], ObjectType, t1
+    orq ValueFalse, t1
+    storeq t1, [cfr, t2, 8]
+    dispatch(3)
+.opIsObjectNotCell:
+    storeq ValueFalse, [cfr, t2, 8]
+    dispatch(3)
+
+
+macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
+    bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
+    loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
+    negi propertyOffsetAsInt
+    sxi2q propertyOffsetAsInt, propertyOffsetAsInt
+    jmp .ready
+.isInline:
+    addp sizeof JSObject - (firstOutOfLineOffset - 2) * 8, objectAndStorage
+.ready:
+    loadq (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8], value
+end
+
+
+macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
+    bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
+    loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
+    negi propertyOffsetAsInt
+    sxi2q propertyOffsetAsInt, propertyOffsetAsInt
+    jmp .ready
+.isInline:
+    addp sizeof JSObject - (firstOutOfLineOffset - 2) * 8, objectAndStorage
+.ready:
+    storeq value, (firstOutOfLineOffset - 2) * 8[objectAndStorage, propertyOffsetAsInt, 8]
+end
+
+_llint_op_get_by_id:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadConstantOrVariableCell(t0, t3, .opGetByIdSlow)
+    loadi JSCell::m_structureID[t3], t1
+    loadisFromInstruction(4, t2)
+    bineq t2, t1, .opGetByIdSlow
+    loadisFromInstruction(5, t1)
+    loadisFromInstruction(1, t2)
+    loadPropertyAtVariableOffset(t1, t3, t0)
+    storeq t0, [cfr, t2, 8]
+    valueProfile(t0, 8, t1)
+    dispatch(9)
+
+.opGetByIdSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_by_id_proto_load:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadConstantOrVariableCell(t0, t3, .opGetByIdProtoSlow)
+    loadi JSCell::m_structureID[t3], t1
+    loadisFromInstruction(4, t2)
+    bineq t2, t1, .opGetByIdProtoSlow
+    loadisFromInstruction(5, t1)
+    loadpFromInstruction(6, t3)
+    loadisFromInstruction(1, t2)
+    loadPropertyAtVariableOffset(t1, t3, t0)
+    storeq t0, [cfr, t2, 8]
+    valueProfile(t0, 8, t1)
+    dispatch(9)
+
+.opGetByIdProtoSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_by_id_unset:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadConstantOrVariableCell(t0, t3, .opGetByIdUnsetSlow)
+    loadi JSCell::m_structureID[t3], t1
+    loadisFromInstruction(4, t2)
+    bineq t2, t1, .opGetByIdUnsetSlow
+    loadisFromInstruction(1, t2)
+    storeq ValueUndefined, [cfr, t2, 8]
+    valueProfile(ValueUndefined, 8, t1)
+    dispatch(9)
+
+.opGetByIdUnsetSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_get_array_length:
+    traceExecution()
+    loadisFromInstruction(2, t0)
+    loadpFromInstruction(4, t1)
+    loadConstantOrVariableCell(t0, t3, .opGetArrayLengthSlow)
+    move t3, t2
+    arrayProfile(t2, t1, t0)
+    btiz t2, IsArray, .opGetArrayLengthSlow
+    btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
+    loadisFromInstruction(1, t1)
+    loadp JSObject::m_butterfly[t3], t0
+    loadi -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], t0
+    bilt t0, 0, .opGetArrayLengthSlow
+    orq tagTypeNumber, t0
+    valueProfile(t0, 8, t2)
+    storeq t0, [cfr, t1, 8]
+    dispatch(9)
+
+.opGetArrayLengthSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_id)
+    dispatch(9)
+
+
+_llint_op_put_by_id:
+    traceExecution()
+    loadisFromInstruction(1, t3)
+    loadConstantOrVariableCell(t3, t0, .opPutByIdSlow)
+    loadisFromInstruction(4, t2)
+    bineq t2, JSCell::m_structureID[t0], .opPutByIdSlow
+
+    # At this point, we have:
+    # t2 -> current structure ID
+    # t0 -> object base
+
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t3)
+
+    loadpFromInstruction(8, t1)
+
+    # At this point, we have:
+    # t0 -> object base
+    # t1 -> put by id flags
+    # t2 -> current structure ID
+    # t3 -> value to put
+
+    btpnz t1, PutByIdPrimaryTypeMask, .opPutByIdTypeCheckObjectWithStructureOrOther
+
+    # We have one of the non-structure type checks. Find out which one.
+    andp PutByIdSecondaryTypeMask, t1
+    bplt t1, PutByIdSecondaryTypeString, .opPutByIdTypeCheckLessThanString
+
+    # We are one of the following: String, Symbol, Object, ObjectOrOther, Top
+    bplt t1, PutByIdSecondaryTypeObjectOrOther, .opPutByIdTypeCheckLessThanObjectOrOther
+
+    # We are either ObjectOrOther or Top.
+    bpeq t1, PutByIdSecondaryTypeTop, .opPutByIdDoneCheckingTypes
+
+    # Check if we are ObjectOrOther.
+    btqz t3, tagMask, .opPutByIdTypeCheckObject
+.opPutByIdTypeCheckOther:
+    andq ~TagBitUndefined, t3
+    bqeq t3, ValueNull, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckLessThanObjectOrOther:
+    # We are either String, Symbol or Object.
+    btqnz t3, tagMask, .opPutByIdSlow
+    bpeq t1, PutByIdSecondaryTypeObject, .opPutByIdTypeCheckObject
+    bpeq t1, PutByIdSecondaryTypeSymbol, .opPutByIdTypeCheckSymbol
+    bbeq JSCell::m_type[t3], StringType, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+.opPutByIdTypeCheckObject:
+    bbaeq JSCell::m_type[t3], ObjectType, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+.opPutByIdTypeCheckSymbol:
+    bbeq JSCell::m_type[t3], SymbolType, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckLessThanString:
+    # We are one of the following: Bottom, Boolean, Other, Int32, Number
+    bplt t1, PutByIdSecondaryTypeInt32, .opPutByIdTypeCheckLessThanInt32
+
+    # We are either Int32 or Number.
+    bpeq t1, PutByIdSecondaryTypeNumber, .opPutByIdTypeCheckNumber
+
+    bqaeq t3, tagTypeNumber, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckNumber:
+    btqnz t3, tagTypeNumber, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckLessThanInt32:
+    # We are one of the following: Bottom, Boolean, Other.
+    bpneq t1, PutByIdSecondaryTypeBoolean, .opPutByIdTypeCheckBottomOrOther
+    xorq ValueFalse, t3
+    btqz t3, ~1, .opPutByIdDoneCheckingTypes
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckBottomOrOther:
+    bpeq t1, PutByIdSecondaryTypeOther, .opPutByIdTypeCheckOther
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckObjectWithStructureOrOther:
+    btqz t3, tagMask, .opPutByIdTypeCheckObjectWithStructure
+    btpnz t1, PutByIdPrimaryTypeObjectWithStructureOrOther, .opPutByIdTypeCheckOther
+    jmp .opPutByIdSlow
+
+.opPutByIdTypeCheckObjectWithStructure:
+    urshiftp 3, t1
+    bineq t1, JSCell::m_structureID[t3], .opPutByIdSlow
+
+.opPutByIdDoneCheckingTypes:
+    loadisFromInstruction(6, t1)
+    
+    btiz t1, .opPutByIdNotTransition
+
+    # This is the transition case. t1 holds the new structureID. t2 holds the old structure ID.
+    # If we have a chain, we need to check it. t0 is the base. We may clobber t1 to use it as
+    # scratch.
+    loadpFromInstruction(7, t3)
+    btpz t3, .opPutByIdTransitionDirect
+
+    loadp StructureChain::m_vector[t3], t3
+    assert(macro (ok) btpnz t3, ok end)
+
+    structureIDToStructureWithScratch(t2, t1)
+    loadq Structure::m_prototype[t2], t2
+    bqeq t2, ValueNull, .opPutByIdTransitionChainDone
+.opPutByIdTransitionChainLoop:
+    # At this point, t2 contains a prototye, and [t3] contains the Structure* that we want that
+    # prototype to have. We don't want to have to load the Structure* for t2. Instead, we load
+    # the Structure* from [t3], and then we compare its id to the id in the header of t2.
+    loadp [t3], t1
+    loadi JSCell::m_structureID[t2], t2
+    # Now, t1 has the Structure* and t2 has the StructureID that we want that Structure* to have.
+    bineq t2, Structure::m_blob + StructureIDBlob::u.fields.structureID[t1], .opPutByIdSlow
+    addp 8, t3
+    loadq Structure::m_prototype[t1], t2
+    bqneq t2, ValueNull, .opPutByIdTransitionChainLoop
+
+.opPutByIdTransitionChainDone:
+    # Reload the new structure, since we clobbered it above.
+    loadisFromInstruction(6, t1)
+
+.opPutByIdTransitionDirect:
+    storei t1, JSCell::m_structureID[t0]
+    writeBarrierOnOperand(1)
+    # Reload base into t0
+    loadisFromInstruction(1, t1)
+    loadConstantOrVariable(t1, t0)
+
+.opPutByIdNotTransition:
+    # The only thing live right now is t0, which holds the base.
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2)
+    loadisFromInstruction(5, t1)
+    storePropertyAtVariableOffset(t1, t0, t2)
+    writeBarrierOnOperands(1, 3)
+    dispatch(9)
+
+.opPutByIdSlow:
+    callOpcodeSlowPath(_llint_slow_path_put_by_id)
+    dispatch(9)
+
+macro finishGetByVal(result, scratch)
+    loadisFromInstruction(1, scratch)
+    storeq result, [cfr, scratch, 8]
+    valueProfile(result, 5, scratch)
+    dispatch(6)
+end
+
+macro finishIntGetByVal(result, scratch)
+    orq tagTypeNumber, result
+    finishGetByVal(result, scratch)
+end
+
+macro finishDoubleGetByVal(result, scratch1, scratch2)
+    fd2q result, scratch1
+    subq tagTypeNumber, scratch1
+    finishGetByVal(scratch1, scratch2)
+end
+
+_llint_op_get_by_val:
+    traceExecution()
+    loadisFromInstruction(2, t2)
+    loadConstantOrVariableCell(t2, t0, .opGetByValSlow)
+    loadpFromInstruction(4, t3)
+    move t0, t2
+    arrayProfile(t2, t3, t1)
+    loadisFromInstruction(3, t3)
+    loadConstantOrVariableInt32(t3, t1, .opGetByValSlow)
+    sxi2q t1, t1
+    loadp JSObject::m_butterfly[t0], t3
+    andi IndexingShapeMask, t2
+    bieq t2, Int32Shape, .opGetByValIsContiguous
+    bineq t2, ContiguousShape, .opGetByValNotContiguous
+.opGetByValIsContiguous:
+
+    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValOutOfBounds
+    loadisFromInstruction(1, t0)
+    loadq [t3, t1, 8], t2
+    btqz t2, .opGetByValOutOfBounds
+    jmp .opGetByValDone
+
+.opGetByValNotContiguous:
+    bineq t2, DoubleShape, .opGetByValNotDouble
+    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValOutOfBounds
+    loadis 8[PB, PC, 8], t0
+    loadd [t3, t1, 8], ft0
+    bdnequn ft0, ft0, .opGetByValOutOfBounds
+    fd2q ft0, t2
+    subq tagTypeNumber, t2
+    jmp .opGetByValDone
+    
+.opGetByValNotDouble:
+    subi ArrayStorageShape, t2
+    bia t2, SlowPutArrayStorageShape - ArrayStorageShape, .opGetByValNotIndexedStorage
+    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t3], .opGetByValOutOfBounds
+    loadisFromInstruction(1, t0)
+    loadq ArrayStorage::m_vector[t3, t1, 8], t2
+    btqz t2, .opGetByValOutOfBounds
+
+.opGetByValDone:
+    storeq t2, [cfr, t0, 8]
+    valueProfile(t2, 5, t0)
+    dispatch(6)
+
+.opGetByValOutOfBounds:
+    loadpFromInstruction(4, t0)
+    storeb 1, ArrayProfile::m_outOfBounds[t0]
+    jmp .opGetByValSlow
+
+.opGetByValNotIndexedStorage:
+    # First lets check if we even have a typed array. This lets us do some boilerplate up front.
+    loadb JSCell::m_type[t0], t2
+    subi FirstArrayType, t2
+    bia t2, LastArrayType - FirstArrayType, .opGetByValSlow
+    
+    # Sweet, now we know that we have a typed array. Do some basic things now.
+    loadp JSArrayBufferView::m_vector[t0], t3
+    biaeq t1, JSArrayBufferView::m_length[t0], .opGetByValSlow
+    
+    # Now bisect through the various types. Note that we can treat Uint8ArrayType and
+    # Uint8ClampedArrayType the same.
+    bia t2, Uint8ClampedArrayType - FirstArrayType, .opGetByValAboveUint8ClampedArray
+    
+    # We have one of Int8ArrayType .. Uint8ClampedArrayType.
+    bia t2, Int16ArrayType - FirstArrayType, .opGetByValInt32ArrayOrUint8Array
+    
+    # We have one of Int8ArrayType or Int16ArrayType
+    bineq t2, Int8ArrayType - FirstArrayType, .opGetByValInt16Array
+    
+    # We have Int8ArrayType
+    loadbs [t3, t1], t0
+    finishIntGetByVal(t0, t1)
+
+.opGetByValInt16Array:
+    loadhs [t3, t1, 2], t0
+    finishIntGetByVal(t0, t1)
+
+.opGetByValInt32ArrayOrUint8Array:
+    # We have one of Int16Array, Uint8Array, or Uint8ClampedArray.
+    bieq t2, Int32ArrayType - FirstArrayType, .opGetByValInt32Array
+    
+    # We have either Uint8Array or Uint8ClampedArray. They behave the same so that's cool.
+    loadb [t3, t1], t0
+    finishIntGetByVal(t0, t1)
+
+.opGetByValInt32Array:
+    loadi [t3, t1, 4], t0
+    finishIntGetByVal(t0, t1)
+
+.opGetByValAboveUint8ClampedArray:
+    # We have one of Uint16ArrayType .. Float64ArrayType.
+    bia t2, Uint32ArrayType - FirstArrayType, .opGetByValAboveUint32Array
+    
+    # We have either Uint16ArrayType or Uint32ArrayType.
+    bieq t2, Uint32ArrayType - FirstArrayType, .opGetByValUint32Array
+
+    # We have Uint16ArrayType.
+    loadh [t3, t1, 2], t0
+    finishIntGetByVal(t0, t1)
+
+.opGetByValUint32Array:
+    # This is the hardest part because of large unsigned values.
+    loadi [t3, t1, 4], t0
+    bilt t0, 0, .opGetByValSlow # This case is still awkward to implement in LLInt.
+    finishIntGetByVal(t0, t1)
+
+.opGetByValAboveUint32Array:
+    # We have one of Float32ArrayType or Float64ArrayType. Sadly, we cannot handle Float32Array
+    # inline yet. That would require some offlineasm changes.
+    bieq t2, Float32ArrayType - FirstArrayType, .opGetByValSlow
+
+    # We have Float64ArrayType.
+    loadd [t3, t1, 8], ft0
+    bdnequn ft0, ft0, .opGetByValSlow
+    finishDoubleGetByVal(ft0, t0, t1)
+
+.opGetByValSlow:
+    callOpcodeSlowPath(_llint_slow_path_get_by_val)
+    dispatch(6)
+
+
+macro contiguousPutByVal(storeCallback)
+    biaeq t3, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], .outOfBounds
+.storeResult:
+    loadisFromInstruction(3, t2)
+    storeCallback(t2, t1, [t0, t3, 8])
+    dispatch(5)
+
+.outOfBounds:
+    biaeq t3, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t0], .opPutByValOutOfBounds
+    loadp 32[PB, PC, 8], t2
+    storeb 1, ArrayProfile::m_mayStoreToHole[t2]
+    addi 1, t3, t2
+    storei t2, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0]
+    jmp .storeResult
+end
+
+macro putByVal(slowPath)
+    traceExecution()
+    loadisFromInstruction(1, t0)
+    loadConstantOrVariableCell(t0, t1, .opPutByValSlow)
+    loadpFromInstruction(4, t3)
+    move t1, t2
+    arrayProfile(t2, t3, t0)
+    loadisFromInstruction(2, t0)
+    loadConstantOrVariableInt32(t0, t3, .opPutByValSlow)
+    sxi2q t3, t3
+    loadp JSObject::m_butterfly[t1], t0
+    andi IndexingShapeMask, t2
+    bineq t2, Int32Shape, .opPutByValNotInt32
+    contiguousPutByVal(
+        macro (operand, scratch, address)
+            loadConstantOrVariable(operand, scratch)
+            bpb scratch, tagTypeNumber, .opPutByValSlow
+            storep scratch, address
+            writeBarrierOnOperands(1, 3)
+        end)
+
+.opPutByValNotInt32:
+    bineq t2, DoubleShape, .opPutByValNotDouble
+    contiguousPutByVal(
+        macro (operand, scratch, address)
+            loadConstantOrVariable(operand, scratch)
+            bqb scratch, tagTypeNumber, .notInt
+            ci2d scratch, ft0
+            jmp .ready
+        .notInt:
+            addp tagTypeNumber, scratch
+            fq2d scratch, ft0
+            bdnequn ft0, ft0, .opPutByValSlow
+        .ready:
+            stored ft0, address
+            writeBarrierOnOperands(1, 3)
+        end)
+
+.opPutByValNotDouble:
+    bineq t2, ContiguousShape, .opPutByValNotContiguous
+    contiguousPutByVal(
+        macro (operand, scratch, address)
+            loadConstantOrVariable(operand, scratch)
+            storep scratch, address
+            writeBarrierOnOperands(1, 3)
+        end)
+
+.opPutByValNotContiguous:
+    bineq t2, ArrayStorageShape, .opPutByValSlow
+    biaeq t3, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t0], .opPutByValOutOfBounds
+    btqz ArrayStorage::m_vector[t0, t3, 8], .opPutByValArrayStorageEmpty
+.opPutByValArrayStorageStoreResult:
+    loadisFromInstruction(3, t2)
+    loadConstantOrVariable(t2, t1)
+    storeq t1, ArrayStorage::m_vector[t0, t3, 8]
+    writeBarrierOnOperands(1, 3)
+    dispatch(5)
+
+.opPutByValArrayStorageEmpty:
+    loadpFromInstruction(4, t1)
+    storeb 1, ArrayProfile::m_mayStoreToHole[t1]
+    addi 1, ArrayStorage::m_numValuesInVector[t0]
+    bib t3, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], .opPutByValArrayStorageStoreResult
+    addi 1, t3, t1
+    storei t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0]
+    jmp .opPutByValArrayStorageStoreResult
+
+.opPutByValOutOfBounds:
+    loadpFromInstruction(4, t0)
+    storeb 1, ArrayProfile::m_outOfBounds[t0]
+.opPutByValSlow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(5)
+end
+
+_llint_op_put_by_val:
+    putByVal(_llint_slow_path_put_by_val)
+
+_llint_op_put_by_val_direct:
+    putByVal(_llint_slow_path_put_by_val_direct)
+
+
+_llint_op_jmp:
+    traceExecution()
+    dispatchIntIndirect(1)
+
+
+macro jumpTrueOrFalse(conditionOp, slow)
+    loadisFromInstruction(1, t1)
+    loadConstantOrVariable(t1, t0)
+    xorq ValueFalse, t0
+    btqnz t0, -1, .slow
+    conditionOp(t0, .target)
+    dispatch(3)
+
+.target:
+    dispatchIntIndirect(2)
+
+.slow:
+    callOpcodeSlowPath(slow)
+    dispatch(0)
+end
+
+
+macro equalNull(cellHandler, immediateHandler)
+    loadisFromInstruction(1, t0)
+    assertNotConstant(t0)
+    loadq [cfr, t0, 8], t0
+    btqnz t0, tagMask, .immediate
+    loadStructureWithScratch(t0, t2, t1)
+    cellHandler(t2, JSCell::m_flags[t0], .target)
+    dispatch(3)
+
+.target:
+    dispatchIntIndirect(2)
+
+.immediate:
+    andq ~TagBitUndefined, t0
+    immediateHandler(t0, .target)
+    dispatch(3)
+end
+
+_llint_op_jeq_null:
+    traceExecution()
+    equalNull(
+        macro (structure, value, target) 
+            btbz value, MasqueradesAsUndefined, .notMasqueradesAsUndefined
+            loadp CodeBlock[cfr], t0
+            loadp CodeBlock::m_globalObject[t0], t0
+            bpeq Structure::m_globalObject[structure], t0, target
+.notMasqueradesAsUndefined:
+        end,
+        macro (value, target) bqeq value, ValueNull, target end)
+
+
+_llint_op_jneq_null:
+    traceExecution()
+    equalNull(
+        macro (structure, value, target) 
+            btbz value, MasqueradesAsUndefined, target
+            loadp CodeBlock[cfr], t0
+            loadp CodeBlock::m_globalObject[t0], t0
+            bpneq Structure::m_globalObject[structure], t0, target
+        end,
+        macro (value, target) bqneq value, ValueNull, target end)
+
+
+_llint_op_jneq_ptr:
+    traceExecution()
+    loadisFromInstruction(1, t0)
+    loadisFromInstruction(2, t1)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_globalObject[t2], t2
+    loadp JSGlobalObject::m_specialPointers[t2, t1, 8], t1
+    bpneq t1, [cfr, t0, 8], .opJneqPtrTarget
+    dispatch(5)
+
+.opJneqPtrTarget:
+    storei 1, 32[PB, PC, 8]
+    dispatchIntIndirect(3)
+
+
+macro compare(integerCompare, doubleCompare, slowPath)
+    loadisFromInstruction(1, t2)
+    loadisFromInstruction(2, t3)
+    loadConstantOrVariable(t2, t0)
+    loadConstantOrVariable(t3, t1)
+    bqb t0, tagTypeNumber, .op1NotInt
+    bqb t1, tagTypeNumber, .op2NotInt
+    integerCompare(t0, t1, .jumpTarget)
+    dispatch(4)
+
+.op1NotInt:
+    btqz t0, tagTypeNumber, .slow
+    bqb t1, tagTypeNumber, .op1NotIntOp2NotInt
+    ci2d t1, ft1
+    jmp .op1NotIntReady
+.op1NotIntOp2NotInt:
+    btqz t1, tagTypeNumber, .slow
+    addq tagTypeNumber, t1
+    fq2d t1, ft1
+.op1NotIntReady:
+    addq tagTypeNumber, t0
+    fq2d t0, ft0
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.op2NotInt:
+    ci2d t0, ft0
+    btqz t1, tagTypeNumber, .slow
+    addq tagTypeNumber, t1
+    fq2d t1, ft1
+    doubleCompare(ft0, ft1, .jumpTarget)
+    dispatch(4)
+
+.jumpTarget:
+    dispatchIntIndirect(3)
+
+.slow:
+    callOpcodeSlowPath(slowPath)
+    dispatch(0)
+end
+
+
+_llint_op_switch_imm:
+    traceExecution()
+    loadisFromInstruction(3, t2)
+    loadisFromInstruction(1, t3)
+    loadConstantOrVariable(t2, t1)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3    # FIXME: would be nice to peephole this!
+    loadp CodeBlock::RareData::m_switchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    bqb t1, tagTypeNumber, .opSwitchImmNotInt
+    subi SimpleJumpTable::min[t2], t1
+    biaeq t1, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchImmFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t3
+    loadis [t3, t1, 4], t1
+    btiz t1, .opSwitchImmFallThrough
+    dispatch(t1)
+
+.opSwitchImmNotInt:
+    btqnz t1, tagTypeNumber, .opSwitchImmSlow   # Go slow if it's a double.
+.opSwitchImmFallThrough:
+    dispatchIntIndirect(2)
+
+.opSwitchImmSlow:
+    callOpcodeSlowPath(_llint_slow_path_switch_imm)
+    dispatch(0)
+
+
+_llint_op_switch_char:
+    traceExecution()
+    loadisFromInstruction(3, t2)
+    loadisFromInstruction(1, t3)
+    loadConstantOrVariable(t2, t1)
+    loadp CodeBlock[cfr], t2
+    loadp CodeBlock::m_rareData[t2], t2
+    muli sizeof SimpleJumpTable, t3
+    loadp CodeBlock::RareData::m_switchJumpTables + VectorBufferOffset[t2], t2
+    addp t3, t2
+    btqnz t1, tagMask, .opSwitchCharFallThrough
+    bbneq JSCell::m_type[t1], StringType, .opSwitchCharFallThrough
+    bineq JSString::m_length[t1], 1, .opSwitchCharFallThrough
+    loadp JSString::m_value[t1], t0
+    btpz  t0, .opSwitchOnRope
+    loadp StringImpl::m_data8[t0], t1
+    btinz StringImpl::m_hashAndFlags[t0], HashFlags8BitBuffer, .opSwitchChar8Bit
+    loadh [t1], t0
+    jmp .opSwitchCharReady
+.opSwitchChar8Bit:
+    loadb [t1], t0
+.opSwitchCharReady:
+    subi SimpleJumpTable::min[t2], t0
+    biaeq t0, SimpleJumpTable::branchOffsets + VectorSizeOffset[t2], .opSwitchCharFallThrough
+    loadp SimpleJumpTable::branchOffsets + VectorBufferOffset[t2], t2
+    loadis [t2, t0, 4], t1
+    btiz t1, .opSwitchCharFallThrough
+    dispatch(t1)
+
+.opSwitchCharFallThrough:
+    dispatchIntIndirect(2)
+
+.opSwitchOnRope:
+    callOpcodeSlowPath(_llint_slow_path_switch_char)
+    dispatch(0)
+
+
+macro arrayProfileForCall()
+    loadisFromInstruction(4, t3)
+    negp t3
+    loadq ThisArgumentOffset[cfr, t3, 8], t0
+    btqnz t0, tagMask, .done
+    loadpFromInstruction((CallOpCodeSize - 2), t1)
+    loadi JSCell::m_structureID[t0], t3
+    storei t3, ArrayProfile::m_lastSeenStructureID[t1]
+.done:
+end
+
+macro doCall(slowPath, prepareCall)
+    loadisFromInstruction(2, t0)
+    loadpFromInstruction(5, t1)
+    loadp LLIntCallLinkInfo::callee[t1], t2
+    loadConstantOrVariable(t0, t3)
+    bqneq t3, t2, .opCallSlow
+    loadisFromInstruction(4, t3)
+    lshifti 3, t3
+    negp t3
+    addp cfr, t3
+    storeq t2, Callee[t3]
+    loadisFromInstruction(3, t2)
+    storei PC, ArgumentCount + TagOffset[cfr]
+    storei t2, ArgumentCount + PayloadOffset[t3]
+    move t3, sp
+    prepareCall(LLIntCallLinkInfo::machineCodeTarget[t1], t2, t3, t4)
+    callTargetFunction(LLIntCallLinkInfo::machineCodeTarget[t1])
+
+.opCallSlow:
+    slowPathForCall(slowPath, prepareCall)
+end
+
+_llint_op_ret:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadisFromInstruction(1, t2)
+    loadConstantOrVariable(t2, r0)
+    doReturn()
+
+
+_llint_op_to_primitive:
+    traceExecution()
+    loadisFromInstruction(2, t2)
+    loadisFromInstruction(1, t3)
+    loadConstantOrVariable(t2, t0)
+    btqnz t0, tagMask, .opToPrimitiveIsImm
+    bbaeq JSCell::m_type[t0], ObjectType, .opToPrimitiveSlowCase
+.opToPrimitiveIsImm:
+    storeq t0, [cfr, t3, 8]
+    dispatch(3)
+
+.opToPrimitiveSlowCase:
+    callOpcodeSlowPath(_slow_path_to_primitive)
+    dispatch(3)
+
+
+_llint_op_catch:
+    # This is where we end up from the JIT's throw trampoline (because the
+    # machine code return address will be set to _llint_op_catch), and from
+    # the interpreter's throw trampoline (see _llint_throw_trampoline).
+    # The throwing code must have known that we were throwing to the interpreter,
+    # and have set VM::targetInterpreterPCForThrow.
+    loadp Callee[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+    restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer(t3, t0)
+    loadp VM::callFrameForCatch[t3], cfr
+    storep 0, VM::callFrameForCatch[t3]
+    restoreStackPointerAfterCall()
+
+    loadp CodeBlock[cfr], PB
+    loadp CodeBlock::m_instructions[PB], PB
+    loadp VM::targetInterpreterPCForThrow[t3], PC
+    subp PB, PC
+    rshiftp 3, PC
+
+    callOpcodeSlowPath(_llint_slow_path_check_if_exception_is_uncatchable_and_notify_profiler)
+    bpeq r1, 0, .isCatchableException
+    jmp _llint_throw_from_slow_path_trampoline
+
+.isCatchableException:
+    loadp Callee[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+
+    loadq VM::m_exception[t3], t0
+    storeq 0, VM::m_exception[t3]
+    loadisFromInstruction(1, t2)
+    storeq t0, [cfr, t2, 8]
+
+    loadq Exception::m_value[t0], t3
+    loadisFromInstruction(2, t2)
+    storeq t3, [cfr, t2, 8]
+
+    traceExecution()
+    dispatch(3)
+
+
+_llint_op_end:
+    traceExecution()
+    checkSwitchToJITForEpilogue()
+    loadisFromInstruction(1, t0)
+    assertNotConstant(t0)
+    loadq [cfr, t0, 8], r0
+    doReturn()
+
+
+_llint_throw_from_slow_path_trampoline:
+    loadp Callee[cfr], t1
+    andp MarkedBlockMask, t1
+    loadp MarkedBlock::m_vm[t1], t1
+    copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(t1, t2)
+
+    callSlowPath(_llint_slow_path_handle_exception)
+
+    # When throwing from the interpreter (i.e. throwing from LLIntSlowPaths), so
+    # the throw target is not necessarily interpreted code, we come to here.
+    # This essentially emulates the JIT's throwing protocol.
+    loadp Callee[cfr], t1
+    andp MarkedBlockMask, t1
+    loadp MarkedBlock::m_vm[t1], t1
+    jmp VM::targetMachinePCForThrow[t1]
+
+
+_llint_throw_during_call_trampoline:
+    preserveReturnAddressAfterCall(t2)
+    jmp _llint_throw_from_slow_path_trampoline
+
+
+macro nativeCallTrampoline(executableOffsetToFunction)
+
+    functionPrologue()
+    storep 0, CodeBlock[cfr]
+    loadp Callee[cfr], t0
+    andp MarkedBlockMask, t0, t1
+    loadp MarkedBlock::m_vm[t1], t1
+    storep cfr, VM::topCallFrame[t1]
+    if ARM64 or C_LOOP
+        storep lr, ReturnPC[cfr]
+    end
+    move cfr, a0
+    loadp Callee[cfr], t1
+    loadp JSFunction::m_executable[t1], t1
+    checkStackPointerAlignment(t3, 0xdead0001)
+    if C_LOOP
+        cloopCallNative executableOffsetToFunction[t1]
+    else
+        if X86_64_WIN
+            subp 32, sp
+        end
+        call executableOffsetToFunction[t1]
+        if X86_64_WIN
+            addp 32, sp
+        end
+    end
+
+    loadp Callee[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_vm[t3], t3
+
+    btqnz VM::m_exception[t3], .handleException
+
+    functionEpilogue()
+    ret
+
+.handleException:
+    storep cfr, VM::topCallFrame[t3]
+    jmp _llint_throw_from_slow_path_trampoline
+end
+
+macro getConstantScope(dst)
+    loadpFromInstruction(6, t0)
+    loadisFromInstruction(dst, t1)
+    storeq t0, [cfr, t1, 8]
+end
+
+macro varInjectionCheck(slowPath)
+    loadp CodeBlock[cfr], t0
+    loadp CodeBlock::m_globalObject[t0], t0
+    loadp JSGlobalObject::m_varInjectionWatchpoint[t0], t0
+    bbeq WatchpointSet::m_state[t0], IsInvalidated, slowPath
+end
+
+macro resolveScope()
+    loadisFromInstruction(5, t2)
+    loadisFromInstruction(2, t0)
+    loadp [cfr, t0, 8], t0
+    btiz t2, .resolveScopeLoopEnd
+
+.resolveScopeLoop:
+    loadp JSScope::m_next[t0], t0
+    subi 1, t2
+    btinz t2, .resolveScopeLoop
+
+.resolveScopeLoopEnd:
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+end
+
+
+_llint_op_resolve_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+
+#rGlobalProperty:
+    bineq t0, GlobalProperty, .rGlobalVar
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalVar:
+    bineq t0, GlobalVar, .rGlobalLexicalVar
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalLexicalVar:
+    bineq t0, GlobalLexicalVar, .rClosureVar
+    getConstantScope(1)
+    dispatch(7)
+
+.rClosureVar:
+    bineq t0, ClosureVar, .rModuleVar
+    resolveScope()
+    dispatch(7)
+
+.rModuleVar:
+    bineq t0, ModuleVar, .rGlobalPropertyWithVarInjectionChecks
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .rGlobalVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .rGlobalLexicalVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getConstantScope(1)
+    dispatch(7)
+
+.rGlobalLexicalVarWithVarInjectionChecks:
+    bineq t0, GlobalLexicalVarWithVarInjectionChecks, .rClosureVarWithVarInjectionChecks
+    varInjectionCheck(.rDynamic)
+    getConstantScope(1)
+    dispatch(7)
+
+.rClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .rDynamic
+    varInjectionCheck(.rDynamic)
+    resolveScope()
+    dispatch(7)
+
+.rDynamic:
+    callOpcodeSlowPath(_slow_path_resolve_scope)
+    dispatch(7)
+
+
+macro loadWithStructureCheck(operand, slowPath)
+    loadisFromInstruction(operand, t0)
+    loadq [cfr, t0, 8], t0
+    loadStructureWithScratch(t0, t2, t1)
+    loadpFromInstruction(5, t1)
+    bpneq t2, t1, slowPath
+end
+
+macro getProperty()
+    loadisFromInstruction(6, t1)
+    loadPropertyAtVariableOffset(t1, t0, t2)
+    valueProfile(t2, 7, t0)
+    loadisFromInstruction(1, t0)
+    storeq t2, [cfr, t0, 8]
+end
+
+macro getGlobalVar(tdzCheckIfNecessary)
+    loadpFromInstruction(6, t0)
+    loadq [t0], t0
+    tdzCheckIfNecessary(t0)
+    valueProfile(t0, 7, t1)
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+end
+
+macro getClosureVar()
+    loadisFromInstruction(6, t1)
+    loadq JSEnvironmentRecord_variables[t0, t1, 8], t0
+    valueProfile(t0, 7, t1)
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+end
+
+_llint_op_get_from_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+    andi ResolveTypeMask, t0
+
+#gGlobalProperty:
+    bineq t0, GlobalProperty, .gGlobalVar
+    loadWithStructureCheck(2, .gDynamic)
+    getProperty()
+    dispatch(8)
+
+.gGlobalVar:
+    bineq t0, GlobalVar, .gGlobalLexicalVar
+    getGlobalVar(macro(v) end)
+    dispatch(8)
+
+.gGlobalLexicalVar:
+    bineq t0, GlobalLexicalVar, .gClosureVar
+    getGlobalVar(
+        macro (value)
+            bqeq value, ValueEmpty, .gDynamic
+        end)
+    dispatch(8)
+
+.gClosureVar:
+    bineq t0, ClosureVar, .gGlobalPropertyWithVarInjectionChecks
+    loadVariable(2, t0)
+    getClosureVar()
+    dispatch(8)
+
+.gGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
+    loadWithStructureCheck(2, .gDynamic)
+    getProperty()
+    dispatch(8)
+
+.gGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .gGlobalLexicalVarWithVarInjectionChecks
+    varInjectionCheck(.gDynamic)
+    getGlobalVar(macro(v) end)
+    dispatch(8)
+
+.gGlobalLexicalVarWithVarInjectionChecks:
+    bineq t0, GlobalLexicalVarWithVarInjectionChecks, .gClosureVarWithVarInjectionChecks
+    varInjectionCheck(.gDynamic)
+    getGlobalVar(
+        macro (value)
+            bqeq value, ValueEmpty, .gDynamic
+        end)
+    dispatch(8)
+
+.gClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .gDynamic
+    varInjectionCheck(.gDynamic)
+    loadVariable(2, t0)
+    getClosureVar()
+    dispatch(8)
+
+.gDynamic:
+    callOpcodeSlowPath(_llint_slow_path_get_from_scope)
+    dispatch(8)
+
+
+macro putProperty()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2)
+    loadisFromInstruction(6, t1)
+    storePropertyAtVariableOffset(t1, t0, t2)
+end
+
+macro putGlobalVariable()
+    loadisFromInstruction(3, t0)
+    loadConstantOrVariable(t0, t1)
+    loadpFromInstruction(5, t2)
+    loadpFromInstruction(6, t0)
+    notifyWrite(t2, .pDynamic)
+    storeq t1, [t0]
+end
+
+macro putClosureVar()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2)
+    loadisFromInstruction(6, t1)
+    storeq t2, JSEnvironmentRecord_variables[t0, t1, 8]
+end
+
+macro putLocalClosureVar()
+    loadisFromInstruction(3, t1)
+    loadConstantOrVariable(t1, t2)
+    loadpFromInstruction(5, t3)
+    btpz t3, .noVariableWatchpointSet
+    notifyWrite(t3, .pDynamic)
+.noVariableWatchpointSet:
+    loadisFromInstruction(6, t1)
+    storeq t2, JSEnvironmentRecord_variables[t0, t1, 8]
+end
+
+macro checkTDZInGlobalPutToScopeIfNecessary()
+    loadisFromInstruction(4, t0)
+    andi InitializationModeMask, t0
+    rshifti InitializationModeShift, t0
+    bineq t0, NotInitialization, .noNeedForTDZCheck
+    loadpFromInstruction(6, t0)
+    loadq [t0], t0
+    bqeq t0, ValueEmpty, .pDynamic
+.noNeedForTDZCheck:
+end
+
+
+_llint_op_put_to_scope:
+    traceExecution()
+    loadisFromInstruction(4, t0)
+    andi ResolveTypeMask, t0
+
+#pLocalClosureVar:
+    bineq t0, LocalClosureVar, .pGlobalProperty
+    loadVariable(1, t0)
+    putLocalClosureVar()
+    writeBarrierOnOperands(1, 3)
+    dispatch(7)
+
+.pGlobalProperty:
+    bineq t0, GlobalProperty, .pGlobalVar
+    loadWithStructureCheck(1, .pDynamic)
+    putProperty()
+    writeBarrierOnOperands(1, 3)
+    dispatch(7)
+
+.pGlobalVar:
+    bineq t0, GlobalVar, .pGlobalLexicalVar
+    writeBarrierOnGlobalObject(3)
+    putGlobalVariable()
+    dispatch(7)
+
+.pGlobalLexicalVar:
+    bineq t0, GlobalLexicalVar, .pClosureVar
+    writeBarrierOnGlobalLexicalEnvironment(3)
+    checkTDZInGlobalPutToScopeIfNecessary()
+    putGlobalVariable()
+    dispatch(7)
+
+.pClosureVar:
+    bineq t0, ClosureVar, .pGlobalPropertyWithVarInjectionChecks
+    loadVariable(1, t0)
+    putClosureVar()
+    writeBarrierOnOperands(1, 3)
+    dispatch(7)
+
+.pGlobalPropertyWithVarInjectionChecks:
+    bineq t0, GlobalPropertyWithVarInjectionChecks, .pGlobalVarWithVarInjectionChecks
+    loadWithStructureCheck(1, .pDynamic)
+    putProperty()
+    writeBarrierOnOperands(1, 3)
+    dispatch(7)
+
+.pGlobalVarWithVarInjectionChecks:
+    bineq t0, GlobalVarWithVarInjectionChecks, .pGlobalLexicalVarWithVarInjectionChecks
+    writeBarrierOnGlobalObject(3)
+    varInjectionCheck(.pDynamic)
+    putGlobalVariable()
+    dispatch(7)
+
+.pGlobalLexicalVarWithVarInjectionChecks:
+    bineq t0, GlobalLexicalVarWithVarInjectionChecks, .pClosureVarWithVarInjectionChecks
+    writeBarrierOnGlobalLexicalEnvironment(3)
+    varInjectionCheck(.pDynamic)
+    checkTDZInGlobalPutToScopeIfNecessary()
+    putGlobalVariable()
+    dispatch(7)
+
+.pClosureVarWithVarInjectionChecks:
+    bineq t0, ClosureVarWithVarInjectionChecks, .pModuleVar
+    varInjectionCheck(.pDynamic)
+    loadVariable(1, t0)
+    putClosureVar()
+    writeBarrierOnOperands(1, 3)
+    dispatch(7)
+
+.pModuleVar:
+    bineq t0, ModuleVar, .pDynamic
+    callOpcodeSlowPath(_slow_path_throw_strict_mode_readonly_property_write_error)
+    dispatch(7)
+
+.pDynamic:
+    callOpcodeSlowPath(_llint_slow_path_put_to_scope)
+    dispatch(7)
+
+
+_llint_op_get_from_arguments:
+    traceExecution()
+    loadVariable(2, t0)
+    loadi 24[PB, PC, 8], t1
+    loadq DirectArguments_storage[t0, t1, 8], t0
+    valueProfile(t0, 4, t1)
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+    dispatch(5)
+
+
+_llint_op_put_to_arguments:
+    traceExecution()
+    loadVariable(1, t0)
+    loadi 16[PB, PC, 8], t1
+    loadisFromInstruction(3, t3)
+    loadConstantOrVariable(t3, t2)
+    storeq t2, DirectArguments_storage[t0, t1, 8]
+    writeBarrierOnOperands(1, 3)
+    dispatch(4)
+
+
+_llint_op_get_parent_scope:
+    traceExecution()
+    loadVariable(2, t0)
+    loadp JSScope::m_next[t0], t0
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+    dispatch(3)
+
+
+_llint_op_profile_type:
+    traceExecution()
+    loadp CodeBlock[cfr], t1
+    loadp CodeBlock::m_vm[t1], t1
+    # t1 is holding the pointer to the typeProfilerLog.
+    loadp VM::m_typeProfilerLog[t1], t1
+    # t2 is holding the pointer to the current log entry.
+    loadp TypeProfilerLog::m_currentLogEntryPtr[t1], t2
+
+    # t0 is holding the JSValue argument.
+    loadisFromInstruction(1, t3)
+    loadConstantOrVariable(t3, t0)
+
+    bqeq t0, ValueEmpty, .opProfileTypeDone
+    # Store the JSValue onto the log entry.
+    storeq t0, TypeProfilerLog::LogEntry::value[t2]
+    
+    # Store the TypeLocation onto the log entry.
+    loadpFromInstruction(2, t3)
+    storep t3, TypeProfilerLog::LogEntry::location[t2]
+
+    btqz t0, tagMask, .opProfileTypeIsCell
+    storei 0, TypeProfilerLog::LogEntry::structureID[t2]
+    jmp .opProfileTypeSkipIsCell
+.opProfileTypeIsCell:
+    loadi JSCell::m_structureID[t0], t3
+    storei t3, TypeProfilerLog::LogEntry::structureID[t2]
+.opProfileTypeSkipIsCell:
+    
+    # Increment the current log entry.
+    addp sizeof TypeProfilerLog::LogEntry, t2
+    storep t2, TypeProfilerLog::m_currentLogEntryPtr[t1]
+
+    loadp TypeProfilerLog::m_logEndPtr[t1], t1
+    bpneq t2, t1, .opProfileTypeDone
+    callOpcodeSlowPath(_slow_path_profile_type_clear_log)
+
+.opProfileTypeDone:
+    dispatch(6)
+
+_llint_op_profile_control_flow:
+    traceExecution()
+    loadpFromInstruction(1, t0)
+    addq 1, BasicBlockLocation::m_executionCount[t0]
+    dispatch(2)
+
+
+_llint_op_get_rest_length:
+    traceExecution()
+    loadi PayloadOffset + ArgumentCount[cfr], t0
+    subi 1, t0
+    loadisFromInstruction(2, t1)
+    bilteq t0, t1, .storeZero
+    subi t1, t0
+    jmp .boxUp
+.storeZero:
+    move 0, t0
+.boxUp:
+    orq tagTypeNumber, t0
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+    dispatch(3)
+
+
+_llint_op_log_shadow_chicken_prologue:
+    traceExecution()
+    acquireShadowChickenPacket(.opLogShadowChickenPrologueSlow)
+    storep cfr, ShadowChicken::Packet::frame[t0]
+    loadp CallerFrame[cfr], t1
+    storep t1, ShadowChicken::Packet::callerFrame[t0]
+    loadp Callee[cfr], t1
+    storep t1, ShadowChicken::Packet::callee[t0]
+    loadVariable(1, t1)
+    storep t1, ShadowChicken::Packet::scope[t0]
+    dispatch(2)
+.opLogShadowChickenPrologueSlow:
+    callOpcodeSlowPath(_llint_slow_path_log_shadow_chicken_prologue)
+    dispatch(2)
+
+
+_llint_op_log_shadow_chicken_tail:
+    traceExecution()
+    acquireShadowChickenPacket(.opLogShadowChickenTailSlow)
+    storep cfr, ShadowChicken::Packet::frame[t0]
+    storep ShadowChickenTailMarker, ShadowChicken::Packet::callee[t0]
+    loadVariable(1, t1)
+    storep t1, ShadowChicken::Packet::thisValue[t0]
+    loadVariable(2, t1)
+    storep t1, ShadowChicken::Packet::scope[t0]
+    loadp CodeBlock[cfr], t1
+    storep t1, ShadowChicken::Packet::codeBlock[t0]
+    storei PC, ShadowChicken::Packet::callSiteIndex[t0]
+    dispatch(3)
+.opLogShadowChickenTailSlow:
+    callOpcodeSlowPath(_llint_slow_path_log_shadow_chicken_tail)
+    dispatch(3)
diff --git a/offlineasm/arm.rb b/offlineasm/arm.rb
new file mode 100644
index 0000000..c8064a5
--- /dev/null
+++ b/offlineasm/arm.rb
@@ -0,0 +1,635 @@
+# Copyright (C) 2011, 2012, 2015-2016 Apple Inc. All rights reserved.
+# Copyright (C) 2013 University of Szeged. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "ast"
+require "opt"
+require "risc"
+
+# GPR conventions, to match the baseline JIT
+#
+#  x0 => t0, a0, r0
+#  x1 => t1, a1, r1
+#  x2 => t2, a2, r2
+#  x3 => t3, a3, r3
+#  x6 =>            (callee-save scratch)
+#  x7 => cfr        (ARMv7 only)
+#  x8 => t4         (callee-save)
+#  x9 => t5         (callee-save)
+# x10 =>            (callee-save scratch)
+# x11 => cfr        (ARM and ARMv7 traditional)
+# x12 =>            (callee-save scratch)
+#  lr => lr
+#  sp => sp
+#  pc => pc
+#
+# FPR conventions, to match the baseline JIT
+#
+# d0 => ft0, fa0, fr
+# d1 => ft1, fa1
+# d2 => ft2
+# d3 => ft3
+# d4 => ft4
+# d5 => ft5
+# d6 =>              (scratch)
+# d7 =>              (scratch)
+
+def isARMv7
+    case $activeBackend
+    when "ARMv7"
+        true
+    when "ARMv7_TRADITIONAL", "ARM"
+        false
+    else
+        raise "bad value for $activeBackend: #{$activeBackend}"
+    end
+end
+
+def isARMv7Traditional
+    case $activeBackend
+    when "ARMv7_TRADITIONAL"
+        true
+    when "ARMv7", "ARM"
+        false
+    else
+        raise "bad value for $activeBackend: #{$activeBackend}"
+    end
+end
+
+class Node
+    def armSingle
+        doubleOperand = armOperand
+        raise "Bogus register name #{doubleOperand}" unless doubleOperand =~ /^d/
+        "s" + ($~.post_match.to_i * 2).to_s
+    end
+end
+
+class SpecialRegister
+    def armOperand
+        @name
+    end
+end
+
+ARM_EXTRA_GPRS = [SpecialRegister.new("r6"), SpecialRegister.new("r10"), SpecialRegister.new("r12")]
+ARM_EXTRA_FPRS = [SpecialRegister.new("d7")]
+ARM_SCRATCH_FPR = SpecialRegister.new("d6")
+
+def armMoveImmediate(value, register)
+    # Currently we only handle the simple cases, and fall back to mov/movt for the complex ones.
+    if value.is_a? String
+      $asm.puts "mov #{register.armOperand}, (#{value})"
+    elsif value >= 0 && value < 256
+        $asm.puts "mov #{register.armOperand}, \##{value}"
+    elsif (~value) >= 0 && (~value) < 256
+        $asm.puts "mvn #{register.armOperand}, \##{~value}"
+    elsif isARMv7 or isARMv7Traditional
+        $asm.puts "movw #{register.armOperand}, \##{value & 0xffff}"
+        if (value & 0xffff0000) != 0
+            $asm.puts "movt #{register.armOperand}, \##{(value >> 16) & 0xffff}"
+        end
+    else
+        $asm.puts "ldr #{register.armOperand}, =#{value}"
+    end
+end
+
+class RegisterID
+    def armOperand
+        case name
+        when "t0", "a0", "r0"
+            "r0"
+        when "t1", "a1", "r1"
+            "r1"
+        when "t2", "a2"
+            "r2"
+        when "a3"
+            "r3"
+        when "t3"
+            "r4"
+        when "t4"
+            "r8"
+        when "t5"
+            "r9"
+        when "cfr"
+            isARMv7 ?  "r7" : "r11"
+        when "lr"
+            "lr"
+        when "sp"
+            "sp"
+        when "pc"
+            "pc"
+        else
+            raise "Bad register #{name} for ARM at #{codeOriginString}"
+        end
+    end
+end
+
+class FPRegisterID
+    def armOperand
+        case name
+        when "ft0", "fr", "fa0"
+            "d0"
+        when "ft1", "fa1"
+            "d1"
+        when "ft2"
+            "d2"
+        when "ft3"
+            "d3"
+        when "ft4"
+            "d4"
+        when "ft5"
+            "d5"
+        else
+            raise "Bad register #{name} for ARM at #{codeOriginString}"
+        end
+    end
+end
+
+class Immediate
+    def armOperand
+        raise "Invalid immediate #{value} at #{codeOriginString}" if value < 0 or value > 255
+        "\##{value}"
+    end
+end
+
+class Address
+    def armOperand
+        raise "Bad offset at #{codeOriginString}" if offset.value < -0xff or offset.value > 0xfff
+        "[#{base.armOperand}, \##{offset.value}]"
+    end
+end
+
+class BaseIndex
+    def armOperand
+        raise "Bad offset at #{codeOriginString}" if offset.value != 0
+        "[#{base.armOperand}, #{index.armOperand}, lsl \##{scaleShift}]"
+    end
+end
+
+class AbsoluteAddress
+    def armOperand
+        raise "Unconverted absolute address at #{codeOriginString}"
+    end
+end
+
+#
+# Lea support.
+#
+
+class Address
+    def armEmitLea(destination)
+        if destination == base
+            $asm.puts "adds #{destination.armOperand}, \##{offset.value}"
+        else
+            $asm.puts "adds #{destination.armOperand}, #{base.armOperand}, \##{offset.value}"
+        end
+    end
+end
+
+class BaseIndex
+    def armEmitLea(destination)
+        raise "Malformed BaseIndex, offset should be zero at #{codeOriginString}" unless offset.value == 0
+        $asm.puts "add #{destination.armOperand}, #{base.armOperand}, #{index.armOperand}, lsl \##{scaleShift}"
+    end
+end
+
+# FIXME: we could support AbsoluteAddress for lea, but we don't.
+
+#
+# Actual lowering code follows.
+#
+
+class Sequence
+    def getModifiedListARM
+        raise unless $activeBackend == "ARM"
+        getModifiedListARMCommon
+    end
+
+    def getModifiedListARMv7
+        raise unless $activeBackend == "ARMv7"
+        getModifiedListARMCommon
+    end
+
+    def getModifiedListARMv7_TRADITIONAL
+        raise unless $activeBackend == "ARMv7_TRADITIONAL"
+        getModifiedListARMCommon
+    end
+
+    def getModifiedListARMCommon
+        result = @list
+        result = riscLowerSimpleBranchOps(result)
+        result = riscLowerHardBranchOps(result)
+        result = riscLowerShiftOps(result)
+        result = riscLowerMalformedAddresses(result) {
+            | node, address |
+            if address.is_a? BaseIndex
+                address.offset.value == 0
+            elsif address.is_a? Address
+                (-0xff..0xfff).include? address.offset.value
+            else
+                false
+            end
+        }
+        result = riscLowerMalformedAddressesDouble(result)
+        result = riscLowerMisplacedImmediates(result, ["storeb", "storei", "storep", "storeq"])
+        result = riscLowerMalformedImmediates(result, 0..0xff)
+        result = riscLowerMisplacedAddresses(result)
+        result = riscLowerRegisterReuse(result)
+        result = assignRegistersToTemporaries(result, :gpr, ARM_EXTRA_GPRS)
+        result = assignRegistersToTemporaries(result, :fpr, ARM_EXTRA_FPRS)
+        return result
+    end
+end
+
+def armOperands(operands)
+    operands.map{|v| v.armOperand}.join(", ")
+end
+
+def armFlippedOperands(operands)
+    armOperands([operands[-1]] + operands[0..-2])
+end
+
+def emitArmCompact(opcode2, opcode3, operands)
+    if operands.size == 3
+        $asm.puts "#{opcode3} #{armFlippedOperands(operands)}"
+    else
+        raise unless operands.size == 2
+        raise unless operands[1].register?
+        if operands[0].immediate?
+            $asm.puts "#{opcode3} #{operands[1].armOperand}, #{operands[1].armOperand}, #{operands[0].armOperand}"
+        else
+            $asm.puts "#{opcode2} #{armFlippedOperands(operands)}"
+        end
+    end
+end
+
+def emitArm(opcode, operands)
+    if operands.size == 3
+        $asm.puts "#{opcode} #{armFlippedOperands(operands)}"
+    else
+        raise unless operands.size == 2
+        $asm.puts "#{opcode} #{operands[1].armOperand}, #{operands[1].armOperand}, #{operands[0].armOperand}"
+    end
+end
+
+def emitArmDoubleBranch(branchOpcode, operands)
+    $asm.puts "vcmpe.f64 #{armOperands(operands[0..1])}"
+    $asm.puts "vmrs apsr_nzcv, fpscr"
+    $asm.puts "#{branchOpcode} #{operands[2].asmLabel}"
+end
+
+def emitArmTest(operands)
+    value = operands[0]
+    case operands.size
+    when 2
+        mask = Immediate.new(codeOrigin, -1)
+    when 3
+        mask = operands[1]
+    else
+        raise "Expected 2 or 3 operands but got #{operands.size} at #{codeOriginString}"
+    end
+    
+    if mask.immediate? and mask.value == -1
+        $asm.puts "tst #{value.armOperand}, #{value.armOperand}"
+    else
+        $asm.puts "tst #{value.armOperand}, #{mask.armOperand}"
+    end
+end
+
+def emitArmCompare(operands, code)
+    $asm.puts "movs #{operands[2].armOperand}, \#0"
+    $asm.puts "cmp #{operands[0].armOperand}, #{operands[1].armOperand}"
+    $asm.puts "it #{code}"
+    $asm.puts "mov#{code} #{operands[2].armOperand}, \#1"
+end
+
+def emitArmTestSet(operands, code)
+    $asm.puts "movs #{operands[-1].armOperand}, \#0"
+    emitArmTest(operands)
+    $asm.puts "it #{code}"
+    $asm.puts "mov#{code} #{operands[-1].armOperand}, \#1"
+end
+
+class Instruction
+    def lowerARM
+        raise unless $activeBackend == "ARM"
+        lowerARMCommon
+    end
+
+    def lowerARMv7
+        raise unless $activeBackend == "ARMv7"
+        lowerARMCommon
+    end
+
+    def lowerARMv7_TRADITIONAL
+        raise unless $activeBackend == "ARMv7_TRADITIONAL"
+        lowerARMCommon
+    end
+
+    def lowerARMCommon
+        $asm.codeOrigin codeOriginString if $enableCodeOriginComments
+        $asm.annotation annotation if $enableInstrAnnotations
+        $asm.debugAnnotation codeOrigin.debugDirective if $enableDebugAnnotations
+
+        case opcode
+        when "addi", "addp", "addis", "addps"
+            if opcode == "addis" or opcode == "addps"
+                suffix = "s"
+            else
+                suffix = ""
+            end
+            if operands.size == 3 and operands[0].immediate?
+                raise unless operands[1].register?
+                raise unless operands[2].register?
+                if operands[0].value == 0 and suffix.empty?
+                    unless operands[1] == operands[2]
+                        $asm.puts "mov #{operands[2].armOperand}, #{operands[1].armOperand}"
+                    end
+                else
+                    $asm.puts "adds #{operands[2].armOperand}, #{operands[1].armOperand}, #{operands[0].armOperand}"
+                end
+            elsif operands.size == 3 and operands[0].register?
+                raise unless operands[1].register?
+                raise unless operands[2].register?
+                $asm.puts "adds #{armFlippedOperands(operands)}"
+            else
+                if operands[0].immediate?
+                    unless Immediate.new(nil, 0) == operands[0]
+                        $asm.puts "adds #{armFlippedOperands(operands)}"
+                    end
+                else
+                    $asm.puts "add#{suffix} #{armFlippedOperands(operands)}"
+                end
+            end
+        when "andi", "andp"
+            emitArmCompact("ands", "and", operands)
+        when "ori", "orp"
+            emitArmCompact("orrs", "orr", operands)
+        when "oris"
+            emitArmCompact("orrs", "orrs", operands)
+        when "xori", "xorp"
+            emitArmCompact("eors", "eor", operands)
+        when "lshifti", "lshiftp"
+            emitArmCompact("lsls", "lsls", operands)
+        when "rshifti", "rshiftp"
+            emitArmCompact("asrs", "asrs", operands)
+        when "urshifti", "urshiftp"
+            emitArmCompact("lsrs", "lsrs", operands)
+        when "muli", "mulp"
+            emitArm("mul", operands)
+        when "subi", "subp", "subis"
+            emitArmCompact("subs", "subs", operands)
+        when "negi", "negp"
+            $asm.puts "rsbs #{operands[0].armOperand}, #{operands[0].armOperand}, \#0"
+        when "noti"
+            $asm.puts "mvns #{operands[0].armOperand}, #{operands[0].armOperand}"
+        when "loadi", "loadis", "loadp"
+            $asm.puts "ldr #{armFlippedOperands(operands)}"
+        when "storei", "storep"
+            $asm.puts "str #{armOperands(operands)}"
+        when "loadb"
+            $asm.puts "ldrb #{armFlippedOperands(operands)}"
+        when "loadbs"
+            $asm.puts "ldrsb.w #{armFlippedOperands(operands)}"
+        when "storeb"
+            $asm.puts "strb #{armOperands(operands)}"
+        when "loadh"
+            $asm.puts "ldrh #{armFlippedOperands(operands)}"
+        when "loadhs"
+            $asm.puts "ldrsh.w #{armFlippedOperands(operands)}"
+        when "storeh"
+            $asm.puts "strh #{armOperands(operands)}"
+        when "loadd"
+            $asm.puts "vldr.64 #{armFlippedOperands(operands)}"
+        when "stored"
+            $asm.puts "vstr.64 #{armOperands(operands)}"
+        when "addd"
+            emitArm("vadd.f64", operands)
+        when "divd"
+            emitArm("vdiv.f64", operands)
+        when "subd"
+            emitArm("vsub.f64", operands)
+        when "muld"
+            emitArm("vmul.f64", operands)
+        when "sqrtd"
+            $asm.puts "vsqrt.f64 #{armFlippedOperands(operands)}"
+        when "ci2d"
+            $asm.puts "vmov #{operands[1].armSingle}, #{operands[0].armOperand}"
+            $asm.puts "vcvt.f64.s32 #{operands[1].armOperand}, #{operands[1].armSingle}"
+        when "bdeq"
+            emitArmDoubleBranch("beq", operands)
+        when "bdneq"
+            $asm.puts "vcmpe.f64 #{armOperands(operands[0..1])}"
+            $asm.puts "vmrs apsr_nzcv, fpscr"
+            isUnordered = LocalLabel.unique("bdneq")
+            $asm.puts "bvs #{LocalLabelReference.new(codeOrigin, isUnordered).asmLabel}"
+            $asm.puts "bne #{operands[2].asmLabel}"
+            isUnordered.lower("ARM")
+        when "bdgt"
+            emitArmDoubleBranch("bgt", operands)
+        when "bdgteq"
+            emitArmDoubleBranch("bge", operands)
+        when "bdlt"
+            emitArmDoubleBranch("bmi", operands)
+        when "bdlteq"
+            emitArmDoubleBranch("bls", operands)
+        when "bdequn"
+            $asm.puts "vcmpe.f64 #{armOperands(operands[0..1])}"
+            $asm.puts "vmrs apsr_nzcv, fpscr"
+            $asm.puts "bvs #{operands[2].asmLabel}"
+            $asm.puts "beq #{operands[2].asmLabel}"
+        when "bdnequn"
+            emitArmDoubleBranch("bne", operands)
+        when "bdgtun"
+            emitArmDoubleBranch("bhi", operands)
+        when "bdgtequn"
+            emitArmDoubleBranch("bpl", operands)
+        when "bdltun"
+            emitArmDoubleBranch("blt", operands)
+        when "bdltequn"
+            emitArmDoubleBranch("ble", operands)
+        when "btd2i"
+            # FIXME: may be a good idea to just get rid of this instruction, since the interpreter
+            # currently does not use it.
+            raise "ARM does not support this opcode yet, #{codeOrigin}"
+        when "td2i"
+            $asm.puts "vcvt.s32.f64 #{ARM_SCRATCH_FPR.armSingle}, #{operands[0].armOperand}"
+            $asm.puts "vmov #{operands[1].armOperand}, #{ARM_SCRATCH_FPR.armSingle}"
+        when "bcd2i"
+            $asm.puts "vcvt.s32.f64 #{ARM_SCRATCH_FPR.armSingle}, #{operands[0].armOperand}"
+            $asm.puts "vmov #{operands[1].armOperand}, #{ARM_SCRATCH_FPR.armSingle}"
+            $asm.puts "vcvt.f64.s32 #{ARM_SCRATCH_FPR.armOperand}, #{ARM_SCRATCH_FPR.armSingle}"
+            emitArmDoubleBranch("bne", [ARM_SCRATCH_FPR, operands[0], operands[2]])
+            $asm.puts "tst #{operands[1].armOperand}, #{operands[1].armOperand}"
+            $asm.puts "beq #{operands[2].asmLabel}"
+        when "movdz"
+            # FIXME: either support this or remove it.
+            raise "ARM does not support this opcode yet, #{codeOrigin}"
+        when "pop"
+            operands.each {
+                | op |
+                $asm.puts "pop { #{op.armOperand} }"
+            }
+        when "push"
+            operands.each {
+                | op |
+                $asm.puts "push { #{op.armOperand} }"
+            }
+        when "move"
+            if operands[0].immediate?
+                armMoveImmediate(operands[0].value, operands[1])
+            else
+                $asm.puts "mov #{armFlippedOperands(operands)}"
+            end
+        when "mvlbl"
+                $asm.puts "movw #{operands[1].armOperand}, \#:lower16:#{operands[0].value}"
+                $asm.puts "movt #{operands[1].armOperand}, \#:upper16:#{operands[0].value}"
+        when "nop"
+            $asm.puts "nop"
+        when "bieq", "bpeq", "bbeq"
+            if Immediate.new(nil, 0) == operands[0]
+                $asm.puts "tst #{operands[1].armOperand}, #{operands[1].armOperand}"
+            elsif Immediate.new(nil, 0) == operands[1]
+                $asm.puts "tst #{operands[0].armOperand}, #{operands[0].armOperand}"
+            else
+                $asm.puts "cmp #{armOperands(operands[0..1])}"
+            end
+            $asm.puts "beq #{operands[2].asmLabel}"
+        when "bineq", "bpneq", "bbneq"
+            if Immediate.new(nil, 0) == operands[0]
+                $asm.puts "tst #{operands[1].armOperand}, #{operands[1].armOperand}"
+            elsif Immediate.new(nil, 0) == operands[1]
+                $asm.puts "tst #{operands[0].armOperand}, #{operands[0].armOperand}"
+            else
+                $asm.puts "cmp #{armOperands(operands[0..1])}"
+            end
+            $asm.puts "bne #{operands[2].asmLabel}"
+        when "bia", "bpa", "bba"
+            $asm.puts "cmp #{armOperands(operands[0..1])}"
+            $asm.puts "bhi #{operands[2].asmLabel}"
+        when "biaeq", "bpaeq", "bbaeq"
+            $asm.puts "cmp #{armOperands(operands[0..1])}"
+            $asm.puts "bhs #{operands[2].asmLabel}"
+        when "bib", "bpb", "bbb"
+            $asm.puts "cmp #{armOperands(operands[0..1])}"
+            $asm.puts "blo #{operands[2].asmLabel}"
+        when "bibeq", "bpbeq", "bbbeq"
+            $asm.puts "cmp #{armOperands(operands[0..1])}"
+            $asm.puts "bls #{operands[2].asmLabel}"
+        when "bigt", "bpgt", "bbgt"
+            $asm.puts "cmp #{armOperands(operands[0..1])}"
+            $asm.puts "bgt #{operands[2].asmLabel}"
+        when "bigteq", "bpgteq", "bbgteq"
+            $asm.puts "cmp #{armOperands(operands[0..1])}"
+            $asm.puts "bge #{operands[2].asmLabel}"
+        when "bilt", "bplt", "bblt"
+            $asm.puts "cmp #{armOperands(operands[0..1])}"
+            $asm.puts "blt #{operands[2].asmLabel}"
+        when "bilteq", "bplteq", "bblteq"
+            $asm.puts "cmp #{armOperands(operands[0..1])}"
+            $asm.puts "ble #{operands[2].asmLabel}"
+        when "btiz", "btpz", "btbz"
+            emitArmTest(operands)
+            $asm.puts "beq #{operands[-1].asmLabel}"
+        when "btinz", "btpnz", "btbnz"
+            emitArmTest(operands)
+            $asm.puts "bne #{operands[-1].asmLabel}"
+        when "btis", "btps", "btbs"
+            emitArmTest(operands)
+            $asm.puts "bmi #{operands[-1].asmLabel}"
+        when "jmp"
+            if operands[0].label?
+                $asm.puts "b #{operands[0].asmLabel}"
+            else
+                $asm.puts "mov pc, #{operands[0].armOperand}"
+            end
+            if not isARMv7 and not isARMv7Traditional
+                $asm.puts ".ltorg"
+            end
+        when "call"
+            if operands[0].label?
+                $asm.puts "blx #{operands[0].asmLabel}"
+            else
+                $asm.puts "blx #{operands[0].armOperand}"
+            end
+        when "break"
+            $asm.puts "bkpt #0"
+        when "ret"
+            $asm.puts "bx lr"
+        when "cieq", "cpeq", "cbeq"
+            emitArmCompare(operands, "eq")
+        when "cineq", "cpneq", "cbneq"
+            emitArmCompare(operands, "ne")
+        when "cia", "cpa", "cba"
+            emitArmCompare(operands, "hi")
+        when "ciaeq", "cpaeq", "cbaeq"
+            emitArmCompare(operands, "hs")
+        when "cib", "cpb", "cbb"
+            emitArmCompare(operands, "lo")
+        when "cibeq", "cpbeq", "cbbeq"
+            emitArmCompare(operands, "ls")
+        when "cigt", "cpgt", "cbgt"
+            emitArmCompare(operands, "gt")
+        when "cigteq", "cpgteq", "cbgteq"
+            emitArmCompare(operands, "ge")
+        when "cilt", "cplt", "cblt"
+            emitArmCompare(operands, "lt")
+        when "cilteq", "cplteq", "cblteq"
+            emitArmCompare(operands, "le")
+        when "tis", "tbs", "tps"
+            emitArmTestSet(operands, "mi")
+        when "tiz", "tbz", "tpz"
+            emitArmTestSet(operands, "eq")
+        when "tinz", "tbnz", "tpnz"
+            emitArmTestSet(operands, "ne")
+        when "peek"
+            $asm.puts "ldr #{operands[1].armOperand}, [sp, \##{operands[0].value * 4}]"
+        when "poke"
+            $asm.puts "str #{operands[1].armOperand}, [sp, \##{operands[0].value * 4}]"
+        when "fii2d"
+            $asm.puts "vmov #{operands[2].armOperand}, #{operands[0].armOperand}, #{operands[1].armOperand}"
+        when "fd2ii"
+            $asm.puts "vmov #{operands[1].armOperand}, #{operands[2].armOperand}, #{operands[0].armOperand}"
+        when "bo"
+            $asm.puts "bvs #{operands[0].asmLabel}"
+        when "bs"
+            $asm.puts "bmi #{operands[0].asmLabel}"
+        when "bz"
+            $asm.puts "beq #{operands[0].asmLabel}"
+        when "bnz"
+            $asm.puts "bne #{operands[0].asmLabel}"
+        when "leai", "leap"
+            operands[0].armEmitLea(operands[1])
+        when "smulli"
+            raise "Wrong number of arguments to smull in #{self.inspect} at #{codeOriginString}" unless operands.length == 4
+            $asm.puts "smull #{operands[2].armOperand}, #{operands[3].armOperand}, #{operands[0].armOperand}, #{operands[1].armOperand}"
+        when "memfence"
+            $asm.puts "dmb sy"
+        when "clrbp"
+            $asm.puts "bic #{operands[2].armOperand}, #{operands[0].armOperand}, #{operands[1].armOperand}"
+        else
+            lowerDefault
+        end
+    end
+end
+
diff --git a/offlineasm/arm64.rb b/offlineasm/arm64.rb
new file mode 100644
index 0000000..ead4891
--- /dev/null
+++ b/offlineasm/arm64.rb
@@ -0,0 +1,912 @@
+# Copyright (C) 2011, 2012, 2014-2016 Apple Inc. All rights reserved.
+# Copyright (C) 2014 University of Szeged. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "ast"
+require "opt"
+require "risc"
+
+# Naming conventions:
+#
+# x<number>  => GPR. This is both the generic name of the register, and the name used
+#               to indicate that the register is used in 64-bit mode.
+# w<number>  => GPR in 32-bit mode. This is the low 32-bits of the GPR. If it is
+#               mutated then the high 32-bit part of the register is zero filled.
+# q<number>  => FPR. This is the generic name of the register.
+# d<number>  => FPR used as an IEEE 64-bit binary floating point number (i.e. double).
+#
+# GPR conventions, to match the baseline JIT:
+#
+#  x0  => t0, a0, r0
+#  x1  => t1, a1, r1
+#  x2  => t2, a2
+#  x3  => t3, a3
+#  x4  => t4
+#  x5  => t5
+# x13  =>                  (scratch)
+# x16  =>                  (scratch)
+# x17  =>                  (scratch)
+# x26  =>             csr0 (PB)
+# x27  =>             csr1 (tagTypeNumber)
+# x28  =>             csr2 (tagMask)
+# x29  => cfr
+#  sp  => sp
+#  lr  => lr
+#
+# FPR conventions, to match the baseline JIT:
+#
+#  q0  => ft0, fa0, fr
+#  q1  => ft1, fa1
+#  q2  => ft2, fa2
+#  q3  => ft3, fa3
+#  q4  => ft4          (unused in baseline)
+#  q5  => ft5          (unused in baseline)
+#  q8  => csfr0        (Only the lower 64 bits)
+#  q9  => csfr1        (Only the lower 64 bits)
+# q10  => csfr2        (Only the lower 64 bits)
+# q11  => csfr3        (Only the lower 64 bits)
+# q12  => csfr4        (Only the lower 64 bits)
+# q13  => csfr5        (Only the lower 64 bits)
+# q14  => csfr6        (Only the lower 64 bits)
+# q15  => csfr7        (Only the lower 64 bits)
+# q31  => scratch
+
+def arm64GPRName(name, kind)
+    raise "bad GPR name #{name}" unless name =~ /^x/
+    number = name[1..-1]
+    case kind
+    when :int
+        "w" + number
+    when :ptr
+        "x" + number
+    else
+        raise "Wrong kind: #{kind}"
+    end
+end
+
+def arm64FPRName(name, kind)
+    raise "bad FPR kind #{kind}" unless kind == :double
+    raise "bad FPR name #{name}" unless name =~ /^q/
+    "d" + name[1..-1]
+end
+
+class SpecialRegister
+    def arm64Operand(kind)
+        case @name
+        when /^x/
+            arm64GPRName(@name, kind)
+        when /^q/
+            arm64FPRName(@name, kind)
+        else
+            raise "Bad name: #{@name}"
+        end
+    end
+end
+
+ARM64_EXTRA_GPRS = [SpecialRegister.new("x16"), SpecialRegister.new("x17"), SpecialRegister.new("x13")]
+ARM64_EXTRA_FPRS = [SpecialRegister.new("q31")]
+
+class RegisterID
+    def arm64Operand(kind)
+        case @name
+        when 't0', 'a0', 'r0'
+            arm64GPRName('x0', kind)
+        when 't1', 'a1', 'r1'
+            arm64GPRName('x1', kind)
+        when 't2', 'a2'
+            arm64GPRName('x2', kind)
+        when 't3', 'a3'
+            arm64GPRName('x3', kind)
+        when 't4'
+            arm64GPRName('x4', kind)
+        when 't5'
+            arm64GPRName('x5', kind)
+        when 'cfr'
+            arm64GPRName('x29', kind)
+        when 'csr0'
+            arm64GPRName('x19', kind)
+        when 'csr1'
+            arm64GPRName('x20', kind)
+        when 'csr2'
+            arm64GPRName('x21', kind)
+        when 'csr3'
+            arm64GPRName('x22', kind)
+        when 'csr4'
+            arm64GPRName('x23', kind)
+        when 'csr5'
+            arm64GPRName('x24', kind)
+        when 'csr6'
+            arm64GPRName('x25', kind)
+        when 'csr7'
+            arm64GPRName('x26', kind)
+        when 'csr8'
+            arm64GPRName('x27', kind)
+        when 'csr9'
+            arm64GPRName('x28', kind)
+        when 'sp'
+            'sp'
+        when 'lr'
+            'x30'
+        else
+            raise "Bad register name #{@name} at #{codeOriginString}"
+        end
+    end
+end
+
+class FPRegisterID
+    def arm64Operand(kind)
+        case @name
+        when 'ft0', 'fr', 'fa0'
+            arm64FPRName('q0', kind)
+        when 'ft1', 'fa1'
+            arm64FPRName('q1', kind)
+        when 'ft2', 'fa2'
+            arm64FPRName('q2', kind)
+        when 'ft3', 'fa3'
+            arm64FPRName('q3', kind)
+        when 'ft4'
+            arm64FPRName('q4', kind)
+        when 'ft5'
+            arm64FPRName('q5', kind)
+        when 'csfr0'
+            arm64FPRName('q8', kind)
+        when 'csfr1'
+            arm64FPRName('q9', kind)
+        when 'csfr2'
+            arm64FPRName('q10', kind)
+        when 'csfr3'
+            arm64FPRName('q11', kind)
+        when 'csfr4'
+            arm64FPRName('q12', kind)
+        when 'csfr5'
+            arm64FPRName('q13', kind)
+        when 'csfr6'
+            arm64FPRName('q14', kind)
+        when 'csfr7'
+            arm64FPRName('q15', kind)
+        else "Bad register name #{@name} at #{codeOriginString}"
+        end
+    end
+end
+
+class Immediate
+    def arm64Operand(kind)
+        raise "Invalid immediate #{value} at #{codeOriginString}" if value < 0 or value > 4095
+        "\##{value}"
+    end
+end
+
+class Address
+    def arm64Operand(kind)
+        raise "Invalid offset #{offset.value} at #{codeOriginString}" if offset.value < -255 or offset.value > 4095
+        "[#{base.arm64Operand(:ptr)}, \##{offset.value}]"
+    end
+    
+    def arm64EmitLea(destination, kind)
+        $asm.puts "add #{destination.arm64Operand(kind)}, #{base.arm64Operand(kind)}, \##{offset.value}"
+    end
+end
+
+class BaseIndex
+    def arm64Operand(kind)
+        raise "Invalid offset #{offset.value} at #{codeOriginString}" if offset.value != 0
+        "[#{base.arm64Operand(:ptr)}, #{index.arm64Operand(:ptr)}, lsl \##{scaleShift}]"
+    end
+
+    def arm64EmitLea(destination, kind)
+        $asm.puts "add #{destination.arm64Operand(kind)}, #{base.arm64Operand(kind)}, #{index.arm64Operand(kind)}, lsl \##{scaleShift}"
+    end
+end
+
+class AbsoluteAddress
+    def arm64Operand(kind)
+        raise "Unconverted absolute address #{address.value} at #{codeOriginString}"
+    end
+end
+
+# FIXME: We could support AbsoluteAddress for lea, but we don't.
+
+#
+# Actual lowering code follows.
+#
+
+def arm64LowerMalformedLoadStoreAddresses(list)
+    newList = []
+
+    def isAddressMalformed(operand)
+        operand.is_a? Address and not (-255..4095).include? operand.offset.value
+    end
+
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            if node.opcode =~ /^store/ and isAddressMalformed(node.operands[1])
+                address = node.operands[1]
+                tmp = Tmp.new(codeOrigin, :gpr)
+                newList << Instruction.new(node.codeOrigin, "move", [address.offset, tmp])
+                newList << Instruction.new(node.codeOrigin, node.opcode, [node.operands[0], BaseIndex.new(node.codeOrigin, address.base, tmp, 1, Immediate.new(codeOrigin, 0))], node.annotation)
+            elsif node.opcode =~ /^load/ and isAddressMalformed(node.operands[0])
+                address = node.operands[0]
+                tmp = Tmp.new(codeOrigin, :gpr)
+                newList << Instruction.new(node.codeOrigin, "move", [address.offset, tmp])
+                newList << Instruction.new(node.codeOrigin, node.opcode, [BaseIndex.new(node.codeOrigin, address.base, tmp, 1, Immediate.new(codeOrigin, 0)), node.operands[1]], node.annotation)
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+# Workaround for Cortex-A53 erratum (835769)
+def arm64CortexA53Fix835769(list)
+    newList = []
+    lastOpcodeUnsafe = false
+
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when /^store/, /^load/
+                # List all macro instructions that can be lowered to a load, store or prefetch ARM64 assembly instruction
+                lastOpcodeUnsafe = true
+            when  "muli", "mulp", "mulq", "smulli"
+                # List all macro instructions that can be lowered to a 64-bit multiply-accumulate ARM64 assembly instruction
+                # (defined as one of MADD, MSUB, SMADDL, SMSUBL, UMADDL or UMSUBL).
+                if lastOpcodeUnsafe
+                    newList << Instruction.new(node.codeOrigin, "nopCortexA53Fix835769", [])
+                end
+                lastOpcodeUnsafe = false
+            else
+                lastOpcodeUnsafe = false
+            end
+        end
+        newList << node
+    }
+    newList
+end
+
+class Sequence
+    def getModifiedListARM64
+        result = @list
+        result = riscLowerNot(result)
+        result = riscLowerSimpleBranchOps(result)
+        result = riscLowerHardBranchOps64(result)
+        result = riscLowerShiftOps(result)
+        result = arm64LowerMalformedLoadStoreAddresses(result)
+        result = riscLowerMalformedAddresses(result) {
+            | node, address |
+            case node.opcode
+            when "loadb", "loadbs", "storeb", /^bb/, /^btb/, /^cb/, /^tb/
+                size = 1
+            when "loadh", "loadhs"
+                size = 2
+            when "loadi", "loadis", "storei", "addi", "andi", "lshifti", "muli", "negi",
+                "noti", "ori", "rshifti", "urshifti", "subi", "xori", /^bi/, /^bti/,
+                /^ci/, /^ti/, "addis", "subis", "mulis", "smulli", "leai"
+                size = 4
+            when "loadp", "storep", "loadq", "storeq", "loadd", "stored", "lshiftp", "lshiftq", "negp", "negq", "rshiftp", "rshiftq",
+                "urshiftp", "urshiftq", "addp", "addq", "mulp", "mulq", "andp", "andq", "orp", "orq", "subp", "subq", "xorp", "xorq", "addd",
+                "divd", "subd", "muld", "sqrtd", /^bp/, /^bq/, /^btp/, /^btq/, /^cp/, /^cq/, /^tp/, /^tq/, /^bd/,
+                "jmp", "call", "leap", "leaq"
+                size = 8
+            else
+                raise "Bad instruction #{node.opcode} for heap access at #{node.codeOriginString}"
+            end
+            
+            if address.is_a? BaseIndex
+                address.offset.value == 0 and
+                    (node.opcode =~ /^lea/ or address.scale == 1 or address.scale == size)
+            elsif address.is_a? Address
+                (-255..4095).include? address.offset.value
+            else
+                false
+            end
+        }
+        result = riscLowerMisplacedImmediates(result, ["storeb", "storei", "storep", "storeq"])
+        result = riscLowerMalformedImmediates(result, 0..4095)
+        result = riscLowerMisplacedAddresses(result)
+        result = riscLowerMalformedAddresses(result) {
+            | node, address |
+            case node.opcode
+            when /^load/
+                true
+            when /^store/
+                not (address.is_a? Address and address.offset.value < 0)
+            when /^lea/
+                true
+            else
+                raise "Bad instruction #{node.opcode} for heap access at #{node.codeOriginString}"
+            end
+        }
+        result = riscLowerTest(result)
+        result = assignRegistersToTemporaries(result, :gpr, ARM64_EXTRA_GPRS)
+        result = assignRegistersToTemporaries(result, :fpr, ARM64_EXTRA_FPRS)
+        result = arm64CortexA53Fix835769(result)
+        return result
+    end
+end
+
+def arm64Operands(operands, kinds)
+    if kinds.is_a? Array
+        raise "Mismatched operand lists: #{operands.inspect} and #{kinds.inspect}" if operands.size != kinds.size
+    else
+        kinds = operands.map{ kinds }
+    end
+    (0...operands.size).map {
+        | index |
+        operands[index].arm64Operand(kinds[index])
+    }.join(', ')
+end
+
+def arm64FlippedOperands(operands, kinds)
+    if kinds.is_a? Array
+        kinds = [kinds[-1]] + kinds[0..-2]
+    end
+    arm64Operands([operands[-1]] + operands[0..-2], kinds)
+end
+
+# TAC = three address code.
+def arm64TACOperands(operands, kind)
+    if operands.size == 3
+        return arm64FlippedOperands(operands, kind)
+    end
+    
+    raise unless operands.size == 2
+    
+    return operands[1].arm64Operand(kind) + ", " + arm64FlippedOperands(operands, kind)
+end
+
+def emitARM64Add(opcode, operands, kind)
+    if operands.size == 3
+        raise unless operands[1].register?
+        raise unless operands[2].register?
+        
+        if operands[0].immediate?
+            if operands[0].value == 0 and flag !~ /s$/
+                unless operands[1] == operands[2]
+                    $asm.puts "mov #{arm64FlippedOperands(operands[1..2], kind)}"
+                end
+            else
+                $asm.puts "#{opcode} #{arm64Operands(operands.reverse, kind)}"
+            end
+            return
+        end
+        
+        raise unless operands[0].register?
+        $asm.puts "#{opcode} #{arm64FlippedOperands(operands, kind)}"
+        return
+    end
+    
+    raise unless operands.size == 2
+    
+    if operands[0].immediate? and operands[0].value == 0 and opcode !~ /s$/
+        return
+    end
+    
+    $asm.puts "#{opcode} #{arm64TACOperands(operands, kind)}"
+end
+
+def emitARM64Unflipped(opcode, operands, kind)
+    $asm.puts "#{opcode} #{arm64Operands(operands, kind)}"
+end
+
+def emitARM64TAC(opcode, operands, kind)
+    $asm.puts "#{opcode} #{arm64TACOperands(operands, kind)}"
+end
+
+def emitARM64(opcode, operands, kind)
+    $asm.puts "#{opcode} #{arm64FlippedOperands(operands, kind)}"
+end
+
+def emitARM64Access(opcode, opcodeNegativeOffset, register, memory, kind)
+    if memory.is_a? Address and memory.offset.value < 0
+        $asm.puts "#{opcodeNegativeOffset} #{register.arm64Operand(kind)}, #{memory.arm64Operand(kind)}"
+        return
+    end
+    
+    $asm.puts "#{opcode} #{register.arm64Operand(kind)}, #{memory.arm64Operand(kind)}"
+end
+
+def emitARM64Shift(opcodeRegs, opcodeImmediate, operands, kind)
+    if operands.size == 3 and operands[1].immediate?
+        magicNumbers = yield operands[1].value
+        $asm.puts "#{opcodeImmediate} #{operands[2].arm64Operand(kind)}, #{operands[0].arm64Operand(kind)}, \##{magicNumbers[0]}, \##{magicNumbers[1]}"
+        return
+    end
+    
+    if operands.size == 2 and operands[0].immediate?
+        magicNumbers = yield operands[0].value
+        $asm.puts "#{opcodeImmediate} #{operands[1].arm64Operand(kind)}, #{operands[1].arm64Operand(kind)}, \##{magicNumbers[0]}, \##{magicNumbers[1]}"
+        return
+    end
+    
+    emitARM64TAC(opcodeRegs, operands, kind)
+end
+
+def emitARM64Branch(opcode, operands, kind, branchOpcode)
+    emitARM64Unflipped(opcode, operands[0..-2], kind)
+    $asm.puts "#{branchOpcode} #{operands[-1].asmLabel}"
+end
+
+def emitARM64Compare(operands, kind, compareCode)
+    emitARM64Unflipped("subs #{arm64GPRName('xzr', kind)}, ", operands[0..-2], kind)
+    $asm.puts "csinc #{operands[-1].arm64Operand(:int)}, wzr, wzr, #{compareCode}"
+end
+
+def emitARM64MoveImmediate(value, target)
+    first = true
+    isNegative = value < 0
+    [48, 32, 16, 0].each {
+        | shift |
+        currentValue = (value >> shift) & 0xffff
+        next if currentValue == (isNegative ? 0xffff : 0) and (shift != 0 or !first)
+        if first
+            if isNegative
+                $asm.puts "movn #{target.arm64Operand(:ptr)}, \##{(~currentValue) & 0xffff}, lsl \##{shift}"
+            else
+                $asm.puts "movz #{target.arm64Operand(:ptr)}, \##{currentValue}, lsl \##{shift}"
+            end
+            first = false
+        else
+            $asm.puts "movk #{target.arm64Operand(:ptr)}, \##{currentValue}, lsl \##{shift}"
+        end
+    }
+end
+
+class Instruction
+    def lowerARM64
+        $asm.comment codeOriginString
+        $asm.annotation annotation if $enableInstrAnnotations
+        $asm.debugAnnotation codeOrigin.debugDirective if $enableDebugAnnotations
+
+        case opcode
+        when 'addi'
+            emitARM64Add("add", operands, :int)
+        when 'addis'
+            emitARM64Add("adds", operands, :int)
+        when 'addp'
+            emitARM64Add("add", operands, :ptr)
+        when 'addps'
+            emitARM64Add("adds", operands, :ptr)
+        when 'addq'
+            emitARM64Add("add", operands, :ptr)
+        when "andi"
+            emitARM64TAC("and", operands, :int)
+        when "andp"
+            emitARM64TAC("and", operands, :ptr)
+        when "andq"
+            emitARM64TAC("and", operands, :ptr)
+        when "ori"
+            emitARM64TAC("orr", operands, :int)
+        when "orp"
+            emitARM64TAC("orr", operands, :ptr)
+        when "orq"
+            emitARM64TAC("orr", operands, :ptr)
+        when "xori"
+            emitARM64TAC("eor", operands, :int)
+        when "xorp"
+            emitARM64TAC("eor", operands, :ptr)
+        when "xorq"
+            emitARM64TAC("eor", operands, :ptr)
+        when "lshifti"
+            emitARM64Shift("lslv", "ubfm", operands, :int) {
+                | value |
+                [32 - value, 31 - value]
+            }
+        when "lshiftp"
+            emitARM64Shift("lslv", "ubfm", operands, :ptr) {
+                | value |
+                [64 - value, 63 - value]
+            }
+        when "lshiftq"
+            emitARM64Shift("lslv", "ubfm", operands, :ptr) {
+                | value |
+                [64 - value, 63 - value]
+            }
+        when "rshifti"
+            emitARM64Shift("asrv", "sbfm", operands, :int) {
+                | value |
+                [value, 31]
+            }
+        when "rshiftp"
+            emitARM64Shift("asrv", "sbfm", operands, :ptr) {
+                | value |
+                [value, 63]
+            }
+        when "rshiftq"
+            emitARM64Shift("asrv", "sbfm", operands, :ptr) {
+                | value |
+                [value, 63]
+            }
+        when "urshifti"
+            emitARM64Shift("lsrv", "ubfm", operands, :int) {
+                | value |
+                [value, 31]
+            }
+        when "urshiftp"
+            emitARM64Shift("lsrv", "ubfm", operands, :ptr) {
+                | value |
+                [value, 63]
+            }
+        when "urshiftq"
+            emitARM64Shift("lsrv", "ubfm", operands, :ptr) {
+                | value |
+                [value, 63]
+            }
+        when "muli"
+            $asm.puts "madd #{arm64TACOperands(operands, :int)}, wzr"
+        when "mulp"
+            $asm.puts "madd #{arm64TACOperands(operands, :ptr)}, xzr"
+        when "mulq"
+            $asm.puts "madd #{arm64TACOperands(operands, :ptr)}, xzr"
+        when "subi"
+            emitARM64TAC("sub", operands, :int)
+        when "subp"
+            emitARM64TAC("sub", operands, :ptr)
+        when "subq"
+            emitARM64TAC("sub", operands, :ptr)
+        when "subis"
+            emitARM64TAC("subs", operands, :int)
+        when "negi"
+            $asm.puts "sub #{operands[0].arm64Operand(:int)}, wzr, #{operands[0].arm64Operand(:int)}"
+        when "negp"
+            $asm.puts "sub #{operands[0].arm64Operand(:ptr)}, xzr, #{operands[0].arm64Operand(:ptr)}"
+        when "negq"
+            $asm.puts "sub #{operands[0].arm64Operand(:ptr)}, xzr, #{operands[0].arm64Operand(:ptr)}"
+        when "loadi"
+            emitARM64Access("ldr", "ldur", operands[1], operands[0], :int)
+        when "loadis"
+            emitARM64Access("ldrsw", "ldursw", operands[1], operands[0], :ptr)
+        when "loadp"
+            emitARM64Access("ldr", "ldur", operands[1], operands[0], :ptr)
+        when "loadq"
+            emitARM64Access("ldr", "ldur", operands[1], operands[0], :ptr)
+        when "storei"
+            emitARM64Unflipped("str", operands, :int)
+        when "storep"
+            emitARM64Unflipped("str", operands, :ptr)
+        when "storeq"
+            emitARM64Unflipped("str", operands, :ptr)
+        when "loadb"
+            emitARM64Access("ldrb", "ldurb", operands[1], operands[0], :int)
+        when "loadbs"
+            emitARM64Access("ldrsb", "ldursb", operands[1], operands[0], :int)
+        when "storeb"
+            emitARM64Unflipped("strb", operands, :int)
+        when "loadh"
+            emitARM64Access("ldrh", "ldurh", operands[1], operands[0], :int)
+        when "loadhs"
+            emitARM64Access("ldrsh", "ldursh", operands[1], operands[0], :int)
+        when "storeh"
+            emitARM64Unflipped("strh", operands, :int)
+        when "loadd"
+            emitARM64Access("ldr", "ldur", operands[1], operands[0], :double)
+        when "stored"
+            emitARM64Unflipped("str", operands, :double)
+        when "addd"
+            emitARM64TAC("fadd", operands, :double)
+        when "divd"
+            emitARM64TAC("fdiv", operands, :double)
+        when "subd"
+            emitARM64TAC("fsub", operands, :double)
+        when "muld"
+            emitARM64TAC("fmul", operands, :double)
+        when "sqrtd"
+            emitARM64("fsqrt", operands, :double)
+        when "ci2d"
+            emitARM64("scvtf", operands, [:int, :double])
+        when "bdeq"
+            emitARM64Branch("fcmp", operands, :double, "b.eq")
+        when "bdneq"
+            emitARM64Unflipped("fcmp", operands[0..1], :double)
+            isUnordered = LocalLabel.unique("bdneq")
+            $asm.puts "b.vs #{LocalLabelReference.new(codeOrigin, isUnordered).asmLabel}"
+            $asm.puts "b.ne #{operands[2].asmLabel}"
+            isUnordered.lower("ARM64")
+        when "bdgt"
+            emitARM64Branch("fcmp", operands, :double, "b.gt")
+        when "bdgteq"
+            emitARM64Branch("fcmp", operands, :double, "b.ge")
+        when "bdlt"
+            emitARM64Branch("fcmp", operands, :double, "b.mi")
+        when "bdlteq"
+            emitARM64Branch("fcmp", operands, :double, "b.ls")
+        when "bdequn"
+            emitARM64Unflipped("fcmp", operands[0..1], :double)
+            $asm.puts "b.vs #{operands[2].asmLabel}"
+            $asm.puts "b.eq #{operands[2].asmLabel}"
+        when "bdnequn"
+            emitARM64Branch("fcmp", operands, :double, "b.ne")
+        when "bdgtun"
+            emitARM64Branch("fcmp", operands, :double, "b.hi")
+        when "bdgtequn"
+            emitARM64Branch("fcmp", operands, :double, "b.pl")
+        when "bdltun"
+            emitARM64Branch("fcmp", operands, :double, "b.lt")
+        when "bdltequn"
+            emitARM64Branch("fcmp", operands, :double, "b.le")
+        when "btd2i"
+            # FIXME: May be a good idea to just get rid of this instruction, since the interpreter
+            # currently does not use it.
+            raise "ARM64 does not support this opcode yet, #{codeOriginString}"
+        when "td2i"
+            emitARM64("fcvtzs", operands, [:double, :int])
+        when "bcd2i"
+            # FIXME: Remove this instruction, or use it and implement it. Currently it's not
+            # used.
+            raise "ARM64 does not support this opcode yet, #{codeOriginString}"
+        when "movdz"
+            # FIXME: Remove it or support it.
+            raise "ARM64 does not support this opcode yet, #{codeOriginString}"
+        when "pop"
+            operands.each_slice(2) {
+                | ops |
+                # Note that the operands are in the reverse order of the case for push.
+                # This is due to the fact that order matters for pushing and popping, and 
+                # on platforms that only push/pop one slot at a time they pop their 
+                # arguments in the reverse order that they were pushed. In order to remain 
+                # compatible with those platforms we assume here that that's what has been done.
+
+                # So for example, if we did push(A, B, C, D), we would then pop(D, C, B, A).
+                # But since the ordering of arguments doesn't change on arm64 between the stp and ldp 
+                # instructions we need to flip flop the argument positions that were passed to us.
+                $asm.puts "ldp #{ops[1].arm64Operand(:ptr)}, #{ops[0].arm64Operand(:ptr)}, [sp], #16"
+            }
+        when "push"
+            operands.each_slice(2) {
+                | ops |
+                $asm.puts "stp #{ops[0].arm64Operand(:ptr)}, #{ops[1].arm64Operand(:ptr)}, [sp, #-16]!"
+            }
+        when "move"
+            if operands[0].immediate?
+                emitARM64MoveImmediate(operands[0].value, operands[1])
+            else
+                emitARM64("mov", operands, :ptr)
+            end
+        when "sxi2p"
+            emitARM64("sxtw", operands, [:int, :ptr])
+        when "sxi2q"
+            emitARM64("sxtw", operands, [:int, :ptr])
+        when "zxi2p"
+            emitARM64("uxtw", operands, [:int, :ptr])
+        when "zxi2q"
+            emitARM64("uxtw", operands, [:int, :ptr])
+        when "nop"
+            $asm.puts "nop"
+        when "bieq", "bbeq"
+            if operands[0].immediate? and operands[0].value == 0
+                $asm.puts "cbz #{operands[1].arm64Operand(:int)}, #{operands[2].asmLabel}"
+            elsif operands[1].immediate? and operands[1].value == 0
+                $asm.puts "cbz #{operands[0].arm64Operand(:int)}, #{operands[2].asmLabel}"
+            else
+                emitARM64Branch("subs wzr, ", operands, :int, "b.eq")
+            end
+        when "bpeq"
+            if operands[0].immediate? and operands[0].value == 0
+                $asm.puts "cbz #{operands[1].arm64Operand(:ptr)}, #{operands[2].asmLabel}"
+            elsif operands[1].immediate? and operands[1].value == 0
+                $asm.puts "cbz #{operands[0].arm64Operand(:ptr)}, #{operands[2].asmLabel}"
+            else
+                emitARM64Branch("subs xzr, ", operands, :ptr, "b.eq")
+            end
+        when "bqeq"
+            if operands[0].immediate? and operands[0].value == 0
+                $asm.puts "cbz #{operands[1].arm64Operand(:ptr)}, #{operands[2].asmLabel}"
+            elsif operands[1].immediate? and operands[1].value == 0
+                $asm.puts "cbz #{operands[0].arm64Operand(:ptr)}, #{operands[2].asmLabel}"
+            else
+                emitARM64Branch("subs xzr, ", operands, :ptr, "b.eq")
+            end
+        when "bineq", "bbneq"
+            if operands[0].immediate? and operands[0].value == 0
+                $asm.puts "cbnz #{operands[1].arm64Operand(:int)}, #{operands[2].asmLabel}"
+            elsif operands[1].immediate? and operands[1].value == 0
+                $asm.puts "cbnz #{operands[0].arm64Operand(:int)}, #{operands[2].asmLabel}"
+            else
+                emitARM64Branch("subs wzr, ", operands, :int, "b.ne")
+            end
+        when "bpneq"
+            if operands[0].immediate? and operands[0].value == 0
+                $asm.puts "cbnz #{operands[1].arm64Operand(:ptr)}, #{operands[2].asmLabel}"
+            elsif operands[1].immediate? and operands[1].value == 0
+                $asm.puts "cbnz #{operands[0].arm64Operand(:ptr)}, #{operands[2].asmLabel}"
+            else
+                emitARM64Branch("subs xzr, ", operands, :ptr, "b.ne")
+            end
+        when "bqneq"
+            if operands[0].immediate? and operands[0].value == 0
+                $asm.puts "cbnz #{operands[1].arm64Operand(:ptr)}, #{operands[2].asmLabel}"
+            elsif operands[1].immediate? and operands[1].value == 0
+                $asm.puts "cbnz #{operands[0].arm64Operand(:ptr)}, #{operands[2].asmLabel}"
+            else
+                emitARM64Branch("subs xzr, ", operands, :ptr, "b.ne")
+            end
+        when "bia", "bba"
+            emitARM64Branch("subs wzr, ", operands, :int, "b.hi")
+        when "bpa"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.hi")
+        when "bqa"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.hi")
+        when "biaeq", "bbaeq"
+            emitARM64Branch("subs wzr, ", operands, :int, "b.hs")
+        when "bpaeq"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.hs")
+        when "bqaeq"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.hs")
+        when "bib", "bbb"
+            emitARM64Branch("subs wzr, ", operands, :int, "b.lo")
+        when "bpb"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.lo")
+        when "bqb"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.lo")
+        when "bibeq", "bbbeq"
+            emitARM64Branch("subs wzr, ", operands, :int, "b.ls")
+        when "bpbeq"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.ls")
+        when "bqbeq"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.ls")
+        when "bigt", "bbgt"
+            emitARM64Branch("subs wzr, ", operands, :int, "b.gt")
+        when "bpgt"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.gt")
+        when "bqgt"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.gt")
+        when "bigteq", "bbgteq"
+            emitARM64Branch("subs wzr, ", operands, :int, "b.ge")
+        when "bpgteq"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.ge")
+        when "bqgteq"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.ge")
+        when "bilt", "bblt"
+            emitARM64Branch("subs wzr, ", operands, :int, "b.lt")
+        when "bplt"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.lt")
+        when "bqlt"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.lt")
+        when "bilteq", "bblteq"
+            emitARM64Branch("subs wzr, ", operands, :int, "b.le")
+        when "bplteq"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.le")
+        when "bqlteq"
+            emitARM64Branch("subs xzr, ", operands, :ptr, "b.le")
+        when "jmp"
+            if operands[0].label?
+                $asm.puts "b #{operands[0].asmLabel}"
+            else
+                emitARM64Unflipped("br", operands, :ptr)
+            end
+        when "call"
+            if operands[0].label?
+                $asm.puts "bl #{operands[0].asmLabel}"
+            else
+                emitARM64Unflipped("blr", operands, :ptr)
+            end
+        when "break"
+            $asm.puts "brk \#0"
+        when "ret"
+            $asm.puts "ret"
+        when "cieq", "cbeq"
+            emitARM64Compare(operands, :int, "ne")
+        when "cpeq"
+            emitARM64Compare(operands, :ptr, "ne")
+        when "cqeq"
+            emitARM64Compare(operands, :ptr, "ne")
+        when "cineq", "cbneq"
+            emitARM64Compare(operands, :int, "eq")
+        when "cpneq"
+            emitARM64Compare(operands, :ptr, "eq")
+        when "cqneq"
+            emitARM64Compare(operands, :ptr, "eq")
+        when "cia", "cba"
+            emitARM64Compare(operands, :int, "ls")
+        when "cpa"
+            emitARM64Compare(operands, :ptr, "ls")
+        when "cqa"
+            emitARM64Compare(operands, :ptr, "ls")
+        when "ciaeq", "cbaeq"
+            emitARM64Compare(operands, :int, "lo")
+        when "cpaeq"
+            emitARM64Compare(operands, :ptr, "lo")
+        when "cqaeq"
+            emitARM64Compare(operands, :ptr, "lo")
+        when "cib", "cbb"
+            emitARM64Compare(operands, :int, "hs")
+        when "cpb"
+            emitARM64Compare(operands, :ptr, "hs")
+        when "cqb"
+            emitARM64Compare(operands, :ptr, "hs")
+        when "cibeq", "cbbeq"
+            emitARM64Compare(operands, :int, "hi")
+        when "cpbeq"
+            emitARM64Compare(operands, :ptr, "hi")
+        when "cqbeq"
+            emitARM64Compare(operands, :ptr, "hi")
+        when "cilt", "cblt"
+            emitARM64Compare(operands, :int, "ge")
+        when "cplt"
+            emitARM64Compare(operands, :ptr, "ge")
+        when "cqlt"
+            emitARM64Compare(operands, :ptr, "ge")
+        when "cilteq", "cblteq"
+            emitARM64Compare(operands, :int, "gt")
+        when "cplteq"
+            emitARM64Compare(operands, :ptr, "gt")
+        when "cqlteq"
+            emitARM64Compare(operands, :ptr, "gt")
+        when "cigt", "cbgt"
+            emitARM64Compare(operands, :int, "le")
+        when "cpgt"
+            emitARM64Compare(operands, :ptr, "le")
+        when "cqgt"
+            emitARM64Compare(operands, :ptr, "le")
+        when "cigteq", "cbgteq"
+            emitARM64Compare(operands, :int, "lt")
+        when "cpgteq"
+            emitARM64Compare(operands, :ptr, "lt")
+        when "cqgteq"
+            emitARM64Compare(operands, :ptr, "lt")
+        when "peek"
+            $asm.puts "ldr #{operands[1].arm64Operand(:ptr)}, [sp, \##{operands[0].value * 8}]"
+        when "poke"
+            $asm.puts "str #{operands[1].arm64Operand(:ptr)}, [sp, \##{operands[0].value * 8}]"
+        when "fp2d"
+            emitARM64("fmov", operands, [:ptr, :double])
+        when "fq2d"
+            emitARM64("fmov", operands, [:ptr, :double])
+        when "fd2p"
+            emitARM64("fmov", operands, [:double, :ptr])
+        when "fd2q"
+            emitARM64("fmov", operands, [:double, :ptr])
+        when "bo"
+            $asm.puts "b.vs #{operands[0].asmLabel}"
+        when "bs"
+            $asm.puts "b.mi #{operands[0].asmLabel}"
+        when "bz"
+            $asm.puts "b.eq #{operands[0].asmLabel}"
+        when "bnz"
+            $asm.puts "b.ne #{operands[0].asmLabel}"
+        when "leai"
+            operands[0].arm64EmitLea(operands[1], :int)
+        when "leap"
+            operands[0].arm64EmitLea(operands[1], :ptr)
+        when "leaq"
+            operands[0].arm64EmitLea(operands[1], :ptr)
+        when "smulli"
+            $asm.puts "smaddl #{operands[2].arm64Operand(:ptr)}, #{operands[0].arm64Operand(:int)}, #{operands[1].arm64Operand(:int)}, xzr"
+        when "memfence"
+            $asm.puts "dmb sy"
+        when "pcrtoaddr"
+            $asm.puts "adr #{operands[1].arm64Operand(:ptr)}, #{operands[0].value}"
+        when "nopCortexA53Fix835769"
+            $asm.putStr("#if CPU(ARM64_CORTEXA53)")
+            $asm.puts "nop"
+            $asm.putStr("#endif")
+        else
+            lowerDefault
+        end
+    end
+end
+
diff --git a/offlineasm/asm.rb b/offlineasm/asm.rb
new file mode 100644
index 0000000..fa00402
--- /dev/null
+++ b/offlineasm/asm.rb
@@ -0,0 +1,378 @@
+#!/usr/bin/env ruby
+
+# Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+$: << File.dirname(__FILE__)
+
+require "config"
+require "backends"
+require "digest/sha1"
+require "offsets"
+require 'optparse'
+require "parser"
+require "self_hash"
+require "settings"
+require "transform"
+
+class Assembler
+    def initialize(outp)
+        @outp = outp
+        @state = :cpp
+        @commentState = :none
+        @comment = nil
+        @internalComment = nil
+        @annotation = nil
+        @codeOrigin = nil
+        @numLocalLabels = 0
+        @numGlobalLabels = 0
+
+        @newlineSpacerState = :none
+        @lastlabel = ""
+    end
+
+    def enterAsm
+        @outp.puts "OFFLINE_ASM_BEGIN" if !$emitWinAsm
+
+        if !$emitWinAsm
+            @outp.puts "OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeStart)"
+        else
+            putsProc("llintPCRangeStart", "")
+            putsProcEndIfNeeded
+        end
+        @state = :asm
+        SourceFile.outputDotFileList(@outp) if $enableDebugAnnotations
+    end
+    
+    def leaveAsm
+        putsProcEndIfNeeded if $emitWinAsm
+        if !$emitWinAsm
+            @outp.puts "OFFLINE_ASM_GLOBAL_LABEL(llintPCRangeEnd)"
+        else
+            putsProc("llintPCRangeEnd", "")
+            putsProcEndIfNeeded
+        end
+        putsLastComment
+        @outp.puts "OFFLINE_ASM_END" if !$emitWinAsm
+        @state = :cpp
+    end
+    
+    def inAsm
+        enterAsm
+        yield
+        leaveAsm
+    end
+    
+    # Concatenates all the various components of the comment to dump.
+    def lastComment
+        separator = " "
+        result = ""
+        result = "#{@comment}" if @comment
+        if @annotation and $enableInstrAnnotations
+            result += separator if result != ""
+            result += "#{@annotation}"
+        end
+        if @internalComment
+            result += separator if result != ""
+            result += "#{@internalComment}"
+        end
+        if @codeOrigin and $enableCodeOriginComments
+            result += separator if result != ""
+            result += "#{@codeOrigin}"
+        end
+        if result != ""
+            result = $commentPrefix + " " + result
+        end
+
+        # Reset all the components that we've just sent to be dumped.
+        @commentState = :none
+        @comment = nil
+        @annotation = nil
+        @codeOrigin = nil
+        @internalComment = nil
+        result
+    end
+    
+    # Puts a C Statement in the output stream.
+    def putc(*line)
+        raise unless @state == :asm
+        @outp.puts(formatDump("    " + line.join(''), lastComment))
+    end
+    
+    def formatDump(dumpStr, comment, commentColumns=$preferredCommentStartColumn)
+        if comment.length > 0
+            "%-#{commentColumns}s %s" % [dumpStr, comment]
+        else
+            dumpStr
+        end
+    end
+
+    # private method for internal use only.
+    def putAnnotation(text)
+        raise unless @state == :asm
+        if $enableInstrAnnotations
+            @outp.puts text
+            @annotation = nil
+        end
+    end
+
+    def putLocalAnnotation()
+        putAnnotation "    // #{@annotation}" if @annotation
+    end
+
+    def putGlobalAnnotation()
+        putsNewlineSpacerIfAppropriate(:annotation)
+        putAnnotation "// #{@annotation}" if @annotation
+    end
+
+    def putsLastComment
+        comment = lastComment
+        unless comment.empty?
+            @outp.puts comment
+        end
+    end
+    
+    def puts(*line)
+        raise unless @state == :asm
+        if !$emitWinAsm
+            @outp.puts(formatDump("    \"\\t" + line.join('') + "\\n\"", lastComment))
+        else
+            @outp.puts(formatDump("    " + line.join(''), lastComment))
+        end
+    end
+    
+    def print(line)
+        raise unless @state == :asm
+        @outp.print("\"" + line + "\"")
+    end
+    
+    def putsNewlineSpacerIfAppropriate(state)
+        if @newlineSpacerState != state
+            @outp.puts("\n")
+            @newlineSpacerState = state
+        end
+    end
+
+    def putsProc(label, comment)
+        raise unless $emitWinAsm
+        @outp.puts(formatDump("#{label} PROC PUBLIC", comment))
+        @lastlabel = label
+    end
+
+    def putsProcEndIfNeeded
+        raise unless $emitWinAsm
+        if @lastlabel != ""
+            @outp.puts("#{@lastlabel} ENDP")
+        end
+        @lastlabel = ""
+    end
+
+    def putsLabel(labelName, isGlobal)
+        raise unless @state == :asm
+        @numGlobalLabels += 1
+        putsProcEndIfNeeded if $emitWinAsm and isGlobal
+        putsNewlineSpacerIfAppropriate(:global)
+        @internalComment = $enableLabelCountComments ? "Global Label #{@numGlobalLabels}" : nil
+        if isGlobal
+            if !$emitWinAsm
+                @outp.puts(formatDump("OFFLINE_ASM_GLOBAL_LABEL(#{labelName})", lastComment))
+            else
+                putsProc(labelName, lastComment)
+            end            
+        elsif /\Allint_op_/.match(labelName)
+            if !$emitWinAsm
+                @outp.puts(formatDump("OFFLINE_ASM_OPCODE_LABEL(op_#{$~.post_match})", lastComment))
+            else
+                label = "llint_" + "op_#{$~.post_match}"
+                @outp.puts(formatDump("  _#{label}:", lastComment))
+            end            
+        else
+            if !$emitWinAsm
+                @outp.puts(formatDump("OFFLINE_ASM_GLUE_LABEL(#{labelName})", lastComment))
+            else
+                @outp.puts(formatDump("  _#{labelName}:", lastComment))
+            end
+        end
+        @newlineSpacerState = :none # After a global label, we can use another spacer.
+    end
+    
+    def putsLocalLabel(labelName)
+        raise unless @state == :asm
+        @numLocalLabels += 1
+        @outp.puts("\n")
+        @internalComment = $enableLabelCountComments ? "Local Label #{@numLocalLabels}" : nil
+        if !$emitWinAsm
+            @outp.puts(formatDump("  OFFLINE_ASM_LOCAL_LABEL(#{labelName})", lastComment))
+        else
+            @outp.puts(formatDump("  #{labelName}:", lastComment))
+        end
+    end
+
+    def self.externLabelReference(labelName)
+        if !$emitWinAsm
+            "\" LOCAL_REFERENCE(#{labelName}) \""
+        else
+            "#{labelName}"
+        end
+    end
+
+    def self.labelReference(labelName)
+        if !$emitWinAsm
+            "\" LOCAL_LABEL_STRING(#{labelName}) \""
+        else
+            "_#{labelName}"
+        end
+    end
+    
+    def self.localLabelReference(labelName)
+        if !$emitWinAsm
+            "\" LOCAL_LABEL_STRING(#{labelName}) \""
+        else
+            "#{labelName}"
+        end
+    end
+    
+    def self.cLabelReference(labelName)
+        if /\Allint_op_/.match(labelName)
+            "op_#{$~.post_match}"  # strip opcodes of their llint_ prefix.
+        else
+            "#{labelName}"
+        end
+    end
+    
+    def self.cLocalLabelReference(labelName)
+        "#{labelName}"
+    end
+    
+    def codeOrigin(text)
+        case @commentState
+        when :none
+            @codeOrigin = text
+            @commentState = :one
+        when :one
+            if $enableCodeOriginComments
+                @outp.puts "    " + $commentPrefix + " #{@codeOrigin}"
+                @outp.puts "    " + $commentPrefix + " #{text}"
+            end
+            @codeOrigin = nil
+            @commentState = :many
+        when :many
+            @outp.puts $commentPrefix + " #{text}" if $enableCodeOriginComments
+        else
+            raise
+        end
+    end
+
+    def comment(text)
+        @comment = text
+    end
+
+    def annotation(text)
+        @annotation = text
+    end
+
+    def debugAnnotation(text)
+        @outp.puts text
+    end
+end
+
+IncludeFile.processIncludeOptions()
+
+asmFile = ARGV.shift
+offsetsFile = ARGV.shift
+outputFlnm = ARGV.shift
+
+$options = {}
+OptionParser.new do |opts|
+    opts.banner = "Usage: asm.rb asmFile offsetsFile outputFileName [--assembler=<ASM>]"
+    # This option is currently only used to specify the masm assembler
+    opts.on("--assembler=[ASM]", "Specify an assembler to use.") do |assembler|
+        $options[:assembler] = assembler
+    end
+end.parse!
+
+begin
+    configurationList = offsetsAndConfigurationIndex(offsetsFile)
+rescue MissingMagicValuesException
+    $stderr.puts "offlineasm: No magic values found. Skipping assembly file generation."
+    exit 0
+end
+
+# The MS compiler doesn't accept DWARF2 debug annotations.
+if isMSVC
+    $enableDebugAnnotations = false
+end
+
+$emitWinAsm = isMSVC ? outputFlnm.index(".asm") != nil : false
+$commentPrefix = $emitWinAsm ? ";" : "//"
+
+inputHash =
+    $commentPrefix + " offlineasm input hash: " + parseHash(asmFile) +
+    " " + Digest::SHA1.hexdigest(configurationList.map{|v| (v[0] + [v[1]]).join(' ')}.join(' ')) +
+    " " + selfHash +
+    " " + Digest::SHA1.hexdigest($options.has_key?(:assembler) ? $options[:assembler] : "")
+
+if FileTest.exist? outputFlnm
+    File.open(outputFlnm, "r") {
+        | inp |
+        firstLine = inp.gets
+        if firstLine and firstLine.chomp == inputHash
+            $stderr.puts "offlineasm: Nothing changed."
+            exit 0
+        end
+    }
+end
+
+File.open(outputFlnm, "w") {
+    | outp |
+    $output = outp
+    $output.puts inputHash
+
+    $asm = Assembler.new($output)
+    
+    ast = parse(asmFile)
+
+    configurationList.each {
+        | configuration |
+        offsetsList = configuration[0]
+        configIndex = configuration[1]
+        forSettings(computeSettingsCombinations(ast)[configIndex], ast) {
+            | concreteSettings, lowLevelAST, backend |
+
+            # There could be multiple backends we are generating for, but the C_LOOP is
+            # always by itself so this check to turn off $enableDebugAnnotations won't
+            # affect the generation for any other backend.
+            if backend == "C_LOOP"
+                $enableDebugAnnotations = false
+            end
+
+            lowLevelAST = lowLevelAST.resolve(*buildOffsetsMap(lowLevelAST, offsetsList))
+            lowLevelAST.validate
+            emitCodeInConfiguration(concreteSettings, lowLevelAST, backend) {
+                $asm.inAsm {
+                    lowLevelAST.lower(backend)
+                }
+            }
+        }
+    }
+}
diff --git a/offlineasm/ast.rb b/offlineasm/ast.rb
new file mode 100644
index 0000000..1241b7f
--- /dev/null
+++ b/offlineasm/ast.rb
@@ -0,0 +1,1426 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+
+#
+# Base utility types for the AST.
+#
+
+# Valid methods for Node:
+#
+# node.children -> Returns an array of immediate children.
+#
+# node.descendents -> Returns an array of all strict descendants (children
+#     and children of children, transitively).
+#
+# node.flatten -> Returns an array containing the strict descendants and
+#     the node itself.
+#
+# node.filter(type) -> Returns an array containing those elements in
+#     node.flatten that are of the given type (is_a? type returns true).
+#
+# node.mapChildren{|v| ...} -> Returns a new node with all children
+#     replaced according to the given block.
+#
+# Examples:
+#
+# node.filter(Setting).uniq -> Returns all of the settings that the AST's
+#     IfThenElse blocks depend on.
+#
+# node.filter(StructOffset).uniq -> Returns all of the structure offsets
+#     that the AST depends on.
+
+class Node
+    attr_reader :codeOrigin
+    
+    def initialize(codeOrigin)
+        @codeOrigin = codeOrigin
+    end
+    
+    def codeOriginString
+        @codeOrigin.to_s
+    end
+    
+    def descendants
+        children.collect{|v| v.flatten}.flatten
+    end
+    
+    def flatten
+        [self] + descendants
+    end
+    
+    def filter(type)
+        flatten.select{|v| v.is_a? type}
+    end
+end
+
+class NoChildren < Node
+    def initialize(codeOrigin)
+        super(codeOrigin)
+    end
+    
+    def children
+        []
+    end
+    
+    def mapChildren
+        self
+    end
+end
+
+class StructOffsetKey
+    attr_reader :struct, :field
+    
+    def initialize(struct, field)
+        @struct = struct
+        @field = field
+    end
+    
+    def hash
+        @struct.hash + @field.hash * 3
+    end
+    
+    def eql?(other)
+        @struct == other.struct and @field == other.field
+    end
+end
+
+#
+# AST nodes.
+#
+
+class StructOffset < NoChildren
+    attr_reader :struct, :field
+    
+    def initialize(codeOrigin, struct, field)
+        super(codeOrigin)
+        @struct = struct
+        @field = field
+    end
+    
+    @@mapping = {}
+    
+    def self.forField(codeOrigin, struct, field)
+        key = StructOffsetKey.new(struct, field)
+        
+        unless @@mapping[key]
+            @@mapping[key] = StructOffset.new(codeOrigin, struct, field)
+        end
+        @@mapping[key]
+    end
+    
+    def dump
+        "#{struct}::#{field}"
+    end
+    
+    def <=>(other)
+        if @struct != other.struct
+            return @struct <=> other.struct
+        end
+        @field <=> other.field
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class Sizeof < NoChildren
+    attr_reader :struct
+    
+    def initialize(codeOrigin, struct)
+        super(codeOrigin)
+        @struct = struct
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, struct)
+        unless @@mapping[struct]
+            @@mapping[struct] = Sizeof.new(codeOrigin, struct)
+        end
+        @@mapping[struct]
+    end
+    
+    def dump
+        "sizeof #{@struct}"
+    end
+    
+    def <=>(other)
+        @struct <=> other.struct
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class Immediate < NoChildren
+    attr_reader :value
+    
+    def initialize(codeOrigin, value)
+        super(codeOrigin)
+        @value = value
+        raise "Bad immediate value #{value.inspect} at #{codeOriginString}" unless value.is_a? Integer
+    end
+    
+    def dump
+        "#{value}"
+    end
+    
+    def ==(other)
+        other.is_a? Immediate and other.value == @value
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        true
+    end
+        
+    def register?
+        false
+    end
+end
+
+class AddImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        AddImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} + #{right.dump})"
+    end
+    
+    def value
+        "#{left.value} + #{right.value}"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class SubImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        SubImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} - #{right.dump})"
+    end
+    
+    def value
+        "#{left.value} - #{right.value}"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class MulImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        MulImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} * #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class NegImmediate < Node
+    attr_reader :child
+    
+    def initialize(codeOrigin, child)
+        super(codeOrigin)
+        @child = child
+    end
+    
+    def children
+        [@child]
+    end
+    
+    def mapChildren
+        NegImmediate.new(codeOrigin, (yield @child))
+    end
+    
+    def dump
+        "(-#{@child.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class OrImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        OrImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} | #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class AndImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        AndImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} & #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class XorImmediates < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        XorImmediates.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} ^ #{right.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class BitnotImmediate < Node
+    attr_reader :child
+    
+    def initialize(codeOrigin, child)
+        super(codeOrigin)
+        @child = child
+    end
+    
+    def children
+        [@child]
+    end
+    
+    def mapChildren
+        BitnotImmediate.new(codeOrigin, (yield @child))
+    end
+    
+    def dump
+        "(~#{@child.dump})"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        true
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class StringLiteral < NoChildren
+    attr_reader :value
+    
+    def initialize(codeOrigin, value)
+        super(codeOrigin)
+        @value = value[1..-2]
+        raise "Bad string literal #{value.inspect} at #{codeOriginString}" unless value.is_a? String
+    end
+    
+    def dump
+        "#{value}"
+    end
+    
+    def ==(other)
+        other.is_a? StringLiteral and other.value == @value
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def immediateOperand?
+        false
+    end
+        
+    def register?
+        false
+    end
+end
+
+class RegisterID < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, name)
+        unless @@mapping[name]
+            @@mapping[name] = RegisterID.new(codeOrigin, name)
+        end
+        @@mapping[name]
+    end
+    
+    def dump
+        name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
+class FPRegisterID < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, name)
+        unless @@mapping[name]
+            @@mapping[name] = FPRegisterID.new(codeOrigin, name)
+        end
+        @@mapping[name]
+    end
+    
+    def dump
+        name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
+class SpecialRegister < NoChildren
+    def initialize(name)
+        @name = name
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
+class Variable < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, name)
+        unless @@mapping[name]
+            @@mapping[name] = Variable.new(codeOrigin, name)
+        end
+        @@mapping[name]
+    end
+    
+    def dump
+        name
+    end
+    
+    def inspect
+        "<variable #{name} at #{codeOriginString}>"
+    end
+end
+
+class Address < Node
+    attr_reader :base, :offset
+    
+    def initialize(codeOrigin, base, offset)
+        super(codeOrigin)
+        @base = base
+        @offset = offset
+        raise "Bad base for address #{base.inspect} at #{codeOriginString}" unless base.is_a? Variable or base.register?
+        raise "Bad offset for address #{offset.inspect} at #{codeOriginString}" unless offset.is_a? Variable or offset.immediate?
+    end
+    
+    def withOffset(extraOffset)
+        Address.new(codeOrigin, @base, Immediate.new(codeOrigin, @offset.value + extraOffset))
+    end
+    
+    def children
+        [@base, @offset]
+    end
+    
+    def mapChildren
+        Address.new(codeOrigin, (yield @base), (yield @offset))
+    end
+    
+    def dump
+        "#{offset.dump}[#{base.dump}]"
+    end
+    
+    def address?
+        true
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def immediateOperand?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class BaseIndex < Node
+    attr_reader :base, :index, :scale, :offset
+    
+    def initialize(codeOrigin, base, index, scale, offset)
+        super(codeOrigin)
+        @base = base
+        @index = index
+        @scale = scale
+        raise unless [1, 2, 4, 8].member? @scale
+        @offset = offset
+    end
+    
+    def scaleShift
+        case scale
+        when 1
+            0
+        when 2
+            1
+        when 4
+            2
+        when 8
+            3
+        else
+            raise "Bad scale at #{codeOriginString}"
+        end
+    end
+    
+    def withOffset(extraOffset)
+        BaseIndex.new(codeOrigin, @base, @index, @scale, Immediate.new(codeOrigin, @offset.value + extraOffset))
+    end
+    
+    def children
+        [@base, @index, @offset]
+    end
+    
+    def mapChildren
+        BaseIndex.new(codeOrigin, (yield @base), (yield @index), @scale, (yield @offset))
+    end
+    
+    def dump
+        "#{offset.dump}[#{base.dump}, #{index.dump}, #{scale}]"
+    end
+    
+    def address?
+        true
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def immediateOperand?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+class AbsoluteAddress < NoChildren
+    attr_reader :address
+    
+    def initialize(codeOrigin, address)
+        super(codeOrigin)
+        @address = address
+    end
+    
+    def withOffset(extraOffset)
+        AbsoluteAddress.new(codeOrigin, Immediate.new(codeOrigin, @address.value + extraOffset))
+    end
+    
+    def dump
+        "#{address.dump}[]"
+    end
+    
+    def address?
+        true
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def immediateOperand?
+        true
+    end
+    
+    def register?
+        false
+    end
+end
+
+class Instruction < Node
+    attr_reader :opcode, :operands, :annotation
+    
+    def initialize(codeOrigin, opcode, operands, annotation=nil)
+        super(codeOrigin)
+        @opcode = opcode
+        @operands = operands
+        @annotation = annotation
+    end
+    
+    def children
+        operands
+    end
+    
+    def mapChildren(&proc)
+        Instruction.new(codeOrigin, @opcode, @operands.map(&proc), @annotation)
+    end
+    
+    def dump
+        "\t" + opcode.to_s + " " + operands.collect{|v| v.dump}.join(", ")
+    end
+
+    def lowerDefault
+        case opcode
+        when "localAnnotation"
+            $asm.putLocalAnnotation
+        when "globalAnnotation"
+            $asm.putGlobalAnnotation
+        when "emit"
+          $asm.puts "#{operands[0].dump}"
+        else
+            raise "Unhandled opcode #{opcode} at #{codeOriginString}"
+        end
+    end
+end
+
+class Error < NoChildren
+    def initialize(codeOrigin)
+        super(codeOrigin)
+    end
+    
+    def dump
+        "\terror"
+    end
+end
+
+class ConstDecl < Node
+    attr_reader :variable, :value
+    
+    def initialize(codeOrigin, variable, value)
+        super(codeOrigin)
+        @variable = variable
+        @value = value
+    end
+    
+    def children
+        [@variable, @value]
+    end
+    
+    def mapChildren
+        ConstDecl.new(codeOrigin, (yield @variable), (yield @value))
+    end
+    
+    def dump
+        "const #{@variable.dump} = #{@value.dump}"
+    end
+end
+
+$labelMapping = {}
+$referencedExternLabels = Array.new
+
+class Label < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+        @extern = true
+        @global = false
+    end
+    
+    def self.forName(codeOrigin, name, definedInFile = false)
+        if $labelMapping[name]
+            raise "Label name collision: #{name}" unless $labelMapping[name].is_a? Label
+        else
+            $labelMapping[name] = Label.new(codeOrigin, name)
+        end
+        if definedInFile
+            $labelMapping[name].clearExtern()
+        end
+        $labelMapping[name]
+    end
+
+    def self.setAsGlobal(codeOrigin, name)
+        if $labelMapping[name]
+            label = $labelMapping[name]
+            raise "Label: #{name} declared global multiple times" unless not label.global?
+            label.setGlobal()
+        else
+            newLabel = Label.new(codeOrigin, name)
+            newLabel.setGlobal()
+            $labelMapping[name] = newLabel
+        end
+    end
+
+    def self.resetReferenced
+        $referencedExternLabels = Array.new
+    end
+
+    def self.forReferencedExtern()
+        $referencedExternLabels.each {
+            | label |
+            yield "#{label.name}"
+        }
+    end
+
+    def clearExtern
+        @extern = false
+    end
+
+    def extern?
+        @extern
+    end
+
+    def setGlobal
+        @global = true
+    end
+
+    def global?
+        @global
+    end
+
+    def dump
+        "#{name}:"
+    end
+end
+
+class LocalLabel < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+
+    @@uniqueNameCounter = 0
+    
+    def self.forName(codeOrigin, name)
+        if $labelMapping[name]
+            raise "Label name collision: #{name}" unless $labelMapping[name].is_a? LocalLabel
+        else
+            $labelMapping[name] = LocalLabel.new(codeOrigin, name)
+        end
+        $labelMapping[name]
+    end
+    
+    def self.unique(comment)
+        newName = "_#{comment}"
+        if $labelMapping[newName]
+            while $labelMapping[newName = "_#{@@uniqueNameCounter}_#{comment}"]
+                @@uniqueNameCounter += 1
+            end
+        end
+        forName(nil, newName)
+    end
+    
+    def cleanName
+        if name =~ /^\./
+            "_" + name[1..-1]
+        else
+            name
+        end
+    end
+    
+    def dump
+        "#{name}:"
+    end
+end
+
+class LabelReference < Node
+    attr_reader :label
+    
+    def initialize(codeOrigin, label)
+        super(codeOrigin)
+        @label = label
+    end
+    
+    def children
+        [@label]
+    end
+    
+    def mapChildren
+        LabelReference.new(codeOrigin, (yield @label))
+    end
+    
+    def name
+        label.name
+    end
+    
+    def extern?
+        $labelMapping[name].is_a? Label and $labelMapping[name].extern?
+    end
+
+    def used
+        if !$referencedExternLabels.include?(@label) and extern?
+            $referencedExternLabels.push(@label)
+        end
+    end
+
+    def dump
+        label.name
+    end
+    
+    def value
+        asmLabel()
+    end
+
+    def address?
+        false
+    end
+    
+    def label?
+        true
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def immediateOperand?
+        true
+    end
+end
+
+class LocalLabelReference < NoChildren
+    attr_reader :label
+    
+    def initialize(codeOrigin, label)
+        super(codeOrigin)
+        @label = label
+    end
+    
+    def children
+        [@label]
+    end
+    
+    def mapChildren
+        LocalLabelReference.new(codeOrigin, (yield @label))
+    end
+    
+    def name
+        label.name
+    end
+    
+    def dump
+        label.name
+    end
+
+    def value
+        asmLabel()
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        true
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def immediateOperand?
+        true
+    end
+end
+
+class Sequence < Node
+    attr_reader :list
+    
+    def initialize(codeOrigin, list)
+        super(codeOrigin)
+        @list = list
+    end
+    
+    def children
+        list
+    end
+    
+    def mapChildren(&proc)
+        Sequence.new(codeOrigin, @list.map(&proc))
+    end
+    
+    def dump
+        list.collect{|v| v.dump}.join("\n")
+    end
+end
+
+class True < NoChildren
+    def initialize
+        super(nil)
+    end
+    
+    @@instance = True.new
+    
+    def self.instance
+        @@instance
+    end
+    
+    def value
+        true
+    end
+    
+    def dump
+        "true"
+    end
+end
+
+class False < NoChildren
+    def initialize
+        super(nil)
+    end
+    
+    @@instance = False.new
+    
+    def self.instance
+        @@instance
+    end
+    
+    def value
+        false
+    end
+    
+    def dump
+        "false"
+    end
+end
+
+class TrueClass
+    def asNode
+        True.instance
+    end
+end
+
+class FalseClass
+    def asNode
+        False.instance
+    end
+end
+
+class Setting < NoChildren
+    attr_reader :name
+    
+    def initialize(codeOrigin, name)
+        super(codeOrigin)
+        @name = name
+    end
+    
+    @@mapping = {}
+    
+    def self.forName(codeOrigin, name)
+        unless @@mapping[name]
+            @@mapping[name] = Setting.new(codeOrigin, name)
+        end
+        @@mapping[name]
+    end
+    
+    def dump
+        name
+    end
+end
+
+class And < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        And.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} and #{right.dump})"
+    end
+end
+
+class Or < Node
+    attr_reader :left, :right
+    
+    def initialize(codeOrigin, left, right)
+        super(codeOrigin)
+        @left = left
+        @right = right
+    end
+    
+    def children
+        [@left, @right]
+    end
+    
+    def mapChildren
+        Or.new(codeOrigin, (yield @left), (yield @right))
+    end
+    
+    def dump
+        "(#{left.dump} or #{right.dump})"
+    end
+end
+
+class Not < Node
+    attr_reader :child
+    
+    def initialize(codeOrigin, child)
+        super(codeOrigin)
+        @child = child
+    end
+    
+    def children
+        [@child]
+    end
+    
+    def mapChildren
+        Not.new(codeOrigin, (yield @child))
+    end
+    
+    def dump
+        "(not #{child.dump})"
+    end
+end
+
+class Skip < NoChildren
+    def initialize(codeOrigin)
+        super(codeOrigin)
+    end
+    
+    def dump
+        "\tskip"
+    end
+end
+
+class IfThenElse < Node
+    attr_reader :predicate, :thenCase
+    attr_accessor :elseCase
+    
+    def initialize(codeOrigin, predicate, thenCase)
+        super(codeOrigin)
+        @predicate = predicate
+        @thenCase = thenCase
+        @elseCase = Skip.new(codeOrigin)
+    end
+    
+    def children
+        if @elseCase
+            [@predicate, @thenCase, @elseCase]
+        else
+            [@predicate, @thenCase]
+        end
+    end
+    
+    def mapChildren
+        IfThenElse.new(codeOrigin, (yield @predicate), (yield @thenCase), (yield @elseCase))
+    end
+    
+    def dump
+        "if #{predicate.dump}\n" + thenCase.dump + "\nelse\n" + elseCase.dump + "\nend"
+    end
+end
+
+class Macro < Node
+    attr_reader :name, :variables, :body
+
+    def initialize(codeOrigin, name, variables, body)
+        super(codeOrigin)
+        @name = name
+        @variables = variables
+        @body = body
+    end
+    
+    def children
+        @variables + [@body]
+    end
+    
+    def mapChildren
+        Macro.new(codeOrigin, @name, @variables.map{|v| yield v}, (yield @body))
+    end
+    
+    def dump
+        "macro #{name}(" + variables.collect{|v| v.dump}.join(", ") + ")\n" + body.dump + "\nend"
+    end
+end
+
+class MacroCall < Node
+    attr_reader :name, :operands, :annotation
+    
+    def initialize(codeOrigin, name, operands, annotation)
+        super(codeOrigin)
+        @name = name
+        @operands = operands
+        raise unless @operands
+        @operands.each{|v| raise unless v}
+        @annotation = annotation
+    end
+    
+    def children
+        @operands
+    end
+    
+    def mapChildren(&proc)
+        MacroCall.new(codeOrigin, @name, @operands.map(&proc), @annotation)
+    end
+    
+    def dump
+        "\t#{name}(" + operands.collect{|v| v.dump}.join(", ") + ")"
+    end
+end
+
diff --git a/offlineasm/backends.rb b/offlineasm/backends.rb
new file mode 100644
index 0000000..eb32756
--- /dev/null
+++ b/offlineasm/backends.rb
@@ -0,0 +1,185 @@
+# Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "arm"
+require "arm64"
+require "ast"
+require "x86"
+require "mips"
+require "sh4"
+require "cloop"
+
+BACKENDS =
+    [
+     "X86",
+     "X86_WIN",
+     "X86_64",
+     "X86_64_WIN",
+     "ARM",
+     "ARMv7",
+     "ARMv7_TRADITIONAL",
+     "ARM64",
+     "MIPS",
+     "SH4",
+     "C_LOOP"
+    ]
+
+# Keep the set of working backends separate from the set of backends that might be
+# supported. This is great because the BACKENDS list is almost like a reserved
+# words list, in that it causes settings resolution to treat those words specially.
+# Hence this lets us set aside the name of a backend we might want to support in
+# the future while not actually supporting the backend yet.
+WORKING_BACKENDS =
+    [
+     "X86",
+     "X86_WIN",
+     "X86_64",
+     "X86_64_WIN",
+     "ARM",
+     "ARMv7",
+     "ARMv7_TRADITIONAL",
+     "ARM64",
+     "MIPS",
+     "SH4",
+     "C_LOOP"
+    ]
+
+BACKEND_PATTERN = Regexp.new('\\A(' + BACKENDS.join(')|(') + ')\\Z')
+
+$allBackends = {}
+$validBackends = {}
+BACKENDS.each {
+    | backend |
+    $validBackends[backend] = true
+    $allBackends[backend] = true
+}
+
+def includeOnlyBackends(list)
+    newValidBackends = {}
+    list.each {
+        | backend |
+        if $validBackends[backend]
+            newValidBackends[backend] = true
+        end
+    }
+    $validBackends = newValidBackends
+end
+
+def isBackend?(backend)
+    $allBackends[backend]
+end
+
+def isValidBackend?(backend)
+    $validBackends[backend]
+end
+
+def validBackends
+    $validBackends.keys
+end
+
+class LoweringError < StandardError
+    attr_reader :originString
+    
+    def initialize(e, originString)
+        super "#{e} (due to #{originString})"
+        @originString = originString
+        set_backtrace e.backtrace
+    end
+end
+
+class Node
+    def lower(name)
+        begin
+            $activeBackend = name
+            send("lower" + name)
+        rescue => e
+            raise LoweringError.new(e, codeOriginString)
+        end
+    end
+end
+
+# Overrides for lower() for those nodes that are backend-agnostic
+
+class Label
+    def lower(name)
+        $asm.debugAnnotation codeOrigin.debugDirective if $enableDebugAnnotations
+        $asm.putsLabel(self.name[1..-1], @global)
+    end
+end
+
+class LocalLabel
+    def lower(name)
+        $asm.putsLocalLabel "_offlineasm_#{self.name[1..-1]}"
+    end
+end
+
+class LabelReference
+    def asmLabel
+        if extern?
+            Assembler.externLabelReference(name[1..-1])
+        else
+            Assembler.labelReference(name[1..-1])
+        end
+    end
+
+    def cLabel
+        Assembler.cLabelReference(name[1..-1])
+    end
+end
+
+class LocalLabelReference
+    def asmLabel
+        Assembler.localLabelReference("_offlineasm_"+name[1..-1])
+    end
+
+    def cLabel
+        Assembler.cLocalLabelReference("_offlineasm_"+name[1..-1])
+    end
+end
+
+class Skip
+    def lower(name)
+    end
+end
+
+class Sequence
+    def lower(name)
+        $activeBackend = name
+        if respond_to? "getModifiedList#{name}"
+            newList = send("getModifiedList#{name}")
+            newList.each {
+                | node |
+                node.lower(name)
+            }
+        elsif respond_to? "lower#{name}"
+            send("lower#{name}")
+        else
+            @list.each {
+                | node |
+                node.lower(name)
+            }
+        end
+    end
+end
+
diff --git a/offlineasm/cloop.rb b/offlineasm/cloop.rb
new file mode 100644
index 0000000..7e93948
--- /dev/null
+++ b/offlineasm/cloop.rb
@@ -0,0 +1,1156 @@
+# Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "ast"
+require "opt"
+
+# The CLoop llint backend is initially based on the ARMv7 backend, and
+# then further enhanced with a few instructions from the x86 backend to
+# support building for X64 targets.  Hence, the shape of the generated
+# code and the usage convention of registers will look a lot like the
+# ARMv7 backend's.
+
+def cloopMapType(type)
+    case type
+    when :int;            ".i"
+    when :uint;           ".u"
+    when :int32;          ".i32"
+    when :uint32;         ".u32"
+    when :int64;          ".i64"
+    when :uint64;         ".u64"
+    when :int8;           ".i8"
+    when :uint8;          ".u8"
+    when :int8Ptr;        ".i8p"
+    when :voidPtr;        ".vp"
+    when :nativeFunc;     ".nativeFunc"
+    when :double;         ".d"
+    when :castToDouble;   ".castToDouble"
+    when :castToInt64;    ".castToInt64"
+    when :opcode;         ".opcode"
+    else;
+        raise "Unsupported type"
+    end
+end
+
+
+class SpecialRegister < NoChildren
+    def clDump
+        @name
+    end
+    def clValue(type=:int)
+        @name + cloopMapType(type)
+    end
+end
+
+C_LOOP_SCRATCH_FPR = SpecialRegister.new("d6")
+
+class RegisterID
+    def clDump
+        case name
+        # The cloop is modelled on the ARM implementation. Hence, the a0-a3
+        # registers are aliases for r0-r3 i.e. t0-t3 in our case.
+        when "t0", "a0", "r0"
+            "t0"
+        when "t1", "a1", "r1"
+            "t1"
+        when "t2", "a2"
+            "t2"
+        when "t3", "a3"
+            "t3"
+        when "t4"
+            "pc"
+        when "t5"
+            "t5"
+        when "csr0"
+            "pcBase"
+        when "csr1"
+            "tagTypeNumber"
+        when "csr2"
+            "tagMask"
+        when "cfr"
+            "cfr"
+        when "lr"
+            "lr"
+        when "sp"
+            "sp"
+        else
+            raise "Bad register #{name} for C_LOOP at #{codeOriginString}"
+        end
+    end
+    def clValue(type=:int)
+        clDump + cloopMapType(type)
+    end
+end
+
+class FPRegisterID
+    def clDump
+        case name
+        when "ft0", "fr"
+            "d0"
+        when "ft1"
+            "d1"
+        when "ft2"
+            "d2"
+        when "ft3"
+            "d3"
+        when "ft4"
+            "d4"
+        when "ft5"
+            "d5"
+        else
+            raise "Bad register #{name} for C_LOOP at #{codeOriginString}"
+        end
+    end
+    def clValue(type=:int)
+        clDump + cloopMapType(type)
+    end
+end
+
+class Immediate
+    def clDump
+        "#{value}"
+    end
+    def clValue(type=:int)
+        # There is a case of a very large unsigned number (0x8000000000000000)
+        # which we wish to encode.  Unfortunately, the C/C++ compiler
+        # complains if we express that number as a positive decimal integer.
+        # Hence, for positive values, we just convert the number into hex form
+        # to keep the compiler happy.
+        #
+        # However, for negative values, the to_s(16) hex conversion method does
+        # not strip the "-" sign resulting in a meaningless "0x-..." valueStr.
+        # To workaround this, we simply don't encode negative numbers as hex.
+
+        valueStr = (value < 0) ? "#{value}" : "0x#{value.to_s(16)}"
+
+        case type
+        when :int8;    "int8_t(#{valueStr})"
+        when :int32;   "int32_t(#{valueStr})"
+        when :int64;   "int64_t(#{valueStr})"
+        when :int;     "intptr_t(#{valueStr})"
+        when :uint8;   "uint8_t(#{valueStr})"
+        when :uint32;  "uint32_t(#{valueStr})"
+        when :uint64;  "uint64_t(#{valueStr})"
+        when :uint;    "uintptr_t(#{valueStr})"
+        else
+            raise "Not implemented immediate of type: #{type}" 
+        end
+    end
+end
+
+class Address
+    def clDump
+        "[#{base.clDump}, #{offset.value}]"
+    end
+    def clValue(type=:int)
+        case type
+        when :int8;         int8MemRef
+        when :int32;        int32MemRef
+        when :int64;        int64MemRef
+        when :int;          intMemRef
+        when :uint8;        uint8MemRef
+        when :uint32;       uint32MemRef
+        when :uint64;       uint64MemRef
+        when :uint;         uintMemRef
+        when :opcode;       opcodeMemRef
+        when :nativeFunc;   nativeFuncMemRef
+        else
+            raise "Unexpected Address type: #{type}"
+        end
+    end
+    def pointerExpr
+        if  offset.value == 0
+            "#{base.clValue(:int8Ptr)}"
+        elsif offset.value > 0
+            "#{base.clValue(:int8Ptr)} + #{offset.value}"
+        else
+            "#{base.clValue(:int8Ptr)} - #{-offset.value}"
+        end
+    end
+    def int8MemRef
+        "*CAST<int8_t*>(#{pointerExpr})"
+    end
+    def int16MemRef
+        "*CAST<int16_t*>(#{pointerExpr})"
+    end
+    def int32MemRef
+        "*CAST<int32_t*>(#{pointerExpr})"
+    end
+    def int64MemRef
+        "*CAST<int64_t*>(#{pointerExpr})"
+    end
+    def intMemRef
+        "*CAST<intptr_t*>(#{pointerExpr})"
+    end
+    def uint8MemRef
+        "*CAST<uint8_t*>(#{pointerExpr})"
+    end
+    def uint16MemRef
+        "*CAST<uint16_t*>(#{pointerExpr})"
+    end
+    def uint32MemRef
+        "*CAST<uint32_t*>(#{pointerExpr})"
+    end
+    def uint64MemRef
+        "*CAST<uint64_t*>(#{pointerExpr})"
+    end
+    def uintMemRef
+        "*CAST<uintptr_t*>(#{pointerExpr})"
+    end
+    def nativeFuncMemRef
+        "*CAST<NativeFunction*>(#{pointerExpr})"
+    end
+    def opcodeMemRef
+        "*CAST<Opcode*>(#{pointerExpr})"
+    end
+    def dblMemRef
+        "*CAST<double*>(#{pointerExpr})"
+    end
+end
+
+class BaseIndex
+    def clDump
+        "[#{base.clDump}, #{offset.clDump}, #{index.clDump} << #{scaleShift}]"
+    end
+    def clValue(type=:int)
+        case type
+        when :int8;       int8MemRef
+        when :int32;      int32MemRef
+        when :int64;      int64MemRef
+        when :int;        intMemRef
+        when :uint8;      uint8MemRef
+        when :uint32;     uint32MemRef
+        when :uint64;     uint64MemRef
+        when :uint;       uintMemRef
+        when :opcode;     opcodeMemRef
+        else
+            raise "Unexpected BaseIndex type: #{type}"
+        end
+    end
+    def pointerExpr
+        if offset.value == 0
+            "#{base.clValue(:int8Ptr)} + (#{index.clValue} << #{scaleShift})"
+        else
+            "#{base.clValue(:int8Ptr)} + (#{index.clValue} << #{scaleShift}) + #{offset.clValue}"
+        end
+    end
+    def int8MemRef
+        "*CAST<int8_t*>(#{pointerExpr})"
+    end
+    def int16MemRef
+        "*CAST<int16_t*>(#{pointerExpr})"
+    end
+    def int32MemRef
+        "*CAST<int32_t*>(#{pointerExpr})"
+    end
+    def int64MemRef
+        "*CAST<int64_t*>(#{pointerExpr})"
+    end
+    def intMemRef
+        "*CAST<intptr_t*>(#{pointerExpr})"
+    end
+    def uint8MemRef
+        "*CAST<uint8_t*>(#{pointerExpr})"
+    end
+    def uint16MemRef
+        "*CAST<uint16_t*>(#{pointerExpr})"
+    end
+    def uint32MemRef
+        "*CAST<uint32_t*>(#{pointerExpr})"
+    end
+    def uint64MemRef
+        "*CAST<uint64_t*>(#{pointerExpr})"
+    end
+    def uintMemRef
+        "*CAST<uintptr_t*>(#{pointerExpr})"
+    end
+    def opcodeMemRef
+        "*CAST<Opcode*>(#{pointerExpr})"
+    end
+    def dblMemRef
+        "*CAST<double*>(#{pointerExpr})"
+    end
+end
+
+class AbsoluteAddress
+    def clDump
+        "#{codeOriginString}"
+    end
+    def clValue
+        clDump
+    end
+end
+
+
+#
+# Lea support.
+#
+
+class Address
+    def cloopEmitLea(destination, type)
+        if destination == base
+            $asm.putc "#{destination.clValue(:int8Ptr)} += #{offset.clValue(type)};"
+        else
+            $asm.putc "#{destination.clValue(:int8Ptr)} = #{base.clValue(:int8Ptr)} + #{offset.clValue(type)};"
+        end
+    end
+end
+
+class BaseIndex
+    def cloopEmitLea(destination, type)
+        raise "Malformed BaseIndex, offset should be zero at #{codeOriginString}" unless offset.value == 0
+        $asm.putc "#{destination.clValue(:int8Ptr)} = #{base.clValue(:int8Ptr)} + (#{index.clValue} << #{scaleShift});"
+    end
+end
+
+#
+# Actual lowering code follows.
+#
+
+class Sequence
+    def getModifiedListC_LOOP
+        myList = @list
+        
+        # Verify that we will only see instructions and labels.
+        myList.each {
+            | node |
+            unless node.is_a? Instruction or
+                    node.is_a? Label or
+                    node.is_a? LocalLabel or
+                    node.is_a? Skip
+                raise "Unexpected #{node.inspect} at #{node.codeOrigin}" 
+            end
+        }
+        
+        return myList
+    end
+end
+
+def clOperands(operands)
+    operands.map{|v| v.clDump}.join(", ")
+end
+
+
+def cloopEmitOperation(operands, type, operator)
+    raise unless type == :int || type == :uint || type == :int32 || type == :uint32 || \
+        type == :int64 || type == :uint64 || type == :double
+    if operands.size == 3
+        $asm.putc "#{operands[2].clValue(type)} = #{operands[0].clValue(type)} #{operator} #{operands[1].clValue(type)};"
+        if operands[2].is_a? RegisterID and (type == :int32 or type == :uint32)
+            $asm.putc "#{operands[2].clDump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+        end
+    else
+        raise unless operands.size == 2
+        raise unless not operands[1].is_a? Immediate
+        $asm.putc "#{operands[1].clValue(type)} = #{operands[1].clValue(type)} #{operator} #{operands[0].clValue(type)};"
+        if operands[1].is_a? RegisterID and (type == :int32 or type == :uint32)
+            $asm.putc "#{operands[1].clDump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+        end
+    end
+end
+
+def cloopEmitShiftOperation(operands, type, operator)
+    raise unless type == :int || type == :uint || type == :int32 || type == :uint32 || type == :int64 || type == :uint64
+    if operands.size == 3
+        $asm.putc "#{operands[2].clValue(type)} = #{operands[1].clValue(type)} #{operator} (#{operands[0].clValue(:int)} & 0x1f);"
+        if operands[2].is_a? RegisterID and (type == :int32 or type == :uint32)
+            $asm.putc "#{operands[2].clDump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+        end
+    else
+        raise unless operands.size == 2
+        raise unless not operands[1].is_a? Immediate
+        $asm.putc "#{operands[1].clValue(type)} = #{operands[1].clValue(type)} #{operator} (#{operands[0].clValue(:int)} & 0x1f);"
+        if operands[1].is_a? RegisterID and (type == :int32 or type == :uint32)
+            $asm.putc "#{operands[1].clDump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+        end
+    end
+end
+
+def cloopEmitUnaryOperation(operands, type, operator)
+    raise unless type == :int || type == :uint || type == :int32 || type == :uint32 || type == :int64 || type == :uint64
+    raise unless operands.size == 1
+    raise unless not operands[0].is_a? Immediate
+    $asm.putc "#{operands[0].clValue(type)} = #{operator}#{operands[0].clValue(type)};"
+    if operands[0].is_a? RegisterID and (type == :int32 or type == :uint32)
+        $asm.putc "#{operands[0].clDump}.clearHighWord();" # Just clear it. It does nothing on the 32-bit port.
+    end
+end
+
+def cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, condition)
+    $asm.putc "if (std::isnan(#{operands[0].clValue(:double)}) || std::isnan(#{operands[1].clValue(:double)})"
+    $asm.putc "    || (#{operands[0].clValue(:double)} #{condition} #{operands[1].clValue(:double)}))"
+    $asm.putc "    goto #{operands[2].cLabel};"
+end
+
+
+def cloopEmitCompareAndSet(operands, type, comparator)
+    # The result is a boolean.  Hence, it doesn't need to be based on the type
+    # of the arguments being compared.
+    $asm.putc "#{operands[2].clValue} = (#{operands[0].clValue(type)} #{comparator} #{op2 = operands[1].clValue(type)});"
+end
+
+
+def cloopEmitCompareAndBranch(operands, type, comparator)
+    $asm.putc "if (#{operands[0].clValue(type)} #{comparator} #{operands[1].clValue(type)})"
+    $asm.putc "    goto #{operands[2].cLabel};"
+end
+
+
+# conditionTest should contain a string that provides a comparator and a RHS
+# value e.g. "< 0".
+def cloopGenerateConditionExpression(operands, type, conditionTest)
+    op1 = operands[0].clValue(type)
+
+    # The operands must consist of 2 or 3 values.
+    case operands.size
+    when 2 # Just test op1 against the conditionTest.
+        lhs = op1
+    when 3 # Mask op1 with op2 before testing against the conditionTest.
+        lhs = "(#{op1} & #{operands[1].clValue(type)})"
+    else
+        raise "Expected 2 or 3 operands but got #{operands.size} at #{codeOriginString}"
+    end
+    
+    "#{lhs} #{conditionTest}"
+end
+
+# conditionTest should contain a string that provides a comparator and a RHS
+# value e.g. "< 0".
+def cloopEmitTestAndBranchIf(operands, type, conditionTest, branchTarget)
+    conditionExpr = cloopGenerateConditionExpression(operands, type, conditionTest)
+    $asm.putc "if (#{conditionExpr})"
+    $asm.putc "    goto #{branchTarget};"
+end
+
+def cloopEmitTestSet(operands, type, conditionTest)
+    # The result is a boolean condition.  Hence, the result type is always an
+    # int.  The passed in type is only used for the values being tested in
+    # the condition test.
+    conditionExpr = cloopGenerateConditionExpression(operands, type, conditionTest)
+    $asm.putc "#{operands[-1].clValue} = (#{conditionExpr});"
+end
+
+def cloopEmitOpAndBranch(operands, operator, type, conditionTest)
+    case type
+    when :int;   tempType = "intptr_t"
+    when :int32; tempType = "int32_t"
+    when :int64; tempType = "int64_t"
+    else
+        raise "Unimplemented type"
+    end
+
+    op1 = operands[0].clValue(type)
+    op2 = operands[1].clValue(type)
+
+    $asm.putc "{"
+    $asm.putc "    #{tempType} temp = #{op2} #{operator} #{op1};"
+    $asm.putc "    #{op2} = temp;"
+    $asm.putc "    if (temp #{conditionTest})"
+    $asm.putc "        goto  #{operands[2].cLabel};"
+    $asm.putc "}"
+end
+
+def cloopAddOverflowTest(operands, type)
+    case type
+    when :int32
+        tempType = "int32_t"
+        signBit = "SIGN_BIT32"
+    else
+        raise "Unimplemented type"
+    end
+
+    $asm.putc "    #{tempType} a = #{operands[0].clValue(type)};"
+    $asm.putc "    #{tempType} b = #{operands[1].clValue(type)};"
+    $asm.putc "    // sign(b) sign(a) | Overflows if:"
+    $asm.putc "    // 0       0       | sign(b+a) = 1 (pos + pos != neg)"
+    $asm.putc "    // 0       1       | never"
+    $asm.putc "    // 1       0       | never"
+    $asm.putc "    // 1       1       | sign(b+a) = 0 (neg + neg != pos)"
+    "((#{signBit}(b) == #{signBit}(a)) && (#{signBit}(b+a) != #{signBit}(a)))"
+end
+
+def cloopSubOverflowTest(operands, type)
+    case type
+    when :int32
+        tempType = "int32_t"
+        signBit = "SIGN_BIT32"
+    else
+        raise "Unimplemented type"
+    end
+
+    $asm.putc "    #{tempType} a = #{operands[0].clValue(type)};"
+    $asm.putc "    #{tempType} b = #{operands[1].clValue(type)};"
+    $asm.putc "    // sign(b) sign(a) | Overflows if:"
+    $asm.putc "    // 0       0       | never"
+    $asm.putc "    // 0       1       | sign(b-a) = 1 (pos - neg != pos)"
+    $asm.putc "    // 1       0       | sign(b-a) = 0 (neg - pos != pos)"
+    $asm.putc "    // 1       1       | never"
+    "((#{signBit}(b) != #{signBit}(a)) && (#{signBit}(b-a) == #{signBit}(a)))"
+end
+
+def cloopMulOverflowTest(operands, type)
+    case type
+    when :int32
+        tempType = "uint32_t"
+    else
+        raise "Unimplemented type"
+    end
+    $asm.putc "    #{tempType} a = #{operands[0].clValue(type)};"
+    $asm.putc "    #{tempType} b = #{operands[1].clValue(type)};"
+    "((b | a) >> 15)"
+end
+
+def cloopEmitOpAndBranchIfOverflow(operands, operator, type)
+    $asm.putc "{"
+
+    # Emit the overflow test based on the operands and the type:
+    case operator
+    when "+"; overflowTest = cloopAddOverflowTest(operands, type)
+    when "-"; overflowTest = cloopSubOverflowTest(operands, type)
+    when "*"; overflowTest = cloopMulOverflowTest(operands, type)
+    else
+        raise "Unimplemented opeartor"
+    end
+
+    $asm.putc "    bool didOverflow = #{overflowTest};"
+    $asm.putc "    #{operands[1].clValue(type)} = #{operands[1].clValue(type)} #{operator} #{operands[0].clValue(type)};"
+    $asm.putc "    if (didOverflow)"
+    $asm.putc "        goto #{operands[2].cLabel};"
+    $asm.putc "}"
+end
+
+# operands: callTarget, currentFrame, currentPC
+def cloopEmitCallSlowPath(operands)
+    $asm.putc "{"
+    $asm.putc "    SlowPathReturnType result = #{operands[0].cLabel}(#{operands[1].clDump}, #{operands[2].clDump});"
+    $asm.putc "    decodeResult(result, t0.vp, t1.vp);"
+    $asm.putc "}"
+end
+
+def cloopEmitCallSlowPathVoid(operands)
+    $asm.putc "#{operands[0].cLabel}(#{operands[1].clDump}, #{operands[2].clDump});"
+end
+
+class Instruction
+    @@didReturnFromJSLabelCounter = 0
+
+    def lowerC_LOOP
+        $asm.codeOrigin codeOriginString if $enableCodeOriginComments
+        $asm.annotation annotation if $enableInstrAnnotations && (opcode != "cloopDo")
+
+        case opcode
+        when "addi"
+            cloopEmitOperation(operands, :int32, "+")
+        when "addq"
+            cloopEmitOperation(operands, :int64, "+")
+        when "addp"
+            cloopEmitOperation(operands, :int, "+")
+
+        when "andi"
+            cloopEmitOperation(operands, :int32, "&")
+        when "andq"
+            cloopEmitOperation(operands, :int64, "&")
+        when "andp"
+            cloopEmitOperation(operands, :int, "&")
+
+        when "ori"
+            cloopEmitOperation(operands, :int32, "|")
+        when "orq"
+            cloopEmitOperation(operands, :int64, "|")
+        when "orp"
+            cloopEmitOperation(operands, :int, "|")
+
+        when "xori"
+            cloopEmitOperation(operands, :int32, "^")
+        when "xorq"
+            cloopEmitOperation(operands, :int64, "^")
+        when "xorp"
+            cloopEmitOperation(operands, :int, "^")
+
+        when "lshifti"
+            cloopEmitShiftOperation(operands, :int32, "<<")
+        when "lshiftq"
+            cloopEmitShiftOperation(operands, :int64, "<<")
+        when "lshiftp"
+            cloopEmitShiftOperation(operands, :int, "<<")
+
+        when "rshifti"
+            cloopEmitShiftOperation(operands, :int32, ">>")
+        when "rshiftq"
+            cloopEmitShiftOperation(operands, :int64, ">>")
+        when "rshiftp"
+            cloopEmitShiftOperation(operands, :int, ">>")
+
+        when "urshifti"
+            cloopEmitShiftOperation(operands, :uint32, ">>")
+        when "urshiftq"
+            cloopEmitShiftOperation(operands, :uint64, ">>")
+        when "urshiftp"
+            cloopEmitShiftOperation(operands, :uint, ">>")
+
+        when "muli"
+            cloopEmitOperation(operands, :int32, "*")
+        when "mulq"
+            cloopEmitOperation(operands, :int64, "*")
+        when "mulp"
+            cloopEmitOperation(operands, :int, "*")
+
+        when "subi"
+            cloopEmitOperation(operands, :int32, "-")
+        when "subq"
+            cloopEmitOperation(operands, :int64, "-")
+        when "subp"
+            cloopEmitOperation(operands, :int, "-")
+
+        when "negi"
+            cloopEmitUnaryOperation(operands, :int32, "-")
+        when "negq"
+            cloopEmitUnaryOperation(operands, :int64, "-")
+        when "negp"
+            cloopEmitUnaryOperation(operands, :int, "-")
+
+        when "noti"
+            cloopEmitUnaryOperation(operands, :int32, "!")
+
+        when "loadi"
+            $asm.putc "#{operands[1].clValue(:uint)} = #{operands[0].uint32MemRef};"
+            # There's no need to call clearHighWord() here because the above will
+            # automatically take care of 0 extension.
+        when "loadis"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].int32MemRef};"
+        when "loadq"
+            $asm.putc "#{operands[1].clValue(:int64)} = #{operands[0].int64MemRef};"
+        when "loadp"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].intMemRef};"
+        when "storei"
+            $asm.putc "#{operands[1].int32MemRef} = #{operands[0].clValue(:int32)};"
+        when "storeq"
+            $asm.putc "#{operands[1].int64MemRef} = #{operands[0].clValue(:int64)};"
+        when "storep"
+            $asm.putc "#{operands[1].intMemRef} = #{operands[0].clValue(:int)};"
+        when "loadb"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].uint8MemRef};"
+        when "loadbs"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].int8MemRef};"
+        when "storeb"
+            $asm.putc "#{operands[1].uint8MemRef} = #{operands[0].clValue(:int8)};"
+        when "loadh"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].uint16MemRef};"
+        when "loadhs"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].int16MemRef};"
+        when "storeh"
+            $asm.putc "*#{operands[1].uint16MemRef} = #{operands[0].clValue(:int16)};"
+        when "loadd"
+            $asm.putc "#{operands[1].clValue(:double)} = #{operands[0].dblMemRef};"
+        when "stored"
+            $asm.putc "#{operands[1].dblMemRef} = #{operands[0].clValue(:double)};"
+
+        when "addd"
+            cloopEmitOperation(operands, :double, "+")
+        when "divd"
+            cloopEmitOperation(operands, :double, "/")
+        when "subd"
+            cloopEmitOperation(operands, :double, "-")
+        when "muld"
+            cloopEmitOperation(operands, :double, "*")
+
+        # Convert an int value to its double equivalent, and store it in a double register.
+        when "ci2d"
+            $asm.putc "#{operands[1].clValue(:double)} = #{operands[0].clValue(:int32)};"
+            
+        when "bdeq"
+            cloopEmitCompareAndBranch(operands, :double, "==")
+        when "bdneq"
+            cloopEmitCompareAndBranch(operands, :double, "!=")
+        when "bdgt"
+            cloopEmitCompareAndBranch(operands, :double, ">");
+        when "bdgteq"
+            cloopEmitCompareAndBranch(operands, :double, ">=");
+        when "bdlt"
+            cloopEmitCompareAndBranch(operands, :double, "<");
+        when "bdlteq"
+            cloopEmitCompareAndBranch(operands, :double, "<=");
+
+        when "bdequn"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, "==")
+        when "bdnequn"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, "!=")
+        when "bdgtun"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, ">")
+        when "bdgtequn"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, ">=")
+        when "bdltun"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, "<")
+        when "bdltequn"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, "<=")
+
+        when "td2i"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].clValue(:double)};"
+            $asm.putc "#{operands[1].clDump}.clearHighWord();"
+
+        when "bcd2i"  # operands: srcDbl dstInt slowPath
+            $asm.putc "{"
+            $asm.putc "    double d = #{operands[0].clValue(:double)};"
+            $asm.putc "    const int32_t asInt32 = int32_t(d);"
+            $asm.putc "    if (asInt32 != d || (!asInt32 && std::signbit(d))) // true for -0.0"
+            $asm.putc "        goto  #{operands[2].cLabel};"
+            $asm.putc "    #{operands[1].clValue} = asInt32;"            
+            $asm.putc "    #{operands[1].clDump}.clearHighWord();"
+            $asm.putc "}"
+
+        when "move"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].clValue(:int)};"
+        when "sxi2q"
+            $asm.putc "#{operands[1].clValue(:int64)} = #{operands[0].clValue(:int32)};"
+        when "zxi2q"
+            $asm.putc "#{operands[1].clValue(:uint64)} = #{operands[0].clValue(:uint32)};"
+        when "nop"
+            $asm.putc "// nop"
+        when "bbeq"
+            cloopEmitCompareAndBranch(operands, :int8, "==")
+        when "bieq"
+            cloopEmitCompareAndBranch(operands, :int32, "==")
+        when "bqeq"
+            cloopEmitCompareAndBranch(operands, :int64, "==")
+        when "bpeq"
+            cloopEmitCompareAndBranch(operands, :int, "==")
+
+        when "bbneq"
+            cloopEmitCompareAndBranch(operands, :int8, "!=")
+        when "bineq"
+            cloopEmitCompareAndBranch(operands, :int32, "!=")
+        when "bqneq"
+            cloopEmitCompareAndBranch(operands, :int64, "!=")
+        when "bpneq"
+            cloopEmitCompareAndBranch(operands, :int, "!=")
+
+        when "bba"
+            cloopEmitCompareAndBranch(operands, :uint8, ">")
+        when "bia"
+            cloopEmitCompareAndBranch(operands, :uint32, ">")
+        when "bqa"
+            cloopEmitCompareAndBranch(operands, :uint64, ">")
+        when "bpa"
+            cloopEmitCompareAndBranch(operands, :uint, ">")
+
+        when "bbaeq"
+            cloopEmitCompareAndBranch(operands, :uint8, ">=")
+        when "biaeq"
+            cloopEmitCompareAndBranch(operands, :uint32, ">=")
+        when "bqaeq"
+            cloopEmitCompareAndBranch(operands, :uint64, ">=")
+        when "bpaeq"
+            cloopEmitCompareAndBranch(operands, :uint, ">=")
+
+        when "bbb"
+            cloopEmitCompareAndBranch(operands, :uint8, "<")
+        when "bib"
+            cloopEmitCompareAndBranch(operands, :uint32, "<")
+        when "bqb"
+            cloopEmitCompareAndBranch(operands, :uint64, "<")
+        when "bpb"
+            cloopEmitCompareAndBranch(operands, :uint, "<")
+
+        when "bbbeq"
+            cloopEmitCompareAndBranch(operands, :uint8, "<=")
+        when "bibeq"
+            cloopEmitCompareAndBranch(operands, :uint32, "<=")
+        when "bqbeq"
+            cloopEmitCompareAndBranch(operands, :uint64, "<=")
+        when "bpbeq"
+            cloopEmitCompareAndBranch(operands, :uint, "<=")
+
+        when "bbgt"
+            cloopEmitCompareAndBranch(operands, :int8, ">")
+        when "bigt"
+            cloopEmitCompareAndBranch(operands, :int32, ">")
+        when "bqgt"
+            cloopEmitCompareAndBranch(operands, :int64, ">")
+        when "bpgt"
+            cloopEmitCompareAndBranch(operands, :int, ">")
+
+        when "bbgteq"
+            cloopEmitCompareAndBranch(operands, :int8, ">=")
+        when "bigteq"
+            cloopEmitCompareAndBranch(operands, :int32, ">=")
+        when "bqgteq"
+            cloopEmitCompareAndBranch(operands, :int64, ">=")
+        when "bpgteq"
+            cloopEmitCompareAndBranch(operands, :int, ">=")
+
+        when "bblt"
+            cloopEmitCompareAndBranch(operands, :int8, "<")
+        when "bilt"
+            cloopEmitCompareAndBranch(operands, :int32, "<")
+        when "bqlt"
+            cloopEmitCompareAndBranch(operands, :int64, "<")
+        when "bplt"
+            cloopEmitCompareAndBranch(operands, :int, "<")
+
+        when "bblteq"
+            cloopEmitCompareAndBranch(operands, :int8, "<=")
+        when "bilteq"
+            cloopEmitCompareAndBranch(operands, :int32, "<=")
+        when "bqlteq"
+            cloopEmitCompareAndBranch(operands, :int64, "<=")
+        when "bplteq"
+            cloopEmitCompareAndBranch(operands, :int, "<=")
+
+        when "btbz"
+            cloopEmitTestAndBranchIf(operands, :int8, "== 0", operands[-1].cLabel)
+        when "btiz"
+            cloopEmitTestAndBranchIf(operands, :int32, "== 0", operands[-1].cLabel)
+        when "btqz"
+            cloopEmitTestAndBranchIf(operands, :int64, "== 0", operands[-1].cLabel)
+        when "btpz"
+            cloopEmitTestAndBranchIf(operands, :int, "== 0", operands[-1].cLabel)
+
+        when "btbnz"
+            cloopEmitTestAndBranchIf(operands, :int8, "!= 0", operands[-1].cLabel)
+        when "btinz"
+            cloopEmitTestAndBranchIf(operands, :int32, "!= 0", operands[-1].cLabel)
+        when "btqnz"
+            cloopEmitTestAndBranchIf(operands, :int64, "!= 0", operands[-1].cLabel)
+        when "btpnz"
+            cloopEmitTestAndBranchIf(operands, :int, "!= 0", operands[-1].cLabel)
+
+        when "btbs"
+            cloopEmitTestAndBranchIf(operands, :int8, "< 0", operands[-1].cLabel)
+        when "btis"
+            cloopEmitTestAndBranchIf(operands, :int32, "< 0", operands[-1].cLabel)
+        when "btqs"
+            cloopEmitTestAndBranchIf(operands, :int64, "< 0", operands[-1].cLabel)
+        when "btps"
+            cloopEmitTestAndBranchIf(operands, :int, "< 0", operands[-1].cLabel)
+
+        # For jmp, we do not want to assume that we have COMPUTED_GOTO support.
+        # Fortunately, the only times we should ever encounter indirect jmps is
+        # when the jmp target is a CLoop opcode (by design).
+        #
+        # Hence, we check if the jmp target is a known label reference. If so,
+        # we can emit a goto directly. If it is not a known target, then we set
+        # the target in the opcode, and dispatch to it via whatever dispatch
+        # mechanism is in used.
+        when "jmp"
+            if operands[0].is_a? LocalLabelReference or operands[0].is_a? LabelReference
+                # Handles jumps local or global labels.
+                $asm.putc "goto #{operands[0].cLabel};"
+            else
+                # Handles jumps to some computed target.
+                # NOTE: must be an opcode handler or a llint glue helper.
+                $asm.putc "opcode = #{operands[0].clValue(:opcode)};"
+                $asm.putc "DISPATCH_OPCODE();"
+            end
+
+        when "call"
+            $asm.putc "CRASH(); // generic call instruction not supported by design!"
+        when "break"
+            $asm.putc "CRASH(); // break instruction not implemented."
+        when "ret"
+            $asm.putc "opcode = lr.opcode;"
+            $asm.putc "DISPATCH_OPCODE();"
+
+        when "cbeq"
+            cloopEmitCompareAndSet(operands, :uint8, "==")
+        when "cieq"
+            cloopEmitCompareAndSet(operands, :uint32, "==")
+        when "cqeq"
+            cloopEmitCompareAndSet(operands, :uint64, "==")
+        when "cpeq"
+            cloopEmitCompareAndSet(operands, :uint, "==")
+
+        when "cbneq"
+            cloopEmitCompareAndSet(operands, :uint8, "!=")
+        when "cineq"
+            cloopEmitCompareAndSet(operands, :uint32, "!=")
+        when "cqneq"
+            cloopEmitCompareAndSet(operands, :uint64, "!=")
+        when "cpneq"
+            cloopEmitCompareAndSet(operands, :uint, "!=")
+
+        when "cba"
+            cloopEmitCompareAndSet(operands, :uint8, ">")
+        when "cia"
+            cloopEmitCompareAndSet(operands, :uint32, ">")
+        when "cqa"
+            cloopEmitCompareAndSet(operands, :uint64, ">")
+        when "cpa"
+            cloopEmitCompareAndSet(operands, :uint, ">")
+
+        when "cbaeq"
+            cloopEmitCompareAndSet(operands, :uint8, ">=")
+        when "ciaeq"
+            cloopEmitCompareAndSet(operands, :uint32, ">=")
+        when "cqaeq"
+            cloopEmitCompareAndSet(operands, :uint64, ">=")
+        when "cpaeq"
+            cloopEmitCompareAndSet(operands, :uint, ">=")
+
+        when "cbb"
+            cloopEmitCompareAndSet(operands, :uint8, "<")
+        when "cib"
+            cloopEmitCompareAndSet(operands, :uint32, "<")
+        when "cqb"
+            cloopEmitCompareAndSet(operands, :uint64, "<")
+        when "cpb"
+            cloopEmitCompareAndSet(operands, :uint, "<")
+
+        when "cbbeq"
+            cloopEmitCompareAndSet(operands, :uint8, "<=")
+        when "cibeq"
+            cloopEmitCompareAndSet(operands, :uint32, "<=")
+        when "cqbeq"
+            cloopEmitCompareAndSet(operands, :uint64, "<=")
+        when "cpbeq"
+            cloopEmitCompareAndSet(operands, :uint, "<=")
+
+        when "cbgt"
+            cloopEmitCompareAndSet(operands, :int8, ">")
+        when "cigt"
+            cloopEmitCompareAndSet(operands, :int32, ">")
+        when "cqgt"
+            cloopEmitCompareAndSet(operands, :int64, ">")
+        when "cpgt"
+            cloopEmitCompareAndSet(operands, :int, ">")
+
+        when "cbgteq"
+            cloopEmitCompareAndSet(operands, :int8, ">=")
+        when "cigteq"
+            cloopEmitCompareAndSet(operands, :int32, ">=")
+        when "cqgteq"
+            cloopEmitCompareAndSet(operands, :int64, ">=")
+        when "cpgteq"
+            cloopEmitCompareAndSet(operands, :int, ">=")
+
+        when "cblt"
+            cloopEmitCompareAndSet(operands, :int8, "<")
+        when "cilt"
+            cloopEmitCompareAndSet(operands, :int32, "<")
+        when "cqlt"
+            cloopEmitCompareAndSet(operands, :int64, "<")
+        when "cplt"
+            cloopEmitCompareAndSet(operands, :int, "<")
+
+        when "cblteq"
+            cloopEmitCompareAndSet(operands, :int8, "<=")
+        when "cilteq"
+            cloopEmitCompareAndSet(operands, :int32, "<=")
+        when "cqlteq"
+            cloopEmitCompareAndSet(operands, :int64, "<=")
+        when "cplteq"
+            cloopEmitCompareAndSet(operands, :int, "<=")
+
+        when "tbs"
+            cloopEmitTestSet(operands, :int8, "< 0")
+        when "tis"
+            cloopEmitTestSet(operands, :int32, "< 0")
+        when "tqs"
+            cloopEmitTestSet(operands, :int64, "< 0")
+        when "tps"
+            cloopEmitTestSet(operands, :int, "< 0")
+
+        when "tbz"
+            cloopEmitTestSet(operands, :int8, "== 0")
+        when "tiz"
+            cloopEmitTestSet(operands, :int32, "== 0")
+        when "tqz"
+            cloopEmitTestSet(operands, :int64, "== 0")
+        when "tpz"
+            cloopEmitTestSet(operands, :int, "== 0")
+
+        when "tbnz"
+            cloopEmitTestSet(operands, :int8, "!= 0")
+        when "tinz"
+            cloopEmitTestSet(operands, :int32, "!= 0")
+        when "tqnz"
+            cloopEmitTestSet(operands, :int64, "!= 0")
+        when "tpnz"
+            cloopEmitTestSet(operands, :int, "!= 0")
+
+        # 64-bit instruction: cdqi (based on X64)
+        # Sign extends the lower 32 bits of t0, but put the sign extension into
+        # the lower 32 bits of t1. Leave the upper 32 bits of t0 and t1 unchanged.
+        when "cdqi"
+            $asm.putc "{"
+            $asm.putc "    int64_t temp = t0.i32; // sign extend the low 32bit"
+            $asm.putc "    t0.i32 = temp; // low word"
+            $asm.putc "    t0.clearHighWord();"
+            $asm.putc "    t1.i32 = uint64_t(temp) >> 32; // high word"
+            $asm.putc "    t1.clearHighWord();"
+            $asm.putc "}"
+
+        # 64-bit instruction: idivi op1 (based on X64)
+        # Divide a 64-bit integer numerator by the specified denominator.
+        # The numerator is specified in t0 and t1 as follows:
+        #     1. low 32 bits of the numerator is in the low 32 bits of t0.
+        #     2. high 32 bits of the numerator is in the low 32 bits of t1.
+        #
+        # The resultant quotient is a signed 32-bit int, and is to be stored
+        # in the lower 32 bits of t0.
+        # The resultant remainder is a signed 32-bit int, and is to be stored
+        # in the lower 32 bits of t1.
+        when "idivi"
+            # Divide t1,t0 (EDX,EAX) by the specified arg, and store the remainder in t1,
+            # and quotient in t0:
+            $asm.putc "{"
+            $asm.putc "    int64_t dividend = (int64_t(t1.u32) << 32) | t0.u32;"
+            $asm.putc "    int64_t divisor = #{operands[0].clValue(:int)};"
+            $asm.putc "    t1.i32 = dividend % divisor; // remainder"
+            $asm.putc "    t1.clearHighWord();"
+            $asm.putc "    t0.i32 = dividend / divisor; // quotient"
+            $asm.putc "    t0.clearHighWord();"
+            $asm.putc "}"
+
+        # 32-bit instruction: fii2d int32LoOp int32HiOp dblOp (based on ARMv7)
+        # Decode 2 32-bit ints (low and high) into a 64-bit double.
+        when "fii2d"
+            $asm.putc "#{operands[2].clValue(:double)} = Ints2Double(#{operands[0].clValue(:uint32)}, #{operands[1].clValue(:uint32)});"
+
+        # 32-bit instruction: f2dii dblOp int32LoOp int32HiOp (based on ARMv7)
+        # Encode a 64-bit double into 2 32-bit ints (low and high).
+        when "fd2ii"
+            $asm.putc "Double2Ints(#{operands[0].clValue(:double)}, #{operands[1].clValue(:uint32)}, #{operands[2].clValue(:uint32)});"
+
+        # 64-bit instruction: fq2d int64Op dblOp (based on X64)
+        # Copy a bit-encoded double in a 64-bit int register to a double register.
+        when "fq2d"
+            $asm.putc "#{operands[1].clValue(:double)} = #{operands[0].clValue(:castToDouble)};"
+
+        # 64-bit instruction: fd2q dblOp int64Op (based on X64 instruction set)
+        # Copy a double as a bit-encoded double into a 64-bit int register.
+        when "fd2q"
+            $asm.putc "#{operands[1].clValue(:int64)} = #{operands[0].clValue(:castToInt64)};"
+
+        when "leai"
+            operands[0].cloopEmitLea(operands[1], :int32)
+        when "leap"
+            operands[0].cloopEmitLea(operands[1], :int)
+
+        when "baddio"
+            cloopEmitOpAndBranchIfOverflow(operands, "+", :int32)
+        when "bsubio"
+            cloopEmitOpAndBranchIfOverflow(operands, "-", :int32)
+        when "bmulio"
+            cloopEmitOpAndBranchIfOverflow(operands, "*", :int32)
+
+        when "baddis"
+            cloopEmitOpAndBranch(operands, "+", :int32, "< 0")
+        when "baddiz"
+            cloopEmitOpAndBranch(operands, "+", :int32, "== 0")
+        when "baddinz"
+            cloopEmitOpAndBranch(operands, "+", :int32, "!= 0")
+
+        when "baddqs"
+            cloopEmitOpAndBranch(operands, "+", :int64, "< 0")
+        when "baddqz"
+            cloopEmitOpAndBranch(operands, "+", :int64, "== 0")
+        when "baddqnz"
+            cloopEmitOpAndBranch(operands, "+", :int64, "!= 0")
+
+        when "baddps"
+            cloopEmitOpAndBranch(operands, "+", :int, "< 0")
+        when "baddpz"
+            cloopEmitOpAndBranch(operands, "+", :int, "== 0")
+        when "baddpnz"
+            cloopEmitOpAndBranch(operands, "+", :int, "!= 0")
+
+        when "bsubis"
+            cloopEmitOpAndBranch(operands, "-", :int32, "< 0")
+        when "bsubiz"
+            cloopEmitOpAndBranch(operands, "-", :int32, "== 0")
+        when "bsubinz"
+            cloopEmitOpAndBranch(operands, "-", :int32, "!= 0")
+
+        when "borris"
+            cloopEmitOpAndBranch(operands, "|", :int32, "< 0")
+        when "borriz"
+            cloopEmitOpAndBranch(operands, "|", :int32, "== 0")
+        when "borrinz"
+            cloopEmitOpAndBranch(operands, "|", :int32, "!= 0")
+            
+        when "memfence"
+
+        when "push"
+            operands.each {
+                | op |
+                $asm.putc "PUSH(#{op.clDump});"
+            }
+        when "pop"
+            operands.each {
+                | op |
+                $asm.putc "POP(#{op.clDump});"
+            }
+
+
+        # A convenience and compact call to crash because we don't want to use
+        # the generic llint crash mechanism which relies on the availability
+        # of the call instruction (which cannot be implemented in a generic
+        # way, and can be abused if we made it just work for this special case).
+        # Using a special cloopCrash instruction is cleaner.
+        when "cloopCrash"
+            $asm.putc "CRASH();"
+
+        # We can't rely on the llint JS call mechanism which actually makes
+        # use of the call instruction. Instead, we just implement JS calls
+        # as an opcode dispatch.
+        when "cloopCallJSFunction"
+            @@didReturnFromJSLabelCounter += 1
+            $asm.putc "lr.opcode = getOpcode(llint_cloop_did_return_from_js_#{@@didReturnFromJSLabelCounter});"
+            $asm.putc "opcode = #{operands[0].clValue(:opcode)};"
+            $asm.putc "DISPATCH_OPCODE();"
+            $asm.putsLabel("llint_cloop_did_return_from_js_#{@@didReturnFromJSLabelCounter}", false)
+
+        # We can't do generic function calls with an arbitrary set of args, but
+        # fortunately we don't have to here. All native function calls always
+        # have a fixed prototype of 1 args: the passed ExecState.
+        when "cloopCallNative"
+            $asm.putc "nativeFunc = #{operands[0].clValue(:nativeFunc)};"
+            $asm.putc "functionReturnValue = JSValue::decode(nativeFunc(t0.execState));"
+            $asm.putc "#if USE(JSVALUE32_64)"
+            $asm.putc "    t1.i = functionReturnValue.tag();"
+            $asm.putc "    t0.i = functionReturnValue.payload();"
+            $asm.putc "#else // USE_JSVALUE64)"
+            $asm.putc "    t0.encodedJSValue = JSValue::encode(functionReturnValue);"
+            $asm.putc "#endif // USE_JSVALUE64)"            
+
+        # We can't do generic function calls with an arbitrary set of args, but
+        # fortunately we don't have to here. All slow path function calls always
+        # have a fixed prototype too. See cloopEmitCallSlowPath() for details.
+        when "cloopCallSlowPath"
+            cloopEmitCallSlowPath(operands)
+
+        when "cloopCallSlowPathVoid"
+            cloopEmitCallSlowPathVoid(operands)
+
+        # For debugging only. This is used to insert instrumentation into the
+        # generated LLIntAssembly.h during llint development only. Do not use
+        # for production code.
+        when "cloopDo"
+            $asm.putc "#{annotation}"
+
+        else
+            lowerDefault
+        end
+    end
+end
diff --git a/offlineasm/config.rb b/offlineasm/config.rb
new file mode 100644
index 0000000..88a0cf5
--- /dev/null
+++ b/offlineasm/config.rb
@@ -0,0 +1,80 @@
+# Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+$preferredCommentStartColumn = 60
+
+
+# Turns on dumping of the count of labels.
+# For example,  the output will look like this:
+#
+#    ...
+#    OFFLINE_ASM_LOCAL_LABEL(_offlineasm_4_functionArityCheck__continue)  // Local Label 24 .
+#    ...
+#    OFFLINE_ASM_GLOBAL_LABEL(llint_op_enter)  // Global Label 8 .
+#    ...
+#
+$enableLabelCountComments = false
+
+# Turns on dumping of source file and line numbers in the output file.
+# For example,  the output will look like this:
+#
+#    ...
+#    "\tmovq -8(%r13), %rcx\n"   // JavaScriptCore/llint/LowLevelInterpreter64.asm:185
+#    "\tmovl 52(%rcx), %ecx\n"   // JavaScriptCore/llint/LowLevelInterpreter64.asm:186
+#    ...
+#
+$enableCodeOriginComments = true
+
+# Turns on recording and dumping of annotations in the generated output file.
+# An annotations can be specified for each instruction in the source asm files.
+# For example, the output will look like this:
+#
+#     ...
+#    "\tmovq -8(%r13), %rcx\n"   // t2<CodeBlock> = cfr.CodeBlock
+#    "\tmovl 52(%rcx), %ecx\n"   // t2<size_t> = t2<CodeBlock>.m_numVars
+#     ...
+#
+$enableInstrAnnotations = false
+
+# Turns on generation of DWARF2 debug annotions for file and line numbers.
+# Allows for source level debuging of the original .asm files in a debugger.
+#
+def shouldEnableDebugAnnotations()
+    if ENV['GCC_VERSION'] =~ /\.clang\./ and ENV['DT_TOOLCHAIN_DIR'] =~ /Xcode.app/
+        clangVersionOut = %x`xcrun clang --version`
+        if ($? == 0)
+            # clang version 800.0.12 or higher is required for debug annotations
+            versionMatch = /clang-(\d{3,}).(\d{1,3}).(\d{1,3})/.match(clangVersionOut)
+            if versionMatch.length >= 4
+                totalVersion = versionMatch[1].to_i * 1000000 + versionMatch[2].to_i * 1000 + versionMatch[3].to_i
+                if totalVersion >= 800000012
+                    return true
+                end
+            end
+        end
+    end
+
+    false
+end
+
+$enableDebugAnnotations = shouldEnableDebugAnnotations()
diff --git a/offlineasm/generate_offset_extractor.rb b/offlineasm/generate_offset_extractor.rb
new file mode 100644
index 0000000..aafa934
--- /dev/null
+++ b/offlineasm/generate_offset_extractor.rb
@@ -0,0 +1,149 @@
+#!/usr/bin/env ruby
+
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+$: << File.dirname(__FILE__)
+
+require "config"
+require "backends"
+require "digest/sha1"
+require "offsets"
+require "parser"
+require "self_hash"
+require "settings"
+require "transform"
+
+IncludeFile.processIncludeOptions()
+
+inputFlnm = ARGV.shift
+outputFlnm = ARGV.shift
+
+validBackends = ARGV.shift
+if validBackends
+    $stderr.puts "Only dealing with backends: #{validBackends}"
+    includeOnlyBackends(validBackends.split(","))
+end
+
+def emitMagicNumber
+    OFFSET_MAGIC_NUMBERS.each {
+        | number |
+        $output.puts "unsigned(#{number}),"
+    }
+end
+
+inputHash = "// offlineasm input hash: #{parseHash(inputFlnm)} #{selfHash}"
+
+if FileTest.exist? outputFlnm
+    File.open(outputFlnm, "r") {
+        | inp |
+        firstLine = inp.gets
+        if firstLine and firstLine.chomp == inputHash
+            $stderr.puts "offlineasm: Nothing changed."
+            exit 0
+        end
+    }
+end
+
+originalAST = parse(inputFlnm)
+
+#
+# Optimize the AST to make configuration extraction faster. This reduces the AST to a form
+# that only contains the things that matter for our purposes: offsets, sizes, and if
+# statements.
+#
+
+class Node
+    def offsetsPruneTo(sequence)
+        children.each {
+            | child |
+            child.offsetsPruneTo(sequence)
+        }
+    end
+    
+    def offsetsPrune
+        result = Sequence.new(codeOrigin, [])
+        offsetsPruneTo(result)
+        result
+    end
+end
+
+class IfThenElse
+    def offsetsPruneTo(sequence)
+        ifThenElse = IfThenElse.new(codeOrigin, predicate, thenCase.offsetsPrune)
+        ifThenElse.elseCase = elseCase.offsetsPrune
+        sequence.list << ifThenElse
+    end
+end
+
+class StructOffset
+    def offsetsPruneTo(sequence)
+        sequence.list << self
+    end
+end
+
+class Sizeof
+    def offsetsPruneTo(sequence)
+        sequence.list << self
+    end
+end
+
+prunedAST = originalAST.offsetsPrune
+
+File.open(outputFlnm, "w") {
+    | outp |
+    $output = outp
+    outp.puts inputHash
+    length = 0
+    emitCodeInAllConfigurations(prunedAST) {
+        | settings, ast, backend, index |
+        offsetsList = ast.filter(StructOffset).uniq.sort
+        sizesList = ast.filter(Sizeof).uniq.sort
+        length += OFFSET_HEADER_MAGIC_NUMBERS.size + (OFFSET_MAGIC_NUMBERS.size + 1) * (1 + offsetsList.size + sizesList.size)
+    }
+    outp.puts "static const unsigned extractorTable[#{length}] = {"
+    emitCodeInAllConfigurations(prunedAST) {
+        | settings, ast, backend, index |
+        OFFSET_HEADER_MAGIC_NUMBERS.each {
+            | number |
+            $output.puts "unsigned(#{number}),"
+        }
+
+        offsetsList = ast.filter(StructOffset).uniq.sort
+        sizesList = ast.filter(Sizeof).uniq.sort
+        
+        emitMagicNumber
+        outp.puts "#{index},"
+        offsetsList.each {
+            | offset |
+            emitMagicNumber
+            outp.puts "OFFLINE_ASM_OFFSETOF(#{offset.struct}, #{offset.field}),"
+        }
+        sizesList.each {
+            | offset |
+            emitMagicNumber
+            outp.puts "sizeof(#{offset.struct}),"
+        }
+    }
+    outp.puts "};"
+}
diff --git a/offlineasm/instructions.rb b/offlineasm/instructions.rb
new file mode 100644
index 0000000..2449287
--- /dev/null
+++ b/offlineasm/instructions.rb
@@ -0,0 +1,338 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "set"
+
+# Interesting invariant, which we take advantage of: branching instructions
+# always begin with "b", and no non-branching instructions begin with "b".
+# Terminal instructions are "jmp" and "ret".
+
+MACRO_INSTRUCTIONS =
+    [
+     "emit",
+     "addi",
+     "andi",
+     "lshifti",
+     "lshiftp",
+     "lshiftq",
+     "muli",
+     "negi",
+     "negp",
+     "negq",
+     "noti",
+     "ori",
+     "rshifti",
+     "urshifti",
+     "rshiftp",
+     "urshiftp",
+     "rshiftq",
+     "urshiftq",
+     "subi",
+     "xori",
+     "loadi",
+     "loadis",
+     "loadb",
+     "loadbs",
+     "loadh",
+     "loadhs",
+     "storei",
+     "storeb",
+     "loadd",
+     "moved",
+     "stored",
+     "addd",
+     "divd",
+     "subd",
+     "muld",
+     "sqrtd",
+     "ci2d",
+     "fii2d", # usage: fii2d <gpr with least significant bits>, <gpr with most significant bits>, <fpr>
+     "fd2ii", # usage: fd2ii <fpr>, <gpr with least significant bits>, <gpr with most significant bits>
+     "fq2d",
+     "fd2q",
+     "bdeq",
+     "bdneq",
+     "bdgt",
+     "bdgteq",
+     "bdlt",
+     "bdlteq",
+     "bdequn",
+     "bdnequn",
+     "bdgtun",
+     "bdgtequn",
+     "bdltun",
+     "bdltequn",
+     "btd2i",
+     "td2i",
+     "bcd2i",
+     "movdz",
+     "pop",
+     "push",
+     "move",
+     "sxi2q",
+     "zxi2q",
+     "nop",
+     "bieq",
+     "bineq",
+     "bia",
+     "biaeq",
+     "bib",
+     "bibeq",
+     "bigt",
+     "bigteq",
+     "bilt",
+     "bilteq",
+     "bbeq",
+     "bbneq",
+     "bba",
+     "bbaeq",
+     "bbb",
+     "bbbeq",
+     "bbgt",
+     "bbgteq",
+     "bblt",
+     "bblteq",
+     "btis",
+     "btiz",
+     "btinz",
+     "btbs",
+     "btbz",
+     "btbnz",
+     "jmp",
+     "baddio",
+     "baddis",
+     "baddiz",
+     "baddinz",
+     "bsubio",
+     "bsubis",
+     "bsubiz",
+     "bsubinz",
+     "bmulio",
+     "bmulis",
+     "bmuliz",
+     "bmulinz",
+     "borio",
+     "boris",
+     "boriz",
+     "borinz",
+     "break",
+     "call",
+     "ret",
+     "cbeq",
+     "cbneq",
+     "cba",
+     "cbaeq",
+     "cbb",
+     "cbbeq",
+     "cbgt",
+     "cbgteq",
+     "cblt",
+     "cblteq",
+     "cieq",
+     "cineq",
+     "cia",
+     "ciaeq",
+     "cib",
+     "cibeq",
+     "cigt",
+     "cigteq",
+     "cilt",
+     "cilteq",
+     "tis",
+     "tiz",
+     "tinz",
+     "tbs",
+     "tbz",
+     "tbnz",
+     "tps",
+     "tpz",
+     "tpnz",
+     "peek",
+     "poke",
+     "bpeq",
+     "bpneq",
+     "bpa",
+     "bpaeq",
+     "bpb",
+     "bpbeq",
+     "bpgt",
+     "bpgteq",
+     "bplt",
+     "bplteq",
+     "addp",
+     "mulp",
+     "andp",
+     "orp",
+     "subp",
+     "xorp",
+     "loadp",
+     "cpeq",
+     "cpneq",
+     "cpa",
+     "cpaeq",
+     "cpb",
+     "cpbeq",
+     "cpgt",
+     "cpgteq",
+     "cplt",
+     "cplteq",
+     "storep",
+     "btps",
+     "btpz",
+     "btpnz",
+     "baddpo",
+     "baddps",
+     "baddpz",
+     "baddpnz",
+     "tqs",
+     "tqz",
+     "tqnz",
+     "bqeq",
+     "bqneq",
+     "bqa",
+     "bqaeq",
+     "bqb",
+     "bqbeq",
+     "bqgt",
+     "bqgteq",
+     "bqlt",
+     "bqlteq",
+     "addq",
+     "mulq",
+     "andq",
+     "orq",
+     "subq",
+     "xorq",
+     "loadq",
+     "cqeq",
+     "cqneq",
+     "cqa",
+     "cqaeq",
+     "cqb",
+     "cqbeq",
+     "cqgt",
+     "cqgteq",
+     "cqlt",
+     "cqlteq",
+     "storeq",
+     "btqs",
+     "btqz",
+     "btqnz",
+     "baddqo",
+     "baddqs",
+     "baddqz",
+     "baddqnz",
+     "bo",
+     "bs",
+     "bz",
+     "bnz",
+     "leai",
+     "leap",
+     "memfence"
+    ]
+
+X86_INSTRUCTIONS =
+    [
+     "cdqi",
+     "idivi"
+    ]
+
+ARM_INSTRUCTIONS =
+    [
+     "clrbp",
+     "mvlbl"
+    ]
+
+ARM64_INSTRUCTIONS =
+    [
+     "pcrtoaddr",   # Address from PC relative offset - adr instruction
+     "nopFixCortexA53Err835769" # nop on Cortex-A53 (nothing otherwise)
+    ]
+
+RISC_INSTRUCTIONS =
+    [
+     "smulli",  # Multiply two 32-bit words and produce a 64-bit word
+     "addis",   # Add integers and set a flag.
+     "subis",   # Same, but for subtraction.
+     "oris",    # Same, but for bitwise or.
+     "addps"    # addis but for pointers.
+    ]
+
+MIPS_INSTRUCTIONS =
+    [
+    "la",
+    "movz",
+    "movn",
+    "setcallreg",
+    "slt",
+    "sltu",
+    "pichdr"
+    ]
+
+SH4_INSTRUCTIONS =
+    [
+    "flushcp",
+    "alignformova",
+    "mova",
+    "shllx",
+    "shlrx",
+    "shld",
+    "shad",
+    "bdnan",
+    "loaddReversedAndIncrementAddress",
+    "storedReversedAndDecrementAddress",
+    "ldspr",
+    "stspr",
+    "setargs"
+    ]
+
+CXX_INSTRUCTIONS =
+    [
+     "cloopCrash",              # no operands
+     "cloopCallJSFunction",     # operands: callee
+     "cloopCallNative",         # operands: callee
+     "cloopCallSlowPath",       # operands: callTarget, currentFrame, currentPC
+     "cloopCallSlowPathVoid",   # operands: callTarget, currentFrame, currentPC
+
+     # For debugging only:
+     # Takes no operands but simply emits whatever follows in // comments as
+     # a line of C++ code in the generated LLIntAssembly.h file. This can be
+     # used to insert instrumentation into the interpreter loop to inspect
+     # variables of interest. Do not leave these instructions in production
+     # code.
+     "cloopDo",              # no operands
+    ]
+
+INSTRUCTIONS = MACRO_INSTRUCTIONS + X86_INSTRUCTIONS + ARM_INSTRUCTIONS + ARM64_INSTRUCTIONS + RISC_INSTRUCTIONS + MIPS_INSTRUCTIONS + SH4_INSTRUCTIONS + CXX_INSTRUCTIONS
+
+INSTRUCTION_SET = INSTRUCTIONS.to_set
+
+def isBranch(instruction)
+    instruction =~ /^b/
+end
+
+def hasFallThrough(instruction)
+    instruction != "ret" and instruction != "jmp"
+end
+
diff --git a/offlineasm/mips.rb b/offlineasm/mips.rb
new file mode 100644
index 0000000..53bb9c1
--- /dev/null
+++ b/offlineasm/mips.rb
@@ -0,0 +1,1055 @@
+# Copyright (C) 2012 Apple Inc. All rights reserved.
+# Copyright (C) 2012 MIPS Technologies, Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY MIPS TECHNOLOGIES, INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL MIPS TECHNOLOGIES, INC. OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+require 'risc'
+
+# GPR conventions, to match the baseline JIT
+#
+# $a0 => a0
+# $a1 => a1
+# $a2 => a2
+# $a3 => a3
+# $v0 => t0, r0
+# $v1 => t1, r1
+# $t0 =>            (scratch)
+# $t1 =>            (scratch)
+# $t2 =>         t2
+# $t3 =>         t3
+# $t4 =>         t4
+# $t5 =>         t5
+# $t6 =>         t6
+# $t7 =>            (scratch)
+# $t8 =>            (scratch)
+# $t9 =>            (stores the callee of a call opcode)
+# $gp =>            (globals)
+# $s4 =>            (callee-save used to preserve $gp across calls)
+# $ra => lr
+# $sp => sp
+# $fp => cfr
+#
+# FPR conventions, to match the baseline JIT
+# We don't have fa2 or fa3!
+#  $f0 => ft0, fr
+#  $f2 => ft1
+#  $f4 => ft2
+#  $f6 => ft3
+#  $f8 => ft4
+# $f10 => ft5
+# $f12 =>        fa0
+# $f14 =>        fa1
+# $f16 =>            (scratch)
+# $f18 =>            (scratch)
+
+class Assembler
+    def putStr(str)
+        @outp.puts str
+    end
+end
+
+class Node
+    def mipsSingleHi
+        doubleOperand = mipsOperand
+        raise "Bogus register name #{doubleOperand}" unless doubleOperand =~ /^\$f/
+        "$f" + ($~.post_match.to_i + 1).to_s
+    end
+    def mipsSingleLo
+        doubleOperand = mipsOperand
+        raise "Bogus register name #{doubleOperand}" unless doubleOperand =~ /^\$f/
+        doubleOperand
+    end
+end
+
+class SpecialRegister < NoChildren
+    def mipsOperand
+        @name
+    end
+
+    def dump
+        @name
+    end
+
+    def register?
+        true
+    end
+end
+
+MIPS_TEMP_GPRS = [SpecialRegister.new("$t0"), SpecialRegister.new("$t1"), SpecialRegister.new("$t7"), SpecialRegister.new("$t8")]
+MIPS_ZERO_REG = SpecialRegister.new("$zero")
+MIPS_GP_REG = SpecialRegister.new("$gp")
+MIPS_GPSAVE_REG = SpecialRegister.new("$s4")
+MIPS_CALL_REG = SpecialRegister.new("$t9")
+MIPS_TEMP_FPRS = [SpecialRegister.new("$f16")]
+MIPS_SCRATCH_FPR = SpecialRegister.new("$f18")
+
+def mipsMoveImmediate(value, register)
+    if value == 0
+        $asm.puts "add #{register.mipsOperand}, $zero, $zero"
+    else
+        $asm.puts "li #{register.mipsOperand}, #{value}"
+    end
+end
+
+class RegisterID
+    def mipsOperand
+        case name
+        when "a0"
+            "$a0"
+        when "a1"
+            "$a1"
+        when "a2"
+            "$a2"
+        when "a3"
+            "$a3"
+        when "t0", "r0"
+            "$v0"
+        when "t1", "r1"
+            "$v1"
+        when "t2"
+            "$t2"
+        when "t3"
+            "$t3"
+        when "t4"
+            "$t4"
+        when "t5"
+            "$t5"
+        when "cfr"
+            "$fp"
+        when "lr"
+            "$ra"
+        when "sp"
+            "$sp"
+        else
+            raise "Bad register #{name} for MIPS at #{codeOriginString}"
+        end
+    end
+end
+
+class FPRegisterID
+    def mipsOperand
+        case name
+        when "ft0", "fr"
+            "$f0"
+        when "ft1"
+            "$f2"
+        when "ft2"
+            "$f4"
+        when "ft3"
+            "$f6"
+        when "ft4"
+            "$f8"
+        when "ft5"
+            "$f10"
+        when "fa0"
+            "$f12"
+        when "fa1"
+            "$f14"
+        else
+            raise "Bad register #{name} for MIPS at #{codeOriginString}"
+        end
+    end
+end
+
+class Immediate
+    def mipsOperand
+        raise "Invalid immediate #{value} at #{codeOriginString}" if value < -0x7fff or value > 0xffff
+        "#{value}"
+    end
+end
+
+class Address
+    def mipsOperand
+        raise "Bad offset at #{codeOriginString}" if offset.value < -0x7fff or offset.value > 0x7fff
+        "#{offset.value}(#{base.mipsOperand})"
+    end
+end
+
+class AbsoluteAddress
+    def mipsOperand
+        raise "Unconverted absolute address at #{codeOriginString}"
+    end
+end
+
+#
+# Negate condition of branches to labels.
+#
+
+class Instruction
+    def mipsNegateCondition(list)
+        /^(b(add|sub|or|mul|t)?)([ipb])/.match(opcode)
+        case $~.post_match
+        when "eq"
+            op = "neq"
+        when "neq"
+            op = "eq"
+        when "z"
+            op = "nz"
+        when "nz"
+            op = "z"
+        when "gt"
+            op = "lteq"
+        when "gteq"
+            op = "lt"
+        when "lt"
+            op = "gteq"
+        when "lteq"
+            op = "gt"
+        when "a"
+            op = "beq"
+        when "b"
+            op = "aeq"
+        when "aeq"
+            op = "b"
+        when "beq"
+            op = "a"
+        else
+            raise "Can't negate #{opcode} branch."
+        end
+        noBranch = LocalLabel.unique("nobranch")
+        noBranchRef = LocalLabelReference.new(codeOrigin, noBranch)
+        toRef = operands[-1]
+        list << Instruction.new(codeOrigin, "#{$1}#{$3}#{op}", operands[0..-2].push(noBranchRef), annotation)
+        list << Instruction.new(codeOrigin, "la", [toRef, MIPS_CALL_REG])
+        list << Instruction.new(codeOrigin, "jmp", [MIPS_CALL_REG])
+        list << noBranch
+    end
+end
+
+def mipsLowerFarBranchOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            annotation = node.annotation
+            case node.opcode
+            when /^b(add|sub|or|mul|t)?([ipb])/
+                if node.operands[-1].is_a? LabelReference
+                    node.mipsNegateCondition(newList)
+                    next
+                end
+            end
+        end
+        newList << node
+    }
+    newList
+end
+
+#
+# Lower 'and' masked branches
+#
+
+def lowerMIPSCondBranch(list, condOp, node)
+    if node.operands.size == 2
+        list << Instruction.new(node.codeOrigin,
+                                condOp,
+                                [node.operands[0], MIPS_ZERO_REG, node.operands[-1]],
+                                node.annotation)
+    elsif node.operands.size == 3
+        tl = condOp[-1, 1]
+        tmp = Tmp.new(node.codeOrigin, :gpr)
+        list << Instruction.new(node.codeOrigin,
+                                "and" + tl,
+                                [node.operands[0], node.operands[1], tmp],
+                                node.annotation)
+        list << Instruction.new(node.codeOrigin,
+                                condOp,
+                                [tmp, MIPS_ZERO_REG, node.operands[-1]])
+    else
+        raise "Expected 2 or 3 operands but got #{node.operands.size} at #{node.codeOriginString}"
+    end
+end
+
+#
+# Lowering of branch ops. For example:
+#
+# baddiz foo, bar, baz
+#
+# will become:
+#
+# addi foo, bar
+# bz baz
+#
+
+def mipsLowerSimpleBranchOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            annotation = node.annotation
+            case node.opcode
+            when /^b(addi|subi|ori|addp)/
+                op = $1
+                bc = $~.post_match
+                branch = "b" + bc
+
+                case op
+                when "addi", "addp"
+                    op = "addi"
+                when "subi"
+                    op = "subi"
+                when "ori"
+                    op = "ori"
+                end
+
+                if bc == "o"
+                    case op
+                    when "addi"
+                        #  addu $s0, $s1, $s2
+                        #  xor $t0, $s1, $s2
+                        #  blt $t0, $zero, no overflow
+                        #  xor $t0, $s0, $s1
+                        #  blt $t0, $zero, overflow
+                        # no overflow:
+                        #
+                        tr = Tmp.new(node.codeOrigin, :gpr)
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        noFlow = LocalLabel.unique("noflow")
+                        noFlowRef = LocalLabelReference.new(node.codeOrigin, noFlow)
+                        newList << Instruction.new(node.codeOrigin, op, [node.operands[0], node.operands[1], tr], annotation)
+                        newList << Instruction.new(node.codeOrigin, "xori", [node.operands[0], node.operands[1], tmp])
+                        newList << Instruction.new(node.codeOrigin, "bilt", [tmp, MIPS_ZERO_REG, noFlowRef])
+                        newList << Instruction.new(node.codeOrigin, "xori", [tr, node.operands[0], tmp])
+                        newList << Instruction.new(node.codeOrigin, "bilt", [tmp, MIPS_ZERO_REG, node.operands[2]])
+                        newList << noFlow
+                        newList << Instruction.new(node.codeOrigin, "move", [tr, node.operands[1]])
+                    when "subi"
+                        #  subu $s0, $s1, $s2
+                        #  xor $t0, $s1, $s2
+                        #  bge $t0, $zero, no overflow
+                        #  xor $t0, $s0, $s1
+                        #  blt $t0, $zero, overflow
+                        # no overflow:
+                        #
+                        tr = Tmp.new(node.codeOrigin, :gpr)
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        noFlow = LocalLabel.unique("noflow")
+                        noFlowRef = LocalLabelReference.new(node.codeOrigin, noFlow)
+                        newList << Instruction.new(node.codeOrigin, op, [node.operands[1], node.operands[0], tr], annotation)
+                        newList << Instruction.new(node.codeOrigin, "xori", [node.operands[1], node.operands[0], tmp])
+                        newList << Instruction.new(node.codeOrigin, "bigteq", [tmp, MIPS_ZERO_REG, noFlowRef])
+                        newList << Instruction.new(node.codeOrigin, "xori", [tr, node.operands[1], tmp])
+                        newList << Instruction.new(node.codeOrigin, "bilt", [tmp, MIPS_ZERO_REG, node.operands[2]])
+                        newList << noFlow
+                        newList << Instruction.new(node.codeOrigin, "move", [tr, node.operands[1]])
+                    when "ori"
+                        # no ovwerflow at ori
+                        newList << Instruction.new(node.codeOrigin, op, node.operands[0..1], annotation)
+                    end
+                else
+                    if node.operands[1].is_a? Address
+                        addr = node.operands[1]
+                        tr = Tmp.new(node.codeOrigin, :gpr)
+                        newList << Instruction.new(node.codeOrigin, "loadp", [addr, tr], annotation)
+                        newList << Instruction.new(node.codeOrigin, op, [node.operands[0], tr])
+                        newList << Instruction.new(node.codeOrigin, "storep", [tr, addr])
+                    else
+                        tr = node.operands[1]
+                        newList << Instruction.new(node.codeOrigin, op, node.operands[0..-2], annotation)
+                    end
+                    newList << Instruction.new(node.codeOrigin, branch, [tr, MIPS_ZERO_REG, node.operands[-1]])
+                end
+            when "bia", "bpa", "bba"
+                tmp = Tmp.new(node.codeOrigin, :gpr)
+                comp = node.opcode[1] == ?b ? "sltub" : "sltu"
+                newList << Instruction.new(node.codeOrigin, comp, [tmp, node.operands[1], node.operands[0]], annotation)
+                newList << Instruction.new(node.codeOrigin, "bnz", [tmp, MIPS_ZERO_REG, node.operands[2]])
+            when "biaeq", "bpaeq", "bbaeq"
+                tmp = Tmp.new(node.codeOrigin, :gpr)
+                comp = node.opcode[1] == ?b ? "sltub" : "sltu"
+                newList << Instruction.new(node.codeOrigin, comp, [tmp, node.operands[0], node.operands[1]], annotation)
+                newList << Instruction.new(node.codeOrigin, "bz", [tmp, MIPS_ZERO_REG, node.operands[2]])
+            when "bib", "bpb", "bbb"
+                tmp = Tmp.new(node.codeOrigin, :gpr)
+                comp = node.opcode[1] == ?b ? "sltub" : "sltu"
+                newList << Instruction.new(node.codeOrigin, comp, [tmp, node.operands[0], node.operands[1]], annotation)
+                newList << Instruction.new(node.codeOrigin, "bnz", [tmp, MIPS_ZERO_REG, node.operands[2]])
+            when "bibeq", "bpbeq", "bbbeq"
+                tmp = Tmp.new(node.codeOrigin, :gpr)
+                comp = node.opcode[1] == ?b ? "sltub" : "sltu"
+                newList << Instruction.new(node.codeOrigin, comp, [tmp, node.operands[1], node.operands[0]], annotation)
+                newList << Instruction.new(node.codeOrigin, "bz", [tmp, MIPS_ZERO_REG, node.operands[2]])
+            when /^bt(i|p|b)/
+                lowerMIPSCondBranch(newList, "b" + $~.post_match + $1, node)
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Specialization of lowering of malformed BaseIndex addresses.
+#
+
+class Node
+    def mipsLowerMalformedAddressesRecurse(list)
+        mapChildren {
+            | subNode |
+            subNode.mipsLowerMalformedAddressesRecurse(list)
+        }
+    end
+
+    def mipsLowerShiftedAddressesRecurse(list, isFirst, tmp)
+        mapChildren {
+            | subNode |
+            subNode.mipsLowerShiftedAddressesRecurse(list, isFirst, tmp)
+        }
+    end
+end
+
+class BaseIndex
+    def mipsLowerMalformedAddressesRecurse(list)
+        tmp = Tmp.new(codeOrigin, :gpr)
+        if scaleShift == 0
+            list << Instruction.new(codeOrigin, "addp", [base, index, tmp])
+            Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, offset.value));
+        end
+    end
+
+    def mipsLowerShiftedAddressesRecurse(list, isFirst, tmp)
+        if isFirst
+            list << Instruction.new(codeOrigin, "lshifti", [index, Immediate.new(codeOrigin, scaleShift), tmp]);
+            list << Instruction.new(codeOrigin, "addp", [base, tmp])
+        end
+        Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, offset.value));
+    end
+end
+
+#
+# Lowering of BaseIndex addresses with optimization for MIPS.
+#
+# offline asm instruction pair:
+#   loadi 4[cfr, t0, 8], t2
+#   loadi 0[cfr, t0, 8], t0
+#
+# lowered instructions: 
+#   lshifti t0, 3, tmp
+#   addp    cfr, tmp
+#   loadi   4[tmp], t2
+#   loadi   0[tmp], t0
+#
+
+def mipsHasShiftedBaseIndexAddress(instruction)
+    instruction.operands.each_with_index {
+        | operand, index |
+        if operand.is_a? BaseIndex and operand.scaleShift != 0
+            return index
+        end
+    }
+    -1
+end
+
+def mipsScaleOfBaseIndexMatches(baseIndex0, baseIndex1)
+    baseIndex0.base == baseIndex1.base and
+    baseIndex0.index == baseIndex1.index and
+    baseIndex0.scale == baseIndex1.scale
+end
+
+def mipsLowerBaseIndexAddresses(list)
+    newList = [ list[0] ]
+    tmp = nil
+    list.each_cons(2) {
+        | nodes |
+        if nodes[1].is_a? Instruction
+            ind = mipsHasShiftedBaseIndexAddress(nodes[1])
+            if ind != -1
+                if nodes[0].is_a? Instruction and
+                    nodes[0].opcode == nodes[1].opcode and
+                    ind == mipsHasShiftedBaseIndexAddress(nodes[0]) and
+                    mipsScaleOfBaseIndexMatches(nodes[0].operands[ind], nodes[1].operands[ind])
+
+                    newList << nodes[1].mipsLowerShiftedAddressesRecurse(newList, false, tmp)
+                else
+                    tmp = Tmp.new(codeOrigin, :gpr)
+                    newList << nodes[1].mipsLowerShiftedAddressesRecurse(newList, true, tmp)
+                end
+            else
+                newList << nodes[1].mipsLowerMalformedAddressesRecurse(newList)
+            end
+        else
+            newList << nodes[1]
+        end
+    }
+    newList
+end
+
+#
+# Lowering of misplaced immediates of MIPS specific instructions. For example:
+#
+# sltu reg, 4, 2
+#
+# will become:
+#
+# move 4, tmp
+# sltu reg, tmp, 2
+#
+
+def mipsLowerMisplacedImmediates(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "slt", "sltu", "sltb", "sltub"
+                if node.operands[1].is_a? Immediate
+                    tmp = Tmp.new(node.codeOrigin, :gpr)
+                    newList << Instruction.new(node.codeOrigin, "move", [node.operands[1], tmp], node.annotation)
+                    newList << Instruction.new(node.codeOrigin, node.opcode,
+                                               [node.operands[0], tmp, node.operands[2]],
+                                               node.annotation)
+                else
+                    newList << node
+                end
+            when /^(addi|subi)/
+                newList << node.riscLowerMalformedImmediatesRecurse(newList, -0x7fff..0x7fff)
+            when "andi", "andp", "ori", "orp", "xori", "xorp"
+                newList << node.riscLowerMalformedImmediatesRecurse(newList, 0..0xffff)
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Specialization of lowering of misplaced addresses.
+#
+
+class LocalLabelReference
+    def register?
+        false
+    end
+end
+
+def mipsAsRegister(preList, postList, operand, needRestore)
+    tmp = MIPS_CALL_REG
+    if operand.address?
+        preList << Instruction.new(operand.codeOrigin, "loadp", [operand, MIPS_CALL_REG])
+    elsif operand.is_a? LabelReference
+        preList << Instruction.new(operand.codeOrigin, "la", [operand, MIPS_CALL_REG])
+    elsif operand.register? and operand != MIPS_CALL_REG
+        preList << Instruction.new(operand.codeOrigin, "move", [operand, MIPS_CALL_REG])
+    else
+        needRestore = false
+        tmp = operand
+    end
+    if needRestore
+        postList << Instruction.new(operand.codeOrigin, "move", [MIPS_GPSAVE_REG, MIPS_GP_REG])
+    end
+    tmp
+end
+
+def mipsLowerMisplacedAddresses(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            postInstructions = []
+            annotation = node.annotation
+            case node.opcode
+            when "jmp"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           [mipsAsRegister(newList, [], node.operands[0], false)])
+            when "call"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           [mipsAsRegister(newList, postInstructions, node.operands[0], true)])
+            when "slt", "sltu"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, [], node.operands, "i"))
+            when "sltub", "sltb"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, [], node.operands, "b"))
+            when "andb"
+                newList << Instruction.new(node.codeOrigin,
+                                           "andi",
+                                           riscAsRegisters(newList, [], node.operands, "b"))
+            when /^(bz|bnz|bs|bo)/
+                tl = $~.post_match == "" ? "i" : $~.post_match
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, [], node.operands, tl))
+            else
+                newList << node
+            end
+            newList += postInstructions
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering compares and tests.
+#
+
+def mipsLowerCompareTemplate(list, node, opCmp, opMov)
+    tmp0 = Tmp.new(node.codeOrigin, :gpr)
+    tmp1 = Tmp.new(node.codeOrigin, :gpr)
+    list << Instruction.new(node.codeOrigin, "move", [Immediate.new(nil, 0), node.operands[2]])
+    list << Instruction.new(node.codeOrigin, opCmp, [node.operands[1], node.operands[0], tmp0])
+    list << Instruction.new(node.codeOrigin, "move", [Immediate.new(nil, 1), tmp1])
+    list << Instruction.new(node.codeOrigin, opMov, [node.operands[2], tmp1, tmp0])
+end
+
+def mipsLowerCompares(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "cieq", "cpeq", "cbeq"
+                mipsLowerCompareTemplate(newList, node, "subp", "movz")
+            when "cineq", "cpneq", "cbneq"
+                mipsLowerCompareTemplate(newList, node, "subp", "movn")
+            when "tiz", "tbz", "tpz"
+                mipsLowerCompareTemplate(newList, node, "andp", "movz")
+            when "tinz", "tbnz", "tpnz"
+                mipsLowerCompareTemplate(newList, node, "andp", "movn")
+            when "tio", "tbo", "tpo"
+                tmp = Tmp.new(node.codeOrigin, :gpr)
+                list << Instruction.new(node.codeOrigin, "andp", [node.operands[1], node.operands[0], tmp])
+                list << Instruction.new(node.codeOrigin, "slt", [node.operands[2], MIPS_ZERO_REG, tmp])
+            when "tis", "tbs", "tps"
+                tmp = Tmp.new(node.codeOrigin, :gpr)
+                list << Instruction.new(node.codeOrigin, "andp", [node.operands[1], node.operands[0], tmp])
+                list << Instruction.new(node.codeOrigin, "slt", [node.operands[2], tmp, MIPS_ZERO_REG])
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lea support.
+#
+
+class Address
+    def mipsEmitLea(destination)
+        if destination == base
+            $asm.puts "addiu #{destination.mipsOperand}, #{offset.value}"
+        else
+            $asm.puts "addiu #{destination.mipsOperand}, #{base.mipsOperand}, #{offset.value}"
+        end
+    end
+end
+
+#
+# Add PIC compatible header code to all the LLInt rutins.
+#
+
+def mipsAddPICCode(list)
+    myList = []
+    list.each {
+        | node |
+        myList << node
+        if node.is_a? Label
+            myList << Instruction.new(node.codeOrigin, "pichdr", [])
+        end
+    }
+    myList
+end
+
+#
+# Actual lowering code follows.
+#
+
+class Sequence
+    def getModifiedListMIPS
+        result = @list
+
+        # Verify that we will only see instructions and labels.
+        result.each {
+            | node |
+            unless node.is_a? Instruction or
+                    node.is_a? Label or
+                    node.is_a? LocalLabel or
+                    node.is_a? Skip
+                raise "Unexpected #{node.inspect} at #{node.codeOrigin}"
+            end
+        }
+
+        result = mipsAddPICCode(result)
+        result = mipsLowerFarBranchOps(result)
+        result = mipsLowerSimpleBranchOps(result)
+        result = riscLowerSimpleBranchOps(result)
+        result = riscLowerHardBranchOps(result)
+        result = riscLowerShiftOps(result)
+        result = mipsLowerBaseIndexAddresses(result)
+        result = riscLowerMalformedAddresses(result) {
+            | node, address |
+            if address.is_a? Address
+                (-0xffff..0xffff).include? address.offset.value
+            else
+                false
+            end
+        }
+        result = riscLowerMalformedAddressesDouble(result)
+        result = riscLowerMisplacedImmediates(result, ["storeb", "storei", "storep"])
+        result = mipsLowerMisplacedImmediates(result)
+        result = riscLowerMalformedImmediates(result, -0xffff..0xffff)
+        result = mipsLowerMisplacedAddresses(result)
+        result = riscLowerMisplacedAddresses(result)
+        result = riscLowerRegisterReuse(result)
+        result = mipsLowerCompares(result)
+        result = assignRegistersToTemporaries(result, :gpr, MIPS_TEMP_GPRS)
+        result = assignRegistersToTemporaries(result, :fpr, MIPS_TEMP_FPRS)
+
+        return result
+    end
+end
+
+def mipsOperands(operands)
+    operands.map{|v| v.mipsOperand}.join(", ")
+end
+
+def mipsFlippedOperands(operands)
+    mipsOperands([operands[-1]] + operands[0..-2])
+end
+
+def getMIPSOpcode(opcode, suffix)
+
+end
+
+def emitMIPSCompact(opcode, opcodei, operands)
+    postfix = ""
+    if opcode == "sub"
+        if operands[0].is_a? Immediate
+            opcode = "add"
+            operands[0] = Immediate.new(operands[0].codeOrigin, -1 * operands[0].value)
+        elsif operands[1].is_a? Immediate
+            opcode = "add"
+            operands[1] = Immediate.new(operands[1].codeOrigin, -1 * operands[1].value)
+        end
+        postfix = "u"
+    elsif opcode == "add"
+        postfix = "u"
+    end
+    if operands.size == 3
+        if operands[0].is_a? Immediate
+            $asm.puts "#{opcode}i#{postfix} #{operands[2].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].value}"
+        elsif operands[1].is_a? Immediate
+            $asm.puts "#{opcode}i#{postfix} #{operands[2].mipsOperand}, #{operands[0].mipsOperand}, #{operands[1].value}"
+        else
+            $asm.puts "#{opcode}#{postfix} #{mipsFlippedOperands(operands)}"
+        end
+    else
+        raise unless operands.size == 2
+        raise unless operands[1].register?
+        if operands[0].is_a? Immediate
+            $asm.puts "#{opcode}i#{postfix} #{operands[1].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+        else
+            $asm.puts "#{opcode}#{postfix} #{operands[1].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+        end
+    end
+end
+
+def emitMIPSShiftCompact(opcode, operands)
+    if operands.size == 3
+        if (operands[1].is_a? Immediate)
+            $asm.puts "#{opcode} #{operands[2].mipsOperand}, #{operands[0].mipsOperand}, #{operands[1].value}"
+        else
+            $asm.puts "#{opcode}v #{mipsFlippedOperands(operands)}"
+        end
+    else
+        raise unless operands.size == 2
+        if operands[0].register?
+            $asm.puts "#{opcode}v #{operands[1].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+        else
+            $asm.puts "#{opcode} #{operands[1].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].value}"
+        end
+    end
+end
+
+def emitMIPS(opcode, operands)
+    if operands.size == 3
+        $asm.puts "#{opcode} #{mipsFlippedOperands(operands)}"
+    else
+        raise unless operands.size == 2
+        $asm.puts "#{opcode} #{operands[1].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+    end
+end
+
+def emitMIPSDoubleBranch(branchOpcode, neg, operands)
+    $asm.puts "c.#{branchOpcode}.d #{mipsOperands(operands[0..1])}"
+    if (!neg)
+        $asm.puts "bc1t #{operands[2].asmLabel}"
+    else
+        $asm.puts "bc1f #{operands[2].asmLabel}"
+    end
+end
+
+def emitMIPSJumpOrCall(opcode, operand)
+    if operand.label?
+        raise "Direct call/jump to a not local label." unless operand.is_a? LocalLabelReference
+        $asm.puts "#{opcode} #{operand.asmLabel}"
+    else
+        raise "Invalid call/jump register." unless operand == MIPS_CALL_REG
+        $asm.puts "#{opcode}r #{MIPS_CALL_REG.mipsOperand}"
+    end
+end
+
+class Instruction
+    def lowerMIPS
+        $asm.comment codeOriginString
+        case opcode
+        when "addi", "addp", "addis"
+            if operands.size == 3 and operands[0].is_a? Immediate
+                raise unless operands[1].register?
+                raise unless operands[2].register?
+                if operands[0].value == 0 #and suffix.empty?
+                    unless operands[1] == operands[2]
+                        $asm.puts "move #{operands[2].mipsOperand}, #{operands[1].mipsOperand}"
+                    end
+                else
+                    $asm.puts "addiu #{operands[2].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+                end
+            elsif operands.size == 3 and operands[0].register?
+                raise unless operands[1].register?
+                raise unless operands[2].register?
+                $asm.puts "addu #{mipsFlippedOperands(operands)}"
+            else
+                if operands[0].is_a? Immediate
+                    unless Immediate.new(nil, 0) == operands[0]
+                        $asm.puts "addiu #{operands[1].mipsOperand}, #{mipsFlippedOperands(operands)}"
+                    end
+                else
+                    $asm.puts "addu #{operands[1].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+                end
+            end
+        when "andi", "andp"
+            emitMIPSCompact("and", "and", operands)
+        when "ori", "orp"
+            emitMIPSCompact("or", "orr", operands)
+        when "oris"
+            emitMIPSCompact("or", "orrs", operands)
+        when "xori", "xorp"
+            emitMIPSCompact("xor", "eor", operands)
+        when "lshifti", "lshiftp"
+            emitMIPSShiftCompact("sll", operands)
+        when "rshifti", "rshiftp"
+            emitMIPSShiftCompact("sra", operands)
+        when "urshifti", "urshiftp"
+            emitMIPSShiftCompact("srl", operands)
+        when "muli", "mulp"
+            emitMIPS("mul", operands)
+        when "subi", "subp", "subis"
+            emitMIPSCompact("sub", "subs", operands)
+        when "negi", "negp"
+            $asm.puts "negu #{operands[0].mipsOperand}, #{operands[0].mipsOperand}"
+        when "noti"
+            $asm.puts "nor #{operands[0].mipsOperand}, #{operands[0].mipsOperand}, $zero"
+        when "loadi", "loadis", "loadp"
+            $asm.puts "lw #{mipsFlippedOperands(operands)}"
+        when "storei", "storep"
+            $asm.puts "sw #{mipsOperands(operands)}"
+        when "loadb"
+            $asm.puts "lbu #{mipsFlippedOperands(operands)}"
+        when "loadbs"
+            $asm.puts "lb #{mipsFlippedOperands(operands)}"
+        when "storeb"
+            $asm.puts "sb #{mipsOperands(operands)}"
+        when "loadh"
+            $asm.puts "lhu #{mipsFlippedOperands(operands)}"
+        when "loadhs"
+            $asm.puts "lh #{mipsFlippedOperands(operands)}"
+        when "storeh"
+            $asm.puts "shv #{mipsOperands(operands)}"
+        when "loadd"
+            $asm.puts "ldc1 #{mipsFlippedOperands(operands)}"
+        when "stored"
+            $asm.puts "sdc1 #{mipsOperands(operands)}"
+        when "la"
+            $asm.puts "la #{operands[1].mipsOperand}, #{operands[0].asmLabel}"
+        when "addd"
+            emitMIPS("add.d", operands)
+        when "divd"
+            emitMIPS("div.d", operands)
+        when "subd"
+            emitMIPS("sub.d", operands)
+        when "muld"
+            emitMIPS("mul.d", operands)
+        when "sqrtd"
+            $asm.puts "sqrt.d #{mipsFlippedOperands(operands)}"
+        when "ci2d"
+            raise "invalid ops of #{self.inspect} at #{codeOriginString}" unless operands[1].is_a? FPRegisterID and operands[0].register?
+            $asm.puts "mtc1 #{operands[0].mipsOperand}, #{operands[1].mipsOperand}"
+            $asm.puts "cvt.d.w #{operands[1].mipsOperand}, #{operands[1].mipsOperand}"
+        when "bdeq"
+            emitMIPSDoubleBranch("eq", false, operands)
+        when "bdneq"
+            emitMIPSDoubleBranch("ueq", true, operands)
+        when "bdgt"
+            emitMIPSDoubleBranch("ule", true, operands)
+        when "bdgteq"
+            emitMIPSDoubleBranch("ult", true, operands)
+        when "bdlt"
+            emitMIPSDoubleBranch("olt", false, operands)
+        when "bdlteq"
+            emitMIPSDoubleBranch("ole", false, operands)
+        when "bdequn"
+            emitMIPSDoubleBranch("ueq", false, operands)
+        when "bdnequn"
+            emitMIPSDoubleBranch("eq", true, operands)
+        when "bdgtun"
+            emitMIPSDoubleBranch("ole", true, operands)
+        when "bdgtequn"
+            emitMIPSDoubleBranch("olt", true, operands)
+        when "bdltun"
+            emitMIPSDoubleBranch("ult", false, operands)
+        when "bdltequn"
+            emitMIPSDoubleBranch("ule", false, operands)
+        when "btd2i"
+            # FIXME: may be a good idea to just get rid of this instruction, since the interpreter
+            # currently does not use it.
+            raise "MIPS does not support this opcode yet, #{codeOrigin}"
+        when "td2i"
+            $asm.puts "cvt.w.d #{MIPS_SCRATCH_FPR.mipsSingleLo}, #{operands[0].mipsOperand}"
+            $asm.puts "mfc1 #{operands[1].mipsOperand}, #{MIPS_SCRATCH_FPR.mipsSingleLo}"
+        when "bcd2i"
+            $asm.puts "cvt.w.d #{MIPS_SCRATCH_FPR.mipsSingleLo}, #{operands[0].mipsOperand}"
+            $asm.puts "mfc1 #{operands[1].mipsOperand}, #{MIPS_SCRATCH_FPR.mipsSingleLo}"
+            $asm.puts "cvt.d.w #{MIPS_SCRATCH_FPR.mipsOperand}, #{MIPS_SCRATCH_FPR.mipsSingleLo}"
+            emitMIPSDoubleBranch("eq", true, [MIPS_SCRATCH_FPR, operands[0], operands[2]])
+            $asm.puts "beq #{operands[1].mipsOperand}, $zero, #{operands[2].asmLabel}"
+        when "movdz"
+            # FIXME: either support this or remove it.
+            raise "MIPS does not support this opcode yet, #{codeOrigin}"
+        when "pop"
+            operands.each {
+                | op |
+                $asm.puts "lw #{op.mipsOperand}, 0($sp)"
+                $asm.puts "addiu $sp, $sp, 4"
+            }
+        when "push"
+            operands.each {
+                | op |
+                $asm.puts "addiu $sp, $sp, -4"
+                $asm.puts "sw #{op.mipsOperand}, 0($sp)"
+            }
+        when "move", "sxi2p", "zxi2p"
+            if operands[0].is_a? Immediate
+                mipsMoveImmediate(operands[0].value, operands[1])
+            else
+                $asm.puts "move #{mipsFlippedOperands(operands)}"
+            end
+        when "nop"
+            $asm.puts "nop"
+        when "bieq", "bpeq", "bbeq"
+            $asm.puts "beq #{mipsOperands(operands[0..1])}, #{operands[2].asmLabel}"
+        when "bineq", "bpneq", "bbneq"
+            $asm.puts "bne #{mipsOperands(operands[0..1])}, #{operands[2].asmLabel}"
+        when "bigt", "bpgt", "bbgt"
+            $asm.puts "bgt #{mipsOperands(operands[0..1])}, #{operands[2].asmLabel}"
+        when "bigteq", "bpgteq", "bbgteq"
+            $asm.puts "bge #{mipsOperands(operands[0..1])}, #{operands[2].asmLabel}"
+        when "bilt", "bplt", "bblt"
+            $asm.puts "blt #{mipsOperands(operands[0..1])}, #{operands[2].asmLabel}"
+        when "bilteq", "bplteq", "bblteq"
+            $asm.puts "ble #{mipsOperands(operands[0..1])}, #{operands[2].asmLabel}"
+        when "jmp"
+            emitMIPSJumpOrCall("j", operands[0])
+        when "call"
+            emitMIPSJumpOrCall("jal", operands[0])
+        when "break"
+            $asm.puts "break"
+        when "ret"
+            $asm.puts "jr $ra"
+        when "cia", "cpa", "cba"
+            $asm.puts "sltu #{operands[2].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+        when "ciaeq", "cpaeq", "cbaeq"
+            $asm.puts "sltu #{operands[2].mipsOperand}, #{operands[0].mipsOperand}, #{operands[1].mipsOperand}"
+            $asm.puts "xori #{operands[2].mipsOperand}, 1"
+        when "cib", "cpb", "cbb"
+            $asm.puts "sltu #{operands[2].mipsOperand}, #{operands[0].mipsOperand}, #{operands[1].mipsOperand}"
+        when "cibeq", "cpbeq", "cbbeq"
+            $asm.puts "sltu #{operands[2].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+            $asm.puts "xori #{operands[2].mipsOperand}, 1"
+        when "cigt", "cpgt", "cbgt"
+            $asm.puts "slt #{operands[2].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+        when "cigteq", "cpgteq", "cbgteq"
+            $asm.puts "slt #{operands[2].mipsOperand}, #{operands[0].mipsOperand}, #{operands[1].mipsOperand}"
+            $asm.puts "xori #{operands[2].mipsOperand}, 1"
+        when "cilt", "cplt", "cblt"
+            $asm.puts "slt #{operands[2].mipsOperand}, #{operands[0].mipsOperand}, #{operands[1].mipsOperand}"
+        when "cilteq", "cplteq", "cblteq"
+            $asm.puts "slt #{operands[2].mipsOperand}, #{operands[1].mipsOperand}, #{operands[0].mipsOperand}"
+            $asm.puts "xori #{operands[2].mipsOperand}, 1"
+        when "peek"
+            $asm.puts "lw #{operands[1].mipsOperand}, #{operands[0].value * 4}($sp)"
+        when "poke"
+            $asm.puts "sw #{operands[1].mipsOperand}, #{operands[0].value * 4}($sp)"
+        when "fii2d"
+            $asm.puts "mtc1 #{operands[0].mipsOperand}, #{operands[2].mipsSingleLo}"
+            $asm.puts "mtc1 #{operands[1].mipsOperand}, #{operands[2].mipsSingleHi}"
+        when "fd2ii"
+            $asm.puts "mfc1 #{operands[1].mipsOperand}, #{operands[0].mipsSingleLo}"
+            $asm.puts "mfc1 #{operands[2].mipsOperand}, #{operands[0].mipsSingleHi}"
+        when /^bo/
+            $asm.puts "bgt #{operands[0].mipsOperand}, #{operands[1].mipsOperand}, #{operands[2].asmLabel}"
+        when /^bs/
+            $asm.puts "blt #{operands[0].mipsOperand}, #{operands[1].mipsOperand}, #{operands[2].asmLabel}"
+        when /^bz/
+            $asm.puts "beq #{operands[0].mipsOperand}, #{operands[1].mipsOperand}, #{operands[2].asmLabel}"
+        when /^bnz/
+            $asm.puts "bne #{operands[0].mipsOperand}, #{operands[1].mipsOperand}, #{operands[2].asmLabel}"
+        when "leai", "leap"
+            operands[0].mipsEmitLea(operands[1])
+        when "smulli"
+            raise "Wrong number of arguments to smull in #{self.inspect} at #{codeOriginString}" unless operands.length == 4
+            $asm.puts "mult #{operands[0].mipsOperand}, #{operands[1].mipsOperand}"
+            $asm.puts "mflo #{operands[2].mipsOperand}"
+            $asm.puts "mfhi #{operands[3].mipsOperand}"
+        when "movz"
+            $asm.puts "movz #{operands[0].mipsOperand}, #{operands[1].mipsOperand}, #{operands[2].mipsOperand}"
+        when "movn"
+            $asm.puts "movn #{operands[0].mipsOperand}, #{operands[1].mipsOperand}, #{operands[2].mipsOperand}"
+        when "setcallreg"
+            $asm.puts "move #{MIPS_CALL_REG.mipsOperand}, #{operands[0].mipsOperand}"
+        when "slt", "sltb"
+            $asm.puts "slt #{operands[0].mipsOperand}, #{operands[1].mipsOperand}, #{operands[2].mipsOperand}"
+        when "sltu", "sltub"
+            $asm.puts "sltu #{operands[0].mipsOperand}, #{operands[1].mipsOperand}, #{operands[2].mipsOperand}"
+        when "pichdr"
+            $asm.putStr("OFFLINE_ASM_CPLOAD(#{MIPS_CALL_REG.mipsOperand})")
+        when "memfence"
+            $asm.puts "sync"
+        else
+            lowerDefault
+        end
+    end
+end
diff --git a/offlineasm/offsets.rb b/offlineasm/offsets.rb
new file mode 100644
index 0000000..50b963b
--- /dev/null
+++ b/offlineasm/offsets.rb
@@ -0,0 +1,194 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "ast"
+
+def to32Bit(value)
+    if value > 0x7fffffff
+        value -= 1 << 32
+    end
+    value
+end
+
+OFFSET_HEADER_MAGIC_NUMBERS = [ to32Bit(0x9e43fd66), to32Bit(0x4379bfba) ]
+OFFSET_MAGIC_NUMBERS = [ to32Bit(0xec577ac7), to32Bit(0x0ff5e755) ]
+
+#
+# MissingMagicValuesException
+#
+# Thrown when magic values are missing from the binary.
+#
+
+class MissingMagicValuesException < Exception
+end
+
+#
+# offsetsList(ast)
+# sizesList(ast)
+#
+# Returns a list of offsets and sizes used by the AST.
+#
+
+def offsetsList(ast)
+    ast.filter(StructOffset).uniq.sort
+end
+
+def sizesList(ast)
+    ast.filter(Sizeof).uniq.sort
+end
+
+#
+# offsetsAndConfigurationIndex(ast, file) ->
+#     [[offsets, index], ...]
+#
+# Parses the offsets from a file and returns a list of offsets and the
+# index of the configuration that is valid in this build target.
+#
+
+def offsetsAndConfigurationIndex(file)
+    endiannessMarkerBytes = nil
+    result = {}
+    
+    def readInt(endianness, bytes)
+        if endianness == :little
+            # Little endian
+            (bytes[0] << 0 |
+             bytes[1] << 8 |
+             bytes[2] << 16 |
+             bytes[3] << 24)
+        else
+            # Big endian
+            (bytes[0] << 24 |
+             bytes[1] << 16 |
+             bytes[2] << 8 |
+             bytes[3] << 0)
+        end
+    end
+    
+    def prepareMagic(endianness, numbers)
+        magicBytes = []
+        numbers.each {
+            | number |
+            currentBytes = []
+            4.times {
+                currentBytes << (number & 0xff)
+                number >>= 8
+            }
+            if endianness == :big
+                currentBytes.reverse!
+            end
+            magicBytes += currentBytes
+        }
+        magicBytes
+    end
+    
+    fileBytes = []
+    
+    File.open(file, "rb") {
+        | inp |
+        loop {
+            byte = inp.getbyte
+            break unless byte
+            fileBytes << byte
+        }
+    }
+    
+    def sliceByteArrays(byteArray, pattern)
+        result = []
+        lastSlicePoint = 0
+        (byteArray.length - pattern.length + 1).times {
+            | index |
+            foundOne = true
+            pattern.length.times {
+                | subIndex |
+                if byteArray[index + subIndex] != pattern[subIndex]
+                    foundOne = false
+                    break
+                end
+            }
+            if foundOne
+                result << byteArray[lastSlicePoint...index]
+                lastSlicePoint = index + pattern.length
+            end
+        }
+        
+        result << byteArray[lastSlicePoint...(byteArray.length)]
+        
+        result
+    end
+    
+    [:little, :big].each {
+        | endianness |
+        headerMagicBytes = prepareMagic(endianness, OFFSET_HEADER_MAGIC_NUMBERS)
+        magicBytes = prepareMagic(endianness, OFFSET_MAGIC_NUMBERS)
+        
+        bigArray = sliceByteArrays(fileBytes, headerMagicBytes)
+        unless bigArray.size <= 1
+            bigArray[1..-1].each {
+                | configArray |
+                array = sliceByteArrays(configArray, magicBytes)
+                index = readInt(endianness, array[1])
+                offsets = []
+                array[2..-1].each {
+                    | data |
+                    offsets << readInt(endianness, data)
+                }
+                result[index] = offsets
+            }
+        end
+    }
+    
+    raise MissingMagicValuesException unless result.length >= 1
+    
+    # result is {index1=>offsets1, index2=>offsets2} but we want to return
+    # [[offsets1, index1], [offsets2, index2]].
+    return result.map {
+        | pair |
+        pair.reverse
+    }
+end
+
+#
+# buildOffsetsMap(ast, offsetsList) -> [offsets, sizes]
+#
+# Builds a mapping between StructOffset nodes and their values.
+#
+
+def buildOffsetsMap(ast, offsetsList)
+    offsetsMap = {}
+    sizesMap = {}
+    astOffsetsList = offsetsList(ast)
+    astSizesList = sizesList(ast)
+    raise unless astOffsetsList.size + astSizesList.size == offsetsList.size
+    offsetsList(ast).each_with_index {
+        | structOffset, index |
+        offsetsMap[structOffset] = offsetsList.shift
+    }
+    sizesList(ast).each_with_index {
+        | sizeof, index |
+        sizesMap[sizeof] = offsetsList.shift
+    }
+    [offsetsMap, sizesMap]
+end
+
diff --git a/offlineasm/opt.rb b/offlineasm/opt.rb
new file mode 100644
index 0000000..c721758
--- /dev/null
+++ b/offlineasm/opt.rb
@@ -0,0 +1,135 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "ast"
+
+#
+# "Optimization" passes. These are used to lower the representation for
+# backends that cannot handle some of our higher-level instructions.
+#
+
+#
+# A temporary - a variable that will be allocated to a register after we're
+# done.
+#
+
+class Node
+    def replaceTemporariesWithRegisters(kind)
+        mapChildren {
+            | node |
+            node.replaceTemporariesWithRegisters(kind)
+        }
+    end
+end
+
+class Tmp < NoChildren
+    attr_reader :firstMention, :lastMention
+    attr_reader :kind
+    attr_accessor :register
+
+    def initialize(codeOrigin, kind)
+        super(codeOrigin)
+        @kind = kind
+    end
+    
+    def dump
+        "$tmp#{object_id}"
+    end
+    
+    def mention!(position)
+        if not @firstMention or position < @firstMention
+            @firstMention = position
+        end
+        if not @lastMention or position > @lastMention
+            @lastMention = position
+        end
+    end
+    
+    def replaceTemporariesWithRegisters(kind)
+        if @kind == kind
+            raise "Did not allocate register to temporary at #{codeOriginString}" unless @register
+            @register
+        else
+            self
+        end
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        true
+    end
+end
+
+# Assign registers to temporaries, by finding which temporaries interfere
+# with each other. Note that this relies on temporary live ranges not crossing
+# basic block boundaries.
+
+def assignRegistersToTemporaries(list, kind, registers)
+    list.each_with_index {
+        | node, index |
+        node.filter(Tmp).uniq.each {
+            | tmp |
+            if tmp.kind == kind
+                tmp.mention! index
+            end
+        }
+    }
+    
+    freeRegisters = registers.dup
+    list.each_with_index {
+        | node, index |
+        tmpList = node.filter(Tmp).uniq
+        tmpList.each {
+            | tmp |
+            if tmp.kind == kind and tmp.firstMention == index
+                raise "Could not allocate register to temporary at #{node.codeOriginString}" if freeRegisters.empty?
+                tmp.register = freeRegisters.pop
+            end
+        }
+        tmpList.each {
+            | tmp |
+            if tmp.kind == kind and tmp.lastMention == index
+                freeRegisters.push tmp.register
+                raise "Register allocation inconsistency at #{node.codeOriginString}" if freeRegisters.size > registers.size
+            end
+        }
+    }
+    
+    list.map {
+        | node |
+        node.replaceTemporariesWithRegisters(kind)
+    }
+end
+
diff --git a/offlineasm/parser.rb b/offlineasm/parser.rb
new file mode 100644
index 0000000..b445112
--- /dev/null
+++ b/offlineasm/parser.rb
@@ -0,0 +1,826 @@
+# Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "ast"
+require "instructions"
+require "pathname"
+require "registers"
+require "self_hash"
+
+class SourceFile
+    @@fileNames = []
+    
+    attr_reader :name, :fileNumber
+
+    def SourceFile.outputDotFileList(outp)
+        @@fileNames.each_index {
+            | index |
+            outp.puts "\".file #{index+1} \\\"#{@@fileNames[index]}\\\"\\n\""
+        }
+    end
+
+    def initialize(fileName)
+        @name = Pathname.new(fileName)
+        pathName = "#{@name.realpath}"
+        fileNumber = @@fileNames.index(pathName)
+        if not fileNumber
+            @@fileNames << pathName
+            fileNumber = @@fileNames.length
+        else
+            fileNumber += 1 # File numbers are 1 based
+        end
+        @fileNumber = fileNumber
+    end
+end
+
+class CodeOrigin
+    attr_reader :lineNumber
+    
+    def initialize(sourceFile, lineNumber)
+        @sourceFile = sourceFile
+        @lineNumber = lineNumber
+    end
+
+    def fileName
+        @sourceFile.name
+    end
+
+    def debugDirective
+        $emitWinAsm ? nil : "\".loc #{@sourceFile.fileNumber} #{lineNumber}\\n\""
+    end
+
+    def to_s
+        "#{fileName}:#{lineNumber}"
+    end
+end
+
+class IncludeFile
+    @@includeDirs = []
+
+    attr_reader :fileName
+
+    def initialize(moduleName, defaultDir)
+        directory = nil
+        @@includeDirs.each {
+            | includePath |
+            fileName = includePath + (moduleName + ".asm")
+            directory = includePath unless not File.file?(fileName)
+        }
+        if not directory
+            directory = defaultDir
+        end
+
+        @fileName = directory + (moduleName + ".asm")
+    end
+
+    def self.processIncludeOptions()
+        while ARGV[0][/^-I/]
+            path = ARGV.shift[2..-1]
+            if not path
+                path = ARGV.shift
+            end
+            @@includeDirs << (path + "/")
+        end
+    end
+end
+
+class Token
+    attr_reader :codeOrigin, :string
+    
+    def initialize(codeOrigin, string)
+        @codeOrigin = codeOrigin
+        @string = string
+    end
+    
+    def ==(other)
+        if other.is_a? Token
+            @string == other.string
+        else
+            @string == other
+        end
+    end
+    
+    def =~(other)
+        @string =~ other
+    end
+    
+    def to_s
+        "#{@string.inspect} at #{codeOrigin}"
+    end
+    
+    def parseError(*comment)
+        if comment.empty?
+            raise "Parse error: #{to_s}"
+        else
+            raise "Parse error: #{to_s}: #{comment[0]}"
+        end
+    end
+end
+
+class Annotation
+    attr_reader :codeOrigin, :type, :string
+    def initialize(codeOrigin, type, string)
+        @codeOrigin = codeOrigin
+        @type = type
+        @string = string
+    end
+end
+
+#
+# The lexer. Takes a string and returns an array of tokens.
+#
+
+def lex(str, file)
+    result = []
+    lineNumber = 1
+    annotation = nil
+    whitespaceFound = false
+    while not str.empty?
+        case str
+        when /\A\#([^\n]*)/
+            # comment, ignore
+        when /\A\/\/\ ?([^\n]*)/
+            # annotation
+            annotation = $1
+            annotationType = whitespaceFound ? :local : :global
+        when /\A\n/
+            # We've found a '\n'.  Emit the last comment recorded if appropriate:
+            # We need to parse annotations regardless of whether the backend does
+            # anything with them or not. This is because the C++ backend may make
+            # use of this for its cloopDo debugging utility even if
+            # enableInstrAnnotations is not enabled.
+            if annotation
+                result << Annotation.new(CodeOrigin.new(file, lineNumber),
+                                         annotationType, annotation)
+                annotation = nil
+            end
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&)
+            lineNumber += 1
+        when /\A[a-zA-Z]([a-zA-Z0-9_.]*)/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&)
+        when /\A\.([a-zA-Z0-9_]*)/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&)
+        when /\A_([a-zA-Z0-9_]*)/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&)
+        when /\A([ \t]+)/
+            # whitespace, ignore
+            whitespaceFound = true
+            str = $~.post_match
+            next
+        when /\A0x([0-9a-fA-F]+)/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&.hex.to_s)
+        when /\A0([0-7]+)/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&.oct.to_s)
+        when /\A([0-9]+)/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&)
+        when /\A::/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&)
+        when /\A[:,\(\)\[\]=\+\-~\|&^*]/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&)
+        when /\A".*"/
+            result << Token.new(CodeOrigin.new(file, lineNumber), $&)
+        else
+            raise "Lexer error at #{CodeOrigin.new(file, lineNumber).to_s}, unexpected sequence #{str[0..20].inspect}"
+        end
+        whitespaceFound = false
+        str = $~.post_match
+    end
+    result
+end
+
+#
+# Token identification.
+#
+
+def isRegister(token)
+    token =~ REGISTER_PATTERN
+end
+
+def isInstruction(token)
+    INSTRUCTION_SET.member? token.string
+end
+
+def isKeyword(token)
+    token =~ /\A((true)|(false)|(if)|(then)|(else)|(elsif)|(end)|(and)|(or)|(not)|(global)|(macro)|(const)|(sizeof)|(error)|(include))\Z/ or
+        token =~ REGISTER_PATTERN or
+        isInstruction(token)
+end
+
+def isIdentifier(token)
+    token =~ /\A[a-zA-Z]([a-zA-Z0-9_.]*)\Z/ and not isKeyword(token)
+end
+
+def isLabel(token)
+    token =~ /\A_([a-zA-Z0-9_]*)\Z/
+end
+
+def isLocalLabel(token)
+    token =~ /\A\.([a-zA-Z0-9_]*)\Z/
+end
+
+def isVariable(token)
+    isIdentifier(token) or isRegister(token)
+end
+
+def isInteger(token)
+    token =~ /\A[0-9]/
+end
+
+def isString(token)
+    token =~ /\A".*"/
+end
+
+#
+# The parser. Takes an array of tokens and returns an AST. Methods
+# other than parse(tokens) are not for public consumption.
+#
+
+class Parser
+    def initialize(data, fileName)
+        @tokens = lex(data, fileName)
+        @idx = 0
+        @annotation = nil
+    end
+    
+    def parseError(*comment)
+        if @tokens[@idx]
+            @tokens[@idx].parseError(*comment)
+        else
+            if comment.empty?
+                raise "Parse error at end of file"
+            else
+                raise "Parse error at end of file: #{comment[0]}"
+            end
+        end
+    end
+    
+    def consume(regexp)
+        if regexp
+            parseError unless @tokens[@idx] =~ regexp
+        else
+            parseError unless @idx == @tokens.length
+        end
+        @idx += 1
+    end
+    
+    def skipNewLine
+        while @tokens[@idx] == "\n"
+            @idx += 1
+        end
+    end
+    
+    def parsePredicateAtom
+        if @tokens[@idx] == "not"
+            codeOrigin = @tokens[@idx].codeOrigin
+            @idx += 1
+            Not.new(codeOrigin, parsePredicateAtom)
+        elsif @tokens[@idx] == "("
+            @idx += 1
+            skipNewLine
+            result = parsePredicate
+            parseError unless @tokens[@idx] == ")"
+            @idx += 1
+            result
+        elsif @tokens[@idx] == "true"
+            result = True.instance
+            @idx += 1
+            result
+        elsif @tokens[@idx] == "false"
+            result = False.instance
+            @idx += 1
+            result
+        elsif isIdentifier @tokens[@idx]
+            result = Setting.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+            @idx += 1
+            result
+        else
+            parseError
+        end
+    end
+    
+    def parsePredicateAnd
+        result = parsePredicateAtom
+        while @tokens[@idx] == "and"
+            codeOrigin = @tokens[@idx].codeOrigin
+            @idx += 1
+            skipNewLine
+            right = parsePredicateAtom
+            result = And.new(codeOrigin, result, right)
+        end
+        result
+    end
+    
+    def parsePredicate
+        # some examples of precedence:
+        # not a and b -> (not a) and b
+        # a and b or c -> (a and b) or c
+        # a or b and c -> a or (b and c)
+        
+        result = parsePredicateAnd
+        while @tokens[@idx] == "or"
+            codeOrigin = @tokens[@idx].codeOrigin
+            @idx += 1
+            skipNewLine
+            right = parsePredicateAnd
+            result = Or.new(codeOrigin, result, right)
+        end
+        result
+    end
+    
+    def parseVariable
+        if isRegister(@tokens[@idx])
+            if @tokens[@idx] =~ FPR_PATTERN
+                result = FPRegisterID.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+            else
+                result = RegisterID.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+            end
+        elsif isIdentifier(@tokens[@idx])
+            result = Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+        else
+            parseError
+        end
+        @idx += 1
+        result
+    end
+    
+    def parseAddress(offset)
+        parseError unless @tokens[@idx] == "["
+        codeOrigin = @tokens[@idx].codeOrigin
+        
+        # Three possibilities:
+        # []       -> AbsoluteAddress
+        # [a]      -> Address
+        # [a,b]    -> BaseIndex with scale = 1
+        # [a,b,c]  -> BaseIndex
+        
+        @idx += 1
+        if @tokens[@idx] == "]"
+            @idx += 1
+            return AbsoluteAddress.new(codeOrigin, offset)
+        end
+        a = parseVariable
+        if @tokens[@idx] == "]"
+            result = Address.new(codeOrigin, a, offset)
+        else
+            parseError unless @tokens[@idx] == ","
+            @idx += 1
+            b = parseVariable
+            if @tokens[@idx] == "]"
+                result = BaseIndex.new(codeOrigin, a, b, 1, offset)
+            else
+                parseError unless @tokens[@idx] == ","
+                @idx += 1
+                parseError unless ["1", "2", "4", "8"].member? @tokens[@idx].string
+                c = @tokens[@idx].string.to_i
+                @idx += 1
+                parseError unless @tokens[@idx] == "]"
+                result = BaseIndex.new(codeOrigin, a, b, c, offset)
+            end
+        end
+        @idx += 1
+        result
+    end
+    
+    def parseColonColon
+        skipNewLine
+        codeOrigin = @tokens[@idx].codeOrigin
+        parseError unless isIdentifier @tokens[@idx]
+        names = [@tokens[@idx].string]
+        @idx += 1
+        while @tokens[@idx] == "::"
+            @idx += 1
+            parseError unless isIdentifier @tokens[@idx]
+            names << @tokens[@idx].string
+            @idx += 1
+        end
+        raise if names.empty?
+        [codeOrigin, names]
+    end
+    
+    def parseExpressionAtom
+        skipNewLine
+        if @tokens[@idx] == "-"
+            @idx += 1
+            NegImmediate.new(@tokens[@idx - 1].codeOrigin, parseExpressionAtom)
+        elsif @tokens[@idx] == "~"
+            @idx += 1
+            BitnotImmediate.new(@tokens[@idx - 1].codeOrigin, parseExpressionAtom)
+        elsif @tokens[@idx] == "("
+            @idx += 1
+            result = parseExpression
+            parseError unless @tokens[@idx] == ")"
+            @idx += 1
+            result
+        elsif isInteger @tokens[@idx]
+            result = Immediate.new(@tokens[@idx].codeOrigin, @tokens[@idx].string.to_i)
+            @idx += 1
+            result
+        elsif isString @tokens[@idx]
+            result = StringLiteral.new(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+            @idx += 1
+            result
+        elsif isIdentifier @tokens[@idx]
+            codeOrigin, names = parseColonColon
+            if names.size > 1
+                StructOffset.forField(codeOrigin, names[0..-2].join('::'), names[-1])
+            else
+                Variable.forName(codeOrigin, names[0])
+            end
+        elsif isRegister @tokens[@idx]
+            parseVariable
+        elsif @tokens[@idx] == "sizeof"
+            @idx += 1
+            codeOrigin, names = parseColonColon
+            Sizeof.forName(codeOrigin, names.join('::'))
+        elsif isLabel @tokens[@idx]
+            result = LabelReference.new(@tokens[@idx].codeOrigin, Label.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string))
+            @idx += 1
+            result
+        elsif isLocalLabel @tokens[@idx]
+            result = LocalLabelReference.new(@tokens[@idx].codeOrigin, LocalLabel.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string))
+            @idx += 1
+            result
+        else
+            parseError
+        end
+    end
+    
+    def parseExpressionMul
+        skipNewLine
+        result = parseExpressionAtom
+        while @tokens[@idx] == "*"
+            if @tokens[@idx] == "*"
+                @idx += 1
+                result = MulImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAtom)
+            else
+                raise
+            end
+        end
+        result
+    end
+    
+    def couldBeExpression
+        @tokens[@idx] == "-" or @tokens[@idx] == "~" or @tokens[@idx] == "sizeof" or isInteger(@tokens[@idx]) or isString(@tokens[@idx]) or isVariable(@tokens[@idx]) or @tokens[@idx] == "("
+    end
+    
+    def parseExpressionAdd
+        skipNewLine
+        result = parseExpressionMul
+        while @tokens[@idx] == "+" or @tokens[@idx] == "-"
+            if @tokens[@idx] == "+"
+                @idx += 1
+                result = AddImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionMul)
+            elsif @tokens[@idx] == "-"
+                @idx += 1
+                result = SubImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionMul)
+            else
+                raise
+            end
+        end
+        result
+    end
+    
+    def parseExpressionAnd
+        skipNewLine
+        result = parseExpressionAdd
+        while @tokens[@idx] == "&"
+            @idx += 1
+            result = AndImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAdd)
+        end
+        result
+    end
+    
+    def parseExpression
+        skipNewLine
+        result = parseExpressionAnd
+        while @tokens[@idx] == "|" or @tokens[@idx] == "^"
+            if @tokens[@idx] == "|"
+                @idx += 1
+                result = OrImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAnd)
+            elsif @tokens[@idx] == "^"
+                @idx += 1
+                result = XorImmediates.new(@tokens[@idx - 1].codeOrigin, result, parseExpressionAnd)
+            else
+                raise
+            end
+        end
+        result
+    end
+    
+    def parseOperand(comment)
+        skipNewLine
+        if couldBeExpression
+            expr = parseExpression
+            if @tokens[@idx] == "["
+                parseAddress(expr)
+            else
+                expr
+            end
+        elsif @tokens[@idx] == "["
+            parseAddress(Immediate.new(@tokens[@idx].codeOrigin, 0))
+        elsif isLabel @tokens[@idx]
+            result = LabelReference.new(@tokens[@idx].codeOrigin, Label.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string))
+            @idx += 1
+            result
+        elsif isLocalLabel @tokens[@idx]
+            result = LocalLabelReference.new(@tokens[@idx].codeOrigin, LocalLabel.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string))
+            @idx += 1
+            result
+        else
+            parseError(comment)
+        end
+    end
+    
+    def parseMacroVariables
+        skipNewLine
+        consume(/\A\(\Z/)
+        variables = []
+        loop {
+            skipNewLine
+            if @tokens[@idx] == ")"
+                @idx += 1
+                break
+            elsif isIdentifier(@tokens[@idx])
+                variables << Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+                @idx += 1
+                skipNewLine
+                if @tokens[@idx] == ")"
+                    @idx += 1
+                    break
+                elsif @tokens[@idx] == ","
+                    @idx += 1
+                else
+                    parseError
+                end
+            else
+                parseError
+            end
+        }
+        variables
+    end
+    
+    def parseSequence(final, comment)
+        firstCodeOrigin = @tokens[@idx].codeOrigin
+        list = []
+        loop {
+            if (@idx == @tokens.length and not final) or (final and @tokens[@idx] =~ final)
+                break
+            elsif @tokens[@idx].is_a? Annotation
+                # This is the only place where we can encounter a global
+                # annotation, and hence need to be able to distinguish between
+                # them.
+                # globalAnnotations are the ones that start from column 0. All
+                # others are considered localAnnotations.  The only reason to
+                # distinguish between them is so that we can format the output
+                # nicely as one would expect.
+
+                codeOrigin = @tokens[@idx].codeOrigin
+                annotationOpcode = (@tokens[@idx].type == :global) ? "globalAnnotation" : "localAnnotation"
+                list << Instruction.new(codeOrigin, annotationOpcode, [], @tokens[@idx].string)
+                @annotation = nil
+                @idx += 2 # Consume the newline as well.
+            elsif @tokens[@idx] == "\n"
+                # ignore
+                @idx += 1
+            elsif @tokens[@idx] == "const"
+                @idx += 1
+                parseError unless isVariable @tokens[@idx]
+                variable = Variable.forName(@tokens[@idx].codeOrigin, @tokens[@idx].string)
+                @idx += 1
+                parseError unless @tokens[@idx] == "="
+                @idx += 1
+                value = parseOperand("while inside of const #{variable.name}")
+                list << ConstDecl.new(@tokens[@idx].codeOrigin, variable, value)
+            elsif @tokens[@idx] == "error"
+                list << Error.new(@tokens[@idx].codeOrigin)
+                @idx += 1
+            elsif @tokens[@idx] == "if"
+                codeOrigin = @tokens[@idx].codeOrigin
+                @idx += 1
+                skipNewLine
+                predicate = parsePredicate
+                consume(/\A((then)|(\n))\Z/)
+                skipNewLine
+                ifThenElse = IfThenElse.new(codeOrigin, predicate, parseSequence(/\A((else)|(end)|(elsif))\Z/, "while inside of \"if #{predicate.dump}\""))
+                list << ifThenElse
+                while @tokens[@idx] == "elsif"
+                    codeOrigin = @tokens[@idx].codeOrigin
+                    @idx += 1
+                    skipNewLine
+                    predicate = parsePredicate
+                    consume(/\A((then)|(\n))\Z/)
+                    skipNewLine
+                    elseCase = IfThenElse.new(codeOrigin, predicate, parseSequence(/\A((else)|(end)|(elsif))\Z/, "while inside of \"if #{predicate.dump}\""))
+                    ifThenElse.elseCase = elseCase
+                    ifThenElse = elseCase
+                end
+                if @tokens[@idx] == "else"
+                    @idx += 1
+                    ifThenElse.elseCase = parseSequence(/\Aend\Z/, "while inside of else case for \"if #{predicate.dump}\"")
+                    @idx += 1
+                else
+                    parseError unless @tokens[@idx] == "end"
+                    @idx += 1
+                end
+            elsif @tokens[@idx] == "macro"
+                codeOrigin = @tokens[@idx].codeOrigin
+                @idx += 1
+                skipNewLine
+                parseError unless isIdentifier(@tokens[@idx])
+                name = @tokens[@idx].string
+                @idx += 1
+                variables = parseMacroVariables
+                body = parseSequence(/\Aend\Z/, "while inside of macro #{name}")
+                @idx += 1
+                list << Macro.new(codeOrigin, name, variables, body)
+            elsif @tokens[@idx] == "global"
+                codeOrigin = @tokens[@idx].codeOrigin
+                @idx += 1
+                skipNewLine
+                parseError unless isLabel(@tokens[@idx])
+                name = @tokens[@idx].string
+                @idx += 1
+                Label.setAsGlobal(codeOrigin, name)
+            elsif isInstruction @tokens[@idx]
+                codeOrigin = @tokens[@idx].codeOrigin
+                name = @tokens[@idx].string
+                @idx += 1
+                if (not final and @idx == @tokens.size) or (final and @tokens[@idx] =~ final)
+                    # Zero operand instruction, and it's the last one.
+                    list << Instruction.new(codeOrigin, name, [], @annotation)
+                    @annotation = nil
+                    break
+                elsif @tokens[@idx].is_a? Annotation
+                    list << Instruction.new(codeOrigin, name, [], @tokens[@idx].string)
+                    @annotation = nil
+                    @idx += 2 # Consume the newline as well.
+                elsif @tokens[@idx] == "\n"
+                    # Zero operand instruction.
+                    list << Instruction.new(codeOrigin, name, [], @annotation)
+                    @annotation = nil
+                    @idx += 1
+                else
+                    # It's definitely an instruction, and it has at least one operand.
+                    operands = []
+                    endOfSequence = false
+                    loop {
+                        operands << parseOperand("while inside of instruction #{name}")
+                        if (not final and @idx == @tokens.size) or (final and @tokens[@idx] =~ final)
+                            # The end of the instruction and of the sequence.
+                            endOfSequence = true
+                            break
+                        elsif @tokens[@idx] == ","
+                            # Has another operand.
+                            @idx += 1
+                        elsif @tokens[@idx].is_a? Annotation
+                            @annotation = @tokens[@idx].string
+                            @idx += 2 # Consume the newline as well.
+                            break
+                        elsif @tokens[@idx] == "\n"
+                            # The end of the instruction.
+                            @idx += 1
+                            break
+                        else
+                            parseError("Expected a comma, newline, or #{final} after #{operands.last.dump}")
+                        end
+                    }
+                    list << Instruction.new(codeOrigin, name, operands, @annotation)
+                    @annotation = nil
+                    if endOfSequence
+                        break
+                    end
+                end
+
+            # Check for potential macro invocation:
+            elsif isIdentifier @tokens[@idx]
+                codeOrigin = @tokens[@idx].codeOrigin
+                name = @tokens[@idx].string
+                @idx += 1
+                if @tokens[@idx] == "("
+                    # Macro invocation.
+                    @idx += 1
+                    operands = []
+                    skipNewLine
+                    if @tokens[@idx] == ")"
+                        @idx += 1
+                    else
+                        loop {
+                            skipNewLine
+                            if @tokens[@idx] == "macro"
+                                # It's a macro lambda!
+                                codeOriginInner = @tokens[@idx].codeOrigin
+                                @idx += 1
+                                variables = parseMacroVariables
+                                body = parseSequence(/\Aend\Z/, "while inside of anonymous macro passed as argument to #{name}")
+                                @idx += 1
+                                operands << Macro.new(codeOriginInner, nil, variables, body)
+                            else
+                                operands << parseOperand("while inside of macro call to #{name}")
+                            end
+                            skipNewLine
+                            if @tokens[@idx] == ")"
+                                @idx += 1
+                                break
+                            elsif @tokens[@idx] == ","
+                                @idx += 1
+                            else
+                                parseError "Unexpected #{@tokens[@idx].string.inspect} while parsing invocation of macro #{name}"
+                            end
+                        }
+                    end
+                    # Check if there's a trailing annotation after the macro invoke:
+                    if @tokens[@idx].is_a? Annotation
+                        @annotation = @tokens[@idx].string
+                        @idx += 2 # Consume the newline as well.
+                    end
+                    list << MacroCall.new(codeOrigin, name, operands, @annotation)
+                    @annotation = nil
+                else
+                    parseError "Expected \"(\" after #{name}"
+                end
+            elsif isLabel @tokens[@idx] or isLocalLabel @tokens[@idx]
+                codeOrigin = @tokens[@idx].codeOrigin
+                name = @tokens[@idx].string
+                @idx += 1
+                parseError unless @tokens[@idx] == ":"
+                # It's a label.
+                if isLabel name
+                    list << Label.forName(codeOrigin, name, true)
+                else
+                    list << LocalLabel.forName(codeOrigin, name)
+                end
+                @idx += 1
+            elsif @tokens[@idx] == "include"
+                @idx += 1
+                parseError unless isIdentifier(@tokens[@idx])
+                moduleName = @tokens[@idx].string
+                fileName = IncludeFile.new(moduleName, @tokens[@idx].codeOrigin.fileName.dirname).fileName
+                @idx += 1
+                list << parse(fileName)
+            else
+                parseError "Expecting terminal #{final} #{comment}"
+            end
+        }
+        Sequence.new(firstCodeOrigin, list)
+    end
+
+    def parseIncludes(final, comment)
+        firstCodeOrigin = @tokens[@idx].codeOrigin
+        fileList = []
+        fileList << @tokens[@idx].codeOrigin.fileName
+        loop {
+            if (@idx == @tokens.length and not final) or (final and @tokens[@idx] =~ final)
+                break
+            elsif @tokens[@idx] == "include"
+                @idx += 1
+                parseError unless isIdentifier(@tokens[@idx])
+                moduleName = @tokens[@idx].string
+                fileName = IncludeFile.new(moduleName, @tokens[@idx].codeOrigin.fileName.dirname).fileName
+                @idx += 1
+                
+                fileList << fileName
+            else
+                @idx += 1
+            end
+        }
+
+        return fileList
+    end
+end
+
+def parseData(data, fileName)
+    parser = Parser.new(data, SourceFile.new(fileName))
+    parser.parseSequence(nil, "")
+end
+
+def parse(fileName)
+    parseData(IO::read(fileName), fileName)
+end
+
+def parseHash(fileName)
+    parser = Parser.new(IO::read(fileName), SourceFile.new(fileName))
+    fileList = parser.parseIncludes(nil, "")
+    fileListHash(fileList)
+end
+
diff --git a/offlineasm/registers.rb b/offlineasm/registers.rb
new file mode 100644
index 0000000..b6ed36d
--- /dev/null
+++ b/offlineasm/registers.rb
@@ -0,0 +1,85 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+
+GPRS =
+    [
+     "t0",
+     "t1",
+     "t2",
+     "t3",
+     "t4",
+     "t5",
+     "cfr",
+     "a0",
+     "a1",
+     "a2",
+     "a3",
+     "r0",
+     "r1",
+     "sp",
+     "lr",
+     "pc",
+     # 64-bit only registers:
+     "csr0",
+     "csr1",
+     "csr2",
+     "csr3",
+     "csr4",
+     "csr5",
+     "csr6",
+     "csr7",
+     "csr8",
+     "csr9"
+    ]
+
+FPRS =
+    [
+     "ft0",
+     "ft1",
+     "ft2",
+     "ft3",
+     "ft4",
+     "ft5",
+     "fa0",
+     "fa1",
+     "fa2",
+     "fa3",
+     "csfr0",
+     "csfr1",
+     "csfr2",
+     "csfr3",
+     "csfr4",
+     "csfr5",
+     "csfr6",
+     "csfr7",
+     "fr"
+    ]
+
+REGISTERS = GPRS + FPRS
+
+GPR_PATTERN = Regexp.new('\\A((' + GPRS.join(')|(') + '))\\Z')
+FPR_PATTERN = Regexp.new('\\A((' + FPRS.join(')|(') + '))\\Z')
+
+REGISTER_PATTERN = Regexp.new('\\A((' + REGISTERS.join(')|(') + '))\\Z')
diff --git a/offlineasm/risc.rb b/offlineasm/risc.rb
new file mode 100644
index 0000000..3fbc07d
--- /dev/null
+++ b/offlineasm/risc.rb
@@ -0,0 +1,730 @@
+# Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require 'config'
+require 'ast'
+require 'opt'
+
+# This file contains utilities that are useful for implementing a backend
+# for RISC-like processors (ARM, MIPS, etc).
+
+#
+# Lowering of simple branch ops. For example:
+#
+# baddiz foo, bar, baz
+#
+# will become:
+#
+# addi foo, bar
+# bz baz
+#
+
+def riscLowerSimpleBranchOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            annotation = node.annotation
+            case node.opcode
+            when /^b(addi|subi|ori|addp)/
+                op = $1
+                branch = "b" + $~.post_match
+                
+                case op
+                when "addi"
+                    op = "addis"
+                when "addp"
+                    op = "addps"
+                when "subi"
+                    op = "subis"
+                when "ori"
+                    op = "oris"
+                end
+                
+                newList << Instruction.new(node.codeOrigin, op, node.operands[0..-2], annotation)
+                newList << Instruction.new(node.codeOrigin, branch, [node.operands[-1]])
+            when 'bmulis', 'bmulz', 'bmulnz'
+                condition = $~.post_match
+                newList << Instruction.new(node.codeOrigin, "muli", node.operands[0..-2], annotation)
+                newList << Instruction.new(node.codeOrigin, "bti" + condition, [node.operands[-2], node.operands[-1]])
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowing of complex branch ops. For example:
+#
+# bmulio foo, bar, baz
+#
+# becomes:
+#
+# smulli foo, bar, bar, tmp1
+# rshifti bar, 31, tmp2
+# bineq tmp1, tmp2, baz
+#
+
+def riscLowerHardBranchOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction and node.opcode == "bmulio"
+            tmp1 = Tmp.new(node.codeOrigin, :gpr)
+            tmp2 = Tmp.new(node.codeOrigin, :gpr)
+            newList << Instruction.new(node.codeOrigin, "smulli", [node.operands[0], node.operands[1], node.operands[1], tmp1], node.annotation)
+            newList << Instruction.new(node.codeOrigin, "rshifti", [node.operands[-2], Immediate.new(node.codeOrigin, 31), tmp2])
+            newList << Instruction.new(node.codeOrigin, "bineq", [tmp1, tmp2, node.operands[-1]])
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of shift ops. For example:
+#
+# lshifti foo, bar
+#
+# will become:
+#
+# andi foo, 31, tmp
+# lshifti tmp, bar
+#
+
+def riscSanitizeShift(operand, list)
+    return operand if operand.immediate?
+    
+    tmp = Tmp.new(operand.codeOrigin, :gpr)
+    list << Instruction.new(operand.codeOrigin, "andi", [operand, Immediate.new(operand.codeOrigin, 31), tmp])
+    tmp
+end
+
+def riscLowerShiftOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "lshifti", "rshifti", "urshifti", "lshiftp", "rshiftp", "urshiftp"
+                if node.operands.size == 2
+                    newList << Instruction.new(node.codeOrigin, node.opcode, [riscSanitizeShift(node.operands[0], newList), node.operands[1]], node.annotation)
+                else
+                    newList << Instruction.new(node.codeOrigin, node.opcode, [node.operands[0], riscSanitizeShift(node.operands[1], newList), node.operands[2]], node.annotation)
+                    raise "Wrong number of operands for shift at #{node.codeOriginString}" unless node.operands.size == 3
+                end
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of malformed addresses. For example:
+#
+# loadp 10000[foo], bar
+#
+# will become:
+#
+# move 10000, tmp
+# addp foo, tmp
+# loadp 0[tmp], bar
+#
+# Note that you use this lowering phase by passing it a block that returns true
+# if you don't want to lower the address, or false if you do. For example to get
+# the effect of the example above, the block would have to say something like:
+#
+# riscLowerMalformedAddresses(thingy) {
+#     | node, address |
+#     if address.is_a? Address
+#         address.offset.value > 1000
+#     else
+#         true # don't lower anything else, in this example
+#     end
+# }
+#
+# See arm.rb for a different example, in which we lower all BaseIndex addresses
+# that have non-zero offset, all Address addresses that have large offsets, and
+# all other addresses (like AbsoluteAddress).
+#
+
+class Node
+    def riscLowerMalformedAddressesRecurse(list, topLevelNode, &block)
+        mapChildren {
+            | subNode |
+            subNode.riscLowerMalformedAddressesRecurse(list, topLevelNode, &block)
+        }
+    end
+end
+
+class Address
+    def riscLowerMalformedAddressesRecurse(list, node, &block)
+        return self if yield node, self
+
+        tmp = Tmp.new(codeOrigin, :gpr)
+        list << Instruction.new(codeOrigin, "move", [offset, tmp])
+        list << Instruction.new(codeOrigin, "addp", [base, tmp])
+        Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, 0))
+    end
+end
+
+class BaseIndex
+    def riscLowerMalformedAddressesRecurse(list, node, &block)
+        return self if yield node, self
+        
+        tmp = Tmp.new(codeOrigin, :gpr)
+        list << Instruction.new(codeOrigin, "leap", [BaseIndex.new(codeOrigin, base, index, scale, Immediate.new(codeOrigin, 0)), tmp])
+        Address.new(codeOrigin, tmp, offset).riscLowerMalformedAddressesRecurse(list, node, &block)
+    end
+end
+
+class AbsoluteAddress
+    def riscLowerMalformedAddressesRecurse(list, node, &block)
+        return self if yield node, self
+        
+        tmp = Tmp.new(codeOrigin, :gpr)
+        list << Instruction.new(codeOrigin, "move", [address, tmp])
+        Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, 0))
+    end
+end
+
+def riscLowerMalformedAddresses(list, &block)
+    newList = []
+    list.each {
+        | node |
+        newList << node.riscLowerMalformedAddressesRecurse(newList, node, &block)
+    }
+    newList
+end
+
+#
+# Lowering of malformed addresses in double loads and stores. For example:
+#
+# loadd [foo, bar, 8], baz
+#
+# becomes:
+#
+# leap [foo, bar, 8], tmp
+# loadd [tmp], baz
+#
+
+class Node
+    def riscDoubleAddress(list)
+        self
+    end
+end
+
+class BaseIndex
+    def riscDoubleAddress(list)
+        tmp = Tmp.new(codeOrigin, :gpr)
+        list << Instruction.new(codeOrigin, "leap", [self, tmp])
+        Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, 0))
+    end
+end
+
+def riscLowerMalformedAddressesDouble(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "loadd"
+                newList << Instruction.new(node.codeOrigin, "loadd", [node.operands[0].riscDoubleAddress(newList), node.operands[1]], node.annotation)
+            when "stored"
+                newList << Instruction.new(node.codeOrigin, "stored", [node.operands[0], node.operands[1].riscDoubleAddress(newList)], node.annotation)
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of misplaced immediates for opcodes in opcodeList. For example, if storei is in opcodeList:
+#
+# storei 0, [foo]
+#
+# will become:
+#
+# move 0, tmp
+# storei tmp, [foo]
+#
+
+def riscLowerMisplacedImmediates(list, opcodeList)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            if opcodeList.include? node.opcode
+                operands = node.operands
+                newOperands = []
+                operands.each {
+                    | operand |
+                    if operand.is_a? Immediate
+                        tmp = Tmp.new(operand.codeOrigin, :gpr)
+                        newList << Instruction.new(operand.codeOrigin, "move", [operand, tmp])
+                        newOperands << tmp
+                    else
+                        newOperands << operand
+                    end
+                }
+                newList << Instruction.new(node.codeOrigin, node.opcode, newOperands, node.annotation)
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of malformed immediates except when used in a "move" instruction.
+# For example:
+#
+# addp 642641, foo
+#
+# will become:
+#
+# move 642641, tmp
+# addp tmp, foo
+#
+
+class Node
+    def riscLowerMalformedImmediatesRecurse(list, validImmediates)
+        mapChildren {
+            | node |
+            node.riscLowerMalformedImmediatesRecurse(list, validImmediates)
+        }
+    end
+end
+
+class Address
+    def riscLowerMalformedImmediatesRecurse(list, validImmediates)
+        self
+    end
+end
+
+class BaseIndex
+    def riscLowerMalformedImmediatesRecurse(list, validImmediates)
+        self
+    end
+end
+
+class AbsoluteAddress
+    def riscLowerMalformedImmediatesRecurse(list, validImmediates)
+        self
+    end
+end
+
+class Immediate
+    def riscLowerMalformedImmediatesRecurse(list, validImmediates)
+        unless validImmediates.include? value
+            tmp = Tmp.new(codeOrigin, :gpr)
+            list << Instruction.new(codeOrigin, "move", [self, tmp])
+            tmp
+        else
+            self
+        end
+    end
+end
+
+def riscLowerMalformedImmediates(list, validImmediates)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            annotation = node.annotation
+            case node.opcode
+            when "move"
+                newList << node
+            when "addi", "addp", "addq", "addis", "subi", "subp", "subq", "subis"
+                if node.operands[0].is_a? Immediate and
+                        (not validImmediates.include? node.operands[0].value) and
+                        validImmediates.include? -node.operands[0].value
+                        node.operands.size == 2
+                    if node.opcode =~ /add/
+                        newOpcode = "sub" + $~.post_match
+                    else
+                        newOpcode = "add" + $~.post_match
+                    end
+                    newList << Instruction.new(node.codeOrigin, newOpcode,
+                                               [Immediate.new(node.codeOrigin, -node.operands[0].value)] + node.operands[1..-1],
+                                               annotation)
+                else
+                    newList << node.riscLowerMalformedImmediatesRecurse(newList, validImmediates)
+                end
+            when "muli", "mulp", "mulq"
+                if node.operands[0].is_a? Immediate
+                    tmp = Tmp.new(codeOrigin, :gpr)
+                    newList << Instruction.new(node.codeOrigin, "move", [node.operands[0], tmp], annotation)
+                    newList << Instruction.new(node.codeOrigin, node.opcode, [tmp] + node.operands[1..-1])
+                else
+                    newList << node.riscLowerMalformedImmediatesRecurse(newList, validImmediates)
+                end
+            else
+                newList << node.riscLowerMalformedImmediatesRecurse(newList, validImmediates)
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of misplaced addresses. For example:
+#
+# addi foo, [bar]
+#
+# will become:
+#
+# loadi [bar], tmp
+# addi foo, tmp
+# storei tmp, [bar]
+#
+# Another example:
+#
+# addi [foo], bar
+#
+# will become:
+#
+# loadi [foo], tmp
+# addi tmp, bar
+#
+
+def riscAsRegister(preList, postList, operand, suffix, needStore)
+    return operand unless operand.address?
+    
+    tmp = Tmp.new(operand.codeOrigin, if suffix == "d" then :fpr else :gpr end)
+    preList << Instruction.new(operand.codeOrigin, "load" + suffix, [operand, tmp])
+    if needStore
+        postList << Instruction.new(operand.codeOrigin, "store" + suffix, [tmp, operand])
+    end
+    tmp
+end
+
+def riscAsRegisters(preList, postList, operands, suffix)
+    newOperands = []
+    operands.each_with_index {
+        | operand, index |
+        newOperands << riscAsRegister(preList, postList, operand, suffix, index == operands.size - 1)
+    }
+    newOperands
+end
+
+def riscLowerMisplacedAddresses(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            postInstructions = []
+            annotation = node.annotation
+            case node.opcode
+            when "addi", "addis", "andi", "lshifti", "muli", "negi", "noti", "ori", "oris",
+                "rshifti", "urshifti", "subi", "subis", "xori", /^bi/, /^bti/, /^ci/, /^ti/
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, postInstructions, node.operands, "i"),
+                                           annotation)
+            when "addp", "andp", "lshiftp", "mulp", "negp", "orp", "rshiftp", "urshiftp",
+                "subp", "xorp", /^bp/, /^btp/, /^cp/
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, postInstructions, node.operands, "p"),
+                                           annotation)
+            when "addq", "andq", "lshiftq", "mulq", "negq", "orq", "rshiftq", "urshiftq",
+                "subq", "xorq", /^bq/, /^btq/, /^cq/
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, postInstructions, node.operands, "q"),
+                                           annotation)
+            when "bbeq", "bbneq", "bba", "bbaeq", "bbb", "bbbeq", "btbz", "btbnz", "tbz", "tbnz",
+                "cbeq", "cbneq", "cba", "cbaeq", "cbb", "cbbeq"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, postInstructions, node.operands, "b"),
+                                           annotation)
+            when "bbgt", "bbgteq", "bblt", "bblteq", "btbs", "tbs", "cbgt", "cbgteq", "cblt", "cblteq"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, postInstructions, node.operands, "bs"),
+                                           annotation)
+            when "addd", "divd", "subd", "muld", "sqrtd", /^bd/
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           riscAsRegisters(newList, postInstructions, node.operands, "d"),
+                                           annotation)
+            when "jmp", "call"
+                newList << Instruction.new(node.codeOrigin,
+                                           node.opcode,
+                                           [riscAsRegister(newList, postInstructions, node.operands[0], "p", false)],
+                                           annotation)
+            else
+                newList << node
+            end
+            newList += postInstructions
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of register reuse in compare instructions. For example:
+#
+# cieq t0, t1, t0
+#
+# will become:
+#
+# mov tmp, t0
+# cieq tmp, t1, t0
+#
+
+def riscLowerRegisterReuse(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            annotation = node.annotation
+            case node.opcode
+            when "cieq", "cineq", "cia", "ciaeq", "cib", "cibeq", "cigt", "cigteq", "cilt", "cilteq",
+                "cpeq", "cpneq", "cpa", "cpaeq", "cpb", "cpbeq", "cpgt", "cpgteq", "cplt", "cplteq",
+                "tis", "tiz", "tinz", "tbs", "tbz", "tbnz", "tps", "tpz", "tpnz", "cbeq", "cbneq",
+                "cba", "cbaeq", "cbb", "cbbeq", "cbgt", "cbgteq", "cblt", "cblteq"
+                if node.operands.size == 2
+                    if node.operands[0] == node.operands[1]
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        newList << Instruction.new(node.codeOrigin, "move", [node.operands[0], tmp], annotation)
+                        newList << Instruction.new(node.codeOrigin, node.opcode, [tmp, node.operands[1]])
+                    else
+                        newList << node
+                    end
+                else
+                    raise "Wrong number of arguments at #{node.codeOriginString}" unless node.operands.size == 3
+                    if node.operands[0] == node.operands[2]
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        newList << Instruction.new(node.codeOrigin, "move", [node.operands[0], tmp], annotation)
+                        newList << Instruction.new(node.codeOrigin, node.opcode, [tmp, node.operands[1], node.operands[2]])
+                    elsif node.operands[1] == node.operands[2]
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        newList << Instruction.new(node.codeOrigin, "move", [node.operands[1], tmp], annotation)
+                        newList << Instruction.new(node.codeOrigin, node.opcode, [node.operands[0], tmp, node.operands[2]])
+                    else
+                        newList << node
+                    end
+                end
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of the not instruction. The following:
+#
+# noti t0
+#
+# becomes:
+#
+# xori -1, t0
+#
+
+def riscLowerNot(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "noti", "notp"
+                raise "Wrong nubmer of operands at #{node.codeOriginString}" unless node.operands.size == 1
+                suffix = node.opcode[-1..-1]
+                newList << Instruction.new(node.codeOrigin, "xor" + suffix,
+                                           [Immediate.new(node.codeOrigin, -1), node.operands[0]])
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    return newList
+end
+
+#
+# Lowing of complex branch ops on 64-bit. For example:
+#
+# bmulio foo, bar, baz
+#
+# becomes:
+#
+# smulli foo, bar, bar
+# rshiftp bar, 32, tmp1
+# rshifti bar, 31, tmp2
+# zxi2p bar, bar 
+# bineq tmp1, tmp2, baz
+#
+
+def riscLowerHardBranchOps64(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction and node.opcode == "bmulio"
+            tmp1 = Tmp.new(node.codeOrigin, :gpr)
+            tmp2 = Tmp.new(node.codeOrigin, :gpr)
+            newList << Instruction.new(node.codeOrigin, "smulli", [node.operands[0], node.operands[1], node.operands[1]])
+            newList << Instruction.new(node.codeOrigin, "rshiftp", [node.operands[1], Immediate.new(node.codeOrigin, 32), tmp1])
+            newList << Instruction.new(node.codeOrigin, "rshifti", [node.operands[1], Immediate.new(node.codeOrigin, 31), tmp2])
+            newList << Instruction.new(node.codeOrigin, "zxi2p", [node.operands[1], node.operands[1]])
+            newList << Instruction.new(node.codeOrigin, "bineq", [tmp1, tmp2, node.operands[2]])
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+#
+# Lowering of test instructions. For example:
+#
+# btiz t0, t1, .foo
+#
+# becomes:
+#
+# andi t0, t1, tmp
+# bieq tmp, 0, .foo
+#
+# and another example:
+#
+# tiz t0, t1, t2
+#
+# becomes:
+#
+# andi t0, t1, tmp
+# cieq tmp, 0, t2
+#
+
+def riscLowerTest(list)
+    def emit(newList, andOpcode, branchOpcode, node)
+        if node.operands.size == 2
+            newList << Instruction.new(node.codeOrigin, branchOpcode, [node.operands[0], Immediate.new(node.codeOrigin, 0), node.operands[1]])
+            return
+        end
+
+        raise "Incorrect number of operands at #{codeOriginString}" unless node.operands.size == 3
+
+        if node.operands[0].immediate? and node.operands[0].value == -1
+            newList << Instruction.new(node.codeOrigin, branchOpcode, [node.operands[1], Immediate.new(node.codeOrigin, 0), node.operands[2]])
+            return
+        end
+
+        if node.operands[1].immediate? and node.operands[1].value == -1
+            newList << Instruction.new(node.codeOrigin, branchOpcode, [node.operands[0], Immediate.new(node.codeOrigin, 0), node.operands[2]])
+            return
+        end
+        
+        tmp = Tmp.new(node.codeOrigin, :gpr)
+        newList << Instruction.new(node.codeOrigin, andOpcode, [node.operands[0], node.operands[1], tmp])
+        newList << Instruction.new(node.codeOrigin, branchOpcode, [tmp, Immediate.new(node.codeOrigin, 0), node.operands[2]])
+    end
+
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "btis"
+                emit(newList, "andi", "bilt", node)
+            when "btiz"
+                emit(newList, "andi", "bieq", node)
+            when "btinz"
+                emit(newList, "andi", "bineq", node)
+            when "btps"
+                emit(newList, "andp", "bplt", node)
+            when "btpz"
+                emit(newList, "andp", "bpeq", node)
+            when "btpnz"
+                emit(newList, "andp", "bpneq", node)
+            when "btqs"
+                emit(newList, "andq", "bqlt", node)
+            when "btqz"
+                emit(newList, "andq", "bqeq", node)
+            when "btqnz"
+                emit(newList, "andq", "bqneq", node)
+            when "btbs"
+                emit(newList, "andi", "bblt", node)
+            when "btbz"
+                emit(newList, "andi", "bbeq", node)
+            when "btbnz"
+                emit(newList, "andi", "bbneq", node)
+            when "tis"
+                emit(newList, "andi", "cilt", node)
+            when "tiz"
+                emit(newList, "andi", "cieq", node)
+            when "tinz"
+                emit(newList, "andi", "cineq", node)
+            when "tps"
+                emit(newList, "andp", "cplt", node)
+            when "tpz"
+                emit(newList, "andp", "cpeq", node)
+            when "tpnz"
+                emit(newList, "andp", "cpneq", node)
+            when "tqs"
+                emit(newList, "andq", "cqlt", node)
+            when "tqz"
+                emit(newList, "andq", "cqeq", node)
+            when "tqnz"
+                emit(newList, "andq", "cqneq", node)
+            when "tbs"
+                emit(newList, "andi", "cblt", node)
+            when "tbz"
+                emit(newList, "andi", "cbeq", node)
+            when "tbnz"
+                emit(newList, "andi", "cbneq", node)
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    return newList
+end
diff --git a/offlineasm/self_hash.rb b/offlineasm/self_hash.rb
new file mode 100644
index 0000000..6c736ff
--- /dev/null
+++ b/offlineasm/self_hash.rb
@@ -0,0 +1,73 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "digest/sha1"
+require "pathname"
+
+#
+# dirHash(directory, regexp) -> SHA1 hexdigest
+#
+# Returns a hash of all files in the given directory that fit the given
+# pattern.
+#
+
+def dirHash(directory, regexp)
+    directory = Pathname.new(directory)
+    contents = ""
+    Dir.foreach(directory) {
+        | entry |
+        if entry =~ regexp
+            contents += IO::read(directory + entry)
+        end
+    }
+    return Digest::SHA1.hexdigest(contents)
+end
+
+#
+# fileListHash(fileList) -> SHA1 hexdigest
+#
+# Returns a hash of all files in the list.
+#
+
+def fileListHash(fileList)
+    contents = ""
+    fileList.each {
+        | fileName |
+        contents += IO::read(fileName)
+    }
+    return Digest::SHA1.hexdigest(contents)
+end
+
+#
+# selfHash -> SHA1 hexdigest
+#
+# Returns a hash of the offlineasm source code. This allows dependency
+# tracking for not just changes in input, but also changes in the assembler
+# itself.
+#
+
+def selfHash
+    dirHash(Pathname.new(__FILE__).dirname, /\.rb$/)
+end
+
diff --git a/offlineasm/settings.rb b/offlineasm/settings.rb
new file mode 100644
index 0000000..eec0925
--- /dev/null
+++ b/offlineasm/settings.rb
@@ -0,0 +1,249 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "ast"
+require "backends"
+require "parser"
+require "transform"
+
+#
+# computeSettingsCombinations(ast) -> settingsCombiations
+#
+# Computes an array of settings maps, where a settings map constitutes
+# a configuration for the assembly code being generated. The map
+# contains key value pairs where keys are settings names (strings) and
+# the values are booleans (true for enabled, false for disabled).
+#
+
+def computeSettingsCombinations(ast)
+    settingsCombinations = []
+    
+    def settingsCombinator(settingsCombinations, mapSoFar, remaining)
+        if remaining.empty?
+            settingsCombinations << mapSoFar
+            return
+        end
+        
+        newMap = mapSoFar.dup
+        newMap[remaining[0]] = true
+        settingsCombinator(settingsCombinations, newMap, remaining[1..-1])
+        
+        newMap = mapSoFar.dup
+        newMap[remaining[0]] = false
+        settingsCombinator(settingsCombinations, newMap, remaining[1..-1])
+    end
+    
+    nonBackendSettings = ast.filter(Setting).uniq.collect{ |v| v.name }
+    nonBackendSettings.delete_if {
+        | setting |
+        isBackend? setting
+    }
+    
+    allBackendsFalse = {}
+    BACKENDS.each {
+        | backend |
+        allBackendsFalse[backend] = false
+    }
+    
+    # This will create entries for invalid backends. That's fine. It's necessary
+    # because it ensures that generate_offsets_extractor (which knows about valid
+    # backends) has settings indices that are compatible with what asm will see
+    # (asm doesn't know about valid backends).
+    BACKENDS.each {
+        | backend |
+        map = allBackendsFalse.clone
+        map[backend] = true
+        settingsCombinator(settingsCombinations, map, nonBackendSettings)
+    }
+    
+    settingsCombinations
+end
+
+#
+# forSettings(concreteSettings, ast) {
+#     | concreteSettings, lowLevelAST, backend | ... }
+#
+# Determines if the settings combination is valid, and if so, calls
+# the block with the information you need to generate code.
+#
+
+def forSettings(concreteSettings, ast)
+    # Check which architectures this combinator claims to support.
+    numClaimedBackends = 0
+    selectedBackend = nil
+    BACKENDS.each {
+        | backend |
+        if concreteSettings[backend]
+            raise if selectedBackend
+            selectedBackend = backend
+        end
+    }
+    
+    return unless isValidBackend? selectedBackend
+    
+    # Resolve the AST down to a low-level form (no macros or conditionals).
+    lowLevelAST = ast.resolveSettings(concreteSettings)
+    
+    yield concreteSettings, lowLevelAST, selectedBackend
+end
+
+#
+# forEachValidSettingsCombination(ast) {
+#     | concreteSettings, ast, backend, index | ... }
+#
+# forEachValidSettingsCombination(ast, settingsCombinations) {
+#     | concreteSettings, ast, backend, index | ... }
+#
+# Executes the given block for each valid settings combination in the
+# settings map. The ast passed into the block is resolved
+# (ast.resolve) against the settings.
+#
+# The first form will call computeSettingsCombinations(ast) for you.
+#
+
+def forEachValidSettingsCombination(ast, *optionalSettingsCombinations)
+    raise if optionalSettingsCombinations.size > 1
+    
+    if optionalSettingsCombinations.empty?
+        settingsCombinations = computeSettingsCombinations(ast)
+    else
+        settingsCombinations = optionalSettingsCombiations[0]
+    end
+    
+    settingsCombinations.each_with_index {
+        | concreteSettings, index |
+        forSettings(concreteSettings, ast) {
+            | concreteSettings_, lowLevelAST, backend |
+            yield concreteSettings, lowLevelAST, backend, index
+        }
+    }
+end
+
+#
+# cppSettingsTest(concreteSettings)
+#
+# Returns the C++ code used to test if we are in a configuration that
+# corresponds to the given concrete settings.
+#
+
+def cppSettingsTest(concreteSettings)
+    "#if " + concreteSettings.to_a.collect{
+        | pair |
+        (if pair[1]
+             ""
+         else
+             "!"
+         end) + "OFFLINE_ASM_" + pair[0]
+    }.join(" && ")
+end
+
+#
+# isASTErroneous(ast)
+#
+# Tests to see if the AST claims that there is an error - i.e. if the
+# user's code, after settings resolution, has Error nodes.
+#
+
+def isASTErroneous(ast)
+    not ast.filter(Error).empty?
+end
+
+#
+# assertConfiguration(concreteSettings)
+#
+# Emits a check that asserts that we're using the given configuration.
+#
+
+def assertConfiguration(concreteSettings)
+    $output.puts cppSettingsTest(concreteSettings)
+    $output.puts "#else"
+    $output.puts "#error \"Configuration mismatch.\""
+    $output.puts "#endif"
+end
+
+#
+# emitCodeInConfiguration(concreteSettings, ast, backend) {
+#     | concreteSettings, ast, backend | ... }
+#
+# Emits all relevant guards to see if the configuration holds and
+# calls the block if the configuration is not erroneous.
+#
+
+def emitCodeInConfiguration(concreteSettings, ast, backend)
+    Label.resetReferenced
+
+    if !$emitWinAsm
+        $output.puts cppSettingsTest(concreteSettings)
+    else
+        if backend == "X86_WIN"
+            $output.puts ".MODEL FLAT, C"
+        end
+        $output.puts "INCLUDE #{File.basename($output.path)}.sym"
+        $output.puts "_TEXT SEGMENT"
+    end
+    
+    if isASTErroneous(ast)
+        $output.puts "#error \"Invalid configuration.\""
+    elsif not WORKING_BACKENDS.include? backend
+        $output.puts "#error \"This backend is not supported yet.\""
+    else
+        yield concreteSettings, ast, backend
+    end
+    
+    if !$emitWinAsm
+        $output.puts "#endif"
+    else
+        $output.puts "_TEXT ENDS"
+        $output.puts "END"
+
+        # Write symbols needed by MASM
+        File.open("#{File.basename($output.path)}.sym", "w") {
+            | outp |
+            Label.forReferencedExtern {
+                | name |
+                outp.puts "EXTERN #{name[1..-1]} : near"
+            }
+        }
+    end
+end
+
+#
+# emitCodeInAllConfigurations(ast) {
+#     | concreteSettings, ast, backend, index | ... }
+#
+# Emits guard codes for all valid configurations, and calls the block
+# for those configurations that are valid and not erroneous.
+#
+
+def emitCodeInAllConfigurations(ast)
+    forEachValidSettingsCombination(ast) {
+        | concreteSettings, lowLevelAST, backend, index |
+        $output.puts cppSettingsTest(concreteSettings)
+        yield concreteSettings, lowLevelAST, backend, index
+        $output.puts "#endif"
+    }
+end
+
+
+
diff --git a/offlineasm/sh4.rb b/offlineasm/sh4.rb
new file mode 100644
index 0000000..c847d56
--- /dev/null
+++ b/offlineasm/sh4.rb
@@ -0,0 +1,1125 @@
+# Copyright (C) 2013 Apple Inc. All rights reserved.
+# Copyright (C) 2013 Cisco Systems, Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY CISCO SYSTEMS, INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL CISCO SYSTEMS, INC. OR ITS
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+require 'risc'
+
+# GPR conventions, to match the baseline JIT
+#
+#  r0 => t0, r0
+#  r1 => t1, r1
+#  r2 => t4
+#  r3 => t5
+#  r4 =>         a0
+#  r5 =>         a1
+#  r6 => t2,     a2
+#  r7 => t3,     a3
+# r10 =>            (scratch)
+# r11 =>            (scratch)
+# r13 =>            (scratch)
+# r14 => cfr
+# r15 => sp
+#  pr => lr
+
+# FPR conventions, to match the baseline JIT
+# We don't have fa2 or fa3!
+#  dr0 => ft0, fr
+#  dr2 => ft1
+#  dr4 => ft2,   fa0
+#  dr6 => ft3,   fa1
+#  dr8 => ft4
+# dr10 => ft5
+# dr12 =>             (scratch)
+
+class Node
+    def sh4SingleHi
+        doubleOperand = sh4Operand
+        raise "Bogus register name #{doubleOperand}" unless doubleOperand =~ /^dr/
+        "fr" + ($~.post_match.to_i).to_s
+    end
+    def sh4SingleLo
+        doubleOperand = sh4Operand
+        raise "Bogus register name #{doubleOperand}" unless doubleOperand =~ /^dr/
+        "fr" + ($~.post_match.to_i + 1).to_s
+    end
+end
+
+class SpecialRegister < NoChildren
+    def sh4Operand
+        @name
+    end
+
+    def dump
+        @name
+    end
+
+    def register?
+        true
+    end
+end
+
+SH4_TMP_GPRS = [ SpecialRegister.new("r10"), SpecialRegister.new("r11"), SpecialRegister.new("r13") ]
+SH4_TMP_FPRS = [ SpecialRegister.new("dr12") ]
+
+class RegisterID
+    def sh4Operand
+        case name
+        when "a0"
+            "r4"
+        when "a1"
+            "r5"
+        when "r0", "t0"
+            "r0"
+        when "r1", "t1"
+            "r1"
+        when "a2", "t2"
+            "r6"
+        when "a3", "t3"
+            "r7"
+        when "t4"
+            "r2"
+        when "t5"
+            "r3"
+        when "cfr"
+            "r14"
+        when "sp"
+            "r15"
+        when "lr"
+            "pr"
+        else
+            raise "Bad register #{name} for SH4 at #{codeOriginString}"
+        end
+    end
+end
+
+class FPRegisterID
+    def sh4Operand
+        case name
+        when "ft0", "fr"
+            "dr0"
+        when "ft1"
+            "dr2"
+        when "ft2", "fa0"
+            "dr4"
+        when "ft3", "fa1"
+            "dr6"
+        when "ft4"
+            "dr8"
+        when "ft5"
+            "dr10"
+        else
+            raise "Bad register #{name} for SH4 at #{codeOriginString}"
+        end
+    end
+end
+
+class Immediate
+    def sh4Operand
+        raise "Invalid immediate #{value} at #{codeOriginString}" if value < -128 or value > 127
+        "##{value}"
+    end
+end
+
+class Address
+    def sh4Operand
+        raise "Bad offset #{offset.value} at #{codeOriginString}" if offset.value < 0 or offset.value > 60
+        if offset.value == 0
+            "@#{base.sh4Operand}"
+        else
+            "@(#{offset.value}, #{base.sh4Operand})"
+        end
+    end
+
+    def sh4OperandPostInc
+        raise "Bad offset #{offset.value} for post inc at #{codeOriginString}" unless offset.value == 0
+        "@#{base.sh4Operand}+"
+    end
+
+    def sh4OperandPreDec
+        raise "Bad offset #{offset.value} for pre dec at #{codeOriginString}" unless offset.value == 0
+        "@-#{base.sh4Operand}"
+    end
+end
+
+class BaseIndex
+    def sh4Operand
+        raise "Unconverted base index at #{codeOriginString}"
+    end
+end
+
+class AbsoluteAddress
+    def sh4Operand
+        raise "Unconverted absolute address at #{codeOriginString}"
+    end
+end
+
+class LabelReference
+    def sh4Operand
+        value
+    end
+end
+
+class SubImmediates < Node
+    def sh4Operand
+        "#{@left.sh4Operand} - #{@right.sh4Operand}"
+    end
+end
+
+class ConstPool < Node
+    attr_reader :size
+    attr_reader :entries
+
+    def initialize(codeOrigin, entries, size)
+        super(codeOrigin)
+        raise "Invalid size #{size} for ConstPool" unless size == 16 or size == 32
+        @size = size
+        @entries = entries
+    end
+    
+    def dump
+        "#{size}: #{entries}"
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        false
+    end
+
+    def lowerSH4
+        if size == 16
+            $asm.puts ".balign 2"
+        else
+            $asm.puts ".balign 4"
+        end
+        entries.map {
+            |e|
+            e.label.lower("SH4")
+            if e.size == 16
+                $asm.puts ".word #{e.value}"
+            else
+                $asm.puts ".long #{e.value}"
+            end
+        }
+    end
+end
+
+class ConstPoolEntry < Node
+    attr_reader :size
+    attr_reader :value
+    attr_reader :label
+    attr_reader :labelref
+    
+    def initialize(codeOrigin, value, size)
+        super(codeOrigin)
+        raise "Invalid size #{size} for ConstPoolEntry" unless size == 16 or size == 32
+        @size = size
+        @value = value
+        @label = LocalLabel.unique("constpool#{size}")
+        @labelref = LocalLabelReference.new(codeOrigin, label)
+    end
+    
+    def dump
+        "#{value} (#{size} @ #{label})"
+    end
+    
+    def ==(other)
+        other.is_a? ConstPoolEntry and other.value == @value
+    end
+    
+    def address?
+        false
+    end
+    
+    def label?
+        false
+    end
+    
+    def immediate?
+        false
+    end
+    
+    def register?
+        false
+    end
+end
+
+
+#
+# Lowering of shift ops for SH4. For example:
+#
+# rshifti foo, bar
+#
+# becomes:
+#
+# negi foo, tmp
+# shad tmp, bar
+#
+
+def sh4LowerShiftOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "ulshifti", "ulshiftp", "urshifti", "urshiftp", "lshifti", "lshiftp", "rshifti", "rshiftp"
+                if node.opcode[0, 1] == "u"
+                    type = "l"
+                    direction = node.opcode[1, 1]
+                else
+                    type = "a"
+                    direction = node.opcode[0, 1]
+                end
+                if node.operands[0].is_a? Immediate
+                    maskedImm = Immediate.new(node.operands[0].codeOrigin, node.operands[0].value & 31)
+                    if maskedImm.value == 0
+                        # There is nothing to do here.
+                    elsif maskedImm.value == 1 or (type == "l" and [2, 8, 16].include? maskedImm.value)
+                        newList << Instruction.new(node.codeOrigin, "sh#{type}#{direction}x", [maskedImm, node.operands[1]])
+                    else
+                        tmp = Tmp.new(node.codeOrigin, :gpr)
+                        if direction == "l"
+                            newList << Instruction.new(node.codeOrigin, "move", [maskedImm, tmp])
+                        else
+                            newList << Instruction.new(node.codeOrigin, "move", [Immediate.new(node.operands[0].codeOrigin, -1 * maskedImm.value), tmp])
+                        end
+                        newList << Instruction.new(node.codeOrigin, "sh#{type}d", [tmp, node.operands[1]])
+                    end
+                else
+                    tmp = Tmp.new(node.codeOrigin, :gpr)
+                    newList << Instruction.new(node.codeOrigin, "move", [Immediate.new(node.operands[0].codeOrigin, 31), tmp])
+                    newList << Instruction.new(node.codeOrigin, "andi", [node.operands[0], tmp])
+                    if direction == "r"
+                        newList << Instruction.new(node.codeOrigin, "negi", [tmp, tmp])
+                    end
+                    newList << Instruction.new(node.codeOrigin, "sh#{type}d", [tmp, node.operands[1]])
+                end
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+
+#
+# Lowering of simple branch ops for SH4. For example:
+#
+# baddis foo, bar, baz
+#
+# will become:
+#
+# addi foo, bar
+# bs bar, baz
+#
+
+def sh4LowerSimpleBranchOps(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            annotation = node.annotation
+            case node.opcode
+            when /^b(addi|subi|ori|addp)/
+                op = $1
+                bc = $~.post_match
+
+                case op
+                when "addi", "addp"
+                    op = "addi"
+                when "subi", "subp"
+                    op = "subi"
+                when "ori", "orp"
+                    op = "ori"
+                end
+
+                if bc == "s"
+                    raise "Invalid operands number (#{node.operands.size})" unless node.operands.size == 3
+                    if node.operands[1].is_a? RegisterID or node.operands[1].is_a? SpecialRegister
+                        newList << Instruction.new(node.codeOrigin, op, node.operands[0..1])
+                        newList << Instruction.new(node.codeOrigin, "bs", node.operands[1..2])
+                    else
+                        tmpVal = Tmp.new(node.codeOrigin, :gpr)
+                        tmpPtr = Tmp.new(node.codeOrigin, :gpr)
+                        addr = Address.new(node.codeOrigin, tmpPtr, Immediate.new(node.codeOrigin, 0))
+                        newList << Instruction.new(node.codeOrigin, "leap", [node.operands[1], tmpPtr])
+                        newList << Instruction.new(node.codeOrigin, "loadi", [addr, tmpVal])
+                        newList << Instruction.new(node.codeOrigin, op, [node.operands[0], tmpVal])
+                        newList << Instruction.new(node.codeOrigin, "storei", [tmpVal, addr])
+                        newList << Instruction.new(node.codeOrigin, "bs", [tmpVal, node.operands[2]])
+                    end
+                elsif bc == "nz"
+                    raise "Invalid operands number (#{node.operands.size})" unless node.operands.size == 3
+                    newList << Instruction.new(node.codeOrigin, op, node.operands[0..1])
+                    newList << Instruction.new(node.codeOrigin, "btinz", node.operands[1..2])
+                else
+                    newList << node
+                end
+            when "bmulio", "bmulpo"
+                raise "Invalid operands number (#{node.operands.size})" unless node.operands.size == 3
+                tmp1 = Tmp.new(node.codeOrigin, :gpr)
+                tmp2 = Tmp.new(node.codeOrigin, :gpr)
+                newList << Instruction.new(node.codeOrigin, node.opcode, [tmp1, tmp2].concat(node.operands))
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+
+#
+# Lowering of double accesses for SH4. For example:
+#
+# loadd [foo, bar, 8], baz
+#
+# becomes:
+#
+# leap [foo, bar, 8], tmp
+# loaddReversedAndIncrementAddress [tmp], baz
+#
+
+def sh4LowerDoubleAccesses(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "loadd"
+                tmp = Tmp.new(codeOrigin, :gpr)
+                addr = Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, 0))
+                newList << Instruction.new(codeOrigin, "leap", [node.operands[0], tmp])
+                newList << Instruction.new(node.codeOrigin, "loaddReversedAndIncrementAddress", [addr, node.operands[1]], node.annotation)
+            when "stored"
+                tmp = Tmp.new(codeOrigin, :gpr)
+                addr = Address.new(codeOrigin, tmp, Immediate.new(codeOrigin, 0))
+                newList << Instruction.new(codeOrigin, "leap", [node.operands[1].withOffset(8), tmp])
+                newList << Instruction.new(node.codeOrigin, "storedReversedAndDecrementAddress", [node.operands[0], addr], node.annotation)
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+
+#
+# Lowering of double specials for SH4.
+#
+
+def sh4LowerDoubleSpecials(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "bdltun", "bdgtun"
+                # Handle specific floating point unordered opcodes.
+                newList << Instruction.new(codeOrigin, "bdnan", [node.operands[0], node.operands[2]])
+                newList << Instruction.new(codeOrigin, "bdnan", [node.operands[1], node.operands[2]])
+                newList << Instruction.new(codeOrigin, node.opcode[0..-3], node.operands)
+            when "bdnequn", "bdgtequn", "bdltequn"
+                newList << Instruction.new(codeOrigin, node.opcode[0..-3], node.operands)
+            when "bdneq", "bdgteq", "bdlteq"
+                # Handle specific floating point ordered opcodes.
+                outlabel = LocalLabel.unique("out_#{node.opcode}")
+                outref = LocalLabelReference.new(codeOrigin, outlabel)
+                newList << Instruction.new(codeOrigin, "bdnan", [node.operands[0], outref])
+                newList << Instruction.new(codeOrigin, "bdnan", [node.operands[1], outref])
+                newList << Instruction.new(codeOrigin, node.opcode, node.operands)
+                newList << outlabel
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+
+#
+# Lowering of misplaced labels for SH4.
+#
+
+def sh4LowerMisplacedLabels(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            operands = node.operands
+            newOperands = []
+            operands.each {
+                | operand |
+                if operand.is_a? LabelReference and node.opcode != "mova"
+                    tmp = Tmp.new(operand.codeOrigin, :gpr)
+                    newList << Instruction.new(operand.codeOrigin, "move", [operand, tmp])
+                    newOperands << tmp
+                else
+                    newOperands << operand
+                end
+            }
+            newList << Instruction.new(node.codeOrigin, node.opcode, newOperands, node.annotation)
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+
+#
+# Lowering of misplaced special registers for SH4. For example:
+#
+# storep pr, foo
+#
+# becomes:
+#
+# stspr tmp
+# storep tmp, foo
+#
+
+def sh4LowerMisplacedSpecialRegisters(list)
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "move"
+                if node.operands[0].is_a? RegisterID and node.operands[0].sh4Operand == "pr"
+                    newList << Instruction.new(codeOrigin, "stspr", [node.operands[1]])
+                elsif node.operands[1].is_a? RegisterID and node.operands[1].sh4Operand == "pr"
+                    newList << Instruction.new(codeOrigin, "ldspr", [node.operands[0]])
+                else
+                    newList << node
+                end
+            when "loadi", "loadis", "loadp"
+                if node.operands[1].is_a? RegisterID and node.operands[1].sh4Operand == "pr"
+                    tmp = Tmp.new(codeOrigin, :gpr)
+                    newList << Instruction.new(codeOrigin, node.opcode, [node.operands[0], tmp])
+                    newList << Instruction.new(codeOrigin, "ldspr", [tmp])
+                else
+                    newList << node
+                end
+            when "storei", "storep"
+                if node.operands[0].is_a? RegisterID and node.operands[0].sh4Operand == "pr"
+                    tmp = Tmp.new(codeOrigin, :gpr)
+                    newList << Instruction.new(codeOrigin, "stspr", [tmp])
+                    newList << Instruction.new(codeOrigin, node.opcode, [tmp, node.operands[1]])
+                else
+                    newList << node
+                end
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+
+#
+# Group immediate values outside -128..127 range into constant pools for SH4.
+# These constant pools will be placed behind non-return opcodes jmp and ret, for example:
+#
+# move 1024, foo
+# ...
+# ret
+#
+# becomes:
+#
+# move [label], foo
+# ...
+# ret
+# label: 1024
+#
+
+def sh4LowerConstPool(list)
+    newList = []
+    currentPool16 = []
+    currentPool32 = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "jmp", "ret", "flushcp"
+                if node.opcode == "flushcp"
+                    outlabel = LocalLabel.unique("flushcp")
+                    newList << Instruction.new(codeOrigin, "jmp", [LocalLabelReference.new(codeOrigin, outlabel)])
+                else
+                    newList << node
+                end
+                if not currentPool16.empty?
+                    newList << ConstPool.new(codeOrigin, currentPool16, 16)
+                    currentPool16 = []
+                end
+                if not currentPool32.empty?
+                    newList << ConstPool.new(codeOrigin, currentPool32, 32)
+                    currentPool32 = []
+                end
+                if node.opcode == "flushcp"
+                    newList << outlabel
+                end
+            when "move"
+                if node.operands[0].is_a? Immediate and not (-128..127).include? node.operands[0].value
+                    poolEntry = nil
+                    if (-32768..32767).include? node.operands[0].value
+                        currentPool16.each { |e|
+                            if e.value == node.operands[0].value
+                                poolEntry = e
+                            end
+                        }
+                        if !poolEntry
+                            poolEntry = ConstPoolEntry.new(codeOrigin, node.operands[0].value, 16)
+                            currentPool16 << poolEntry
+                        end
+                    else
+                        currentPool32.each { |e|
+                            if e.value == node.operands[0].value
+                                poolEntry = e
+                            end
+                        }
+                        if !poolEntry
+                            poolEntry = ConstPoolEntry.new(codeOrigin, node.operands[0].value, 32)
+                            currentPool32 << poolEntry
+                        end
+                    end
+                    newList << Instruction.new(codeOrigin, "move", [poolEntry, node.operands[1]])
+                elsif node.operands[0].is_a? LabelReference
+                    poolEntry = nil
+                    currentPool32.each { |e|
+                        if e.value == node.operands[0].asmLabel
+                            poolEntry = e
+                        end
+                    }
+                    if !poolEntry
+                        poolEntry = ConstPoolEntry.new(codeOrigin, node.operands[0].asmLabel, 32)
+                        currentPool32 << poolEntry
+                    end
+                    newList << Instruction.new(codeOrigin, "move", [poolEntry, node.operands[1]])
+                elsif node.operands[0].is_a? SubImmediates
+                    poolEntry = ConstPoolEntry.new(codeOrigin, node.operands[0].sh4Operand, 32)
+                    currentPool32 << poolEntry
+                    newList << Instruction.new(codeOrigin, "move", [poolEntry, node.operands[1]])
+                else
+                    newList << node
+                end
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    if not currentPool16.empty?
+        newList << ConstPool.new(codeOrigin, currentPool16, 16)
+    end
+    if not currentPool32.empty?
+        newList << ConstPool.new(codeOrigin, currentPool32, 32)
+    end
+    newList
+end
+
+
+#
+# Lowering of argument setup for SH4.
+# This phase avoids argument register trampling. For example, if a0 == t4:
+#
+# setargs t1, t4
+#
+# becomes:
+#
+# move t4, a1
+# move t1, a0
+#
+
+def sh4LowerArgumentSetup(list)
+    a0 = RegisterID.forName(codeOrigin, "a0")
+    a1 = RegisterID.forName(codeOrigin, "a1")
+    a2 = RegisterID.forName(codeOrigin, "a2")
+    a3 = RegisterID.forName(codeOrigin, "a3")
+    newList = []
+    list.each {
+        | node |
+        if node.is_a? Instruction
+            case node.opcode
+            when "setargs"
+                if node.operands.size == 2
+                    if node.operands[1].sh4Operand != a0.sh4Operand
+                        newList << Instruction.new(codeOrigin, "move", [node.operands[0], a0])
+                        newList << Instruction.new(codeOrigin, "move", [node.operands[1], a1])
+                    elsif node.operands[0].sh4Operand != a1.sh4Operand
+                        newList << Instruction.new(codeOrigin, "move", [node.operands[1], a1])
+                        newList << Instruction.new(codeOrigin, "move", [node.operands[0], a0])
+                    else
+                        # As (operands[0] == a1) and (operands[1] == a0), we just need to swap a0 and a1.
+                        newList << Instruction.new(codeOrigin, "xori", [a0, a1])
+                        newList << Instruction.new(codeOrigin, "xori", [a1, a0])
+                        newList << Instruction.new(codeOrigin, "xori", [a0, a1])
+                    end
+                elsif node.operands.size == 4
+                    # FIXME: We just raise an error if something is likely to go wrong for now.
+                    # It would be better to implement a recovering algorithm.
+                    if (node.operands[0].sh4Operand == a1.sh4Operand) or
+                        (node.operands[0].sh4Operand == a2.sh4Operand) or
+                        (node.operands[0].sh4Operand == a3.sh4Operand) or
+                        (node.operands[1].sh4Operand == a0.sh4Operand) or
+                        (node.operands[1].sh4Operand == a2.sh4Operand) or
+                        (node.operands[1].sh4Operand == a3.sh4Operand) or
+                        (node.operands[2].sh4Operand == a0.sh4Operand) or
+                        (node.operands[2].sh4Operand == a1.sh4Operand) or
+                        (node.operands[2].sh4Operand == a3.sh4Operand) or
+                        (node.operands[3].sh4Operand == a0.sh4Operand) or
+                        (node.operands[3].sh4Operand == a1.sh4Operand) or
+                        (node.operands[3].sh4Operand == a2.sh4Operand)
+                        raise "Potential argument register trampling detected."
+                    end
+
+                    newList << Instruction.new(codeOrigin, "move", [node.operands[0], a0])
+                    newList << Instruction.new(codeOrigin, "move", [node.operands[1], a1])
+                    newList << Instruction.new(codeOrigin, "move", [node.operands[2], a2])
+                    newList << Instruction.new(codeOrigin, "move", [node.operands[3], a3])
+                else
+                    raise "Invalid operands number (#{node.operands.size}) for setargs"
+                end
+            else
+                newList << node
+            end
+        else
+            newList << node
+        end
+    }
+    newList
+end
+
+
+class Sequence
+    def getModifiedListSH4
+        result = @list
+
+        # Verify that we will only see instructions and labels.
+        result.each {
+            | node |
+            unless node.is_a? Instruction or
+                    node.is_a? Label or
+                    node.is_a? LocalLabel or
+                    node.is_a? Skip
+                raise "Unexpected #{node.inspect} at #{node.codeOrigin}"
+            end
+        }
+
+        result = sh4LowerShiftOps(result)
+        result = sh4LowerSimpleBranchOps(result)
+        result = riscLowerMalformedAddresses(result) {
+            | node, address |
+            if address.is_a? Address
+                case node.opcode
+                when "btbz", "btbnz", "cbeq", "bbeq", "bbneq", "bbb", "loadb", "storeb"
+                    (0..15).include? address.offset.value and
+                        ((node.operands[0].is_a? RegisterID and node.operands[0].sh4Operand == "r0") or
+                         (node.operands[1].is_a? RegisterID and node.operands[1].sh4Operand == "r0"))
+                when "loadh"
+                    (0..30).include? address.offset.value and
+                        ((node.operands[0].is_a? RegisterID and node.operands[0].sh4Operand == "r0") or
+                         (node.operands[1].is_a? RegisterID and node.operands[1].sh4Operand == "r0"))
+                else
+                    (0..60).include? address.offset.value
+                end
+            else
+                false
+            end
+        }
+        result = sh4LowerDoubleAccesses(result)
+        result = sh4LowerDoubleSpecials(result)
+        result = riscLowerMisplacedImmediates(result, ["storeb", "storei", "storep", "muli", "mulp", "andi", "ori", "xori",
+            "cbeq", "cieq", "cpeq", "cineq", "cpneq", "cib", "baddio", "bsubio", "bmulio", "baddis",
+            "bbeq", "bbneq", "bbb", "bieq", "bpeq", "bineq", "bpneq", "bia", "bpa", "biaeq", "bpaeq", "bib", "bpb",
+            "bigteq", "bpgteq", "bilt", "bplt", "bigt", "bpgt", "bilteq", "bplteq", "btiz", "btpz", "btinz", "btpnz", "btbz", "btbnz"])
+        result = riscLowerMalformedImmediates(result, -128..127)
+        result = riscLowerMisplacedAddresses(result)
+        result = sh4LowerMisplacedLabels(result)
+        result = sh4LowerMisplacedSpecialRegisters(result)
+
+        result = assignRegistersToTemporaries(result, :gpr, SH4_TMP_GPRS)
+        result = assignRegistersToTemporaries(result, :gpr, SH4_TMP_FPRS)
+
+        result = sh4LowerConstPool(result)
+        result = sh4LowerArgumentSetup(result)
+
+        return result
+    end
+end
+
+def sh4Operands(operands)
+    operands.map{|v| v.sh4Operand}.join(", ")
+end
+
+def emitSH4Branch(sh4opcode, operand)
+    raise "Invalid operand #{operand}" unless operand.is_a? RegisterID or operand.is_a? SpecialRegister
+    $asm.puts "#{sh4opcode} @#{operand.sh4Operand}"
+    $asm.puts "nop"
+end
+
+def emitSH4ShiftImm(val, operand, direction)
+    tmp = val
+    while tmp > 0
+        if tmp >= 16
+            $asm.puts "shl#{direction}16 #{operand.sh4Operand}"
+            tmp -= 16
+        elsif tmp >= 8
+            $asm.puts "shl#{direction}8 #{operand.sh4Operand}"
+            tmp -= 8
+        elsif tmp >= 2
+            $asm.puts "shl#{direction}2 #{operand.sh4Operand}"
+            tmp -= 2
+        else
+            $asm.puts "shl#{direction} #{operand.sh4Operand}"
+            tmp -= 1
+        end
+    end
+end
+
+def emitSH4BranchIfT(dest, neg)
+    outlabel = LocalLabel.unique("branchIfT")
+    sh4opcode = neg ? "bt" : "bf"
+    $asm.puts "#{sh4opcode} #{LocalLabelReference.new(codeOrigin, outlabel).asmLabel}"
+    if dest.is_a? LocalLabelReference
+        $asm.puts "bra #{dest.asmLabel}"
+        $asm.puts "nop"
+    else
+        emitSH4Branch("jmp", dest)
+    end
+    outlabel.lower("SH4")
+end
+
+def emitSH4IntCompare(cmpOpcode, operands)
+    $asm.puts "cmp/#{cmpOpcode} #{sh4Operands([operands[1], operands[0]])}"
+end
+
+def emitSH4CondBranch(cmpOpcode, neg, operands)
+    emitSH4IntCompare(cmpOpcode, operands)
+    emitSH4BranchIfT(operands[2], neg)
+end
+
+def emitSH4CompareSet(cmpOpcode, neg, operands)
+    emitSH4IntCompare(cmpOpcode, operands)
+    if !neg
+        $asm.puts "movt #{operands[2].sh4Operand}"
+    else
+        outlabel = LocalLabel.unique("compareSet")
+        $asm.puts "mov #0, #{operands[2].sh4Operand}"
+        $asm.puts "bt #{LocalLabelReference.new(codeOrigin, outlabel).asmLabel}"
+        $asm.puts "mov #1, #{operands[2].sh4Operand}"
+        outlabel.lower("SH4")
+    end
+end
+
+def emitSH4BranchIfNaN(operands)
+    raise "Invalid operands number (#{operands.size})" unless operands.size == 2
+    $asm.puts "fcmp/eq #{sh4Operands([operands[0], operands[0]])}"
+    $asm.puts "bf #{operands[1].asmLabel}"
+end
+
+def emitSH4DoubleCondBranch(cmpOpcode, neg, operands)
+    if cmpOpcode == "lt"
+        $asm.puts "fcmp/gt #{sh4Operands([operands[0], operands[1]])}"
+    else
+        $asm.puts "fcmp/#{cmpOpcode} #{sh4Operands([operands[1], operands[0]])}"
+    end
+    emitSH4BranchIfT(operands[2], neg)
+end
+
+class Instruction
+    def lowerSH4
+        $asm.comment codeOriginString
+        case opcode
+        when "addi", "addp"
+            if operands.size == 3
+                if operands[0].sh4Operand == operands[2].sh4Operand
+                    $asm.puts "add #{sh4Operands([operands[1], operands[2]])}"
+                elsif operands[1].sh4Operand == operands[2].sh4Operand
+                    $asm.puts "add #{sh4Operands([operands[0], operands[2]])}"
+                else
+                    $asm.puts "mov #{sh4Operands([operands[0], operands[2]])}"
+                    $asm.puts "add #{sh4Operands([operands[1], operands[2]])}"
+                end
+            else
+                $asm.puts "add #{sh4Operands(operands)}"
+            end
+        when "subi", "subp"
+            if operands.size == 3
+                if operands[1].is_a? Immediate
+                    $asm.puts "mov #{sh4Operands([Immediate.new(codeOrigin, -1 * operands[1].value), operands[2]])}"
+                    $asm.puts "add #{sh4Operands([operands[0], operands[2]])}"
+                elsif operands[1].sh4Operand == operands[2].sh4Operand
+                    $asm.puts "neg #{sh4Operands([operands[2], operands[2]])}"
+                    $asm.puts "add #{sh4Operands([operands[0], operands[2]])}"
+                else
+                    $asm.puts "mov #{sh4Operands([operands[0], operands[2]])}"
+                    $asm.puts "sub #{sh4Operands([operands[1], operands[2]])}"
+                end
+            else
+                if operands[0].is_a? Immediate
+                    $asm.puts "add #{sh4Operands([Immediate.new(codeOrigin, -1 * operands[0].value), operands[1]])}"
+                else
+                    $asm.puts "sub #{sh4Operands(operands)}"
+                end
+            end
+        when "muli", "mulp"
+            $asm.puts "mul.l #{sh4Operands(operands[0..1])}"
+            $asm.puts "sts macl, #{operands[-1].sh4Operand}"
+        when "negi", "negp"
+            if operands.size == 2
+                $asm.puts "neg #{sh4Operands(operands)}"
+            else
+                $asm.puts "neg #{sh4Operands([operands[0], operands[0]])}"
+            end
+        when "andi", "andp", "ori", "orp", "xori", "xorp"
+            raise "#{opcode} with #{operands.size} operands is not handled yet" unless operands.size == 2
+            sh4opcode = opcode[0..-2]
+            $asm.puts "#{sh4opcode} #{sh4Operands(operands)}"
+        when "shllx", "shlrx"
+            raise "Unhandled parameters for opcode #{opcode}" unless operands[0].is_a? Immediate
+            if operands[0].value == 1
+                $asm.puts "shl#{opcode[3, 1]} #{operands[1].sh4Operand}"
+            else
+                $asm.puts "shl#{opcode[3, 1]}#{operands[0].value} #{operands[1].sh4Operand}"
+            end
+        when "shalx", "sharx"
+            raise "Unhandled parameters for opcode #{opcode}" unless operands[0].is_a? Immediate and operands[0].value == 1
+            $asm.puts "sha#{opcode[3, 1]} #{operands[1].sh4Operand}"
+        when "shld", "shad"
+            $asm.puts "#{opcode} #{sh4Operands(operands)}"
+        when "loaddReversedAndIncrementAddress"
+            # As we are little endian, we don't use "fmov @Rm, DRn" here.
+            $asm.puts "fmov.s #{operands[0].sh4OperandPostInc}, #{operands[1].sh4SingleLo}"
+            $asm.puts "fmov.s #{operands[0].sh4OperandPostInc}, #{operands[1].sh4SingleHi}"
+        when "storedReversedAndDecrementAddress"
+            # As we are little endian, we don't use "fmov DRm, @Rn" here.
+            $asm.puts "fmov.s #{operands[0].sh4SingleHi}, #{operands[1].sh4OperandPreDec}"
+            $asm.puts "fmov.s #{operands[0].sh4SingleLo}, #{operands[1].sh4OperandPreDec}"
+        when "ci2d"
+            $asm.puts "lds #{operands[0].sh4Operand}, fpul"
+            $asm.puts "float fpul, #{operands[1].sh4Operand}"
+        when "fii2d"
+            $asm.puts "lds #{operands[0].sh4Operand}, fpul"
+            $asm.puts "fsts fpul, #{operands[2].sh4SingleLo}"
+            $asm.puts "lds #{operands[1].sh4Operand}, fpul"
+            $asm.puts "fsts fpul, #{operands[2].sh4SingleHi}"
+        when "fd2ii"
+            $asm.puts "flds #{operands[0].sh4SingleLo}, fpul"
+            $asm.puts "sts fpul, #{operands[1].sh4Operand}"
+            $asm.puts "flds #{operands[0].sh4SingleHi}, fpul"
+            $asm.puts "sts fpul, #{operands[2].sh4Operand}"
+        when "addd", "subd", "muld", "divd"
+            sh4opcode = opcode[0..-2]
+            $asm.puts "f#{sh4opcode} #{sh4Operands(operands)}"
+        when "bcd2i"
+            $asm.puts "ftrc #{operands[0].sh4Operand}, fpul"
+            $asm.puts "sts fpul, #{operands[1].sh4Operand}"
+            $asm.puts "float fpul, #{SH4_TMP_FPRS[0].sh4Operand}"
+            $asm.puts "fcmp/eq #{sh4Operands([operands[0], SH4_TMP_FPRS[0]])}"
+            $asm.puts "bf #{operands[2].asmLabel}"
+            $asm.puts "tst #{sh4Operands([operands[1], operands[1]])}"
+            $asm.puts "bt #{operands[2].asmLabel}"
+        when "bdnan"
+            emitSH4BranchIfNaN(operands)
+        when "bdneq"
+            emitSH4DoubleCondBranch("eq", true, operands)
+        when "bdgteq"
+            emitSH4DoubleCondBranch("lt", true, operands)
+        when "bdlt"
+            emitSH4DoubleCondBranch("lt", false, operands)
+        when "bdlteq"
+            emitSH4DoubleCondBranch("gt", true, operands)
+        when "bdgt"
+            emitSH4DoubleCondBranch("gt", false, operands)
+        when "baddio", "baddpo", "bsubio", "bsubpo"
+            raise "#{opcode} with #{operands.size} operands is not handled yet" unless operands.size == 3
+            $asm.puts "#{opcode[1, 3]}v #{sh4Operands([operands[0], operands[1]])}"
+            $asm.puts "bt #{operands[2].asmLabel}"
+        when "bmulio", "bmulpo"
+            raise "Invalid operands number (#{operands.size})" unless operands.size == 5
+            $asm.puts "dmuls.l #{sh4Operands([operands[2], operands[3]])}"
+            $asm.puts "sts macl, #{operands[3].sh4Operand}"
+            $asm.puts "cmp/pz #{operands[3].sh4Operand}"
+            $asm.puts "movt #{operands[1].sh4Operand}"
+            $asm.puts "add #-1, #{operands[1].sh4Operand}"
+            $asm.puts "sts mach, #{operands[0].sh4Operand}"
+            $asm.puts "cmp/eq #{sh4Operands([operands[0], operands[1]])}"
+            $asm.puts "bf #{operands[4].asmLabel}"
+        when "btiz", "btpz", "btbz", "btinz", "btpnz", "btbnz"
+            if operands.size == 3
+                $asm.puts "tst #{sh4Operands([operands[0], operands[1]])}"
+            else
+                if operands[0].sh4Operand == "r0"
+                    $asm.puts "cmp/eq #0, r0"
+                else
+                    $asm.puts "tst #{sh4Operands([operands[0], operands[0]])}"
+                end
+            end
+            emitSH4BranchIfT(operands[-1], (opcode[-2, 2] == "nz"))
+        when "cieq", "cpeq", "cbeq"
+            emitSH4CompareSet("eq", false, operands)
+        when "cineq", "cpneq", "cbneq"
+            emitSH4CompareSet("eq", true, operands)
+        when "cib", "cpb", "cbb"
+            emitSH4CompareSet("hs", true, operands)
+        when "bieq", "bpeq", "bbeq"
+            emitSH4CondBranch("eq", false, operands)
+        when "bineq", "bpneq", "bbneq"
+            emitSH4CondBranch("eq", true, operands)
+        when "bib", "bpb", "bbb"
+            emitSH4CondBranch("hs", true, operands)
+        when "bia", "bpa", "bba"
+            emitSH4CondBranch("hi", false, operands)
+        when "bibeq", "bpbeq"
+            emitSH4CondBranch("hi", true, operands)
+        when "biaeq", "bpaeq"
+            emitSH4CondBranch("hs", false, operands)
+        when "bigteq", "bpgteq", "bbgteq"
+            emitSH4CondBranch("ge", false, operands)
+        when "bilt", "bplt", "bblt"
+            emitSH4CondBranch("ge", true, operands)
+        when "bigt", "bpgt", "bbgt"
+            emitSH4CondBranch("gt", false, operands)
+        when "bilteq", "bplteq", "bblteq"
+            emitSH4CondBranch("gt", true, operands)
+        when "bs"
+            $asm.puts "cmp/pz #{operands[0].sh4Operand}"
+            $asm.puts "bf #{operands[1].asmLabel}"
+        when "call"
+            if operands[0].is_a? LocalLabelReference
+                $asm.puts "bsr #{operands[0].asmLabel}"
+                $asm.puts "nop"
+            elsif operands[0].is_a? RegisterID or operands[0].is_a? SpecialRegister
+                emitSH4Branch("jsr", operands[0])
+            else
+                raise "Unhandled parameters for opcode #{opcode} at #{codeOriginString}"
+            end
+        when "jmp"
+            if operands[0].is_a? LocalLabelReference
+                $asm.puts "bra #{operands[0].asmLabel}"
+                $asm.puts "nop"
+            elsif operands[0].is_a? RegisterID or operands[0].is_a? SpecialRegister
+                emitSH4Branch("jmp", operands[0])
+            else
+                raise "Unhandled parameters for opcode #{opcode} at #{codeOriginString}"
+            end
+        when "ret"
+            $asm.puts "rts"
+            $asm.puts "nop"
+        when "loadb"
+            $asm.puts "mov.b #{sh4Operands(operands)}"
+            $asm.puts "extu.b #{sh4Operands([operands[1], operands[1]])}"
+        when "storeb"
+            $asm.puts "mov.b #{sh4Operands(operands)}"
+        when "loadh"
+            $asm.puts "mov.w #{sh4Operands(operands)}"
+            $asm.puts "extu.w #{sh4Operands([operands[1], operands[1]])}"
+        when "loadi", "loadis", "loadp", "storei", "storep"
+            $asm.puts "mov.l #{sh4Operands(operands)}"
+        when "alignformova"
+            $asm.puts ".balign 4" # As balign directive is in a code section, fill value is 'nop' instruction.
+        when "mova"
+            $asm.puts "mova #{sh4Operands(operands)}"
+        when "move"
+            if operands[0].is_a? ConstPoolEntry
+                if operands[0].size == 16
+                    $asm.puts "mov.w #{operands[0].labelref.asmLabel}, #{operands[1].sh4Operand}"
+                else
+                    $asm.puts "mov.l #{operands[0].labelref.asmLabel}, #{operands[1].sh4Operand}"
+                end
+            elsif operands[0].sh4Operand != operands[1].sh4Operand
+                $asm.puts "mov #{sh4Operands(operands)}"
+            end
+        when "leap"
+            if operands[0].is_a? BaseIndex
+                biop = operands[0]
+                $asm.puts "mov #{sh4Operands([biop.index, operands[1]])}"
+                if biop.scaleShift > 0
+                    emitSH4ShiftImm(biop.scaleShift, operands[1], "l")
+                end
+                $asm.puts "add #{sh4Operands([biop.base, operands[1]])}"
+                if biop.offset.value != 0
+                    $asm.puts "add #{sh4Operands([biop.offset, operands[1]])}"
+                end
+            elsif operands[0].is_a? Address
+                if operands[0].base != operands[1]
+                    $asm.puts "mov #{sh4Operands([operands[0].base, operands[1]])}"
+                end
+                if operands[0].offset.value != 0
+                    $asm.puts "add #{sh4Operands([operands[0].offset, operands[1]])}"
+                end
+            else
+                raise "Unhandled parameters for opcode #{opcode} at #{codeOriginString}"
+            end
+        when "ldspr"
+            $asm.puts "lds #{sh4Operands(operands)}, pr"
+        when "stspr"
+            $asm.puts "sts pr, #{sh4Operands(operands)}"
+        when "memfence"
+            $asm.puts "synco"
+        when "pop"
+            if operands[0].sh4Operand == "pr"
+                $asm.puts "lds.l @r15+, #{sh4Operands(operands)}"
+            else
+                $asm.puts "mov.l @r15+, #{sh4Operands(operands)}"
+            end
+        when "push"
+            if operands[0].sh4Operand == "pr"
+                $asm.puts "sts.l #{sh4Operands(operands)}, @-r15"
+            else
+                $asm.puts "mov.l #{sh4Operands(operands)}, @-r15"
+            end
+        when "break"
+            # This special opcode always generates an illegal instruction exception.
+            $asm.puts ".word 0xfffd"
+        else
+            lowerDefault
+        end
+    end
+end
+
diff --git a/offlineasm/transform.rb b/offlineasm/transform.rb
new file mode 100644
index 0000000..84dd041
--- /dev/null
+++ b/offlineasm/transform.rb
@@ -0,0 +1,501 @@
+# Copyright (C) 2011 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "ast"
+
+#
+# node.resolveSettings(settings)
+#
+# Construct a new AST that does not have any IfThenElse nodes by
+# substituting concrete boolean values for each Setting.
+#
+
+class Node
+    def resolveSettings(settings)
+        mapChildren {
+            | child |
+            child.resolveSettings(settings)
+        }
+    end
+end
+
+class True
+    def resolveSettings(settings)
+        self
+    end
+end
+
+class False
+    def resolveSettings(settings)
+        self
+    end
+end
+
+class Setting
+    def resolveSettings(settings)
+        settings[@name].asNode
+    end
+end
+
+class And
+    def resolveSettings(settings)
+        (@left.resolveSettings(settings).value and @right.resolveSettings(settings).value).asNode
+    end
+end
+
+class Or
+    def resolveSettings(settings)
+        (@left.resolveSettings(settings).value or @right.resolveSettings(settings).value).asNode
+    end
+end
+
+class Not
+    def resolveSettings(settings)
+        (not @child.resolveSettings(settings).value).asNode
+    end
+end
+
+class IfThenElse
+    def resolveSettings(settings)
+        if @predicate.resolveSettings(settings).value
+            @thenCase.resolveSettings(settings)
+        else
+            @elseCase.resolveSettings(settings)
+        end
+    end
+end
+
+class Sequence
+    def resolveSettings(settings)
+        newList = []
+        @list.each {
+            | item |
+            item = item.resolveSettings(settings)
+            if item.is_a? Sequence
+                newList += item.list
+            else
+                newList << item
+            end
+        }
+        Sequence.new(codeOrigin, newList)
+    end
+end
+
+#
+# node.demacroify(macros)
+# node.substitute(mapping)
+#
+# demacroify() constructs a new AST that does not have any Macro
+# nodes, while substitute() replaces Variable nodes with the given
+# nodes in the mapping.
+#
+
+class Node
+    def demacroify(macros)
+        mapChildren {
+            | child |
+            child.demacroify(macros)
+        }
+    end
+    
+    def substitute(mapping)
+        mapChildren {
+            | child |
+            child.substitute(mapping)
+        }
+    end
+    
+    def substituteLabels(mapping)
+        mapChildren {
+            | child |
+            child.substituteLabels(mapping)
+        }
+    end
+end
+
+class Macro
+    def substitute(mapping)
+        myMapping = {}
+        mapping.each_pair {
+            | key, value |
+            unless @variables.include? key
+                myMapping[key] = value
+            end
+        }
+        mapChildren {
+            | child |
+            child.substitute(myMapping)
+        }
+    end
+end
+
+class Variable
+    def substitute(mapping)
+        if mapping[self]
+            mapping[self]
+        else
+            self
+        end
+    end
+end
+
+class LocalLabel
+    def substituteLabels(mapping)
+        if mapping[self]
+            mapping[self]
+        else
+            self
+        end
+    end
+end
+
+class Sequence
+    def substitute(constants)
+        newList = []
+        myConstants = constants.dup
+        @list.each {
+            | item |
+            if item.is_a? ConstDecl
+                myConstants[item.variable] = item.value.substitute(myConstants)
+            else
+                newList << item.substitute(myConstants)
+            end
+        }
+        Sequence.new(codeOrigin, newList)
+    end
+    
+    def renameLabels(comment)
+        mapping = {}
+        
+        @list.each {
+            | item |
+            if item.is_a? LocalLabel
+                mapping[item] = LocalLabel.unique(if comment then comment + "_" else "" end + item.cleanName)
+            end
+        }
+        
+        substituteLabels(mapping)
+    end
+    
+    def demacroify(macros)
+        myMacros = macros.dup
+        @list.each {
+            | item |
+            if item.is_a? Macro
+                myMacros[item.name] = item
+            end
+        }
+        newList = []
+        @list.each {
+            | item |
+            if item.is_a? Macro
+                # Ignore.
+            elsif item.is_a? MacroCall
+                mapping = {}
+                myMyMacros = myMacros.dup
+                raise "Could not find macro #{item.name} at #{item.codeOriginString}" unless myMacros[item.name]
+                raise "Argument count mismatch for call to #{item.name} at #{item.codeOriginString}" unless item.operands.size == myMacros[item.name].variables.size
+                item.operands.size.times {
+                    | idx |
+                    if item.operands[idx].is_a? Variable and myMacros[item.operands[idx].name]
+                        myMyMacros[myMacros[item.name].variables[idx].name] = myMacros[item.operands[idx].name]
+                        mapping[myMacros[item.name].variables[idx].name] = nil
+                    elsif item.operands[idx].is_a? Macro
+                        myMyMacros[myMacros[item.name].variables[idx].name] = item.operands[idx]
+                        mapping[myMacros[item.name].variables[idx].name] = nil
+                    else
+                        myMyMacros[myMacros[item.name].variables[idx]] = nil
+                        mapping[myMacros[item.name].variables[idx]] = item.operands[idx]
+                    end
+                }
+                if item.annotation
+                    newList << Instruction.new(item.codeOrigin, "localAnnotation", [], item.annotation)
+                end
+                newList += myMacros[item.name].body.substitute(mapping).demacroify(myMyMacros).renameLabels(item.name).list
+            else
+                newList << item.demacroify(myMacros)
+            end
+        }
+        Sequence.new(codeOrigin, newList).substitute({})
+    end
+end
+
+#
+# node.resolveOffsets(offsets, sizes)
+#
+# Construct a new AST that has offset values instead of symbolic
+# offsets.
+#
+
+class Node
+    def resolveOffsets(offsets, sizes)
+        mapChildren {
+            | child |
+            child.resolveOffsets(offsets, sizes)
+        }
+    end
+end
+
+class StructOffset
+    def resolveOffsets(offsets, sizes)
+        if offsets[self]
+            Immediate.new(codeOrigin, offsets[self])
+        else
+            self
+        end
+    end
+end
+
+class Sizeof
+    def resolveOffsets(offsets, sizes)
+        if sizes[self]
+            Immediate.new(codeOrigin, sizes[self])
+        else
+            puts "Could not find #{self.inspect} in #{sizes.keys.inspect}"
+            puts "sizes = #{sizes.inspect}"
+            self
+        end
+    end
+end
+
+#
+# node.fold
+#
+# Resolve constant references and compute arithmetic expressions.
+#
+
+class Node
+    def fold
+        mapChildren {
+            | child |
+            child.fold
+        }
+    end
+end
+
+class AddImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value + @right.value)
+    end
+end
+
+class SubImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value - @right.value)
+    end
+end
+
+class MulImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value * @right.value)
+    end
+end
+
+class NegImmediate
+    def fold
+        @child = @child.fold
+        return self unless @child.is_a? Immediate
+        Immediate.new(codeOrigin, -@child.value)
+    end
+end
+
+class OrImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value | @right.value)
+    end
+end
+
+class AndImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value & @right.value)
+    end
+end
+
+class XorImmediates
+    def fold
+        @left = @left.fold
+        @right = @right.fold
+        return self unless @left.is_a? Immediate
+        return self unless @right.is_a? Immediate
+        Immediate.new(codeOrigin, @left.value ^ @right.value)
+    end
+end
+
+class BitnotImmediate
+    def fold
+        @child = @child.fold
+        return self unless @child.is_a? Immediate
+        Immediate.new(codeOrigin, ~@child.value)
+    end
+end
+
+#
+# node.resolveAfterSettings(offsets, sizes)
+#
+# Compile assembly against a set of offsets.
+#
+
+class Node
+    def resolve(offsets, sizes)
+        demacroify({}).resolveOffsets(offsets, sizes).fold
+    end
+end
+
+#
+# node.validate
+#
+# Checks that the node is ready for backend compilation.
+#
+
+class Node
+    def validate
+        raise "Unresolved #{dump} at #{codeOriginString}"
+    end
+    
+    def validateChildren
+        children.each {
+            | node |
+            node.validate
+        }
+    end
+end
+
+class Sequence
+    def validate
+        validateChildren
+        
+        # Further verify that this list contains only instructions, labels, and skips.
+        @list.each {
+            | node |
+            unless node.is_a? Instruction or
+                    node.is_a? Label or
+                    node.is_a? LocalLabel or
+                    node.is_a? Skip
+                raise "Unexpected #{node.inspect} at #{node.codeOrigin}" 
+            end
+        }
+    end
+end
+
+class Immediate
+    def validate
+    end
+end
+
+class StringLiteral
+    def validate
+    end
+end
+
+class RegisterID
+    def validate
+    end
+end
+
+class FPRegisterID
+    def validate
+    end
+end
+
+class Address
+    def validate
+        validateChildren
+    end
+end
+
+class BaseIndex
+    def validate
+        validateChildren
+    end
+end
+
+class AbsoluteAddress
+    def validate
+        validateChildren
+    end
+end
+
+class Instruction
+    def validate
+        validateChildren
+    end
+end
+
+class SubImmediates
+    def validate
+      raise "Invalid operand #{left.dump} to immediate subtraction" unless left.immediateOperand?
+      raise "Invalid operand #{right.dump} to immediate subtraction" unless right.immediateOperand?
+    end
+end
+
+class Error
+    def validate
+    end
+end
+
+class Label
+    def validate
+    end
+end
+
+class LocalLabel
+    def validate
+    end
+end
+
+class LabelReference
+    def validate
+    end
+end
+
+class LocalLabelReference
+    def validate
+    end
+end
+
+class Skip
+    def validate
+    end
+end
+
diff --git a/offlineasm/x86.rb b/offlineasm/x86.rb
new file mode 100644
index 0000000..c73d0aa
--- /dev/null
+++ b/offlineasm/x86.rb
@@ -0,0 +1,1538 @@
+# Copyright (C) 2012, 2014-2016 Apple Inc. All rights reserved.
+# Copyright (C) 2013 Digia Plc. and/or its subsidiary(-ies)
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+
+# GPR conventions, to match the baseline JIT:
+#
+#
+# On x86-32 bits (windows and non-windows)
+# a0, a1, a2, a3 are only there for ease-of-use of offlineasm; they are not
+# actually considered as such by the ABI and we need to push/pop our arguments
+# on the stack. a0 and a1 are ecx and edx to follow fastcall.
+#
+# eax => t0, a2, r0
+# edx => t1, a1, r1
+# ecx => t2, a0
+# ebx => t3, a3     (callee-save)
+# esi => t4         (callee-save)
+# edi => t5         (callee-save)
+# ebp => cfr
+# esp => sp
+#
+# On x86-64 non-windows
+#
+# rax => t0,     r0
+# rdi =>     a0
+# rsi => t1, a1
+# rdx => t2, a2, r1
+# rcx => t3, a3
+#  r8 => t4
+# r10 => t5
+# rbx =>             csr0 (callee-save, PB, unused in baseline)
+# r12 =>             csr1 (callee-save)
+# r13 =>             csr2 (callee-save)
+# r14 =>             csr3 (callee-save, tagTypeNumber)
+# r15 =>             csr4 (callee-save, tagMask)
+# rsp => sp
+# rbp => cfr
+# r11 =>                  (scratch)
+#
+# On x86-64 windows
+# Arguments need to be push/pop'd on the stack in addition to being stored in
+# the registers. Also, >8 return types are returned in a weird way.
+#
+# rax => t0,     r0
+# rcx =>     a0
+# rdx => t1, a1, r1
+#  r8 => t2, a2
+#  r9 => t3, a3
+# r10 => t4
+# rbx =>             csr0 (callee-save, PB, unused in baseline)
+# rsi =>             csr1 (callee-save)
+# rdi =>             csr2 (callee-save)
+# r12 =>             csr3 (callee-save)
+# r13 =>             csr4 (callee-save)
+# r14 =>             csr5 (callee-save, tagTypeNumber)
+# r15 =>             csr6 (callee-save, tagMask)
+# rsp => sp
+# rbp => cfr
+# r11 =>                  (scratch)
+
+def isX64
+    case $activeBackend
+    when "X86"
+        false
+    when "X86_WIN"
+        false
+    when "X86_64"
+        true
+    when "X86_64_WIN"
+        true
+    else
+        raise "bad value for $activeBackend: #{$activeBackend}"
+    end
+end
+
+def isWin
+    case $activeBackend
+    when "X86"
+        false
+    when "X86_WIN"
+        true
+    when "X86_64"
+        false
+    when "X86_64_WIN"
+        true
+    else
+        raise "bad value for $activeBackend: #{$activeBackend}"
+    end
+end
+
+def useX87
+    case $activeBackend
+    when "X86"
+        true
+    when "X86_WIN"
+        true
+    when "X86_64"
+        false
+    when "X86_64_WIN"
+        false
+    else
+        raise "bad value for $activeBackend: #{$activeBackend}"
+    end
+end
+
+def isMSVC
+    $options.has_key?(:assembler) && $options[:assembler] == "MASM"
+end
+
+def isIntelSyntax
+    $options.has_key?(:assembler) && $options[:assembler] == "MASM"
+end
+
+def register(name)
+    isIntelSyntax ? name : "%" + name
+end
+
+def offsetRegister(off, register)
+    isIntelSyntax ? "[#{off} + #{register}]" : "#{off}(#{register})"
+end
+
+def callPrefix
+    isIntelSyntax ? "" : "*"
+end
+
+def orderOperands(opA, opB)
+    isIntelSyntax ? "#{opB}, #{opA}" : "#{opA}, #{opB}"
+end
+
+def const(c)
+    isIntelSyntax ? "#{c}" : "$#{c}"
+end
+
+def getSizeString(kind)
+    if !isIntelSyntax
+        return ""
+    end
+
+    size = ""
+    case kind
+    when :byte
+        size = "byte"
+    when :half
+        size = "word"
+    when :int
+        size = "dword"
+    when :ptr
+        size =  isX64 ? "qword" : "dword"
+    when :double
+        size = "qword"
+    when :quad
+        size = "qword"
+    else
+        raise "Invalid kind #{kind}"
+    end
+
+    return size + " " + "ptr" + " ";
+end
+
+class SpecialRegister < NoChildren
+    def x86Operand(kind)
+        raise unless @name =~ /^r/
+        raise unless isX64
+        case kind
+        when :half
+            register(@name + "w")
+        when :int
+            register(@name + "d")
+        when :ptr
+            register(@name)
+        when :quad
+            register(@name)
+        else
+            raise
+        end
+    end
+    def x86CallOperand(kind)
+        # Call operands are not allowed to be partial registers.
+        "#{callPrefix}#{x86Operand(:quad)}"
+    end
+end
+
+X64_SCRATCH_REGISTER = SpecialRegister.new("r11")
+
+def x86GPRName(name, kind)
+    case name
+    when "eax", "ebx", "ecx", "edx"
+        name8 = name[1] + 'l'
+        name16 = name[1..2]
+    when "esi", "edi", "ebp", "esp"
+        name16 = name[1..2]
+        name8 = name16 + 'l'
+    when "rax", "rbx", "rcx", "rdx"
+        raise "bad GPR name #{name} in 32-bit X86" unless isX64
+        name8 = name[1] + 'l'
+        name16 = name[1..2]
+    when "r8", "r9", "r10", "r12", "r13", "r14", "r15"
+        raise "bad GPR name #{name} in 32-bit X86" unless isX64
+        case kind
+        when :half
+            return register(name + "w")
+        when :int
+            return register(name + "d")
+        when :ptr
+            return register(name)
+        when :quad
+            return register(name)
+        end
+    else
+        raise "bad GPR name #{name}"
+    end
+    case kind
+    when :byte
+        register(name8)
+    when :half
+        register(name16)
+    when :int
+        register("e" + name16)
+    when :ptr
+        register((isX64 ? "r" : "e") + name16)
+    when :quad
+        isX64 ? register("r" + name16) : raise
+    else
+        raise "invalid kind #{kind} for GPR #{name} in X86"
+    end
+end
+
+class RegisterID
+    def supports8BitOnX86
+        case x86GPR
+        when "eax", "ebx", "ecx", "edx", "edi", "esi", "ebp", "esp"
+            true
+        when "r8", "r9", "r10", "r12", "r13", "r14", "r15"
+            false
+        else
+            raise
+        end
+    end
+
+    def x86GPR
+        if isX64
+            case name
+            when "t0", "r0"
+                "eax"
+            when "r1"
+                "edx" # t1 = a1 when isWin, t2 = a2 otherwise
+            when "a0"
+                isWin ? "ecx" : "edi"
+            when "t1", "a1"
+                isWin ? "edx" : "esi"
+            when "t2", "a2"
+                isWin ? "r8" : "edx"
+            when "t3", "a3"
+                isWin ? "r9" : "ecx"
+            when "t4"
+                isWin ? "r10" : "r8"
+            when "t5"
+                raise "cannot use register #{name} on X86-64 Windows" unless not isWin
+                "r10"
+            when "csr0"
+                "ebx"
+            when "csr1"
+                isWin ? "esi" : "r12"
+            when "csr2"
+                isWin ? "edi" : "r13"
+            when "csr3"
+                isWin ? "r12" : "r14"
+            when "csr4"
+                isWin ? "r13" : "r15"
+            when "csr5"
+                raise "cannot use register #{name} on X86-64" unless isWin
+                "r14"
+            when "csr6"
+                raise "cannot use register #{name} on X86-64" unless isWin
+                "r15"
+            when "cfr"
+                "ebp"
+            when "sp"
+                "esp"
+            else
+                raise "cannot use register #{name} on X86"
+            end
+        else
+            case name
+            when "t0", "r0", "a2"
+                "eax"
+            when "t1", "r1", "a1"
+                "edx"
+            when "t2", "a0"
+                "ecx"
+            when "t3", "a3"
+                "ebx"
+            when "t4"
+                "esi"
+            when "t5"
+                "edi"
+            when "cfr"
+                "ebp"
+            when "sp"
+                "esp"
+            end
+        end
+    end
+
+    def x86Operand(kind)
+        x86GPRName(x86GPR, kind)
+    end
+
+    def x86CallOperand(kind)
+        "#{callPrefix}#{x86Operand(:ptr)}"
+    end
+end
+
+class FPRegisterID
+    def x86Operand(kind)
+        raise unless kind == :double
+        raise if useX87
+        case name
+        when "ft0", "fa0", "fr"
+            register("xmm0")
+        when "ft1", "fa1"
+            register("xmm1")
+        when "ft2", "fa2"
+            register("xmm2")
+        when "ft3", "fa3"
+            register("xmm3")
+        when "ft4"
+            register("xmm4")
+        when "ft5"
+            register("xmm5")
+        else
+            raise "Bad register #{name} for X86 at #{codeOriginString}"
+        end
+    end
+    def x87DefaultStackPosition
+        case name
+        when "ft0", "fr"
+            0
+        when "ft1"
+            1
+        when "ft2", "ft3", "ft4", "ft5"
+            raise "Unimplemented register #{name} for X86 at #{codeOriginString}"
+        else
+            raise "Bad register #{name} for X86 at #{codeOriginString}"
+        end
+    end
+    def x87Operand(offset)
+        raise unless useX87
+        raise unless offset == 0 or offset == 1
+        "#{register("st")}(#{x87DefaultStackPosition + offset})"
+    end
+    def x86CallOperand(kind)
+        "#{callPrefix}#{x86Operand(kind)}"
+    end
+end
+
+class Immediate
+    def validX86Immediate?
+        if isX64
+            value >= -0x80000000 and value <= 0x7fffffff
+        else
+            true
+        end
+    end
+    def x86Operand(kind)
+        "#{const(value)}"
+    end
+    def x86CallOperand(kind)
+        "#{value}"
+    end
+end
+
+class Address
+    def supports8BitOnX86
+        true
+    end
+    
+    def x86AddressOperand(addressKind)
+        "#{offsetRegister(offset.value, base.x86Operand(addressKind))}"
+    end
+    def x86Operand(kind)
+        "#{getSizeString(kind)}#{x86AddressOperand(:ptr)}"
+    end
+    def x86CallOperand(kind)
+        "#{callPrefix}#{x86Operand(kind)}"
+    end
+end
+
+class BaseIndex
+    def supports8BitOnX86
+        true
+    end
+    
+    def x86AddressOperand(addressKind)
+        if !isIntelSyntax
+            "#{offset.value}(#{base.x86Operand(addressKind)}, #{index.x86Operand(addressKind)}, #{scale})"
+        else
+            "#{getSizeString(addressKind)}[#{offset.value} + #{base.x86Operand(addressKind)} + #{index.x86Operand(addressKind)} * #{scale}]"
+        end
+    end
+    
+    def x86Operand(kind)
+        if !isIntelSyntax
+            x86AddressOperand(:ptr)
+        else
+            "#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"
+        end
+    end
+
+    def x86CallOperand(kind)
+        "#{callPrefix}#{x86Operand(kind)}"
+    end
+end
+
+class AbsoluteAddress
+    def supports8BitOnX86
+        true
+    end
+    
+    def x86AddressOperand(addressKind)
+        "#{address.value}"
+    end
+    
+    def x86Operand(kind)
+        "#{address.value}"
+    end
+
+    def x86CallOperand(kind)
+        "#{callPrefix}#{address.value}"
+    end
+end
+
+class LabelReference
+    def x86CallOperand(kind)
+        asmLabel
+    end
+end
+
+class LocalLabelReference
+    def x86Operand(kind)
+        asmLabel
+    end
+    def x86CallOperand(kind)
+        asmLabel
+    end
+end
+
+class Sequence
+    def getModifiedListX86_64
+        newList = []
+        
+        @list.each {
+            | node |
+            newNode = node
+            if node.is_a? Instruction
+                unless node.opcode == "move"
+                    usedScratch = false
+                    newOperands = node.operands.map {
+                        | operand |
+                        if operand.immediate? and not operand.validX86Immediate?
+                            if usedScratch
+                                raise "Attempt to use scratch register twice at #{operand.codeOriginString}"
+                            end
+                            newList << Instruction.new(operand.codeOrigin, "move", [operand, X64_SCRATCH_REGISTER])
+                            usedScratch = true
+                            X64_SCRATCH_REGISTER
+                        else
+                            operand
+                        end
+                    }
+                    newNode = Instruction.new(node.codeOrigin, node.opcode, newOperands, node.annotation)
+                end
+            else
+                unless node.is_a? Label or
+                        node.is_a? LocalLabel or
+                        node.is_a? Skip
+                    raise "Unexpected #{node.inspect} at #{node.codeOrigin}" 
+                end
+            end
+            if newNode
+                newList << newNode
+            end
+        }
+        
+        return newList
+    end
+    def getModifiedListX86_64_WIN
+        getModifiedListX86_64
+    end
+end
+
+class Instruction
+    
+    def x86Operands(*kinds)
+        raise unless kinds.size == operands.size
+        result = []
+        kinds.size.times {
+            | idx |
+            i = isIntelSyntax ? (kinds.size - idx - 1) : idx
+            result << operands[i].x86Operand(kinds[i])
+        }
+        result.join(", ")
+    end
+
+    def x86Suffix(kind)
+        if isIntelSyntax
+            return ""
+        end
+
+        case kind
+        when :byte
+            "b"
+        when :half
+            "w"
+        when :int
+            "l"
+        when :ptr
+            isX64 ? "q" : "l"
+        when :quad
+            isX64 ? "q" : raise
+        when :double
+            not useX87 ? "sd" : raise
+        else
+            raise
+        end
+    end
+    
+    def x86Bytes(kind)
+        case kind
+        when :byte
+            1
+        when :half
+            2
+        when :int
+            4
+        when :ptr
+            isX64 ? 8 : 4
+        when :quad
+            isX64 ? 8 : raise
+        when :double
+            8
+        else
+            raise
+        end
+    end
+
+    def getImplicitOperandString
+        isIntelSyntax ? "st(0), " : ""
+    end
+    
+    def handleX86OpWithNumOperands(opcode, kind, numOperands)
+        if numOperands == 3
+            if operands[0] == operands[2]
+                $asm.puts "#{opcode} #{orderOperands(operands[1].x86Operand(kind), operands[2].x86Operand(kind))}"
+            elsif operands[1] == operands[2]
+                $asm.puts "#{opcode} #{orderOperands(operands[0].x86Operand(kind), operands[2].x86Operand(kind))}"
+            else
+                $asm.puts "mov#{x86Suffix(kind)} #{orderOperands(operands[0].x86Operand(kind), operands[2].x86Operand(kind))}"
+                $asm.puts "#{opcode} #{orderOperands(operands[1].x86Operand(kind), operands[2].x86Operand(kind))}"
+            end
+        else
+            $asm.puts "#{opcode} #{orderOperands(operands[0].x86Operand(kind), operands[1].x86Operand(kind))}"
+        end
+    end
+    
+    def handleX86Op(opcode, kind)
+        handleX86OpWithNumOperands(opcode, kind, operands.size)
+    end
+    
+    def handleX86Shift(opcode, kind)
+        if operands[0].is_a? Immediate or operands[0].x86GPR == "ecx"
+            $asm.puts "#{opcode} #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(kind))}"
+        else
+            $asm.puts "xchg#{x86Suffix(:ptr)} #{operands[0].x86Operand(:ptr)}, #{x86GPRName("ecx", :ptr)}"
+            $asm.puts "#{opcode} #{orderOperands(register("cl"), operands[1].x86Operand(kind))}"
+            $asm.puts "xchg#{x86Suffix(:ptr)} #{operands[0].x86Operand(:ptr)}, #{x86GPRName("ecx", :ptr)}"
+        end
+    end
+    
+    def handleX86DoubleBranch(branchOpcode, mode)
+        if useX87
+            handleX87Compare(mode)
+        else
+            case mode
+            when :normal
+                $asm.puts "ucomisd #{orderOperands(operands[1].x86Operand(:double), operands[0].x86Operand(:double))}"
+            when :reverse
+                $asm.puts "ucomisd #{orderOperands(operands[0].x86Operand(:double), operands[1].x86Operand(:double))}"
+            else
+                raise mode.inspect
+            end
+        end
+        $asm.puts "#{branchOpcode} #{operands[2].asmLabel}"
+    end
+    
+    def handleX86IntCompare(opcodeSuffix, kind)
+        if operands[0].is_a? Immediate and operands[0].value == 0 and operands[1].is_a? RegisterID and (opcodeSuffix == "e" or opcodeSuffix == "ne")
+            $asm.puts "test#{x86Suffix(kind)} #{orderOperands(operands[1].x86Operand(kind), operands[1].x86Operand(kind))}"
+        elsif operands[1].is_a? Immediate and operands[1].value == 0 and operands[0].is_a? RegisterID and (opcodeSuffix == "e" or opcodeSuffix == "ne")
+            $asm.puts "test#{x86Suffix(kind)}  #{orderOperands(operands[0].x86Operand(kind), operands[0].x86Operand(kind))}"
+        else
+            $asm.puts "cmp#{x86Suffix(kind)} #{orderOperands(operands[1].x86Operand(kind), operands[0].x86Operand(kind))}"
+        end
+    end
+    
+    def handleX86IntBranch(branchOpcode, kind)
+        handleX86IntCompare(branchOpcode[1..-1], kind)
+        $asm.puts "#{branchOpcode} #{operands[2].asmLabel}"
+    end
+    
+    def handleX86Set(setOpcode, operand)
+        if operand.supports8BitOnX86
+            $asm.puts "#{setOpcode} #{operand.x86Operand(:byte)}"
+            if !isIntelSyntax
+                $asm.puts "movzbl #{orderOperands(operand.x86Operand(:byte), operand.x86Operand(:int))}"
+            else
+                $asm.puts "movzx #{orderOperands(operand.x86Operand(:byte), operand.x86Operand(:int))}"
+            end
+        else
+            ax = RegisterID.new(nil, "r0")
+            $asm.puts "xchg#{x86Suffix(:ptr)} #{operand.x86Operand(:ptr)}, #{ax.x86Operand(:ptr)}"
+            $asm.puts "#{setOpcode} #{ax.x86Operand(:byte)}"
+            if !isIntelSyntax
+                $asm.puts "movzbl #{ax.x86Operand(:byte)}, #{ax.x86Operand(:int)}"
+            else
+                $asm.puts "movzx #{ax.x86Operand(:int)}, #{ax.x86Operand(:byte)}"
+            end
+            $asm.puts "xchg#{x86Suffix(:ptr)} #{operand.x86Operand(:ptr)}, #{ax.x86Operand(:ptr)}"
+        end
+    end
+    
+    def handleX86IntCompareSet(setOpcode, kind)
+        handleX86IntCompare(setOpcode[3..-1], kind)
+        handleX86Set(setOpcode, operands[2])
+    end
+    
+    def handleX86Test(kind)
+        value = operands[0]
+        case operands.size
+        when 2
+            mask = Immediate.new(codeOrigin, -1)
+        when 3
+            mask = operands[1]
+        else
+            raise "Expected 2 or 3 operands, but got #{operands.size} at #{codeOriginString}"
+        end
+        
+        if mask.is_a? Immediate and mask.value == -1
+            if value.is_a? RegisterID
+                $asm.puts "test#{x86Suffix(kind)} #{value.x86Operand(kind)}, #{value.x86Operand(kind)}"
+            else
+                $asm.puts "cmp#{x86Suffix(kind)} #{orderOperands(const(0), value.x86Operand(kind))}"
+            end
+        else
+            $asm.puts "test#{x86Suffix(kind)} #{orderOperands(mask.x86Operand(kind), value.x86Operand(kind))}"
+        end
+    end
+    
+    def handleX86BranchTest(branchOpcode, kind)
+        handleX86Test(kind)
+        $asm.puts "#{branchOpcode} #{operands.last.asmLabel}"
+    end
+    
+    def handleX86SetTest(setOpcode, kind)
+        handleX86Test(kind)
+        handleX86Set(setOpcode, operands.last)
+    end
+    
+    def handleX86OpBranch(opcode, branchOpcode, kind)
+        handleX86OpWithNumOperands(opcode, kind, operands.size - 1)
+        case operands.size
+        when 4
+            jumpTarget = operands[3]
+        when 3
+            jumpTarget = operands[2]
+        else
+            raise self.inspect
+        end
+        $asm.puts "#{branchOpcode} #{jumpTarget.asmLabel}"
+    end
+    
+    def handleX86SubBranch(branchOpcode, kind)
+        if operands.size == 4 and operands[1] == operands[2]
+            $asm.puts "neg#{x86Suffix(kind)} #{operands[2].x86Operand(kind)}"
+            $asm.puts "add#{x86Suffix(kind)} #{orderOperands(operands[0].x86Operand(kind), operands[2].x86Operand(kind))}"
+        else
+            handleX86OpWithNumOperands("sub#{x86Suffix(kind)}", kind, operands.size - 1)
+        end
+        case operands.size
+        when 4
+            jumpTarget = operands[3]
+        when 3
+            jumpTarget = operands[2]
+        else
+            raise self.inspect
+        end
+        $asm.puts "#{branchOpcode} #{jumpTarget.asmLabel}"
+    end
+
+    def handleX86Add(kind)
+        if operands.size == 3 and operands[1] == operands[2]
+            unless Immediate.new(nil, 0) == operands[0]
+                $asm.puts "add#{x86Suffix(kind)} #{orderOperands(operands[0].x86Operand(kind), operands[2].x86Operand(kind))}"
+            end
+        elsif operands.size == 3 and operands[0].is_a? Immediate
+            raise unless operands[1].is_a? RegisterID
+            raise unless operands[2].is_a? RegisterID
+            if operands[0].value == 0
+                unless operands[1] == operands[2]
+                    $asm.puts "mov#{x86Suffix(kind)} #{orderOperands(operands[1].x86Operand(kind), operands[2].x86Operand(kind))}"
+                end
+            else
+                $asm.puts "lea#{x86Suffix(kind)} #{orderOperands(offsetRegister(operands[0].value, operands[1].x86Operand(kind)), operands[2].x86Operand(kind))}"
+            end
+        elsif operands.size == 3 and operands[0].is_a? RegisterID
+            raise unless operands[1].is_a? RegisterID
+            raise unless operands[2].is_a? RegisterID
+            if operands[0] == operands[2]
+                $asm.puts "add#{x86Suffix(kind)} #{orderOperands(operands[1].x86Operand(kind), operands[2].x86Operand(kind))}"
+            else
+                if !isIntelSyntax
+                    $asm.puts "lea#{x86Suffix(kind)} (#{operands[0].x86Operand(kind)}, #{operands[1].x86Operand(kind)}), #{operands[2].x86Operand(kind)}"
+                else
+                    $asm.puts "lea#{x86Suffix(kind)} #{operands[2].x86Operand(kind)}, [#{operands[0].x86Operand(kind)} + #{operands[1].x86Operand(kind)}]"
+                end
+            end
+        else
+            unless Immediate.new(nil, 0) == operands[0]
+                $asm.puts "add#{x86Suffix(kind)} #{x86Operands(kind, kind)}"
+            end
+        end
+    end
+    
+    def handleX86Sub(kind)
+        if operands.size == 3 and operands[1] == operands[2]
+            $asm.puts "neg#{x86Suffix(kind)} #{operands[2].x86Operand(kind)}"
+            $asm.puts "add#{x86Suffix(kind)} #{orderOperands(operands[0].x86Operand(kind), operands[2].x86Operand(kind))}"
+        else
+            handleX86Op("sub#{x86Suffix(kind)}", kind)
+        end
+    end
+    
+    def handleX86Mul(kind)
+        if operands.size == 3 and operands[0].is_a? Immediate
+            $asm.puts "imul#{x86Suffix(kind)} #{x86Operands(kind, kind, kind)}"
+        else
+            # FIXME: could do some peephole in case the left operand is immediate and it's
+            # a power of two.
+            handleX86Op("imul#{x86Suffix(kind)}", kind)
+        end
+    end
+    
+    def handleX86Peek()
+        sp = RegisterID.new(nil, "sp")
+        opA = offsetRegister(operands[0].value * x86Bytes(:ptr), sp.x86Operand(:ptr))
+        opB = operands[1].x86Operand(:ptr)
+        $asm.puts "mov#{x86Suffix(:ptr)} #{orderOperands(opA, opB)}"
+    end
+
+    def handleX86Poke()
+        sp = RegisterID.new(nil, "sp")
+        opA = operands[0].x86Operand(:ptr)
+        opB = offsetRegister(operands[1].value * x86Bytes(:ptr), sp.x86Operand(:ptr))
+        $asm.puts "mov#{x86Suffix(:ptr)} #{orderOperands(opA, opB)}"
+    end
+
+    def handleMove
+        if Immediate.new(nil, 0) == operands[0] and operands[1].is_a? RegisterID
+            if isX64
+                $asm.puts "xor#{x86Suffix(:quad)} #{operands[1].x86Operand(:quad)}, #{operands[1].x86Operand(:quad)}"
+            else
+                $asm.puts "xor#{x86Suffix(:ptr)} #{operands[1].x86Operand(:ptr)}, #{operands[1].x86Operand(:ptr)}"
+            end
+        elsif operands[0] != operands[1]
+            if isX64
+                $asm.puts "mov#{x86Suffix(:quad)} #{x86Operands(:quad, :quad)}"
+            else
+                $asm.puts "mov#{x86Suffix(:ptr)} #{x86Operands(:ptr, :ptr)}"
+            end
+        end
+    end
+
+    def handleX87Compare(mode)
+        floatingPointCompareImplicitOperand = getImplicitOperandString
+        case mode
+        when :normal
+            if (operands[0].x87DefaultStackPosition == 0)
+                $asm.puts "fucomi #{floatingPointCompareImplicitOperand}#{operands[1].x87Operand(0)}"
+            else
+                $asm.puts "fld #{operands[0].x87Operand(0)}"
+                $asm.puts "fucomip #{floatingPointCompareImplicitOperand}#{operands[1].x87Operand(1)}"
+            end
+        when :reverse
+            if (operands[1].x87DefaultStackPosition == 0)
+                $asm.puts "fucomi #{floatingPointCompareImplicitOperand}#{operands[0].x87Operand(0)}"
+            else
+                $asm.puts "fld #{operands[1].x87Operand(0)}"
+                $asm.puts "fucomip #{floatingPointCompareImplicitOperand}#{operands[0].x87Operand(1)}"
+            end
+        else
+            raise mode.inspect
+        end
+    end
+
+    def handleX87BinOp(opcode, opcodereverse)
+        if (operands[1].x87DefaultStackPosition == 0)
+            $asm.puts "#{opcode} #{orderOperands(operands[0].x87Operand(0), register("st"))}"
+        elsif (operands[0].x87DefaultStackPosition == 0)
+            if !isIntelSyntax
+                $asm.puts "#{opcodereverse} #{register("st")}, #{operands[1].x87Operand(0)}"
+            else
+                $asm.puts "#{opcode} #{operands[1].x87Operand(0)}, #{register("st")}"
+            end
+        else
+            $asm.puts "fld #{operands[0].x87Operand(0)}"
+            $asm.puts "#{opcodereverse}p #{orderOperands(register("st"), operands[1].x87Operand(1))}"
+        end
+    end
+
+    def lowerX86
+        raise unless $activeBackend == "X86"
+        lowerX86Common
+    end
+
+    def lowerX86_WIN
+        raise unless $activeBackend == "X86_WIN" 
+        lowerX86Common
+    end
+    
+    def lowerX86_64
+        raise unless $activeBackend == "X86_64"
+        lowerX86Common
+    end
+
+    def lowerX86_64_WIN
+        raise unless $activeBackend == "X86_64_WIN"
+        lowerX86Common
+    end
+
+    def lowerX86Common
+        $asm.codeOrigin codeOriginString if $enableCodeOriginComments
+        $asm.annotation annotation if $enableInstrAnnotations
+        $asm.debugAnnotation codeOrigin.debugDirective if $enableDebugAnnotations
+
+        case opcode
+        when "addi"
+            handleX86Add(:int)
+        when "addp"
+            handleX86Add(:ptr)
+        when "addq"
+            handleX86Add(:quad)
+        when "andi"
+            handleX86Op("and#{x86Suffix(:int)}", :int)
+        when "andp"
+            handleX86Op("and#{x86Suffix(:ptr)}", :ptr)
+        when "andq"
+            handleX86Op("and#{x86Suffix(:quad)}", :quad)
+        when "lshifti"
+            handleX86Shift("sal#{x86Suffix(:int)}", :int)
+        when "lshiftp"
+            handleX86Shift("sal#{x86Suffix(:ptr)}", :ptr)
+        when "lshiftq"
+            handleX86Shift("sal#{x86Suffix(:quad)}", :quad)
+        when "muli"
+            handleX86Mul(:int)
+        when "mulp"
+            handleX86Mul(:ptr)
+        when "mulq"
+            handleX86Mul(:quad)
+        when "negi"
+            $asm.puts "neg#{x86Suffix(:int)} #{x86Operands(:int)}"
+        when "negp"
+            $asm.puts "neg#{x86Suffix(:ptr)} #{x86Operands(:ptr)}"
+        when "negq"
+            $asm.puts "neg#{x86Suffix(:quad)} #{x86Operands(:quad)}"
+        when "noti"
+            $asm.puts "not#{x86Suffix(:int)} #{x86Operands(:int)}"
+        when "ori"
+            handleX86Op("or#{x86Suffix(:int)}", :int)
+        when "orp"
+            handleX86Op("or#{x86Suffix(:ptr)}", :ptr)
+        when "orq"
+            handleX86Op("or#{x86Suffix(:quad)}", :quad)
+        when "rshifti"
+            handleX86Shift("sar#{x86Suffix(:int)}", :int)
+        when "rshiftp"
+            handleX86Shift("sar#{x86Suffix(:ptr)}", :ptr)
+        when "rshiftq"
+            handleX86Shift("sar#{x86Suffix(:quad)}", :quad)
+        when "urshifti"
+            handleX86Shift("shr#{x86Suffix(:int)}", :int)
+        when "urshiftp"
+            handleX86Shift("shr#{x86Suffix(:ptr)}", :ptr)
+        when "urshiftq"
+            handleX86Shift("shr#{x86Suffix(:quad)}", :quad)
+        when "subi"
+            handleX86Sub(:int)
+        when "subp"
+            handleX86Sub(:ptr)
+        when "subq"
+            handleX86Sub(:quad)
+        when "xori"
+            handleX86Op("xor#{x86Suffix(:int)}", :int)
+        when "xorp"
+            handleX86Op("xor#{x86Suffix(:ptr)}", :ptr)
+        when "xorq"
+            handleX86Op("xor#{x86Suffix(:quad)}", :quad)
+        when "loadi", "storei"
+            $asm.puts "mov#{x86Suffix(:int)} #{x86Operands(:int, :int)}"
+        when "loadis"
+            if isX64
+                if !isIntelSyntax
+                    $asm.puts "movslq #{x86Operands(:int, :quad)}"
+                else
+                    $asm.puts "movsxd #{x86Operands(:int, :quad)}"
+                end
+            else
+                $asm.puts "mov#{x86Suffix(:int)} #{x86Operands(:int, :int)}"
+            end
+        when "loadp", "storep"
+            $asm.puts "mov#{x86Suffix(:ptr)} #{x86Operands(:ptr, :ptr)}"
+        when "loadq", "storeq"
+            $asm.puts "mov#{x86Suffix(:quad)} #{x86Operands(:quad, :quad)}"
+        when "loadb"
+            if !isIntelSyntax
+                $asm.puts "movzbl #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(:int))}"
+            else
+                $asm.puts "movzx #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(:int))}"
+            end
+        when "loadbs"
+            if !isIntelSyntax
+                $asm.puts "movsbl #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(:int))}"
+            else
+                $asm.puts "movsx #{orderOperands(operands[0].x86Operand(:byte), operands[1].x86Operand(:int))}"
+            end
+        when "loadh"
+            if !isIntelSyntax
+                $asm.puts "movzwl #{orderOperands(operands[0].x86Operand(:half), operands[1].x86Operand(:int))}"
+            else
+                $asm.puts "movzx #{orderOperands(operands[0].x86Operand(:half), operands[1].x86Operand(:int))}"
+            end
+        when "loadhs"
+            if !isIntelSyntax
+                $asm.puts "movswl #{orderOperands(operands[0].x86Operand(:half), operands[1].x86Operand(:int))}"
+            else
+                $asm.puts "movsx #{orderOperands(operands[0].x86Operand(:half), operands[1].x86Operand(:int))}"
+            end
+        when "storeb"
+            $asm.puts "mov#{x86Suffix(:byte)} #{x86Operands(:byte, :byte)}"
+        when "loadd"
+            if useX87
+                if !isIntelSyntax
+                    $asm.puts "fldl #{operands[0].x86Operand(:double)}"
+                else
+                    $asm.puts "fld #{operands[0].x86Operand(:double)}"
+                end
+                $asm.puts "fstp #{operands[1].x87Operand(1)}"
+            else
+                $asm.puts "movsd #{x86Operands(:double, :double)}"
+            end
+        when "moved"
+            if useX87
+                if (operands[0].x87DefaultStackPosition == 0)
+                    $asm.puts "fst #{operands[1].x87Operand(0)}"
+                else
+                    $asm.puts "fld #{operands[0].x87Operand(0)}"
+                    $asm.puts "fstp #{operands[1].x87Operand(1)}"
+                end
+            else
+                $asm.puts "movsd #{x86Operands(:double, :double)}"
+            end
+        when "stored"
+            if useX87
+                if (operands[0].x87DefaultStackPosition == 0)
+                    $asm.puts "fst#{x86Suffix(:int)} #{operands[1].x86Operand(:double)}"
+                else
+                    $asm.puts "fld #{operands[0].x87Operand(0)}"
+                    if !isIntelSyntax
+                        $asm.puts "fstpl #{operands[1].x86Operand(:double)}"
+                    else
+                        $asm.puts "fstp #{operands[1].x86Operand(:double)}"
+                    end
+                end
+            else
+                $asm.puts "movsd #{x86Operands(:double, :double)}"
+            end
+        when "addd"
+            if useX87
+                handleX87BinOp("fadd", "fadd")
+            else
+                $asm.puts "addsd #{x86Operands(:double, :double)}"
+            end
+        when "muld"
+            if useX87
+                handleX87BinOp("fmul", "fmul")
+            else
+                $asm.puts "mulsd #{x86Operands(:double, :double)}"
+            end
+        when "subd"
+            if useX87
+                handleX87BinOp("fsub", "fsubr")
+            else
+                $asm.puts "subsd #{x86Operands(:double, :double)}"
+            end
+        when "divd"
+            if useX87
+                handleX87BinOp("fdiv", "fdivr")
+            else
+                $asm.puts "divsd #{x86Operands(:double, :double)}"
+            end
+        when "sqrtd"
+            if useX87
+                $asm.puts "fld #{operands[0].x87Operand(0)}"
+                $asm.puts "fsqrtl"
+                $asm.puts "fstp #{operands[1].x87Operand(1)}"
+            else
+                $asm.puts "sqrtsd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:double)}"
+            end
+        when "ci2d"
+            if useX87
+                sp = RegisterID.new(nil, "sp")
+                $asm.puts "mov#{x86Suffix(:int)} #{orderOperands(operands[0].x86Operand(:int), offsetRegister(-4, sp.x86Operand(:ptr)))}"
+                $asm.puts "fild#{x86Suffix(:ptr)} #{getSizeString(:ptr)}#{offsetRegister(-4, sp.x86Operand(:ptr))}"
+                $asm.puts "fstp #{operands[1].x87Operand(1)}"
+            else
+                $asm.puts "cvtsi2sd #{orderOperands(operands[0].x86Operand(:int), operands[1].x86Operand(:double))}"
+            end
+        when "bdeq"
+            if useX87
+                handleX87Compare(:normal)
+            else
+                $asm.puts "ucomisd #{orderOperands(operands[0].x86Operand(:double), operands[1].x86Operand(:double))}"
+            end
+            if operands[0] == operands[1]
+                # This is just a jump ordered, which is a jnp.
+                $asm.puts "jnp #{operands[2].asmLabel}"
+            else
+                isUnordered = LocalLabel.unique("bdeq")
+                $asm.puts "jp #{LabelReference.new(codeOrigin, isUnordered).asmLabel}"
+                $asm.puts "je #{LabelReference.new(codeOrigin, operands[2]).asmLabel}"
+                isUnordered.lower("X86")
+            end
+        when "bdneq"
+            handleX86DoubleBranch("jne", :normal)
+        when "bdgt"
+            handleX86DoubleBranch("ja", :normal)
+        when "bdgteq"
+            handleX86DoubleBranch("jae", :normal)
+        when "bdlt"
+            handleX86DoubleBranch("ja", :reverse)
+        when "bdlteq"
+            handleX86DoubleBranch("jae", :reverse)
+        when "bdequn"
+            handleX86DoubleBranch("je", :normal)
+        when "bdnequn"
+            if useX87
+                handleX87Compare(:normal)
+            else
+                $asm.puts "ucomisd #{orderOperands(operands[0].x86Operand(:double), operands[1].x86Operand(:double))}"
+            end
+            if operands[0] == operands[1]
+                # This is just a jump unordered, which is a jp.
+                $asm.puts "jp #{operands[2].asmLabel}"
+            else
+                isUnordered = LocalLabel.unique("bdnequn")
+                isEqual = LocalLabel.unique("bdnequn")
+                $asm.puts "jp #{LabelReference.new(codeOrigin, isUnordered).asmLabel}"
+                $asm.puts "je #{LabelReference.new(codeOrigin, isEqual).asmLabel}"
+                isUnordered.lower("X86")
+                $asm.puts "jmp #{operands[2].asmLabel}"
+                isEqual.lower("X86")
+            end
+        when "bdgtun"
+            handleX86DoubleBranch("jb", :reverse)
+        when "bdgtequn"
+            handleX86DoubleBranch("jbe", :reverse)
+        when "bdltun"
+            handleX86DoubleBranch("jb", :normal)
+        when "bdltequn"
+            handleX86DoubleBranch("jbe", :normal)
+        when "btd2i"
+            # FIXME: unused and unimplemented for x87
+            raise if useX87
+            $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
+            $asm.puts "cmpl $0x80000000 #{operands[1].x86Operand(:int)}"
+            $asm.puts "je #{operands[2].asmLabel}"
+        when "td2i"
+            # FIXME: unused and unimplemented for x87
+            raise if useX87
+            $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
+        when "bcd2i"
+            if useX87
+                floatingPointCompareImplicitOperand = getImplicitOperandString
+                sp = RegisterID.new(nil, "sp")
+                if (operands[0].x87DefaultStackPosition == 0)
+                    $asm.puts "fistl -4(#{sp.x86Operand(:ptr)})"
+                else
+                    $asm.puts "fld #{operands[0].x87Operand(0)}"
+                    $asm.puts "fistp#{x86Suffix(:ptr)} #{getSizeString(:ptr)}#{offsetRegister(-4, sp.x86Operand(:ptr))}"
+                end
+                $asm.puts "mov#{x86Suffix(:int)} #{orderOperands(offsetRegister(-4, sp.x86Operand(:ptr)), operands[1].x86Operand(:int))}"
+                $asm.puts "test#{x86Suffix(:int)} #{operands[1].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
+                $asm.puts "je #{operands[2].asmLabel}"
+                $asm.puts "fild#{x86Suffix(:int)} #{getSizeString(:int)}#{offsetRegister(-4, sp.x86Operand(:ptr))}"
+                $asm.puts "fucomip #{floatingPointCompareImplicitOperand}#{operands[0].x87Operand(1)}"
+                $asm.puts "jp #{operands[2].asmLabel}"
+                $asm.puts "jne #{operands[2].asmLabel}"
+            else
+                $asm.puts "cvttsd2si #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
+                $asm.puts "test#{x86Suffix(:int)} #{operands[1].x86Operand(:int)}, #{operands[1].x86Operand(:int)}"
+                $asm.puts "je #{operands[2].asmLabel}"
+                $asm.puts "cvtsi2sd #{operands[1].x86Operand(:int)}, %xmm7"
+                $asm.puts "ucomisd #{operands[0].x86Operand(:double)}, %xmm7"
+                $asm.puts "jp #{operands[2].asmLabel}"
+                $asm.puts "jne #{operands[2].asmLabel}"
+            end
+        when "movdz"
+            if useX87
+                $asm.puts "fldzl"
+                $asm.puts "fstp #{operands[0].x87Operand(1)}"
+            else
+                $asm.puts "xorpd #{operands[0].x86Operand(:double)}, #{operands[0].x86Operand(:double)}"
+            end
+        when "pop"
+            operands.each {
+                | op |
+                $asm.puts "pop #{op.x86Operand(:ptr)}"
+            }
+        when "push"
+            operands.each {
+                | op |
+                $asm.puts "push #{op.x86Operand(:ptr)}"
+            }
+        when "move"
+            handleMove
+        when "sxi2q"
+            if !isIntelSyntax
+                $asm.puts "movslq #{operands[0].x86Operand(:int)}, #{operands[1].x86Operand(:quad)}"
+            else
+                $asm.puts "movsxd #{orderOperands(operands[0].x86Operand(:int), operands[1].x86Operand(:quad))}"
+            end
+        when "zxi2q"
+            $asm.puts "mov#{x86Suffix(:int)} #{orderOperands(operands[0].x86Operand(:int), operands[1].x86Operand(:int))}"
+        when "nop"
+            $asm.puts "nop"
+        when "bieq"
+            handleX86IntBranch("je", :int)
+        when "bpeq"
+            handleX86IntBranch("je", :ptr)
+        when "bqeq"
+            handleX86IntBranch("je", :quad)
+        when "bineq"
+            handleX86IntBranch("jne", :int)
+        when "bpneq"
+            handleX86IntBranch("jne", :ptr)
+        when "bqneq"
+            handleX86IntBranch("jne", :quad)
+        when "bia"
+            handleX86IntBranch("ja", :int)
+        when "bpa"
+            handleX86IntBranch("ja", :ptr)
+        when "bqa"
+            handleX86IntBranch("ja", :quad)
+        when "biaeq"
+            handleX86IntBranch("jae", :int)
+        when "bpaeq"
+            handleX86IntBranch("jae", :ptr)
+        when "bqaeq"
+            handleX86IntBranch("jae", :quad)
+        when "bib"
+            handleX86IntBranch("jb", :int)
+        when "bpb"
+            handleX86IntBranch("jb", :ptr)
+        when "bqb"
+            handleX86IntBranch("jb", :quad)
+        when "bibeq"
+            handleX86IntBranch("jbe", :int)
+        when "bpbeq"
+            handleX86IntBranch("jbe", :ptr)
+        when "bqbeq"
+            handleX86IntBranch("jbe", :quad)
+        when "bigt"
+            handleX86IntBranch("jg", :int)
+        when "bpgt"
+            handleX86IntBranch("jg", :ptr)
+        when "bqgt"
+            handleX86IntBranch("jg", :quad)
+        when "bigteq"
+            handleX86IntBranch("jge", :int)
+        when "bpgteq"
+            handleX86IntBranch("jge", :ptr)
+        when "bqgteq"
+            handleX86IntBranch("jge", :quad)
+        when "bilt"
+            handleX86IntBranch("jl", :int)
+        when "bplt"
+            handleX86IntBranch("jl", :ptr)
+        when "bqlt"
+            handleX86IntBranch("jl", :quad)
+        when "bilteq"
+            handleX86IntBranch("jle", :int)
+        when "bplteq"
+            handleX86IntBranch("jle", :ptr)
+        when "bqlteq"
+            handleX86IntBranch("jle", :quad)
+        when "bbeq"
+            handleX86IntBranch("je", :byte)
+        when "bbneq"
+            handleX86IntBranch("jne", :byte)
+        when "bba"
+            handleX86IntBranch("ja", :byte)
+        when "bbaeq"
+            handleX86IntBranch("jae", :byte)
+        when "bbb"
+            handleX86IntBranch("jb", :byte)
+        when "bbbeq"
+            handleX86IntBranch("jbe", :byte)
+        when "bbgt"
+            handleX86IntBranch("jg", :byte)
+        when "bbgteq"
+            handleX86IntBranch("jge", :byte)
+        when "bblt"
+            handleX86IntBranch("jl", :byte)
+        when "bblteq"
+            handleX86IntBranch("jlteq", :byte)
+        when "btis"
+            handleX86BranchTest("js", :int)
+        when "btps"
+            handleX86BranchTest("js", :ptr)
+        when "btqs"
+            handleX86BranchTest("js", :quad)
+        when "btiz"
+            handleX86BranchTest("jz", :int)
+        when "btpz"
+            handleX86BranchTest("jz", :ptr)
+        when "btqz"
+            handleX86BranchTest("jz", :quad)
+        when "btinz"
+            handleX86BranchTest("jnz", :int)
+        when "btpnz"
+            handleX86BranchTest("jnz", :ptr)
+        when "btqnz"
+            handleX86BranchTest("jnz", :quad)
+        when "btbs"
+            handleX86BranchTest("js", :byte)
+        when "btbz"
+            handleX86BranchTest("jz", :byte)
+        when "btbnz"
+            handleX86BranchTest("jnz", :byte)
+        when "jmp"
+            $asm.puts "jmp #{operands[0].x86CallOperand(:ptr)}"
+        when "baddio"
+            handleX86OpBranch("add#{x86Suffix(:int)}", "jo", :int)
+        when "baddpo"
+            handleX86OpBranch("add#{x86Suffix(:ptr)}", "jo", :ptr)
+        when "baddqo"
+            handleX86OpBranch("add#{x86Suffix(:quad)}", "jo", :quad)
+        when "baddis"
+            handleX86OpBranch("add#{x86Suffix(:int)}", "js", :int)
+        when "baddps"
+            handleX86OpBranch("add#{x86Suffix(:ptr)}", "js", :ptr)
+        when "baddqs"
+            handleX86OpBranch("add#{x86Suffix(:quad)}", "js", :quad)
+        when "baddiz"
+            handleX86OpBranch("add#{x86Suffix(:int)}", "jz", :int)
+        when "baddpz"
+            handleX86OpBranch("add#{x86Suffix(:ptr)}", "jz", :ptr)
+        when "baddqz"
+            handleX86OpBranch("add#{x86Suffix(:quad)}", "jz", :quad)
+        when "baddinz"
+            handleX86OpBranch("add#{x86Suffix(:int)}", "jnz", :int)
+        when "baddpnz"
+            handleX86OpBranch("add#{x86Suffix(:ptr)}", "jnz", :ptr)
+        when "baddqnz"
+            handleX86OpBranch("add#{x86Suffix(:quad)}", "jnz", :quad)
+        when "bsubio"
+            handleX86SubBranch("jo", :int)
+        when "bsubis"
+            handleX86SubBranch("js", :int)
+        when "bsubiz"
+            handleX86SubBranch("jz", :int)
+        when "bsubinz"
+            handleX86SubBranch("jnz", :int)
+        when "bmulio"
+            handleX86OpBranch("imul#{x86Suffix(:int)}", "jo", :int)
+        when "bmulis"
+            handleX86OpBranch("imul#{x86Suffix(:int)}", "js", :int)
+        when "bmuliz"
+            handleX86OpBranch("imul#{x86Suffix(:int)}", "jz", :int)
+        when "bmulinz"
+            handleX86OpBranch("imul#{x86Suffix(:int)}", "jnz", :int)
+        when "borio"
+            handleX86OpBranch("orl", "jo", :int)
+        when "boris"
+            handleX86OpBranch("orl", "js", :int)
+        when "boriz"
+            handleX86OpBranch("orl", "jz", :int)
+        when "borinz"
+            handleX86OpBranch("orl", "jnz", :int)
+        when "break"
+            $asm.puts "int #{const(3)}"
+        when "call"
+            if useX87
+                2.times {
+                    | offset |
+                    $asm.puts "ffree #{register("st")}(#{offset})"
+                }
+            end
+            op = operands[0].x86CallOperand(:ptr)
+            if operands[0].is_a? LabelReference
+                operands[0].used
+            end
+            $asm.puts "call #{op}"
+        when "ret"
+            $asm.puts "ret"
+        when "cieq"
+            handleX86IntCompareSet("sete", :int)
+        when "cbeq"
+            handleX86IntCompareSet("sete", :byte)
+        when "cpeq"
+            handleX86IntCompareSet("sete", :ptr)
+        when "cqeq"
+            handleX86IntCompareSet("sete", :quad)
+        when "cineq"
+            handleX86IntCompareSet("setne", :int)
+        when "cbneq"
+            handleX86IntCompareSet("setne", :byte)
+        when "cpneq"
+            handleX86IntCompareSet("setne", :ptr)
+        when "cqneq"
+            handleX86IntCompareSet("setne", :quad)
+        when "cia"
+            handleX86IntCompareSet("seta", :int)
+        when "cba"
+            handleX86IntCompareSet("seta", :byte)
+        when "cpa"
+            handleX86IntCompareSet("seta", :ptr)
+        when "cqa"
+            handleX86IntCompareSet("seta", :quad)
+        when "ciaeq"
+            handleX86IntCompareSet("setae", :int)
+        when "cbaeq"
+            handleX86IntCompareSet("setae", :byte)
+        when "cpaeq"
+            handleX86IntCompareSet("setae", :ptr)
+        when "cqaeq"
+            handleX86IntCompareSet("setae", :quad)
+        when "cib"
+            handleX86IntCompareSet("setb", :int)
+        when "cbb"
+            handleX86IntCompareSet("setb", :byte)
+        when "cpb"
+            handleX86IntCompareSet("setb", :ptr)
+        when "cqb"
+            handleX86IntCompareSet("setb", :quad)
+        when "cibeq"
+            handleX86IntCompareSet("setbe", :int)
+        when "cbbeq"
+            handleX86IntCompareSet("setbe", :byte)
+        when "cpbeq"
+            handleX86IntCompareSet("setbe", :ptr)
+        when "cqbeq"
+            handleX86IntCompareSet("setbe", :quad)
+        when "cigt"
+            handleX86IntCompareSet("setg", :int)
+        when "cbgt"
+            handleX86IntCompareSet("setg", :byte)
+        when "cpgt"
+            handleX86IntCompareSet("setg", :ptr)
+        when "cqgt"
+            handleX86IntCompareSet("setg", :quad)
+        when "cigteq"
+            handleX86IntCompareSet("setge", :int)
+        when "cbgteq"
+            handleX86IntCompareSet("setge", :byte)
+        when "cpgteq"
+            handleX86IntCompareSet("setge", :ptr)
+        when "cqgteq"
+            handleX86IntCompareSet("setge", :quad)
+        when "cilt"
+            handleX86IntCompareSet("setl", :int)
+        when "cblt"
+            handleX86IntCompareSet("setl", :byte)
+        when "cplt"
+            handleX86IntCompareSet("setl", :ptr)
+        when "cqlt"
+            handleX86IntCompareSet("setl", :quad)
+        when "cilteq"
+            handleX86IntCompareSet("setle", :int)
+        when "cblteq"
+            handleX86IntCompareSet("setle", :byte)
+        when "cplteq"
+            handleX86IntCompareSet("setle", :ptr)
+        when "cqlteq"
+            handleX86IntCompareSet("setle", :quad)
+        when "tis"
+            handleX86SetTest("sets", :int)
+        when "tiz"
+            handleX86SetTest("setz", :int)
+        when "tinz"
+            handleX86SetTest("setnz", :int)
+        when "tps"
+            handleX86SetTest("sets", :ptr)
+        when "tpz"
+            handleX86SetTest("setz", :ptr)
+        when "tpnz"
+            handleX86SetTest("setnz", :ptr)
+        when "tqs"
+            handleX86SetTest("sets", :quad)
+        when "tqz"
+            handleX86SetTest("setz", :quad)
+        when "tqnz"
+            handleX86SetTest("setnz", :quad)
+        when "tbs"
+            handleX86SetTest("sets", :byte)
+        when "tbz"
+            handleX86SetTest("setz", :byte)
+        when "tbnz"
+            handleX86SetTest("setnz", :byte)
+        when "peek"
+            handleX86Peek()
+        when "poke"
+            handleX86Poke()
+        when "cdqi"
+            $asm.puts "cdq"
+        when "idivi"
+            $asm.puts "idiv#{x86Suffix(:int)} #{operands[0].x86Operand(:int)}"
+        when "fii2d"
+            if useX87
+                sp = RegisterID.new(nil, "sp")
+                $asm.puts "mov#{x86Suffix(:int)} #{orderOperands(operands[0].x86Operand(:int), offsetRegister(-8, sp.x86Operand(:ptr)))}"
+                $asm.puts "mov#{x86Suffix(:int)} #{orderOperands(operands[1].x86Operand(:int), offsetRegister(-4, sp.x86Operand(:ptr)))}"
+                $asm.puts "fld#{x86Suffix(:ptr)} #{getSizeString(:double)}#{offsetRegister(-8, sp.x86Operand(:ptr))}"
+                $asm.puts "fstp #{operands[2].x87Operand(1)}"
+            else
+                $asm.puts "movd #{operands[0].x86Operand(:int)}, #{operands[2].x86Operand(:double)}"
+                $asm.puts "movd #{operands[1].x86Operand(:int)}, %xmm7"
+                $asm.puts "psllq $32, %xmm7"
+                $asm.puts "por %xmm7, #{operands[2].x86Operand(:double)}"
+            end
+        when "fd2ii"
+            if useX87
+                sp = RegisterID.new(nil, "sp")
+                if (operands[0].x87DefaultStackPosition == 0)
+                    $asm.puts "fst#{x86Suffix(:ptr)} #{getSizeString(:double)}#{offsetRegister(-8, sp.x86Operand(:ptr))}"
+                else
+                    $asm.puts "fld #{operands[0].x87Operand(0)}"
+                    $asm.puts "fstpl -8(#{sp.x86Operand(:ptr)})"
+                end
+                $asm.puts "mov#{x86Suffix(:int)} #{orderOperands(offsetRegister(-8, sp.x86Operand(:ptr)), operands[1].x86Operand(:int))}"
+                $asm.puts "mov#{x86Suffix(:int)} #{orderOperands(offsetRegister(-4, sp.x86Operand(:ptr)), operands[2].x86Operand(:int))}"
+            else
+                $asm.puts "movd #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:int)}"
+                $asm.puts "movsd #{operands[0].x86Operand(:double)}, %xmm7"
+                $asm.puts "psrlq $32, %xmm7"
+                $asm.puts "movd %xmm7, #{operands[2].x86Operand(:int)}"
+            end
+        when "fq2d"
+            if useX87
+                sp = RegisterID.new(nil, "sp")
+                $asm.puts "movq #{operands[0].x86Operand(:quad)}, -8(#{sp.x86Operand(:ptr)})"
+                $asm.puts "fldl -8(#{sp.x86Operand(:ptr)})"
+                $asm.puts "fstp #{operands[1].x87Operand(1)}"
+            else
+                if !isIntelSyntax
+                    $asm.puts "movq #{operands[0].x86Operand(:quad)}, #{operands[1].x86Operand(:double)}"
+                else
+                    # MASM does not accept register operands with movq.
+                    # Debugging shows that movd actually moves a qword when using MASM.
+                    $asm.puts "movd #{operands[1].x86Operand(:double)}, #{operands[0].x86Operand(:quad)}"
+                end
+            end
+        when "fd2q"
+            if useX87
+                sp = RegisterID.new(nil, "sp")
+                if (operands[0].x87DefaultStackPosition == 0)
+                    $asm.puts "fst#{x86Suffix(:int)} #{getSizeString(:int)}#{offsetRegister(-8, sp.x86Operand(:ptr))}"
+                else
+                    $asm.puts "fld #{operands[0].x87Operand(0)}"
+                    $asm.puts "fstpl -8(#{sp.x86Operand(:ptr)})"
+                end
+                $asm.puts "movq -8(#{sp.x86Operand(:ptr)}), #{operands[1].x86Operand(:quad)}"
+            else
+                if !isIntelSyntax
+                    $asm.puts "movq #{operands[0].x86Operand(:double)}, #{operands[1].x86Operand(:quad)}"
+                else
+                    # MASM does not accept register operands with movq.
+                    # Debugging shows that movd actually moves a qword when using MASM.
+                    $asm.puts "movd #{operands[1].x86Operand(:quad)}, #{operands[0].x86Operand(:double)}"
+                end
+            end
+        when "bo"
+            $asm.puts "jo #{operands[0].asmLabel}"
+        when "bs"
+            $asm.puts "js #{operands[0].asmLabel}"
+        when "bz"
+            $asm.puts "jz #{operands[0].asmLabel}"
+        when "bnz"
+            $asm.puts "jnz #{operands[0].asmLabel}"
+        when "leai"
+            $asm.puts "lea#{x86Suffix(:int)} #{orderOperands(operands[0].x86AddressOperand(:int), operands[1].x86Operand(:int))}"
+        when "leap"
+            $asm.puts "lea#{x86Suffix(:ptr)} #{orderOperands(operands[0].x86AddressOperand(:ptr), operands[1].x86Operand(:ptr))}"
+        when "memfence"
+            sp = RegisterID.new(nil, "sp")
+            if isIntelSyntax
+                $asm.puts "mfence"
+            else
+                $asm.puts "lock; orl $0, (#{sp.x86Operand(:ptr)})"
+            end
+        else
+            lowerDefault
+        end
+    end
+end
+
diff --git a/parser/ASTBuilder.h b/parser/ASTBuilder.h
new file mode 100644
index 0000000..57ec412
--- /dev/null
+++ b/parser/ASTBuilder.h
@@ -0,0 +1,1455 @@
+/*
+ * Copyright (C) 2010, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BuiltinNames.h"
+#include "BytecodeIntrinsicRegistry.h"
+#include "MathCommon.h"
+#include "NodeConstructors.h"
+#include "SyntaxChecker.h"
+#include "VariableEnvironment.h"
+#include <utility>
+
+namespace JSC {
+
+class ASTBuilder {
+    struct BinaryOpInfo {
+        BinaryOpInfo() {}
+        BinaryOpInfo(const JSTextPosition& otherStart, const JSTextPosition& otherDivot, const JSTextPosition& otherEnd, bool rhsHasAssignment)
+            : start(otherStart)
+            , divot(otherDivot)
+            , end(otherEnd)
+            , hasAssignment(rhsHasAssignment)
+        {
+        }
+        BinaryOpInfo(const BinaryOpInfo& lhs, const BinaryOpInfo& rhs)
+            : start(lhs.start)
+            , divot(rhs.start)
+            , end(rhs.end)
+            , hasAssignment(lhs.hasAssignment || rhs.hasAssignment)
+        {
+        }
+        JSTextPosition start;
+        JSTextPosition divot;
+        JSTextPosition end;
+        bool hasAssignment;
+    };
+    
+    
+    struct AssignmentInfo {
+        AssignmentInfo() {}
+        AssignmentInfo(ExpressionNode* node, const JSTextPosition& start, const JSTextPosition& divot, int initAssignments, Operator op)
+            : m_node(node)
+            , m_start(start)
+            , m_divot(divot)
+            , m_initAssignments(initAssignments)
+            , m_op(op)
+        {
+            ASSERT(m_divot.offset >= m_divot.lineStartOffset);
+            ASSERT(m_start.offset >= m_start.lineStartOffset);
+        }
+        ExpressionNode* m_node;
+        JSTextPosition m_start;
+        JSTextPosition m_divot;
+        int m_initAssignments;
+        Operator m_op;
+    };
+public:
+    ASTBuilder(VM* vm, ParserArena& parserArena, SourceCode* sourceCode)
+        : m_vm(vm)
+        , m_parserArena(parserArena)
+        , m_sourceCode(sourceCode)
+        , m_evalCount(0)
+    {
+    }
+    
+    struct BinaryExprContext {
+        BinaryExprContext(ASTBuilder&) {}
+    };
+    struct UnaryExprContext {
+        UnaryExprContext(ASTBuilder&) {}
+    };
+
+    typedef ExpressionNode* Expression;
+    typedef JSC::SourceElements* SourceElements;
+    typedef ArgumentsNode* Arguments;
+    typedef CommaNode* Comma;
+    typedef PropertyNode* Property;
+    typedef PropertyListNode* PropertyList;
+    typedef ElementNode* ElementList;
+    typedef ArgumentListNode* ArgumentsList;
+    typedef TemplateExpressionListNode* TemplateExpressionList;
+    typedef TemplateStringNode* TemplateString;
+    typedef TemplateStringListNode* TemplateStringList;
+    typedef TemplateLiteralNode* TemplateLiteral;
+    typedef FunctionParameters* FormalParameterList;
+    typedef FunctionMetadataNode* FunctionBody;
+    typedef ClassExprNode* ClassExpression;
+    typedef ModuleNameNode* ModuleName;
+    typedef ImportSpecifierNode* ImportSpecifier;
+    typedef ImportSpecifierListNode* ImportSpecifierList;
+    typedef ExportSpecifierNode* ExportSpecifier;
+    typedef ExportSpecifierListNode* ExportSpecifierList;
+    typedef StatementNode* Statement;
+    typedef ClauseListNode* ClauseList;
+    typedef CaseClauseNode* Clause;
+    typedef std::pair<ExpressionNode*, BinaryOpInfo> BinaryOperand;
+    typedef DestructuringPatternNode* DestructuringPattern;
+    typedef ArrayPatternNode* ArrayPattern;
+    typedef ObjectPatternNode* ObjectPattern;
+    typedef BindingNode* BindingPattern;
+    typedef AssignmentElementNode* AssignmentElement;
+    static const bool CreatesAST = true;
+    static const bool NeedsFreeVariableInfo = true;
+    static const bool CanUseFunctionCache = true;
+    static const int  DontBuildKeywords = 0;
+    static const int  DontBuildStrings = 0;
+
+    ExpressionNode* makeBinaryNode(const JSTokenLocation&, int token, std::pair<ExpressionNode*, BinaryOpInfo>, std::pair<ExpressionNode*, BinaryOpInfo>);
+    ExpressionNode* makeFunctionCallNode(const JSTokenLocation&, ExpressionNode* func, ArgumentsNode* args, const JSTextPosition& divotStart, const JSTextPosition& divot, const JSTextPosition& divotEnd);
+
+    JSC::SourceElements* createSourceElements() { return new (m_parserArena) JSC::SourceElements(); }
+
+    int features() const { return m_scope.m_features; }
+    int numConstants() const { return m_scope.m_numConstants; }
+
+    ExpressionNode* makeAssignNode(const JSTokenLocation&, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end);
+    ExpressionNode* makePrefixNode(const JSTokenLocation&, ExpressionNode*, Operator, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end);
+    ExpressionNode* makePostfixNode(const JSTokenLocation&, ExpressionNode*, Operator, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end);
+    ExpressionNode* makeTypeOfNode(const JSTokenLocation&, ExpressionNode*);
+    ExpressionNode* makeDeleteNode(const JSTokenLocation&, ExpressionNode*, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end);
+    ExpressionNode* makeNegateNode(const JSTokenLocation&, ExpressionNode*);
+    ExpressionNode* makeBitwiseNotNode(const JSTokenLocation&, ExpressionNode*);
+    ExpressionNode* makePowNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeMultNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeDivNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeModNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeAddNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeSubNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeBitXOrNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeBitAndNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeBitOrNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeLeftShiftNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeRightShiftNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+    ExpressionNode* makeURightShiftNode(const JSTokenLocation&, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
+
+    ExpressionNode* createLogicalNot(const JSTokenLocation& location, ExpressionNode* expr)
+    {
+        if (expr->isNumber())
+            return createBoolean(location, isZeroOrUnordered(static_cast<NumberNode*>(expr)->value()));
+
+        return new (m_parserArena) LogicalNotNode(location, expr);
+    }
+    ExpressionNode* createUnaryPlus(const JSTokenLocation& location, ExpressionNode* expr) { return new (m_parserArena) UnaryPlusNode(location, expr); }
+    ExpressionNode* createVoid(const JSTokenLocation& location, ExpressionNode* expr)
+    {
+        incConstants();
+        return new (m_parserArena) VoidNode(location, expr);
+    }
+    ExpressionNode* createThisExpr(const JSTokenLocation& location)
+    {
+        usesThis();
+        return new (m_parserArena) ThisNode(location);
+    }
+    ExpressionNode* createSuperExpr(const JSTokenLocation& location)
+    {
+        return new (m_parserArena) SuperNode(location);
+    }
+    ExpressionNode* createNewTargetExpr(const JSTokenLocation location)
+    {
+        usesNewTarget();
+        return new (m_parserArena) NewTargetNode(location);
+    }
+    bool isNewTarget(ExpressionNode* node) { return node->isNewTarget(); }
+    ExpressionNode* createResolve(const JSTokenLocation& location, const Identifier& ident, const JSTextPosition& start, const JSTextPosition& end)
+    {
+        if (m_vm->propertyNames->arguments == ident)
+            usesArguments();
+
+        if (ident.isSymbol()) {
+            if (BytecodeIntrinsicNode::EmitterType emitter = m_vm->bytecodeIntrinsicRegistry().lookup(ident))
+                return new (m_parserArena) BytecodeIntrinsicNode(BytecodeIntrinsicNode::Type::Constant, location, emitter, ident, nullptr, start, start, end);
+        }
+
+        return new (m_parserArena) ResolveNode(location, ident, start);
+    }
+    ExpressionNode* createObjectLiteral(const JSTokenLocation& location) { return new (m_parserArena) ObjectLiteralNode(location); }
+    ExpressionNode* createObjectLiteral(const JSTokenLocation& location, PropertyListNode* properties) { return new (m_parserArena) ObjectLiteralNode(location, properties); }
+
+    ExpressionNode* createArray(const JSTokenLocation& location, int elisions)
+    {
+        if (elisions)
+            incConstants();
+        return new (m_parserArena) ArrayNode(location, elisions);
+    }
+
+    ExpressionNode* createArray(const JSTokenLocation& location, ElementNode* elems) { return new (m_parserArena) ArrayNode(location, elems); }
+    ExpressionNode* createArray(const JSTokenLocation& location, int elisions, ElementNode* elems)
+    {
+        if (elisions)
+            incConstants();
+        return new (m_parserArena) ArrayNode(location, elisions, elems);
+    }
+    ExpressionNode* createDoubleExpr(const JSTokenLocation& location, double d)
+    {
+        incConstants();
+        return new (m_parserArena) DoubleNode(location, d);
+    }
+    ExpressionNode* createIntegerExpr(const JSTokenLocation& location, double d)
+    {
+        incConstants();
+        return new (m_parserArena) IntegerNode(location, d);
+    }
+
+    ExpressionNode* createString(const JSTokenLocation& location, const Identifier* string)
+    {
+        incConstants();
+        return new (m_parserArena) StringNode(location, *string);
+    }
+
+    ExpressionNode* createBoolean(const JSTokenLocation& location, bool b)
+    {
+        incConstants();
+        return new (m_parserArena) BooleanNode(location, b);
+    }
+
+    ExpressionNode* createNull(const JSTokenLocation& location)
+    {
+        incConstants();
+        return new (m_parserArena) NullNode(location);
+    }
+
+    ExpressionNode* createBracketAccess(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* property, bool propertyHasAssignments, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+    {
+        if (base->isSuperNode())
+            usesSuperProperty();
+
+        BracketAccessorNode* node = new (m_parserArena) BracketAccessorNode(location, base, property, propertyHasAssignments);
+        setExceptionLocation(node, start, divot, end);
+        return node;
+    }
+
+    ExpressionNode* createDotAccess(const JSTokenLocation& location, ExpressionNode* base, const Identifier* property, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+    {
+        if (base->isSuperNode())
+            usesSuperProperty();
+        
+        DotAccessorNode* node = new (m_parserArena) DotAccessorNode(location, base, *property);
+        setExceptionLocation(node, start, divot, end);
+        return node;
+    }
+
+    ExpressionNode* createSpreadExpression(const JSTokenLocation& location, ExpressionNode* expression, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+    {
+        auto node = new (m_parserArena) SpreadExpressionNode(location, expression);
+        setExceptionLocation(node, start, divot, end);
+        return node;
+    }
+
+    TemplateStringNode* createTemplateString(const JSTokenLocation& location, const Identifier& cooked, const Identifier& raw)
+    {
+        return new (m_parserArena) TemplateStringNode(location, cooked, raw);
+    }
+
+    TemplateStringListNode* createTemplateStringList(TemplateStringNode* templateString)
+    {
+        return new (m_parserArena) TemplateStringListNode(templateString);
+    }
+
+    TemplateStringListNode* createTemplateStringList(TemplateStringListNode* templateStringList, TemplateStringNode* templateString)
+    {
+        return new (m_parserArena) TemplateStringListNode(templateStringList, templateString);
+    }
+
+    TemplateExpressionListNode* createTemplateExpressionList(ExpressionNode* expression)
+    {
+        return new (m_parserArena) TemplateExpressionListNode(expression);
+    }
+
+    TemplateExpressionListNode* createTemplateExpressionList(TemplateExpressionListNode* templateExpressionListNode, ExpressionNode* expression)
+    {
+        return new (m_parserArena) TemplateExpressionListNode(templateExpressionListNode, expression);
+    }
+
+    TemplateLiteralNode* createTemplateLiteral(const JSTokenLocation& location, TemplateStringListNode* templateStringList)
+    {
+        return new (m_parserArena) TemplateLiteralNode(location, templateStringList);
+    }
+
+    TemplateLiteralNode* createTemplateLiteral(const JSTokenLocation& location, TemplateStringListNode* templateStringList, TemplateExpressionListNode* templateExpressionList)
+    {
+        return new (m_parserArena) TemplateLiteralNode(location, templateStringList, templateExpressionList);
+    }
+
+    ExpressionNode* createTaggedTemplate(const JSTokenLocation& location, ExpressionNode* base, TemplateLiteralNode* templateLiteral, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+    {
+        auto node = new (m_parserArena) TaggedTemplateNode(location, base, templateLiteral);
+        setExceptionLocation(node, start, divot, end);
+        return node;
+    }
+
+    ExpressionNode* createRegExp(const JSTokenLocation& location, const Identifier& pattern, const Identifier& flags, const JSTextPosition& start)
+    {
+        if (Yarr::checkSyntax(pattern.string(), flags.string()))
+            return 0;
+        RegExpNode* node = new (m_parserArena) RegExpNode(location, pattern, flags);
+        int size = pattern.length() + 2; // + 2 for the two /'s
+        JSTextPosition end = start + size;
+        setExceptionLocation(node, start, end, end);
+        return node;
+    }
+
+    ExpressionNode* createNewExpr(const JSTokenLocation& location, ExpressionNode* expr, ArgumentsNode* arguments, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+    {
+        NewExprNode* node = new (m_parserArena) NewExprNode(location, expr, arguments);
+        setExceptionLocation(node, start, divot, end);
+        return node;
+    }
+
+    ExpressionNode* createNewExpr(const JSTokenLocation& location, ExpressionNode* expr, const JSTextPosition& start, const JSTextPosition& end)
+    {
+        NewExprNode* node = new (m_parserArena) NewExprNode(location, expr);
+        setExceptionLocation(node, start, end, end);
+        return node;
+    }
+
+    ExpressionNode* createConditionalExpr(const JSTokenLocation& location, ExpressionNode* condition, ExpressionNode* lhs, ExpressionNode* rhs)
+    {
+        return new (m_parserArena) ConditionalNode(location, condition, lhs, rhs);
+    }
+
+    ExpressionNode* createAssignResolve(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* rhs, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end, AssignmentContext assignmentContext)
+    {
+        if (rhs->isBaseFuncExprNode()) {
+            auto metadata = static_cast<BaseFuncExprNode*>(rhs)->metadata();
+            metadata->setEcmaName(ident);
+            metadata->setInferredName(ident);
+        } else if (rhs->isClassExprNode())
+            static_cast<ClassExprNode*>(rhs)->setEcmaName(ident);
+        AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, ident, rhs, assignmentContext);
+        setExceptionLocation(node, start, divot, end);
+        return node;
+    }
+
+    YieldExprNode* createYield(const JSTokenLocation& location)
+    {
+        return new (m_parserArena) YieldExprNode(location, nullptr, /* delegate */ false);
+    }
+
+    YieldExprNode* createYield(const JSTokenLocation& location, ExpressionNode* argument, bool delegate, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+    {
+        YieldExprNode* node = new (m_parserArena) YieldExprNode(location, argument, delegate);
+        setExceptionLocation(node, start, divot, end);
+        return node;
+    }
+
+    AwaitExprNode* createAwait(const JSTokenLocation& location, ExpressionNode* argument, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+    {
+        ASSERT(argument);
+        AwaitExprNode* node = new (m_parserArena) AwaitExprNode(location, argument);
+        setExceptionLocation(node, start, divot, end);
+        return node;
+    }
+
+    ClassExprNode* createClassExpr(const JSTokenLocation& location, const ParserClassInfo<ASTBuilder>& classInfo, VariableEnvironment& classEnvironment, ExpressionNode* constructor,
+        ExpressionNode* parentClass, PropertyListNode* instanceMethods, PropertyListNode* staticMethods)
+    {
+        SourceCode source = m_sourceCode->subExpression(classInfo.startOffset, classInfo.endOffset, classInfo.startLine, classInfo.startColumn);
+        return new (m_parserArena) ClassExprNode(location, *classInfo.className, source, classEnvironment, constructor, parentClass, instanceMethods, staticMethods);
+    }
+
+    ExpressionNode* createFunctionExpr(const JSTokenLocation& location, const ParserFunctionInfo<ASTBuilder>& functionInfo)
+    {
+        FuncExprNode* result = new (m_parserArena) FuncExprNode(location, *functionInfo.name, functionInfo.body,
+            m_sourceCode->subExpression(functionInfo.startOffset, functionInfo.endOffset, functionInfo.startLine, functionInfo.parametersStartColumn));
+        functionInfo.body->setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    ExpressionNode* createGeneratorFunctionBody(const JSTokenLocation& location, const ParserFunctionInfo<ASTBuilder>& functionInfo, const Identifier& name)
+    {
+        FuncExprNode* result = static_cast<FuncExprNode*>(createFunctionExpr(location, functionInfo));
+        if (!name.isNull())
+            result->metadata()->setInferredName(name);
+        return result;
+    }
+
+    ExpressionNode* createAsyncFunctionBody(const JSTokenLocation& location, const ParserFunctionInfo<ASTBuilder>& functionInfo, SourceParseMode parseMode)
+    {
+        if (parseMode == SourceParseMode::AsyncArrowFunctionBodyMode) {
+            SourceCode source = m_sourceCode->subExpression(functionInfo.startOffset, functionInfo.body->isArrowFunctionBodyExpression() ? functionInfo.endOffset - 1 : functionInfo.endOffset, functionInfo.startLine, functionInfo.parametersStartColumn);
+            FuncExprNode* result = new (m_parserArena) FuncExprNode(location, *functionInfo.name, functionInfo.body, source);
+            functionInfo.body->setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
+            return result;
+        }
+        return createFunctionExpr(location, functionInfo);
+    }
+
+    ExpressionNode* createMethodDefinition(const JSTokenLocation& location, const ParserFunctionInfo<ASTBuilder>& functionInfo)
+    {
+        MethodDefinitionNode* result = new (m_parserArena) MethodDefinitionNode(location, *functionInfo.name, functionInfo.body,
+            m_sourceCode->subExpression(functionInfo.startOffset, functionInfo.endOffset, functionInfo.startLine, functionInfo.parametersStartColumn));
+        functionInfo.body->setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+    
+    FunctionMetadataNode* createFunctionMetadata(
+        const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, 
+        unsigned startColumn, unsigned endColumn, int functionKeywordStart, 
+        int functionNameStart, int parametersStart, bool inStrictContext, 
+        ConstructorKind constructorKind, SuperBinding superBinding,
+        unsigned parameterCount, unsigned functionLength,
+        SourceParseMode mode, bool isArrowFunctionBodyExpression)
+    {
+        return new (m_parserArena) FunctionMetadataNode(
+            m_parserArena, startLocation, endLocation, startColumn, endColumn, 
+            functionKeywordStart, functionNameStart, parametersStart, 
+            inStrictContext, constructorKind, superBinding,
+            parameterCount, functionLength, mode, isArrowFunctionBodyExpression);
+    }
+
+    ExpressionNode* createArrowFunctionExpr(const JSTokenLocation& location, const ParserFunctionInfo<ASTBuilder>& functionInfo)
+    {
+        usesArrowFunction();
+        SourceCode source = m_sourceCode->subExpression(functionInfo.startOffset, functionInfo.body->isArrowFunctionBodyExpression() ? functionInfo.endOffset - 1 : functionInfo.endOffset, functionInfo.startLine, functionInfo.parametersStartColumn);
+        ArrowFuncExprNode* result = new (m_parserArena) ArrowFuncExprNode(location, *functionInfo.name, functionInfo.body, source);
+        functionInfo.body->setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    NEVER_INLINE PropertyNode* createGetterOrSetterProperty(const JSTokenLocation& location, PropertyNode::Type type, bool,
+        const Identifier* name, const ParserFunctionInfo<ASTBuilder>& functionInfo, bool isClassProperty)
+    {
+        ASSERT(name);
+        functionInfo.body->setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
+        functionInfo.body->setEcmaName(*name);
+        functionInfo.body->setInferredName(*name);
+        SourceCode source = m_sourceCode->subExpression(functionInfo.startOffset, functionInfo.endOffset, functionInfo.startLine, functionInfo.parametersStartColumn);
+        MethodDefinitionNode* methodDef = new (m_parserArena) MethodDefinitionNode(location, m_vm->propertyNames->nullIdentifier, functionInfo.body, source);
+        return new (m_parserArena) PropertyNode(*name, methodDef, type, PropertyNode::Unknown, SuperBinding::Needed, isClassProperty);
+    }
+
+    NEVER_INLINE PropertyNode* createGetterOrSetterProperty(const JSTokenLocation& location, PropertyNode::Type type, bool,
+        ExpressionNode* name, const ParserFunctionInfo<ASTBuilder>& functionInfo, bool isClassProperty)
+    {
+        ASSERT(name);
+        functionInfo.body->setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
+        SourceCode source = m_sourceCode->subExpression(functionInfo.startOffset, functionInfo.endOffset, functionInfo.startLine, functionInfo.parametersStartColumn);
+        MethodDefinitionNode* methodDef = new (m_parserArena) MethodDefinitionNode(location, m_vm->propertyNames->nullIdentifier, functionInfo.body, source);
+        return new (m_parserArena) PropertyNode(name, methodDef, type, PropertyNode::Unknown, SuperBinding::Needed, isClassProperty);
+    }
+
+    NEVER_INLINE PropertyNode* createGetterOrSetterProperty(VM* vm, ParserArena& parserArena, const JSTokenLocation& location, PropertyNode::Type type, bool,
+        double name, const ParserFunctionInfo<ASTBuilder>& functionInfo, bool isClassProperty)
+    {
+        functionInfo.body->setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
+        const Identifier& ident = parserArena.identifierArena().makeNumericIdentifier(vm, name);
+        SourceCode source = m_sourceCode->subExpression(functionInfo.startOffset, functionInfo.endOffset, functionInfo.startLine, functionInfo.parametersStartColumn);
+        MethodDefinitionNode* methodDef = new (m_parserArena) MethodDefinitionNode(location, vm->propertyNames->nullIdentifier, functionInfo.body, source);
+        return new (m_parserArena) PropertyNode(ident, methodDef, type, PropertyNode::Unknown, SuperBinding::Needed, isClassProperty);
+    }
+
+    ArgumentsNode* createArguments() { return new (m_parserArena) ArgumentsNode(); }
+    ArgumentsNode* createArguments(ArgumentListNode* args) { return new (m_parserArena) ArgumentsNode(args); }
+    ArgumentListNode* createArgumentsList(const JSTokenLocation& location, ExpressionNode* arg) { return new (m_parserArena) ArgumentListNode(location, arg); }
+    ArgumentListNode* createArgumentsList(const JSTokenLocation& location, ArgumentListNode* args, ExpressionNode* arg) { return new (m_parserArena) ArgumentListNode(location, args, arg); }
+
+    PropertyNode* createProperty(const Identifier* propertyName, ExpressionNode* node, PropertyNode::Type type, PropertyNode::PutType putType, bool, SuperBinding superBinding, bool isClassProperty)
+    {
+        if (node->isBaseFuncExprNode()) {
+            auto metadata = static_cast<BaseFuncExprNode*>(node)->metadata();
+            metadata->setEcmaName(*propertyName);
+            metadata->setInferredName(*propertyName);
+        } else if (node->isClassExprNode())
+            static_cast<ClassExprNode*>(node)->setEcmaName(*propertyName);
+        return new (m_parserArena) PropertyNode(*propertyName, node, type, putType, superBinding, isClassProperty);
+    }
+    PropertyNode* createProperty(VM* vm, ParserArena& parserArena, double propertyName, ExpressionNode* node, PropertyNode::Type type, PropertyNode::PutType putType, bool, SuperBinding superBinding, bool isClassProperty)
+    {
+        return new (m_parserArena) PropertyNode(parserArena.identifierArena().makeNumericIdentifier(vm, propertyName), node, type, putType, superBinding, isClassProperty);
+    }
+    PropertyNode* createProperty(ExpressionNode* propertyName, ExpressionNode* node, PropertyNode::Type type, PropertyNode::PutType putType, bool, SuperBinding superBinding, bool isClassProperty) { return new (m_parserArena) PropertyNode(propertyName, node, type, putType, superBinding, isClassProperty); }
+    PropertyListNode* createPropertyList(const JSTokenLocation& location, PropertyNode* property) { return new (m_parserArena) PropertyListNode(location, property); }
+    PropertyListNode* createPropertyList(const JSTokenLocation& location, PropertyNode* property, PropertyListNode* tail) { return new (m_parserArena) PropertyListNode(location, property, tail); }
+
+    ElementNode* createElementList(int elisions, ExpressionNode* expr) { return new (m_parserArena) ElementNode(elisions, expr); }
+    ElementNode* createElementList(ElementNode* elems, int elisions, ExpressionNode* expr) { return new (m_parserArena) ElementNode(elems, elisions, expr); }
+    ElementNode* createElementList(ArgumentListNode* elems)
+    {
+        ElementNode* head = new (m_parserArena) ElementNode(0, elems->m_expr);
+        ElementNode* tail = head;
+        elems = elems->m_next;
+        while (elems) {
+            tail = new (m_parserArena) ElementNode(tail, 0, elems->m_expr);
+            elems = elems->m_next;
+        }
+        return head;
+    }
+
+    FormalParameterList createFormalParameterList() { return new (m_parserArena) FunctionParameters(); }
+    void appendParameter(FormalParameterList list, DestructuringPattern pattern, ExpressionNode* defaultValue) 
+    { 
+        list->append(pattern, defaultValue); 
+        tryInferNameInPattern(pattern, defaultValue);
+    }
+
+    CaseClauseNode* createClause(ExpressionNode* expr, JSC::SourceElements* statements) { return new (m_parserArena) CaseClauseNode(expr, statements); }
+    ClauseListNode* createClauseList(CaseClauseNode* clause) { return new (m_parserArena) ClauseListNode(clause); }
+    ClauseListNode* createClauseList(ClauseListNode* tail, CaseClauseNode* clause) { return new (m_parserArena) ClauseListNode(tail, clause); }
+
+    StatementNode* createFuncDeclStatement(const JSTokenLocation& location, const ParserFunctionInfo<ASTBuilder>& functionInfo)
+    {
+        FuncDeclNode* decl = new (m_parserArena) FuncDeclNode(location, *functionInfo.name, functionInfo.body,
+            m_sourceCode->subExpression(functionInfo.startOffset, functionInfo.endOffset, functionInfo.startLine, functionInfo.parametersStartColumn));
+        if (*functionInfo.name == m_vm->propertyNames->arguments)
+            usesArguments();
+        functionInfo.body->setLoc(functionInfo.startLine, functionInfo.endLine, location.startOffset, location.lineStartOffset);
+        return decl;
+    }
+
+    StatementNode* createClassDeclStatement(const JSTokenLocation& location, ClassExprNode* classExpression,
+        const JSTextPosition& classStart, const JSTextPosition& classEnd, unsigned startLine, unsigned endLine)
+    {
+        ExpressionNode* assign = createAssignResolve(location, classExpression->name(), classExpression, classStart, classStart + 1, classEnd, AssignmentContext::DeclarationStatement);
+        ClassDeclNode* decl = new (m_parserArena) ClassDeclNode(location, assign);
+        decl->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
+        return decl;
+    }
+
+    StatementNode* createBlockStatement(const JSTokenLocation& location, JSC::SourceElements* elements, int startLine, int endLine, VariableEnvironment& lexicalVariables, DeclarationStacks::FunctionStack&& functionStack)
+    {
+        BlockNode* block = new (m_parserArena) BlockNode(location, elements, lexicalVariables, WTFMove(functionStack));
+        block->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
+        return block;
+    }
+
+    StatementNode* createExprStatement(const JSTokenLocation& location, ExpressionNode* expr, const JSTextPosition& start, int end)
+    {
+        ExprStatementNode* result = new (m_parserArena) ExprStatementNode(location, expr);
+        result->setLoc(start.line, end, start.offset, start.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createIfStatement(const JSTokenLocation& location, ExpressionNode* condition, StatementNode* trueBlock, StatementNode* falseBlock, int start, int end)
+    {
+        IfElseNode* result = new (m_parserArena) IfElseNode(location, condition, trueBlock, falseBlock);
+        result->setLoc(start, end, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createForLoop(const JSTokenLocation& location, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end, VariableEnvironment& lexicalVariables)
+    {
+        ForNode* result = new (m_parserArena) ForNode(location, initializer, condition, iter, statements, lexicalVariables);
+        result->setLoc(start, end, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createForInLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTokenLocation&, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, VariableEnvironment& lexicalVariables)
+    {
+        ForInNode* result = new (m_parserArena) ForInNode(location, lhs, iter, statements, lexicalVariables);
+        result->setLoc(start, end, location.startOffset, location.lineStartOffset);
+        setExceptionLocation(result, eStart, eDivot, eEnd);
+        return result;
+    }
+    
+    StatementNode* createForInLoop(const JSTokenLocation& location, DestructuringPatternNode* pattern, ExpressionNode* iter, StatementNode* statements, const JSTokenLocation& declLocation, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, VariableEnvironment& lexicalVariables)
+    {
+        auto lexpr = new (m_parserArena) DestructuringAssignmentNode(declLocation, pattern, nullptr);
+        return createForInLoop(location, lexpr, iter, statements, declLocation, eStart, eDivot, eEnd, start, end, lexicalVariables);
+    }
+    
+    StatementNode* createForOfLoop(const JSTokenLocation& location, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, const JSTokenLocation&, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, VariableEnvironment& lexicalVariables)
+    {
+        ForOfNode* result = new (m_parserArena) ForOfNode(location, lhs, iter, statements, lexicalVariables);
+        result->setLoc(start, end, location.startOffset, location.lineStartOffset);
+        setExceptionLocation(result, eStart, eDivot, eEnd);
+        return result;
+    }
+    
+    StatementNode* createForOfLoop(const JSTokenLocation& location, DestructuringPatternNode* pattern, ExpressionNode* iter, StatementNode* statements, const JSTokenLocation& declLocation, const JSTextPosition& eStart, const JSTextPosition& eDivot, const JSTextPosition& eEnd, int start, int end, VariableEnvironment& lexicalVariables)
+    {
+        auto lexpr = new (m_parserArena) DestructuringAssignmentNode(declLocation, pattern, nullptr);
+        return createForOfLoop(location, lexpr, iter, statements, declLocation, eStart, eDivot, eEnd, start, end, lexicalVariables);
+    }
+
+    bool isBindingNode(const DestructuringPattern& pattern)
+    {
+        return pattern->isBindingNode();
+    }
+
+    bool isAssignmentLocation(const Expression& pattern)
+    {
+        return pattern->isAssignmentLocation();
+    }
+
+    bool isObjectLiteral(const Expression& node)
+    {
+        return node->isObjectLiteral();
+    }
+
+    bool isArrayLiteral(const Expression& node)
+    {
+        return node->isArrayLiteral();
+    }
+
+    bool isObjectOrArrayLiteral(const Expression& node)
+    {
+        return isObjectLiteral(node) || isArrayLiteral(node);
+    }
+
+    bool shouldSkipPauseLocation(StatementNode* statement) const
+    {
+        return !statement || statement->isLabel();
+    }
+
+    StatementNode* createEmptyStatement(const JSTokenLocation& location) { return new (m_parserArena) EmptyStatementNode(location); }
+
+    StatementNode* createDeclarationStatement(const JSTokenLocation& location, ExpressionNode* expr, int start, int end)
+    {
+        StatementNode* result;
+        result = new (m_parserArena) DeclarationStatement(location, expr);
+        result->setLoc(start, end, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    ExpressionNode* createEmptyVarExpression(const JSTokenLocation& location, const Identifier& identifier)
+    {
+        return new (m_parserArena) EmptyVarExpression(location, identifier);
+    }
+
+    ExpressionNode* createEmptyLetExpression(const JSTokenLocation& location, const Identifier& identifier)
+    {
+        return new (m_parserArena) EmptyLetExpression(location, identifier);
+    }
+
+    StatementNode* createReturnStatement(const JSTokenLocation& location, ExpressionNode* expression, const JSTextPosition& start, const JSTextPosition& end)
+    {
+        ReturnNode* result = new (m_parserArena) ReturnNode(location, expression);
+        setExceptionLocation(result, start, end, end);
+        result->setLoc(start.line, end.line, start.offset, start.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createBreakStatement(const JSTokenLocation& location, const Identifier* ident, const JSTextPosition& start, const JSTextPosition& end)
+    {
+        BreakNode* result = new (m_parserArena) BreakNode(location, *ident);
+        setExceptionLocation(result, start, end, end);
+        result->setLoc(start.line, end.line, start.offset, start.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createContinueStatement(const JSTokenLocation& location, const Identifier* ident, const JSTextPosition& start, const JSTextPosition& end)
+    {
+        ContinueNode* result = new (m_parserArena) ContinueNode(location, *ident);
+        setExceptionLocation(result, start, end, end);
+        result->setLoc(start.line, end.line, start.offset, start.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createTryStatement(const JSTokenLocation& location, StatementNode* tryBlock, DestructuringPatternNode* catchPattern, StatementNode* catchBlock, StatementNode* finallyBlock, int startLine, int endLine, VariableEnvironment& catchEnvironment)
+    {
+        TryNode* result = new (m_parserArena) TryNode(location, tryBlock, catchPattern, catchBlock, catchEnvironment, finallyBlock);
+        result->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createSwitchStatement(const JSTokenLocation& location, ExpressionNode* expr, ClauseListNode* firstClauses, CaseClauseNode* defaultClause, ClauseListNode* secondClauses, int startLine, int endLine, VariableEnvironment& lexicalVariables, DeclarationStacks::FunctionStack&& functionStack)
+    {
+        CaseBlockNode* cases = new (m_parserArena) CaseBlockNode(firstClauses, defaultClause, secondClauses);
+        SwitchNode* result = new (m_parserArena) SwitchNode(location, expr, cases, lexicalVariables, WTFMove(functionStack));
+        result->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createWhileStatement(const JSTokenLocation& location, ExpressionNode* expr, StatementNode* statement, int startLine, int endLine)
+    {
+        WhileNode* result = new (m_parserArena) WhileNode(location, expr, statement);
+        result->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createDoWhileStatement(const JSTokenLocation& location, StatementNode* statement, ExpressionNode* expr, int startLine, int endLine)
+    {
+        DoWhileNode* result = new (m_parserArena) DoWhileNode(location, statement, expr);
+        result->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    StatementNode* createLabelStatement(const JSTokenLocation& location, const Identifier* ident, StatementNode* statement, const JSTextPosition& start, const JSTextPosition& end)
+    {
+        LabelNode* result = new (m_parserArena) LabelNode(location, *ident, statement);
+        setExceptionLocation(result, start, end, end);
+        return result;
+    }
+
+    StatementNode* createWithStatement(const JSTokenLocation& location, ExpressionNode* expr, StatementNode* statement, unsigned start, const JSTextPosition& end, unsigned startLine, unsigned endLine)
+    {
+        usesWith();
+        WithNode* result = new (m_parserArena) WithNode(location, expr, statement, end, end - start);
+        result->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }    
+    
+    StatementNode* createThrowStatement(const JSTokenLocation& location, ExpressionNode* expr, const JSTextPosition& start, const JSTextPosition& end)
+    {
+        ThrowNode* result = new (m_parserArena) ThrowNode(location, expr);
+        result->setLoc(start.line, end.line, start.offset, start.lineStartOffset);
+        setExceptionLocation(result, start, end, end);
+        return result;
+    }
+    
+    StatementNode* createDebugger(const JSTokenLocation& location, int startLine, int endLine)
+    {
+        DebuggerStatementNode* result = new (m_parserArena) DebuggerStatementNode(location);
+        result->setLoc(startLine, endLine, location.startOffset, location.lineStartOffset);
+        return result;
+    }
+
+    ModuleNameNode* createModuleName(const JSTokenLocation& location, const Identifier& moduleName)
+    {
+        return new (m_parserArena) ModuleNameNode(location, moduleName);
+    }
+
+    ImportSpecifierNode* createImportSpecifier(const JSTokenLocation& location, const Identifier& importedName, const Identifier& localName)
+    {
+        return new (m_parserArena) ImportSpecifierNode(location, importedName, localName);
+    }
+
+    ImportSpecifierListNode* createImportSpecifierList()
+    {
+        return new (m_parserArena) ImportSpecifierListNode();
+    }
+
+    void appendImportSpecifier(ImportSpecifierListNode* specifierList, ImportSpecifierNode* specifier)
+    {
+        specifierList->append(specifier);
+    }
+
+    StatementNode* createImportDeclaration(const JSTokenLocation& location, ImportSpecifierListNode* importSpecifierList, ModuleNameNode* moduleName)
+    {
+        return new (m_parserArena) ImportDeclarationNode(location, importSpecifierList, moduleName);
+    }
+
+    StatementNode* createExportAllDeclaration(const JSTokenLocation& location, ModuleNameNode* moduleName)
+    {
+        return new (m_parserArena) ExportAllDeclarationNode(location, moduleName);
+    }
+
+    StatementNode* createExportDefaultDeclaration(const JSTokenLocation& location, StatementNode* declaration, const Identifier& localName)
+    {
+        return new (m_parserArena) ExportDefaultDeclarationNode(location, declaration, localName);
+    }
+
+    StatementNode* createExportLocalDeclaration(const JSTokenLocation& location, StatementNode* declaration)
+    {
+        return new (m_parserArena) ExportLocalDeclarationNode(location, declaration);
+    }
+
+    StatementNode* createExportNamedDeclaration(const JSTokenLocation& location, ExportSpecifierListNode* exportSpecifierList, ModuleNameNode* moduleName)
+    {
+        return new (m_parserArena) ExportNamedDeclarationNode(location, exportSpecifierList, moduleName);
+    }
+
+    ExportSpecifierNode* createExportSpecifier(const JSTokenLocation& location, const Identifier& localName, const Identifier& exportedName)
+    {
+        return new (m_parserArena) ExportSpecifierNode(location, localName, exportedName);
+    }
+
+    ExportSpecifierListNode* createExportSpecifierList()
+    {
+        return new (m_parserArena) ExportSpecifierListNode();
+    }
+
+    void appendExportSpecifier(ExportSpecifierListNode* specifierList, ExportSpecifierNode* specifier)
+    {
+        specifierList->append(specifier);
+    }
+
+    void appendStatement(JSC::SourceElements* elements, JSC::StatementNode* statement)
+    {
+        elements->append(statement);
+    }
+
+    CommaNode* createCommaExpr(const JSTokenLocation& location, ExpressionNode* node)
+    {
+        return new (m_parserArena) CommaNode(location, node);
+    }
+
+    CommaNode* appendToCommaExpr(const JSTokenLocation& location, ExpressionNode*, ExpressionNode* tail, ExpressionNode* next)
+    {
+        ASSERT(tail->isCommaNode());
+        ASSERT(next);
+        CommaNode* newTail = new (m_parserArena) CommaNode(location, next);
+        static_cast<CommaNode*>(tail)->setNext(newTail);
+        return newTail;
+    }
+
+    int evalCount() const { return m_evalCount; }
+
+    void appendBinaryExpressionInfo(int& operandStackDepth, ExpressionNode* current, const JSTextPosition& exprStart, const JSTextPosition& lhs, const JSTextPosition& rhs, bool hasAssignments)
+    {
+        operandStackDepth++;
+        m_binaryOperandStack.append(std::make_pair(current, BinaryOpInfo(exprStart, lhs, rhs, hasAssignments)));
+    }
+
+    // Logic to handle datastructures used during parsing of binary expressions
+    void operatorStackPop(int& operatorStackDepth)
+    {
+        operatorStackDepth--;
+        m_binaryOperatorStack.removeLast();
+    }
+    bool operatorStackShouldReduce(int precedence)
+    {
+        // If the current precedence of the operator stack is the same to the one of the given operator,
+        // it depends on the associative whether we reduce the stack.
+        // If the operator is right associative, we should not reduce the stack right now.
+        if (precedence == m_binaryOperatorStack.last().second)
+            return !(m_binaryOperatorStack.last().first & RightAssociativeBinaryOpTokenFlag);
+        return precedence < m_binaryOperatorStack.last().second;
+    }
+    const BinaryOperand& getFromOperandStack(int i) { return m_binaryOperandStack[m_binaryOperandStack.size() + i]; }
+    void shrinkOperandStackBy(int& operandStackDepth, int amount)
+    {
+        operandStackDepth -= amount;
+        ASSERT(operandStackDepth >= 0);
+        m_binaryOperandStack.resize(m_binaryOperandStack.size() - amount);
+    }
+    void appendBinaryOperation(const JSTokenLocation& location, int& operandStackDepth, int&, const BinaryOperand& lhs, const BinaryOperand& rhs)
+    {
+        operandStackDepth++;
+        m_binaryOperandStack.append(std::make_pair(makeBinaryNode(location, m_binaryOperatorStack.last().first, lhs, rhs), BinaryOpInfo(lhs.second, rhs.second)));
+    }
+    void operatorStackAppend(int& operatorStackDepth, int op, int precedence)
+    {
+        operatorStackDepth++;
+        m_binaryOperatorStack.append(std::make_pair(op, precedence));
+    }
+    ExpressionNode* popOperandStack(int&)
+    {
+        ExpressionNode* result = m_binaryOperandStack.last().first;
+        m_binaryOperandStack.removeLast();
+        return result;
+    }
+    
+    void appendUnaryToken(int& tokenStackDepth, int type, const JSTextPosition& start)
+    {
+        tokenStackDepth++;
+        m_unaryTokenStack.append(std::make_pair(type, start));
+    }
+
+    int unaryTokenStackLastType(int&)
+    {
+        return m_unaryTokenStack.last().first;
+    }
+    
+    const JSTextPosition& unaryTokenStackLastStart(int&)
+    {
+        return m_unaryTokenStack.last().second;
+    }
+    
+    void unaryTokenStackRemoveLast(int& tokenStackDepth)
+    {
+        tokenStackDepth--;
+        m_unaryTokenStack.removeLast();
+    }
+    
+    void assignmentStackAppend(int& assignmentStackDepth, ExpressionNode* node, const JSTextPosition& start, const JSTextPosition& divot, int assignmentCount, Operator op)
+    {
+        assignmentStackDepth++;
+        ASSERT(start.offset >= start.lineStartOffset);
+        ASSERT(divot.offset >= divot.lineStartOffset);
+        m_assignmentInfoStack.append(AssignmentInfo(node, start, divot, assignmentCount, op));
+    }
+
+    ExpressionNode* createAssignment(const JSTokenLocation& location, int& assignmentStackDepth, ExpressionNode* rhs, int initialAssignmentCount, int currentAssignmentCount, const JSTextPosition& lastTokenEnd)
+    {
+        AssignmentInfo& info = m_assignmentInfoStack.last();
+        ExpressionNode* result = makeAssignNode(location, info.m_node, info.m_op, rhs, info.m_initAssignments != initialAssignmentCount, info.m_initAssignments != currentAssignmentCount, info.m_start, info.m_divot + 1, lastTokenEnd);
+        m_assignmentInfoStack.removeLast();
+        assignmentStackDepth--;
+        return result;
+    }
+
+    const Identifier* getName(const Property& property) const { return property->name(); }
+    PropertyNode::Type getType(const Property& property) const { return property->type(); }
+
+    bool isResolve(ExpressionNode* expr) const { return expr->isResolveNode(); }
+
+    ExpressionNode* createDestructuringAssignment(const JSTokenLocation& location, DestructuringPattern pattern, ExpressionNode* initializer)
+    {
+        return new (m_parserArena) DestructuringAssignmentNode(location, pattern, initializer);
+    }
+    
+    ArrayPattern createArrayPattern(const JSTokenLocation&)
+    {
+        return new (m_parserArena) ArrayPatternNode();
+    }
+    
+    void appendArrayPatternSkipEntry(ArrayPattern node, const JSTokenLocation& location)
+    {
+        node->appendIndex(ArrayPatternNode::BindingType::Elision, location, 0, nullptr);
+    }
+
+    void appendArrayPatternEntry(ArrayPattern node, const JSTokenLocation& location, DestructuringPattern pattern, ExpressionNode* defaultValue)
+    {
+        node->appendIndex(ArrayPatternNode::BindingType::Element, location, pattern, defaultValue);
+        tryInferNameInPattern(pattern, defaultValue);
+    }
+
+    void appendArrayPatternRestEntry(ArrayPattern node, const JSTokenLocation& location, DestructuringPattern pattern)
+    {
+        node->appendIndex(ArrayPatternNode::BindingType::RestElement, location, pattern, nullptr);
+    }
+
+    void finishArrayPattern(ArrayPattern node, const JSTextPosition& divotStart, const JSTextPosition& divot, const JSTextPosition& divotEnd)
+    {
+        setExceptionLocation(node, divotStart, divot, divotEnd);
+    }
+    
+    ObjectPattern createObjectPattern(const JSTokenLocation&)
+    {
+        return new (m_parserArena) ObjectPatternNode();
+    }
+    
+    void appendObjectPatternEntry(ObjectPattern node, const JSTokenLocation& location, bool wasString, const Identifier& identifier, DestructuringPattern pattern, ExpressionNode* defaultValue)
+    {
+        node->appendEntry(location, identifier, wasString, pattern, defaultValue);
+        tryInferNameInPattern(pattern, defaultValue);
+    }
+
+    void appendObjectPatternEntry(ObjectPattern node, const JSTokenLocation& location, ExpressionNode* propertyExpression, DestructuringPattern pattern, ExpressionNode* defaultValue)
+    {
+        node->appendEntry(location, propertyExpression, pattern, defaultValue);
+        tryInferNameInPattern(pattern, defaultValue);
+    }
+
+    BindingPattern createBindingLocation(const JSTokenLocation&, const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, AssignmentContext context)
+    {
+        return new (m_parserArena) BindingNode(boundProperty, start, end, context);
+    }
+
+    RestParameterNode* createRestParameter(DestructuringPatternNode* pattern, size_t numParametersToSkip)
+    {
+        return new (m_parserArena) RestParameterNode(pattern, numParametersToSkip);
+    }
+
+    AssignmentElement createAssignmentElement(const Expression& assignmentTarget, const JSTextPosition& start, const JSTextPosition& end)
+    {
+        return new (m_parserArena) AssignmentElementNode(assignmentTarget, start, end);
+    }
+
+    void setEndOffset(Node* node, int offset)
+    {
+        node->setEndOffset(offset);
+    }
+
+    int endOffset(Node* node)
+    {
+        return node->endOffset();
+    }
+
+    void setStartOffset(CaseClauseNode* node, int offset)
+    {
+        node->setStartOffset(offset);
+    }
+
+    void setStartOffset(Node* node, int offset)
+    {
+        node->setStartOffset(offset);
+    }
+
+    JSTextPosition breakpointLocation(Node* node)
+    {
+        node->setNeedsDebugHook();
+        return node->position();
+    }
+
+    void propagateArgumentsUse() { usesArguments(); }
+    
+private:
+    struct Scope {
+        Scope()
+            : m_features(0)
+            , m_numConstants(0)
+        {
+        }
+        int m_features;
+        int m_numConstants;
+    };
+
+    static void setExceptionLocation(ThrowableExpressionData* node, const JSTextPosition& divotStart, const JSTextPosition& divot, const JSTextPosition& divotEnd)
+    {
+        ASSERT(divot.offset >= divot.lineStartOffset);
+        node->setExceptionSourceCode(divot, divotStart, divotEnd);
+    }
+
+    void incConstants() { m_scope.m_numConstants++; }
+    void usesThis() { m_scope.m_features |= ThisFeature; }
+    void usesArrowFunction() { m_scope.m_features |= ArrowFunctionFeature; }
+    void usesArguments() { m_scope.m_features |= ArgumentsFeature; }
+    void usesWith() { m_scope.m_features |= WithFeature; }
+    void usesSuperCall() { m_scope.m_features |= SuperCallFeature; }
+    void usesSuperProperty() { m_scope.m_features |= SuperPropertyFeature; }
+    void usesEval() 
+    {
+        m_evalCount++;
+        m_scope.m_features |= EvalFeature;
+    }
+    void usesNewTarget() { m_scope.m_features |= NewTargetFeature; }
+    ExpressionNode* createIntegerLikeNumber(const JSTokenLocation& location, double d)
+    {
+        return new (m_parserArena) IntegerNode(location, d);
+    }
+    ExpressionNode* createDoubleLikeNumber(const JSTokenLocation& location, double d)
+    {
+        return new (m_parserArena) DoubleNode(location, d);
+    }
+    ExpressionNode* createNumberFromBinaryOperation(const JSTokenLocation& location, double value, const NumberNode& originalNodeA, const NumberNode& originalNodeB)
+    {
+        if (originalNodeA.isIntegerNode() && originalNodeB.isIntegerNode())
+            return createIntegerLikeNumber(location, value);
+        return createDoubleLikeNumber(location, value);
+    }
+    ExpressionNode* createNumberFromUnaryOperation(const JSTokenLocation& location, double value, const NumberNode& originalNode)
+    {
+        if (originalNode.isIntegerNode())
+            return createIntegerLikeNumber(location, value);
+        return createDoubleLikeNumber(location, value);
+    }
+
+    void tryInferNameInPattern(DestructuringPattern pattern, ExpressionNode* defaultValue)
+    {
+        if (!defaultValue)
+            return;
+
+        if (!pattern->isBindingNode())
+            return;
+
+        const Identifier& ident = static_cast<const BindingNode*>(pattern)->boundProperty();
+
+        if (defaultValue->isBaseFuncExprNode()) {
+            auto metadata = static_cast<BaseFuncExprNode*>(defaultValue)->metadata();
+            metadata->setEcmaName(ident);
+            metadata->setInferredName(ident);
+        } else if (defaultValue->isClassExprNode())
+            static_cast<ClassExprNode*>(defaultValue)->setEcmaName(ident);
+    }
+
+    VM* m_vm;
+    ParserArena& m_parserArena;
+    SourceCode* m_sourceCode;
+    Scope m_scope;
+    Vector<BinaryOperand, 10, UnsafeVectorOverflow> m_binaryOperandStack;
+    Vector<AssignmentInfo, 10, UnsafeVectorOverflow> m_assignmentInfoStack;
+    Vector<std::pair<int, int>, 10, UnsafeVectorOverflow> m_binaryOperatorStack;
+    Vector<std::pair<int, JSTextPosition>, 10, UnsafeVectorOverflow> m_unaryTokenStack;
+    int m_evalCount;
+};
+
+ExpressionNode* ASTBuilder::makeTypeOfNode(const JSTokenLocation& location, ExpressionNode* expr)
+{
+    if (expr->isResolveNode()) {
+        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
+        return new (m_parserArena) TypeOfResolveNode(location, resolve->identifier());
+    }
+    return new (m_parserArena) TypeOfValueNode(location, expr);
+}
+
+ExpressionNode* ASTBuilder::makeDeleteNode(const JSTokenLocation& location, ExpressionNode* expr, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+{
+    if (!expr->isLocation())
+        return new (m_parserArena) DeleteValueNode(location, expr);
+    if (expr->isResolveNode()) {
+        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
+        return new (m_parserArena) DeleteResolveNode(location, resolve->identifier(), divot, start, end);
+    }
+    if (expr->isBracketAccessorNode()) {
+        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
+        return new (m_parserArena) DeleteBracketNode(location, bracket->base(), bracket->subscript(), divot, start, end);
+    }
+    ASSERT(expr->isDotAccessorNode());
+    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
+    return new (m_parserArena) DeleteDotNode(location, dot->base(), dot->identifier(), divot, start, end);
+}
+
+ExpressionNode* ASTBuilder::makeNegateNode(const JSTokenLocation& location, ExpressionNode* n)
+{
+    if (n->isNumber()) {
+        const NumberNode& numberNode = static_cast<const NumberNode&>(*n);
+        return createNumberFromUnaryOperation(location, -numberNode.value(), numberNode);
+    }
+
+    return new (m_parserArena) NegateNode(location, n);
+}
+
+ExpressionNode* ASTBuilder::makeBitwiseNotNode(const JSTokenLocation& location, ExpressionNode* expr)
+{
+    if (expr->isNumber())
+        return createIntegerLikeNumber(location, ~toInt32(static_cast<NumberNode*>(expr)->value()));
+    return new (m_parserArena) BitwiseNotNode(location, expr);
+}
+
+ExpressionNode* ASTBuilder::makePowNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    auto* strippedExpr1 = expr1->stripUnaryPlus();
+    auto* strippedExpr2 = expr2->stripUnaryPlus();
+
+    if (strippedExpr1->isNumber() && strippedExpr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*strippedExpr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*strippedExpr2);
+        return createNumberFromBinaryOperation(location, operationMathPow(numberExpr1.value(), numberExpr2.value()), numberExpr1, numberExpr2);
+    }
+
+    if (strippedExpr1->isNumber())
+        expr1 = strippedExpr1;
+    if (strippedExpr2->isNumber())
+        expr2 = strippedExpr2;
+
+    return new (m_parserArena) PowNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeMultNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    // FIXME: Unary + change the evaluation order.
+    // https://bugs.webkit.org/show_bug.cgi?id=159968
+    expr1 = expr1->stripUnaryPlus();
+    expr2 = expr2->stripUnaryPlus();
+
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createNumberFromBinaryOperation(location, numberExpr1.value() * numberExpr2.value(), numberExpr1, numberExpr2);
+    }
+
+    if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
+        return new (m_parserArena) UnaryPlusNode(location, expr2);
+
+    if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
+        return new (m_parserArena) UnaryPlusNode(location, expr1);
+
+    return new (m_parserArena) MultNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeDivNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    // FIXME: Unary + change the evaluation order.
+    // https://bugs.webkit.org/show_bug.cgi?id=159968
+    expr1 = expr1->stripUnaryPlus();
+    expr2 = expr2->stripUnaryPlus();
+
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        double result = numberExpr1.value() / numberExpr2.value();
+        if (static_cast<int64_t>(result) == result)
+            return createNumberFromBinaryOperation(location, result, numberExpr1, numberExpr2);
+        return createDoubleLikeNumber(location, result);
+    }
+    return new (m_parserArena) DivNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeModNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    // FIXME: Unary + change the evaluation order.
+    // https://bugs.webkit.org/show_bug.cgi?id=159968
+    expr1 = expr1->stripUnaryPlus();
+    expr2 = expr2->stripUnaryPlus();
+
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createIntegerLikeNumber(location, fmod(numberExpr1.value(), numberExpr2.value()));
+    }
+    return new (m_parserArena) ModNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeAddNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createNumberFromBinaryOperation(location, numberExpr1.value() + numberExpr2.value(), numberExpr1, numberExpr2);
+    }
+    return new (m_parserArena) AddNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeSubNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    // FIXME: Unary + change the evaluation order.
+    // https://bugs.webkit.org/show_bug.cgi?id=159968
+    expr1 = expr1->stripUnaryPlus();
+    expr2 = expr2->stripUnaryPlus();
+
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createNumberFromBinaryOperation(location, numberExpr1.value() - numberExpr2.value(), numberExpr1, numberExpr2);
+    }
+    return new (m_parserArena) SubNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeLeftShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createIntegerLikeNumber(location, toInt32(numberExpr1.value()) << (toUInt32(numberExpr2.value()) & 0x1f));
+    }
+    return new (m_parserArena) LeftShiftNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeRightShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createIntegerLikeNumber(location, toInt32(numberExpr1.value()) >> (toUInt32(numberExpr2.value()) & 0x1f));
+    }
+    return new (m_parserArena) RightShiftNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeURightShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createIntegerLikeNumber(location, toUInt32(numberExpr1.value()) >> (toUInt32(numberExpr2.value()) & 0x1f));
+    }
+    return new (m_parserArena) UnsignedRightShiftNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeBitOrNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createIntegerLikeNumber(location, toInt32(numberExpr1.value()) | toInt32(numberExpr2.value()));
+    }
+    return new (m_parserArena) BitOrNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeBitAndNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createIntegerLikeNumber(location, toInt32(numberExpr1.value()) & toInt32(numberExpr2.value()));
+    }
+    return new (m_parserArena) BitAndNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeBitXOrNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+{
+    if (expr1->isNumber() && expr2->isNumber()) {
+        const NumberNode& numberExpr1 = static_cast<NumberNode&>(*expr1);
+        const NumberNode& numberExpr2 = static_cast<NumberNode&>(*expr2);
+        return createIntegerLikeNumber(location, toInt32(numberExpr1.value()) ^ toInt32(numberExpr2.value()));
+    }
+    return new (m_parserArena) BitXOrNode(location, expr1, expr2, rightHasAssignments);
+}
+
+ExpressionNode* ASTBuilder::makeFunctionCallNode(const JSTokenLocation& location, ExpressionNode* func, ArgumentsNode* args, const JSTextPosition& divotStart, const JSTextPosition& divot, const JSTextPosition& divotEnd)
+{
+    ASSERT(divot.offset >= divot.lineStartOffset);
+    if (func->isSuperNode())
+        usesSuperCall();
+
+    if (func->isBytecodeIntrinsicNode()) {
+        BytecodeIntrinsicNode* intrinsic = static_cast<BytecodeIntrinsicNode*>(func);
+        if (intrinsic->type() == BytecodeIntrinsicNode::Type::Constant)
+            return new (m_parserArena) BytecodeIntrinsicNode(BytecodeIntrinsicNode::Type::Function, location, intrinsic->emitter(), intrinsic->identifier(), args, divot, divotStart, divotEnd);
+    }
+    if (!func->isLocation())
+        return new (m_parserArena) FunctionCallValueNode(location, func, args, divot, divotStart, divotEnd);
+    if (func->isResolveNode()) {
+        ResolveNode* resolve = static_cast<ResolveNode*>(func);
+        const Identifier& identifier = resolve->identifier();
+        if (identifier == m_vm->propertyNames->eval) {
+            usesEval();
+            return new (m_parserArena) EvalFunctionCallNode(location, args, divot, divotStart, divotEnd);
+        }
+        return new (m_parserArena) FunctionCallResolveNode(location, identifier, args, divot, divotStart, divotEnd);
+    }
+    if (func->isBracketAccessorNode()) {
+        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func);
+        FunctionCallBracketNode* node = new (m_parserArena) FunctionCallBracketNode(location, bracket->base(), bracket->subscript(), bracket->subscriptHasAssignments(), args, divot, divotStart, divotEnd);
+        node->setSubexpressionInfo(bracket->divot(), bracket->divotEnd().offset);
+        return node;
+    }
+    ASSERT(func->isDotAccessorNode());
+    DotAccessorNode* dot = static_cast<DotAccessorNode*>(func);
+    FunctionCallDotNode* node;
+    if (dot->identifier() == m_vm->propertyNames->builtinNames().callPublicName() || dot->identifier() == m_vm->propertyNames->builtinNames().callPrivateName())
+        node = new (m_parserArena) CallFunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divotStart, divotEnd);
+    else if (dot->identifier() == m_vm->propertyNames->builtinNames().applyPublicName() || dot->identifier() == m_vm->propertyNames->builtinNames().applyPrivateName())
+        node = new (m_parserArena) ApplyFunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divotStart, divotEnd);
+    else
+        node = new (m_parserArena) FunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divotStart, divotEnd);
+    node->setSubexpressionInfo(dot->divot(), dot->divotEnd().offset);
+    return node;
+}
+
+ExpressionNode* ASTBuilder::makeBinaryNode(const JSTokenLocation& location, int token, std::pair<ExpressionNode*, BinaryOpInfo> lhs, std::pair<ExpressionNode*, BinaryOpInfo> rhs)
+{
+    switch (token) {
+    case OR:
+        return new (m_parserArena) LogicalOpNode(location, lhs.first, rhs.first, OpLogicalOr);
+
+    case AND:
+        return new (m_parserArena) LogicalOpNode(location, lhs.first, rhs.first, OpLogicalAnd);
+
+    case BITOR:
+        return makeBitOrNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case BITXOR:
+        return makeBitXOrNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case BITAND:
+        return makeBitAndNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case EQEQ:
+        return new (m_parserArena) EqualNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case NE:
+        return new (m_parserArena) NotEqualNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case STREQ:
+        return new (m_parserArena) StrictEqualNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case STRNEQ:
+        return new (m_parserArena) NotStrictEqualNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case LT:
+        return new (m_parserArena) LessNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case GT:
+        return new (m_parserArena) GreaterNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case LE:
+        return new (m_parserArena) LessEqNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case GE:
+        return new (m_parserArena) GreaterEqNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case INSTANCEOF: {
+        InstanceOfNode* node = new (m_parserArena) InstanceOfNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+        setExceptionLocation(node, lhs.second.start, rhs.second.start, rhs.second.end);
+        return node;
+    }
+
+    case INTOKEN: {
+        InNode* node = new (m_parserArena) InNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+        setExceptionLocation(node, lhs.second.start, rhs.second.start, rhs.second.end);
+        return node;
+    }
+
+    case LSHIFT:
+        return makeLeftShiftNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case RSHIFT:
+        return makeRightShiftNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case URSHIFT:
+        return makeURightShiftNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case PLUS:
+        return makeAddNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case MINUS:
+        return makeSubNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case TIMES:
+        return makeMultNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case DIVIDE:
+        return makeDivNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case MOD:
+        return makeModNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+
+    case POW:
+        return makePowNode(location, lhs.first, rhs.first, rhs.second.hasAssignment);
+    }
+    CRASH();
+    return 0;
+}
+
+ExpressionNode* ASTBuilder::makeAssignNode(const JSTokenLocation& location, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+{
+    if (!loc->isLocation())
+        return new (m_parserArena) AssignErrorNode(location, divot, start, end);
+
+    if (loc->isResolveNode()) {
+        ResolveNode* resolve = static_cast<ResolveNode*>(loc);
+        if (op == OpEqual) {
+            if (expr->isBaseFuncExprNode()) {
+                auto metadata = static_cast<BaseFuncExprNode*>(expr)->metadata();
+                metadata->setEcmaName(resolve->identifier());
+                metadata->setInferredName(resolve->identifier());
+            } else if (expr->isClassExprNode())
+                static_cast<ClassExprNode*>(expr)->setEcmaName(resolve->identifier());
+            AssignResolveNode* node = new (m_parserArena) AssignResolveNode(location, resolve->identifier(), expr, AssignmentContext::AssignmentExpression);
+            setExceptionLocation(node, start, divot, end);
+            return node;
+        }
+        return new (m_parserArena) ReadModifyResolveNode(location, resolve->identifier(), op, expr, exprHasAssignments, divot, start, end);
+    }
+    if (loc->isBracketAccessorNode()) {
+        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
+        if (op == OpEqual)
+            return new (m_parserArena) AssignBracketNode(location, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), start, end);
+        ReadModifyBracketNode* node = new (m_parserArena) ReadModifyBracketNode(location, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, start, end);
+        node->setSubexpressionInfo(bracket->divot(), bracket->divotEnd().offset);
+        return node;
+    }
+    ASSERT(loc->isDotAccessorNode());
+    DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
+    if (op == OpEqual) {
+        if (expr->isBaseFuncExprNode()) {
+            // We don't also set the ecma name here because ES6 specifies that the
+            // function should not pick up the name of the dot->identifier().
+            static_cast<BaseFuncExprNode*>(expr)->metadata()->setInferredName(dot->identifier());
+        }
+        return new (m_parserArena) AssignDotNode(location, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), start, end);
+    }
+
+    ReadModifyDotNode* node = new (m_parserArena) ReadModifyDotNode(location, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, start, end);
+    node->setSubexpressionInfo(dot->divot(), dot->divotEnd().offset);
+    return node;
+}
+
+ExpressionNode* ASTBuilder::makePrefixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator op, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+{
+    return new (m_parserArena) PrefixNode(location, expr, op, divot, start, end);
+}
+
+ExpressionNode* ASTBuilder::makePostfixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator op, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
+{
+    return new (m_parserArena) PostfixNode(location, expr, op, divot, start, end);
+}
+
+}
diff --git a/parser/Keywords.table b/parser/Keywords.table
new file mode 100644
index 0000000..a0e5163
--- /dev/null
+++ b/parser/Keywords.table
@@ -0,0 +1,59 @@
+# Main keywords.
+@begin mainTable 47
+
+# Types.
+null		NULLTOKEN
+true		TRUETOKEN
+false		FALSETOKEN
+
+# Keywords.
+async       ASYNC
+await       AWAIT
+break		BREAK
+case		CASE
+catch		CATCH
+class		CLASSTOKEN
+const		CONSTTOKEN
+default		DEFAULT
+extends	EXTENDS
+finally		FINALLY
+for		FOR
+instanceof	INSTANCEOF
+new		NEW
+var		VAR
+let		LET
+continue	CONTINUE
+function	FUNCTION
+return		RETURN
+void		VOIDTOKEN
+delete		DELETETOKEN
+if		IF
+this		THISTOKEN
+do		DO
+while		WHILE
+else		ELSE
+in		INTOKEN
+super		SUPER
+switch		SWITCH
+throw		THROW
+try		TRY
+typeof		TYPEOF
+with		WITH
+debugger	DEBUGGER
+yield	YIELD
+
+# Reserved for future use.
+enum            RESERVED
+export          EXPORT
+import          IMPORT
+
+# Reserved for future use in strict code.
+implements      RESERVED_IF_STRICT
+interface       RESERVED_IF_STRICT
+package         RESERVED_IF_STRICT
+private         RESERVED_IF_STRICT
+protected       RESERVED_IF_STRICT
+public          RESERVED_IF_STRICT
+static          RESERVED_IF_STRICT
+
+@end
diff --git a/parser/Lexer.cpp b/parser/Lexer.cpp
new file mode 100644
index 0000000..d990f7b
--- /dev/null
+++ b/parser/Lexer.cpp
@@ -0,0 +1,2466 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2006-2009, 2011-2013, 2016 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2010 Zoltan Herczeg (zherczeg@inf.u-szeged.hu)
+ *  Copyright (C) 2012 Mathias Bynens (mathias@qiwi.be)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Lexer.h"
+
+#include "BuiltinNames.h"
+#include "Identifier.h"
+#include "JSCInlines.h"
+#include "JSFunctionInlines.h"
+#include "JSGlobalObjectFunctions.h"
+#include "KeywordLookup.h"
+#include "Lexer.lut.h"
+#include "Nodes.h"
+#include "Parser.h"
+#include <ctype.h>
+#include <limits.h>
+#include <string.h>
+#include <wtf/Assertions.h>
+#include <wtf/dtoa.h>
+
+namespace JSC {
+
+bool isLexerKeyword(const Identifier& identifier)
+{
+    return JSC::mainTable.entry(identifier);
+}
+
+enum CharacterType {
+    // Types for the main switch
+
+    // The first three types are fixed, and also used for identifying
+    // ASCII alpha and alphanumeric characters (see isIdentStart and isIdentPart).
+    CharacterIdentifierStart,
+    CharacterZero,
+    CharacterNumber,
+
+    CharacterInvalid,
+    CharacterLineTerminator,
+    CharacterExclamationMark,
+    CharacterOpenParen,
+    CharacterCloseParen,
+    CharacterOpenBracket,
+    CharacterCloseBracket,
+    CharacterComma,
+    CharacterColon,
+    CharacterQuestion,
+    CharacterTilde,
+    CharacterQuote,
+    CharacterBackQuote,
+    CharacterDot,
+    CharacterSlash,
+    CharacterBackSlash,
+    CharacterSemicolon,
+    CharacterOpenBrace,
+    CharacterCloseBrace,
+
+    CharacterAdd,
+    CharacterSub,
+    CharacterMultiply,
+    CharacterModulo,
+    CharacterAnd,
+    CharacterXor,
+    CharacterOr,
+    CharacterLess,
+    CharacterGreater,
+    CharacterEqual,
+
+    // Other types (only one so far)
+    CharacterWhiteSpace,
+    CharacterPrivateIdentifierStart
+};
+
+// 256 Latin-1 codes
+static const unsigned short typesOfLatin1Characters[256] = {
+/*   0 - Null               */ CharacterInvalid,
+/*   1 - Start of Heading   */ CharacterInvalid,
+/*   2 - Start of Text      */ CharacterInvalid,
+/*   3 - End of Text        */ CharacterInvalid,
+/*   4 - End of Transm.     */ CharacterInvalid,
+/*   5 - Enquiry            */ CharacterInvalid,
+/*   6 - Acknowledgment     */ CharacterInvalid,
+/*   7 - Bell               */ CharacterInvalid,
+/*   8 - Back Space         */ CharacterInvalid,
+/*   9 - Horizontal Tab     */ CharacterWhiteSpace,
+/*  10 - Line Feed          */ CharacterLineTerminator,
+/*  11 - Vertical Tab       */ CharacterWhiteSpace,
+/*  12 - Form Feed          */ CharacterWhiteSpace,
+/*  13 - Carriage Return    */ CharacterLineTerminator,
+/*  14 - Shift Out          */ CharacterInvalid,
+/*  15 - Shift In           */ CharacterInvalid,
+/*  16 - Data Line Escape   */ CharacterInvalid,
+/*  17 - Device Control 1   */ CharacterInvalid,
+/*  18 - Device Control 2   */ CharacterInvalid,
+/*  19 - Device Control 3   */ CharacterInvalid,
+/*  20 - Device Control 4   */ CharacterInvalid,
+/*  21 - Negative Ack.      */ CharacterInvalid,
+/*  22 - Synchronous Idle   */ CharacterInvalid,
+/*  23 - End of Transmit    */ CharacterInvalid,
+/*  24 - Cancel             */ CharacterInvalid,
+/*  25 - End of Medium      */ CharacterInvalid,
+/*  26 - Substitute         */ CharacterInvalid,
+/*  27 - Escape             */ CharacterInvalid,
+/*  28 - File Separator     */ CharacterInvalid,
+/*  29 - Group Separator    */ CharacterInvalid,
+/*  30 - Record Separator   */ CharacterInvalid,
+/*  31 - Unit Separator     */ CharacterInvalid,
+/*  32 - Space              */ CharacterWhiteSpace,
+/*  33 - !                  */ CharacterExclamationMark,
+/*  34 - "                  */ CharacterQuote,
+/*  35 - #                  */ CharacterInvalid,
+/*  36 - $                  */ CharacterIdentifierStart,
+/*  37 - %                  */ CharacterModulo,
+/*  38 - &                  */ CharacterAnd,
+/*  39 - '                  */ CharacterQuote,
+/*  40 - (                  */ CharacterOpenParen,
+/*  41 - )                  */ CharacterCloseParen,
+/*  42 - *                  */ CharacterMultiply,
+/*  43 - +                  */ CharacterAdd,
+/*  44 - ,                  */ CharacterComma,
+/*  45 - -                  */ CharacterSub,
+/*  46 - .                  */ CharacterDot,
+/*  47 - /                  */ CharacterSlash,
+/*  48 - 0                  */ CharacterZero,
+/*  49 - 1                  */ CharacterNumber,
+/*  50 - 2                  */ CharacterNumber,
+/*  51 - 3                  */ CharacterNumber,
+/*  52 - 4                  */ CharacterNumber,
+/*  53 - 5                  */ CharacterNumber,
+/*  54 - 6                  */ CharacterNumber,
+/*  55 - 7                  */ CharacterNumber,
+/*  56 - 8                  */ CharacterNumber,
+/*  57 - 9                  */ CharacterNumber,
+/*  58 - :                  */ CharacterColon,
+/*  59 - ;                  */ CharacterSemicolon,
+/*  60 - <                  */ CharacterLess,
+/*  61 - =                  */ CharacterEqual,
+/*  62 - >                  */ CharacterGreater,
+/*  63 - ?                  */ CharacterQuestion,
+/*  64 - @                  */ CharacterPrivateIdentifierStart,
+/*  65 - A                  */ CharacterIdentifierStart,
+/*  66 - B                  */ CharacterIdentifierStart,
+/*  67 - C                  */ CharacterIdentifierStart,
+/*  68 - D                  */ CharacterIdentifierStart,
+/*  69 - E                  */ CharacterIdentifierStart,
+/*  70 - F                  */ CharacterIdentifierStart,
+/*  71 - G                  */ CharacterIdentifierStart,
+/*  72 - H                  */ CharacterIdentifierStart,
+/*  73 - I                  */ CharacterIdentifierStart,
+/*  74 - J                  */ CharacterIdentifierStart,
+/*  75 - K                  */ CharacterIdentifierStart,
+/*  76 - L                  */ CharacterIdentifierStart,
+/*  77 - M                  */ CharacterIdentifierStart,
+/*  78 - N                  */ CharacterIdentifierStart,
+/*  79 - O                  */ CharacterIdentifierStart,
+/*  80 - P                  */ CharacterIdentifierStart,
+/*  81 - Q                  */ CharacterIdentifierStart,
+/*  82 - R                  */ CharacterIdentifierStart,
+/*  83 - S                  */ CharacterIdentifierStart,
+/*  84 - T                  */ CharacterIdentifierStart,
+/*  85 - U                  */ CharacterIdentifierStart,
+/*  86 - V                  */ CharacterIdentifierStart,
+/*  87 - W                  */ CharacterIdentifierStart,
+/*  88 - X                  */ CharacterIdentifierStart,
+/*  89 - Y                  */ CharacterIdentifierStart,
+/*  90 - Z                  */ CharacterIdentifierStart,
+/*  91 - [                  */ CharacterOpenBracket,
+/*  92 - \                  */ CharacterBackSlash,
+/*  93 - ]                  */ CharacterCloseBracket,
+/*  94 - ^                  */ CharacterXor,
+/*  95 - _                  */ CharacterIdentifierStart,
+/*  96 - `                  */ CharacterBackQuote,
+/*  97 - a                  */ CharacterIdentifierStart,
+/*  98 - b                  */ CharacterIdentifierStart,
+/*  99 - c                  */ CharacterIdentifierStart,
+/* 100 - d                  */ CharacterIdentifierStart,
+/* 101 - e                  */ CharacterIdentifierStart,
+/* 102 - f                  */ CharacterIdentifierStart,
+/* 103 - g                  */ CharacterIdentifierStart,
+/* 104 - h                  */ CharacterIdentifierStart,
+/* 105 - i                  */ CharacterIdentifierStart,
+/* 106 - j                  */ CharacterIdentifierStart,
+/* 107 - k                  */ CharacterIdentifierStart,
+/* 108 - l                  */ CharacterIdentifierStart,
+/* 109 - m                  */ CharacterIdentifierStart,
+/* 110 - n                  */ CharacterIdentifierStart,
+/* 111 - o                  */ CharacterIdentifierStart,
+/* 112 - p                  */ CharacterIdentifierStart,
+/* 113 - q                  */ CharacterIdentifierStart,
+/* 114 - r                  */ CharacterIdentifierStart,
+/* 115 - s                  */ CharacterIdentifierStart,
+/* 116 - t                  */ CharacterIdentifierStart,
+/* 117 - u                  */ CharacterIdentifierStart,
+/* 118 - v                  */ CharacterIdentifierStart,
+/* 119 - w                  */ CharacterIdentifierStart,
+/* 120 - x                  */ CharacterIdentifierStart,
+/* 121 - y                  */ CharacterIdentifierStart,
+/* 122 - z                  */ CharacterIdentifierStart,
+/* 123 - {                  */ CharacterOpenBrace,
+/* 124 - |                  */ CharacterOr,
+/* 125 - }                  */ CharacterCloseBrace,
+/* 126 - ~                  */ CharacterTilde,
+/* 127 - Delete             */ CharacterInvalid,
+/* 128 - Cc category        */ CharacterInvalid,
+/* 129 - Cc category        */ CharacterInvalid,
+/* 130 - Cc category        */ CharacterInvalid,
+/* 131 - Cc category        */ CharacterInvalid,
+/* 132 - Cc category        */ CharacterInvalid,
+/* 133 - Cc category        */ CharacterInvalid,
+/* 134 - Cc category        */ CharacterInvalid,
+/* 135 - Cc category        */ CharacterInvalid,
+/* 136 - Cc category        */ CharacterInvalid,
+/* 137 - Cc category        */ CharacterInvalid,
+/* 138 - Cc category        */ CharacterInvalid,
+/* 139 - Cc category        */ CharacterInvalid,
+/* 140 - Cc category        */ CharacterInvalid,
+/* 141 - Cc category        */ CharacterInvalid,
+/* 142 - Cc category        */ CharacterInvalid,
+/* 143 - Cc category        */ CharacterInvalid,
+/* 144 - Cc category        */ CharacterInvalid,
+/* 145 - Cc category        */ CharacterInvalid,
+/* 146 - Cc category        */ CharacterInvalid,
+/* 147 - Cc category        */ CharacterInvalid,
+/* 148 - Cc category        */ CharacterInvalid,
+/* 149 - Cc category        */ CharacterInvalid,
+/* 150 - Cc category        */ CharacterInvalid,
+/* 151 - Cc category        */ CharacterInvalid,
+/* 152 - Cc category        */ CharacterInvalid,
+/* 153 - Cc category        */ CharacterInvalid,
+/* 154 - Cc category        */ CharacterInvalid,
+/* 155 - Cc category        */ CharacterInvalid,
+/* 156 - Cc category        */ CharacterInvalid,
+/* 157 - Cc category        */ CharacterInvalid,
+/* 158 - Cc category        */ CharacterInvalid,
+/* 159 - Cc category        */ CharacterInvalid,
+/* 160 - Zs category (nbsp) */ CharacterWhiteSpace,
+/* 161 - Po category        */ CharacterInvalid,
+/* 162 - Sc category        */ CharacterInvalid,
+/* 163 - Sc category        */ CharacterInvalid,
+/* 164 - Sc category        */ CharacterInvalid,
+/* 165 - Sc category        */ CharacterInvalid,
+/* 166 - So category        */ CharacterInvalid,
+/* 167 - So category        */ CharacterInvalid,
+/* 168 - Sk category        */ CharacterInvalid,
+/* 169 - So category        */ CharacterInvalid,
+/* 170 - Ll category        */ CharacterIdentifierStart,
+/* 171 - Pi category        */ CharacterInvalid,
+/* 172 - Sm category        */ CharacterInvalid,
+/* 173 - Cf category        */ CharacterInvalid,
+/* 174 - So category        */ CharacterInvalid,
+/* 175 - Sk category        */ CharacterInvalid,
+/* 176 - So category        */ CharacterInvalid,
+/* 177 - Sm category        */ CharacterInvalid,
+/* 178 - No category        */ CharacterInvalid,
+/* 179 - No category        */ CharacterInvalid,
+/* 180 - Sk category        */ CharacterInvalid,
+/* 181 - Ll category        */ CharacterIdentifierStart,
+/* 182 - So category        */ CharacterInvalid,
+/* 183 - Po category        */ CharacterInvalid,
+/* 184 - Sk category        */ CharacterInvalid,
+/* 185 - No category        */ CharacterInvalid,
+/* 186 - Ll category        */ CharacterIdentifierStart,
+/* 187 - Pf category        */ CharacterInvalid,
+/* 188 - No category        */ CharacterInvalid,
+/* 189 - No category        */ CharacterInvalid,
+/* 190 - No category        */ CharacterInvalid,
+/* 191 - Po category        */ CharacterInvalid,
+/* 192 - Lu category        */ CharacterIdentifierStart,
+/* 193 - Lu category        */ CharacterIdentifierStart,
+/* 194 - Lu category        */ CharacterIdentifierStart,
+/* 195 - Lu category        */ CharacterIdentifierStart,
+/* 196 - Lu category        */ CharacterIdentifierStart,
+/* 197 - Lu category        */ CharacterIdentifierStart,
+/* 198 - Lu category        */ CharacterIdentifierStart,
+/* 199 - Lu category        */ CharacterIdentifierStart,
+/* 200 - Lu category        */ CharacterIdentifierStart,
+/* 201 - Lu category        */ CharacterIdentifierStart,
+/* 202 - Lu category        */ CharacterIdentifierStart,
+/* 203 - Lu category        */ CharacterIdentifierStart,
+/* 204 - Lu category        */ CharacterIdentifierStart,
+/* 205 - Lu category        */ CharacterIdentifierStart,
+/* 206 - Lu category        */ CharacterIdentifierStart,
+/* 207 - Lu category        */ CharacterIdentifierStart,
+/* 208 - Lu category        */ CharacterIdentifierStart,
+/* 209 - Lu category        */ CharacterIdentifierStart,
+/* 210 - Lu category        */ CharacterIdentifierStart,
+/* 211 - Lu category        */ CharacterIdentifierStart,
+/* 212 - Lu category        */ CharacterIdentifierStart,
+/* 213 - Lu category        */ CharacterIdentifierStart,
+/* 214 - Lu category        */ CharacterIdentifierStart,
+/* 215 - Sm category        */ CharacterInvalid,
+/* 216 - Lu category        */ CharacterIdentifierStart,
+/* 217 - Lu category        */ CharacterIdentifierStart,
+/* 218 - Lu category        */ CharacterIdentifierStart,
+/* 219 - Lu category        */ CharacterIdentifierStart,
+/* 220 - Lu category        */ CharacterIdentifierStart,
+/* 221 - Lu category        */ CharacterIdentifierStart,
+/* 222 - Lu category        */ CharacterIdentifierStart,
+/* 223 - Ll category        */ CharacterIdentifierStart,
+/* 224 - Ll category        */ CharacterIdentifierStart,
+/* 225 - Ll category        */ CharacterIdentifierStart,
+/* 226 - Ll category        */ CharacterIdentifierStart,
+/* 227 - Ll category        */ CharacterIdentifierStart,
+/* 228 - Ll category        */ CharacterIdentifierStart,
+/* 229 - Ll category        */ CharacterIdentifierStart,
+/* 230 - Ll category        */ CharacterIdentifierStart,
+/* 231 - Ll category        */ CharacterIdentifierStart,
+/* 232 - Ll category        */ CharacterIdentifierStart,
+/* 233 - Ll category        */ CharacterIdentifierStart,
+/* 234 - Ll category        */ CharacterIdentifierStart,
+/* 235 - Ll category        */ CharacterIdentifierStart,
+/* 236 - Ll category        */ CharacterIdentifierStart,
+/* 237 - Ll category        */ CharacterIdentifierStart,
+/* 238 - Ll category        */ CharacterIdentifierStart,
+/* 239 - Ll category        */ CharacterIdentifierStart,
+/* 240 - Ll category        */ CharacterIdentifierStart,
+/* 241 - Ll category        */ CharacterIdentifierStart,
+/* 242 - Ll category        */ CharacterIdentifierStart,
+/* 243 - Ll category        */ CharacterIdentifierStart,
+/* 244 - Ll category        */ CharacterIdentifierStart,
+/* 245 - Ll category        */ CharacterIdentifierStart,
+/* 246 - Ll category        */ CharacterIdentifierStart,
+/* 247 - Sm category        */ CharacterInvalid,
+/* 248 - Ll category        */ CharacterIdentifierStart,
+/* 249 - Ll category        */ CharacterIdentifierStart,
+/* 250 - Ll category        */ CharacterIdentifierStart,
+/* 251 - Ll category        */ CharacterIdentifierStart,
+/* 252 - Ll category        */ CharacterIdentifierStart,
+/* 253 - Ll category        */ CharacterIdentifierStart,
+/* 254 - Ll category        */ CharacterIdentifierStart,
+/* 255 - Ll category        */ CharacterIdentifierStart
+};
+
+// This table provides the character that results from \X where X is the index in the table beginning
+// with SPACE. A table value of 0 means that more processing needs to be done.
+static const LChar singleCharacterEscapeValuesForASCII[128] = {
+/*   0 - Null               */ 0,
+/*   1 - Start of Heading   */ 0,
+/*   2 - Start of Text      */ 0,
+/*   3 - End of Text        */ 0,
+/*   4 - End of Transm.     */ 0,
+/*   5 - Enquiry            */ 0,
+/*   6 - Acknowledgment     */ 0,
+/*   7 - Bell               */ 0,
+/*   8 - Back Space         */ 0,
+/*   9 - Horizontal Tab     */ 0,
+/*  10 - Line Feed          */ 0,
+/*  11 - Vertical Tab       */ 0,
+/*  12 - Form Feed          */ 0,
+/*  13 - Carriage Return    */ 0,
+/*  14 - Shift Out          */ 0,
+/*  15 - Shift In           */ 0,
+/*  16 - Data Line Escape   */ 0,
+/*  17 - Device Control 1   */ 0,
+/*  18 - Device Control 2   */ 0,
+/*  19 - Device Control 3   */ 0,
+/*  20 - Device Control 4   */ 0,
+/*  21 - Negative Ack.      */ 0,
+/*  22 - Synchronous Idle   */ 0,
+/*  23 - End of Transmit    */ 0,
+/*  24 - Cancel             */ 0,
+/*  25 - End of Medium      */ 0,
+/*  26 - Substitute         */ 0,
+/*  27 - Escape             */ 0,
+/*  28 - File Separator     */ 0,
+/*  29 - Group Separator    */ 0,
+/*  30 - Record Separator   */ 0,
+/*  31 - Unit Separator     */ 0,
+/*  32 - Space              */ ' ',
+/*  33 - !                  */ '!',
+/*  34 - "                  */ '"',
+/*  35 - #                  */ '#',
+/*  36 - $                  */ '$',
+/*  37 - %                  */ '%',
+/*  38 - &                  */ '&',
+/*  39 - '                  */ '\'',
+/*  40 - (                  */ '(',
+/*  41 - )                  */ ')',
+/*  42 - *                  */ '*',
+/*  43 - +                  */ '+',
+/*  44 - ,                  */ ',',
+/*  45 - -                  */ '-',
+/*  46 - .                  */ '.',
+/*  47 - /                  */ '/',
+/*  48 - 0                  */ 0,
+/*  49 - 1                  */ 0,
+/*  50 - 2                  */ 0,
+/*  51 - 3                  */ 0,
+/*  52 - 4                  */ 0,
+/*  53 - 5                  */ 0,
+/*  54 - 6                  */ 0,
+/*  55 - 7                  */ 0,
+/*  56 - 8                  */ 0,
+/*  57 - 9                  */ 0,
+/*  58 - :                  */ ':',
+/*  59 - ;                  */ ';',
+/*  60 - <                  */ '<',
+/*  61 - =                  */ '=',
+/*  62 - >                  */ '>',
+/*  63 - ?                  */ '?',
+/*  64 - @                  */ '@',
+/*  65 - A                  */ 'A',
+/*  66 - B                  */ 'B',
+/*  67 - C                  */ 'C',
+/*  68 - D                  */ 'D',
+/*  69 - E                  */ 'E',
+/*  70 - F                  */ 'F',
+/*  71 - G                  */ 'G',
+/*  72 - H                  */ 'H',
+/*  73 - I                  */ 'I',
+/*  74 - J                  */ 'J',
+/*  75 - K                  */ 'K',
+/*  76 - L                  */ 'L',
+/*  77 - M                  */ 'M',
+/*  78 - N                  */ 'N',
+/*  79 - O                  */ 'O',
+/*  80 - P                  */ 'P',
+/*  81 - Q                  */ 'Q',
+/*  82 - R                  */ 'R',
+/*  83 - S                  */ 'S',
+/*  84 - T                  */ 'T',
+/*  85 - U                  */ 'U',
+/*  86 - V                  */ 'V',
+/*  87 - W                  */ 'W',
+/*  88 - X                  */ 'X',
+/*  89 - Y                  */ 'Y',
+/*  90 - Z                  */ 'Z',
+/*  91 - [                  */ '[',
+/*  92 - \                  */ '\\',
+/*  93 - ]                  */ ']',
+/*  94 - ^                  */ '^',
+/*  95 - _                  */ '_',
+/*  96 - `                  */ '`',
+/*  97 - a                  */ 'a',
+/*  98 - b                  */ 0x08,
+/*  99 - c                  */ 'c',
+/* 100 - d                  */ 'd',
+/* 101 - e                  */ 'e',
+/* 102 - f                  */ 0x0C,
+/* 103 - g                  */ 'g',
+/* 104 - h                  */ 'h',
+/* 105 - i                  */ 'i',
+/* 106 - j                  */ 'j',
+/* 107 - k                  */ 'k',
+/* 108 - l                  */ 'l',
+/* 109 - m                  */ 'm',
+/* 110 - n                  */ 0x0A,
+/* 111 - o                  */ 'o',
+/* 112 - p                  */ 'p',
+/* 113 - q                  */ 'q',
+/* 114 - r                  */ 0x0D,
+/* 115 - s                  */ 's',
+/* 116 - t                  */ 0x09,
+/* 117 - u                  */ 0,
+/* 118 - v                  */ 0x0B,
+/* 119 - w                  */ 'w',
+/* 120 - x                  */ 0,
+/* 121 - y                  */ 'y',
+/* 122 - z                  */ 'z',
+/* 123 - {                  */ '{',
+/* 124 - |                  */ '|',
+/* 125 - }                  */ '}',
+/* 126 - ~                  */ '~',
+/* 127 - Delete             */ 0
+};
+
+template <typename T>
+Lexer<T>::Lexer(VM* vm, JSParserBuiltinMode builtinMode, JSParserScriptMode scriptMode)
+    : m_isReparsingFunction(false)
+    , m_vm(vm)
+    , m_parsingBuiltinFunction(builtinMode == JSParserBuiltinMode::Builtin)
+    , m_scriptMode(scriptMode)
+{
+}
+
+static inline JSTokenType tokenTypeForIntegerLikeToken(double doubleValue)
+{
+    if ((doubleValue || !std::signbit(doubleValue)) && static_cast<int64_t>(doubleValue) == doubleValue)
+        return INTEGER;
+    return DOUBLE;
+}
+
+template <typename T>
+Lexer<T>::~Lexer()
+{
+}
+
+template <typename T>
+String Lexer<T>::invalidCharacterMessage() const
+{
+    switch (m_current) {
+    case 0:
+        return ASCIILiteral("Invalid character: '\\0'");
+    case 10:
+        return ASCIILiteral("Invalid character: '\\n'");
+    case 11:
+        return ASCIILiteral("Invalid character: '\\v'");
+    case 13:
+        return ASCIILiteral("Invalid character: '\\r'");
+    case 35:
+        return ASCIILiteral("Invalid character: '#'");
+    case 64:
+        return ASCIILiteral("Invalid character: '@'");
+    case 96:
+        return ASCIILiteral("Invalid character: '`'");
+    default:
+        return String::format("Invalid character '\\u%04u'", static_cast<unsigned>(m_current));
+    }
+}
+
+template <typename T>
+ALWAYS_INLINE const T* Lexer<T>::currentSourcePtr() const
+{
+    ASSERT(m_code <= m_codeEnd);
+    return m_code;
+}
+
+template <typename T>
+void Lexer<T>::setCode(const SourceCode& source, ParserArena* arena)
+{
+    m_arena = &arena->identifierArena();
+    
+    m_lineNumber = source.firstLine().oneBasedInt();
+    m_lastToken = -1;
+    
+    StringView sourceString = source.provider()->source();
+
+    if (!sourceString.isNull())
+        setCodeStart(sourceString);
+    else
+        m_codeStart = 0;
+
+    m_source = &source;
+    m_sourceOffset = source.startOffset();
+    m_codeStartPlusOffset = m_codeStart + source.startOffset();
+    m_code = m_codeStartPlusOffset;
+    m_codeEnd = m_codeStart + source.endOffset();
+    m_error = false;
+    m_atLineStart = true;
+    m_lineStart = m_code;
+    m_lexErrorMessage = String();
+    m_sourceURLDirective = String();
+    m_sourceMappingURLDirective = String();
+    
+    m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
+    m_buffer16.reserveInitialCapacity((m_codeEnd - m_code) / 2);
+    m_bufferForRawTemplateString16.reserveInitialCapacity(initialReadBufferCapacity);
+    
+    if (LIKELY(m_code < m_codeEnd))
+        m_current = *m_code;
+    else
+        m_current = 0;
+    ASSERT(currentOffset() == source.startOffset());
+}
+
+template <typename T>
+template <int shiftAmount> ALWAYS_INLINE void Lexer<T>::internalShift()
+{
+    m_code += shiftAmount;
+    ASSERT(currentOffset() >= currentLineStartOffset());
+    m_current = *m_code;
+}
+
+template <typename T>
+ALWAYS_INLINE void Lexer<T>::shift()
+{
+    // At one point timing showed that setting m_current to 0 unconditionally was faster than an if-else sequence.
+    m_current = 0;
+    ++m_code;
+    if (LIKELY(m_code < m_codeEnd))
+        m_current = *m_code;
+}
+
+template <typename T>
+ALWAYS_INLINE bool Lexer<T>::atEnd() const
+{
+    ASSERT(!m_current || m_code < m_codeEnd);
+    return UNLIKELY(UNLIKELY(!m_current) && m_code == m_codeEnd);
+}
+
+template <typename T>
+ALWAYS_INLINE T Lexer<T>::peek(int offset) const
+{
+    ASSERT(offset > 0 && offset < 5);
+    const T* code = m_code + offset;
+    return (code < m_codeEnd) ? *code : 0;
+}
+
+struct ParsedUnicodeEscapeValue {
+    ParsedUnicodeEscapeValue(UChar32 value)
+        : m_value(value)
+    {
+        ASSERT(isValid());
+    }
+
+    enum SpecialValueType { Incomplete = -2, Invalid = -1 };
+    ParsedUnicodeEscapeValue(SpecialValueType type)
+        : m_value(type)
+    {
+    }
+
+    bool isValid() const { return m_value >= 0; }
+    bool isIncomplete() const { return m_value == Incomplete; }
+
+    UChar32 value() const
+    {
+        ASSERT(isValid());
+        return m_value;
+    }
+
+private:
+    UChar32 m_value;
+};
+
+template<typename CharacterType> ParsedUnicodeEscapeValue Lexer<CharacterType>::parseUnicodeEscape()
+{
+    if (m_current == '{') {
+        shift();
+        UChar32 codePoint = 0;
+        do {
+            if (!isASCIIHexDigit(m_current))
+                return m_current ? ParsedUnicodeEscapeValue::Invalid : ParsedUnicodeEscapeValue::Incomplete;
+            codePoint = (codePoint << 4) | toASCIIHexValue(m_current);
+            if (codePoint > UCHAR_MAX_VALUE)
+                return ParsedUnicodeEscapeValue::Invalid;
+            shift();
+        } while (m_current != '}');
+        shift();
+        return codePoint;
+    }
+
+    auto character2 = peek(1);
+    auto character3 = peek(2);
+    auto character4 = peek(3);
+    if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(character2) || !isASCIIHexDigit(character3) || !isASCIIHexDigit(character4)))
+        return (m_code + 4) >= m_codeEnd ? ParsedUnicodeEscapeValue::Incomplete : ParsedUnicodeEscapeValue::Invalid;
+    auto result = convertUnicode(m_current, character2, character3, character4);
+    shift();
+    shift();
+    shift();
+    shift();
+    return result;
+}
+
+template <typename T>
+void Lexer<T>::shiftLineTerminator()
+{
+    ASSERT(isLineTerminator(m_current));
+
+    m_positionBeforeLastNewline = currentPosition();
+    T prev = m_current;
+    shift();
+
+    // Allow both CRLF and LFCR.
+    if (prev + m_current == '\n' + '\r')
+        shift();
+
+    ++m_lineNumber;
+}
+
+template <typename T>
+ALWAYS_INLINE bool Lexer<T>::lastTokenWasRestrKeyword() const
+{
+    return m_lastToken == CONTINUE || m_lastToken == BREAK || m_lastToken == RETURN || m_lastToken == THROW;
+}
+
+template <typename T>
+ALWAYS_INLINE void Lexer<T>::skipWhitespace()
+{
+    while (isWhiteSpace(m_current))
+        shift();
+}
+
+static NEVER_INLINE bool isNonLatin1IdentStart(UChar c)
+{
+    return U_GET_GC_MASK(c) & U_GC_L_MASK;
+}
+
+static ALWAYS_INLINE bool isLatin1(LChar)
+{
+    return true;
+}
+
+static ALWAYS_INLINE bool isLatin1(UChar c)
+{
+    return c < 256;
+}
+
+static ALWAYS_INLINE bool isLatin1(UChar32 c)
+{
+    return !(c & ~0xFF);
+}
+
+static inline bool isIdentStart(LChar c)
+{
+    return typesOfLatin1Characters[c] == CharacterIdentifierStart;
+}
+
+static inline bool isIdentStart(UChar32 c)
+{
+    return isLatin1(c) ? isIdentStart(static_cast<LChar>(c)) : isNonLatin1IdentStart(c);
+}
+
+static NEVER_INLINE bool isNonLatin1IdentPart(UChar32 c)
+{
+    // FIXME: ES6 says this should be based on the Unicode property ID_Continue now instead.
+    return (U_GET_GC_MASK(c) & (U_GC_L_MASK | U_GC_MN_MASK | U_GC_MC_MASK | U_GC_ND_MASK | U_GC_PC_MASK)) || c == 0x200C || c == 0x200D;
+}
+
+static ALWAYS_INLINE bool isIdentPart(LChar c)
+{
+    // Character types are divided into two groups depending on whether they can be part of an
+    // identifier or not. Those whose type value is less or equal than CharacterNumber can be
+    // part of an identifier. (See the CharacterType definition for more details.)
+    return typesOfLatin1Characters[c] <= CharacterNumber;
+}
+
+static ALWAYS_INLINE bool isIdentPart(UChar32 c)
+{
+    return isLatin1(c) ? isIdentPart(static_cast<LChar>(c)) : isNonLatin1IdentPart(c);
+}
+
+static ALWAYS_INLINE bool isIdentPart(UChar c)
+{
+    return isIdentPart(static_cast<UChar32>(c));
+}
+
+template<typename CharacterType> ALWAYS_INLINE bool isIdentPartIncludingEscapeTemplate(const CharacterType* code, const CharacterType* codeEnd)
+{
+    if (isIdentPart(code[0]))
+        return true;
+
+    // Shortest sequence handled below is \u{0}, which is 5 characters.
+    if (!(code[0] == '\\' && codeEnd - code >= 5 && code[1] == 'u'))
+        return false;
+
+    if (code[2] == '{') {
+        UChar32 codePoint = 0;
+        const CharacterType* pointer;
+        for (pointer = &code[3]; pointer < codeEnd; ++pointer) {
+            auto digit = *pointer;
+            if (!isASCIIHexDigit(digit))
+                break;
+            codePoint = (codePoint << 4) | toASCIIHexValue(digit);
+            if (codePoint > UCHAR_MAX_VALUE)
+                return false;
+        }
+        return isIdentPart(codePoint) && pointer < codeEnd && *pointer == '}';
+    }
+
+    // Shortest sequence handled below is \uXXXX, which is 6 characters.
+    if (codeEnd - code < 6)
+        return false;
+
+    auto character1 = code[2];
+    auto character2 = code[3];
+    auto character3 = code[4];
+    auto character4 = code[5];
+    return isASCIIHexDigit(character1) && isASCIIHexDigit(character2) && isASCIIHexDigit(character3) && isASCIIHexDigit(character4)
+        && isIdentPart(Lexer<LChar>::convertUnicode(character1, character2, character3, character4));
+}
+
+static ALWAYS_INLINE bool isIdentPartIncludingEscape(const LChar* code, const LChar* codeEnd)
+{
+    return isIdentPartIncludingEscapeTemplate(code, codeEnd);
+}
+
+static ALWAYS_INLINE bool isIdentPartIncludingEscape(const UChar* code, const UChar* codeEnd)
+{
+    return isIdentPartIncludingEscapeTemplate(code, codeEnd);
+}
+
+static inline LChar singleEscape(int c)
+{
+    if (c < 128) {
+        ASSERT(static_cast<size_t>(c) < ARRAY_SIZE(singleCharacterEscapeValuesForASCII));
+        return singleCharacterEscapeValuesForASCII[c];
+    }
+    return 0;
+}
+
+template <typename T>
+inline void Lexer<T>::record8(int c)
+{
+    ASSERT(c >= 0);
+    ASSERT(c <= 0xFF);
+    m_buffer8.append(static_cast<LChar>(c));
+}
+
+template <typename T>
+inline void assertCharIsIn8BitRange(T c)
+{
+    UNUSED_PARAM(c);
+    ASSERT(c >= 0);
+    ASSERT(c <= 0xFF);
+}
+
+template <>
+inline void assertCharIsIn8BitRange(UChar c)
+{
+    UNUSED_PARAM(c);
+    ASSERT(c <= 0xFF);
+}
+
+template <>
+inline void assertCharIsIn8BitRange(LChar)
+{
+}
+
+template <typename T>
+inline void Lexer<T>::append8(const T* p, size_t length)
+{
+    size_t currentSize = m_buffer8.size();
+    m_buffer8.grow(currentSize + length);
+    LChar* rawBuffer = m_buffer8.data() + currentSize;
+
+    for (size_t i = 0; i < length; i++) {
+        T c = p[i];
+        assertCharIsIn8BitRange(c);
+        rawBuffer[i] = c;
+    }
+}
+
+template <typename T>
+inline void Lexer<T>::append16(const LChar* p, size_t length)
+{
+    size_t currentSize = m_buffer16.size();
+    m_buffer16.grow(currentSize + length);
+    UChar* rawBuffer = m_buffer16.data() + currentSize;
+
+    for (size_t i = 0; i < length; i++)
+        rawBuffer[i] = p[i];
+}
+
+template <typename T>
+inline void Lexer<T>::record16(T c)
+{
+    m_buffer16.append(c);
+}
+
+template <typename T>
+inline void Lexer<T>::record16(int c)
+{
+    ASSERT(c >= 0);
+    ASSERT(c <= static_cast<int>(USHRT_MAX));
+    m_buffer16.append(static_cast<UChar>(c));
+}
+    
+template<typename CharacterType> inline void Lexer<CharacterType>::recordUnicodeCodePoint(UChar32 codePoint)
+{
+    ASSERT(codePoint >= 0);
+    ASSERT(codePoint <= UCHAR_MAX_VALUE);
+    if (U_IS_BMP(codePoint))
+        record16(codePoint);
+    else {
+        UChar codeUnits[2] = { U16_LEAD(codePoint), U16_TRAIL(codePoint) };
+        append16(codeUnits, 2);
+    }
+}
+
+#if !ASSERT_DISABLED
+bool isSafeBuiltinIdentifier(VM& vm, const Identifier* ident)
+{
+    if (!ident)
+        return true;
+    /* Just block any use of suspicious identifiers.  This is intended to
+     * be used as a safety net while implementing builtins.
+     */
+    // FIXME: How can a debug-only assertion be a safety net?
+    if (*ident == vm.propertyNames->builtinNames().callPublicName())
+        return false;
+    if (*ident == vm.propertyNames->builtinNames().applyPublicName())
+        return false;
+    if (*ident == vm.propertyNames->eval)
+        return false;
+    if (*ident == vm.propertyNames->Function)
+        return false;
+    return true;
+}
+#endif
+    
+template <>
+template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<LChar>::parseIdentifier(JSTokenData* tokenData, unsigned lexerFlags, bool strictMode)
+{
+    const ptrdiff_t remaining = m_codeEnd - m_code;
+    if ((remaining >= maxTokenLength) && !(lexerFlags & LexerFlagsIgnoreReservedWords)) {
+        JSTokenType keyword = parseKeyword<shouldCreateIdentifier>(tokenData);
+        if (keyword != IDENT) {
+            ASSERT((!shouldCreateIdentifier) || tokenData->ident);
+            return keyword == RESERVED_IF_STRICT && !strictMode ? IDENT : keyword;
+        }
+    }
+    
+    bool isPrivateName = m_current == '@' && m_parsingBuiltinFunction;
+    if (isPrivateName)
+        shift();
+    
+    const LChar* identifierStart = currentSourcePtr();
+    unsigned identifierLineStart = currentLineStartOffset();
+    
+    while (isIdentPart(m_current))
+        shift();
+    
+    if (UNLIKELY(m_current == '\\')) {
+        setOffsetFromSourcePtr(identifierStart, identifierLineStart);
+        return parseIdentifierSlowCase<shouldCreateIdentifier>(tokenData, lexerFlags, strictMode);
+    }
+
+    const Identifier* ident = 0;
+    
+    if (shouldCreateIdentifier || m_parsingBuiltinFunction) {
+        int identifierLength = currentSourcePtr() - identifierStart;
+        ident = makeIdentifier(identifierStart, identifierLength);
+        if (m_parsingBuiltinFunction) {
+            if (!isSafeBuiltinIdentifier(*m_vm, ident) && !isPrivateName) {
+                m_lexErrorMessage = makeString("The use of '", ident->string(), "' is disallowed in builtin functions.");
+                return ERRORTOK;
+            }
+            if (isPrivateName)
+                ident = m_vm->propertyNames->lookUpPrivateName(*ident);
+            else if (*ident == m_vm->propertyNames->undefinedKeyword)
+                tokenData->ident = &m_vm->propertyNames->builtinNames().undefinedPrivateName();
+            if (!ident)
+                return INVALID_PRIVATE_NAME_ERRORTOK;
+        }
+        tokenData->ident = ident;
+    } else
+        tokenData->ident = 0;
+
+    if (UNLIKELY((remaining < maxTokenLength) && !(lexerFlags & LexerFlagsIgnoreReservedWords)) && !isPrivateName) {
+        ASSERT(shouldCreateIdentifier);
+        if (remaining < maxTokenLength) {
+            const HashTableValue* entry = JSC::mainTable.entry(*ident);
+            ASSERT((remaining < maxTokenLength) || !entry);
+            if (!entry)
+                return IDENT;
+            JSTokenType token = static_cast<JSTokenType>(entry->lexerValue());
+            return (token != RESERVED_IF_STRICT) || strictMode ? token : IDENT;
+        }
+        return IDENT;
+    }
+
+    return IDENT;
+}
+
+template <>
+template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<UChar>::parseIdentifier(JSTokenData* tokenData, unsigned lexerFlags, bool strictMode)
+{
+    const ptrdiff_t remaining = m_codeEnd - m_code;
+    if ((remaining >= maxTokenLength) && !(lexerFlags & LexerFlagsIgnoreReservedWords)) {
+        JSTokenType keyword = parseKeyword<shouldCreateIdentifier>(tokenData);
+        if (keyword != IDENT) {
+            ASSERT((!shouldCreateIdentifier) || tokenData->ident);
+            return keyword == RESERVED_IF_STRICT && !strictMode ? IDENT : keyword;
+        }
+    }
+    
+    bool isPrivateName = m_current == '@' && m_parsingBuiltinFunction;
+    if (isPrivateName)
+        shift();
+
+    const UChar* identifierStart = currentSourcePtr();
+    int identifierLineStart = currentLineStartOffset();
+
+    UChar orAllChars = 0;
+    
+    while (isIdentPart(m_current)) {
+        orAllChars |= m_current;
+        shift();
+    }
+    
+    if (UNLIKELY(m_current == '\\')) {
+        ASSERT(!isPrivateName);
+        setOffsetFromSourcePtr(identifierStart, identifierLineStart);
+        return parseIdentifierSlowCase<shouldCreateIdentifier>(tokenData, lexerFlags, strictMode);
+    }
+
+    bool isAll8Bit = false;
+
+    if (!(orAllChars & ~0xff))
+        isAll8Bit = true;
+
+    const Identifier* ident = 0;
+    
+    if (shouldCreateIdentifier || m_parsingBuiltinFunction) {
+        int identifierLength = currentSourcePtr() - identifierStart;
+        if (isAll8Bit)
+            ident = makeIdentifierLCharFromUChar(identifierStart, identifierLength);
+        else
+            ident = makeIdentifier(identifierStart, identifierLength);
+        if (m_parsingBuiltinFunction) {
+            if (!isSafeBuiltinIdentifier(*m_vm, ident) && !isPrivateName) {
+                m_lexErrorMessage = makeString("The use of '", ident->string(), "' is disallowed in builtin functions.");
+                return ERRORTOK;
+            }
+            if (isPrivateName)
+                ident = m_vm->propertyNames->lookUpPrivateName(*ident);
+            else if (*ident == m_vm->propertyNames->undefinedKeyword)
+                tokenData->ident = &m_vm->propertyNames->builtinNames().undefinedPrivateName();
+            if (!ident)
+                return INVALID_PRIVATE_NAME_ERRORTOK;
+        }
+        tokenData->ident = ident;
+    } else
+        tokenData->ident = 0;
+    
+    if (UNLIKELY((remaining < maxTokenLength) && !(lexerFlags & LexerFlagsIgnoreReservedWords)) && !isPrivateName) {
+        ASSERT(shouldCreateIdentifier);
+        if (remaining < maxTokenLength) {
+            const HashTableValue* entry = JSC::mainTable.entry(*ident);
+            ASSERT((remaining < maxTokenLength) || !entry);
+            if (!entry)
+                return IDENT;
+            JSTokenType token = static_cast<JSTokenType>(entry->lexerValue());
+            return (token != RESERVED_IF_STRICT) || strictMode ? token : IDENT;
+        }
+        return IDENT;
+    }
+
+    return IDENT;
+}
+
+template<typename CharacterType> template<bool shouldCreateIdentifier> JSTokenType Lexer<CharacterType>::parseIdentifierSlowCase(JSTokenData* tokenData, unsigned lexerFlags, bool strictMode)
+{
+    auto identifierStart = currentSourcePtr();
+    bool bufferRequired = false;
+
+    while (true) {
+        if (LIKELY(isIdentPart(m_current))) {
+            shift();
+            continue;
+        }
+        if (LIKELY(m_current != '\\'))
+            break;
+
+        // \uXXXX unicode characters.
+        bufferRequired = true;
+        if (identifierStart != currentSourcePtr())
+            m_buffer16.append(identifierStart, currentSourcePtr() - identifierStart);
+        shift();
+        if (UNLIKELY(m_current != 'u'))
+            return atEnd() ? UNTERMINATED_IDENTIFIER_ESCAPE_ERRORTOK : INVALID_IDENTIFIER_ESCAPE_ERRORTOK;
+        shift();
+        auto character = parseUnicodeEscape();
+        if (UNLIKELY(!character.isValid()))
+            return character.isIncomplete() ? UNTERMINATED_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK : INVALID_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK;
+        if (UNLIKELY(m_buffer16.size() ? !isIdentPart(character.value()) : !isIdentStart(character.value())))
+            return INVALID_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK;
+        if (shouldCreateIdentifier)
+            recordUnicodeCodePoint(character.value());
+        identifierStart = currentSourcePtr();
+    }
+
+    int identifierLength;
+    const Identifier* ident = nullptr;
+    if (shouldCreateIdentifier) {
+        if (!bufferRequired) {
+            identifierLength = currentSourcePtr() - identifierStart;
+            ident = makeIdentifier(identifierStart, identifierLength);
+        } else {
+            if (identifierStart != currentSourcePtr())
+                m_buffer16.append(identifierStart, currentSourcePtr() - identifierStart);
+            ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+        }
+
+        tokenData->ident = ident;
+    } else
+        tokenData->ident = nullptr;
+
+    m_buffer16.shrink(0);
+
+    if (LIKELY(!(lexerFlags & LexerFlagsIgnoreReservedWords))) {
+        ASSERT(shouldCreateIdentifier);
+        const HashTableValue* entry = JSC::mainTable.entry(*ident);
+        if (!entry)
+            return IDENT;
+        JSTokenType token = static_cast<JSTokenType>(entry->lexerValue());
+        return (token != RESERVED_IF_STRICT) || strictMode ? token : IDENT;
+    }
+
+    return IDENT;
+}
+
+static ALWAYS_INLINE bool characterRequiresParseStringSlowCase(LChar character)
+{
+    return character < 0xE;
+}
+
+static ALWAYS_INLINE bool characterRequiresParseStringSlowCase(UChar character)
+{
+    return character < 0xE || character > 0xFF;
+}
+
+template <typename T>
+template <bool shouldBuildStrings> ALWAYS_INLINE typename Lexer<T>::StringParseResult Lexer<T>::parseString(JSTokenData* tokenData, bool strictMode)
+{
+    int startingOffset = currentOffset();
+    int startingLineStartOffset = currentLineStartOffset();
+    int startingLineNumber = lineNumber();
+    T stringQuoteCharacter = m_current;
+    shift();
+
+    const T* stringStart = currentSourcePtr();
+
+    while (m_current != stringQuoteCharacter) {
+        if (UNLIKELY(m_current == '\\')) {
+            if (stringStart != currentSourcePtr() && shouldBuildStrings)
+                append8(stringStart, currentSourcePtr() - stringStart);
+            shift();
+
+            LChar escape = singleEscape(m_current);
+
+            // Most common escape sequences first.
+            if (escape) {
+                if (shouldBuildStrings)
+                    record8(escape);
+                shift();
+            } else if (UNLIKELY(isLineTerminator(m_current)))
+                shiftLineTerminator();
+            else if (m_current == 'x') {
+                shift();
+                if (!isASCIIHexDigit(m_current) || !isASCIIHexDigit(peek(1))) {
+                    m_lexErrorMessage = ASCIILiteral("\\x can only be followed by a hex character sequence");
+                    return (atEnd() || (isASCIIHexDigit(m_current) && (m_code + 1 == m_codeEnd))) ? StringUnterminated : StringCannotBeParsed;
+                }
+                T prev = m_current;
+                shift();
+                if (shouldBuildStrings)
+                    record8(convertHex(prev, m_current));
+                shift();
+            } else {
+                setOffset(startingOffset, startingLineStartOffset);
+                setLineNumber(startingLineNumber);
+                m_buffer8.shrink(0);
+                return parseStringSlowCase<shouldBuildStrings>(tokenData, strictMode);
+            }
+            stringStart = currentSourcePtr();
+            continue;
+        }
+
+        if (UNLIKELY(characterRequiresParseStringSlowCase(m_current))) {
+            setOffset(startingOffset, startingLineStartOffset);
+            setLineNumber(startingLineNumber);
+            m_buffer8.shrink(0);
+            return parseStringSlowCase<shouldBuildStrings>(tokenData, strictMode);
+        }
+
+        shift();
+    }
+
+    if (currentSourcePtr() != stringStart && shouldBuildStrings)
+        append8(stringStart, currentSourcePtr() - stringStart);
+    if (shouldBuildStrings) {
+        tokenData->ident = makeIdentifier(m_buffer8.data(), m_buffer8.size());
+        m_buffer8.shrink(0);
+    } else
+        tokenData->ident = 0;
+
+    return StringParsedSuccessfully;
+}
+
+template <typename T>
+template <bool shouldBuildStrings> ALWAYS_INLINE auto Lexer<T>::parseComplexEscape(EscapeParseMode escapeParseMode, bool strictMode, T stringQuoteCharacter) -> StringParseResult
+{
+    if (m_current == 'x') {
+        shift();
+        if (!isASCIIHexDigit(m_current) || !isASCIIHexDigit(peek(1))) {
+            m_lexErrorMessage = ASCIILiteral("\\x can only be followed by a hex character sequence");
+            return StringCannotBeParsed;
+        }
+        T prev = m_current;
+        shift();
+        if (shouldBuildStrings)
+            record16(convertHex(prev, m_current));
+        shift();
+        return StringParsedSuccessfully;
+    }
+
+    if (m_current == 'u') {
+        shift();
+
+        if (escapeParseMode == EscapeParseMode::String && m_current == stringQuoteCharacter) {
+            if (shouldBuildStrings)
+                record16('u');
+            return StringParsedSuccessfully;
+        }
+
+        auto character = parseUnicodeEscape();
+        if (character.isValid()) {
+            if (shouldBuildStrings)
+                recordUnicodeCodePoint(character.value());
+            return StringParsedSuccessfully;
+        }
+
+        m_lexErrorMessage = ASCIILiteral("\\u can only be followed by a Unicode character sequence");
+        return character.isIncomplete() ? StringUnterminated : StringCannotBeParsed;
+    }
+
+    if (strictMode) {
+        if (isASCIIDigit(m_current)) {
+            // The only valid numeric escape in strict mode is '\0', and this must not be followed by a decimal digit.
+            int character1 = m_current;
+            shift();
+            if (character1 != '0' || isASCIIDigit(m_current)) {
+                m_lexErrorMessage = ASCIILiteral("The only valid numeric escape in strict mode is '\\0'");
+                return StringCannotBeParsed;
+            }
+            if (shouldBuildStrings)
+                record16(0);
+            return StringParsedSuccessfully;
+        }
+    } else {
+        if (isASCIIOctalDigit(m_current)) {
+            // Octal character sequences
+            T character1 = m_current;
+            shift();
+            if (isASCIIOctalDigit(m_current)) {
+                // Two octal characters
+                T character2 = m_current;
+                shift();
+                if (character1 >= '0' && character1 <= '3' && isASCIIOctalDigit(m_current)) {
+                    if (shouldBuildStrings)
+                        record16((character1 - '0') * 64 + (character2 - '0') * 8 + m_current - '0');
+                    shift();
+                } else {
+                    if (shouldBuildStrings)
+                        record16((character1 - '0') * 8 + character2 - '0');
+                }
+            } else {
+                if (shouldBuildStrings)
+                    record16(character1 - '0');
+            }
+            return StringParsedSuccessfully;
+        }
+    }
+
+    if (!atEnd()) {
+        if (shouldBuildStrings)
+            record16(m_current);
+        shift();
+        return StringParsedSuccessfully;
+    }
+
+    m_lexErrorMessage = ASCIILiteral("Unterminated string constant");
+    return StringUnterminated;
+}
+
+template <typename T>
+template <bool shouldBuildStrings> auto Lexer<T>::parseStringSlowCase(JSTokenData* tokenData, bool strictMode) -> StringParseResult
+{
+    T stringQuoteCharacter = m_current;
+    shift();
+
+    const T* stringStart = currentSourcePtr();
+
+    while (m_current != stringQuoteCharacter) {
+        if (UNLIKELY(m_current == '\\')) {
+            if (stringStart != currentSourcePtr() && shouldBuildStrings)
+                append16(stringStart, currentSourcePtr() - stringStart);
+            shift();
+
+            LChar escape = singleEscape(m_current);
+
+            // Most common escape sequences first
+            if (escape) {
+                if (shouldBuildStrings)
+                    record16(escape);
+                shift();
+            } else if (UNLIKELY(isLineTerminator(m_current)))
+                shiftLineTerminator();
+            else {
+                StringParseResult result = parseComplexEscape<shouldBuildStrings>(EscapeParseMode::String, strictMode, stringQuoteCharacter);
+                if (result != StringParsedSuccessfully)
+                    return result;
+            }
+
+            stringStart = currentSourcePtr();
+            continue;
+        }
+        // Fast check for characters that require special handling.
+        // Catches 0, \n, \r, 0x2028, and 0x2029 as efficiently
+        // as possible, and lets through all common ASCII characters.
+        if (UNLIKELY(((static_cast<unsigned>(m_current) - 0xE) & 0x2000))) {
+            // New-line or end of input is not allowed
+            if (atEnd() || isLineTerminator(m_current)) {
+                m_lexErrorMessage = ASCIILiteral("Unexpected EOF");
+                return atEnd() ? StringUnterminated : StringCannotBeParsed;
+            }
+            // Anything else is just a normal character
+        }
+        shift();
+    }
+
+    if (currentSourcePtr() != stringStart && shouldBuildStrings)
+        append16(stringStart, currentSourcePtr() - stringStart);
+    if (shouldBuildStrings)
+        tokenData->ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    else
+        tokenData->ident = 0;
+
+    m_buffer16.shrink(0);
+    return StringParsedSuccessfully;
+}
+
+// While the lexer accepts <LF><CR> (not <CR><LF>) sequence
+// as one line terminator and increments one line number,
+// TemplateLiteral considers it as two line terminators <LF> and <CR>.
+//
+// TemplateLiteral normalizes line terminators as follows.
+//
+// <LF> => <LF>
+// <CR> => <LF>
+// <CR><LF> => <LF>
+// <\u2028> => <\u2028>
+// <\u2029> => <\u2029>
+//
+// So, <LF><CR> should be normalized to <LF><LF>.
+// However, the lexer should increment the line number only once for <LF><CR>.
+//
+// To achieve this, LineNumberAdder holds the current status of line terminator sequence.
+// When TemplateLiteral lexer encounters a line terminator, it notifies to LineNumberAdder.
+// LineNumberAdder maintains the status and increments the line number when it's necessary.
+// For example, LineNumberAdder increments the line number only once for <LF><CR> and <CR><LF>.
+template<typename CharacterType>
+class LineNumberAdder {
+public:
+    LineNumberAdder(int& lineNumber)
+        : m_lineNumber(lineNumber)
+    {
+    }
+
+    void clear()
+    {
+        m_previous = 0;
+    }
+
+    void add(CharacterType character)
+    {
+        ASSERT(Lexer<CharacterType>::isLineTerminator(character));
+        if ((character + m_previous) == ('\n' + '\r'))
+            m_previous = 0;
+        else {
+            ++m_lineNumber;
+            m_previous = character;
+        }
+    }
+
+private:
+    int& m_lineNumber;
+    CharacterType m_previous { 0 };
+};
+
+template <typename T>
+template <bool shouldBuildStrings> typename Lexer<T>::StringParseResult Lexer<T>::parseTemplateLiteral(JSTokenData* tokenData, RawStringsBuildMode rawStringsBuildMode)
+{
+    const T* stringStart = currentSourcePtr();
+    const T* rawStringStart = currentSourcePtr();
+
+    LineNumberAdder<T> lineNumberAdder(m_lineNumber);
+
+    while (m_current != '`') {
+        if (UNLIKELY(m_current == '\\')) {
+            lineNumberAdder.clear();
+            if (stringStart != currentSourcePtr() && shouldBuildStrings)
+                append16(stringStart, currentSourcePtr() - stringStart);
+            shift();
+
+            LChar escape = singleEscape(m_current);
+
+            // Most common escape sequences first.
+            if (escape) {
+                if (shouldBuildStrings)
+                    record16(escape);
+                shift();
+            } else if (UNLIKELY(isLineTerminator(m_current))) {
+                // Normalize <CR>, <CR><LF> to <LF>.
+                if (m_current == '\r') {
+                    if (shouldBuildStrings) {
+                        ASSERT_WITH_MESSAGE(rawStringStart != currentSourcePtr(), "We should have at least shifted the escape.");
+
+                        if (rawStringsBuildMode == RawStringsBuildMode::BuildRawStrings) {
+                            m_bufferForRawTemplateString16.append(rawStringStart, currentSourcePtr() - rawStringStart);
+                            m_bufferForRawTemplateString16.append('\n');
+                        }
+                    }
+
+                    lineNumberAdder.add(m_current);
+                    shift();
+                    if (m_current == '\n') {
+                        lineNumberAdder.add(m_current);
+                        shift();
+                    }
+
+                    rawStringStart = currentSourcePtr();
+                } else {
+                    lineNumberAdder.add(m_current);
+                    shift();
+                }
+            } else {
+                bool strictMode = true;
+                StringParseResult result = parseComplexEscape<shouldBuildStrings>(EscapeParseMode::Template, strictMode, '`');
+                if (result != StringParsedSuccessfully)
+                    return result;
+            }
+
+            stringStart = currentSourcePtr();
+            continue;
+        }
+
+        if (m_current == '$' && peek(1) == '{')
+            break;
+
+        // Fast check for characters that require special handling.
+        // Catches 0, \n, \r, 0x2028, and 0x2029 as efficiently
+        // as possible, and lets through all common ASCII characters.
+        if (UNLIKELY(((static_cast<unsigned>(m_current) - 0xE) & 0x2000))) {
+            // End of input is not allowed.
+            // Unlike String, line terminator is allowed.
+            if (atEnd()) {
+                m_lexErrorMessage = ASCIILiteral("Unexpected EOF");
+                return atEnd() ? StringUnterminated : StringCannotBeParsed;
+            }
+
+            if (isLineTerminator(m_current)) {
+                if (m_current == '\r') {
+                    // Normalize <CR>, <CR><LF> to <LF>.
+                    if (shouldBuildStrings) {
+                        if (stringStart != currentSourcePtr())
+                            append16(stringStart, currentSourcePtr() - stringStart);
+                        if (rawStringStart != currentSourcePtr() && rawStringsBuildMode == RawStringsBuildMode::BuildRawStrings)
+                            m_bufferForRawTemplateString16.append(rawStringStart, currentSourcePtr() - rawStringStart);
+
+                        record16('\n');
+                        if (rawStringsBuildMode == RawStringsBuildMode::BuildRawStrings)
+                            m_bufferForRawTemplateString16.append('\n');
+                    }
+                    lineNumberAdder.add(m_current);
+                    shift();
+                    if (m_current == '\n') {
+                        lineNumberAdder.add(m_current);
+                        shift();
+                    }
+                    stringStart = currentSourcePtr();
+                    rawStringStart = currentSourcePtr();
+                } else {
+                    lineNumberAdder.add(m_current);
+                    shift();
+                }
+                continue;
+            }
+            // Anything else is just a normal character
+        }
+
+        lineNumberAdder.clear();
+        shift();
+    }
+
+    bool isTail = m_current == '`';
+
+    if (shouldBuildStrings) {
+        if (currentSourcePtr() != stringStart)
+            append16(stringStart, currentSourcePtr() - stringStart);
+        if (rawStringStart != currentSourcePtr() && rawStringsBuildMode == RawStringsBuildMode::BuildRawStrings)
+            m_bufferForRawTemplateString16.append(rawStringStart, currentSourcePtr() - rawStringStart);
+    }
+
+    if (shouldBuildStrings) {
+        tokenData->cooked = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+        // Line terminator normalization (e.g. <CR> => <LF>) should be applied to both the raw and cooked representations.
+        if (rawStringsBuildMode == RawStringsBuildMode::BuildRawStrings)
+            tokenData->raw = makeIdentifier(m_bufferForRawTemplateString16.data(), m_bufferForRawTemplateString16.size());
+        else
+            tokenData->raw = makeEmptyIdentifier();
+    } else {
+        tokenData->cooked = makeEmptyIdentifier();
+        tokenData->raw = makeEmptyIdentifier();
+    }
+    tokenData->isTail = isTail;
+
+    m_buffer16.shrink(0);
+    m_bufferForRawTemplateString16.shrink(0);
+
+    if (isTail) {
+        // Skip `
+        shift();
+    } else {
+        // Skip $ and {
+        shift();
+        shift();
+    }
+
+    return StringParsedSuccessfully;
+}
+
+template <typename T>
+ALWAYS_INLINE void Lexer<T>::parseHex(double& returnValue)
+{
+    // Optimization: most hexadecimal values fit into 4 bytes.
+    uint32_t hexValue = 0;
+    int maximumDigits = 7;
+
+    do {
+        hexValue = (hexValue << 4) + toASCIIHexValue(m_current);
+        shift();
+        --maximumDigits;
+    } while (isASCIIHexDigit(m_current) && maximumDigits >= 0);
+
+    if (maximumDigits >= 0) {
+        returnValue = hexValue;
+        return;
+    }
+
+    // No more place in the hexValue buffer.
+    // The values are shifted out and placed into the m_buffer8 vector.
+    for (int i = 0; i < 8; ++i) {
+         int digit = hexValue >> 28;
+         if (digit < 10)
+             record8(digit + '0');
+         else
+             record8(digit - 10 + 'a');
+         hexValue <<= 4;
+    }
+
+    while (isASCIIHexDigit(m_current)) {
+        record8(m_current);
+        shift();
+    }
+
+    returnValue = parseIntOverflow(m_buffer8.data(), m_buffer8.size(), 16);
+}
+
+template <typename T>
+ALWAYS_INLINE bool Lexer<T>::parseBinary(double& returnValue)
+{
+    // Optimization: most binary values fit into 4 bytes.
+    uint32_t binaryValue = 0;
+    const unsigned maximumDigits = 32;
+    int digit = maximumDigits - 1;
+    // Temporary buffer for the digits. Makes easier
+    // to reconstruct the input characters when needed.
+    LChar digits[maximumDigits];
+
+    do {
+        binaryValue = (binaryValue << 1) + (m_current - '0');
+        digits[digit] = m_current;
+        shift();
+        --digit;
+    } while (isASCIIBinaryDigit(m_current) && digit >= 0);
+
+    if (!isASCIIDigit(m_current) && digit >= 0) {
+        returnValue = binaryValue;
+        return true;
+    }
+
+    for (int i = maximumDigits - 1; i > digit; --i)
+        record8(digits[i]);
+
+    while (isASCIIBinaryDigit(m_current)) {
+        record8(m_current);
+        shift();
+    }
+
+    if (isASCIIDigit(m_current)) {
+        returnValue = 0;
+        return false;
+    }
+
+    returnValue = parseIntOverflow(m_buffer8.data(), m_buffer8.size(), 2);
+    return true;
+}
+
+template <typename T>
+ALWAYS_INLINE bool Lexer<T>::parseOctal(double& returnValue)
+{
+    // Optimization: most octal values fit into 4 bytes.
+    uint32_t octalValue = 0;
+    const unsigned maximumDigits = 10;
+    int digit = maximumDigits - 1;
+    // Temporary buffer for the digits. Makes easier
+    // to reconstruct the input characters when needed.
+    LChar digits[maximumDigits];
+
+    do {
+        octalValue = octalValue * 8 + (m_current - '0');
+        digits[digit] = m_current;
+        shift();
+        --digit;
+    } while (isASCIIOctalDigit(m_current) && digit >= 0);
+
+    if (!isASCIIDigit(m_current) && digit >= 0) {
+        returnValue = octalValue;
+        return true;
+    }
+
+    for (int i = maximumDigits - 1; i > digit; --i)
+         record8(digits[i]);
+
+    while (isASCIIOctalDigit(m_current)) {
+        record8(m_current);
+        shift();
+    }
+
+    if (isASCIIDigit(m_current)) {
+        returnValue = 0;
+        return false;
+    }
+
+    returnValue = parseIntOverflow(m_buffer8.data(), m_buffer8.size(), 8);
+    return true;
+}
+
+template <typename T>
+ALWAYS_INLINE bool Lexer<T>::parseDecimal(double& returnValue)
+{
+    // Optimization: most decimal values fit into 4 bytes.
+    uint32_t decimalValue = 0;
+
+    // Since parseOctal may be executed before parseDecimal,
+    // the m_buffer8 may hold ascii digits.
+    if (!m_buffer8.size()) {
+        const unsigned maximumDigits = 10;
+        int digit = maximumDigits - 1;
+        // Temporary buffer for the digits. Makes easier
+        // to reconstruct the input characters when needed.
+        LChar digits[maximumDigits];
+
+        do {
+            decimalValue = decimalValue * 10 + (m_current - '0');
+            digits[digit] = m_current;
+            shift();
+            --digit;
+        } while (isASCIIDigit(m_current) && digit >= 0);
+
+        if (digit >= 0 && m_current != '.' && (m_current | 0x20) != 'e') {
+            returnValue = decimalValue;
+            return true;
+        }
+
+        for (int i = maximumDigits - 1; i > digit; --i)
+            record8(digits[i]);
+    }
+
+    while (isASCIIDigit(m_current)) {
+        record8(m_current);
+        shift();
+    }
+
+    return false;
+}
+
+template <typename T>
+ALWAYS_INLINE void Lexer<T>::parseNumberAfterDecimalPoint()
+{
+    record8('.');
+    while (isASCIIDigit(m_current)) {
+        record8(m_current);
+        shift();
+    }
+}
+
+template <typename T>
+ALWAYS_INLINE bool Lexer<T>::parseNumberAfterExponentIndicator()
+{
+    record8('e');
+    shift();
+    if (m_current == '+' || m_current == '-') {
+        record8(m_current);
+        shift();
+    }
+
+    if (!isASCIIDigit(m_current))
+        return false;
+
+    do {
+        record8(m_current);
+        shift();
+    } while (isASCIIDigit(m_current));
+    return true;
+}
+
+template <typename T>
+ALWAYS_INLINE bool Lexer<T>::parseMultilineComment()
+{
+    while (true) {
+        while (UNLIKELY(m_current == '*')) {
+            shift();
+            if (m_current == '/') {
+                shift();
+                return true;
+            }
+        }
+
+        if (atEnd())
+            return false;
+
+        if (isLineTerminator(m_current)) {
+            shiftLineTerminator();
+            m_terminator = true;
+        } else
+            shift();
+    }
+}
+
+template <typename T>
+ALWAYS_INLINE void Lexer<T>::parseCommentDirective()
+{
+    // sourceURL and sourceMappingURL directives.
+    if (!consume("source"))
+        return;
+
+    if (consume("URL=")) {
+        m_sourceURLDirective = parseCommentDirectiveValue();
+        return;
+    }
+
+    if (consume("MappingURL=")) {
+        m_sourceMappingURLDirective = parseCommentDirectiveValue();
+        return;
+    }
+}
+
+template <typename T>
+ALWAYS_INLINE String Lexer<T>::parseCommentDirectiveValue()
+{
+    skipWhitespace();
+    const T* stringStart = currentSourcePtr();
+    while (!isWhiteSpace(m_current) && !isLineTerminator(m_current) && m_current != '"' && m_current != '\'' && !atEnd())
+        shift();
+    const T* stringEnd = currentSourcePtr();
+    skipWhitespace();
+
+    if (!isLineTerminator(m_current) && !atEnd())
+        return String();
+
+    append8(stringStart, stringEnd - stringStart);
+    String result = String(m_buffer8.data(), m_buffer8.size());
+    m_buffer8.shrink(0);
+    return result;
+}
+
+template <typename T>
+template <unsigned length>
+ALWAYS_INLINE bool Lexer<T>::consume(const char (&input)[length])
+{
+    unsigned lengthToCheck = length - 1; // Ignore the ending NULL byte in the string literal.
+
+    unsigned i = 0;
+    for (; i < lengthToCheck && m_current == input[i]; i++)
+        shift();
+
+    return i == lengthToCheck;
+}
+
+template <typename T>
+bool Lexer<T>::nextTokenIsColon()
+{
+    const T* code = m_code;
+    while (code < m_codeEnd && (isWhiteSpace(*code) || isLineTerminator(*code)))
+        code++;
+    
+    return code < m_codeEnd && *code == ':';
+}
+
+template <typename T>
+void Lexer<T>::fillTokenInfo(JSToken* tokenRecord, JSTokenType token, int lineNumber, int endOffset, int lineStartOffset, JSTextPosition endPosition)
+{
+    JSTokenLocation* tokenLocation = &tokenRecord->m_location;
+    tokenLocation->line = lineNumber;
+    tokenLocation->endOffset = endOffset;
+    tokenLocation->lineStartOffset = lineStartOffset;
+    ASSERT(tokenLocation->endOffset >= tokenLocation->lineStartOffset);
+    tokenRecord->m_endPosition = endPosition;
+    m_lastToken = token;
+}
+
+template <typename T>
+JSTokenType Lexer<T>::lex(JSToken* tokenRecord, unsigned lexerFlags, bool strictMode)
+{
+    JSTokenData* tokenData = &tokenRecord->m_data;
+    JSTokenLocation* tokenLocation = &tokenRecord->m_location;
+    m_lastTokenLocation = JSTokenLocation(tokenRecord->m_location);
+    
+    ASSERT(!m_error);
+    ASSERT(m_buffer8.isEmpty());
+    ASSERT(m_buffer16.isEmpty());
+
+    JSTokenType token = ERRORTOK;
+    m_terminator = false;
+
+start:
+    skipWhitespace();
+
+    if (atEnd())
+        return EOFTOK;
+    
+    tokenLocation->startOffset = currentOffset();
+    ASSERT(currentOffset() >= currentLineStartOffset());
+    tokenRecord->m_startPosition = currentPosition();
+
+    CharacterType type;
+    if (LIKELY(isLatin1(m_current)))
+        type = static_cast<CharacterType>(typesOfLatin1Characters[m_current]);
+    else if (isNonLatin1IdentStart(m_current))
+        type = CharacterIdentifierStart;
+    else if (isLineTerminator(m_current))
+        type = CharacterLineTerminator;
+    else
+        type = CharacterInvalid;
+
+    switch (type) {
+    case CharacterGreater:
+        shift();
+        if (m_current == '>') {
+            shift();
+            if (m_current == '>') {
+                shift();
+                if (m_current == '=') {
+                    shift();
+                    token = URSHIFTEQUAL;
+                    break;
+                }
+                token = URSHIFT;
+                break;
+            }
+            if (m_current == '=') {
+                shift();
+                token = RSHIFTEQUAL;
+                break;
+            }
+            token = RSHIFT;
+            break;
+        }
+        if (m_current == '=') {
+            shift();
+            token = GE;
+            break;
+        }
+        token = GT;
+        break;
+    case CharacterEqual: {
+        if (peek(1) == '>') {
+            token = ARROWFUNCTION;
+            tokenData->line = lineNumber();
+            tokenData->offset = currentOffset();
+            tokenData->lineStartOffset = currentLineStartOffset();
+            ASSERT(tokenData->offset >= tokenData->lineStartOffset);
+            shift();
+            shift();
+            break;
+        }
+
+        shift();
+        if (m_current == '=') {
+            shift();
+            if (m_current == '=') {
+                shift();
+                token = STREQ;
+                break;
+            }
+            token = EQEQ;
+            break;
+        }
+        token = EQUAL;
+        break;
+    }
+    case CharacterLess:
+        shift();
+        if (m_current == '!' && peek(1) == '-' && peek(2) == '-') {
+            if (m_scriptMode == JSParserScriptMode::Classic) {
+                // <!-- marks the beginning of a line comment (for www usage)
+                goto inSingleLineComment;
+            }
+        }
+        if (m_current == '<') {
+            shift();
+            if (m_current == '=') {
+                shift();
+                token = LSHIFTEQUAL;
+                break;
+            }
+            token = LSHIFT;
+            break;
+        }
+        if (m_current == '=') {
+            shift();
+            token = LE;
+            break;
+        }
+        token = LT;
+        break;
+    case CharacterExclamationMark:
+        shift();
+        if (m_current == '=') {
+            shift();
+            if (m_current == '=') {
+                shift();
+                token = STRNEQ;
+                break;
+            }
+            token = NE;
+            break;
+        }
+        token = EXCLAMATION;
+        break;
+    case CharacterAdd:
+        shift();
+        if (m_current == '+') {
+            shift();
+            token = (!m_terminator) ? PLUSPLUS : AUTOPLUSPLUS;
+            break;
+        }
+        if (m_current == '=') {
+            shift();
+            token = PLUSEQUAL;
+            break;
+        }
+        token = PLUS;
+        break;
+    case CharacterSub:
+        shift();
+        if (m_current == '-') {
+            shift();
+            if (m_atLineStart && m_current == '>') {
+                if (m_scriptMode == JSParserScriptMode::Classic) {
+                    shift();
+                    goto inSingleLineComment;
+                }
+            }
+            token = (!m_terminator) ? MINUSMINUS : AUTOMINUSMINUS;
+            break;
+        }
+        if (m_current == '=') {
+            shift();
+            token = MINUSEQUAL;
+            break;
+        }
+        token = MINUS;
+        break;
+    case CharacterMultiply:
+        shift();
+        if (m_current == '=') {
+            shift();
+            token = MULTEQUAL;
+            break;
+        }
+        if (m_current == '*') {
+            shift();
+            if (m_current == '=') {
+                shift();
+                token = POWEQUAL;
+                break;
+            }
+            token = POW;
+            break;
+        }
+        token = TIMES;
+        break;
+    case CharacterSlash:
+        shift();
+        if (m_current == '/') {
+            shift();
+            goto inSingleLineCommentCheckForDirectives;
+        }
+        if (m_current == '*') {
+            shift();
+            if (parseMultilineComment())
+                goto start;
+            m_lexErrorMessage = ASCIILiteral("Multiline comment was not closed properly");
+            token = UNTERMINATED_MULTILINE_COMMENT_ERRORTOK;
+            goto returnError;
+        }
+        if (m_current == '=') {
+            shift();
+            token = DIVEQUAL;
+            break;
+        }
+        token = DIVIDE;
+        break;
+    case CharacterAnd:
+        shift();
+        if (m_current == '&') {
+            shift();
+            token = AND;
+            break;
+        }
+        if (m_current == '=') {
+            shift();
+            token = ANDEQUAL;
+            break;
+        }
+        token = BITAND;
+        break;
+    case CharacterXor:
+        shift();
+        if (m_current == '=') {
+            shift();
+            token = XOREQUAL;
+            break;
+        }
+        token = BITXOR;
+        break;
+    case CharacterModulo:
+        shift();
+        if (m_current == '=') {
+            shift();
+            token = MODEQUAL;
+            break;
+        }
+        token = MOD;
+        break;
+    case CharacterOr:
+        shift();
+        if (m_current == '=') {
+            shift();
+            token = OREQUAL;
+            break;
+        }
+        if (m_current == '|') {
+            shift();
+            token = OR;
+            break;
+        }
+        token = BITOR;
+        break;
+    case CharacterOpenParen:
+        token = OPENPAREN;
+        tokenData->line = lineNumber();
+        tokenData->offset = currentOffset();
+        tokenData->lineStartOffset = currentLineStartOffset();
+        shift();
+        break;
+    case CharacterCloseParen:
+        token = CLOSEPAREN;
+        shift();
+        break;
+    case CharacterOpenBracket:
+        token = OPENBRACKET;
+        shift();
+        break;
+    case CharacterCloseBracket:
+        token = CLOSEBRACKET;
+        shift();
+        break;
+    case CharacterComma:
+        token = COMMA;
+        shift();
+        break;
+    case CharacterColon:
+        token = COLON;
+        shift();
+        break;
+    case CharacterQuestion:
+        token = QUESTION;
+        shift();
+        break;
+    case CharacterTilde:
+        token = TILDE;
+        shift();
+        break;
+    case CharacterSemicolon:
+        shift();
+        token = SEMICOLON;
+        break;
+    case CharacterOpenBrace:
+        tokenData->line = lineNumber();
+        tokenData->offset = currentOffset();
+        tokenData->lineStartOffset = currentLineStartOffset();
+        ASSERT(tokenData->offset >= tokenData->lineStartOffset);
+        shift();
+        token = OPENBRACE;
+        break;
+    case CharacterCloseBrace:
+        tokenData->line = lineNumber();
+        tokenData->offset = currentOffset();
+        tokenData->lineStartOffset = currentLineStartOffset();
+        ASSERT(tokenData->offset >= tokenData->lineStartOffset);
+        shift();
+        token = CLOSEBRACE;
+        break;
+    case CharacterDot:
+        shift();
+        if (!isASCIIDigit(m_current)) {
+            if (UNLIKELY((m_current == '.') && (peek(1) == '.'))) {
+                shift();
+                shift();
+                token = DOTDOTDOT;
+                break;
+            }
+            token = DOT;
+            break;
+        }
+        goto inNumberAfterDecimalPoint;
+    case CharacterZero:
+        shift();
+        if ((m_current | 0x20) == 'x') {
+            if (!isASCIIHexDigit(peek(1))) {
+                m_lexErrorMessage = ASCIILiteral("No hexadecimal digits after '0x'");
+                token = UNTERMINATED_HEX_NUMBER_ERRORTOK;
+                goto returnError;
+            }
+
+            // Shift out the 'x' prefix.
+            shift();
+
+            parseHex(tokenData->doubleValue);
+            if (isIdentStart(m_current)) {
+                m_lexErrorMessage = ASCIILiteral("No space between hexadecimal literal and identifier");
+                token = UNTERMINATED_HEX_NUMBER_ERRORTOK;
+                goto returnError;
+            }
+            token = tokenTypeForIntegerLikeToken(tokenData->doubleValue);
+            m_buffer8.shrink(0);
+            break;
+        }
+        if ((m_current | 0x20) == 'b') {
+            if (!isASCIIBinaryDigit(peek(1))) {
+                m_lexErrorMessage = ASCIILiteral("No binary digits after '0b'");
+                token = UNTERMINATED_BINARY_NUMBER_ERRORTOK;
+                goto returnError;
+            }
+
+            // Shift out the 'b' prefix.
+            shift();
+
+            parseBinary(tokenData->doubleValue);
+            if (isIdentStart(m_current)) {
+                m_lexErrorMessage = ASCIILiteral("No space between binary literal and identifier");
+                token = UNTERMINATED_BINARY_NUMBER_ERRORTOK;
+                goto returnError;
+            }
+            token = tokenTypeForIntegerLikeToken(tokenData->doubleValue);
+            m_buffer8.shrink(0);
+            break;
+        }
+
+        if ((m_current | 0x20) == 'o') {
+            if (!isASCIIOctalDigit(peek(1))) {
+                m_lexErrorMessage = ASCIILiteral("No octal digits after '0o'");
+                token = UNTERMINATED_OCTAL_NUMBER_ERRORTOK;
+                goto returnError;
+            }
+
+            // Shift out the 'o' prefix.
+            shift();
+
+            parseOctal(tokenData->doubleValue);
+            if (isIdentStart(m_current)) {
+                m_lexErrorMessage = ASCIILiteral("No space between octal literal and identifier");
+                token = UNTERMINATED_OCTAL_NUMBER_ERRORTOK;
+                goto returnError;
+            }
+            token = tokenTypeForIntegerLikeToken(tokenData->doubleValue);
+            m_buffer8.shrink(0);
+            break;
+        }
+
+        record8('0');
+        if (strictMode && isASCIIDigit(m_current)) {
+            m_lexErrorMessage = ASCIILiteral("Decimal integer literals with a leading zero are forbidden in strict mode");
+            token = UNTERMINATED_OCTAL_NUMBER_ERRORTOK;
+            goto returnError;
+        }
+        if (isASCIIOctalDigit(m_current)) {
+            if (parseOctal(tokenData->doubleValue)) {
+                token = tokenTypeForIntegerLikeToken(tokenData->doubleValue);
+            }
+        }
+        FALLTHROUGH;
+    case CharacterNumber:
+        if (LIKELY(token != INTEGER && token != DOUBLE)) {
+            if (!parseDecimal(tokenData->doubleValue)) {
+                token = INTEGER;
+                if (m_current == '.') {
+                    shift();
+inNumberAfterDecimalPoint:
+                    parseNumberAfterDecimalPoint();
+                    token = DOUBLE;
+                }
+                if ((m_current | 0x20) == 'e') {
+                    if (!parseNumberAfterExponentIndicator()) {
+                        m_lexErrorMessage = ASCIILiteral("Non-number found after exponent indicator");
+                        token = atEnd() ? UNTERMINATED_NUMERIC_LITERAL_ERRORTOK : INVALID_NUMERIC_LITERAL_ERRORTOK;
+                        goto returnError;
+                    }
+                }
+                size_t parsedLength;
+                tokenData->doubleValue = parseDouble(m_buffer8.data(), m_buffer8.size(), parsedLength);
+                if (token == INTEGER)
+                    token = tokenTypeForIntegerLikeToken(tokenData->doubleValue);
+            } else
+                token = tokenTypeForIntegerLikeToken(tokenData->doubleValue);
+        }
+
+        if (UNLIKELY(isIdentStart(m_current))) {
+            m_lexErrorMessage = ASCIILiteral("No identifiers allowed directly after numeric literal");
+            token = atEnd() ? UNTERMINATED_NUMERIC_LITERAL_ERRORTOK : INVALID_NUMERIC_LITERAL_ERRORTOK;
+            goto returnError;
+        }
+        m_buffer8.shrink(0);
+        break;
+    case CharacterQuote: {
+        StringParseResult result = StringCannotBeParsed;
+        if (lexerFlags & LexerFlagsDontBuildStrings)
+            result = parseString<false>(tokenData, strictMode);
+        else
+            result = parseString<true>(tokenData, strictMode);
+
+        if (UNLIKELY(result != StringParsedSuccessfully)) {
+            token = result == StringUnterminated ? UNTERMINATED_STRING_LITERAL_ERRORTOK : INVALID_STRING_LITERAL_ERRORTOK;
+            goto returnError;
+        }
+        shift();
+        token = STRING;
+        break;
+        }
+    case CharacterBackQuote: {
+        // Skip backquote.
+        shift();
+        StringParseResult result = StringCannotBeParsed;
+        if (lexerFlags & LexerFlagsDontBuildStrings)
+            result = parseTemplateLiteral<false>(tokenData, RawStringsBuildMode::BuildRawStrings);
+        else
+            result = parseTemplateLiteral<true>(tokenData, RawStringsBuildMode::BuildRawStrings);
+
+        if (UNLIKELY(result != StringParsedSuccessfully)) {
+            token = result == StringUnterminated ? UNTERMINATED_TEMPLATE_LITERAL_ERRORTOK : INVALID_TEMPLATE_LITERAL_ERRORTOK;
+            goto returnError;
+        }
+        token = TEMPLATE;
+        break;
+        }
+    case CharacterIdentifierStart:
+        ASSERT(isIdentStart(m_current));
+        FALLTHROUGH;
+    case CharacterBackSlash:
+        parseIdent:
+        if (lexerFlags & LexexFlagsDontBuildKeywords)
+            token = parseIdentifier<false>(tokenData, lexerFlags, strictMode);
+        else
+            token = parseIdentifier<true>(tokenData, lexerFlags, strictMode);
+        break;
+    case CharacterLineTerminator:
+        ASSERT(isLineTerminator(m_current));
+        shiftLineTerminator();
+        m_atLineStart = true;
+        m_terminator = true;
+        m_lineStart = m_code;
+        goto start;
+    case CharacterPrivateIdentifierStart:
+        if (m_parsingBuiltinFunction)
+            goto parseIdent;
+
+        FALLTHROUGH;
+    case CharacterInvalid:
+        m_lexErrorMessage = invalidCharacterMessage();
+        token = ERRORTOK;
+        goto returnError;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        m_lexErrorMessage = ASCIILiteral("Internal Error");
+        token = ERRORTOK;
+        goto returnError;
+    }
+
+    m_atLineStart = false;
+    goto returnToken;
+
+inSingleLineCommentCheckForDirectives:
+    // Script comment directives like "//# sourceURL=test.js".
+    if (UNLIKELY((m_current == '#' || m_current == '@') && isWhiteSpace(peek(1)))) {
+        shift();
+        shift();
+        parseCommentDirective();
+    }
+    // Fall through to complete single line comment parsing.
+
+inSingleLineComment:
+    {
+        auto lineNumber = m_lineNumber;
+        auto endOffset = currentOffset();
+        auto lineStartOffset = currentLineStartOffset();
+        auto endPosition = currentPosition();
+
+        while (!isLineTerminator(m_current)) {
+            if (atEnd())
+                return EOFTOK;
+            shift();
+        }
+        shiftLineTerminator();
+        m_atLineStart = true;
+        m_terminator = true;
+        m_lineStart = m_code;
+        if (!lastTokenWasRestrKeyword())
+            goto start;
+
+        token = SEMICOLON;
+        fillTokenInfo(tokenRecord, token, lineNumber, endOffset, lineStartOffset, endPosition);
+        return token;
+    }
+
+returnToken:
+    fillTokenInfo(tokenRecord, token, m_lineNumber, currentOffset(), currentLineStartOffset(), currentPosition());
+    return token;
+
+returnError:
+    m_error = true;
+    fillTokenInfo(tokenRecord, token, m_lineNumber, currentOffset(), currentLineStartOffset(), currentPosition());
+    RELEASE_ASSERT(token & ErrorTokenFlag);
+    return token;
+}
+
+template <typename T>
+static inline void orCharacter(UChar&, UChar);
+
+template <>
+inline void orCharacter<LChar>(UChar&, UChar) { }
+
+template <>
+inline void orCharacter<UChar>(UChar& orAccumulator, UChar character)
+{
+    orAccumulator |= character;
+}
+
+template <typename T>
+JSTokenType Lexer<T>::scanRegExp(JSToken* tokenRecord, UChar patternPrefix)
+{
+    JSTokenData* tokenData = &tokenRecord->m_data;
+    ASSERT(m_buffer16.isEmpty());
+
+    bool lastWasEscape = false;
+    bool inBrackets = false;
+    UChar charactersOredTogether = 0;
+
+    if (patternPrefix) {
+        ASSERT(!isLineTerminator(patternPrefix));
+        ASSERT(patternPrefix != '/');
+        ASSERT(patternPrefix != '[');
+        record16(patternPrefix);
+    }
+
+    while (true) {
+        if (isLineTerminator(m_current) || atEnd()) {
+            m_buffer16.shrink(0);
+            JSTokenType token = UNTERMINATED_REGEXP_LITERAL_ERRORTOK;
+            fillTokenInfo(tokenRecord, token, m_lineNumber, currentOffset(), currentLineStartOffset(), currentPosition());
+            m_error = true;
+            m_lexErrorMessage = makeString("Unterminated regular expression literal '", getToken(*tokenRecord), "'");
+            return token;
+        }
+
+        T prev = m_current;
+        
+        shift();
+
+        if (prev == '/' && !lastWasEscape && !inBrackets)
+            break;
+
+        record16(prev);
+        orCharacter<T>(charactersOredTogether, prev);
+
+        if (lastWasEscape) {
+            lastWasEscape = false;
+            continue;
+        }
+
+        switch (prev) {
+        case '[':
+            inBrackets = true;
+            break;
+        case ']':
+            inBrackets = false;
+            break;
+        case '\\':
+            lastWasEscape = true;
+            break;
+        }
+    }
+
+    tokenData->pattern = makeRightSizedIdentifier(m_buffer16.data(), m_buffer16.size(), charactersOredTogether);
+
+    m_buffer16.shrink(0);
+    charactersOredTogether = 0;
+
+    while (isIdentPart(m_current)) {
+        record16(m_current);
+        orCharacter<T>(charactersOredTogether, m_current);
+        shift();
+    }
+
+    tokenData->flags = makeRightSizedIdentifier(m_buffer16.data(), m_buffer16.size(), charactersOredTogether);
+    m_buffer16.shrink(0);
+
+    // Since RegExp always ends with /, m_atLineStart always becomes false.
+    m_atLineStart = false;
+
+    JSTokenType token = REGEXP;
+    fillTokenInfo(tokenRecord, token, m_lineNumber, currentOffset(), currentLineStartOffset(), currentPosition());
+    return token;
+}
+
+template <typename T>
+JSTokenType Lexer<T>::scanTrailingTemplateString(JSToken* tokenRecord, RawStringsBuildMode rawStringsBuildMode)
+{
+    JSTokenData* tokenData = &tokenRecord->m_data;
+    ASSERT(!m_error);
+    ASSERT(m_buffer16.isEmpty());
+
+    // Leading closing brace } is already shifted in the previous token scan.
+    // So in this re-scan phase, shift() is not needed here.
+    StringParseResult result = parseTemplateLiteral<true>(tokenData, rawStringsBuildMode);
+    JSTokenType token = ERRORTOK;
+    if (UNLIKELY(result != StringParsedSuccessfully)) {
+        token = result == StringUnterminated ? UNTERMINATED_TEMPLATE_LITERAL_ERRORTOK : INVALID_TEMPLATE_LITERAL_ERRORTOK;
+        m_error = true;
+    } else
+        token = TEMPLATE;
+
+    // Since TemplateString always ends with ` or }, m_atLineStart always becomes false.
+    m_atLineStart = false;
+    fillTokenInfo(tokenRecord, token, m_lineNumber, currentOffset(), currentLineStartOffset(), currentPosition());
+    return token;
+}
+
+template <typename T>
+void Lexer<T>::clear()
+{
+    m_arena = 0;
+
+    Vector<LChar> newBuffer8;
+    m_buffer8.swap(newBuffer8);
+
+    Vector<UChar> newBuffer16;
+    m_buffer16.swap(newBuffer16);
+
+    Vector<UChar> newBufferForRawTemplateString16;
+    m_bufferForRawTemplateString16.swap(newBufferForRawTemplateString16);
+
+    m_isReparsingFunction = false;
+}
+
+// Instantiate the two flavors of Lexer we need instead of putting most of this file in Lexer.h
+template class Lexer<LChar>;
+template class Lexer<UChar>;
+
+} // namespace JSC
diff --git a/parser/Lexer.h b/parser/Lexer.h
new file mode 100644
index 0000000..e408cc6
--- /dev/null
+++ b/parser/Lexer.h
@@ -0,0 +1,402 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012, 2013 Apple Inc. All rights reserved.
+ *  Copyright (C) 2010 Zoltan Herczeg (zherczeg@inf.u-szeged.hu)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "Lookup.h"
+#include "ParserArena.h"
+#include "ParserTokens.h"
+#include "SourceCode.h"
+#include <wtf/ASCIICType.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+enum LexerFlags {
+    LexerFlagsIgnoreReservedWords = 1, 
+    LexerFlagsDontBuildStrings = 2,
+    LexexFlagsDontBuildKeywords = 4
+};
+
+struct ParsedUnicodeEscapeValue;
+
+bool isLexerKeyword(const Identifier&);
+
+template <typename T>
+class Lexer {
+    WTF_MAKE_NONCOPYABLE(Lexer);
+    WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    Lexer(VM*, JSParserBuiltinMode, JSParserScriptMode);
+    ~Lexer();
+
+    // Character manipulation functions.
+    static bool isWhiteSpace(T character);
+    static bool isLineTerminator(T character);
+    static unsigned char convertHex(int c1, int c2);
+    static UChar convertUnicode(int c1, int c2, int c3, int c4);
+
+    // Functions to set up parsing.
+    void setCode(const SourceCode&, ParserArena*);
+    void setIsReparsingFunction() { m_isReparsingFunction = true; }
+    bool isReparsingFunction() const { return m_isReparsingFunction; }
+
+    JSTokenType lex(JSToken*, unsigned, bool strictMode);
+    bool nextTokenIsColon();
+    int lineNumber() const { return m_lineNumber; }
+    ALWAYS_INLINE int currentOffset() const { return offsetFromSourcePtr(m_code); }
+    ALWAYS_INLINE int currentLineStartOffset() const { return offsetFromSourcePtr(m_lineStart); }
+    ALWAYS_INLINE JSTextPosition currentPosition() const
+    {
+        return JSTextPosition(m_lineNumber, currentOffset(), currentLineStartOffset());
+    }
+    JSTextPosition positionBeforeLastNewline() const { return m_positionBeforeLastNewline; }
+    JSTokenLocation lastTokenLocation() const { return m_lastTokenLocation; }
+    void setLastLineNumber(int lastLineNumber) { m_lastLineNumber = lastLineNumber; }
+    int lastLineNumber() const { return m_lastLineNumber; }
+    bool prevTerminator() const { return m_terminator; }
+    JSTokenType scanRegExp(JSToken*, UChar patternPrefix = 0);
+    enum class RawStringsBuildMode { BuildRawStrings, DontBuildRawStrings };
+    JSTokenType scanTrailingTemplateString(JSToken*, RawStringsBuildMode);
+
+    // Functions for use after parsing.
+    bool sawError() const { return m_error; }
+    void setSawError(bool sawError) { m_error = sawError; }
+    String getErrorMessage() const { return m_lexErrorMessage; }
+    void setErrorMessage(const String& errorMessage) { m_lexErrorMessage = errorMessage; }
+    String sourceURL() const { return m_sourceURLDirective; }
+    String sourceMappingURL() const { return m_sourceMappingURLDirective; }
+    void clear();
+    void setOffset(int offset, int lineStartOffset)
+    {
+        m_error = 0;
+        m_lexErrorMessage = String();
+
+        m_code = sourcePtrFromOffset(offset);
+        m_lineStart = sourcePtrFromOffset(lineStartOffset);
+        ASSERT(currentOffset() >= currentLineStartOffset());
+
+        m_buffer8.resize(0);
+        m_buffer16.resize(0);
+        if (LIKELY(m_code < m_codeEnd))
+            m_current = *m_code;
+        else
+            m_current = 0;
+    }
+    void setLineNumber(int line)
+    {
+        m_lineNumber = line;
+    }
+    void setTerminator(bool terminator)
+    {
+        m_terminator = terminator;
+    }
+
+    JSTokenType lexExpectIdentifier(JSToken*, unsigned, bool strictMode);
+
+    ALWAYS_INLINE StringView getToken(const JSToken& token)
+    {
+        SourceProvider* sourceProvider = m_source->provider();
+        ASSERT_WITH_MESSAGE(token.m_location.startOffset <= token.m_location.endOffset, "Calling this function with the baked token.");
+        return sourceProvider->getRange(token.m_location.startOffset, token.m_location.endOffset);
+    }
+
+private:
+    void record8(int);
+    void append8(const T*, size_t);
+    void record16(int);
+    void record16(T);
+    void recordUnicodeCodePoint(UChar32);
+    void append16(const LChar*, size_t);
+    void append16(const UChar* characters, size_t length) { m_buffer16.append(characters, length); }
+
+    ALWAYS_INLINE void shift();
+    ALWAYS_INLINE bool atEnd() const;
+    ALWAYS_INLINE T peek(int offset) const;
+
+    ParsedUnicodeEscapeValue parseUnicodeEscape();
+    void shiftLineTerminator();
+
+    ALWAYS_INLINE int offsetFromSourcePtr(const T* ptr) const { return ptr - m_codeStart; }
+    ALWAYS_INLINE const T* sourcePtrFromOffset(int offset) const { return m_codeStart + offset; }
+
+    String invalidCharacterMessage() const;
+    ALWAYS_INLINE const T* currentSourcePtr() const;
+    ALWAYS_INLINE void setOffsetFromSourcePtr(const T* sourcePtr, unsigned lineStartOffset) { setOffset(offsetFromSourcePtr(sourcePtr), lineStartOffset); }
+
+    ALWAYS_INLINE void setCodeStart(const StringView&);
+
+    ALWAYS_INLINE const Identifier* makeIdentifier(const LChar* characters, size_t length);
+    ALWAYS_INLINE const Identifier* makeIdentifier(const UChar* characters, size_t length);
+    ALWAYS_INLINE const Identifier* makeLCharIdentifier(const LChar* characters, size_t length);
+    ALWAYS_INLINE const Identifier* makeLCharIdentifier(const UChar* characters, size_t length);
+    ALWAYS_INLINE const Identifier* makeRightSizedIdentifier(const UChar* characters, size_t length, UChar orAllChars);
+    ALWAYS_INLINE const Identifier* makeIdentifierLCharFromUChar(const UChar* characters, size_t length);
+    ALWAYS_INLINE const Identifier* makeEmptyIdentifier();
+
+    ALWAYS_INLINE bool lastTokenWasRestrKeyword() const;
+    
+    ALWAYS_INLINE void skipWhitespace();
+
+    template <int shiftAmount> void internalShift();
+    template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType parseKeyword(JSTokenData*);
+    template <bool shouldBuildIdentifiers> ALWAYS_INLINE JSTokenType parseIdentifier(JSTokenData*, unsigned lexerFlags, bool strictMode);
+    template <bool shouldBuildIdentifiers> NEVER_INLINE JSTokenType parseIdentifierSlowCase(JSTokenData*, unsigned lexerFlags, bool strictMode);
+    enum StringParseResult {
+        StringParsedSuccessfully,
+        StringUnterminated,
+        StringCannotBeParsed
+    };
+    template <bool shouldBuildStrings> ALWAYS_INLINE StringParseResult parseString(JSTokenData*, bool strictMode);
+    template <bool shouldBuildStrings> NEVER_INLINE StringParseResult parseStringSlowCase(JSTokenData*, bool strictMode);
+
+    enum class EscapeParseMode { Template, String };
+    template <bool shouldBuildStrings> ALWAYS_INLINE StringParseResult parseComplexEscape(EscapeParseMode, bool strictMode, T stringQuoteCharacter);
+    template <bool shouldBuildStrings> ALWAYS_INLINE StringParseResult parseTemplateLiteral(JSTokenData*, RawStringsBuildMode);
+    ALWAYS_INLINE void parseHex(double& returnValue);
+    ALWAYS_INLINE bool parseBinary(double& returnValue);
+    ALWAYS_INLINE bool parseOctal(double& returnValue);
+    ALWAYS_INLINE bool parseDecimal(double& returnValue);
+    ALWAYS_INLINE void parseNumberAfterDecimalPoint();
+    ALWAYS_INLINE bool parseNumberAfterExponentIndicator();
+    ALWAYS_INLINE bool parseMultilineComment();
+
+    ALWAYS_INLINE void parseCommentDirective();
+    ALWAYS_INLINE String parseCommentDirectiveValue();
+
+    template <unsigned length>
+    ALWAYS_INLINE bool consume(const char (&input)[length]);
+
+    void fillTokenInfo(JSToken*, JSTokenType, int lineNumber, int endOffset, int lineStartOffset, JSTextPosition endPosition);
+
+    static const size_t initialReadBufferCapacity = 32;
+
+    int m_lineNumber;
+    int m_lastLineNumber;
+
+    Vector<LChar> m_buffer8;
+    Vector<UChar> m_buffer16;
+    Vector<UChar> m_bufferForRawTemplateString16;
+    bool m_terminator;
+    int m_lastToken;
+
+    const SourceCode* m_source;
+    unsigned m_sourceOffset;
+    const T* m_code;
+    const T* m_codeStart;
+    const T* m_codeEnd;
+    const T* m_codeStartPlusOffset;
+    const T* m_lineStart;
+    JSTextPosition m_positionBeforeLastNewline;
+    JSTokenLocation m_lastTokenLocation;
+    bool m_isReparsingFunction;
+    bool m_atLineStart;
+    bool m_error;
+    String m_lexErrorMessage;
+
+    String m_sourceURLDirective;
+    String m_sourceMappingURLDirective;
+
+    T m_current;
+
+    IdentifierArena* m_arena;
+
+    VM* m_vm;
+    bool m_parsingBuiltinFunction;
+    JSParserScriptMode m_scriptMode;
+};
+
+template <>
+ALWAYS_INLINE bool Lexer<LChar>::isWhiteSpace(LChar ch)
+{
+    return ch == ' ' || ch == '\t' || ch == 0xB || ch == 0xC || ch == 0xA0;
+}
+
+template <>
+ALWAYS_INLINE bool Lexer<UChar>::isWhiteSpace(UChar ch)
+{
+    // 0x180E used to be in Zs category before Unicode 6.3, and EcmaScript says that we should keep treating it as such.
+    return (ch < 256) ? Lexer<LChar>::isWhiteSpace(static_cast<LChar>(ch)) : (u_charType(ch) == U_SPACE_SEPARATOR || ch == 0x180E || ch == 0xFEFF);
+}
+
+template <>
+ALWAYS_INLINE bool Lexer<LChar>::isLineTerminator(LChar ch)
+{
+    return ch == '\r' || ch == '\n';
+}
+
+template <>
+ALWAYS_INLINE bool Lexer<UChar>::isLineTerminator(UChar ch)
+{
+    return ch == '\r' || ch == '\n' || (ch & ~1) == 0x2028;
+}
+
+template <typename T>
+inline unsigned char Lexer<T>::convertHex(int c1, int c2)
+{
+    return (toASCIIHexValue(c1) << 4) | toASCIIHexValue(c2);
+}
+
+template <typename T>
+inline UChar Lexer<T>::convertUnicode(int c1, int c2, int c3, int c4)
+{
+    return (convertHex(c1, c2) << 8) | convertHex(c3, c4);
+}
+
+template <typename T>
+ALWAYS_INLINE const Identifier* Lexer<T>::makeIdentifier(const LChar* characters, size_t length)
+{
+    return &m_arena->makeIdentifier(m_vm, characters, length);
+}
+
+template <typename T>
+ALWAYS_INLINE const Identifier* Lexer<T>::makeIdentifier(const UChar* characters, size_t length)
+{
+    return &m_arena->makeIdentifier(m_vm, characters, length);
+}
+
+template <>
+ALWAYS_INLINE const Identifier* Lexer<LChar>::makeRightSizedIdentifier(const UChar* characters, size_t length, UChar)
+{
+    return &m_arena->makeIdentifierLCharFromUChar(m_vm, characters, length);
+}
+
+template <>
+ALWAYS_INLINE const Identifier* Lexer<UChar>::makeRightSizedIdentifier(const UChar* characters, size_t length, UChar orAllChars)
+{
+    if (!(orAllChars & ~0xff))
+        return &m_arena->makeIdentifierLCharFromUChar(m_vm, characters, length);
+
+    return &m_arena->makeIdentifier(m_vm, characters, length);
+}
+
+template <typename T>
+ALWAYS_INLINE const Identifier* Lexer<T>::makeEmptyIdentifier()
+{
+    return &m_arena->makeEmptyIdentifier(m_vm);
+}
+
+template <>
+ALWAYS_INLINE void Lexer<LChar>::setCodeStart(const StringView& sourceString)
+{
+    ASSERT(sourceString.is8Bit());
+    m_codeStart = sourceString.characters8();
+}
+
+template <>
+ALWAYS_INLINE void Lexer<UChar>::setCodeStart(const StringView& sourceString)
+{
+    ASSERT(!sourceString.is8Bit());
+    m_codeStart = sourceString.characters16();
+}
+
+template <typename T>
+ALWAYS_INLINE const Identifier* Lexer<T>::makeIdentifierLCharFromUChar(const UChar* characters, size_t length)
+{
+    return &m_arena->makeIdentifierLCharFromUChar(m_vm, characters, length);
+}
+
+template <typename T>
+ALWAYS_INLINE const Identifier* Lexer<T>::makeLCharIdentifier(const LChar* characters, size_t length)
+{
+    return &m_arena->makeIdentifier(m_vm, characters, length);
+}
+
+template <typename T>
+ALWAYS_INLINE const Identifier* Lexer<T>::makeLCharIdentifier(const UChar* characters, size_t length)
+{
+    return &m_arena->makeIdentifierLCharFromUChar(m_vm, characters, length);
+}
+
+#if ASSERT_DISABLED
+ALWAYS_INLINE bool isSafeBuiltinIdentifier(VM&, const Identifier*) { return true; }
+#else
+bool isSafeBuiltinIdentifier(VM&, const Identifier*);
+#endif
+
+template <typename T>
+ALWAYS_INLINE JSTokenType Lexer<T>::lexExpectIdentifier(JSToken* tokenRecord, unsigned lexerFlags, bool strictMode)
+{
+    JSTokenData* tokenData = &tokenRecord->m_data;
+    JSTokenLocation* tokenLocation = &tokenRecord->m_location;
+    ASSERT((lexerFlags & LexerFlagsIgnoreReservedWords));
+    const T* start = m_code;
+    const T* ptr = start;
+    const T* end = m_codeEnd;
+    JSTextPosition startPosition = currentPosition();
+    if (ptr >= end) {
+        ASSERT(ptr == end);
+        goto slowCase;
+    }
+    if (!WTF::isASCIIAlpha(*ptr))
+        goto slowCase;
+    ++ptr;
+    while (ptr < end) {
+        if (!WTF::isASCIIAlphanumeric(*ptr))
+            break;
+        ++ptr;
+    }
+
+    // Here's the shift
+    if (ptr < end) {
+        if ((!WTF::isASCII(*ptr)) || (*ptr == '\\') || (*ptr == '_') || (*ptr == '$'))
+            goto slowCase;
+        m_current = *ptr;
+    } else
+        m_current = 0;
+
+    m_code = ptr;
+    ASSERT(currentOffset() >= currentLineStartOffset());
+
+    // Create the identifier if needed
+    if (lexerFlags & LexexFlagsDontBuildKeywords
+#if !ASSERT_DISABLED
+        && !m_parsingBuiltinFunction
+#endif
+        )
+        tokenData->ident = 0;
+    else
+        tokenData->ident = makeLCharIdentifier(start, ptr - start);
+
+    tokenLocation->line = m_lineNumber;
+    tokenLocation->lineStartOffset = currentLineStartOffset();
+    tokenLocation->startOffset = offsetFromSourcePtr(start);
+    tokenLocation->endOffset = currentOffset();
+    ASSERT(tokenLocation->startOffset >= tokenLocation->lineStartOffset);
+    tokenRecord->m_startPosition = startPosition;
+    tokenRecord->m_endPosition = currentPosition();
+#if !ASSERT_DISABLED
+    if (m_parsingBuiltinFunction) {
+        if (!isSafeBuiltinIdentifier(*m_vm, tokenData->ident))
+            return ERRORTOK;
+    }
+#endif
+
+    m_lastToken = IDENT;
+    return IDENT;
+    
+slowCase:
+    return lex(tokenRecord, lexerFlags, strictMode);
+}
+
+} // namespace JSC
diff --git a/parser/ModuleAnalyzer.cpp b/parser/ModuleAnalyzer.cpp
new file mode 100644
index 0000000..a7b180b
--- /dev/null
+++ b/parser/ModuleAnalyzer.cpp
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ModuleAnalyzer.h"
+
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSModuleRecord.h"
+#include "ModuleScopeData.h"
+#include "StrongInlines.h"
+
+namespace JSC {
+
+
+ModuleAnalyzer::ModuleAnalyzer(ExecState* exec, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables)
+    : m_vm(&exec->vm())
+    , m_moduleRecord(exec->vm(), JSModuleRecord::create(exec, exec->vm(), exec->lexicalGlobalObject()->moduleRecordStructure(), moduleKey, sourceCode, declaredVariables, lexicalVariables))
+{
+}
+
+void ModuleAnalyzer::exportVariable(ModuleProgramNode& moduleProgramNode, const RefPtr<UniquedStringImpl>& localName, const VariableEnvironmentEntry& variable)
+{
+    // In the parser, we already marked the variables as Exported and Imported.
+    // By leveraging this information, we collect the information that is needed
+    // to construct the module environment.
+    //
+    // I E
+    //   * = exported module local variable
+    // *   = imported binding
+    //     = non-exported module local variable
+    // * * = indirect exported binding
+    //
+    // One exception is namespace binding (like import * as ns from "mod").
+    // This is annotated as an imported, but the actual binding is locate in the
+    // current module.
+
+    if (!variable.isExported())
+        return;
+
+    // Exported module local variable.
+    if (!variable.isImported()) {
+        for (auto& exportName : moduleProgramNode.moduleScopeData().exportedBindings().get(localName.get()))
+            moduleRecord()->addExportEntry(JSModuleRecord::ExportEntry::createLocal(Identifier::fromUid(m_vm, exportName.get()), Identifier::fromUid(m_vm, localName.get())));
+        return;
+    }
+
+    if (variable.isImportedNamespace()) {
+        // Exported namespace binding.
+        // import * as namespace from "mod"
+        // export { namespace }
+        //
+        // Sec 15.2.1.16.1 step 11-a-ii-2-b https://tc39.github.io/ecma262/#sec-parsemodule
+        // Namespace export is handled as local export since a namespace object binding itself is implemented as a local binding.
+        for (auto& exportName : moduleProgramNode.moduleScopeData().exportedBindings().get(localName.get()))
+            moduleRecord()->addExportEntry(JSModuleRecord::ExportEntry::createLocal(Identifier::fromUid(m_vm, exportName.get()), Identifier::fromUid(m_vm, localName.get())));
+        return;
+    }
+
+    // Indirectly exported binding.
+    // import a from "mod"
+    // export { a }
+    std::optional<JSModuleRecord::ImportEntry> optionalImportEntry = moduleRecord()->tryGetImportEntry(localName.get());
+    ASSERT(optionalImportEntry);
+    const JSModuleRecord::ImportEntry& importEntry = *optionalImportEntry;
+    for (auto& exportName : moduleProgramNode.moduleScopeData().exportedBindings().get(localName.get()))
+        moduleRecord()->addExportEntry(JSModuleRecord::ExportEntry::createIndirect(Identifier::fromUid(m_vm, exportName.get()), importEntry.importName, importEntry.moduleRequest));
+}
+
+
+
+JSModuleRecord* ModuleAnalyzer::analyze(ModuleProgramNode& moduleProgramNode)
+{
+    // Traverse the module AST and collect
+    // * Import entries
+    // * Export entries that have FromClause (e.g. export { a } from "mod")
+    // * Export entries that have star (e.g. export * from "mod")
+    // * Aliased export names (e.g. export { a as b })
+    moduleProgramNode.analyzeModule(*this);
+
+    // Based on the collected information, categorize export entries into 3 types.
+    // 1. Local export entries
+    //     This references the local variable in the current module.
+    //     This variable should be allocated in the current module environment as a heap variable.
+    //
+    //     const variable = 20
+    //     export { variable }
+    //
+    // 2. Namespace export entries
+    //     This references the namespace object imported by some import entries.
+    //     This variable itself should be allocated in the current module environment as a heap variable.
+    //     But when the other modules attempt to resolve this export name in this module, this module
+    //     should tell the link to the original module.
+    //
+    //     import * as namespace from "mod"
+    //     export { namespace as mod }
+    //
+    // 3. Indirect export entries
+    //     This references the imported binding name from the other module.
+    //     This module environment itself should hold the pointer to (1) the original module and
+    //     (2) the binding in the original module. The variable itself is allocated in the original
+    //     module. This indirect binding is resolved when the CodeBlock resolves the references.
+    //
+    //     import mod from "mod"
+    //     export { mod }
+    //
+    //     export { a } from "mod"
+    //
+    // And separeted from the above 3 types, we also collect the star export entries.
+    //
+    // 4. Star export entries
+    //     This exports all the names from the specified external module as the current module's name.
+    //
+    //     export * from "mod"
+    for (const auto& pair : m_moduleRecord->declaredVariables())
+        exportVariable(moduleProgramNode, pair.key, pair.value);
+
+    for (const auto& pair : m_moduleRecord->lexicalVariables())
+        exportVariable(moduleProgramNode, pair.key, pair.value);
+
+    if (Options::dumpModuleRecord())
+        m_moduleRecord->dump();
+
+    return m_moduleRecord.get();
+}
+
+} // namespace JSC
diff --git a/parser/ModuleAnalyzer.h b/parser/ModuleAnalyzer.h
new file mode 100644
index 0000000..cdc7e00
--- /dev/null
+++ b/parser/ModuleAnalyzer.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Nodes.h"
+
+namespace JSC {
+
+class JSModuleRecord;
+class SourceCode;
+
+class ModuleAnalyzer {
+    WTF_MAKE_NONCOPYABLE(ModuleAnalyzer);
+public:
+    ModuleAnalyzer(ExecState*, const Identifier& moduleKey, const SourceCode&, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables);
+
+    JSModuleRecord* analyze(ModuleProgramNode&);
+
+    VM& vm() { return *m_vm; }
+
+    JSModuleRecord* moduleRecord() { return m_moduleRecord.get(); }
+
+private:
+    void exportVariable(ModuleProgramNode&, const RefPtr<UniquedStringImpl>&, const VariableEnvironmentEntry&);
+
+    VM* m_vm;
+    Strong<JSModuleRecord> m_moduleRecord;
+};
+
+} // namespace JSC
diff --git a/parser/ModuleScopeData.h b/parser/ModuleScopeData.h
new file mode 100644
index 0000000..2a1eca2
--- /dev/null
+++ b/parser/ModuleScopeData.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+class ModuleScopeData : public RefCounted<ModuleScopeData> {
+WTF_MAKE_NONCOPYABLE(ModuleScopeData);
+WTF_MAKE_FAST_ALLOCATED;
+public:
+    typedef HashMap<RefPtr<UniquedStringImpl>, Vector<RefPtr<UniquedStringImpl>>, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>> IdentifierAliasMap;
+
+    static Ref<ModuleScopeData> create() { return adoptRef(*new ModuleScopeData); }
+
+    const IdentifierAliasMap& exportedBindings() const { return m_exportedBindings; }
+
+    bool exportName(const Identifier& exportedName)
+    {
+        return m_exportedNames.add(exportedName.impl()).isNewEntry;
+    }
+
+    void exportBinding(const Identifier& localName, const Identifier& exportedName)
+    {
+        m_exportedBindings.add(localName.impl(), Vector<RefPtr<UniquedStringImpl>>()).iterator->value.append(exportedName.impl());
+    }
+
+    void exportBinding(const Identifier& localName)
+    {
+        exportBinding(localName, localName);
+    }
+
+private:
+    ModuleScopeData() = default;
+
+    IdentifierSet m_exportedNames { };
+    IdentifierAliasMap m_exportedBindings { };
+};
+
+} // namespace
diff --git a/parser/NodeConstructors.h b/parser/NodeConstructors.h
new file mode 100644
index 0000000..e27e209
--- /dev/null
+++ b/parser/NodeConstructors.h
@@ -0,0 +1,1072 @@
+/*
+ *  Copyright (C) 2009, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "Nodes.h"
+#include "Lexer.h"
+#include "Opcode.h"
+#include "Parser.h"
+
+namespace JSC {
+
+    inline void* ParserArenaFreeable::operator new(size_t size, ParserArena& parserArena)
+    {
+        return parserArena.allocateFreeable(size);
+    }
+
+    inline void* ParserArenaDeletable::operator new(size_t size, ParserArena& parserArena)
+    {
+        return parserArena.allocateDeletable(size);
+    }
+
+    inline ParserArenaRoot::ParserArenaRoot(ParserArena& parserArena)
+    {
+        m_arena.swap(parserArena);
+    }
+
+    inline Node::Node(const JSTokenLocation& location)
+        : m_position(location.line, location.startOffset, location.lineStartOffset)
+        , m_endOffset(-1)
+    {
+        ASSERT(location.startOffset >= location.lineStartOffset);
+    }
+
+    inline ExpressionNode::ExpressionNode(const JSTokenLocation& location, ResultType resultType)
+        : Node(location)
+        , m_resultType(resultType)
+    {
+    }
+
+    inline StatementNode::StatementNode(const JSTokenLocation& location)
+        : Node(location)
+        , m_next(nullptr)
+        , m_lastLine(-1)
+    {
+    }
+
+    inline ConstantNode::ConstantNode(const JSTokenLocation& location, ResultType resultType)
+        : ExpressionNode(location, resultType)
+    {
+    }
+
+    inline NullNode::NullNode(const JSTokenLocation& location)
+        : ConstantNode(location, ResultType::nullType())
+    {
+    }
+
+    inline BooleanNode::BooleanNode(const JSTokenLocation& location, bool value)
+        : ConstantNode(location, ResultType::booleanType())
+        , m_value(value)
+    {
+    }
+
+    inline NumberNode::NumberNode(const JSTokenLocation& location, double value)
+        : ConstantNode(location, JSValue(value).isInt32() ? ResultType::numberTypeIsInt32() : ResultType::numberType())
+        , m_value(value)
+    {
+    }
+
+    inline DoubleNode::DoubleNode(const JSTokenLocation& location, double value)
+        : NumberNode(location, value)
+    {
+    }
+
+    inline IntegerNode::IntegerNode(const JSTokenLocation& location, double value)
+        : DoubleNode(location, value)
+    {
+    }
+
+    inline StringNode::StringNode(const JSTokenLocation& location, const Identifier& value)
+        : ConstantNode(location, ResultType::stringType())
+        , m_value(value)
+    {
+    }
+
+    inline TemplateExpressionListNode::TemplateExpressionListNode(ExpressionNode* node)
+        : m_node(node)
+    {
+    }
+
+    inline TemplateExpressionListNode::TemplateExpressionListNode(TemplateExpressionListNode* previous, ExpressionNode* node)
+        : m_node(node)
+    {
+        previous->m_next = this;
+    }
+
+    inline TemplateStringNode::TemplateStringNode(const JSTokenLocation& location, const Identifier& cooked, const Identifier& raw)
+        : ExpressionNode(location)
+        , m_cooked(cooked)
+        , m_raw(raw)
+    {
+    }
+
+    inline TemplateStringListNode::TemplateStringListNode(TemplateStringNode* node)
+        : m_node(node)
+    {
+    }
+
+    inline TemplateStringListNode::TemplateStringListNode(TemplateStringListNode* previous, TemplateStringNode* node)
+        : m_node(node)
+    {
+        previous->m_next = this;
+    }
+
+    inline TemplateLiteralNode::TemplateLiteralNode(const JSTokenLocation& location, TemplateStringListNode* templateStrings)
+        : ExpressionNode(location)
+        , m_templateStrings(templateStrings)
+        , m_templateExpressions(nullptr)
+    {
+    }
+
+    inline TemplateLiteralNode::TemplateLiteralNode(const JSTokenLocation& location, TemplateStringListNode* templateStrings, TemplateExpressionListNode* templateExpressions)
+        : ExpressionNode(location)
+        , m_templateStrings(templateStrings)
+        , m_templateExpressions(templateExpressions)
+    {
+    }
+
+    inline TaggedTemplateNode::TaggedTemplateNode(const JSTokenLocation& location, ExpressionNode* tag, TemplateLiteralNode* templateLiteral)
+        : ExpressionNode(location)
+        , m_tag(tag)
+        , m_templateLiteral(templateLiteral)
+    {
+    }
+
+    inline RegExpNode::RegExpNode(const JSTokenLocation& location, const Identifier& pattern, const Identifier& flags)
+        : ExpressionNode(location)
+        , m_pattern(pattern)
+        , m_flags(flags)
+    {
+    }
+
+    inline ThisNode::ThisNode(const JSTokenLocation& location)
+        : ExpressionNode(location)
+    {
+    }
+
+    inline SuperNode::SuperNode(const JSTokenLocation& location)
+        : ExpressionNode(location)
+    {
+    }
+
+    inline NewTargetNode::NewTargetNode(const JSTokenLocation& location)
+        : ExpressionNode(location)
+    {
+    }
+
+    inline ResolveNode::ResolveNode(const JSTokenLocation& location, const Identifier& ident, const JSTextPosition& start)
+        : ExpressionNode(location)
+        , m_ident(ident)
+        , m_start(start)
+    {
+        ASSERT(m_start.offset >= m_start.lineStartOffset);
+    }
+
+    inline ElementNode::ElementNode(int elision, ExpressionNode* node)
+        : m_next(0)
+        , m_elision(elision)
+        , m_node(node)
+    {
+    }
+
+    inline ElementNode::ElementNode(ElementNode* l, int elision, ExpressionNode* node)
+        : m_next(0)
+        , m_elision(elision)
+        , m_node(node)
+    {
+        l->m_next = this;
+    }
+
+    inline ArrayNode::ArrayNode(const JSTokenLocation& location, int elision)
+        : ExpressionNode(location)
+        , m_element(0)
+        , m_elision(elision)
+        , m_optional(true)
+    {
+    }
+
+    inline ArrayNode::ArrayNode(const JSTokenLocation& location, ElementNode* element)
+        : ExpressionNode(location)
+        , m_element(element)
+        , m_elision(0)
+        , m_optional(false)
+    {
+    }
+
+    inline ArrayNode::ArrayNode(const JSTokenLocation& location, int elision, ElementNode* element)
+        : ExpressionNode(location)
+        , m_element(element)
+        , m_elision(elision)
+        , m_optional(true)
+    {
+    }
+
+    inline PropertyNode::PropertyNode(const Identifier& name, ExpressionNode* assign, Type type, PutType putType, SuperBinding superBinding, bool isClassProperty)
+        : m_name(&name)
+        , m_assign(assign)
+        , m_type(type)
+        , m_needsSuperBinding(superBinding == SuperBinding::Needed)
+        , m_putType(putType)
+        , m_isClassProperty(isClassProperty)
+    {
+    }
+
+    inline PropertyNode::PropertyNode(ExpressionNode* name, ExpressionNode* assign, Type type, PutType putType, SuperBinding superBinding, bool isClassProperty)
+        : m_name(0)
+        , m_expression(name)
+        , m_assign(assign)
+        , m_type(type)
+        , m_needsSuperBinding(superBinding == SuperBinding::Needed)
+        , m_putType(putType)
+        , m_isClassProperty(isClassProperty)
+    {
+    }
+
+    inline PropertyListNode::PropertyListNode(const JSTokenLocation& location, PropertyNode* node)
+        : ExpressionNode(location)
+        , m_node(node)
+        , m_next(0)
+    {
+    }
+
+    inline PropertyListNode::PropertyListNode(const JSTokenLocation& location, PropertyNode* node, PropertyListNode* list)
+        : ExpressionNode(location)
+        , m_node(node)
+        , m_next(0)
+    {
+        list->m_next = this;
+    }
+
+    inline ObjectLiteralNode::ObjectLiteralNode(const JSTokenLocation& location)
+        : ExpressionNode(location)
+        , m_list(0)
+    {
+    }
+
+    inline ObjectLiteralNode::ObjectLiteralNode(const JSTokenLocation& location, PropertyListNode* list)
+        : ExpressionNode(location)
+        , m_list(list)
+    {
+    }
+
+    inline BracketAccessorNode::BracketAccessorNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments)
+        : ExpressionNode(location)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+    {
+    }
+
+    inline DotAccessorNode::DotAccessorNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident)
+        : ExpressionNode(location)
+        , m_base(base)
+        , m_ident(ident)
+    {
+    }
+    
+    
+    inline SpreadExpressionNode::SpreadExpressionNode(const JSTokenLocation& location, ExpressionNode* expression)
+        : ExpressionNode(location)
+        , m_expression(expression)
+    {
+    }
+
+    inline ArgumentListNode::ArgumentListNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location)
+        , m_next(0)
+        , m_expr(expr)
+    {
+    }
+
+    inline ArgumentListNode::ArgumentListNode(const JSTokenLocation& location, ArgumentListNode* listNode, ExpressionNode* expr)
+        : ExpressionNode(location)
+        , m_next(0)
+        , m_expr(expr)
+    {
+        listNode->m_next = this;
+    }
+
+    inline ArgumentsNode::ArgumentsNode()
+        : m_listNode(0)
+    {
+    }
+
+    inline ArgumentsNode::ArgumentsNode(ArgumentListNode* listNode)
+        : m_listNode(listNode)
+    {
+    }
+
+    inline NewExprNode::NewExprNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location)
+        , m_expr(expr)
+        , m_args(0)
+    {
+    }
+
+    inline NewExprNode::NewExprNode(const JSTokenLocation& location, ExpressionNode* expr, ArgumentsNode* args)
+        : ExpressionNode(location)
+        , m_expr(expr)
+        , m_args(args)
+    {
+    }
+
+    inline EvalFunctionCallNode::EvalFunctionCallNode(const JSTokenLocation& location, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallValueNode::FunctionCallValueNode(const JSTokenLocation& location, ExpressionNode* expr, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_expr(expr)
+        , m_args(args)
+    {
+        ASSERT(divot.offset >= divotStart.offset);
+    }
+
+    inline FunctionCallResolveNode::FunctionCallResolveNode(const JSTokenLocation& location, const Identifier& ident, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallBracketNode::FunctionCallBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableSubExpressionData(divot, divotStart, divotEnd)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_args(args)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+    {
+    }
+
+    inline FunctionCallDotNode::FunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableSubExpressionData(divot, divotStart, divotEnd)
+        , m_base(base)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline BytecodeIntrinsicNode::BytecodeIntrinsicNode(Type type, const JSTokenLocation& location, EmitterType emitter, const Identifier& ident, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_type(type)
+        , m_emitter(emitter)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline CallFunctionCallDotNode::CallFunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : FunctionCallDotNode(location, base, ident, args, divot, divotStart, divotEnd)
+    {
+    }
+
+    inline ApplyFunctionCallDotNode::ApplyFunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : FunctionCallDotNode(location, base, ident, args, divot, divotStart, divotEnd)
+    {
+    }
+
+    inline PostfixNode::PostfixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator oper, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : PrefixNode(location, expr, oper, divot, divotStart, divotEnd)
+    {
+    }
+
+    inline DeleteResolveNode::DeleteResolveNode(const JSTokenLocation& location, const Identifier& ident, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_ident(ident)
+    {
+    }
+
+    inline DeleteBracketNode::DeleteBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_base(base)
+        , m_subscript(subscript)
+    {
+    }
+
+    inline DeleteDotNode::DeleteDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_base(base)
+        , m_ident(ident)
+    {
+    }
+
+    inline DeleteValueNode::DeleteValueNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location)
+        , m_expr(expr)
+    {
+    }
+
+    inline VoidNode::VoidNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location)
+        , m_expr(expr)
+    {
+    }
+
+    inline TypeOfResolveNode::TypeOfResolveNode(const JSTokenLocation& location, const Identifier& ident)
+        : ExpressionNode(location, ResultType::stringType())
+        , m_ident(ident)
+    {
+    }
+
+    inline TypeOfValueNode::TypeOfValueNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location, ResultType::stringType())
+        , m_expr(expr)
+    {
+    }
+
+    inline PrefixNode::PrefixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator oper, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowablePrefixedSubExpressionData(divot, divotStart, divotEnd)
+        , m_expr(expr)
+        , m_operator(oper)
+    {
+    }
+
+    inline UnaryOpNode::UnaryOpNode(const JSTokenLocation& location, ResultType type, ExpressionNode* expr, OpcodeID opcodeID)
+        : ExpressionNode(location, type)
+        , m_expr(expr)
+        , m_opcodeID(opcodeID)
+    {
+    }
+
+    inline UnaryPlusNode::UnaryPlusNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : UnaryOpNode(location, ResultType::numberType(), expr, op_to_number)
+    {
+    }
+
+    inline NegateNode::NegateNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : UnaryOpNode(location, ResultType::numberType(), expr, op_negate)
+    {
+    }
+
+    inline BitwiseNotNode::BitwiseNotNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location, ResultType::forBitOp())
+        , m_expr(expr)
+    {
+    }
+
+    inline LogicalNotNode::LogicalNotNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : UnaryOpNode(location, ResultType::booleanType(), expr, op_not)
+    {
+    }
+
+    inline BinaryOpNode::BinaryOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(location)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_opcodeID(opcodeID)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline BinaryOpNode::BinaryOpNode(const JSTokenLocation& location, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(location, type)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_opcodeID(opcodeID)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline PowNode::PowNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_pow, rightHasAssignments)
+    {
+    }
+
+    inline MultNode::MultNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_mul, rightHasAssignments)
+    {
+    }
+
+    inline DivNode::DivNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_div, rightHasAssignments)
+    {
+    }
+
+
+    inline ModNode::ModNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_mod, rightHasAssignments)
+    {
+    }
+
+    inline AddNode::AddNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, op_add, rightHasAssignments)
+    {
+    }
+
+    inline SubNode::SubNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_sub, rightHasAssignments)
+    {
+    }
+
+    inline LeftShiftNode::LeftShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_lshift, rightHasAssignments)
+    {
+    }
+
+    inline RightShiftNode::RightShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_rshift, rightHasAssignments)
+    {
+    }
+
+    inline UnsignedRightShiftNode::UnsignedRightShiftNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::numberType(), expr1, expr2, op_urshift, rightHasAssignments)
+    {
+    }
+
+    inline LessNode::LessNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
+    {
+    }
+
+    inline GreaterNode::GreaterNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_greater, rightHasAssignments)
+    {
+    }
+
+    inline LessEqNode::LessEqNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
+    {
+    }
+
+    inline GreaterEqNode::GreaterEqNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_greatereq, rightHasAssignments)
+    {
+    }
+
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(const JSTokenLocation& location, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(location, type, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(location, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline InstanceOfNode::InstanceOfNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_instanceof, rightHasAssignments)
+    {
+    }
+
+    inline InNode::InNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(location, expr1, expr2, op_in, rightHasAssignments)
+    {
+    }
+
+    inline EqualNode::EqualNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_eq, rightHasAssignments)
+    {
+    }
+
+    inline NotEqualNode::NotEqualNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_neq, rightHasAssignments)
+    {
+    }
+
+    inline StrictEqualNode::StrictEqualNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_stricteq, rightHasAssignments)
+    {
+    }
+
+    inline NotStrictEqualNode::NotStrictEqualNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::booleanType(), expr1, expr2, op_nstricteq, rightHasAssignments)
+    {
+    }
+
+    inline BitAndNode::BitAndNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_bitand, rightHasAssignments)
+    {
+    }
+
+    inline BitOrNode::BitOrNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_bitor, rightHasAssignments)
+    {
+    }
+
+    inline BitXOrNode::BitXOrNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(location, ResultType::forBitOp(), expr1, expr2, op_bitxor, rightHasAssignments)
+    {
+    }
+
+    inline LogicalOpNode::LogicalOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper)
+        : ExpressionNode(location, ResultType::forLogicalOp(expr1->resultDescriptor(), expr2->resultDescriptor()))
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_operator(oper)
+    {
+    }
+
+    inline ConditionalNode::ConditionalNode(const JSTokenLocation& location, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(location)
+        , m_logical(logical)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+    {
+    }
+
+    inline ReadModifyResolveNode::ReadModifyResolveNode(const JSTokenLocation& location, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_ident(ident)
+        , m_right(right)
+        , m_operator(oper)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignResolveNode::AssignResolveNode(const JSTokenLocation& location, const Identifier& ident, ExpressionNode* right, AssignmentContext assignmentContext)
+        : ExpressionNode(location)
+        , m_ident(ident)
+        , m_right(right)
+        , m_assignmentContext(assignmentContext)
+    {
+    }
+
+
+    inline ReadModifyBracketNode::ReadModifyBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableSubExpressionData(divot, divotStart, divotEnd)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_right(right)
+        , m_operator(oper)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignBracketNode::AssignBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_right(right)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignDotNode::AssignDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+        , m_base(base)
+        , m_ident(ident)
+        , m_right(right)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReadModifyDotNode::ReadModifyDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableSubExpressionData(divot, divotStart, divotEnd)
+        , m_base(base)
+        , m_ident(ident)
+        , m_right(right)
+        , m_operator(oper)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignErrorNode::AssignErrorNode(const JSTokenLocation& location, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        : ExpressionNode(location)
+        , ThrowableExpressionData(divot, divotStart, divotEnd)
+    {
+    }
+
+    inline CommaNode::CommaNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : ExpressionNode(location)
+        , m_expr(expr)
+        , m_next(nullptr)
+    {
+    }
+
+    inline SourceElements::SourceElements()
+        : m_head(nullptr)
+        , m_tail(nullptr)
+    {
+    }
+
+    inline EmptyStatementNode::EmptyStatementNode(const JSTokenLocation& location)
+        : StatementNode(location)
+    {
+    }
+
+    inline DebuggerStatementNode::DebuggerStatementNode(const JSTokenLocation& location)
+        : StatementNode(location)
+    {
+    }
+    
+    inline ExprStatementNode::ExprStatementNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : StatementNode(location)
+        , m_expr(expr)
+    {
+    }
+
+    inline DeclarationStatement::DeclarationStatement(const JSTokenLocation& location, ExpressionNode* expr)
+        : StatementNode(location)
+        , m_expr(expr)
+    {
+    }
+
+    inline ModuleDeclarationNode::ModuleDeclarationNode(const JSTokenLocation& location)
+        : StatementNode(location)
+    {
+    }
+
+    inline ModuleNameNode::ModuleNameNode(const JSTokenLocation& location, const Identifier& moduleName)
+        : Node(location)
+        , m_moduleName(moduleName)
+    {
+    }
+
+    inline ImportSpecifierNode::ImportSpecifierNode(const JSTokenLocation& location, const Identifier& importedName, const Identifier& localName)
+        : Node(location)
+        , m_importedName(importedName)
+        , m_localName(localName)
+    {
+    }
+
+    inline ImportDeclarationNode::ImportDeclarationNode(const JSTokenLocation& location, ImportSpecifierListNode* importSpecifierList, ModuleNameNode* moduleName)
+        : ModuleDeclarationNode(location)
+        , m_specifierList(importSpecifierList)
+        , m_moduleName(moduleName)
+    {
+    }
+
+    inline ExportAllDeclarationNode::ExportAllDeclarationNode(const JSTokenLocation& location, ModuleNameNode* moduleName)
+        : ModuleDeclarationNode(location)
+        , m_moduleName(moduleName)
+    {
+    }
+
+    inline ExportDefaultDeclarationNode::ExportDefaultDeclarationNode(const JSTokenLocation& location, StatementNode* declaration, const Identifier& localName)
+        : ModuleDeclarationNode(location)
+        , m_declaration(declaration)
+        , m_localName(localName)
+    {
+    }
+
+    inline ExportLocalDeclarationNode::ExportLocalDeclarationNode(const JSTokenLocation& location, StatementNode* declaration)
+        : ModuleDeclarationNode(location)
+        , m_declaration(declaration)
+    {
+    }
+
+    inline ExportNamedDeclarationNode::ExportNamedDeclarationNode(const JSTokenLocation& location, ExportSpecifierListNode* exportSpecifierList, ModuleNameNode* moduleName)
+        : ModuleDeclarationNode(location)
+        , m_specifierList(exportSpecifierList)
+        , m_moduleName(moduleName)
+    {
+    }
+
+    inline ExportSpecifierNode::ExportSpecifierNode(const JSTokenLocation& location, const Identifier& localName, const Identifier& exportedName)
+        : Node(location)
+        , m_localName(localName)
+        , m_exportedName(exportedName)
+    {
+    }
+
+    inline EmptyVarExpression::EmptyVarExpression(const JSTokenLocation& location, const Identifier& ident)
+        : ExpressionNode(location)
+        , m_ident(ident)
+    {
+    }
+
+    inline EmptyLetExpression::EmptyLetExpression(const JSTokenLocation& location, const Identifier& ident)
+        : ExpressionNode(location)
+        , m_ident(ident)
+    {
+    }
+    
+    inline IfElseNode::IfElseNode(const JSTokenLocation& location, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock)
+        : StatementNode(location)
+        , m_condition(condition)
+        , m_ifBlock(ifBlock)
+        , m_elseBlock(elseBlock)
+    {
+    }
+
+    inline DoWhileNode::DoWhileNode(const JSTokenLocation& location, StatementNode* statement, ExpressionNode* expr)
+        : StatementNode(location)
+        , m_statement(statement)
+        , m_expr(expr)
+    {
+    }
+
+    inline WhileNode::WhileNode(const JSTokenLocation& location, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(location)
+        , m_expr(expr)
+        , m_statement(statement)
+    {
+    }
+
+    inline ForNode::ForNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, VariableEnvironment& lexicalVariables)
+        : StatementNode(location)
+        , VariableEnvironmentNode(lexicalVariables)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_expr3(expr3)
+        , m_statement(statement)
+    {
+        ASSERT(statement);
+    }
+
+    inline ContinueNode::ContinueNode(const JSTokenLocation& location, const Identifier& ident)
+        : StatementNode(location)
+        , m_ident(ident)
+    {
+    }
+    
+    inline BreakNode::BreakNode(const JSTokenLocation& location, const Identifier& ident)
+        : StatementNode(location)
+        , m_ident(ident)
+    {
+    }
+    
+    inline ReturnNode::ReturnNode(const JSTokenLocation& location, ExpressionNode* value)
+        : StatementNode(location)
+        , m_value(value)
+    {
+    }
+
+    inline WithNode::WithNode(const JSTokenLocation& location, ExpressionNode* expr, StatementNode* statement, const JSTextPosition& divot, uint32_t expressionLength)
+        : StatementNode(location)
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_divot(divot)
+        , m_expressionLength(expressionLength)
+    {
+    }
+
+    inline LabelNode::LabelNode(const JSTokenLocation& location, const Identifier& name, StatementNode* statement)
+        : StatementNode(location)
+        , m_name(name)
+        , m_statement(statement)
+    {
+    }
+
+    inline ThrowNode::ThrowNode(const JSTokenLocation& location, ExpressionNode* expr)
+        : StatementNode(location)
+        , m_expr(expr)
+    {
+    }
+
+    inline TryNode::TryNode(const JSTokenLocation& location, StatementNode* tryBlock, DestructuringPatternNode* catchPattern, StatementNode* catchBlock, VariableEnvironment& catchEnvironment, StatementNode* finallyBlock)
+        : StatementNode(location)
+        , VariableEnvironmentNode(catchEnvironment)
+        , m_tryBlock(tryBlock)
+        , m_catchPattern(catchPattern)
+        , m_catchBlock(catchBlock)
+        , m_finallyBlock(finallyBlock)
+    {
+    }
+
+    inline FunctionParameters::FunctionParameters()
+    {
+    }
+
+    
+    inline BaseFuncExprNode::BaseFuncExprNode(const JSTokenLocation& location, const Identifier& ident, FunctionMetadataNode* metadata, const SourceCode& source, FunctionMode functionMode)
+        : ExpressionNode(location)
+        , m_metadata(metadata)
+    {
+        m_metadata->finishParsing(source, ident, functionMode);
+    }
+
+    inline FuncExprNode::FuncExprNode(const JSTokenLocation& location, const Identifier& ident, FunctionMetadataNode* metadata, const SourceCode& source)
+        : BaseFuncExprNode(location, ident, metadata, source, FunctionMode::FunctionExpression)
+    {
+    }
+
+    inline FuncExprNode::FuncExprNode(const JSTokenLocation& location, const Identifier& ident, FunctionMetadataNode* metadata, const SourceCode& source, FunctionMode functionMode)
+        : BaseFuncExprNode(location, ident, metadata, source, functionMode)
+    {
+    }
+    
+    inline FuncDeclNode::FuncDeclNode(const JSTokenLocation& location, const Identifier& ident, FunctionMetadataNode* metadata, const SourceCode& source)
+        : StatementNode(location)
+        , m_metadata(metadata)
+    {
+        m_metadata->finishParsing(source, ident, FunctionMode::FunctionDeclaration);
+    }
+
+    inline ArrowFuncExprNode::ArrowFuncExprNode(const JSTokenLocation& location, const Identifier& ident, FunctionMetadataNode* metadata, const SourceCode& source)
+        : BaseFuncExprNode(location, ident, metadata, source, FunctionMode::FunctionExpression)
+    {
+    }
+
+    inline MethodDefinitionNode::MethodDefinitionNode(const JSTokenLocation& location, const Identifier& ident, FunctionMetadataNode* metadata, const SourceCode& source)
+        : FuncExprNode(location, ident, metadata, source, FunctionMode::MethodDefinition)
+    {
+    }
+    
+    inline YieldExprNode::YieldExprNode(const JSTokenLocation& location, ExpressionNode* argument, bool delegate)
+        : ExpressionNode(location)
+        , m_argument(argument)
+        , m_delegate(delegate)
+    {
+    }
+
+    inline AwaitExprNode::AwaitExprNode(const JSTokenLocation& location, ExpressionNode* argument)
+        : ExpressionNode(location)
+        , m_argument(argument)
+    {
+    }
+
+    inline ClassDeclNode::ClassDeclNode(const JSTokenLocation& location, ExpressionNode* classDeclaration)
+        : StatementNode(location)
+        , m_classDeclaration(classDeclaration)
+    {
+    }
+
+    inline ClassExprNode::ClassExprNode(const JSTokenLocation& location, const Identifier& name, const SourceCode& classSource, VariableEnvironment& classEnvironment, ExpressionNode* constructorExpression, ExpressionNode* classHeritage, PropertyListNode* instanceMethods, PropertyListNode* staticMethods)
+        : ExpressionNode(location)
+        , VariableEnvironmentNode(classEnvironment)
+        , m_classSource(classSource)
+        , m_name(name)
+        , m_ecmaName(&name)
+        , m_constructorExpression(constructorExpression)
+        , m_classHeritage(classHeritage)
+        , m_instanceMethods(instanceMethods)
+        , m_staticMethods(staticMethods)
+    {
+    }
+
+    inline CaseClauseNode::CaseClauseNode(ExpressionNode* expr, SourceElements* statements)
+        : m_expr(expr)
+        , m_statements(statements)
+    {
+    }
+
+    inline ClauseListNode::ClauseListNode(CaseClauseNode* clause)
+        : m_clause(clause)
+        , m_next(0)
+    {
+    }
+
+    inline ClauseListNode::ClauseListNode(ClauseListNode* clauseList, CaseClauseNode* clause)
+        : m_clause(clause)
+        , m_next(0)
+    {
+        clauseList->m_next = this;
+    }
+
+    inline CaseBlockNode::CaseBlockNode(ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2)
+        : m_list1(list1)
+        , m_defaultClause(defaultClause)
+        , m_list2(list2)
+    {
+    }
+
+    inline SwitchNode::SwitchNode(const JSTokenLocation& location, ExpressionNode* expr, CaseBlockNode* block, VariableEnvironment& lexicalVariables, FunctionStack&& functionStack)
+        : StatementNode(location)
+        , VariableEnvironmentNode(lexicalVariables, WTFMove(functionStack))
+        , m_expr(expr)
+        , m_block(block)
+    {
+    }
+
+    inline BlockNode::BlockNode(const JSTokenLocation& location, SourceElements* statements, VariableEnvironment& lexicalVariables, FunctionStack&& functionStack)
+        : StatementNode(location)
+        , VariableEnvironmentNode(lexicalVariables, WTFMove(functionStack))
+        , m_statements(statements)
+    {
+    }
+
+    inline EnumerationNode::EnumerationNode(const JSTokenLocation& location, ExpressionNode* lexpr, ExpressionNode* expr, StatementNode* statement, VariableEnvironment& lexicalVariables)
+        : StatementNode(location)
+        , VariableEnvironmentNode(lexicalVariables)
+        , m_lexpr(lexpr)
+        , m_expr(expr)
+        , m_statement(statement)
+    {
+        ASSERT(lexpr);
+    }
+    
+    inline ForInNode::ForInNode(const JSTokenLocation& location, ExpressionNode* lexpr, ExpressionNode* expr, StatementNode* statement, VariableEnvironment& lexicalVariables)
+        : EnumerationNode(location, lexpr, expr, statement, lexicalVariables)
+    {
+    }
+    
+    inline ForOfNode::ForOfNode(const JSTokenLocation& location, ExpressionNode* lexpr, ExpressionNode* expr, StatementNode* statement, VariableEnvironment& lexicalVariables)
+        : EnumerationNode(location, lexpr, expr, statement, lexicalVariables)
+    {
+    }
+    
+    inline DestructuringPatternNode::DestructuringPatternNode()
+    {
+    }
+
+    inline ArrayPatternNode::ArrayPatternNode()
+        : DestructuringPatternNode()
+    {
+    }
+    
+    inline ObjectPatternNode::ObjectPatternNode()
+        : DestructuringPatternNode()
+    {
+    }
+    
+    inline BindingNode::BindingNode(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, AssignmentContext context)
+        : DestructuringPatternNode()
+        , m_divotStart(start)
+        , m_divotEnd(end)
+        , m_boundProperty(boundProperty)
+        , m_bindingContext(context)
+    {
+    }
+
+    inline AssignmentElementNode::AssignmentElementNode(ExpressionNode* assignmentTarget, const JSTextPosition& start, const JSTextPosition& end)
+        : DestructuringPatternNode()
+        , m_divotStart(start)
+        , m_divotEnd(end)
+        , m_assignmentTarget(assignmentTarget)
+    {
+    }
+
+    inline RestParameterNode::RestParameterNode(DestructuringPatternNode* pattern, unsigned numParametersToSkip)
+        : DestructuringPatternNode()
+        , m_pattern(pattern)
+        , m_numParametersToSkip(numParametersToSkip)
+    {
+        ASSERT(!pattern->isRestParameter());
+    }
+
+    inline DestructuringAssignmentNode::DestructuringAssignmentNode(const JSTokenLocation& location, DestructuringPatternNode* bindings, ExpressionNode* initializer)
+        : ExpressionNode(location)
+        , m_bindings(bindings)
+        , m_initializer(initializer)
+    {
+    }
+    
+} // namespace JSC
diff --git a/parser/Nodes.cpp b/parser/Nodes.cpp
new file mode 100644
index 0000000..80c657e
--- /dev/null
+++ b/parser/Nodes.cpp
@@ -0,0 +1,211 @@
+/*
+*  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+*  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+*  Copyright (C) 2003-2009, 2013, 2016 Apple Inc. All rights reserved.
+*  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+*  Copyright (C) 2007 Maks Orlovich
+*  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+*
+*  This library is free software; you can redistribute it and/or
+*  modify it under the terms of the GNU Library General Public
+*  License as published by the Free Software Foundation; either
+*  version 2 of the License, or (at your option) any later version.
+*
+*  This library is distributed in the hope that it will be useful,
+*  but WITHOUT ANY WARRANTY; without even the implied warranty of
+*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+*  Library General Public License for more details.
+*
+*  You should have received a copy of the GNU Library General Public License
+*  along with this library; see the file COPYING.LIB.  If not, write to
+*  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+*  Boston, MA 02110-1301, USA.
+*
+*/
+
+#include "config.h"
+#include "Nodes.h"
+#include "NodeConstructors.h"
+
+#include "JSCInlines.h"
+#include <wtf/Assertions.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+// ------------------------------ StatementNode --------------------------------
+
+void StatementNode::setLoc(unsigned firstLine, unsigned lastLine, int startOffset, int lineStartOffset)
+{
+    m_lastLine = lastLine;
+    m_position = JSTextPosition(firstLine, startOffset, lineStartOffset);
+    ASSERT(m_position.offset >= m_position.lineStartOffset);
+}
+
+// ------------------------------ SourceElements --------------------------------
+
+void SourceElements::append(StatementNode* statement)
+{
+    if (statement->isEmptyStatement())
+        return;
+
+    if (!m_head) {
+        m_head = statement;
+        m_tail = statement;
+        return;
+    }
+
+    m_tail->setNext(statement);
+    m_tail = statement;
+}
+
+StatementNode* SourceElements::singleStatement() const
+{
+    return m_head == m_tail ? m_head : nullptr;
+}
+
+// ------------------------------ ScopeNode -----------------------------
+
+ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, bool inStrictContext)
+    : StatementNode(endLocation)
+    , ParserArenaRoot(parserArena)
+    , m_startLineNumber(startLocation.line)
+    , m_startStartOffset(startLocation.startOffset)
+    , m_startLineStartOffset(startLocation.lineStartOffset)
+    , m_features(inStrictContext ? StrictModeFeature : NoFeatures)
+    , m_innerArrowFunctionCodeFeatures(NoInnerArrowFunctionFeatures)
+    , m_numConstants(0)
+    , m_statements(0)
+{
+}
+
+ScopeNode::ScopeNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, const SourceCode& source, SourceElements* children, VariableEnvironment& varEnvironment, FunctionStack&& funcStack, VariableEnvironment& lexicalVariables, UniquedStringImplPtrSet&& sloppyModeHoistedFunctions, CodeFeatures features, InnerArrowFunctionCodeFeatures innerArrowFunctionCodeFeatures, int numConstants)
+    : StatementNode(endLocation)
+    , ParserArenaRoot(parserArena)
+    , VariableEnvironmentNode(lexicalVariables, WTFMove(funcStack))
+    , m_startLineNumber(startLocation.line)
+    , m_startStartOffset(startLocation.startOffset)
+    , m_startLineStartOffset(startLocation.lineStartOffset)
+    , m_features(features)
+    , m_innerArrowFunctionCodeFeatures(innerArrowFunctionCodeFeatures)
+    , m_source(source)
+    , m_sloppyModeHoistedFunctions(WTFMove(sloppyModeHoistedFunctions))
+    , m_numConstants(numConstants)
+    , m_statements(children)
+{
+    m_varDeclarations.swap(varEnvironment);
+}
+
+StatementNode* ScopeNode::singleStatement() const
+{
+    return m_statements ? m_statements->singleStatement() : 0;
+}
+
+// ------------------------------ ProgramNode -----------------------------
+
+ProgramNode::ProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VariableEnvironment& varEnvironment, FunctionStack&& funcStack, VariableEnvironment& lexicalVariables, UniquedStringImplPtrSet&& sloppyModeHoistedFunctions, FunctionParameters*, const SourceCode& source, CodeFeatures features, InnerArrowFunctionCodeFeatures innerArrowFunctionCodeFeatures, int numConstants, RefPtr<ModuleScopeData>&&)
+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varEnvironment, WTFMove(funcStack), lexicalVariables, WTFMove(sloppyModeHoistedFunctions), features, innerArrowFunctionCodeFeatures, numConstants)
+    , m_startColumn(startColumn)
+    , m_endColumn(endColumn)
+{
+}
+
+// ------------------------------ ModuleProgramNode -----------------------------
+
+ModuleProgramNode::ModuleProgramNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VariableEnvironment& varEnvironment, FunctionStack&& funcStack, VariableEnvironment& lexicalVariables, UniquedStringImplPtrSet&& sloppyModeHoistedFunctions, FunctionParameters*, const SourceCode& source, CodeFeatures features, InnerArrowFunctionCodeFeatures innerArrowFunctionCodeFeatures, int numConstants, RefPtr<ModuleScopeData>&& moduleScopeData)
+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varEnvironment, WTFMove(funcStack), lexicalVariables, WTFMove(sloppyModeHoistedFunctions), features, innerArrowFunctionCodeFeatures, numConstants)
+    , m_startColumn(startColumn)
+    , m_endColumn(endColumn)
+    , m_moduleScopeData(*WTFMove(moduleScopeData))
+{
+}
+
+// ------------------------------ EvalNode -----------------------------
+
+EvalNode::EvalNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned, unsigned endColumn, SourceElements* children, VariableEnvironment& varEnvironment, FunctionStack&& funcStack, VariableEnvironment& lexicalVariables, UniquedStringImplPtrSet&& sloppyModeHoistedFunctions, FunctionParameters*, const SourceCode& source, CodeFeatures features, InnerArrowFunctionCodeFeatures innerArrowFunctionCodeFeatures, int numConstants, RefPtr<ModuleScopeData>&&)
+    : ScopeNode(parserArena, startLocation, endLocation, source, children, varEnvironment, WTFMove(funcStack), lexicalVariables, WTFMove(sloppyModeHoistedFunctions), features, innerArrowFunctionCodeFeatures, numConstants)
+    , m_endColumn(endColumn)
+{
+}
+
+// ------------------------------ FunctionMetadataNode -----------------------------
+
+FunctionMetadataNode::FunctionMetadataNode(
+    ParserArena&, const JSTokenLocation& startLocation, 
+    const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, 
+    int functionKeywordStart, int functionNameStart, int parametersStart, bool isInStrictContext, 
+    ConstructorKind constructorKind, SuperBinding superBinding, unsigned parameterCount, unsigned functionLength, SourceParseMode mode, bool isArrowFunctionBodyExpression)
+        : Node(endLocation)
+        , m_startColumn(startColumn)
+        , m_endColumn(endColumn)
+        , m_functionKeywordStart(functionKeywordStart)
+        , m_functionNameStart(functionNameStart)
+        , m_parametersStart(parametersStart)
+        , m_startStartOffset(startLocation.startOffset)
+        , m_parameterCount(parameterCount)
+        , m_functionLength(functionLength)
+        , m_parseMode(mode)
+        , m_isInStrictContext(isInStrictContext)
+        , m_superBinding(static_cast<unsigned>(superBinding))
+        , m_constructorKind(static_cast<unsigned>(constructorKind))
+        , m_isArrowFunctionBodyExpression(isArrowFunctionBodyExpression)
+{
+    ASSERT(m_superBinding == static_cast<unsigned>(superBinding));
+    ASSERT(m_constructorKind == static_cast<unsigned>(constructorKind));
+}
+
+void FunctionMetadataNode::finishParsing(const SourceCode& source, const Identifier& ident, FunctionMode functionMode)
+{
+    m_source = source;
+    m_ident = ident;
+    m_functionMode = functionMode;
+}
+
+void FunctionMetadataNode::setEndPosition(JSTextPosition position)
+{
+    m_lastLine = position.line;
+    m_endColumn = position.offset - position.lineStartOffset;
+}
+
+// ------------------------------ FunctionNode -----------------------------
+
+FunctionNode::FunctionNode(ParserArena& parserArena, const JSTokenLocation& startLocation, const JSTokenLocation& endLocation, unsigned startColumn, unsigned endColumn, SourceElements* children, VariableEnvironment& varEnvironment, FunctionStack&& funcStack, VariableEnvironment& lexicalVariables, UniquedStringImplPtrSet&& sloppyModeHoistedFunctions, FunctionParameters* parameters, const SourceCode& sourceCode, CodeFeatures features, InnerArrowFunctionCodeFeatures innerArrowFunctionCodeFeatures, int numConstants, RefPtr<ModuleScopeData>&&)
+    : ScopeNode(parserArena, startLocation, endLocation, sourceCode, children, varEnvironment, WTFMove(funcStack), lexicalVariables, WTFMove(sloppyModeHoistedFunctions), features, innerArrowFunctionCodeFeatures, numConstants)
+    , m_parameters(parameters)
+    , m_startColumn(startColumn)
+    , m_endColumn(endColumn)
+{
+}
+
+void FunctionNode::finishParsing(const Identifier& ident, FunctionMode functionMode)
+{
+    ASSERT(!source().isNull());
+    m_ident = ident;
+    m_functionMode = functionMode;
+}
+
+bool PropertyListNode::hasStaticallyNamedProperty(const Identifier& propName)
+{
+    PropertyListNode* list = this;
+    while (list) {
+        const Identifier* currentNodeName = list->m_node->name();
+        if (currentNodeName && *currentNodeName == propName)
+            return true;
+        list = list->m_next;
+    }
+    return false;
+}
+
+VariableEnvironmentNode::VariableEnvironmentNode(VariableEnvironment& lexicalVariables)
+{
+    m_lexicalVariables.swap(lexicalVariables);
+}
+
+VariableEnvironmentNode::VariableEnvironmentNode(VariableEnvironment& lexicalVariables, FunctionStack&& functionStack)
+{
+    m_lexicalVariables.swap(lexicalVariables);
+    m_functionStack = WTFMove(functionStack);
+}
+
+} // namespace JSC
diff --git a/parser/Nodes.h b/parser/Nodes.h
new file mode 100644
index 0000000..24110aa
--- /dev/null
+++ b/parser/Nodes.h
@@ -0,0 +1,2314 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2009, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2007 Maks Orlovich
+ *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "Interpreter.h"
+#include "JITCode.h"
+#include "ParserArena.h"
+#include "ParserTokens.h"
+#include "ResultType.h"
+#include "SourceCode.h"
+#include "SymbolTable.h"
+#include "VariableEnvironment.h"
+#include <wtf/MathExtras.h>
+#include <wtf/SmallPtrSet.h>
+
+namespace JSC {
+
+    enum OpcodeID : unsigned;
+
+    class ArgumentListNode;
+    class BytecodeGenerator;
+    class FunctionMetadataNode;
+    class FunctionParameters;
+    class Label;
+    class ModuleAnalyzer;
+    class ModuleScopeData;
+    class PropertyListNode;
+    class ReadModifyResolveNode;
+    class RegisterID;
+    class ScopeNode;
+
+    typedef SmallPtrSet<UniquedStringImpl*> UniquedStringImplPtrSet;
+
+    enum Operator {
+        OpEqual,
+        OpPlusEq,
+        OpMinusEq,
+        OpMultEq,
+        OpDivEq,
+        OpPlusPlus,
+        OpMinusMinus,
+        OpAndEq,
+        OpXOrEq,
+        OpOrEq,
+        OpModEq,
+        OpPowEq,
+        OpLShift,
+        OpRShift,
+        OpURShift
+    };
+    
+    enum LogicalOperator {
+        OpLogicalAnd,
+        OpLogicalOr
+    };
+
+    enum FallThroughMode {
+        FallThroughMeansTrue = 0,
+        FallThroughMeansFalse = 1
+    };
+    inline FallThroughMode invert(FallThroughMode fallThroughMode) { return static_cast<FallThroughMode>(!fallThroughMode); }
+
+    namespace DeclarationStacks {
+        typedef Vector<FunctionMetadataNode*> FunctionStack;
+    }
+
+    struct SwitchInfo {
+        enum SwitchType { SwitchNone, SwitchImmediate, SwitchCharacter, SwitchString };
+        uint32_t bytecodeOffset;
+        SwitchType switchType;
+    };
+
+    enum class AssignmentContext { 
+        DeclarationStatement, 
+        ConstDeclarationStatement, 
+        AssignmentExpression 
+    };
+
+    class ParserArenaFreeable {
+    public:
+        // ParserArenaFreeable objects are are freed when the arena is deleted.
+        // Destructors are not called. Clients must not call delete on such objects.
+        void* operator new(size_t, ParserArena&);
+    };
+
+    class ParserArenaDeletable {
+    public:
+        virtual ~ParserArenaDeletable() { }
+
+        // ParserArenaDeletable objects are deleted when the arena is deleted.
+        // Clients must not call delete directly on such objects.
+        void* operator new(size_t, ParserArena&);
+    };
+
+    class ParserArenaRoot {
+        WTF_MAKE_FAST_ALLOCATED;
+    protected:
+        ParserArenaRoot(ParserArena&);
+
+    public:
+        ParserArena& parserArena() { return m_arena; }
+        virtual ~ParserArenaRoot() { }
+
+    protected:
+        ParserArena m_arena;
+    };
+
+    class Node : public ParserArenaFreeable {
+    protected:
+        Node(const JSTokenLocation&);
+
+    public:
+        virtual ~Node() { }
+
+        int firstLine() const { return m_position.line; }
+        int startOffset() const { return m_position.offset; }
+        int endOffset() const { return m_endOffset; }
+        int lineStartOffset() const { return m_position.lineStartOffset; }
+        const JSTextPosition& position() const { return m_position; }
+        void setEndOffset(int offset) { m_endOffset = offset; }
+        void setStartOffset(int offset) { m_position.offset = offset; }
+
+        bool needsDebugHook() const { return m_needsDebugHook; }
+        void setNeedsDebugHook() { m_needsDebugHook = true; }
+
+    protected:
+        JSTextPosition m_position;
+        int m_endOffset;
+        bool m_needsDebugHook { false };
+    };
+
+    class ExpressionNode : public Node {
+    protected:
+        ExpressionNode(const JSTokenLocation&, ResultType = ResultType::unknownType());
+
+    public:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* destination = 0) = 0;
+
+        virtual bool isNumber() const { return false; }
+        virtual bool isString() const { return false; }
+        virtual bool isObjectLiteral() const { return false; }
+        virtual bool isArrayLiteral() const { return false; }
+        virtual bool isNull() const { return false; }
+        virtual bool isPure(BytecodeGenerator&) const { return false; }        
+        virtual bool isConstant() const { return false; }
+        virtual bool isLocation() const { return false; }
+        virtual bool isAssignmentLocation() const { return isLocation(); }
+        virtual bool isResolveNode() const { return false; }
+        virtual bool isAssignResolveNode() const { return false; }
+        virtual bool isBracketAccessorNode() const { return false; }
+        virtual bool isDotAccessorNode() const { return false; }
+        virtual bool isDestructuringNode() const { return false; }
+        virtual bool isBaseFuncExprNode() const { return false; }
+        virtual bool isFuncExprNode() const { return false; }
+        virtual bool isArrowFuncExprNode() const { return false; }
+        virtual bool isClassExprNode() const { return false; }
+        virtual bool isCommaNode() const { return false; }
+        virtual bool isSimpleArray() const { return false; }
+        virtual bool isAdd() const { return false; }
+        virtual bool isSubtract() const { return false; }
+        virtual bool isBoolean() const { return false; }
+        virtual bool isSpreadExpression() const { return false; }
+        virtual bool isSuperNode() const { return false; }
+        virtual bool isNewTarget() const { return false; }
+        virtual bool isBytecodeIntrinsicNode() const { return false; }
+
+        virtual void emitBytecodeInConditionContext(BytecodeGenerator&, Label*, Label*, FallThroughMode);
+
+        virtual ExpressionNode* stripUnaryPlus() { return this; }
+
+        ResultType resultDescriptor() const { return m_resultType; }
+
+    private:
+        ResultType m_resultType;
+    };
+
+    class StatementNode : public Node {
+    protected:
+        StatementNode(const JSTokenLocation&);
+
+    public:
+        virtual void emitBytecode(BytecodeGenerator&, RegisterID* destination = 0) = 0;
+
+        void setLoc(unsigned firstLine, unsigned lastLine, int startOffset, int lineStartOffset);
+        unsigned lastLine() const { return m_lastLine; }
+
+        StatementNode* next() { return m_next; }
+        void setNext(StatementNode* next) { m_next = next; }
+
+        virtual bool isEmptyStatement() const { return false; }
+        virtual bool isDebuggerStatement() const { return false; }
+        virtual bool isFunctionNode() const { return false; }
+        virtual bool isReturnNode() const { return false; }
+        virtual bool isExprStatement() const { return false; }
+        virtual bool isBreak() const { return false; }
+        virtual bool isContinue() const { return false; }
+        virtual bool isLabel() const { return false; }
+        virtual bool isBlock() const { return false; }
+        virtual bool isFuncDeclNode() const { return false; }
+        virtual bool isModuleDeclarationNode() const { return false; }
+        virtual bool isForOfNode() const { return false; }
+
+    protected:
+        StatementNode* m_next;
+        int m_lastLine;
+    };
+
+    class VariableEnvironmentNode : public ParserArenaDeletable {
+    public:
+        typedef DeclarationStacks::FunctionStack FunctionStack;
+
+        VariableEnvironmentNode()
+        {
+        }
+
+        VariableEnvironmentNode(VariableEnvironment& lexicalDeclaredVariables);
+        VariableEnvironmentNode(VariableEnvironment& lexicalDeclaredVariables, FunctionStack&&);
+
+        VariableEnvironment& lexicalVariables() { return m_lexicalVariables; }
+        FunctionStack& functionStack() { return m_functionStack; }
+
+    protected:
+        VariableEnvironment m_lexicalVariables;
+        FunctionStack m_functionStack;
+    };
+
+    class ConstantNode : public ExpressionNode {
+    public:
+        ConstantNode(const JSTokenLocation&, ResultType);
+        bool isPure(BytecodeGenerator&) const override { return true; }
+        bool isConstant() const  override { return true; }
+        virtual JSValue jsValue(BytecodeGenerator&) const = 0;
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, FallThroughMode) override;
+    };
+
+    class NullNode : public ConstantNode {
+    public:
+        NullNode(const JSTokenLocation&);
+
+    private:
+        bool isNull() const override { return true; }
+        JSValue jsValue(BytecodeGenerator&) const override { return jsNull(); }
+    };
+
+    class BooleanNode : public ConstantNode {
+    public:
+        BooleanNode(const JSTokenLocation&, bool value);
+        bool value() { return m_value; }
+
+    private:
+        bool isBoolean() const override { return true; }
+        JSValue jsValue(BytecodeGenerator&) const override { return jsBoolean(m_value); }
+
+        bool m_value;
+    };
+
+    class NumberNode : public ConstantNode {
+    public:
+        NumberNode(const JSTokenLocation&, double value);
+        double value() const { return m_value; }
+        virtual bool isIntegerNode() const = 0;
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) final;
+
+    private:
+        bool isNumber() const final { return true; }
+        JSValue jsValue(BytecodeGenerator&) const override { return jsNumber(m_value); }
+
+        double m_value;
+    };
+
+    class DoubleNode : public NumberNode {
+    public:
+        DoubleNode(const JSTokenLocation&, double value);
+
+    private:
+        bool isIntegerNode() const override { return false; }
+    };
+
+    // An integer node represent a number represented as an integer (e.g. 42 instead of 42., 42.0, 42e0)
+    class IntegerNode : public DoubleNode {
+    public:
+        IntegerNode(const JSTokenLocation&, double value);
+        bool isIntegerNode() const final { return true; }
+    };
+
+    class StringNode : public ConstantNode {
+    public:
+        StringNode(const JSTokenLocation&, const Identifier&);
+        const Identifier& value() { return m_value; }
+
+    private:
+        bool isString() const override { return true; }
+        JSValue jsValue(BytecodeGenerator&) const override;
+
+        const Identifier& m_value;
+    };
+
+    class ThrowableExpressionData {
+    public:
+        ThrowableExpressionData()
+            : m_divot(-1, -1, -1)
+            , m_divotStart(-1, -1, -1)
+            , m_divotEnd(-1, -1, -1)
+        {
+        }
+        
+        ThrowableExpressionData(const JSTextPosition& divot, const JSTextPosition& start, const JSTextPosition& end)
+            : m_divot(divot)
+            , m_divotStart(start)
+            , m_divotEnd(end)
+        {
+            ASSERT(m_divot.offset >= m_divot.lineStartOffset);
+            ASSERT(m_divotStart.offset >= m_divotStart.lineStartOffset);
+            ASSERT(m_divotEnd.offset >= m_divotEnd.lineStartOffset);
+        }
+
+        void setExceptionSourceCode(const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+        {
+            ASSERT(divot.offset >= divot.lineStartOffset);
+            ASSERT(divotStart.offset >= divotStart.lineStartOffset);
+            ASSERT(divotEnd.offset >= divotEnd.lineStartOffset);
+            m_divot = divot;
+            m_divotStart = divotStart;
+            m_divotEnd = divotEnd;
+        }
+
+        const JSTextPosition& divot() const { return m_divot; }
+        const JSTextPosition& divotStart() const { return m_divotStart; }
+        const JSTextPosition& divotEnd() const { return m_divotEnd; }
+
+    protected:
+        RegisterID* emitThrowReferenceError(BytecodeGenerator&, const String& message);
+
+    private:
+        JSTextPosition m_divot;
+        JSTextPosition m_divotStart;
+        JSTextPosition m_divotEnd;
+    };
+
+    class ThrowableSubExpressionData : public ThrowableExpressionData {
+    public:
+        ThrowableSubExpressionData()
+            : m_subexpressionDivotOffset(0)
+            , m_subexpressionEndOffset(0)
+            , m_subexpressionLineOffset(0)
+            , m_subexpressionLineStartOffset(0)
+        {
+        }
+
+        ThrowableSubExpressionData(const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
+            : ThrowableExpressionData(divot, divotStart, divotEnd)
+            , m_subexpressionDivotOffset(0)
+            , m_subexpressionEndOffset(0)
+            , m_subexpressionLineOffset(0)
+            , m_subexpressionLineStartOffset(0)
+        {
+        }
+
+        void setSubexpressionInfo(const JSTextPosition& subexpressionDivot, int subexpressionOffset)
+        {
+            ASSERT(subexpressionDivot.offset <= divot().offset);
+            // Overflow means we can't do this safely, so just point at the primary divot,
+            // divotLine, or divotLineStart.
+            if ((divot() - subexpressionDivot.offset) & ~0xFFFF)
+                return;
+            if ((divot().line - subexpressionDivot.line) & ~0xFFFF)
+                return;
+            if ((divot().lineStartOffset - subexpressionDivot.lineStartOffset) & ~0xFFFF)
+                return;
+            if ((divotEnd() - subexpressionOffset) & ~0xFFFF)
+                return;
+            m_subexpressionDivotOffset = divot() - subexpressionDivot.offset;
+            m_subexpressionEndOffset = divotEnd() - subexpressionOffset;
+            m_subexpressionLineOffset = divot().line - subexpressionDivot.line;
+            m_subexpressionLineStartOffset = divot().lineStartOffset - subexpressionDivot.lineStartOffset;
+        }
+
+        JSTextPosition subexpressionDivot()
+        {
+            int newLine = divot().line - m_subexpressionLineOffset;
+            int newOffset = divot().offset - m_subexpressionDivotOffset;
+            int newLineStartOffset = divot().lineStartOffset - m_subexpressionLineStartOffset;
+            return JSTextPosition(newLine, newOffset, newLineStartOffset);
+        }
+        JSTextPosition subexpressionStart() { return divotStart(); }
+        JSTextPosition subexpressionEnd() { return divotEnd() - static_cast<int>(m_subexpressionEndOffset); }
+
+    protected:
+        uint16_t m_subexpressionDivotOffset;
+        uint16_t m_subexpressionEndOffset;
+        uint16_t m_subexpressionLineOffset;
+        uint16_t m_subexpressionLineStartOffset;
+    };
+    
+    class ThrowablePrefixedSubExpressionData : public ThrowableExpressionData {
+    public:
+        ThrowablePrefixedSubExpressionData()
+            : m_subexpressionDivotOffset(0)
+            , m_subexpressionStartOffset(0)
+            , m_subexpressionLineOffset(0)
+            , m_subexpressionLineStartOffset(0)
+        {
+        }
+
+        ThrowablePrefixedSubExpressionData(const JSTextPosition& divot, const JSTextPosition& start, const JSTextPosition& end)
+            : ThrowableExpressionData(divot, start, end)
+            , m_subexpressionDivotOffset(0)
+            , m_subexpressionStartOffset(0)
+            , m_subexpressionLineOffset(0)
+            , m_subexpressionLineStartOffset(0)
+        {
+        }
+
+        void setSubexpressionInfo(const JSTextPosition& subexpressionDivot, int subexpressionOffset)
+        {
+            ASSERT(subexpressionDivot.offset >= divot().offset);
+            // Overflow means we can't do this safely, so just point at the primary divot,
+            // divotLine, or divotLineStart.
+            if ((subexpressionDivot.offset - divot()) & ~0xFFFF) 
+                return;
+            if ((subexpressionDivot.line - divot().line) & ~0xFFFF)
+                return;
+            if ((subexpressionDivot.lineStartOffset - divot().lineStartOffset) & ~0xFFFF)
+                return;
+            if ((subexpressionOffset - divotStart()) & ~0xFFFF) 
+                return;
+            m_subexpressionDivotOffset = subexpressionDivot.offset - divot();
+            m_subexpressionStartOffset = subexpressionOffset - divotStart();
+            m_subexpressionLineOffset = subexpressionDivot.line - divot().line;
+            m_subexpressionLineStartOffset = subexpressionDivot.lineStartOffset - divot().lineStartOffset;
+        }
+
+        JSTextPosition subexpressionDivot()
+        {
+            int newLine = divot().line + m_subexpressionLineOffset;
+            int newOffset = divot().offset + m_subexpressionDivotOffset;
+            int newLineStartOffset = divot().lineStartOffset + m_subexpressionLineStartOffset;
+            return JSTextPosition(newLine, newOffset, newLineStartOffset);
+        }
+        JSTextPosition subexpressionStart() { return divotStart() + static_cast<int>(m_subexpressionStartOffset); }
+        JSTextPosition subexpressionEnd() { return divotEnd(); }
+
+    protected:
+        uint16_t m_subexpressionDivotOffset;
+        uint16_t m_subexpressionStartOffset;
+        uint16_t m_subexpressionLineOffset;
+        uint16_t m_subexpressionLineStartOffset;
+    };
+
+    class TemplateExpressionListNode : public ParserArenaFreeable {
+    public:
+        TemplateExpressionListNode(ExpressionNode*);
+        TemplateExpressionListNode(TemplateExpressionListNode*, ExpressionNode*);
+
+        ExpressionNode* value() { return m_node; }
+        TemplateExpressionListNode* next() { return m_next; }
+
+    private:
+        TemplateExpressionListNode* m_next { nullptr };
+        ExpressionNode* m_node { nullptr };
+    };
+
+    class TemplateStringNode : public ExpressionNode {
+    public:
+        TemplateStringNode(const JSTokenLocation&, const Identifier& cooked, const Identifier& raw);
+
+        const Identifier& cooked() { return m_cooked; }
+        const Identifier& raw() { return m_raw; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_cooked;
+        const Identifier& m_raw;
+    };
+
+    class TemplateStringListNode : public ParserArenaFreeable {
+    public:
+        TemplateStringListNode(TemplateStringNode*);
+        TemplateStringListNode(TemplateStringListNode*, TemplateStringNode*);
+
+        TemplateStringNode* value() { return m_node; }
+        TemplateStringListNode* next() { return m_next; }
+
+    private:
+        TemplateStringListNode* m_next { nullptr };
+        TemplateStringNode* m_node { nullptr };
+    };
+
+    class TemplateLiteralNode : public ExpressionNode {
+    public:
+        TemplateLiteralNode(const JSTokenLocation&, TemplateStringListNode*);
+        TemplateLiteralNode(const JSTokenLocation&, TemplateStringListNode*, TemplateExpressionListNode*);
+
+        TemplateStringListNode* templateStrings() const { return m_templateStrings; }
+        TemplateExpressionListNode* templateExpressions() const { return m_templateExpressions; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        TemplateStringListNode* m_templateStrings;
+        TemplateExpressionListNode* m_templateExpressions;
+    };
+
+    class TaggedTemplateNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        TaggedTemplateNode(const JSTokenLocation&, ExpressionNode*, TemplateLiteralNode*);
+
+        TemplateLiteralNode* templateLiteral() const { return m_templateLiteral; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_tag;
+        TemplateLiteralNode* m_templateLiteral;
+    };
+
+    class RegExpNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        RegExpNode(const JSTokenLocation&, const Identifier& pattern, const Identifier& flags);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_pattern;
+        const Identifier& m_flags;
+    };
+
+    class ThisNode : public ExpressionNode {
+    public:
+        ThisNode(const JSTokenLocation&);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class SuperNode final : public ExpressionNode {
+    public:
+        SuperNode(const JSTokenLocation&);
+
+    private:
+        bool isSuperNode() const override { return true; }
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class NewTargetNode final : public ExpressionNode {
+    public:
+        NewTargetNode(const JSTokenLocation&);
+
+    private:
+        bool isNewTarget() const final { return true; }
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class ResolveNode : public ExpressionNode {
+    public:
+        ResolveNode(const JSTokenLocation&, const Identifier&, const JSTextPosition& start);
+
+        const Identifier& identifier() const { return m_ident; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isPure(BytecodeGenerator&) const override;
+        bool isLocation() const override { return true; }
+        bool isResolveNode() const override { return true; }
+
+        const Identifier& m_ident;
+        JSTextPosition m_start;
+    };
+
+    class ElementNode : public ParserArenaFreeable {
+    public:
+        ElementNode(int elision, ExpressionNode*);
+        ElementNode(ElementNode*, int elision, ExpressionNode*);
+
+        int elision() const { return m_elision; }
+        ExpressionNode* value() { return m_node; }
+        ElementNode* next() { return m_next; }
+
+    private:
+        ElementNode* m_next;
+        int m_elision;
+        ExpressionNode* m_node;
+    };
+
+    class ArrayNode : public ExpressionNode {
+    public:
+        ArrayNode(const JSTokenLocation&, int elision);
+        ArrayNode(const JSTokenLocation&, ElementNode*);
+        ArrayNode(const JSTokenLocation&, int elision, ElementNode*);
+
+        bool isArrayLiteral() const override { return true; }
+
+        ArgumentListNode* toArgumentList(ParserArena&, int, int) const;
+
+        ElementNode* elements() const { ASSERT(isSimpleArray()); return m_element; }
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isSimpleArray() const override;
+
+        ElementNode* m_element;
+        int m_elision;
+        bool m_optional;
+    };
+
+    class PropertyNode : public ParserArenaFreeable {
+    public:
+        enum Type { Constant = 1, Getter = 2, Setter = 4, Computed = 8, Shorthand = 16 };
+        enum PutType { Unknown, KnownDirect };
+
+        PropertyNode(const Identifier&, ExpressionNode*, Type, PutType, SuperBinding, bool isClassProperty);
+        PropertyNode(ExpressionNode* propertyName, ExpressionNode*, Type, PutType, SuperBinding, bool isClassProperty);
+
+        ExpressionNode* expressionName() const { return m_expression; }
+        const Identifier* name() const { return m_name; }
+
+        Type type() const { return static_cast<Type>(m_type); }
+        bool needsSuperBinding() const { return m_needsSuperBinding; }
+        bool isClassProperty() const { return m_isClassProperty; }
+        PutType putType() const { return static_cast<PutType>(m_putType); }
+
+    private:
+        friend class PropertyListNode;
+        const Identifier* m_name;
+        ExpressionNode* m_expression;
+        ExpressionNode* m_assign;
+        unsigned m_type : 5;
+        unsigned m_needsSuperBinding : 1;
+        unsigned m_putType : 1;
+        unsigned m_isClassProperty: 1;
+    };
+
+    class PropertyListNode : public ExpressionNode {
+    public:
+        PropertyListNode(const JSTokenLocation&, PropertyNode*);
+        PropertyListNode(const JSTokenLocation&, PropertyNode*, PropertyListNode*);
+
+        bool hasStaticallyNamedProperty(const Identifier& propName);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        void emitPutConstantProperty(BytecodeGenerator&, RegisterID*, PropertyNode&);
+
+        PropertyNode* m_node;
+        PropertyListNode* m_next;
+    };
+
+    class ObjectLiteralNode : public ExpressionNode {
+    public:
+        ObjectLiteralNode(const JSTokenLocation&);
+        ObjectLiteralNode(const JSTokenLocation&, PropertyListNode*);
+        bool isObjectLiteral() const override { return true; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        PropertyListNode* m_list;
+    };
+    
+    class BracketAccessorNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        BracketAccessorNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments);
+
+        ExpressionNode* base() const { return m_base; }
+        ExpressionNode* subscript() const { return m_subscript; }
+
+        bool subscriptHasAssignments() const { return m_subscriptHasAssignments; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isLocation() const override { return true; }
+        bool isBracketAccessorNode() const override { return true; }
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        bool m_subscriptHasAssignments;
+    };
+
+    class DotAccessorNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        DotAccessorNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&);
+
+        ExpressionNode* base() const { return m_base; }
+        const Identifier& identifier() const { return m_ident; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isLocation() const override { return true; }
+        bool isDotAccessorNode() const override { return true; }
+
+        ExpressionNode* m_base;
+        const Identifier& m_ident;
+    };
+
+    class SpreadExpressionNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        SpreadExpressionNode(const JSTokenLocation&, ExpressionNode*);
+        
+        ExpressionNode* expression() const { return m_expression; }
+        
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        
+        bool isSpreadExpression() const override { return true; }
+        ExpressionNode* m_expression;
+    };
+
+    class ArgumentListNode : public ExpressionNode {
+    public:
+        ArgumentListNode(const JSTokenLocation&, ExpressionNode*);
+        ArgumentListNode(const JSTokenLocation&, ArgumentListNode*, ExpressionNode*);
+
+        ArgumentListNode* m_next;
+        ExpressionNode* m_expr;
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class ArgumentsNode : public ParserArenaFreeable {
+    public:
+        ArgumentsNode();
+        ArgumentsNode(ArgumentListNode*);
+
+        ArgumentListNode* m_listNode;
+    };
+
+    class NewExprNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        NewExprNode(const JSTokenLocation&, ExpressionNode*);
+        NewExprNode(const JSTokenLocation&, ExpressionNode*, ArgumentsNode*);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+        ArgumentsNode* m_args;
+    };
+
+    class EvalFunctionCallNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        EvalFunctionCallNode(const JSTokenLocation&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ArgumentsNode* m_args;
+    };
+
+    class FunctionCallValueNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        FunctionCallValueNode(const JSTokenLocation&, ExpressionNode*, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+        ArgumentsNode* m_args;
+    };
+
+    class FunctionCallResolveNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        FunctionCallResolveNode(const JSTokenLocation&, const Identifier&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+        ArgumentsNode* m_args;
+    };
+    
+    class FunctionCallBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
+    public:
+        FunctionCallBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ArgumentsNode* m_args;
+        bool m_subscriptHasAssignments;
+    };
+
+    class FunctionCallDotNode : public ExpressionNode, public ThrowableSubExpressionData {
+    public:
+        FunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+    protected:
+        ExpressionNode* m_base;
+        const Identifier& m_ident;
+        ArgumentsNode* m_args;
+    };
+
+    class BytecodeIntrinsicNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        enum class Type {
+            Constant,
+            Function
+        };
+
+        typedef RegisterID* (BytecodeIntrinsicNode::* EmitterType)(BytecodeGenerator&, RegisterID*);
+
+        BytecodeIntrinsicNode(Type, const JSTokenLocation&, EmitterType, const Identifier&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+        bool isBytecodeIntrinsicNode() const override { return true; }
+
+        Type type() const { return m_type; }
+        EmitterType emitter() const { return m_emitter; }
+        const Identifier& identifier() const { return m_ident; }
+
+#define JSC_DECLARE_BYTECODE_INTRINSIC_FUNCTIONS(name) RegisterID* emit_intrinsic_##name(BytecodeGenerator&, RegisterID*);
+        JSC_COMMON_BYTECODE_INTRINSIC_FUNCTIONS_EACH_NAME(JSC_DECLARE_BYTECODE_INTRINSIC_FUNCTIONS)
+        JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(JSC_DECLARE_BYTECODE_INTRINSIC_FUNCTIONS)
+#undef JSC_DECLARE_BYTECODE_INTRINSIC_FUNCTIONS
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        Type m_type;
+        EmitterType m_emitter;
+        const Identifier& m_ident;
+        ArgumentsNode* m_args;
+    };
+
+    class CallFunctionCallDotNode : public FunctionCallDotNode {
+    public:
+        CallFunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+    
+    class ApplyFunctionCallDotNode : public FunctionCallDotNode {
+    public:
+        ApplyFunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class DeleteResolveNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        DeleteResolveNode(const JSTokenLocation&, const Identifier&, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+    };
+
+    class DeleteBracketNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        DeleteBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+    };
+
+    class DeleteDotNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        DeleteDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_base;
+        const Identifier& m_ident;
+    };
+
+    class DeleteValueNode : public ExpressionNode {
+    public:
+        DeleteValueNode(const JSTokenLocation&, ExpressionNode*);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+    };
+
+    class VoidNode : public ExpressionNode {
+    public:
+        VoidNode(const JSTokenLocation&, ExpressionNode*);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+    };
+
+    class TypeOfResolveNode : public ExpressionNode {
+    public:
+        TypeOfResolveNode(const JSTokenLocation&, const Identifier&);
+
+        const Identifier& identifier() const { return m_ident; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+    };
+
+    class TypeOfValueNode : public ExpressionNode {
+    public:
+        TypeOfValueNode(const JSTokenLocation&, ExpressionNode*);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+    };
+
+    class PrefixNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
+    public:
+        PrefixNode(const JSTokenLocation&, ExpressionNode*, Operator, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    protected:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        virtual RegisterID* emitResolve(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitBracket(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitDot(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        Operator m_operator;
+    };
+
+    class PostfixNode : public PrefixNode {
+    public:
+        PostfixNode(const JSTokenLocation&, ExpressionNode*, Operator, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        RegisterID* emitResolve(BytecodeGenerator&, RegisterID* = 0) override;
+        RegisterID* emitBracket(BytecodeGenerator&, RegisterID* = 0) override;
+        RegisterID* emitDot(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class UnaryOpNode : public ExpressionNode {
+    public:
+        UnaryOpNode(const JSTokenLocation&, ResultType, ExpressionNode*, OpcodeID);
+
+    protected:
+        ExpressionNode* expr() { return m_expr; }
+        const ExpressionNode* expr() const { return m_expr; }
+        OpcodeID opcodeID() const { return m_opcodeID; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+        OpcodeID m_opcodeID;
+    };
+
+    class UnaryPlusNode : public UnaryOpNode {
+    public:
+        UnaryPlusNode(const JSTokenLocation&, ExpressionNode*);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* stripUnaryPlus() override { return expr(); }
+    };
+
+    class NegateNode : public UnaryOpNode {
+    public:
+        NegateNode(const JSTokenLocation&, ExpressionNode*);
+    };
+
+    class BitwiseNotNode : public ExpressionNode {
+    public:
+        BitwiseNotNode(const JSTokenLocation&, ExpressionNode*);
+
+    protected:
+        ExpressionNode* expr() { return m_expr; }
+        const ExpressionNode* expr() const { return m_expr; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+    };
+ 
+    class LogicalNotNode : public UnaryOpNode {
+    public:
+        LogicalNotNode(const JSTokenLocation&, ExpressionNode*);
+    private:
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, FallThroughMode) override;
+    };
+
+    class BinaryOpNode : public ExpressionNode {
+    public:
+        BinaryOpNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        BinaryOpNode(const JSTokenLocation&, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+
+        RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* destination, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, FallThroughMode) override;
+
+        ExpressionNode* lhs() { return m_expr1; };
+        ExpressionNode* rhs() { return m_expr2; };
+
+    private:
+        void tryFoldToBranch(BytecodeGenerator&, TriState& branchCondition, ExpressionNode*& branchExpression);
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+    protected:
+        OpcodeID opcodeID() const { return m_opcodeID; }
+
+    protected:
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+    private:
+        OpcodeID m_opcodeID;
+    protected:
+        bool m_rightHasAssignments;
+    };
+
+    class PowNode : public BinaryOpNode {
+    public:
+        PowNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class MultNode : public BinaryOpNode {
+    public:
+        MultNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class DivNode : public BinaryOpNode {
+    public:
+        DivNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class ModNode : public BinaryOpNode {
+    public:
+        ModNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class AddNode : public BinaryOpNode {
+    public:
+        AddNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+
+        bool isAdd() const override { return true; }
+    };
+
+    class SubNode : public BinaryOpNode {
+    public:
+        SubNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+
+        bool isSubtract() const override { return true; }
+    };
+
+    class LeftShiftNode : public BinaryOpNode {
+    public:
+        LeftShiftNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class RightShiftNode : public BinaryOpNode {
+    public:
+        RightShiftNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class UnsignedRightShiftNode : public BinaryOpNode {
+    public:
+        UnsignedRightShiftNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class LessNode : public BinaryOpNode {
+    public:
+        LessNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class GreaterNode : public BinaryOpNode {
+    public:
+        GreaterNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class LessEqNode : public BinaryOpNode {
+    public:
+        LessEqNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class GreaterEqNode : public BinaryOpNode {
+    public:
+        GreaterEqNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class ThrowableBinaryOpNode : public BinaryOpNode, public ThrowableExpressionData {
+    public:
+        ThrowableBinaryOpNode(const JSTokenLocation&, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ThrowableBinaryOpNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+    
+    class InstanceOfNode : public ThrowableBinaryOpNode {
+    public:
+        InstanceOfNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class InNode : public ThrowableBinaryOpNode {
+    public:
+        InNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class EqualNode : public BinaryOpNode {
+    public:
+        EqualNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class NotEqualNode : public BinaryOpNode {
+    public:
+        NotEqualNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class StrictEqualNode : public BinaryOpNode {
+    public:
+        StrictEqualNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class NotStrictEqualNode : public BinaryOpNode {
+    public:
+        NotStrictEqualNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class BitAndNode : public BinaryOpNode {
+    public:
+        BitAndNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class BitOrNode : public BinaryOpNode {
+    public:
+        BitOrNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    class BitXOrNode : public BinaryOpNode {
+    public:
+        BitXOrNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
+    };
+
+    // m_expr1 && m_expr2, m_expr1 || m_expr2
+    class LogicalOpNode : public ExpressionNode {
+    public:
+        LogicalOpNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        void emitBytecodeInConditionContext(BytecodeGenerator&, Label* trueTarget, Label* falseTarget, FallThroughMode) override;
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+        LogicalOperator m_operator;
+    };
+
+    // The ternary operator, "m_logical ? m_expr1 : m_expr2"
+    class ConditionalNode : public ExpressionNode {
+    public:
+        ConditionalNode(const JSTokenLocation&, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_logical;
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+    };
+
+    class ReadModifyResolveNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        ReadModifyResolveNode(const JSTokenLocation&, const Identifier&, Operator, ExpressionNode*  right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+        ExpressionNode* m_right;
+        Operator m_operator;
+        bool m_rightHasAssignments;
+    };
+
+    class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        AssignResolveNode(const JSTokenLocation&, const Identifier&, ExpressionNode* right, AssignmentContext);
+        bool isAssignResolveNode() const override { return true; }
+        const Identifier& identifier() const { return m_ident; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+        ExpressionNode* m_right;
+        AssignmentContext m_assignmentContext;
+    };
+
+    class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
+    public:
+        ReadModifyBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, Operator, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ExpressionNode* m_right;
+        unsigned m_operator : 30;
+        bool m_subscriptHasAssignments : 1;
+        bool m_rightHasAssignments : 1;
+    };
+
+    class AssignBracketNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        AssignBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ExpressionNode* m_right;
+        bool m_subscriptHasAssignments : 1;
+        bool m_rightHasAssignments : 1;
+    };
+
+    class AssignDotNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        AssignDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_base;
+        const Identifier& m_ident;
+        ExpressionNode* m_right;
+        bool m_rightHasAssignments;
+    };
+
+    class ReadModifyDotNode : public ExpressionNode, public ThrowableSubExpressionData {
+    public:
+        ReadModifyDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, Operator, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_base;
+        const Identifier& m_ident;
+        ExpressionNode* m_right;
+        unsigned m_operator : 31;
+        bool m_rightHasAssignments : 1;
+    };
+
+    class AssignErrorNode : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        AssignErrorNode(const JSTokenLocation&, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+    
+    class CommaNode final : public ExpressionNode {
+    public:
+        CommaNode(const JSTokenLocation&, ExpressionNode*);
+
+        void setNext(CommaNode* next) { m_next = next; }
+        CommaNode* next() { return m_next; }
+
+    private:
+        bool isCommaNode() const override { return true; }
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+        CommaNode* m_next;
+    };
+    
+    class SourceElements final : public ParserArenaFreeable {
+    public:
+        SourceElements();
+
+        void append(StatementNode*);
+
+        StatementNode* singleStatement() const;
+        StatementNode* lastStatement() const;
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* destination);
+        void analyzeModule(ModuleAnalyzer&);
+
+    private:
+        StatementNode* m_head;
+        StatementNode* m_tail;
+    };
+
+    class BlockNode : public StatementNode, public VariableEnvironmentNode {
+    public:
+        using ParserArenaDeletable::operator new;
+
+        BlockNode(const JSTokenLocation&, SourceElements*, VariableEnvironment&, FunctionStack&&);
+
+        StatementNode* singleStatement() const;
+        StatementNode* lastStatement() const;
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isBlock() const override { return true; }
+
+        SourceElements* m_statements;
+    };
+
+    class EmptyStatementNode : public StatementNode {
+    public:
+        EmptyStatementNode(const JSTokenLocation&);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isEmptyStatement() const override { return true; }
+    };
+    
+    class DebuggerStatementNode : public StatementNode {
+    public:
+        DebuggerStatementNode(const JSTokenLocation&);
+
+        bool isDebuggerStatement() const override { return true; }
+        
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class ExprStatementNode : public StatementNode {
+    public:
+        ExprStatementNode(const JSTokenLocation&, ExpressionNode*);
+
+        ExpressionNode* expr() const { return m_expr; }
+
+    private:
+        bool isExprStatement() const override { return true; }
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+    };
+
+    class DeclarationStatement : public StatementNode {
+    public:
+        DeclarationStatement(const JSTokenLocation&, ExpressionNode*);
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+    };
+
+    class EmptyVarExpression : public ExpressionNode {
+    public:
+        EmptyVarExpression(const JSTokenLocation&, const Identifier&);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+    };
+
+    class EmptyLetExpression : public ExpressionNode {
+    public:
+        EmptyLetExpression(const JSTokenLocation&, const Identifier&);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+    };
+
+    class IfElseNode : public StatementNode {
+    public:
+        IfElseNode(const JSTokenLocation&, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        bool tryFoldBreakAndContinue(BytecodeGenerator&, StatementNode* ifBlock,
+            Label*& trueTarget, FallThroughMode&);
+
+        ExpressionNode* m_condition;
+        StatementNode* m_ifBlock;
+        StatementNode* m_elseBlock;
+    };
+
+    class DoWhileNode : public StatementNode {
+    public:
+        DoWhileNode(const JSTokenLocation&, StatementNode*, ExpressionNode*);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        StatementNode* m_statement;
+        ExpressionNode* m_expr;
+    };
+
+    class WhileNode : public StatementNode {
+    public:
+        WhileNode(const JSTokenLocation&, ExpressionNode*, StatementNode*);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
+    };
+
+    class ForNode : public StatementNode, public VariableEnvironmentNode {
+    public:
+        using ParserArenaDeletable::operator new;
+
+        ForNode(const JSTokenLocation&, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*, VariableEnvironment&);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+        ExpressionNode* m_expr3;
+        StatementNode* m_statement;
+    };
+    
+    class DestructuringPatternNode;
+    
+    class EnumerationNode : public StatementNode, public ThrowableExpressionData, public VariableEnvironmentNode {
+    public:
+        using ParserArenaDeletable::operator new;
+
+        EnumerationNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, VariableEnvironment&);
+
+        ExpressionNode* lexpr() const { return m_lexpr; }
+        ExpressionNode* expr() const { return m_expr; }
+
+    protected:
+        ExpressionNode* m_lexpr;
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
+    };
+    
+    class ForInNode : public EnumerationNode {
+    public:
+        ForInNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, VariableEnvironment&);
+
+    private:
+        RegisterID* tryGetBoundLocal(BytecodeGenerator&);
+        void emitLoopHeader(BytecodeGenerator&, RegisterID* propertyName);
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+    
+    class ForOfNode : public EnumerationNode {
+    public:
+        ForOfNode(const JSTokenLocation&, ExpressionNode*, ExpressionNode*, StatementNode*, VariableEnvironment&);
+        bool isForOfNode() const override { return true; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class ContinueNode : public StatementNode, public ThrowableExpressionData {
+    public:
+        ContinueNode(const JSTokenLocation&, const Identifier&);
+        Label* trivialTarget(BytecodeGenerator&);
+        
+    private:
+        bool isContinue() const override { return true; }
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+    };
+
+    class BreakNode : public StatementNode, public ThrowableExpressionData {
+    public:
+        BreakNode(const JSTokenLocation&, const Identifier&);
+        Label* trivialTarget(BytecodeGenerator&);
+        
+    private:
+        bool isBreak() const override { return true; }
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_ident;
+    };
+
+    class ReturnNode : public StatementNode, public ThrowableExpressionData {
+    public:
+        ReturnNode(const JSTokenLocation&, ExpressionNode* value);
+
+        ExpressionNode* value() { return m_value; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isReturnNode() const override { return true; }
+
+        ExpressionNode* m_value;
+    };
+
+    class WithNode : public StatementNode {
+    public:
+        WithNode(const JSTokenLocation&, ExpressionNode*, StatementNode*, const JSTextPosition& divot, uint32_t expressionLength);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
+        JSTextPosition m_divot;
+        uint32_t m_expressionLength;
+    };
+
+    class LabelNode : public StatementNode, public ThrowableExpressionData {
+    public:
+        LabelNode(const JSTokenLocation&, const Identifier& name, StatementNode*);
+
+        bool isLabel() const override { return true; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        const Identifier& m_name;
+        StatementNode* m_statement;
+    };
+
+    class ThrowNode : public StatementNode, public ThrowableExpressionData {
+    public:
+        ThrowNode(const JSTokenLocation&, ExpressionNode*);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+    };
+
+    class TryNode : public StatementNode, public VariableEnvironmentNode {
+    public:
+        using ParserArenaDeletable::operator new;
+
+        TryNode(const JSTokenLocation&, StatementNode* tryBlock, DestructuringPatternNode* catchPattern, StatementNode* catchBlock, VariableEnvironment& catchEnvironment, StatementNode* finallyBlock);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        StatementNode* m_tryBlock;
+        DestructuringPatternNode* m_catchPattern;
+        StatementNode* m_catchBlock;
+        StatementNode* m_finallyBlock;
+    };
+
+    class ScopeNode : public StatementNode, public ParserArenaRoot, public VariableEnvironmentNode {
+    public:
+
+        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, bool inStrictContext);
+        ScopeNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, const SourceCode&, SourceElements*, VariableEnvironment&, FunctionStack&&, VariableEnvironment&, UniquedStringImplPtrSet&&, CodeFeatures, InnerArrowFunctionCodeFeatures, int numConstants);
+
+        using ParserArenaRoot::operator new;
+
+        const SourceCode& source() const { return m_source; }
+        const String& sourceURL() const { return m_source.provider()->url(); }
+        intptr_t sourceID() const { return m_source.providerID(); }
+
+        int startLine() const { return m_startLineNumber; }
+        int startStartOffset() const { return m_startStartOffset; }
+        int startLineStartOffset() const { return m_startLineStartOffset; }
+
+        void setFeatures(CodeFeatures features) { m_features = features; }
+        CodeFeatures features() { return m_features; }
+        InnerArrowFunctionCodeFeatures innerArrowFunctionCodeFeatures() { return m_innerArrowFunctionCodeFeatures; }
+        bool doAnyInnerArrowFunctionsUseAnyFeature() { return m_innerArrowFunctionCodeFeatures != NoInnerArrowFunctionFeatures; }
+        bool doAnyInnerArrowFunctionsUseArguments() { return m_innerArrowFunctionCodeFeatures & ArgumentsInnerArrowFunctionFeature; }
+        bool doAnyInnerArrowFunctionsUseSuperCall() { return m_innerArrowFunctionCodeFeatures & SuperCallInnerArrowFunctionFeature; }
+        bool doAnyInnerArrowFunctionsUseSuperProperty() { return m_innerArrowFunctionCodeFeatures & SuperPropertyInnerArrowFunctionFeature; }
+        bool doAnyInnerArrowFunctionsUseEval() { return m_innerArrowFunctionCodeFeatures & EvalInnerArrowFunctionFeature; }
+        bool doAnyInnerArrowFunctionsUseThis() { return m_innerArrowFunctionCodeFeatures & ThisInnerArrowFunctionFeature; }
+        bool doAnyInnerArrowFunctionsUseNewTarget() { return m_innerArrowFunctionCodeFeatures & NewTargetInnerArrowFunctionFeature; }
+
+        bool usesEval() const { return m_features & EvalFeature; }
+        bool usesArguments() const { return (m_features & ArgumentsFeature) && !(m_features & ShadowsArgumentsFeature); }
+        bool usesArrowFunction() const { return m_features & ArrowFunctionFeature; }
+        bool isStrictMode() const { return m_features & StrictModeFeature; }
+        void setUsesArguments() { m_features |= ArgumentsFeature; }
+        bool usesThis() const { return m_features & ThisFeature; }
+        bool usesSuperCall() const { return m_features & SuperCallFeature; }
+        bool usesSuperProperty() const { return m_features & SuperPropertyFeature; }
+        bool usesNewTarget() const { return m_features & NewTargetFeature; }
+        bool needsActivation() const { return (hasCapturedVariables()) || (m_features & (EvalFeature | WithFeature)); }
+        bool hasCapturedVariables() const { return m_varDeclarations.hasCapturedVariables(); }
+        bool captures(UniquedStringImpl* uid) { return m_varDeclarations.captures(uid); }
+        bool captures(const Identifier& ident) { return captures(ident.impl()); }
+        bool hasSloppyModeHoistedFunction(UniquedStringImpl* uid) const { return m_sloppyModeHoistedFunctions.contains(uid); }
+
+        VariableEnvironment& varDeclarations() { return m_varDeclarations; }
+
+        int neededConstants()
+        {
+            // We may need 2 more constants than the count given by the parser,
+            // because of the various uses of jsUndefined() and jsNull().
+            return m_numConstants + 2;
+        }
+
+        StatementNode* singleStatement() const;
+
+        void emitStatementsBytecode(BytecodeGenerator&, RegisterID* destination);
+        
+        void analyzeModule(ModuleAnalyzer&);
+
+    protected:
+        int m_startLineNumber;
+        unsigned m_startStartOffset;
+        unsigned m_startLineStartOffset;
+
+    private:
+        CodeFeatures m_features;
+        InnerArrowFunctionCodeFeatures m_innerArrowFunctionCodeFeatures;
+        SourceCode m_source;
+        VariableEnvironment m_varDeclarations;
+        UniquedStringImplPtrSet m_sloppyModeHoistedFunctions;
+        int m_numConstants;
+        SourceElements* m_statements;
+    };
+
+    class ProgramNode : public ScopeNode {
+    public:
+        ProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VariableEnvironment&, FunctionStack&&, VariableEnvironment&, UniquedStringImplPtrSet&&, FunctionParameters*, const SourceCode&, CodeFeatures, InnerArrowFunctionCodeFeatures, int numConstants, RefPtr<ModuleScopeData>&&);
+
+        unsigned startColumn() const { return m_startColumn; }
+        unsigned endColumn() const { return m_endColumn; }
+
+        static const bool scopeIsFunction = false;
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        unsigned m_startColumn;
+        unsigned m_endColumn;
+    };
+
+    class EvalNode : public ScopeNode {
+    public:
+        EvalNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VariableEnvironment&, FunctionStack&&, VariableEnvironment&, UniquedStringImplPtrSet&&, FunctionParameters*, const SourceCode&, CodeFeatures, InnerArrowFunctionCodeFeatures, int numConstants, RefPtr<ModuleScopeData>&&);
+
+        ALWAYS_INLINE unsigned startColumn() const { return 0; }
+        unsigned endColumn() const { return m_endColumn; }
+
+        static const bool scopeIsFunction = false;
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        unsigned m_endColumn;
+    };
+
+    class ModuleProgramNode : public ScopeNode {
+    public:
+        ModuleProgramNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VariableEnvironment&, FunctionStack&&, VariableEnvironment&, UniquedStringImplPtrSet&&, FunctionParameters*, const SourceCode&, CodeFeatures, InnerArrowFunctionCodeFeatures, int numConstants, RefPtr<ModuleScopeData>&&);
+
+        unsigned startColumn() const { return m_startColumn; }
+        unsigned endColumn() const { return m_endColumn; }
+
+        static const bool scopeIsFunction = false;
+
+        ModuleScopeData& moduleScopeData()
+        {
+            return m_moduleScopeData;
+        }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        unsigned m_startColumn;
+        unsigned m_endColumn;
+        Ref<ModuleScopeData> m_moduleScopeData;
+    };
+
+    class ModuleNameNode : public Node {
+    public:
+        ModuleNameNode(const JSTokenLocation&, const Identifier& moduleName);
+
+        const Identifier& moduleName() { return m_moduleName; }
+
+    private:
+        const Identifier& m_moduleName;
+    };
+
+    class ImportSpecifierNode : public Node {
+    public:
+        ImportSpecifierNode(const JSTokenLocation&, const Identifier& importedName, const Identifier& localName);
+
+        const Identifier& importedName() { return m_importedName; }
+        const Identifier& localName() { return m_localName; }
+
+    private:
+        const Identifier& m_importedName;
+        const Identifier& m_localName;
+    };
+
+    class ImportSpecifierListNode : public ParserArenaDeletable {
+    public:
+        typedef Vector<ImportSpecifierNode*, 3> Specifiers;
+
+        const Specifiers& specifiers() const { return m_specifiers; }
+        void append(ImportSpecifierNode* specifier)
+        {
+            m_specifiers.append(specifier);
+        }
+
+    private:
+        Specifiers m_specifiers;
+    };
+
+    class ModuleDeclarationNode : public StatementNode {
+    public:
+        virtual void analyzeModule(ModuleAnalyzer&) = 0;
+        bool isModuleDeclarationNode() const override { return true; }
+
+    protected:
+        ModuleDeclarationNode(const JSTokenLocation&);
+    };
+
+    class ImportDeclarationNode : public ModuleDeclarationNode {
+    public:
+        ImportDeclarationNode(const JSTokenLocation&, ImportSpecifierListNode*, ModuleNameNode*);
+
+        ImportSpecifierListNode* specifierList() const { return m_specifierList; }
+        ModuleNameNode* moduleName() const { return m_moduleName; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        void analyzeModule(ModuleAnalyzer&) override;
+
+        ImportSpecifierListNode* m_specifierList;
+        ModuleNameNode* m_moduleName;
+    };
+
+    class ExportAllDeclarationNode : public ModuleDeclarationNode {
+    public:
+        ExportAllDeclarationNode(const JSTokenLocation&, ModuleNameNode*);
+
+        ModuleNameNode* moduleName() const { return m_moduleName; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        void analyzeModule(ModuleAnalyzer&) override;
+
+        ModuleNameNode* m_moduleName;
+    };
+
+    class ExportDefaultDeclarationNode : public ModuleDeclarationNode {
+    public:
+        ExportDefaultDeclarationNode(const JSTokenLocation&, StatementNode*, const Identifier& localName);
+
+        const StatementNode& declaration() const { return *m_declaration; }
+        const Identifier& localName() const { return m_localName; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        void analyzeModule(ModuleAnalyzer&) override;
+        StatementNode* m_declaration;
+        const Identifier& m_localName;
+    };
+
+    class ExportLocalDeclarationNode : public ModuleDeclarationNode {
+    public:
+        ExportLocalDeclarationNode(const JSTokenLocation&, StatementNode*);
+
+        const StatementNode& declaration() const { return *m_declaration; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        void analyzeModule(ModuleAnalyzer&) override;
+        StatementNode* m_declaration;
+    };
+
+    class ExportSpecifierNode : public Node {
+    public:
+        ExportSpecifierNode(const JSTokenLocation&, const Identifier& localName, const Identifier& exportedName);
+
+        const Identifier& exportedName() { return m_exportedName; }
+        const Identifier& localName() { return m_localName; }
+
+    private:
+        const Identifier& m_localName;
+        const Identifier& m_exportedName;
+    };
+
+    class ExportSpecifierListNode : public ParserArenaDeletable {
+    public:
+        typedef Vector<ExportSpecifierNode*, 3> Specifiers;
+
+        const Specifiers& specifiers() const { return m_specifiers; }
+        void append(ExportSpecifierNode* specifier)
+        {
+            m_specifiers.append(specifier);
+        }
+
+    private:
+        Specifiers m_specifiers;
+    };
+
+    class ExportNamedDeclarationNode : public ModuleDeclarationNode {
+    public:
+        ExportNamedDeclarationNode(const JSTokenLocation&, ExportSpecifierListNode*, ModuleNameNode*);
+
+        ExportSpecifierListNode* specifierList() const { return m_specifierList; }
+        ModuleNameNode* moduleName() const { return m_moduleName; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+        void analyzeModule(ModuleAnalyzer&) override;
+        ExportSpecifierListNode* m_specifierList;
+        ModuleNameNode* m_moduleName { nullptr };
+    };
+
+    class FunctionParameters : public ParserArenaDeletable {
+    public:
+        FunctionParameters();
+        ALWAYS_INLINE unsigned size() const { return m_patterns.size(); }
+        ALWAYS_INLINE std::pair<DestructuringPatternNode*, ExpressionNode*> at(unsigned index) { return m_patterns[index]; }
+        ALWAYS_INLINE void append(DestructuringPatternNode* pattern, ExpressionNode* defaultValue) 
+        { 
+            ASSERT(pattern); 
+            m_patterns.append(std::make_pair(pattern, defaultValue));
+        }
+
+    private:
+
+        Vector<std::pair<DestructuringPatternNode*, ExpressionNode*>, 3> m_patterns;
+    };
+
+    class FunctionMetadataNode final : public Node, public ParserArenaDeletable {
+    public:
+        using ParserArenaDeletable::operator new;
+
+        FunctionMetadataNode(
+            ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, 
+            unsigned startColumn, unsigned endColumn, int functionKeywordStart, 
+            int functionNameStart, int parametersStart, bool isInStrictContext, 
+            ConstructorKind, SuperBinding, unsigned parameterCount, unsigned functionLength,
+            SourceParseMode, bool isArrowFunctionBodyExpression);
+
+        void finishParsing(const SourceCode&, const Identifier&, FunctionMode);
+        
+        void overrideName(const Identifier& ident) { m_ident = ident; }
+        const Identifier& ident() { return m_ident; }
+        void setEcmaName(const Identifier& ecmaName) { m_ecmaName = ecmaName; }
+        const Identifier& ecmaName() { return m_ident.isEmpty() ? m_ecmaName : m_ident; }
+        void setInferredName(const Identifier& inferredName) { ASSERT(!inferredName.isNull()); m_inferredName = inferredName; }
+        const Identifier& inferredName() { return m_inferredName.isEmpty() ? m_ident : m_inferredName; }
+
+        FunctionMode functionMode() { return m_functionMode; }
+
+        int functionNameStart() const { return m_functionNameStart; }
+        int functionKeywordStart() const { return m_functionKeywordStart; }
+        int parametersStart() const { return m_parametersStart; }
+        unsigned startColumn() const { return m_startColumn; }
+        unsigned endColumn() const { return m_endColumn; }
+        unsigned parameterCount() const { return m_parameterCount; }
+        unsigned functionLength() const { return m_functionLength; }
+        SourceParseMode parseMode() const { return m_parseMode; }
+
+        void setEndPosition(JSTextPosition);
+
+        const SourceCode& source() const { return m_source; }
+        const SourceCode& classSource() const { return m_classSource; }
+        void setClassSource(const SourceCode& source) { m_classSource = source; }
+
+        int startStartOffset() const { return m_startStartOffset; }
+        bool isInStrictContext() const { return m_isInStrictContext; }
+        SuperBinding superBinding() { return static_cast<SuperBinding>(m_superBinding); }
+        ConstructorKind constructorKind() { return static_cast<ConstructorKind>(m_constructorKind); }
+        bool isArrowFunctionBodyExpression() const { return m_isArrowFunctionBodyExpression; }
+
+        void setLoc(unsigned firstLine, unsigned lastLine, int startOffset, int lineStartOffset)
+        {
+            m_lastLine = lastLine;
+            m_position = JSTextPosition(firstLine, startOffset, lineStartOffset);
+            ASSERT(m_position.offset >= m_position.lineStartOffset);
+        }
+        unsigned lastLine() const { return m_lastLine; }
+
+    protected:
+        Identifier m_ident;
+        Identifier m_ecmaName;
+        Identifier m_inferredName;
+        FunctionMode m_functionMode;
+        unsigned m_startColumn;
+        unsigned m_endColumn;
+        int m_functionKeywordStart;
+        int m_functionNameStart;
+        int m_parametersStart;
+        SourceCode m_source;
+        SourceCode m_classSource;
+        int m_startStartOffset;
+        unsigned m_parameterCount;
+        unsigned m_functionLength;
+        int m_lastLine;
+        SourceParseMode m_parseMode;
+        unsigned m_isInStrictContext : 1;
+        unsigned m_superBinding : 1;
+        unsigned m_constructorKind : 2;
+        unsigned m_isArrowFunctionBodyExpression : 1;
+    };
+
+    class FunctionNode final : public ScopeNode {
+    public:
+        FunctionNode(ParserArena&, const JSTokenLocation& start, const JSTokenLocation& end, unsigned startColumn, unsigned endColumn, SourceElements*, VariableEnvironment&, FunctionStack&&, VariableEnvironment&, UniquedStringImplPtrSet&&, FunctionParameters*, const SourceCode&, CodeFeatures, InnerArrowFunctionCodeFeatures, int numConstants, RefPtr<ModuleScopeData>&&);
+
+        FunctionParameters* parameters() const { return m_parameters; }
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isFunctionNode() const override { return true; }
+
+        void finishParsing(const Identifier&, FunctionMode);
+        
+        const Identifier& ident() { return m_ident; }
+
+        FunctionMode functionMode() const { return m_functionMode; }
+
+        unsigned startColumn() const { return m_startColumn; }
+        unsigned endColumn() const { return m_endColumn; }
+
+        static const bool scopeIsFunction = true;
+
+    private:
+        Identifier m_ident;
+        FunctionMode m_functionMode;
+        FunctionParameters* m_parameters;
+        unsigned m_startColumn;
+        unsigned m_endColumn;
+    };
+
+    class BaseFuncExprNode : public ExpressionNode {
+    public:
+        FunctionMetadataNode* metadata() { return m_metadata; }
+
+        bool isBaseFuncExprNode() const override { return true; }
+
+    protected:
+        BaseFuncExprNode(const JSTokenLocation&, const Identifier&, FunctionMetadataNode*, const SourceCode&, FunctionMode);
+
+        FunctionMetadataNode* m_metadata;
+    };
+
+
+    class FuncExprNode : public BaseFuncExprNode {
+    public:
+        FuncExprNode(const JSTokenLocation&, const Identifier&, FunctionMetadataNode*, const SourceCode&);
+
+    protected:
+        FuncExprNode(const JSTokenLocation&, const Identifier&, FunctionMetadataNode*, const SourceCode&, FunctionMode);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isFuncExprNode() const override { return true; }
+    };
+
+    class ArrowFuncExprNode : public BaseFuncExprNode {
+    public:
+        ArrowFuncExprNode(const JSTokenLocation&, const Identifier&, FunctionMetadataNode*, const SourceCode&);
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isArrowFuncExprNode() const override { return true; }
+    };
+
+    class MethodDefinitionNode : public FuncExprNode {
+    public:
+        MethodDefinitionNode(const JSTokenLocation&, const Identifier&, FunctionMetadataNode*, const SourceCode&);
+        
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+    };
+
+    class YieldExprNode final : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        YieldExprNode(const JSTokenLocation&, ExpressionNode* argument, bool delegate);
+
+        ExpressionNode* argument() const { return m_argument; }
+        bool delegate() const { return m_delegate; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_argument;
+        bool m_delegate;
+    };
+
+    class AwaitExprNode final : public ExpressionNode, public ThrowableExpressionData {
+    public:
+        AwaitExprNode(const JSTokenLocation&, ExpressionNode* argument);
+
+        ExpressionNode* argument() const { return m_argument; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_argument;
+    };
+
+    class ClassExprNode final : public ExpressionNode, public VariableEnvironmentNode {
+    public:
+        using ParserArenaDeletable::operator new;
+
+        ClassExprNode(const JSTokenLocation&, const Identifier&, const SourceCode& classSource,
+            VariableEnvironment& classEnvironment, ExpressionNode* constructorExpresssion,
+            ExpressionNode* parentClass, PropertyListNode* instanceMethods, PropertyListNode* staticMethods);
+
+        const Identifier& name() { return m_name; }
+        const Identifier& ecmaName() { return m_ecmaName ? *m_ecmaName : m_name; }
+        void setEcmaName(const Identifier& name) { m_ecmaName = m_name.isNull() ? &name : &m_name; }
+
+        bool hasStaticProperty(const Identifier& propName) { return m_staticMethods ? m_staticMethods->hasStaticallyNamedProperty(propName) : false; }
+
+    private:
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        bool isClassExprNode() const override { return true; }
+
+        SourceCode m_classSource;
+        const Identifier& m_name;
+        const Identifier* m_ecmaName;
+        ExpressionNode* m_constructorExpression;
+        ExpressionNode* m_classHeritage;
+        PropertyListNode* m_instanceMethods;
+        PropertyListNode* m_staticMethods;
+    };
+
+    class DestructuringPatternNode : public ParserArenaFreeable {
+    public:
+        virtual ~DestructuringPatternNode() { }
+        virtual void collectBoundIdentifiers(Vector<Identifier>&) const = 0;
+        virtual void bindValue(BytecodeGenerator&, RegisterID* source) const = 0;
+        virtual void toString(StringBuilder&) const = 0;
+
+        virtual bool isBindingNode() const { return false; }
+        virtual bool isRestParameter() const { return false; }
+        virtual RegisterID* emitDirectBinding(BytecodeGenerator&, RegisterID*, ExpressionNode*) { return 0; }
+        
+    protected:
+        DestructuringPatternNode();
+    };
+
+    class ArrayPatternNode : public DestructuringPatternNode, public ThrowableExpressionData, public ParserArenaDeletable {
+    public:
+        using ParserArenaDeletable::operator new;
+
+        ArrayPatternNode();
+        enum class BindingType {
+            Elision,
+            Element,
+            RestElement
+        };
+
+        void appendIndex(BindingType bindingType, const JSTokenLocation&, DestructuringPatternNode* node, ExpressionNode* defaultValue)
+        {
+            m_targetPatterns.append({ bindingType, node, defaultValue });
+        }
+
+    private:
+        struct Entry {
+            BindingType bindingType;
+            DestructuringPatternNode* pattern;
+            ExpressionNode* defaultValue;
+        };
+        void collectBoundIdentifiers(Vector<Identifier>&) const override;
+        void bindValue(BytecodeGenerator&, RegisterID*) const override;
+        RegisterID* emitDirectBinding(BytecodeGenerator&, RegisterID* dst, ExpressionNode*) override;
+        void toString(StringBuilder&) const override;
+
+        Vector<Entry> m_targetPatterns;
+    };
+    
+    class ObjectPatternNode : public DestructuringPatternNode, public ParserArenaDeletable {
+    public:
+        using ParserArenaDeletable::operator new;
+        
+        ObjectPatternNode();
+        void appendEntry(const JSTokenLocation&, const Identifier& identifier, bool wasString, DestructuringPatternNode* pattern, ExpressionNode* defaultValue)
+        {
+            m_targetPatterns.append(Entry{ identifier, nullptr, wasString, pattern, defaultValue });
+        }
+
+        void appendEntry(const JSTokenLocation&, ExpressionNode* propertyExpression, DestructuringPatternNode* pattern, ExpressionNode* defaultValue)
+        {
+            m_targetPatterns.append(Entry{ Identifier(), propertyExpression, false, pattern, defaultValue });
+        }
+
+    private:
+        void collectBoundIdentifiers(Vector<Identifier>&) const override;
+        void bindValue(BytecodeGenerator&, RegisterID*) const override;
+        void toString(StringBuilder&) const override;
+        struct Entry {
+            const Identifier& propertyName;
+            ExpressionNode* propertyExpression;
+            bool wasString;
+            DestructuringPatternNode* pattern;
+            ExpressionNode* defaultValue;
+        };
+        Vector<Entry> m_targetPatterns;
+    };
+
+    class BindingNode : public DestructuringPatternNode {
+    public:
+        BindingNode(const Identifier& boundProperty, const JSTextPosition& start, const JSTextPosition& end, AssignmentContext);
+        const Identifier& boundProperty() const { return m_boundProperty; }
+
+        const JSTextPosition& divotStart() const { return m_divotStart; }
+        const JSTextPosition& divotEnd() const { return m_divotEnd; }
+        
+    private:
+        void collectBoundIdentifiers(Vector<Identifier>&) const override;
+        void bindValue(BytecodeGenerator&, RegisterID*) const override;
+        void toString(StringBuilder&) const override;
+        
+        bool isBindingNode() const override { return true; }
+
+        JSTextPosition m_divotStart;
+        JSTextPosition m_divotEnd;
+        const Identifier& m_boundProperty;
+        AssignmentContext m_bindingContext;
+    };
+
+    class RestParameterNode : public DestructuringPatternNode {
+    public:
+        RestParameterNode(DestructuringPatternNode*, unsigned numParametersToSkip);
+
+        bool isRestParameter() const override { return true; }
+
+        void emit(BytecodeGenerator&);
+
+    private:
+        void collectBoundIdentifiers(Vector<Identifier>&) const override;
+        void bindValue(BytecodeGenerator&, RegisterID*) const override;
+        void toString(StringBuilder&) const override;
+
+        DestructuringPatternNode* m_pattern;
+        unsigned m_numParametersToSkip;
+    };
+
+    class AssignmentElementNode : public DestructuringPatternNode {
+    public:
+        AssignmentElementNode(ExpressionNode* assignmentTarget, const JSTextPosition& start, const JSTextPosition& end);
+        const ExpressionNode* assignmentTarget() { return m_assignmentTarget; }
+
+        const JSTextPosition& divotStart() const { return m_divotStart; }
+        const JSTextPosition& divotEnd() const { return m_divotEnd; }
+
+    private:
+        void collectBoundIdentifiers(Vector<Identifier>&) const override;
+        void bindValue(BytecodeGenerator&, RegisterID*) const override;
+        void toString(StringBuilder&) const override;
+
+        JSTextPosition m_divotStart;
+        JSTextPosition m_divotEnd;
+        ExpressionNode* m_assignmentTarget;
+    };
+
+    class DestructuringAssignmentNode : public ExpressionNode {
+    public:
+        DestructuringAssignmentNode(const JSTokenLocation&, DestructuringPatternNode*, ExpressionNode*);
+        DestructuringPatternNode* bindings() { return m_bindings; }
+        
+    private:
+        bool isAssignmentLocation() const override { return true; }
+        bool isDestructuringNode() const override { return true; }
+        RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        DestructuringPatternNode* m_bindings;
+        ExpressionNode* m_initializer;
+    };
+
+    class FuncDeclNode : public StatementNode {
+    public:
+        FuncDeclNode(const JSTokenLocation&, const Identifier&, FunctionMetadataNode*, const SourceCode&);
+
+        bool isFuncDeclNode() const override { return true; }
+        FunctionMetadataNode* metadata() { return m_metadata; }
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        FunctionMetadataNode* m_metadata;
+    };
+
+    class ClassDeclNode final : public StatementNode {
+    public:
+        ClassDeclNode(const JSTokenLocation&, ExpressionNode* classExpression);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_classDeclaration;
+    };
+
+    class CaseClauseNode : public ParserArenaFreeable {
+    public:
+        CaseClauseNode(ExpressionNode*, SourceElements* = 0);
+
+        ExpressionNode* expr() const { return m_expr; }
+
+        void emitBytecode(BytecodeGenerator&, RegisterID* destination);
+        void setStartOffset(int offset) { m_startOffset = offset; }
+
+    private:
+        ExpressionNode* m_expr;
+        SourceElements* m_statements;
+        int m_startOffset;
+    };
+
+    class ClauseListNode : public ParserArenaFreeable {
+    public:
+        ClauseListNode(CaseClauseNode*);
+        ClauseListNode(ClauseListNode*, CaseClauseNode*);
+
+        CaseClauseNode* getClause() const { return m_clause; }
+        ClauseListNode* getNext() const { return m_next; }
+
+    private:
+        CaseClauseNode* m_clause;
+        ClauseListNode* m_next;
+    };
+
+    class CaseBlockNode : public ParserArenaFreeable {
+    public:
+        CaseBlockNode(ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2);
+
+        void emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* destination);
+
+    private:
+        SwitchInfo::SwitchType tryTableSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num);
+        static const size_t s_tableSwitchMinimum = 3;
+        ClauseListNode* m_list1;
+        CaseClauseNode* m_defaultClause;
+        ClauseListNode* m_list2;
+    };
+
+    class SwitchNode : public StatementNode, public VariableEnvironmentNode {
+    public:
+        using ParserArenaDeletable::operator new;
+
+        SwitchNode(const JSTokenLocation&, ExpressionNode*, CaseBlockNode*, VariableEnvironment&, FunctionStack&&);
+
+    private:
+        void emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
+
+        ExpressionNode* m_expr;
+        CaseBlockNode* m_block;
+    };
+
+    struct ElementList {
+        ElementNode* head;
+        ElementNode* tail;
+    };
+
+    struct PropertyList {
+        PropertyListNode* head;
+        PropertyListNode* tail;
+    };
+
+    struct ArgumentList {
+        ArgumentListNode* head;
+        ArgumentListNode* tail;
+    };
+
+    struct ClauseList {
+        ClauseListNode* head;
+        ClauseListNode* tail;
+    };
+
+} // namespace JSC
diff --git a/parser/NodesAnalyzeModule.cpp b/parser/NodesAnalyzeModule.cpp
new file mode 100644
index 0000000..426e53b
--- /dev/null
+++ b/parser/NodesAnalyzeModule.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Nodes.h"
+#include "NodeConstructors.h"
+
+#include "JSCJSValueInlines.h"
+#include "JSModuleRecord.h"
+#include "ModuleAnalyzer.h"
+
+namespace JSC {
+
+void ScopeNode::analyzeModule(ModuleAnalyzer& analyzer)
+{
+    m_statements->analyzeModule(analyzer);
+}
+
+void SourceElements::analyzeModule(ModuleAnalyzer& analyzer)
+{
+    // In the module analyzer phase, only module declarations are included in the top-level SourceElements.
+    for (StatementNode* statement = m_head; statement; statement = statement->next()) {
+        ASSERT(statement->isModuleDeclarationNode());
+        static_cast<ModuleDeclarationNode*>(statement)->analyzeModule(analyzer);
+    }
+}
+
+void ImportDeclarationNode::analyzeModule(ModuleAnalyzer& analyzer)
+{
+    analyzer.moduleRecord()->appendRequestedModule(m_moduleName->moduleName());
+    for (auto* specifier : m_specifierList->specifiers()) {
+        analyzer.moduleRecord()->addImportEntry(JSModuleRecord::ImportEntry {
+            m_moduleName->moduleName(),
+            specifier->importedName(),
+            specifier->localName()
+        });
+    }
+}
+
+void ExportAllDeclarationNode::analyzeModule(ModuleAnalyzer& analyzer)
+{
+    analyzer.moduleRecord()->appendRequestedModule(m_moduleName->moduleName());
+    analyzer.moduleRecord()->addStarExportEntry(m_moduleName->moduleName());
+}
+
+void ExportDefaultDeclarationNode::analyzeModule(ModuleAnalyzer&)
+{
+}
+
+void ExportLocalDeclarationNode::analyzeModule(ModuleAnalyzer&)
+{
+}
+
+void ExportNamedDeclarationNode::analyzeModule(ModuleAnalyzer& analyzer)
+{
+    if (m_moduleName)
+        analyzer.moduleRecord()->appendRequestedModule(m_moduleName->moduleName());
+
+    for (auto* specifier : m_specifierList->specifiers()) {
+        if (m_moduleName) {
+            // export { v } from "mod"
+            //
+            // In this case, no local variable names are imported into the current module.
+            // "v" indirectly points the binding in "mod".
+            analyzer.moduleRecord()->addExportEntry(JSModuleRecord::ExportEntry::createIndirect(specifier->exportedName(), specifier->localName(), m_moduleName->moduleName()));
+        }
+    }
+}
+
+} // namespace JSC
diff --git a/parser/Parser.cpp b/parser/Parser.cpp
new file mode 100644
index 0000000..e582d2f
--- /dev/null
+++ b/parser/Parser.cpp
@@ -0,0 +1,4843 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2006-2010, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Parser.h"
+
+#include "ASTBuilder.h"
+#include "DebuggerParseData.h"
+#include "JSCInlines.h"
+#include "VM.h"
+#include <utility>
+#include <wtf/SetForScope.h>
+#include <wtf/StringPrintStream.h>
+
+#define updateErrorMessage(shouldPrintToken, ...) do {\
+    propagateError(); \
+    logError(shouldPrintToken, __VA_ARGS__); \
+} while (0)
+
+#define propagateError() do { if (UNLIKELY(hasError())) return 0; } while (0)
+#define internalFailWithMessage(shouldPrintToken, ...) do { updateErrorMessage(shouldPrintToken, __VA_ARGS__); return 0; } while (0)
+#define handleErrorToken() do { if (m_token.m_type == EOFTOK || m_token.m_type & ErrorTokenFlag) { failDueToUnexpectedToken(); } } while (0)
+#define failWithMessage(...) do { { handleErrorToken(); updateErrorMessage(true, __VA_ARGS__); } return 0; } while (0)
+#define failWithStackOverflow() do { updateErrorMessage(false, "Stack exhausted"); m_hasStackOverflow = true; return 0; } while (0)
+#define failIfFalse(cond, ...) do { if (!(cond)) { handleErrorToken(); internalFailWithMessage(true, __VA_ARGS__); } } while (0)
+#define failIfTrue(cond, ...) do { if (cond) { handleErrorToken(); internalFailWithMessage(true, __VA_ARGS__); } } while (0)
+#define failIfTrueIfStrict(cond, ...) do { if ((cond) && strictMode()) internalFailWithMessage(false, __VA_ARGS__); } while (0)
+#define failIfFalseIfStrict(cond, ...) do { if ((!(cond)) && strictMode()) internalFailWithMessage(false, __VA_ARGS__); } while (0)
+#define consumeOrFail(tokenType, ...) do { if (!consume(tokenType)) { handleErrorToken(); internalFailWithMessage(true, __VA_ARGS__); } } while (0)
+#define consumeOrFailWithFlags(tokenType, flags, ...) do { if (!consume(tokenType, flags)) { handleErrorToken(); internalFailWithMessage(true, __VA_ARGS__); } } while (0)
+#define matchOrFail(tokenType, ...) do { if (!match(tokenType)) { handleErrorToken(); internalFailWithMessage(true, __VA_ARGS__); } } while (0)
+#define failIfStackOverflow() do { if (UNLIKELY(!canRecurse())) failWithStackOverflow(); } while (0)
+#define semanticFail(...) do { internalFailWithMessage(false, __VA_ARGS__); } while (0)
+#define semanticFailIfTrue(cond, ...) do { if (cond) internalFailWithMessage(false, __VA_ARGS__); } while (0)
+#define semanticFailIfFalse(cond, ...) do { if (!(cond)) internalFailWithMessage(false, __VA_ARGS__); } while (0)
+#define regexFail(failure) do { setErrorMessage(failure); return 0; } while (0)
+#define failDueToUnexpectedToken() do {\
+        logError(true);\
+    return 0;\
+} while (0)
+
+#define handleProductionOrFail(token, tokenString, operation, production) do {\
+    consumeOrFail(token, "Expected '", tokenString, "' to ", operation, " a ", production);\
+} while (0)
+
+#define handleProductionOrFail2(token, tokenString, operation, production) do {\
+    consumeOrFail(token, "Expected '", tokenString, "' to ", operation, " an ", production);\
+} while (0)
+
+#define semanticFailureDueToKeyword(...) do { \
+    if (strictMode() && m_token.m_type == RESERVED_IF_STRICT) \
+        semanticFail("Cannot use the reserved word '", getToken(), "' as a ", __VA_ARGS__, " in strict mode"); \
+    if (m_token.m_type == RESERVED || m_token.m_type == RESERVED_IF_STRICT) \
+        semanticFail("Cannot use the reserved word '", getToken(), "' as a ", __VA_ARGS__); \
+    if (m_token.m_type & KeywordTokenFlag) \
+        semanticFail("Cannot use the keyword '", getToken(), "' as a ", __VA_ARGS__); \
+    if (isDisallowedIdentifierAwait(m_token)) \
+        semanticFail("Can't use 'await' as a ", __VA_ARGS__, " ", disallowedIdentifierAwaitReason()); \
+} while (0)
+
+using namespace std;
+
+namespace JSC {
+
+template <typename LexerType>
+void Parser<LexerType>::logError(bool)
+{
+    if (hasError())
+        return;
+    StringPrintStream stream;
+    printUnexpectedTokenText(stream);
+    setErrorMessage(stream.toStringWithLatin1Fallback());
+}
+
+template <typename LexerType> template <typename A>
+void Parser<LexerType>::logError(bool shouldPrintToken, const A& value1)
+{
+    if (hasError())
+        return;
+    StringPrintStream stream;
+    if (shouldPrintToken) {
+        printUnexpectedTokenText(stream);
+        stream.print(". ");
+    }
+    stream.print(value1, ".");
+    setErrorMessage(stream.toStringWithLatin1Fallback());
+}
+
+template <typename LexerType> template <typename A, typename B>
+void Parser<LexerType>::logError(bool shouldPrintToken, const A& value1, const B& value2)
+{
+    if (hasError())
+        return;
+    StringPrintStream stream;
+    if (shouldPrintToken) {
+        printUnexpectedTokenText(stream);
+        stream.print(". ");
+    }
+    stream.print(value1, value2, ".");
+    setErrorMessage(stream.toStringWithLatin1Fallback());
+}
+
+template <typename LexerType> template <typename A, typename B, typename C>
+void Parser<LexerType>::logError(bool shouldPrintToken, const A& value1, const B& value2, const C& value3)
+{
+    if (hasError())
+        return;
+    StringPrintStream stream;
+    if (shouldPrintToken) {
+        printUnexpectedTokenText(stream);
+        stream.print(". ");
+    }
+    stream.print(value1, value2, value3, ".");
+    setErrorMessage(stream.toStringWithLatin1Fallback());
+}
+
+template <typename LexerType> template <typename A, typename B, typename C, typename D>
+void Parser<LexerType>::logError(bool shouldPrintToken, const A& value1, const B& value2, const C& value3, const D& value4)
+{
+    if (hasError())
+        return;
+    StringPrintStream stream;
+    if (shouldPrintToken) {
+        printUnexpectedTokenText(stream);
+        stream.print(". ");
+    }
+    stream.print(value1, value2, value3, value4, ".");
+    setErrorMessage(stream.toStringWithLatin1Fallback());
+}
+
+template <typename LexerType> template <typename A, typename B, typename C, typename D, typename E>
+void Parser<LexerType>::logError(bool shouldPrintToken, const A& value1, const B& value2, const C& value3, const D& value4, const E& value5)
+{
+    if (hasError())
+        return;
+    StringPrintStream stream;
+    if (shouldPrintToken) {
+        printUnexpectedTokenText(stream);
+        stream.print(". ");
+    }
+    stream.print(value1, value2, value3, value4, value5, ".");
+    setErrorMessage(stream.toStringWithLatin1Fallback());
+}
+
+template <typename LexerType> template <typename A, typename B, typename C, typename D, typename E, typename F>
+void Parser<LexerType>::logError(bool shouldPrintToken, const A& value1, const B& value2, const C& value3, const D& value4, const E& value5, const F& value6)
+{
+    if (hasError())
+        return;
+    StringPrintStream stream;
+    if (shouldPrintToken) {
+        printUnexpectedTokenText(stream);
+        stream.print(". ");
+    }
+    stream.print(value1, value2, value3, value4, value5, value6, ".");
+    setErrorMessage(stream.toStringWithLatin1Fallback());
+}
+
+template <typename LexerType> template <typename A, typename B, typename C, typename D, typename E, typename F, typename G>
+void Parser<LexerType>::logError(bool shouldPrintToken, const A& value1, const B& value2, const C& value3, const D& value4, const E& value5, const F& value6, const G& value7)
+{
+    if (hasError())
+        return;
+    StringPrintStream stream;
+    if (shouldPrintToken) {
+        printUnexpectedTokenText(stream);
+        stream.print(". ");
+    }
+    stream.print(value1, value2, value3, value4, value5, value6, value7, ".");
+    setErrorMessage(stream.toStringWithLatin1Fallback());
+}
+
+template <typename LexerType>
+Parser<LexerType>::Parser(VM* vm, const SourceCode& source, JSParserBuiltinMode builtinMode, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, SourceParseMode parseMode, SuperBinding superBinding, ConstructorKind defaultConstructorKind, DerivedContextType derivedContextType, bool isEvalContext, EvalContextType evalContextType, DebuggerParseData* debuggerParseData)
+    : m_vm(vm)
+    , m_source(&source)
+    , m_hasStackOverflow(false)
+    , m_allowsIn(true)
+    , m_syntaxAlreadyValidated(source.provider()->isValid())
+    , m_statementDepth(0)
+    , m_sourceElements(0)
+    , m_parsingBuiltin(builtinMode == JSParserBuiltinMode::Builtin)
+    , m_scriptMode(scriptMode)
+    , m_superBinding(superBinding)
+    , m_defaultConstructorKind(defaultConstructorKind)
+    , m_immediateParentAllowsFunctionDeclarationInStatement(false)
+    , m_debuggerParseData(debuggerParseData)
+{
+    m_lexer = std::make_unique<LexerType>(vm, builtinMode, scriptMode);
+    m_lexer->setCode(source, &m_parserArena);
+    m_token.m_location.line = source.firstLine().oneBasedInt();
+    m_token.m_location.startOffset = source.startOffset();
+    m_token.m_location.endOffset = source.startOffset();
+    m_token.m_location.lineStartOffset = source.startOffset();
+    m_functionCache = vm->addSourceProviderCache(source.provider());
+    m_expressionErrorClassifier = nullptr;
+
+    ScopeRef scope = pushScope();
+    scope->setSourceParseMode(parseMode);
+    scope->setIsEvalContext(isEvalContext);
+    if (isEvalContext)
+        scope->setEvalContextType(evalContextType);
+    
+    if (derivedContextType == DerivedContextType::DerivedConstructorContext) {
+        scope->setConstructorKind(ConstructorKind::Extends);
+        scope->setExpectedSuperBinding(SuperBinding::Needed);
+    }
+    
+    if (derivedContextType == DerivedContextType::DerivedMethodContext)
+        scope->setExpectedSuperBinding(SuperBinding::Needed);
+
+    if (strictMode == JSParserStrictMode::Strict)
+        scope->setStrictMode();
+
+    if (parseMode == SourceParseMode::ModuleAnalyzeMode || parseMode == SourceParseMode::ModuleEvaluateMode)
+        m_moduleScopeData = ModuleScopeData::create();
+
+    next();
+}
+
+class Scope::MaybeParseAsGeneratorForScope : public SetForScope<bool> {
+public:
+    MaybeParseAsGeneratorForScope(ScopeRef& scope, bool shouldParseAsGenerator)
+        : SetForScope<bool>(scope->m_isGenerator, shouldParseAsGenerator) { }
+};
+
+template <typename LexerType>
+Parser<LexerType>::~Parser()
+{
+}
+
+template <typename LexerType>
+String Parser<LexerType>::parseInner(const Identifier& calleeName, SourceParseMode parseMode)
+{
+    String parseError = String();
+
+    ASTBuilder context(const_cast<VM*>(m_vm), m_parserArena, const_cast<SourceCode*>(m_source));
+    ScopeRef scope = currentScope();
+    scope->setIsLexicalScope();
+    SetForScope<FunctionParsePhase> functionParsePhasePoisoner(m_parserState.functionParsePhase, FunctionParsePhase::Body);
+
+    bool isArrowFunctionBodyExpression = parseMode == SourceParseMode::AsyncArrowFunctionBodyMode && !match(OPENBRACE);
+    if (m_lexer->isReparsingFunction()) {
+        ParserFunctionInfo<ASTBuilder> functionInfo;
+        if (isGeneratorOrAsyncFunctionBodyParseMode(parseMode))
+            m_parameters = createGeneratorParameters(context, functionInfo.parameterCount);
+        else
+            m_parameters = parseFunctionParameters(context, parseMode, functionInfo);
+
+        if (SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(parseMode) && !hasError()) {
+            // The only way we could have an error wile reparsing is if we run out of stack space.
+            RELEASE_ASSERT(match(ARROWFUNCTION));
+            next();
+            isArrowFunctionBodyExpression = !match(OPENBRACE);
+        }
+    }
+
+    if (!calleeName.isNull())
+        scope->declareCallee(&calleeName);
+
+    if (m_lexer->isReparsingFunction())
+        m_statementDepth--;
+
+    SourceElements* sourceElements = nullptr;
+    // The only way we can error this early is if we reparse a function and we run out of stack space.
+    if (!hasError()) {
+        if (isAsyncFunctionWrapperParseMode(parseMode))
+            sourceElements = parseAsyncFunctionSourceElements(context, parseMode, isArrowFunctionBodyExpression, CheckForStrictMode);
+        else if (isArrowFunctionBodyExpression)
+            sourceElements = parseArrowFunctionSingleExpressionBodySourceElements(context);
+        else if (isModuleParseMode(parseMode))
+            sourceElements = parseModuleSourceElements(context, parseMode);
+        else if (parseMode == SourceParseMode::GeneratorWrapperFunctionMode)
+            sourceElements = parseGeneratorFunctionSourceElements(context, calleeName, CheckForStrictMode);
+        else
+            sourceElements = parseSourceElements(context, CheckForStrictMode);
+    }
+
+    bool validEnding = consume(EOFTOK);
+    if (!sourceElements || !validEnding) {
+        if (hasError())
+            parseError = m_errorMessage;
+        else
+            parseError = ASCIILiteral("Parser error");
+    }
+
+    IdentifierSet capturedVariables;
+    UniquedStringImplPtrSet sloppyModeHoistedFunctions;
+    scope->getSloppyModeHoistedFunctions(sloppyModeHoistedFunctions);
+    scope->getCapturedVars(capturedVariables);
+
+    VariableEnvironment& varDeclarations = scope->declaredVariables();
+    for (auto& entry : capturedVariables)
+        varDeclarations.markVariableAsCaptured(entry);
+
+    if (SourceParseModeSet(SourceParseMode::GeneratorWrapperFunctionMode).contains(parseMode) || isAsyncFunctionWrapperParseMode(parseMode)) {
+        if (scope->usedVariablesContains(m_vm->propertyNames->arguments.impl()))
+            context.propagateArgumentsUse();
+    }
+
+    CodeFeatures features = context.features();
+    if (scope->strictMode())
+        features |= StrictModeFeature;
+    if (scope->shadowsArguments())
+        features |= ShadowsArgumentsFeature;
+
+#ifndef NDEBUG
+    if (m_parsingBuiltin && isProgramParseMode(parseMode)) {
+        VariableEnvironment& lexicalVariables = scope->lexicalVariables();
+        const HashSet<UniquedStringImpl*>& closedVariableCandidates = scope->closedVariableCandidates();
+        for (UniquedStringImpl* candidate : closedVariableCandidates) {
+            if (!lexicalVariables.contains(candidate) && !varDeclarations.contains(candidate) && !candidate->isSymbol()) {
+                dataLog("Bad global capture in builtin: '", candidate, "'\n");
+                dataLog(m_source->view());
+                CRASH();
+            }
+        }
+    }
+#endif // NDEBUG
+    didFinishParsing(sourceElements, scope->takeFunctionDeclarations(), varDeclarations, WTFMove(sloppyModeHoistedFunctions), features, context.numConstants());
+
+    return parseError;
+}
+
+template <typename LexerType>
+void Parser<LexerType>::didFinishParsing(SourceElements* sourceElements, DeclarationStacks::FunctionStack&& funcStack, 
+    VariableEnvironment& varDeclarations, UniquedStringImplPtrSet&& sloppyModeHoistedFunctions, CodeFeatures features, int numConstants)
+{
+    m_sourceElements = sourceElements;
+    m_funcDeclarations = WTFMove(funcStack);
+    m_varDeclarations.swap(varDeclarations);
+    m_features = features;
+    m_sloppyModeHoistedFunctions = WTFMove(sloppyModeHoistedFunctions);
+    m_numConstants = numConstants;
+}
+
+template <typename LexerType>
+bool Parser<LexerType>::isArrowFunctionParameters()
+{
+    if (match(OPENPAREN)) {
+        SavePoint saveArrowFunctionPoint = createSavePoint();
+        next();
+        bool isArrowFunction = false;
+        if (match(CLOSEPAREN)) {
+            next();
+            isArrowFunction = match(ARROWFUNCTION);
+        } else {
+            SyntaxChecker syntaxChecker(const_cast<VM*>(m_vm), m_lexer.get());
+            // We make fake scope, otherwise parseFormalParameters will add variable to current scope that lead to errors
+            AutoPopScopeRef fakeScope(this, pushScope());
+            fakeScope->setSourceParseMode(SourceParseMode::ArrowFunctionMode);
+
+            unsigned parametersCount = 0;
+            unsigned functionLength = 0;
+            bool isArrowFunctionParameterList = true;
+            isArrowFunction = parseFormalParameters(syntaxChecker, syntaxChecker.createFormalParameterList(), isArrowFunctionParameterList, parametersCount, functionLength) && consume(CLOSEPAREN) && match(ARROWFUNCTION);
+            propagateError();
+            popScope(fakeScope, syntaxChecker.NeedsFreeVariableInfo);
+        }
+        restoreSavePoint(saveArrowFunctionPoint);
+        return isArrowFunction;
+    }
+
+    if (matchSpecIdentifier()) {
+        SavePoint saveArrowFunctionPoint = createSavePoint();
+        next();
+        bool isArrowFunction = match(ARROWFUNCTION);
+        restoreSavePoint(saveArrowFunctionPoint);
+        return isArrowFunction;
+    }
+
+    return false;
+}
+
+template <typename LexerType>
+bool Parser<LexerType>::allowAutomaticSemicolon()
+{
+    return match(CLOSEBRACE) || match(EOFTOK) || m_lexer->prevTerminator();
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeSourceElements Parser<LexerType>::parseSourceElements(TreeBuilder& context, SourceElementsMode mode)
+{
+    const unsigned lengthOfUseStrictLiteral = 12; // "use strict".length
+    TreeSourceElements sourceElements = context.createSourceElements();
+    const Identifier* directive = 0;
+    unsigned directiveLiteralLength = 0;
+    auto savePoint = createSavePoint();
+    bool shouldCheckForUseStrict = mode == CheckForStrictMode;
+    
+    while (TreeStatement statement = parseStatementListItem(context, directive, &directiveLiteralLength)) {
+        if (shouldCheckForUseStrict) {
+            if (directive) {
+                // "use strict" must be the exact literal without escape sequences or line continuation.
+                if (directiveLiteralLength == lengthOfUseStrictLiteral && m_vm->propertyNames->useStrictIdentifier == *directive) {
+                    setStrictMode();
+                    shouldCheckForUseStrict = false; // We saw "use strict", there is no need to keep checking for it.
+                    if (!isValidStrictMode()) {
+                        if (m_parserState.lastFunctionName) {
+                            if (m_vm->propertyNames->arguments == *m_parserState.lastFunctionName)
+                                semanticFail("Cannot name a function 'arguments' in strict mode");
+                            if (m_vm->propertyNames->eval == *m_parserState.lastFunctionName)
+                                semanticFail("Cannot name a function 'eval' in strict mode");
+                        }
+                        if (hasDeclaredVariable(m_vm->propertyNames->arguments))
+                            semanticFail("Cannot declare a variable named 'arguments' in strict mode");
+                        if (hasDeclaredVariable(m_vm->propertyNames->eval))
+                            semanticFail("Cannot declare a variable named 'eval' in strict mode");
+                        semanticFailIfTrue(currentScope()->hasNonSimpleParameterList(), "'use strict' directive not allowed inside a function with a non-simple parameter list");
+                        semanticFailIfFalse(isValidStrictMode(), "Invalid parameters or function name in strict mode");
+                    }
+                    // Since strict mode is changed, restoring lexer state by calling next() may cause errors.
+                    restoreSavePoint(savePoint);
+                    propagateError();
+                    continue;
+                }
+
+                // We saw a directive, but it wasn't "use strict". We reset our state to
+                // see if the next statement we parse is also a directive.
+                directive = nullptr;
+            } else {
+                // We saw a statement that wasn't in the form of a directive. The spec says that "use strict"
+                // is only allowed as the first statement, or after a sequence of directives before it, but
+                // not after non-directive statements.
+                shouldCheckForUseStrict = false;
+            }
+        }
+        context.appendStatement(sourceElements, statement);
+    }
+
+    propagateError();
+    return sourceElements;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeSourceElements Parser<LexerType>::parseModuleSourceElements(TreeBuilder& context, SourceParseMode parseMode)
+{
+    TreeSourceElements sourceElements = context.createSourceElements();
+    SyntaxChecker syntaxChecker(const_cast<VM*>(m_vm), m_lexer.get());
+
+    while (true) {
+        TreeStatement statement = 0;
+        if (match(IMPORT)) {
+            statement = parseImportDeclaration(context);
+            if (statement)
+                recordPauseLocation(context.breakpointLocation(statement));
+        } else if (match(EXPORT)) {
+            statement = parseExportDeclaration(context);
+            if (statement)
+                recordPauseLocation(context.breakpointLocation(statement));
+        } else {
+            const Identifier* directive = 0;
+            unsigned directiveLiteralLength = 0;
+            if (parseMode == SourceParseMode::ModuleAnalyzeMode) {
+                if (!parseStatementListItem(syntaxChecker, directive, &directiveLiteralLength))
+                    break;
+                continue;
+            }
+            statement = parseStatementListItem(context, directive, &directiveLiteralLength);
+        }
+
+        if (!statement)
+            break;
+        context.appendStatement(sourceElements, statement);
+    }
+
+    propagateError();
+
+    for (const auto& pair : m_moduleScopeData->exportedBindings()) {
+        const auto& uid = pair.key;
+        if (currentScope()->hasDeclaredVariable(uid)) {
+            currentScope()->declaredVariables().markVariableAsExported(uid);
+            continue;
+        }
+
+        if (currentScope()->hasLexicallyDeclaredVariable(uid)) {
+            currentScope()->lexicalVariables().markVariableAsExported(uid);
+            continue;
+        }
+
+        semanticFail("Exported binding '", uid.get(), "' needs to refer to a top-level declared variable");
+    }
+
+    return sourceElements;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeSourceElements Parser<LexerType>::parseGeneratorFunctionSourceElements(TreeBuilder& context, const Identifier& name, SourceElementsMode mode)
+{
+    auto sourceElements = context.createSourceElements();
+
+    unsigned functionKeywordStart = tokenStart();
+    JSTokenLocation startLocation(tokenLocation());
+    JSTextPosition start = tokenStartPosition();
+    unsigned startColumn = tokenColumn();
+    int functionNameStart = m_token.m_location.startOffset;
+    int parametersStart = m_token.m_location.startOffset;
+
+    ParserFunctionInfo<TreeBuilder> info;
+    info.name = &m_vm->propertyNames->nullIdentifier;
+    createGeneratorParameters(context, info.parameterCount);
+    info.startOffset = parametersStart;
+    info.startLine = tokenLine();
+
+    {
+        AutoPopScopeRef generatorBodyScope(this, pushScope());
+        generatorBodyScope->setSourceParseMode(SourceParseMode::GeneratorBodyMode);
+        generatorBodyScope->setConstructorKind(ConstructorKind::None);
+        generatorBodyScope->setExpectedSuperBinding(m_superBinding);
+
+        SyntaxChecker generatorFunctionContext(const_cast<VM*>(m_vm), m_lexer.get());
+        failIfFalse(parseSourceElements(generatorFunctionContext, mode), "Cannot parse the body of a generator");
+        popScope(generatorBodyScope, TreeBuilder::NeedsFreeVariableInfo);
+    }
+    info.body = context.createFunctionMetadata(startLocation, tokenLocation(), startColumn, tokenColumn(), functionKeywordStart, functionNameStart, parametersStart, strictMode(), ConstructorKind::None, m_superBinding, info.parameterCount, info.functionLength, SourceParseMode::GeneratorBodyMode, false);
+
+    info.endLine = tokenLine();
+    info.endOffset = m_token.m_data.offset;
+    info.parametersStartColumn = startColumn;
+
+    auto functionExpr = context.createGeneratorFunctionBody(startLocation, info, name);
+    auto statement = context.createExprStatement(startLocation, functionExpr, start, m_lastTokenEndPosition.line);
+    context.appendStatement(sourceElements, statement);
+
+    return sourceElements;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeSourceElements Parser<LexerType>::parseAsyncFunctionSourceElements(TreeBuilder& context, SourceParseMode parseMode, bool isArrowFunctionBodyExpression, SourceElementsMode mode)
+{
+    ASSERT(isAsyncFunctionWrapperParseMode(parseMode));
+    auto sourceElements = context.createSourceElements();
+
+    unsigned functionKeywordStart = tokenStart();
+    JSTokenLocation startLocation(tokenLocation());
+    JSTextPosition start = tokenStartPosition();
+    unsigned startColumn = tokenColumn();
+    int functionNameStart = m_token.m_location.startOffset;
+    int parametersStart = m_token.m_location.startOffset;
+
+    ParserFunctionInfo<TreeBuilder> info;
+    info.name = &m_vm->propertyNames->nullIdentifier;
+    createGeneratorParameters(context, info.parameterCount);
+    info.startOffset = parametersStart;
+    info.startLine = tokenLine();
+    SourceParseMode innerParseMode = parseMode == SourceParseMode::AsyncArrowFunctionMode
+        ? SourceParseMode::AsyncArrowFunctionBodyMode
+        : SourceParseMode::AsyncFunctionBodyMode;
+    {
+        AutoPopScopeRef asyncFunctionBodyScope(this, pushScope());
+        asyncFunctionBodyScope->setSourceParseMode(innerParseMode);
+        SyntaxChecker syntaxChecker(const_cast<VM*>(m_vm), m_lexer.get());
+        if (isArrowFunctionBodyExpression) {
+            if (m_debuggerParseData)
+                failIfFalse(parseArrowFunctionSingleExpressionBodySourceElements(context), "Cannot parse the body of async arrow function");
+            else
+                failIfFalse(parseArrowFunctionSingleExpressionBodySourceElements(syntaxChecker), "Cannot parse the body of async arrow function");
+        } else {
+            if (m_debuggerParseData)
+                failIfFalse(parseSourceElements(context, mode), "Cannot parse the body of async function");
+            else
+                failIfFalse(parseSourceElements(syntaxChecker, mode), "Cannot parse the body of async function");
+        }
+        popScope(asyncFunctionBodyScope, TreeBuilder::NeedsFreeVariableInfo);
+    }
+    info.body = context.createFunctionMetadata(startLocation, tokenLocation(), startColumn, tokenColumn(), functionKeywordStart, functionNameStart, parametersStart, strictMode(), ConstructorKind::None, m_superBinding, info.parameterCount, info.functionLength, innerParseMode, isArrowFunctionBodyExpression);
+
+    info.endLine = tokenLine();
+    info.endOffset = isArrowFunctionBodyExpression ? tokenLocation().endOffset : m_token.m_data.offset;
+    info.parametersStartColumn = startColumn;
+
+    auto functionExpr = context.createAsyncFunctionBody(startLocation, info, innerParseMode);
+    auto statement = context.createExprStatement(startLocation, functionExpr, start, m_lastTokenEndPosition.line);
+    context.appendStatement(sourceElements, statement);
+
+    return sourceElements;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseStatementListItem(TreeBuilder& context, const Identifier*& directive, unsigned* directiveLiteralLength)
+{
+    // The grammar is documented here:
+    // http://www.ecma-international.org/ecma-262/6.0/index.html#sec-statements
+    DepthManager statementDepth(&m_statementDepth);
+    m_statementDepth++;
+    TreeStatement result = 0;
+    bool shouldSetEndOffset = true;
+    bool shouldSetPauseLocation = false;
+
+    switch (m_token.m_type) {
+    case CONSTTOKEN:
+        result = parseVariableDeclaration(context, DeclarationType::ConstDeclaration);
+        shouldSetPauseLocation = true;
+        break;
+    case LET: {
+        bool shouldParseVariableDeclaration = true;
+        if (!strictMode()) {
+            SavePoint savePoint = createSavePoint();
+            next();
+            // Intentionally use `isIdentifierOrAnyContextualKeyword(m_token)` and don't use `matchSpecIdentifier()`.
+            // We would like to fall into parseVariableDeclaration path even if "yield" is not treated as an Identifier.
+            // For example, under a generator context, matchSpecIdentifier() for "yield" returns `false`.
+            // But we would like to enter parseVariableDeclaration and raise an error under the context of parseVariableDeclaration
+            // to raise consistent errors between "var", "const" and "let".
+            if (!isIdentifierOrAnyContextualKeyword(m_token) && !match(OPENBRACE) && !match(OPENBRACKET))
+                shouldParseVariableDeclaration = false;
+            restoreSavePoint(savePoint);
+        }
+        if (shouldParseVariableDeclaration)
+            result = parseVariableDeclaration(context, DeclarationType::LetDeclaration);
+        else {
+            bool allowFunctionDeclarationAsStatement = true;
+            result = parseExpressionOrLabelStatement(context, allowFunctionDeclarationAsStatement);
+        }
+        shouldSetPauseLocation = !context.shouldSkipPauseLocation(result);
+        break;
+    }
+    case CLASSTOKEN:
+        result = parseClassDeclaration(context);
+        break;
+    case FUNCTION:
+        result = parseFunctionDeclaration(context);
+        break;
+    case ASYNC: {
+        // Eagerly parse as AsyncFunctionDeclaration. This is the uncommon case,
+        // but could be mistakenly parsed as an AsyncFunctionExpression.
+        SavePoint savePoint = createSavePoint();
+        next();
+        if (UNLIKELY(match(FUNCTION) && !m_lexer->prevTerminator())) {
+            result = parseAsyncFunctionDeclaration(context);
+            break;
+        }
+        restoreSavePoint(savePoint);
+        FALLTHROUGH;
+    }
+    case IDENT:
+    case AWAIT:
+    case YIELD: {
+        // This is a convenient place to notice labeled statements
+        // (even though we also parse them as normal statements)
+        // because we allow the following type of code in sloppy mode:
+        // ``` function foo() { label: function bar() { } } ```
+        bool allowFunctionDeclarationAsStatement = true;
+        result = parseExpressionOrLabelStatement(context, allowFunctionDeclarationAsStatement);
+        shouldSetPauseLocation = !context.shouldSkipPauseLocation(result);
+        break;
+    }
+    default:
+        m_statementDepth--; // parseStatement() increments the depth.
+        result = parseStatement(context, directive, directiveLiteralLength);
+        shouldSetEndOffset = false;
+        break;
+    }
+
+    if (result) {
+        if (shouldSetEndOffset)
+            context.setEndOffset(result, m_lastTokenEndPosition.offset);
+        if (shouldSetPauseLocation)
+            recordPauseLocation(context.breakpointLocation(result));
+    }
+
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseVariableDeclaration(TreeBuilder& context, DeclarationType declarationType, ExportType exportType)
+{
+    ASSERT(match(VAR) || match(LET) || match(CONSTTOKEN));
+    JSTokenLocation location(tokenLocation());
+    int start = tokenLine();
+    int end = 0;
+    int scratch;
+    TreeDestructuringPattern scratch1 = 0;
+    TreeExpression scratch2 = 0;
+    JSTextPosition scratch3;
+    bool scratchBool;
+    TreeExpression variableDecls = parseVariableDeclarationList(context, scratch, scratch1, scratch2, scratch3, scratch3, scratch3, VarDeclarationContext, declarationType, exportType, scratchBool);
+    propagateError();
+    failIfFalse(autoSemiColon(), "Expected ';' after variable declaration");
+    
+    return context.createDeclarationStatement(location, variableDecls, start, end);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseDoWhileStatement(TreeBuilder& context)
+{
+    ASSERT(match(DO));
+    int startLine = tokenLine();
+    next();
+    const Identifier* unused = 0;
+    startLoop();
+    TreeStatement statement = parseStatement(context, unused);
+    endLoop();
+    failIfFalse(statement, "Expected a statement following 'do'");
+    int endLine = tokenLine();
+    JSTokenLocation location(tokenLocation());
+    handleProductionOrFail(WHILE, "while", "end", "do-while loop");
+    handleProductionOrFail(OPENPAREN, "(", "start", "do-while loop condition");
+    semanticFailIfTrue(match(CLOSEPAREN), "Must provide an expression as a do-while loop condition");
+    TreeExpression expr = parseExpression(context);
+    failIfFalse(expr, "Unable to parse do-while loop condition");
+    recordPauseLocation(context.breakpointLocation(expr));
+    handleProductionOrFail(CLOSEPAREN, ")", "end", "do-while loop condition");
+    if (match(SEMICOLON))
+        next(); // Always performs automatic semicolon insertion.
+    return context.createDoWhileStatement(location, statement, expr, startLine, endLine);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseWhileStatement(TreeBuilder& context)
+{
+    ASSERT(match(WHILE));
+    JSTokenLocation location(tokenLocation());
+    int startLine = tokenLine();
+    next();
+    
+    handleProductionOrFail(OPENPAREN, "(", "start", "while loop condition");
+    semanticFailIfTrue(match(CLOSEPAREN), "Must provide an expression as a while loop condition");
+    TreeExpression expr = parseExpression(context);
+    failIfFalse(expr, "Unable to parse while loop condition");
+    recordPauseLocation(context.breakpointLocation(expr));
+    int endLine = tokenLine();
+    handleProductionOrFail(CLOSEPAREN, ")", "end", "while loop condition");
+
+    const Identifier* unused = 0;
+    startLoop();
+    TreeStatement statement = parseStatement(context, unused);
+    endLoop();
+    failIfFalse(statement, "Expected a statement as the body of a while loop");
+    return context.createWhileStatement(location, expr, statement, startLine, endLine);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVariableDeclarationList(TreeBuilder& context, int& declarations, TreeDestructuringPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext declarationListContext, DeclarationType declarationType, ExportType exportType, bool& forLoopConstDoesNotHaveInitializer)
+{
+    ASSERT(declarationType == DeclarationType::LetDeclaration || declarationType == DeclarationType::VarDeclaration || declarationType == DeclarationType::ConstDeclaration);
+    TreeExpression head = 0;
+    TreeExpression tail = 0;
+    const Identifier* lastIdent;
+    JSToken lastIdentToken; 
+    AssignmentContext assignmentContext = assignmentContextFromDeclarationType(declarationType);
+    do {
+        lastIdent = 0;
+        lastPattern = TreeDestructuringPattern(0);
+        JSTokenLocation location(tokenLocation());
+        next();
+        TreeExpression node = 0;
+        declarations++;
+        bool hasInitializer = false;
+        if (matchSpecIdentifier()) {
+            failIfTrue(match(LET) && (declarationType == DeclarationType::LetDeclaration || declarationType == DeclarationType::ConstDeclaration), 
+                "Can't use 'let' as an identifier name for a LexicalDeclaration");
+            semanticFailIfTrue(isDisallowedIdentifierAwait(m_token), "Can't use 'await' as a ", declarationTypeToVariableKind(declarationType), " ", disallowedIdentifierAwaitReason());
+            JSTextPosition varStart = tokenStartPosition();
+            JSTokenLocation varStartLocation(tokenLocation());
+            identStart = varStart;
+            const Identifier* name = m_token.m_data.ident;
+            lastIdent = name;
+            lastIdentToken = m_token;
+            next();
+            hasInitializer = match(EQUAL);
+            DeclarationResultMask declarationResult = declareVariable(name, declarationType);
+            if (declarationResult != DeclarationResult::Valid) {
+                failIfTrueIfStrict(declarationResult & DeclarationResult::InvalidStrictMode, "Cannot declare a variable named ", name->impl(), " in strict mode");
+                if (declarationResult & DeclarationResult::InvalidDuplicateDeclaration) {
+                    if (declarationType == DeclarationType::LetDeclaration) 
+                        internalFailWithMessage(false, "Cannot declare a let variable twice: '", name->impl(), "'");
+                    if (declarationType == DeclarationType::ConstDeclaration)
+                        internalFailWithMessage(false, "Cannot declare a const variable twice: '", name->impl(), "'");
+                    ASSERT(declarationType == DeclarationType::VarDeclaration);
+                    internalFailWithMessage(false, "Cannot declare a var variable that shadows a let/const/class variable: '", name->impl(), "'");
+                }
+            }
+            if (exportType == ExportType::Exported) {
+                semanticFailIfFalse(exportName(*name), "Cannot export a duplicate name '", name->impl(), "'");
+                m_moduleScopeData->exportBinding(*name);
+            }
+
+            if (hasInitializer) {
+                JSTextPosition varDivot = tokenStartPosition() + 1;
+                initStart = tokenStartPosition();
+                next(TreeBuilder::DontBuildStrings); // consume '='
+                propagateError();
+                TreeExpression initializer = parseAssignmentExpression(context);
+                initEnd = lastTokenEndPosition();
+                lastInitializer = initializer;
+                failIfFalse(initializer, "Expected expression as the intializer for the variable '", name->impl(), "'");
+                
+                node = context.createAssignResolve(location, *name, initializer, varStart, varDivot, lastTokenEndPosition(), assignmentContext);
+            } else {
+                if (declarationListContext == ForLoopContext && declarationType == DeclarationType::ConstDeclaration)
+                    forLoopConstDoesNotHaveInitializer = true;
+                failIfTrue(declarationListContext != ForLoopContext && declarationType == DeclarationType::ConstDeclaration, "const declared variable '", name->impl(), "'", " must have an initializer");
+                if (declarationType == DeclarationType::VarDeclaration)
+                    node = context.createEmptyVarExpression(varStartLocation, *name);
+                else
+                    node = context.createEmptyLetExpression(varStartLocation, *name);
+            }
+        } else {
+            lastIdent = 0;
+            auto pattern = parseDestructuringPattern(context, destructuringKindFromDeclarationType(declarationType), exportType, nullptr, nullptr, assignmentContext);
+            failIfFalse(pattern, "Cannot parse this destructuring pattern");
+            hasInitializer = match(EQUAL);
+            failIfTrue(declarationListContext == VarDeclarationContext && !hasInitializer, "Expected an initializer in destructuring variable declaration");
+            lastPattern = pattern;
+            if (hasInitializer) {
+                next(TreeBuilder::DontBuildStrings); // consume '='
+                TreeExpression rhs = parseAssignmentExpression(context);
+                propagateError();
+                ASSERT(rhs);
+                node = context.createDestructuringAssignment(location, pattern, rhs);
+                lastInitializer = rhs;
+            }
+        }
+
+        if (node) {
+            if (!head)
+                head = node;
+            else if (!tail) {
+                head = context.createCommaExpr(location, head);
+                tail = context.appendToCommaExpr(location, head, head, node);
+            } else
+                tail = context.appendToCommaExpr(location, head, tail, node);
+        }
+    } while (match(COMMA));
+    if (lastIdent)
+        lastPattern = context.createBindingLocation(lastIdentToken.m_location, *lastIdent, lastIdentToken.m_startPosition, lastIdentToken.m_endPosition, assignmentContext);
+
+    return head;
+}
+
+template <typename LexerType>
+bool Parser<LexerType>::declareRestOrNormalParameter(const Identifier& name, const Identifier** duplicateIdentifier)
+{
+    DeclarationResultMask declarationResult = declareParameter(&name);
+    if ((declarationResult & DeclarationResult::InvalidStrictMode) && strictMode()) {
+        semanticFailIfTrue(isEvalOrArguments(&name), "Cannot destructure to a parameter name '", name.impl(), "' in strict mode");
+        if (m_parserState.lastFunctionName && name == *m_parserState.lastFunctionName)
+            semanticFail("Cannot declare a parameter named '", name.impl(), "' as it shadows the name of a strict mode function");
+        semanticFailureDueToKeyword("parameter name");
+        if (!m_lexer->isReparsingFunction() && hasDeclaredParameter(name))
+            semanticFail("Cannot declare a parameter named '", name.impl(), "' in strict mode as it has already been declared");
+        semanticFail("Cannot declare a parameter named '", name.impl(), "' in strict mode");
+    }
+    if (declarationResult & DeclarationResult::InvalidDuplicateDeclaration) {
+        // It's not always an error to define a duplicate parameter.
+        // It's only an error when there are default parameter values or destructuring parameters.
+        // We note this value now so we can check it later.
+        if (duplicateIdentifier)
+            *duplicateIdentifier = &name;
+    }
+
+    return true;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::createBindingPattern(TreeBuilder& context, DestructuringKind kind, ExportType exportType, const Identifier& name, JSToken token, AssignmentContext bindingContext, const Identifier** duplicateIdentifier)
+{
+    ASSERT(!name.isNull());
+    
+    ASSERT(name.impl()->isAtomic() || name.impl()->isSymbol());
+
+    switch (kind) {
+    case DestructuringKind::DestructureToVariables: {
+        DeclarationResultMask declarationResult = declareVariable(&name);
+        failIfTrueIfStrict(declarationResult & DeclarationResult::InvalidStrictMode, "Cannot declare a variable named '", name.impl(), "' in strict mode");
+        if (declarationResult & DeclarationResult::InvalidDuplicateDeclaration)
+            internalFailWithMessage(false, "Cannot declare a var variable that shadows a let/const/class variable: '", name.impl(), "'");
+        break;
+    }
+
+    case DestructuringKind::DestructureToLet:
+    case DestructuringKind::DestructureToConst:
+    case DestructuringKind::DestructureToCatchParameters: {
+        DeclarationResultMask declarationResult = declareVariable(&name, kind == DestructuringKind::DestructureToConst ? DeclarationType::ConstDeclaration : DeclarationType::LetDeclaration);
+        if (declarationResult != DeclarationResult::Valid) {
+            failIfTrueIfStrict(declarationResult & DeclarationResult::InvalidStrictMode, "Cannot destructure to a variable named '", name.impl(), "' in strict mode");
+            failIfTrue(declarationResult & DeclarationResult::InvalidDuplicateDeclaration, "Cannot declare a lexical variable twice: '", name.impl(), "'");
+        }
+        break;
+    }
+
+    case DestructuringKind::DestructureToParameters: {
+        declareRestOrNormalParameter(name, duplicateIdentifier);
+        propagateError();
+        break;
+    }
+
+    case DestructuringKind::DestructureToExpressions: {
+        break;
+    }
+    }
+
+    if (exportType == ExportType::Exported) {
+        semanticFailIfFalse(exportName(name), "Cannot export a duplicate name '", name.impl(), "'");
+        m_moduleScopeData->exportBinding(name);
+    }
+    return context.createBindingLocation(token.m_location, name, token.m_startPosition, token.m_endPosition, bindingContext);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> NEVER_INLINE TreeDestructuringPattern Parser<LexerType>::createAssignmentElement(TreeBuilder& context, TreeExpression& assignmentTarget, const JSTextPosition& startPosition, const JSTextPosition& endPosition)
+{
+    return context.createAssignmentElement(assignmentTarget, startPosition, endPosition);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeSourceElements Parser<LexerType>::parseArrowFunctionSingleExpressionBodySourceElements(TreeBuilder& context)
+{
+    ASSERT(!match(OPENBRACE));
+
+    JSTokenLocation location(tokenLocation());
+    JSTextPosition start = tokenStartPosition();
+
+    failIfStackOverflow();
+    TreeExpression expr = parseAssignmentExpression(context);
+    failIfFalse(expr, "Cannot parse the arrow function expression");
+    
+    context.setEndOffset(expr, m_lastTokenEndPosition.offset);
+
+    JSTextPosition end = tokenEndPosition();
+    
+    TreeSourceElements sourceElements = context.createSourceElements();
+    TreeStatement body = context.createReturnStatement(location, expr, start, end);
+    context.setEndOffset(body, m_lastTokenEndPosition.offset);
+    recordPauseLocation(context.breakpointLocation(body));
+    context.appendStatement(sourceElements, body);
+
+    return sourceElements;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::tryParseDestructuringPatternExpression(TreeBuilder& context, AssignmentContext bindingContext)
+{
+    return parseDestructuringPattern(context, DestructuringKind::DestructureToExpressions, ExportType::NotExported, nullptr, nullptr, bindingContext);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::parseBindingOrAssignmentElement(TreeBuilder& context, DestructuringKind kind, ExportType exportType, const Identifier** duplicateIdentifier, bool* hasDestructuringPattern, AssignmentContext bindingContext, int depth)
+{
+    if (kind == DestructuringKind::DestructureToExpressions)
+        return parseAssignmentElement(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth);
+    return parseDestructuringPattern(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::parseAssignmentElement(TreeBuilder& context, DestructuringKind kind, ExportType exportType, const Identifier** duplicateIdentifier, bool* hasDestructuringPattern, AssignmentContext bindingContext, int depth)
+{
+    TreeDestructuringPattern assignmentTarget = 0;
+
+    if (match(OPENBRACE) || match(OPENBRACKET)) {
+        SavePoint savePoint = createSavePoint();
+        assignmentTarget = parseDestructuringPattern(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth);
+        if (assignmentTarget && !match(DOT) && !match(OPENBRACKET) && !match(OPENPAREN) && !match(TEMPLATE))
+            return assignmentTarget;
+        restoreSavePoint(savePoint);
+    }
+
+    JSTextPosition startPosition = tokenStartPosition();
+    auto element = parseMemberExpression(context);
+
+    semanticFailIfFalse(element && context.isAssignmentLocation(element), "Invalid destructuring assignment target");
+
+    if (strictMode() && m_parserState.lastIdentifier && context.isResolve(element)) {
+        bool isEvalOrArguments = m_vm->propertyNames->eval == *m_parserState.lastIdentifier || m_vm->propertyNames->arguments == *m_parserState.lastIdentifier;
+        failIfTrueIfStrict(isEvalOrArguments, "Cannot modify '", m_parserState.lastIdentifier->impl(), "' in strict mode");
+    }
+
+    return createAssignmentElement(context, element, startPosition, lastTokenEndPosition());
+}
+
+static const char* destructuringKindToVariableKindName(DestructuringKind kind)
+{
+    switch (kind) {
+    case DestructuringKind::DestructureToLet:
+    case DestructuringKind::DestructureToConst:
+        return "lexical variable name";
+    case DestructuringKind::DestructureToVariables:
+        return "variable name";
+    case DestructuringKind::DestructureToParameters:
+        return "parameter name";
+    case DestructuringKind::DestructureToCatchParameters:
+        return "catch parameter name";
+    case DestructuringKind::DestructureToExpressions:
+        return "expression name";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return "invalid";
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::parseDestructuringPattern(TreeBuilder& context, DestructuringKind kind, ExportType exportType, const Identifier** duplicateIdentifier, bool* hasDestructuringPattern, AssignmentContext bindingContext, int depth)
+{
+    failIfStackOverflow();
+    int nonLHSCount = m_parserState.nonLHSCount;
+    TreeDestructuringPattern pattern;
+    switch (m_token.m_type) {
+    case OPENBRACKET: {
+        JSTextPosition divotStart = tokenStartPosition();
+        auto arrayPattern = context.createArrayPattern(m_token.m_location);
+        next();
+
+        if (hasDestructuringPattern)
+            *hasDestructuringPattern = true;
+
+        bool restElementWasFound = false;
+
+        do {
+            while (match(COMMA)) {
+                context.appendArrayPatternSkipEntry(arrayPattern, m_token.m_location);
+                next();
+            }
+            propagateError();
+
+            if (match(CLOSEBRACKET))
+                break;
+
+            if (UNLIKELY(match(DOTDOTDOT))) {
+                JSTokenLocation location = m_token.m_location;
+                next();
+                auto innerPattern = parseBindingOrAssignmentElement(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth + 1);
+                if (kind == DestructuringKind::DestructureToExpressions && !innerPattern)
+                    return 0;
+                failIfFalse(innerPattern, "Cannot parse this destructuring pattern");
+                context.appendArrayPatternRestEntry(arrayPattern, location, innerPattern);
+                restElementWasFound = true;
+                break;
+            }
+
+            JSTokenLocation location = m_token.m_location;
+            auto innerPattern = parseBindingOrAssignmentElement(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth + 1);
+            if (kind == DestructuringKind::DestructureToExpressions && !innerPattern)
+                return 0;
+            failIfFalse(innerPattern, "Cannot parse this destructuring pattern");
+            TreeExpression defaultValue = parseDefaultValueForDestructuringPattern(context);
+            propagateError();
+            context.appendArrayPatternEntry(arrayPattern, location, innerPattern, defaultValue);
+        } while (consume(COMMA));
+
+        consumeOrFail(CLOSEBRACKET, restElementWasFound ? "Expected a closing ']' following a rest element destructuring pattern" : "Expected either a closing ']' or a ',' following an element destructuring pattern");
+        context.finishArrayPattern(arrayPattern, divotStart, divotStart, lastTokenEndPosition());
+        pattern = arrayPattern;
+        break;
+    }
+    case OPENBRACE: {
+        auto objectPattern = context.createObjectPattern(m_token.m_location);
+        next();
+
+        if (hasDestructuringPattern)
+            *hasDestructuringPattern = true;
+
+        do {
+            bool wasString = false;
+
+            if (match(CLOSEBRACE))
+                break;
+
+            const Identifier* propertyName = nullptr;
+            TreeExpression propertyExpression = 0;
+            TreeDestructuringPattern innerPattern = 0;
+            JSTokenLocation location = m_token.m_location;
+            if (matchSpecIdentifier()) {
+                failIfTrue(match(LET) && (kind == DestructuringKind::DestructureToLet || kind == DestructuringKind::DestructureToConst), "Can't use 'let' as an identifier name for a LexicalDeclaration");
+                propertyName = m_token.m_data.ident;
+                JSToken identifierToken = m_token;
+                next();
+                if (consume(COLON))
+                    innerPattern = parseBindingOrAssignmentElement(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth + 1);
+                else {
+                    if (kind == DestructuringKind::DestructureToExpressions) {
+                        bool isEvalOrArguments = m_vm->propertyNames->eval == *propertyName || m_vm->propertyNames->arguments == *propertyName;
+                        if (isEvalOrArguments && strictMode())
+                            reclassifyExpressionError(ErrorIndicatesPattern, ErrorIndicatesNothing);
+                        failIfTrueIfStrict(isEvalOrArguments, "Cannot modify '", propertyName->impl(), "' in strict mode");
+                    }
+                    semanticFailIfTrue(isDisallowedIdentifierAwait(identifierToken), "Can't use 'await' as a ", destructuringKindToVariableKindName(kind), " ", disallowedIdentifierAwaitReason());
+                    innerPattern = createBindingPattern(context, kind, exportType, *propertyName, identifierToken, bindingContext, duplicateIdentifier);
+                }
+            } else {
+                JSTokenType tokenType = m_token.m_type;
+                switch (m_token.m_type) {
+                case DOUBLE:
+                case INTEGER:
+                    propertyName = &m_parserArena.identifierArena().makeNumericIdentifier(const_cast<VM*>(m_vm), m_token.m_data.doubleValue);
+                    break;
+                case STRING:
+                    propertyName = m_token.m_data.ident;
+                    wasString = true;
+                    break;
+                case OPENBRACKET:
+                    next();
+                    propertyExpression = parseAssignmentExpression(context);
+                    failIfFalse(propertyExpression, "Cannot parse computed property name");
+                    matchOrFail(CLOSEBRACKET, "Expected ']' to end end a computed property name");
+                    break;
+                default:
+                    if (m_token.m_type != RESERVED && m_token.m_type != RESERVED_IF_STRICT && !(m_token.m_type & KeywordTokenFlag)) {
+                        if (kind == DestructuringKind::DestructureToExpressions)
+                            return 0;
+                        failWithMessage("Expected a property name");
+                    }
+                    propertyName = m_token.m_data.ident;
+                    break;
+                }
+                next();
+                if (!consume(COLON)) {
+                    if (kind == DestructuringKind::DestructureToExpressions)
+                        return 0;
+                    semanticFailIfTrue(tokenType == RESERVED, "Cannot use abbreviated destructuring syntax for reserved name '", propertyName->impl(), "'");
+                    semanticFailIfTrue(tokenType == RESERVED_IF_STRICT, "Cannot use abbreviated destructuring syntax for reserved name '", propertyName->impl(), "' in strict mode");
+                    semanticFailIfTrue(tokenType & KeywordTokenFlag, "Cannot use abbreviated destructuring syntax for keyword '", propertyName->impl(), "'");
+                    
+                    failWithMessage("Expected a ':' prior to a named destructuring property");
+                }
+                innerPattern = parseBindingOrAssignmentElement(context, kind, exportType, duplicateIdentifier, hasDestructuringPattern, bindingContext, depth + 1);
+            }
+            if (kind == DestructuringKind::DestructureToExpressions && !innerPattern)
+                return 0;
+            failIfFalse(innerPattern, "Cannot parse this destructuring pattern");
+            TreeExpression defaultValue = parseDefaultValueForDestructuringPattern(context);
+            propagateError();
+            if (propertyExpression)
+                context.appendObjectPatternEntry(objectPattern, location, propertyExpression, innerPattern, defaultValue);
+            else {
+                ASSERT(propertyName);
+                context.appendObjectPatternEntry(objectPattern, location, wasString, *propertyName, innerPattern, defaultValue);
+            }
+        } while (consume(COMMA));
+
+        if (kind == DestructuringKind::DestructureToExpressions && !match(CLOSEBRACE))
+            return 0;
+        consumeOrFail(CLOSEBRACE, "Expected either a closing '}' or an ',' after a property destructuring pattern");
+        pattern = objectPattern;
+        break;
+    }
+
+    default: {
+        if (!matchSpecIdentifier()) {
+            if (kind == DestructuringKind::DestructureToExpressions)
+                return 0;
+            semanticFailureDueToKeyword(destructuringKindToVariableKindName(kind));
+            failWithMessage("Expected a parameter pattern or a ')' in parameter list");
+        }
+        failIfTrue(match(LET) && (kind == DestructuringKind::DestructureToLet || kind == DestructuringKind::DestructureToConst), "Can't use 'let' as an identifier name for a LexicalDeclaration");
+        semanticFailIfTrue(isDisallowedIdentifierAwait(m_token), "Can't use 'await' as a ", destructuringKindToVariableKindName(kind), " ", disallowedIdentifierAwaitReason());
+        pattern = createBindingPattern(context, kind, exportType, *m_token.m_data.ident, m_token, bindingContext, duplicateIdentifier);
+        next();
+        break;
+    }
+    }
+    m_parserState.nonLHSCount = nonLHSCount;
+    return pattern;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseDefaultValueForDestructuringPattern(TreeBuilder& context)
+{
+    if (!match(EQUAL))
+        return 0;
+
+    next(TreeBuilder::DontBuildStrings); // consume '='
+    return parseAssignmentExpression(context);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseForStatement(TreeBuilder& context)
+{
+    ASSERT(match(FOR));
+    JSTokenLocation location(tokenLocation());
+    int startLine = tokenLine();
+    next();
+    handleProductionOrFail(OPENPAREN, "(", "start", "for-loop header");
+    int nonLHSCount = m_parserState.nonLHSCount;
+    int declarations = 0;
+    JSTokenLocation declLocation(tokenLocation());
+    JSTextPosition declsStart;
+    JSTextPosition declsEnd;
+    TreeExpression decls = 0;
+    TreeDestructuringPattern pattern = 0;
+    bool isVarDeclaraton = match(VAR);
+    bool isLetDeclaration = match(LET);
+    bool isConstDeclaration = match(CONSTTOKEN);
+    bool forLoopConstDoesNotHaveInitializer = false;
+
+    VariableEnvironment dummySet;
+    VariableEnvironment* lexicalVariables = nullptr;
+    AutoCleanupLexicalScope lexicalScope;
+
+    auto gatherLexicalVariablesIfNecessary = [&] {
+        if (isLetDeclaration || isConstDeclaration) {
+            ScopeRef scope = lexicalScope.scope();
+            lexicalVariables = &scope->finalizeLexicalEnvironment();
+        } else
+            lexicalVariables = &dummySet;
+    };
+
+    auto popLexicalScopeIfNecessary = [&] {
+        if (isLetDeclaration || isConstDeclaration)
+            popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
+    };
+
+    if (isVarDeclaraton || isLetDeclaration || isConstDeclaration) {
+        /*
+         for (var/let/const IDENT in/of expression) statement
+         for (var/let/const varDeclarationList; expressionOpt; expressionOpt)
+         */
+        if (isLetDeclaration || isConstDeclaration) {
+            ScopeRef newScope = pushScope();
+            newScope->setIsLexicalScope();
+            newScope->preventVarDeclarations();
+            lexicalScope.setIsValid(newScope, this);
+        }
+
+        TreeDestructuringPattern forInTarget = 0;
+        TreeExpression forInInitializer = 0;
+        m_allowsIn = false;
+        JSTextPosition initStart;
+        JSTextPosition initEnd;
+        DeclarationType declarationType;
+        if (isVarDeclaraton)
+            declarationType = DeclarationType::VarDeclaration;
+        else if (isLetDeclaration)
+            declarationType = DeclarationType::LetDeclaration;
+        else if (isConstDeclaration)
+            declarationType = DeclarationType::ConstDeclaration;
+        else
+            RELEASE_ASSERT_NOT_REACHED();
+        decls = parseVariableDeclarationList(context, declarations, forInTarget, forInInitializer, declsStart, initStart, initEnd, ForLoopContext, declarationType, ExportType::NotExported, forLoopConstDoesNotHaveInitializer);
+        m_allowsIn = true;
+        propagateError();
+
+        // Remainder of a standard for loop is handled identically
+        if (match(SEMICOLON))
+            goto standardForLoop;
+
+        failIfFalse(declarations == 1, "can only declare a single variable in an enumeration");
+
+        // Handle for-in with var declaration
+        JSTextPosition inLocation = tokenStartPosition();
+        bool isOfEnumeration = false;
+        if (!consume(INTOKEN)) {
+            failIfFalse(match(IDENT) && *m_token.m_data.ident == m_vm->propertyNames->of, "Expected either 'in' or 'of' in enumeration syntax");
+            isOfEnumeration = true;
+            next();
+        }
+        bool hasAnyAssignments = !!forInInitializer;
+        if (hasAnyAssignments) {
+            if (isOfEnumeration)
+                internalFailWithMessage(false, "Cannot assign to the loop variable inside a for-of loop header");
+            if (strictMode() || (isLetDeclaration || isConstDeclaration) || !context.isBindingNode(forInTarget))
+                internalFailWithMessage(false, "Cannot assign to the loop variable inside a for-in loop header");
+        }
+        TreeExpression expr = parseExpression(context);
+        failIfFalse(expr, "Expected expression to enumerate");
+        recordPauseLocation(context.breakpointLocation(expr));
+        JSTextPosition exprEnd = lastTokenEndPosition();
+        
+        int endLine = tokenLine();
+        
+        handleProductionOrFail(CLOSEPAREN, ")", "end", (isOfEnumeration ? "for-of header" : "for-in header"));
+        
+        const Identifier* unused = 0;
+        startLoop();
+        TreeStatement statement = parseStatement(context, unused);
+        endLoop();
+        failIfFalse(statement, "Expected statement as body of for-", isOfEnumeration ? "of" : "in", " statement");
+        gatherLexicalVariablesIfNecessary();
+        TreeStatement result;
+        if (isOfEnumeration)
+            result = context.createForOfLoop(location, forInTarget, expr, statement, declLocation, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables);
+        else {
+            if (isVarDeclaraton && forInInitializer)
+                result = context.createForInLoop(location, decls, expr, statement, declLocation, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables);
+            else
+                result = context.createForInLoop(location, forInTarget, expr, statement, declLocation, declsStart, inLocation, exprEnd, startLine, endLine, *lexicalVariables);
+        }
+        popLexicalScopeIfNecessary();
+        return result;
+    }
+    
+    if (!match(SEMICOLON)) {
+        if (match(OPENBRACE) || match(OPENBRACKET)) {
+            SavePoint savePoint = createSavePoint();
+            declsStart = tokenStartPosition();
+            pattern = tryParseDestructuringPatternExpression(context, AssignmentContext::DeclarationStatement);
+            declsEnd = lastTokenEndPosition();
+            if (pattern && (match(INTOKEN) || (match(IDENT) && *m_token.m_data.ident == m_vm->propertyNames->of)))
+                goto enumerationLoop;
+            pattern = TreeDestructuringPattern(0);
+            restoreSavePoint(savePoint);
+        }
+        m_allowsIn = false;
+        declsStart = tokenStartPosition();
+        decls = parseExpression(context);
+        declsEnd = lastTokenEndPosition();
+        m_allowsIn = true;
+        failIfFalse(decls, "Cannot parse for loop declarations");
+        recordPauseLocation(context.breakpointLocation(decls));
+    }
+    
+    if (match(SEMICOLON)) {
+    standardForLoop:
+        // Standard for loop
+        if (decls)
+            recordPauseLocation(context.breakpointLocation(decls));
+        next();
+        TreeExpression condition = 0;
+        failIfTrue(forLoopConstDoesNotHaveInitializer && isConstDeclaration, "const variables in for loops must have initializers");
+        
+        if (!match(SEMICOLON)) {
+            condition = parseExpression(context);
+            failIfFalse(condition, "Cannot parse for loop condition expression");
+            recordPauseLocation(context.breakpointLocation(condition));
+        }
+        consumeOrFail(SEMICOLON, "Expected a ';' after the for loop condition expression");
+        
+        TreeExpression increment = 0;
+        if (!match(CLOSEPAREN)) {
+            increment = parseExpression(context);
+            failIfFalse(increment, "Cannot parse for loop iteration expression");
+            recordPauseLocation(context.breakpointLocation(increment));
+        }
+        int endLine = tokenLine();
+        handleProductionOrFail(CLOSEPAREN, ")", "end", "for-loop header");
+        const Identifier* unused = 0;
+        startLoop();
+        TreeStatement statement = parseStatement(context, unused);
+        endLoop();
+        failIfFalse(statement, "Expected a statement as the body of a for loop");
+        gatherLexicalVariablesIfNecessary();
+        TreeStatement result = context.createForLoop(location, decls, condition, increment, statement, startLine, endLine, *lexicalVariables);
+        popLexicalScopeIfNecessary();
+        return result;
+    }
+    
+    // For-in and For-of loop
+enumerationLoop:
+    failIfFalse(nonLHSCount == m_parserState.nonLHSCount, "Expected a reference on the left hand side of an enumeration statement");
+    bool isOfEnumeration = false;
+    if (!consume(INTOKEN)) {
+        failIfFalse(match(IDENT) && *m_token.m_data.ident == m_vm->propertyNames->of, "Expected either 'in' or 'of' in enumeration syntax");
+        isOfEnumeration = true;
+        next();
+    }
+    TreeExpression expr = parseExpression(context);
+    failIfFalse(expr, "Cannot parse subject for-", isOfEnumeration ? "of" : "in", " statement");
+    recordPauseLocation(context.breakpointLocation(expr));
+    JSTextPosition exprEnd = lastTokenEndPosition();
+    int endLine = tokenLine();
+    
+    handleProductionOrFail(CLOSEPAREN, ")", "end", (isOfEnumeration ? "for-of header" : "for-in header"));
+    const Identifier* unused = 0;
+    startLoop();
+    TreeStatement statement = parseStatement(context, unused);
+    endLoop();
+    failIfFalse(statement, "Expected a statement as the body of a for-", isOfEnumeration ? "of" : "in", "loop");
+    gatherLexicalVariablesIfNecessary();
+    TreeStatement result;
+    if (pattern) {
+        ASSERT(!decls);
+        if (isOfEnumeration)
+            result = context.createForOfLoop(location, pattern, expr, statement, declLocation, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);
+        else 
+            result = context.createForInLoop(location, pattern, expr, statement, declLocation, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);
+
+        popLexicalScopeIfNecessary();
+        return result;
+    }
+    if (isOfEnumeration)
+        result = context.createForOfLoop(location, decls, expr, statement, declLocation, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);
+    else
+        result = context.createForInLoop(location, decls, expr, statement, declLocation, declsStart, declsEnd, exprEnd, startLine, endLine, *lexicalVariables);
+    popLexicalScopeIfNecessary();
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBreakStatement(TreeBuilder& context)
+{
+    ASSERT(match(BREAK));
+    JSTokenLocation location(tokenLocation());
+    JSTextPosition start = tokenStartPosition();
+    JSTextPosition end = tokenEndPosition();
+    next();
+    
+    if (autoSemiColon()) {
+        semanticFailIfFalse(breakIsValid(), "'break' is only valid inside a switch or loop statement");
+        return context.createBreakStatement(location, &m_vm->propertyNames->nullIdentifier, start, end);
+    }
+    failIfFalse(matchSpecIdentifier(), "Expected an identifier as the target for a break statement");
+    const Identifier* ident = m_token.m_data.ident;
+    semanticFailIfFalse(getLabel(ident), "Cannot use the undeclared label '", ident->impl(), "'");
+    end = tokenEndPosition();
+    next();
+    failIfFalse(autoSemiColon(), "Expected a ';' following a targeted break statement");
+    return context.createBreakStatement(location, ident, start, end);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseContinueStatement(TreeBuilder& context)
+{
+    ASSERT(match(CONTINUE));
+    JSTokenLocation location(tokenLocation());
+    JSTextPosition start = tokenStartPosition();
+    JSTextPosition end = tokenEndPosition();
+    next();
+    
+    if (autoSemiColon()) {
+        semanticFailIfFalse(continueIsValid(), "'continue' is only valid inside a loop statement");
+        return context.createContinueStatement(location, &m_vm->propertyNames->nullIdentifier, start, end);
+    }
+    failIfFalse(matchSpecIdentifier(), "Expected an identifier as the target for a continue statement");
+    const Identifier* ident = m_token.m_data.ident;
+    ScopeLabelInfo* label = getLabel(ident);
+    semanticFailIfFalse(label, "Cannot use the undeclared label '", ident->impl(), "'");
+    semanticFailIfFalse(label->isLoop, "Cannot continue to the label '", ident->impl(), "' as it is not targeting a loop");
+    end = tokenEndPosition();
+    next();
+    failIfFalse(autoSemiColon(), "Expected a ';' following a targeted continue statement");
+    return context.createContinueStatement(location, ident, start, end);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseReturnStatement(TreeBuilder& context)
+{
+    ASSERT(match(RETURN));
+    JSTokenLocation location(tokenLocation());
+    semanticFailIfFalse(currentScope()->isFunction(), "Return statements are only valid inside functions");
+    JSTextPosition start = tokenStartPosition();
+    JSTextPosition end = tokenEndPosition();
+    next();
+    // We do the auto semicolon check before attempting to parse expression
+    // as we need to ensure the a line break after the return correctly terminates
+    // the statement
+    if (match(SEMICOLON))
+        end = tokenEndPosition();
+
+    if (autoSemiColon())
+        return context.createReturnStatement(location, 0, start, end);
+    TreeExpression expr = parseExpression(context);
+    failIfFalse(expr, "Cannot parse the return expression");
+    end = lastTokenEndPosition();
+    if (match(SEMICOLON))
+        end  = tokenEndPosition();
+    if (!autoSemiColon())
+        failWithMessage("Expected a ';' following a return statement");
+    return context.createReturnStatement(location, expr, start, end);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseThrowStatement(TreeBuilder& context)
+{
+    ASSERT(match(THROW));
+    JSTokenLocation location(tokenLocation());
+    JSTextPosition start = tokenStartPosition();
+    next();
+    failIfTrue(match(SEMICOLON), "Expected expression after 'throw'");
+    semanticFailIfTrue(autoSemiColon(), "Cannot have a newline after 'throw'");
+    
+    TreeExpression expr = parseExpression(context);
+    failIfFalse(expr, "Cannot parse expression for throw statement");
+    JSTextPosition end = lastTokenEndPosition();
+    failIfFalse(autoSemiColon(), "Expected a ';' after a throw statement");
+    
+    return context.createThrowStatement(location, expr, start, end);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseWithStatement(TreeBuilder& context)
+{
+    ASSERT(match(WITH));
+    JSTokenLocation location(tokenLocation());
+    semanticFailIfTrue(strictMode(), "'with' statements are not valid in strict mode");
+    currentScope()->setNeedsFullActivation();
+    int startLine = tokenLine();
+    next();
+
+    handleProductionOrFail(OPENPAREN, "(", "start", "subject of a 'with' statement");
+    int start = tokenStart();
+    TreeExpression expr = parseExpression(context);
+    failIfFalse(expr, "Cannot parse 'with' subject expression");
+    recordPauseLocation(context.breakpointLocation(expr));
+    JSTextPosition end = lastTokenEndPosition();
+    int endLine = tokenLine();
+    handleProductionOrFail(CLOSEPAREN, ")", "start", "subject of a 'with' statement");
+    const Identifier* unused = 0;
+    TreeStatement statement = parseStatement(context, unused);
+    failIfFalse(statement, "A 'with' statement must have a body");
+    
+    return context.createWithStatement(location, expr, statement, start, end, startLine, endLine);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseSwitchStatement(TreeBuilder& context)
+{
+    ASSERT(match(SWITCH));
+    JSTokenLocation location(tokenLocation());
+    int startLine = tokenLine();
+    next();
+    handleProductionOrFail(OPENPAREN, "(", "start", "subject of a 'switch'");
+    TreeExpression expr = parseExpression(context);
+    failIfFalse(expr, "Cannot parse switch subject expression");
+    recordPauseLocation(context.breakpointLocation(expr));
+    int endLine = tokenLine();
+    
+    handleProductionOrFail(CLOSEPAREN, ")", "end", "subject of a 'switch'");
+    handleProductionOrFail(OPENBRACE, "{", "start", "body of a 'switch'");
+    AutoPopScopeRef lexicalScope(this, pushScope());
+    lexicalScope->setIsLexicalScope();
+    lexicalScope->preventVarDeclarations();
+    startSwitch();
+    TreeClauseList firstClauses = parseSwitchClauses(context);
+    propagateError();
+    
+    TreeClause defaultClause = parseSwitchDefaultClause(context);
+    propagateError();
+    
+    TreeClauseList secondClauses = parseSwitchClauses(context);
+    propagateError();
+    endSwitch();
+    handleProductionOrFail(CLOSEBRACE, "}", "end", "body of a 'switch'");
+    
+    TreeStatement result = context.createSwitchStatement(location, expr, firstClauses, defaultClause, secondClauses, startLine, endLine, lexicalScope->finalizeLexicalEnvironment(), lexicalScope->takeFunctionDeclarations());
+    popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeClauseList Parser<LexerType>::parseSwitchClauses(TreeBuilder& context)
+{
+    if (!match(CASE))
+        return 0;
+    unsigned startOffset = tokenStart();
+    next();
+    TreeExpression condition = parseExpression(context);
+    failIfFalse(condition, "Cannot parse switch clause");
+    consumeOrFail(COLON, "Expected a ':' after switch clause expression");
+    TreeSourceElements statements = parseSourceElements(context, DontCheckForStrictMode);
+    failIfFalse(statements, "Cannot parse the body of a switch clause");
+    TreeClause clause = context.createClause(condition, statements);
+    context.setStartOffset(clause, startOffset);
+    TreeClauseList clauseList = context.createClauseList(clause);
+    TreeClauseList tail = clauseList;
+    
+    while (match(CASE)) {
+        startOffset = tokenStart();
+        next();
+        TreeExpression condition = parseExpression(context);
+        failIfFalse(condition, "Cannot parse switch case expression");
+        consumeOrFail(COLON, "Expected a ':' after switch clause expression");
+        TreeSourceElements statements = parseSourceElements(context, DontCheckForStrictMode);
+        failIfFalse(statements, "Cannot parse the body of a switch clause");
+        clause = context.createClause(condition, statements);
+        context.setStartOffset(clause, startOffset);
+        tail = context.createClauseList(tail, clause);
+    }
+    return clauseList;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeClause Parser<LexerType>::parseSwitchDefaultClause(TreeBuilder& context)
+{
+    if (!match(DEFAULT))
+        return 0;
+    unsigned startOffset = tokenStart();
+    next();
+    consumeOrFail(COLON, "Expected a ':' after switch default clause");
+    TreeSourceElements statements = parseSourceElements(context, DontCheckForStrictMode);
+    failIfFalse(statements, "Cannot parse the body of a switch default clause");
+    TreeClause result = context.createClause(0, statements);
+    context.setStartOffset(result, startOffset);
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseTryStatement(TreeBuilder& context)
+{
+    ASSERT(match(TRY));
+    JSTokenLocation location(tokenLocation());
+    TreeStatement tryBlock = 0;
+    TreeDestructuringPattern catchPattern = 0;
+    TreeStatement catchBlock = 0;
+    TreeStatement finallyBlock = 0;
+    int firstLine = tokenLine();
+    next();
+    matchOrFail(OPENBRACE, "Expected a block statement as body of a try statement");
+    
+    tryBlock = parseBlockStatement(context);
+    failIfFalse(tryBlock, "Cannot parse the body of try block");
+    int lastLine = m_lastTokenEndPosition.line;
+    VariableEnvironment catchEnvironment; 
+    if (match(CATCH)) {
+        next();
+        
+        handleProductionOrFail(OPENPAREN, "(", "start", "'catch' target");
+        AutoPopScopeRef catchScope(this, pushScope());
+        catchScope->setIsLexicalScope();
+        catchScope->preventVarDeclarations();
+        const Identifier* ident = nullptr;
+        if (matchSpecIdentifier()) {
+            ident = m_token.m_data.ident;
+            catchPattern = context.createBindingLocation(m_token.m_location, *ident, m_token.m_startPosition, m_token.m_endPosition, AssignmentContext::DeclarationStatement);
+            next();
+            failIfTrueIfStrict(catchScope->declareLexicalVariable(ident, false) & DeclarationResult::InvalidStrictMode, "Cannot declare a catch variable named '", ident->impl(), "' in strict mode");
+        } else {
+            catchPattern = parseDestructuringPattern(context, DestructuringKind::DestructureToCatchParameters, ExportType::NotExported);
+            failIfFalse(catchPattern, "Cannot parse this destructuring pattern");
+        }
+        handleProductionOrFail(CLOSEPAREN, ")", "end", "'catch' target");
+        matchOrFail(OPENBRACE, "Expected exception handler to be a block statement");
+        catchBlock = parseBlockStatement(context);
+        failIfFalse(catchBlock, "Unable to parse 'catch' block");
+        catchEnvironment = catchScope->finalizeLexicalEnvironment();
+        RELEASE_ASSERT(!ident || (catchEnvironment.size() == 1 && catchEnvironment.contains(ident->impl())));
+        popScope(catchScope, TreeBuilder::NeedsFreeVariableInfo);
+    }
+    
+    if (match(FINALLY)) {
+        next();
+        matchOrFail(OPENBRACE, "Expected block statement for finally body");
+        finallyBlock = parseBlockStatement(context);
+        failIfFalse(finallyBlock, "Cannot parse finally body");
+    }
+    failIfFalse(catchBlock || finallyBlock, "Try statements must have at least a catch or finally block");
+    return context.createTryStatement(location, tryBlock, catchPattern, catchBlock, finallyBlock, firstLine, lastLine, catchEnvironment);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseDebuggerStatement(TreeBuilder& context)
+{
+    ASSERT(match(DEBUGGER));
+    JSTokenLocation location(tokenLocation());
+    int startLine = tokenLine();
+    int endLine = startLine;
+    next();
+    if (match(SEMICOLON))
+        startLine = tokenLine();
+    failIfFalse(autoSemiColon(), "Debugger keyword must be followed by a ';'");
+    return context.createDebugger(location, startLine, endLine);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseBlockStatement(TreeBuilder& context)
+{
+    ASSERT(match(OPENBRACE));
+
+    // We should treat the first block statement of the function (the body of the function) as the lexical 
+    // scope of the function itself, and not the lexical scope of a 'block' statement within the function.
+    AutoCleanupLexicalScope lexicalScope;
+    bool shouldPushLexicalScope = m_statementDepth > 0;
+    if (shouldPushLexicalScope) {
+        ScopeRef newScope = pushScope();
+        newScope->setIsLexicalScope();
+        newScope->preventVarDeclarations();
+        lexicalScope.setIsValid(newScope, this);
+    }
+    JSTokenLocation location(tokenLocation());
+    int startOffset = m_token.m_data.offset;
+    int start = tokenLine();
+    VariableEnvironment emptyEnvironment;
+    DeclarationStacks::FunctionStack emptyFunctionStack;
+    next();
+    if (match(CLOSEBRACE)) {
+        int endOffset = m_token.m_data.offset;
+        next();
+        TreeStatement result = context.createBlockStatement(location, 0, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->finalizeLexicalEnvironment() : emptyEnvironment, shouldPushLexicalScope ? currentScope()->takeFunctionDeclarations() : WTFMove(emptyFunctionStack));
+        context.setStartOffset(result, startOffset);
+        context.setEndOffset(result, endOffset);
+        if (shouldPushLexicalScope)
+            popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
+        return result;
+    }
+    TreeSourceElements subtree = parseSourceElements(context, DontCheckForStrictMode);
+    failIfFalse(subtree, "Cannot parse the body of the block statement");
+    matchOrFail(CLOSEBRACE, "Expected a closing '}' at the end of a block statement");
+    int endOffset = m_token.m_data.offset;
+    next();
+    TreeStatement result = context.createBlockStatement(location, subtree, start, m_lastTokenEndPosition.line, shouldPushLexicalScope ? currentScope()->finalizeLexicalEnvironment() : emptyEnvironment, shouldPushLexicalScope ? currentScope()->takeFunctionDeclarations() : WTFMove(emptyFunctionStack));
+    context.setStartOffset(result, startOffset);
+    context.setEndOffset(result, endOffset);
+    if (shouldPushLexicalScope)
+        popScope(lexicalScope, TreeBuilder::NeedsFreeVariableInfo);
+
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseStatement(TreeBuilder& context, const Identifier*& directive, unsigned* directiveLiteralLength)
+{
+    DepthManager statementDepth(&m_statementDepth);
+    m_statementDepth++;
+    int nonTrivialExpressionCount = 0;
+    failIfStackOverflow();
+    TreeStatement result = 0;
+    bool shouldSetEndOffset = true;
+    bool shouldSetPauseLocation = false;
+    bool parentAllowsFunctionDeclarationAsStatement = m_immediateParentAllowsFunctionDeclarationInStatement;
+    m_immediateParentAllowsFunctionDeclarationInStatement = false;
+
+    switch (m_token.m_type) {
+    case OPENBRACE:
+        result = parseBlockStatement(context);
+        shouldSetEndOffset = false;
+        break;
+    case VAR:
+        result = parseVariableDeclaration(context, DeclarationType::VarDeclaration);
+        shouldSetPauseLocation = true;
+        break;
+    case FUNCTION: {
+        const bool isAsync = false;
+        result = parseFunctionDeclarationStatement(context, isAsync, parentAllowsFunctionDeclarationAsStatement);
+        break;
+    }
+    case SEMICOLON: {
+        JSTokenLocation location(tokenLocation());
+        next();
+        result = context.createEmptyStatement(location);
+        shouldSetPauseLocation = true;
+        break;
+    }
+    case IF:
+        result = parseIfStatement(context);
+        break;
+    case DO:
+        result = parseDoWhileStatement(context);
+        break;
+    case WHILE:
+        result = parseWhileStatement(context);
+        break;
+    case FOR:
+        result = parseForStatement(context);
+        break;
+    case CONTINUE:
+        result = parseContinueStatement(context);
+        shouldSetPauseLocation = true;
+        break;
+    case BREAK:
+        result = parseBreakStatement(context);
+        shouldSetPauseLocation = true;
+        break;
+    case RETURN:
+        result = parseReturnStatement(context);
+        shouldSetPauseLocation = true;
+        break;
+    case WITH:
+        result = parseWithStatement(context);
+        break;
+    case SWITCH:
+        result = parseSwitchStatement(context);
+        break;
+    case THROW:
+        result = parseThrowStatement(context);
+        shouldSetPauseLocation = true;
+        break;
+    case TRY:
+        result = parseTryStatement(context);
+        break;
+    case DEBUGGER:
+        result = parseDebuggerStatement(context);
+        shouldSetPauseLocation = true;
+        break;
+    case EOFTOK:
+    case CASE:
+    case CLOSEBRACE:
+    case DEFAULT:
+        // These tokens imply the end of a set of source elements
+        return 0;
+    case ASYNC:
+        if (maybeParseAsyncFunctionDeclarationStatement(context, result, parentAllowsFunctionDeclarationAsStatement))
+            break;
+        FALLTHROUGH;
+    case IDENT:
+    case AWAIT:
+    case YIELD: {
+        bool allowFunctionDeclarationAsStatement = false;
+        result = parseExpressionOrLabelStatement(context, allowFunctionDeclarationAsStatement);
+        shouldSetPauseLocation = !context.shouldSkipPauseLocation(result);
+        break;
+    }
+    case STRING:
+        directive = m_token.m_data.ident;
+        if (directiveLiteralLength)
+            *directiveLiteralLength = m_token.m_location.endOffset - m_token.m_location.startOffset;
+        nonTrivialExpressionCount = m_parserState.nonTrivialExpressionCount;
+        FALLTHROUGH;
+    default:
+        TreeStatement exprStatement = parseExpressionStatement(context);
+        if (directive && nonTrivialExpressionCount != m_parserState.nonTrivialExpressionCount)
+            directive = nullptr;
+        result = exprStatement;
+        shouldSetPauseLocation = true;
+        break;
+    }
+
+    if (result) {
+        if (shouldSetEndOffset)
+            context.setEndOffset(result, m_lastTokenEndPosition.offset);
+        if (shouldSetPauseLocation)
+            recordPauseLocation(context.breakpointLocation(result));
+    }
+
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseFunctionDeclarationStatement(TreeBuilder& context, bool isAsync, bool parentAllowsFunctionDeclarationAsStatement)
+{
+    semanticFailIfTrue(strictMode(), "Function declarations are only allowed inside blocks or switch statements in strict mode");
+    failIfFalse(parentAllowsFunctionDeclarationAsStatement, "Function declarations are only allowed inside block statements or at the top level of a program");
+    if (!currentScope()->isFunction()) {
+        // We only implement annex B.3.3 if we're in function mode. Otherwise, we fall back
+        // to hoisting behavior.
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=155813
+        DepthManager statementDepth(&m_statementDepth);
+        m_statementDepth = 1;
+        if (isAsync)
+            return parseAsyncFunctionDeclaration(context);
+        return parseFunctionDeclaration(context);
+    }
+
+    // Any function declaration that isn't in a block is a syntax error unless it's
+    // in an if/else statement. If it's in an if/else statement, we will magically
+    // treat it as if the if/else statement is inside a block statement.
+    // to the very top like a "var". For example:
+    // function a() {
+    //     if (cond) function foo() { }
+    // }
+    // will be rewritten as:
+    // function a() {
+    //     if (cond) { function foo() { } }
+    // }
+    AutoPopScopeRef blockScope(this, pushScope());
+    blockScope->setIsLexicalScope();
+    blockScope->preventVarDeclarations();
+    JSTokenLocation location(tokenLocation());
+    int start = tokenLine();
+
+    TreeStatement function = 0;
+    if (!isAsync)
+        function = parseFunctionDeclaration(context);
+    else
+        function = parseAsyncFunctionDeclaration(context);
+    propagateError();
+    failIfFalse(function, "Expected valid function statement after 'function' keyword");
+    TreeSourceElements sourceElements = context.createSourceElements();
+    context.appendStatement(sourceElements, function);
+    TreeStatement result = context.createBlockStatement(location, sourceElements, start, m_lastTokenEndPosition.line, currentScope()->finalizeLexicalEnvironment(), currentScope()->takeFunctionDeclarations());
+    popScope(blockScope, TreeBuilder::NeedsFreeVariableInfo);
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> bool Parser<LexerType>::maybeParseAsyncFunctionDeclarationStatement(TreeBuilder& context, TreeStatement& result, bool parentAllowsFunctionDeclarationAsStatement)
+{
+    ASSERT(match(ASYNC));
+    SavePoint savePoint = createSavePoint();
+    next();
+    if (match(FUNCTION) && !m_lexer->prevTerminator()) {
+        const bool isAsync = true;
+        result = parseFunctionDeclarationStatement(context, isAsync, parentAllowsFunctionDeclarationAsStatement);
+        return true;
+    }
+    restoreSavePoint(savePoint);
+    return false;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> bool Parser<LexerType>::parseFormalParameters(TreeBuilder& context, TreeFormalParameterList list, bool isArrowFunction, unsigned& parameterCount, unsigned& functionLength)
+{
+#define failIfDuplicateIfViolation() \
+    if (duplicateParameter) {\
+        semanticFailIfTrue(hasDefaultParameterValues, "Duplicate parameter '", duplicateParameter->impl(), "' not allowed in function with default parameter values");\
+        semanticFailIfTrue(hasDestructuringPattern, "Duplicate parameter '", duplicateParameter->impl(), "' not allowed in function with destructuring parameters");\
+        semanticFailIfTrue(isRestParameter, "Duplicate parameter '", duplicateParameter->impl(), "' not allowed in function with a rest parameter");\
+        semanticFailIfTrue(isArrowFunction, "Duplicate parameter '", duplicateParameter->impl(), "' not allowed in an arrow function");\
+    }
+
+    bool hasDefaultParameterValues = false;
+    bool hasDestructuringPattern = false;
+    bool isRestParameter = false;
+    const Identifier* duplicateParameter = nullptr;
+    do {
+        TreeDestructuringPattern parameter = 0;
+        TreeExpression defaultValue = 0;
+
+        if (UNLIKELY(match(CLOSEPAREN)))
+            break;
+        
+        if (match(DOTDOTDOT)) {
+            next();
+            semanticFailIfTrue(!m_parserState.allowAwait && match(AWAIT), "Can't use 'await' as a parameter name in an async function");
+            TreeDestructuringPattern destructuringPattern = parseDestructuringPattern(context, DestructuringKind::DestructureToParameters, ExportType::NotExported, &duplicateParameter, &hasDestructuringPattern);
+            propagateError();
+            parameter = context.createRestParameter(destructuringPattern, parameterCount);
+            failIfTrue(match(COMMA), "Rest parameter should be the last parameter in a function declaration"); // Let's have a good error message for this common case.
+            isRestParameter = true;
+        } else
+            parameter = parseDestructuringPattern(context, DestructuringKind::DestructureToParameters, ExportType::NotExported, &duplicateParameter, &hasDestructuringPattern);
+        failIfFalse(parameter, "Cannot parse parameter pattern");
+        if (!isRestParameter) {
+            defaultValue = parseDefaultValueForDestructuringPattern(context);
+            if (defaultValue)
+                hasDefaultParameterValues = true;
+        }
+        propagateError();
+        failIfDuplicateIfViolation();
+        if (isRestParameter || defaultValue || hasDestructuringPattern)
+            currentScope()->setHasNonSimpleParameterList();
+        context.appendParameter(list, parameter, defaultValue);
+        if (!isRestParameter) {
+            parameterCount++;
+            if (!hasDefaultParameterValues)
+                functionLength++;
+        }
+    } while (!isRestParameter && consume(COMMA));
+
+    return true;
+#undef failIfDuplicateIfViolation
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeFunctionBody Parser<LexerType>::parseFunctionBody(
+    TreeBuilder& context, SyntaxChecker& syntaxChecker, const JSTokenLocation& startLocation, int startColumn, int functionKeywordStart, int functionNameStart, int parametersStart,
+    ConstructorKind constructorKind, SuperBinding superBinding, FunctionBodyType bodyType, unsigned parameterCount, unsigned functionLength, SourceParseMode parseMode)
+{
+    bool isArrowFunctionBodyExpression = bodyType == ArrowFunctionBodyExpression;
+    if (!isArrowFunctionBodyExpression) {
+        next();
+        if (match(CLOSEBRACE)) {
+            unsigned endColumn = tokenColumn();
+            return context.createFunctionMetadata(startLocation, tokenLocation(), startColumn, endColumn, functionKeywordStart, functionNameStart, parametersStart, strictMode(), constructorKind, superBinding, parameterCount, functionLength, parseMode, isArrowFunctionBodyExpression);
+        }
+    }
+
+    DepthManager statementDepth(&m_statementDepth);
+    m_statementDepth = 0;
+    if (bodyType == ArrowFunctionBodyExpression) {
+        if (m_debuggerParseData)
+            failIfFalse(parseArrowFunctionSingleExpressionBodySourceElements(context), "Cannot parse body of this arrow function");
+        else
+            failIfFalse(parseArrowFunctionSingleExpressionBodySourceElements(syntaxChecker), "Cannot parse body of this arrow function");
+    } else {
+        if (m_debuggerParseData)
+            failIfFalse(parseSourceElements(context, CheckForStrictMode), bodyType == StandardFunctionBodyBlock ? "Cannot parse body of this function" : "Cannot parse body of this arrow function");
+        else
+            failIfFalse(parseSourceElements(syntaxChecker, CheckForStrictMode), bodyType == StandardFunctionBodyBlock ? "Cannot parse body of this function" : "Cannot parse body of this arrow function");
+    }
+    unsigned endColumn = tokenColumn();
+    return context.createFunctionMetadata(startLocation, tokenLocation(), startColumn, endColumn, functionKeywordStart, functionNameStart, parametersStart, strictMode(), constructorKind, superBinding, parameterCount, functionLength, parseMode, isArrowFunctionBodyExpression);
+}
+
+static const char* stringForFunctionMode(SourceParseMode mode)
+{
+    switch (mode) {
+    case SourceParseMode::GetterMode:
+        return "getter";
+    case SourceParseMode::SetterMode:
+        return "setter";
+    case SourceParseMode::NormalFunctionMode:
+        return "function";
+    case SourceParseMode::MethodMode:
+        return "method";
+    case SourceParseMode::GeneratorBodyMode:
+        return "generator";
+    case SourceParseMode::GeneratorWrapperFunctionMode:
+        return "generator function";
+    case SourceParseMode::ArrowFunctionMode:
+        return "arrow function";
+    case SourceParseMode::AsyncFunctionMode:
+    case SourceParseMode::AsyncFunctionBodyMode:
+        return "async function";
+    case SourceParseMode::AsyncMethodMode:
+        return "async method";
+    case SourceParseMode::AsyncArrowFunctionBodyMode:
+    case SourceParseMode::AsyncArrowFunctionMode:
+        return "async arrow function";
+    case SourceParseMode::ProgramMode:
+    case SourceParseMode::ModuleAnalyzeMode:
+    case SourceParseMode::ModuleEvaluateMode:
+        RELEASE_ASSERT_NOT_REACHED();
+        return "";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+template <typename LexerType> template <class TreeBuilder, class FunctionInfoType> typename TreeBuilder::FormalParameterList Parser<LexerType>::parseFunctionParameters(TreeBuilder& context, SourceParseMode mode, FunctionInfoType& functionInfo)
+{
+    RELEASE_ASSERT(!(SourceParseModeSet(SourceParseMode::ProgramMode, SourceParseMode::ModuleAnalyzeMode, SourceParseMode::ModuleEvaluateMode).contains(mode)));
+    TreeFormalParameterList parameterList = context.createFormalParameterList();
+    SetForScope<FunctionParsePhase> functionParsePhasePoisoner(m_parserState.functionParsePhase, FunctionParsePhase::Parameters);
+    
+    if (UNLIKELY((SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(mode)))) {
+        if (!matchSpecIdentifier() && !match(OPENPAREN)) {
+            semanticFailureDueToKeyword(stringForFunctionMode(mode), " name");
+            failWithMessage("Expected an arrow function input parameter");
+        } else {
+            if (match(OPENPAREN)) {
+                next();
+                
+                if (match(CLOSEPAREN)) {
+                    functionInfo.parameterCount = 0;
+                    functionInfo.functionLength = 0;
+                } else {
+                    bool isArrowFunction = true;
+                    failIfFalse(parseFormalParameters(context, parameterList, isArrowFunction, functionInfo.parameterCount, functionInfo.functionLength), "Cannot parse parameters for this ", stringForFunctionMode(mode));
+                }
+                
+                consumeOrFail(CLOSEPAREN, "Expected a ')' or a ',' after a parameter declaration");
+            } else {
+                functionInfo.parameterCount = 1;
+                functionInfo.functionLength = 1;
+                auto parameter = parseDestructuringPattern(context, DestructuringKind::DestructureToParameters, ExportType::NotExported);
+                failIfFalse(parameter, "Cannot parse parameter pattern");
+                context.appendParameter(parameterList, parameter, 0);
+            }
+        }
+
+        return parameterList;
+    }
+
+    if (!consume(OPENPAREN)) {
+        semanticFailureDueToKeyword(stringForFunctionMode(mode), " name");
+        failWithMessage("Expected an opening '(' before a ", stringForFunctionMode(mode), "'s parameter list");
+    }
+
+    if (mode == SourceParseMode::GetterMode) {
+        consumeOrFail(CLOSEPAREN, "getter functions must have no parameters");
+        functionInfo.parameterCount = 0;
+        functionInfo.functionLength = 0;
+    } else if (mode == SourceParseMode::SetterMode) {
+        failIfTrue(match(CLOSEPAREN), "setter functions must have one parameter");
+        const Identifier* duplicateParameter = nullptr;
+        bool hasDestructuringPattern = false;
+        auto parameter = parseDestructuringPattern(context, DestructuringKind::DestructureToParameters, ExportType::NotExported, &duplicateParameter, &hasDestructuringPattern);
+        failIfFalse(parameter, "setter functions must have one parameter");
+        auto defaultValue = parseDefaultValueForDestructuringPattern(context);
+        propagateError();
+        if (defaultValue || hasDestructuringPattern) {
+            semanticFailIfTrue(duplicateParameter, "Duplicate parameter '", duplicateParameter->impl(), "' not allowed in function with non-simple parameter list");
+            currentScope()->setHasNonSimpleParameterList();
+        }
+        context.appendParameter(parameterList, parameter, defaultValue);
+        functionInfo.parameterCount = 1;
+        functionInfo.functionLength = defaultValue ? 0 : 1;
+        failIfTrue(match(COMMA), "setter functions must have one parameter");
+        consumeOrFail(CLOSEPAREN, "Expected a ')' after a parameter declaration");
+    } else {
+        if (match(CLOSEPAREN)) {
+            functionInfo.parameterCount = 0;
+            functionInfo.functionLength = 0;
+        } else {
+            bool isArrowFunction = false;
+            failIfFalse(parseFormalParameters(context, parameterList, isArrowFunction, functionInfo.parameterCount, functionInfo.functionLength), "Cannot parse parameters for this ", stringForFunctionMode(mode));
+        }
+        consumeOrFail(CLOSEPAREN, "Expected a ')' or a ',' after a parameter declaration");
+    }
+
+    return parameterList;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> typename TreeBuilder::FormalParameterList Parser<LexerType>::createGeneratorParameters(TreeBuilder& context, unsigned& parameterCount)
+{
+    auto parameters = context.createFormalParameterList();
+
+    JSTokenLocation location(tokenLocation());
+    JSTextPosition position = tokenStartPosition();
+
+    auto addParameter = [&](const Identifier& name) {
+        declareParameter(&name);
+        auto binding = context.createBindingLocation(location, name, position, position, AssignmentContext::DeclarationStatement);
+        context.appendParameter(parameters, binding, 0);
+        ++parameterCount;
+    };
+
+    // @generator
+    addParameter(m_vm->propertyNames->builtinNames().generatorPrivateName());
+    // @generatorState
+    addParameter(m_vm->propertyNames->builtinNames().generatorStatePrivateName());
+    // @generatorValue
+    addParameter(m_vm->propertyNames->builtinNames().generatorValuePrivateName());
+    // @generatorResumeMode
+    addParameter(m_vm->propertyNames->builtinNames().generatorResumeModePrivateName());
+    // @generatorFrame
+    addParameter(m_vm->propertyNames->builtinNames().generatorFramePrivateName());
+
+    return parameters;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> bool Parser<LexerType>::parseFunctionInfo(TreeBuilder& context, FunctionNameRequirements requirements, SourceParseMode mode, bool nameIsInContainingScope, ConstructorKind constructorKind, SuperBinding expectedSuperBinding, int functionKeywordStart, ParserFunctionInfo<TreeBuilder>& functionInfo, FunctionDefinitionType functionDefinitionType)
+{
+    RELEASE_ASSERT(isFunctionParseMode(mode));
+
+    ScopeRef parentScope = currentScope();
+
+    bool isDisallowedAwaitFunctionName = isDisallowedIdentifierAwait(m_token);
+    const char* isDisallowedAwaitFunctionNameReason = isDisallowedAwaitFunctionName ? disallowedIdentifierAwaitReason() : nullptr;
+
+    AutoPopScopeRef functionScope(this, pushScope());
+    functionScope->setSourceParseMode(mode);
+    functionScope->setExpectedSuperBinding(expectedSuperBinding);
+    functionScope->setConstructorKind(constructorKind);
+    SetForScope<FunctionParsePhase> functionParsePhasePoisoner(m_parserState.functionParsePhase, FunctionParsePhase::Body);
+    int functionNameStart = m_token.m_location.startOffset;
+    const Identifier* lastFunctionName = m_parserState.lastFunctionName;
+    m_parserState.lastFunctionName = nullptr;
+    int parametersStart = -1;
+    JSTokenLocation startLocation;
+    int startColumn = -1;
+    FunctionBodyType functionBodyType;
+
+    auto loadCachedFunction = [&] () -> bool {
+        if (UNLIKELY(!Options::useSourceProviderCache()))
+            return false;
+
+        if (UNLIKELY(m_debuggerParseData))
+            return false;
+
+        ASSERT(parametersStart != -1);
+        ASSERT(startColumn != -1);
+
+        // If we know about this function already, we can use the cached info and skip the parser to the end of the function.
+        if (const SourceProviderCacheItem* cachedInfo = TreeBuilder::CanUseFunctionCache ? findCachedFunctionInfo(parametersStart) : 0) {
+            // If we're in a strict context, the cached function info must say it was strict too.
+            ASSERT(!strictMode() || cachedInfo->strictMode);
+            JSTokenLocation endLocation;
+
+            ConstructorKind constructorKind = static_cast<ConstructorKind>(cachedInfo->constructorKind);
+            SuperBinding expectedSuperBinding = static_cast<SuperBinding>(cachedInfo->expectedSuperBinding);
+
+            endLocation.line = cachedInfo->lastTokenLine;
+            endLocation.startOffset = cachedInfo->lastTokenStartOffset;
+            endLocation.lineStartOffset = cachedInfo->lastTokenLineStartOffset;
+            ASSERT(endLocation.startOffset >= endLocation.lineStartOffset);
+
+            bool endColumnIsOnStartLine = endLocation.line == functionInfo.startLine;
+            unsigned currentLineStartOffset = m_lexer->currentLineStartOffset();
+            unsigned bodyEndColumn = endColumnIsOnStartLine ? endLocation.startOffset - currentLineStartOffset : endLocation.startOffset - endLocation.lineStartOffset;
+
+            ASSERT(endLocation.startOffset >= endLocation.lineStartOffset);
+            
+            FunctionBodyType functionBodyType;
+            if (UNLIKELY(SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(mode)))
+                functionBodyType = cachedInfo->isBodyArrowExpression ?  ArrowFunctionBodyExpression : ArrowFunctionBodyBlock;
+            else
+                functionBodyType = StandardFunctionBodyBlock;
+            
+            functionInfo.body = context.createFunctionMetadata(
+                startLocation, endLocation, startColumn, bodyEndColumn, 
+                functionKeywordStart, functionNameStart, parametersStart, 
+                cachedInfo->strictMode, constructorKind, expectedSuperBinding,
+                cachedInfo->parameterCount, cachedInfo->functionLength,
+                mode, functionBodyType == ArrowFunctionBodyExpression);
+            functionInfo.endOffset = cachedInfo->endFunctionOffset;
+            functionInfo.parameterCount = cachedInfo->parameterCount;
+            functionInfo.functionLength = cachedInfo->functionLength;
+
+            functionScope->restoreFromSourceProviderCache(cachedInfo);
+            popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo);
+            
+            m_token = cachedInfo->endFunctionToken();
+
+            if (endColumnIsOnStartLine)
+                m_token.m_location.lineStartOffset = currentLineStartOffset;
+
+            m_lexer->setOffset(m_token.m_location.endOffset, m_token.m_location.lineStartOffset);
+            m_lexer->setLineNumber(m_token.m_location.line);
+
+            switch (functionBodyType) {
+            case ArrowFunctionBodyExpression:
+                next();
+                context.setEndOffset(functionInfo.body, m_lexer->currentOffset());
+                break;
+            case ArrowFunctionBodyBlock:
+            case StandardFunctionBodyBlock:
+                context.setEndOffset(functionInfo.body, m_lexer->currentOffset());
+                next();
+                break;
+            }
+            functionInfo.endLine = m_lastTokenEndPosition.line;
+            return true;
+        }
+
+        return false;
+    };
+
+    SyntaxChecker syntaxChecker(const_cast<VM*>(m_vm), m_lexer.get());
+
+    if (UNLIKELY((SourceParseModeSet(SourceParseMode::ArrowFunctionMode, SourceParseMode::AsyncArrowFunctionMode).contains(mode)))) {
+        startLocation = tokenLocation();
+        functionInfo.startLine = tokenLine();
+        startColumn = tokenColumn();
+
+        parametersStart = m_token.m_location.startOffset;
+        functionInfo.startOffset = parametersStart;
+        functionInfo.parametersStartColumn = startColumn;
+
+        if (loadCachedFunction())
+            return true;
+
+        {
+            // Parse formal parameters with [+Yield] parameterization, in order to ban YieldExpressions
+            // in ArrowFormalParameters, per ES6 #sec-arrow-function-definitions-static-semantics-early-errors.
+            Scope::MaybeParseAsGeneratorForScope parseAsGenerator(functionScope, parentScope->isGenerator());
+            SetForScope<bool> overrideAllowAwait(m_parserState.allowAwait, !isAsyncFunctionParseMode(mode));
+            parseFunctionParameters(syntaxChecker, mode, functionInfo);
+            propagateError();
+        }
+
+        matchOrFail(ARROWFUNCTION, "Expected a '=>' after arrow function parameter declaration");
+
+        if (m_lexer->prevTerminator())
+            failDueToUnexpectedToken();
+
+        ASSERT(constructorKind == ConstructorKind::None);
+
+        // Check if arrow body start with {. If it true it mean that arrow function is Fat arrow function
+        // and we need use common approach to parse function body
+        next();
+        functionBodyType = match(OPENBRACE) ? ArrowFunctionBodyBlock : ArrowFunctionBodyExpression;
+    } else {
+        // http://ecma-international.org/ecma-262/6.0/#sec-function-definitions
+        // FunctionExpression :
+        //     function BindingIdentifieropt ( FormalParameters ) { FunctionBody }
+        //
+        // FunctionDeclaration[Yield, Default] :
+        //     function BindingIdentifier[?Yield] ( FormalParameters ) { FunctionBody }
+        //     [+Default] function ( FormalParameters ) { FunctionBody }
+        //
+        // GeneratorDeclaration[Yield, Default] :
+        //     function * BindingIdentifier[?Yield] ( FormalParameters[Yield] ) { GeneratorBody }
+        //     [+Default] function * ( FormalParameters[Yield] ) { GeneratorBody }
+        //
+        // GeneratorExpression :
+        //     function * BindingIdentifier[Yield]opt ( FormalParameters[Yield] ) { GeneratorBody }
+        //
+        // The name of FunctionExpression and AsyncFunctionExpression can accept "yield" even in the context of generator.
+        bool upperScopeIsGenerator = false;
+        if (!(functionDefinitionType == FunctionDefinitionType::Expression && SourceParseModeSet(SourceParseMode::NormalFunctionMode, SourceParseMode::AsyncFunctionMode).contains(mode)))
+            upperScopeIsGenerator = upperScope(1)->isGenerator();
+
+        if (requirements != FunctionNameRequirements::Unnamed) {
+            ASSERT_WITH_MESSAGE(!(requirements == FunctionNameRequirements::None && !functionInfo.name), "When specifying FunctionNameRequirements::None, we need to initialize functionInfo.name with the default value in the caller side.");
+            if (matchSpecIdentifier(upperScopeIsGenerator)) {
+                functionInfo.name = m_token.m_data.ident;
+                m_parserState.lastFunctionName = functionInfo.name;
+                if (UNLIKELY(isDisallowedAwaitFunctionName))
+                    semanticFailIfTrue(functionDefinitionType == FunctionDefinitionType::Declaration || isAsyncFunctionWrapperParseMode(mode), "Cannot declare function named 'await' ", isDisallowedAwaitFunctionNameReason);
+                else if (isAsyncFunctionWrapperParseMode(mode) && match(AWAIT) && functionDefinitionType == FunctionDefinitionType::Expression)
+                    semanticFail("Cannot declare async function named 'await'");
+                next();
+                if (!nameIsInContainingScope)
+                    failIfTrueIfStrict(functionScope->declareCallee(functionInfo.name) & DeclarationResult::InvalidStrictMode, "'", functionInfo.name->impl(), "' is not a valid ", stringForFunctionMode(mode), " name in strict mode");
+            } else if (requirements == FunctionNameRequirements::Named) {
+                if (match(OPENPAREN)) {
+                    semanticFailIfTrue(mode == SourceParseMode::NormalFunctionMode, "Function statements must have a name");
+                    semanticFailIfTrue(mode == SourceParseMode::AsyncFunctionMode, "Async function statements must have a name");
+                }
+                semanticFailureDueToKeyword(stringForFunctionMode(mode), " name");
+                failDueToUnexpectedToken();
+                return false;
+            }
+            ASSERT(functionInfo.name);
+        }
+
+        startLocation = tokenLocation();
+        functionInfo.startLine = tokenLine();
+        startColumn = tokenColumn();
+        functionInfo.parametersStartColumn = startColumn;
+
+        parametersStart = m_token.m_location.startOffset;
+        functionInfo.startOffset = parametersStart;
+
+        if (loadCachedFunction())
+            return true;
+        {
+            SetForScope<bool> overrideAllowAwait(m_parserState.allowAwait, !isAsyncFunctionParseMode(mode));
+            parseFunctionParameters(syntaxChecker, mode, functionInfo);
+            propagateError();
+        }
+        
+        matchOrFail(OPENBRACE, "Expected an opening '{' at the start of a ", stringForFunctionMode(mode), " body");
+        
+        // BytecodeGenerator emits code to throw TypeError when a class constructor is "call"ed.
+        // Set ConstructorKind to None for non-constructor methods of classes.
+    
+        if (m_defaultConstructorKind != ConstructorKind::None) {
+            constructorKind = m_defaultConstructorKind;
+            expectedSuperBinding = m_defaultConstructorKind == ConstructorKind::Extends ? SuperBinding::Needed : SuperBinding::NotNeeded;
+        }
+
+        functionBodyType = StandardFunctionBodyBlock;
+    }
+
+    functionScope->setConstructorKind(constructorKind);
+    functionScope->setExpectedSuperBinding(expectedSuperBinding);
+
+    m_parserState.lastFunctionName = lastFunctionName;
+    ParserState oldState = internalSaveParserState();
+
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=156962
+    // This loop collects the set of capture candidates that aren't
+    // part of the set of this function's declared parameters. We will
+    // figure out which parameters are captured for this function when
+    // we actually generate code for it. For now, we just propagate to
+    // our parent scopes which variables we might have closed over that
+    // belong to them. This is necessary for correctness when using
+    // the source provider cache because we can't close over a variable
+    // that we don't claim to close over. The source provider cache must
+    // know this information to properly cache this function.
+    // This might work itself out nicer if we declared a different
+    // Scope struct for the parameters (because they are indeed implemented
+    // as their own scope).
+    UniquedStringImplPtrSet nonLocalCapturesFromParameterExpressions;
+    functionScope->forEachUsedVariable([&] (UniquedStringImpl* impl) {
+        if (!functionScope->hasDeclaredParameter(impl)) {
+            nonLocalCapturesFromParameterExpressions.add(impl);
+            if (TreeBuilder::NeedsFreeVariableInfo)
+                parentScope->addClosedVariableCandidateUnconditionally(impl);
+        }
+    });
+
+    auto performParsingFunctionBody = [&] {
+        return parseFunctionBody(context, syntaxChecker, startLocation, startColumn, functionKeywordStart, functionNameStart, parametersStart, constructorKind, expectedSuperBinding, functionBodyType, functionInfo.parameterCount, functionInfo.functionLength, mode);
+    };
+
+    if (isGeneratorOrAsyncFunctionWrapperParseMode(mode)) {
+        AutoPopScopeRef generatorBodyScope(this, pushScope());
+        SourceParseMode innerParseMode = SourceParseMode::GeneratorBodyMode;
+        if (isAsyncFunctionWrapperParseMode(mode)) {
+            innerParseMode = mode == SourceParseMode::AsyncArrowFunctionMode
+                ? SourceParseMode::AsyncArrowFunctionBodyMode
+                : SourceParseMode::AsyncFunctionBodyMode;
+        }
+        generatorBodyScope->setSourceParseMode(innerParseMode);
+        generatorBodyScope->setConstructorKind(ConstructorKind::None);
+        generatorBodyScope->setExpectedSuperBinding(expectedSuperBinding);
+
+        // Disallow 'use strict' directives in the implicit inner function if
+        // needed.
+        if (functionScope->hasNonSimpleParameterList())
+            generatorBodyScope->setHasNonSimpleParameterList();
+
+        functionInfo.body = performParsingFunctionBody();
+
+        // When a generator has a "use strict" directive, a generator function wrapping it should be strict mode.
+        if  (generatorBodyScope->strictMode())
+            functionScope->setStrictMode();
+
+        popScope(generatorBodyScope, TreeBuilder::NeedsFreeVariableInfo);
+    } else
+        functionInfo.body = performParsingFunctionBody();
+    
+    restoreParserState(oldState);
+    failIfFalse(functionInfo.body, "Cannot parse the body of this ", stringForFunctionMode(mode));
+    context.setEndOffset(functionInfo.body, m_lexer->currentOffset());
+    if (functionScope->strictMode() && requirements != FunctionNameRequirements::Unnamed) {
+        ASSERT(functionInfo.name);
+        RELEASE_ASSERT(SourceParseModeSet(SourceParseMode::NormalFunctionMode, SourceParseMode::MethodMode, SourceParseMode::ArrowFunctionMode, SourceParseMode::GeneratorBodyMode, SourceParseMode::GeneratorWrapperFunctionMode).contains(mode) || isAsyncFunctionWrapperParseMode(mode));
+        semanticFailIfTrue(m_vm->propertyNames->arguments == *functionInfo.name, "'", functionInfo.name->impl(), "' is not a valid function name in strict mode");
+        semanticFailIfTrue(m_vm->propertyNames->eval == *functionInfo.name, "'", functionInfo.name->impl(), "' is not a valid function name in strict mode");
+    }
+
+    JSTokenLocation location = JSTokenLocation(m_token.m_location);
+    functionInfo.endOffset = m_token.m_data.offset;
+    
+    if (functionBodyType == ArrowFunctionBodyExpression) {
+        location = locationBeforeLastToken();
+        functionInfo.endOffset = location.endOffset;
+    } else {
+        recordFunctionEntryLocation(JSTextPosition(startLocation.line, startLocation.startOffset, startLocation.lineStartOffset));
+        recordFunctionLeaveLocation(JSTextPosition(location.line, location.startOffset, location.lineStartOffset));
+    }
+
+    // Cache the tokenizer state and the function scope the first time the function is parsed.
+    // Any future reparsing can then skip the function.
+    // For arrow function is 8 = x=>x + 4 symbols;
+    // For ordinary function is 16  = function(){} + 4 symbols
+    const int minimumFunctionLengthToCache = functionBodyType == StandardFunctionBodyBlock ? 16 : 8;
+    std::unique_ptr<SourceProviderCacheItem> newInfo;
+    int functionLength = functionInfo.endOffset - functionInfo.startOffset;
+    if (TreeBuilder::CanUseFunctionCache && m_functionCache && functionLength > minimumFunctionLengthToCache) {
+        SourceProviderCacheItemCreationParameters parameters;
+        parameters.endFunctionOffset = functionInfo.endOffset;
+        parameters.functionNameStart = functionNameStart;
+        parameters.lastTokenLine = location.line;
+        parameters.lastTokenStartOffset = location.startOffset;
+        parameters.lastTokenEndOffset = location.endOffset;
+        parameters.lastTokenLineStartOffset = location.lineStartOffset;
+        parameters.parameterCount = functionInfo.parameterCount;
+        parameters.functionLength = functionInfo.functionLength;
+        parameters.constructorKind = constructorKind;
+        parameters.expectedSuperBinding = expectedSuperBinding;
+        if (functionBodyType == ArrowFunctionBodyExpression) {
+            parameters.isBodyArrowExpression = true;
+            parameters.tokenType = m_token.m_type;
+        }
+        functionScope->fillParametersForSourceProviderCache(parameters, nonLocalCapturesFromParameterExpressions);
+        newInfo = SourceProviderCacheItem::create(parameters);
+    }
+    
+    popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo);
+    
+    if (functionBodyType != ArrowFunctionBodyExpression) {
+        matchOrFail(CLOSEBRACE, "Expected a closing '}' after a ", stringForFunctionMode(mode), " body");
+        next();
+    }
+
+    if (newInfo)
+        m_functionCache->add(functionInfo.startOffset, WTFMove(newInfo));
+    
+    functionInfo.endLine = m_lastTokenEndPosition.line;
+    return true;
+}
+
+static NO_RETURN_DUE_TO_CRASH FunctionMetadataNode* getMetadata(ParserFunctionInfo<SyntaxChecker>&) { RELEASE_ASSERT_NOT_REACHED(); }
+static FunctionMetadataNode* getMetadata(ParserFunctionInfo<ASTBuilder>& info) { return info.body; }
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseFunctionDeclaration(TreeBuilder& context, ExportType exportType, DeclarationDefaultContext declarationDefaultContext)
+{
+    ASSERT(match(FUNCTION));
+    JSTokenLocation location(tokenLocation());
+    unsigned functionKeywordStart = tokenStart();
+    next();
+    SourceParseMode parseMode = SourceParseMode::NormalFunctionMode;
+    if (consume(TIMES))
+        parseMode = SourceParseMode::GeneratorWrapperFunctionMode;
+
+    ParserFunctionInfo<TreeBuilder> functionInfo;
+    FunctionNameRequirements requirements = FunctionNameRequirements::Named;
+    if (declarationDefaultContext == DeclarationDefaultContext::ExportDefault) {
+        // Under the "export default" context, function declaration does not require the function name.
+        //
+        //     ExportDeclaration:
+        //         ...
+        //         export default HoistableDeclaration[~Yield, +Default]
+        //         ...
+        //
+        //     HoistableDeclaration[Yield, Default]:
+        //         FunctionDeclaration[?Yield, ?Default]
+        //         GeneratorDeclaration[?Yield, ?Default]
+        //
+        //     FunctionDeclaration[Yield, Default]:
+        //         ...
+        //         [+Default] function ( FormalParameters[~Yield] ) { FunctionBody[~Yield] }
+        //
+        //     GeneratorDeclaration[Yield, Default]:
+        //         ...
+        //         [+Default] function * ( FormalParameters[+Yield] ) { GeneratorBody }
+        //
+        // In this case, we use "*default*" as this function declaration's name.
+        requirements = FunctionNameRequirements::None;
+        functionInfo.name = &m_vm->propertyNames->builtinNames().starDefaultPrivateName();
+    }
+
+    failIfFalse((parseFunctionInfo(context, requirements, parseMode, true, ConstructorKind::None, SuperBinding::NotNeeded, functionKeywordStart, functionInfo, FunctionDefinitionType::Declaration)), "Cannot parse this function");
+    ASSERT(functionInfo.name);
+
+    std::pair<DeclarationResultMask, ScopeRef> functionDeclaration = declareFunction(functionInfo.name);
+    DeclarationResultMask declarationResult = functionDeclaration.first;
+    failIfTrueIfStrict(declarationResult & DeclarationResult::InvalidStrictMode, "Cannot declare a function named '", functionInfo.name->impl(), "' in strict mode");
+    if (declarationResult & DeclarationResult::InvalidDuplicateDeclaration)
+        internalFailWithMessage(false, "Cannot declare a function that shadows a let/const/class/function variable '", functionInfo.name->impl(), "' in strict mode");
+    if (exportType == ExportType::Exported) {
+        ASSERT_WITH_MESSAGE(declarationDefaultContext != DeclarationDefaultContext::ExportDefault, "Export default case will export the name and binding in the caller.");
+        semanticFailIfFalse(exportName(*functionInfo.name), "Cannot export a duplicate function name: '", functionInfo.name->impl(), "'");
+        m_moduleScopeData->exportBinding(*functionInfo.name);
+    }
+
+    TreeStatement result = context.createFuncDeclStatement(location, functionInfo);
+    if (TreeBuilder::CreatesAST)
+        functionDeclaration.second->appendFunction(getMetadata(functionInfo));
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseAsyncFunctionDeclaration(TreeBuilder& context, ExportType exportType, DeclarationDefaultContext declarationDefaultContext)
+{
+    ASSERT(match(FUNCTION));
+    JSTokenLocation location(tokenLocation());
+    unsigned functionKeywordStart = tokenStart();
+    next();
+    ParserFunctionInfo<TreeBuilder> functionInfo;
+    SourceParseMode parseMode = SourceParseMode::AsyncFunctionMode;
+    FunctionNameRequirements requirements = FunctionNameRequirements::Named;
+    if (declarationDefaultContext == DeclarationDefaultContext::ExportDefault) {
+        // Under the "export default" context, function declaration does not require the function name.
+        //
+        //     ExportDeclaration:
+        //         ...
+        //         export default HoistableDeclaration[~Yield, +Default]
+        //         ...
+        //
+        //     HoistableDeclaration[Yield, Default]:
+        //         FunctionDeclaration[?Yield, ?Default]
+        //         GeneratorDeclaration[?Yield, ?Default]
+        //
+        //     FunctionDeclaration[Yield, Default]:
+        //         ...
+        //         [+Default] function ( FormalParameters[~Yield] ) { FunctionBody[~Yield] }
+        //
+        //     GeneratorDeclaration[Yield, Default]:
+        //         ...
+        //         [+Default] function * ( FormalParameters[+Yield] ) { GeneratorBody }
+        //
+        // In this case, we use "*default*" as this function declaration's name.
+        requirements = FunctionNameRequirements::None;
+        functionInfo.name = &m_vm->propertyNames->builtinNames().starDefaultPrivateName();
+    }
+
+    failIfFalse((parseFunctionInfo(context, requirements, parseMode, true, ConstructorKind::None, SuperBinding::NotNeeded, functionKeywordStart, functionInfo, FunctionDefinitionType::Declaration)), "Cannot parse this async function");
+    failIfFalse(functionInfo.name, "Async function statements must have a name");
+
+    std::pair<DeclarationResultMask, ScopeRef> functionDeclaration = declareFunction(functionInfo.name);
+    DeclarationResultMask declarationResult = functionDeclaration.first;
+    failIfTrueIfStrict(declarationResult & DeclarationResult::InvalidStrictMode, "Cannot declare an async function named '", functionInfo.name->impl(), "' in strict mode");
+    if (declarationResult & DeclarationResult::InvalidDuplicateDeclaration)
+        internalFailWithMessage(false, "Cannot declare an async function that shadows a let/const/class/function variable '", functionInfo.name->impl(), "' in strict mode");
+    if (exportType == ExportType::Exported) {
+        semanticFailIfFalse(exportName(*functionInfo.name), "Cannot export a duplicate function name: '", functionInfo.name->impl(), "'");
+        m_moduleScopeData->exportBinding(*functionInfo.name);
+    }
+
+    TreeStatement result = context.createFuncDeclStatement(location, functionInfo);
+    if (TreeBuilder::CreatesAST)
+        functionDeclaration.second->appendFunction(getMetadata(functionInfo));
+    return result;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseClassDeclaration(TreeBuilder& context, ExportType exportType, DeclarationDefaultContext declarationDefaultContext)
+{
+    ASSERT(match(CLASSTOKEN));
+    JSTokenLocation location(tokenLocation());
+    JSTextPosition classStart = tokenStartPosition();
+    unsigned classStartLine = tokenLine();
+
+    ParserClassInfo<TreeBuilder> info;
+    FunctionNameRequirements requirements = FunctionNameRequirements::Named;
+    if (declarationDefaultContext == DeclarationDefaultContext::ExportDefault) {
+        // Under the "export default" context, class declaration does not require the class name.
+        //
+        //     ExportDeclaration:
+        //         ...
+        //         export default ClassDeclaration[~Yield, +Default]
+        //         ...
+        //
+        //     ClassDeclaration[Yield, Default]:
+        //         ...
+        //         [+Default] class ClassTail[?Yield]
+        //
+        // In this case, we use "*default*" as this class declaration's name.
+        requirements = FunctionNameRequirements::None;
+        info.className = &m_vm->propertyNames->builtinNames().starDefaultPrivateName();
+    }
+
+    TreeClassExpression classExpr = parseClass(context, requirements, info);
+    failIfFalse(classExpr, "Failed to parse class");
+    ASSERT(info.className);
+
+    DeclarationResultMask declarationResult = declareVariable(info.className, DeclarationType::LetDeclaration);
+    if (declarationResult & DeclarationResult::InvalidDuplicateDeclaration)
+        internalFailWithMessage(false, "Cannot declare a class twice: '", info.className->impl(), "'");
+    if (exportType == ExportType::Exported) {
+        ASSERT_WITH_MESSAGE(declarationDefaultContext != DeclarationDefaultContext::ExportDefault, "Export default case will export the name and binding in the caller.");
+        semanticFailIfFalse(exportName(*info.className), "Cannot export a duplicate class name: '", info.className->impl(), "'");
+        m_moduleScopeData->exportBinding(*info.className);
+    }
+
+    JSTextPosition classEnd = lastTokenEndPosition();
+    unsigned classEndLine = tokenLine();
+
+    return context.createClassDeclStatement(location, classExpr, classStart, classEnd, classStartLine, classEndLine);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeClassExpression Parser<LexerType>::parseClass(TreeBuilder& context, FunctionNameRequirements requirements, ParserClassInfo<TreeBuilder>& info)
+{
+    ASSERT(match(CLASSTOKEN));
+    JSTokenLocation location(tokenLocation());
+    info.startLine = location.line;
+    info.startColumn = tokenColumn();
+    info.startOffset = location.startOffset;
+    next();
+
+    AutoPopScopeRef classScope(this, pushScope());
+    classScope->setIsLexicalScope();
+    classScope->preventVarDeclarations();
+    classScope->setStrictMode();
+
+    ASSERT_WITH_MESSAGE(requirements != FunctionNameRequirements::Unnamed, "Currently, there is no caller that uses FunctionNameRequirements::Unnamed for class syntax.");
+    ASSERT_WITH_MESSAGE(!(requirements == FunctionNameRequirements::None && !info.className), "When specifying FunctionNameRequirements::None, we need to initialize info.className with the default value in the caller side.");
+    if (match(IDENT)) {
+        info.className = m_token.m_data.ident;
+        next();
+        failIfTrue(classScope->declareLexicalVariable(info.className, true) & DeclarationResult::InvalidStrictMode, "'", info.className->impl(), "' is not a valid class name");
+    } else if (requirements == FunctionNameRequirements::Named) {
+        if (match(OPENBRACE))
+            semanticFail("Class statements must have a name");
+        semanticFailureDueToKeyword("class name");
+        failDueToUnexpectedToken();
+    }
+    ASSERT(info.className);
+
+    TreeExpression parentClass = 0;
+    if (consume(EXTENDS)) {
+        parentClass = parseMemberExpression(context);
+        failIfFalse(parentClass, "Cannot parse the parent class name");
+    }
+    const ConstructorKind constructorKind = parentClass ? ConstructorKind::Extends : ConstructorKind::Base;
+
+    consumeOrFail(OPENBRACE, "Expected opening '{' at the start of a class body");
+
+    TreeExpression constructor = 0;
+    TreePropertyList staticMethods = 0;
+    TreePropertyList instanceMethods = 0;
+    TreePropertyList instanceMethodsTail = 0;
+    TreePropertyList staticMethodsTail = 0;
+    while (!match(CLOSEBRACE)) {
+        if (match(SEMICOLON)) {
+            next();
+            continue;
+        }
+
+        JSTokenLocation methodLocation(tokenLocation());
+        unsigned methodStart = tokenStart();
+
+        // For backwards compatibility, "static" is a non-reserved keyword in non-strict mode.
+        bool isStaticMethod = false;
+        if (match(RESERVED_IF_STRICT) && *m_token.m_data.ident == m_vm->propertyNames->staticKeyword) {
+            SavePoint savePoint = createSavePoint();
+            next();
+            if (match(OPENPAREN)) {
+                // Reparse "static()" as a method named "static".
+                restoreSavePoint(savePoint);
+            } else
+                isStaticMethod = true;
+        }
+
+        // FIXME: Figure out a way to share more code with parseProperty.
+        const CommonIdentifiers& propertyNames = *m_vm->propertyNames;
+        const Identifier* ident = &propertyNames.nullIdentifier;
+        TreeExpression computedPropertyName = 0;
+        bool isGetter = false;
+        bool isSetter = false;
+        bool isGenerator = false;
+        bool isAsync = false;
+        bool isAsyncMethod = false;
+        if (consume(TIMES))
+            isGenerator = true;
+
+parseMethod:
+        switch (m_token.m_type) {
+        namedKeyword:
+        case STRING:
+            ident = m_token.m_data.ident;
+            ASSERT(ident);
+            next();
+            break;
+        case ASYNC:
+            isAsync = !isGenerator && !isAsyncMethod;
+            FALLTHROUGH;
+        case IDENT:
+        case AWAIT:
+            ident = m_token.m_data.ident;
+            ASSERT(ident);
+            next();
+            if (!isGenerator && !isAsyncMethod && (matchIdentifierOrKeyword() || match(STRING) || match(DOUBLE) || match(INTEGER) || match(OPENBRACKET))) {
+                isGetter = *ident == propertyNames.get;
+                isSetter = *ident == propertyNames.set;
+
+                if (UNLIKELY(isAsync && !m_lexer->prevTerminator())) {
+                    isAsyncMethod = true;
+                    goto parseMethod;
+                }
+            }
+            break;
+        case DOUBLE:
+        case INTEGER:
+            ident = &m_parserArena.identifierArena().makeNumericIdentifier(const_cast<VM*>(m_vm), m_token.m_data.doubleValue);
+            ASSERT(ident);
+            next();
+            break;
+        case OPENBRACKET:
+            next();
+            computedPropertyName = parseAssignmentExpression(context);
+            failIfFalse(computedPropertyName, "Cannot parse computed property name");
+            handleProductionOrFail(CLOSEBRACKET, "]", "end", "computed property name");
+            break;
+        default:
+            if (m_token.m_type & KeywordTokenFlag)
+                goto namedKeyword;
+            failDueToUnexpectedToken();
+        }
+
+        TreeProperty property;
+        const bool alwaysStrictInsideClass = true;
+        if (isGetter || isSetter) {
+            bool isClassProperty = true;
+            property = parseGetterSetter(context, alwaysStrictInsideClass, isGetter ? PropertyNode::Getter : PropertyNode::Setter, methodStart,
+                ConstructorKind::None, isClassProperty);
+            failIfFalse(property, "Cannot parse this method");
+        } else {
+            ParserFunctionInfo<TreeBuilder> methodInfo;
+            bool isConstructor = !isStaticMethod && *ident == propertyNames.constructor;
+            SourceParseMode parseMode = SourceParseMode::MethodMode;
+            if (isAsyncMethod) {
+                isConstructor = false;
+                parseMode = SourceParseMode::AsyncMethodMode;
+                semanticFailIfTrue(*ident == m_vm->propertyNames->prototype, "Cannot declare an async method named 'prototype'");
+                semanticFailIfTrue(*ident == m_vm->propertyNames->constructor, "Cannot declare an async method named 'constructor'");
+            } else if (isGenerator) {
+                isConstructor = false;
+                parseMode = SourceParseMode::GeneratorWrapperFunctionMode;
+                semanticFailIfTrue(*ident == m_vm->propertyNames->prototype, "Cannot declare a generator named 'prototype'");
+                semanticFailIfTrue(*ident == m_vm->propertyNames->constructor, "Cannot declare a generator named 'constructor'");
+            }
+            methodInfo.name = isConstructor ? info.className : ident;
+            failIfFalse((parseFunctionInfo(context, FunctionNameRequirements::Unnamed, parseMode, false, isConstructor ? constructorKind : ConstructorKind::None, SuperBinding::Needed, methodStart, methodInfo, FunctionDefinitionType::Method)), "Cannot parse this method");
+
+            TreeExpression method = context.createMethodDefinition(methodLocation, methodInfo);
+            if (isConstructor) {
+                semanticFailIfTrue(constructor, "Cannot declare multiple constructors in a single class");
+                constructor = method;
+                continue;
+            }
+
+            // FIXME: Syntax error when super() is called
+            semanticFailIfTrue(isStaticMethod && methodInfo.name && *methodInfo.name == propertyNames.prototype,
+                "Cannot declare a static method named 'prototype'");
+
+            bool isClassProperty = true;
+            if (computedPropertyName) {
+                property = context.createProperty(computedPropertyName, method, static_cast<PropertyNode::Type>(PropertyNode::Constant | PropertyNode::Computed),
+                    PropertyNode::Unknown, alwaysStrictInsideClass, SuperBinding::Needed, isClassProperty);
+            } else
+                property = context.createProperty(methodInfo.name, method, PropertyNode::Constant, PropertyNode::Unknown, alwaysStrictInsideClass, SuperBinding::Needed, isClassProperty);
+        }
+
+        TreePropertyList& tail = isStaticMethod ? staticMethodsTail : instanceMethodsTail;
+        if (tail)
+            tail = context.createPropertyList(methodLocation, property, tail);
+        else {
+            tail = context.createPropertyList(methodLocation, property);
+            if (isStaticMethod)
+                staticMethods = tail;
+            else
+                instanceMethods = tail;
+        }
+    }
+
+    info.endOffset = tokenLocation().endOffset - 1;
+    consumeOrFail(CLOSEBRACE, "Expected a closing '}' after a class body");
+
+    auto classExpression = context.createClassExpr(location, info, classScope->finalizeLexicalEnvironment(), constructor, parentClass, instanceMethods, staticMethods);
+    popScope(classScope, TreeBuilder::NeedsFreeVariableInfo);
+    return classExpression;
+}
+
+struct LabelInfo {
+    LabelInfo(const Identifier* ident, const JSTextPosition& start, const JSTextPosition& end)
+    : m_ident(ident)
+    , m_start(start)
+    , m_end(end)
+    {
+    }
+    
+    const Identifier* m_ident;
+    JSTextPosition m_start;
+    JSTextPosition m_end;
+};
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseExpressionOrLabelStatement(TreeBuilder& context, bool allowFunctionDeclarationAsStatement)
+{
+    
+    /* Expression and Label statements are ambiguous at LL(1), so we have a
+     * special case that looks for a colon as the next character in the input.
+     */
+    Vector<LabelInfo> labels;
+    JSTokenLocation location;
+    do {
+        JSTextPosition start = tokenStartPosition();
+        location = tokenLocation();
+        if (!nextTokenIsColon()) {
+            // If we hit this path we're making a expression statement, which
+            // by definition can't make use of continue/break so we can just
+            // ignore any labels we might have accumulated.
+            TreeExpression expression = parseExpression(context);
+            failIfFalse(expression, "Cannot parse expression statement");
+            if (!autoSemiColon())
+                failDueToUnexpectedToken();
+            return context.createExprStatement(location, expression, start, m_lastTokenEndPosition.line);
+        }
+
+        if (UNLIKELY(match(AWAIT)))
+            semanticFailIfTrue(isDisallowedIdentifierAwait(m_token), "Can't use 'await' as a label ", disallowedIdentifierAwaitReason());
+
+        const Identifier* ident = m_token.m_data.ident;
+        JSTextPosition end = tokenEndPosition();
+        next();
+        consumeOrFail(COLON, "Labels must be followed by a ':'");
+        if (!m_syntaxAlreadyValidated) {
+            // This is O(N^2) over the current list of consecutive labels, but I
+            // have never seen more than one label in a row in the real world.
+            for (size_t i = 0; i < labels.size(); i++)
+                failIfTrue(ident->impl() == labels[i].m_ident->impl(), "Attempted to redeclare the label '", ident->impl(), "'");
+            failIfTrue(getLabel(ident), "Cannot find scope for the label '", ident->impl(), "'");
+            labels.append(LabelInfo(ident, start, end));
+        }
+    } while (matchSpecIdentifier());
+    bool isLoop = false;
+    switch (m_token.m_type) {
+    case FOR:
+    case WHILE:
+    case DO:
+        isLoop = true;
+        break;
+        
+    default:
+        break;
+    }
+    const Identifier* unused = 0;
+    ScopeRef labelScope = currentScope();
+    if (!m_syntaxAlreadyValidated) {
+        for (size_t i = 0; i < labels.size(); i++)
+            pushLabel(labels[i].m_ident, isLoop);
+    }
+    m_immediateParentAllowsFunctionDeclarationInStatement = allowFunctionDeclarationAsStatement;
+    TreeStatement statement = parseStatement(context, unused);
+    if (!m_syntaxAlreadyValidated) {
+        for (size_t i = 0; i < labels.size(); i++)
+            popLabel(labelScope);
+    }
+    failIfFalse(statement, "Cannot parse statement");
+    for (size_t i = 0; i < labels.size(); i++) {
+        const LabelInfo& info = labels[labels.size() - i - 1];
+        statement = context.createLabelStatement(location, info.m_ident, statement, info.m_start, info.m_end);
+    }
+    return statement;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseExpressionStatement(TreeBuilder& context)
+{
+    switch (m_token.m_type) {
+    // Consult: http://www.ecma-international.org/ecma-262/6.0/index.html#sec-expression-statement
+    // The ES6 spec mandates that we should fail from FUNCTION token here. We handle this case 
+    // in parseStatement() which is the only caller of parseExpressionStatement().
+    // We actually allow FUNCTION in situations where it should not be allowed unless we're in strict mode.
+    case CLASSTOKEN:
+        failWithMessage("'class' declaration is not directly within a block statement");
+        break;
+    default:
+        // FIXME: when implementing 'let' we should fail when we see the token sequence "let [".
+        // https://bugs.webkit.org/show_bug.cgi?id=142944
+        break;
+    }
+    JSTextPosition start = tokenStartPosition();
+    JSTokenLocation location(tokenLocation());
+    TreeExpression expression = parseExpression(context);
+    failIfFalse(expression, "Cannot parse expression statement");
+    failIfFalse(autoSemiColon(), "Parse error");
+    return context.createExprStatement(location, expression, start, m_lastTokenEndPosition.line);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseIfStatement(TreeBuilder& context)
+{
+    ASSERT(match(IF));
+    JSTokenLocation ifLocation(tokenLocation());
+    int start = tokenLine();
+    next();
+    handleProductionOrFail2(OPENPAREN, "(", "start", "'if' condition");
+
+    TreeExpression condition = parseExpression(context);
+    failIfFalse(condition, "Expected a expression as the condition for an if statement");
+    recordPauseLocation(context.breakpointLocation(condition));
+    int end = tokenLine();
+    handleProductionOrFail2(CLOSEPAREN, ")", "end", "'if' condition");
+
+    const Identifier* unused = 0;
+    m_immediateParentAllowsFunctionDeclarationInStatement = true;
+    TreeStatement trueBlock = parseStatement(context, unused);
+    failIfFalse(trueBlock, "Expected a statement as the body of an if block");
+
+    if (!match(ELSE))
+        return context.createIfStatement(ifLocation, condition, trueBlock, 0, start, end);
+
+    Vector<TreeExpression> exprStack;
+    Vector<std::pair<int, int>> posStack;
+    Vector<JSTokenLocation> tokenLocationStack;
+    Vector<TreeStatement> statementStack;
+    bool trailingElse = false;
+    do {
+        JSTokenLocation tempLocation = tokenLocation();
+        next();
+        if (!match(IF)) {
+            const Identifier* unused = 0;
+            m_immediateParentAllowsFunctionDeclarationInStatement = true;
+            TreeStatement block = parseStatement(context, unused);
+            failIfFalse(block, "Expected a statement as the body of an else block");
+            statementStack.append(block);
+            trailingElse = true;
+            break;
+        }
+        int innerStart = tokenLine();
+        next();
+        
+        handleProductionOrFail2(OPENPAREN, "(", "start", "'if' condition");
+
+        TreeExpression innerCondition = parseExpression(context);
+        failIfFalse(innerCondition, "Expected a expression as the condition for an if statement");
+        recordPauseLocation(context.breakpointLocation(innerCondition));
+        int innerEnd = tokenLine();
+        handleProductionOrFail2(CLOSEPAREN, ")", "end", "'if' condition");
+        const Identifier* unused = 0;
+        m_immediateParentAllowsFunctionDeclarationInStatement = true;
+        TreeStatement innerTrueBlock = parseStatement(context, unused);
+        failIfFalse(innerTrueBlock, "Expected a statement as the body of an if block");
+        tokenLocationStack.append(tempLocation);
+        exprStack.append(innerCondition);
+        posStack.append(std::make_pair(innerStart, innerEnd));
+        statementStack.append(innerTrueBlock);
+    } while (match(ELSE));
+
+    if (!trailingElse) {
+        TreeExpression condition = exprStack.last();
+        exprStack.removeLast();
+        TreeStatement trueBlock = statementStack.last();
+        statementStack.removeLast();
+        std::pair<int, int> pos = posStack.last();
+        posStack.removeLast();
+        JSTokenLocation elseLocation = tokenLocationStack.last();
+        tokenLocationStack.removeLast();
+        TreeStatement ifStatement = context.createIfStatement(elseLocation, condition, trueBlock, 0, pos.first, pos.second);
+        context.setEndOffset(ifStatement, context.endOffset(trueBlock));
+        statementStack.append(ifStatement);
+    }
+
+    while (!exprStack.isEmpty()) {
+        TreeExpression condition = exprStack.last();
+        exprStack.removeLast();
+        TreeStatement falseBlock = statementStack.last();
+        statementStack.removeLast();
+        TreeStatement trueBlock = statementStack.last();
+        statementStack.removeLast();
+        std::pair<int, int> pos = posStack.last();
+        posStack.removeLast();
+        JSTokenLocation elseLocation = tokenLocationStack.last();
+        tokenLocationStack.removeLast();
+        TreeStatement ifStatement = context.createIfStatement(elseLocation, condition, trueBlock, falseBlock, pos.first, pos.second);
+        context.setEndOffset(ifStatement, context.endOffset(falseBlock));
+        statementStack.append(ifStatement);
+    }
+
+    return context.createIfStatement(ifLocation, condition, trueBlock, statementStack.last(), start, end);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> typename TreeBuilder::ModuleName Parser<LexerType>::parseModuleName(TreeBuilder& context)
+{
+    // ModuleName (ModuleSpecifier in the spec) represents the module name imported by the script.
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-imports
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-exports
+    JSTokenLocation specifierLocation(tokenLocation());
+    failIfFalse(match(STRING), "Imported modules names must be string literals");
+    const Identifier* moduleName = m_token.m_data.ident;
+    next();
+    return context.createModuleName(specifierLocation, *moduleName);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> typename TreeBuilder::ImportSpecifier Parser<LexerType>::parseImportClauseItem(TreeBuilder& context, ImportSpecifierType specifierType)
+{
+    // Produced node is the item of the ImportClause.
+    // That is the ImportSpecifier, ImportedDefaultBinding or NameSpaceImport.
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-imports
+    JSTokenLocation specifierLocation(tokenLocation());
+    JSToken localNameToken;
+    const Identifier* importedName = nullptr;
+    const Identifier* localName = nullptr;
+
+    switch (specifierType) {
+    case ImportSpecifierType::NamespaceImport: {
+        // NameSpaceImport :
+        // * as ImportedBinding
+        // e.g.
+        //     * as namespace
+        ASSERT(match(TIMES));
+        importedName = &m_vm->propertyNames->timesIdentifier;
+        next();
+
+        failIfFalse(matchContextualKeyword(m_vm->propertyNames->as), "Expected 'as' before imported binding name");
+        next();
+
+        failIfFalse(matchSpecIdentifier(), "Expected a variable name for the import declaration");
+        localNameToken = m_token;
+        localName = m_token.m_data.ident;
+        next();
+        break;
+    }
+
+    case ImportSpecifierType::NamedImport: {
+        // ImportSpecifier :
+        // ImportedBinding
+        // IdentifierName as ImportedBinding
+        // e.g.
+        //     A
+        //     A as B
+        ASSERT(matchIdentifierOrKeyword());
+        localNameToken = m_token;
+        localName = m_token.m_data.ident;
+        importedName = localName;
+        next();
+
+        if (matchContextualKeyword(m_vm->propertyNames->as)) {
+            next();
+            failIfFalse(matchSpecIdentifier(), "Expected a variable name for the import declaration");
+            localNameToken = m_token;
+            localName = m_token.m_data.ident;
+            next();
+        }
+        break;
+    }
+
+    case ImportSpecifierType::DefaultImport: {
+        // ImportedDefaultBinding :
+        // ImportedBinding
+        ASSERT(matchSpecIdentifier());
+        localNameToken = m_token;
+        localName = m_token.m_data.ident;
+        importedName = &m_vm->propertyNames->defaultKeyword;
+        next();
+        break;
+    }
+    }
+
+    semanticFailIfTrue(localNameToken.m_type == AWAIT, "Cannot use 'await' as an imported binding name");
+    semanticFailIfTrue(localNameToken.m_type & KeywordTokenFlag, "Cannot use keyword as imported binding name");
+    DeclarationResultMask declarationResult = declareVariable(localName, DeclarationType::ConstDeclaration, (specifierType == ImportSpecifierType::NamespaceImport) ? DeclarationImportType::ImportedNamespace : DeclarationImportType::Imported);
+    if (declarationResult != DeclarationResult::Valid) {
+        failIfTrueIfStrict(declarationResult & DeclarationResult::InvalidStrictMode, "Cannot declare an imported binding named ", localName->impl(), " in strict mode");
+        if (declarationResult & DeclarationResult::InvalidDuplicateDeclaration)
+            internalFailWithMessage(false, "Cannot declare an imported binding name twice: '", localName->impl(), "'");
+    }
+
+    return context.createImportSpecifier(specifierLocation, *importedName, *localName);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseImportDeclaration(TreeBuilder& context)
+{
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-imports
+    ASSERT(match(IMPORT));
+    JSTokenLocation importLocation(tokenLocation());
+    next();
+
+    auto specifierList = context.createImportSpecifierList();
+
+    if (match(STRING)) {
+        // import ModuleSpecifier ;
+        auto moduleName = parseModuleName(context);
+        failIfFalse(moduleName, "Cannot parse the module name");
+        failIfFalse(autoSemiColon(), "Expected a ';' following a targeted import declaration");
+        return context.createImportDeclaration(importLocation, specifierList, moduleName);
+    }
+
+    bool isFinishedParsingImport = false;
+    if (matchSpecIdentifier()) {
+        // ImportedDefaultBinding :
+        // ImportedBinding
+        auto specifier = parseImportClauseItem(context, ImportSpecifierType::DefaultImport);
+        failIfFalse(specifier, "Cannot parse the default import");
+        context.appendImportSpecifier(specifierList, specifier);
+        if (match(COMMA))
+            next();
+        else
+            isFinishedParsingImport = true;
+    }
+
+    if (!isFinishedParsingImport) {
+        if (match(TIMES)) {
+            // import NameSpaceImport FromClause ;
+            auto specifier = parseImportClauseItem(context, ImportSpecifierType::NamespaceImport);
+            failIfFalse(specifier, "Cannot parse the namespace import");
+            context.appendImportSpecifier(specifierList, specifier);
+        } else if (match(OPENBRACE)) {
+            // NamedImports :
+            // { }
+            // { ImportsList }
+            // { ImportsList , }
+            next();
+
+            while (!match(CLOSEBRACE)) {
+                failIfFalse(matchIdentifierOrKeyword(), "Expected an imported name for the import declaration");
+                auto specifier = parseImportClauseItem(context, ImportSpecifierType::NamedImport);
+                failIfFalse(specifier, "Cannot parse the named import");
+                context.appendImportSpecifier(specifierList, specifier);
+                if (!consume(COMMA))
+                    break;
+            }
+            handleProductionOrFail2(CLOSEBRACE, "}", "end", "import list");
+        } else
+            failWithMessage("Expected namespace import or import list");
+    }
+
+    // FromClause :
+    // from ModuleSpecifier
+
+    failIfFalse(matchContextualKeyword(m_vm->propertyNames->from), "Expected 'from' before imported module name");
+    next();
+
+    auto moduleName = parseModuleName(context);
+    failIfFalse(moduleName, "Cannot parse the module name");
+    failIfFalse(autoSemiColon(), "Expected a ';' following a targeted import declaration");
+
+    return context.createImportDeclaration(importLocation, specifierList, moduleName);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> typename TreeBuilder::ExportSpecifier Parser<LexerType>::parseExportSpecifier(TreeBuilder& context, Vector<std::pair<const Identifier*, const Identifier*>>& maybeExportedLocalNames, bool& hasKeywordForLocalBindings)
+{
+    // ExportSpecifier :
+    // IdentifierName
+    // IdentifierName as IdentifierName
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-exports
+    ASSERT(matchIdentifierOrKeyword());
+    JSTokenLocation specifierLocation(tokenLocation());
+    if (m_token.m_type & KeywordTokenFlag)
+        hasKeywordForLocalBindings = true;
+    const Identifier* localName = m_token.m_data.ident;
+    const Identifier* exportedName = localName;
+    next();
+
+    if (matchContextualKeyword(m_vm->propertyNames->as)) {
+        next();
+        failIfFalse(matchIdentifierOrKeyword(), "Expected an exported name for the export declaration");
+        exportedName = m_token.m_data.ident;
+        next();
+    }
+
+    semanticFailIfFalse(exportName(*exportedName), "Cannot export a duplicate name '", exportedName->impl(), "'");
+    maybeExportedLocalNames.append(std::make_pair(localName, exportedName));
+    return context.createExportSpecifier(specifierLocation, *localName, *exportedName);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeStatement Parser<LexerType>::parseExportDeclaration(TreeBuilder& context)
+{
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-exports
+    ASSERT(match(EXPORT));
+    JSTokenLocation exportLocation(tokenLocation());
+    next();
+
+    switch (m_token.m_type) {
+    case TIMES: {
+        // export * FromClause ;
+        next();
+
+        failIfFalse(matchContextualKeyword(m_vm->propertyNames->from), "Expected 'from' before exported module name");
+        next();
+        auto moduleName = parseModuleName(context);
+        failIfFalse(moduleName, "Cannot parse the 'from' clause");
+        failIfFalse(autoSemiColon(), "Expected a ';' following a targeted export declaration");
+
+        return context.createExportAllDeclaration(exportLocation, moduleName);
+    }
+
+    case DEFAULT: {
+        // export default HoistableDeclaration[Default]
+        // export default ClassDeclaration[Default]
+        // export default [lookahead not-in {function, class}] AssignmentExpression[In] ;
+
+        next();
+
+        TreeStatement result = 0;
+        bool isFunctionOrClassDeclaration = false;
+        const Identifier* localName = nullptr;
+
+        bool startsWithFunction = match(FUNCTION);
+        if (startsWithFunction || match(CLASSTOKEN)) {
+            SavePoint savePoint = createSavePoint();
+            isFunctionOrClassDeclaration = true;
+            next();
+
+            // ES6 Generators
+            if (startsWithFunction && match(TIMES))
+                next();
+            if (match(IDENT))
+                localName = m_token.m_data.ident;
+            restoreSavePoint(savePoint);
+        } else if (match(ASYNC)) {
+            SavePoint savePoint = createSavePoint();
+            next();
+            if (match(FUNCTION) && !m_lexer->prevTerminator()) {
+                next();
+                if (match(IDENT))
+                    localName = m_token.m_data.ident;
+                isFunctionOrClassDeclaration = true;
+            }
+            restoreSavePoint(savePoint);
+        }
+
+        if (!localName)
+            localName = &m_vm->propertyNames->builtinNames().starDefaultPrivateName();
+
+        if (isFunctionOrClassDeclaration) {
+            if (startsWithFunction) {
+                ASSERT(match(FUNCTION));
+                DepthManager statementDepth(&m_statementDepth);
+                m_statementDepth = 1;
+                result = parseFunctionDeclaration(context, ExportType::NotExported, DeclarationDefaultContext::ExportDefault);
+            } else if (match(CLASSTOKEN)) {
+                result = parseClassDeclaration(context, ExportType::NotExported, DeclarationDefaultContext::ExportDefault);
+            } else {
+                ASSERT(match(ASYNC));
+                next();
+                DepthManager statementDepth(&m_statementDepth);
+                m_statementDepth = 1;
+                result = parseAsyncFunctionDeclaration(context, ExportType::NotExported, DeclarationDefaultContext::ExportDefault);
+            }
+        } else {
+            // export default expr;
+            //
+            // It should be treated as the same to the following.
+            //
+            // const *default* = expr;
+            // export { *default* as default }
+            //
+            // In the above example, *default* is the invisible variable to the users.
+            // We use the private symbol to represent the name of this variable.
+            JSTokenLocation location(tokenLocation());
+            JSTextPosition start = tokenStartPosition();
+            TreeExpression expression = parseAssignmentExpression(context);
+            failIfFalse(expression, "Cannot parse expression");
+
+            DeclarationResultMask declarationResult = declareVariable(&m_vm->propertyNames->builtinNames().starDefaultPrivateName(), DeclarationType::ConstDeclaration);
+            if (declarationResult & DeclarationResult::InvalidDuplicateDeclaration)
+                internalFailWithMessage(false, "Only one 'default' export is allowed");
+
+            TreeExpression assignment = context.createAssignResolve(location, m_vm->propertyNames->builtinNames().starDefaultPrivateName(), expression, start, start, tokenEndPosition(), AssignmentContext::ConstDeclarationStatement);
+            result = context.createExprStatement(location, assignment, start, tokenEndPosition());
+            failIfFalse(autoSemiColon(), "Expected a ';' following a targeted export declaration");
+        }
+        failIfFalse(result, "Cannot parse the declaration");
+
+        semanticFailIfFalse(exportName(m_vm->propertyNames->defaultKeyword), "Only one 'default' export is allowed");
+        m_moduleScopeData->exportBinding(*localName, m_vm->propertyNames->defaultKeyword);
+        return context.createExportDefaultDeclaration(exportLocation, result, *localName);
+    }
+
+    case OPENBRACE: {
+        // export ExportClause FromClause ;
+        // export ExportClause ;
+        //
+        // ExportClause :
+        // { }
+        // { ExportsList }
+        // { ExportsList , }
+        //
+        // ExportsList :
+        // ExportSpecifier
+        // ExportsList , ExportSpecifier
+
+        next();
+
+        auto specifierList = context.createExportSpecifierList();
+        Vector<std::pair<const Identifier*, const Identifier*>> maybeExportedLocalNames;
+
+        bool hasKeywordForLocalBindings = false;
+        while (!match(CLOSEBRACE)) {
+            failIfFalse(matchIdentifierOrKeyword(), "Expected a variable name for the export declaration");
+            auto specifier = parseExportSpecifier(context, maybeExportedLocalNames, hasKeywordForLocalBindings);
+            failIfFalse(specifier, "Cannot parse the named export");
+            context.appendExportSpecifier(specifierList, specifier);
+            if (!consume(COMMA))
+                break;
+        }
+        handleProductionOrFail2(CLOSEBRACE, "}", "end", "export list");
+
+        typename TreeBuilder::ModuleName moduleName = 0;
+        if (matchContextualKeyword(m_vm->propertyNames->from)) {
+            next();
+            moduleName = parseModuleName(context);
+            failIfFalse(moduleName, "Cannot parse the 'from' clause");
+        }
+        failIfFalse(autoSemiColon(), "Expected a ';' following a targeted export declaration");
+
+        if (!moduleName) {
+            semanticFailIfTrue(hasKeywordForLocalBindings, "Cannot use keyword as exported variable name");
+            // Since this export declaration does not have module specifier part, it exports the local bindings.
+            // While the export declaration with module specifier does not have any effect on the current module's scope,
+            // the export named declaration without module specifier references the the local binding names.
+            // For example,
+            //   export { A, B, C as D } from "mod"
+            // does not have effect on the current module's scope. But,
+            //   export { A, B, C as D }
+            // will reference the current module's bindings.
+            for (const auto& pair : maybeExportedLocalNames) {
+                const Identifier* localName = pair.first;
+                const Identifier* exportedName = pair.second;
+                m_moduleScopeData->exportBinding(*localName, *exportedName);
+            }
+        }
+
+        return context.createExportNamedDeclaration(exportLocation, specifierList, moduleName);
+    }
+
+    default: {
+        // export VariableStatement
+        // export Declaration
+        TreeStatement result = 0;
+        switch (m_token.m_type) {
+        case VAR:
+            result = parseVariableDeclaration(context, DeclarationType::VarDeclaration, ExportType::Exported);
+            break;
+
+        case CONSTTOKEN:
+            result = parseVariableDeclaration(context, DeclarationType::ConstDeclaration, ExportType::Exported);
+            break;
+
+        case LET:
+            result = parseVariableDeclaration(context, DeclarationType::LetDeclaration, ExportType::Exported);
+            break;
+
+        case FUNCTION: {
+            DepthManager statementDepth(&m_statementDepth);
+            m_statementDepth = 1;
+            result = parseFunctionDeclaration(context, ExportType::Exported);
+            break;
+        }
+
+        case CLASSTOKEN:
+            result = parseClassDeclaration(context, ExportType::Exported);
+            break;
+
+        case ASYNC:
+            next();
+            semanticFailIfFalse(match(FUNCTION) && !m_lexer->prevTerminator(), "Expected 'function' keyword following 'async' keyword with no preceding line terminator");
+            result = parseAsyncFunctionDeclaration(context, ExportType::Exported);
+            break;
+
+        default:
+            failWithMessage("Expected either a declaration or a variable statement");
+            break;
+        }
+
+        failIfFalse(result, "Cannot parse the declaration");
+        return context.createExportLocalDeclaration(exportLocation, result);
+    }
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseExpression(TreeBuilder& context)
+{
+    failIfStackOverflow();
+    JSTokenLocation location(tokenLocation());
+    TreeExpression node = parseAssignmentExpression(context);
+    failIfFalse(node, "Cannot parse expression");
+    context.setEndOffset(node, m_lastTokenEndPosition.offset);
+    if (!match(COMMA))
+        return node;
+    next();
+    m_parserState.nonTrivialExpressionCount++;
+    m_parserState.nonLHSCount++;
+    TreeExpression right = parseAssignmentExpression(context);
+    failIfFalse(right, "Cannot parse expression in a comma expression");
+    context.setEndOffset(right, m_lastTokenEndPosition.offset);
+    typename TreeBuilder::Comma head = context.createCommaExpr(location, node);
+    typename TreeBuilder::Comma tail = context.appendToCommaExpr(location, head, head, right);
+    while (match(COMMA)) {
+        next(TreeBuilder::DontBuildStrings);
+        right = parseAssignmentExpression(context);
+        failIfFalse(right, "Cannot parse expression in a comma expression");
+        context.setEndOffset(right, m_lastTokenEndPosition.offset);
+        tail = context.appendToCommaExpr(location, head, tail, right);
+    }
+    context.setEndOffset(head, m_lastTokenEndPosition.offset);
+    return head;
+}
+
+template <typename LexerType>
+template <typename TreeBuilder> TreeExpression Parser<LexerType>::parseAssignmentExpressionOrPropagateErrorClass(TreeBuilder& context)
+{
+    ExpressionErrorClassifier classifier(this);
+    auto assignment = parseAssignmentExpression(context, classifier);
+    if (!assignment)
+        classifier.propagateExpressionErrorClass();
+    return assignment;
+}
+
+template <typename LexerType>
+template <typename TreeBuilder> TreeExpression Parser<LexerType>::parseAssignmentExpression(TreeBuilder& context)
+{
+    ExpressionErrorClassifier classifier(this);
+    return parseAssignmentExpression(context, classifier);
+}
+    
+template <typename LexerType>
+template <typename TreeBuilder> TreeExpression Parser<LexerType>::parseAssignmentExpression(TreeBuilder& context, ExpressionErrorClassifier& classifier)
+{
+    ASSERT(!hasError());
+    
+    failIfStackOverflow();
+
+    if (match(YIELD) && !isYIELDMaskedAsIDENT(currentScope()->isGenerator()))
+        return parseYieldExpression(context);
+
+    JSTextPosition start = tokenStartPosition();
+    JSTokenLocation location(tokenLocation());
+    int initialAssignmentCount = m_parserState.assignmentCount;
+    int initialNonLHSCount = m_parserState.nonLHSCount;
+    bool maybeAssignmentPattern = match(OPENBRACE) || match(OPENBRACKET);
+    bool wasOpenParen = match(OPENPAREN);
+    // Do not use matchSpecIdentifier() here since it is slower than isIdentifierOrKeyword.
+    // Whether spec identifier is will be validated by isArrowFunctionParameters().
+    bool wasIdentifierOrKeyword = isIdentifierOrKeyword(m_token);
+    bool maybeValidArrowFunctionStart = wasOpenParen || wasIdentifierOrKeyword;
+    SavePoint savePoint = createSavePoint();
+    size_t usedVariablesSize = 0;
+
+    if (wasOpenParen) {
+        usedVariablesSize = currentScope()->currentUsedVariablesSize();
+        currentScope()->pushUsedVariableSet();
+    }
+
+    TreeExpression lhs = parseConditionalExpression(context);
+
+    if (maybeValidArrowFunctionStart && !match(EOFTOK)) {
+        bool isArrowFunctionToken = match(ARROWFUNCTION);
+        if (!lhs || isArrowFunctionToken) {
+            SavePointWithError errorRestorationSavePoint = createSavePointForError();
+            restoreSavePoint(savePoint);
+            bool isAsyncArrow = false;
+            if (UNLIKELY(classifier.indicatesPossibleAsyncArrowFunction())) {
+                ASSERT(match(ASYNC));
+                next();
+                isAsyncArrow = !m_lexer->prevTerminator();
+            }
+            if (isArrowFunctionParameters()) {
+                if (wasOpenParen)
+                    currentScope()->revertToPreviousUsedVariables(usedVariablesSize);
+                return parseArrowFunctionExpression(context, isAsyncArrow);
+            }
+            if (isArrowFunctionToken)
+                propagateError();
+            restoreSavePointWithError(errorRestorationSavePoint);
+            if (isArrowFunctionToken)
+                failDueToUnexpectedToken();
+        }
+    }
+
+    if (!lhs && (!maybeAssignmentPattern || !classifier.indicatesPossiblePattern()))
+        propagateError();
+
+    if (maybeAssignmentPattern && (!lhs || (context.isObjectOrArrayLiteral(lhs) && match(EQUAL)))) {
+        SavePointWithError expressionErrorLocation = createSavePointForError();
+        restoreSavePoint(savePoint);
+        auto pattern = tryParseDestructuringPatternExpression(context, AssignmentContext::AssignmentExpression);
+        if (classifier.indicatesPossiblePattern() && (!pattern || !match(EQUAL))) {
+            restoreSavePointWithError(expressionErrorLocation);
+            return 0;
+        }
+        failIfFalse(pattern, "Cannot parse assignment pattern");
+        consumeOrFail(EQUAL, "Expected '=' following assignment pattern");
+        auto rhs = parseAssignmentExpression(context);
+        if (!rhs)
+            propagateError();
+        return context.createDestructuringAssignment(location, pattern, rhs);
+    }
+
+    failIfFalse(lhs, "Cannot parse expression");
+    if (initialNonLHSCount != m_parserState.nonLHSCount) {
+        if (m_token.m_type >= EQUAL && m_token.m_type <= OREQUAL)
+            semanticFail("Left hand side of operator '", getToken(), "' must be a reference");
+
+        return lhs;
+    }
+    
+    int assignmentStack = 0;
+    Operator op;
+    bool hadAssignment = false;
+    while (true) {
+        switch (m_token.m_type) {
+        case EQUAL: op = OpEqual; break;
+        case PLUSEQUAL: op = OpPlusEq; break;
+        case MINUSEQUAL: op = OpMinusEq; break;
+        case MULTEQUAL: op = OpMultEq; break;
+        case DIVEQUAL: op = OpDivEq; break;
+        case LSHIFTEQUAL: op = OpLShift; break;
+        case RSHIFTEQUAL: op = OpRShift; break;
+        case URSHIFTEQUAL: op = OpURShift; break;
+        case ANDEQUAL: op = OpAndEq; break;
+        case XOREQUAL: op = OpXOrEq; break;
+        case OREQUAL: op = OpOrEq; break;
+        case MODEQUAL: op = OpModEq; break;
+        case POWEQUAL: op = OpPowEq; break;
+        default:
+            goto end;
+        }
+        m_parserState.nonTrivialExpressionCount++;
+        hadAssignment = true;
+        if (UNLIKELY(context.isNewTarget(lhs)))
+            internalFailWithMessage(false, "new.target can't be the left hand side of an assignment expression");
+        context.assignmentStackAppend(assignmentStack, lhs, start, tokenStartPosition(), m_parserState.assignmentCount, op);
+        start = tokenStartPosition();
+        m_parserState.assignmentCount++;
+        next(TreeBuilder::DontBuildStrings);
+        if (strictMode() && m_parserState.lastIdentifier && context.isResolve(lhs)) {
+            failIfTrueIfStrict(m_vm->propertyNames->eval == *m_parserState.lastIdentifier, "Cannot modify 'eval' in strict mode");
+            failIfTrueIfStrict(m_vm->propertyNames->arguments == *m_parserState.lastIdentifier, "Cannot modify 'arguments' in strict mode");
+            m_parserState.lastIdentifier = 0;
+        }
+        lhs = parseAssignmentExpression(context);
+        failIfFalse(lhs, "Cannot parse the right hand side of an assignment expression");
+        if (initialNonLHSCount != m_parserState.nonLHSCount) {
+            if (m_token.m_type >= EQUAL && m_token.m_type <= OREQUAL)
+                semanticFail("Left hand side of operator '", getToken(), "' must be a reference");
+            break;
+        }
+    }
+end:
+    if (hadAssignment)
+        m_parserState.nonLHSCount++;
+    
+    if (!TreeBuilder::CreatesAST)
+        return lhs;
+    
+    while (assignmentStack)
+        lhs = context.createAssignment(location, assignmentStack, lhs, initialAssignmentCount, m_parserState.assignmentCount, lastTokenEndPosition());
+    
+    return lhs;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseYieldExpression(TreeBuilder& context)
+{
+    // YieldExpression[In] :
+    //     yield
+    //     yield [no LineTerminator here] AssignmentExpression[?In, Yield]
+    //     yield [no LineTerminator here] * AssignmentExpression[?In, Yield]
+
+    // http://ecma-international.org/ecma-262/6.0/#sec-generator-function-definitions
+    failIfFalse(currentScope()->isGenerator() && !currentScope()->isArrowFunctionBoundary(), "Cannot use yield expression out of generator");
+
+    // http://ecma-international.org/ecma-262/6.0/#sec-generator-function-definitions-static-semantics-early-errors
+    failIfTrue(m_parserState.functionParsePhase == FunctionParsePhase::Parameters, "Cannot use yield expression within parameters");
+
+    JSTokenLocation location(tokenLocation());
+    JSTextPosition divotStart = tokenStartPosition();
+    ASSERT(match(YIELD));
+    SavePoint savePoint = createSavePoint();
+    next();
+    if (m_lexer->prevTerminator())
+        return context.createYield(location);
+
+    bool delegate = consume(TIMES);
+    JSTextPosition argumentStart = tokenStartPosition();
+    TreeExpression argument = parseAssignmentExpression(context);
+    if (!argument) {
+        restoreSavePoint(savePoint);
+        next();
+        return context.createYield(location);
+    }
+    return context.createYield(location, argument, delegate, divotStart, argumentStart, lastTokenEndPosition());
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseAwaitExpression(TreeBuilder& context)
+{
+    ASSERT(match(AWAIT));
+    ASSERT(currentScope()->isAsyncFunction());
+    failIfTrue(m_parserState.functionParsePhase == FunctionParsePhase::Parameters, "Cannot use await expression within parameters");
+    JSTokenLocation location(tokenLocation());
+    JSTextPosition divotStart = tokenStartPosition();
+    next();
+    JSTextPosition argumentStart = tokenStartPosition();
+    TreeExpression argument = parseUnaryExpression(context);
+    failIfFalse(argument, "Failed to parse await expression");
+    return context.createAwait(location, argument, divotStart, argumentStart, lastTokenEndPosition());
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseConditionalExpression(TreeBuilder& context)
+{
+    JSTokenLocation location(tokenLocation());
+    TreeExpression cond = parseBinaryExpression(context);
+    failIfFalse(cond, "Cannot parse expression");
+    if (!match(QUESTION))
+        return cond;
+    m_parserState.nonTrivialExpressionCount++;
+    m_parserState.nonLHSCount++;
+    next(TreeBuilder::DontBuildStrings);
+    TreeExpression lhs = parseAssignmentExpression(context);
+    failIfFalse(lhs, "Cannot parse left hand side of ternary operator");
+    context.setEndOffset(lhs, m_lastTokenEndPosition.offset);
+    consumeOrFailWithFlags(COLON, TreeBuilder::DontBuildStrings, "Expected ':' in ternary operator");
+    
+    TreeExpression rhs = parseAssignmentExpression(context);
+    failIfFalse(rhs, "Cannot parse right hand side of ternary operator");
+    context.setEndOffset(rhs, m_lastTokenEndPosition.offset);
+    return context.createConditionalExpr(location, cond, lhs, rhs);
+}
+
+ALWAYS_INLINE static bool isUnaryOpExcludingUpdateOp(JSTokenType token)
+{
+    if (isUpdateOp(token))
+        return false;
+    return isUnaryOp(token);
+}
+
+template <typename LexerType>
+int Parser<LexerType>::isBinaryOperator(JSTokenType token)
+{
+    if (m_allowsIn)
+        return token & (BinaryOpTokenPrecedenceMask << BinaryOpTokenAllowsInPrecedenceAdditionalShift);
+    return token & BinaryOpTokenPrecedenceMask;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseBinaryExpression(TreeBuilder& context)
+{
+    int operandStackDepth = 0;
+    int operatorStackDepth = 0;
+    typename TreeBuilder::BinaryExprContext binaryExprContext(context);
+    JSTokenLocation location(tokenLocation());
+    while (true) {
+        JSTextPosition exprStart = tokenStartPosition();
+        int initialAssignments = m_parserState.assignmentCount;
+        JSTokenType leadingTokenTypeForUnaryExpression = m_token.m_type;
+        TreeExpression current = parseUnaryExpression(context);
+        failIfFalse(current, "Cannot parse expression");
+        
+        context.appendBinaryExpressionInfo(operandStackDepth, current, exprStart, lastTokenEndPosition(), lastTokenEndPosition(), initialAssignments != m_parserState.assignmentCount);
+
+        // 12.6 https://tc39.github.io/ecma262/#sec-exp-operator
+        // ExponentiationExpresion is described as follows.
+        //
+        //     ExponentiationExpression[Yield]:
+        //         UnaryExpression[?Yield]
+        //         UpdateExpression[?Yield] ** ExponentiationExpression[?Yield]
+        //
+        // As we can see, the left hand side of the ExponentiationExpression is UpdateExpression, not UnaryExpression.
+        // So placing UnaryExpression not included in UpdateExpression here is a syntax error.
+        // This is intentional. For example, if UnaryExpression is allowed, we can have the code like `-x**y`.
+        // But this is confusing: `-(x**y)` OR `(-x)**y`, which interpretation is correct?
+        // To avoid this problem, ECMA262 makes unparenthesized exponentiation expression as operand of unary operators an early error.
+        // More rationale: https://mail.mozilla.org/pipermail/es-discuss/2015-September/044232.html
+        //
+        // Here, we guarantee that the left hand side of this expression is not unary expression by checking the leading operator of the parseUnaryExpression.
+        // This check just works. Let's consider the example,
+        //     y <> -x ** z
+        //          ^
+        //          Check this.
+        // If the binary operator <> has higher precedence than one of "**", this check does not work.
+        // But it's OK for ** because the operator "**" has the highest operator precedence in the binary operators.
+        failIfTrue(match(POW) && isUnaryOpExcludingUpdateOp(leadingTokenTypeForUnaryExpression), "Amiguous unary expression in the left hand side of the exponentiation expression; parenthesis must be used to disambiguate the expression");
+
+        int precedence = isBinaryOperator(m_token.m_type);
+        if (!precedence)
+            break;
+        m_parserState.nonTrivialExpressionCount++;
+        m_parserState.nonLHSCount++;
+        int operatorToken = m_token.m_type;
+        next(TreeBuilder::DontBuildStrings);
+        
+        while (operatorStackDepth && context.operatorStackShouldReduce(precedence)) {
+            ASSERT(operandStackDepth > 1);
+            
+            typename TreeBuilder::BinaryOperand rhs = context.getFromOperandStack(-1);
+            typename TreeBuilder::BinaryOperand lhs = context.getFromOperandStack(-2);
+            context.shrinkOperandStackBy(operandStackDepth, 2);
+            context.appendBinaryOperation(location, operandStackDepth, operatorStackDepth, lhs, rhs);
+            context.operatorStackPop(operatorStackDepth);
+        }
+        context.operatorStackAppend(operatorStackDepth, operatorToken, precedence);
+    }
+    while (operatorStackDepth) {
+        ASSERT(operandStackDepth > 1);
+        
+        typename TreeBuilder::BinaryOperand rhs = context.getFromOperandStack(-1);
+        typename TreeBuilder::BinaryOperand lhs = context.getFromOperandStack(-2);
+        context.shrinkOperandStackBy(operandStackDepth, 2);
+        context.appendBinaryOperation(location, operandStackDepth, operatorStackDepth, lhs, rhs);
+        context.operatorStackPop(operatorStackDepth);
+    }
+    return context.popOperandStack(operandStackDepth);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeProperty Parser<LexerType>::parseProperty(TreeBuilder& context, bool complete)
+{
+    bool wasIdent = false;
+    bool isAsync = false;
+    bool isGenerator = false;
+    bool isClassProperty = false;
+    bool isAsyncMethod = false;
+    if (consume(TIMES))
+        isGenerator = true;
+
+parseProperty:
+    switch (m_token.m_type) {
+    case ASYNC:
+        isAsync = !isGenerator && !isAsyncMethod;
+        FALLTHROUGH;
+    case IDENT:
+    case AWAIT:
+        wasIdent = true;
+        FALLTHROUGH;
+    case STRING: {
+namedProperty:
+        const Identifier* ident = m_token.m_data.ident;
+        unsigned getterOrSetterStartOffset = tokenStart();
+
+        if (complete || (wasIdent && !isGenerator && (*ident == m_vm->propertyNames->get || *ident == m_vm->propertyNames->set)) || isAsync)
+            nextExpectIdentifier(LexerFlagsIgnoreReservedWords);
+        else
+            nextExpectIdentifier(LexerFlagsIgnoreReservedWords | TreeBuilder::DontBuildKeywords);
+
+        if (!isGenerator && !isAsyncMethod && match(COLON)) {
+            next();
+            TreeExpression node = parseAssignmentExpressionOrPropagateErrorClass(context);
+            failIfFalse(node, "Cannot parse expression for property declaration");
+            context.setEndOffset(node, m_lexer->currentOffset());
+            return context.createProperty(ident, node, PropertyNode::Constant, PropertyNode::Unknown, complete, SuperBinding::NotNeeded, isClassProperty);
+        }
+
+        if (match(OPENPAREN)) {
+            auto method = parsePropertyMethod(context, ident, isGenerator, isAsyncMethod);
+            propagateError();
+            return context.createProperty(ident, method, PropertyNode::Constant, PropertyNode::KnownDirect, complete, SuperBinding::Needed, isClassProperty);
+        }
+        failIfTrue(isGenerator || isAsyncMethod, "Expected a parenthesis for argument list");
+
+        failIfFalse(wasIdent, "Expected an identifier as property name");
+
+        if (match(COMMA) || match(CLOSEBRACE)) {
+            JSTextPosition start = tokenStartPosition();
+            JSTokenLocation location(tokenLocation());
+            currentScope()->useVariable(ident, m_vm->propertyNames->eval == *ident);
+            if (currentScope()->isArrowFunction())
+                currentScope()->setInnerArrowFunctionUsesEval();
+            TreeExpression node = context.createResolve(location, *ident, start, lastTokenEndPosition());
+            return context.createProperty(ident, node, static_cast<PropertyNode::Type>(PropertyNode::Constant | PropertyNode::Shorthand), PropertyNode::KnownDirect, complete, SuperBinding::NotNeeded, isClassProperty);
+        }
+
+        if (match(EQUAL)) // CoverInitializedName is exclusive to BindingPattern and AssignmentPattern
+            classifyExpressionError(ErrorIndicatesPattern);
+
+        PropertyNode::Type type;
+        if (*ident == m_vm->propertyNames->get)
+            type = PropertyNode::Getter;
+        else if (*ident == m_vm->propertyNames->set)
+            type = PropertyNode::Setter;
+        else if (UNLIKELY(isAsync && !isAsyncMethod)) {
+            isAsyncMethod = true;
+            failIfTrue(m_lexer->prevTerminator(), "Expected a property name following keyword 'async'");
+            goto parseProperty;
+        } else
+            failWithMessage("Expected a ':' following the property name '", ident->impl(), "'");
+        return parseGetterSetter(context, complete, type, getterOrSetterStartOffset, ConstructorKind::None, isClassProperty);
+    }
+    case DOUBLE:
+    case INTEGER: {
+        double propertyName = m_token.m_data.doubleValue;
+        next();
+
+        if (match(OPENPAREN)) {
+            const Identifier& ident = m_parserArena.identifierArena().makeNumericIdentifier(const_cast<VM*>(m_vm), propertyName);
+            auto method = parsePropertyMethod(context, &ident, isGenerator, isAsyncMethod);
+            propagateError();
+            return context.createProperty(&ident, method, PropertyNode::Constant, PropertyNode::Unknown, complete, SuperBinding::Needed, isClassProperty);
+        }
+        failIfTrue(isGenerator || isAsyncMethod, "Expected a parenthesis for argument list");
+
+        consumeOrFail(COLON, "Expected ':' after property name");
+        TreeExpression node = parseAssignmentExpression(context);
+        failIfFalse(node, "Cannot parse expression for property declaration");
+        context.setEndOffset(node, m_lexer->currentOffset());
+        return context.createProperty(const_cast<VM*>(m_vm), m_parserArena, propertyName, node, PropertyNode::Constant, PropertyNode::Unknown, complete, SuperBinding::NotNeeded, isClassProperty);
+    }
+    case OPENBRACKET: {
+        next();
+        auto propertyName = parseAssignmentExpression(context);
+        failIfFalse(propertyName, "Cannot parse computed property name");
+        handleProductionOrFail(CLOSEBRACKET, "]", "end", "computed property name");
+
+        if (match(OPENPAREN)) {
+            auto method = parsePropertyMethod(context, &m_vm->propertyNames->nullIdentifier, isGenerator, isAsyncMethod);
+            propagateError();
+            return context.createProperty(propertyName, method, static_cast<PropertyNode::Type>(PropertyNode::Constant | PropertyNode::Computed), PropertyNode::KnownDirect, complete, SuperBinding::Needed, isClassProperty);
+        }
+        failIfTrue(isGenerator || isAsyncMethod, "Expected a parenthesis for argument list");
+
+        consumeOrFail(COLON, "Expected ':' after property name");
+        TreeExpression node = parseAssignmentExpression(context);
+        failIfFalse(node, "Cannot parse expression for property declaration");
+        context.setEndOffset(node, m_lexer->currentOffset());
+        return context.createProperty(propertyName, node, static_cast<PropertyNode::Type>(PropertyNode::Constant | PropertyNode::Computed), PropertyNode::Unknown, complete, SuperBinding::NotNeeded, isClassProperty);
+    }
+    default:
+        failIfFalse(m_token.m_type & KeywordTokenFlag, "Expected a property name");
+        wasIdent = true; // Treat keyword token as an identifier
+        goto namedProperty;
+    }
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parsePropertyMethod(TreeBuilder& context, const Identifier* methodName, bool isGenerator, bool isAsyncMethod)
+{
+    JSTokenLocation methodLocation(tokenLocation());
+    unsigned methodStart = tokenStart();
+    ParserFunctionInfo<TreeBuilder> methodInfo;
+    methodInfo.name = methodName;
+    SourceParseMode parseMode = isGenerator ? SourceParseMode::GeneratorWrapperFunctionMode : isAsyncMethod ? SourceParseMode::AsyncMethodMode : SourceParseMode::MethodMode;
+    failIfFalse((parseFunctionInfo(context, FunctionNameRequirements::Unnamed, parseMode, false, ConstructorKind::None, SuperBinding::Needed, methodStart, methodInfo, FunctionDefinitionType::Method)), "Cannot parse this method");
+    return context.createMethodDefinition(methodLocation, methodInfo);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeProperty Parser<LexerType>::parseGetterSetter(TreeBuilder& context, bool strict, PropertyNode::Type type, unsigned getterOrSetterStartOffset,
+    ConstructorKind constructorKind, bool isClassProperty)
+{
+    const Identifier* stringPropertyName = 0;
+    double numericPropertyName = 0;
+    TreeExpression computedPropertyName = 0;
+
+    JSTokenLocation location(tokenLocation());
+
+    if (matchSpecIdentifier() || match(STRING) || m_token.m_type & KeywordTokenFlag) {
+        stringPropertyName = m_token.m_data.ident;
+        semanticFailIfTrue(isClassProperty && *stringPropertyName == m_vm->propertyNames->prototype,
+            "Cannot declare a static method named 'prototype'");
+        semanticFailIfTrue(isClassProperty && *stringPropertyName == m_vm->propertyNames->constructor,
+            "Cannot declare a getter or setter named 'constructor'");
+        next();
+    } else if (match(DOUBLE) || match(INTEGER)) {
+        numericPropertyName = m_token.m_data.doubleValue;
+        next();
+    } else if (match(OPENBRACKET)) {
+        next();
+        computedPropertyName = parseAssignmentExpression(context);
+        failIfFalse(computedPropertyName, "Cannot parse computed property name");
+        handleProductionOrFail(CLOSEBRACKET, "]", "end", "computed property name");
+    } else
+        failDueToUnexpectedToken();
+
+    ParserFunctionInfo<TreeBuilder> info;
+    if (type & PropertyNode::Getter) {
+        failIfFalse(match(OPENPAREN), "Expected a parameter list for getter definition");
+        failIfFalse((parseFunctionInfo(context, FunctionNameRequirements::Unnamed, SourceParseMode::GetterMode, false, constructorKind, SuperBinding::Needed, getterOrSetterStartOffset, info, FunctionDefinitionType::Method)), "Cannot parse getter definition");
+    } else {
+        failIfFalse(match(OPENPAREN), "Expected a parameter list for setter definition");
+        failIfFalse((parseFunctionInfo(context, FunctionNameRequirements::Unnamed, SourceParseMode::SetterMode, false, constructorKind, SuperBinding::Needed, getterOrSetterStartOffset, info, FunctionDefinitionType::Method)), "Cannot parse setter definition");
+    }
+
+    if (stringPropertyName)
+        return context.createGetterOrSetterProperty(location, type, strict, stringPropertyName, info, isClassProperty);
+
+    if (computedPropertyName)
+        return context.createGetterOrSetterProperty(location, static_cast<PropertyNode::Type>(type | PropertyNode::Computed), strict, computedPropertyName, info, isClassProperty);
+
+    return context.createGetterOrSetterProperty(const_cast<VM*>(m_vm), m_parserArena, location, type, strict, numericPropertyName, info, isClassProperty);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> bool Parser<LexerType>::shouldCheckPropertyForUnderscoreProtoDuplicate(TreeBuilder& context, const TreeProperty& property)
+{
+    if (m_syntaxAlreadyValidated)
+        return false;
+
+    if (!context.getName(property))
+        return false;
+
+    // A Constant property that is not a Computed or Shorthand Constant property.
+    return context.getType(property) == PropertyNode::Constant;
+}
+
+template <typename LexerType>
+void Parser<LexerType>::recordPauseLocation(const JSTextPosition& position)
+{
+    if (LIKELY(!m_debuggerParseData))
+        return;
+
+    if (position.line < 0)
+        return;
+
+    m_debuggerParseData->pausePositions.appendPause(position);
+}
+
+template <typename LexerType>
+void Parser<LexerType>::recordFunctionEntryLocation(const JSTextPosition& position)
+{
+    if (LIKELY(!m_debuggerParseData))
+        return;
+
+    m_debuggerParseData->pausePositions.appendEntry(position);
+}
+
+template <typename LexerType>
+void Parser<LexerType>::recordFunctionLeaveLocation(const JSTextPosition& position)
+{
+    if (LIKELY(!m_debuggerParseData))
+        return;
+
+    m_debuggerParseData->pausePositions.appendLeave(position);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseObjectLiteral(TreeBuilder& context)
+{
+    SavePoint savePoint = createSavePoint();
+    consumeOrFailWithFlags(OPENBRACE, TreeBuilder::DontBuildStrings, "Expected opening '{' at the start of an object literal");
+
+    int oldNonLHSCount = m_parserState.nonLHSCount;
+
+    JSTokenLocation location(tokenLocation());    
+    if (match(CLOSEBRACE)) {
+        next();
+        return context.createObjectLiteral(location);
+    }
+    
+    TreeProperty property = parseProperty(context, false);
+    failIfFalse(property, "Cannot parse object literal property");
+
+    if (!m_syntaxAlreadyValidated && context.getType(property) & (PropertyNode::Getter | PropertyNode::Setter)) {
+        restoreSavePoint(savePoint);
+        return parseStrictObjectLiteral(context);
+    }
+
+    bool seenUnderscoreProto = false;
+    if (shouldCheckPropertyForUnderscoreProtoDuplicate(context, property))
+        seenUnderscoreProto = *context.getName(property) == m_vm->propertyNames->underscoreProto;
+
+    TreePropertyList propertyList = context.createPropertyList(location, property);
+    TreePropertyList tail = propertyList;
+    while (match(COMMA)) {
+        next(TreeBuilder::DontBuildStrings);
+        if (match(CLOSEBRACE))
+            break;
+        JSTokenLocation propertyLocation(tokenLocation());
+        property = parseProperty(context, false);
+        failIfFalse(property, "Cannot parse object literal property");
+        if (!m_syntaxAlreadyValidated && context.getType(property) & (PropertyNode::Getter | PropertyNode::Setter)) {
+            restoreSavePoint(savePoint);
+            return parseStrictObjectLiteral(context);
+        }
+        if (shouldCheckPropertyForUnderscoreProtoDuplicate(context, property)) {
+            if (*context.getName(property) == m_vm->propertyNames->underscoreProto) {
+                semanticFailIfTrue(seenUnderscoreProto, "Attempted to redefine __proto__ property");
+                seenUnderscoreProto = true;
+            }
+        }
+        tail = context.createPropertyList(propertyLocation, property, tail);
+    }
+
+    location = tokenLocation();
+    handleProductionOrFail2(CLOSEBRACE, "}", "end", "object literal");
+    
+    m_parserState.nonLHSCount = oldNonLHSCount;
+    
+    return context.createObjectLiteral(location, propertyList);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseStrictObjectLiteral(TreeBuilder& context)
+{
+    consumeOrFail(OPENBRACE, "Expected opening '{' at the start of an object literal");
+    
+    int oldNonLHSCount = m_parserState.nonLHSCount;
+
+    JSTokenLocation location(tokenLocation());
+    if (match(CLOSEBRACE)) {
+        next();
+        return context.createObjectLiteral(location);
+    }
+    
+    TreeProperty property = parseProperty(context, true);
+    failIfFalse(property, "Cannot parse object literal property");
+
+    bool seenUnderscoreProto = false;
+    if (shouldCheckPropertyForUnderscoreProtoDuplicate(context, property))
+        seenUnderscoreProto = *context.getName(property) == m_vm->propertyNames->underscoreProto;
+
+    TreePropertyList propertyList = context.createPropertyList(location, property);
+    TreePropertyList tail = propertyList;
+    while (match(COMMA)) {
+        next();
+        if (match(CLOSEBRACE))
+            break;
+        JSTokenLocation propertyLocation(tokenLocation());
+        property = parseProperty(context, true);
+        failIfFalse(property, "Cannot parse object literal property");
+        if (shouldCheckPropertyForUnderscoreProtoDuplicate(context, property)) {
+            if (*context.getName(property) == m_vm->propertyNames->underscoreProto) {
+                semanticFailIfTrue(seenUnderscoreProto, "Attempted to redefine __proto__ property");
+                seenUnderscoreProto = true;
+            }
+        }
+        tail = context.createPropertyList(propertyLocation, property, tail);
+    }
+
+    location = tokenLocation();
+    handleProductionOrFail2(CLOSEBRACE, "}", "end", "object literal");
+
+    m_parserState.nonLHSCount = oldNonLHSCount;
+
+    return context.createObjectLiteral(location, propertyList);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseArrayLiteral(TreeBuilder& context)
+{
+    consumeOrFailWithFlags(OPENBRACKET, TreeBuilder::DontBuildStrings, "Expected an opening '[' at the beginning of an array literal");
+    
+    int oldNonLHSCount = m_parserState.nonLHSCount;
+    
+    int elisions = 0;
+    while (match(COMMA)) {
+        next(TreeBuilder::DontBuildStrings);
+        elisions++;
+    }
+    if (match(CLOSEBRACKET)) {
+        JSTokenLocation location(tokenLocation());
+        next(TreeBuilder::DontBuildStrings);
+        return context.createArray(location, elisions);
+    }
+    
+    TreeExpression elem;
+    if (UNLIKELY(match(DOTDOTDOT))) {
+        auto spreadLocation = m_token.m_location;
+        auto start = m_token.m_startPosition;
+        auto divot = m_token.m_endPosition;
+        next();
+        auto spreadExpr = parseAssignmentExpressionOrPropagateErrorClass(context);
+        failIfFalse(spreadExpr, "Cannot parse subject of a spread operation");
+        elem = context.createSpreadExpression(spreadLocation, spreadExpr, start, divot, m_lastTokenEndPosition);
+    } else
+        elem = parseAssignmentExpressionOrPropagateErrorClass(context);
+    failIfFalse(elem, "Cannot parse array literal element");
+    typename TreeBuilder::ElementList elementList = context.createElementList(elisions, elem);
+    typename TreeBuilder::ElementList tail = elementList;
+    elisions = 0;
+    while (match(COMMA)) {
+        next(TreeBuilder::DontBuildStrings);
+        elisions = 0;
+        
+        while (match(COMMA)) {
+            next();
+            elisions++;
+        }
+        
+        if (match(CLOSEBRACKET)) {
+            JSTokenLocation location(tokenLocation());
+            next(TreeBuilder::DontBuildStrings);
+            return context.createArray(location, elisions, elementList);
+        }
+        if (UNLIKELY(match(DOTDOTDOT))) {
+            auto spreadLocation = m_token.m_location;
+            auto start = m_token.m_startPosition;
+            auto divot = m_token.m_endPosition;
+            next();
+            TreeExpression elem = parseAssignmentExpressionOrPropagateErrorClass(context);
+            failIfFalse(elem, "Cannot parse subject of a spread operation");
+            auto spread = context.createSpreadExpression(spreadLocation, elem, start, divot, m_lastTokenEndPosition);
+            tail = context.createElementList(tail, elisions, spread);
+            continue;
+        }
+        TreeExpression elem = parseAssignmentExpressionOrPropagateErrorClass(context);
+        failIfFalse(elem, "Cannot parse array literal element");
+        tail = context.createElementList(tail, elisions, elem);
+    }
+
+    JSTokenLocation location(tokenLocation());
+    if (!consume(CLOSEBRACKET)) {
+        failIfFalse(match(DOTDOTDOT), "Expected either a closing ']' or a ',' following an array element");
+        semanticFail("The '...' operator should come before a target expression");
+    }
+    
+    m_parserState.nonLHSCount = oldNonLHSCount;
+    
+    return context.createArray(location, elementList);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeClassExpression Parser<LexerType>::parseClassExpression(TreeBuilder& context)
+{
+    ASSERT(match(CLASSTOKEN));
+    ParserClassInfo<TreeBuilder> info;
+    info.className = &m_vm->propertyNames->nullIdentifier;
+    return parseClass(context, FunctionNameRequirements::None, info);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseFunctionExpression(TreeBuilder& context)
+{
+    ASSERT(match(FUNCTION));
+    JSTokenLocation location(tokenLocation());
+    unsigned functionKeywordStart = tokenStart();
+    next();
+    ParserFunctionInfo<TreeBuilder> functionInfo;
+    functionInfo.name = &m_vm->propertyNames->nullIdentifier;
+    SourceParseMode parseMode = SourceParseMode::NormalFunctionMode;
+    if (consume(TIMES))
+        parseMode = SourceParseMode::GeneratorWrapperFunctionMode;
+    failIfFalse((parseFunctionInfo(context, FunctionNameRequirements::None, parseMode, false, ConstructorKind::None, SuperBinding::NotNeeded, functionKeywordStart, functionInfo, FunctionDefinitionType::Expression)), "Cannot parse function expression");
+    return context.createFunctionExpr(location, functionInfo);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseAsyncFunctionExpression(TreeBuilder& context)
+{
+    ASSERT(match(FUNCTION));
+    JSTokenLocation location(tokenLocation());
+    unsigned functionKeywordStart = tokenStart();
+    next();
+    ParserFunctionInfo<TreeBuilder> functionInfo;
+    functionInfo.name = &m_vm->propertyNames->nullIdentifier;
+    SourceParseMode parseMode = SourceParseMode::AsyncFunctionMode;
+    failIfFalse(parseFunctionInfo(context, FunctionNameRequirements::None, parseMode, false, ConstructorKind::None, SuperBinding::NotNeeded, functionKeywordStart, functionInfo, FunctionDefinitionType::Expression), "Cannot parse async function expression");
+    return context.createFunctionExpr(location, functionInfo);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> typename TreeBuilder::TemplateString Parser<LexerType>::parseTemplateString(TreeBuilder& context, bool isTemplateHead, typename LexerType::RawStringsBuildMode rawStringsBuildMode, bool& elementIsTail)
+{
+    if (!isTemplateHead) {
+        matchOrFail(CLOSEBRACE, "Expected a closing '}' following an expression in template literal");
+        // Re-scan the token to recognize it as Template Element.
+        m_token.m_type = m_lexer->scanTrailingTemplateString(&m_token, rawStringsBuildMode);
+    }
+    matchOrFail(TEMPLATE, "Expected an template element");
+    const Identifier* cooked = m_token.m_data.cooked;
+    const Identifier* raw = m_token.m_data.raw;
+    elementIsTail = m_token.m_data.isTail;
+    JSTokenLocation location(tokenLocation());
+    next();
+    return context.createTemplateString(location, *cooked, *raw);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> typename TreeBuilder::TemplateLiteral Parser<LexerType>::parseTemplateLiteral(TreeBuilder& context, typename LexerType::RawStringsBuildMode rawStringsBuildMode)
+{
+    JSTokenLocation location(tokenLocation());
+    bool elementIsTail = false;
+
+    auto headTemplateString = parseTemplateString(context, true, rawStringsBuildMode, elementIsTail);
+    failIfFalse(headTemplateString, "Cannot parse head template element");
+
+    typename TreeBuilder::TemplateStringList templateStringList = context.createTemplateStringList(headTemplateString);
+    typename TreeBuilder::TemplateStringList templateStringTail = templateStringList;
+
+    if (elementIsTail)
+        return context.createTemplateLiteral(location, templateStringList);
+
+    failIfTrue(match(CLOSEBRACE), "Template literal expression cannot be empty");
+    TreeExpression expression = parseExpression(context);
+    failIfFalse(expression, "Cannot parse expression in template literal");
+
+    typename TreeBuilder::TemplateExpressionList templateExpressionList = context.createTemplateExpressionList(expression);
+    typename TreeBuilder::TemplateExpressionList templateExpressionTail = templateExpressionList;
+
+    auto templateString = parseTemplateString(context, false, rawStringsBuildMode, elementIsTail);
+    failIfFalse(templateString, "Cannot parse template element");
+    templateStringTail = context.createTemplateStringList(templateStringTail, templateString);
+
+    while (!elementIsTail) {
+        failIfTrue(match(CLOSEBRACE), "Template literal expression cannot be empty");
+        TreeExpression expression = parseExpression(context);
+        failIfFalse(expression, "Cannot parse expression in template literal");
+
+        templateExpressionTail = context.createTemplateExpressionList(templateExpressionTail, expression);
+
+        auto templateString = parseTemplateString(context, false, rawStringsBuildMode, elementIsTail);
+        failIfFalse(templateString, "Cannot parse template element");
+        templateStringTail = context.createTemplateStringList(templateStringTail, templateString);
+    }
+
+    return context.createTemplateLiteral(location, templateStringList, templateExpressionList);
+}
+
+template <class LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::createResolveAndUseVariable(TreeBuilder& context, const Identifier* ident, bool isEval, const JSTextPosition& start, const JSTokenLocation& location)
+{
+    currentScope()->useVariable(ident, isEval);
+    m_parserState.lastIdentifier = ident;
+    return context.createResolve(location, *ident, start, lastTokenEndPosition());
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parsePrimaryExpression(TreeBuilder& context)
+{
+    failIfStackOverflow();
+    switch (m_token.m_type) {
+    case FUNCTION:
+        return parseFunctionExpression(context);
+    case CLASSTOKEN:
+        return parseClassExpression(context);
+    case OPENBRACE:
+        if (strictMode())
+            return parseStrictObjectLiteral(context);
+        return parseObjectLiteral(context);
+    case OPENBRACKET:
+        return parseArrayLiteral(context);
+    case OPENPAREN: {
+        next();
+        int oldNonLHSCount = m_parserState.nonLHSCount;
+        TreeExpression result = parseExpression(context);
+        m_parserState.nonLHSCount = oldNonLHSCount;
+        handleProductionOrFail(CLOSEPAREN, ")", "end", "compound expression");
+        return result;
+    }
+    case THISTOKEN: {
+        JSTokenLocation location(tokenLocation());
+        next();
+        if (currentScope()->isArrowFunction())
+            currentScope()->setInnerArrowFunctionUsesThis();
+        return context.createThisExpr(location);
+    }
+    case AWAIT:
+        if (m_parserState.functionParsePhase == FunctionParsePhase::Parameters)
+            failIfFalse(m_parserState.allowAwait, "Cannot use await expression within parameters");
+        goto identifierExpression;
+    case ASYNC: {
+        JSTextPosition start = tokenStartPosition();
+        const Identifier* ident = m_token.m_data.ident;
+        JSTokenLocation location(tokenLocation());
+        next();
+        if (match(FUNCTION) && !m_lexer->prevTerminator())
+            return parseAsyncFunctionExpression(context);
+
+        // Avoid using variable if it is an arrow function parameter
+        if (UNLIKELY(match(ARROWFUNCTION)))
+            return 0;
+
+        const bool isEval = false;
+        return createResolveAndUseVariable(context, ident, isEval, start, location);
+    }
+    case IDENT: {
+    identifierExpression:
+        JSTextPosition start = tokenStartPosition();
+        const Identifier* ident = m_token.m_data.ident;
+        JSTokenLocation location(tokenLocation());
+        next();
+
+        // Avoid using variable if it is an arrow function parameter
+        if (UNLIKELY(match(ARROWFUNCTION)))
+            return 0;
+
+        return createResolveAndUseVariable(context, ident, *ident == m_vm->propertyNames->eval, start, location);
+    }
+    case STRING: {
+        const Identifier* ident = m_token.m_data.ident;
+        JSTokenLocation location(tokenLocation());
+        next();
+        return context.createString(location, ident);
+    }
+    case DOUBLE: {
+        double d = m_token.m_data.doubleValue;
+        JSTokenLocation location(tokenLocation());
+        next();
+        return context.createDoubleExpr(location, d);
+    }
+    case INTEGER: {
+        double d = m_token.m_data.doubleValue;
+        JSTokenLocation location(tokenLocation());
+        next();
+        return context.createIntegerExpr(location, d);
+    }
+    case NULLTOKEN: {
+        JSTokenLocation location(tokenLocation());
+        next();
+        return context.createNull(location);
+    }
+    case TRUETOKEN: {
+        JSTokenLocation location(tokenLocation());
+        next();
+        return context.createBoolean(location, true);
+    }
+    case FALSETOKEN: {
+        JSTokenLocation location(tokenLocation());
+        next();
+        return context.createBoolean(location, false);
+    }
+    case DIVEQUAL:
+    case DIVIDE: {
+        /* regexp */
+        if (match(DIVEQUAL))
+            m_token.m_type = m_lexer->scanRegExp(&m_token, '=');
+        else
+            m_token.m_type = m_lexer->scanRegExp(&m_token);
+        matchOrFail(REGEXP, "Invalid regular expression");
+
+        const Identifier* pattern = m_token.m_data.pattern;
+        const Identifier* flags = m_token.m_data.flags;
+        JSTextPosition start = tokenStartPosition();
+        JSTokenLocation location(tokenLocation());
+        next();
+        TreeExpression re = context.createRegExp(location, *pattern, *flags, start);
+        if (!re) {
+            const char* yarrErrorMsg = Yarr::checkSyntax(pattern->string(), flags->string());
+            regexFail(yarrErrorMsg);
+        }
+        return re;
+    }
+    case TEMPLATE:
+        return parseTemplateLiteral(context, LexerType::RawStringsBuildMode::DontBuildRawStrings);
+    case YIELD:
+        if (!strictMode() && !currentScope()->isGenerator())
+            goto identifierExpression;
+        failDueToUnexpectedToken();
+    case LET:
+        if (!strictMode())
+            goto identifierExpression;
+        FALLTHROUGH;
+    default:
+        failDueToUnexpectedToken();
+    }
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeArguments Parser<LexerType>::parseArguments(TreeBuilder& context)
+{
+    consumeOrFailWithFlags(OPENPAREN, TreeBuilder::DontBuildStrings, "Expected opening '(' at start of argument list");
+    JSTokenLocation location(tokenLocation());
+    if (match(CLOSEPAREN)) {
+        next(TreeBuilder::DontBuildStrings);
+        return context.createArguments();
+    }
+    auto argumentsStart = m_token.m_startPosition;
+    auto argumentsDivot = m_token.m_endPosition;
+
+    ArgumentType argType = ArgumentType::Normal;
+    TreeExpression firstArg = parseArgument(context, argType);
+    failIfFalse(firstArg, "Cannot parse function argument");
+    semanticFailIfTrue(match(DOTDOTDOT), "The '...' operator should come before the target expression");
+
+    bool hasSpread = false;
+    if (argType == ArgumentType::Spread)
+        hasSpread = true;
+    TreeArgumentsList argList = context.createArgumentsList(location, firstArg);
+    TreeArgumentsList tail = argList;
+
+    while (match(COMMA)) {
+        JSTokenLocation argumentLocation(tokenLocation());
+        next(TreeBuilder::DontBuildStrings);
+
+        if (UNLIKELY(match(CLOSEPAREN)))
+            break;
+        
+        TreeExpression arg = parseArgument(context, argType);
+        propagateError();
+        semanticFailIfTrue(match(DOTDOTDOT), "The '...' operator should come before the target expression");
+
+        if (argType == ArgumentType::Spread)
+            hasSpread = true;
+
+        tail = context.createArgumentsList(argumentLocation, tail, arg);
+    }
+
+    handleProductionOrFail2(CLOSEPAREN, ")", "end", "argument list");
+    if (hasSpread) {
+        TreeExpression spreadArray = context.createSpreadExpression(location, context.createArray(location, context.createElementList(argList)), argumentsStart, argumentsDivot, m_lastTokenEndPosition);
+        return context.createArguments(context.createArgumentsList(location, spreadArray));
+    }
+
+    return context.createArguments(argList);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseArgument(TreeBuilder& context, ArgumentType& type)
+{
+    if (UNLIKELY(match(DOTDOTDOT))) {
+        JSTokenLocation spreadLocation(tokenLocation());
+        auto start = m_token.m_startPosition;
+        auto divot = m_token.m_endPosition;
+        next();
+        TreeExpression spreadExpr = parseAssignmentExpression(context);
+        propagateError();
+        auto end = m_lastTokenEndPosition;
+        type = ArgumentType::Spread;
+        return context.createSpreadExpression(spreadLocation, spreadExpr, start, divot, end);
+    }
+
+    type = ArgumentType::Normal;
+    return parseAssignmentExpression(context);
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpression(TreeBuilder& context)
+{
+    TreeExpression base = 0;
+    JSTextPosition expressionStart = tokenStartPosition();
+    int newCount = 0;
+    JSTokenLocation startLocation = tokenLocation();
+    JSTokenLocation location;
+    while (match(NEW)) {
+        next();
+        newCount++;
+    }
+
+    bool baseIsSuper = match(SUPER);
+    semanticFailIfTrue(baseIsSuper && newCount, "Cannot use new with super");
+
+    bool baseIsNewTarget = false;
+    if (newCount && match(DOT)) {
+        next();
+        if (match(IDENT)) {
+            const Identifier* ident = m_token.m_data.ident;
+            if (m_vm->propertyNames->target == *ident) {
+                semanticFailIfFalse(currentScope()->isFunction() || closestParentOrdinaryFunctionNonLexicalScope()->evalContextType() == EvalContextType::FunctionEvalContext, "new.target is only valid inside functions");
+                baseIsNewTarget = true;
+                if (currentScope()->isArrowFunction())
+                    currentScope()->setInnerArrowFunctionUsesNewTarget();
+                base = context.createNewTargetExpr(location);
+                newCount--;
+                next();
+            } else
+                failWithMessage("\"new.\" can only followed with target");
+        } else
+            failDueToUnexpectedToken();
+    }
+
+    bool baseIsAsyncKeyword = false;
+
+    if (baseIsSuper) {
+        ScopeRef closestOrdinaryFunctionScope = closestParentOrdinaryFunctionNonLexicalScope();
+        semanticFailIfFalse(currentScope()->isFunction() || (closestOrdinaryFunctionScope->isEvalContext() && closestOrdinaryFunctionScope->expectedSuperBinding() == SuperBinding::Needed), "super is not valid in this context");
+        base = context.createSuperExpr(location);
+        next();
+        ScopeRef functionScope = currentFunctionScope();
+        if (!functionScope->setNeedsSuperBinding()) {
+            // It unnecessary to check of using super during reparsing one more time. Also it can lead to syntax error
+            // in case of arrow function because during reparsing we don't know whether we currently parse the arrow function
+            // inside of the constructor or method.
+            if (!m_lexer->isReparsingFunction()) {
+                SuperBinding functionSuperBinding = !functionScope->isArrowFunction() && !closestOrdinaryFunctionScope->isEvalContext()
+                    ? functionScope->expectedSuperBinding()
+                    : closestOrdinaryFunctionScope->expectedSuperBinding();
+                semanticFailIfTrue(functionSuperBinding == SuperBinding::NotNeeded, "super is not valid in this context");
+            }
+        }
+    } else if (!baseIsNewTarget) {
+        const bool isAsync = match(ASYNC);
+
+        base = parsePrimaryExpression(context);
+        failIfFalse(base, "Cannot parse base expression");
+        if (UNLIKELY(isAsync && context.isResolve(base) && !m_lexer->prevTerminator())) {
+            if (matchSpecIdentifier()) {
+                // AsyncArrowFunction
+                forceClassifyExpressionError(ErrorIndicatesAsyncArrowFunction);
+                failDueToUnexpectedToken();
+            }
+            baseIsAsyncKeyword = true;
+        }
+    }
+
+    failIfFalse(base, "Cannot parse base expression");
+    while (true) {
+        location = tokenLocation();
+        switch (m_token.m_type) {
+        case OPENBRACKET: {
+            m_parserState.nonTrivialExpressionCount++;
+            JSTextPosition expressionEnd = lastTokenEndPosition();
+            next();
+            int nonLHSCount = m_parserState.nonLHSCount;
+            int initialAssignments = m_parserState.assignmentCount;
+            TreeExpression property = parseExpression(context);
+            failIfFalse(property, "Cannot parse subscript expression");
+            base = context.createBracketAccess(startLocation, base, property, initialAssignments != m_parserState.assignmentCount, expressionStart, expressionEnd, tokenEndPosition());
+            
+            if (UNLIKELY(baseIsSuper && currentScope()->isArrowFunction()))
+                currentFunctionScope()->setInnerArrowFunctionUsesSuperProperty();
+            
+            handleProductionOrFail(CLOSEBRACKET, "]", "end", "subscript expression");
+            m_parserState.nonLHSCount = nonLHSCount;
+            break;
+        }
+        case OPENPAREN: {
+            m_parserState.nonTrivialExpressionCount++;
+            int nonLHSCount = m_parserState.nonLHSCount;
+            if (newCount) {
+                newCount--;
+                JSTextPosition expressionEnd = lastTokenEndPosition();
+                TreeArguments arguments = parseArguments(context);
+                failIfFalse(arguments, "Cannot parse call arguments");
+                base = context.createNewExpr(location, base, arguments, expressionStart, expressionEnd, lastTokenEndPosition());
+            } else {
+                size_t usedVariablesSize = currentScope()->currentUsedVariablesSize();
+                JSTextPosition expressionEnd = lastTokenEndPosition();
+                TreeArguments arguments = parseArguments(context);
+
+                if (baseIsAsyncKeyword && (!arguments || match(ARROWFUNCTION))) {
+                    currentScope()->revertToPreviousUsedVariables(usedVariablesSize);
+                    forceClassifyExpressionError(ErrorIndicatesAsyncArrowFunction);
+                    failDueToUnexpectedToken();
+                }
+
+                failIfFalse(arguments, "Cannot parse call arguments");
+                if (baseIsSuper) {
+                    ScopeRef functionScope = currentFunctionScope();
+                    if (!functionScope->setHasDirectSuper()) {
+                        // It unnecessary to check of using super during reparsing one more time. Also it can lead to syntax error
+                        // in case of arrow function because during reparsing we don't know whether we currently parse the arrow function
+                        // inside of the constructor or method.
+                        if (!m_lexer->isReparsingFunction()) {
+                            ScopeRef closestOrdinaryFunctionScope = closestParentOrdinaryFunctionNonLexicalScope();
+                            ConstructorKind functionConstructorKind = !functionScope->isArrowFunction() && !closestOrdinaryFunctionScope->isEvalContext()
+                                ? functionScope->constructorKind()
+                                : closestOrdinaryFunctionScope->constructorKind();
+                            semanticFailIfTrue(functionConstructorKind == ConstructorKind::None, "super is not valid in this context");
+                            semanticFailIfTrue(functionConstructorKind != ConstructorKind::Extends, "super is not valid in this context");
+                        }
+                    }
+                    if (currentScope()->isArrowFunction())
+                        functionScope->setInnerArrowFunctionUsesSuperCall();
+                }
+                base = context.makeFunctionCallNode(startLocation, base, arguments, expressionStart, expressionEnd, lastTokenEndPosition());
+            }
+            m_parserState.nonLHSCount = nonLHSCount;
+            break;
+        }
+        case DOT: {
+            m_parserState.nonTrivialExpressionCount++;
+            JSTextPosition expressionEnd = lastTokenEndPosition();
+            nextExpectIdentifier(LexerFlagsIgnoreReservedWords | TreeBuilder::DontBuildKeywords);
+            matchOrFail(IDENT, "Expected a property name after '.'");
+            base = context.createDotAccess(startLocation, base, m_token.m_data.ident, expressionStart, expressionEnd, tokenEndPosition());
+            if (UNLIKELY(baseIsSuper && currentScope()->isArrowFunction()))
+                currentFunctionScope()->setInnerArrowFunctionUsesSuperProperty();
+            next();
+            break;
+        }
+        case TEMPLATE: {
+            semanticFailIfTrue(baseIsSuper, "Cannot use super as tag for tagged templates");
+            JSTextPosition expressionEnd = lastTokenEndPosition();
+            int nonLHSCount = m_parserState.nonLHSCount;
+            typename TreeBuilder::TemplateLiteral templateLiteral = parseTemplateLiteral(context, LexerType::RawStringsBuildMode::BuildRawStrings);
+            failIfFalse(templateLiteral, "Cannot parse template literal");
+            base = context.createTaggedTemplate(startLocation, base, templateLiteral, expressionStart, expressionEnd, lastTokenEndPosition());
+            m_parserState.nonLHSCount = nonLHSCount;
+            break;
+        }
+        default:
+            goto endMemberExpression;
+        }
+        baseIsSuper = false;
+    }
+endMemberExpression:
+    semanticFailIfTrue(baseIsSuper, "super is not valid in this context");
+    while (newCount--)
+        base = context.createNewExpr(location, base, expressionStart, lastTokenEndPosition());
+    return base;
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseArrowFunctionExpression(TreeBuilder& context, bool isAsync)
+{
+    JSTokenLocation location;
+
+    unsigned functionKeywordStart = tokenStart();
+    location = tokenLocation();
+    ParserFunctionInfo<TreeBuilder> info;
+    info.name = &m_vm->propertyNames->nullIdentifier;
+
+    SourceParseMode parseMode = isAsync ? SourceParseMode::AsyncArrowFunctionMode : SourceParseMode::ArrowFunctionMode;
+    failIfFalse((parseFunctionInfo(context, FunctionNameRequirements::Unnamed, parseMode, true, ConstructorKind::None, SuperBinding::NotNeeded, functionKeywordStart, info, FunctionDefinitionType::Expression)), "Cannot parse arrow function expression");
+
+    return context.createArrowFunctionExpr(location, info);
+}
+
+static const char* operatorString(bool prefix, unsigned tok)
+{
+    switch (tok) {
+    case MINUSMINUS:
+    case AUTOMINUSMINUS:
+        return prefix ? "prefix-decrement" : "decrement";
+
+    case PLUSPLUS:
+    case AUTOPLUSPLUS:
+        return prefix ? "prefix-increment" : "increment";
+
+    case EXCLAMATION:
+        return "logical-not";
+
+    case TILDE:
+        return "bitwise-not";
+    
+    case TYPEOF:
+        return "typeof";
+    
+    case VOIDTOKEN:
+        return "void";
+    
+    case DELETETOKEN:
+        return "delete";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return "error";
+}
+
+template <typename LexerType>
+template <class TreeBuilder> TreeExpression Parser<LexerType>::parseUnaryExpression(TreeBuilder& context)
+{
+    typename TreeBuilder::UnaryExprContext unaryExprContext(context);
+    AllowInOverride allowInOverride(this);
+    int tokenStackDepth = 0;
+    bool modifiesExpr = false;
+    bool requiresLExpr = false;
+    unsigned lastOperator = 0;
+
+    if (UNLIKELY(match(AWAIT) && currentFunctionScope()->isAsyncFunctionBoundary()))
+        return parseAwaitExpression(context);
+
+    JSTokenLocation location(tokenLocation());
+
+    while (isUnaryOp(m_token.m_type)) {
+        if (strictMode()) {
+            switch (m_token.m_type) {
+            case PLUSPLUS:
+            case MINUSMINUS:
+            case AUTOPLUSPLUS:
+            case AUTOMINUSMINUS:
+                semanticFailIfTrue(requiresLExpr, "The ", operatorString(true, lastOperator), " operator requires a reference expression");
+                modifiesExpr = true;
+                requiresLExpr = true;
+                break;
+            case DELETETOKEN:
+                semanticFailIfTrue(requiresLExpr, "The ", operatorString(true, lastOperator), " operator requires a reference expression");
+                requiresLExpr = true;
+                break;
+            default:
+                semanticFailIfTrue(requiresLExpr, "The ", operatorString(true, lastOperator), " operator requires a reference expression");
+                break;
+            }
+        }
+        lastOperator = m_token.m_type;
+        m_parserState.nonLHSCount++;
+        context.appendUnaryToken(tokenStackDepth, m_token.m_type, tokenStartPosition());
+        next();
+        m_parserState.nonTrivialExpressionCount++;
+    }
+    JSTextPosition subExprStart = tokenStartPosition();
+    ASSERT(subExprStart.offset >= subExprStart.lineStartOffset);
+    TreeExpression expr = parseMemberExpression(context);
+    if (!expr) {
+        if (lastOperator)
+            failWithMessage("Cannot parse subexpression of ", operatorString(true, lastOperator), "operator");
+        failWithMessage("Cannot parse member expression");
+    }
+    if (UNLIKELY(lastOperator && context.isNewTarget(expr)))
+        internalFailWithMessage(false, "new.target can't come after a prefix operator");
+    bool isEvalOrArguments = false;
+    if (strictMode() && !m_syntaxAlreadyValidated) {
+        if (context.isResolve(expr))
+            isEvalOrArguments = *m_parserState.lastIdentifier == m_vm->propertyNames->eval || *m_parserState.lastIdentifier == m_vm->propertyNames->arguments;
+    }
+    failIfTrueIfStrict(isEvalOrArguments && modifiesExpr, "Cannot modify '", m_parserState.lastIdentifier->impl(), "' in strict mode");
+    switch (m_token.m_type) {
+    case PLUSPLUS:
+        if (UNLIKELY(context.isNewTarget(expr)))
+            internalFailWithMessage(false, "new.target can't come before a postfix operator");
+        m_parserState.nonTrivialExpressionCount++;
+        m_parserState.nonLHSCount++;
+        expr = context.makePostfixNode(location, expr, OpPlusPlus, subExprStart, lastTokenEndPosition(), tokenEndPosition());
+        m_parserState.assignmentCount++;
+        failIfTrueIfStrict(isEvalOrArguments, "Cannot modify '", m_parserState.lastIdentifier->impl(), "' in strict mode");
+        semanticFailIfTrue(requiresLExpr, "The ", operatorString(false, lastOperator), " operator requires a reference expression");
+        lastOperator = PLUSPLUS;
+        next();
+        break;
+    case MINUSMINUS:
+        if (UNLIKELY(context.isNewTarget(expr)))
+            internalFailWithMessage(false, "new.target can't come before a postfix operator");
+        m_parserState.nonTrivialExpressionCount++;
+        m_parserState.nonLHSCount++;
+        expr = context.makePostfixNode(location, expr, OpMinusMinus, subExprStart, lastTokenEndPosition(), tokenEndPosition());
+        m_parserState.assignmentCount++;
+        failIfTrueIfStrict(isEvalOrArguments, "'", m_parserState.lastIdentifier->impl(), "' cannot be modified in strict mode");
+        semanticFailIfTrue(requiresLExpr, "The ", operatorString(false, lastOperator), " operator requires a reference expression");
+        lastOperator = PLUSPLUS;
+        next();
+        break;
+    default:
+        break;
+    }
+    
+    JSTextPosition end = lastTokenEndPosition();
+
+    if (!TreeBuilder::CreatesAST && (m_syntaxAlreadyValidated || !strictMode()))
+        return expr;
+
+    while (tokenStackDepth) {
+        switch (context.unaryTokenStackLastType(tokenStackDepth)) {
+        case EXCLAMATION:
+            expr = context.createLogicalNot(location, expr);
+            break;
+        case TILDE:
+            expr = context.makeBitwiseNotNode(location, expr);
+            break;
+        case MINUS:
+            expr = context.makeNegateNode(location, expr);
+            break;
+        case PLUS:
+            expr = context.createUnaryPlus(location, expr);
+            break;
+        case PLUSPLUS:
+        case AUTOPLUSPLUS:
+            expr = context.makePrefixNode(location, expr, OpPlusPlus, context.unaryTokenStackLastStart(tokenStackDepth), subExprStart + 1, end);
+            m_parserState.assignmentCount++;
+            break;
+        case MINUSMINUS:
+        case AUTOMINUSMINUS:
+            expr = context.makePrefixNode(location, expr, OpMinusMinus, context.unaryTokenStackLastStart(tokenStackDepth), subExprStart + 1, end);
+            m_parserState.assignmentCount++;
+            break;
+        case TYPEOF:
+            expr = context.makeTypeOfNode(location, expr);
+            break;
+        case VOIDTOKEN:
+            expr = context.createVoid(location, expr);
+            break;
+        case DELETETOKEN:
+            failIfTrueIfStrict(context.isResolve(expr), "Cannot delete unqualified property '", m_parserState.lastIdentifier->impl(), "' in strict mode");
+            expr = context.makeDeleteNode(location, expr, context.unaryTokenStackLastStart(tokenStackDepth), end, end);
+            break;
+        default:
+            // If we get here something has gone horribly horribly wrong
+            CRASH();
+        }
+        subExprStart = context.unaryTokenStackLastStart(tokenStackDepth);
+        context.unaryTokenStackRemoveLast(tokenStackDepth);
+    }
+    return expr;
+}
+
+template <typename LexerType> void Parser<LexerType>::printUnexpectedTokenText(WTF::PrintStream& out)
+{
+    switch (m_token.m_type) {
+    case EOFTOK:
+        out.print("Unexpected end of script");
+        return;
+    case UNTERMINATED_IDENTIFIER_ESCAPE_ERRORTOK:
+    case UNTERMINATED_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK:
+        out.print("Incomplete unicode escape in identifier: '", getToken(), "'");
+        return;
+    case UNTERMINATED_MULTILINE_COMMENT_ERRORTOK:
+        out.print("Unterminated multiline comment");
+        return;
+    case UNTERMINATED_NUMERIC_LITERAL_ERRORTOK:
+        out.print("Unterminated numeric literal '", getToken(), "'");
+        return;
+    case UNTERMINATED_STRING_LITERAL_ERRORTOK:
+        out.print("Unterminated string literal '", getToken(), "'");
+        return;
+    case INVALID_IDENTIFIER_ESCAPE_ERRORTOK:
+        out.print("Invalid escape in identifier: '", getToken(), "'");
+        return;
+    case INVALID_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK:
+        out.print("Invalid unicode escape in identifier: '", getToken(), "'");
+        return;
+    case INVALID_NUMERIC_LITERAL_ERRORTOK:
+        out.print("Invalid numeric literal: '", getToken(), "'");
+        return;
+    case UNTERMINATED_OCTAL_NUMBER_ERRORTOK:
+        out.print("Invalid use of octal: '", getToken(), "'");
+        return;
+    case INVALID_STRING_LITERAL_ERRORTOK:
+        out.print("Invalid string literal: '", getToken(), "'");
+        return;
+    case ERRORTOK:
+        out.print("Unrecognized token '", getToken(), "'");
+        return;
+    case STRING:
+        out.print("Unexpected string literal ", getToken());
+        return;
+    case INTEGER:
+    case DOUBLE:
+        out.print("Unexpected number '", getToken(), "'");
+        return;
+    
+    case RESERVED_IF_STRICT:
+        out.print("Unexpected use of reserved word '", getToken(), "' in strict mode");
+        return;
+        
+    case RESERVED:
+        out.print("Unexpected use of reserved word '", getToken(), "'");
+        return;
+
+    case INVALID_PRIVATE_NAME_ERRORTOK:
+        out.print("Invalid private name '", getToken(), "'");
+        return;
+            
+    case ASYNC:
+    case AWAIT:
+    case IDENT:
+        out.print("Unexpected identifier '", getToken(), "'");
+        return;
+
+    default:
+        break;
+    }
+
+    if (m_token.m_type & KeywordTokenFlag) {
+        out.print("Unexpected keyword '", getToken(), "'");
+        return;
+    }
+    
+    out.print("Unexpected token '", getToken(), "'");
+}
+
+// Instantiate the two flavors of Parser we need instead of putting most of this file in Parser.h
+template class Parser<Lexer<LChar>>;
+template class Parser<Lexer<UChar>>;
+    
+} // namespace JSC
diff --git a/parser/Parser.h b/parser/Parser.h
new file mode 100644
index 0000000..97488b6
--- /dev/null
+++ b/parser/Parser.h
@@ -0,0 +1,1902 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010, 2011, 2013 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "ExecutableInfo.h"
+#include "ExceptionHelpers.h"
+#include "Lexer.h"
+#include "ModuleScopeData.h"
+#include "Nodes.h"
+#include "ParserArena.h"
+#include "ParserError.h"
+#include "ParserFunctionInfo.h"
+#include "ParserTokens.h"
+#include "SourceProvider.h"
+#include "SourceProviderCache.h"
+#include "SourceProviderCacheItem.h"
+#include "VariableEnvironment.h"
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+class FunctionMetadataNode;
+class FunctionParameters;
+class Identifier;
+class VM;
+class SourceCode;
+class SyntaxChecker;
+struct DebuggerParseData;
+
+// Macros to make the more common TreeBuilder types a little less verbose
+#define TreeStatement typename TreeBuilder::Statement
+#define TreeExpression typename TreeBuilder::Expression
+#define TreeFormalParameterList typename TreeBuilder::FormalParameterList
+#define TreeSourceElements typename TreeBuilder::SourceElements
+#define TreeClause typename TreeBuilder::Clause
+#define TreeClauseList typename TreeBuilder::ClauseList
+#define TreeArguments typename TreeBuilder::Arguments
+#define TreeArgumentsList typename TreeBuilder::ArgumentsList
+#define TreeFunctionBody typename TreeBuilder::FunctionBody
+#define TreeClassExpression typename TreeBuilder::ClassExpression
+#define TreeProperty typename TreeBuilder::Property
+#define TreePropertyList typename TreeBuilder::PropertyList
+#define TreeDestructuringPattern typename TreeBuilder::DestructuringPattern
+
+COMPILE_ASSERT(LastUntaggedToken < 64, LessThan64UntaggedTokens);
+
+enum SourceElementsMode { CheckForStrictMode, DontCheckForStrictMode };
+enum FunctionBodyType { ArrowFunctionBodyExpression, ArrowFunctionBodyBlock, StandardFunctionBodyBlock };
+enum class FunctionNameRequirements { None, Named, Unnamed };
+
+enum class DestructuringKind {
+    DestructureToVariables,
+    DestructureToLet,
+    DestructureToConst,
+    DestructureToCatchParameters,
+    DestructureToParameters,
+    DestructureToExpressions
+};
+
+enum class DeclarationType { 
+    VarDeclaration, 
+    LetDeclaration,
+    ConstDeclaration
+};
+
+enum class DeclarationImportType {
+    Imported,
+    ImportedNamespace,
+    NotImported
+};
+
+enum DeclarationResult {
+    Valid = 0,
+    InvalidStrictMode = 1 << 0,
+    InvalidDuplicateDeclaration = 1 << 1
+};
+
+typedef uint8_t DeclarationResultMask;
+
+enum class DeclarationDefaultContext {
+    Standard,
+    ExportDefault,
+};
+
+template <typename T> inline bool isEvalNode() { return false; }
+template <> inline bool isEvalNode<EvalNode>() { return true; }
+
+struct ScopeLabelInfo {
+    UniquedStringImpl* uid;
+    bool isLoop;
+};
+
+ALWAYS_INLINE static bool isArguments(const VM* vm, const Identifier* ident)
+{
+    return vm->propertyNames->arguments == *ident;
+}
+ALWAYS_INLINE static bool isEval(const VM* vm, const Identifier* ident)
+{
+    return vm->propertyNames->eval == *ident;
+}
+ALWAYS_INLINE static bool isEvalOrArgumentsIdentifier(const VM* vm, const Identifier* ident)
+{
+    return isEval(vm, ident) || isArguments(vm, ident);
+}
+ALWAYS_INLINE static bool isIdentifierOrKeyword(const JSToken& token)
+{
+    return token.m_type == IDENT || token.m_type & KeywordTokenFlag;
+}
+// _Any_ContextualKeyword includes keywords such as "let" or "yield", which have a specific meaning depending on the current parse mode
+// or strict mode. These helpers allow to treat all contextual keywords as identifiers as required.
+ALWAYS_INLINE static bool isAnyContextualKeyword(const JSToken& token)
+{
+    return token.m_type >= FirstContextualKeywordToken && token.m_type <= LastContextualKeywordToken;
+}
+ALWAYS_INLINE static bool isIdentifierOrAnyContextualKeyword(const JSToken& token)
+{
+    return token.m_type == IDENT || isAnyContextualKeyword(token);
+}
+// _Safe_ContextualKeyword includes only contextual keywords which can be treated as identifiers independently from parse mode. The exeption
+// to this rule is `await`, but matchSpecIdentifier() always treats it as an identifier regardless.
+ALWAYS_INLINE static bool isSafeContextualKeyword(const JSToken& token)
+{
+    return token.m_type >= FirstSafeContextualKeywordToken && token.m_type <= LastSafeContextualKeywordToken;
+}
+
+struct Scope {
+    WTF_MAKE_NONCOPYABLE(Scope);
+
+public:
+    Scope(const VM* vm, bool isFunction, bool isGenerator, bool strictMode, bool isArrowFunction, bool isAsyncFunction)
+        : m_vm(vm)
+        , m_shadowsArguments(false)
+        , m_usesEval(false)
+        , m_needsFullActivation(false)
+        , m_hasDirectSuper(false)
+        , m_needsSuperBinding(false)
+        , m_allowsVarDeclarations(true)
+        , m_allowsLexicalDeclarations(true)
+        , m_strictMode(strictMode)
+        , m_isFunction(isFunction)
+        , m_isGenerator(isGenerator)
+        , m_isGeneratorBoundary(false)
+        , m_isArrowFunction(isArrowFunction)
+        , m_isArrowFunctionBoundary(false)
+        , m_isAsyncFunction(isAsyncFunction)
+        , m_isAsyncFunctionBoundary(false)
+        , m_isLexicalScope(false)
+        , m_isFunctionBoundary(false)
+        , m_isValidStrictMode(true)
+        , m_hasArguments(false)
+        , m_isEvalContext(false)
+        , m_hasNonSimpleParameterList(false)
+        , m_evalContextType(EvalContextType::None)
+        , m_constructorKind(static_cast<unsigned>(ConstructorKind::None))
+        , m_expectedSuperBinding(static_cast<unsigned>(SuperBinding::NotNeeded))
+        , m_loopDepth(0)
+        , m_switchDepth(0)
+        , m_innerArrowFunctionFeatures(0)
+    {
+        m_usedVariables.append(UniquedStringImplPtrSet());
+    }
+
+    Scope(Scope&& other)
+        : m_vm(other.m_vm)
+        , m_shadowsArguments(other.m_shadowsArguments)
+        , m_usesEval(other.m_usesEval)
+        , m_needsFullActivation(other.m_needsFullActivation)
+        , m_hasDirectSuper(other.m_hasDirectSuper)
+        , m_needsSuperBinding(other.m_needsSuperBinding)
+        , m_allowsVarDeclarations(other.m_allowsVarDeclarations)
+        , m_allowsLexicalDeclarations(other.m_allowsLexicalDeclarations)
+        , m_strictMode(other.m_strictMode)
+        , m_isFunction(other.m_isFunction)
+        , m_isGenerator(other.m_isGenerator)
+        , m_isGeneratorBoundary(other.m_isGeneratorBoundary)
+        , m_isArrowFunction(other.m_isArrowFunction)
+        , m_isArrowFunctionBoundary(other.m_isArrowFunctionBoundary)
+        , m_isAsyncFunction(other.m_isAsyncFunction)
+        , m_isAsyncFunctionBoundary(other.m_isAsyncFunctionBoundary)
+        , m_isLexicalScope(other.m_isLexicalScope)
+        , m_isFunctionBoundary(other.m_isFunctionBoundary)
+        , m_isValidStrictMode(other.m_isValidStrictMode)
+        , m_hasArguments(other.m_hasArguments)
+        , m_isEvalContext(other.m_isEvalContext)
+        , m_hasNonSimpleParameterList(other.m_hasNonSimpleParameterList)
+        , m_constructorKind(other.m_constructorKind)
+        , m_expectedSuperBinding(other.m_expectedSuperBinding)
+        , m_loopDepth(other.m_loopDepth)
+        , m_switchDepth(other.m_switchDepth)
+        , m_innerArrowFunctionFeatures(other.m_innerArrowFunctionFeatures)
+        , m_labels(WTFMove(other.m_labels))
+        , m_declaredParameters(WTFMove(other.m_declaredParameters))
+        , m_declaredVariables(WTFMove(other.m_declaredVariables))
+        , m_lexicalVariables(WTFMove(other.m_lexicalVariables))
+        , m_usedVariables(WTFMove(other.m_usedVariables))
+        , m_closedVariableCandidates(WTFMove(other.m_closedVariableCandidates))
+        , m_functionDeclarations(WTFMove(other.m_functionDeclarations))
+    {
+    }
+
+    void startSwitch() { m_switchDepth++; }
+    void endSwitch() { m_switchDepth--; }
+    void startLoop() { m_loopDepth++; }
+    void endLoop() { ASSERT(m_loopDepth); m_loopDepth--; }
+    bool inLoop() { return !!m_loopDepth; }
+    bool breakIsValid() { return m_loopDepth || m_switchDepth; }
+    bool continueIsValid() { return m_loopDepth; }
+
+    void pushLabel(const Identifier* label, bool isLoop)
+    {
+        if (!m_labels)
+            m_labels = std::make_unique<LabelStack>();
+        m_labels->append(ScopeLabelInfo { label->impl(), isLoop });
+    }
+
+    void popLabel()
+    {
+        ASSERT(m_labels);
+        ASSERT(m_labels->size());
+        m_labels->removeLast();
+    }
+
+    ScopeLabelInfo* getLabel(const Identifier* label)
+    {
+        if (!m_labels)
+            return 0;
+        for (int i = m_labels->size(); i > 0; i--) {
+            if (m_labels->at(i - 1).uid == label->impl())
+                return &m_labels->at(i - 1);
+        }
+        return 0;
+    }
+
+    void setSourceParseMode(SourceParseMode mode)
+    {
+        switch (mode) {
+        case SourceParseMode::AsyncArrowFunctionBodyMode:
+            setIsAsyncArrowFunctionBody();
+            break;
+
+        case SourceParseMode::AsyncFunctionBodyMode:
+            setIsAsyncFunctionBody();
+            break;
+
+        case SourceParseMode::GeneratorBodyMode:
+            setIsGenerator();
+            break;
+
+        case SourceParseMode::GeneratorWrapperFunctionMode:
+            setIsGeneratorFunction();
+            break;
+
+        case SourceParseMode::NormalFunctionMode:
+        case SourceParseMode::GetterMode:
+        case SourceParseMode::SetterMode:
+        case SourceParseMode::MethodMode:
+            setIsFunction();
+            break;
+
+        case SourceParseMode::ArrowFunctionMode:
+            setIsArrowFunction();
+            break;
+
+        case SourceParseMode::AsyncFunctionMode:
+        case SourceParseMode::AsyncMethodMode:
+            setIsAsyncFunction();
+            break;
+
+        case SourceParseMode::AsyncArrowFunctionMode:
+            setIsAsyncArrowFunction();
+            break;
+
+        case SourceParseMode::ProgramMode:
+        case SourceParseMode::ModuleAnalyzeMode:
+        case SourceParseMode::ModuleEvaluateMode:
+            break;
+        }
+    }
+
+    bool isFunction() const { return m_isFunction; }
+    bool isFunctionBoundary() const { return m_isFunctionBoundary; }
+    bool isGenerator() const { return m_isGenerator; }
+    bool isGeneratorBoundary() const { return m_isGeneratorBoundary; }
+    bool isAsyncFunction() const { return m_isAsyncFunction; }
+    bool isAsyncFunctionBoundary() const { return m_isAsyncFunctionBoundary; }
+
+    bool hasArguments() const { return m_hasArguments; }
+
+    void setIsLexicalScope() 
+    { 
+        m_isLexicalScope = true;
+        m_allowsLexicalDeclarations = true;
+    }
+    bool isLexicalScope() { return m_isLexicalScope; }
+
+    const HashSet<UniquedStringImpl*>& closedVariableCandidates() const { return m_closedVariableCandidates; }
+    VariableEnvironment& declaredVariables() { return m_declaredVariables; }
+    VariableEnvironment& lexicalVariables() { return m_lexicalVariables; }
+    VariableEnvironment& finalizeLexicalEnvironment() 
+    { 
+        if (m_usesEval || m_needsFullActivation)
+            m_lexicalVariables.markAllVariablesAsCaptured();
+        else
+            computeLexicallyCapturedVariablesAndPurgeCandidates();
+
+        return m_lexicalVariables;
+    }
+
+    void computeLexicallyCapturedVariablesAndPurgeCandidates()
+    {
+        // Because variables may be defined at any time in the range of a lexical scope, we must
+        // track lexical variables that might be captured. Then, when we're preparing to pop the top
+        // lexical scope off the stack, we should find which variables are truly captured, and which
+        // variable still may be captured in a parent scope.
+        if (m_lexicalVariables.size() && m_closedVariableCandidates.size()) {
+            for (UniquedStringImpl* impl : m_closedVariableCandidates)
+                m_lexicalVariables.markVariableAsCapturedIfDefined(impl);
+        }
+
+        // We can now purge values from the captured candidates because they're captured in this scope.
+        {
+            for (auto entry : m_lexicalVariables) {
+                if (entry.value.isCaptured())
+                    m_closedVariableCandidates.remove(entry.key.get());
+            }
+        }
+    }
+
+    DeclarationResultMask declareCallee(const Identifier* ident)
+    {
+        auto addResult = m_declaredVariables.add(ident->impl());
+        // We want to track if callee is captured, but we don't want to act like it's a 'var'
+        // because that would cause the BytecodeGenerator to emit bad code.
+        addResult.iterator->value.clearIsVar();
+
+        DeclarationResultMask result = DeclarationResult::Valid;
+        if (isEvalOrArgumentsIdentifier(m_vm, ident))
+            result |= DeclarationResult::InvalidStrictMode;
+        return result;
+    }
+
+    DeclarationResultMask declareVariable(const Identifier* ident)
+    {
+        ASSERT(m_allowsVarDeclarations);
+        DeclarationResultMask result = DeclarationResult::Valid;
+        bool isValidStrictMode = !isEvalOrArgumentsIdentifier(m_vm, ident);
+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
+        auto addResult = m_declaredVariables.add(ident->impl());
+        addResult.iterator->value.setIsVar();
+        if (!isValidStrictMode)
+            result |= DeclarationResult::InvalidStrictMode;
+        if (m_lexicalVariables.contains(ident->impl()))
+            result |= DeclarationResult::InvalidDuplicateDeclaration;
+        return result;
+    }
+
+    DeclarationResultMask declareFunction(const Identifier* ident, bool declareAsVar, bool isSloppyModeHoistingCandidate)
+    {
+        ASSERT(m_allowsVarDeclarations || m_allowsLexicalDeclarations);
+        DeclarationResultMask result = DeclarationResult::Valid;
+        bool isValidStrictMode = !isEvalOrArgumentsIdentifier(m_vm, ident);
+        if (!isValidStrictMode)
+            result |= DeclarationResult::InvalidStrictMode;
+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
+        auto addResult = declareAsVar ? m_declaredVariables.add(ident->impl()) : m_lexicalVariables.add(ident->impl());
+        if (isSloppyModeHoistingCandidate)
+            addResult.iterator->value.setIsSloppyModeHoistingCandidate();
+        if (declareAsVar) {
+            addResult.iterator->value.setIsVar();
+            if (m_lexicalVariables.contains(ident->impl()))
+                result |= DeclarationResult::InvalidDuplicateDeclaration;
+        } else {
+            addResult.iterator->value.setIsLet();
+            ASSERT_WITH_MESSAGE(!m_declaredVariables.size(), "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. I.e, in strict mode and not at the top-level scope of a function or program.");
+            if (!addResult.isNewEntry) {
+                if (!isSloppyModeHoistingCandidate || !addResult.iterator->value.isFunction())
+                    result |= DeclarationResult::InvalidDuplicateDeclaration;
+            }
+        }
+
+        addResult.iterator->value.setIsFunction();
+
+        return result;
+    }
+
+    void addSloppyModeHoistableFunctionCandidate(const Identifier* ident)
+    {
+        ASSERT(m_allowsVarDeclarations);
+        m_sloppyModeHoistableFunctionCandidates.add(ident->impl());
+    }
+
+    void appendFunction(FunctionMetadataNode* node)
+    { 
+        ASSERT(node);
+        m_functionDeclarations.append(node);
+    }
+    DeclarationStacks::FunctionStack&& takeFunctionDeclarations() { return WTFMove(m_functionDeclarations); }
+    
+
+    DeclarationResultMask declareLexicalVariable(const Identifier* ident, bool isConstant, DeclarationImportType importType = DeclarationImportType::NotImported)
+    {
+        ASSERT(m_allowsLexicalDeclarations);
+        DeclarationResultMask result = DeclarationResult::Valid;
+        bool isValidStrictMode = !isEvalOrArgumentsIdentifier(m_vm, ident);
+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
+        auto addResult = m_lexicalVariables.add(ident->impl());
+        if (isConstant)
+            addResult.iterator->value.setIsConst();
+        else
+            addResult.iterator->value.setIsLet();
+
+        if (importType == DeclarationImportType::Imported)
+            addResult.iterator->value.setIsImported();
+        else if (importType == DeclarationImportType::ImportedNamespace) {
+            addResult.iterator->value.setIsImported();
+            addResult.iterator->value.setIsImportedNamespace();
+        }
+
+        if (!addResult.isNewEntry)
+            result |= DeclarationResult::InvalidDuplicateDeclaration;
+        if (!isValidStrictMode)
+            result |= DeclarationResult::InvalidStrictMode;
+
+        return result;
+    }
+
+    bool hasDeclaredVariable(const Identifier& ident)
+    {
+        return hasDeclaredVariable(ident.impl());
+    }
+
+    bool hasDeclaredVariable(const RefPtr<UniquedStringImpl>& ident)
+    {
+        auto iter = m_declaredVariables.find(ident.get());
+        if (iter == m_declaredVariables.end())
+            return false;
+        VariableEnvironmentEntry entry = iter->value;
+        return entry.isVar(); // The callee isn't a "var".
+    }
+
+    bool hasLexicallyDeclaredVariable(const RefPtr<UniquedStringImpl>& ident) const
+    {
+        return m_lexicalVariables.contains(ident.get());
+    }
+    
+    ALWAYS_INLINE bool hasDeclaredParameter(const Identifier& ident)
+    {
+        return hasDeclaredParameter(ident.impl());
+    }
+
+    bool hasDeclaredParameter(const RefPtr<UniquedStringImpl>& ident)
+    {
+        return m_declaredParameters.contains(ident.get()) || hasDeclaredVariable(ident);
+    }
+    
+    void preventAllVariableDeclarations()
+    {
+        m_allowsVarDeclarations = false; 
+        m_allowsLexicalDeclarations = false;
+    }
+    void preventVarDeclarations() { m_allowsVarDeclarations = false; }
+    bool allowsVarDeclarations() const { return m_allowsVarDeclarations; }
+    bool allowsLexicalDeclarations() const { return m_allowsLexicalDeclarations; }
+
+    DeclarationResultMask declareParameter(const Identifier* ident)
+    {
+        ASSERT(m_allowsVarDeclarations);
+        DeclarationResultMask result = DeclarationResult::Valid;
+        bool isArgumentsIdent = isArguments(m_vm, ident);
+        auto addResult = m_declaredVariables.add(ident->impl());
+        bool isValidStrictMode = (addResult.isNewEntry || !addResult.iterator->value.isParameter())
+            && m_vm->propertyNames->eval != *ident && !isArgumentsIdent;
+        addResult.iterator->value.clearIsVar();
+        addResult.iterator->value.setIsParameter();
+        m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
+        m_declaredParameters.add(ident->impl());
+        if (!isValidStrictMode)
+            result |= DeclarationResult::InvalidStrictMode;
+        if (isArgumentsIdent)
+            m_shadowsArguments = true;
+        if (!addResult.isNewEntry)
+            result |= DeclarationResult::InvalidDuplicateDeclaration;
+
+        return result;
+    }
+    
+    bool usedVariablesContains(UniquedStringImpl* impl) const
+    { 
+        for (const UniquedStringImplPtrSet& set : m_usedVariables) {
+            if (set.contains(impl))
+                return true;
+        }
+        return false;
+    }
+    template <typename Func>
+    void forEachUsedVariable(const Func& func)
+    {
+        for (const UniquedStringImplPtrSet& set : m_usedVariables) {
+            for (UniquedStringImpl* impl : set)
+                func(impl);
+        }
+    }
+    void useVariable(const Identifier* ident, bool isEval)
+    {
+        useVariable(ident->impl(), isEval);
+    }
+    void useVariable(UniquedStringImpl* impl, bool isEval)
+    {
+        m_usesEval |= isEval;
+        m_usedVariables.last().add(impl);
+    }
+
+    void pushUsedVariableSet() { m_usedVariables.append(UniquedStringImplPtrSet()); }
+    size_t currentUsedVariablesSize() { return m_usedVariables.size(); }
+
+    void revertToPreviousUsedVariables(size_t size) { m_usedVariables.resize(size); }
+
+    void setNeedsFullActivation() { m_needsFullActivation = true; }
+    bool needsFullActivation() const { return m_needsFullActivation; }
+    bool isArrowFunctionBoundary() { return m_isArrowFunctionBoundary; }
+    bool isArrowFunction() { return m_isArrowFunction; }
+
+    bool hasDirectSuper() const { return m_hasDirectSuper; }
+    bool setHasDirectSuper() { return std::exchange(m_hasDirectSuper, true); }
+
+    bool needsSuperBinding() const { return m_needsSuperBinding; }
+    bool setNeedsSuperBinding() { return std::exchange(m_needsSuperBinding, true); }
+    
+    void setEvalContextType(EvalContextType evalContextType) { m_evalContextType = evalContextType; }
+    EvalContextType evalContextType() { return m_evalContextType; }
+    
+    InnerArrowFunctionCodeFeatures innerArrowFunctionFeatures() { return m_innerArrowFunctionFeatures; }
+    
+    void setExpectedSuperBinding(SuperBinding superBinding) { m_expectedSuperBinding = static_cast<unsigned>(superBinding); }
+    SuperBinding expectedSuperBinding() const { return static_cast<SuperBinding>(m_expectedSuperBinding); }
+    void setConstructorKind(ConstructorKind constructorKind) { m_constructorKind = static_cast<unsigned>(constructorKind); }
+    ConstructorKind constructorKind() const { return static_cast<ConstructorKind>(m_constructorKind); }
+
+    void setInnerArrowFunctionUsesSuperCall() { m_innerArrowFunctionFeatures |= SuperCallInnerArrowFunctionFeature; }
+    void setInnerArrowFunctionUsesSuperProperty() { m_innerArrowFunctionFeatures |= SuperPropertyInnerArrowFunctionFeature; }
+    void setInnerArrowFunctionUsesEval() { m_innerArrowFunctionFeatures |= EvalInnerArrowFunctionFeature; }
+    void setInnerArrowFunctionUsesThis() { m_innerArrowFunctionFeatures |= ThisInnerArrowFunctionFeature; }
+    void setInnerArrowFunctionUsesNewTarget() { m_innerArrowFunctionFeatures |= NewTargetInnerArrowFunctionFeature; }
+    void setInnerArrowFunctionUsesArguments() { m_innerArrowFunctionFeatures |= ArgumentsInnerArrowFunctionFeature; }
+    
+    bool isEvalContext() const { return m_isEvalContext; }
+    void setIsEvalContext(bool isEvalContext) { m_isEvalContext = isEvalContext; }
+
+    void setInnerArrowFunctionUsesEvalAndUseArgumentsIfNeeded()
+    {
+        ASSERT(m_isArrowFunction);
+
+        if (m_usesEval)
+            setInnerArrowFunctionUsesEval();
+        
+        if (usedVariablesContains(m_vm->propertyNames->arguments.impl()))
+            setInnerArrowFunctionUsesArguments();
+    }
+
+    void addClosedVariableCandidateUnconditionally(UniquedStringImpl* impl)
+    {
+        m_closedVariableCandidates.add(impl);
+    }
+    
+    void collectFreeVariables(Scope* nestedScope, bool shouldTrackClosedVariables)
+    {
+        if (nestedScope->m_usesEval)
+            m_usesEval = true;
+
+        {
+            UniquedStringImplPtrSet& destinationSet = m_usedVariables.last();
+            for (const UniquedStringImplPtrSet& usedVariablesSet : nestedScope->m_usedVariables) {
+                for (UniquedStringImpl* impl : usedVariablesSet) {
+                    if (nestedScope->m_declaredVariables.contains(impl) || nestedScope->m_lexicalVariables.contains(impl))
+                        continue;
+
+                    // "arguments" reference should be resolved at function boudary.
+                    if (nestedScope->isFunctionBoundary() && nestedScope->hasArguments() && impl == m_vm->propertyNames->arguments.impl() && !nestedScope->isArrowFunctionBoundary())
+                        continue;
+
+                    destinationSet.add(impl);
+                    // We don't want a declared variable that is used in an inner scope to be thought of as captured if
+                    // that inner scope is both a lexical scope and not a function. Only inner functions and "catch" 
+                    // statements can cause variables to be captured.
+                    if (shouldTrackClosedVariables && (nestedScope->m_isFunctionBoundary || !nestedScope->m_isLexicalScope))
+                        m_closedVariableCandidates.add(impl);
+                }
+            }
+        }
+        // Propagate closed variable candidates downwards within the same function.
+        // Cross function captures will be realized via m_usedVariables propagation.
+        if (shouldTrackClosedVariables && !nestedScope->m_isFunctionBoundary && nestedScope->m_closedVariableCandidates.size()) {
+            auto end = nestedScope->m_closedVariableCandidates.end();
+            auto begin = nestedScope->m_closedVariableCandidates.begin();
+            m_closedVariableCandidates.add(begin, end);
+        }
+    }
+    
+    void mergeInnerArrowFunctionFeatures(InnerArrowFunctionCodeFeatures arrowFunctionCodeFeatures)
+    {
+        m_innerArrowFunctionFeatures = m_innerArrowFunctionFeatures | arrowFunctionCodeFeatures;
+    }
+    
+    void getSloppyModeHoistedFunctions(UniquedStringImplPtrSet& sloppyModeHoistedFunctions)
+    {
+        for (UniquedStringImpl* function : m_sloppyModeHoistableFunctionCandidates) {
+            // ES6 Annex B.3.3. The only time we can't hoist a function is if a syntax error would
+            // be caused by declaring a var with that function's name or if we have a parameter with
+            // that function's name. Note that we would only cause a syntax error if we had a let/const/class
+            // variable with the same name.
+            if (!m_lexicalVariables.contains(function)) {
+                auto iter = m_declaredVariables.find(function);
+                bool isParameter = iter != m_declaredVariables.end() && iter->value.isParameter();
+                if (!isParameter) {
+                    auto addResult = m_declaredVariables.add(function);
+                    addResult.iterator->value.setIsVar();
+                    sloppyModeHoistedFunctions.add(function);
+                }
+            }
+        }
+    }
+
+    void getCapturedVars(IdentifierSet& capturedVariables)
+    {
+        if (m_needsFullActivation || m_usesEval) {
+            for (auto& entry : m_declaredVariables)
+                capturedVariables.add(entry.key);
+            return;
+        }
+        for (UniquedStringImpl* impl : m_closedVariableCandidates) {
+            // We refer to m_declaredVariables here directly instead of a hasDeclaredVariable because we want to mark the callee as captured.
+            if (!m_declaredVariables.contains(impl)) 
+                continue;
+            capturedVariables.add(impl);
+        }
+    }
+    void setStrictMode() { m_strictMode = true; }
+    bool strictMode() const { return m_strictMode; }
+    bool isValidStrictMode() const { return m_isValidStrictMode; }
+    bool shadowsArguments() const { return m_shadowsArguments; }
+    void setHasNonSimpleParameterList()
+    {
+        m_isValidStrictMode = false;
+        m_hasNonSimpleParameterList = true;
+    }
+    bool hasNonSimpleParameterList() const { return m_hasNonSimpleParameterList; }
+
+    void copyCapturedVariablesToVector(const UniquedStringImplPtrSet& usedVariables, Vector<UniquedStringImpl*, 8>& vector)
+    {
+        for (UniquedStringImpl* impl : usedVariables) {
+            if (m_declaredVariables.contains(impl) || m_lexicalVariables.contains(impl))
+                continue;
+            vector.append(impl);
+        }
+    }
+
+    void fillParametersForSourceProviderCache(SourceProviderCacheItemCreationParameters& parameters, const UniquedStringImplPtrSet& capturesFromParameterExpressions)
+    {
+        ASSERT(m_isFunction);
+        parameters.usesEval = m_usesEval;
+        parameters.strictMode = m_strictMode;
+        parameters.needsFullActivation = m_needsFullActivation;
+        parameters.innerArrowFunctionFeatures = m_innerArrowFunctionFeatures;
+        for (const UniquedStringImplPtrSet& set : m_usedVariables)
+            copyCapturedVariablesToVector(set, parameters.usedVariables);
+
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=156962
+        // We add these unconditionally because we currently don't keep a separate
+        // declaration scope for a function's parameters and its var/let/const declarations.
+        // This is somewhat unfortunate and we should refactor to do this at some point
+        // because parameters logically form a parent scope to var/let/const variables.
+        // But because we don't do this, we must grab capture candidates from a parameter
+        // list before we parse the body of a function because the body's declarations
+        // might make us believe something isn't actually a capture candidate when it really
+        // is.
+        for (UniquedStringImpl* impl : capturesFromParameterExpressions)
+            parameters.usedVariables.append(impl);
+    }
+
+    void restoreFromSourceProviderCache(const SourceProviderCacheItem* info)
+    {
+        ASSERT(m_isFunction);
+        m_usesEval = info->usesEval;
+        m_strictMode = info->strictMode;
+        m_innerArrowFunctionFeatures = info->innerArrowFunctionFeatures;
+        m_needsFullActivation = info->needsFullActivation;
+        UniquedStringImplPtrSet& destSet = m_usedVariables.last();
+        for (unsigned i = 0; i < info->usedVariablesCount; ++i)
+            destSet.add(info->usedVariables()[i]);
+    }
+
+    class MaybeParseAsGeneratorForScope;
+
+private:
+    void setIsFunction()
+    {
+        m_isFunction = true;
+        m_isFunctionBoundary = true;
+        m_hasArguments = true;
+        setIsLexicalScope();
+        m_isGenerator = false;
+        m_isGeneratorBoundary = false;
+        m_isArrowFunctionBoundary = false;
+        m_isArrowFunction = false;
+    }
+
+    void setIsGeneratorFunction()
+    {
+        setIsFunction();
+        m_isGenerator = true;
+    }
+
+    void setIsGenerator()
+    {
+        setIsFunction();
+        m_isGenerator = true;
+        m_isGeneratorBoundary = true;
+        m_hasArguments = false;
+    }
+    
+    void setIsArrowFunction()
+    {
+        setIsFunction();
+        m_isArrowFunctionBoundary = true;
+        m_isArrowFunction = true;
+    }
+
+    void setIsAsyncArrowFunction()
+    {
+        setIsArrowFunction();
+        m_isAsyncFunction = true;
+    }
+
+    void setIsAsyncFunction()
+    {
+        setIsFunction();
+        m_isAsyncFunction = true;
+    }
+
+    void setIsAsyncFunctionBody()
+    {
+        setIsFunction();
+        m_hasArguments = false;
+        m_isAsyncFunction = true;
+        m_isAsyncFunctionBoundary = true;
+    }
+
+    void setIsAsyncArrowFunctionBody()
+    {
+        setIsArrowFunction();
+        m_hasArguments = false;
+        m_isAsyncFunction = true;
+        m_isAsyncFunctionBoundary = true;
+    }
+
+    const VM* m_vm;
+    bool m_shadowsArguments;
+    bool m_usesEval;
+    bool m_needsFullActivation;
+    bool m_hasDirectSuper;
+    bool m_needsSuperBinding;
+    bool m_allowsVarDeclarations;
+    bool m_allowsLexicalDeclarations;
+    bool m_strictMode;
+    bool m_isFunction;
+    bool m_isGenerator;
+    bool m_isGeneratorBoundary;
+    bool m_isArrowFunction;
+    bool m_isArrowFunctionBoundary;
+    bool m_isAsyncFunction;
+    bool m_isAsyncFunctionBoundary;
+    bool m_isLexicalScope;
+    bool m_isFunctionBoundary;
+    bool m_isValidStrictMode;
+    bool m_hasArguments;
+    bool m_isEvalContext;
+    bool m_hasNonSimpleParameterList;
+    EvalContextType m_evalContextType;
+    unsigned m_constructorKind;
+    unsigned m_expectedSuperBinding;
+    int m_loopDepth;
+    int m_switchDepth;
+    InnerArrowFunctionCodeFeatures m_innerArrowFunctionFeatures;
+
+    typedef Vector<ScopeLabelInfo, 2> LabelStack;
+    std::unique_ptr<LabelStack> m_labels;
+    UniquedStringImplPtrSet m_declaredParameters;
+    VariableEnvironment m_declaredVariables;
+    VariableEnvironment m_lexicalVariables;
+    Vector<UniquedStringImplPtrSet, 6> m_usedVariables;
+    UniquedStringImplPtrSet m_sloppyModeHoistableFunctionCandidates;
+    HashSet<UniquedStringImpl*> m_closedVariableCandidates;
+    DeclarationStacks::FunctionStack m_functionDeclarations;
+};
+
+typedef Vector<Scope, 10> ScopeStack;
+
+struct ScopeRef {
+    ScopeRef(ScopeStack* scopeStack, unsigned index)
+        : m_scopeStack(scopeStack)
+        , m_index(index)
+    {
+    }
+    Scope* operator->() { return &m_scopeStack->at(m_index); }
+    unsigned index() const { return m_index; }
+
+    bool hasContainingScope()
+    {
+        return m_index && !m_scopeStack->at(m_index).isFunctionBoundary();
+    }
+
+    ScopeRef containingScope()
+    {
+        ASSERT(hasContainingScope());
+        return ScopeRef(m_scopeStack, m_index - 1);
+    }
+
+    bool operator==(const ScopeRef& other)
+    {
+        ASSERT(other.m_scopeStack == m_scopeStack);
+        return m_index == other.m_index;
+    }
+
+    bool operator!=(const ScopeRef& other)
+    {
+        return !(*this == other);
+    }
+
+private:
+    ScopeStack* m_scopeStack;
+    unsigned m_index;
+};
+
+enum class ArgumentType {
+    Normal,
+    Spread
+};
+
+template <typename LexerType>
+class Parser {
+    WTF_MAKE_NONCOPYABLE(Parser);
+    WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    Parser(VM*, const SourceCode&, JSParserBuiltinMode, JSParserStrictMode, JSParserScriptMode, SourceParseMode, SuperBinding, ConstructorKind defaultConstructorKind = ConstructorKind::None, DerivedContextType = DerivedContextType::None, bool isEvalContext = false, EvalContextType = EvalContextType::None, DebuggerParseData* = nullptr);
+    ~Parser();
+
+    template <class ParsedNode>
+    std::unique_ptr<ParsedNode> parse(ParserError&, const Identifier&, SourceParseMode);
+
+    JSTextPosition positionBeforeLastNewline() const { return m_lexer->positionBeforeLastNewline(); }
+    JSTokenLocation locationBeforeLastToken() const { return m_lexer->lastTokenLocation(); }
+
+private:
+    struct AllowInOverride {
+        AllowInOverride(Parser* parser)
+            : m_parser(parser)
+            , m_oldAllowsIn(parser->m_allowsIn)
+        {
+            parser->m_allowsIn = true;
+        }
+        ~AllowInOverride()
+        {
+            m_parser->m_allowsIn = m_oldAllowsIn;
+        }
+        Parser* m_parser;
+        bool m_oldAllowsIn;
+    };
+
+    struct AutoPopScopeRef : public ScopeRef {
+        AutoPopScopeRef(Parser* parser, ScopeRef scope)
+        : ScopeRef(scope)
+        , m_parser(parser)
+        {
+        }
+        
+        ~AutoPopScopeRef()
+        {
+            if (m_parser)
+                m_parser->popScope(*this, false);
+        }
+        
+        void setPopped()
+        {
+            m_parser = 0;
+        }
+        
+    private:
+        Parser* m_parser;
+    };
+
+    struct AutoCleanupLexicalScope {
+        // We can allocate this object on the stack without actually knowing beforehand if we're 
+        // going to create a new lexical scope. If we decide to create a new lexical scope, we
+        // can pass the scope into this obejct and it will take care of the cleanup for us if the parse fails.
+        // This is helpful if we may fail from syntax errors after creating a lexical scope conditionally.
+        AutoCleanupLexicalScope()
+            : m_scope(nullptr, UINT_MAX)
+            , m_parser(nullptr)
+        {
+        }
+
+        ~AutoCleanupLexicalScope()
+        {
+            // This should only ever be called if we fail from a syntax error. Otherwise
+            // it's the intention that a user of this class pops this scope manually on a 
+            // successful parse. 
+            if (isValid())
+                m_parser->popScope(*this, false);
+        }
+
+        void setIsValid(ScopeRef& scope, Parser* parser)
+        {
+            RELEASE_ASSERT(scope->isLexicalScope());
+            m_scope = scope;
+            m_parser = parser;
+        }
+
+        bool isValid() const { return !!m_parser; }
+
+        void setPopped()
+        {
+            m_parser = nullptr;
+        }
+
+        ScopeRef& scope() { return m_scope; }
+
+    private:
+        ScopeRef m_scope;
+        Parser* m_parser;
+    };
+
+    enum ExpressionErrorClass {
+        ErrorIndicatesNothing = 0,
+        ErrorIndicatesPattern,
+        ErrorIndicatesAsyncArrowFunction
+    };
+
+    struct ExpressionErrorClassifier {
+        ExpressionErrorClassifier(Parser* parser)
+            : m_class(ErrorIndicatesNothing)
+            , m_previous(parser->m_expressionErrorClassifier)
+            , m_parser(parser)
+        {
+            m_parser->m_expressionErrorClassifier = this;
+        }
+
+        ~ExpressionErrorClassifier()
+        {
+            m_parser->m_expressionErrorClassifier = m_previous;
+        }
+
+        void classifyExpressionError(ExpressionErrorClass classification)
+        {
+            if (m_class != ErrorIndicatesNothing)
+                return;
+            m_class = classification;
+        }
+
+        void forceClassifyExpressionError(ExpressionErrorClass classification)
+        {
+            m_class = classification;
+        }
+
+        void reclassifyExpressionError(ExpressionErrorClass oldClassification, ExpressionErrorClass classification)
+        {
+            if (m_class != oldClassification)
+                return;
+            m_class = classification;
+        }
+
+        void propagateExpressionErrorClass()
+        {
+            if (m_previous)
+                m_previous->m_class = m_class;
+        }
+
+        bool indicatesPossiblePattern() const { return m_class == ErrorIndicatesPattern; }
+        bool indicatesPossibleAsyncArrowFunction() const { return m_class == ErrorIndicatesAsyncArrowFunction; }
+
+    private:
+        ExpressionErrorClass m_class;
+        ExpressionErrorClassifier* m_previous;
+        Parser* m_parser;
+    };
+
+    ALWAYS_INLINE void classifyExpressionError(ExpressionErrorClass classification)
+    {
+        if (m_expressionErrorClassifier)
+            m_expressionErrorClassifier->classifyExpressionError(classification);
+    }
+
+    ALWAYS_INLINE void forceClassifyExpressionError(ExpressionErrorClass classification)
+    {
+        if (m_expressionErrorClassifier)
+            m_expressionErrorClassifier->forceClassifyExpressionError(classification);
+    }
+
+    ALWAYS_INLINE void reclassifyExpressionError(ExpressionErrorClass oldClassification, ExpressionErrorClass classification)
+    {
+        if (m_expressionErrorClassifier)
+            m_expressionErrorClassifier->reclassifyExpressionError(oldClassification, classification);
+    }
+
+    ALWAYS_INLINE DestructuringKind destructuringKindFromDeclarationType(DeclarationType type)
+    {
+        switch (type) {
+        case DeclarationType::VarDeclaration:
+            return DestructuringKind::DestructureToVariables;
+        case DeclarationType::LetDeclaration:
+            return DestructuringKind::DestructureToLet;
+        case DeclarationType::ConstDeclaration:
+            return DestructuringKind::DestructureToConst;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return DestructuringKind::DestructureToVariables;
+    }
+
+    ALWAYS_INLINE const char* declarationTypeToVariableKind(DeclarationType type)
+    {
+        switch (type) {
+        case DeclarationType::VarDeclaration:
+            return "variable name";
+        case DeclarationType::LetDeclaration:
+        case DeclarationType::ConstDeclaration:
+            return "lexical variable name";
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return "invalid";
+    }
+
+    ALWAYS_INLINE AssignmentContext assignmentContextFromDeclarationType(DeclarationType type)
+    {
+        switch (type) {
+        case DeclarationType::ConstDeclaration:
+            return AssignmentContext::ConstDeclarationStatement;
+        default:
+            return AssignmentContext::DeclarationStatement;
+        }
+    }
+
+    ALWAYS_INLINE bool isEvalOrArguments(const Identifier* ident) { return isEvalOrArgumentsIdentifier(m_vm, ident); }
+
+    ScopeRef upperScope(int n)
+    {
+        ASSERT(m_scopeStack.size() >= size_t(1 + n));
+        return ScopeRef(&m_scopeStack, m_scopeStack.size() - 1 - n);
+    }
+
+    ScopeRef currentScope()
+    {
+        return ScopeRef(&m_scopeStack, m_scopeStack.size() - 1);
+    }
+
+    ScopeRef currentVariableScope()
+    {
+        unsigned i = m_scopeStack.size() - 1;
+        ASSERT(i < m_scopeStack.size());
+        while (!m_scopeStack[i].allowsVarDeclarations()) {
+            i--;
+            ASSERT(i < m_scopeStack.size());
+        }
+        return ScopeRef(&m_scopeStack, i);
+    }
+
+    ScopeRef currentLexicalDeclarationScope()
+    {
+        unsigned i = m_scopeStack.size() - 1;
+        ASSERT(i < m_scopeStack.size());
+        while (!m_scopeStack[i].allowsLexicalDeclarations()) {
+            i--;
+            ASSERT(i < m_scopeStack.size());
+        }
+
+        return ScopeRef(&m_scopeStack, i);
+    }
+
+    ScopeRef currentFunctionScope()
+    {
+        unsigned i = m_scopeStack.size() - 1;
+        ASSERT(i < m_scopeStack.size());
+        while (i && !m_scopeStack[i].isFunctionBoundary()) {
+            i--;
+            ASSERT(i < m_scopeStack.size());
+        }
+        // When reaching the top level scope (it can be non function scope), we return it.
+        return ScopeRef(&m_scopeStack, i);
+    }
+
+    ScopeRef closestParentOrdinaryFunctionNonLexicalScope()
+    {
+        unsigned i = m_scopeStack.size() - 1;
+        ASSERT(i < m_scopeStack.size() && m_scopeStack.size());
+        while (i && (!m_scopeStack[i].isFunctionBoundary() || m_scopeStack[i].isGeneratorBoundary() || m_scopeStack[i].isAsyncFunctionBoundary() || m_scopeStack[i].isArrowFunctionBoundary()))
+            i--;
+        // When reaching the top level scope (it can be non ordinary function scope), we return it.
+        return ScopeRef(&m_scopeStack, i);
+    }
+    
+    ScopeRef pushScope()
+    {
+        bool isFunction = false;
+        bool isStrict = false;
+        bool isGenerator = false;
+        bool isArrowFunction = false;
+        bool isAsyncFunction = false;
+        if (!m_scopeStack.isEmpty()) {
+            isStrict = m_scopeStack.last().strictMode();
+            isFunction = m_scopeStack.last().isFunction();
+            isGenerator = m_scopeStack.last().isGenerator();
+            isArrowFunction = m_scopeStack.last().isArrowFunction();
+            isAsyncFunction = m_scopeStack.last().isAsyncFunction();
+        }
+        m_scopeStack.constructAndAppend(m_vm, isFunction, isGenerator, isStrict, isArrowFunction, isAsyncFunction);
+        return currentScope();
+    }
+
+    void popScopeInternal(ScopeRef& scope, bool shouldTrackClosedVariables)
+    {
+        ASSERT_UNUSED(scope, scope.index() == m_scopeStack.size() - 1);
+        ASSERT(m_scopeStack.size() > 1);
+        m_scopeStack[m_scopeStack.size() - 2].collectFreeVariables(&m_scopeStack.last(), shouldTrackClosedVariables);
+        
+        if (m_scopeStack.last().isArrowFunction())
+            m_scopeStack.last().setInnerArrowFunctionUsesEvalAndUseArgumentsIfNeeded();
+        
+        if (!(m_scopeStack.last().isFunctionBoundary() && !m_scopeStack.last().isArrowFunctionBoundary()))
+            m_scopeStack[m_scopeStack.size() - 2].mergeInnerArrowFunctionFeatures(m_scopeStack.last().innerArrowFunctionFeatures());
+
+        if (!m_scopeStack.last().isFunctionBoundary() && m_scopeStack.last().needsFullActivation())
+            m_scopeStack[m_scopeStack.size() - 2].setNeedsFullActivation();
+        m_scopeStack.removeLast();
+    }
+    
+    ALWAYS_INLINE void popScope(ScopeRef& scope, bool shouldTrackClosedVariables)
+    {
+        popScopeInternal(scope, shouldTrackClosedVariables);
+    }
+    
+    ALWAYS_INLINE void popScope(AutoPopScopeRef& scope, bool shouldTrackClosedVariables)
+    {
+        scope.setPopped();
+        popScopeInternal(scope, shouldTrackClosedVariables);
+    }
+
+    ALWAYS_INLINE void popScope(AutoCleanupLexicalScope& cleanupScope, bool shouldTrackClosedVariables)
+    {
+        RELEASE_ASSERT(cleanupScope.isValid());
+        ScopeRef& scope = cleanupScope.scope();
+        cleanupScope.setPopped();
+        popScopeInternal(scope, shouldTrackClosedVariables);
+    }
+    
+    DeclarationResultMask declareVariable(const Identifier* ident, DeclarationType type = DeclarationType::VarDeclaration, DeclarationImportType importType = DeclarationImportType::NotImported)
+    {
+        if (type == DeclarationType::VarDeclaration)
+            return currentVariableScope()->declareVariable(ident);
+
+        ASSERT(type == DeclarationType::LetDeclaration || type == DeclarationType::ConstDeclaration);
+        // Lexical variables declared at a top level scope that shadow arguments or vars are not allowed.
+        if (!m_lexer->isReparsingFunction() && m_statementDepth == 1 && (hasDeclaredParameter(*ident) || hasDeclaredVariable(*ident)))
+            return DeclarationResult::InvalidDuplicateDeclaration;
+
+        return currentLexicalDeclarationScope()->declareLexicalVariable(ident, type == DeclarationType::ConstDeclaration, importType);
+    }
+
+    std::pair<DeclarationResultMask, ScopeRef> declareFunction(const Identifier* ident)
+    {
+        if (m_statementDepth == 1 || (!strictMode() && !currentScope()->isFunction())) {
+            // Functions declared at the top-most scope (both in sloppy and strict mode) are declared as vars
+            // for backwards compatibility. This allows us to declare functions with the same name more than once.
+            // In sloppy mode, we always declare functions as vars.
+            bool declareAsVar = true;
+            bool isSloppyModeHoistingCandidate = false;
+            ScopeRef variableScope = currentVariableScope();
+            return std::make_pair(variableScope->declareFunction(ident, declareAsVar, isSloppyModeHoistingCandidate), variableScope);
+        }
+
+        if (!strictMode()) {
+            ASSERT(currentScope()->isFunction());
+
+            // Functions declared inside a function inside a nested block scope in sloppy mode are subject to this
+            // crazy rule defined inside Annex B.3.3 in the ES6 spec. It basically states that we will create
+            // the function as a local block scoped variable, but when we evaluate the block that the function is
+            // contained in, we will assign the function to a "var" variable only if declaring such a "var" wouldn't
+            // be a syntax error and if there isn't a parameter with the same name. (It would only be a syntax error if
+            // there are is a let/class/const with the same name). Note that this mean we only do the "var" hoisting 
+            // binding if the block evaluates. For example, this means we wont won't perform the binding if it's inside
+            // the untaken branch of an if statement.
+            bool declareAsVar = false;
+            bool isSloppyModeHoistingCandidate = true;
+            ScopeRef lexicalVariableScope = currentLexicalDeclarationScope();
+            ScopeRef varScope = currentVariableScope();
+            varScope->addSloppyModeHoistableFunctionCandidate(ident);
+            ASSERT(varScope != lexicalVariableScope);
+            return std::make_pair(lexicalVariableScope->declareFunction(ident, declareAsVar, isSloppyModeHoistingCandidate), lexicalVariableScope);
+        }
+
+        bool declareAsVar = false;
+        bool isSloppyModeHoistingCandidate = false;
+        ScopeRef lexicalVariableScope = currentLexicalDeclarationScope();
+        return std::make_pair(lexicalVariableScope->declareFunction(ident, declareAsVar, isSloppyModeHoistingCandidate), lexicalVariableScope);
+    }
+
+    NEVER_INLINE bool hasDeclaredVariable(const Identifier& ident)
+    {
+        unsigned i = m_scopeStack.size() - 1;
+        ASSERT(i < m_scopeStack.size());
+        while (!m_scopeStack[i].allowsVarDeclarations()) {
+            i--;
+            ASSERT(i < m_scopeStack.size());
+        }
+        return m_scopeStack[i].hasDeclaredVariable(ident);
+    }
+
+    NEVER_INLINE bool hasDeclaredParameter(const Identifier& ident)
+    {
+        // FIXME: hasDeclaredParameter() is not valid during reparsing of generator or async function bodies, because their formal
+        // parameters are declared in a scope unavailable during reparsing. Note that it is redundant to call this function during
+        // reparsing anyways, as the function is already guaranteed to be valid by the original parsing.
+        // https://bugs.webkit.org/show_bug.cgi?id=164087
+        ASSERT(!m_lexer->isReparsingFunction());
+
+        unsigned i = m_scopeStack.size() - 1;
+        ASSERT(i < m_scopeStack.size());
+        while (!m_scopeStack[i].allowsVarDeclarations()) {
+            i--;
+            ASSERT(i < m_scopeStack.size());
+        }
+
+        if (m_scopeStack[i].isGeneratorBoundary() || m_scopeStack[i].isAsyncFunctionBoundary()) {
+            // The formal parameters which need to be verified for Generators and Async Function bodies occur
+            // in the outer wrapper function, so pick the outer scope here.
+            i--;
+            ASSERT(i < m_scopeStack.size());
+        }
+        return m_scopeStack[i].hasDeclaredParameter(ident);
+    }
+    
+    bool exportName(const Identifier& ident)
+    {
+        ASSERT(currentScope().index() == 0);
+        ASSERT(m_moduleScopeData);
+        return m_moduleScopeData->exportName(ident);
+    }
+
+    ScopeStack m_scopeStack;
+    
+    const SourceProviderCacheItem* findCachedFunctionInfo(int openBracePos) 
+    {
+        return m_functionCache ? m_functionCache->get(openBracePos) : 0;
+    }
+
+    Parser();
+    String parseInner(const Identifier&, SourceParseMode);
+
+    void didFinishParsing(SourceElements*, DeclarationStacks::FunctionStack&&, VariableEnvironment&, UniquedStringImplPtrSet&&, CodeFeatures, int);
+
+    // Used to determine type of error to report.
+    bool isFunctionMetadataNode(ScopeNode*) { return false; }
+    bool isFunctionMetadataNode(FunctionMetadataNode*) { return true; }
+
+    ALWAYS_INLINE void next(unsigned lexerFlags = 0)
+    {
+        int lastLine = m_token.m_location.line;
+        int lastTokenEnd = m_token.m_location.endOffset;
+        int lastTokenLineStart = m_token.m_location.lineStartOffset;
+        m_lastTokenEndPosition = JSTextPosition(lastLine, lastTokenEnd, lastTokenLineStart);
+        m_lexer->setLastLineNumber(lastLine);
+        m_token.m_type = m_lexer->lex(&m_token, lexerFlags, strictMode());
+    }
+
+    ALWAYS_INLINE void nextExpectIdentifier(unsigned lexerFlags = 0)
+    {
+        int lastLine = m_token.m_location.line;
+        int lastTokenEnd = m_token.m_location.endOffset;
+        int lastTokenLineStart = m_token.m_location.lineStartOffset;
+        m_lastTokenEndPosition = JSTextPosition(lastLine, lastTokenEnd, lastTokenLineStart);
+        m_lexer->setLastLineNumber(lastLine);
+        m_token.m_type = m_lexer->lexExpectIdentifier(&m_token, lexerFlags, strictMode());
+    }
+
+    ALWAYS_INLINE bool nextTokenIsColon()
+    {
+        return m_lexer->nextTokenIsColon();
+    }
+
+    ALWAYS_INLINE bool consume(JSTokenType expected, unsigned flags = 0)
+    {
+        bool result = m_token.m_type == expected;
+        if (result)
+            next(flags);
+        return result;
+    }
+
+    void printUnexpectedTokenText(WTF::PrintStream&);
+    ALWAYS_INLINE StringView getToken()
+    {
+        return m_lexer->getToken(m_token);
+    }
+    
+    ALWAYS_INLINE bool match(JSTokenType expected)
+    {
+        return m_token.m_type == expected;
+    }
+    
+    ALWAYS_INLINE bool matchContextualKeyword(const Identifier& identifier)
+    {
+        return m_token.m_type == IDENT && *m_token.m_data.ident == identifier;
+    }
+
+    ALWAYS_INLINE bool matchIdentifierOrKeyword()
+    {
+        return isIdentifierOrKeyword(m_token);
+    }
+    
+    ALWAYS_INLINE unsigned tokenStart()
+    {
+        return m_token.m_location.startOffset;
+    }
+    
+    ALWAYS_INLINE const JSTextPosition& tokenStartPosition()
+    {
+        return m_token.m_startPosition;
+    }
+
+    ALWAYS_INLINE int tokenLine()
+    {
+        return m_token.m_location.line;
+    }
+    
+    ALWAYS_INLINE int tokenColumn()
+    {
+        return tokenStart() - tokenLineStart();
+    }
+
+    ALWAYS_INLINE const JSTextPosition& tokenEndPosition()
+    {
+        return m_token.m_endPosition;
+    }
+    
+    ALWAYS_INLINE unsigned tokenLineStart()
+    {
+        return m_token.m_location.lineStartOffset;
+    }
+    
+    ALWAYS_INLINE const JSTokenLocation& tokenLocation()
+    {
+        return m_token.m_location;
+    }
+
+    void setErrorMessage(const String& message)
+    {
+        ASSERT_WITH_MESSAGE(!message.isEmpty(), "Attempted to set the empty string as an error message. Likely caused by invalid UTF8 used when creating the message.");
+        m_errorMessage = message;
+        if (m_errorMessage.isEmpty())
+            m_errorMessage = ASCIILiteral("Unparseable script");
+    }
+    
+    NEVER_INLINE void logError(bool);
+    template <typename A> NEVER_INLINE void logError(bool, const A&);
+    template <typename A, typename B> NEVER_INLINE void logError(bool, const A&, const B&);
+    template <typename A, typename B, typename C> NEVER_INLINE void logError(bool, const A&, const B&, const C&);
+    template <typename A, typename B, typename C, typename D> NEVER_INLINE void logError(bool, const A&, const B&, const C&, const D&);
+    template <typename A, typename B, typename C, typename D, typename E> NEVER_INLINE void logError(bool, const A&, const B&, const C&, const D&, const E&);
+    template <typename A, typename B, typename C, typename D, typename E, typename F> NEVER_INLINE void logError(bool, const A&, const B&, const C&, const D&, const E&, const F&);
+    template <typename A, typename B, typename C, typename D, typename E, typename F, typename G> NEVER_INLINE void logError(bool, const A&, const B&, const C&, const D&, const E&, const F&, const G&);
+    
+    NEVER_INLINE void updateErrorWithNameAndMessage(const char* beforeMessage, const String& name, const char* afterMessage)
+    {
+        m_errorMessage = makeString(beforeMessage, " '", name, "' ", afterMessage);
+    }
+    
+    NEVER_INLINE void updateErrorMessage(const char* msg)
+    {
+        ASSERT(msg);
+        m_errorMessage = String(msg);
+        ASSERT(!m_errorMessage.isNull());
+    }
+
+    ALWAYS_INLINE void recordPauseLocation(const JSTextPosition&);
+    ALWAYS_INLINE void recordFunctionEntryLocation(const JSTextPosition&);
+    ALWAYS_INLINE void recordFunctionLeaveLocation(const JSTextPosition&);
+
+    void startLoop() { currentScope()->startLoop(); }
+    void endLoop() { currentScope()->endLoop(); }
+    void startSwitch() { currentScope()->startSwitch(); }
+    void endSwitch() { currentScope()->endSwitch(); }
+    void setStrictMode() { currentScope()->setStrictMode(); }
+    bool strictMode() { return currentScope()->strictMode(); }
+    bool isValidStrictMode()
+    {
+        int i = m_scopeStack.size() - 1;
+        if (!m_scopeStack[i].isValidStrictMode())
+            return false;
+
+        // In the case of Generator or Async function bodies, also check the wrapper function, whose name or
+        // arguments may be invalid.
+        if (UNLIKELY((m_scopeStack[i].isGeneratorBoundary() || m_scopeStack[i].isAsyncFunctionBoundary()) && i))
+            return m_scopeStack[i - 1].isValidStrictMode();
+        return true;
+    }
+    DeclarationResultMask declareParameter(const Identifier* ident) { return currentScope()->declareParameter(ident); }
+    bool declareRestOrNormalParameter(const Identifier&, const Identifier**);
+
+    bool breakIsValid()
+    {
+        ScopeRef current = currentScope();
+        while (!current->breakIsValid()) {
+            if (!current.hasContainingScope())
+                return false;
+            current = current.containingScope();
+        }
+        return true;
+    }
+    bool continueIsValid()
+    {
+        ScopeRef current = currentScope();
+        while (!current->continueIsValid()) {
+            if (!current.hasContainingScope())
+                return false;
+            current = current.containingScope();
+        }
+        return true;
+    }
+    void pushLabel(const Identifier* label, bool isLoop) { currentScope()->pushLabel(label, isLoop); }
+    void popLabel(ScopeRef scope) { scope->popLabel(); }
+    ScopeLabelInfo* getLabel(const Identifier* label)
+    {
+        ScopeRef current = currentScope();
+        ScopeLabelInfo* result = 0;
+        while (!(result = current->getLabel(label))) {
+            if (!current.hasContainingScope())
+                return 0;
+            current = current.containingScope();
+        }
+        return result;
+    }
+
+    // http://ecma-international.org/ecma-262/6.0/#sec-identifiers-static-semantics-early-errors
+    ALWAYS_INLINE bool isLETMaskedAsIDENT()
+    {
+        return match(LET) && !strictMode();
+    }
+
+    // http://ecma-international.org/ecma-262/6.0/#sec-identifiers-static-semantics-early-errors
+    ALWAYS_INLINE bool isYIELDMaskedAsIDENT(bool inGenerator)
+    {
+        return match(YIELD) && !strictMode() && !inGenerator;
+    }
+
+    // http://ecma-international.org/ecma-262/6.0/#sec-generator-function-definitions-static-semantics-early-errors
+    ALWAYS_INLINE bool matchSpecIdentifier(bool inGenerator)
+    {
+        return match(IDENT) || isLETMaskedAsIDENT() || isYIELDMaskedAsIDENT(inGenerator) || isSafeContextualKeyword(m_token);
+    }
+
+    ALWAYS_INLINE bool matchSpecIdentifier()
+    {
+        return match(IDENT) || isLETMaskedAsIDENT() || isYIELDMaskedAsIDENT(currentScope()->isGenerator()) || isSafeContextualKeyword(m_token);
+    }
+
+    template <class TreeBuilder> TreeSourceElements parseSourceElements(TreeBuilder&, SourceElementsMode);
+    template <class TreeBuilder> TreeSourceElements parseGeneratorFunctionSourceElements(TreeBuilder&, const Identifier& name, SourceElementsMode);
+    template <class TreeBuilder> TreeSourceElements parseAsyncFunctionSourceElements(TreeBuilder&, SourceParseMode, bool isArrowFunctionBodyExpression, SourceElementsMode);
+    template <class TreeBuilder> TreeStatement parseStatementListItem(TreeBuilder&, const Identifier*& directive, unsigned* directiveLiteralLength);
+    template <class TreeBuilder> TreeStatement parseStatement(TreeBuilder&, const Identifier*& directive, unsigned* directiveLiteralLength = 0);
+    enum class ExportType { Exported, NotExported };
+    template <class TreeBuilder> TreeStatement parseClassDeclaration(TreeBuilder&, ExportType = ExportType::NotExported, DeclarationDefaultContext = DeclarationDefaultContext::Standard);
+    template <class TreeBuilder> TreeStatement parseFunctionDeclaration(TreeBuilder&, ExportType = ExportType::NotExported, DeclarationDefaultContext = DeclarationDefaultContext::Standard);
+    template <class TreeBuilder> TreeStatement parseFunctionDeclarationStatement(TreeBuilder&, bool isAsync, bool parentAllowsFunctionDeclarationAsStatement);
+    template <class TreeBuilder> TreeStatement parseAsyncFunctionDeclaration(TreeBuilder&, ExportType = ExportType::NotExported, DeclarationDefaultContext = DeclarationDefaultContext::Standard);
+    template <class TreeBuilder> NEVER_INLINE bool maybeParseAsyncFunctionDeclarationStatement(TreeBuilder& context, TreeStatement& result, bool parentAllowsFunctionDeclarationAsStatement);
+    template <class TreeBuilder> TreeStatement parseVariableDeclaration(TreeBuilder&, DeclarationType, ExportType = ExportType::NotExported);
+    template <class TreeBuilder> TreeStatement parseDoWhileStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseWhileStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseForStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseBreakStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseContinueStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseReturnStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseThrowStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseWithStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseSwitchStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeClauseList parseSwitchClauses(TreeBuilder&);
+    template <class TreeBuilder> TreeClause parseSwitchDefaultClause(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseTryStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseDebuggerStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseExpressionStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseExpressionOrLabelStatement(TreeBuilder&, bool allowFunctionDeclarationAsStatement);
+    template <class TreeBuilder> TreeStatement parseIfStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseBlockStatement(TreeBuilder&);
+    template <class TreeBuilder> TreeExpression parseExpression(TreeBuilder&);
+    template <class TreeBuilder> TreeExpression parseAssignmentExpression(TreeBuilder&, ExpressionErrorClassifier&);
+    template <class TreeBuilder> TreeExpression parseAssignmentExpression(TreeBuilder&);
+    template <class TreeBuilder> TreeExpression parseAssignmentExpressionOrPropagateErrorClass(TreeBuilder&);
+    template <class TreeBuilder> TreeExpression parseYieldExpression(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parseConditionalExpression(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parseBinaryExpression(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parseUnaryExpression(TreeBuilder&);
+    template <class TreeBuilder> NEVER_INLINE TreeExpression parseAwaitExpression(TreeBuilder&);
+    template <class TreeBuilder> TreeExpression parseMemberExpression(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parsePrimaryExpression(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parseArrayLiteral(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parseObjectLiteral(TreeBuilder&);
+    template <class TreeBuilder> NEVER_INLINE TreeExpression parseStrictObjectLiteral(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeClassExpression parseClassExpression(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parseFunctionExpression(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parseAsyncFunctionExpression(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeArguments parseArguments(TreeBuilder&);
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression parseArgument(TreeBuilder&, ArgumentType&);
+    template <class TreeBuilder> TreeProperty parseProperty(TreeBuilder&, bool strict);
+    template <class TreeBuilder> TreeExpression parsePropertyMethod(TreeBuilder& context, const Identifier* methodName, bool isGenerator, bool isAsyncMethod);
+    template <class TreeBuilder> TreeProperty parseGetterSetter(TreeBuilder&, bool strict, PropertyNode::Type, unsigned getterOrSetterStartOffset, ConstructorKind, bool isClassProperty);
+    template <class TreeBuilder> ALWAYS_INLINE TreeFunctionBody parseFunctionBody(TreeBuilder&, SyntaxChecker&, const JSTokenLocation&, int, int functionKeywordStart, int functionNameStart, int parametersStart, ConstructorKind, SuperBinding, FunctionBodyType, unsigned, unsigned, SourceParseMode);
+    template <class TreeBuilder> ALWAYS_INLINE bool parseFormalParameters(TreeBuilder&, TreeFormalParameterList, bool isArrowFunction, unsigned&, unsigned&);
+    enum VarDeclarationListContext { ForLoopContext, VarDeclarationContext };
+    template <class TreeBuilder> TreeExpression parseVariableDeclarationList(TreeBuilder&, int& declarations, TreeDestructuringPattern& lastPattern, TreeExpression& lastInitializer, JSTextPosition& identStart, JSTextPosition& initStart, JSTextPosition& initEnd, VarDeclarationListContext, DeclarationType, ExportType, bool& forLoopConstDoesNotHaveInitializer);
+    template <class TreeBuilder> TreeSourceElements parseArrowFunctionSingleExpressionBodySourceElements(TreeBuilder&);
+    template <class TreeBuilder> TreeExpression parseArrowFunctionExpression(TreeBuilder&, bool isAsync);
+    template <class TreeBuilder> NEVER_INLINE TreeDestructuringPattern createBindingPattern(TreeBuilder&, DestructuringKind, ExportType, const Identifier&, JSToken, AssignmentContext, const Identifier** duplicateIdentifier);
+    template <class TreeBuilder> NEVER_INLINE TreeDestructuringPattern createAssignmentElement(TreeBuilder&, TreeExpression&, const JSTextPosition&, const JSTextPosition&);
+    template <class TreeBuilder> NEVER_INLINE TreeDestructuringPattern parseBindingOrAssignmentElement(TreeBuilder& context, DestructuringKind, ExportType, const Identifier** duplicateIdentifier, bool* hasDestructuringPattern, AssignmentContext bindingContext, int depth);
+    template <class TreeBuilder> NEVER_INLINE TreeDestructuringPattern parseAssignmentElement(TreeBuilder& context, DestructuringKind, ExportType, const Identifier** duplicateIdentifier, bool* hasDestructuringPattern, AssignmentContext bindingContext, int depth);
+    template <class TreeBuilder> NEVER_INLINE TreeDestructuringPattern parseDestructuringPattern(TreeBuilder&, DestructuringKind, ExportType, const Identifier** duplicateIdentifier = nullptr, bool* hasDestructuringPattern = nullptr, AssignmentContext = AssignmentContext::DeclarationStatement, int depth = 0);
+    template <class TreeBuilder> NEVER_INLINE TreeDestructuringPattern tryParseDestructuringPatternExpression(TreeBuilder&, AssignmentContext);
+    template <class TreeBuilder> NEVER_INLINE TreeExpression parseDefaultValueForDestructuringPattern(TreeBuilder&);
+    template <class TreeBuilder> TreeSourceElements parseModuleSourceElements(TreeBuilder&, SourceParseMode);
+    enum class ImportSpecifierType { NamespaceImport, NamedImport, DefaultImport };
+    template <class TreeBuilder> typename TreeBuilder::ImportSpecifier parseImportClauseItem(TreeBuilder&, ImportSpecifierType);
+    template <class TreeBuilder> typename TreeBuilder::ModuleName parseModuleName(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseImportDeclaration(TreeBuilder&);
+    template <class TreeBuilder> typename TreeBuilder::ExportSpecifier parseExportSpecifier(TreeBuilder& context, Vector<std::pair<const Identifier*, const Identifier*>>& maybeExportedLocalNames, bool& hasKeywordForLocalBindings);
+    template <class TreeBuilder> TreeStatement parseExportDeclaration(TreeBuilder&);
+
+    template <class TreeBuilder> ALWAYS_INLINE TreeExpression createResolveAndUseVariable(TreeBuilder&, const Identifier*, bool isEval, const JSTextPosition&, const JSTokenLocation&);
+
+    enum class FunctionDefinitionType { Expression, Declaration, Method };
+    template <class TreeBuilder> NEVER_INLINE bool parseFunctionInfo(TreeBuilder&, FunctionNameRequirements, SourceParseMode, bool nameIsInContainingScope, ConstructorKind, SuperBinding, int functionKeywordStart, ParserFunctionInfo<TreeBuilder>&, FunctionDefinitionType);
+    
+    ALWAYS_INLINE bool isArrowFunctionParameters();
+    
+    template <class TreeBuilder, class FunctionInfoType> NEVER_INLINE typename TreeBuilder::FormalParameterList parseFunctionParameters(TreeBuilder&, SourceParseMode, FunctionInfoType&);
+    template <class TreeBuilder> NEVER_INLINE typename TreeBuilder::FormalParameterList createGeneratorParameters(TreeBuilder&, unsigned& parameterCount);
+
+    template <class TreeBuilder> NEVER_INLINE TreeClassExpression parseClass(TreeBuilder&, FunctionNameRequirements, ParserClassInfo<TreeBuilder>&);
+
+    template <class TreeBuilder> NEVER_INLINE typename TreeBuilder::TemplateString parseTemplateString(TreeBuilder& context, bool isTemplateHead, typename LexerType::RawStringsBuildMode, bool& elementIsTail);
+    template <class TreeBuilder> NEVER_INLINE typename TreeBuilder::TemplateLiteral parseTemplateLiteral(TreeBuilder&, typename LexerType::RawStringsBuildMode);
+
+    template <class TreeBuilder> ALWAYS_INLINE bool shouldCheckPropertyForUnderscoreProtoDuplicate(TreeBuilder&, const TreeProperty&);
+
+    ALWAYS_INLINE int isBinaryOperator(JSTokenType);
+    bool allowAutomaticSemicolon();
+    
+    bool autoSemiColon()
+    {
+        if (m_token.m_type == SEMICOLON) {
+            next();
+            return true;
+        }
+        return allowAutomaticSemicolon();
+    }
+    
+    bool canRecurse()
+    {
+        return m_vm->isSafeToRecurse();
+    }
+    
+    const JSTextPosition& lastTokenEndPosition() const
+    {
+        return m_lastTokenEndPosition;
+    }
+
+    bool hasError() const
+    {
+        return !m_errorMessage.isNull();
+    }
+
+    bool isDisallowedIdentifierAwait(const JSToken& token)
+    {
+        return token.m_type == AWAIT && (!m_parserState.allowAwait || currentScope()->isAsyncFunctionBoundary() || m_scriptMode == JSParserScriptMode::Module);
+    }
+
+    const char* disallowedIdentifierAwaitReason()
+    {
+        if (!m_parserState.allowAwait || currentScope()->isAsyncFunctionBoundary())
+            return "in an async function";
+        if (m_scriptMode == JSParserScriptMode::Module)
+            return "in a module";
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    enum class FunctionParsePhase { Parameters, Body };
+    struct ParserState {
+        int assignmentCount { 0 };
+        int nonLHSCount { 0 };
+        int nonTrivialExpressionCount { 0 };
+        FunctionParsePhase functionParsePhase { FunctionParsePhase::Body };
+        const Identifier* lastIdentifier { nullptr };
+        const Identifier* lastFunctionName { nullptr };
+        bool allowAwait { true };
+    };
+
+    // If you're using this directly, you probably should be using
+    // createSavePoint() instead.
+    ALWAYS_INLINE ParserState internalSaveParserState()
+    {
+        return m_parserState;
+    }
+
+    ALWAYS_INLINE void restoreParserState(const ParserState& state)
+    {
+        m_parserState = state;
+    }
+
+    struct LexerState {
+        int startOffset;
+        unsigned oldLineStartOffset;
+        unsigned oldLastLineNumber;
+        unsigned oldLineNumber;
+    };
+
+    // If you're using this directly, you probably should be using
+    // createSavePoint() instead.
+    // i.e, if you parse any kind of AssignmentExpression between
+    // saving/restoring, you should definitely not be using this directly.
+    ALWAYS_INLINE LexerState internalSaveLexerState()
+    {
+        LexerState result;
+        result.startOffset = m_token.m_location.startOffset;
+        result.oldLineStartOffset = m_token.m_location.lineStartOffset;
+        result.oldLastLineNumber = m_lexer->lastLineNumber();
+        result.oldLineNumber = m_lexer->lineNumber();
+        ASSERT(static_cast<unsigned>(result.startOffset) >= result.oldLineStartOffset);
+        return result;
+    }
+
+    ALWAYS_INLINE void restoreLexerState(const LexerState& lexerState)
+    {
+        // setOffset clears lexer errors.
+        m_lexer->setOffset(lexerState.startOffset, lexerState.oldLineStartOffset);
+        m_lexer->setLineNumber(lexerState.oldLineNumber);
+        next();
+        m_lexer->setLastLineNumber(lexerState.oldLastLineNumber);
+    }
+
+    struct SavePoint {
+        ParserState parserState;
+        LexerState lexerState;
+    };
+
+    struct SavePointWithError : public SavePoint {
+        bool lexerError;
+        String lexerErrorMessage;
+        String parserErrorMessage;
+    };
+
+    ALWAYS_INLINE void internalSaveState(SavePoint& savePoint)
+    {
+        savePoint.parserState = internalSaveParserState();
+        savePoint.lexerState = internalSaveLexerState();
+    }
+    
+    ALWAYS_INLINE SavePointWithError createSavePointForError()
+    {
+        SavePointWithError savePoint;
+        internalSaveState(savePoint);
+        savePoint.lexerError = m_lexer->sawError();
+        savePoint.lexerErrorMessage = m_lexer->getErrorMessage();
+        savePoint.parserErrorMessage = m_errorMessage;
+        return savePoint;
+    }
+    
+    ALWAYS_INLINE SavePoint createSavePoint()
+    {
+        ASSERT(!hasError());
+        SavePoint savePoint;
+        internalSaveState(savePoint);
+        return savePoint;
+    }
+
+    ALWAYS_INLINE void internalRestoreState(const SavePoint& savePoint)
+    {
+        restoreLexerState(savePoint.lexerState);
+        restoreParserState(savePoint.parserState);
+    }
+
+    ALWAYS_INLINE void restoreSavePointWithError(const SavePointWithError& savePoint)
+    {
+        internalRestoreState(savePoint);
+        m_lexer->setSawError(savePoint.lexerError);
+        m_lexer->setErrorMessage(savePoint.lexerErrorMessage);
+        m_errorMessage = savePoint.parserErrorMessage;
+    }
+
+    ALWAYS_INLINE void restoreSavePoint(const SavePoint& savePoint)
+    {
+        internalRestoreState(savePoint);
+        m_errorMessage = String();
+    }
+
+    VM* m_vm;
+    const SourceCode* m_source;
+    ParserArena m_parserArena;
+    std::unique_ptr<LexerType> m_lexer;
+    FunctionParameters* m_parameters { nullptr };
+
+    ParserState m_parserState;
+    
+    bool m_hasStackOverflow;
+    String m_errorMessage;
+    JSToken m_token;
+    bool m_allowsIn;
+    JSTextPosition m_lastTokenEndPosition;
+    bool m_syntaxAlreadyValidated;
+    int m_statementDepth;
+    RefPtr<SourceProviderCache> m_functionCache;
+    SourceElements* m_sourceElements;
+    bool m_parsingBuiltin;
+    JSParserScriptMode m_scriptMode;
+    SuperBinding m_superBinding;
+    ConstructorKind m_defaultConstructorKind;
+    VariableEnvironment m_varDeclarations;
+    DeclarationStacks::FunctionStack m_funcDeclarations;
+    UniquedStringImplPtrSet m_sloppyModeHoistedFunctions;
+    CodeFeatures m_features;
+    int m_numConstants;
+    ExpressionErrorClassifier* m_expressionErrorClassifier;
+    bool m_isEvalContext;
+    bool m_immediateParentAllowsFunctionDeclarationInStatement;
+    RefPtr<ModuleScopeData> m_moduleScopeData;
+    DebuggerParseData* m_debuggerParseData;
+
+    struct DepthManager {
+        DepthManager(int* depth)
+        : m_originalDepth(*depth)
+        , m_depth(depth)
+        {
+        }
+        
+        ~DepthManager()
+        {
+            *m_depth = m_originalDepth;
+        }
+        
+    private:
+        int m_originalDepth;
+        int* m_depth;
+    };
+};
+
+
+template <typename LexerType>
+template <class ParsedNode>
+std::unique_ptr<ParsedNode> Parser<LexerType>::parse(ParserError& error, const Identifier& calleeName, SourceParseMode parseMode)
+{
+    int errLine;
+    String errMsg;
+
+    if (ParsedNode::scopeIsFunction)
+        m_lexer->setIsReparsingFunction();
+
+    m_sourceElements = 0;
+
+    errLine = -1;
+    errMsg = String();
+
+    JSTokenLocation startLocation(tokenLocation());
+    ASSERT(m_source->startColumn() > OrdinalNumber::beforeFirst());
+    unsigned startColumn = m_source->startColumn().zeroBasedInt();
+
+    String parseError = parseInner(calleeName, parseMode);
+
+    int lineNumber = m_lexer->lineNumber();
+    bool lexError = m_lexer->sawError();
+    String lexErrorMessage = lexError ? m_lexer->getErrorMessage() : String();
+    ASSERT(lexErrorMessage.isNull() != lexError);
+    m_lexer->clear();
+
+    if (!parseError.isNull() || lexError) {
+        errLine = lineNumber;
+        errMsg = !lexErrorMessage.isNull() ? lexErrorMessage : parseError;
+        m_sourceElements = 0;
+    }
+
+    std::unique_ptr<ParsedNode> result;
+    if (m_sourceElements) {
+        JSTokenLocation endLocation;
+        endLocation.line = m_lexer->lineNumber();
+        endLocation.lineStartOffset = m_lexer->currentLineStartOffset();
+        endLocation.startOffset = m_lexer->currentOffset();
+        unsigned endColumn = endLocation.startOffset - endLocation.lineStartOffset;
+        result = std::make_unique<ParsedNode>(m_parserArena,
+                                    startLocation,
+                                    endLocation,
+                                    startColumn,
+                                    endColumn,
+                                    m_sourceElements,
+                                    m_varDeclarations,
+                                    WTFMove(m_funcDeclarations),
+                                    currentScope()->finalizeLexicalEnvironment(),
+                                    WTFMove(m_sloppyModeHoistedFunctions),
+                                    m_parameters,
+                                    *m_source,
+                                    m_features,
+                                    currentScope()->innerArrowFunctionFeatures(),
+                                    m_numConstants,
+                                    WTFMove(m_moduleScopeData));
+        result->setLoc(m_source->firstLine().oneBasedInt(), m_lexer->lineNumber(), m_lexer->currentOffset(), m_lexer->currentLineStartOffset());
+        result->setEndOffset(m_lexer->currentOffset());
+
+        if (!isFunctionParseMode(parseMode)) {
+            m_source->provider()->setSourceURLDirective(m_lexer->sourceURL());
+            m_source->provider()->setSourceMappingURLDirective(m_lexer->sourceMappingURL());
+        }
+    } else {
+        // We can never see a syntax error when reparsing a function, since we should have
+        // reported the error when parsing the containing program or eval code. So if we're
+        // parsing a function body node, we assume that what actually happened here is that
+        // we ran out of stack while parsing. If we see an error while parsing eval or program
+        // code we assume that it was a syntax error since running out of stack is much less
+        // likely, and we are currently unable to distinguish between the two cases.
+        if (isFunctionMetadataNode(static_cast<ParsedNode*>(0)) || m_hasStackOverflow)
+            error = ParserError(ParserError::StackOverflow, ParserError::SyntaxErrorNone, m_token);
+        else {
+            ParserError::SyntaxErrorType errorType = ParserError::SyntaxErrorIrrecoverable;
+            if (m_token.m_type == EOFTOK)
+                errorType = ParserError::SyntaxErrorRecoverable;
+            else if (m_token.m_type & UnterminatedErrorTokenFlag) {
+                // Treat multiline capable unterminated literals as recoverable.
+                if (m_token.m_type == UNTERMINATED_MULTILINE_COMMENT_ERRORTOK || m_token.m_type == UNTERMINATED_TEMPLATE_LITERAL_ERRORTOK)
+                    errorType = ParserError::SyntaxErrorRecoverable;
+                else
+                    errorType = ParserError::SyntaxErrorUnterminatedLiteral;
+            }
+            
+            if (isEvalNode<ParsedNode>())
+                error = ParserError(ParserError::EvalError, errorType, m_token, errMsg, errLine);
+            else
+                error = ParserError(ParserError::SyntaxError, errorType, m_token, errMsg, errLine);
+        }
+    }
+
+    return result;
+}
+
+template <class ParsedNode>
+std::unique_ptr<ParsedNode> parse(
+    VM* vm, const SourceCode& source,
+    const Identifier& name, JSParserBuiltinMode builtinMode,
+    JSParserStrictMode strictMode, JSParserScriptMode scriptMode, SourceParseMode parseMode, SuperBinding superBinding,
+    ParserError& error, JSTextPosition* positionBeforeLastNewline = nullptr,
+    ConstructorKind defaultConstructorKind = ConstructorKind::None,
+    DerivedContextType derivedContextType = DerivedContextType::None,
+    EvalContextType evalContextType = EvalContextType::None,
+    DebuggerParseData* debuggerParseData = nullptr)
+{
+    ASSERT(!source.provider()->source().isNull());
+    if (source.provider()->source().is8Bit()) {
+        Parser<Lexer<LChar>> parser(vm, source, builtinMode, strictMode, scriptMode, parseMode, superBinding, defaultConstructorKind, derivedContextType, isEvalNode<ParsedNode>(), evalContextType, debuggerParseData);
+        std::unique_ptr<ParsedNode> result = parser.parse<ParsedNode>(error, name, parseMode);
+        if (positionBeforeLastNewline)
+            *positionBeforeLastNewline = parser.positionBeforeLastNewline();
+        if (builtinMode == JSParserBuiltinMode::Builtin) {
+            if (!result)
+                WTF::dataLog("Error compiling builtin: ", error.message(), "\n");
+        }
+        return result;
+    }
+    ASSERT_WITH_MESSAGE(defaultConstructorKind == ConstructorKind::None, "BuiltinExecutables::createDefaultConstructor should always use a 8-bit string");
+    Parser<Lexer<UChar>> parser(vm, source, builtinMode, strictMode, scriptMode, parseMode, superBinding, defaultConstructorKind, derivedContextType, isEvalNode<ParsedNode>(), evalContextType, debuggerParseData);
+    std::unique_ptr<ParsedNode> result = parser.parse<ParsedNode>(error, name, parseMode);
+    if (positionBeforeLastNewline)
+        *positionBeforeLastNewline = parser.positionBeforeLastNewline();
+    return result;
+}
+
+} // namespace
diff --git a/parser/ParserArena.cpp b/parser/ParserArena.cpp
new file mode 100644
index 0000000..a276887
--- /dev/null
+++ b/parser/ParserArena.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ParserArena.h"
+
+#include "Nodes.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+ParserArena::ParserArena()
+    : m_freeableMemory(0)
+    , m_freeablePoolEnd(0)
+{
+}
+
+inline void* ParserArena::freeablePool()
+{
+    ASSERT(m_freeablePoolEnd);
+    return m_freeablePoolEnd - freeablePoolSize;
+}
+
+inline void ParserArena::deallocateObjects()
+{
+    size_t size = m_deletableObjects.size();
+    for (size_t i = 0; i < size; ++i)
+        m_deletableObjects[i]->~ParserArenaDeletable();
+
+    if (m_freeablePoolEnd)
+        fastFree(freeablePool());
+
+    size = m_freeablePools.size();
+    for (size_t i = 0; i < size; ++i)
+        fastFree(m_freeablePools[i]);
+}
+
+ParserArena::~ParserArena()
+{
+    deallocateObjects();
+}
+
+void ParserArena::allocateFreeablePool()
+{
+    if (m_freeablePoolEnd)
+        m_freeablePools.append(freeablePool());
+
+    char* pool = static_cast<char*>(fastMalloc(freeablePoolSize));
+    m_freeableMemory = pool;
+    m_freeablePoolEnd = pool + freeablePoolSize;
+    ASSERT(freeablePool() == pool);
+}
+
+}
diff --git a/parser/ParserArena.h b/parser/ParserArena.h
new file mode 100644
index 0000000..16e065d
--- /dev/null
+++ b/parser/ParserArena.h
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CommonIdentifiers.h"
+#include "Identifier.h"
+#include <array>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+    class ParserArenaDeletable;
+
+    class IdentifierArena {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        IdentifierArena()
+        {
+            clear();
+        }
+
+        template <typename T>
+        ALWAYS_INLINE const Identifier& makeIdentifier(VM*, const T* characters, size_t length);
+        ALWAYS_INLINE const Identifier& makeEmptyIdentifier(VM*);
+        ALWAYS_INLINE const Identifier& makeIdentifierLCharFromUChar(VM*, const UChar* characters, size_t length);
+
+        const Identifier& makeNumericIdentifier(VM*, double number);
+
+    public:
+        static const int MaximumCachableCharacter = 128;
+        typedef SegmentedVector<Identifier, 64> IdentifierVector;
+        void clear()
+        {
+            m_identifiers.clear();
+            for (int i = 0; i < MaximumCachableCharacter; i++)
+                m_shortIdentifiers[i] = 0;
+            for (int i = 0; i < MaximumCachableCharacter; i++)
+                m_recentIdentifiers[i] = 0;
+        }
+
+    private:
+        IdentifierVector m_identifiers;
+        std::array<Identifier*, MaximumCachableCharacter> m_shortIdentifiers;
+        std::array<Identifier*, MaximumCachableCharacter> m_recentIdentifiers;
+    };
+
+    template <typename T>
+    ALWAYS_INLINE const Identifier& IdentifierArena::makeIdentifier(VM* vm, const T* characters, size_t length)
+    {
+        if (!length)
+            return vm->propertyNames->emptyIdentifier;
+        if (characters[0] >= MaximumCachableCharacter) {
+            m_identifiers.append(Identifier::fromString(vm, characters, length));
+            return m_identifiers.last();
+        }
+        if (length == 1) {
+            if (Identifier* ident = m_shortIdentifiers[characters[0]])
+                return *ident;
+            m_identifiers.append(Identifier::fromString(vm, characters, length));
+            m_shortIdentifiers[characters[0]] = &m_identifiers.last();
+            return m_identifiers.last();
+        }
+        Identifier* ident = m_recentIdentifiers[characters[0]];
+        if (ident && Identifier::equal(ident->impl(), characters, length))
+            return *ident;
+        m_identifiers.append(Identifier::fromString(vm, characters, length));
+        m_recentIdentifiers[characters[0]] = &m_identifiers.last();
+        return m_identifiers.last();
+    }
+
+    ALWAYS_INLINE const Identifier& IdentifierArena::makeEmptyIdentifier(VM* vm)
+    {
+        return vm->propertyNames->emptyIdentifier;
+    }
+
+    ALWAYS_INLINE const Identifier& IdentifierArena::makeIdentifierLCharFromUChar(VM* vm, const UChar* characters, size_t length)
+    {
+        if (!length)
+            return vm->propertyNames->emptyIdentifier;
+        if (characters[0] >= MaximumCachableCharacter) {
+            m_identifiers.append(Identifier::createLCharFromUChar(vm, characters, length));
+            return m_identifiers.last();
+        }
+        if (length == 1) {
+            if (Identifier* ident = m_shortIdentifiers[characters[0]])
+                return *ident;
+            m_identifiers.append(Identifier::fromString(vm, characters, length));
+            m_shortIdentifiers[characters[0]] = &m_identifiers.last();
+            return m_identifiers.last();
+        }
+        Identifier* ident = m_recentIdentifiers[characters[0]];
+        if (ident && Identifier::equal(ident->impl(), characters, length))
+            return *ident;
+        m_identifiers.append(Identifier::createLCharFromUChar(vm, characters, length));
+        m_recentIdentifiers[characters[0]] = &m_identifiers.last();
+        return m_identifiers.last();
+    }
+    
+    inline const Identifier& IdentifierArena::makeNumericIdentifier(VM* vm, double number)
+    {
+        m_identifiers.append(Identifier::fromString(vm, String::numberToStringECMAScript(number)));
+        return m_identifiers.last();
+    }
+
+    class ParserArena {
+        WTF_MAKE_NONCOPYABLE(ParserArena);
+    public:
+        ParserArena();
+        ~ParserArena();
+
+        void swap(ParserArena& otherArena)
+        {
+            std::swap(m_freeableMemory, otherArena.m_freeableMemory);
+            std::swap(m_freeablePoolEnd, otherArena.m_freeablePoolEnd);
+            m_identifierArena.swap(otherArena.m_identifierArena);
+            m_freeablePools.swap(otherArena.m_freeablePools);
+            m_deletableObjects.swap(otherArena.m_deletableObjects);
+        }
+
+        void* allocateFreeable(size_t size)
+        {
+            ASSERT(size);
+            ASSERT(size <= freeablePoolSize);
+            size_t alignedSize = alignSize(size);
+            ASSERT(alignedSize <= freeablePoolSize);
+            if (UNLIKELY(static_cast<size_t>(m_freeablePoolEnd - m_freeableMemory) < alignedSize))
+                allocateFreeablePool();
+            void* block = m_freeableMemory;
+            m_freeableMemory += alignedSize;
+            return block;
+        }
+
+        void* allocateDeletable(size_t size)
+        {
+            ParserArenaDeletable* deletable = static_cast<ParserArenaDeletable*>(allocateFreeable(size));
+            m_deletableObjects.append(deletable);
+            return deletable;
+        }
+
+        IdentifierArena& identifierArena()
+        {
+            if (UNLIKELY (!m_identifierArena))
+                m_identifierArena = std::make_unique<IdentifierArena>();
+            return *m_identifierArena;
+        }
+
+    private:
+        static const size_t freeablePoolSize = 8000;
+
+        static size_t alignSize(size_t size)
+        {
+            return (size + sizeof(WTF::AllocAlignmentInteger) - 1) & ~(sizeof(WTF::AllocAlignmentInteger) - 1);
+        }
+
+        void* freeablePool();
+        void allocateFreeablePool();
+        void deallocateObjects();
+
+        char* m_freeableMemory;
+        char* m_freeablePoolEnd;
+
+        std::unique_ptr<IdentifierArena> m_identifierArena;
+        Vector<void*> m_freeablePools;
+        Vector<ParserArenaDeletable*> m_deletableObjects;
+    };
+
+} // namespace JSC
diff --git a/parser/ParserError.h b/parser/ParserError.h
new file mode 100644
index 0000000..7883efe
--- /dev/null
+++ b/parser/ParserError.h
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Error.h"
+#include "ErrorHandlingScope.h"
+#include "ExceptionHelpers.h"
+#include "ParserTokens.h"
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class ParserError {
+public:
+    enum SyntaxErrorType {
+        SyntaxErrorNone,
+        SyntaxErrorIrrecoverable,
+        SyntaxErrorUnterminatedLiteral,
+        SyntaxErrorRecoverable
+    };
+
+    enum ErrorType {
+        ErrorNone,
+        StackOverflow,
+        EvalError,
+        OutOfMemory,
+        SyntaxError
+    };
+
+    ParserError()
+        : m_type(ErrorNone)
+        , m_syntaxErrorType(SyntaxErrorNone)
+    {
+    }
+    
+    explicit ParserError(ErrorType type)
+        : m_type(type)
+        , m_syntaxErrorType(SyntaxErrorNone)
+    {
+    }
+
+    ParserError(ErrorType type, SyntaxErrorType syntaxError, JSToken token)
+        : m_token(token)
+        , m_type(type)
+        , m_syntaxErrorType(syntaxError)
+    {
+    }
+
+    ParserError(ErrorType type, SyntaxErrorType syntaxError, JSToken token, const String& msg, int line)
+        : m_token(token)
+        , m_message(msg)
+        , m_line(line)
+        , m_type(type)
+        , m_syntaxErrorType(syntaxError)
+    {
+    }
+
+    bool isValid() const { return m_type != ErrorNone; }
+    SyntaxErrorType syntaxErrorType() const { return m_syntaxErrorType; }
+    const JSToken& token() const { return m_token; }
+    const String& message() const { return m_message; }
+    int line() const { return m_line; }
+
+    JSObject* toErrorObject(
+        JSGlobalObject* globalObject, const SourceCode& source, 
+        int overrideLineNumber = -1)
+    {
+        ExecState* exec = globalObject->globalExec();
+        switch (m_type) {
+        case ErrorNone:
+            return nullptr;
+        case SyntaxError:
+            return addErrorInfo(
+                exec, 
+                createSyntaxError(exec, m_message), 
+                overrideLineNumber == -1 ? m_line : overrideLineNumber, source);
+        case EvalError:
+            return createSyntaxError(exec, m_message);
+        case StackOverflow: {
+            ErrorHandlingScope errorScope(globalObject->vm());
+            return createStackOverflowError(exec);
+        }
+        case OutOfMemory:
+            return createOutOfMemoryError(exec);
+        }
+        CRASH();
+        return nullptr;
+    }
+
+private:
+    JSToken m_token;
+    String m_message;
+    int m_line { -1 };
+    ErrorType m_type;
+    SyntaxErrorType m_syntaxErrorType;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::ParserError::SyntaxErrorType type)
+{
+    switch (type) {
+    case JSC::ParserError::SyntaxErrorNone:
+        out.print("SyntaxErrorNone");
+        return;
+    case JSC::ParserError::SyntaxErrorIrrecoverable:
+        out.print("SyntaxErrorIrrecoverable");
+        return;
+    case JSC::ParserError::SyntaxErrorUnterminatedLiteral:
+        out.print("SyntaxErrorUnterminatedLiteral");
+        return;
+    case JSC::ParserError::SyntaxErrorRecoverable:
+        out.print("SyntaxErrorRecoverable");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+inline void printInternal(PrintStream& out, JSC::ParserError::ErrorType type)
+{
+    switch (type) {
+    case JSC::ParserError::ErrorNone:
+        out.print("ErrorNone");
+        return;
+    case JSC::ParserError::StackOverflow:
+        out.print("StackOverflow");
+        return;
+    case JSC::ParserError::EvalError:
+        out.print("EvalError");
+        return;
+    case JSC::ParserError::OutOfMemory:
+        out.print("OutOfMemory");
+        return;
+    case JSC::ParserError::SyntaxError:
+        out.print("SyntaxError");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
diff --git a/parser/ParserFunctionInfo.h b/parser/ParserFunctionInfo.h
new file mode 100644
index 0000000..b9fd679
--- /dev/null
+++ b/parser/ParserFunctionInfo.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+template <class TreeBuilder>
+struct ParserFunctionInfo {
+    const Identifier* name = 0;
+    typename TreeBuilder::FunctionBody body = 0;
+    unsigned parameterCount = 0;
+    unsigned functionLength = 0;
+    unsigned startOffset = 0;
+    unsigned endOffset = 0;
+    int startLine = 0;
+    int endLine = 0;
+    unsigned parametersStartColumn = 0;
+};
+
+template <class TreeBuilder>
+struct ParserClassInfo {
+    const Identifier* className { nullptr };
+    unsigned startOffset { 0 };
+    unsigned endOffset { 0 };
+    int startLine { 0 };
+    unsigned startColumn { 0 };
+};
+
+}
diff --git a/parser/ParserModes.h b/parser/ParserModes.h
new file mode 100644
index 0000000..6da8837
--- /dev/null
+++ b/parser/ParserModes.h
@@ -0,0 +1,251 @@
+/*
+ * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConstructAbility.h"
+#include "Identifier.h"
+
+namespace JSC {
+
+enum class JSParserStrictMode { NotStrict, Strict };
+enum class JSParserBuiltinMode { NotBuiltin, Builtin };
+enum class JSParserScriptMode { Classic, Module };
+enum class JSParserCodeType { Program, Function, Module };
+
+enum class ConstructorKind { None, Base, Extends };
+enum class SuperBinding { Needed, NotNeeded };
+
+enum DebuggerMode { DebuggerOff, DebuggerOn };
+
+enum class FunctionMode { FunctionExpression, FunctionDeclaration, MethodDefinition };
+
+enum class SourceParseMode : uint16_t {
+    NormalFunctionMode            = 0b0000000000000001,
+    GeneratorBodyMode             = 0b0000000000000010,
+    GeneratorWrapperFunctionMode  = 0b0000000000000100,
+    GetterMode                    = 0b0000000000001000,
+    SetterMode                    = 0b0000000000010000,
+    MethodMode                    = 0b0000000000100000,
+    ArrowFunctionMode             = 0b0000000001000000,
+    AsyncFunctionBodyMode         = 0b0000000010000000,
+    AsyncArrowFunctionBodyMode    = 0b0000000100000000,
+    AsyncFunctionMode             = 0b0000001000000000,
+    AsyncMethodMode               = 0b0000010000000000,
+    AsyncArrowFunctionMode        = 0b0000100000000000,
+    ProgramMode                   = 0b0001000000000000,
+    ModuleAnalyzeMode             = 0b0010000000000000,
+    ModuleEvaluateMode            = 0b0100000000000000,
+};
+
+class SourceParseModeSet { 
+public: 
+    template<typename... Modes> 
+    SourceParseModeSet(Modes... args) 
+        : m_mask(mergeSourceParseModes(args...)) 
+    { 
+    } 
+
+    ALWAYS_INLINE bool contains(SourceParseMode mode) 
+    { 
+        return static_cast<unsigned>(mode) & m_mask; 
+    } 
+
+private: 
+    ALWAYS_INLINE static unsigned mergeSourceParseModes(SourceParseMode mode) 
+    { 
+        return static_cast<unsigned>(mode); 
+    } 
+
+    template<typename... Rest> 
+    ALWAYS_INLINE static unsigned mergeSourceParseModes(SourceParseMode mode, Rest... rest) 
+    { 
+        return static_cast<unsigned>(mode) | mergeSourceParseModes(rest...); 
+    } 
+
+    const unsigned m_mask; 
+}; 
+
+ALWAYS_INLINE bool isFunctionParseMode(SourceParseMode parseMode) 
+{ 
+    return SourceParseModeSet( 
+        SourceParseMode::NormalFunctionMode, 
+        SourceParseMode::GeneratorBodyMode, 
+        SourceParseMode::GeneratorWrapperFunctionMode, 
+        SourceParseMode::GetterMode, 
+        SourceParseMode::SetterMode, 
+        SourceParseMode::MethodMode, 
+        SourceParseMode::ArrowFunctionMode, 
+        SourceParseMode::AsyncFunctionBodyMode, 
+        SourceParseMode::AsyncFunctionMode, 
+        SourceParseMode::AsyncMethodMode, 
+        SourceParseMode::AsyncArrowFunctionMode, 
+        SourceParseMode::AsyncArrowFunctionBodyMode).contains(parseMode); 
+} 
+
+ALWAYS_INLINE bool isAsyncFunctionParseMode(SourceParseMode parseMode) 
+{ 
+    return SourceParseModeSet( 
+        SourceParseMode::AsyncFunctionBodyMode, 
+        SourceParseMode::AsyncFunctionMode, 
+        SourceParseMode::AsyncMethodMode, 
+        SourceParseMode::AsyncArrowFunctionMode, 
+        SourceParseMode::AsyncArrowFunctionBodyMode).contains(parseMode); 
+} 
+
+ALWAYS_INLINE bool isAsyncArrowFunctionParseMode(SourceParseMode parseMode) 
+{ 
+    return SourceParseModeSet( 
+        SourceParseMode::AsyncArrowFunctionMode, 
+        SourceParseMode::AsyncArrowFunctionBodyMode).contains(parseMode); 
+} 
+
+ALWAYS_INLINE bool isAsyncFunctionWrapperParseMode(SourceParseMode parseMode) 
+{ 
+    return SourceParseModeSet( 
+        SourceParseMode::AsyncArrowFunctionMode, 
+        SourceParseMode::AsyncFunctionMode, 
+        SourceParseMode::AsyncMethodMode).contains(parseMode); 
+} 
+
+ALWAYS_INLINE bool isAsyncFunctionBodyParseMode(SourceParseMode parseMode) 
+{ 
+    return SourceParseModeSet( 
+        SourceParseMode::AsyncFunctionBodyMode, 
+        SourceParseMode::AsyncArrowFunctionBodyMode).contains(parseMode); 
+} 
+
+ALWAYS_INLINE bool isMethodParseMode(SourceParseMode parseMode)
+{
+    return SourceParseModeSet(
+        // FIXME: GeneratorWrapperFunctionMode is not guaranteed to be a method.
+        SourceParseMode::GeneratorWrapperFunctionMode,
+        SourceParseMode::GetterMode,
+        SourceParseMode::SetterMode,
+        SourceParseMode::MethodMode,
+        SourceParseMode::AsyncMethodMode).contains(parseMode);
+}
+
+ALWAYS_INLINE bool isGeneratorOrAsyncFunctionBodyParseMode(SourceParseMode parseMode)
+{
+    return SourceParseModeSet(
+        SourceParseMode::GeneratorBodyMode,
+        SourceParseMode::AsyncFunctionBodyMode,
+        SourceParseMode::AsyncArrowFunctionBodyMode).contains(parseMode);
+}
+
+ALWAYS_INLINE bool isGeneratorOrAsyncFunctionWrapperParseMode(SourceParseMode parseMode)
+{
+    return SourceParseModeSet(
+        SourceParseMode::GeneratorWrapperFunctionMode,
+        SourceParseMode::AsyncFunctionMode,
+        SourceParseMode::AsyncArrowFunctionMode,
+        SourceParseMode::AsyncMethodMode).contains(parseMode);
+}
+
+ALWAYS_INLINE bool isArrowFunctionParseMode(SourceParseMode parseMode)
+{
+    return SourceParseModeSet(
+        SourceParseMode::ArrowFunctionMode,
+        SourceParseMode::AsyncArrowFunctionMode,
+        SourceParseMode::AsyncArrowFunctionBodyMode).contains(parseMode);
+}
+
+
+ALWAYS_INLINE bool isModuleParseMode(SourceParseMode parseMode) 
+{ 
+    return SourceParseModeSet( 
+        SourceParseMode::ModuleAnalyzeMode, 
+        SourceParseMode::ModuleEvaluateMode).contains(parseMode); 
+} 
+
+ALWAYS_INLINE bool isProgramParseMode(SourceParseMode parseMode) 
+{ 
+    return SourceParseModeSet(SourceParseMode::ProgramMode).contains(parseMode); 
+} 
+
+ALWAYS_INLINE ConstructAbility constructAbilityForParseMode(SourceParseMode parseMode) 
+{ 
+    if (parseMode == SourceParseMode::NormalFunctionMode) 
+        return ConstructAbility::CanConstruct;
+
+    return ConstructAbility::CannotConstruct;
+}
+
+inline bool functionNameIsInScope(const Identifier& name, FunctionMode functionMode)
+{
+    if (name.isNull())
+        return false;
+
+    if (functionMode != FunctionMode::FunctionExpression)
+        return false;
+
+    return true;
+}
+
+inline bool functionNameScopeIsDynamic(bool usesEval, bool isStrictMode)
+{
+    // If non-strict eval is in play, a function gets a separate object in the scope chain for its name.
+    // This enables eval to declare and then delete a name that shadows the function's name.
+
+    if (!usesEval)
+        return false;
+
+    if (isStrictMode)
+        return false;
+
+    return true;
+}
+
+typedef uint16_t CodeFeatures;
+
+const CodeFeatures NoFeatures =                       0;
+const CodeFeatures EvalFeature =                 1 << 0;
+const CodeFeatures ArgumentsFeature =            1 << 1;
+const CodeFeatures WithFeature =                 1 << 2;
+const CodeFeatures ThisFeature =                 1 << 3;
+const CodeFeatures StrictModeFeature =           1 << 4;
+const CodeFeatures ShadowsArgumentsFeature =     1 << 5;
+const CodeFeatures ArrowFunctionFeature =        1 << 6;
+const CodeFeatures ArrowFunctionContextFeature = 1 << 7;
+const CodeFeatures SuperCallFeature =            1 << 8;
+const CodeFeatures SuperPropertyFeature =        1 << 9;
+const CodeFeatures NewTargetFeature =            1 << 10;
+
+const CodeFeatures AllFeatures = EvalFeature | ArgumentsFeature | WithFeature | ThisFeature | StrictModeFeature | ShadowsArgumentsFeature | ArrowFunctionFeature | ArrowFunctionContextFeature |
+    SuperCallFeature | SuperPropertyFeature | NewTargetFeature;
+
+typedef uint8_t InnerArrowFunctionCodeFeatures;
+    
+const InnerArrowFunctionCodeFeatures NoInnerArrowFunctionFeatures =                0;
+const InnerArrowFunctionCodeFeatures EvalInnerArrowFunctionFeature =          1 << 0;
+const InnerArrowFunctionCodeFeatures ArgumentsInnerArrowFunctionFeature =     1 << 1;
+const InnerArrowFunctionCodeFeatures ThisInnerArrowFunctionFeature =          1 << 2;
+const InnerArrowFunctionCodeFeatures SuperCallInnerArrowFunctionFeature =     1 << 3;
+const InnerArrowFunctionCodeFeatures SuperPropertyInnerArrowFunctionFeature = 1 << 4;
+const InnerArrowFunctionCodeFeatures NewTargetInnerArrowFunctionFeature =     1 << 5;
+    
+const InnerArrowFunctionCodeFeatures AllInnerArrowFunctionCodeFeatures = EvalInnerArrowFunctionFeature | ArgumentsInnerArrowFunctionFeature | ThisInnerArrowFunctionFeature | SuperCallInnerArrowFunctionFeature | SuperPropertyInnerArrowFunctionFeature | NewTargetInnerArrowFunctionFeature;
+} // namespace JSC
diff --git a/parser/ParserTokens.h b/parser/ParserTokens.h
new file mode 100644
index 0000000..f70fc3a
--- /dev/null
+++ b/parser/ParserTokens.h
@@ -0,0 +1,262 @@
+/*
+ * Copyright (C) 2010, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ParserModes.h"
+#include <limits.h>
+#include <stdint.h>
+
+namespace JSC {
+
+class Identifier;
+
+enum {
+    // Token Bitfield: 0b000000000RTE000IIIIPPPPKUXXXXXXX
+    // R = right-associative bit
+    // T = unterminated error flag
+    // E = error flag
+    // I = binary operator allows 'in'
+    // P = binary operator precedence
+    // K = keyword flag
+    // U = unary operator flag
+    UnaryOpTokenFlag = 128,
+    KeywordTokenFlag = 256,
+    BinaryOpTokenPrecedenceShift = 9,
+    BinaryOpTokenAllowsInPrecedenceAdditionalShift = 4,
+    BinaryOpTokenPrecedenceMask = 15 << BinaryOpTokenPrecedenceShift,
+    ErrorTokenFlag = 1 << (BinaryOpTokenAllowsInPrecedenceAdditionalShift + BinaryOpTokenPrecedenceShift + 7),
+    UnterminatedErrorTokenFlag = ErrorTokenFlag << 1,
+    RightAssociativeBinaryOpTokenFlag = UnterminatedErrorTokenFlag << 1
+};
+
+#define BINARY_OP_PRECEDENCE(prec) (((prec) << BinaryOpTokenPrecedenceShift) | ((prec) << (BinaryOpTokenPrecedenceShift + BinaryOpTokenAllowsInPrecedenceAdditionalShift)))
+#define IN_OP_PRECEDENCE(prec) ((prec) << (BinaryOpTokenPrecedenceShift + BinaryOpTokenAllowsInPrecedenceAdditionalShift))
+
+enum JSTokenType {
+    NULLTOKEN = KeywordTokenFlag,
+    TRUETOKEN,
+    FALSETOKEN,
+    BREAK,
+    CASE,
+    DEFAULT,
+    FOR,
+    NEW,
+    VAR,
+    CONSTTOKEN,
+    CONTINUE,
+    FUNCTION,
+    RETURN,
+    IF,
+    THISTOKEN,
+    DO,
+    WHILE,
+    SWITCH,
+    WITH,
+    RESERVED,
+    RESERVED_IF_STRICT,
+    THROW,
+    TRY,
+    CATCH,
+    FINALLY,
+    DEBUGGER,
+    ELSE,
+    IMPORT,
+    EXPORT,
+    CLASSTOKEN,
+    EXTENDS,
+    SUPER,
+
+    // Contextual keywords
+    
+    LET,
+    YIELD,
+    AWAIT,
+    ASYNC,
+
+    FirstContextualKeywordToken = LET,
+    LastContextualKeywordToken = ASYNC,
+    FirstSafeContextualKeywordToken = AWAIT,
+    LastSafeContextualKeywordToken = LastContextualKeywordToken,
+
+    OPENBRACE = 0,
+    CLOSEBRACE,
+    OPENPAREN,
+    CLOSEPAREN,
+    OPENBRACKET,
+    CLOSEBRACKET,
+    COMMA,
+    QUESTION,
+    INTEGER,
+    DOUBLE,
+    IDENT,
+    STRING,
+    TEMPLATE,
+    REGEXP,
+    SEMICOLON,
+    COLON,
+    DOT,
+    EOFTOK,
+    EQUAL,
+    PLUSEQUAL,
+    MINUSEQUAL,
+    MULTEQUAL,
+    DIVEQUAL,
+    LSHIFTEQUAL,
+    RSHIFTEQUAL,
+    URSHIFTEQUAL,
+    ANDEQUAL,
+    MODEQUAL,
+    POWEQUAL,
+    XOREQUAL,
+    OREQUAL,
+    DOTDOTDOT,
+    ARROWFUNCTION,
+    LastUntaggedToken,
+
+    // Begin tagged tokens
+    PLUSPLUS = 0 | UnaryOpTokenFlag,
+    MINUSMINUS = 1 | UnaryOpTokenFlag,
+    AUTOPLUSPLUS = 2 | UnaryOpTokenFlag,
+    AUTOMINUSMINUS = 3 | UnaryOpTokenFlag,
+    EXCLAMATION = 4 | UnaryOpTokenFlag,
+    TILDE = 5 | UnaryOpTokenFlag,
+    TYPEOF = 6 | UnaryOpTokenFlag | KeywordTokenFlag,
+    VOIDTOKEN = 7 | UnaryOpTokenFlag | KeywordTokenFlag,
+    DELETETOKEN = 8 | UnaryOpTokenFlag | KeywordTokenFlag,
+    OR = 0 | BINARY_OP_PRECEDENCE(1),
+    AND = 1 | BINARY_OP_PRECEDENCE(2),
+    BITOR = 2 | BINARY_OP_PRECEDENCE(3),
+    BITXOR = 3 | BINARY_OP_PRECEDENCE(4),
+    BITAND = 4 | BINARY_OP_PRECEDENCE(5),
+    EQEQ = 5 | BINARY_OP_PRECEDENCE(6),
+    NE = 6 | BINARY_OP_PRECEDENCE(6),
+    STREQ = 7 | BINARY_OP_PRECEDENCE(6),
+    STRNEQ = 8 | BINARY_OP_PRECEDENCE(6),
+    LT = 9 | BINARY_OP_PRECEDENCE(7),
+    GT = 10 | BINARY_OP_PRECEDENCE(7),
+    LE = 11 | BINARY_OP_PRECEDENCE(7),
+    GE = 12 | BINARY_OP_PRECEDENCE(7),
+    INSTANCEOF = 13 | BINARY_OP_PRECEDENCE(7) | KeywordTokenFlag,
+    INTOKEN = 14 | IN_OP_PRECEDENCE(7) | KeywordTokenFlag,
+    LSHIFT = 15 | BINARY_OP_PRECEDENCE(8),
+    RSHIFT = 16 | BINARY_OP_PRECEDENCE(8),
+    URSHIFT = 17 | BINARY_OP_PRECEDENCE(8),
+    PLUS = 18 | BINARY_OP_PRECEDENCE(9) | UnaryOpTokenFlag,
+    MINUS = 19 | BINARY_OP_PRECEDENCE(9) | UnaryOpTokenFlag,
+    TIMES = 20 | BINARY_OP_PRECEDENCE(10),
+    DIVIDE = 21 | BINARY_OP_PRECEDENCE(10),
+    MOD = 22 | BINARY_OP_PRECEDENCE(10),
+    POW = 23 | BINARY_OP_PRECEDENCE(11) | RightAssociativeBinaryOpTokenFlag, // Make sure that POW has the highest operator precedence.
+    ERRORTOK = 0 | ErrorTokenFlag,
+    UNTERMINATED_IDENTIFIER_ESCAPE_ERRORTOK = 0 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    INVALID_IDENTIFIER_ESCAPE_ERRORTOK = 1 | ErrorTokenFlag,
+    UNTERMINATED_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK = 2 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    INVALID_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK = 3 | ErrorTokenFlag,
+    UNTERMINATED_MULTILINE_COMMENT_ERRORTOK = 4 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    UNTERMINATED_NUMERIC_LITERAL_ERRORTOK = 5 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    UNTERMINATED_OCTAL_NUMBER_ERRORTOK = 6 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    INVALID_NUMERIC_LITERAL_ERRORTOK = 7 | ErrorTokenFlag,
+    UNTERMINATED_STRING_LITERAL_ERRORTOK = 8 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    INVALID_STRING_LITERAL_ERRORTOK = 9 | ErrorTokenFlag,
+    INVALID_PRIVATE_NAME_ERRORTOK = 10 | ErrorTokenFlag,
+    UNTERMINATED_HEX_NUMBER_ERRORTOK = 11 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    UNTERMINATED_BINARY_NUMBER_ERRORTOK = 12 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    UNTERMINATED_TEMPLATE_LITERAL_ERRORTOK = 13 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    UNTERMINATED_REGEXP_LITERAL_ERRORTOK = 14 | ErrorTokenFlag | UnterminatedErrorTokenFlag,
+    INVALID_TEMPLATE_LITERAL_ERRORTOK = 15 | ErrorTokenFlag,
+};
+
+struct JSTextPosition {
+    JSTextPosition() : line(0), offset(0), lineStartOffset(0) { }
+    JSTextPosition(int _line, int _offset, int _lineStartOffset) : line(_line), offset(_offset), lineStartOffset(_lineStartOffset) { }
+    JSTextPosition(const JSTextPosition& other) : line(other.line), offset(other.offset), lineStartOffset(other.lineStartOffset) { }
+
+    JSTextPosition operator+(int adjustment) const { return JSTextPosition(line, offset + adjustment, lineStartOffset); }
+    JSTextPosition operator+(unsigned adjustment) const { return *this + static_cast<int>(adjustment); }
+    JSTextPosition operator-(int adjustment) const { return *this + (- adjustment); }
+    JSTextPosition operator-(unsigned adjustment) const { return *this + (- static_cast<int>(adjustment)); }
+
+    operator int() const { return offset; }
+
+    int line;
+    int offset;
+    int lineStartOffset;
+};
+
+union JSTokenData {
+    struct {
+        uint32_t line;
+        uint32_t offset;
+        uint32_t lineStartOffset;
+    };
+    double doubleValue;
+    const Identifier* ident;
+    struct {
+        const Identifier* cooked;
+        const Identifier* raw;
+        bool isTail;
+    };
+    struct {
+        const Identifier* pattern;
+        const Identifier* flags;
+    };
+};
+
+struct JSTokenLocation {
+    JSTokenLocation() : line(0), lineStartOffset(0), startOffset(0) { }
+    JSTokenLocation(const JSTokenLocation& location)
+    {
+        line = location.line;
+        lineStartOffset = location.lineStartOffset;
+        startOffset = location.startOffset;
+        endOffset = location.endOffset;
+    }
+
+    int line;
+    unsigned lineStartOffset;
+    unsigned startOffset;
+    unsigned endOffset;
+};
+
+struct JSToken {
+    JSTokenType m_type;
+    JSTokenData m_data;
+    JSTokenLocation m_location;
+    JSTextPosition m_startPosition;
+    JSTextPosition m_endPosition;
+};
+
+ALWAYS_INLINE bool isUpdateOp(JSTokenType token)
+{
+    return token >= PLUSPLUS && token <= AUTOMINUSMINUS;
+}
+
+ALWAYS_INLINE bool isUnaryOp(JSTokenType token)
+{
+    return token & UnaryOpTokenFlag;
+}
+
+} // namespace JSC
diff --git a/parser/ResultType.h b/parser/ResultType.h
new file mode 100644
index 0000000..4f6471b
--- /dev/null
+++ b/parser/ResultType.h
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+    struct ResultType {
+    private:
+        friend struct OperandTypes;
+
+        typedef uint8_t Type;
+        static const Type TypeInt32 = 1;
+        static const Type TypeMaybeNumber = 0x02;
+        static const Type TypeMaybeString = 0x04;
+        static const Type TypeMaybeNull   = 0x08;
+        static const Type TypeMaybeBool   = 0x10;
+        static const Type TypeMaybeOther  = 0x20;
+
+        static const Type TypeBits = TypeMaybeNumber | TypeMaybeString | TypeMaybeNull | TypeMaybeBool | TypeMaybeOther;
+
+    public:
+        static const int numBitsNeeded = 6;
+        static_assert((TypeBits & ((1 << numBitsNeeded) - 1)) == TypeBits, "This is necessary for correctness.");
+
+        explicit ResultType(Type type)
+            : m_bits(type)
+        {
+        }
+
+        bool isInt32() const
+        {
+            return m_bits & TypeInt32;
+        }
+
+        bool definitelyIsNumber() const
+        {
+            return (m_bits & TypeBits) == TypeMaybeNumber;
+        }
+        
+        bool definitelyIsString() const
+        {
+            return (m_bits & TypeBits) == TypeMaybeString;
+        }
+
+        bool definitelyIsBoolean() const
+        {
+            return (m_bits & TypeBits) == TypeMaybeBool;
+        }
+
+        bool mightBeNumber() const
+        {
+            return m_bits & TypeMaybeNumber;
+        }
+
+        bool isNotNumber() const
+        {
+            return !mightBeNumber();
+        }
+        
+        static ResultType nullType()
+        {
+            return ResultType(TypeMaybeNull);
+        }
+        
+        static ResultType booleanType()
+        {
+            return ResultType(TypeMaybeBool);
+        }
+        
+        static ResultType numberType()
+        {
+            return ResultType(TypeMaybeNumber);
+        }
+        
+        static ResultType numberTypeIsInt32()
+        {
+            return ResultType(TypeInt32 | TypeMaybeNumber);
+        }
+        
+        static ResultType stringOrNumberType()
+        {
+            return ResultType(TypeMaybeNumber | TypeMaybeString);
+        }
+        
+        static ResultType stringType()
+        {
+            return ResultType(TypeMaybeString);
+        }
+        
+        static ResultType unknownType()
+        {
+            return ResultType(TypeBits);
+        }
+        
+        static ResultType forAdd(ResultType op1, ResultType op2)
+        {
+            if (op1.definitelyIsNumber() && op2.definitelyIsNumber())
+                return numberType();
+            if (op1.definitelyIsString() || op2.definitelyIsString())
+                return stringType();
+            return stringOrNumberType();
+        }
+
+        // Unlike in C, a logical op produces the value of the
+        // last expression evaluated (and not true or false).
+        static ResultType forLogicalOp(ResultType op1, ResultType op2)
+        {
+            if (op1.definitelyIsBoolean() && op2.definitelyIsBoolean())
+                return booleanType();
+            if (op1.definitelyIsNumber() && op2.definitelyIsNumber())
+                return numberType();
+            if (op1.definitelyIsString() && op2.definitelyIsString())
+                return stringType();
+            return unknownType();
+        }
+
+        static ResultType forBitOp()
+        {
+            return numberTypeIsInt32();
+        }
+
+        Type bits() const { return m_bits; }
+
+    private:
+        Type m_bits;
+    };
+    
+    struct OperandTypes
+    {
+        OperandTypes(ResultType first = ResultType::unknownType(), ResultType second = ResultType::unknownType())
+        {
+            // We have to initialize one of the int to ensure that
+            // the entire struct is initialized.
+            m_u.i = 0;
+            m_u.rds.first = first.m_bits;
+            m_u.rds.second = second.m_bits;
+        }
+        
+        union {
+            struct {
+                ResultType::Type first;
+                ResultType::Type second;
+            } rds;
+            int i;
+        } m_u;
+
+        ResultType first()
+        {
+            return ResultType(m_u.rds.first);
+        }
+
+        ResultType second()
+        {
+            return ResultType(m_u.rds.second);
+        }
+
+        int toInt()
+        {
+            return m_u.i;
+        }
+        static OperandTypes fromInt(int value)
+        {
+            OperandTypes types;
+            types.m_u.i = value;
+            return types;
+        }
+    };
+
+} // namespace JSC
diff --git a/parser/SourceCode.h b/parser/SourceCode.h
new file mode 100644
index 0000000..4c39fe8
--- /dev/null
+++ b/parser/SourceCode.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2008, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "UnlinkedSourceCode.h"
+
+namespace JSC {
+
+    class SourceCode : public UnlinkedSourceCode {
+    public:
+        SourceCode()
+            : UnlinkedSourceCode()
+            , m_firstLine(OrdinalNumber::beforeFirst())
+            , m_startColumn(OrdinalNumber::beforeFirst())
+        {
+        }
+
+        SourceCode(PassRefPtr<SourceProvider> provider)
+            : UnlinkedSourceCode(provider)
+        {
+        }
+
+        SourceCode(PassRefPtr<SourceProvider> provider, int firstLine, int startColumn)
+            : UnlinkedSourceCode(provider)
+            , m_firstLine(OrdinalNumber::fromOneBasedInt(std::max(firstLine, 1)))
+            , m_startColumn(OrdinalNumber::fromOneBasedInt(std::max(startColumn, 1)))
+        {
+        }
+
+        SourceCode(PassRefPtr<SourceProvider> provider, int startOffset, int endOffset, int firstLine, int startColumn)
+            : UnlinkedSourceCode(provider, startOffset, endOffset)
+            , m_firstLine(OrdinalNumber::fromOneBasedInt(std::max(firstLine, 1)))
+            , m_startColumn(OrdinalNumber::fromOneBasedInt(std::max(startColumn, 1)))
+        {
+        }
+
+        OrdinalNumber firstLine() const { return m_firstLine; }
+        OrdinalNumber startColumn() const { return m_startColumn; }
+
+        intptr_t providerID() const
+        {
+            if (!m_provider)
+                return SourceProvider::nullID;
+            return m_provider->asID();
+        }
+
+        SourceProvider* provider() const { return m_provider.get(); }
+
+        SourceCode subExpression(unsigned openBrace, unsigned closeBrace, int firstLine, int startColumn);
+
+    private:
+        OrdinalNumber m_firstLine;
+        OrdinalNumber m_startColumn;
+    };
+
+    inline SourceCode makeSource(const String& source, const String& url = String(), const TextPosition& startPosition = TextPosition(), SourceProviderSourceType sourceType = SourceProviderSourceType::Program)
+    {
+        return SourceCode(StringSourceProvider::create(source, url, startPosition, sourceType), startPosition.m_line.oneBasedInt(), startPosition.m_column.oneBasedInt());
+    }
+    
+    inline SourceCode SourceCode::subExpression(unsigned openBrace, unsigned closeBrace, int firstLine, int startColumn)
+    {
+        startColumn += 1; // Convert to base 1.
+        return SourceCode(provider(), openBrace, closeBrace + 1, firstLine, startColumn);
+    }
+
+} // namespace JSC
diff --git a/parser/SourceCodeKey.h b/parser/SourceCodeKey.h
new file mode 100644
index 0000000..abe4181
--- /dev/null
+++ b/parser/SourceCodeKey.h
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ParserModes.h"
+#include "UnlinkedSourceCode.h"
+#include <wtf/HashTraits.h>
+
+namespace JSC {
+
+enum class SourceCodeType { EvalType, ProgramType, FunctionType, ModuleType };
+enum class TypeProfilerEnabled { No, Yes };
+enum class ControlFlowProfilerEnabled { No, Yes };
+
+class SourceCodeFlags {
+public:
+    SourceCodeFlags() = default;
+
+    SourceCodeFlags(
+        SourceCodeType codeType, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, 
+        DerivedContextType derivedContextType, EvalContextType evalContextType, bool isArrowFunctionContext,
+        DebuggerMode debuggerMode, TypeProfilerEnabled typeProfilerEnabled, ControlFlowProfilerEnabled controlFlowProfilerEnabled)
+        : m_flags(
+            (static_cast<unsigned>(debuggerMode) << 8) |
+            (static_cast<unsigned>(typeProfilerEnabled) << 7) |
+            (static_cast<unsigned>(controlFlowProfilerEnabled) << 6) |
+            (static_cast<unsigned>(scriptMode) << 5) |
+            (static_cast<unsigned>(isArrowFunctionContext) << 4) |
+            (static_cast<unsigned>(evalContextType) << 3) |
+            (static_cast<unsigned>(derivedContextType) << 2) |
+            (static_cast<unsigned>(codeType) << 1) |
+            (static_cast<unsigned>(strictMode))
+        )
+    {
+    }
+
+    inline bool operator==(const SourceCodeFlags& rhs) const
+    {
+        return m_flags == rhs.m_flags;
+    }
+
+    unsigned bits() { return m_flags; }
+
+private:
+    unsigned m_flags { 0 };
+};
+
+class SourceCodeKey {
+public:
+    SourceCodeKey()
+    {
+    }
+
+    SourceCodeKey(
+        const UnlinkedSourceCode& sourceCode, const String& name, SourceCodeType codeType, JSParserStrictMode strictMode, 
+        JSParserScriptMode scriptMode, DerivedContextType derivedContextType, EvalContextType evalContextType, bool isArrowFunctionContext,
+        DebuggerMode debuggerMode, TypeProfilerEnabled typeProfilerEnabled, ControlFlowProfilerEnabled controlFlowProfilerEnabled)
+            : m_sourceCode(sourceCode)
+            , m_name(name)
+            , m_flags(codeType, strictMode, scriptMode, derivedContextType, evalContextType, isArrowFunctionContext, debuggerMode, typeProfilerEnabled, controlFlowProfilerEnabled)
+            , m_hash(sourceCode.hash() ^ m_flags.bits())
+    {
+    }
+
+    SourceCodeKey(WTF::HashTableDeletedValueType)
+        : m_sourceCode(WTF::HashTableDeletedValue)
+    {
+    }
+
+    bool isHashTableDeletedValue() const { return m_sourceCode.isHashTableDeletedValue(); }
+
+    unsigned hash() const { return m_hash; }
+
+    size_t length() const { return m_sourceCode.length(); }
+
+    bool isNull() const { return m_sourceCode.isNull(); }
+
+    // To save memory, we compute our string on demand. It's expected that source
+    // providers cache their strings to make this efficient.
+    StringView string() const { return m_sourceCode.view(); }
+
+    bool operator==(const SourceCodeKey& other) const
+    {
+        return m_hash == other.m_hash
+            && length() == other.length()
+            && m_flags == other.m_flags
+            && m_name == other.m_name
+            && string() == other.string();
+    }
+
+    struct Hash {
+        static unsigned hash(const SourceCodeKey& key) { return key.hash(); }
+        static bool equal(const SourceCodeKey& a, const SourceCodeKey& b) { return a == b; }
+        static const bool safeToCompareToEmptyOrDeleted = false;
+    };
+
+    struct HashTraits : SimpleClassHashTraits<SourceCodeKey> {
+        static const bool hasIsEmptyValueFunction = true;
+        static bool isEmptyValue(const SourceCodeKey& key) { return key.isNull(); }
+    };
+
+private:
+    UnlinkedSourceCode m_sourceCode;
+    String m_name;
+    SourceCodeFlags m_flags;
+    unsigned m_hash;
+};
+
+} // namespace JSC
diff --git a/parser/SourceProvider.cpp b/parser/SourceProvider.cpp
new file mode 100644
index 0000000..69bc574
--- /dev/null
+++ b/parser/SourceProvider.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SourceProvider.h"
+
+#include "JSCInlines.h"
+#include <wtf/Lock.h>
+
+namespace JSC {
+
+SourceProvider::SourceProvider(const String& url, const TextPosition& startPosition, SourceProviderSourceType sourceType)
+    : m_url(url)
+    , m_startPosition(startPosition)
+    , m_sourceType(sourceType)
+    , m_validated(false)
+    , m_id(0)
+{
+}
+
+SourceProvider::~SourceProvider()
+{
+}
+
+static StaticLock providerIdLock;
+
+void SourceProvider::getID()
+{
+    LockHolder lock(&providerIdLock);
+    if (!m_id) {
+        static intptr_t nextProviderID = 0;
+        m_id = ++nextProviderID;
+    }
+}
+
+} // namespace JSC
+
diff --git a/parser/SourceProvider.h b/parser/SourceProvider.h
new file mode 100644
index 0000000..8b0cd3c
--- /dev/null
+++ b/parser/SourceProvider.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2008, 2009, 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/RefCounted.h>
+#include <wtf/text/TextPosition.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+    enum class SourceProviderSourceType {
+        Program,
+        Module,
+        WebAssembly,
+    };
+
+    class SourceProvider : public RefCounted<SourceProvider> {
+    public:
+        static const intptr_t nullID = 1;
+        
+        JS_EXPORT_PRIVATE SourceProvider(const String& url, const TextPosition& startPosition, SourceProviderSourceType);
+
+        JS_EXPORT_PRIVATE virtual ~SourceProvider();
+
+        virtual unsigned hash() const = 0;
+        virtual StringView source() const = 0;
+        StringView getRange(int start, int end) const
+        {
+            return source().substring(start, end - start);
+        }
+
+        const String& url() const { return m_url; }
+        const String& sourceURL() const { return m_sourceURLDirective; }
+        const String& sourceMappingURL() const { return m_sourceMappingURLDirective; }
+
+        TextPosition startPosition() const { return m_startPosition; }
+        SourceProviderSourceType sourceType() const { return m_sourceType; }
+
+        intptr_t asID()
+        {
+            if (!m_id)
+                getID();
+            return m_id;
+        }
+
+        bool isValid() const { return m_validated; }
+        void setValid() { m_validated = true; }
+
+        void setSourceURLDirective(const String& sourceURL) { m_sourceURLDirective = sourceURL; }
+        void setSourceMappingURLDirective(const String& sourceMappingURL) { m_sourceMappingURLDirective = sourceMappingURL; }
+
+    private:
+        JS_EXPORT_PRIVATE void getID();
+
+        String m_url;
+        String m_sourceURLDirective;
+        String m_sourceMappingURLDirective;
+        TextPosition m_startPosition;
+        SourceProviderSourceType m_sourceType;
+        bool m_validated : 1;
+        uintptr_t m_id : sizeof(uintptr_t) * 8 - 1;
+    };
+
+    class StringSourceProvider : public SourceProvider {
+    public:
+        static Ref<StringSourceProvider> create(const String& source, const String& url, const TextPosition& startPosition = TextPosition(), SourceProviderSourceType sourceType = SourceProviderSourceType::Program)
+        {
+            return adoptRef(*new StringSourceProvider(source, url, startPosition, sourceType));
+        }
+        
+        unsigned hash() const override
+        {
+            return m_source.get().hash();
+        }
+
+        StringView source() const override
+        {
+            return m_source.get();
+        }
+
+    private:
+        StringSourceProvider(const String& source, const String& url, const TextPosition& startPosition, SourceProviderSourceType sourceType)
+            : SourceProvider(url, startPosition, sourceType)
+            , m_source(source.isNull() ? *StringImpl::empty() : *source.impl())
+        {
+        }
+
+        Ref<StringImpl> m_source;
+    };
+    
+#if ENABLE(WEBASSEMBLY)
+    class WebAssemblySourceProvider : public SourceProvider {
+    public:
+        static Ref<WebAssemblySourceProvider> create(const Vector<uint8_t>& data, const String& url)
+        {
+            return adoptRef(*new WebAssemblySourceProvider(data, url));
+        }
+
+        unsigned hash() const override
+        {
+            return m_source.impl()->hash();
+        }
+
+        StringView source() const override
+        {
+            return m_source;
+        }
+
+        const Vector<uint8_t>& data() const
+        {
+            return m_data;
+        }
+
+    private:
+        WebAssemblySourceProvider(const Vector<uint8_t>& data, const String& url)
+            : SourceProvider(url, TextPosition(), SourceProviderSourceType::WebAssembly)
+            , m_source("[WebAssembly source]")
+            , m_data(data)
+        {
+        }
+
+        String m_source;
+        Vector<uint8_t> m_data;
+    };
+#endif
+
+} // namespace JSC
diff --git a/parser/SourceProviderCache.cpp b/parser/SourceProviderCache.cpp
new file mode 100644
index 0000000..ccc6727
--- /dev/null
+++ b/parser/SourceProviderCache.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#include "config.h"
+#include "SourceProviderCache.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+SourceProviderCache::~SourceProviderCache()
+{
+    clear();
+}
+
+void SourceProviderCache::clear()
+{
+    m_map.clear();
+}
+
+void SourceProviderCache::add(int sourcePosition, std::unique_ptr<SourceProviderCacheItem> item)
+{
+    m_map.add(sourcePosition, WTFMove(item));
+}
+
+}
diff --git a/parser/SourceProviderCache.h b/parser/SourceProviderCache.h
new file mode 100644
index 0000000..05a851f
--- /dev/null
+++ b/parser/SourceProviderCache.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "SourceProviderCacheItem.h"
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+class SourceProviderCache : public RefCounted<SourceProviderCache> {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    SourceProviderCache() { }
+    JS_EXPORT_PRIVATE ~SourceProviderCache();
+
+    JS_EXPORT_PRIVATE void clear();
+    void add(int sourcePosition, std::unique_ptr<SourceProviderCacheItem>);
+    const SourceProviderCacheItem* get(int sourcePosition) const { return m_map.get(sourcePosition); }
+
+private:
+    HashMap<int, std::unique_ptr<SourceProviderCacheItem>, WTF::IntHash<int>, WTF::UnsignedWithZeroKeyHashTraits<int>> m_map;
+};
+
+} // namespace JSC
diff --git a/parser/SourceProviderCacheItem.h b/parser/SourceProviderCacheItem.h
new file mode 100644
index 0000000..a14e3d1
--- /dev/null
+++ b/parser/SourceProviderCacheItem.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ParserTokens.h"
+#include <wtf/Vector.h>
+#include <wtf/text/UniquedStringImpl.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+struct SourceProviderCacheItemCreationParameters {
+    unsigned functionNameStart;
+    unsigned lastTokenLine;
+    unsigned lastTokenStartOffset;
+    unsigned lastTokenEndOffset;
+    unsigned lastTokenLineStartOffset;
+    unsigned endFunctionOffset;
+    unsigned parameterCount;
+    unsigned functionLength;
+    bool needsFullActivation;
+    bool usesEval;
+    bool strictMode;
+    InnerArrowFunctionCodeFeatures innerArrowFunctionFeatures;
+    Vector<UniquedStringImpl*, 8> usedVariables;
+    bool isBodyArrowExpression { false };
+    JSTokenType tokenType { CLOSEBRACE };
+    ConstructorKind constructorKind;
+    SuperBinding expectedSuperBinding;
+};
+
+#if COMPILER(MSVC)
+#pragma warning(push)
+#pragma warning(disable: 4200) // Disable "zero-sized array in struct/union" warning
+#endif
+
+class SourceProviderCacheItem {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static std::unique_ptr<SourceProviderCacheItem> create(const SourceProviderCacheItemCreationParameters&);
+    ~SourceProviderCacheItem();
+
+    JSToken endFunctionToken() const 
+    {
+        JSToken token;
+        token.m_type = isBodyArrowExpression ? tokenType : CLOSEBRACE;
+        token.m_data.offset = lastTokenStartOffset;
+        token.m_location.startOffset = lastTokenStartOffset;
+        token.m_location.endOffset = lastTokenEndOffset;
+        token.m_location.line = lastTokenLine;
+        token.m_location.lineStartOffset = lastTokenLineStartOffset;
+        // token.m_location.sourceOffset is initialized once by the client. So,
+        // we do not need to set it here.
+        return token;
+    }
+
+    unsigned functionNameStart : 31;
+    bool needsFullActivation : 1;
+    unsigned endFunctionOffset : 31;
+    bool usesEval : 1;
+    unsigned lastTokenLine : 31;
+    bool strictMode : 1;
+    unsigned lastTokenStartOffset : 31;
+    unsigned lastTokenEndOffset: 31;
+    unsigned constructorKind : 2; // ConstructorKind
+    unsigned parameterCount : 31;
+    unsigned expectedSuperBinding : 1; // SuperBinding
+    unsigned functionLength;
+    unsigned lastTokenLineStartOffset;
+    unsigned usedVariablesCount;
+    InnerArrowFunctionCodeFeatures innerArrowFunctionFeatures;
+    bool isBodyArrowExpression;
+    JSTokenType tokenType;
+
+    UniquedStringImpl** usedVariables() const { return const_cast<UniquedStringImpl**>(m_variables); }
+
+private:
+    SourceProviderCacheItem(const SourceProviderCacheItemCreationParameters&);
+
+    UniquedStringImpl* m_variables[0];
+};
+
+inline SourceProviderCacheItem::~SourceProviderCacheItem()
+{
+    for (unsigned i = 0; i < usedVariablesCount; ++i)
+        m_variables[i]->deref();
+}
+
+inline std::unique_ptr<SourceProviderCacheItem> SourceProviderCacheItem::create(const SourceProviderCacheItemCreationParameters& parameters)
+{
+    size_t variableCount = parameters.usedVariables.size();
+    size_t objectSize = sizeof(SourceProviderCacheItem) + sizeof(UniquedStringImpl*) * variableCount;
+    void* slot = fastMalloc(objectSize);
+    return std::unique_ptr<SourceProviderCacheItem>(new (slot) SourceProviderCacheItem(parameters));
+}
+
+inline SourceProviderCacheItem::SourceProviderCacheItem(const SourceProviderCacheItemCreationParameters& parameters)
+    : functionNameStart(parameters.functionNameStart)
+    , needsFullActivation(parameters.needsFullActivation)
+    , endFunctionOffset(parameters.endFunctionOffset)
+    , usesEval(parameters.usesEval)
+    , lastTokenLine(parameters.lastTokenLine)
+    , strictMode(parameters.strictMode)
+    , lastTokenStartOffset(parameters.lastTokenStartOffset)
+    , lastTokenEndOffset(parameters.lastTokenEndOffset)
+    , constructorKind(static_cast<unsigned>(parameters.constructorKind))
+    , parameterCount(parameters.parameterCount)
+    , expectedSuperBinding(static_cast<unsigned>(parameters.expectedSuperBinding))
+    , functionLength(parameters.functionLength)
+    , lastTokenLineStartOffset(parameters.lastTokenLineStartOffset)
+    , usedVariablesCount(parameters.usedVariables.size())
+    , innerArrowFunctionFeatures(parameters.innerArrowFunctionFeatures)
+    , isBodyArrowExpression(parameters.isBodyArrowExpression)
+    , tokenType(parameters.tokenType)
+{
+    for (unsigned i = 0; i < usedVariablesCount; ++i) {
+        m_variables[i] = parameters.usedVariables[i];
+        m_variables[i]->ref();
+    }
+}
+
+#if COMPILER(MSVC)
+#pragma warning(pop)
+#endif
+
+} // namespace JSC
diff --git a/parser/SyntaxChecker.h b/parser/SyntaxChecker.h
new file mode 100644
index 0000000..f32854a
--- /dev/null
+++ b/parser/SyntaxChecker.h
@@ -0,0 +1,408 @@
+/*
+ * Copyright (C) 2010, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Lexer.h"
+#include "ParserFunctionInfo.h"
+#include "YarrSyntaxChecker.h"
+
+namespace JSC {
+
+class SyntaxChecker {
+public:
+    struct BinaryExprContext {
+        BinaryExprContext(SyntaxChecker& context)
+            : m_context(&context)
+        {
+            m_token = m_context->m_topBinaryExpr;
+            m_context->m_topBinaryExpr = 0;
+        }
+        ~BinaryExprContext()
+        {
+            m_context->m_topBinaryExpr = m_token;
+        }
+    private:
+        int m_token;
+        SyntaxChecker* m_context;
+    };
+    struct UnaryExprContext {
+        UnaryExprContext(SyntaxChecker& context)
+            : m_context(&context)
+        {
+            m_token = m_context->m_topUnaryToken;
+            m_context->m_topUnaryToken = 0;
+        }
+        ~UnaryExprContext()
+        {
+            m_context->m_topUnaryToken = m_token;
+        }
+    private:
+        int m_token;
+        SyntaxChecker* m_context;
+    };
+    
+    SyntaxChecker(VM* , void*)
+    {
+    }
+
+    enum { NoneExpr = 0,
+        ResolveEvalExpr, ResolveExpr, IntegerExpr, DoubleExpr, StringExpr,
+        ThisExpr, NullExpr, BoolExpr, RegExpExpr, ObjectLiteralExpr,
+        FunctionExpr, ClassExpr, SuperExpr, BracketExpr, DotExpr, CallExpr,
+        NewExpr, PreExpr, PostExpr, UnaryExpr, BinaryExpr,
+        ConditionalExpr, AssignmentExpr, TypeofExpr, NewTargetExpr,
+        DeleteExpr, ArrayLiteralExpr, BindingDestructuring, RestParameter,
+        ArrayDestructuring, ObjectDestructuring, SourceElementsResult,
+        FunctionBodyResult, SpreadExpr, ArgumentsResult,
+        PropertyListResult, ArgumentsListResult, ElementsListResult,
+        StatementResult, FormalParameterListResult, ClauseResult,
+        ClauseListResult, CommaExpr, DestructuringAssignment,
+        TemplateStringResult, TemplateStringListResult,
+        TemplateExpressionListResult, TemplateExpr,
+        TaggedTemplateExpr, YieldExpr, AwaitExpr,
+        ModuleNameResult,
+        ImportSpecifierResult, ImportSpecifierListResult,
+        ExportSpecifierResult, ExportSpecifierListResult
+    };
+    typedef int ExpressionType;
+
+    typedef ExpressionType Expression;
+    typedef int SourceElements;
+    typedef int Arguments;
+    typedef ExpressionType Comma;
+    struct Property {
+        ALWAYS_INLINE Property(void* = 0)
+            : type((PropertyNode::Type)0)
+        {
+        }
+        ALWAYS_INLINE Property(const Identifier* ident, PropertyNode::Type ty)
+            : name(ident)
+            , type(ty)
+        {
+        }
+        ALWAYS_INLINE Property(PropertyNode::Type ty)
+            : name(0)
+            , type(ty)
+        {
+        }
+        ALWAYS_INLINE bool operator!() { return !type; }
+        const Identifier* name;
+        PropertyNode::Type type;
+    };
+    typedef int PropertyList;
+    typedef int ElementList;
+    typedef int ArgumentsList;
+    typedef int TemplateExpressionList;
+    typedef int TemplateString;
+    typedef int TemplateStringList;
+    typedef int TemplateLiteral;
+    typedef int FormalParameterList;
+    typedef int FunctionBody;
+    typedef int ClassExpression;
+    typedef int ModuleName;
+    typedef int ImportSpecifier;
+    typedef int ImportSpecifierList;
+    typedef int ExportSpecifier;
+    typedef int ExportSpecifierList;
+    typedef int Statement;
+    typedef int ClauseList;
+    typedef int Clause;
+    typedef int BinaryOperand;
+    typedef int DestructuringPattern;
+    typedef DestructuringPattern ArrayPattern;
+    typedef DestructuringPattern ObjectPattern;
+    typedef DestructuringPattern RestPattern;
+
+    static const bool CreatesAST = false;
+    static const bool NeedsFreeVariableInfo = false;
+    static const bool CanUseFunctionCache = true;
+    static const unsigned DontBuildKeywords = LexexFlagsDontBuildKeywords;
+    static const unsigned DontBuildStrings = LexerFlagsDontBuildStrings;
+
+    int createSourceElements() { return SourceElementsResult; }
+    ExpressionType makeFunctionCallNode(const JSTokenLocation&, int, int, int, int, int) { return CallExpr; }
+    ExpressionType createCommaExpr(const JSTokenLocation&, ExpressionType expr) { return expr; }
+    ExpressionType appendToCommaExpr(const JSTokenLocation&, ExpressionType& head, ExpressionType, ExpressionType next) { head = next; return next; }
+    ExpressionType makeAssignNode(const JSTokenLocation&, ExpressionType, Operator, ExpressionType, bool, bool, int, int, int) { return AssignmentExpr; }
+    ExpressionType makePrefixNode(const JSTokenLocation&, ExpressionType, Operator, int, int, int) { return PreExpr; }
+    ExpressionType makePostfixNode(const JSTokenLocation&, ExpressionType, Operator, int, int, int) { return PostExpr; }
+    ExpressionType makeTypeOfNode(const JSTokenLocation&, ExpressionType) { return TypeofExpr; }
+    ExpressionType makeDeleteNode(const JSTokenLocation&, ExpressionType, int, int, int) { return DeleteExpr; }
+    ExpressionType makeNegateNode(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType makeBitwiseNotNode(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType createLogicalNot(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType createUnaryPlus(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType createVoid(const JSTokenLocation&, ExpressionType) { return UnaryExpr; }
+    ExpressionType createThisExpr(const JSTokenLocation&) { return ThisExpr; }
+    ExpressionType createSuperExpr(const JSTokenLocation&) { return SuperExpr; }
+    ExpressionType createNewTargetExpr(const JSTokenLocation&) { return NewTargetExpr; }
+    ALWAYS_INLINE bool isNewTarget(ExpressionType type) { return type == NewTargetExpr; }
+    ExpressionType createResolve(const JSTokenLocation&, const Identifier&, int, int) { return ResolveExpr; }
+    ExpressionType createObjectLiteral(const JSTokenLocation&) { return ObjectLiteralExpr; }
+    ExpressionType createObjectLiteral(const JSTokenLocation&, int) { return ObjectLiteralExpr; }
+    ExpressionType createArray(const JSTokenLocation&, int) { return ArrayLiteralExpr; }
+    ExpressionType createArray(const JSTokenLocation&, int, int) { return ArrayLiteralExpr; }
+    ExpressionType createDoubleExpr(const JSTokenLocation&, double) { return DoubleExpr; }
+    ExpressionType createIntegerExpr(const JSTokenLocation&, double) { return IntegerExpr; }
+    ExpressionType createString(const JSTokenLocation&, const Identifier*) { return StringExpr; }
+    ExpressionType createBoolean(const JSTokenLocation&, bool) { return BoolExpr; }
+    ExpressionType createNull(const JSTokenLocation&) { return NullExpr; }
+    ExpressionType createBracketAccess(const JSTokenLocation&, ExpressionType, ExpressionType, bool, int, int, int) { return BracketExpr; }
+    ExpressionType createDotAccess(const JSTokenLocation&, ExpressionType, const Identifier*, int, int, int) { return DotExpr; }
+    ExpressionType createRegExp(const JSTokenLocation&, const Identifier& pattern, const Identifier& flags, int) { return Yarr::checkSyntax(pattern.string(), flags.string()) ? 0 : RegExpExpr; }
+    ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int, int, int) { return NewExpr; }
+    ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int) { return NewExpr; }
+    ExpressionType createConditionalExpr(const JSTokenLocation&, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
+    ExpressionType createAssignResolve(const JSTokenLocation&, const Identifier&, ExpressionType, int, int, int, AssignmentContext) { return AssignmentExpr; }
+    ExpressionType createEmptyVarExpression(const JSTokenLocation&, const Identifier&) { return AssignmentExpr; }
+    ExpressionType createEmptyLetExpression(const JSTokenLocation&, const Identifier&) { return AssignmentExpr; }
+    ExpressionType createYield(const JSTokenLocation&) { return YieldExpr; }
+    ExpressionType createYield(const JSTokenLocation&, ExpressionType, bool, int, int, int) { return YieldExpr; }
+    ExpressionType createAwait(const JSTokenLocation&, ExpressionType, int, int, int) { return AwaitExpr; }
+    ClassExpression createClassExpr(const JSTokenLocation&, const ParserClassInfo<SyntaxChecker>&, VariableEnvironment&, ExpressionType, ExpressionType, PropertyList, PropertyList) { return ClassExpr; }
+    ExpressionType createFunctionExpr(const JSTokenLocation&, const ParserFunctionInfo<SyntaxChecker>&) { return FunctionExpr; }
+    ExpressionType createGeneratorFunctionBody(const JSTokenLocation&, const ParserFunctionInfo<SyntaxChecker>&, const Identifier&) { return FunctionExpr; }
+    ExpressionType createAsyncFunctionBody(const JSTokenLocation&, const ParserFunctionInfo<SyntaxChecker>&) { return FunctionExpr; }
+    int createFunctionMetadata(const JSTokenLocation&, const JSTokenLocation&, int, int, bool, int, int, int, ConstructorKind, SuperBinding, unsigned, int, SourceParseMode, bool, InnerArrowFunctionCodeFeatures = NoInnerArrowFunctionFeatures) { return FunctionBodyResult; }
+    ExpressionType createArrowFunctionExpr(const JSTokenLocation&, const ParserFunctionInfo<SyntaxChecker>&) { return FunctionExpr; }
+    ExpressionType createMethodDefinition(const JSTokenLocation&, const ParserFunctionInfo<SyntaxChecker>&) { return FunctionExpr; }
+    void setFunctionNameStart(int, int) { }
+    int createArguments() { return ArgumentsResult; }
+    int createArguments(int) { return ArgumentsResult; }
+    ExpressionType createSpreadExpression(const JSTokenLocation&, ExpressionType, int, int, int) { return SpreadExpr; }
+    TemplateString createTemplateString(const JSTokenLocation&, const Identifier&, const Identifier&) { return TemplateStringResult; }
+    TemplateStringList createTemplateStringList(TemplateString) { return TemplateStringListResult; }
+    TemplateStringList createTemplateStringList(TemplateStringList, TemplateString) { return TemplateStringListResult; }
+    TemplateExpressionList createTemplateExpressionList(Expression) { return TemplateExpressionListResult; }
+    TemplateExpressionList createTemplateExpressionList(TemplateExpressionList, Expression) { return TemplateExpressionListResult; }
+    TemplateLiteral createTemplateLiteral(const JSTokenLocation&, TemplateStringList) { return TemplateExpr; }
+    TemplateLiteral createTemplateLiteral(const JSTokenLocation&, TemplateStringList, TemplateExpressionList) { return TemplateExpr; }
+    ExpressionType createTaggedTemplate(const JSTokenLocation&, ExpressionType, TemplateLiteral, int, int, int) { return TaggedTemplateExpr; }
+
+    int createArgumentsList(const JSTokenLocation&, int) { return ArgumentsListResult; }
+    int createArgumentsList(const JSTokenLocation&, int, int) { return ArgumentsListResult; }
+    Property createProperty(const Identifier* name, int, PropertyNode::Type type, PropertyNode::PutType, bool complete, SuperBinding, bool)
+    {
+        if (!complete)
+            return Property(type);
+        ASSERT(name);
+        return Property(name, type);
+    }
+    Property createProperty(VM* vm, ParserArena& parserArena, double name, int, PropertyNode::Type type, PropertyNode::PutType, bool complete, SuperBinding, bool)
+    {
+        if (!complete)
+            return Property(type);
+        return Property(&parserArena.identifierArena().makeNumericIdentifier(vm, name), type);
+    }
+    Property createProperty(int, int, PropertyNode::Type type, PropertyNode::PutType, bool, SuperBinding, bool)
+    {
+        return Property(type);
+    }
+    int createPropertyList(const JSTokenLocation&, Property) { return PropertyListResult; }
+    int createPropertyList(const JSTokenLocation&, Property, int) { return PropertyListResult; }
+    int createElementList(int, int) { return ElementsListResult; }
+    int createElementList(int, int, int) { return ElementsListResult; }
+    int createElementList(int) { return ElementsListResult; }
+    int createFormalParameterList() { return FormalParameterListResult; }
+    void appendParameter(int, DestructuringPattern, int) { }
+    int createClause(int, int) { return ClauseResult; }
+    int createClauseList(int) { return ClauseListResult; }
+    int createClauseList(int, int) { return ClauseListResult; }
+    int createFuncDeclStatement(const JSTokenLocation&, const ParserFunctionInfo<SyntaxChecker>&) { return StatementResult; }
+    int createClassDeclStatement(const JSTokenLocation&, ClassExpression,
+        const JSTextPosition&, const JSTextPosition&, int, int) { return StatementResult; }
+    int createBlockStatement(const JSTokenLocation&, int, int, int, VariableEnvironment&, DeclarationStacks::FunctionStack&&) { return StatementResult; }
+    int createExprStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
+    int createIfStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
+    int createIfStatement(const JSTokenLocation&, int, int, int, int, int) { return StatementResult; }
+    int createForLoop(const JSTokenLocation&, int, int, int, int, int, int, VariableEnvironment&) { return StatementResult; }
+    int createForInLoop(const JSTokenLocation&, int, int, int, const JSTokenLocation&, int, int, int, int, int, VariableEnvironment&) { return StatementResult; }
+    int createForOfLoop(const JSTokenLocation&, int, int, int, const JSTokenLocation&, int, int, int, int, int, VariableEnvironment&) { return StatementResult; }
+    int createEmptyStatement(const JSTokenLocation&) { return StatementResult; }
+    int createDeclarationStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
+    int createReturnStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
+    int createBreakStatement(const JSTokenLocation&, int, int) { return StatementResult; }
+    int createBreakStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
+    int createContinueStatement(const JSTokenLocation&, int, int) { return StatementResult; }
+    int createContinueStatement(const JSTokenLocation&, const Identifier*, int, int) { return StatementResult; }
+    int createTryStatement(const JSTokenLocation&, int, int, int, int, int, int, VariableEnvironment&) { return StatementResult; }
+    int createSwitchStatement(const JSTokenLocation&, int, int, int, int, int, int, VariableEnvironment&, DeclarationStacks::FunctionStack&&) { return StatementResult; }
+    int createWhileStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
+    int createWithStatement(const JSTokenLocation&, int, int, int, int, int, int) { return StatementResult; }
+    int createDoWhileStatement(const JSTokenLocation&, int, int, int, int) { return StatementResult; }
+    int createLabelStatement(const JSTokenLocation&, const Identifier*, int, int, int) { return StatementResult; }
+    int createThrowStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
+    int createDebugger(const JSTokenLocation&, int, int) { return StatementResult; }
+    int createConstStatement(const JSTokenLocation&, int, int, int) { return StatementResult; }
+    int createModuleName(const JSTokenLocation&, const Identifier&) { return ModuleNameResult; }
+    ImportSpecifier createImportSpecifier(const JSTokenLocation&, const Identifier&, const Identifier&) { return ImportSpecifierResult; }
+    ImportSpecifierList createImportSpecifierList() { return ImportSpecifierListResult; }
+    void appendImportSpecifier(ImportSpecifierList, ImportSpecifier) { }
+    int createImportDeclaration(const JSTokenLocation&, ImportSpecifierList, ModuleName) { return StatementResult; }
+    int createExportAllDeclaration(const JSTokenLocation&, ModuleName) { return StatementResult; }
+    int createExportDefaultDeclaration(const JSTokenLocation&, int, const Identifier&) { return StatementResult; }
+    int createExportLocalDeclaration(const JSTokenLocation&, int) { return StatementResult; }
+    int createExportNamedDeclaration(const JSTokenLocation&, ExportSpecifierList, ModuleName) { return StatementResult; }
+    ExportSpecifier createExportSpecifier(const JSTokenLocation&, const Identifier&, const Identifier&) { return ExportSpecifierResult; }
+    ExportSpecifierList createExportSpecifierList() { return ExportSpecifierListResult; }
+    void appendExportSpecifier(ExportSpecifierList, ExportSpecifier) { }
+
+    int appendConstDecl(const JSTokenLocation&, int, const Identifier*, int) { return StatementResult; }
+    Property createGetterOrSetterProperty(const JSTokenLocation&, PropertyNode::Type type, bool strict, const Identifier* name, const ParserFunctionInfo<SyntaxChecker>&, bool)
+    {
+        ASSERT(name);
+        if (!strict)
+            return Property(type);
+        return Property(name, type);
+    }
+    Property createGetterOrSetterProperty(const JSTokenLocation&, PropertyNode::Type type, bool, int, const ParserFunctionInfo<SyntaxChecker>&, bool)
+    {
+        return Property(type);
+    }
+    Property createGetterOrSetterProperty(VM* vm, ParserArena& parserArena, const JSTokenLocation&, PropertyNode::Type type, bool strict, double name, const ParserFunctionInfo<SyntaxChecker>&, bool)
+    {
+        if (!strict)
+            return Property(type);
+        return Property(&parserArena.identifierArena().makeNumericIdentifier(vm, name), type);
+    }
+
+    void appendStatement(int, int) { }
+    int combineCommaNodes(const JSTokenLocation&, int, int) { return CommaExpr; }
+    int evalCount() const { return 0; }
+    void appendBinaryExpressionInfo(int& operandStackDepth, int expr, int, int, int, bool)
+    {
+        if (!m_topBinaryExpr)
+            m_topBinaryExpr = expr;
+        else
+            m_topBinaryExpr = BinaryExpr;
+        operandStackDepth++;
+    }
+    
+    // Logic to handle datastructures used during parsing of binary expressions
+    void operatorStackPop(int& operatorStackDepth) { operatorStackDepth--; }
+    bool operatorStackShouldReduce(int) { return true; }
+    BinaryOperand getFromOperandStack(int) { return m_topBinaryExpr; }
+    void shrinkOperandStackBy(int& operandStackDepth, int amount) { operandStackDepth -= amount; }
+    void appendBinaryOperation(const JSTokenLocation&, int& operandStackDepth, int&, BinaryOperand, BinaryOperand) { operandStackDepth++; }
+    void operatorStackAppend(int& operatorStackDepth, int, int) { operatorStackDepth++; }
+    int popOperandStack(int&) { int res = m_topBinaryExpr; m_topBinaryExpr = 0; return res; }
+    
+    void appendUnaryToken(int& stackDepth, int tok, int) { stackDepth = 1; m_topUnaryToken = tok; }
+    int unaryTokenStackLastType(int&) { return m_topUnaryToken; }
+    JSTextPosition unaryTokenStackLastStart(int&) { return JSTextPosition(0, 0, 0); }
+    void unaryTokenStackRemoveLast(int& stackDepth) { stackDepth = 0; }
+    
+    void assignmentStackAppend(int, int, int, int, int, Operator) { }
+    int createAssignment(const JSTokenLocation&, int, int, int, int, int) { RELEASE_ASSERT_NOT_REACHED(); return AssignmentExpr; }
+    const Identifier* getName(const Property& property) const { return property.name; }
+    PropertyNode::Type getType(const Property& property) const { return property.type; }
+    bool isResolve(ExpressionType expr) const { return expr == ResolveExpr || expr == ResolveEvalExpr; }
+    ExpressionType createDestructuringAssignment(const JSTokenLocation&, int, ExpressionType)
+    {
+        return DestructuringAssignment;
+    }
+    
+    ArrayPattern createArrayPattern(const JSTokenLocation&)
+    {
+        return ArrayDestructuring;
+    }
+    void appendArrayPatternSkipEntry(ArrayPattern, const JSTokenLocation&)
+    {
+    }
+    void appendArrayPatternEntry(ArrayPattern, const JSTokenLocation&, DestructuringPattern, int)
+    {
+    }
+    void appendArrayPatternRestEntry(ArrayPattern, const JSTokenLocation&, DestructuringPattern)
+    {
+    }
+    void finishArrayPattern(ArrayPattern, const JSTextPosition&, const JSTextPosition&, const JSTextPosition&)
+    {
+    }
+    ObjectPattern createObjectPattern(const JSTokenLocation&)
+    {
+        return ObjectDestructuring;
+    }
+    void appendObjectPatternEntry(ArrayPattern, const JSTokenLocation&, bool, const Identifier&, DestructuringPattern, int)
+    {
+    }
+    void appendObjectPatternEntry(ArrayPattern, const JSTokenLocation&, Expression, DestructuringPattern, Expression)
+    {
+    }
+
+    DestructuringPattern createBindingLocation(const JSTokenLocation&, const Identifier&, const JSTextPosition&, const JSTextPosition&, AssignmentContext)
+    {
+        return BindingDestructuring;
+    }
+    RestPattern createRestParameter(DestructuringPattern, size_t)
+    { 
+        return RestParameter;
+    }
+    DestructuringPattern createAssignmentElement(const Expression&, const JSTextPosition&, const JSTextPosition&)
+    {
+        return BindingDestructuring;
+    }
+
+    bool isBindingNode(DestructuringPattern pattern)
+    {
+        return pattern == BindingDestructuring;
+    }
+
+    bool isAssignmentLocation(ExpressionType type)
+    {
+        return type == ResolveExpr || type == DotExpr || type == BracketExpr;
+    }
+
+    bool isObjectLiteral(ExpressionType type)
+    {
+        return type == ObjectLiteralExpr;
+    }
+
+    bool isArrayLiteral(ExpressionType type)
+    {
+        return type == ArrayLiteralExpr;
+    }
+
+    bool isObjectOrArrayLiteral(ExpressionType type)
+    {
+        return isObjectLiteral(type) || isArrayLiteral(type);
+    }
+
+    bool shouldSkipPauseLocation(int) const { return true; }
+
+    void setEndOffset(int, int) { }
+    int endOffset(int) { return 0; }
+    void setStartOffset(int, int) { }
+
+    JSTextPosition breakpointLocation(int) { return JSTextPosition(-1, 0, 0); }
+
+    void propagateArgumentsUse() { }
+
+private:
+    int m_topBinaryExpr;
+    int m_topUnaryToken;
+};
+
+} // namespace JSC
diff --git a/parser/UnlinkedSourceCode.cpp b/parser/UnlinkedSourceCode.cpp
new file mode 100644
index 0000000..e1e990b
--- /dev/null
+++ b/parser/UnlinkedSourceCode.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "UnlinkedSourceCode.h"
+
+#include "JSCInlines.h"
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+CString UnlinkedSourceCode::toUTF8() const
+{
+    if (!m_provider)
+        return CString("", 0);
+    
+    return m_provider->source().substring(m_startOffset, m_endOffset - m_startOffset).utf8();
+}
+
+} // namespace JSC
+
diff --git a/parser/UnlinkedSourceCode.h b/parser/UnlinkedSourceCode.h
new file mode 100644
index 0000000..29ecf5b
--- /dev/null
+++ b/parser/UnlinkedSourceCode.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2008, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "SourceProvider.h"
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+    class UnlinkedSourceCode {
+    public:
+        UnlinkedSourceCode()
+            : m_provider(0)
+            , m_startOffset(0)
+            , m_endOffset(0)
+        {
+        }
+
+        UnlinkedSourceCode(WTF::HashTableDeletedValueType)
+            : m_provider(WTF::HashTableDeletedValue)
+        {
+        }
+
+        UnlinkedSourceCode(PassRefPtr<SourceProvider> provider)
+            : m_provider(provider)
+            , m_startOffset(0)
+            , m_endOffset(m_provider->source().length())
+        {
+        }
+
+        UnlinkedSourceCode(PassRefPtr<SourceProvider> provider, int startOffset, int endOffset)
+            : m_provider(provider)
+            , m_startOffset(startOffset)
+            , m_endOffset(endOffset)
+        {
+        }
+
+        UnlinkedSourceCode(const UnlinkedSourceCode& other)
+            : m_provider(other.m_provider)
+            , m_startOffset(other.m_startOffset)
+            , m_endOffset(other.m_endOffset)
+        {
+        }
+
+        bool isHashTableDeletedValue() const { return m_provider.isHashTableDeletedValue(); }
+
+        unsigned hash() const
+        {
+            ASSERT(m_provider);
+            return m_provider->hash();
+        }
+
+        StringView view() const
+        {
+            if (!m_provider)
+                return StringView();
+            return m_provider->getRange(m_startOffset, m_endOffset);
+        }
+        
+        CString toUTF8() const;
+        
+        bool isNull() const { return !m_provider; }
+        int startOffset() const { return m_startOffset; }
+        int endOffset() const { return m_endOffset; }
+        int length() const { return m_endOffset - m_startOffset; }
+
+    protected:
+        RefPtr<SourceProvider> m_provider;
+        int m_startOffset;
+        int m_endOffset;
+    };
+
+} // namespace JSC
diff --git a/parser/VariableEnvironment.cpp b/parser/VariableEnvironment.cpp
new file mode 100644
index 0000000..6dc2fbb
--- /dev/null
+++ b/parser/VariableEnvironment.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "VariableEnvironment.h"
+#include <wtf/text/UniquedStringImpl.h>
+
+namespace JSC {
+
+void VariableEnvironment::markVariableAsCapturedIfDefined(const RefPtr<UniquedStringImpl>& identifier)
+{
+    auto findResult = m_map.find(identifier);
+    if (findResult != m_map.end())
+        findResult->value.setIsCaptured();
+}
+
+void VariableEnvironment::markVariableAsCaptured(const RefPtr<UniquedStringImpl>& identifier)
+{
+    auto findResult = m_map.find(identifier);
+    RELEASE_ASSERT(findResult != m_map.end());
+    findResult->value.setIsCaptured();
+}
+
+void VariableEnvironment::markAllVariablesAsCaptured()
+{
+    if (m_isEverythingCaptured)
+        return;
+
+    m_isEverythingCaptured = true; // For fast queries.
+    // We must mark every entry as captured for when we iterate through m_map and entry.isCaptured() is called.
+    for (auto iter = m_map.begin(), end = m_map.end(); iter != end; ++iter) 
+        iter->value.setIsCaptured();
+}
+
+bool VariableEnvironment::hasCapturedVariables() const
+{
+    if (m_isEverythingCaptured)
+        return size() > 0;
+    for (auto entry : m_map) {
+        if (entry.value.isCaptured())
+            return true;
+    }
+    return false;
+}
+
+bool VariableEnvironment::captures(UniquedStringImpl* identifier) const
+{
+    if (m_isEverythingCaptured)
+        return true;
+
+    auto findResult = m_map.find(identifier);
+    if (findResult == m_map.end())
+        return false;
+    return findResult->value.isCaptured();
+}
+
+void VariableEnvironment::swap(VariableEnvironment& other)
+{
+    m_map.swap(other.m_map);
+    m_isEverythingCaptured = other.m_isEverythingCaptured;
+}
+
+void VariableEnvironment::markVariableAsImported(const RefPtr<UniquedStringImpl>& identifier)
+{
+    auto findResult = m_map.find(identifier);
+    RELEASE_ASSERT(findResult != m_map.end());
+    findResult->value.setIsImported();
+}
+
+void VariableEnvironment::markVariableAsExported(const RefPtr<UniquedStringImpl>& identifier)
+{
+    auto findResult = m_map.find(identifier);
+    RELEASE_ASSERT(findResult != m_map.end());
+    findResult->value.setIsExported();
+}
+
+} // namespace JSC
diff --git a/parser/VariableEnvironment.h b/parser/VariableEnvironment.h
new file mode 100644
index 0000000..eb05605
--- /dev/null
+++ b/parser/VariableEnvironment.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+struct VariableEnvironmentEntry {
+public:
+    ALWAYS_INLINE bool isCaptured() const { return m_bits & IsCaptured; }
+    ALWAYS_INLINE bool isConst() const { return m_bits & IsConst; }
+    ALWAYS_INLINE bool isVar() const { return m_bits & IsVar; }
+    ALWAYS_INLINE bool isLet() const { return m_bits & IsLet; }
+    ALWAYS_INLINE bool isExported() const { return m_bits & IsExported; }
+    ALWAYS_INLINE bool isImported() const { return m_bits & IsImported; }
+    ALWAYS_INLINE bool isImportedNamespace() const { return m_bits & IsImportedNamespace; }
+    ALWAYS_INLINE bool isFunction() const { return m_bits & IsFunction; }
+    ALWAYS_INLINE bool isParameter() const { return m_bits & IsParameter; }
+    ALWAYS_INLINE bool isSloppyModeHoistingCandidate() const { return m_bits & IsSloppyModeHoistingCandidate; }
+
+    ALWAYS_INLINE void setIsCaptured() { m_bits |= IsCaptured; }
+    ALWAYS_INLINE void setIsConst() { m_bits |= IsConst; }
+    ALWAYS_INLINE void setIsVar() { m_bits |= IsVar; }
+    ALWAYS_INLINE void setIsLet() { m_bits |= IsLet; }
+    ALWAYS_INLINE void setIsExported() { m_bits |= IsExported; }
+    ALWAYS_INLINE void setIsImported() { m_bits |= IsImported; }
+    ALWAYS_INLINE void setIsImportedNamespace() { m_bits |= IsImportedNamespace; }
+    ALWAYS_INLINE void setIsFunction() { m_bits |= IsFunction; }
+    ALWAYS_INLINE void setIsParameter() { m_bits |= IsParameter; }
+    ALWAYS_INLINE void setIsSloppyModeHoistingCandidate() { m_bits |= IsSloppyModeHoistingCandidate; }
+
+    ALWAYS_INLINE void clearIsVar() { m_bits &= ~IsVar; }
+
+private:
+    enum Traits : uint16_t {
+        IsCaptured = 1 << 0,
+        IsConst = 1 << 1,
+        IsVar = 1 << 2,
+        IsLet = 1 << 3,
+        IsExported = 1 << 4,
+        IsImported = 1 << 5,
+        IsImportedNamespace = 1 << 6,
+        IsFunction = 1 << 7,
+        IsParameter = 1 << 8,
+        IsSloppyModeHoistingCandidate = 1 << 9
+    };
+    uint16_t m_bits { 0 };
+};
+
+struct VariableEnvironmentEntryHashTraits : HashTraits<VariableEnvironmentEntry> {
+    static const bool needsDestruction = false;
+};
+
+class VariableEnvironment {
+private:
+    typedef HashMap<RefPtr<UniquedStringImpl>, VariableEnvironmentEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> Map;
+public:
+    VariableEnvironment()
+    { }
+    VariableEnvironment(VariableEnvironment&& other)
+        : m_map(WTFMove(other.m_map))
+        , m_isEverythingCaptured(other.m_isEverythingCaptured)
+    { }
+    VariableEnvironment(const VariableEnvironment&) = default;
+    VariableEnvironment& operator=(const VariableEnvironment&) = default;
+
+    ALWAYS_INLINE Map::iterator begin() { return m_map.begin(); }
+    ALWAYS_INLINE Map::iterator end() { return m_map.end(); }
+    ALWAYS_INLINE Map::const_iterator begin() const { return m_map.begin(); }
+    ALWAYS_INLINE Map::const_iterator end() const { return m_map.end(); }
+    ALWAYS_INLINE Map::AddResult add(const RefPtr<UniquedStringImpl>& identifier) { return m_map.add(identifier, VariableEnvironmentEntry()); }
+    ALWAYS_INLINE Map::AddResult add(const Identifier& identifier) { return add(identifier.impl()); }
+    ALWAYS_INLINE unsigned size() const { return m_map.size(); }
+    ALWAYS_INLINE bool contains(const RefPtr<UniquedStringImpl>& identifier) const { return m_map.contains(identifier); }
+    ALWAYS_INLINE bool remove(const RefPtr<UniquedStringImpl>& identifier) { return m_map.remove(identifier); }
+    ALWAYS_INLINE Map::iterator find(const RefPtr<UniquedStringImpl>& identifier) { return m_map.find(identifier); }
+    ALWAYS_INLINE Map::const_iterator find(const RefPtr<UniquedStringImpl>& identifier) const { return m_map.find(identifier); }
+    void swap(VariableEnvironment& other);
+    void markVariableAsCapturedIfDefined(const RefPtr<UniquedStringImpl>& identifier);
+    void markVariableAsCaptured(const RefPtr<UniquedStringImpl>& identifier);
+    void markAllVariablesAsCaptured();
+    bool hasCapturedVariables() const;
+    bool captures(UniquedStringImpl* identifier) const;
+    void markVariableAsImported(const RefPtr<UniquedStringImpl>& identifier);
+    void markVariableAsExported(const RefPtr<UniquedStringImpl>& identifier);
+
+private:
+    Map m_map;
+    bool m_isEverythingCaptured { false };
+};
+
+} // namespace JSC
diff --git a/postprocess-headers.sh b/postprocess-headers.sh
new file mode 100755
index 0000000..c861843
--- /dev/null
+++ b/postprocess-headers.sh
@@ -0,0 +1,18 @@
+cd "${TARGET_BUILD_DIR}/${PUBLIC_HEADERS_FOLDER_PATH}"
+
+UNIFDEF_OPTIONS="-D__MAC_OS_X_VERSION_MIN_REQUIRED=${TARGET_MAC_OS_X_VERSION_MAJOR}"
+
+for ((i = 0; i < ${SCRIPT_INPUT_FILE_COUNT}; ++i)); do
+    eval HEADER=\${SCRIPT_INPUT_FILE_${i}};
+    unifdef -B ${UNIFDEF_OPTIONS} -o "${HEADER}".unifdef "${HEADER}"
+    case $? in
+    0)
+        rm "${HEADER}".unifdef
+        ;;
+    1)
+        mv "${HEADER}"{.unifdef,}
+        ;;
+    *)
+        exit 1
+    esac
+done
diff --git a/profiler/ProfilerBytecode.cpp b/profiler/ProfilerBytecode.cpp
new file mode 100644
index 0000000..b76e78f
--- /dev/null
+++ b/profiler/ProfilerBytecode.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerBytecode.h"
+
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+#include "Opcode.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace Profiler {
+
+JSValue Bytecode::toJS(ExecState* exec) const
+{
+    JSObject* result = constructEmptyObject(exec);
+    result->putDirect(exec->vm(), exec->propertyNames().bytecodeIndex, jsNumber(m_bytecodeIndex));
+    result->putDirect(exec->vm(), exec->propertyNames().opcode, jsString(exec, String::fromUTF8(opcodeNames[m_opcodeID])));
+    result->putDirect(exec->vm(), exec->propertyNames().description, jsString(exec, String::fromUTF8(m_description)));
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerBytecode.h b/profiler/ProfilerBytecode.h
new file mode 100644
index 0000000..72c66c5
--- /dev/null
+++ b/profiler/ProfilerBytecode.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+enum OpcodeID : unsigned;
+
+namespace Profiler {
+
+class Bytecode {
+public:
+    Bytecode()
+        : m_bytecodeIndex(std::numeric_limits<unsigned>::max())
+    {
+    }
+    
+    Bytecode(unsigned bytecodeIndex, OpcodeID opcodeID, const CString& description)
+        : m_bytecodeIndex(bytecodeIndex)
+        , m_opcodeID(opcodeID)
+        , m_description(description)
+    {
+    }
+    
+    unsigned bytecodeIndex() const { return m_bytecodeIndex; }
+    OpcodeID opcodeID() const { return m_opcodeID; }
+    const CString& description() const { return m_description; }
+    
+    JSValue toJS(ExecState*) const;
+private:
+    unsigned m_bytecodeIndex;
+    OpcodeID m_opcodeID;
+    CString m_description;
+};
+
+inline unsigned getBytecodeIndexForBytecode(Bytecode* bytecode) { return bytecode->bytecodeIndex(); }
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerBytecodeSequence.cpp b/profiler/ProfilerBytecodeSequence.cpp
new file mode 100644
index 0000000..09b8213
--- /dev/null
+++ b/profiler/ProfilerBytecodeSequence.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2012-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerBytecodeSequence.h"
+
+#include "CodeBlock.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "Operands.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace Profiler {
+
+BytecodeSequence::BytecodeSequence(CodeBlock* codeBlock)
+{
+    StringPrintStream out;
+    
+    for (unsigned i = 0; i < codeBlock->numberOfArgumentValueProfiles(); ++i) {
+        ConcurrentJSLocker locker(codeBlock->m_lock);
+        CString description = codeBlock->valueProfileForArgument(i)->briefDescription(locker);
+        if (!description.length())
+            continue;
+        out.reset();
+        out.print("arg", i, ": ", description);
+        m_header.append(out.toCString());
+    }
+    
+    StubInfoMap stubInfos;
+    codeBlock->getStubInfoMap(stubInfos);
+    
+    for (unsigned bytecodeIndex = 0; bytecodeIndex < codeBlock->instructions().size();) {
+        out.reset();
+        codeBlock->dumpBytecode(out, bytecodeIndex, stubInfos);
+        m_sequence.append(Bytecode(bytecodeIndex, codeBlock->vm()->interpreter->getOpcodeID(codeBlock->instructions()[bytecodeIndex].u.opcode), out.toCString()));
+        bytecodeIndex += opcodeLength(
+            codeBlock->vm()->interpreter->getOpcodeID(
+                codeBlock->instructions()[bytecodeIndex].u.opcode));
+    }
+}
+
+BytecodeSequence::~BytecodeSequence()
+{
+}
+
+unsigned BytecodeSequence::indexForBytecodeIndex(unsigned bytecodeIndex) const
+{
+    return binarySearch<Bytecode, unsigned>(m_sequence, m_sequence.size(), bytecodeIndex, getBytecodeIndexForBytecode) - m_sequence.begin();
+}
+
+const Bytecode& BytecodeSequence::forBytecodeIndex(unsigned bytecodeIndex) const
+{
+    return at(indexForBytecodeIndex(bytecodeIndex));
+}
+
+void BytecodeSequence::addSequenceProperties(ExecState* exec, JSObject* result) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSArray* header = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, void());
+    for (unsigned i = 0; i < m_header.size(); ++i) {
+        header->putDirectIndex(exec, i, jsString(exec, String::fromUTF8(m_header[i])));
+        RETURN_IF_EXCEPTION(scope, void());
+    }
+    result->putDirect(vm, exec->propertyNames().header, header);
+    
+    JSArray* sequence = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, void());
+    for (unsigned i = 0; i < m_sequence.size(); ++i) {
+        sequence->putDirectIndex(exec, i, m_sequence[i].toJS(exec));
+        RETURN_IF_EXCEPTION(scope, void());
+    }
+    result->putDirect(vm, exec->propertyNames().bytecode, sequence);
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerBytecodeSequence.h b/profiler/ProfilerBytecodeSequence.h
new file mode 100644
index 0000000..979f0c4
--- /dev/null
+++ b/profiler/ProfilerBytecodeSequence.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "ProfilerBytecode.h"
+#include <wtf/PrintStream.h>
+#include <wtf/Vector.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class CodeBlock;
+
+namespace Profiler {
+
+class BytecodeSequence {
+public:
+    BytecodeSequence(CodeBlock*);
+    ~BytecodeSequence();
+    
+    // Note that this data structure is not indexed by bytecode index.
+    unsigned size() const { return m_sequence.size(); }
+    const Bytecode& at(unsigned i) const { return m_sequence[i]; }
+
+    unsigned indexForBytecodeIndex(unsigned bytecodeIndex) const;
+    const Bytecode& forBytecodeIndex(unsigned bytecodeIndex) const;
+
+protected:
+    void addSequenceProperties(ExecState*, JSObject*) const;
+    
+private:
+    Vector<CString> m_header;
+    Vector<Bytecode> m_sequence;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerBytecodes.cpp b/profiler/ProfilerBytecodes.cpp
new file mode 100644
index 0000000..74c55ab
--- /dev/null
+++ b/profiler/ProfilerBytecodes.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerBytecodes.h"
+
+#include "CodeBlock.h"
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace Profiler {
+
+Bytecodes::Bytecodes(size_t id, CodeBlock* codeBlock)
+    : BytecodeSequence(codeBlock)
+    , m_id(id)
+    , m_inferredName(codeBlock->inferredName())
+    , m_sourceCode(codeBlock->sourceCodeForTools())
+    , m_hash(codeBlock->hash())
+    , m_instructionCount(codeBlock->instructionCount())
+{
+}
+
+Bytecodes::~Bytecodes() { }
+
+void Bytecodes::dump(PrintStream& out) const
+{
+    out.print("#", m_hash, "(", m_id, ")");
+}
+
+JSValue Bytecodes::toJS(ExecState* exec) const
+{
+    JSObject* result = constructEmptyObject(exec);
+    
+    result->putDirect(exec->vm(), exec->propertyNames().bytecodesID, jsNumber(m_id));
+    result->putDirect(exec->vm(), exec->propertyNames().inferredName, jsString(exec, String::fromUTF8(m_inferredName)));
+    result->putDirect(exec->vm(), exec->propertyNames().sourceCode, jsString(exec, String::fromUTF8(m_sourceCode)));
+    result->putDirect(exec->vm(), exec->propertyNames().hash, jsString(exec, String::fromUTF8(toCString(m_hash))));
+    result->putDirect(exec->vm(), exec->propertyNames().instructionCount, jsNumber(m_instructionCount));
+    addSequenceProperties(exec, result);
+    
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerBytecodes.h b/profiler/ProfilerBytecodes.h
new file mode 100644
index 0000000..b85936d
--- /dev/null
+++ b/profiler/ProfilerBytecodes.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlockHash.h"
+#include "JSCJSValue.h"
+#include "ProfilerBytecodeSequence.h"
+#include <wtf/PrintStream.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC { namespace Profiler {
+
+class Bytecodes : public BytecodeSequence {
+public:
+    Bytecodes(size_t id, CodeBlock*);
+    ~Bytecodes();
+    
+    size_t id() const { return m_id; }
+    const CString& inferredName() const { return m_inferredName; }
+    const CString& sourceCode() const { return m_sourceCode; }
+    unsigned instructionCount() const { return m_instructionCount; }
+    CodeBlockHash hash() const { return m_hash; }
+
+    void dump(PrintStream&) const;
+    
+    JSValue toJS(ExecState*) const;
+    
+private:
+    size_t m_id;
+    CString m_inferredName;
+    CString m_sourceCode;
+    CodeBlockHash m_hash;
+    unsigned m_instructionCount;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerCompilation.cpp b/profiler/ProfilerCompilation.cpp
new file mode 100644
index 0000000..255f831
--- /dev/null
+++ b/profiler/ProfilerCompilation.cpp
@@ -0,0 +1,189 @@
+/*
+ * Copyright (C) 2012-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerCompilation.h"
+
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+#include "ProfilerDatabase.h"
+#include "Watchpoint.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace Profiler {
+
+Compilation::Compilation(Bytecodes* bytecodes, CompilationKind kind)
+    : m_bytecodes(bytecodes)
+    , m_kind(kind)
+    , m_jettisonReason(NotJettisoned)
+    , m_numInlinedGetByIds(0)
+    , m_numInlinedPutByIds(0)
+    , m_numInlinedCalls(0)
+    , m_uid(UID::create())
+{
+}
+
+Compilation::~Compilation() { }
+
+void Compilation::addProfiledBytecodes(Database& database, CodeBlock* profiledBlock)
+{
+    Bytecodes* bytecodes = database.ensureBytecodesFor(profiledBlock);
+    
+    // First make sure that we haven't already added profiled bytecodes for this code
+    // block. We do this using an O(N) search because I suspect that this list will
+    // tend to be fairly small, and the additional space costs of having a HashMap/Set
+    // would be greater than the time cost of occasionally doing this search.
+    
+    for (unsigned i = m_profiledBytecodes.size(); i--;) {
+        if (m_profiledBytecodes[i].bytecodes() == bytecodes)
+            return;
+    }
+    
+    m_profiledBytecodes.append(ProfiledBytecodes(bytecodes, profiledBlock));
+}
+
+void Compilation::addDescription(const CompiledBytecode& compiledBytecode)
+{
+    m_descriptions.append(compiledBytecode);
+}
+
+void Compilation::addDescription(const OriginStack& stack, const CString& description)
+{
+    addDescription(CompiledBytecode(stack, description));
+}
+
+ExecutionCounter* Compilation::executionCounterFor(const OriginStack& origin)
+{
+    std::unique_ptr<ExecutionCounter>& counter = m_counters.add(origin, nullptr).iterator->value;
+    if (!counter)
+        counter = std::make_unique<ExecutionCounter>();
+
+    return counter.get();
+}
+
+void Compilation::addOSRExitSite(const Vector<const void*>& codeAddresses)
+{
+    m_osrExitSites.append(OSRExitSite(codeAddresses));
+}
+
+OSRExit* Compilation::addOSRExit(unsigned id, const OriginStack& originStack, ExitKind exitKind, bool isWatchpoint)
+{
+    m_osrExits.append(OSRExit(id, originStack, exitKind, isWatchpoint));
+    return &m_osrExits.last();
+}
+
+void Compilation::setJettisonReason(JettisonReason jettisonReason, const FireDetail* detail)
+{
+    if (m_jettisonReason != NotJettisoned)
+        return; // We only care about the original jettison reason.
+    
+    m_jettisonReason = jettisonReason;
+    if (detail)
+        m_additionalJettisonReason = toCString(*detail);
+    else
+        m_additionalJettisonReason = CString();
+}
+
+void Compilation::dump(PrintStream& out) const
+{
+    out.print("Comp", m_uid);
+}
+
+JSValue Compilation::toJS(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* result = constructEmptyObject(exec);
+    RETURN_IF_EXCEPTION(scope, { });
+    result->putDirect(vm, exec->propertyNames().bytecodesID, jsNumber(m_bytecodes->id()));
+    result->putDirect(vm, exec->propertyNames().compilationKind, jsString(exec, String::fromUTF8(toCString(m_kind))));
+    
+    JSArray* profiledBytecodes = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < m_profiledBytecodes.size(); ++i) {
+        auto value = m_profiledBytecodes[i].toJS(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        profiledBytecodes->putDirectIndex(exec, i, value);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    result->putDirect(vm, exec->propertyNames().profiledBytecodes, profiledBytecodes);
+    
+    JSArray* descriptions = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < m_descriptions.size(); ++i) {
+        auto value = m_descriptions[i].toJS(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        descriptions->putDirectIndex(exec, i, value);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    result->putDirect(vm, exec->propertyNames().descriptions, descriptions);
+    
+    JSArray* counters = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (auto it = m_counters.begin(), end = m_counters.end(); it != end; ++it) {
+        JSObject* counterEntry = constructEmptyObject(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        auto value = it->key.toJS(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        counterEntry->putDirect(vm, exec->propertyNames().origin, value);
+        counterEntry->putDirect(vm, exec->propertyNames().executionCount, jsNumber(it->value->count()));
+        counters->push(exec, counterEntry);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    result->putDirect(vm, exec->propertyNames().counters, counters);
+    
+    JSArray* exitSites = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < m_osrExitSites.size(); ++i) {
+        auto value = m_osrExitSites[i].toJS(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        exitSites->putDirectIndex(exec, i, value);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    result->putDirect(vm, exec->propertyNames().osrExitSites, exitSites);
+    
+    JSArray* exits = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < m_osrExits.size(); ++i) {
+        exits->putDirectIndex(exec, i, m_osrExits[i].toJS(exec));
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    result->putDirect(vm, exec->propertyNames().osrExits, exits);
+    
+    result->putDirect(vm, exec->propertyNames().numInlinedGetByIds, jsNumber(m_numInlinedGetByIds));
+    result->putDirect(vm, exec->propertyNames().numInlinedPutByIds, jsNumber(m_numInlinedPutByIds));
+    result->putDirect(vm, exec->propertyNames().numInlinedCalls, jsNumber(m_numInlinedCalls));
+    result->putDirect(vm, exec->propertyNames().jettisonReason, jsString(exec, String::fromUTF8(toCString(m_jettisonReason))));
+    if (!m_additionalJettisonReason.isNull())
+        result->putDirect(vm, exec->propertyNames().additionalJettisonReason, jsString(exec, String::fromUTF8(m_additionalJettisonReason)));
+    
+    result->putDirect(vm, exec->propertyNames().uid, m_uid.toJS(exec));
+    
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerCompilation.h b/profiler/ProfilerCompilation.h
new file mode 100644
index 0000000..1e05862
--- /dev/null
+++ b/profiler/ProfilerCompilation.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ExitKind.h"
+#include "JSCJSValue.h"
+#include "ProfilerCompilationKind.h"
+#include "ProfilerCompiledBytecode.h"
+#include "ProfilerExecutionCounter.h"
+#include "ProfilerJettisonReason.h"
+#include "ProfilerOSRExit.h"
+#include "ProfilerOSRExitSite.h"
+#include "ProfilerOriginStack.h"
+#include "ProfilerProfiledBytecodes.h"
+#include "ProfilerUID.h"
+#include <wtf/RefCounted.h>
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+class FireDetail;
+
+namespace Profiler {
+
+class Bytecodes;
+class Database;
+
+// Represents the act of executing some bytecodes in some engine, and does
+// all of the counting for those executions.
+
+class Compilation : public RefCounted<Compilation> {
+public:
+    Compilation(Bytecodes*, CompilationKind);
+    ~Compilation();
+    
+    void addProfiledBytecodes(Database&, CodeBlock*);
+    unsigned profiledBytecodesSize() const { return m_profiledBytecodes.size(); }
+    const ProfiledBytecodes& profiledBytecodesAt(unsigned i) const { return m_profiledBytecodes[i]; }
+    
+    void noticeInlinedGetById() { m_numInlinedGetByIds++; }
+    void noticeInlinedPutById() { m_numInlinedPutByIds++; }
+    void noticeInlinedCall() { m_numInlinedCalls++; }
+    
+    Bytecodes* bytecodes() const { return m_bytecodes; }
+    CompilationKind kind() const { return m_kind; }
+    
+    void addDescription(const CompiledBytecode&);
+    void addDescription(const OriginStack&, const CString& description);
+    ExecutionCounter* executionCounterFor(const OriginStack&);
+    void addOSRExitSite(const Vector<const void*>& codeAddresses);
+    OSRExit* addOSRExit(unsigned id, const OriginStack&, ExitKind, bool isWatchpoint);
+    
+    void setJettisonReason(JettisonReason, const FireDetail*);
+    
+    UID uid() const { return m_uid; }
+    
+    void dump(PrintStream&) const;
+    JSValue toJS(ExecState*) const;
+    
+private:
+    Bytecodes* m_bytecodes;
+    CompilationKind m_kind;
+    JettisonReason m_jettisonReason;
+    CString m_additionalJettisonReason;
+    Vector<ProfiledBytecodes> m_profiledBytecodes;
+    Vector<CompiledBytecode> m_descriptions;
+    HashMap<OriginStack, std::unique_ptr<ExecutionCounter>> m_counters;
+    Vector<OSRExitSite> m_osrExitSites;
+    SegmentedVector<OSRExit> m_osrExits;
+    unsigned m_numInlinedGetByIds;
+    unsigned m_numInlinedPutByIds;
+    unsigned m_numInlinedCalls;
+    UID m_uid;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerCompilationKind.cpp b/profiler/ProfilerCompilationKind.cpp
new file mode 100644
index 0000000..3fbe251
--- /dev/null
+++ b/profiler/ProfilerCompilationKind.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerCompilationKind.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::Profiler::CompilationKind kind)
+{
+    switch (kind) {
+    case JSC::Profiler::LLInt:
+        out.print("LLInt");
+        return;
+    case JSC::Profiler::Baseline:
+        out.print("Baseline");
+        return;
+    case JSC::Profiler::DFG:
+        out.print("DFG");
+        return;
+    case JSC::Profiler::FTL:
+        out.print("FTL");
+        return;
+    case JSC::Profiler::FTLForOSREntry:
+        out.print("FTLForOSREntry");
+        return;
+    default:
+        CRASH();
+        return;
+    }
+}
+
+} // namespace WTF
+
diff --git a/profiler/ProfilerCompilationKind.h b/profiler/ProfilerCompilationKind.h
new file mode 100644
index 0000000..aaefd4b
--- /dev/null
+++ b/profiler/ProfilerCompilationKind.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC { namespace Profiler {
+
+enum CompilationKind {
+    LLInt,
+    Baseline,
+    DFG,
+    FTL,
+    FTLForOSREntry
+};
+
+} } // namespace JSC::Profiler
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::Profiler::CompilationKind);
+
+} // namespace WTF
diff --git a/profiler/ProfilerCompiledBytecode.cpp b/profiler/ProfilerCompiledBytecode.cpp
new file mode 100644
index 0000000..4891c31
--- /dev/null
+++ b/profiler/ProfilerCompiledBytecode.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerCompiledBytecode.h"
+
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace Profiler {
+
+CompiledBytecode::CompiledBytecode(const OriginStack& origin, const CString& description)
+    : m_origin(origin)
+    , m_description(description)
+{
+}
+
+CompiledBytecode::~CompiledBytecode()
+{
+}
+
+JSValue CompiledBytecode::toJS(ExecState* exec) const
+{
+    JSObject* result = constructEmptyObject(exec);
+    
+    result->putDirect(exec->vm(), exec->propertyNames().origin, m_origin.toJS(exec));
+    result->putDirect(exec->vm(), exec->propertyNames().description, jsString(exec, String::fromUTF8(m_description)));
+    
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerCompiledBytecode.h b/profiler/ProfilerCompiledBytecode.h
new file mode 100644
index 0000000..5f8e4df
--- /dev/null
+++ b/profiler/ProfilerCompiledBytecode.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "ProfilerOriginStack.h"
+#include <wtf/text/CString.h>
+
+namespace JSC { namespace Profiler {
+
+class CompiledBytecode {
+public:
+    // It's valid to have an empty OriginStack, which indicates that this is some
+    // sort of non-bytecode-related machine code.
+    CompiledBytecode(const OriginStack&, const CString& description);
+    ~CompiledBytecode();
+    
+    const OriginStack& originStack() const { return m_origin; }
+    const CString& description() const { return m_description; }
+    
+    JSValue toJS(ExecState*) const;
+    
+private:
+    OriginStack m_origin;
+    CString m_description;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerDatabase.cpp b/profiler/ProfilerDatabase.cpp
new file mode 100644
index 0000000..8ed9f18
--- /dev/null
+++ b/profiler/ProfilerDatabase.cpp
@@ -0,0 +1,235 @@
+/*
+ * Copyright (C) 2012-2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerDatabase.h"
+
+#include "CodeBlock.h"
+#include "JSONObject.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+#include <wtf/CurrentTime.h>
+
+namespace JSC { namespace Profiler {
+
+static std::atomic<int> databaseCounter;
+
+static StaticLock registrationLock;
+static std::atomic<int> didRegisterAtExit;
+static Database* firstDatabase;
+
+Database::Database(VM& vm)
+    : m_databaseID(++databaseCounter)
+    , m_vm(vm)
+    , m_shouldSaveAtExit(false)
+    , m_nextRegisteredDatabase(0)
+{
+}
+
+Database::~Database()
+{
+    if (m_shouldSaveAtExit) {
+        removeDatabaseFromAtExit();
+        performAtExitSave();
+    }
+}
+
+Bytecodes* Database::ensureBytecodesFor(CodeBlock* codeBlock)
+{
+    LockHolder locker(m_lock);
+    return ensureBytecodesFor(locker, codeBlock);
+}
+
+Bytecodes* Database::ensureBytecodesFor(const LockHolder&, CodeBlock* codeBlock)
+{
+    codeBlock = codeBlock->baselineAlternative();
+    
+    HashMap<CodeBlock*, Bytecodes*>::iterator iter = m_bytecodesMap.find(codeBlock);
+    if (iter != m_bytecodesMap.end())
+        return iter->value;
+    
+    m_bytecodes.append(Bytecodes(m_bytecodes.size(), codeBlock));
+    Bytecodes* result = &m_bytecodes.last();
+    
+    m_bytecodesMap.add(codeBlock, result);
+    
+    return result;
+}
+
+void Database::notifyDestruction(CodeBlock* codeBlock)
+{
+    LockHolder locker(m_lock);
+    
+    m_bytecodesMap.remove(codeBlock);
+    m_compilationMap.remove(codeBlock);
+}
+
+void Database::addCompilation(CodeBlock* codeBlock, PassRefPtr<Compilation> passedCompilation)
+{
+    LockHolder locker(m_lock);
+    ASSERT(!isCompilationThread());
+
+    RefPtr<Compilation> compilation = passedCompilation;
+    
+    m_compilations.append(compilation);
+    m_compilationMap.set(codeBlock, compilation);
+}
+
+JSValue Database::toJS(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* result = constructEmptyObject(exec);
+    
+    JSArray* bytecodes = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < m_bytecodes.size(); ++i) {
+        auto value = m_bytecodes[i].toJS(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        bytecodes->putDirectIndex(exec, i, value);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    result->putDirect(vm, exec->propertyNames().bytecodes, bytecodes);
+    
+    JSArray* compilations = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < m_compilations.size(); ++i) {
+        auto value = m_compilations[i]->toJS(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        compilations->putDirectIndex(exec, i, value);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    result->putDirect(vm, exec->propertyNames().compilations, compilations);
+    
+    JSArray* events = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < m_events.size(); ++i) {
+        auto value = m_events[i].toJS(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        events->putDirectIndex(exec, i, value);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    result->putDirect(vm, exec->propertyNames().events, events);
+    
+    return result;
+}
+
+String Database::toJSON() const
+{
+    auto scope = DECLARE_THROW_SCOPE(m_vm);
+    JSGlobalObject* globalObject = JSGlobalObject::create(
+        m_vm, JSGlobalObject::createStructure(m_vm, jsNull()));
+
+    auto value = toJS(globalObject->globalExec());
+    RETURN_IF_EXCEPTION(scope, String());
+    scope.release();
+    return JSONStringify(globalObject->globalExec(), value, 0);
+}
+
+bool Database::save(const char* filename) const
+{
+    auto scope = DECLARE_CATCH_SCOPE(m_vm);
+    auto out = FilePrintStream::open(filename, "w");
+    if (!out)
+        return false;
+    
+    String data = toJSON();
+    if (UNLIKELY(scope.exception())) {
+        scope.clearException();
+        return false;
+    }
+    out->print(data);
+    return true;
+}
+
+void Database::registerToSaveAtExit(const char* filename)
+{
+    m_atExitSaveFilename = filename;
+    
+    if (m_shouldSaveAtExit)
+        return;
+    
+    addDatabaseToAtExit();
+    m_shouldSaveAtExit = true;
+}
+
+void Database::logEvent(CodeBlock* codeBlock, const char* summary, const CString& detail)
+{
+    LockHolder locker(m_lock);
+    
+    Bytecodes* bytecodes = ensureBytecodesFor(locker, codeBlock);
+    Compilation* compilation = m_compilationMap.get(codeBlock);
+    m_events.append(Event(currentTime(), bytecodes, compilation, summary, detail));
+}
+
+void Database::addDatabaseToAtExit()
+{
+    if (++didRegisterAtExit == 1)
+        atexit(atExitCallback);
+    
+    LockHolder holder(registrationLock);
+    m_nextRegisteredDatabase = firstDatabase;
+    firstDatabase = this;
+}
+
+void Database::removeDatabaseFromAtExit()
+{
+    LockHolder holder(registrationLock);
+    for (Database** current = &firstDatabase; *current; current = &(*current)->m_nextRegisteredDatabase) {
+        if (*current != this)
+            continue;
+        *current = m_nextRegisteredDatabase;
+        m_nextRegisteredDatabase = 0;
+        m_shouldSaveAtExit = false;
+        break;
+    }
+}
+
+void Database::performAtExitSave() const
+{
+    JSLockHolder lock(m_vm);
+    save(m_atExitSaveFilename.data());
+}
+
+Database* Database::removeFirstAtExitDatabase()
+{
+    LockHolder holder(registrationLock);
+    Database* result = firstDatabase;
+    if (result) {
+        firstDatabase = result->m_nextRegisteredDatabase;
+        result->m_nextRegisteredDatabase = 0;
+        result->m_shouldSaveAtExit = false;
+    }
+    return result;
+}
+
+void Database::atExitCallback()
+{
+    while (Database* database = removeFirstAtExitDatabase())
+        database->performAtExitSave();
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerDatabase.h b/profiler/ProfilerDatabase.h
new file mode 100644
index 0000000..206aa3a
--- /dev/null
+++ b/profiler/ProfilerDatabase.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2012-2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "ProfilerBytecodes.h"
+#include "ProfilerCompilation.h"
+#include "ProfilerCompilationKind.h"
+#include "ProfilerEvent.h"
+#include <wtf/FastMalloc.h>
+#include <wtf/HashMap.h>
+#include <wtf/Lock.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/SegmentedVector.h>
+#include <wtf/ThreadingPrimitives.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC { namespace Profiler {
+
+class Database {
+    WTF_MAKE_FAST_ALLOCATED; WTF_MAKE_NONCOPYABLE(Database);
+public:
+    JS_EXPORT_PRIVATE Database(VM&);
+    JS_EXPORT_PRIVATE ~Database();
+    
+    int databaseID() const { return m_databaseID; }
+    
+    Bytecodes* ensureBytecodesFor(CodeBlock*);
+    void notifyDestruction(CodeBlock*);
+    
+    void addCompilation(CodeBlock*, PassRefPtr<Compilation>);
+    
+    // Converts the database to a JavaScript object that is suitable for JSON stringification.
+    // Note that it's probably a good idea to use an ExecState* associated with a global
+    // object that is "clean" - i.e. array and object prototypes haven't had strange things
+    // done to them. And yes, it should be appropriate to just use a globalExec here.
+    JS_EXPORT_PRIVATE JSValue toJS(ExecState*) const;
+    
+    // Converts the database to a JavaScript object using a private temporary global object,
+    // and then returns the JSON representation of that object.
+    JS_EXPORT_PRIVATE String toJSON() const;
+    
+    // Saves the JSON representation (from toJSON()) to the given file. Returns false if the
+    // save failed.
+    JS_EXPORT_PRIVATE bool save(const char* filename) const;
+
+    void registerToSaveAtExit(const char* filename);
+    
+    JS_EXPORT_PRIVATE void logEvent(CodeBlock* codeBlock, const char* summary, const CString& detail);
+    
+private:
+    Bytecodes* ensureBytecodesFor(const LockHolder&, CodeBlock*);
+    
+    void addDatabaseToAtExit();
+    void removeDatabaseFromAtExit();
+    void performAtExitSave() const;
+    static Database* removeFirstAtExitDatabase();
+    static void atExitCallback();
+    
+    int m_databaseID;
+    VM& m_vm;
+    SegmentedVector<Bytecodes> m_bytecodes;
+    HashMap<CodeBlock*, Bytecodes*> m_bytecodesMap;
+    Vector<RefPtr<Compilation>> m_compilations;
+    HashMap<CodeBlock*, RefPtr<Compilation>> m_compilationMap;
+    Vector<Event> m_events;
+    bool m_shouldSaveAtExit;
+    CString m_atExitSaveFilename;
+    Database* m_nextRegisteredDatabase;
+    Lock m_lock;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerEvent.cpp b/profiler/ProfilerEvent.cpp
new file mode 100644
index 0000000..e84ef6f
--- /dev/null
+++ b/profiler/ProfilerEvent.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerEvent.h"
+
+#include "JSCInlines.h"
+#include "ObjectConstructor.h"
+#include "ProfilerBytecodes.h"
+#include "ProfilerCompilation.h"
+#include "ProfilerUID.h"
+
+namespace JSC { namespace Profiler {
+
+void Event::dump(PrintStream& out) const
+{
+    out.print(m_time, ": ", pointerDump(m_bytecodes));
+    if (m_compilation)
+        out.print(" ", *m_compilation);
+    out.print(": ", m_summary);
+    if (m_detail.length())
+        out.print(" (", m_detail, ")");
+}
+
+JSValue Event::toJS(ExecState* exec) const
+{
+    JSObject* result = constructEmptyObject(exec);
+    
+    result->putDirect(exec->vm(), exec->propertyNames().time, jsNumber(m_time));
+    result->putDirect(exec->vm(), exec->propertyNames().bytecodesID, jsNumber(m_bytecodes->id()));
+    if (m_compilation)
+        result->putDirect(exec->vm(), exec->propertyNames().compilationUID, m_compilation->uid().toJS(exec));
+    result->putDirect(exec->vm(), exec->propertyNames().summary, jsString(exec, String::fromUTF8(m_summary)));
+    if (m_detail.length())
+        result->putDirect(exec->vm(), exec->propertyNames().detail, jsString(exec, String::fromUTF8(m_detail)));
+    
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerEvent.h b/profiler/ProfilerEvent.h
new file mode 100644
index 0000000..11cb6da
--- /dev/null
+++ b/profiler/ProfilerEvent.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include <wtf/PrintStream.h>
+#include <wtf/text/CString.h>
+
+namespace JSC { namespace Profiler {
+
+class Bytecodes;
+class Compilation;
+
+class Event {
+public:
+    Event()
+    {
+    }
+    
+    Event(double time, Bytecodes* bytecodes, Compilation* compilation, const char* summary, const CString& detail)
+        : m_time(time)
+        , m_bytecodes(bytecodes)
+        , m_compilation(compilation)
+        , m_summary(summary)
+        , m_detail(detail)
+    {
+    }
+    
+    explicit operator bool() const
+    {
+        return m_bytecodes;
+    }
+    
+    double time() const { return m_time; }
+    Bytecodes* bytecodes() const { return m_bytecodes; }
+    Compilation* compilation() const { return m_compilation; }
+    const char* summary() const { return m_summary; }
+    const CString& detail() const { return m_detail; }
+    
+    void dump(PrintStream&) const;
+    JSValue toJS(ExecState*) const;
+    
+private:
+    double m_time { 0 };
+    Bytecodes* m_bytecodes { nullptr };
+    Compilation* m_compilation { nullptr };
+    const char* m_summary { nullptr };
+    CString m_detail;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerExecutionCounter.h b/profiler/ProfilerExecutionCounter.h
new file mode 100644
index 0000000..e11747c
--- /dev/null
+++ b/profiler/ProfilerExecutionCounter.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/FastMalloc.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC { namespace Profiler {
+
+class ExecutionCounter {
+    WTF_MAKE_FAST_ALLOCATED; WTF_MAKE_NONCOPYABLE(ExecutionCounter);
+public:
+    ExecutionCounter() : m_counter(0) { }
+    
+    uint64_t* address() { return &m_counter; }
+    
+    uint64_t count() const { return m_counter; }
+
+private:
+    uint64_t m_counter;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerJettisonReason.cpp b/profiler/ProfilerJettisonReason.cpp
new file mode 100644
index 0000000..3751fed
--- /dev/null
+++ b/profiler/ProfilerJettisonReason.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerJettisonReason.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+using namespace JSC::Profiler;
+
+void printInternal(PrintStream& out, JettisonReason reason)
+{
+    switch (reason) {
+    case NotJettisoned:
+        out.print("NotJettisoned");
+        return;
+    case JettisonDueToWeakReference:
+        out.print("WeakReference");
+        return;
+    case JettisonDueToDebuggerBreakpoint:
+        out.print("DebuggerBreakpoint");
+        return;
+    case JettisonDueToDebuggerStepping:
+        out.print("DebuggerStepping");
+        return;
+    case JettisonDueToBaselineLoopReoptimizationTrigger:
+        out.print("BaselineLoopReoptimizationTrigger");
+        return;
+    case JettisonDueToBaselineLoopReoptimizationTriggerOnOSREntryFail:
+        out.print("BaselineLoopReoptimizationTriggerOnOSREntryFail");
+        return;
+    case JettisonDueToOSRExit:
+        out.print("OSRExit");
+        return;
+    case JettisonDueToProfiledWatchpoint:
+        out.print("ProfiledWatchpoint");
+        return;
+    case JettisonDueToUnprofiledWatchpoint:
+        out.print("UnprofiledWatchpoint");
+        return;
+    case JettisonDueToOldAge:
+        out.print("JettisonDueToOldAge");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/profiler/ProfilerJettisonReason.h b/profiler/ProfilerJettisonReason.h
new file mode 100644
index 0000000..745964f
--- /dev/null
+++ b/profiler/ProfilerJettisonReason.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC { namespace Profiler {
+
+enum JettisonReason {
+    NotJettisoned,
+    JettisonDueToWeakReference,
+    JettisonDueToDebuggerBreakpoint,
+    JettisonDueToDebuggerStepping,
+    JettisonDueToBaselineLoopReoptimizationTrigger,
+    JettisonDueToBaselineLoopReoptimizationTriggerOnOSREntryFail,
+    JettisonDueToOSRExit,
+    JettisonDueToProfiledWatchpoint,
+    JettisonDueToUnprofiledWatchpoint,
+    JettisonDueToOldAge
+};
+
+} } // namespace JSC::Profiler
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::Profiler::JettisonReason);
+
+} // namespace WTF
diff --git a/profiler/ProfilerOSRExit.cpp b/profiler/ProfilerOSRExit.cpp
new file mode 100644
index 0000000..2a5d5be
--- /dev/null
+++ b/profiler/ProfilerOSRExit.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerOSRExit.h"
+
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace Profiler {
+
+OSRExit::OSRExit(unsigned id, const OriginStack& origin, ExitKind kind, bool isWatchpoint)
+    : m_id(id)
+    , m_origin(origin)
+    , m_exitKind(kind)
+    , m_isWatchpoint(isWatchpoint)
+    , m_counter(0)
+{
+}
+
+OSRExit::~OSRExit()
+{
+}
+
+JSValue OSRExit::toJS(ExecState* exec) const
+{
+    JSObject* result = constructEmptyObject(exec);
+    result->putDirect(exec->vm(), exec->propertyNames().id, jsNumber(m_id));
+    result->putDirect(exec->vm(), exec->propertyNames().origin, m_origin.toJS(exec));
+    result->putDirect(exec->vm(), exec->propertyNames().exitKind, jsString(exec, exitKindToString(m_exitKind)));
+    result->putDirect(exec->vm(), exec->propertyNames().isWatchpoint, jsBoolean(m_isWatchpoint));
+    result->putDirect(exec->vm(), exec->propertyNames().count, jsNumber(m_counter));
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerOSRExit.h b/profiler/ProfilerOSRExit.h
new file mode 100644
index 0000000..733df63
--- /dev/null
+++ b/profiler/ProfilerOSRExit.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ExitKind.h"
+#include "JSCJSValue.h"
+#include "ProfilerOriginStack.h"
+
+namespace JSC { namespace Profiler {
+
+class OSRExit {
+public:
+    OSRExit(unsigned id, const OriginStack&, ExitKind, bool isWatchpoint);
+    ~OSRExit();
+    
+    unsigned id() const { return m_id; }
+    const OriginStack& origin() const { return m_origin; }
+    ExitKind exitKind() const { return m_exitKind; }
+    bool isWatchpoint() const { return m_isWatchpoint; }
+    
+    uint64_t* counterAddress() { return &m_counter; }
+    uint64_t count() const { return m_counter; }
+    
+    JSValue toJS(ExecState*) const;
+
+private:
+    unsigned m_id;
+    OriginStack m_origin;
+    ExitKind m_exitKind;
+    bool m_isWatchpoint;
+    uint64_t m_counter;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerOSRExitSite.cpp b/profiler/ProfilerOSRExitSite.cpp
new file mode 100644
index 0000000..8b5568f
--- /dev/null
+++ b/profiler/ProfilerOSRExitSite.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerOSRExitSite.h"
+
+#include "JSGlobalObject.h"
+#include "JSScope.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC { namespace Profiler {
+
+JSValue OSRExitSite::toJS(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSArray* result = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < m_codeAddresses.size(); ++i) {
+        result->putDirectIndex(exec, i, jsString(exec, toString(RawPointer(m_codeAddresses[i]))));
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerOSRExitSite.h b/profiler/ProfilerOSRExitSite.h
new file mode 100644
index 0000000..1776f1d
--- /dev/null
+++ b/profiler/ProfilerOSRExitSite.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace Profiler {
+
+class OSRExitSite {
+public:
+    explicit OSRExitSite(const Vector<const void*>& codeAddresses)
+        : m_codeAddresses(codeAddresses)
+    {
+    }
+    
+    const Vector<const void*>& codeAddress() const { return m_codeAddresses; }
+    
+    JSValue toJS(ExecState*) const;
+
+private:
+    Vector<const void*> m_codeAddresses;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerOrigin.cpp b/profiler/ProfilerOrigin.cpp
new file mode 100644
index 0000000..7c28f7b
--- /dev/null
+++ b/profiler/ProfilerOrigin.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerOrigin.h"
+
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+#include "ProfilerBytecodes.h"
+#include "ProfilerDatabase.h"
+
+namespace JSC { namespace Profiler {
+
+Origin::Origin(Database& database, CodeBlock* codeBlock, unsigned bytecodeIndex)
+    : m_bytecodes(database.ensureBytecodesFor(codeBlock))
+    , m_bytecodeIndex(bytecodeIndex)
+{
+}
+
+void Origin::dump(PrintStream& out) const
+{
+    out.print(*m_bytecodes, ":bc#", m_bytecodeIndex);
+}
+
+JSValue Origin::toJS(ExecState* exec) const
+{
+    JSObject* result = constructEmptyObject(exec);
+    result->putDirect(exec->vm(), exec->propertyNames().bytecodesID, jsNumber(m_bytecodes->id()));
+    result->putDirect(exec->vm(), exec->propertyNames().bytecodeIndex, jsNumber(m_bytecodeIndex));
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerOrigin.h b/profiler/ProfilerOrigin.h
new file mode 100644
index 0000000..4844f03
--- /dev/null
+++ b/profiler/ProfilerOrigin.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlockHash.h"
+#include "JSCJSValue.h"
+#include <wtf/HashMap.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class CodeBlock;
+
+namespace Profiler {
+
+class Bytecodes;
+class Database;
+
+class Origin {
+public:
+    Origin()
+        : m_bytecodeIndex(std::numeric_limits<unsigned>::max())
+    {
+    }
+    
+    Origin(WTF::HashTableDeletedValueType)
+        : m_bytecodeIndex(std::numeric_limits<unsigned>::max() - 1)
+    {
+    }
+    
+    Origin(Bytecodes* bytecodes, unsigned bytecodeIndex)
+        : m_bytecodes(bytecodes)
+        , m_bytecodeIndex(bytecodeIndex)
+    {
+        ASSERT(m_bytecodeIndex < std::numeric_limits<unsigned>::max() - 1);
+    }
+    
+    Origin(Database&, CodeBlock*, unsigned bytecodeIndex);
+    
+    bool operator!() const { return m_bytecodeIndex == std::numeric_limits<unsigned>::max(); }
+    
+    Bytecodes* bytecodes() const { return m_bytecodes; }
+    unsigned bytecodeIndex() const { return m_bytecodeIndex; }
+    
+    bool operator==(const Origin&) const;
+    bool operator!=(const Origin& other) const { return !(*this == other); }
+    unsigned hash() const;
+    
+    bool isHashTableDeletedValue() const;
+    
+    void dump(PrintStream&) const;
+    JSValue toJS(ExecState*) const;
+
+private:
+    Bytecodes* m_bytecodes;
+    unsigned m_bytecodeIndex;
+};
+
+inline bool Origin::operator==(const Origin& other) const
+{
+    return m_bytecodes == other.m_bytecodes
+        && m_bytecodeIndex == other.m_bytecodeIndex;
+}
+
+inline unsigned Origin::hash() const
+{
+    return WTF::PtrHash<Bytecodes*>::hash(m_bytecodes) + m_bytecodeIndex;
+}
+
+inline bool Origin::isHashTableDeletedValue() const
+{
+    return m_bytecodeIndex == std::numeric_limits<unsigned>::max();
+}
+
+struct OriginHash {
+    static unsigned hash(const Origin& key) { return key.hash(); }
+    static bool equal(const Origin& a, const Origin& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::Profiler
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::Profiler::Origin> {
+    typedef JSC::Profiler::OriginHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::Profiler::Origin> : SimpleClassHashTraits<JSC::Profiler::Origin> { };
+
+} // namespace WTF
diff --git a/profiler/ProfilerOriginStack.cpp b/profiler/ProfilerOriginStack.cpp
new file mode 100644
index 0000000..61dfb63
--- /dev/null
+++ b/profiler/ProfilerOriginStack.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerOriginStack.h"
+
+#include "CodeOrigin.h"
+#include "InlineCallFrame.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+#include "ProfilerDatabase.h"
+
+namespace JSC { namespace Profiler {
+
+OriginStack::OriginStack(WTF::HashTableDeletedValueType)
+{
+    m_stack.append(Origin(WTF::HashTableDeletedValue));
+}
+
+OriginStack::OriginStack(const Origin& origin)
+{
+    m_stack.append(origin);
+}
+
+OriginStack::OriginStack(Database& database, CodeBlock* codeBlock, const CodeOrigin& codeOrigin)
+{
+    Vector<CodeOrigin> stack = codeOrigin.inlineStack();
+    
+    append(Origin(database, codeBlock, stack[0].bytecodeIndex));
+    
+    for (unsigned i = 1; i < stack.size(); ++i) {
+        append(Origin(
+            database.ensureBytecodesFor(stack[i].inlineCallFrame->baselineCodeBlock.get()),
+            stack[i].bytecodeIndex));
+    }
+}
+
+OriginStack::~OriginStack() { }
+
+void OriginStack::append(const Origin& origin)
+{
+    m_stack.append(origin);
+}
+
+bool OriginStack::operator==(const OriginStack& other) const
+{
+    if (m_stack.size() != other.m_stack.size())
+        return false;
+    
+    for (unsigned i = m_stack.size(); i--;) {
+        if (m_stack[i] != other.m_stack[i])
+            return false;
+    }
+    
+    return true;
+}
+
+unsigned OriginStack::hash() const
+{
+    unsigned result = m_stack.size();
+    
+    for (unsigned i = m_stack.size(); i--;) {
+        result *= 3;
+        result += m_stack[i].hash();
+    }
+    
+    return result;
+}
+
+void OriginStack::dump(PrintStream& out) const
+{
+    for (unsigned i = 0; i < m_stack.size(); ++i) {
+        if (i)
+            out.print(" --> ");
+        out.print(m_stack[i]);
+    }
+}
+
+JSValue OriginStack::toJS(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSArray* result = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+    
+    for (unsigned i = 0; i < m_stack.size(); ++i) {
+        result->putDirectIndex(exec, i, m_stack[i].toJS(exec));
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerOriginStack.h b/profiler/ProfilerOriginStack.h
new file mode 100644
index 0000000..36bc13a
--- /dev/null
+++ b/profiler/ProfilerOriginStack.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "ProfilerOrigin.h"
+#include <wtf/HashMap.h>
+#include <wtf/PrintStream.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CodeBlock;
+struct CodeOrigin;
+
+namespace Profiler {
+
+class Database;
+
+class OriginStack {
+public:
+    OriginStack() { }
+    
+    OriginStack(WTF::HashTableDeletedValueType);
+    
+    explicit OriginStack(const Origin&);
+    
+    explicit OriginStack(Database&, CodeBlock*, const CodeOrigin&);
+    
+    ~OriginStack();
+    
+    void append(const Origin&);
+    
+    bool operator!() const { return m_stack.isEmpty(); }
+    
+    unsigned size() const { return m_stack.size(); }
+    const Origin& fromBottom(unsigned i) const { return m_stack[i]; }
+    const Origin& fromTop(unsigned i) const { return m_stack[m_stack.size() - i - 1]; }
+    
+    bool operator==(const OriginStack&) const;
+    unsigned hash() const;
+    
+    bool isHashTableDeletedValue() const;
+    
+    void dump(PrintStream&) const;
+    JSValue toJS(ExecState*) const;
+    
+private:
+    Vector<Origin, 1> m_stack;
+};
+
+inline bool OriginStack::isHashTableDeletedValue() const
+{
+    return m_stack.size() == 1 && m_stack[0].isHashTableDeletedValue();
+}
+
+struct OriginStackHash {
+    static unsigned hash(const OriginStack& key) { return key.hash(); }
+    static bool equal(const OriginStack& a, const OriginStack& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::Profiler
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::Profiler::OriginStack> {
+    typedef JSC::Profiler::OriginStackHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::Profiler::OriginStack> : SimpleClassHashTraits<JSC::Profiler::OriginStack> { };
+
+} // namespace WTF
diff --git a/profiler/ProfilerProfiledBytecodes.cpp b/profiler/ProfilerProfiledBytecodes.cpp
new file mode 100644
index 0000000..fe590ff
--- /dev/null
+++ b/profiler/ProfilerProfiledBytecodes.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerProfiledBytecodes.h"
+
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace Profiler {
+
+ProfiledBytecodes::ProfiledBytecodes(Bytecodes* bytecodes, CodeBlock* profiledBlock)
+    : BytecodeSequence(profiledBlock)
+    , m_bytecodes(bytecodes)
+{
+}
+
+ProfiledBytecodes::~ProfiledBytecodes()
+{
+}
+
+JSValue ProfiledBytecodes::toJS(ExecState* exec) const
+{
+    JSObject* result = constructEmptyObject(exec);
+    
+    result->putDirect(exec->vm(), exec->propertyNames().bytecodesID, jsNumber(m_bytecodes->id()));
+    addSequenceProperties(exec, result);
+    
+    return result;
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerProfiledBytecodes.h b/profiler/ProfilerProfiledBytecodes.h
new file mode 100644
index 0000000..2ef9f44
--- /dev/null
+++ b/profiler/ProfilerProfiledBytecodes.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ProfilerBytecodeSequence.h"
+#include "ProfilerBytecodes.h"
+#include "ProfilerOriginStack.h"
+
+namespace JSC { namespace Profiler {
+
+class ProfiledBytecodes : public BytecodeSequence {
+public:
+    ProfiledBytecodes(Bytecodes*, CodeBlock*);
+    ~ProfiledBytecodes();
+    
+    const Bytecodes* bytecodes() const { return m_bytecodes; }
+    
+    JSValue toJS(ExecState*) const;
+
+private:
+    Bytecodes* m_bytecodes;
+};
+
+} } // namespace JSC::Profiler
diff --git a/profiler/ProfilerUID.cpp b/profiler/ProfilerUID.cpp
new file mode 100644
index 0000000..228988b
--- /dev/null
+++ b/profiler/ProfilerUID.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ProfilerUID.h"
+
+#include "JSCInlines.h"
+#include <wtf/Lock.h>
+
+namespace JSC { namespace Profiler {
+
+UID UID::create()
+{
+    static StaticLock lock;
+    static uint64_t counter;
+    
+    LockHolder locker(lock);
+    UID result;
+    result.m_uid = ++counter;
+    return result;
+}
+
+void UID::dump(PrintStream& out) const
+{
+    out.print(m_uid);
+}
+
+JSValue UID::toJS(ExecState* exec) const
+{
+    return jsString(exec, toString(*this));
+}
+
+} } // namespace JSC::Profiler
+
diff --git a/profiler/ProfilerUID.h b/profiler/ProfilerUID.h
new file mode 100644
index 0000000..97dc320
--- /dev/null
+++ b/profiler/ProfilerUID.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include <wtf/HashMap.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace Profiler {
+
+class UID {
+public:
+    UID()
+        : m_uid(0)
+    {
+    }
+    
+    static UID fromInt(uint64_t value)
+    {
+        UID result;
+        result.m_uid = value;
+        return result;
+    }
+    
+    UID(WTF::HashTableDeletedValueType)
+        : m_uid(std::numeric_limits<uint64_t>::max())
+    {
+    }
+    
+    static UID create();
+    
+    uint64_t toInt() const
+    {
+        return m_uid;
+    }
+    
+    bool operator==(const UID& other) const
+    {
+        return m_uid == other.m_uid;
+    }
+    
+    bool operator!=(const UID& other) const
+    {
+        return !(*this == other);
+    }
+    
+    explicit operator bool() const
+    {
+        return *this != UID();
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return *this != UID(WTF::HashTableDeletedValue);
+    }
+    
+    unsigned hash() const
+    {
+        return IntHash<uint64_t>::hash(m_uid);
+    }
+    
+    void dump(PrintStream&) const;
+    JSValue toJS(ExecState*) const;
+    
+private:
+    uint64_t m_uid;
+};
+
+struct UIDHash {
+    static unsigned hash(const UID& key) { return key.hash(); }
+    static bool equal(const UID& a, const UID& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} } // namespace JSC::Profiler
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::Profiler::UID> {
+    typedef JSC::Profiler::UIDHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::Profiler::UID> : SimpleClassHashTraits<JSC::Profiler::UID> { };
+
+} // namespace WTF
diff --git a/replay/EmptyInputCursor.h b/replay/EmptyInputCursor.h
new file mode 100644
index 0000000..c47e64c
--- /dev/null
+++ b/replay/EmptyInputCursor.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+
+#include "InputCursor.h"
+#include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class EmptyInputCursor final : public InputCursor {
+    WTF_MAKE_NONCOPYABLE(EmptyInputCursor);
+public:
+    virtual ~EmptyInputCursor() { }
+
+    static Ref<EmptyInputCursor> create()
+    {
+        return adoptRef(*new EmptyInputCursor());
+    }
+
+    bool isCapturing() const override { return false; }
+    bool isReplaying() const override { return false; }
+
+    NondeterministicInputBase* uncheckedLoadInput(InputQueue) override
+    {
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    void storeInput(std::unique_ptr<NondeterministicInputBase>) override
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+protected:
+    NondeterministicInputBase* loadInput(InputQueue, const String&) override
+    {
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+private:
+    EmptyInputCursor() { }
+};
+
+} // namespace JSC
+
+using JSC::EmptyInputCursor;
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/EncodedValue.cpp b/replay/EncodedValue.cpp
new file mode 100644
index 0000000..7924528
--- /dev/null
+++ b/replay/EncodedValue.cpp
@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2013 University of Washington. All rights reserved.
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EncodedValue.h"
+
+#if ENABLE(WEB_REPLAY)
+
+#include "InspectorValues.h"
+#include <wtf/text/Base64.h>
+
+using namespace Inspector;
+
+namespace JSC {
+
+RefPtr<InspectorObject> EncodedValue::asObject()
+{
+    RefPtr<InspectorObject> result;
+    bool castSucceeded = m_value->asObject(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+RefPtr<InspectorArray> EncodedValue::asArray()
+{
+    RefPtr<InspectorArray> result;
+    bool castSucceeded = m_value->asArray(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+EncodedValue EncodingTraits<Vector<char>>::encodeValue(const Vector<char>& buffer)
+{
+    return EncodedValue::createString(base64Encode(buffer));
+}
+
+bool EncodingTraits<Vector<char>>::decodeValue(EncodedValue& encodedBuffer, Vector<char>& decodedValue)
+{
+    return base64Decode(encodedBuffer.convertTo<String>(), decodedValue);
+}
+
+template<> EncodedValue ScalarEncodingTraits<bool>::encodeValue(const bool& value)
+{
+    return EncodedValue(InspectorValue::create(value));
+}
+
+template<> EncodedValue ScalarEncodingTraits<double>::encodeValue(const double& value)
+{
+    return EncodedValue(InspectorValue::create(value));
+}
+
+template<> EncodedValue ScalarEncodingTraits<float>::encodeValue(const float& value)
+{
+    return EncodedValue(InspectorValue::create((double)value));
+}
+
+template<> EncodedValue ScalarEncodingTraits<int32_t>::encodeValue(const int32_t& value)
+{
+    return EncodedValue(InspectorValue::create((double)value));
+}
+
+template<> EncodedValue ScalarEncodingTraits<int64_t>::encodeValue(const int64_t& value)
+{
+    return EncodedValue(InspectorValue::create((double)value));
+}
+
+template<> EncodedValue ScalarEncodingTraits<uint32_t>::encodeValue(const uint32_t& value)
+{
+    return EncodedValue(InspectorValue::create((double)value));
+}
+
+template<> EncodedValue ScalarEncodingTraits<uint64_t>::encodeValue(const uint64_t& value)
+{
+    return EncodedValue(InspectorValue::create((double)value));
+}
+
+template<> bool EncodedValue::convertTo<bool>()
+{
+    bool result;
+    bool castSucceeded = m_value->asBoolean(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+template<> double EncodedValue::convertTo<double>()
+{
+    double result;
+    bool castSucceeded = m_value->asDouble(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+template<> float EncodedValue::convertTo<float>()
+{
+    float result;
+    bool castSucceeded = m_value->asDouble(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+template<> int32_t EncodedValue::convertTo<int32_t>()
+{
+    int32_t result;
+    bool castSucceeded = m_value->asInteger(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+template<> int64_t EncodedValue::convertTo<int64_t>()
+{
+    int64_t result;
+    bool castSucceeded = m_value->asInteger(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+template<> uint32_t EncodedValue::convertTo<uint32_t>()
+{
+    uint32_t result;
+    bool castSucceeded = m_value->asInteger(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+template<> uint64_t EncodedValue::convertTo<uint64_t>()
+{
+    uint64_t result;
+    bool castSucceeded = m_value->asInteger(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+template<> String EncodedValue::convertTo<String>()
+{
+    String result;
+    bool castSucceeded = m_value->asString(result);
+    ASSERT_UNUSED(castSucceeded, castSucceeded);
+
+    return result;
+}
+
+template<>
+void EncodedValue::put<EncodedValue>(const String& key, const typename EncodingTraits<EncodedValue>::DecodedType& value)
+{
+    asObject()->setValue(key, value.m_value.copyRef());
+}
+
+template<>
+void EncodedValue::append<EncodedValue>(const typename EncodingTraits<EncodedValue>::DecodedType& value)
+{
+    asArray()->pushValue(value.m_value.copyRef());
+}
+
+template<>
+bool EncodedValue::get<EncodedValue>(const String& key, typename EncodingTraits<EncodedValue>::DecodedType& decodedValue)
+{
+    RefPtr<Inspector::InspectorValue> value;
+    if (!asObject()->getValue(key, value))
+        return false;
+
+    decodedValue = EncodedValue(WTFMove(value));
+    return true;
+}
+
+
+}; // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/EncodedValue.h b/replay/EncodedValue.h
new file mode 100644
index 0000000..9fb1782
--- /dev/null
+++ b/replay/EncodedValue.h
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2013 University of Washington. All rights reserved.
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+
+#include "InspectorValues.h"
+#include <wtf/Forward.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class NondeterministicInputBase;
+template<typename T> struct EncodingTraits;
+
+class EncodedValue final {
+public:
+    explicit EncodedValue(RefPtr<Inspector::InspectorValue>&& value)
+        : m_value(value) { }
+
+    EncodedValue()
+        : m_value(nullptr) { }
+
+    static EncodedValue createObject()
+    {
+        return EncodedValue(Inspector::InspectorObject::create());
+    }
+
+    static EncodedValue createArray()
+    {
+        return EncodedValue(Inspector::InspectorArray::create());
+    }
+
+    static EncodedValue createString(const String& value)
+    {
+        return EncodedValue(Inspector::InspectorValue::create(value));
+    }
+
+    static EncodedValue createString(const char* value)
+    {
+        return EncodedValue(Inspector::InspectorValue::create(value));
+    }
+
+    template<typename T>
+    void put(const String&, const typename EncodingTraits<T>::DecodedType&);
+
+    template<typename T>
+    void append(const typename EncodingTraits<T>::DecodedType&);
+
+    template<typename T> bool get(const String&, typename EncodingTraits<T>::DecodedType&);
+    template<typename T> bool get(const String&, std::unique_ptr<typename EncodingTraits<T>::DecodedType>&);
+
+    template<typename T> T convertTo();
+
+    JS_EXPORT_PRIVATE RefPtr<Inspector::InspectorObject> asObject();
+    JS_EXPORT_PRIVATE RefPtr<Inspector::InspectorArray> asArray();
+
+private:
+    RefPtr<Inspector::InspectorValue> m_value;
+};
+
+template<> JS_EXPORT_PRIVATE bool EncodedValue::convertTo<bool>();
+template<> JS_EXPORT_PRIVATE double EncodedValue::convertTo<double>();
+template<> JS_EXPORT_PRIVATE float EncodedValue::convertTo<float>();
+template<> JS_EXPORT_PRIVATE int32_t EncodedValue::convertTo<int32_t>();
+template<> JS_EXPORT_PRIVATE int64_t EncodedValue::convertTo<int64_t>();
+template<> JS_EXPORT_PRIVATE uint32_t EncodedValue::convertTo<uint32_t>();
+template<> JS_EXPORT_PRIVATE uint64_t EncodedValue::convertTo<uint64_t>();
+template<> JS_EXPORT_PRIVATE String EncodedValue::convertTo<String>();
+
+template<typename T>
+struct EncodingTraits {
+    typedef T DecodedType;
+
+    static EncodedValue encodeValue(const DecodedType&);
+
+    static bool decodeValue(EncodedValue&, DecodedType&);
+    static bool decodeValue(EncodedValue&, std::unique_ptr<DecodedType>&);
+};
+
+template<typename T, size_t inlineCapacity, typename OverflowHandler>
+struct EncodingTraits<Vector<T, inlineCapacity, OverflowHandler>> {
+    typedef Vector<typename EncodingTraits<T>::DecodedType, inlineCapacity, OverflowHandler> DecodedType;
+
+    static EncodedValue encodeValue(const DecodedType& vectorOfValues)
+    {
+        EncodedValue encodedVector = EncodedValue::createArray();
+        for (const typename EncodingTraits<T>::DecodedType& value : vectorOfValues)
+            encodedVector.append<T>(value);
+
+        return encodedVector;
+    }
+
+    static bool decodeValue(EncodedValue& encodedVector, DecodedType& decodedValue)
+    {
+        RefPtr<Inspector::InspectorArray> inspectorArray = encodedVector.asArray();
+        decodedValue = Vector<typename EncodingTraits<T>::DecodedType, inlineCapacity, OverflowHandler>(inspectorArray->length());
+        for (size_t i = 0; i < inspectorArray->length(); ++i) {
+            EncodedValue encodedElement(inspectorArray->get(i));
+            if (!EncodingTraits<T>::decodeValue(encodedElement, decodedValue.at(i)))
+                return false;
+        }
+        return true;
+    }
+};
+
+template<> struct EncodingTraits<EncodedValue> {
+    typedef EncodedValue DecodedType;
+    // We should never attempt to decode or encode an encoded value,
+    // so encodeValue and decodeValue are intentionally omitted here.
+};
+
+// Specialize byte vectors to use base64 encoding.
+template<> struct EncodingTraits<Vector<char>> {
+    typedef Vector<char> DecodedType;
+    static EncodedValue encodeValue(const DecodedType&);
+    static bool decodeValue(EncodedValue&, DecodedType&);
+};
+
+template<typename T>
+struct ScalarEncodingTraits {
+    typedef T DecodedType;
+
+    static JS_EXPORT_PRIVATE EncodedValue encodeValue(const DecodedType& decodedValue);
+    static bool decodeValue(EncodedValue& encodedValue, DecodedType& decodedValue)
+    {
+        decodedValue = encodedValue.convertTo<DecodedType>();
+        return true;
+    }
+};
+
+template<> struct EncodingTraits<bool> : public ScalarEncodingTraits<bool> { };
+template<> struct EncodingTraits<double> : public ScalarEncodingTraits<double> { };
+template<> struct EncodingTraits<float> : public ScalarEncodingTraits<float> { };
+template<> struct EncodingTraits<int32_t> : public ScalarEncodingTraits<int32_t> { };
+template<> struct EncodingTraits<int64_t> : public ScalarEncodingTraits<int64_t> { };
+template<> struct EncodingTraits<uint32_t> : public ScalarEncodingTraits<uint32_t> { };
+template<> struct EncodingTraits<uint64_t> : public ScalarEncodingTraits<uint64_t> { };
+
+template<> struct EncodingTraits<String> : public ScalarEncodingTraits<String> {
+    static EncodedValue encodeValue(const String& value)
+    {
+        return EncodedValue::createString(value);
+    }
+};
+
+// Base cases for loading and storing values.
+template<> JS_EXPORT_PRIVATE
+void EncodedValue::put<EncodedValue>(const String& key, const typename EncodingTraits<EncodedValue>::DecodedType&);
+
+template<> JS_EXPORT_PRIVATE
+void EncodedValue::append<EncodedValue>(const typename EncodingTraits<EncodedValue>::DecodedType&);
+
+template<> JS_EXPORT_PRIVATE
+bool EncodedValue::get<EncodedValue>(const String& key, typename EncodingTraits<EncodedValue>::DecodedType&);
+
+// Load and store types with an accompanying EncodingTraits implementation.
+template<typename T>
+void EncodedValue::put(const String& key, const typename EncodingTraits<T>::DecodedType& value)
+{
+    EncodedValue encodedValue = EncodingTraits<T>::encodeValue(value);
+    put<EncodedValue>(key, encodedValue);
+}
+
+template<typename T>
+void EncodedValue::append(const typename EncodingTraits<T>::DecodedType& value)
+{
+    EncodedValue encodedValue = EncodingTraits<T>::encodeValue(value);
+    append<EncodedValue>(encodedValue);
+}
+
+template<typename T>
+bool EncodedValue::get(const String& key, typename EncodingTraits<T>::DecodedType& decodedValue)
+{
+    EncodedValue encodedValue;
+    if (!get<EncodedValue>(key, encodedValue))
+        return false;
+
+    return EncodingTraits<T>::decodeValue(encodedValue, decodedValue);
+}
+
+template<typename T>
+bool EncodedValue::get(const String& key, std::unique_ptr<typename EncodingTraits<T>::DecodedType>& decodedValue)
+{
+    EncodedValue encodedValue;
+    if (!get<EncodedValue>(key, encodedValue))
+        return false;
+
+    return EncodingTraits<T>::decodeValue(encodedValue, decodedValue);
+}
+
+} // namespace JSC
+
+using JSC::EncodedValue;
+using JSC::EncodingTraits;
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/InputCursor.h b/replay/InputCursor.h
new file mode 100644
index 0000000..02a20e5
--- /dev/null
+++ b/replay/InputCursor.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2011, 2012 University of Washington. All rights reserved.
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+
+#include "NondeterministicInput.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+class InputCursor : public RefCounted<InputCursor> {
+    WTF_MAKE_NONCOPYABLE(InputCursor);
+public:
+    InputCursor() { }
+    virtual ~InputCursor() { }
+
+    virtual bool isCapturing() const = 0;
+    virtual bool isReplaying() const = 0;
+
+    void setWithinEventLoopInputExtent(bool withinEventLoopInputExtent)
+    {
+        // We can be within two input extents when a nested run loop
+        // processes additional user inputs while the debugger is paused.
+        // However, the debugger should not pause when capturing, and we
+        // should not replay event loop inputs while in a nested run loop.
+        ASSERT(m_withinEventLoopInputExtent != withinEventLoopInputExtent || !(isCapturing() || isReplaying()));
+        m_withinEventLoopInputExtent = withinEventLoopInputExtent;
+    }
+
+    bool withinEventLoopInputExtent() const { return m_withinEventLoopInputExtent; }
+
+    template <class InputType, class... Args> inline
+    void appendInput(Args&&... args)
+    {
+        InputType* rawInput = WTF::safeCast<InputType*>(new InputType(std::forward<Args>(args)...));
+        return storeInput(std::unique_ptr<NondeterministicInputBase>(rawInput));
+    }
+
+    template <class InputType> inline
+    InputType* fetchInput()
+    {
+        return static_cast<InputType*>(loadInput(InputTraits<InputType>::queue(), InputTraits<InputType>::type()));
+    }
+
+    virtual void storeInput(std::unique_ptr<NondeterministicInputBase>) = 0;
+    virtual NondeterministicInputBase* uncheckedLoadInput(InputQueue) = 0;
+protected:
+    virtual NondeterministicInputBase* loadInput(InputQueue, const String&) = 0;
+
+private:
+    bool m_withinEventLoopInputExtent {false};
+};
+
+} // namespace JSC
+
+using JSC::InputCursor;
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/JSInputs.json b/replay/JSInputs.json
new file mode 100644
index 0000000..fa5c004
--- /dev/null
+++ b/replay/JSInputs.json
@@ -0,0 +1,49 @@
+{
+    "types": {
+        "Global": [
+            { "name": "bool", "mode": "SCALAR" },
+            { "name": "double", "mode": "SCALAR" },
+            { "name": "uint32_t", "mode": "SCALAR", "description": "Unsigned 32-bit integer." },
+            { "name": "uint64_t", "mode": "SCALAR", "description": "Unsigned 64-bit integer." },
+            { "name": "int32_t", "mode": "SCALAR", "description": "Signed 32-bit integer." },
+            { "name": "int64_t", "mode": "SCALAR", "description": "Signed 64-bit integer." }
+        ],
+
+        "WTF": [
+            {
+                "name": "String", "mode": "HEAVY_SCALAR",
+                "header": "wtf/text/WTFString.h"
+            }
+        ],
+
+        "JavaScriptCore": [
+            {
+                "name": "InputQueue", "mode": "SCALAR", "storage": "uint8_t",
+                "flags": ["ENUM_CLASS"],
+                "values": ["EventLoopInput", "LoaderMemoizedData", "ScriptMemoizedData", "Count"],
+                "header": "replay/NondeterministicInput.h"
+            }
+        ]
+    },
+
+    "inputs": {
+        "JavaScriptCore": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "currentTime", "type": "double" }
+                ]
+            },
+            {
+                "name": "SetRandomSeed",
+                "description": "Sets the PRNG seed used by Math.random().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "randomSeed", "type": "uint64_t" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/NondeterministicInput.h b/replay/NondeterministicInput.h
new file mode 100644
index 0000000..92f8b63
--- /dev/null
+++ b/replay/NondeterministicInput.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2011, 2012 University of Washington. All rights reserved.
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class EncodedValue;
+
+enum class InputQueue {
+    ScriptMemoizedData = 0,
+    LoaderMemoizedData = 1,
+    EventLoopInput = 2,
+    Count = 3
+};
+
+template<typename InputType>
+struct JS_EXPORT_PRIVATE InputTraits {
+    static InputQueue queue();
+    static String& type();
+
+    static void encode(EncodedValue& encodedInput, InputType& decodedInput);
+    static bool decode(EncodedValue& encodedInput, std::unique_ptr<InputType>& decodedInput);
+};
+
+class NondeterministicInputBase {
+    WTF_MAKE_NONCOPYABLE(NondeterministicInputBase);
+public:
+    NondeterministicInputBase() { }
+    virtual ~NondeterministicInputBase() { }
+
+    virtual const String& type() const = 0;
+    virtual InputQueue queue() const = 0;
+};
+
+template<typename InputType>
+class NondeterministicInput : public NondeterministicInputBase {
+public:
+    const String& type() const override
+    {
+        return InputTraits<InputType>::type();
+    }
+
+    InputQueue queue() const override
+    {
+        return InputTraits<InputType>::queue();
+    }
+};
+
+} // namespace JSC
+
+using JSC::InputQueue;
+using JSC::InputTraits;
+using JSC::NondeterministicInput;
+using JSC::NondeterministicInputBase;
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/CodeGeneratorReplayInputs.py b/replay/scripts/CodeGeneratorReplayInputs.py
new file mode 100755
index 0000000..0441ed5
--- /dev/null
+++ b/replay/scripts/CodeGeneratorReplayInputs.py
@@ -0,0 +1,1070 @@
+#!/usr/bin/env python
+# Copyright (c) 2014 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os.path
+import re
+import sys
+import string
+from string import Template
+import optparse
+import logging
+from CodeGeneratorReplayInputsTemplates import Templates
+
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+# Configuration values are first looked up in the framework configuration,
+# and then in the global configuration if there is no framework-specific value.
+GLOBAL_CONFIG = {
+    "baseFilename": "ReplayInputs",
+    "guardCondition": "ENABLE(WEB_REPLAY)",
+    "traitsFrameworkName": "JavaScriptCore",
+
+    # These are formatted as ([allowed_frameworks], (framework, header_path)).
+    # The generator can figure out how to format the includes.
+    "headerIncludes": [
+        (["WebCore"],
+            ("WebCore", "replay/EventLoopInput.h")
+        ),
+        (["JavaScriptCore", "WebCore"],
+            ("JavaScriptCore", "replay/EncodedValue.h")
+        ),
+        (["JavaScriptCore"],
+            ("JavaScriptCore", "replay/NondeterministicInput.h")
+        ),
+        (["JavaScriptCore", "WebCore"],
+            ("WTF", "wtf/TypeCasts.h")
+        ),
+        (["WebCore"],
+            ("WTF", "wtf/text/WTFString.h")
+        ),
+
+        # Testing fixtures.
+        (["Test"],
+            ("WebCore", "platform/ExternalNamespaceHeaderIncludeDummy.h")
+        ),
+        (["Test"],
+            ("Test", "platform/InternalNamespaceHeaderIncludeDummy.h")
+        )
+    ],
+
+    "implIncludes": [
+        (["WebCore"],
+            ("WebCore", "replay/SerializationMethods.h")
+        ),
+        (["WebCore", "JavaScriptCore"],
+            ("JavaScriptCore", "inspector/InspectorValues.h")
+        ),
+        (["WebCore", "JavaScriptCore"],
+            ("WTF", "wtf/NeverDestroyed.h")
+        ),
+
+        # Testing fixtures.
+        (["Test"],
+            ("WebCore", "platform/ExternalNamespaceImplIncludeDummy.h")
+        ),
+        (["Test"],
+            ("Test", "platform/InternalNamespaceImplIncludeDummy.h")
+        )
+    ],
+}
+
+FRAMEWORK_CONFIG_MAP = {
+    "Global": {
+        "prefix": "",
+        "namespace": ""
+    },
+
+    "WTF": {
+        "prefix": "WTF",
+        "namespace": "WTF",
+    },
+    "JavaScriptCore": {
+        "prefix": "JS",
+        "namespace": "JSC",
+        "exportMacro": "JS_EXPORT_PRIVATE",
+    },
+    "WebCore": {
+        "prefix": "Web",
+        "namespace": "WebCore",
+        "exportMacro": "WEBCORE_EXPORT"
+    },
+    # Used for bindings tests.
+    "Test": {
+        "prefix": "Test",
+        "namespace": "Test",
+        "exportMacro": "TEST_EXPORT_MACRO"
+    }
+}
+
+# These settings are specific to an input queue.
+QUEUE_CONFIG_MAP = {
+    "SCRIPT_MEMOIZED": {
+        "enumValue": "ScriptMemoizedData",
+        "baseClass": "NondeterministicInput<%s>",
+    },
+    "LOADER_MEMOIZED": {
+        "enumValue": "LoaderMemoizedData",
+        "baseClass": "NondeterministicInput<%s>",
+    },
+    "EVENT_LOOP": {
+        "enumValue": "EventLoopInput",
+        "baseClass": "EventLoopInput<%s>",
+    },
+}
+
+# Use a global logger, which normally only logs errors.
+# It can be configured to log debug messages from the CLI.
+logging.basicConfig(format='%(levelname)s: %(message)s', level=logging.ERROR)
+log = logging.getLogger('global')
+
+
+# Model classes, which transliterate JSON input.
+class ParseException(Exception):
+    pass
+
+
+class TypecheckException(Exception):
+    pass
+
+
+class Framework:
+    def __init__(self, name):
+        self._settings = FRAMEWORK_CONFIG_MAP[name]
+        self.name = name
+
+    def setting(self, key, default=''):
+        return self._settings.get(key, default)
+
+    @staticmethod
+    def fromString(frameworkString):
+        if frameworkString == "Global":
+            return Frameworks.Global
+
+        if frameworkString == "WTF":
+            return Frameworks.WTF
+
+        if frameworkString == "JavaScriptCore":
+            return Frameworks.JavaScriptCore
+
+        if frameworkString == "WebCore":
+            return Frameworks.WebCore
+
+        if frameworkString == "Test":
+            return Frameworks.Test
+
+        raise ParseException("Unknown framework: " + frameworkString)
+
+
+class Frameworks:
+    Global = Framework("Global")
+    WTF = Framework("WTF")
+    JavaScriptCore = Framework("JavaScriptCore")
+    WebCore = Framework("WebCore")
+    Test = Framework("Test")
+
+
+class InputQueue:
+    def __init__(self, settings):
+        self._settings = settings
+
+    def setting(self, key, default=''):
+        return self._settings.get(key, default)
+
+    @staticmethod
+    def fromString(queueString):
+        if queueString == "SCRIPT_MEMOIZED":
+            return InputQueues.SCRIPT_MEMOIZED
+
+        if queueString == "LOADER_MEMOIZED":
+            return InputQueues.LOADER_MEMOIZED
+
+        if queueString == "EVENT_LOOP":
+            return InputQueues.EVENT_LOOP
+
+        raise ParseException("Unknown input queue: " + queueString)
+
+
+class InputQueues:
+    SCRIPT_MEMOIZED = InputQueue(QUEUE_CONFIG_MAP["SCRIPT_MEMOIZED"])
+    LOADER_MEMOIZED = InputQueue(QUEUE_CONFIG_MAP["LOADER_MEMOIZED"])
+    EVENT_LOOP = InputQueue(QUEUE_CONFIG_MAP["EVENT_LOOP"])
+
+
+class Input:
+    def __init__(self, name, description, framework, queueString, flags, guard=None):
+        self.name = name
+        self.description = description
+        self.framework = framework
+        self.queue = InputQueue.fromString(queueString)
+        self._flags = flags
+        self.guard = guard
+        self.members = []  # names should be unique, but ordered.
+
+    def setting(self, key, default=''):
+        if key in self._flags:
+            return True
+
+        return self.queue.setting(key, default)
+
+
+class InputMember:
+    def __init__(self, memberName, typeName, flags=[]):
+        self.memberName = memberName
+        self.typeName = typeName
+        self._flags = flags
+
+    def has_flag(self, key, default=''):
+        return key in self._flags
+
+
+class TypeMode:
+    def __init__(self, name):
+        self._name = name
+
+    @staticmethod
+    def fromString(modeString):
+        modeString = modeString.upper()
+        if modeString == 'SCALAR':
+            return TypeModes.SCALAR
+        if modeString == 'HEAVY_SCALAR':
+            return TypeModes.HEAVY_SCALAR
+        if modeString == 'OWNED':
+            return TypeModes.OWNED
+        if modeString == 'SHARED':
+            return TypeModes.SHARED
+        if modeString == 'VECTOR':
+            return TypeModes.VECTOR
+
+        raise ParseException("Unknown type mode: " + modeString)
+
+
+class TypeModes:
+    # Copy for assignment and for getter
+    SCALAR = TypeMode("SCALAR")
+    # Copy for assignment, pass by reference for getter
+    HEAVY_SCALAR = TypeMode("HEAVY_SCALAR")
+    # Move for assignment, pass by reference for getter
+    OWNED = TypeMode("OWNED")
+    # Copy a RefPtr for assignment and getter
+    SHARED = TypeMode("SHARED")
+    # Move operator for assignment, pass by reference for getter
+    VECTOR = TypeMode("VECTOR")
+
+
+class Type:
+    def __init__(self, name, mode, framework, header, enclosing_class, values, guard_values_map, underlying_storage, flags, guard=None):
+        self._name = name
+        self.mode = mode
+        self.framework = framework
+        self.header = header
+        self.enclosing_class = enclosing_class
+        self.values = values
+        self.guard_values_map = guard_values_map
+        self.underlying_storage = underlying_storage
+        self._flags = flags
+        self.guard = guard
+
+    def __eq__(self, other):
+        return self.type_name() == other.type_name() and self.mode == other.mode
+
+    def __hash__(self):
+        return self._name.__hash__()
+
+    def has_flag(self, flagString):
+        return flagString in self._flags
+
+    def is_struct(self):
+        return self.has_flag("STRUCT")
+
+    def is_enum_declaration(self):
+        return self.has_flag("ENUM")
+
+    def is_enum_class_declaration(self):
+        return self.has_flag("ENUM_CLASS")
+
+    def is_option_set(self):
+        return self.has_flag("OPTION_SET")
+
+    def is_enumerable(self):
+        return self.is_enum_declaration() or self.is_enum_class_declaration() or self.is_option_set()
+
+    def declaration_kind(self):
+        if self.is_enum_declaration():
+            return "enum"
+        elif self.is_enum_class_declaration():
+            return "enum class"
+        # If the enumerable is an OptionSet<T>, then T must be forward declared as an enum class.
+        elif self.is_option_set():
+            return "enum class"
+        elif self.is_struct():
+            return "struct"
+        else:
+            return "class"
+
+    def qualified_prefix(self):
+        components = []
+        if self.framework != Frameworks.Global:
+            components.append(self.framework.setting('namespace'))
+        if self.enclosing_class is not None:
+            components.append(self.enclosing_class)
+        components.append("")
+        return "::".join(components)
+
+    def type_name(self, qualified=False):
+        if qualified:
+            return "%s%s" % (self.qualified_prefix(), self._name)
+        elif self.enclosing_class is not None:
+            return "%s::%s" % (self.enclosing_class, self._name)
+        else:
+            return self._name
+
+    def storage_type(self, qualified=False):
+        if self.mode == TypeModes.OWNED:
+            return "std::unique_ptr<%s>" % self.type_name(qualified)
+        elif self.mode == TypeModes.SHARED:
+            return "RefPtr<%s>" % self.type_name(qualified)
+        else:
+            return self.type_name(qualified)
+
+    def borrow_type(self, qualified=False):
+        if self.mode == TypeModes.SCALAR:
+            return self.type_name(qualified)
+        elif self.mode == TypeModes.SHARED:
+            return "RefPtr<%s>" % self.type_name(qualified)
+        else:
+            return "const %s&" % self.type_name(qualified)
+
+    def argument_type(self, qualified=False):
+        if self.mode == TypeModes.SHARED:
+            return "RefPtr<%s>&&" % self.type_name(qualified)
+        else:
+            return self.storage_type()
+
+    def encoding_type_argument(self, qualified=False):
+        return self.type_name(qualified=qualified)
+
+
+def check_for_required_properties(props, obj, what):
+    for prop in props:
+        if prop not in obj:
+            raise ParseException("When parsing %s, required property missing: %s" % (what, prop))
+
+
+class VectorType(Type):
+    def __init__(self, element_type):
+        self._element_type = element_type
+        self.mode = TypeModes.VECTOR
+        self.framework = element_type.framework
+        self.enclosing_class = None
+
+    def has_flag(self):
+        return False
+
+    def is_struct(self):
+        return False
+
+    def is_enum_declaration(self):
+        return False
+
+    def is_enum_class_declaration(self):
+        return False
+
+    def is_option_set(self):
+        return False
+
+    def qualified_prefix(self):
+        return ""
+
+    def type_name(self, qualified=False):
+        return "Vector<%s>" % self._element_type.storage_type(qualified=qualified)
+
+    def encoding_type_argument(self, qualified=False):
+        return "Vector<%s>" % self._element_type.type_name(qualified=qualified)
+
+    def argument_type(self, qualified=False):
+        return self.type_name(qualified=qualified) + "&"
+
+
+class InputsModel:
+    def __init__(self):
+        self.inputs = []
+        self.types = []
+
+        # Types have associated frameworks and are in their namespace, but within the specification
+        # file types are in a flat namespace. Types with the same name are not allowed.
+        self.types_by_name = {}
+        self.inputs_by_name = {}
+
+    def enumerable_types(self):
+        _enumerables = filter(lambda x: x.is_enumerable(), self.types)
+        return sorted(_enumerables, key=lambda _enumerable: _enumerable.type_name())
+
+    def get_type_for_member(self, member):
+        if member.has_flag("VECTOR"):
+            return VectorType(self.types_by_name.get(member.typeName))
+        else:
+            return self.types_by_name.get(member.typeName)
+
+    def parse_specification(self, json):
+        if 'types' in json:
+            if not isinstance(json['types'], dict):
+                raise ParseException("Malformed specification: types is not a dict of framework->type list")
+
+            for framework_name, type_list in json['types'].iteritems():
+                if not isinstance(type_list, list):
+                    raise ParseException("Malformed specification: type list for framework %s is not a list" % framework_name)
+
+                framework = Framework.fromString(framework_name)
+                for _type in type_list:
+                    self.parse_type_with_framework(_type, framework)
+
+        if 'inputs' in json:
+            if not isinstance(json['inputs'], dict):
+                raise ParseException("Malformed specification: inputs is not a dict of framework->input list")
+
+            for framework_name, input_list in json['inputs'].iteritems():
+                if not isinstance(input_list, list):
+                    raise ParseException("Malformed specification: input list for framework %s is not a list" % framework_name)
+
+                framework = Framework.fromString(framework_name)
+                for _input in input_list:
+                    self.parse_input_with_framework(_input, framework)
+
+    def parse_type_with_framework(self, json, framework):
+        check_for_required_properties(['name', 'mode'], json, 'type')
+        if framework is not Frameworks.Global:
+            check_for_required_properties(['header'], json, 'non-global type')
+
+        type_name = json['name']
+        type_mode = TypeMode.fromString(json['mode'])
+        header = json.get('header')
+        enclosing_class = json.get('enclosing_class')
+        enumerable_values = json.get('values')
+        guarded_enumerable_values = json.get('guarded_values', {})
+        type_storage = json.get('storage')
+        type_flags = json.get('flags', [])
+        guard = json.get('guard', None)
+        _type = Type(type_name, type_mode, framework, header, enclosing_class, enumerable_values, guarded_enumerable_values, type_storage, type_flags, guard)
+        if _type.is_enumerable():
+            check_for_required_properties(['values'], json, 'enum')
+            if not isinstance(json['values'], list) or len(_type.values) == 0:
+                raise ParseException("Malformed specification: enumerable type %s does not supply a list of values" % type_name)
+
+            if _type.is_enum_declaration() and enclosing_class is None and type_storage is None:
+                raise ParseException("Could not parse enumerable type %s: C-style enum declarations not enclosed by a class must specify their storage type so they can be forward declared." % type_name)
+
+        self.types.append(_type)
+
+    def parse_input_with_framework(self, json, framework):
+        check_for_required_properties(['name', 'description', 'queue', 'members'], json, 'input')
+        _input = Input(json['name'], json['description'], framework, json['queue'], json.get('flags', []), json.get('guard'))
+        if isinstance(json['members'], list):
+            for member in json['members']:
+                check_for_required_properties(['name', 'type'], member, 'member')
+                _input.members.append(InputMember(member['name'], member['type'], member.get('flags', [])))
+
+        self.inputs.append(_input)
+
+    # Types cannot (yet) reference other types, so we can check references in one pass.
+    def resolve_types(self):
+        for _type in self.types:
+            self.typecheck_type(_type)
+
+        for _input in self.inputs:
+            self.typecheck_input(_input)
+
+    def typecheck_type(self, _type):
+        log.debug("typecheck type " + _type.type_name())
+
+        if _type.type_name() in self.types_by_name:
+            raise TypecheckException("Duplicate type with name: " + _type.type_name())
+
+        self.types_by_name[_type.type_name()] = _type
+
+    def typecheck_input(self, _input):
+        log.debug("typecheck input " + _input.name)
+
+        if _input.name in self.inputs_by_name:
+            raise TypecheckException("Duplicate input with name: " + _input.name)
+
+        seen_members = {}
+
+        for member in _input.members:
+            if member.memberName in seen_members:
+                raise TypecheckException("Duplicate input member with name: " + member.memberName)
+
+            self.typecheck_input_member(member, _input)
+            seen_members[member.memberName] = member
+
+        self.inputs_by_name[_input.name] = _input
+
+    def typecheck_input_member(self, input_member, _input):
+        log.debug("typecheck member '%s' of '%s'" % (input_member.memberName, _input.name))
+
+        if not input_member.typeName in self.types_by_name:
+            raise TypecheckException("Unknown type '%s' referenced by member '%s' of input '%s'" % (input_member.typeName, input_member.memberName, _input.name))
+
+
+# A writer that only updates file if it actually changed.
+class IncrementalFileWriter:
+    def __init__(self, filepath, force_output):
+        self._filepath = filepath
+        self._output = ""
+        self.force_output = force_output
+
+    def write(self, text):
+        self._output += text
+
+    def close(self):
+        text_changed = True
+        self._output = self._output.rstrip() + "\n"
+
+        try:
+            read_file = open(self._filepath, "r")
+            old_text = read_file.read()
+            read_file.close()
+            text_changed = old_text != self._output
+        except:
+            # Ignore, just overwrite by default
+            pass
+
+        if text_changed or self.force_output:
+            out_file = open(self._filepath, "w")
+            out_file.write(self._output)
+            out_file.close()
+
+
+def wrap_with_guard(contents, condition=None):
+    if condition is None:
+        return contents
+
+    return "\n".join([
+        "#if %s" % condition,
+        contents,
+        "#endif // %s" % condition
+    ])
+
+
+class Generator:
+    def __init__(self, model, target_framework_name, input_filepath, output_prefix):
+        self._model = model
+        self.target_framework = Framework.fromString(target_framework_name)
+        self.traits_framework = Framework.fromString(self.setting('traitsFrameworkName'))
+        self._input_filepath = input_filepath
+        self._output_prefix = output_prefix
+
+    def setting(self, key, default=''):
+        return self.target_framework.setting(key, GLOBAL_CONFIG.get(key, default))
+
+    def should_generate_item(self, item):
+        return item.framework is self.target_framework
+
+    # This does not account for any filename mangling performed on behalf of the test harness.
+    def output_filename(self, extension=None):
+        components = []
+        if len(self._output_prefix) > 0:
+            components.extend([self._output_prefix, '-'])
+
+        components.extend([self.setting('prefix'), self.setting('baseFilename')])
+
+        if extension is not None:
+            components.extend(['.', extension])
+
+        return "".join(components)
+
+    def write_output_files(self, _dir, force=False):
+        header_file = IncrementalFileWriter(os.path.join(_dir, self.output_filename('h')), force)
+        implementation_file = IncrementalFileWriter(os.path.join(_dir, self.output_filename('cpp')), force)
+
+        header_file.write(self.generate_header())
+        implementation_file.write(self.generate_implementation())
+
+        header_file.close()
+        implementation_file.close()
+
+    def generate_header(self):
+        enumerable_types_to_generate = filter(self.should_generate_item, self._model.enumerable_types())
+        inputs_to_generate = filter(self.should_generate_item, self._model.inputs)
+
+        template_arguments = {
+            'licenseBlock': self.generate_license(),
+            'filename': self.output_filename(),
+            'guardCondition': self.setting('guardCondition'),
+            'traitsNamespace': self.traits_framework.setting('namespace'),
+            'inputsNamespace': self.target_framework.setting('namespace'),
+            'includes': self.generate_includes(defaults=self.setting('headerIncludes')),
+            'typeForwardDeclarations': self.generate_type_forward_declarations(),
+            'inputForwardDeclarations': "\n".join([wrap_with_guard("class %s;", _input.guard) % _input.name for _input in inputs_to_generate]),
+            'inputClassDeclarations': "\n\n".join([self.generate_class_declaration(_input) for _input in inputs_to_generate]),
+            'inputTraitDeclarations': "\n\n".join([self.generate_input_trait_declaration(_input) for _input in inputs_to_generate]),
+            'inputTypeTraitDeclarations': "\n\n".join([self.generate_input_type_trait_declaration(_input) for _input in inputs_to_generate]),
+            'enumerableTypeTraitDeclarations': "\n\n".join([wrap_with_guard(self.generate_enumerable_type_trait_declaration(_type), _type.guard) for _type in enumerable_types_to_generate]),
+            'forEachMacro': self.generate_for_each_macro(),
+        }
+
+        return Template(Templates.HeaderSkeleton).substitute(template_arguments)
+
+    def generate_implementation(self):
+        enumerable_types_to_generate = filter(self.should_generate_item, self._model.enumerable_types())
+        inputs_to_generate = filter(self.should_generate_item, self._model.inputs)
+
+        template_arguments = {
+            'licenseBlock': self.generate_license(),
+            'filename': self.output_filename(),
+            'guardCondition': self.setting('guardCondition'),
+            'traitsNamespace': self.traits_framework.setting('namespace'),
+            'inputsNamespace': self.target_framework.setting('namespace'),
+            'includes': self.generate_includes(defaults=self.setting('implIncludes'), includes_for_types=True),
+            'inputClassImplementations': "\n\n".join([self.generate_class_implementation(_input) for _input in inputs_to_generate]),
+            'inputTraitImplementations': "\n\n".join([self.generate_input_trait_implementation(_input) for _input in inputs_to_generate]),
+            'enumerableTypeTraitImplementations': "\n\n".join([wrap_with_guard(self.generate_enumerable_type_trait_implementation(_type), _type.guard) for _type in enumerable_types_to_generate]),
+        }
+
+        return Template(Templates.ImplementationSkeleton).substitute(template_arguments)
+
+    def generate_license(self):
+        return Template(Templates.CopyrightBlock).substitute(None, inputFilename=os.path.basename(self._input_filepath))
+
+    def generate_includes(self, defaults=[], includes_for_types=False):
+        lines = set()
+
+        for _type in self._model.types:
+            # Types in the "global" framework are implicitly declared and available in all namespaces.
+            if _type.framework is Frameworks.Global:
+                continue
+            # For RefCounted types, we reverse when to include the header so that the destructor can be
+            # used in the header file.
+            include_for_destructor = _type.mode is TypeModes.SHARED
+            # Enum declarations within classes cannot be forward declared, so we include
+            # headers with the relevant class declaration.
+            include_for_enclosing_class = _type.enclosing_class is not None
+            # Include headers for types like URL and String which are copied, not owned or shared.
+            include_for_copyable_member = _type.mode is TypeModes.HEAVY_SCALAR
+            if (not includes_for_types) ^ (include_for_destructor or include_for_enclosing_class or include_for_copyable_member):
+                continue
+
+            if self.target_framework != _type.framework:
+                lines.add("#include <%s>" % _type.header)
+            else:
+                lines.add("#include \"%s\"" % os.path.basename(_type.header))
+
+        for entry in defaults:
+            (allowed_framework_names, data) = entry
+            (framework_name, header_path) = data
+
+            if self.target_framework.name not in allowed_framework_names:
+                continue
+            if self.target_framework.name != framework_name:
+                lines.add("#include <%s>" % header_path)
+            else:
+                lines.add("#include \"%s\"" % os.path.basename(header_path))
+
+        return "\n".join(sorted(list(lines)))
+
+    def generate_type_forward_declarations(self):
+        lines = []
+
+        decls_by_framework = {}
+        frameworks = [Framework.fromString(s) for s in FRAMEWORK_CONFIG_MAP.keys() if s != Frameworks.Global.name]
+        for framework in frameworks:
+            decls_by_framework[framework] = []
+
+        for _type in self._model.types:
+            if _type.framework not in frameworks:
+                continue
+            if _type.enclosing_class is not None:
+                continue
+            if _type.mode == TypeModes.HEAVY_SCALAR:
+                continue
+            if _type.mode == TypeModes.SCALAR and not _type.is_enumerable():
+                continue
+            if _type.is_enum_declaration():
+                declaration = "enum %s : %s;" % (_type.type_name(), _type.underlying_storage)
+            else:
+                declaration = "%s %s;" % (_type.declaration_kind(), _type.type_name())
+            decls_by_framework[_type.framework].append(declaration)
+
+        # Declare all namespaces explicitly, even if it's the main namespace.
+        for framework in frameworks:
+            if len(decls_by_framework[framework]) == 0:
+                continue
+
+            decls_by_framework[framework].sort()
+            lines.append("namespace %s {" % framework.setting('namespace'))
+            lines.extend(decls_by_framework[framework])
+            lines.append("}")
+            lines.append("")
+
+        return "\n".join(lines)
+
+    def generate_class_declaration(self, _input):
+        extra_declarations = []
+        if _input.queue == InputQueues.EVENT_LOOP:
+            extra_declarations.extend([
+                "",
+                "    // EventLoopInput API",
+                "    virtual void dispatch(ReplayController&) final;",
+            ])
+
+            if _input.setting('CREATE_FROM_PAGE'):
+                extra_declarations.extend([
+                    "    static std::unique_ptr<%s> createFromPage(const Page&);" % _input.name
+                ])
+
+        member_getters = [self.generate_input_member_getter(_member) for _member in _input.members]
+
+        member_declarations = [self.generate_input_member_declaration(_member) for _member in _input.members]
+        if len(member_declarations) > 0:
+            member_declarations.insert(0, "private:")
+
+        template_arguments = {
+            'inputConstructor': self.generate_input_constructor_declaration(_input),
+            'inputDestructor': self.generate_input_destructor_declaration(_input),
+            'inputName': _input.name,
+            'inputQueue': _input.setting('enumValue'),
+            'baseClass': _input.setting('baseClass') % _input.name,
+            'extraDeclarations': "\n".join(extra_declarations),
+            'memberGetters': "\n".join(member_getters),
+            'memberDeclarations': "\n".join(member_declarations),
+        }
+
+        return wrap_with_guard(Template(Templates.InputClassDeclaration).substitute(template_arguments), _input.guard)
+
+    def generate_input_constructor_declaration(self, _input):
+        formals_list = self.generate_constructor_formals_list(_input)
+        terms = []
+        if self.setting('exportMacro'):
+            terms.append(self.setting('exportMacro'))
+        terms.append("%s(%s)" % (_input.name, formals_list))
+        return "    %s;" % " ".join(terms)
+
+    def generate_input_destructor_declaration(self, _input):
+        return "    virtual ~%s();" % _input.name
+
+    def generate_input_member_getter(self, _member):
+        member_type = self._model.get_type_for_member(_member)
+        return "    %s %s() const { return %s; }" % (member_type.borrow_type(), _member.memberName, self.generate_member_borrow_expression(_member))
+
+    def generate_input_member_declaration(self, _member):
+        member_type = self._model.get_type_for_member(_member)
+        return "    %s m_%s;" % (member_type.storage_type(), _member.memberName)
+
+    def generate_input_member_tuples(self, _input):
+        return [(_member, self._model.get_type_for_member(_member)) for _member in _input.members]
+
+    def qualified_input_name(self, _input, forceQualified=False):
+        if forceQualified or self.target_framework != self.traits_framework:
+            return "%s::%s" % (self.target_framework.setting('namespace'), _input.name)
+        else:
+            return _input.name
+
+    def generate_input_trait_declaration(self, _input):
+        decl_type = ['struct']
+        if len(self.setting('exportMacro')) > 0:
+            decl_type.append(self.setting('exportMacro'))
+
+        template_arguments = {
+            'structOrClass': " ".join(decl_type),
+            'queueType': _input.queue.setting('enumValue'),
+            'qualifiedInputName': self.qualified_input_name(_input),
+        }
+
+        return wrap_with_guard(Template(Templates.InputTraitsDeclaration).substitute(template_arguments), _input.guard)
+
+    def generate_input_type_trait_declaration(self, _input):
+        template_arguments = {
+            'qualifiedInputName': self.qualified_input_name(_input, forceQualified=True),
+        }
+
+        return wrap_with_guard(Template(Templates.InputTypeTraitsDeclaration).substitute(template_arguments), _input.guard)
+
+    def generate_enumerable_type_trait_declaration(self, _type):
+        decl_type = ['struct']
+        if len(self.setting('exportMacro')) > 0:
+            decl_type.append(self.setting('exportMacro'))
+
+        should_qualify_type = _type.framework != self.traits_framework
+        decoded_type = _type.type_name(qualified=should_qualify_type)
+        if _type.is_option_set():
+            decoded_type = "OptionSet<%s>" % decoded_type
+
+        template_arguments = {
+            'encodingTypeArgument': _type.encoding_type_argument(qualified=should_qualify_type),
+            'enumerableType': decoded_type,
+            'structOrClass': " ".join(decl_type)
+        }
+        return Template(Templates.EnumerableTypeTraitDeclaration).substitute(template_arguments)
+
+    def generate_for_each_macro(self):
+        inputs_to_generate = filter(self.should_generate_item, self._model.inputs)
+
+        macro_name = "%s_REPLAY_INPUT_NAMES_FOR_EACH" % self.setting('prefix').upper()
+        lines = []
+        lines.append("#define %s(macro) \\" % macro_name)
+        lines.extend(["    macro(%s) \\" % _input.name for _input in inputs_to_generate])
+        lines.append("    \\")
+        lines.append("// end of %s" % macro_name)
+        return "\n".join(lines)
+
+    def generate_class_implementation(self, _input):
+        template_arguments = {
+            'inputName': _input.name,
+            'inputsNamespace': self.target_framework.setting('namespace'),
+            'initializerList': self.generate_constructor_initializer_list(_input),
+            'constructorFormalsList': self.generate_constructor_formals_list(_input),
+        }
+
+        return wrap_with_guard(Template(Templates.InputClassImplementation).substitute(template_arguments), _input.guard)
+
+    def generate_enumerable_type_trait_implementation(self, _type):
+        should_qualify_type = _type.framework != self.traits_framework
+        prefix_components = []
+        if should_qualify_type:
+            prefix_components.append(_type.framework.setting('namespace'))
+        if _type.is_enum_declaration() and _type.enclosing_class is not None:
+            prefix_components.append(_type.enclosing_class)
+        elif _type.is_enum_class_declaration() or _type.is_option_set():
+            prefix_components.append(_type.type_name(qualified=False))
+        prefix_components.append("")
+        enumerable_type_prefix = "::".join(prefix_components)
+        encodeLines = []
+
+        if _type.is_enum_declaration():
+            encode_template = Templates.EnumTypeEncodeCase
+            decode_template = Templates.EnumTypeDecodeCase
+            enumerable_type_trait_template = Templates.EnumTypeTraitImplementation
+        elif _type.is_enum_class_declaration():
+            encode_template = Templates.EnumClassTypeEncodeCase
+            decode_template = Templates.EnumClassTypeDecodeCase
+            enumerable_type_trait_template = Templates.EnumClassTypeTraitImplementation
+        else:  # Thus, _type.is_option_set().
+            encode_template = Templates.OptionSetTypeEncodeCase
+            decode_template = Templates.OptionSetTypeDecodeCase
+            enumerable_type_trait_template = Templates.OptionSetTypeTraitImplementation
+
+        # Generate body for encode.
+        for _value in _type.values:
+            template_arguments = {
+                'enumStringValue': _value,
+                'qualifiedEnumValue': "%s%s" % (enumerable_type_prefix, _value),
+            }
+            encodeLines.append(Template(encode_template).substitute(template_arguments))
+
+        for guard, guard_values in _type.guard_values_map.iteritems():
+            guardedLines = []
+            for guard_value in guard_values:
+                template_arguments = {
+                    'enumStringValue': guard_value,
+                    'qualifiedEnumValue': "%s%s" % (enumerable_type_prefix, guard_value),
+                }
+                guardedLines.append(Template(encode_template).substitute(template_arguments))
+            encodeLines.append(wrap_with_guard("\n".join(guardedLines), guard))
+
+        # Generate body for decode.
+        decodeLines = []
+        for i, _value in enumerate(_type.values):
+
+            template_arguments = {
+                'branchKeyword': "else if" if i > 0 else "if",
+                'enumStringValue': _value,
+                'qualifiedEnumValue': "%s%s" % (enumerable_type_prefix, _value),
+                'qualifiedEnumName': _type.type_name(qualified=should_qualify_type)
+            }
+            decodeLines.append(Template(decode_template).substitute(template_arguments))
+
+        for guard, guard_values in _type.guard_values_map.iteritems():
+            guardedLines = []
+            for i, guard_value in enumerate(guard_values):
+                template_arguments = {
+                    'branchKeyword': "else if" if i > 0 else "if",
+                    'enumStringValue': guard_value,
+                    'qualifiedEnumValue': "%s%s" % (enumerable_type_prefix, guard_value),
+                    'qualifiedEnumName': _type.type_name(qualified=should_qualify_type)
+                }
+                guardedLines.append(Template(decode_template).substitute(template_arguments))
+            decodeLines.append(wrap_with_guard("\n".join(guardedLines), guard))
+
+        enumerable_type = _type.type_name(qualified=should_qualify_type)
+        if _type.is_option_set():
+            enumerable_type = "OptionSet<%s>" % enumerable_type
+
+        template_arguments = {
+            'encodingTypeArgument': _type.encoding_type_argument(qualified=should_qualify_type),
+            'enumerableType': enumerable_type,
+            'encodeCases': "\n".join(encodeLines),
+            'decodeCases': "\n".join(decodeLines)
+        }
+
+        return Template(enumerable_type_trait_template).substitute(template_arguments)
+
+    def generate_input_trait_implementation(self, _input):
+        template_arguments = {
+            'inputsNamespace': self.target_framework.setting('namespace'),
+            'inputNameStringLiteral': '"%s"' % _input.name,
+            'qualifiedInputName': self.qualified_input_name(_input),
+            'constructorArguments': self.generate_constructor_arguments_list(_input),
+            'constructorFormalsList': self.generate_constructor_formals_list(_input),
+            'encodeSteps': self.generate_input_encode_implementation(_input),
+            'decodeSteps': self.generate_input_decode_implementation(_input),
+        }
+        return wrap_with_guard(Template(Templates.InputTraitsImplementation).substitute(template_arguments), _input.guard)
+
+    def generate_input_encode_implementation(self, _input):
+        steps = []
+        for (_member, _type) in self.generate_input_member_tuples(_input):
+            should_qualify_type = _type.framework != self.traits_framework
+            put_method = "put<%s>" % _type.encoding_type_argument(qualified=should_qualify_type)
+
+            steps.extend([
+                "    encodedValue.%s(ASCIILiteral(\"%s\"), input.%s());" % (put_method, _member.memberName, _member.memberName)
+            ])
+
+        if len(steps) == 0:
+            steps.extend([
+                "    UNUSED_PARAM(encodedValue);",
+                "    UNUSED_PARAM(input);",
+            ])
+
+        return "\n".join(steps)
+
+    def generate_input_decode_implementation(self, _input):
+        steps = []
+        for (_member, _type) in self.generate_input_member_tuples(_input):
+            should_qualify_type = _type.framework != self.traits_framework
+            get_method = "get<%s>" % _type.encoding_type_argument(qualified=should_qualify_type)
+
+            lines = [
+                "    %s %s;" % (_type.storage_type(qualified=should_qualify_type), _member.memberName),
+                "    if (!encodedValue.%s(ASCIILiteral(\"%s\"), %s))" % (get_method, _member.memberName, _member.memberName),
+                "        return false;",
+                ""
+            ]
+
+            steps.append("\n".join(lines))
+
+        if len(steps) == 0:
+            steps.extend([
+                "    UNUSED_PARAM(encodedValue);",
+            ])
+
+        return "\n".join(steps)
+
+    def generate_constructor_initializer_list(self, _input):
+        initializers = []
+        initializers.append("    : %s()" % (_input.setting('baseClass') % _input.name))
+        for _member in _input.members:
+            initializers.append("    , m_%s(%s)" % (_member.memberName, self.generate_member_move_expression(_member)))
+
+        return "\n".join(initializers)
+
+    def generate_constructor_formals_list(self, _input):
+        member_tuples = self.generate_input_member_tuples(_input)
+        return ", ".join(["%s %s" % (_type.argument_type(), _member.memberName) for (_member, _type) in member_tuples])
+
+    def generate_member_borrow_expression(self, _member):
+        _type = self._model.get_type_for_member(_member)
+        expression = "m_%s" % _member.memberName
+        if _type.mode == TypeModes.OWNED:
+            expression = "*" + expression
+
+        return expression
+
+    def generate_member_move_expression(self, _member):
+        _type = self._model.get_type_for_member(_member)
+        if _type.mode in [TypeModes.OWNED, TypeModes.SHARED]:
+            return "WTFMove(%s)" % _member.memberName
+        else:
+            return _member.memberName
+
+    def generate_constructor_arguments_list(self, _input):
+        return ", ".join([self.generate_member_move_expression(_member) for _member in _input.members])
+
+
+def generate_from_specifications(input_filepaths=[], output_prefix="", output_dirpath=None, framework_name=None, force_output=False):
+
+    if not framework_name in FRAMEWORK_CONFIG_MAP:
+        raise ParseException("Unknown or unsupported framework name supplied: " + framework_name)
+
+    if len(input_filepaths) == 0:
+        raise ParseException("Must provide at least one specification file, none were provided.")
+
+    def parse_json_from_file(input_filepath):
+        try:
+            with open(input_filepath, "r") as input_file:
+                return json.load(input_file)
+        except ValueError as e:
+            raise Exception("Error parsing valid JSON in file: " + input_filepath)
+
+    specifications = map(parse_json_from_file, input_filepaths)
+
+    model = InputsModel()
+    for spec in specifications:
+        model.parse_specification(spec)
+
+    model.resolve_types()
+    generator = Generator(model, framework_name, input_filepaths[0], output_prefix)
+
+    generator.write_output_files(output_dirpath, force_output)
+
+
+if __name__ == '__main__':
+    allowed_framework_names = FRAMEWORK_CONFIG_MAP.keys()
+
+    cli_parser = optparse.OptionParser(usage="usage: %prog [options] <Inputs.json> [, <MoreInputs.json> ]")
+    cli_parser.add_option("-o", "--outputDir", help="Directory where generated files should be written.")
+    cli_parser.add_option("--framework", type="choice", choices=allowed_framework_names, help="The framework these inputs belong to.")  # JavaScriptCore, WebCore
+    cli_parser.add_option("--force", action="store_true", help="Force output of generated scripts, even if nothing changed.")
+    cli_parser.add_option("-v", "--debug", action="store_true", help="Log extra output for debugging the generator itself.")
+    cli_parser.add_option("-t", "--test", action="store_true", help="Enable test mode. Use unique output filenames created by prepending the input filename.")
+
+    options = None
+
+    arg_options, arg_values = cli_parser.parse_args()
+
+    if not arg_options.outputDir:
+        raise ParseException("Missing output directory")
+
+    if arg_options.debug:
+        log.setLevel(logging.DEBUG)
+
+    options = {
+        'input_filepaths': arg_values,
+        'output_dirpath': arg_options.outputDir,
+        'output_prefix': os.path.basename(arg_values[0]) if arg_options.test else "",
+        'framework_name': arg_options.framework,
+        'force_output': arg_options.force
+    }
+
+    try:
+        generate_from_specifications(**options)
+    except (ParseException, TypecheckException) as e:
+        if arg_options.test:
+            log.error(e.message)
+        else:
+            raise e  # Force the build to fail.
diff --git a/replay/scripts/CodeGeneratorReplayInputsTemplates.py b/replay/scripts/CodeGeneratorReplayInputsTemplates.py
new file mode 100755
index 0000000..953e67f
--- /dev/null
+++ b/replay/scripts/CodeGeneratorReplayInputsTemplates.py
@@ -0,0 +1,265 @@
+#!/usr/bin/env python
+# Copyright (c) 2011 Google Inc. All rights reserved.
+# Copyright (c) 2012 Intel Corporation. All rights reserved.
+# Copyright (c) 2013, 2014, 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# Generator templates, which can be filled with string.Template.
+# Following are classes that fill the templates from the typechecked model.
+
+class Templates:
+    CopyrightBlock = (
+    """/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from ${inputFilename}
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py""")
+
+    HeaderSkeleton = (
+    """${licenseBlock}
+
+#pragma once
+
+#if ${guardCondition}
+${includes}
+
+${typeForwardDeclarations}
+
+namespace ${inputsNamespace} {
+${inputForwardDeclarations}
+} // namespace ${inputsNamespace}
+
+namespace ${traitsNamespace} {
+${inputTraitDeclarations}
+${enumerableTypeTraitDeclarations}
+} // namespace ${traitsNamespace}
+
+namespace ${inputsNamespace} {
+${inputClassDeclarations}
+} // namespace ${inputsNamespace}
+
+${inputTypeTraitDeclarations}
+
+${forEachMacro}
+
+#endif // ${guardCondition}
+""")
+
+    InputTraitsDeclaration = (
+    """template<> ${structOrClass} InputTraits<${qualifiedInputName}> {
+    static InputQueue queue() { return InputQueue::${queueType}; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const ${qualifiedInputName}&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<${qualifiedInputName}>&);
+};""")
+
+    InputTypeTraitsDeclaration = (
+    """SPECIALIZE_TYPE_TRAITS_BEGIN(${qualifiedInputName})
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<${qualifiedInputName}>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()""")
+
+    EnumerableTypeTraitDeclaration = (
+    """template<> ${structOrClass} EncodingTraits<${encodingTypeArgument}> {
+    typedef ${enumerableType} DecodedType;
+
+    static EncodedValue encodeValue(const ${enumerableType}& value);
+    static bool decodeValue(EncodedValue&, ${enumerableType}& value);
+};""")
+
+    InputClassDeclaration = (
+    """class ${inputName} : public ${baseClass} {
+public:
+${inputConstructor}
+${inputDestructor}
+${extraDeclarations}
+${memberGetters}
+${memberDeclarations}
+};""")
+
+    ImplementationSkeleton = (
+    """${licenseBlock}
+
+#include "config.h"
+#include "${filename}.h"
+
+#if ${guardCondition}
+${includes}
+
+namespace ${inputsNamespace} {
+${inputClassImplementations}
+} // namespace ${inputsNamespace}
+
+namespace ${traitsNamespace} {
+${inputTraitImplementations}
+${enumerableTypeTraitImplementations}
+} // namespace ${traitsNamespace}
+
+#endif // ${guardCondition}
+""")
+
+    InputTraitsImplementation = (
+    """const String& InputTraits<${qualifiedInputName}>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral(${inputNameStringLiteral}));
+    return type;
+}
+
+void InputTraits<${qualifiedInputName}>::encode(EncodedValue& encodedValue, const ${qualifiedInputName}& input)
+{
+${encodeSteps}
+}
+
+bool InputTraits<${qualifiedInputName}>::decode(EncodedValue& encodedValue, std::unique_ptr<${qualifiedInputName}>& input)
+{
+${decodeSteps}
+    input = std::make_unique<${qualifiedInputName}>(${constructorArguments});
+    return true;
+}""")
+
+    EnumClassTypeTraitImplementation = (
+    """EncodedValue EncodingTraits<${encodingTypeArgument}>::encodeValue(const ${enumerableType}& enumValue)
+{
+    switch (enumValue) {
+${encodeCases}
+    default: ASSERT_NOT_REACHED(); return EncodedValue::createString("Error!");
+    }
+}
+
+bool EncodingTraits<${encodingTypeArgument}>::decodeValue(EncodedValue& encodedValue, ${enumerableType}& enumValue)
+{
+    String enumString = encodedValue.convertTo<String>();
+${decodeCases}
+    return false;
+}""")
+
+    EnumClassTypeEncodeCase = (
+    """    case ${qualifiedEnumValue}: return EncodedValue::createString("${enumStringValue}");""")
+
+    EnumClassTypeDecodeCase = (
+    """    if (enumString == "${enumStringValue}") {
+        enumValue = ${qualifiedEnumValue};
+        return true;
+    }""")
+
+    EnumTypeTraitImplementation = (
+    """EncodedValue EncodingTraits<${encodingTypeArgument}>::encodeValue(const ${enumerableType}& enumValue)
+{
+    EncodedValue encodedValue = EncodedValue::createArray();
+${encodeCases}
+    return encodedValue;
+}
+
+bool EncodingTraits<${encodingTypeArgument}>::decodeValue(EncodedValue& encodedValue, ${enumerableType}& enumValue)
+{
+    Vector<String> enumStrings;
+    if (!EncodingTraits<Vector<String>>::decodeValue(encodedValue, enumStrings))
+        return false;
+
+    for (const String& enumString : enumStrings) {
+${decodeCases}
+    }
+
+    return true;
+}""")
+
+    EnumTypeEncodeCase = (
+    """    if (enumValue & ${qualifiedEnumValue}) {
+        encodedValue.append<String>(ASCIILiteral("${enumStringValue}"));
+        if (enumValue == ${qualifiedEnumValue})
+            return encodedValue;
+    }""")
+
+    EnumTypeDecodeCase = (
+    """        ${branchKeyword} (enumString == "${enumStringValue}")
+            enumValue = static_cast<${qualifiedEnumName}>(enumValue | ${qualifiedEnumValue});""")
+
+    OptionSetTypeTraitImplementation = (
+    """EncodedValue EncodingTraits<${encodingTypeArgument}>::encodeValue(const ${enumerableType}& enumValue)
+{
+    EncodedValue encodedValue = EncodedValue::createArray();
+${encodeCases}
+
+    return encodedValue;
+}
+
+bool EncodingTraits<${encodingTypeArgument}>::decodeValue(EncodedValue& encodedValue, ${enumerableType}& enumValue)
+{
+    Vector<String> enumStrings;
+    if (!EncodingTraits<Vector<String>>::decodeValue(encodedValue, enumStrings))
+        return false;
+
+    for (const String& enumString : enumStrings) {
+${decodeCases}
+    }
+
+    return true;
+}""")
+
+    OptionSetTypeEncodeCase = (
+    """    if (enumValue.contains(${qualifiedEnumValue}))
+        encodedValue.append<String>(ASCIILiteral("${enumStringValue}"));""")
+
+    OptionSetTypeDecodeCase = (
+    """        ${branchKeyword} (enumString == "${enumStringValue}")
+            enumValue |= ${qualifiedEnumValue};""")
+
+
+    InputClassImplementation = (
+    """${inputName}::${inputName}(${constructorFormalsList})
+${initializerList}
+{
+}
+
+${inputName}::~${inputName}()
+{
+}""")
diff --git a/replay/scripts/tests/expected/fail-on-c-style-enum-no-storage.json-error b/replay/scripts/tests/expected/fail-on-c-style-enum-no-storage.json-error
new file mode 100644
index 0000000..9ef00c4
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-c-style-enum-no-storage.json-error
@@ -0,0 +1 @@
+ERROR: Could not parse enumerable type MouseButton: C-style enum declarations not enclosed by a class must specify their storage type so they can be forward declared.
diff --git a/replay/scripts/tests/expected/fail-on-duplicate-enum-type.json-error b/replay/scripts/tests/expected/fail-on-duplicate-enum-type.json-error
new file mode 100644
index 0000000..ef750bf
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-duplicate-enum-type.json-error
@@ -0,0 +1 @@
+ERROR: Duplicate type with name: PlatformEvent::Type
diff --git a/replay/scripts/tests/expected/fail-on-duplicate-input-names.json-error b/replay/scripts/tests/expected/fail-on-duplicate-input-names.json-error
new file mode 100644
index 0000000..d31ec80
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-duplicate-input-names.json-error
@@ -0,0 +1 @@
+ERROR: Duplicate input with name: GetCurrentTime
diff --git a/replay/scripts/tests/expected/fail-on-duplicate-type-names.json-error b/replay/scripts/tests/expected/fail-on-duplicate-type-names.json-error
new file mode 100644
index 0000000..d1e4c47
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-duplicate-type-names.json-error
@@ -0,0 +1 @@
+ERROR: Duplicate type with name: uint64_t
diff --git a/replay/scripts/tests/expected/fail-on-enum-type-missing-values.json-error b/replay/scripts/tests/expected/fail-on-enum-type-missing-values.json-error
new file mode 100644
index 0000000..b4a348c
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-enum-type-missing-values.json-error
@@ -0,0 +1 @@
+ERROR: When parsing enum, required property missing: values
diff --git a/replay/scripts/tests/expected/fail-on-missing-input-member-name.json-error b/replay/scripts/tests/expected/fail-on-missing-input-member-name.json-error
new file mode 100644
index 0000000..0bb2869
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-missing-input-member-name.json-error
@@ -0,0 +1 @@
+ERROR: When parsing member, required property missing: name
diff --git a/replay/scripts/tests/expected/fail-on-missing-input-name.json-error b/replay/scripts/tests/expected/fail-on-missing-input-name.json-error
new file mode 100644
index 0000000..b599607
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-missing-input-name.json-error
@@ -0,0 +1 @@
+ERROR: When parsing input, required property missing: name
diff --git a/replay/scripts/tests/expected/fail-on-missing-input-queue.json-error b/replay/scripts/tests/expected/fail-on-missing-input-queue.json-error
new file mode 100644
index 0000000..c7919ab
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-missing-input-queue.json-error
@@ -0,0 +1 @@
+ERROR: When parsing input, required property missing: queue
diff --git a/replay/scripts/tests/expected/fail-on-missing-type-mode.json-error b/replay/scripts/tests/expected/fail-on-missing-type-mode.json-error
new file mode 100644
index 0000000..6929f4f
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-missing-type-mode.json-error
@@ -0,0 +1 @@
+ERROR: When parsing type, required property missing: mode
diff --git a/replay/scripts/tests/expected/fail-on-missing-type-name.json-error b/replay/scripts/tests/expected/fail-on-missing-type-name.json-error
new file mode 100644
index 0000000..0aad900
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-missing-type-name.json-error
@@ -0,0 +1 @@
+ERROR: When parsing type, required property missing: name
diff --git a/replay/scripts/tests/expected/fail-on-unknown-input-queue.json-error b/replay/scripts/tests/expected/fail-on-unknown-input-queue.json-error
new file mode 100644
index 0000000..acf469b
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-unknown-input-queue.json-error
@@ -0,0 +1 @@
+ERROR: Unknown input queue: SCRIPT_MEOIZED
diff --git a/replay/scripts/tests/expected/fail-on-unknown-member-type.json-error b/replay/scripts/tests/expected/fail-on-unknown-member-type.json-error
new file mode 100644
index 0000000..d31e454
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-unknown-member-type.json-error
@@ -0,0 +1 @@
+ERROR: Unknown type 'double' referenced by member 'randomSeed' of input 'SetRandomSeed'
diff --git a/replay/scripts/tests/expected/fail-on-unknown-type-mode.json-error b/replay/scripts/tests/expected/fail-on-unknown-type-mode.json-error
new file mode 100644
index 0000000..952c69e
--- /dev/null
+++ b/replay/scripts/tests/expected/fail-on-unknown-type-mode.json-error
@@ -0,0 +1 @@
+ERROR: Unknown type mode: BONKERS
diff --git a/replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.cpp b/replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.cpp
new file mode 100644
index 0000000..d5b1585
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-enum-encoding-helpers-with-guarded-values.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#include "config.h"
+#include "generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h"
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceImplIncludeDummy.h"
+#include <platform/ExternalNamespaceImplIncludeDummy.h>
+#include <platform/PlatformMouseEvent.h>
+
+namespace Test {
+SavedMouseButton::SavedMouseButton(MouseButton button)
+    : NondeterministicInput<SavedMouseButton>()
+    , m_button(button)
+{
+}
+
+SavedMouseButton::~SavedMouseButton()
+{
+}
+} // namespace Test
+
+namespace JSC {
+const String& InputTraits<Test::SavedMouseButton>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("SavedMouseButton"));
+    return type;
+}
+
+void InputTraits<Test::SavedMouseButton>::encode(EncodedValue& encodedValue, const Test::SavedMouseButton& input)
+{
+    encodedValue.put<WebCore::MouseButton>(ASCIILiteral("button"), input.button());
+}
+
+bool InputTraits<Test::SavedMouseButton>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::SavedMouseButton>& input)
+{
+    WebCore::MouseButton button;
+    if (!encodedValue.get<WebCore::MouseButton>(ASCIILiteral("button"), button))
+        return false;
+
+    input = std::make_unique<Test::SavedMouseButton>(button);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h b/replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h
new file mode 100644
index 0000000..913fffb
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-enum-encoding-helpers-with-guarded-values.json-TestReplayInputs.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-enum-encoding-helpers-with-guarded-values.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceHeaderIncludeDummy.h"
+#include <platform/ExternalNamespaceHeaderIncludeDummy.h>
+
+namespace WebCore {
+enum MouseButton : unsigned;
+}
+
+
+namespace Test {
+class SavedMouseButton;
+} // namespace Test
+
+namespace JSC {
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::SavedMouseButton> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::SavedMouseButton&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::SavedMouseButton>&);
+};
+
+} // namespace JSC
+
+namespace Test {
+class SavedMouseButton : public NondeterministicInput<SavedMouseButton> {
+public:
+    TEST_EXPORT_MACRO SavedMouseButton(MouseButton button);
+    virtual ~SavedMouseButton();
+
+    MouseButton button() const { return m_button; }
+private:
+    MouseButton m_button;
+};
+} // namespace Test
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::SavedMouseButton)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::SavedMouseButton>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#define TEST_REPLAY_INPUT_NAMES_FOR_EACH(macro) \
+    macro(SavedMouseButton) \
+    \
+// end of TEST_REPLAY_INPUT_NAMES_FOR_EACH
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp b/replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp
new file mode 100644
index 0000000..4ed407c
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.cpp
@@ -0,0 +1,228 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-enum-encoding-helpers.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#include "config.h"
+#include "generate-enum-encoding-helpers.json-TestReplayInputs.h"
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceImplIncludeDummy.h"
+#include "NondeterministicInput.h"
+#include "PlatformMouseEvent.h"
+#include <platform/ExternalNamespaceImplIncludeDummy.h>
+
+namespace Test {
+SavedMouseButton::SavedMouseButton(MouseButton button)
+    : NondeterministicInput<SavedMouseButton>()
+    , m_button(button)
+{
+}
+
+SavedMouseButton::~SavedMouseButton()
+{
+}
+} // namespace Test
+
+namespace JSC {
+const String& InputTraits<Test::SavedMouseButton>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("SavedMouseButton"));
+    return type;
+}
+
+void InputTraits<Test::SavedMouseButton>::encode(EncodedValue& encodedValue, const Test::SavedMouseButton& input)
+{
+    encodedValue.put<Test::MouseButton>(ASCIILiteral("button"), input.button());
+}
+
+bool InputTraits<Test::SavedMouseButton>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::SavedMouseButton>& input)
+{
+    Test::MouseButton button;
+    if (!encodedValue.get<Test::MouseButton>(ASCIILiteral("button"), button))
+        return false;
+
+    input = std::make_unique<Test::SavedMouseButton>(button);
+    return true;
+}
+EncodedValue EncodingTraits<Test::InputQueue>::encodeValue(const Test::InputQueue& enumValue)
+{
+    switch (enumValue) {
+    case Test::InputQueue::EventLoopInput: return EncodedValue::createString("EventLoopInput");
+    case Test::InputQueue::LoaderMemoizedData: return EncodedValue::createString("LoaderMemoizedData");
+    case Test::InputQueue::ScriptMemoizedData: return EncodedValue::createString("ScriptMemoizedData");
+    default: ASSERT_NOT_REACHED(); return EncodedValue::createString("Error!");
+    }
+}
+
+bool EncodingTraits<Test::InputQueue>::decodeValue(EncodedValue& encodedValue, Test::InputQueue& enumValue)
+{
+    String enumString = encodedValue.convertTo<String>();
+    if (enumString == "EventLoopInput") {
+        enumValue = Test::InputQueue::EventLoopInput;
+        return true;
+    }
+    if (enumString == "LoaderMemoizedData") {
+        enumValue = Test::InputQueue::LoaderMemoizedData;
+        return true;
+    }
+    if (enumString == "ScriptMemoizedData") {
+        enumValue = Test::InputQueue::ScriptMemoizedData;
+        return true;
+    }
+    return false;
+}
+
+EncodedValue EncodingTraits<Test::MouseButton>::encodeValue(const Test::MouseButton& enumValue)
+{
+    EncodedValue encodedValue = EncodedValue::createArray();
+    if (enumValue & Test::NoButton) {
+        encodedValue.append<String>(ASCIILiteral("NoButton"));
+        if (enumValue == Test::NoButton)
+            return encodedValue;
+    }
+    if (enumValue & Test::LeftButton) {
+        encodedValue.append<String>(ASCIILiteral("LeftButton"));
+        if (enumValue == Test::LeftButton)
+            return encodedValue;
+    }
+    if (enumValue & Test::MiddleButton) {
+        encodedValue.append<String>(ASCIILiteral("MiddleButton"));
+        if (enumValue == Test::MiddleButton)
+            return encodedValue;
+    }
+    if (enumValue & Test::RightButton) {
+        encodedValue.append<String>(ASCIILiteral("RightButton"));
+        if (enumValue == Test::RightButton)
+            return encodedValue;
+    }
+    return encodedValue;
+}
+
+bool EncodingTraits<Test::MouseButton>::decodeValue(EncodedValue& encodedValue, Test::MouseButton& enumValue)
+{
+    Vector<String> enumStrings;
+    if (!EncodingTraits<Vector<String>>::decodeValue(encodedValue, enumStrings))
+        return false;
+
+    for (const String& enumString : enumStrings) {
+        if (enumString == "NoButton")
+            enumValue = static_cast<Test::MouseButton>(enumValue | Test::NoButton);
+        else if (enumString == "LeftButton")
+            enumValue = static_cast<Test::MouseButton>(enumValue | Test::LeftButton);
+        else if (enumString == "MiddleButton")
+            enumValue = static_cast<Test::MouseButton>(enumValue | Test::MiddleButton);
+        else if (enumString == "RightButton")
+            enumValue = static_cast<Test::MouseButton>(enumValue | Test::RightButton);
+    }
+
+    return true;
+}
+
+EncodedValue EncodingTraits<Test::PlatformEvent::OtherType>::encodeValue(const OptionSet<Test::PlatformEvent::OtherType>& enumValue)
+{
+    EncodedValue encodedValue = EncodedValue::createArray();
+    if (enumValue.contains(Test::PlatformEvent::OtherType::Mouse))
+        encodedValue.append<String>(ASCIILiteral("Mouse"));
+    if (enumValue.contains(Test::PlatformEvent::OtherType::Key))
+        encodedValue.append<String>(ASCIILiteral("Key"));
+    if (enumValue.contains(Test::PlatformEvent::OtherType::Touch))
+        encodedValue.append<String>(ASCIILiteral("Touch"));
+    if (enumValue.contains(Test::PlatformEvent::OtherType::Wheel))
+        encodedValue.append<String>(ASCIILiteral("Wheel"));
+
+    return encodedValue;
+}
+
+bool EncodingTraits<Test::PlatformEvent::OtherType>::decodeValue(EncodedValue& encodedValue, OptionSet<Test::PlatformEvent::OtherType>& enumValue)
+{
+    Vector<String> enumStrings;
+    if (!EncodingTraits<Vector<String>>::decodeValue(encodedValue, enumStrings))
+        return false;
+
+    for (const String& enumString : enumStrings) {
+        if (enumString == "Mouse")
+            enumValue |= Test::PlatformEvent::OtherType::Mouse;
+        else if (enumString == "Key")
+            enumValue |= Test::PlatformEvent::OtherType::Key;
+        else if (enumString == "Touch")
+            enumValue |= Test::PlatformEvent::OtherType::Touch;
+        else if (enumString == "Wheel")
+            enumValue |= Test::PlatformEvent::OtherType::Wheel;
+    }
+
+    return true;
+}
+
+EncodedValue EncodingTraits<Test::PlatformEvent::Type>::encodeValue(const Test::PlatformEvent::Type& enumValue)
+{
+    EncodedValue encodedValue = EncodedValue::createArray();
+    if (enumValue & Test::PlatformEvent::Mouse) {
+        encodedValue.append<String>(ASCIILiteral("Mouse"));
+        if (enumValue == Test::PlatformEvent::Mouse)
+            return encodedValue;
+    }
+    if (enumValue & Test::PlatformEvent::Key) {
+        encodedValue.append<String>(ASCIILiteral("Key"));
+        if (enumValue == Test::PlatformEvent::Key)
+            return encodedValue;
+    }
+    if (enumValue & Test::PlatformEvent::Touch) {
+        encodedValue.append<String>(ASCIILiteral("Touch"));
+        if (enumValue == Test::PlatformEvent::Touch)
+            return encodedValue;
+    }
+    if (enumValue & Test::PlatformEvent::Wheel) {
+        encodedValue.append<String>(ASCIILiteral("Wheel"));
+        if (enumValue == Test::PlatformEvent::Wheel)
+            return encodedValue;
+    }
+    return encodedValue;
+}
+
+bool EncodingTraits<Test::PlatformEvent::Type>::decodeValue(EncodedValue& encodedValue, Test::PlatformEvent::Type& enumValue)
+{
+    Vector<String> enumStrings;
+    if (!EncodingTraits<Vector<String>>::decodeValue(encodedValue, enumStrings))
+        return false;
+
+    for (const String& enumString : enumStrings) {
+        if (enumString == "Mouse")
+            enumValue = static_cast<Test::PlatformEvent::Type>(enumValue | Test::PlatformEvent::Mouse);
+        else if (enumString == "Key")
+            enumValue = static_cast<Test::PlatformEvent::Type>(enumValue | Test::PlatformEvent::Key);
+        else if (enumString == "Touch")
+            enumValue = static_cast<Test::PlatformEvent::Type>(enumValue | Test::PlatformEvent::Touch);
+        else if (enumString == "Wheel")
+            enumValue = static_cast<Test::PlatformEvent::Type>(enumValue | Test::PlatformEvent::Wheel);
+    }
+
+    return true;
+}
+} // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h b/replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h
new file mode 100644
index 0000000..37bd92f
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-enum-encoding-helpers.json-TestReplayInputs.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-enum-encoding-helpers.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceHeaderIncludeDummy.h"
+#include "PlatformEvent.h"
+#include <platform/ExternalNamespaceHeaderIncludeDummy.h>
+
+namespace Test {
+enum MouseButton : unsigned;
+enum class InputQueue;
+}
+
+
+namespace Test {
+class SavedMouseButton;
+} // namespace Test
+
+namespace JSC {
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::SavedMouseButton> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::SavedMouseButton&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::SavedMouseButton>&);
+};
+template<> struct TEST_EXPORT_MACRO EncodingTraits<Test::InputQueue> {
+    typedef Test::InputQueue DecodedType;
+
+    static EncodedValue encodeValue(const Test::InputQueue& value);
+    static bool decodeValue(EncodedValue&, Test::InputQueue& value);
+};
+
+template<> struct TEST_EXPORT_MACRO EncodingTraits<Test::MouseButton> {
+    typedef Test::MouseButton DecodedType;
+
+    static EncodedValue encodeValue(const Test::MouseButton& value);
+    static bool decodeValue(EncodedValue&, Test::MouseButton& value);
+};
+
+template<> struct TEST_EXPORT_MACRO EncodingTraits<Test::PlatformEvent::OtherType> {
+    typedef OptionSet<Test::PlatformEvent::OtherType> DecodedType;
+
+    static EncodedValue encodeValue(const OptionSet<Test::PlatformEvent::OtherType>& value);
+    static bool decodeValue(EncodedValue&, OptionSet<Test::PlatformEvent::OtherType>& value);
+};
+
+template<> struct TEST_EXPORT_MACRO EncodingTraits<Test::PlatformEvent::Type> {
+    typedef Test::PlatformEvent::Type DecodedType;
+
+    static EncodedValue encodeValue(const Test::PlatformEvent::Type& value);
+    static bool decodeValue(EncodedValue&, Test::PlatformEvent::Type& value);
+};
+} // namespace JSC
+
+namespace Test {
+class SavedMouseButton : public NondeterministicInput<SavedMouseButton> {
+public:
+    TEST_EXPORT_MACRO SavedMouseButton(MouseButton button);
+    virtual ~SavedMouseButton();
+
+    MouseButton button() const { return m_button; }
+private:
+    MouseButton m_button;
+};
+} // namespace Test
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::SavedMouseButton)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::SavedMouseButton>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#define TEST_REPLAY_INPUT_NAMES_FOR_EACH(macro) \
+    macro(SavedMouseButton) \
+    \
+// end of TEST_REPLAY_INPUT_NAMES_FOR_EACH
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.cpp b/replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.cpp
new file mode 100644
index 0000000..486756e
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-enum-with-guard.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#include "config.h"
+#include "generate-enum-with-guard.json-TestReplayInputs.h"
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceImplIncludeDummy.h"
+#include "PlatformWheelEvent.h"
+#include <platform/ExternalNamespaceImplIncludeDummy.h>
+#include <platform/PlatformWheelEvent.h>
+
+namespace Test {
+HandleWheelEvent::HandleWheelEvent(std::unique_ptr<PlatformWheelEvent> platformEvent, PlatformWheelPhase phase)
+    : EventLoopInput<HandleWheelEvent>()
+    , m_platformEvent(WTFMove(platformEvent))
+    , m_phase(phase)
+{
+}
+
+HandleWheelEvent::~HandleWheelEvent()
+{
+}
+} // namespace Test
+
+namespace JSC {
+const String& InputTraits<Test::HandleWheelEvent>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("HandleWheelEvent"));
+    return type;
+}
+
+void InputTraits<Test::HandleWheelEvent>::encode(EncodedValue& encodedValue, const Test::HandleWheelEvent& input)
+{
+    encodedValue.put<WebCore::PlatformWheelEvent>(ASCIILiteral("platformEvent"), input.platformEvent());
+    encodedValue.put<Test::PlatformWheelPhase>(ASCIILiteral("phase"), input.phase());
+}
+
+bool InputTraits<Test::HandleWheelEvent>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::HandleWheelEvent>& input)
+{
+    std::unique_ptr<WebCore::PlatformWheelEvent> platformEvent;
+    if (!encodedValue.get<WebCore::PlatformWheelEvent>(ASCIILiteral("platformEvent"), platformEvent))
+        return false;
+
+    Test::PlatformWheelPhase phase;
+    if (!encodedValue.get<Test::PlatformWheelPhase>(ASCIILiteral("phase"), phase))
+        return false;
+
+    input = std::make_unique<Test::HandleWheelEvent>(WTFMove(platformEvent), phase);
+    return true;
+}
+#if ENABLE(DUMMY_FEATURE)
+EncodedValue EncodingTraits<Test::PlatformWheelPhase>::encodeValue(const Test::PlatformWheelPhase& enumValue)
+{
+    EncodedValue encodedValue = EncodedValue::createArray();
+    if (enumValue & Test::PlatformWheelEventPhaseNone) {
+        encodedValue.append<String>(ASCIILiteral("PlatformWheelEventPhaseNone"));
+        if (enumValue == Test::PlatformWheelEventPhaseNone)
+            return encodedValue;
+    }
+    return encodedValue;
+}
+
+bool EncodingTraits<Test::PlatformWheelPhase>::decodeValue(EncodedValue& encodedValue, Test::PlatformWheelPhase& enumValue)
+{
+    Vector<String> enumStrings;
+    if (!EncodingTraits<Vector<String>>::decodeValue(encodedValue, enumStrings))
+        return false;
+
+    for (const String& enumString : enumStrings) {
+        if (enumString == "PlatformWheelEventPhaseNone")
+            enumValue = static_cast<Test::PlatformWheelPhase>(enumValue | Test::PlatformWheelEventPhaseNone);
+    }
+
+    return true;
+}
+#endif // ENABLE(DUMMY_FEATURE)
+} // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h b/replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h
new file mode 100644
index 0000000..adab4b7
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-enum-with-guard.json-TestReplayInputs.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-enum-with-guard.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceHeaderIncludeDummy.h"
+#include <platform/ExternalNamespaceHeaderIncludeDummy.h>
+
+namespace Test {
+enum PlatformWheelPhase : uint64_t;
+}
+
+namespace WebCore {
+class PlatformWheelEvent;
+}
+
+
+namespace Test {
+class HandleWheelEvent;
+} // namespace Test
+
+namespace JSC {
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::HandleWheelEvent> {
+    static InputQueue queue() { return InputQueue::EventLoopInput; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::HandleWheelEvent&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::HandleWheelEvent>&);
+};
+#if ENABLE(DUMMY_FEATURE)
+template<> struct TEST_EXPORT_MACRO EncodingTraits<Test::PlatformWheelPhase> {
+    typedef Test::PlatformWheelPhase DecodedType;
+
+    static EncodedValue encodeValue(const Test::PlatformWheelPhase& value);
+    static bool decodeValue(EncodedValue&, Test::PlatformWheelPhase& value);
+};
+#endif // ENABLE(DUMMY_FEATURE)
+} // namespace JSC
+
+namespace Test {
+class HandleWheelEvent : public EventLoopInput<HandleWheelEvent> {
+public:
+    TEST_EXPORT_MACRO HandleWheelEvent(std::unique_ptr<PlatformWheelEvent> platformEvent, PlatformWheelPhase phase);
+    virtual ~HandleWheelEvent();
+
+    // EventLoopInput API
+    virtual void dispatch(ReplayController&) final;
+    const PlatformWheelEvent& platformEvent() const { return *m_platformEvent; }
+    PlatformWheelPhase phase() const { return m_phase; }
+private:
+    std::unique_ptr<PlatformWheelEvent> m_platformEvent;
+    PlatformWheelPhase m_phase;
+};
+} // namespace Test
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::HandleWheelEvent)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::HandleWheelEvent>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#define TEST_REPLAY_INPUT_NAMES_FOR_EACH(macro) \
+    macro(HandleWheelEvent) \
+    \
+// end of TEST_REPLAY_INPUT_NAMES_FOR_EACH
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp b/replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp
new file mode 100644
index 0000000..a19644f
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-enums-with-same-base-name.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#include "config.h"
+#include "generate-enums-with-same-base-name.json-TestReplayInputs.h"
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceImplIncludeDummy.h"
+#include <platform/ExternalNamespaceImplIncludeDummy.h>
+
+namespace Test {
+FormCombo::FormCombo(PlatformEvent1::Type eventType1, PlatformEvent2::Type eventType2, FormData1::Type formType1, FormData2::Type formType2)
+    : NondeterministicInput<FormCombo>()
+    , m_eventType1(eventType1)
+    , m_eventType2(eventType2)
+    , m_formType1(formType1)
+    , m_formType2(formType2)
+{
+}
+
+FormCombo::~FormCombo()
+{
+}
+} // namespace Test
+
+namespace JSC {
+const String& InputTraits<Test::FormCombo>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("FormCombo"));
+    return type;
+}
+
+void InputTraits<Test::FormCombo>::encode(EncodedValue& encodedValue, const Test::FormCombo& input)
+{
+    encodedValue.put<PlatformEvent1::Type>(ASCIILiteral("eventType1"), input.eventType1());
+    encodedValue.put<PlatformEvent2::Type>(ASCIILiteral("eventType2"), input.eventType2());
+    encodedValue.put<Test::FormData1::Type>(ASCIILiteral("formType1"), input.formType1());
+    encodedValue.put<Test::FormData2::Type>(ASCIILiteral("formType2"), input.formType2());
+}
+
+bool InputTraits<Test::FormCombo>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::FormCombo>& input)
+{
+    PlatformEvent1::Type eventType1;
+    if (!encodedValue.get<PlatformEvent1::Type>(ASCIILiteral("eventType1"), eventType1))
+        return false;
+
+    PlatformEvent2::Type eventType2;
+    if (!encodedValue.get<PlatformEvent2::Type>(ASCIILiteral("eventType2"), eventType2))
+        return false;
+
+    Test::FormData1::Type formType1;
+    if (!encodedValue.get<Test::FormData1::Type>(ASCIILiteral("formType1"), formType1))
+        return false;
+
+    Test::FormData2::Type formType2;
+    if (!encodedValue.get<Test::FormData2::Type>(ASCIILiteral("formType2"), formType2))
+        return false;
+
+    input = std::make_unique<Test::FormCombo>(eventType1, eventType2, formType1, formType2);
+    return true;
+}
+EncodedValue EncodingTraits<Test::FormData1::Type>::encodeValue(const Test::FormData1::Type& enumValue)
+{
+    EncodedValue encodedValue = EncodedValue::createArray();
+    if (enumValue & Test::FormData1::Text) {
+        encodedValue.append<String>(ASCIILiteral("Text"));
+        if (enumValue == Test::FormData1::Text)
+            return encodedValue;
+    }
+    if (enumValue & Test::FormData1::Blob) {
+        encodedValue.append<String>(ASCIILiteral("Blob"));
+        if (enumValue == Test::FormData1::Blob)
+            return encodedValue;
+    }
+    return encodedValue;
+}
+
+bool EncodingTraits<Test::FormData1::Type>::decodeValue(EncodedValue& encodedValue, Test::FormData1::Type& enumValue)
+{
+    Vector<String> enumStrings;
+    if (!EncodingTraits<Vector<String>>::decodeValue(encodedValue, enumStrings))
+        return false;
+
+    for (const String& enumString : enumStrings) {
+        if (enumString == "Text")
+            enumValue = static_cast<Test::FormData1::Type>(enumValue | Test::FormData1::Text);
+        else if (enumString == "Blob")
+            enumValue = static_cast<Test::FormData1::Type>(enumValue | Test::FormData1::Blob);
+    }
+
+    return true;
+}
+
+EncodedValue EncodingTraits<Test::FormData2::Type>::encodeValue(const Test::FormData2::Type& enumValue)
+{
+    switch (enumValue) {
+    case Test::FormData2::Type::Text: return EncodedValue::createString("Text");
+    case Test::FormData2::Type::Blob: return EncodedValue::createString("Blob");
+    default: ASSERT_NOT_REACHED(); return EncodedValue::createString("Error!");
+    }
+}
+
+bool EncodingTraits<Test::FormData2::Type>::decodeValue(EncodedValue& encodedValue, Test::FormData2::Type& enumValue)
+{
+    String enumString = encodedValue.convertTo<String>();
+    if (enumString == "Text") {
+        enumValue = Test::FormData2::Type::Text;
+        return true;
+    }
+    if (enumString == "Blob") {
+        enumValue = Test::FormData2::Type::Blob;
+        return true;
+    }
+    return false;
+}
+} // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h b/replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h
new file mode 100644
index 0000000..86d43be
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-enums-with-same-base-name.json-TestReplayInputs.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-enums-with-same-base-name.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+#include "FormData1.h"
+#include "FormData2.h"
+#include "InternalNamespaceHeaderIncludeDummy.h"
+#include <platform/ExternalNamespaceHeaderIncludeDummy.h>
+#include <replay/PlatformEvent.h>
+
+
+
+namespace Test {
+class FormCombo;
+} // namespace Test
+
+namespace JSC {
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::FormCombo> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::FormCombo&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::FormCombo>&);
+};
+template<> struct TEST_EXPORT_MACRO EncodingTraits<Test::FormData1::Type> {
+    typedef Test::FormData1::Type DecodedType;
+
+    static EncodedValue encodeValue(const Test::FormData1::Type& value);
+    static bool decodeValue(EncodedValue&, Test::FormData1::Type& value);
+};
+
+template<> struct TEST_EXPORT_MACRO EncodingTraits<Test::FormData2::Type> {
+    typedef Test::FormData2::Type DecodedType;
+
+    static EncodedValue encodeValue(const Test::FormData2::Type& value);
+    static bool decodeValue(EncodedValue&, Test::FormData2::Type& value);
+};
+} // namespace JSC
+
+namespace Test {
+class FormCombo : public NondeterministicInput<FormCombo> {
+public:
+    TEST_EXPORT_MACRO FormCombo(PlatformEvent1::Type eventType1, PlatformEvent2::Type eventType2, FormData1::Type formType1, FormData2::Type formType2);
+    virtual ~FormCombo();
+
+    PlatformEvent1::Type eventType1() const { return m_eventType1; }
+    PlatformEvent2::Type eventType2() const { return m_eventType2; }
+    FormData1::Type formType1() const { return m_formType1; }
+    FormData2::Type formType2() const { return m_formType2; }
+private:
+    PlatformEvent1::Type m_eventType1;
+    PlatformEvent2::Type m_eventType2;
+    FormData1::Type m_formType1;
+    FormData2::Type m_formType2;
+};
+} // namespace Test
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::FormCombo)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::FormCombo>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#define TEST_REPLAY_INPUT_NAMES_FOR_EACH(macro) \
+    macro(FormCombo) \
+    \
+// end of TEST_REPLAY_INPUT_NAMES_FOR_EACH
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-event-loop-shape-types.json-error b/replay/scripts/tests/expected/generate-event-loop-shape-types.json-error
new file mode 100644
index 0000000..90a4176
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-event-loop-shape-types.json-error
@@ -0,0 +1 @@
+ERROR: Unknown type mode: MAP
diff --git a/replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.cpp b/replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.cpp
new file mode 100644
index 0000000..9cbb7af
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-input-with-guard.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#include "config.h"
+#include "generate-input-with-guard.json-TestReplayInputs.h"
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceImplIncludeDummy.h"
+#include <platform/ExternalNamespaceImplIncludeDummy.h>
+
+namespace Test {
+#if ENABLE(DUMMY_FEATURE)
+GetCurrentTime::GetCurrentTime(double currentTime)
+    : NondeterministicInput<GetCurrentTime>()
+    , m_currentTime(currentTime)
+{
+}
+
+GetCurrentTime::~GetCurrentTime()
+{
+}
+#endif // ENABLE(DUMMY_FEATURE)
+
+SetRandomSeed::SetRandomSeed(uint64_t randomSeed)
+    : NondeterministicInput<SetRandomSeed>()
+    , m_randomSeed(randomSeed)
+{
+}
+
+SetRandomSeed::~SetRandomSeed()
+{
+}
+} // namespace Test
+
+namespace JSC {
+#if ENABLE(DUMMY_FEATURE)
+const String& InputTraits<Test::GetCurrentTime>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("GetCurrentTime"));
+    return type;
+}
+
+void InputTraits<Test::GetCurrentTime>::encode(EncodedValue& encodedValue, const Test::GetCurrentTime& input)
+{
+    encodedValue.put<double>(ASCIILiteral("currentTime"), input.currentTime());
+}
+
+bool InputTraits<Test::GetCurrentTime>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::GetCurrentTime>& input)
+{
+    double currentTime;
+    if (!encodedValue.get<double>(ASCIILiteral("currentTime"), currentTime))
+        return false;
+
+    input = std::make_unique<Test::GetCurrentTime>(currentTime);
+    return true;
+}
+#endif // ENABLE(DUMMY_FEATURE)
+
+const String& InputTraits<Test::SetRandomSeed>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("SetRandomSeed"));
+    return type;
+}
+
+void InputTraits<Test::SetRandomSeed>::encode(EncodedValue& encodedValue, const Test::SetRandomSeed& input)
+{
+    encodedValue.put<uint64_t>(ASCIILiteral("randomSeed"), input.randomSeed());
+}
+
+bool InputTraits<Test::SetRandomSeed>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::SetRandomSeed>& input)
+{
+    uint64_t randomSeed;
+    if (!encodedValue.get<uint64_t>(ASCIILiteral("randomSeed"), randomSeed))
+        return false;
+
+    input = std::make_unique<Test::SetRandomSeed>(randomSeed);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.h b/replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.h
new file mode 100644
index 0000000..6d9346e
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-input-with-guard.json-TestReplayInputs.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-input-with-guard.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceHeaderIncludeDummy.h"
+#include <platform/ExternalNamespaceHeaderIncludeDummy.h>
+
+
+
+namespace Test {
+#if ENABLE(DUMMY_FEATURE)
+class GetCurrentTime;
+#endif // ENABLE(DUMMY_FEATURE)
+class SetRandomSeed;
+} // namespace Test
+
+namespace JSC {
+#if ENABLE(DUMMY_FEATURE)
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::GetCurrentTime> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::GetCurrentTime&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::GetCurrentTime>&);
+};
+#endif // ENABLE(DUMMY_FEATURE)
+
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::SetRandomSeed> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::SetRandomSeed&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::SetRandomSeed>&);
+};
+
+} // namespace JSC
+
+namespace Test {
+#if ENABLE(DUMMY_FEATURE)
+class GetCurrentTime : public NondeterministicInput<GetCurrentTime> {
+public:
+    TEST_EXPORT_MACRO GetCurrentTime(double currentTime);
+    virtual ~GetCurrentTime();
+
+    double currentTime() const { return m_currentTime; }
+private:
+    double m_currentTime;
+};
+#endif // ENABLE(DUMMY_FEATURE)
+
+class SetRandomSeed : public NondeterministicInput<SetRandomSeed> {
+public:
+    TEST_EXPORT_MACRO SetRandomSeed(uint64_t randomSeed);
+    virtual ~SetRandomSeed();
+
+    uint64_t randomSeed() const { return m_randomSeed; }
+private:
+    uint64_t m_randomSeed;
+};
+} // namespace Test
+
+#if ENABLE(DUMMY_FEATURE)
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::GetCurrentTime)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::GetCurrentTime>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+#endif // ENABLE(DUMMY_FEATURE)
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::SetRandomSeed)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::SetRandomSeed>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#define TEST_REPLAY_INPUT_NAMES_FOR_EACH(macro) \
+    macro(GetCurrentTime) \
+    macro(SetRandomSeed) \
+    \
+// end of TEST_REPLAY_INPUT_NAMES_FOR_EACH
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.cpp b/replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.cpp
new file mode 100644
index 0000000..f2f962a
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-input-with-vector-members.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#include "config.h"
+#include "generate-input-with-vector-members.json-TestReplayInputs.h"
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceImplIncludeDummy.h"
+#include <platform/ExternalNamespaceImplIncludeDummy.h>
+#include <things/JSThing.h>
+#include <things/WebThing.h>
+
+namespace Test {
+ArrayOfThings::ArrayOfThings(Vector<double>& doubles, Vector<JSThing>& jsthings, Vector<WebThing>& webthings)
+    : NondeterministicInput<ArrayOfThings>()
+    , m_doubles(doubles)
+    , m_jsthings(jsthings)
+    , m_webthings(webthings)
+{
+}
+
+ArrayOfThings::~ArrayOfThings()
+{
+}
+
+SavedHistory::SavedHistory(Vector<RefPtr<HistoryItem>>& entries)
+    : NondeterministicInput<SavedHistory>()
+    , m_entries(entries)
+{
+}
+
+SavedHistory::~SavedHistory()
+{
+}
+} // namespace Test
+
+namespace JSC {
+const String& InputTraits<Test::ArrayOfThings>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("ArrayOfThings"));
+    return type;
+}
+
+void InputTraits<Test::ArrayOfThings>::encode(EncodedValue& encodedValue, const Test::ArrayOfThings& input)
+{
+    encodedValue.put<Vector<double>>(ASCIILiteral("doubles"), input.doubles());
+    encodedValue.put<Vector<JSThing>>(ASCIILiteral("jsthings"), input.jsthings());
+    encodedValue.put<Vector<WebCore::WebThing>>(ASCIILiteral("webthings"), input.webthings());
+}
+
+bool InputTraits<Test::ArrayOfThings>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::ArrayOfThings>& input)
+{
+    Vector<double> doubles;
+    if (!encodedValue.get<Vector<double>>(ASCIILiteral("doubles"), doubles))
+        return false;
+
+    Vector<JSThing> jsthings;
+    if (!encodedValue.get<Vector<JSThing>>(ASCIILiteral("jsthings"), jsthings))
+        return false;
+
+    Vector<WebCore::WebThing> webthings;
+    if (!encodedValue.get<Vector<WebCore::WebThing>>(ASCIILiteral("webthings"), webthings))
+        return false;
+
+    input = std::make_unique<Test::ArrayOfThings>(doubles, jsthings, webthings);
+    return true;
+}
+
+const String& InputTraits<Test::SavedHistory>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("SavedHistory"));
+    return type;
+}
+
+void InputTraits<Test::SavedHistory>::encode(EncodedValue& encodedValue, const Test::SavedHistory& input)
+{
+    encodedValue.put<Vector<WebCore::HistoryItem>>(ASCIILiteral("entries"), input.entries());
+}
+
+bool InputTraits<Test::SavedHistory>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::SavedHistory>& input)
+{
+    Vector<RefPtr<WebCore::HistoryItem>> entries;
+    if (!encodedValue.get<Vector<WebCore::HistoryItem>>(ASCIILiteral("entries"), entries))
+        return false;
+
+    input = std::make_unique<Test::SavedHistory>(entries);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h b/replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h
new file mode 100644
index 0000000..9f184fa
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-input-with-vector-members.json-TestReplayInputs.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-input-with-vector-members.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceHeaderIncludeDummy.h"
+#include <history/HistoryItem.h>
+#include <platform/ExternalNamespaceHeaderIncludeDummy.h>
+
+namespace WebCore {
+class HistoryItem;
+}
+
+
+namespace Test {
+class ArrayOfThings;
+class SavedHistory;
+} // namespace Test
+
+namespace JSC {
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::ArrayOfThings> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::ArrayOfThings&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::ArrayOfThings>&);
+};
+
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::SavedHistory> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::SavedHistory&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::SavedHistory>&);
+};
+
+} // namespace JSC
+
+namespace Test {
+class ArrayOfThings : public NondeterministicInput<ArrayOfThings> {
+public:
+    TEST_EXPORT_MACRO ArrayOfThings(Vector<double>& doubles, Vector<JSThing>& jsthings, Vector<WebThing>& webthings);
+    virtual ~ArrayOfThings();
+
+    const Vector<double>& doubles() const { return m_doubles; }
+    const Vector<JSThing>& jsthings() const { return m_jsthings; }
+    const Vector<WebThing>& webthings() const { return m_webthings; }
+private:
+    Vector<double> m_doubles;
+    Vector<JSThing> m_jsthings;
+    Vector<WebThing> m_webthings;
+};
+
+class SavedHistory : public NondeterministicInput<SavedHistory> {
+public:
+    TEST_EXPORT_MACRO SavedHistory(Vector<RefPtr<HistoryItem>>& entries);
+    virtual ~SavedHistory();
+
+    const Vector<RefPtr<HistoryItem>>& entries() const { return m_entries; }
+private:
+    Vector<RefPtr<HistoryItem>> m_entries;
+};
+} // namespace Test
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::ArrayOfThings)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::ArrayOfThings>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::SavedHistory)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::SavedHistory>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#define TEST_REPLAY_INPUT_NAMES_FOR_EACH(macro) \
+    macro(ArrayOfThings) \
+    macro(SavedHistory) \
+    \
+// end of TEST_REPLAY_INPUT_NAMES_FOR_EACH
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.cpp b/replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.cpp
new file mode 100644
index 0000000..821f4d0
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-inputs-with-flags.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#include "config.h"
+#include "generate-inputs-with-flags.json-TestReplayInputs.h"
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceImplIncludeDummy.h"
+#include <platform/ExternalNamespaceImplIncludeDummy.h>
+
+namespace Test {
+ScalarInput1::ScalarInput1(ScalarType data)
+    : NondeterministicInput<ScalarInput1>()
+    , m_data(data)
+{
+}
+
+ScalarInput1::~ScalarInput1()
+{
+}
+
+ScalarInput2::ScalarInput2(ScalarType data)
+    : NondeterministicInput<ScalarInput2>()
+    , m_data(data)
+{
+}
+
+ScalarInput2::~ScalarInput2()
+{
+}
+} // namespace Test
+
+namespace JSC {
+const String& InputTraits<Test::ScalarInput1>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("ScalarInput1"));
+    return type;
+}
+
+void InputTraits<Test::ScalarInput1>::encode(EncodedValue& encodedValue, const Test::ScalarInput1& input)
+{
+    encodedValue.put<ScalarType>(ASCIILiteral("data"), input.data());
+}
+
+bool InputTraits<Test::ScalarInput1>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::ScalarInput1>& input)
+{
+    ScalarType data;
+    if (!encodedValue.get<ScalarType>(ASCIILiteral("data"), data))
+        return false;
+
+    input = std::make_unique<Test::ScalarInput1>(data);
+    return true;
+}
+
+const String& InputTraits<Test::ScalarInput2>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("ScalarInput2"));
+    return type;
+}
+
+void InputTraits<Test::ScalarInput2>::encode(EncodedValue& encodedValue, const Test::ScalarInput2& input)
+{
+    encodedValue.put<ScalarType>(ASCIILiteral("data"), input.data());
+}
+
+bool InputTraits<Test::ScalarInput2>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::ScalarInput2>& input)
+{
+    ScalarType data;
+    if (!encodedValue.get<ScalarType>(ASCIILiteral("data"), data))
+        return false;
+
+    input = std::make_unique<Test::ScalarInput2>(data);
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.h b/replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.h
new file mode 100644
index 0000000..761ea90
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-inputs-with-flags.json-TestReplayInputs.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-inputs-with-flags.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceHeaderIncludeDummy.h"
+#include <platform/ExternalNamespaceHeaderIncludeDummy.h>
+
+
+
+namespace Test {
+class ScalarInput1;
+class ScalarInput2;
+} // namespace Test
+
+namespace JSC {
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::ScalarInput1> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::ScalarInput1&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::ScalarInput1>&);
+};
+
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::ScalarInput2> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::ScalarInput2&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::ScalarInput2>&);
+};
+
+} // namespace JSC
+
+namespace Test {
+class ScalarInput1 : public NondeterministicInput<ScalarInput1> {
+public:
+    TEST_EXPORT_MACRO ScalarInput1(ScalarType data);
+    virtual ~ScalarInput1();
+
+    ScalarType data() const { return m_data; }
+private:
+    ScalarType m_data;
+};
+
+class ScalarInput2 : public NondeterministicInput<ScalarInput2> {
+public:
+    TEST_EXPORT_MACRO ScalarInput2(ScalarType data);
+    virtual ~ScalarInput2();
+
+    ScalarType data() const { return m_data; }
+private:
+    ScalarType m_data;
+};
+} // namespace Test
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::ScalarInput1)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::ScalarInput1>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::ScalarInput2)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::ScalarInput2>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#define TEST_REPLAY_INPUT_NAMES_FOR_EACH(macro) \
+    macro(ScalarInput1) \
+    macro(ScalarInput2) \
+    \
+// end of TEST_REPLAY_INPUT_NAMES_FOR_EACH
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.cpp b/replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.cpp
new file mode 100644
index 0000000..b67a9e9
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-memoized-type-modes.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#include "config.h"
+#include "generate-memoized-type-modes.json-TestReplayInputs.h"
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceImplIncludeDummy.h"
+#include <platform/ExternalNamespaceImplIncludeDummy.h>
+
+namespace Test {
+ScalarInput::ScalarInput(ScalarType data)
+    : NondeterministicInput<ScalarInput>()
+    , m_data(data)
+{
+}
+
+ScalarInput::~ScalarInput()
+{
+}
+
+MapInput::MapInput(std::unique_ptr<MapType> data)
+    : NondeterministicInput<MapInput>()
+    , m_data(WTFMove(data))
+{
+}
+
+MapInput::~MapInput()
+{
+}
+} // namespace Test
+
+namespace JSC {
+const String& InputTraits<Test::ScalarInput>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("ScalarInput"));
+    return type;
+}
+
+void InputTraits<Test::ScalarInput>::encode(EncodedValue& encodedValue, const Test::ScalarInput& input)
+{
+    encodedValue.put<ScalarType>(ASCIILiteral("data"), input.data());
+}
+
+bool InputTraits<Test::ScalarInput>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::ScalarInput>& input)
+{
+    ScalarType data;
+    if (!encodedValue.get<ScalarType>(ASCIILiteral("data"), data))
+        return false;
+
+    input = std::make_unique<Test::ScalarInput>(data);
+    return true;
+}
+
+const String& InputTraits<Test::MapInput>::type()
+{
+    static NeverDestroyed<const String> type(ASCIILiteral("MapInput"));
+    return type;
+}
+
+void InputTraits<Test::MapInput>::encode(EncodedValue& encodedValue, const Test::MapInput& input)
+{
+    encodedValue.put<MapType>(ASCIILiteral("data"), input.data());
+}
+
+bool InputTraits<Test::MapInput>::decode(EncodedValue& encodedValue, std::unique_ptr<Test::MapInput>& input)
+{
+    std::unique_ptr<MapType> data;
+    if (!encodedValue.get<MapType>(ASCIILiteral("data"), data))
+        return false;
+
+    input = std::make_unique<Test::MapInput>(WTFMove(data));
+    return true;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.h b/replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.h
new file mode 100644
index 0000000..ddac707
--- /dev/null
+++ b/replay/scripts/tests/expected/generate-memoized-type-modes.json-TestReplayInputs.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NOT EDIT THIS FILE. It is automatically generated from generate-memoized-type-modes.json
+// by the script: JavaScriptCore/replay/scripts/CodeGeneratorReplayInputs.py
+
+#pragma once
+
+#if ENABLE(WEB_REPLAY)
+#include "InternalNamespaceHeaderIncludeDummy.h"
+#include <platform/ExternalNamespaceHeaderIncludeDummy.h>
+
+
+
+namespace Test {
+class ScalarInput;
+class MapInput;
+} // namespace Test
+
+namespace JSC {
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::ScalarInput> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::ScalarInput&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::ScalarInput>&);
+};
+
+template<> struct TEST_EXPORT_MACRO InputTraits<Test::MapInput> {
+    static InputQueue queue() { return InputQueue::ScriptMemoizedData; }
+    static const String& type();
+
+    static void encode(JSC::EncodedValue&, const Test::MapInput&);
+    static bool decode(JSC::EncodedValue&, std::unique_ptr<Test::MapInput>&);
+};
+
+} // namespace JSC
+
+namespace Test {
+class ScalarInput : public NondeterministicInput<ScalarInput> {
+public:
+    TEST_EXPORT_MACRO ScalarInput(ScalarType data);
+    virtual ~ScalarInput();
+
+    ScalarType data() const { return m_data; }
+private:
+    ScalarType m_data;
+};
+
+class MapInput : public NondeterministicInput<MapInput> {
+public:
+    TEST_EXPORT_MACRO MapInput(std::unique_ptr<MapType> data);
+    virtual ~MapInput();
+
+    const MapType& data() const { return *m_data; }
+private:
+    std::unique_ptr<MapType> m_data;
+};
+} // namespace Test
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::ScalarInput)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::ScalarInput>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+SPECIALIZE_TYPE_TRAITS_BEGIN(Test::MapInput)
+    static bool isType(const NondeterministicInputBase& input) { return input.type() == InputTraits<Test::MapInput>::type(); }
+SPECIALIZE_TYPE_TRAITS_END()
+
+#define TEST_REPLAY_INPUT_NAMES_FOR_EACH(macro) \
+    macro(ScalarInput) \
+    macro(MapInput) \
+    \
+// end of TEST_REPLAY_INPUT_NAMES_FOR_EACH
+
+#endif // ENABLE(WEB_REPLAY)
diff --git a/replay/scripts/tests/fail-on-c-style-enum-no-storage.json b/replay/scripts/tests/fail-on-c-style-enum-no-storage.json
new file mode 100644
index 0000000..31d2c43
--- /dev/null
+++ b/replay/scripts/tests/fail-on-c-style-enum-no-storage.json
@@ -0,0 +1,25 @@
+{
+    "types": {
+        "Test": [
+            {
+                "name": "MouseButton", "mode": "SCALAR",
+                "flags": ["ENUM"],
+                "values": ["NoButton", "LeftButton", "MiddleButton", "RightButton"],
+                "header": "path/to/MouseButton.h"
+            }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "SavedMouseButton",
+                "description": "Supplies a mouse button enum value.",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "button", "type": "MouseButton" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-duplicate-enum-type.json b/replay/scripts/tests/fail-on-duplicate-enum-type.json
new file mode 100644
index 0000000..089e699
--- /dev/null
+++ b/replay/scripts/tests/fail-on-duplicate-enum-type.json
@@ -0,0 +1,35 @@
+{
+    "types": {
+        "JavaScriptCore": [
+            {
+                "name": "Type", "mode": "SCALAR", "storage": "uint64_t",
+                "enclosing_class": "PlatformEvent",
+                "flags": ["ENUM"],
+                "values": ["Mouse", "Keyboard"],
+                "header": "replay/PlatformEvent.h"
+            }
+        ],
+        "WebCore": [
+            {
+                "name": "Type", "mode": "SCALAR", "storage": "uint64_t",
+                "enclosing_class": "PlatformEvent",
+                "flags": ["ENUM"],
+                "values": ["Mouse", "Keyboard"],
+                "header": "replay/PlatformEvent.h"
+            }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "FormCombo",
+                "description": "Combines an event type and form data type.",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "eventType", "type": "PlatformEvent::Type" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-duplicate-input-names.json b/replay/scripts/tests/fail-on-duplicate-input-names.json
new file mode 100644
index 0000000..91c84a2
--- /dev/null
+++ b/replay/scripts/tests/fail-on-duplicate-input-names.json
@@ -0,0 +1,29 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double", "mode": "SCALAR" },
+            { "name": "uint64_t", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "currentTime", "type": "double" }
+                ]
+            },
+            {
+                "name": "GetCurrentTime",
+                "description": "Sets the PRNG seed used by Math.random().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "randomSeed", "type": "uint64_t" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-duplicate-type-names.json b/replay/scripts/tests/fail-on-duplicate-type-names.json
new file mode 100644
index 0000000..fc4b5d9
--- /dev/null
+++ b/replay/scripts/tests/fail-on-duplicate-type-names.json
@@ -0,0 +1,24 @@
+{
+    "types": {
+        "Global": [
+            { "name": "uint64_t", "mode": "SCALAR" },
+            { "name": "uint64_t", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "SetRandomSeed",
+                "description": "Sets the PRNG seed used by Math.random().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    {
+                        "name": "randomSeed",
+                        "type": "uint64_t"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-enum-type-missing-values.json b/replay/scripts/tests/fail-on-enum-type-missing-values.json
new file mode 100644
index 0000000..5bd20bd
--- /dev/null
+++ b/replay/scripts/tests/fail-on-enum-type-missing-values.json
@@ -0,0 +1,23 @@
+{
+    "types": {
+        "Global": [
+            {
+                "name": "MouseButton", "mode": "SCALAR",
+                "flags": ["ENUM"]
+            }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "SavedMouseButton",
+                "description": "Supplies a mouse button enum value.",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "currentTime", "type": "MouseButton" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-missing-input-member-name.json b/replay/scripts/tests/fail-on-missing-input-member-name.json
new file mode 100644
index 0000000..b924aaf
--- /dev/null
+++ b/replay/scripts/tests/fail-on-missing-input-member-name.json
@@ -0,0 +1,22 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    {
+                        "type": "double"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-missing-input-name.json b/replay/scripts/tests/fail-on-missing-input-name.json
new file mode 100644
index 0000000..aa80980
--- /dev/null
+++ b/replay/scripts/tests/fail-on-missing-input-name.json
@@ -0,0 +1,22 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    {
+                        "name": "currentTime",
+                        "type": "double"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-missing-input-queue.json b/replay/scripts/tests/fail-on-missing-input-queue.json
new file mode 100644
index 0000000..8136dfb
--- /dev/null
+++ b/replay/scripts/tests/fail-on-missing-input-queue.json
@@ -0,0 +1,22 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "members": [
+                    {
+                        "name": "currentTime",
+                        "type": "double"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-missing-type-mode.json b/replay/scripts/tests/fail-on-missing-type-mode.json
new file mode 100644
index 0000000..3ed6d1e
--- /dev/null
+++ b/replay/scripts/tests/fail-on-missing-type-mode.json
@@ -0,0 +1,23 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    {
+                        "name": "currentTime",
+                        "type": "double"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-missing-type-name.json b/replay/scripts/tests/fail-on-missing-type-name.json
new file mode 100644
index 0000000..01b1c08
--- /dev/null
+++ b/replay/scripts/tests/fail-on-missing-type-name.json
@@ -0,0 +1,23 @@
+{
+    "types": {
+        "Global": [
+            { "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    {
+                        "name": "currentTime",
+                        "type": "double"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-unknown-input-queue.json b/replay/scripts/tests/fail-on-unknown-input-queue.json
new file mode 100644
index 0000000..cd15f06
--- /dev/null
+++ b/replay/scripts/tests/fail-on-unknown-input-queue.json
@@ -0,0 +1,23 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEOIZED",
+                "members": [
+                    {
+                        "name": "currentTime",
+                        "type": "double"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-unknown-member-type.json b/replay/scripts/tests/fail-on-unknown-member-type.json
new file mode 100644
index 0000000..8a23057
--- /dev/null
+++ b/replay/scripts/tests/fail-on-unknown-member-type.json
@@ -0,0 +1,23 @@
+{
+    "types": {
+        "Global": [
+            { "name": "uint64_t", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "SetRandomSeed",
+                "description": "Sets the PRNG seed used by Math.random().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    {
+                        "name": "randomSeed",
+                        "type": "double"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/fail-on-unknown-type-mode.json b/replay/scripts/tests/fail-on-unknown-type-mode.json
new file mode 100644
index 0000000..b553bef
--- /dev/null
+++ b/replay/scripts/tests/fail-on-unknown-type-mode.json
@@ -0,0 +1,23 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double", "mode": "BONKERS" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    {
+                        "name": "currentTime",
+                        "type": "double"
+                    }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-enum-encoding-helpers-with-guarded-values.json b/replay/scripts/tests/generate-enum-encoding-helpers-with-guarded-values.json
new file mode 100644
index 0000000..9b2017d
--- /dev/null
+++ b/replay/scripts/tests/generate-enum-encoding-helpers-with-guarded-values.json
@@ -0,0 +1,29 @@
+{
+    "types": {
+        "WebCore": [
+            {
+                "name": "MouseButton", "mode": "SCALAR", "storage": "unsigned",
+                "flags": ["ENUM"],
+                "values": ["NoButton", "LeftButton", "MiddleButton", "RightButton"],
+                "guarded_values": {
+                    "ENABLE(SIDE_BUTTONS)": ["LeftSideButton", "RightSideButton"],
+                    "PLATFORM(WINDOWS)": ["WindowsButton"]
+                },
+                "header": "platform/PlatformMouseEvent.h"
+            }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "SavedMouseButton",
+                "description": "Supplies a mouse button enum value.",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "button", "type": "MouseButton" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-enum-encoding-helpers.json b/replay/scripts/tests/generate-enum-encoding-helpers.json
new file mode 100644
index 0000000..73b74ed
--- /dev/null
+++ b/replay/scripts/tests/generate-enum-encoding-helpers.json
@@ -0,0 +1,45 @@
+{
+    "types": {
+        "Test": [
+            {
+                "name": "InputQueue", "mode": "SCALAR",
+                "flags": ["ENUM_CLASS"],
+                "values": ["EventLoopInput", "LoaderMemoizedData", "ScriptMemoizedData"],
+                "header": "replay/NondeterministicInput.h"
+            },
+            {
+                "name": "MouseButton", "mode": "SCALAR", "storage": "unsigned",
+                "flags": ["ENUM"],
+                "values": ["NoButton", "LeftButton", "MiddleButton", "RightButton"],
+                "header": "platform/PlatformMouseEvent.h"
+            },
+            {
+                "name": "Type", "mode": "SCALAR",
+                "flags": ["ENUM"],
+                "enclosing_class": "PlatformEvent",
+                "values": ["Mouse", "Key", "Touch", "Wheel"],
+                "header": "platform/PlatformEvent.h"
+            },
+            {
+                "name": "OtherType", "mode": "SCALAR",
+                "flags": ["OPTION_SET"],
+                "enclosing_class": "PlatformEvent",
+                "values": ["Mouse", "Key", "Touch", "Wheel"],
+                "header": "platform/PlatformEvent.h"
+            }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "SavedMouseButton",
+                "description": "Supplies a mouse button enum value.",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "button", "type": "MouseButton" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-enum-with-guard.json b/replay/scripts/tests/generate-enum-with-guard.json
new file mode 100644
index 0000000..20ea359
--- /dev/null
+++ b/replay/scripts/tests/generate-enum-with-guard.json
@@ -0,0 +1,36 @@
+{
+    "types": {
+        "Global": [
+            { "name": "uint64_t", "mode": "SCALAR" }
+        ],
+        "WebCore": [
+            {
+                "name": "PlatformWheelEvent", "mode": "OWNED",
+                "header": "platform/PlatformWheelEvent.h"
+            }
+        ],
+        "Test": [
+            {
+                "name": "PlatformWheelPhase", "mode": "SCALAR", "storage": "uint64_t",
+                "flags": ["ENUM"],
+                "guard": "ENABLE(DUMMY_FEATURE)",
+                "values": ["PlatformWheelEventPhaseNone"],
+                "header": "platform/PlatformWheelEvent.h"
+            }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "HandleWheelEvent",
+                "description": "",
+                "queue": "EVENT_LOOP",
+                "members": [
+                    { "name": "platformEvent", "type": "PlatformWheelEvent" },
+                    { "name": "phase", "type": "PlatformWheelPhase" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-enums-with-same-base-name.json b/replay/scripts/tests/generate-enums-with-same-base-name.json
new file mode 100644
index 0000000..699439d
--- /dev/null
+++ b/replay/scripts/tests/generate-enums-with-same-base-name.json
@@ -0,0 +1,52 @@
+{
+    "types": {
+        "JavaScriptCore": [
+            {
+                "name": "Type", "mode": "SCALAR", "storage": "uint64_t",
+                "enclosing_class": "PlatformEvent1",
+                "flags": ["ENUM"],
+                "values": ["Mouse", "Keyboard"],
+                "header": "replay/PlatformEvent.h"
+            },
+            {
+                "name": "Type", "mode": "SCALAR",
+                "enclosing_class": "PlatformEvent2",
+                "flags": ["ENUM_CLASS"],
+                "values": ["Mouse", "Keyboard"],
+                "header": "replay/PlatformEvent.h"
+            }
+        ],
+        "Test": [
+            {
+                "name": "Type", "mode": "SCALAR", "storage": "uint64_t",
+                "enclosing_class": "FormData1",
+                "flags": ["ENUM"],
+                "values": ["Text", "Blob"],
+                "header": "replay/FormData1.h"
+            },
+            {
+                "name": "Type", "mode": "SCALAR",
+                "enclosing_class": "FormData2",
+                "flags": ["ENUM_CLASS"],
+                "values": ["Text", "Blob"],
+                "header": "replay/FormData2.h"
+            }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "FormCombo",
+                "description": "Combines an event type and form data type.",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "eventType1", "type": "PlatformEvent1::Type" },
+                    { "name": "eventType2", "type": "PlatformEvent2::Type" },
+                    { "name": "formType1", "type": "FormData1::Type" },
+                    { "name": "formType2", "type": "FormData2::Type" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-event-loop-shape-types.json b/replay/scripts/tests/generate-event-loop-shape-types.json
new file mode 100644
index 0000000..93b16bf
--- /dev/null
+++ b/replay/scripts/tests/generate-event-loop-shape-types.json
@@ -0,0 +1,38 @@
+{
+    "types": {
+        "Global": [
+            { "name": "ScalarType", "mode": "SCALAR" },
+            { "name": "MapType", "mode": "MAP" },
+            { "name": "SharedMapType", "mode": "SHARED_MAP" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "ScalarInput",
+                "description": "",
+                "queue": "EVENT_LOOP",
+                "members": [
+                    { "name": "data", "type": "ScalarType" }
+                ]
+            },
+            {
+                "name": "MapInput",
+                "description": "",
+                "queue": "EVENT_LOOP",
+                "members": [
+                    { "name": "data", "type": "MapType" }
+                ]
+            },
+            {
+                "name": "SharedMapInput",
+                "description": "",
+                "queue": "EVENT_LOOP",
+                "members": [
+                    { "name": "data", "type": "SharedMapType" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-input-with-guard.json b/replay/scripts/tests/generate-input-with-guard.json
new file mode 100644
index 0000000..75cd504
--- /dev/null
+++ b/replay/scripts/tests/generate-input-with-guard.json
@@ -0,0 +1,30 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double", "mode": "SCALAR" },
+            { "name": "uint64_t", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "GetCurrentTime",
+                "description": "Supplies the system time to Date.now() and new Date().",
+                "queue": "SCRIPT_MEMOIZED",
+                "guard": "ENABLE(DUMMY_FEATURE)",
+                "members": [
+                    { "name": "currentTime", "type": "double" }
+                ]
+            },
+            {
+                "name": "SetRandomSeed",
+                "description": "Sets the PRNG seed used by Math.random().",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    {"name": "randomSeed", "type": "uint64_t" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-input-with-vector-members.json b/replay/scripts/tests/generate-input-with-vector-members.json
new file mode 100644
index 0000000..eabd072
--- /dev/null
+++ b/replay/scripts/tests/generate-input-with-vector-members.json
@@ -0,0 +1,42 @@
+{
+    "types": {
+        "Global": [
+            { "name": "double", "mode": "SCALAR" }
+        ],
+
+        "JavaScriptCore": [
+            { "name": "JSThing", "mode": "SCALAR", "header": "things/JSThing.h" }
+        ],
+
+        "WebCore": [
+            { "name": "WebThing", "mode": "SCALAR", "header": "things/WebThing.h" },
+            {
+                "name": "HistoryItem", "mode": "SHARED",
+                "header": "history/HistoryItem.h"
+            }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "ArrayOfThings",
+                "description": "Supplies arrays of things.",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "doubles", "type": "double", "flags": ["VECTOR"] },
+                    { "name": "jsthings", "type": "JSThing", "flags": ["VECTOR"] },
+                    { "name": "webthings", "type": "WebThing", "flags": ["VECTOR"] }
+                ]
+            },
+            {
+                "name": "SavedHistory",
+                "description": "Save history items.",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "entries", "type": "HistoryItem", "flags": ["VECTOR"] }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-inputs-with-flags.json b/replay/scripts/tests/generate-inputs-with-flags.json
new file mode 100644
index 0000000..3f49cc1
--- /dev/null
+++ b/replay/scripts/tests/generate-inputs-with-flags.json
@@ -0,0 +1,29 @@
+{
+    "types": {
+        "Global": [
+            { "name": "ScalarType", "mode": "SCALAR" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "ScalarInput1",
+                "description": "",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "data", "type": "ScalarType" }
+                ]
+            },
+            {
+                "name": "ScalarInput2",
+                "description": "",
+                "queue": "SCRIPT_MEMOIZED",
+                "flags": ["CREATE_FROM_PAGE"],
+                "members": [
+                    { "name": "data", "type": "ScalarType" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/replay/scripts/tests/generate-memoized-type-modes.json b/replay/scripts/tests/generate-memoized-type-modes.json
new file mode 100644
index 0000000..0d66bd8
--- /dev/null
+++ b/replay/scripts/tests/generate-memoized-type-modes.json
@@ -0,0 +1,29 @@
+{
+    "types": {
+        "Global": [
+            { "name": "ScalarType", "mode": "SCALAR" },
+            { "name": "MapType", "mode": "OWNED" }
+        ]
+    },
+
+    "inputs": {
+        "Test": [
+            {
+                "name": "ScalarInput",
+                "description": "",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "data", "type": "ScalarType" }
+                ]
+            },
+            {
+                "name": "MapInput",
+                "description": "",
+                "queue": "SCRIPT_MEMOIZED",
+                "members": [
+                    { "name": "data", "type": "MapType" }
+                ]
+            }
+        ]
+    }
+}
diff --git a/runtime/AbstractModuleRecord.cpp b/runtime/AbstractModuleRecord.cpp
new file mode 100644
index 0000000..015e3e3
--- /dev/null
+++ b/runtime/AbstractModuleRecord.cpp
@@ -0,0 +1,768 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AbstractModuleRecord.h"
+
+#include "Error.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSMap.h"
+#include "JSModuleEnvironment.h"
+#include "JSModuleNamespaceObject.h"
+#include "UnlinkedModuleProgramCodeBlock.h"
+
+namespace JSC {
+
+const ClassInfo AbstractModuleRecord::s_info = { "AbstractModuleRecord", &Base::s_info, 0, CREATE_METHOD_TABLE(AbstractModuleRecord) };
+
+AbstractModuleRecord::AbstractModuleRecord(VM& vm, Structure* structure, const Identifier& moduleKey)
+    : Base(vm, structure)
+    , m_moduleKey(moduleKey)
+{
+}
+
+void AbstractModuleRecord::destroy(JSCell* cell)
+{
+    AbstractModuleRecord* thisObject = static_cast<AbstractModuleRecord*>(cell);
+    thisObject->AbstractModuleRecord::~AbstractModuleRecord();
+}
+
+void AbstractModuleRecord::finishCreation(ExecState* exec, VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirect(vm, Identifier::fromString(&vm, ASCIILiteral("registryEntry")), jsUndefined());
+    putDirect(vm, Identifier::fromString(&vm, ASCIILiteral("evaluated")), jsBoolean(false));
+
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSMap* map = JSMap::create(exec, vm, globalObject()->mapStructure());
+    RELEASE_ASSERT(!scope.exception());
+    m_dependenciesMap.set(vm, this, map);
+    putDirect(vm, Identifier::fromString(&vm, ASCIILiteral("dependenciesMap")), m_dependenciesMap.get());
+}
+
+void AbstractModuleRecord::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    AbstractModuleRecord* thisObject = jsCast<AbstractModuleRecord*>(cell);
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_moduleEnvironment);
+    visitor.append(thisObject->m_moduleNamespaceObject);
+    visitor.append(thisObject->m_dependenciesMap);
+}
+
+void AbstractModuleRecord::appendRequestedModule(const Identifier& moduleName)
+{
+    m_requestedModules.add(moduleName.impl());
+}
+
+void AbstractModuleRecord::addStarExportEntry(const Identifier& moduleName)
+{
+    m_starExportEntries.add(moduleName.impl());
+}
+
+void AbstractModuleRecord::addImportEntry(const ImportEntry& entry)
+{
+    bool isNewEntry = m_importEntries.add(entry.localName.impl(), entry).isNewEntry;
+    ASSERT_UNUSED(isNewEntry, isNewEntry); // This is guaranteed by the parser.
+}
+
+void AbstractModuleRecord::addExportEntry(const ExportEntry& entry)
+{
+    bool isNewEntry = m_exportEntries.add(entry.exportName.impl(), entry).isNewEntry;
+    ASSERT_UNUSED(isNewEntry, isNewEntry); // This is guaranteed by the parser.
+}
+
+auto AbstractModuleRecord::tryGetImportEntry(UniquedStringImpl* localName) -> std::optional<ImportEntry>
+{
+    const auto iterator = m_importEntries.find(localName);
+    if (iterator == m_importEntries.end())
+        return std::nullopt;
+    return std::optional<ImportEntry>(iterator->value);
+}
+
+auto AbstractModuleRecord::tryGetExportEntry(UniquedStringImpl* exportName) -> std::optional<ExportEntry>
+{
+    const auto iterator = m_exportEntries.find(exportName);
+    if (iterator == m_exportEntries.end())
+        return std::nullopt;
+    return std::optional<ExportEntry>(iterator->value);
+}
+
+auto AbstractModuleRecord::ExportEntry::createLocal(const Identifier& exportName, const Identifier& localName) -> ExportEntry
+{
+    return ExportEntry { Type::Local, exportName, Identifier(), Identifier(), localName };
+}
+
+auto AbstractModuleRecord::ExportEntry::createIndirect(const Identifier& exportName, const Identifier& importName, const Identifier& moduleName) -> ExportEntry
+{
+    return ExportEntry { Type::Indirect, exportName, moduleName, importName, Identifier() };
+}
+
+auto AbstractModuleRecord::Resolution::notFound() -> Resolution
+{
+    return Resolution { Type::NotFound, nullptr, Identifier() };
+}
+
+auto AbstractModuleRecord::Resolution::error() -> Resolution
+{
+    return Resolution { Type::Error, nullptr, Identifier() };
+}
+
+auto AbstractModuleRecord::Resolution::ambiguous() -> Resolution
+{
+    return Resolution { Type::Ambiguous, nullptr, Identifier() };
+}
+
+static JSValue identifierToJSValue(ExecState* exec, const Identifier& identifier)
+{
+    if (identifier.isSymbol())
+        return Symbol::create(exec->vm(), static_cast<SymbolImpl&>(*identifier.impl()));
+    return jsString(&exec->vm(), identifier.impl());
+}
+
+AbstractModuleRecord* AbstractModuleRecord::hostResolveImportedModule(ExecState* exec, const Identifier& moduleName)
+{
+    JSValue moduleNameValue = identifierToJSValue(exec, moduleName);
+    JSValue pair = m_dependenciesMap->JSMap::get(exec, moduleNameValue);
+    return jsCast<AbstractModuleRecord*>(pair.get(exec, Identifier::fromString(exec, "value")));
+}
+
+auto AbstractModuleRecord::resolveImport(ExecState* exec, const Identifier& localName) -> Resolution
+{
+    std::optional<ImportEntry> optionalImportEntry = tryGetImportEntry(localName.impl());
+    if (!optionalImportEntry)
+        return Resolution::notFound();
+
+    const ImportEntry& importEntry = *optionalImportEntry;
+    if (importEntry.isNamespace(exec->vm()))
+        return Resolution::notFound();
+
+    AbstractModuleRecord* importedModule = hostResolveImportedModule(exec, importEntry.moduleRequest);
+    return importedModule->resolveExport(exec, importEntry.importName);
+}
+
+struct AbstractModuleRecord::ResolveQuery {
+    struct Hash {
+        static unsigned hash(const ResolveQuery&);
+        static bool equal(const ResolveQuery&, const ResolveQuery&);
+        static const bool safeToCompareToEmptyOrDeleted = true;
+    };
+
+    ResolveQuery(AbstractModuleRecord* moduleRecord, UniquedStringImpl* exportName)
+        : moduleRecord(moduleRecord)
+        , exportName(exportName)
+    {
+    }
+
+    ResolveQuery(AbstractModuleRecord* moduleRecord, const Identifier& exportName)
+        : ResolveQuery(moduleRecord, exportName.impl())
+    {
+    }
+
+    enum EmptyValueTag { EmptyValue };
+    ResolveQuery(EmptyValueTag)
+    {
+    }
+
+    enum DeletedValueTag { DeletedValue };
+    ResolveQuery(DeletedValueTag)
+        : moduleRecord(nullptr)
+        , exportName(WTF::HashTableDeletedValue)
+    {
+    }
+
+    bool isEmptyValue() const
+    {
+        return !exportName;
+    }
+
+    bool isDeletedValue() const
+    {
+        return exportName.isHashTableDeletedValue();
+    }
+
+    // The module record is not marked from the GC. But these records are reachable from the JSGlobalObject.
+    // So we don't care the reachability to this record.
+    AbstractModuleRecord* moduleRecord;
+    RefPtr<UniquedStringImpl> exportName;
+};
+
+inline unsigned AbstractModuleRecord::ResolveQuery::Hash::hash(const ResolveQuery& query)
+{
+    return WTF::PtrHash<AbstractModuleRecord*>::hash(query.moduleRecord) + IdentifierRepHash::hash(query.exportName);
+}
+
+inline bool AbstractModuleRecord::ResolveQuery::Hash::equal(const ResolveQuery& lhs, const ResolveQuery& rhs)
+{
+    return lhs.moduleRecord == rhs.moduleRecord && lhs.exportName == rhs.exportName;
+}
+
+auto AbstractModuleRecord::tryGetCachedResolution(UniquedStringImpl* exportName) -> std::optional<Resolution>
+{
+    const auto iterator = m_resolutionCache.find(exportName);
+    if (iterator == m_resolutionCache.end())
+        return std::nullopt;
+    return std::optional<Resolution>(iterator->value);
+}
+
+void AbstractModuleRecord::cacheResolution(UniquedStringImpl* exportName, const Resolution& resolution)
+{
+    m_resolutionCache.add(exportName, resolution);
+}
+
+auto AbstractModuleRecord::resolveExportImpl(ExecState* exec, const ResolveQuery& root) -> Resolution
+{
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-resolveexport
+
+    // How to avoid C++ recursion in this function:
+    // This function avoids C++ recursion of the naive ResolveExport implementation.
+    // Flatten the recursion to the loop with the task queue and frames.
+    //
+    // 1. pendingTasks
+    //     We enqueue the recursive resolveExport call to this queue to avoid recursive calls in C++.
+    //     The task has 3 types. (1) Query, (2) IndirectFallback and (3) GatherStars.
+    //     (1) Query
+    //         Querying the resolution to the current module.
+    //     (2) IndirectFallback
+    //         Examine the result of the indirect export resolution. Only when the indirect export resolution fails,
+    //         we look into the star exports. (step 5-a-vi).
+    //     (3) GatherStars
+    //         Examine the result of the star export resolutions.
+    //
+    // 2. frames
+    //     When the spec calls the resolveExport recursively, instead we append the frame
+    //     (that holds the result resolution) to the frames and enqueue the task to the pendingTasks.
+    //     The entry in the frames means the *local* resolution result of the specific recursive resolveExport.
+    //
+    // We should maintain the local resolution result instead of holding the global resolution result only.
+    // For example,
+    //
+    //     star
+    // (1) ---> (2) "Resolve"
+    //      |
+    //      |
+    //      +-> (3) "NotFound"
+    //      |
+    //      |       star
+    //      +-> (4) ---> (5) "Resolve" [here]
+    //               |
+    //               |
+    //               +-> (6) "Error"
+    //
+    // Consider the above graph. The numbers represents the modules. Now we are [here].
+    // If we only hold the global resolution result during the resolveExport operation, [here],
+    // we decide the entire result of resolveExport is "Ambiguous", because there are multiple
+    // "Resolve" (in module (2) and (5)). However, this should become "Error" because (6) will
+    // propagate "Error" state to the (4), (4) will become "Error" and then, (1) will become
+    // "Error". We should aggregate the results at the star exports point ((4) and (1)).
+    //
+    // Usually, both "Error" and "Ambiguous" states will throw the syntax error. So except for the content of the
+    // error message, there are no difference. (And if we fix the (6) that raises "Error", next, it will produce
+    // the "Ambiguous" error due to (5). Anyway, user need to fix the both. So which error should be raised at first
+    // doesn't matter so much.
+    //
+    // However, this may become the problem under the module namespace creation.
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-getmodulenamespace
+    // section 15.2.1.18, step 3-d-ii
+    // Here, we distinguish "Ambiguous" and "Error". When "Error" state is produced, we need to throw the propagated error.
+    // But if "Ambiguous" state comes, we just ignore the result.
+    // To follow the requirement strictly, in this implementation, we keep the local resolution result to produce the
+    // correct result under the above complex cases.
+
+    // Caching strategy:
+    // The resolveExport operation is frequently called. So caching results is important.
+    // We observe the following aspects and based on them construct the caching strategy.
+    // Here, we attempt to cache the resolution by constructing the map in module records.
+    // That means  Module -> ExportName -> Maybe<Resolution>.
+    // Technically, all the AbstractModuleRecords have the Map<ExportName, Resolution> for caching.
+    //
+    // The important observations are that,
+    //
+    //  - *cacheable* means that traversing to this node from a path will produce the same results as starting from this node.
+    //
+    //    Here, we define the resovling route. We represent [?] as the module that has the local binding.
+    //    And (?) as the module without the local binding.
+    //
+    //      @ -> (A) -> (B) -> [C]
+    //
+    //    We list the resolving route for each node.
+    //
+    //    (A): (A) -> (B) -> [C]
+    //    (B): (B) -> [C]
+    //    [C]: [C]
+    //
+    //    In this case, if we start the tracing from (B), the resolving route becomes (B) -> [C].
+    //    So this is the same. At that time, we can say (B) is cacheable in the first tracing.
+    //
+    //  - The cache ability of a node depends on the resolving route from this node.
+    //
+    // 1. The starting point is always cacheable.
+    //
+    // 2. A module that has resolved a local binding is always cacheable.
+    //
+    //  @ -> (A) -> [B]
+    //
+    //  In the above case, we can see the [B] as cacheable.
+    //  This is because when starting from [B] node, we immediately resolve with the local binding.
+    //  So the resolving route from [B] does not depend on the starting point.
+    //
+    // 3. If we don't follow any star links during the resolution, we can see all the traced nodes are cacheable.
+    //
+    //  If there are non star links, it means that there is *no branch* in the module dependency graph.
+    //  This *no branch* feature makes all the modules cachable.
+    //
+    //  I.e, if we traverse one star link (even if we successfully resolve that star link),
+    //  we must still traverse all other star links. I would also explain we don't run into
+    //  this when resolving a local/indirect link. When resolving a local/indirect link,
+    //  we won't traverse any star links.
+    //  And since the module can hold only one local/indirect link for the specific export name (if there
+    //  are multiple local/indirect links that has the same export name, it should be syntax error in the
+    //  parsing phase.), there is no multiple outgoing links from a module.
+    //
+    //  @ -> (A) --> (B) -> [C] -> (D) -> (E) -+
+    //                ^                        |
+    //                |                        |
+    //                +------------------------+
+    //
+    //  When starting from @, [C] will be found as the module resolving the given binding.
+    //  In this case, (B) can cache this resolution. Since the resolving route is the same to the one when
+    //  starting from (B). After caching the above result, we attempt to resolve the same binding from (D).
+    //
+    //                              @
+    //                              |
+    //                              v
+    //  @ -> (A) --> (B) -> [C] -> (D) -> (E) -+
+    //                ^                        |
+    //                |                        |
+    //                +------------------------+
+    //
+    //  In this case, we can use the (B)'s cached result. And (E) can be cached.
+    //
+    //    (E): The resolving route is now (E) -> (B) -> [C]. That is the same when starting from (E).
+    //
+    //  No branching makes that the problematic *once-visited* node cannot be seen.
+    //  The *once-visited* node makes the resolving route changed since when we see the *once-visited* node,
+    //  we stop tracing this.
+    //
+    //  If there is no star links and if we look *once-visited* node under no branching graph, *once-visited*
+    //  node cannot resolve the requested binding. If the *once-visited* node can resolve the binding, we
+    //  should have already finished the resolution before reaching this *once-visited* node.
+    //
+    // 4. Once we follow star links, we should not retrieve the result from the cache and should not cache.
+    //
+    //  Star links are only the way to introduce branch.
+    //  Once we follow the star links during the resolution, we cannot cache naively.
+    //  This is because the cacheability depends on the resolving route. And branching produces the problematic *once-visited*
+    //  nodes. Since we don't follow the *once-visited* node, the resolving route from the node becomes different from
+    //  the resolving route when starting from this node.
+    //
+    //  The following example explains when we should not retrieve the cache and cache the result.
+    //
+    //               +----> (D) ------+
+    //               |                |
+    //               |                v
+    //      (A) *----+----> (B) ---> [C]
+    //                       ^
+    //                       |
+    //                       @
+    //
+    //  When starting from (B), we find [C]. In this resolving route, we don't find any star link.
+    //  And by definition, (B) and [C] are cachable. (B) is the starting point. And [C] has the local binding.
+    //
+    //               +----> (D) ------+
+    //               |                |
+    //               |                v
+    //  @-> (A) *----+----> (B) ---> [C]
+    //
+    //  But when starting from (A), we should not get the value from the cache. Because,
+    //
+    //    1. When looking (D), we reach [C] and make both resolved.
+    //    2. When looking (B), if we retrieved the last cache from (B), (B) becomes resolved.
+    //    3. But actually, (B) is not-found in this trial because (C) is already *once-visited*.
+    //    4. If we accidentally make (B) resolved, (A) becomes ambiguous. But the correct answer is resolved.
+    //
+    //  Why is this problem caused? This is because the *once-visited* node makes the result not-found.
+    //  In the second trial, (B) -> [C] result is changed from resolved to not-found.
+    //
+    //  When does this become a problem? If the status of the *once-visited* node group is resolved,
+    //  changing the result to not-found makes the result changed.
+    //
+    //  This problem does not happen when we don't see any star link yet. Now, consider the minimum case.
+    //
+    //  @-> (A) -> [ some graph ]
+    //       ^            |
+    //       |            |
+    //       +------------+
+    //
+    //  In (A), we don't see any star link yet. So we can say that all the visited nodes does not have any local
+    //  resolution. Because if they had a local/indirect resolution, we should have already finished the tracing.
+    //
+    //  And even if the some graph will see the *once-visited* node (in this case, (A)), that does not affect the
+    //  result of the resolution. Because even if we follow the link to (A) or not follow the link to (A), the status
+    //  of the link is always not-found since (A) does not have any local resolution.
+    //  In the above case, we can use the result of the [some graph].
+    //
+    // 5. Once we see star links, even if we have not yet traversed that star link path, we should disable caching.
+    //
+    //  Here is the reason why:
+    //
+    //       +-------------+
+    //       |             |
+    //       v             |
+    //      (A) -> (B) -> (C) *-> [E]
+    //       *             ^
+    //       |             |
+    //       v             @
+    //      [D]
+    //
+    //  In the above case, (C) will be resolved with [D].
+    //  (C) will see (A) and (A) gives up in (A) -> (B) -> (C) route. So, (A) will fallback to [D].
+    //
+    //       +-------------+
+    //       |             |
+    //       v             |
+    //  @-> (A) -> (B) -> (C) *-> [E]
+    //       *
+    //       |
+    //       v
+    //      [D]
+    //
+    //  But in this case, (A) will be resolved with [E] (not [D]).
+    //  (C) will attempt to follow the link to (A), but it fails.
+    //  So (C) will fallback to the star link and found [E]. In this senario,
+    //  (C) is now resolved with [E]'s result.
+    //
+    //  The cause of this problem is also the same to 4.
+    //  In the latter case, when looking (C), we cannot use the cached result in (C).
+    //  Because the cached result of (C) depends on the *once-visited* node (A) and
+    //  (A) has the fallback system with the star link.
+    //  In the latter trial, we now assume that (A)'s status is not-found.
+    //  But, actually, in the former trial, (A)'s status becomes resolved due to the fallback to the [D].
+    //
+    // To summarize the observations.
+    //
+    //  1. The starting point is always cacheable.
+    //  2. A module that has resolved a local binding is always cacheable.
+    //  3. If we don't follow any star links during the resolution, we can see all the traced nodes are cacheable.
+    //  4. Once we follow star links, we should not retrieve the result from the cache and should not cache the result.
+    //  5. Once we see star links, even if we have not yet traversed that star link path, we should disable caching.
+
+    typedef WTF::HashSet<ResolveQuery, ResolveQuery::Hash, WTF::CustomHashTraits<ResolveQuery>> ResolveSet;
+    enum class Type { Query, IndirectFallback, GatherStars };
+    struct Task {
+        ResolveQuery query;
+        Type type;
+    };
+
+    Vector<Task, 8> pendingTasks;
+    ResolveSet resolveSet;
+    HashSet<AbstractModuleRecord*> starSet;
+
+    Vector<Resolution, 8> frames;
+
+    bool foundStarLinks = false;
+
+    frames.append(Resolution::notFound());
+
+    // Call when the query is not resolved in the current module.
+    // It will enqueue the star resolution requests. Return "false" if the error occurs.
+    auto resolveNonLocal = [&](const ResolveQuery& query) -> bool {
+        // http://www.ecma-international.org/ecma-262/6.0/#sec-resolveexport
+        // section 15.2.1.16.3, step 6
+        // If the "default" name is not resolved in the current module, we need to throw an error and stop resolution immediately,
+        // Rationale to this error: A default export cannot be provided by an export *.
+        if (query.exportName == exec->propertyNames().defaultKeyword.impl())
+            return false;
+
+        // step 7, If exportStarSet contains module, then return null.
+        if (!starSet.add(query.moduleRecord).isNewEntry)
+            return true;
+
+        // Enqueue the task to gather the results of the stars.
+        // And append the new Resolution frame to gather the local result of the stars.
+        pendingTasks.append(Task { query, Type::GatherStars });
+        foundStarLinks = true;
+        frames.append(Resolution::notFound());
+
+
+        // Enqueue the tasks in reverse order.
+        for (auto iterator = query.moduleRecord->starExportEntries().rbegin(), end = query.moduleRecord->starExportEntries().rend(); iterator != end; ++iterator) {
+            const RefPtr<UniquedStringImpl>& starModuleName = *iterator;
+            AbstractModuleRecord* importedModuleRecord = query.moduleRecord->hostResolveImportedModule(exec, Identifier::fromUid(exec, starModuleName.get()));
+            pendingTasks.append(Task { ResolveQuery(importedModuleRecord, query.exportName.get()), Type::Query });
+        }
+        return true;
+    };
+
+    // Return the current resolution value of the top frame.
+    auto currentTop = [&] () -> Resolution& {
+        ASSERT(!frames.isEmpty());
+        return frames.last();
+    };
+
+    // Merge the given resolution to the current resolution value of the top frame.
+    // If there is ambiguity, return "false". When the "false" is returned, we should make the result "ambiguous".
+    auto mergeToCurrentTop = [&] (const Resolution& resolution) -> bool {
+        if (resolution.type == Resolution::Type::NotFound)
+            return true;
+
+        if (currentTop().type == Resolution::Type::NotFound) {
+            currentTop() = resolution;
+            return true;
+        }
+
+        if (currentTop().moduleRecord != resolution.moduleRecord || currentTop().localName != resolution.localName)
+            return false;
+
+        return true;
+    };
+
+    auto cacheResolutionForQuery = [] (const ResolveQuery& query, const Resolution& resolution) {
+        ASSERT(resolution.type == Resolution::Type::Resolved);
+        query.moduleRecord->cacheResolution(query.exportName.get(), resolution);
+    };
+
+    pendingTasks.append(Task { root, Type::Query });
+    while (!pendingTasks.isEmpty()) {
+        const Task task = pendingTasks.takeLast();
+        const ResolveQuery& query = task.query;
+
+        switch (task.type) {
+        case Type::Query: {
+            AbstractModuleRecord* moduleRecord = query.moduleRecord;
+
+            if (!resolveSet.add(task.query).isNewEntry)
+                continue;
+
+            //  5. Once we see star links, even if we have not yet traversed that star link path, we should disable caching.
+            if (!moduleRecord->starExportEntries().isEmpty())
+                foundStarLinks = true;
+
+            //  4. Once we follow star links, we should not retrieve the result from the cache and should not cache the result.
+            if (!foundStarLinks) {
+                if (std::optional<Resolution> cachedResolution = moduleRecord->tryGetCachedResolution(query.exportName.get())) {
+                    if (!mergeToCurrentTop(*cachedResolution))
+                        return Resolution::ambiguous();
+                    continue;
+                }
+            }
+
+            const std::optional<ExportEntry> optionalExportEntry = moduleRecord->tryGetExportEntry(query.exportName.get());
+            if (!optionalExportEntry) {
+                // If there is no matched exported binding in the current module,
+                // we need to look into the stars.
+                if (!resolveNonLocal(task.query))
+                    return Resolution::error();
+                continue;
+            }
+
+            const ExportEntry& exportEntry = *optionalExportEntry;
+            switch (exportEntry.type) {
+            case ExportEntry::Type::Local: {
+                ASSERT(!exportEntry.localName.isNull());
+                Resolution resolution { Resolution::Type::Resolved, moduleRecord, exportEntry.localName };
+                //  2. A module that has resolved a local binding is always cacheable.
+                cacheResolutionForQuery(query, resolution);
+                if (!mergeToCurrentTop(resolution))
+                    return Resolution::ambiguous();
+                continue;
+            }
+
+            case ExportEntry::Type::Indirect: {
+                AbstractModuleRecord* importedModuleRecord = moduleRecord->hostResolveImportedModule(exec, exportEntry.moduleName);
+
+                // When the imported module does not produce any resolved binding, we need to look into the stars in the *current*
+                // module. To do this, we append the `IndirectFallback` task to the task queue.
+                pendingTasks.append(Task { query, Type::IndirectFallback });
+                // And append the new Resolution frame to check the indirect export will be resolved or not.
+                frames.append(Resolution::notFound());
+                pendingTasks.append(Task { ResolveQuery(importedModuleRecord, exportEntry.importName), Type::Query });
+                continue;
+            }
+            }
+            break;
+        }
+
+        case Type::IndirectFallback: {
+            Resolution resolution = frames.takeLast();
+
+            if (resolution.type == Resolution::Type::NotFound) {
+                // Indirect export entry does not produce any resolved binding.
+                // So we will investigate the stars.
+                if (!resolveNonLocal(task.query))
+                    return Resolution::error();
+                continue;
+            }
+
+            ASSERT_WITH_MESSAGE(resolution.type == Resolution::Type::Resolved, "When we see Error and Ambiguous, we immediately return from this loop. So here, only Resolved comes.");
+
+            //  3. If we don't follow any star links during the resolution, we can see all the traced nodes are cacheable.
+            //  4. Once we follow star links, we should not retrieve the result from the cache and should not cache the result.
+            if (!foundStarLinks)
+                cacheResolutionForQuery(query, resolution);
+
+            // If indirect export entry produces Resolved, we should merge it to the upper frame.
+            // And do not investigate the stars of the current module.
+            if (!mergeToCurrentTop(resolution))
+                return Resolution::ambiguous();
+            break;
+        }
+
+        case Type::GatherStars: {
+            Resolution resolution = frames.takeLast();
+            ASSERT_WITH_MESSAGE(resolution.type == Resolution::Type::Resolved || resolution.type == Resolution::Type::NotFound, "When we see Error and Ambiguous, we immediately return from this loop. So here, only Resolved and NotFound comes.");
+
+            // Merge the star resolution to the upper frame.
+            if (!mergeToCurrentTop(resolution))
+                return Resolution::ambiguous();
+            break;
+        }
+        }
+    }
+
+    ASSERT(frames.size() == 1);
+    //  1. The starting point is always cacheable.
+    if (frames[0].type == Resolution::Type::Resolved)
+        cacheResolutionForQuery(root, frames[0]);
+    return frames[0];
+}
+
+auto AbstractModuleRecord::resolveExport(ExecState* exec, const Identifier& exportName) -> Resolution
+{
+    // Look up the cached resolution first before entering the resolving loop, since the loop setup takes some cost.
+    if (std::optional<Resolution> cachedResolution = tryGetCachedResolution(exportName.impl()))
+        return *cachedResolution;
+    return resolveExportImpl(exec, ResolveQuery(this, exportName.impl()));
+}
+
+static void getExportedNames(ExecState* exec, AbstractModuleRecord* root, IdentifierSet& exportedNames)
+{
+    HashSet<AbstractModuleRecord*> exportStarSet;
+    Vector<AbstractModuleRecord*, 8> pendingModules;
+
+    pendingModules.append(root);
+
+    while (!pendingModules.isEmpty()) {
+        AbstractModuleRecord* moduleRecord = pendingModules.takeLast();
+        if (exportStarSet.contains(moduleRecord))
+            continue;
+        exportStarSet.add(moduleRecord);
+
+        for (const auto& pair : moduleRecord->exportEntries()) {
+            const AbstractModuleRecord::ExportEntry& exportEntry = pair.value;
+            if (moduleRecord == root || exec->propertyNames().defaultKeyword != exportEntry.exportName)
+                exportedNames.add(exportEntry.exportName.impl());
+        }
+
+        for (const auto& starModuleName : moduleRecord->starExportEntries()) {
+            AbstractModuleRecord* requestedModuleRecord = moduleRecord->hostResolveImportedModule(exec, Identifier::fromUid(exec, starModuleName.get()));
+            pendingModules.append(requestedModuleRecord);
+        }
+    }
+}
+
+JSModuleNamespaceObject* AbstractModuleRecord::getModuleNamespace(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-getmodulenamespace
+    if (m_moduleNamespaceObject)
+        return m_moduleNamespaceObject.get();
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    IdentifierSet exportedNames;
+    getExportedNames(exec, this, exportedNames);
+
+    IdentifierSet unambiguousNames;
+    for (auto& name : exportedNames) {
+        const AbstractModuleRecord::Resolution resolution = resolveExport(exec, Identifier::fromUid(exec, name.get()));
+        switch (resolution.type) {
+        case Resolution::Type::NotFound:
+            throwSyntaxError(exec, scope, makeString("Exported binding name '", String(name.get()), "' is not found."));
+            return nullptr;
+
+        case Resolution::Type::Error:
+            throwSyntaxError(exec, scope, makeString("Exported binding name 'default' cannot be resolved by star export entries."));
+            return nullptr;
+
+        case Resolution::Type::Ambiguous:
+            break;
+
+        case Resolution::Type::Resolved:
+            unambiguousNames.add(name);
+            break;
+        }
+    }
+
+    m_moduleNamespaceObject.set(vm, this, JSModuleNamespaceObject::create(exec, globalObject, globalObject->moduleNamespaceObjectStructure(), this, unambiguousNames));
+    return m_moduleNamespaceObject.get();
+}
+
+static String printableName(const RefPtr<UniquedStringImpl>& uid)
+{
+    if (uid->isSymbol())
+        return uid.get();
+    return WTF::makeString("'", String(uid.get()), "'");
+}
+
+static String printableName(const Identifier& ident)
+{
+    return printableName(ident.impl());
+}
+
+void AbstractModuleRecord::dump()
+{
+    dataLog("\nAnalyzing ModuleRecord key(", printableName(m_moduleKey), ")\n");
+
+    dataLog("    Dependencies: ", m_requestedModules.size(), " modules\n");
+    for (const auto& moduleName : m_requestedModules)
+        dataLog("      module(", printableName(moduleName), ")\n");
+
+    dataLog("    Import: ", m_importEntries.size(), " entries\n");
+    for (const auto& pair : m_importEntries) {
+        const ImportEntry& importEntry = pair.value;
+        dataLog("      import(", printableName(importEntry.importName), "), local(", printableName(importEntry.localName), "), module(", printableName(importEntry.moduleRequest), ")\n");
+    }
+
+    dataLog("    Export: ", m_exportEntries.size(), " entries\n");
+    for (const auto& pair : m_exportEntries) {
+        const ExportEntry& exportEntry = pair.value;
+        switch (exportEntry.type) {
+        case ExportEntry::Type::Local:
+            dataLog("      [Local] ", "export(", printableName(exportEntry.exportName), "), local(", printableName(exportEntry.localName), ")\n");
+            break;
+
+        case ExportEntry::Type::Indirect:
+            dataLog("      [Indirect] ", "export(", printableName(exportEntry.exportName), "), import(", printableName(exportEntry.importName), "), module(", printableName(exportEntry.moduleName), ")\n");
+            break;
+        }
+    }
+    for (const auto& moduleName : m_starExportEntries)
+        dataLog("      [Star] module(", printableName(moduleName.get()), ")\n");
+}
+
+} // namespace JSC
diff --git a/runtime/AbstractModuleRecord.h b/runtime/AbstractModuleRecord.h
new file mode 100644
index 0000000..04af126
--- /dev/null
+++ b/runtime/AbstractModuleRecord.h
@@ -0,0 +1,180 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include "JSDestructibleObject.h"
+#include "SourceCode.h"
+#include "VariableEnvironment.h"
+#include <wtf/HashMap.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+class JSModuleEnvironment;
+class JSModuleNamespaceObject;
+class JSMap;
+
+// Based on the Source Text Module Record
+// http://www.ecma-international.org/ecma-262/6.0/#sec-source-text-module-records
+class AbstractModuleRecord : public JSDestructibleObject {
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef JSDestructibleObject Base;
+
+    // https://tc39.github.io/ecma262/#sec-source-text-module-records
+    struct ExportEntry {
+        enum class Type {
+            Local,
+            Indirect
+        };
+
+        static ExportEntry createLocal(const Identifier& exportName, const Identifier& localName);
+        static ExportEntry createIndirect(const Identifier& exportName, const Identifier& importName, const Identifier& moduleName);
+
+        Type type;
+        Identifier exportName;
+        Identifier moduleName;
+        Identifier importName;
+        Identifier localName;
+    };
+
+    struct ImportEntry {
+        Identifier moduleRequest;
+        Identifier importName;
+        Identifier localName;
+
+        bool isNamespace(VM& vm) const
+        {
+            return importName == vm.propertyNames->timesIdentifier;
+        }
+    };
+
+    typedef WTF::ListHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> OrderedIdentifierSet;
+    typedef HashMap<RefPtr<UniquedStringImpl>, ImportEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>> ImportEntries;
+    typedef HashMap<RefPtr<UniquedStringImpl>, ExportEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>> ExportEntries;
+
+    DECLARE_EXPORT_INFO;
+
+    void appendRequestedModule(const Identifier&);
+    void addStarExportEntry(const Identifier&);
+    void addImportEntry(const ImportEntry&);
+    void addExportEntry(const ExportEntry&);
+
+    std::optional<ImportEntry> tryGetImportEntry(UniquedStringImpl* localName);
+    std::optional<ExportEntry> tryGetExportEntry(UniquedStringImpl* exportName);
+
+    const Identifier& moduleKey() const { return m_moduleKey; }
+    const OrderedIdentifierSet& requestedModules() const { return m_requestedModules; }
+    const ExportEntries& exportEntries() const { return m_exportEntries; }
+    const ImportEntries& importEntries() const { return m_importEntries; }
+    const OrderedIdentifierSet& starExportEntries() const { return m_starExportEntries; }
+
+    void dump();
+
+    struct Resolution {
+        enum class Type { Resolved, NotFound, Ambiguous, Error };
+
+        static Resolution notFound();
+        static Resolution error();
+        static Resolution ambiguous();
+
+        Type type;
+        AbstractModuleRecord* moduleRecord;
+        Identifier localName;
+    };
+
+    Resolution resolveExport(ExecState*, const Identifier& exportName);
+    Resolution resolveImport(ExecState*, const Identifier& localName);
+
+    AbstractModuleRecord* hostResolveImportedModule(ExecState*, const Identifier& moduleName);
+
+    JSModuleNamespaceObject* getModuleNamespace(ExecState*);
+    
+    JSModuleEnvironment* moduleEnvironment()
+    {
+        ASSERT(m_moduleEnvironment);
+        return m_moduleEnvironment.get();
+    }
+
+protected:
+    AbstractModuleRecord(VM&, Structure*, const Identifier&);
+    void finishCreation(ExecState*, VM&);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static void destroy(JSCell*);
+
+    WriteBarrier<JSModuleEnvironment> m_moduleEnvironment;
+
+private:
+    struct ResolveQuery;
+    static Resolution resolveExportImpl(ExecState*, const ResolveQuery&);
+    std::optional<Resolution> tryGetCachedResolution(UniquedStringImpl* exportName);
+    void cacheResolution(UniquedStringImpl* exportName, const Resolution&);
+
+    // The loader resolves the given module name to the module key. The module key is the unique value to represent this module.
+    Identifier m_moduleKey;
+
+    // Currently, we don't keep the occurrence order of the import / export entries.
+    // So, we does not guarantee the order of the errors.
+    // e.g. The import declaration that occurr later than the another import declaration may
+    //      throw the error even if the former import declaration also has the invalid content.
+    //
+    //      import ... // (1) this has some invalid content.
+    //      import ... // (2) this also has some invalid content.
+    //
+    //      In the above case, (2) may throw the error earlier than (1)
+    //
+    // But, in all the cases, we will throw the syntax error. So except for the content of the syntax error,
+    // there are no difference.
+
+    // Map localName -> ImportEntry.
+    ImportEntries m_importEntries;
+
+    // Map exportName -> ExportEntry.
+    ExportEntries m_exportEntries;
+
+    // Save the occurrence order since resolveExport requires it.
+    OrderedIdentifierSet m_starExportEntries;
+
+    // Save the occurrence order since the module loader loads and runs the modules in this order.
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-moduleevaluation
+    OrderedIdentifierSet m_requestedModules;
+
+    WriteBarrier<JSMap> m_dependenciesMap;
+    
+    WriteBarrier<JSModuleNamespaceObject> m_moduleNamespaceObject;
+
+    // We assume that all the AbstractModuleRecord are retained by JSModuleLoader's registry.
+    // So here, we don't visit each object for GC. The resolution cache map caches the once
+    // looked up correctly resolved resolution, since (1) we rarely looked up the non-resolved one,
+    // and (2) if we cache all the attempts the size of the map becomes infinitely large.
+    typedef HashMap<RefPtr<UniquedStringImpl>, Resolution, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>> Resolutions;
+    Resolutions m_resolutionCache;
+};
+
+} // namespace JSC
diff --git a/runtime/ArgList.cpp b/runtime/ArgList.cpp
new file mode 100644
index 0000000..6fbbc5d
--- /dev/null
+++ b/runtime/ArgList.cpp
@@ -0,0 +1,106 @@
+/*
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "ArgList.h"
+
+#include "JSCJSValue.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+
+using std::min;
+
+namespace JSC {
+
+void MarkedArgumentBuffer::addMarkSet(JSValue v)
+{
+    if (m_markSet)
+        return;
+
+    Heap* heap = Heap::heap(v);
+    if (!heap)
+        return;
+
+    m_markSet = &heap->markListSet();
+    m_markSet->add(this);
+}
+
+void ArgList::getSlice(int startIndex, ArgList& result) const
+{
+    if (startIndex <= 0 || startIndex >= m_argCount) {
+        result = ArgList();
+        return;
+    }
+
+    result.m_args = m_args + startIndex;
+    result.m_argCount =  m_argCount - startIndex;
+}
+
+void MarkedArgumentBuffer::markLists(SlotVisitor& visitor, ListSet& markSet)
+{
+    ListSet::iterator end = markSet.end();
+    for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
+        MarkedArgumentBuffer* list = *it;
+        for (int i = 0; i < list->m_size; ++i)
+            visitor.appendUnbarriered(JSValue::decode(list->slotFor(i)));
+    }
+}
+
+void MarkedArgumentBuffer::slowEnsureCapacity(size_t requestedCapacity)
+{
+    int newCapacity = Checked<int>(requestedCapacity).unsafeGet();
+    expandCapacity(newCapacity);
+}
+
+void MarkedArgumentBuffer::expandCapacity()
+{
+    int newCapacity = (Checked<int>(m_capacity) * 2).unsafeGet();
+    expandCapacity(newCapacity);
+}
+
+void MarkedArgumentBuffer::expandCapacity(int newCapacity)
+{
+    ASSERT(m_capacity < newCapacity);
+    size_t size = (Checked<size_t>(newCapacity) * sizeof(EncodedJSValue)).unsafeGet();
+    EncodedJSValue* newBuffer = static_cast<EncodedJSValue*>(fastMalloc(size));
+    for (int i = 0; i < m_size; ++i) {
+        newBuffer[i] = m_buffer[i];
+        addMarkSet(JSValue::decode(m_buffer[i]));
+    }
+
+    if (EncodedJSValue* base = mallocBase())
+        fastFree(base);
+
+    m_buffer = newBuffer;
+    m_capacity = newCapacity;
+}
+
+void MarkedArgumentBuffer::slowAppend(JSValue v)
+{
+    ASSERT(m_size <= m_capacity);
+    if (m_size == m_capacity)
+        expandCapacity();
+
+    slotFor(m_size) = JSValue::encode(v);
+    ++m_size;
+    addMarkSet(v);
+}
+
+} // namespace JSC
diff --git a/runtime/ArgList.h b/runtime/ArgList.h
new file mode 100644
index 0000000..79918d6
--- /dev/null
+++ b/runtime/ArgList.h
@@ -0,0 +1,175 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include <wtf/ForbidHeapAllocation.h>
+#include <wtf/HashSet.h>
+
+namespace JSC {
+
+class MarkedArgumentBuffer {
+    WTF_MAKE_NONCOPYABLE(MarkedArgumentBuffer);
+    WTF_FORBID_HEAP_ALLOCATION;
+    friend class VM;
+    friend class ArgList;
+
+private:
+    static const size_t inlineCapacity = 8;
+    typedef HashSet<MarkedArgumentBuffer*> ListSet;
+
+public:
+    // Constructor for a read-write list, to which you may append values.
+    // FIXME: Remove all clients of this API, then remove this API.
+    MarkedArgumentBuffer()
+        : m_size(0)
+        , m_capacity(inlineCapacity)
+        , m_buffer(m_inlineBuffer)
+        , m_markSet(0)
+    {
+    }
+
+    ~MarkedArgumentBuffer()
+    {
+        if (m_markSet)
+            m_markSet->remove(this);
+
+        if (EncodedJSValue* base = mallocBase())
+            fastFree(base);
+    }
+
+    size_t size() const { return m_size; }
+    bool isEmpty() const { return !m_size; }
+
+    JSValue at(int i) const
+    {
+        if (i >= m_size)
+            return jsUndefined();
+
+        return JSValue::decode(slotFor(i));
+    }
+
+    void clear()
+    {
+        m_size = 0;
+    }
+
+    void append(JSValue v)
+    {
+        ASSERT(m_size <= m_capacity);
+        if (m_size == m_capacity || mallocBase())
+            return slowAppend(v);
+
+        slotFor(m_size) = JSValue::encode(v);
+        ++m_size;
+    }
+
+    void removeLast()
+    { 
+        ASSERT(m_size);
+        m_size--;
+    }
+
+    JSValue last() 
+    {
+        ASSERT(m_size);
+        return JSValue::decode(slotFor(m_size - 1));
+    }
+        
+    static void markLists(SlotVisitor&, ListSet&);
+
+    void ensureCapacity(size_t requestedCapacity)
+    {
+        if (requestedCapacity > static_cast<size_t>(m_capacity))
+            slowEnsureCapacity(requestedCapacity);
+    }
+
+private:
+    void expandCapacity();
+    void expandCapacity(int newCapacity);
+    void slowEnsureCapacity(size_t requestedCapacity);
+
+    void addMarkSet(JSValue);
+
+    JS_EXPORT_PRIVATE void slowAppend(JSValue);
+        
+    EncodedJSValue& slotFor(int item) const
+    {
+        return m_buffer[item];
+    }
+        
+    EncodedJSValue* mallocBase()
+    {
+        if (m_buffer == m_inlineBuffer)
+            return 0;
+        return &slotFor(0);
+    }
+        
+    int m_size;
+    int m_capacity;
+    EncodedJSValue m_inlineBuffer[inlineCapacity];
+    EncodedJSValue* m_buffer;
+    ListSet* m_markSet;
+};
+
+class ArgList {
+    friend class Interpreter;
+    friend class JIT;
+public:
+    ArgList()
+        : m_args(0)
+        , m_argCount(0)
+    {
+    }
+
+    ArgList(ExecState* exec)
+        : m_args(reinterpret_cast<JSValue*>(&exec[CallFrame::argumentOffset(0)]))
+        , m_argCount(exec->argumentCount())
+    {
+    }
+
+    ArgList(const MarkedArgumentBuffer& args)
+        : m_args(reinterpret_cast<JSValue*>(args.m_buffer))
+        , m_argCount(args.size())
+    {
+    }
+
+    JSValue at(int i) const
+    {
+        if (i >= m_argCount)
+            return jsUndefined();
+        return m_args[i];
+    }
+
+    bool isEmpty() const { return !m_argCount; }
+    size_t size() const { return m_argCount; }
+        
+    JS_EXPORT_PRIVATE void getSlice(int startIndex, ArgList& result) const;
+
+private:
+    JSValue* data() const { return m_args; }
+
+    JSValue* m_args;
+    int m_argCount;
+};
+
+} // namespace JSC
diff --git a/runtime/ArgumentsMode.h b/runtime/ArgumentsMode.h
new file mode 100644
index 0000000..e7a1291
--- /dev/null
+++ b/runtime/ArgumentsMode.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum class ArgumentsMode {
+    Cloned,
+    FakeValues
+};
+
+} // namespace JSC
diff --git a/runtime/ArityCheckMode.h b/runtime/ArityCheckMode.h
new file mode 100644
index 0000000..dae719a
--- /dev/null
+++ b/runtime/ArityCheckMode.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum ArityCheckMode {
+    ArityCheckNotRequired,
+    MustCheckArity
+};
+
+} // namespace JSC
diff --git a/runtime/ArrayBuffer.cpp b/runtime/ArrayBuffer.cpp
new file mode 100644
index 0000000..27336af
--- /dev/null
+++ b/runtime/ArrayBuffer.cpp
@@ -0,0 +1,333 @@
+/*
+ * Copyright (C) 2009, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ArrayBuffer.h"
+
+#include "ArrayBufferNeuteringWatchpoint.h"
+#include "JSArrayBufferView.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+SharedArrayBufferContents::SharedArrayBufferContents(void* data, ArrayBufferDestructorFunction&& destructor)
+    : m_data(data)
+    , m_destructor(WTFMove(destructor))
+{
+}
+
+SharedArrayBufferContents::~SharedArrayBufferContents()
+{
+    m_destructor(m_data);
+}
+
+ArrayBufferContents::ArrayBufferContents()
+{
+    reset();
+}
+
+ArrayBufferContents::ArrayBufferContents(ArrayBufferContents&& other)
+{
+    reset();
+    other.transferTo(*this);
+}
+
+ArrayBufferContents::ArrayBufferContents(void* data, unsigned sizeInBytes, ArrayBufferDestructorFunction&& destructor)
+    : m_data(data)
+    , m_sizeInBytes(sizeInBytes)
+{
+    m_destructor = WTFMove(destructor);
+}
+
+ArrayBufferContents& ArrayBufferContents::operator=(ArrayBufferContents&& other)
+{
+    other.transferTo(*this);
+    return *this;
+}
+
+ArrayBufferContents::~ArrayBufferContents()
+{
+    destroy();
+}
+
+void ArrayBufferContents::clear()
+{
+    destroy();
+    reset();
+}
+
+void ArrayBufferContents::destroy()
+{
+    m_destructor(m_data);
+}
+
+void ArrayBufferContents::reset()
+{
+    m_destructor = [] (void*) { };
+    m_shared = nullptr;
+    m_data = nullptr;
+    m_sizeInBytes = 0;
+}
+
+void ArrayBufferContents::tryAllocate(unsigned numElements, unsigned elementByteSize, InitializationPolicy policy)
+{
+    // Do not allow 31-bit overflow of the total size.
+    if (numElements) {
+        unsigned totalSize = numElements * elementByteSize;
+        if (totalSize / numElements != elementByteSize
+            || totalSize > static_cast<unsigned>(std::numeric_limits<int32_t>::max())) {
+            reset();
+            return;
+        }
+    }
+    bool allocationSucceeded = false;
+    if (policy == ZeroInitialize)
+        allocationSucceeded = WTF::tryFastCalloc(numElements, elementByteSize).getValue(m_data);
+    else {
+        ASSERT(policy == DontInitialize);
+        allocationSucceeded = WTF::tryFastMalloc(numElements * elementByteSize).getValue(m_data);
+    }
+
+    if (allocationSucceeded) {
+        m_sizeInBytes = numElements * elementByteSize;
+        m_destructor = [] (void* p) { fastFree(p); };
+        return;
+    }
+    reset();
+}
+
+void ArrayBufferContents::makeShared()
+{
+    m_shared = adoptRef(new SharedArrayBufferContents(m_data, WTFMove(m_destructor)));
+    m_destructor = [] (void*) { };
+}
+
+void ArrayBufferContents::transferTo(ArrayBufferContents& other)
+{
+    other.clear();
+    other.m_data = m_data;
+    other.m_sizeInBytes = m_sizeInBytes;
+    other.m_destructor = WTFMove(m_destructor);
+    other.m_shared = m_shared;
+    clear();
+}
+
+void ArrayBufferContents::copyTo(ArrayBufferContents& other)
+{
+    ASSERT(!other.m_data);
+    other.tryAllocate(m_sizeInBytes, sizeof(char), ArrayBufferContents::DontInitialize);
+    if (!other.m_data)
+        return;
+    memcpy(other.m_data, m_data, m_sizeInBytes);
+    other.m_sizeInBytes = m_sizeInBytes;
+}
+
+void ArrayBufferContents::shareWith(ArrayBufferContents& other)
+{
+    ASSERT(!other.m_data);
+    ASSERT(m_shared);
+    other.m_destructor = [] (void*) { };
+    other.m_shared = m_shared;
+    other.m_data = m_data;
+    other.m_sizeInBytes = m_sizeInBytes;
+}
+
+Ref<ArrayBuffer> ArrayBuffer::create(unsigned numElements, unsigned elementByteSize)
+{
+    auto buffer = tryCreate(numElements, elementByteSize);
+    if (!buffer)
+        CRASH();
+    return buffer.releaseNonNull();
+}
+
+Ref<ArrayBuffer> ArrayBuffer::create(ArrayBuffer& other)
+{
+    return ArrayBuffer::create(other.data(), other.byteLength());
+}
+
+Ref<ArrayBuffer> ArrayBuffer::create(const void* source, unsigned byteLength)
+{
+    auto buffer = tryCreate(source, byteLength);
+    if (!buffer)
+        CRASH();
+    return buffer.releaseNonNull();
+}
+
+Ref<ArrayBuffer> ArrayBuffer::create(ArrayBufferContents&& contents)
+{
+    return adoptRef(*new ArrayBuffer(WTFMove(contents)));
+}
+
+Ref<ArrayBuffer> ArrayBuffer::createAdopted(const void* data, unsigned byteLength)
+{
+    return createFromBytes(data, byteLength, [] (void* p) { fastFree(p); });
+}
+
+Ref<ArrayBuffer> ArrayBuffer::createFromBytes(const void* data, unsigned byteLength, ArrayBufferDestructorFunction&& destructor)
+{
+    ArrayBufferContents contents(const_cast<void*>(data), byteLength, WTFMove(destructor));
+    return create(WTFMove(contents));
+}
+
+RefPtr<ArrayBuffer> ArrayBuffer::tryCreate(unsigned numElements, unsigned elementByteSize)
+{
+    return tryCreate(numElements, elementByteSize, ArrayBufferContents::ZeroInitialize);
+}
+
+RefPtr<ArrayBuffer> ArrayBuffer::tryCreate(ArrayBuffer& other)
+{
+    return tryCreate(other.data(), other.byteLength());
+}
+
+RefPtr<ArrayBuffer> ArrayBuffer::tryCreate(const void* source, unsigned byteLength)
+{
+    ArrayBufferContents contents;
+    contents.tryAllocate(byteLength, 1, ArrayBufferContents::ZeroInitialize);
+    if (!contents.m_data)
+        return nullptr;
+    return createInternal(WTFMove(contents), source, byteLength);
+}
+
+Ref<ArrayBuffer> ArrayBuffer::createUninitialized(unsigned numElements, unsigned elementByteSize)
+{
+    return create(numElements, elementByteSize, ArrayBufferContents::DontInitialize);
+}
+
+RefPtr<ArrayBuffer> ArrayBuffer::tryCreateUninitialized(unsigned numElements, unsigned elementByteSize)
+{
+    return tryCreate(numElements, elementByteSize, ArrayBufferContents::DontInitialize);
+}
+
+Ref<ArrayBuffer> ArrayBuffer::create(unsigned numElements, unsigned elementByteSize, ArrayBufferContents::InitializationPolicy policy)
+{
+    auto buffer = tryCreate(numElements, elementByteSize, policy);
+    if (!buffer)
+        CRASH();
+    return buffer.releaseNonNull();
+}
+
+Ref<ArrayBuffer> ArrayBuffer::createInternal(ArrayBufferContents&& contents, const void* source, unsigned byteLength)
+{
+    ASSERT(!byteLength || source);
+    auto buffer = adoptRef(*new ArrayBuffer(WTFMove(contents)));
+    memcpy(buffer->data(), source, byteLength);
+    return buffer;
+}
+
+RefPtr<ArrayBuffer> ArrayBuffer::tryCreate(unsigned numElements, unsigned elementByteSize, ArrayBufferContents::InitializationPolicy policy)
+{
+    ArrayBufferContents contents;
+    contents.tryAllocate(numElements, elementByteSize, policy);
+    if (!contents.m_data)
+        return nullptr;
+    return adoptRef(*new ArrayBuffer(WTFMove(contents)));
+}
+
+ArrayBuffer::ArrayBuffer(ArrayBufferContents&& contents)
+    : m_contents(WTFMove(contents))
+    , m_pinCount(0)
+    , m_locked(false)
+{
+}
+
+RefPtr<ArrayBuffer> ArrayBuffer::slice(int begin, int end) const
+{
+    return sliceImpl(clampIndex(begin), clampIndex(end));
+}
+
+RefPtr<ArrayBuffer> ArrayBuffer::slice(int begin) const
+{
+    return sliceImpl(clampIndex(begin), byteLength());
+}
+
+RefPtr<ArrayBuffer> ArrayBuffer::sliceImpl(unsigned begin, unsigned end) const
+{
+    unsigned size = begin <= end ? end - begin : 0;
+    RefPtr<ArrayBuffer> result = ArrayBuffer::create(static_cast<const char*>(data()) + begin, size);
+    result->setSharingMode(sharingMode());
+    return result;
+}
+
+void ArrayBuffer::makeShared()
+{
+    m_contents.makeShared();
+}
+
+void ArrayBuffer::setSharingMode(ArrayBufferSharingMode newSharingMode)
+{
+    if (newSharingMode == sharingMode())
+        return;
+    RELEASE_ASSERT(!isShared()); // Cannot revert sharing.
+    RELEASE_ASSERT(newSharingMode == ArrayBufferSharingMode::Shared);
+    makeShared();
+}
+
+bool ArrayBuffer::transferTo(ArrayBufferContents& result)
+{
+    Ref<ArrayBuffer> protect(*this);
+
+    if (!m_contents.m_data) {
+        result.m_data = 0;
+        return false;
+    }
+    
+    if (isShared()) {
+        m_contents.shareWith(result);
+        return true;
+    }
+
+    bool isNeuterable = !m_pinCount && !m_locked;
+
+    if (!isNeuterable) {
+        m_contents.copyTo(result);
+        if (!result.m_data)
+            return false;
+        return true;
+    }
+
+    m_contents.transferTo(result);
+    for (size_t i = numberOfIncomingReferences(); i--;) {
+        JSCell* cell = incomingReferenceAt(i);
+        if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(cell))
+            view->neuter();
+        else if (ArrayBufferNeuteringWatchpoint* watchpoint = jsDynamicCast<ArrayBufferNeuteringWatchpoint*>(cell))
+            watchpoint->fireAll();
+    }
+    return true;
+}
+
+bool ArrayBuffer::shareWith(ArrayBufferContents& result)
+{
+    if (!m_contents.m_data || !isShared()) {
+        result.m_data = nullptr;
+        return false;
+    }
+    
+    m_contents.shareWith(result);
+    return true;
+}
+
+} // namespace JSC
+
diff --git a/runtime/ArrayBuffer.h b/runtime/ArrayBuffer.h
new file mode 100644
index 0000000..f8f60ea
--- /dev/null
+++ b/runtime/ArrayBuffer.h
@@ -0,0 +1,220 @@
+/*
+ * Copyright (C) 2009, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBufferSharingMode.h"
+#include "GCIncomingRefCounted.h"
+#include "Weak.h"
+#include <wtf/Function.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace JSC {
+
+class ArrayBuffer;
+class ArrayBufferView;
+class JSArrayBuffer;
+
+typedef Function<void(void*)> ArrayBufferDestructorFunction;
+
+class SharedArrayBufferContents : public ThreadSafeRefCounted<SharedArrayBufferContents> {
+public:
+    SharedArrayBufferContents(void* data, ArrayBufferDestructorFunction&&);
+    ~SharedArrayBufferContents();
+    
+    void* data() const { return m_data; }
+    
+private:
+    void* m_data;
+    ArrayBufferDestructorFunction m_destructor;
+};
+
+class ArrayBufferContents {
+    WTF_MAKE_NONCOPYABLE(ArrayBufferContents);
+public:
+    JS_EXPORT_PRIVATE ArrayBufferContents();
+    
+    JS_EXPORT_PRIVATE ArrayBufferContents(ArrayBufferContents&&);
+    JS_EXPORT_PRIVATE ArrayBufferContents& operator=(ArrayBufferContents&&);
+
+    JS_EXPORT_PRIVATE ~ArrayBufferContents();
+    
+    JS_EXPORT_PRIVATE void clear();
+    
+    explicit operator bool() { return !!m_data; }
+    
+    void* data() const { return m_data; }
+    unsigned sizeInBytes() const { return m_sizeInBytes; }
+    
+    bool isShared() const { return m_shared; }
+
+private:
+    ArrayBufferContents(void* data, unsigned sizeInBytes, ArrayBufferDestructorFunction&&);
+    
+    void destroy();
+    void reset();
+
+    friend class ArrayBuffer;
+
+    enum InitializationPolicy {
+        ZeroInitialize,
+        DontInitialize
+    };
+
+    void tryAllocate(unsigned numElements, unsigned elementByteSize, InitializationPolicy);
+    
+    void makeShared();
+    void transferTo(ArrayBufferContents&);
+    void copyTo(ArrayBufferContents&);
+    void shareWith(ArrayBufferContents&);
+
+    ArrayBufferDestructorFunction m_destructor;
+    RefPtr<SharedArrayBufferContents> m_shared;
+    void* m_data;
+    unsigned m_sizeInBytes;
+};
+
+class ArrayBuffer : public GCIncomingRefCounted<ArrayBuffer> {
+public:
+    JS_EXPORT_PRIVATE static Ref<ArrayBuffer> create(unsigned numElements, unsigned elementByteSize);
+    JS_EXPORT_PRIVATE static Ref<ArrayBuffer> create(ArrayBuffer&);
+    JS_EXPORT_PRIVATE static Ref<ArrayBuffer> create(const void* source, unsigned byteLength);
+    JS_EXPORT_PRIVATE static Ref<ArrayBuffer> create(ArrayBufferContents&&);
+    JS_EXPORT_PRIVATE static Ref<ArrayBuffer> createAdopted(const void* data, unsigned byteLength);
+    JS_EXPORT_PRIVATE static Ref<ArrayBuffer> createFromBytes(const void* data, unsigned byteLength, ArrayBufferDestructorFunction&&);
+    JS_EXPORT_PRIVATE static RefPtr<ArrayBuffer> tryCreate(unsigned numElements, unsigned elementByteSize);
+    JS_EXPORT_PRIVATE static RefPtr<ArrayBuffer> tryCreate(ArrayBuffer&);
+    JS_EXPORT_PRIVATE static RefPtr<ArrayBuffer> tryCreate(const void* source, unsigned byteLength);
+
+    // Only for use by Uint8ClampedArray::createUninitialized and SharedBuffer::createArrayBuffer.
+    JS_EXPORT_PRIVATE static Ref<ArrayBuffer> createUninitialized(unsigned numElements, unsigned elementByteSize);
+    JS_EXPORT_PRIVATE static RefPtr<ArrayBuffer> tryCreateUninitialized(unsigned numElements, unsigned elementByteSize);
+
+    inline void* data();
+    inline const void* data() const;
+    inline unsigned byteLength() const;
+    
+    void makeShared();
+    void setSharingMode(ArrayBufferSharingMode);
+    inline bool isShared() const;
+    inline ArrayBufferSharingMode sharingMode() const { return isShared() ? ArrayBufferSharingMode::Shared : ArrayBufferSharingMode::Default; }
+    
+    inline size_t gcSizeEstimateInBytes() const;
+
+    JS_EXPORT_PRIVATE RefPtr<ArrayBuffer> slice(int begin, int end) const;
+    JS_EXPORT_PRIVATE RefPtr<ArrayBuffer> slice(int begin) const;
+    
+    inline void pin();
+    inline void unpin();
+    inline void pinAndLock();
+
+    JS_EXPORT_PRIVATE bool transferTo(ArrayBufferContents&);
+    JS_EXPORT_PRIVATE bool shareWith(ArrayBufferContents&);
+    bool isNeutered() { return !m_contents.m_data; }
+    
+    static ptrdiff_t offsetOfData() { return OBJECT_OFFSETOF(ArrayBuffer, m_contents) + OBJECT_OFFSETOF(ArrayBufferContents, m_data); }
+
+    ~ArrayBuffer() { }
+
+private:
+    static Ref<ArrayBuffer> create(unsigned numElements, unsigned elementByteSize, ArrayBufferContents::InitializationPolicy);
+    static Ref<ArrayBuffer> createInternal(ArrayBufferContents&&, const void*, unsigned);
+    static RefPtr<ArrayBuffer> tryCreate(unsigned numElements, unsigned elementByteSize, ArrayBufferContents::InitializationPolicy);
+    ArrayBuffer(ArrayBufferContents&&);
+    RefPtr<ArrayBuffer> sliceImpl(unsigned begin, unsigned end) const;
+    inline unsigned clampIndex(int index) const;
+    static inline int clampValue(int x, int left, int right);
+
+    ArrayBufferContents m_contents;
+    unsigned m_pinCount : 31;
+    bool m_locked : 1; // m_locked == true means that some API user fetched m_contents directly from a TypedArray object.
+
+public:
+    Weak<JSArrayBuffer> m_wrapper;
+};
+
+int ArrayBuffer::clampValue(int x, int left, int right)
+{
+    ASSERT(left <= right);
+    if (x < left)
+        x = left;
+    if (right < x)
+        x = right;
+    return x;
+}
+
+void* ArrayBuffer::data()
+{
+    return m_contents.m_data;
+}
+
+const void* ArrayBuffer::data() const
+{
+    return m_contents.m_data;
+}
+
+unsigned ArrayBuffer::byteLength() const
+{
+    return m_contents.m_sizeInBytes;
+}
+
+bool ArrayBuffer::isShared() const
+{
+    return m_contents.isShared();
+}
+
+size_t ArrayBuffer::gcSizeEstimateInBytes() const
+{
+    // FIXME: We probably want to scale this by the shared ref count or something.
+    return sizeof(ArrayBuffer) + static_cast<size_t>(byteLength());
+}
+
+unsigned ArrayBuffer::clampIndex(int index) const
+{
+    unsigned currentLength = byteLength();
+    if (index < 0)
+        index = currentLength + index;
+    return clampValue(index, 0, currentLength);
+}
+
+void ArrayBuffer::pin()
+{
+    m_pinCount++;
+}
+
+void ArrayBuffer::unpin()
+{
+    m_pinCount--;
+}
+
+void ArrayBuffer::pinAndLock()
+{
+    m_locked = true;
+}
+
+} // namespace JSC
+
+using JSC::ArrayBuffer;
diff --git a/runtime/ArrayBufferNeuteringWatchpoint.cpp b/runtime/ArrayBufferNeuteringWatchpoint.cpp
new file mode 100644
index 0000000..11279f5
--- /dev/null
+++ b/runtime/ArrayBufferNeuteringWatchpoint.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ArrayBufferNeuteringWatchpoint.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo ArrayBufferNeuteringWatchpoint::s_info = {
+    "ArrayBufferNeuteringWatchpoint", 0, 0,
+    CREATE_METHOD_TABLE(ArrayBufferNeuteringWatchpoint)
+};
+
+ArrayBufferNeuteringWatchpoint::ArrayBufferNeuteringWatchpoint(VM& vm)
+    : Base(vm, vm.arrayBufferNeuteringWatchpointStructure.get())
+    , m_set(adoptRef(new WatchpointSet(IsWatched)))
+{
+}
+
+void ArrayBufferNeuteringWatchpoint::destroy(JSCell* cell)
+{
+    static_cast<ArrayBufferNeuteringWatchpoint*>(cell)->ArrayBufferNeuteringWatchpoint::~ArrayBufferNeuteringWatchpoint();
+}
+
+ArrayBufferNeuteringWatchpoint* ArrayBufferNeuteringWatchpoint::create(VM& vm)
+{
+    ArrayBufferNeuteringWatchpoint* result = new
+        (NotNull, allocateCell<ArrayBufferNeuteringWatchpoint>(vm.heap))
+        ArrayBufferNeuteringWatchpoint(vm);
+    result->finishCreation(vm);
+    return result;
+}
+
+Structure* ArrayBufferNeuteringWatchpoint::createStructure(VM& vm)
+{
+    return Structure::create(vm, 0, jsNull(), TypeInfo(CellType, StructureFlags), info());
+}
+
+void ArrayBufferNeuteringWatchpoint::fireAll()
+{
+    set()->fireAll(*vm(), "Array buffer was neutered");
+}
+
+} // namespace JSC
+
diff --git a/runtime/ArrayBufferNeuteringWatchpoint.h b/runtime/ArrayBufferNeuteringWatchpoint.h
new file mode 100644
index 0000000..263ac77
--- /dev/null
+++ b/runtime/ArrayBufferNeuteringWatchpoint.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "Watchpoint.h"
+
+namespace JSC {
+
+class ArrayBufferNeuteringWatchpoint final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    DECLARE_INFO;
+    
+    static ArrayBufferNeuteringWatchpoint* create(VM&);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+    
+    static Structure* createStructure(VM&);
+    
+    WatchpointSet* set() { return m_set.get(); }
+    
+    void fireAll();
+
+private:
+    explicit ArrayBufferNeuteringWatchpoint(VM&);
+    
+    RefPtr<WatchpointSet> m_set;
+};
+
+} // namespace JSC
diff --git a/runtime/ArrayBufferSharingMode.h b/runtime/ArrayBufferSharingMode.h
new file mode 100644
index 0000000..0dd14c2
--- /dev/null
+++ b/runtime/ArrayBufferSharingMode.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum class ArrayBufferSharingMode {
+    Default,
+    Shared
+};
+
+inline const char* arrayBufferSharingModeName(ArrayBufferSharingMode sharingMode)
+{
+    switch (sharingMode) {
+    case ArrayBufferSharingMode::Default:
+        return "ArrayBuffer";
+    case ArrayBufferSharingMode::Shared:
+        return "SharedArrayBuffer";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::ArrayBufferSharingMode mode)
+{
+    out.print(JSC::arrayBufferSharingModeName(mode));
+}
+
+} // namespace WTF
+
diff --git a/runtime/ArrayBufferView.cpp b/runtime/ArrayBufferView.cpp
new file mode 100644
index 0000000..c0befc4
--- /dev/null
+++ b/runtime/ArrayBufferView.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ArrayBufferView.h"
+
+namespace JSC {
+
+ArrayBufferView::ArrayBufferView(
+    PassRefPtr<ArrayBuffer> buffer,
+    unsigned byteOffset)
+        : m_byteOffset(byteOffset)
+        , m_isNeuterable(true)
+        , m_buffer(buffer)
+{
+    m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_byteOffset) : 0;
+}
+
+ArrayBufferView::~ArrayBufferView()
+{
+    if (!m_isNeuterable)
+        m_buffer->unpin();
+}
+
+void ArrayBufferView::setNeuterable(bool flag)
+{
+    if (flag == m_isNeuterable)
+        return;
+    
+    m_isNeuterable = flag;
+    
+    if (!m_buffer)
+        return;
+    
+    if (flag)
+        m_buffer->unpin();
+    else
+        m_buffer->pin();
+}
+
+} // namespace JSC
diff --git a/runtime/ArrayBufferView.h b/runtime/ArrayBufferView.h
new file mode 100644
index 0000000..55f346e
--- /dev/null
+++ b/runtime/ArrayBufferView.h
@@ -0,0 +1,224 @@
+/*
+ * Copyright (C) 2009, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBuffer.h"
+#include "TypedArrayType.h"
+#include <algorithm>
+#include <limits.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+class JSArrayBufferView;
+class JSGlobalObject;
+class ExecState;
+
+class ArrayBufferView : public RefCounted<ArrayBufferView> {
+public:
+    virtual TypedArrayType getType() const = 0;
+
+    bool isNeutered() const
+    {
+        return !m_buffer || m_buffer->isNeutered();
+    }
+    
+    PassRefPtr<ArrayBuffer> possiblySharedBuffer() const
+    {
+        if (isNeutered())
+            return 0;
+        return m_buffer;
+    }
+    
+    PassRefPtr<ArrayBuffer> unsharedBuffer() const
+    {
+        PassRefPtr<ArrayBuffer> result = possiblySharedBuffer();
+        RELEASE_ASSERT(!result->isShared());
+        return result;
+    }
+    
+    bool isShared() const
+    {
+        if (isNeutered())
+            return false;
+        return m_buffer->isShared();
+    }
+
+    void* baseAddress() const
+    {
+        if (isNeutered())
+            return 0;
+        return m_baseAddress;
+    }
+
+    void* data() const { return baseAddress(); }
+
+    unsigned byteOffset() const
+    {
+        if (isNeutered())
+            return 0;
+        return m_byteOffset;
+    }
+
+    virtual unsigned byteLength() const = 0;
+
+    JS_EXPORT_PRIVATE void setNeuterable(bool flag);
+    bool isNeuterable() const { return m_isNeuterable; }
+
+    JS_EXPORT_PRIVATE virtual ~ArrayBufferView();
+
+    // Helper to verify byte offset is size aligned.
+    static bool verifyByteOffsetAlignment(unsigned byteOffset, size_t size)
+    {
+        return !(byteOffset & (size - 1));
+    }
+
+    // Helper to verify that a given sub-range of an ArrayBuffer is
+    // within range.
+    static bool verifySubRangeLength(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned numElements, size_t size)
+    {
+        unsigned byteLength = buffer->byteLength();
+        if (byteOffset > byteLength)
+            return false;
+        unsigned remainingElements = (byteLength - byteOffset) / size;
+        if (numElements > remainingElements)
+            return false;
+        return true;
+    }
+    
+    virtual JSArrayBufferView* wrap(ExecState*, JSGlobalObject*) = 0;
+    
+protected:
+    JS_EXPORT_PRIVATE ArrayBufferView(PassRefPtr<ArrayBuffer>, unsigned byteOffset);
+
+    inline bool setImpl(ArrayBufferView*, unsigned byteOffset);
+
+    inline bool setRangeImpl(const char* data, size_t dataByteLength, unsigned byteOffset);
+
+    inline bool zeroRangeImpl(unsigned byteOffset, size_t rangeByteLength);
+
+    static inline void calculateOffsetAndLength(
+        int start, int end, unsigned arraySize,
+        unsigned* offset, unsigned* length);
+
+    // Input offset is in number of elements from this array's view;
+    // output offset is in number of bytes from the underlying buffer's view.
+    template <typename T>
+    static void clampOffsetAndNumElements(
+        PassRefPtr<ArrayBuffer> buffer,
+        unsigned arrayByteOffset,
+        unsigned *offset,
+        unsigned *numElements)
+    {
+        unsigned maxOffset = (UINT_MAX - arrayByteOffset) / sizeof(T);
+        if (*offset > maxOffset) {
+            *offset = buffer->byteLength();
+            *numElements = 0;
+            return;
+        }
+        *offset = arrayByteOffset + *offset * sizeof(T);
+        *offset = std::min(buffer->byteLength(), *offset);
+        unsigned remainingElements = (buffer->byteLength() - *offset) / sizeof(T);
+        *numElements = std::min(remainingElements, *numElements);
+    }
+
+    // This is the address of the ArrayBuffer's storage, plus the byte offset.
+    void* m_baseAddress;
+
+    unsigned m_byteOffset : 31;
+    bool m_isNeuterable : 1;
+
+private:
+    friend class ArrayBuffer;
+    RefPtr<ArrayBuffer> m_buffer;
+};
+
+bool ArrayBufferView::setImpl(ArrayBufferView* array, unsigned byteOffset)
+{
+    if (byteOffset > byteLength()
+        || byteOffset + array->byteLength() > byteLength()
+        || byteOffset + array->byteLength() < byteOffset) {
+        // Out of range offset or overflow
+        return false;
+    }
+    
+    char* base = static_cast<char*>(baseAddress());
+    memmove(base + byteOffset, array->baseAddress(), array->byteLength());
+    return true;
+}
+
+bool ArrayBufferView::setRangeImpl(const char* data, size_t dataByteLength, unsigned byteOffset)
+{
+    if (byteOffset > byteLength()
+        || byteOffset + dataByteLength > byteLength()
+        || byteOffset + dataByteLength < byteOffset) {
+        // Out of range offset or overflow
+        return false;
+    }
+    
+    char* base = static_cast<char*>(baseAddress());
+    memmove(base + byteOffset, data, dataByteLength);
+    return true;
+}
+
+bool ArrayBufferView::zeroRangeImpl(unsigned byteOffset, size_t rangeByteLength)
+{
+    if (byteOffset > byteLength()
+        || byteOffset + rangeByteLength > byteLength()
+        || byteOffset + rangeByteLength < byteOffset) {
+        // Out of range offset or overflow
+        return false;
+    }
+    
+    char* base = static_cast<char*>(baseAddress());
+    memset(base + byteOffset, 0, rangeByteLength);
+    return true;
+}
+
+void ArrayBufferView::calculateOffsetAndLength(
+    int start, int end, unsigned arraySize, unsigned* offset, unsigned* length)
+{
+    if (start < 0)
+        start += arraySize;
+    if (start < 0)
+        start = 0;
+    if (end < 0)
+        end += arraySize;
+    if (end < 0)
+        end = 0;
+    if (static_cast<unsigned>(end) > arraySize)
+        end = arraySize;
+    if (end < start)
+        end = start;
+    *offset = static_cast<unsigned>(start);
+    *length = static_cast<unsigned>(end - start);
+}
+
+} // namespace JSC
+
+using JSC::ArrayBufferView;
diff --git a/runtime/ArrayConstructor.cpp b/runtime/ArrayConstructor.cpp
new file mode 100644
index 0000000..77fe5ad
--- /dev/null
+++ b/runtime/ArrayConstructor.cpp
@@ -0,0 +1,164 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007-2008, 2011, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ *
+ */
+
+#include "config.h"
+#include "ArrayConstructor.h"
+
+#include "ArrayPrototype.h"
+#include "ButterflyInlines.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "GetterSetter.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "Lookup.h"
+#include "ProxyObject.h"
+#include "JSCInlines.h"
+
+#include "ArrayConstructor.lut.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ArrayConstructor);
+
+const ClassInfo ArrayConstructor::s_info = { "Function", &InternalFunction::s_info, &arrayConstructorTable, CREATE_METHOD_TABLE(ArrayConstructor) };
+
+/* Source for ArrayConstructor.lut.h
+@begin arrayConstructorTable
+  of        JSBuiltin                   DontEnum|Function 0
+  from      JSBuiltin                   DontEnum|Function 0
+@end
+*/
+
+ArrayConstructor::ArrayConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void ArrayConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, ArrayPrototype* arrayPrototype, GetterSetter* speciesSymbol)
+{
+    Base::finishCreation(vm, arrayPrototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, arrayPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+    putDirectNonIndexAccessor(vm, vm.propertyNames->speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->isArray, arrayConstructorIsArrayCodeGenerator, DontEnum);
+}
+
+// ------------------------------ Functions ---------------------------
+
+JSValue constructArrayWithSizeQuirk(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, JSValue length, JSValue newTarget)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (!length.isNumber()) {
+        scope.release();
+        return constructArrayNegativeIndexed(exec, profile, globalObject, &length, 1, newTarget);
+    }
+    
+    uint32_t n = length.toUInt32(exec);
+    if (n != length.toNumber(exec))
+        return throwException(exec, scope, createRangeError(exec, ASCIILiteral("Array size is not a small enough positive integer.")));
+    scope.release();
+    return constructEmptyArray(exec, profile, globalObject, n, newTarget);
+}
+
+static inline JSValue constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args, JSValue newTarget)
+{
+    JSGlobalObject* globalObject = asInternalFunction(exec->jsCallee())->globalObject();
+
+    // a single numeric argument denotes the array size (!)
+    if (args.size() == 1)
+        return constructArrayWithSizeQuirk(exec, nullptr, globalObject, args.at(0), newTarget);
+
+    // otherwise the array is constructed with the arguments in it
+    return constructArray(exec, nullptr, globalObject, args, newTarget);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructWithArrayConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructArrayWithSizeQuirk(exec, args, exec->newTarget()));
+}
+
+ConstructType ArrayConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWithArrayConstructor;
+    return ConstructType::Host;
+}
+
+static EncodedJSValue JSC_HOST_CALL callArrayConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructArrayWithSizeQuirk(exec, args, JSValue()));
+}
+
+CallType ArrayConstructor::getCallData(JSCell*, CallData& callData)
+{
+    // equivalent to 'new Array(....)'
+    callData.native.function = callArrayConstructor;
+    return CallType::Host;
+}
+
+static ALWAYS_INLINE bool isArraySlowInline(ExecState* exec, ProxyObject* proxy)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    while (true) {
+        if (proxy->isRevoked()) {
+            throwTypeError(exec, scope, ASCIILiteral("Array.isArray cannot be called on a Proxy that has been revoked"));
+            return false;
+        }
+        JSObject* argument = proxy->target();
+
+        if (argument->type() == ArrayType ||  argument->type() == DerivedArrayType)
+            return true;
+
+        if (argument->type() != ProxyObjectType)
+            return false;
+
+        proxy = jsCast<ProxyObject*>(argument);
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+bool isArraySlow(ExecState* exec, ProxyObject* argument)
+{
+    return isArraySlowInline(exec, argument);
+}
+
+// ES6 7.2.2
+// https://tc39.github.io/ecma262/#sec-isarray
+EncodedJSValue JSC_HOST_CALL arrayConstructorPrivateFuncIsArraySlow(ExecState* exec)
+{
+    ASSERT(jsDynamicCast<ProxyObject*>(exec->argument(0)));
+    return JSValue::encode(jsBoolean(isArraySlowInline(exec, jsCast<ProxyObject*>(exec->uncheckedArgument(0)))));
+}
+
+EncodedJSValue JSC_HOST_CALL arrayConstructorPrivateFuncIsArrayConstructor(ExecState* exec)
+{
+    return JSValue::encode(jsBoolean(jsDynamicCast<ArrayConstructor*>(exec->uncheckedArgument(0))));
+}
+
+} // namespace JSC
diff --git a/runtime/ArrayConstructor.h b/runtime/ArrayConstructor.h
new file mode 100644
index 0000000..e8e0478
--- /dev/null
+++ b/runtime/ArrayConstructor.h
@@ -0,0 +1,93 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007-2008, 2011, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+#include "ProxyObject.h"
+#include "ThrowScope.h"
+
+namespace JSC {
+
+class ArrayAllocationProfile;
+class ArrayPrototype;
+class JSArray;
+class GetterSetter;
+
+class ArrayConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = HasStaticPropertyTable | InternalFunction::StructureFlags;
+
+    static ArrayConstructor* create(VM& vm, JSGlobalObject* globalObject, Structure* structure, ArrayPrototype* arrayPrototype, GetterSetter* speciesSymbol)
+    {
+        ArrayConstructor* constructor = new (NotNull, allocateCell<ArrayConstructor>(vm.heap)) ArrayConstructor(vm, structure);
+        constructor->finishCreation(vm, globalObject, arrayPrototype, speciesSymbol);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*, ArrayPrototype*, GetterSetter* speciesSymbol);
+
+private:
+    ArrayConstructor(VM&, Structure*);
+
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+JSValue constructArrayWithSizeQuirk(ExecState*, ArrayAllocationProfile*, JSGlobalObject*, JSValue length, JSValue prototype = JSValue());
+
+EncodedJSValue JSC_HOST_CALL arrayConstructorPrivateFuncIsArrayConstructor(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayConstructorPrivateFuncIsArraySlow(ExecState*);
+bool isArraySlow(ExecState*, ProxyObject* argument);
+
+// ES6 7.2.2
+// https://tc39.github.io/ecma262/#sec-isarray
+inline bool isArray(ExecState* exec, JSValue argumentValue)
+{
+    if (!argumentValue.isObject())
+        return false;
+
+    JSObject* argument = jsCast<JSObject*>(argumentValue);
+    if (argument->type() == ArrayType || argument->type() == DerivedArrayType)
+        return true;
+
+    if (argument->type() != ProxyObjectType)
+        return false;
+    return isArraySlow(exec, jsCast<ProxyObject*>(argument));
+}
+
+inline bool isArrayConstructor(JSValue argumentValue)
+{
+    if (!argumentValue.isObject())
+        return false;
+
+    return jsCast<JSObject*>(argumentValue)->classInfo() == ArrayConstructor::info();
+}
+
+} // namespace JSC
diff --git a/runtime/ArrayConventions.cpp b/runtime/ArrayConventions.cpp
new file mode 100644
index 0000000..69a4789
--- /dev/null
+++ b/runtime/ArrayConventions.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ArrayConventions.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+#if USE(JSVALUE64)
+void clearArrayMemset(WriteBarrier<Unknown>* base, unsigned count)
+{
+#if CPU(X86_64) && COMPILER(GCC_OR_CLANG)
+    uint64_t zero = 0;
+    asm volatile (
+        "rep stosq\n\t"
+        : "+D"(base), "+c"(count)
+        : "a"(zero)
+        : "memory"
+        );
+#else // not CPU(X86_64)
+    memset(base, 0, count * sizeof(WriteBarrier<Unknown>));
+#endif // generic CPU
+}
+
+void clearArrayMemset(double* base, unsigned count)
+{
+#if CPU(X86_64) && COMPILER(GCC_OR_CLANG)
+    uint64_t pnan = bitwise_cast<uint64_t>(PNaN);
+    asm volatile (
+        "rep stosq\n\t"
+        : "+D"(base), "+c"(count)
+        : "a"(pnan)
+        : "memory"
+        );
+#else // not CPU(X86_64)
+    // Oh no, we can't actually do any better than this!
+    for (unsigned i = count; i--;)
+        base[i] = PNaN;
+#endif // generic CPU
+}
+#endif // USE(JSVALUE64)
+
+} // namespace JSC
+
diff --git a/runtime/ArrayConventions.h b/runtime/ArrayConventions.h
new file mode 100644
index 0000000..6aacb97
--- /dev/null
+++ b/runtime/ArrayConventions.h
@@ -0,0 +1,146 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007, 2008, 2009, 2012, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "IndexingHeader.h"
+#include "WriteBarrier.h"
+
+namespace JSC {
+
+// Overview of JSArray
+//
+// Properties of JSArray objects may be stored in one of three locations:
+//   * The regular JSObject property map.
+//   * A storage vector.
+//   * A sparse map of array entries.
+//
+// Properties with non-numeric identifiers, with identifiers that are not representable
+// as an unsigned integer, or where the value is greater than  MAX_ARRAY_INDEX
+// (specifically, this is only one property - the value 0xFFFFFFFFU as an unsigned 32-bit
+// integer) are not considered array indices and will be stored in the JSObject property map.
+//
+// All properties with a numeric identifier, representable as an unsigned integer i,
+// where (i <= MAX_ARRAY_INDEX), are an array index and will be stored in either the
+// storage vector or the sparse map. An array index i will be handled in the following
+// fashion:
+//
+//   * Where (i < MIN_SPARSE_ARRAY_INDEX) the value will be stored in the storage vector,
+//     unless the array is in SparseMode in which case all properties go into the map.
+//   * Where (MIN_SPARSE_ARRAY_INDEX <= i <= MAX_STORAGE_VECTOR_INDEX) the value will either
+//     be stored in the storage vector or in the sparse array, depending on the density of
+//     data that would be stored in the vector (a vector being used where at least
+//     (1 / minDensityMultiplier) of the entries would be populated).
+//   * Where (MAX_STORAGE_VECTOR_INDEX < i <= MAX_ARRAY_INDEX) the value will always be stored
+//     in the sparse array.
+
+// Define the maximum storage vector length to be 2^32 / sizeof(JSValue) / 2 to ensure that
+// there is no risk of overflow.
+#define MAX_STORAGE_VECTOR_LENGTH (static_cast<unsigned>(IndexingHeader::maximumLength))
+
+// These values have to be macros to be used in max() and min() without introducing
+// a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
+
+// If you grow an ArrayStorage array by more than this, then the array will go sparse. Note that we
+// could probably make this smaller (it's large because it used to be conflated with
+// MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH).
+#define MIN_SPARSE_ARRAY_INDEX 100000U
+// If you try to allocate a contiguous array larger than this, then we will allocate an ArrayStorage
+// array instead. We allow for an array that occupies 1GB of VM.
+#define MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH 1024 * 1024 * 1024 / 8
+#define MAX_STORAGE_VECTOR_INDEX (MAX_STORAGE_VECTOR_LENGTH - 1)
+// 0xFFFFFFFF is a bit weird -- is not an array index even though it's an integer.
+#define MAX_ARRAY_INDEX 0xFFFFFFFEU
+
+// The value BASE_XXX_VECTOR_LEN is the maximum number of vector elements we'll allocate
+// for an array that was created with a sepcified length (e.g. a = new Array(123))
+#define BASE_CONTIGUOUS_VECTOR_LEN 3U
+#define BASE_CONTIGUOUS_VECTOR_LEN_EMPTY 5U
+#define BASE_ARRAY_STORAGE_VECTOR_LEN 4U
+
+// The upper bound to the size we'll grow a zero length array when the first element
+// is added.
+#define FIRST_ARRAY_STORAGE_VECTOR_GROW 4U
+
+#define MIN_BEYOND_LENGTH_SPARSE_INDEX 1000
+
+// Our policy for when to use a vector and when to use a sparse map.
+// For all array indices under MIN_SPARSE_ARRAY_INDEX, we always use a vector.
+// When indices greater than MIN_SPARSE_ARRAY_INDEX are involved, we use a vector
+// as long as it is 1/8 full. If more sparse than that, we use a map.
+static const unsigned minDensityMultiplier = 8;
+
+inline bool isDenseEnoughForVector(unsigned length, unsigned numValues)
+{
+    return length / minDensityMultiplier <= numValues;
+}
+
+inline bool indexIsSufficientlyBeyondLengthForSparseMap(unsigned i, unsigned length)
+{
+    return i >= MIN_BEYOND_LENGTH_SPARSE_INDEX && i > length;
+}
+
+inline IndexingHeader indexingHeaderForArrayStorage(unsigned length, unsigned vectorLength)
+{
+    IndexingHeader result;
+    result.setPublicLength(length);
+    result.setVectorLength(vectorLength);
+    return result;
+}
+
+inline IndexingHeader baseIndexingHeaderForArrayStorage(unsigned length)
+{
+    return indexingHeaderForArrayStorage(length, BASE_ARRAY_STORAGE_VECTOR_LEN);
+}
+
+#if USE(JSVALUE64)
+JS_EXPORT_PRIVATE void clearArrayMemset(WriteBarrier<Unknown>* base, unsigned count);
+JS_EXPORT_PRIVATE void clearArrayMemset(double* base, unsigned count);
+#endif // USE(JSVALUE64)
+
+ALWAYS_INLINE void clearArray(WriteBarrier<Unknown>* base, unsigned count)
+{
+#if USE(JSVALUE64)
+    const unsigned minCountForMemset = 100;
+    if (count >= minCountForMemset) {
+        clearArrayMemset(base, count);
+        return;
+    }
+#endif
+    
+    for (unsigned i = count; i--;)
+        base[i].clear();
+}
+
+ALWAYS_INLINE void clearArray(double* base, unsigned count)
+{
+#if USE(JSVALUE64)
+    const unsigned minCountForMemset = 100;
+    if (count >= minCountForMemset) {
+        clearArrayMemset(base, count);
+        return;
+    }
+#endif
+    
+    for (unsigned i = count; i--;)
+        base[i] = PNaN;
+}
+
+} // namespace JSC
diff --git a/runtime/ArrayIteratorAdaptiveWatchpoint.cpp b/runtime/ArrayIteratorAdaptiveWatchpoint.cpp
new file mode 100644
index 0000000..1fc8a7a
--- /dev/null
+++ b/runtime/ArrayIteratorAdaptiveWatchpoint.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ArrayIteratorAdaptiveWatchpoint.h"
+
+#include "JSGlobalObject.h"
+
+namespace JSC {
+
+ArrayIteratorAdaptiveWatchpoint::ArrayIteratorAdaptiveWatchpoint(const ObjectPropertyCondition& condition, JSGlobalObject* globalObject)
+    : Base(condition)
+    , m_globalObject(globalObject)
+{
+    RELEASE_ASSERT(m_globalObject->arrayIteratorProtocolWatchpoint().stateOnJSThread() == IsWatched);
+}
+
+void ArrayIteratorAdaptiveWatchpoint::handleFire(const FireDetail&)
+{
+    m_globalObject->arrayIteratorProtocolWatchpoint().fireAll(m_globalObject->vm(), StringFireDetail("Array iterator protocol changed."));
+}
+
+} // namespace JSC
diff --git a/runtime/ArrayIteratorAdaptiveWatchpoint.h b/runtime/ArrayIteratorAdaptiveWatchpoint.h
new file mode 100644
index 0000000..a45cce2
--- /dev/null
+++ b/runtime/ArrayIteratorAdaptiveWatchpoint.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "AdaptiveInferredPropertyValueWatchpointBase.h"
+
+namespace JSC {
+
+class JSGlobalObject;
+
+class ArrayIteratorAdaptiveWatchpoint : public AdaptiveInferredPropertyValueWatchpointBase {
+public:
+    typedef AdaptiveInferredPropertyValueWatchpointBase Base;
+    ArrayIteratorAdaptiveWatchpoint(const ObjectPropertyCondition&, JSGlobalObject*);
+
+private:
+    void handleFire(const FireDetail&) override;
+
+    JSGlobalObject* m_globalObject;
+};
+
+} // namespace JSC
diff --git a/runtime/ArrayIteratorPrototype.cpp b/runtime/ArrayIteratorPrototype.cpp
new file mode 100644
index 0000000..88957e1
--- /dev/null
+++ b/runtime/ArrayIteratorPrototype.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ArrayIteratorPrototype.h"
+
+#include "ArrayIteratorPrototype.lut.h"
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSCJSValueInlines.h"
+#include "JSCellInlines.h"
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+#include "StructureInlines.h"
+
+namespace JSC {
+
+const ClassInfo ArrayIteratorPrototype::s_info = { "Array Iterator", &Base::s_info, &arrayIteratorPrototypeTable, CREATE_METHOD_TABLE(ArrayIteratorPrototype) };
+
+/* Source for ArrayIteratorPrototype.lut.h
+@begin arrayIteratorPrototypeTable
+  next      JSBuiltin  DontEnum|Function 0
+@end
+*/
+
+void ArrayIteratorPrototype::finishCreation(VM& vm, JSGlobalObject*)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Array Iterator"), DontEnum | ReadOnly);
+    vm.prototypeMap.addPrototype(this);
+}
+
+// ------------------------------ Array Functions ----------------------------
+
+} // namespace JSC
diff --git a/runtime/ArrayIteratorPrototype.h b/runtime/ArrayIteratorPrototype.h
new file mode 100644
index 0000000..b0f0f66
--- /dev/null
+++ b/runtime/ArrayIteratorPrototype.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "IterationKind.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class ArrayIteratorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
+
+    static ArrayIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        ArrayIteratorPrototype* prototype = new (NotNull, allocateCell<ArrayIteratorPrototype>(vm.heap)) ArrayIteratorPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    ArrayIteratorPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespcae JSc
diff --git a/runtime/ArrayPrototype.cpp b/runtime/ArrayPrototype.cpp
new file mode 100644
index 0000000..0542023
--- /dev/null
+++ b/runtime/ArrayPrototype.cpp
@@ -0,0 +1,1441 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007-2009, 2011, 2013, 2015-2017 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ *
+ */
+
+#include "config.h"
+#include "ArrayPrototype.h"
+
+#include "AdaptiveInferredPropertyValueWatchpointBase.h"
+#include "ArrayConstructor.h"
+#include "BuiltinNames.h"
+#include "ButterflyInlines.h"
+#include "CodeBlock.h"
+#include "Error.h"
+#include "GetterSetter.h"
+#include "Interpreter.h"
+#include "JIT.h"
+#include "JSArrayInlines.h"
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSStringBuilder.h"
+#include "JSStringJoiner.h"
+#include "Lookup.h"
+#include "ObjectConstructor.h"
+#include "ObjectPrototype.h"
+#include "Operations.h"
+#include "StringRecursionChecker.h"
+#include <algorithm>
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState*);
+
+// ------------------------------ ArrayPrototype ----------------------------
+
+const ClassInfo ArrayPrototype::s_info = {"Array", &JSArray::s_info, nullptr, CREATE_METHOD_TABLE(ArrayPrototype)};
+
+ArrayPrototype* ArrayPrototype::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    ArrayPrototype* prototype = new (NotNull, allocateCell<ArrayPrototype>(vm.heap)) ArrayPrototype(vm, structure);
+    prototype->finishCreation(vm, globalObject);
+    vm.heap.addFinalizer(prototype, destroy);
+    return prototype;
+}
+
+// ECMA 15.4.4
+ArrayPrototype::ArrayPrototype(VM& vm, Structure* structure)
+    : JSArray(vm, structure, 0)
+{
+}
+
+void ArrayPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->toString, globalObject->arrayProtoToStringFunction(), DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPublicName(), globalObject->arrayProtoValuesFunction(), DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->iteratorSymbol, globalObject->arrayProtoValuesFunction(), DontEnum);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->toLocaleString, arrayProtoFuncToLocaleString, DontEnum, 0);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("concat", arrayPrototypeConcatCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("fill", arrayPrototypeFillCodeGenerator, DontEnum);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->join, arrayProtoFuncJoin, DontEnum, 1);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION("pop", arrayProtoFuncPop, DontEnum, 0, ArrayPopIntrinsic);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().pushPublicName(), arrayProtoFuncPush, DontEnum, 1, ArrayPushIntrinsic);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().pushPrivateName(), arrayProtoFuncPush, DontEnum | DontDelete | ReadOnly, 1, ArrayPushIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("reverse", arrayProtoFuncReverse, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().shiftPublicName(), arrayProtoFuncShift, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().shiftPrivateName(), arrayProtoFuncShift, DontEnum | DontDelete | ReadOnly, 0);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->slice, arrayProtoFuncSlice, DontEnum, 2, ArraySliceIntrinsic);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("sort", arrayPrototypeSortCodeGenerator, DontEnum);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("splice", arrayProtoFuncSplice, DontEnum, 2);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("unshift", arrayProtoFuncUnShift, DontEnum, 1);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("every", arrayPrototypeEveryCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("forEach", arrayPrototypeForEachCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("some", arrayPrototypeSomeCodeGenerator, DontEnum);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("indexOf", arrayProtoFuncIndexOf, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("lastIndexOf", arrayProtoFuncLastIndexOf, DontEnum, 1);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("filter", arrayPrototypeFilterCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("reduce", arrayPrototypeReduceCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("reduceRight", arrayPrototypeReduceRightCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("map", arrayPrototypeMapCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().entriesPublicName(), arrayPrototypeEntriesCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().keysPublicName(), arrayPrototypeKeysCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("find", arrayPrototypeFindCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("findIndex", arrayPrototypeFindIndexCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("includes", arrayPrototypeIncludesCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("copyWithin", arrayPrototypeCopyWithinCodeGenerator, DontEnum);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().entriesPrivateName(), getDirect(vm, vm.propertyNames->builtinNames().entriesPublicName()), ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().forEachPrivateName(), getDirect(vm, vm.propertyNames->builtinNames().forEachPublicName()), ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().keysPrivateName(), getDirect(vm, vm.propertyNames->builtinNames().keysPublicName()), ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPrivateName(), globalObject->arrayProtoValuesFunction(), ReadOnly);
+
+    JSObject* unscopables = constructEmptyObject(globalObject->globalExec(), globalObject->nullPrototypeObjectStructure());
+    const char* unscopableNames[] = {
+        "copyWithin",
+        "entries",
+        "fill",
+        "find",
+        "findIndex",
+        "includes",
+        "keys",
+        "values"
+    };
+    for (const char* unscopableName : unscopableNames)
+        unscopables->putDirect(vm, Identifier::fromString(&vm, unscopableName), jsBoolean(true));
+    putDirectWithoutTransition(vm, vm.propertyNames->unscopablesSymbol, unscopables, DontEnum | ReadOnly);
+}
+
+void ArrayPrototype::destroy(JSC::JSCell* cell)
+{
+    ArrayPrototype* thisObject = static_cast<ArrayPrototype*>(cell);
+    thisObject->ArrayPrototype::~ArrayPrototype();
+}
+
+// ------------------------------ Array Functions ----------------------------
+
+static ALWAYS_INLINE JSValue getProperty(ExecState* exec, JSObject* object, unsigned index)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    if (JSValue result = object->tryGetIndexQuickly(index))
+        return result;
+    // We want to perform get and has in the same operation.
+    // We can only do so when this behavior is not observable. The
+    // only time it is observable is when we encounter an opaque objects (ProxyObject and JSModuleNamespaceObject)
+    // somewhere in the prototype chain.
+    PropertySlot slot(object, PropertySlot::InternalMethodType::HasProperty);
+    bool hasProperty = object->getPropertySlot(exec, index, slot);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (!hasProperty)
+        return { };
+    if (UNLIKELY(slot.isTaintedByOpaqueObject())) {
+        scope.release();
+        return object->get(exec, index);
+    }
+    scope.release();
+    return slot.getValue(exec, index);
+}
+
+static ALWAYS_INLINE bool putLength(ExecState* exec, VM& vm, JSObject* obj, JSValue value)
+{
+    PutPropertySlot slot(obj);
+    return obj->methodTable(vm)->put(obj, exec, vm.propertyNames->length, value, slot);
+}
+
+static ALWAYS_INLINE void setLength(ExecState* exec, VM& vm, JSObject* obj, unsigned value)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    static const bool throwException = true;
+    if (isJSArray(obj)) {
+        jsCast<JSArray*>(obj)->setLength(exec, value, throwException);
+        RETURN_IF_EXCEPTION(scope, void());
+    }
+    bool success = putLength(exec, vm, obj, jsNumber(value));
+    RETURN_IF_EXCEPTION(scope, void());
+    if (UNLIKELY(!success))
+        throwTypeError(exec, scope, ASCIILiteral(ReadonlyPropertyWriteError));
+}
+
+ALWAYS_INLINE bool speciesWatchpointIsValid(ExecState* exec, JSObject* thisObject)
+{
+    JSGlobalObject* globalObject = thisObject->globalObject();
+    ArrayPrototype* arrayPrototype = globalObject->arrayPrototype();
+
+    if (globalObject->arraySpeciesWatchpoint().stateOnJSThread() == ClearWatchpoint) {
+        arrayPrototype->tryInitializeSpeciesWatchpoint(exec);
+        ASSERT(globalObject->arraySpeciesWatchpoint().stateOnJSThread() != ClearWatchpoint);
+    }
+
+    return !thisObject->hasCustomProperties()
+        && arrayPrototype == thisObject->getPrototypeDirect()
+        && globalObject->arraySpeciesWatchpoint().stateOnJSThread() == IsWatched;
+}
+
+enum class SpeciesConstructResult {
+    FastPath,
+    Exception,
+    CreatedObject
+};
+
+static ALWAYS_INLINE std::pair<SpeciesConstructResult, JSObject*> speciesConstructArray(ExecState* exec, JSObject* thisObject, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    auto exceptionResult = [] () {
+        return std::make_pair(SpeciesConstructResult::Exception, nullptr);
+    };
+
+    // ECMA 9.4.2.3: https://tc39.github.io/ecma262/#sec-arrayspeciescreate
+    JSValue constructor = jsUndefined();
+    bool thisIsArray = isArray(exec, thisObject);
+    RETURN_IF_EXCEPTION(scope, exceptionResult());
+    if (LIKELY(thisIsArray)) {
+        // Fast path in the normal case where the user has not set an own constructor and the Array.prototype.constructor is normal.
+        // We need prototype check for subclasses of Array, which are Array objects but have a different prototype by default.
+        bool isValid = speciesWatchpointIsValid(exec, thisObject);
+        if (LIKELY(isValid))
+            return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
+
+        constructor = thisObject->get(exec, vm.propertyNames->constructor);
+        RETURN_IF_EXCEPTION(scope, exceptionResult());
+        if (constructor.isConstructor()) {
+            JSObject* constructorObject = jsCast<JSObject*>(constructor);
+            if (exec->lexicalGlobalObject() != constructorObject->globalObject())
+                return std::make_pair(SpeciesConstructResult::FastPath, nullptr);;
+        }
+        if (constructor.isObject()) {
+            constructor = constructor.get(exec, vm.propertyNames->speciesSymbol);
+            RETURN_IF_EXCEPTION(scope, exceptionResult());
+            if (constructor.isNull())
+                return std::make_pair(SpeciesConstructResult::FastPath, nullptr);;
+        }
+    } else
+        RETURN_IF_EXCEPTION(scope, exceptionResult());
+
+    if (constructor.isUndefined())
+        return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
+
+    MarkedArgumentBuffer args;
+    args.append(jsNumber(length));
+    JSObject* newObject = construct(exec, constructor, args, "Species construction did not get a valid constructor");
+    RETURN_IF_EXCEPTION(scope, exceptionResult());
+    return std::make_pair(SpeciesConstructResult::CreatedObject, newObject);
+}
+
+static inline unsigned argumentClampedIndexFromStartOrEnd(ExecState* exec, int argument, unsigned length, unsigned undefinedValue = 0)
+{
+    JSValue value = exec->argument(argument);
+    if (value.isUndefined())
+        return undefinedValue;
+
+    double indexDouble = value.toInteger(exec);
+    if (indexDouble < 0) {
+        indexDouble += length;
+        return indexDouble < 0 ? 0 : static_cast<unsigned>(indexDouble);
+    }
+    return indexDouble > length ? length : static_cast<unsigned>(indexDouble);
+}
+
+// The shift/unshift function implement the shift/unshift behaviour required
+// by the corresponding array prototype methods, and by splice. In both cases,
+// the methods are operating an an array or array like object.
+//
+//  header  currentCount  (remainder)
+// [------][------------][-----------]
+//  header  resultCount  (remainder)
+// [------][-----------][-----------]
+//
+// The set of properties in the range 'header' must be unchanged. The set of
+// properties in the range 'remainder' (where remainder = length - header -
+// currentCount) will be shifted to the left or right as appropriate; in the
+// case of shift this must be removing values, in the case of unshift this
+// must be introducing new values.
+
+template<JSArray::ShiftCountMode shiftCountMode>
+void shift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    RELEASE_ASSERT(currentCount > resultCount);
+    unsigned count = currentCount - resultCount;
+
+    RELEASE_ASSERT(header <= length);
+    RELEASE_ASSERT(currentCount <= (length - header));
+
+    if (isJSArray(thisObj)) {
+        JSArray* array = asArray(thisObj);
+        if (array->length() == length && array->shiftCount<shiftCountMode>(exec, header, count))
+            return;
+    }
+
+    for (unsigned k = header; k < length - currentCount; ++k) {
+        unsigned from = k + currentCount;
+        unsigned to = k + resultCount;
+        JSValue value = getProperty(exec, thisObj, from);
+        RETURN_IF_EXCEPTION(scope, void());
+        if (value) {
+            thisObj->putByIndexInline(exec, to, value, true);
+            RETURN_IF_EXCEPTION(scope, void());
+        } else {
+            bool success = thisObj->methodTable(vm)->deletePropertyByIndex(thisObj, exec, to);
+            RETURN_IF_EXCEPTION(scope, void());
+            if (!success) {
+                throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+                return;
+            }
+        }
+    }
+    for (unsigned k = length; k > length - count; --k) {
+        bool success = thisObj->methodTable(vm)->deletePropertyByIndex(thisObj, exec, k - 1);
+        RETURN_IF_EXCEPTION(scope, void());
+        if (!success) {
+            throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+            return;
+        }
+    }
+}
+
+template<JSArray::ShiftCountMode shiftCountMode>
+void unshift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    RELEASE_ASSERT(resultCount > currentCount);
+    unsigned count = resultCount - currentCount;
+
+    RELEASE_ASSERT(header <= length);
+    RELEASE_ASSERT(currentCount <= (length - header));
+
+    // Guard against overflow.
+    if (count > (UINT_MAX - length)) {
+        throwOutOfMemoryError(exec, scope);
+        return;
+    }
+
+    if (isJSArray(thisObj)) {
+        JSArray* array = asArray(thisObj);
+        if (array->length() == length) {
+            bool handled = array->unshiftCount<shiftCountMode>(exec, header, count);
+            ASSERT(!scope.exception() || handled);
+            if (handled)
+                return;
+        }
+    }
+
+    for (unsigned k = length - currentCount; k > header; --k) {
+        unsigned from = k + currentCount - 1;
+        unsigned to = k + resultCount - 1;
+        JSValue value = getProperty(exec, thisObj, from);
+        RETURN_IF_EXCEPTION(scope, void());
+        if (value) {
+            thisObj->putByIndexInline(exec, to, value, true);
+            RETURN_IF_EXCEPTION(scope, void());
+        } else {
+            bool success = thisObj->methodTable(vm)->deletePropertyByIndex(thisObj, exec, to);
+            RETURN_IF_EXCEPTION(scope, void());
+            if (UNLIKELY(!success)) {
+                throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+                return;
+            }
+        }
+    }
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+
+    // 1. Let array be the result of calling ToObject on the this value.
+    JSObject* thisObject = thisValue.toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    // 2. Let func be the result of calling the [[Get]] internal method of array with argument "join".
+    JSValue function = JSValue(thisObject).get(exec, vm.propertyNames->join);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 3. If IsCallable(func) is false, then let func be the standard built-in method Object.prototype.toString (15.2.4.2).
+    bool customJoinCase = false;
+    if (!function.isCell())
+        customJoinCase = true;
+    CallData callData;
+    CallType callType = getCallData(function, callData);
+    if (callType == CallType::None)
+        customJoinCase = true;
+
+    if (UNLIKELY(customJoinCase)) {
+        scope.release();
+        return JSValue::encode(jsMakeNontrivialString(exec, "[object ", thisObject->methodTable(vm)->className(thisObject), "]"));
+    }
+
+    // 4. Return the result of calling the [[Call]] internal method of func providing array as the this value and an empty arguments list.
+    if (!isJSArray(thisObject) || callType != CallType::Host || callData.native.function != arrayProtoFuncJoin) {
+        scope.release();
+        return JSValue::encode(call(exec, function, callType, callData, thisObject, exec->emptyList()));
+    }
+
+    ASSERT(isJSArray(thisValue));
+    JSArray* thisArray = asArray(thisValue);
+
+    unsigned length = thisArray->length();
+
+    StringRecursionChecker checker(exec, thisArray);
+    ASSERT(!scope.exception() || checker.earlyReturnValue());
+    if (JSValue earlyReturnValue = checker.earlyReturnValue())
+        return JSValue::encode(earlyReturnValue);
+
+    JSStringJoiner joiner(*exec, ',', length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    for (unsigned i = 0; i < length; ++i) {
+        JSValue element = thisArray->tryGetIndexQuickly(i);
+        if (!element) {
+            element = thisArray->get(exec, i);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        }
+        joiner.append(*exec, element);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    scope.release();
+    return JSValue::encode(joiner.join(*exec));
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+
+    JSObject* thisObject = thisValue.toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    unsigned length = getLength(exec, thisObject);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    StringRecursionChecker checker(exec, thisObject);
+    ASSERT(!scope.exception() || checker.earlyReturnValue());
+    if (JSValue earlyReturnValue = checker.earlyReturnValue())
+        return JSValue::encode(earlyReturnValue);
+
+    JSStringJoiner stringJoiner(*exec, ',', length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+#if ENABLE(INTL)
+    ArgList arguments(exec);
+    for (unsigned i = 0; i < length; ++i) {
+        JSValue element = thisObject->getIndex(exec, i);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (element.isUndefinedOrNull())
+            element = jsEmptyString(exec);
+        else {
+            JSValue conversionFunction = element.get(exec, vm.propertyNames->toLocaleString);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            CallData callData;
+            CallType callType = getCallData(conversionFunction, callData);
+            if (callType != CallType::None) {
+                element = call(exec, conversionFunction, callType, callData, element, arguments);
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            }
+        }
+        stringJoiner.append(*exec, element);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+#else // !ENABLE(INTL)
+    for (unsigned i = 0; i < length; ++i) {
+        JSValue element = thisObject->getIndex(exec, i);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (element.isUndefinedOrNull())
+            continue;
+        JSValue conversionFunction = element.get(exec, vm.propertyNames->toLocaleString);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        CallData callData;
+        CallType callType = getCallData(conversionFunction, callData);
+        if (callType != CallType::None) {
+            element = call(exec, conversionFunction, callType, callData, element, exec->emptyList());
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        }
+        stringJoiner.append(*exec, element);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+#endif // !ENABLE(INTL)
+
+    scope.release();
+    return JSValue::encode(stringJoiner.join(*exec));
+}
+
+static inline bool isHole(double value)
+{
+    return std::isnan(value);
+}
+
+static inline bool isHole(const WriteBarrier<Unknown>& value)
+{
+    return !value;
+}
+
+template<typename T> static inline bool containsHole(T* data, unsigned length)
+{
+    for (unsigned i = 0; i < length; ++i) {
+        if (isHole(data[i]))
+            return true;
+    }
+    return false;
+}
+
+static inline bool holesMustForwardToPrototype(ExecState& state, JSObject* object)
+{
+    auto& vm = state.vm();
+    return object->structure(vm)->holesMustForwardToPrototype(vm);
+}
+
+static JSValue slowJoin(ExecState& exec, JSObject* thisObject, JSString* separator, uint64_t length)
+{
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 5. If len is zero, return the empty String.
+    if (!length)
+        return jsEmptyString(&exec);
+
+    // 6. Let element0 be Get(O, "0").
+    JSValue element0 = thisObject->getIndex(&exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    // 7. If element0 is undefined or null, let R be the empty String; otherwise, let R be ? ToString(element0).
+    JSString* r = nullptr;
+    if (element0.isUndefinedOrNull())
+        r = jsEmptyString(&exec);
+    else
+        r = element0.toString(&exec);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    // 8. Let k be 1.
+    // 9. Repeat, while k < len
+    // 9.e Increase k by 1..
+    for (uint64_t k = 1; k < length; ++k) {
+        // b. Let element be ? Get(O, ! ToString(k)).
+        JSValue element = thisObject->get(&exec, Identifier::fromString(&exec, AtomicString::number(k)));
+        RETURN_IF_EXCEPTION(scope, { });
+
+        // c. If element is undefined or null, let next be the empty String; otherwise, let next be ? ToString(element).
+        JSString* next = nullptr;
+        if (element.isUndefinedOrNull()) {
+            if (!separator->length())
+                continue;
+            next = jsEmptyString(&exec);
+        } else
+            next = element.toString(&exec);
+        RETURN_IF_EXCEPTION(scope, { });
+
+        // a. Let S be the String value produced by concatenating R and sep.
+        // d. Let R be a String value produced by concatenating S and next.
+        r = jsString(&exec, r, separator, next);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    // 10. Return R.
+    return r;
+}
+
+static inline bool canUseFastJoin(const JSObject* thisObject)
+{
+    switch (thisObject->indexingType()) {
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+    case ALL_INT32_INDEXING_TYPES:
+    case ALL_DOUBLE_INDEXING_TYPES:
+        return true;
+    default:
+        break;
+    }
+    return false;
+}
+
+static inline JSValue fastJoin(ExecState& state, JSObject* thisObject, StringView separator, unsigned length)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    switch (thisObject->indexingType()) {
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+    case ALL_INT32_INDEXING_TYPES: {
+        auto& butterfly = *thisObject->butterfly();
+        if (length > butterfly.publicLength())
+            break;
+        JSStringJoiner joiner(state, separator, length);
+        RETURN_IF_EXCEPTION(scope, { });
+        auto data = butterfly.contiguous().data();
+        bool holesKnownToBeOK = false;
+        for (unsigned i = 0; i < length; ++i) {
+            if (JSValue value = data[i].get()) {
+                if (!joiner.appendWithoutSideEffects(state, value))
+                    goto generalCase;
+            } else {
+                if (!holesKnownToBeOK) {
+                    if (holesMustForwardToPrototype(state, thisObject))
+                        goto generalCase;
+                    holesKnownToBeOK = true;
+                }
+                joiner.appendEmptyString();
+            }
+        }
+        scope.release();
+        return joiner.join(state);
+    }
+    case ALL_DOUBLE_INDEXING_TYPES: {
+        auto& butterfly = *thisObject->butterfly();
+        if (length > butterfly.publicLength())
+            break;
+        JSStringJoiner joiner(state, separator, length);
+        RETURN_IF_EXCEPTION(scope, { });
+        auto data = butterfly.contiguousDouble().data();
+        bool holesKnownToBeOK = false;
+        for (unsigned i = 0; i < length; ++i) {
+            double value = data[i];
+            if (!isHole(value))
+                joiner.append(state, jsDoubleNumber(value));
+            else {
+                if (!holesKnownToBeOK) {
+                    if (thisObject->structure(vm)->holesMustForwardToPrototype(vm))
+                        goto generalCase;
+                    holesKnownToBeOK = true;
+                }
+                joiner.appendEmptyString();
+            }
+        }
+        scope.release();
+        return joiner.join(state);
+    }
+    }
+
+generalCase:
+    JSStringJoiner joiner(state, separator, length);
+    RETURN_IF_EXCEPTION(scope, { });
+    for (unsigned i = 0; i < length; ++i) {
+        JSValue element = thisObject->getIndex(&state, i);
+        RETURN_IF_EXCEPTION(scope, { });
+        joiner.append(state, element);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    scope.release();
+    return joiner.join(state);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. Let O be ? ToObject(this value).
+    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    ASSERT(!!scope.exception() == !thisObject);
+    if (UNLIKELY(!thisObject))
+        return encodedJSValue();
+
+    StringRecursionChecker checker(exec, thisObject);
+    ASSERT(!scope.exception() || checker.earlyReturnValue());
+    if (JSValue earlyReturnValue = checker.earlyReturnValue())
+        return JSValue::encode(earlyReturnValue);
+
+    // 2. Let len be ? ToLength(? Get(O, "length")).
+    double length = toLength(exec, thisObject);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 3. If separator is undefined, let separator be the single-element String ",".
+    JSValue separatorValue = exec->argument(0);
+    if (separatorValue.isUndefined()) {
+        const LChar comma = ',';
+
+        if (UNLIKELY(length > std::numeric_limits<unsigned>::max() || !canUseFastJoin(thisObject))) {
+            uint64_t length64 = static_cast<uint64_t>(length);
+            ASSERT(static_cast<double>(length64) == length);
+            JSString* jsSeparator = jsSingleCharacterString(exec, comma);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+            scope.release();
+            return JSValue::encode(slowJoin(*exec, thisObject, jsSeparator, length64));
+        }
+
+        unsigned unsignedLength = static_cast<unsigned>(length);
+        ASSERT(static_cast<double>(unsignedLength) == length);
+
+        scope.release();
+        return JSValue::encode(fastJoin(*exec, thisObject, { &comma, 1 }, unsignedLength));
+    }
+
+    // 4. Let sep be ? ToString(separator).
+    JSString* jsSeparator = separatorValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (UNLIKELY(length > std::numeric_limits<unsigned>::max() || !canUseFastJoin(thisObject))) {
+        uint64_t length64 = static_cast<uint64_t>(length);
+        ASSERT(static_cast<double>(length64) == length);
+
+        scope.release();
+        return JSValue::encode(slowJoin(*exec, thisObject, jsSeparator, length64));
+    }
+
+    auto viewWithString = jsSeparator->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    scope.release();
+    return JSValue::encode(fastJoin(*exec, thisObject, viewWithString.view, length));
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+
+    if (isJSArray(thisValue)) {
+        scope.release();
+        return JSValue::encode(asArray(thisValue)->pop(exec));
+    }
+
+    JSObject* thisObj = thisValue.toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return encodedJSValue();
+    unsigned length = getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (length == 0) {
+        scope.release();
+        putLength(exec, vm, thisObj, jsNumber(length));
+        return JSValue::encode(jsUndefined());
+    }
+
+    JSValue result = thisObj->get(exec, length - 1);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    bool success = thisObj->methodTable(vm)->deletePropertyByIndex(thisObj, exec, length - 1);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (UNLIKELY(!success)) {
+        throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+        return encodedJSValue();
+    }
+    scope.release();
+    putLength(exec, vm, thisObj, jsNumber(length - 1));
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+
+    if (isJSArray(thisValue) && exec->argumentCount() == 1) {
+        JSArray* array = asArray(thisValue);
+        scope.release();
+        array->push(exec, exec->uncheckedArgument(0));
+        return JSValue::encode(jsNumber(array->length()));
+    }
+    
+    JSObject* thisObj = thisValue.toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return encodedJSValue();
+    unsigned length = getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    for (unsigned n = 0; n < exec->argumentCount(); n++) {
+        // Check for integer overflow; where safe we can do a fast put by index.
+        if (length + n >= length)
+            thisObj->methodTable(vm)->putByIndex(thisObj, exec, length + n, exec->uncheckedArgument(n), true);
+        else {
+            PutPropertySlot slot(thisObj);
+            Identifier propertyName = Identifier::fromString(exec, JSValue(static_cast<int64_t>(length) + static_cast<int64_t>(n)).toWTFString(exec));
+            thisObj->methodTable(vm)->put(thisObj, exec, propertyName, exec->uncheckedArgument(n), slot);
+        }
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    
+    JSValue newLength(static_cast<int64_t>(length) + static_cast<int64_t>(exec->argumentCount()));
+    scope.release();
+    putLength(exec, vm, thisObj, newLength);
+    return JSValue::encode(newLength);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    ASSERT(!!scope.exception() == !thisObject);
+    if (UNLIKELY(!thisObject))
+        return encodedJSValue();
+
+    unsigned length = getLength(exec, thisObject);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    switch (thisObject->indexingType()) {
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+    case ALL_INT32_INDEXING_TYPES: {
+        auto& butterfly = *thisObject->butterfly();
+        if (length > butterfly.publicLength())
+            break;
+        auto data = butterfly.contiguous().data();
+        if (containsHole(data, length) && holesMustForwardToPrototype(*exec, thisObject))
+            break;
+        std::reverse(data, data + length);
+        return JSValue::encode(thisObject);
+    }
+    case ALL_DOUBLE_INDEXING_TYPES: {
+        auto& butterfly = *thisObject->butterfly();
+        if (length > butterfly.publicLength())
+            break;
+        auto data = butterfly.contiguousDouble().data();
+        if (containsHole(data, length) && holesMustForwardToPrototype(*exec, thisObject))
+            break;
+        std::reverse(data, data + length);
+        return JSValue::encode(thisObject);
+    }
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+        auto& storage = *thisObject->butterfly()->arrayStorage();
+        if (length > storage.vectorLength())
+            break;
+        if (storage.hasHoles() && holesMustForwardToPrototype(*exec, thisObject))
+            break;
+        auto data = storage.vector().data();
+        std::reverse(data, data + length);
+        return JSValue::encode(thisObject);
+    }
+    }
+
+    unsigned middle = length / 2;
+    for (unsigned lower = 0; lower < middle; lower++) {
+        unsigned upper = length - lower - 1;
+        bool lowerExists = thisObject->hasProperty(exec, lower);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        JSValue lowerValue;
+        if (lowerExists) {
+            lowerValue = thisObject->get(exec, lower);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        }
+
+        bool upperExists = thisObject->hasProperty(exec, upper);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        JSValue upperValue;
+        if (upperExists) {
+            upperValue = thisObject->get(exec, upper);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        }
+
+        if (upperExists) {
+            thisObject->putByIndexInline(exec, lower, upperValue, true);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        } else {
+            bool success = thisObject->methodTable(vm)->deletePropertyByIndex(thisObject, exec, lower);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            if (UNLIKELY(!success)) {
+                throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+                return encodedJSValue();
+            }
+        }
+
+        if (lowerExists) {
+            thisObject->putByIndexInline(exec, upper, lowerValue, true);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        } else {
+            bool success = thisObject->methodTable(vm)->deletePropertyByIndex(thisObject, exec, upper);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            if (UNLIKELY(!success)) {
+                throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+                return encodedJSValue();
+            }
+        }
+    }
+    return JSValue::encode(thisObject);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return encodedJSValue();
+    unsigned length = getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (length == 0) {
+        scope.release();
+        putLength(exec, vm, thisObj, jsNumber(length));
+        return JSValue::encode(jsUndefined());
+    }
+
+    JSValue result = thisObj->getIndex(exec, 0);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    shift<JSArray::ShiftCountForShift>(exec, thisObj, 0, 1, 0, length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    putLength(exec, vm, thisObj, jsNumber(length - 1));
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec)
+{
+    // https://tc39.github.io/ecma262/#sec-array.prototype.slice
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return { };
+    unsigned length = getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, length);
+    RETURN_IF_EXCEPTION(scope, { });
+    unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, length, length);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    std::pair<SpeciesConstructResult, JSObject*> speciesResult = speciesConstructArray(exec, thisObj, end - begin);
+    // We can only get an exception if we call some user function.
+    ASSERT(!!scope.exception() == (speciesResult.first == SpeciesConstructResult::Exception));
+    if (UNLIKELY(speciesResult.first == SpeciesConstructResult::Exception))
+        return { };
+
+    bool okToDoFastPath = speciesResult.first == SpeciesConstructResult::FastPath && isJSArray(thisObj) && length == getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, { });
+    if (LIKELY(okToDoFastPath)) {
+        if (JSArray* result = asArray(thisObj)->fastSlice(*exec, begin, end - begin))
+            return JSValue::encode(result);
+    }
+
+    JSObject* result;
+    if (speciesResult.first == SpeciesConstructResult::CreatedObject)
+        result = speciesResult.second;
+    else {
+        result = constructEmptyArray(exec, nullptr, end - begin);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+
+    unsigned n = 0;
+    for (unsigned k = begin; k < end; k++, n++) {
+        JSValue v = getProperty(exec, thisObj, k);
+        RETURN_IF_EXCEPTION(scope, { });
+        if (v) {
+            result->putDirectIndex(exec, n, v, 0, PutDirectIndexShouldThrow);
+            RETURN_IF_EXCEPTION(scope, { });
+        }
+    }
+    scope.release();
+    setLength(exec, vm, result, n);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec)
+{
+    // 15.4.4.12
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return encodedJSValue();
+    unsigned length = getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (!exec->argumentCount()) {
+        std::pair<SpeciesConstructResult, JSObject*> speciesResult = speciesConstructArray(exec, thisObj, 0);
+        ASSERT(!!scope.exception() == (speciesResult.first == SpeciesConstructResult::Exception));
+        if (UNLIKELY(speciesResult.first == SpeciesConstructResult::Exception))
+            return encodedJSValue();
+
+        JSObject* result;
+        if (speciesResult.first == SpeciesConstructResult::CreatedObject)
+            result = speciesResult.second;
+        else {
+            result = constructEmptyArray(exec, nullptr);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        }
+
+        setLength(exec, vm, result, 0);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        scope.release();
+        setLength(exec, vm, thisObj, length);
+        return JSValue::encode(result);
+    }
+
+    unsigned actualStart = argumentClampedIndexFromStartOrEnd(exec, 0, length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    unsigned actualDeleteCount = length - actualStart;
+    if (exec->argumentCount() > 1) {
+        double deleteCount = exec->uncheckedArgument(1).toInteger(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (deleteCount < 0)
+            actualDeleteCount = 0;
+        else if (deleteCount > length - actualStart)
+            actualDeleteCount = length - actualStart;
+        else
+            actualDeleteCount = static_cast<unsigned>(deleteCount);
+    }
+
+    std::pair<SpeciesConstructResult, JSObject*> speciesResult = speciesConstructArray(exec, thisObj, actualDeleteCount);
+    ASSERT(!!scope.exception() == (speciesResult.first == SpeciesConstructResult::Exception));
+    if (speciesResult.first == SpeciesConstructResult::Exception)
+        return JSValue::encode(jsUndefined());
+
+    JSObject* result = nullptr;
+    bool okToDoFastPath = speciesResult.first == SpeciesConstructResult::FastPath && isJSArray(thisObj) && length == getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (LIKELY(okToDoFastPath))
+        result = asArray(thisObj)->fastSlice(*exec, actualStart, actualDeleteCount);
+
+    if (!result) {
+        if (speciesResult.first == SpeciesConstructResult::CreatedObject) {
+            result = speciesResult.second;
+            
+            for (unsigned k = 0; k < actualDeleteCount; ++k) {
+                JSValue v = getProperty(exec, thisObj, k + actualStart);
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+                if (UNLIKELY(!v))
+                    continue;
+                result->putByIndexInline(exec, k, v, true);
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            }
+        } else {
+            result = JSArray::tryCreateUninitialized(vm, exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), actualDeleteCount);
+            if (!result)
+                return JSValue::encode(throwOutOfMemoryError(exec, scope));
+            
+            for (unsigned k = 0; k < actualDeleteCount; ++k) {
+                JSValue v = getProperty(exec, thisObj, k + actualStart);
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+                if (UNLIKELY(!v))
+                    continue;
+                result->initializeIndex(vm, k, v);
+            }
+        }
+    }
+
+    unsigned itemCount = std::max<int>(exec->argumentCount() - 2, 0);
+    if (itemCount < actualDeleteCount) {
+        shift<JSArray::ShiftCountForSplice>(exec, thisObj, actualStart, actualDeleteCount, itemCount, length);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    } else if (itemCount > actualDeleteCount) {
+        unshift<JSArray::ShiftCountForSplice>(exec, thisObj, actualStart, actualDeleteCount, itemCount, length);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    for (unsigned k = 0; k < itemCount; ++k) {
+        thisObj->putByIndexInline(exec, k + actualStart, exec->uncheckedArgument(k + 2), true);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    
+    scope.release();
+    setLength(exec, vm, thisObj, length - actualDeleteCount + itemCount);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 15.4.4.13
+
+    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return encodedJSValue();
+    unsigned length = getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    unsigned nrArgs = exec->argumentCount();
+    if (nrArgs) {
+        unshift<JSArray::ShiftCountForShift>(exec, thisObj, 0, 0, nrArgs, length);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    for (unsigned k = 0; k < nrArgs; ++k) {
+        thisObj->putByIndexInline(exec, k, exec->uncheckedArgument(k), true);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    JSValue result = jsNumber(length + nrArgs);
+    scope.release();
+    putLength(exec, vm, thisObj, result);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 15.4.4.14
+    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return encodedJSValue();
+    unsigned length = getLength(exec, thisObj);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
+    JSValue searchElement = exec->argument(0);
+    for (; index < length; ++index) {
+        JSValue e = getProperty(exec, thisObj, index);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (!e)
+            continue;
+        if (JSValue::strictEqual(exec, searchElement, e))
+            return JSValue::encode(jsNumber(index));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    return JSValue::encode(jsNumber(-1));
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 15.4.4.15
+    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return encodedJSValue();
+    unsigned length = getLength(exec, thisObj);
+    if (UNLIKELY(scope.exception()) || !length)
+        return JSValue::encode(jsNumber(-1));
+
+    unsigned index = length - 1;
+    if (exec->argumentCount() >= 2) {
+        JSValue fromValue = exec->uncheckedArgument(1);
+        double fromDouble = fromValue.toInteger(exec);
+        if (fromDouble < 0) {
+            fromDouble += length;
+            if (fromDouble < 0)
+                return JSValue::encode(jsNumber(-1));
+        }
+        if (fromDouble < length)
+            index = static_cast<unsigned>(fromDouble);
+    }
+
+    JSValue searchElement = exec->argument(0);
+    do {
+        RELEASE_ASSERT(index < length);
+        JSValue e = getProperty(exec, thisObj, index);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (!e)
+            continue;
+        if (JSValue::strictEqual(exec, searchElement, e))
+            return JSValue::encode(jsNumber(index));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    } while (index--);
+
+    return JSValue::encode(jsNumber(-1));
+}
+
+static bool moveElements(ExecState* exec, VM& vm, JSArray* target, unsigned targetOffset, JSArray* source, unsigned sourceLength)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (LIKELY(!hasAnyArrayStorage(source->indexingType()) && !source->structure()->holesMustForwardToPrototype(vm))) {
+        for (unsigned i = 0; i < sourceLength; ++i) {
+            JSValue value = source->tryGetIndexQuickly(i);
+            if (value) {
+                target->putDirectIndex(exec, targetOffset + i, value, 0, PutDirectIndexShouldThrow);
+                RETURN_IF_EXCEPTION(scope, false);
+            }
+        }
+    } else {
+        for (unsigned i = 0; i < sourceLength; ++i) {
+            JSValue value = getProperty(exec, source, i);
+            RETURN_IF_EXCEPTION(scope, false);
+            if (value) {
+                target->putDirectIndex(exec, targetOffset + i, value, 0, PutDirectIndexShouldThrow);
+                RETURN_IF_EXCEPTION(scope, false);
+            }
+        }
+    }
+    return true;
+}
+
+static EncodedJSValue concatAppendOne(ExecState* exec, VM& vm, JSArray* first, JSValue second)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT(!isJSArray(second));
+    ASSERT(!shouldUseSlowPut(first->indexingType()));
+    Butterfly* firstButterfly = first->butterfly();
+    unsigned firstArraySize = firstButterfly->publicLength();
+
+    IndexingType type = first->mergeIndexingTypeForCopying(indexingTypeForValue(second) | IsArray);
+    
+    if (type == NonArray)
+        type = first->indexingType();
+
+    Structure* resultStructure = exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(type);
+    JSArray* result = JSArray::create(vm, resultStructure, firstArraySize + 1);
+    if (!result)
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
+
+    bool success = result->appendMemcpy(exec, vm, 0, first);
+    ASSERT(!success || !scope.exception());
+    if (!success) {
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+        bool success = moveElements(exec, vm, result, 0, first, firstArraySize);
+        ASSERT(!scope.exception() == success);
+        if (UNLIKELY(!success))
+            return encodedJSValue();
+    }
+
+    scope.release();
+    result->putDirectIndex(exec, firstArraySize, second);
+    return JSValue::encode(result);
+
+}
+
+
+EncodedJSValue JSC_HOST_CALL arrayProtoPrivateFuncConcatMemcpy(ExecState* exec)
+{
+    ASSERT(exec->argumentCount() == 2);
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSArray* firstArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
+    
+    // This code assumes that neither array has set Symbol.isConcatSpreadable. If the first array
+    // has indexed accessors then one of those accessors might change the value of Symbol.isConcatSpreadable
+    // on the second argument.
+    if (UNLIKELY(shouldUseSlowPut(firstArray->indexingType())))
+        return JSValue::encode(jsNull());
+
+    // We need to check the species constructor here since checking it in the JS wrapper is too expensive for the non-optimizing tiers.
+    bool isValid = speciesWatchpointIsValid(exec, firstArray);
+    if (UNLIKELY(!isValid))
+        return JSValue::encode(jsNull());
+
+    JSValue second = exec->uncheckedArgument(1);
+    if (!isJSArray(second)) {
+        scope.release();
+        return concatAppendOne(exec, vm, firstArray, second);
+    }
+
+    JSArray* secondArray = jsCast<JSArray*>(second);
+    
+    Butterfly* firstButterfly = firstArray->butterfly();
+    Butterfly* secondButterfly = secondArray->butterfly();
+
+    unsigned firstArraySize = firstButterfly->publicLength();
+    unsigned secondArraySize = secondButterfly->publicLength();
+
+    IndexingType secondType = secondArray->indexingType();
+    IndexingType type = firstArray->mergeIndexingTypeForCopying(secondType);
+    if (type == NonArray || !firstArray->canFastCopy(vm, secondArray) || firstArraySize + secondArraySize >= MIN_SPARSE_ARRAY_INDEX) {
+        JSArray* result = constructEmptyArray(exec, nullptr, firstArraySize + secondArraySize);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+        bool success = moveElements(exec, vm, result, 0, firstArray, firstArraySize);
+        ASSERT(!scope.exception() == success);
+        if (UNLIKELY(!success))
+            return encodedJSValue();
+        success = moveElements(exec, vm, result, firstArraySize, secondArray, secondArraySize);
+        ASSERT(!scope.exception() == success);
+        if (UNLIKELY(!success))
+            return encodedJSValue();
+
+        return JSValue::encode(result);
+    }
+
+    Structure* resultStructure = exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(type);
+    JSArray* result = JSArray::tryCreateUninitialized(vm, resultStructure, firstArraySize + secondArraySize);
+    if (!result)
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
+    
+    if (type == ArrayWithDouble) {
+        double* buffer = result->butterfly()->contiguousDouble().data();
+        memcpy(buffer, firstButterfly->contiguousDouble().data(), sizeof(JSValue) * firstArraySize);
+        memcpy(buffer + firstArraySize, secondButterfly->contiguousDouble().data(), sizeof(JSValue) * secondArraySize);
+    } else if (type != ArrayWithUndecided) {
+        WriteBarrier<Unknown>* buffer = result->butterfly()->contiguous().data();
+        memcpy(buffer, firstButterfly->contiguous().data(), sizeof(JSValue) * firstArraySize);
+        if (secondType != ArrayWithUndecided)
+            memcpy(buffer + firstArraySize, secondButterfly->contiguous().data(), sizeof(JSValue) * secondArraySize);
+        else {
+            for (unsigned i = secondArraySize; i--;)
+                buffer[i + firstArraySize].clear();
+        }
+    }
+
+    result->butterfly()->setPublicLength(firstArraySize + secondArraySize);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL arrayProtoPrivateFuncAppendMemcpy(ExecState* exec)
+{
+    ASSERT(exec->argumentCount() == 3);
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSArray* resultArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
+    JSArray* otherArray = jsCast<JSArray*>(exec->uncheckedArgument(1));
+    JSValue startValue = exec->uncheckedArgument(2);
+    ASSERT(startValue.isAnyInt() && startValue.asAnyInt() >= 0 && startValue.asAnyInt() <= std::numeric_limits<unsigned>::max());
+    unsigned startIndex = static_cast<unsigned>(startValue.asAnyInt());
+    bool success = resultArray->appendMemcpy(exec, vm, startIndex, otherArray);
+    ASSERT(!success || !scope.exception());
+    if (!success) {
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        moveElements(exec, vm, resultArray, startIndex, otherArray, otherArray->length());
+    }
+    return JSValue::encode(jsUndefined());
+}
+
+
+// -------------------- ArrayPrototype.constructor Watchpoint ------------------
+
+static bool verbose = false;
+
+class ArrayPrototypeAdaptiveInferredPropertyWatchpoint : public AdaptiveInferredPropertyValueWatchpointBase {
+public:
+    typedef AdaptiveInferredPropertyValueWatchpointBase Base;
+    ArrayPrototypeAdaptiveInferredPropertyWatchpoint(const ObjectPropertyCondition&, ArrayPrototype*);
+
+private:
+    void handleFire(const FireDetail&) override;
+
+    ArrayPrototype* m_arrayPrototype;
+};
+
+void ArrayPrototype::tryInitializeSpeciesWatchpoint(ExecState* exec)
+{
+    VM& vm = exec->vm();
+
+    RELEASE_ASSERT(!m_constructorWatchpoint);
+    RELEASE_ASSERT(!m_constructorSpeciesWatchpoint);
+
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (verbose)
+        dataLog("Initializing Array species watchpoints for Array.prototype: ", pointerDump(this), " with structure: ", pointerDump(this->structure()), "\nand Array: ", pointerDump(this->globalObject()->arrayConstructor()), " with structure: ", pointerDump(this->globalObject()->arrayConstructor()->structure()), "\n");
+    // First we need to make sure that the Array.prototype.constructor property points to Array
+    // and that Array[Symbol.species] is the primordial GetterSetter.
+
+    // We only initialize once so flattening the structures does not have any real cost.
+    Structure* prototypeStructure = this->structure(vm);
+    if (prototypeStructure->isDictionary())
+        prototypeStructure = prototypeStructure->flattenDictionaryStructure(vm, this);
+    RELEASE_ASSERT(!prototypeStructure->isDictionary());
+
+    JSGlobalObject* globalObject = this->globalObject();
+    ArrayConstructor* arrayConstructor = globalObject->arrayConstructor();
+
+    auto invalidateWatchpoint = [&] {
+        globalObject->arraySpeciesWatchpoint().invalidate(vm, StringFireDetail("Was not able to set up array species watchpoint."));
+    };
+
+    PropertySlot constructorSlot(this, PropertySlot::InternalMethodType::VMInquiry);
+    this->getOwnPropertySlot(this, exec, vm.propertyNames->constructor, constructorSlot);
+    ASSERT_UNUSED(scope, !scope.exception());
+    if (constructorSlot.slotBase() != this
+        || !constructorSlot.isCacheableValue()
+        || constructorSlot.getValue(exec, vm.propertyNames->constructor) != arrayConstructor) {
+        invalidateWatchpoint();
+        return;
+    }
+
+    Structure* constructorStructure = arrayConstructor->structure(vm);
+    if (constructorStructure->isDictionary())
+        constructorStructure = constructorStructure->flattenDictionaryStructure(vm, arrayConstructor);
+
+    PropertySlot speciesSlot(arrayConstructor, PropertySlot::InternalMethodType::VMInquiry);
+    arrayConstructor->getOwnPropertySlot(arrayConstructor, exec, vm.propertyNames->speciesSymbol, speciesSlot);
+    ASSERT_UNUSED(scope, !scope.exception());
+    if (speciesSlot.slotBase() != arrayConstructor
+        || !speciesSlot.isCacheableGetter()
+        || speciesSlot.getterSetter() != globalObject->speciesGetterSetter()) {
+        invalidateWatchpoint();
+        return;
+    }
+
+    // Now we need to setup the watchpoints to make sure these conditions remain valid.
+    prototypeStructure->startWatchingPropertyForReplacements(vm, constructorSlot.cachedOffset());
+    constructorStructure->startWatchingPropertyForReplacements(vm, speciesSlot.cachedOffset());
+
+    ObjectPropertyCondition constructorCondition = ObjectPropertyCondition::equivalence(vm, this, this, vm.propertyNames->constructor.impl(), arrayConstructor);
+    ObjectPropertyCondition speciesCondition = ObjectPropertyCondition::equivalence(vm, this, arrayConstructor, vm.propertyNames->speciesSymbol.impl(), globalObject->speciesGetterSetter());
+
+    if (!constructorCondition.isWatchable() || !speciesCondition.isWatchable()) {
+        invalidateWatchpoint();
+        return;
+    }
+
+    m_constructorWatchpoint = std::make_unique<ArrayPrototypeAdaptiveInferredPropertyWatchpoint>(constructorCondition, this);
+    m_constructorWatchpoint->install();
+
+    m_constructorSpeciesWatchpoint = std::make_unique<ArrayPrototypeAdaptiveInferredPropertyWatchpoint>(speciesCondition, this);
+    m_constructorSpeciesWatchpoint->install();
+
+    // We only watch this from the DFG, and the DFG makes sure to only start watching if the watchpoint is in the IsWatched state.
+    RELEASE_ASSERT(!globalObject->arraySpeciesWatchpoint().isBeingWatched()); 
+    globalObject->arraySpeciesWatchpoint().touch(vm, "Set up array species watchpoint.");
+}
+
+ArrayPrototypeAdaptiveInferredPropertyWatchpoint::ArrayPrototypeAdaptiveInferredPropertyWatchpoint(const ObjectPropertyCondition& key, ArrayPrototype* prototype)
+    : Base(key)
+    , m_arrayPrototype(prototype)
+{
+}
+
+void ArrayPrototypeAdaptiveInferredPropertyWatchpoint::handleFire(const FireDetail& detail)
+{
+    StringPrintStream out;
+    out.print("ArrayPrototype adaption of ", key(), " failed: ", detail);
+
+    StringFireDetail stringDetail(out.toCString().data());
+
+    if (verbose)
+        WTF::dataLog(stringDetail, "\n");
+
+    JSGlobalObject* globalObject = m_arrayPrototype->globalObject();
+    globalObject->arraySpeciesWatchpoint().fireAll(globalObject->vm(), stringDetail);
+}
+
+} // namespace JSC
diff --git a/runtime/ArrayPrototype.h b/runtime/ArrayPrototype.h
new file mode 100644
index 0000000..a75cd5c
--- /dev/null
+++ b/runtime/ArrayPrototype.h
@@ -0,0 +1,73 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007, 2011, 2015 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSArray.h"
+#include "Lookup.h"
+
+namespace JSC {
+
+class ArrayPrototypeAdaptiveInferredPropertyWatchpoint;
+
+class ArrayPrototype : public JSArray {
+private:
+    ArrayPrototype(VM&, Structure*);
+
+public:
+    typedef JSArray Base;
+
+    enum class SpeciesWatchpointStatus {
+        Uninitialized,
+        Initialized,
+        Fired
+    };
+
+    static ArrayPrototype* create(VM&, JSGlobalObject*, Structure*);
+        
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(DerivedArrayType, StructureFlags), info(), ArrayClass);
+    }
+
+    void tryInitializeSpeciesWatchpoint(ExecState*);
+
+    static const bool needsDestruction = false;
+    // We don't need destruction since we use a finalizer.
+    static void destroy(JSC::JSCell*);
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+
+private:
+    // This bit is set if any user modifies the constructor property Array.prototype. This is used to optimize species creation for JSArrays.
+    friend ArrayPrototypeAdaptiveInferredPropertyWatchpoint;
+    std::unique_ptr<ArrayPrototypeAdaptiveInferredPropertyWatchpoint> m_constructorWatchpoint;
+    std::unique_ptr<ArrayPrototypeAdaptiveInferredPropertyWatchpoint> m_constructorSpeciesWatchpoint;
+};
+
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoFuncValues(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoPrivateFuncConcatMemcpy(ExecState*);
+EncodedJSValue JSC_HOST_CALL arrayProtoPrivateFuncAppendMemcpy(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/ArrayStorage.h b/runtime/ArrayStorage.h
new file mode 100644
index 0000000..c4e596d
--- /dev/null
+++ b/runtime/ArrayStorage.h
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayConventions.h"
+#include "Butterfly.h"
+#include "IndexingHeader.h"
+#include "MarkedSpace.h"
+#include "SparseArrayValueMap.h"
+#include "Structure.h"
+#include "WriteBarrier.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+// This struct holds the actual data values of an array. A JSArray object points to its contained ArrayStorage
+// struct by pointing to m_vector. To access the contained ArrayStorage struct, use the getStorage() and 
+// setStorage() methods. It is important to note that there may be space before the ArrayStorage that 
+// is used to quick unshift / shift operation. The actual allocated pointer is available by using:
+//     getStorage() - m_indexBias * sizeof(JSValue)
+// All slots in ArrayStorage (slots from 0 to vectorLength) are expected to be initialized to a JSValue or,
+// for hole slots, JSValue().
+struct ArrayStorage {
+    WTF_MAKE_NONCOPYABLE(ArrayStorage);
+private:
+    ArrayStorage() { } // Not directly instantiable. Can only be created as part of a Butterfly.
+public:
+    
+    static ArrayStorage* from(Butterfly* butterfly) { return reinterpret_cast_ptr<ArrayStorage*>(butterfly); }
+    static ArrayStorage* from(IndexingHeader* indexingHeader) { return indexingHeader->arrayStorage(); }
+    
+    Butterfly* butterfly() { return reinterpret_cast<Butterfly*>(this); }
+    IndexingHeader* indexingHeader() { return IndexingHeader::from(this); }
+    const IndexingHeader* indexingHeader() const { return IndexingHeader::from(this); }
+    
+    // We steal two fields from the indexing header: vectorLength and length.
+    unsigned length() const { return indexingHeader()->publicLength(); }
+    void setLength(unsigned length) { indexingHeader()->setPublicLength(length); }
+    unsigned vectorLength() const { return indexingHeader()->vectorLength(); }
+    void setVectorLength(unsigned length) { indexingHeader()->setVectorLength(length); }
+    
+    ALWAYS_INLINE void copyHeaderFromDuringGC(const ArrayStorage& other)
+    {
+        m_sparseMap.copyFrom(other.m_sparseMap);
+        m_indexBias = other.m_indexBias;
+        m_numValuesInVector = other.m_numValuesInVector;
+    }
+    
+    bool hasHoles() const
+    {
+        return m_numValuesInVector != length();
+    }   
+
+    bool inSparseMode()
+    {
+        return m_sparseMap && m_sparseMap->sparseMode();
+    }
+
+    ContiguousJSValues vector() { return ContiguousJSValues(m_vector, vectorLength()); }
+
+    WriteBarrier<SparseArrayValueMap> m_sparseMap;
+    unsigned m_indexBias;
+    unsigned m_numValuesInVector;
+#if USE(JSVALUE32_64)
+    uintptr_t m_padding;
+#endif
+    WriteBarrier<Unknown> m_vector[1];
+    
+    static ptrdiff_t lengthOffset() { return Butterfly::offsetOfPublicLength(); }
+    static ptrdiff_t vectorLengthOffset() { return Butterfly::offsetOfVectorLength(); }
+    static ptrdiff_t numValuesInVectorOffset() { return OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector); }
+    static ptrdiff_t vectorOffset() { return OBJECT_OFFSETOF(ArrayStorage, m_vector); }
+    static ptrdiff_t indexBiasOffset() { return OBJECT_OFFSETOF(ArrayStorage, m_indexBias); }
+    static ptrdiff_t sparseMapOffset() { return OBJECT_OFFSETOF(ArrayStorage, m_sparseMap); }
+    
+    static size_t sizeFor(unsigned vectorLength)
+    {
+        return ArrayStorage::vectorOffset() + vectorLength * sizeof(WriteBarrier<Unknown>);
+    }
+    
+    static size_t totalSizeFor(unsigned indexBias, size_t propertyCapacity, unsigned vectorLength)
+    {
+        return Butterfly::totalSize(indexBias, propertyCapacity, true, sizeFor(vectorLength));
+    }
+    
+    size_t totalSize(size_t propertyCapacity) const
+    {
+        return totalSizeFor(m_indexBias, propertyCapacity, vectorLength());
+    }
+    
+    size_t totalSize(Structure* structure) const
+    {
+        return totalSize(structure->outOfLineCapacity());
+    }
+    
+    static unsigned availableVectorLength(unsigned indexBias, size_t propertyCapacity, unsigned vectorLength)
+    {
+        size_t cellSize = MarkedSpace::optimalSizeFor(totalSizeFor(indexBias, propertyCapacity, vectorLength));
+        
+        vectorLength = (cellSize - totalSizeFor(indexBias, propertyCapacity, 0)) / sizeof(WriteBarrier<Unknown>);
+
+        return vectorLength;
+    }
+    
+    static unsigned availableVectorLength(unsigned indexBias, Structure* structure, unsigned vectorLength)
+    {
+        return availableVectorLength(indexBias, structure->outOfLineCapacity(), vectorLength);
+    }
+    
+    unsigned availableVectorLength(size_t propertyCapacity, unsigned vectorLength)
+    {
+        return availableVectorLength(m_indexBias, propertyCapacity, vectorLength);
+    }
+    
+    unsigned availableVectorLength(Structure* structure, unsigned vectorLength)
+    {
+        return availableVectorLength(structure->outOfLineCapacity(), vectorLength);
+    }
+
+    static unsigned optimalVectorLength(unsigned indexBias, size_t propertyCapacity, unsigned vectorLength)
+    {
+        vectorLength = std::max(BASE_ARRAY_STORAGE_VECTOR_LEN, vectorLength);
+        return availableVectorLength(indexBias, propertyCapacity, vectorLength);
+    }
+    
+    static unsigned optimalVectorLength(unsigned indexBias, Structure* structure, unsigned vectorLength)
+    {
+        return optimalVectorLength(indexBias, structure->outOfLineCapacity(), vectorLength);
+    }
+    
+    unsigned optimalVectorLength(size_t propertyCapacity, unsigned vectorLength)
+    {
+        return optimalVectorLength(m_indexBias, propertyCapacity, vectorLength);
+    }
+    
+    unsigned optimalVectorLength(Structure* structure, unsigned vectorLength)
+    {
+        return optimalVectorLength(structure->outOfLineCapacity(), vectorLength);
+    }
+};
+
+} // namespace JSC
diff --git a/runtime/AsyncFunctionConstructor.cpp b/runtime/AsyncFunctionConstructor.cpp
new file mode 100644
index 0000000..67840a8
--- /dev/null
+++ b/runtime/AsyncFunctionConstructor.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2016 Caitlin Potter <caitp@igalia.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AsyncFunctionConstructor.h"
+
+#include "AsyncFunctionPrototype.h"
+#include "FunctionConstructor.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(AsyncFunctionConstructor);
+
+const ClassInfo AsyncFunctionConstructor::s_info = { "AsyncFunction", &Base::s_info, nullptr, CREATE_METHOD_TABLE(AsyncFunctionConstructor) };
+
+AsyncFunctionConstructor::AsyncFunctionConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void AsyncFunctionConstructor::finishCreation(VM& vm, AsyncFunctionPrototype* prototype)
+{
+    Base::finishCreation(vm, "AsyncFunction");
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+
+    // Number of arguments for constructor
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum);
+}
+
+static EncodedJSValue JSC_HOST_CALL callAsyncFunctionConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->jsCallee())->globalObject(), args, FunctionConstructionMode::Async));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructAsyncFunctionConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->jsCallee())->globalObject(), args, FunctionConstructionMode::Async));
+}
+
+CallType AsyncFunctionConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callAsyncFunctionConstructor;
+    return CallType::Host;
+}
+
+ConstructType AsyncFunctionConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructAsyncFunctionConstructor;
+    return ConstructType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/AsyncFunctionConstructor.h b/runtime/AsyncFunctionConstructor.h
new file mode 100644
index 0000000..035a2c1
--- /dev/null
+++ b/runtime/AsyncFunctionConstructor.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 Caitlin Potter <caitp@igalia.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class AsyncFunctionPrototype;
+
+class AsyncFunctionConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    DECLARE_INFO;
+
+    static AsyncFunctionConstructor* create(VM& vm, Structure* structure, AsyncFunctionPrototype* asyncFunctionPrototype)
+    {
+        AsyncFunctionConstructor* constructor = new (NotNull, allocateCell<AsyncFunctionConstructor>(vm.heap)) AsyncFunctionConstructor(vm, structure);
+        constructor->finishCreation(vm, asyncFunctionPrototype);
+        return constructor;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    AsyncFunctionConstructor(VM&, Structure*);
+    void finishCreation(VM&, AsyncFunctionPrototype*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/AsyncFunctionPrototype.cpp b/runtime/AsyncFunctionPrototype.cpp
new file mode 100644
index 0000000..fb1f0e1
--- /dev/null
+++ b/runtime/AsyncFunctionPrototype.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2016 Caitlin Potter <caitp@igalia.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AsyncFunctionPrototype.h"
+
+#include "BuiltinExecutables.h"
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSString.h"
+#include "JSStringBuilder.h"
+#include "Lexer.h"
+
+namespace JSC {
+
+const ClassInfo AsyncFunctionPrototype::s_info = { "AsyncFunction", &Base::s_info, nullptr, CREATE_METHOD_TABLE(AsyncFunctionPrototype) };
+
+AsyncFunctionPrototype::AsyncFunctionPrototype(VM& vm, Structure* structure)
+    : JSC::JSNonFinalObject(vm, structure)
+{
+}
+
+void AsyncFunctionPrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "AsyncFunction"), DontEnum | ReadOnly);
+    vm.prototypeMap.addPrototype(this);
+}
+
+} // namespace JSC
diff --git a/runtime/AsyncFunctionPrototype.h b/runtime/AsyncFunctionPrototype.h
new file mode 100644
index 0000000..b201e6b
--- /dev/null
+++ b/runtime/AsyncFunctionPrototype.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2016 Caitlin Potter <caitp@igalia.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class AsyncFunctionPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    DECLARE_INFO;
+
+    static AsyncFunctionPrototype* create(VM& vm, Structure* structure)
+    {
+        AsyncFunctionPrototype* prototype = new (NotNull, allocateCell<AsyncFunctionPrototype>(vm.heap)) AsyncFunctionPrototype(vm, structure);
+        prototype->finishCreation(vm);
+        return prototype;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    AsyncFunctionPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
diff --git a/runtime/AtomicsObject.cpp b/runtime/AtomicsObject.cpp
new file mode 100644
index 0000000..c86ffa2
--- /dev/null
+++ b/runtime/AtomicsObject.cpp
@@ -0,0 +1,396 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AtomicsObject.h"
+
+#include "JSCInlines.h"
+#include "JSTypedArrays.h"
+#include "ObjectPrototype.h"
+#include "ReleaseHeapAccessScope.h"
+#include "TypedArrayController.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(AtomicsObject);
+
+#define FOR_EACH_ATOMICS_FUNC(macro)                                    \
+    macro(add, Add, 3)                                                  \
+    macro(and, And, 3)                                                  \
+    macro(compareExchange, CompareExchange, 4)                          \
+    macro(exchange, Exchange, 3)                                        \
+    macro(isLockFree, IsLockFree, 1)                                    \
+    macro(load, Load, 2)                                                \
+    macro(or, Or, 3)                                                    \
+    macro(store, Store, 3)                                              \
+    macro(sub, Sub, 3)                                                  \
+    macro(wait, Wait, 4)                                                \
+    macro(wake, Wake, 3)                                                \
+    macro(xor, Xor, 3)
+
+#define DECLARE_FUNC_PROTO(lowerName, upperName, count)                 \
+    EncodedJSValue JSC_HOST_CALL atomicsFunc ## upperName(ExecState*);
+FOR_EACH_ATOMICS_FUNC(DECLARE_FUNC_PROTO)
+#undef DECLARE_FUNC_PROTO
+
+const ClassInfo AtomicsObject::s_info = { "Atomics", &Base::s_info, 0, CREATE_METHOD_TABLE(AtomicsObject) };
+
+AtomicsObject::AtomicsObject(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+AtomicsObject* AtomicsObject::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    AtomicsObject* object = new (NotNull, allocateCell<AtomicsObject>(vm.heap)) AtomicsObject(vm, structure);
+    object->finishCreation(vm, globalObject);
+    return object;
+}
+
+Structure* AtomicsObject::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void AtomicsObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    
+#define PUT_DIRECT_NATIVE_FUNC(lowerName, upperName, count) \
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, #lowerName), count, atomicsFunc ## upperName, Atomics ## upperName ## Intrinsic, DontEnum);
+    FOR_EACH_ATOMICS_FUNC(PUT_DIRECT_NATIVE_FUNC)
+#undef PUT_DIRECT_NATIVE_FUNC
+}
+
+namespace {
+
+template<unsigned numExtraArgs, typename Adaptor, typename Func>
+EncodedJSValue atomicOperationWithArgsCase(ExecState* exec, ThrowScope& scope, JSArrayBufferView* typedArrayView, unsigned accessIndex, const Func& func)
+{
+    JSGenericTypedArrayView<Adaptor>* typedArray = jsCast<JSGenericTypedArrayView<Adaptor>*>(typedArrayView);
+    
+    double extraArgs[numExtraArgs + 1]; // Add 1 to avoid 0 size array error in VS.
+    for (unsigned i = 0; i < numExtraArgs; ++i) {
+        double value = exec->argument(2 + i).toInteger(exec);
+        RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined()));
+        extraArgs[i] = value;
+    }
+
+    return JSValue::encode(func(typedArray->typedVector() + accessIndex, extraArgs));
+}
+
+unsigned validatedAccessIndex(VM& vm, ExecState* exec, JSArrayBufferView* typedArrayView)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue accessIndexValue = exec->argument(1);
+    if (UNLIKELY(!accessIndexValue.isInt32())) {
+        double accessIndexDouble = accessIndexValue.toNumber(exec);
+        RETURN_IF_EXCEPTION(scope, 0);
+        if (accessIndexDouble == 0)
+            accessIndexValue = jsNumber(0);
+        else {
+            accessIndexValue = jsNumber(accessIndexDouble);
+            if (!accessIndexValue.isInt32()) {
+                throwRangeError(exec, scope, ASCIILiteral("Access index is not an integer."));
+                return 0;
+            }
+        }
+    }
+    int32_t accessIndex = accessIndexValue.asInt32();
+    
+    ASSERT(typedArrayView->length() <= static_cast<unsigned>(INT_MAX));
+    if (static_cast<unsigned>(accessIndex) >= typedArrayView->length()) {
+        throwRangeError(exec, scope, ASCIILiteral("Access index out of bounds for atomic access."));
+        return 0;
+    }
+    
+    return accessIndex;
+}
+
+template<unsigned numExtraArgs, typename Func>
+EncodedJSValue atomicOperationWithArgs(ExecState* exec, const Func& func)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue typedArrayValue = exec->argument(0);
+    if (!typedArrayValue.isCell()) {
+        throwTypeError(exec, scope, ASCIILiteral("Typed array argument must be a cell."));
+        return JSValue::encode(jsUndefined());
+    }
+    
+    JSCell* typedArrayCell = typedArrayValue.asCell();
+    
+    JSType type = typedArrayCell->type();
+    switch (type) {
+    case Int8ArrayType:
+    case Int16ArrayType:
+    case Int32ArrayType:
+    case Uint8ArrayType:
+    case Uint16ArrayType:
+    case Uint32ArrayType:
+        break;
+    default:
+        throwTypeError(exec, scope, ASCIILiteral("Typed array argument must be an Int8Array, Int16Array, Int32Array, Uint8Array, Uint16Array, or Uint32Array."));
+        return JSValue::encode(jsUndefined());
+    }
+    
+    JSArrayBufferView* typedArrayView = jsCast<JSArrayBufferView*>(typedArrayCell);
+    if (!typedArrayView->isShared()) {
+        throwTypeError(exec, scope, ASCIILiteral("Typed array argument must wrap a SharedArrayBuffer."));
+        return JSValue::encode(jsUndefined());
+    }
+    
+    unsigned accessIndex = validatedAccessIndex(vm, exec, typedArrayView);
+    RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined()));
+    
+    switch (type) {
+    case Int8ArrayType:
+        return atomicOperationWithArgsCase<numExtraArgs, Int8Adaptor>(exec, scope, typedArrayView, accessIndex, func);
+    case Int16ArrayType:
+        return atomicOperationWithArgsCase<numExtraArgs, Int16Adaptor>(exec, scope, typedArrayView, accessIndex, func);
+    case Int32ArrayType:
+        return atomicOperationWithArgsCase<numExtraArgs, Int32Adaptor>(exec, scope, typedArrayView, accessIndex, func);
+    case Uint8ArrayType:
+        return atomicOperationWithArgsCase<numExtraArgs, Uint8Adaptor>(exec, scope, typedArrayView, accessIndex, func);
+    case Uint16ArrayType:
+        return atomicOperationWithArgsCase<numExtraArgs, Uint16Adaptor>(exec, scope, typedArrayView, accessIndex, func);
+    case Uint32ArrayType:
+        return atomicOperationWithArgsCase<numExtraArgs, Uint32Adaptor>(exec, scope, typedArrayView, accessIndex, func);
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return JSValue::encode(jsUndefined());
+    }
+}
+
+} // anonymous namespace
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncAdd(ExecState* exec)
+{
+    return atomicOperationWithArgs<1>(
+        exec, [&] (auto* ptr, const double* args) {
+            return jsNumber(WTF::atomicExchangeAdd(ptr, toInt32(args[0])));
+        });
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncAnd(ExecState* exec)
+{
+    return atomicOperationWithArgs<1>(
+        exec, [&] (auto* ptr, const double* args) {
+            return jsNumber(WTF::atomicExchangeAnd(ptr, toInt32(args[0])));
+        });
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncCompareExchange(ExecState* exec)
+{
+    return atomicOperationWithArgs<2>(
+        exec, [&] (auto* ptr, const double* args) {
+            typedef typename std::remove_pointer<decltype(ptr)>::type T;
+            T expected = static_cast<T>(toInt32(args[0]));
+            T newValue = static_cast<T>(toInt32(args[1]));
+            return jsNumber(WTF::atomicCompareExchangeStrong(ptr, expected, newValue));
+        });
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncExchange(ExecState* exec)
+{
+    return atomicOperationWithArgs<1>(
+        exec, [&] (auto* ptr, const double* args) {
+            typedef typename std::remove_pointer<decltype(ptr)>::type T;
+            return jsNumber(WTF::atomicExchange(ptr, static_cast<T>(toInt32(args[0]))));
+        });
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncIsLockFree(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    int32_t size = exec->argument(0).toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined()));
+    
+    bool result;
+    switch (size) {
+    case 1:
+    case 2:
+    case 4:
+        result = true;
+        break;
+    default:
+        result = false;
+        break;
+    }
+    return JSValue::encode(jsBoolean(result));
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncLoad(ExecState* exec)
+{
+    return atomicOperationWithArgs<0>(
+        exec, [&] (auto* ptr, const double*) {
+            return jsNumber(WTF::atomicLoad(ptr));
+        });
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncOr(ExecState* exec)
+{
+    return atomicOperationWithArgs<1>(
+        exec, [&] (auto* ptr, const double* args) {
+            return jsNumber(WTF::atomicExchangeOr(ptr, toInt32(args[0])));
+        });
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncStore(ExecState* exec)
+{
+    return atomicOperationWithArgs<1>(
+        exec, [&] (auto* ptr, const double* args) {
+            typedef typename std::remove_pointer<decltype(ptr)>::type T;
+            double valueAsInt = args[0];
+            T valueAsT = static_cast<T>(toInt32(valueAsInt));
+            WTF::atomicStore(ptr, valueAsT);
+            return jsNumber(valueAsInt);
+        });
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncSub(ExecState* exec)
+{
+    return atomicOperationWithArgs<1>(
+        exec, [&] (auto* ptr, const double* args) {
+            return jsNumber(WTF::atomicExchangeSub(ptr, toInt32(args[0])));
+        });
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncWait(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    JSInt32Array* typedArray = jsDynamicCast<JSInt32Array*>(exec->argument(0));
+    if (!typedArray) {
+        throwTypeError(exec, scope, ASCIILiteral("Typed array for wait/wake must be an Int32Array."));
+        return JSValue::encode(jsUndefined());
+    }
+    
+    if (!typedArray->isShared()) {
+        throwTypeError(exec, scope, ASCIILiteral("Typed array for wait/wake must wrap a SharedArrayBuffer."));
+        return JSValue::encode(jsUndefined());
+    }
+
+    unsigned accessIndex = validatedAccessIndex(vm, exec, typedArray);
+    RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined()));
+    
+    int32_t* ptr = typedArray->typedVector() + accessIndex;
+    
+    int32_t expectedValue = exec->argument(2).toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined()));
+    
+    double timeoutInMilliseconds = exec->argument(3).toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined()));
+    
+    if (!vm.m_typedArrayController->isAtomicsWaitAllowedOnCurrentThread()) {
+        throwTypeError(exec, scope, ASCIILiteral("Atomics.wait cannot be called from the current thread."));
+        return JSValue::encode(jsUndefined());
+    }
+    
+    Seconds timeout = Seconds::fromMilliseconds(timeoutInMilliseconds);
+
+    // This covers the proposed rule:
+    //
+    // 4. If timeout is not provided or is undefined then let t be +inf. Otherwise:
+    //     a. Let q be ? ToNumber(timeout).
+    //     b. If q is NaN then let t be +inf, otherwise let t be max(0, q).
+    //
+    // exec->argument(3) returns undefined if it's not provided and ToNumber(undefined) returns NaN,
+    // so NaN is the only special case.
+    if (timeout == timeout)
+        timeout = std::max(0_s, timeout);
+    else
+        timeout = Seconds::infinity();
+    
+    bool didPassValidation = false;
+    ParkingLot::ParkResult result;
+    {
+        ReleaseHeapAccessScope releaseHeapAccessScope(vm.heap);
+        result = ParkingLot::parkConditionally(
+            ptr,
+            [&] () -> bool {
+                didPassValidation = WTF::atomicLoad(ptr) == expectedValue;
+                return didPassValidation;
+            },
+            [] () { },
+            MonotonicTime::now() + timeout);
+    }
+    const char* resultString;
+    if (!didPassValidation)
+        resultString = "not-equal";
+    else if (!result.wasUnparked)
+        resultString = "timed-out";
+    else
+        resultString = "ok";
+    return JSValue::encode(jsString(exec, ASCIILiteral(resultString)));
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncWake(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    JSInt32Array* typedArray = jsDynamicCast<JSInt32Array*>(exec->argument(0));
+    if (!typedArray) {
+        throwTypeError(exec, scope, ASCIILiteral("Typed array for wait/wake must be an Int32Array."));
+        return JSValue::encode(jsUndefined());
+    }
+    
+    if (!typedArray->isShared()) {
+        throwTypeError(exec, scope, ASCIILiteral("Typed array for wait/wake must wrap a SharedArrayBuffer."));
+        return JSValue::encode(jsUndefined());
+    }
+
+    unsigned accessIndex = validatedAccessIndex(vm, exec, typedArray);
+    RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined()));
+    
+    int32_t* ptr = typedArray->typedVector() + accessIndex;
+    
+    JSValue countValue = exec->argument(2);
+    unsigned count = UINT_MAX;
+    if (!countValue.isUndefined()) {
+        int32_t countInt = countValue.toInt32(exec);
+        RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined()));
+        count = std::max(0, countInt);
+    }
+
+    return JSValue::encode(jsNumber(ParkingLot::unparkCount(ptr, count)));
+}
+
+EncodedJSValue JSC_HOST_CALL atomicsFuncXor(ExecState* exec)
+{
+    return atomicOperationWithArgs<1>(
+        exec, [&] (auto* ptr, const double* args) {
+            return jsNumber(WTF::atomicExchangeXor(ptr, toInt32(args[0])));
+        });
+}
+
+} // namespace JSC
+
diff --git a/runtime/AtomicsObject.h b/runtime/AtomicsObject.h
new file mode 100644
index 0000000..e8144ce
--- /dev/null
+++ b/runtime/AtomicsObject.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class AtomicsObject : public JSNonFinalObject {
+private:
+    AtomicsObject(VM&, Structure*);
+
+public:
+    typedef JSNonFinalObject Base;
+    
+    static AtomicsObject* create(VM&, JSGlobalObject*, Structure*);
+    
+    DECLARE_INFO;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
+
diff --git a/runtime/AuxiliaryBarrier.h b/runtime/AuxiliaryBarrier.h
new file mode 100644
index 0000000..3b7322f
--- /dev/null
+++ b/runtime/AuxiliaryBarrier.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+class JSCell;
+class VM;
+
+// An Auxiliary barrier is a barrier that does not try to reason about the value being stored into
+// it, other than interpreting a falsy value as not needing a barrier. It's OK to use this for either
+// JSCells or any other kind of data, so long as it responds to operator!().
+template<typename T>
+class AuxiliaryBarrier {
+public:
+    AuxiliaryBarrier(): m_value() { }
+    
+    template<typename U>
+    AuxiliaryBarrier(VM&, JSCell*, U&&);
+    
+    void clear() { m_value = T(); }
+    
+    template<typename U>
+    void set(VM&, JSCell*, U&&);
+    
+    const T& get() const { return m_value; }
+    
+    T* slot() { return &m_value; }
+    
+    explicit operator bool() const { return !!m_value; }
+    
+    template<typename U>
+    void setWithoutBarrier(U&& value) { m_value = std::forward<U>(value); }
+    
+private:
+    T m_value;
+};
+
+} // namespace JSC
diff --git a/runtime/AuxiliaryBarrierInlines.h b/runtime/AuxiliaryBarrierInlines.h
new file mode 100644
index 0000000..6d4e789
--- /dev/null
+++ b/runtime/AuxiliaryBarrierInlines.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "AuxiliaryBarrier.h"
+#include "Heap.h"
+#include "VM.h"
+
+namespace JSC {
+
+template<typename T>
+template<typename U>
+AuxiliaryBarrier<T>::AuxiliaryBarrier(VM& vm, JSCell* owner, U&& value)
+{
+    m_value = std::forward<U>(value);
+    vm.heap.writeBarrier(owner);
+}
+
+template<typename T>
+template<typename U>
+void AuxiliaryBarrier<T>::set(VM& vm, JSCell* owner, U&& value)
+{
+    m_value = std::forward<U>(value);
+    vm.heap.writeBarrier(owner);
+}
+
+} // namespace JSC
+
diff --git a/runtime/BasicBlockLocation.cpp b/runtime/BasicBlockLocation.cpp
new file mode 100644
index 0000000..d97b037
--- /dev/null
+++ b/runtime/BasicBlockLocation.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 Saam Barati. <saambarati1@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "BasicBlockLocation.h"
+
+#include "CCallHelpers.h"
+#include <climits>
+#include <wtf/DataLog.h>
+
+namespace JSC {
+
+BasicBlockLocation::BasicBlockLocation(int startOffset, int endOffset)
+    : m_startOffset(startOffset)
+    , m_endOffset(endOffset)
+    , m_executionCount(0)
+{
+}
+
+void BasicBlockLocation::insertGap(int startOffset, int endOffset)
+{
+    std::pair<int, int> gap(startOffset, endOffset);
+    if (!m_gaps.contains(gap))
+        m_gaps.append(gap);
+}
+
+Vector<std::pair<int, int>> BasicBlockLocation::getExecutedRanges() const
+{
+    Vector<Gap> result;
+    Vector<Gap> gaps = m_gaps;
+    int nextRangeStart = m_startOffset;
+    while (gaps.size()) {
+        Gap minGap(INT_MAX, 0);
+        unsigned minIdx = std::numeric_limits<unsigned>::max();
+        for (unsigned idx = 0; idx < gaps.size(); idx++) {
+            // Because we know that the Gaps inside m_gaps aren't enclosed within one another, it suffices to just check the first element to test ordering.
+            if (gaps[idx].first < minGap.first) {
+                minGap = gaps[idx];
+                minIdx = idx;
+            }
+        }
+        result.append(Gap(nextRangeStart, minGap.first - 1));
+        nextRangeStart = minGap.second + 1;
+        gaps.remove(minIdx);
+    }
+
+    result.append(Gap(nextRangeStart, m_endOffset));
+    return result;
+}
+
+void BasicBlockLocation::dumpData() const
+{
+    Vector<Gap> executedRanges = getExecutedRanges();
+    for (Gap gap : executedRanges)
+        dataLogF("\tBasicBlock: [%d, %d] hasExecuted: %s, executionCount:%zu\n", gap.first, gap.second, hasExecuted() ? "true" : "false", m_executionCount);
+}
+
+#if ENABLE(JIT)
+#if USE(JSVALUE64)
+void BasicBlockLocation::emitExecuteCode(CCallHelpers& jit) const
+{
+    static_assert(sizeof(size_t) == 8, "Assuming size_t is 64 bits on 64 bit platforms.");
+    jit.add64(CCallHelpers::TrustedImm32(1), CCallHelpers::AbsoluteAddress(&m_executionCount));
+}
+#else
+void BasicBlockLocation::emitExecuteCode(CCallHelpers& jit, MacroAssembler::RegisterID scratch) const
+{
+    static_assert(sizeof(size_t) == 4, "Assuming size_t is 32 bits on 32 bit platforms.");
+    jit.load32(&m_executionCount, scratch);
+    CCallHelpers::Jump done = jit.branchAdd32(CCallHelpers::Zero, scratch, CCallHelpers::TrustedImm32(1), scratch);
+    jit.store32(scratch, bitwise_cast<void*>(&m_executionCount));
+    done.link(&jit);
+}
+#endif // USE(JSVALUE64)
+#endif // ENABLE(JIT)
+
+} // namespace JSC
diff --git a/runtime/BasicBlockLocation.h b/runtime/BasicBlockLocation.h
new file mode 100644
index 0000000..3ece647
--- /dev/null
+++ b/runtime/BasicBlockLocation.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 Saam Barati. <saambarati1@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "MacroAssembler.h"
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CCallHelpers;
+class LLIntOffsetsExtractor;
+
+class BasicBlockLocation {
+public:
+    typedef std::pair<int, int> Gap;
+
+    BasicBlockLocation(int startOffset = -1, int endOffset = -1);
+
+    int startOffset() const { return m_startOffset; }
+    int endOffset() const { return m_endOffset; }
+    void setStartOffset(int startOffset) { m_startOffset = startOffset; }
+    void setEndOffset(int endOffset) { m_endOffset = endOffset; }
+    bool hasExecuted() const { return m_executionCount > 0; }
+    size_t executionCount() const { return m_executionCount; }
+    void insertGap(int, int);
+    Vector<Gap> getExecutedRanges() const;
+    JS_EXPORT_PRIVATE void dumpData() const;
+#if ENABLE(JIT)
+#if USE(JSVALUE64)
+    void emitExecuteCode(CCallHelpers&) const;
+#else
+    void emitExecuteCode(CCallHelpers&, MacroAssembler::RegisterID scratch) const;
+#endif
+#endif
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    int m_startOffset;
+    int m_endOffset;
+    size_t m_executionCount;
+    Vector<Gap> m_gaps;
+};
+
+} // namespace JSC
diff --git a/runtime/BatchedTransitionOptimizer.h b/runtime/BatchedTransitionOptimizer.h
new file mode 100644
index 0000000..601414c
--- /dev/null
+++ b/runtime/BatchedTransitionOptimizer.h
@@ -0,0 +1,43 @@
+// -*- mode: c++; c-basic-offset: 4 -*-
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class BatchedTransitionOptimizer {
+    WTF_MAKE_NONCOPYABLE(BatchedTransitionOptimizer);
+public:
+    BatchedTransitionOptimizer(VM& vm, JSObject* object)
+    {
+        if (!object->structure(vm)->isDictionary())
+            object->convertToDictionary(vm);
+    }
+};
+
+} // namespace JSC
diff --git a/runtime/BigInteger.h b/runtime/BigInteger.h
new file mode 100644
index 0000000..6b0df59
--- /dev/null
+++ b/runtime/BigInteger.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+// This is used in converting the integer part of a number to a string.
+class BigInteger {
+public:
+    BigInteger(double number)
+    {
+        ASSERT(std::isfinite(number) && !std::signbit(number));
+        ASSERT(number == floor(number));
+
+        bool sign;
+        int32_t exponent;
+        uint64_t mantissa;
+        decomposeDouble(number, sign, exponent, mantissa);
+        ASSERT(!sign && exponent >= 0);
+
+        int32_t zeroBits = exponent - 52;
+
+        if (zeroBits < 0) {
+            mantissa >>= -zeroBits;
+            zeroBits = 0;
+        }
+
+        while (zeroBits >= 32) {
+            m_values.append(0);
+            zeroBits -= 32;
+        }
+
+        // Left align the 53 bits of the mantissa within 96 bits.
+        uint32_t values[3];
+        values[0] = static_cast<uint32_t>(mantissa);
+        values[1] = static_cast<uint32_t>(mantissa >> 32);
+        values[2] = 0;
+        // Shift based on the remainder of the exponent.
+        if (zeroBits) {
+            values[2] = values[1] >> (32 - zeroBits);
+            values[1] = (values[1] << zeroBits) | (values[0] >> (32 - zeroBits));
+            values[0] = (values[0] << zeroBits);
+        }
+        m_values.append(values[0]);
+        m_values.append(values[1]);
+        m_values.append(values[2]);
+
+        // Canonicalize; remove all trailing zeros.
+        while (m_values.size() && !m_values.last())
+            m_values.removeLast();
+    }
+
+    uint32_t divide(uint32_t divisor)
+    {
+        uint32_t carry = 0;
+
+        for (size_t i = m_values.size(); i; ) {
+            --i;
+            uint64_t dividend = (static_cast<uint64_t>(carry) << 32) + static_cast<uint64_t>(m_values[i]);
+
+            uint64_t result = dividend / static_cast<uint64_t>(divisor);
+            ASSERT(result == static_cast<uint32_t>(result));
+            uint64_t remainder = dividend % static_cast<uint64_t>(divisor);
+            ASSERT(remainder == static_cast<uint32_t>(remainder));
+            
+            m_values[i] = static_cast<uint32_t>(result);
+            carry = static_cast<uint32_t>(remainder);
+        }
+
+        // Canonicalize; remove all trailing zeros.
+        while (m_values.size() && !m_values.last())
+            m_values.removeLast();
+
+        return carry;
+    }
+
+    bool operator!() { return !m_values.size(); }
+
+private:
+    Vector<uint32_t, 36> m_values;
+};
+
+} // namespace JSC
diff --git a/runtime/BooleanConstructor.cpp b/runtime/BooleanConstructor.cpp
new file mode 100644
index 0000000..a0fff58
--- /dev/null
+++ b/runtime/BooleanConstructor.cpp
@@ -0,0 +1,86 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "BooleanConstructor.h"
+
+#include "BooleanPrototype.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(BooleanConstructor);
+
+const ClassInfo BooleanConstructor::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(BooleanConstructor) };
+
+BooleanConstructor::BooleanConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void BooleanConstructor::finishCreation(VM& vm, BooleanPrototype* booleanPrototype)
+{
+    Base::finishCreation(vm, booleanPrototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, booleanPrototype, DontEnum | DontDelete | ReadOnly);
+
+    // no. of arguments for constructor
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
+}
+
+// ECMA 15.6.2
+static EncodedJSValue JSC_HOST_CALL constructWithBooleanConstructor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue boolean = jsBoolean(exec->argument(0).toBoolean(exec));
+    Structure* booleanStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), asInternalFunction(exec->jsCallee())->globalObject()->booleanObjectStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    BooleanObject* obj = BooleanObject::create(vm, booleanStructure);
+    obj->setInternalValue(vm, boolean);
+    return JSValue::encode(obj);
+}
+
+ConstructType BooleanConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWithBooleanConstructor;
+    return ConstructType::Host;
+}
+
+// ECMA 15.6.1
+static EncodedJSValue JSC_HOST_CALL callBooleanConstructor(ExecState* exec)
+{
+    return JSValue::encode(jsBoolean(exec->argument(0).toBoolean(exec)));
+}
+
+CallType BooleanConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callBooleanConstructor;
+    return CallType::Host;
+}
+
+JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSGlobalObject* globalObject, JSValue immediateBooleanValue)
+{
+    BooleanObject* obj = BooleanObject::create(exec->vm(), globalObject->booleanObjectStructure());
+    obj->setInternalValue(exec->vm(), immediateBooleanValue);
+    return obj;
+}
+
+} // namespace JSC
diff --git a/runtime/BooleanConstructor.h b/runtime/BooleanConstructor.h
new file mode 100644
index 0000000..bb8c5df
--- /dev/null
+++ b/runtime/BooleanConstructor.h
@@ -0,0 +1,59 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class BooleanPrototype;
+class GetterSetter;
+
+class BooleanConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static BooleanConstructor* create(VM& vm, Structure* structure, BooleanPrototype* booleanPrototype, GetterSetter*)
+    {
+        BooleanConstructor* constructor = new (NotNull, allocateCell<BooleanConstructor>(vm.heap)) BooleanConstructor(vm, structure);
+        constructor->finishCreation(vm, booleanPrototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    { 
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+protected:
+    void finishCreation(VM&, BooleanPrototype*);
+
+private:
+    BooleanConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSGlobalObject*, JSValue);
+
+} // namespace JSC
diff --git a/runtime/BooleanObject.cpp b/runtime/BooleanObject.cpp
new file mode 100644
index 0000000..28cad6a
--- /dev/null
+++ b/runtime/BooleanObject.cpp
@@ -0,0 +1,44 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "BooleanObject.h"
+
+#include "JSScope.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(BooleanObject);
+
+const ClassInfo BooleanObject::s_info = { "Boolean", &JSWrapperObject::s_info, 0, CREATE_METHOD_TABLE(BooleanObject) };
+
+BooleanObject::BooleanObject(VM& vm, Structure* structure)
+    : JSWrapperObject(vm, structure)
+{
+}
+
+void BooleanObject::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+} // namespace JSC
diff --git a/runtime/BooleanObject.h b/runtime/BooleanObject.h
new file mode 100644
index 0000000..cdab445
--- /dev/null
+++ b/runtime/BooleanObject.h
@@ -0,0 +1,58 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSWrapperObject.h"
+
+namespace JSC {
+
+class BooleanObject : public JSWrapperObject {
+protected:
+    JS_EXPORT_PRIVATE BooleanObject(VM&, Structure*);
+    JS_EXPORT_PRIVATE void finishCreation(VM&);
+
+public:
+    typedef JSWrapperObject Base;
+
+    static BooleanObject* create(VM& vm, Structure* structure)
+    {
+        BooleanObject* boolean = new (NotNull, allocateCell<BooleanObject>(vm.heap)) BooleanObject(vm, structure);
+        boolean->finishCreation(vm);
+        return boolean;
+    }
+        
+    DECLARE_EXPORT_INFO;
+        
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+};
+
+BooleanObject* asBooleanObject(JSValue);
+
+inline BooleanObject* asBooleanObject(JSValue value)
+{
+    ASSERT(asObject(value)->inherits(BooleanObject::info()));
+    return static_cast<BooleanObject*>(asObject(value));
+}
+
+} // namespace JSC
diff --git a/runtime/BooleanPrototype.cpp b/runtime/BooleanPrototype.cpp
new file mode 100644
index 0000000..aee96ca
--- /dev/null
+++ b/runtime/BooleanPrototype.cpp
@@ -0,0 +1,102 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2008, 2011, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "BooleanPrototype.h"
+
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSFunction.h"
+#include "JSString.h"
+#include "ObjectPrototype.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState*);
+static EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState*);
+
+}
+
+#include "BooleanPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo BooleanPrototype::s_info = { "Boolean", &BooleanObject::s_info, &booleanPrototypeTable, CREATE_METHOD_TABLE(BooleanPrototype) };
+
+/* Source for BooleanPrototype.lut.h
+@begin booleanPrototypeTable
+  toString  booleanProtoFuncToString    DontEnum|Function 0
+  valueOf   booleanProtoFuncValueOf     DontEnum|Function 0
+@end
+*/
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(BooleanPrototype);
+
+BooleanPrototype::BooleanPrototype(VM& vm, Structure* structure)
+    : BooleanObject(vm, structure)
+{
+}
+
+void BooleanPrototype::finishCreation(VM& vm, JSGlobalObject*)
+{
+    Base::finishCreation(vm);
+    setInternalValue(vm, jsBoolean(false));
+
+    ASSERT(inherits(info()));
+}
+
+// ------------------------------ Functions ---------------------------
+
+EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    JSValue thisValue = exec->thisValue();
+    if (thisValue == jsBoolean(false))
+        return JSValue::encode(vm->smallStrings.falseString());
+
+    if (thisValue == jsBoolean(true))
+        return JSValue::encode(vm->smallStrings.trueString());
+
+    if (!thisValue.inherits(BooleanObject::info()))
+        return throwVMTypeError(exec, scope);
+
+    if (asBooleanObject(thisValue)->internalValue() == jsBoolean(false))
+        return JSValue::encode(vm->smallStrings.falseString());
+
+    ASSERT(asBooleanObject(thisValue)->internalValue() == jsBoolean(true));
+    return JSValue::encode(vm->smallStrings.trueString());
+}
+
+EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (thisValue.isBoolean())
+        return JSValue::encode(thisValue);
+
+    if (!thisValue.inherits(BooleanObject::info()))
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(asBooleanObject(thisValue)->internalValue());
+}
+
+} // namespace JSC
diff --git a/runtime/BooleanPrototype.h b/runtime/BooleanPrototype.h
new file mode 100644
index 0000000..41a239d
--- /dev/null
+++ b/runtime/BooleanPrototype.h
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2011 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "BooleanObject.h"
+
+namespace JSC {
+
+class BooleanPrototype : public BooleanObject {
+public:
+    typedef BooleanObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static BooleanPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        BooleanPrototype* prototype = new (NotNull, allocateCell<BooleanPrototype>(vm.heap)) BooleanPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+        
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+
+private:
+    BooleanPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
diff --git a/runtime/BundlePath.h b/runtime/BundlePath.h
new file mode 100644
index 0000000..3b700d4
--- /dev/null
+++ b/runtime/BundlePath.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <string>
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+const CString& bundlePath();
+
+} // namespace JSC
diff --git a/runtime/BundlePath.mm b/runtime/BundlePath.mm
new file mode 100644
index 0000000..bd2212e
--- /dev/null
+++ b/runtime/BundlePath.mm
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+#import "BundlePath.h"
+
+#import <Foundation/Foundation.h>
+#import <string>
+
+@interface JSJavaScriptCoreFinder : NSObject
+@end
+
+@implementation JSJavaScriptCoreFinder
+@end
+
+
+namespace JSC {
+
+const CString* constantBundlePath = nullptr;
+
+const CString& bundlePath()
+{
+    if (!constantBundlePath) {
+        @autoreleasepool {
+            NSBundle* myBundle = [NSBundle bundleForClass:[JSJavaScriptCoreFinder class]];
+
+            constantBundlePath = new CString([[myBundle bundlePath] UTF8String]);
+        }
+    }
+
+    return *constantBundlePath;
+}
+
+} // namespace JSC
diff --git a/runtime/Butterfly.h b/runtime/Butterfly.h
new file mode 100644
index 0000000..8ed39b0
--- /dev/null
+++ b/runtime/Butterfly.h
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "IndexingHeader.h"
+#include "PropertyOffset.h"
+#include "PropertyStorage.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class VM;
+class CopyVisitor;
+struct ArrayStorage;
+
+template <typename T> struct ContiguousData {
+    ContiguousData()
+        : m_data(0)
+#if !ASSERT_DISABLED
+        , m_length(0)
+#endif
+    {
+    }
+    ContiguousData(T* data, size_t length)
+        : m_data(data)
+#if !ASSERT_DISABLED
+        , m_length(length)
+#endif
+    {
+        UNUSED_PARAM(length);
+    }
+
+    const T& operator[](size_t index) const { ASSERT(index < m_length); return m_data[index]; }
+    T& operator[](size_t index) { ASSERT(index < m_length); return m_data[index]; }
+
+    T* data() const { return m_data; }
+#if !ASSERT_DISABLED
+    size_t length() const { return m_length; }
+#endif
+
+private:
+    T* m_data;
+#if !ASSERT_DISABLED
+    size_t m_length;
+#endif
+};
+
+typedef ContiguousData<double> ContiguousDoubles;
+typedef ContiguousData<WriteBarrier<Unknown>> ContiguousJSValues;
+
+class Butterfly {
+    WTF_MAKE_NONCOPYABLE(Butterfly);
+private:
+    Butterfly() { } // Not instantiable.
+public:
+    
+    static size_t totalSize(size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, size_t indexingPayloadSizeInBytes)
+    {
+        ASSERT(indexingPayloadSizeInBytes ? hasIndexingHeader : true);
+        ASSERT(sizeof(EncodedJSValue) == sizeof(IndexingHeader));
+        return (preCapacity + propertyCapacity) * sizeof(EncodedJSValue) + (hasIndexingHeader ? sizeof(IndexingHeader) : 0) + indexingPayloadSizeInBytes;
+    }
+
+    static Butterfly* fromBase(void* base, size_t preCapacity, size_t propertyCapacity)
+    {
+        return reinterpret_cast<Butterfly*>(static_cast<EncodedJSValue*>(base) + preCapacity + propertyCapacity + 1);
+    }
+    
+    ALWAYS_INLINE static unsigned availableContiguousVectorLength(size_t propertyCapacity, unsigned vectorLength);
+    static unsigned availableContiguousVectorLength(Structure*, unsigned vectorLength);
+    
+    ALWAYS_INLINE static unsigned optimalContiguousVectorLength(size_t propertyCapacity, unsigned vectorLength);
+    static unsigned optimalContiguousVectorLength(Structure*, unsigned vectorLength);
+    
+    // This method is here not just because it's handy, but to remind you that
+    // the whole point of butterflies is to do evil pointer arithmetic.
+    static Butterfly* fromPointer(char* ptr)
+    {
+        return reinterpret_cast<Butterfly*>(ptr);
+    }
+    
+    char* pointer() { return reinterpret_cast<char*>(this); }
+    
+    static ptrdiff_t offsetOfIndexingHeader() { return IndexingHeader::offsetOfIndexingHeader(); }
+    static ptrdiff_t offsetOfArrayBuffer() { return offsetOfIndexingHeader() + IndexingHeader::offsetOfArrayBuffer(); }
+    static ptrdiff_t offsetOfPublicLength() { return offsetOfIndexingHeader() + IndexingHeader::offsetOfPublicLength(); }
+    static ptrdiff_t offsetOfVectorLength() { return offsetOfIndexingHeader() + IndexingHeader::offsetOfVectorLength(); }
+    
+    static Butterfly* createUninitialized(VM&, JSCell* intendedOwner, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, size_t indexingPayloadSizeInBytes);
+
+    static Butterfly* tryCreate(VM& vm, JSCell*, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, const IndexingHeader& indexingHeader, size_t indexingPayloadSizeInBytes);
+    static Butterfly* create(VM&, JSCell* intendedOwner, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, const IndexingHeader&, size_t indexingPayloadSizeInBytes);
+    static Butterfly* create(VM&, JSCell* intendedOwner, Structure*);
+    
+    IndexingHeader* indexingHeader() { return IndexingHeader::from(this); }
+    const IndexingHeader* indexingHeader() const { return IndexingHeader::from(this); }
+    PropertyStorage propertyStorage() { return indexingHeader()->propertyStorage(); }
+    ConstPropertyStorage propertyStorage() const { return indexingHeader()->propertyStorage(); }
+    
+    uint32_t publicLength() { return indexingHeader()->publicLength(); }
+    uint32_t vectorLength() { return indexingHeader()->vectorLength(); }
+    void setPublicLength(uint32_t value) { indexingHeader()->setPublicLength(value); }
+    void setVectorLength(uint32_t value) { indexingHeader()->setVectorLength(value); }
+    
+    template<typename T>
+    T* indexingPayload() { return reinterpret_cast_ptr<T*>(this); }
+    ArrayStorage* arrayStorage() { return indexingPayload<ArrayStorage>(); }
+    ContiguousJSValues contiguousInt32() { return ContiguousJSValues(indexingPayload<WriteBarrier<Unknown>>(), vectorLength()); }
+
+    ContiguousDoubles contiguousDouble() { return ContiguousDoubles(indexingPayload<double>(), vectorLength()); }
+    ContiguousJSValues contiguous() { return ContiguousJSValues(indexingPayload<WriteBarrier<Unknown>>(), vectorLength()); }
+    
+    static Butterfly* fromContiguous(WriteBarrier<Unknown>* contiguous)
+    {
+        return reinterpret_cast<Butterfly*>(contiguous);
+    }
+    static Butterfly* fromContiguous(double* contiguous)
+    {
+        return reinterpret_cast<Butterfly*>(contiguous);
+    }
+    
+    static ptrdiff_t offsetOfPropertyStorage() { return -static_cast<ptrdiff_t>(sizeof(IndexingHeader)); }
+    static int indexOfPropertyStorage()
+    {
+        ASSERT(sizeof(IndexingHeader) == sizeof(EncodedJSValue));
+        return -1;
+    }
+
+    void* base(size_t preCapacity, size_t propertyCapacity) { return propertyStorage() - propertyCapacity - preCapacity; }
+    void* base(Structure*);
+
+    static Butterfly* createOrGrowArrayRight(
+        Butterfly*, VM&, JSCell* intendedOwner, Structure* oldStructure,
+        size_t propertyCapacity, bool hadIndexingHeader,
+        size_t oldIndexingPayloadSizeInBytes, size_t newIndexingPayloadSizeInBytes); 
+
+    // The butterfly reallocation methods perform the reallocation itself but do not change any
+    // of the meta-data to reflect that the reallocation occurred. Note that this set of
+    // methods is not exhaustive and is not intended to encapsulate all possible allocation
+    // modes of butterflies - there are code paths that allocate butterflies by calling
+    // directly into Heap::tryAllocateStorage.
+    static Butterfly* createOrGrowPropertyStorage(Butterfly*, VM&, JSCell* intendedOwner, Structure*, size_t oldPropertyCapacity, size_t newPropertyCapacity);
+    Butterfly* growArrayRight(VM&, JSCell* intendedOwner, Structure* oldStructure, size_t propertyCapacity, bool hadIndexingHeader, size_t oldIndexingPayloadSizeInBytes, size_t newIndexingPayloadSizeInBytes); // Assumes that preCapacity is zero, and asserts as much.
+    Butterfly* growArrayRight(VM&, JSCell* intendedOwner, Structure*, size_t newIndexingPayloadSizeInBytes);
+    Butterfly* resizeArray(VM&, JSCell* intendedOwner, size_t propertyCapacity, bool oldHasIndexingHeader, size_t oldIndexingPayloadSizeInBytes, size_t newPreCapacity, bool newHasIndexingHeader, size_t newIndexingPayloadSizeInBytes);
+    Butterfly* resizeArray(VM&, JSCell* intendedOwner, Structure*, size_t newPreCapacity, size_t newIndexingPayloadSizeInBytes); // Assumes that you're not changing whether or not the object has an indexing header.
+    Butterfly* unshift(Structure*, size_t numberOfSlots);
+    Butterfly* shift(Structure*, size_t numberOfSlots);
+};
+
+} // namespace JSC
diff --git a/runtime/ButterflyInlines.h b/runtime/ButterflyInlines.h
new file mode 100644
index 0000000..88c6f8a
--- /dev/null
+++ b/runtime/ButterflyInlines.h
@@ -0,0 +1,231 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayStorage.h"
+#include "Butterfly.h"
+#include "VM.h"
+#include "Structure.h"
+
+namespace JSC {
+
+ALWAYS_INLINE unsigned Butterfly::availableContiguousVectorLength(size_t propertyCapacity, unsigned vectorLength)
+{
+    size_t cellSize = totalSize(0, propertyCapacity, true, sizeof(EncodedJSValue) * vectorLength);
+    cellSize = MarkedSpace::optimalSizeFor(cellSize);
+    vectorLength = (cellSize - totalSize(0, propertyCapacity, true, 0)) / sizeof(EncodedJSValue);
+    return vectorLength;
+}
+
+ALWAYS_INLINE unsigned Butterfly::availableContiguousVectorLength(Structure* structure, unsigned vectorLength)
+{
+    return availableContiguousVectorLength(structure ? structure->outOfLineCapacity() : 0, vectorLength);
+}
+
+ALWAYS_INLINE unsigned Butterfly::optimalContiguousVectorLength(size_t propertyCapacity, unsigned vectorLength)
+{
+    if (!vectorLength)
+        vectorLength = BASE_CONTIGUOUS_VECTOR_LEN_EMPTY;
+    else
+        vectorLength = std::max(BASE_CONTIGUOUS_VECTOR_LEN, vectorLength);
+    return availableContiguousVectorLength(propertyCapacity, vectorLength);
+}
+
+ALWAYS_INLINE unsigned Butterfly::optimalContiguousVectorLength(Structure* structure, unsigned vectorLength)
+{
+    return optimalContiguousVectorLength(structure ? structure->outOfLineCapacity() : 0, vectorLength);
+}
+
+inline Butterfly* Butterfly::createUninitialized(VM& vm, JSCell*, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, size_t indexingPayloadSizeInBytes)
+{
+    size_t size = totalSize(preCapacity, propertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes);
+    void* base = vm.auxiliarySpace.allocate(size);
+    Butterfly* result = fromBase(base, preCapacity, propertyCapacity);
+    return result;
+}
+
+inline Butterfly* Butterfly::tryCreate(VM& vm, JSCell*, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, const IndexingHeader& indexingHeader, size_t indexingPayloadSizeInBytes)
+{
+    size_t size = totalSize(preCapacity, propertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes);
+    void* base = vm.auxiliarySpace.tryAllocate(size);
+    if (!base)
+        return nullptr;
+    Butterfly* result = fromBase(base, preCapacity, propertyCapacity);
+    if (hasIndexingHeader)
+        *result->indexingHeader() = indexingHeader;
+    memset(result->propertyStorage() - propertyCapacity, 0, propertyCapacity * sizeof(EncodedJSValue));
+    return result;
+}
+
+inline Butterfly* Butterfly::create(VM& vm, JSCell* intendedOwner, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, const IndexingHeader& indexingHeader, size_t indexingPayloadSizeInBytes)
+{
+    Butterfly* result = tryCreate(vm, intendedOwner, preCapacity, propertyCapacity, hasIndexingHeader, indexingHeader, indexingPayloadSizeInBytes);
+
+    RELEASE_ASSERT(result);
+    return result;
+}
+
+inline Butterfly* Butterfly::create(VM& vm, JSCell* intendedOwner, Structure* structure)
+{
+    return create(
+        vm, intendedOwner, 0, structure->outOfLineCapacity(),
+        structure->hasIndexingHeader(intendedOwner), IndexingHeader(), 0);
+}
+
+inline void* Butterfly::base(Structure* structure)
+{
+    return base(indexingHeader()->preCapacity(structure), structure->outOfLineCapacity());
+}
+
+inline Butterfly* Butterfly::createOrGrowPropertyStorage(
+    Butterfly* oldButterfly, VM& vm, JSCell* intendedOwner, Structure* structure, size_t oldPropertyCapacity, size_t newPropertyCapacity)
+{
+    RELEASE_ASSERT(newPropertyCapacity > oldPropertyCapacity);
+    if (!oldButterfly)
+        return create(vm, intendedOwner, 0, newPropertyCapacity, false, IndexingHeader(), 0);
+
+    size_t preCapacity = oldButterfly->indexingHeader()->preCapacity(structure);
+    size_t indexingPayloadSizeInBytes = oldButterfly->indexingHeader()->indexingPayloadSizeInBytes(structure);
+    bool hasIndexingHeader = structure->hasIndexingHeader(intendedOwner);
+    Butterfly* result = createUninitialized(
+        vm, intendedOwner, preCapacity, newPropertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes);
+    memcpy(
+        result->propertyStorage() - oldPropertyCapacity,
+        oldButterfly->propertyStorage() - oldPropertyCapacity,
+        totalSize(0, oldPropertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes));
+    memset(
+        result->propertyStorage() - newPropertyCapacity,
+        0,
+        (newPropertyCapacity - oldPropertyCapacity) * sizeof(EncodedJSValue));
+    return result;
+}
+
+inline Butterfly* Butterfly::createOrGrowArrayRight(
+    Butterfly* oldButterfly, VM& vm, JSCell* intendedOwner, Structure* oldStructure,
+    size_t propertyCapacity, bool hadIndexingHeader, size_t oldIndexingPayloadSizeInBytes,
+    size_t newIndexingPayloadSizeInBytes)
+{
+    if (!oldButterfly) {
+        return create(
+            vm, intendedOwner, 0, propertyCapacity, true, IndexingHeader(),
+            newIndexingPayloadSizeInBytes);
+    }
+    return oldButterfly->growArrayRight(
+        vm, intendedOwner, oldStructure, propertyCapacity, hadIndexingHeader,
+        oldIndexingPayloadSizeInBytes, newIndexingPayloadSizeInBytes);
+}
+
+inline Butterfly* Butterfly::growArrayRight(
+    VM& vm, JSCell* intendedOwner, Structure* oldStructure, size_t propertyCapacity,
+    bool hadIndexingHeader, size_t oldIndexingPayloadSizeInBytes,
+    size_t newIndexingPayloadSizeInBytes)
+{
+    ASSERT_UNUSED(oldStructure, !indexingHeader()->preCapacity(oldStructure));
+    ASSERT_UNUSED(intendedOwner, hadIndexingHeader == oldStructure->hasIndexingHeader(intendedOwner));
+    void* theBase = base(0, propertyCapacity);
+    size_t oldSize = totalSize(0, propertyCapacity, hadIndexingHeader, oldIndexingPayloadSizeInBytes);
+    size_t newSize = totalSize(0, propertyCapacity, true, newIndexingPayloadSizeInBytes);
+    void* newBase = vm.auxiliarySpace.tryAllocate(newSize);
+    if (!newBase)
+        return nullptr;
+    // FIXME: This probably shouldn't be a memcpy.
+    memcpy(newBase, theBase, oldSize);
+    return fromBase(newBase, 0, propertyCapacity);
+}
+
+inline Butterfly* Butterfly::growArrayRight(
+    VM& vm, JSCell* intendedOwner, Structure* oldStructure,
+    size_t newIndexingPayloadSizeInBytes)
+{
+    return growArrayRight(
+        vm, intendedOwner, oldStructure, oldStructure->outOfLineCapacity(),
+        oldStructure->hasIndexingHeader(intendedOwner), 
+        indexingHeader()->indexingPayloadSizeInBytes(oldStructure),
+        newIndexingPayloadSizeInBytes);
+}
+
+inline Butterfly* Butterfly::resizeArray(
+    VM& vm, JSCell* intendedOwner, size_t propertyCapacity, bool oldHasIndexingHeader,
+    size_t oldIndexingPayloadSizeInBytes, size_t newPreCapacity, bool newHasIndexingHeader,
+    size_t newIndexingPayloadSizeInBytes)
+{
+    Butterfly* result = createUninitialized(
+        vm, intendedOwner, newPreCapacity, propertyCapacity, newHasIndexingHeader,
+        newIndexingPayloadSizeInBytes);
+    // FIXME: This could be made much more efficient if we used the property size,
+    // not the capacity.
+    void* to = result->propertyStorage() - propertyCapacity;
+    void* from = propertyStorage() - propertyCapacity;
+    size_t size = std::min(
+        totalSize(0, propertyCapacity, oldHasIndexingHeader, oldIndexingPayloadSizeInBytes),
+        totalSize(0, propertyCapacity, newHasIndexingHeader, newIndexingPayloadSizeInBytes));
+    memcpy(to, from, size);
+    return result;
+}
+
+inline Butterfly* Butterfly::resizeArray(
+    VM& vm, JSCell* intendedOwner, Structure* structure, size_t newPreCapacity,
+    size_t newIndexingPayloadSizeInBytes)
+{
+    bool hasIndexingHeader = structure->hasIndexingHeader(intendedOwner);
+    return resizeArray(
+        vm, intendedOwner, structure->outOfLineCapacity(), hasIndexingHeader,
+        indexingHeader()->indexingPayloadSizeInBytes(structure), newPreCapacity,
+        hasIndexingHeader, newIndexingPayloadSizeInBytes);
+}
+
+inline Butterfly* Butterfly::unshift(Structure* structure, size_t numberOfSlots)
+{
+    ASSERT(hasAnyArrayStorage(structure->indexingType()));
+    ASSERT(numberOfSlots <= indexingHeader()->preCapacity(structure));
+    unsigned propertyCapacity = structure->outOfLineCapacity();
+    // FIXME: It would probably be wise to rewrite this as a loop since (1) we know in which
+    // direction we're moving memory so we don't need the extra check of memmove and (2) we're
+    // moving a small amount of memory in the common case so the throughput of memmove won't
+    // amortize the overhead of calling it. And no, we cannot rely on the C++ compiler to
+    // inline memmove (particularly since the size argument is likely to be variable), nor can
+    // we rely on the compiler to recognize the ordering of the pointer arguments (since
+    // propertyCapacity is variable and could cause wrap-around as far as the compiler knows).
+    memmove(
+        propertyStorage() - numberOfSlots - propertyCapacity,
+        propertyStorage() - propertyCapacity,
+        sizeof(EncodedJSValue) * propertyCapacity + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
+    return IndexingHeader::fromEndOf(propertyStorage() - numberOfSlots)->butterfly();
+}
+
+inline Butterfly* Butterfly::shift(Structure* structure, size_t numberOfSlots)
+{
+    ASSERT(hasAnyArrayStorage(structure->indexingType()));
+    unsigned propertyCapacity = structure->outOfLineCapacity();
+    // FIXME: See comment in unshift(), above.
+    memmove(
+        propertyStorage() - propertyCapacity + numberOfSlots,
+        propertyStorage() - propertyCapacity,
+        sizeof(EncodedJSValue) * propertyCapacity + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
+    return IndexingHeader::fromEndOf(propertyStorage() + numberOfSlots)->butterfly();
+}
+
+} // namespace JSC
diff --git a/runtime/CallData.cpp b/runtime/CallData.cpp
new file mode 100644
index 0000000..4402c62
--- /dev/null
+++ b/runtime/CallData.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CallData.h"
+
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "ScriptProfilingScope.h"
+
+namespace JSC {
+
+JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
+{
+    ASSERT(callType == CallType::JS || callType == CallType::Host);
+    return exec->interpreter()->executeCall(exec, asObject(functionObject), callType, callData, thisValue, args);
+}
+
+JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, NakedPtr<Exception>& returnedException)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    JSValue result = call(exec, functionObject, callType, callData, thisValue, args);
+    if (UNLIKELY(scope.exception())) {
+        returnedException = scope.exception();
+        scope.clearException();
+        return jsUndefined();
+    }
+    RELEASE_ASSERT(result);
+    return result;
+}
+
+JSValue profiledCall(ExecState* exec, ProfilingReason reason, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
+{
+    ScriptProfilingScope profilingScope(exec->vmEntryGlobalObject(), reason);
+    return call(exec, functionObject, callType, callData, thisValue, args);
+}
+
+JSValue profiledCall(ExecState* exec, ProfilingReason reason, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, NakedPtr<Exception>& returnedException)
+{
+    ScriptProfilingScope profilingScope(exec->vmEntryGlobalObject(), reason);
+    return call(exec, functionObject, callType, callData, thisValue, args, returnedException);
+}
+
+} // namespace JSC
diff --git a/runtime/CallData.h b/runtime/CallData.h
new file mode 100644
index 0000000..53043aa
--- /dev/null
+++ b/runtime/CallData.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include <wtf/NakedPtr.h>
+
+namespace JSC {
+
+class ArgList;
+class Exception;
+class ExecState;
+class FunctionExecutable;
+class JSObject;
+class JSScope;
+
+enum class CallType : unsigned {
+    None,
+    Host,
+    JS
+};
+
+typedef EncodedJSValue (JSC_HOST_CALL *NativeFunction)(ExecState*);
+
+struct CallData {
+    union {
+        struct {
+            NativeFunction function;
+        } native;
+        struct {
+            FunctionExecutable* functionExecutable;
+            JSScope* scope;
+        } js;
+    };
+};
+
+enum class ProfilingReason {
+    API,
+    Microtask,
+    Other
+};
+
+JS_EXPORT_PRIVATE JSValue call(ExecState*, JSValue functionObject, CallType, const CallData&, JSValue thisValue, const ArgList&);
+JS_EXPORT_PRIVATE JSValue call(ExecState*, JSValue functionObject, CallType, const CallData&, JSValue thisValue, const ArgList&, NakedPtr<Exception>& returnedException);
+
+JS_EXPORT_PRIVATE JSValue profiledCall(ExecState*, ProfilingReason, JSValue functionObject, CallType, const CallData&, JSValue thisValue, const ArgList&);
+JS_EXPORT_PRIVATE JSValue profiledCall(ExecState*, ProfilingReason, JSValue functionObject, CallType, const CallData&, JSValue thisValue, const ArgList&, NakedPtr<Exception>& returnedException);
+
+} // namespace JSC
diff --git a/runtime/CatchScope.cpp b/runtime/CatchScope.cpp
new file mode 100644
index 0000000..f7bb37a
--- /dev/null
+++ b/runtime/CatchScope.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CatchScope.h"
+
+namespace JSC {
+    
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+
+CatchScope::CatchScope(VM& vm, ExceptionEventLocation location)
+    : ExceptionScope(vm, location)
+{
+    m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);
+}
+
+CatchScope::~CatchScope()
+{
+    RELEASE_ASSERT(m_vm.m_topExceptionScope);
+    m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);
+}
+
+#endif // ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    
+} // namespace JSC
diff --git a/runtime/CatchScope.h b/runtime/CatchScope.h
new file mode 100644
index 0000000..1f2a8e7
--- /dev/null
+++ b/runtime/CatchScope.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ExceptionScope.h"
+
+namespace JSC {
+    
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    
+// If a function can clear JS exceptions, it should declare a CatchScope at the
+// top of the function (as early as possible) using the DECLARE_CATCH_SCOPE macro.
+// Declaring a CatchScope in a function means that the function intends to clear
+// pending exceptions before returning to its caller.
+    
+class CatchScope : public ExceptionScope {
+public:
+    JS_EXPORT_PRIVATE CatchScope(VM&, ExceptionEventLocation);
+    CatchScope(const CatchScope&) = delete;
+    CatchScope(CatchScope&&) = default;
+
+    JS_EXPORT_PRIVATE ~CatchScope();
+
+    void clearException() { m_vm.clearException(); }
+};
+
+#define DECLARE_CATCH_SCOPE(vm__) \
+    JSC::CatchScope((vm__), JSC::ExceptionEventLocation(__FUNCTION__, __FILE__, __LINE__))
+
+#else // not ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+
+class CatchScope : public ExceptionScope {
+public:
+    ALWAYS_INLINE CatchScope(VM& vm)
+        : ExceptionScope(vm)
+    { }
+    CatchScope(const CatchScope&) = delete;
+    CatchScope(CatchScope&&) = default;
+
+    ALWAYS_INLINE void clearException() { m_vm.clearException(); }
+};
+
+#define DECLARE_CATCH_SCOPE(vm__) \
+    JSC::CatchScope((vm__))
+
+#endif // ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+
+} // namespace JSC
diff --git a/runtime/ClassInfo.h b/runtime/ClassInfo.h
new file mode 100644
index 0000000..2b2157c
--- /dev/null
+++ b/runtime/ClassInfo.h
@@ -0,0 +1,211 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "ConstructData.h"
+#include "JSCell.h"
+
+namespace JSC {
+
+class HeapSnapshotBuilder;
+class JSArrayBufferView;
+struct HashTable;
+
+struct MethodTable {
+    typedef void (*DestroyFunctionPtr)(JSCell*);
+    DestroyFunctionPtr destroy;
+
+    typedef void (*VisitChildrenFunctionPtr)(JSCell*, SlotVisitor&);
+    VisitChildrenFunctionPtr visitChildren;
+    
+    typedef CallType (*GetCallDataFunctionPtr)(JSCell*, CallData&);
+    GetCallDataFunctionPtr getCallData;
+
+    typedef ConstructType (*GetConstructDataFunctionPtr)(JSCell*, ConstructData&);
+    GetConstructDataFunctionPtr getConstructData;
+
+    typedef bool (*PutFunctionPtr)(JSCell*, ExecState*, PropertyName propertyName, JSValue, PutPropertySlot&);
+    PutFunctionPtr put;
+
+    typedef bool (*PutByIndexFunctionPtr)(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    PutByIndexFunctionPtr putByIndex;
+
+    typedef bool (*DeletePropertyFunctionPtr)(JSCell*, ExecState*, PropertyName);
+    DeletePropertyFunctionPtr deleteProperty;
+
+    typedef bool (*DeletePropertyByIndexFunctionPtr)(JSCell*, ExecState*, unsigned);
+    DeletePropertyByIndexFunctionPtr deletePropertyByIndex;
+
+    typedef bool (*GetOwnPropertySlotFunctionPtr)(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    GetOwnPropertySlotFunctionPtr getOwnPropertySlot;
+
+    typedef bool (*GetOwnPropertySlotByIndexFunctionPtr)(JSObject*, ExecState*, unsigned, PropertySlot&);
+    GetOwnPropertySlotByIndexFunctionPtr getOwnPropertySlotByIndex;
+
+    typedef JSValue (*ToThisFunctionPtr)(JSCell*, ExecState*, ECMAMode);
+    ToThisFunctionPtr toThis;
+
+    typedef JSValue (*DefaultValueFunctionPtr)(const JSObject*, ExecState*, PreferredPrimitiveType);
+    DefaultValueFunctionPtr defaultValue;
+
+    typedef void (*GetOwnPropertyNamesFunctionPtr)(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    GetOwnPropertyNamesFunctionPtr getOwnPropertyNames;
+
+    typedef void (*GetOwnNonIndexPropertyNamesFunctionPtr)(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    GetOwnNonIndexPropertyNamesFunctionPtr getOwnNonIndexPropertyNames;
+
+    typedef void (*GetPropertyNamesFunctionPtr)(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    GetPropertyNamesFunctionPtr getPropertyNames;
+
+    typedef uint32_t (*GetEnumerableLengthFunctionPtr)(ExecState*, JSObject*);
+    GetEnumerableLengthFunctionPtr getEnumerableLength;
+
+    GetPropertyNamesFunctionPtr getStructurePropertyNames;
+    GetPropertyNamesFunctionPtr getGenericPropertyNames;
+
+    typedef String (*ClassNameFunctionPtr)(const JSObject*);
+    ClassNameFunctionPtr className;
+
+    typedef String (*ToStringNameFunctionPtr)(const JSObject*, ExecState*);
+    ToStringNameFunctionPtr toStringName;
+
+    typedef bool (*CustomHasInstanceFunctionPtr)(JSObject*, ExecState*, JSValue);
+    CustomHasInstanceFunctionPtr customHasInstance;
+
+    typedef bool (*DefineOwnPropertyFunctionPtr)(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool);
+    DefineOwnPropertyFunctionPtr defineOwnProperty;
+
+    typedef ArrayBuffer* (*SlowDownAndWasteMemory)(JSArrayBufferView*);
+    SlowDownAndWasteMemory slowDownAndWasteMemory;
+    
+    typedef PassRefPtr<ArrayBufferView> (*GetTypedArrayImpl)(JSArrayBufferView*);
+    GetTypedArrayImpl getTypedArrayImpl;
+
+    typedef bool (*PreventExtensionsFunctionPtr)(JSObject*, ExecState*);
+    PreventExtensionsFunctionPtr preventExtensions;
+
+    typedef bool (*IsExtensibleFunctionPtr)(JSObject*, ExecState*);
+    IsExtensibleFunctionPtr isExtensible;
+
+    typedef bool (*SetPrototypeFunctionPtr)(JSObject*, ExecState*, JSValue, bool shouldThrowIfCantSet);
+    SetPrototypeFunctionPtr setPrototype;
+
+    typedef JSValue (*GetPrototypeFunctionPtr)(JSObject*, ExecState*);
+    GetPrototypeFunctionPtr getPrototype;
+
+    typedef void (*DumpToStreamFunctionPtr)(const JSCell*, PrintStream&);
+    DumpToStreamFunctionPtr dumpToStream;
+
+    typedef void (*HeapSnapshotFunctionPtr)(JSCell*, HeapSnapshotBuilder&);
+    HeapSnapshotFunctionPtr heapSnapshot;
+
+    typedef size_t (*EstimatedSizeFunctionPtr)(JSCell*);
+    EstimatedSizeFunctionPtr estimatedSize;
+    
+    typedef void (*VisitOutputConstraintsPtr)(JSCell*, SlotVisitor&);
+    VisitOutputConstraintsPtr visitOutputConstraints;
+};
+
+#define CREATE_MEMBER_CHECKER(member) \
+    template <typename T> \
+    struct MemberCheck##member { \
+        struct Fallback { \
+            void member(...); \
+        }; \
+        struct Derived : T, Fallback { }; \
+        template <typename U, U> struct Check; \
+        typedef char Yes[2]; \
+        typedef char No[1]; \
+        template <typename U> \
+        static No &func(Check<void (Fallback::*)(...), &U::member>*); \
+        template <typename U> \
+        static Yes &func(...); \
+        enum { has = sizeof(func<Derived>(0)) == sizeof(Yes) }; \
+    }
+
+#define HAS_MEMBER_NAMED(klass, name) (MemberCheck##name<klass>::has)
+
+#define CREATE_METHOD_TABLE(ClassName) { \
+        &ClassName::destroy, \
+        &ClassName::visitChildren, \
+        &ClassName::getCallData, \
+        &ClassName::getConstructData, \
+        &ClassName::put, \
+        &ClassName::putByIndex, \
+        &ClassName::deleteProperty, \
+        &ClassName::deletePropertyByIndex, \
+        &ClassName::getOwnPropertySlot, \
+        &ClassName::getOwnPropertySlotByIndex, \
+        &ClassName::toThis, \
+        &ClassName::defaultValue, \
+        &ClassName::getOwnPropertyNames, \
+        &ClassName::getOwnNonIndexPropertyNames, \
+        &ClassName::getPropertyNames, \
+        &ClassName::getEnumerableLength, \
+        &ClassName::getStructurePropertyNames, \
+        &ClassName::getGenericPropertyNames, \
+        &ClassName::className, \
+        &ClassName::toStringName, \
+        &ClassName::customHasInstance, \
+        &ClassName::defineOwnProperty, \
+        &ClassName::slowDownAndWasteMemory, \
+        &ClassName::getTypedArrayImpl, \
+        &ClassName::preventExtensions, \
+        &ClassName::isExtensible, \
+        &ClassName::setPrototype, \
+        &ClassName::getPrototype, \
+        &ClassName::dumpToStream, \
+        &ClassName::heapSnapshot, \
+        &ClassName::estimatedSize, \
+        &ClassName::visitOutputConstraints \
+    }, \
+    ClassName::TypedArrayStorageType
+
+struct ClassInfo {
+    // A string denoting the class name. Example: "Window".
+    const char* className;
+
+    // Pointer to the class information of the base class.
+    // nullptrif there is none.
+    const ClassInfo* parentClass;
+
+    bool isSubClassOf(const ClassInfo* other) const
+    {
+        for (const ClassInfo* ci = this; ci; ci = ci->parentClass) {
+            if (ci == other)
+                return true;
+        }
+        return false;
+    }
+
+    JS_EXPORT_PRIVATE bool hasStaticSetterOrReadonlyProperties() const;
+
+    const HashTable* staticPropHashTable;
+
+    MethodTable methodTable;
+
+    TypedArrayType typedArrayStorageType;
+};
+
+} // namespace JSC
diff --git a/runtime/ClonedArguments.cpp b/runtime/ClonedArguments.cpp
new file mode 100644
index 0000000..b7bdfad
--- /dev/null
+++ b/runtime/ClonedArguments.cpp
@@ -0,0 +1,280 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ClonedArguments.h"
+
+#include "GetterSetter.h"
+#include "InlineCallFrame.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ClonedArguments);
+
+const ClassInfo ClonedArguments::s_info = { "Arguments", &Base::s_info, 0, CREATE_METHOD_TABLE(ClonedArguments) };
+
+ClonedArguments::ClonedArguments(VM& vm, Structure* structure, Butterfly* butterfly)
+    : Base(vm, structure, butterfly)
+{
+}
+
+ClonedArguments* ClonedArguments::createEmpty(
+    VM& vm, Structure* structure, JSFunction* callee, unsigned length)
+{
+    unsigned vectorLength = length;
+    if (vectorLength > MAX_STORAGE_VECTOR_LENGTH)
+        return 0;
+
+    Butterfly* butterfly;
+    if (UNLIKELY(structure->needsSlowPutIndexing())) {
+        butterfly = createArrayStorageButterfly(vm, nullptr, structure, length, vectorLength);
+        butterfly->arrayStorage()->m_numValuesInVector = vectorLength;
+
+    } else {
+        void* temp = vm.auxiliarySpace.tryAllocate(Butterfly::totalSize(0, structure->outOfLineCapacity(), true, vectorLength * sizeof(EncodedJSValue)));
+        if (!temp)
+            return 0;
+        butterfly = Butterfly::fromBase(temp, 0, structure->outOfLineCapacity());
+        butterfly->setVectorLength(vectorLength);
+        butterfly->setPublicLength(length);
+        
+        for (unsigned i = length; i < vectorLength; ++i)
+            butterfly->contiguous()[i].clear();
+    }
+    
+    ClonedArguments* result =
+        new (NotNull, allocateCell<ClonedArguments>(vm.heap))
+        ClonedArguments(vm, structure, butterfly);
+    result->finishCreation(vm);
+
+    result->m_callee.set(vm, result, callee);
+    result->putDirect(vm, clonedArgumentsLengthPropertyOffset, jsNumber(length));
+    return result;
+}
+
+ClonedArguments* ClonedArguments::createEmpty(ExecState* exec, JSFunction* callee, unsigned length)
+{
+    VM& vm = exec->vm();
+    // NB. Some clients might expect that the global object of of this object is the global object
+    // of the callee. We don't do this for now, but maybe we should.
+    ClonedArguments* result = createEmpty(vm, exec->lexicalGlobalObject()->clonedArgumentsStructure(), callee, length);
+    ASSERT(!result->structure(vm)->needsSlowPutIndexing() || shouldUseSlowPut(result->structure(vm)->indexingType()));
+    return result;
+}
+
+ClonedArguments* ClonedArguments::createWithInlineFrame(ExecState* myFrame, ExecState* targetFrame, InlineCallFrame* inlineCallFrame, ArgumentsMode mode)
+{
+    VM& vm = myFrame->vm();
+    
+    JSFunction* callee;
+    
+    if (inlineCallFrame)
+        callee = jsCast<JSFunction*>(inlineCallFrame->calleeRecovery.recover(targetFrame));
+    else
+        callee = jsCast<JSFunction*>(targetFrame->jsCallee());
+
+    ClonedArguments* result = nullptr;
+    
+    unsigned length = 0; // Initialize because VC needs it.
+    switch (mode) {
+    case ArgumentsMode::Cloned: {
+        if (inlineCallFrame) {
+            if (inlineCallFrame->argumentCountRegister.isValid())
+                length = targetFrame->r(inlineCallFrame->argumentCountRegister).unboxedInt32();
+            else
+                length = inlineCallFrame->arguments.size();
+            length--;
+            result = createEmpty(myFrame, callee, length);
+
+            for (unsigned i = length; i--;)
+                result->initializeIndex(vm, i, inlineCallFrame->arguments[i + 1].recover(targetFrame));
+        } else {
+            length = targetFrame->argumentCount();
+            result = createEmpty(myFrame, callee, length);
+
+            for (unsigned i = length; i--;)
+                result->initializeIndex(vm, i, targetFrame->uncheckedArgument(i));
+        }
+        break;
+    }
+        
+    case ArgumentsMode::FakeValues: {
+        result = createEmpty(myFrame, callee, 0);
+        break;
+    } }
+
+    ASSERT(myFrame->lexicalGlobalObject()->clonedArgumentsStructure() == result->structure());
+    ASSERT(!result->structure(vm)->needsSlowPutIndexing() || shouldUseSlowPut(result->structure(vm)->indexingType()));
+    return result;
+}
+
+ClonedArguments* ClonedArguments::createWithMachineFrame(ExecState* myFrame, ExecState* targetFrame, ArgumentsMode mode)
+{
+    ClonedArguments* result = createWithInlineFrame(myFrame, targetFrame, nullptr, mode);
+    ASSERT(!result->structure()->needsSlowPutIndexing() || shouldUseSlowPut(result->structure()->indexingType()));
+    return result;
+}
+
+ClonedArguments* ClonedArguments::createByCopyingFrom(
+    ExecState* exec, Structure* structure, Register* argumentStart, unsigned length,
+    JSFunction* callee)
+{
+    VM& vm = exec->vm();
+    ClonedArguments* result = createEmpty(vm, structure, callee, length);
+    
+    for (unsigned i = length; i--;)
+        result->initializeIndex(vm, i, argumentStart[i].jsValue());
+    ASSERT(!result->structure(vm)->needsSlowPutIndexing() || shouldUseSlowPut(result->structure(vm)->indexingType()));
+    return result;
+}
+
+Structure* ClonedArguments::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, IndexingType indexingType)
+{
+    Structure* structure = Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info(), indexingType);
+    PropertyOffset offset;
+    structure = structure->addPropertyTransition(vm, structure, vm.propertyNames->length, DontEnum, offset);
+    ASSERT(offset == clonedArgumentsLengthPropertyOffset);
+    return structure;
+}
+
+Structure* ClonedArguments::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    // We use contiguous storage because optimizations in the FTL assume that cloned arguments creation always produces the same initial structure.
+    return createStructure(vm, globalObject, prototype, NonArrayWithContiguous);
+}
+
+Structure* ClonedArguments::createSlowPutStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return createStructure(vm, globalObject, prototype, NonArrayWithSlowPutArrayStorage);
+}
+
+bool ClonedArguments::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName ident, PropertySlot& slot)
+{
+    ClonedArguments* thisObject = jsCast<ClonedArguments*>(object);
+    VM& vm = exec->vm();
+
+    if (!thisObject->specialsMaterialized()) {
+        FunctionExecutable* executable = jsCast<FunctionExecutable*>(thisObject->m_callee->executable());
+        bool isStrictMode = executable->isStrictMode();
+
+        if (ident == vm.propertyNames->callee) {
+            if (isStrictMode) {
+                slot.setGetterSlot(thisObject, DontDelete | DontEnum | Accessor, thisObject->globalObject()->throwTypeErrorArgumentsCalleeAndCallerGetterSetter());
+                return true;
+            }
+            slot.setValue(thisObject, 0, thisObject->m_callee.get());
+            return true;
+        }
+
+        if (ident == vm.propertyNames->iteratorSymbol) {
+            slot.setValue(thisObject, DontEnum, thisObject->globalObject()->arrayProtoValuesFunction());
+            return true;
+        }
+    }
+
+    return Base::getOwnPropertySlot(thisObject, exec, ident, slot);
+}
+
+void ClonedArguments::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& array, EnumerationMode mode)
+{
+    ClonedArguments* thisObject = jsCast<ClonedArguments*>(object);
+    thisObject->materializeSpecialsIfNecessary(exec);
+    Base::getOwnPropertyNames(thisObject, exec, array, mode);
+}
+
+bool ClonedArguments::put(JSCell* cell, ExecState* exec, PropertyName ident, JSValue value, PutPropertySlot& slot)
+{
+    ClonedArguments* thisObject = jsCast<ClonedArguments*>(cell);
+    VM& vm = exec->vm();
+    
+    if (ident == vm.propertyNames->callee
+        || ident == vm.propertyNames->iteratorSymbol) {
+        thisObject->materializeSpecialsIfNecessary(exec);
+        PutPropertySlot dummy = slot; // Shadow the given PutPropertySlot to prevent caching.
+        return Base::put(thisObject, exec, ident, value, dummy);
+    }
+    
+    return Base::put(thisObject, exec, ident, value, slot);
+}
+
+bool ClonedArguments::deleteProperty(JSCell* cell, ExecState* exec, PropertyName ident)
+{
+    ClonedArguments* thisObject = jsCast<ClonedArguments*>(cell);
+    VM& vm = exec->vm();
+    
+    if (ident == vm.propertyNames->callee
+        || ident == vm.propertyNames->iteratorSymbol)
+        thisObject->materializeSpecialsIfNecessary(exec);
+    
+    return Base::deleteProperty(thisObject, exec, ident);
+}
+
+bool ClonedArguments::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName ident, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    ClonedArguments* thisObject = jsCast<ClonedArguments*>(object);
+    VM& vm = exec->vm();
+    
+    if (ident == vm.propertyNames->callee
+        || ident == vm.propertyNames->iteratorSymbol)
+        thisObject->materializeSpecialsIfNecessary(exec);
+    
+    return Base::defineOwnProperty(object, exec, ident, descriptor, shouldThrow);
+}
+
+void ClonedArguments::materializeSpecials(ExecState* exec)
+{
+    RELEASE_ASSERT(!specialsMaterialized());
+    VM& vm = exec->vm();
+    
+    FunctionExecutable* executable = jsCast<FunctionExecutable*>(m_callee->executable());
+    bool isStrictMode = executable->isStrictMode();
+    
+    if (isStrictMode)
+        putDirectAccessor(exec, vm.propertyNames->callee, globalObject()->throwTypeErrorArgumentsCalleeAndCallerGetterSetter(), DontDelete | DontEnum | Accessor);
+    else
+        putDirect(vm, vm.propertyNames->callee, JSValue(m_callee.get()));
+
+    putDirect(vm, vm.propertyNames->iteratorSymbol, globalObject()->arrayProtoValuesFunction(), DontEnum);
+    
+    m_callee.clear();
+}
+
+void ClonedArguments::materializeSpecialsIfNecessary(ExecState* exec)
+{
+    if (!specialsMaterialized())
+        materializeSpecials(exec);
+}
+
+void ClonedArguments::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    ClonedArguments* thisObject = jsCast<ClonedArguments*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_callee);
+}
+
+} // namespace JSC
+
diff --git a/runtime/ClonedArguments.h b/runtime/ClonedArguments.h
new file mode 100644
index 0000000..7601c5c
--- /dev/null
+++ b/runtime/ClonedArguments.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArgumentsMode.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+// This is an Arguments-class object that we create when you do function.arguments, or you say
+// "arguments" inside a function in strict mode. It behaves almpst entirely like an ordinary
+// JavaScript object. All of the arguments values are simply copied from the stack (possibly via
+// some sophisticated ValueRecovery's if an optimizing compiler is in play) and the appropriate
+// properties of the object are populated. The only reason why we need a special class is to make
+// the object claim to be "Arguments" from a toString standpoint, and to avoid materializing the
+// caller/callee/@@iterator properties unless someone asks for them.
+class ClonedArguments : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
+    
+private:
+    ClonedArguments(VM&, Structure*, Butterfly*);
+
+public:
+    static ClonedArguments* createEmpty(VM&, Structure*, JSFunction* callee, unsigned length);
+    static ClonedArguments* createEmpty(ExecState*, JSFunction* callee, unsigned length);
+    static ClonedArguments* createWithInlineFrame(ExecState* myFrame, ExecState* targetFrame, InlineCallFrame*, ArgumentsMode);
+    static ClonedArguments* createWithMachineFrame(ExecState* myFrame, ExecState* targetFrame, ArgumentsMode);
+    static ClonedArguments* createByCopyingFrom(ExecState*, Structure*, Register* argumentsStart, unsigned length, JSFunction* callee);
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+    static Structure* createSlowPutStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    DECLARE_INFO;
+
+private:
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype, IndexingType);
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    
+    bool specialsMaterialized() const { return !m_callee; }
+    void materializeSpecials(ExecState*);
+    void materializeSpecialsIfNecessary(ExecState*);
+    
+    WriteBarrier<JSFunction> m_callee; // Set to nullptr when we materialize all of our special properties.
+};
+
+static const PropertyOffset clonedArgumentsLengthPropertyOffset = 100;
+
+} // namespace JSC
diff --git a/runtime/CodeCache.cpp b/runtime/CodeCache.cpp
new file mode 100644
index 0000000..6c1c0c0
--- /dev/null
+++ b/runtime/CodeCache.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CodeCache.h"
+
+#include "IndirectEvalExecutable.h"
+
+namespace JSC {
+
+const double CodeCacheMap::workingSetTime = 10.0;
+
+void CodeCacheMap::pruneSlowCase()
+{
+    m_minCapacity = std::max(m_size - m_sizeAtLastPrune, static_cast<int64_t>(0));
+    m_sizeAtLastPrune = m_size;
+    m_timeAtLastPrune = monotonicallyIncreasingTime();
+
+    if (m_capacity < m_minCapacity)
+        m_capacity = m_minCapacity;
+
+    while (m_size > m_capacity || !canPruneQuickly()) {
+        MapType::iterator it = m_map.begin();
+        m_size -= it->key.length();
+        m_map.remove(it);
+    }
+}
+
+template <class UnlinkedCodeBlockType, class ExecutableType>
+UnlinkedCodeBlockType* CodeCache::getUnlinkedGlobalCodeBlock(VM& vm, ExecutableType* executable, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, DebuggerMode debuggerMode, ParserError& error, EvalContextType evalContextType)
+{
+    DerivedContextType derivedContextType = executable->derivedContextType();
+    bool isArrowFunctionContext = executable->isArrowFunctionContext();
+    SourceCodeKey key(
+        source, String(), CacheTypes<UnlinkedCodeBlockType>::codeType, strictMode, scriptMode, 
+        derivedContextType, evalContextType, isArrowFunctionContext, debuggerMode, 
+        vm.typeProfiler() ? TypeProfilerEnabled::Yes : TypeProfilerEnabled::No, 
+        vm.controlFlowProfiler() ? ControlFlowProfilerEnabled::Yes : ControlFlowProfilerEnabled::No);
+    SourceCodeValue* cache = m_sourceCode.findCacheAndUpdateAge(key);
+    if (cache && Options::useCodeCache()) {
+        UnlinkedCodeBlockType* unlinkedCodeBlock = jsCast<UnlinkedCodeBlockType*>(cache->cell.get());
+        unsigned lineCount = unlinkedCodeBlock->lineCount();
+        unsigned startColumn = unlinkedCodeBlock->startColumn() + source.startColumn().oneBasedInt();
+        bool endColumnIsOnStartLine = !lineCount;
+        unsigned endColumn = unlinkedCodeBlock->endColumn() + (endColumnIsOnStartLine ? startColumn : 1);
+        executable->recordParse(unlinkedCodeBlock->codeFeatures(), unlinkedCodeBlock->hasCapturedVariables(), source.firstLine().oneBasedInt() + lineCount, endColumn);
+        source.provider()->setSourceURLDirective(unlinkedCodeBlock->sourceURLDirective());
+        source.provider()->setSourceMappingURLDirective(unlinkedCodeBlock->sourceMappingURLDirective());
+        return unlinkedCodeBlock;
+    }
+    
+    VariableEnvironment variablesUnderTDZ;
+    UnlinkedCodeBlockType* unlinkedCodeBlock = generateUnlinkedCodeBlock<UnlinkedCodeBlockType, ExecutableType>(vm, executable, source, strictMode, scriptMode, debuggerMode, error, evalContextType, &variablesUnderTDZ);
+
+    if (unlinkedCodeBlock && Options::useCodeCache())
+        m_sourceCode.addCache(key, SourceCodeValue(vm, unlinkedCodeBlock, m_sourceCode.age()));
+
+    return unlinkedCodeBlock;
+}
+
+UnlinkedProgramCodeBlock* CodeCache::getUnlinkedProgramCodeBlock(VM& vm, ProgramExecutable* executable, const SourceCode& source, JSParserStrictMode strictMode, DebuggerMode debuggerMode, ParserError& error)
+{
+    return getUnlinkedGlobalCodeBlock<UnlinkedProgramCodeBlock>(vm, executable, source, strictMode, JSParserScriptMode::Classic, debuggerMode, error, EvalContextType::None);
+}
+
+UnlinkedEvalCodeBlock* CodeCache::getUnlinkedEvalCodeBlock(VM& vm, IndirectEvalExecutable* executable, const SourceCode& source, JSParserStrictMode strictMode, DebuggerMode debuggerMode, ParserError& error, EvalContextType evalContextType)
+{
+    return getUnlinkedGlobalCodeBlock<UnlinkedEvalCodeBlock>(vm, executable, source, strictMode, JSParserScriptMode::Classic, debuggerMode, error, evalContextType);
+}
+
+UnlinkedModuleProgramCodeBlock* CodeCache::getUnlinkedModuleProgramCodeBlock(VM& vm, ModuleProgramExecutable* executable, const SourceCode& source, DebuggerMode debuggerMode, ParserError& error)
+{
+    return getUnlinkedGlobalCodeBlock<UnlinkedModuleProgramCodeBlock>(vm, executable, source, JSParserStrictMode::Strict, JSParserScriptMode::Module, debuggerMode, error, EvalContextType::None);
+}
+
+UnlinkedFunctionExecutable* CodeCache::getUnlinkedGlobalFunctionExecutable(VM& vm, const Identifier& name, const SourceCode& source, DebuggerMode debuggerMode, ParserError& error)
+{
+    bool isArrowFunctionContext = false;
+    SourceCodeKey key(
+        source, name.string(), SourceCodeType::FunctionType,
+        JSParserStrictMode::NotStrict,
+        JSParserScriptMode::Classic,
+        DerivedContextType::None,
+        EvalContextType::None,
+        isArrowFunctionContext,
+        debuggerMode, 
+        vm.typeProfiler() ? TypeProfilerEnabled::Yes : TypeProfilerEnabled::No, 
+        vm.controlFlowProfiler() ? ControlFlowProfilerEnabled::Yes : ControlFlowProfilerEnabled::No);
+    SourceCodeValue* cache = m_sourceCode.findCacheAndUpdateAge(key);
+    if (cache && Options::useCodeCache()) {
+        UnlinkedFunctionExecutable* executable = jsCast<UnlinkedFunctionExecutable*>(cache->cell.get());
+        source.provider()->setSourceURLDirective(executable->sourceURLDirective());
+        source.provider()->setSourceMappingURLDirective(executable->sourceMappingURLDirective());
+        return executable;
+    }
+
+    JSTextPosition positionBeforeLastNewline;
+    std::unique_ptr<ProgramNode> program = parse<ProgramNode>(
+        &vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin,
+        JSParserStrictMode::NotStrict, JSParserScriptMode::Classic, SourceParseMode::ProgramMode, SuperBinding::NotNeeded,
+        error, &positionBeforeLastNewline);
+    if (!program) {
+        RELEASE_ASSERT(error.isValid());
+        return nullptr;
+    }
+
+    // This function assumes an input string that would result in a single function declaration.
+    StatementNode* statement = program->singleStatement();
+    if (UNLIKELY(!statement)) {
+        JSToken token;
+        error = ParserError(ParserError::SyntaxError, ParserError::SyntaxErrorIrrecoverable, token, "Parser error", -1);
+        return nullptr;
+    }
+    ASSERT(statement->isBlock());
+
+    StatementNode* funcDecl = static_cast<BlockNode*>(statement)->singleStatement();
+    if (UNLIKELY(!funcDecl)) {
+        JSToken token;
+        error = ParserError(ParserError::SyntaxError, ParserError::SyntaxErrorIrrecoverable, token, "Parser error", -1);
+        return nullptr;
+    }
+    ASSERT(funcDecl->isFuncDeclNode());
+
+    FunctionMetadataNode* metadata = static_cast<FuncDeclNode*>(funcDecl)->metadata();
+    ASSERT(metadata);
+    if (!metadata)
+        return nullptr;
+    
+    metadata->overrideName(name);
+    metadata->setEndPosition(positionBeforeLastNewline);
+    // The Function constructor only has access to global variables, so no variables will be under TDZ.
+    VariableEnvironment emptyTDZVariables;
+    ConstructAbility constructAbility = constructAbilityForParseMode(metadata->parseMode());
+    UnlinkedFunctionExecutable* functionExecutable = UnlinkedFunctionExecutable::create(&vm, source, metadata, UnlinkedNormalFunction, constructAbility, JSParserScriptMode::Classic, emptyTDZVariables, DerivedContextType::None);
+
+    functionExecutable->setSourceURLDirective(source.provider()->sourceURL());
+    functionExecutable->setSourceMappingURLDirective(source.provider()->sourceMappingURL());
+
+    m_sourceCode.addCache(key, SourceCodeValue(vm, functionExecutable, m_sourceCode.age()));
+    return functionExecutable;
+}
+
+}
diff --git a/runtime/CodeCache.h b/runtime/CodeCache.h
new file mode 100644
index 0000000..b4ab8e5
--- /dev/null
+++ b/runtime/CodeCache.h
@@ -0,0 +1,261 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "BytecodeGenerator.h"
+#include "ExecutableInfo.h"
+#include "JSCInlines.h"
+#include "Parser.h"
+#include "ParserModes.h"
+#include "SourceCodeKey.h"
+#include "Strong.h"
+#include "StrongInlines.h"
+#include "UnlinkedCodeBlock.h"
+#include "UnlinkedEvalCodeBlock.h"
+#include "UnlinkedModuleProgramCodeBlock.h"
+#include "UnlinkedProgramCodeBlock.h"
+#include "UnlinkedSourceCode.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/Forward.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class EvalExecutable;
+class IndirectEvalExecutable;
+class Identifier;
+class DirectEvalExecutable;
+class ModuleProgramExecutable;
+class ParserError;
+class ProgramExecutable;
+class SourceCode;
+class UnlinkedCodeBlock;
+class UnlinkedEvalCodeBlock;
+class UnlinkedFunctionExecutable;
+class UnlinkedModuleProgramCodeBlock;
+class UnlinkedProgramCodeBlock;
+class VM;
+class VariableEnvironment;
+
+struct SourceCodeValue {
+    SourceCodeValue()
+    {
+    }
+
+    SourceCodeValue(VM& vm, JSCell* cell, int64_t age)
+        : cell(vm, cell)
+        , age(age)
+    {
+    }
+
+    Strong<JSCell> cell;
+    int64_t age;
+};
+
+class CodeCacheMap {
+public:
+    typedef HashMap<SourceCodeKey, SourceCodeValue, SourceCodeKey::Hash, SourceCodeKey::HashTraits> MapType;
+    typedef MapType::iterator iterator;
+    typedef MapType::AddResult AddResult;
+
+    CodeCacheMap()
+        : m_size(0)
+        , m_sizeAtLastPrune(0)
+        , m_timeAtLastPrune(monotonicallyIncreasingTime())
+        , m_minCapacity(0)
+        , m_capacity(0)
+        , m_age(0)
+    {
+    }
+
+    SourceCodeValue* findCacheAndUpdateAge(const SourceCodeKey& key)
+    {
+        prune();
+
+        iterator findResult = m_map.find(key);
+        if (findResult == m_map.end())
+            return nullptr;
+
+        int64_t age = m_age - findResult->value.age;
+        if (age > m_capacity) {
+            // A requested object is older than the cache's capacity. We can
+            // infer that requested objects are subject to high eviction probability,
+            // so we grow the cache to improve our hit rate.
+            m_capacity += recencyBias * oldObjectSamplingMultiplier * key.length();
+        } else if (age < m_capacity / 2) {
+            // A requested object is much younger than the cache's capacity. We can
+            // infer that requested objects are subject to low eviction probability,
+            // so we shrink the cache to save memory.
+            m_capacity -= recencyBias * key.length();
+            if (m_capacity < m_minCapacity)
+                m_capacity = m_minCapacity;
+        }
+
+        findResult->value.age = m_age;
+        m_age += key.length();
+
+        return &findResult->value;
+    }
+
+    AddResult addCache(const SourceCodeKey& key, const SourceCodeValue& value)
+    {
+        prune();
+
+        AddResult addResult = m_map.add(key, value);
+        ASSERT(addResult.isNewEntry);
+
+        m_size += key.length();
+        m_age += key.length();
+        return addResult;
+    }
+
+    void remove(iterator it)
+    {
+        m_size -= it->key.length();
+        m_map.remove(it);
+    }
+
+    void clear()
+    {
+        m_size = 0;
+        m_age = 0;
+        m_map.clear();
+    }
+
+    int64_t age() { return m_age; }
+
+private:
+    // This constant factor biases cache capacity toward allowing a minimum
+    // working set to enter the cache before it starts evicting.
+    static const double workingSetTime;
+    static const int64_t workingSetMaxBytes = 16000000;
+    static const size_t workingSetMaxEntries = 2000;
+
+    // This constant factor biases cache capacity toward recent activity. We
+    // want to adapt to changing workloads.
+    static const int64_t recencyBias = 4;
+
+    // This constant factor treats a sampled event for one old object as if it
+    // happened for many old objects. Most old objects are evicted before we can
+    // sample them, so we need to extrapolate from the ones we do sample.
+    static const int64_t oldObjectSamplingMultiplier = 32;
+
+    size_t numberOfEntries() const { return static_cast<size_t>(m_map.size()); }
+    bool canPruneQuickly() const { return numberOfEntries() < workingSetMaxEntries; }
+
+    void pruneSlowCase();
+    void prune()
+    {
+        if (m_size <= m_capacity && canPruneQuickly())
+            return;
+
+        if (monotonicallyIncreasingTime() - m_timeAtLastPrune < workingSetTime
+            && m_size - m_sizeAtLastPrune < workingSetMaxBytes
+            && canPruneQuickly())
+                return;
+
+        pruneSlowCase();
+    }
+
+    MapType m_map;
+    int64_t m_size;
+    int64_t m_sizeAtLastPrune;
+    double m_timeAtLastPrune;
+    int64_t m_minCapacity;
+    int64_t m_capacity;
+    int64_t m_age;
+};
+
+// Caches top-level code such as <script>, window.eval(), new Function, and JSEvaluateScript().
+class CodeCache {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    UnlinkedProgramCodeBlock* getUnlinkedProgramCodeBlock(VM&, ProgramExecutable*, const SourceCode&, JSParserStrictMode, DebuggerMode, ParserError&);
+    UnlinkedEvalCodeBlock* getUnlinkedEvalCodeBlock(VM&, IndirectEvalExecutable*, const SourceCode&, JSParserStrictMode, DebuggerMode, ParserError&, EvalContextType);
+    UnlinkedModuleProgramCodeBlock* getUnlinkedModuleProgramCodeBlock(VM&, ModuleProgramExecutable*, const SourceCode&, DebuggerMode, ParserError&);
+    UnlinkedFunctionExecutable* getUnlinkedGlobalFunctionExecutable(VM&, const Identifier&, const SourceCode&, DebuggerMode, ParserError&);
+
+    void clear() { m_sourceCode.clear(); }
+
+private:
+    template <class UnlinkedCodeBlockType, class ExecutableType> 
+    UnlinkedCodeBlockType* getUnlinkedGlobalCodeBlock(VM&, ExecutableType*, const SourceCode&, JSParserStrictMode, JSParserScriptMode, DebuggerMode, ParserError&, EvalContextType);
+
+    CodeCacheMap m_sourceCode;
+};
+
+template <typename T> struct CacheTypes { };
+
+template <> struct CacheTypes<UnlinkedProgramCodeBlock> {
+    typedef JSC::ProgramNode RootNode;
+    static const SourceCodeType codeType = SourceCodeType::ProgramType;
+    static const SourceParseMode parseMode = SourceParseMode::ProgramMode;
+};
+
+template <> struct CacheTypes<UnlinkedEvalCodeBlock> {
+    typedef JSC::EvalNode RootNode;
+    static const SourceCodeType codeType = SourceCodeType::EvalType;
+    static const SourceParseMode parseMode = SourceParseMode::ProgramMode;
+};
+
+template <> struct CacheTypes<UnlinkedModuleProgramCodeBlock> {
+    typedef JSC::ModuleProgramNode RootNode;
+    static const SourceCodeType codeType = SourceCodeType::ModuleType;
+    static const SourceParseMode parseMode = SourceParseMode::ModuleEvaluateMode;
+};
+
+template <class UnlinkedCodeBlockType, class ExecutableType>
+UnlinkedCodeBlockType* generateUnlinkedCodeBlock(VM& vm, ExecutableType* executable, const SourceCode& source, JSParserStrictMode strictMode, JSParserScriptMode scriptMode, DebuggerMode debuggerMode, ParserError& error, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
+{
+    typedef typename CacheTypes<UnlinkedCodeBlockType>::RootNode RootNode;
+    DerivedContextType derivedContextType = executable->derivedContextType();
+    std::unique_ptr<RootNode> rootNode = parse<RootNode>(
+        &vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin, strictMode, scriptMode, CacheTypes<UnlinkedCodeBlockType>::parseMode, SuperBinding::NotNeeded, error, nullptr, ConstructorKind::None, derivedContextType, evalContextType);
+    if (!rootNode)
+        return nullptr;
+
+    unsigned lineCount = rootNode->lastLine() - rootNode->firstLine();
+    unsigned startColumn = rootNode->startColumn() + 1;
+    bool endColumnIsOnStartLine = !lineCount;
+    unsigned unlinkedEndColumn = rootNode->endColumn();
+    unsigned endColumn = unlinkedEndColumn + (endColumnIsOnStartLine ? startColumn : 1);
+    unsigned arrowContextFeature = executable->isArrowFunctionContext() ? ArrowFunctionContextFeature : 0;
+    executable->recordParse(rootNode->features() | arrowContextFeature, rootNode->hasCapturedVariables(), rootNode->lastLine(), endColumn);
+
+    UnlinkedCodeBlockType* unlinkedCodeBlock = UnlinkedCodeBlockType::create(&vm, executable->executableInfo(), debuggerMode);
+    unlinkedCodeBlock->recordParse(rootNode->features(), rootNode->hasCapturedVariables(), lineCount, unlinkedEndColumn);
+    unlinkedCodeBlock->setSourceURLDirective(source.provider()->sourceURL());
+    unlinkedCodeBlock->setSourceMappingURLDirective(source.provider()->sourceMappingURL());
+
+    error = BytecodeGenerator::generate(vm, rootNode.get(), unlinkedCodeBlock, debuggerMode, variablesUnderTDZ);
+
+    if (error.isValid())
+        return nullptr;
+
+    return unlinkedCodeBlock;
+}
+
+} // namespace JSC
diff --git a/runtime/CodeSpecializationKind.cpp b/runtime/CodeSpecializationKind.cpp
new file mode 100644
index 0000000..202a1d9
--- /dev/null
+++ b/runtime/CodeSpecializationKind.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CodeSpecializationKind.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::CodeSpecializationKind kind)
+{
+    if (kind == JSC::CodeForCall) {
+        out.print("Call");
+        return;
+    }
+    
+    ASSERT(kind == JSC::CodeForConstruct);
+    out.print("Construct");
+}
+
+} // namespace WTF
+
+
+
diff --git a/runtime/CodeSpecializationKind.h b/runtime/CodeSpecializationKind.h
new file mode 100644
index 0000000..7500861
--- /dev/null
+++ b/runtime/CodeSpecializationKind.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum CodeSpecializationKind { CodeForCall, CodeForConstruct };
+
+inline CodeSpecializationKind specializationFromIsCall(bool isCall)
+{
+    return isCall ? CodeForCall : CodeForConstruct;
+}
+
+inline CodeSpecializationKind specializationFromIsConstruct(bool isConstruct)
+{
+    return isConstruct ? CodeForConstruct : CodeForCall;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+void printInternal(PrintStream&, JSC::CodeSpecializationKind);
+
+} // namespace WTF
diff --git a/runtime/CommonIdentifiers.cpp b/runtime/CommonIdentifiers.cpp
new file mode 100644
index 0000000..926528e
--- /dev/null
+++ b/runtime/CommonIdentifiers.cpp
@@ -0,0 +1,84 @@
+/*
+ *  Copyright (C) 2003, 2007, 2009, 2012, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "CommonIdentifiers.h"
+
+#include "BuiltinNames.h"
+#include "IdentifierInlines.h"
+#include "JSCBuiltins.h"
+#include "PrivateName.h"
+
+namespace JSC {
+
+#define INITIALIZE_PROPERTY_NAME(name) , name(Identifier::fromString(vm, #name))
+#define INITIALIZE_KEYWORD(name) , name##Keyword(Identifier::fromString(vm, #name))
+#define INITIALIZE_PRIVATE_NAME(name) , name##PrivateName(m_builtinNames->name##PrivateName())
+#define INITIALIZE_SYMBOL(name) , name##Symbol(m_builtinNames->name##Symbol())
+
+CommonIdentifiers::CommonIdentifiers(VM* vm)
+    : nullIdentifier()
+    , emptyIdentifier(Identifier::EmptyIdentifier)
+    , underscoreProto(Identifier::fromString(vm, "__proto__"))
+    , thisIdentifier(Identifier::fromString(vm, "this"))
+    , useStrictIdentifier(Identifier::fromString(vm, "use strict"))
+    , timesIdentifier(Identifier::fromString(vm, "*"))
+    , m_builtinNames(new BuiltinNames(vm, this))
+    JSC_COMMON_IDENTIFIERS_EACH_KEYWORD(INITIALIZE_KEYWORD)
+    JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(INITIALIZE_PROPERTY_NAME)
+    JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_SYMBOL)
+{
+}
+
+CommonIdentifiers::~CommonIdentifiers()
+{
+}
+
+bool CommonIdentifiers::isPrivateName(SymbolImpl& uid) const
+{
+    return m_builtinNames->isPrivateName(uid);
+}
+
+bool CommonIdentifiers::isPrivateName(UniquedStringImpl& uid) const
+{
+    return m_builtinNames->isPrivateName(uid);
+}
+
+bool CommonIdentifiers::isPrivateName(const Identifier& ident) const
+{
+    return m_builtinNames->isPrivateName(ident);
+}
+
+const Identifier* CommonIdentifiers::lookUpPrivateName(const Identifier& ident) const
+{
+    return m_builtinNames->lookUpPrivateName(ident);
+}
+    
+Identifier CommonIdentifiers::lookUpPublicName(const Identifier& ident) const
+{
+    return m_builtinNames->lookUpPublicName(ident);
+}
+
+void CommonIdentifiers::appendExternalName(const Identifier& publicName, const Identifier& privateName)
+{
+    m_builtinNames->appendExternalName(publicName, privateName);
+}
+
+} // namespace JSC
diff --git a/runtime/CommonIdentifiers.h b/runtime/CommonIdentifiers.h
new file mode 100644
index 0000000..e860730
--- /dev/null
+++ b/runtime/CommonIdentifiers.h
@@ -0,0 +1,406 @@
+/*
+ *  Copyright (C) 2003, 2007, 2009, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include <wtf/Noncopyable.h>
+
+// MarkedArgumentBuffer of property names, passed to a macro so we can do set them up various
+// ways without repeating the list.
+#define JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(macro) \
+    macro(Animation) \
+    macro(AnimationEffectReadOnly) \
+    macro(AnimationTimeline) \
+    macro(Array) \
+    macro(ArrayBuffer) \
+    macro(ArrayIterator) \
+    macro(Audio) \
+    macro(BYTES_PER_ELEMENT) \
+    macro(Boolean) \
+    macro(Collator) \
+    macro(CustomElementRegistry) \
+    macro(Date) \
+    macro(DateTimeFormat) \
+    macro(DocumentTimeline) \
+    macro(Error) \
+    macro(EvalError) \
+    macro(Function) \
+    macro(Gamepad) \
+    macro(GamepadButton) \
+    macro(GamepadEvent) \
+    macro(GeneratorFunction) \
+    macro(Headers) \
+    macro(HTMLAudioElement) \
+    macro(HTMLSlotElement) \
+    macro(IDBCursor) \
+    macro(IDBCursorWithValue) \
+    macro(IDBDatabase) \
+    macro(IDBFactory) \
+    macro(IDBIndex) \
+    macro(IDBKeyRange) \
+    macro(IDBObjectStore) \
+    macro(IDBOpenDBRequest) \
+    macro(IDBRequest) \
+    macro(IDBTransaction) \
+    macro(IDBVersionChangeEvent) \
+    macro(Infinity) \
+    macro(InputEvent) \
+    macro(IntersectionObserver) \
+    macro(IntersectionObserverEntry) \
+    macro(Intl) \
+    macro(JSON) \
+    macro(Loader) \
+    macro(Map)\
+    macro(MapIterator)\
+    macro(Math) \
+    macro(MediaEncryptedEvent) \
+    macro(MediaKeyMessageEvent) \
+    macro(MediaKeySession) \
+    macro(MediaKeyStatusMap) \
+    macro(MediaKeySystemAccess) \
+    macro(MediaKeys) \
+    macro(MediaStreamEvent) \
+    macro(ModernMediaControls) \
+    macro(NaN) \
+    macro(NavigatorMediaDevices) \
+    macro(NavigatorUserMedia) \
+    macro(Number) \
+    macro(NumberFormat) \
+    macro(Object) \
+    macro(PerformanceEntry) \
+    macro(PerformanceEntryList) \
+    macro(PerformanceResourceTiming) \
+    macro(Promise) \
+    macro(Proxy) \
+    macro(RangeError) \
+    macro(ReferenceError) \
+    macro(Reflect) \
+    macro(RegExp) \
+    macro(Response) \
+    macro(Request) \
+    macro(RTCDTMFToneChangeEvent) \
+    macro(RTCIceCandidate) \
+    macro(RTCPeerConnection) \
+    macro(RTCRtpReceiver) \
+    macro(RTCRtpSender) \
+    macro(RTCRtpTransceiver) \
+    macro(RTCSessionDescription) \
+    macro(RTCTrackEvent) \
+    macro(Set)\
+    macro(SetIterator)\
+    macro(ShadowRoot) \
+    macro(SharedArrayBuffer) \
+    macro(StaticRange) \
+    macro(String) \
+    macro(Symbol) \
+    macro(SyntaxError) \
+    macro(TypeError) \
+    macro(URIError) \
+    macro(UTC) \
+    macro(WeakMap)\
+    macro(WeakSet)\
+    macro(WebGL2RenderingContext) \
+    macro(WebGLVertexArrayObject) \
+    macro(WebSocket) \
+    macro(__defineGetter__) \
+    macro(__defineSetter__) \
+    macro(__lookupGetter__) \
+    macro(__lookupSetter__) \
+    macro(add) \
+    macro(additionalJettisonReason) \
+    macro(anonymous) \
+    macro(arguments) \
+    macro(as) \
+    macro(assign) \
+    macro(back) \
+    macro(bind) \
+    macro(blur) \
+    macro(buffer) \
+    macro(byteLength) \
+    macro(byteOffset) \
+    macro(bytecode) \
+    macro(bytecodeIndex) \
+    macro(bytecodes) \
+    macro(bytecodesID) \
+    macro(calendar) \
+    macro(callee) \
+    macro(caller) \
+    macro(caseFirst) \
+    macro(clear) \
+    macro(close) \
+    macro(closed) \
+    macro(collation) \
+    macro(column) \
+    macro(compilationKind) \
+    macro(compilationUID) \
+    macro(compilations) \
+    macro(compile) \
+    macro(configurable) \
+    macro(constructor) \
+    macro(count) \
+    macro(counters) \
+    macro(customElements) \
+    macro(day) \
+    macro(defineProperty) \
+    macro(description) \
+    macro(descriptions) \
+    macro(detail) \
+    macro(displayName) \
+    macro(document) \
+    macro(done) \
+    macro(enumerable) \
+    macro(era) \
+    macro(eval) \
+    macro(events) \
+    macro(exec) \
+    macro(executionCount) \
+    macro(exitKind) \
+    macro(fetch) \
+    macro(flags) \
+    macro(focus) \
+    macro(forEach) \
+    macro(formatMatcher) \
+    macro(forward) \
+    macro(frames) \
+    macro(from) \
+    macro(fromCharCode) \
+    macro(get) \
+    macro(global) \
+    macro(go) \
+    macro(has) \
+    macro(hasOwnProperty) \
+    macro(hash) \
+    macro(header) \
+    macro(hour) \
+    macro(hour12) \
+    macro(href) \
+    macro(id) \
+    macro(ignoreCase) \
+    macro(ignorePunctuation) \
+    macro(index) \
+    macro(indexedDB) \
+    macro(inferredName) \
+    macro(input) \
+    macro(instructionCount) \
+    macro(isArray) \
+    macro(isEnabled) \
+    macro(isPrototypeOf) \
+    macro(isView) \
+    macro(isWatchpoint) \
+    macro(jettisonReason) \
+    macro(join) \
+    macro(KeyframeEffect) \
+    macro(lastIndex) \
+    macro(length) \
+    macro(line) \
+    macro(locale) \
+    macro(localeMatcher) \
+    macro(location) \
+    macro(message) \
+    macro(minute) \
+    macro(month) \
+    macro(multiline) \
+    macro(name) \
+    macro(next) \
+    macro(now) \
+    macro(numInlinedCalls) \
+    macro(numInlinedGetByIds) \
+    macro(numInlinedPutByIds) \
+    macro(numberingSystem) \
+    macro(numeric) \
+    macro(of) \
+    macro(opcode) \
+    macro(opener) \
+    macro(origin) \
+    macro(osrExitSites) \
+    macro(osrExits) \
+    macro(parent) \
+    macro(parse) \
+    macro(parseInt) \
+    macro(postMessage) \
+    macro(profiledBytecodes) \
+    macro(propertyIsEnumerable) \
+    macro(prototype) \
+    macro(raw) \
+    macro(reload) \
+    macro(replace) \
+    macro(resolve) \
+    macro(second) \
+    macro(self) \
+    macro(sensitivity) \
+    macro(set) \
+    macro(showModalDialog) \
+    macro(size) \
+    macro(slice) \
+    macro(source) \
+    macro(sourceCode) \
+    macro(sourceURL) \
+    macro(stack) \
+    macro(sticky) \
+    macro(subarray) \
+    macro(summary) \
+    macro(target) \
+    macro(test) \
+    macro(then) \
+    macro(time) \
+    macro(timeZone) \
+    macro(timeZoneName) \
+    macro(toExponential) \
+    macro(toFixed) \
+    macro(toISOString) \
+    macro(toJSON) \
+    macro(toLocaleString) \
+    macro(toPrecision) \
+    macro(toString) \
+    macro(top) \
+    macro(uid) \
+    macro(unicode) \
+    macro(usage) \
+    macro(value) \
+    macro(valueOf) \
+    macro(webkit) \
+    macro(collectMatchingElementsInFlatTree) \
+    macro(webkitIDBCursor) \
+    macro(webkitIDBDatabase) \
+    macro(webkitIDBFactory) \
+    macro(webkitIDBIndex) \
+    macro(webkitIDBKeyRange) \
+    macro(webkitIDBObjectStore) \
+    macro(webkitIDBRequest) \
+    macro(webkitIDBTransaction) \
+    macro(webkitIndexedDB) \
+    macro(weekday) \
+    macro(window) \
+    macro(writable) \
+    macro(year)
+
+#define JSC_COMMON_IDENTIFIERS_EACH_KEYWORD(macro) \
+    macro(async) \
+    macro(await) \
+    macro(break) \
+    macro(case) \
+    macro(catch) \
+    macro(class) \
+    macro(const) \
+    macro(continue) \
+    macro(debugger) \
+    macro(default) \
+    macro(delete) \
+    macro(do) \
+    macro(else) \
+    macro(enum) \
+    macro(export) \
+    macro(extends) \
+    macro(false) \
+    macro(finally) \
+    macro(for) \
+    macro(function) \
+    macro(if) \
+    macro(implements) \
+    macro(import) \
+    macro(in) \
+    macro(instanceof) \
+    macro(interface) \
+    macro(let) \
+    macro(new) \
+    macro(null) \
+    macro(package) \
+    macro(private) \
+    macro(protected) \
+    macro(public) \
+    macro(return) \
+    macro(static) \
+    macro(super) \
+    macro(switch) \
+    macro(this) \
+    macro(throw) \
+    macro(true) \
+    macro(try) \
+    macro(typeof) \
+    macro(undefined) \
+    macro(var) \
+    macro(void) \
+    macro(while) \
+    macro(with) \
+    macro(yield)
+
+#define JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(macro) \
+    macro(hasInstance) \
+    macro(isConcatSpreadable) \
+    macro(iterator) \
+    macro(match) \
+    macro(replace) \
+    macro(search) \
+    macro(species) \
+    macro(split) \
+    macro(toPrimitive) \
+    macro(toStringTag) \
+    macro(unscopables)
+
+namespace JSC {
+    
+    class BuiltinNames;
+    
+    class CommonIdentifiers {
+        WTF_MAKE_NONCOPYABLE(CommonIdentifiers); WTF_MAKE_FAST_ALLOCATED;
+    private:
+        CommonIdentifiers(VM*);
+        ~CommonIdentifiers();
+        friend class VM;
+        
+    public:
+        const BuiltinNames& builtinNames() const { return *m_builtinNames; }
+        const Identifier nullIdentifier;
+        const Identifier emptyIdentifier;
+        const Identifier underscoreProto;
+        const Identifier thisIdentifier;
+        const Identifier useStrictIdentifier;
+        const Identifier timesIdentifier;
+    private:
+        std::unique_ptr<BuiltinNames> m_builtinNames;
+
+    public:
+        
+#define JSC_IDENTIFIER_DECLARE_KEYWORD_NAME_GLOBAL(name) const Identifier name##Keyword;
+        JSC_COMMON_IDENTIFIERS_EACH_KEYWORD(JSC_IDENTIFIER_DECLARE_KEYWORD_NAME_GLOBAL)
+#undef JSC_IDENTIFIER_DECLARE_KEYWORD_NAME_GLOBAL
+        
+#define JSC_IDENTIFIER_DECLARE_PROPERTY_NAME_GLOBAL(name) const Identifier name;
+        JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(JSC_IDENTIFIER_DECLARE_PROPERTY_NAME_GLOBAL)
+#undef JSC_IDENTIFIER_DECLARE_PROPERTY_NAME_GLOBAL
+
+#define JSC_IDENTIFIER_DECLARE_PRIVATE_WELL_KNOWN_SYMBOL_GLOBAL(name) const Identifier name##Symbol;
+        JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(JSC_IDENTIFIER_DECLARE_PRIVATE_WELL_KNOWN_SYMBOL_GLOBAL)
+#undef JSC_IDENTIFIER_DECLARE_PRIVATE_WELL_KNOWN_SYMBOL_GLOBAL
+
+        bool isPrivateName(SymbolImpl& uid) const;
+        bool isPrivateName(UniquedStringImpl& uid) const;
+        bool isPrivateName(const Identifier&) const;
+
+        const Identifier* lookUpPrivateName(const Identifier&) const;
+        Identifier lookUpPublicName(const Identifier&) const;
+
+        // Callers of this method should make sure that identifiers given to this method 
+        // survive the lifetime of CommonIdentifiers and related VM.
+        JS_EXPORT_PRIVATE void appendExternalName(const Identifier& publicName, const Identifier& privateName);
+    };
+
+} // namespace JSC
diff --git a/runtime/CommonSlowPaths.cpp b/runtime/CommonSlowPaths.cpp
new file mode 100644
index 0000000..3488b5b
--- /dev/null
+++ b/runtime/CommonSlowPaths.cpp
@@ -0,0 +1,1067 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CommonSlowPaths.h"
+
+#include "ArithProfile.h"
+#include "ArrayConstructor.h"
+#include "BuiltinNames.h"
+#include "CallFrame.h"
+#include "ClonedArguments.h"
+#include "CodeProfiling.h"
+#include "CommonSlowPathsExceptions.h"
+#include "DefinePropertyAttributes.h"
+#include "DirectArguments.h"
+#include "Error.h"
+#include "ErrorHandlingScope.h"
+#include "ExceptionFuzz.h"
+#include "GetterSetter.h"
+#include "HostCallReturnValue.h"
+#include "Interpreter.h"
+#include "IteratorOperations.h"
+#include "JIT.h"
+#include "JSArrayInlines.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSFixedArray.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSLexicalEnvironment.h"
+#include "JSPropertyNameEnumerator.h"
+#include "JSString.h"
+#include "JSWithScope.h"
+#include "LLIntCommon.h"
+#include "LLIntExceptions.h"
+#include "LowLevelInterpreter.h"
+#include "MathCommon.h"
+#include "ObjectConstructor.h"
+#include "ScopedArguments.h"
+#include "StructureRareDataInlines.h"
+#include "TypeProfilerLog.h"
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+#define BEGIN_NO_SET_PC() \
+    VM& vm = exec->vm();      \
+    NativeCallFrameTracer tracer(&vm, exec); \
+    auto throwScope = DECLARE_THROW_SCOPE(vm); \
+    UNUSED_PARAM(throwScope)
+
+#ifndef NDEBUG
+#define SET_PC_FOR_STUBS() do { \
+        exec->codeBlock()->bytecodeOffset(pc); \
+        exec->setCurrentVPC(pc + 1); \
+    } while (false)
+#else
+#define SET_PC_FOR_STUBS() do { \
+        exec->setCurrentVPC(pc + 1); \
+    } while (false)
+#endif
+
+#define RETURN_TO_THROW(exec, pc)   pc = LLInt::returnToThrow(exec)
+
+#define BEGIN()                           \
+    BEGIN_NO_SET_PC();                    \
+    SET_PC_FOR_STUBS()
+
+#define OP(index) (exec->uncheckedR(pc[index].u.operand))
+#define OP_C(index) (exec->r(pc[index].u.operand))
+
+#define RETURN_TWO(first, second) do {       \
+        return encodeResult(first, second);        \
+    } while (false)
+
+#define END_IMPL() RETURN_TWO(pc, exec)
+
+#define THROW(exceptionToThrow) do {                        \
+        throwException(exec, throwScope, exceptionToThrow); \
+        RETURN_TO_THROW(exec, pc);                          \
+        END_IMPL();                                         \
+    } while (false)
+
+#define CHECK_EXCEPTION() do {                    \
+        doExceptionFuzzingIfEnabled(exec, throwScope, "CommonSlowPaths", pc);   \
+        if (UNLIKELY(throwScope.exception())) {   \
+            RETURN_TO_THROW(exec, pc);            \
+            END_IMPL();                           \
+        }                                         \
+    } while (false)
+
+#define END() do {                        \
+        CHECK_EXCEPTION();                \
+        END_IMPL();                       \
+    } while (false)
+
+#define BRANCH(opcode, condition) do {                      \
+        bool bCondition = (condition);                         \
+        CHECK_EXCEPTION();                                  \
+        if (bCondition)                                        \
+            pc += pc[OPCODE_LENGTH(opcode) - 1].u.operand;        \
+        else                                                      \
+            pc += OPCODE_LENGTH(opcode);                          \
+        END_IMPL();                                         \
+    } while (false)
+
+#define RETURN_WITH_PROFILING(value__, profilingAction__) do { \
+        JSValue returnValue__ = (value__);  \
+        CHECK_EXCEPTION();                  \
+        OP(1) = returnValue__;              \
+        profilingAction__;                  \
+        END_IMPL();                         \
+    } while (false)
+
+#define RETURN(value) \
+    RETURN_WITH_PROFILING(value, { })
+
+#define RETURN_PROFILED(opcode__, value__) \
+    RETURN_WITH_PROFILING(value__, PROFILE_VALUE(opcode__, returnValue__))
+
+#define PROFILE_VALUE(opcode, value) do { \
+        pc[OPCODE_LENGTH(opcode) - 1].u.profile->m_buckets[0] = \
+        JSValue::encode(value);                  \
+    } while (false)
+
+#define CALL_END_IMPL(exec, callTarget) RETURN_TWO((callTarget), (exec))
+
+#define CALL_CHECK_EXCEPTION(exec, pc) do {                          \
+        ExecState* cceExec = (exec);                                 \
+        Instruction* ccePC = (pc);                                   \
+        if (UNLIKELY(throwScope.exception()))                        \
+            CALL_END_IMPL(cceExec, LLInt::callToThrow(cceExec));     \
+    } while (false)
+
+#define CALL_RETURN(exec, pc, callTarget) do {                    \
+        ExecState* crExec = (exec);                                  \
+        Instruction* crPC = (pc);                                    \
+        void* crCallTarget = (callTarget);                           \
+        CALL_CHECK_EXCEPTION(crExec->callerFrame(), crPC);  \
+        CALL_END_IMPL(crExec, crCallTarget);                \
+    } while (false)
+
+static CommonSlowPaths::ArityCheckData* setupArityCheckData(VM& vm, int slotsToAdd)
+{
+    CommonSlowPaths::ArityCheckData* result = vm.arityCheckData.get();
+    result->paddedStackSpace = slotsToAdd;
+#if ENABLE(JIT)
+    if (vm.canUseJIT())
+        result->thunkToCall = vm.getCTIStub(arityFixupGenerator).code().executableAddress();
+    else
+#endif
+        result->thunkToCall = 0;
+    return result;
+}
+
+SLOW_PATH_DECL(slow_path_call_arityCheck)
+{
+    BEGIN();
+    int slotsToAdd = CommonSlowPaths::arityCheckFor(exec, vm, CodeForCall);
+    if (slotsToAdd < 0) {
+        exec = exec->callerFrame();
+        vm.topCallFrame = exec;
+        ErrorHandlingScope errorScope(vm);
+        throwScope.release();
+        CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));
+        RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
+    }
+    RETURN_TWO(0, setupArityCheckData(vm, slotsToAdd));
+}
+
+SLOW_PATH_DECL(slow_path_construct_arityCheck)
+{
+    BEGIN();
+    int slotsToAdd = CommonSlowPaths::arityCheckFor(exec, vm, CodeForConstruct);
+    if (slotsToAdd < 0) {
+        exec = exec->callerFrame();
+        vm.topCallFrame = exec;
+        ErrorHandlingScope errorScope(vm);
+        CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));
+        RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
+    }
+    RETURN_TWO(0, setupArityCheckData(vm, slotsToAdd));
+}
+
+SLOW_PATH_DECL(slow_path_create_direct_arguments)
+{
+    BEGIN();
+    RETURN(DirectArguments::createByCopying(exec));
+}
+
+SLOW_PATH_DECL(slow_path_create_scoped_arguments)
+{
+    BEGIN();
+    JSLexicalEnvironment* scope = jsCast<JSLexicalEnvironment*>(OP(2).jsValue());
+    ScopedArgumentsTable* table = scope->symbolTable()->arguments();
+    RETURN(ScopedArguments::createByCopying(exec, table, scope));
+}
+
+SLOW_PATH_DECL(slow_path_create_cloned_arguments)
+{
+    BEGIN();
+    RETURN(ClonedArguments::createWithMachineFrame(exec, exec, ArgumentsMode::Cloned));
+}
+
+SLOW_PATH_DECL(slow_path_create_this)
+{
+    BEGIN();
+    JSObject* result;
+    JSObject* constructorAsObject = asObject(OP(2).jsValue());
+    if (constructorAsObject->type() == JSFunctionType) {
+        JSFunction* constructor = jsCast<JSFunction*>(constructorAsObject);
+        auto& cacheWriteBarrier = pc[4].u.jsCell;
+        if (!cacheWriteBarrier)
+            cacheWriteBarrier.set(exec->vm(), exec->codeBlock(), constructor);
+        else if (cacheWriteBarrier.unvalidatedGet() != JSCell::seenMultipleCalleeObjects() && cacheWriteBarrier.get() != constructor)
+            cacheWriteBarrier.setWithoutWriteBarrier(JSCell::seenMultipleCalleeObjects());
+
+        size_t inlineCapacity = pc[3].u.operand;
+        Structure* structure = constructor->rareData(exec, inlineCapacity)->objectAllocationProfile()->structure();
+        result = constructEmptyObject(exec, structure);
+    } else {
+        // http://ecma-international.org/ecma-262/6.0/#sec-ordinarycreatefromconstructor
+        JSValue proto = constructorAsObject->get(exec, exec->propertyNames().prototype);
+        CHECK_EXCEPTION();
+        if (proto.isObject())
+            result = constructEmptyObject(exec, asObject(proto));
+        else
+            result = constructEmptyObject(exec);
+    }
+    RETURN(result);
+}
+
+SLOW_PATH_DECL(slow_path_to_this)
+{
+    BEGIN();
+    JSValue v1 = OP(1).jsValue();
+    if (v1.isCell()) {
+        Structure* myStructure = v1.asCell()->structure(vm);
+        Structure* otherStructure = pc[2].u.structure.get();
+        if (myStructure != otherStructure) {
+            if (otherStructure)
+                pc[3].u.toThisStatus = ToThisConflicted;
+            pc[2].u.structure.set(vm, exec->codeBlock(), myStructure);
+        }
+    } else {
+        pc[3].u.toThisStatus = ToThisConflicted;
+        pc[2].u.structure.clear();
+    }
+    RETURN(v1.toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
+}
+
+SLOW_PATH_DECL(slow_path_throw_tdz_error)
+{
+    BEGIN();
+    THROW(createTDZError(exec));
+}
+
+SLOW_PATH_DECL(slow_path_throw_strict_mode_readonly_property_write_error)
+{
+    BEGIN();
+    THROW(createTypeError(exec, ASCIILiteral(ReadonlyPropertyWriteError)));
+}
+
+SLOW_PATH_DECL(slow_path_not)
+{
+    BEGIN();
+    RETURN(jsBoolean(!OP_C(2).jsValue().toBoolean(exec)));
+}
+
+SLOW_PATH_DECL(slow_path_eq)
+{
+    BEGIN();
+    RETURN(jsBoolean(JSValue::equal(exec, OP_C(2).jsValue(), OP_C(3).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_neq)
+{
+    BEGIN();
+    RETURN(jsBoolean(!JSValue::equal(exec, OP_C(2).jsValue(), OP_C(3).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_stricteq)
+{
+    BEGIN();
+    RETURN(jsBoolean(JSValue::strictEqual(exec, OP_C(2).jsValue(), OP_C(3).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_nstricteq)
+{
+    BEGIN();
+    RETURN(jsBoolean(!JSValue::strictEqual(exec, OP_C(2).jsValue(), OP_C(3).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_less)
+{
+    BEGIN();
+    RETURN(jsBoolean(jsLess<true>(exec, OP_C(2).jsValue(), OP_C(3).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_lesseq)
+{
+    BEGIN();
+    RETURN(jsBoolean(jsLessEq<true>(exec, OP_C(2).jsValue(), OP_C(3).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_greater)
+{
+    BEGIN();
+    RETURN(jsBoolean(jsLess<false>(exec, OP_C(3).jsValue(), OP_C(2).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_greatereq)
+{
+    BEGIN();
+    RETURN(jsBoolean(jsLessEq<false>(exec, OP_C(3).jsValue(), OP_C(2).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_inc)
+{
+    BEGIN();
+    RETURN(jsNumber(OP(1).jsValue().toNumber(exec) + 1));
+}
+
+SLOW_PATH_DECL(slow_path_dec)
+{
+    BEGIN();
+    RETURN(jsNumber(OP(1).jsValue().toNumber(exec) - 1));
+}
+
+SLOW_PATH_DECL(slow_path_to_string)
+{
+    BEGIN();
+    RETURN(OP_C(2).jsValue().toString(exec));
+}
+
+#if ENABLE(JIT)
+static void updateArithProfileForUnaryArithOp(Instruction* pc, JSValue result, JSValue operand)
+{
+    ArithProfile& profile = *bitwise_cast<ArithProfile*>(&pc[3].u.operand);
+    profile.observeLHS(operand);
+    ASSERT(result.isNumber());
+    if (!result.isInt32()) {
+        if (operand.isInt32())
+            profile.setObservedInt32Overflow();
+
+        double doubleVal = result.asNumber();
+        if (!doubleVal && std::signbit(doubleVal))
+            profile.setObservedNegZeroDouble();
+        else {
+            profile.setObservedNonNegZeroDouble();
+
+            // The Int52 overflow check here intentionally omits 1ll << 51 as a valid negative Int52 value.
+            // Therefore, we will get a false positive if the result is that value. This is intentionally
+            // done to simplify the checking algorithm.
+            static const int64_t int52OverflowPoint = (1ll << 51);
+            int64_t int64Val = static_cast<int64_t>(std::abs(doubleVal));
+            if (int64Val >= int52OverflowPoint)
+                profile.setObservedInt52Overflow();
+        }
+    }
+}
+#else
+static void updateArithProfileForUnaryArithOp(Instruction*, JSValue, JSValue) { }
+#endif
+
+SLOW_PATH_DECL(slow_path_negate)
+{
+    BEGIN();
+    JSValue operand = OP_C(2).jsValue();
+    JSValue result = jsNumber(-operand.toNumber(exec));
+    RETURN_WITH_PROFILING(result, {
+        updateArithProfileForUnaryArithOp(pc, result, operand);
+    });
+}
+
+#if ENABLE(DFG_JIT)
+static void updateArithProfileForBinaryArithOp(ExecState* exec, Instruction* pc, JSValue result, JSValue left, JSValue right)
+{
+    CodeBlock* codeBlock = exec->codeBlock();
+    ArithProfile& profile = *codeBlock->arithProfileForPC(pc);
+
+    if (result.isNumber()) {
+        if (!result.isInt32()) {
+            if (left.isInt32() && right.isInt32())
+                profile.setObservedInt32Overflow();
+
+            double doubleVal = result.asNumber();
+            if (!doubleVal && std::signbit(doubleVal))
+                profile.setObservedNegZeroDouble();
+            else {
+                profile.setObservedNonNegZeroDouble();
+
+                // The Int52 overflow check here intentionally omits 1ll << 51 as a valid negative Int52 value.
+                // Therefore, we will get a false positive if the result is that value. This is intentionally
+                // done to simplify the checking algorithm.
+                static const int64_t int52OverflowPoint = (1ll << 51);
+                int64_t int64Val = static_cast<int64_t>(std::abs(doubleVal));
+                if (int64Val >= int52OverflowPoint)
+                    profile.setObservedInt52Overflow();
+            }
+        }
+    } else
+        profile.setObservedNonNumber();
+}
+#else
+static void updateArithProfileForBinaryArithOp(ExecState*, Instruction*, JSValue, JSValue, JSValue) { }
+#endif
+
+SLOW_PATH_DECL(slow_path_to_number)
+{
+    BEGIN();
+    JSValue argument = OP_C(2).jsValue();
+    JSValue result = jsNumber(argument.toNumber(exec));
+    RETURN_PROFILED(op_to_number, result);
+}
+
+SLOW_PATH_DECL(slow_path_add)
+{
+    BEGIN();
+    JSValue v1 = OP_C(2).jsValue();
+    JSValue v2 = OP_C(3).jsValue();
+    JSValue result;
+
+    ArithProfile& arithProfile = *exec->codeBlock()->arithProfileForPC(pc);
+    arithProfile.observeLHSAndRHS(v1, v2);
+
+    if (v1.isString() && !v2.isObject()) {
+        JSString* v2String = v2.toString(exec);
+        if (LIKELY(!throwScope.exception()))
+            result = jsString(exec, asString(v1), v2String);
+    } else if (v1.isNumber() && v2.isNumber())
+        result = jsNumber(v1.asNumber() + v2.asNumber());
+    else
+        result = jsAddSlowCase(exec, v1, v2);
+
+    RETURN_WITH_PROFILING(result, {
+        updateArithProfileForBinaryArithOp(exec, pc, result, v1, v2);
+    });
+}
+
+// The following arithmetic and bitwise operations need to be sure to run
+// toNumber() on their operands in order.  (A call to toNumber() is idempotent
+// if an exception is already set on the ExecState.)
+
+SLOW_PATH_DECL(slow_path_mul)
+{
+    BEGIN();
+    JSValue left = OP_C(2).jsValue();
+    JSValue right = OP_C(3).jsValue();
+    double a = left.toNumber(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    double b = right.toNumber(exec);
+    JSValue result = jsNumber(a * b);
+    RETURN_WITH_PROFILING(result, {
+        updateArithProfileForBinaryArithOp(exec, pc, result, left, right);
+    });
+}
+
+SLOW_PATH_DECL(slow_path_sub)
+{
+    BEGIN();
+    JSValue left = OP_C(2).jsValue();
+    JSValue right = OP_C(3).jsValue();
+    double a = left.toNumber(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    double b = right.toNumber(exec);
+    JSValue result = jsNumber(a - b);
+    RETURN_WITH_PROFILING(result, {
+        updateArithProfileForBinaryArithOp(exec, pc, result, left, right);
+    });
+}
+
+SLOW_PATH_DECL(slow_path_div)
+{
+    BEGIN();
+    JSValue left = OP_C(2).jsValue();
+    JSValue right = OP_C(3).jsValue();
+    double a = left.toNumber(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    double b = right.toNumber(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    JSValue result = jsNumber(a / b);
+    RETURN_WITH_PROFILING(result, {
+        updateArithProfileForBinaryArithOp(exec, pc, result, left, right);
+    });
+}
+
+SLOW_PATH_DECL(slow_path_mod)
+{
+    BEGIN();
+    double a = OP_C(2).jsValue().toNumber(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    double b = OP_C(3).jsValue().toNumber(exec);
+    RETURN(jsNumber(jsMod(a, b)));
+}
+
+SLOW_PATH_DECL(slow_path_pow)
+{
+    BEGIN();
+    double a = OP_C(2).jsValue().toNumber(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    double b = OP_C(3).jsValue().toNumber(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    RETURN(jsNumber(operationMathPow(a, b)));
+}
+
+SLOW_PATH_DECL(slow_path_lshift)
+{
+    BEGIN();
+    int32_t a = OP_C(2).jsValue().toInt32(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    uint32_t b = OP_C(3).jsValue().toUInt32(exec);
+    RETURN(jsNumber(a << (b & 31)));
+}
+
+SLOW_PATH_DECL(slow_path_rshift)
+{
+    BEGIN();
+    int32_t a = OP_C(2).jsValue().toInt32(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    uint32_t b = OP_C(3).jsValue().toUInt32(exec);
+    RETURN(jsNumber(a >> (b & 31)));
+}
+
+SLOW_PATH_DECL(slow_path_urshift)
+{
+    BEGIN();
+    uint32_t a = OP_C(2).jsValue().toUInt32(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    uint32_t b = OP_C(3).jsValue().toUInt32(exec);
+    RETURN(jsNumber(static_cast<int32_t>(a >> (b & 31))));
+}
+
+SLOW_PATH_DECL(slow_path_unsigned)
+{
+    BEGIN();
+    uint32_t a = OP_C(2).jsValue().toUInt32(exec);
+    RETURN(jsNumber(a));
+}
+
+SLOW_PATH_DECL(slow_path_bitand)
+{
+    BEGIN();
+    int32_t a = OP_C(2).jsValue().toInt32(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    int32_t b = OP_C(3).jsValue().toInt32(exec);
+    RETURN(jsNumber(a & b));
+}
+
+SLOW_PATH_DECL(slow_path_bitor)
+{
+    BEGIN();
+    int32_t a = OP_C(2).jsValue().toInt32(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    int32_t b = OP_C(3).jsValue().toInt32(exec);
+    RETURN(jsNumber(a | b));
+}
+
+SLOW_PATH_DECL(slow_path_bitxor)
+{
+    BEGIN();
+    int32_t a = OP_C(2).jsValue().toInt32(exec);
+    if (UNLIKELY(throwScope.exception()))
+        RETURN(JSValue());
+    int32_t b = OP_C(3).jsValue().toInt32(exec);
+    RETURN(jsNumber(a ^ b));
+}
+
+SLOW_PATH_DECL(slow_path_typeof)
+{
+    BEGIN();
+    RETURN(jsTypeStringForValue(exec, OP_C(2).jsValue()));
+}
+
+SLOW_PATH_DECL(slow_path_is_object_or_null)
+{
+    BEGIN();
+    RETURN(jsBoolean(jsIsObjectTypeOrNull(exec, OP_C(2).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_is_function)
+{
+    BEGIN();
+    RETURN(jsBoolean(jsIsFunctionType(OP_C(2).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_in)
+{
+    BEGIN();
+    RETURN(jsBoolean(CommonSlowPaths::opIn(exec, OP_C(2).jsValue(), OP_C(3).jsValue())));
+}
+
+SLOW_PATH_DECL(slow_path_del_by_val)
+{
+    BEGIN();
+    JSValue baseValue = OP_C(2).jsValue();
+    JSObject* baseObject = baseValue.toObject(exec);
+    CHECK_EXCEPTION();
+    
+    JSValue subscript = OP_C(3).jsValue();
+    
+    bool couldDelete;
+    
+    uint32_t i;
+    if (subscript.getUInt32(i))
+        couldDelete = baseObject->methodTable(vm)->deletePropertyByIndex(baseObject, exec, i);
+    else {
+        CHECK_EXCEPTION();
+        auto property = subscript.toPropertyKey(exec);
+        CHECK_EXCEPTION();
+        couldDelete = baseObject->methodTable(vm)->deleteProperty(baseObject, exec, property);
+    }
+    
+    if (!couldDelete && exec->codeBlock()->isStrictMode())
+        THROW(createTypeError(exec, UnableToDeletePropertyError));
+    
+    RETURN(jsBoolean(couldDelete));
+}
+
+SLOW_PATH_DECL(slow_path_strcat)
+{
+    BEGIN();
+    RETURN(jsStringFromRegisterArray(exec, &OP(2), pc[3].u.operand));
+}
+
+SLOW_PATH_DECL(slow_path_to_primitive)
+{
+    BEGIN();
+    RETURN(OP_C(2).jsValue().toPrimitive(exec));
+}
+
+SLOW_PATH_DECL(slow_path_enter)
+{
+    BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    Heap::heap(codeBlock)->writeBarrier(codeBlock);
+    END();
+}
+
+SLOW_PATH_DECL(slow_path_get_enumerable_length)
+{
+    BEGIN();
+    JSValue enumeratorValue = OP(2).jsValue();
+    if (enumeratorValue.isUndefinedOrNull())
+        RETURN(jsNumber(0));
+
+    JSPropertyNameEnumerator* enumerator = jsCast<JSPropertyNameEnumerator*>(enumeratorValue.asCell());
+
+    RETURN(jsNumber(enumerator->indexedLength()));
+}
+
+SLOW_PATH_DECL(slow_path_has_indexed_property)
+{
+    BEGIN();
+    JSObject* base = OP(2).jsValue().toObject(exec);
+    CHECK_EXCEPTION();
+    JSValue property = OP(3).jsValue();
+    pc[4].u.arrayProfile->observeStructure(base->structure(vm));
+    ASSERT(property.isUInt32());
+    RETURN(jsBoolean(base->hasPropertyGeneric(exec, property.asUInt32(), PropertySlot::InternalMethodType::GetOwnProperty)));
+}
+
+SLOW_PATH_DECL(slow_path_has_structure_property)
+{
+    BEGIN();
+    JSObject* base = OP(2).jsValue().toObject(exec);
+    CHECK_EXCEPTION();
+    JSValue property = OP(3).jsValue();
+    ASSERT(property.isString());
+    JSPropertyNameEnumerator* enumerator = jsCast<JSPropertyNameEnumerator*>(OP(4).jsValue().asCell());
+    if (base->structure(vm)->id() == enumerator->cachedStructureID())
+        RETURN(jsBoolean(true));
+    RETURN(jsBoolean(base->hasPropertyGeneric(exec, asString(property.asCell())->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty)));
+}
+
+SLOW_PATH_DECL(slow_path_has_generic_property)
+{
+    BEGIN();
+    JSObject* base = OP(2).jsValue().toObject(exec);
+    CHECK_EXCEPTION();
+    JSValue property = OP(3).jsValue();
+    bool result;
+    if (property.isString())
+        result = base->hasPropertyGeneric(exec, asString(property.asCell())->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty);
+    else {
+        ASSERT(property.isUInt32());
+        result = base->hasPropertyGeneric(exec, property.asUInt32(), PropertySlot::InternalMethodType::GetOwnProperty);
+    }
+    RETURN(jsBoolean(result));
+}
+
+SLOW_PATH_DECL(slow_path_get_direct_pname)
+{
+    BEGIN();
+    JSValue baseValue = OP_C(2).jsValue();
+    JSValue property = OP(3).jsValue();
+    ASSERT(property.isString());
+    RETURN(baseValue.get(exec, asString(property)->toIdentifier(exec)));
+}
+
+SLOW_PATH_DECL(slow_path_get_property_enumerator)
+{
+    BEGIN();
+    JSValue baseValue = OP(2).jsValue();
+    if (baseValue.isUndefinedOrNull())
+        RETURN(JSPropertyNameEnumerator::create(vm));
+
+    JSObject* base = baseValue.toObject(exec);
+    CHECK_EXCEPTION();
+
+    RETURN(propertyNameEnumerator(exec, base));
+}
+
+SLOW_PATH_DECL(slow_path_next_structure_enumerator_pname)
+{
+    BEGIN();
+    JSPropertyNameEnumerator* enumerator = jsCast<JSPropertyNameEnumerator*>(OP(2).jsValue().asCell());
+    uint32_t index = OP(3).jsValue().asUInt32();
+
+    JSString* propertyName = nullptr;
+    if (index < enumerator->endStructurePropertyIndex())
+        propertyName = enumerator->propertyNameAtIndex(index);
+    RETURN(propertyName ? propertyName : jsNull());
+}
+
+SLOW_PATH_DECL(slow_path_next_generic_enumerator_pname)
+{
+    BEGIN();
+    JSPropertyNameEnumerator* enumerator = jsCast<JSPropertyNameEnumerator*>(OP(2).jsValue().asCell());
+    uint32_t index = OP(3).jsValue().asUInt32();
+
+    JSString* propertyName = nullptr;
+    if (enumerator->endStructurePropertyIndex() <= index && index < enumerator->endGenericPropertyIndex())
+        propertyName = enumerator->propertyNameAtIndex(index);
+    RETURN(propertyName ? propertyName : jsNull());
+}
+
+SLOW_PATH_DECL(slow_path_to_index_string)
+{
+    BEGIN();
+    RETURN(jsString(exec, Identifier::from(exec, OP(2).jsValue().asUInt32()).string()));
+}
+
+SLOW_PATH_DECL(slow_path_profile_type_clear_log)
+{
+    BEGIN();
+    vm.typeProfilerLog()->processLogEntries(ASCIILiteral("LLInt log full."));
+    END();
+}
+
+SLOW_PATH_DECL(slow_path_assert)
+{
+    BEGIN();
+    RELEASE_ASSERT_WITH_MESSAGE(OP(1).jsValue().asBoolean(), "JS assertion failed at line %d in:\n%s\n", pc[2].u.operand, exec->codeBlock()->sourceCodeForTools().data());
+    END();
+}
+
+SLOW_PATH_DECL(slow_path_create_lexical_environment)
+{
+    BEGIN();
+    int scopeReg = pc[2].u.operand;
+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
+    SymbolTable* symbolTable = jsCast<SymbolTable*>(OP_C(3).jsValue());
+    JSValue initialValue = OP_C(4).jsValue();
+    ASSERT(initialValue == jsUndefined() || initialValue == jsTDZValue());
+    JSScope* newScope = JSLexicalEnvironment::create(vm, exec->lexicalGlobalObject(), currentScope, symbolTable, initialValue);
+    RETURN(newScope);
+}
+
+SLOW_PATH_DECL(slow_path_push_with_scope)
+{
+    BEGIN();
+    JSObject* newScope = OP_C(2).jsValue().toObject(exec);
+    CHECK_EXCEPTION();
+
+    int scopeReg = pc[3].u.operand;
+    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
+    RETURN(JSWithScope::create(vm, exec->lexicalGlobalObject(), newScope, currentScope));
+}
+
+SLOW_PATH_DECL(slow_path_resolve_scope)
+{
+    BEGIN();
+    const Identifier& ident = exec->codeBlock()->identifier(pc[3].u.operand);
+    JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
+    JSObject* resolvedScope = JSScope::resolve(exec, scope, ident);
+    // Proxy can throw an error here, e.g. Proxy in with statement's @unscopables.
+    CHECK_EXCEPTION();
+
+    ResolveType resolveType = static_cast<ResolveType>(pc[4].u.operand);
+
+    // ModuleVar does not keep the scope register value alive in DFG.
+    ASSERT(resolveType != ModuleVar);
+
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        if (resolvedScope->isGlobalObject()) {
+            JSGlobalObject* globalObject = jsCast<JSGlobalObject*>(resolvedScope);
+            bool hasProperty = globalObject->hasProperty(exec, ident);
+            CHECK_EXCEPTION();
+            if (hasProperty) {
+                ConcurrentJSLocker locker(exec->codeBlock()->m_lock);
+                if (resolveType == UnresolvedProperty)
+                    pc[4].u.operand = GlobalProperty;
+                else
+                    pc[4].u.operand = GlobalPropertyWithVarInjectionChecks;
+
+                pc[6].u.pointer = globalObject;
+            }
+        } else if (resolvedScope->isGlobalLexicalEnvironment()) {
+            JSGlobalLexicalEnvironment* globalLexicalEnvironment = jsCast<JSGlobalLexicalEnvironment*>(resolvedScope);
+            ConcurrentJSLocker locker(exec->codeBlock()->m_lock);
+            if (resolveType == UnresolvedProperty)
+                pc[4].u.operand = GlobalLexicalVar;
+            else
+                pc[4].u.operand = GlobalLexicalVarWithVarInjectionChecks;
+            pc[6].u.pointer = globalLexicalEnvironment;
+        }
+    }
+
+    RETURN(resolvedScope);
+}
+
+SLOW_PATH_DECL(slow_path_create_rest)
+{
+    BEGIN();
+    unsigned arraySize = OP_C(2).jsValue().asUInt32();
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    Structure* structure = globalObject->restParameterStructure();
+    unsigned numParamsToSkip = pc[3].u.unsignedValue;
+    JSValue* argumentsToCopyRegion = exec->addressOfArgumentsStart() + numParamsToSkip;
+    RETURN(constructArray(exec, structure, argumentsToCopyRegion, arraySize));
+}
+
+SLOW_PATH_DECL(slow_path_get_by_id_with_this)
+{
+    BEGIN();
+    const Identifier& ident = exec->codeBlock()->identifier(pc[4].u.operand);
+    JSValue baseValue = OP_C(2).jsValue();
+    JSValue thisVal = OP_C(3).jsValue();
+    PropertySlot slot(thisVal, PropertySlot::PropertySlot::InternalMethodType::Get);
+    JSValue result = baseValue.get(exec, ident, slot);
+    RETURN_PROFILED(op_get_by_id_with_this, result);
+}
+
+SLOW_PATH_DECL(slow_path_get_by_val_with_this)
+{
+    BEGIN();
+
+    JSValue baseValue = OP_C(2).jsValue();
+    JSValue thisValue = OP_C(3).jsValue();
+    JSValue subscript = OP_C(4).jsValue();
+
+    if (LIKELY(baseValue.isCell() && subscript.isString())) {
+        VM& vm = exec->vm();
+        Structure& structure = *baseValue.asCell()->structure(vm);
+        if (JSCell::canUseFastGetOwnProperty(structure)) {
+            if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
+                if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
+                    RETURN_PROFILED(op_get_by_val_with_this, result);
+            }
+        }
+    }
+    
+    PropertySlot slot(thisValue, PropertySlot::PropertySlot::InternalMethodType::Get);
+    if (subscript.isUInt32()) {
+        uint32_t i = subscript.asUInt32();
+        if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
+            RETURN_PROFILED(op_get_by_val_with_this, asString(baseValue)->getIndex(exec, i));
+        
+        RETURN_PROFILED(op_get_by_val_with_this, baseValue.get(exec, i, slot));
+    }
+
+    baseValue.requireObjectCoercible(exec);
+    CHECK_EXCEPTION();
+    auto property = subscript.toPropertyKey(exec);
+    CHECK_EXCEPTION();
+    RETURN_PROFILED(op_get_by_val_with_this, baseValue.get(exec, property, slot));
+}
+
+SLOW_PATH_DECL(slow_path_put_by_id_with_this)
+{
+    BEGIN();
+    CodeBlock* codeBlock = exec->codeBlock();
+    const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
+    JSValue baseValue = OP_C(1).jsValue();
+    JSValue thisVal = OP_C(2).jsValue();
+    JSValue putValue = OP_C(4).jsValue();
+    PutPropertySlot slot(thisVal, codeBlock->isStrictMode(), codeBlock->putByIdContext());
+    baseValue.putInline(exec, ident, putValue, slot);
+    END();
+}
+
+SLOW_PATH_DECL(slow_path_put_by_val_with_this)
+{
+    BEGIN();
+    JSValue baseValue = OP_C(1).jsValue();
+    JSValue thisValue = OP_C(2).jsValue();
+    JSValue subscript = OP_C(3).jsValue();
+    JSValue value = OP_C(4).jsValue();
+    
+    auto property = subscript.toPropertyKey(exec);
+    CHECK_EXCEPTION();
+    PutPropertySlot slot(thisValue, exec->codeBlock()->isStrictMode());
+    baseValue.put(exec, property, value, slot);
+    END();
+}
+
+SLOW_PATH_DECL(slow_path_define_data_property)
+{
+    BEGIN();
+    JSObject* base = asObject(OP_C(1).jsValue());
+    JSValue property = OP_C(2).jsValue();
+    JSValue value = OP_C(3).jsValue();
+    JSValue attributes = OP_C(4).jsValue();
+    ASSERT(attributes.isInt32());
+
+    auto propertyName = property.toPropertyKey(exec);
+    CHECK_EXCEPTION();
+    PropertyDescriptor descriptor = toPropertyDescriptor(value, jsUndefined(), jsUndefined(), DefinePropertyAttributes(attributes.asInt32()));
+    ASSERT((descriptor.attributes() & Accessor) || (!descriptor.isAccessorDescriptor()));
+    base->methodTable(vm)->defineOwnProperty(base, exec, propertyName, descriptor, true);
+    END();
+}
+
+SLOW_PATH_DECL(slow_path_define_accessor_property)
+{
+    BEGIN();
+    JSObject* base = asObject(OP_C(1).jsValue());
+    JSValue property = OP_C(2).jsValue();
+    JSValue getter = OP_C(3).jsValue();
+    JSValue setter = OP_C(4).jsValue();
+    JSValue attributes = OP_C(5).jsValue();
+    ASSERT(attributes.isInt32());
+
+    auto propertyName = property.toPropertyKey(exec);
+    CHECK_EXCEPTION();
+    PropertyDescriptor descriptor = toPropertyDescriptor(jsUndefined(), getter, setter, DefinePropertyAttributes(attributes.asInt32()));
+    ASSERT((descriptor.attributes() & Accessor) || (!descriptor.isAccessorDescriptor()));
+    base->methodTable(vm)->defineOwnProperty(base, exec, propertyName, descriptor, true);
+    END();
+}
+
+SLOW_PATH_DECL(slow_path_throw_static_error)
+{
+    BEGIN();
+    JSValue errorMessageValue = OP_C(1).jsValue();
+    RELEASE_ASSERT(errorMessageValue.isString());
+    String errorMessage = asString(errorMessageValue)->value(exec);
+    ErrorType errorType = static_cast<ErrorType>(pc[2].u.unsignedValue);
+    THROW(createError(exec, errorType, errorMessage));
+}
+
+SLOW_PATH_DECL(slow_path_new_array_with_spread)
+{
+    BEGIN();
+    int numItems = pc[3].u.operand;
+    ASSERT(numItems >= 0);
+    const BitVector& bitVector = exec->codeBlock()->unlinkedCodeBlock()->bitVector(pc[4].u.unsignedValue);
+
+    JSValue* values = bitwise_cast<JSValue*>(&OP(2));
+
+    unsigned arraySize = 0;
+    for (int i = 0; i < numItems; i++) {
+        if (bitVector.get(i)) {
+            JSValue value = values[-i];
+            JSFixedArray* array = jsCast<JSFixedArray*>(value);
+            arraySize += array->size();
+        } else
+            arraySize += 1;
+    }
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
+
+    JSArray* result = JSArray::tryCreateUninitialized(vm, structure, arraySize);
+    CHECK_EXCEPTION();
+
+    unsigned index = 0;
+    for (int i = 0; i < numItems; i++) {
+        JSValue value = values[-i];
+        if (bitVector.get(i)) {
+            // We are spreading.
+            JSFixedArray* array = jsCast<JSFixedArray*>(value);
+            for (unsigned i = 0; i < array->size(); i++) {
+                RELEASE_ASSERT(array->get(i));
+                result->initializeIndex(vm, index, array->get(i));
+                ++index;
+            }
+        } else {
+            // We are not spreading.
+            result->initializeIndex(vm, index, value);
+            ++index;
+        }
+    }
+
+    RETURN(result);
+}
+
+SLOW_PATH_DECL(slow_path_spread)
+{
+    BEGIN();
+
+    JSValue iterable = OP_C(2).jsValue();
+
+    if (iterable.isCell() && isJSArray(iterable.asCell())) {
+        JSArray* array = jsCast<JSArray*>(iterable);
+        if (array->isIteratorProtocolFastAndNonObservable()) {
+            // JSFixedArray::createFromArray does not consult the prototype chain,
+            // so we must be sure that not consulting the prototype chain would
+            // produce the same value during iteration.
+            RETURN(JSFixedArray::createFromArray(exec, vm, array));
+        }
+    }
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+
+    JSArray* array;
+    {
+        JSFunction* iterationFunction = globalObject->iteratorProtocolFunction();
+        CallData callData;
+        CallType callType = JSC::getCallData(iterationFunction, callData);
+        ASSERT(callType != CallType::None);
+
+        MarkedArgumentBuffer arguments;
+        arguments.append(iterable);
+        JSValue arrayResult = call(exec, iterationFunction, callType, callData, jsNull(), arguments);
+        CHECK_EXCEPTION();
+        array = jsCast<JSArray*>(arrayResult);
+    }
+
+    RETURN(JSFixedArray::createFromArray(exec, vm, array));
+}
+
+} // namespace JSC
diff --git a/runtime/CommonSlowPaths.h b/runtime/CommonSlowPaths.h
new file mode 100644
index 0000000..fcc30d0
--- /dev/null
+++ b/runtime/CommonSlowPaths.h
@@ -0,0 +1,269 @@
+/*
+ * Copyright (C) 2011-2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "CodeSpecializationKind.h"
+#include "ExceptionHelpers.h"
+#include "FunctionCodeBlock.h"
+#include "SlowPathReturnType.h"
+#include "StackAlignment.h"
+#include "Symbol.h"
+#include "VMInlines.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+// The purpose of this namespace is to include slow paths that are shared
+// between the interpreter and baseline JIT. They are written to be agnostic
+// with respect to the slow-path calling convention, but they do rely on the
+// JS code being executed more-or-less directly from bytecode (so the call
+// frame layout is unmodified, making it potentially awkward to use these
+// from any optimizing JIT, like the DFG).
+
+namespace CommonSlowPaths {
+
+struct ArityCheckData {
+    unsigned paddedStackSpace;
+    void* thunkToCall;
+};
+
+ALWAYS_INLINE int arityCheckFor(ExecState* exec, VM& vm, CodeSpecializationKind kind)
+{
+    JSFunction* callee = jsCast<JSFunction*>(exec->jsCallee());
+    ASSERT(!callee->isHostFunction());
+    CodeBlock* newCodeBlock = callee->jsExecutable()->codeBlockFor(kind);
+    int argumentCountIncludingThis = exec->argumentCountIncludingThis();
+    
+    ASSERT(argumentCountIncludingThis < newCodeBlock->numParameters());
+    int frameSize = argumentCountIncludingThis + CallFrame::headerSizeInRegisters;
+    int alignedFrameSizeForParameters = WTF::roundUpToMultipleOf(stackAlignmentRegisters(),
+        newCodeBlock->numParameters() + CallFrame::headerSizeInRegisters);
+    int paddedStackSpace = alignedFrameSizeForParameters - frameSize;
+    
+    Register* newStack = exec->registers() - WTF::roundUpToMultipleOf(stackAlignmentRegisters(), paddedStackSpace);
+
+    if (UNLIKELY(!vm.ensureStackCapacityFor(newStack)))
+        return -1;
+    return paddedStackSpace;
+}
+
+inline bool opIn(ExecState* exec, JSValue propName, JSValue baseVal)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (!baseVal.isObject()) {
+        throwException(exec, scope, createInvalidInParameterError(exec, baseVal));
+        return false;
+    }
+
+    JSObject* baseObj = asObject(baseVal);
+
+    uint32_t i;
+    if (propName.getUInt32(i)) {
+        scope.release();
+        return baseObj->hasProperty(exec, i);
+    }
+
+    auto property = propName.toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    scope.release();
+    return baseObj->hasProperty(exec, property);
+}
+
+inline void tryCachePutToScopeGlobal(
+    ExecState* exec, CodeBlock* codeBlock, Instruction* pc, JSObject* scope,
+    GetPutInfo getPutInfo, PutPropertySlot& slot, const Identifier& ident)
+{
+    // Covers implicit globals. Since they don't exist until they first execute, we didn't know how to cache them at compile time.
+    ResolveType resolveType = getPutInfo.resolveType();
+    if (resolveType != GlobalProperty && resolveType != GlobalPropertyWithVarInjectionChecks 
+        && resolveType != UnresolvedProperty && resolveType != UnresolvedPropertyWithVarInjectionChecks)
+        return;
+
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        if (scope->isGlobalObject()) {
+            ResolveType newResolveType = resolveType == UnresolvedProperty ? GlobalProperty : GlobalPropertyWithVarInjectionChecks;
+            resolveType = newResolveType;
+            getPutInfo = GetPutInfo(getPutInfo.resolveMode(), newResolveType, getPutInfo.initializationMode());
+            ConcurrentJSLocker locker(codeBlock->m_lock);
+            pc[4].u.operand = getPutInfo.operand();
+        } else if (scope->isGlobalLexicalEnvironment()) {
+            JSGlobalLexicalEnvironment* globalLexicalEnvironment = jsCast<JSGlobalLexicalEnvironment*>(scope);
+            ResolveType newResolveType = resolveType == UnresolvedProperty ? GlobalLexicalVar : GlobalLexicalVarWithVarInjectionChecks;
+            pc[4].u.operand = GetPutInfo(getPutInfo.resolveMode(), newResolveType, getPutInfo.initializationMode()).operand();
+            SymbolTableEntry entry = globalLexicalEnvironment->symbolTable()->get(ident.impl());
+            ASSERT(!entry.isNull());
+            ConcurrentJSLocker locker(codeBlock->m_lock);
+            pc[5].u.watchpointSet = entry.watchpointSet();
+            pc[6].u.pointer = static_cast<void*>(globalLexicalEnvironment->variableAt(entry.scopeOffset()).slot());
+        }
+    }
+    
+    if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
+        if (!slot.isCacheablePut()
+            || slot.base() != scope
+            || !scope->structure()->propertyAccessesAreCacheable())
+            return;
+        
+        if (slot.type() == PutPropertySlot::NewProperty) {
+            // Don't cache if we've done a transition. We want to detect the first replace so that we
+            // can invalidate the watchpoint.
+            return;
+        }
+        
+        scope->structure()->didCachePropertyReplacement(exec->vm(), slot.cachedOffset());
+
+        ConcurrentJSLocker locker(codeBlock->m_lock);
+        pc[5].u.structure.set(exec->vm(), codeBlock, scope->structure());
+        pc[6].u.operand = slot.cachedOffset();
+    }
+}
+
+inline void tryCacheGetFromScopeGlobal(
+    ExecState* exec, VM& vm, Instruction* pc, JSObject* scope, PropertySlot& slot, const Identifier& ident)
+{
+    GetPutInfo getPutInfo(pc[4].u.operand);
+    ResolveType resolveType = getPutInfo.resolveType();
+
+    if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
+        if (scope->isGlobalObject()) {
+            ResolveType newResolveType = resolveType == UnresolvedProperty ? GlobalProperty : GlobalPropertyWithVarInjectionChecks;
+            resolveType = newResolveType; // Allow below caching mechanism to kick in.
+            ConcurrentJSLocker locker(exec->codeBlock()->m_lock);
+            pc[4].u.operand = GetPutInfo(getPutInfo.resolveMode(), newResolveType, getPutInfo.initializationMode()).operand();
+        } else if (scope->isGlobalLexicalEnvironment()) {
+            JSGlobalLexicalEnvironment* globalLexicalEnvironment = jsCast<JSGlobalLexicalEnvironment*>(scope);
+            ResolveType newResolveType = resolveType == UnresolvedProperty ? GlobalLexicalVar : GlobalLexicalVarWithVarInjectionChecks;
+            SymbolTableEntry entry = globalLexicalEnvironment->symbolTable()->get(ident.impl());
+            ASSERT(!entry.isNull());
+            ConcurrentJSLocker locker(exec->codeBlock()->m_lock);
+            pc[4].u.operand = GetPutInfo(getPutInfo.resolveMode(), newResolveType, getPutInfo.initializationMode()).operand();
+            pc[5].u.watchpointSet = entry.watchpointSet();
+            pc[6].u.pointer = static_cast<void*>(globalLexicalEnvironment->variableAt(entry.scopeOffset()).slot());
+        }
+    }
+
+    // Covers implicit globals. Since they don't exist until they first execute, we didn't know how to cache them at compile time.
+    if (slot.isCacheableValue() && slot.slotBase() == scope && scope->structure()->propertyAccessesAreCacheable()) {
+        if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
+            CodeBlock* codeBlock = exec->codeBlock();
+            Structure* structure = scope->structure(vm);
+            {
+                ConcurrentJSLocker locker(codeBlock->m_lock);
+                pc[5].u.structure.set(exec->vm(), codeBlock, structure);
+                pc[6].u.operand = slot.cachedOffset();
+            }
+            structure->startWatchingPropertyForReplacements(vm, slot.cachedOffset());
+        }
+    }
+}
+
+} // namespace CommonSlowPaths
+
+class ExecState;
+struct Instruction;
+
+#define SLOW_PATH
+    
+#define SLOW_PATH_DECL(name) \
+extern "C" SlowPathReturnType SLOW_PATH name(ExecState* exec, Instruction* pc)
+    
+#define SLOW_PATH_HIDDEN_DECL(name) \
+SLOW_PATH_DECL(name) WTF_INTERNAL
+    
+SLOW_PATH_HIDDEN_DECL(slow_path_call_arityCheck);
+SLOW_PATH_HIDDEN_DECL(slow_path_construct_arityCheck);
+SLOW_PATH_HIDDEN_DECL(slow_path_create_direct_arguments);
+SLOW_PATH_HIDDEN_DECL(slow_path_create_scoped_arguments);
+SLOW_PATH_HIDDEN_DECL(slow_path_create_cloned_arguments);
+SLOW_PATH_HIDDEN_DECL(slow_path_create_this);
+SLOW_PATH_HIDDEN_DECL(slow_path_enter);
+SLOW_PATH_HIDDEN_DECL(slow_path_get_callee);
+SLOW_PATH_HIDDEN_DECL(slow_path_to_this);
+SLOW_PATH_HIDDEN_DECL(slow_path_throw_tdz_error);
+SLOW_PATH_HIDDEN_DECL(slow_path_throw_strict_mode_readonly_property_write_error);
+SLOW_PATH_HIDDEN_DECL(slow_path_not);
+SLOW_PATH_HIDDEN_DECL(slow_path_eq);
+SLOW_PATH_HIDDEN_DECL(slow_path_neq);
+SLOW_PATH_HIDDEN_DECL(slow_path_stricteq);
+SLOW_PATH_HIDDEN_DECL(slow_path_nstricteq);
+SLOW_PATH_HIDDEN_DECL(slow_path_less);
+SLOW_PATH_HIDDEN_DECL(slow_path_lesseq);
+SLOW_PATH_HIDDEN_DECL(slow_path_greater);
+SLOW_PATH_HIDDEN_DECL(slow_path_greatereq);
+SLOW_PATH_HIDDEN_DECL(slow_path_inc);
+SLOW_PATH_HIDDEN_DECL(slow_path_dec);
+SLOW_PATH_HIDDEN_DECL(slow_path_to_number);
+SLOW_PATH_HIDDEN_DECL(slow_path_to_string);
+SLOW_PATH_HIDDEN_DECL(slow_path_negate);
+SLOW_PATH_HIDDEN_DECL(slow_path_add);
+SLOW_PATH_HIDDEN_DECL(slow_path_mul);
+SLOW_PATH_HIDDEN_DECL(slow_path_sub);
+SLOW_PATH_HIDDEN_DECL(slow_path_div);
+SLOW_PATH_HIDDEN_DECL(slow_path_mod);
+SLOW_PATH_HIDDEN_DECL(slow_path_pow);
+SLOW_PATH_HIDDEN_DECL(slow_path_lshift);
+SLOW_PATH_HIDDEN_DECL(slow_path_rshift);
+SLOW_PATH_HIDDEN_DECL(slow_path_urshift);
+SLOW_PATH_HIDDEN_DECL(slow_path_unsigned);
+SLOW_PATH_HIDDEN_DECL(slow_path_bitand);
+SLOW_PATH_HIDDEN_DECL(slow_path_bitor);
+SLOW_PATH_HIDDEN_DECL(slow_path_bitxor);
+SLOW_PATH_HIDDEN_DECL(slow_path_typeof);
+SLOW_PATH_HIDDEN_DECL(slow_path_is_object);
+SLOW_PATH_HIDDEN_DECL(slow_path_is_object_or_null);
+SLOW_PATH_HIDDEN_DECL(slow_path_is_function);
+SLOW_PATH_HIDDEN_DECL(slow_path_in);
+SLOW_PATH_HIDDEN_DECL(slow_path_del_by_val);
+SLOW_PATH_HIDDEN_DECL(slow_path_strcat);
+SLOW_PATH_HIDDEN_DECL(slow_path_to_primitive);
+SLOW_PATH_HIDDEN_DECL(slow_path_get_enumerable_length);
+SLOW_PATH_HIDDEN_DECL(slow_path_has_generic_property);
+SLOW_PATH_HIDDEN_DECL(slow_path_has_structure_property);
+SLOW_PATH_HIDDEN_DECL(slow_path_has_indexed_property);
+SLOW_PATH_HIDDEN_DECL(slow_path_get_direct_pname);
+SLOW_PATH_HIDDEN_DECL(slow_path_get_property_enumerator);
+SLOW_PATH_HIDDEN_DECL(slow_path_next_structure_enumerator_pname);
+SLOW_PATH_HIDDEN_DECL(slow_path_next_generic_enumerator_pname);
+SLOW_PATH_HIDDEN_DECL(slow_path_to_index_string);
+SLOW_PATH_HIDDEN_DECL(slow_path_profile_type_clear_log);
+SLOW_PATH_HIDDEN_DECL(slow_path_assert);
+SLOW_PATH_HIDDEN_DECL(slow_path_create_lexical_environment);
+SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
+SLOW_PATH_HIDDEN_DECL(slow_path_resolve_scope);
+SLOW_PATH_HIDDEN_DECL(slow_path_create_rest);
+SLOW_PATH_HIDDEN_DECL(slow_path_get_by_id_with_this);
+SLOW_PATH_HIDDEN_DECL(slow_path_get_by_val_with_this);
+SLOW_PATH_HIDDEN_DECL(slow_path_put_by_id_with_this);
+SLOW_PATH_HIDDEN_DECL(slow_path_put_by_val_with_this);
+SLOW_PATH_HIDDEN_DECL(slow_path_define_data_property);
+SLOW_PATH_HIDDEN_DECL(slow_path_define_accessor_property);
+SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
+SLOW_PATH_HIDDEN_DECL(slow_path_new_array_with_spread);
+SLOW_PATH_HIDDEN_DECL(slow_path_spread);
+
+} // namespace JSC
diff --git a/runtime/CommonSlowPathsExceptions.cpp b/runtime/CommonSlowPathsExceptions.cpp
new file mode 100644
index 0000000..a272434
--- /dev/null
+++ b/runtime/CommonSlowPathsExceptions.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CommonSlowPathsExceptions.h"
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "Interpreter.h"
+#include "JITExceptions.h"
+#include "LLIntCommon.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace CommonSlowPaths {
+
+void interpreterThrowInCaller(ExecState* exec, JSObject* error)
+{
+    VM* vm = &exec->vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    throwException(exec, scope, error);
+#if LLINT_SLOW_PATH_TRACING
+    dataLog("Throwing exception ", scope.exception(), ".\n");
+#endif
+}
+
+} } // namespace JSC::LLInt
diff --git a/runtime/CommonSlowPathsExceptions.h b/runtime/CommonSlowPathsExceptions.h
new file mode 100644
index 0000000..f5e4876
--- /dev/null
+++ b/runtime/CommonSlowPathsExceptions.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+class ExecState;
+class JSObject;
+
+namespace CommonSlowPaths {
+
+// Throw the currently active exception in the context of the caller's call frame.
+void interpreterThrowInCaller(ExecState* callerFrame, JSObject*);
+
+} } // namespace JSC::CommonSlowPaths
diff --git a/runtime/CompilationResult.cpp b/runtime/CompilationResult.cpp
new file mode 100644
index 0000000..878892f
--- /dev/null
+++ b/runtime/CompilationResult.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CompilationResult.h"
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, CompilationResult result)
+{
+    switch (result) {
+    case CompilationFailed:
+        out.print("CompilationFailed");
+        return;
+    case CompilationInvalidated:
+        out.print("CompilationInvalidated");
+        return;
+    case CompilationSuccessful:
+        out.print("CompilationSuccessful");
+        return;
+    case CompilationDeferred:
+        out.print("CompilationDeferred");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
diff --git a/runtime/CompilationResult.h b/runtime/CompilationResult.h
new file mode 100644
index 0000000..203a4f2
--- /dev/null
+++ b/runtime/CompilationResult.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum CompilationResult {
+    // We tried to compile the code, but we couldn't compile it. This could be
+    // because we ran out of memory, or because the compiler encountered an
+    // internal error and decided to bail out gracefully. Either way, this implies
+    // that we shouldn't try to compile this code block again.
+    CompilationFailed,
+    
+    // The profiling assumptions that were fed into the compiler were invalidated
+    // even before we finished compiling. This means we should try again: in such
+    // cases the profiling will now be updated and the next compilation won't
+    // encounter the same problem. But it does mean that we should exercise
+    // exponential back-off, to get even more profiling so that new profiling
+    // pathologies aren't encountered.
+    CompilationInvalidated,
+    
+    // The compilation succeeded and the code block now has JITCode for the newly
+    // compiled code. However, compilation success doesn't mean that the CodeBlock
+    // will execute yet; you typically have to install it first, unless you plan
+    // on invoking it manually (something that *could* be done for some kinds of
+    // OSR entry).
+    CompilationSuccessful,
+    
+    // We decided to do the compilation asynchronously. This means that we haven't
+    // yet compiled the code. This only happens when you pass a
+    // DeferredCompilationCallback. That callback will get called with some
+    // interesting result, once compilation completes.
+    CompilationDeferred
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::CompilationResult);
+
+} // namespace WTF
diff --git a/runtime/Completion.cpp b/runtime/Completion.cpp
new file mode 100644
index 0000000..a5ed559
--- /dev/null
+++ b/runtime/Completion.cpp
@@ -0,0 +1,243 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2007, 2013, 2016 Apple Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Completion.h"
+
+#include "CallFrame.h"
+#include "CodeProfiling.h"
+#include "Exception.h"
+#include "IdentifierInlines.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSInternalPromise.h"
+#include "JSInternalPromiseDeferred.h"
+#include "JSLock.h"
+#include "JSModuleLoader.h"
+#include "JSModuleRecord.h"
+#include "JSWithScope.h"
+#include "ModuleAnalyzer.h"
+#include "Parser.h"
+#include "ProgramExecutable.h"
+#include "ScriptProfilingScope.h"
+#include <wtf/WTFThreadData.h>
+
+namespace JSC {
+
+bool checkSyntax(ExecState* exec, const SourceCode& source, JSValue* returnedException)
+{
+    JSLockHolder lock(exec);
+    RELEASE_ASSERT(exec->vm().atomicStringTable() == wtfThreadData().atomicStringTable());
+
+    ProgramExecutable* program = ProgramExecutable::create(exec, source);
+    JSObject* error = program->checkSyntax(exec);
+    if (error) {
+        if (returnedException)
+            *returnedException = error;
+        return false;
+    }
+
+    return true;
+}
+    
+bool checkSyntax(VM& vm, const SourceCode& source, ParserError& error)
+{
+    JSLockHolder lock(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == wtfThreadData().atomicStringTable());
+    return !!parse<ProgramNode>(
+        &vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin,
+        JSParserStrictMode::NotStrict, JSParserScriptMode::Classic, SourceParseMode::ProgramMode, SuperBinding::NotNeeded, error);
+}
+
+bool checkModuleSyntax(ExecState* exec, const SourceCode& source, ParserError& error)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == wtfThreadData().atomicStringTable());
+    std::unique_ptr<ModuleProgramNode> moduleProgramNode = parse<ModuleProgramNode>(
+        &vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin,
+        JSParserStrictMode::Strict, JSParserScriptMode::Module, SourceParseMode::ModuleAnalyzeMode, SuperBinding::NotNeeded, error);
+    if (!moduleProgramNode)
+        return false;
+
+    PrivateName privateName(PrivateName::Description, "EntryPointModule");
+    ModuleAnalyzer moduleAnalyzer(exec, Identifier::fromUid(privateName), source, moduleProgramNode->varDeclarations(), moduleProgramNode->lexicalVariables());
+    moduleAnalyzer.analyze(*moduleProgramNode);
+    return true;
+}
+
+JSValue evaluate(ExecState* exec, const SourceCode& source, JSValue thisValue, NakedPtr<Exception>& returnedException)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == wtfThreadData().atomicStringTable());
+    RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
+
+    CodeProfiling profile(source);
+
+    if (!thisValue || thisValue.isUndefinedOrNull())
+        thisValue = exec->vmEntryGlobalObject();
+    JSObject* thisObj = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
+    JSValue result = exec->interpreter()->executeProgram(source, exec, thisObj);
+
+    if (scope.exception()) {
+        returnedException = scope.exception();
+        scope.clearException();
+        return jsUndefined();
+    }
+
+    RELEASE_ASSERT(result);
+    return result;
+}
+
+JSValue profiledEvaluate(ExecState* exec, ProfilingReason reason, const SourceCode& source, JSValue thisValue, NakedPtr<Exception>& returnedException)
+{
+    ScriptProfilingScope profilingScope(exec->vmEntryGlobalObject(), reason);
+    return evaluate(exec, source, thisValue, returnedException);
+}
+
+JSValue evaluateWithScopeExtension(ExecState* exec, const SourceCode& source, JSObject* scopeExtensionObject, NakedPtr<Exception>& returnedException)
+{
+    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
+
+    if (scopeExtensionObject) {
+        JSScope* ignoredPreviousScope = globalObject->globalScope();
+        globalObject->setGlobalScopeExtension(JSWithScope::create(exec->vm(), globalObject, scopeExtensionObject, ignoredPreviousScope));
+    }
+
+    JSValue returnValue = JSC::evaluate(globalObject->globalExec(), source, globalObject, returnedException);
+
+    if (scopeExtensionObject)
+        globalObject->clearGlobalScopeExtension();
+
+    return returnValue;
+}
+
+static Symbol* createSymbolForEntryPointModule(VM& vm)
+{
+    // Generate the unique key for the source-provided module.
+    PrivateName privateName(PrivateName::Description, "EntryPointModule");
+    return Symbol::create(vm, privateName.uid());
+}
+
+static JSInternalPromise* rejectPromise(ExecState* exec, JSGlobalObject* globalObject)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    ASSERT(scope.exception());
+    JSValue exception = scope.exception()->value();
+    scope.clearException();
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    deferred->reject(exec, exception);
+    return deferred->promise();
+}
+
+static JSInternalPromise* loadAndEvaluateModule(const JSLockHolder&, ExecState* exec, JSGlobalObject* globalObject, JSValue moduleName, JSValue referrer, JSValue initiator)
+{
+    return globalObject->moduleLoader()->loadAndEvaluateModule(exec, moduleName, referrer, initiator);
+}
+
+static JSInternalPromise* loadAndEvaluateModule(const JSLockHolder& lock, ExecState* exec, JSGlobalObject* globalObject, const Identifier& moduleName, JSValue initiator)
+{
+    return loadAndEvaluateModule(lock, exec, globalObject, identifierToJSValue(exec->vm(), moduleName), jsUndefined(), initiator);
+}
+
+JSInternalPromise* loadAndEvaluateModule(ExecState* exec, const String& moduleName, JSValue initiator)
+{
+    JSLockHolder lock(exec);
+    RELEASE_ASSERT(exec->vm().atomicStringTable() == wtfThreadData().atomicStringTable());
+    RELEASE_ASSERT(!exec->vm().isCollectorBusyOnCurrentThread());
+
+    return loadAndEvaluateModule(lock, exec, exec->vmEntryGlobalObject(), Identifier::fromString(exec, moduleName), initiator);
+}
+
+JSInternalPromise* loadAndEvaluateModule(ExecState* exec, const SourceCode& source, JSValue initiator)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == wtfThreadData().atomicStringTable());
+    RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
+
+    Symbol* key = createSymbolForEntryPointModule(vm);
+
+    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
+
+    // Insert the given source code to the ModuleLoader registry as the fetched registry entry.
+    globalObject->moduleLoader()->provide(exec, key, JSModuleLoader::Status::Fetch, source.view().toString());
+    RETURN_IF_EXCEPTION(scope, rejectPromise(exec, globalObject));
+
+    return loadAndEvaluateModule(lock, exec, globalObject, key, jsUndefined(), initiator);
+}
+
+static JSInternalPromise* loadModule(const JSLockHolder&, ExecState* exec, JSGlobalObject* globalObject, JSValue moduleName, JSValue referrer, JSValue initiator)
+{
+    return globalObject->moduleLoader()->loadModule(exec, moduleName, referrer, initiator);
+}
+
+static JSInternalPromise* loadModule(const JSLockHolder& lock, ExecState* exec, JSGlobalObject* globalObject, const Identifier& moduleName, JSValue initiator)
+{
+    return loadModule(lock, exec, globalObject, identifierToJSValue(exec->vm(), moduleName), jsUndefined(), initiator);
+}
+
+JSInternalPromise* loadModule(ExecState* exec, const String& moduleName, JSValue initiator)
+{
+    JSLockHolder lock(exec);
+    RELEASE_ASSERT(exec->vm().atomicStringTable() == wtfThreadData().atomicStringTable());
+    RELEASE_ASSERT(!exec->vm().isCollectorBusyOnCurrentThread());
+
+    return loadModule(lock, exec, exec->vmEntryGlobalObject(), Identifier::fromString(exec, moduleName), initiator);
+}
+
+JSInternalPromise* loadModule(ExecState* exec, const SourceCode& source, JSValue initiator)
+{
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == wtfThreadData().atomicStringTable());
+    RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
+
+    Symbol* key = createSymbolForEntryPointModule(vm);
+
+    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
+
+    // Insert the given source code to the ModuleLoader registry as the fetched registry entry.
+    // FIXME: Introduce JSSourceCode object to wrap around this source.
+    globalObject->moduleLoader()->provide(exec, key, JSModuleLoader::Status::Fetch, source.view().toString());
+    RETURN_IF_EXCEPTION(scope, rejectPromise(exec, globalObject));
+
+    return loadModule(lock, exec, globalObject, key, jsUndefined(), initiator);
+}
+
+JSValue linkAndEvaluateModule(ExecState* exec, const Identifier& moduleKey, JSValue initiator)
+{
+    JSLockHolder lock(exec);
+    RELEASE_ASSERT(exec->vm().atomicStringTable() == wtfThreadData().atomicStringTable());
+    RELEASE_ASSERT(!exec->vm().isCollectorBusyOnCurrentThread());
+
+    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
+    return globalObject->moduleLoader()->linkAndEvaluateModule(exec, identifierToJSValue(exec->vm(), moduleKey), initiator);
+}
+
+} // namespace JSC
diff --git a/runtime/Completion.h b/runtime/Completion.h
new file mode 100644
index 0000000..198d7ec
--- /dev/null
+++ b/runtime/Completion.h
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2007 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "CallData.h"
+#include "JSCJSValue.h"
+#include <wtf/NakedPtr.h>
+
+namespace JSC {
+
+class Exception;
+class ExecState;
+class JSObject;
+class ParserError;
+class SourceCode;
+class VM;
+class JSInternalPromise;
+
+JS_EXPORT_PRIVATE bool checkSyntax(VM&, const SourceCode&, ParserError&);
+JS_EXPORT_PRIVATE bool checkSyntax(ExecState*, const SourceCode&, JSValue* exception = 0);
+JS_EXPORT_PRIVATE bool checkModuleSyntax(ExecState*, const SourceCode&, ParserError&);
+
+JS_EXPORT_PRIVATE JSValue evaluate(ExecState*, const SourceCode&, JSValue thisValue, NakedPtr<Exception>& returnedException);
+inline JSValue evaluate(ExecState* exec, const SourceCode& sourceCode, JSValue thisValue = JSValue())
+{
+    NakedPtr<Exception> unused;
+    return evaluate(exec, sourceCode, thisValue, unused);
+}
+
+JS_EXPORT_PRIVATE JSValue profiledEvaluate(ExecState*, ProfilingReason, const SourceCode&, JSValue thisValue, NakedPtr<Exception>& returnedException);
+inline JSValue profiledEvaluate(ExecState* exec, ProfilingReason reason, const SourceCode& sourceCode, JSValue thisValue = JSValue())
+{
+    NakedPtr<Exception> unused;
+    return profiledEvaluate(exec, reason, sourceCode, thisValue, unused);
+}
+
+JS_EXPORT_PRIVATE JSValue evaluateWithScopeExtension(ExecState*, const SourceCode&, JSObject* scopeExtension, NakedPtr<Exception>& returnedException);
+
+// Load the module source and evaluate it.
+JS_EXPORT_PRIVATE JSInternalPromise* loadAndEvaluateModule(ExecState*, const String& moduleName, JSValue initiator = jsUndefined());
+JS_EXPORT_PRIVATE JSInternalPromise* loadAndEvaluateModule(ExecState*, const SourceCode&, JSValue initiator = jsUndefined());
+
+// Fetch the module source, and instantiate the module record.
+JS_EXPORT_PRIVATE JSInternalPromise* loadModule(ExecState*, const String& moduleName, JSValue initiator = jsUndefined());
+JS_EXPORT_PRIVATE JSInternalPromise* loadModule(ExecState*, const SourceCode&, JSValue initiator = jsUndefined());
+
+// Link and evaluate the already linked module. This function is called in a sync manner.
+JS_EXPORT_PRIVATE JSValue linkAndEvaluateModule(ExecState*, const Identifier& moduleKey, JSValue initiator = jsUndefined());
+
+} // namespace JSC
diff --git a/runtime/ConcurrentJSLock.h b/runtime/ConcurrentJSLock.h
new file mode 100644
index 0000000..b5c8ba4
--- /dev/null
+++ b/runtime/ConcurrentJSLock.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DeferGC.h"
+#include <wtf/Lock.h>
+#include <wtf/NoLock.h>
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+#if ENABLE(CONCURRENT_JS)
+typedef Lock ConcurrentJSLock;
+typedef LockHolder ConcurrentJSLockerImpl;
+#else
+typedef NoLock ConcurrentJSLock;
+typedef NoLockLocker ConcurrentJSLockerImpl;
+#endif
+
+class ConcurrentJSLockerBase : public AbstractLocker {
+    WTF_MAKE_NONCOPYABLE(ConcurrentJSLockerBase);
+public:
+    explicit ConcurrentJSLockerBase(ConcurrentJSLock& lockable)
+        : m_locker(&lockable)
+    {
+    }
+    explicit ConcurrentJSLockerBase(ConcurrentJSLock* lockable)
+        : m_locker(lockable)
+    {
+    }
+
+    explicit ConcurrentJSLockerBase(NoLockingNecessaryTag)
+        : m_locker(NoLockingNecessary)
+    {
+    }
+
+    ~ConcurrentJSLockerBase()
+    {
+    }
+    
+    void unlockEarly()
+    {
+        m_locker.unlockEarly();
+    }
+
+private:
+    ConcurrentJSLockerImpl m_locker;
+};
+
+class GCSafeConcurrentJSLocker : public ConcurrentJSLockerBase {
+public:
+    GCSafeConcurrentJSLocker(ConcurrentJSLock& lockable, Heap& heap)
+        : ConcurrentJSLockerBase(lockable)
+        , m_deferGC(heap)
+    {
+    }
+
+    GCSafeConcurrentJSLocker(ConcurrentJSLock* lockable, Heap& heap)
+        : ConcurrentJSLockerBase(lockable)
+        , m_deferGC(heap)
+    {
+    }
+
+    ~GCSafeConcurrentJSLocker()
+    {
+        // We have to unlock early due to the destruction order of base
+        // vs. derived classes. If we didn't, then we would destroy the 
+        // DeferGC object before unlocking the lock which could cause a GC
+        // and resulting deadlock.
+        unlockEarly();
+    }
+
+private:
+    DeferGC m_deferGC;
+};
+
+class ConcurrentJSLocker : public ConcurrentJSLockerBase {
+public:
+    ConcurrentJSLocker(ConcurrentJSLock& lockable)
+        : ConcurrentJSLockerBase(lockable)
+#if ENABLE(CONCURRENT_JS) && !defined(NDEBUG)
+        , m_disallowGC(std::in_place)
+#endif
+    {
+    }
+
+    ConcurrentJSLocker(ConcurrentJSLock* lockable)
+        : ConcurrentJSLockerBase(lockable)
+#if ENABLE(CONCURRENT_JS) && !defined(NDEBUG)
+        , m_disallowGC(std::in_place)
+#endif
+    {
+    }
+
+    ConcurrentJSLocker(NoLockingNecessaryTag)
+        : ConcurrentJSLockerBase(NoLockingNecessary)
+#if ENABLE(CONCURRENT_JS) && !defined(NDEBUG)
+        , m_disallowGC(std::nullopt)
+#endif
+    {
+    }
+    
+    ConcurrentJSLocker(int) = delete;
+
+#if ENABLE(CONCURRENT_JS) && !defined(NDEBUG)
+private:
+    std::optional<DisallowGC> m_disallowGC;
+#endif
+};
+
+} // namespace JSC
diff --git a/runtime/ConsoleClient.cpp b/runtime/ConsoleClient.cpp
new file mode 100644
index 0000000..1ae3e29
--- /dev/null
+++ b/runtime/ConsoleClient.cpp
@@ -0,0 +1,251 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ConsoleClient.h"
+
+#include "JSCInlines.h"
+#include "ScriptArguments.h"
+#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
+#include "ScriptValue.h"
+#include <wtf/Assertions.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+using namespace Inspector;
+
+namespace JSC {
+
+static void appendURLAndPosition(StringBuilder& builder, const String& url, unsigned lineNumber, unsigned columnNumber)
+{
+    if (url.isEmpty())
+        return;
+
+    builder.append(url);
+
+    if (lineNumber > 0) {
+        builder.append(':');
+        builder.appendNumber(lineNumber);
+    }
+
+    if (columnNumber > 0) {
+        builder.append(':');
+        builder.appendNumber(columnNumber);
+    }
+}
+
+static void appendMessagePrefix(StringBuilder& builder, MessageSource source, MessageType type, MessageLevel level)
+{
+    const char* sourceString;
+    switch (source) {
+    case MessageSource::XML:
+        sourceString = "XML";
+        break;
+    case MessageSource::JS:
+        sourceString = "JS";
+        break;
+    case MessageSource::Network:
+        sourceString = "NETWORK";
+        break;
+    case MessageSource::ConsoleAPI:
+        sourceString = "CONSOLE";
+        break;
+    case MessageSource::Storage:
+        sourceString = "STORAGE";
+        break;
+    case MessageSource::AppCache:
+        sourceString = "APPCACHE";
+        break;
+    case MessageSource::Rendering:
+        sourceString = "RENDERING";
+        break;
+    case MessageSource::CSS:
+        sourceString = "CSS";
+        break;
+    case MessageSource::Security:
+        sourceString = "SECURITY";
+        break;
+    case MessageSource::Other:
+        sourceString = "OTHER";
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        sourceString = "UNKNOWN";
+        break;
+    }
+
+    const char* levelString;
+    switch (level) {
+    case MessageLevel::Debug:
+        levelString = "DEBUG";
+        break;
+    case MessageLevel::Log:
+        levelString = "LOG";
+        break;
+    case MessageLevel::Info:
+        levelString = "INFO";
+        break;
+    case MessageLevel::Warning:
+        levelString = "WARN";
+        break;
+    case MessageLevel::Error:
+        levelString = "ERROR";
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        levelString = "UNKNOWN";
+        break;
+    }
+
+    if (type == MessageType::Trace)
+        levelString = "TRACE";
+    else if (type == MessageType::Table)
+        levelString = "TABLE";
+
+    builder.append(sourceString);
+    builder.append(' ');
+    builder.append(levelString);
+}
+
+void ConsoleClient::printConsoleMessage(MessageSource source, MessageType type, MessageLevel level, const String& message, const String& url, unsigned lineNumber, unsigned columnNumber)
+{
+    StringBuilder builder;
+
+    if (!url.isEmpty()) {
+        appendURLAndPosition(builder, url, lineNumber, columnNumber);
+        builder.appendLiteral(": ");
+    }
+
+    appendMessagePrefix(builder, source, type, level);
+    builder.append(' ');
+    builder.append(message);
+
+    WTFLogAlways("%s", builder.toString().utf8().data());
+}
+
+void ConsoleClient::printConsoleMessageWithArguments(MessageSource source, MessageType type, MessageLevel level, JSC::ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    bool isTraceMessage = type == MessageType::Trace;
+    size_t stackSize = isTraceMessage ? ScriptCallStack::maxCallStackSizeToCapture : 1;
+    RefPtr<ScriptCallStack> callStack(createScriptCallStackForConsole(exec, stackSize));
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+
+    StringBuilder builder;
+
+    if (!lastCaller.sourceURL().isEmpty()) {
+        appendURLAndPosition(builder, lastCaller.sourceURL(), lastCaller.lineNumber(), lastCaller.columnNumber());
+        builder.appendLiteral(": ");
+    }
+
+    appendMessagePrefix(builder, source, type, level);
+    for (size_t i = 0; i < arguments->argumentCount(); ++i) {
+        String argAsString = arguments->argumentAt(i).toString(arguments->globalState());
+        builder.append(' ');
+        builder.append(argAsString.utf8().data());
+    }
+
+    WTFLogAlways("%s", builder.toString().utf8().data());
+
+    if (isTraceMessage) {
+        for (size_t i = 0; i < callStack->size(); ++i) {
+            const ScriptCallFrame& callFrame = callStack->at(i);
+            String functionName = String(callFrame.functionName());
+            if (functionName.isEmpty())
+                functionName = ASCIILiteral("(unknown)");
+
+            StringBuilder callFrameBuilder;
+            callFrameBuilder.appendNumber(i);
+            callFrameBuilder.appendLiteral(": ");
+            callFrameBuilder.append(functionName);
+            callFrameBuilder.append('(');
+            appendURLAndPosition(callFrameBuilder, callFrame.sourceURL(), callFrame.lineNumber(), callFrame.columnNumber());
+            callFrameBuilder.append(')');
+
+            WTFLogAlways("%s", callFrameBuilder.toString().utf8().data());
+        }
+    }
+}
+
+void ConsoleClient::internalMessageWithTypeAndLevel(MessageType type, MessageLevel level, JSC::ExecState* exec, RefPtr<ScriptArguments>&& arguments, ArgumentRequirement argumentRequirement)
+{
+    if (argumentRequirement == ArgumentRequired && !arguments->argumentCount())
+        return;
+
+    messageWithTypeAndLevel(type, level, exec, WTFMove(arguments));
+}
+
+void ConsoleClient::logWithLevel(ExecState* exec, RefPtr<ScriptArguments>&& arguments, MessageLevel level)
+{
+    internalMessageWithTypeAndLevel(MessageType::Log, level, exec, WTFMove(arguments), ArgumentRequired);
+}
+
+void ConsoleClient::clear(ExecState* exec)
+{
+    internalMessageWithTypeAndLevel(MessageType::Clear, MessageLevel::Log, exec, ScriptArguments::createEmpty(exec), ArgumentNotRequired);
+}
+
+void ConsoleClient::dir(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    internalMessageWithTypeAndLevel(MessageType::Dir, MessageLevel::Log, exec, WTFMove(arguments), ArgumentRequired);
+}
+
+void ConsoleClient::dirXML(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    internalMessageWithTypeAndLevel(MessageType::DirXML, MessageLevel::Log, exec, WTFMove(arguments), ArgumentRequired);
+}
+
+void ConsoleClient::table(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    internalMessageWithTypeAndLevel(MessageType::Table, MessageLevel::Log, exec, WTFMove(arguments), ArgumentRequired);
+}
+
+void ConsoleClient::trace(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    internalMessageWithTypeAndLevel(MessageType::Trace, MessageLevel::Log, exec, WTFMove(arguments), ArgumentNotRequired);
+}
+
+void ConsoleClient::assertion(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    internalMessageWithTypeAndLevel(MessageType::Assert, MessageLevel::Error, exec, WTFMove(arguments), ArgumentNotRequired);
+}
+
+void ConsoleClient::group(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    internalMessageWithTypeAndLevel(MessageType::StartGroup, MessageLevel::Log, exec, WTFMove(arguments), ArgumentNotRequired);
+}
+
+void ConsoleClient::groupCollapsed(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    internalMessageWithTypeAndLevel(MessageType::StartGroupCollapsed, MessageLevel::Log, exec, WTFMove(arguments), ArgumentNotRequired);
+}
+
+void ConsoleClient::groupEnd(ExecState* exec, RefPtr<ScriptArguments>&& arguments)
+{
+    internalMessageWithTypeAndLevel(MessageType::EndGroup, MessageLevel::Log, exec, WTFMove(arguments), ArgumentNotRequired);
+}
+
+} // namespace JSC
diff --git a/runtime/ConsoleClient.h b/runtime/ConsoleClient.h
new file mode 100644
index 0000000..759df7f
--- /dev/null
+++ b/runtime/ConsoleClient.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConsoleTypes.h"
+#include <wtf/Forward.h>
+
+namespace Inspector {
+class ScriptArguments;
+}
+
+namespace JSC {
+
+class ExecState;
+
+class ConsoleClient {
+public:
+    virtual ~ConsoleClient() { }
+
+    JS_EXPORT_PRIVATE static void printConsoleMessage(MessageSource, MessageType, MessageLevel, const String& message, const String& url, unsigned lineNumber, unsigned columnNumber);
+    JS_EXPORT_PRIVATE static void printConsoleMessageWithArguments(MessageSource, MessageType, MessageLevel, JSC::ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+
+    void logWithLevel(ExecState*, RefPtr<Inspector::ScriptArguments>&&, MessageLevel);
+    void clear(ExecState*);
+    void dir(ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+    void dirXML(ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+    void table(ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+    void trace(ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+    void assertion(ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+    void group(ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+    void groupCollapsed(ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+    void groupEnd(ExecState*, RefPtr<Inspector::ScriptArguments>&&);
+
+    virtual void messageWithTypeAndLevel(MessageType, MessageLevel, JSC::ExecState*, RefPtr<Inspector::ScriptArguments>&&) = 0;
+    virtual void count(ExecState*, RefPtr<Inspector::ScriptArguments>&&) = 0;
+    virtual void profile(ExecState*, const String& title) = 0;
+    virtual void profileEnd(ExecState*, const String& title) = 0;
+    virtual void takeHeapSnapshot(ExecState*, const String& title) = 0;
+    virtual void time(ExecState*, const String& title) = 0;
+    virtual void timeEnd(ExecState*, const String& title) = 0;
+    virtual void timeStamp(ExecState*, RefPtr<Inspector::ScriptArguments>&&) = 0;
+
+private:
+    enum ArgumentRequirement { ArgumentRequired, ArgumentNotRequired };
+    void internalMessageWithTypeAndLevel(MessageType, MessageLevel, JSC::ExecState*, RefPtr<Inspector::ScriptArguments>&&, ArgumentRequirement);
+};
+
+} // namespace JSC
diff --git a/runtime/ConsoleObject.cpp b/runtime/ConsoleObject.cpp
new file mode 100644
index 0000000..19bd5bd
--- /dev/null
+++ b/runtime/ConsoleObject.cpp
@@ -0,0 +1,381 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ConsoleObject.h"
+
+#include "ConsoleClient.h"
+#include "Error.h"
+#include "JSCInlines.h"
+#include "ScriptArguments.h"
+#include "ScriptCallStackFactory.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ConsoleObject);
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncDebug(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncError(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncLog(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncInfo(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncWarn(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncClear(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncDir(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncDirXML(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTable(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTrace(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncAssert(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncCount(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncProfile(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncProfileEnd(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTakeHeapSnapshot(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTime(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTimeEnd(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTimeStamp(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncGroup(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncGroupCollapsed(ExecState*);
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncGroupEnd(ExecState*);
+
+const ClassInfo ConsoleObject::s_info = { "Console", &Base::s_info, 0, CREATE_METHOD_TABLE(ConsoleObject) };
+
+ConsoleObject::ConsoleObject(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void ConsoleObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    // For legacy reasons, console properties are enumerable, writable, deleteable,
+    // and all have a length of 0. This may change if Console is standardized.
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("debug", consoleProtoFuncDebug, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("error", consoleProtoFuncError, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("log", consoleProtoFuncLog, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("info", consoleProtoFuncInfo, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("warn", consoleProtoFuncWarn, None, 0);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, consoleProtoFuncClear, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("dir", consoleProtoFuncDir, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("dirxml", consoleProtoFuncDirXML, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("table", consoleProtoFuncTable, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("trace", consoleProtoFuncTrace, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("assert", consoleProtoFuncAssert, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->count, consoleProtoFuncCount, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("profile", consoleProtoFuncProfile, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("profileEnd", consoleProtoFuncProfileEnd, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("time", consoleProtoFuncTime, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("timeEnd", consoleProtoFuncTimeEnd, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("timeStamp", consoleProtoFuncTimeStamp, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("takeHeapSnapshot", consoleProtoFuncTakeHeapSnapshot, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("group", consoleProtoFuncGroup, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("groupCollapsed", consoleProtoFuncGroupCollapsed, None, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("groupEnd", consoleProtoFuncGroupEnd, None, 0);
+}
+
+static String valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue value)
+{
+    if (value.isUndefinedOrNull())
+        return String();
+    return value.toWTFString(exec);
+}
+
+static EncodedJSValue consoleLogWithLevel(ExecState* exec, MessageLevel level)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->logWithLevel(exec, WTFMove(arguments), level);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncDebug(ExecState* exec)
+{
+    return consoleLogWithLevel(exec, MessageLevel::Debug);
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncError(ExecState* exec)
+{
+    return consoleLogWithLevel(exec, MessageLevel::Error);
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncLog(ExecState* exec)
+{
+    return consoleLogWithLevel(exec, MessageLevel::Log);
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncInfo(ExecState* exec)
+{
+    return consoleLogWithLevel(exec, MessageLevel::Info);
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncWarn(ExecState* exec)
+{
+    return consoleLogWithLevel(exec, MessageLevel::Warning);
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncClear(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    client->clear(exec);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncDir(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->dir(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncDirXML(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->dirXML(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTable(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->table(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTrace(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->trace(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncAssert(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    bool condition = exec->argument(0).toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (condition)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 1));
+    client->assertion(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncCount(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->count(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncProfile(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    size_t argsCount = exec->argumentCount();
+    if (!argsCount) {
+        client->profile(exec, String());
+        return JSValue::encode(jsUndefined());
+    }
+
+    const String& title(valueToStringWithUndefinedOrNullCheck(exec, exec->argument(0)));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    client->profile(exec, title);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncProfileEnd(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    size_t argsCount = exec->argumentCount();
+    if (!argsCount) {
+        client->profileEnd(exec, String());
+        return JSValue::encode(jsUndefined());
+    }
+
+    const String& title(valueToStringWithUndefinedOrNullCheck(exec, exec->argument(0)));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    client->profileEnd(exec, title);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTakeHeapSnapshot(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    size_t argsCount = exec->argumentCount();
+    if (!argsCount) {
+        client->takeHeapSnapshot(exec, String());
+        return JSValue::encode(jsUndefined());
+    }
+
+    const String& title(valueToStringWithUndefinedOrNullCheck(exec, exec->argument(0)));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    client->takeHeapSnapshot(exec, title);
+    return JSValue::encode(jsUndefined());
+}
+
+static String valueOrDefaultLabelString(ExecState* exec, JSValue value)
+{
+    if (value.isUndefined())
+        return ASCIILiteral("default");
+    return value.toWTFString(exec);
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTime(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    String title;
+    if (exec->argumentCount() < 1)
+        title = ASCIILiteral("default");
+    else {
+        title = valueOrDefaultLabelString(exec, exec->argument(0));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    client->time(exec, title);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTimeEnd(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    String title;
+    if (exec->argumentCount() < 1)
+        title =  ASCIILiteral("default");
+    else {
+        title = valueOrDefaultLabelString(exec, exec->argument(0));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    client->timeEnd(exec, title);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncTimeStamp(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->timeStamp(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncGroup(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->group(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncGroupCollapsed(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->groupCollapsed(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL consoleProtoFuncGroupEnd(ExecState* exec)
+{
+    ConsoleClient* client = exec->lexicalGlobalObject()->consoleClient();
+    if (!client)
+        return JSValue::encode(jsUndefined());
+
+    RefPtr<Inspector::ScriptArguments> arguments(Inspector::createScriptArguments(exec, 0));
+    client->groupEnd(exec, WTFMove(arguments));
+    return JSValue::encode(jsUndefined());
+}
+
+} // namespace JSC
diff --git a/runtime/ConsoleObject.h b/runtime/ConsoleObject.h
new file mode 100644
index 0000000..1d0e404
--- /dev/null
+++ b/runtime/ConsoleObject.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class ConsoleObject : public JSNonFinalObject {
+private:
+    ConsoleObject(VM&, Structure*);
+
+public:
+    typedef JSNonFinalObject Base;
+
+    static ConsoleObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        ConsoleObject* object = new (NotNull, allocateCell<ConsoleObject>(vm.heap)) ConsoleObject(vm, structure);
+        object->finishCreation(vm, globalObject);
+        return object;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/ConsoleTypes.h b/runtime/ConsoleTypes.h
new file mode 100644
index 0000000..9b670a4
--- /dev/null
+++ b/runtime/ConsoleTypes.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum class MessageSource {
+    XML,
+    JS,
+    Network,
+    ConsoleAPI,
+    Storage,
+    AppCache,
+    Rendering,
+    CSS,
+    Security,
+    ContentBlocker,
+    Other,
+};
+
+enum class MessageType {
+    Log,
+    Dir,
+    DirXML,
+    Table,
+    Trace,
+    StartGroup,
+    StartGroupCollapsed,
+    EndGroup,
+    Clear,
+    Assert,
+    Timing,
+    Profile,
+    ProfileEnd,
+};
+
+enum class MessageLevel {
+    Log = 1,
+    Warning = 2,
+    Error = 3,
+    Debug = 4,
+    Info = 5,
+};
+
+} // namespace JSC
+
+using JSC::MessageSource;
+using JSC::MessageType;
+using JSC::MessageLevel;
diff --git a/runtime/ConstantMode.cpp b/runtime/ConstantMode.cpp
new file mode 100644
index 0000000..58ba794
--- /dev/null
+++ b/runtime/ConstantMode.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ConstantMode.h"
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, ConstantMode mode)
+{
+    switch (mode) {
+    case IsConstant:
+        out.print("Constant");
+        return;
+    case IsVariable:
+        out.print("Variable");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
diff --git a/runtime/ConstantMode.h b/runtime/ConstantMode.h
new file mode 100644
index 0000000..fe73fd0
--- /dev/null
+++ b/runtime/ConstantMode.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum ConstantMode { IsConstant, IsVariable };
+
+inline ConstantMode modeForIsConstant(bool isConstant)
+{
+    return isConstant ? IsConstant : IsVariable;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::ConstantMode);
+
+} // namespace WTF
diff --git a/runtime/ConstructAbility.h b/runtime/ConstructAbility.h
new file mode 100644
index 0000000..e39d5f3
--- /dev/null
+++ b/runtime/ConstructAbility.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum class ConstructAbility : unsigned {
+    CanConstruct,
+    CannotConstruct,
+};
+
+} // namespace JSC
diff --git a/runtime/ConstructData.cpp b/runtime/ConstructData.cpp
new file mode 100644
index 0000000..94e672f
--- /dev/null
+++ b/runtime/ConstructData.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ConstructData.h"
+
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "ScriptProfilingScope.h"
+
+namespace JSC {
+
+JSObject* construct(ExecState* exec, JSValue constructorObject, const ArgList& args, const char* errorMessage)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    ConstructData constructData;
+    ConstructType constructType = getConstructData(constructorObject, constructData);
+    if (constructType == ConstructType::None)
+        return throwTypeError(exec, scope, errorMessage);
+
+    scope.release();
+    return construct(exec, constructorObject, constructType, constructData, args, constructorObject);
+}
+
+
+JSObject* construct(ExecState* exec, JSValue constructorObject, ConstructType constructType, const ConstructData& constructData, const ArgList& args, JSValue newTarget)
+{
+    ASSERT(constructType == ConstructType::JS || constructType == ConstructType::Host);
+    return exec->interpreter()->executeConstruct(exec, asObject(constructorObject), constructType, constructData, args, newTarget);
+}
+
+JSObject* profiledConstruct(ExecState* exec, ProfilingReason reason, JSValue constructorObject, ConstructType constructType, const ConstructData& constructData, const ArgList& args, JSValue newTarget)
+{
+    ScriptProfilingScope profilingScope(exec->vmEntryGlobalObject(), reason);
+    return construct(exec, constructorObject, constructType, constructData, args, newTarget);
+}
+
+} // namespace JSC
diff --git a/runtime/ConstructData.h b/runtime/ConstructData.h
new file mode 100644
index 0000000..b12a4cf
--- /dev/null
+++ b/runtime/ConstructData.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CallData.h"
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+class ArgList;
+class ExecState;
+class FunctionExecutable;
+class JSObject;
+class JSScope;
+
+enum class ConstructType : unsigned {
+    None,
+    Host,
+    JS
+};
+
+struct ConstructData {
+    union {
+        struct {
+            NativeFunction function;
+        } native;
+        struct {
+            FunctionExecutable* functionExecutable;
+            JSScope* scope;
+        } js;
+    };
+};
+
+// Convenience wrapper so you don't need to deal with CallData and CallType unless you are going to use them.
+JSObject* construct(ExecState*, JSValue functionObject, const ArgList&, const char* errorMessage);
+JS_EXPORT_PRIVATE JSObject* construct(ExecState*, JSValue constructor, ConstructType, const ConstructData&, const ArgList&, JSValue newTarget);
+
+ALWAYS_INLINE JSObject* construct(ExecState* exec, JSValue constructorObject, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
+{
+    return construct(exec, constructorObject, constructType, constructData, args, constructorObject);
+}
+
+JS_EXPORT_PRIVATE JSObject* profiledConstruct(ExecState*, ProfilingReason, JSValue constructor, ConstructType, const ConstructData&, const ArgList&, JSValue newTarget);
+
+ALWAYS_INLINE JSObject* profiledConstruct(ExecState* exec, ProfilingReason reason, JSValue constructorObject, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
+{
+    return profiledConstruct(exec, reason, constructorObject, constructType, constructData, args, constructorObject);
+}
+
+} // namespace JSC
diff --git a/runtime/ControlFlowProfiler.cpp b/runtime/ControlFlowProfiler.cpp
new file mode 100644
index 0000000..ebb4299
--- /dev/null
+++ b/runtime/ControlFlowProfiler.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 Saam Barati. <saambarati1@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ControlFlowProfiler.h"
+
+#include "VM.h"
+
+namespace JSC {
+
+ControlFlowProfiler::ControlFlowProfiler()
+    : m_dummyBasicBlock(BasicBlockLocation(-1, -1))
+{
+}
+
+ControlFlowProfiler::~ControlFlowProfiler()
+{
+    for (const BlockLocationCache& cache : m_sourceIDBuckets.values()) {
+        for (BasicBlockLocation* block : cache.values())
+            delete block;
+    }
+}
+
+BasicBlockLocation* ControlFlowProfiler::getBasicBlockLocation(intptr_t sourceID, int startOffset, int endOffset)
+{
+    auto addResult = m_sourceIDBuckets.add(sourceID, BlockLocationCache());
+    BlockLocationCache& blockLocationCache = addResult.iterator->value;
+    BasicBlockKey key(startOffset, endOffset);
+    auto addResultForBasicBlock = blockLocationCache.add(key, nullptr);
+    if (addResultForBasicBlock.isNewEntry)
+        addResultForBasicBlock.iterator->value = new BasicBlockLocation(startOffset, endOffset);
+    return addResultForBasicBlock.iterator->value;
+}
+
+void ControlFlowProfiler::dumpData() const
+{
+    auto iter = m_sourceIDBuckets.begin();
+    auto end = m_sourceIDBuckets.end();
+    for (; iter != end; ++iter) {
+        dataLog("SourceID: ", iter->key, "\n");
+        for (const BasicBlockLocation* block : iter->value.values())
+            block->dumpData();
+    }
+}
+
+Vector<BasicBlockRange> ControlFlowProfiler::getBasicBlocksForSourceID(intptr_t sourceID, VM& vm) const 
+{
+    Vector<BasicBlockRange> result(0);
+    auto bucketFindResult = m_sourceIDBuckets.find(sourceID);
+    if (bucketFindResult == m_sourceIDBuckets.end())
+        return result;
+
+    const BlockLocationCache& cache = bucketFindResult->value;
+    for (const BasicBlockLocation* block : cache.values()) {
+        bool hasExecuted = block->hasExecuted();
+        size_t executionCount = block->executionCount();
+        const Vector<BasicBlockLocation::Gap>& blockRanges = block->getExecutedRanges();
+        for (BasicBlockLocation::Gap gap : blockRanges) {
+            BasicBlockRange range;
+            range.m_hasExecuted = hasExecuted;
+            range.m_executionCount = executionCount;
+            range.m_startOffset = gap.first;
+            range.m_endOffset = gap.second;
+            result.append(range);
+        }
+    }
+
+    const Vector<std::tuple<bool, unsigned, unsigned>>& functionRanges = vm.functionHasExecutedCache()->getFunctionRanges(sourceID);
+    for (const auto& functionRange : functionRanges) {
+        BasicBlockRange range;
+        range.m_hasExecuted = std::get<0>(functionRange);
+        range.m_startOffset = static_cast<int>(std::get<1>(functionRange));
+        range.m_endOffset = static_cast<int>(std::get<2>(functionRange));
+        range.m_executionCount = range.m_hasExecuted ? 1 : 0; // This is a hack. We don't actually count this.
+        result.append(range);
+    }
+
+    return result;
+}
+
+static BasicBlockRange findBasicBlockAtTextOffset(int offset, const Vector<BasicBlockRange>& blocks)
+{
+    int bestDistance = INT_MAX;
+    BasicBlockRange bestRange;
+    bestRange.m_startOffset = bestRange.m_endOffset = -1;
+    bestRange.m_hasExecuted = false; // Suppress MSVC warning.
+    // Because some ranges may overlap because of function boundaries, make sure to find the smallest range enclosing the offset.
+    for (BasicBlockRange range : blocks) {
+        if (range.m_startOffset <= offset && offset <= range.m_endOffset && (range.m_endOffset - range.m_startOffset) < bestDistance) {
+            RELEASE_ASSERT(range.m_endOffset - range.m_startOffset >= 0);
+            bestDistance = range.m_endOffset - range.m_startOffset;
+            bestRange = range;
+        }
+    }
+
+    RELEASE_ASSERT(bestRange.m_startOffset != -1 && bestRange.m_endOffset != -1);
+    return bestRange;
+}
+
+bool ControlFlowProfiler::hasBasicBlockAtTextOffsetBeenExecuted(int offset, intptr_t sourceID, VM& vm)
+{
+    const Vector<BasicBlockRange>& blocks = getBasicBlocksForSourceID(sourceID, vm);
+    BasicBlockRange range = findBasicBlockAtTextOffset(offset, blocks);
+    return range.m_hasExecuted;
+}
+
+size_t ControlFlowProfiler::basicBlockExecutionCountAtTextOffset(int offset, intptr_t sourceID, VM& vm)
+{
+    const Vector<BasicBlockRange>& blocks = getBasicBlocksForSourceID(sourceID, vm);
+    BasicBlockRange range = findBasicBlockAtTextOffset(offset, blocks);
+    return range.m_executionCount;
+}
+
+} // namespace JSC
diff --git a/runtime/ControlFlowProfiler.h b/runtime/ControlFlowProfiler.h
new file mode 100644
index 0000000..89aef2c
--- /dev/null
+++ b/runtime/ControlFlowProfiler.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 Saam Barati. <saambarati1@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "BasicBlockLocation.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashMethod.h>
+
+namespace JSC {
+
+class VM;
+
+struct BasicBlockKey {
+    BasicBlockKey()
+        : m_startOffset(-3)
+        , m_endOffset(-3)
+    { }
+
+    BasicBlockKey(int startOffset, int endOffset)
+        : m_startOffset(startOffset)
+        , m_endOffset(endOffset)
+    { }
+
+    BasicBlockKey(WTF::HashTableDeletedValueType)
+        : m_startOffset(-2)
+        , m_endOffset(-2)
+    { }
+
+    bool isHashTableDeletedValue() const { return m_startOffset == -2 && m_endOffset == -2; }
+    bool operator==(const BasicBlockKey& other) const { return m_startOffset == other.m_startOffset && m_endOffset == other.m_endOffset; }
+    unsigned hash() const { return m_startOffset + m_endOffset + 1; }
+
+    int m_startOffset;
+    int m_endOffset;
+};
+
+struct BasicBlockKeyHash {
+    static unsigned hash(const BasicBlockKey& key) { return key.hash(); }
+    static bool equal(const BasicBlockKey& a, const BasicBlockKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::BasicBlockKey> {
+    typedef JSC::BasicBlockKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::BasicBlockKey> : SimpleClassHashTraits<JSC::BasicBlockKey> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+namespace JSC {
+
+struct BasicBlockRange {
+    int m_startOffset;
+    int m_endOffset;
+    bool m_hasExecuted;
+    size_t m_executionCount;
+};
+
+class ControlFlowProfiler {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ControlFlowProfiler();
+    ~ControlFlowProfiler();
+    BasicBlockLocation* getBasicBlockLocation(intptr_t sourceID, int startOffset, int endOffset);
+    JS_EXPORT_PRIVATE void dumpData() const;
+    Vector<BasicBlockRange> getBasicBlocksForSourceID(intptr_t sourceID, VM&) const;
+    BasicBlockLocation* dummyBasicBlock() { return &m_dummyBasicBlock; }
+    JS_EXPORT_PRIVATE bool hasBasicBlockAtTextOffsetBeenExecuted(int, intptr_t, VM&);  // This function exists for testing.
+    JS_EXPORT_PRIVATE size_t basicBlockExecutionCountAtTextOffset(int, intptr_t, VM&); // This function exists for testing.
+
+private:
+    typedef HashMap<BasicBlockKey, BasicBlockLocation*> BlockLocationCache;
+    typedef HashMap<intptr_t, BlockLocationCache> SourceIDBuckets;
+
+    SourceIDBuckets m_sourceIDBuckets;
+    BasicBlockLocation m_dummyBasicBlock;
+};
+
+} // namespace JSC
diff --git a/runtime/CustomGetterSetter.cpp b/runtime/CustomGetterSetter.cpp
new file mode 100644
index 0000000..dea45c4
--- /dev/null
+++ b/runtime/CustomGetterSetter.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CustomGetterSetter.h"
+
+#include "JSCJSValueInlines.h"
+#include "JSObject.h"
+#include "SlotVisitorInlines.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(CustomGetterSetter);
+
+const ClassInfo CustomGetterSetter::s_info = { "CustomGetterSetter", 0, 0, CREATE_METHOD_TABLE(CustomGetterSetter) };
+
+bool callCustomSetter(ExecState* exec, CustomGetterSetter::CustomSetter setter, bool isAccessor, JSValue thisValue, JSValue value)
+{
+    ASSERT(setter);
+    bool result = setter(exec, JSValue::encode(thisValue), JSValue::encode(value));
+    // Always return true if there is a setter and it is observed as an accessor to users.
+    if (isAccessor)
+        return true;
+    return result;
+}
+
+bool callCustomSetter(ExecState* exec, JSValue customGetterSetter, bool isAccessor, JSObject* base, JSValue thisValue, JSValue value)
+{
+    CustomGetterSetter::CustomSetter setter = jsCast<CustomGetterSetter*>(customGetterSetter)->setter();
+    // Return false since there is no setter.
+    if (!setter)
+        return false;
+    // FIXME: Remove this differences in custom values and custom accessors.
+    // https://bugs.webkit.org/show_bug.cgi?id=158014
+    if (!isAccessor)
+        thisValue = base;
+    return callCustomSetter(exec, setter, isAccessor, thisValue, value);
+}
+
+} // namespace JSC
diff --git a/runtime/CustomGetterSetter.h b/runtime/CustomGetterSetter.h
new file mode 100644
index 0000000..44b7306
--- /dev/null
+++ b/runtime/CustomGetterSetter.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "PropertySlot.h"
+#include "PutPropertySlot.h"
+#include "Structure.h"
+
+namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
+
+class CustomGetterSetter final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    typedef PropertySlot::GetValueFunc CustomGetter;
+    typedef PutPropertySlot::PutValueFunc CustomSetter;
+
+    static CustomGetterSetter* create(VM& vm, CustomGetter customGetter, CustomSetter customSetter, DOMJIT::GetterSetter* domJIT = nullptr)
+    {
+        CustomGetterSetter* customGetterSetter = new (NotNull, allocateCell<CustomGetterSetter>(vm.heap)) CustomGetterSetter(vm, customGetter, customSetter, domJIT);
+        customGetterSetter->finishCreation(vm);
+        return customGetterSetter;
+    }
+
+    CustomGetterSetter::CustomGetter getter() const { return m_getter; }
+    CustomGetterSetter::CustomSetter setter() const { return m_setter; }
+    DOMJIT::GetterSetter* domJIT() const { return m_domJIT; }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CustomGetterSetterType, StructureFlags), info());
+    }
+        
+    DECLARE_EXPORT_INFO;
+
+private:
+    CustomGetterSetter(VM& vm, CustomGetter getter, CustomSetter setter, DOMJIT::GetterSetter* domJIT)
+        : JSCell(vm, vm.customGetterSetterStructure.get())
+        , m_getter(getter)
+        , m_setter(setter)
+        , m_domJIT(domJIT)
+    {
+    }
+
+    CustomGetter m_getter;
+    CustomSetter m_setter;
+    DOMJIT::GetterSetter* m_domJIT;
+};
+
+JS_EXPORT_PRIVATE bool callCustomSetter(ExecState*, CustomGetterSetter::CustomSetter, bool isAccessor, JSValue thisValue, JSValue);
+JS_EXPORT_PRIVATE bool callCustomSetter(ExecState*, JSValue customGetterSetter, bool isAccessor, JSObject* slotBase, JSValue thisValue, JSValue);
+
+} // namespace JSC
diff --git a/runtime/DataView.cpp b/runtime/DataView.cpp
new file mode 100644
index 0000000..b10ca40
--- /dev/null
+++ b/runtime/DataView.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DataView.h"
+
+#include "JSCInlines.h"
+#include "JSDataView.h"
+#include "JSGlobalObject.h"
+
+namespace JSC {
+
+DataView::DataView(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned byteLength)
+    : ArrayBufferView(buffer, byteOffset)
+    , m_byteLength(byteLength)
+{
+}
+
+Ref<DataView> DataView::create(
+    PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned byteLength)
+{
+    return adoptRef(*new DataView(buffer, byteOffset, byteLength));
+}
+
+Ref<DataView> DataView::create(PassRefPtr<ArrayBuffer> passedBuffer)
+{
+    RefPtr<ArrayBuffer> buffer = passedBuffer;
+    return create(buffer, 0, buffer->byteLength());
+}
+
+JSArrayBufferView* DataView::wrap(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return JSDataView::create(
+        exec, globalObject->typedArrayStructure(TypeDataView), possiblySharedBuffer(), byteOffset(),
+        byteLength());
+}
+
+} // namespace JSC
+
diff --git a/runtime/DataView.h b/runtime/DataView.h
new file mode 100644
index 0000000..2281479
--- /dev/null
+++ b/runtime/DataView.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ArrayBufferView.h"
+#include <wtf/FlipBytes.h>
+#include <wtf/PassRefPtr.h>
+
+namespace JSC {
+
+class DataView : public ArrayBufferView {
+protected:
+    DataView(PassRefPtr<ArrayBuffer>, unsigned byteOffset, unsigned byteLength);
+    
+public:
+    JS_EXPORT_PRIVATE static Ref<DataView> create(PassRefPtr<ArrayBuffer>, unsigned byteOffset, unsigned length);
+    static Ref<DataView> create(PassRefPtr<ArrayBuffer>);
+    
+    unsigned byteLength() const override
+    {
+        return m_byteLength;
+    }
+    
+    TypedArrayType getType() const override
+    {
+        return TypeDataView;
+    }
+
+    JSArrayBufferView* wrap(ExecState*, JSGlobalObject*) override;
+    
+    template<typename T>
+    T get(unsigned offset, bool littleEndian, bool* status = 0)
+    {
+        if (status) {
+            if (offset + sizeof(T) > byteLength()) {
+                *status = false;
+                return T();
+            }
+            *status = true;
+        } else
+            ASSERT_WITH_SECURITY_IMPLICATION(offset + sizeof(T) <= byteLength());
+        return flipBytesIfLittleEndian(
+            *reinterpret_cast<T*>(static_cast<uint8_t*>(m_baseAddress) + offset),
+            littleEndian);
+    }
+    
+    template<typename T>
+    T read(unsigned& offset, bool littleEndian, bool* status = 0)
+    {
+        T result = this->template get<T>(offset, littleEndian, status);
+        if (!status || *status)
+            offset += sizeof(T);
+        return result;
+    }
+    
+    template<typename T>
+    void set(unsigned offset, T value, bool littleEndian, bool* status = 0)
+    {
+        if (status) {
+            if (offset + sizeof(T) > byteLength()) {
+                *status = false;
+                return;
+            }
+            *status = true;
+        } else
+            ASSERT_WITH_SECURITY_IMPLICATION(offset + sizeof(T) <= byteLength());
+        *reinterpret_cast<T*>(static_cast<uint8_t*>(m_baseAddress) + offset) =
+            flipBytesIfLittleEndian(value, littleEndian);
+    }
+
+private:
+    unsigned m_byteLength;
+};
+
+} // namespace JSC
diff --git a/runtime/DateConstructor.cpp b/runtime/DateConstructor.cpp
new file mode 100644
index 0000000..405074b
--- /dev/null
+++ b/runtime/DateConstructor.cpp
@@ -0,0 +1,228 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004-2008, 2011, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ *
+ */
+
+#include "config.h"
+#include "DateConstructor.h"
+
+#include "DateConversion.h"
+#include "DateInstance.h"
+#include "DatePrototype.h"
+#include "JSDateMath.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "ObjectPrototype.h"
+#include "JSCInlines.h"
+#include <math.h>
+#include <time.h>
+#include <wtf/MathExtras.h>
+
+#if ENABLE(WEB_REPLAY)
+#include "InputCursor.h"
+#include "JSReplayInputs.h"
+#endif
+
+#if HAVE(SYS_TIME_H)
+#include <sys/time.h>
+#endif
+
+#if HAVE(SYS_TIMEB_H)
+#include <sys/timeb.h>
+#endif
+
+using namespace WTF;
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL dateParse(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateUTC(ExecState*);
+
+}
+
+#include "DateConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo DateConstructor::s_info = { "Function", &InternalFunction::s_info, &dateConstructorTable, CREATE_METHOD_TABLE(DateConstructor) };
+
+/* Source for DateConstructor.lut.h
+@begin dateConstructorTable
+  parse     dateParse   DontEnum|Function 1
+  UTC       dateUTC     DontEnum|Function 7
+  now       dateNow     DontEnum|Function 0
+@end
+*/
+
+#if ENABLE(WEB_REPLAY)
+static double deterministicCurrentTime(JSGlobalObject* globalObject)
+{
+    double currentTime = jsCurrentTime();
+    InputCursor& cursor = globalObject->inputCursor();
+    if (cursor.isCapturing())
+        cursor.appendInput<GetCurrentTime>(currentTime);
+
+    if (cursor.isReplaying()) {
+        if (GetCurrentTime* input = cursor.fetchInput<GetCurrentTime>())
+            currentTime = input->currentTime();
+    }
+    return currentTime;
+}
+#endif
+
+#if ENABLE(WEB_REPLAY)
+#define NORMAL_OR_DETERMINISTIC_FUNCTION(a, b) (b)
+#else
+#define NORMAL_OR_DETERMINISTIC_FUNCTION(a, b) (a)
+#endif
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DateConstructor);
+
+DateConstructor::DateConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void DateConstructor::finishCreation(VM& vm, DatePrototype* datePrototype)
+{
+    Base::finishCreation(vm, "Date");
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, datePrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
+}
+
+static double millisecondsFromComponents(ExecState* exec, const ArgList& args, WTF::TimeType timeType)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    double doubleArguments[7];
+    for (int i = 0; i < 7; i++) {
+        doubleArguments[i] = args.at(i).toNumber(exec);
+        RETURN_IF_EXCEPTION(scope, 0);
+    }
+
+    int numArgs = args.size();
+
+    if ((!std::isfinite(doubleArguments[0]) || (doubleArguments[0] > INT_MAX) || (doubleArguments[0] < INT_MIN))
+        || (!std::isfinite(doubleArguments[1]) || (doubleArguments[1] > INT_MAX) || (doubleArguments[1] < INT_MIN))
+        || (numArgs >= 3 && (!std::isfinite(doubleArguments[2]) || (doubleArguments[2] > INT_MAX) || (doubleArguments[2] < INT_MIN)))
+        || (numArgs >= 4 && (!std::isfinite(doubleArguments[3]) || (doubleArguments[3] > INT_MAX) || (doubleArguments[3] < INT_MIN)))
+        || (numArgs >= 5 && (!std::isfinite(doubleArguments[4]) || (doubleArguments[4] > INT_MAX) || (doubleArguments[4] < INT_MIN)))
+        || (numArgs >= 6 && (!std::isfinite(doubleArguments[5]) || (doubleArguments[5] > INT_MAX) || (doubleArguments[5] < INT_MIN)))
+        || (numArgs >= 7 && (!std::isfinite(doubleArguments[6]) || (doubleArguments[6] > INT_MAX) || (doubleArguments[6] < INT_MIN))))
+        return PNaN;
+
+    GregorianDateTime t;
+    int year = JSC::toInt32(doubleArguments[0]);
+    t.setYear((year >= 0 && year <= 99) ? (year + 1900) : year);
+    t.setMonth(JSC::toInt32(doubleArguments[1]));
+    t.setMonthDay((numArgs >= 3) ? JSC::toInt32(doubleArguments[2]) : 1);
+    t.setHour(JSC::toInt32(doubleArguments[3]));
+    t.setMinute(JSC::toInt32(doubleArguments[4]));
+    t.setSecond(JSC::toInt32(doubleArguments[5]));
+    t.setIsDST(-1);
+    double ms = (numArgs >= 7) ? doubleArguments[6] : 0;
+    return gregorianDateTimeToMS(vm, t, ms, timeType);
+}
+
+// ECMA 15.9.3
+JSObject* constructDate(ExecState* exec, JSGlobalObject* globalObject, JSValue newTarget, const ArgList& args)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    int numArgs = args.size();
+
+    double value;
+
+    if (numArgs == 0) // new Date() ECMA 15.9.3.3
+        value = NORMAL_OR_DETERMINISTIC_FUNCTION(jsCurrentTime(), deterministicCurrentTime(globalObject));
+    else if (numArgs == 1) {
+        if (args.at(0).inherits(DateInstance::info()))
+            value = asDateInstance(args.at(0))->internalNumber();
+        else {
+            JSValue primitive = args.at(0).toPrimitive(exec);
+            RETURN_IF_EXCEPTION(scope, nullptr);
+            if (primitive.isString())
+                value = parseDate(vm, asString(primitive)->value(exec));
+            else
+                value = primitive.toNumber(exec);
+        }
+    } else
+        value = millisecondsFromComponents(exec, args, WTF::LocalTime);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    Structure* dateStructure = InternalFunction::createSubclassStructure(exec, newTarget, globalObject->dateStructure());
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    return DateInstance::create(vm, dateStructure, value);
+}
+    
+static EncodedJSValue JSC_HOST_CALL constructWithDateConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructDate(exec, asInternalFunction(exec->jsCallee())->globalObject(), exec->newTarget(), args));
+}
+
+ConstructType DateConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWithDateConstructor;
+    return ConstructType::Host;
+}
+
+// ECMA 15.9.2
+static EncodedJSValue JSC_HOST_CALL callDate(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    GregorianDateTime ts;
+    msToGregorianDateTime(vm, currentTimeMS(), WTF::LocalTime, ts);
+    return JSValue::encode(jsNontrivialString(&vm, formatDateTime(ts, DateTimeFormatDateAndTime, false)));
+}
+
+CallType DateConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callDate;
+    return CallType::Host;
+}
+
+EncodedJSValue JSC_HOST_CALL dateParse(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    String dateStr = exec->argument(0).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsNumber(parseDate(vm, dateStr)));
+}
+
+EncodedJSValue JSC_HOST_CALL dateNow(ExecState* exec)
+{
+#if !ENABLE(WEB_REPLAY)
+    UNUSED_PARAM(exec);
+#endif
+
+    return JSValue::encode(jsNumber(NORMAL_OR_DETERMINISTIC_FUNCTION(jsCurrentTime(), deterministicCurrentTime(exec->lexicalGlobalObject()))));
+}
+
+EncodedJSValue JSC_HOST_CALL dateUTC(ExecState* exec) 
+{
+    double ms = millisecondsFromComponents(exec, ArgList(exec), WTF::UTCTime);
+    return JSValue::encode(jsNumber(timeClip(ms)));
+}
+
+} // namespace JSC
diff --git a/runtime/DateConstructor.h b/runtime/DateConstructor.h
new file mode 100644
index 0000000..fcea55f
--- /dev/null
+++ b/runtime/DateConstructor.h
@@ -0,0 +1,62 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2011, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class DatePrototype;
+class GetterSetter;
+
+class DateConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static DateConstructor* create(VM& vm, Structure* structure, DatePrototype* datePrototype, GetterSetter*)
+    {
+        DateConstructor* constructor = new (NotNull, allocateCell<DateConstructor>(vm.heap)) DateConstructor(vm, structure);
+        constructor->finishCreation(vm, datePrototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, DatePrototype*);
+
+private:
+    DateConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+JSObject* constructDate(ExecState*, JSGlobalObject*, JSValue newTarget, const ArgList&);
+
+EncodedJSValue JSC_HOST_CALL dateNow(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/DateConversion.cpp b/runtime/DateConversion.cpp
new file mode 100644
index 0000000..df9a60d
--- /dev/null
+++ b/runtime/DateConversion.cpp
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateConversion.h"
+
+#include <wtf/Assertions.h>
+#include <wtf/DateMath.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+#if OS(WINDOWS)
+#include <windows.h>
+#endif
+
+using namespace WTF;
+
+namespace JSC {
+
+template<int width>
+static inline void appendNumber(StringBuilder& builder, int value)
+{
+    int fillingZerosCount = width;
+    if (value < 0) {
+        builder.append('-');
+        value = -value;
+        --fillingZerosCount;
+    }
+    String valueString = String::number(value);
+    fillingZerosCount -= valueString.length();
+    for (int i = 0; i < fillingZerosCount; ++i)
+        builder.append('0');
+    builder.append(valueString);
+}
+
+template<>
+void appendNumber<2>(StringBuilder& builder, int value)
+{
+    ASSERT(0 <= value && value <= 99);
+    builder.append(static_cast<char>('0' + value / 10));
+    builder.append(static_cast<char>('0' + value % 10));
+}
+
+String formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool asUTCVariant)
+{
+    bool appendDate = format & DateTimeFormatDate;
+    bool appendTime = format & DateTimeFormatTime;
+
+    StringBuilder builder;
+
+    if (appendDate) {
+        builder.append(weekdayName[(t.weekDay() + 6) % 7]);
+
+        if (asUTCVariant) {
+            builder.appendLiteral(", ");
+            appendNumber<2>(builder, t.monthDay());
+            builder.append(' ');
+            builder.append(monthName[t.month()]);
+        } else {
+            builder.append(' ');
+            builder.append(monthName[t.month()]);
+            builder.append(' ');
+            appendNumber<2>(builder, t.monthDay());
+        }
+        builder.append(' ');
+        appendNumber<4>(builder, t.year());
+    }
+
+    if (appendDate && appendTime)
+        builder.append(' ');
+
+    if (appendTime) {
+        appendNumber<2>(builder, t.hour());
+        builder.append(':');
+        appendNumber<2>(builder, t.minute());
+        builder.append(':');
+        appendNumber<2>(builder, t.second());
+        builder.appendLiteral(" GMT");
+
+        if (!asUTCVariant) {
+            int offset = abs(t.utcOffset()) / 60;
+            builder.append(t.utcOffset() < 0 ? '-' : '+');
+            appendNumber<2>(builder, offset / 60);
+            appendNumber<2>(builder, offset % 60);
+
+#if OS(WINDOWS)
+            TIME_ZONE_INFORMATION timeZoneInformation;
+            GetTimeZoneInformation(&timeZoneInformation);
+            const WCHAR* timeZoneName = t.isDST() ? timeZoneInformation.DaylightName : timeZoneInformation.StandardName;
+#else
+            struct tm gtm = t;
+            char timeZoneName[70];
+            strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+#endif
+            if (timeZoneName[0]) {
+                builder.appendLiteral(" (");
+#if OS(WINDOWS)
+                builder.append(String(timeZoneName));
+#else
+                builder.append(timeZoneName);
+#endif
+                builder.append(')');
+            }
+        }
+    }
+
+    return builder.toString().impl();
+}
+
+} // namespace JSC
diff --git a/runtime/DateConversion.h b/runtime/DateConversion.h
new file mode 100644
index 0000000..d7b763e
--- /dev/null
+++ b/runtime/DateConversion.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/GregorianDateTime.h>
+
+namespace WTF {
+class String;
+} // namespace WTF
+
+namespace JSC {
+
+enum DateTimeFormat {
+    DateTimeFormatDate = 1,
+    DateTimeFormatTime = 2,
+    DateTimeFormatDateAndTime = DateTimeFormatDate | DateTimeFormatTime
+};
+
+JS_EXPORT_PRIVATE WTF::String formatDateTime(const GregorianDateTime&, DateTimeFormat, bool asUTCVariant);
+
+} // namespace JSC
diff --git a/runtime/DateInstance.cpp b/runtime/DateInstance.cpp
new file mode 100644
index 0000000..e095f88
--- /dev/null
+++ b/runtime/DateInstance.cpp
@@ -0,0 +1,95 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ *
+ */
+
+#include "config.h"
+#include "DateInstance.h"
+
+#include "JSDateMath.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+#include <math.h>
+#include <wtf/MathExtras.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+const ClassInfo DateInstance::s_info = {"Date", &JSWrapperObject::s_info, 0, CREATE_METHOD_TABLE(DateInstance)};
+
+DateInstance::DateInstance(VM& vm, Structure* structure)
+    : JSWrapperObject(vm, structure)
+{
+}
+
+void DateInstance::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    setInternalValue(vm, jsNaN());
+}
+
+void DateInstance::finishCreation(VM& vm, double time)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    setInternalValue(vm, jsNumber(timeClip(time)));
+}
+
+void DateInstance::destroy(JSCell* cell)
+{
+    static_cast<DateInstance*>(cell)->DateInstance::~DateInstance();
+}
+
+const GregorianDateTime* DateInstance::calculateGregorianDateTime(ExecState* exec) const
+{
+    double milli = internalNumber();
+    if (std::isnan(milli))
+        return 0;
+
+    VM& vm = exec->vm();
+    if (!m_data)
+        m_data = vm.dateInstanceCache.add(milli);
+
+    if (m_data->m_gregorianDateTimeCachedForMS != milli) {
+        msToGregorianDateTime(vm, milli, WTF::LocalTime, m_data->m_cachedGregorianDateTime);
+        m_data->m_gregorianDateTimeCachedForMS = milli;
+    }
+    return &m_data->m_cachedGregorianDateTime;
+}
+
+const GregorianDateTime* DateInstance::calculateGregorianDateTimeUTC(ExecState* exec) const
+{
+    double milli = internalNumber();
+    if (std::isnan(milli))
+        return 0;
+
+    VM& vm = exec->vm();
+    if (!m_data)
+        m_data = vm.dateInstanceCache.add(milli);
+
+    if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
+        msToGregorianDateTime(vm, milli, WTF::UTCTime, m_data->m_cachedGregorianDateTimeUTC);
+        m_data->m_gregorianDateTimeUTCCachedForMS = milli;
+    }
+    return &m_data->m_cachedGregorianDateTimeUTC;
+}
+
+} // namespace JSC
diff --git a/runtime/DateInstance.h b/runtime/DateInstance.h
new file mode 100644
index 0000000..848f396
--- /dev/null
+++ b/runtime/DateInstance.h
@@ -0,0 +1,90 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSWrapperObject.h"
+
+namespace JSC {
+
+class DateInstance : public JSWrapperObject {
+protected:
+    JS_EXPORT_PRIVATE DateInstance(VM&, Structure*);
+    void finishCreation(VM&);
+    JS_EXPORT_PRIVATE void finishCreation(VM&, double);
+
+    JS_EXPORT_PRIVATE static void destroy(JSCell*);
+
+public:
+    typedef JSWrapperObject Base;
+
+    static DateInstance* create(VM& vm, Structure* structure, double date)
+    {
+        DateInstance* instance = new (NotNull, allocateCell<DateInstance>(vm.heap)) DateInstance(vm, structure);
+        instance->finishCreation(vm, date);
+        return instance;
+    }
+
+    static DateInstance* create(VM& vm, Structure* structure)
+    {
+        DateInstance* instance = new (NotNull, allocateCell<DateInstance>(vm.heap)) DateInstance(vm, structure);
+        instance->finishCreation(vm);
+        return instance;
+    }
+
+    double internalNumber() const { return internalValue().asNumber(); }
+
+    DECLARE_EXPORT_INFO;
+
+    const GregorianDateTime* gregorianDateTime(ExecState* exec) const
+    {
+        if (m_data && m_data->m_gregorianDateTimeCachedForMS == internalNumber())
+            return &m_data->m_cachedGregorianDateTime;
+        return calculateGregorianDateTime(exec);
+    }
+
+    const GregorianDateTime* gregorianDateTimeUTC(ExecState* exec) const
+    {
+        if (m_data && m_data->m_gregorianDateTimeUTCCachedForMS == internalNumber())
+            return &m_data->m_cachedGregorianDateTimeUTC;
+        return calculateGregorianDateTimeUTC(exec);
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    JS_EXPORT_PRIVATE const GregorianDateTime* calculateGregorianDateTime(ExecState*) const;
+    JS_EXPORT_PRIVATE const GregorianDateTime* calculateGregorianDateTimeUTC(ExecState*) const;
+
+    mutable RefPtr<DateInstanceData> m_data;
+};
+
+DateInstance* asDateInstance(JSValue);
+
+inline DateInstance* asDateInstance(JSValue value)
+{
+    ASSERT(asObject(value)->inherits(DateInstance::info()));
+    return static_cast<DateInstance*>(asObject(value));
+}
+
+} // namespace JSC
diff --git a/runtime/DateInstanceCache.h b/runtime/DateInstanceCache.h
new file mode 100644
index 0000000..4f1c967
--- /dev/null
+++ b/runtime/DateInstanceCache.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "JSDateMath.h"
+#include <array>
+#include <wtf/HashFunctions.h>
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+class DateInstanceData : public RefCounted<DateInstanceData> {
+public:
+    static Ref<DateInstanceData> create() { return adoptRef(*new DateInstanceData); }
+
+    double m_gregorianDateTimeCachedForMS;
+    GregorianDateTime m_cachedGregorianDateTime;
+    double m_gregorianDateTimeUTCCachedForMS;
+    GregorianDateTime m_cachedGregorianDateTimeUTC;
+
+private:
+    DateInstanceData()
+        : m_gregorianDateTimeCachedForMS(PNaN)
+        , m_gregorianDateTimeUTCCachedForMS(PNaN)
+    {
+    }
+};
+
+class DateInstanceCache {
+public:
+    DateInstanceCache()
+    {
+        reset();
+    }
+
+    void reset()
+    {
+        for (size_t i = 0; i < cacheSize; ++i)
+            m_cache[i].key = PNaN;
+    }
+
+    DateInstanceData* add(double d)
+    {
+        CacheEntry& entry = lookup(d);
+        if (d == entry.key)
+            return entry.value.get();
+
+        entry.key = d;
+        entry.value = DateInstanceData::create();
+        return entry.value.get();
+    }
+
+private:
+    static const size_t cacheSize = 16;
+
+    struct CacheEntry {
+        double key;
+        RefPtr<DateInstanceData> value;
+    };
+
+    CacheEntry& lookup(double d) { return m_cache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
+
+    std::array<CacheEntry, cacheSize> m_cache;
+};
+
+} // namespace JSC
diff --git a/runtime/DatePrototype.cpp b/runtime/DatePrototype.cpp
new file mode 100644
index 0000000..e349a71
--- /dev/null
+++ b/runtime/DatePrototype.cpp
@@ -0,0 +1,1153 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008, 2009 Torch Mobile, Inc. All rights reserved.
+ *  Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ *
+ */
+
+#include "config.h"
+#include "DatePrototype.h"
+
+#include "DateConversion.h"
+#include "DateInstance.h"
+#include "Error.h"
+#include "JSCBuiltins.h"
+#include "JSDateMath.h"
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "Lookup.h"
+#include "ObjectPrototype.h"
+#include "JSCInlines.h"
+#include <limits.h>
+#include <locale.h>
+#include <math.h>
+#include <stdlib.h>
+#include <time.h>
+#include <wtf/Assertions.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
+
+#if HAVE(LANGINFO_H)
+#include <langinfo.h>
+#endif
+
+#if HAVE(SYS_PARAM_H)
+#include <sys/param.h>
+#endif
+
+#if HAVE(SYS_TIME_H)
+#include <sys/time.h>
+#endif
+
+#if HAVE(SYS_TIMEB_H)
+#include <sys/timeb.h>
+#endif
+
+#if !(OS(DARWIN) && USE(CF))
+#include <unicode/udat.h>
+#endif
+
+#if USE(CF)
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
+using namespace WTF;
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetDate(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetFullYear(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetHours(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetMilliSeconds(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetMinutes(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetMonth(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetSeconds(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCDate(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCHours(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCMilliseconds(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCMinutes(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCMonth(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCSeconds(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToPrimitiveSymbol(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToString(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState*);
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState*);
+
+}
+
+#include "DatePrototype.lut.h"
+
+namespace JSC {
+
+enum LocaleDateTimeFormat { LocaleDateAndTime, LocaleDate, LocaleTime };
+ 
+#if OS(DARWIN) && USE(CF)
+
+// FIXME: Since this is superior to the strftime-based version, why limit this to OS(DARWIN)?
+// Instead we should consider using this whenever USE(CF) is true.
+
+static CFDateFormatterStyle styleFromArgString(const String& string, CFDateFormatterStyle defaultStyle)
+{
+    if (string == "short")
+        return kCFDateFormatterShortStyle;
+    if (string == "medium")
+        return kCFDateFormatterMediumStyle;
+    if (string == "long")
+        return kCFDateFormatterLongStyle;
+    if (string == "full")
+        return kCFDateFormatterFullStyle;
+    return defaultStyle;
+}
+
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance*, double timeInMilliseconds, LocaleDateTimeFormat format)
+{
+    CFDateFormatterStyle dateStyle = (format != LocaleTime ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
+    CFDateFormatterStyle timeStyle = (format != LocaleDate ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
+
+    bool useCustomFormat = false;
+    String customFormatString;
+
+    String arg0String = exec->argument(0).toWTFString(exec);
+    if (arg0String == "custom" && !exec->argument(1).isUndefined()) {
+        useCustomFormat = true;
+        customFormatString = exec->argument(1).toWTFString(exec);
+    } else if (format == LocaleDateAndTime && !exec->argument(1).isUndefined()) {
+        dateStyle = styleFromArgString(arg0String, dateStyle);
+        timeStyle = styleFromArgString(exec->argument(1).toWTFString(exec), timeStyle);
+    } else if (format != LocaleTime && !exec->argument(0).isUndefined())
+        dateStyle = styleFromArgString(arg0String, dateStyle);
+    else if (format != LocaleDate && !exec->argument(0).isUndefined())
+        timeStyle = styleFromArgString(arg0String, timeStyle);
+
+    CFAbsoluteTime absoluteTime = floor(timeInMilliseconds / msPerSecond) - kCFAbsoluteTimeIntervalSince1970;
+
+    auto formatter = adoptCF(CFDateFormatterCreate(kCFAllocatorDefault, adoptCF(CFLocaleCopyCurrent()).get(), dateStyle, timeStyle));
+    if (useCustomFormat)
+        CFDateFormatterSetFormat(formatter.get(), customFormatString.createCFString().get());
+    return jsNontrivialString(exec, adoptCF(CFDateFormatterCreateStringWithAbsoluteTime(kCFAllocatorDefault, formatter.get(), absoluteTime)).get());
+}
+
+#elif !UCONFIG_NO_FORMATTING
+
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance*, double timeInMilliseconds, LocaleDateTimeFormat format)
+{
+    UDateFormatStyle timeStyle = (format != LocaleDate ? UDAT_LONG : UDAT_NONE);
+    UDateFormatStyle dateStyle = (format != LocaleTime ? UDAT_LONG : UDAT_NONE);
+
+    UErrorCode status = U_ZERO_ERROR;
+    UDateFormat* df = udat_open(timeStyle, dateStyle, 0, 0, -1, 0, 0, &status);
+    if (!df)
+        return jsEmptyString(exec);
+
+    UChar buffer[128];
+    int32_t length;
+    length = udat_format(df, timeInMilliseconds, buffer, 128, 0, &status);
+    udat_close(df);
+    if (status != U_ZERO_ERROR)
+        return jsEmptyString(exec);
+
+    return jsNontrivialString(exec, String(buffer, length));
+}
+
+#else
+
+static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, LocaleDateTimeFormat format)
+{
+#if OS(WINDOWS)
+    SYSTEMTIME systemTime;
+    memset(&systemTime, 0, sizeof(systemTime));
+    systemTime.wYear = gdt.year();
+    systemTime.wMonth = gdt.month() + 1;
+    systemTime.wDay = gdt.monthDay();
+    systemTime.wDayOfWeek = gdt.weekDay();
+    systemTime.wHour = gdt.hour();
+    systemTime.wMinute = gdt.minute();
+    systemTime.wSecond = gdt.second();
+
+    Vector<UChar, 128> buffer;
+    size_t length = 0;
+
+    if (format == LocaleDate) {
+        buffer.resize(GetDateFormatW(LOCALE_USER_DEFAULT, DATE_LONGDATE, &systemTime, 0, 0, 0));
+        length = GetDateFormatW(LOCALE_USER_DEFAULT, DATE_LONGDATE, &systemTime, 0, buffer.data(), buffer.size());
+    } else if (format == LocaleTime) {
+        buffer.resize(GetTimeFormatW(LOCALE_USER_DEFAULT, 0, &systemTime, 0, 0, 0));
+        length = GetTimeFormatW(LOCALE_USER_DEFAULT, 0, &systemTime, 0, buffer.data(), buffer.size());
+    } else if (format == LocaleDateAndTime) {
+        buffer.resize(GetDateFormatW(LOCALE_USER_DEFAULT, DATE_LONGDATE, &systemTime, 0, 0, 0) + GetTimeFormatW(LOCALE_USER_DEFAULT, 0, &systemTime, 0, 0, 0));
+        length = GetDateFormatW(LOCALE_USER_DEFAULT, DATE_LONGDATE, &systemTime, 0, buffer.data(), buffer.size());
+        if (length) {
+            buffer[length - 1] = ' ';
+            length += GetTimeFormatW(LOCALE_USER_DEFAULT, 0, &systemTime, 0, buffer.data() + length, buffer.size() - length);
+        }
+    } else
+        RELEASE_ASSERT_NOT_REACHED();
+
+    //  Remove terminating null character.
+    if (length)
+        length--;
+
+    return jsNontrivialString(exec, String(buffer.data(), length));
+
+#else // OS(WINDOWS)
+
+#if HAVE(LANGINFO_H)
+    static const nl_item formats[] = { D_T_FMT, D_FMT, T_FMT };
+#else
+    static const char* const formatStrings[] = { "%#c", "%#x", "%X" };
+#endif
+
+    // Offset year if needed
+    struct tm localTM = gdt;
+    int year = gdt.year();
+    bool yearNeedsOffset = year < 1900 || year > 2038;
+    if (yearNeedsOffset)
+        localTM.tm_year = equivalentYearForDST(year) - 1900;
+
+#if HAVE(LANGINFO_H)
+    // We do not allow strftime to generate dates with 2-digits years,
+    // both to avoid ambiguity, and a crash in strncpy, for years that
+    // need offset.
+    char* formatString = strdup(nl_langinfo(formats[format]));
+    char* yPos = strchr(formatString, 'y');
+    if (yPos)
+        *yPos = 'Y';
+#endif
+
+    // Do the formatting
+    const int bufsize = 128;
+    char timebuffer[bufsize];
+
+#if HAVE(LANGINFO_H)
+    size_t ret = strftime(timebuffer, bufsize, formatString, &localTM);
+    free(formatString);
+#else
+    size_t ret = strftime(timebuffer, bufsize, formatStrings[format], &localTM);
+#endif
+
+    if (ret == 0)
+        return jsEmptyString(exec);
+
+    // Copy original into the buffer
+    if (yearNeedsOffset && format != LocaleTime) {
+        static const int yearLen = 5;   // FIXME will be a problem in the year 10,000
+        char yearString[yearLen];
+
+        snprintf(yearString, yearLen, "%d", localTM.tm_year + 1900);
+        char* yearLocation = strstr(timebuffer, yearString);
+        snprintf(yearString, yearLen, "%d", year);
+
+        strncpy(yearLocation, yearString, yearLen - 1);
+    }
+
+    // Convert multi-byte result to UNICODE.
+    // If __STDC_ISO_10646__ is defined, wide character represents
+    // UTF-16 (or UTF-32) code point. In most modern Unix like system
+    // (e.g. Linux with glibc 2.2 and above) the macro is defined,
+    // and wide character represents UTF-32 code point.
+    // Here we static_cast potential UTF-32 to UTF-16, it should be
+    // safe because date and (or) time related characters in different languages
+    // should be in UNICODE BMP. If mbstowcs fails, we just fall
+    // back on using multi-byte result as-is.
+#ifdef __STDC_ISO_10646__
+    UChar buffer[bufsize];
+    wchar_t tempbuffer[bufsize];
+    size_t length = mbstowcs(tempbuffer, timebuffer, bufsize - 1);
+    if (length != static_cast<size_t>(-1)) {
+        for (size_t i = 0; i < length; ++i)
+            buffer[i] = static_cast<UChar>(tempbuffer[i]);
+        return jsNontrivialString(exec, String(buffer, length));
+    }
+#endif
+
+    return jsNontrivialString(exec, timebuffer);
+#endif // OS(WINDOWS)
+}
+
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double, LocaleDateTimeFormat format)
+{
+    const GregorianDateTime* gregorianDateTime = dateObject->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return jsNontrivialString(exec, ASCIILiteral("Invalid Date"));
+    return formatLocaleDate(exec, *gregorianDateTime, format);
+}
+
+#endif // OS(DARWIN) && USE(CF)
+
+static EncodedJSValue formateDateInstance(ExecState* exec, DateTimeFormat format, bool asUTCVariant)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue);
+
+    const GregorianDateTime* gregorianDateTime = asUTCVariant
+        ? thisDateObj->gregorianDateTimeUTC(exec)
+        : thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNontrivialString(exec, String(ASCIILiteral("Invalid Date"))));
+
+    return JSValue::encode(jsNontrivialString(exec, formatDateTime(*gregorianDateTime, format, asUTCVariant)));
+}
+
+// Converts a list of arguments sent to a Date member function into milliseconds, updating
+// ms (representing milliseconds) and t (representing the rest of the date structure) appropriately.
+//
+// Format of member function: f([hour,] [min,] [sec,] [ms])
+static bool fillStructuresUsingTimeArgs(ExecState* exec, int maxArgs, double* ms, GregorianDateTime* t)
+{
+    double milliseconds = 0;
+    bool ok = true;
+    int idx = 0;
+    int numArgs = exec->argumentCount();
+    
+    // JS allows extra trailing arguments -- ignore them
+    if (numArgs > maxArgs)
+        numArgs = maxArgs;
+
+    // hours
+    if (maxArgs >= 4 && idx < numArgs) {
+        t->setHour(0);
+        double hours = exec->uncheckedArgument(idx++).toIntegerPreserveNaN(exec);
+        ok = std::isfinite(hours);
+        milliseconds += hours * msPerHour;
+    }
+
+    // minutes
+    if (maxArgs >= 3 && idx < numArgs && ok) {
+        t->setMinute(0);
+        double minutes = exec->uncheckedArgument(idx++).toIntegerPreserveNaN(exec);
+        ok = std::isfinite(minutes);
+        milliseconds += minutes * msPerMinute;
+    }
+    
+    // seconds
+    if (maxArgs >= 2 && idx < numArgs && ok) {
+        t->setSecond(0);
+        double seconds = exec->uncheckedArgument(idx++).toIntegerPreserveNaN(exec);
+        ok = std::isfinite(seconds);
+        milliseconds += seconds * msPerSecond;
+    }
+    
+    if (!ok)
+        return false;
+        
+    // milliseconds
+    if (idx < numArgs) {
+        double millis = exec->uncheckedArgument(idx).toIntegerPreserveNaN(exec);
+        ok = std::isfinite(millis);
+        milliseconds += millis;
+    } else
+        milliseconds += *ms;
+    
+    *ms = milliseconds;
+    return ok;
+}
+
+// Converts a list of arguments sent to a Date member function into years, months, and milliseconds, updating
+// ms (representing milliseconds) and t (representing the rest of the date structure) appropriately.
+//
+// Format of member function: f([years,] [months,] [days])
+static bool fillStructuresUsingDateArgs(ExecState *exec, int maxArgs, double *ms, GregorianDateTime *t)
+{
+    int idx = 0;
+    bool ok = true;
+    int numArgs = exec->argumentCount();
+  
+    // JS allows extra trailing arguments -- ignore them
+    if (numArgs > maxArgs)
+        numArgs = maxArgs;
+  
+    // years
+    if (maxArgs >= 3 && idx < numArgs) {
+        double years = exec->uncheckedArgument(idx++).toIntegerPreserveNaN(exec);
+        ok = std::isfinite(years);
+        t->setYear(toInt32(years));
+    }
+    // months
+    if (maxArgs >= 2 && idx < numArgs && ok) {
+        double months = exec->uncheckedArgument(idx++).toIntegerPreserveNaN(exec);
+        ok = std::isfinite(months);
+        t->setMonth(toInt32(months));
+    }
+    // days
+    if (idx < numArgs && ok) {
+        double days = exec->uncheckedArgument(idx++).toIntegerPreserveNaN(exec);
+        ok = std::isfinite(days);
+        t->setMonthDay(0);
+        *ms += days * msPerDay;
+    }
+    
+    return ok;
+}
+
+const ClassInfo DatePrototype::s_info = {"Object", &JSNonFinalObject::s_info, &dateTable, CREATE_METHOD_TABLE(DatePrototype)};
+
+/* Source for DatePrototype.lut.h
+@begin dateTable
+  toString              dateProtoFuncToString                DontEnum|Function       0
+  toISOString           dateProtoFuncToISOString             DontEnum|Function       0
+  toDateString          dateProtoFuncToDateString            DontEnum|Function       0
+  toTimeString          dateProtoFuncToTimeString            DontEnum|Function       0
+  toLocaleString        dateProtoFuncToLocaleString          DontEnum|Function       0
+  toLocaleDateString    dateProtoFuncToLocaleDateString      DontEnum|Function       0
+  toLocaleTimeString    dateProtoFuncToLocaleTimeString      DontEnum|Function       0
+  valueOf               dateProtoFuncGetTime                 DontEnum|Function       0
+  getTime               dateProtoFuncGetTime                 DontEnum|Function       0
+  getFullYear           dateProtoFuncGetFullYear             DontEnum|Function       0
+  getUTCFullYear        dateProtoFuncGetUTCFullYear          DontEnum|Function       0
+  getMonth              dateProtoFuncGetMonth                DontEnum|Function       0
+  getUTCMonth           dateProtoFuncGetUTCMonth             DontEnum|Function       0
+  getDate               dateProtoFuncGetDate                 DontEnum|Function       0
+  getUTCDate            dateProtoFuncGetUTCDate              DontEnum|Function       0
+  getDay                dateProtoFuncGetDay                  DontEnum|Function       0
+  getUTCDay             dateProtoFuncGetUTCDay               DontEnum|Function       0
+  getHours              dateProtoFuncGetHours                DontEnum|Function       0
+  getUTCHours           dateProtoFuncGetUTCHours             DontEnum|Function       0
+  getMinutes            dateProtoFuncGetMinutes              DontEnum|Function       0
+  getUTCMinutes         dateProtoFuncGetUTCMinutes           DontEnum|Function       0
+  getSeconds            dateProtoFuncGetSeconds              DontEnum|Function       0
+  getUTCSeconds         dateProtoFuncGetUTCSeconds           DontEnum|Function       0
+  getMilliseconds       dateProtoFuncGetMilliSeconds         DontEnum|Function       0
+  getUTCMilliseconds    dateProtoFuncGetUTCMilliseconds      DontEnum|Function       0
+  getTimezoneOffset     dateProtoFuncGetTimezoneOffset       DontEnum|Function       0
+  setTime               dateProtoFuncSetTime                 DontEnum|Function       1
+  setMilliseconds       dateProtoFuncSetMilliSeconds         DontEnum|Function       1
+  setUTCMilliseconds    dateProtoFuncSetUTCMilliseconds      DontEnum|Function       1
+  setSeconds            dateProtoFuncSetSeconds              DontEnum|Function       2
+  setUTCSeconds         dateProtoFuncSetUTCSeconds           DontEnum|Function       2
+  setMinutes            dateProtoFuncSetMinutes              DontEnum|Function       3
+  setUTCMinutes         dateProtoFuncSetUTCMinutes           DontEnum|Function       3
+  setHours              dateProtoFuncSetHours                DontEnum|Function       4
+  setUTCHours           dateProtoFuncSetUTCHours             DontEnum|Function       4
+  setDate               dateProtoFuncSetDate                 DontEnum|Function       1
+  setUTCDate            dateProtoFuncSetUTCDate              DontEnum|Function       1
+  setMonth              dateProtoFuncSetMonth                DontEnum|Function       2
+  setUTCMonth           dateProtoFuncSetUTCMonth             DontEnum|Function       2
+  setFullYear           dateProtoFuncSetFullYear             DontEnum|Function       3
+  setUTCFullYear        dateProtoFuncSetUTCFullYear          DontEnum|Function       3
+  setYear               dateProtoFuncSetYear                 DontEnum|Function       1
+  getYear               dateProtoFuncGetYear                 DontEnum|Function       0
+  toJSON                dateProtoFuncToJSON                  DontEnum|Function       1
+@end
+*/
+
+// ECMA 15.9.4
+
+DatePrototype::DatePrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void DatePrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    Identifier toUTCStringName = Identifier::fromString(&vm, ASCIILiteral("toUTCString"));
+    JSFunction* toUTCStringFunction = JSFunction::create(vm, globalObject, 0, toUTCStringName.string(), dateProtoFuncToUTCString);
+    putDirectWithoutTransition(vm, toUTCStringName, toUTCStringFunction, DontEnum);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, ASCIILiteral("toGMTString")), toUTCStringFunction, DontEnum);
+
+#if ENABLE(INTL)
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("toLocaleString", datePrototypeToLocaleStringCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("toLocaleDateString", datePrototypeToLocaleDateStringCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("toLocaleTimeString", datePrototypeToLocaleTimeStringCodeGenerator, DontEnum);
+#else
+    UNUSED_PARAM(globalObject);
+#endif // ENABLE(INTL)
+
+    JSC_NATIVE_FUNCTION(vm.propertyNames->toPrimitiveSymbol, dateProtoFuncToPrimitiveSymbol, DontEnum | ReadOnly, 1);
+    // The constructor will be added later, after DateConstructor has been built.
+}
+
+// Functions
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec)
+{
+    const bool asUTCVariant = false;
+    return formateDateInstance(exec, DateTimeFormatDateAndTime, asUTCVariant);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec)
+{
+    const bool asUTCVariant = true;
+    return formateDateInstance(exec, DateTimeFormatDateAndTime, asUTCVariant);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+    
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+    if (!std::isfinite(thisDateObj->internalNumber()))
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Invalid Date")));
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNontrivialString(exec, String(ASCIILiteral("Invalid Date"))));
+    // Maximum amount of space we need in buffer: 7 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
+    // 6 for formatting and one for null termination = 28. We add one extra character to allow us to force null termination.
+    char buffer[28];
+    // If the year is outside the bounds of 0 and 9999 inclusive we want to use the extended year format (ES 15.9.1.15.1).
+    int ms = static_cast<int>(fmod(thisDateObj->internalNumber(), msPerSecond));
+    if (ms < 0)
+        ms += msPerSecond;
+
+    int charactersWritten;
+    if (gregorianDateTime->year() > 9999 || gregorianDateTime->year() < 0)
+        charactersWritten = snprintf(buffer, sizeof(buffer), "%+07d-%02d-%02dT%02d:%02d:%02d.%03dZ", gregorianDateTime->year(), gregorianDateTime->month() + 1, gregorianDateTime->monthDay(), gregorianDateTime->hour(), gregorianDateTime->minute(), gregorianDateTime->second(), ms);
+    else
+        charactersWritten = snprintf(buffer, sizeof(buffer), "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", gregorianDateTime->year(), gregorianDateTime->month() + 1, gregorianDateTime->monthDay(), gregorianDateTime->hour(), gregorianDateTime->minute(), gregorianDateTime->second(), ms);
+
+    ASSERT(charactersWritten > 0 && static_cast<unsigned>(charactersWritten) < sizeof(buffer));
+    if (static_cast<unsigned>(charactersWritten) >= sizeof(buffer))
+        return JSValue::encode(jsEmptyString(exec));
+
+    return JSValue::encode(jsNontrivialString(exec, String(buffer, charactersWritten)));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec)
+{
+    const bool asUTCVariant = false;
+    return formateDateInstance(exec, DateTimeFormatDate, asUTCVariant);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec)
+{
+    const bool asUTCVariant = false;
+    return formateDateInstance(exec, DateTimeFormatTime, asUTCVariant);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+    return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleDateAndTime));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+    return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleDate));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+    return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleTime));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToPrimitiveSymbol(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, "Date.prototype[Symbol.toPrimitive] expected |this| to be an object.");
+    JSObject* thisObject = jsCast<JSObject*>(thisValue);
+
+    if (!exec->argumentCount())
+        return throwVMTypeError(exec, scope, "Date.prototype[Symbol.toPrimitive] expected a first argument.");
+
+    JSValue hintValue = exec->uncheckedArgument(0);
+    PreferredPrimitiveType type = toPreferredPrimitiveType(exec, hintValue);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (type == NoPreference)
+        type = PreferString;
+
+    scope.release();
+    return JSValue::encode(thisObject->ordinaryToPrimitive(exec, type));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(asDateInstance(thisValue)->internalValue());
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->year()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->year()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->month()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->month()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->monthDay()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->monthDay()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->weekDay()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->weekDay()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->hour()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->hour()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->minute()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->minute()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->second()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(gregorianDateTime->second()));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+    double milli = thisDateObj->internalNumber();
+    if (std::isnan(milli))
+        return JSValue::encode(jsNaN());
+
+    double secs = floor(milli / msPerSecond);
+    double ms = milli - secs * msPerSecond;
+    return JSValue::encode(jsNumber(ms));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+    double milli = thisDateObj->internalNumber();
+    if (std::isnan(milli))
+        return JSValue::encode(jsNaN());
+
+    double secs = floor(milli / msPerSecond);
+    double ms = milli - secs * msPerSecond;
+    return JSValue::encode(jsNumber(ms));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+    return JSValue::encode(jsNumber(-gregorianDateTime->utcOffset() / minutesPerHour));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    double milli = timeClip(exec->argument(0).toNumber(exec));
+    JSValue result = jsNumber(milli);
+    thisDateObj->setInternalValue(exec->vm(), result);
+    return JSValue::encode(result);
+}
+
+static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse, WTF::TimeType inputTimeType)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue);
+    double milli = thisDateObj->internalNumber();
+    VM& vm = exec->vm();
+    
+    if (!exec->argumentCount() || std::isnan(milli)) {
+        JSValue result = jsNaN();
+        thisDateObj->setInternalValue(vm, result);
+        return JSValue::encode(result);
+    }
+     
+    double secs = floor(milli / msPerSecond);
+    double ms = milli - secs * msPerSecond;
+
+    const GregorianDateTime* other = inputTimeType == WTF::UTCTime
+        ? thisDateObj->gregorianDateTimeUTC(exec)
+        : thisDateObj->gregorianDateTime(exec);
+    if (!other)
+        return JSValue::encode(jsNaN());
+
+    GregorianDateTime gregorianDateTime;
+    gregorianDateTime.copyFrom(*other);
+    if (!fillStructuresUsingTimeArgs(exec, numArgsToUse, &ms, &gregorianDateTime)) {
+        JSValue result = jsNaN();
+        thisDateObj->setInternalValue(vm, result);
+        return JSValue::encode(result);
+    } 
+
+    double newUTCDate = gregorianDateTimeToMS(vm, gregorianDateTime, ms, inputTimeType);
+    JSValue result = jsNumber(timeClip(newUTCDate));
+    thisDateObj->setInternalValue(vm, result);
+    return JSValue::encode(result);
+}
+
+static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse, WTF::TimeType inputTimeType)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue);
+    if (!exec->argumentCount()) {
+        JSValue result = jsNaN();
+        thisDateObj->setInternalValue(exec->vm(), result);
+        return JSValue::encode(result);
+    }
+
+    VM& vm = exec->vm();
+    double milli = thisDateObj->internalNumber();
+    double ms = 0; 
+
+    GregorianDateTime gregorianDateTime; 
+    if (numArgsToUse == 3 && std::isnan(milli)) 
+        msToGregorianDateTime(vm, 0, WTF::UTCTime, gregorianDateTime);
+    else { 
+        ms = milli - floor(milli / msPerSecond) * msPerSecond; 
+        const GregorianDateTime* other = inputTimeType == WTF::UTCTime
+            ? thisDateObj->gregorianDateTimeUTC(exec)
+            : thisDateObj->gregorianDateTime(exec);
+        if (!other)
+            return JSValue::encode(jsNaN());
+        gregorianDateTime.copyFrom(*other);
+    }
+    
+    if (!fillStructuresUsingDateArgs(exec, numArgsToUse, &ms, &gregorianDateTime)) {
+        JSValue result = jsNaN();
+        thisDateObj->setInternalValue(vm, result);
+        return JSValue::encode(result);
+    } 
+
+    double newUTCDate = gregorianDateTimeToMS(vm, gregorianDateTime, ms, inputTimeType);
+    JSValue result = jsNumber(timeClip(newUTCDate));
+    thisDateObj->setInternalValue(vm, result);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetMilliSeconds(ExecState* exec)
+{
+    return setNewValueFromTimeArgs(exec, 1, WTF::LocalTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCMilliseconds(ExecState* exec)
+{
+    return setNewValueFromTimeArgs(exec, 1, WTF::UTCTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetSeconds(ExecState* exec)
+{
+    return setNewValueFromTimeArgs(exec, 2, WTF::LocalTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCSeconds(ExecState* exec)
+{
+    return setNewValueFromTimeArgs(exec, 2, WTF::UTCTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetMinutes(ExecState* exec)
+{
+    return setNewValueFromTimeArgs(exec, 3, WTF::LocalTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCMinutes(ExecState* exec)
+{
+    return setNewValueFromTimeArgs(exec, 3, WTF::UTCTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetHours(ExecState* exec)
+{
+    return setNewValueFromTimeArgs(exec, 4, WTF::LocalTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCHours(ExecState* exec)
+{
+    return setNewValueFromTimeArgs(exec, 4, WTF::UTCTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetDate(ExecState* exec)
+{
+    return setNewValueFromDateArgs(exec, 1, WTF::LocalTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCDate(ExecState* exec)
+{
+    return setNewValueFromDateArgs(exec, 1, WTF::UTCTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetMonth(ExecState* exec)
+{
+    return setNewValueFromDateArgs(exec, 2, WTF::LocalTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCMonth(ExecState* exec)
+{
+    return setNewValueFromDateArgs(exec, 2, WTF::UTCTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetFullYear(ExecState* exec)
+{
+    return setNewValueFromDateArgs(exec, 3, WTF::LocalTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState* exec)
+{
+    return setNewValueFromDateArgs(exec, 3, WTF::UTCTime);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    VM& vm = exec->vm();
+    DateInstance* thisDateObj = asDateInstance(thisValue);
+    if (!exec->argumentCount()) { 
+        JSValue result = jsNaN();
+        thisDateObj->setInternalValue(vm, result);
+        return JSValue::encode(result);
+    }
+
+    double milli = thisDateObj->internalNumber();
+    double ms = 0;
+
+    GregorianDateTime gregorianDateTime;
+    if (std::isnan(milli))
+        // Based on ECMA 262 B.2.5 (setYear)
+        // the time must be reset to +0 if it is NaN.
+        msToGregorianDateTime(vm, 0, WTF::UTCTime, gregorianDateTime);
+    else {
+        double secs = floor(milli / msPerSecond);
+        ms = milli - secs * msPerSecond;
+        if (const GregorianDateTime* other = thisDateObj->gregorianDateTime(exec))
+            gregorianDateTime.copyFrom(*other);
+    }
+
+    double year = exec->argument(0).toIntegerPreserveNaN(exec);
+    if (!std::isfinite(year)) {
+        JSValue result = jsNaN();
+        thisDateObj->setInternalValue(vm, result);
+        return JSValue::encode(result);
+    }
+
+    gregorianDateTime.setYear(toInt32((year >= 0 && year <= 99) ? (year + 1900) : year));
+    double timeInMilliseconds = gregorianDateTimeToMS(vm, gregorianDateTime, ms, WTF::LocalTime);
+    JSValue result = jsNumber(timeClip(timeInMilliseconds));
+    thisDateObj->setInternalValue(vm, result);
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(DateInstance::info()))
+        return throwVMTypeError(exec, scope);
+
+    DateInstance* thisDateObj = asDateInstance(thisValue); 
+
+    const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTime(exec);
+    if (!gregorianDateTime)
+        return JSValue::encode(jsNaN());
+
+    // NOTE: IE returns the full year even in getYear.
+    return JSValue::encode(jsNumber(gregorianDateTime->year() - 1900));
+}
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    JSObject* object = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue timeValue = object->toPrimitive(exec, PreferNumber);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (timeValue.isNumber() && !(timeValue.isInt32() || std::isfinite(timeValue.asDouble())))
+        return JSValue::encode(jsNull());
+
+    JSValue toISOValue = object->get(exec, vm.propertyNames->toISOString);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    CallData callData;
+    CallType callType = getCallData(toISOValue, callData);
+    if (callType == CallType::None)
+        return throwVMTypeError(exec, scope, ASCIILiteral("toISOString is not a function"));
+
+    JSValue result = call(exec, asObject(toISOValue), callType, callData, object, exec->emptyList());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (result.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("toISOString did not return a primitive value"));
+    return JSValue::encode(result);
+}
+
+} // namespace JSC
diff --git a/runtime/DatePrototype.h b/runtime/DatePrototype.h
new file mode 100644
index 0000000..5d0c2e4
--- /dev/null
+++ b/runtime/DatePrototype.h
@@ -0,0 +1,57 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "DateInstance.h"
+
+namespace JSC {
+
+class ObjectPrototype;
+
+class DatePrototype : public JSNonFinalObject {
+private:
+    DatePrototype(VM&, Structure*);
+
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static DatePrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        DatePrototype* prototype = new (NotNull, allocateCell<DatePrototype>(vm.heap)) DatePrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/DefinePropertyAttributes.h b/runtime/DefinePropertyAttributes.h
new file mode 100644
index 0000000..d7e3b91
--- /dev/null
+++ b/runtime/DefinePropertyAttributes.h
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/Optional.h>
+#include <wtf/TriState.h>
+
+namespace JSC {
+
+class DefinePropertyAttributes {
+public:
+    static_assert(FalseTriState == 0, "FalseTriState is 0.");
+    static_assert(TrueTriState == 1, "TrueTriState is 1.");
+    static_assert(MixedTriState == 2, "MixedTriState is 2.");
+
+    static const unsigned ConfigurableShift = 0;
+    static const unsigned EnumerableShift = 2;
+    static const unsigned WritableShift = 4;
+    static const unsigned ValueShift = 6;
+    static const unsigned GetShift = 7;
+    static const unsigned SetShift = 8;
+
+    DefinePropertyAttributes()
+        : m_attributes(
+            (MixedTriState << ConfigurableShift)
+            | (MixedTriState << EnumerableShift)
+            | (MixedTriState << WritableShift)
+            | (0 << ValueShift)
+            | (0 << GetShift)
+            | (0 << SetShift))
+    {
+    }
+
+    explicit DefinePropertyAttributes(unsigned attributes)
+        : m_attributes(attributes)
+    {
+    }
+
+    unsigned rawRepresentation() const
+    {
+        return m_attributes;
+    }
+
+    bool hasValue() const
+    {
+        return m_attributes & (0b1 << ValueShift);
+    }
+
+    void setValue()
+    {
+        m_attributes = m_attributes | (0b1 << ValueShift);
+    }
+
+    bool hasGet() const
+    {
+        return m_attributes & (0b1 << GetShift);
+    }
+
+    void setGet()
+    {
+        m_attributes = m_attributes | (0b1 << GetShift);
+    }
+
+    bool hasSet() const
+    {
+        return m_attributes & (0b1 << SetShift);
+    }
+
+    void setSet()
+    {
+        m_attributes = m_attributes | (0b1 << SetShift);
+    }
+
+    bool hasWritable() const
+    {
+        return extractTriState(WritableShift) != MixedTriState;
+    }
+
+    std::optional<bool> writable() const
+    {
+        if (!hasWritable())
+            return std::nullopt;
+        return extractTriState(WritableShift) == TrueTriState;
+    }
+
+    bool hasConfigurable() const
+    {
+        return extractTriState(ConfigurableShift) != MixedTriState;
+    }
+
+    std::optional<bool> configurable() const
+    {
+        if (!hasConfigurable())
+            return std::nullopt;
+        return extractTriState(ConfigurableShift) == TrueTriState;
+    }
+
+    bool hasEnumerable() const
+    {
+        return extractTriState(EnumerableShift) != MixedTriState;
+    }
+
+    std::optional<bool> enumerable() const
+    {
+        if (!hasEnumerable())
+            return std::nullopt;
+        return extractTriState(EnumerableShift) == TrueTriState;
+    }
+
+    void setWritable(bool value)
+    {
+        fillWithTriState(value ? TrueTriState : FalseTriState, WritableShift);
+    }
+
+    void setConfigurable(bool value)
+    {
+        fillWithTriState(value ? TrueTriState : FalseTriState, ConfigurableShift);
+    }
+
+    void setEnumerable(bool value)
+    {
+        fillWithTriState(value ? TrueTriState : FalseTriState, EnumerableShift);
+    }
+
+private:
+    void fillWithTriState(TriState state, unsigned shift)
+    {
+        unsigned mask = 0b11 << shift;
+        m_attributes = (m_attributes & ~mask) | (state << shift);
+    }
+
+    TriState extractTriState(unsigned shift) const
+    {
+        return static_cast<TriState>((m_attributes >> shift) & 0b11);
+    }
+
+    unsigned m_attributes;
+};
+
+
+} // namespace JSC
diff --git a/runtime/DirectArguments.cpp b/runtime/DirectArguments.cpp
new file mode 100644
index 0000000..1503832
--- /dev/null
+++ b/runtime/DirectArguments.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DirectArguments.h"
+
+#include "CodeBlock.h"
+#include "GenericArgumentsInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DirectArguments);
+
+const ClassInfo DirectArguments::s_info = { "Arguments", &Base::s_info, 0, CREATE_METHOD_TABLE(DirectArguments) };
+
+DirectArguments::DirectArguments(VM& vm, Structure* structure, unsigned length, unsigned capacity)
+    : GenericArguments(vm, structure)
+    , m_length(length)
+    , m_minCapacity(capacity)
+{
+    // When we construct the object from C++ code, we expect the capacity to be at least as large as
+    // length. JIT-allocated DirectArguments objects play evil tricks, though.
+    ASSERT(capacity >= length);
+}
+
+DirectArguments* DirectArguments::createUninitialized(
+    VM& vm, Structure* structure, unsigned length, unsigned capacity)
+{
+    DirectArguments* result =
+        new (NotNull, allocateCell<DirectArguments>(vm.heap, allocationSize(capacity)))
+        DirectArguments(vm, structure, length, capacity);
+    result->finishCreation(vm);
+    return result;
+}
+
+DirectArguments* DirectArguments::create(VM& vm, Structure* structure, unsigned length, unsigned capacity)
+{
+    DirectArguments* result = createUninitialized(vm, structure, length, capacity);
+    
+    for (unsigned i = capacity; i--;)
+        result->storage()[i].clear();
+    
+    return result;
+}
+
+DirectArguments* DirectArguments::createByCopying(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    
+    unsigned length = exec->argumentCount();
+    unsigned capacity = std::max(length, static_cast<unsigned>(exec->codeBlock()->numParameters() - 1));
+    DirectArguments* result = createUninitialized(
+        vm, exec->lexicalGlobalObject()->directArgumentsStructure(), length, capacity);
+    
+    for (unsigned i = capacity; i--;)
+        result->storage()[i].set(vm, result, exec->getArgumentUnsafe(i));
+    
+    result->callee().set(vm, result, jsCast<JSFunction*>(exec->jsCallee()));
+    
+    return result;
+}
+
+size_t DirectArguments::estimatedSize(JSCell* cell)
+{
+    DirectArguments* thisObject = jsCast<DirectArguments*>(cell);
+    size_t overridesSize = thisObject->m_overrides ? thisObject->overridesSize() : 0;
+    return Base::estimatedSize(cell) + overridesSize;
+}
+
+void DirectArguments::visitChildren(JSCell* thisCell, SlotVisitor& visitor)
+{
+    DirectArguments* thisObject = static_cast<DirectArguments*>(thisCell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    
+    visitor.appendValues(thisObject->storage(), std::max(thisObject->m_length, thisObject->m_minCapacity));
+    visitor.append(thisObject->m_callee);
+
+    if (bool* override = thisObject->m_overrides.get())
+        visitor.markAuxiliary(override);
+}
+
+Structure* DirectArguments::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(DirectArgumentsType, StructureFlags), info());
+}
+
+void DirectArguments::overrideThings(VM& vm)
+{
+    RELEASE_ASSERT(!m_overrides);
+    
+    putDirect(vm, vm.propertyNames->length, jsNumber(m_length), DontEnum);
+    putDirect(vm, vm.propertyNames->callee, m_callee.get(), DontEnum);
+    putDirect(vm, vm.propertyNames->iteratorSymbol, globalObject()->arrayProtoValuesFunction(), DontEnum);
+    
+    void* backingStore = vm.auxiliarySpace.tryAllocate(overridesSize());
+    RELEASE_ASSERT(backingStore);
+    bool* overrides = static_cast<bool*>(backingStore);
+    m_overrides.set(vm, this, overrides);
+    for (unsigned i = m_length; i--;)
+        overrides[i] = false;
+}
+
+void DirectArguments::overrideThingsIfNecessary(VM& vm)
+{
+    if (!m_overrides)
+        overrideThings(vm);
+}
+
+void DirectArguments::overrideArgument(VM& vm, unsigned index)
+{
+    overrideThingsIfNecessary(vm);
+    m_overrides.get()[index] = true;
+}
+
+void DirectArguments::copyToArguments(ExecState* exec, VirtualRegister firstElementDest, unsigned offset, unsigned length)
+{
+    if (!m_overrides) {
+        unsigned limit = std::min(length + offset, m_length);
+        unsigned i;
+        VirtualRegister start = firstElementDest - offset;
+        for (i = offset; i < limit; ++i)
+            exec->r(start + i) = storage()[i].get();
+        for (; i < length; ++i)
+            exec->r(start + i) = get(exec, i);
+        return;
+    }
+
+    GenericArguments::copyToArguments(exec, firstElementDest, offset, length);
+}
+
+unsigned DirectArguments::overridesSize()
+{
+    // We always allocate something; in the relatively uncommon case of overriding an empty argument we
+    // still allocate so that m_overrides is non-null. We use that to indicate that the other properties
+    // (length, etc) are overridden.
+    return WTF::roundUpToMultipleOf<8>(m_length ? m_length : 1);
+}
+
+} // namespace JSC
+
diff --git a/runtime/DirectArguments.h b/runtime/DirectArguments.h
new file mode 100644
index 0000000..f02b054
--- /dev/null
+++ b/runtime/DirectArguments.h
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "AuxiliaryBarrier.h"
+#include "DirectArgumentsOffset.h"
+#include "GenericArguments.h"
+
+namespace JSC {
+
+// This is an Arguments-class object that we create when you say "arguments" inside a function,
+// and none of the arguments are captured in the function's activation. The function will copy all
+// of its arguments into this object, and all subsequent accesses to the arguments will go through
+// this object thereafter. Special support is in place for mischevious events like the arguments
+// being deleted (something like "delete arguments[0]") or reconfigured (broadly, we say deletions
+// and reconfigurations mean that the respective argument was "overridden").
+//
+// To speed allocation, this object will hold all of the arguments in-place. The arguments as well
+// as a table of flags saying which arguments were overridden.
+class DirectArguments : public GenericArguments<DirectArguments> {
+private:
+    DirectArguments(VM&, Structure*, unsigned length, unsigned capacity);
+    
+public:
+    // Creates an arguments object but leaves it uninitialized. This is dangerous if we GC right
+    // after allocation.
+    static DirectArguments* createUninitialized(VM&, Structure*, unsigned length, unsigned capacity);
+    
+    // Creates an arguments object and initializes everything to the empty value. Use this if you
+    // cannot guarantee that you'll immediately initialize all of the elements.
+    static DirectArguments* create(VM&, Structure*, unsigned length, unsigned capacity);
+    
+    // Creates an arguments object by copying the argumnets from the stack.
+    static DirectArguments* createByCopying(ExecState*);
+
+    static size_t estimatedSize(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+    uint32_t internalLength() const
+    {
+        return m_length;
+    }
+    
+    uint32_t length(ExecState* exec) const
+    {
+        if (UNLIKELY(m_overrides))
+            return get(exec, exec->propertyNames().length).toUInt32(exec);
+        return m_length;
+    }
+    
+    bool canAccessIndexQuickly(uint32_t i) const
+    {
+        return i < m_length && (!m_overrides || !m_overrides.get()[i]);
+    }
+
+    bool canAccessArgumentIndexQuicklyInDFG(uint32_t i) const
+    {
+        return i < m_length && !overrodeThings();
+    }
+
+    JSValue getIndexQuickly(uint32_t i) const
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(canAccessIndexQuickly(i));
+        return const_cast<DirectArguments*>(this)->storage()[i].get();
+    }
+    
+    void setIndexQuickly(VM& vm, uint32_t i, JSValue value)
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(canAccessIndexQuickly(i));
+        storage()[i].set(vm, this, value);
+    }
+    
+    WriteBarrier<JSFunction>& callee()
+    {
+        return m_callee;
+    }
+    
+    WriteBarrier<Unknown>& argument(DirectArgumentsOffset offset)
+    {
+        ASSERT(offset);
+        ASSERT_WITH_SECURITY_IMPLICATION(offset.offset() < std::max(m_length, m_minCapacity));
+        return storage()[offset.offset()];
+    }
+    
+    // Methods intended for use by the GenericArguments mixin.
+    bool overrodeThings() const { return !!m_overrides; }
+    void overrideThings(VM&);
+    void overrideThingsIfNecessary(VM&);
+    void overrideArgument(VM&, unsigned index);
+    
+    void copyToArguments(ExecState*, VirtualRegister firstElementDest, unsigned offset, unsigned length);
+
+    DECLARE_INFO;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+    
+    static ptrdiff_t offsetOfCallee() { return OBJECT_OFFSETOF(DirectArguments, m_callee); }
+    static ptrdiff_t offsetOfLength() { return OBJECT_OFFSETOF(DirectArguments, m_length); }
+    static ptrdiff_t offsetOfMinCapacity() { return OBJECT_OFFSETOF(DirectArguments, m_minCapacity); }
+    static ptrdiff_t offsetOfOverrides() { return OBJECT_OFFSETOF(DirectArguments, m_overrides); }
+    
+    static size_t storageOffset()
+    {
+        return WTF::roundUpToMultipleOf<sizeof(WriteBarrier<Unknown>)>(sizeof(DirectArguments));
+    }
+    
+    static size_t offsetOfSlot(uint32_t index)
+    {
+        return storageOffset() + sizeof(WriteBarrier<Unknown>) * index;
+    }
+    
+    static size_t allocationSize(uint32_t capacity)
+    {
+        return offsetOfSlot(capacity);
+    }
+    
+private:
+    WriteBarrier<Unknown>* storage()
+    {
+        return bitwise_cast<WriteBarrier<Unknown>*>(bitwise_cast<char*>(this) + storageOffset());
+    }
+    
+    unsigned overridesSize();
+    
+    WriteBarrier<JSFunction> m_callee;
+    uint32_t m_length; // Always the actual length of captured arguments and never what was stored into the length property.
+    uint32_t m_minCapacity; // The max of this and length determines the capacity of this object. It may be the actual capacity, or maybe something smaller. We arrange it this way to be kind to the JITs.
+    AuxiliaryBarrier<bool*> m_overrides; // If non-null, it means that length, callee, and caller are fully materialized properties.
+};
+
+} // namespace JSC
diff --git a/runtime/DirectArgumentsOffset.cpp b/runtime/DirectArgumentsOffset.cpp
new file mode 100644
index 0000000..9fc4c42
--- /dev/null
+++ b/runtime/DirectArgumentsOffset.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DirectArgumentsOffset.h"
+
+namespace JSC {
+
+void DirectArgumentsOffset::dump(PrintStream& out) const
+{
+    if (!*this) {
+        out.print("capturedArgumentInvalid");
+        return;
+    }
+
+    out.print("capturedArgument", offset());
+}
+
+} // namespace JSC
+
diff --git a/runtime/DirectArgumentsOffset.h b/runtime/DirectArgumentsOffset.h
new file mode 100644
index 0000000..1c9cb54
--- /dev/null
+++ b/runtime/DirectArgumentsOffset.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GenericOffset.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+// This is an offset into the special arguments object, which captures the arguments to a
+// function. It only comes into play if the arguments aren't also lifted into the activation.
+// If they were then accesses to the arguments would resolve to a ScopeOffset and not a
+// DirectArgumentsOffset.
+class DirectArgumentsOffset : public GenericOffset<DirectArgumentsOffset> {
+public:
+    DirectArgumentsOffset() { }
+    
+    explicit DirectArgumentsOffset(unsigned offset)
+        : GenericOffset(offset)
+    {
+    }
+    
+    void dump(PrintStream&) const;
+};
+
+} // namespace JSC
diff --git a/runtime/DirectEvalExecutable.cpp b/runtime/DirectEvalExecutable.cpp
new file mode 100644
index 0000000..277ff4d
--- /dev/null
+++ b/runtime/DirectEvalExecutable.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DirectEvalExecutable.h"
+
+#include "CodeCache.h"
+#include "Debugger.h"
+#include "Error.h"
+#include "HeapInlines.h"
+#include "JSCJSValueInlines.h"
+#include "ParserError.h"
+
+namespace JSC {
+
+DirectEvalExecutable* DirectEvalExecutable::create(ExecState* exec, const SourceCode& source, bool isInStrictContext, DerivedContextType derivedContextType, bool isArrowFunctionContext, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    if (!globalObject->evalEnabled()) {
+        throwException(exec, scope, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
+        return 0;
+    }
+
+    auto* executable = new (NotNull, allocateCell<DirectEvalExecutable>(*exec->heap())) DirectEvalExecutable(exec, source, isInStrictContext, derivedContextType, isArrowFunctionContext, evalContextType);
+    executable->finishCreation(vm);
+
+    ParserError error;
+    JSParserStrictMode strictMode = executable->isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
+    DebuggerMode debuggerMode = globalObject->hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
+
+    // We don't bother with CodeCache here because direct eval uses a specialized DirectEvalCodeCache.
+    UnlinkedEvalCodeBlock* unlinkedEvalCode = generateUnlinkedCodeBlock<UnlinkedEvalCodeBlock>(
+        vm, executable, executable->source(), strictMode, JSParserScriptMode::Classic, debuggerMode, error, evalContextType, variablesUnderTDZ);
+
+    if (globalObject->hasDebugger())
+        globalObject->debugger()->sourceParsed(exec, executable->source().provider(), error.line(), error.message());
+
+    if (error.isValid()) {
+        throwVMError(exec, scope, error.toErrorObject(globalObject, executable->source()));
+        return nullptr;
+    }
+
+    executable->m_unlinkedEvalCodeBlock.set(vm, executable, unlinkedEvalCode);
+
+    return executable;
+}
+
+DirectEvalExecutable::DirectEvalExecutable(ExecState* exec, const SourceCode& source, bool inStrictContext, DerivedContextType derivedContextType, bool isArrowFunctionContext, EvalContextType evalContextType)
+    : EvalExecutable(exec, source, inStrictContext, derivedContextType, isArrowFunctionContext, evalContextType)
+{
+}
+
+} // namespace JSC
diff --git a/runtime/DirectEvalExecutable.h b/runtime/DirectEvalExecutable.h
new file mode 100644
index 0000000..e48019f
--- /dev/null
+++ b/runtime/DirectEvalExecutable.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "EvalExecutable.h"
+
+namespace JSC {
+
+class DirectEvalExecutable final : public EvalExecutable {
+public:
+    static DirectEvalExecutable* create(ExecState*, const SourceCode&, bool isInStrictContext, DerivedContextType, bool isArrowFunctionContext, EvalContextType, const VariableEnvironment*);
+private:
+    DirectEvalExecutable(ExecState*, const SourceCode&, bool inStrictContext, DerivedContextType, bool isArrowFunctionContext, EvalContextType);
+};
+
+} // namespace JSC
diff --git a/runtime/DumpContext.cpp b/runtime/DumpContext.cpp
new file mode 100644
index 0000000..f07c2b2
--- /dev/null
+++ b/runtime/DumpContext.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DumpContext.h"
+
+namespace JSC {
+
+DumpContext::DumpContext()
+    : graph(0)
+{
+}
+
+DumpContext::~DumpContext() { }
+
+bool DumpContext::isEmpty() const
+{
+    return structures.isEmpty();
+}
+
+void DumpContext::dump(PrintStream& out, const char* prefix) const
+{
+    structures.dump(out, prefix);
+}
+
+} // namespace JSC
+
diff --git a/runtime/DumpContext.h b/runtime/DumpContext.h
new file mode 100644
index 0000000..1227cfe
--- /dev/null
+++ b/runtime/DumpContext.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Structure.h"
+#include <wtf/PrintStream.h>
+#include <wtf/StringHashDumpContext.h>
+
+namespace JSC {
+
+namespace DFG { class Graph; }
+
+struct DumpContext {
+    DumpContext();
+    ~DumpContext();
+    
+    bool isEmpty() const;
+    
+    void dump(PrintStream&, const char* prefix = "") const;
+    
+    StringHashDumpContext<Structure> structures;
+    DFG::Graph* graph;
+};
+
+} // namespace JSC
diff --git a/runtime/ECMAScriptSpecInternalFunctions.cpp b/runtime/ECMAScriptSpecInternalFunctions.cpp
new file mode 100644
index 0000000..011e08f
--- /dev/null
+++ b/runtime/ECMAScriptSpecInternalFunctions.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ECMAScriptSpecInternalFunctions.h"
+
+#include "CallFrame.h"
+#include "ConstructData.h"
+#include "JSCInlines.h"
+#include "RegExpObject.h"
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL esSpecIsConstructor(ExecState* exec)
+{
+    bool isConstructor = exec->uncheckedArgument(0).isConstructor();
+    return JSValue::encode(jsBoolean(isConstructor));
+}
+
+} // namespace JSC
diff --git a/runtime/ECMAScriptSpecInternalFunctions.h b/runtime/ECMAScriptSpecInternalFunctions.h
new file mode 100644
index 0000000..808d7f8
--- /dev/null
+++ b/runtime/ECMAScriptSpecInternalFunctions.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL esSpecIsConstructor(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/EnumerationMode.h b/runtime/EnumerationMode.h
new file mode 100644
index 0000000..7abbed2
--- /dev/null
+++ b/runtime/EnumerationMode.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum class PropertyNameMode {
+    Symbols = 1 << 0,
+    Strings = 1 << 1,
+    StringsAndSymbols = Symbols | Strings,
+};
+
+enum class DontEnumPropertiesMode {
+    Include,
+    Exclude
+};
+
+enum class JSObjectPropertiesMode {
+    Include,
+    Exclude
+};
+
+class EnumerationMode {
+public:
+    EnumerationMode(DontEnumPropertiesMode dontEnumPropertiesMode = DontEnumPropertiesMode::Exclude, JSObjectPropertiesMode jsObjectPropertiesMode = JSObjectPropertiesMode::Include)
+        : m_dontEnumPropertiesMode(dontEnumPropertiesMode)
+        , m_jsObjectPropertiesMode(jsObjectPropertiesMode)
+    {
+    }
+
+    EnumerationMode(const EnumerationMode& mode, JSObjectPropertiesMode jsObjectPropertiesMode)
+        : m_dontEnumPropertiesMode(mode.m_dontEnumPropertiesMode)
+        , m_jsObjectPropertiesMode(jsObjectPropertiesMode)
+    {
+    }
+
+    // Add other constructors as needed for convenience
+
+    bool includeDontEnumProperties()
+    {
+        return m_dontEnumPropertiesMode == DontEnumPropertiesMode::Include;
+    }
+
+    bool includeJSObjectProperties()
+    {
+        return m_jsObjectPropertiesMode == JSObjectPropertiesMode::Include;
+    }
+
+private:
+    DontEnumPropertiesMode m_dontEnumPropertiesMode;
+    JSObjectPropertiesMode m_jsObjectPropertiesMode;
+};
+
+} // namespace JSC
diff --git a/runtime/Error.cpp b/runtime/Error.cpp
new file mode 100644
index 0000000..677dc9b
--- /dev/null
+++ b/runtime/Error.cpp
@@ -0,0 +1,341 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2006, 2008, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Eric Seidel (eric@webkit.org)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Error.h"
+
+#include "ConstructData.h"
+#include "ErrorConstructor.h"
+#include "ExceptionHelpers.h"
+#include "FunctionPrototype.h"
+#include "Interpreter.h"
+#include "JSArray.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+#include "NativeErrorConstructor.h"
+#include "SourceCode.h"
+#include "StackFrame.h"
+
+namespace JSC {
+
+static const char* linePropertyName = "line";
+static const char* sourceURLPropertyName = "sourceURL";
+
+JSObject* createError(ExecState* exec, const String& message, ErrorInstance::SourceAppender appender)
+{
+    ASSERT(!message.isEmpty());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return ErrorInstance::create(exec, globalObject->vm(), globalObject->errorStructure(), message, appender, TypeNothing, true);
+}
+
+JSObject* createEvalError(ExecState* exec, const String& message, ErrorInstance::SourceAppender appender)
+{
+    ASSERT(!message.isEmpty());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return ErrorInstance::create(exec, globalObject->vm(), globalObject->evalErrorConstructor()->errorStructure(), message, appender, TypeNothing, true);
+}
+
+JSObject* createRangeError(ExecState* exec, const String& message, ErrorInstance::SourceAppender appender)
+{
+    ASSERT(!message.isEmpty());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return ErrorInstance::create(exec, globalObject->vm(), globalObject->rangeErrorConstructor()->errorStructure(), message, appender, TypeNothing, true);
+}
+
+JSObject* createReferenceError(ExecState* exec, const String& message, ErrorInstance::SourceAppender appender)
+{
+    ASSERT(!message.isEmpty());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return ErrorInstance::create(exec, globalObject->vm(), globalObject->referenceErrorConstructor()->errorStructure(), message, appender, TypeNothing, true);
+}
+
+JSObject* createSyntaxError(ExecState* exec, const String& message, ErrorInstance::SourceAppender appender)
+{
+    ASSERT(!message.isEmpty());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return ErrorInstance::create(exec, globalObject->vm(), globalObject->syntaxErrorConstructor()->errorStructure(), message, appender, TypeNothing, true);
+}
+
+JSObject* createTypeError(ExecState* exec, const String& message, ErrorInstance::SourceAppender appender, RuntimeType type)
+{
+    ASSERT(!message.isEmpty());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return ErrorInstance::create(exec, globalObject->vm(), globalObject->typeErrorConstructor()->errorStructure(), message, appender, type, true);
+}
+
+JSObject* createNotEnoughArgumentsError(ExecState* exec, ErrorInstance::SourceAppender appender)
+{
+    return createTypeError(exec, ASCIILiteral("Not enough arguments"), appender, TypeNothing);
+}
+
+JSObject* createURIError(ExecState* exec, const String& message, ErrorInstance::SourceAppender appender)
+{
+    ASSERT(!message.isEmpty());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return ErrorInstance::create(exec, globalObject->vm(), globalObject->URIErrorConstructor()->errorStructure(), message, appender, TypeNothing, true);
+}
+
+JSObject* createError(ExecState* exec, ErrorType errorType, const String& message)
+{
+    switch (errorType) {
+    case ErrorType::Error:
+        return createError(exec, message);
+    case ErrorType::EvalError:
+        return createEvalError(exec, message);
+    case ErrorType::RangeError:
+        return createRangeError(exec, message);
+    case ErrorType::ReferenceError:
+        return createReferenceError(exec, message);
+    case ErrorType::SyntaxError:
+        return createSyntaxError(exec, message);
+    case ErrorType::TypeError:
+        return createTypeError(exec, message);
+    case ErrorType::URIError:
+        return createURIError(exec, message);
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+class FindFirstCallerFrameWithCodeblockFunctor {
+public:
+    FindFirstCallerFrameWithCodeblockFunctor(CallFrame* startCallFrame)
+        : m_startCallFrame(startCallFrame)
+        , m_foundCallFrame(nullptr)
+        , m_foundStartCallFrame(false)
+        , m_index(0)
+    { }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        if (!m_foundStartCallFrame && (visitor->callFrame() == m_startCallFrame))
+            m_foundStartCallFrame = true;
+
+        if (m_foundStartCallFrame) {
+            if (visitor->callFrame()->codeBlock()) {
+                m_foundCallFrame = visitor->callFrame();
+                return StackVisitor::Done;
+            }
+            m_index++;
+        }
+
+        return StackVisitor::Continue;
+    }
+
+    CallFrame* foundCallFrame() const { return m_foundCallFrame; }
+    unsigned index() const { return m_index; }
+
+private:
+    CallFrame* m_startCallFrame;
+    mutable CallFrame* m_foundCallFrame;
+    mutable bool m_foundStartCallFrame;
+    mutable unsigned m_index;
+};
+
+bool addErrorInfoAndGetBytecodeOffset(ExecState* exec, VM& vm, JSObject* obj, bool useCurrentFrame, CallFrame*& callFrame, unsigned* bytecodeOffset)
+{
+    Vector<StackFrame> stackTrace = Vector<StackFrame>();
+
+    size_t framesToSkip = useCurrentFrame ? 0 : 1;
+    vm.interpreter->getStackTrace(stackTrace, framesToSkip);
+    if (!stackTrace.isEmpty()) {
+
+        ASSERT(exec == vm.topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec());
+
+        StackFrame* firstFrameWithLineAndColumnInfo = nullptr;
+        for (unsigned i = 0 ; i < stackTrace.size(); ++i) {
+            firstFrameWithLineAndColumnInfo = &stackTrace.at(i);
+            if (firstFrameWithLineAndColumnInfo->hasLineAndColumnInfo())
+                break;
+        }
+
+        if (bytecodeOffset) {
+            FindFirstCallerFrameWithCodeblockFunctor functor(exec);
+            vm.topCallFrame->iterate(functor);
+            callFrame = functor.foundCallFrame();
+            unsigned stackIndex = functor.index();
+            *bytecodeOffset = 0;
+            if (stackTrace.at(stackIndex).hasBytecodeOffset())
+                *bytecodeOffset = stackTrace.at(stackIndex).bytecodeOffset();
+        }
+        
+        unsigned line;
+        unsigned column;
+        firstFrameWithLineAndColumnInfo->computeLineAndColumn(line, column);
+        obj->putDirect(vm, vm.propertyNames->line, jsNumber(line));
+        obj->putDirect(vm, vm.propertyNames->column, jsNumber(column));
+
+        String frameSourceURL = firstFrameWithLineAndColumnInfo->sourceURL();
+        if (!frameSourceURL.isEmpty())
+            obj->putDirect(vm, vm.propertyNames->sourceURL, jsString(&vm, frameSourceURL));
+
+        obj->putDirect(vm, vm.propertyNames->stack, Interpreter::stackTraceAsString(vm, stackTrace), DontEnum);
+
+        return true;
+    }
+    return false;
+}
+
+void addErrorInfo(ExecState* exec, JSObject* obj, bool useCurrentFrame)
+{
+    CallFrame* callFrame = nullptr;
+    addErrorInfoAndGetBytecodeOffset(exec, exec->vm(), obj, useCurrentFrame, callFrame);
+}
+
+JSObject* addErrorInfo(CallFrame* callFrame, JSObject* error, int line, const SourceCode& source)
+{
+    VM* vm = &callFrame->vm();
+    const String& sourceURL = source.provider()->url();
+
+    if (line != -1)
+        error->putDirect(*vm, Identifier::fromString(vm, linePropertyName), jsNumber(line));
+    if (!sourceURL.isNull())
+        error->putDirect(*vm, Identifier::fromString(vm, sourceURLPropertyName), jsString(vm, sourceURL));
+    return error;
+}
+
+JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState* exec, ThrowScope& scope, const char* constructorName)
+{
+    return throwTypeError(exec, scope, makeString("calling ", constructorName, " constructor without new is invalid"));
+}
+
+JSObject* throwTypeError(ExecState* exec, ThrowScope& scope)
+{
+    return throwException(exec, scope, createTypeError(exec));
+}
+
+JSObject* throwTypeError(ExecState* exec, ThrowScope& scope, ASCIILiteral errorMessage)
+{
+    return throwTypeError(exec, scope, String(errorMessage));
+}
+
+JSObject* throwTypeError(ExecState* exec, ThrowScope& scope, const String& message)
+{
+    return throwException(exec, scope, createTypeError(exec, message));
+}
+
+JSObject* throwSyntaxError(ExecState* exec, ThrowScope& scope)
+{
+    return throwException(exec, scope, createSyntaxError(exec, ASCIILiteral("Syntax error")));
+}
+
+JSObject* throwSyntaxError(ExecState* exec, ThrowScope& scope, const String& message)
+{
+    return throwException(exec, scope, createSyntaxError(exec, message));
+}
+
+JSObject* createError(ExecState* exec, const String& message)
+{
+    return createError(exec, message, nullptr);
+}
+
+JSObject* createEvalError(ExecState* exec, const String& message)
+{
+    return createEvalError(exec, message, nullptr);
+}
+
+JSObject* createRangeError(ExecState* exec, const String& message)
+{
+    return createRangeError(exec, message, nullptr);
+}
+
+JSObject* createReferenceError(ExecState* exec, const String& message)
+{
+    return createReferenceError(exec, message, nullptr);
+}
+
+JSObject* createSyntaxError(ExecState* exec, const String& message)
+{
+    return createSyntaxError(exec, message, nullptr);
+}
+
+JSObject* createTypeError(ExecState* exec)
+{
+    return createTypeError(exec, ASCIILiteral("Type error"));
+}
+
+JSObject* createTypeError(ExecState* exec, const String& message)
+{
+    return createTypeError(exec, message, nullptr, TypeNothing);
+}
+
+JSObject* createNotEnoughArgumentsError(ExecState* exec)
+{
+    return createNotEnoughArgumentsError(exec, nullptr);
+}
+
+JSObject* createURIError(ExecState* exec, const String& message)
+{
+    return createURIError(exec, message, nullptr);
+}
+
+JSObject* createOutOfMemoryError(ExecState* exec)
+{
+    return createError(exec, ASCIILiteral("Out of memory"), nullptr);
+}
+
+
+const ClassInfo StrictModeTypeErrorFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(StrictModeTypeErrorFunction) };
+
+void StrictModeTypeErrorFunction::destroy(JSCell* cell)
+{
+    static_cast<StrictModeTypeErrorFunction*>(cell)->StrictModeTypeErrorFunction::~StrictModeTypeErrorFunction();
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, JSC::ErrorType errorType)
+{
+    switch (errorType) {
+    case JSC::ErrorType::Error:
+        out.print("Error");
+        break;
+    case JSC::ErrorType::EvalError:
+        out.print("EvalError");
+        break;
+    case JSC::ErrorType::RangeError:
+        out.print("RangeError");
+        break;
+    case JSC::ErrorType::ReferenceError:
+        out.print("ReferenceError");
+        break;
+    case JSC::ErrorType::SyntaxError:
+        out.print("SyntaxError");
+        break;
+    case JSC::ErrorType::TypeError:
+        out.print("TypeError");
+        break;
+    case JSC::ErrorType::URIError:
+        out.print("URIError");
+        break;
+    }
+}
+
+} // namespace WTF
diff --git a/runtime/Error.h b/runtime/Error.h
new file mode 100644
index 0000000..aae660c
--- /dev/null
+++ b/runtime/Error.h
@@ -0,0 +1,168 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "ErrorInstance.h"
+#include "InternalFunction.h"
+#include "JSObject.h"
+#include "ThrowScope.h"
+#include <stdint.h>
+
+
+namespace JSC {
+
+class ExecState;
+class VM;
+class JSGlobalObject;
+class JSObject;
+class SourceCode;
+class Structure;
+
+enum class ErrorType : uint8_t {
+    Error,
+    EvalError,
+    RangeError,
+    ReferenceError,
+    SyntaxError,
+    TypeError,
+    URIError,
+};
+
+// ExecState wrappers.
+JSObject* createError(ExecState*, const String&, ErrorInstance::SourceAppender);
+JSObject* createEvalError(ExecState*, const String&, ErrorInstance::SourceAppender);
+JSObject* createRangeError(ExecState*, const String&, ErrorInstance::SourceAppender);
+JSObject* createReferenceError(ExecState*, const String&, ErrorInstance::SourceAppender);
+JSObject* createSyntaxError(ExecState*, const String&, ErrorInstance::SourceAppender);
+JSObject* createTypeError(ExecState*, const String&, ErrorInstance::SourceAppender, RuntimeType);
+JSObject* createNotEnoughArgumentsError(ExecState*, ErrorInstance::SourceAppender);
+JSObject* createURIError(ExecState*, const String&, ErrorInstance::SourceAppender);
+
+
+JS_EXPORT_PRIVATE JSObject* createError(ExecState*, const String&);
+JS_EXPORT_PRIVATE JSObject* createEvalError(ExecState*, const String&);
+JS_EXPORT_PRIVATE JSObject* createRangeError(ExecState*, const String&);
+JS_EXPORT_PRIVATE JSObject* createReferenceError(ExecState*, const String&);
+JS_EXPORT_PRIVATE JSObject* createSyntaxError(ExecState*, const String&);
+JS_EXPORT_PRIVATE JSObject* createTypeError(ExecState*);
+JS_EXPORT_PRIVATE JSObject* createTypeError(ExecState*, const String&);
+JS_EXPORT_PRIVATE JSObject* createNotEnoughArgumentsError(ExecState*);
+JS_EXPORT_PRIVATE JSObject* createURIError(ExecState*, const String&);
+JS_EXPORT_PRIVATE JSObject* createOutOfMemoryError(ExecState*);
+
+JS_EXPORT_PRIVATE JSObject* createError(ExecState*, ErrorType, const String&);
+
+
+bool addErrorInfoAndGetBytecodeOffset(ExecState*, VM&, JSObject*, bool, CallFrame*&, unsigned* = nullptr);
+
+JS_EXPORT_PRIVATE void addErrorInfo(ExecState*, JSObject*, bool); 
+JSObject* addErrorInfo(ExecState*, JSObject* error, int line, const SourceCode&);
+
+// Methods to throw Errors.
+
+// Convenience wrappers, create an throw an exception with a default message.
+JS_EXPORT_PRIVATE JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState*, ThrowScope&, const char* constructorName);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&, ASCIILiteral errorMessage);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&, const String& errorMessage);
+JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, ThrowScope&);
+JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, ThrowScope&, const String& errorMessage);
+inline JSObject* throwRangeError(ExecState* state, ThrowScope& scope, const String& errorMessage) { return throwException(state, scope, createRangeError(state, errorMessage)); }
+
+// Convenience wrappers, wrap result as an EncodedJSValue.
+inline void throwVMError(ExecState* exec, ThrowScope& scope, Exception* exception) { throwException(exec, scope, exception); }
+inline EncodedJSValue throwVMError(ExecState* exec, ThrowScope& scope, JSValue error) { return JSValue::encode(throwException(exec, scope, error)); }
+inline EncodedJSValue throwVMError(ExecState* exec, ThrowScope& scope, const char* errorMessage) { return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(errorMessage)))); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope& scope) { return JSValue::encode(throwTypeError(exec, scope)); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope& scope, ASCIILiteral errorMessage) { return JSValue::encode(throwTypeError(exec, scope, errorMessage)); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope& scope, const String& errorMessage) { return JSValue::encode(throwTypeError(exec, scope, errorMessage)); }
+inline EncodedJSValue throwVMRangeError(ExecState* state, ThrowScope& scope, const String& errorMessage) { return JSValue::encode(throwRangeError(state, scope, errorMessage)); }
+
+class StrictModeTypeErrorFunction : public InternalFunction {
+private:
+    StrictModeTypeErrorFunction(VM& vm, Structure* structure, const String& message)
+        : InternalFunction(vm, structure)
+        , m_message(message)
+    {
+    }
+
+    static void destroy(JSCell*);
+
+public:
+    typedef InternalFunction Base;
+
+    static StrictModeTypeErrorFunction* create(VM& vm, Structure* structure, const String& message)
+    {
+        StrictModeTypeErrorFunction* function = new (NotNull, allocateCell<StrictModeTypeErrorFunction>(vm.heap)) StrictModeTypeErrorFunction(vm, structure, message);
+        function->finishCreation(vm, String());
+        return function;
+    }
+
+    static EncodedJSValue JSC_HOST_CALL constructThrowTypeError(ExecState* exec)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwTypeError(exec, scope, static_cast<StrictModeTypeErrorFunction*>(exec->jsCallee())->m_message);
+        return JSValue::encode(jsNull());
+    }
+
+    static ConstructType getConstructData(JSCell*, ConstructData& constructData)
+    {
+        constructData.native.function = constructThrowTypeError;
+        return ConstructType::Host;
+    }
+
+    static EncodedJSValue JSC_HOST_CALL callThrowTypeError(ExecState* exec)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwTypeError(exec, scope, static_cast<StrictModeTypeErrorFunction*>(exec->jsCallee())->m_message);
+        return JSValue::encode(jsNull());
+    }
+
+    static CallType getCallData(JSCell*, CallData& callData)
+    {
+        callData.native.function = callThrowTypeError;
+        return CallType::Host;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    { 
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+private:
+    String m_message;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::ErrorType);
+
+} // namespace WTF
diff --git a/runtime/ErrorConstructor.cpp b/runtime/ErrorConstructor.cpp
new file mode 100644
index 0000000..1d822c7
--- /dev/null
+++ b/runtime/ErrorConstructor.cpp
@@ -0,0 +1,81 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "ErrorConstructor.h"
+
+#include "ErrorPrototype.h"
+#include "Interpreter.h"
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ErrorConstructor);
+
+const ClassInfo ErrorConstructor::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(ErrorConstructor) };
+
+ErrorConstructor::ErrorConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void ErrorConstructor::finishCreation(VM& vm, ErrorPrototype* errorPrototype)
+{
+    Base::finishCreation(vm, ASCIILiteral("Error"));
+    // ECMA 15.11.3.1 Error.prototype
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, errorPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), DontEnum | ReadOnly);
+}
+
+// ECMA 15.9.3
+
+EncodedJSValue JSC_HOST_CALL Interpreter::constructWithErrorConstructor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue message = exec->argument(0);
+    Structure* errorStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), asInternalFunction(exec->jsCallee())->globalObject()->errorStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(ErrorInstance::create(exec, errorStructure, message, nullptr, TypeNothing, false));
+}
+
+ConstructType ErrorConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = Interpreter::constructWithErrorConstructor;
+    return ConstructType::Host;
+}
+
+EncodedJSValue JSC_HOST_CALL Interpreter::callErrorConstructor(ExecState* exec)
+{
+    JSValue message = exec->argument(0);
+    Structure* errorStructure = asInternalFunction(exec->jsCallee())->globalObject()->errorStructure();
+    return JSValue::encode(ErrorInstance::create(exec, errorStructure, message, nullptr, TypeNothing, false));
+}
+
+CallType ErrorConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = Interpreter::callErrorConstructor;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/ErrorConstructor.h b/runtime/ErrorConstructor.h
new file mode 100644
index 0000000..1dc3090
--- /dev/null
+++ b/runtime/ErrorConstructor.h
@@ -0,0 +1,58 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "ErrorInstance.h"
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class ErrorPrototype;
+class GetterSetter;
+
+class ErrorConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static ErrorConstructor* create(VM& vm, Structure* structure, ErrorPrototype* errorPrototype, GetterSetter*)
+    {
+        ErrorConstructor* constructor = new (NotNull, allocateCell<ErrorConstructor>(vm.heap)) ErrorConstructor(vm, structure);
+        constructor->finishCreation(vm, errorPrototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    { 
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+protected:
+    void finishCreation(VM&, ErrorPrototype*);
+        
+private:
+    ErrorConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/ErrorHandlingScope.cpp b/runtime/ErrorHandlingScope.cpp
new file mode 100644
index 0000000..072a9fa
--- /dev/null
+++ b/runtime/ErrorHandlingScope.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ErrorHandlingScope.h"
+
+#include "Options.h"
+#include "VM.h"
+
+namespace JSC {
+
+ErrorHandlingScope::ErrorHandlingScope(VM& vm)
+    : m_vm(vm)
+{
+    RELEASE_ASSERT(m_vm.stackPointerAtVMEntry());
+    size_t newSoftReservedZoneSize = Options::reservedZoneSize();
+    m_savedSoftReservedZoneSize = m_vm.updateSoftReservedZoneSize(newSoftReservedZoneSize);
+}
+
+ErrorHandlingScope::~ErrorHandlingScope()
+{
+    RELEASE_ASSERT(m_vm.stackPointerAtVMEntry());
+    m_vm.updateSoftReservedZoneSize(m_savedSoftReservedZoneSize);
+}
+
+} // namespace JSC
diff --git a/runtime/ErrorHandlingScope.h b/runtime/ErrorHandlingScope.h
new file mode 100644
index 0000000..f728978
--- /dev/null
+++ b/runtime/ErrorHandlingScope.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+class VM;
+
+class ErrorHandlingScope {
+public:
+    JS_EXPORT_PRIVATE ErrorHandlingScope(VM&);
+    JS_EXPORT_PRIVATE ~ErrorHandlingScope();
+private:
+    VM& m_vm;
+    size_t m_savedSoftReservedZoneSize;
+};
+
+} // namespace JSC
diff --git a/runtime/ErrorInstance.cpp b/runtime/ErrorInstance.cpp
new file mode 100644
index 0000000..ed8f2d7
--- /dev/null
+++ b/runtime/ErrorInstance.cpp
@@ -0,0 +1,228 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "ErrorInstance.h"
+
+#include "CodeBlock.h"
+#include "InlineCallFrame.h"
+#include "JSScope.h"
+#include "JSCInlines.h"
+#include "JSGlobalObjectFunctions.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ErrorInstance);
+
+const ClassInfo ErrorInstance::s_info = { "Error", &JSNonFinalObject::s_info, 0, CREATE_METHOD_TABLE(ErrorInstance) };
+
+ErrorInstance::ErrorInstance(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+ErrorInstance* ErrorInstance::create(ExecState* state, Structure* structure, JSValue message, SourceAppender appender, RuntimeType type, bool useCurrentFrame)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    String messageString = message.isUndefined() ? String() : message.toWTFString(state);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    return create(state, vm, structure, messageString, appender, type, useCurrentFrame);
+}
+
+static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception, unsigned bytecodeOffset)
+{
+    ErrorInstance::SourceAppender appender = exception->sourceAppender();
+    exception->clearSourceAppender();
+    RuntimeType type = exception->runtimeTypeForCause();
+    exception->clearRuntimeTypeForCause();
+
+    if (!callFrame->codeBlock()->hasExpressionInfo())
+        return;
+    
+    int startOffset = 0;
+    int endOffset = 0;
+    int divotPoint = 0;
+    unsigned line = 0;
+    unsigned column = 0;
+
+    CodeBlock* codeBlock;
+    CodeOrigin codeOrigin = callFrame->codeOrigin();
+    if (codeOrigin && codeOrigin.inlineCallFrame)
+        codeBlock = baselineCodeBlockForInlineCallFrame(codeOrigin.inlineCallFrame);
+    else
+        codeBlock = callFrame->codeBlock();
+
+    codeBlock->expressionRangeForBytecodeOffset(bytecodeOffset, divotPoint, startOffset, endOffset, line, column);
+    
+    int expressionStart = divotPoint - startOffset;
+    int expressionStop = divotPoint + endOffset;
+
+    StringView sourceString = codeBlock->source()->source();
+    if (!expressionStop || expressionStart > static_cast<int>(sourceString.length()))
+        return;
+    
+    VM* vm = &callFrame->vm();
+    JSValue jsMessage = exception->getDirect(*vm, vm->propertyNames->message);
+    if (!jsMessage || !jsMessage.isString())
+        return;
+    
+    String message = asString(jsMessage)->value(callFrame);
+    if (expressionStart < expressionStop)
+        message = appender(message, codeBlock->source()->getRange(expressionStart, expressionStop).toString(), type, ErrorInstance::FoundExactSource);
+    else {
+        // No range information, so give a few characters of context.
+        int dataLength = sourceString.length();
+        int start = expressionStart;
+        int stop = expressionStart;
+        // Get up to 20 characters of context to the left and right of the divot, clamping to the line.
+        // Then strip whitespace.
+        while (start > 0 && (expressionStart - start < 20) && sourceString[start - 1] != '\n')
+            start--;
+        while (start < (expressionStart - 1) && isStrWhiteSpace(sourceString[start]))
+            start++;
+        while (stop < dataLength && (stop - expressionStart < 20) && sourceString[stop] != '\n')
+            stop++;
+        while (stop > expressionStart && isStrWhiteSpace(sourceString[stop - 1]))
+            stop--;
+        message = appender(message, codeBlock->source()->getRange(start, stop).toString(), type, ErrorInstance::FoundApproximateSource);
+    }
+    exception->putDirect(*vm, vm->propertyNames->message, jsString(vm, message));
+
+}
+
+class FindFirstCallerFrameWithCodeblockFunctor {
+public:
+    FindFirstCallerFrameWithCodeblockFunctor(CallFrame* startCallFrame)
+        : m_startCallFrame(startCallFrame)
+        , m_foundCallFrame(nullptr)
+        , m_foundStartCallFrame(false)
+        , m_index(0)
+    { }
+
+    StackVisitor::Status operator()(StackVisitor& visitor)
+    {
+        if (!m_foundStartCallFrame && (visitor->callFrame() == m_startCallFrame))
+            m_foundStartCallFrame = true;
+
+        if (m_foundStartCallFrame) {
+            if (visitor->callFrame()->codeBlock()) {
+                m_foundCallFrame = visitor->callFrame();
+                return StackVisitor::Done;
+            }
+            m_index++;
+        }
+
+        return StackVisitor::Continue;
+    }
+
+    CallFrame* foundCallFrame() const { return m_foundCallFrame; }
+    unsigned index() const { return m_index; }
+
+private:
+    CallFrame* m_startCallFrame;
+    CallFrame* m_foundCallFrame;
+    bool m_foundStartCallFrame;
+    unsigned m_index;
+};
+
+void ErrorInstance::finishCreation(ExecState* exec, VM& vm, const String& message, bool useCurrentFrame)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    if (!message.isNull())
+        putDirect(vm, vm.propertyNames->message, jsString(&vm, message), DontEnum);
+
+    unsigned bytecodeOffset = 0;
+    CallFrame* callFrame = nullptr;
+    bool hasTrace = addErrorInfoAndGetBytecodeOffset(exec, vm, this, useCurrentFrame, callFrame, hasSourceAppender() ? &bytecodeOffset : nullptr);
+
+    if (hasTrace && callFrame && hasSourceAppender()) {
+        if (callFrame && callFrame->codeBlock()) 
+            appendSourceToError(callFrame, this, bytecodeOffset);
+    }
+}
+
+// Based on ErrorPrototype's errorProtoFuncToString(), but is modified to
+// have no observable side effects to the user (i.e. does not call proxies,
+// and getters).
+String ErrorInstance::sanitizedToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue nameValue;
+    auto namePropertName = vm.propertyNames->name;
+    PropertySlot nameSlot(this, PropertySlot::InternalMethodType::VMInquiry);
+
+    JSValue currentObj = this;
+    unsigned prototypeDepth = 0;
+
+    // We only check the current object and its prototype (2 levels) because normal
+    // Error objects may have a name property, and if not, its prototype should have
+    // a name property for the type of error e.g. "SyntaxError".
+    while (currentObj.isCell() && prototypeDepth++ < 2) {
+        JSObject* obj = jsCast<JSObject*>(currentObj);
+        if (JSObject::getOwnPropertySlot(obj, exec, namePropertName, nameSlot) && nameSlot.isValue()) {
+            nameValue = nameSlot.getValue(exec, namePropertName);
+            break;
+        }
+        currentObj = obj->getPrototypeDirect();
+    }
+    ASSERT(!scope.exception());
+
+    String nameString;
+    if (!nameValue)
+        nameString = ASCIILiteral("Error");
+    else {
+        nameString = nameValue.toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, String());
+    }
+
+    JSValue messageValue;
+    auto messagePropertName = vm.propertyNames->message;
+    PropertySlot messageSlot(this, PropertySlot::InternalMethodType::VMInquiry);
+    if (JSObject::getOwnPropertySlot(this, exec, messagePropertName, messageSlot) && messageSlot.isValue())
+        messageValue = messageSlot.getValue(exec, messagePropertName);
+    ASSERT(!scope.exception());
+
+    String messageString;
+    if (!messageValue)
+        messageString = String();
+    else {
+        messageString = messageValue.toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, String());
+    }
+
+    if (!nameString.length())
+        return messageString;
+
+    if (!messageString.length())
+        return nameString;
+
+    StringBuilder builder;
+    builder.append(nameString);
+    builder.appendLiteral(": ");
+    builder.append(messageString);
+    return builder.toString();
+}
+
+} // namespace JSC
diff --git a/runtime/ErrorInstance.h b/runtime/ErrorInstance.h
new file mode 100644
index 0000000..732b79a
--- /dev/null
+++ b/runtime/ErrorInstance.h
@@ -0,0 +1,75 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "RuntimeType.h"
+#include "SourceProvider.h"
+
+namespace JSC {
+
+class ErrorInstance : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    enum SourceTextWhereErrorOccurred { FoundExactSource, FoundApproximateSource };
+    typedef String (*SourceAppender) (const String& originalMessage, const String& sourceText, RuntimeType, SourceTextWhereErrorOccurred);
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ErrorInstanceType, StructureFlags), info());
+    }
+
+    static ErrorInstance* create(ExecState* exec, VM& vm, Structure* structure, const String& message, SourceAppender appender = nullptr, RuntimeType type = TypeNothing, bool useCurrentFrame = true)
+    {
+        ErrorInstance* instance = new (NotNull, allocateCell<ErrorInstance>(vm.heap)) ErrorInstance(vm, structure);
+        instance->m_sourceAppender = appender;
+        instance->m_runtimeTypeForCause = type;
+        instance->finishCreation(exec, vm, message, useCurrentFrame);
+        return instance;
+    }
+
+    static ErrorInstance* create(ExecState*, Structure*, JSValue message, SourceAppender = nullptr, RuntimeType = TypeNothing, bool useCurrentFrame = true);
+
+    static void addErrorInfo(ExecState*, VM&, JSObject*, bool = true);
+
+    bool hasSourceAppender() const { return !!m_sourceAppender; }
+    SourceAppender sourceAppender() const { return m_sourceAppender; }
+    void setSourceAppender(SourceAppender appender) { m_sourceAppender = appender; }
+    void clearSourceAppender() { m_sourceAppender = nullptr; }
+    void setRuntimeTypeForCause(RuntimeType type) { m_runtimeTypeForCause = type; }
+    RuntimeType runtimeTypeForCause() const { return m_runtimeTypeForCause; }
+    void clearRuntimeTypeForCause() { m_runtimeTypeForCause = TypeNothing; }
+
+    JS_EXPORT_PRIVATE String sanitizedToString(ExecState*);
+
+protected:
+    explicit ErrorInstance(VM&, Structure*);
+
+    void finishCreation(ExecState*, VM&, const String&, bool useCurrentFrame = true);
+
+    SourceAppender m_sourceAppender { nullptr };
+    RuntimeType m_runtimeTypeForCause { TypeNothing };
+};
+
+} // namespace JSC
diff --git a/runtime/ErrorPrototype.cpp b/runtime/ErrorPrototype.cpp
new file mode 100644
index 0000000..b66a14d
--- /dev/null
+++ b/runtime/ErrorPrototype.cpp
@@ -0,0 +1,128 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "ErrorPrototype.h"
+
+#include "Error.h"
+#include "JSFunction.h"
+#include "JSString.h"
+#include "JSStringBuilder.h"
+#include "ObjectPrototype.h"
+#include "JSCInlines.h"
+#include "StringRecursionChecker.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ErrorPrototype);
+
+static EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState*);
+
+}
+
+#include "ErrorPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo ErrorPrototype::s_info = { "Object", &Base::s_info, &errorPrototypeTable, CREATE_METHOD_TABLE(ErrorPrototype) };
+
+/* Source for ErrorPrototype.lut.h
+@begin errorPrototypeTable
+  toString          errorProtoFuncToString         DontEnum|Function 0
+@end
+*/
+
+ErrorPrototype::ErrorPrototype(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void ErrorPrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirect(vm, vm.propertyNames->name, jsNontrivialString(&vm, String(ASCIILiteral("Error"))), DontEnum);
+    putDirect(vm, vm.propertyNames->message, jsEmptyString(&vm), DontEnum);
+}
+
+// ------------------------------ Functions ---------------------------
+
+// ECMA-262 5.1, 15.11.4.4
+EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. Let O be the this value.
+    JSValue thisValue = exec->thisValue();
+
+    // 2. If Type(O) is not Object, throw a TypeError exception.
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope);
+    JSObject* thisObj = asObject(thisValue);
+
+    // Guard against recursion!
+    StringRecursionChecker checker(exec, thisObj);
+    ASSERT(!scope.exception() || checker.earlyReturnValue());
+    if (JSValue earlyReturnValue = checker.earlyReturnValue())
+        return JSValue::encode(earlyReturnValue);
+
+    // 3. Let name be the result of calling the [[Get]] internal method of O with argument "name".
+    JSValue name = thisObj->get(exec, exec->propertyNames().name);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 4. If name is undefined, then let name be "Error"; else let name be ToString(name).
+    String nameString;
+    if (name.isUndefined())
+        nameString = ASCIILiteral("Error");
+    else {
+        nameString = name.toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    // 5. Let msg be the result of calling the [[Get]] internal method of O with argument "message".
+    JSValue message = thisObj->get(exec, exec->propertyNames().message);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // (sic)
+    // 6. If msg is undefined, then let msg be the empty String; else let msg be ToString(msg).
+    // 7. If msg is undefined, then let msg be the empty String; else let msg be ToString(msg).
+    String messageString;
+    if (message.isUndefined())
+        messageString = String();
+    else {
+        messageString = message.toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    // 8. If name is the empty String, return msg.
+    if (!nameString.length())
+        return JSValue::encode(message.isString() ? message : jsString(exec, messageString));
+
+    // 9. If msg is the empty String, return name.
+    if (!messageString.length())
+        return JSValue::encode(name.isString() ? name : jsString(exec, nameString));
+
+    // 10. Return the result of concatenating name, ":", a single space character, and msg.
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, nameString, ": ", messageString));
+}
+
+} // namespace JSC
diff --git a/runtime/ErrorPrototype.h b/runtime/ErrorPrototype.h
new file mode 100644
index 0000000..2f0b4b6
--- /dev/null
+++ b/runtime/ErrorPrototype.h
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class ObjectPrototype;
+
+class ErrorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static ErrorPrototype* create(VM& vm, JSGlobalObject*, Structure* structure)
+    {
+        ErrorPrototype* prototype = new (NotNull, allocateCell<ErrorPrototype>(vm.heap)) ErrorPrototype(vm, structure);
+        prototype->finishCreation(vm);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ErrorInstanceType, StructureFlags), info());
+    }
+
+protected:
+    ErrorPrototype(VM&, Structure*);
+    void finishCreation(VM&);
+};
+
+} // namespace JSC
diff --git a/runtime/EvalExecutable.cpp b/runtime/EvalExecutable.cpp
new file mode 100644
index 0000000..236b371
--- /dev/null
+++ b/runtime/EvalExecutable.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009, 2010, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "EvalExecutable.h"
+
+#include "EvalCodeBlock.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo EvalExecutable::s_info = { "EvalExecutable", &ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(EvalExecutable) };
+
+EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode& source, bool inStrictContext, DerivedContextType derivedContextType, bool isArrowFunctionContext, EvalContextType evalContextType)
+    : ScriptExecutable(exec->vm().evalExecutableStructure.get(), exec->vm(), source, inStrictContext, derivedContextType, isArrowFunctionContext, evalContextType, NoIntrinsic)
+{
+    ASSERT(source.provider()->sourceType() == SourceProviderSourceType::Program);
+}
+
+void EvalExecutable::destroy(JSCell* cell)
+{
+    static_cast<EvalExecutable*>(cell)->EvalExecutable::~EvalExecutable();
+}
+
+void EvalExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    EvalExecutable* thisObject = jsCast<EvalExecutable*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    ScriptExecutable::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_unlinkedEvalCodeBlock);
+    if (EvalCodeBlock* evalCodeBlock = thisObject->m_evalCodeBlock.get())
+        evalCodeBlock->visitWeakly(visitor);
+}
+
+} // namespace JSC
diff --git a/runtime/EvalExecutable.h b/runtime/EvalExecutable.h
new file mode 100644
index 0000000..a6bab67
--- /dev/null
+++ b/runtime/EvalExecutable.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009, 2010, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ScriptExecutable.h"
+#include "UnlinkedEvalCodeBlock.h"
+
+namespace JSC {
+
+class EvalExecutable : public ScriptExecutable {
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef ScriptExecutable Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static void destroy(JSCell*);
+
+    EvalCodeBlock* codeBlock()
+    {
+        return m_evalCodeBlock.get();
+    }
+
+    PassRefPtr<JITCode> generatedJITCode()
+    {
+        return generatedJITCodeForCall();
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(EvalExecutableType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+    ExecutableInfo executableInfo() const { return ExecutableInfo(usesEval(), isStrictMode(), false, false, ConstructorKind::None, JSParserScriptMode::Classic, SuperBinding::NotNeeded, SourceParseMode::ProgramMode, derivedContextType(), isArrowFunctionContext(), false, evalContextType()); }
+
+    unsigned numVariables() { return m_unlinkedEvalCodeBlock->numVariables(); }
+    unsigned numberOfFunctionDecls() { return m_unlinkedEvalCodeBlock->numberOfFunctionDecls(); }
+
+protected:
+    friend class ExecutableBase;
+    friend class ScriptExecutable;
+
+    using Base::finishCreation;
+    EvalExecutable(ExecState*, const SourceCode&, bool inStrictContext, DerivedContextType, bool isArrowFunctionContext, EvalContextType);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<EvalCodeBlock> m_evalCodeBlock;
+    WriteBarrier<UnlinkedEvalCodeBlock> m_unlinkedEvalCodeBlock;
+};
+
+} // namespace JSC
diff --git a/runtime/Exception.cpp b/runtime/Exception.cpp
new file mode 100644
index 0000000..93175ee
--- /dev/null
+++ b/runtime/Exception.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Exception.h"
+
+#include "Interpreter.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo Exception::s_info = { "Exception", &Base::s_info, 0, CREATE_METHOD_TABLE(Exception) };
+
+Exception* Exception::create(VM& vm, JSValue thrownValue, StackCaptureAction action)
+{
+    Exception* result = new (NotNull, allocateCell<Exception>(vm.heap)) Exception(vm);
+    result->finishCreation(vm, thrownValue, action);
+    return result;
+}
+
+void Exception::destroy(JSCell* cell)
+{
+    Exception* exception = static_cast<Exception*>(cell);
+    exception->~Exception();
+}
+
+Structure* Exception::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void Exception::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    Exception* thisObject = jsCast<Exception*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_value);
+}
+
+Exception::Exception(VM& vm)
+    : Base(vm, vm.exceptionStructure.get())
+{
+}
+
+Exception::~Exception()
+{
+}
+
+void Exception::finishCreation(VM& vm, JSValue thrownValue, StackCaptureAction action)
+{
+    Base::finishCreation(vm);
+
+    m_value.set(vm, this, thrownValue);
+
+    Vector<StackFrame> stackTrace;
+    if (action == StackCaptureAction::CaptureStack)
+        vm.interpreter->getStackTrace(stackTrace);
+    m_stack = WTFMove(stackTrace);
+}
+
+} // namespace JSC
diff --git a/runtime/Exception.h b/runtime/Exception.h
new file mode 100644
index 0000000..55b7957
--- /dev/null
+++ b/runtime/Exception.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "StackFrame.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+    
+class Exception : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = StructureIsImmortal | Base::StructureFlags;
+
+    enum StackCaptureAction {
+        CaptureStack,
+        DoNotCaptureStack
+    };
+    JS_EXPORT_PRIVATE static Exception* create(VM&, JSValue thrownValue, StackCaptureAction = CaptureStack);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    DECLARE_EXPORT_INFO;
+
+    static ptrdiff_t valueOffset()
+    {
+        return OBJECT_OFFSETOF(Exception, m_value);
+    }
+
+    JSValue value() const { return m_value.get(); }
+    const Vector<StackFrame>& stack() const { return m_stack; }
+
+    bool didNotifyInspectorOfThrow() const { return m_didNotifyInspectorOfThrow; }
+    void setDidNotifyInspectorOfThrow() { m_didNotifyInspectorOfThrow = true; }
+
+    ~Exception();
+
+private:
+    Exception(VM&);
+    void finishCreation(VM&, JSValue thrownValue, StackCaptureAction);
+
+    WriteBarrier<Unknown> m_value;
+    Vector<StackFrame> m_stack;
+    bool m_didNotifyInspectorOfThrow { false };
+
+    friend class LLIntOffsetsExtractor;
+};
+
+} // namespace JSC
diff --git a/runtime/ExceptionEventLocation.cpp b/runtime/ExceptionEventLocation.cpp
new file mode 100644
index 0000000..c95d3eb
--- /dev/null
+++ b/runtime/ExceptionEventLocation.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ExceptionEventLocation.h"
+
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+    
+void printInternal(PrintStream& out, JSC::ExceptionEventLocation location)
+{
+    out.print(location.functionName, " @ ", location.file, ":", location.line);
+}
+
+} // namespace WTF
+
diff --git a/runtime/ExceptionEventLocation.h b/runtime/ExceptionEventLocation.h
new file mode 100644
index 0000000..e149b03
--- /dev/null
+++ b/runtime/ExceptionEventLocation.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+struct ExceptionEventLocation {
+    ExceptionEventLocation() { }
+    ExceptionEventLocation(const char* functionName, const char* file, unsigned line)
+        : functionName(functionName)
+        , file(file)
+        , line(line)
+    { }
+    
+    const char* functionName { nullptr };
+    const char* file { nullptr };
+    unsigned line { 0 };
+};
+
+} // namespace JSC
+
+namespace WTF {
+    
+class PrintStream;
+
+void printInternal(PrintStream&, JSC::ExceptionEventLocation);
+    
+} // namespace WTF
diff --git a/runtime/ExceptionFuzz.cpp b/runtime/ExceptionFuzz.cpp
new file mode 100644
index 0000000..d688811
--- /dev/null
+++ b/runtime/ExceptionFuzz.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ExceptionFuzz.h"
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "TestRunnerUtils.h"
+
+namespace JSC {
+
+static unsigned s_numberOfExceptionFuzzChecks;
+unsigned numberOfExceptionFuzzChecks() { return s_numberOfExceptionFuzzChecks; }
+
+// Call this only if you know that exception fuzzing is enabled.
+void doExceptionFuzzing(ExecState* exec, ThrowScope& scope, const char* where, void* returnPC)
+{
+    VM& vm = scope.vm();
+    ASSERT(Options::useExceptionFuzz());
+
+    DeferGCForAWhile deferGC(vm.heap);
+    
+    s_numberOfExceptionFuzzChecks++;
+    
+    unsigned fireTarget = Options::fireExceptionFuzzAt();
+    if (fireTarget == s_numberOfExceptionFuzzChecks) {
+        printf("JSC EXCEPTION FUZZ: Throwing fuzz exception with call frame %p, seen in %s and return address %p.\n", exec, where, returnPC);
+        fflush(stdout);
+
+        // The ThrowScope also checks for unchecked simulated exceptions before throwing a
+        // new exception. This ensures that we don't quietly overwrite a pending exception
+        // (which should never happen with the only exception being to rethrow the same
+        // exception). However, ExceptionFuzz works by intentionally throwing its own exception
+        // even when one may already exist. This is ok for ExceptionFuzz testing, but we need
+        // to placate the exception check verifier here.
+        ASSERT(scope.exception() || !scope.exception());
+
+        throwException(exec, scope, createError(exec, ASCIILiteral("Exception Fuzz")));
+    }
+}
+
+} // namespace JSC
+
+
diff --git a/runtime/ExceptionFuzz.h b/runtime/ExceptionFuzz.h
new file mode 100644
index 0000000..aab07cf
--- /dev/null
+++ b/runtime/ExceptionFuzz.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Options.h"
+
+namespace JSC {
+
+class ExecState;
+class ThrowScope;
+
+// Call this only if you know that exception fuzzing is enabled.
+void doExceptionFuzzing(ExecState*, ThrowScope&, const char* where, void* returnPC);
+
+// This is what you should call if you don't know if fuzzing is enabled.
+ALWAYS_INLINE void doExceptionFuzzingIfEnabled(ExecState* exec, ThrowScope& scope, const char* where, void* returnPC)
+{
+    if (LIKELY(!Options::useExceptionFuzz()))
+        return;
+    doExceptionFuzzing(exec, scope, where, returnPC);
+}
+
+} // namespace JSC
diff --git a/runtime/ExceptionHelpers.cpp b/runtime/ExceptionHelpers.cpp
new file mode 100644
index 0000000..fb67e21
--- /dev/null
+++ b/runtime/ExceptionHelpers.cpp
@@ -0,0 +1,321 @@
+/*
+ * Copyright (C) 2008-2009, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ExceptionHelpers.h"
+
+#include "CodeBlock.h"
+#include "CallFrame.h"
+#include "ErrorHandlingScope.h"
+#include "Exception.h"
+#include "JSGlobalObjectFunctions.h"
+#include "Interpreter.h"
+#include "Nodes.h"
+#include "JSCInlines.h"
+#include "RuntimeType.h"
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringView.h>
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(TerminatedExecutionError);
+
+const ClassInfo TerminatedExecutionError::s_info = { "TerminatedExecutionError", &Base::s_info, 0, CREATE_METHOD_TABLE(TerminatedExecutionError) };
+
+JSValue TerminatedExecutionError::defaultValue(const JSObject*, ExecState* exec, PreferredPrimitiveType hint)
+{
+    if (hint == PreferString)
+        return jsNontrivialString(exec, String(ASCIILiteral("JavaScript execution terminated.")));
+    return JSValue(PNaN);
+}
+
+JSObject* createTerminatedExecutionException(VM* vm)
+{
+    return TerminatedExecutionError::create(*vm);
+}
+
+bool isTerminatedExecutionException(Exception* exception)
+{
+    if (!exception->value().isObject())
+        return false;
+
+    return exception->value().inherits(TerminatedExecutionError::info());
+}
+
+JSObject* createStackOverflowError(ExecState* exec)
+{
+    return createRangeError(exec, ASCIILiteral("Maximum call stack size exceeded."));
+}
+
+JSObject* createUndefinedVariableError(ExecState* exec, const Identifier& ident)
+{
+    if (exec->propertyNames().isPrivateName(ident)) {
+        String message(makeString("Can't find private variable: @", exec->propertyNames().lookUpPublicName(ident).string()));
+        return createReferenceError(exec, message);
+    }
+    String message(makeString("Can't find variable: ", ident.string()));
+    return createReferenceError(exec, message);
+}
+    
+JSString* errorDescriptionForValue(ExecState* exec, JSValue v)
+{
+    if (v.isString())
+        return jsNontrivialString(exec, makeString('"', asString(v)->value(exec), '"'));
+    if (v.isSymbol())
+        return jsNontrivialString(exec, asSymbol(v)->descriptiveString());
+    if (v.isObject()) {
+        CallData callData;
+        JSObject* object = asObject(v);
+        if (object->methodTable()->getCallData(object, callData) != CallType::None)
+            return exec->vm().smallStrings.functionString();
+        return jsString(exec, JSObject::calculatedClassName(object));
+    }
+    return v.toString(exec);
+}
+    
+static String defaultApproximateSourceError(const String& originalMessage, const String& sourceText)
+{
+    return makeString(originalMessage, " (near '...", sourceText, "...')");
+}
+
+String defaultSourceAppender(const String& originalMessage, const String& sourceText, RuntimeType, ErrorInstance::SourceTextWhereErrorOccurred occurrence)
+{
+    if (occurrence == ErrorInstance::FoundApproximateSource)
+        return defaultApproximateSourceError(originalMessage, sourceText);
+
+    ASSERT(occurrence == ErrorInstance::FoundExactSource);
+    return makeString(originalMessage, " (evaluating '", sourceText, "')");
+}
+
+static String functionCallBase(const String& sourceText)
+{ 
+    // This function retrieves the 'foo.bar' substring from 'foo.bar(baz)'.
+    // FIXME: This function has simple processing of /* */ style comments.
+    // It doesn't properly handle embedded comments of string literals that contain
+    // parenthesis or comment constructs, e.g. foo.bar("/abc\)*/").
+    // https://bugs.webkit.org/show_bug.cgi?id=146304
+
+    unsigned sourceLength = sourceText.length();
+    unsigned idx = sourceLength - 1;
+    if (sourceLength < 2 || sourceText[idx] != ')') {
+        // For function calls that have many new lines in between their open parenthesis
+        // and their closing parenthesis, the text range passed into the message appender 
+        // will not inlcude the text in between these parentheses, it will just be the desired
+        // text that precedes the parentheses.
+        return sourceText;
+    }
+
+    unsigned parenStack = 1;
+    bool isInMultiLineComment = false;
+    idx -= 1;
+    // Note that we're scanning text right to left instead of the more common left to right, 
+    // so syntax detection is backwards.
+    while (parenStack > 0) {
+        UChar curChar = sourceText[idx];
+        if (isInMultiLineComment)  {
+            if (idx > 0 && curChar == '*' && sourceText[idx - 1] == '/') {
+                isInMultiLineComment = false;
+                idx -= 1;
+            }
+        } else if (curChar == '(')
+            parenStack -= 1;
+        else if (curChar == ')')
+            parenStack += 1;
+        else if (idx > 0 && curChar == '/' && sourceText[idx - 1] == '*') {
+            isInMultiLineComment = true;
+            idx -= 1;
+        }
+
+        if (!idx)
+            break;
+
+        idx -= 1;
+    }
+
+    return sourceText.left(idx + 1);
+}
+
+static String notAFunctionSourceAppender(const String& originalMessage, const String& sourceText, RuntimeType type, ErrorInstance::SourceTextWhereErrorOccurred occurrence)
+{
+    ASSERT(type != TypeFunction);
+
+    if (occurrence == ErrorInstance::FoundApproximateSource)
+        return defaultApproximateSourceError(originalMessage, sourceText);
+
+    ASSERT(occurrence == ErrorInstance::FoundExactSource);
+    auto notAFunctionIndex = originalMessage.reverseFind("is not a function");
+    RELEASE_ASSERT(notAFunctionIndex != notFound);
+    StringView displayValue;
+    if (originalMessage.is8Bit()) 
+        displayValue = StringView(originalMessage.characters8(), notAFunctionIndex - 1);
+    else
+        displayValue = StringView(originalMessage.characters16(), notAFunctionIndex - 1);
+
+    String base = functionCallBase(sourceText);
+    StringBuilder builder;
+    builder.append(base);
+    builder.appendLiteral(" is not a function. (In '");
+    builder.append(sourceText);
+    builder.appendLiteral("', '");
+    builder.append(base);
+    builder.appendLiteral("' is ");
+    if (type == TypeSymbol)
+        builder.appendLiteral("a Symbol");
+    else {
+        if (type == TypeObject)
+            builder.appendLiteral("an instance of ");
+        builder.append(displayValue);
+    }
+    builder.append(')');
+
+    return builder.toString();
+}
+
+static String invalidParameterInSourceAppender(const String& originalMessage, const String& sourceText, RuntimeType type, ErrorInstance::SourceTextWhereErrorOccurred occurrence)
+{
+    ASSERT_UNUSED(type, type != TypeObject);
+
+    if (occurrence == ErrorInstance::FoundApproximateSource)
+        return defaultApproximateSourceError(originalMessage, sourceText);
+
+    ASSERT(occurrence == ErrorInstance::FoundExactSource);
+    auto inIndex = sourceText.reverseFind("in");
+    RELEASE_ASSERT(inIndex != notFound);
+    if (sourceText.find("in") != inIndex)
+        return makeString(originalMessage, " (evaluating '", sourceText, "')");
+
+    static const unsigned inLength = 2;
+    String rightHandSide = sourceText.substring(inIndex + inLength).simplifyWhiteSpace();
+    return makeString(rightHandSide, " is not an Object. (evaluating '", sourceText, "')");
+}
+
+inline String invalidParameterInstanceofSourceAppender(const String& content, const String& originalMessage, const String& sourceText, RuntimeType, ErrorInstance::SourceTextWhereErrorOccurred occurrence)
+{
+    if (occurrence == ErrorInstance::FoundApproximateSource)
+        return defaultApproximateSourceError(originalMessage, sourceText);
+
+    ASSERT(occurrence == ErrorInstance::FoundExactSource);
+    auto instanceofIndex = sourceText.reverseFind("instanceof");
+    RELEASE_ASSERT(instanceofIndex != notFound);
+    if (sourceText.find("instanceof") != instanceofIndex)
+        return makeString(originalMessage, " (evaluating '", sourceText, "')");
+
+    static const unsigned instanceofLength = 10;
+    String rightHandSide = sourceText.substring(instanceofIndex + instanceofLength).simplifyWhiteSpace();
+    return makeString(rightHandSide, content, ". (evaluating '", sourceText, "')");
+}
+
+static String invalidParameterInstanceofNotFunctionSourceAppender(const String& originalMessage, const String& sourceText, RuntimeType runtimeType, ErrorInstance::SourceTextWhereErrorOccurred occurrence)
+{
+    return invalidParameterInstanceofSourceAppender(WTF::makeString(" is not a function"), originalMessage, sourceText, runtimeType, occurrence);
+}
+
+static String invalidParameterInstanceofhasInstanceValueNotFunctionSourceAppender(const String& originalMessage, const String& sourceText, RuntimeType runtimeType, ErrorInstance::SourceTextWhereErrorOccurred occurrence)
+{
+    return invalidParameterInstanceofSourceAppender(WTF::makeString("[Symbol.hasInstance] is not a function, undefined, or null"), originalMessage, sourceText, runtimeType, occurrence);
+}
+
+JSObject* createError(ExecState* exec, JSValue value, const String& message, ErrorInstance::SourceAppender appender)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    String errorMessage = makeString(errorDescriptionForValue(exec, value)->value(exec), ' ', message);
+    ASSERT_UNUSED(scope, !scope.exception());
+    JSObject* exception = createTypeError(exec, errorMessage, appender, runtimeTypeForValue(value));
+    ASSERT(exception->isErrorInstance());
+    return exception;
+}
+
+JSObject* createInvalidFunctionApplyParameterError(ExecState* exec, JSValue value)
+{
+    JSObject* exception = createTypeError(exec, makeString("second argument to Function.prototype.apply must be an Array-like object"), defaultSourceAppender, runtimeTypeForValue(value));
+    ASSERT(exception->isErrorInstance());
+    return exception;
+}
+
+JSObject* createInvalidInParameterError(ExecState* exec, JSValue value)
+{
+    return createError(exec, value, makeString("is not an Object."), invalidParameterInSourceAppender);
+}
+
+JSObject* createInvalidInstanceofParameterErrorNotFunction(ExecState* exec, JSValue value)
+{
+    return createError(exec, value, makeString(" is not a function"), invalidParameterInstanceofNotFunctionSourceAppender);
+}
+
+JSObject* createInvalidInstanceofParameterErrorhasInstanceValueNotFunction(ExecState* exec, JSValue value)
+{
+    return createError(exec, value, makeString("[Symbol.hasInstance] is not a function, undefined, or null"), invalidParameterInstanceofhasInstanceValueNotFunctionSourceAppender);
+}
+
+JSObject* createNotAConstructorError(ExecState* exec, JSValue value)
+{
+    return createError(exec, value, ASCIILiteral("is not a constructor"), defaultSourceAppender);
+}
+
+JSObject* createNotAFunctionError(ExecState* exec, JSValue value)
+{
+    return createError(exec, value, ASCIILiteral("is not a function"), notAFunctionSourceAppender);
+}
+
+JSObject* createNotAnObjectError(ExecState* exec, JSValue value)
+{
+    return createError(exec, value, ASCIILiteral("is not an object"), defaultSourceAppender);
+}
+
+JSObject* createErrorForInvalidGlobalAssignment(ExecState* exec, const String& propertyName)
+{
+    return createReferenceError(exec, makeString("Strict mode forbids implicit creation of global property '", propertyName, '\''));
+}
+
+JSObject* createTDZError(ExecState* exec)
+{
+    return createReferenceError(exec, "Cannot access uninitialized variable.");
+}
+
+JSObject* throwOutOfMemoryError(ExecState* exec, ThrowScope& scope)
+{
+    return throwException(exec, scope, createOutOfMemoryError(exec));
+}
+
+JSObject* throwStackOverflowError(ExecState* exec, ThrowScope& scope)
+{
+    VM& vm = exec->vm();
+    ErrorHandlingScope errorScope(vm);
+    return throwException(exec, scope, createStackOverflowError(exec));
+}
+
+JSObject* throwTerminatedExecutionException(ExecState* exec, ThrowScope& scope)
+{
+    VM& vm = exec->vm();
+    ErrorHandlingScope errorScope(vm);
+    return throwException(exec, scope, createTerminatedExecutionException(&vm));
+}
+
+} // namespace JSC
diff --git a/runtime/ExceptionHelpers.h b/runtime/ExceptionHelpers.h
new file mode 100644
index 0000000..ec05294
--- /dev/null
+++ b/runtime/ExceptionHelpers.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CatchScope.h"
+#include "ErrorInstance.h"
+#include "JSObject.h"
+#include "ThrowScope.h"
+
+namespace JSC {
+
+typedef JSObject* (*ErrorFactory)(ExecState*, const String&, ErrorInstance::SourceAppender);
+
+String defaultSourceAppender(const String&, const String&, RuntimeType, ErrorInstance::SourceTextWhereErrorOccurred);
+
+JSObject* createTerminatedExecutionException(VM*);
+JS_EXPORT_PRIVATE bool isTerminatedExecutionException(Exception*);
+JS_EXPORT_PRIVATE JSObject* createError(ExecState*, JSValue, const String&, ErrorInstance::SourceAppender);
+JS_EXPORT_PRIVATE JSObject* createStackOverflowError(ExecState*);
+JSObject* createUndefinedVariableError(ExecState*, const Identifier&);
+JSObject* createTDZError(ExecState*);
+JSObject* createNotAnObjectError(ExecState*, JSValue);
+JSObject* createInvalidFunctionApplyParameterError(ExecState*, JSValue);
+JSObject* createInvalidInParameterError(ExecState*, JSValue);
+JSObject* createInvalidInstanceofParameterErrorNotFunction(ExecState*, JSValue);
+JSObject* createInvalidInstanceofParameterErrorhasInstanceValueNotFunction(ExecState*, JSValue);
+JSObject* createNotAConstructorError(ExecState*, JSValue);
+JSObject* createNotAFunctionError(ExecState*, JSValue);
+JSObject* createErrorForInvalidGlobalAssignment(ExecState*, const String&);
+JSString* errorDescriptionForValue(ExecState*, JSValue);
+
+JS_EXPORT_PRIVATE JSObject* throwOutOfMemoryError(ExecState*, ThrowScope&);
+JS_EXPORT_PRIVATE JSObject* throwStackOverflowError(ExecState*, ThrowScope&);
+JS_EXPORT_PRIVATE JSObject* throwTerminatedExecutionException(ExecState*, ThrowScope&);
+
+
+class TerminatedExecutionError final : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static TerminatedExecutionError* create(VM& vm)
+    {
+        TerminatedExecutionError* error = new (NotNull, allocateCell<TerminatedExecutionError>(vm.heap)) TerminatedExecutionError(vm);
+        error->finishCreation(vm);
+        return error;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+
+private:
+    explicit TerminatedExecutionError(VM& vm)
+        : JSNonFinalObject(vm, vm.terminatedExecutionErrorStructure.get())
+    {
+    }
+
+    static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
+
+};
+
+} // namespace JSC
diff --git a/runtime/ExceptionScope.cpp b/runtime/ExceptionScope.cpp
new file mode 100644
index 0000000..0a86a39
--- /dev/null
+++ b/runtime/ExceptionScope.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ExceptionScope.h"
+
+#include "Exception.h"
+
+namespace JSC {
+    
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    
+ExceptionScope::ExceptionScope(VM& vm, ExceptionEventLocation location)
+    : m_vm(vm)
+    , m_previousScope(vm.m_topExceptionScope)
+    , m_location(location)
+    , m_recursionDepth(m_previousScope ? m_previousScope->m_recursionDepth + 1 : 0)
+{
+    m_vm.m_topExceptionScope = this;
+}
+
+ExceptionScope::~ExceptionScope()
+{
+    RELEASE_ASSERT(m_vm.m_topExceptionScope);
+    m_vm.m_topExceptionScope = m_previousScope;
+}
+
+#endif // ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    
+} // namespace JSC
diff --git a/runtime/ExceptionScope.h b/runtime/ExceptionScope.h
new file mode 100644
index 0000000..583a040
--- /dev/null
+++ b/runtime/ExceptionScope.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "VM.h"
+
+namespace JSC {
+    
+class Exception;
+    
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    
+class ExceptionScope {
+public:
+    VM& vm() const { return m_vm; }
+    unsigned recursionDepth() const { return m_recursionDepth; }
+    Exception* exception() { return m_vm.exception(); }
+    
+protected:
+    ExceptionScope(VM&, ExceptionEventLocation);
+    ExceptionScope(const ExceptionScope&) = delete;
+    ExceptionScope(ExceptionScope&&) = default;
+    ~ExceptionScope();
+
+    VM& m_vm;
+    ExceptionScope* m_previousScope;
+    ExceptionEventLocation m_location;
+    unsigned m_recursionDepth;
+};
+    
+#else // not ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    
+class ExceptionScope {
+public:
+    ALWAYS_INLINE VM& vm() const { return m_vm; }
+    ALWAYS_INLINE Exception* exception() { return m_vm.exception(); }
+
+protected:
+    ALWAYS_INLINE ExceptionScope(VM& vm)
+        : m_vm(vm)
+    { }
+    ExceptionScope(const ExceptionScope&) = delete;
+    ExceptionScope(ExceptionScope&&) = default;
+
+    VM& m_vm;
+};
+    
+#endif // ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+
+#define RETURN_IF_EXCEPTION(scope__, value__) do { \
+        if (UNLIKELY((scope__).exception())) \
+            return value__; \
+    } while (false)
+
+} // namespace JSC
diff --git a/runtime/ExecutableBase.cpp b/runtime/ExecutableBase.cpp
new file mode 100644
index 0000000..73f1ac5
--- /dev/null
+++ b/runtime/ExecutableBase.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2009, 2010, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "BatchedTransitionOptimizer.h"
+#include "CodeBlock.h"
+#include "Debugger.h"
+#include "EvalCodeBlock.h"
+#include "FunctionCodeBlock.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "LLIntEntrypoint.h"
+#include "ModuleProgramCodeBlock.h"
+#include "Parser.h"
+#include "ProgramCodeBlock.h"
+#include "TypeProfiler.h"
+#include "VMInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+const ClassInfo ExecutableBase::s_info = { "Executable", 0, 0, CREATE_METHOD_TABLE(ExecutableBase) };
+
+void ExecutableBase::destroy(JSCell* cell)
+{
+    static_cast<ExecutableBase*>(cell)->ExecutableBase::~ExecutableBase();
+}
+
+void ExecutableBase::clearCode()
+{
+#if ENABLE(JIT)
+    m_jitCodeForCall = nullptr;
+    m_jitCodeForConstruct = nullptr;
+    m_jitCodeForCallWithArityCheck = MacroAssemblerCodePtr();
+    m_jitCodeForConstructWithArityCheck = MacroAssemblerCodePtr();
+#endif
+    m_numParametersForCall = NUM_PARAMETERS_NOT_COMPILED;
+    m_numParametersForConstruct = NUM_PARAMETERS_NOT_COMPILED;
+
+    if (structure()->classInfo() == FunctionExecutable::info()) {
+        FunctionExecutable* executable = static_cast<FunctionExecutable*>(this);
+        executable->m_codeBlockForCall.clear();
+        executable->m_codeBlockForConstruct.clear();
+        return;
+    }
+
+    if (structure()->classInfo() == EvalExecutable::info()) {
+        EvalExecutable* executable = static_cast<EvalExecutable*>(this);
+        executable->m_evalCodeBlock.clear();
+        executable->m_unlinkedEvalCodeBlock.clear();
+        return;
+    }
+    
+    if (structure()->classInfo() == ProgramExecutable::info()) {
+        ProgramExecutable* executable = static_cast<ProgramExecutable*>(this);
+        executable->m_programCodeBlock.clear();
+        executable->m_unlinkedProgramCodeBlock.clear();
+        return;
+    }
+
+    if (structure()->classInfo() == ModuleProgramExecutable::info()) {
+        ModuleProgramExecutable* executable = static_cast<ModuleProgramExecutable*>(this);
+        executable->m_moduleProgramCodeBlock.clear();
+        executable->m_unlinkedModuleProgramCodeBlock.clear();
+        executable->m_moduleEnvironmentSymbolTable.clear();
+        return;
+    }
+    
+    ASSERT(structure()->classInfo() == NativeExecutable::info());
+}
+
+void ExecutableBase::dump(PrintStream& out) const
+{
+    ExecutableBase* realThis = const_cast<ExecutableBase*>(this);
+    
+    if (classInfo() == NativeExecutable::info()) {
+        NativeExecutable* native = jsCast<NativeExecutable*>(realThis);
+        out.print("NativeExecutable:", RawPointer(bitwise_cast<void*>(native->function())), "/", RawPointer(bitwise_cast<void*>(native->constructor())));
+        return;
+    }
+    
+    if (classInfo() == EvalExecutable::info()) {
+        EvalExecutable* eval = jsCast<EvalExecutable*>(realThis);
+        if (CodeBlock* codeBlock = eval->codeBlock())
+            out.print(*codeBlock);
+        else
+            out.print("EvalExecutable w/o CodeBlock");
+        return;
+    }
+    
+    if (classInfo() == ProgramExecutable::info()) {
+        ProgramExecutable* eval = jsCast<ProgramExecutable*>(realThis);
+        if (CodeBlock* codeBlock = eval->codeBlock())
+            out.print(*codeBlock);
+        else
+            out.print("ProgramExecutable w/o CodeBlock");
+        return;
+    }
+
+    if (classInfo() == ModuleProgramExecutable::info()) {
+        ModuleProgramExecutable* executable = jsCast<ModuleProgramExecutable*>(realThis);
+        if (CodeBlock* codeBlock = executable->codeBlock())
+            out.print(*codeBlock);
+        else
+            out.print("ModuleProgramExecutable w/o CodeBlock");
+        return;
+    }
+    
+    FunctionExecutable* function = jsCast<FunctionExecutable*>(realThis);
+    if (!function->eitherCodeBlock())
+        out.print("FunctionExecutable w/o CodeBlock");
+    else {
+        CommaPrinter comma("/");
+        if (function->codeBlockForCall())
+            out.print(comma, *function->codeBlockForCall());
+        if (function->codeBlockForConstruct())
+            out.print(comma, *function->codeBlockForConstruct());
+    }
+}
+
+CodeBlockHash ExecutableBase::hashFor(CodeSpecializationKind kind) const
+{
+    if (this->classInfo() == NativeExecutable::info())
+        return jsCast<const NativeExecutable*>(this)->hashFor(kind);
+    
+    return jsCast<const ScriptExecutable*>(this)->hashFor(kind);
+}
+
+} // namespace JSC
diff --git a/runtime/ExecutableBase.h b/runtime/ExecutableBase.h
new file mode 100644
index 0000000..5d1e0b4
--- /dev/null
+++ b/runtime/ExecutableBase.h
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2009, 2010, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArityCheckMode.h"
+#include "CallData.h"
+#include "CodeBlockHash.h"
+#include "CodeSpecializationKind.h"
+#include "CompilationResult.h"
+#include "ExecutableInfo.h"
+#include "HandlerInfo.h"
+#include "InferredValue.h"
+#include "JITCode.h"
+#include "JSGlobalObject.h"
+#include "SourceCode.h"
+#include "TypeSet.h"
+#include "UnlinkedCodeBlock.h"
+#include "UnlinkedFunctionExecutable.h"
+
+namespace JSC {
+
+class CodeBlock;
+class EvalCodeBlock;
+class FunctionCodeBlock;
+class JSScope;
+class JSWebAssemblyModule;
+class LLIntOffsetsExtractor;
+class ModuleProgramCodeBlock;
+class ProgramCodeBlock;
+
+enum CompilationKind { FirstCompilation, OptimizingCompilation };
+
+inline bool isCall(CodeSpecializationKind kind)
+{
+    if (kind == CodeForCall)
+        return true;
+    ASSERT(kind == CodeForConstruct);
+    return false;
+}
+
+class ExecutableBase : public JSCell {
+    friend class JIT;
+
+protected:
+    static const int NUM_PARAMETERS_IS_HOST = 0;
+    static const int NUM_PARAMETERS_NOT_COMPILED = -1;
+
+    ExecutableBase(VM& vm, Structure* structure, int numParameters, Intrinsic intrinsic)
+        : JSCell(vm, structure)
+        , m_numParametersForCall(numParameters)
+        , m_numParametersForConstruct(numParameters)
+        , m_intrinsic(intrinsic)
+    {
+    }
+
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+    }
+
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+        
+    CodeBlockHash hashFor(CodeSpecializationKind) const;
+
+    bool isEvalExecutable() const
+    {
+        return type() == EvalExecutableType;
+    }
+    bool isFunctionExecutable() const
+    {
+        return type() == FunctionExecutableType;
+    }
+    bool isProgramExecutable() const
+    {
+        return type() == ProgramExecutableType;
+    }
+    bool isModuleProgramExecutable()
+    {
+        return type() == ModuleProgramExecutableType;
+    }
+
+
+    bool isHostFunction() const
+    {
+        ASSERT((m_numParametersForCall == NUM_PARAMETERS_IS_HOST) == (m_numParametersForConstruct == NUM_PARAMETERS_IS_HOST));
+        return m_numParametersForCall == NUM_PARAMETERS_IS_HOST;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info()); }
+        
+    void clearCode();
+
+    DECLARE_EXPORT_INFO;
+
+protected:
+    int m_numParametersForCall;
+    int m_numParametersForConstruct;
+
+public:
+    PassRefPtr<JITCode> generatedJITCodeForCall()
+    {
+        ASSERT(m_jitCodeForCall);
+        return m_jitCodeForCall;
+    }
+
+    PassRefPtr<JITCode> generatedJITCodeForConstruct()
+    {
+        ASSERT(m_jitCodeForConstruct);
+        return m_jitCodeForConstruct;
+    }
+        
+    PassRefPtr<JITCode> generatedJITCodeFor(CodeSpecializationKind kind)
+    {
+        if (kind == CodeForCall)
+            return generatedJITCodeForCall();
+        ASSERT(kind == CodeForConstruct);
+        return generatedJITCodeForConstruct();
+    }
+    
+    MacroAssemblerCodePtr entrypointFor(CodeSpecializationKind kind, ArityCheckMode arity)
+    {
+        // Check if we have a cached result. We only have it for arity check because we use the
+        // no-arity entrypoint in non-virtual calls, which will "cache" this value directly in
+        // machine code.
+        if (arity == MustCheckArity) {
+            switch (kind) {
+            case CodeForCall:
+                if (MacroAssemblerCodePtr result = m_jitCodeForCallWithArityCheck)
+                    return result;
+                break;
+            case CodeForConstruct:
+                if (MacroAssemblerCodePtr result = m_jitCodeForConstructWithArityCheck)
+                    return result;
+                break;
+            }
+        }
+        MacroAssemblerCodePtr result =
+            generatedJITCodeFor(kind)->addressForCall(arity);
+        if (arity == MustCheckArity) {
+            // Cache the result; this is necessary for the JIT's virtual call optimizations.
+            switch (kind) {
+            case CodeForCall:
+                m_jitCodeForCallWithArityCheck = result;
+                break;
+            case CodeForConstruct:
+                m_jitCodeForConstructWithArityCheck = result;
+                break;
+            }
+        }
+        return result;
+    }
+
+    static ptrdiff_t offsetOfJITCodeWithArityCheckFor(
+        CodeSpecializationKind kind)
+    {
+        switch (kind) {
+        case CodeForCall:
+            return OBJECT_OFFSETOF(ExecutableBase, m_jitCodeForCallWithArityCheck);
+        case CodeForConstruct:
+            return OBJECT_OFFSETOF(ExecutableBase, m_jitCodeForConstructWithArityCheck);
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+    
+    static ptrdiff_t offsetOfNumParametersFor(CodeSpecializationKind kind)
+    {
+        if (kind == CodeForCall)
+            return OBJECT_OFFSETOF(ExecutableBase, m_numParametersForCall);
+        ASSERT(kind == CodeForConstruct);
+        return OBJECT_OFFSETOF(ExecutableBase, m_numParametersForConstruct);
+    }
+
+    bool hasJITCodeForCall() const
+    {
+        return m_numParametersForCall >= 0;
+    }
+        
+    bool hasJITCodeForConstruct() const
+    {
+        return m_numParametersForConstruct >= 0;
+    }
+        
+    bool hasJITCodeFor(CodeSpecializationKind kind) const
+    {
+        if (kind == CodeForCall)
+            return hasJITCodeForCall();
+        ASSERT(kind == CodeForConstruct);
+        return hasJITCodeForConstruct();
+    }
+
+    // Intrinsics are only for calls, currently.
+    Intrinsic intrinsic() const { return m_intrinsic; }
+        
+    Intrinsic intrinsicFor(CodeSpecializationKind kind) const
+    {
+        if (isCall(kind))
+            return intrinsic();
+        return NoIntrinsic;
+    }
+    
+    void dump(PrintStream&) const;
+        
+protected:
+    Intrinsic m_intrinsic;
+    RefPtr<JITCode> m_jitCodeForCall;
+    RefPtr<JITCode> m_jitCodeForConstruct;
+    MacroAssemblerCodePtr m_jitCodeForCallWithArityCheck;
+    MacroAssemblerCodePtr m_jitCodeForConstructWithArityCheck;
+};
+
+} // namespace JSC
diff --git a/runtime/Float32Array.h b/runtime/Float32Array.h
new file mode 100644
index 0000000..4521be5
--- /dev/null
+++ b/runtime/Float32Array.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Float32Array;
diff --git a/runtime/Float64Array.h b/runtime/Float64Array.h
new file mode 100644
index 0000000..0e2fcef
--- /dev/null
+++ b/runtime/Float64Array.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Float64Array;
diff --git a/runtime/FunctionConstructor.cpp b/runtime/FunctionConstructor.cpp
new file mode 100644
index 0000000..11e5331
--- /dev/null
+++ b/runtime/FunctionConstructor.cpp
@@ -0,0 +1,176 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003-2008, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "FunctionConstructor.h"
+
+#include "ExceptionHelpers.h"
+#include "FunctionPrototype.h"
+#include "JSAsyncFunction.h"
+#include "JSFunction.h"
+#include "JSGeneratorFunction.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(FunctionConstructor);
+
+const ClassInfo FunctionConstructor::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(FunctionConstructor) };
+
+FunctionConstructor::FunctionConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void FunctionConstructor::finishCreation(VM& vm, FunctionPrototype* functionPrototype)
+{
+    Base::finishCreation(vm, functionPrototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, functionPrototype, DontEnum | DontDelete | ReadOnly);
+
+    // Number of arguments for constructor
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructWithFunctionConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->jsCallee())->globalObject(), args, FunctionConstructionMode::Function, exec->newTarget()));
+}
+
+ConstructType FunctionConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWithFunctionConstructor;
+    return ConstructType::Host;
+}
+
+static EncodedJSValue JSC_HOST_CALL callFunctionConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->jsCallee())->globalObject(), args));
+}
+
+// ECMA 15.3.1 The Function Constructor Called as a Function
+CallType FunctionConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callFunctionConstructor;
+    return CallType::Host;
+}
+
+// ECMA 15.3.2 The Function Constructor
+JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const String& sourceURL, const TextPosition& position, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!globalObject->evalEnabled())
+        return throwException(exec, scope, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
+    scope.release();
+    return constructFunctionSkippingEvalEnabledCheck(exec, globalObject, args, functionName, sourceURL, position, -1, functionConstructionMode, newTarget);
+}
+
+JSObject* constructFunctionSkippingEvalEnabledCheck(
+    ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, 
+    const Identifier& functionName, const String& sourceURL, 
+    const TextPosition& position, int overrideLineNumber, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    const char* prefix = nullptr;
+    Structure* structure = nullptr;
+    switch (functionConstructionMode) {
+    case FunctionConstructionMode::Function:
+        structure = globalObject->functionStructure();
+        prefix = "{function ";
+        break;
+    case FunctionConstructionMode::Generator:
+        structure = globalObject->generatorFunctionStructure();
+        prefix = "{function *";
+        break;
+    case FunctionConstructionMode::Async:
+        structure = globalObject->asyncFunctionStructure();
+        prefix = "{async function ";
+        break;
+    }
+
+    // How we stringify functions is sometimes important for web compatibility.
+    // See https://bugs.webkit.org/show_bug.cgi?id=24350.
+    String program;
+    if (args.isEmpty())
+        program = makeString(prefix, functionName.string(), "() {\n\n}}");
+    else if (args.size() == 1) {
+        auto body = args.at(0).toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        program = makeString(prefix, functionName.string(), "() {\n", body, "\n}}");
+    } else {
+        StringBuilder builder;
+        builder.append(prefix);
+        builder.append(functionName.string());
+        builder.append('(');
+        auto viewWithString = args.at(0).toString(exec)->viewWithUnderlyingString(*exec);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        builder.append(viewWithString.view);
+        for (size_t i = 1; i < args.size() - 1; i++) {
+            builder.appendLiteral(", ");
+            auto viewWithString = args.at(i).toString(exec)->viewWithUnderlyingString(*exec);
+            RETURN_IF_EXCEPTION(scope, nullptr);
+            builder.append(viewWithString.view);
+        }
+        builder.appendLiteral(") {\n");
+        viewWithString = args.at(args.size() - 1).toString(exec)->viewWithUnderlyingString(*exec);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        builder.append(viewWithString.view);
+        builder.appendLiteral("\n}}");
+        program = builder.toString();
+    }
+
+    SourceCode source = makeSource(program, sourceURL, position);
+    JSObject* exception = nullptr;
+    FunctionExecutable* function = FunctionExecutable::fromGlobalCode(functionName, *exec, source, exception, overrideLineNumber);
+    if (!function) {
+        ASSERT(exception);
+        return throwException(exec, scope, exception);
+    }
+
+    Structure* subclassStructure = InternalFunction::createSubclassStructure(exec, newTarget, structure);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    switch (functionConstructionMode) {
+    case FunctionConstructionMode::Function:
+        return JSFunction::create(vm, function, globalObject->globalScope(), subclassStructure);
+    case FunctionConstructionMode::Generator:
+        return JSGeneratorFunction::create(vm, function, globalObject->globalScope(), subclassStructure);
+    case FunctionConstructionMode::Async:
+        return JSAsyncFunction::create(vm, function, globalObject->globalScope(), subclassStructure);
+    }
+
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+// ECMA 15.3.2 The Function Constructor
+JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
+{
+    return constructFunction(exec, globalObject, args, exec->propertyNames().anonymous, String(), TextPosition(), functionConstructionMode, newTarget);
+}
+
+} // namespace JSC
diff --git a/runtime/FunctionConstructor.h b/runtime/FunctionConstructor.h
new file mode 100644
index 0000000..deee9a5
--- /dev/null
+++ b/runtime/FunctionConstructor.h
@@ -0,0 +1,72 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace WTF {
+class TextPosition;
+}
+
+namespace JSC {
+
+class FunctionPrototype;
+
+class FunctionConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static FunctionConstructor* create(VM& vm, Structure* structure, FunctionPrototype* functionPrototype)
+    {
+        FunctionConstructor* constructor = new (NotNull, allocateCell<FunctionConstructor>(vm.heap)) FunctionConstructor(vm, structure);
+        constructor->finishCreation(vm, functionPrototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    { 
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+private:
+    FunctionConstructor(VM&, Structure*);
+    void finishCreation(VM&, FunctionPrototype*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+enum class FunctionConstructionMode {
+    Function,
+    Generator,
+    Async,
+};
+
+JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&, const Identifier& functionName, const String& sourceURL, const WTF::TextPosition&, FunctionConstructionMode = FunctionConstructionMode::Function, JSValue newTarget = JSValue());
+JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&, FunctionConstructionMode = FunctionConstructionMode::Function, JSValue newTarget = JSValue());
+
+JS_EXPORT_PRIVATE JSObject* constructFunctionSkippingEvalEnabledCheck(
+    ExecState*, JSGlobalObject*, const ArgList&, const Identifier&, 
+    const String&, const WTF::TextPosition&, int overrideLineNumber = -1,
+    FunctionConstructionMode = FunctionConstructionMode::Function, JSValue newTarget = JSValue());
+
+} // namespace JSC
diff --git a/runtime/FunctionExecutable.cpp b/runtime/FunctionExecutable.cpp
new file mode 100644
index 0000000..13bf1d5
--- /dev/null
+++ b/runtime/FunctionExecutable.cpp
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2009, 2010, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "BatchedTransitionOptimizer.h"
+#include "CodeBlock.h"
+#include "Debugger.h"
+#include "FunctionCodeBlock.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "LLIntEntrypoint.h"
+#include "Parser.h"
+#include "TypeProfiler.h"
+#include "VMInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+const ClassInfo FunctionExecutable::s_info = { "FunctionExecutable", &ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(FunctionExecutable) };
+
+FunctionExecutable::FunctionExecutable(VM& vm, const SourceCode& source, UnlinkedFunctionExecutable* unlinkedExecutable, unsigned lastLine, unsigned endColumn, Intrinsic intrinsic)
+    : ScriptExecutable(vm.functionExecutableStructure.get(), vm, source, unlinkedExecutable->isInStrictContext(), unlinkedExecutable->derivedContextType(), false, EvalContextType::None, intrinsic)
+    , m_unlinkedExecutable(vm, this, unlinkedExecutable)
+{
+    RELEASE_ASSERT(!source.isNull());
+    ASSERT(source.length());
+    m_lastLine = lastLine;
+    ASSERT(endColumn != UINT_MAX);
+    m_endColumn = endColumn;
+    m_parametersStartOffset = unlinkedExecutable->parametersStartOffset();
+    m_typeProfilingStartOffset = unlinkedExecutable->typeProfilingStartOffset();
+    m_typeProfilingEndOffset = unlinkedExecutable->typeProfilingEndOffset();
+}
+
+void FunctionExecutable::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    m_singletonFunction.set(vm, this, InferredValue::create(vm));
+}
+
+void FunctionExecutable::destroy(JSCell* cell)
+{
+    static_cast<FunctionExecutable*>(cell)->FunctionExecutable::~FunctionExecutable();
+}
+
+FunctionCodeBlock* FunctionExecutable::baselineCodeBlockFor(CodeSpecializationKind kind)
+{
+    FunctionCodeBlock* result;
+    if (kind == CodeForCall)
+        result = m_codeBlockForCall.get();
+    else {
+        RELEASE_ASSERT(kind == CodeForConstruct);
+        result = m_codeBlockForConstruct.get();
+    }
+    if (!result)
+        return 0;
+    return static_cast<FunctionCodeBlock*>(result->baselineAlternative());
+}
+
+void FunctionExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    FunctionExecutable* thisObject = jsCast<FunctionExecutable*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    ScriptExecutable::visitChildren(thisObject, visitor);
+    if (FunctionCodeBlock* codeBlockForCall = thisObject->m_codeBlockForCall.get())
+        codeBlockForCall->visitWeakly(visitor);
+    if (FunctionCodeBlock* codeBlockForConstruct = thisObject->m_codeBlockForConstruct.get())
+        codeBlockForConstruct->visitWeakly(visitor);
+    visitor.append(thisObject->m_unlinkedExecutable);
+    visitor.append(thisObject->m_singletonFunction);
+}
+
+FunctionExecutable* FunctionExecutable::fromGlobalCode(
+    const Identifier& name, ExecState& exec, const SourceCode& source, 
+    JSObject*& exception, int overrideLineNumber)
+{
+    UnlinkedFunctionExecutable* unlinkedExecutable = 
+        UnlinkedFunctionExecutable::fromGlobalCode(
+            name, exec, source, exception, overrideLineNumber);
+    if (!unlinkedExecutable)
+        return nullptr;
+
+    return unlinkedExecutable->link(exec.vm(), source, overrideLineNumber);
+}
+
+} // namespace JSC
diff --git a/runtime/FunctionExecutable.h b/runtime/FunctionExecutable.h
new file mode 100644
index 0000000..e774b55
--- /dev/null
+++ b/runtime/FunctionExecutable.h
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2009, 2010, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ScriptExecutable.h"
+
+namespace JSC {
+
+class FunctionExecutable final : public ScriptExecutable {
+    friend class JIT;
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef ScriptExecutable Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static FunctionExecutable* create(
+        VM& vm, const SourceCode& source, UnlinkedFunctionExecutable* unlinkedExecutable, 
+        unsigned lastLine, unsigned endColumn, Intrinsic intrinsic)
+    {
+        FunctionExecutable* executable = new (NotNull, allocateCell<FunctionExecutable>(vm.heap)) FunctionExecutable(vm, source, unlinkedExecutable, lastLine, endColumn, intrinsic);
+        executable->finishCreation(vm);
+        return executable;
+    }
+    static FunctionExecutable* fromGlobalCode(
+        const Identifier& name, ExecState&, const SourceCode&, 
+        JSObject*& exception, int overrideLineNumber);
+
+    static void destroy(JSCell*);
+        
+    UnlinkedFunctionExecutable* unlinkedExecutable() const
+    {
+        return m_unlinkedExecutable.get();
+    }
+
+    // Returns either call or construct bytecode. This can be appropriate
+    // for answering questions that that don't vary between call and construct --
+    // for example, argumentsRegister().
+    FunctionCodeBlock* eitherCodeBlock()
+    {
+        if (m_codeBlockForCall)
+            return m_codeBlockForCall.get();
+        return m_codeBlockForConstruct.get();
+    }
+        
+    bool isGeneratedForCall() const
+    {
+        return !!m_codeBlockForCall;
+    }
+
+    FunctionCodeBlock* codeBlockForCall()
+    {
+        return m_codeBlockForCall.get();
+    }
+
+    bool isGeneratedForConstruct() const
+    {
+        return m_codeBlockForConstruct.get();
+    }
+
+    FunctionCodeBlock* codeBlockForConstruct()
+    {
+        return m_codeBlockForConstruct.get();
+    }
+        
+    bool isGeneratedFor(CodeSpecializationKind kind)
+    {
+        if (kind == CodeForCall)
+            return isGeneratedForCall();
+        ASSERT(kind == CodeForConstruct);
+        return isGeneratedForConstruct();
+    }
+        
+    FunctionCodeBlock* codeBlockFor(CodeSpecializationKind kind)
+    {
+        if (kind == CodeForCall)
+            return codeBlockForCall();
+        ASSERT(kind == CodeForConstruct);
+        return codeBlockForConstruct();
+    }
+
+    FunctionCodeBlock* baselineCodeBlockFor(CodeSpecializationKind);
+        
+    FunctionCodeBlock* profiledCodeBlockFor(CodeSpecializationKind kind)
+    {
+        return baselineCodeBlockFor(kind);
+    }
+
+    RefPtr<TypeSet> returnStatementTypeSet() 
+    {
+        if (!m_returnStatementTypeSet)
+            m_returnStatementTypeSet = TypeSet::create();
+
+        return m_returnStatementTypeSet;
+    }
+        
+    FunctionMode functionMode() { return m_unlinkedExecutable->functionMode(); }
+    bool isBuiltinFunction() const { return m_unlinkedExecutable->isBuiltinFunction(); }
+    ConstructAbility constructAbility() const { return m_unlinkedExecutable->constructAbility(); }
+    bool isClass() const { return !classSource().isNull(); }
+    bool isArrowFunction() const { return parseMode() == SourceParseMode::ArrowFunctionMode; }
+    bool isGetter() const { return parseMode() == SourceParseMode::GetterMode; }
+    bool isSetter() const { return parseMode() == SourceParseMode::SetterMode; }
+    bool isGenerator() const { return SourceParseModeSet(SourceParseMode::GeneratorBodyMode, SourceParseMode::GeneratorWrapperFunctionMode).contains(parseMode()); }
+    bool isMethod() const { return parseMode() == SourceParseMode::MethodMode; }
+    bool hasCallerAndArgumentsProperties() const
+    {
+        // Per https://tc39.github.io/ecma262/#sec-forbidden-extensions, only sloppy-mode non-builtin functions in old-style (pre-ES6) syntactic forms can contain
+        // "caller" and "arguments".
+        return !isStrictMode() && parseMode() == SourceParseMode::NormalFunctionMode && !isClassConstructorFunction();
+    }
+    bool hasPrototypeProperty() const
+    {
+        return SourceParseModeSet(
+            SourceParseMode::NormalFunctionMode,
+            SourceParseMode::GeneratorBodyMode,
+            SourceParseMode::GeneratorWrapperFunctionMode
+        ).contains(parseMode()) || isClass();
+    }
+    DerivedContextType derivedContextType() const { return m_unlinkedExecutable->derivedContextType(); }
+    bool isClassConstructorFunction() const { return m_unlinkedExecutable->isClassConstructorFunction(); }
+    const Identifier& name() { return m_unlinkedExecutable->name(); }
+    const Identifier& ecmaName() { return m_unlinkedExecutable->ecmaName(); }
+    const Identifier& inferredName() { return m_unlinkedExecutable->inferredName(); }
+    unsigned parameterCount() const { return m_unlinkedExecutable->parameterCount(); } // Excluding 'this'!
+    unsigned functionLength() const { return m_unlinkedExecutable->functionLength(); }
+    SourceParseMode parseMode() const { return m_unlinkedExecutable->parseMode(); }
+    JSParserScriptMode scriptMode() const { return m_unlinkedExecutable->scriptMode(); }
+    const SourceCode& classSource() const { return m_unlinkedExecutable->classSource(); }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(FunctionExecutableType, StructureFlags), info());
+    }
+
+    unsigned parametersStartOffset() const { return m_parametersStartOffset; }
+
+    void overrideParameterAndTypeProfilingStartEndOffsets(unsigned parametersStartOffset, unsigned typeProfilingStartOffset, unsigned typeProfilingEndOffset)
+    {
+        m_parametersStartOffset = parametersStartOffset;
+        m_typeProfilingStartOffset = typeProfilingStartOffset;
+        m_typeProfilingEndOffset = typeProfilingEndOffset;
+    }
+
+    DECLARE_INFO;
+
+    InferredValue* singletonFunction() { return m_singletonFunction.get(); }
+
+private:
+    friend class ExecutableBase;
+    FunctionExecutable(
+        VM&, const SourceCode&, UnlinkedFunctionExecutable*,
+        unsigned lastLine, unsigned endColumn, Intrinsic);
+    
+    void finishCreation(VM&);
+
+    friend class ScriptExecutable;
+    
+    unsigned m_parametersStartOffset;
+    WriteBarrier<UnlinkedFunctionExecutable> m_unlinkedExecutable;
+    WriteBarrier<FunctionCodeBlock> m_codeBlockForCall;
+    WriteBarrier<FunctionCodeBlock> m_codeBlockForConstruct;
+    RefPtr<TypeSet> m_returnStatementTypeSet;
+    WriteBarrier<InferredValue> m_singletonFunction;
+};
+
+} // namespace JSC
diff --git a/runtime/FunctionExecutableDump.cpp b/runtime/FunctionExecutableDump.cpp
new file mode 100644
index 0000000..75845fa
--- /dev/null
+++ b/runtime/FunctionExecutableDump.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FunctionExecutableDump.h"
+
+#include "CodeBlock.h"
+#include "FunctionCodeBlock.h"
+#include "JSCellInlines.h"
+
+namespace JSC {
+
+void FunctionExecutableDump::dump(PrintStream& out) const
+{
+    out.print(m_executable->inferredName().string(), "#");
+    if (m_executable->isGeneratedForCall())
+        out.print(m_executable->codeBlockForCall()->hashAsStringIfPossible());
+    else
+        out.print("<nogen>");
+    out.print("/");
+    if (m_executable->isGeneratedForConstruct())
+        out.print(m_executable->codeBlockForConstruct()->hashAsStringIfPossible());
+    else
+        out.print("<nogen>");
+    out.print(":[", RawPointer(m_executable), "]");
+}
+
+} // namespace JSC
+
diff --git a/runtime/FunctionExecutableDump.h b/runtime/FunctionExecutableDump.h
new file mode 100644
index 0000000..a2ab02c
--- /dev/null
+++ b/runtime/FunctionExecutableDump.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+class FunctionExecutable;
+
+class FunctionExecutableDump {
+public:
+    explicit FunctionExecutableDump(FunctionExecutable* executable)
+        : m_executable(executable)
+    {
+    }
+    
+    void dump(PrintStream&) const;
+private:
+    FunctionExecutable* m_executable;
+};
+
+} // namespace JSC
diff --git a/runtime/FunctionHasExecutedCache.cpp b/runtime/FunctionHasExecutedCache.cpp
new file mode 100644
index 0000000..3d7e31b
--- /dev/null
+++ b/runtime/FunctionHasExecutedCache.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FunctionHasExecutedCache.h"
+
+#include <limits.h>
+
+namespace JSC {
+
+bool FunctionHasExecutedCache::hasExecutedAtOffset(intptr_t id, unsigned offset)
+{
+    if (m_rangeMap.find(id) == m_rangeMap.end())
+        return false;
+
+    RangeMap& map = m_rangeMap.find(id)->second;
+    unsigned distance = UINT_MAX;
+    bool hasExecuted = false;
+    for (auto iter = map.begin(), end = map.end(); iter != end; ++iter) {
+        const FunctionRange& range = iter->first;
+        if (range.m_start <= offset && offset <= range.m_end && range.m_end - range.m_start < distance) {
+            hasExecuted = iter->second;
+            distance = range.m_end - range.m_start;
+        }
+    }
+
+    return hasExecuted;
+}
+
+void FunctionHasExecutedCache::insertUnexecutedRange(intptr_t id, unsigned start, unsigned end) 
+{
+    if (m_rangeMap.find(id) == m_rangeMap.end()) {
+        RangeMap map;
+        m_rangeMap[id] = map;
+    }
+
+    RangeMap& map = m_rangeMap.find(id)->second;
+    FunctionRange range;
+    range.m_start = start;
+    range.m_end = end;
+    // Only insert unexecuted ranges once for a given sourceID because we may run into a situation where an executable executes, then is GCed, and then is allocated again,
+    // and tries to reinsert itself, claiming it has never run, but this is false because it indeed already executed.
+    if (map.find(range) == map.end())
+        map[range] = false;
+}
+
+void FunctionHasExecutedCache::removeUnexecutedRange(intptr_t id, unsigned start, unsigned end)
+{
+    // FIXME: We should never have an instance where we return here, but currently do in some situations. Find out why.
+    if (m_rangeMap.find(id) == m_rangeMap.end())
+        return;
+
+    RangeMap& map = m_rangeMap.find(id)->second;
+
+    FunctionRange range;
+    range.m_start = start;
+    range.m_end = end;
+    map[range] = true;
+}
+
+Vector<std::tuple<bool, unsigned, unsigned>> FunctionHasExecutedCache::getFunctionRanges(intptr_t id)
+{
+    Vector<std::tuple<bool, unsigned, unsigned>> ranges(0);
+    auto findResult = m_rangeMap.find(id);
+    if (findResult == m_rangeMap.end())
+        return ranges;
+
+    RangeMap& map = m_rangeMap.find(id)->second;
+    for (auto iter = map.begin(), end = map.end(); iter != end; ++iter) {
+        const FunctionRange& range = iter->first;
+        bool hasExecuted = iter->second;
+        ranges.append(std::tuple<bool, unsigned, unsigned>(hasExecuted, range.m_start, range.m_end));
+    }
+
+    return ranges;
+}
+
+} // namespace JSC
diff --git a/runtime/FunctionHasExecutedCache.h b/runtime/FunctionHasExecutedCache.h
new file mode 100644
index 0000000..2c2521c
--- /dev/null
+++ b/runtime/FunctionHasExecutedCache.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <unordered_map>
+#include <wtf/HashMethod.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class FunctionHasExecutedCache {
+public:
+    struct FunctionRange {
+        FunctionRange() {}
+        bool operator==(const FunctionRange& other) const 
+        {
+            return m_start == other.m_start && m_end == other.m_end;
+        }
+        unsigned hash() const
+        {
+            return m_start * m_end;
+        }
+
+        unsigned m_start;
+        unsigned m_end;
+    };
+
+    bool hasExecutedAtOffset(intptr_t id, unsigned offset);
+    void insertUnexecutedRange(intptr_t id, unsigned start, unsigned end);
+    void removeUnexecutedRange(intptr_t id, unsigned start, unsigned end);
+    Vector<std::tuple<bool, unsigned, unsigned>> getFunctionRanges(intptr_t id);
+
+private:     
+    typedef std::unordered_map<FunctionRange, bool, HashMethod<FunctionRange>> RangeMap;
+    typedef std::unordered_map<intptr_t, RangeMap> SourceIDToRangeMap;
+    SourceIDToRangeMap m_rangeMap;
+};
+
+} // namespace JSC
diff --git a/runtime/FunctionPrototype.cpp b/runtime/FunctionPrototype.cpp
new file mode 100644
index 0000000..61e7eec
--- /dev/null
+++ b/runtime/FunctionPrototype.cpp
@@ -0,0 +1,149 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003-2009, 2015-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "FunctionPrototype.h"
+
+#include "BuiltinExecutables.h"
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "GetterSetter.h"
+#include "JSArray.h"
+#include "JSAsyncFunction.h"
+#include "JSFunction.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSString.h"
+#include "JSStringBuilder.h"
+#include "Interpreter.h"
+#include "Lexer.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(FunctionPrototype);
+
+const ClassInfo FunctionPrototype::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(FunctionPrototype) };
+
+static EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState*);
+
+FunctionPrototype::FunctionPrototype(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void FunctionPrototype::finishCreation(VM& vm, const String& name)
+{
+    Base::finishCreation(vm, name);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
+}
+
+void FunctionPrototype::addFunctionProperties(ExecState* exec, JSGlobalObject* globalObject, JSFunction** callFunction, JSFunction** applyFunction, JSFunction** hasInstanceSymbolFunction)
+{
+    VM& vm = exec->vm();
+
+    JSFunction* toStringFunction = JSFunction::create(vm, globalObject, 0, vm.propertyNames->toString.string(), functionProtoFuncToString);
+    putDirectWithoutTransition(vm, vm.propertyNames->toString, toStringFunction, DontEnum);
+
+    *applyFunction = putDirectBuiltinFunctionWithoutTransition(vm, globalObject, vm.propertyNames->builtinNames().applyPublicName(), functionPrototypeApplyCodeGenerator(vm), DontEnum);
+    *callFunction = putDirectBuiltinFunctionWithoutTransition(vm, globalObject, vm.propertyNames->builtinNames().callPublicName(), functionPrototypeCallCodeGenerator(vm), DontEnum);
+    *hasInstanceSymbolFunction = putDirectBuiltinFunction(vm, globalObject, vm.propertyNames->hasInstanceSymbol, functionPrototypeSymbolHasInstanceCodeGenerator(vm), DontDelete | ReadOnly | DontEnum);
+    putDirectBuiltinFunctionWithoutTransition(vm, globalObject, vm.propertyNames->bind, functionPrototypeBindCodeGenerator(vm), DontEnum);
+}
+    
+void FunctionPrototype::initRestrictedProperties(ExecState* exec, JSGlobalObject* globalObject)
+{
+    VM& vm = exec->vm();
+    GetterSetter* errorGetterSetter = globalObject->throwTypeErrorArgumentsCalleeAndCallerGetterSetter();
+    putDirectAccessor(exec, vm.propertyNames->caller, errorGetterSetter, DontEnum | Accessor);
+    putDirectAccessor(exec, vm.propertyNames->arguments, errorGetterSetter, DontEnum | Accessor);
+}
+
+static EncodedJSValue JSC_HOST_CALL callFunctionPrototype(ExecState*)
+{
+    return JSValue::encode(jsUndefined());
+}
+
+// ECMA 15.3.4
+CallType FunctionPrototype::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callFunctionPrototype;
+    return CallType::Host;
+}
+
+EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (thisValue.inherits(JSFunction::info())) {
+        JSFunction* function = jsCast<JSFunction*>(thisValue);
+        if (function->isHostOrBuiltinFunction()) {
+            scope.release();
+            return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(vm), "() {\n    [native code]\n}"));
+        }
+
+        FunctionExecutable* executable = function->jsExecutable();
+        if (executable->isClass()) {
+            StringView classSource = executable->classSource().view();
+            return JSValue::encode(jsString(exec, classSource.toStringWithoutCopying()));
+        }
+
+        if (thisValue.inherits(JSAsyncFunction::info())) {
+            String functionHeader = executable->isArrowFunction() ? "async " : "async function ";
+
+            StringView source = executable->source().provider()->getRange(
+                executable->parametersStartOffset(),
+                executable->parametersStartOffset() + executable->source().length());
+            return JSValue::encode(jsMakeNontrivialString(exec, functionHeader, function->name(vm), source));
+        }
+
+        String functionHeader = executable->isArrowFunction() ? "" : "function ";
+        
+        StringView source = executable->source().provider()->getRange(
+            executable->parametersStartOffset(),
+            executable->parametersStartOffset() + executable->source().length());
+        scope.release();
+        return JSValue::encode(jsMakeNontrivialString(exec, functionHeader, function->name(vm), source));
+    }
+
+    if (thisValue.inherits(InternalFunction::info())) {
+        InternalFunction* function = asInternalFunction(thisValue);
+        scope.release();
+        return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(), "() {\n    [native code]\n}"));
+    }
+
+    if (thisValue.isObject()) {
+        JSObject* object = asObject(thisValue);
+        if (object->inlineTypeFlags() & TypeOfShouldCallGetCallData) {
+            CallData callData;
+            if (object->methodTable(vm)->getCallData(object, callData) != CallType::None) {
+                if (auto* classInfo = object->classInfo()) {
+                    scope.release();
+                    return JSValue::encode(jsMakeNontrivialString(exec, "function ", classInfo->className, "() {\n    [native code]\n}"));
+                }
+            }
+        }
+    }
+
+    return throwVMTypeError(exec, scope);
+}
+
+} // namespace JSC
diff --git a/runtime/FunctionPrototype.h b/runtime/FunctionPrototype.h
new file mode 100644
index 0000000..baf7ccb
--- /dev/null
+++ b/runtime/FunctionPrototype.h
@@ -0,0 +1,57 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class FunctionPrototype : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static FunctionPrototype* create(VM& vm, Structure* structure)
+    {
+        FunctionPrototype* prototype = new (NotNull, allocateCell<FunctionPrototype>(vm.heap)) FunctionPrototype(vm, structure);
+        prototype->finishCreation(vm, String());
+        return prototype;
+    }
+
+    void addFunctionProperties(ExecState*, JSGlobalObject*, JSFunction** callFunction, JSFunction** applyFunction, JSFunction** hasInstanceSymbolFunction);
+
+    void initRestrictedProperties(ExecState*, JSGlobalObject*);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, const String& name);
+
+private:
+    FunctionPrototype(VM&, Structure*);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/FunctionRareData.cpp b/runtime/FunctionRareData.cpp
new file mode 100644
index 0000000..1c650cb
--- /dev/null
+++ b/runtime/FunctionRareData.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FunctionRareData.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo FunctionRareData::s_info = { "FunctionRareData", 0, 0, CREATE_METHOD_TABLE(FunctionRareData) };
+
+FunctionRareData* FunctionRareData::create(VM& vm)
+{
+    FunctionRareData* rareData = new (NotNull, allocateCell<FunctionRareData>(vm.heap)) FunctionRareData(vm);
+    rareData->finishCreation(vm);
+    return rareData;
+}
+
+void FunctionRareData::destroy(JSCell* cell)
+{
+    FunctionRareData* rareData = static_cast<FunctionRareData*>(cell);
+    rareData->FunctionRareData::~FunctionRareData();
+}
+
+Structure* FunctionRareData::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+void FunctionRareData::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    FunctionRareData* rareData = jsCast<FunctionRareData*>(cell);
+
+    rareData->m_objectAllocationProfile.visitAggregate(visitor);
+    rareData->m_internalFunctionAllocationProfile.visitAggregate(visitor);
+    visitor.append(rareData->m_boundFunctionStructure);
+}
+
+FunctionRareData::FunctionRareData(VM& vm)
+    : Base(vm, vm.functionRareDataStructure.get())
+    , m_objectAllocationProfile()
+    // We initialize blind so that changes to the prototype after function creation but before
+    // the optimizer kicks in don't disable optimizations. Once the optimizer kicks in, the
+    // watchpoint will start watching and any changes will both force deoptimization and disable
+    // future attempts to optimize. This is necessary because we are guaranteed that the
+    // allocation profile is changed exactly once prior to optimizations kicking in. We could be
+    // smarter and count the number of times the prototype is clobbered and only optimize if it
+    // was clobbered exactly once, but that seems like overkill. In almost all cases it will be
+    // clobbered once, and if it's clobbered more than once, that will probably only occur
+    // before we started optimizing, anyway.
+    , m_objectAllocationProfileWatchpoint(ClearWatchpoint)
+{
+}
+
+FunctionRareData::~FunctionRareData()
+{
+}
+
+void FunctionRareData::initializeObjectAllocationProfile(VM& vm, JSGlobalObject* globalObject, JSObject* prototype, size_t inlineCapacity)
+{
+    m_objectAllocationProfile.initialize(vm, globalObject, this, prototype, inlineCapacity);
+}
+
+void FunctionRareData::clear(const char* reason)
+{
+    m_objectAllocationProfile.clear();
+    m_internalFunctionAllocationProfile.clear();
+    m_objectAllocationProfileWatchpoint.fireAll(*vm(), reason);
+}
+
+}
diff --git a/runtime/FunctionRareData.h b/runtime/FunctionRareData.h
new file mode 100644
index 0000000..0dd577e
--- /dev/null
+++ b/runtime/FunctionRareData.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "InternalFunctionAllocationProfile.h"
+#include "JSCell.h"
+#include "ObjectAllocationProfile.h"
+#include "Watchpoint.h"
+
+namespace JSC {
+
+class JSGlobalObject;
+class LLIntOffsetsExtractor;
+namespace DFG {
+class SpeculativeJIT;
+class JITCompiler;
+}
+
+class FunctionRareData : public JSCell {
+    friend class JIT;
+    friend class DFG::SpeculativeJIT;
+    friend class DFG::JITCompiler;
+    friend class VM;
+    
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = StructureIsImmortal | Base::StructureFlags;
+
+    static FunctionRareData* create(VM&);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    DECLARE_INFO;
+
+    static inline ptrdiff_t offsetOfObjectAllocationProfile()
+    {
+        return OBJECT_OFFSETOF(FunctionRareData, m_objectAllocationProfile);
+    }
+
+    ObjectAllocationProfile* objectAllocationProfile()
+    {
+        return &m_objectAllocationProfile;
+    }
+
+    Structure* objectAllocationStructure() { return m_objectAllocationProfile.structure(); }
+
+    InlineWatchpointSet& allocationProfileWatchpointSet()
+    {
+        return m_objectAllocationProfileWatchpoint;
+    }
+
+    void clear(const char* reason);
+
+    void initializeObjectAllocationProfile(VM&, JSGlobalObject*, JSObject* prototype, size_t inlineCapacity);
+
+    bool isObjectAllocationProfileInitialized() { return !m_objectAllocationProfile.isNull(); }
+
+    Structure* internalFunctionAllocationStructure() { return m_internalFunctionAllocationProfile.structure(); }
+    Structure* createInternalFunctionAllocationStructureFromBase(VM& vm, JSGlobalObject* globalObject, JSObject* prototype, Structure* baseStructure)
+    {
+        return m_internalFunctionAllocationProfile.createAllocationStructureFromBase(vm, globalObject, this, prototype, baseStructure);
+    }
+
+    Structure* getBoundFunctionStructure() { return m_boundFunctionStructure.get(); }
+    void setBoundFunctionStructure(VM& vm, Structure* structure) { m_boundFunctionStructure.set(vm, this, structure); }
+
+    bool hasReifiedLength() const { return m_hasReifiedLength; }
+    void setHasReifiedLength() { m_hasReifiedLength = true; }
+    bool hasReifiedName() const { return m_hasReifiedName; }
+    void setHasReifiedName() { m_hasReifiedName = true; }
+
+protected:
+    FunctionRareData(VM&);
+    ~FunctionRareData();
+
+private:
+
+    friend class LLIntOffsetsExtractor;
+
+    // Ideally, there would only be one allocation profile for subclassing but due to Reflect.construct we
+    // have two. There are some pros and cons in comparison to our current system to using the same profile
+    // for both JS constructors and subclasses of builtin constructors:
+    //
+    // 1) + Uses less memory.
+    // 2) + Conceptually simplier as there is only one profile.
+    // 3) - We would need a check in all JSFunction object creations (both with classes and without) that the
+    //      new.target's profiled structure has a JSFinalObject ClassInfo. This is needed, for example, if we have
+    //      `Reflect.construct(Array, args, myConstructor)` since myConstructor will be the new.target of Array
+    //      the Array constructor will set the allocation profile of myConstructor to hold an Array structure
+    //
+    // We don't really care about 1) since this memory is rare and small in total. 2) is unfortunate but is
+    // probably outweighed by the cost of 3).
+    ObjectAllocationProfile m_objectAllocationProfile;
+    InlineWatchpointSet m_objectAllocationProfileWatchpoint;
+    InternalFunctionAllocationProfile m_internalFunctionAllocationProfile;
+    WriteBarrier<Structure> m_boundFunctionStructure;
+    bool m_hasReifiedLength { false };
+    bool m_hasReifiedName { false };
+};
+
+} // namespace JSC
diff --git a/runtime/GeneratorFunctionConstructor.cpp b/runtime/GeneratorFunctionConstructor.cpp
new file mode 100644
index 0000000..58cab32
--- /dev/null
+++ b/runtime/GeneratorFunctionConstructor.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GeneratorFunctionConstructor.h"
+
+#include "FunctionConstructor.h"
+#include "GeneratorFunctionPrototype.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(GeneratorFunctionConstructor);
+
+const ClassInfo GeneratorFunctionConstructor::s_info = { "GeneratorFunction", &Base::s_info, nullptr, CREATE_METHOD_TABLE(GeneratorFunctionConstructor) };
+
+GeneratorFunctionConstructor::GeneratorFunctionConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void GeneratorFunctionConstructor::finishCreation(VM& vm, GeneratorFunctionPrototype* generatorFunctionPrototype)
+{
+    Base::finishCreation(vm, "GeneratorFunction");
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, generatorFunctionPrototype, DontEnum | DontDelete | ReadOnly);
+
+    // Number of arguments for constructor
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum);
+}
+
+static EncodedJSValue JSC_HOST_CALL callGeneratorFunctionConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->jsCallee())->globalObject(), args, FunctionConstructionMode::Generator));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructGeneratorFunctionConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->jsCallee())->globalObject(), args, FunctionConstructionMode::Generator, exec->newTarget()));
+}
+
+CallType GeneratorFunctionConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callGeneratorFunctionConstructor;
+    return CallType::Host;
+}
+
+ConstructType GeneratorFunctionConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructGeneratorFunctionConstructor;
+    return ConstructType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/GeneratorFunctionConstructor.h b/runtime/GeneratorFunctionConstructor.h
new file mode 100644
index 0000000..f28c71c
--- /dev/null
+++ b/runtime/GeneratorFunctionConstructor.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace WTF {
+class TextPosition;
+}
+
+namespace JSC {
+
+class GeneratorFunctionPrototype;
+
+// %GeneratorFunction% intrinsic.
+// https://tc39.github.io/ecma262/#sec-generatorfunction-constructor
+class GeneratorFunctionConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static GeneratorFunctionConstructor* create(VM& vm, Structure* structure, GeneratorFunctionPrototype* generatorFunctionPrototype)
+    {
+        GeneratorFunctionConstructor* constructor = new (NotNull, allocateCell<GeneratorFunctionConstructor>(vm.heap)) GeneratorFunctionConstructor(vm, structure);
+        constructor->finishCreation(vm, generatorFunctionPrototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    GeneratorFunctionConstructor(VM&, Structure*);
+    void finishCreation(VM&, GeneratorFunctionPrototype*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/GeneratorFunctionPrototype.cpp b/runtime/GeneratorFunctionPrototype.cpp
new file mode 100644
index 0000000..59c865b
--- /dev/null
+++ b/runtime/GeneratorFunctionPrototype.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GeneratorFunctionPrototype.h"
+
+#include "BuiltinExecutables.h"
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSString.h"
+#include "JSStringBuilder.h"
+#include "Lexer.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(GeneratorFunctionPrototype);
+
+const ClassInfo GeneratorFunctionPrototype::s_info = { "GeneratorFunction", &Base::s_info, nullptr, CREATE_METHOD_TABLE(GeneratorFunctionPrototype) };
+
+GeneratorFunctionPrototype::GeneratorFunctionPrototype(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void GeneratorFunctionPrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), ReadOnly | DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "GeneratorFunction"), DontEnum | ReadOnly);
+    vm.prototypeMap.addPrototype(this);
+}
+
+} // namespace JSC
diff --git a/runtime/GeneratorFunctionPrototype.h b/runtime/GeneratorFunctionPrototype.h
new file mode 100644
index 0000000..c07e38a
--- /dev/null
+++ b/runtime/GeneratorFunctionPrototype.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+// %Generator% intrinsic.
+// https://tc39.github.io/ecma262/#sec-generatorfunction.prototype
+class GeneratorFunctionPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static GeneratorFunctionPrototype* create(VM& vm, Structure* structure)
+    {
+        GeneratorFunctionPrototype* prototype = new (NotNull, allocateCell<GeneratorFunctionPrototype>(vm.heap)) GeneratorFunctionPrototype(vm, structure);
+        prototype->finishCreation(vm);
+        return prototype;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    GeneratorFunctionPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
diff --git a/runtime/GeneratorPrototype.cpp b/runtime/GeneratorPrototype.cpp
new file mode 100644
index 0000000..4d14c49
--- /dev/null
+++ b/runtime/GeneratorPrototype.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GeneratorPrototype.h"
+
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+
+#include "GeneratorPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo GeneratorPrototype::s_info = { "Generator", &Base::s_info, &generatorPrototypeTable, CREATE_METHOD_TABLE(GeneratorPrototype) };
+
+/* Source for GeneratorPrototype.lut.h
+@begin generatorPrototypeTable
+  next      JSBuiltin    DontEnum|Function 1
+  return    JSBuiltin    DontEnum|Function 1
+  throw     JSBuiltin    DontEnum|Function 1
+@end
+*/
+
+void GeneratorPrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Generator"), DontEnum | ReadOnly);
+    vm.prototypeMap.addPrototype(this);
+}
+
+} // namespace JSC
diff --git a/runtime/GeneratorPrototype.h b/runtime/GeneratorPrototype.h
new file mode 100644
index 0000000..afb7c97
--- /dev/null
+++ b/runtime/GeneratorPrototype.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+// %GeneratorPrototype% intrinsic.
+// https://tc39.github.io/ecma262/#sec-properties-of-generator-prototype
+class GeneratorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static GeneratorPrototype* create(VM& vm, JSGlobalObject*, Structure* structure)
+    {
+        GeneratorPrototype* prototype = new (NotNull, allocateCell<GeneratorPrototype>(vm.heap)) GeneratorPrototype(vm, structure);
+        prototype->finishCreation(vm);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    GeneratorPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&);
+};
+
+} // namespace JSC
diff --git a/runtime/GenericArguments.h b/runtime/GenericArguments.h
new file mode 100644
index 0000000..a9d9c1f
--- /dev/null
+++ b/runtime/GenericArguments.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+// This is a mixin for the two kinds of Arguments-class objects that arise when you say
+// "arguments" inside a function. This class doesn't show up in the JSCell inheritance hierarchy.
+template<typename Type>
+class GenericArguments : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
+
+protected:
+    GenericArguments(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
+    static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    
+    void copyToArguments(ExecState*, VirtualRegister firstElementDest, unsigned offset, unsigned length);
+};
+
+} // namespace JSC
diff --git a/runtime/GenericArgumentsInlines.h b/runtime/GenericArgumentsInlines.h
new file mode 100644
index 0000000..46ef913
--- /dev/null
+++ b/runtime/GenericArgumentsInlines.h
@@ -0,0 +1,237 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GenericArguments.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+template<typename Type>
+bool GenericArguments<Type>::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName ident, PropertySlot& slot)
+{
+    Type* thisObject = jsCast<Type*>(object);
+    VM& vm = exec->vm();
+    
+    if (!thisObject->overrodeThings()) {
+        if (ident == vm.propertyNames->length) {
+            slot.setValue(thisObject, DontEnum, jsNumber(thisObject->internalLength()));
+            return true;
+        }
+        if (ident == vm.propertyNames->callee) {
+            slot.setValue(thisObject, DontEnum, thisObject->callee().get());
+            return true;
+        }
+        if (ident == vm.propertyNames->iteratorSymbol) {
+            slot.setValue(thisObject, DontEnum, thisObject->globalObject()->arrayProtoValuesFunction());
+            return true;
+        }
+    }
+    
+    std::optional<uint32_t> index = parseIndex(ident);
+    if (index && thisObject->canAccessIndexQuickly(index.value())) {
+        slot.setValue(thisObject, None, thisObject->getIndexQuickly(index.value()));
+        return true;
+    }
+    
+    return Base::getOwnPropertySlot(thisObject, exec, ident, slot);
+}
+
+template<typename Type>
+bool GenericArguments<Type>::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned index, PropertySlot& slot)
+{
+    Type* thisObject = jsCast<Type*>(object);
+    
+    if (thisObject->canAccessIndexQuickly(index)) {
+        JSValue result = thisObject->getIndexQuickly(index);
+        slot.setValue(thisObject, None, result);
+        return true;
+    }
+    
+    bool result = Base::getOwnPropertySlotByIndex(object, exec, index, slot);
+    return result;
+}
+
+template<typename Type>
+void GenericArguments<Type>::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& array, EnumerationMode mode)
+{
+    Type* thisObject = jsCast<Type*>(object);
+
+    if (array.includeStringProperties()) {
+        for (unsigned i = 0; i < thisObject->internalLength(); ++i) {
+            if (!thisObject->canAccessIndexQuickly(i))
+                continue;
+            array.add(Identifier::from(exec, i));
+        }
+    }
+
+    if (mode.includeDontEnumProperties() && !thisObject->overrodeThings()) {
+        array.add(exec->propertyNames().length);
+        array.add(exec->propertyNames().callee);
+        if (array.includeSymbolProperties())
+            array.add(exec->propertyNames().iteratorSymbol);
+    }
+    Base::getOwnPropertyNames(thisObject, exec, array, mode);
+}
+
+template<typename Type>
+bool GenericArguments<Type>::put(JSCell* cell, ExecState* exec, PropertyName ident, JSValue value, PutPropertySlot& slot)
+{
+    Type* thisObject = jsCast<Type*>(cell);
+    VM& vm = exec->vm();
+    
+    if (!thisObject->overrodeThings()
+        && (ident == vm.propertyNames->length
+            || ident == vm.propertyNames->callee
+            || ident == vm.propertyNames->iteratorSymbol)) {
+        thisObject->overrideThings(vm);
+        PutPropertySlot dummy = slot; // This put is not cacheable, so we shadow the slot that was given to us.
+        return Base::put(thisObject, exec, ident, value, dummy);
+    }
+
+    // https://tc39.github.io/ecma262/#sec-arguments-exotic-objects-set-p-v-receiver
+    // Fall back to the OrdinarySet when the receiver is altered from the thisObject.
+    if (UNLIKELY(isThisValueAltered(slot, thisObject)))
+        return ordinarySetSlow(exec, thisObject, ident, value, slot.thisValue(), slot.isStrictMode());
+    
+    std::optional<uint32_t> index = parseIndex(ident);
+    if (index && thisObject->canAccessIndexQuickly(index.value())) {
+        thisObject->setIndexQuickly(vm, index.value(), value);
+        return true;
+    }
+    
+    return Base::put(thisObject, exec, ident, value, slot);
+}
+
+template<typename Type>
+bool GenericArguments<Type>::putByIndex(JSCell* cell, ExecState* exec, unsigned index, JSValue value, bool shouldThrow)
+{
+    Type* thisObject = jsCast<Type*>(cell);
+    VM& vm = exec->vm();
+    
+    if (thisObject->canAccessIndexQuickly(index)) {
+        thisObject->setIndexQuickly(vm, index, value);
+        return true;
+    }
+    
+    return Base::putByIndex(cell, exec, index, value, shouldThrow);
+}
+
+template<typename Type>
+bool GenericArguments<Type>::deleteProperty(JSCell* cell, ExecState* exec, PropertyName ident)
+{
+    Type* thisObject = jsCast<Type*>(cell);
+    VM& vm = exec->vm();
+    
+    if (!thisObject->overrodeThings()
+        && (ident == vm.propertyNames->length
+            || ident == vm.propertyNames->callee
+            || ident == vm.propertyNames->iteratorSymbol))
+        thisObject->overrideThings(vm);
+    
+    std::optional<uint32_t> index = parseIndex(ident);
+    if (index && thisObject->canAccessIndexQuickly(index.value())) {
+        thisObject->overrideArgument(vm, index.value());
+        return true;
+    }
+    
+    return Base::deleteProperty(thisObject, exec, ident);
+}
+
+template<typename Type>
+bool GenericArguments<Type>::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned index)
+{
+    Type* thisObject = jsCast<Type*>(cell);
+    VM& vm = exec->vm();
+    
+    if (thisObject->canAccessIndexQuickly(index)) {
+        thisObject->overrideArgument(vm, index);
+        return true;
+    }
+    
+    return Base::deletePropertyByIndex(cell, exec, index);
+}
+
+template<typename Type>
+bool GenericArguments<Type>::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName ident, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    Type* thisObject = jsCast<Type*>(object);
+    VM& vm = exec->vm();
+    
+    if (ident == vm.propertyNames->length
+        || ident == vm.propertyNames->callee
+        || ident == vm.propertyNames->iteratorSymbol)
+        thisObject->overrideThingsIfNecessary(vm);
+    else {
+        std::optional<uint32_t> optionalIndex = parseIndex(ident);
+        if (optionalIndex && thisObject->canAccessIndexQuickly(optionalIndex.value())) {
+            uint32_t index = optionalIndex.value();
+            if (!descriptor.isAccessorDescriptor()) {
+                // If the property is not deleted and we are using a non-accessor descriptor, then
+                // make sure that the aliased argument sees the value.
+                if (descriptor.value())
+                    thisObject->setIndexQuickly(vm, index, descriptor.value());
+            
+                // If the property is not deleted and we are using a non-accessor, writable
+                // descriptor, then we are done. The argument continues to be aliased. Note that we
+                // ignore the request to change enumerability. We appear to have always done so, in
+                // cases where the argument was still aliased.
+                // FIXME: https://bugs.webkit.org/show_bug.cgi?id=141952
+                if (descriptor.writable())
+                    return true;
+            }
+        
+            // If the property is a non-deleted argument, then move it into the base object and
+            // then delete it.
+            JSValue value = thisObject->getIndexQuickly(index);
+            ASSERT(value);
+            object->putDirectMayBeIndex(exec, ident, value);
+            thisObject->overrideArgument(vm, index);
+        }
+    }
+    
+    // Now just let the normal object machinery do its thing.
+    return Base::defineOwnProperty(object, exec, ident, descriptor, shouldThrow);
+}
+
+template<typename Type>
+void GenericArguments<Type>::copyToArguments(ExecState* exec, VirtualRegister firstElementDest, unsigned offset, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Type* thisObject = static_cast<Type*>(this);
+    for (unsigned i = 0; i < length; ++i) {
+        if (thisObject->canAccessIndexQuickly(i + offset))
+            exec->r(firstElementDest + i) = thisObject->getIndexQuickly(i + offset);
+        else {
+            exec->r(firstElementDest + i) = get(exec, i + offset);
+            RETURN_IF_EXCEPTION(scope, void());
+        }
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/GenericOffset.h b/runtime/GenericOffset.h
new file mode 100644
index 0000000..45689f4
--- /dev/null
+++ b/runtime/GenericOffset.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <limits.h>
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+// A mixin for creating the various kinds of variable offsets that our engine supports.
+template<typename T>
+class GenericOffset {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static const unsigned invalidOffset = UINT_MAX;
+    
+    GenericOffset()
+        : m_offset(invalidOffset)
+    {
+    }
+    
+    explicit GenericOffset(unsigned offset)
+        : m_offset(offset)
+    {
+    }
+    
+    bool operator!() const { return m_offset == invalidOffset; }
+    
+    unsigned offsetUnchecked() const
+    {
+        return m_offset;
+    }
+    
+    unsigned offset() const
+    {
+        ASSERT(m_offset != invalidOffset);
+        return m_offset;
+    }
+    
+    bool operator==(const T& other) const
+    {
+        return m_offset == other.offsetUnchecked();
+    }
+    bool operator!=(const T& other) const
+    {
+        return m_offset != other.offsetUnchecked();
+    }
+    bool operator<(const T& other) const
+    {
+        return m_offset < other.offsetUnchecked();
+    }
+    bool operator>(const T& other) const
+    {
+        return m_offset > other.offsetUnchecked();
+    }
+    bool operator<=(const T& other) const
+    {
+        return m_offset <= other.offsetUnchecked();
+    }
+    bool operator>=(const T& other) const
+    {
+        return m_offset >= other.offsetUnchecked();
+    }
+    
+    T operator+(int value) const
+    {
+        return T(offset() + value);
+    }
+    T operator-(int value) const
+    {
+        return T(offset() - value);
+    }
+    T& operator+=(int value)
+    {
+        return *this = *this + value;
+    }
+    T& operator-=(int value)
+    {
+        return *this = *this - value;
+    }
+    
+private:
+    unsigned m_offset;
+};
+
+} // namespace JSC
diff --git a/runtime/GenericTypedArrayView.h b/runtime/GenericTypedArrayView.h
new file mode 100644
index 0000000..fd48c9c
--- /dev/null
+++ b/runtime/GenericTypedArrayView.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBuffer.h"
+#include "ArrayBufferView.h"
+
+namespace JSC {
+
+template<typename Adaptor>
+class GenericTypedArrayView : public ArrayBufferView {
+protected:
+    GenericTypedArrayView(PassRefPtr<ArrayBuffer>, unsigned byteOffset, unsigned length);
+
+public:
+    static RefPtr<GenericTypedArrayView> create(unsigned length);
+    static RefPtr<GenericTypedArrayView> create(const typename Adaptor::Type* array, unsigned length);
+    static RefPtr<GenericTypedArrayView> create(PassRefPtr<ArrayBuffer>, unsigned byteOffset, unsigned length);
+    
+    static RefPtr<GenericTypedArrayView> createUninitialized(unsigned length);
+    
+    typename Adaptor::Type* data() const { return static_cast<typename Adaptor::Type*>(baseAddress()); }
+    
+    bool set(GenericTypedArrayView<Adaptor>* array, unsigned offset)
+    {
+        return setImpl(array, offset * sizeof(typename Adaptor::Type));
+    }
+    
+    bool setRange(const typename Adaptor::Type* data, size_t dataLength, unsigned offset)
+    {
+        return setRangeImpl(
+            reinterpret_cast<const char*>(data),
+            dataLength * sizeof(typename Adaptor::Type),
+            offset * sizeof(typename Adaptor::Type));
+    }
+    
+    bool zeroRange(unsigned offset, size_t length)
+    {
+        return zeroRangeImpl(offset * sizeof(typename Adaptor::Type), length * sizeof(typename Adaptor::Type));
+    }
+    
+    void zeroFill() { zeroRange(0, length()); }
+    
+    unsigned length() const
+    {
+        if (isNeutered())
+            return 0;
+        return m_length;
+    }
+    
+    unsigned byteLength() const override
+    {
+        return length() * sizeof(typename Adaptor::Type);
+    }
+
+    typename Adaptor::Type item(unsigned index) const
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(index < this->length());
+        return data()[index];
+    }
+    
+    void set(unsigned index, double value) const
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(index < this->length());
+        data()[index] = Adaptor::toNativeFromDouble(value);
+    }
+    
+    bool checkInboundData(unsigned offset, unsigned pos) const
+    {
+        unsigned length = this->length();
+        return (offset <= length
+            && offset + pos <= length
+            // check overflow
+            && offset + pos >= offset);
+    }
+    
+    RefPtr<GenericTypedArrayView> subarray(int start) const;
+    RefPtr<GenericTypedArrayView> subarray(int start, int end) const;
+    
+    TypedArrayType getType() const override
+    {
+        return Adaptor::typeValue;
+    }
+
+    JSArrayBufferView* wrap(ExecState*, JSGlobalObject*) override;
+
+private:
+    unsigned m_length;
+};
+
+} // namespace JSC
diff --git a/runtime/GenericTypedArrayViewInlines.h b/runtime/GenericTypedArrayViewInlines.h
new file mode 100644
index 0000000..da7a453
--- /dev/null
+++ b/runtime/GenericTypedArrayViewInlines.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GenericTypedArrayView.h"
+#include "JSGlobalObject.h"
+
+namespace JSC {
+
+template<typename Adaptor>
+GenericTypedArrayView<Adaptor>::GenericTypedArrayView(
+    PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+    : ArrayBufferView(buffer, byteOffset)
+    , m_length(length)
+{
+}
+
+template<typename Adaptor>
+RefPtr<GenericTypedArrayView<Adaptor>> GenericTypedArrayView<Adaptor>::create(unsigned length)
+{
+    auto buffer = ArrayBuffer::tryCreate(length, sizeof(typename Adaptor::Type));
+    if (!buffer)
+        return nullptr;
+    return create(WTFMove(buffer), 0, length);
+}
+
+template<typename Adaptor>
+RefPtr<GenericTypedArrayView<Adaptor>> GenericTypedArrayView<Adaptor>::create(
+    const typename Adaptor::Type* array, unsigned length)
+{
+    RefPtr<GenericTypedArrayView> result = create(length);
+    memcpy(result->data(), array, length * sizeof(typename Adaptor::Type));
+    return result;
+}
+
+template<typename Adaptor>
+RefPtr<GenericTypedArrayView<Adaptor>> GenericTypedArrayView<Adaptor>::create(
+    PassRefPtr<ArrayBuffer> passedBuffer, unsigned byteOffset, unsigned length)
+{
+    RefPtr<ArrayBuffer> buffer = passedBuffer;
+    if (!verifySubRangeLength(buffer, byteOffset, length, sizeof(typename Adaptor::Type))
+        || !verifyByteOffsetAlignment(byteOffset, sizeof(typename Adaptor::Type))) {
+        return nullptr;
+    }
+    
+    return adoptRef(new GenericTypedArrayView(WTFMove(buffer), byteOffset, length));
+}
+
+template<typename Adaptor>
+RefPtr<GenericTypedArrayView<Adaptor>>
+GenericTypedArrayView<Adaptor>::createUninitialized(unsigned length)
+{
+    RefPtr<ArrayBuffer> buffer =
+        ArrayBuffer::tryCreateUninitialized(length, sizeof(typename Adaptor::Type));
+    if (!buffer)
+        return nullptr;
+    return create(WTFMove(buffer), 0, length);
+}
+
+template<typename Adaptor>
+RefPtr<GenericTypedArrayView<Adaptor>>
+GenericTypedArrayView<Adaptor>::subarray(int start) const
+{
+    return subarray(start, length());
+}
+
+template<typename Adaptor>
+RefPtr<GenericTypedArrayView<Adaptor>>
+GenericTypedArrayView<Adaptor>::subarray(int start, int end) const
+{
+    unsigned offset, length;
+    calculateOffsetAndLength(start, end, this->length(), &offset, &length);
+    ArrayBuffer* buffer = possiblySharedBuffer();
+    clampOffsetAndNumElements<Adaptor::Type>(buffer, byteOffset(), &offset, &length);
+    return create(buffer, offset, length);
+}
+
+template<typename Adaptor>
+JSArrayBufferView* GenericTypedArrayView<Adaptor>::wrap(
+    ExecState* exec, JSGlobalObject* globalObject)
+{
+    return Adaptor::JSViewType::create(
+        exec->vm(), globalObject->typedArrayStructure(Adaptor::typeValue), this);
+}
+
+} // namespace JSC
diff --git a/runtime/GetPutInfo.h b/runtime/GetPutInfo.h
new file mode 100644
index 0000000..b7acb18
--- /dev/null
+++ b/runtime/GetPutInfo.h
@@ -0,0 +1,234 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/text/UniquedStringImpl.h>
+
+namespace JSC {
+
+class Structure;
+class WatchpointSet;
+class JSLexicalEnvironment;
+
+enum ResolveMode {
+    ThrowIfNotFound,
+    DoNotThrowIfNotFound
+};
+
+enum ResolveType {
+    // Lexical scope guaranteed a certain type of variable access.
+    GlobalProperty,
+    GlobalVar,
+    GlobalLexicalVar,
+    ClosureVar,
+    LocalClosureVar,
+    ModuleVar,
+
+    // Ditto, but at least one intervening scope used non-strict eval, which
+    // can inject an intercepting var delcaration at runtime.
+    GlobalPropertyWithVarInjectionChecks,
+    GlobalVarWithVarInjectionChecks,
+    GlobalLexicalVarWithVarInjectionChecks,
+    ClosureVarWithVarInjectionChecks,
+
+    // We haven't found which scope this belongs to, and we also
+    // haven't ruled out the possibility of it being cached. Ideally,
+    // we want to transition this to GlobalVar/GlobalLexicalVar/GlobalProperty <with/without injection>
+    UnresolvedProperty,
+    UnresolvedPropertyWithVarInjectionChecks,
+
+    // Lexical scope didn't prove anything -- probably because of a 'with' scope.
+    Dynamic
+};
+
+enum class InitializationMode : unsigned {
+    Initialization,      // "let x = 20;"
+    ConstInitialization, // "const x = 20;"
+    NotInitialization    // "x = 20;"
+};
+
+ALWAYS_INLINE const char* resolveModeName(ResolveMode resolveMode)
+{
+    static const char* const names[] = {
+        "ThrowIfNotFound",
+        "DoNotThrowIfNotFound"
+    };
+    return names[resolveMode];
+}
+
+ALWAYS_INLINE const char* resolveTypeName(ResolveType type)
+{
+    static const char* const names[] = {
+        "GlobalProperty",
+        "GlobalVar",
+        "GlobalLexicalVar",
+        "ClosureVar",
+        "LocalClosureVar",
+        "ModuleVar",
+        "GlobalPropertyWithVarInjectionChecks",
+        "GlobalVarWithVarInjectionChecks",
+        "GlobalLexicalVarWithVarInjectionChecks",
+        "ClosureVarWithVarInjectionChecks",
+        "UnresolvedProperty",
+        "UnresolvedPropertyWithVarInjectionChecks",
+        "Dynamic"
+    };
+    return names[type];
+}
+
+ALWAYS_INLINE const char* initializationModeName(InitializationMode initializationMode)
+{
+    static const char* const names[] = {
+        "Initialization",
+        "ConstInitialization",
+        "NotInitialization"
+    };
+    return names[static_cast<unsigned>(initializationMode)];
+}
+
+ALWAYS_INLINE bool isInitialization(InitializationMode initializationMode)
+{
+    switch (initializationMode) {
+    case InitializationMode::Initialization:
+    case InitializationMode::ConstInitialization:
+        return true;
+    case InitializationMode::NotInitialization:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+ALWAYS_INLINE ResolveType makeType(ResolveType type, bool needsVarInjectionChecks)
+{
+    if (!needsVarInjectionChecks)
+        return type;
+
+    switch (type) {
+    case GlobalProperty:
+        return GlobalPropertyWithVarInjectionChecks;
+    case GlobalVar:
+        return GlobalVarWithVarInjectionChecks;
+    case GlobalLexicalVar:
+        return GlobalLexicalVarWithVarInjectionChecks;
+    case ClosureVar:
+    case LocalClosureVar:
+        return ClosureVarWithVarInjectionChecks;
+    case UnresolvedProperty:
+        return UnresolvedPropertyWithVarInjectionChecks;
+    case ModuleVar:
+    case GlobalPropertyWithVarInjectionChecks:
+    case GlobalVarWithVarInjectionChecks:
+    case GlobalLexicalVarWithVarInjectionChecks:
+    case ClosureVarWithVarInjectionChecks:
+    case UnresolvedPropertyWithVarInjectionChecks:
+    case Dynamic:
+        return type;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return type;
+}
+
+ALWAYS_INLINE bool needsVarInjectionChecks(ResolveType type)
+{
+    switch (type) {
+    case GlobalProperty:
+    case GlobalVar:
+    case GlobalLexicalVar:
+    case ClosureVar:
+    case LocalClosureVar:
+    case ModuleVar:
+    case UnresolvedProperty:
+        return false;
+    case GlobalPropertyWithVarInjectionChecks:
+    case GlobalVarWithVarInjectionChecks:
+    case GlobalLexicalVarWithVarInjectionChecks:
+    case ClosureVarWithVarInjectionChecks:
+    case UnresolvedPropertyWithVarInjectionChecks:
+    case Dynamic:
+        return true;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return true;
+    }
+}
+
+struct ResolveOp {
+    ResolveOp(ResolveType type, size_t depth, Structure* structure, JSLexicalEnvironment* lexicalEnvironment, WatchpointSet* watchpointSet, uintptr_t operand, UniquedStringImpl* importedName = nullptr)
+        : type(type)
+        , depth(depth)
+        , structure(structure)
+        , lexicalEnvironment(lexicalEnvironment)
+        , watchpointSet(watchpointSet)
+        , operand(operand)
+        , importedName(importedName)
+    {
+    }
+
+    ResolveType type;
+    size_t depth;
+    Structure* structure;
+    JSLexicalEnvironment* lexicalEnvironment;
+    WatchpointSet* watchpointSet;
+    uintptr_t operand;
+    RefPtr<UniquedStringImpl> importedName;
+};
+
+class GetPutInfo {
+    typedef unsigned Operand;
+public:
+    // Give each field 10 bits for simplicity.
+    static_assert(sizeof(Operand) * 8 > 30, "Not enough bits for GetPutInfo");
+    static const unsigned modeShift = 20;
+    static const unsigned initializationShift = 10;
+    static const unsigned typeBits = (1 << initializationShift) - 1;
+    static const unsigned initializationBits = ((1 << modeShift) - 1) & ~typeBits;
+    static const unsigned modeBits = ((1 << 30) - 1) & ~initializationBits & ~typeBits;
+    static_assert((modeBits & initializationBits & typeBits) == 0x0, "There should be no intersection between ResolveMode ResolveType and InitializationMode");
+
+    GetPutInfo(ResolveMode resolveMode, ResolveType resolveType, InitializationMode initializationMode)
+        : m_operand((resolveMode << modeShift) | (static_cast<unsigned>(initializationMode) << initializationShift) | resolveType)
+    {
+    }
+
+    explicit GetPutInfo(unsigned operand)
+        : m_operand(operand)
+    {
+    }
+
+    ResolveType resolveType() const { return static_cast<ResolveType>(m_operand & typeBits); }
+    InitializationMode initializationMode() const { return static_cast<InitializationMode>((m_operand & initializationBits) >> initializationShift); }
+    ResolveMode resolveMode() const { return static_cast<ResolveMode>((m_operand & modeBits) >> modeShift); }
+    unsigned operand() { return m_operand; }
+
+private:
+    Operand m_operand;
+};
+
+enum GetOrPut { Get, Put };
+
+} // namespace JSC
diff --git a/runtime/GetterSetter.cpp b/runtime/GetterSetter.cpp
new file mode 100644
index 0000000..2b96272
--- /dev/null
+++ b/runtime/GetterSetter.cpp
@@ -0,0 +1,112 @@
+/*
+ *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2004, 2007-2009, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "GetterSetter.h"
+
+#include "Error.h"
+#include "Exception.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(GetterSetter);
+
+const ClassInfo GetterSetter::s_info = { "GetterSetter", &Base::s_info, 0, CREATE_METHOD_TABLE(GetterSetter) };
+
+void GetterSetter::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    GetterSetter* thisObject = jsCast<GetterSetter*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    JSCell::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_getter);
+    visitor.append(thisObject->m_setter);
+}
+
+GetterSetter* GetterSetter::withGetter(VM& vm, JSGlobalObject* globalObject, JSObject* newGetter)
+{
+    if (isGetterNull()) {
+        setGetter(vm, globalObject, newGetter);
+        return this;
+    }
+    
+    GetterSetter* result = GetterSetter::create(vm, globalObject);
+    result->setGetter(vm, globalObject, newGetter);
+    result->setSetter(vm, globalObject, setter());
+    return result;
+}
+
+GetterSetter* GetterSetter::withSetter(VM& vm, JSGlobalObject* globalObject, JSObject* newSetter)
+{
+    if (isSetterNull()) {
+        setSetter(vm, globalObject, newSetter);
+        return this;
+    }
+    
+    GetterSetter* result = GetterSetter::create(vm, globalObject);
+    result->setGetter(vm, globalObject, getter());
+    result->setSetter(vm, globalObject, newSetter);
+    return result;
+}
+
+JSValue callGetter(ExecState* exec, JSValue base, JSValue getterSetter)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // FIXME: Some callers may invoke get() without checking for an exception first.
+    // We work around that by checking here.
+    RETURN_IF_EXCEPTION(scope, scope.exception()->value());
+
+    JSObject* getter = jsCast<GetterSetter*>(getterSetter)->getter();
+
+    CallData callData;
+    CallType callType = getter->methodTable(vm)->getCallData(getter, callData);
+    scope.release();
+    return call(exec, getter, callType, callData, base, ArgList());
+}
+
+bool callSetter(ExecState* exec, JSValue base, JSValue getterSetter, JSValue value, ECMAMode ecmaMode)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    GetterSetter* getterSetterObj = jsCast<GetterSetter*>(getterSetter);
+
+    if (getterSetterObj->isSetterNull())
+        return typeError(exec, scope, ecmaMode == StrictMode, ASCIILiteral(ReadonlyPropertyWriteError));
+
+    JSObject* setter = getterSetterObj->setter();
+
+    MarkedArgumentBuffer args;
+    args.append(value);
+
+    CallData callData;
+    CallType callType = setter->methodTable(vm)->getCallData(setter, callData);
+    scope.release();
+    call(exec, setter, callType, callData, base, args);
+    return true;
+}
+
+} // namespace JSC
diff --git a/runtime/GetterSetter.h b/runtime/GetterSetter.h
new file mode 100644
index 0000000..55a9cce
--- /dev/null
+++ b/runtime/GetterSetter.h
@@ -0,0 +1,153 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2014 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "JSCell.h"
+
+#include "CallFrame.h"
+#include "JSGlobalObject.h"
+#include "NullGetterFunction.h"
+#include "NullSetterFunction.h"
+#include "Structure.h"
+
+namespace JSC {
+
+class JSObject;
+
+// This is an internal value object which stores getter and setter functions
+// for a property. Instances of this class have the property that once a getter
+// or setter is set to a non-null value, then they cannot be changed. This means
+// that if a property holding a GetterSetter reference is constant-inferred and
+// that constant is observed to have a non-null setter (or getter) then we can
+// constant fold that setter (or getter).
+class GetterSetter final : public JSNonFinalObject {
+    friend class JIT;
+    typedef JSNonFinalObject Base;
+private:
+    GetterSetter(VM& vm, JSGlobalObject* globalObject)
+        : Base(vm, globalObject->getterSetterStructure())
+    {
+        m_getter.set(vm, this, globalObject->nullGetterFunction());
+        m_setter.set(vm, this, globalObject->nullSetterFunction());
+    }
+
+public:
+
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | StructureIsImmortal;
+
+    static GetterSetter* create(VM& vm, JSGlobalObject* globalObject)
+    {
+        GetterSetter* getterSetter = new (NotNull, allocateCell<GetterSetter>(vm.heap)) GetterSetter(vm, globalObject);
+        getterSetter->finishCreation(vm);
+        return getterSetter;
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    JSObject* getter() const { return m_getter.get(); }
+
+    JSObject* getterConcurrently() const
+    {
+        JSObject* result = getter();
+        WTF::loadLoadFence();
+        return result;
+    }
+
+    bool isGetterNull() const { return !!jsDynamicCast<NullGetterFunction*>(m_getter.get()); }
+    bool isSetterNull() const { return !!jsDynamicCast<NullSetterFunction*>(m_setter.get()); }
+
+    // Set the getter. It's only valid to call this if you've never set the getter on this
+    // object.
+    void setGetter(VM& vm, JSGlobalObject* globalObject, JSObject* getter)
+    {
+        if (!getter)
+            getter = jsCast<JSObject*>(globalObject->nullGetterFunction());
+
+        RELEASE_ASSERT(isGetterNull());
+        WTF::storeStoreFence();
+        m_getter.set(vm, this, getter);
+    }
+
+    JSObject* setter() const { return m_setter.get(); }
+
+    JSObject* setterConcurrently() const
+    {
+        JSObject* result = setter();
+        WTF::loadLoadFence();
+        return result;
+    }
+
+    // Set the setter. It's only valid to call this if you've never set the setter on this
+    // object.
+    void setSetter(VM& vm, JSGlobalObject* globalObject, JSObject* setter)
+    {
+        if (!setter)
+            setter = jsCast<JSObject*>(globalObject->nullSetterFunction());
+
+        RELEASE_ASSERT(isSetterNull());
+        WTF::storeStoreFence();
+        m_setter.set(vm, this, setter);
+    }
+
+    GetterSetter* withGetter(VM&, JSGlobalObject*, JSObject* getter);
+    GetterSetter* withSetter(VM&, JSGlobalObject*, JSObject* setter);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(GetterSetterType), info());
+    }
+
+    static ptrdiff_t offsetOfGetter()
+    {
+        return OBJECT_OFFSETOF(GetterSetter, m_getter);
+    }
+
+    static ptrdiff_t offsetOfSetter()
+    {
+        return OBJECT_OFFSETOF(GetterSetter, m_setter);
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&) { RELEASE_ASSERT_NOT_REACHED(); return false; }
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&) { RELEASE_ASSERT_NOT_REACHED(); return false; }
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool) { RELEASE_ASSERT_NOT_REACHED(); return false; }
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName) { RELEASE_ASSERT_NOT_REACHED(); return false; }
+
+private:
+    WriteBarrier<JSObject> m_getter;
+    WriteBarrier<JSObject> m_setter;  
+};
+
+GetterSetter* asGetterSetter(JSValue);
+
+inline GetterSetter* asGetterSetter(JSValue value)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(value.asCell()->isGetterSetter());
+    return static_cast<GetterSetter*>(value.asCell());
+}
+
+JSValue callGetter(ExecState*, JSValue base, JSValue getterSetter);
+JS_EXPORT_PRIVATE bool callSetter(ExecState*, JSValue base, JSValue getterSetter, JSValue, ECMAMode);
+
+} // namespace JSC
diff --git a/runtime/HasOwnPropertyCache.h b/runtime/HasOwnPropertyCache.h
new file mode 100644
index 0000000..1bbe6e8
--- /dev/null
+++ b/runtime/HasOwnPropertyCache.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSProxy.h"
+#include "PropertySlot.h"
+#include "Structure.h"
+
+namespace JSC {
+
+class HasOwnPropertyCache {
+    static const uint32_t size = 2 * 1024;
+    static_assert(!(size & (size - 1)), "size should be a power of two.");
+public:
+    static const uint32_t mask = size - 1;
+
+    struct Entry {
+        static ptrdiff_t offsetOfStructureID() { return OBJECT_OFFSETOF(Entry, structureID); }
+        static ptrdiff_t offsetOfImpl() { return OBJECT_OFFSETOF(Entry, impl); }
+        static ptrdiff_t offsetOfResult() { return OBJECT_OFFSETOF(Entry, result); }
+
+        Entry() = default;
+
+        Entry(RefPtr<UniquedStringImpl>&& impl, StructureID structureID, bool result)
+            : impl(WTFMove(impl))
+            , structureID(structureID)
+            , result(result)
+        { }
+
+        Entry& operator=(Entry&& other)
+        {
+            impl = WTFMove(other.impl);
+            structureID = other.structureID;
+            result = other.result;
+            return *this;
+        }
+
+        RefPtr<UniquedStringImpl> impl { };
+        StructureID structureID { 0 };
+        bool result { false };
+    };
+
+    HasOwnPropertyCache() = delete;
+
+    void operator delete(void* cache)
+    {
+        static_cast<HasOwnPropertyCache*>(cache)->clear();
+        fastFree(cache);
+    }
+
+    static HasOwnPropertyCache* create()
+    {
+        size_t allocationSize = sizeof(Entry) * size;
+        HasOwnPropertyCache* result = static_cast<HasOwnPropertyCache*>(fastMalloc(allocationSize));
+        result->clearBuffer();
+        return result;
+    }
+
+    ALWAYS_INLINE static uint32_t hash(StructureID structureID, UniquedStringImpl* impl)
+    {
+        return bitwise_cast<uint32_t>(structureID) + impl->hash();
+    }
+
+    ALWAYS_INLINE std::optional<bool> get(Structure* structure, PropertyName propName)
+    {
+        UniquedStringImpl* impl = propName.uid();
+        StructureID id = structure->id();
+        uint32_t index = HasOwnPropertyCache::hash(id, impl) & mask;
+        Entry& entry = bitwise_cast<Entry*>(this)[index];
+        if (entry.structureID == id && entry.impl.get() == impl)
+            return entry.result;
+        return std::nullopt;
+    }
+
+    ALWAYS_INLINE void tryAdd(VM& vm, PropertySlot& slot, JSObject* object, PropertyName propName, bool result)
+    {
+        if (parseIndex(propName))
+            return;
+
+        if (!slot.isCacheable() && !slot.isUnset())
+            return;
+
+        if (object->type() == PureForwardingProxyType || object->type() == ImpureProxyType)
+            return;
+
+        Structure* structure = object->structure(vm);
+        if (!structure->typeInfo().prohibitsPropertyCaching()
+            && structure->propertyAccessesAreCacheable()
+            && (!slot.isUnset() || structure->propertyAccessesAreCacheableForAbsence())) {
+            if (structure->isDictionary()) {
+                // FIXME: We should be able to flatten a dictionary object again.
+                // https://bugs.webkit.org/show_bug.cgi?id=163092
+                return;
+            }
+
+            ASSERT(!result == slot.isUnset());
+
+            UniquedStringImpl* impl = propName.uid();
+            StructureID id = structure->id();
+            uint32_t index = HasOwnPropertyCache::hash(id, impl) & mask;
+            bitwise_cast<Entry*>(this)[index] = Entry { RefPtr<UniquedStringImpl>(impl), id, result };
+        }
+    }
+
+    void clear()
+    {
+        Entry* buffer = bitwise_cast<Entry*>(this);
+        for (uint32_t i = 0; i < size; ++i)
+            buffer[i].Entry::~Entry();
+
+        clearBuffer();
+    }
+
+private:
+    void clearBuffer()
+    {
+        Entry* buffer = bitwise_cast<Entry*>(this);
+        for (uint32_t i = 0; i < size; ++i)
+            new (&buffer[i]) Entry();
+    }
+};
+
+ALWAYS_INLINE HasOwnPropertyCache* VM::ensureHasOwnPropertyCache()
+{
+    if (UNLIKELY(!m_hasOwnPropertyCache))
+        m_hasOwnPropertyCache = std::unique_ptr<HasOwnPropertyCache>(HasOwnPropertyCache::create());
+    return m_hasOwnPropertyCache.get();
+}
+
+} // namespace JSC
diff --git a/runtime/HashMapImpl.cpp b/runtime/HashMapImpl.cpp
new file mode 100644
index 0000000..a24cc2f
--- /dev/null
+++ b/runtime/HashMapImpl.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HashMapImpl.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+template<>
+const ClassInfo HashMapBucket<HashMapBucketDataKey>::s_info =
+    { "HashMapBucket", nullptr, 0, CREATE_METHOD_TABLE(HashMapBucket<HashMapBucketDataKey>) };
+
+template<>
+const ClassInfo HashMapBucket<HashMapBucketDataKeyValue>::s_info =
+    { "HashMapBucket", nullptr, 0, CREATE_METHOD_TABLE(HashMapBucket<HashMapBucketDataKeyValue>) };
+
+template <typename Data>
+void HashMapBucket<Data>::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    HashMapBucket* thisObject = jsCast<HashMapBucket*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_next);
+    visitor.append(thisObject->m_prev);
+
+    static_assert(sizeof(Data) % sizeof(WriteBarrier<Unknown>) == 0, "We assume that these are filled with WriteBarrier<Unknown> members only.");
+    visitor.appendValues(bitwise_cast<WriteBarrier<Unknown>*>(&thisObject->m_data), sizeof(Data) / sizeof(WriteBarrier<Unknown>));
+}
+
+template<>
+const ClassInfo HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::s_info =
+    { "HashMapImpl", nullptr, 0, CREATE_METHOD_TABLE(HashMapImpl<HashMapBucket<HashMapBucketDataKey>>) };
+
+template<>
+const ClassInfo HashMapImpl<HashMapBucket<HashMapBucketDataKeyValue>>::s_info =
+    { "HashMapImpl", nullptr, 0, CREATE_METHOD_TABLE(HashMapImpl<HashMapBucket<HashMapBucketDataKeyValue>>) };
+
+template <typename HashMapBucket>
+void HashMapImpl<HashMapBucket>::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    HashMapImpl* thisObject = jsCast<HashMapImpl*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_head);
+    visitor.append(thisObject->m_tail);
+    
+    if (HashMapBufferType* buffer = thisObject->m_buffer.get())
+        visitor.markAuxiliary(buffer);
+}
+
+const ClassInfo* getHashMapBucketKeyClassInfo()
+{
+    return &HashMapBucket<HashMapBucketDataKey>::s_info;
+}
+const ClassInfo* getHashMapBucketKeyValueClassInfo()
+{
+    return &HashMapBucket<HashMapBucketDataKeyValue>::s_info;
+}
+const ClassInfo* getHashMapImplKeyClassInfo()
+{
+    return &HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::s_info;
+}
+const ClassInfo* getHashMapImplKeyValueClassInfo()
+{
+    return &HashMapImpl<HashMapBucket<HashMapBucketDataKeyValue>>::s_info;
+}
+
+} // namespace JSC
diff --git a/runtime/HashMapImpl.h b/runtime/HashMapImpl.h
new file mode 100644
index 0000000..fbeb72f
--- /dev/null
+++ b/runtime/HashMapImpl.h
@@ -0,0 +1,638 @@
+/*
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ExceptionHelpers.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+JS_EXPORT_PRIVATE const ClassInfo* getHashMapBucketKeyClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getHashMapBucketKeyValueClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getHashMapImplKeyClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getHashMapImplKeyValueClassInfo();
+
+enum class HashTableType {
+    Key,
+    KeyValue
+};
+
+struct HashMapBucketDataKey {
+    static const HashTableType Type = HashTableType::Key;
+    WriteBarrier<Unknown> key;
+};
+
+struct HashMapBucketDataKeyValue {
+    static const HashTableType Type = HashTableType::KeyValue;
+    WriteBarrier<Unknown> key;
+    WriteBarrier<Unknown> value;
+};
+
+template <typename Data>
+class HashMapBucket : public JSCell {
+    typedef JSCell Base;
+
+    template <typename T = Data>
+    static typename std::enable_if<std::is_same<T, HashMapBucketDataKey>::value, Structure*>::type selectStructure(VM& vm)
+    {
+        return vm.hashMapBucketSetStructure.get();
+    }
+
+    template <typename T = Data>
+    static typename std::enable_if<std::is_same<T, HashMapBucketDataKeyValue>::value, Structure*>::type selectStructure(VM& vm)
+    {
+        return vm.hashMapBucketMapStructure.get();
+    }
+
+public:
+    static const HashTableType Type = Data::Type;
+    static const ClassInfo s_info; // This is never accessed directly, since that would break linkage on some compilers.
+
+    static const ClassInfo* info()
+    {
+        switch (Type) {
+        case HashTableType::Key:
+            return getHashMapBucketKeyClassInfo();
+        case HashTableType::KeyValue:
+            return getHashMapBucketKeyValueClassInfo();
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    static HashMapBucket* create(VM& vm)
+    {
+        HashMapBucket* bucket = new (NotNull, allocateCell<HashMapBucket<Data>>(vm.heap)) HashMapBucket(vm, selectStructure(vm));
+        bucket->finishCreation(vm);
+        ASSERT(!bucket->next());
+        ASSERT(!bucket->prev());
+        return bucket;
+    }
+
+    HashMapBucket(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    { }
+
+    ALWAYS_INLINE void setNext(VM& vm, HashMapBucket* bucket)
+    {
+        m_next.set(vm, this, bucket);
+    }
+    ALWAYS_INLINE void setPrev(VM& vm, HashMapBucket* bucket)
+    {
+        m_prev.set(vm, this, bucket);
+    }
+
+    ALWAYS_INLINE void setKey(VM& vm, JSValue key)
+    {
+        m_data.key.set(vm, this, key);
+    }
+
+    template <typename T = Data>
+    ALWAYS_INLINE typename std::enable_if<std::is_same<T, HashMapBucketDataKeyValue>::value>::type setValue(VM& vm, JSValue value)
+    {
+        m_data.value.set(vm, this, value);
+    }
+    template <typename T = Data>
+    ALWAYS_INLINE typename std::enable_if<std::is_same<T, HashMapBucketDataKey>::value>::type setValue(VM&, JSValue) { }
+
+    ALWAYS_INLINE JSValue key() const { return m_data.key.get(); }
+
+    template <typename T = Data>
+    ALWAYS_INLINE typename std::enable_if<std::is_same<T, HashMapBucketDataKeyValue>::value, JSValue>::type value() const
+    {
+        return m_data.value.get();
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    ALWAYS_INLINE HashMapBucket* next() const { return m_next.get(); }
+    ALWAYS_INLINE HashMapBucket* prev() const { return m_prev.get(); }
+
+    ALWAYS_INLINE bool deleted() const { return m_deleted; }
+    ALWAYS_INLINE void setDeleted(bool deleted) { m_deleted = deleted; }
+
+    static ptrdiff_t offsetOfKey()
+    {
+        return OBJECT_OFFSETOF(HashMapBucket, m_data) + OBJECT_OFFSETOF(Data, key);
+    }
+
+    template <typename T = Data>
+    static typename std::enable_if<std::is_same<T, HashMapBucketDataKeyValue>::value, ptrdiff_t>::type offsetOfValue()
+    {
+        return OBJECT_OFFSETOF(HashMapBucket, m_data) + OBJECT_OFFSETOF(Data, value);
+    }
+
+private:
+    Data m_data;
+    WriteBarrier<HashMapBucket> m_next;
+    WriteBarrier<HashMapBucket> m_prev;
+    bool m_deleted { false };
+};
+
+template <typename BucketType>
+class HashMapBuffer {
+public:
+    HashMapBuffer() = delete;
+
+    static size_t allocationSize(uint32_t capacity)
+    {
+        return capacity * sizeof(BucketType*);
+    }
+
+    ALWAYS_INLINE BucketType** buffer() const
+    {
+        return bitwise_cast<BucketType**>(this);
+    }
+
+    static HashMapBuffer* create(ExecState* exec, VM& vm, JSCell*, uint32_t capacity)
+    {
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        size_t allocationSize = HashMapBuffer::allocationSize(capacity);
+        void* data = vm.auxiliarySpace.tryAllocate(allocationSize);
+        if (!data) {
+            throwOutOfMemoryError(exec, scope);
+            return nullptr;
+        }
+
+        HashMapBuffer* buffer = static_cast<HashMapBuffer*>(data);
+        buffer->reset(capacity);
+        return buffer;
+    }
+
+    ALWAYS_INLINE void reset(uint32_t capacity)
+    {
+        memset(this, -1, allocationSize(capacity));
+    }
+};
+
+ALWAYS_INLINE static bool areKeysEqual(ExecState* exec, JSValue a, JSValue b)
+{
+    // We want +0 and -0 to be compared to true here. sameValue() itself doesn't
+    // guarantee that, however, we normalize all keys before comparing and storing
+    // them in the map. The normalization will convert -0.0 and 0.0 to the integer
+    // representation for 0.
+    return sameValue(exec, a, b);
+}
+
+ALWAYS_INLINE JSValue normalizeMapKey(JSValue key)
+{
+    if (!key.isNumber())
+        return key;
+
+    if (key.isInt32())
+        return key;
+
+    double d = key.asDouble();
+    if (std::isnan(d))
+        return key;
+
+    int i = static_cast<int>(d);
+    if (i == d) {
+        // When a key is -0, we convert it to positive zero.
+        // When a key is the double representation for an integer, we convert it to an integer.
+        return jsNumber(i);
+    }
+    // This means key is definitely not negative zero, and it's definitely not a double representation of an integer. 
+    return key;
+}
+
+static ALWAYS_INLINE uint32_t wangsInt64Hash(uint64_t key)
+{
+    key += ~(key << 32);
+    key ^= (key >> 22);
+    key += ~(key << 13);
+    key ^= (key >> 8);
+    key += (key << 3);
+    key ^= (key >> 15);
+    key += ~(key << 27);
+    key ^= (key >> 31);
+    return static_cast<unsigned>(key);
+}
+
+ALWAYS_INLINE uint32_t jsMapHash(ExecState* exec, VM& vm, JSValue value)
+{
+    ASSERT_WITH_MESSAGE(normalizeMapKey(value) == value, "We expect normalized values flowing into this function.");
+
+    if (value.isString()) {
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        const String& wtfString = asString(value)->value(exec);
+        RETURN_IF_EXCEPTION(scope, UINT_MAX);
+        return wtfString.impl()->hash();
+    }
+
+    return wangsInt64Hash(JSValue::encode(value));
+}
+
+ALWAYS_INLINE std::optional<uint32_t> concurrentJSMapHash(JSValue key)
+{
+    key = normalizeMapKey(key);
+    if (key.isString()) {
+        JSString* string = asString(key);
+        if (string->length() > 10 * 1024)
+            return std::nullopt;
+        const StringImpl* impl = string->tryGetValueImpl();
+        if (!impl)
+            return std::nullopt;
+        return impl->concurrentHash();
+    }
+
+    uint64_t rawValue = JSValue::encode(key);
+    return wangsInt64Hash(rawValue);
+}
+
+template <typename HashMapBucketType>
+class HashMapImpl : public JSCell {
+    typedef JSCell Base;
+    typedef HashMapBuffer<HashMapBucketType> HashMapBufferType;
+
+    template <typename T = HashMapBucketType>
+    static typename std::enable_if<std::is_same<T, HashMapBucket<HashMapBucketDataKey>>::value, Structure*>::type selectStructure(VM& vm)
+    {
+        return vm.hashMapImplSetStructure.get();
+    }
+
+    template <typename T = HashMapBucketType>
+    static typename std::enable_if<std::is_same<T, HashMapBucket<HashMapBucketDataKeyValue>>::value, Structure*>::type selectStructure(VM& vm)
+    {
+        return vm.hashMapImplMapStructure.get();
+    }
+
+public:
+    static const ClassInfo s_info; // This is never accessed directly, since that would break linkage on some compilers.
+
+    static const ClassInfo* info()
+    {
+        switch (HashMapBucketType::Type) {
+        case HashTableType::Key:
+            return getHashMapImplKeyClassInfo();
+        case HashTableType::KeyValue:
+            return getHashMapImplKeyValueClassInfo();
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    static HashMapImpl* create(ExecState* exec, VM& vm)
+    {
+        ASSERT_WITH_MESSAGE(HashMapBucket<HashMapBucketDataKey>::offsetOfKey() == HashMapBucket<HashMapBucketDataKeyValue>::offsetOfKey(), "We assume this to be true in the DFG and FTL JIT.");
+
+        HashMapImpl* impl = new (NotNull, allocateCell<HashMapImpl>(vm.heap)) HashMapImpl(vm, selectStructure(vm));
+        impl->finishCreation(exec, vm);
+        return impl;
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    HashMapImpl(VM& vm, Structure* structure)
+        : Base(vm, structure)
+        , m_keyCount(0)
+        , m_deleteCount(0)
+        , m_capacity(4)
+    {
+    }
+
+    ALWAYS_INLINE HashMapBucketType** buffer() const
+    {
+        return m_buffer.get()->buffer();
+    }
+
+    void finishCreation(ExecState* exec, VM& vm)
+    {
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        Base::finishCreation(vm);
+
+        makeAndSetNewBuffer(exec, vm);
+        RETURN_IF_EXCEPTION(scope, void());
+
+        m_head.set(vm, this, HashMapBucketType::create(vm));
+        m_tail.set(vm, this, HashMapBucketType::create(vm));
+
+        m_head->setNext(vm, m_tail.get());
+        m_tail->setPrev(vm, m_head.get());
+        m_head->setDeleted(true);
+        m_tail->setDeleted(true);
+
+    }
+
+    static HashMapBucketType* emptyValue()
+    {
+        return bitwise_cast<HashMapBucketType*>(static_cast<uintptr_t>(-1));
+    }
+
+    static ALWAYS_INLINE bool isEmpty(HashMapBucketType* bucket)
+    {
+        return bucket == emptyValue();
+    }
+
+    static HashMapBucketType* deletedValue()
+    {
+        return bitwise_cast<HashMapBucketType*>(static_cast<uintptr_t>(-3));
+    }
+
+    static ALWAYS_INLINE bool isDeleted(HashMapBucketType* bucket)
+    {
+        return bucket == deletedValue();
+    }
+
+    ALWAYS_INLINE HashMapBucketType** findBucket(ExecState* exec, JSValue key)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        key = normalizeMapKey(key);
+        uint32_t hash = jsMapHash(exec, vm, key);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        return findBucket(exec, key, hash);
+    }
+
+    ALWAYS_INLINE HashMapBucketType** findBucket(ExecState* exec, JSValue key, uint32_t hash)
+    {
+        ASSERT_WITH_MESSAGE(normalizeMapKey(key) == key, "We expect normalized values flowing into this function.");
+        return findBucketAlreadyHashedAndNormalized(exec, key, hash);
+    }
+
+    ALWAYS_INLINE JSValue get(ExecState* exec, JSValue key)
+    {
+        if (HashMapBucketType** bucket = findBucket(exec, key))
+            return (*bucket)->value();
+        return jsUndefined();
+    }
+
+    ALWAYS_INLINE bool has(ExecState* exec, JSValue key)
+    {
+        return !!findBucket(exec, key);
+    }
+
+    ALWAYS_INLINE void add(ExecState* exec, JSValue key, JSValue value = JSValue())
+    {
+        key = normalizeMapKey(key);
+
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        const uint32_t mask = m_capacity - 1;
+        uint32_t index = jsMapHash(exec, vm, key) & mask;
+        RETURN_IF_EXCEPTION(scope, void());
+        HashMapBucketType** buffer = this->buffer();
+        HashMapBucketType* bucket = buffer[index];
+        while (!isEmpty(bucket)) {
+            if (!isDeleted(bucket) && areKeysEqual(exec, key, bucket->key())) {
+                bucket->setValue(vm, value);
+                return;
+            }
+            index = (index + 1) & mask;
+            bucket = buffer[index];
+        }
+
+        HashMapBucketType* newEntry = m_tail.get();
+        buffer[index] = newEntry;
+        newEntry->setKey(vm, key);
+        newEntry->setValue(vm, value);
+        newEntry->setDeleted(false);
+        HashMapBucketType* newTail = HashMapBucketType::create(vm);
+        m_tail.set(vm, this, newTail);
+        newTail->setPrev(vm, newEntry);
+        newTail->setDeleted(true);
+        newEntry->setNext(vm, newTail);
+
+        ++m_keyCount;
+
+        if (shouldRehashAfterAdd())
+            rehash(exec);
+    }
+
+    ALWAYS_INLINE bool remove(ExecState* exec, JSValue key)
+    {
+        HashMapBucketType** bucket = findBucket(exec, key);
+        if (!bucket)
+            return false;
+
+        VM& vm = exec->vm();
+        HashMapBucketType* impl = *bucket;
+        impl->next()->setPrev(vm, impl->prev());
+        impl->prev()->setNext(vm, impl->next());
+        impl->setDeleted(true);
+
+        *bucket = deletedValue();
+
+        ++m_deleteCount;
+        ASSERT(m_keyCount > 0);
+        --m_keyCount;
+
+        if (shouldShrink())
+            rehash(exec);
+
+        return true;
+    }
+
+    ALWAYS_INLINE uint32_t size() const
+    {
+        return m_keyCount;
+    }
+
+    ALWAYS_INLINE void clear(ExecState* exec)
+    {
+        VM& vm = exec->vm();
+        m_keyCount = 0;
+        m_deleteCount = 0;
+        HashMapBucketType* head = m_head.get();
+        HashMapBucketType* bucket = m_head->next();
+        HashMapBucketType* tail = m_tail.get();
+        while (bucket != tail) {
+            HashMapBucketType* next = bucket->next();
+            // We restart each iterator by pointing it to the head of the list.
+            bucket->setNext(vm, head);
+            bucket->setDeleted(true);
+            bucket = next;
+        }
+        m_head->setNext(vm, m_tail.get());
+        m_tail->setPrev(vm, m_head.get());
+        m_capacity = 4;
+        makeAndSetNewBuffer(exec, vm);
+        checkConsistency();
+    }
+
+    ALWAYS_INLINE size_t bufferSizeInBytes() const
+    {
+        return m_capacity * sizeof(HashMapBucketType*);
+    }
+
+    static ptrdiff_t offsetOfBuffer()
+    {
+        return OBJECT_OFFSETOF(HashMapImpl<HashMapBucketType>, m_buffer);
+    }
+
+    static ptrdiff_t offsetOfCapacity()
+    {
+        return OBJECT_OFFSETOF(HashMapImpl<HashMapBucketType>, m_capacity);
+    }
+
+    HashMapBucketType* head() { return m_head.get(); }
+    HashMapBucketType* tail() { return m_tail.get(); }
+
+    size_t approximateSize() const
+    {
+        size_t size = sizeof(HashMapImpl);
+        size += bufferSizeInBytes();
+        size += 2 * sizeof(HashMapBucketType); // Head and tail members.
+        size += m_keyCount * sizeof(HashMapBucketType); // Number of members that are on the list.
+        return size;
+    }
+
+private:
+    ALWAYS_INLINE uint32_t shouldRehashAfterAdd() const
+    {
+        return 2 * (m_keyCount + m_deleteCount) >= m_capacity;
+    }
+
+    ALWAYS_INLINE uint32_t shouldShrink() const
+    {
+        return 8 * m_keyCount <= m_capacity && m_capacity > 4;
+    }
+
+    ALWAYS_INLINE HashMapBucketType** findBucketAlreadyHashedAndNormalized(ExecState* exec, JSValue key, uint32_t hash)
+    {
+        const uint32_t mask = m_capacity - 1;
+        uint32_t index = hash & mask;
+        HashMapBucketType** buffer = this->buffer();
+        HashMapBucketType* bucket = buffer[index];
+
+        while (!isEmpty(bucket)) {
+            if (!isDeleted(bucket) && areKeysEqual(exec, key, bucket->key()))
+                return buffer + index;
+            index = (index + 1) & mask;
+            bucket = buffer[index];
+        }
+        return nullptr;
+    }
+
+    void rehash(ExecState* exec)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        uint32_t oldCapacity = m_capacity;
+        if (shouldShrink()) {
+            m_capacity = m_capacity / 2;
+            ASSERT(m_capacity >= 4);
+        } else if (3 * m_keyCount <= m_capacity && m_capacity > 64) {
+            // We stay at the same size if rehashing would cause us to be no more than
+            // 1/3rd full. This comes up for programs like this:
+            // Say the hash table grew to a key count of 64, causing it to grow to a capacity of 256.
+            // Then, the table added 63 items. The load is now 127. Then, 63 items are deleted.
+            // The load is still 127. Then, another item is added. The load is now 128, and we
+            // decide that we need to rehash. The key count is 65, almost exactly what it was
+            // when we grew to a capacity of 256. We don't really need to grow to a capacity
+            // of 512 in this situation. Instead, we choose to rehash at the same size. This
+            // will bring the load down to 65. We rehash into the same size when we determine
+            // that the new load ratio will be under 1/3rd. (We also pick a minumum capacity
+            // at which this rule kicks in because otherwise we will be too sensitive to rehashing
+            // at the same capacity).
+        } else
+            m_capacity = (Checked<uint32_t>(m_capacity) * 2).unsafeGet();
+
+        if (m_capacity != oldCapacity) {
+            makeAndSetNewBuffer(exec, vm);
+            RETURN_IF_EXCEPTION(scope, void());
+        } else {
+            m_buffer.get()->reset(m_capacity);
+            assertBufferIsEmpty();
+        }
+
+        HashMapBucketType* iter = m_head->next();
+        HashMapBucketType* end = m_tail.get();
+        const uint32_t mask = m_capacity - 1;
+        RELEASE_ASSERT(!(m_capacity & (m_capacity - 1)));
+        HashMapBucketType** buffer = this->buffer();
+        while (iter != end) {
+            uint32_t index = jsMapHash(exec, vm, iter->key()) & mask;
+            ASSERT_WITH_MESSAGE(!scope.exception(), "All keys should already be hashed before, so this should not throw because it won't resolve ropes.");
+            {
+                HashMapBucketType* bucket = buffer[index];
+                while (!isEmpty(bucket)) {
+                    index = (index + 1) & mask;
+                    bucket = buffer[index];
+                }
+            }
+            buffer[index] = iter;
+            iter = iter->next();
+        }
+
+        m_deleteCount = 0;
+
+        checkConsistency();
+    }
+
+    ALWAYS_INLINE void checkConsistency() const
+    {
+        if (!ASSERT_DISABLED) {
+            HashMapBucketType* iter = m_head->next();
+            HashMapBucketType* end = m_tail.get();
+            uint32_t size = 0;
+            while (iter != end) {
+                ++size;
+                iter = iter->next();
+            }
+            ASSERT(size == m_keyCount);
+        }
+    }
+
+    void makeAndSetNewBuffer(ExecState* exec, VM& vm)
+    {
+        ASSERT(!(m_capacity & (m_capacity - 1)));
+
+        HashMapBufferType* buffer = HashMapBufferType::create(exec, vm, this, m_capacity);
+        if (UNLIKELY(!buffer))
+            return;
+
+        m_buffer.set(vm, this, buffer);
+        assertBufferIsEmpty();
+    }
+
+    ALWAYS_INLINE void assertBufferIsEmpty() const
+    {
+        if (!ASSERT_DISABLED) {
+            for (unsigned i = 0; i < m_capacity; i++)
+                ASSERT(isEmpty(buffer()[i]));
+        }
+    }
+
+    WriteBarrier<HashMapBucketType> m_head;
+    WriteBarrier<HashMapBucketType> m_tail;
+    AuxiliaryBarrier<HashMapBufferType*> m_buffer;
+    uint32_t m_keyCount;
+    uint32_t m_deleteCount;
+    uint32_t m_capacity;
+};
+
+} // namespace JSC
diff --git a/runtime/Identifier.cpp b/runtime/Identifier.cpp
new file mode 100644
index 0000000..b0c5c3e
--- /dev/null
+++ b/runtime/Identifier.cpp
@@ -0,0 +1,130 @@
+/*
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2012 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Identifier.h"
+
+#include "CallFrame.h"
+#include "JSObject.h"
+#include "JSScope.h"
+#include "NumericStrings.h"
+#include "JSCInlines.h"
+#include <new>
+#include <string.h>
+#include <wtf/Assertions.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/text/ASCIIFastPath.h>
+#include <wtf/text/StringHash.h>
+
+using WTF::ThreadSpecific;
+
+namespace JSC {
+
+Ref<StringImpl> Identifier::add(VM* vm, const char* c)
+{
+    ASSERT(c);
+    ASSERT(c[0]);
+    if (!c[1])
+        return *vm->smallStrings.singleCharacterStringRep(c[0]);
+
+    return *AtomicStringImpl::add(c);
+}
+
+Ref<StringImpl> Identifier::add(ExecState* exec, const char* c)
+{
+    return add(&exec->vm(), c);
+}
+
+Ref<StringImpl> Identifier::add8(VM* vm, const UChar* s, int length)
+{
+    if (length == 1) {
+        UChar c = s[0];
+        ASSERT(c <= 0xff);
+        if (canUseSingleCharacterString(c))
+            return *vm->smallStrings.singleCharacterStringRep(c);
+    }
+    if (!length)
+        return *StringImpl::empty();
+
+    return *AtomicStringImpl::add(s, length);
+}
+
+Identifier Identifier::from(ExecState* exec, unsigned value)
+{
+    return Identifier(exec, exec->vm().numericStrings.add(value));
+}
+
+Identifier Identifier::from(ExecState* exec, int value)
+{
+    return Identifier(exec, exec->vm().numericStrings.add(value));
+}
+
+Identifier Identifier::from(ExecState* exec, double value)
+{
+    return Identifier(exec, exec->vm().numericStrings.add(value));
+}
+
+Identifier Identifier::from(VM* vm, unsigned value)
+{
+    return Identifier(vm, vm->numericStrings.add(value));
+}
+
+Identifier Identifier::from(VM* vm, int value)
+{
+    return Identifier(vm, vm->numericStrings.add(value));
+}
+
+Identifier Identifier::from(VM* vm, double value)
+{
+    return Identifier(vm, vm->numericStrings.add(value));
+}
+
+void Identifier::dump(PrintStream& out) const
+{
+    if (impl())
+        out.print(impl());
+    else
+        out.print("<null identifier>");
+}
+
+#ifndef NDEBUG
+
+void Identifier::checkCurrentAtomicStringTable(VM* vm)
+{
+    // Check the identifier table accessible through the threadspecific matches the
+    // vm's identifier table.
+    ASSERT_UNUSED(vm, vm->atomicStringTable() == wtfThreadData().atomicStringTable());
+}
+
+void Identifier::checkCurrentAtomicStringTable(ExecState* exec)
+{
+    checkCurrentAtomicStringTable(&exec->vm());
+}
+
+#else
+
+// These only exists so that our exports are the same for debug and release builds.
+// This would be an RELEASE_ASSERT_NOT_REACHED(), but we're in NDEBUG only code here!
+NO_RETURN_DUE_TO_CRASH void Identifier::checkCurrentAtomicStringTable(VM*) { CRASH(); }
+NO_RETURN_DUE_TO_CRASH void Identifier::checkCurrentAtomicStringTable(ExecState*) { CRASH(); }
+
+#endif
+
+} // namespace JSC
diff --git a/runtime/Identifier.h b/runtime/Identifier.h
new file mode 100644
index 0000000..25e16ae
--- /dev/null
+++ b/runtime/Identifier.h
@@ -0,0 +1,313 @@
+/*
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "VM.h"
+#include <wtf/Optional.h>
+#include <wtf/ThreadSpecific.h>
+#include <wtf/WTFThreadData.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/UniquedStringImpl.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class ExecState;
+
+ALWAYS_INLINE bool isIndex(uint32_t index)
+{
+    return index != 0xFFFFFFFFU;
+}
+
+template <typename CharType>
+ALWAYS_INLINE std::optional<uint32_t> parseIndex(const CharType* characters, unsigned length)
+{
+    // An empty string is not a number.
+    if (!length)
+        return std::nullopt;
+
+    // Get the first character, turning it into a digit.
+    uint32_t value = characters[0] - '0';
+    if (value > 9)
+        return std::nullopt;
+
+    // Check for leading zeros. If the first characher is 0, then the
+    // length of the string must be one - e.g. "042" is not equal to "42".
+    if (!value && length > 1)
+        return std::nullopt;
+
+    while (--length) {
+        // Multiply value by 10, checking for overflow out of 32 bits.
+        if (value > 0xFFFFFFFFU / 10)
+            return std::nullopt;
+        value *= 10;
+
+        // Get the next character, turning it into a digit.
+        uint32_t newValue = *(++characters) - '0';
+        if (newValue > 9)
+            return std::nullopt;
+
+        // Add in the old value, checking for overflow out of 32 bits.
+        newValue += value;
+        if (newValue < value)
+            return std::nullopt;
+        value = newValue;
+    }
+
+    if (!isIndex(value))
+        return std::nullopt;
+    return value;
+}
+
+ALWAYS_INLINE std::optional<uint32_t> parseIndex(StringImpl& impl)
+{
+    if (impl.is8Bit())
+        return parseIndex(impl.characters8(), impl.length());
+    return parseIndex(impl.characters16(), impl.length());
+}
+
+class Identifier {
+    friend class Structure;
+public:
+    Identifier() { }
+    enum EmptyIdentifierFlag { EmptyIdentifier };
+    Identifier(EmptyIdentifierFlag) : m_string(StringImpl::empty()) { ASSERT(m_string.impl()->isAtomic()); }
+
+    const String& string() const { return m_string; }
+    UniquedStringImpl* impl() const { return static_cast<UniquedStringImpl*>(m_string.impl()); }
+
+    int length() const { return m_string.length(); }
+
+    CString ascii() const { return m_string.ascii(); }
+    CString utf8() const { return m_string.utf8(); }
+
+    // There's 2 functions to construct Identifier from string, (1) fromString and (2) fromUid.
+    // They have different meanings in keeping or discarding symbol-ness of strings.
+    // (1): fromString
+    // Just construct Identifier from string. String held by Identifier is always atomized.
+    // Symbol-ness of StringImpl*, which represents that the string is inteded to be used for ES6 Symbols, is discarded.
+    // So a constructed Identifier never represents a symbol.
+    // (2): fromUid
+    // `StringImpl* uid` represents ether String or Symbol property.
+    // fromUid keeps symbol-ness of provided StringImpl* while fromString discards it.
+    // Use fromUid when constructing Identifier from StringImpl* which may represent symbols.
+
+    // Only to be used with string literals.
+    template<unsigned charactersCount>
+    static Identifier fromString(VM*, const char (&characters)[charactersCount]);
+    template<unsigned charactersCount>
+    static Identifier fromString(ExecState*, const char (&characters)[charactersCount]);
+    static Identifier fromString(VM*, const LChar*, int length);
+    static Identifier fromString(VM*, const UChar*, int length);
+    static Identifier fromString(VM*, const String&);
+    static Identifier fromString(ExecState*, AtomicStringImpl*);
+    static Identifier fromString(ExecState*, const AtomicString&);
+    static Identifier fromString(ExecState*, const String&);
+    static Identifier fromString(ExecState*, const char*);
+
+    static Identifier fromUid(VM*, UniquedStringImpl* uid);
+    static Identifier fromUid(ExecState*, UniquedStringImpl* uid);
+    static Identifier fromUid(const PrivateName&);
+
+    static Identifier createLCharFromUChar(VM* vm, const UChar* s, int length) { return Identifier(vm, add8(vm, s, length)); }
+
+    JS_EXPORT_PRIVATE static Identifier from(ExecState*, unsigned y);
+    JS_EXPORT_PRIVATE static Identifier from(ExecState*, int y);
+    static Identifier from(ExecState*, double y);
+    static Identifier from(VM*, unsigned y);
+    static Identifier from(VM*, int y);
+    static Identifier from(VM*, double y);
+
+    bool isNull() const { return m_string.isNull(); }
+    bool isEmpty() const { return m_string.isEmpty(); }
+    bool isSymbol() const { return !isNull() && impl()->isSymbol(); }
+
+    friend bool operator==(const Identifier&, const Identifier&);
+    friend bool operator!=(const Identifier&, const Identifier&);
+
+    friend bool operator==(const Identifier&, const LChar*);
+    friend bool operator==(const Identifier&, const char*);
+    friend bool operator!=(const Identifier&, const LChar*);
+    friend bool operator!=(const Identifier&, const char*);
+
+    static bool equal(const StringImpl*, const LChar*);
+    static inline bool equal(const StringImpl*a, const char*b) { return Identifier::equal(a, reinterpret_cast<const LChar*>(b)); };
+    static bool equal(const StringImpl*, const LChar*, unsigned length);
+    static bool equal(const StringImpl*, const UChar*, unsigned length);
+    static bool equal(const StringImpl* a, const StringImpl* b) { return ::equal(a, b); }
+
+    // Only to be used with string literals.
+    JS_EXPORT_PRIVATE static Ref<StringImpl> add(VM*, const char*);
+    JS_EXPORT_PRIVATE static Ref<StringImpl> add(ExecState*, const char*);
+
+    void dump(PrintStream&) const;
+
+private:
+    String m_string;
+
+    // Only to be used with string literals.
+    template<unsigned charactersCount>
+    Identifier(VM* vm, const char (&characters)[charactersCount]) : m_string(add(vm, characters)) { ASSERT(m_string.impl()->isAtomic()); }
+
+    Identifier(VM* vm, const LChar* s, int length) : m_string(add(vm, s, length)) { ASSERT(m_string.impl()->isAtomic()); }
+    Identifier(VM* vm, const UChar* s, int length) : m_string(add(vm, s, length)) { ASSERT(m_string.impl()->isAtomic()); }
+    Identifier(ExecState*, AtomicStringImpl*);
+    Identifier(ExecState*, const AtomicString&);
+    Identifier(VM* vm, const String& string) : m_string(add(vm, string.impl())) { ASSERT(m_string.impl()->isAtomic()); }
+    Identifier(VM* vm, StringImpl* rep) : m_string(add(vm, rep)) { ASSERT(m_string.impl()->isAtomic()); }
+
+    Identifier(SymbolImpl& uid)
+        : m_string(&uid)
+    {
+    }
+
+    template <typename CharType>
+    ALWAYS_INLINE static uint32_t toUInt32FromCharacters(const CharType* characters, unsigned length, bool& ok);
+
+    static bool equal(const Identifier& a, const Identifier& b) { return a.m_string.impl() == b.m_string.impl(); }
+    static bool equal(const Identifier& a, const LChar* b) { return equal(a.m_string.impl(), b); }
+
+    template <typename T> static Ref<StringImpl> add(VM*, const T*, int length);
+    static Ref<StringImpl> add8(VM*, const UChar*, int length);
+    template <typename T> ALWAYS_INLINE static bool canUseSingleCharacterString(T);
+
+    static Ref<StringImpl> add(ExecState*, StringImpl*);
+    static Ref<StringImpl> add(VM*, StringImpl*);
+
+#ifndef NDEBUG
+    JS_EXPORT_PRIVATE static void checkCurrentAtomicStringTable(ExecState*);
+    JS_EXPORT_PRIVATE static void checkCurrentAtomicStringTable(VM*);
+#else
+    JS_EXPORT_PRIVATE NO_RETURN_DUE_TO_CRASH static void checkCurrentAtomicStringTable(ExecState*);
+    JS_EXPORT_PRIVATE NO_RETURN_DUE_TO_CRASH static void checkCurrentAtomicStringTable(VM*);
+#endif
+};
+
+template <> ALWAYS_INLINE bool Identifier::canUseSingleCharacterString(LChar)
+{
+    ASSERT(maxSingleCharacterString == 0xff);
+    return true;
+}
+
+template <> ALWAYS_INLINE bool Identifier::canUseSingleCharacterString(UChar c)
+{
+    return (c <= maxSingleCharacterString);
+}
+
+template <typename T>
+Ref<StringImpl> Identifier::add(VM* vm, const T* s, int length)
+{
+    if (length == 1) {
+        T c = s[0];
+        if (canUseSingleCharacterString(c))
+            return *vm->smallStrings.singleCharacterStringRep(c);
+    }
+    if (!length)
+        return *StringImpl::empty();
+
+    return *AtomicStringImpl::add(s, length);
+}
+
+inline bool operator==(const Identifier& a, const Identifier& b)
+{
+    return Identifier::equal(a, b);
+}
+
+inline bool operator!=(const Identifier& a, const Identifier& b)
+{
+    return !Identifier::equal(a, b);
+}
+
+inline bool operator==(const Identifier& a, const LChar* b)
+{
+    return Identifier::equal(a, b);
+}
+
+inline bool operator==(const Identifier& a, const char* b)
+{
+    return Identifier::equal(a, reinterpret_cast<const LChar*>(b));
+}
+
+inline bool operator!=(const Identifier& a, const LChar* b)
+{
+    return !Identifier::equal(a, b);
+}
+
+inline bool operator!=(const Identifier& a, const char* b)
+{
+    return !Identifier::equal(a, reinterpret_cast<const LChar*>(b));
+}
+
+inline bool Identifier::equal(const StringImpl* r, const LChar* s)
+{
+    return WTF::equal(r, s);
+}
+
+inline bool Identifier::equal(const StringImpl* r, const LChar* s, unsigned length)
+{
+    return WTF::equal(r, s, length);
+}
+
+inline bool Identifier::equal(const StringImpl* r, const UChar* s, unsigned length)
+{
+    return WTF::equal(r, s, length);
+}
+
+ALWAYS_INLINE std::optional<uint32_t> parseIndex(const Identifier& identifier)
+{
+    auto uid = identifier.impl();
+    if (!uid)
+        return std::nullopt;
+    if (uid->isSymbol())
+        return std::nullopt;
+    return parseIndex(*uid);
+}
+
+JSValue identifierToJSValue(VM&, const Identifier&);
+// This will stringify private symbols. When leaking JSValues to
+// non-internal code, make sure to use this function and not the above one.
+JSValue identifierToSafePublicJSValue(VM&, const Identifier&);
+
+// FIXME: It may be better for this to just be a typedef for PtrHash, since PtrHash may be cheaper to
+// compute than loading the StringImpl's hash from memory. That change would also reduce the likelihood of
+// crashes in code that somehow dangled a StringImpl.
+// https://bugs.webkit.org/show_bug.cgi?id=150137
+struct IdentifierRepHash : PtrHash<RefPtr<UniquedStringImpl>> {
+    static unsigned hash(const RefPtr<UniquedStringImpl>& key) { return key->existingSymbolAwareHash(); }
+    static unsigned hash(UniquedStringImpl* key) { return key->existingSymbolAwareHash(); }
+};
+
+struct IdentifierMapIndexHashTraits : HashTraits<int> {
+    static int emptyValue() { return std::numeric_limits<int>::max(); }
+    static const bool emptyValueIsZero = false;
+};
+
+typedef HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> IdentifierSet;
+typedef HashMap<RefPtr<UniquedStringImpl>, int, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, IdentifierMapIndexHashTraits> IdentifierMap;
+typedef HashMap<UniquedStringImpl*, int, IdentifierRepHash, HashTraits<UniquedStringImpl*>, IdentifierMapIndexHashTraits> BorrowedIdentifierMap;
+
+} // namespace JSC
+
+namespace WTF {
+
+template <> struct VectorTraits<JSC::Identifier> : SimpleClassVectorTraits { };
+
+} // namespace WTF
diff --git a/runtime/IdentifierInlines.h b/runtime/IdentifierInlines.h
new file mode 100644
index 0000000..41dbe1b
--- /dev/null
+++ b/runtime/IdentifierInlines.h
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "Identifier.h"
+#include "Symbol.h"
+
+namespace JSC  {
+
+inline Identifier::Identifier(ExecState* exec, AtomicStringImpl* string)
+    : m_string(string)
+{
+#ifndef NDEBUG
+    checkCurrentAtomicStringTable(exec);
+    if (string)
+        ASSERT_WITH_MESSAGE(!string->length() || string->isSymbol() || AtomicStringImpl::isInAtomicStringTable(string), "The atomic string comes from an other thread!");
+#else
+    UNUSED_PARAM(exec);
+#endif
+}
+
+inline Identifier::Identifier(ExecState* exec, const AtomicString& string)
+    : m_string(string.string())
+{
+#ifndef NDEBUG
+    checkCurrentAtomicStringTable(exec);
+    if (!string.isNull())
+        ASSERT_WITH_MESSAGE(!string.length() || string.impl()->isSymbol() || AtomicStringImpl::isInAtomicStringTable(string.impl()), "The atomic string comes from an other thread!");
+#else
+    UNUSED_PARAM(exec);
+#endif
+}
+
+inline Ref<StringImpl> Identifier::add(ExecState* exec, StringImpl* r)
+{
+#ifndef NDEBUG
+    checkCurrentAtomicStringTable(exec);
+#endif
+    return *AtomicStringImpl::addWithStringTableProvider(*exec, r);
+}
+inline Ref<StringImpl> Identifier::add(VM* vm, StringImpl* r)
+{
+#ifndef NDEBUG
+    checkCurrentAtomicStringTable(vm);
+#endif
+    return *AtomicStringImpl::addWithStringTableProvider(*vm, r);
+}
+
+inline Identifier Identifier::fromUid(VM* vm, UniquedStringImpl* uid)
+{
+    if (!uid || !uid->isSymbol())
+        return Identifier(vm, uid);
+    return static_cast<SymbolImpl&>(*uid);
+}
+
+inline Identifier Identifier::fromUid(ExecState* exec, UniquedStringImpl* uid)
+{
+    return fromUid(&exec->vm(), uid);
+}
+
+inline Identifier Identifier::fromUid(const PrivateName& name)
+{
+    return name.uid();
+}
+
+template<unsigned charactersCount>
+inline Identifier Identifier::fromString(VM* vm, const char (&characters)[charactersCount])
+{
+    return Identifier(vm, characters);
+}
+
+template<unsigned charactersCount>
+inline Identifier Identifier::fromString(ExecState* exec, const char (&characters)[charactersCount])
+{
+    return Identifier(&exec->vm(), characters);
+}
+
+inline Identifier Identifier::fromString(VM* vm, const LChar* s, int length)
+{
+    return Identifier(vm, s, length);
+}
+
+inline Identifier Identifier::fromString(VM* vm, const UChar* s, int length)
+{
+    return Identifier(vm, s, length);
+}
+
+inline Identifier Identifier::fromString(VM* vm, const String& string)
+{
+    return Identifier(vm, string.impl());
+}
+
+inline Identifier Identifier::fromString(ExecState* exec, const String& string)
+{
+    return Identifier(&exec->vm(), string.impl());
+}
+
+inline Identifier Identifier::fromString(ExecState* exec, AtomicStringImpl* atomicString)
+{
+    return Identifier(exec, atomicString);
+}
+
+inline Identifier Identifier::fromString(ExecState* exec, const AtomicString& atomicString)
+{
+    return Identifier(exec, atomicString);
+}
+
+inline Identifier Identifier::fromString(ExecState* exec, const char* s)
+{
+    return Identifier(exec, AtomicString(s));
+}
+
+inline JSValue identifierToJSValue(VM& vm, const Identifier& identifier)
+{
+    if (identifier.isSymbol())
+        return Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl()));
+    return jsString(&vm, identifier.impl());
+}
+
+inline JSValue identifierToSafePublicJSValue(VM& vm, const Identifier& identifier) 
+{
+    if (identifier.isSymbol() && !vm.propertyNames->isPrivateName(identifier))
+        return Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl()));
+    return jsString(&vm, identifier.impl());
+}
+
+} // namespace JSC
diff --git a/runtime/IndexingHeader.h b/runtime/IndexingHeader.h
new file mode 100644
index 0000000..6a7f687
--- /dev/null
+++ b/runtime/IndexingHeader.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "PropertyStorage.h"
+
+namespace JSC {
+
+class ArrayBuffer;
+class Butterfly;
+class LLIntOffsetsExtractor;
+class Structure;
+struct ArrayStorage;
+
+class IndexingHeader {
+public:
+    // Define the maximum storage vector length to be 2^32 / sizeof(JSValue) / 2 to ensure that
+    // there is no risk of overflow.
+    enum { maximumLength = 0x10000000 };
+    
+    static ptrdiff_t offsetOfIndexingHeader() { return -static_cast<ptrdiff_t>(sizeof(IndexingHeader)); }
+    
+    static ptrdiff_t offsetOfArrayBuffer() { return OBJECT_OFFSETOF(IndexingHeader, u.typedArray.buffer); }
+    static ptrdiff_t offsetOfPublicLength() { return OBJECT_OFFSETOF(IndexingHeader, u.lengths.publicLength); }
+    static ptrdiff_t offsetOfVectorLength() { return OBJECT_OFFSETOF(IndexingHeader, u.lengths.vectorLength); }
+    
+    IndexingHeader()
+    {
+        u.lengths.publicLength = 0;
+        u.lengths.vectorLength = 0;
+    }
+    
+    uint32_t vectorLength() const { return u.lengths.vectorLength; }
+    
+    void setVectorLength(uint32_t length)
+    {
+        RELEASE_ASSERT(length <= maximumLength);
+        u.lengths.vectorLength = length;
+    }
+    
+    uint32_t publicLength() const { return u.lengths.publicLength; }
+    void setPublicLength(uint32_t auxWord) { u.lengths.publicLength = auxWord; }
+    
+    ArrayBuffer* arrayBuffer() { return u.typedArray.buffer; }
+    void setArrayBuffer(ArrayBuffer* buffer) { u.typedArray.buffer = buffer; }
+    
+    static IndexingHeader* from(Butterfly* butterfly)
+    {
+        return reinterpret_cast<IndexingHeader*>(butterfly) - 1;
+    }
+    
+    static const IndexingHeader* from(const Butterfly* butterfly)
+    {
+        return reinterpret_cast<const IndexingHeader*>(butterfly) - 1;
+    }
+    
+    static IndexingHeader* from(ArrayStorage* arrayStorage)
+    {
+        return const_cast<IndexingHeader*>(from(const_cast<const ArrayStorage*>(arrayStorage)));
+    }
+    
+    static const IndexingHeader* from(const ArrayStorage* arrayStorage)
+    {
+        return reinterpret_cast<const IndexingHeader*>(arrayStorage) - 1;
+    }
+    
+    static IndexingHeader* fromEndOf(PropertyStorage propertyStorage)
+    {
+        return reinterpret_cast<IndexingHeader*>(propertyStorage);
+    }
+    
+    PropertyStorage propertyStorage()
+    {
+        return reinterpret_cast_ptr<PropertyStorage>(this);
+    }
+    
+    ConstPropertyStorage propertyStorage() const
+    {
+        return reinterpret_cast_ptr<ConstPropertyStorage>(this);
+    }
+    
+    ArrayStorage* arrayStorage()
+    {
+        return reinterpret_cast<ArrayStorage*>(this + 1);
+    }
+    
+    Butterfly* butterfly()
+    {
+        return reinterpret_cast<Butterfly*>(this + 1);
+    }
+    
+    // These methods are not standalone in the sense that they cannot be
+    // used on a copy of the IndexingHeader.
+    size_t preCapacity(Structure*);
+    size_t indexingPayloadSizeInBytes(Structure*);
+    
+private:
+    friend class LLIntOffsetsExtractor;
+
+    union {
+        struct {
+            uint32_t publicLength; // The meaning of this field depends on the array type, but for all JSArrays we rely on this being the publicly visible length (array.length).
+            uint32_t vectorLength; // The length of the indexed property storage. The actual size of the storage depends on this, and the type.
+        } lengths;
+        
+        struct {
+            ArrayBuffer* buffer;
+        } typedArray;
+    } u;
+};
+
+} // namespace JSC
diff --git a/runtime/IndexingHeaderInlines.h b/runtime/IndexingHeaderInlines.h
new file mode 100644
index 0000000..8340259
--- /dev/null
+++ b/runtime/IndexingHeaderInlines.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayStorage.h"
+#include "IndexingHeader.h"
+#include "Structure.h"
+
+namespace JSC {
+
+inline size_t IndexingHeader::preCapacity(Structure* structure)
+{
+    if (LIKELY(!hasAnyArrayStorage(structure->indexingType())))
+        return 0;
+    
+    return arrayStorage()->m_indexBias;
+}
+
+inline size_t IndexingHeader::indexingPayloadSizeInBytes(Structure* structure)
+{
+    switch (structure->indexingType()) {
+    case ALL_UNDECIDED_INDEXING_TYPES:
+    case ALL_INT32_INDEXING_TYPES:
+    case ALL_DOUBLE_INDEXING_TYPES:
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        return vectorLength() * sizeof(EncodedJSValue);
+        
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        return ArrayStorage::sizeFor(arrayStorage()->vectorLength());
+        
+    default:
+        ASSERT(!hasIndexedProperties(structure->indexingType()));
+        return 0;
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/IndexingType.cpp b/runtime/IndexingType.cpp
new file mode 100644
index 0000000..f7d5475
--- /dev/null
+++ b/runtime/IndexingType.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IndexingType.h"
+
+#include <wtf/StringExtras.h>
+
+namespace JSC {
+
+IndexingType leastUpperBoundOfIndexingTypes(IndexingType a, IndexingType b)
+{
+    // It doesn't make sense to LUB something that is an array with something that isn't.
+    ASSERT((a & IsArray) == (b & IsArray));
+
+    // Boy, this sure is easy right now.
+    return std::max(a, b);
+}
+
+IndexingType leastUpperBoundOfIndexingTypeAndType(IndexingType indexingType, SpeculatedType type)
+{
+    if (!type)
+        return indexingType;
+    switch (indexingType) {
+    case ALL_BLANK_INDEXING_TYPES:
+    case ALL_UNDECIDED_INDEXING_TYPES:
+    case ALL_INT32_INDEXING_TYPES:
+        if (isInt32Speculation(type))
+            return (indexingType & ~IndexingShapeMask) | Int32Shape;
+        if (isFullNumberSpeculation(type))
+            return (indexingType & ~IndexingShapeMask) | DoubleShape;
+        return (indexingType & ~IndexingShapeMask) | ContiguousShape;
+    case ALL_DOUBLE_INDEXING_TYPES:
+        if (isFullNumberSpeculation(type))
+            return indexingType;
+        return (indexingType & ~IndexingShapeMask) | ContiguousShape;
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        return indexingType;
+    default:
+        CRASH();
+        return 0;
+    }
+}
+
+IndexingType leastUpperBoundOfIndexingTypeAndValue(IndexingType indexingType, JSValue value)
+{
+    return leastUpperBoundOfIndexingTypeAndType(indexingType, speculationFromValue(value));
+}
+
+void dumpIndexingType(PrintStream& out, IndexingType indexingType)
+{
+    const char* basicName;
+    switch (indexingType & AllArrayTypes) {
+    case NonArray:
+        basicName = "NonArray";
+        break;
+    case NonArrayWithInt32:
+        basicName = "NonArrayWithInt32";
+        break;
+    case NonArrayWithDouble:
+        basicName = "NonArrayWithDouble";
+        break;
+    case NonArrayWithContiguous:
+        basicName = "NonArrayWithContiguous";
+        break;
+    case NonArrayWithArrayStorage:
+        basicName = "NonArrayWithArrayStorage";
+        break;
+    case NonArrayWithSlowPutArrayStorage:
+        basicName = "NonArrayWithSlowPutArrayStorage";
+        break;
+    case ArrayClass:
+        basicName = "ArrayClass";
+        break;
+    case ArrayWithUndecided:
+        basicName = "ArrayWithUndecided";
+        break;
+    case ArrayWithInt32:
+        basicName = "ArrayWithInt32";
+        break;
+    case ArrayWithDouble:
+        basicName = "ArrayWithDouble";
+        break;
+    case ArrayWithContiguous:
+        basicName = "ArrayWithContiguous";
+        break;
+    case ArrayWithArrayStorage:
+        basicName = "ArrayWithArrayStorage";
+        break;
+    case ArrayWithSlowPutArrayStorage:
+        basicName = "ArrayWithSlowPutArrayStorage";
+        break;
+    default:
+        basicName = "Unknown!";
+        break;
+    }
+    
+    out.printf("%s%s", basicName, (indexingType & MayHaveIndexedAccessors) ? "|MayHaveIndexedAccessors" : "");
+}
+
+} // namespace JSC
+
diff --git a/runtime/IndexingType.h b/runtime/IndexingType.h
new file mode 100644
index 0000000..6460d32
--- /dev/null
+++ b/runtime/IndexingType.h
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "SpeculatedType.h"
+#include <wtf/LockAlgorithm.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+/*
+    Structure of the IndexingType
+    =============================
+    Conceptually, the IndexingType looks like this:
+
+    struct IndexingType {
+        uint8_t isArray:1;                    // bit 0
+        uint8_t shape:4;                      // bit 1 - 3
+        uint8_t mayHaveIndexedAccessors:1;    // bit 4
+    };
+
+    The shape values (e.g. Int32Shape, ContiguousShape, etc) are an enumeration of
+    various shapes (though not necessarily sequential in terms of their values).
+    Hence, shape values are not bitwise exclusive with respect to each other.
+*/
+
+typedef uint8_t IndexingType;
+
+// Flags for testing the presence of capabilities.
+static const IndexingType IsArray                  = 0x01;
+
+// The shape of the indexed property storage.
+static const IndexingType IndexingShapeMask               = 0x0E;
+static const IndexingType NoIndexingShape                 = 0x00;
+static const IndexingType UndecidedShape                  = 0x02; // Only useful for arrays.
+static const IndexingType Int32Shape                      = 0x04;
+static const IndexingType DoubleShape                     = 0x06;
+static const IndexingType ContiguousShape                 = 0x08;
+static const IndexingType ArrayStorageShape               = 0x0A;
+static const IndexingType SlowPutArrayStorageShape        = 0x0C;
+
+static const IndexingType IndexingShapeShift              = 1;
+static const IndexingType NumberOfIndexingShapes          = 7;
+
+// Additional flags for tracking the history of the type. These are usually
+// masked off unless you ask for them directly.
+static const IndexingType MayHaveIndexedAccessors         = 0x10;
+
+// The IndexingType field of JSCells is stolen for locks.
+static const IndexingType IndexingTypeLockIsHeld          = 0x20;
+static const IndexingType IndexingTypeLockHasParked       = 0x40;
+
+// List of acceptable array types.
+static const IndexingType NonArray                        = 0x0;
+static const IndexingType NonArrayWithInt32               = Int32Shape;
+static const IndexingType NonArrayWithDouble              = DoubleShape;
+static const IndexingType NonArrayWithContiguous          = ContiguousShape;
+static const IndexingType NonArrayWithArrayStorage        = ArrayStorageShape;
+static const IndexingType NonArrayWithSlowPutArrayStorage = SlowPutArrayStorageShape;
+static const IndexingType ArrayClass                      = IsArray; // I'd want to call this "Array" but this would lead to disastrous namespace pollution.
+static const IndexingType ArrayWithUndecided              = IsArray | UndecidedShape;
+static const IndexingType ArrayWithInt32                  = IsArray | Int32Shape;
+static const IndexingType ArrayWithDouble                 = IsArray | DoubleShape;
+static const IndexingType ArrayWithContiguous             = IsArray | ContiguousShape;
+static const IndexingType ArrayWithArrayStorage           = IsArray | ArrayStorageShape;
+static const IndexingType ArrayWithSlowPutArrayStorage    = IsArray | SlowPutArrayStorageShape;
+
+#define ALL_BLANK_INDEXING_TYPES \
+    NonArray:                    \
+    case ArrayClass
+
+#define ALL_UNDECIDED_INDEXING_TYPES \
+    ArrayWithUndecided
+
+#define ALL_INT32_INDEXING_TYPES      \
+    NonArrayWithInt32:                \
+    case ArrayWithInt32
+
+#define ALL_DOUBLE_INDEXING_TYPES     \
+    NonArrayWithDouble:               \
+    case ArrayWithDouble
+
+#define ALL_CONTIGUOUS_INDEXING_TYPES \
+    NonArrayWithContiguous:           \
+    case ArrayWithContiguous
+
+#define ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES \
+    ArrayWithArrayStorage:                      \
+    case ArrayWithSlowPutArrayStorage
+    
+#define ALL_ARRAY_STORAGE_INDEXING_TYPES                \
+    NonArrayWithArrayStorage:                           \
+    case NonArrayWithSlowPutArrayStorage:               \
+    case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES
+
+static inline bool hasIndexedProperties(IndexingType indexingType)
+{
+    return (indexingType & IndexingShapeMask) != NoIndexingShape;
+}
+
+static inline bool hasUndecided(IndexingType indexingType)
+{
+    return (indexingType & IndexingShapeMask) == UndecidedShape;
+}
+
+static inline bool hasInt32(IndexingType indexingType)
+{
+    return (indexingType & IndexingShapeMask) == Int32Shape;
+}
+
+static inline bool hasDouble(IndexingType indexingType)
+{
+    return (indexingType & IndexingShapeMask) == DoubleShape;
+}
+
+static inline bool hasContiguous(IndexingType indexingType)
+{
+    return (indexingType & IndexingShapeMask) == ContiguousShape;
+}
+
+static inline bool hasArrayStorage(IndexingType indexingType)
+{
+    return (indexingType & IndexingShapeMask) == ArrayStorageShape;
+}
+
+static inline bool hasAnyArrayStorage(IndexingType indexingType)
+{
+    return static_cast<uint8_t>(indexingType & IndexingShapeMask) >= ArrayStorageShape;
+}
+
+static inline bool shouldUseSlowPut(IndexingType indexingType)
+{
+    return (indexingType & IndexingShapeMask) == SlowPutArrayStorageShape;
+}
+
+inline IndexingType indexingTypeForValue(JSValue value)
+{
+    if (value.isInt32())
+        return Int32Shape;
+
+    if (value.isNumber() && value.asNumber() == value.asNumber())
+        return DoubleShape;
+
+    return ContiguousShape;
+}
+
+// Return an indexing type that can handle all of the elements of both indexing types.
+IndexingType leastUpperBoundOfIndexingTypes(IndexingType, IndexingType);
+
+IndexingType leastUpperBoundOfIndexingTypeAndType(IndexingType, SpeculatedType);
+IndexingType leastUpperBoundOfIndexingTypeAndValue(IndexingType, JSValue);
+
+void dumpIndexingType(PrintStream&, IndexingType);
+MAKE_PRINT_ADAPTOR(IndexingTypeDump, IndexingType, dumpIndexingType);
+
+// Mask of all possible types.
+static const IndexingType AllArrayTypes            = IndexingShapeMask | IsArray;
+
+// Mask of all possible types including the history.
+static const IndexingType AllArrayTypesAndHistory  = AllArrayTypes | MayHaveIndexedAccessors;
+
+typedef LockAlgorithm<IndexingType, IndexingTypeLockIsHeld, IndexingTypeLockHasParked> IndexingTypeLockAlgorithm;
+
+} // namespace JSC
diff --git a/runtime/IndirectEvalExecutable.cpp b/runtime/IndirectEvalExecutable.cpp
new file mode 100644
index 0000000..db9269e
--- /dev/null
+++ b/runtime/IndirectEvalExecutable.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IndirectEvalExecutable.h"
+
+#include "CodeCache.h"
+#include "Debugger.h"
+#include "Error.h"
+#include "HeapInlines.h"
+#include "JSCJSValueInlines.h"
+#include "ParserError.h"
+
+namespace JSC {
+
+IndirectEvalExecutable* IndirectEvalExecutable::create(ExecState* exec, const SourceCode& source, bool isInStrictContext, DerivedContextType derivedContextType, bool isArrowFunctionContext, EvalContextType evalContextType)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    if (!globalObject->evalEnabled()) {
+        throwException(exec, scope, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
+        return 0;
+    }
+
+    auto* executable = new (NotNull, allocateCell<IndirectEvalExecutable>(*exec->heap())) IndirectEvalExecutable(exec, source, isInStrictContext, derivedContextType, isArrowFunctionContext, evalContextType);
+    executable->finishCreation(vm);
+
+    ParserError error;
+    JSParserStrictMode strictMode = executable->isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
+    DebuggerMode debuggerMode = globalObject->hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
+    
+    UnlinkedEvalCodeBlock* unlinkedEvalCode = vm.codeCache()->getUnlinkedEvalCodeBlock(
+        vm, executable, executable->source(), strictMode, debuggerMode, error, evalContextType);
+
+    if (globalObject->hasDebugger())
+        globalObject->debugger()->sourceParsed(exec, executable->source().provider(), error.line(), error.message());
+
+    if (error.isValid()) {
+        throwVMError(exec, scope, error.toErrorObject(globalObject, executable->source()));
+        return nullptr;
+    }
+
+    executable->m_unlinkedEvalCodeBlock.set(vm, executable, unlinkedEvalCode);
+
+    return executable;
+}
+
+IndirectEvalExecutable::IndirectEvalExecutable(ExecState* exec, const SourceCode& source, bool inStrictContext, DerivedContextType derivedContextType, bool isArrowFunctionContext, EvalContextType evalContextType)
+    : EvalExecutable(exec, source, inStrictContext, derivedContextType, isArrowFunctionContext, evalContextType)
+{
+}
+
+} // namespace JSC
diff --git a/runtime/IndirectEvalExecutable.h b/runtime/IndirectEvalExecutable.h
new file mode 100644
index 0000000..4f175e8
--- /dev/null
+++ b/runtime/IndirectEvalExecutable.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "EvalExecutable.h"
+
+namespace JSC {
+
+class IndirectEvalExecutable final : public EvalExecutable {
+public:
+    static IndirectEvalExecutable* create(ExecState*, const SourceCode&, bool isInStrictContext, DerivedContextType, bool isArrowFunctionContext, EvalContextType);
+private:
+    IndirectEvalExecutable(ExecState*, const SourceCode&, bool inStrictContext, DerivedContextType, bool isArrowFunctionContext, EvalContextType);
+};
+
+} // namespace JSC
diff --git a/runtime/InferredType.cpp b/runtime/InferredType.cpp
new file mode 100644
index 0000000..e343d6e
--- /dev/null
+++ b/runtime/InferredType.cpp
@@ -0,0 +1,613 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "InferredType.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+namespace {
+
+class InferredTypeFireDetail : public FireDetail {
+public:
+    InferredTypeFireDetail(
+        InferredType* inferredType, UniquedStringImpl* uid,
+        const InferredType::Descriptor& oldDescriptor, const InferredType::Descriptor& newDescriptor,
+        JSValue offendingValue)
+        : m_inferredType(inferredType)
+        , m_uid(uid)
+        , m_oldDescriptor(oldDescriptor)
+        , m_newDescriptor(newDescriptor)
+        , m_offendingValue(offendingValue)
+    {
+    }
+
+protected:
+    void dump(PrintStream& out) const override
+    {
+        out.print(
+            "Inferred type changed on ", RawPointer(m_inferredType), " for property ", m_uid, ": "
+            "old type was ", m_oldDescriptor, " while desired type is ", m_newDescriptor);
+        if (m_offendingValue)
+            out.print(" due to ", m_offendingValue);
+    }
+
+private:
+    InferredType* m_inferredType;
+    RefPtr<UniquedStringImpl> m_uid;
+    InferredType::Descriptor m_oldDescriptor;
+    InferredType::Descriptor m_newDescriptor;
+    JSValue m_offendingValue;
+};
+
+} // anonymous namespace
+
+const ClassInfo InferredType::s_info = { "InferredType", 0, 0, CREATE_METHOD_TABLE(InferredType) };
+
+InferredType* InferredType::create(VM& vm)
+{
+    InferredType* result = new (NotNull, allocateCell<InferredType>(vm.heap)) InferredType(vm);
+    result->finishCreation(vm);
+    return result;
+}
+
+void InferredType::destroy(JSCell* cell)
+{
+    InferredType* inferredType = static_cast<InferredType*>(cell);
+    inferredType->InferredType::~InferredType();
+}
+
+Structure* InferredType::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+void InferredType::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    InferredType* inferredType = jsCast<InferredType*>(cell);
+    
+    ConcurrentJSLocker locker(inferredType->m_lock);
+
+    if (inferredType->m_structure) {
+        // The mutator may clear the structure before the GC runs finalizers, so we have to protect
+        // the finalizer from being destroyed.
+        inferredType->m_structure->ref();
+        visitor.addUnconditionalFinalizer(&inferredType->m_structure->m_finalizer);
+    }
+}
+
+InferredType::Kind InferredType::kindForFlags(PutByIdFlags flags)
+{
+    switch (flags & PutByIdPrimaryTypeMask) {
+    case PutByIdPrimaryTypeSecondary:
+        switch (flags & PutByIdSecondaryTypeMask) {
+        case PutByIdSecondaryTypeBottom:
+            return Bottom;
+        case PutByIdSecondaryTypeBoolean:
+            return Boolean;
+        case PutByIdSecondaryTypeOther:
+            return Other;
+        case PutByIdSecondaryTypeInt32:
+            return Int32;
+        case PutByIdSecondaryTypeNumber:
+            return Number;
+        case PutByIdSecondaryTypeString:
+            return String;
+        case PutByIdSecondaryTypeSymbol:
+            return Symbol;
+        case PutByIdSecondaryTypeObject:
+            return Object;
+        case PutByIdSecondaryTypeObjectOrOther:
+            return ObjectOrOther;
+        case PutByIdSecondaryTypeTop:
+            return Top;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return Bottom;
+        }
+    case PutByIdPrimaryTypeObjectWithStructure:
+        return ObjectWithStructure;
+    case PutByIdPrimaryTypeObjectWithStructureOrOther:
+        return ObjectWithStructureOrOther;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return Bottom;
+    }
+}
+
+InferredType::Descriptor InferredType::Descriptor::forValue(JSValue value)
+{
+    if (value.isBoolean())
+        return Boolean;
+    if (value.isUndefinedOrNull())
+        return Other;
+    if (value.isInt32())
+        return Int32;
+    if (value.isNumber())
+        return Number;
+    if (value.isCell()) {
+        JSCell* cell = value.asCell();
+        if (cell->isString())
+            return String;
+        if (cell->isSymbol())
+            return Symbol;
+        if (cell->isObject()) {
+            if (cell->structure()->transitionWatchpointSetIsStillValid())
+                return Descriptor(ObjectWithStructure, cell->structure());
+            return Object;
+        }
+    }
+    return Top;
+}
+
+InferredType::Descriptor InferredType::Descriptor::forFlags(VM& vm, PutByIdFlags flags)
+{
+    Kind kind = kindForFlags(flags);
+    Structure* structure;
+    if (hasStructure(kind))
+        structure = vm.heap.structureIDTable().get(decodeStructureID(flags));
+    else
+        structure = nullptr;
+    return Descriptor(kind, structure);
+}
+
+PutByIdFlags InferredType::Descriptor::putByIdFlags() const
+{
+    switch (m_kind) {
+    case Bottom:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeBottom);
+    case Boolean:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeBoolean);
+    case Other:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeOther);
+    case Int32:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeInt32);
+    case Number:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeNumber);
+    case String:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeString);
+    case Symbol:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeSymbol);
+    case Object:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeObject);
+    case ObjectOrOther:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeObjectOrOther);
+    case Top:
+        return static_cast<PutByIdFlags>(PutByIdPrimaryTypeSecondary | PutByIdSecondaryTypeTop);
+    case ObjectWithStructure:
+        return static_cast<PutByIdFlags>(
+            PutByIdPrimaryTypeObjectWithStructure | encodeStructureID(m_structure->id()));
+    case ObjectWithStructureOrOther:
+        return static_cast<PutByIdFlags>(
+            PutByIdPrimaryTypeObjectWithStructureOrOther | encodeStructureID(m_structure->id()));
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return PutByIdNone;
+}
+
+void InferredType::Descriptor::merge(const Descriptor& other)
+{
+    // Filter out common things to simplify the switch statement below.
+    if (*this == other)
+        return;
+    if (other.m_kind == Bottom)
+        return;
+
+    switch (m_kind) {
+    case Bottom:
+        *this = other;
+        return;
+    case Boolean:
+    case String:
+    case Symbol:
+        *this = Top;
+        return;
+    case Other:
+        switch (other.m_kind) {
+        case ObjectWithStructure:
+        case ObjectWithStructureOrOther:
+            *this = Descriptor(ObjectWithStructureOrOther, other.structure());
+            return;
+        case Object:
+        case ObjectOrOther:
+            *this = ObjectOrOther;
+            return;
+        default:
+            *this = Top;
+            return;
+        }
+    case Int32:
+        switch (other.m_kind) {
+        case Number:
+            *this = Number;
+            return;
+        default:
+            *this = Top;
+            return;
+        }
+    case Number:
+        switch (other.m_kind) {
+        case Int32:
+            return;
+        default:
+            *this = Top;
+            return;
+        }
+    case ObjectWithStructure:
+        switch (other.m_kind) {
+        case ObjectWithStructure: // If we see this here, then we know that the structures didn't match.
+        case Object:
+            *this = Object;
+            return;
+        case ObjectWithStructureOrOther:
+            if (m_structure == other.m_structure) {
+                *this = other;
+                return;
+            }
+            *this = ObjectOrOther;
+            return;
+        case ObjectOrOther:
+            *this = ObjectOrOther;
+            return;
+        case Other:
+            m_kind = ObjectWithStructureOrOther;
+            return;
+        default:
+            *this = Top;
+            return;
+        }
+    case ObjectWithStructureOrOther:
+        switch (other.m_kind) {
+        case ObjectWithStructure:
+            if (m_structure == other.m_structure)
+                return;
+            *this = ObjectOrOther;
+            return;
+        case Object:
+        case ObjectWithStructureOrOther: // If we see this here, then we know that the structures didn't match.
+        case ObjectOrOther:
+            *this = ObjectOrOther;
+            return;
+        case Other:
+            return;
+        default:
+            *this = Top;
+            return;
+        }
+    case Object:
+        switch (other.m_kind) {
+        case ObjectWithStructure:
+            return;
+        case ObjectWithStructureOrOther:
+        case ObjectOrOther:
+        case Other:
+            *this = ObjectOrOther;
+            return;
+        default:
+            *this = Top;
+            return;
+        }
+    case ObjectOrOther:
+        switch (other.m_kind) {
+        case ObjectWithStructure:
+        case ObjectWithStructureOrOther:
+        case Object:
+        case Other:
+            return;
+        default:
+            *this = Top;
+            return;
+        }
+    case Top:
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void InferredType::Descriptor::removeStructure()
+{
+    switch (m_kind) {
+    case ObjectWithStructure:
+        *this = Object;
+        return;
+    case ObjectWithStructureOrOther:
+        *this = ObjectOrOther;
+        return;
+    default:
+        return;
+    }
+}
+
+bool InferredType::Descriptor::subsumes(const Descriptor& other) const
+{
+    Descriptor merged = *this;
+    merged.merge(other);
+    return *this == merged;
+}
+
+void InferredType::Descriptor::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    out.print(m_kind);
+    if (m_structure)
+        out.print(":", inContext(*m_structure, context));
+}
+
+void InferredType::Descriptor::dump(PrintStream& out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+InferredType::InferredType(VM& vm)
+    : Base(vm, vm.inferredTypeStructure.get())
+    , m_watchpointSet(ClearWatchpoint)
+{
+}
+
+InferredType::~InferredType()
+{
+}
+
+bool InferredType::canWatch(const ConcurrentJSLocker& locker, const Descriptor& expected)
+{
+    if (expected.kind() == Top)
+        return false;
+    
+    return descriptor(locker) == expected;
+}
+
+bool InferredType::canWatch(const Descriptor& expected)
+{
+    ConcurrentJSLocker locker(m_lock);
+    return canWatch(locker, expected);
+}
+
+void InferredType::addWatchpoint(const ConcurrentJSLocker& locker, Watchpoint* watchpoint)
+{
+    RELEASE_ASSERT(descriptor(locker).kind() != Top);
+
+    m_watchpointSet.add(watchpoint);
+}
+
+void InferredType::addWatchpoint(Watchpoint* watchpoint)
+{
+    ConcurrentJSLocker locker(m_lock);
+    addWatchpoint(locker, watchpoint);
+}
+
+void InferredType::dump(PrintStream& out) const
+{
+    out.print(RawPointer(this), ":", descriptor());
+}
+
+bool InferredType::willStoreValueSlow(VM& vm, PropertyName propertyName, JSValue value)
+{
+    Descriptor oldType;
+    Descriptor myType;
+    bool result;
+    {
+        ConcurrentJSLocker locker(m_lock);
+        oldType = descriptor(locker);
+        myType = Descriptor::forValue(value);
+
+        myType.merge(oldType);
+        
+        ASSERT(oldType != myType); // The type must have changed if we're on the slow path.
+
+        bool setResult = set(locker, vm, myType);
+        result = kind(locker) != Top;
+        if (!setResult)
+            return result;
+    }
+    
+    InferredTypeFireDetail detail(this, propertyName.uid(), oldType, myType, value);
+    m_watchpointSet.fireAll(vm, detail);
+    return result;
+}
+
+void InferredType::makeTopSlow(VM& vm, PropertyName propertyName)
+{
+    Descriptor oldType;
+    {
+        ConcurrentJSLocker locker(m_lock);
+        oldType = descriptor(locker);
+        if (!set(locker, vm, Top))
+            return;
+    }
+
+    InferredTypeFireDetail detail(this, propertyName.uid(), oldType, Top, JSValue());
+    m_watchpointSet.fireAll(vm, detail);
+}
+
+bool InferredType::set(const ConcurrentJSLocker& locker, VM& vm, Descriptor newDescriptor)
+{
+    // We will trigger write barriers while holding our lock. Currently, write barriers don't GC, but that
+    // could change. If it does, we don't want to deadlock. Note that we could have used
+    // GCSafeConcurrentJSLocker in the caller, but the caller is on a fast path so maybe that wouldn't be
+    // a good idea.
+    DeferGCForAWhile deferGC(vm.heap);
+    
+    // Be defensive: if we're not really changing the type, then we don't have to do anything.
+    if (descriptor(locker) == newDescriptor)
+        return false;
+
+    bool shouldFireWatchpointSet = false;
+    
+    // The new descriptor must be more general than the previous one.
+    ASSERT(newDescriptor.subsumes(descriptor(locker)));
+
+    // If the new descriptors have different structures, then it can only be because one is null.
+    if (descriptor(locker).structure() != newDescriptor.structure())
+        ASSERT(!descriptor(locker).structure() || !newDescriptor.structure());
+
+    // We are changing the type, so make sure that if anyone was watching, they find out about it now. If
+    // anyone is watching, we make sure to go to Top so that we don't do this sort of thing again.
+    if (m_watchpointSet.state() != ClearWatchpoint) {
+        // We cannot have been invalidated, since if we were, then we'd already be at Top.
+        ASSERT(m_watchpointSet.state() != IsInvalidated);
+
+        // We're about to do expensive things because some compiler thread decided to watch this type and
+        // then the type changed. Assume that this property is crazy, and don't ever do any more things for
+        // it.
+        newDescriptor = Top;
+
+        shouldFireWatchpointSet = true;
+    }
+
+    // Remove the old InferredStructure object if we no longer need it.
+    if (!newDescriptor.structure())
+        m_structure = nullptr;
+
+    // Add a new InferredStructure object if we need one now.
+    if (newDescriptor.structure()) {
+        if (m_structure) {
+            // We should agree on the structures if we get here.
+            ASSERT(newDescriptor.structure() == m_structure->structure());
+        } else {
+            m_structure = adoptRef(new InferredStructure(vm, this, newDescriptor.structure()));
+            newDescriptor.structure()->addTransitionWatchpoint(&m_structure->m_watchpoint);
+        }
+    }
+
+    // Finally, set the descriptor kind.
+    m_kind = newDescriptor.kind();
+
+    // Assert that we did things.
+    ASSERT(descriptor(locker) == newDescriptor);
+
+    return shouldFireWatchpointSet;
+}
+
+void InferredType::removeStructure()
+{
+    // FIXME: Find an elegant and cheap way to thread information about why we got here into the fire
+    // detail in set().
+    
+    VM& vm = *Heap::heap(this)->vm();
+
+    Descriptor oldDescriptor;
+    Descriptor newDescriptor;
+    {
+        ConcurrentJSLocker locker(m_lock);
+        oldDescriptor = descriptor(locker);
+        newDescriptor = oldDescriptor;
+        newDescriptor.removeStructure();
+        
+        if (!set(locker, vm, newDescriptor))
+            return;
+    }
+
+    InferredTypeFireDetail detail(this, nullptr, oldDescriptor, newDescriptor, JSValue());
+    m_watchpointSet.fireAll(vm, detail);
+}
+
+void InferredType::InferredStructureWatchpoint::fireInternal(const FireDetail&)
+{
+    InferredStructure* inferredStructure =
+        bitwise_cast<InferredStructure*>(
+            bitwise_cast<char*>(this) - OBJECT_OFFSETOF(InferredStructure, m_watchpoint));
+
+    inferredStructure->m_parent->removeStructure();
+}
+
+void InferredType::InferredStructureFinalizer::finalizeUnconditionally()
+{
+    InferredStructure* inferredStructure =
+        bitwise_cast<InferredStructure*>(
+            bitwise_cast<char*>(this) - OBJECT_OFFSETOF(InferredStructure, m_finalizer));
+    
+    ASSERT(Heap::isMarked(inferredStructure->m_parent));
+    
+    // Monotonicity ensures that we shouldn't see a new structure that is different from us, but we
+    // could have been nulled. We only rely on it being the null case only in debug.
+    if (inferredStructure == inferredStructure->m_parent->m_structure.get()) {
+        if (!Heap::isMarked(inferredStructure->m_structure.get()))
+            inferredStructure->m_parent->removeStructure();
+    } else
+        ASSERT(!inferredStructure->m_parent->m_structure);
+    
+    inferredStructure->deref();
+}
+
+InferredType::InferredStructure::InferredStructure(VM& vm, InferredType* parent, Structure* structure)
+    : m_parent(parent)
+    , m_structure(vm, parent, structure)
+{
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, InferredType::Kind kind)
+{
+    switch (kind) {
+    case InferredType::Bottom:
+        out.print("Bottom");
+        return;
+    case InferredType::Boolean:
+        out.print("Boolean");
+        return;
+    case InferredType::Other:
+        out.print("Other");
+        return;
+    case InferredType::Int32:
+        out.print("Int32");
+        return;
+    case InferredType::Number:
+        out.print("Number");
+        return;
+    case InferredType::String:
+        out.print("String");
+        return;
+    case InferredType::Symbol:
+        out.print("Symbol");
+        return;
+    case InferredType::ObjectWithStructure:
+        out.print("ObjectWithStructure");
+        return;
+    case InferredType::ObjectWithStructureOrOther:
+        out.print("ObjectWithStructureOrOther");
+        return;
+    case InferredType::Object:
+        out.print("Object");
+        return;
+    case InferredType::ObjectOrOther:
+        out.print("ObjectOrOther");
+        return;
+    case InferredType::Top:
+        out.print("Top");
+        return;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/runtime/InferredType.h b/runtime/InferredType.h
new file mode 100644
index 0000000..4e39776
--- /dev/null
+++ b/runtime/InferredType.h
@@ -0,0 +1,289 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "JSCell.h"
+#include "PropertyName.h"
+#include "PutByIdFlags.h"
+#include "Watchpoint.h"
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace JSC {
+
+// This is an object used for the inference of the types of object properties.
+
+class InferredType final : public JSCell {
+public:
+    typedef JSCell Base;
+
+    static InferredType* create(VM&);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    static const unsigned StructureFlags = StructureIsImmortal | Base::StructureFlags;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    DECLARE_INFO;
+
+    enum Kind : uint8_t {
+        Bottom,
+        Boolean,
+        Other,
+        Int32,
+        Number,
+        String,
+        Symbol,
+        ObjectWithStructure,
+        ObjectWithStructureOrOther,
+        Object,
+        ObjectOrOther,
+        Top
+    };
+
+    static Kind kindForFlags(PutByIdFlags);
+    
+    static bool hasStructure(Kind kind)
+    {
+        switch (kind) {
+        case ObjectWithStructure:
+        case ObjectWithStructureOrOther:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    class Descriptor {
+    public:
+        Descriptor()
+            : m_kind(Bottom)
+            , m_structure(nullptr)
+        {
+        }
+
+        Descriptor(Kind kind, Structure* structure = nullptr)
+            : m_kind(kind)
+            , m_structure(structure)
+        {
+            if (hasStructure(kind))
+                ASSERT(structure);
+        }
+
+        static Descriptor forValue(JSValue);
+
+        static Descriptor forFlags(VM&, PutByIdFlags);
+
+        explicit operator bool() const
+        {
+            return m_kind != Bottom || m_structure;
+        }
+
+        Kind kind() const { return m_kind; }
+        Structure* structure() const { return m_structure; }
+
+        PutByIdFlags putByIdFlags() const;
+
+        ALWAYS_INLINE bool includesValue(JSValue value)
+        {
+            switch (m_kind) {
+            case Bottom:
+                return false;
+            case Boolean:
+                return value.isBoolean();
+            case Other:
+                return value.isUndefinedOrNull();
+            case Int32:
+                return value.isInt32();
+            case Number:
+                return value.isNumber();
+            case String:
+                return value.isString();
+            case Symbol:
+                return value.isSymbol();
+            case ObjectWithStructure:
+                return value.isCell() && value.asCell()->structure() == m_structure;
+            case ObjectWithStructureOrOther:
+                return value.isUndefinedOrNull()
+                    || (value.isCell() && value.asCell()->structure() == m_structure);
+            case Object:
+                return value.isObject();
+            case ObjectOrOther:
+                return value.isUndefinedOrNull() || value.isObject();
+            case Top:
+                return true;
+            }
+
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        bool operator==(const Descriptor& other) const
+        {
+            return m_kind == other.m_kind
+                && m_structure == other.m_structure;
+        }
+
+        bool operator!=(const Descriptor& other) const
+        {
+            return !(*this == other);
+        }
+
+        unsigned hash() const
+        {
+            return WTF::PtrHash<Structure*>::hash(m_structure) ^ static_cast<unsigned>(m_kind);
+        }
+    
+        void merge(const Descriptor&);
+        void removeStructure();
+
+        // Returns true if this descriptor is more general than the other one.
+        bool subsumes(const Descriptor&) const;
+
+        void dumpInContext(PrintStream&, DumpContext*) const;
+        void dump(PrintStream&) const;
+
+    private:
+        Kind m_kind;
+        Structure* m_structure;
+    };
+
+    ConcurrentJSLock& lock() const { return m_lock; }
+
+    Descriptor descriptorMainThread() const
+    {
+        return Descriptor(m_kind, m_structure ? m_structure->structure() : nullptr);
+    }
+    
+    Descriptor descriptor(const ConcurrentJSLocker&) const
+    {
+        return descriptorMainThread();
+    }
+    Descriptor descriptor() const
+    {
+        ConcurrentJSLocker locker(m_lock);
+        return descriptor(locker);
+    }
+    
+    Kind kind(const ConcurrentJSLocker& locker) const { return descriptor(locker).kind(); }
+
+    bool isTop() const { return m_kind == Top; }
+    bool isRelevant() const { return m_kind != Top; }
+
+    // Returns true if the InferredType is still relevant after the store. It's not relevant if it's Top.
+    ALWAYS_INLINE bool willStoreValue(VM& vm, PropertyName propertyName, JSValue value)
+    {
+        Descriptor currentDescriptor = descriptorMainThread();
+        if (currentDescriptor.includesValue(value))
+            return currentDescriptor.kind() != Top;
+        return willStoreValueSlow(vm, propertyName, value);
+    }
+
+    // Immediately makes this type irrelevant.
+    void makeTop(VM& vm, PropertyName propertyName)
+    {
+        if (isTop())
+            return;
+        makeTopSlow(vm, propertyName);
+    }
+
+    // Returns true if it currently makes sense to watch this InferredType for this descriptor. Note that
+    // this will always return false for Top.
+    bool canWatch(const ConcurrentJSLocker&, const Descriptor&);
+    bool canWatch(const Descriptor&);
+    
+    void addWatchpoint(const ConcurrentJSLocker&, Watchpoint*);
+    void addWatchpoint(Watchpoint*);
+
+    void dump(PrintStream&) const;
+
+private:
+    InferredType(VM&);
+    ~InferredType();
+
+    bool willStoreValueSlow(VM&, PropertyName, JSValue);
+    void makeTopSlow(VM&, PropertyName);
+
+    // Helper for willStoreValueSlow() and makeTopSlow(). This returns true if we should fire the
+    // watchpoint set.
+    bool set(const ConcurrentJSLocker&, VM&, Descriptor);
+    
+    void removeStructure();
+
+    mutable ConcurrentJSLock m_lock;
+    
+    Kind m_kind { Bottom };
+
+    class InferredStructureWatchpoint : public Watchpoint {
+    public:
+        InferredStructureWatchpoint() { }
+    protected:
+        void fireInternal(const FireDetail&) override;
+    };
+
+    class InferredStructureFinalizer : public UnconditionalFinalizer {
+    public:
+        InferredStructureFinalizer() { }
+    protected:
+        void finalizeUnconditionally() override;
+    };
+
+    class InferredStructure : public ThreadSafeRefCounted<InferredStructure> {
+    public:
+        InferredStructure(VM&, InferredType* parent, Structure*);
+
+        Structure* structure() const { return m_structure.get(); };
+
+    private:
+        friend class InferredType;
+        friend class InferredStructureWatchpoint;
+        friend class InferredStructureFinalizer;
+        
+        InferredType* m_parent;
+        WriteBarrier<Structure> m_structure;
+
+        InferredStructureWatchpoint m_watchpoint;
+        InferredStructureFinalizer m_finalizer;
+    };
+
+    RefPtr<InferredStructure> m_structure;
+
+    // NOTE: If this is being watched, we transform to Top because that implies that it wouldn't be
+    // profitable to watch it again. Also, this set is initialized clear, and is never exposed to the DFG
+    // thread. The DFG will use the InferredType as the thing that it watches.
+    InlineWatchpointSet m_watchpointSet;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::InferredType::Kind);
+
+} // namespace WTF
diff --git a/runtime/InferredTypeTable.cpp b/runtime/InferredTypeTable.cpp
new file mode 100644
index 0000000..810534c
--- /dev/null
+++ b/runtime/InferredTypeTable.cpp
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "InferredTypeTable.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo InferredTypeTable::s_info = { "InferredTypeTable", 0, 0, CREATE_METHOD_TABLE(InferredTypeTable) };
+
+InferredTypeTable* InferredTypeTable::create(VM& vm)
+{
+    InferredTypeTable* result = new (NotNull, allocateCell<InferredTypeTable>(vm.heap)) InferredTypeTable(vm);
+    result->finishCreation(vm);
+    return result;
+}
+
+void InferredTypeTable::destroy(JSCell* cell)
+{
+    InferredTypeTable* inferredTypeTable = static_cast<InferredTypeTable*>(cell);
+    inferredTypeTable->InferredTypeTable::~InferredTypeTable();
+}
+
+Structure* InferredTypeTable::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+void InferredTypeTable::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    InferredTypeTable* inferredTypeTable = jsCast<InferredTypeTable*>(cell);
+
+    ConcurrentJSLocker locker(inferredTypeTable->m_lock);
+    
+    for (auto& entry : inferredTypeTable->m_table) {
+        auto entryValue = entry.value;
+
+        if (!entryValue)
+            continue;
+        if (entryValue->isRelevant())
+            visitor.append(entryValue);
+        else
+            entry.value.clear();
+    }
+}
+
+InferredType* InferredTypeTable::get(const ConcurrentJSLocker&, UniquedStringImpl* uid)
+{
+    auto iter = m_table.find(uid);
+    if (iter == m_table.end())
+        return nullptr;
+
+    InferredType* entryValue = iter->value.get();
+    if (!entryValue)
+        return nullptr;
+
+    // Take this opportunity to prune invalidated types.
+    if (!entryValue->isRelevant()) {
+        iter->value.clear();
+        return nullptr;
+    }
+
+    return entryValue;
+}
+
+InferredType* InferredTypeTable::get(UniquedStringImpl* uid)
+{
+    ConcurrentJSLocker locker(m_lock);
+    return get(locker, uid);
+}
+
+InferredType* InferredTypeTable::get(PropertyName propertyName)
+{
+    return get(propertyName.uid());
+}
+
+bool InferredTypeTable::willStoreValue(
+    VM& vm, PropertyName propertyName, JSValue value, StoredPropertyAge age)
+{
+    // The algorithm here relies on the fact that only one thread modifies the hash map.
+    
+    if (age == OldProperty) {
+        TableType::iterator iter = m_table.find(propertyName.uid());
+        if (iter == m_table.end())
+            return false; // Absence on replace => top.
+
+        InferredType* entryValue = iter->value.get();
+        if (!entryValue)
+            return false;
+        
+        if (entryValue->willStoreValue(vm, propertyName, value))
+            return true;
+        
+        iter->value.clear();
+        return false;
+    }
+
+    TableType::AddResult result;
+    {
+        ConcurrentJSLocker locker(m_lock);
+        result = m_table.add(propertyName.uid(), WriteBarrier<InferredType>());
+    }
+    InferredType* entryValue = result.iterator->value.get();
+
+    if (result.isNewEntry) {
+        InferredType* inferredType = InferredType::create(vm);
+        WTF::storeStoreFence();
+        result.iterator->value.set(vm, this, inferredType);
+        entryValue = inferredType;
+    } else if (!entryValue)
+        return false;
+    
+    if (entryValue->willStoreValue(vm, propertyName, value))
+        return true;
+    
+    result.iterator->value.clear();
+    return false;
+}
+
+void InferredTypeTable::makeTop(VM& vm, PropertyName propertyName, StoredPropertyAge age)
+{
+    // The algorithm here relies on the fact that only one thread modifies the hash map.
+    if (age == OldProperty) {
+        TableType::iterator iter = m_table.find(propertyName.uid());
+        if (iter == m_table.end())
+            return; // Absence on replace => top.
+
+        InferredType* entryValue = iter->value.get();
+
+        if (!entryValue)
+            return;
+
+        entryValue->makeTop(vm, propertyName);
+        iter->value.clear();
+        return;
+    }
+
+    TableType::AddResult result;
+    {
+        ConcurrentJSLocker locker(m_lock);
+        result = m_table.add(propertyName.uid(), WriteBarrier<InferredType>());
+    }
+    if (!result.iterator->value)
+        return;
+    
+    result.iterator->value->makeTop(vm, propertyName);
+    result.iterator->value.clear();
+}
+
+InferredTypeTable::InferredTypeTable(VM& vm)
+    : Base(vm, vm.inferredTypeTableStructure.get())
+{
+}
+
+InferredTypeTable::~InferredTypeTable()
+{
+}
+
+} // namespace JSC
+
diff --git a/runtime/InferredTypeTable.h b/runtime/InferredTypeTable.h
new file mode 100644
index 0000000..6b4515f
--- /dev/null
+++ b/runtime/InferredTypeTable.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include "InferredType.h"
+#include "JSCell.h"
+
+namespace JSC {
+
+// A table of inferred types for some structure. This is a JSCell because that simplifies the Structure
+// destructor and makes lifetime easier to manage. For example, since it's a cell, we know that this thing
+// cannot be deleted while the DFG is running. This is separate from PropertyTable because most properties
+// will not have an InferredType, since most properties are in dictionaries (if you think of "a property"
+// as being "a property in some Structure"). Also, this will happily conflate the types of properties from
+// different structures even if the structures represent disjoint sets of objects.
+
+class InferredTypeTable final : public JSCell {
+public:
+    typedef JSCell Base;
+
+    static InferredTypeTable* create(VM&);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    static const unsigned StructureFlags = StructureIsImmortal | Base::StructureFlags;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    DECLARE_INFO;
+
+    ConcurrentJSLock& lock() { return m_lock; }
+
+    bool isEmpty() const { return m_table.isEmpty(); }
+
+    // Get the current inferred type. Returns nullptr for both Top and Bottom. Null means Bottom if the
+    // owning Structure doesn't know about the property.
+    InferredType* get(const ConcurrentJSLocker&, UniquedStringImpl*);
+    InferredType* get(UniquedStringImpl*);
+    InferredType* get(PropertyName);
+
+    enum StoredPropertyAge {
+        NewProperty,
+        OldProperty
+    };
+    
+    // Returns true if the InferredType for this property is still relevant after the store. It's not
+    // relevant if it's Top. Note that this table will internally prune Top entries.
+    bool willStoreValue(VM&, PropertyName, JSValue, StoredPropertyAge);
+
+    // Invalidates the type for the property. Useful if we detect a store in a reflective context.
+    void makeTop(VM&, PropertyName, StoredPropertyAge);
+
+private:
+    InferredTypeTable(VM&);
+    ~InferredTypeTable();
+
+    // Bottom: absence from table.
+    // Top: null value in table, !value->isRelevant(), or absence from table.
+    //
+    // We know how to determine if absence from the table is bottom or top depending on whether the
+    // property is present in the owning structure. Hence, depending on the structure, absence may have
+    // different meanings. The way that this class determines if the owning structure knows of the property
+    // is that we differentiate between actions: replace or transition. If we're adding a new property
+    // (transition), then absence means bottom. If we're storing to an existing property (replace), then
+    // absence means top. To make this work, we have to watch out for the case where two structures, S1 and
+    // S2, share the same InferredTypeTable and neither of them initially know about property P. S1 may
+    // want to add P without a type, while S2 may want to add P with a type. If S1 added P and used absence
+    // to indicate Top, then S2 would use that absence to mean Bottom and would end up creating a non-Top
+    // entry in the table. Then S1 would forget that it wanted Top, and would use S2's type. Clearly,
+    // that's bad. We avoid such confusion by ensuring that a transition always adds an entry. Hence,
+    // absence-means-bottom only comes into play for properties added before the InferredTypeTable was
+    // created.
+    typedef HashMap<RefPtr<UniquedStringImpl>, WriteBarrier<InferredType>, IdentifierRepHash> TableType;
+    
+    TableType m_table;
+
+    // We only grab this lock when we're doing modifications on the main thread, or reads on the compiler
+    // thread. The compiler thread is not allowed to do modifications.
+    ConcurrentJSLock m_lock;
+};
+
+} // namespace JSC
diff --git a/runtime/InferredValue.cpp b/runtime/InferredValue.cpp
new file mode 100644
index 0000000..c32b3e3
--- /dev/null
+++ b/runtime/InferredValue.cpp
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "InferredValue.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo InferredValue::s_info = { "InferredValue", 0, 0, CREATE_METHOD_TABLE(InferredValue) };
+
+InferredValue* InferredValue::create(VM& vm)
+{
+    InferredValue* result = new (NotNull, allocateCell<InferredValue>(vm.heap)) InferredValue(vm);
+    result->finishCreation(vm);
+    return result;
+}
+
+void InferredValue::destroy(JSCell* cell)
+{
+    InferredValue* inferredValue = static_cast<InferredValue*>(cell);
+    inferredValue->InferredValue::~InferredValue();
+}
+
+Structure* InferredValue::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+void InferredValue::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    InferredValue* inferredValue = jsCast<InferredValue*>(cell);
+    
+    auto locker = holdLock(*inferredValue);
+    
+    if (inferredValue->m_set.hasBeenInvalidated()) {
+        if (inferredValue->m_cleanup && !inferredValue->m_cleanup->isOnList())
+            inferredValue->m_cleanup = nullptr;
+        return;
+    }
+    
+    JSValue value = inferredValue->m_value.get();
+    if (!value)
+        return;
+    if (!value.isCell())
+        return;
+    
+    if (!inferredValue->m_cleanup)
+        inferredValue->m_cleanup = std::make_unique<ValueCleanup>(inferredValue);
+    visitor.addUnconditionalFinalizer(inferredValue->m_cleanup.get());
+}
+
+InferredValue::InferredValue(VM& vm)
+    : Base(vm, vm.inferredValueStructure.get())
+    , m_set(ClearWatchpoint)
+{
+}
+
+InferredValue::~InferredValue()
+{
+}
+
+void InferredValue::notifyWriteSlow(VM& vm, JSValue value, const FireDetail& detail)
+{
+    ASSERT(!!value);
+    switch (m_set.state()) {
+    case ClearWatchpoint:
+        m_value.set(vm, this, value);
+        m_set.startWatching();
+        return;
+        
+    case IsWatched:
+        ASSERT(!!m_value);
+        if (m_value.get() == value)
+            return;
+        invalidate(vm, detail);
+        return;
+        
+    case IsInvalidated:
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    
+    ASSERT_NOT_REACHED();
+}
+
+void InferredValue::notifyWriteSlow(VM& vm, JSValue value, const char* reason)
+{
+    notifyWriteSlow(vm, value, StringFireDetail(reason));
+}
+
+InferredValue::ValueCleanup::ValueCleanup(InferredValue* owner)
+    : m_owner(owner)
+{
+}
+
+InferredValue::ValueCleanup::~ValueCleanup()
+{
+}
+
+void InferredValue::ValueCleanup::finalizeUnconditionally()
+{
+    JSValue value = m_owner->m_value.get();
+    
+    // Concurrent GC means that this could have changed since we installed the finalizer.
+    if (!value || !value.isCell())
+        return;
+    
+    if (Heap::isMarked(value.asCell()))
+        return;
+    
+    m_owner->invalidate(*m_owner->vm(), StringFireDetail("InferredValue clean-up during GC"));
+}
+
+} // namespace JSC
+
diff --git a/runtime/InferredValue.h b/runtime/InferredValue.h
new file mode 100644
index 0000000..50c2a3c
--- /dev/null
+++ b/runtime/InferredValue.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "Watchpoint.h"
+#include "WriteBarrier.h"
+
+namespace JSC {
+
+// Allocate one of these if you'd like to infer a constant value. Writes to the value should use
+// notifyWrite(). So long as exactly one value had ever been written and invalidate() has never been
+// called, and you register a watchpoint, you can rely on the inferredValue() being the one true
+// value.
+//
+// Commonly used for inferring singletons - in that case each allocation does notifyWrite(). But you
+// can use it for other things as well.
+
+class InferredValue : public JSCell {
+public:
+    typedef JSCell Base;
+    
+    static InferredValue* create(VM&);
+    
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+    
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+    DECLARE_INFO;
+    
+    // For the purpose of deciding whether or not to watch this variable, you only need
+    // to inspect inferredValue(). If this returns something other than the empty
+    // value, then it means that at all future safepoints, this watchpoint set will be
+    // in one of these states:
+    //
+    //    IsWatched: in this case, the variable's value must still be the
+    //        inferredValue.
+    //
+    //    IsInvalidated: in this case the variable's value may be anything but you'll
+    //        either notice that it's invalidated and not install the watchpoint, or
+    //        you will have been notified that the watchpoint was fired.
+    JSValue inferredValue() { return m_value.get(); }
+
+    // Forwards some WatchpointSet methods.
+    WatchpointState state() const { return m_set.state(); }
+    bool isStillValid() const { return m_set.isStillValid(); }
+    bool hasBeenInvalidated() const { return m_set.hasBeenInvalidated(); }
+    void add(Watchpoint* watchpoint) { m_set.add(watchpoint); }
+    
+    void notifyWrite(VM& vm, JSValue value, const FireDetail& detail)
+    {
+        if (LIKELY(m_set.stateOnJSThread() == IsInvalidated))
+            return;
+        notifyWriteSlow(vm, value, detail);
+    }
+    
+    void notifyWrite(VM& vm, JSValue value, const char* reason)
+    {
+        if (LIKELY(m_set.stateOnJSThread() == IsInvalidated))
+            return;
+        notifyWriteSlow(vm, value, reason);
+    }
+    
+    void invalidate(VM& vm, const FireDetail& detail)
+    {
+        m_value.clear();
+        m_set.invalidate(vm, detail);
+    }
+    
+    static const unsigned StructureFlags = StructureIsImmortal | Base::StructureFlags;
+    
+    // We could have used Weak<>. But we want arbitrary JSValues, not just cells. It's also somewhat
+    // convenient to have eager notification of death.
+    //
+    // Also note that this should be a private class, but it isn't because Windows.
+    class ValueCleanup : public UnconditionalFinalizer {
+        WTF_MAKE_FAST_ALLOCATED;
+        
+    public:
+        ValueCleanup(InferredValue*);
+        virtual ~ValueCleanup();
+        
+    protected:
+        void finalizeUnconditionally() override;
+        
+    private:
+        InferredValue* m_owner;
+    };
+    
+private:
+    InferredValue(VM&);
+    ~InferredValue();
+    
+    JS_EXPORT_PRIVATE void notifyWriteSlow(VM&, JSValue, const FireDetail&);
+    JS_EXPORT_PRIVATE void notifyWriteSlow(VM&, JSValue, const char* reason);
+    
+    friend class ValueCleanup;
+    
+    InlineWatchpointSet m_set;
+    WriteBarrier<Unknown> m_value;
+    std::unique_ptr<ValueCleanup> m_cleanup;
+};
+
+// FIXME: We could have an InlineInferredValue, which only allocates the InferredValue object when
+// a notifyWrite() transitions us towards watching, and then clears the reference (allowing the object
+// to die) when we get invalidated.
+
+} // namespace JSC
diff --git a/runtime/InitializeThreading.cpp b/runtime/InitializeThreading.cpp
new file mode 100644
index 0000000..f72da99
--- /dev/null
+++ b/runtime/InitializeThreading.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2008, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InitializeThreading.h"
+
+#include "ExecutableAllocator.h"
+#include "Heap.h"
+#include "HeapStatistics.h"
+#include "Identifier.h"
+#include "JSDateMath.h"
+#include "JSGlobalObject.h"
+#include "JSLock.h"
+#include "LLIntData.h"
+#include "Options.h"
+#include "StructureIDTable.h"
+#include "SuperSampler.h"
+#include "WriteBarrier.h"
+#include <mutex>
+#include <wtf/MainThread.h>
+#include <wtf/Threading.h>
+#include <wtf/dtoa.h>
+#include <wtf/dtoa/cached-powers.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+void initializeThreading()
+{
+    static std::once_flag initializeThreadingOnceFlag;
+
+    std::call_once(initializeThreadingOnceFlag, []{
+        WTF::double_conversion::initialize();
+        WTF::initializeThreading();
+        WTF::initializeGCThreads();
+        Options::initialize();
+        if (Options::recordGCPauseTimes())
+            HeapStatistics::initialize();
+#if ENABLE(WRITE_BARRIER_PROFILING)
+        WriteBarrierCounters::initialize();
+#endif
+#if ENABLE(ASSEMBLER)
+        ExecutableAllocator::initializeAllocator();
+#endif
+        LLInt::initialize();
+#ifndef NDEBUG
+        DisallowGC::initialize();
+#endif
+        initializeSuperSampler();
+        WTFThreadData& threadData = wtfThreadData();
+        threadData.setSavedLastStackTop(threadData.stack().origin());
+    });
+}
+
+} // namespace JSC
diff --git a/runtime/InitializeThreading.h b/runtime/InitializeThreading.h
new file mode 100644
index 0000000..553e620
--- /dev/null
+++ b/runtime/InitializeThreading.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#pragma once
+
+namespace JSC {
+
+// This function must be called from the main thread. It is safe to call it repeatedly.
+// Darwin is an exception to this rule: it is OK to call this function from any thread, even reentrantly.
+JS_EXPORT_PRIVATE void initializeThreading();
+
+} // namespace JSC
diff --git a/runtime/InspectorInstrumentationObject.cpp b/runtime/InspectorInstrumentationObject.cpp
new file mode 100644
index 0000000..f69f831
--- /dev/null
+++ b/runtime/InspectorInstrumentationObject.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorInstrumentationObject.h"
+
+#include "JSCInlines.h"
+#include "Lookup.h"
+#include <wtf/DataLog.h>
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL inspectorInstrumentationObjectLog(ExecState*);
+
+}
+
+#include "InspectorInstrumentationObject.lut.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(InspectorInstrumentationObject);
+
+const ClassInfo InspectorInstrumentationObject::s_info = { "InspectorInstrumentation", &Base::s_info, &inspectorInstrumentationObjectTable, CREATE_METHOD_TABLE(InspectorInstrumentationObject) };
+
+/* Source for InspectorInstrumentationObject.lut.h
+@begin inspectorInstrumentationObjectTable
+    log               inspectorInstrumentationObjectLog              DontEnum|Function 1
+    promiseFulfilled  JSBuiltin                                      DontEnum|Function 3
+    promiseRejected   JSBuiltin                                      DontEnum|Function 3
+@end
+*/
+
+InspectorInstrumentationObject::InspectorInstrumentationObject(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void InspectorInstrumentationObject::finishCreation(VM& vm, JSGlobalObject*)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirectWithoutTransition(vm, vm.propertyNames->isEnabled, jsBoolean(false));
+}
+
+bool InspectorInstrumentationObject::isEnabled(VM& vm) const
+{
+    return getDirect(vm, vm.propertyNames->isEnabled).asBoolean();
+}
+
+void InspectorInstrumentationObject::enable(VM& vm)
+{
+    putDirect(vm, vm.propertyNames->isEnabled, jsBoolean(true));
+}
+
+void InspectorInstrumentationObject::disable(VM& vm)
+{
+    putDirect(vm, vm.propertyNames->isEnabled, jsBoolean(false));
+}
+
+// ------------------------------ Functions --------------------------------
+
+EncodedJSValue JSC_HOST_CALL inspectorInstrumentationObjectLog(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue target = exec->argument(0);
+    String value = target.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    dataLog(value, "\n");
+    return JSValue::encode(jsUndefined());
+}
+
+} // namespace JSC
diff --git a/runtime/InspectorInstrumentationObject.h b/runtime/InspectorInstrumentationObject.h
new file mode 100644
index 0000000..21e6610
--- /dev/null
+++ b/runtime/InspectorInstrumentationObject.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class InspectorInstrumentationObject : public JSNonFinalObject {
+private:
+    InspectorInstrumentationObject(VM&, Structure*);
+
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static InspectorInstrumentationObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        InspectorInstrumentationObject* object = new (NotNull, allocateCell<InspectorInstrumentationObject>(vm.heap)) InspectorInstrumentationObject(vm, structure);
+        object->finishCreation(vm, globalObject);
+        return object;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    void enable(VM&);
+    void disable(VM&);
+    bool isEnabled(VM&) const;
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/Int16Array.h b/runtime/Int16Array.h
new file mode 100644
index 0000000..69fa9d5
--- /dev/null
+++ b/runtime/Int16Array.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Int16Array;
diff --git a/runtime/Int32Array.h b/runtime/Int32Array.h
new file mode 100644
index 0000000..ca5b2aa
--- /dev/null
+++ b/runtime/Int32Array.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Int32Array;
diff --git a/runtime/Int8Array.h b/runtime/Int8Array.h
new file mode 100644
index 0000000..2b0fe3c
--- /dev/null
+++ b/runtime/Int8Array.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Int8Array;
diff --git a/runtime/IntegralTypedArrayBase.h b/runtime/IntegralTypedArrayBase.h
new file mode 100644
index 0000000..c8149f6
--- /dev/null
+++ b/runtime/IntegralTypedArrayBase.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrayBase.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+
+// Base class for all WebGL<T>Array types holding integral
+// (non-floating-point) values.
+
+namespace JSC {
+
+template <typename T>
+class IntegralTypedArrayBase : public TypedArrayBase<T> {
+public:
+    void set(unsigned index, double value)
+    {
+        if (index >= TypedArrayBase<T>::m_length)
+            return;
+        if (std::isnan(value)) // Clamp NaN to 0
+            value = 0;
+        // The double cast is necessary to get the correct wrapping
+        // for out-of-range values with Int32Array and Uint32Array.
+        TypedArrayBase<T>::data()[index] = static_cast<T>(static_cast<int64_t>(value));
+    }
+
+protected:
+    IntegralTypedArrayBase(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+        : TypedArrayBase<T>(buffer, byteOffset, length)
+    {
+    }
+
+};
+
+} // namespace JSC
diff --git a/runtime/InternalFunction.cpp b/runtime/InternalFunction.cpp
new file mode 100644
index 0000000..85bcf56
--- /dev/null
+++ b/runtime/InternalFunction.cpp
@@ -0,0 +1,135 @@
+/*
+ *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2004, 2007-2008, 2016-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "InternalFunction.h"
+
+#include "FunctionPrototype.h"
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(InternalFunction);
+
+const ClassInfo InternalFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(InternalFunction) };
+
+InternalFunction::InternalFunction(VM& vm, Structure* structure)
+    : JSDestructibleObject(vm, structure)
+{
+    // exec->vm() wants callees to not be large allocations.
+    RELEASE_ASSERT(!isLargeAllocation());
+}
+
+void InternalFunction::finishCreation(VM& vm, const String& name)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    ASSERT(methodTable()->getCallData != InternalFunction::info()->methodTable.getCallData);
+    JSString* nameString = jsString(&vm, name);
+    m_originalName.set(vm, this, nameString);
+    putDirect(vm, vm.propertyNames->name, nameString, ReadOnly | DontEnum);
+}
+
+void InternalFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    InternalFunction* thisObject = jsCast<InternalFunction*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    
+    visitor.append(thisObject->m_originalName);
+}
+
+const String& InternalFunction::name()
+{
+    const String& name = m_originalName->tryGetValue();
+    ASSERT(name); // m_originalName was built from a String, and hence, there is no rope to resolve.
+    return name;
+}
+
+const String InternalFunction::displayName(VM& vm)
+{
+    JSValue displayName = getDirect(vm, vm.propertyNames->displayName);
+    
+    if (displayName && isJSString(displayName))
+        return asString(displayName)->tryGetValue();
+    
+    return String();
+}
+
+CallType InternalFunction::getCallData(JSCell*, CallData&)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return CallType::None;
+}
+
+const String InternalFunction::calculatedDisplayName(VM& vm)
+{
+    const String explicitName = displayName(vm);
+    
+    if (!explicitName.isEmpty())
+        return explicitName;
+    
+    return name();
+}
+
+Structure* InternalFunction::createSubclassStructure(ExecState* exec, JSValue newTarget, Structure* baseClass)
+{
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // We allow newTarget == JSValue() because the API needs to be able to create classes without having a real JS frame.
+    // Since we don't allow subclassing in the API we just treat newTarget == JSValue() as newTarget == exec->jsCallee()
+    ASSERT(!newTarget || newTarget.isConstructor());
+
+    if (newTarget && newTarget != exec->jsCallee()) {
+        // newTarget may be an InternalFunction if we were called from Reflect.construct.
+        JSFunction* targetFunction = jsDynamicCast<JSFunction*>(newTarget);
+        JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
+
+        if (LIKELY(targetFunction)) {
+            Structure* structure = targetFunction->rareData(vm)->internalFunctionAllocationStructure();
+            if (LIKELY(structure && structure->classInfo() == baseClass->classInfo()))
+                return structure;
+
+            // Note, Reflect.construct might cause the profile to churn but we don't care.
+            JSValue prototypeValue = newTarget.get(exec, exec->propertyNames().prototype);
+            RETURN_IF_EXCEPTION(scope, nullptr);
+            if (JSObject* prototype = jsDynamicCast<JSObject*>(prototypeValue))
+                return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, lexicalGlobalObject, prototype, baseClass);
+        } else {
+            JSValue prototypeValue = newTarget.get(exec, exec->propertyNames().prototype);
+            RETURN_IF_EXCEPTION(scope, nullptr);
+            if (JSObject* prototype = jsDynamicCast<JSObject*>(prototypeValue)) {
+                // This only happens if someone Reflect.constructs our builtin constructor with another builtin constructor as the new.target.
+                // Thus, we don't care about the cost of looking up the structure from our hash table every time.
+                return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(lexicalGlobalObject, prototype, baseClass);
+            }
+        }
+    }
+    
+    return baseClass;
+}
+
+
+} // namespace JSC
diff --git a/runtime/InternalFunction.h b/runtime/InternalFunction.h
new file mode 100644
index 0000000..2928397
--- /dev/null
+++ b/runtime/InternalFunction.h
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2007 Maks Orlovich
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include "JSDestructibleObject.h"
+
+namespace JSC {
+
+class FunctionPrototype;
+
+class InternalFunction : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | ImplementsHasInstance | ImplementsDefaultHasInstance | TypeOfShouldCallGetCallData;
+
+    DECLARE_EXPORT_INFO;
+
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+
+    JS_EXPORT_PRIVATE const String& name();
+    const String displayName(VM&);
+    const String calculatedDisplayName(VM&);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    { 
+        return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+    JS_EXPORT_PRIVATE static Structure* createSubclassStructure(ExecState*, JSValue newTarget, Structure*);
+
+protected:
+    JS_EXPORT_PRIVATE InternalFunction(VM&, Structure*);
+
+    JS_EXPORT_PRIVATE void finishCreation(VM&, const String& name);
+
+    static CallType getCallData(JSCell*, CallData&);
+    WriteBarrier<JSString> m_originalName;
+};
+
+InternalFunction* asInternalFunction(JSValue);
+
+inline InternalFunction* asInternalFunction(JSValue value)
+{
+    ASSERT(asObject(value)->inherits(InternalFunction::info()));
+    return static_cast<InternalFunction*>(asObject(value));
+}
+
+} // namespace JSC
diff --git a/runtime/IntlCollator.cpp b/runtime/IntlCollator.cpp
new file mode 100644
index 0000000..22b4eb3
--- /dev/null
+++ b/runtime/IntlCollator.cpp
@@ -0,0 +1,454 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2015 Sukolsak Sakshuwong (sukolsak@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlCollator.h"
+
+#if ENABLE(INTL)
+
+#include "Error.h"
+#include "IntlCollatorConstructor.h"
+#include "IntlObject.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "ObjectConstructor.h"
+#include "SlotVisitorInlines.h"
+#include "StructureInlines.h"
+#include <unicode/ucol.h>
+#include <wtf/unicode/Collator.h>
+
+namespace JSC {
+
+const ClassInfo IntlCollator::s_info = { "Object", &Base::s_info, 0, CREATE_METHOD_TABLE(IntlCollator) };
+
+// FIXME: Implement kf (caseFirst).
+static const char* const relevantExtensionKeys[2] = { "co", "kn" };
+static const size_t indexOfExtensionKeyCo = 0;
+static const size_t indexOfExtensionKeyKn = 1;
+
+void IntlCollator::UCollatorDeleter::operator()(UCollator* collator) const
+{
+    if (collator)
+        ucol_close(collator);
+}
+
+IntlCollator* IntlCollator::create(VM& vm, Structure* structure)
+{
+    IntlCollator* format = new (NotNull, allocateCell<IntlCollator>(vm.heap)) IntlCollator(vm, structure);
+    format->finishCreation(vm);
+    return format;
+}
+
+Structure* IntlCollator::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlCollator::IntlCollator(VM& vm, Structure* structure)
+    : JSDestructibleObject(vm, structure)
+{
+}
+
+void IntlCollator::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+void IntlCollator::destroy(JSCell* cell)
+{
+    static_cast<IntlCollator*>(cell)->IntlCollator::~IntlCollator();
+}
+
+void IntlCollator::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    IntlCollator* thisObject = jsCast<IntlCollator*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_boundCompare);
+}
+
+static Vector<String> sortLocaleData(const String& locale, size_t keyIndex)
+{
+    // 9.1 Internal slots of Service Constructors & 10.2.3 Internal slots (ECMA-402 2.0)
+    Vector<String> keyLocaleData;
+    switch (keyIndex) {
+    case indexOfExtensionKeyCo: {
+        // 10.2.3 "The first element of [[sortLocaleData]][locale].co and [[searchLocaleData]][locale].co must be null for all locale values."
+        keyLocaleData.append({ });
+
+        UErrorCode status = U_ZERO_ERROR;
+        UEnumeration* enumeration = ucol_getKeywordValuesForLocale("collation", locale.utf8().data(), false, &status);
+        if (U_SUCCESS(status)) {
+            const char* collation;
+            while ((collation = uenum_next(enumeration, nullptr, &status)) && U_SUCCESS(status)) {
+                // 10.2.3 "The values "standard" and "search" must not be used as elements in any [[sortLocaleData]][locale].co and [[searchLocaleData]][locale].co array."
+                if (!strcmp(collation, "standard") || !strcmp(collation, "search"))
+                    continue;
+
+                // Map keyword values to BCP 47 equivalents.
+                if (!strcmp(collation, "dictionary"))
+                    collation = "dict";
+                else if (!strcmp(collation, "gb2312han"))
+                    collation = "gb2312";
+                else if (!strcmp(collation, "phonebook"))
+                    collation = "phonebk";
+                else if (!strcmp(collation, "traditional"))
+                    collation = "trad";
+
+                keyLocaleData.append(collation);
+            }
+            uenum_close(enumeration);
+        }
+        break;
+    }
+    case indexOfExtensionKeyKn:
+        keyLocaleData.reserveInitialCapacity(2);
+        keyLocaleData.uncheckedAppend(ASCIILiteral("false"));
+        keyLocaleData.uncheckedAppend(ASCIILiteral("true"));
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    return keyLocaleData;
+}
+
+static Vector<String> searchLocaleData(const String&, size_t keyIndex)
+{
+    // 9.1 Internal slots of Service Constructors & 10.2.3 Internal slots (ECMA-402 2.0)
+    Vector<String> keyLocaleData;
+    switch (keyIndex) {
+    case indexOfExtensionKeyCo:
+        // 10.2.3 "The first element of [[sortLocaleData]][locale].co and [[searchLocaleData]][locale].co must be null for all locale values."
+        keyLocaleData.reserveInitialCapacity(1);
+        keyLocaleData.append({ });
+        break;
+    case indexOfExtensionKeyKn:
+        keyLocaleData.reserveInitialCapacity(2);
+        keyLocaleData.uncheckedAppend(ASCIILiteral("false"));
+        keyLocaleData.uncheckedAppend(ASCIILiteral("true"));
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    return keyLocaleData;
+}
+
+void IntlCollator::initializeCollator(ExecState& state, JSValue locales, JSValue optionsValue)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 10.1.1 InitializeCollator (collator, locales, options) (ECMA-402 2.0)
+    // 1. If collator has an [[initializedIntlObject]] internal slot with value true, throw a TypeError exception.
+    // 2. Set collator.[[initializedIntlObject]] to true.
+
+    // 3. Let requestedLocales be CanonicalizeLocaleList(locales).
+    auto requestedLocales = canonicalizeLocaleList(state, locales);
+    // 4. ReturnIfAbrupt(requestedLocales).
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // 5. If options is undefined, then
+    JSObject* options;
+    if (optionsValue.isUndefined()) {
+        // a. Let options be ObjectCreate(%ObjectPrototype%).
+        options = constructEmptyObject(&state);
+    } else { // 6. Else
+        // a. Let options be ToObject(options).
+        options = optionsValue.toObject(&state);
+        // b. ReturnIfAbrupt(options).
+        RETURN_IF_EXCEPTION(scope, void());
+    }
+
+    // 7. Let u be GetOption(options, "usage", "string", «"sort", "search"», "sort").
+    String usageString = intlStringOption(state, options, vm.propertyNames->usage, { "sort", "search" }, "usage must be either \"sort\" or \"search\"", "sort");
+    // 8. ReturnIfAbrupt(u).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 9. Set collator.[[usage]] to u.
+    if (usageString == "sort")
+        m_usage = Usage::Sort;
+    else if (usageString == "search")
+        m_usage = Usage::Search;
+    else
+        ASSERT_NOT_REACHED();
+
+    // 10. If u is "sort", then
+    // a. Let localeData be the value of %Collator%.[[sortLocaleData]];
+    // 11. Else
+    // a. Let localeData be the value of %Collator%.[[searchLocaleData]].
+    Vector<String> (*localeData)(const String&, size_t);
+    if (m_usage == Usage::Sort)
+        localeData = sortLocaleData;
+    else
+        localeData = searchLocaleData;
+
+    // 12. Let opt be a new Record.
+    HashMap<String, String> opt;
+
+    // 13. Let matcher be GetOption(options, "localeMatcher", "string", «"lookup", "best fit"», "best fit").
+    String matcher = intlStringOption(state, options, vm.propertyNames->localeMatcher, { "lookup", "best fit" }, "localeMatcher must be either \"lookup\" or \"best fit\"", "best fit");
+    // 14. ReturnIfAbrupt(matcher).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 15. Set opt.[[localeMatcher]] to matcher.
+    opt.add(ASCIILiteral("localeMatcher"), matcher);
+
+    // 16. For each row in Table 1, except the header row, do:
+    // a. Let key be the name given in the Key column of the row.
+    // b. Let prop be the name given in the Property column of the row.
+    // c. Let type be the string given in the Type column of the row.
+    // d. Let list be a List containing the Strings given in the Values column of the row, or undefined if no strings are given.
+    // e. Let value be GetOption(options, prop, type, list, undefined).
+    // f. ReturnIfAbrupt(value).
+    // g. If the string given in the Type column of the row is "boolean" and value is not undefined, then
+    //    i. Let value be ToString(value).
+    //    ii. ReturnIfAbrupt(value).
+    // h. Set opt.[[<key>]] to value.
+    {
+        String numericString;
+        bool usesFallback;
+        bool numeric = intlBooleanOption(state, options, vm.propertyNames->numeric, usesFallback);
+        RETURN_IF_EXCEPTION(scope, void());
+        if (!usesFallback)
+            numericString = ASCIILiteral(numeric ? "true" : "false");
+        opt.add(ASCIILiteral("kn"), numericString);
+    }
+    {
+        String caseFirst = intlStringOption(state, options, vm.propertyNames->caseFirst, { "upper", "lower", "false" }, "caseFirst must be either \"upper\", \"lower\", or \"false\"", nullptr);
+        RETURN_IF_EXCEPTION(scope, void());
+        opt.add(ASCIILiteral("kf"), caseFirst);
+    }
+
+    // 17. Let relevantExtensionKeys be the value of %Collator%.[[relevantExtensionKeys]].
+    // 18. Let r be ResolveLocale(%Collator%.[[availableLocales]], requestedLocales, opt, relevantExtensionKeys, localeData).
+    auto& availableLocales = state.jsCallee()->globalObject()->intlCollatorAvailableLocales();
+    auto result = resolveLocale(state, availableLocales, requestedLocales, opt, relevantExtensionKeys, WTF_ARRAY_LENGTH(relevantExtensionKeys), localeData);
+
+    // 19. Set collator.[[locale]] to the value of r.[[locale]].
+    m_locale = result.get(ASCIILiteral("locale"));
+    if (m_locale.isEmpty()) {
+        throwTypeError(&state, scope, ASCIILiteral("failed to initialize Collator due to invalid locale"));
+        return;
+    }
+
+    // 20. Let k be 0.
+    // 21. Let lenValue be Get(relevantExtensionKeys, "length").
+    // 22. Let len be ToLength(lenValue).
+    // 23. Repeat while k < len:
+    // a. Let Pk be ToString(k).
+    // b. Let key be Get(relevantExtensionKeys, Pk).
+    // c. ReturnIfAbrupt(key).
+    // d. If key is "co", then
+    //    i. Let property be "collation".
+    //    ii. Let value be the value of r.[[co]].
+    //    iii. If value is null, let value be "default".
+    // e. Else use the row of Table 1 that contains the value of key in the Key column:
+    //    i. Let property be the name given in the Property column of the row.
+    //    ii. Let value be the value of r.[[<key>]].
+    //    iii. If the name given in the Type column of the row is "boolean", let value be the result of comparing value with "true".
+    // f. Set collator.[[<property>]] to value.
+    // g. Increase k by 1.
+    const String& collation = result.get(ASCIILiteral("co"));
+    m_collation = collation.isNull() ? ASCIILiteral("default") : collation;
+    m_numeric = (result.get(ASCIILiteral("kn")) == "true");
+
+    // 24. Let s be GetOption(options, "sensitivity", "string", «"base", "accent", "case", "variant"», undefined).
+    String sensitivityString = intlStringOption(state, options, vm.propertyNames->sensitivity, { "base", "accent", "case", "variant" }, "sensitivity must be either \"base\", \"accent\", \"case\", or \"variant\"", nullptr);
+    // 25. ReturnIfAbrupt(s).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 26. If s is undefined, then
+    // a. If u is "sort", then let s be "variant".
+    // b. Else
+    //    i. Let dataLocale be the value of r.[[dataLocale]].
+    //    ii. Let dataLocaleData be Get(localeData, dataLocale).
+    //    iii. Let s be Get(dataLocaleData, "sensitivity").
+    //    10.2.3 "[[searchLocaleData]][locale] must have a sensitivity property with a String value equal to "base", "accent", "case", or "variant" for all locale values."
+    // 27. Set collator.[[sensitivity]] to s.
+    if (sensitivityString == "base")
+        m_sensitivity = Sensitivity::Base;
+    else if (sensitivityString == "accent")
+        m_sensitivity = Sensitivity::Accent;
+    else if (sensitivityString == "case")
+        m_sensitivity = Sensitivity::Case;
+    else
+        m_sensitivity = Sensitivity::Variant;
+
+    // 28. Let ip be GetOption(options, "ignorePunctuation", "boolean", undefined, false).
+    bool usesFallback;
+    bool ignorePunctuation = intlBooleanOption(state, options, vm.propertyNames->ignorePunctuation, usesFallback);
+    if (usesFallback)
+        ignorePunctuation = false;
+    // 29. ReturnIfAbrupt(ip).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 30. Set collator.[[ignorePunctuation]] to ip.
+    m_ignorePunctuation = ignorePunctuation;
+
+    // 31. Set collator.[[boundCompare]] to undefined.
+    // 32. Set collator.[[initializedCollator]] to true.
+    m_initializedCollator = true;
+
+    // 33. Return collator.
+}
+
+void IntlCollator::createCollator(ExecState& state)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    ASSERT(!m_collator);
+
+    if (!m_initializedCollator) {
+        initializeCollator(state, jsUndefined(), jsUndefined());
+        ASSERT_UNUSED(scope, !scope.exception());
+    }
+
+    UErrorCode status = U_ZERO_ERROR;
+    auto collator = std::unique_ptr<UCollator, UCollatorDeleter>(ucol_open(m_locale.utf8().data(), &status));
+    if (U_FAILURE(status))
+        return;
+
+    UColAttributeValue strength = UCOL_PRIMARY;
+    UColAttributeValue caseLevel = UCOL_OFF;
+    switch (m_sensitivity) {
+    case Sensitivity::Base:
+        break;
+    case Sensitivity::Accent:
+        strength = UCOL_SECONDARY;
+        break;
+    case Sensitivity::Case:
+        caseLevel = UCOL_ON;
+        break;
+    case Sensitivity::Variant:
+        strength = UCOL_TERTIARY;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    ucol_setAttribute(collator.get(), UCOL_STRENGTH, strength, &status);
+    ucol_setAttribute(collator.get(), UCOL_CASE_LEVEL, caseLevel, &status);
+
+    ucol_setAttribute(collator.get(), UCOL_NUMERIC_COLLATION, m_numeric ? UCOL_ON : UCOL_OFF, &status);
+
+    // FIXME: Setting UCOL_ALTERNATE_HANDLING to UCOL_SHIFTED causes punctuation and whitespace to be
+    // ignored. There is currently no way to ignore only punctuation.
+    ucol_setAttribute(collator.get(), UCOL_ALTERNATE_HANDLING, m_ignorePunctuation ? UCOL_SHIFTED : UCOL_DEFAULT, &status);
+
+    // "The method is required to return 0 when comparing Strings that are considered canonically
+    // equivalent by the Unicode standard."
+    ucol_setAttribute(collator.get(), UCOL_NORMALIZATION_MODE, UCOL_ON, &status);
+    if (U_FAILURE(status))
+        return;
+
+    m_collator = WTFMove(collator);
+}
+
+JSValue IntlCollator::compareStrings(ExecState& state, StringView x, StringView y)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 10.3.4 CompareStrings abstract operation (ECMA-402 2.0)
+    if (!m_collator) {
+        createCollator(state);
+        if (!m_collator)
+            return throwException(&state, scope, createError(&state, ASCIILiteral("Failed to compare strings.")));
+    }
+
+    UErrorCode status = U_ZERO_ERROR;
+    UCharIterator iteratorX = createIterator(x);
+    UCharIterator iteratorY = createIterator(y);
+    auto result = ucol_strcollIter(m_collator.get(), &iteratorX, &iteratorY, &status);
+    if (U_FAILURE(status))
+        return throwException(&state, scope, createError(&state, ASCIILiteral("Failed to compare strings.")));
+    return jsNumber(result);
+}
+
+const char* IntlCollator::usageString(Usage usage)
+{
+    switch (usage) {
+    case Usage::Sort:
+        return "sort";
+    case Usage::Search:
+        return "search";
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlCollator::sensitivityString(Sensitivity sensitivity)
+{
+    switch (sensitivity) {
+    case Sensitivity::Base:
+        return "base";
+    case Sensitivity::Accent:
+        return "accent";
+    case Sensitivity::Case:
+        return "case";
+    case Sensitivity::Variant:
+        return "variant";
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+JSObject* IntlCollator::resolvedOptions(ExecState& state)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 10.3.5 Intl.Collator.prototype.resolvedOptions() (ECMA-402 2.0)
+    // The function returns a new object whose properties and attributes are set as if
+    // constructed by an object literal assigning to each of the following properties the
+    // value of the corresponding internal slot of this Collator object (see 10.4): locale,
+    // usage, sensitivity, ignorePunctuation, collation, as well as those properties shown
+    // in Table 1 whose keys are included in the %Collator%[[relevantExtensionKeys]]
+    // internal slot of the standard built-in object that is the initial value of
+    // Intl.Collator.
+
+    if (!m_initializedCollator) {
+        initializeCollator(state, jsUndefined(), jsUndefined());
+        ASSERT_UNUSED(scope, !scope.exception());
+    }
+
+    JSObject* options = constructEmptyObject(&state);
+    options->putDirect(vm, vm.propertyNames->locale, jsString(&state, m_locale));
+    options->putDirect(vm, vm.propertyNames->usage, jsNontrivialString(&state, ASCIILiteral(usageString(m_usage))));
+    options->putDirect(vm, vm.propertyNames->sensitivity, jsNontrivialString(&state, ASCIILiteral(sensitivityString(m_sensitivity))));
+    options->putDirect(vm, vm.propertyNames->ignorePunctuation, jsBoolean(m_ignorePunctuation));
+    options->putDirect(vm, vm.propertyNames->collation, jsString(&state, m_collation));
+    options->putDirect(vm, vm.propertyNames->numeric, jsBoolean(m_numeric));
+    return options;
+}
+
+void IntlCollator::setBoundCompare(VM& vm, JSBoundFunction* format)
+{
+    m_boundCompare.set(vm, this, format);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlCollator.h b/runtime/IntlCollator.h
new file mode 100644
index 0000000..f1554b0
--- /dev/null
+++ b/runtime/IntlCollator.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "JSDestructibleObject.h"
+
+struct UCollator;
+
+namespace JSC {
+
+class IntlCollatorConstructor;
+class JSBoundFunction;
+
+class IntlCollator : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static IntlCollator* create(VM&, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    void initializeCollator(ExecState&, JSValue locales, JSValue optionsValue);
+    JSValue compareStrings(ExecState&, StringView, StringView);
+    JSObject* resolvedOptions(ExecState&);
+
+    JSBoundFunction* boundCompare() const { return m_boundCompare.get(); }
+    void setBoundCompare(VM&, JSBoundFunction*);
+
+protected:
+    IntlCollator(VM&, Structure*);
+    void finishCreation(VM&);
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    enum class Usage { Sort, Search };
+    enum class Sensitivity { Base, Accent, Case, Variant };
+
+    struct UCollatorDeleter {
+        void operator()(UCollator*) const;
+    };
+
+    void createCollator(ExecState&);
+    static const char* usageString(Usage);
+    static const char* sensitivityString(Sensitivity);
+
+    Usage m_usage;
+    String m_locale;
+    String m_collation;
+    Sensitivity m_sensitivity;
+    WriteBarrier<JSBoundFunction> m_boundCompare;
+    std::unique_ptr<UCollator, UCollatorDeleter> m_collator;
+    bool m_numeric;
+    bool m_ignorePunctuation;
+    bool m_initializedCollator { false };
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlCollatorConstructor.cpp b/runtime/IntlCollatorConstructor.cpp
new file mode 100644
index 0000000..a625b09
--- /dev/null
+++ b/runtime/IntlCollatorConstructor.cpp
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2015 Sukolsak Sakshuwong (sukolsak@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlCollatorConstructor.h"
+
+#if ENABLE(INTL)
+
+#include "Error.h"
+#include "IntlCollator.h"
+#include "IntlCollatorPrototype.h"
+#include "IntlObject.h"
+#include "JSCInlines.h"
+#include "Lookup.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(IntlCollatorConstructor);
+
+static EncodedJSValue JSC_HOST_CALL IntlCollatorConstructorFuncSupportedLocalesOf(ExecState*);
+
+}
+
+#include "IntlCollatorConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo IntlCollatorConstructor::s_info = { "Function", &InternalFunction::s_info, &collatorConstructorTable, CREATE_METHOD_TABLE(IntlCollatorConstructor) };
+
+/* Source for IntlCollatorConstructor.lut.h
+@begin collatorConstructorTable
+  supportedLocalesOf             IntlCollatorConstructorFuncSupportedLocalesOf             DontEnum|Function 1
+@end
+*/
+
+IntlCollatorConstructor* IntlCollatorConstructor::create(VM& vm, Structure* structure, IntlCollatorPrototype* collatorPrototype, Structure* collatorStructure)
+{
+    IntlCollatorConstructor* constructor = new (NotNull, allocateCell<IntlCollatorConstructor>(vm.heap)) IntlCollatorConstructor(vm, structure);
+    constructor->finishCreation(vm, collatorPrototype, collatorStructure);
+    return constructor;
+}
+
+Structure* IntlCollatorConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlCollatorConstructor::IntlCollatorConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void IntlCollatorConstructor::finishCreation(VM& vm, IntlCollatorPrototype* collatorPrototype, Structure* collatorStructure)
+{
+    Base::finishCreation(vm, ASCIILiteral("Collator"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, collatorPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), ReadOnly | DontEnum | DontDelete);
+    m_collatorStructure.set(vm, this, collatorStructure);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructIntlCollator(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 10.1.2 Intl.Collator ([locales [, options]]) (ECMA-402 2.0)
+    // 1. If NewTarget is undefined, let newTarget be the active function object, else let newTarget be NewTarget.
+    // 2. Let collator be OrdinaryCreateFromConstructor(newTarget, %CollatorPrototype%).
+    // 3. ReturnIfAbrupt(collator).
+    Structure* structure = InternalFunction::createSubclassStructure(state, state->newTarget(), jsCast<IntlCollatorConstructor*>(state->jsCallee())->collatorStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    IntlCollator* collator = IntlCollator::create(vm, structure);
+    ASSERT(collator);
+
+    // 4. Return InitializeCollator(collator, locales, options).
+    scope.release();
+    collator->initializeCollator(*state, state->argument(0), state->argument(1));
+    return JSValue::encode(collator);
+}
+
+static EncodedJSValue JSC_HOST_CALL callIntlCollator(ExecState* state)
+{
+    // 10.1.2 Intl.Collator ([locales [, options]]) (ECMA-402 2.0)
+    // 1. If NewTarget is undefined, let newTarget be the active function object, else let newTarget be NewTarget.
+    // NewTarget is always undefined when called as a function.
+
+    VM& vm = state->vm();
+    IntlCollatorConstructor* callee = jsCast<IntlCollatorConstructor*>(state->jsCallee());
+
+    // FIXME: Collator does not get the workaround for ECMA-402 1.0 compatibility.
+    // https://bugs.webkit.org/show_bug.cgi?id=153679
+
+    // 2. Let collator be OrdinaryCreateFromConstructor(newTarget, %CollatorPrototype%).
+    // 3. ReturnIfAbrupt(collator).
+    IntlCollator* collator = IntlCollator::create(vm, callee->collatorStructure());
+    ASSERT(collator);
+
+    // 4. Return InitializeCollator(collator, locales, options).
+    collator->initializeCollator(*state, state->argument(0), state->argument(1));
+    return JSValue::encode(collator);
+}
+
+ConstructType IntlCollatorConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructIntlCollator;
+    return ConstructType::Host;
+}
+
+CallType IntlCollatorConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callIntlCollator;
+    return CallType::Host;
+}
+
+EncodedJSValue JSC_HOST_CALL IntlCollatorConstructorFuncSupportedLocalesOf(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 10.2.2 Intl.Collator.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)
+
+    // 1. Let requestedLocales be CanonicalizeLocaleList(locales).
+    Vector<String> requestedLocales = canonicalizeLocaleList(*state, state->argument(0));
+
+    // 2. ReturnIfAbrupt(requestedLocales).
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 3. Return SupportedLocales(%Collator%.[[availableLocales]], requestedLocales, options).
+    JSGlobalObject* globalObject = state->jsCallee()->globalObject();
+    scope.release();
+    return JSValue::encode(supportedLocales(*state, globalObject->intlCollatorAvailableLocales(), requestedLocales, state->argument(1)));
+}
+
+void IntlCollatorConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    IntlCollatorConstructor* thisObject = jsCast<IntlCollatorConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_collatorStructure);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlCollatorConstructor.h b/runtime/IntlCollatorConstructor.h
new file mode 100644
index 0000000..cf3468f
--- /dev/null
+++ b/runtime/IntlCollatorConstructor.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class IntlCollator;
+class IntlCollatorPrototype;
+
+class IntlCollatorConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static IntlCollatorConstructor* create(VM&, Structure*, IntlCollatorPrototype*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    Structure* collatorStructure() const { return m_collatorStructure.get(); }
+
+protected:
+    void finishCreation(VM&, IntlCollatorPrototype*, Structure*);
+
+private:
+    IntlCollatorConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+    WriteBarrier<Structure> m_collatorStructure;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlCollatorPrototype.cpp b/runtime/IntlCollatorPrototype.cpp
new file mode 100644
index 0000000..6132266
--- /dev/null
+++ b/runtime/IntlCollatorPrototype.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlCollatorPrototype.h"
+
+#if ENABLE(INTL)
+
+#include "Error.h"
+#include "IntlCollator.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL IntlCollatorPrototypeGetterCompare(ExecState*);
+static EncodedJSValue JSC_HOST_CALL IntlCollatorPrototypeFuncResolvedOptions(ExecState*);
+
+}
+
+#include "IntlCollatorPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo IntlCollatorPrototype::s_info = { "Object", &IntlCollator::s_info, &collatorPrototypeTable, CREATE_METHOD_TABLE(IntlCollatorPrototype) };
+
+/* Source for IntlCollatorPrototype.lut.h
+@begin collatorPrototypeTable
+  compare          IntlCollatorPrototypeGetterCompare        DontEnum|Accessor
+  resolvedOptions  IntlCollatorPrototypeFuncResolvedOptions  DontEnum|Function 0
+@end
+*/
+
+IntlCollatorPrototype* IntlCollatorPrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    IntlCollatorPrototype* object = new (NotNull, allocateCell<IntlCollatorPrototype>(vm.heap)) IntlCollatorPrototype(vm, structure);
+    object->finishCreation(vm);
+    return object;
+}
+
+Structure* IntlCollatorPrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlCollatorPrototype::IntlCollatorPrototype(VM& vm, Structure* structure)
+    : IntlCollator(vm, structure)
+{
+}
+
+void IntlCollatorPrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+static EncodedJSValue JSC_HOST_CALL IntlCollatorFuncCompare(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 10.3.4 Collator Compare Functions (ECMA-402 2.0)
+    // 1. Let collator be the this value.
+    // 2. Assert: Type(collator) is Object and collator has an [[initializedCollator]] internal slot whose value is true.
+    IntlCollator* collator = jsCast<IntlCollator*>(state->thisValue());
+
+    // 3. If x is not provided, let x be undefined.
+    // 4. If y is not provided, let y be undefined.
+    // 5. Let X be ToString(x).
+    JSString* x = state->argument(0).toString(state);
+    // 6. ReturnIfAbrupt(X).
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 7. Let Y be ToString(y).
+    JSString* y = state->argument(1).toString(state);
+    // 8. ReturnIfAbrupt(Y).
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 9. Return CompareStrings(collator, X, Y).
+    auto xViewWithString = x->viewWithUnderlyingString(*state);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    auto yViewWithString = y->viewWithUnderlyingString(*state);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(collator->compareStrings(*state, xViewWithString.view, yViewWithString.view));
+}
+
+EncodedJSValue JSC_HOST_CALL IntlCollatorPrototypeGetterCompare(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 10.3.3 Intl.Collator.prototype.compare (ECMA-402 2.0)
+    // 1. Let collator be this Collator object.
+    IntlCollator* collator = jsDynamicCast<IntlCollator*>(state->thisValue());
+    if (!collator)
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.Collator.prototype.compare called on value that's not an object initialized as a Collator")));
+
+    JSBoundFunction* boundCompare = collator->boundCompare();
+    // 2. If collator.[[boundCompare]] is undefined,
+    if (!boundCompare) {
+        JSGlobalObject* globalObject = collator->globalObject();
+        // a. Let F be a new built-in function object as defined in 11.3.4.
+        // b. The value of F’s length property is 2.
+        JSFunction* targetObject = JSFunction::create(vm, globalObject, 2, ASCIILiteral("compare"), IntlCollatorFuncCompare, NoIntrinsic);
+
+        // c. Let bc be BoundFunctionCreate(F, «this value»).
+        boundCompare = JSBoundFunction::create(vm, state, globalObject, targetObject, collator, nullptr, 2, ASCIILiteral("compare"));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        // d. Set collator.[[boundCompare]] to bc.
+        collator->setBoundCompare(vm, boundCompare);
+    }
+    // 3. Return collator.[[boundCompare]].
+    return JSValue::encode(boundCompare);
+}
+
+EncodedJSValue JSC_HOST_CALL IntlCollatorPrototypeFuncResolvedOptions(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 10.3.5 Intl.Collator.prototype.resolvedOptions() (ECMA-402 2.0)
+    IntlCollator* collator = jsDynamicCast<IntlCollator*>(state->thisValue());
+    if (!collator)
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.Collator.prototype.resolvedOptions called on value that's not an object initialized as a Collator")));
+
+    scope.release();
+    return JSValue::encode(collator->resolvedOptions(*state));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlCollatorPrototype.h b/runtime/IntlCollatorPrototype.h
new file mode 100644
index 0000000..8332e13
--- /dev/null
+++ b/runtime/IntlCollatorPrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "IntlCollator.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class IntlCollatorPrototype : public IntlCollator {
+public:
+    typedef IntlCollator Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static IntlCollatorPrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    IntlCollatorPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlDateTimeFormat.cpp b/runtime/IntlDateTimeFormat.cpp
new file mode 100644
index 0000000..6552c60
--- /dev/null
+++ b/runtime/IntlDateTimeFormat.cpp
@@ -0,0 +1,896 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlDateTimeFormat.h"
+
+#if ENABLE(INTL)
+
+#include "DateInstance.h"
+#include "Error.h"
+#include "IntlDateTimeFormatConstructor.h"
+#include "IntlObject.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "ObjectConstructor.h"
+#include <unicode/ucal.h>
+#include <unicode/udatpg.h>
+#include <unicode/uenum.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+const ClassInfo IntlDateTimeFormat::s_info = { "Object", &Base::s_info, 0, CREATE_METHOD_TABLE(IntlDateTimeFormat) };
+
+static const char* const relevantExtensionKeys[2] = { "ca", "nu" };
+static const size_t indexOfExtensionKeyCa = 0;
+static const size_t indexOfExtensionKeyNu = 1;
+
+void IntlDateTimeFormat::UDateFormatDeleter::operator()(UDateFormat* dateFormat) const
+{
+    if (dateFormat)
+        udat_close(dateFormat);
+}
+
+IntlDateTimeFormat* IntlDateTimeFormat::create(VM& vm, Structure* structure)
+{
+    IntlDateTimeFormat* format = new (NotNull, allocateCell<IntlDateTimeFormat>(vm.heap)) IntlDateTimeFormat(vm, structure);
+    format->finishCreation(vm);
+    return format;
+}
+
+Structure* IntlDateTimeFormat::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlDateTimeFormat::IntlDateTimeFormat(VM& vm, Structure* structure)
+    : JSDestructibleObject(vm, structure)
+{
+}
+
+void IntlDateTimeFormat::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+void IntlDateTimeFormat::destroy(JSCell* cell)
+{
+    static_cast<IntlDateTimeFormat*>(cell)->IntlDateTimeFormat::~IntlDateTimeFormat();
+}
+
+void IntlDateTimeFormat::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    IntlDateTimeFormat* thisObject = jsCast<IntlDateTimeFormat*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_boundFormat);
+}
+
+void IntlDateTimeFormat::setBoundFormat(VM& vm, JSBoundFunction* format)
+{
+    m_boundFormat.set(vm, this, format);
+}
+
+static String defaultTimeZone()
+{
+    // 6.4.3 DefaultTimeZone () (ECMA-402 2.0)
+    // The DefaultTimeZone abstract operation returns a String value representing the valid (6.4.1) and canonicalized (6.4.2) time zone name for the host environment’s current time zone.
+
+    UErrorCode status = U_ZERO_ERROR;
+    Vector<UChar, 32> buffer(32);
+    auto bufferLength = ucal_getDefaultTimeZone(buffer.data(), buffer.size(), &status);
+    if (status == U_BUFFER_OVERFLOW_ERROR) {
+        status = U_ZERO_ERROR;
+        buffer.grow(bufferLength);
+        ucal_getDefaultTimeZone(buffer.data(), bufferLength, &status);
+    }
+    if (U_SUCCESS(status)) {
+        status = U_ZERO_ERROR;
+        Vector<UChar, 32> canonicalBuffer(32);
+        auto canonicalLength = ucal_getCanonicalTimeZoneID(buffer.data(), bufferLength, canonicalBuffer.data(), canonicalBuffer.size(), nullptr, &status);
+        if (status == U_BUFFER_OVERFLOW_ERROR) {
+            status = U_ZERO_ERROR;
+            canonicalBuffer.grow(canonicalLength);
+            ucal_getCanonicalTimeZoneID(buffer.data(), bufferLength, canonicalBuffer.data(), canonicalLength, nullptr, &status);
+        }
+        if (U_SUCCESS(status))
+            return String(canonicalBuffer.data(), canonicalLength);
+    }
+
+    return ASCIILiteral("UTC");
+}
+
+static String canonicalizeTimeZoneName(const String& timeZoneName)
+{
+    // 6.4.1 IsValidTimeZoneName (timeZone)
+    // The abstract operation returns true if timeZone, converted to upper case as described in 6.1, is equal to one of the Zone or Link names of the IANA Time Zone Database, converted to upper case as described in 6.1. It returns false otherwise.
+    UErrorCode status = U_ZERO_ERROR;
+    UEnumeration* timeZones = ucal_openTimeZones(&status);
+    ASSERT(U_SUCCESS(status));
+
+    String canonical;
+    do {
+        status = U_ZERO_ERROR;
+        int32_t ianaTimeZoneLength;
+        // Time zone names are respresented as UChar[] in all related ICU apis.
+        const UChar* ianaTimeZone = uenum_unext(timeZones, &ianaTimeZoneLength, &status);
+        ASSERT(U_SUCCESS(status));
+
+        // End of enumeration.
+        if (!ianaTimeZone)
+            break;
+
+        StringView ianaTimeZoneView(ianaTimeZone, ianaTimeZoneLength);
+        if (!equalIgnoringASCIICase(timeZoneName, ianaTimeZoneView))
+            continue;
+
+        // Found a match, now canonicalize.
+        // 6.4.2 CanonicalizeTimeZoneName (timeZone) (ECMA-402 2.0)
+        // 1. Let ianaTimeZone be the Zone or Link name of the IANA Time Zone Database such that timeZone, converted to upper case as described in 6.1, is equal to ianaTimeZone, converted to upper case as described in 6.1.
+        // 2. If ianaTimeZone is a Link name, then let ianaTimeZone be the corresponding Zone name as specified in the “backward” file of the IANA Time Zone Database.
+
+        Vector<UChar, 32> buffer(ianaTimeZoneLength);
+        status = U_ZERO_ERROR;
+        auto canonicalLength = ucal_getCanonicalTimeZoneID(ianaTimeZone, ianaTimeZoneLength, buffer.data(), ianaTimeZoneLength, nullptr, &status);
+        if (status == U_BUFFER_OVERFLOW_ERROR) {
+            buffer.grow(canonicalLength);
+            status = U_ZERO_ERROR;
+            ucal_getCanonicalTimeZoneID(ianaTimeZone, ianaTimeZoneLength, buffer.data(), canonicalLength, nullptr, &status);
+        }
+        ASSERT(U_SUCCESS(status));
+        canonical = String(buffer.data(), canonicalLength);
+    } while (canonical.isNull());
+    uenum_close(timeZones);
+
+    // 3. If ianaTimeZone is "Etc/UTC" or "Etc/GMT", then return "UTC".
+    if (canonical == "Etc/UTC" || canonical == "Etc/GMT")
+        canonical = ASCIILiteral("UTC");
+
+    // 4. Return ianaTimeZone.
+    return canonical;
+}
+
+static Vector<String> localeData(const String& locale, size_t keyIndex)
+{
+    Vector<String> keyLocaleData;
+    switch (keyIndex) {
+    case indexOfExtensionKeyCa: {
+        UErrorCode status = U_ZERO_ERROR;
+        UEnumeration* calendars = ucal_getKeywordValuesForLocale("calendar", locale.utf8().data(), false, &status);
+        ASSERT(U_SUCCESS(status));
+
+        int32_t nameLength;
+        while (const char* availableName = uenum_next(calendars, &nameLength, &status)) {
+            ASSERT(U_SUCCESS(status));
+            String calendar = String(availableName, nameLength);
+            keyLocaleData.append(calendar);
+            // Ensure aliases used in language tag are allowed.
+            if (calendar == "gregorian")
+                keyLocaleData.append(ASCIILiteral("gregory"));
+            else if (calendar == "islamic-civil")
+                keyLocaleData.append(ASCIILiteral("islamicc"));
+            else if (calendar == "ethiopic-amete-alem")
+                keyLocaleData.append(ASCIILiteral("ethioaa"));
+        }
+        uenum_close(calendars);
+        break;
+    }
+    case indexOfExtensionKeyNu:
+        keyLocaleData = numberingSystemsForLocale(locale);
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    return keyLocaleData;
+}
+
+static JSObject* toDateTimeOptionsAnyDate(ExecState& exec, JSValue originalOptions)
+{
+    // 12.1.1 ToDateTimeOptions abstract operation (ECMA-402 2.0)
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. If options is undefined, then let options be null, else let options be ToObject(options).
+    // 2. ReturnIfAbrupt(options).
+    // 3. Let options be ObjectCreate(options).
+    JSObject* options;
+    if (originalOptions.isUndefined())
+        options = constructEmptyObject(&exec, exec.lexicalGlobalObject()->nullPrototypeObjectStructure());
+    else {
+        JSObject* originalToObject = originalOptions.toObject(&exec);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        options = constructEmptyObject(&exec, originalToObject);
+    }
+
+    // 4. Let needDefaults be true.
+    bool needDefaults = true;
+
+    // 5. If required is "date" or "any",
+    // Always "any".
+
+    // a. For each of the property names "weekday", "year", "month", "day":
+    // i. Let prop be the property name.
+    // ii. Let value be Get(options, prop).
+    // iii. ReturnIfAbrupt(value).
+    // iv. If value is not undefined, then let needDefaults be false.
+    JSValue weekday = options->get(&exec, vm.propertyNames->weekday);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!weekday.isUndefined())
+        needDefaults = false;
+
+    JSValue year = options->get(&exec, vm.propertyNames->year);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!year.isUndefined())
+        needDefaults = false;
+
+    JSValue month = options->get(&exec, vm.propertyNames->month);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!month.isUndefined())
+        needDefaults = false;
+
+    JSValue day = options->get(&exec, vm.propertyNames->day);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!day.isUndefined())
+        needDefaults = false;
+
+    // 6. If required is "time" or "any",
+    // Always "any".
+
+    // a. For each of the property names "hour", "minute", "second":
+    // i. Let prop be the property name.
+    // ii. Let value be Get(options, prop).
+    // iii. ReturnIfAbrupt(value).
+    // iv. If value is not undefined, then let needDefaults be false.
+    JSValue hour = options->get(&exec, vm.propertyNames->hour);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!hour.isUndefined())
+        needDefaults = false;
+
+    JSValue minute = options->get(&exec, vm.propertyNames->minute);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!minute.isUndefined())
+        needDefaults = false;
+
+    JSValue second = options->get(&exec, vm.propertyNames->second);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!second.isUndefined())
+        needDefaults = false;
+
+    // 7. If needDefaults is true and defaults is either "date" or "all", then
+    // Defaults is always "date".
+    if (needDefaults) {
+        // a. For each of the property names "year", "month", "day":
+        // i. Let status be CreateDatePropertyOrThrow(options, prop, "numeric").
+        // ii. ReturnIfAbrupt(status).
+        JSString* numeric = jsNontrivialString(&exec, ASCIILiteral("numeric"));
+
+        options->putDirect(vm, vm.propertyNames->year, numeric);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+
+        options->putDirect(vm, vm.propertyNames->month, numeric);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+
+        options->putDirect(vm, vm.propertyNames->day, numeric);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+    }
+
+    // 8. If needDefaults is true and defaults is either "time" or "all", then
+    // Defaults is always "date". Ignore this branch.
+
+    // 9. Return options.
+    return options;
+}
+
+void IntlDateTimeFormat::setFormatsFromPattern(const StringView& pattern)
+{
+    // Get all symbols from the pattern, and set format fields accordingly.
+    // http://unicode.org/reports/tr35/tr35-dates.html#Date_Field_Symbol_Table
+    unsigned length = pattern.length();
+    for (unsigned i = 0; i < length; ++i) {
+        UChar currentCharacter = pattern[i];
+        if (!isASCIIAlpha(currentCharacter))
+            continue;
+
+        unsigned count = 1;
+        while (i + 1 < length && pattern[i + 1] == currentCharacter) {
+            ++count;
+            ++i;
+        }
+
+        if (currentCharacter == 'h' || currentCharacter == 'K')
+            m_hour12 = true;
+        else if (currentCharacter == 'H' || currentCharacter == 'k')
+            m_hour12 = false;
+
+        switch (currentCharacter) {
+        case 'G':
+            if (count <= 3)
+                m_era = Era::Short;
+            else if (count == 4)
+                m_era = Era::Long;
+            else if (count == 5)
+                m_era = Era::Narrow;
+            break;
+        case 'y':
+            if (count == 1)
+                m_year = Year::Numeric;
+            else if (count == 2)
+                m_year = Year::TwoDigit;
+            break;
+        case 'M':
+        case 'L':
+            if (count == 1)
+                m_month = Month::Numeric;
+            else if (count == 2)
+                m_month = Month::TwoDigit;
+            else if (count == 3)
+                m_month = Month::Short;
+            else if (count == 4)
+                m_month = Month::Long;
+            else if (count == 5)
+                m_month = Month::Narrow;
+            break;
+        case 'E':
+        case 'e':
+        case 'c':
+            if (count <= 3)
+                m_weekday = Weekday::Short;
+            else if (count == 4)
+                m_weekday = Weekday::Long;
+            else if (count == 5)
+                m_weekday = Weekday::Narrow;
+            break;
+        case 'd':
+            if (count == 1)
+                m_day = Day::Numeric;
+            else if (count == 2)
+                m_day = Day::TwoDigit;
+            break;
+        case 'h':
+        case 'H':
+        case 'k':
+        case 'K':
+            if (count == 1)
+                m_hour = Hour::Numeric;
+            else if (count == 2)
+                m_hour = Hour::TwoDigit;
+            break;
+        case 'm':
+            if (count == 1)
+                m_minute = Minute::Numeric;
+            else if (count == 2)
+                m_minute = Minute::TwoDigit;
+            break;
+        case 's':
+            if (count == 1)
+                m_second = Second::Numeric;
+            else if (count == 2)
+                m_second = Second::TwoDigit;
+            break;
+        case 'z':
+        case 'v':
+        case 'V':
+            if (count == 1)
+                m_timeZoneName = TimeZoneName::Short;
+            else if (count == 4)
+                m_timeZoneName = TimeZoneName::Long;
+            break;
+        }
+    }
+}
+
+void IntlDateTimeFormat::initializeDateTimeFormat(ExecState& exec, JSValue locales, JSValue originalOptions)
+{
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 12.1.1 InitializeDateTimeFormat (dateTimeFormat, locales, options) (ECMA-402 2.0)
+    // 1. If dateTimeFormat.[[initializedIntlObject]] is true, throw a TypeError exception.
+    // 2. Set dateTimeFormat.[[initializedIntlObject]] to true.
+
+    // 3. Let requestedLocales be CanonicalizeLocaleList(locales).
+    Vector<String> requestedLocales = canonicalizeLocaleList(exec, locales);
+    // 4. ReturnIfAbrupt(requestedLocales),
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // 5. Let options be ToDateTimeOptions(options, "any", "date").
+    JSObject* options = toDateTimeOptionsAnyDate(exec, originalOptions);
+    // 6. ReturnIfAbrupt(options).
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // 7. Let opt be a new Record.
+    HashMap<String, String> localeOpt;
+
+    // 8. Let matcher be GetOption(options, "localeMatcher", "string", «"lookup", "best fit"», "best fit").
+    String localeMatcher = intlStringOption(exec, options, vm.propertyNames->localeMatcher, { "lookup", "best fit" }, "localeMatcher must be either \"lookup\" or \"best fit\"", "best fit");
+    // 9. ReturnIfAbrupt(matcher).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 10. Set opt.[[localeMatcher]] to matcher.
+    localeOpt.add(vm.propertyNames->localeMatcher.string(), localeMatcher);
+
+    // 11. Let localeData be the value of %DateTimeFormat%.[[localeData]].
+    // 12. Let r be ResolveLocale( %DateTimeFormat%.[[availableLocales]], requestedLocales, opt, %DateTimeFormat%.[[relevantExtensionKeys]], localeData).
+    const HashSet<String> availableLocales = exec.jsCallee()->globalObject()->intlDateTimeFormatAvailableLocales();
+    HashMap<String, String> resolved = resolveLocale(exec, availableLocales, requestedLocales, localeOpt, relevantExtensionKeys, WTF_ARRAY_LENGTH(relevantExtensionKeys), localeData);
+
+    // 13. Set dateTimeFormat.[[locale]] to the value of r.[[locale]].
+    m_locale = resolved.get(vm.propertyNames->locale.string());
+    if (m_locale.isEmpty()) {
+        throwTypeError(&exec, scope, ASCIILiteral("failed to initialize DateTimeFormat due to invalid locale"));
+        return;
+    }
+    // 14. Set dateTimeFormat.[[calendar]] to the value of r.[[ca]].
+    m_calendar = resolved.get(ASCIILiteral("ca"));
+    // Switch to preferred aliases.
+    if (m_calendar == "gregory")
+        m_calendar = ASCIILiteral("gregorian");
+    else if (m_calendar == "islamicc")
+        m_calendar = ASCIILiteral("islamic-civil");
+    else if (m_calendar == "ethioaa")
+        m_calendar = ASCIILiteral("ethiopic-amete-alem");
+    // 15. Set dateTimeFormat.[[numberingSystem]] to the value of r.[[nu]].
+    m_numberingSystem = resolved.get(ASCIILiteral("nu"));
+    // 16. Let dataLocale be the value of r.[[dataLocale]].
+    String dataLocale = resolved.get(ASCIILiteral("dataLocale"));
+
+    // 17. Let tz be Get(options, "timeZone").
+    JSValue tzValue = options->get(&exec, vm.propertyNames->timeZone);
+    // 18. ReturnIfAbrupt(tz).
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // 19. If tz is not undefined, then
+    String tz;
+    if (!tzValue.isUndefined()) {
+        // a. Let tz be ToString(tz).
+        String originalTz = tzValue.toWTFString(&exec);
+        // b. ReturnIfAbrupt(tz).
+        RETURN_IF_EXCEPTION(scope, void());
+        // c. If the result of IsValidTimeZoneName(tz) is false, then i. Throw a RangeError exception.
+        // d. Let tz be CanonicalizeTimeZoneName(tz).
+        tz = canonicalizeTimeZoneName(originalTz);
+        if (tz.isNull()) {
+            throwRangeError(&exec, scope, String::format("invalid time zone: %s", originalTz.utf8().data()));
+            return;
+        }
+    } else {
+        // 20. Else,
+        // a. Let tz be DefaultTimeZone().
+        tz = defaultTimeZone();
+    }
+
+    // 21. Set dateTimeFormat.[[timeZone]] to tz.
+    m_timeZone = tz;
+
+    // 22. Let opt be a new Record.
+    // Rather than building a record, build the skeleton pattern.
+    StringBuilder skeletonBuilder;
+
+    // 23. For each row of Table 3, except the header row, do:
+    // a. Let prop be the name given in the Property column of the row.
+    // b. Let value be GetOption(options, prop, "string", «the strings given in the Values column of the row», undefined).
+    // c. ReturnIfAbrupt(value).
+    // d. Set opt.[[<prop>]] to value.
+    auto narrowShortLong = { "narrow", "short", "long" };
+    auto twoDigitNumeric = { "2-digit", "numeric" };
+    auto twoDigitNumericNarrowShortLong = { "2-digit", "numeric", "narrow", "short", "long" };
+    auto shortLong = { "short", "long" };
+
+    String weekday = intlStringOption(exec, options, vm.propertyNames->weekday, narrowShortLong, "weekday must be \"narrow\", \"short\", or \"long\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (!weekday.isNull()) {
+        if (weekday == "narrow")
+            skeletonBuilder.appendLiteral("EEEEE");
+        else if (weekday == "short")
+            skeletonBuilder.appendLiteral("EEE");
+        else if (weekday == "long")
+            skeletonBuilder.appendLiteral("EEEE");
+    }
+
+    String era = intlStringOption(exec, options, vm.propertyNames->era, narrowShortLong, "era must be \"narrow\", \"short\", or \"long\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (!era.isNull()) {
+        if (era == "narrow")
+            skeletonBuilder.appendLiteral("GGGGG");
+        else if (era == "short")
+            skeletonBuilder.appendLiteral("GGG");
+        else if (era == "long")
+            skeletonBuilder.appendLiteral("GGGG");
+    }
+
+    String year = intlStringOption(exec, options, vm.propertyNames->year, twoDigitNumeric, "year must be \"2-digit\" or \"numeric\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (!year.isNull()) {
+        if (year == "2-digit")
+            skeletonBuilder.appendLiteral("yy");
+        else if (year == "numeric")
+            skeletonBuilder.append('y');
+    }
+
+    String month = intlStringOption(exec, options, vm.propertyNames->month, twoDigitNumericNarrowShortLong, "month must be \"2-digit\", \"numeric\", \"narrow\", \"short\", or \"long\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (!month.isNull()) {
+        if (month == "2-digit")
+            skeletonBuilder.appendLiteral("MM");
+        else if (month == "numeric")
+            skeletonBuilder.append('M');
+        else if (month == "narrow")
+            skeletonBuilder.appendLiteral("MMMMM");
+        else if (month == "short")
+            skeletonBuilder.appendLiteral("MMM");
+        else if (month == "long")
+            skeletonBuilder.appendLiteral("MMMM");
+    }
+
+    String day = intlStringOption(exec, options, vm.propertyNames->day, twoDigitNumeric, "day must be \"2-digit\" or \"numeric\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (!day.isNull()) {
+        if (day == "2-digit")
+            skeletonBuilder.appendLiteral("dd");
+        else if (day == "numeric")
+            skeletonBuilder.append('d');
+    }
+
+    String hour = intlStringOption(exec, options, vm.propertyNames->hour, twoDigitNumeric, "hour must be \"2-digit\" or \"numeric\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // We need hour12 to make the hour skeleton pattern decision, so do this early.
+    // 32. Let hr12 be GetOption(options, "hour12", "boolean", undefined, undefined).
+    bool isHour12Undefined;
+    bool hr12 = intlBooleanOption(exec, options, vm.propertyNames->hour12, isHour12Undefined);
+    // 33. ReturnIfAbrupt(hr12).
+    RETURN_IF_EXCEPTION(scope, void());
+
+    if (!hour.isNull()) {
+        if (isHour12Undefined) {
+            if (hour == "2-digit")
+                skeletonBuilder.appendLiteral("jj");
+            else if (hour == "numeric")
+                skeletonBuilder.append('j');
+        } else if (hr12) {
+            if (hour == "2-digit")
+                skeletonBuilder.appendLiteral("hh");
+            else if (hour == "numeric")
+                skeletonBuilder.append('h');
+        } else {
+            if (hour == "2-digit")
+                skeletonBuilder.appendLiteral("HH");
+            else if (hour == "numeric")
+                skeletonBuilder.append('H');
+        }
+    }
+
+    String minute = intlStringOption(exec, options, vm.propertyNames->minute, twoDigitNumeric, "minute must be \"2-digit\" or \"numeric\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (!minute.isNull()) {
+        if (minute == "2-digit")
+            skeletonBuilder.appendLiteral("mm");
+        else if (minute == "numeric")
+            skeletonBuilder.append('m');
+    }
+
+    String second = intlStringOption(exec, options, vm.propertyNames->second, twoDigitNumeric, "second must be \"2-digit\" or \"numeric\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (!second.isNull()) {
+        if (second == "2-digit")
+            skeletonBuilder.appendLiteral("ss");
+        else if (second == "numeric")
+            skeletonBuilder.append('s');
+    }
+
+    String timeZoneName = intlStringOption(exec, options, vm.propertyNames->timeZoneName, shortLong, "timeZoneName must be \"short\" or \"long\"", nullptr);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (!timeZoneName.isNull()) {
+        if (timeZoneName == "short")
+            skeletonBuilder.append('z');
+        else if (timeZoneName == "long")
+            skeletonBuilder.appendLiteral("zzzz");
+    }
+
+    // 24. Let dataLocaleData be Get(localeData, dataLocale).
+    // 25. Let formats be Get(dataLocaleData, "formats").
+    // 26. Let matcher be GetOption(options, "formatMatcher", "string", «"basic", "best fit"», "best fit").
+    intlStringOption(exec, options, vm.propertyNames->formatMatcher, { "basic", "best fit" }, "formatMatcher must be either \"basic\" or \"best fit\"", "best fit");
+    // 27. ReturnIfAbrupt(matcher).
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // Always use ICU date format generator, rather than our own pattern list and matcher.
+    // Covers steps 28-36.
+    UErrorCode status = U_ZERO_ERROR;
+    UDateTimePatternGenerator* generator = udatpg_open(dataLocale.utf8().data(), &status);
+    if (U_FAILURE(status)) {
+        throwTypeError(&exec, scope, ASCIILiteral("failed to initialize DateTimeFormat"));
+        return;
+    }
+
+    String skeleton = skeletonBuilder.toString();
+    StringView skeletonView(skeleton);
+    Vector<UChar, 32> patternBuffer(32);
+    status = U_ZERO_ERROR;
+    auto patternLength = udatpg_getBestPattern(generator, skeletonView.upconvertedCharacters(), skeletonView.length(), patternBuffer.data(), patternBuffer.size(), &status);
+    if (status == U_BUFFER_OVERFLOW_ERROR) {
+        status = U_ZERO_ERROR;
+        patternBuffer.grow(patternLength);
+        udatpg_getBestPattern(generator, skeletonView.upconvertedCharacters(), skeletonView.length(), patternBuffer.data(), patternLength, &status);
+    }
+    udatpg_close(generator);
+    if (U_FAILURE(status)) {
+        throwTypeError(&exec, scope, ASCIILiteral("failed to initialize DateTimeFormat"));
+        return;
+    }
+
+    StringView pattern(patternBuffer.data(), patternLength);
+    setFormatsFromPattern(pattern);
+
+    status = U_ZERO_ERROR;
+    StringView timeZoneView(m_timeZone);
+    m_dateFormat = std::unique_ptr<UDateFormat, UDateFormatDeleter>(udat_open(UDAT_PATTERN, UDAT_PATTERN, m_locale.utf8().data(), timeZoneView.upconvertedCharacters(), timeZoneView.length(), pattern.upconvertedCharacters(), pattern.length(), &status));
+    if (U_FAILURE(status)) {
+        throwTypeError(&exec, scope, ASCIILiteral("failed to initialize DateTimeFormat"));
+        return;
+    }
+
+    // 37. Set dateTimeFormat.[[boundFormat]] to undefined.
+    // Already undefined.
+
+    // 38. Set dateTimeFormat.[[initializedDateTimeFormat]] to true.
+    m_initializedDateTimeFormat = true;
+
+    // 39. Return dateTimeFormat.
+}
+
+const char* IntlDateTimeFormat::weekdayString(Weekday weekday)
+{
+    switch (weekday) {
+    case Weekday::Narrow:
+        return "narrow";
+    case Weekday::Short:
+        return "short";
+    case Weekday::Long:
+        return "long";
+    case Weekday::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlDateTimeFormat::eraString(Era era)
+{
+    switch (era) {
+    case Era::Narrow:
+        return "narrow";
+    case Era::Short:
+        return "short";
+    case Era::Long:
+        return "long";
+    case Era::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlDateTimeFormat::yearString(Year year)
+{
+    switch (year) {
+    case Year::TwoDigit:
+        return "2-digit";
+    case Year::Numeric:
+        return "numeric";
+    case Year::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlDateTimeFormat::monthString(Month month)
+{
+    switch (month) {
+    case Month::TwoDigit:
+        return "2-digit";
+    case Month::Numeric:
+        return "numeric";
+    case Month::Narrow:
+        return "narrow";
+    case Month::Short:
+        return "short";
+    case Month::Long:
+        return "long";
+    case Month::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlDateTimeFormat::dayString(Day day)
+{
+    switch (day) {
+    case Day::TwoDigit:
+        return "2-digit";
+    case Day::Numeric:
+        return "numeric";
+    case Day::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlDateTimeFormat::hourString(Hour hour)
+{
+    switch (hour) {
+    case Hour::TwoDigit:
+        return "2-digit";
+    case Hour::Numeric:
+        return "numeric";
+    case Hour::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlDateTimeFormat::minuteString(Minute minute)
+{
+    switch (minute) {
+    case Minute::TwoDigit:
+        return "2-digit";
+    case Minute::Numeric:
+        return "numeric";
+    case Minute::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlDateTimeFormat::secondString(Second second)
+{
+    switch (second) {
+    case Second::TwoDigit:
+        return "2-digit";
+    case Second::Numeric:
+        return "numeric";
+    case Second::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlDateTimeFormat::timeZoneNameString(TimeZoneName timeZoneName)
+{
+    switch (timeZoneName) {
+    case TimeZoneName::Short:
+        return "short";
+    case TimeZoneName::Long:
+        return "long";
+    case TimeZoneName::None:
+        ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+JSObject* IntlDateTimeFormat::resolvedOptions(ExecState& exec)
+{
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 12.3.5 Intl.DateTimeFormat.prototype.resolvedOptions() (ECMA-402 2.0)
+    // The function returns a new object whose properties and attributes are set as if constructed by an object literal assigning to each of the following properties the value of the corresponding internal slot of this DateTimeFormat object (see 12.4): locale, calendar, numberingSystem, timeZone, hour12, weekday, era, year, month, day, hour, minute, second, and timeZoneName. Properties whose corresponding internal slots are not present are not assigned.
+    // Note: In this version of the ECMAScript 2015 Internationalization API, the timeZone property will be the name of the default time zone if no timeZone property was provided in the options object provided to the Intl.DateTimeFormat constructor. The previous version left the timeZone property undefined in this case.
+    if (!m_initializedDateTimeFormat) {
+        initializeDateTimeFormat(exec, jsUndefined(), jsUndefined());
+        ASSERT_UNUSED(scope, !scope.exception());
+    }
+
+    JSObject* options = constructEmptyObject(&exec);
+    options->putDirect(vm, vm.propertyNames->locale, jsNontrivialString(&exec, m_locale));
+    options->putDirect(vm, vm.propertyNames->calendar, jsNontrivialString(&exec, m_calendar));
+    options->putDirect(vm, vm.propertyNames->numberingSystem, jsNontrivialString(&exec, m_numberingSystem));
+    options->putDirect(vm, vm.propertyNames->timeZone, jsNontrivialString(&exec, m_timeZone));
+
+    if (m_weekday != Weekday::None)
+        options->putDirect(vm, vm.propertyNames->weekday, jsNontrivialString(&exec, ASCIILiteral(weekdayString(m_weekday))));
+
+    if (m_era != Era::None)
+        options->putDirect(vm, vm.propertyNames->era, jsNontrivialString(&exec, ASCIILiteral(eraString(m_era))));
+
+    if (m_year != Year::None)
+        options->putDirect(vm, vm.propertyNames->year, jsNontrivialString(&exec, ASCIILiteral(yearString(m_year))));
+
+    if (m_month != Month::None)
+        options->putDirect(vm, vm.propertyNames->month, jsNontrivialString(&exec, ASCIILiteral(monthString(m_month))));
+
+    if (m_day != Day::None)
+        options->putDirect(vm, vm.propertyNames->day, jsNontrivialString(&exec, ASCIILiteral(dayString(m_day))));
+
+    if (m_hour != Hour::None) {
+        options->putDirect(vm, vm.propertyNames->hour, jsNontrivialString(&exec, ASCIILiteral(hourString(m_hour))));
+        options->putDirect(vm, vm.propertyNames->hour12, jsBoolean(m_hour12));
+    }
+
+    if (m_minute != Minute::None)
+        options->putDirect(vm, vm.propertyNames->minute, jsNontrivialString(&exec, ASCIILiteral(minuteString(m_minute))));
+
+    if (m_second != Second::None)
+        options->putDirect(vm, vm.propertyNames->second, jsNontrivialString(&exec, ASCIILiteral(secondString(m_second))));
+
+    if (m_timeZoneName != TimeZoneName::None)
+        options->putDirect(vm, vm.propertyNames->timeZoneName, jsNontrivialString(&exec, ASCIILiteral(timeZoneNameString(m_timeZoneName))));
+
+    return options;
+}
+
+JSValue IntlDateTimeFormat::format(ExecState& exec, double value)
+{
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 12.3.4 FormatDateTime abstract operation (ECMA-402 2.0)
+    if (!m_initializedDateTimeFormat) {
+        initializeDateTimeFormat(exec, jsUndefined(), jsUndefined());
+        ASSERT(!scope.exception());
+    }
+
+    // 1. If x is not a finite Number, then throw a RangeError exception.
+    if (!std::isfinite(value))
+        return throwRangeError(&exec, scope, ASCIILiteral("date value is not finite in DateTimeFormat format()"));
+
+    // Delegate remaining steps to ICU.
+    UErrorCode status = U_ZERO_ERROR;
+    Vector<UChar, 32> result(32);
+    auto resultLength = udat_format(m_dateFormat.get(), value, result.data(), result.size(), nullptr, &status);
+    if (status == U_BUFFER_OVERFLOW_ERROR) {
+        status = U_ZERO_ERROR;
+        result.grow(resultLength);
+        udat_format(m_dateFormat.get(), value, result.data(), resultLength, nullptr, &status);
+    }
+    if (U_FAILURE(status))
+        return throwTypeError(&exec, scope, ASCIILiteral("failed to format date value"));
+
+    return jsString(&exec, String(result.data(), resultLength));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlDateTimeFormat.h b/runtime/IntlDateTimeFormat.h
new file mode 100644
index 0000000..f2e35d1
--- /dev/null
+++ b/runtime/IntlDateTimeFormat.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "JSDestructibleObject.h"
+#include <unicode/udat.h>
+
+namespace JSC {
+
+class IntlDateTimeFormatConstructor;
+class JSBoundFunction;
+
+class IntlDateTimeFormat : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static IntlDateTimeFormat* create(VM&, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    void initializeDateTimeFormat(ExecState&, JSValue locales, JSValue options);
+    JSValue format(ExecState&, double value);
+    JSObject* resolvedOptions(ExecState&);
+
+    JSBoundFunction* boundFormat() const { return m_boundFormat.get(); }
+    void setBoundFormat(VM&, JSBoundFunction*);
+
+protected:
+    IntlDateTimeFormat(VM&, Structure*);
+    void finishCreation(VM&);
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    enum class Weekday { None, Narrow, Short, Long };
+    enum class Era { None, Narrow, Short, Long };
+    enum class Year { None, TwoDigit, Numeric };
+    enum class Month { None, TwoDigit, Numeric, Narrow, Short, Long };
+    enum class Day { None, TwoDigit, Numeric };
+    enum class Hour { None, TwoDigit, Numeric };
+    enum class Minute { None, TwoDigit, Numeric };
+    enum class Second { None, TwoDigit, Numeric };
+    enum class TimeZoneName { None, Short, Long };
+
+    struct UDateFormatDeleter {
+        void operator()(UDateFormat*) const;
+    };
+
+    void setFormatsFromPattern(const StringView&);
+    static const char* weekdayString(Weekday);
+    static const char* eraString(Era);
+    static const char* yearString(Year);
+    static const char* monthString(Month);
+    static const char* dayString(Day);
+    static const char* hourString(Hour);
+    static const char* minuteString(Minute);
+    static const char* secondString(Second);
+    static const char* timeZoneNameString(TimeZoneName);
+
+    bool m_initializedDateTimeFormat { false };
+    WriteBarrier<JSBoundFunction> m_boundFormat;
+    std::unique_ptr<UDateFormat, UDateFormatDeleter> m_dateFormat;
+
+    String m_locale;
+    String m_calendar;
+    String m_numberingSystem;
+    String m_timeZone;
+    bool m_hour12 { true };
+    Weekday m_weekday { Weekday::None };
+    Era m_era { Era::None };
+    Year m_year { Year::None };
+    Month m_month { Month::None };
+    Day m_day { Day::None };
+    Hour m_hour { Hour::None };
+    Minute m_minute { Minute::None };
+    Second m_second { Second::None };
+    TimeZoneName m_timeZoneName { TimeZoneName::None };
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlDateTimeFormatConstructor.cpp b/runtime/IntlDateTimeFormatConstructor.cpp
new file mode 100644
index 0000000..7f57975
--- /dev/null
+++ b/runtime/IntlDateTimeFormatConstructor.cpp
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlDateTimeFormatConstructor.h"
+
+#if ENABLE(INTL)
+
+#include "Error.h"
+#include "IntlDateTimeFormat.h"
+#include "IntlDateTimeFormatPrototype.h"
+#include "IntlObject.h"
+#include "IntlObjectInlines.h"
+#include "JSCInlines.h"
+#include "Lookup.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(IntlDateTimeFormatConstructor);
+
+static EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatConstructorFuncSupportedLocalesOf(ExecState*);
+
+}
+
+#include "IntlDateTimeFormatConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo IntlDateTimeFormatConstructor::s_info = { "Function", &InternalFunction::s_info, &dateTimeFormatConstructorTable, CREATE_METHOD_TABLE(IntlDateTimeFormatConstructor) };
+
+/* Source for IntlDateTimeFormatConstructor.lut.h
+@begin dateTimeFormatConstructorTable
+  supportedLocalesOf             IntlDateTimeFormatConstructorFuncSupportedLocalesOf             DontEnum|Function 1
+@end
+*/
+
+IntlDateTimeFormatConstructor* IntlDateTimeFormatConstructor::create(VM& vm, Structure* structure, IntlDateTimeFormatPrototype* dateTimeFormatPrototype, Structure* dateTimeFormatStructure)
+{
+    IntlDateTimeFormatConstructor* constructor = new (NotNull, allocateCell<IntlDateTimeFormatConstructor>(vm.heap)) IntlDateTimeFormatConstructor(vm, structure);
+    constructor->finishCreation(vm, dateTimeFormatPrototype, dateTimeFormatStructure);
+    return constructor;
+}
+
+Structure* IntlDateTimeFormatConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlDateTimeFormatConstructor::IntlDateTimeFormatConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void IntlDateTimeFormatConstructor::finishCreation(VM& vm, IntlDateTimeFormatPrototype* dateTimeFormatPrototype, Structure* dateTimeFormatStructure)
+{
+    Base::finishCreation(vm, ASCIILiteral("DateTimeFormat"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, dateTimeFormatPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), ReadOnly | DontEnum | DontDelete);
+    m_dateTimeFormatStructure.set(vm, this, dateTimeFormatStructure);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructIntlDateTimeFormat(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 12.1.2 Intl.DateTimeFormat ([locales [, options]]) (ECMA-402 2.0)
+    // 1. If NewTarget is undefined, let newTarget be the active function object, else let newTarget be NewTarget.
+    // 2. Let dateTimeFormat be OrdinaryCreateFromConstructor(newTarget, %DateTimeFormatPrototype%).
+    // 3. ReturnIfAbrupt(dateTimeFormat).
+    Structure* structure = InternalFunction::createSubclassStructure(state, state->newTarget(), jsCast<IntlDateTimeFormatConstructor*>(state->jsCallee())->dateTimeFormatStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    IntlDateTimeFormat* dateTimeFormat = IntlDateTimeFormat::create(vm, structure);
+    ASSERT(dateTimeFormat);
+
+    // 4. Return InitializeDateTimeFormat(dateTimeFormat, locales, options).
+    scope.release();
+    dateTimeFormat->initializeDateTimeFormat(*state, state->argument(0), state->argument(1));
+    return JSValue::encode(dateTimeFormat);
+}
+
+static EncodedJSValue JSC_HOST_CALL callIntlDateTimeFormat(ExecState* state)
+{
+    // 12.1.2 Intl.DateTimeFormat ([locales [, options]]) (ECMA-402 2.0)
+    // 1. If NewTarget is undefined, let newTarget be the active function object, else let newTarget be NewTarget.
+    // NewTarget is always undefined when called as a function.
+
+    IntlDateTimeFormatConstructor* callee = jsCast<IntlDateTimeFormatConstructor*>(state->jsCallee());
+
+    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
+    // https://bugs.webkit.org/show_bug.cgi?id=153679
+    return JSValue::encode(constructIntlInstanceWithWorkaroundForLegacyIntlConstructor<IntlDateTimeFormat>(*state, state->thisValue(), callee, [&] (VM& vm) {
+        // 2. Let dateTimeFormat be OrdinaryCreateFromConstructor(newTarget, %DateTimeFormatPrototype%).
+        // 3. ReturnIfAbrupt(dateTimeFormat).
+        IntlDateTimeFormat* dateTimeFormat = IntlDateTimeFormat::create(vm, callee->dateTimeFormatStructure());
+        ASSERT(dateTimeFormat);
+
+        // 4. Return InitializeDateTimeFormat(dateTimeFormat, locales, options).
+        dateTimeFormat->initializeDateTimeFormat(*state, state->argument(0), state->argument(1));
+        return dateTimeFormat;
+    }));
+}
+
+ConstructType IntlDateTimeFormatConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructIntlDateTimeFormat;
+    return ConstructType::Host;
+}
+
+CallType IntlDateTimeFormatConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callIntlDateTimeFormat;
+    return CallType::Host;
+}
+
+EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatConstructorFuncSupportedLocalesOf(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 12.2.2 Intl.DateTimeFormat.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)
+
+    // 1. Let availableLocales be %DateTimeFormat%.[[availableLocales]].
+    JSGlobalObject* globalObject = state->jsCallee()->globalObject();
+    const HashSet<String> availableLocales = globalObject->intlDateTimeFormatAvailableLocales();
+
+    // 2. Let requestedLocales be CanonicalizeLocaleList(locales).
+    Vector<String> requestedLocales = canonicalizeLocaleList(*state, state->argument(0));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 3. Return SupportedLocales(availableLocales, requestedLocales, options).
+    scope.release();
+    return JSValue::encode(supportedLocales(*state, availableLocales, requestedLocales, state->argument(1)));
+}
+
+void IntlDateTimeFormatConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    IntlDateTimeFormatConstructor* thisObject = jsCast<IntlDateTimeFormatConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_dateTimeFormatStructure);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlDateTimeFormatConstructor.h b/runtime/IntlDateTimeFormatConstructor.h
new file mode 100644
index 0000000..f1ba267
--- /dev/null
+++ b/runtime/IntlDateTimeFormatConstructor.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class IntlDateTimeFormat;
+class IntlDateTimeFormatPrototype;
+
+class IntlDateTimeFormatConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static IntlDateTimeFormatConstructor* create(VM&, Structure*, IntlDateTimeFormatPrototype*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    Structure* dateTimeFormatStructure() const { return m_dateTimeFormatStructure.get(); }
+
+protected:
+    void finishCreation(VM&, IntlDateTimeFormatPrototype*, Structure*);
+
+private:
+    IntlDateTimeFormatConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+    WriteBarrier<Structure> m_dateTimeFormatStructure;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlDateTimeFormatPrototype.cpp b/runtime/IntlDateTimeFormatPrototype.cpp
new file mode 100644
index 0000000..91b5a9a
--- /dev/null
+++ b/runtime/IntlDateTimeFormatPrototype.cpp
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlDateTimeFormatPrototype.h"
+
+#if ENABLE(INTL)
+
+#include "BuiltinNames.h"
+#include "DateConstructor.h"
+#include "Error.h"
+#include "IntlDateTimeFormat.h"
+#include "IntlObject.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "JSObjectInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatPrototypeGetterFormat(ExecState*);
+static EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatPrototypeFuncResolvedOptions(ExecState*);
+
+}
+
+#include "IntlDateTimeFormatPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo IntlDateTimeFormatPrototype::s_info = { "Object", &IntlDateTimeFormat::s_info, &dateTimeFormatPrototypeTable, CREATE_METHOD_TABLE(IntlDateTimeFormatPrototype) };
+
+/* Source for IntlDateTimeFormatPrototype.lut.h
+@begin dateTimeFormatPrototypeTable
+  format           IntlDateTimeFormatPrototypeGetterFormat         DontEnum|Accessor
+  resolvedOptions  IntlDateTimeFormatPrototypeFuncResolvedOptions  DontEnum|Function 0
+@end
+*/
+
+IntlDateTimeFormatPrototype* IntlDateTimeFormatPrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    IntlDateTimeFormatPrototype* object = new (NotNull, allocateCell<IntlDateTimeFormatPrototype>(vm.heap)) IntlDateTimeFormatPrototype(vm, structure);
+    object->finishCreation(vm, structure);
+    return object;
+}
+
+Structure* IntlDateTimeFormatPrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlDateTimeFormatPrototype::IntlDateTimeFormatPrototype(VM& vm, Structure* structure)
+    : IntlDateTimeFormat(vm, structure)
+{
+}
+
+void IntlDateTimeFormatPrototype::finishCreation(VM& vm, Structure*)
+{
+    Base::finishCreation(vm);
+}
+
+static EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatFuncFormatDateTime(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 12.3.4 DateTime Format Functions (ECMA-402 2.0)
+    // 1. Let dtf be the this value.
+    // 2. Assert: Type(dtf) is Object and dtf has an [[initializedDateTimeFormat]] internal slot whose value is true.
+    IntlDateTimeFormat* format = jsCast<IntlDateTimeFormat*>(state->thisValue());
+
+    JSValue date = state->argument(0);
+    double value;
+
+    // 3. If date is not provided or is undefined, then
+    if (date.isUndefined()) {
+        // a. Let x be %Date_now%().
+        value = JSValue::decode(dateNow(state)).toNumber(state);
+    } else {
+        // 4. Else
+        // a. Let x be ToNumber(date).
+        value = date.toNumber(state);
+        // b. ReturnIfAbrupt(x).
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    // 5. Return FormatDateTime(dtf, x).
+    scope.release();
+    return JSValue::encode(format->format(*state, value));
+}
+
+EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatPrototypeGetterFormat(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 12.3.3 Intl.DateTimeFormat.prototype.format (ECMA-402 2.0)
+    // 1. Let dtf be this DateTimeFormat object.
+    IntlDateTimeFormat* dtf = jsDynamicCast<IntlDateTimeFormat*>(state->thisValue());
+
+    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
+    // https://bugs.webkit.org/show_bug.cgi?id=153679
+    if (!dtf) {
+        JSValue value = state->thisValue().get(state, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName());
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        dtf = jsDynamicCast<IntlDateTimeFormat*>(value);
+    }
+
+    // 2. ReturnIfAbrupt(dtf).
+    if (!dtf)
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.DateTimeFormat.prototype.format called on value that's not an object initialized as a DateTimeFormat")));
+
+    JSBoundFunction* boundFormat = dtf->boundFormat();
+    // 3. If the [[boundFormat]] internal slot of this DateTimeFormat object is undefined,
+    if (!boundFormat) {
+        JSGlobalObject* globalObject = dtf->globalObject();
+        // a. Let F be a new built-in function object as defined in 12.3.4.
+        // b. The value of F’s length property is 1. (Note: F’s length property was 0 in ECMA-402 1.0)
+        JSFunction* targetObject = JSFunction::create(vm, globalObject, 1, ASCIILiteral("format"), IntlDateTimeFormatFuncFormatDateTime, NoIntrinsic);
+        // c. Let bf be BoundFunctionCreate(F, «this value»).
+        boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, dtf, nullptr, 1, ASCIILiteral("format"));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        // d. Set dtf.[[boundFormat]] to bf.
+        dtf->setBoundFormat(vm, boundFormat);
+    }
+    // 4. Return dtf.[[boundFormat]].
+    return JSValue::encode(boundFormat);
+}
+
+EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatPrototypeFuncResolvedOptions(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 12.3.5 Intl.DateTimeFormat.prototype.resolvedOptions() (ECMA-402 2.0)
+    IntlDateTimeFormat* dateTimeFormat = jsDynamicCast<IntlDateTimeFormat*>(state->thisValue());
+
+    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
+    // https://bugs.webkit.org/show_bug.cgi?id=153679
+    if (!dateTimeFormat) {
+        JSValue value = state->thisValue().get(state, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName());
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        dateTimeFormat = jsDynamicCast<IntlDateTimeFormat*>(value);
+    }
+
+    if (!dateTimeFormat)
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.DateTimeFormat.prototype.resolvedOptions called on value that's not an object initialized as a DateTimeFormat")));
+
+    scope.release();
+    return JSValue::encode(dateTimeFormat->resolvedOptions(*state));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlDateTimeFormatPrototype.h b/runtime/IntlDateTimeFormatPrototype.h
new file mode 100644
index 0000000..d05d0f2
--- /dev/null
+++ b/runtime/IntlDateTimeFormatPrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "IntlDateTimeFormat.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class IntlDateTimeFormatPrototype : public IntlDateTimeFormat {
+public:
+    typedef IntlDateTimeFormat Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static IntlDateTimeFormatPrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, Structure*);
+
+private:
+    IntlDateTimeFormatPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlNumberFormat.cpp b/runtime/IntlNumberFormat.cpp
new file mode 100644
index 0000000..acba514
--- /dev/null
+++ b/runtime/IntlNumberFormat.cpp
@@ -0,0 +1,519 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2016 Sukolsak Sakshuwong (sukolsak@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlNumberFormat.h"
+
+#if ENABLE(INTL)
+
+#include "Error.h"
+#include "IntlNumberFormatConstructor.h"
+#include "IntlObject.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "ObjectConstructor.h"
+
+namespace JSC {
+
+const ClassInfo IntlNumberFormat::s_info = { "Object", &Base::s_info, 0, CREATE_METHOD_TABLE(IntlNumberFormat) };
+
+static const char* const relevantExtensionKeys[1] = { "nu" };
+
+void IntlNumberFormat::UNumberFormatDeleter::operator()(UNumberFormat* numberFormat) const
+{
+    if (numberFormat)
+        unum_close(numberFormat);
+}
+
+IntlNumberFormat* IntlNumberFormat::create(VM& vm, Structure* structure)
+{
+    IntlNumberFormat* format = new (NotNull, allocateCell<IntlNumberFormat>(vm.heap)) IntlNumberFormat(vm, structure);
+    format->finishCreation(vm);
+    return format;
+}
+
+Structure* IntlNumberFormat::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlNumberFormat::IntlNumberFormat(VM& vm, Structure* structure)
+    : JSDestructibleObject(vm, structure)
+{
+}
+
+void IntlNumberFormat::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+void IntlNumberFormat::destroy(JSCell* cell)
+{
+    static_cast<IntlNumberFormat*>(cell)->IntlNumberFormat::~IntlNumberFormat();
+}
+
+void IntlNumberFormat::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    IntlNumberFormat* thisObject = jsCast<IntlNumberFormat*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_boundFormat);
+}
+
+static Vector<String> localeData(const String& locale, size_t keyIndex)
+{
+    // 9.1 Internal slots of Service Constructors & 11.2.3 Internal slots (ECMA-402 2.0)
+    ASSERT_UNUSED(keyIndex, !keyIndex); // The index of the extension key "nu" in relevantExtensionKeys is 0.
+    return numberingSystemsForLocale(locale);
+}
+
+static inline unsigned computeCurrencySortKey(const String& currency)
+{
+    ASSERT(currency.length() == 3);
+    ASSERT(currency.isAllSpecialCharacters<isASCIIUpper>());
+    return (currency[0] << 16) + (currency[1] << 8) + currency[2];
+}
+
+static inline unsigned computeCurrencySortKey(const char* currency)
+{
+    ASSERT(strlen(currency) == 3);
+    ASSERT(isAllSpecialCharacters<isASCIIUpper>(currency, 3));
+    return (currency[0] << 16) + (currency[1] << 8) + currency[2];
+}
+
+static unsigned extractCurrencySortKey(std::pair<const char*, unsigned>* currencyMinorUnit)
+{
+    return computeCurrencySortKey(currencyMinorUnit->first);
+}
+
+static unsigned computeCurrencyDigits(const String& currency)
+{
+    // 11.1.1 The abstract operation CurrencyDigits (currency)
+    // "If the ISO 4217 currency and funds code list contains currency as an alphabetic code,
+    // then return the minor unit value corresponding to the currency from the list; else return 2.
+    std::pair<const char*, unsigned> currencyMinorUnits[] = {
+        { "BHD", 3 },
+        { "BIF", 0 },
+        { "BYR", 0 },
+        { "CLF", 4 },
+        { "CLP", 0 },
+        { "DJF", 0 },
+        { "GNF", 0 },
+        { "IQD", 3 },
+        { "ISK", 0 },
+        { "JOD", 3 },
+        { "JPY", 0 },
+        { "KMF", 0 },
+        { "KRW", 0 },
+        { "KWD", 3 },
+        { "LYD", 3 },
+        { "OMR", 3 },
+        { "PYG", 0 },
+        { "RWF", 0 },
+        { "TND", 3 },
+        { "UGX", 0 },
+        { "UYI", 0 },
+        { "VND", 0 },
+        { "VUV", 0 },
+        { "XAF", 0 },
+        { "XOF", 0 },
+        { "XPF", 0 }
+    };
+    auto* currencyMinorUnit = tryBinarySearch<std::pair<const char*, unsigned>>(currencyMinorUnits, WTF_ARRAY_LENGTH(currencyMinorUnits), computeCurrencySortKey(currency), extractCurrencySortKey);
+    if (currencyMinorUnit)
+        return currencyMinorUnit->second;
+    return 2;
+}
+
+void IntlNumberFormat::initializeNumberFormat(ExecState& state, JSValue locales, JSValue optionsValue)
+{
+    // 11.1.1 InitializeNumberFormat (numberFormat, locales, options) (ECMA-402 2.0)
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. If numberFormat has an [[initializedIntlObject]] internal slot with value true, throw a TypeError exception.
+    // 2. Set numberFormat.[[initializedIntlObject]] to true.
+
+    // 3. Let requestedLocales be CanonicalizeLocaleList(locales).
+    auto requestedLocales = canonicalizeLocaleList(state, locales);
+    // 4. ReturnIfAbrupt(requestedLocales).
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // 5. If options is undefined, then
+    JSObject* options;
+    if (optionsValue.isUndefined()) {
+        // a. Let options be ObjectCreate(%ObjectPrototype%).
+        options = constructEmptyObject(&state);
+    } else { // 6. Else
+        // a. Let options be ToObject(options).
+        options = optionsValue.toObject(&state);
+        // b. ReturnIfAbrupt(options).
+        RETURN_IF_EXCEPTION(scope, void());
+    }
+
+    // 7. Let opt be a new Record.
+    HashMap<String, String> opt;
+
+    // 8. Let matcher be GetOption(options, "localeMatcher", "string", «"lookup", "best fit"», "best fit").
+    String matcher = intlStringOption(state, options, vm.propertyNames->localeMatcher, { "lookup", "best fit" }, "localeMatcher must be either \"lookup\" or \"best fit\"", "best fit");
+    // 9. ReturnIfAbrupt(matcher).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 10. Set opt.[[localeMatcher]] to matcher.
+    opt.add(ASCIILiteral("localeMatcher"), matcher);
+
+    // 11. Let localeData be %NumberFormat%.[[localeData]].
+    // 12. Let r be ResolveLocale(%NumberFormat%.[[availableLocales]], requestedLocales, opt, %NumberFormat%.[[relevantExtensionKeys]], localeData).
+    auto& availableLocales = state.jsCallee()->globalObject()->intlNumberFormatAvailableLocales();
+    auto result = resolveLocale(state, availableLocales, requestedLocales, opt, relevantExtensionKeys, WTF_ARRAY_LENGTH(relevantExtensionKeys), localeData);
+
+    // 13. Set numberFormat.[[locale]] to the value of r.[[locale]].
+    m_locale = result.get(ASCIILiteral("locale"));
+    if (m_locale.isEmpty()) {
+        throwTypeError(&state, scope, ASCIILiteral("failed to initialize NumberFormat due to invalid locale"));
+        return;
+    }
+
+    // 14. Set numberFormat.[[numberingSystem]] to the value of r.[[nu]].
+    m_numberingSystem = result.get(ASCIILiteral("nu"));
+
+    // 15. Let dataLocale be r.[[dataLocale]].
+
+    // 16. Let s be GetOption(options, "style", "string", « "decimal", "percent", "currency"», "decimal").
+    String styleString = intlStringOption(state, options, Identifier::fromString(&vm, "style"), { "decimal", "percent", "currency" }, "style must be either \"decimal\", \"percent\", or \"currency\"", "decimal");
+    // 17. ReturnIfAbrupt(s).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 18. Set numberFormat.[[style]] to s.
+    if (styleString == "decimal")
+        m_style = Style::Decimal;
+    else if (styleString == "percent")
+        m_style = Style::Percent;
+    else if (styleString == "currency")
+        m_style = Style::Currency;
+    else
+        ASSERT_NOT_REACHED();
+
+    // 19. Let c be GetOption(options, "currency", "string", undefined, undefined).
+    String currency = intlStringOption(state, options, Identifier::fromString(&vm, "currency"), { }, nullptr, nullptr);
+    // 20. ReturnIfAbrupt(c).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 21. If c is not undefined, then
+    if (!currency.isNull()) {
+        // a. If the result of IsWellFormedCurrencyCode(c), is false, then throw a RangeError exception.
+        if (currency.length() != 3 || !currency.isAllSpecialCharacters<isASCIIAlpha>()) {
+            throwException(&state, scope, createRangeError(&state, ASCIILiteral("currency is not a well-formed currency code")));
+            return;
+        }
+    }
+
+    unsigned currencyDigits = 0;
+    if (m_style == Style::Currency) {
+        // 22. If s is "currency" and c is undefined, throw a TypeError exception.
+        if (currency.isNull()) {
+            throwTypeError(&state, scope, ASCIILiteral("currency must be a string"));
+            return;
+        }
+
+        // 23. If s is "currency", then
+        // a. Let c be converting c to upper case as specified in 6.1.
+        currency = currency.convertToASCIIUppercase();
+        // b. Set numberFormat.[[currency]] to c.
+        m_currency = currency;
+        // c. Let cDigits be CurrencyDigits(c)
+        currencyDigits = computeCurrencyDigits(currency);
+    }
+
+    // 24. Let cd be GetOption(options, "currencyDisplay", "string", «"code", "symbol", "name"», "symbol").
+    String currencyDisplayString = intlStringOption(state, options, Identifier::fromString(&vm, "currencyDisplay"), { "code", "symbol", "name" }, "currencyDisplay must be either \"code\", \"symbol\", or \"name\"", "symbol");
+    // 25. ReturnIfAbrupt(cd).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 26. If s is "currency", set numberFormat.[[currencyDisplay]] to cd.
+    if (m_style == Style::Currency) {
+        if (currencyDisplayString == "code")
+            m_currencyDisplay = CurrencyDisplay::Code;
+        else if (currencyDisplayString == "symbol")
+            m_currencyDisplay = CurrencyDisplay::Symbol;
+        else if (currencyDisplayString == "name")
+            m_currencyDisplay = CurrencyDisplay::Name;
+        else
+            ASSERT_NOT_REACHED();
+    }
+
+    // 27. Let mnid be GetNumberOption(options, "minimumIntegerDigits", 1, 21, 1).
+    // 28. ReturnIfAbrupt(mnid).
+    // 29. Set numberFormat.[[minimumIntegerDigits]] to mnid.
+    unsigned minimumIntegerDigits = intlNumberOption(state, options, Identifier::fromString(&vm, "minimumIntegerDigits"), 1, 21, 1);
+    RETURN_IF_EXCEPTION(scope, void());
+    m_minimumIntegerDigits = minimumIntegerDigits;
+
+    // 30. If s is "currency", let mnfdDefault be cDigits; else let mnfdDefault be 0.
+    unsigned minimumFractionDigitsDefault = (m_style == Style::Currency) ? currencyDigits : 0;
+
+    // 31. Let mnfd be GetNumberOption(options, "minimumFractionDigits", 0, 20, mnfdDefault).
+    // 32. ReturnIfAbrupt(mnfd).
+    // 33. Set numberFormat.[[minimumFractionDigits]] to mnfd.
+    unsigned minimumFractionDigits = intlNumberOption(state, options, Identifier::fromString(&vm, "minimumFractionDigits"), 0, 20, minimumFractionDigitsDefault);
+    RETURN_IF_EXCEPTION(scope, void());
+    m_minimumFractionDigits = minimumFractionDigits;
+
+    // 34. If s is "currency", let mxfdDefault be max(mnfd, cDigits);
+    unsigned maximumFractionDigitsDefault;
+    if (m_style == Style::Currency)
+        maximumFractionDigitsDefault = std::max(minimumFractionDigits, currencyDigits);
+    else if (m_style == Style::Percent) // else if s is "percent", let mxfdDefault be max(mnfd, 0);
+        maximumFractionDigitsDefault = minimumFractionDigits;
+    else // else let mxfdDefault be max(mnfd, 3).
+        maximumFractionDigitsDefault = std::max(minimumFractionDigits, 3u);
+
+    // 35. Let mxfd be GetNumberOption(options, "maximumFractionDigits", mnfd, 20, mxfdDefault).
+    // 36. ReturnIfAbrupt(mxfd).
+    // 37. Set numberFormat.[[maximumFractionDigits]] to mxfd.
+    unsigned maximumFractionDigits = intlNumberOption(state, options, Identifier::fromString(&vm, "maximumFractionDigits"), minimumFractionDigits, 20, maximumFractionDigitsDefault);
+    RETURN_IF_EXCEPTION(scope, void());
+    m_maximumFractionDigits = maximumFractionDigits;
+
+    // 38. Let mnsd be Get(options, "minimumSignificantDigits").
+    JSValue minimumSignificantDigitsValue = options->get(&state, Identifier::fromString(&vm, "minimumSignificantDigits"));
+    // 39. ReturnIfAbrupt(mnsd).
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // 40. Let mxsd be Get(options, "maximumSignificantDigits").
+    JSValue maximumSignificantDigitsValue = options->get(&state, Identifier::fromString(&vm, "maximumSignificantDigits"));
+    // 41. ReturnIfAbrupt(mxsd).
+    RETURN_IF_EXCEPTION(scope, void());
+
+    // 42. If mnsd is not undefined or mxsd is not undefined, then
+    if (!minimumSignificantDigitsValue.isUndefined() || !maximumSignificantDigitsValue.isUndefined()) {
+        // a. Let mnsd be GetNumberOption(options, "minimumSignificantDigits", 1, 21, 1).
+        unsigned minimumSignificantDigits = intlNumberOption(state, options, Identifier::fromString(&vm, "minimumSignificantDigits"), 1, 21, 1);
+        // b. ReturnIfAbrupt(mnsd).
+        RETURN_IF_EXCEPTION(scope, void());
+        // c. Let mxsd be GetNumberOption(options, "maximumSignificantDigits", mnsd, 21, 21).
+        unsigned maximumSignificantDigits = intlNumberOption(state, options, Identifier::fromString(&vm, "maximumSignificantDigits"), minimumSignificantDigits, 21, 21);
+        // d. ReturnIfAbrupt(mxsd).
+        RETURN_IF_EXCEPTION(scope, void());
+        // e. Set numberFormat.[[minimumSignificantDigits]] to mnsd.
+        m_minimumSignificantDigits = minimumSignificantDigits;
+        // f. Set numberFormat.[[maximumSignificantDigits]] to mxsd.
+        m_maximumSignificantDigits = maximumSignificantDigits;
+    }
+
+    // 43. Let g be GetOption(options, "useGrouping", "boolean", undefined, true).
+    bool usesFallback;
+    bool useGrouping = intlBooleanOption(state, options, Identifier::fromString(&vm, "useGrouping"), usesFallback);
+    if (usesFallback)
+        useGrouping = true;
+    // 44. ReturnIfAbrupt(g).
+    RETURN_IF_EXCEPTION(scope, void());
+    // 45. Set numberFormat.[[useGrouping]] to g.
+    m_useGrouping = useGrouping;
+
+    // Steps 46 - 51 are not necessary to our implementation.
+    // 46. Let dataLocaleData be Get(localeData, dataLocale).
+    // 47. Let patterns be Get(dataLocaleData, "patterns").
+    // 48. Assert: patterns is an object (see 11.2.3).
+    // 49. Let stylePatterns be Get(patterns, s).
+    // 50. Set numberFormat.[[positivePattern]] to Get(stylePatterns, "positivePattern").
+    // 51. Set numberFormat.[[negativePattern]] to Get(stylePatterns, "negativePattern").
+
+    // 52. Set numberFormat.[[boundFormat]] to undefined.
+    // 53. Set numberFormat.[[initializedNumberFormat]] to true.
+    m_initializedNumberFormat = true;
+
+    // 54. Return numberFormat.
+}
+
+void IntlNumberFormat::createNumberFormat(ExecState& state)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    ASSERT(!m_numberFormat);
+
+    if (!m_initializedNumberFormat) {
+        initializeNumberFormat(state, jsUndefined(), jsUndefined());
+        ASSERT_UNUSED(scope, !scope.exception());
+    }
+
+    UNumberFormatStyle style;
+    switch (m_style) {
+    case Style::Decimal:
+        style = UNUM_DECIMAL;
+        break;
+    case Style::Percent:
+        style = UNUM_PERCENT;
+        break;
+    case Style::Currency:
+        switch (m_currencyDisplay) {
+        case CurrencyDisplay::Code:
+            style = UNUM_CURRENCY_ISO;
+            break;
+        case CurrencyDisplay::Symbol:
+            style = UNUM_CURRENCY;
+            break;
+        case CurrencyDisplay::Name:
+            style = UNUM_CURRENCY_PLURAL;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    UErrorCode status = U_ZERO_ERROR;
+    auto numberFormat = std::unique_ptr<UNumberFormat, UNumberFormatDeleter>(unum_open(style, nullptr, 0, m_locale.utf8().data(), nullptr, &status));
+    if (U_FAILURE(status))
+        return;
+
+    if (m_style == Style::Currency)
+        unum_setTextAttribute(numberFormat.get(), UNUM_CURRENCY_CODE, StringView(m_currency).upconvertedCharacters(), 3, &status);
+    if (!m_minimumSignificantDigits) {
+        unum_setAttribute(numberFormat.get(), UNUM_MIN_INTEGER_DIGITS, m_minimumIntegerDigits);
+        unum_setAttribute(numberFormat.get(), UNUM_MIN_FRACTION_DIGITS, m_minimumFractionDigits);
+        unum_setAttribute(numberFormat.get(), UNUM_MAX_FRACTION_DIGITS, m_maximumFractionDigits);
+    } else {
+        unum_setAttribute(numberFormat.get(), UNUM_SIGNIFICANT_DIGITS_USED, true);
+        unum_setAttribute(numberFormat.get(), UNUM_MIN_SIGNIFICANT_DIGITS, m_minimumSignificantDigits);
+        unum_setAttribute(numberFormat.get(), UNUM_MAX_SIGNIFICANT_DIGITS, m_maximumSignificantDigits);
+    }
+    unum_setAttribute(numberFormat.get(), UNUM_GROUPING_USED, m_useGrouping);
+    unum_setAttribute(numberFormat.get(), UNUM_ROUNDING_MODE, UNUM_ROUND_HALFUP);
+    if (U_FAILURE(status))
+        return;
+
+    m_numberFormat = WTFMove(numberFormat);
+}
+
+JSValue IntlNumberFormat::formatNumber(ExecState& state, double number)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 11.3.4 FormatNumber abstract operation (ECMA-402 2.0)
+    if (!m_numberFormat) {
+        createNumberFormat(state);
+        if (!m_numberFormat)
+            return throwException(&state, scope, createError(&state, ASCIILiteral("Failed to format a number.")));
+    }
+
+    // Map negative zero to positive zero.
+    if (!number)
+        number = 0.0;
+
+    UErrorCode status = U_ZERO_ERROR;
+    Vector<UChar, 32> buffer(32);
+    auto length = unum_formatDouble(m_numberFormat.get(), number, buffer.data(), buffer.size(), nullptr, &status);
+    if (status == U_BUFFER_OVERFLOW_ERROR) {
+        buffer.grow(length);
+        status = U_ZERO_ERROR;
+        unum_formatDouble(m_numberFormat.get(), number, buffer.data(), length, nullptr, &status);
+    }
+    if (U_FAILURE(status))
+        return throwException(&state, scope, createError(&state, ASCIILiteral("Failed to format a number.")));
+
+    return jsString(&state, String(buffer.data(), length));
+}
+
+const char* IntlNumberFormat::styleString(Style style)
+{
+    switch (style) {
+    case Style::Decimal:
+        return "decimal";
+    case Style::Percent:
+        return "percent";
+    case Style::Currency:
+        return "currency";
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+const char* IntlNumberFormat::currencyDisplayString(CurrencyDisplay currencyDisplay)
+{
+    switch (currencyDisplay) {
+    case CurrencyDisplay::Code:
+        return "code";
+    case CurrencyDisplay::Symbol:
+        return "symbol";
+    case CurrencyDisplay::Name:
+        return "name";
+    }
+    ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+JSObject* IntlNumberFormat::resolvedOptions(ExecState& state)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 11.3.5 Intl.NumberFormat.prototype.resolvedOptions() (ECMA-402 2.0)
+    // The function returns a new object whose properties and attributes are set as if
+    // constructed by an object literal assigning to each of the following properties the
+    // value of the corresponding internal slot of this NumberFormat object (see 11.4):
+    // locale, numberingSystem, style, currency, currencyDisplay, minimumIntegerDigits,
+    // minimumFractionDigits, maximumFractionDigits, minimumSignificantDigits,
+    // maximumSignificantDigits, and useGrouping. Properties whose corresponding internal
+    // slots are not present are not assigned.
+
+    if (!m_initializedNumberFormat) {
+        initializeNumberFormat(state, jsUndefined(), jsUndefined());
+        ASSERT_UNUSED(scope, !scope.exception());
+    }
+
+    JSObject* options = constructEmptyObject(&state);
+    options->putDirect(vm, vm.propertyNames->locale, jsString(&state, m_locale));
+    options->putDirect(vm, Identifier::fromString(&vm, "numberingSystem"), jsString(&state, m_numberingSystem));
+    options->putDirect(vm, Identifier::fromString(&vm, "style"), jsNontrivialString(&state, ASCIILiteral(styleString(m_style))));
+    if (m_style == Style::Currency) {
+        options->putDirect(vm, Identifier::fromString(&vm, "currency"), jsNontrivialString(&state, m_currency));
+        options->putDirect(vm, Identifier::fromString(&vm, "currencyDisplay"), jsNontrivialString(&state, ASCIILiteral(currencyDisplayString(m_currencyDisplay))));
+    }
+    options->putDirect(vm, Identifier::fromString(&vm, "minimumIntegerDigits"), jsNumber(m_minimumIntegerDigits));
+    options->putDirect(vm, Identifier::fromString(&vm, "minimumFractionDigits"), jsNumber(m_minimumFractionDigits));
+    options->putDirect(vm, Identifier::fromString(&vm, "maximumFractionDigits"), jsNumber(m_maximumFractionDigits));
+    if (m_minimumSignificantDigits) {
+        ASSERT(m_maximumSignificantDigits);
+        options->putDirect(vm, Identifier::fromString(&vm, "minimumSignificantDigits"), jsNumber(m_minimumSignificantDigits));
+        options->putDirect(vm, Identifier::fromString(&vm, "maximumSignificantDigits"), jsNumber(m_maximumSignificantDigits));
+    }
+    options->putDirect(vm, Identifier::fromString(&vm, "useGrouping"), jsBoolean(m_useGrouping));
+    return options;
+}
+
+void IntlNumberFormat::setBoundFormat(VM& vm, JSBoundFunction* format)
+{
+    m_boundFormat.set(vm, this, format);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlNumberFormat.h b/runtime/IntlNumberFormat.h
new file mode 100644
index 0000000..94cd5a2
--- /dev/null
+++ b/runtime/IntlNumberFormat.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "JSDestructibleObject.h"
+#include <unicode/unum.h>
+
+namespace JSC {
+
+class IntlNumberFormatConstructor;
+class JSBoundFunction;
+
+class IntlNumberFormat : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static IntlNumberFormat* create(VM&, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    void initializeNumberFormat(ExecState&, JSValue locales, JSValue optionsValue);
+    JSValue formatNumber(ExecState&, double number);
+    JSObject* resolvedOptions(ExecState&);
+
+    JSBoundFunction* boundFormat() const { return m_boundFormat.get(); }
+    void setBoundFormat(VM&, JSBoundFunction*);
+
+protected:
+    IntlNumberFormat(VM&, Structure*);
+    void finishCreation(VM&);
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    enum class Style { Decimal, Percent, Currency };
+    enum class CurrencyDisplay { Code, Symbol, Name };
+
+    struct UNumberFormatDeleter {
+        void operator()(UNumberFormat*) const;
+    };
+
+    void createNumberFormat(ExecState&);
+    static const char* styleString(Style);
+    static const char* currencyDisplayString(CurrencyDisplay);
+
+    String m_locale;
+    String m_numberingSystem;
+    Style m_style { Style::Decimal };
+    String m_currency;
+    CurrencyDisplay m_currencyDisplay;
+    unsigned m_minimumIntegerDigits { 1 };
+    unsigned m_minimumFractionDigits { 0 };
+    unsigned m_maximumFractionDigits { 3 };
+    unsigned m_minimumSignificantDigits { 0 };
+    unsigned m_maximumSignificantDigits { 0 };
+    std::unique_ptr<UNumberFormat, UNumberFormatDeleter> m_numberFormat;
+    WriteBarrier<JSBoundFunction> m_boundFormat;
+    bool m_useGrouping { true };
+    bool m_initializedNumberFormat { false };
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlNumberFormatConstructor.cpp b/runtime/IntlNumberFormatConstructor.cpp
new file mode 100644
index 0000000..db25c7f
--- /dev/null
+++ b/runtime/IntlNumberFormatConstructor.cpp
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlNumberFormatConstructor.h"
+
+#if ENABLE(INTL)
+
+#include "Error.h"
+#include "IntlNumberFormat.h"
+#include "IntlNumberFormatPrototype.h"
+#include "IntlObject.h"
+#include "IntlObjectInlines.h"
+#include "JSCInlines.h"
+#include "Lookup.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(IntlNumberFormatConstructor);
+
+static EncodedJSValue JSC_HOST_CALL IntlNumberFormatConstructorFuncSupportedLocalesOf(ExecState*);
+
+}
+
+#include "IntlNumberFormatConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo IntlNumberFormatConstructor::s_info = { "Function", &Base::s_info, &numberFormatConstructorTable, CREATE_METHOD_TABLE(IntlNumberFormatConstructor) };
+
+/* Source for IntlNumberFormatConstructor.lut.h
+@begin numberFormatConstructorTable
+  supportedLocalesOf             IntlNumberFormatConstructorFuncSupportedLocalesOf             DontEnum|Function 1
+@end
+*/
+
+IntlNumberFormatConstructor* IntlNumberFormatConstructor::create(VM& vm, Structure* structure, IntlNumberFormatPrototype* numberFormatPrototype, Structure* numberFormatStructure)
+{
+    IntlNumberFormatConstructor* constructor = new (NotNull, allocateCell<IntlNumberFormatConstructor>(vm.heap)) IntlNumberFormatConstructor(vm, structure);
+    constructor->finishCreation(vm, numberFormatPrototype, numberFormatStructure);
+    return constructor;
+}
+
+Structure* IntlNumberFormatConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlNumberFormatConstructor::IntlNumberFormatConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void IntlNumberFormatConstructor::finishCreation(VM& vm, IntlNumberFormatPrototype* numberFormatPrototype, Structure* numberFormatStructure)
+{
+    Base::finishCreation(vm, ASCIILiteral("NumberFormat"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, numberFormatPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), ReadOnly | DontEnum | DontDelete);
+    m_numberFormatStructure.set(vm, this, numberFormatStructure);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructIntlNumberFormat(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 11.1.2 Intl.NumberFormat ([locales [, options]]) (ECMA-402 2.0)
+    // 1. If NewTarget is undefined, let newTarget be the active function object, else let newTarget be NewTarget.
+    // 2. Let numberFormat be OrdinaryCreateFromConstructor(newTarget, %NumberFormatPrototype%).
+    // 3. ReturnIfAbrupt(numberFormat).
+    Structure* structure = InternalFunction::createSubclassStructure(state, state->newTarget(), jsCast<IntlNumberFormatConstructor*>(state->jsCallee())->numberFormatStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    IntlNumberFormat* numberFormat = IntlNumberFormat::create(vm, structure);
+    ASSERT(numberFormat);
+
+    // 4. Return InitializeNumberFormat(numberFormat, locales, options).
+    scope.release();
+    numberFormat->initializeNumberFormat(*state, state->argument(0), state->argument(1));
+    return JSValue::encode(numberFormat);
+}
+
+static EncodedJSValue JSC_HOST_CALL callIntlNumberFormat(ExecState* state)
+{
+    // 11.1.2 Intl.NumberFormat ([locales [, options]]) (ECMA-402 2.0)
+    // 1. If NewTarget is undefined, let newTarget be the active function object, else let newTarget be NewTarget.
+    // NewTarget is always undefined when called as a function.
+
+    IntlNumberFormatConstructor* callee = jsCast<IntlNumberFormatConstructor*>(state->jsCallee());
+
+    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
+    // https://bugs.webkit.org/show_bug.cgi?id=153679
+    return JSValue::encode(constructIntlInstanceWithWorkaroundForLegacyIntlConstructor<IntlNumberFormat>(*state, state->thisValue(), callee, [&] (VM& vm) {
+        // 2. Let numberFormat be OrdinaryCreateFromConstructor(newTarget, %NumberFormatPrototype%).
+        // 3. ReturnIfAbrupt(numberFormat).
+        IntlNumberFormat* numberFormat = IntlNumberFormat::create(vm, callee->numberFormatStructure());
+        ASSERT(numberFormat);
+
+        // 4. Return InitializeNumberFormat(numberFormat, locales, options).
+        numberFormat->initializeNumberFormat(*state, state->argument(0), state->argument(1));
+        return numberFormat;
+    }));
+}
+
+ConstructType IntlNumberFormatConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructIntlNumberFormat;
+    return ConstructType::Host;
+}
+
+CallType IntlNumberFormatConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callIntlNumberFormat;
+    return CallType::Host;
+}
+
+EncodedJSValue JSC_HOST_CALL IntlNumberFormatConstructorFuncSupportedLocalesOf(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 11.2.2 Intl.NumberFormat.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)
+
+    // 1. Let availableLocales be %NumberFormat%.[[availableLocales]].
+    JSGlobalObject* globalObject = state->jsCallee()->globalObject();
+    const HashSet<String> availableLocales = globalObject->intlNumberFormatAvailableLocales();
+
+    // 2. Let requestedLocales be CanonicalizeLocaleList(locales).
+    Vector<String> requestedLocales = canonicalizeLocaleList(*state, state->argument(0));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 3. Return SupportedLocales(availableLocales, requestedLocales, options).
+    scope.release();
+    return JSValue::encode(supportedLocales(*state, availableLocales, requestedLocales, state->argument(1)));
+}
+
+void IntlNumberFormatConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    IntlNumberFormatConstructor* thisObject = jsCast<IntlNumberFormatConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_numberFormatStructure);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlNumberFormatConstructor.h b/runtime/IntlNumberFormatConstructor.h
new file mode 100644
index 0000000..d762161
--- /dev/null
+++ b/runtime/IntlNumberFormatConstructor.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class IntlNumberFormat;
+class IntlNumberFormatPrototype;
+
+class IntlNumberFormatConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static IntlNumberFormatConstructor* create(VM&, Structure*, IntlNumberFormatPrototype*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    Structure* numberFormatStructure() const { return m_numberFormatStructure.get(); }
+
+protected:
+    void finishCreation(VM&, IntlNumberFormatPrototype*, Structure*);
+
+private:
+    IntlNumberFormatConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+    WriteBarrier<Structure> m_numberFormatStructure;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlNumberFormatPrototype.cpp b/runtime/IntlNumberFormatPrototype.cpp
new file mode 100644
index 0000000..9ea7878
--- /dev/null
+++ b/runtime/IntlNumberFormatPrototype.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlNumberFormatPrototype.h"
+
+#if ENABLE(INTL)
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "IntlNumberFormat.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "JSObjectInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL IntlNumberFormatPrototypeGetterFormat(ExecState*);
+static EncodedJSValue JSC_HOST_CALL IntlNumberFormatPrototypeFuncResolvedOptions(ExecState*);
+
+}
+
+#include "IntlNumberFormatPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo IntlNumberFormatPrototype::s_info = { "Object", &IntlNumberFormat::s_info, &numberFormatPrototypeTable, CREATE_METHOD_TABLE(IntlNumberFormatPrototype) };
+
+/* Source for IntlNumberFormatPrototype.lut.h
+@begin numberFormatPrototypeTable
+  format           IntlNumberFormatPrototypeGetterFormat         DontEnum|Accessor
+  resolvedOptions  IntlNumberFormatPrototypeFuncResolvedOptions  DontEnum|Function 0
+@end
+*/
+
+IntlNumberFormatPrototype* IntlNumberFormatPrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    IntlNumberFormatPrototype* object = new (NotNull, allocateCell<IntlNumberFormatPrototype>(vm.heap)) IntlNumberFormatPrototype(vm, structure);
+    object->finishCreation(vm, structure);
+    return object;
+}
+
+Structure* IntlNumberFormatPrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+IntlNumberFormatPrototype::IntlNumberFormatPrototype(VM& vm, Structure* structure)
+    : IntlNumberFormat(vm, structure)
+{
+}
+
+void IntlNumberFormatPrototype::finishCreation(VM& vm, Structure*)
+{
+    Base::finishCreation(vm);
+}
+
+static EncodedJSValue JSC_HOST_CALL IntlNumberFormatFuncFormatNumber(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 11.3.4 Format Number Functions (ECMA-402 2.0)
+    // 1. Let nf be the this value.
+    // 2. Assert: Type(nf) is Object and nf has an [[initializedNumberFormat]] internal slot whose value  true.
+    IntlNumberFormat* numberFormat = jsCast<IntlNumberFormat*>(state->thisValue());
+
+    // 3. If value is not provided, let value be undefined.
+    // 4. Let x be ToNumber(value).
+    double number = state->argument(0).toNumber(state);
+    // 5. ReturnIfAbrupt(x).
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 6. Return FormatNumber(nf, x).
+    scope.release();
+    return JSValue::encode(numberFormat->formatNumber(*state, number));
+}
+
+EncodedJSValue JSC_HOST_CALL IntlNumberFormatPrototypeGetterFormat(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 11.3.3 Intl.NumberFormat.prototype.format (ECMA-402 2.0)
+    // 1. Let nf be this NumberFormat object.
+    IntlNumberFormat* nf = jsDynamicCast<IntlNumberFormat*>(state->thisValue());
+
+    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
+    // https://bugs.webkit.org/show_bug.cgi?id=153679
+    if (!nf) {
+        JSValue value = state->thisValue().get(state, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName());
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        nf = jsDynamicCast<IntlNumberFormat*>(value);
+    }
+
+    if (!nf)
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.NumberFormat.prototype.format called on value that's not an object initialized as a NumberFormat")));
+    
+    JSBoundFunction* boundFormat = nf->boundFormat();
+    // 2. If nf.[[boundFormat]] is undefined,
+    if (!boundFormat) {
+        JSGlobalObject* globalObject = nf->globalObject();
+        // a. Let F be a new built-in function object as defined in 11.3.4.
+        // b. The value of F’s length property is 1.
+        JSFunction* targetObject = JSFunction::create(vm, globalObject, 1, ASCIILiteral("format"), IntlNumberFormatFuncFormatNumber, NoIntrinsic);
+        // c. Let bf be BoundFunctionCreate(F, «this value»).
+        boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, nf, nullptr, 1, ASCIILiteral("format"));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        // d. Set nf.[[boundFormat]] to bf.
+        nf->setBoundFormat(vm, boundFormat);
+    }
+    // 3. Return nf.[[boundFormat]].
+    return JSValue::encode(boundFormat);
+}
+
+EncodedJSValue JSC_HOST_CALL IntlNumberFormatPrototypeFuncResolvedOptions(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 11.3.5 Intl.NumberFormat.prototype.resolvedOptions() (ECMA-402 2.0)
+    IntlNumberFormat* numberFormat = jsDynamicCast<IntlNumberFormat*>(state->thisValue());
+
+    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
+    // https://bugs.webkit.org/show_bug.cgi?id=153679
+    if (!numberFormat) {
+        JSValue value = state->thisValue().get(state, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName());
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        numberFormat = jsDynamicCast<IntlNumberFormat*>(value);
+    }
+
+    if (!numberFormat)
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.NumberFormat.prototype.resolvedOptions called on value that's not an object initialized as a NumberFormat")));
+
+    scope.release();
+    return JSValue::encode(numberFormat->resolvedOptions(*state));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlNumberFormatPrototype.h b/runtime/IntlNumberFormatPrototype.h
new file mode 100644
index 0000000..3a61825
--- /dev/null
+++ b/runtime/IntlNumberFormatPrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "IntlNumberFormat.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class IntlNumberFormatPrototype : public IntlNumberFormat {
+public:
+    typedef IntlNumberFormat Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static IntlNumberFormatPrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, Structure*);
+
+private:
+    IntlNumberFormatPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlObject.cpp b/runtime/IntlObject.cpp
new file mode 100644
index 0000000..efd07dd
--- /dev/null
+++ b/runtime/IntlObject.cpp
@@ -0,0 +1,1055 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2015 Sukolsak Sakshuwong (sukolsak@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntlObject.h"
+
+#if ENABLE(INTL)
+
+#include "Error.h"
+#include "FunctionPrototype.h"
+#include "IntlCollator.h"
+#include "IntlCollatorConstructor.h"
+#include "IntlCollatorPrototype.h"
+#include "IntlDateTimeFormat.h"
+#include "IntlDateTimeFormatConstructor.h"
+#include "IntlDateTimeFormatPrototype.h"
+#include "IntlNumberFormat.h"
+#include "IntlNumberFormatConstructor.h"
+#include "IntlNumberFormatPrototype.h"
+#include "JSCInlines.h"
+#include "JSCJSValueInlines.h"
+#include "Lookup.h"
+#include "ObjectPrototype.h"
+#include <unicode/uloc.h>
+#include <unicode/unumsys.h>
+#include <wtf/Assertions.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/PlatformUserPreferredLanguages.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(IntlObject);
+
+static EncodedJSValue JSC_HOST_CALL intlObjectFuncGetCanonicalLocales(ExecState*);
+
+}
+
+namespace JSC {
+
+struct MatcherResult {
+    String locale;
+    String extension;
+    size_t extensionIndex;
+};
+
+const ClassInfo IntlObject::s_info = { "Object", &Base::s_info, 0, CREATE_METHOD_TABLE(IntlObject) };
+
+IntlObject::IntlObject(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+IntlObject* IntlObject::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    IntlObject* object = new (NotNull, allocateCell<IntlObject>(vm.heap)) IntlObject(vm, structure);
+    object->finishCreation(vm, globalObject);
+    return object;
+}
+
+void IntlObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    // Set up Collator.
+    IntlCollatorPrototype* collatorPrototype = IntlCollatorPrototype::create(vm, globalObject, IntlCollatorPrototype::createStructure(vm, globalObject, globalObject->objectPrototype()));
+    Structure* collatorStructure = IntlCollator::createStructure(vm, globalObject, collatorPrototype);
+    IntlCollatorConstructor* collatorConstructor = IntlCollatorConstructor::create(vm, IntlCollatorConstructor::createStructure(vm, globalObject, globalObject->functionPrototype()), collatorPrototype, collatorStructure);
+
+    collatorPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, collatorConstructor, DontEnum);
+
+    // Set up NumberFormat.
+    IntlNumberFormatPrototype* numberFormatPrototype = IntlNumberFormatPrototype::create(vm, globalObject, IntlNumberFormatPrototype::createStructure(vm, globalObject, globalObject->objectPrototype()));
+    Structure* numberFormatStructure = IntlNumberFormat::createStructure(vm, globalObject, numberFormatPrototype);
+    IntlNumberFormatConstructor* numberFormatConstructor = IntlNumberFormatConstructor::create(vm, IntlNumberFormatConstructor::createStructure(vm, globalObject, globalObject->functionPrototype()), numberFormatPrototype, numberFormatStructure);
+
+    numberFormatPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, numberFormatConstructor, DontEnum);
+
+    // Set up DateTimeFormat.
+    IntlDateTimeFormatPrototype* dateTimeFormatPrototype = IntlDateTimeFormatPrototype::create(vm, globalObject, IntlDateTimeFormatPrototype::createStructure(vm, globalObject, globalObject->objectPrototype()));
+    Structure* dateTimeFormatStructure = IntlDateTimeFormat::createStructure(vm, globalObject, dateTimeFormatPrototype);
+    IntlDateTimeFormatConstructor* dateTimeFormatConstructor = IntlDateTimeFormatConstructor::create(vm, IntlDateTimeFormatConstructor::createStructure(vm, globalObject, globalObject->functionPrototype()), dateTimeFormatPrototype, dateTimeFormatStructure);
+
+    dateTimeFormatPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, dateTimeFormatConstructor, DontEnum);
+
+    // 8.1 Properties of the Intl Object (ECMA-402 2.0)
+    putDirectWithoutTransition(vm, vm.propertyNames->Collator, collatorConstructor, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->NumberFormat, numberFormatConstructor, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->DateTimeFormat, dateTimeFormatConstructor, DontEnum);
+
+    // 8.2 Function Properties of the Intl Object
+    // https://tc39.github.io/ecma402/#sec-function-properties-of-the-intl-object
+    putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "getCanonicalLocales"), 1, intlObjectFuncGetCanonicalLocales, NoIntrinsic, DontEnum);
+}
+
+Structure* IntlObject::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void convertICULocaleToBCP47LanguageTag(String& locale)
+{
+    locale.replace('_', '-');
+}
+
+bool intlBooleanOption(ExecState& state, JSValue options, PropertyName property, bool& usesFallback)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 9.2.9 GetOption (options, property, type, values, fallback)
+    // For type="boolean". values is always undefined.
+
+    // 1. Let opts be ToObject(options).
+    JSObject* opts = options.toObject(&state);
+
+    // 2. ReturnIfAbrupt(opts).
+    RETURN_IF_EXCEPTION(scope, false);
+
+    // 3. Let value be Get(opts, property).
+    JSValue value = opts->get(&state, property);
+
+    // 4. ReturnIfAbrupt(value).
+    RETURN_IF_EXCEPTION(scope, false);
+
+    // 5. If value is not undefined, then
+    if (!value.isUndefined()) {
+        // a. Assert: type is "boolean" or "string".
+        // Function dedicated to "boolean".
+
+        // b. If type is "boolean", then
+        // i. Let value be ToBoolean(value).
+        bool booleanValue = value.toBoolean(&state);
+
+        // e. Return value.
+        usesFallback = false;
+        return booleanValue;
+    }
+
+    // 6. Else return fallback.
+    // Because fallback can be undefined, we let the caller handle it instead.
+    usesFallback = true;
+    return false;
+}
+
+String intlStringOption(ExecState& state, JSValue options, PropertyName property, std::initializer_list<const char*> values, const char* notFound, const char* fallback)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 9.2.9 GetOption (options, property, type, values, fallback)
+    // For type="string".
+
+    // 1. Let opts be ToObject(options).
+    JSObject* opts = options.toObject(&state);
+
+    // 2. ReturnIfAbrupt(opts).
+    RETURN_IF_EXCEPTION(scope, String());
+
+    // 3. Let value be Get(opts, property).
+    JSValue value = opts->get(&state, property);
+
+    // 4. ReturnIfAbrupt(value).
+    RETURN_IF_EXCEPTION(scope, String());
+
+    // 5. If value is not undefined, then
+    if (!value.isUndefined()) {
+        // a. Assert: type is "boolean" or "string".
+        // Function dedicated to "string".
+
+        // c. If type is "string", then
+        // i. Let value be ToString(value).
+        String stringValue = value.toWTFString(&state);
+
+        // ii. ReturnIfAbrupt(value).
+        RETURN_IF_EXCEPTION(scope, String());
+
+        // d. If values is not undefined, then
+        // i. If values does not contain an element equal to value, throw a RangeError exception.
+        if (values.size() && std::find(values.begin(), values.end(), stringValue) == values.end()) {
+            throwException(&state, scope, createRangeError(&state, notFound));
+            return { };
+        }
+
+        // e. Return value.
+        return stringValue;
+    }
+
+    // 6. Else return fallback.
+    return fallback;
+}
+
+unsigned intlNumberOption(ExecState& state, JSValue options, PropertyName property, unsigned minimum, unsigned maximum, unsigned fallback)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 9.2.9 GetNumberOption (options, property, minimum, maximum, fallback) (ECMA-402 2.0)
+    // 1. Let opts be ToObject(options).
+    JSObject* opts = options.toObject(&state);
+
+    // 2. ReturnIfAbrupt(opts).
+    RETURN_IF_EXCEPTION(scope, 0);
+
+    // 3. Let value be Get(opts, property).
+    JSValue value = opts->get(&state, property);
+
+    // 4. ReturnIfAbrupt(value).
+    RETURN_IF_EXCEPTION(scope, 0);
+
+    // 5. If value is not undefined, then
+    if (!value.isUndefined()) {
+        // a. Let value be ToNumber(value).
+        double doubleValue = value.toNumber(&state);
+        // b. ReturnIfAbrupt(value).
+        RETURN_IF_EXCEPTION(scope, 0);
+        // 1. If value is NaN or less than minimum or greater than maximum, throw a RangeError exception.
+        if (!(doubleValue >= minimum && doubleValue <= maximum)) {
+            throwException(&state, scope, createRangeError(&state, *property.publicName() + " is out of range"));
+            return 0;
+        }
+
+        // c. Return floor(value).
+        return static_cast<unsigned>(doubleValue);
+    }
+
+    // 6. Else return fallback.
+    return fallback;
+}
+
+static String privateUseLangTag(const Vector<String>& parts, size_t startIndex)
+{
+    size_t numParts = parts.size();
+    size_t currentIndex = startIndex;
+
+    // Check for privateuse.
+    // privateuse = "x" 1*("-" (1*8alphanum))
+    StringBuilder privateuse;
+    while (currentIndex < numParts) {
+        const String& singleton = parts[currentIndex];
+        unsigned singletonLength = singleton.length();
+        bool isValid = (singletonLength == 1 && (singleton == "x" || singleton == "X"));
+        if (!isValid)
+            break;
+
+        if (currentIndex != startIndex)
+            privateuse.append('-');
+
+        ++currentIndex;
+        unsigned numExtParts = 0;
+        privateuse.append('x');
+        while (currentIndex < numParts) {
+            const String& extPart = parts[currentIndex];
+            unsigned extPartLength = extPart.length();
+
+            bool isValid = (extPartLength >= 1 && extPartLength <= 8 && extPart.isAllSpecialCharacters<isASCIIAlphanumeric>());
+            if (!isValid)
+                break;
+
+            ++currentIndex;
+            ++numExtParts;
+            privateuse.append('-');
+            privateuse.append(extPart.convertToASCIILowercase());
+        }
+
+        // Requires at least one production.
+        if (!numExtParts)
+            return String();
+    }
+
+    // Leftovers makes it invalid.
+    if (currentIndex < numParts)
+        return String();
+
+    return privateuse.toString();
+}
+
+static String canonicalLangTag(const Vector<String>& parts)
+{
+    ASSERT(!parts.isEmpty());
+
+    // Follows the grammar at https://www.rfc-editor.org/rfc/bcp/bcp47.txt
+    // langtag = language ["-" script] ["-" region] *("-" variant) *("-" extension) ["-" privateuse]
+
+    size_t numParts = parts.size();
+    // Check for language.
+    // language = 2*3ALPHA ["-" extlang] / 4ALPHA / 5*8ALPHA
+    size_t currentIndex = 0;
+    const String& language = parts[currentIndex];
+    unsigned languageLength = language.length();
+    bool canHaveExtlang = languageLength >= 2 && languageLength <= 3;
+    bool isValidLanguage = languageLength >= 2 && languageLength <= 8 && language.isAllSpecialCharacters<isASCIIAlpha>();
+    if (!isValidLanguage)
+        return String();
+
+    ++currentIndex;
+    StringBuilder canonical;
+    canonical.append(language.convertToASCIILowercase());
+
+    // Check for extlang.
+    // extlang = 3ALPHA *2("-" 3ALPHA)
+    if (canHaveExtlang) {
+        for (unsigned times = 0; times < 3 && currentIndex < numParts; ++times) {
+            const String& extlang = parts[currentIndex];
+            unsigned extlangLength = extlang.length();
+            if (extlangLength == 3 && extlang.isAllSpecialCharacters<isASCIIAlpha>()) {
+                ++currentIndex;
+                canonical.append('-');
+                canonical.append(extlang.convertToASCIILowercase());
+            } else
+                break;
+        }
+    }
+
+    // Check for script.
+    // script = 4ALPHA
+    if (currentIndex < numParts) {
+        const String& script = parts[currentIndex];
+        unsigned scriptLength = script.length();
+        if (scriptLength == 4 && script.isAllSpecialCharacters<isASCIIAlpha>()) {
+            ++currentIndex;
+            canonical.append('-');
+            canonical.append(toASCIIUpper(script[0]));
+            canonical.append(script.substring(1, 3).convertToASCIILowercase());
+        }
+    }
+
+    // Check for region.
+    // region = 2ALPHA / 3DIGIT
+    if (currentIndex < numParts) {
+        const String& region = parts[currentIndex];
+        unsigned regionLength = region.length();
+        bool isValidRegion = (
+            (regionLength == 2 && region.isAllSpecialCharacters<isASCIIAlpha>())
+            || (regionLength == 3 && region.isAllSpecialCharacters<isASCIIDigit>())
+        );
+        if (isValidRegion) {
+            ++currentIndex;
+            canonical.append('-');
+            canonical.append(region.convertToASCIIUppercase());
+        }
+    }
+
+    // Check for variant.
+    // variant = 5*8alphanum / (DIGIT 3alphanum)
+    HashSet<String> subtags;
+    while (currentIndex < numParts) {
+        const String& variant = parts[currentIndex];
+        unsigned variantLength = variant.length();
+        bool isValidVariant = (
+            (variantLength >= 5 && variantLength <= 8 && variant.isAllSpecialCharacters<isASCIIAlphanumeric>())
+            || (variantLength == 4 && isASCIIDigit(variant[0]) && variant.substring(1, 3).isAllSpecialCharacters<isASCIIAlphanumeric>())
+        );
+        if (!isValidVariant)
+            break;
+
+        // Cannot include duplicate subtags (case insensitive).
+        String lowerVariant = variant.convertToASCIILowercase();
+        if (!subtags.add(lowerVariant).isNewEntry)
+            return String();
+
+        ++currentIndex;
+
+        // Reordering variant subtags is not required in the spec.
+        canonical.append('-');
+        canonical.append(lowerVariant);
+    }
+
+    // Check for extension.
+    // extension = singleton 1*("-" (2*8alphanum))
+    // singleton = alphanum except x or X
+    subtags.clear();
+    Vector<String> extensions;
+    while (currentIndex < numParts) {
+        const String& possibleSingleton = parts[currentIndex];
+        unsigned singletonLength = possibleSingleton.length();
+        bool isValidSingleton = (singletonLength == 1 && possibleSingleton != "x" && possibleSingleton != "X" && isASCIIAlphanumeric(possibleSingleton[0]));
+        if (!isValidSingleton)
+            break;
+
+        // Cannot include duplicate singleton (case insensitive).
+        String singleton = possibleSingleton.convertToASCIILowercase();
+        if (!subtags.add(singleton).isNewEntry)
+            return String();
+
+        ++currentIndex;
+        int numExtParts = 0;
+        StringBuilder extension;
+        extension.append(singleton);
+        while (currentIndex < numParts) {
+            const String& extPart = parts[currentIndex];
+            unsigned extPartLength = extPart.length();
+
+            bool isValid = (extPartLength >= 2 && extPartLength <= 8 && extPart.isAllSpecialCharacters<isASCIIAlphanumeric>());
+            if (!isValid)
+                break;
+
+            ++currentIndex;
+            ++numExtParts;
+            extension.append('-');
+            extension.append(extPart.convertToASCIILowercase());
+        }
+
+        // Requires at least one production.
+        if (!numExtParts)
+            return String();
+
+        extensions.append(extension.toString());
+    }
+
+    // Add extensions to canonical sorted by singleton.
+    std::sort(
+        extensions.begin(),
+        extensions.end(),
+        [] (const String& a, const String& b) -> bool {
+            return a[0] < b[0];
+        }
+    );
+    size_t numExtenstions = extensions.size();
+    for (size_t i = 0; i < numExtenstions; ++i) {
+        canonical.append('-');
+        canonical.append(extensions[i]);
+    }
+
+    // Check for privateuse.
+    if (currentIndex < numParts) {
+        String privateuse = privateUseLangTag(parts, currentIndex);
+        if (privateuse.isNull())
+            return String();
+        canonical.append('-');
+        canonical.append(privateuse);
+    }
+
+    // FIXME: Replace subtags with their preferred values.
+
+    return canonical.toString();
+}
+
+static String grandfatheredLangTag(const String& locale)
+{
+    // grandfathered = irregular / regular
+    // FIXME: convert to a compile time hash table if this is causing performance issues.
+    HashMap<String, String> tagMap = {
+        // Irregular.
+        { ASCIILiteral("en-gb-oed"), ASCIILiteral("en-GB-oed") },
+        { ASCIILiteral("i-ami"), ASCIILiteral("ami") },
+        { ASCIILiteral("i-bnn"), ASCIILiteral("bnn") },
+        { ASCIILiteral("i-default"), ASCIILiteral("i-default") },
+        { ASCIILiteral("i-enochian"), ASCIILiteral("i-enochian") },
+        { ASCIILiteral("i-hak"), ASCIILiteral("hak") },
+        { ASCIILiteral("i-klingon"), ASCIILiteral("tlh") },
+        { ASCIILiteral("i-lux"), ASCIILiteral("lb") },
+        { ASCIILiteral("i-mingo"), ASCIILiteral("i-mingo") },
+        { ASCIILiteral("i-navajo"), ASCIILiteral("nv") },
+        { ASCIILiteral("i-pwn"), ASCIILiteral("pwn") },
+        { ASCIILiteral("i-tao"), ASCIILiteral("tao") },
+        { ASCIILiteral("i-tay"), ASCIILiteral("tay") },
+        { ASCIILiteral("i-tsu"), ASCIILiteral("tsu") },
+        { ASCIILiteral("sgn-be-fr"), ASCIILiteral("sfb") },
+        { ASCIILiteral("sgn-be-nl"), ASCIILiteral("vgt") },
+        { ASCIILiteral("sgn-ch-de"), ASCIILiteral("sgg") },
+        // Regular.
+        { ASCIILiteral("art-lojban"), ASCIILiteral("jbo") },
+        { ASCIILiteral("cel-gaulish"), ASCIILiteral("cel-gaulish") },
+        { ASCIILiteral("no-bok"), ASCIILiteral("nb") },
+        { ASCIILiteral("no-nyn"), ASCIILiteral("nn") },
+        { ASCIILiteral("zh-guoyu"), ASCIILiteral("cmn") },
+        { ASCIILiteral("zh-hakka"), ASCIILiteral("hak") },
+        { ASCIILiteral("zh-min"), ASCIILiteral("zh-min") },
+        { ASCIILiteral("zh-min-nan"), ASCIILiteral("nan") },
+        { ASCIILiteral("zh-xiang"), ASCIILiteral("hsn") }
+    };
+
+    return tagMap.get(locale.convertToASCIILowercase());
+}
+
+static String canonicalizeLanguageTag(const String& locale)
+{
+    // 6.2.2 IsStructurallyValidLanguageTag (locale)
+    // 6.2.3 CanonicalizeLanguageTag (locale)
+    // These are done one after another in CanonicalizeLocaleList, so they are combined here to reduce duplication.
+    // https://www.rfc-editor.org/rfc/bcp/bcp47.txt
+
+    // Language-Tag = langtag / privateuse / grandfathered
+    String grandfather = grandfatheredLangTag(locale);
+    if (!grandfather.isNull())
+        return grandfather;
+
+    // FIXME: Replace redundant tags [RFC4647].
+
+    Vector<String> parts;
+    locale.split('-', true, parts);
+    if (!parts.isEmpty()) {
+        String langtag = canonicalLangTag(parts);
+        if (!langtag.isNull())
+            return langtag;
+
+        String privateuse = privateUseLangTag(parts, 0);
+        if (!privateuse.isNull())
+            return privateuse;
+    }
+
+    return String();
+}
+
+Vector<String> canonicalizeLocaleList(ExecState& state, JSValue locales)
+{
+    // 9.2.1 CanonicalizeLocaleList (locales)
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = state.jsCallee()->globalObject();
+    Vector<String> seen;
+
+    // 1. If locales is undefined, then a. Return a new empty List.
+    if (locales.isUndefined())
+        return seen;
+
+    // 2. Let seen be an empty List.
+    // Done before to also return in step 1, if needed.
+
+    // 3. If Type(locales) is String, then
+    JSObject* localesObject;
+    if (locales.isString()) {
+        //  a. Let aLocales be CreateArrayFromList(«locales»).
+        JSArray* localesArray = JSArray::tryCreate(vm, globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous), 1);
+        if (!localesArray) {
+            throwOutOfMemoryError(&state, scope);
+            RETURN_IF_EXCEPTION(scope, Vector<String>());
+        }
+
+        localesArray->initializeIndex(vm, 0, locales);
+        // 4. Let O be ToObject(aLocales).
+        localesObject = localesArray;
+    } else {
+        // 4. Let O be ToObject(aLocales).
+        localesObject = locales.toObject(&state);
+    }
+
+    // 5. ReturnIfAbrupt(O).
+    RETURN_IF_EXCEPTION(scope, Vector<String>());
+
+    // 6. Let len be ToLength(Get(O, "length")).
+    JSValue lengthProperty = localesObject->get(&state, vm.propertyNames->length);
+    RETURN_IF_EXCEPTION(scope, Vector<String>());
+
+    double length = lengthProperty.toLength(&state);
+    RETURN_IF_EXCEPTION(scope, Vector<String>());
+
+    // Keep track of locales that have been added to the list.
+    HashSet<String> seenSet;
+
+    // 7. Let k be 0.
+    // 8. Repeat, while k < len
+    for (double k = 0; k < length; ++k) {
+        // a. Let Pk be ToString(k).
+        // Not needed because hasProperty and get take an int for numeric key.
+
+        // b. Let kPresent be HasProperty(O, Pk).
+        bool kPresent = localesObject->hasProperty(&state, k);
+
+        // c. ReturnIfAbrupt(kPresent).
+        RETURN_IF_EXCEPTION(scope, Vector<String>());
+
+        // d. If kPresent is true, then
+        if (kPresent) {
+            // i. Let kValue be Get(O, Pk).
+            JSValue kValue = localesObject->get(&state, k);
+
+            // ii. ReturnIfAbrupt(kValue).
+            RETURN_IF_EXCEPTION(scope, Vector<String>());
+
+            // iii. If Type(kValue) is not String or Object, throw a TypeError exception.
+            if (!kValue.isString() && !kValue.isObject()) {
+                throwTypeError(&state, scope, ASCIILiteral("locale value must be a string or object"));
+                return Vector<String>();
+            }
+
+            // iv. Let tag be ToString(kValue).
+            JSString* tag = kValue.toString(&state);
+
+            // v. ReturnIfAbrupt(tag).
+            RETURN_IF_EXCEPTION(scope, Vector<String>());
+
+            // vi. If IsStructurallyValidLanguageTag(tag) is false, throw a RangeError exception.
+            // vii. Let canonicalizedTag be CanonicalizeLanguageTag(tag).
+            String canonicalizedTag = canonicalizeLanguageTag(tag->value(&state));
+            if (canonicalizedTag.isNull()) {
+                throwException(&state, scope, createRangeError(&state, String::format("invalid language tag: %s", tag->value(&state).utf8().data())));
+                return Vector<String>();
+            }
+
+            // viii. If canonicalizedTag is not an element of seen, append canonicalizedTag as the last element of seen.
+            if (seenSet.add(canonicalizedTag).isNewEntry)
+                seen.append(canonicalizedTag);
+        }
+        // e. Increase k by 1.
+    }
+
+    return seen;
+}
+
+String bestAvailableLocale(const HashSet<String>& availableLocales, const String& locale)
+{
+    // 9.2.2 BestAvailableLocale (availableLocales, locale)
+    // 1. Let candidate be locale.
+    String candidate = locale;
+
+    // 2. Repeat
+    while (!candidate.isEmpty()) {
+        // a. If availableLocales contains an element equal to candidate, then return candidate.
+        if (availableLocales.contains(candidate))
+            return candidate;
+
+        // b. Let pos be the character index of the last occurrence of "-" (U+002D) within candidate. If that character does not occur, return undefined.
+        size_t pos = candidate.reverseFind('-');
+        if (pos == notFound)
+            return String();
+
+        // c. If pos ≥ 2 and the character "-" occurs at index pos-2 of candidate, then decrease pos by 2.
+        if (pos >= 2 && candidate[pos - 2] == '-')
+            pos -= 2;
+
+        // d. Let candidate be the substring of candidate from position 0, inclusive, to position pos, exclusive.
+        candidate = candidate.substring(0, pos);
+    }
+
+    return String();
+}
+
+String defaultLocale(ExecState& state)
+{
+    // 6.2.4 DefaultLocale ()
+    
+    // WebCore's global objects will have their own ideas of how to determine the language. It may
+    // be determined by WebCore-specific logic like some WK settings. Usually this will return the
+    // same thing as platformUserPreferredLanguages()[0].
+    if (auto defaultLanguage = state.jsCallee()->globalObject()->globalObjectMethodTable()->defaultLanguage) {
+        String locale = defaultLanguage();
+        if (!locale.isEmpty())
+            return canonicalizeLanguageTag(locale);
+    }
+    
+    // If WebCore isn't around to tell us how to get the language then fall back to our own way of
+    // doing it, which mostly follows what WebCore would have done.
+    Vector<String> languages = platformUserPreferredLanguages();
+    if (!languages.isEmpty() && !languages[0].isEmpty())
+        return canonicalizeLanguageTag(languages[0]);
+    
+    // If all else fails, ask ICU. It will probably say something bogus like en_us even if the user
+    // has configured some other language, but being wrong is better than crashing.
+    String locale = uloc_getDefault();
+    convertICULocaleToBCP47LanguageTag(locale);
+    return locale;
+}
+
+String removeUnicodeLocaleExtension(const String& locale)
+{
+    Vector<String> parts;
+    locale.split('-', parts);
+    StringBuilder builder;
+    size_t partsSize = parts.size();
+    if (partsSize > 0)
+        builder.append(parts[0]);
+    for (size_t p = 1; p < partsSize; ++p) {
+        if (parts[p] == "u") {
+            // Skip the u- and anything that follows until another singleton.
+            // While the next part is part of the unicode extension, skip it.
+            while (p + 1 < partsSize && parts[p + 1].length() > 1)
+                ++p;
+        } else {
+            builder.append('-');
+            builder.append(parts[p]);
+        }
+    }
+    return builder.toString();
+}
+
+static MatcherResult lookupMatcher(ExecState& state, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales)
+{
+    // 9.2.3 LookupMatcher (availableLocales, requestedLocales) (ECMA-402 2.0)
+    String locale;
+    String noExtensionsLocale;
+    String availableLocale;
+    for (size_t i = 0; i < requestedLocales.size() && availableLocale.isNull(); ++i) {
+        locale = requestedLocales[i];
+        noExtensionsLocale = removeUnicodeLocaleExtension(locale);
+        availableLocale = bestAvailableLocale(availableLocales, noExtensionsLocale);
+    }
+
+    MatcherResult result;
+    if (!availableLocale.isNull()) {
+        result.locale = availableLocale;
+        if (locale != noExtensionsLocale) {
+            // i. Let extension be the String value consisting of the first substring of locale that is a Unicode locale extension sequence.
+            // ii. Let extensionIndex be the character position of the initial "-" extension sequence within locale.
+            size_t extensionIndex = locale.find("-u-");
+            RELEASE_ASSERT(extensionIndex != notFound);
+
+            size_t extensionLength = locale.length() - extensionIndex;
+            size_t end = extensionIndex + 3;
+            while (end < locale.length()) {
+                end = locale.find('-', end);
+                if (end == notFound)
+                    break;
+                if (end + 2 < locale.length() && locale[end + 2] == '-') {
+                    extensionLength = end - extensionIndex;
+                    break;
+                }
+                end++;
+            }
+            result.extension = locale.substring(extensionIndex, extensionLength);
+            result.extensionIndex = extensionIndex;
+        }
+    } else
+        result.locale = defaultLocale(state);
+    return result;
+}
+
+static MatcherResult bestFitMatcher(ExecState& state, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales)
+{
+    // 9.2.4 BestFitMatcher (availableLocales, requestedLocales) (ECMA-402 2.0)
+    // FIXME: Implement something better than lookup.
+    return lookupMatcher(state, availableLocales, requestedLocales);
+}
+
+HashMap<String, String> resolveLocale(ExecState& state, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales, const HashMap<String, String>& options, const char* const relevantExtensionKeys[], size_t relevantExtensionKeyCount, Vector<String> (*localeData)(const String&, size_t))
+{
+    // 9.2.5 ResolveLocale (availableLocales, requestedLocales, options, relevantExtensionKeys, localeData) (ECMA-402 2.0)
+    // 1. Let matcher be the value of options.[[localeMatcher]].
+    const String& matcher = options.get(ASCIILiteral("localeMatcher"));
+
+    // 2. If matcher is "lookup", then
+    MatcherResult (*matcherOperation)(ExecState&, const HashSet<String>&, const Vector<String>&);
+    if (matcher == "lookup") {
+        // a. Let MatcherOperation be the abstract operation LookupMatcher.
+        matcherOperation = lookupMatcher;
+    } else { // 3. Else
+        // a. Let MatcherOperation be the abstract operation BestFitMatcher.
+        matcherOperation = bestFitMatcher;
+    }
+
+    // 4. Let r be MatcherOperation(availableLocales, requestedLocales).
+    MatcherResult matcherResult = matcherOperation(state, availableLocales, requestedLocales);
+
+    // 5. Let foundLocale be the value of r.[[locale]].
+    String foundLocale = matcherResult.locale;
+
+    // 6. If r has an [[extension]] field, then
+    Vector<String> extensionSubtags;
+    if (!matcherResult.extension.isNull()) {
+        // a. Let extension be the value of r.[[extension]].
+        // b. Let extensionIndex be the value of r.[[extensionIndex]].
+        // c. Let extensionSubtags be Call(%StringProto_split%, extension, «"-"») .
+        // d. Let extensionSubtagsLength be Get(CreateArrayFromList(extensionSubtags), "length").
+        matcherResult.extension.split('-', extensionSubtags);
+    }
+
+    // 7. Let result be a new Record.
+    HashMap<String, String> result;
+
+    // 8. Set result.[[dataLocale]] to foundLocale.
+    result.add(ASCIILiteral("dataLocale"), foundLocale);
+
+    // 9. Let supportedExtension be "-u".
+    String supportedExtension = ASCIILiteral("-u");
+
+    // 10. Let k be 0.
+    // 11. Let rExtensionKeys be ToObject(CreateArrayFromList(relevantExtensionKeys)).
+    // 12. ReturnIfAbrupt(rExtensionKeys).
+    // 13. Let len be ToLength(Get(rExtensionKeys, "length")).
+    // 14. Repeat while k < len
+    for (size_t keyIndex = 0; keyIndex < relevantExtensionKeyCount; ++keyIndex) {
+        // a. Let key be Get(rExtensionKeys, ToString(k)).
+        // b. ReturnIfAbrupt(key).
+        const char* key = relevantExtensionKeys[keyIndex];
+
+        // c. Let foundLocaleData be Get(localeData, foundLocale).
+        // d. ReturnIfAbrupt(foundLocaleData).
+        // e. Let keyLocaleData be ToObject(Get(foundLocaleData, key)).
+        // f. ReturnIfAbrupt(keyLocaleData).
+        Vector<String> keyLocaleData = localeData(foundLocale, keyIndex);
+
+        // g. Let value be ToString(Get(keyLocaleData, "0")).
+        // h. ReturnIfAbrupt(value).
+        ASSERT(!keyLocaleData.isEmpty());
+        String value = keyLocaleData[0];
+
+        // i. Let supportedExtensionAddition be "".
+        String supportedExtensionAddition;
+
+        // j. If extensionSubtags is not undefined, then
+        if (!extensionSubtags.isEmpty()) {
+            // i. Let keyPos be Call(%ArrayProto_indexOf%, extensionSubtags, «key») .
+            size_t keyPos = extensionSubtags.find(key);
+            // ii. If keyPos != -1, then
+            if (keyPos != notFound) {
+                // FIXME: https://github.com/tc39/ecma402/issues/59
+                // 1. If keyPos + 1 < extensionSubtagsLength and the length of the result of Get(extensionSubtags, ToString(keyPos +1)) is greater than 2, then
+                if (keyPos + 1 < extensionSubtags.size() && extensionSubtags[keyPos + 1].length() > 2) {
+                    const String& requestedValue = extensionSubtags[keyPos + 1];
+                    if (keyLocaleData.contains(requestedValue)) {
+                        value = requestedValue;
+                        supportedExtensionAddition = makeString('-', key, '-', value);
+                    }
+                } else if (keyLocaleData.contains(static_cast<String>(ASCIILiteral("true")))) {
+                    // 2. Else, if the result of Call(%StringProto_includes%, keyLocaleData, «"true"») is true, then
+                    value = ASCIILiteral("true");
+                }
+            }
+        }
+
+        // k. If options has a field [[<key>]], then
+        HashMap<String, String>::const_iterator iterator = options.find(key);
+        if (iterator != options.end()) {
+            // i. Let optionsValue be the value of ToString(options.[[<key>]]).
+            // ii. ReturnIfAbrupt(optionsValue).
+            const String& optionsValue = iterator->value;
+            // iii. If the result of Call(%StringProto_includes%, keyLocaleData, «optionsValue») is true, then
+            if (!optionsValue.isNull() && keyLocaleData.contains(optionsValue)) {
+                // 1. If optionsValue is not equal to value, then
+                if (optionsValue != value) {
+                    value = optionsValue;
+                    supportedExtensionAddition = String();
+                }
+            }
+        }
+
+        // l. Set result.[[<key>]] to value.
+        result.add(key, value);
+
+        // m. Append supportedExtensionAddition to supportedExtension.
+        supportedExtension.append(supportedExtensionAddition);
+
+        // n. Increase k by 1.
+    }
+
+    // 15. If the number of elements in supportedExtension is greater than 2, then
+    if (supportedExtension.length() > 2) {
+        // a. Let preExtension be the substring of foundLocale from position 0, inclusive, to position extensionIndex, exclusive.
+        // b. Let postExtension be the substring of foundLocale from position extensionIndex to the end of the string.
+        // c. Let foundLocale be the concatenation of preExtension, supportedExtension, and postExtension.
+        String preExtension = foundLocale.substring(0, matcherResult.extensionIndex);
+        String postExtension = foundLocale.substring(matcherResult.extensionIndex);
+        foundLocale = preExtension + supportedExtension + postExtension;
+    }
+
+    // 16. Set result.[[locale]] to foundLocale.
+    result.add(ASCIILiteral("locale"), foundLocale);
+
+    // 17. Return result.
+    return result;
+}
+
+static JSArray* lookupSupportedLocales(ExecState& state, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 9.2.6 LookupSupportedLocales (availableLocales, requestedLocales)
+
+    // 1. Let rLocales be CreateArrayFromList(requestedLocales).
+    // Already an array.
+
+    // 2. Let len be ToLength(Get(rLocales, "length")).
+    size_t len = requestedLocales.size();
+
+    // 3. Let subset be an empty List.
+    JSGlobalObject* globalObject = state.jsCallee()->globalObject();
+    JSArray* subset = JSArray::tryCreate(vm, globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), 0);
+    if (!subset) {
+        throwOutOfMemoryError(&state, scope);
+        return nullptr;
+    }
+
+    // 4. Let k be 0.
+    // 5. Repeat while k < len
+    for (size_t k = 0; k < len; ++k) {
+        // a. Let Pk be ToString(k).
+        // b. Let locale be Get(rLocales, Pk).
+        // c. ReturnIfAbrupt(locale).
+        const String& locale = requestedLocales[k];
+
+        // d. Let noExtensionsLocale be the String value that is locale with all Unicode locale extension sequences removed.
+        String noExtensionsLocale = removeUnicodeLocaleExtension(locale);
+
+        // e. Let availableLocale be BestAvailableLocale(availableLocales, noExtensionsLocale).
+        String availableLocale = bestAvailableLocale(availableLocales, noExtensionsLocale);
+
+        // f. If availableLocale is not undefined, then append locale to the end of subset.
+        if (!availableLocale.isNull()) {
+            subset->push(&state, jsString(&state, locale));
+            RETURN_IF_EXCEPTION(scope, nullptr);
+        }
+
+        // g. Increment k by 1.
+    }
+
+    // 6. Return subset.
+    return subset;
+}
+
+static JSArray* bestFitSupportedLocales(ExecState& state, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales)
+{
+    // 9.2.7 BestFitSupportedLocales (availableLocales, requestedLocales)
+    // FIXME: Implement something better than lookup.
+    return lookupSupportedLocales(state, availableLocales, requestedLocales);
+}
+
+JSValue supportedLocales(ExecState& state, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales, JSValue options)
+{
+    // 9.2.8 SupportedLocales (availableLocales, requestedLocales, options)
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    String matcher;
+
+    // 1. If options is not undefined, then
+    if (!options.isUndefined()) {
+        // a. Let matcher be GetOption(options, "localeMatcher", "string", « "lookup", "best fit" », "best fit").
+        matcher = intlStringOption(state, options, vm.propertyNames->localeMatcher, { "lookup", "best fit" }, "localeMatcher must be either \"lookup\" or \"best fit\"", "best fit");
+        // b. ReturnIfAbrupt(matcher).
+        RETURN_IF_EXCEPTION(scope, JSValue());
+    } else {
+        // 2. Else, let matcher be "best fit".
+        matcher = ASCIILiteral("best fit");
+    }
+
+    JSArray* supportedLocales;
+    // 3. If matcher is "best fit",
+    if (matcher == "best fit") {
+        // a. Let MatcherOperation be the abstract operation BestFitSupportedLocales.
+        // 5. Let supportedLocales be MatcherOperation(availableLocales, requestedLocales).
+        supportedLocales = bestFitSupportedLocales(state, availableLocales, requestedLocales);
+    } else {
+        // 4. Else
+        // a. Let MatcherOperation be the abstract operation LookupSupportedLocales.
+        // 5. Let supportedLocales be MatcherOperation(availableLocales, requestedLocales).
+        supportedLocales = lookupSupportedLocales(state, availableLocales, requestedLocales);
+    }
+
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    // 6. Let subset be CreateArrayFromList(supportedLocales).
+    // Already an array.
+
+    // 7. Let keys be subset.[[OwnPropertyKeys]]().
+    PropertyNameArray keys(&state, PropertyNameMode::Strings);
+    supportedLocales->getOwnPropertyNames(supportedLocales, &state, keys, EnumerationMode());
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    PropertyDescriptor desc;
+    desc.setConfigurable(false);
+    desc.setWritable(false);
+
+    // 8. Repeat for each element P of keys in List order,
+    size_t len = keys.size();
+    for (size_t i = 0; i < len; ++i) {
+        // a. Let desc be PropertyDescriptor { [[Configurable]]: false, [[Writable]]: false }.
+        // Created above for reuse.
+
+        // b. Let status be DefinePropertyOrThrow(subset, P, desc).
+        supportedLocales->defineOwnProperty(supportedLocales, &state, keys[i], desc, true);
+
+        // c. Assert: status is not abrupt completion.
+        RETURN_IF_EXCEPTION(scope, JSValue());
+    }
+
+    // 9. Return subset.
+    return supportedLocales;
+}
+
+Vector<String> numberingSystemsForLocale(const String& locale)
+{
+    static NeverDestroyed<Vector<String>> cachedNumberingSystems;
+    Vector<String>& availableNumberingSystems = cachedNumberingSystems.get();
+    if (availableNumberingSystems.isEmpty()) {
+        UErrorCode status = U_ZERO_ERROR;
+        UEnumeration* numberingSystemNames = unumsys_openAvailableNames(&status);
+        ASSERT(U_SUCCESS(status));
+
+        int32_t resultLength;
+        // Numbering system names are always ASCII, so use char[].
+        while (const char* result = uenum_next(numberingSystemNames, &resultLength, &status)) {
+            ASSERT(U_SUCCESS(status));
+            availableNumberingSystems.append(String(result, resultLength));
+        }
+        uenum_close(numberingSystemNames);
+    }
+
+    UErrorCode status = U_ZERO_ERROR;
+    UNumberingSystem* defaultSystem = unumsys_open(locale.utf8().data(), &status);
+    ASSERT(U_SUCCESS(status));
+    String defaultSystemName(unumsys_getName(defaultSystem));
+    unumsys_close(defaultSystem);
+
+    Vector<String> numberingSystems({ defaultSystemName });
+    numberingSystems.appendVector(availableNumberingSystems);
+    return numberingSystems;
+}
+
+EncodedJSValue JSC_HOST_CALL intlObjectFuncGetCanonicalLocales(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // https://tc39.github.io/ecma402/#sec-intl.getcanonicallocales
+    // 8.2.1 Intl.getCanonicalLocales(locales) (ECMA-402 4.0)
+
+    // 1. Let ll be ? CanonicalizeLocaleList(locales).
+    Vector<String> localeList = canonicalizeLocaleList(*state, state->argument(0));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 2. Return CreateArrayFromList(ll).
+    JSGlobalObject* globalObject = state->jsCallee()->globalObject();
+    JSArray* localeArray = JSArray::tryCreate(vm, globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous), localeList.size());
+    if (!localeArray) {
+        throwOutOfMemoryError(state, scope);
+        return encodedJSValue();
+    }
+
+    auto length = localeList.size();
+    for (size_t i = 0; i < length; ++i) {
+        localeArray->initializeIndex(vm, i, jsString(state, localeList[i]));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    return JSValue::encode(localeArray);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlObject.h b/runtime/IntlObject.h
new file mode 100644
index 0000000..54a1d45
--- /dev/null
+++ b/runtime/IntlObject.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "JSCJSValueInlines.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class IntlCollatorConstructor;
+class IntlCollatorPrototype;
+class IntlDateTimeFormatConstructor;
+class IntlDateTimeFormatPrototype;
+class IntlNumberFormatConstructor;
+class IntlNumberFormatPrototype;
+
+class IntlObject : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+
+    static IntlObject* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+
+private:
+    IntlObject(VM&, Structure*);
+};
+
+String defaultLocale(ExecState&);
+void convertICULocaleToBCP47LanguageTag(String& locale);
+bool intlBooleanOption(ExecState&, JSValue options, PropertyName, bool& usesFallback);
+String intlStringOption(ExecState&, JSValue options, PropertyName, std::initializer_list<const char*> values, const char* notFound, const char* fallback);
+unsigned intlNumberOption(ExecState&, JSValue options, PropertyName, unsigned minimum, unsigned maximum, unsigned fallback);
+Vector<String> canonicalizeLocaleList(ExecState&, JSValue locales);
+HashMap<String, String> resolveLocale(ExecState&, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales, const HashMap<String, String>& options, const char* const relevantExtensionKeys[], size_t relevantExtensionKeyCount, Vector<String> (*localeData)(const String&, size_t));
+JSValue supportedLocales(ExecState&, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales, JSValue options);
+String removeUnicodeLocaleExtension(const String& locale);
+String bestAvailableLocale(const HashSet<String>& availableLocales, const String& requestedLocale);
+Vector<String> numberingSystemsForLocale(const String& locale);
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/IntlObjectInlines.h b/runtime/IntlObjectInlines.h
new file mode 100644
index 0000000..eb0e859
--- /dev/null
+++ b/runtime/IntlObjectInlines.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <yusuke.suzuki@sslab.ics.keio.ac.jp>
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(INTL)
+
+#include "BuiltinNames.h"
+#include "IntlObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+template<typename IntlInstance, typename Constructor, typename Factory>
+JSValue constructIntlInstanceWithWorkaroundForLegacyIntlConstructor(ExecState& state, JSValue thisValue, Constructor* callee, Factory factory)
+{
+    // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
+    // https://bugs.webkit.org/show_bug.cgi?id=153679
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!jsDynamicCast<IntlInstance*>(thisValue)) {
+        JSValue prototype = callee->getDirect(vm, vm.propertyNames->prototype);
+        bool hasInstance = JSObject::defaultHasInstance(&state, thisValue, prototype);
+        RETURN_IF_EXCEPTION(scope, JSValue());
+        if (hasInstance) {
+            JSObject* thisObject = thisValue.toObject(&state);
+            RETURN_IF_EXCEPTION(scope, JSValue());
+
+            IntlInstance* instance = factory(vm);
+            RETURN_IF_EXCEPTION(scope, JSValue());
+
+            thisObject->putDirect(vm, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName(), instance);
+            return thisObject;
+        }
+    }
+    scope.release();
+    return factory(vm);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(INTL)
diff --git a/runtime/Intrinsic.h b/runtime/Intrinsic.h
new file mode 100644
index 0000000..adae5ef
--- /dev/null
+++ b/runtime/Intrinsic.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum JS_EXPORT_PRIVATE Intrinsic {
+    // Call intrinsics.
+    NoIntrinsic,
+    AbsIntrinsic,
+    MinIntrinsic,
+    MaxIntrinsic,
+    SqrtIntrinsic,
+    SinIntrinsic,
+    Clz32Intrinsic,
+    CosIntrinsic,
+    TanIntrinsic,
+    ArrayPushIntrinsic,
+    ArrayPopIntrinsic,
+    ArraySliceIntrinsic,
+    CharCodeAtIntrinsic,
+    CharAtIntrinsic,
+    FromCharCodeIntrinsic,
+    PowIntrinsic,
+    FloorIntrinsic,
+    CeilIntrinsic,
+    RoundIntrinsic,
+    ExpIntrinsic,
+    LogIntrinsic,
+    RegExpExecIntrinsic,
+    RegExpTestIntrinsic,
+    RegExpTestFastIntrinsic,
+    StringPrototypeValueOfIntrinsic,
+    StringPrototypeReplaceIntrinsic,
+    StringPrototypeReplaceRegExpIntrinsic,
+    IMulIntrinsic,
+    RandomIntrinsic,
+    FRoundIntrinsic,
+    TruncIntrinsic,
+    IsTypedArrayViewIntrinsic,
+    BoundThisNoArgsFunctionCallIntrinsic,
+    JSMapGetIntrinsic,
+    JSMapHasIntrinsic,
+    JSSetHasIntrinsic,
+    HasOwnPropertyIntrinsic,
+    AtomicsAddIntrinsic,
+    AtomicsAndIntrinsic,
+    AtomicsCompareExchangeIntrinsic,
+    AtomicsExchangeIntrinsic,
+    AtomicsIsLockFreeIntrinsic,
+    AtomicsLoadIntrinsic,
+    AtomicsOrIntrinsic,
+    AtomicsStoreIntrinsic,
+    AtomicsSubIntrinsic,
+    AtomicsWaitIntrinsic,
+    AtomicsWakeIntrinsic,
+    AtomicsXorIntrinsic,
+    ToLowerCaseIntrinsic,
+
+    // Getter intrinsics.
+    TypedArrayLengthIntrinsic,
+    TypedArrayByteLengthIntrinsic,
+    TypedArrayByteOffsetIntrinsic,
+
+    // Debugging intrinsics. These are meant to be used as testing hacks within
+    // jsc.cpp and should never be exposed to users.
+    DFGTrueIntrinsic,
+    OSRExitIntrinsic,
+    IsFinalTierIntrinsic,
+    SetInt32HeapPredictionIntrinsic,
+    CheckInt32Intrinsic,
+    FiatInt52Intrinsic,
+};
+
+} // namespace JSC
diff --git a/runtime/IterationKind.h b/runtime/IterationKind.h
new file mode 100644
index 0000000..07f1fcf
--- /dev/null
+++ b/runtime/IterationKind.h
@@ -0,0 +1,37 @@
+/*
+ *  Copyright (C) 2016 Oleksandr Skachkov (gskachkov@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+    
+enum IterationKind : uint32_t {
+    IterateKey,
+    IterateValue,
+    IterateKeyValue,
+};
+
+    
+} // namespace JSC
diff --git a/runtime/IterationStatus.h b/runtime/IterationStatus.h
new file mode 100644
index 0000000..3d0b0dd
--- /dev/null
+++ b/runtime/IterationStatus.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum class IterationStatus {
+    Continue,
+    Done
+};
+
+} // namespace JSC
diff --git a/runtime/IteratorOperations.cpp b/runtime/IteratorOperations.cpp
new file mode 100644
index 0000000..83befd2
--- /dev/null
+++ b/runtime/IteratorOperations.cpp
@@ -0,0 +1,189 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IteratorOperations.h"
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "ObjectConstructor.h"
+
+using namespace WTF;
+
+namespace JSC {
+
+JSValue iteratorNext(ExecState* exec, JSValue iterator, JSValue value)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue nextFunction = iterator.get(exec, vm.propertyNames->next);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    CallData nextFunctionCallData;
+    CallType nextFunctionCallType = getCallData(nextFunction, nextFunctionCallData);
+    if (nextFunctionCallType == CallType::None)
+        return throwTypeError(exec, scope);
+
+    MarkedArgumentBuffer nextFunctionArguments;
+    if (!value.isEmpty())
+        nextFunctionArguments.append(value);
+    JSValue result = call(exec, nextFunction, nextFunctionCallType, nextFunctionCallData, iterator, nextFunctionArguments);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    if (!result.isObject())
+        return throwTypeError(exec, scope, ASCIILiteral("Iterator result interface is not an object."));
+
+    return result;
+}
+
+JSValue iteratorNext(ExecState* exec, JSValue iterator)
+{
+    return iteratorNext(exec, iterator, JSValue());
+}
+
+JSValue iteratorValue(ExecState* exec, JSValue iterResult)
+{
+    return iterResult.get(exec, exec->vm().propertyNames->value);
+}
+
+bool iteratorComplete(ExecState* exec, JSValue iterResult)
+{
+    JSValue done = iterResult.get(exec, exec->vm().propertyNames->done);
+    return done.toBoolean(exec);
+}
+
+JSValue iteratorStep(ExecState* exec, JSValue iterator)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue result = iteratorNext(exec, iterator);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    bool done = iteratorComplete(exec, result);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    if (done)
+        return jsBoolean(false);
+    return result;
+}
+
+void iteratorClose(ExecState* exec, JSValue iterator)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    auto catchScope = DECLARE_CATCH_SCOPE(vm);
+
+    Exception* exception = nullptr;
+    if (UNLIKELY(catchScope.exception())) {
+        exception = catchScope.exception();
+        catchScope.clearException();
+    }
+    JSValue returnFunction = iterator.get(exec, vm.propertyNames->returnKeyword);
+    RETURN_IF_EXCEPTION(throwScope, void());
+
+    if (returnFunction.isUndefined()) {
+        if (exception)
+            throwException(exec, throwScope, exception);
+        return;
+    }
+
+    CallData returnFunctionCallData;
+    CallType returnFunctionCallType = getCallData(returnFunction, returnFunctionCallData);
+    if (returnFunctionCallType == CallType::None) {
+        if (exception)
+            throwException(exec, throwScope, exception);
+        else
+            throwTypeError(exec, throwScope);
+        return;
+    }
+
+    MarkedArgumentBuffer returnFunctionArguments;
+    JSValue innerResult = call(exec, returnFunction, returnFunctionCallType, returnFunctionCallData, iterator, returnFunctionArguments);
+
+    if (exception) {
+        throwException(exec, throwScope, exception);
+        return;
+    }
+
+    RETURN_IF_EXCEPTION(throwScope, void());
+
+    if (!innerResult.isObject()) {
+        throwTypeError(exec, throwScope, ASCIILiteral("Iterator result interface is not an object."));
+        return;
+    }
+}
+
+static const PropertyOffset donePropertyOffset = 0;
+static const PropertyOffset valuePropertyOffset = 1;
+
+Structure* createIteratorResultObjectStructure(VM& vm, JSGlobalObject& globalObject)
+{
+    Structure* iteratorResultStructure = vm.prototypeMap.emptyObjectStructureForPrototype(&globalObject, globalObject.objectPrototype(), JSFinalObject::defaultInlineCapacity());
+    PropertyOffset offset;
+    iteratorResultStructure = Structure::addPropertyTransition(vm, iteratorResultStructure, vm.propertyNames->done, 0, offset);
+    RELEASE_ASSERT(offset == donePropertyOffset);
+    iteratorResultStructure = Structure::addPropertyTransition(vm, iteratorResultStructure, vm.propertyNames->value, 0, offset);
+    RELEASE_ASSERT(offset == valuePropertyOffset);
+    return iteratorResultStructure;
+}
+
+JSObject* createIteratorResultObject(ExecState* exec, JSValue value, bool done)
+{
+    VM& vm = exec->vm();
+    JSObject* resultObject = constructEmptyObject(exec, exec->lexicalGlobalObject()->iteratorResultObjectStructure());
+    resultObject->putDirect(vm, donePropertyOffset, jsBoolean(done));
+    resultObject->putDirect(vm, valuePropertyOffset, value);
+    return resultObject;
+}
+
+JSValue iteratorForIterable(ExecState* state, JSValue iterable)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    JSValue iteratorFunction = iterable.get(state, state->propertyNames().iteratorSymbol);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    
+    CallData iteratorFunctionCallData;
+    CallType iteratorFunctionCallType = getCallData(iteratorFunction, iteratorFunctionCallData);
+    if (iteratorFunctionCallType == CallType::None) {
+        throwTypeError(state, scope);
+        return JSValue();
+    }
+
+    ArgList iteratorFunctionArguments;
+    JSValue iterator = call(state, iteratorFunction, iteratorFunctionCallType, iteratorFunctionCallData, iterable, iteratorFunctionArguments);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    if (!iterator.isObject()) {
+        throwTypeError(state, scope);
+        return JSValue();
+    }
+
+    return iterator;
+}
+
+} // namespace JSC
diff --git a/runtime/IteratorOperations.h b/runtime/IteratorOperations.h
new file mode 100644
index 0000000..a9b88b3
--- /dev/null
+++ b/runtime/IteratorOperations.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "JSObject.h"
+#include "ThrowScope.h"
+
+namespace JSC {
+
+JSValue iteratorNext(ExecState*, JSValue iterator, JSValue);
+JSValue iteratorNext(ExecState*, JSValue iterator);
+JS_EXPORT_PRIVATE JSValue iteratorValue(ExecState*, JSValue iterator);
+bool iteratorComplete(ExecState*, JSValue iterator);
+JS_EXPORT_PRIVATE JSValue iteratorStep(ExecState*, JSValue iterator);
+JS_EXPORT_PRIVATE void iteratorClose(ExecState*, JSValue iterator);
+JS_EXPORT_PRIVATE JSObject* createIteratorResultObject(ExecState*, JSValue, bool done);
+
+Structure* createIteratorResultObjectStructure(VM&, JSGlobalObject&);
+
+JS_EXPORT_PRIVATE JSValue iteratorForIterable(ExecState*, JSValue iterable);
+
+template <typename CallBackType>
+void forEachInIterable(ExecState* exec, JSValue iterable, const CallBackType& callback)
+{
+    auto& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue iterator = iteratorForIterable(exec, iterable);
+    RETURN_IF_EXCEPTION(scope, void());
+    while (true) {
+        JSValue next = iteratorStep(exec, iterator);
+        if (UNLIKELY(scope.exception()) || next.isFalse())
+            return;
+
+        JSValue nextValue = iteratorValue(exec, next);
+        RETURN_IF_EXCEPTION(scope, void());
+
+        callback(vm, exec, nextValue);
+        if (UNLIKELY(scope.exception())) {
+            scope.release();
+            iteratorClose(exec, iterator);
+            return;
+        }
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/IteratorPrototype.cpp b/runtime/IteratorPrototype.cpp
new file mode 100644
index 0000000..121a01e
--- /dev/null
+++ b/runtime/IteratorPrototype.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IteratorPrototype.h"
+
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "ObjectConstructor.h"
+
+namespace JSC {
+
+const ClassInfo IteratorPrototype::s_info = { "Iterator", &Base::s_info, nullptr, CREATE_METHOD_TABLE(IteratorPrototype) };
+
+void IteratorPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSFunction* iteratorPrototypeFunction = JSFunction::createBuiltinFunction(vm, iteratorPrototypeSymbolIteratorGetterCodeGenerator(vm), globalObject, "[Symbol.iterator]");
+    putDirectWithoutTransition(vm, vm.propertyNames->iteratorSymbol, iteratorPrototypeFunction, DontEnum);
+}
+
+} // namespace JSC
diff --git a/runtime/IteratorPrototype.h b/runtime/IteratorPrototype.h
new file mode 100644
index 0000000..643b194
--- /dev/null
+++ b/runtime/IteratorPrototype.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class IteratorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static IteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        IteratorPrototype* prototype = new (NotNull, allocateCell<IteratorPrototype>(vm.heap)) IteratorPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    IteratorPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSAPIValueWrapper.cpp b/runtime/JSAPIValueWrapper.cpp
new file mode 100644
index 0000000..6e5b536
--- /dev/null
+++ b/runtime/JSAPIValueWrapper.cpp
@@ -0,0 +1,34 @@
+/*
+ *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2004, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSAPIValueWrapper.h"
+
+#include "NumberObject.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSAPIValueWrapper);
+
+const ClassInfo JSAPIValueWrapper::s_info = { "API Wrapper", 0, 0, CREATE_METHOD_TABLE(JSAPIValueWrapper) };
+
+} // namespace JSC
diff --git a/runtime/JSAPIValueWrapper.h b/runtime/JSAPIValueWrapper.h
new file mode 100644
index 0000000..8c7c845
--- /dev/null
+++ b/runtime/JSAPIValueWrapper.h
@@ -0,0 +1,77 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "JSCell.h"
+#include "CallFrame.h"
+#include "Structure.h"
+
+namespace JSC {
+
+class JSAPIValueWrapper : public JSCell {
+    friend JSValue jsAPIValueWrapper(ExecState*, JSValue);
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    JSValue value() const { return m_value.get(); }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(APIValueWrapperType, OverridesGetPropertyNames), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    static JSAPIValueWrapper* create(ExecState* exec, JSValue value) 
+    {
+        VM& vm = exec->vm();
+        JSAPIValueWrapper* wrapper = new (NotNull, allocateCell<JSAPIValueWrapper>(vm.heap)) JSAPIValueWrapper(exec);
+        wrapper->finishCreation(vm, value);
+        return wrapper;
+    }
+
+protected:
+    void finishCreation(VM& vm, JSValue value)
+    {
+        Base::finishCreation(vm);
+        m_value.set(vm, this, value);
+        ASSERT(!value.isCell());
+    }
+
+private:
+    JSAPIValueWrapper(ExecState* exec)
+        : JSCell(exec->vm(), exec->vm().apiWrapperStructure.get())
+    {
+    }
+
+    WriteBarrier<Unknown> m_value;
+};
+
+inline JSValue jsAPIValueWrapper(ExecState* exec, JSValue value)
+{
+    return JSAPIValueWrapper::create(exec, value);
+}
+
+} // namespace JSC
diff --git a/runtime/JSArray.cpp b/runtime/JSArray.cpp
new file mode 100644
index 0000000..77d70a0
--- /dev/null
+++ b/runtime/JSArray.cpp
@@ -0,0 +1,1389 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "JSArray.h"
+
+#include "ArrayPrototype.h"
+#include "ButterflyInlines.h"
+#include "CodeBlock.h"
+#include "Error.h"
+#include "GetterSetter.h"
+#include "IndexingHeaderInlines.h"
+#include "JSArrayInlines.h"
+#include "JSCInlines.h"
+#include "PropertyNameArray.h"
+#include "TypeError.h"
+#include <wtf/Assertions.h>
+
+using namespace std;
+using namespace WTF;
+
+namespace JSC {
+
+static const char* const LengthExceededTheMaximumArrayLengthError = "Length exceeded the maximum array length";
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSArray);
+
+const ClassInfo JSArray::s_info = {"Array", &JSNonFinalObject::s_info, 0, CREATE_METHOD_TABLE(JSArray)};
+
+Butterfly* createArrayButterflyInDictionaryIndexingMode(
+    VM& vm, JSCell* intendedOwner, unsigned initialLength)
+{
+    Butterfly* butterfly = Butterfly::create(
+        vm, intendedOwner, 0, 0, true, IndexingHeader(), ArrayStorage::sizeFor(0));
+    ArrayStorage* storage = butterfly->arrayStorage();
+    storage->setLength(initialLength);
+    storage->setVectorLength(0);
+    storage->m_indexBias = 0;
+    storage->m_sparseMap.clear();
+    storage->m_numValuesInVector = 0;
+    return butterfly;
+}
+
+JSArray* JSArray::tryCreateUninitialized(VM& vm, GCDeferralContext* deferralContext, Structure* structure, unsigned initialLength)
+{
+    if (initialLength > MAX_STORAGE_VECTOR_LENGTH)
+        return 0;
+
+    unsigned outOfLineStorage = structure->outOfLineCapacity();
+
+    Butterfly* butterfly;
+    IndexingType indexingType = structure->indexingType();
+    if (LIKELY(!hasAnyArrayStorage(indexingType))) {
+        ASSERT(
+            hasUndecided(indexingType)
+            || hasInt32(indexingType)
+            || hasDouble(indexingType)
+            || hasContiguous(indexingType));
+
+        unsigned vectorLength = Butterfly::optimalContiguousVectorLength(structure, initialLength);
+        void* temp = vm.auxiliarySpace.tryAllocate(deferralContext, Butterfly::totalSize(0, outOfLineStorage, true, vectorLength * sizeof(EncodedJSValue)));
+        if (!temp)
+            return nullptr;
+        butterfly = Butterfly::fromBase(temp, 0, outOfLineStorage);
+        butterfly->setVectorLength(vectorLength);
+        butterfly->setPublicLength(initialLength);
+        if (hasDouble(indexingType)) {
+            for (unsigned i = initialLength; i < vectorLength; ++i)
+                butterfly->contiguousDouble()[i] = PNaN;
+        } else {
+            for (unsigned i = initialLength; i < vectorLength; ++i)
+                butterfly->contiguous()[i].clear();
+        }
+    } else {
+        unsigned vectorLength = ArrayStorage::optimalVectorLength(0, structure, initialLength);
+        void* temp = vm.auxiliarySpace.tryAllocate(deferralContext, Butterfly::totalSize(0, outOfLineStorage, true, ArrayStorage::sizeFor(vectorLength)));
+        if (!temp)
+            return nullptr;
+        butterfly = Butterfly::fromBase(temp, 0, outOfLineStorage);
+        *butterfly->indexingHeader() = indexingHeaderForArrayStorage(initialLength, vectorLength);
+        ArrayStorage* storage = butterfly->arrayStorage();
+        storage->m_indexBias = 0;
+        storage->m_sparseMap.clear();
+        storage->m_numValuesInVector = initialLength;
+        for (unsigned i = initialLength; i < vectorLength; ++i)
+            storage->m_vector[i].clear();
+    }
+
+    return createWithButterfly(vm, deferralContext, structure, butterfly);
+}
+
+void JSArray::setLengthWritable(ExecState* exec, bool writable)
+{
+    ASSERT(isLengthWritable() || !writable);
+    if (!isLengthWritable() || writable)
+        return;
+
+    enterDictionaryIndexingMode(exec->vm());
+
+    SparseArrayValueMap* map = arrayStorage()->m_sparseMap.get();
+    ASSERT(map);
+    map->setLengthIsReadOnly();
+}
+
+// Defined in ES5.1 15.4.5.1
+bool JSArray::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool throwException)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSArray* array = jsCast<JSArray*>(object);
+
+    // 3. If P is "length", then
+    if (propertyName == vm.propertyNames->length) {
+        // All paths through length definition call the default [[DefineOwnProperty]], hence:
+        // from ES5.1 8.12.9 7.a.
+        if (descriptor.configurablePresent() && descriptor.configurable())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeConfigurabilityError));
+        // from ES5.1 8.12.9 7.b.
+        if (descriptor.enumerablePresent() && descriptor.enumerable())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeEnumerabilityError));
+
+        // a. If the [[Value]] field of Desc is absent, then
+        // a.i. Return the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", Desc, and Throw as arguments.
+        if (descriptor.isAccessorDescriptor())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+        // from ES5.1 8.12.9 10.a.
+        if (!array->isLengthWritable() && descriptor.writablePresent() && descriptor.writable())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeWritabilityError));
+        // This descriptor is either just making length read-only, or changing nothing!
+        if (!descriptor.value()) {
+            if (descriptor.writablePresent())
+                array->setLengthWritable(exec, descriptor.writable());
+            return true;
+        }
+        
+        // b. Let newLenDesc be a copy of Desc.
+        // c. Let newLen be ToUint32(Desc.[[Value]]).
+        unsigned newLen = descriptor.value().toUInt32(exec);
+        // d. If newLen is not equal to ToNumber( Desc.[[Value]]), throw a RangeError exception.
+        if (newLen != descriptor.value().toNumber(exec)) {
+            JSC::throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
+            return false;
+        }
+
+        // Based on SameValue check in 8.12.9, this is always okay.
+        // FIXME: Nothing prevents this from being called on a RuntimeArray, and the length function will always return 0 in that case.
+        if (newLen == array->length()) {
+            if (descriptor.writablePresent())
+                array->setLengthWritable(exec, descriptor.writable());
+            return true;
+        }
+
+        // e. Set newLenDesc.[[Value] to newLen.
+        // f. If newLen >= oldLen, then
+        // f.i. Return the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", newLenDesc, and Throw as arguments.
+        // g. Reject if oldLenDesc.[[Writable]] is false.
+        if (!array->isLengthWritable())
+            return typeError(exec, scope, throwException, ASCIILiteral(ReadonlyPropertyChangeError));
+        
+        // h. If newLenDesc.[[Writable]] is absent or has the value true, let newWritable be true.
+        // i. Else,
+        // i.i. Need to defer setting the [[Writable]] attribute to false in case any elements cannot be deleted.
+        // i.ii. Let newWritable be false.
+        // i.iii. Set newLenDesc.[[Writable] to true.
+        // j. Let succeeded be the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", newLenDesc, and Throw as arguments.
+        // k. If succeeded is false, return false.
+        // l. While newLen < oldLen repeat,
+        // l.i. Set oldLen to oldLen – 1.
+        // l.ii. Let deleteSucceeded be the result of calling the [[Delete]] internal method of A passing ToString(oldLen) and false as arguments.
+        // l.iii. If deleteSucceeded is false, then
+        bool success = array->setLength(exec, newLen, throwException);
+        ASSERT(!scope.exception() || !success);
+        if (!success) {
+            // 1. Set newLenDesc.[[Value] to oldLen+1.
+            // 2. If newWritable is false, set newLenDesc.[[Writable] to false.
+            // 3. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", newLenDesc, and false as arguments.
+            // 4. Reject.
+            if (descriptor.writablePresent())
+                array->setLengthWritable(exec, descriptor.writable());
+            return false;
+        }
+
+        // m. If newWritable is false, then
+        // i. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length",
+        //    Property Descriptor{[[Writable]]: false}, and false as arguments. This call will always
+        //    return true.
+        if (descriptor.writablePresent())
+            array->setLengthWritable(exec, descriptor.writable());
+        // n. Return true.
+        return true;
+    }
+
+    // 4. Else if P is an array index (15.4), then
+    // a. Let index be ToUint32(P).
+    if (std::optional<uint32_t> optionalIndex = parseIndex(propertyName)) {
+        // b. Reject if index >= oldLen and oldLenDesc.[[Writable]] is false.
+        uint32_t index = optionalIndex.value();
+        // FIXME: Nothing prevents this from being called on a RuntimeArray, and the length function will always return 0 in that case.
+        if (index >= array->length() && !array->isLengthWritable())
+            return typeError(exec, scope, throwException, ASCIILiteral("Attempting to define numeric property on array with non-writable length property."));
+        // c. Let succeeded be the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing P, Desc, and false as arguments.
+        // d. Reject if succeeded is false.
+        // e. If index >= oldLen
+        // e.i. Set oldLenDesc.[[Value]] to index + 1.
+        // e.ii. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", oldLenDesc, and false as arguments. This call will always return true.
+        // f. Return true.
+        scope.release();
+        return array->defineOwnIndexedProperty(exec, index, descriptor, throwException);
+    }
+
+    scope.release();
+    return array->JSObject::defineOwnNonIndexProperty(exec, propertyName, descriptor, throwException);
+}
+
+bool JSArray::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    JSArray* thisObject = jsCast<JSArray*>(object);
+    if (propertyName == exec->propertyNames().length) {
+        unsigned attributes = thisObject->isLengthWritable() ? DontDelete | DontEnum : DontDelete | DontEnum | ReadOnly;
+        slot.setValue(thisObject, attributes, jsNumber(thisObject->length()));
+        return true;
+    }
+
+    return JSObject::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+}
+
+// ECMA 15.4.5.1
+bool JSArray::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSArray* thisObject = jsCast<JSArray*>(cell);
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject))) {
+        scope.release();
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+    }
+
+    if (propertyName == exec->propertyNames().length) {
+        unsigned newLength = value.toUInt32(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (value.toNumber(exec) != static_cast<double>(newLength)) {
+            throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
+            return false;
+        }
+        scope.release();
+        return thisObject->setLength(exec, newLength, slot.isStrictMode());
+    }
+
+    scope.release();
+    return JSObject::put(thisObject, exec, propertyName, value, slot);
+}
+
+bool JSArray::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    JSArray* thisObject = jsCast<JSArray*>(cell);
+
+    if (propertyName == exec->propertyNames().length)
+        return false;
+
+    return JSObject::deleteProperty(thisObject, exec, propertyName);
+}
+
+static int compareKeysForQSort(const void* a, const void* b)
+{
+    unsigned da = *static_cast<const unsigned*>(a);
+    unsigned db = *static_cast<const unsigned*>(b);
+    return (da > db) - (da < db);
+}
+
+void JSArray::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    JSArray* thisObject = jsCast<JSArray*>(object);
+
+    if (mode.includeDontEnumProperties())
+        propertyNames.add(exec->propertyNames().length);
+
+    JSObject::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);
+}
+
+// This method makes room in the vector, but leaves the new space for count slots uncleared.
+bool JSArray::unshiftCountSlowCase(const AbstractLocker&, VM& vm, DeferGC&, bool addToFront, unsigned count)
+{
+    ArrayStorage* storage = ensureArrayStorage(vm);
+    Butterfly* butterfly = storage->butterfly();
+    Structure* structure = this->structure(vm);
+    unsigned propertyCapacity = structure->outOfLineCapacity();
+    unsigned propertySize = structure->outOfLineSize();
+    
+    // If not, we should have handled this on the fast path.
+    ASSERT(!addToFront || count > storage->m_indexBias);
+
+    // Step 1:
+    // Gather 4 key metrics:
+    //  * usedVectorLength - how many entries are currently in the vector (conservative estimate - fewer may be in use in sparse vectors).
+    //  * requiredVectorLength - how many entries are will there be in the vector, after allocating space for 'count' more.
+    //  * currentCapacity - what is the current size of the vector, including any pre-capacity.
+    //  * desiredCapacity - how large should we like to grow the vector to - based on 2x requiredVectorLength.
+
+    unsigned length = storage->length();
+    unsigned oldVectorLength = storage->vectorLength();
+    unsigned usedVectorLength = min(oldVectorLength, length);
+    ASSERT(usedVectorLength <= MAX_STORAGE_VECTOR_LENGTH);
+    // Check that required vector length is possible, in an overflow-safe fashion.
+    if (count > MAX_STORAGE_VECTOR_LENGTH - usedVectorLength)
+        return false;
+    unsigned requiredVectorLength = usedVectorLength + count;
+    ASSERT(requiredVectorLength <= MAX_STORAGE_VECTOR_LENGTH);
+    // The sum of m_vectorLength and m_indexBias will never exceed MAX_STORAGE_VECTOR_LENGTH.
+    ASSERT(storage->vectorLength() <= MAX_STORAGE_VECTOR_LENGTH && (MAX_STORAGE_VECTOR_LENGTH - storage->vectorLength()) >= storage->m_indexBias);
+    unsigned currentCapacity = storage->vectorLength() + storage->m_indexBias;
+    // The calculation of desiredCapacity won't overflow, due to the range of MAX_STORAGE_VECTOR_LENGTH.
+    // FIXME: This code should be fixed to avoid internal fragmentation. It's not super high
+    // priority since increaseVectorLength() will "fix" any mistakes we make, but it would be cool
+    // to get this right eventually.
+    unsigned desiredCapacity = min(MAX_STORAGE_VECTOR_LENGTH, max(BASE_ARRAY_STORAGE_VECTOR_LEN, requiredVectorLength) << 1);
+
+    // Step 2:
+    // We're either going to choose to allocate a new ArrayStorage, or we're going to reuse the existing one.
+
+    void* newAllocBase = 0;
+    unsigned newStorageCapacity;
+    bool allocatedNewStorage;
+    // If the current storage array is sufficiently large (but not too large!) then just keep using it.
+    if (currentCapacity > desiredCapacity && isDenseEnoughForVector(currentCapacity, requiredVectorLength)) {
+        newAllocBase = butterfly->base(structure);
+        newStorageCapacity = currentCapacity;
+        allocatedNewStorage = false;
+    } else {
+        size_t newSize = Butterfly::totalSize(0, propertyCapacity, true, ArrayStorage::sizeFor(desiredCapacity));
+        newAllocBase = vm.auxiliarySpace.tryAllocate(newSize);
+        if (!newAllocBase)
+            return false;
+        newStorageCapacity = desiredCapacity;
+        allocatedNewStorage = true;
+    }
+
+    // Step 3:
+    // Work out where we're going to move things to.
+
+    // Determine how much of the vector to use as pre-capacity, and how much as post-capacity.
+    // If we're adding to the end, we'll add all the new space to the end.
+    // If the vector had no free post-capacity (length >= m_vectorLength), don't give it any.
+    // If it did, we calculate the amount that will remain based on an atomic decay - leave the
+    // vector with half the post-capacity it had previously.
+    unsigned postCapacity = 0;
+    if (!addToFront)
+        postCapacity = max(newStorageCapacity - requiredVectorLength, count);
+    else if (length < storage->vectorLength()) {
+        // Atomic decay, + the post-capacity cannot be greater than what is available.
+        postCapacity = min((storage->vectorLength() - length) >> 1, newStorageCapacity - requiredVectorLength);
+        // If we're moving contents within the same allocation, the post-capacity is being reduced.
+        ASSERT(newAllocBase != butterfly->base(structure) || postCapacity < storage->vectorLength() - length);
+    }
+
+    unsigned newVectorLength = requiredVectorLength + postCapacity;
+    unsigned newIndexBias = newStorageCapacity - newVectorLength;
+
+    Butterfly* newButterfly = Butterfly::fromBase(newAllocBase, newIndexBias, propertyCapacity);
+
+    if (addToFront) {
+        ASSERT(count + usedVectorLength <= newVectorLength);
+        memmove(newButterfly->arrayStorage()->m_vector + count, storage->m_vector, sizeof(JSValue) * usedVectorLength);
+        memmove(newButterfly->propertyStorage() - propertySize, butterfly->propertyStorage() - propertySize, sizeof(JSValue) * propertySize + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
+        
+        if (allocatedNewStorage) {
+            // We will set the vectorLength to newVectorLength. We populated requiredVectorLength
+            // (usedVectorLength + count), which is less. Clear the difference.
+            for (unsigned i = requiredVectorLength; i < newVectorLength; ++i)
+                newButterfly->arrayStorage()->m_vector[i].clear();
+        }
+    } else if ((newAllocBase != butterfly->base(structure)) || (newIndexBias != storage->m_indexBias)) {
+        memmove(newButterfly->propertyStorage() - propertySize, butterfly->propertyStorage() - propertySize, sizeof(JSValue) * propertySize + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
+        memmove(newButterfly->arrayStorage()->m_vector, storage->m_vector, sizeof(JSValue) * usedVectorLength);
+        
+        for (unsigned i = requiredVectorLength; i < newVectorLength; i++)
+            newButterfly->arrayStorage()->m_vector[i].clear();
+    }
+
+    newButterfly->arrayStorage()->setVectorLength(newVectorLength);
+    newButterfly->arrayStorage()->m_indexBias = newIndexBias;
+    
+    setButterfly(vm, newButterfly);
+
+    return true;
+}
+
+bool JSArray::setLengthWithArrayStorage(ExecState* exec, unsigned newLength, bool throwException, ArrayStorage* storage)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    unsigned length = storage->length();
+    
+    // If the length is read only then we enter sparse mode, so should enter the following 'if'.
+    ASSERT(isLengthWritable() || storage->m_sparseMap);
+
+    if (SparseArrayValueMap* map = storage->m_sparseMap.get()) {
+        // Fail if the length is not writable.
+        if (map->lengthIsReadOnly())
+            return typeError(exec, scope, throwException, ASCIILiteral(ReadonlyPropertyWriteError));
+
+        if (newLength < length) {
+            // Copy any keys we might be interested in into a vector.
+            Vector<unsigned, 0, UnsafeVectorOverflow> keys;
+            keys.reserveInitialCapacity(min(map->size(), static_cast<size_t>(length - newLength)));
+            SparseArrayValueMap::const_iterator end = map->end();
+            for (SparseArrayValueMap::const_iterator it = map->begin(); it != end; ++it) {
+                unsigned index = static_cast<unsigned>(it->key);
+                if (index < length && index >= newLength)
+                    keys.append(index);
+            }
+
+            // Check if the array is in sparse mode. If so there may be non-configurable
+            // properties, so we have to perform deletion with caution, if not we can
+            // delete values in any order.
+            if (map->sparseMode()) {
+                qsort(keys.begin(), keys.size(), sizeof(unsigned), compareKeysForQSort);
+                unsigned i = keys.size();
+                while (i) {
+                    unsigned index = keys[--i];
+                    SparseArrayValueMap::iterator it = map->find(index);
+                    ASSERT(it != map->notFound());
+                    if (it->value.attributes & DontDelete) {
+                        storage->setLength(index + 1);
+                        return typeError(exec, scope, throwException, ASCIILiteral(UnableToDeletePropertyError));
+                    }
+                    map->remove(it);
+                }
+            } else {
+                for (unsigned i = 0; i < keys.size(); ++i)
+                    map->remove(keys[i]);
+                if (map->isEmpty())
+                    deallocateSparseIndexMap();
+            }
+        }
+    }
+
+    if (newLength < length) {
+        // Delete properties from the vector.
+        unsigned usedVectorLength = min(length, storage->vectorLength());
+        for (unsigned i = newLength; i < usedVectorLength; ++i) {
+            WriteBarrier<Unknown>& valueSlot = storage->m_vector[i];
+            bool hadValue = !!valueSlot;
+            valueSlot.clear();
+            storage->m_numValuesInVector -= hadValue;
+        }
+    }
+
+    storage->setLength(newLength);
+
+    return true;
+}
+
+bool JSArray::appendMemcpy(ExecState* exec, VM& vm, unsigned startIndex, JSC::JSArray* otherArray)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!canFastCopy(vm, otherArray))
+        return false;
+
+    IndexingType type = indexingType();
+    IndexingType copyType = mergeIndexingTypeForCopying(otherArray->indexingType());
+    if (type == ArrayWithUndecided && copyType != NonArray) {
+        if (copyType == ArrayWithInt32)
+            convertUndecidedToInt32(vm);
+        else if (copyType == ArrayWithDouble)
+            convertUndecidedToDouble(vm);
+        else if (copyType == ArrayWithContiguous)
+            convertUndecidedToContiguous(vm);
+        else {
+            ASSERT(copyType == ArrayWithUndecided);
+            return true;
+        }
+    } else if (type != copyType)
+        return false;
+
+    unsigned otherLength = otherArray->length();
+    Checked<unsigned, RecordOverflow> checkedNewLength = startIndex;
+    checkedNewLength += otherLength;
+
+    unsigned newLength;
+    if (checkedNewLength.safeGet(newLength) == CheckedState::DidOverflow) {
+        throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
+        return false;
+    }
+
+    if (newLength >= MIN_SPARSE_ARRAY_INDEX)
+        return false;
+
+    if (!ensureLength(vm, newLength)) {
+        throwOutOfMemoryError(exec, scope);
+        return false;
+    }
+    ASSERT(copyType == indexingType());
+
+    if (type == ArrayWithDouble)
+        memcpy(butterfly()->contiguousDouble().data() + startIndex, otherArray->butterfly()->contiguousDouble().data(), sizeof(JSValue) * otherLength);
+    else
+        memcpy(butterfly()->contiguous().data() + startIndex, otherArray->butterfly()->contiguous().data(), sizeof(JSValue) * otherLength);
+
+    return true;
+}
+
+bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Butterfly* butterfly = m_butterfly.get();
+    switch (indexingType()) {
+    case ArrayClass:
+        if (!newLength)
+            return true;
+        if (newLength >= MIN_SPARSE_ARRAY_INDEX) {
+            scope.release();
+            return setLengthWithArrayStorage(
+                exec, newLength, throwException,
+                ensureArrayStorage(vm));
+        }
+        createInitialUndecided(vm, newLength);
+        return true;
+        
+    case ArrayWithUndecided:
+    case ArrayWithInt32:
+    case ArrayWithDouble:
+    case ArrayWithContiguous: {
+        if (newLength == butterfly->publicLength())
+            return true;
+        if (newLength >= MAX_ARRAY_INDEX // This case ensures that we can do fast push.
+            || (newLength >= MIN_SPARSE_ARRAY_INDEX
+                && !isDenseEnoughForVector(newLength, countElements()))) {
+            scope.release();
+            return setLengthWithArrayStorage(
+                exec, newLength, throwException,
+                ensureArrayStorage(vm));
+        }
+        if (newLength > butterfly->publicLength()) {
+            if (!ensureLength(vm, newLength)) {
+                throwOutOfMemoryError(exec, scope);
+                return false;
+            }
+            return true;
+        }
+
+        unsigned lengthToClear = butterfly->publicLength() - newLength;
+        unsigned costToAllocateNewButterfly = 64; // a heuristic.
+        if (lengthToClear > newLength && lengthToClear > costToAllocateNewButterfly) {
+            reallocateAndShrinkButterfly(vm, newLength);
+            return true;
+        }
+
+        if (indexingType() == ArrayWithDouble) {
+            for (unsigned i = butterfly->publicLength(); i-- > newLength;)
+                butterfly->contiguousDouble()[i] = PNaN;
+        } else {
+            for (unsigned i = butterfly->publicLength(); i-- > newLength;)
+                butterfly->contiguous()[i].clear();
+        }
+        butterfly->setPublicLength(newLength);
+        return true;
+    }
+        
+    case ArrayWithArrayStorage:
+    case ArrayWithSlowPutArrayStorage:
+        scope.release();
+        return setLengthWithArrayStorage(exec, newLength, throwException, arrayStorage());
+        
+    default:
+        CRASH();
+        return false;
+    }
+}
+
+JSValue JSArray::pop(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Butterfly* butterfly = m_butterfly.get();
+    
+    switch (indexingType()) {
+    case ArrayClass:
+        return jsUndefined();
+        
+    case ArrayWithUndecided:
+        if (!butterfly->publicLength())
+            return jsUndefined();
+        // We have nothing but holes. So, drop down to the slow version.
+        break;
+        
+    case ArrayWithInt32:
+    case ArrayWithContiguous: {
+        unsigned length = butterfly->publicLength();
+        
+        if (!length--)
+            return jsUndefined();
+        
+        RELEASE_ASSERT(length < butterfly->vectorLength());
+        JSValue value = butterfly->contiguous()[length].get();
+        if (value) {
+            butterfly->contiguous()[length].clear();
+            butterfly->setPublicLength(length);
+            return value;
+        }
+        break;
+    }
+        
+    case ArrayWithDouble: {
+        unsigned length = butterfly->publicLength();
+        
+        if (!length--)
+            return jsUndefined();
+        
+        RELEASE_ASSERT(length < butterfly->vectorLength());
+        double value = butterfly->contiguousDouble()[length];
+        if (value == value) {
+            butterfly->contiguousDouble()[length] = PNaN;
+            butterfly->setPublicLength(length);
+            return JSValue(JSValue::EncodeAsDouble, value);
+        }
+        break;
+    }
+        
+    case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES: {
+        ArrayStorage* storage = butterfly->arrayStorage();
+    
+        unsigned length = storage->length();
+        if (!length) {
+            if (!isLengthWritable())
+                throwTypeError(exec, scope, ASCIILiteral(ReadonlyPropertyWriteError));
+            return jsUndefined();
+        }
+
+        unsigned index = length - 1;
+        if (index < storage->vectorLength()) {
+            WriteBarrier<Unknown>& valueSlot = storage->m_vector[index];
+            if (valueSlot) {
+                --storage->m_numValuesInVector;
+                JSValue element = valueSlot.get();
+                valueSlot.clear();
+            
+                RELEASE_ASSERT(isLengthWritable());
+                storage->setLength(index);
+                return element;
+            }
+        }
+        break;
+    }
+        
+    default:
+        CRASH();
+        return JSValue();
+    }
+    
+    unsigned index = getArrayLength() - 1;
+    // Let element be the result of calling the [[Get]] internal method of O with argument indx.
+    JSValue element = get(exec, index);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    // Call the [[Delete]] internal method of O with arguments indx and true.
+    bool success = deletePropertyByIndex(this, exec, index);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+    if (!success) {
+        throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
+        return jsUndefined();
+    }
+    // Call the [[Put]] internal method of O with arguments "length", indx, and true.
+    scope.release();
+    setLength(exec, index, true);
+    // Return element.
+    return element;
+}
+
+// Push & putIndex are almost identical, with two small differences.
+//  - we always are writing beyond the current array bounds, so it is always necessary to update m_length & m_numValuesInVector.
+//  - pushing to an array of length 2^32-1 stores the property, but throws a range error.
+void JSArray::push(ExecState* exec, JSValue value)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Butterfly* butterfly = m_butterfly.get();
+    
+    switch (indexingType()) {
+    case ArrayClass: {
+        createInitialUndecided(vm, 0);
+        FALLTHROUGH;
+    }
+        
+    case ArrayWithUndecided: {
+        convertUndecidedForValue(vm, value);
+        scope.release();
+        push(exec, value);
+        return;
+    }
+        
+    case ArrayWithInt32: {
+        if (!value.isInt32()) {
+            convertInt32ForValue(vm, value);
+            scope.release();
+            push(exec, value);
+            return;
+        }
+
+        unsigned length = butterfly->publicLength();
+        ASSERT(length <= butterfly->vectorLength());
+        if (length < butterfly->vectorLength()) {
+            butterfly->contiguousInt32()[length].setWithoutWriteBarrier(value);
+            butterfly->setPublicLength(length + 1);
+            return;
+        }
+        
+        if (UNLIKELY(length > MAX_ARRAY_INDEX)) {
+            methodTable(vm)->putByIndex(this, exec, length, value, true);
+            if (!scope.exception())
+                throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
+            return;
+        }
+
+        scope.release();
+        putByIndexBeyondVectorLengthWithoutAttributes<Int32Shape>(exec, length, value);
+        return;
+    }
+
+    case ArrayWithContiguous: {
+        unsigned length = butterfly->publicLength();
+        ASSERT(length <= butterfly->vectorLength());
+        if (length < butterfly->vectorLength()) {
+            butterfly->contiguous()[length].set(vm, this, value);
+            butterfly->setPublicLength(length + 1);
+            return;
+        }
+        
+        if (UNLIKELY(length > MAX_ARRAY_INDEX)) {
+            methodTable(vm)->putByIndex(this, exec, length, value, true);
+            if (!scope.exception())
+                throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
+            return;
+        }
+
+        scope.release();
+        putByIndexBeyondVectorLengthWithoutAttributes<ContiguousShape>(exec, length, value);
+        return;
+    }
+        
+    case ArrayWithDouble: {
+        if (!value.isNumber()) {
+            convertDoubleToContiguous(vm);
+            scope.release();
+            push(exec, value);
+            return;
+        }
+        double valueAsDouble = value.asNumber();
+        if (valueAsDouble != valueAsDouble) {
+            convertDoubleToContiguous(vm);
+            scope.release();
+            push(exec, value);
+            return;
+        }
+
+        unsigned length = butterfly->publicLength();
+        ASSERT(length <= butterfly->vectorLength());
+        if (length < butterfly->vectorLength()) {
+            butterfly->contiguousDouble()[length] = valueAsDouble;
+            butterfly->setPublicLength(length + 1);
+            return;
+        }
+        
+        if (UNLIKELY(length > MAX_ARRAY_INDEX)) {
+            methodTable(vm)->putByIndex(this, exec, length, value, true);
+            if (!scope.exception())
+                throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
+            return;
+        }
+
+        scope.release();
+        putByIndexBeyondVectorLengthWithoutAttributes<DoubleShape>(exec, length, value);
+        return;
+    }
+        
+    case ArrayWithSlowPutArrayStorage: {
+        unsigned oldLength = length();
+        bool putResult = false;
+        if (attemptToInterceptPutByIndexOnHole(exec, oldLength, value, true, putResult)) {
+            if (!scope.exception() && oldLength < 0xFFFFFFFFu) {
+                scope.release();
+                setLength(exec, oldLength + 1, true);
+            }
+            return;
+        }
+        FALLTHROUGH;
+    }
+        
+    case ArrayWithArrayStorage: {
+        ArrayStorage* storage = butterfly->arrayStorage();
+
+        // Fast case - push within vector, always update m_length & m_numValuesInVector.
+        unsigned length = storage->length();
+        if (length < storage->vectorLength()) {
+            storage->m_vector[length].set(vm, this, value);
+            storage->setLength(length + 1);
+            ++storage->m_numValuesInVector;
+            return;
+        }
+
+        // Pushing to an array of invalid length (2^31-1) stores the property, but throws a range error.
+        if (UNLIKELY(storage->length() > MAX_ARRAY_INDEX)) {
+            methodTable(vm)->putByIndex(this, exec, storage->length(), value, true);
+            // Per ES5.1 15.4.4.7 step 6 & 15.4.5.1 step 3.d.
+            if (!scope.exception())
+                throwException(exec, scope, createRangeError(exec, ASCIILiteral(LengthExceededTheMaximumArrayLengthError)));
+            return;
+        }
+
+        // Handled the same as putIndex.
+        scope.release();
+        putByIndexBeyondVectorLengthWithArrayStorage(exec, storage->length(), value, true, storage);
+        return;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+
+JSArray* JSArray::fastSlice(ExecState& exec, unsigned startIndex, unsigned count)
+{
+    auto arrayType = indexingType();
+    switch (arrayType) {
+    case ArrayWithDouble:
+    case ArrayWithInt32:
+    case ArrayWithContiguous: {
+        VM& vm = exec.vm();
+        if (count >= MIN_SPARSE_ARRAY_INDEX || structure(vm)->holesMustForwardToPrototype(vm))
+            return nullptr;
+
+        Structure* resultStructure = exec.lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(arrayType);
+        JSArray* resultArray = JSArray::tryCreateUninitialized(vm, resultStructure, count);
+        if (!resultArray)
+            return nullptr;
+
+        auto& resultButterfly = *resultArray->butterfly();
+        if (arrayType == ArrayWithDouble)
+            memcpy(resultButterfly.contiguousDouble().data(), m_butterfly.get()->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
+        else
+            memcpy(resultButterfly.contiguous().data(), m_butterfly.get()->contiguous().data() + startIndex, sizeof(JSValue) * count);
+        resultButterfly.setPublicLength(count);
+
+        return resultArray;
+    }
+    default:
+        return nullptr;
+    }
+}
+
+bool JSArray::shiftCountWithArrayStorage(VM& vm, unsigned startIndex, unsigned count, ArrayStorage* storage)
+{
+    unsigned oldLength = storage->length();
+    RELEASE_ASSERT(count <= oldLength);
+    
+    // If the array contains holes or is otherwise in an abnormal state,
+    // use the generic algorithm in ArrayPrototype.
+    if ((storage->hasHoles() && this->structure(vm)->holesMustForwardToPrototype(vm)) 
+        || hasSparseMap() 
+        || shouldUseSlowPut(indexingType())) {
+        return false;
+    }
+
+    if (!oldLength)
+        return true;
+    
+    unsigned length = oldLength - count;
+    
+    storage->m_numValuesInVector -= count;
+    storage->setLength(length);
+    
+    unsigned vectorLength = storage->vectorLength();
+    if (!vectorLength)
+        return true;
+    
+    if (startIndex >= vectorLength)
+        return true;
+    
+    DisallowGC disallowGC;
+    auto locker = holdLock(*this);
+    
+    if (startIndex + count > vectorLength)
+        count = vectorLength - startIndex;
+    
+    unsigned usedVectorLength = min(vectorLength, oldLength);
+    
+    unsigned numElementsBeforeShiftRegion = startIndex;
+    unsigned firstIndexAfterShiftRegion = startIndex + count;
+    unsigned numElementsAfterShiftRegion = usedVectorLength - firstIndexAfterShiftRegion;
+    ASSERT(numElementsBeforeShiftRegion + count + numElementsAfterShiftRegion == usedVectorLength);
+
+    // The point of this comparison seems to be to minimize the amount of elements that have to 
+    // be moved during a shift operation.
+    if (numElementsBeforeShiftRegion < numElementsAfterShiftRegion) {
+        // The number of elements before the shift region is less than the number of elements
+        // after the shift region, so we move the elements before to the right.
+        if (numElementsBeforeShiftRegion) {
+            RELEASE_ASSERT(count + startIndex <= vectorLength);
+            if (storage->hasHoles()) {
+                for (unsigned i = startIndex; i-- > 0;) {
+                    unsigned destinationIndex = count + i;
+                    JSValue source = storage->m_vector[i].get();
+                    JSValue dest = storage->m_vector[destinationIndex].get();
+                    // Any time we overwrite a hole we know we overcounted the number of values we removed 
+                    // when we subtracted count from m_numValuesInVector above.
+                    if (!dest && destinationIndex >= firstIndexAfterShiftRegion)
+                        storage->m_numValuesInVector++;
+                    storage->m_vector[count + i].setWithoutWriteBarrier(source);
+                }
+            } else {
+                memmove(storage->m_vector + count,
+                    storage->m_vector,
+                    sizeof(JSValue) * startIndex);
+            }
+        }
+        // Adjust the Butterfly and the index bias. We only need to do this here because we're changing
+        // the start of the Butterfly, which needs to point at the first indexed property in the used
+        // portion of the vector.
+        Butterfly* butterfly = m_butterfly.get()->shift(structure(), count);
+        setButterfly(vm, butterfly);
+        storage = butterfly->arrayStorage();
+        storage->m_indexBias += count;
+
+        // Since we're consuming part of the vector by moving its beginning to the left,
+        // we need to modify the vector length appropriately.
+        storage->setVectorLength(vectorLength - count);
+    } else {
+        // The number of elements before the shift region is greater than or equal to the number 
+        // of elements after the shift region, so we move the elements after the shift region to the left.
+        if (storage->hasHoles()) {
+            for (unsigned i = 0; i < numElementsAfterShiftRegion; ++i) {
+                unsigned destinationIndex = startIndex + i;
+                JSValue source = storage->m_vector[firstIndexAfterShiftRegion + i].get();
+                JSValue dest = storage->m_vector[destinationIndex].get();
+                // Any time we overwrite a hole we know we overcounted the number of values we removed 
+                // when we subtracted count from m_numValuesInVector above.
+                if (!dest && destinationIndex < firstIndexAfterShiftRegion)
+                    storage->m_numValuesInVector++;
+                storage->m_vector[startIndex + i].setWithoutWriteBarrier(source);
+            }
+        } else {
+            memmove(storage->m_vector + startIndex,
+                storage->m_vector + firstIndexAfterShiftRegion,
+                sizeof(JSValue) * numElementsAfterShiftRegion);
+        }
+        // Clear the slots of the elements we just moved.
+        unsigned startOfEmptyVectorTail = usedVectorLength - count;
+        for (unsigned i = startOfEmptyVectorTail; i < usedVectorLength; ++i)
+            storage->m_vector[i].clear();
+        // We don't modify the index bias or the Butterfly pointer in this case because we're not changing 
+        // the start of the Butterfly, which needs to point at the first indexed property in the used 
+        // portion of the vector. We also don't modify the vector length because we're not actually changing
+        // its length; we're just using less of it.
+    }
+    
+    return true;
+}
+
+bool JSArray::shiftCountWithAnyIndexingType(ExecState* exec, unsigned& startIndex, unsigned count)
+{
+    VM& vm = exec->vm();
+    RELEASE_ASSERT(count > 0);
+
+    Butterfly* butterfly = m_butterfly.get();
+    
+    switch (indexingType()) {
+    case ArrayClass:
+        return true;
+        
+    case ArrayWithUndecided:
+        // Don't handle this because it's confusing and it shouldn't come up.
+        return false;
+        
+    case ArrayWithInt32:
+    case ArrayWithContiguous: {
+        unsigned oldLength = butterfly->publicLength();
+        RELEASE_ASSERT(count <= oldLength);
+        
+        // We may have to walk the entire array to do the shift. We're willing to do
+        // so only if it's not horribly slow.
+        if (oldLength - (startIndex + count) >= MIN_SPARSE_ARRAY_INDEX)
+            return shiftCountWithArrayStorage(vm, startIndex, count, ensureArrayStorage(vm));
+
+        // Storing to a hole is fine since we're still having a good time. But reading from a hole 
+        // is totally not fine, since we might have to read from the proto chain.
+        // We have to check for holes before we start moving things around so that we don't get halfway 
+        // through shifting and then realize we should have been in ArrayStorage mode.
+        unsigned end = oldLength - count;
+        if (this->structure(vm)->holesMustForwardToPrototype(vm)) {
+            for (unsigned i = startIndex; i < end; ++i) {
+                JSValue v = butterfly->contiguous()[i + count].get();
+                if (UNLIKELY(!v)) {
+                    startIndex = i;
+                    return shiftCountWithArrayStorage(vm, startIndex, count, ensureArrayStorage(vm));
+                }
+                butterfly->contiguous()[i].setWithoutWriteBarrier(v);
+            }
+        } else {
+            memmove(butterfly->contiguous().data() + startIndex, 
+                butterfly->contiguous().data() + startIndex + count, 
+                sizeof(JSValue) * (end - startIndex));
+        }
+
+        for (unsigned i = end; i < oldLength; ++i)
+            butterfly->contiguous()[i].clear();
+        
+        butterfly->setPublicLength(oldLength - count);
+
+        // Our memmoving of values around in the array could have concealed some of them from
+        // the collector. Let's make sure that the collector scans this object again.
+        vm.heap.writeBarrier(this);
+        
+        return true;
+    }
+        
+    case ArrayWithDouble: {
+        unsigned oldLength = butterfly->publicLength();
+        RELEASE_ASSERT(count <= oldLength);
+        
+        // We may have to walk the entire array to do the shift. We're willing to do
+        // so only if it's not horribly slow.
+        if (oldLength - (startIndex + count) >= MIN_SPARSE_ARRAY_INDEX)
+            return shiftCountWithArrayStorage(vm, startIndex, count, ensureArrayStorage(vm));
+
+        // Storing to a hole is fine since we're still having a good time. But reading from a hole 
+        // is totally not fine, since we might have to read from the proto chain.
+        // We have to check for holes before we start moving things around so that we don't get halfway 
+        // through shifting and then realize we should have been in ArrayStorage mode.
+        unsigned end = oldLength - count;
+        if (this->structure(vm)->holesMustForwardToPrototype(vm)) {
+            for (unsigned i = startIndex; i < end; ++i) {
+                double v = butterfly->contiguousDouble()[i + count];
+                if (UNLIKELY(v != v)) {
+                    startIndex = i;
+                    return shiftCountWithArrayStorage(vm, startIndex, count, ensureArrayStorage(vm));
+                }
+                butterfly->contiguousDouble()[i] = v;
+            }
+        } else {
+            memmove(butterfly->contiguousDouble().data() + startIndex,
+                butterfly->contiguousDouble().data() + startIndex + count,
+                sizeof(JSValue) * (end - startIndex));
+        }
+        for (unsigned i = end; i < oldLength; ++i)
+            butterfly->contiguousDouble()[i] = PNaN;
+        
+        butterfly->setPublicLength(oldLength - count);
+        return true;
+    }
+        
+    case ArrayWithArrayStorage:
+    case ArrayWithSlowPutArrayStorage:
+        return shiftCountWithArrayStorage(vm, startIndex, count, arrayStorage());
+        
+    default:
+        CRASH();
+        return false;
+    }
+}
+
+// Returns true if the unshift can be handled, false to fallback.    
+bool JSArray::unshiftCountWithArrayStorage(ExecState* exec, unsigned startIndex, unsigned count, ArrayStorage* storage)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    unsigned length = storage->length();
+
+    RELEASE_ASSERT(startIndex <= length);
+
+    // If the array contains holes or is otherwise in an abnormal state,
+    // use the generic algorithm in ArrayPrototype.
+    if (storage->hasHoles() || storage->inSparseMode() || shouldUseSlowPut(indexingType()))
+        return false;
+
+    bool moveFront = !startIndex || startIndex < length / 2;
+
+    unsigned vectorLength = storage->vectorLength();
+
+    // Need to have GC deferred around the unshiftCountSlowCase(), since that leaves the butterfly in
+    // a weird state: some parts of it will be left uninitialized, which we will fill in here.
+    DeferGC deferGC(vm.heap);
+    auto locker = holdLock(*this);
+    
+    if (moveFront && storage->m_indexBias >= count) {
+        Butterfly* newButterfly = storage->butterfly()->unshift(structure(), count);
+        storage = newButterfly->arrayStorage();
+        storage->m_indexBias -= count;
+        storage->setVectorLength(vectorLength + count);
+        setButterfly(vm, newButterfly);
+    } else if (!moveFront && vectorLength - length >= count)
+        storage = storage->butterfly()->arrayStorage();
+    else if (unshiftCountSlowCase(locker, vm, deferGC, moveFront, count))
+        storage = arrayStorage();
+    else {
+        throwOutOfMemoryError(exec, scope);
+        return true;
+    }
+
+    WriteBarrier<Unknown>* vector = storage->m_vector;
+
+    if (startIndex) {
+        if (moveFront)
+            memmove(vector, vector + count, startIndex * sizeof(JSValue));
+        else if (length - startIndex)
+            memmove(vector + startIndex + count, vector + startIndex, (length - startIndex) * sizeof(JSValue));
+    }
+
+    for (unsigned i = 0; i < count; i++)
+        vector[i + startIndex].clear();
+    
+    return true;
+}
+
+bool JSArray::unshiftCountWithAnyIndexingType(ExecState* exec, unsigned startIndex, unsigned count)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Butterfly* butterfly = m_butterfly.get();
+    
+    switch (indexingType()) {
+    case ArrayClass:
+    case ArrayWithUndecided:
+        // We could handle this. But it shouldn't ever come up, so we won't.
+        return false;
+
+    case ArrayWithInt32:
+    case ArrayWithContiguous: {
+        unsigned oldLength = butterfly->publicLength();
+        
+        // We may have to walk the entire array to do the unshift. We're willing to do so
+        // only if it's not horribly slow.
+        if (oldLength - startIndex >= MIN_SPARSE_ARRAY_INDEX) {
+            scope.release();
+            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
+        }
+        
+        if (!ensureLength(vm, oldLength + count)) {
+            throwOutOfMemoryError(exec, scope);
+            return false;
+        }
+        butterfly = m_butterfly.get();
+
+        // We have to check for holes before we start moving things around so that we don't get halfway 
+        // through shifting and then realize we should have been in ArrayStorage mode.
+        for (unsigned i = oldLength; i-- > startIndex;) {
+            JSValue v = butterfly->contiguous()[i].get();
+            if (UNLIKELY(!v)) {
+                scope.release();
+                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
+            }
+        }
+
+        for (unsigned i = oldLength; i-- > startIndex;) {
+            JSValue v = butterfly->contiguous()[i].get();
+            ASSERT(v);
+            butterfly->contiguous()[i + count].setWithoutWriteBarrier(v);
+        }
+        
+        // Our memmoving of values around in the array could have concealed some of them from
+        // the collector. Let's make sure that the collector scans this object again.
+        vm.heap.writeBarrier(this);
+        
+        // NOTE: we're leaving being garbage in the part of the array that we shifted out
+        // of. This is fine because the caller is required to store over that area, and
+        // in contiguous mode storing into a hole is guaranteed to behave exactly the same
+        // as storing over an existing element.
+        
+        return true;
+    }
+        
+    case ArrayWithDouble: {
+        unsigned oldLength = butterfly->publicLength();
+        
+        // We may have to walk the entire array to do the unshift. We're willing to do so
+        // only if it's not horribly slow.
+        if (oldLength - startIndex >= MIN_SPARSE_ARRAY_INDEX) {
+            scope.release();
+            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
+        }
+        
+        if (!ensureLength(vm, oldLength + count)) {
+            throwOutOfMemoryError(exec, scope);
+            return false;
+        }
+        butterfly = m_butterfly.get();
+        
+        // We have to check for holes before we start moving things around so that we don't get halfway 
+        // through shifting and then realize we should have been in ArrayStorage mode.
+        for (unsigned i = oldLength; i-- > startIndex;) {
+            double v = butterfly->contiguousDouble()[i];
+            if (UNLIKELY(v != v)) {
+                scope.release();
+                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
+            }
+        }
+
+        for (unsigned i = oldLength; i-- > startIndex;) {
+            double v = butterfly->contiguousDouble()[i];
+            ASSERT(v == v);
+            butterfly->contiguousDouble()[i + count] = v;
+        }
+        
+        // NOTE: we're leaving being garbage in the part of the array that we shifted out
+        // of. This is fine because the caller is required to store over that area, and
+        // in contiguous mode storing into a hole is guaranteed to behave exactly the same
+        // as storing over an existing element.
+        
+        return true;
+    }
+        
+    case ArrayWithArrayStorage:
+    case ArrayWithSlowPutArrayStorage:
+        scope.release();
+        return unshiftCountWithArrayStorage(exec, startIndex, count, arrayStorage());
+        
+    default:
+        CRASH();
+        return false;
+    }
+}
+
+void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
+{
+    unsigned i = 0;
+    unsigned vectorEnd;
+    WriteBarrier<Unknown>* vector;
+
+    Butterfly* butterfly = m_butterfly.get();
+    
+    switch (indexingType()) {
+    case ArrayClass:
+        return;
+        
+    case ArrayWithUndecided: {
+        vector = 0;
+        vectorEnd = 0;
+        break;
+    }
+        
+    case ArrayWithInt32:
+    case ArrayWithContiguous: {
+        vectorEnd = butterfly->publicLength();
+        vector = butterfly->contiguous().data();
+        break;
+    }
+        
+    case ArrayWithDouble: {
+        vector = 0;
+        vectorEnd = 0;
+        for (; i < butterfly->publicLength(); ++i) {
+            double v = butterfly->contiguousDouble()[i];
+            if (v != v)
+                break;
+            args.append(JSValue(JSValue::EncodeAsDouble, v));
+        }
+        break;
+    }
+    
+    case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES: {
+        ArrayStorage* storage = butterfly->arrayStorage();
+        
+        vector = storage->m_vector;
+        vectorEnd = min(storage->length(), storage->vectorLength());
+        break;
+    }
+        
+    default:
+        CRASH();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+        vector = 0;
+        vectorEnd = 0;
+        break;
+#endif
+    }
+    
+    for (; i < vectorEnd; ++i) {
+        WriteBarrier<Unknown>& v = vector[i];
+        if (!v)
+            break;
+        args.append(v.get());
+    }
+
+    // FIXME: What prevents this from being called with a RuntimeArray? The length function will always return 0 in that case.
+    for (; i < length(); ++i)
+        args.append(get(exec, i));
+}
+
+void JSArray::copyToArguments(ExecState* exec, VirtualRegister firstElementDest, unsigned offset, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    unsigned i = offset;
+    WriteBarrier<Unknown>* vector;
+    unsigned vectorEnd;
+    length += offset; // We like to think of the length as being our length, rather than the output length.
+
+    // FIXME: What prevents this from being called with a RuntimeArray? The length function will always return 0 in that case.
+    ASSERT(length == this->length());
+
+    Butterfly* butterfly = m_butterfly.get();
+    switch (indexingType()) {
+    case ArrayClass:
+        return;
+        
+    case ArrayWithUndecided: {
+        vector = 0;
+        vectorEnd = 0;
+        break;
+    }
+        
+    case ArrayWithInt32:
+    case ArrayWithContiguous: {
+        vector = butterfly->contiguous().data();
+        vectorEnd = butterfly->publicLength();
+        break;
+    }
+        
+    case ArrayWithDouble: {
+        vector = 0;
+        vectorEnd = 0;
+        for (; i < butterfly->publicLength(); ++i) {
+            ASSERT(i < butterfly->vectorLength());
+            double v = butterfly->contiguousDouble()[i];
+            if (v != v)
+                break;
+            exec->r(firstElementDest + i - offset) = JSValue(JSValue::EncodeAsDouble, v);
+        }
+        break;
+    }
+        
+    case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES: {
+        ArrayStorage* storage = butterfly->arrayStorage();
+        vector = storage->m_vector;
+        vectorEnd = min(length, storage->vectorLength());
+        break;
+    }
+        
+    default:
+        CRASH();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+        vector = 0;
+        vectorEnd = 0;
+        break;
+#endif
+    }
+    
+    for (; i < vectorEnd; ++i) {
+        WriteBarrier<Unknown>& v = vector[i];
+        if (!v)
+            break;
+        exec->r(firstElementDest + i - offset) = v.get();
+    }
+    
+    for (; i < length; ++i) {
+        exec->r(firstElementDest + i - offset) = get(exec, i);
+        RETURN_IF_EXCEPTION(scope, void());
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/JSArray.h b/runtime/JSArray.h
new file mode 100644
index 0000000..3e1f2b5
--- /dev/null
+++ b/runtime/JSArray.h
@@ -0,0 +1,340 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "ArrayConventions.h"
+#include "ButterflyInlines.h"
+#include "JSCellInlines.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSArray;
+class LLIntOffsetsExtractor;
+
+class JSArray : public JSNonFinalObject {
+    friend class LLIntOffsetsExtractor;
+    friend class Walker;
+    friend class JIT;
+
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
+
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
+        return sizeof(JSArray);
+    }
+        
+protected:
+    explicit JSArray(VM& vm, Structure* structure, Butterfly* butterfly)
+        : JSNonFinalObject(vm, structure, butterfly)
+    {
+    }
+
+public:
+    static JSArray* tryCreate(VM&, Structure*, unsigned initialLength = 0);
+    static JSArray* create(VM&, Structure*, unsigned initialLength = 0);
+    static JSArray* createWithButterfly(VM&, GCDeferralContext*, Structure*, Butterfly*);
+
+    // tryCreateUninitialized is used for fast construction of arrays whose size and
+    // contents are known at time of creation. This should be considered a private API.
+    // Clients of this interface must:
+    //   - null-check the result (indicating out of memory, or otherwise unable to allocate vector).
+    //   - call 'initializeIndex' for all properties in sequence, for 0 <= i < initialLength.
+    //   - Provide a valid GCDefferalContext* if they might garbage collect when initializing properties,
+    //     otherwise the caller can provide a null GCDefferalContext*.
+    //
+    JS_EXPORT_PRIVATE static JSArray* tryCreateUninitialized(VM&, GCDeferralContext*, Structure*, unsigned initialLength);
+    static JSArray* tryCreateUninitialized(VM& vm, Structure* structure, unsigned initialLength)
+    {
+        return tryCreateUninitialized(vm, nullptr, structure, initialLength);
+    }
+
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool throwException);
+
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+
+    DECLARE_EXPORT_INFO;
+
+    // OK if we know this is a JSArray, but not if it could be an object of a derived class; for RuntimeArray this always returns 0.
+    unsigned length() const { return getArrayLength(); }
+
+    // OK to use on new arrays, but not if it might be a RegExpMatchArray or RuntimeArray.
+    JS_EXPORT_PRIVATE bool setLength(ExecState*, unsigned, bool throwException = false);
+
+    JS_EXPORT_PRIVATE void push(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE JSValue pop(ExecState*);
+
+    JSArray* fastSlice(ExecState&, unsigned startIndex, unsigned count);
+
+    bool canFastCopy(VM&, JSArray* otherArray);
+    // This function returns NonArray if the indexing types are not compatable for copying.
+    IndexingType mergeIndexingTypeForCopying(IndexingType other);
+    bool appendMemcpy(ExecState*, VM&, unsigned startIndex, JSArray* otherArray);
+
+    enum ShiftCountMode {
+        // This form of shift hints that we're doing queueing. With this assumption in hand,
+        // we convert to ArrayStorage, which has queue optimizations.
+        ShiftCountForShift,
+            
+        // This form of shift hints that we're just doing care and feeding on an array that
+        // is probably typically used for ordinary accesses. With this assumption in hand,
+        // we try to preserve whatever indexing type it has already.
+        ShiftCountForSplice
+    };
+
+    bool shiftCountForShift(ExecState* exec, unsigned startIndex, unsigned count)
+    {
+        return shiftCountWithArrayStorage(exec->vm(), startIndex, count, ensureArrayStorage(exec->vm()));
+    }
+    bool shiftCountForSplice(ExecState* exec, unsigned& startIndex, unsigned count)
+    {
+        return shiftCountWithAnyIndexingType(exec, startIndex, count);
+    }
+    template<ShiftCountMode shiftCountMode>
+    bool shiftCount(ExecState* exec, unsigned& startIndex, unsigned count)
+    {
+        switch (shiftCountMode) {
+        case ShiftCountForShift:
+            return shiftCountForShift(exec, startIndex, count);
+        case ShiftCountForSplice:
+            return shiftCountForSplice(exec, startIndex, count);
+        default:
+            CRASH();
+            return false;
+        }
+    }
+        
+    bool unshiftCountForShift(ExecState* exec, unsigned startIndex, unsigned count)
+    {
+        return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
+    }
+    bool unshiftCountForSplice(ExecState* exec, unsigned startIndex, unsigned count)
+    {
+        return unshiftCountWithAnyIndexingType(exec, startIndex, count);
+    }
+    template<ShiftCountMode shiftCountMode>
+    bool unshiftCount(ExecState* exec, unsigned startIndex, unsigned count)
+    {
+        switch (shiftCountMode) {
+        case ShiftCountForShift:
+            return unshiftCountForShift(exec, startIndex, count);
+        case ShiftCountForSplice:
+            return unshiftCountForSplice(exec, startIndex, count);
+        default:
+            CRASH();
+            return false;
+        }
+    }
+
+    JS_EXPORT_PRIVATE void fillArgList(ExecState*, MarkedArgumentBuffer&);
+    JS_EXPORT_PRIVATE void copyToArguments(ExecState*, VirtualRegister firstElementDest, unsigned offset, unsigned length);
+
+    bool isIteratorProtocolFastAndNonObservable();
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, IndexingType indexingType)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ArrayType, StructureFlags), info(), indexingType);
+    }
+        
+protected:
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        ASSERT_WITH_MESSAGE(type() == ArrayType || type() == DerivedArrayType, "Instance inheriting JSArray should have either ArrayType or DerivedArrayType");
+    }
+
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+private:
+    bool isLengthWritable()
+    {
+        ArrayStorage* storage = arrayStorageOrNull();
+        if (!storage)
+            return true;
+        SparseArrayValueMap* map = storage->m_sparseMap.get();
+        return !map || !map->lengthIsReadOnly();
+    }
+        
+    bool shiftCountWithAnyIndexingType(ExecState*, unsigned& startIndex, unsigned count);
+    JS_EXPORT_PRIVATE bool shiftCountWithArrayStorage(VM&, unsigned startIndex, unsigned count, ArrayStorage*);
+
+    bool unshiftCountWithAnyIndexingType(ExecState*, unsigned startIndex, unsigned count);
+    bool unshiftCountWithArrayStorage(ExecState*, unsigned startIndex, unsigned count, ArrayStorage*);
+    bool unshiftCountSlowCase(const AbstractLocker&, VM&, DeferGC&, bool, unsigned);
+
+    bool setLengthWithArrayStorage(ExecState*, unsigned newLength, bool throwException, ArrayStorage*);
+    void setLengthWritable(ExecState*, bool writable);
+};
+
+inline Butterfly* tryCreateArrayButterfly(VM& vm, JSCell* intendedOwner, unsigned initialLength)
+{
+    Butterfly* butterfly = Butterfly::tryCreate(
+        vm, intendedOwner, 0, 0, true, baseIndexingHeaderForArrayStorage(initialLength),
+        ArrayStorage::sizeFor(BASE_ARRAY_STORAGE_VECTOR_LEN));
+    if (!butterfly)
+        return nullptr;
+    ArrayStorage* storage = butterfly->arrayStorage();
+    storage->m_sparseMap.clear();
+    storage->m_indexBias = 0;
+    storage->m_numValuesInVector = 0;
+    return butterfly;
+}
+
+inline Butterfly* createArrayButterfly(VM& vm, JSCell* intendedOwner, unsigned initialLength)
+{
+    Butterfly* result = tryCreateArrayButterfly(vm, intendedOwner, initialLength);
+    RELEASE_ASSERT(result);
+    return result;
+}
+
+Butterfly* createArrayButterflyInDictionaryIndexingMode(
+    VM&, JSCell* intendedOwner, unsigned initialLength);
+
+inline JSArray* JSArray::tryCreate(VM& vm, Structure* structure, unsigned initialLength)
+{
+    unsigned outOfLineStorage = structure->outOfLineCapacity();
+
+    Butterfly* butterfly;
+    IndexingType indexingType = structure->indexingType();
+    if (LIKELY(!hasAnyArrayStorage(indexingType))) {
+        ASSERT(
+            hasUndecided(indexingType)
+            || hasInt32(indexingType)
+            || hasDouble(indexingType)
+            || hasContiguous(indexingType));
+
+        if (initialLength > MAX_STORAGE_VECTOR_LENGTH)
+            return 0;
+
+        unsigned vectorLength = Butterfly::optimalContiguousVectorLength(structure, initialLength);
+        void* temp = vm.auxiliarySpace.tryAllocate(nullptr, Butterfly::totalSize(0, outOfLineStorage, true, vectorLength * sizeof(EncodedJSValue)));
+        if (!temp)
+            return nullptr;
+        butterfly = Butterfly::fromBase(temp, 0, outOfLineStorage);
+        butterfly->setVectorLength(vectorLength);
+        butterfly->setPublicLength(initialLength);
+        if (hasDouble(indexingType))
+            clearArray(butterfly->contiguousDouble().data(), vectorLength);
+        else
+            clearArray(butterfly->contiguous().data(), vectorLength);
+    } else {
+        ASSERT(
+            indexingType == ArrayWithSlowPutArrayStorage
+            || indexingType == ArrayWithArrayStorage);
+        butterfly = tryCreateArrayButterfly(vm, 0, initialLength);
+        if (!butterfly)
+            return nullptr;
+        for (unsigned i = 0; i < BASE_ARRAY_STORAGE_VECTOR_LEN; ++i)
+            butterfly->arrayStorage()->m_vector[i].clear();
+    }
+
+    return createWithButterfly(vm, nullptr, structure, butterfly);
+}
+
+inline JSArray* JSArray::create(VM& vm, Structure* structure, unsigned initialLength)
+{
+    JSArray* result = JSArray::tryCreate(vm, structure, initialLength);
+    RELEASE_ASSERT(result);
+
+    return result;
+}
+
+inline JSArray* JSArray::createWithButterfly(VM& vm, GCDeferralContext* deferralContext, Structure* structure, Butterfly* butterfly)
+{
+    JSArray* array = new (NotNull, allocateCell<JSArray>(vm.heap, deferralContext)) JSArray(vm, structure, butterfly);
+    array->finishCreation(vm);
+    return array;
+}
+
+JSArray* asArray(JSValue);
+
+inline JSArray* asArray(JSCell* cell)
+{
+    ASSERT(cell->inherits(JSArray::info()));
+    return jsCast<JSArray*>(cell);
+}
+
+inline JSArray* asArray(JSValue value)
+{
+    return asArray(value.asCell());
+}
+
+inline bool isJSArray(JSCell* cell)
+{
+    ASSERT((cell->classInfo() == JSArray::info()) == (cell->type() == ArrayType));
+    return cell->type() == ArrayType;
+}
+
+inline bool isJSArray(JSValue v) { return v.isCell() && isJSArray(v.asCell()); }
+
+inline JSArray* constructArray(ExecState* exec, Structure* arrayStructure, const ArgList& values)
+{
+    VM& vm = exec->vm();
+    unsigned length = values.size();
+    JSArray* array = JSArray::tryCreateUninitialized(vm, arrayStructure, length);
+
+    // FIXME: we should probably throw an out of memory error here, but
+    // when making this change we should check that all clients of this
+    // function will correctly handle an exception being thrown from here.
+    RELEASE_ASSERT(array);
+
+    for (unsigned i = 0; i < length; ++i)
+        array->initializeIndex(vm, i, values.at(i));
+    return array;
+}
+    
+inline JSArray* constructArray(ExecState* exec, Structure* arrayStructure, const JSValue* values, unsigned length)
+{
+    VM& vm = exec->vm();
+    JSArray* array = JSArray::tryCreateUninitialized(vm, arrayStructure, length);
+
+    // FIXME: we should probably throw an out of memory error here, but
+    // when making this change we should check that all clients of this
+    // function will correctly handle an exception being thrown from here.
+    RELEASE_ASSERT(array);
+
+    for (unsigned i = 0; i < length; ++i)
+        array->initializeIndex(vm, i, values[i]);
+    return array;
+}
+
+inline JSArray* constructArrayNegativeIndexed(ExecState* exec, Structure* arrayStructure, const JSValue* values, unsigned length)
+{
+    VM& vm = exec->vm();
+    JSArray* array = JSArray::tryCreateUninitialized(vm, arrayStructure, length);
+
+    // FIXME: we should probably throw an out of memory error here, but
+    // when making this change we should check that all clients of this
+    // function will correctly handle an exception being thrown from here.
+    RELEASE_ASSERT(array);
+
+    for (int i = 0; i < static_cast<int>(length); ++i)
+        array->initializeIndex(vm, i, values[-i]);
+    return array;
+}
+
+} // namespace JSC
diff --git a/runtime/JSArrayBuffer.cpp b/runtime/JSArrayBuffer.cpp
new file mode 100644
index 0000000..23540da
--- /dev/null
+++ b/runtime/JSArrayBuffer.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSArrayBuffer.h"
+
+#include "JSCInlines.h"
+#include "TypeError.h"
+#include "TypedArrayController.h"
+
+namespace JSC {
+
+const ClassInfo JSArrayBuffer::s_info = {
+    "ArrayBuffer", &Base::s_info, 0, CREATE_METHOD_TABLE(JSArrayBuffer)};
+
+JSArrayBuffer::JSArrayBuffer(VM& vm, Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer)
+    : Base(vm, structure)
+    , m_impl(arrayBuffer.get())
+{
+}
+
+void JSArrayBuffer::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    // This probably causes GCs in the various VMs to overcount the impact of the array buffer.
+    vm.heap.addReference(this, m_impl);
+    vm.m_typedArrayController->registerWrapper(globalObject, m_impl, this);
+}
+
+JSArrayBuffer* JSArrayBuffer::create(
+    VM& vm, Structure* structure, PassRefPtr<ArrayBuffer> passedBuffer)
+{
+    RefPtr<ArrayBuffer> buffer = passedBuffer;
+    JSArrayBuffer* result =
+        new (NotNull, allocateCell<JSArrayBuffer>(vm.heap))
+        JSArrayBuffer(vm, structure, buffer);
+    result->finishCreation(vm, structure->globalObject());
+    return result;
+}
+
+Structure* JSArrayBuffer::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(
+        vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info(),
+        NonArray);
+}
+
+bool JSArrayBuffer::isShared() const
+{
+    return m_impl->isShared();
+}
+
+ArrayBufferSharingMode JSArrayBuffer::sharingMode() const
+{
+    return m_impl->sharingMode();
+}
+
+size_t JSArrayBuffer::estimatedSize(JSCell* cell)
+{
+    JSArrayBuffer* thisObject = jsCast<JSArrayBuffer*>(cell);
+    size_t bufferEstimatedSize = thisObject->impl()->gcSizeEstimateInBytes();
+    return Base::estimatedSize(cell) + bufferEstimatedSize;
+}
+
+bool JSArrayBuffer::getOwnPropertySlot(
+    JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    JSArrayBuffer* thisObject = jsCast<JSArrayBuffer*>(object);
+    
+    if (propertyName == exec->propertyNames().byteLength) {
+        slot.setValue(thisObject, DontDelete | ReadOnly, jsNumber(thisObject->impl()->byteLength()));
+        return true;
+    }
+    
+    return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+}
+
+bool JSArrayBuffer::put(
+    JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value,
+    PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSArrayBuffer* thisObject = jsCast<JSArrayBuffer*>(cell);
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject))) {
+        scope.release();
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+    }
+    
+    if (propertyName == vm.propertyNames->byteLength)
+        return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral("Attempting to write to a read-only array buffer property."));
+
+    scope.release();
+    return Base::put(thisObject, exec, propertyName, value, slot);
+}
+
+bool JSArrayBuffer::defineOwnProperty(
+    JSObject* object, ExecState* exec, PropertyName propertyName,
+    const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSArrayBuffer* thisObject = jsCast<JSArrayBuffer*>(object);
+    
+    if (propertyName == vm.propertyNames->byteLength)
+        return typeError(exec, scope, shouldThrow, ASCIILiteral("Attempting to define read-only array buffer property."));
+
+    scope.release();
+    return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+}
+
+bool JSArrayBuffer::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    JSArrayBuffer* thisObject = jsCast<JSArrayBuffer*>(cell);
+    
+    if (propertyName == exec->propertyNames().byteLength)
+        return false;
+    
+    return Base::deleteProperty(thisObject, exec, propertyName);
+}
+
+void JSArrayBuffer::getOwnNonIndexPropertyNames(
+    JSObject* object, ExecState* exec, PropertyNameArray& array, EnumerationMode mode)
+{
+    JSArrayBuffer* thisObject = jsCast<JSArrayBuffer*>(object);
+    
+    if (mode.includeDontEnumProperties())
+        array.add(exec->propertyNames().byteLength);
+    
+    Base::getOwnNonIndexPropertyNames(thisObject, exec, array, mode);
+}
+
+} // namespace JSC
+
diff --git a/runtime/JSArrayBuffer.h b/runtime/JSArrayBuffer.h
new file mode 100644
index 0000000..5c8bb68
--- /dev/null
+++ b/runtime/JSArrayBuffer.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBuffer.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSArrayBuffer : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetPropertyNames | OverridesGetOwnPropertySlot;
+    
+protected:
+    JSArrayBuffer(VM&, Structure*, PassRefPtr<ArrayBuffer>);
+    void finishCreation(VM&, JSGlobalObject*);
+    
+public:
+    // This function will register the new wrapper with the vm's TypedArrayController.
+    JS_EXPORT_PRIVATE static JSArrayBuffer* create(VM&, Structure*, PassRefPtr<ArrayBuffer>);
+
+    ArrayBuffer* impl() const { return m_impl; }
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    JS_EXPORT_PRIVATE bool isShared() const;
+    ArrayBufferSharingMode sharingMode() const;
+    
+    DECLARE_EXPORT_INFO;
+    
+    // This is the default DOM unwrapping. It calls toUnsharedArrayBuffer().
+    static ArrayBuffer* toWrapped(JSValue);
+    
+protected:
+
+    static size_t estimatedSize(JSCell*);
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    
+    static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+private:
+    ArrayBuffer* m_impl;
+};
+
+inline ArrayBuffer* toPossiblySharedArrayBuffer(JSValue value)
+{
+    JSArrayBuffer* wrapper = jsDynamicCast<JSArrayBuffer*>(value);
+    if (!wrapper)
+        return nullptr;
+    return wrapper->impl();
+}
+
+inline ArrayBuffer* toUnsharedArrayBuffer(JSValue value)
+{
+    ArrayBuffer* result = toPossiblySharedArrayBuffer(value);
+    if (!result || result->isShared())
+        return nullptr;
+    return result;
+}
+
+inline ArrayBuffer* JSArrayBuffer::toWrapped(JSValue value)
+{
+    return toUnsharedArrayBuffer(value);
+}
+
+} // namespace JSC
diff --git a/runtime/JSArrayBufferConstructor.cpp b/runtime/JSArrayBufferConstructor.cpp
new file mode 100644
index 0000000..2b9ad53
--- /dev/null
+++ b/runtime/JSArrayBufferConstructor.cpp
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSArrayBufferConstructor.h"
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "GetterSetter.h"
+#include "JSArrayBuffer.h"
+#include "JSArrayBufferPrototype.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL arrayBufferFuncIsView(ExecState*);
+
+const ClassInfo JSArrayBufferConstructor::s_info = {
+    "Function", &Base::s_info, 0,
+    CREATE_METHOD_TABLE(JSArrayBufferConstructor)
+};
+
+JSArrayBufferConstructor::JSArrayBufferConstructor(VM& vm, Structure* structure, ArrayBufferSharingMode sharingMode)
+    : Base(vm, structure)
+    , m_sharingMode(sharingMode)
+{
+}
+
+void JSArrayBufferConstructor::finishCreation(VM& vm, JSArrayBufferPrototype* prototype, GetterSetter* speciesSymbol)
+{
+    Base::finishCreation(vm, ASCIILiteral(arrayBufferSharingModeName(m_sharingMode)));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), DontEnum | DontDelete | ReadOnly);
+    putDirectNonIndexAccessor(vm, vm.propertyNames->speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);
+
+    if (m_sharingMode == ArrayBufferSharingMode::Default) {
+        JSGlobalObject* globalObject = this->globalObject();
+        JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->isView, arrayBufferFuncIsView, DontEnum, 1);
+        JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().isViewPrivateName(), arrayBufferFuncIsView, DontEnum, 1);
+    }
+}
+
+JSArrayBufferConstructor* JSArrayBufferConstructor::create(VM& vm, Structure* structure, JSArrayBufferPrototype* prototype, GetterSetter* speciesSymbol, ArrayBufferSharingMode sharingMode)
+{
+    JSArrayBufferConstructor* result =
+        new (NotNull, allocateCell<JSArrayBufferConstructor>(vm.heap))
+        JSArrayBufferConstructor(vm, structure, sharingMode);
+    result->finishCreation(vm, prototype, speciesSymbol);
+    return result;
+}
+
+Structure* JSArrayBufferConstructor::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(
+        vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+static EncodedJSValue JSC_HOST_CALL constructArrayBuffer(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSArrayBufferConstructor* constructor =
+        jsCast<JSArrayBufferConstructor*>(exec->jsCallee());
+    
+    unsigned length;
+    if (exec->argumentCount()) {
+        length = exec->uncheckedArgument(0).toIndex(exec, "length");
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    } else {
+        // Although the documentation doesn't say so, it is in fact correct to say
+        // "new ArrayBuffer()". The result is the same as allocating an array buffer
+        // with a zero length.
+        length = 0;
+    }
+    
+    auto buffer = ArrayBuffer::tryCreate(length, 1);
+    if (!buffer)
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
+    
+    if (constructor->sharingMode() == ArrayBufferSharingMode::Shared)
+        buffer->makeShared();
+    
+    ASSERT(constructor->sharingMode() == buffer->sharingMode());
+    
+    Structure* arrayBufferStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), constructor->globalObject()->arrayBufferStructure(constructor->sharingMode()));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSArrayBuffer* result = JSArrayBuffer::create(vm, arrayBufferStructure, WTFMove(buffer));
+    
+    return JSValue::encode(result);
+}
+
+static EncodedJSValue JSC_HOST_CALL callArrayBuffer(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "ArrayBuffer"));
+}
+
+ConstructType JSArrayBufferConstructor::getConstructData(
+    JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructArrayBuffer;
+    return ConstructType::Host;
+}
+
+CallType JSArrayBufferConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callArrayBuffer;
+    return CallType::Host;
+}
+
+// ------------------------------ Functions --------------------------------
+
+// ECMA 24.1.3.1
+EncodedJSValue JSC_HOST_CALL arrayBufferFuncIsView(ExecState* exec)
+{
+    return JSValue::encode(jsBoolean(jsDynamicCast<JSArrayBufferView*>(exec->argument(0))));
+}
+    
+
+} // namespace JSC
+
diff --git a/runtime/JSArrayBufferConstructor.h b/runtime/JSArrayBufferConstructor.h
new file mode 100644
index 0000000..9c75324
--- /dev/null
+++ b/runtime/JSArrayBufferConstructor.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBuffer.h"
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class JSArrayBufferPrototype;
+class GetterSetter;
+
+class JSArrayBufferConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+protected:
+    JSArrayBufferConstructor(VM&, Structure*, ArrayBufferSharingMode);
+    void finishCreation(VM&, JSArrayBufferPrototype*, GetterSetter* speciesSymbol);
+
+public:
+    static JSArrayBufferConstructor* create(VM&, Structure*, JSArrayBufferPrototype*, GetterSetter* speciesSymbol, ArrayBufferSharingMode);
+    
+    DECLARE_INFO;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+    
+    ArrayBufferSharingMode sharingMode() const { return m_sharingMode; }
+
+protected:
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+
+private:
+    ArrayBufferSharingMode m_sharingMode;
+};
+
+} // namespace JSC
diff --git a/runtime/JSArrayBufferPrototype.cpp b/runtime/JSArrayBufferPrototype.cpp
new file mode 100644
index 0000000..01d6035
--- /dev/null
+++ b/runtime/JSArrayBufferPrototype.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSArrayBufferPrototype.h"
+
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSArrayBuffer.h"
+#include "JSFunction.h"
+#include "JSCInlines.h"
+#include "TypedArrayAdaptors.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL arrayBufferProtoFuncSlice(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSFunction* callee = jsCast<JSFunction*>(exec->jsCallee());
+    
+    JSArrayBuffer* thisObject = jsDynamicCast<JSArrayBuffer*>(exec->thisValue());
+    if (!thisObject)
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver of slice must be an array buffer."));
+    
+    if (!exec->argumentCount())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Slice requires at least one argument."));
+    
+    int32_t begin = exec->argument(0).toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    int32_t end;
+    if (exec->argumentCount() >= 2) {
+        end = exec->uncheckedArgument(1).toInt32(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    } else
+        end = thisObject->impl()->byteLength();
+    
+    RefPtr<ArrayBuffer> newBuffer = thisObject->impl()->slice(begin, end);
+    if (!newBuffer)
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
+    
+    Structure* structure = callee->globalObject()->arrayBufferStructure(newBuffer->sharingMode());
+    
+    JSArrayBuffer* result = JSArrayBuffer::create(vm, structure, newBuffer);
+    
+    return JSValue::encode(result);
+}
+
+const ClassInfo JSArrayBufferPrototype::s_info = {
+    "ArrayBufferPrototype", &Base::s_info, 0, CREATE_METHOD_TABLE(JSArrayBufferPrototype)
+};
+
+JSArrayBufferPrototype::JSArrayBufferPrototype(VM& vm, Structure* structure, ArrayBufferSharingMode sharingMode)
+    : Base(vm, structure)
+    , m_sharingMode(sharingMode)
+{
+}
+
+void JSArrayBufferPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->slice, arrayBufferProtoFuncSlice, DontEnum, 2);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, arrayBufferSharingModeName(m_sharingMode)), DontEnum | ReadOnly);
+}
+
+JSArrayBufferPrototype* JSArrayBufferPrototype::create(VM& vm, JSGlobalObject* globalObject, Structure* structure, ArrayBufferSharingMode sharingMode)
+{
+    JSArrayBufferPrototype* prototype =
+        new (NotNull, allocateCell<JSArrayBufferPrototype>(vm.heap))
+        JSArrayBufferPrototype(vm, structure, sharingMode);
+    prototype->finishCreation(vm, globalObject);
+    return prototype;
+}
+
+Structure* JSArrayBufferPrototype::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(
+        vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+} // namespace JSC
+
diff --git a/runtime/JSArrayBufferPrototype.h b/runtime/JSArrayBufferPrototype.h
new file mode 100644
index 0000000..e5e1f69
--- /dev/null
+++ b/runtime/JSArrayBufferPrototype.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBuffer.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSArrayBufferPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+protected:
+    JSArrayBufferPrototype(VM&, Structure*, ArrayBufferSharingMode);
+    void finishCreation(VM&, JSGlobalObject*);
+
+public:
+    static JSArrayBufferPrototype* create(VM&, JSGlobalObject*, Structure*, ArrayBufferSharingMode);
+    
+    DECLARE_INFO;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+private:
+    ArrayBufferSharingMode m_sharingMode;
+};
+
+} // namespace JSC
diff --git a/runtime/JSArrayBufferView.cpp b/runtime/JSArrayBufferView.cpp
new file mode 100644
index 0000000..a3b3888
--- /dev/null
+++ b/runtime/JSArrayBufferView.cpp
@@ -0,0 +1,242 @@
+/*
+ * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSArrayBufferView.h"
+
+#include "JSArrayBuffer.h"
+#include "JSCInlines.h"
+#include "TypeError.h"
+#include "TypedArrayController.h"
+
+namespace JSC {
+
+const ClassInfo JSArrayBufferView::s_info = {
+    "ArrayBufferView", &Base::s_info, 0, CREATE_METHOD_TABLE(JSArrayBufferView)
+};
+
+String JSArrayBufferView::toStringName(const JSObject*, ExecState*)
+{
+    return ASCIILiteral("Object");
+}
+
+JSArrayBufferView::ConstructionContext::ConstructionContext(
+    Structure* structure, uint32_t length, void* vector)
+    : m_structure(structure)
+    , m_vector(vector)
+    , m_length(length)
+    , m_mode(FastTypedArray)
+    , m_butterfly(nullptr)
+{
+    RELEASE_ASSERT(length <= fastSizeLimit);
+}
+
+JSArrayBufferView::ConstructionContext::ConstructionContext(
+    VM& vm, Structure* structure, uint32_t length, uint32_t elementSize,
+    InitializationMode mode)
+    : m_structure(0)
+    , m_length(length)
+    , m_butterfly(0)
+{
+    if (length <= fastSizeLimit) {
+        // Attempt GC allocation.
+        void* temp;
+        size_t size = sizeOf(length, elementSize);
+        if (size) {
+            temp = vm.auxiliarySpace.tryAllocate(nullptr, size);
+            if (!temp)
+                return;
+        } else
+            temp = nullptr;
+
+        m_structure = structure;
+        m_vector = temp;
+        m_mode = FastTypedArray;
+
+        if (mode == ZeroFill) {
+            uint64_t* asWords = static_cast<uint64_t*>(m_vector);
+            for (unsigned i = size / sizeof(uint64_t); i--;)
+                asWords[i] = 0;
+        }
+        
+        return;
+    }
+
+    // Don't allow a typed array to use more than 2GB.
+    if (length > static_cast<unsigned>(INT_MAX) / elementSize)
+        return;
+    
+    if (mode == ZeroFill) {
+        if (!tryFastCalloc(length, elementSize).getValue(m_vector))
+            return;
+    } else {
+        if (!tryFastMalloc(length * elementSize).getValue(m_vector))
+            return;
+    }
+    
+    vm.heap.reportExtraMemoryAllocated(static_cast<size_t>(length) * elementSize);
+    
+    m_structure = structure;
+    m_mode = OversizeTypedArray;
+}
+
+JSArrayBufferView::ConstructionContext::ConstructionContext(
+    VM& vm, Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer,
+    unsigned byteOffset, unsigned length)
+    : m_structure(structure)
+    , m_length(length)
+    , m_mode(WastefulTypedArray)
+{
+    m_vector = static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset;
+    IndexingHeader indexingHeader;
+    indexingHeader.setArrayBuffer(arrayBuffer.get());
+    m_butterfly = Butterfly::create(vm, 0, 0, 0, true, indexingHeader, 0);
+}
+
+JSArrayBufferView::ConstructionContext::ConstructionContext(
+    Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer,
+    unsigned byteOffset, unsigned length, DataViewTag)
+    : m_structure(structure)
+    , m_length(length)
+    , m_mode(DataViewMode)
+    , m_butterfly(0)
+{
+    m_vector = static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset;
+}
+
+JSArrayBufferView::JSArrayBufferView(VM& vm, ConstructionContext& context)
+    : Base(vm, context.structure(), context.butterfly())
+    , m_length(context.length())
+    , m_mode(context.mode())
+{
+    m_vector.setWithoutBarrier(context.vector());
+}
+
+void JSArrayBufferView::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    switch (m_mode) {
+    case FastTypedArray:
+        return;
+    case OversizeTypedArray:
+        vm.heap.addFinalizer(this, finalize);
+        return;
+    case WastefulTypedArray:
+        vm.heap.addReference(this, butterfly()->indexingHeader()->arrayBuffer());
+        return;
+    case DataViewMode:
+        ASSERT(!butterfly());
+        vm.heap.addReference(this, jsCast<JSDataView*>(this)->possiblySharedBuffer());
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void JSArrayBufferView::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(cell);
+
+    if (thisObject->hasArrayBuffer()) {
+        WTF::loadLoadFence();
+        ArrayBuffer* buffer = thisObject->possiblySharedBuffer();
+        RELEASE_ASSERT(buffer);
+        visitor.addOpaqueRoot(buffer);
+    }
+    
+    Base::visitChildren(thisObject, visitor);
+}
+
+bool JSArrayBufferView::put(
+    JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value,
+    PutPropertySlot& slot)
+{
+    JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(cell);
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject)))
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+    
+    return Base::put(thisObject, exec, propertyName, value, slot);
+}
+
+ArrayBuffer* JSArrayBufferView::unsharedBuffer()
+{
+    ArrayBuffer* result = possiblySharedBuffer();
+    RELEASE_ASSERT(!result->isShared());
+    return result;
+}
+    
+void JSArrayBufferView::finalize(JSCell* cell)
+{
+    JSArrayBufferView* thisObject = static_cast<JSArrayBufferView*>(cell);
+    ASSERT(thisObject->m_mode == OversizeTypedArray || thisObject->m_mode == WastefulTypedArray);
+    if (thisObject->m_mode == OversizeTypedArray)
+        fastFree(thisObject->m_vector.get());
+}
+
+JSArrayBuffer* JSArrayBufferView::unsharedJSBuffer(ExecState* exec)
+{
+    return exec->vm().m_typedArrayController->toJS(exec, globalObject(), unsharedBuffer());
+}
+
+JSArrayBuffer* JSArrayBufferView::possiblySharedJSBuffer(ExecState* exec)
+{
+    return exec->vm().m_typedArrayController->toJS(exec, globalObject(), possiblySharedBuffer());
+}
+
+void JSArrayBufferView::neuter()
+{
+    RELEASE_ASSERT(hasArrayBuffer());
+    RELEASE_ASSERT(!isShared());
+    m_length = 0;
+    m_vector.clear();
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, TypedArrayMode mode)
+{
+    switch (mode) {
+    case FastTypedArray:
+        out.print("FastTypedArray");
+        return;
+    case OversizeTypedArray:
+        out.print("OversizeTypedArray");
+        return;
+    case WastefulTypedArray:
+        out.print("WastefulTypedArray");
+        return;
+    case DataViewMode:
+        out.print("DataViewMode");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/runtime/JSArrayBufferView.h b/runtime/JSArrayBufferView.h
new file mode 100644
index 0000000..76a2f75
--- /dev/null
+++ b/runtime/JSArrayBufferView.h
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "AuxiliaryBarrier.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class LLIntOffsetsExtractor;
+
+// This class serves two purposes:
+//
+// 1) It provides those parts of JSGenericTypedArrayView that don't depend
+//    on template parameters.
+//
+// 2) It represents the DOM/WebCore-visible "JSArrayBufferView" type, which
+//    C++ code uses when it wants to pass around a view of an array buffer
+//    without concern for the actual type of the view.
+//
+// These two roles are quite different. (1) is just a matter of optimizing
+// compile and link times by having as much code and data as possible not
+// be subject to template specialization. (2) is *almost* a matter of
+// semantics; indeed at the very least it is a matter of obeying a contract
+// that we have with WebCore right now.
+//
+// One convenient thing that saves us from too much crazy is that
+// ArrayBufferView is not instantiable.
+
+// Typed array views have different modes depending on how big they are and
+// whether the user has done anything that requires a separate backing
+// buffer or the DOM-specified neutering capabilities.
+enum TypedArrayMode : uint32_t {
+    // Small and fast typed array. B is unused, V points to a vector
+    // allocated in copied space, and M = FastTypedArray. V's liveness is
+    // determined entirely by the view's liveness.
+    FastTypedArray,
+    
+    // A large typed array that still attempts not to waste too much
+    // memory. B is initialized to point to a slot that could hold a
+    // buffer pointer, V points to a vector allocated using fastCalloc(),
+    // and M = OversizeTypedArray. V's liveness is determined entirely by
+    // the view's liveness, and the view will add a finalizer to delete V.
+    OversizeTypedArray,
+    
+    // A typed array that was used in some crazy way. B's IndexingHeader
+    // is hijacked to contain a reference to the native array buffer. The
+    // native typed array view points back to the JS view. V points to a
+    // vector allocated using who-knows-what, and M = WastefulTypedArray.
+    // The view does not own the vector.
+    WastefulTypedArray,
+    
+    // A data view. B is unused, V points to a vector allocated using who-
+    // knows-what, and M = DataViewMode. The view does not own the vector.
+    // There is an extra field (in JSDataView) that points to the
+    // ArrayBuffer.
+    DataViewMode
+};
+
+inline bool hasArrayBuffer(TypedArrayMode mode)
+{
+    return mode >= WastefulTypedArray;
+}
+
+// When WebCore uses a JSArrayBufferView, it expects to be able to get the native
+// ArrayBuffer and little else. This requires slowing down and wasting memory,
+// and then accessing things via the Butterfly. When JS uses a JSArrayBufferView
+// it is always via the usual methods in the MethodTable, so this class's
+// implementation of those has no need to even exist - we could at any time sink
+// code into JSGenericTypedArrayView if it was convenient.
+
+class JSArrayBufferView : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned fastSizeLimit = 1000;
+    
+    static size_t sizeOf(uint32_t length, uint32_t elementSize)
+    {
+        return (length * elementSize + sizeof(EncodedJSValue) - 1)
+            & ~(sizeof(EncodedJSValue) - 1);
+    }
+
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
+        return sizeof(JSArrayBufferView);
+    }
+        
+protected:
+    class ConstructionContext {
+        WTF_MAKE_NONCOPYABLE(ConstructionContext);
+        
+    public:
+        enum InitializationMode { ZeroFill, DontInitialize };
+        
+        JS_EXPORT_PRIVATE ConstructionContext(VM&, Structure*, uint32_t length, uint32_t elementSize, InitializationMode = ZeroFill);
+        
+        // This is only for constructing fast typed arrays. It's used by the JIT's slow path.
+        ConstructionContext(Structure*, uint32_t length, void* vector);
+        
+        JS_EXPORT_PRIVATE ConstructionContext(
+            VM&, Structure*, PassRefPtr<ArrayBuffer>,
+            unsigned byteOffset, unsigned length);
+        
+        enum DataViewTag { DataView };
+        ConstructionContext(
+            Structure*, PassRefPtr<ArrayBuffer>,
+            unsigned byteOffset, unsigned length, DataViewTag);
+        
+        bool operator!() const { return !m_structure; }
+        
+        Structure* structure() const { return m_structure; }
+        void* vector() const { return m_vector; }
+        uint32_t length() const { return m_length; }
+        TypedArrayMode mode() const { return m_mode; }
+        Butterfly* butterfly() const { return m_butterfly; }
+        
+    private:
+        Structure* m_structure;
+        void* m_vector;
+        uint32_t m_length;
+        TypedArrayMode m_mode;
+        Butterfly* m_butterfly;
+    };
+    
+    JS_EXPORT_PRIVATE JSArrayBufferView(VM&, ConstructionContext&);
+    JS_EXPORT_PRIVATE void finishCreation(VM&);
+    
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+public:
+    TypedArrayMode mode() const { return m_mode; }
+    bool hasArrayBuffer() const { return JSC::hasArrayBuffer(mode()); }
+    
+    bool isShared();
+    JS_EXPORT_PRIVATE ArrayBuffer* unsharedBuffer();
+    ArrayBuffer* possiblySharedBuffer();
+    JSArrayBuffer* unsharedJSBuffer(ExecState* exec);
+    JSArrayBuffer* possiblySharedJSBuffer(ExecState* exec);
+    PassRefPtr<ArrayBufferView> unsharedImpl();
+    PassRefPtr<ArrayBufferView> possiblySharedImpl();
+    bool isNeutered() { return hasArrayBuffer() && !vector(); }
+    void neuter();
+    
+    void* vector() { return m_vector.get(); }
+    
+    unsigned byteOffset();
+    unsigned length() const { return m_length; }
+
+    DECLARE_EXPORT_INFO;
+    
+    static ptrdiff_t offsetOfVector() { return OBJECT_OFFSETOF(JSArrayBufferView, m_vector); }
+    static ptrdiff_t offsetOfLength() { return OBJECT_OFFSETOF(JSArrayBufferView, m_length); }
+    static ptrdiff_t offsetOfMode() { return OBJECT_OFFSETOF(JSArrayBufferView, m_mode); }
+    
+    static RefPtr<ArrayBufferView> toWrapped(JSValue);
+
+private:
+    static void finalize(JSCell*);
+
+protected:
+    friend class LLIntOffsetsExtractor;
+
+    ArrayBuffer* existingBufferInButterfly();
+
+    static String toStringName(const JSObject*, ExecState*);
+
+    AuxiliaryBarrier<void*> m_vector;
+    uint32_t m_length;
+    TypedArrayMode m_mode;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::TypedArrayMode);
+
+} // namespace WTF
diff --git a/runtime/JSArrayBufferViewInlines.h b/runtime/JSArrayBufferViewInlines.h
new file mode 100644
index 0000000..2183a4b
--- /dev/null
+++ b/runtime/JSArrayBufferViewInlines.h
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBufferView.h"
+#include "JSArrayBufferView.h"
+#include "JSDataView.h"
+
+namespace JSC {
+
+inline bool JSArrayBufferView::isShared()
+{
+    switch (m_mode) {
+    case WastefulTypedArray:
+        return existingBufferInButterfly()->isShared();
+    case DataViewMode:
+        return jsCast<JSDataView*>(this)->possiblySharedBuffer()->isShared();
+    default:
+        return false;
+    }
+}
+
+inline ArrayBuffer* JSArrayBufferView::possiblySharedBuffer()
+{
+    switch (m_mode) {
+    case WastefulTypedArray:
+        return existingBufferInButterfly();
+    case DataViewMode:
+        return jsCast<JSDataView*>(this)->possiblySharedBuffer();
+    default:
+        return methodTable()->slowDownAndWasteMemory(this);
+    }
+}
+
+inline ArrayBuffer* JSArrayBufferView::existingBufferInButterfly()
+{
+    ASSERT(m_mode == WastefulTypedArray);
+    return butterfly()->indexingHeader()->arrayBuffer();
+}
+
+inline PassRefPtr<ArrayBufferView> JSArrayBufferView::possiblySharedImpl()
+{
+    return methodTable()->getTypedArrayImpl(this);
+}
+
+inline PassRefPtr<ArrayBufferView> JSArrayBufferView::unsharedImpl()
+{
+    PassRefPtr<ArrayBufferView> result = possiblySharedImpl();
+    RELEASE_ASSERT(!result->isShared());
+    return result;
+}
+
+inline unsigned JSArrayBufferView::byteOffset()
+{
+    if (!hasArrayBuffer())
+        return 0;
+    
+    ArrayBuffer* buffer = possiblySharedBuffer();
+    ASSERT(!vector() == !buffer->data());
+    
+    ptrdiff_t delta =
+        bitwise_cast<uint8_t*>(vector()) - static_cast<uint8_t*>(buffer->data());
+    
+    unsigned result = static_cast<unsigned>(delta);
+    ASSERT(static_cast<ptrdiff_t>(result) == delta);
+    return result;
+}
+
+inline RefPtr<ArrayBufferView> JSArrayBufferView::toWrapped(JSValue value)
+{
+    if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(value)) {
+        if (!view->isShared())
+            return view->unsharedImpl();
+    }
+    return nullptr;
+}
+
+} // namespace JSC
diff --git a/runtime/JSArrayInlines.h b/runtime/JSArrayInlines.h
new file mode 100644
index 0000000..30d7e4f
--- /dev/null
+++ b/runtime/JSArrayInlines.h
@@ -0,0 +1,101 @@
+/*
+ *  Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSArray.h"
+#include "JSCellInlines.h"
+#include "Structure.h"
+
+namespace JSC {
+
+inline IndexingType JSArray::mergeIndexingTypeForCopying(IndexingType other)
+{
+    IndexingType type = indexingType();
+    if (!(type & IsArray && other & IsArray))
+        return NonArray;
+
+    if (hasAnyArrayStorage(type) || hasAnyArrayStorage(other))
+        return NonArray;
+
+    if (type == ArrayWithUndecided)
+        return other;
+
+    if (other == ArrayWithUndecided)
+        return type;
+
+    // We can memcpy an Int32 and a Contiguous into a Contiguous array since
+    // both share the same memory layout for Int32 numbers.
+    if ((type == ArrayWithInt32 || type == ArrayWithContiguous)
+        && (other == ArrayWithInt32 || other == ArrayWithContiguous)) {
+        if (other == ArrayWithContiguous)
+            return other;
+        return type;
+    }
+
+    if (type != other)
+        return NonArray;
+
+    return type;
+}
+
+inline bool JSArray::canFastCopy(VM& vm, JSArray* otherArray)
+{
+    if (hasAnyArrayStorage(indexingType()) || hasAnyArrayStorage(otherArray->indexingType()))
+        return false;
+    // FIXME: We should have a watchpoint for indexed properties on Array.prototype and Object.prototype
+    // instead of walking the prototype chain. https://bugs.webkit.org/show_bug.cgi?id=155592
+    if (structure(vm)->holesMustForwardToPrototype(vm)
+        || otherArray->structure(vm)->holesMustForwardToPrototype(vm))
+        return false;
+    return true;
+}
+
+ALWAYS_INLINE unsigned getLength(ExecState* exec, JSObject* obj)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (isJSArray(obj))
+        return jsCast<JSArray*>(obj)->length();
+
+    JSValue lengthValue = obj->get(exec, vm.propertyNames->length);
+    RETURN_IF_EXCEPTION(scope, UINT_MAX);
+    scope.release();
+    return lengthValue.toUInt32(exec);
+}
+
+ALWAYS_INLINE double toLength(ExecState* exec, JSObject* obj)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (isJSArray(obj))
+        return jsCast<JSArray*>(obj)->length();
+
+    JSValue lengthValue = obj->get(exec, vm.propertyNames->length);
+    RETURN_IF_EXCEPTION(scope, PNaN);
+    scope.release();
+    return lengthValue.toLength(exec);
+}
+
+ALWAYS_INLINE bool JSArray::isIteratorProtocolFastAndNonObservable()
+{
+    return globalObject()->isArrayIteratorProtocolFastAndNonObservable();
+}
+
+} // namespace JSC
diff --git a/runtime/JSAsyncFunction.cpp b/runtime/JSAsyncFunction.cpp
new file mode 100644
index 0000000..aba7437
--- /dev/null
+++ b/runtime/JSAsyncFunction.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2016 Caitlin Potter <caitp@igalia.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSAsyncFunction.h"
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSFunction.h"
+#include "JSFunctionInlines.h"
+#include "JSObject.h"
+#include "PropertySlot.h"
+#include "VM.h"
+
+namespace JSC {
+
+const ClassInfo JSAsyncFunction::s_info = { "AsyncFunction",  &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSAsyncFunction) };
+
+JSAsyncFunction::JSAsyncFunction(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+    : Base(vm, executable, scope, structure)
+{
+}
+
+JSAsyncFunction* JSAsyncFunction::createImpl(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+{
+    JSAsyncFunction* asyncFunction = new (NotNull, allocateCell<JSAsyncFunction>(vm.heap)) JSAsyncFunction(vm, executable, scope, structure);
+    ASSERT(asyncFunction->structure()->globalObject());
+    asyncFunction->finishCreation(vm);
+    return asyncFunction;
+}
+
+JSAsyncFunction* JSAsyncFunction::create(VM& vm, FunctionExecutable* executable, JSScope* scope)
+{
+    JSAsyncFunction* asyncFunction = createImpl(vm, executable, scope, scope->globalObject()->asyncFunctionStructure());
+    executable->singletonFunction()->notifyWrite(vm, asyncFunction, "Allocating an async function");
+    return asyncFunction;
+}
+
+JSAsyncFunction* JSAsyncFunction::create(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+{
+    JSAsyncFunction* asyncFunction = createImpl(vm, executable, scope, structure);
+    executable->singletonFunction()->notifyWrite(vm, asyncFunction, "Allocating an async function");
+    return asyncFunction;
+}
+
+JSAsyncFunction* JSAsyncFunction::createWithInvalidatedReallocationWatchpoint(VM& vm, FunctionExecutable* executable, JSScope* scope)
+{
+    return createImpl(vm, executable, scope, scope->globalObject()->asyncFunctionStructure());
+}
+
+}
diff --git a/runtime/JSAsyncFunction.h b/runtime/JSAsyncFunction.h
new file mode 100644
index 0000000..d7da87d
--- /dev/null
+++ b/runtime/JSAsyncFunction.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2016 Caitlin Potter <caitp@igalia.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSFunction.h"
+
+namespace JSC {
+
+class JSAsyncFunction : public JSFunction {
+    friend class JIT;
+    friend class VM;
+public:
+    typedef JSFunction Base;
+
+    const static unsigned StructureFlags = Base::StructureFlags;
+
+    DECLARE_EXPORT_INFO;
+
+    static JSAsyncFunction* create(VM&, FunctionExecutable*, JSScope*);
+    static JSAsyncFunction* create(VM&, FunctionExecutable*, JSScope*, Structure*);
+    static JSAsyncFunction* createWithInvalidatedReallocationWatchpoint(VM&, FunctionExecutable*, JSScope*);
+
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
+        return sizeof(JSAsyncFunction);
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info());
+    }
+
+private:
+    JSAsyncFunction(VM&, FunctionExecutable*, JSScope*, Structure*);
+
+    static JSAsyncFunction* createImpl(VM&, FunctionExecutable*, JSScope*, Structure*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSBoundFunction.cpp b/runtime/JSBoundFunction.cpp
new file mode 100644
index 0000000..e6d7dc8
--- /dev/null
+++ b/runtime/JSBoundFunction.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2011, 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSBoundFunction.h"
+
+#include "GetterSetter.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSBoundFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(JSBoundFunction) };
+
+EncodedJSValue JSC_HOST_CALL boundThisNoArgsFunctionCall(ExecState* exec)
+{
+    JSBoundFunction* boundFunction = jsCast<JSBoundFunction*>(exec->jsCallee());
+
+    MarkedArgumentBuffer args;
+    for (unsigned i = 0; i < exec->argumentCount(); ++i)
+        args.append(exec->uncheckedArgument(i));
+
+    JSFunction* targetFunction = jsCast<JSFunction*>(boundFunction->targetFunction());
+    ExecutableBase* executable = targetFunction->executable();
+    if (executable->hasJITCodeForCall()) {
+        // Force the executable to cache its arity entrypoint.
+        executable->entrypointFor(CodeForCall, MustCheckArity);
+    }
+    CallData callData;
+    CallType callType = getCallData(targetFunction, callData);
+    ASSERT(callType != CallType::None);
+    return JSValue::encode(call(exec, targetFunction, callType, callData, boundFunction->boundThis(), args));
+}
+
+EncodedJSValue JSC_HOST_CALL boundFunctionCall(ExecState* exec)
+{
+    JSBoundFunction* boundFunction = jsCast<JSBoundFunction*>(exec->jsCallee());
+
+    JSArray* boundArgs = boundFunction->boundArgs();
+
+    MarkedArgumentBuffer args;
+    if (boundArgs) {
+        for (unsigned i = 0; i < boundArgs->length(); ++i)
+            args.append(boundArgs->getIndexQuickly(i));
+    }
+    for (unsigned i = 0; i < exec->argumentCount(); ++i)
+        args.append(exec->uncheckedArgument(i));
+
+    JSObject* targetFunction = boundFunction->targetFunction();
+    CallData callData;
+    CallType callType = getCallData(targetFunction, callData);
+    ASSERT(callType != CallType::None);
+    return JSValue::encode(call(exec, targetFunction, callType, callData, boundFunction->boundThis(), args));
+}
+
+EncodedJSValue JSC_HOST_CALL boundThisNoArgsFunctionConstruct(ExecState* exec)
+{
+    JSBoundFunction* boundFunction = jsCast<JSBoundFunction*>(exec->jsCallee());
+
+    MarkedArgumentBuffer args;
+    for (unsigned i = 0; i < exec->argumentCount(); ++i)
+        args.append(exec->uncheckedArgument(i));
+
+    JSFunction* targetFunction = jsCast<JSFunction*>(boundFunction->targetFunction());
+    ConstructData constructData;
+    ConstructType constructType = getConstructData(targetFunction, constructData);
+    ASSERT(constructType != ConstructType::None);
+    return JSValue::encode(construct(exec, targetFunction, constructType, constructData, args));
+}
+
+EncodedJSValue JSC_HOST_CALL boundFunctionConstruct(ExecState* exec)
+{
+    JSBoundFunction* boundFunction = jsCast<JSBoundFunction*>(exec->jsCallee());
+
+    JSArray* boundArgs = boundFunction->boundArgs();
+
+    MarkedArgumentBuffer args;
+    if (boundArgs) {
+        for (unsigned i = 0; i < boundArgs->length(); ++i)
+            args.append(boundArgs->getIndexQuickly(i));
+    }
+    for (unsigned i = 0; i < exec->argumentCount(); ++i)
+        args.append(exec->uncheckedArgument(i));
+
+    JSObject* targetFunction = boundFunction->targetFunction();
+    ConstructData constructData;
+    ConstructType constructType = getConstructData(targetFunction, constructData);
+    ASSERT(constructType != ConstructType::None);
+    return JSValue::encode(construct(exec, targetFunction, constructType, constructData, args));
+}
+
+EncodedJSValue JSC_HOST_CALL isBoundFunction(ExecState* exec)
+{
+    return JSValue::encode(JSValue(static_cast<bool>(jsDynamicCast<JSBoundFunction*>(exec->uncheckedArgument(0)))));
+}
+
+EncodedJSValue JSC_HOST_CALL hasInstanceBoundFunction(ExecState* exec)
+{
+    JSBoundFunction* boundObject = jsCast<JSBoundFunction*>(exec->uncheckedArgument(0));
+    JSValue value = exec->uncheckedArgument(1);
+
+    return JSValue::encode(jsBoolean(boundObject->targetFunction()->hasInstance(exec, value)));
+}
+
+inline Structure* getBoundFunctionStructure(VM& vm, ExecState* exec, JSGlobalObject* globalObject, JSObject* targetFunction)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue prototype = targetFunction->getPrototype(vm, exec);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    JSFunction* targetJSFunction = jsDynamicCast<JSFunction*>(targetFunction);
+
+    // We only cache the structure of the bound function if the bindee is a JSFunction since there
+    // isn't any good place to put the structure on Internal Functions.
+    if (targetJSFunction) {
+        Structure* structure = targetJSFunction->rareData(vm)->getBoundFunctionStructure();
+        if (structure && structure->storedPrototype() == prototype && structure->globalObject() == globalObject)
+            return structure;
+    }
+
+    Structure* result = globalObject->boundFunctionStructure();
+
+    // It would be nice if the structure map was keyed global objects in addition to the other things. Unfortunately, it is not
+    // currently. Whoever works on caching structure changes for prototype transistions should consider this problem as well.
+    // See: https://bugs.webkit.org/show_bug.cgi?id=152738
+    if (prototype.isObject() && prototype.getObject()->globalObject() == globalObject) {
+        result = vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(globalObject, prototype.getObject(), result);
+        ASSERT_WITH_SECURITY_IMPLICATION(result->globalObject() == globalObject);
+    } else
+        result = Structure::create(vm, globalObject, prototype, result->typeInfo(), result->classInfo());
+
+    if (targetJSFunction)
+        targetJSFunction->rareData(vm)->setBoundFunctionStructure(vm, result);
+
+    return result;
+}
+
+JSBoundFunction* JSBoundFunction::create(VM& vm, ExecState* exec, JSGlobalObject* globalObject, JSObject* targetFunction, JSValue boundThis, JSArray* boundArgs, int length, const String& name)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConstructData constructData;
+    ConstructType constructType = JSC::getConstructData(targetFunction, constructData);
+    bool canConstruct = constructType != ConstructType::None;
+    
+    bool slowCase = boundArgs || !getJSFunction(targetFunction);
+    
+    NativeExecutable* executable = vm.getHostFunction(
+        slowCase ? boundFunctionCall : boundThisNoArgsFunctionCall,
+        slowCase ? NoIntrinsic : BoundThisNoArgsFunctionCallIntrinsic,
+        canConstruct ? (slowCase ? boundFunctionConstruct : boundThisNoArgsFunctionConstruct) : callHostFunctionAsConstructor, nullptr,
+        name);
+    Structure* structure = getBoundFunctionStructure(vm, exec, globalObject, targetFunction);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    JSBoundFunction* function = new (NotNull, allocateCell<JSBoundFunction>(vm.heap)) JSBoundFunction(vm, globalObject, structure, targetFunction, boundThis, boundArgs);
+
+    function->finishCreation(vm, executable, length);
+    return function;
+}
+
+bool JSBoundFunction::customHasInstance(JSObject* object, ExecState* exec, JSValue value)
+{
+    return jsCast<JSBoundFunction*>(object)->m_targetFunction->hasInstance(exec, value);
+}
+
+JSBoundFunction::JSBoundFunction(VM& vm, JSGlobalObject* globalObject, Structure* structure, JSObject* targetFunction, JSValue boundThis, JSArray* boundArgs)
+    : Base(vm, globalObject, structure)
+    , m_targetFunction(vm, this, targetFunction)
+    , m_boundThis(vm, this, boundThis)
+    , m_boundArgs(vm, this, boundArgs, WriteBarrier<JSArray>::MayBeNull)
+{
+}
+
+void JSBoundFunction::finishCreation(VM& vm, NativeExecutable* executable, int length)
+{
+    String name; // We lazily create our 'name' string property.
+    Base::finishCreation(vm, executable, length, name);
+    ASSERT(inherits(info()));
+
+    putDirectNonIndexAccessor(vm, vm.propertyNames->arguments, globalObject()->throwTypeErrorArgumentsCalleeAndCallerGetterSetter(), DontDelete | DontEnum | Accessor);
+    putDirectNonIndexAccessor(vm, vm.propertyNames->caller, globalObject()->throwTypeErrorArgumentsCalleeAndCallerGetterSetter(), DontDelete | DontEnum | Accessor);
+}
+
+void JSBoundFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSBoundFunction* thisObject = jsCast<JSBoundFunction*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_targetFunction);
+    visitor.append(thisObject->m_boundThis);
+    visitor.append(thisObject->m_boundArgs);
+}
+
+} // namespace JSC
diff --git a/runtime/JSBoundFunction.h b/runtime/JSBoundFunction.h
new file mode 100644
index 0000000..2c9e2cd
--- /dev/null
+++ b/runtime/JSBoundFunction.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSFunction.h"
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL boundThisNoArgsFunctionCall(ExecState*);
+EncodedJSValue JSC_HOST_CALL boundFunctionCall(ExecState*);
+EncodedJSValue JSC_HOST_CALL boundThisNoArgsFunctionConstruct(ExecState*);
+EncodedJSValue JSC_HOST_CALL boundFunctionConstruct(ExecState*);
+EncodedJSValue JSC_HOST_CALL isBoundFunction(ExecState*);
+EncodedJSValue JSC_HOST_CALL hasInstanceBoundFunction(ExecState*);
+
+class JSBoundFunction : public JSFunction {
+public:
+    typedef JSFunction Base;
+    const static unsigned StructureFlags = ~ImplementsDefaultHasInstance & Base::StructureFlags;
+
+    static JSBoundFunction* create(VM&, ExecState*, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSArray* boundArgs, int, const String& name);
+    
+    static bool customHasInstance(JSObject*, ExecState*, JSValue);
+
+    JSObject* targetFunction() { return m_targetFunction.get(); }
+    JSValue boundThis() { return m_boundThis.get(); }
+    JSArray* boundArgs() { return m_boundArgs.get(); }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info()); 
+    }
+    
+    static ptrdiff_t offsetOfTargetFunction() { return OBJECT_OFFSETOF(JSBoundFunction, m_targetFunction); }
+    static ptrdiff_t offsetOfBoundThis() { return OBJECT_OFFSETOF(JSBoundFunction, m_boundThis); }
+
+    DECLARE_INFO;
+
+protected:
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    JSBoundFunction(VM&, JSGlobalObject*, Structure*, JSObject* targetFunction, JSValue boundThis, JSArray* boundArgs);
+    
+    void finishCreation(VM&, NativeExecutable*, int length);
+
+    WriteBarrier<JSObject> m_targetFunction;
+    WriteBarrier<Unknown> m_boundThis;
+    WriteBarrier<JSArray> m_boundArgs;
+};
+
+} // namespace JSC
diff --git a/runtime/JSCInlines.h b/runtime/JSCInlines.h
new file mode 100644
index 0000000..cb3db3d
--- /dev/null
+++ b/runtime/JSCInlines.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+// This file's only purpose is to collect commonly used *Inlines.h files, so that you don't
+// have to include all of them in every .cpp file. Instead you just include this. It's good
+// style to make sure that every .cpp file includes JSCInlines.h.
+//
+// JSC should never include this file, or any *Inline.h file, from interface headers, since
+// this could lead to a circular dependency.
+//
+// WebCore, or any other downstream client of JSC, is allowed to include this file in headers.
+// In fact, it can make a lot of sense: outside of JSC, this file becomes a kind of umbrella
+// header that pulls in most (all?) of the interesting things in JSC.
+
+#include "ExceptionHelpers.h"
+#include "GCIncomingRefCountedInlines.h"
+#include "HeapInlines.h"
+#include "IdentifierInlines.h"
+#include "JSArrayBufferViewInlines.h"
+#include "JSCJSValueInlines.h"
+#include "JSFunctionInlines.h"
+#include "JSGlobalObjectInlines.h"
+#include "JSObjectInlines.h"
+#include "JSProxy.h"
+#include "JSString.h"
+#include "Operations.h"
+#include "SlotVisitorInlines.h"
+#include "StructureInlines.h"
+#include "ThrowScope.h"
+#include "WeakGCMapInlines.h"
diff --git a/runtime/JSCJSValue.cpp b/runtime/JSCJSValue.cpp
new file mode 100644
index 0000000..0d5f495
--- /dev/null
+++ b/runtime/JSCJSValue.cpp
@@ -0,0 +1,398 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2007-2008, 2012, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSCJSValue.h"
+
+#include "BooleanConstructor.h"
+#include "BooleanPrototype.h"
+#include "CustomGetterSetter.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "GetterSetter.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "NumberObject.h"
+#include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
+
+namespace JSC {
+
+// ECMA 9.4
+double JSValue::toInteger(ExecState* exec) const
+{
+    if (isInt32())
+        return asInt32();
+    double d = toNumber(exec);
+    return std::isnan(d) ? 0.0 : trunc(d);
+}
+
+double JSValue::toIntegerPreserveNaN(ExecState* exec) const
+{
+    if (isInt32())
+        return asInt32();
+    return trunc(toNumber(exec));
+}
+
+double JSValue::toLength(ExecState* exec) const
+{
+    // ECMA 7.1.15
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-tolength
+    double d = toInteger(exec);
+    if (d <= 0)
+        return 0.0;
+    if (std::isinf(d))
+        return 9007199254740991.0; // 2 ** 53 - 1
+    return std::min(d, 9007199254740991.0);
+}
+
+double JSValue::toNumberSlowCase(ExecState* exec) const
+{
+    ASSERT(!isInt32() && !isDouble());
+    if (isCell())
+        return asCell()->toNumber(exec);
+    if (isTrue())
+        return 1.0;
+    return isUndefined() ? PNaN : 0; // null and false both convert to 0.
+}
+
+std::optional<double> JSValue::toNumberFromPrimitive() const
+{
+    if (isEmpty())
+        return std::nullopt;
+    if (isNumber())
+        return asNumber();
+    if (isBoolean())
+        return asBoolean();
+    if (isUndefined())
+        return PNaN;
+    if (isNull())
+        return 0;
+    return std::nullopt;
+}
+
+JSObject* JSValue::toObjectSlowCase(ExecState* exec, JSGlobalObject* globalObject) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ASSERT(!isCell());
+
+    if (isInt32() || isDouble())
+        return constructNumber(exec, globalObject, asValue());
+    if (isTrue() || isFalse())
+        return constructBooleanFromImmediateBoolean(exec, globalObject, asValue());
+
+    ASSERT(isUndefinedOrNull());
+    throwException(exec, scope, createNotAnObjectError(exec, *this));
+    return nullptr;
+}
+
+JSValue JSValue::toThisSlowCase(ExecState* exec, ECMAMode ecmaMode) const
+{
+    ASSERT(!isCell());
+
+    if (ecmaMode == StrictMode)
+        return *this;
+
+    if (isInt32() || isDouble())
+        return constructNumber(exec, exec->lexicalGlobalObject(), asValue());
+    if (isTrue() || isFalse())
+        return constructBooleanFromImmediateBoolean(exec, exec->lexicalGlobalObject(), asValue());
+    ASSERT(isUndefinedOrNull());
+    return exec->globalThisValue();
+}
+
+JSObject* JSValue::synthesizePrototype(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (isCell()) {
+        if (isString())
+            return exec->lexicalGlobalObject()->stringPrototype();
+        ASSERT(isSymbol());
+        return exec->lexicalGlobalObject()->symbolPrototype();
+    }
+
+    if (isNumber())
+        return exec->lexicalGlobalObject()->numberPrototype();
+    if (isBoolean())
+        return exec->lexicalGlobalObject()->booleanPrototype();
+
+    ASSERT(isUndefinedOrNull());
+    throwException(exec, scope, createNotAnObjectError(exec, *this));
+    return nullptr;
+}
+
+// ECMA 8.7.2
+bool JSValue::putToPrimitive(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return putToPrimitiveByIndex(exec, index.value(), value, slot.isStrictMode());
+
+    // Check if there are any setters or getters in the prototype chain
+    JSObject* obj = synthesizePrototype(exec);
+    if (UNLIKELY(!obj))
+        return false;
+    JSValue prototype;
+    if (propertyName != vm.propertyNames->underscoreProto) {
+        for (; !obj->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
+            prototype = obj->getPrototypeDirect();
+            if (prototype.isNull())
+                return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+        }
+    }
+
+    for (; ; obj = asObject(prototype)) {
+        unsigned attributes;
+        PropertyOffset offset = obj->structure()->get(vm, propertyName, attributes);
+        if (offset != invalidOffset) {
+            if (attributes & ReadOnly)
+                return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+
+            JSValue gs = obj->getDirect(offset);
+            if (gs.isGetterSetter())
+                return callSetter(exec, *this, gs, value, slot.isStrictMode() ? StrictMode : NotStrictMode);
+
+            if (gs.isCustomGetterSetter())
+                return callCustomSetter(exec, gs, attributes & CustomAccessor, obj, slot.thisValue(), value);
+
+            // If there's an existing property on the object or one of its 
+            // prototypes it should be replaced, so break here.
+            break;
+        }
+
+        prototype = obj->getPrototype(vm, exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (prototype.isNull())
+            break;
+    }
+    
+    return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+}
+
+bool JSValue::putToPrimitiveByIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (propertyName > MAX_ARRAY_INDEX) {
+        PutPropertySlot slot(*this, shouldThrow);
+        return putToPrimitive(exec, Identifier::from(exec, propertyName), value, slot);
+    }
+    
+    JSObject* prototype = synthesizePrototype(exec);
+    if (UNLIKELY(!prototype)) {
+        ASSERT(scope.exception());
+        return false;
+    }
+    bool putResult = false;
+    if (prototype->attemptToInterceptPutByIndexOnHoleForPrototype(exec, *this, propertyName, value, shouldThrow, putResult))
+        return putResult;
+    
+    return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+}
+
+void JSValue::dump(PrintStream& out) const
+{
+    dumpInContext(out, 0);
+}
+
+void JSValue::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    dumpInContextAssumingStructure(
+        out, context, (!!*this && isCell()) ? asCell()->structure() : nullptr);
+}
+
+void JSValue::dumpInContextAssumingStructure(
+    PrintStream& out, DumpContext* context, Structure* structure) const
+{
+    if (!*this)
+        out.print("<JSValue()>");
+    else if (isInt32())
+        out.printf("Int32: %d", asInt32());
+    else if (isDouble()) {
+#if USE(JSVALUE64)
+        out.printf("Double: %lld, %lf", (long long)reinterpretDoubleToInt64(asDouble()), asDouble());
+#else
+        union {
+            double asDouble;
+            uint32_t asTwoInt32s[2];
+        } u;
+        u.asDouble = asDouble();
+        out.printf("Double: %08x:%08x, %lf", u.asTwoInt32s[1], u.asTwoInt32s[0], asDouble());
+#endif
+    } else if (isCell()) {
+        if (structure->classInfo()->isSubClassOf(JSString::info())) {
+            JSString* string = asString(asCell());
+            out.print("String");
+            if (string->isRope())
+                out.print(" (rope)");
+            const StringImpl* impl = string->tryGetValueImpl();
+            if (impl) {
+                if (impl->isAtomic())
+                    out.print(" (atomic)");
+                if (impl->isAtomic())
+                    out.print(" (identifier)");
+                if (impl->isSymbol())
+                    out.print(" (symbol)");
+            } else
+                out.print(" (unresolved)");
+            out.print(": ", impl);
+        } else if (structure->classInfo()->isSubClassOf(Symbol::info()))
+            out.print("Symbol: ", RawPointer(asCell()));
+        else if (structure->classInfo()->isSubClassOf(Structure::info()))
+            out.print("Structure: ", inContext(*jsCast<Structure*>(asCell()), context));
+        else if (structure->classInfo()->isSubClassOf(JSObject::info())) {
+            out.print("Object: ", RawPointer(asCell()));
+            out.print(" with butterfly ", RawPointer(asObject(asCell())->butterfly()));
+            out.print(" (", inContext(*structure, context), ")");
+        } else {
+            out.print("Cell: ", RawPointer(asCell()));
+            out.print(" (", inContext(*structure, context), ")");
+        }
+#if USE(JSVALUE64)
+        out.print(", ID: ", asCell()->structureID());
+#endif
+    } else if (isTrue())
+        out.print("True");
+    else if (isFalse())
+        out.print("False");
+    else if (isNull())
+        out.print("Null");
+    else if (isUndefined())
+        out.print("Undefined");
+    else
+        out.print("INVALID");
+}
+
+void JSValue::dumpForBacktrace(PrintStream& out) const
+{
+    if (!*this)
+        out.print("<JSValue()>");
+    else if (isInt32())
+        out.printf("%d", asInt32());
+    else if (isDouble())
+        out.printf("%lf", asDouble());
+    else if (isCell()) {
+        if (asCell()->inherits(JSString::info())) {
+            JSString* string = asString(asCell());
+            const StringImpl* impl = string->tryGetValueImpl();
+            if (impl)
+                out.print("\"", impl, "\"");
+            else
+                out.print("(unresolved string)");
+        } else if (asCell()->inherits(Structure::info())) {
+            out.print("Structure[ ", asCell()->structure()->classInfo()->className);
+#if USE(JSVALUE64)
+            out.print(" ID: ", asCell()->structureID());
+#endif
+            out.print("]: ", RawPointer(asCell()));
+        } else {
+            out.print("Cell[", asCell()->structure()->classInfo()->className);
+#if USE(JSVALUE64)
+            out.print(" ID: ", asCell()->structureID());
+#endif
+            out.print("]: ", RawPointer(asCell()));
+        }
+    } else if (isTrue())
+        out.print("True");
+    else if (isFalse())
+        out.print("False");
+    else if (isNull())
+        out.print("Null");
+    else if (isUndefined())
+        out.print("Undefined");
+    else
+        out.print("INVALID");
+}
+
+bool JSValue::isValidCallee()
+{
+    return asObject(asCell())->globalObject();
+}
+
+JSString* JSValue::toStringSlowCase(ExecState* exec, bool returnEmptyStringOnError) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    auto errorValue = [&] () -> JSString* {
+        if (returnEmptyStringOnError)
+            return jsEmptyString(exec);
+        return nullptr;
+    };
+    
+    ASSERT(!isString());
+    if (isInt32()) {
+        auto integer = asInt32();
+        if (static_cast<unsigned>(integer) <= 9)
+            return vm.smallStrings.singleCharacterString(integer + '0');
+        return jsNontrivialString(&vm, vm.numericStrings.add(integer));
+    }
+    if (isDouble())
+        return jsString(&vm, vm.numericStrings.add(asDouble()));
+    if (isTrue())
+        return vm.smallStrings.trueString();
+    if (isFalse())
+        return vm.smallStrings.falseString();
+    if (isNull())
+        return vm.smallStrings.nullString();
+    if (isUndefined())
+        return vm.smallStrings.undefinedString();
+    if (isSymbol()) {
+        throwTypeError(exec, scope, ASCIILiteral("Cannot convert a symbol to a string"));
+        return errorValue();
+    }
+
+    ASSERT(isCell());
+    JSValue value = asCell()->toPrimitive(exec, PreferString);
+    RETURN_IF_EXCEPTION(scope, errorValue());
+    ASSERT(!value.isObject());
+    JSString* result = value.toString(exec);
+    RETURN_IF_EXCEPTION(scope, errorValue());
+    return result;
+}
+
+String JSValue::toWTFStringSlowCase(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    if (isInt32())
+        return vm.numericStrings.add(asInt32());
+    if (isDouble())
+        return vm.numericStrings.add(asDouble());
+    if (isTrue())
+        return vm.propertyNames->trueKeyword.string();
+    if (isFalse())
+        return vm.propertyNames->falseKeyword.string();
+    if (isNull())
+        return vm.propertyNames->nullKeyword.string();
+    if (isUndefined())
+        return vm.propertyNames->undefinedKeyword.string();
+    return toString(exec)->value(exec);
+}
+
+} // namespace JSC
diff --git a/runtime/JSCJSValue.h b/runtime/JSCJSValue.h
new file mode 100644
index 0000000..8809fdc
--- /dev/null
+++ b/runtime/JSCJSValue.h
@@ -0,0 +1,601 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2007, 2008, 2009, 2012, 2015 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "JSExportMacros.h"
+#include "PureNaN.h"
+#include <functional>
+#include <math.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <wtf/Assertions.h>
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashTraits.h>
+#include <wtf/MathExtras.h>
+#include <wtf/MediaTime.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/TriState.h>
+
+namespace JSC {
+
+class AssemblyHelpers;
+class ExecState;
+class JSCell;
+class JSValueSource;
+class VM;
+class JSGlobalObject;
+class JSObject;
+class JSString;
+class Identifier;
+class PropertyName;
+class PropertySlot;
+class PutPropertySlot;
+class Structure;
+#if ENABLE(DFG_JIT)
+namespace DFG {
+class JITCompiler;
+class OSRExitCompiler;
+class SpeculativeJIT;
+}
+#endif
+#if !ENABLE(JIT)
+namespace LLInt {
+class CLoop;
+}
+#endif
+
+struct ClassInfo;
+struct DumpContext;
+struct Instruction;
+struct MethodTable;
+
+template <class T> class WriteBarrierBase;
+
+enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
+enum ECMAMode { StrictMode, NotStrictMode };
+
+enum class CallType : unsigned;
+struct CallData;
+enum class ConstructType : unsigned;
+struct ConstructData;
+
+typedef int64_t EncodedJSValue;
+    
+union EncodedValueDescriptor {
+    int64_t asInt64;
+#if USE(JSVALUE32_64)
+    double asDouble;
+#elif USE(JSVALUE64)
+    JSCell* ptr;
+#endif
+        
+#if CPU(BIG_ENDIAN)
+    struct {
+        int32_t tag;
+        int32_t payload;
+    } asBits;
+#else
+    struct {
+        int32_t payload;
+        int32_t tag;
+    } asBits;
+#endif
+};
+
+#define TagOffset (OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag))
+#define PayloadOffset (OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload))
+
+#if USE(JSVALUE64)
+#define CellPayloadOffset 0
+#else
+#define CellPayloadOffset PayloadOffset
+#endif
+
+enum WhichValueWord {
+    TagWord,
+    PayloadWord
+};
+
+int64_t tryConvertToInt52(double);
+bool isInt52(double);
+
+enum class SourceCodeRepresentation {
+    Other,
+    Integer,
+    Double
+};
+
+class JSValue {
+    friend struct EncodedJSValueHashTraits;
+    friend struct EncodedJSValueWithRepresentationHashTraits;
+    friend class AssemblyHelpers;
+    friend class JIT;
+    friend class JITSlowPathCall;
+    friend class JITStubs;
+    friend class JITStubCall;
+    friend class JSInterfaceJIT;
+    friend class JSValueSource;
+    friend class SpecializedThunkJIT;
+#if ENABLE(DFG_JIT)
+    friend class DFG::JITCompiler;
+    friend class DFG::OSRExitCompiler;
+    friend class DFG::SpeculativeJIT;
+#endif
+#if !ENABLE(JIT)
+    friend class LLInt::CLoop;
+#endif
+
+public:
+#if USE(JSVALUE32_64)
+    enum { Int32Tag =        0xffffffff };
+    enum { BooleanTag =      0xfffffffe };
+    enum { NullTag =         0xfffffffd };
+    enum { UndefinedTag =    0xfffffffc };
+    enum { CellTag =         0xfffffffb };
+    enum { EmptyValueTag =   0xfffffffa };
+    enum { DeletedValueTag = 0xfffffff9 };
+
+    enum { LowestTag =  DeletedValueTag };
+#endif
+
+    static EncodedJSValue encode(JSValue);
+    static JSValue decode(EncodedJSValue);
+
+    enum JSNullTag { JSNull };
+    enum JSUndefinedTag { JSUndefined };
+    enum JSTrueTag { JSTrue };
+    enum JSFalseTag { JSFalse };
+    enum EncodeAsDoubleTag { EncodeAsDouble };
+
+    JSValue();
+    JSValue(JSNullTag);
+    JSValue(JSUndefinedTag);
+    JSValue(JSTrueTag);
+    JSValue(JSFalseTag);
+    JSValue(JSCell* ptr);
+    JSValue(const JSCell* ptr);
+
+    // Numbers
+    JSValue(EncodeAsDoubleTag, double);
+    explicit JSValue(double);
+    explicit JSValue(char);
+    explicit JSValue(unsigned char);
+    explicit JSValue(short);
+    explicit JSValue(unsigned short);
+    explicit JSValue(int);
+    explicit JSValue(unsigned);
+    explicit JSValue(long);
+    explicit JSValue(unsigned long);
+    explicit JSValue(long long);
+    explicit JSValue(unsigned long long);
+
+    explicit operator bool() const;
+    bool operator==(const JSValue& other) const;
+    bool operator!=(const JSValue& other) const;
+
+    bool isInt32() const;
+    bool isUInt32() const;
+    bool isDouble() const;
+    bool isTrue() const;
+    bool isFalse() const;
+
+    int32_t asInt32() const;
+    uint32_t asUInt32() const;
+    int64_t asAnyInt() const;
+    double asDouble() const;
+    bool asBoolean() const;
+    double asNumber() const;
+    
+    int32_t asInt32ForArithmetic() const; // Boolean becomes an int, but otherwise like asInt32().
+
+    // Querying the type.
+    bool isEmpty() const;
+    bool isFunction() const;
+    bool isFunction(CallType&, CallData&) const;
+    bool isCallable(CallType&, CallData&) const;
+    bool isConstructor() const;
+    bool isConstructor(ConstructType&, ConstructData&) const;
+    bool isUndefined() const;
+    bool isNull() const;
+    bool isUndefinedOrNull() const;
+    bool isBoolean() const;
+    bool isAnyInt() const;
+    bool isNumber() const;
+    bool isString() const;
+    bool isSymbol() const;
+    bool isPrimitive() const;
+    bool isGetterSetter() const;
+    bool isCustomGetterSetter() const;
+    bool isObject() const;
+    bool inherits(const ClassInfo*) const;
+    const ClassInfo* classInfoOrNull() const;
+        
+    // Extracting the value.
+    bool getString(ExecState*, WTF::String&) const;
+    WTF::String getString(ExecState*) const; // null string if not a string
+    JSObject* getObject() const; // 0 if not an object
+
+    // Extracting integer values.
+    bool getUInt32(uint32_t&) const;
+        
+    // Basic conversions.
+    JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+    bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
+
+    bool toBoolean(ExecState*) const;
+    TriState pureToBoolean() const;
+
+    // toNumber conversion is expected to be side effect free if an exception has
+    // been set in the ExecState already.
+    double toNumber(ExecState*) const;
+
+    // toNumber conversion if it can be done without side effects.
+    std::optional<double> toNumberFromPrimitive() const;
+
+    JSString* toString(ExecState*) const; // On exception, this returns the empty string.
+    JSString* toStringOrNull(ExecState*) const; // On exception, this returns null, to make exception checks faster.
+    Identifier toPropertyKey(ExecState*) const;
+    WTF::String toWTFString(ExecState*) const;
+    JSObject* toObject(ExecState*) const;
+    JSObject* toObject(ExecState*, JSGlobalObject*) const;
+
+    // Integer conversions.
+    JS_EXPORT_PRIVATE double toInteger(ExecState*) const;
+    JS_EXPORT_PRIVATE double toIntegerPreserveNaN(ExecState*) const;
+    int32_t toInt32(ExecState*) const;
+    uint32_t toUInt32(ExecState*) const;
+    uint32_t toIndex(ExecState*, const char* errorName) const;
+    double toLength(ExecState*) const;
+
+    // Floating point conversions (this is a convenience function for WebCore;
+    // single precision float is not a representation used in JS or JSC).
+    float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
+
+    // Object operations, with the toObject operation included.
+    JSValue get(ExecState*, PropertyName) const;
+    JSValue get(ExecState*, PropertyName, PropertySlot&) const;
+    JSValue get(ExecState*, unsigned propertyName) const;
+    JSValue get(ExecState*, unsigned propertyName, PropertySlot&) const;
+    JSValue get(ExecState*, uint64_t propertyName) const;
+
+    bool getPropertySlot(ExecState*, PropertyName, PropertySlot&) const;
+    template<typename CallbackWhenNoException> typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type getPropertySlot(ExecState*, PropertyName, CallbackWhenNoException) const;
+    template<typename CallbackWhenNoException> typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type getPropertySlot(ExecState*, PropertyName, PropertySlot&, CallbackWhenNoException) const;
+
+    bool put(ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    bool putInline(ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    JS_EXPORT_PRIVATE bool putToPrimitive(ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    JS_EXPORT_PRIVATE bool putToPrimitiveByIndex(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    bool putByIndex(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+
+    JSValue toThis(ExecState*, ECMAMode) const;
+
+    static bool equal(ExecState*, JSValue v1, JSValue v2);
+    static bool equalSlowCase(ExecState*, JSValue v1, JSValue v2);
+    static bool equalSlowCaseInline(ExecState*, JSValue v1, JSValue v2);
+    static bool strictEqual(ExecState*, JSValue v1, JSValue v2);
+    static bool strictEqualSlowCase(ExecState*, JSValue v1, JSValue v2);
+    static bool strictEqualSlowCaseInline(ExecState*, JSValue v1, JSValue v2);
+    static TriState pureStrictEqual(JSValue v1, JSValue v2);
+
+    bool isCell() const;
+    JSCell* asCell() const;
+    JS_EXPORT_PRIVATE bool isValidCallee();
+
+    Structure* structureOrNull() const;
+    JSValue structureOrUndefined() const;
+
+    JS_EXPORT_PRIVATE void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dumpInContextAssumingStructure(PrintStream&, DumpContext*, Structure*) const;
+    void dumpForBacktrace(PrintStream&) const;
+
+    JS_EXPORT_PRIVATE JSObject* synthesizePrototype(ExecState*) const;
+    bool requireObjectCoercible(ExecState*) const;
+
+    // Constants used for Int52. Int52 isn't part of JSValue right now, but JSValues may be
+    // converted to Int52s and back again.
+    static const unsigned numberOfInt52Bits = 52;
+    static const int64_t notInt52 = static_cast<int64_t>(1) << numberOfInt52Bits;
+    static const unsigned int52ShiftAmount = 12;
+    
+    static ptrdiff_t offsetOfPayload() { return OBJECT_OFFSETOF(JSValue, u.asBits.payload); }
+    static ptrdiff_t offsetOfTag() { return OBJECT_OFFSETOF(JSValue, u.asBits.tag); }
+
+#if USE(JSVALUE32_64)
+    /*
+     * On 32-bit platforms USE(JSVALUE32_64) should be defined, and we use a NaN-encoded
+     * form for immediates.
+     *
+     * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
+     * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
+     * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
+     * have a payload of zero.  We assume that non-zero payloads are available to encode
+     * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
+     * all set represents a NaN with a non-zero payload, we can use this space in the NaN
+     * ranges to encode other values (however there are also other ranges of NaN space that
+     * could have been selected).
+     *
+     * For JSValues that do not contain a double value, the high 32 bits contain the tag
+     * values listed in the enums below, which all correspond to NaN-space. In the case of
+     * cell, integer and bool values the lower 32 bits (the 'payload') contain the pointer
+     * integer or boolean value; in the case of all other tags the payload is 0.
+     */
+    uint32_t tag() const;
+    int32_t payload() const;
+
+#if !ENABLE(JIT)
+    // This should only be used by the LLInt C Loop interpreter who needs
+    // synthesize JSValue from its "register"s holding tag and payload
+    // values.
+    explicit JSValue(int32_t tag, int32_t payload);
+#endif
+
+#elif USE(JSVALUE64)
+    /*
+     * On 64-bit platforms USE(JSVALUE64) should be defined, and we use a NaN-encoded
+     * form for immediates.
+     *
+     * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
+     * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
+     * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
+     * have a payload of zero.  We assume that non-zero payloads are available to encode
+     * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
+     * all set represents a NaN with a non-zero payload, we can use this space in the NaN
+     * ranges to encode other values (however there are also other ranges of NaN space that
+     * could have been selected).
+     *
+     * This range of NaN space is represented by 64-bit numbers begining with the 16-bit
+     * hex patterns 0xFFFE and 0xFFFF - we rely on the fact that no valid double-precision
+     * numbers will fall in these ranges.
+     *
+     * The top 16-bits denote the type of the encoded JSValue:
+     *
+     *     Pointer {  0000:PPPP:PPPP:PPPP
+     *              / 0001:****:****:****
+     *     Double  {         ...
+     *              \ FFFE:****:****:****
+     *     Integer {  FFFF:0000:IIII:IIII
+     *
+     * The scheme we have implemented encodes double precision values by performing a
+     * 64-bit integer addition of the value 2^48 to the number. After this manipulation
+     * no encoded double-precision value will begin with the pattern 0x0000 or 0xFFFF.
+     * Values must be decoded by reversing this operation before subsequent floating point
+     * operations may be peformed.
+     *
+     * 32-bit signed integers are marked with the 16-bit tag 0xFFFF.
+     *
+     * The tag 0x0000 denotes a pointer, or another form of tagged immediate. Boolean,
+     * null and undefined values are represented by specific, invalid pointer values:
+     *
+     *     False:     0x06
+     *     True:      0x07
+     *     Undefined: 0x0a
+     *     Null:      0x02
+     *
+     * These values have the following properties:
+     * - Bit 1 (TagBitTypeOther) is set for all four values, allowing real pointers to be
+     *   quickly distinguished from all immediate values, including these invalid pointers.
+     * - With bit 3 is masked out (TagBitUndefined) Undefined and Null share the
+     *   same value, allowing null & undefined to be quickly detected.
+     *
+     * No valid JSValue will have the bit pattern 0x0, this is used to represent array
+     * holes, and as a C++ 'no value' result (e.g. JSValue() has an internal value of 0).
+     */
+
+    // These values are #defines since using static const integers here is a ~1% regression!
+
+    // This value is 2^48, used to encode doubles such that the encoded value will begin
+    // with a 16-bit pattern within the range 0x0001..0xFFFE.
+    #define DoubleEncodeOffset 0x1000000000000ll
+    // If all bits in the mask are set, this indicates an integer number,
+    // if any but not all are set this value is a double precision number.
+    #define TagTypeNumber 0xffff000000000000ll
+
+    // All non-numeric (bool, null, undefined) immediates have bit 2 set.
+    #define TagBitTypeOther 0x2ll
+    #define TagBitBool      0x4ll
+    #define TagBitUndefined 0x8ll
+    // Combined integer value for non-numeric immediates.
+    #define ValueFalse     (TagBitTypeOther | TagBitBool | false)
+    #define ValueTrue      (TagBitTypeOther | TagBitBool | true)
+    #define ValueUndefined (TagBitTypeOther | TagBitUndefined)
+    #define ValueNull      (TagBitTypeOther)
+
+    // TagMask is used to check for all types of immediate values (either number or 'other').
+    #define TagMask (TagTypeNumber | TagBitTypeOther)
+
+    // These special values are never visible to JavaScript code; Empty is used to represent
+    // Array holes, and for uninitialized JSValues. Deleted is used in hash table code.
+    // These values would map to cell types in the JSValue encoding, but not valid GC cell
+    // pointer should have either of these values (Empty is null, deleted is at an invalid
+    // alignment for a GC cell, and in the zero page).
+    #define ValueEmpty   0x0ll
+    #define ValueDeleted 0x4ll
+#endif
+
+private:
+    template <class T> JSValue(WriteBarrierBase<T>);
+
+    enum HashTableDeletedValueTag { HashTableDeletedValue };
+    JSValue(HashTableDeletedValueTag);
+
+    inline const JSValue asValue() const { return *this; }
+    JS_EXPORT_PRIVATE double toNumberSlowCase(ExecState*) const;
+    JS_EXPORT_PRIVATE JSString* toStringSlowCase(ExecState*, bool returnEmptyStringOnError) const;
+    JS_EXPORT_PRIVATE WTF::String toWTFStringSlowCase(ExecState*) const;
+    JS_EXPORT_PRIVATE JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
+    JS_EXPORT_PRIVATE JSValue toThisSlowCase(ExecState*, ECMAMode) const;
+
+    EncodedValueDescriptor u;
+};
+
+typedef IntHash<EncodedJSValue> EncodedJSValueHash;
+
+#if USE(JSVALUE32_64)
+struct EncodedJSValueHashTraits : HashTraits<EncodedJSValue> {
+    static const bool emptyValueIsZero = false;
+    static EncodedJSValue emptyValue() { return JSValue::encode(JSValue()); }
+    static void constructDeletedValue(EncodedJSValue& slot) { slot = JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+    static bool isDeletedValue(EncodedJSValue value) { return value == JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+};
+#else
+struct EncodedJSValueHashTraits : HashTraits<EncodedJSValue> {
+    static void constructDeletedValue(EncodedJSValue& slot) { slot = JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+    static bool isDeletedValue(EncodedJSValue value) { return value == JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+};
+#endif
+
+typedef std::pair<EncodedJSValue, SourceCodeRepresentation> EncodedJSValueWithRepresentation;
+
+struct EncodedJSValueWithRepresentationHashTraits : HashTraits<EncodedJSValueWithRepresentation> {
+    static const bool emptyValueIsZero = false;
+    static EncodedJSValueWithRepresentation emptyValue() { return std::make_pair(JSValue::encode(JSValue()), SourceCodeRepresentation::Other); }
+    static void constructDeletedValue(EncodedJSValueWithRepresentation& slot) { slot = std::make_pair(JSValue::encode(JSValue(JSValue::HashTableDeletedValue)), SourceCodeRepresentation::Other); }
+    static bool isDeletedValue(EncodedJSValueWithRepresentation value) { return value == std::make_pair(JSValue::encode(JSValue(JSValue::HashTableDeletedValue)), SourceCodeRepresentation::Other); }
+};
+
+struct EncodedJSValueWithRepresentationHash {
+    static unsigned hash(const EncodedJSValueWithRepresentation& value)
+    {
+        return WTF::pairIntHash(EncodedJSValueHash::hash(value.first), IntHash<SourceCodeRepresentation>::hash(value.second));
+    }
+    static bool equal(const EncodedJSValueWithRepresentation& a, const EncodedJSValueWithRepresentation& b)
+    {
+        return a == b;
+    }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+// Stand-alone helper functions.
+inline JSValue jsNull()
+{
+    return JSValue(JSValue::JSNull);
+}
+
+inline JSValue jsUndefined()
+{
+    return JSValue(JSValue::JSUndefined);
+}
+
+inline JSValue jsTDZValue()
+{
+    return JSValue();
+}
+
+inline JSValue jsBoolean(bool b)
+{
+    return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
+}
+
+ALWAYS_INLINE JSValue jsDoubleNumber(double d)
+{
+    ASSERT(JSValue(JSValue::EncodeAsDouble, d).isNumber());
+    return JSValue(JSValue::EncodeAsDouble, d);
+}
+
+ALWAYS_INLINE JSValue jsNumber(double d)
+{
+    ASSERT(JSValue(d).isNumber());
+    return JSValue(d);
+}
+
+ALWAYS_INLINE JSValue jsNumber(MediaTime t)
+{
+    return jsNumber(t.toDouble());
+}
+
+ALWAYS_INLINE JSValue jsNumber(char i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(unsigned char i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(short i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(unsigned short i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(int i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(unsigned i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(long i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(unsigned long i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(long long i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE JSValue jsNumber(unsigned long long i)
+{
+    return JSValue(i);
+}
+
+ALWAYS_INLINE EncodedJSValue encodedJSUndefined()
+{
+    return JSValue::encode(jsUndefined());
+}
+
+ALWAYS_INLINE EncodedJSValue encodedJSValue()
+{
+    return JSValue::encode(JSValue());
+}
+
+inline bool operator==(const JSValue a, const JSCell* b) { return a == JSValue(b); }
+inline bool operator==(const JSCell* a, const JSValue b) { return JSValue(a) == b; }
+
+inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
+inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
+
+
+bool isThisValueAltered(const PutPropertySlot&, JSObject* baseObject);
+
+// See section 7.2.9: https://tc39.github.io/ecma262/#sec-samevalue
+bool sameValue(ExecState*, JSValue a, JSValue b);
+
+} // namespace JSC
diff --git a/runtime/JSCJSValueInlines.h b/runtime/JSCJSValueInlines.h
new file mode 100644
index 0000000..74963ac
--- /dev/null
+++ b/runtime/JSCJSValueInlines.h
@@ -0,0 +1,1096 @@
+/*
+ * Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "Identifier.h"
+#include "InternalFunction.h"
+#include "JSCJSValue.h"
+#include "JSCellInlines.h"
+#include "JSFunction.h"
+#include "JSObject.h"
+#include "JSStringInlines.h"
+#include "MathCommon.h"
+#include <wtf/text/StringImpl.h>
+
+namespace JSC {
+
+ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
+{
+    if (isInt32())
+        return asInt32();
+    return JSC::toInt32(toNumber(exec));
+}
+
+inline uint32_t JSValue::toUInt32(ExecState* exec) const
+{
+    // See comment on JSC::toUInt32, in JSCJSValue.h.
+    return toInt32(exec);
+}
+
+inline uint32_t JSValue::toIndex(ExecState* exec, const char* errorName) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    double d = toNumber(exec);
+
+    if (d <= -1) {
+        throwException(exec, scope, createRangeError(exec, makeString(errorName, " cannot be negative")));
+        return 0;
+    }
+    if (d > std::numeric_limits<unsigned>::max()) {
+        throwException(exec, scope, createRangeError(exec, makeString(errorName, " too large")));
+        return 0;
+    }
+
+    if (isInt32())
+        return asInt32();
+    return JSC::toInt32(d);
+}
+
+inline bool JSValue::isUInt32() const
+{
+    return isInt32() && asInt32() >= 0;
+}
+
+inline uint32_t JSValue::asUInt32() const
+{
+    ASSERT(isUInt32());
+    return asInt32();
+}
+
+inline double JSValue::asNumber() const
+{
+    ASSERT(isNumber());
+    return isInt32() ? asInt32() : asDouble();
+}
+
+inline JSValue jsNaN()
+{
+    return JSValue(JSValue::EncodeAsDouble, PNaN);
+}
+
+inline JSValue::JSValue(char i)
+{
+    *this = JSValue(static_cast<int32_t>(i));
+}
+
+inline JSValue::JSValue(unsigned char i)
+{
+    *this = JSValue(static_cast<int32_t>(i));
+}
+
+inline JSValue::JSValue(short i)
+{
+    *this = JSValue(static_cast<int32_t>(i));
+}
+
+inline JSValue::JSValue(unsigned short i)
+{
+    *this = JSValue(static_cast<int32_t>(i));
+}
+
+inline JSValue::JSValue(unsigned i)
+{
+    if (static_cast<int32_t>(i) < 0) {
+        *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+        return;
+    }
+    *this = JSValue(static_cast<int32_t>(i));
+}
+
+inline JSValue::JSValue(long i)
+{
+    if (static_cast<int32_t>(i) != i) {
+        *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+        return;
+    }
+    *this = JSValue(static_cast<int32_t>(i));
+}
+
+inline JSValue::JSValue(unsigned long i)
+{
+    if (static_cast<uint32_t>(i) != i) {
+        *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+        return;
+    }
+    *this = JSValue(static_cast<uint32_t>(i));
+}
+
+inline JSValue::JSValue(long long i)
+{
+    if (static_cast<int32_t>(i) != i) {
+        *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+        return;
+    }
+    *this = JSValue(static_cast<int32_t>(i));
+}
+
+inline JSValue::JSValue(unsigned long long i)
+{
+    if (static_cast<uint32_t>(i) != i) {
+        *this = JSValue(EncodeAsDouble, static_cast<double>(i));
+        return;
+    }
+    *this = JSValue(static_cast<uint32_t>(i));
+}
+
+inline JSValue::JSValue(double d)
+{
+    // Note: while this behavior is undefined for NaN and inf, the subsequent statement will catch these cases.
+    const int32_t asInt32 = static_cast<int32_t>(d);
+    if (asInt32 != d || (!asInt32 && std::signbit(d))) { // true for -0.0
+        *this = JSValue(EncodeAsDouble, d);
+        return;
+    }
+    *this = JSValue(static_cast<int32_t>(d));
+}
+
+inline EncodedJSValue JSValue::encode(JSValue value)
+{
+    return value.u.asInt64;
+}
+
+inline JSValue JSValue::decode(EncodedJSValue encodedJSValue)
+{
+    JSValue v;
+    v.u.asInt64 = encodedJSValue;
+    return v;
+}
+
+#if USE(JSVALUE32_64)
+inline JSValue::JSValue()
+{
+    u.asBits.tag = EmptyValueTag;
+    u.asBits.payload = 0;
+}
+
+inline JSValue::JSValue(JSNullTag)
+{
+    u.asBits.tag = NullTag;
+    u.asBits.payload = 0;
+}
+    
+inline JSValue::JSValue(JSUndefinedTag)
+{
+    u.asBits.tag = UndefinedTag;
+    u.asBits.payload = 0;
+}
+    
+inline JSValue::JSValue(JSTrueTag)
+{
+    u.asBits.tag = BooleanTag;
+    u.asBits.payload = 1;
+}
+    
+inline JSValue::JSValue(JSFalseTag)
+{
+    u.asBits.tag = BooleanTag;
+    u.asBits.payload = 0;
+}
+
+inline JSValue::JSValue(HashTableDeletedValueTag)
+{
+    u.asBits.tag = DeletedValueTag;
+    u.asBits.payload = 0;
+}
+
+inline JSValue::JSValue(JSCell* ptr)
+{
+    if (ptr)
+        u.asBits.tag = CellTag;
+    else
+        u.asBits.tag = EmptyValueTag;
+    u.asBits.payload = reinterpret_cast<int32_t>(ptr);
+}
+
+inline JSValue::JSValue(const JSCell* ptr)
+{
+    if (ptr)
+        u.asBits.tag = CellTag;
+    else
+        u.asBits.tag = EmptyValueTag;
+    u.asBits.payload = reinterpret_cast<int32_t>(const_cast<JSCell*>(ptr));
+}
+
+inline JSValue::operator bool() const
+{
+    ASSERT(tag() != DeletedValueTag);
+    return tag() != EmptyValueTag;
+}
+
+inline bool JSValue::operator==(const JSValue& other) const
+{
+    return u.asInt64 == other.u.asInt64;
+}
+
+inline bool JSValue::operator!=(const JSValue& other) const
+{
+    return u.asInt64 != other.u.asInt64;
+}
+
+inline bool JSValue::isEmpty() const
+{
+    return tag() == EmptyValueTag;
+}
+
+inline bool JSValue::isUndefined() const
+{
+    return tag() == UndefinedTag;
+}
+
+inline bool JSValue::isNull() const
+{
+    return tag() == NullTag;
+}
+
+inline bool JSValue::isUndefinedOrNull() const
+{
+    return isUndefined() || isNull();
+}
+
+inline bool JSValue::isCell() const
+{
+    return tag() == CellTag;
+}
+
+inline bool JSValue::isInt32() const
+{
+    return tag() == Int32Tag;
+}
+
+inline bool JSValue::isDouble() const
+{
+    return tag() < LowestTag;
+}
+
+inline bool JSValue::isTrue() const
+{
+    return tag() == BooleanTag && payload();
+}
+
+inline bool JSValue::isFalse() const
+{
+    return tag() == BooleanTag && !payload();
+}
+
+inline uint32_t JSValue::tag() const
+{
+    return u.asBits.tag;
+}
+    
+inline int32_t JSValue::payload() const
+{
+    return u.asBits.payload;
+}
+    
+inline int32_t JSValue::asInt32() const
+{
+    ASSERT(isInt32());
+    return u.asBits.payload;
+}
+    
+inline double JSValue::asDouble() const
+{
+    ASSERT(isDouble());
+    return u.asDouble;
+}
+    
+ALWAYS_INLINE JSCell* JSValue::asCell() const
+{
+    ASSERT(isCell());
+    return reinterpret_cast<JSCell*>(u.asBits.payload);
+}
+
+ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
+{
+    ASSERT(!isImpureNaN(d));
+    u.asDouble = d;
+}
+
+inline JSValue::JSValue(int i)
+{
+    u.asBits.tag = Int32Tag;
+    u.asBits.payload = i;
+}
+
+#if !ENABLE(JIT)
+inline JSValue::JSValue(int32_t tag, int32_t payload)
+{
+    u.asBits.tag = tag;
+    u.asBits.payload = payload;
+}
+#endif
+
+inline bool JSValue::isNumber() const
+{
+    return isInt32() || isDouble();
+}
+
+inline bool JSValue::isBoolean() const
+{
+    return tag() == BooleanTag;
+}
+
+inline bool JSValue::asBoolean() const
+{
+    ASSERT(isBoolean());
+    return payload();
+}
+
+#else // !USE(JSVALUE32_64) i.e. USE(JSVALUE64)
+
+// 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
+inline JSValue::JSValue()
+{
+    u.asInt64 = ValueEmpty;
+}
+
+// 0x4 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x4, which is in the (invalid) zero page.
+inline JSValue::JSValue(HashTableDeletedValueTag)
+{
+    u.asInt64 = ValueDeleted;
+}
+
+inline JSValue::JSValue(JSCell* ptr)
+{
+    u.asInt64 = reinterpret_cast<uintptr_t>(ptr);
+}
+
+inline JSValue::JSValue(const JSCell* ptr)
+{
+    u.asInt64 = reinterpret_cast<uintptr_t>(const_cast<JSCell*>(ptr));
+}
+
+inline JSValue::operator bool() const
+{
+    return u.asInt64;
+}
+
+inline bool JSValue::operator==(const JSValue& other) const
+{
+    return u.asInt64 == other.u.asInt64;
+}
+
+inline bool JSValue::operator!=(const JSValue& other) const
+{
+    return u.asInt64 != other.u.asInt64;
+}
+
+inline bool JSValue::isEmpty() const
+{
+    return u.asInt64 == ValueEmpty;
+}
+
+inline bool JSValue::isUndefined() const
+{
+    return asValue() == JSValue(JSUndefined);
+}
+
+inline bool JSValue::isNull() const
+{
+    return asValue() == JSValue(JSNull);
+}
+
+inline bool JSValue::isTrue() const
+{
+    return asValue() == JSValue(JSTrue);
+}
+
+inline bool JSValue::isFalse() const
+{
+    return asValue() == JSValue(JSFalse);
+}
+
+inline bool JSValue::asBoolean() const
+{
+    ASSERT(isBoolean());
+    return asValue() == JSValue(JSTrue);
+}
+
+inline int32_t JSValue::asInt32() const
+{
+    ASSERT(isInt32());
+    return static_cast<int32_t>(u.asInt64);
+}
+
+inline bool JSValue::isDouble() const
+{
+    return isNumber() && !isInt32();
+}
+
+inline JSValue::JSValue(JSNullTag)
+{
+    u.asInt64 = ValueNull;
+}
+    
+inline JSValue::JSValue(JSUndefinedTag)
+{
+    u.asInt64 = ValueUndefined;
+}
+
+inline JSValue::JSValue(JSTrueTag)
+{
+    u.asInt64 = ValueTrue;
+}
+
+inline JSValue::JSValue(JSFalseTag)
+{
+    u.asInt64 = ValueFalse;
+}
+
+inline bool JSValue::isUndefinedOrNull() const
+{
+    // Undefined and null share the same value, bar the 'undefined' bit in the extended tag.
+    return (u.asInt64 & ~TagBitUndefined) == ValueNull;
+}
+
+inline bool JSValue::isBoolean() const
+{
+    return (u.asInt64 & ~1) == ValueFalse;
+}
+
+inline bool JSValue::isCell() const
+{
+    return !(u.asInt64 & TagMask);
+}
+
+inline bool JSValue::isInt32() const
+{
+    return (u.asInt64 & TagTypeNumber) == TagTypeNumber;
+}
+
+inline int64_t reinterpretDoubleToInt64(double value)
+{
+    return bitwise_cast<int64_t>(value);
+}
+inline double reinterpretInt64ToDouble(int64_t value)
+{
+    return bitwise_cast<double>(value);
+}
+
+ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, double d)
+{
+    ASSERT(!isImpureNaN(d));
+    u.asInt64 = reinterpretDoubleToInt64(d) + DoubleEncodeOffset;
+}
+
+inline JSValue::JSValue(int i)
+{
+    u.asInt64 = TagTypeNumber | static_cast<uint32_t>(i);
+}
+
+inline double JSValue::asDouble() const
+{
+    ASSERT(isDouble());
+    return reinterpretInt64ToDouble(u.asInt64 - DoubleEncodeOffset);
+}
+
+inline bool JSValue::isNumber() const
+{
+    return u.asInt64 & TagTypeNumber;
+}
+
+ALWAYS_INLINE JSCell* JSValue::asCell() const
+{
+    ASSERT(isCell());
+    return u.ptr;
+}
+
+#endif // USE(JSVALUE64)
+
+inline int64_t tryConvertToInt52(double number)
+{
+    if (number != number)
+        return JSValue::notInt52;
+#if OS(WINDOWS) && CPU(X86)
+    // The VS Compiler for 32-bit builds generates a floating point error when attempting to cast
+    // from an infinity to a 64-bit integer. We leave this routine with the floating point error
+    // left in a register, causing undefined behavior in later floating point operations.
+    //
+    // To avoid this issue, we check for infinity here, and return false in that case.
+    if (std::isinf(number))
+        return JSValue::notInt52;
+#endif
+    int64_t asInt64 = static_cast<int64_t>(number);
+    if (asInt64 != number)
+        return JSValue::notInt52;
+    if (!asInt64 && std::signbit(number))
+        return JSValue::notInt52;
+    if (asInt64 >= (static_cast<int64_t>(1) << (JSValue::numberOfInt52Bits - 1)))
+        return JSValue::notInt52;
+    if (asInt64 < -(static_cast<int64_t>(1) << (JSValue::numberOfInt52Bits - 1)))
+        return JSValue::notInt52;
+    return asInt64;
+}
+
+inline bool isInt52(double number)
+{
+    return tryConvertToInt52(number) != JSValue::notInt52;
+}
+
+inline bool JSValue::isAnyInt() const
+{
+    if (isInt32())
+        return true;
+    if (!isNumber())
+        return false;
+    return isInt52(asDouble());
+}
+
+inline int64_t JSValue::asAnyInt() const
+{
+    ASSERT(isAnyInt());
+    if (isInt32())
+        return asInt32();
+    return static_cast<int64_t>(asDouble());
+}
+
+inline bool JSValue::isString() const
+{
+    return isCell() && asCell()->isString();
+}
+
+inline bool JSValue::isSymbol() const
+{
+    return isCell() && asCell()->isSymbol();
+}
+
+inline bool JSValue::isPrimitive() const
+{
+    return !isCell() || asCell()->isString() || asCell()->isSymbol();
+}
+
+inline bool JSValue::isGetterSetter() const
+{
+    return isCell() && asCell()->isGetterSetter();
+}
+
+inline bool JSValue::isCustomGetterSetter() const
+{
+    return isCell() && asCell()->isCustomGetterSetter();
+}
+
+inline bool JSValue::isObject() const
+{
+    return isCell() && asCell()->isObject();
+}
+
+inline bool JSValue::getString(ExecState* exec, String& s) const
+{
+    return isCell() && asCell()->getString(exec, s);
+}
+
+inline String JSValue::getString(ExecState* exec) const
+{
+    return isCell() ? asCell()->getString(exec) : String();
+}
+
+template <typename Base> String HandleConverter<Base, Unknown>::getString(ExecState* exec) const
+{
+    return jsValue().getString(exec);
+}
+
+inline JSObject* JSValue::getObject() const
+{
+    return isCell() ? asCell()->getObject() : 0;
+}
+
+ALWAYS_INLINE bool JSValue::getUInt32(uint32_t& v) const
+{
+    if (isInt32()) {
+        int32_t i = asInt32();
+        v = static_cast<uint32_t>(i);
+        return i >= 0;
+    }
+    if (isDouble()) {
+        double d = asDouble();
+        v = static_cast<uint32_t>(d);
+        return v == d;
+    }
+    return false;
+}
+
+ALWAYS_INLINE Identifier JSValue::toPropertyKey(ExecState* exec) const
+{
+    if (isString())
+        return asString(*this)->toIdentifier(exec);
+
+    JSValue primitive = toPrimitive(exec, PreferString);
+    if (primitive.isSymbol())
+        return Identifier::fromUid(asSymbol(primitive)->privateName());
+    return primitive.toString(exec)->toIdentifier(exec);
+}
+
+inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+{
+    return isCell() ? asCell()->toPrimitive(exec, preferredType) : asValue();
+}
+
+inline PreferredPrimitiveType toPreferredPrimitiveType(ExecState* exec, JSValue value)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!value.isString()) {
+        throwTypeError(exec, scope, ASCIILiteral("Primitive hint is not a string."));
+        return NoPreference;
+    }
+
+    StringImpl* hintString = asString(value)->value(exec).impl();
+    RETURN_IF_EXCEPTION(scope, NoPreference);
+
+    if (WTF::equal(hintString, "default"))
+        return NoPreference;
+    if (WTF::equal(hintString, "number"))
+        return PreferNumber;
+    if (WTF::equal(hintString, "string"))
+        return PreferString;
+
+    throwTypeError(exec, scope, ASCIILiteral("Expected primitive hint to match one of 'default', 'number', 'string'."));
+    return NoPreference;
+}
+
+inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
+{
+    if (isInt32()) {
+        number = asInt32();
+        value = *this;
+        return true;
+    }
+    if (isDouble()) {
+        number = asDouble();
+        value = *this;
+        return true;
+    }
+    if (isCell())
+        return asCell()->getPrimitiveNumber(exec, number, value);
+    if (isTrue()) {
+        number = 1.0;
+        value = *this;
+        return true;
+    }
+    if (isFalse() || isNull()) {
+        number = 0.0;
+        value = *this;
+        return true;
+    }
+    ASSERT(isUndefined());
+    number = PNaN;
+    value = *this;
+    return true;
+}
+
+ALWAYS_INLINE double JSValue::toNumber(ExecState* exec) const
+{
+    if (isInt32())
+        return asInt32();
+    if (isDouble())
+        return asDouble();
+    return toNumberSlowCase(exec);
+}
+
+inline JSObject* JSValue::toObject(ExecState* exec) const
+{
+    return isCell() ? asCell()->toObject(exec, exec->lexicalGlobalObject()) : toObjectSlowCase(exec, exec->lexicalGlobalObject());
+}
+
+inline JSObject* JSValue::toObject(ExecState* exec, JSGlobalObject* globalObject) const
+{
+    return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
+}
+
+inline bool JSValue::isFunction() const
+{
+    if (!isCell())
+        return false;
+    JSCell* cell = asCell();
+    CallData ignored;
+    return cell->methodTable()->getCallData(cell, ignored) != CallType::None;
+}
+
+inline bool JSValue::isFunction(CallType& callType, CallData& callData) const
+{
+    return isCallable(callType, callData);
+}
+
+inline bool JSValue::isCallable(CallType& callType, CallData& callData) const
+{
+    if (!isCell())
+        return false;
+    JSCell* cell = asCell();
+    callType = cell->methodTable()->getCallData(cell, callData);
+    return callType != CallType::None;
+}
+
+inline bool JSValue::isConstructor() const
+{
+    if (!isCell())
+        return false;
+    JSCell* cell = asCell();
+    ConstructData ignored;
+    return cell->methodTable()->getConstructData(cell, ignored) != ConstructType::None;
+}
+
+inline bool JSValue::isConstructor(ConstructType& constructType, ConstructData& constructData) const
+{
+    if (!isCell())
+        return false;
+    JSCell* cell = asCell();
+    constructType = cell->methodTable()->getConstructData(cell, constructData);
+    return constructType != ConstructType::None;
+}
+
+// this method is here to be after the inline declaration of JSCell::inherits
+inline bool JSValue::inherits(const ClassInfo* classInfo) const
+{
+    return isCell() && asCell()->inherits(classInfo);
+}
+
+inline const ClassInfo* JSValue::classInfoOrNull() const
+{
+    return isCell() ? asCell()->classInfo() : nullptr;
+}
+
+inline JSValue JSValue::toThis(ExecState* exec, ECMAMode ecmaMode) const
+{
+    return isCell() ? asCell()->methodTable(exec->vm())->toThis(asCell(), exec, ecmaMode) : toThisSlowCase(exec, ecmaMode);
+}
+
+ALWAYS_INLINE JSValue JSValue::get(ExecState* exec, PropertyName propertyName) const
+{
+    PropertySlot slot(asValue(), PropertySlot::InternalMethodType::Get);
+    return get(exec, propertyName, slot);
+}
+
+ALWAYS_INLINE JSValue JSValue::get(ExecState* exec, PropertyName propertyName, PropertySlot& slot) const
+{
+    return getPropertySlot(exec, propertyName, slot) ? 
+        slot.getValue(exec, propertyName) : jsUndefined();
+}
+
+template<typename CallbackWhenNoException>
+ALWAYS_INLINE typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type JSValue::getPropertySlot(ExecState* exec, PropertyName propertyName, CallbackWhenNoException callback) const
+{
+    PropertySlot slot(asValue(), PropertySlot::InternalMethodType::Get);
+    return getPropertySlot(exec, propertyName, slot, callback);
+}
+
+template<typename CallbackWhenNoException>
+ALWAYS_INLINE typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type JSValue::getPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot, CallbackWhenNoException callback) const
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    bool found = getPropertySlot(exec, propertyName, slot);
+    RETURN_IF_EXCEPTION(scope, { });
+    return callback(found, slot);
+}
+
+ALWAYS_INLINE bool JSValue::getPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot) const
+{
+    // If this is a primitive, we'll need to synthesize the prototype -
+    // and if it's a string there are special properties to check first.
+    JSObject* object;
+    if (UNLIKELY(!isObject())) {
+        if (isString() && asString(*this)->getStringPropertySlot(exec, propertyName, slot))
+            return true;
+        object = synthesizePrototype(exec);
+        if (UNLIKELY(!object))
+            return false;
+    } else
+        object = asObject(asCell());
+    
+    return object->getPropertySlot(exec, propertyName, slot);
+}
+
+ALWAYS_INLINE JSValue JSValue::get(ExecState* exec, unsigned propertyName) const
+{
+    PropertySlot slot(asValue(), PropertySlot::InternalMethodType::Get);
+    return get(exec, propertyName, slot);
+}
+
+ALWAYS_INLINE JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
+{
+    // If this is a primitive, we'll need to synthesize the prototype -
+    // and if it's a string there are special properties to check first.
+    JSObject* object;
+    if (UNLIKELY(!isObject())) {
+        if (isString() && asString(*this)->getStringPropertySlot(exec, propertyName, slot))
+            return slot.getValue(exec, propertyName);
+        object = synthesizePrototype(exec);
+        if (UNLIKELY(!object))
+            return JSValue();
+    } else
+        object = asObject(asCell());
+    
+    if (object->getPropertySlot(exec, propertyName, slot))
+        return slot.getValue(exec, propertyName);
+    return jsUndefined();
+}
+
+ALWAYS_INLINE JSValue JSValue::get(ExecState* exec, uint64_t propertyName) const
+{
+    if (LIKELY(propertyName <= std::numeric_limits<unsigned>::max()))
+        return get(exec, static_cast<unsigned>(propertyName));
+    return get(exec, Identifier::from(exec, static_cast<double>(propertyName)));
+}
+
+inline bool JSValue::put(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    if (UNLIKELY(!isCell()))
+        return putToPrimitive(exec, propertyName, value, slot);
+
+    return asCell()->methodTable(exec->vm())->put(asCell(), exec, propertyName, value, slot);
+}
+
+ALWAYS_INLINE bool JSValue::putInline(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    if (UNLIKELY(!isCell()))
+        return putToPrimitive(exec, propertyName, value, slot);
+
+    JSCell* cell = asCell();
+    auto putMethod = cell->methodTable(exec->vm())->put;
+    if (LIKELY(putMethod == JSObject::put))
+        return JSObject::putInline(cell, exec, propertyName, value, slot);
+
+    PutPropertySlot otherSlot = slot;
+    bool result = putMethod(cell, exec, propertyName, value, otherSlot);
+    slot = otherSlot;
+    return result;
+}
+
+inline bool JSValue::putByIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    if (UNLIKELY(!isCell()))
+        return putToPrimitiveByIndex(exec, propertyName, value, shouldThrow);
+
+    return asCell()->methodTable(exec->vm())->putByIndex(asCell(), exec, propertyName, value, shouldThrow);
+}
+
+inline Structure* JSValue::structureOrNull() const
+{
+    if (isCell())
+        return asCell()->structure();
+    return nullptr;
+}
+
+inline JSValue JSValue::structureOrUndefined() const
+{
+    if (isCell())
+        return JSValue(asCell()->structure());
+    return jsUndefined();
+}
+
+// ECMA 11.9.3
+inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
+{
+    if (v1.isInt32() && v2.isInt32())
+        return v1 == v2;
+
+    return equalSlowCase(exec, v1, v2);
+}
+
+ALWAYS_INLINE bool JSValue::equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    do {
+        if (v1.isNumber() && v2.isNumber())
+            return v1.asNumber() == v2.asNumber();
+
+        bool s1 = v1.isString();
+        bool s2 = v2.isString();
+        if (s1 && s2)
+            return asString(v1)->equal(exec, asString(v2));
+
+        if (v1.isUndefinedOrNull()) {
+            if (v2.isUndefinedOrNull())
+                return true;
+            if (!v2.isCell())
+                return false;
+            return v2.asCell()->structure(vm)->masqueradesAsUndefined(exec->lexicalGlobalObject());
+        }
+
+        if (v2.isUndefinedOrNull()) {
+            if (!v1.isCell())
+                return false;
+            return v1.asCell()->structure(vm)->masqueradesAsUndefined(exec->lexicalGlobalObject());
+        }
+
+        if (v1.isObject()) {
+            if (v2.isObject())
+                return v1 == v2;
+            JSValue p1 = v1.toPrimitive(exec);
+            RETURN_IF_EXCEPTION(scope, false);
+            v1 = p1;
+            if (v1.isInt32() && v2.isInt32())
+                return v1 == v2;
+            continue;
+        }
+
+        if (v2.isObject()) {
+            JSValue p2 = v2.toPrimitive(exec);
+            RETURN_IF_EXCEPTION(scope, false);
+            v2 = p2;
+            if (v1.isInt32() && v2.isInt32())
+                return v1 == v2;
+            continue;
+        }
+
+        bool sym1 = v1.isSymbol();
+        bool sym2 = v2.isSymbol();
+        if (sym1 || sym2) {
+            if (sym1 && sym2)
+                return asSymbol(v1) == asSymbol(v2);
+            return false;
+        }
+
+        if (s1 || s2) {
+            double d1 = v1.toNumber(exec);
+            double d2 = v2.toNumber(exec);
+            return d1 == d2;
+        }
+
+        if (v1.isBoolean()) {
+            if (v2.isNumber())
+                return static_cast<double>(v1.asBoolean()) == v2.asNumber();
+        } else if (v2.isBoolean()) {
+            if (v1.isNumber())
+                return v1.asNumber() == static_cast<double>(v2.asBoolean());
+        }
+
+        return v1 == v2;
+    } while (true);
+}
+
+// ECMA 11.9.3
+ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
+{
+    ASSERT(v1.isCell() && v2.isCell());
+
+    if (v1.asCell()->isString() && v2.asCell()->isString())
+        return asString(v1)->equal(exec, asString(v2));
+    return v1 == v2;
+}
+
+inline bool JSValue::strictEqual(ExecState* exec, JSValue v1, JSValue v2)
+{
+    if (v1.isInt32() && v2.isInt32())
+        return v1 == v2;
+
+    if (v1.isNumber() && v2.isNumber())
+        return v1.asNumber() == v2.asNumber();
+
+    if (!v1.isCell() || !v2.isCell())
+        return v1 == v2;
+
+    return strictEqualSlowCaseInline(exec, v1, v2);
+}
+
+inline int32_t JSValue::asInt32ForArithmetic() const
+{
+    if (isBoolean())
+        return asBoolean();
+    return asInt32();
+}
+
+inline TriState JSValue::pureStrictEqual(JSValue v1, JSValue v2)
+{
+    if (v1.isInt32() && v2.isInt32())
+        return triState(v1 == v2);
+
+    if (v1.isNumber() && v2.isNumber())
+        return triState(v1.asNumber() == v2.asNumber());
+
+    if (!v1.isCell() || !v2.isCell())
+        return triState(v1 == v2);
+    
+    if (v1.asCell()->isString() && v2.asCell()->isString()) {
+        const StringImpl* v1String = asString(v1)->tryGetValueImpl();
+        const StringImpl* v2String = asString(v2)->tryGetValueImpl();
+        if (!v1String || !v2String)
+            return MixedTriState;
+        return triState(WTF::equal(*v1String, *v2String));
+    }
+    
+    return triState(v1 == v2);
+}
+
+inline TriState JSValue::pureToBoolean() const
+{
+    if (isInt32())
+        return asInt32() ? TrueTriState : FalseTriState;
+    if (isDouble())
+        return isNotZeroAndOrdered(asDouble()) ? TrueTriState : FalseTriState; // false for NaN
+    if (isCell())
+        return asCell()->pureToBoolean();
+    return isTrue() ? TrueTriState : FalseTriState;
+}
+
+ALWAYS_INLINE bool JSValue::requireObjectCoercible(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!isUndefinedOrNull())
+        return true;
+    throwException(exec, scope, createNotAnObjectError(exec, *this));
+    return false;
+}
+
+ALWAYS_INLINE bool isThisValueAltered(const PutPropertySlot& slot, JSObject* baseObject)
+{
+    JSValue thisValue = slot.thisValue();
+    if (LIKELY(thisValue == baseObject))
+        return false;
+
+    if (!thisValue.isObject())
+        return true;
+    JSObject* thisObject = asObject(thisValue);
+    // Only PureForwardingProxyType can be seen as the same to the original target object.
+    if (thisObject->type() == PureForwardingProxyType && jsCast<JSProxy*>(thisObject)->target() == baseObject)
+        return false;
+    return true;
+}
+
+// See section 7.2.9: https://tc39.github.io/ecma262/#sec-samevalue
+ALWAYS_INLINE bool sameValue(ExecState* exec, JSValue a, JSValue b)
+{
+    if (!a.isNumber())
+        return JSValue::strictEqual(exec, a, b);
+    if (!b.isNumber())
+        return false;
+    double x = a.asNumber();
+    double y = b.asNumber();
+    bool xIsNaN = std::isnan(x);
+    bool yIsNaN = std::isnan(y);
+    if (xIsNaN || yIsNaN)
+        return xIsNaN && yIsNaN;
+    return bitwise_cast<uint64_t>(x) == bitwise_cast<uint64_t>(y);
+}
+
+} // namespace JSC
diff --git a/runtime/JSCallee.cpp b/runtime/JSCallee.cpp
new file mode 100644
index 0000000..b350f31
--- /dev/null
+++ b/runtime/JSCallee.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCallee.h"
+
+#include "GetterSetter.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "StackVisitor.h"
+
+namespace JSC {
+
+const ClassInfo JSCallee::s_info = { "Callee", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCallee) };
+
+JSCallee::JSCallee(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    : Base(vm, structure)
+    , m_scope(vm, this, globalObject)
+{
+    RELEASE_ASSERT(!isLargeAllocation());
+}
+
+JSCallee::JSCallee(VM& vm, JSScope* scope, Structure* structure)
+    : Base(vm, structure)
+{
+    setScope(vm, scope);
+}
+
+void JSCallee::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+void JSCallee::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSCallee* thisObject = jsCast<JSCallee*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_scope);
+}
+
+} // namespace JSC
diff --git a/runtime/JSCallee.h b/runtime/JSCallee.h
new file mode 100644
index 0000000..d783dc4
--- /dev/null
+++ b/runtime/JSCallee.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+#include "JSScope.h"
+
+namespace JSC {
+
+class JSGlobalObject;
+class LLIntOffsetsExtractor;
+
+
+class JSCallee : public JSNonFinalObject {
+    friend class JIT;
+#if ENABLE(DFG_JIT)
+    friend class DFG::SpeculativeJIT;
+    friend class DFG::JITCompiler;
+#endif
+    friend class VM;
+
+public:
+    typedef JSNonFinalObject Base;
+    const static unsigned StructureFlags = Base::StructureFlags | ImplementsHasInstance | ImplementsDefaultHasInstance;
+
+    static JSCallee* create(VM& vm, JSGlobalObject* globalObject, JSScope* scope)
+    {
+        JSCallee* callee = new (NotNull, allocateCell<JSCallee>(vm.heap)) JSCallee(vm, scope, globalObject->calleeStructure());
+        callee->finishCreation(vm);
+        return callee;
+    }
+    
+    JSScope* scope()
+    {
+        return m_scope.get();
+    }
+
+    // This method may be called for host functions, in which case it
+    // will return an arbitrary value. This should only be used for
+    // optimized paths in which the return value does not matter for
+    // host functions, and checking whether the function is a host
+    // function is deemed too expensive.
+    JSScope* scopeUnchecked()
+    {
+        return m_scope.get();
+    }
+
+    void setScope(VM& vm, JSScope* scope)
+    {
+        m_scope.set(vm, this, scope);
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSCalleeType, StructureFlags), info());
+    }
+
+    static inline ptrdiff_t offsetOfScopeChain()
+    {
+        return OBJECT_OFFSETOF(JSCallee, m_scope);
+    }
+
+protected:
+    JS_EXPORT_PRIVATE JSCallee(VM&, JSGlobalObject*, Structure*);
+    JSCallee(VM&, JSScope*, Structure*);
+
+    void finishCreation(VM&);
+    using Base::finishCreation;
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    WriteBarrier<JSScope> m_scope;
+};
+
+} // namespace JSC
diff --git a/runtime/JSCell.cpp b/runtime/JSCell.cpp
new file mode 100644
index 0000000..4298566
--- /dev/null
+++ b/runtime/JSCell.cpp
@@ -0,0 +1,308 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSCell.h"
+
+#include "ArrayBufferView.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSString.h"
+#include "JSObject.h"
+#include "JSWebAssemblyCallee.h"
+#include "NumberObject.h"
+#include "WebAssemblyToJSCallee.h"
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+COMPILE_ASSERT(sizeof(JSCell) == sizeof(uint64_t), jscell_is_eight_bytes);
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSCell);
+
+void JSCell::destroy(JSCell* cell)
+{
+    cell->JSCell::~JSCell();
+}
+
+void JSCell::dump(PrintStream& out) const
+{
+    methodTable()->dumpToStream(this, out);
+}
+
+void JSCell::dumpToStream(const JSCell* cell, PrintStream& out)
+{
+    out.printf("<%p, %s>", cell, cell->className());
+}
+
+size_t JSCell::estimatedSizeInBytes() const
+{
+    return methodTable()->estimatedSize(const_cast<JSCell*>(this));
+}
+
+size_t JSCell::estimatedSize(JSCell* cell)
+{
+    return cell->cellSize();
+}
+
+void JSCell::heapSnapshot(JSCell*, HeapSnapshotBuilder&)
+{
+}
+
+bool JSCell::getString(ExecState* exec, String& stringValue) const
+{
+    if (!isString())
+        return false;
+    stringValue = static_cast<const JSString*>(this)->value(exec);
+    return true;
+}
+
+String JSCell::getString(ExecState* exec) const
+{
+    return isString() ? static_cast<const JSString*>(this)->value(exec) : String();
+}
+
+JSObject* JSCell::getObject()
+{
+    return isObject() ? asObject(this) : 0;
+}
+
+const JSObject* JSCell::getObject() const
+{
+    return isObject() ? static_cast<const JSObject*>(this) : 0;
+}
+
+CallType JSCell::getCallData(JSCell*, CallData& callData)
+{
+    callData.js.functionExecutable = 0;
+    callData.js.scope = 0;
+    callData.native.function = 0;
+    return CallType::None;
+}
+
+ConstructType JSCell::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.js.functionExecutable = 0;
+    constructData.js.scope = 0;
+    constructData.native.function = 0;
+    return ConstructType::None;
+}
+
+bool JSCell::put(JSCell* cell, ExecState* exec, PropertyName identifier, JSValue value, PutPropertySlot& slot)
+{
+    if (cell->isString() || cell->isSymbol())
+        return JSValue(cell).putToPrimitive(exec, identifier, value, slot);
+
+    JSObject* thisObject = cell->toObject(exec, exec->lexicalGlobalObject());
+    return thisObject->methodTable(exec->vm())->put(thisObject, exec, identifier, value, slot);
+}
+
+bool JSCell::putByIndex(JSCell* cell, ExecState* exec, unsigned identifier, JSValue value, bool shouldThrow)
+{
+    if (cell->isString() || cell->isSymbol()) {
+        PutPropertySlot slot(cell, shouldThrow);
+        return JSValue(cell).putToPrimitive(exec, Identifier::from(exec, identifier), value, slot);
+    }
+    JSObject* thisObject = cell->toObject(exec, exec->lexicalGlobalObject());
+    return thisObject->methodTable(exec->vm())->putByIndex(thisObject, exec, identifier, value, shouldThrow);
+}
+
+bool JSCell::deleteProperty(JSCell* cell, ExecState* exec, PropertyName identifier)
+{
+    JSObject* thisObject = cell->toObject(exec, exec->lexicalGlobalObject());
+    return thisObject->methodTable(exec->vm())->deleteProperty(thisObject, exec, identifier);
+}
+
+bool JSCell::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned identifier)
+{
+    JSObject* thisObject = cell->toObject(exec, exec->lexicalGlobalObject());
+    return thisObject->methodTable(exec->vm())->deletePropertyByIndex(thisObject, exec, identifier);
+}
+
+JSValue JSCell::toThis(JSCell* cell, ExecState* exec, ECMAMode ecmaMode)
+{
+    if (ecmaMode == StrictMode)
+        return cell;
+    return cell->toObject(exec, exec->lexicalGlobalObject());
+}
+
+JSValue JSCell::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+{
+    if (isString())
+        return static_cast<const JSString*>(this)->toPrimitive(exec, preferredType);
+    if (isSymbol())
+        return static_cast<const Symbol*>(this)->toPrimitive(exec, preferredType);
+    return static_cast<const JSObject*>(this)->toPrimitive(exec, preferredType);
+}
+
+bool JSCell::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value) const
+{
+    if (isString())
+        return static_cast<const JSString*>(this)->getPrimitiveNumber(exec, number, value);
+    if (isSymbol())
+        return static_cast<const Symbol*>(this)->getPrimitiveNumber(exec, number, value);
+    return static_cast<const JSObject*>(this)->getPrimitiveNumber(exec, number, value);
+}
+
+double JSCell::toNumber(ExecState* exec) const
+{
+    if (isString())
+        return static_cast<const JSString*>(this)->toNumber(exec);
+    if (isSymbol())
+        return static_cast<const Symbol*>(this)->toNumber(exec);
+    return static_cast<const JSObject*>(this)->toNumber(exec);
+}
+
+JSObject* JSCell::toObjectSlow(ExecState* exec, JSGlobalObject* globalObject) const
+{
+    ASSERT(!isObject());
+    if (isString())
+        return static_cast<const JSString*>(this)->toObject(exec, globalObject);
+    ASSERT(isSymbol());
+    return static_cast<const Symbol*>(this)->toObject(exec, globalObject);
+}
+
+void slowValidateCell(JSCell* cell)
+{
+    ASSERT_GC_OBJECT_LOOKS_VALID(cell);
+}
+
+JSValue JSCell::defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return jsUndefined();
+}
+
+bool JSCell::getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool JSCell::getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned, PropertySlot&)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+void JSCell::getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void JSCell::getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+String JSCell::className(const JSObject*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return String();
+}
+
+String JSCell::toStringName(const JSObject*, ExecState*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return String();
+}
+
+const char* JSCell::className() const
+{
+    return classInfo()->className;
+}
+
+void JSCell::getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool JSCell::customHasInstance(JSObject*, ExecState*, JSValue)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool JSCell::defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+ArrayBuffer* JSCell::slowDownAndWasteMemory(JSArrayBufferView*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+PassRefPtr<ArrayBufferView> JSCell::getTypedArrayImpl(JSArrayBufferView*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+uint32_t JSCell::getEnumerableLength(ExecState*, JSObject*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void JSCell::getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void JSCell::getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool JSCell::preventExtensions(JSObject*, ExecState*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool JSCell::isExtensible(JSObject*, ExecState*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool JSCell::setPrototype(JSObject*, ExecState*, JSValue, bool)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+JSValue JSCell::getPrototype(JSObject*, ExecState*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool JSCell::isAnyWasmCallee() const
+{
+#if ENABLE(WEBASSEMBLY)
+    return inherits(JSWebAssemblyCallee::info()) || inherits(WebAssemblyToJSCallee::info());
+#else
+    return false;
+#endif
+
+}
+
+} // namespace JSC
diff --git a/runtime/JSCell.h b/runtime/JSCell.h
new file mode 100644
index 0000000..dd8b53e
--- /dev/null
+++ b/runtime/JSCell.h
@@ -0,0 +1,308 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "CallData.h"
+#include "CellState.h"
+#include "ConstructData.h"
+#include "EnumerationMode.h"
+#include "Heap.h"
+#include "HeapCell.h"
+#include "IndexingType.h"
+#include "JSLock.h"
+#include "JSTypeInfo.h"
+#include "SlotVisitor.h"
+#include "TypedArrayType.h"
+#include "WriteBarrier.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class CopyVisitor;
+class GCDeferralContext;
+class ExecState;
+class Identifier;
+class JSArrayBufferView;
+class JSDestructibleObject;
+class JSGlobalObject;
+class LLIntOffsetsExtractor;
+class PropertyDescriptor;
+class PropertyNameArray;
+class Structure;
+
+template<typename T> void* allocateCell(Heap&);
+template<typename T> void* allocateCell(Heap&, size_t);
+
+template<typename T> void* allocateCell(Heap&, GCDeferralContext*);
+template<typename T> void* allocateCell(Heap&, GCDeferralContext*, size_t);
+
+#define DECLARE_EXPORT_INFO                                                  \
+    protected:                                                               \
+        static JS_EXPORTDATA const ::JSC::ClassInfo s_info;                  \
+    public:                                                                  \
+        static constexpr const ::JSC::ClassInfo* info() { return &s_info; }
+
+#define DECLARE_INFO                                                         \
+    protected:                                                               \
+        static const ::JSC::ClassInfo s_info;                                \
+    public:                                                                  \
+        static constexpr const ::JSC::ClassInfo* info() { return &s_info; }
+
+class JSCell : public HeapCell {
+    friend class JSValue;
+    friend class MarkedBlock;
+    template<typename T> friend void* allocateCell(Heap&);
+    template<typename T> friend void* allocateCell(Heap&, size_t);
+    template<typename T> friend void* allocateCell(Heap&, GCDeferralContext*);
+    template<typename T> friend void* allocateCell(Heap&, GCDeferralContext*, size_t);
+
+public:
+    static const unsigned StructureFlags = 0;
+
+    static const bool needsDestruction = false;
+
+    // Don't call this directly. Call JSC::subspaceFor<Type>(vm) instead.
+    // FIXME: Refer to Subspace by reference.
+    // https://bugs.webkit.org/show_bug.cgi?id=166988
+    template<typename CellType>
+    static Subspace* subspaceFor(VM&);
+
+    static JSCell* seenMultipleCalleeObjects() { return bitwise_cast<JSCell*>(static_cast<uintptr_t>(1)); }
+
+    enum CreatingEarlyCellTag { CreatingEarlyCell };
+    JSCell(CreatingEarlyCellTag);
+    
+protected:
+    JSCell(VM&, Structure*);
+    JS_EXPORT_PRIVATE static void destroy(JSCell*);
+
+public:
+    // Querying the type.
+    bool isString() const;
+    bool isSymbol() const;
+    bool isObject() const;
+    bool isAnyWasmCallee() const;
+    bool isGetterSetter() const;
+    bool isCustomGetterSetter() const;
+    bool isProxy() const;
+    bool inherits(const ClassInfo*) const;
+    bool isAPIValueWrapper() const;
+    
+    // Each cell has a built-in lock. Currently it's simply available for use if you need it. It's
+    // a full-blown WTF::Lock. Note that this lock is currently used in JSArray and that lock's
+    // ordering with the Structure lock is that the Structure lock must be acquired first.
+    void lock();
+    bool tryLock();
+    void unlock();
+    bool isLocked() const;
+    
+    JSType type() const;
+    IndexingType indexingTypeAndMisc() const;
+    IndexingType indexingType() const;
+    StructureID structureID() const { return m_structureID; }
+    Structure* structure() const;
+    Structure* structure(VM&) const;
+    void setStructure(VM&, Structure*);
+    void setStructureIDDirectly(StructureID id) { m_structureID = id; }
+    void clearStructure() { m_structureID = 0; }
+
+    TypeInfo::InlineTypeFlags inlineTypeFlags() const { return m_flags; }
+
+    const char* className() const;
+
+    // Extracting the value.
+    JS_EXPORT_PRIVATE bool getString(ExecState*, String&) const;
+    JS_EXPORT_PRIVATE String getString(ExecState*) const; // null string if not a string
+    JS_EXPORT_PRIVATE JSObject* getObject(); // NULL if not an object
+    const JSObject* getObject() const; // NULL if not an object
+        
+    // Returns information about how to call/construct this cell as a function/constructor. May tell
+    // you that the cell is not callable or constructor (default is that it's not either). If it
+    // says that the function is callable, and the TypeOfShouldCallGetCallData type flag is set, and
+    // this is an object, then typeof will return "function" instead of "object". These methods
+    // cannot change their minds and must be thread-safe. They are sometimes called from compiler
+    // threads.
+    JS_EXPORT_PRIVATE static CallType getCallData(JSCell*, CallData&);
+    JS_EXPORT_PRIVATE static ConstructType getConstructData(JSCell*, ConstructData&);
+
+    // Basic conversions.
+    JS_EXPORT_PRIVATE JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+    bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
+    bool toBoolean(ExecState*) const;
+    TriState pureToBoolean() const;
+    JS_EXPORT_PRIVATE double toNumber(ExecState*) const;
+    JSObject* toObject(ExecState*, JSGlobalObject*) const;
+
+    void dump(PrintStream&) const;
+    JS_EXPORT_PRIVATE static void dumpToStream(const JSCell*, PrintStream&);
+
+    size_t estimatedSizeInBytes() const;
+    JS_EXPORT_PRIVATE static size_t estimatedSize(JSCell*);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static void visitOutputConstraints(JSCell*, SlotVisitor&);
+
+    JS_EXPORT_PRIVATE static void heapSnapshot(JSCell*, HeapSnapshotBuilder&);
+
+    // Object operations, with the toObject operation included.
+    const ClassInfo* classInfo() const;
+    const MethodTable* methodTable() const;
+    const MethodTable* methodTable(VM&) const;
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+        
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
+
+    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
+
+    static bool canUseFastGetOwnProperty(const Structure&);
+    JSValue fastGetOwnProperty(VM&, Structure&, PropertyName);
+
+    // The recommended idiom for using cellState() is to switch on it or perform an == comparison on it
+    // directly. We deliberately avoid helpers for this, because we want transparency about how the various
+    // CellState values influences our various algorithms. 
+    CellState cellState() const { return m_cellState; }
+    
+    void setCellState(CellState data) const { const_cast<JSCell*>(this)->m_cellState = data; }
+    
+    bool atomicCompareExchangeCellStateWeakRelaxed(CellState oldState, CellState newState)
+    {
+        return WTF::atomicCompareExchangeWeakRelaxed(&m_cellState, oldState, newState);
+    }
+
+    CellState atomicCompareExchangeCellStateStrong(CellState oldState, CellState newState)
+    {
+        return WTF::atomicCompareExchangeStrong(&m_cellState, oldState, newState);
+    }
+
+    static ptrdiff_t structureIDOffset()
+    {
+        return OBJECT_OFFSETOF(JSCell, m_structureID);
+    }
+
+    static ptrdiff_t typeInfoFlagsOffset()
+    {
+        return OBJECT_OFFSETOF(JSCell, m_flags);
+    }
+
+    static ptrdiff_t typeInfoTypeOffset()
+    {
+        return OBJECT_OFFSETOF(JSCell, m_type);
+    }
+
+    // DO NOT store to this field. Always use a CAS loop, since some bits are flipped using CAS
+    // from other threads due to the internal lock. One exception: you don't need the CAS if the
+    // object has not escaped yet.
+    static ptrdiff_t indexingTypeAndMiscOffset()
+    {
+        return OBJECT_OFFSETOF(JSCell, m_indexingTypeAndMisc);
+    }
+
+    static ptrdiff_t cellStateOffset()
+    {
+        return OBJECT_OFFSETOF(JSCell, m_cellState);
+    }
+    
+    void callDestructor(VM&);
+
+    static const TypedArrayType TypedArrayStorageType = NotTypedArray;
+protected:
+
+    void finishCreation(VM&);
+    void finishCreation(VM&, Structure*, CreatingEarlyCellTag);
+
+    // Dummy implementations of override-able static functions for classes to put in their MethodTable
+    static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
+    static NO_RETURN_DUE_TO_CRASH void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_CRASH void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_CRASH void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+    static uint32_t getEnumerableLength(ExecState*, JSObject*);
+    static NO_RETURN_DUE_TO_CRASH void getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_CRASH void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_CRASH bool preventExtensions(JSObject*, ExecState*);
+    static NO_RETURN_DUE_TO_CRASH bool isExtensible(JSObject*, ExecState*);
+    static NO_RETURN_DUE_TO_CRASH bool setPrototype(JSObject*, ExecState*, JSValue, bool);
+    static NO_RETURN_DUE_TO_CRASH JSValue getPrototype(JSObject*, ExecState*);
+
+    static String className(const JSObject*);
+    static String toStringName(const JSObject*, ExecState*);
+    JS_EXPORT_PRIVATE static bool customHasInstance(JSObject*, ExecState*, JSValue);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE static ArrayBuffer* slowDownAndWasteMemory(JSArrayBufferView*);
+    JS_EXPORT_PRIVATE static PassRefPtr<ArrayBufferView> getTypedArrayImpl(JSArrayBufferView*);
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    JS_EXPORT_PRIVATE JSObject* toObjectSlow(ExecState*, JSGlobalObject*) const;
+
+    StructureID m_structureID;
+    IndexingType m_indexingTypeAndMisc; // DO NOT store to this field. Always CAS.
+    JSType m_type;
+    TypeInfo::InlineTypeFlags m_flags;
+    CellState m_cellState;
+};
+
+template<typename To, typename From>
+inline To jsCast(From* from)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(!from || from->JSCell::inherits(std::remove_pointer<To>::type::info()));
+    return static_cast<To>(from);
+}
+    
+template<typename To>
+inline To jsCast(JSValue from)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(from.isCell() && from.asCell()->JSCell::inherits(std::remove_pointer<To>::type::info()));
+    return static_cast<To>(from.asCell());
+}
+
+template<typename To, typename From>
+inline To jsDynamicCast(From* from)
+{
+    if (LIKELY(from->inherits(std::remove_pointer<To>::type::info())))
+        return static_cast<To>(from);
+    return nullptr;
+}
+
+template<typename To>
+inline To jsDynamicCast(JSValue from)
+{
+    if (LIKELY(from.isCell() && from.asCell()->inherits(std::remove_pointer<To>::type::info())))
+        return static_cast<To>(from.asCell());
+    return nullptr;
+}
+
+// FIXME: Refer to Subspace by reference.
+// https://bugs.webkit.org/show_bug.cgi?id=166988
+template<typename Type>
+inline Subspace* subspaceFor(VM& vm)
+{
+    return Type::template subspaceFor<Type>(vm);
+}
+
+} // namespace JSC
diff --git a/runtime/JSCellInlines.h b/runtime/JSCellInlines.h
new file mode 100644
index 0000000..283c7ab
--- /dev/null
+++ b/runtime/JSCellInlines.h
@@ -0,0 +1,353 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CPU.h"
+#include "CallFrame.h"
+#include "DeferGC.h"
+#include "Handle.h"
+#include "JSCell.h"
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "MarkedBlock.h"
+#include "Structure.h"
+#include "Symbol.h"
+#include <wtf/CompilationThread.h>
+
+namespace JSC {
+
+inline JSCell::JSCell(CreatingEarlyCellTag)
+    : m_cellState(CellState::DefinitelyWhite)
+{
+    ASSERT(!isCompilationThread());
+}
+
+inline JSCell::JSCell(VM&, Structure* structure)
+    : m_structureID(structure->id())
+    , m_indexingTypeAndMisc(structure->indexingTypeIncludingHistory())
+    , m_type(structure->typeInfo().type())
+    , m_flags(structure->typeInfo().inlineTypeFlags())
+    , m_cellState(CellState::DefinitelyWhite)
+{
+    ASSERT(!isCompilationThread());
+}
+
+inline void JSCell::finishCreation(VM& vm)
+{
+    // This object is ready to be escaped so the concurrent GC may see it at any time. We have
+    // to make sure that none of our stores sink below here.
+    vm.heap.mutatorFence();
+#if ENABLE(GC_VALIDATION)
+    ASSERT(vm.isInitializingObject());
+    vm.setInitializingObjectClass(0);
+#else
+    UNUSED_PARAM(vm);
+#endif
+    ASSERT(m_structureID);
+}
+
+inline void JSCell::finishCreation(VM& vm, Structure* structure, CreatingEarlyCellTag)
+{
+#if ENABLE(GC_VALIDATION)
+    ASSERT(vm.isInitializingObject());
+    vm.setInitializingObjectClass(0);
+    if (structure) {
+#endif
+        m_structureID = structure->id();
+        m_indexingTypeAndMisc = structure->indexingTypeIncludingHistory();
+        m_type = structure->typeInfo().type();
+        m_flags = structure->typeInfo().inlineTypeFlags();
+#if ENABLE(GC_VALIDATION)
+    }
+#else
+    UNUSED_PARAM(vm);
+#endif
+    // Very first set of allocations won't have a real structure.
+    ASSERT(m_structureID || !vm.structureStructure);
+}
+
+inline JSType JSCell::type() const
+{
+    return m_type;
+}
+
+inline IndexingType JSCell::indexingTypeAndMisc() const
+{
+    return m_indexingTypeAndMisc;
+}
+
+inline IndexingType JSCell::indexingType() const
+{
+    return indexingTypeAndMisc() & AllArrayTypes;
+}
+
+ALWAYS_INLINE Structure* JSCell::structure() const
+{
+    return structure(*vm());
+}
+
+ALWAYS_INLINE Structure* JSCell::structure(VM& vm) const
+{
+    return vm.getStructure(m_structureID);
+}
+
+inline void JSCell::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    visitor.appendUnbarriered(cell->structure(visitor.vm()));
+}
+
+inline void JSCell::visitOutputConstraints(JSCell*, SlotVisitor&)
+{
+}
+
+ALWAYS_INLINE VM& ExecState::vm() const
+{
+    ASSERT(callee());
+    ASSERT(callee()->vm());
+    ASSERT(!callee()->isLargeAllocation());
+    // This is an important optimization since we access this so often.
+    return *callee()->markedBlock().vm();
+}
+
+template<typename CellType>
+Subspace* JSCell::subspaceFor(VM& vm)
+{
+    if (CellType::needsDestruction)
+        return &vm.destructibleCellSpace;
+    return &vm.cellSpace;
+}
+
+template<typename T>
+void* allocateCell(Heap& heap, size_t size)
+{
+    ASSERT(!DisallowGC::isGCDisallowedOnCurrentThread());
+    ASSERT(size >= sizeof(T));
+    JSCell* result = static_cast<JSCell*>(subspaceFor<T>(*heap.vm())->allocate(size));
+#if ENABLE(GC_VALIDATION)
+    ASSERT(!heap.vm()->isInitializingObject());
+    heap.vm()->setInitializingObjectClass(T::info());
+#endif
+    result->clearStructure();
+    return result;
+}
+    
+template<typename T>
+void* allocateCell(Heap& heap)
+{
+    return allocateCell<T>(heap, sizeof(T));
+}
+    
+template<typename T>
+void* allocateCell(Heap& heap, GCDeferralContext* deferralContext, size_t size)
+{
+    ASSERT(size >= sizeof(T));
+    JSCell* result = static_cast<JSCell*>(subspaceFor<T>(*heap.vm())->allocate(deferralContext, size));
+#if ENABLE(GC_VALIDATION)
+    ASSERT(!heap.vm()->isInitializingObject());
+    heap.vm()->setInitializingObjectClass(T::info());
+#endif
+    result->clearStructure();
+    return result;
+}
+    
+template<typename T>
+void* allocateCell(Heap& heap, GCDeferralContext* deferralContext)
+{
+    return allocateCell<T>(heap, deferralContext, sizeof(T));
+}
+    
+inline bool JSCell::isObject() const
+{
+    return TypeInfo::isObject(m_type);
+}
+
+inline bool JSCell::isString() const
+{
+    return m_type == StringType;
+}
+
+inline bool JSCell::isSymbol() const
+{
+    return m_type == SymbolType;
+}
+
+inline bool JSCell::isGetterSetter() const
+{
+    return m_type == GetterSetterType;
+}
+
+inline bool JSCell::isCustomGetterSetter() const
+{
+    return m_type == CustomGetterSetterType;
+}
+
+inline bool JSCell::isProxy() const
+{
+    return m_type == ImpureProxyType || m_type == PureForwardingProxyType;
+}
+
+inline bool JSCell::isAPIValueWrapper() const
+{
+    return m_type == APIValueWrapperType;
+}
+
+ALWAYS_INLINE void JSCell::setStructure(VM& vm, Structure* structure)
+{
+    ASSERT(structure->classInfo() == this->structure()->classInfo());
+    ASSERT(!this->structure()
+        || this->structure()->transitionWatchpointSetHasBeenInvalidated()
+        || Heap::heap(this)->structureIDTable().get(structure->id()) == structure);
+    m_structureID = structure->id();
+    m_flags = structure->typeInfo().inlineTypeFlags();
+    m_type = structure->typeInfo().type();
+    IndexingType newIndexingType = structure->indexingTypeIncludingHistory();
+    if (m_indexingTypeAndMisc != newIndexingType) {
+        ASSERT(!(newIndexingType & ~AllArrayTypesAndHistory));
+        for (;;) {
+            IndexingType oldValue = m_indexingTypeAndMisc;
+            IndexingType newValue = (oldValue & ~AllArrayTypesAndHistory) | structure->indexingTypeIncludingHistory();
+            if (WTF::atomicCompareExchangeWeakRelaxed(&m_indexingTypeAndMisc, oldValue, newValue))
+                break;
+        }
+    }
+    vm.heap.writeBarrier(this, structure);
+}
+
+inline const MethodTable* JSCell::methodTable() const
+{
+    VM& vm = *Heap::heap(this)->vm();
+    Structure* structure = this->structure(vm);
+    if (Structure* rootStructure = structure->structure(vm))
+        RELEASE_ASSERT(rootStructure == rootStructure->structure(vm));
+
+    return &structure->classInfo()->methodTable;
+}
+
+inline const MethodTable* JSCell::methodTable(VM& vm) const
+{
+    Structure* structure = this->structure(vm);
+    if (Structure* rootStructure = structure->structure(vm))
+        RELEASE_ASSERT(rootStructure == rootStructure->structure(vm));
+
+    return &structure->classInfo()->methodTable;
+}
+
+inline bool JSCell::inherits(const ClassInfo* info) const
+{
+    return classInfo()->isSubClassOf(info);
+}
+
+ALWAYS_INLINE JSValue JSCell::fastGetOwnProperty(VM& vm, Structure& structure, PropertyName name)
+{
+    ASSERT(canUseFastGetOwnProperty(structure));
+    PropertyOffset offset = structure.get(vm, name);
+    if (offset != invalidOffset)
+        return asObject(this)->locationForOffset(offset)->get();
+    return JSValue();
+}
+
+inline bool JSCell::canUseFastGetOwnProperty(const Structure& structure)
+{
+    return !structure.hasGetterSetterProperties() 
+        && !structure.hasCustomGetterSetterProperties()
+        && !structure.typeInfo().overridesGetOwnPropertySlot();
+}
+
+ALWAYS_INLINE const ClassInfo* JSCell::classInfo() const
+{
+    VM* vm;
+    if (isLargeAllocation())
+        vm = largeAllocation().vm();
+    else
+        vm = markedBlock().vm();
+    ASSERT(vm->heap.mutatorState() == MutatorState::Running || vm->apiLock().ownerThread() != std::this_thread::get_id());
+    return structure(*vm)->classInfo();
+}
+
+inline bool JSCell::toBoolean(ExecState* exec) const
+{
+    if (isString())
+        return static_cast<const JSString*>(this)->toBoolean();
+    return !structure()->masqueradesAsUndefined(exec->lexicalGlobalObject());
+}
+
+inline TriState JSCell::pureToBoolean() const
+{
+    if (isString())
+        return static_cast<const JSString*>(this)->toBoolean() ? TrueTriState : FalseTriState;
+    if (isSymbol())
+        return TrueTriState;
+    return MixedTriState;
+}
+
+inline void JSCell::callDestructor(VM& vm)
+{
+    if (isZapped())
+        return;
+    ASSERT(structureID());
+    if (inlineTypeFlags() & StructureIsImmortal) {
+        Structure* structure = this->structure(vm);
+        const ClassInfo* classInfo = structure->classInfo();
+        MethodTable::DestroyFunctionPtr destroy = classInfo->methodTable.destroy;
+        destroy(this);
+    } else
+        static_cast<JSDestructibleObject*>(this)->classInfo()->methodTable.destroy(this);
+    zap();
+}
+
+inline void JSCell::lock()
+{
+    Atomic<IndexingType>* lock = bitwise_cast<Atomic<IndexingType>*>(&m_indexingTypeAndMisc);
+    IndexingTypeLockAlgorithm::lock(*lock);
+}
+
+inline bool JSCell::tryLock()
+{
+    Atomic<IndexingType>* lock = bitwise_cast<Atomic<IndexingType>*>(&m_indexingTypeAndMisc);
+    return IndexingTypeLockAlgorithm::tryLock(*lock);
+}
+
+inline void JSCell::unlock()
+{
+    Atomic<IndexingType>* lock = bitwise_cast<Atomic<IndexingType>*>(&m_indexingTypeAndMisc);
+    IndexingTypeLockAlgorithm::unlock(*lock);
+}
+
+inline bool JSCell::isLocked() const
+{
+    Atomic<IndexingType>* lock = bitwise_cast<Atomic<IndexingType>*>(&m_indexingTypeAndMisc);
+    return IndexingTypeLockAlgorithm::isLocked(*lock);
+}
+
+inline JSObject* JSCell::toObject(ExecState* exec, JSGlobalObject* globalObject) const
+{
+    if (isObject())
+        return jsCast<JSObject*>(const_cast<JSCell*>(this));
+    return toObjectSlow(exec, globalObject);
+}
+
+} // namespace JSC
diff --git a/runtime/JSCustomGetterSetterFunction.cpp b/runtime/JSCustomGetterSetterFunction.cpp
new file mode 100644
index 0000000..792a2e7
--- /dev/null
+++ b/runtime/JSCustomGetterSetterFunction.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCustomGetterSetterFunction.h"
+
+#include "CustomGetterSetter.h"
+#include "GetterSetter.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+
+namespace JSC {
+
+const ClassInfo JSCustomGetterSetterFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(JSCustomGetterSetterFunction) };
+
+EncodedJSValue JSC_HOST_CALL JSCustomGetterSetterFunction::customGetterSetterFunctionCall(ExecState* exec)
+{
+    JSCustomGetterSetterFunction* customGetterSetterFunction = jsCast<JSCustomGetterSetterFunction*>(exec->jsCallee());
+    CustomGetterSetter* customGetterSetter = customGetterSetterFunction->customGetterSetter();
+
+    if (customGetterSetterFunction->isSetter()) {
+        CustomGetterSetter::CustomSetter setter = customGetterSetter->setter();
+        ASSERT(setter);
+        callCustomSetter(exec, setter, true, exec->thisValue(), exec->argument(0));
+        return JSValue::encode(jsUndefined());
+    }
+
+    CustomGetterSetter::CustomGetter getter = customGetterSetter->getter();
+    ASSERT(getter);
+    return getter(exec, JSValue::encode(exec->thisValue()), customGetterSetterFunction->propertyName());
+}
+
+JSCustomGetterSetterFunction::JSCustomGetterSetterFunction(VM& vm, JSGlobalObject* globalObject, Structure* structure, const Type type, const PropertyName& propertyName)
+    : Base(vm, globalObject, structure)
+    , m_type(type)
+    , m_propertyName(propertyName)
+{
+}
+
+JSCustomGetterSetterFunction* JSCustomGetterSetterFunction::create(VM& vm, JSGlobalObject* globalObject, CustomGetterSetter* getterSetter, const Type type, const PropertyName& propertyName)
+{
+    ASSERT(type == Type::Getter ? !!getterSetter->getter() : !!getterSetter->setter());
+
+    const char* prefix = (type == Type::Getter) ? "get " : "set ";
+    String name = makeString(prefix, String(propertyName.publicName()));
+
+    NativeExecutable* executable = vm.getHostFunction(customGetterSetterFunctionCall, callHostFunctionAsConstructor, String(propertyName.publicName()));
+
+    Structure* structure = globalObject->customGetterSetterFunctionStructure();
+    JSCustomGetterSetterFunction* function = new (NotNull, allocateCell<JSCustomGetterSetterFunction>(vm.heap)) JSCustomGetterSetterFunction(vm, globalObject, structure, type, propertyName);
+
+    // Can't do this during initialization because getHostFunction might do a GC allocation.
+    function->finishCreation(vm, executable, getterSetter, name);
+    return function;
+}
+
+void JSCustomGetterSetterFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSCustomGetterSetterFunction* thisObject = jsCast<JSCustomGetterSetterFunction*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_getterSetter);
+}
+
+void JSCustomGetterSetterFunction::finishCreation(VM& vm, NativeExecutable* executable, CustomGetterSetter* getterSetter, const String& name)
+{
+    Base::finishCreation(vm, executable, isSetter(), name);
+    ASSERT(inherits(info()));
+    ASSERT(getterSetter);
+    m_getterSetter.set(vm, this, getterSetter);
+}
+
+} // namespace JSC
diff --git a/runtime/JSCustomGetterSetterFunction.h b/runtime/JSCustomGetterSetterFunction.h
new file mode 100644
index 0000000..f9d2448
--- /dev/null
+++ b/runtime/JSCustomGetterSetterFunction.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSFunction.h"
+
+namespace JSC {
+
+class CustomGetterSetter;
+
+class JSCustomGetterSetterFunction : public JSFunction {
+public:
+    typedef JSFunction Base;
+
+    // The Type is set to the number of arguments the resultant function will have.
+    enum class Type { Getter = 0, Setter = 1 };
+
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info());
+    }
+
+    static JSCustomGetterSetterFunction* create(VM&, JSGlobalObject*, CustomGetterSetter*, const Type, const PropertyName&);
+
+    DECLARE_EXPORT_INFO;
+
+protected:
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    JSCustomGetterSetterFunction(VM&, JSGlobalObject*, Structure*, Type, const PropertyName&);
+    void finishCreation(VM&, NativeExecutable*, CustomGetterSetter*, const String&);
+
+    static EncodedJSValue JSC_HOST_CALL customGetterSetterFunctionCall(ExecState*);
+
+    CustomGetterSetter* customGetterSetter() const { return m_getterSetter.get(); }
+    bool isSetter() const { return m_type == Type::Setter; }
+    const PropertyName& propertyName() const { return m_propertyName; }
+
+    WriteBarrier<CustomGetterSetter> m_getterSetter;
+    Type m_type;
+    PropertyName m_propertyName;
+};
+
+} // namespace JSC
diff --git a/runtime/JSDataView.cpp b/runtime/JSDataView.cpp
new file mode 100644
index 0000000..f4afebb
--- /dev/null
+++ b/runtime/JSDataView.cpp
@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSDataView.h"
+
+#include "ArrayBufferView.h"
+#include "DataView.h"
+#include "Error.h"
+#include "JSCInlines.h"
+#include "TypeError.h"
+
+namespace JSC {
+
+const ClassInfo JSDataView::s_info = {
+    "DataView", &Base::s_info, 0, CREATE_METHOD_TABLE(JSDataView)};
+
+JSDataView::JSDataView(VM& vm, ConstructionContext& context, ArrayBuffer* buffer)
+    : Base(vm, context)
+    , m_buffer(buffer)
+{
+}
+
+JSDataView* JSDataView::create(
+    ExecState* exec, Structure* structure, PassRefPtr<ArrayBuffer> passedBuffer,
+    unsigned byteOffset, unsigned byteLength)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    RefPtr<ArrayBuffer> buffer = passedBuffer;
+    if (!ArrayBufferView::verifySubRangeLength(buffer, byteOffset, byteLength, sizeof(uint8_t))) {
+        throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Length out of range of buffer")));
+        return nullptr;
+    }
+    if (!ArrayBufferView::verifyByteOffsetAlignment(byteOffset, sizeof(uint8_t))) {
+        throwException(exec, scope, createRangeError(exec, ASCIILiteral("Byte offset is not aligned")));
+        return nullptr;
+    }
+    ConstructionContext context(
+        structure, buffer, byteOffset, byteLength, ConstructionContext::DataView);
+    ASSERT(context);
+    JSDataView* result =
+        new (NotNull, allocateCell<JSDataView>(vm.heap)) JSDataView(vm, context, buffer.get());
+    result->finishCreation(vm);
+    return result;
+}
+
+JSDataView* JSDataView::createUninitialized(ExecState*, Structure*, unsigned)
+{
+    UNREACHABLE_FOR_PLATFORM();
+    return 0;
+}
+
+JSDataView* JSDataView::create(ExecState*, Structure*, unsigned)
+{
+    UNREACHABLE_FOR_PLATFORM();
+    return 0;
+}
+
+bool JSDataView::set(ExecState*, unsigned, JSObject*, unsigned, unsigned)
+{
+    UNREACHABLE_FOR_PLATFORM();
+    return false;
+}
+
+bool JSDataView::setIndex(ExecState*, unsigned, JSValue)
+{
+    UNREACHABLE_FOR_PLATFORM();
+    return false;
+}
+
+PassRefPtr<DataView> JSDataView::possiblySharedTypedImpl()
+{
+    return DataView::create(possiblySharedBuffer(), byteOffset(), length());
+}
+
+PassRefPtr<DataView> JSDataView::unsharedTypedImpl()
+{
+    return DataView::create(unsharedBuffer(), byteOffset(), length());
+}
+
+bool JSDataView::getOwnPropertySlot(
+    JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    JSDataView* thisObject = jsCast<JSDataView*>(object);
+    if (propertyName == exec->propertyNames().byteLength) {
+        slot.setValue(thisObject, DontEnum | ReadOnly, jsNumber(thisObject->m_length));
+        return true;
+    }
+    if (propertyName == exec->propertyNames().byteOffset) {
+        slot.setValue(thisObject, DontEnum | ReadOnly, jsNumber(thisObject->byteOffset()));
+        return true;
+    }
+
+    return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+}
+
+bool JSDataView::put(
+    JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value,
+    PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSDataView* thisObject = jsCast<JSDataView*>(cell);
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject))) {
+        scope.release();
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+    }
+
+    if (propertyName == vm.propertyNames->byteLength
+        || propertyName == vm.propertyNames->byteOffset)
+        return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral("Attempting to write to read-only typed array property."));
+
+    scope.release();
+    return Base::put(thisObject, exec, propertyName, value, slot);
+}
+
+bool JSDataView::defineOwnProperty(
+    JSObject* object, ExecState* exec, PropertyName propertyName,
+    const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSDataView* thisObject = jsCast<JSDataView*>(object);
+    if (propertyName == vm.propertyNames->byteLength
+        || propertyName == vm.propertyNames->byteOffset)
+        return typeError(exec, scope, shouldThrow, ASCIILiteral("Attempting to define read-only typed array property."));
+
+    return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+}
+
+bool JSDataView::deleteProperty(
+    JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    JSDataView* thisObject = jsCast<JSDataView*>(cell);
+    if (propertyName == exec->propertyNames().byteLength
+        || propertyName == exec->propertyNames().byteOffset)
+        return false;
+
+    return Base::deleteProperty(thisObject, exec, propertyName);
+}
+
+void JSDataView::getOwnNonIndexPropertyNames(
+    JSObject* object, ExecState* exec, PropertyNameArray& array, EnumerationMode mode)
+{
+    JSDataView* thisObject = jsCast<JSDataView*>(object);
+    
+    if (mode.includeDontEnumProperties()) {
+        array.add(exec->propertyNames().byteOffset);
+        array.add(exec->propertyNames().byteLength);
+    }
+    
+    Base::getOwnNonIndexPropertyNames(thisObject, exec, array, mode);
+}
+
+ArrayBuffer* JSDataView::slowDownAndWasteMemory(JSArrayBufferView*)
+{
+    UNREACHABLE_FOR_PLATFORM();
+    return 0;
+}
+
+PassRefPtr<ArrayBufferView> JSDataView::getTypedArrayImpl(JSArrayBufferView* object)
+{
+    JSDataView* thisObject = jsCast<JSDataView*>(object);
+    return thisObject->possiblySharedTypedImpl();
+}
+
+Structure* JSDataView::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(
+        vm, globalObject, prototype, TypeInfo(DataViewType, StructureFlags), info(),
+        NonArray);
+}
+
+} // namespace JSC
+
diff --git a/runtime/JSDataView.h b/runtime/JSDataView.h
new file mode 100644
index 0000000..cae3a92
--- /dev/null
+++ b/runtime/JSDataView.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DataView.h"
+#include "JSArrayBufferView.h"
+
+namespace JSC {
+
+class JSDataView : public JSArrayBufferView {
+public:
+    typedef JSArrayBufferView Base;
+    static const unsigned elementSize = 1;
+    
+protected:
+    JSDataView(VM&, ConstructionContext&, ArrayBuffer*);
+    
+public:
+    JS_EXPORT_PRIVATE static JSDataView* create(
+        ExecState*, Structure*, PassRefPtr<ArrayBuffer>, unsigned byteOffset,
+        unsigned byteLength);
+    
+    // Dummy methods, which don't actually work; these are just in place to
+    // placate some template specialization we do elsewhere.
+    static JSDataView* createUninitialized(ExecState*, Structure*, unsigned length);
+    static JSDataView* create(ExecState*, Structure*, unsigned length);
+    bool set(ExecState*, unsigned, JSObject*, unsigned, unsigned length);
+    bool setIndex(ExecState*, unsigned, JSValue);
+    
+    ArrayBuffer* possiblySharedBuffer() const { return m_buffer; }
+    ArrayBuffer* unsharedBuffer() const
+    {
+        RELEASE_ASSERT(!m_buffer->isShared());
+        return m_buffer;
+    }
+    
+    PassRefPtr<DataView> possiblySharedTypedImpl();
+    PassRefPtr<DataView> unsharedTypedImpl();
+    
+    static const TypedArrayType TypedArrayStorageType = TypeDataView;
+
+protected:
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+
+    static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+    static ArrayBuffer* slowDownAndWasteMemory(JSArrayBufferView*);
+    static PassRefPtr<ArrayBufferView> getTypedArrayImpl(JSArrayBufferView*);
+    
+public:
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+    
+    DECLARE_EXPORT_INFO;
+
+private:
+    ArrayBuffer* m_buffer;
+};
+
+} // namespace JSC
diff --git a/runtime/JSDataViewPrototype.cpp b/runtime/JSDataViewPrototype.cpp
new file mode 100644
index 0000000..7159389
--- /dev/null
+++ b/runtime/JSDataViewPrototype.cpp
@@ -0,0 +1,335 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSDataViewPrototype.h"
+
+#include "Error.h"
+#include "JSArrayBuffer.h"
+#include "JSDataView.h"
+#include "Lookup.h"
+#include "JSCInlines.h"
+#include "ToNativeFromValue.h"
+#include "TypedArrayAdaptors.h"
+#include <wtf/FlipBytes.h>
+
+namespace JSC {
+
+/* Source for JSDataViewPrototype.lut.h
+@begin dataViewTable
+  getInt8               dataViewProtoFuncGetInt8             DontEnum|Function       1
+  getUint8              dataViewProtoFuncGetUint8            DontEnum|Function       1
+  getInt16              dataViewProtoFuncGetInt16            DontEnum|Function       1
+  getUint16             dataViewProtoFuncGetUint16           DontEnum|Function       1
+  getInt32              dataViewProtoFuncGetInt32            DontEnum|Function       1
+  getUint32             dataViewProtoFuncGetUint32           DontEnum|Function       1
+  getFloat32            dataViewProtoFuncGetFloat32          DontEnum|Function       1
+  getFloat64            dataViewProtoFuncGetFloat64          DontEnum|Function       1
+  setInt8               dataViewProtoFuncSetInt8             DontEnum|Function       2
+  setUint8              dataViewProtoFuncSetUint8            DontEnum|Function       2
+  setInt16              dataViewProtoFuncSetInt16            DontEnum|Function       2
+  setUint16             dataViewProtoFuncSetUint16           DontEnum|Function       2
+  setInt32              dataViewProtoFuncSetInt32            DontEnum|Function       2
+  setUint32             dataViewProtoFuncSetUint32           DontEnum|Function       2
+  setFloat32            dataViewProtoFuncSetFloat32          DontEnum|Function       2
+  setFloat64            dataViewProtoFuncSetFloat64          DontEnum|Function       2
+  buffer                dataViewProtoGetterBuffer            DontEnum|Accessor       0
+  byteLength            dataViewProtoGetterByteLength        DontEnum|Accessor       0
+  byteOffset            dataViewProtoGetterByteOffset        DontEnum|Accessor       0
+@end
+*/
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetInt8(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetInt16(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetInt32(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetUint8(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetUint16(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetUint32(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetFloat32(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetFloat64(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetInt8(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetInt16(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetInt32(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetUint8(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetUint16(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetUint32(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetFloat32(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetFloat64(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterBuffer(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteLength(ExecState*);
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteOffset(ExecState*);
+
+}
+
+#include "JSDataViewPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo JSDataViewPrototype::s_info = {
+    "DataViewPrototype", &Base::s_info, &dataViewTable,
+    CREATE_METHOD_TABLE(JSDataViewPrototype)
+};
+
+JSDataViewPrototype::JSDataViewPrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+JSDataViewPrototype* JSDataViewPrototype::create(VM& vm, Structure* structure)
+{
+    JSDataViewPrototype* prototype =
+        new (NotNull, allocateCell<JSDataViewPrototype>(vm.heap))
+        JSDataViewPrototype(vm, structure);
+    prototype->finishCreation(vm);
+    return prototype;
+}
+
+void JSDataViewPrototype::finishCreation(JSC::VM& vm)
+{
+    Base::finishCreation(vm);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "DataView"), DontEnum | ReadOnly);
+}
+
+Structure* JSDataViewPrototype::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(
+        vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+template<typename Adaptor>
+EncodedJSValue getData(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSDataView* dataView = jsDynamicCast<JSDataView*>(exec->thisValue());
+    if (!dataView)
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver of DataView method must be a DataView"));
+    
+    unsigned byteOffset = exec->argument(0).toIndex(exec, "byteOffset");
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    bool littleEndian = false;
+    unsigned elementSize = sizeof(typename Adaptor::Type);
+    if (elementSize > 1 && exec->argumentCount() >= 2) {
+        littleEndian = exec->uncheckedArgument(1).toBoolean(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    
+    unsigned byteLength = dataView->length();
+    if (elementSize > byteLength || byteOffset > byteLength - elementSize)
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Out of bounds access")));
+
+    const unsigned dataSize = sizeof(typename Adaptor::Type);
+    union {
+        typename Adaptor::Type value;
+        uint8_t rawBytes[dataSize];
+    } u = { };
+
+    uint8_t* dataPtr = static_cast<uint8_t*>(dataView->vector()) + byteOffset;
+
+    if (needToFlipBytesIfLittleEndian(littleEndian)) {
+        for (unsigned i = dataSize; i--;)
+            u.rawBytes[i] = *dataPtr++;
+    } else {
+        for (unsigned i = 0; i < dataSize; i++)
+            u.rawBytes[i] = *dataPtr++;
+    }
+
+    return JSValue::encode(Adaptor::toJSValue(u.value));
+}
+
+template<typename Adaptor>
+EncodedJSValue setData(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSDataView* dataView = jsDynamicCast<JSDataView*>(exec->thisValue());
+    if (!dataView)
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver of DataView method must be a DataView"));
+    
+    unsigned byteOffset = exec->argument(0).toIndex(exec, "byteOffset");
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    const unsigned dataSize = sizeof(typename Adaptor::Type);
+    union {
+        typename Adaptor::Type value;
+        uint8_t rawBytes[dataSize];
+    } u;
+
+    u.value = toNativeFromValue<Adaptor>(exec, exec->argument(1));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    
+    bool littleEndian = false;
+    unsigned elementSize = sizeof(typename Adaptor::Type);
+    if (elementSize > 1 && exec->argumentCount() >= 3) {
+        littleEndian = exec->uncheckedArgument(2).toBoolean(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    
+    unsigned byteLength = dataView->length();
+    if (elementSize > byteLength || byteOffset > byteLength - elementSize)
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Out of bounds access")));
+
+    uint8_t* dataPtr = static_cast<uint8_t*>(dataView->vector()) + byteOffset;
+
+    if (needToFlipBytesIfLittleEndian(littleEndian)) {
+        for (unsigned i = dataSize; i--;)
+            *dataPtr++ = u.rawBytes[i];
+    } else {
+        for (unsigned i = 0; i < dataSize; i++)
+            *dataPtr++ = u.rawBytes[i];
+    }
+
+    return JSValue::encode(jsUndefined());
+}
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wmissing-prototypes"
+#endif
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterBuffer(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSDataView* view = jsDynamicCast<JSDataView*>(exec->thisValue());
+    if (!view)
+        return throwVMTypeError(exec, scope, "DataView.prototype.buffer expects |this| to be a DataView object");
+
+    return JSValue::encode(view->possiblySharedJSBuffer(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteLength(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSDataView* view = jsDynamicCast<JSDataView*>(exec->thisValue());
+    if (!view)
+        return throwVMTypeError(exec, scope, "DataView.prototype.buffer expects |this| to be a DataView object");
+
+    return JSValue::encode(jsNumber(view->length()));
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteOffset(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSDataView* view = jsDynamicCast<JSDataView*>(exec->thisValue());
+    if (!view)
+        return throwVMTypeError(exec, scope, "DataView.prototype.buffer expects |this| to be a DataView object");
+
+    return JSValue::encode(jsNumber(view->byteOffset()));
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetInt8(ExecState* exec)
+{
+    return getData<Int8Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetInt16(ExecState* exec)
+{
+    return getData<Int16Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetInt32(ExecState* exec)
+{
+    return getData<Int32Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetUint8(ExecState* exec)
+{
+    return getData<Uint8Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetUint16(ExecState* exec)
+{
+    return getData<Uint16Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetUint32(ExecState* exec)
+{
+    return getData<Uint32Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetFloat32(ExecState* exec)
+{
+    return getData<Float32Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncGetFloat64(ExecState* exec)
+{
+    return getData<Float64Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetInt8(ExecState* exec)
+{
+    return setData<Int8Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetInt16(ExecState* exec)
+{
+    return setData<Int16Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetInt32(ExecState* exec)
+{
+    return setData<Int32Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetUint8(ExecState* exec)
+{
+    return setData<Uint8Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetUint16(ExecState* exec)
+{
+    return setData<Uint16Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetUint32(ExecState* exec)
+{
+    return setData<Uint32Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetFloat32(ExecState* exec)
+{
+    return setData<Float32Adaptor>(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL dataViewProtoFuncSetFloat64(ExecState* exec)
+{
+    return setData<Float64Adaptor>(exec);
+}
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
+
+} // namespace JSC
diff --git a/runtime/JSDataViewPrototype.h b/runtime/JSDataViewPrototype.h
new file mode 100644
index 0000000..c7edf3d
--- /dev/null
+++ b/runtime/JSDataViewPrototype.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSDataViewPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+protected:
+    JSDataViewPrototype(VM&, Structure*);
+
+    void finishCreation(VM&);
+
+public:
+    static JSDataViewPrototype* create(VM&, Structure*);
+    
+    DECLARE_INFO;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+};
+
+} // namespace JSC
diff --git a/runtime/JSDateMath.cpp b/runtime/JSDateMath.cpp
new file mode 100644
index 0000000..7e6df45
--- /dev/null
+++ b/runtime/JSDateMath.cpp
@@ -0,0 +1,252 @@
+/*
+ * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ * Copyright (C) 2006, 2007, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ * Copyright (C) 2010 &yet, LLC. (nate@andyet.net)
+ *
+ * The Original Code is Mozilla Communicator client code, released
+ * March 31, 1998.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * Alternatively, the contents of this file may be used under the terms
+ * of either the Mozilla Public License Version 1.1, found at
+ * http://www.mozilla.org/MPL/ (the "MPL") or the GNU General Public
+ * License Version 2.0, found at http://www.fsf.org/copyleft/gpl.html
+ * (the "GPL"), in which case the provisions of the MPL or the GPL are
+ * applicable instead of those above.  If you wish to allow use of your
+ * version of this file only under the terms of one of those two
+ * licenses (the MPL or the GPL) and not to allow others to use your
+ * version of this file under the LGPL, indicate your decision by
+ * deletingthe provisions above and replace them with the notice and
+ * other provisions required by the MPL or the GPL, as the case may be.
+ * If you do not delete the provisions above, a recipient may use your
+ * version of this file under any of the LGPL, the MPL or the GPL.
+
+ * Copyright 2006-2008 the V8 project authors. All rights reserved.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following
+ *       disclaimer in the documentation and/or other materials provided
+ *       with the distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived
+ *       from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDateMath.h"
+
+#include "JSObject.h"
+#include "JSScope.h"
+#include "JSCInlines.h"
+
+#include <algorithm>
+#include <limits.h>
+#include <limits>
+#include <stdint.h>
+#include <time.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/Assertions.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/StringExtras.h>
+
+#if HAVE(ERRNO_H)
+#include <errno.h>
+#endif
+
+#if HAVE(SYS_TIME_H)
+#include <sys/time.h>
+#endif
+
+#if HAVE(SYS_TIMEB_H)
+#include <sys/timeb.h>
+#endif
+
+using namespace WTF;
+
+namespace JSC {
+
+static inline double timeToMS(double hour, double min, double sec, double ms)
+{
+    return (((hour * minutesPerHour + min) * secondsPerMinute + sec) * msPerSecond + ms);
+}
+
+static inline int msToSeconds(double ms)
+{
+    double result = fmod(floor(ms / msPerSecond), secondsPerMinute);
+    if (result < 0)
+        result += secondsPerMinute;
+    return static_cast<int>(result);
+}
+
+// 0: Sunday, 1: Monday, etc.
+static inline int msToWeekDay(double ms)
+{
+    int wd = (static_cast<int>(msToDays(ms)) + 4) % 7;
+    if (wd < 0)
+        wd += 7;
+    return wd;
+}
+
+// Get the combined UTC + DST offset for the time passed in.
+//
+// NOTE: The implementation relies on the fact that no time zones have
+// more than one daylight savings offset change per month.
+// If this function is called with NaN it returns NaN.
+static LocalTimeOffset localTimeOffset(VM& vm, double ms, WTF::TimeType inputTimeType = WTF::UTCTime)
+{
+    LocalTimeOffsetCache& cache = vm.localTimeOffsetCache;
+    double start = cache.start;
+    double end = cache.end;
+    WTF::TimeType cachedTimeType = cache.timeType;
+
+    if (cachedTimeType == inputTimeType && start <= ms) {
+        // If the time fits in the cached interval, return the cached offset.
+        if (ms <= end) return cache.offset;
+
+        // Compute a possible new interval end.
+        double newEnd = end + cache.increment;
+
+        if (ms <= newEnd) {
+            LocalTimeOffset endOffset = calculateLocalTimeOffset(newEnd, inputTimeType);
+            if (cache.offset == endOffset) {
+                // If the offset at the end of the new interval still matches
+                // the offset in the cache, we grow the cached time interval
+                // and return the offset.
+                cache.end = newEnd;
+                cache.increment = msPerMonth;
+                return endOffset;
+            }
+            LocalTimeOffset offset = calculateLocalTimeOffset(ms, inputTimeType);
+            if (offset == endOffset) {
+                // The offset at the given time is equal to the offset at the
+                // new end of the interval, so that means that we've just skipped
+                // the point in time where the DST offset change occurred. Updated
+                // the interval to reflect this and reset the increment.
+                cache.start = ms;
+                cache.end = newEnd;
+                cache.increment = msPerMonth;
+            } else {
+                // The interval contains a DST offset change and the given time is
+                // before it. Adjust the increment to avoid a linear search for
+                // the offset change point and change the end of the interval.
+                cache.increment /= 3;
+                cache.end = ms;
+            }
+            // Update the offset in the cache and return it.
+            cache.offset = offset;
+            return offset;
+        }
+    }
+
+    // Compute the DST offset for the time and shrink the cache interval
+    // to only contain the time. This allows fast repeated DST offset
+    // computations for the same time.
+    LocalTimeOffset offset = calculateLocalTimeOffset(ms, inputTimeType);
+    cache.offset = offset;
+    cache.start = ms;
+    cache.end = ms;
+    cache.increment = msPerMonth;
+    cache.timeType = inputTimeType;
+    return offset;
+}
+
+double gregorianDateTimeToMS(VM& vm, const GregorianDateTime& t, double milliSeconds, WTF::TimeType inputTimeType)
+{
+    double day = dateToDaysFrom1970(t.year(), t.month(), t.monthDay());
+    double ms = timeToMS(t.hour(), t.minute(), t.second(), milliSeconds);
+    double localTimeResult = (day * WTF::msPerDay) + ms;
+    double localToUTCTimeOffset = inputTimeType == LocalTime
+        ? localTimeOffset(vm, localTimeResult, inputTimeType).offset : 0;
+
+    return localTimeResult - localToUTCTimeOffset;
+}
+
+// input is UTC
+void msToGregorianDateTime(VM& vm, double ms, WTF::TimeType outputTimeType, GregorianDateTime& tm)
+{
+    LocalTimeOffset localTime;
+    if (outputTimeType == WTF::LocalTime) {
+        localTime = localTimeOffset(vm, ms);
+        ms += localTime.offset;
+    }
+
+    const int year = msToYear(ms);
+    tm.setSecond(msToSeconds(ms));
+    tm.setMinute(msToMinutes(ms));
+    tm.setHour(msToHours(ms));
+    tm.setWeekDay(msToWeekDay(ms));
+    tm.setYearDay(dayInYear(ms, year));
+    tm.setMonthDay(dayInMonthFromDayInYear(tm.yearDay(), isLeapYear(year)));
+    tm.setMonth(monthFromDayInYear(tm.yearDay(), isLeapYear(year)));
+    tm.setYear(year);
+    tm.setIsDST(localTime.isDST);
+    tm.setUtcOffset(localTime.offset / WTF::msPerSecond);
+}
+
+double parseDateFromNullTerminatedCharacters(VM& vm, const char* dateString)
+{
+    bool haveTZ;
+    int offset;
+    double localTimeMS = WTF::parseDateFromNullTerminatedCharacters(dateString, haveTZ, offset);
+    if (std::isnan(localTimeMS))
+        return std::numeric_limits<double>::quiet_NaN();
+
+    // fall back to local timezone.
+    if (!haveTZ)
+        offset = localTimeOffset(vm, localTimeMS, WTF::LocalTime).offset / WTF::msPerMinute;
+
+    return localTimeMS - (offset * WTF::msPerMinute);
+}
+
+double parseDate(VM& vm, const String& date)
+{
+    if (date == vm.cachedDateString)
+        return vm.cachedDateStringValue;
+    double value = parseES5DateFromNullTerminatedCharacters(date.utf8().data());
+    if (std::isnan(value))
+        value = parseDateFromNullTerminatedCharacters(vm, date.utf8().data());
+    vm.cachedDateString = date;
+    vm.cachedDateStringValue = value;
+    return value;
+}
+
+} // namespace JSC
diff --git a/runtime/JSDateMath.h b/runtime/JSDateMath.h
new file mode 100644
index 0000000..5e81382
--- /dev/null
+++ b/runtime/JSDateMath.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Research In Motion Limited. All rights reserved.
+ *
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code, released
+ * March 31, 1998.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ */
+
+#pragma once
+
+#include <wtf/DateMath.h>
+#include <wtf/GregorianDateTime.h>
+
+namespace JSC {
+
+class VM;
+
+JS_EXPORT_PRIVATE void msToGregorianDateTime(VM&, double, WTF::TimeType outputTimeType, GregorianDateTime&);
+JS_EXPORT_PRIVATE double gregorianDateTimeToMS(VM&, const GregorianDateTime&, double, WTF::TimeType inputTimeType);
+JS_EXPORT_PRIVATE double getUTCOffset(VM&);
+JS_EXPORT_PRIVATE double parseDateFromNullTerminatedCharacters(VM&, const char* dateString);
+JS_EXPORT_PRIVATE double parseDate(VM&, const WTF::String&);
+
+} // namespace JSC
diff --git a/runtime/JSDestructibleObject.h b/runtime/JSDestructibleObject.h
new file mode 100644
index 0000000..0c10f2d
--- /dev/null
+++ b/runtime/JSDestructibleObject.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+struct ClassInfo;
+
+class JSDestructibleObject : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static const bool needsDestruction = true;
+    
+    template<typename CellType>
+    static Subspace* subspaceFor(VM& vm)
+    {
+        return &vm.destructibleObjectSpace;
+    }
+
+    const ClassInfo* classInfo() const { return m_classInfo; }
+    
+    static ptrdiff_t classInfoOffset() { return OBJECT_OFFSETOF(JSDestructibleObject, m_classInfo); }
+
+protected:
+    JSDestructibleObject(VM& vm, Structure* structure, Butterfly* butterfly = 0)
+        : JSNonFinalObject(vm, structure, butterfly)
+        , m_classInfo(structure->classInfo())
+    {
+        ASSERT(m_classInfo);
+    }
+
+private:
+    const ClassInfo* m_classInfo;
+};
+
+} // namespace JSC
diff --git a/runtime/JSDestructibleObjectSubspace.cpp b/runtime/JSDestructibleObjectSubspace.cpp
new file mode 100644
index 0000000..544eff2
--- /dev/null
+++ b/runtime/JSDestructibleObjectSubspace.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSDestructibleObjectSubspace.h"
+
+#include "MarkedBlockInlines.h"
+#include "JSCInlines.h"
+#include "SubspaceInlines.h"
+
+namespace JSC {
+
+namespace {
+
+struct DestroyFunc {
+    ALWAYS_INLINE void operator()(VM&, JSCell* cell) const
+    {
+        static_cast<JSDestructibleObject*>(cell)->classInfo()->methodTable.destroy(cell);
+    }
+};
+
+} // anonymous namespace
+
+JSDestructibleObjectSubspace::JSDestructibleObjectSubspace(CString name, Heap& heap)
+    : Subspace(name, heap, AllocatorAttributes(NeedsDestruction, HeapCell::JSCell))
+{
+}
+
+JSDestructibleObjectSubspace::~JSDestructibleObjectSubspace()
+{
+}
+
+FreeList JSDestructibleObjectSubspace::finishSweep(MarkedBlock::Handle& handle, MarkedBlock::Handle::SweepMode sweepMode)
+{
+    return handle.finishSweepKnowingSubspace(sweepMode, DestroyFunc());
+}
+
+void JSDestructibleObjectSubspace::destroy(VM& vm, JSCell* cell)
+{
+    DestroyFunc()(vm, cell);
+}
+
+} // namespace JSC
+
diff --git a/runtime/JSDestructibleObjectSubspace.h b/runtime/JSDestructibleObjectSubspace.h
new file mode 100644
index 0000000..0538a7a
--- /dev/null
+++ b/runtime/JSDestructibleObjectSubspace.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Subspace.h"
+
+namespace JSC {
+
+class JSDestructibleObjectSubspace : public Subspace {
+public:
+    JS_EXPORT_PRIVATE JSDestructibleObjectSubspace(CString name, Heap&);
+    JS_EXPORT_PRIVATE virtual ~JSDestructibleObjectSubspace();
+    
+    FreeList finishSweep(MarkedBlock::Handle&, MarkedBlock::Handle::SweepMode) override;
+    void destroy(VM&, JSCell*) override;
+};
+
+} // namespace JSC
+
diff --git a/runtime/JSEnvironmentRecord.cpp b/runtime/JSEnvironmentRecord.cpp
new file mode 100644
index 0000000..8807c42
--- /dev/null
+++ b/runtime/JSEnvironmentRecord.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2007, 2008, 2012, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSEnvironmentRecord.h"
+
+#include "HeapSnapshotBuilder.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSEnvironmentRecord::s_info = { "EnvironmentRecord", &Base::s_info, 0, CREATE_METHOD_TABLE(JSEnvironmentRecord) };
+
+void JSEnvironmentRecord::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSEnvironmentRecord* thisObject = jsCast<JSEnvironmentRecord*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.appendValuesHidden(thisObject->variables(), thisObject->symbolTable()->scopeSize());
+}
+
+void JSEnvironmentRecord::heapSnapshot(JSCell* cell, HeapSnapshotBuilder& builder)
+{
+    JSEnvironmentRecord* thisObject = jsCast<JSEnvironmentRecord*>(cell);
+    Base::heapSnapshot(cell, builder);
+
+    ConcurrentJSLocker locker(thisObject->symbolTable()->m_lock);
+    SymbolTable::Map::iterator end = thisObject->symbolTable()->end(locker);
+    for (SymbolTable::Map::iterator it = thisObject->symbolTable()->begin(locker); it != end; ++it) {
+        SymbolTableEntry::Fast entry = it->value;
+        ASSERT(!entry.isNull());
+        ScopeOffset offset = entry.scopeOffset();
+        if (!thisObject->isValidScopeOffset(offset))
+            continue;
+
+        JSValue toValue = thisObject->variableAt(offset).get();
+        if (toValue && toValue.isCell())
+            builder.appendVariableNameEdge(thisObject, toValue.asCell(), it->key.get());
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/JSEnvironmentRecord.h b/runtime/JSEnvironmentRecord.h
new file mode 100644
index 0000000..b81758e
--- /dev/null
+++ b/runtime/JSEnvironmentRecord.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2007, 2008, 2012, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "JSSymbolTableObject.h"
+#include "SymbolTable.h"
+
+namespace JSC {
+
+class LLIntOffsetsExtractor;
+
+class JSEnvironmentRecord : public JSSymbolTableObject {
+    friend class JIT;
+    friend class LLIntOffsetsExtractor;
+
+public:
+    typedef JSSymbolTableObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    WriteBarrierBase<Unknown>* variables()
+    {
+        return bitwise_cast<WriteBarrierBase<Unknown>*>(bitwise_cast<char*>(this) + offsetOfVariables());
+    }
+    
+    bool isValidScopeOffset(ScopeOffset offset)
+    {
+        return !!offset && offset.offset() < symbolTable()->scopeSize();
+    }
+    
+    WriteBarrierBase<Unknown>& variableAt(ScopeOffset offset)
+    {
+        ASSERT(isValidScopeOffset(offset));
+        return variables()[offset.offset()];
+    }
+
+    static size_t offsetOfVariables()
+    {
+        return WTF::roundUpToMultipleOf<sizeof(WriteBarrier<Unknown>)>(sizeof(JSEnvironmentRecord));
+    }
+    
+    static ptrdiff_t offsetOfVariable(ScopeOffset offset)
+    {
+        return offsetOfVariables() + offset.offset() * sizeof(WriteBarrier<Unknown>);
+    }
+
+    DECLARE_INFO;
+
+    static size_t allocationSizeForScopeSize(unsigned scopeSize)
+    {
+        return offsetOfVariables() + scopeSize * sizeof(WriteBarrier<Unknown>);
+    }
+    
+    static size_t allocationSize(SymbolTable* symbolTable)
+    {
+        return allocationSizeForScopeSize(symbolTable->scopeSize());
+    }
+    
+protected:
+    JSEnvironmentRecord(
+        VM& vm,
+        Structure* structure,
+        JSScope* scope,
+        SymbolTable* symbolTable)
+        : Base(vm, structure, scope, symbolTable)
+    {
+    }
+    
+    void finishCreationUninitialized(VM& vm)
+    {
+        Base::finishCreation(vm);
+    }
+    
+    void finishCreation(VM& vm, JSValue value)
+    {
+        finishCreationUninitialized(vm);
+        ASSERT(value == jsUndefined() || value == jsTDZValue());
+        for (unsigned i = symbolTable()->scopeSize(); i--;) {
+            // Filling this with undefined/TDZEmptyValue is useful because that's what variables start out as.
+            variableAt(ScopeOffset(i)).setStartingValue(value);
+        }
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static void heapSnapshot(JSCell*, HeapSnapshotBuilder&);
+};
+
+} // namespace JSC
diff --git a/runtime/JSExportMacros.h b/runtime/JSExportMacros.h
new file mode 100644
index 0000000..126cbc9
--- /dev/null
+++ b/runtime/JSExportMacros.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ * This file handles shared library symbol export decorations. It is recommended
+ * that all WebKit projects use these definitions so that symbol exports work
+ * properly on all platforms and compilers that WebKit builds under.
+ */
+
+#pragma once
+
+#include <wtf/ExportMacros.h>
+
+// See note in wtf/Platform.h for more info on EXPORT_MACROS.
+#if USE(EXPORT_MACROS)
+
+#if defined(BUILDING_JavaScriptCore) || defined(STATICALLY_LINKED_WITH_JavaScriptCore)
+#define JS_EXPORT_PRIVATE WTF_EXPORT
+#else
+#define JS_EXPORT_PRIVATE WTF_IMPORT
+#endif
+
+#define JS_EXPORT_HIDDEN WTF_HIDDEN
+#define JS_EXPORTDATA JS_EXPORT_PRIVATE
+#define JS_EXPORTCLASS JS_EXPORT_PRIVATE
+
+#else // !USE(EXPORT_MACROS)
+
+#if OS(WINDOWS) && !COMPILER(GCC_OR_CLANG)
+
+#if defined(BUILDING_JavaScriptCore) || defined(STATICALLY_LINKED_WITH_JavaScriptCore)
+#define JS_EXPORTDATA __declspec(dllexport)
+#else
+#define JS_EXPORTDATA __declspec(dllimport)
+#endif
+
+#define JS_EXPORTCLASS JS_EXPORTDATA
+
+#else // !PLATFORM...
+
+#define JS_EXPORTDATA
+#define JS_EXPORTCLASS
+
+#endif // !PLATFORM...
+
+#define JS_EXPORT_PRIVATE
+#define JS_EXPORT_HIDDEN
+
+#endif // USE(EXPORT_MACROS)
diff --git a/runtime/JSFixedArray.cpp b/runtime/JSFixedArray.cpp
new file mode 100644
index 0000000..15d3e23
--- /dev/null
+++ b/runtime/JSFixedArray.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSFixedArray.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSFixedArray::s_info = { "JSFixedArray", nullptr, nullptr, CREATE_METHOD_TABLE(JSFixedArray) };
+
+void JSFixedArray::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSFixedArray* thisObject = jsCast<JSFixedArray*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.appendValuesHidden(thisObject->buffer(), thisObject->size());
+}
+
+} // namespace JSC
diff --git a/runtime/JSFixedArray.h b/runtime/JSFixedArray.h
new file mode 100644
index 0000000..c754e6b
--- /dev/null
+++ b/runtime/JSFixedArray.h
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSFixedArray : public JSCell {
+    typedef JSCell Base;
+
+public:
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFixedArrayType, StructureFlags), info());
+    }
+
+    ALWAYS_INLINE static JSFixedArray* createFromArray(ExecState* exec, VM& vm, JSArray* array)
+    {
+        IndexingType indexingType = array->indexingType() & IndexingShapeMask;
+        unsigned length = array->length();
+        JSFixedArray* result = JSFixedArray::create(vm, vm.fixedArrayStructure.get(), length);
+
+        if (!length)
+            return result;
+
+        if (indexingType == ContiguousShape || indexingType == Int32Shape) {
+            for (unsigned i = 0; i < length; i++) {
+                JSValue value = array->butterfly()->contiguous()[i].get();
+                value = !!value ? value : jsUndefined();
+                result->buffer()[i].set(vm, result, value);
+            }
+            return result;
+        }
+
+        if (indexingType == DoubleShape) {
+            for (unsigned i = 0; i < length; i++) {
+                double d = array->butterfly()->contiguousDouble()[i];
+                JSValue value = std::isnan(d) ? jsUndefined() : JSValue(JSValue::EncodeAsDouble, d);
+                result->buffer()[i].set(vm, result, value);
+            }
+            return result;
+        }
+
+
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        for (unsigned i = 0; i < length; i++) {
+            JSValue value = array->getDirectIndex(exec, i);
+            if (!value) {
+                // When we see a hole, we assume that it's safe to assume the get would have returned undefined.
+                // We may still call into this function when !globalObject->isArrayIteratorProtocolFastAndNonObservable(),
+                // however, if we do that, we ensure we're calling in with an array with all self properties between
+                // [0, length).
+                //
+                // We may also call into this during OSR exit to materialize a phantom fixed array.
+                // We may be creating a fixed array during OSR exit even after the iterator protocol changed.
+                // But, when the phantom would have logically been created, the protocol hadn't been
+                // changed. Therefore, it is sound to assume empty indices are jsUndefined().
+                value = jsUndefined();
+            }
+            RETURN_IF_EXCEPTION(throwScope, nullptr);
+            result->buffer()[i].set(vm, result, value);
+        }
+        return result;
+    }
+
+    ALWAYS_INLINE JSValue get(unsigned index)
+    {
+        ASSERT(index < m_size);
+        return buffer()[index].get();
+    }
+
+    ALWAYS_INLINE WriteBarrier<Unknown>* buffer() { return bitwise_cast<WriteBarrier<Unknown>*>(bitwise_cast<char*>(this) + offsetOfData()); }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    unsigned size() const { return m_size; }
+
+    static size_t offsetOfSize() { return OBJECT_OFFSETOF(JSFixedArray, m_size); }
+
+    static size_t offsetOfData()
+    {
+        return WTF::roundUpToMultipleOf<sizeof(WriteBarrier<Unknown>)>(sizeof(JSFixedArray));
+    }
+
+private:
+    unsigned m_size;
+
+    ALWAYS_INLINE static JSFixedArray* create(VM& vm, Structure* structure, unsigned size)
+    {
+        JSFixedArray* result = new (NotNull, allocateCell<JSFixedArray>(vm.heap, allocationSize(size))) JSFixedArray(vm, structure, size);
+        result->finishCreation(vm);
+        return result;
+    }
+
+
+    JSFixedArray(VM& vm, Structure* structure, unsigned size)
+        : Base(vm, structure)
+        , m_size(size)
+    {
+        for (unsigned i = 0; i < m_size; i++)
+            buffer()[i].setStartingValue(JSValue());
+    }
+
+
+    static size_t allocationSize(unsigned numItems)
+    {
+        return offsetOfData() + numItems * sizeof(WriteBarrier<Unknown>);
+    }
+};
+
+} // namespace JSC
diff --git a/runtime/JSFloat32Array.h b/runtime/JSFloat32Array.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSFloat32Array.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSFloat64Array.h b/runtime/JSFloat64Array.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSFloat64Array.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSFunction.cpp b/runtime/JSFunction.cpp
new file mode 100644
index 0000000..f100383
--- /dev/null
+++ b/runtime/JSFunction.cpp
@@ -0,0 +1,707 @@
+/*
+ *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2009, 2015-2017 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2007 Maks Orlovich
+ *  Copyright (C) 2015 Canon Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSFunction.h"
+
+#include "ClonedArguments.h"
+#include "CodeBlock.h"
+#include "CommonIdentifiers.h"
+#include "CallFrame.h"
+#include "ExceptionHelpers.h"
+#include "FunctionPrototype.h"
+#include "GeneratorPrototype.h"
+#include "GetterSetter.h"
+#include "JSArray.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "JSFunctionInlines.h"
+#include "JSGlobalObject.h"
+#include "Interpreter.h"
+#include "ObjectConstructor.h"
+#include "ObjectPrototype.h"
+#include "Parser.h"
+#include "PropertyNameArray.h"
+#include "StackVisitor.h"
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMError(exec, scope, createNotAConstructorError(exec, exec->jsCallee()));
+}
+
+const ClassInfo JSFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(JSFunction) };
+
+bool JSFunction::isHostFunctionNonInline() const
+{
+    return isHostFunction();
+}
+
+JSFunction* JSFunction::create(VM& vm, FunctionExecutable* executable, JSScope* scope)
+{
+    return create(vm, executable, scope, scope->globalObject(vm)->functionStructure());
+}
+
+JSFunction* JSFunction::create(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+{
+    JSFunction* result = createImpl(vm, executable, scope, structure);
+    executable->singletonFunction()->notifyWrite(vm, result, "Allocating a function");
+    return result;
+}
+
+JSFunction* JSFunction::create(VM& vm, JSGlobalObject* globalObject, int length, const String& name, NativeFunction nativeFunction, Intrinsic intrinsic, NativeFunction nativeConstructor, const DOMJIT::Signature* signature)
+{
+    NativeExecutable* executable = vm.getHostFunction(nativeFunction, intrinsic, nativeConstructor, signature, name);
+    JSFunction* function = new (NotNull, allocateCell<JSFunction>(vm.heap)) JSFunction(vm, globalObject, globalObject->functionStructure());
+    // Can't do this during initialization because getHostFunction might do a GC allocation.
+    function->finishCreation(vm, executable, length, name);
+    return function;
+}
+
+JSFunction::JSFunction(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    : Base(vm, globalObject, structure)
+    , m_executable()
+{
+}
+
+void JSFunction::finishCreation(VM& vm, NativeExecutable* executable, int length, const String& name)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    m_executable.set(vm, this, executable);
+    // Some NativeExecutable functions, like JSBoundFunction, decide to lazily allocate their name string.
+    if (!name.isNull())
+        putDirect(vm, vm.propertyNames->name, jsString(&vm, name), ReadOnly | DontEnum);
+    putDirect(vm, vm.propertyNames->length, jsNumber(length), ReadOnly | DontEnum);
+}
+
+JSFunction* JSFunction::createBuiltinFunction(VM& vm, FunctionExecutable* executable, JSGlobalObject* globalObject)
+{
+    JSFunction* function = create(vm, executable, globalObject);
+    function->putDirect(vm, vm.propertyNames->name, jsString(&vm, executable->name().string()), ReadOnly | DontEnum);
+    function->putDirect(vm, vm.propertyNames->length, jsNumber(executable->functionLength()), ReadOnly | DontEnum);
+    return function;
+}
+
+JSFunction* JSFunction::createBuiltinFunction(VM& vm, FunctionExecutable* executable, JSGlobalObject* globalObject, const String& name)
+{
+    JSFunction* function = create(vm, executable, globalObject);
+    function->putDirect(vm, vm.propertyNames->name, jsString(&vm, name), ReadOnly | DontEnum);
+    function->putDirect(vm, vm.propertyNames->length, jsNumber(executable->functionLength()), ReadOnly | DontEnum);
+    return function;
+}
+
+FunctionRareData* JSFunction::allocateRareData(VM& vm)
+{
+    ASSERT(!m_rareData);
+    FunctionRareData* rareData = FunctionRareData::create(vm);
+
+    // A DFG compilation thread may be trying to read the rare data
+    // We want to ensure that it sees it properly allocated
+    WTF::storeStoreFence();
+
+    m_rareData.set(vm, this, rareData);
+    return m_rareData.get();
+}
+
+FunctionRareData* JSFunction::allocateAndInitializeRareData(ExecState* exec, size_t inlineCapacity)
+{
+    ASSERT(!m_rareData);
+    VM& vm = exec->vm();
+    JSObject* prototype = jsDynamicCast<JSObject*>(get(exec, vm.propertyNames->prototype));
+    JSGlobalObject* globalObject = this->globalObject(vm);
+    if (!prototype)
+        prototype = globalObject->objectPrototype();
+    FunctionRareData* rareData = FunctionRareData::create(vm);
+    rareData->initializeObjectAllocationProfile(vm, globalObject, prototype, inlineCapacity);
+
+    // A DFG compilation thread may be trying to read the rare data
+    // We want to ensure that it sees it properly allocated
+    WTF::storeStoreFence();
+
+    m_rareData.set(vm, this, rareData);
+    return m_rareData.get();
+}
+
+FunctionRareData* JSFunction::initializeRareData(ExecState* exec, size_t inlineCapacity)
+{
+    ASSERT(!!m_rareData);
+    VM& vm = exec->vm();
+    JSObject* prototype = jsDynamicCast<JSObject*>(get(exec, vm.propertyNames->prototype));
+    JSGlobalObject* globalObject = this->globalObject(vm);
+    if (!prototype)
+        prototype = globalObject->objectPrototype();
+    m_rareData->initializeObjectAllocationProfile(vm, globalObject, prototype, inlineCapacity);
+    return m_rareData.get();
+}
+
+String JSFunction::name(VM& vm)
+{
+    if (isHostFunction()) {
+        NativeExecutable* executable = jsCast<NativeExecutable*>(this->executable());
+        return executable->name();
+    }
+    const Identifier identifier = jsExecutable()->name();
+    if (identifier == vm.propertyNames->builtinNames().starDefaultPrivateName())
+        return emptyString();
+    return identifier.string();
+}
+
+String JSFunction::displayName(VM& vm)
+{
+    JSValue displayName = getDirect(vm, vm.propertyNames->displayName);
+    
+    if (displayName && isJSString(displayName))
+        return asString(displayName)->tryGetValue();
+    
+    return String();
+}
+
+const String JSFunction::calculatedDisplayName(VM& vm)
+{
+    const String explicitName = displayName(vm);
+    
+    if (!explicitName.isEmpty())
+        return explicitName;
+    
+    const String actualName = name(vm);
+    if (!actualName.isEmpty() || isHostOrBuiltinFunction())
+        return actualName;
+    
+    return jsExecutable()->inferredName().string();
+}
+
+const SourceCode* JSFunction::sourceCode() const
+{
+    if (isHostOrBuiltinFunction())
+        return 0;
+    return &jsExecutable()->source();
+}
+    
+void JSFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSFunction* thisObject = jsCast<JSFunction*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_executable);
+    visitor.append(thisObject->m_rareData);
+}
+
+CallType JSFunction::getCallData(JSCell* cell, CallData& callData)
+{
+    JSFunction* thisObject = jsCast<JSFunction*>(cell);
+    if (thisObject->isHostFunction()) {
+        callData.native.function = thisObject->nativeFunction();
+        return CallType::Host;
+    }
+    callData.js.functionExecutable = thisObject->jsExecutable();
+    callData.js.scope = thisObject->scope();
+    return CallType::JS;
+}
+
+class RetrieveArgumentsFunctor {
+public:
+    RetrieveArgumentsFunctor(JSFunction* functionObj)
+        : m_targetCallee(jsDynamicCast<JSObject*>(functionObj))
+        , m_result(jsNull())
+    {
+    }
+
+    JSValue result() const { return m_result; }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        JSCell* callee = visitor->callee();
+        if (callee != m_targetCallee)
+            return StackVisitor::Continue;
+
+        m_result = JSValue(visitor->createArguments());
+        return StackVisitor::Done;
+    }
+
+private:
+    JSObject* m_targetCallee;
+    mutable JSValue m_result;
+};
+
+static JSValue retrieveArguments(ExecState* exec, JSFunction* functionObj)
+{
+    RetrieveArgumentsFunctor functor(functionObj);
+    exec->iterate(functor);
+    return functor.result();
+}
+
+EncodedJSValue JSFunction::argumentsGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+{
+    JSFunction* thisObj = jsCast<JSFunction*>(JSValue::decode(thisValue));
+    ASSERT(!thisObj->isHostFunction());
+
+    return JSValue::encode(retrieveArguments(exec, thisObj));
+}
+
+class RetrieveCallerFunctionFunctor {
+public:
+    RetrieveCallerFunctionFunctor(JSFunction* functionObj)
+        : m_targetCallee(jsDynamicCast<JSObject*>(functionObj))
+        , m_hasFoundFrame(false)
+        , m_hasSkippedToCallerFrame(false)
+        , m_result(jsNull())
+    {
+    }
+
+    JSValue result() const { return m_result; }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        JSCell* callee = visitor->callee();
+
+        if (callee && callee->inherits(JSBoundFunction::info()))
+            return StackVisitor::Continue;
+
+        if (!m_hasFoundFrame && (callee != m_targetCallee))
+            return StackVisitor::Continue;
+
+        m_hasFoundFrame = true;
+        if (!m_hasSkippedToCallerFrame) {
+            m_hasSkippedToCallerFrame = true;
+            return StackVisitor::Continue;
+        }
+
+        if (callee)
+            m_result = callee;
+        return StackVisitor::Done;
+    }
+
+private:
+    JSObject* m_targetCallee;
+    mutable bool m_hasFoundFrame;
+    mutable bool m_hasSkippedToCallerFrame;
+    mutable JSValue m_result;
+};
+
+static JSValue retrieveCallerFunction(ExecState* exec, JSFunction* functionObj)
+{
+    RetrieveCallerFunctionFunctor functor(functionObj);
+    exec->iterate(functor);
+    return functor.result();
+}
+
+EncodedJSValue JSFunction::callerGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSFunction* thisObj = jsCast<JSFunction*>(JSValue::decode(thisValue));
+    ASSERT(!thisObj->isHostFunction());
+    JSValue caller = retrieveCallerFunction(exec, thisObj);
+
+    // See ES5.1 15.3.5.4 - Function.caller may not be used to retrieve a strict caller.
+    if (!caller.isObject() || !asObject(caller)->inherits(JSFunction::info())) {
+        // It isn't a JSFunction, but if it is a JSCallee from a program or eval call or an internal constructor, return null.
+        if (jsDynamicCast<JSCallee*>(caller) || jsDynamicCast<InternalFunction*>(caller))
+            return JSValue::encode(jsNull());
+        return JSValue::encode(caller);
+    }
+    JSFunction* function = jsCast<JSFunction*>(caller);
+
+    // Firefox returns null for native code callers, so we match that behavior.
+    if (function->isHostOrBuiltinFunction())
+        return JSValue::encode(jsNull());
+    if (!function->jsExecutable()->isStrictMode())
+        return JSValue::encode(caller);
+    return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Function.caller used to retrieve strict caller")));
+}
+
+bool JSFunction::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    JSFunction* thisObject = jsCast<JSFunction*>(object);
+    if (thisObject->isHostOrBuiltinFunction()) {
+        thisObject->reifyBoundNameIfNeeded(vm, exec, propertyName);
+        return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+    }
+
+    if (propertyName == vm.propertyNames->prototype && thisObject->jsExecutable()->hasPrototypeProperty() && !thisObject->jsExecutable()->isClassConstructorFunction()) {
+        unsigned attributes;
+        PropertyOffset offset = thisObject->getDirectOffset(vm, propertyName, attributes);
+        if (!isValidOffset(offset)) {
+            JSObject* prototype = nullptr;
+            if (thisObject->jsExecutable()->parseMode() == SourceParseMode::GeneratorWrapperFunctionMode) {
+                // Unlike function instances, the object that is the value of the a GeneratorFunction's prototype
+                // property does not have a constructor property whose value is the GeneratorFunction instance.
+                // https://tc39.github.io/ecma262/#sec-generatorfunction-instances-prototype
+                prototype = constructEmptyObject(exec, thisObject->globalObject(vm)->generatorPrototype());
+            } else {
+                prototype = constructEmptyObject(exec);
+                prototype->putDirect(vm, vm.propertyNames->constructor, thisObject, DontEnum);
+            }
+
+            thisObject->putDirect(vm, vm.propertyNames->prototype, prototype, DontDelete | DontEnum);
+            offset = thisObject->getDirectOffset(vm, vm.propertyNames->prototype, attributes);
+            ASSERT(isValidOffset(offset));
+        }
+
+        slot.setValue(thisObject, attributes, thisObject->getDirect(offset), offset);
+    }
+
+    if (propertyName == exec->propertyNames().arguments) {
+        if (!thisObject->jsExecutable()->hasCallerAndArgumentsProperties())
+            return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+        
+        slot.setCacheableCustom(thisObject, ReadOnly | DontEnum | DontDelete, argumentsGetter);
+        return true;
+    }
+
+    if (propertyName == exec->propertyNames().caller) {
+        if (!thisObject->jsExecutable()->hasCallerAndArgumentsProperties())
+            return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+
+        slot.setCacheableCustom(thisObject, ReadOnly | DontEnum | DontDelete, callerGetter);
+        return true;
+    }
+
+    thisObject->reifyLazyPropertyIfNeeded(vm, exec, propertyName);
+
+    return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+}
+
+void JSFunction::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    JSFunction* thisObject = jsCast<JSFunction*>(object);
+    if (!thisObject->isHostOrBuiltinFunction() && mode.includeDontEnumProperties()) {
+        VM& vm = exec->vm();
+        // Make sure prototype has been reified.
+        PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+        thisObject->methodTable(vm)->getOwnPropertySlot(thisObject, exec, vm.propertyNames->prototype, slot);
+
+        if (thisObject->jsExecutable()->hasCallerAndArgumentsProperties()) {
+            propertyNames.add(vm.propertyNames->arguments);
+            propertyNames.add(vm.propertyNames->caller);
+        }
+        if (!thisObject->hasReifiedLength())
+            propertyNames.add(vm.propertyNames->length);
+        if (!thisObject->hasReifiedName())
+            propertyNames.add(vm.propertyNames->name);
+    } else if (thisObject->isHostOrBuiltinFunction() && mode.includeDontEnumProperties() && thisObject->inherits(JSBoundFunction::info()) && !thisObject->hasReifiedName())
+        propertyNames.add(exec->vm().propertyNames->name);
+    Base::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);
+}
+
+bool JSFunction::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSFunction* thisObject = jsCast<JSFunction*>(cell);
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject))) {
+        scope.release();
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+    }
+
+    if (thisObject->isHostOrBuiltinFunction()) {
+        LazyPropertyType propType = thisObject->reifyBoundNameIfNeeded(vm, exec, propertyName);
+        if (propType == LazyPropertyType::IsLazyProperty)
+            slot.disableCaching();
+        scope.release();
+        return Base::put(thisObject, exec, propertyName, value, slot);
+    }
+
+    if (propertyName == vm.propertyNames->prototype) {
+        slot.disableCaching();
+        // Make sure prototype has been reified, such that it can only be overwritten
+        // following the rules set out in ECMA-262 8.12.9.
+        PropertySlot getSlot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+        thisObject->methodTable(vm)->getOwnPropertySlot(thisObject, exec, propertyName, getSlot);
+        if (thisObject->m_rareData)
+            thisObject->m_rareData->clear("Store to prototype property of a function");
+        scope.release();
+        return Base::put(thisObject, exec, propertyName, value, slot);
+    }
+
+    if (propertyName == vm.propertyNames->arguments || propertyName == vm.propertyNames->caller) {
+        slot.disableCaching();
+        if (!thisObject->jsExecutable()->hasCallerAndArgumentsProperties()) {
+            // This will trigger the property to be reified, if this is not already the case!
+            // FIXME: Investigate if the `hasProperty()` call is even needed, as in the `!hasCallerAndArgumentsProperties()` case,
+            // these properties are not lazy and should not need to be reified. (https://bugs.webkit.org/show_bug.cgi?id=163579)
+            bool okay = thisObject->hasProperty(exec, propertyName);
+            RETURN_IF_EXCEPTION(scope, false);
+            ASSERT_UNUSED(okay, okay);
+            scope.release();
+            return Base::put(thisObject, exec, propertyName, value, slot);
+        }
+        return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+    }
+    LazyPropertyType propType = thisObject->reifyLazyPropertyIfNeeded(vm, exec, propertyName);
+    if (propType == LazyPropertyType::IsLazyProperty)
+        slot.disableCaching();
+    scope.release();
+    return Base::put(thisObject, exec, propertyName, value, slot);
+}
+
+bool JSFunction::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    JSFunction* thisObject = jsCast<JSFunction*>(cell);
+    if (thisObject->isHostOrBuiltinFunction())
+        thisObject->reifyBoundNameIfNeeded(exec->vm(), exec, propertyName);
+    else if (exec->vm().deletePropertyMode() != VM::DeletePropertyMode::IgnoreConfigurable) {
+        // For non-host functions, don't let these properties by deleted - except by DefineOwnProperty.
+        VM& vm = exec->vm();
+        FunctionExecutable* executable = thisObject->jsExecutable();
+        
+        if (propertyName == exec->propertyNames().caller || propertyName == exec->propertyNames().arguments)
+            return !executable->hasCallerAndArgumentsProperties();
+
+        if (propertyName == exec->propertyNames().prototype && !executable->isArrowFunction())
+            return false;
+
+        thisObject->reifyLazyPropertyIfNeeded(vm, exec, propertyName);
+    }
+    
+    return Base::deleteProperty(thisObject, exec, propertyName);
+}
+
+bool JSFunction::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool throwException)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSFunction* thisObject = jsCast<JSFunction*>(object);
+    if (thisObject->isHostOrBuiltinFunction()) {
+        thisObject->reifyBoundNameIfNeeded(vm, exec, propertyName);
+        scope.release();
+        return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+    }
+
+    if (propertyName == vm.propertyNames->prototype) {
+        // Make sure prototype has been reified, such that it can only be overwritten
+        // following the rules set out in ECMA-262 8.12.9.
+        PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+        thisObject->methodTable(vm)->getOwnPropertySlot(thisObject, exec, propertyName, slot);
+        if (thisObject->m_rareData)
+            thisObject->m_rareData->clear("Store to prototype property of a function");
+        scope.release();
+        return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+    }
+
+    bool valueCheck;
+    if (propertyName == vm.propertyNames->arguments) {
+        if (!thisObject->jsExecutable()->hasCallerAndArgumentsProperties()) {
+            if (thisObject->jsExecutable()->isClass()) {
+                thisObject->reifyLazyPropertyIfNeeded(vm, exec, propertyName);
+                scope.release();
+                return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+            }
+            PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+            if (!Base::getOwnPropertySlot(thisObject, exec, propertyName, slot))
+                thisObject->putDirectAccessor(exec, propertyName, thisObject->globalObject(vm)->throwTypeErrorArgumentsCalleeAndCallerGetterSetter(), DontDelete | DontEnum | Accessor);
+            scope.release();
+            return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+        }
+        valueCheck = !descriptor.value() || sameValue(exec, descriptor.value(), retrieveArguments(exec, thisObject));
+    } else if (propertyName == vm.propertyNames->caller) {
+        if (!thisObject->jsExecutable()->hasCallerAndArgumentsProperties()) {
+            if (thisObject->jsExecutable()->isClass()) {
+                thisObject->reifyLazyPropertyIfNeeded(vm, exec, propertyName);
+                scope.release();
+                return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+            }
+            PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+            if (!Base::getOwnPropertySlot(thisObject, exec, propertyName, slot))
+                thisObject->putDirectAccessor(exec, propertyName, thisObject->globalObject(vm)->throwTypeErrorArgumentsCalleeAndCallerGetterSetter(), DontDelete | DontEnum | Accessor);
+            scope.release();
+            return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+        }
+        valueCheck = !descriptor.value() || sameValue(exec, descriptor.value(), retrieveCallerFunction(exec, thisObject));
+    } else {
+        thisObject->reifyLazyPropertyIfNeeded(vm, exec, propertyName);
+        scope.release();
+        return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+    }
+     
+    if (descriptor.configurablePresent() && descriptor.configurable())
+        return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeConfigurabilityError));
+    if (descriptor.enumerablePresent() && descriptor.enumerable())
+        return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeEnumerabilityError));
+    if (descriptor.isAccessorDescriptor())
+        return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+    if (descriptor.writablePresent() && descriptor.writable())
+        return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeWritabilityError));
+    if (!valueCheck)
+        return typeError(exec, scope, throwException, ASCIILiteral(ReadonlyPropertyChangeError));
+    return true;
+}
+
+// ECMA 13.2.2 [[Construct]]
+ConstructType JSFunction::getConstructData(JSCell* cell, ConstructData& constructData)
+{
+    JSFunction* thisObject = jsCast<JSFunction*>(cell);
+
+    if (thisObject->isHostFunction()) {
+        if (thisObject->nativeConstructor() == callHostFunctionAsConstructor)
+            return ConstructType::None;
+        constructData.native.function = thisObject->nativeConstructor();
+        return ConstructType::Host;
+    }
+
+    FunctionExecutable* functionExecutable = thisObject->jsExecutable();
+    if (functionExecutable->constructAbility() == ConstructAbility::CannotConstruct)
+        return ConstructType::None;
+
+    constructData.js.functionExecutable = functionExecutable;
+    constructData.js.scope = thisObject->scope();
+    return ConstructType::JS;
+}
+
+String getCalculatedDisplayName(VM& vm, JSObject* object)
+{
+    if (JSFunction* function = jsDynamicCast<JSFunction*>(object))
+        return function->calculatedDisplayName(vm);
+    if (InternalFunction* function = jsDynamicCast<InternalFunction*>(object))
+        return function->calculatedDisplayName(vm);
+    return emptyString();
+}
+
+void JSFunction::setFunctionName(ExecState* exec, JSValue value)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // The "name" property may have been already been defined as part of a property list in an
+    // object literal (and therefore reified).
+    if (hasReifiedName())
+        return;
+
+    ASSERT(!isHostFunction());
+    ASSERT(jsExecutable()->ecmaName().isNull());
+    String name;
+    if (value.isSymbol()) {
+        SymbolImpl& uid = asSymbol(value)->privateName().uid();
+        if (uid.isNullSymbol())
+            name = emptyString();
+        else
+            name = makeString('[', String(&uid), ']');
+    } else {
+        JSString* jsStr = value.toString(exec);
+        RETURN_IF_EXCEPTION(scope, void());
+        name = jsStr->value(exec);
+        RETURN_IF_EXCEPTION(scope, void());
+    }
+    reifyName(vm, exec, name);
+}
+
+void JSFunction::reifyLength(VM& vm)
+{
+    FunctionRareData* rareData = this->rareData(vm);
+
+    ASSERT(!hasReifiedLength());
+    ASSERT(!isHostFunction());
+    JSValue initialValue = jsNumber(jsExecutable()->functionLength());
+    unsigned initialAttributes = DontEnum | ReadOnly;
+    const Identifier& identifier = vm.propertyNames->length;
+    putDirect(vm, identifier, initialValue, initialAttributes);
+
+    rareData->setHasReifiedLength();
+}
+
+void JSFunction::reifyName(VM& vm, ExecState* exec)
+{
+    const Identifier& ecmaName = jsExecutable()->ecmaName();
+    String name;
+    // https://tc39.github.io/ecma262/#sec-exports-runtime-semantics-evaluation
+    // When the ident is "*default*", we need to set "default" for the ecma name.
+    // This "*default*" name is never shown to users.
+    if (ecmaName == exec->propertyNames().builtinNames().starDefaultPrivateName())
+        name = exec->propertyNames().defaultKeyword.string();
+    else
+        name = ecmaName.string();
+    reifyName(vm, exec, name);
+}
+
+void JSFunction::reifyName(VM& vm, ExecState* exec, String name)
+{
+    FunctionRareData* rareData = this->rareData(vm);
+
+    ASSERT(!hasReifiedName());
+    ASSERT(!isHostFunction());
+    unsigned initialAttributes = DontEnum | ReadOnly;
+    const Identifier& propID = vm.propertyNames->name;
+
+    if (exec->lexicalGlobalObject()->needsSiteSpecificQuirks()) {
+        auto illegalCharMatcher = [] (UChar ch) -> bool {
+            return ch == ' ' || ch == '|';
+        };
+        if (name.find(illegalCharMatcher) != notFound)
+            name = String();
+    }
+    
+    if (jsExecutable()->isGetter())
+        name = makeString("get ", name);
+    else if (jsExecutable()->isSetter())
+        name = makeString("set ", name);
+
+    putDirect(vm, propID, jsString(exec, name), initialAttributes);
+    rareData->setHasReifiedName();
+}
+
+JSFunction::LazyPropertyType JSFunction::reifyLazyPropertyIfNeeded(VM& vm, ExecState* exec, PropertyName propertyName)
+{
+    if (propertyName == vm.propertyNames->length) {
+        if (!hasReifiedLength())
+            reifyLength(vm);
+        return LazyPropertyType::IsLazyProperty;
+    } else if (propertyName == vm.propertyNames->name) {
+        if (!hasReifiedName())
+            reifyName(vm, exec);
+        return LazyPropertyType::IsLazyProperty;
+    }
+    return LazyPropertyType::NotLazyProperty;
+}
+
+JSFunction::LazyPropertyType JSFunction::reifyBoundNameIfNeeded(VM& vm, ExecState* exec, PropertyName propertyName)
+{
+    const Identifier& nameIdent = vm.propertyNames->name;
+    if (propertyName != nameIdent)
+        return LazyPropertyType::NotLazyProperty;
+
+    if (hasReifiedName())
+        return LazyPropertyType::IsLazyProperty;
+
+    if (this->inherits(JSBoundFunction::info())) {
+        FunctionRareData* rareData = this->rareData(vm);
+        String name = makeString("bound ", static_cast<NativeExecutable*>(m_executable.get())->name());
+        unsigned initialAttributes = DontEnum | ReadOnly;
+        putDirect(vm, nameIdent, jsString(exec, name), initialAttributes);
+        rareData->setHasReifiedName();
+    }
+    return LazyPropertyType::IsLazyProperty;
+}
+
+} // namespace JSC
diff --git a/runtime/JSFunction.h b/runtime/JSFunction.h
new file mode 100644
index 0000000..4a25333
--- /dev/null
+++ b/runtime/JSFunction.h
@@ -0,0 +1,207 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2006-2009, 2015-2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2007 Maks Orlovich
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "FunctionRareData.h"
+#include "InternalFunction.h"
+#include "JSCallee.h"
+#include "JSScope.h"
+#include "Watchpoint.h"
+
+namespace JSC {
+
+class ExecutableBase;
+class FunctionExecutable;
+class FunctionPrototype;
+class JSLexicalEnvironment;
+class JSGlobalObject;
+class LLIntOffsetsExtractor;
+class NativeExecutable;
+class SourceCode;
+class InternalFunction;
+namespace DFG {
+class SpeculativeJIT;
+class JITCompiler;
+}
+
+namespace DOMJIT {
+class Signature;
+}
+
+
+JS_EXPORT_PRIVATE EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState*);
+
+JS_EXPORT_PRIVATE String getCalculatedDisplayName(VM&, JSObject*);
+
+class JSFunction : public JSCallee {
+    friend class JIT;
+    friend class DFG::SpeculativeJIT;
+    friend class DFG::JITCompiler;
+    friend class VM;
+    friend class InternalFunction;
+
+public:
+    typedef JSCallee Base;
+    const static unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
+
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
+        return sizeof(JSFunction);
+    }
+
+    JS_EXPORT_PRIVATE static JSFunction* create(VM&, JSGlobalObject*, int length, const String& name, NativeFunction, Intrinsic = NoIntrinsic, NativeFunction nativeConstructor = callHostFunctionAsConstructor, const DOMJIT::Signature* = nullptr);
+    
+    static JSFunction* createWithInvalidatedReallocationWatchpoint(VM&, FunctionExecutable*, JSScope*);
+
+    static JSFunction* create(VM&, FunctionExecutable*, JSScope*);
+    static JSFunction* create(VM&, FunctionExecutable*, JSScope*, Structure*);
+
+    JS_EXPORT_PRIVATE static JSFunction* createBuiltinFunction(VM&, FunctionExecutable*, JSGlobalObject*);
+    static JSFunction* createBuiltinFunction(VM&, FunctionExecutable*, JSGlobalObject*, const String& name);
+
+    JS_EXPORT_PRIVATE String name(VM&);
+    JS_EXPORT_PRIVATE String displayName(VM&);
+    const String calculatedDisplayName(VM&);
+
+    ExecutableBase* executable() const { return m_executable.get(); }
+
+    // To call any of these methods include JSFunctionInlines.h
+    bool isHostFunction() const;
+    FunctionExecutable* jsExecutable() const;
+    Intrinsic intrinsic() const;
+
+    JS_EXPORT_PRIVATE const SourceCode* sourceCode() const;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info()); 
+    }
+
+    NativeFunction nativeFunction();
+    NativeFunction nativeConstructor();
+
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+
+    static inline ptrdiff_t offsetOfExecutable()
+    {
+        return OBJECT_OFFSETOF(JSFunction, m_executable);
+    }
+
+    static inline ptrdiff_t offsetOfRareData()
+    {
+        return OBJECT_OFFSETOF(JSFunction, m_rareData);
+    }
+
+    FunctionRareData* rareData(VM& vm)
+    {
+        if (UNLIKELY(!m_rareData))
+            return allocateRareData(vm);
+        return m_rareData.get();
+    }
+
+    FunctionRareData* rareData(ExecState* exec, unsigned inlineCapacity)
+    {
+        if (UNLIKELY(!m_rareData))
+            return allocateAndInitializeRareData(exec, inlineCapacity);
+        if (UNLIKELY(!m_rareData->isObjectAllocationProfileInitialized()))
+            return initializeRareData(exec, inlineCapacity);
+        return m_rareData.get();
+    }
+
+    FunctionRareData* rareData()
+    {
+        FunctionRareData* rareData = m_rareData.get();
+
+        // The JS thread may be concurrently creating the rare data
+        // If we see it, we want to ensure it has been properly created
+        WTF::loadLoadFence();
+
+        return rareData;
+    }
+
+    bool isHostOrBuiltinFunction() const;
+    bool isBuiltinFunction() const;
+    JS_EXPORT_PRIVATE bool isHostFunctionNonInline() const;
+    bool isClassConstructorFunction() const;
+
+    void setFunctionName(ExecState*, JSValue name);
+
+protected:
+    JS_EXPORT_PRIVATE JSFunction(VM&, JSGlobalObject*, Structure*);
+    JSFunction(VM&, FunctionExecutable*, JSScope*, Structure*);
+
+    void finishCreation(VM&, NativeExecutable*, int length, const String& name);
+    using Base::finishCreation;
+
+    FunctionRareData* allocateRareData(VM&);
+    FunctionRareData* allocateAndInitializeRareData(ExecState*, size_t inlineCapacity);
+    FunctionRareData* initializeRareData(ExecState*, size_t inlineCapacity);
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode = EnumerationMode());
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+
+private:
+    static JSFunction* createImpl(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+    {
+        JSFunction* function = new (NotNull, allocateCell<JSFunction>(vm.heap)) JSFunction(vm, executable, scope, structure);
+        ASSERT(function->structure()->globalObject());
+        function->finishCreation(vm);
+        return function;
+    }
+
+    bool hasReifiedLength() const;
+    bool hasReifiedName() const;
+    void reifyLength(VM&);
+    void reifyName(VM&, ExecState*);
+    void reifyName(VM&, ExecState*, String name);
+
+    enum class LazyPropertyType { NotLazyProperty, IsLazyProperty };
+    LazyPropertyType reifyLazyPropertyIfNeeded(VM&, ExecState*, PropertyName);
+    LazyPropertyType reifyBoundNameIfNeeded(VM&, ExecState*, PropertyName);
+
+    friend class LLIntOffsetsExtractor;
+
+    static EncodedJSValue argumentsGetter(ExecState*, EncodedJSValue, PropertyName);
+    static EncodedJSValue callerGetter(ExecState*, EncodedJSValue, PropertyName);
+    static EncodedJSValue lengthGetter(ExecState*, EncodedJSValue, PropertyName);
+    static EncodedJSValue nameGetter(ExecState*, EncodedJSValue, PropertyName);
+
+    WriteBarrier<ExecutableBase> m_executable;
+    WriteBarrier<FunctionRareData> m_rareData;
+};
+
+} // namespace JSC
diff --git a/runtime/JSFunctionInlines.h b/runtime/JSFunctionInlines.h
new file mode 100644
index 0000000..263a00c
--- /dev/null
+++ b/runtime/JSFunctionInlines.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "FunctionExecutable.h"
+#include "JSFunction.h"
+#include "NativeExecutable.h"
+
+namespace JSC {
+
+inline JSFunction* JSFunction::createWithInvalidatedReallocationWatchpoint(
+    VM& vm, FunctionExecutable* executable, JSScope* scope)
+{
+    ASSERT(executable->singletonFunction()->hasBeenInvalidated());
+    return createImpl(vm, executable, scope, scope->globalObject(vm)->functionStructure());
+}
+
+inline JSFunction::JSFunction(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+    : Base(vm, scope, structure)
+    , m_executable(vm, this, executable)
+    , m_rareData()
+{
+}
+
+inline FunctionExecutable* JSFunction::jsExecutable() const
+{
+    ASSERT(!isHostFunctionNonInline());
+    return static_cast<FunctionExecutable*>(m_executable.get());
+}
+
+inline bool JSFunction::isHostFunction() const
+{
+    ASSERT(m_executable);
+    return m_executable->isHostFunction();
+}
+
+inline Intrinsic JSFunction::intrinsic() const
+{
+    return executable()->intrinsic();
+}
+
+inline bool JSFunction::isBuiltinFunction() const
+{
+    return !isHostFunction() && jsExecutable()->isBuiltinFunction();
+}
+
+inline bool JSFunction::isHostOrBuiltinFunction() const
+{
+    return isHostFunction() || isBuiltinFunction();
+}
+
+inline bool JSFunction::isClassConstructorFunction() const
+{
+    return !isHostFunction() && jsExecutable()->isClassConstructorFunction();
+}
+
+inline NativeFunction JSFunction::nativeFunction()
+{
+    ASSERT(isHostFunctionNonInline());
+    return static_cast<NativeExecutable*>(m_executable.get())->function();
+}
+
+inline NativeFunction JSFunction::nativeConstructor()
+{
+    ASSERT(isHostFunctionNonInline());
+    return static_cast<NativeExecutable*>(m_executable.get())->constructor();
+}
+
+inline bool isHostFunction(JSValue value, NativeFunction nativeFunction)
+{
+    JSFunction* function = jsCast<JSFunction*>(getJSFunction(value));
+    if (!function || !function->isHostFunction())
+        return false;
+    return function->nativeFunction() == nativeFunction;
+}
+
+inline bool JSFunction::hasReifiedLength() const
+{
+    return m_rareData ? m_rareData->hasReifiedLength() : false;
+}
+
+inline bool JSFunction::hasReifiedName() const
+{
+    return m_rareData ? m_rareData->hasReifiedName() : false;
+}
+
+} // namespace JSC
diff --git a/runtime/JSGeneratorFunction.cpp b/runtime/JSGeneratorFunction.cpp
new file mode 100644
index 0000000..9de8005
--- /dev/null
+++ b/runtime/JSGeneratorFunction.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGeneratorFunction.h"
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSFunction.h"
+#include "JSFunctionInlines.h"
+#include "JSObject.h"
+#include "PropertySlot.h"
+#include "VM.h"
+
+namespace JSC {
+
+const ClassInfo JSGeneratorFunction::s_info = { "GeneratorFunction", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSGeneratorFunction) };
+
+JSGeneratorFunction::JSGeneratorFunction(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+    : Base(vm, executable, scope, structure)
+{
+}
+
+JSGeneratorFunction* JSGeneratorFunction::createImpl(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+{
+    JSGeneratorFunction* generatorFunction = new (NotNull, allocateCell<JSGeneratorFunction>(vm.heap)) JSGeneratorFunction(vm, executable, scope, structure);
+    ASSERT(generatorFunction->structure()->globalObject());
+    generatorFunction->finishCreation(vm);
+    return generatorFunction;
+}
+
+JSGeneratorFunction* JSGeneratorFunction::create(VM& vm, FunctionExecutable* executable, JSScope* scope)
+{
+    return create(vm, executable, scope, scope->globalObject()->generatorFunctionStructure());
+}
+
+JSGeneratorFunction* JSGeneratorFunction::create(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+{
+    JSGeneratorFunction* generatorFunction = createImpl(vm, executable, scope, structure);
+    executable->singletonFunction()->notifyWrite(vm, generatorFunction, "Allocating a generator function");
+    return generatorFunction;
+}
+
+JSGeneratorFunction* JSGeneratorFunction::createWithInvalidatedReallocationWatchpoint(VM& vm, FunctionExecutable* executable, JSScope* scope)
+{
+    return createImpl(vm, executable, scope, scope->globalObject()->generatorFunctionStructure());
+}
+
+} // namespace JSC
diff --git a/runtime/JSGeneratorFunction.h b/runtime/JSGeneratorFunction.h
new file mode 100644
index 0000000..b424b15
--- /dev/null
+++ b/runtime/JSGeneratorFunction.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSFunction.h"
+
+namespace JSC {
+
+class JSGlobalObject;
+class LLIntOffsetsExtractor;
+class LLIntDesiredOffsets;
+
+class JSGeneratorFunction : public JSFunction {
+    friend class JIT;
+#if ENABLE(DFG_JIT)
+    friend class DFG::SpeculativeJIT;
+    friend class DFG::JITCompiler;
+#endif
+    friend class VM;
+public:
+    typedef JSFunction Base;
+
+    enum class GeneratorResumeMode : int32_t {
+        NormalMode = 0,
+        ReturnMode = 1,
+        ThrowMode = 2
+    };
+
+    enum class GeneratorState : int32_t {
+        Completed = -1,
+        Executing = -2,
+    };
+
+    // [this], @generator, @generatorState, @generatorValue, @generatorResumeMode, @generatorFrame.
+    enum class GeneratorArgument : int32_t {
+        ThisValue = 0,
+        Generator = 1,
+        State = 2,
+        Value = 3,
+        ResumeMode = 4,
+        Frame = 5,
+    };
+
+    const static unsigned StructureFlags = Base::StructureFlags;
+
+    DECLARE_EXPORT_INFO;
+
+    static JSGeneratorFunction* create(VM&, FunctionExecutable*, JSScope*);
+    static JSGeneratorFunction* create(VM&, FunctionExecutable*, JSScope*, Structure*);
+    static JSGeneratorFunction* createWithInvalidatedReallocationWatchpoint(VM&, FunctionExecutable*, JSScope*);
+
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
+        return sizeof(JSGeneratorFunction);
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info());
+    }
+
+private:
+    JSGeneratorFunction(VM&, FunctionExecutable*, JSScope*, Structure*);
+
+    static JSGeneratorFunction* createImpl(VM&, FunctionExecutable*, JSScope*, Structure*);
+
+    friend class LLIntOffsetsExtractor;
+};
+
+} // namespace JSC
diff --git a/runtime/JSGenericTypedArrayView.h b/runtime/JSGenericTypedArrayView.h
new file mode 100644
index 0000000..9cc05fa
--- /dev/null
+++ b/runtime/JSGenericTypedArrayView.h
@@ -0,0 +1,386 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSArrayBufferView.h"
+#include "ThrowScope.h"
+#include "ToNativeFromValue.h"
+
+namespace JSC {
+
+JS_EXPORT_PRIVATE const ClassInfo* getInt8ArrayClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getInt16ArrayClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getInt32ArrayClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getUint8ArrayClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getUint8ClampedArrayClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getUint16ArrayClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getUint32ArrayClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getFloat32ArrayClassInfo();
+JS_EXPORT_PRIVATE const ClassInfo* getFloat64ArrayClassInfo();
+
+// A typed array view is our representation of a typed array object as seen
+// from JavaScript. For example:
+//
+// var o = new Int8Array(100);
+//
+// Here, 'o' points to a JSGenericTypedArrayView<int8_t>.
+//
+// Views contain five fields:
+//
+//     Structure* S     // from JSCell
+//     Butterfly* B     // from JSObject
+//     ElementType* V
+//     uint32_t L
+//     TypedArrayMode M
+//
+// These fields take up a total of four pointer-width words. FIXME: Make
+// it take less words!
+//
+// B is usually unused but may stored some additional "overflow" data for
+// one of the modes. V always points to the base of the typed array's data,
+// and may point to either GC-managed copied space, or data in the C heap;
+// which of those things it points to is governed by the mode although for
+// simple accesses to the view you can just read from the pointer either
+// way. M specifies the mode of the view. L is the length, in units that
+// depend on the view's type.
+
+// The JSGenericTypedArrayView is templatized by an Adaptor that controls
+// the element type and how it's converted; it should obey the following
+// interface; I use int8_t as an example:
+//
+// struct Adaptor {
+//     typedef int8_t Type;
+//     typedef Int8Array ViewType;
+//     typedef JSInt8Array JSViewType;
+//     static int8_t toNativeFromInt32(int32_t);
+//     static int8_t toNativeFromUint32(uint32_t);
+//     static int8_t toNativeFromDouble(double);
+//     static JSValue toJSValue(int8_t);
+//     static double toDouble(int8_t);
+//     template<T> static T::Type convertTo(uint8_t);
+// };
+
+enum class CopyType {
+    LeftToRight,
+    Unobservable,
+};
+
+static const char* const typedArrayBufferHasBeenDetachedErrorMessage = "Underlying ArrayBuffer has been detached from the view";
+
+template<typename Adaptor>
+class JSGenericTypedArrayView : public JSArrayBufferView {
+public:
+    typedef JSArrayBufferView Base;
+    typedef typename Adaptor::Type ElementType;
+
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetPropertyNames | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;
+
+    static const unsigned elementSize = sizeof(typename Adaptor::Type);
+    
+protected:
+    JSGenericTypedArrayView(VM&, ConstructionContext&);
+    
+public:
+    static JSGenericTypedArrayView* create(ExecState*, Structure*, unsigned length);
+    static JSGenericTypedArrayView* createWithFastVector(ExecState*, Structure*, unsigned length, void* vector);
+    static JSGenericTypedArrayView* createUninitialized(ExecState*, Structure*, unsigned length);
+    static JSGenericTypedArrayView* create(ExecState*, Structure*, PassRefPtr<ArrayBuffer>, unsigned byteOffset, unsigned length);
+    static JSGenericTypedArrayView* create(VM&, Structure*, PassRefPtr<typename Adaptor::ViewType> impl);
+    static JSGenericTypedArrayView* create(Structure*, JSGlobalObject*, PassRefPtr<typename Adaptor::ViewType> impl);
+    
+    unsigned byteLength() const { return m_length * sizeof(typename Adaptor::Type); }
+    size_t byteSize() const { return sizeOf(m_length, sizeof(typename Adaptor::Type)); }
+    
+    const typename Adaptor::Type* typedVector() const
+    {
+        return bitwise_cast<const typename Adaptor::Type*>(vector());
+    }
+    typename Adaptor::Type* typedVector()
+    {
+        return bitwise_cast<typename Adaptor::Type*>(vector());
+    }
+
+    // These methods are meant to match indexed access methods that JSObject
+    // supports - hence the slight redundancy.
+    bool canGetIndexQuickly(unsigned i)
+    {
+        return i < m_length;
+    }
+    bool canSetIndexQuickly(unsigned i)
+    {
+        return i < m_length;
+    }
+    
+    typename Adaptor::Type getIndexQuicklyAsNativeValue(unsigned i)
+    {
+        ASSERT(i < m_length);
+        return typedVector()[i];
+    }
+    
+    double getIndexQuicklyAsDouble(unsigned i)
+    {
+        return Adaptor::toDouble(getIndexQuicklyAsNativeValue(i));
+    }
+    
+    JSValue getIndexQuickly(unsigned i)
+    {
+        return Adaptor::toJSValue(getIndexQuicklyAsNativeValue(i));
+    }
+    
+    void setIndexQuicklyToNativeValue(unsigned i, typename Adaptor::Type value)
+    {
+        ASSERT(i < m_length);
+        typedVector()[i] = value;
+    }
+    
+    void setIndexQuicklyToDouble(unsigned i, double value)
+    {
+        setIndexQuicklyToNativeValue(i, toNativeFromValue<Adaptor>(jsNumber(value)));
+    }
+    
+    void setIndexQuickly(unsigned i, JSValue value)
+    {
+        ASSERT(!value.isObject());
+        setIndexQuicklyToNativeValue(i, toNativeFromValue<Adaptor>(value));
+    }
+    
+    bool setIndex(ExecState* exec, unsigned i, JSValue jsValue)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        typename Adaptor::Type value = toNativeFromValue<Adaptor>(exec, jsValue);
+        RETURN_IF_EXCEPTION(scope, false);
+
+        if (isNeutered()) {
+            throwTypeError(exec, scope, ASCIILiteral(typedArrayBufferHasBeenDetachedErrorMessage));
+            return false;
+        }
+
+        if (i >= m_length)
+            return false;
+
+        setIndexQuicklyToNativeValue(i, value);
+        return true;
+    }
+
+    static ElementType toAdaptorNativeFromValue(ExecState* exec, JSValue jsValue) { return toNativeFromValue<Adaptor>(exec, jsValue); }
+
+    static std::optional<ElementType> toAdaptorNativeFromValueWithoutCoercion(JSValue jsValue) { return toNativeFromValueWithoutCoercion<Adaptor>(jsValue); }
+
+    void sort()
+    {
+        RELEASE_ASSERT(!isNeutered());
+        switch (Adaptor::typeValue) {
+        case TypeFloat32:
+            sortFloat<int32_t>();
+            break;
+        case TypeFloat64:
+            sortFloat<int64_t>();
+            break;
+        default: {
+            ElementType* array = typedVector();
+            std::sort(array, array + m_length);
+            break;
+        }
+        }
+    }
+
+    bool canAccessRangeQuickly(unsigned offset, unsigned length)
+    {
+        return offset <= m_length
+            && offset + length <= m_length
+            // check overflow
+            && offset + length >= offset;
+    }
+    
+    // Like canSetQuickly, except: if it returns false, it will throw the
+    // appropriate exception.
+    bool validateRange(ExecState*, unsigned offset, unsigned length);
+
+    // Returns true if successful, and false on error; if it returns false
+    // then it will have thrown an exception.
+    bool set(ExecState*, unsigned offset, JSObject*, unsigned objectOffset, unsigned length, CopyType type = CopyType::Unobservable);
+    
+    PassRefPtr<typename Adaptor::ViewType> possiblySharedTypedImpl();
+    PassRefPtr<typename Adaptor::ViewType> unsharedTypedImpl();
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(typeForTypedArrayType(Adaptor::typeValue), StructureFlags), info(), NonArray);
+    }
+    
+    static const ClassInfo s_info; // This is never accessed directly, since that would break linkage on some compilers.
+    
+    static const ClassInfo* info()
+    {
+        switch (Adaptor::typeValue) {
+        case TypeInt8:
+            return getInt8ArrayClassInfo();
+        case TypeInt16:
+            return getInt16ArrayClassInfo();
+        case TypeInt32:
+            return getInt32ArrayClassInfo();
+        case TypeUint8:
+            return getUint8ArrayClassInfo();
+        case TypeUint8Clamped:
+            return getUint8ClampedArrayClassInfo();
+        case TypeUint16:
+            return getUint16ArrayClassInfo();
+        case TypeUint32:
+            return getUint32ArrayClassInfo();
+        case TypeFloat32:
+            return getFloat32ArrayClassInfo();
+        case TypeFloat64:
+            return getFloat64ArrayClassInfo();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return 0;
+        }
+    }
+    
+    ArrayBuffer* existingBuffer();
+
+    static const TypedArrayType TypedArrayStorageType = Adaptor::typeValue;
+
+    // This is the default DOM unwrapping. It calls toUnsharedNativeTypedView().
+    static RefPtr<typename Adaptor::ViewType> toWrapped(JSValue);
+    
+protected:
+    friend struct TypedArrayClassInfos;
+
+    static EncodedJSValue throwNeuteredTypedArrayTypeError(ExecState*, EncodedJSValue, PropertyName);
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+
+    static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
+    static bool putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
+    
+    static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+    static size_t estimatedSize(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    // Allocates the full-on native buffer and moves data into the C heap if
+    // necessary. Note that this never allocates in the GC heap.
+    static ArrayBuffer* slowDownAndWasteMemory(JSArrayBufferView*);
+    static PassRefPtr<ArrayBufferView> getTypedArrayImpl(JSArrayBufferView*);
+
+private:
+    // Returns true if successful, and false on error; it will throw on error.
+    template<typename OtherAdaptor>
+    bool setWithSpecificType(
+        ExecState*, unsigned offset, JSGenericTypedArrayView<OtherAdaptor>*,
+        unsigned objectOffset, unsigned length, CopyType);
+
+    // The ECMA 6 spec states that floating point Typed Arrays should have the following ordering:
+    //
+    // -Inifinity < negative finite numbers < -0.0 < 0.0 < positive finite numbers < Infinity < NaN
+    // Note: regardless of the sign or exact representation of a NaN it is greater than all other values.
+    //
+    // An interesting fact about IEEE 754 floating point numbers is that have an adjacent representation
+    // i.e. for any finite floating point x there does not exist a finite floating point y such that
+    // ((float) ((int) x + 1)) > y > x (where int represents a signed bit integer with the same number
+    // of bits as float). Thus, if we have an array of floating points if we view it as an
+    // array of signed bit integers it will sort in the format we desire. Note, denormal
+    // numbers fit this property as they are floating point numbers with a exponent field of all
+    // zeros so they will be closer to the signed zeros than any normalized number.
+    //
+    // All the processors we support, however, use twos complement. Fortunately, if you compare a signed
+    // bit number as if it were twos complement the result will be correct assuming both numbers are not
+    // negative. e.g.
+    //
+    //    - <=> - = reversed (-30 > -20 = true)
+    //    + <=> + = ordered (30 > 20 = true)
+    //    - <=> + = ordered (-30 > 20 = false)
+    //    + <=> - = ordered (30 > -20 = true)
+    //
+    // For NaN, we normalize the NaN to a peticular representation; the sign bit is 0, all exponential bits
+    // are 1 and only the MSB of the mantissa is 1. So, NaN is recognized as the largest integral numbers.
+
+    void purifyArray()
+    {
+        ElementType* array = typedVector();
+        for (unsigned i = 0; i < m_length; i++)
+            array[i] = purifyNaN(array[i]);
+    }
+
+    template<typename IntegralType>
+    static bool ALWAYS_INLINE sortComparison(IntegralType a, IntegralType b)
+    {
+        if (a >= 0 || b >= 0)
+            return a < b;
+        return a > b;
+    }
+
+    template<typename IntegralType>
+    void sortFloat()
+    {
+        ASSERT(sizeof(IntegralType) == sizeof(ElementType));
+
+        // Since there might be another view that sets the bits of
+        // our floats to NaNs with negative sign bits we need to
+        // purify the array.
+        // We use a separate function here to avoid the strict aliasing rule.
+        // We could use a union but ASAN seems to frown upon that.
+        purifyArray();
+
+        IntegralType* array = reinterpret_cast_ptr<IntegralType*>(typedVector());
+        std::sort(array, array + m_length, sortComparison<IntegralType>);
+
+    }
+
+};
+
+template<typename Adaptor>
+inline RefPtr<typename Adaptor::ViewType> toPossiblySharedNativeTypedView(JSValue value)
+{
+    typename Adaptor::JSViewType* wrapper = jsDynamicCast<typename Adaptor::JSViewType*>(value);
+    if (!wrapper)
+        return nullptr;
+    return wrapper->possiblySharedTypedImpl();
+}
+
+template<typename Adaptor>
+inline RefPtr<typename Adaptor::ViewType> toUnsharedNativeTypedView(JSValue value)
+{
+    RefPtr<typename Adaptor::ViewType> result = toPossiblySharedNativeTypedView<Adaptor>(value);
+    if (!result || result->isShared())
+        return nullptr;
+    return result;
+}
+
+template<typename Adaptor>
+RefPtr<typename Adaptor::ViewType> JSGenericTypedArrayView<Adaptor>::toWrapped(JSValue value)
+{
+    return JSC::toUnsharedNativeTypedView<Adaptor>(value);
+}
+
+} // namespace JSC
diff --git a/runtime/JSGenericTypedArrayViewConstructor.h b/runtime/JSGenericTypedArrayViewConstructor.h
new file mode 100644
index 0000000..3f18e0e
--- /dev/null
+++ b/runtime/JSGenericTypedArrayViewConstructor.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+template<typename ViewClass>
+class JSGenericTypedArrayViewConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+protected:
+    JSGenericTypedArrayViewConstructor(VM&, Structure*);
+    void finishCreation(VM&, JSGlobalObject*, JSObject* prototype, const String& name, FunctionExecutable* privateAllocator);
+
+public:
+    static JSGenericTypedArrayViewConstructor* create(
+        VM&, JSGlobalObject*, Structure*, JSObject* prototype, const String& name, FunctionExecutable* privateAllocator);
+
+    // FIXME: We should fix the warnings for extern-template in JSObject template classes: https://bugs.webkit.org/show_bug.cgi?id=161979
+#if COMPILER(CLANG)
+#if __has_warning("-Wundefined-var-template")
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wundefined-var-template"
+#endif
+#endif
+    DECLARE_INFO;
+#if COMPILER(CLANG)
+#if __has_warning("-Wundefined-var-template")
+#pragma clang diagnostic pop
+#endif
+#endif
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+protected:
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/JSGenericTypedArrayViewConstructorInlines.h b/runtime/JSGenericTypedArrayViewConstructorInlines.h
new file mode 100644
index 0000000..47165f3
--- /dev/null
+++ b/runtime/JSGenericTypedArrayViewConstructorInlines.h
@@ -0,0 +1,286 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "IteratorOperations.h"
+#include "JSArrayBuffer.h"
+#include "JSCJSValueInlines.h"
+#include "JSDataView.h"
+#include "JSGenericTypedArrayViewConstructor.h"
+#include "JSGlobalObject.h"
+#include "StructureInlines.h"
+
+namespace JSC {
+
+template<typename ViewClass>
+JSGenericTypedArrayViewConstructor<ViewClass>::JSGenericTypedArrayViewConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+template<typename ViewClass>
+void JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation(VM& vm, JSGlobalObject* globalObject, JSObject* prototype, const String& name, FunctionExecutable* privateAllocator)
+{
+    Base::finishCreation(vm, name);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(3), DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->BYTES_PER_ELEMENT, jsNumber(ViewClass::elementSize), DontEnum | ReadOnly | DontDelete);
+
+    if (privateAllocator)
+        putDirectBuiltinFunction(vm, globalObject, vm.propertyNames->builtinNames().allocateTypedArrayPrivateName(), privateAllocator, DontEnum | DontDelete | ReadOnly);
+}
+
+template<typename ViewClass>
+JSGenericTypedArrayViewConstructor<ViewClass>*
+JSGenericTypedArrayViewConstructor<ViewClass>::create(
+    VM& vm, JSGlobalObject* globalObject, Structure* structure, JSObject* prototype,
+    const String& name, FunctionExecutable* privateAllocator)
+{
+    JSGenericTypedArrayViewConstructor* result =
+        new (NotNull, allocateCell<JSGenericTypedArrayViewConstructor>(vm.heap))
+        JSGenericTypedArrayViewConstructor(vm, structure);
+    result->finishCreation(vm, globalObject, prototype, name, privateAllocator);
+    return result;
+}
+
+template<typename ViewClass>
+Structure* JSGenericTypedArrayViewConstructor<ViewClass>::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(
+        vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+template<typename ViewClass>
+inline JSObject* constructGenericTypedArrayViewFromIterator(ExecState* exec, Structure* structure, JSValue iterator)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!iterator.isObject())
+        return throwTypeError(exec, scope, ASCIILiteral("Symbol.Iterator for the first argument did not return an object."));
+
+    MarkedArgumentBuffer storage;
+    while (true) {
+        JSValue next = iteratorStep(exec, iterator);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+
+        if (next.isFalse())
+            break;
+
+        JSValue nextItem = iteratorValue(exec, next);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+
+        storage.append(nextItem);
+    }
+
+    ViewClass* result = ViewClass::createUninitialized(exec, structure, storage.size());
+    ASSERT(!!scope.exception() == !result);
+    if (UNLIKELY(!result))
+        return nullptr;
+
+    for (unsigned i = 0; i < storage.size(); ++i) {
+        bool success = result->setIndex(exec, i, storage.at(i));
+        ASSERT(scope.exception() || success);
+        if (!success)
+            return nullptr;
+    }
+
+    return result;
+}
+
+template<typename ViewClass>
+inline JSObject* constructGenericTypedArrayViewWithArguments(ExecState* exec, Structure* structure, EncodedJSValue firstArgument, unsigned offset, std::optional<unsigned> lengthOpt)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue firstValue = JSValue::decode(firstArgument);
+
+    if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(firstValue)) {
+        RefPtr<ArrayBuffer> buffer = jsBuffer->impl();
+        unsigned length = 0;
+
+        if (lengthOpt)
+            length = lengthOpt.value();
+        else {
+            if ((buffer->byteLength() - offset) % ViewClass::elementSize)
+                return throwRangeError(exec, scope, ASCIILiteral("ArrayBuffer length minus the byteOffset is not a multiple of the element size"));
+            length = (buffer->byteLength() - offset) / ViewClass::elementSize;
+        }
+
+        scope.release();
+        return ViewClass::create(exec, structure, buffer, offset, length);
+    }
+    ASSERT(!offset && !lengthOpt);
+    
+    if (ViewClass::TypedArrayStorageType == TypeDataView)
+        return throwTypeError(exec, scope, ASCIILiteral("Expected ArrayBuffer for the first argument."));
+    
+    // For everything but DataView, we allow construction with any of:
+    // - Another array. This creates a copy of the of that array.
+    // - An integer. This creates a new typed array of that length and zero-initializes it.
+
+    if (JSObject* object = jsDynamicCast<JSObject*>(firstValue)) {
+        unsigned length;
+
+        if (isTypedView(object->classInfo()->typedArrayStorageType))
+            length = jsCast<JSArrayBufferView*>(object)->length();
+        else {
+            // This getPropertySlot operation should not be observed by the Proxy.
+            // So we use VMInquiry. And purge the opaque object cases (proxy and namespace object) by isTaintedByOpaqueObject() guard.
+            PropertySlot lengthSlot(object, PropertySlot::InternalMethodType::VMInquiry);
+            object->getPropertySlot(exec, vm.propertyNames->length, lengthSlot);
+            RETURN_IF_EXCEPTION(scope, nullptr);
+
+            JSValue iteratorFunc = object->get(exec, vm.propertyNames->iteratorSymbol);
+            RETURN_IF_EXCEPTION(scope, nullptr);
+
+            // We would like not use the iterator as it is painfully slow. Fortunately, unless
+            // 1) The iterator is not a known iterator.
+            // 2) The base object does not have a length getter.
+            // 3) The base object might have indexed getters.
+            // it should not be observable that we do not use the iterator.
+
+            if (!iteratorFunc.isUndefined()
+                && (iteratorFunc != object->globalObject()->arrayProtoValuesFunction()
+                    || lengthSlot.isAccessor() || lengthSlot.isCustom() || lengthSlot.isTaintedByOpaqueObject()
+                    || hasAnyArrayStorage(object->indexingType()))) {
+
+                    CallData callData;
+                    CallType callType = getCallData(iteratorFunc, callData);
+                    if (callType == CallType::None)
+                        return throwTypeError(exec, scope, ASCIILiteral("Symbol.Iterator for the first argument cannot be called."));
+
+                    ArgList arguments;
+                    JSValue iterator = call(exec, iteratorFunc, callType, callData, object, arguments);
+                    RETURN_IF_EXCEPTION(scope, nullptr);
+
+                    scope.release();
+                    return constructGenericTypedArrayViewFromIterator<ViewClass>(exec, structure, iterator);
+            }
+
+            length = lengthSlot.isUnset() ? 0 : lengthSlot.getValue(exec, vm.propertyNames->length).toUInt32(exec);
+            RETURN_IF_EXCEPTION(scope, nullptr);
+        }
+
+        
+        ViewClass* result = ViewClass::createUninitialized(exec, structure, length);
+        ASSERT(!!scope.exception() == !result);
+        if (UNLIKELY(!result))
+            return nullptr;
+        
+        scope.release();
+        if (!result->set(exec, 0, object, 0, length))
+            return nullptr;
+        
+        return result;
+    }
+
+    if (!firstValue.isNumber())
+        return throwTypeError(exec, scope, ASCIILiteral("Invalid array length argument"));
+
+    unsigned length = firstValue.toIndex(exec, "length");
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    scope.release();
+    return ViewClass::create(exec, structure, length);
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL constructGenericTypedArrayView(ExecState*);
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL constructGenericTypedArrayView(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    InternalFunction* function = asInternalFunction(exec->jsCallee());
+    Structure* parentStructure = function->globalObject()->typedArrayStructure(ViewClass::TypedArrayStorageType);
+    Structure* structure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), parentStructure);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    size_t argCount = exec->argumentCount();
+
+    if (!argCount) {
+        if (ViewClass::TypedArrayStorageType == TypeDataView)
+            return throwVMTypeError(exec, scope, ASCIILiteral("DataView constructor requires at least one argument."));
+
+        scope.release();
+        return JSValue::encode(ViewClass::create(exec, structure, 0));
+    }
+
+    JSValue firstValue = exec->uncheckedArgument(0);
+    unsigned offset = 0;
+    std::optional<unsigned> length = std::nullopt;
+    if (jsDynamicCast<JSArrayBuffer*>(firstValue) && argCount > 1) {
+        offset = exec->uncheckedArgument(1).toIndex(exec, "byteOffset");
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+        if (argCount > 2) {
+            if (ViewClass::TypedArrayStorageType == TypeDataView) {
+                // If the DataView byteLength is present but undefined, treat it as missing.
+                JSValue byteLengthValue = exec->uncheckedArgument(2);
+                if (!byteLengthValue.isUndefined()) {
+                    length = byteLengthValue.toIndex(exec, "byteLength");
+                    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+                }
+            } else {
+                length = exec->uncheckedArgument(2).toIndex(exec, "length");
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            }
+        }
+    }
+
+    scope.release();
+    return JSValue::encode(constructGenericTypedArrayViewWithArguments<ViewClass>(exec, structure, JSValue::encode(firstValue), offset, length));
+}
+
+template<typename ViewClass>
+ConstructType JSGenericTypedArrayViewConstructor<ViewClass>::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructGenericTypedArrayView<ViewClass>;
+    return ConstructType::Host;
+}
+
+template<typename ViewClass>
+static EncodedJSValue JSC_HOST_CALL callGenericTypedArrayView(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, ViewClass::info()->className));
+}
+
+template<typename ViewClass>
+CallType JSGenericTypedArrayViewConstructor<ViewClass>::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callGenericTypedArrayView<ViewClass>;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/JSGenericTypedArrayViewInlines.h b/runtime/JSGenericTypedArrayViewInlines.h
new file mode 100644
index 0000000..695d8be
--- /dev/null
+++ b/runtime/JSGenericTypedArrayViewInlines.h
@@ -0,0 +1,600 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBufferView.h"
+#include "DeferGC.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSArrayBuffer.h"
+#include "JSGenericTypedArrayView.h"
+#include "TypeError.h"
+#include "TypedArrays.h"
+
+namespace JSC {
+
+template<typename Adaptor>
+JSGenericTypedArrayView<Adaptor>::JSGenericTypedArrayView(
+    VM& vm, ConstructionContext& context)
+    : Base(vm, context)
+{
+}
+
+template<typename Adaptor>
+JSGenericTypedArrayView<Adaptor>* JSGenericTypedArrayView<Adaptor>::create(
+    ExecState* exec, Structure* structure, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConstructionContext context(vm, structure, length, sizeof(typename Adaptor::Type));
+    if (!context) {
+        throwOutOfMemoryError(exec, scope);
+        return nullptr;
+    }
+    JSGenericTypedArrayView* result =
+        new (NotNull, allocateCell<JSGenericTypedArrayView>(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result->finishCreation(vm);
+    return result;
+}
+
+template<typename Adaptor>
+JSGenericTypedArrayView<Adaptor>* JSGenericTypedArrayView<Adaptor>::createWithFastVector(
+    ExecState* exec, Structure* structure, unsigned length, void* vector)
+{
+    VM& vm = exec->vm();
+    ConstructionContext context(structure, length, vector);
+    RELEASE_ASSERT(context);
+    JSGenericTypedArrayView* result =
+        new (NotNull, allocateCell<JSGenericTypedArrayView>(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result->finishCreation(vm);
+    return result;
+}
+
+template<typename Adaptor>
+JSGenericTypedArrayView<Adaptor>* JSGenericTypedArrayView<Adaptor>::createUninitialized(
+    ExecState* exec, Structure* structure, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConstructionContext context(
+        vm, structure, length, sizeof(typename Adaptor::Type),
+        ConstructionContext::DontInitialize);
+    if (!context) {
+        throwOutOfMemoryError(exec, scope);
+        return nullptr;
+    }
+    JSGenericTypedArrayView* result =
+        new (NotNull, allocateCell<JSGenericTypedArrayView>(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result->finishCreation(vm);
+    return result;
+}
+
+template<typename Adaptor>
+JSGenericTypedArrayView<Adaptor>* JSGenericTypedArrayView<Adaptor>::create(
+    ExecState* exec, Structure* structure, PassRefPtr<ArrayBuffer> passedBuffer,
+    unsigned byteOffset, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    RefPtr<ArrayBuffer> buffer = passedBuffer;
+    size_t size = sizeof(typename Adaptor::Type);
+    if (!ArrayBufferView::verifySubRangeLength(buffer, byteOffset, length, size)) {
+        throwException(exec, scope, createRangeError(exec, "Length out of range of buffer"));
+        return nullptr;
+    }
+    if (!ArrayBufferView::verifyByteOffsetAlignment(byteOffset, size)) {
+        throwException(exec, scope, createRangeError(exec, "Byte offset is not aligned"));
+        return nullptr;
+    }
+    ConstructionContext context(vm, structure, buffer, byteOffset, length);
+    ASSERT(context);
+    JSGenericTypedArrayView* result =
+        new (NotNull, allocateCell<JSGenericTypedArrayView>(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result->finishCreation(vm);
+    return result;
+}
+
+template<typename Adaptor>
+JSGenericTypedArrayView<Adaptor>* JSGenericTypedArrayView<Adaptor>::create(
+    VM& vm, Structure* structure, PassRefPtr<typename Adaptor::ViewType> impl)
+{
+    RefPtr<ArrayBuffer> buffer = impl->possiblySharedBuffer();
+    ConstructionContext context(vm, structure, buffer, impl->byteOffset(), impl->length());
+    ASSERT(context);
+    JSGenericTypedArrayView* result =
+        new (NotNull, allocateCell<JSGenericTypedArrayView>(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result->finishCreation(vm);
+    return result;
+}
+
+template<typename Adaptor>
+JSGenericTypedArrayView<Adaptor>* JSGenericTypedArrayView<Adaptor>::create(
+    Structure* structure, JSGlobalObject* globalObject,
+    PassRefPtr<typename Adaptor::ViewType> impl)
+{
+    return create(globalObject->vm(), structure, impl);
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::validateRange(
+    ExecState* exec, unsigned offset, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (canAccessRangeQuickly(offset, length))
+        return true;
+    
+    throwException(exec, scope, createRangeError(exec, "Range consisting of offset and length are out of bounds"));
+    return false;
+}
+
+template<typename Adaptor>
+template<typename OtherAdaptor>
+bool JSGenericTypedArrayView<Adaptor>::setWithSpecificType(
+    ExecState* exec, unsigned offset, JSGenericTypedArrayView<OtherAdaptor>* other,
+    unsigned otherOffset, unsigned length, CopyType type)
+{
+    // Handle the hilarious case: the act of getting the length could have resulted
+    // in neutering. Well, no. That'll never happen because there cannot be
+    // side-effects on getting the length of a typed array. But predicting where there
+    // are, or aren't, side-effects is a fool's game so we resort to this cheap
+    // check. Worst case, if we're wrong, people start seeing less things get copied
+    // but we won't have a security vulnerability.
+    length = std::min(length, other->length());
+
+    RELEASE_ASSERT(other->canAccessRangeQuickly(otherOffset, length));
+    if (!validateRange(exec, offset, length))
+        return false;
+    
+    // This method doesn't support copying between the same array. Note that
+    // set() will only call this if the types differ, which implicitly guarantees
+    // that we can't be the same array. This is relevant because the way we detect
+    // non-overlapping is by checking if either (a) either array doesn't have a
+    // backing buffer or (b) the backing buffers are different, but that doesn't
+    // catch the case where it's the *same* array - fortunately though, this code
+    // path never needs to worry about that case.
+    ASSERT(static_cast<JSCell*>(this) != static_cast<JSCell*>(other));
+    
+    // 1) If the two arrays are non-overlapping, we can copy in any order we like
+    //    and we don't need an intermediate buffer. Arrays are definitely
+    //    non-overlapping if either one of them has no backing buffer (that means
+    //    that it *owns* its philosophical backing buffer) or if they have
+    //    different backing buffers.
+    // 2) If the two arrays overlap but have the same element size, we can do a
+    //    memmove-like copy where we flip-flop direction based on which vector
+    //    starts before the other:
+    //    A) If the destination vector is before the source vector, then a forward
+    //       copy is in order.
+    //    B) If the destination vector is after the source vector, then a backward
+    //       copy is in order.
+    // 3) If we have different element sizes and there is a chance of overlap then
+    //    we need an intermediate vector.
+    
+    // NB. Comparisons involving elementSize will be constant-folded by template
+    // specialization.
+
+    unsigned otherElementSize = sizeof(typename OtherAdaptor::Type);
+
+    // Handle cases (1) and (2A).
+    if (!hasArrayBuffer() || !other->hasArrayBuffer()
+        || existingBuffer() != other->existingBuffer()
+        || (elementSize == otherElementSize && vector() <= other->vector())
+        || type == CopyType::LeftToRight) {
+        for (unsigned i = 0; i < length; ++i) {
+            setIndexQuicklyToNativeValue(
+                offset + i, OtherAdaptor::template convertTo<Adaptor>(
+                    other->getIndexQuicklyAsNativeValue(i + otherOffset)));
+        }
+        return true;
+    }
+
+    // Now we either have (2B) or (3) - so first we try to cover (2B).
+    if (elementSize == otherElementSize) {
+        for (unsigned i = length; i--;) {
+            setIndexQuicklyToNativeValue(
+                offset + i, OtherAdaptor::template convertTo<Adaptor>(
+                    other->getIndexQuicklyAsNativeValue(i + otherOffset)));
+        }
+        return true;
+    }
+    
+    // Fail: we need an intermediate transfer buffer (i.e. case (3)).
+    Vector<typename Adaptor::Type, 32> transferBuffer(length);
+    for (unsigned i = length; i--;) {
+        transferBuffer[i] = OtherAdaptor::template convertTo<Adaptor>(
+            other->getIndexQuicklyAsNativeValue(i + otherOffset));
+    }
+    for (unsigned i = length; i--;)
+        setIndexQuicklyToNativeValue(offset + i, transferBuffer[i]);
+    
+    return true;
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::set(
+    ExecState* exec, unsigned offset, JSObject* object, unsigned objectOffset, unsigned length, CopyType type)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    const ClassInfo* ci = object->classInfo();
+    if (ci->typedArrayStorageType == Adaptor::typeValue) {
+        // The super fast case: we can just memcpy since we're the same type.
+        JSGenericTypedArrayView* other = jsCast<JSGenericTypedArrayView*>(object);
+        length = std::min(length, other->length());
+        
+        RELEASE_ASSERT(other->canAccessRangeQuickly(objectOffset, length));
+        bool success = validateRange(exec, offset, length);
+        ASSERT(!scope.exception() == success);
+        if (!success)
+            return false;
+
+        memmove(typedVector() + offset, other->typedVector() + objectOffset, length * elementSize);
+        return true;
+    }
+    
+    switch (ci->typedArrayStorageType) {
+    case TypeInt8:
+        scope.release();
+        return setWithSpecificType<Int8Adaptor>(
+            exec, offset, jsCast<JSInt8Array*>(object), objectOffset, length, type);
+    case TypeInt16:
+        scope.release();
+        return setWithSpecificType<Int16Adaptor>(
+            exec, offset, jsCast<JSInt16Array*>(object), objectOffset, length, type);
+    case TypeInt32:
+        scope.release();
+        return setWithSpecificType<Int32Adaptor>(
+            exec, offset, jsCast<JSInt32Array*>(object), objectOffset, length, type);
+    case TypeUint8:
+        scope.release();
+        return setWithSpecificType<Uint8Adaptor>(
+            exec, offset, jsCast<JSUint8Array*>(object), objectOffset, length, type);
+    case TypeUint8Clamped:
+        scope.release();
+        return setWithSpecificType<Uint8ClampedAdaptor>(
+            exec, offset, jsCast<JSUint8ClampedArray*>(object), objectOffset, length, type);
+    case TypeUint16:
+        scope.release();
+        return setWithSpecificType<Uint16Adaptor>(
+            exec, offset, jsCast<JSUint16Array*>(object), objectOffset, length, type);
+    case TypeUint32:
+        scope.release();
+        return setWithSpecificType<Uint32Adaptor>(
+            exec, offset, jsCast<JSUint32Array*>(object), objectOffset, length, type);
+    case TypeFloat32:
+        scope.release();
+        return setWithSpecificType<Float32Adaptor>(
+            exec, offset, jsCast<JSFloat32Array*>(object), objectOffset, length, type);
+    case TypeFloat64:
+        scope.release();
+        return setWithSpecificType<Float64Adaptor>(
+            exec, offset, jsCast<JSFloat64Array*>(object), objectOffset, length, type);
+    case NotTypedArray:
+    case TypeDataView: {
+        bool success = validateRange(exec, offset, length);
+        ASSERT(!scope.exception() == success);
+        if (!success)
+            return false;
+
+        // We could optimize this case. But right now, we don't.
+        for (unsigned i = 0; i < length; ++i) {
+            JSValue value = object->get(exec, i + objectOffset);
+            RETURN_IF_EXCEPTION(scope, false);
+            bool success = setIndex(exec, offset + i, value);
+            ASSERT(!scope.exception() || !success);
+            if (!success)
+                return false;
+        }
+        return true;
+    } }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+template<typename Adaptor>
+PassRefPtr<typename Adaptor::ViewType> JSGenericTypedArrayView<Adaptor>::possiblySharedTypedImpl()
+{
+    return Adaptor::ViewType::create(possiblySharedBuffer(), byteOffset(), length());
+}
+
+template<typename Adaptor>
+PassRefPtr<typename Adaptor::ViewType> JSGenericTypedArrayView<Adaptor>::unsharedTypedImpl()
+{
+    return Adaptor::ViewType::create(unsharedBuffer(), byteOffset(), length());
+}
+
+template<typename Adaptor>
+ArrayBuffer* JSGenericTypedArrayView<Adaptor>::existingBuffer()
+{
+    return existingBufferInButterfly();
+}
+
+template<typename Adaptor>
+EncodedJSValue JSGenericTypedArrayView<Adaptor>::throwNeuteredTypedArrayTypeError(ExecState* exec, EncodedJSValue object, PropertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ASSERT_UNUSED(object, jsCast<JSGenericTypedArrayView*>(JSValue::decode(object))->isNeutered());
+    return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot(
+    JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(object);
+
+    if (std::optional<uint32_t> index = parseIndex(propertyName)) {
+        if (thisObject->isNeutered()) {
+            slot.setCustom(thisObject, None, throwNeuteredTypedArrayTypeError);
+            return true;
+        }
+
+        if (thisObject->canGetIndexQuickly(index.value()))
+            slot.setValue(thisObject, DontDelete | ReadOnly, thisObject->getIndexQuickly(index.value()));
+        else
+            slot.setValue(thisObject, DontDelete | ReadOnly, jsUndefined());
+        return true;
+    }
+    
+    return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::put(
+    JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value,
+    PutPropertySlot& slot)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
+
+    // https://tc39.github.io/ecma262/#sec-integer-indexed-exotic-objects-set-p-v-receiver
+    // Ignore the receiver even if the receiver is altered to non base value.
+    // 9.4.5.5-2-b-i Return ? IntegerIndexedElementSet(O, numericIndex, V).
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode());
+    
+    return Base::put(thisObject, exec, propertyName, value, slot);
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::defineOwnProperty(
+    JSObject* object, ExecState* exec, PropertyName propertyName,
+    const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(object);
+
+    if (parseIndex(propertyName)) {
+        if (descriptor.isAccessorDescriptor())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral("Attempting to store accessor indexed property on a typed array."));
+
+        if (descriptor.configurable())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral("Attempting to configure non-configurable property."));
+
+        if (!descriptor.enumerable() || !descriptor.writable())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral("Attempting to store non-enumerable or non-writable indexed property on a typed array."));
+
+        if (descriptor.value()) {
+            PutPropertySlot unused(JSValue(thisObject), shouldThrow);
+            scope.release();
+            return thisObject->put(thisObject, exec, propertyName, descriptor.value(), unused);
+        }
+        return true;
+    }
+    
+    scope.release();
+    return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::deleteProperty(
+    JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
+
+    if (thisObject->isNeutered())
+        return typeError(exec, scope, true, ASCIILiteral(typedArrayBufferHasBeenDetachedErrorMessage));
+
+    if (parseIndex(propertyName))
+        return false;
+    
+    return Base::deleteProperty(thisObject, exec, propertyName);
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex(
+    JSObject* object, ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(object);
+
+    if (thisObject->isNeutered()) {
+        slot.setCustom(thisObject, None, throwNeuteredTypedArrayTypeError);
+        return true;
+    }
+
+    if (propertyName > MAX_ARRAY_INDEX) {
+        return thisObject->methodTable()->getOwnPropertySlot(
+            thisObject, exec, Identifier::from(exec, propertyName), slot);
+    }
+    
+    if (!thisObject->canGetIndexQuickly(propertyName))
+        return false;
+    
+    slot.setValue(thisObject, None, thisObject->getIndexQuickly(propertyName));
+    return true;
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::putByIndex(
+    JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
+
+    if (propertyName > MAX_ARRAY_INDEX) {
+        PutPropertySlot slot(JSValue(thisObject), shouldThrow);
+        return thisObject->methodTable()->put(thisObject, exec, Identifier::from(exec, propertyName), value, slot);
+    }
+    
+    return thisObject->setIndex(exec, propertyName, value);
+}
+
+template<typename Adaptor>
+bool JSGenericTypedArrayView<Adaptor>::deletePropertyByIndex(
+    JSCell* cell, ExecState* exec, unsigned propertyName)
+{
+    return cell->methodTable()->deleteProperty(cell, exec, Identifier::from(exec, propertyName));
+}
+
+template<typename Adaptor>
+void JSGenericTypedArrayView<Adaptor>::getOwnPropertyNames(
+    JSObject* object, ExecState* exec, PropertyNameArray& array, EnumerationMode mode)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(object);
+
+    if (array.includeStringProperties()) {
+        for (unsigned i = 0; i < thisObject->m_length; ++i)
+            array.add(Identifier::from(exec, i));
+    }
+    
+    return Base::getOwnPropertyNames(object, exec, array, mode);
+}
+
+template<typename Adaptor>
+size_t JSGenericTypedArrayView<Adaptor>::estimatedSize(JSCell* cell)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
+
+    if (thisObject->m_mode == OversizeTypedArray)
+        return Base::estimatedSize(thisObject) + thisObject->byteSize();
+    if (thisObject->m_mode == FastTypedArray && thisObject->m_vector)
+        return Base::estimatedSize(thisObject) + thisObject->byteSize();
+
+    return Base::estimatedSize(thisObject);
+}
+
+template<typename Adaptor>
+void JSGenericTypedArrayView<Adaptor>::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
+    
+    switch (thisObject->m_mode) {
+    case FastTypedArray: {
+        if (void* vector = thisObject->m_vector.get())
+            visitor.markAuxiliary(vector);
+        break;
+    }
+        
+    case OversizeTypedArray: {
+        visitor.reportExtraMemoryVisited(thisObject->byteSize());
+        break;
+    }
+        
+    case WastefulTypedArray:
+        break;
+        
+    case DataViewMode:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    
+    Base::visitChildren(thisObject, visitor);
+}
+
+template<typename Adaptor>
+ArrayBuffer* JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory(JSArrayBufferView* object)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(object);
+    
+    // We play this game because we want this to be callable even from places that
+    // don't have access to ExecState* or the VM, and we only allocate so little
+    // memory here that it's not necessary to trigger a GC - just accounting what
+    // we have done is good enough. The sort of bizarro exception to the "allocating
+    // little memory" is when we transfer a backing buffer into the C heap; this
+    // will temporarily get counted towards heap footprint (incorrectly, in the case
+    // of adopting an oversize typed array) but we don't GC here anyway. That's
+    // almost certainly fine. The worst case is if you created a ton of fast typed
+    // arrays, and did nothing but caused all of them to slow down and waste memory.
+    // In that case, your memory footprint will double before the GC realizes what's
+    // up. But if you do *anything* to trigger a GC watermark check, it will know
+    // that you *had* done those allocations and it will GC appropriately.
+    Heap* heap = Heap::heap(thisObject);
+    VM& vm = *heap->vm();
+    DeferGCForAWhile deferGC(*heap);
+    
+    ASSERT(!thisObject->hasIndexingHeader());
+    
+    RELEASE_ASSERT(!thisObject->hasIndexingHeader());
+    thisObject->m_butterfly.set(vm, thisObject, Butterfly::createOrGrowArrayRight(
+        thisObject->butterfly(), vm, thisObject, thisObject->structure(),
+        thisObject->structure()->outOfLineCapacity(), false, 0, 0));
+
+    RefPtr<ArrayBuffer> buffer;
+    
+    switch (thisObject->m_mode) {
+    case FastTypedArray:
+        buffer = ArrayBuffer::create(thisObject->vector(), thisObject->byteLength());
+        break;
+        
+    case OversizeTypedArray:
+        // FIXME: consider doing something like "subtracting" from extra memory
+        // cost, since right now this case will cause the GC to think that we reallocated
+        // the whole buffer.
+        buffer = ArrayBuffer::createAdopted(thisObject->vector(), thisObject->byteLength());
+        break;
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+
+    thisObject->butterfly()->indexingHeader()->setArrayBuffer(buffer.get());
+    thisObject->m_vector.setWithoutBarrier(buffer->data());
+    WTF::storeStoreFence();
+    thisObject->m_mode = WastefulTypedArray;
+    heap->addReference(thisObject, buffer.get());
+    
+    return buffer.get();
+}
+
+template<typename Adaptor>
+PassRefPtr<ArrayBufferView>
+JSGenericTypedArrayView<Adaptor>::getTypedArrayImpl(JSArrayBufferView* object)
+{
+    JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(object);
+    return thisObject->possiblySharedTypedImpl();
+}
+
+} // namespace JSC
diff --git a/runtime/JSGenericTypedArrayViewPrototype.h b/runtime/JSGenericTypedArrayViewPrototype.h
new file mode 100644
index 0000000..02ccf4d
--- /dev/null
+++ b/runtime/JSGenericTypedArrayViewPrototype.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+template<typename ViewClass>
+class JSGenericTypedArrayViewPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+protected:
+    JSGenericTypedArrayViewPrototype(VM&, Structure*);
+    void finishCreation(VM&, JSGlobalObject*);
+
+public:
+    static JSGenericTypedArrayViewPrototype* create(
+        VM&, JSGlobalObject*, Structure*);
+
+    // FIXME: We should fix the warnings for extern-template in JSObject template classes: https://bugs.webkit.org/show_bug.cgi?id=161979
+#if COMPILER(CLANG)
+#if __has_warning("-Wundefined-var-template")
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wundefined-var-template"
+#endif
+#endif
+    DECLARE_INFO;
+#if COMPILER(CLANG)
+#if __has_warning("-Wundefined-var-template")
+#pragma clang diagnostic pop
+#endif
+#endif
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+};
+
+} // namespace JSC
diff --git a/runtime/JSGenericTypedArrayViewPrototypeFunctions.h b/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
new file mode 100644
index 0000000..f5fad6b
--- /dev/null
+++ b/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
@@ -0,0 +1,579 @@
+/*
+ * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ArrayPrototype.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSArrayBufferViewInlines.h"
+#include "JSCBuiltins.h"
+#include "JSCJSValueInlines.h"
+#include "JSFunction.h"
+#include "JSGenericTypedArrayViewInlines.h"
+#include "JSGenericTypedArrayViewPrototypeInlines.h"
+#include "JSStringJoiner.h"
+#include "StructureInlines.h"
+#include "TypedArrayAdaptors.h"
+#include "TypedArrayController.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+// This implements 22.2.4.7 TypedArraySpeciesCreate
+// Note, that this function throws.
+template<typename Functor>
+inline JSArrayBufferView* speciesConstruct(ExecState* exec, JSObject* exemplar, MarkedArgumentBuffer& args, const Functor& defaultConstructor)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue constructor = exemplar->get(exec, vm.propertyNames->constructor);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    if (constructor.isUndefined()) {
+        scope.release();
+        return defaultConstructor();
+    }
+    if (!constructor.isObject()) {
+        throwTypeError(exec, scope, ASCIILiteral("constructor Property should not be null"));
+        return nullptr;
+    }
+
+    JSValue species = constructor.get(exec, vm.propertyNames->speciesSymbol);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    if (species.isUndefinedOrNull()) {
+        scope.release();
+        return defaultConstructor();
+    }
+
+    JSValue result = construct(exec, species, args, "species is not a constructor");
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(result)) {
+        if (!view->isNeutered())
+            return view;
+
+        throwTypeError(exec, scope, ASCIILiteral(typedArrayBufferHasBeenDetachedErrorMessage));
+        return nullptr;
+    }
+
+    throwTypeError(exec, scope, ASCIILiteral("species constructor did not return a TypedArray View"));
+    return nullptr;
+}
+
+inline unsigned argumentClampedIndexFromStartOrEnd(ExecState* exec, int argument, unsigned length, unsigned undefinedValue = 0)
+{
+    JSValue value = exec->argument(argument);
+    if (value.isUndefined())
+        return undefinedValue;
+
+    double indexDouble = value.toInteger(exec);
+    if (indexDouble < 0) {
+        indexDouble += length;
+        return indexDouble < 0 ? 0 : static_cast<unsigned>(indexDouble);
+    }
+    return indexDouble > length ? length : static_cast<unsigned>(indexDouble);
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSet(VM& vm, ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 22.2.3.22
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+
+    if (UNLIKELY(!exec->argumentCount()))
+        return throwVMTypeError(exec, scope, ASCIILiteral("Expected at least one argument"));
+
+    unsigned offset;
+    if (exec->argumentCount() >= 2) {
+        double offsetNumber = exec->uncheckedArgument(1).toInteger(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (UNLIKELY(offsetNumber < 0))
+            return throwVMRangeError(exec, scope, "Offset should not be negative");
+        offset = static_cast<unsigned>(std::min(offsetNumber, static_cast<double>(std::numeric_limits<unsigned>::max())));
+    } else
+        offset = 0;
+
+    if (UNLIKELY(thisObject->isNeutered()))
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    JSObject* sourceArray = jsDynamicCast<JSObject*>(exec->uncheckedArgument(0));
+    if (UNLIKELY(!sourceArray))
+        return throwVMTypeError(exec, scope, ASCIILiteral("First argument should be an object"));
+
+    unsigned length;
+    if (isTypedView(sourceArray->classInfo()->typedArrayStorageType)) {
+        JSArrayBufferView* sourceView = jsCast<JSArrayBufferView*>(sourceArray);
+        if (UNLIKELY(sourceView->isNeutered()))
+            return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+        length = jsCast<JSArrayBufferView*>(sourceArray)->length();
+    } else {
+        JSValue lengthValue = sourceArray->get(exec, vm.propertyNames->length);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        length = lengthValue.toUInt32(exec);
+    }
+
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    scope.release();
+    thisObject->set(exec, offset, sourceArray, 0, length, CopyType::Unobservable);
+    return JSValue::encode(jsUndefined());
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncCopyWithin(VM& vm, ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 22.2.3.5
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    long length = thisObject->length();
+    long to = argumentClampedIndexFromStartOrEnd(exec, 0, length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    long from = argumentClampedIndexFromStartOrEnd(exec, 1, length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    long final = argumentClampedIndexFromStartOrEnd(exec, 2, length, length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (final < from)
+        return JSValue::encode(exec->thisValue());
+
+    long count = std::min(length - std::max(to, from), final - from);
+
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    typename ViewClass::ElementType* array = thisObject->typedVector();
+    memmove(array + to, array + from, count * thisObject->elementSize);
+
+    return JSValue::encode(exec->thisValue());
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIncludes(VM& vm, ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    unsigned length = thisObject->length();
+
+    if (!length)
+        return JSValue::encode(jsBoolean(false));
+
+    JSValue valueToFind = exec->argument(0);
+
+    unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    typename ViewClass::ElementType* array = thisObject->typedVector();
+    auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
+    if (!targetOption)
+        return JSValue::encode(jsBoolean(false));
+
+    ASSERT(!scope.exception());
+    RELEASE_ASSERT(!thisObject->isNeutered());
+
+    if (std::isnan(static_cast<double>(*targetOption))) {
+        for (; index < length; ++index) {
+            if (std::isnan(static_cast<double>(array[index])))
+                return JSValue::encode(jsBoolean(true));
+        }
+    } else {
+        for (; index < length; ++index) {
+            if (array[index] == targetOption)
+                return JSValue::encode(jsBoolean(true));
+        }
+    }
+
+    return JSValue::encode(jsBoolean(false));
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIndexOf(VM& vm, ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 22.2.3.13
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    if (!exec->argumentCount())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Expected at least one argument"));
+
+    unsigned length = thisObject->length();
+
+    JSValue valueToFind = exec->argument(0);
+    unsigned index = argumentClampedIndexFromStartOrEnd(exec, 1, length);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    typename ViewClass::ElementType* array = thisObject->typedVector();
+    auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
+    if (!targetOption)
+        return JSValue::encode(jsNumber(-1));
+    ASSERT(!scope.exception());
+    RELEASE_ASSERT(!thisObject->isNeutered());
+
+    for (; index < length; ++index) {
+        if (array[index] == targetOption)
+            return JSValue::encode(jsNumber(index));
+    }
+
+    return JSValue::encode(jsNumber(-1));
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncJoin(VM& vm, ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    // 22.2.3.14
+    auto joinWithSeparator = [&] (StringView separator) -> EncodedJSValue {
+        ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+        unsigned length = thisObject->length();
+
+        JSStringJoiner joiner(*exec, separator, length);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        for (unsigned i = 0; i < length; i++) {
+            joiner.append(*exec, thisObject->getIndexQuickly(i));
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        }
+        scope.release();
+        return JSValue::encode(joiner.join(*exec));
+    };
+
+    JSValue separatorValue = exec->argument(0);
+    if (separatorValue.isUndefined()) {
+        const LChar* comma = reinterpret_cast<const LChar*>(",");
+        return joinWithSeparator({ comma, 1 });
+    }
+
+    JSString* separatorString = separatorValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+    auto viewWithString = separatorString->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return joinWithSeparator(viewWithString.view);
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncLastIndexOf(VM& vm, ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 22.2.3.16
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    if (!exec->argumentCount())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Expected at least one argument"));
+
+    unsigned length = thisObject->length();
+
+    JSValue valueToFind = exec->argument(0);
+
+    int index = length - 1;
+    if (exec->argumentCount() >= 2) {
+        JSValue fromValue = exec->uncheckedArgument(1);
+        double fromDouble = fromValue.toInteger(exec);
+        if (fromDouble < 0) {
+            fromDouble += length;
+            if (fromDouble < 0)
+                return JSValue::encode(jsNumber(-1));
+        }
+        if (fromDouble < length)
+            index = static_cast<unsigned>(fromDouble);
+    }
+
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
+    if (!targetOption)
+        return JSValue::encode(jsNumber(-1));
+
+    typename ViewClass::ElementType* array = thisObject->typedVector();
+    ASSERT(!scope.exception());
+    RELEASE_ASSERT(!thisObject->isNeutered());
+
+    for (; index >= 0; --index) {
+        if (array[index] == targetOption)
+            return JSValue::encode(jsNumber(index));
+    }
+
+    return JSValue::encode(jsNumber(-1));
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncBuffer(VM&, ExecState* exec)
+{
+    // 22.2.3.3
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+
+    return JSValue::encode(thisObject->possiblySharedJSBuffer(exec));
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncLength(VM&, ExecState* exec)
+{
+    // 22.2.3.17
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+
+    return JSValue::encode(jsNumber(thisObject->length()));
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteLength(VM&, ExecState* exec)
+{
+    // 22.2.3.2
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+
+    return JSValue::encode(jsNumber(thisObject->byteLength()));
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteOffset(VM&, ExecState* exec)
+{
+    // 22.2.3.3
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+
+    return JSValue::encode(jsNumber(thisObject->byteOffset()));
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncReverse(VM& vm, ExecState* exec)
+{
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 22.2.3.21
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    typename ViewClass::ElementType* array = thisObject->typedVector();
+    std::reverse(array, array + thisObject->length());
+
+    return JSValue::encode(thisObject);
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSort(VM& vm, ExecState* exec)
+{
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 22.2.3.25
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->argument(0));
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    thisObject->sort();
+
+    return JSValue::encode(thisObject);
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSlice(VM& vm, ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 22.2.3.26
+    JSFunction* callee = jsCast<JSFunction*>(exec->jsCallee());
+
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    unsigned thisLength = thisObject->length();
+
+    unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, thisLength);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, thisLength, thisLength);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    // Clamp end to begin.
+    end = std::max(begin, end);
+
+    ASSERT(end >= begin);
+    unsigned length = end - begin;
+
+    MarkedArgumentBuffer args;
+    args.append(jsNumber(length));
+
+    JSArrayBufferView* result = speciesConstruct(exec, thisObject, args, [&]() {
+        Structure* structure = callee->globalObject()->typedArrayStructure(ViewClass::TypedArrayStorageType);
+        return ViewClass::createUninitialized(exec, structure, length);
+    });
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    ASSERT(!result->isNeutered());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    // We return early here since we don't allocate a backing store if length is 0 and memmove does not like nullptrs
+    if (!length)
+        return JSValue::encode(result);
+
+    // The species constructor may return an array with any arbitrary length.
+    length = std::min(length, result->length());
+    switch (result->classInfo()->typedArrayStorageType) {
+    case TypeInt8:
+        scope.release();
+        jsCast<JSInt8Array*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    case TypeInt16:
+        scope.release();
+        jsCast<JSInt16Array*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    case TypeInt32:
+        scope.release();
+        jsCast<JSInt32Array*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    case TypeUint8:
+        scope.release();
+        jsCast<JSUint8Array*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    case TypeUint8Clamped:
+        scope.release();
+        jsCast<JSUint8ClampedArray*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    case TypeUint16:
+        scope.release();
+        jsCast<JSUint16Array*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    case TypeUint32:
+        scope.release();
+        jsCast<JSUint32Array*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    case TypeFloat32:
+        scope.release();
+        jsCast<JSFloat32Array*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    case TypeFloat64:
+        scope.release();
+        jsCast<JSFloat64Array*>(result)->set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);
+        return JSValue::encode(result);
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+}
+
+template<typename ViewClass>
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSubarrayCreate(VM&vm, ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 22.2.3.23
+    JSFunction* callee = jsCast<JSFunction*>(exec->jsCallee());
+
+    ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
+
+    // Get the length here; later assert that the length didn't change.
+    unsigned thisLength = thisObject->length();
+
+    // I would assert that the arguments are integers here but that's not true since
+    // https://tc39.github.io/ecma262/#sec-tointeger allows the result of the operation
+    // to be +/- Infinity and -0.
+    ASSERT(exec->argument(0).isNumber());
+    ASSERT(exec->argument(1).isUndefined() || exec->argument(1).isNumber());
+    unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, thisLength);
+    ASSERT(!scope.exception());
+    unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, thisLength, thisLength);
+    ASSERT(!scope.exception());
+
+    RELEASE_ASSERT(!thisObject->isNeutered());
+
+    // Clamp end to begin.
+    end = std::max(begin, end);
+
+    ASSERT(end >= begin);
+    unsigned offset = begin;
+    unsigned length = end - begin;
+
+    RefPtr<ArrayBuffer> arrayBuffer = thisObject->possiblySharedBuffer();
+    RELEASE_ASSERT(thisLength == thisObject->length());
+
+    unsigned newByteOffset = thisObject->byteOffset() + offset * ViewClass::elementSize;
+
+    JSObject* defaultConstructor = callee->globalObject()->typedArrayConstructor(ViewClass::TypedArrayStorageType);
+    JSValue species = exec->uncheckedArgument(2);
+    if (species == defaultConstructor) {
+        Structure* structure = callee->globalObject()->typedArrayStructure(ViewClass::TypedArrayStorageType);
+
+        scope.release();
+        return JSValue::encode(ViewClass::create(
+            exec, structure, arrayBuffer,
+            thisObject->byteOffset() + offset * ViewClass::elementSize,
+            length));
+    }
+
+    MarkedArgumentBuffer args;
+    args.append(vm.m_typedArrayController->toJS(exec, thisObject->globalObject(), arrayBuffer.get()));
+    args.append(jsNumber(newByteOffset));
+    args.append(jsNumber(length));
+
+    JSObject* result = construct(exec, species, args, "species is not a constructor");
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (jsDynamicCast<JSArrayBufferView*>(result))
+        return JSValue::encode(result);
+
+    throwTypeError(exec, scope, ASCIILiteral("species constructor did not return a TypedArray View"));
+    return JSValue::encode(JSValue());
+}
+
+} // namespace JSC
diff --git a/runtime/JSGenericTypedArrayViewPrototypeInlines.h b/runtime/JSGenericTypedArrayViewPrototypeInlines.h
new file mode 100644
index 0000000..03bfce2
--- /dev/null
+++ b/runtime/JSGenericTypedArrayViewPrototypeInlines.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSGenericTypedArrayViewPrototype.h"
+
+namespace JSC {
+    
+template<typename ViewClass>
+JSGenericTypedArrayViewPrototype<ViewClass>::JSGenericTypedArrayViewPrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+template<typename ViewClass>
+void JSGenericTypedArrayViewPrototype<ViewClass>::finishCreation(
+    VM& vm, JSGlobalObject*)
+{
+    Base::finishCreation(vm);
+    
+    ASSERT(inherits(info()));
+
+    putDirect(vm, vm.propertyNames->BYTES_PER_ELEMENT, jsNumber(ViewClass::elementSize), DontEnum | ReadOnly | DontDelete);
+
+}
+
+template<typename ViewClass>
+JSGenericTypedArrayViewPrototype<ViewClass>*
+JSGenericTypedArrayViewPrototype<ViewClass>::create(
+    VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    JSGenericTypedArrayViewPrototype* prototype =
+        new (NotNull, allocateCell<JSGenericTypedArrayViewPrototype>(vm.heap))
+        JSGenericTypedArrayViewPrototype(vm, structure);
+    prototype->finishCreation(vm, globalObject);
+    return prototype;
+}
+
+template<typename ViewClass>
+Structure* JSGenericTypedArrayViewPrototype<ViewClass>::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(
+        vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+} // namespace JSC
diff --git a/runtime/JSGlobalLexicalEnvironment.cpp b/runtime/JSGlobalLexicalEnvironment.cpp
new file mode 100644
index 0000000..d6e1f52
--- /dev/null
+++ b/runtime/JSGlobalLexicalEnvironment.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSGlobalLexicalEnvironment.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSGlobalLexicalEnvironment::s_info = { "JSGlobalLexicalEnvironment", &Base::s_info, 0, CREATE_METHOD_TABLE(JSGlobalLexicalEnvironment) };
+
+void JSGlobalLexicalEnvironment::destroy(JSCell* cell)
+{
+    static_cast<JSGlobalLexicalEnvironment*>(cell)->JSGlobalLexicalEnvironment::~JSGlobalLexicalEnvironment();
+}
+
+bool JSGlobalLexicalEnvironment::getOwnPropertySlot(JSObject* object, ExecState*, PropertyName propertyName, PropertySlot& slot)
+{
+    JSGlobalLexicalEnvironment* thisObject = jsCast<JSGlobalLexicalEnvironment*>(object);
+    return symbolTableGet(thisObject, propertyName, slot);
+}
+
+bool JSGlobalLexicalEnvironment::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    JSGlobalLexicalEnvironment* thisObject = jsCast<JSGlobalLexicalEnvironment*>(cell);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
+    bool alwaysThrowWhenAssigningToConstProperty = true;
+    bool ignoreConstAssignmentError = slot.isInitialization();
+    bool putResult = false;
+    symbolTablePutTouchWatchpointSet(thisObject, exec, propertyName, value, alwaysThrowWhenAssigningToConstProperty, ignoreConstAssignmentError, putResult);
+    return putResult;
+}
+
+bool JSGlobalLexicalEnvironment::isConstVariable(UniquedStringImpl* impl)
+{
+    SymbolTableEntry entry = symbolTable()->get(impl);
+    ASSERT(!entry.isNull());
+    return entry.isReadOnly();
+}
+
+JSValue JSGlobalLexicalEnvironment::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
+{
+    if (ecmaMode == StrictMode)
+        return jsUndefined();
+    return exec->globalThisValue();
+}
+
+} // namespace JSC
diff --git a/runtime/JSGlobalLexicalEnvironment.h b/runtime/JSGlobalLexicalEnvironment.h
new file mode 100644
index 0000000..3832987
--- /dev/null
+++ b/runtime/JSGlobalLexicalEnvironment.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSSegmentedVariableObject.h"
+
+namespace JSC {
+
+class JSGlobalLexicalEnvironment : public JSSegmentedVariableObject {
+
+public:
+    typedef JSSegmentedVariableObject Base;
+
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesToThis;
+
+    static JSGlobalLexicalEnvironment* create(VM& vm, Structure* structure, JSScope* parentScope)
+    {
+        JSGlobalLexicalEnvironment* result =
+            new (NotNull, allocateCell<JSGlobalLexicalEnvironment>(vm.heap)) JSGlobalLexicalEnvironment(vm, structure, parentScope);
+        result->finishCreation(vm);
+        result->symbolTable()->setScopeType(SymbolTable::ScopeType::GlobalLexicalScope);
+        vm.heap.addFinalizer(result, destroy);
+        return result;
+    }
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    static void destroy(JSCell*);
+    // We don't need a destructor because we use a finalizer instead.
+    static const bool needsDestruction = false;
+
+    bool isEmpty() const { return !symbolTable()->size(); }
+    bool isConstVariable(UniquedStringImpl*);
+
+    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
+    
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject)
+    {
+        return Structure::create(vm, globalObject, jsNull(), TypeInfo(GlobalLexicalEnvironmentType, StructureFlags), info());
+    }
+
+protected:
+    JSGlobalLexicalEnvironment(VM& vm, Structure* structure, JSScope* scope)
+        : Base(vm, structure, scope)
+    {
+    }
+};
+
+} // namespace JSC
diff --git a/runtime/JSGlobalObject.cpp b/runtime/JSGlobalObject.cpp
new file mode 100644
index 0000000..3788dd2
--- /dev/null
+++ b/runtime/JSGlobalObject.cpp
@@ -0,0 +1,1449 @@
+/*
+ * Copyright (C) 2007-2009, 2014-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGlobalObject.h"
+
+#include "ArrayConstructor.h"
+#include "ArrayIteratorAdaptiveWatchpoint.h"
+#include "ArrayIteratorPrototype.h"
+#include "ArrayPrototype.h"
+#include "AtomicsObject.h"
+#include "AsyncFunctionConstructor.h"
+#include "AsyncFunctionPrototype.h"
+#include "BooleanConstructor.h"
+#include "BooleanPrototype.h"
+#include "BuiltinNames.h"
+#include "ClonedArguments.h"
+#include "CodeBlock.h"
+#include "CodeCache.h"
+#include "ConsoleObject.h"
+#include "DateConstructor.h"
+#include "DatePrototype.h"
+#include "Debugger.h"
+#include "DebuggerScope.h"
+#include "DirectArguments.h"
+#include "DirectEvalExecutable.h"
+#include "ECMAScriptSpecInternalFunctions.h"
+#include "Error.h"
+#include "ErrorConstructor.h"
+#include "ErrorPrototype.h"
+#include "FunctionConstructor.h"
+#include "FunctionPrototype.h"
+#include "GeneratorFunctionConstructor.h"
+#include "GeneratorFunctionPrototype.h"
+#include "GeneratorPrototype.h"
+#include "GetterSetter.h"
+#include "HeapIterationScope.h"
+#include "IndirectEvalExecutable.h"
+#include "InspectorInstrumentationObject.h"
+#include "Interpreter.h"
+#include "IteratorPrototype.h"
+#include "JSAPIWrapperObject.h"
+#include "JSArrayBuffer.h"
+#include "JSArrayBufferConstructor.h"
+#include "JSArrayBufferPrototype.h"
+#include "JSAsyncFunction.h"
+#include "JSBoundFunction.h"
+#include "JSCInlines.h"
+#include "JSCallbackConstructor.h"
+#include "JSCallbackFunction.h"
+#include "JSCallbackObject.h"
+#include "JSCustomGetterSetterFunction.h"
+#include "JSDataView.h"
+#include "JSDataViewPrototype.h"
+#include "JSDollarVM.h"
+#include "JSDollarVMPrototype.h"
+#include "JSFixedArray.h"
+#include "JSFunction.h"
+#include "JSGeneratorFunction.h"
+#include "JSGenericTypedArrayViewConstructorInlines.h"
+#include "JSGenericTypedArrayViewInlines.h"
+#include "JSGenericTypedArrayViewPrototypeInlines.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSInternalPromise.h"
+#include "JSInternalPromiseConstructor.h"
+#include "JSInternalPromisePrototype.h"
+#include "JSJob.h"
+#include "JSLexicalEnvironment.h"
+#include "JSLock.h"
+#include "JSMap.h"
+#include "JSMapIterator.h"
+#include "JSModuleEnvironment.h"
+#include "JSModuleLoader.h"
+#include "JSModuleNamespaceObject.h"
+#include "JSModuleRecord.h"
+#include "JSNativeStdFunction.h"
+#include "JSONObject.h"
+#include "JSPromise.h"
+#include "JSPromiseConstructor.h"
+#include "JSPromisePrototype.h"
+#include "JSPropertyNameIterator.h"
+#include "JSSet.h"
+#include "JSSetIterator.h"
+#include "JSStringIterator.h"
+#include "JSTemplateRegistryKey.h"
+#include "JSTypedArrayConstructors.h"
+#include "JSTypedArrayPrototypes.h"
+#include "JSTypedArrayViewConstructor.h"
+#include "JSTypedArrayViewPrototype.h"
+#include "JSTypedArrays.h"
+#include "JSWeakMap.h"
+#include "JSWeakSet.h"
+#include "JSWebAssembly.h"
+#include "JSWebAssemblyCallee.h"
+#include "JSWithScope.h"
+#include "LazyClassStructureInlines.h"
+#include "LazyPropertyInlines.h"
+#include "Lookup.h"
+#include "MapConstructor.h"
+#include "MapIteratorPrototype.h"
+#include "MapPrototype.h"
+#include "MarkedSpaceInlines.h"
+#include "MathObject.h"
+#include "Microtask.h"
+#include "ModuleLoaderPrototype.h"
+#include "NativeErrorConstructor.h"
+#include "NativeErrorPrototype.h"
+#include "NullGetterFunction.h"
+#include "NullSetterFunction.h"
+#include "NumberConstructor.h"
+#include "NumberPrototype.h"
+#include "ObjCCallbackFunction.h"
+#include "ObjectConstructor.h"
+#include "ObjectPropertyConditionSet.h"
+#include "ObjectPrototype.h"
+#include "ParserError.h"
+#include "ProxyConstructor.h"
+#include "ProxyObject.h"
+#include "ProxyRevoke.h"
+#include "ReflectObject.h"
+#include "RegExpConstructor.h"
+#include "RegExpMatchesArray.h"
+#include "RegExpObject.h"
+#include "RegExpPrototype.h"
+#include "ScopedArguments.h"
+#include "SetConstructor.h"
+#include "SetIteratorPrototype.h"
+#include "SetPrototype.h"
+#include "StrictEvalActivation.h"
+#include "StringConstructor.h"
+#include "StringIteratorPrototype.h"
+#include "StringPrototype.h"
+#include "Symbol.h"
+#include "SymbolConstructor.h"
+#include "SymbolPrototype.h"
+#include "VariableWriteFireDetail.h"
+#include "WeakGCMapInlines.h"
+#include "WeakMapConstructor.h"
+#include "WeakMapPrototype.h"
+#include "WeakSetConstructor.h"
+#include "WeakSetPrototype.h"
+#include <wtf/RandomNumber.h>
+
+#if ENABLE(INTL)
+#include "IntlObject.h"
+#include <unicode/ucol.h>
+#include <unicode/udat.h>
+#include <unicode/unum.h>
+#endif // ENABLE(INTL)
+
+#if ENABLE(REMOTE_INSPECTOR)
+#include "JSGlobalObjectDebuggable.h"
+#include "JSGlobalObjectInspectorController.h"
+#endif
+
+#if ENABLE(WEB_REPLAY)
+#include "EmptyInputCursor.h"
+#include "JSReplayInputs.h"
+#endif
+
+namespace JSC {
+
+static JSValue createProxyProperty(VM& vm, JSObject* object)
+{
+    JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
+    return ProxyConstructor::create(vm, ProxyConstructor::createStructure(vm, global, global->functionPrototype()));
+}
+
+static JSValue createJSONProperty(VM& vm, JSObject* object)
+{
+    JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
+    return JSONObject::create(vm, JSONObject::createStructure(vm, global, global->objectPrototype()));
+}
+
+static JSValue createMathProperty(VM& vm, JSObject* object)
+{
+    JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
+    return MathObject::create(vm, global, MathObject::createStructure(vm, global, global->objectPrototype()));
+}
+
+static JSValue createConsoleProperty(VM& vm, JSObject* object)
+{
+    JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
+    return ConsoleObject::create(vm, global, ConsoleObject::createStructure(vm, global, constructEmptyObject(global->globalExec())));
+}
+
+static JSValue createAtomicsProperty(VM& vm, JSObject* object)
+{
+    JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
+    return AtomicsObject::create(vm, global, AtomicsObject::createStructure(vm, global, global->objectPrototype()));
+}
+
+static EncodedJSValue JSC_HOST_CALL makeBoundFunction(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+
+    JSObject* target = asObject(exec->uncheckedArgument(0));
+    JSValue boundThis = exec->uncheckedArgument(1);
+    JSValue boundArgs = exec->uncheckedArgument(2);
+    JSValue length = exec->uncheckedArgument(3);
+    JSString* name = asString(exec->uncheckedArgument(4));
+
+    return JSValue::encode(JSBoundFunction::create(
+        vm, exec, globalObject, target, boundThis, boundArgs.isCell() ? jsCast<JSArray*>(boundArgs) : nullptr, length.asInt32(), name->value(exec)));
+}
+
+static EncodedJSValue JSC_HOST_CALL hasOwnLengthProperty(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSObject* target = asObject(exec->uncheckedArgument(0));
+    return JSValue::encode(jsBoolean(target->hasOwnProperty(exec, vm.propertyNames->length)));
+}
+
+} // namespace JSC
+
+#include "JSGlobalObject.lut.h"
+
+namespace JSC {
+
+const ClassInfo JSGlobalObject::s_info = { "GlobalObject", &Base::s_info, &globalObjectTable, CREATE_METHOD_TABLE(JSGlobalObject) };
+
+const GlobalObjectMethodTable JSGlobalObject::s_globalObjectMethodTable = {
+    &supportsRichSourceInfo,
+    &shouldInterruptScript,
+    &javaScriptRuntimeFlags,
+    nullptr,
+    &shouldInterruptScriptBeforeTimeout,
+    nullptr,
+    nullptr,
+    nullptr,
+    nullptr,
+    nullptr
+};
+
+/* Source for JSGlobalObject.lut.h
+@begin globalObjectTable
+  parseFloat            globalFuncParseFloat                         DontEnum|Function 1
+  isNaN                 JSBuiltin                                    DontEnum|Function 1
+  isFinite              JSBuiltin                                    DontEnum|Function 1
+  escape                globalFuncEscape                             DontEnum|Function 1
+  unescape              globalFuncUnescape                           DontEnum|Function 1
+  decodeURI             globalFuncDecodeURI                          DontEnum|Function 1
+  decodeURIComponent    globalFuncDecodeURIComponent                 DontEnum|Function 1
+  encodeURI             globalFuncEncodeURI                          DontEnum|Function 1
+  encodeURIComponent    globalFuncEncodeURIComponent                 DontEnum|Function 1
+  EvalError             JSGlobalObject::m_evalErrorConstructor       DontEnum|CellProperty
+  ReferenceError        JSGlobalObject::m_referenceErrorConstructor  DontEnum|CellProperty
+  SyntaxError           JSGlobalObject::m_syntaxErrorConstructor     DontEnum|CellProperty
+  URIError              JSGlobalObject::m_URIErrorConstructor        DontEnum|CellProperty
+  Proxy                 createProxyProperty                          DontEnum|PropertyCallback
+  JSON                  createJSONProperty                           DontEnum|PropertyCallback
+  Math                  createMathProperty                           DontEnum|PropertyCallback
+  Atomics               createAtomicsProperty                        DontEnum|PropertyCallback
+  console               createConsoleProperty                        DontEnum|PropertyCallback
+  Int8Array             JSGlobalObject::m_typedArrayInt8             DontEnum|ClassStructure
+  Int16Array            JSGlobalObject::m_typedArrayInt16            DontEnum|ClassStructure
+  Int32Array            JSGlobalObject::m_typedArrayInt32            DontEnum|ClassStructure
+  Uint8Array            JSGlobalObject::m_typedArrayUint8            DontEnum|ClassStructure
+  Uint8ClampedArray     JSGlobalObject::m_typedArrayUint8Clamped     DontEnum|ClassStructure
+  Uint16Array           JSGlobalObject::m_typedArrayUint16           DontEnum|ClassStructure
+  Uint32Array           JSGlobalObject::m_typedArrayUint32           DontEnum|ClassStructure
+  Float32Array          JSGlobalObject::m_typedArrayFloat32          DontEnum|ClassStructure
+  Float64Array          JSGlobalObject::m_typedArrayFloat64          DontEnum|ClassStructure
+  DataView              JSGlobalObject::m_typedArrayDataView         DontEnum|ClassStructure
+  Set                   JSGlobalObject::m_setStructure               DontEnum|ClassStructure
+  Date                  JSGlobalObject::m_dateStructure              DontEnum|ClassStructure
+  Boolean               JSGlobalObject::m_booleanObjectStructure     DontEnum|ClassStructure
+  Number                JSGlobalObject::m_numberObjectStructure      DontEnum|ClassStructure
+  WeakMap               JSGlobalObject::m_weakMapStructure           DontEnum|ClassStructure
+  WeakSet               JSGlobalObject::m_weakSetStructure           DontEnum|ClassStructure
+@end
+*/
+
+static EncodedJSValue JSC_HOST_CALL getTemplateObject(ExecState* exec)
+{
+    JSValue thisValue = exec->thisValue();
+    ASSERT(thisValue.inherits(JSTemplateRegistryKey::info()));
+    return JSValue::encode(exec->lexicalGlobalObject()->templateRegistry().getTemplateObject(exec, jsCast<JSTemplateRegistryKey*>(thisValue)));
+}
+
+
+static EncodedJSValue JSC_HOST_CALL enqueueJob(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+
+    JSValue job = exec->argument(0);
+    JSValue arguments = exec->argument(1);
+    ASSERT(arguments.inherits(JSArray::info()));
+
+    globalObject->queueMicrotask(createJSJob(vm, job, jsCast<JSArray*>(arguments)));
+
+    return JSValue::encode(jsUndefined());
+}
+
+JSGlobalObject::JSGlobalObject(VM& vm, Structure* structure, const GlobalObjectMethodTable* globalObjectMethodTable)
+    : Base(vm, structure, 0)
+    , m_vm(vm)
+#if ENABLE(WEB_REPLAY)
+    , m_inputCursor(EmptyInputCursor::create())
+#endif
+    , m_masqueradesAsUndefinedWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
+    , m_havingABadTimeWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
+    , m_varInjectionWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
+    , m_weakRandom(Options::forceWeakRandomSeed() ? Options::forcedWeakRandomSeed() : static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
+    , m_arrayIteratorProtocolWatchpoint(IsWatched)
+    , m_arraySpeciesWatchpoint(ClearWatchpoint)
+    , m_templateRegistry(vm)
+    , m_evalEnabled(true)
+    , m_runtimeFlags()
+    , m_consoleClient(nullptr)
+    , m_globalObjectMethodTable(globalObjectMethodTable ? globalObjectMethodTable : &s_globalObjectMethodTable)
+{
+}
+
+JSGlobalObject::~JSGlobalObject()
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    m_inspectorController->globalObjectDestroyed();
+#endif
+
+    if (m_debugger)
+        m_debugger->detach(this, Debugger::GlobalObjectIsDestructing);
+}
+
+void JSGlobalObject::destroy(JSCell* cell)
+{
+    static_cast<JSGlobalObject*>(cell)->JSGlobalObject::~JSGlobalObject();
+}
+
+void JSGlobalObject::setGlobalThis(VM& vm, JSObject* globalThis)
+{
+    m_globalThis.set(vm, this, globalThis);
+}
+
+static JSObject* getGetterById(ExecState* exec, JSObject* base, const Identifier& ident)
+{
+    JSValue baseValue = JSValue(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
+    baseValue.getPropertySlot(exec, ident, slot);
+    return slot.getPureResult().toObject(exec);
+}
+
+void JSGlobalObject::init(VM& vm)
+{
+    ASSERT(vm.currentThreadIsHoldingAPILock());
+    auto catchScope = DECLARE_CATCH_SCOPE(vm);
+
+    Base::setStructure(vm, Structure::toCacheableDictionaryTransition(vm, structure()));
+
+    m_debugger = 0;
+
+#if ENABLE(REMOTE_INSPECTOR)
+    m_inspectorController = std::make_unique<Inspector::JSGlobalObjectInspectorController>(*this);
+    m_inspectorDebuggable = std::make_unique<JSGlobalObjectDebuggable>(*this);
+    m_inspectorDebuggable->init();
+    m_consoleClient = m_inspectorController->consoleClient();
+#endif
+
+    m_functionPrototype.set(vm, this, FunctionPrototype::create(vm, FunctionPrototype::createStructure(vm, this, jsNull()))); // The real prototype will be set once ObjectPrototype is created.
+    m_calleeStructure.set(vm, this, JSCallee::createStructure(vm, this, jsNull()));
+
+    m_globalLexicalEnvironment.set(vm, this, JSGlobalLexicalEnvironment::create(vm, JSGlobalLexicalEnvironment::createStructure(vm, this), this));
+    // Need to create the callee structure (above) before creating the callee.
+    JSCallee* globalCallee = JSCallee::create(vm, this, globalScope());
+    m_globalCallee.set(vm, this, globalCallee);
+
+    ExecState::initGlobalExec(JSGlobalObject::globalExec(), globalCallee);
+    ExecState* exec = JSGlobalObject::globalExec();
+
+    m_functionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
+    m_customGetterSetterFunctionStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSCustomGetterSetterFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
+        });
+    m_boundFunctionStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSBoundFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
+        });
+    m_getterSetterStructure.set(vm, this, GetterSetter::createStructure(vm, this, jsNull()));
+    m_nativeStdFunctionStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSNativeStdFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
+        });
+    m_namedFunctionStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(Structure::addPropertyTransition(init.vm, init.owner->m_functionStructure.get(), init.vm.propertyNames->name, DontDelete | ReadOnly | DontEnum, init.owner->m_functionNameOffset));
+        });
+    JSFunction* callFunction = 0;
+    JSFunction* applyFunction = 0;
+    JSFunction* hasInstanceSymbolFunction = 0;
+    m_functionPrototype->addFunctionProperties(exec, this, &callFunction, &applyFunction, &hasInstanceSymbolFunction);
+    m_callFunction.set(vm, this, callFunction);
+    m_applyFunction.set(vm, this, applyFunction);
+    m_arrayProtoToStringFunction.initLater(
+        [] (const Initializer<JSFunction>& init) {
+            init.set(JSFunction::create(init.vm, init.owner, 0, init.vm.propertyNames->toString.string(), arrayProtoFuncToString, NoIntrinsic));
+        });
+    m_arrayProtoValuesFunction.initLater(
+        [] (const Initializer<JSFunction>& init) {
+            init.set(JSFunction::createBuiltinFunction(init.vm, arrayPrototypeValuesCodeGenerator(init.vm), init.owner));
+        });
+    m_initializePromiseFunction.initLater(
+        [] (const Initializer<JSFunction>& init) {
+            init.set(JSFunction::createBuiltinFunction(init.vm, promiseOperationsInitializePromiseCodeGenerator(init.vm), init.owner));
+        });
+
+    m_iteratorProtocolFunction.initLater(
+        [] (const Initializer<JSFunction>& init) {
+            init.set(JSFunction::createBuiltinFunction(init.vm, iteratorHelpersPerformIterationCodeGenerator(init.vm), init.owner));
+        });
+
+    m_newPromiseCapabilityFunction.set(vm, this, JSFunction::createBuiltinFunction(vm, promiseOperationsNewPromiseCapabilityCodeGenerator(vm), this));
+    m_functionProtoHasInstanceSymbolFunction.set(vm, this, hasInstanceSymbolFunction);
+    m_throwTypeErrorGetterSetter.initLater(
+        [] (const Initializer<GetterSetter>& init) {
+            JSFunction* thrower = init.owner->throwTypeErrorFunction();
+            GetterSetter* getterSetter = GetterSetter::create(init.vm, init.owner);
+            getterSetter->setGetter(init.vm, init.owner, thrower);
+            getterSetter->setSetter(init.vm, init.owner, thrower);
+            init.set(getterSetter);
+        });
+
+    m_nullGetterFunction.set(vm, this, NullGetterFunction::create(vm, NullGetterFunction::createStructure(vm, this, m_functionPrototype.get())));
+    m_nullSetterFunction.set(vm, this, NullSetterFunction::create(vm, NullSetterFunction::createStructure(vm, this, m_functionPrototype.get())));
+    m_objectPrototype.set(vm, this, ObjectPrototype::create(vm, this, ObjectPrototype::createStructure(vm, this, jsNull())));
+    GetterSetter* protoAccessor = GetterSetter::create(vm, this);
+    protoAccessor->setGetter(vm, this, JSFunction::create(vm, this, 0, makeString("get ", vm.propertyNames->underscoreProto.string()), globalFuncProtoGetter));
+    protoAccessor->setSetter(vm, this, JSFunction::create(vm, this, 0, makeString("set ", vm.propertyNames->underscoreProto.string()), globalFuncProtoSetter));
+    m_objectPrototype->putDirectNonIndexAccessor(vm, vm.propertyNames->underscoreProto, protoAccessor, Accessor | DontEnum);
+    m_functionPrototype->structure()->setPrototypeWithoutTransition(vm, m_objectPrototype.get());
+    m_objectStructureForObjectConstructor.set(vm, this, vm.prototypeMap.emptyObjectStructureForPrototype(this, m_objectPrototype.get(), JSFinalObject::defaultInlineCapacity()));
+    
+    JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeErrorArgumentsCalleeAndCaller);
+    GetterSetter* getterSetter = GetterSetter::create(vm, this);
+    getterSetter->setGetter(vm, this, thrower);
+    getterSetter->setSetter(vm, this, thrower);
+    m_throwTypeErrorArgumentsCalleeAndCallerGetterSetter.set(vm, this, getterSetter);
+    
+    m_functionPrototype->initRestrictedProperties(exec, this);
+
+    m_speciesGetterSetter.set(vm, this, GetterSetter::create(vm, this));
+    m_speciesGetterSetter->setGetter(vm, this, JSFunction::createBuiltinFunction(vm, globalOperationsSpeciesGetterCodeGenerator(vm), this, "get [Symbol.species]"));
+
+    m_typedArrayProto.initLater(
+        [] (const Initializer<JSTypedArrayViewPrototype>& init) {
+            init.set(JSTypedArrayViewPrototype::create(init.vm, init.owner, JSTypedArrayViewPrototype::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get())));
+            
+            // Make sure that the constructor gets initialized, too.
+            init.owner->m_typedArraySuperConstructor.get(init.owner);
+        });
+    m_typedArraySuperConstructor.initLater(
+        [] (const Initializer<JSTypedArrayViewConstructor>& init) {
+            JSTypedArrayViewPrototype* prototype = init.owner->m_typedArrayProto.get(init.owner);
+            JSTypedArrayViewConstructor* constructor = JSTypedArrayViewConstructor::create(init.vm, init.owner, JSTypedArrayViewConstructor::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()), prototype, init.owner->m_speciesGetterSetter.get());
+            prototype->putDirectWithoutTransition(init.vm, init.vm.propertyNames->constructor, constructor, DontEnum);
+            init.set(constructor);
+        });
+    
+#define INIT_TYPED_ARRAY_LATER(type) \
+    m_typedArray ## type.initLater( \
+        [] (LazyClassStructure::Initializer& init) { \
+            init.setPrototype(JS ## type ## ArrayPrototype::create(init.vm, init.global, JS ## type ## ArrayPrototype::createStructure(init.vm, init.global, init.global->m_typedArrayProto.get(init.global)))); \
+            init.setStructure(JS ## type ## Array::createStructure(init.vm, init.global, init.prototype)); \
+            init.setConstructor(JS ## type ## ArrayConstructor::create(init.vm, init.global, JS ## type ## ArrayConstructor::createStructure(init.vm, init.global, init.global->m_typedArraySuperConstructor.get(init.global)), init.prototype, ASCIILiteral(#type "Array"), typedArrayConstructorAllocate ## type ## ArrayCodeGenerator(init.vm))); \
+            init.global->putDirectWithoutTransition(init.vm, init.vm.propertyNames->builtinNames().type ## ArrayPrivateName(), init.constructor, DontEnum); \
+        });
+    FOR_EACH_TYPED_ARRAY_TYPE_EXCLUDING_DATA_VIEW(INIT_TYPED_ARRAY_LATER)
+#undef INIT_TYPED_ARRAY_LATER
+    
+    m_typedArrayDataView.initLater(
+        [] (LazyClassStructure::Initializer& init) {
+            init.setPrototype(JSDataViewPrototype::create(init.vm, JSDataViewPrototype::createStructure(init.vm, init.global, init.global->m_objectPrototype.get())));
+            init.setStructure(JSDataView::createStructure(init.vm, init.global, init.prototype));
+            init.setConstructor(JSDataViewConstructor::create(init.vm, init.global, JSDataViewConstructor::createStructure(init.vm, init.global, init.global->m_functionPrototype.get()), init.prototype, ASCIILiteral("DataView"), nullptr));
+        });
+    
+    m_lexicalEnvironmentStructure.set(vm, this, JSLexicalEnvironment::createStructure(vm, this));
+    m_moduleEnvironmentStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSModuleEnvironment::createStructure(init.vm, init.owner));
+        });
+    m_strictEvalActivationStructure.set(vm, this, StrictEvalActivation::createStructure(vm, this, jsNull()));
+    m_debuggerScopeStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(DebuggerScope::createStructure(init.vm, init.owner));
+        });
+    m_withScopeStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSWithScope::createStructure(init.vm, init.owner, jsNull()));
+        });
+    
+    m_nullPrototypeObjectStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSFinalObject::createStructure(init.vm, init.owner, jsNull(), JSFinalObject::defaultInlineCapacity()));
+        });
+    
+    m_callbackFunctionStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSCallbackFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
+        });
+    m_directArgumentsStructure.set(vm, this, DirectArguments::createStructure(vm, this, m_objectPrototype.get()));
+    m_scopedArgumentsStructure.set(vm, this, ScopedArguments::createStructure(vm, this, m_objectPrototype.get()));
+    m_clonedArgumentsStructure.set(vm, this, ClonedArguments::createStructure(vm, this, m_objectPrototype.get()));
+    m_callbackConstructorStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSCallbackConstructor::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
+        });
+    m_callbackObjectStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSCallbackObject<JSDestructibleObject>::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
+        });
+
+#if JSC_OBJC_API_ENABLED
+    m_objcCallbackFunctionStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(ObjCCallbackFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
+        });
+    m_objcWrapperObjectStructure.initLater(
+        [] (const Initializer<Structure>& init) {
+            init.set(JSCallbackObject<JSAPIWrapperObject>::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
+        });
+#endif
+    
+    m_arrayPrototype.set(vm, this, ArrayPrototype::create(vm, this, ArrayPrototype::createStructure(vm, this, m_objectPrototype.get())));
+    
+    m_originalArrayStructureForIndexingShape[UndecidedShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithUndecided));
+    m_originalArrayStructureForIndexingShape[Int32Shape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithInt32));
+    m_originalArrayStructureForIndexingShape[DoubleShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithDouble));
+    m_originalArrayStructureForIndexingShape[ContiguousShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithContiguous));
+    m_originalArrayStructureForIndexingShape[ArrayStorageShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithArrayStorage));
+    m_originalArrayStructureForIndexingShape[SlowPutArrayStorageShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithSlowPutArrayStorage));
+    for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
+        m_arrayStructureForIndexingShapeDuringAllocation[i] = m_originalArrayStructureForIndexingShape[i];
+
+    m_regExpPrototype.set(vm, this, RegExpPrototype::create(vm, this, RegExpPrototype::createStructure(vm, this, m_objectPrototype.get())));
+    m_regExpStructure.set(vm, this, RegExpObject::createStructure(vm, this, m_regExpPrototype.get()));
+    m_regExpMatchesArrayStructure.set(vm, this, createRegExpMatchesArrayStructure(vm, this));
+
+    m_moduleRecordStructure.set(vm, this, JSModuleRecord::createStructure(vm, this, m_objectPrototype.get()));
+    m_moduleNamespaceObjectStructure.set(vm, this, JSModuleNamespaceObject::createStructure(vm, this, jsNull()));
+    {
+        bool isCallable = false;
+        m_proxyObjectStructure.set(vm, this, ProxyObject::createStructure(vm, this, jsNull(), isCallable));
+        isCallable = true;
+        m_callableProxyObjectStructure.set(vm, this, ProxyObject::createStructure(vm, this, jsNull(), isCallable));
+    }
+    m_proxyRevokeStructure.set(vm, this, ProxyRevoke::createStructure(vm, this, m_functionPrototype.get()));
+
+    m_parseIntFunction.set(vm, this, JSFunction::create(vm, this, 2, vm.propertyNames->parseInt.string(), globalFuncParseInt, NoIntrinsic));
+    putDirectWithoutTransition(vm, vm.propertyNames->parseInt, m_parseIntFunction.get(), DontEnum);
+    
+    m_arrayBufferPrototype.set(vm, this, JSArrayBufferPrototype::create(vm, this, JSArrayBufferPrototype::createStructure(vm, this, m_objectPrototype.get()), ArrayBufferSharingMode::Default));
+    m_arrayBufferStructure.set(vm, this, JSArrayBuffer::createStructure(vm, this, m_arrayBufferPrototype.get()));
+    m_sharedArrayBufferPrototype.set(vm, this, JSArrayBufferPrototype::create(vm, this, JSArrayBufferPrototype::createStructure(vm, this, m_objectPrototype.get()), ArrayBufferSharingMode::Shared));
+    m_sharedArrayBufferStructure.set(vm, this, JSArrayBuffer::createStructure(vm, this, m_sharedArrayBufferPrototype.get()));
+
+#define CREATE_PROTOTYPE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+m_ ## lowerName ## Prototype.set(vm, this, capitalName##Prototype::create(vm, this, capitalName##Prototype::createStructure(vm, this, m_ ## prototypeBase ## Prototype.get()))); \
+m_ ## properName ## Structure.set(vm, this, instanceType::createStructure(vm, this, m_ ## lowerName ## Prototype.get()));
+    
+    FOR_EACH_SIMPLE_BUILTIN_TYPE(CREATE_PROTOTYPE_FOR_SIMPLE_TYPE)
+    
+#undef CREATE_PROTOTYPE_FOR_SIMPLE_TYPE
+
+#define CREATE_PROTOTYPE_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    m_ ## properName ## Structure.initLater(\
+        [] (LazyClassStructure::Initializer& init) { \
+            init.setPrototype(capitalName##Prototype::create(init.vm, init.global, capitalName##Prototype::createStructure(init.vm, init.global, init.global->m_ ## prototypeBase ## Prototype.get()))); \
+            init.setStructure(instanceType::createStructure(init.vm, init.global, init.prototype)); \
+            init.setConstructor(capitalName ## Constructor::create(init.vm, capitalName ## Constructor::createStructure(init.vm, init.global, init.global->m_functionPrototype.get()), jsCast<capitalName ## Prototype*>(init.prototype), init.global->m_speciesGetterSetter.get())); \
+        });
+    
+    FOR_EACH_LAZY_BUILTIN_TYPE(CREATE_PROTOTYPE_FOR_LAZY_TYPE)
+    
+#undef CREATE_PROTOTYPE_FOR_LAZY_TYPE
+    
+    m_iteratorPrototype.set(vm, this, IteratorPrototype::create(vm, this, IteratorPrototype::createStructure(vm, this, m_objectPrototype.get())));
+
+#define CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    m_ ## lowerName ## Structure.initLater( \
+        [] (const Initializer<Structure>& init) { \
+            JSObject* prototype = capitalName ## Prototype::create(init.vm, init.owner, capitalName ## Prototype::createStructure(init.vm, init.owner, init.owner->m_iteratorPrototype.get())); \
+            init.set(instanceType::createStructure(init.vm, init.owner, prototype)); \
+        });
+    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE)
+#undef CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE
+
+    m_propertyNameIteratorStructure.set(vm, this, JSPropertyNameIterator::createStructure(vm, this, m_iteratorPrototype.get()));
+    m_generatorPrototype.set(vm, this, GeneratorPrototype::create(vm, this, GeneratorPrototype::createStructure(vm, this, m_iteratorPrototype.get())));
+    m_moduleLoaderPrototype.set(vm, this, ModuleLoaderPrototype::create(vm, this, ModuleLoaderPrototype::createStructure(vm, this, m_objectPrototype.get())));
+    
+    // Constructors
+
+    ObjectConstructor* objectConstructor = ObjectConstructor::create(vm, this, ObjectConstructor::createStructure(vm, this, m_functionPrototype.get()), m_objectPrototype.get());
+    m_objectConstructor.set(vm, this, objectConstructor);
+
+    JSFunction* throwTypeErrorFunction = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeError);
+    m_throwTypeErrorFunction.set(vm, this, throwTypeErrorFunction);
+
+    JSCell* functionConstructor = FunctionConstructor::create(vm, FunctionConstructor::createStructure(vm, this, m_functionPrototype.get()), m_functionPrototype.get());
+
+    ArrayConstructor* arrayConstructor = ArrayConstructor::create(vm, this, ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_arrayPrototype.get(), m_speciesGetterSetter.get());
+    m_arrayConstructor.set(vm, this, arrayConstructor);
+    
+    m_regExpConstructor.set(vm, this, RegExpConstructor::create(vm, RegExpConstructor::createStructure(vm, this, m_functionPrototype.get()), m_regExpPrototype.get(), m_speciesGetterSetter.get()));
+    
+    JSArrayBufferConstructor* arrayBufferConstructor = JSArrayBufferConstructor::create(vm, JSArrayBufferConstructor::createStructure(vm, this, m_functionPrototype.get()), m_arrayBufferPrototype.get(), m_speciesGetterSetter.get(), ArrayBufferSharingMode::Default);
+    m_arrayBufferPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, arrayBufferConstructor, DontEnum);
+    JSArrayBufferConstructor* sharedArrayBufferConstructor = nullptr;
+    sharedArrayBufferConstructor = JSArrayBufferConstructor::create(vm, JSArrayBufferConstructor::createStructure(vm, this, m_functionPrototype.get()), m_sharedArrayBufferPrototype.get(), m_speciesGetterSetter.get(), ArrayBufferSharingMode::Shared);
+    m_sharedArrayBufferPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, sharedArrayBufferConstructor, DontEnum);
+    
+#define CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+capitalName ## Constructor* lowerName ## Constructor = capitalName ## Constructor::create(vm, capitalName ## Constructor::createStructure(vm, this, m_functionPrototype.get()), m_ ## lowerName ## Prototype.get(), m_speciesGetterSetter.get()); \
+m_ ## lowerName ## Prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, lowerName ## Constructor, DontEnum); \
+
+    FOR_EACH_SIMPLE_BUILTIN_TYPE(CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE)
+    
+#undef CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE
+
+    m_errorConstructor.set(vm, this, errorConstructor);
+    m_promiseConstructor.set(vm, this, promiseConstructor);
+    m_internalPromiseConstructor.set(vm, this, internalPromiseConstructor);
+    
+    m_nativeErrorPrototypeStructure.set(vm, this, NativeErrorPrototype::createStructure(vm, this, m_errorPrototype.get()));
+    m_nativeErrorStructure.set(vm, this, NativeErrorConstructor::createStructure(vm, this, m_functionPrototype.get()));
+    m_evalErrorConstructor.initLater(
+        [] (const Initializer<NativeErrorConstructor>& init) {
+            init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("EvalError")));
+        });
+    m_rangeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, m_nativeErrorStructure.get(), m_nativeErrorPrototypeStructure.get(), ASCIILiteral("RangeError")));
+    m_referenceErrorConstructor.initLater(
+        [] (const Initializer<NativeErrorConstructor>& init) {
+            init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("ReferenceError")));
+        });
+    m_syntaxErrorConstructor.initLater(
+        [] (const Initializer<NativeErrorConstructor>& init) {
+            init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("SyntaxError")));
+        });
+    m_typeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, m_nativeErrorStructure.get(), m_nativeErrorPrototypeStructure.get(), ASCIILiteral("TypeError")));
+    m_URIErrorConstructor.initLater(
+        [] (const Initializer<NativeErrorConstructor>& init) {
+            init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("URIError")));
+        });
+
+    m_generatorFunctionPrototype.set(vm, this, GeneratorFunctionPrototype::create(vm, GeneratorFunctionPrototype::createStructure(vm, this, m_functionPrototype.get())));
+    GeneratorFunctionConstructor* generatorFunctionConstructor = GeneratorFunctionConstructor::create(vm, GeneratorFunctionConstructor::createStructure(vm, this, functionConstructor), m_generatorFunctionPrototype.get());
+    m_generatorFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, generatorFunctionConstructor, DontEnum | ReadOnly);
+    m_generatorFunctionStructure.set(vm, this, JSGeneratorFunction::createStructure(vm, this, m_generatorFunctionPrototype.get()));
+
+    m_generatorPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_generatorFunctionPrototype.get(), DontEnum | ReadOnly);
+    m_generatorFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->prototype, m_generatorPrototype.get(), DontEnum | ReadOnly);
+
+    m_asyncFunctionPrototype.set(vm, this, AsyncFunctionPrototype::create(vm, AsyncFunctionPrototype::createStructure(vm, this, m_functionPrototype.get())));
+    AsyncFunctionConstructor* asyncFunctionConstructor = AsyncFunctionConstructor::create(vm, AsyncFunctionConstructor::createStructure(vm, this, functionConstructor), m_asyncFunctionPrototype.get());
+    m_asyncFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, asyncFunctionConstructor, DontEnum | ReadOnly);
+    m_asyncFunctionStructure.set(vm, this, JSAsyncFunction::createStructure(vm, this, m_asyncFunctionPrototype.get()));
+
+    m_objectPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, objectConstructor, DontEnum);
+    m_functionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, functionConstructor, DontEnum);
+    m_arrayPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, arrayConstructor, DontEnum);
+    m_regExpPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_regExpConstructor.get(), DontEnum);
+    
+    putDirectWithoutTransition(vm, vm.propertyNames->Object, objectConstructor, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->Function, functionConstructor, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->Array, arrayConstructor, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->RegExp, m_regExpConstructor.get(), DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->RangeError, m_rangeErrorConstructor.get(), DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->TypeError, m_typeErrorConstructor.get(), DontEnum);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().ObjectPrivateName(), objectConstructor, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().ArrayPrivateName(), arrayConstructor, DontEnum | DontDelete | ReadOnly);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->ArrayBuffer, arrayBufferConstructor, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->SharedArrayBuffer, sharedArrayBufferConstructor, DontEnum);
+
+#define PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Constructor, DontEnum); \
+
+    FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR(PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE)
+
+#undef PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE
+    m_iteratorResultObjectStructure.set(vm, this, createIteratorResultObjectStructure(vm, *this));
+    
+    m_evalFunction.set(vm, this, JSFunction::create(vm, this, 1, vm.propertyNames->eval.string(), globalFuncEval));
+    putDirectWithoutTransition(vm, vm.propertyNames->eval, m_evalFunction.get(), DontEnum);
+    
+#if ENABLE(INTL)
+    IntlObject* intl = IntlObject::create(vm, this, IntlObject::createStructure(vm, this, m_objectPrototype.get()));
+    putDirectWithoutTransition(vm, vm.propertyNames->Intl, intl, DontEnum);
+#endif // ENABLE(INTL)
+    ReflectObject* reflectObject = ReflectObject::create(vm, this, ReflectObject::createStructure(vm, this, m_objectPrototype.get()));
+    putDirectWithoutTransition(vm, vm.propertyNames->Reflect, reflectObject, DontEnum);
+
+    m_moduleLoaderStructure.set(vm, this, JSModuleLoader::createStructure(vm, this, m_moduleLoaderPrototype.get()));
+    m_moduleLoader.set(vm, this, JSModuleLoader::create(globalExec(), vm, this, m_moduleLoaderStructure.get()));
+    if (Options::exposeInternalModuleLoader())
+        putDirectWithoutTransition(vm, vm.propertyNames->Loader, m_moduleLoader.get(), DontEnum);
+
+    JSFunction* builtinLog = JSFunction::create(vm, this, 1, vm.propertyNames->emptyIdentifier.string(), globalFuncBuiltinLog);
+
+    JSFunction* privateFuncAbs = JSFunction::create(vm, this, 0, String(), mathProtoFuncAbs, AbsIntrinsic);
+    JSFunction* privateFuncFloor = JSFunction::create(vm, this, 0, String(), mathProtoFuncFloor, FloorIntrinsic);
+    JSFunction* privateFuncTrunc = JSFunction::create(vm, this, 0, String(), mathProtoFuncTrunc, TruncIntrinsic);
+
+    JSFunction* privateFuncGetTemplateObject = JSFunction::create(vm, this, 0, String(), getTemplateObject);
+    JSFunction* privateFuncTypedArrayLength = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncLength);
+    JSFunction* privateFuncTypedArrayGetOriginalConstructor = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncGetOriginalConstructor);
+    JSFunction* privateFuncTypedArraySort = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncSort);
+    JSFunction* privateFuncIsTypedArrayView = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncIsTypedArrayView, IsTypedArrayViewIntrinsic);
+    JSFunction* privateFuncTypedArraySubarrayCreate = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncSubarrayCreate);
+    JSFunction* privateFuncIsBoundFunction = JSFunction::create(vm, this, 0, String(), isBoundFunction);
+    JSFunction* privateFuncHasInstanceBoundFunction = JSFunction::create(vm, this, 0, String(), hasInstanceBoundFunction);
+    JSFunction* privateFuncInstanceOf = JSFunction::create(vm, this, 0, String(), objectPrivateFuncInstanceOf);
+    JSFunction* privateFuncThisTimeValue = JSFunction::create(vm, this, 0, String(), dateProtoFuncGetTime);
+    JSFunction* privateFuncThisNumberValue = JSFunction::create(vm, this, 0, String(), numberProtoFuncValueOf);
+    JSFunction* privateFuncIsArrayConstructor = JSFunction::create(vm, this, 0, String(), arrayConstructorPrivateFuncIsArrayConstructor);
+    JSFunction* privateFuncIsArraySlow = JSFunction::create(vm, this, 0, String(), arrayConstructorPrivateFuncIsArraySlow);
+    JSFunction* privateFuncConcatMemcpy = JSFunction::create(vm, this, 0, String(), arrayProtoPrivateFuncConcatMemcpy);
+    JSFunction* privateFuncAppendMemcpy = JSFunction::create(vm, this, 0, String(), arrayProtoPrivateFuncAppendMemcpy);
+    JSFunction* privateFuncConcatSlowPath = JSFunction::createBuiltinFunction(vm, arrayPrototypeConcatSlowPathCodeGenerator(vm), this);
+
+    JSObject* regExpProtoFlagsGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->flags);
+    ASSERT_UNUSED(catchScope, !catchScope.exception());
+    JSObject* regExpProtoGlobalGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->global);
+    ASSERT(!catchScope.exception());
+    m_regExpProtoGlobalGetter.set(vm, this, regExpProtoGlobalGetterObject);
+    JSObject* regExpProtoIgnoreCaseGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->ignoreCase);
+    ASSERT(!catchScope.exception());
+    JSObject* regExpProtoMultilineGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->multiline);
+    ASSERT(!catchScope.exception());
+    JSObject* regExpProtoSourceGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->source);
+    ASSERT(!catchScope.exception());
+    JSObject* regExpProtoStickyGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->sticky);
+    ASSERT(!catchScope.exception());
+    JSObject* regExpProtoUnicodeGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->unicode);
+    ASSERT(!catchScope.exception());
+    m_regExpProtoUnicodeGetter.set(vm, this, regExpProtoUnicodeGetterObject);
+    JSObject* builtinRegExpExec = asObject(m_regExpPrototype->getDirect(vm, vm.propertyNames->exec).asCell());
+    m_regExpProtoExec.set(vm, this, builtinRegExpExec);
+    JSObject* regExpSymbolReplace = asObject(m_regExpPrototype->getDirect(vm, vm.propertyNames->replaceSymbol).asCell());
+    m_regExpProtoSymbolReplace.set(vm, this, regExpSymbolReplace);
+
+#define CREATE_PRIVATE_GLOBAL_FUNCTION(name, code) JSFunction* name ## PrivateFunction = JSFunction::createBuiltinFunction(vm, code ## CodeGenerator(vm), this);
+    JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(CREATE_PRIVATE_GLOBAL_FUNCTION)
+#undef CREATE_PRIVATE_GLOBAL_FUNCTION
+
+    JSObject* arrayIteratorPrototype = ArrayIteratorPrototype::create(vm, this, ArrayIteratorPrototype::createStructure(vm, this, m_iteratorPrototype.get()));
+    createArrayIteratorPrivateFunction->putDirect(vm, vm.propertyNames->prototype, arrayIteratorPrototype);
+
+    GlobalPropertyInfo staticGlobals[] = {
+#define INIT_PRIVATE_GLOBAL(name, code) GlobalPropertyInfo(vm.propertyNames->builtinNames().name ## PrivateName(), name ## PrivateFunction, DontEnum | DontDelete | ReadOnly),
+        JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(INIT_PRIVATE_GLOBAL)
+#undef INIT_PRIVATE_GLOBAL
+        GlobalPropertyInfo(vm.propertyNames->NaN, jsNaN(), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->Infinity, jsNumber(std::numeric_limits<double>::infinity()), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->undefinedKeyword, jsUndefined(), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().ownEnumerablePropertyKeysPrivateName(), JSFunction::create(vm, this, 0, String(), ownEnumerablePropertyKeys), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().getTemplateObjectPrivateName(), privateFuncGetTemplateObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().enqueueJobPrivateName(), JSFunction::create(vm, this, 0, String(), enqueueJob), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().ErrorPrivateName(), m_errorConstructor.get(), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().RangeErrorPrivateName(), m_rangeErrorConstructor.get(), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().TypeErrorPrivateName(), m_typeErrorConstructor.get(), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().typedArrayLengthPrivateName(), privateFuncTypedArrayLength, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().typedArrayGetOriginalConstructorPrivateName(), privateFuncTypedArrayGetOriginalConstructor, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().typedArraySortPrivateName(), privateFuncTypedArraySort, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().isTypedArrayViewPrivateName(), privateFuncIsTypedArrayView, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().typedArraySubarrayCreatePrivateName(), privateFuncTypedArraySubarrayCreate, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().isBoundFunctionPrivateName(), privateFuncIsBoundFunction, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().hasInstanceBoundFunctionPrivateName(), privateFuncHasInstanceBoundFunction, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().instanceOfPrivateName(), privateFuncInstanceOf, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().BuiltinLogPrivateName(), builtinLog, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().NumberPrivateName(), numberConstructor, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().RegExpPrivateName(), m_regExpConstructor.get(), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().StringPrivateName(), stringConstructor, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().absPrivateName(), privateFuncAbs, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().floorPrivateName(), privateFuncFloor, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().truncPrivateName(), privateFuncTrunc, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().PromisePrivateName(), promiseConstructor, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().ReflectPrivateName(), reflectObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().InternalPromisePrivateName(), internalPromiseConstructor, DontEnum | DontDelete | ReadOnly),
+
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().repeatCharacterPrivateName(), JSFunction::create(vm, this, 2, String(), stringProtoFuncRepeatCharacter), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().SetIteratorPrivateName(), JSFunction::create(vm, this, 1, String(), privateFuncSetIterator), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().setIteratorNextPrivateName(), JSFunction::create(vm, this, 0, String(), privateFuncSetIteratorNext), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().isArrayPrivateName(), arrayConstructor->getDirect(vm, vm.propertyNames->isArray), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().isArraySlowPrivateName(), privateFuncIsArraySlow, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().isArrayConstructorPrivateName(), privateFuncIsArrayConstructor, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().concatMemcpyPrivateName(), privateFuncConcatMemcpy, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().appendMemcpyPrivateName(), privateFuncAppendMemcpy, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().concatSlowPathPrivateName(), privateFuncConcatSlowPath, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().MapIteratorPrivateName(), JSFunction::create(vm, this, 1, String(), privateFuncMapIterator), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().mapIteratorNextPrivateName(), JSFunction::create(vm, this, 0, String(), privateFuncMapIteratorNext), DontEnum | DontDelete | ReadOnly),
+
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().InspectorInstrumentationPrivateName(), InspectorInstrumentationObject::create(vm, this, InspectorInstrumentationObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().MapPrivateName(), mapConstructor, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().thisTimeValuePrivateName(), privateFuncThisTimeValue, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().thisNumberValuePrivateName(), privateFuncThisNumberValue, DontEnum | DontDelete | ReadOnly),
+#if ENABLE(INTL)
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().CollatorPrivateName(), intl->getDirect(vm, vm.propertyNames->Collator), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().DateTimeFormatPrivateName(), intl->getDirect(vm, vm.propertyNames->DateTimeFormat), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().NumberFormatPrivateName(), intl->getDirect(vm, vm.propertyNames->NumberFormat), DontEnum | DontDelete | ReadOnly),
+#endif // ENABLE(INTL)
+
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().isConstructorPrivateName(), JSFunction::create(vm, this, 1, String(), esSpecIsConstructor, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
+
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoFlagsGetterPrivateName(), regExpProtoFlagsGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoGlobalGetterPrivateName(), regExpProtoGlobalGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoIgnoreCaseGetterPrivateName(), regExpProtoIgnoreCaseGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoMultilineGetterPrivateName(), regExpProtoMultilineGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoSourceGetterPrivateName(), regExpProtoSourceGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoStickyGetterPrivateName(), regExpProtoStickyGetterObject, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoUnicodeGetterPrivateName(), regExpProtoUnicodeGetterObject, DontEnum | DontDelete | ReadOnly),
+
+        // RegExp.prototype helpers.
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpBuiltinExecPrivateName(), builtinRegExpExec, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpCreatePrivateName(), JSFunction::create(vm, this, 2, String(), esSpecRegExpCreate, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpMatchFastPrivateName(), JSFunction::create(vm, this, 1, String(), regExpProtoFuncMatchFast), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpSearchFastPrivateName(), JSFunction::create(vm, this, 1, String(), regExpProtoFuncSearchFast), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpSplitFastPrivateName(), JSFunction::create(vm, this, 2, String(), regExpProtoFuncSplitFast), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpPrototypeSymbolReplacePrivateName(), m_regExpPrototype->getDirect(vm, vm.propertyNames->replaceSymbol), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpTestFastPrivateName(), JSFunction::create(vm, this, 1, String(), regExpProtoFuncTestFast, RegExpTestFastIntrinsic), DontEnum | DontDelete | ReadOnly),
+
+        // String.prototype helpers.
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().stringIncludesInternalPrivateName(), JSFunction::create(vm, this, 1, String(), builtinStringIncludesInternal), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().stringSplitFastPrivateName(), JSFunction::create(vm, this, 2, String(), stringProtoFuncSplitFast), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().stringSubstrInternalPrivateName(), JSFunction::create(vm, this, 2, String(), builtinStringSubstrInternal), DontEnum | DontDelete | ReadOnly),
+
+        // Function prototype helpers.
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().makeBoundFunctionPrivateName(), JSFunction::create(vm, this, 5, String(), makeBoundFunction), DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames->builtinNames().hasOwnLengthPropertyPrivateName(), JSFunction::create(vm, this, 1, String(), hasOwnLengthProperty), DontEnum | DontDelete | ReadOnly),
+    };
+    addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
+    
+    m_specialPointers[Special::CallFunction] = m_callFunction.get();
+    m_specialPointers[Special::ApplyFunction] = m_applyFunction.get();
+    m_specialPointers[Special::ObjectConstructor] = objectConstructor;
+    m_specialPointers[Special::ArrayConstructor] = arrayConstructor;
+
+    m_linkTimeConstants[static_cast<unsigned>(LinkTimeConstant::ThrowTypeErrorFunction)] = m_throwTypeErrorFunction.get();
+
+    if (UNLIKELY(Options::useDollarVM())) {
+        JSDollarVMPrototype* dollarVMPrototype = JSDollarVMPrototype::create(vm, this, JSDollarVMPrototype::createStructure(vm, this, m_objectPrototype.get()));
+        m_dollarVMStructure.set(vm, this, JSDollarVM::createStructure(vm, this, dollarVMPrototype));
+        JSDollarVM* dollarVM = JSDollarVM::create(vm, m_dollarVMStructure.get());
+
+        GlobalPropertyInfo extraStaticGlobals[] = {
+            GlobalPropertyInfo(vm.propertyNames->builtinNames().dollarVMPrivateName(), dollarVM, DontEnum | DontDelete | ReadOnly),
+        };
+        addStaticGlobals(extraStaticGlobals, WTF_ARRAY_LENGTH(extraStaticGlobals));
+
+        putDirectWithoutTransition(vm, Identifier::fromString(exec, "$vm"), dollarVM, DontEnum);
+    }
+
+#if ENABLE(WEBASSEMBLY)
+    if (Options::useWebAssembly()) {
+        auto* webAssemblyPrototype = WebAssemblyPrototype::create(vm, this, WebAssemblyPrototype::createStructure(vm, this, m_objectPrototype.get()));
+        m_webAssemblyStructure.set(vm, this, JSWebAssembly::createStructure(vm, this, webAssemblyPrototype));
+        m_webAssemblyModuleRecordStructure.set(vm, this, WebAssemblyModuleRecord::createStructure(vm, this, m_objectPrototype.get()));
+        m_webAssemblyFunctionStructure.set(vm, this, WebAssemblyFunction::createStructure(vm, this, m_objectPrototype.get()));
+        auto* webAssembly = JSWebAssembly::create(vm, this, m_webAssemblyStructure.get());
+        putDirectWithoutTransition(vm, Identifier::fromString(exec, "WebAssembly"), webAssembly, DontEnum);
+
+#define CREATE_WEBASSEMBLY_CONSTRUCTOR(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) do { \
+        typedef capitalName ## Prototype Prototype; \
+        typedef capitalName ## Constructor Constructor; \
+        typedef JS ## capitalName JSObj; \
+        auto* base = m_ ## prototypeBase ## Prototype.get(); \
+        auto* prototype = Prototype::create(vm, this, Prototype::createStructure(vm, this, base)); \
+        auto* structure = JSObj::createStructure(vm, this, prototype); \
+        auto* constructor = Constructor::create(vm, Constructor::createStructure(vm, this, this->functionPrototype()), prototype); \
+        prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, constructor, DontEnum); \
+        m_ ## lowerName ## Prototype.set(vm, this, prototype); \
+        m_ ## properName ## Structure.set(vm, this, structure); \
+        webAssembly->putDirectWithoutTransition(vm, Identifier::fromString(this->globalExec(), #jsName), constructor, DontEnum); \
+    } while (0);
+
+        FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(CREATE_WEBASSEMBLY_CONSTRUCTOR)
+
+#undef CREATE_WEBASSEMBLY_CONSTRUCTOR
+    }
+#endif // ENABLE(WEBASSEMBLY)
+
+    {
+        ExecState* exec = globalExec();
+
+        auto setupAdaptiveWatchpoint = [&] (JSObject* base, const Identifier& ident) -> ObjectPropertyCondition {
+            // Performing these gets should not throw.
+            PropertySlot slot(base, PropertySlot::InternalMethodType::Get);
+            bool result = base->getOwnPropertySlot(base, exec, ident, slot);
+            ASSERT_UNUSED(result, result);
+            ASSERT(!catchScope.exception());
+            RELEASE_ASSERT(slot.isCacheableValue());
+            JSValue functionValue = slot.getValue(exec, ident);
+            ASSERT(!catchScope.exception());
+            ASSERT(jsDynamicCast<JSFunction*>(functionValue));
+
+            ObjectPropertyCondition condition = generateConditionForSelfEquivalence(m_vm, nullptr, base, ident.impl());
+            RELEASE_ASSERT(condition.requiredValue() == functionValue);
+
+            bool isWatchable = condition.isWatchable(PropertyCondition::EnsureWatchability);
+            RELEASE_ASSERT(isWatchable); // We allow this to install the necessary watchpoints.
+
+            return condition;
+        };
+
+        {
+            ObjectPropertyCondition condition = setupAdaptiveWatchpoint(arrayIteratorPrototype, m_vm.propertyNames->next);
+            m_arrayIteratorPrototypeNext = std::make_unique<ArrayIteratorAdaptiveWatchpoint>(condition, this);
+            m_arrayIteratorPrototypeNext->install();
+        }
+
+        {
+            ArrayPrototype* arrayPrototype = this->arrayPrototype();
+            ObjectPropertyCondition condition = setupAdaptiveWatchpoint(arrayPrototype, m_vm.propertyNames->iteratorSymbol);
+            m_arrayPrototypeSymbolIteratorWatchpoint = std::make_unique<ArrayIteratorAdaptiveWatchpoint>(condition, this);
+            m_arrayPrototypeSymbolIteratorWatchpoint->install();
+        }
+    }
+
+    resetPrototype(vm, getPrototypeDirect());
+}
+
+bool JSGlobalObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(cell);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject))) {
+        scope.release();
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+    }
+
+    bool shouldThrowReadOnlyError = slot.isStrictMode();
+    bool ignoreReadOnlyErrors = false;
+    bool putResult = false;
+    bool done = symbolTablePutTouchWatchpointSet(thisObject, exec, propertyName, value, shouldThrowReadOnlyError, ignoreReadOnlyErrors, putResult);
+    ASSERT((!!scope.exception() == (done && !putResult)) || !shouldThrowReadOnlyError);
+    if (done)
+        return putResult;
+    scope.release();
+    return Base::put(thisObject, exec, propertyName, value, slot);
+}
+
+bool JSGlobalObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(object);
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
+    // silently ignore attempts to add accessors aliasing vars.
+    if (descriptor.isAccessorDescriptor() && symbolTableGet(thisObject, propertyName, slot))
+        return false;
+    return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+}
+
+void JSGlobalObject::addGlobalVar(const Identifier& ident)
+{
+    ConcurrentJSLocker locker(symbolTable()->m_lock);
+    SymbolTableEntry entry = symbolTable()->get(locker, ident.impl());
+    if (!entry.isNull())
+        return;
+    
+    ScopeOffset offset = symbolTable()->takeNextScopeOffset(locker);
+    SymbolTableEntry newEntry(VarOffset(offset), 0);
+    newEntry.prepareToWatch();
+    symbolTable()->add(locker, ident.impl(), WTFMove(newEntry));
+    
+    ScopeOffset offsetForAssert = addVariables(1, jsUndefined());
+    RELEASE_ASSERT(offsetForAssert == offset);
+}
+
+void JSGlobalObject::addFunction(ExecState* exec, const Identifier& propertyName)
+{
+    VM& vm = exec->vm();
+    VM::DeletePropertyModeScope scope(vm, VM::DeletePropertyMode::IgnoreConfigurable);
+    methodTable(vm)->deleteProperty(this, exec, propertyName);
+    addGlobalVar(propertyName);
+}
+
+void JSGlobalObject::setGlobalScopeExtension(JSScope* scope)
+{
+    m_globalScopeExtension.set(vm(), this, scope);
+}
+
+void JSGlobalObject::clearGlobalScopeExtension()
+{
+    m_globalScopeExtension.clear();
+}
+
+static inline JSObject* lastInPrototypeChain(JSObject* object)
+{
+    JSObject* o = object;
+    while (o->getPrototypeDirect().isObject())
+        o = asObject(o->getPrototypeDirect());
+    return o;
+}
+
+// Private namespace for helpers for JSGlobalObject::haveABadTime()
+namespace {
+
+class ObjectsWithBrokenIndexingFinder : public MarkedBlock::VoidFunctor {
+public:
+    ObjectsWithBrokenIndexingFinder(MarkedArgumentBuffer&, JSGlobalObject*);
+    IterationStatus operator()(HeapCell*, HeapCell::Kind) const;
+
+private:
+    void visit(JSCell*);
+
+    MarkedArgumentBuffer& m_foundObjects;
+    JSGlobalObject* m_globalObject;
+};
+
+ObjectsWithBrokenIndexingFinder::ObjectsWithBrokenIndexingFinder(
+    MarkedArgumentBuffer& foundObjects, JSGlobalObject* globalObject)
+    : m_foundObjects(foundObjects)
+    , m_globalObject(globalObject)
+{
+}
+
+inline bool hasBrokenIndexing(JSObject* object)
+{
+    // This will change if we have more indexing types.
+    IndexingType type = object->indexingType();
+    // This could be made obviously more efficient, but isn't made so right now, because
+    // we expect this to be an unlikely slow path anyway.
+    return hasUndecided(type) || hasInt32(type) || hasDouble(type) || hasContiguous(type) || hasArrayStorage(type);
+}
+
+inline void ObjectsWithBrokenIndexingFinder::visit(JSCell* cell)
+{
+    if (!cell->isObject())
+        return;
+    
+    JSObject* object = asObject(cell);
+
+    // Run this filter first, since it's cheap, and ought to filter out a lot of objects.
+    if (!hasBrokenIndexing(object))
+        return;
+    
+    // We only want to have a bad time in the affected global object, not in the entire
+    // VM. But we have to be careful, since there may be objects that claim to belong to
+    // a different global object that have prototypes from our global object.
+    bool foundGlobalObject = false;
+    for (JSObject* current = object; ;) {
+        if (current->globalObject() == m_globalObject) {
+            foundGlobalObject = true;
+            break;
+        }
+        
+        JSValue prototypeValue = current->getPrototypeDirect();
+        if (prototypeValue.isNull())
+            break;
+        current = asObject(prototypeValue);
+    }
+    if (!foundGlobalObject)
+        return;
+    
+    m_foundObjects.append(object);
+}
+
+IterationStatus ObjectsWithBrokenIndexingFinder::operator()(HeapCell* cell, HeapCell::Kind kind) const
+{
+    if (kind == HeapCell::JSCell) {
+        // FIXME: This const_cast exists because this isn't a C++ lambda.
+        // https://bugs.webkit.org/show_bug.cgi?id=159644
+        const_cast<ObjectsWithBrokenIndexingFinder*>(this)->visit(static_cast<JSCell*>(cell));
+    }
+    return IterationStatus::Continue;
+}
+
+} // end private namespace for helpers for JSGlobalObject::haveABadTime()
+
+void JSGlobalObject::haveABadTime(VM& vm)
+{
+    ASSERT(&vm == &this->vm());
+    
+    if (isHavingABadTime())
+        return;
+    
+    // Make sure that all allocations or indexed storage transitions that are inlining
+    // the assumption that it's safe to transition to a non-SlowPut array storage don't
+    // do so anymore.
+    m_havingABadTimeWatchpoint->fireAll(vm, "Having a bad time");
+    ASSERT(isHavingABadTime()); // The watchpoint is what tells us that we're having a bad time.
+    
+    // Make sure that all JSArray allocations that load the appropriate structure from
+    // this object now load a structure that uses SlowPut.
+    for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
+        m_arrayStructureForIndexingShapeDuringAllocation[i].set(vm, this, originalArrayStructureForIndexingType(ArrayWithSlowPutArrayStorage));
+
+    // Same for any special array structures.
+    Structure* slowPutStructure;
+    slowPutStructure = createRegExpMatchesArraySlowPutStructure(vm, this);
+    m_regExpMatchesArrayStructure.set(vm, this, slowPutStructure);
+    slowPutStructure = ClonedArguments::createSlowPutStructure(vm, this, m_objectPrototype.get());
+    m_clonedArgumentsStructure.set(vm, this, slowPutStructure);
+
+    // Make sure that all objects that have indexed storage switch to the slow kind of
+    // indexed storage.
+    MarkedArgumentBuffer foundObjects; // Use MarkedArgumentBuffer because switchToSlowPutArrayStorage() may GC.
+    ObjectsWithBrokenIndexingFinder finder(foundObjects, this);
+    {
+        HeapIterationScope iterationScope(vm.heap);
+        vm.heap.objectSpace().forEachLiveCell(iterationScope, finder);
+    }
+    while (!foundObjects.isEmpty()) {
+        JSObject* object = asObject(foundObjects.last());
+        foundObjects.removeLast();
+        ASSERT(hasBrokenIndexing(object));
+        object->switchToSlowPutArrayStorage(vm);
+    }
+}
+
+// Set prototype, and also insert the object prototype at the end of the chain.
+void JSGlobalObject::resetPrototype(VM& vm, JSValue prototype)
+{
+    setPrototypeDirect(vm, prototype);
+
+    JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
+    JSObject* objectPrototype = m_objectPrototype.get();
+    if (oldLastInPrototypeChain != objectPrototype)
+        oldLastInPrototypeChain->setPrototypeDirect(vm, objectPrototype);
+
+    // Whenever we change the prototype of the global object, we need to create a new JSProxy with the correct prototype.
+    setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype, PureForwardingProxyType), this));
+}
+
+void JSGlobalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{ 
+    JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_globalThis);
+
+    visitor.append(thisObject->m_globalLexicalEnvironment);
+    visitor.append(thisObject->m_globalScopeExtension);
+    visitor.append(thisObject->m_globalCallee);
+    visitor.append(thisObject->m_regExpConstructor);
+    visitor.append(thisObject->m_errorConstructor);
+    visitor.append(thisObject->m_nativeErrorPrototypeStructure);
+    visitor.append(thisObject->m_nativeErrorStructure);
+    thisObject->m_evalErrorConstructor.visit(visitor);
+    visitor.append(thisObject->m_rangeErrorConstructor);
+    thisObject->m_referenceErrorConstructor.visit(visitor);
+    thisObject->m_syntaxErrorConstructor.visit(visitor);
+    visitor.append(thisObject->m_typeErrorConstructor);
+    thisObject->m_URIErrorConstructor.visit(visitor);
+    visitor.append(thisObject->m_objectConstructor);
+    visitor.append(thisObject->m_promiseConstructor);
+
+    visitor.append(thisObject->m_nullGetterFunction);
+    visitor.append(thisObject->m_nullSetterFunction);
+
+    visitor.append(thisObject->m_parseIntFunction);
+    visitor.append(thisObject->m_evalFunction);
+    visitor.append(thisObject->m_callFunction);
+    visitor.append(thisObject->m_applyFunction);
+    visitor.append(thisObject->m_throwTypeErrorFunction);
+    thisObject->m_arrayProtoToStringFunction.visit(visitor);
+    thisObject->m_arrayProtoValuesFunction.visit(visitor);
+    thisObject->m_initializePromiseFunction.visit(visitor);
+    thisObject->m_iteratorProtocolFunction.visit(visitor);
+    visitor.append(thisObject->m_newPromiseCapabilityFunction);
+    visitor.append(thisObject->m_functionProtoHasInstanceSymbolFunction);
+    thisObject->m_throwTypeErrorGetterSetter.visit(visitor);
+    visitor.append(thisObject->m_throwTypeErrorArgumentsCalleeAndCallerGetterSetter);
+    visitor.append(thisObject->m_moduleLoader);
+
+    visitor.append(thisObject->m_objectPrototype);
+    visitor.append(thisObject->m_functionPrototype);
+    visitor.append(thisObject->m_arrayPrototype);
+    visitor.append(thisObject->m_errorPrototype);
+    visitor.append(thisObject->m_iteratorPrototype);
+    visitor.append(thisObject->m_generatorFunctionPrototype);
+    visitor.append(thisObject->m_generatorPrototype);
+    visitor.append(thisObject->m_asyncFunctionPrototype);
+    visitor.append(thisObject->m_moduleLoaderPrototype);
+
+    thisObject->m_debuggerScopeStructure.visit(visitor);
+    thisObject->m_withScopeStructure.visit(visitor);
+    visitor.append(thisObject->m_strictEvalActivationStructure);
+    visitor.append(thisObject->m_lexicalEnvironmentStructure);
+    thisObject->m_moduleEnvironmentStructure.visit(visitor);
+    visitor.append(thisObject->m_directArgumentsStructure);
+    visitor.append(thisObject->m_scopedArgumentsStructure);
+    visitor.append(thisObject->m_clonedArgumentsStructure);
+    visitor.append(thisObject->m_objectStructureForObjectConstructor);
+    for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
+        visitor.append(thisObject->m_originalArrayStructureForIndexingShape[i]);
+    for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
+        visitor.append(thisObject->m_arrayStructureForIndexingShapeDuringAllocation[i]);
+    thisObject->m_callbackConstructorStructure.visit(visitor);
+    thisObject->m_callbackFunctionStructure.visit(visitor);
+    thisObject->m_callbackObjectStructure.visit(visitor);
+    visitor.append(thisObject->m_propertyNameIteratorStructure);
+#if JSC_OBJC_API_ENABLED
+    thisObject->m_objcCallbackFunctionStructure.visit(visitor);
+    thisObject->m_objcWrapperObjectStructure.visit(visitor);
+#endif
+    thisObject->m_nullPrototypeObjectStructure.visit(visitor);
+    visitor.append(thisObject->m_errorStructure);
+    visitor.append(thisObject->m_calleeStructure);
+    visitor.append(thisObject->m_functionStructure);
+    thisObject->m_customGetterSetterFunctionStructure.visit(visitor);
+    thisObject->m_boundFunctionStructure.visit(visitor);
+    visitor.append(thisObject->m_getterSetterStructure);
+    thisObject->m_nativeStdFunctionStructure.visit(visitor);
+    thisObject->m_namedFunctionStructure.visit(visitor);
+    visitor.append(thisObject->m_symbolObjectStructure);
+    visitor.append(thisObject->m_regExpStructure);
+    visitor.append(thisObject->m_generatorFunctionStructure);
+    visitor.append(thisObject->m_asyncFunctionStructure);
+    visitor.append(thisObject->m_iteratorResultObjectStructure);
+    visitor.append(thisObject->m_regExpMatchesArrayStructure);
+    visitor.append(thisObject->m_moduleRecordStructure);
+    visitor.append(thisObject->m_moduleNamespaceObjectStructure);
+    visitor.append(thisObject->m_dollarVMStructure);
+    visitor.append(thisObject->m_proxyObjectStructure);
+    visitor.append(thisObject->m_callableProxyObjectStructure);
+    visitor.append(thisObject->m_proxyRevokeStructure);
+    visitor.append(thisObject->m_moduleLoaderStructure);
+    
+    visitor.append(thisObject->m_arrayBufferPrototype);
+    visitor.append(thisObject->m_arrayBufferStructure);
+    visitor.append(thisObject->m_sharedArrayBufferPrototype);
+    visitor.append(thisObject->m_sharedArrayBufferStructure);
+
+#define VISIT_SIMPLE_TYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    visitor.append(thisObject->m_ ## lowerName ## Prototype); \
+    visitor.append(thisObject->m_ ## properName ## Structure); \
+
+    FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE)
+    
+#if ENABLE(WEBASSEMBLY)
+    visitor.append(thisObject->m_webAssemblyStructure);
+    visitor.append(thisObject->m_webAssemblyModuleRecordStructure);
+    visitor.append(thisObject->m_webAssemblyFunctionStructure);
+    FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(VISIT_SIMPLE_TYPE)
+#endif // ENABLE(WEBASSEMBLY)
+
+#undef VISIT_SIMPLE_TYPE
+
+#define VISIT_LAZY_TYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    thisObject->m_ ## properName ## Structure.visit(visitor);
+    
+    FOR_EACH_LAZY_BUILTIN_TYPE(VISIT_LAZY_TYPE)
+    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_LAZY_TYPE)
+
+#undef VISIT_LAZY_TYPE
+
+    for (unsigned i = NUMBER_OF_TYPED_ARRAY_TYPES; i--;)
+        thisObject->lazyTypedArrayStructure(indexToTypedArrayType(i)).visit(visitor);
+    
+    visitor.append(thisObject->m_speciesGetterSetter);
+    thisObject->m_typedArrayProto.visit(visitor);
+    thisObject->m_typedArraySuperConstructor.visit(visitor);
+}
+
+JSValue JSGlobalObject::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
+{
+    if (ecmaMode == StrictMode)
+        return jsUndefined();
+    return exec->globalThisValue();
+}
+
+ExecState* JSGlobalObject::globalExec()
+{
+    return CallFrame::create(m_globalCallFrame);
+}
+
+void JSGlobalObject::addStaticGlobals(GlobalPropertyInfo* globals, int count)
+{
+    ScopeOffset startOffset = addVariables(count, jsUndefined());
+
+    for (int i = 0; i < count; ++i) {
+        GlobalPropertyInfo& global = globals[i];
+        ASSERT(global.attributes & DontDelete);
+        
+        WatchpointSet* watchpointSet = nullptr;
+        WriteBarrierBase<Unknown>* variable = nullptr;
+        {
+            ConcurrentJSLocker locker(symbolTable()->m_lock);
+            ScopeOffset offset = symbolTable()->takeNextScopeOffset(locker);
+            RELEASE_ASSERT(offset = startOffset + i);
+            SymbolTableEntry newEntry(VarOffset(offset), global.attributes);
+            newEntry.prepareToWatch();
+            watchpointSet = newEntry.watchpointSet();
+            symbolTable()->add(locker, global.identifier.impl(), WTFMove(newEntry));
+            variable = &variableAt(offset);
+        }
+        symbolTablePutTouchWatchpointSet(vm(), this, global.identifier, global.value, variable, watchpointSet);
+    }
+}
+
+bool JSGlobalObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    if (Base::getOwnPropertySlot(object, exec, propertyName, slot))
+        return true;
+    return symbolTableGet(jsCast<JSGlobalObject*>(object), propertyName, slot);
+}
+
+void JSGlobalObject::clearRareData(JSCell* cell)
+{
+    jsCast<JSGlobalObject*>(cell)->m_rareData = nullptr;
+}
+
+void slowValidateCell(JSGlobalObject* globalObject)
+{
+    RELEASE_ASSERT(globalObject->isGlobalObject());
+    ASSERT_GC_OBJECT_INHERITS(globalObject, JSGlobalObject::info());
+}
+
+void JSGlobalObject::setRemoteDebuggingEnabled(bool enabled)
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    m_inspectorDebuggable->setRemoteDebuggingAllowed(enabled);
+#else
+    UNUSED_PARAM(enabled);
+#endif
+}
+
+bool JSGlobalObject::remoteDebuggingEnabled() const
+{
+#if ENABLE(REMOTE_INSPECTOR)
+    return m_inspectorDebuggable->remoteDebuggingAllowed();
+#else
+    return false;
+#endif
+}
+
+#if ENABLE(WEB_REPLAY)
+void JSGlobalObject::setInputCursor(PassRefPtr<InputCursor> prpCursor)
+{
+    m_inputCursor = prpCursor;
+    ASSERT(m_inputCursor);
+
+    InputCursor& cursor = inputCursor();
+    // Save or set the random seed. This performed here rather than the constructor
+    // to avoid threading the input cursor through all the abstraction layers.
+    if (cursor.isCapturing())
+        cursor.appendInput<SetRandomSeed>(m_weakRandom.seed());
+    else if (cursor.isReplaying()) {
+        if (SetRandomSeed* input = cursor.fetchInput<SetRandomSeed>())
+            m_weakRandom.setSeed(static_cast<unsigned>(input->randomSeed()));
+    }
+}
+#endif
+
+void JSGlobalObject::setName(const String& name)
+{
+    m_name = name;
+
+#if ENABLE(REMOTE_INSPECTOR)
+    m_inspectorDebuggable->update();
+#endif
+}
+
+# if ENABLE(INTL)
+const HashSet<String>& JSGlobalObject::intlCollatorAvailableLocales()
+{
+    if (m_intlCollatorAvailableLocales.isEmpty()) {
+        int32_t count = ucol_countAvailable();
+        for (int32_t i = 0; i < count; ++i) {
+            String locale(ucol_getAvailable(i));
+            convertICULocaleToBCP47LanguageTag(locale);
+            m_intlCollatorAvailableLocales.add(locale);
+        }
+    }
+    return m_intlCollatorAvailableLocales;
+}
+
+const HashSet<String>& JSGlobalObject::intlDateTimeFormatAvailableLocales()
+{
+    if (m_intlDateTimeFormatAvailableLocales.isEmpty()) {
+        int32_t count = udat_countAvailable();
+        for (int32_t i = 0; i < count; ++i) {
+            String locale(udat_getAvailable(i));
+            convertICULocaleToBCP47LanguageTag(locale);
+            m_intlDateTimeFormatAvailableLocales.add(locale);
+        }
+    }
+    return m_intlDateTimeFormatAvailableLocales;
+}
+
+const HashSet<String>& JSGlobalObject::intlNumberFormatAvailableLocales()
+{
+    if (m_intlNumberFormatAvailableLocales.isEmpty()) {
+        int32_t count = unum_countAvailable();
+        for (int32_t i = 0; i < count; ++i) {
+            String locale(unum_getAvailable(i));
+            convertICULocaleToBCP47LanguageTag(locale);
+            m_intlNumberFormatAvailableLocales.add(locale);
+        }
+    }
+    return m_intlNumberFormatAvailableLocales;
+}
+#endif // ENABLE(INTL)
+
+void JSGlobalObject::queueMicrotask(Ref<Microtask>&& task)
+{
+    if (globalObjectMethodTable()->queueTaskToEventLoop) {
+        globalObjectMethodTable()->queueTaskToEventLoop(this, WTFMove(task));
+        return;
+    }
+
+    vm().queueMicrotask(this, WTFMove(task));
+}
+
+bool JSGlobalObject::hasDebugger() const
+{ 
+    return m_debugger;
+}
+
+bool JSGlobalObject::hasInteractiveDebugger() const 
+{ 
+    return m_debugger && m_debugger->isInteractivelyDebugging();
+}
+
+} // namespace JSC
diff --git a/runtime/JSGlobalObject.h b/runtime/JSGlobalObject.h
new file mode 100644
index 0000000..ac1b740
--- /dev/null
+++ b/runtime/JSGlobalObject.h
@@ -0,0 +1,953 @@
+/*
+ *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ *  Copyright (C) 2007-2009, 2014-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "ArrayAllocationProfile.h"
+#include "ArrayBufferSharingMode.h"
+#include "InternalFunction.h"
+#include "JSArray.h"
+#include "JSArrayBufferPrototype.h"
+#include "JSClassRef.h"
+#include "JSGlobalLexicalEnvironment.h"
+#include "JSProxy.h"
+#include "JSSegmentedVariableObject.h"
+#include "JSWeakObjectMapRefInternal.h"
+#include "LazyProperty.h"
+#include "LazyClassStructure.h"
+#include "NumberPrototype.h"
+#include "RuntimeFlags.h"
+#include "SpecialPointer.h"
+#include "StringPrototype.h"
+#include "SymbolPrototype.h"
+#include "TemplateRegistry.h"
+#include "VM.h"
+#include "Watchpoint.h"
+#include <JavaScriptCore/JSBase.h>
+#include <array>
+#include <wtf/HashSet.h>
+#include <wtf/PassRefPtr.h>
+
+struct OpaqueJSClass;
+struct OpaqueJSClassContextData;
+
+namespace Inspector {
+class JSGlobalObjectInspectorController;
+}
+
+namespace JSC {
+class ArrayConstructor;
+class ArrayPrototype;
+class ArrayIteratorAdaptiveWatchpoint;
+class AsyncFunctionPrototype;
+class BooleanPrototype;
+class ConsoleClient;
+class Debugger;
+class ErrorConstructor;
+class ErrorPrototype;
+class EvalCodeBlock;
+class EvalExecutable;
+class FunctionConstructor;
+class FunctionPrototype;
+class GeneratorPrototype;
+class GeneratorFunctionPrototype;
+class GetterSetter;
+class GlobalCodeBlock;
+class IndirectEvalExecutable;
+class InputCursor;
+class JSArrayBuffer;
+class JSArrayBufferConstructor;
+class JSArrayBufferPrototype;
+class JSGlobalObjectDebuggable;
+class JSInternalPromise;
+class JSModuleLoader;
+class JSPromise;
+class JSPromiseConstructor;
+class JSPromisePrototype;
+class JSSharedArrayBuffer;
+class JSSharedArrayBufferConstructor;
+class JSSharedArrayBufferPrototype;
+class JSTypedArrayViewConstructor;
+class JSTypedArrayViewPrototype;
+class DirectEvalExecutable;
+class LLIntOffsetsExtractor;
+class Microtask;
+class ModuleLoaderPrototype;
+class ModuleProgramExecutable;
+class NativeErrorConstructor;
+class NullGetterFunction;
+class NullSetterFunction;
+class ObjectConstructor;
+class ProgramCodeBlock;
+class ProgramExecutable;
+class RegExpConstructor;
+class RegExpPrototype;
+class SourceCode;
+class UnlinkedModuleProgramCodeBlock;
+class VariableEnvironment;
+struct ActivationStackNode;
+struct HashTable;
+
+#define DEFINE_STANDARD_BUILTIN(macro, upperName, lowerName) macro(upperName, lowerName, lowerName, JS ## upperName, upperName, object)
+
+#define FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR(macro) \
+    macro(String, string, stringObject, StringObject, String, object) \
+    macro(Symbol, symbol, symbolObject, SymbolObject, Symbol, object) \
+    macro(Number, number, numberObject, NumberObject, Number, object) \
+    macro(Error, error, error, ErrorInstance, Error, object) \
+    macro(Map, map, map, JSMap, Map, object) \
+    macro(JSPromise, promise, promise, JSPromise, Promise, object)
+
+#define FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(macro) \
+    DEFINE_STANDARD_BUILTIN(macro, MapIterator, mapIterator) \
+    DEFINE_STANDARD_BUILTIN(macro, SetIterator, setIterator) \
+    DEFINE_STANDARD_BUILTIN(macro, StringIterator, stringIterator) \
+
+#define FOR_EACH_BUILTIN_ITERATOR_TYPE(macro) \
+    DEFINE_STANDARD_BUILTIN(macro, Iterator, iterator) \
+    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(macro) \
+
+#define FOR_EACH_SIMPLE_BUILTIN_TYPE(macro) \
+    FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR(macro) \
+    macro(JSInternalPromise, internalPromise, internalPromise, JSInternalPromise, InternalPromise, object) \
+
+#define FOR_EACH_LAZY_BUILTIN_TYPE(macro) \
+    macro(Set, set, set, JSSet, Set, object) \
+    macro(Date, date, date, DateInstance, Date, object) \
+    macro(Boolean, boolean, booleanObject, BooleanObject, Boolean, object) \
+    DEFINE_STANDARD_BUILTIN(macro, WeakMap, weakMap) \
+    DEFINE_STANDARD_BUILTIN(macro, WeakSet, weakSet) \
+
+#if ENABLE(WEBASSEMBLY)
+#define FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(macro) \
+    macro(WebAssemblyCompileError, webAssemblyCompileError, WebAssemblyCompileError, WebAssemblyCompileError, CompileError, error) \
+    macro(WebAssemblyInstance,     webAssemblyInstance,     WebAssemblyInstance,     WebAssemblyInstance,     Instance,     object) \
+    macro(WebAssemblyMemory,       webAssemblyMemory,       WebAssemblyMemory,       WebAssemblyMemory,       Memory,       object) \
+    macro(WebAssemblyModule,       webAssemblyModule,       WebAssemblyModule,       WebAssemblyModule,       Module,       object) \
+    macro(WebAssemblyRuntimeError, webAssemblyRuntimeError, WebAssemblyRuntimeError, WebAssemblyRuntimeError, RuntimeError, error) \
+    macro(WebAssemblyTable,        webAssemblyTable,        WebAssemblyTable,        WebAssemblyTable,        Table,        object)
+#else
+#define FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(macro)
+#endif // ENABLE(WEBASSEMBLY)
+
+#define DECLARE_SIMPLE_BUILTIN_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    class JS ## capitalName; \
+    class capitalName ## Prototype; \
+    class capitalName ## Constructor;
+
+class IteratorPrototype;
+FOR_EACH_SIMPLE_BUILTIN_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
+FOR_EACH_LAZY_BUILTIN_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
+FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
+FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
+
+#undef DECLARE_SIMPLE_BUILTIN_TYPE
+
+class JSInternalPromise;
+class InternalPromisePrototype;
+class InternalPromiseConstructor;
+
+typedef Vector<ExecState*, 16> ExecStateStack;
+
+struct GlobalObjectMethodTable {
+    typedef bool (*SupportsRichSourceInfoFunctionPtr)(const JSGlobalObject*);
+    SupportsRichSourceInfoFunctionPtr supportsRichSourceInfo;
+
+    typedef bool (*ShouldInterruptScriptFunctionPtr)(const JSGlobalObject*);
+    ShouldInterruptScriptFunctionPtr shouldInterruptScript;
+
+    typedef RuntimeFlags (*JavaScriptRuntimeFlagsFunctionPtr)(const JSGlobalObject*);
+    JavaScriptRuntimeFlagsFunctionPtr javaScriptRuntimeFlags;
+
+    typedef void (*QueueTaskToEventLoopFunctionPtr)(const JSGlobalObject*, Ref<Microtask>&&);
+    QueueTaskToEventLoopFunctionPtr queueTaskToEventLoop;
+
+    typedef bool (*ShouldInterruptScriptBeforeTimeoutPtr)(const JSGlobalObject*);
+    ShouldInterruptScriptBeforeTimeoutPtr shouldInterruptScriptBeforeTimeout;
+
+    typedef JSInternalPromise* (*ModuleLoaderResolvePtr)(JSGlobalObject*, ExecState*, JSModuleLoader*, JSValue, JSValue, JSValue);
+    ModuleLoaderResolvePtr moduleLoaderResolve;
+
+    typedef JSInternalPromise* (*ModuleLoaderFetchPtr)(JSGlobalObject*, ExecState*, JSModuleLoader*, JSValue, JSValue);
+    ModuleLoaderFetchPtr moduleLoaderFetch;
+
+    typedef JSInternalPromise* (*ModuleLoaderInstantiatePtr)(JSGlobalObject*, ExecState*, JSModuleLoader*, JSValue, JSValue, JSValue);
+    ModuleLoaderInstantiatePtr moduleLoaderInstantiate;
+
+    typedef JSValue (*ModuleLoaderEvaluatePtr)(JSGlobalObject*, ExecState*, JSModuleLoader*, JSValue, JSValue, JSValue);
+    ModuleLoaderEvaluatePtr moduleLoaderEvaluate;
+
+    typedef String (*DefaultLanguageFunctionPtr)();
+    DefaultLanguageFunctionPtr defaultLanguage;
+};
+
+class JSGlobalObject : public JSSegmentedVariableObject {
+private:
+    typedef HashSet<RefPtr<OpaqueJSWeakObjectMap>> WeakMapSet;
+    typedef HashMap<OpaqueJSClass*, std::unique_ptr<OpaqueJSClassContextData>> OpaqueJSClassDataMap;
+
+    struct JSGlobalObjectRareData {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        JSGlobalObjectRareData()
+            : profileGroup(0)
+        {
+        }
+
+        WeakMapSet weakMaps;
+        unsigned profileGroup;
+        
+        OpaqueJSClassDataMap opaqueJSClassData;
+    };
+
+// Our hashtable code-generator tries to access these properties, so we make them public.
+// However, we'd like it better if they could be protected.
+public:
+    template<typename T> using Initializer = typename LazyProperty<JSGlobalObject, T>::Initializer;
+    
+    Register m_globalCallFrame[CallFrame::headerSizeInRegisters];
+
+    WriteBarrier<JSObject> m_globalThis;
+
+    WriteBarrier<JSGlobalLexicalEnvironment> m_globalLexicalEnvironment;
+    WriteBarrier<JSScope> m_globalScopeExtension;
+    WriteBarrier<JSObject> m_globalCallee;
+    WriteBarrier<RegExpConstructor> m_regExpConstructor;
+    WriteBarrier<ErrorConstructor> m_errorConstructor;
+    WriteBarrier<Structure> m_nativeErrorPrototypeStructure;
+    WriteBarrier<Structure> m_nativeErrorStructure;
+    LazyProperty<JSGlobalObject, NativeErrorConstructor> m_evalErrorConstructor;
+    WriteBarrier<NativeErrorConstructor> m_rangeErrorConstructor;
+    LazyProperty<JSGlobalObject, NativeErrorConstructor> m_referenceErrorConstructor;
+    LazyProperty<JSGlobalObject, NativeErrorConstructor> m_syntaxErrorConstructor;
+    WriteBarrier<NativeErrorConstructor> m_typeErrorConstructor;
+    LazyProperty<JSGlobalObject, NativeErrorConstructor> m_URIErrorConstructor;
+    WriteBarrier<ObjectConstructor> m_objectConstructor;
+    WriteBarrier<ArrayConstructor> m_arrayConstructor;
+    WriteBarrier<JSPromiseConstructor> m_promiseConstructor;
+    WriteBarrier<JSInternalPromiseConstructor> m_internalPromiseConstructor;
+
+    WriteBarrier<NullGetterFunction> m_nullGetterFunction;
+    WriteBarrier<NullSetterFunction> m_nullSetterFunction;
+
+    WriteBarrier<JSFunction> m_parseIntFunction;
+
+    WriteBarrier<JSFunction> m_evalFunction;
+    WriteBarrier<JSFunction> m_callFunction;
+    WriteBarrier<JSFunction> m_applyFunction;
+    WriteBarrier<JSFunction> m_throwTypeErrorFunction;
+    LazyProperty<JSGlobalObject, JSFunction> m_arrayProtoToStringFunction;
+    LazyProperty<JSGlobalObject, JSFunction> m_arrayProtoValuesFunction;
+    LazyProperty<JSGlobalObject, JSFunction> m_initializePromiseFunction;
+    LazyProperty<JSGlobalObject, JSFunction> m_iteratorProtocolFunction;
+    WriteBarrier<JSFunction> m_newPromiseCapabilityFunction;
+    WriteBarrier<JSFunction> m_functionProtoHasInstanceSymbolFunction;
+    LazyProperty<JSGlobalObject, GetterSetter> m_throwTypeErrorGetterSetter;
+    WriteBarrier<JSObject> m_regExpProtoExec;
+    WriteBarrier<JSObject> m_regExpProtoSymbolReplace;
+    WriteBarrier<JSObject> m_regExpProtoGlobalGetter;
+    WriteBarrier<JSObject> m_regExpProtoUnicodeGetter;
+    WriteBarrier<GetterSetter> m_throwTypeErrorArgumentsCalleeAndCallerGetterSetter;
+
+    WriteBarrier<JSModuleLoader> m_moduleLoader;
+
+    WriteBarrier<ObjectPrototype> m_objectPrototype;
+    WriteBarrier<FunctionPrototype> m_functionPrototype;
+    WriteBarrier<ArrayPrototype> m_arrayPrototype;
+    WriteBarrier<RegExpPrototype> m_regExpPrototype;
+    WriteBarrier<IteratorPrototype> m_iteratorPrototype;
+    WriteBarrier<GeneratorFunctionPrototype> m_generatorFunctionPrototype;
+    WriteBarrier<GeneratorPrototype> m_generatorPrototype;
+    WriteBarrier<ModuleLoaderPrototype> m_moduleLoaderPrototype;
+
+    LazyProperty<JSGlobalObject, Structure> m_debuggerScopeStructure;
+    LazyProperty<JSGlobalObject, Structure> m_withScopeStructure;
+    WriteBarrier<Structure> m_strictEvalActivationStructure;
+    WriteBarrier<Structure> m_lexicalEnvironmentStructure;
+    LazyProperty<JSGlobalObject, Structure> m_moduleEnvironmentStructure;
+    WriteBarrier<Structure> m_directArgumentsStructure;
+    WriteBarrier<Structure> m_scopedArgumentsStructure;
+    WriteBarrier<Structure> m_clonedArgumentsStructure;
+
+    WriteBarrier<Structure> m_objectStructureForObjectConstructor;
+        
+    // Lists the actual structures used for having these particular indexing shapes.
+    WriteBarrier<Structure> m_originalArrayStructureForIndexingShape[NumberOfIndexingShapes];
+    // Lists the structures we should use during allocation for these particular indexing shapes.
+    // These structures will differ from the originals list above when we are having a bad time.
+    WriteBarrier<Structure> m_arrayStructureForIndexingShapeDuringAllocation[NumberOfIndexingShapes];
+
+    LazyProperty<JSGlobalObject, Structure> m_callbackConstructorStructure;
+    LazyProperty<JSGlobalObject, Structure> m_callbackFunctionStructure;
+    LazyProperty<JSGlobalObject, Structure> m_callbackObjectStructure;
+    WriteBarrier<Structure> m_propertyNameIteratorStructure;
+#if JSC_OBJC_API_ENABLED
+    LazyProperty<JSGlobalObject, Structure> m_objcCallbackFunctionStructure;
+    LazyProperty<JSGlobalObject, Structure> m_objcWrapperObjectStructure;
+#endif
+    LazyProperty<JSGlobalObject, Structure> m_nullPrototypeObjectStructure;
+    WriteBarrier<Structure> m_calleeStructure;
+    WriteBarrier<Structure> m_functionStructure;
+    LazyProperty<JSGlobalObject, Structure> m_boundFunctionStructure;
+    LazyProperty<JSGlobalObject, Structure> m_customGetterSetterFunctionStructure;
+    WriteBarrier<Structure> m_getterSetterStructure;
+    LazyProperty<JSGlobalObject, Structure> m_nativeStdFunctionStructure;
+    LazyProperty<JSGlobalObject, Structure> m_namedFunctionStructure;
+    PropertyOffset m_functionNameOffset;
+    WriteBarrier<Structure> m_privateNameStructure;
+    WriteBarrier<Structure> m_regExpStructure;
+    WriteBarrier<AsyncFunctionPrototype> m_asyncFunctionPrototype;
+    WriteBarrier<Structure> m_asyncFunctionStructure;
+    WriteBarrier<Structure> m_generatorFunctionStructure;
+    WriteBarrier<Structure> m_dollarVMStructure;
+    WriteBarrier<Structure> m_iteratorResultObjectStructure;
+    WriteBarrier<Structure> m_regExpMatchesArrayStructure;
+    WriteBarrier<Structure> m_moduleRecordStructure;
+    WriteBarrier<Structure> m_moduleNamespaceObjectStructure;
+    WriteBarrier<Structure> m_proxyObjectStructure;
+    WriteBarrier<Structure> m_callableProxyObjectStructure;
+    WriteBarrier<Structure> m_proxyRevokeStructure;
+    WriteBarrier<Structure> m_moduleLoaderStructure;
+    WriteBarrier<JSArrayBufferPrototype> m_arrayBufferPrototype;
+    WriteBarrier<Structure> m_arrayBufferStructure;
+    WriteBarrier<JSArrayBufferPrototype> m_sharedArrayBufferPrototype;
+    WriteBarrier<Structure> m_sharedArrayBufferStructure;
+
+#define DEFINE_STORAGE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    WriteBarrier<capitalName ## Prototype> m_ ## lowerName ## Prototype; \
+    WriteBarrier<Structure> m_ ## properName ## Structure;
+
+    FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
+    
+#if ENABLE(WEBASSEMBLY)
+    WriteBarrier<Structure> m_webAssemblyStructure;
+    WriteBarrier<Structure> m_webAssemblyModuleRecordStructure;
+    WriteBarrier<Structure> m_webAssemblyFunctionStructure;
+    FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
+#endif // ENABLE(WEBASSEMBLY)
+
+#undef DEFINE_STORAGE_FOR_SIMPLE_TYPE
+
+#define DEFINE_STORAGE_FOR_ITERATOR_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    LazyProperty<JSGlobalObject, Structure> m_ ## properName ## Structure;
+    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_ITERATOR_TYPE)
+#undef DEFINE_STORAGE_FOR_ITERATOR_TYPE
+    
+#define DEFINE_STORAGE_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    LazyClassStructure m_ ## properName ## Structure;
+    FOR_EACH_LAZY_BUILTIN_TYPE(DEFINE_STORAGE_FOR_LAZY_TYPE)
+#undef DEFINE_STORAGE_FOR_LAZY_TYPE
+
+    WriteBarrier<GetterSetter> m_speciesGetterSetter;
+    
+    LazyProperty<JSGlobalObject, JSTypedArrayViewPrototype> m_typedArrayProto;
+    LazyProperty<JSGlobalObject, JSTypedArrayViewConstructor> m_typedArraySuperConstructor;
+    
+#define DECLARE_TYPED_ARRAY_TYPE_STRUCTURE(name) LazyClassStructure m_typedArray ## name;
+    FOR_EACH_TYPED_ARRAY_TYPE(DECLARE_TYPED_ARRAY_TYPE_STRUCTURE)
+#undef DECLARE_TYPED_ARRAY_TYPE_STRUCTURE
+
+    JSCell* m_specialPointers[Special::TableSize]; // Special pointers used by the LLInt and JIT.
+    JSCell* m_linkTimeConstants[LinkTimeConstantCount];
+
+    String m_name;
+
+    Debugger* m_debugger;
+
+    VM& m_vm;
+
+#if ENABLE(WEB_REPLAY)
+    RefPtr<InputCursor> m_inputCursor;
+#endif
+
+#if ENABLE(REMOTE_INSPECTOR)
+    std::unique_ptr<Inspector::JSGlobalObjectInspectorController> m_inspectorController;
+    std::unique_ptr<JSGlobalObjectDebuggable> m_inspectorDebuggable;
+#endif
+
+#if ENABLE(INTL)
+    HashSet<String> m_intlCollatorAvailableLocales;
+    HashSet<String> m_intlDateTimeFormatAvailableLocales;
+    HashSet<String> m_intlNumberFormatAvailableLocales;
+#endif // ENABLE(INTL)
+
+    RefPtr<WatchpointSet> m_masqueradesAsUndefinedWatchpoint;
+    RefPtr<WatchpointSet> m_havingABadTimeWatchpoint;
+    RefPtr<WatchpointSet> m_varInjectionWatchpoint;
+
+    std::unique_ptr<JSGlobalObjectRareData> m_rareData;
+
+    WeakRandom m_weakRandom;
+
+    InlineWatchpointSet& arrayIteratorProtocolWatchpoint() { return m_arrayIteratorProtocolWatchpoint; }
+    InlineWatchpointSet& arraySpeciesWatchpoint() { return m_arraySpeciesWatchpoint; }
+    // If this hasn't been invalidated, it means the array iterator protocol
+    // is not observable to user code yet.
+    InlineWatchpointSet m_arrayIteratorProtocolWatchpoint;
+    InlineWatchpointSet m_arraySpeciesWatchpoint;
+    std::unique_ptr<ArrayIteratorAdaptiveWatchpoint> m_arrayPrototypeSymbolIteratorWatchpoint;
+    std::unique_ptr<ArrayIteratorAdaptiveWatchpoint> m_arrayIteratorPrototypeNext;
+
+    bool isArrayIteratorProtocolFastAndNonObservable();
+
+    TemplateRegistry m_templateRegistry;
+
+    bool m_evalEnabled;
+    String m_evalDisabledErrorMessage;
+    RuntimeFlags m_runtimeFlags;
+    ConsoleClient* m_consoleClient;
+
+    static JS_EXPORTDATA const GlobalObjectMethodTable s_globalObjectMethodTable;
+    const GlobalObjectMethodTable* m_globalObjectMethodTable;
+
+    void createRareDataIfNeeded()
+    {
+        if (m_rareData)
+            return;
+        m_rareData = std::make_unique<JSGlobalObjectRareData>();
+    }
+        
+public:
+    typedef JSSegmentedVariableObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesToThis;
+
+    static JSGlobalObject* create(VM& vm, Structure* structure)
+    {
+        JSGlobalObject* globalObject = new (NotNull, allocateCell<JSGlobalObject>(vm.heap)) JSGlobalObject(vm, structure);
+        globalObject->finishCreation(vm);
+        vm.heap.addFinalizer(globalObject, destroy);
+        return globalObject;
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    bool hasDebugger() const;
+    bool hasInteractiveDebugger() const;
+    const RuntimeFlags& runtimeFlags() const { return m_runtimeFlags; }
+
+protected:
+    JS_EXPORT_PRIVATE explicit JSGlobalObject(VM&, Structure*, const GlobalObjectMethodTable* = 0);
+
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        structure()->setGlobalObject(vm, this);
+        m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
+        init(vm);
+        setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, getPrototypeDirect(), PureForwardingProxyType), this));
+    }
+
+    void finishCreation(VM& vm, JSObject* thisValue)
+    {
+        Base::finishCreation(vm);
+        structure()->setGlobalObject(vm, this);
+        m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
+        init(vm);
+        setGlobalThis(vm, thisValue);
+    }
+
+    void addGlobalVar(const Identifier&);
+
+public:
+    JS_EXPORT_PRIVATE ~JSGlobalObject();
+    JS_EXPORT_PRIVATE static void destroy(JSCell*);
+    // We don't need a destructor because we use a finalizer instead.
+    static const bool needsDestruction = false;
+
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    JS_EXPORT_PRIVATE static void defineGetter(JSObject*, ExecState*, PropertyName, JSObject* getterFunc, unsigned attributes);
+    JS_EXPORT_PRIVATE static void defineSetter(JSObject*, ExecState*, PropertyName, JSObject* setterFunc, unsigned attributes);
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+    void addVar(ExecState* exec, const Identifier& propertyName)
+    {
+        if (!hasProperty(exec, propertyName))
+            addGlobalVar(propertyName);
+    }
+    void addFunction(ExecState*, const Identifier&);
+
+    JSScope* globalScope() { return m_globalLexicalEnvironment.get(); }
+    JSGlobalLexicalEnvironment* globalLexicalEnvironment() { return m_globalLexicalEnvironment.get(); }
+
+    JSScope* globalScopeExtension() { return m_globalScopeExtension.get(); }
+    void setGlobalScopeExtension(JSScope*);
+    void clearGlobalScopeExtension();
+
+    // The following accessors return pristine values, even if a script 
+    // replaces the global object's associated property.
+
+    GetterSetter* speciesGetterSetter() const { return m_speciesGetterSetter.get(); }
+
+    RegExpConstructor* regExpConstructor() const { return m_regExpConstructor.get(); }
+
+    ErrorConstructor* errorConstructor() const { return m_errorConstructor.get(); }
+    ArrayConstructor* arrayConstructor() const { return m_arrayConstructor.get(); }
+    ObjectConstructor* objectConstructor() const { return m_objectConstructor.get(); }
+    JSPromiseConstructor* promiseConstructor() const { return m_promiseConstructor.get(); }
+    JSInternalPromiseConstructor* internalPromiseConstructor() const { return m_internalPromiseConstructor.get(); }
+    NativeErrorConstructor* evalErrorConstructor() const { return m_evalErrorConstructor.get(this); }
+    NativeErrorConstructor* rangeErrorConstructor() const { return m_rangeErrorConstructor.get(); }
+    NativeErrorConstructor* referenceErrorConstructor() const { return m_referenceErrorConstructor.get(this); }
+    NativeErrorConstructor* syntaxErrorConstructor() const { return m_syntaxErrorConstructor.get(this); }
+    NativeErrorConstructor* typeErrorConstructor() const { return m_typeErrorConstructor.get(); }
+    NativeErrorConstructor* URIErrorConstructor() const { return m_URIErrorConstructor.get(this); }
+
+    NullGetterFunction* nullGetterFunction() const { return m_nullGetterFunction.get(); }
+    NullSetterFunction* nullSetterFunction() const { return m_nullSetterFunction.get(); }
+
+    JSFunction* parseIntFunction() const { return m_parseIntFunction.get(); }
+
+    JSFunction* evalFunction() const { return m_evalFunction.get(); }
+    JSFunction* callFunction() const { return m_callFunction.get(); }
+    JSFunction* applyFunction() const { return m_applyFunction.get(); }
+    JSFunction* throwTypeErrorFunction() const { return m_throwTypeErrorFunction.get(); }
+    JSFunction* arrayProtoToStringFunction() const { return m_arrayProtoToStringFunction.get(this); }
+    JSFunction* arrayProtoValuesFunction() const { return m_arrayProtoValuesFunction.get(this); }
+    JSFunction* initializePromiseFunction() const { return m_initializePromiseFunction.get(this); }
+    JSFunction* iteratorProtocolFunction() const { return m_iteratorProtocolFunction.get(this); }
+    JSFunction* newPromiseCapabilityFunction() const { return m_newPromiseCapabilityFunction.get(); }
+    JSFunction* functionProtoHasInstanceSymbolFunction() const { return m_functionProtoHasInstanceSymbolFunction.get(); }
+    JSObject* regExpProtoExecFunction() const { return m_regExpProtoExec.get(); }
+    JSObject* regExpProtoSymbolReplaceFunction() const { return m_regExpProtoSymbolReplace.get(); }
+    JSObject* regExpProtoGlobalGetter() const { return m_regExpProtoGlobalGetter.get(); }
+    JSObject* regExpProtoUnicodeGetter() const { return m_regExpProtoUnicodeGetter.get(); }
+    GetterSetter* throwTypeErrorArgumentsCalleeAndCallerGetterSetter()
+    {
+        return m_throwTypeErrorArgumentsCalleeAndCallerGetterSetter.get();
+    }
+    
+    JSModuleLoader* moduleLoader() const { return m_moduleLoader.get(); }
+
+    ObjectPrototype* objectPrototype() const { return m_objectPrototype.get(); }
+    FunctionPrototype* functionPrototype() const { return m_functionPrototype.get(); }
+    ArrayPrototype* arrayPrototype() const { return m_arrayPrototype.get(); }
+    JSObject* booleanPrototype() const { return m_booleanObjectStructure.prototype(this); }
+    StringPrototype* stringPrototype() const { return m_stringPrototype.get(); }
+    SymbolPrototype* symbolPrototype() const { return m_symbolPrototype.get(); }
+    JSObject* numberPrototype() const { return m_numberPrototype.get(); }
+    JSObject* datePrototype() const { return m_dateStructure.prototype(this); }
+    RegExpPrototype* regExpPrototype() const { return m_regExpPrototype.get(); }
+    ErrorPrototype* errorPrototype() const { return m_errorPrototype.get(); }
+    IteratorPrototype* iteratorPrototype() const { return m_iteratorPrototype.get(); }
+    GeneratorFunctionPrototype* generatorFunctionPrototype() const { return m_generatorFunctionPrototype.get(); }
+    GeneratorPrototype* generatorPrototype() const { return m_generatorPrototype.get(); }
+    AsyncFunctionPrototype* asyncFunctionPrototype() const { return m_asyncFunctionPrototype.get(); }
+
+    Structure* debuggerScopeStructure() const { return m_debuggerScopeStructure.get(this); }
+    Structure* withScopeStructure() const { return m_withScopeStructure.get(this); }
+    Structure* strictEvalActivationStructure() const { return m_strictEvalActivationStructure.get(); }
+    Structure* activationStructure() const { return m_lexicalEnvironmentStructure.get(); }
+    Structure* moduleEnvironmentStructure() const { return m_moduleEnvironmentStructure.get(this); }
+    Structure* directArgumentsStructure() const { return m_directArgumentsStructure.get(); }
+    Structure* scopedArgumentsStructure() const { return m_scopedArgumentsStructure.get(); }
+    Structure* clonedArgumentsStructure() const { return m_clonedArgumentsStructure.get(); }
+    Structure* objectStructureForObjectConstructor() const { return m_objectStructureForObjectConstructor.get(); }
+    Structure* originalArrayStructureForIndexingType(IndexingType indexingType) const
+    {
+        ASSERT(indexingType & IsArray);
+        return m_originalArrayStructureForIndexingShape[(indexingType & IndexingShapeMask) >> IndexingShapeShift].get();
+    }
+    Structure* arrayStructureForIndexingTypeDuringAllocation(IndexingType indexingType) const
+    {
+        ASSERT(indexingType & IsArray);
+        return m_arrayStructureForIndexingShapeDuringAllocation[(indexingType & IndexingShapeMask) >> IndexingShapeShift].get();
+    }
+    Structure* arrayStructureForIndexingTypeDuringAllocation(ExecState* exec, IndexingType indexingType, JSValue newTarget) const
+    {
+        return InternalFunction::createSubclassStructure(exec, newTarget, arrayStructureForIndexingTypeDuringAllocation(indexingType));
+    }
+    Structure* arrayStructureForProfileDuringAllocation(ExecState* exec, ArrayAllocationProfile* profile, JSValue newTarget) const
+    {
+        return arrayStructureForIndexingTypeDuringAllocation(exec, ArrayAllocationProfile::selectIndexingTypeFor(profile), newTarget);
+    }
+        
+    bool isOriginalArrayStructure(Structure* structure)
+    {
+        return originalArrayStructureForIndexingType(structure->indexingType() | IsArray) == structure;
+    }
+        
+    Structure* booleanObjectStructure() const { return m_booleanObjectStructure.get(this); }
+    Structure* callbackConstructorStructure() const { return m_callbackConstructorStructure.get(this); }
+    Structure* callbackFunctionStructure() const { return m_callbackFunctionStructure.get(this); }
+    Structure* callbackObjectStructure() const { return m_callbackObjectStructure.get(this); }
+    Structure* propertyNameIteratorStructure() const { return m_propertyNameIteratorStructure.get(); }
+#if JSC_OBJC_API_ENABLED
+    Structure* objcCallbackFunctionStructure() const { return m_objcCallbackFunctionStructure.get(this); }
+    Structure* objcWrapperObjectStructure() const { return m_objcWrapperObjectStructure.get(this); }
+#endif
+    Structure* dateStructure() const { return m_dateStructure.get(this); }
+    Structure* nullPrototypeObjectStructure() const { return m_nullPrototypeObjectStructure.get(this); }
+    Structure* errorStructure() const { return m_errorStructure.get(); }
+    Structure* calleeStructure() const { return m_calleeStructure.get(); }
+    Structure* functionStructure() const { return m_functionStructure.get(); }
+    Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(this); }
+    Structure* customGetterSetterFunctionStructure() const { return m_customGetterSetterFunctionStructure.get(this); }
+    Structure* getterSetterStructure() const { return m_getterSetterStructure.get(); }
+    Structure* nativeStdFunctionStructure() const { return m_nativeStdFunctionStructure.get(this); }
+    Structure* namedFunctionStructure() const { return m_namedFunctionStructure.get(this); }
+    PropertyOffset functionNameOffset() const { return m_functionNameOffset; }
+    Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }
+    Structure* privateNameStructure() const { return m_privateNameStructure.get(); }
+    Structure* mapStructure() const { return m_mapStructure.get(); }
+    Structure* regExpStructure() const { return m_regExpStructure.get(); }
+    Structure* generatorFunctionStructure() const { return m_generatorFunctionStructure.get(); }
+    Structure* asyncFunctionStructure() const { return m_asyncFunctionStructure.get(); }
+    Structure* setStructure() const { return m_setStructure.get(this); }
+    Structure* stringObjectStructure() const { return m_stringObjectStructure.get(); }
+    Structure* symbolObjectStructure() const { return m_symbolObjectStructure.get(); }
+    Structure* iteratorResultObjectStructure() const { return m_iteratorResultObjectStructure.get(); }
+    Structure* regExpMatchesArrayStructure() const { return m_regExpMatchesArrayStructure.get(); }
+    Structure* moduleRecordStructure() const { return m_moduleRecordStructure.get(); }
+    Structure* moduleNamespaceObjectStructure() const { return m_moduleNamespaceObjectStructure.get(); }
+    Structure* proxyObjectStructure() const { return m_proxyObjectStructure.get(); }
+    Structure* callableProxyObjectStructure() const { return m_callableProxyObjectStructure.get(); }
+    Structure* proxyRevokeStructure() const { return m_proxyRevokeStructure.get(); }
+    Structure* moduleLoaderStructure() const { return m_moduleLoaderStructure.get(); }
+    Structure* restParameterStructure() const { return arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous); }
+#if ENABLE(WEBASSEMBLY)
+    Structure* webAssemblyModuleRecordStructure() const { return m_webAssemblyModuleRecordStructure.get(); }
+    Structure* webAssemblyFunctionStructure() const { return m_webAssemblyFunctionStructure.get(); }
+#endif // ENABLE(WEBASSEMBLY)
+
+    JS_EXPORT_PRIVATE void setRemoteDebuggingEnabled(bool);
+    JS_EXPORT_PRIVATE bool remoteDebuggingEnabled() const;
+
+#if ENABLE(WEB_REPLAY)
+    JS_EXPORT_PRIVATE void setInputCursor(PassRefPtr<InputCursor>);
+    InputCursor& inputCursor() const { return *m_inputCursor; }
+#endif
+
+#if ENABLE(REMOTE_INSPECTOR)
+    Inspector::JSGlobalObjectInspectorController& inspectorController() const { return *m_inspectorController.get(); }
+    JSGlobalObjectDebuggable& inspectorDebuggable() { return *m_inspectorDebuggable.get(); }
+#endif
+
+#if ENABLE(INTL)
+    const HashSet<String>& intlCollatorAvailableLocales();
+    const HashSet<String>& intlDateTimeFormatAvailableLocales();
+    const HashSet<String>& intlNumberFormatAvailableLocales();
+#endif // ENABLE(INTL)
+
+    void setConsoleClient(ConsoleClient* consoleClient) { m_consoleClient = consoleClient; }
+    ConsoleClient* consoleClient() const { return m_consoleClient; }
+
+    void setName(const String&);
+    const String& name() const { return m_name; }
+
+    JSArrayBufferPrototype* arrayBufferPrototype(ArrayBufferSharingMode sharingMode) const
+    {
+        switch (sharingMode) {
+        case ArrayBufferSharingMode::Default:
+            return m_arrayBufferPrototype.get();
+        case ArrayBufferSharingMode::Shared:
+            return m_sharedArrayBufferPrototype.get();
+        }
+    }
+    Structure* arrayBufferStructure(ArrayBufferSharingMode sharingMode) const
+    {
+        switch (sharingMode) {
+        case ArrayBufferSharingMode::Default:
+            return m_arrayBufferStructure.get();
+        case ArrayBufferSharingMode::Shared:
+            return m_sharedArrayBufferStructure.get();
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+#define DEFINE_ACCESSORS_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    Structure* properName ## Structure() { return m_ ## properName ## Structure.get(); }
+
+    FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_ACCESSORS_FOR_SIMPLE_TYPE)
+    FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(DEFINE_ACCESSORS_FOR_SIMPLE_TYPE)
+
+#undef DEFINE_ACCESSORS_FOR_SIMPLE_TYPE
+
+#define DEFINE_ACCESSORS_FOR_ITERATOR_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    Structure* properName ## Structure() { return m_ ## properName ## Structure.get(this); }
+
+    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_ACCESSORS_FOR_ITERATOR_TYPE)
+
+#undef DEFINE_ACCESSORS_FOR_ITERATOR_TYPE
+
+#define DEFINE_ACCESSORS_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
+    Structure* properName ## Structure() { return m_ ## properName ## Structure.get(this); }
+
+    FOR_EACH_LAZY_BUILTIN_TYPE(DEFINE_ACCESSORS_FOR_LAZY_TYPE)
+
+#undef DEFINE_ACCESSORS_FOR_LAZY_TYPE
+
+    LazyClassStructure& lazyTypedArrayStructure(TypedArrayType type)
+    {
+        switch (type) {
+        case NotTypedArray:
+            RELEASE_ASSERT_NOT_REACHED();
+            return m_typedArrayInt8;
+#define TYPED_ARRAY_TYPE_CASE(name) case Type ## name: return m_typedArray ## name;
+            FOR_EACH_TYPED_ARRAY_TYPE(TYPED_ARRAY_TYPE_CASE)
+#undef TYPED_ARRAY_TYPE_CASE
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return m_typedArrayInt8;
+    }
+    const LazyClassStructure& lazyTypedArrayStructure(TypedArrayType type) const
+    {
+        return const_cast<const LazyClassStructure&>(const_cast<JSGlobalObject*>(this)->lazyTypedArrayStructure(type));
+    }
+    
+    Structure* typedArrayStructure(TypedArrayType type) const
+    {
+        return lazyTypedArrayStructure(type).get(this);
+    }
+    Structure* typedArrayStructureConcurrently(TypedArrayType type) const
+    {
+        return lazyTypedArrayStructure(type).getConcurrently();
+    }
+    bool isOriginalTypedArrayStructure(Structure* structure)
+    {
+        TypedArrayType type = structure->classInfo()->typedArrayStorageType;
+        if (type == NotTypedArray)
+            return false;
+        return typedArrayStructureConcurrently(type) == structure;
+    }
+
+    JSObject* typedArrayConstructor(TypedArrayType type) const
+    {
+        return lazyTypedArrayStructure(type).constructor(this);
+    }
+
+    JSCell* actualPointerFor(Special::Pointer pointer)
+    {
+        ASSERT(pointer < Special::TableSize);
+        return m_specialPointers[pointer];
+    }
+    JSCell* jsCellForLinkTimeConstant(LinkTimeConstant type)
+    {
+        unsigned index = static_cast<unsigned>(type);
+        ASSERT(index < LinkTimeConstantCount);
+        return m_linkTimeConstants[index];
+    }
+
+    WatchpointSet* masqueradesAsUndefinedWatchpoint() { return m_masqueradesAsUndefinedWatchpoint.get(); }
+    WatchpointSet* havingABadTimeWatchpoint() { return m_havingABadTimeWatchpoint.get(); }
+    WatchpointSet* varInjectionWatchpoint() { return m_varInjectionWatchpoint.get(); }
+        
+    bool isHavingABadTime() const
+    {
+        return m_havingABadTimeWatchpoint->hasBeenInvalidated();
+    }
+        
+    void haveABadTime(VM&);
+        
+    bool objectPrototypeIsSane();
+    bool arrayPrototypeChainIsSane();
+    bool stringPrototypeChainIsSane();
+
+    void setProfileGroup(unsigned value) { createRareDataIfNeeded(); m_rareData->profileGroup = value; }
+    unsigned profileGroup() const
+    { 
+        if (!m_rareData)
+            return 0;
+        return m_rareData->profileGroup;
+    }
+
+    Debugger* debugger() const { return m_debugger; }
+    void setDebugger(Debugger* debugger) { m_debugger = debugger; }
+
+    const GlobalObjectMethodTable* globalObjectMethodTable() const { return m_globalObjectMethodTable; }
+
+    static bool supportsRichSourceInfo(const JSGlobalObject*) { return true; }
+
+    JS_EXPORT_PRIVATE ExecState* globalExec();
+
+    static bool shouldInterruptScript(const JSGlobalObject*) { return true; }
+    static bool shouldInterruptScriptBeforeTimeout(const JSGlobalObject*) { return false; }
+    static RuntimeFlags javaScriptRuntimeFlags(const JSGlobalObject*) { return RuntimeFlags(); }
+
+    void queueMicrotask(Ref<Microtask>&&);
+
+    bool evalEnabled() const { return m_evalEnabled; }
+    const String& evalDisabledErrorMessage() const { return m_evalDisabledErrorMessage; }
+    void setEvalEnabled(bool enabled, const String& errorMessage = String())
+    {
+        m_evalEnabled = enabled;
+        m_evalDisabledErrorMessage = errorMessage;
+    }
+
+    void resetPrototype(VM&, JSValue prototype);
+
+    VM& vm() const { return m_vm; }
+    JSObject* globalThis() const;
+
+    static Structure* createStructure(VM& vm, JSValue prototype)
+    {
+        Structure* result = Structure::create(vm, 0, prototype, TypeInfo(GlobalObjectType, StructureFlags), info());
+        result->setTransitionWatchpointIsLikelyToBeFired(true);
+        return result;
+    }
+
+    void registerWeakMap(OpaqueJSWeakObjectMap* map)
+    {
+        createRareDataIfNeeded();
+        m_rareData->weakMaps.add(map);
+    }
+
+    void unregisterWeakMap(OpaqueJSWeakObjectMap* map)
+    {
+        if (m_rareData)
+            m_rareData->weakMaps.remove(map);
+    }
+
+    OpaqueJSClassDataMap& opaqueJSClassData()
+    {
+        createRareDataIfNeeded();
+        return m_rareData->opaqueJSClassData;
+    }
+
+    TemplateRegistry& templateRegistry() { return m_templateRegistry; }
+
+    static ptrdiff_t weakRandomOffset() { return OBJECT_OFFSETOF(JSGlobalObject, m_weakRandom); }
+    double weakRandomNumber() { return m_weakRandom.get(); }
+    unsigned weakRandomInteger() { return m_weakRandom.getUint32(); }
+    WeakRandom& weakRandom() { return m_weakRandom; }
+
+    bool needsSiteSpecificQuirks() const { return m_needsSiteSpecificQuirks; }
+
+protected:
+    struct GlobalPropertyInfo {
+        GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
+            : identifier(i)
+            , value(v)
+            , attributes(a)
+        {
+        }
+
+        const Identifier identifier;
+        JSValue value;
+        unsigned attributes;
+    };
+    JS_EXPORT_PRIVATE void addStaticGlobals(GlobalPropertyInfo*, int count);
+
+    JS_EXPORT_PRIVATE static JSC::JSValue toThis(JSC::JSCell*, JSC::ExecState*, ECMAMode);
+
+    void setNeedsSiteSpecificQuirks(bool needQuirks) { m_needsSiteSpecificQuirks = needQuirks; }
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    JS_EXPORT_PRIVATE void setGlobalThis(VM&, JSObject* globalThis);
+
+    JS_EXPORT_PRIVATE void init(VM&);
+
+    JS_EXPORT_PRIVATE static void clearRareData(JSCell*);
+
+    bool m_needsSiteSpecificQuirks { false };
+};
+
+JSGlobalObject* asGlobalObject(JSValue);
+
+inline JSGlobalObject* asGlobalObject(JSValue value)
+{
+    ASSERT(asObject(value)->isGlobalObject());
+    return jsCast<JSGlobalObject*>(asObject(value));
+}
+
+inline JSArray* constructEmptyArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, unsigned initialLength = 0, JSValue newTarget = JSValue())
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Structure* structure;
+    if (initialLength >= MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)
+        structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(exec, ArrayWithArrayStorage, newTarget);
+    else
+        structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, JSArray::create(exec->vm(), structure, initialLength));
+}
+
+inline JSArray* constructEmptyArray(ExecState* exec, ArrayAllocationProfile* profile, unsigned initialLength = 0, JSValue newTarget = JSValue())
+{
+    return constructEmptyArray(exec, profile, exec->lexicalGlobalObject(), initialLength, newTarget);
+}
+ 
+inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const ArgList& values, JSValue newTarget = JSValue())
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Structure* structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, structure, values));
+}
+
+inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, const ArgList& values, JSValue newTarget = JSValue())
+{
+    return constructArray(exec, profile, exec->lexicalGlobalObject(), values, newTarget);
+}
+
+inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Structure* structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, structure, values, length));
+}
+
+inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
+{
+    return constructArray(exec, profile, exec->lexicalGlobalObject(), values, length, newTarget);
+}
+
+inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Structure* structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArrayNegativeIndexed(exec, structure, values, length));
+}
+
+inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
+{
+    return constructArrayNegativeIndexed(exec, profile, exec->lexicalGlobalObject(), values, length, newTarget);
+}
+
+inline JSObject* ExecState::globalThisValue() const
+{
+    return lexicalGlobalObject()->globalThis();
+}
+
+inline JSObject* JSScope::globalThis()
+{ 
+    return globalObject()->globalThis();
+}
+
+inline JSObject* JSGlobalObject::globalThis() const
+{ 
+    return m_globalThis.get();
+}
+
+} // namespace JSC
diff --git a/runtime/JSGlobalObjectDebuggable.cpp b/runtime/JSGlobalObjectDebuggable.cpp
new file mode 100644
index 0000000..94b964d
--- /dev/null
+++ b/runtime/JSGlobalObjectDebuggable.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSGlobalObjectDebuggable.h"
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#include "InspectorAgentBase.h"
+#include "InspectorFrontendChannel.h"
+#include "JSGlobalObject.h"
+#include "JSLock.h"
+#include "RemoteInspector.h"
+
+using namespace Inspector;
+
+namespace JSC {
+
+JSGlobalObjectDebuggable::JSGlobalObjectDebuggable(JSGlobalObject& globalObject)
+    : m_globalObject(globalObject)
+{
+}
+
+String JSGlobalObjectDebuggable::name() const
+{
+    String name = m_globalObject.name();
+    return name.isEmpty() ? ASCIILiteral("JSContext") : name;
+}
+
+void JSGlobalObjectDebuggable::connect(FrontendChannel* frontendChannel, bool automaticInspection)
+{
+    JSLockHolder locker(&m_globalObject.vm());
+
+    m_globalObject.inspectorController().connectFrontend(frontendChannel, automaticInspection);
+}
+
+void JSGlobalObjectDebuggable::disconnect(FrontendChannel* frontendChannel)
+{
+    JSLockHolder locker(&m_globalObject.vm());
+
+    m_globalObject.inspectorController().disconnectFrontend(frontendChannel);
+}
+
+void JSGlobalObjectDebuggable::pause()
+{
+    JSLockHolder locker(&m_globalObject.vm());
+
+    m_globalObject.inspectorController().pause();
+}
+
+void JSGlobalObjectDebuggable::dispatchMessageFromRemote(const String& message)
+{
+    JSLockHolder locker(&m_globalObject.vm());
+
+    m_globalObject.inspectorController().dispatchMessageFromFrontend(message);
+}
+
+void JSGlobalObjectDebuggable::pauseWaitingForAutomaticInspection()
+{
+    JSC::JSLock::DropAllLocks dropAllLocks(&m_globalObject.vm());
+    RemoteInspectionTarget::pauseWaitingForAutomaticInspection();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/runtime/JSGlobalObjectDebuggable.h b/runtime/JSGlobalObjectDebuggable.h
new file mode 100644
index 0000000..7933ee0
--- /dev/null
+++ b/runtime/JSGlobalObjectDebuggable.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(REMOTE_INSPECTOR)
+
+#include "JSGlobalObjectInspectorController.h"
+#include "RemoteInspectionTarget.h"
+#include <wtf/Noncopyable.h>
+
+namespace Inspector {
+class FrontendChannel;
+enum class DisconnectReason;
+}
+
+namespace JSC {
+
+class JSGlobalObject;
+
+class JSGlobalObjectDebuggable final : public Inspector::RemoteInspectionTarget {
+    WTF_MAKE_FAST_ALLOCATED;
+    WTF_MAKE_NONCOPYABLE(JSGlobalObjectDebuggable);
+public:
+    JSGlobalObjectDebuggable(JSGlobalObject&);
+    ~JSGlobalObjectDebuggable() { }
+
+    Inspector::RemoteControllableTarget::Type type() const override { return Inspector::RemoteControllableTarget::Type::JavaScript; }
+
+    String name() const override;
+    bool hasLocalDebugger() const override { return false; }
+
+    void connect(Inspector::FrontendChannel*, bool automaticInspection) override;
+    void disconnect(Inspector::FrontendChannel*) override;
+    void dispatchMessageFromRemote(const String& message) override;
+    void pause() override;
+
+    bool automaticInspectionAllowed() const override { return true; }
+    void pauseWaitingForAutomaticInspection() override;
+
+private:
+    JSGlobalObject& m_globalObject;
+};
+
+} // namespace JSC
+
+SPECIALIZE_TYPE_TRAITS_CONTROLLABLE_TARGET(JSC::JSGlobalObjectDebuggable, JavaScript);
+
+#endif // ENABLE(REMOTE_INSPECTOR)
diff --git a/runtime/JSGlobalObjectFunctions.cpp b/runtime/JSGlobalObjectFunctions.cpp
new file mode 100644
index 0000000..5ce0903
--- /dev/null
+++ b/runtime/JSGlobalObjectFunctions.cpp
@@ -0,0 +1,927 @@
+/*
+ *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2009, 2012, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2007 Maks Orlovich
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSGlobalObjectFunctions.h"
+
+#include "CallFrame.h"
+#include "EvalExecutable.h"
+#include "IndirectEvalExecutable.h"
+#include "Interpreter.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "JSStringBuilder.h"
+#include "Lexer.h"
+#include "LiteralParser.h"
+#include "Nodes.h"
+#include "JSCInlines.h"
+#include "Parser.h"
+#include "StackVisitor.h"
+#include <wtf/dtoa.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/Assertions.h>
+#include <wtf/HexNumber.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/unicode/UTF8.h>
+
+using namespace WTF;
+using namespace Unicode;
+
+namespace JSC {
+
+static const char* const ObjectProtoCalledOnNullOrUndefinedError = "Object.prototype.__proto__ called on null or undefined";
+
+template<typename CallbackWhenNoException>
+static ALWAYS_INLINE typename std::result_of<CallbackWhenNoException(StringView)>::type toStringView(ExecState* exec, JSValue value, CallbackWhenNoException callback)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSString* string = value.toStringOrNull(exec);
+    if (UNLIKELY(!string))
+        return { };
+    auto viewWithString = string->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, { });
+    return callback(viewWithString.view);
+}
+
+template<unsigned charactersCount>
+static Bitmap<256> makeCharacterBitmap(const char (&characters)[charactersCount])
+{
+    static_assert(charactersCount > 0, "Since string literal is null terminated, characterCount is always larger than 0");
+    Bitmap<256> bitmap;
+    for (unsigned i = 0; i < charactersCount - 1; ++i)
+        bitmap.set(characters[i]);
+    return bitmap;
+}
+
+template<typename CharacterType>
+static JSValue encode(ExecState* exec, const Bitmap<256>& doNotEscape, const CharacterType* characters, unsigned length)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 18.2.6.1.1 Runtime Semantics: Encode ( string, unescapedSet )
+    // https://tc39.github.io/ecma262/#sec-encode
+
+    auto throwException = [&scope, exec] {
+        return JSC::throwException(exec, scope, createURIError(exec, ASCIILiteral("String contained an illegal UTF-16 sequence.")));
+    };
+
+    StringBuilder builder;
+    builder.reserveCapacity(length);
+
+    // 4. Repeat
+    auto* end = characters + length;
+    for (auto* cursor = characters; cursor != end; ++cursor) {
+        auto character = *cursor;
+
+        // 4-c. If C is in unescapedSet, then
+        if (character < doNotEscape.size() && doNotEscape.get(character)) {
+            // 4-c-i. Let S be a String containing only the code unit C.
+            // 4-c-ii. Let R be a new String value computed by concatenating the previous value of R and S.
+            builder.append(static_cast<LChar>(character));
+            continue;
+        }
+
+        // 4-d-i. If the code unit value of C is not less than 0xDC00 and not greater than 0xDFFF, throw a URIError exception.
+        if (U16_IS_TRAIL(character))
+            return throwException();
+
+        // 4-d-ii. If the code unit value of C is less than 0xD800 or greater than 0xDBFF, then
+        // 4-d-ii-1. Let V be the code unit value of C.
+        UChar32 codePoint;
+        if (!U16_IS_LEAD(character))
+            codePoint = character;
+        else {
+            // 4-d-iii. Else,
+            // 4-d-iii-1. Increase k by 1.
+            ++cursor;
+
+            // 4-d-iii-2. If k equals strLen, throw a URIError exception.
+            if (cursor == end)
+                return throwException();
+
+            // 4-d-iii-3. Let kChar be the code unit value of the code unit at index k within string.
+            auto trail = *cursor;
+
+            // 4-d-iii-4. If kChar is less than 0xDC00 or greater than 0xDFFF, throw a URIError exception.
+            if (!U16_IS_TRAIL(trail))
+                return throwException();
+
+            // 4-d-iii-5. Let V be UTF16Decode(C, kChar).
+            codePoint = U16_GET_SUPPLEMENTARY(character, trail);
+        }
+
+        // 4-d-iv. Let Octets be the array of octets resulting by applying the UTF-8 transformation to V, and let L be the array size.
+        LChar utf8OctetsBuffer[U8_MAX_LENGTH];
+        unsigned utf8Length = 0;
+        // We can use U8_APPEND_UNSAFE here since codePoint is either
+        // 1. non surrogate one, correct code point.
+        // 2. correct code point generated from validated lead and trail surrogates.
+        U8_APPEND_UNSAFE(utf8OctetsBuffer, utf8Length, codePoint);
+
+        // 4-d-v. Let j be 0.
+        // 4-d-vi. Repeat, while j < L
+        for (unsigned index = 0; index < utf8Length; ++index) {
+            // 4-d-vi-1. Let jOctet be the value at index j within Octets.
+            // 4-d-vi-2. Let S be a String containing three code units "%XY" where XY are two uppercase hexadecimal digits encoding the value of jOctet.
+            // 4-d-vi-3. Let R be a new String value computed by concatenating the previous value of R and S.
+            builder.append(static_cast<LChar>('%'));
+            appendByteAsHex(utf8OctetsBuffer[index], builder);
+        }
+    }
+
+    return jsString(exec, builder.toString());
+}
+
+static JSValue encode(ExecState* exec, const Bitmap<256>& doNotEscape)
+{
+    return toStringView(exec, exec->argument(0), [&] (StringView view) {
+        if (view.is8Bit())
+            return encode(exec, doNotEscape, view.characters8(), view.length());
+        return encode(exec, doNotEscape, view.characters16(), view.length());
+    });
+}
+
+template <typename CharType>
+ALWAYS_INLINE
+static JSValue decode(ExecState* exec, const CharType* characters, int length, const Bitmap<256>& doNotUnescape, bool strict)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSStringBuilder builder;
+    int k = 0;
+    UChar u = 0;
+    while (k < length) {
+        const CharType* p = characters + k;
+        CharType c = *p;
+        if (c == '%') {
+            int charLen = 0;
+            if (k <= length - 3 && isASCIIHexDigit(p[1]) && isASCIIHexDigit(p[2])) {
+                const char b0 = Lexer<CharType>::convertHex(p[1], p[2]);
+                const int sequenceLen = UTF8SequenceLength(b0);
+                if (sequenceLen && k <= length - sequenceLen * 3) {
+                    charLen = sequenceLen * 3;
+                    char sequence[5];
+                    sequence[0] = b0;
+                    for (int i = 1; i < sequenceLen; ++i) {
+                        const CharType* q = p + i * 3;
+                        if (q[0] == '%' && isASCIIHexDigit(q[1]) && isASCIIHexDigit(q[2]))
+                            sequence[i] = Lexer<CharType>::convertHex(q[1], q[2]);
+                        else {
+                            charLen = 0;
+                            break;
+                        }
+                    }
+                    if (charLen != 0) {
+                        sequence[sequenceLen] = 0;
+                        const int character = decodeUTF8Sequence(sequence);
+                        if (character < 0 || character >= 0x110000)
+                            charLen = 0;
+                        else if (character >= 0x10000) {
+                            // Convert to surrogate pair.
+                            builder.append(static_cast<UChar>(0xD800 | ((character - 0x10000) >> 10)));
+                            u = static_cast<UChar>(0xDC00 | ((character - 0x10000) & 0x3FF));
+                        } else
+                            u = static_cast<UChar>(character);
+                    }
+                }
+            }
+            if (charLen == 0) {
+                if (strict)
+                    return throwException(exec, scope, createURIError(exec, ASCIILiteral("URI error")));
+                // The only case where we don't use "strict" mode is the "unescape" function.
+                // For that, it's good to support the wonky "%u" syntax for compatibility with WinIE.
+                if (k <= length - 6 && p[1] == 'u'
+                        && isASCIIHexDigit(p[2]) && isASCIIHexDigit(p[3])
+                        && isASCIIHexDigit(p[4]) && isASCIIHexDigit(p[5])) {
+                    charLen = 6;
+                    u = Lexer<UChar>::convertUnicode(p[2], p[3], p[4], p[5]);
+                }
+            }
+            if (charLen && (u >= 128 || !doNotUnescape.get(static_cast<LChar>(u)))) {
+                builder.append(u);
+                k += charLen;
+                continue;
+            }
+        }
+        k++;
+        builder.append(c);
+    }
+    return builder.build(exec);
+}
+
+static JSValue decode(ExecState* exec, const Bitmap<256>& doNotUnescape, bool strict)
+{
+    return toStringView(exec, exec->argument(0), [&] (StringView view) {
+        if (view.is8Bit())
+            return decode(exec, view.characters8(), view.length(), doNotUnescape, strict);
+        return decode(exec, view.characters16(), view.length(), doNotUnescape, strict);
+    });
+}
+
+bool isStrWhiteSpace(UChar c)
+{
+    switch (c) {
+        // ECMA-262-5th 7.2 & 7.3
+        case 0x0009:
+        case 0x000A:
+        case 0x000B:
+        case 0x000C:
+        case 0x000D:
+        case 0x0020:
+        case 0x00A0:
+        case 0x180E: // This character used to be in Zs category before Unicode 6.3, and EcmaScript says that we should keep treating it as such.
+        case 0x2028:
+        case 0x2029:
+        case 0xFEFF:
+            return true;
+        default:
+            return c > 0xFF && u_charType(c) == U_SPACE_SEPARATOR;
+    }
+}
+
+static int parseDigit(unsigned short c, int radix)
+{
+    int digit = -1;
+
+    if (isASCIIDigit(c))
+        digit = c - '0';
+    else if (isASCIIUpper(c))
+        digit = c - 'A' + 10;
+    else if (isASCIILower(c))
+        digit = c - 'a' + 10;
+
+    if (digit >= radix)
+        return -1;
+    return digit;
+}
+
+double parseIntOverflow(const LChar* s, unsigned length, int radix)
+{
+    double number = 0.0;
+    double radixMultiplier = 1.0;
+
+    for (const LChar* p = s + length - 1; p >= s; p--) {
+        if (radixMultiplier == std::numeric_limits<double>::infinity()) {
+            if (*p != '0') {
+                number = std::numeric_limits<double>::infinity();
+                break;
+            }
+        } else {
+            int digit = parseDigit(*p, radix);
+            number += digit * radixMultiplier;
+        }
+
+        radixMultiplier *= radix;
+    }
+
+    return number;
+}
+
+static double parseIntOverflow(const UChar* s, unsigned length, int radix)
+{
+    double number = 0.0;
+    double radixMultiplier = 1.0;
+
+    for (const UChar* p = s + length - 1; p >= s; p--) {
+        if (radixMultiplier == std::numeric_limits<double>::infinity()) {
+            if (*p != '0') {
+                number = std::numeric_limits<double>::infinity();
+                break;
+            }
+        } else {
+            int digit = parseDigit(*p, radix);
+            number += digit * radixMultiplier;
+        }
+
+        radixMultiplier *= radix;
+    }
+
+    return number;
+}
+
+static double parseIntOverflow(StringView string, int radix)
+{
+    if (string.is8Bit())
+        return parseIntOverflow(string.characters8(), string.length(), radix);
+    return parseIntOverflow(string.characters16(), string.length(), radix);
+}
+
+// ES5.1 15.1.2.2
+template <typename CharType>
+ALWAYS_INLINE
+static double parseInt(StringView s, const CharType* data, int radix)
+{
+    // 1. Let inputString be ToString(string).
+    // 2. Let S be a newly created substring of inputString consisting of the first character that is not a
+    //    StrWhiteSpaceChar and all characters following that character. (In other words, remove leading white
+    //    space.) If inputString does not contain any such characters, let S be the empty string.
+    int length = s.length();
+    int p = 0;
+    while (p < length && isStrWhiteSpace(data[p]))
+        ++p;
+
+    // 3. Let sign be 1.
+    // 4. If S is not empty and the first character of S is a minus sign -, let sign be -1.
+    // 5. If S is not empty and the first character of S is a plus sign + or a minus sign -, then remove the first character from S.
+    double sign = 1;
+    if (p < length) {
+        if (data[p] == '+')
+            ++p;
+        else if (data[p] == '-') {
+            sign = -1;
+            ++p;
+        }
+    }
+
+    // 6. Let R = ToInt32(radix).
+    // 7. Let stripPrefix be true.
+    // 8. If R != 0,then
+    //   b. If R != 16, let stripPrefix be false.
+    // 9. Else, R == 0
+    //   a. LetR = 10.
+    // 10. If stripPrefix is true, then
+    //   a. If the length of S is at least 2 and the first two characters of S are either ―0x or ―0X,
+    //      then remove the first two characters from S and let R = 16.
+    // 11. If S contains any character that is not a radix-R digit, then let Z be the substring of S
+    //     consisting of all characters before the first such character; otherwise, let Z be S.
+    if ((radix == 0 || radix == 16) && length - p >= 2 && data[p] == '0' && (data[p + 1] == 'x' || data[p + 1] == 'X')) {
+        radix = 16;
+        p += 2;
+    } else if (radix == 0)
+        radix = 10;
+
+    // 8.a If R < 2 or R > 36, then return NaN.
+    if (radix < 2 || radix > 36)
+        return PNaN;
+
+    // 13. Let mathInt be the mathematical integer value that is represented by Z in radix-R notation, using the letters
+    //     A-Z and a-z for digits with values 10 through 35. (However, if R is 10 and Z contains more than 20 significant
+    //     digits, every significant digit after the 20th may be replaced by a 0 digit, at the option of the implementation;
+    //     and if R is not 2, 4, 8, 10, 16, or 32, then mathInt may be an implementation-dependent approximation to the
+    //     mathematical integer value that is represented by Z in radix-R notation.)
+    // 14. Let number be the Number value for mathInt.
+    int firstDigitPosition = p;
+    bool sawDigit = false;
+    double number = 0;
+    while (p < length) {
+        int digit = parseDigit(data[p], radix);
+        if (digit == -1)
+            break;
+        sawDigit = true;
+        number *= radix;
+        number += digit;
+        ++p;
+    }
+
+    // 12. If Z is empty, return NaN.
+    if (!sawDigit)
+        return PNaN;
+
+    // Alternate code path for certain large numbers.
+    if (number >= mantissaOverflowLowerBound) {
+        if (radix == 10) {
+            size_t parsedLength;
+            number = parseDouble(s.substring(firstDigitPosition, p - firstDigitPosition), parsedLength);
+        } else if (radix == 2 || radix == 4 || radix == 8 || radix == 16 || radix == 32)
+            number = parseIntOverflow(s.substring(firstDigitPosition, p - firstDigitPosition), radix);
+    }
+
+    // 15. Return sign x number.
+    return sign * number;
+}
+
+static double parseInt(StringView s, int radix)
+{
+    if (s.is8Bit())
+        return parseInt(s, s.characters8(), radix);
+    return parseInt(s, s.characters16(), radix);
+}
+
+static const int SizeOfInfinity = 8;
+
+template <typename CharType>
+static bool isInfinity(const CharType* data, const CharType* end)
+{
+    return (end - data) >= SizeOfInfinity
+        && data[0] == 'I'
+        && data[1] == 'n'
+        && data[2] == 'f'
+        && data[3] == 'i'
+        && data[4] == 'n'
+        && data[5] == 'i'
+        && data[6] == 't'
+        && data[7] == 'y';
+}
+
+// See ecma-262 6th 11.8.3
+template <typename CharType>
+static double jsBinaryIntegerLiteral(const CharType*& data, const CharType* end)
+{
+    // Binary number.
+    data += 2;
+    const CharType* firstDigitPosition = data;
+    double number = 0;
+    while (true) {
+        number = number * 2 + (*data - '0');
+        ++data;
+        if (data == end)
+            break;
+        if (!isASCIIBinaryDigit(*data))
+            break;
+    }
+    if (number >= mantissaOverflowLowerBound)
+        number = parseIntOverflow(firstDigitPosition, data - firstDigitPosition, 2);
+
+    return number;
+}
+
+// See ecma-262 6th 11.8.3
+template <typename CharType>
+static double jsOctalIntegerLiteral(const CharType*& data, const CharType* end)
+{
+    // Octal number.
+    data += 2;
+    const CharType* firstDigitPosition = data;
+    double number = 0;
+    while (true) {
+        number = number * 8 + (*data - '0');
+        ++data;
+        if (data == end)
+            break;
+        if (!isASCIIOctalDigit(*data))
+            break;
+    }
+    if (number >= mantissaOverflowLowerBound)
+        number = parseIntOverflow(firstDigitPosition, data - firstDigitPosition, 8);
+    
+    return number;
+}
+
+// See ecma-262 6th 11.8.3
+template <typename CharType>
+static double jsHexIntegerLiteral(const CharType*& data, const CharType* end)
+{
+    // Hex number.
+    data += 2;
+    const CharType* firstDigitPosition = data;
+    double number = 0;
+    while (true) {
+        number = number * 16 + toASCIIHexValue(*data);
+        ++data;
+        if (data == end)
+            break;
+        if (!isASCIIHexDigit(*data))
+            break;
+    }
+    if (number >= mantissaOverflowLowerBound)
+        number = parseIntOverflow(firstDigitPosition, data - firstDigitPosition, 16);
+
+    return number;
+}
+
+// See ecma-262 6th 11.8.3
+template <typename CharType>
+static double jsStrDecimalLiteral(const CharType*& data, const CharType* end)
+{
+    RELEASE_ASSERT(data < end);
+
+    size_t parsedLength;
+    double number = parseDouble(data, end - data, parsedLength);
+    if (parsedLength) {
+        data += parsedLength;
+        return number;
+    }
+
+    // Check for [+-]?Infinity
+    switch (*data) {
+    case 'I':
+        if (isInfinity(data, end)) {
+            data += SizeOfInfinity;
+            return std::numeric_limits<double>::infinity();
+        }
+        break;
+
+    case '+':
+        if (isInfinity(data + 1, end)) {
+            data += SizeOfInfinity + 1;
+            return std::numeric_limits<double>::infinity();
+        }
+        break;
+
+    case '-':
+        if (isInfinity(data + 1, end)) {
+            data += SizeOfInfinity + 1;
+            return -std::numeric_limits<double>::infinity();
+        }
+        break;
+    }
+
+    // Not a number.
+    return PNaN;
+}
+
+template <typename CharType>
+static double toDouble(const CharType* characters, unsigned size)
+{
+    const CharType* endCharacters = characters + size;
+
+    // Skip leading white space.
+    for (; characters < endCharacters; ++characters) {
+        if (!isStrWhiteSpace(*characters))
+            break;
+    }
+    
+    // Empty string.
+    if (characters == endCharacters)
+        return 0.0;
+    
+    double number;
+    if (characters[0] == '0' && characters + 2 < endCharacters) {
+        if ((characters[1] | 0x20) == 'x' && isASCIIHexDigit(characters[2]))
+            number = jsHexIntegerLiteral(characters, endCharacters);
+        else if ((characters[1] | 0x20) == 'o' && isASCIIOctalDigit(characters[2]))
+            number = jsOctalIntegerLiteral(characters, endCharacters);
+        else if ((characters[1] | 0x20) == 'b' && isASCIIBinaryDigit(characters[2]))
+            number = jsBinaryIntegerLiteral(characters, endCharacters);
+        else
+            number = jsStrDecimalLiteral(characters, endCharacters);
+    } else
+        number = jsStrDecimalLiteral(characters, endCharacters);
+    
+    // Allow trailing white space.
+    for (; characters < endCharacters; ++characters) {
+        if (!isStrWhiteSpace(*characters))
+            break;
+    }
+    if (characters != endCharacters)
+        return PNaN;
+    
+    return number;
+}
+
+// See ecma-262 6th 11.8.3
+double jsToNumber(StringView s)
+{
+    unsigned size = s.length();
+
+    if (size == 1) {
+        UChar c = s[0];
+        if (isASCIIDigit(c))
+            return c - '0';
+        if (isStrWhiteSpace(c))
+            return 0;
+        return PNaN;
+    }
+
+    if (s.is8Bit())
+        return toDouble(s.characters8(), size);
+    return toDouble(s.characters16(), size);
+}
+
+static double parseFloat(StringView s)
+{
+    unsigned size = s.length();
+
+    if (size == 1) {
+        UChar c = s[0];
+        if (isASCIIDigit(c))
+            return c - '0';
+        return PNaN;
+    }
+
+    if (s.is8Bit()) {
+        const LChar* data = s.characters8();
+        const LChar* end = data + size;
+
+        // Skip leading white space.
+        for (; data < end; ++data) {
+            if (!isStrWhiteSpace(*data))
+                break;
+        }
+
+        // Empty string.
+        if (data == end)
+            return PNaN;
+
+        return jsStrDecimalLiteral(data, end);
+    }
+
+    const UChar* data = s.characters16();
+    const UChar* end = data + size;
+
+    // Skip leading white space.
+    for (; data < end; ++data) {
+        if (!isStrWhiteSpace(*data))
+            break;
+    }
+
+    // Empty string.
+    if (data == end)
+        return PNaN;
+
+    return jsStrDecimalLiteral(data, end);
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue x = exec->argument(0);
+    if (!x.isString())
+        return JSValue::encode(x);
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    if (!globalObject->evalEnabled()) {
+        throwException(exec, scope, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
+        return JSValue::encode(jsUndefined());
+    }
+
+    String s = asString(x)->value(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (s.is8Bit()) {
+        LiteralParser<LChar> preparser(exec, s.characters8(), s.length(), NonStrictJSON);
+        if (JSValue parsedObject = preparser.tryLiteralParse())
+            return JSValue::encode(parsedObject);
+    } else {
+        LiteralParser<UChar> preparser(exec, s.characters16(), s.length(), NonStrictJSON);
+        if (JSValue parsedObject = preparser.tryLiteralParse())
+            return JSValue::encode(parsedObject);        
+    }
+
+    JSGlobalObject* calleeGlobalObject = exec->jsCallee()->globalObject();
+    EvalExecutable* eval = IndirectEvalExecutable::create(exec, makeSource(s), false, DerivedContextType::None, false, EvalContextType::None);
+    if (!eval)
+        return JSValue::encode(jsUndefined());
+
+    return JSValue::encode(exec->interpreter()->execute(eval, exec, calleeGlobalObject->globalThis(), calleeGlobalObject->globalScope()));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
+{
+    JSValue value = exec->argument(0);
+    JSValue radixValue = exec->argument(1);
+
+    // Optimized handling for numbers:
+    // If the argument is 0 or a number in range 10^-6 <= n < INT_MAX+1, then parseInt
+    // results in a truncation to integer. In the case of -0, this is converted to 0.
+    //
+    // This is also a truncation for values in the range INT_MAX+1 <= n < 10^21,
+    // however these values cannot be trivially truncated to int since 10^21 exceeds
+    // even the int64_t range. Negative numbers are a little trickier, the case for
+    // values in the range -10^21 < n <= -1 are similar to those for integer, but
+    // values in the range -1 < n <= -10^-6 need to truncate to -0, not 0.
+    static const double tenToTheMinus6 = 0.000001;
+    static const double intMaxPlusOne = 2147483648.0;
+    if (value.isNumber()) {
+        double n = value.asNumber();
+        if (((n < intMaxPlusOne && n >= tenToTheMinus6) || !n) && radixValue.isUndefinedOrNull())
+            return JSValue::encode(jsNumber(static_cast<int32_t>(n)));
+    }
+
+    // If ToString throws, we shouldn't call ToInt32.
+    return toStringView(exec, value, [&] (StringView view) {
+        return JSValue::encode(jsNumber(parseInt(view, radixValue.toInt32(exec))));
+    });
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncParseFloat(ExecState* exec)
+{
+    auto viewWithString = exec->argument(0).toString(exec)->viewWithUnderlyingString(*exec);
+    return JSValue::encode(jsNumber(parseFloat(viewWithString.view)));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState* exec)
+{
+    static Bitmap<256> doNotUnescapeWhenDecodingURI = makeCharacterBitmap(
+        "#$&+,/:;=?@"
+    );
+
+    return JSValue::encode(decode(exec, doNotUnescapeWhenDecodingURI, true));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState* exec)
+{
+    static Bitmap<256> emptyBitmap;
+    return JSValue::encode(decode(exec, emptyBitmap, true));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState* exec)
+{
+    static Bitmap<256> doNotEscapeWhenEncodingURI = makeCharacterBitmap(
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+        "abcdefghijklmnopqrstuvwxyz"
+        "0123456789"
+        "!#$&'()*+,-./:;=?@_~"
+    );
+
+    return JSValue::encode(encode(exec, doNotEscapeWhenEncodingURI));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncEncodeURIComponent(ExecState* exec)
+{
+    static Bitmap<256> doNotEscapeWhenEncodingURIComponent = makeCharacterBitmap(
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+        "abcdefghijklmnopqrstuvwxyz"
+        "0123456789"
+        "!'()*-._~"
+    );
+
+    return JSValue::encode(encode(exec, doNotEscapeWhenEncodingURIComponent));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec)
+{
+    static Bitmap<256> doNotEscape = makeCharacterBitmap(
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+        "abcdefghijklmnopqrstuvwxyz"
+        "0123456789"
+        "*+-./@_"
+    );
+
+    return JSValue::encode(toStringView(exec, exec->argument(0), [&] (StringView view) {
+        JSStringBuilder builder;
+        if (view.is8Bit()) {
+            const LChar* c = view.characters8();
+            for (unsigned k = 0; k < view.length(); k++, c++) {
+                int u = c[0];
+                if (doNotEscape.get(static_cast<LChar>(u)))
+                    builder.append(*c);
+                else {
+                    builder.append(static_cast<LChar>('%'));
+                    appendByteAsHex(static_cast<LChar>(u), builder);
+                }
+            }
+
+            return builder.build(exec);
+        }
+
+        const UChar* c = view.characters16();
+        for (unsigned k = 0; k < view.length(); k++, c++) {
+            UChar u = c[0];
+            if (u >= doNotEscape.size()) {
+                builder.append(static_cast<LChar>('%'));
+                builder.append(static_cast<LChar>('u'));
+                appendByteAsHex(u >> 8, builder);
+                appendByteAsHex(u & 0xFF, builder);
+            } else if (doNotEscape.get(static_cast<LChar>(u)))
+                builder.append(*c);
+            else {
+                builder.append(static_cast<LChar>('%'));
+                appendByteAsHex(u, builder);
+            }
+        }
+
+        return builder.build(exec);
+    }));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec)
+{
+    return JSValue::encode(toStringView(exec, exec->argument(0), [&] (StringView view) {
+        StringBuilder builder;
+        int k = 0;
+        int len = view.length();
+
+        if (view.is8Bit()) {
+            const LChar* characters = view.characters8();
+            LChar convertedLChar;
+            while (k < len) {
+                const LChar* c = characters + k;
+                if (c[0] == '%' && k <= len - 6 && c[1] == 'u') {
+                    if (isASCIIHexDigit(c[2]) && isASCIIHexDigit(c[3]) && isASCIIHexDigit(c[4]) && isASCIIHexDigit(c[5])) {
+                        builder.append(Lexer<UChar>::convertUnicode(c[2], c[3], c[4], c[5]));
+                        k += 6;
+                        continue;
+                    }
+                } else if (c[0] == '%' && k <= len - 3 && isASCIIHexDigit(c[1]) && isASCIIHexDigit(c[2])) {
+                    convertedLChar = LChar(Lexer<LChar>::convertHex(c[1], c[2]));
+                    c = &convertedLChar;
+                    k += 2;
+                }
+                builder.append(*c);
+                k++;
+            }
+        } else {
+            const UChar* characters = view.characters16();
+
+            while (k < len) {
+                const UChar* c = characters + k;
+                UChar convertedUChar;
+                if (c[0] == '%' && k <= len - 6 && c[1] == 'u') {
+                    if (isASCIIHexDigit(c[2]) && isASCIIHexDigit(c[3]) && isASCIIHexDigit(c[4]) && isASCIIHexDigit(c[5])) {
+                        convertedUChar = Lexer<UChar>::convertUnicode(c[2], c[3], c[4], c[5]);
+                        c = &convertedUChar;
+                        k += 5;
+                    }
+                } else if (c[0] == '%' && k <= len - 3 && isASCIIHexDigit(c[1]) && isASCIIHexDigit(c[2])) {
+                    convertedUChar = UChar(Lexer<UChar>::convertHex(c[1], c[2]));
+                    c = &convertedUChar;
+                    k += 2;
+                }
+                k++;
+                builder.append(*c);
+            }
+        }
+
+        return jsString(exec, builder.toString());
+    }));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeError(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope);
+}
+    
+EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeErrorArgumentsCalleeAndCaller(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope, "'arguments', 'callee', and 'caller' cannot be accessed in this context.");
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    if (thisValue.isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(ObjectProtoCalledOnNullOrUndefinedError));
+
+    JSObject* thisObject = jsDynamicCast<JSObject*>(thisValue);
+    if (!thisObject) {
+        JSObject* prototype = exec->thisValue().synthesizePrototype(exec);
+        if (UNLIKELY(!prototype))
+            return JSValue::encode(JSValue());
+        return JSValue::encode(prototype);
+    }
+
+    return JSValue::encode(thisObject->getPrototype(vm, exec));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    if (thisValue.isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(ObjectProtoCalledOnNullOrUndefinedError));
+
+    JSValue value = exec->argument(0);
+
+    JSObject* thisObject = jsDynamicCast<JSObject*>(thisValue);
+
+    // Setting __proto__ of a primitive should have no effect.
+    if (!thisObject)
+        return JSValue::encode(jsUndefined());
+
+    // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
+    if (!value.isObject() && !value.isNull())
+        return JSValue::encode(jsUndefined());
+
+    bool shouldThrowIfCantSet = true;
+    thisObject->setPrototype(vm, exec, value, shouldThrowIfCantSet);
+    return JSValue::encode(jsUndefined());
+}
+    
+EncodedJSValue JSC_HOST_CALL globalFuncBuiltinLog(ExecState* exec)
+{
+    dataLog(exec->argument(0).toWTFString(exec), "\n");
+    return JSValue::encode(jsUndefined());
+}
+
+} // namespace JSC
diff --git a/runtime/JSGlobalObjectFunctions.h b/runtime/JSGlobalObjectFunctions.h
new file mode 100644
index 0000000..dcdba38
--- /dev/null
+++ b/runtime/JSGlobalObjectFunctions.h
@@ -0,0 +1,59 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2007 Maks Orlovich
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include <unicode/uchar.h>
+#include <wtf/text/LChar.h>
+
+namespace JSC {
+
+class ArgList;
+class ExecState;
+class JSObject;
+
+// FIXME: These functions should really be in JSGlobalObject.cpp, but putting them there
+// is a 0.5% reduction.
+
+EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncParseFloat(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncEncodeURIComponent(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeError(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeErrorArgumentsCalleeAndCaller(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncBuiltinLog(ExecState*);
+
+static const double mantissaOverflowLowerBound = 9007199254740992.0;
+double parseIntOverflow(const LChar*, unsigned length, int radix);
+bool isStrWhiteSpace(UChar);
+double jsToNumber(StringView);
+
+} // namespace JSC
diff --git a/runtime/JSGlobalObjectInlines.h b/runtime/JSGlobalObjectInlines.h
new file mode 100644
index 0000000..7e334eb
--- /dev/null
+++ b/runtime/JSGlobalObjectInlines.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSGlobalObject.h"
+
+#include "ArrayPrototype.h"
+#include "ObjectPrototype.h"
+
+namespace JSC {
+
+ALWAYS_INLINE bool JSGlobalObject::objectPrototypeIsSane()
+{
+    return !hasIndexedProperties(m_objectPrototype->indexingType())
+        && m_objectPrototype->getPrototypeDirect().isNull();
+}
+
+ALWAYS_INLINE bool JSGlobalObject::arrayPrototypeChainIsSane()
+{
+    return !hasIndexedProperties(m_arrayPrototype->indexingType())
+        && m_arrayPrototype->getPrototypeDirect() == m_objectPrototype.get()
+        && objectPrototypeIsSane();
+}
+
+ALWAYS_INLINE bool JSGlobalObject::stringPrototypeChainIsSane()
+{
+    return !hasIndexedProperties(m_stringPrototype->indexingType())
+        && m_stringPrototype->getPrototypeDirect() == m_objectPrototype.get()
+        && objectPrototypeIsSane();
+}
+
+
+ALWAYS_INLINE bool JSGlobalObject::isArrayIteratorProtocolFastAndNonObservable()
+{
+    // We're fast if we don't have any indexed properties on the prototype.
+    // We're non-observable if the iteration protocol hasn't changed.
+    //
+    // Note: it only makes sense to call this from the main thread. If you're
+    // trying to prove this behavior on the compiler thread, you'll want to
+    // carefully set up watchpoints to have correct ordering while JS code is
+    // executing concurrently.
+
+    return arrayIteratorProtocolWatchpoint().isStillValid() && !isHavingABadTime() && arrayPrototypeChainIsSane();
+}
+
+} // namespace JSC
diff --git a/runtime/JSInt16Array.h b/runtime/JSInt16Array.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSInt16Array.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSInt32Array.h b/runtime/JSInt32Array.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSInt32Array.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSInt8Array.h b/runtime/JSInt8Array.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSInt8Array.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSInternalPromise.cpp b/runtime/JSInternalPromise.cpp
new file mode 100644
index 0000000..90f8032
--- /dev/null
+++ b/runtime/JSInternalPromise.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInternalPromise.h"
+
+#include "BuiltinNames.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSInternalPromise::s_info = { "InternalPromise", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSInternalPromise) };
+
+JSInternalPromise* JSInternalPromise::create(VM& vm, Structure* structure)
+{
+    JSInternalPromise* promise = new (NotNull, allocateCell<JSInternalPromise>(vm.heap)) JSInternalPromise(vm, structure);
+    promise->finishCreation(vm);
+    return promise;
+}
+
+Structure* JSInternalPromise::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSInternalPromise::JSInternalPromise(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+JSInternalPromise* JSInternalPromise::then(ExecState* exec, JSFunction* onFulfilled, JSFunction* onRejected)
+{
+    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().thenPublicName()));
+    CallData callData;
+    CallType callType = JSC::getCallData(function, callData);
+    ASSERT(callType != CallType::None);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(onFulfilled ? onFulfilled : jsUndefined());
+    arguments.append(onRejected ? onRejected : jsUndefined());
+
+    return jsCast<JSInternalPromise*>(call(exec, function, callType, callData, this, arguments));
+}
+
+} // namespace JSC
diff --git a/runtime/JSInternalPromise.h b/runtime/JSInternalPromise.h
new file mode 100644
index 0000000..f5f7595
--- /dev/null
+++ b/runtime/JSInternalPromise.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSPromise.h"
+
+namespace JSC {
+
+class JSFunction;
+
+// JSInternalPromise is completely separated instance from the JSPromise.
+// Since its prototype and constructor are different from the exposed Promises' ones,
+// all the user modification onto the exposed Promise does not have effect on JSInternalPromise.
+//
+// e.g.
+//     Replacing Promise.prototype.then with the user-customized one does not effect on JSInternalPromise.
+//
+// CAUTION: Must not leak the JSInternalPromise to the user space to keep its integrity.
+class JSInternalPromise : public JSPromise {
+public:
+    typedef JSPromise Base;
+
+    static JSInternalPromise* create(VM&, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_EXPORT_INFO;
+
+    JS_EXPORT_PRIVATE JSInternalPromise* then(ExecState*, JSFunction* = nullptr, JSFunction* = nullptr);
+
+private:
+    JSInternalPromise(VM&, Structure*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSInternalPromiseConstructor.cpp b/runtime/JSInternalPromiseConstructor.cpp
new file mode 100644
index 0000000..98178af
--- /dev/null
+++ b/runtime/JSInternalPromiseConstructor.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInternalPromiseConstructor.h"
+
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSInternalPromise.h"
+#include "JSInternalPromisePrototype.h"
+
+#include "JSInternalPromiseConstructor.lut.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSInternalPromiseConstructor);
+
+const ClassInfo JSInternalPromiseConstructor::s_info = { "Function", &Base::s_info, &internalPromiseConstructorTable, CREATE_METHOD_TABLE(JSInternalPromiseConstructor) };
+
+/* Source for JSInternalPromiseConstructor.lut.h
+@begin internalPromiseConstructorTable
+  internalAll  JSBuiltin DontEnum|Function 1
+@end
+*/
+
+JSInternalPromiseConstructor* JSInternalPromiseConstructor::create(VM& vm, Structure* structure, JSInternalPromisePrototype* promisePrototype, GetterSetter* speciesSymbol)
+{
+    JSInternalPromiseConstructor* constructor = new (NotNull, allocateCell<JSInternalPromiseConstructor>(vm.heap)) JSInternalPromiseConstructor(vm, structure);
+    constructor->finishCreation(vm, promisePrototype, speciesSymbol);
+    return constructor;
+}
+
+Structure* JSInternalPromiseConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSInternalPromiseConstructor::JSInternalPromiseConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+static EncodedJSValue JSC_HOST_CALL constructPromise(ExecState* exec)
+{
+    JSGlobalObject* globalObject = exec->jsCallee()->globalObject();
+    VM& vm = exec->vm();
+    JSInternalPromise* promise = JSInternalPromise::create(vm, globalObject->internalPromiseStructure());
+    promise->initialize(exec, globalObject, exec->argument(0));
+    return JSValue::encode(promise);
+}
+
+ConstructType JSInternalPromiseConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructPromise;
+    return ConstructType::Host;
+}
+
+CallType JSInternalPromiseConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = constructPromise;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/JSInternalPromiseConstructor.h b/runtime/JSInternalPromiseConstructor.h
new file mode 100644
index 0000000..81bd2b8
--- /dev/null
+++ b/runtime/JSInternalPromiseConstructor.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSPromiseConstructor.h"
+
+namespace JSC {
+
+class JSInternalPromise;
+class JSInternalPromisePrototype;
+
+class JSInternalPromiseConstructor : public JSPromiseConstructor {
+public:
+    typedef JSPromiseConstructor Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static JSInternalPromiseConstructor* create(VM&, Structure*, JSInternalPromisePrototype*, GetterSetter*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+private:
+    JSInternalPromiseConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/JSInternalPromiseDeferred.cpp b/runtime/JSInternalPromiseDeferred.cpp
new file mode 100644
index 0000000..0e0f3dd
--- /dev/null
+++ b/runtime/JSInternalPromiseDeferred.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInternalPromiseDeferred.h"
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "Exception.h"
+#include "JSCInlines.h"
+#include "JSInternalPromise.h"
+#include "JSInternalPromiseConstructor.h"
+
+namespace JSC {
+
+const ClassInfo JSInternalPromiseDeferred::s_info = { "JSInternalPromiseDeferred", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSInternalPromiseDeferred) };
+
+JSInternalPromiseDeferred* JSInternalPromiseDeferred::create(ExecState* exec, JSGlobalObject* globalObject)
+{
+    VM& vm = exec->vm();
+
+    JSValue deferred = newPromiseCapability(exec, globalObject, globalObject->internalPromiseConstructor());
+
+    JSValue promise = deferred.get(exec, vm.propertyNames->builtinNames().promisePrivateName());
+    ASSERT(promise.inherits(JSInternalPromise::info()));
+    JSValue resolve = deferred.get(exec, vm.propertyNames->builtinNames().resolvePrivateName());
+    JSValue reject = deferred.get(exec, vm.propertyNames->builtinNames().rejectPrivateName());
+
+    JSInternalPromiseDeferred* result = new (NotNull, allocateCell<JSInternalPromiseDeferred>(vm.heap)) JSInternalPromiseDeferred(vm);
+    result->finishCreation(vm, jsCast<JSObject*>(promise), resolve, reject);
+    return result;
+}
+
+JSInternalPromiseDeferred::JSInternalPromiseDeferred(VM& vm)
+    : Base(vm, vm.internalPromiseDeferredStructure.get())
+{
+}
+
+JSInternalPromise* JSInternalPromiseDeferred::promise() const
+{
+    return jsCast<JSInternalPromise*>(Base::promise());
+}
+
+JSInternalPromise* JSInternalPromiseDeferred::resolve(ExecState* exec, JSValue value)
+{
+    Base::resolve(exec, value);
+    return promise();
+}
+
+JSInternalPromise* JSInternalPromiseDeferred::reject(ExecState* exec, JSValue reason)
+{
+    Base::reject(exec, reason);
+    return promise();
+}
+
+} // namespace JSC
diff --git a/runtime/JSInternalPromiseDeferred.h b/runtime/JSInternalPromiseDeferred.h
new file mode 100644
index 0000000..d2c322c
--- /dev/null
+++ b/runtime/JSInternalPromiseDeferred.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSPromiseDeferred.h"
+
+namespace JSC {
+
+class JSInternalPromise;
+
+class JSInternalPromiseDeferred final : public JSPromiseDeferred {
+public:
+    typedef JSPromiseDeferred Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    JS_EXPORT_PRIVATE static JSInternalPromiseDeferred* create(ExecState*, JSGlobalObject*);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    JS_EXPORT_PRIVATE JSInternalPromise* promise() const;
+    JS_EXPORT_PRIVATE JSInternalPromise* resolve(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE JSInternalPromise* reject(ExecState*, JSValue);
+
+private:
+    JSInternalPromiseDeferred(VM&);
+};
+
+} // namespace JSC
diff --git a/runtime/JSInternalPromisePrototype.cpp b/runtime/JSInternalPromisePrototype.cpp
new file mode 100644
index 0000000..5db434b
--- /dev/null
+++ b/runtime/JSInternalPromisePrototype.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInternalPromisePrototype.h"
+
+#include "Error.h"
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSInternalPromise.h"
+#include "Microtask.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSInternalPromisePrototype);
+
+const ClassInfo JSInternalPromisePrototype::s_info = { "InternalPromisePrototype", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSInternalPromisePrototype) };
+
+JSInternalPromisePrototype* JSInternalPromisePrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    JSInternalPromisePrototype* object = new (NotNull, allocateCell<JSInternalPromisePrototype>(vm.heap)) JSInternalPromisePrototype(vm, structure);
+    object->finishCreation(vm, structure);
+    return object;
+}
+
+Structure* JSInternalPromisePrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSInternalPromisePrototype::JSInternalPromisePrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+} // namespace JSC
diff --git a/runtime/JSInternalPromisePrototype.h b/runtime/JSInternalPromisePrototype.h
new file mode 100644
index 0000000..3abf205
--- /dev/null
+++ b/runtime/JSInternalPromisePrototype.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSPromisePrototype.h"
+
+namespace JSC {
+
+class JSInternalPromisePrototype : public JSPromisePrototype {
+public:
+    typedef JSPromisePrototype Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static JSInternalPromisePrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+private:
+    JSInternalPromisePrototype(VM&, Structure*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSJob.cpp b/runtime/JSJob.cpp
new file mode 100644
index 0000000..d4c3185
--- /dev/null
+++ b/runtime/JSJob.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSJob.h"
+
+#include "Error.h"
+#include "Exception.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSObjectInlines.h"
+#include "Microtask.h"
+#include "StrongInlines.h"
+
+namespace JSC {
+
+class JSJobMicrotask final : public Microtask {
+public:
+    JSJobMicrotask(VM& vm, JSValue job, JSArray* arguments)
+    {
+        m_job.set(vm, job);
+        m_arguments.set(vm, arguments);
+    }
+
+    virtual ~JSJobMicrotask()
+    {
+    }
+
+private:
+    void run(ExecState*) override;
+
+    Strong<Unknown> m_job;
+    Strong<JSArray> m_arguments;
+};
+
+Ref<Microtask> createJSJob(VM& vm, JSValue job, JSArray* arguments)
+{
+    return adoptRef(*new JSJobMicrotask(vm, job, arguments));
+}
+
+void JSJobMicrotask::run(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    CallData handlerCallData;
+    CallType handlerCallType = getCallData(m_job.get(), handlerCallData);
+    ASSERT(handlerCallType != CallType::None);
+
+    MarkedArgumentBuffer handlerArguments;
+    for (unsigned index = 0, length = m_arguments->length(); index < length; ++index)
+        handlerArguments.append(m_arguments->JSArray::get(exec, index));
+    profiledCall(exec, ProfilingReason::Microtask, m_job.get(), handlerCallType, handlerCallData, jsUndefined(), handlerArguments);
+    scope.clearException();
+}
+
+} // namespace JSC
diff --git a/runtime/JSJob.h b/runtime/JSJob.h
new file mode 100644
index 0000000..a73715c
--- /dev/null
+++ b/runtime/JSJob.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "Structure.h"
+
+namespace JSC {
+
+class Microtask;
+class JSArray;
+
+Ref<Microtask> createJSJob(VM&, JSValue job, JSArray* arguments);
+
+} // namespace JSC
diff --git a/runtime/JSLexicalEnvironment.cpp b/runtime/JSLexicalEnvironment.cpp
new file mode 100644
index 0000000..436d6f2
--- /dev/null
+++ b/runtime/JSLexicalEnvironment.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2008, 2009, 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSLexicalEnvironment.h"
+
+#include "Interpreter.h"
+#include "JSFunction.h"
+#include "JSCInlines.h"
+
+using namespace std;
+
+namespace JSC {
+
+const ClassInfo JSLexicalEnvironment::s_info = { "JSLexicalEnvironment", &Base::s_info, 0, CREATE_METHOD_TABLE(JSLexicalEnvironment) };
+
+void JSLexicalEnvironment::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    JSLexicalEnvironment* thisObject = jsCast<JSLexicalEnvironment*>(object);
+
+    {
+        ConcurrentJSLocker locker(thisObject->symbolTable()->m_lock);
+        SymbolTable::Map::iterator end = thisObject->symbolTable()->end(locker);
+        for (SymbolTable::Map::iterator it = thisObject->symbolTable()->begin(locker); it != end; ++it) {
+            if (it->value.getAttributes() & DontEnum && !mode.includeDontEnumProperties())
+                continue;
+            if (!thisObject->isValidScopeOffset(it->value.scopeOffset()))
+                continue;
+            if (it->key->isSymbol() && !propertyNames.includeSymbolProperties())
+                continue;
+            propertyNames.add(Identifier::fromUid(exec, it->key.get()));
+        }
+    }
+    // Skip the JSEnvironmentRecord implementation of getOwnNonIndexPropertyNames
+    JSObject::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);
+}
+
+bool JSLexicalEnvironment::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    JSLexicalEnvironment* thisObject = jsCast<JSLexicalEnvironment*>(object);
+
+    if (symbolTableGet(thisObject, propertyName, slot))
+        return true;
+
+    unsigned attributes;
+    if (JSValue value = thisObject->getDirect(exec->vm(), propertyName, attributes)) {
+        slot.setValue(thisObject, attributes, value);
+        return true;
+    }
+
+    // We don't call through to JSObject because there's no way to give a 
+    // lexical environment object getter properties or a prototype.
+    ASSERT(!thisObject->hasGetterSetterProperties());
+    ASSERT(thisObject->getPrototypeDirect().isNull());
+    return false;
+}
+
+bool JSLexicalEnvironment::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    JSLexicalEnvironment* thisObject = jsCast<JSLexicalEnvironment*>(cell);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
+
+    bool shouldThrowReadOnlyError = slot.isStrictMode() || thisObject->isLexicalScope();
+    bool ignoreReadOnlyErrors = false;
+    bool putResult = false;
+    if (symbolTablePutInvalidateWatchpointSet(thisObject, exec, propertyName, value, shouldThrowReadOnlyError, ignoreReadOnlyErrors, putResult))
+        return putResult;
+
+    // We don't call through to JSObject because __proto__ and getter/setter 
+    // properties are non-standard extensions that other implementations do not
+    // expose in the lexicalEnvironment object.
+    ASSERT(!thisObject->hasGetterSetterProperties());
+    return thisObject->putOwnDataProperty(exec->vm(), propertyName, value, slot);
+}
+
+bool JSLexicalEnvironment::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    if (propertyName == exec->propertyNames().arguments)
+        return false;
+
+    return Base::deleteProperty(cell, exec, propertyName);
+}
+
+JSValue JSLexicalEnvironment::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
+{
+    if (ecmaMode == StrictMode)
+        return jsUndefined();
+    return exec->globalThisValue();
+}
+
+} // namespace JSC
diff --git a/runtime/JSLexicalEnvironment.h b/runtime/JSLexicalEnvironment.h
new file mode 100644
index 0000000..5ae193e
--- /dev/null
+++ b/runtime/JSLexicalEnvironment.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2008, 2009, 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#pragma once
+
+#include "CodeBlock.h"
+#include "JSEnvironmentRecord.h"
+#include "SymbolTable.h"
+
+namespace JSC {
+
+class JSLexicalEnvironment : public JSEnvironmentRecord {
+protected:
+    JSLexicalEnvironment(VM&, Structure*, JSScope*, SymbolTable*);
+    
+public:
+    typedef JSEnvironmentRecord Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesToThis;
+
+    static JSLexicalEnvironment* create(
+        VM& vm, Structure* structure, JSScope* currentScope, SymbolTable* symbolTable, JSValue initialValue)
+    {
+        JSLexicalEnvironment* result = 
+            new (
+                NotNull,
+                allocateCell<JSLexicalEnvironment>(vm.heap, allocationSize(symbolTable)))
+            JSLexicalEnvironment(vm, structure, currentScope, symbolTable);
+        result->finishCreation(vm, initialValue);
+        return result;
+    }
+
+    static JSLexicalEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable, JSValue initialValue)
+    {
+        Structure* structure = globalObject->activationStructure();
+        return create(vm, structure, currentScope, symbolTable, initialValue);
+    }
+        
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+
+    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject) { return Structure::create(vm, globalObject, jsNull(), TypeInfo(LexicalEnvironmentType, StructureFlags), info()); }
+};
+
+inline JSLexicalEnvironment::JSLexicalEnvironment(VM& vm, Structure* structure, JSScope* currentScope, SymbolTable* symbolTable)
+    : Base(vm, structure, currentScope, symbolTable)
+{
+}
+
+inline JSLexicalEnvironment* asActivation(JSValue value)
+{
+    ASSERT(asObject(value)->inherits(JSLexicalEnvironment::info()));
+    return jsCast<JSLexicalEnvironment*>(asObject(value));
+}
+    
+} // namespace JSC
diff --git a/runtime/JSLock.cpp b/runtime/JSLock.cpp
new file mode 100644
index 0000000..d90386c
--- /dev/null
+++ b/runtime/JSLock.cpp
@@ -0,0 +1,301 @@
+/*
+ * Copyright (C) 2005, 2008, 2012, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the NU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA 
+ *
+ */
+
+#include "config.h"
+#include "JSLock.h"
+
+#include "Heap.h"
+#include "CallFrame.h"
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "SamplingProfiler.h"
+#include <thread>
+
+namespace JSC {
+
+StaticLock GlobalJSLock::s_sharedInstanceMutex;
+
+GlobalJSLock::GlobalJSLock()
+{
+    s_sharedInstanceMutex.lock();
+}
+
+GlobalJSLock::~GlobalJSLock()
+{
+    s_sharedInstanceMutex.unlock();
+}
+
+JSLockHolder::JSLockHolder(ExecState* exec)
+    : m_vm(&exec->vm())
+{
+    init();
+}
+
+JSLockHolder::JSLockHolder(VM* vm)
+    : m_vm(vm)
+{
+    init();
+}
+
+JSLockHolder::JSLockHolder(VM& vm)
+    : m_vm(&vm)
+{
+    init();
+}
+
+void JSLockHolder::init()
+{
+    m_vm->apiLock().lock();
+}
+
+JSLockHolder::~JSLockHolder()
+{
+    RefPtr<JSLock> apiLock(&m_vm->apiLock());
+    m_vm = nullptr;
+    apiLock->unlock();
+}
+
+JSLock::JSLock(VM* vm)
+    : m_ownerThreadID(std::thread::id())
+    , m_lockCount(0)
+    , m_lockDropDepth(0)
+    , m_hasExclusiveThread(false)
+    , m_vm(vm)
+    , m_entryAtomicStringTable(nullptr)
+{
+}
+
+JSLock::~JSLock()
+{
+}
+
+void JSLock::willDestroyVM(VM* vm)
+{
+    ASSERT_UNUSED(vm, m_vm == vm);
+    m_vm = nullptr;
+}
+
+void JSLock::setExclusiveThread(std::thread::id threadId)
+{
+    RELEASE_ASSERT(!m_lockCount && m_ownerThreadID == std::thread::id());
+    m_hasExclusiveThread = (threadId != std::thread::id());
+    m_ownerThreadID = threadId;
+}
+
+void JSLock::lock()
+{
+    lock(1);
+}
+
+void JSLock::lock(intptr_t lockCount)
+{
+    ASSERT(lockCount > 0);
+    if (currentThreadIsHoldingLock()) {
+        m_lockCount += lockCount;
+        return;
+    }
+
+    if (!m_hasExclusiveThread) {
+        m_lock.lock();
+        m_ownerThreadID = std::this_thread::get_id();
+    }
+    ASSERT(!m_lockCount);
+    m_lockCount = lockCount;
+
+    didAcquireLock();
+}
+
+void JSLock::didAcquireLock()
+{
+    // FIXME: What should happen to the per-thread identifier table if we don't have a VM?
+    if (!m_vm)
+        return;
+    
+    WTFThreadData& threadData = wtfThreadData();
+    ASSERT(!m_entryAtomicStringTable);
+    m_entryAtomicStringTable = threadData.setCurrentAtomicStringTable(m_vm->atomicStringTable());
+    ASSERT(m_entryAtomicStringTable);
+
+    if (m_vm->heap.hasAccess())
+        m_shouldReleaseHeapAccess = false;
+    else {
+        m_vm->heap.acquireAccess();
+        m_shouldReleaseHeapAccess = true;
+    }
+
+    RELEASE_ASSERT(!m_vm->stackPointerAtVMEntry());
+    void* p = &p; // A proxy for the current stack pointer.
+    m_vm->setStackPointerAtVMEntry(p);
+
+    m_vm->setLastStackTop(threadData.savedLastStackTop());
+
+    m_vm->heap.machineThreads().addCurrentThread();
+
+#if ENABLE(SAMPLING_PROFILER)
+    // Note: this must come after addCurrentThread().
+    if (SamplingProfiler* samplingProfiler = m_vm->samplingProfiler())
+        samplingProfiler->noticeJSLockAcquisition();
+#endif
+}
+
+void JSLock::unlock()
+{
+    unlock(1);
+}
+
+void JSLock::unlock(intptr_t unlockCount)
+{
+    RELEASE_ASSERT(currentThreadIsHoldingLock());
+    ASSERT(m_lockCount >= unlockCount);
+
+    // Maintain m_lockCount while calling willReleaseLock() so that its callees know that
+    // they still have the lock.
+    if (unlockCount == m_lockCount)
+        willReleaseLock();
+
+    m_lockCount -= unlockCount;
+
+    if (!m_lockCount) {
+        
+        if (!m_hasExclusiveThread) {
+            m_ownerThreadID = std::thread::id();
+            m_lock.unlock();
+        }
+    }
+}
+
+void JSLock::willReleaseLock()
+{
+    RefPtr<VM> vm = m_vm;
+    if (vm) {
+        vm->drainMicrotasks();
+
+        vm->heap.releaseDelayedReleasedObjects();
+        vm->setStackPointerAtVMEntry(nullptr);
+        
+        if (m_shouldReleaseHeapAccess)
+            vm->heap.releaseAccess();
+    }
+
+    if (m_entryAtomicStringTable) {
+        wtfThreadData().setCurrentAtomicStringTable(m_entryAtomicStringTable);
+        m_entryAtomicStringTable = nullptr;
+    }
+}
+
+void JSLock::lock(ExecState* exec)
+{
+    exec->vm().apiLock().lock();
+}
+
+void JSLock::unlock(ExecState* exec)
+{
+    exec->vm().apiLock().unlock();
+}
+
+bool JSLock::currentThreadIsHoldingLock()
+{
+    ASSERT(!m_hasExclusiveThread || (exclusiveThread() == std::this_thread::get_id()));
+    if (m_hasExclusiveThread)
+        return !!m_lockCount;
+    return m_ownerThreadID == std::this_thread::get_id();
+}
+
+// This function returns the number of locks that were dropped.
+unsigned JSLock::dropAllLocks(DropAllLocks* dropper)
+{
+    if (m_hasExclusiveThread) {
+        ASSERT(exclusiveThread() == std::this_thread::get_id());
+        return 0;
+    }
+
+    if (!currentThreadIsHoldingLock())
+        return 0;
+
+    ++m_lockDropDepth;
+
+    dropper->setDropDepth(m_lockDropDepth);
+
+    WTFThreadData& threadData = wtfThreadData();
+    threadData.setSavedStackPointerAtVMEntry(m_vm->stackPointerAtVMEntry());
+    threadData.setSavedLastStackTop(m_vm->lastStackTop());
+
+    unsigned droppedLockCount = m_lockCount;
+    unlock(droppedLockCount);
+
+    return droppedLockCount;
+}
+
+void JSLock::grabAllLocks(DropAllLocks* dropper, unsigned droppedLockCount)
+{
+    ASSERT(!m_hasExclusiveThread || !droppedLockCount);
+
+    // If no locks were dropped, nothing to do!
+    if (!droppedLockCount)
+        return;
+
+    ASSERT(!currentThreadIsHoldingLock());
+    lock(droppedLockCount);
+
+    while (dropper->dropDepth() != m_lockDropDepth) {
+        unlock(droppedLockCount);
+        std::this_thread::yield();
+        lock(droppedLockCount);
+    }
+
+    --m_lockDropDepth;
+
+    WTFThreadData& threadData = wtfThreadData();
+    m_vm->setStackPointerAtVMEntry(threadData.savedStackPointerAtVMEntry());
+    m_vm->setLastStackTop(threadData.savedLastStackTop());
+}
+
+JSLock::DropAllLocks::DropAllLocks(VM* vm)
+    : m_droppedLockCount(0)
+    // If the VM is in the middle of being destroyed then we don't want to resurrect it
+    // by allowing DropAllLocks to ref it. By this point the JSLock has already been 
+    // released anyways, so it doesn't matter that DropAllLocks is a no-op.
+    , m_vm(vm->refCount() ? vm : nullptr)
+{
+    if (!m_vm)
+        return;
+    RELEASE_ASSERT(!m_vm->apiLock().currentThreadIsHoldingLock() || !m_vm->isCollectorBusyOnCurrentThread());
+    m_droppedLockCount = m_vm->apiLock().dropAllLocks(this);
+}
+
+JSLock::DropAllLocks::DropAllLocks(ExecState* exec)
+    : DropAllLocks(exec ? &exec->vm() : nullptr)
+{
+}
+
+JSLock::DropAllLocks::DropAllLocks(VM& vm)
+    : DropAllLocks(&vm)
+{
+}
+
+JSLock::DropAllLocks::~DropAllLocks()
+{
+    if (!m_vm)
+        return;
+    m_vm->apiLock().grabAllLocks(this, m_droppedLockCount);
+}
+
+} // namespace JSC
diff --git a/runtime/JSLock.h b/runtime/JSLock.h
new file mode 100644
index 0000000..31171b4
--- /dev/null
+++ b/runtime/JSLock.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2005, 2008, 2009, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include <mutex>
+#include <thread>
+#include <wtf/Assertions.h>
+#include <wtf/Lock.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+#include <wtf/ThreadSafeRefCounted.h>
+#include <wtf/WTFThreadData.h>
+
+namespace JSC {
+
+// To make it safe to use JavaScript on multiple threads, it is
+// important to lock before doing anything that allocates a
+// JavaScript data structure or that interacts with shared state
+// such as the protect count hash table. The simplest way to lock
+// is to create a local JSLockHolder object in the scope where the lock 
+// must be held and pass it the context that requires protection. 
+// The lock is recursive so nesting is ok. The JSLock 
+// object also acts as a convenience short-hand for running important
+// initialization routines.
+
+// To avoid deadlock, sometimes it is necessary to temporarily
+// release the lock. Since it is recursive you actually have to
+// release all locks held by your thread. This is safe to do if
+// you are executing code that doesn't require the lock, and you
+// reacquire the right number of locks at the end. You can do this
+// by constructing a locally scoped JSLock::DropAllLocks object. The 
+// DropAllLocks object takes care to release the JSLock only if your
+// thread acquired it to begin with.
+
+class ExecState;
+class VM;
+
+// This class is used to protect the initialization of the legacy single 
+// shared VM.
+class GlobalJSLock {
+    WTF_MAKE_NONCOPYABLE(GlobalJSLock);
+public:
+    JS_EXPORT_PRIVATE GlobalJSLock();
+    JS_EXPORT_PRIVATE ~GlobalJSLock();
+private:
+    static StaticLock s_sharedInstanceMutex;
+};
+
+class JSLockHolder {
+public:
+    JS_EXPORT_PRIVATE JSLockHolder(VM*);
+    JS_EXPORT_PRIVATE JSLockHolder(VM&);
+    JS_EXPORT_PRIVATE JSLockHolder(ExecState*);
+
+    JS_EXPORT_PRIVATE ~JSLockHolder();
+private:
+    void init();
+
+    RefPtr<VM> m_vm;
+};
+
+class JSLock : public ThreadSafeRefCounted<JSLock> {
+    WTF_MAKE_NONCOPYABLE(JSLock);
+public:
+    JSLock(VM*);
+    JS_EXPORT_PRIVATE ~JSLock();
+
+    JS_EXPORT_PRIVATE void lock();
+    JS_EXPORT_PRIVATE void unlock();
+
+    static void lock(ExecState*);
+    static void unlock(ExecState*);
+    static void lock(VM&);
+    static void unlock(VM&);
+
+    VM* vm() { return m_vm; }
+
+    bool hasExclusiveThread() const { return m_hasExclusiveThread; }
+    std::thread::id exclusiveThread() const
+    {
+        ASSERT(m_hasExclusiveThread);
+        return m_ownerThreadID;
+    }
+    std::thread::id ownerThread() const { return m_ownerThreadID; }
+    JS_EXPORT_PRIVATE void setExclusiveThread(std::thread::id);
+    JS_EXPORT_PRIVATE bool currentThreadIsHoldingLock();
+
+    void willDestroyVM(VM*);
+
+    class DropAllLocks {
+        WTF_MAKE_NONCOPYABLE(DropAllLocks);
+    public:
+        JS_EXPORT_PRIVATE DropAllLocks(ExecState*);
+        JS_EXPORT_PRIVATE DropAllLocks(VM*);
+        JS_EXPORT_PRIVATE DropAllLocks(VM&);
+        JS_EXPORT_PRIVATE ~DropAllLocks();
+
+        void setDropDepth(unsigned depth) { m_dropDepth = depth; }
+        unsigned dropDepth() const { return m_dropDepth; }
+
+    private:
+        intptr_t m_droppedLockCount;
+        RefPtr<VM> m_vm;
+        unsigned m_dropDepth;
+    };
+
+private:
+    void lock(intptr_t lockCount);
+    void unlock(intptr_t unlockCount);
+
+    void didAcquireLock();
+    void willReleaseLock();
+
+    unsigned dropAllLocks(DropAllLocks*);
+    void grabAllLocks(DropAllLocks*, unsigned lockCount);
+
+    Lock m_lock;
+    std::thread::id m_ownerThreadID;
+    intptr_t m_lockCount;
+    unsigned m_lockDropDepth;
+    bool m_hasExclusiveThread;
+    bool m_shouldReleaseHeapAccess;
+    VM* m_vm;
+    AtomicStringTable* m_entryAtomicStringTable; 
+};
+
+} // namespace
diff --git a/runtime/JSMap.cpp b/runtime/JSMap.cpp
new file mode 100644
index 0000000..deee647
--- /dev/null
+++ b/runtime/JSMap.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSMap.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSMap::s_info = { "Map", &Base::s_info, 0, CREATE_METHOD_TABLE(JSMap) };
+
+String JSMap::toStringName(const JSObject*, ExecState*)
+{
+    return ASCIILiteral("Object");
+}
+
+}
diff --git a/runtime/JSMap.h b/runtime/JSMap.h
new file mode 100644
index 0000000..551a2fb
--- /dev/null
+++ b/runtime/JSMap.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "MapBase.h"
+
+namespace JSC {
+
+class JSMapIterator;
+
+class JSMap : public MapBase<HashMapBucket<HashMapBucketDataKeyValue>> {
+    typedef MapBase<HashMapBucket<HashMapBucketDataKeyValue>> Base;
+public:
+    friend class JSMapIterator;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSMapType, StructureFlags), info());
+    }
+
+    static JSMap* create(ExecState* exec, VM& vm, Structure* structure)
+    {
+        JSMap* instance = new (NotNull, allocateCell<JSMap>(vm.heap)) JSMap(vm, structure);
+        instance->finishCreation(exec, vm);
+        return instance;
+    }
+
+    ALWAYS_INLINE JSValue get(ExecState* exec, JSValue key)
+    {
+        return m_map->get(exec, key);
+    }
+
+    ALWAYS_INLINE void set(ExecState* exec, JSValue key, JSValue value)
+    {
+        m_map->add(exec, key, value);
+    }
+
+private:
+    JSMap(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    static String toStringName(const JSObject*, ExecState*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSMapIterator.cpp b/runtime/JSMapIterator.cpp
new file mode 100644
index 0000000..9da4550
--- /dev/null
+++ b/runtime/JSMapIterator.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSMapIterator.h"
+
+#include "JSCInlines.h"
+#include "JSMap.h"
+
+namespace JSC {
+
+const ClassInfo JSMapIterator::s_info = { "Map Iterator", &Base::s_info, 0, CREATE_METHOD_TABLE(JSMapIterator) };
+
+void JSMapIterator::finishCreation(VM& vm, JSMap* iteratedObject)
+{
+    Base::finishCreation(vm);
+    m_map.set(vm, this, iteratedObject);
+    setIterator(vm, m_map->impl()->head());
+}
+
+void JSMapIterator::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSMapIterator* thisObject = jsCast<JSMapIterator*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_map);
+    visitor.append(thisObject->m_iter);
+}
+
+JSValue JSMapIterator::createPair(CallFrame* callFrame, JSValue key, JSValue value)
+{
+    MarkedArgumentBuffer args;
+    args.append(key);
+    args.append(value);
+    JSGlobalObject* globalObject = callFrame->jsCallee()->globalObject();
+    return constructArray(callFrame, 0, globalObject, args);
+}
+
+JSMapIterator* JSMapIterator::clone(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto clone = JSMapIterator::create(vm, exec->jsCallee()->globalObject()->mapIteratorStructure(), m_map.get(), m_kind);
+    clone->setIterator(vm, m_iter.get());
+    return clone;
+}
+
+}
diff --git a/runtime/JSMapIterator.h b/runtime/JSMapIterator.h
new file mode 100644
index 0000000..366533e
--- /dev/null
+++ b/runtime/JSMapIterator.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "IterationKind.h"
+#include "JSMap.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSMapIterator : public JSNonFinalObject {
+    typedef HashMapBucket<HashMapBucketDataKeyValue> HashMapBucketType;
+public:
+    typedef JSNonFinalObject Base;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static JSMapIterator* create(VM& vm, Structure* structure, JSMap* iteratedObject, IterationKind kind)
+    {
+        JSMapIterator* instance = new (NotNull, allocateCell<JSMapIterator>(vm.heap)) JSMapIterator(vm, structure, iteratedObject, kind);
+        instance->finishCreation(vm, iteratedObject);
+        return instance;
+    }
+
+    ALWAYS_INLINE HashMapBucketType* advanceIter(ExecState* exec)
+    {
+        HashMapBucketType* prev = m_iter.get();
+        if (!prev)
+            return nullptr;
+        HashMapBucketType* bucket = m_iter->next();
+        while (bucket && bucket->deleted()) {
+            prev = bucket;
+            bucket = bucket->next();
+        }
+        if (!bucket) {
+            setIterator(exec->vm(), nullptr);
+            return nullptr;
+        }
+        setIterator(exec->vm(), bucket); // We keep m_iter on the last value since the first thing we do in this function is call next().
+        return bucket;
+    }
+    bool next(ExecState* exec, JSValue& value)
+    {
+        HashMapBucketType* bucket = advanceIter(exec);
+        if (!bucket)
+            return false;
+
+        if (m_kind == IterateValue)
+            value = bucket->value();
+        else if (m_kind == IterateKey)
+            value = bucket->key();
+        else
+            value = createPair(exec, bucket->key(), bucket->value());
+        return true;
+    }
+
+    bool nextKeyValue(ExecState* exec, JSValue& key, JSValue& value)
+    {
+        HashMapBucketType* bucket = advanceIter(exec);
+        if (!bucket)
+            return false;
+
+        key = bucket->key();
+        value = bucket->value();
+        return true;
+    }
+
+    IterationKind kind() const { return m_kind; }
+    JSValue iteratedValue() const { return m_map.get(); }
+    JSMapIterator* clone(ExecState*);
+
+private:
+    JSMapIterator(VM& vm, Structure* structure, JSMap*, IterationKind kind)
+        : Base(vm, structure)
+        , m_kind(kind)
+    { }
+
+    void setIterator(VM& vm, HashMapBucketType* bucket)
+    {
+        m_iter.setMayBeNull(vm, this, bucket);
+    }
+
+    JS_EXPORT_PRIVATE void finishCreation(VM&, JSMap*);
+    JSValue createPair(CallFrame*, JSValue, JSValue);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<JSMap> m_map;
+    WriteBarrier<HashMapBucketType> m_iter;
+    IterationKind m_kind;
+};
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSMapIterator);
+
+} // namespace JSC
diff --git a/runtime/JSModuleEnvironment.cpp b/runtime/JSModuleEnvironment.cpp
new file mode 100644
index 0000000..80fedeb
--- /dev/null
+++ b/runtime/JSModuleEnvironment.cpp
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSModuleEnvironment.h"
+
+#include "AbstractModuleRecord.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+
+using namespace std;
+
+namespace JSC {
+
+const ClassInfo JSModuleEnvironment::s_info = { "JSModuleEnvironment", &Base::s_info, 0, CREATE_METHOD_TABLE(JSModuleEnvironment) };
+
+JSModuleEnvironment* JSModuleEnvironment::create(
+    VM& vm, Structure* structure, JSScope* currentScope, SymbolTable* symbolTable, JSValue initialValue, AbstractModuleRecord* moduleRecord)
+{
+    // JSLexicalEnvironment (precisely, JSEnvironmentRecord) has the storage to store the variable slots after the its class storage.
+    // Because the offset of the variable slots are fixed in the JSEnvironmentRecord, inheritting these class and adding new member field is not allowed,
+    // the new member will overlap the variable slots.
+    // To keep the JSModuleEnvironment compatible to the JSLexicalEnvironment but add the new member to store the AbstractModuleRecord, we additionally allocate
+    // the storage after the variable slots.
+    //
+    // JSLexicalEnvironment:
+    //     [ JSLexicalEnvironment ][ variable slots ]
+    //
+    // JSModuleEnvironment:
+    //     [ JSLexicalEnvironment ][ variable slots ][ additional slots for JSModuleEnvironment ]
+    JSModuleEnvironment* result =
+        new (
+            NotNull,
+            allocateCell<JSModuleEnvironment>(vm.heap, JSModuleEnvironment::allocationSize(symbolTable)))
+        JSModuleEnvironment(vm, structure, currentScope, symbolTable);
+    result->finishCreation(vm, initialValue, moduleRecord);
+    return result;
+}
+
+void JSModuleEnvironment::finishCreation(VM& vm, JSValue initialValue, AbstractModuleRecord* moduleRecord)
+{
+    Base::finishCreation(vm, initialValue);
+    this->moduleRecordSlot().set(vm, this, moduleRecord);
+}
+
+void JSModuleEnvironment::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSModuleEnvironment* thisObject = jsCast<JSModuleEnvironment*>(cell);
+    Base::visitChildren(thisObject, visitor);
+    visitor.appendValues(thisObject->variables(), thisObject->symbolTable()->scopeSize());
+    visitor.append(thisObject->moduleRecordSlot());
+}
+
+bool JSModuleEnvironment::getOwnPropertySlot(JSObject* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSModuleEnvironment* thisObject = jsCast<JSModuleEnvironment*>(cell);
+    AbstractModuleRecord::Resolution resolution = thisObject->moduleRecord()->resolveImport(exec, Identifier::fromUid(exec, propertyName.uid()));
+    if (resolution.type == AbstractModuleRecord::Resolution::Type::Resolved) {
+        // When resolveImport resolves the resolution, the imported module environment must have the binding.
+        JSModuleEnvironment* importedModuleEnvironment = resolution.moduleRecord->moduleEnvironment();
+        PropertySlot redirectSlot(importedModuleEnvironment, PropertySlot::InternalMethodType::Get);
+        bool result = importedModuleEnvironment->methodTable(vm)->getOwnPropertySlot(importedModuleEnvironment, exec, resolution.localName, redirectSlot);
+        ASSERT_UNUSED(result, result);
+        ASSERT(redirectSlot.isValue());
+        JSValue value = redirectSlot.getValue(exec, resolution.localName);
+        ASSERT_UNUSED(scope, !scope.exception());
+        slot.setValue(thisObject, redirectSlot.attributes(), value);
+        return true;
+    }
+    return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+}
+
+void JSModuleEnvironment::getOwnNonIndexPropertyNames(JSObject* cell, ExecState* exec, PropertyNameArray& propertyNamesArray, EnumerationMode mode)
+{
+    JSModuleEnvironment* thisObject = jsCast<JSModuleEnvironment*>(cell);
+    if (propertyNamesArray.includeStringProperties()) {
+        for (const auto& pair : thisObject->moduleRecord()->importEntries()) {
+            const AbstractModuleRecord::ImportEntry& importEntry = pair.value;
+            if (!importEntry.isNamespace(exec->vm()))
+                propertyNamesArray.add(importEntry.localName);
+        }
+    }
+    return Base::getOwnNonIndexPropertyNames(thisObject, exec, propertyNamesArray, mode);
+}
+
+bool JSModuleEnvironment::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSModuleEnvironment* thisObject = jsCast<JSModuleEnvironment*>(cell);
+    // All imported bindings are immutable.
+    AbstractModuleRecord::Resolution resolution = thisObject->moduleRecord()->resolveImport(exec, Identifier::fromUid(exec, propertyName.uid()));
+    if (resolution.type == AbstractModuleRecord::Resolution::Type::Resolved) {
+        throwTypeError(exec, scope, ASCIILiteral(ReadonlyPropertyWriteError));
+        return false;
+    }
+    return Base::put(thisObject, exec, propertyName, value, slot);
+}
+
+bool JSModuleEnvironment::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    JSModuleEnvironment* thisObject = jsCast<JSModuleEnvironment*>(cell);
+    // All imported bindings are immutable.
+    AbstractModuleRecord::Resolution resolution = thisObject->moduleRecord()->resolveImport(exec, Identifier::fromUid(exec, propertyName.uid()));
+    if (resolution.type == AbstractModuleRecord::Resolution::Type::Resolved)
+        return false;
+    return Base::deleteProperty(thisObject, exec, propertyName);
+}
+
+} // namespace JSC
diff --git a/runtime/JSModuleEnvironment.h b/runtime/JSModuleEnvironment.h
new file mode 100644
index 0000000..c3fd16f
--- /dev/null
+++ b/runtime/JSModuleEnvironment.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSLexicalEnvironment.h"
+
+namespace JSC {
+
+class AbstractModuleRecord;
+class Register;
+
+class JSModuleEnvironment : public JSLexicalEnvironment {
+    friend class JIT;
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef JSLexicalEnvironment Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
+
+    static JSModuleEnvironment* create(VM&, Structure*, JSScope*, SymbolTable*, JSValue initialValue, AbstractModuleRecord*);
+
+    static JSModuleEnvironment* create(VM& vm, JSGlobalObject* globalObject, JSScope* currentScope, SymbolTable* symbolTable, JSValue initialValue, AbstractModuleRecord* moduleRecord)
+    {
+        Structure* structure = globalObject->moduleEnvironmentStructure();
+        return create(vm, structure, currentScope, symbolTable, initialValue, moduleRecord);
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject)
+    {
+        return Structure::create(vm, globalObject, jsNull(), TypeInfo(ModuleEnvironmentType, StructureFlags), info());
+    }
+
+    static size_t offsetOfModuleRecord(SymbolTable* symbolTable)
+    {
+        size_t offset = Base::allocationSize(symbolTable);
+        ASSERT(WTF::roundUpToMultipleOf<sizeof(WriteBarrier<AbstractModuleRecord>)>(offset) == offset);
+        return offset;
+    }
+
+    static size_t allocationSize(SymbolTable* symbolTable)
+    {
+        return offsetOfModuleRecord(symbolTable) + sizeof(WriteBarrier<AbstractModuleRecord>);
+    }
+
+    AbstractModuleRecord* moduleRecord()
+    {
+        return moduleRecordSlot().get();
+    }
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+
+private:
+    JSModuleEnvironment(VM&, Structure*, JSScope*, SymbolTable*);
+
+    void finishCreation(VM&, JSValue initialValue, AbstractModuleRecord*);
+
+    WriteBarrierBase<AbstractModuleRecord>& moduleRecordSlot()
+    {
+        return *bitwise_cast<WriteBarrierBase<AbstractModuleRecord>*>(bitwise_cast<char*>(this) + offsetOfModuleRecord(symbolTable()));
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+};
+
+inline JSModuleEnvironment::JSModuleEnvironment(VM& vm, Structure* structure, JSScope* currentScope, SymbolTable* symbolTable)
+    : Base(vm, structure, currentScope, symbolTable)
+{
+}
+
+} // namespace JSC
diff --git a/runtime/JSModuleLoader.cpp b/runtime/JSModuleLoader.cpp
new file mode 100644
index 0000000..bfd8f49
--- /dev/null
+++ b/runtime/JSModuleLoader.cpp
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSModuleLoader.h"
+
+#include "BuiltinNames.h"
+#include "CodeProfiling.h"
+#include "Error.h"
+#include "Exception.h"
+#include "JSCInlines.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSInternalPromise.h"
+#include "JSInternalPromiseDeferred.h"
+#include "JSMap.h"
+#include "JSModuleEnvironment.h"
+#include "JSModuleRecord.h"
+#include "ModuleAnalyzer.h"
+#include "ModuleLoaderPrototype.h"
+#include "Nodes.h"
+#include "Parser.h"
+#include "ParserError.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSModuleLoader);
+
+const ClassInfo JSModuleLoader::s_info = { "ModuleLoader", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSModuleLoader) };
+
+JSModuleLoader::JSModuleLoader(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void JSModuleLoader::finishCreation(ExecState* exec, VM& vm, JSGlobalObject* globalObject)
+{
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    JSMap* map = JSMap::create(exec, vm, globalObject->mapStructure());
+    RELEASE_ASSERT(!scope.exception());
+    putDirect(vm, Identifier::fromString(&vm, "registry"), map);
+}
+
+// ------------------------------ Functions --------------------------------
+
+static String printableModuleKey(ExecState* exec, JSValue key)
+{
+    if (key.isString() || key.isSymbol())
+        return key.toPropertyKey(exec).impl();
+    return exec->propertyNames().emptyIdentifier.impl();
+}
+
+JSValue JSModuleLoader::provide(ExecState* exec, JSValue key, Status status, const String& source)
+{
+    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().providePublicName()));
+    CallData callData;
+    CallType callType = JSC::getCallData(function, callData);
+    ASSERT(callType != CallType::None);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(key);
+    arguments.append(jsNumber(status));
+    arguments.append(jsString(exec, source));
+
+    return call(exec, function, callType, callData, this, arguments);
+}
+
+JSInternalPromise* JSModuleLoader::loadAndEvaluateModule(ExecState* exec, JSValue moduleName, JSValue referrer, JSValue initiator)
+{
+    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().loadAndEvaluateModulePublicName()));
+    CallData callData;
+    CallType callType = JSC::getCallData(function, callData);
+    ASSERT(callType != CallType::None);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(moduleName);
+    arguments.append(referrer);
+    arguments.append(initiator);
+
+    return jsCast<JSInternalPromise*>(call(exec, function, callType, callData, this, arguments));
+}
+
+JSInternalPromise* JSModuleLoader::loadModule(ExecState* exec, JSValue moduleName, JSValue referrer, JSValue initiator)
+{
+    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().loadModulePublicName()));
+    CallData callData;
+    CallType callType = JSC::getCallData(function, callData);
+    ASSERT(callType != CallType::None);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(moduleName);
+    arguments.append(referrer);
+    arguments.append(initiator);
+
+    return jsCast<JSInternalPromise*>(call(exec, function, callType, callData, this, arguments));
+}
+
+JSValue JSModuleLoader::linkAndEvaluateModule(ExecState* exec, JSValue moduleKey, JSValue initiator)
+{
+    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().linkAndEvaluateModulePublicName()));
+    CallData callData;
+    CallType callType = JSC::getCallData(function, callData);
+    ASSERT(callType != CallType::None);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(moduleKey);
+    arguments.append(initiator);
+
+    return call(exec, function, callType, callData, this, arguments);
+}
+
+JSInternalPromise* JSModuleLoader::resolve(ExecState* exec, JSValue name, JSValue referrer, JSValue initiator)
+{
+    if (Options::dumpModuleLoadingState())
+        dataLog("Loader [resolve] ", printableModuleKey(exec, name), "\n");
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    if (globalObject->globalObjectMethodTable()->moduleLoaderResolve)
+        return globalObject->globalObjectMethodTable()->moduleLoaderResolve(globalObject, exec, this, name, referrer, initiator);
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    deferred->resolve(exec, name);
+    return deferred->promise();
+}
+
+JSInternalPromise* JSModuleLoader::fetch(ExecState* exec, JSValue key, JSValue initiator)
+{
+    if (Options::dumpModuleLoadingState())
+        dataLog("Loader [fetch] ", printableModuleKey(exec, key), "\n");
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    if (globalObject->globalObjectMethodTable()->moduleLoaderFetch)
+        return globalObject->globalObjectMethodTable()->moduleLoaderFetch(globalObject, exec, this, key, initiator);
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    String moduleKey = key.toWTFString(exec);
+    if (UNLIKELY(scope.exception())) {
+        JSValue exception = scope.exception()->value();
+        scope.clearException();
+        deferred->reject(exec, exception);
+        return deferred->promise();
+    }
+    deferred->reject(exec, createError(exec, makeString("Could not open the module '", moduleKey, "'.")));
+    return deferred->promise();
+}
+
+JSInternalPromise* JSModuleLoader::instantiate(ExecState* exec, JSValue key, JSValue source, JSValue initiator)
+{
+    if (Options::dumpModuleLoadingState())
+        dataLog("Loader [instantiate] ", printableModuleKey(exec, key), "\n");
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    if (globalObject->globalObjectMethodTable()->moduleLoaderInstantiate)
+        return globalObject->globalObjectMethodTable()->moduleLoaderInstantiate(globalObject, exec, this, key, source, initiator);
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    deferred->resolve(exec, jsUndefined());
+    return deferred->promise();
+}
+
+JSValue JSModuleLoader::evaluate(ExecState* exec, JSValue key, JSValue moduleRecordValue, JSValue initiator)
+{
+    if (Options::dumpModuleLoadingState())
+        dataLog("Loader [evaluate] ", printableModuleKey(exec, key), "\n");
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    if (globalObject->globalObjectMethodTable()->moduleLoaderEvaluate)
+        return globalObject->globalObjectMethodTable()->moduleLoaderEvaluate(globalObject, exec, this, key, moduleRecordValue, initiator);
+
+    JSModuleRecord* moduleRecord = jsDynamicCast<JSModuleRecord*>(moduleRecordValue);
+    if (!moduleRecord)
+        return jsUndefined();
+    return moduleRecord->evaluate(exec);
+}
+
+} // namespace JSC
diff --git a/runtime/JSModuleLoader.h b/runtime/JSModuleLoader.h
new file mode 100644
index 0000000..d3bb3bc
--- /dev/null
+++ b/runtime/JSModuleLoader.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSInternalPromise;
+
+class JSModuleLoader : public JSNonFinalObject {
+private:
+    JSModuleLoader(VM&, Structure*);
+public:
+    typedef JSNonFinalObject Base;
+
+    enum Status {
+        Fetch = 1,
+        Instantiate,
+        Satisfy,
+        Link,
+        Ready,
+    };
+
+    static JSModuleLoader* create(ExecState* exec, VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        JSModuleLoader* object = new (NotNull, allocateCell<JSModuleLoader>(vm.heap)) JSModuleLoader(vm, structure);
+        object->finishCreation(exec, vm, globalObject);
+        return object;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    // APIs to control the module loader.
+    JSValue provide(ExecState*, JSValue key, Status, const String&);
+    JSInternalPromise* loadAndEvaluateModule(ExecState*, JSValue moduleName, JSValue referrer, JSValue initiator);
+    JSInternalPromise* loadModule(ExecState*, JSValue moduleName, JSValue referrer, JSValue initiator);
+    JSValue linkAndEvaluateModule(ExecState*, JSValue moduleKey, JSValue initiator);
+
+    // Platform dependent hooked APIs.
+    JSInternalPromise* resolve(ExecState*, JSValue name, JSValue referrer, JSValue initiator);
+    JSInternalPromise* fetch(ExecState*, JSValue key, JSValue initiator);
+    JSInternalPromise* instantiate(ExecState*, JSValue key, JSValue source, JSValue initiator);
+
+    // Additional platform dependent hooked APIs.
+    JSValue evaluate(ExecState*, JSValue key, JSValue moduleRecord, JSValue initiator);
+
+protected:
+    void finishCreation(ExecState*, VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSModuleNamespaceObject.cpp b/runtime/JSModuleNamespaceObject.cpp
new file mode 100644
index 0000000..b91ee0f
--- /dev/null
+++ b/runtime/JSModuleNamespaceObject.cpp
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSModuleNamespaceObject.h"
+
+#include "AbstractModuleRecord.h"
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSModuleEnvironment.h"
+#include "JSPropertyNameIterator.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL moduleNamespaceObjectSymbolIterator(ExecState*);
+
+const ClassInfo JSModuleNamespaceObject::s_info = { "ModuleNamespaceObject", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSModuleNamespaceObject) };
+
+
+JSModuleNamespaceObject::JSModuleNamespaceObject(VM& vm, Structure* structure)
+    : Base(vm, structure)
+    , m_exports()
+{
+}
+
+void JSModuleNamespaceObject::finishCreation(ExecState* exec, JSGlobalObject* globalObject, AbstractModuleRecord* moduleRecord, const IdentifierSet& exports)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects
+    // Quoted from the spec:
+    //     A List containing the String values of the exported names exposed as own properties of this object.
+    //     The list is ordered as if an Array of those String values had been sorted using Array.prototype.sort using SortCompare as comparefn.
+    //
+    // Sort the exported names by the code point order.
+    Vector<UniquedStringImpl*> temporaryVector(exports.size(), nullptr);
+    std::transform(exports.begin(), exports.end(), temporaryVector.begin(), [](const RefPtr<WTF::UniquedStringImpl>& ref) {
+        return ref.get();
+    });
+    std::sort(temporaryVector.begin(), temporaryVector.end(), [] (UniquedStringImpl* lhs, UniquedStringImpl* rhs) {
+        return codePointCompare(lhs, rhs) < 0;
+    });
+    for (auto* identifier : temporaryVector)
+        m_exports.add(identifier);
+
+    m_moduleRecord.set(vm, this, moduleRecord);
+    JSFunction* iteratorFunction = JSFunction::create(vm, globalObject, 0, ASCIILiteral("[Symbol.iterator]"), moduleNamespaceObjectSymbolIterator, NoIntrinsic);
+    putDirect(vm, vm.propertyNames->iteratorSymbol, iteratorFunction, DontEnum);
+    putDirect(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Module"), DontEnum | ReadOnly);
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-getprototypeof
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-setprototypeof-v
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-isextensible
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-preventextensions
+    methodTable(vm)->preventExtensions(this, exec);
+    ASSERT_UNUSED(scope, !scope.exception());
+}
+
+void JSModuleNamespaceObject::destroy(JSCell* cell)
+{
+    JSModuleNamespaceObject* thisObject = static_cast<JSModuleNamespaceObject*>(cell);
+    thisObject->JSModuleNamespaceObject::~JSModuleNamespaceObject();
+}
+
+void JSModuleNamespaceObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSModuleNamespaceObject* thisObject = jsCast<JSModuleNamespaceObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_moduleRecord);
+}
+
+bool JSModuleNamespaceObject::getOwnPropertySlot(JSObject* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-getownproperty-p
+
+    JSModuleNamespaceObject* thisObject = jsCast<JSModuleNamespaceObject*>(cell);
+
+    // step 1.
+    // If the property name is a symbol, we don't look into the imported bindings.
+    // It may return the descriptor with writable: true, but namespace objects does not allow it in [[Set]] / [[DefineOwnProperty]] side.
+    if (propertyName.isSymbol())
+        return JSObject::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+
+    // FIXME: Add IC for module namespace object.
+    // https://bugs.webkit.org/show_bug.cgi?id=160590
+    slot.disableCaching();
+    slot.setIsTaintedByOpaqueObject();
+    if (!thisObject->m_exports.contains(propertyName.uid()))
+        return false;
+
+    switch (slot.internalMethodType()) {
+    case PropertySlot::InternalMethodType::Get:
+    case PropertySlot::InternalMethodType::GetOwnProperty: {
+        AbstractModuleRecord* moduleRecord = thisObject->moduleRecord();
+
+        AbstractModuleRecord::Resolution resolution = moduleRecord->resolveExport(exec, Identifier::fromUid(exec, propertyName.uid()));
+        ASSERT(resolution.type != AbstractModuleRecord::Resolution::Type::NotFound && resolution.type != AbstractModuleRecord::Resolution::Type::Ambiguous);
+
+        AbstractModuleRecord* targetModule = resolution.moduleRecord;
+        JSModuleEnvironment* targetEnvironment = targetModule->moduleEnvironment();
+
+        PropertySlot trampolineSlot(targetEnvironment, PropertySlot::InternalMethodType::Get);
+        bool found = targetEnvironment->methodTable(vm)->getOwnPropertySlot(targetEnvironment, exec, resolution.localName, trampolineSlot);
+        ASSERT_UNUSED(found, found);
+
+        JSValue value = trampolineSlot.getValue(exec, propertyName);
+        ASSERT(!scope.exception());
+
+        // If the value is filled with TDZ value, throw a reference error.
+        if (!value) {
+            throwVMError(exec, scope, createTDZError(exec));
+            return false;
+        }
+
+        slot.setValue(thisObject, DontDelete, value);
+        return true;
+    }
+    case PropertySlot::InternalMethodType::HasProperty: {
+        // Do not perform [[Get]] for [[HasProperty]].
+        // [[Get]] / [[GetOwnProperty]] onto namespace object could throw an error while [[HasProperty]] just returns true here.
+        // https://tc39.github.io/ecma262/#sec-module-namespace-exotic-objects-hasproperty-p
+        slot.setValue(thisObject, DontDelete, jsUndefined());
+        return true;
+    }
+
+    case PropertySlot::InternalMethodType::VMInquiry:
+        return false;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool JSModuleNamespaceObject::put(JSCell*, ExecState* exec, PropertyName, JSValue, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-set-p-v-receiver
+    if (slot.isStrictMode())
+        throwTypeError(exec, scope, ASCIILiteral(ReadonlyPropertyWriteError));
+    return false;
+}
+
+bool JSModuleNamespaceObject::putByIndex(JSCell*, ExecState* exec, unsigned, JSValue, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (shouldThrow)
+        throwTypeError(exec, scope, ASCIILiteral(ReadonlyPropertyWriteError));
+    return false;
+}
+
+bool JSModuleNamespaceObject::deleteProperty(JSCell* cell, ExecState*, PropertyName propertyName)
+{
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-delete-p
+    JSModuleNamespaceObject* thisObject = jsCast<JSModuleNamespaceObject*>(cell);
+    return !thisObject->m_exports.contains(propertyName.uid());
+}
+
+void JSModuleNamespaceObject::getOwnPropertyNames(JSObject* cell, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-ownpropertykeys
+    JSModuleNamespaceObject* thisObject = jsCast<JSModuleNamespaceObject*>(cell);
+    for (const auto& name : thisObject->m_exports)
+        propertyNames.add(name.get());
+    return JSObject::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
+}
+
+bool JSModuleNamespaceObject::defineOwnProperty(JSObject*, ExecState* exec, PropertyName, const PropertyDescriptor&, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-defineownproperty-p-desc
+    if (shouldThrow)
+        throwTypeError(exec, scope, ASCIILiteral(NonExtensibleObjectPropertyDefineError));
+    return false;
+}
+
+EncodedJSValue JSC_HOST_CALL moduleNamespaceObjectSymbolIterator(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSModuleNamespaceObject* object = jsDynamicCast<JSModuleNamespaceObject*>(exec->thisValue());
+    if (!object)
+        return throwVMTypeError(exec, scope, ASCIILiteral("|this| should be a module namespace object"));
+    return JSValue::encode(JSPropertyNameIterator::create(exec, exec->lexicalGlobalObject()->propertyNameIteratorStructure(), object));
+}
+
+} // namespace JSC
diff --git a/runtime/JSModuleNamespaceObject.h b/runtime/JSModuleNamespaceObject.h
new file mode 100644
index 0000000..b72f543
--- /dev/null
+++ b/runtime/JSModuleNamespaceObject.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSDestructibleObject.h"
+#include <wtf/ListHashSet.h>
+
+namespace JSC {
+
+class AbstractModuleRecord;
+
+class JSModuleNamespaceObject : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames | GetOwnPropertySlotIsImpureForPropertyAbsence | IsImmutablePrototypeExoticObject;
+
+    static JSModuleNamespaceObject* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, AbstractModuleRecord* moduleRecord, const IdentifierSet& exports)
+    {
+        JSModuleNamespaceObject* object = new (NotNull, allocateCell<JSModuleNamespaceObject>(exec->vm().heap)) JSModuleNamespaceObject(exec->vm(), structure);
+        object->finishCreation(exec, globalObject, moduleRecord, exports);
+        return object;
+    }
+
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    JS_EXPORT_PRIVATE static bool putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    AbstractModuleRecord* moduleRecord() { return m_moduleRecord.get(); }
+
+protected:
+    JS_EXPORT_PRIVATE void finishCreation(ExecState*, JSGlobalObject*, AbstractModuleRecord*, const IdentifierSet& exports);
+    JS_EXPORT_PRIVATE JSModuleNamespaceObject(VM&, Structure*);
+
+private:
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    typedef WTF::ListHashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> OrderedIdentifierSet;
+
+    OrderedIdentifierSet m_exports;
+    WriteBarrier<AbstractModuleRecord> m_moduleRecord;
+};
+
+} // namespace JSC
diff --git a/runtime/JSModuleRecord.cpp b/runtime/JSModuleRecord.cpp
new file mode 100644
index 0000000..9f73523
--- /dev/null
+++ b/runtime/JSModuleRecord.cpp
@@ -0,0 +1,212 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSModuleRecord.h"
+
+#include "Error.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSModuleEnvironment.h"
+#include "JSModuleNamespaceObject.h"
+#include "UnlinkedModuleProgramCodeBlock.h"
+
+namespace JSC {
+
+const ClassInfo JSModuleRecord::s_info = { "ModuleRecord", &Base::s_info, 0, CREATE_METHOD_TABLE(JSModuleRecord) };
+
+
+Structure* JSModuleRecord::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSModuleRecord* JSModuleRecord::create(ExecState* exec, VM& vm, Structure* structure, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables)
+{
+    JSModuleRecord* instance = new (NotNull, allocateCell<JSModuleRecord>(vm.heap)) JSModuleRecord(vm, structure, moduleKey, sourceCode, declaredVariables, lexicalVariables);
+    instance->finishCreation(exec, vm);
+    return instance;
+}
+JSModuleRecord::JSModuleRecord(VM& vm, Structure* structure, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables)
+    : Base(vm, structure, moduleKey)
+    , m_sourceCode(sourceCode)
+    , m_declaredVariables(declaredVariables)
+    , m_lexicalVariables(lexicalVariables)
+{
+}
+
+void JSModuleRecord::destroy(JSCell* cell)
+{
+    JSModuleRecord* thisObject = static_cast<JSModuleRecord*>(cell);
+    thisObject->JSModuleRecord::~JSModuleRecord();
+}
+
+void JSModuleRecord::finishCreation(ExecState* exec, VM& vm)
+{
+    Base::finishCreation(exec, vm);
+    ASSERT(inherits(info()));
+}
+
+void JSModuleRecord::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSModuleRecord* thisObject = jsCast<JSModuleRecord*>(cell);
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_moduleProgramExecutable);
+}
+
+void JSModuleRecord::link(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    ModuleProgramExecutable* executable = ModuleProgramExecutable::create(exec, sourceCode());
+    if (!executable) {
+        throwSyntaxError(exec, scope);
+        return;
+    }
+    m_moduleProgramExecutable.set(vm, this, executable);
+    instantiateDeclarations(exec, executable);
+}
+
+void JSModuleRecord::instantiateDeclarations(ExecState* exec, ModuleProgramExecutable* moduleProgramExecutable)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
+
+    SymbolTable* symbolTable = moduleProgramExecutable->moduleEnvironmentSymbolTable();
+    JSModuleEnvironment* moduleEnvironment = JSModuleEnvironment::create(vm, exec->lexicalGlobalObject(), exec->lexicalGlobalObject(), symbolTable, jsTDZValue(), this);
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
+    // section 15.2.1.16.4 step 9.
+    // Ensure all the indirect exports are correctly resolved to unique bindings.
+    // Even if we avoided duplicate exports in the parser, still ambiguous exports occur due to the star export (`export * from "mod"`).
+    // When we see this type of ambiguity for the indirect exports here, throw a syntax error.
+    for (const auto& pair : exportEntries()) {
+        const ExportEntry& exportEntry = pair.value;
+        if (exportEntry.type == JSModuleRecord::ExportEntry::Type::Indirect) {
+            Resolution resolution = resolveExport(exec, exportEntry.exportName);
+            switch (resolution.type) {
+            case Resolution::Type::NotFound:
+                throwSyntaxError(exec, scope, makeString("Indirectly exported binding name '", String(exportEntry.exportName.impl()), "' is not found."));
+                return;
+
+            case Resolution::Type::Ambiguous:
+                throwSyntaxError(exec, scope, makeString("Indirectly exported binding name '", String(exportEntry.exportName.impl()), "' cannot be resolved due to ambiguous multiple bindings."));
+                return;
+
+            case Resolution::Type::Error:
+                throwSyntaxError(exec, scope, makeString("Indirectly exported binding name 'default' cannot be resolved by star export entries."));
+                return;
+
+            case Resolution::Type::Resolved:
+                break;
+            }
+        }
+    }
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
+    // section 15.2.1.16.4 step 12.
+    // Instantiate namespace objects and initialize the bindings with them if required.
+    // And ensure that all the imports correctly resolved to unique bindings.
+    for (const auto& pair : importEntries()) {
+        const ImportEntry& importEntry = pair.value;
+        AbstractModuleRecord* importedModule = hostResolveImportedModule(exec, importEntry.moduleRequest);
+        if (importEntry.isNamespace(vm)) {
+            JSModuleNamespaceObject* namespaceObject = importedModule->getModuleNamespace(exec);
+            RETURN_IF_EXCEPTION(scope, void());
+            bool putResult = false;
+            symbolTablePutTouchWatchpointSet(moduleEnvironment, exec, importEntry.localName, namespaceObject, /* shouldThrowReadOnlyError */ false, /* ignoreReadOnlyErrors */ true, putResult);
+        } else {
+            Resolution resolution = importedModule->resolveExport(exec, importEntry.importName);
+            switch (resolution.type) {
+            case Resolution::Type::NotFound:
+                throwSyntaxError(exec, scope, makeString("Importing binding name '", String(importEntry.importName.impl()), "' is not found."));
+                return;
+
+            case Resolution::Type::Ambiguous:
+                throwSyntaxError(exec, scope, makeString("Importing binding name '", String(importEntry.importName.impl()), "' cannot be resolved due to ambiguous multiple bindings."));
+                return;
+
+            case Resolution::Type::Error:
+                throwSyntaxError(exec, scope, makeString("Importing binding name 'default' cannot be resolved by star export entries."));
+                return;
+
+            case Resolution::Type::Resolved:
+                break;
+            }
+        }
+    }
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
+    // section 15.2.1.16.4 step 14.
+    // Module environment contains the heap allocated "var", "function", "let", "const", and "class".
+    // When creating the environment, we initialized all the slots with empty, it's ok for lexical values.
+    // But for "var" and "function", we should initialize it with undefined. They are contained in the declared variables.
+    for (const auto& variable : declaredVariables()) {
+        SymbolTableEntry entry = symbolTable->get(variable.key.get());
+        VarOffset offset = entry.varOffset();
+        if (!offset.isStack()) {
+            bool putResult = false;
+            symbolTablePutTouchWatchpointSet(moduleEnvironment, exec, Identifier::fromUid(exec, variable.key.get()), jsUndefined(), /* shouldThrowReadOnlyError */ false, /* ignoreReadOnlyErrors */ true, putResult);
+        }
+    }
+
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
+    // section 15.2.1.16.4 step 16-a-iv.
+    // Initialize heap allocated function declarations.
+    // They can be called before the body of the module is executed under circular dependencies.
+    UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock = moduleProgramExecutable->unlinkedModuleProgramCodeBlock();
+    for (size_t i = 0, numberOfFunctions = unlinkedCodeBlock->numberOfFunctionDecls(); i < numberOfFunctions; ++i) {
+        UnlinkedFunctionExecutable* unlinkedFunctionExecutable = unlinkedCodeBlock->functionDecl(i);
+        SymbolTableEntry entry = symbolTable->get(unlinkedFunctionExecutable->name().impl());
+        VarOffset offset = entry.varOffset();
+        if (!offset.isStack()) {
+            ASSERT(!unlinkedFunctionExecutable->name().isEmpty());
+            if (vm.typeProfiler() || vm.controlFlowProfiler()) {
+                vm.functionHasExecutedCache()->insertUnexecutedRange(moduleProgramExecutable->sourceID(),
+                    unlinkedFunctionExecutable->typeProfilingStartOffset(),
+                    unlinkedFunctionExecutable->typeProfilingEndOffset());
+            }
+            JSFunction* function = JSFunction::create(vm, unlinkedFunctionExecutable->link(vm, moduleProgramExecutable->source()), moduleEnvironment);
+            bool putResult = false;
+            symbolTablePutTouchWatchpointSet(moduleEnvironment, exec, unlinkedFunctionExecutable->name(), function, /* shouldThrowReadOnlyError */ false, /* ignoreReadOnlyErrors */ true, putResult);
+        }
+    }
+
+    m_moduleEnvironment.set(vm, this, moduleEnvironment);
+}
+
+JSValue JSModuleRecord::evaluate(ExecState* exec)
+{
+    if (!m_moduleProgramExecutable)
+        return jsUndefined();
+    JSValue result = exec->interpreter()->execute(m_moduleProgramExecutable.get(), exec, m_moduleEnvironment.get());
+    m_moduleProgramExecutable.clear();
+    return result;
+}
+
+} // namespace JSC
diff --git a/runtime/JSModuleRecord.h b/runtime/JSModuleRecord.h
new file mode 100644
index 0000000..9e69b0f
--- /dev/null
+++ b/runtime/JSModuleRecord.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "AbstractModuleRecord.h"
+
+namespace JSC {
+
+class ModuleProgramExecutable;
+
+// Based on the Source Text Module Record
+// http://www.ecma-international.org/ecma-262/6.0/#sec-source-text-module-records
+class JSModuleRecord : public AbstractModuleRecord {
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef AbstractModuleRecord Base;
+
+    DECLARE_EXPORT_INFO;
+
+    JSModuleEnvironment* moduleEnvironment()
+    {
+        ASSERT(m_moduleEnvironment);
+        return m_moduleEnvironment.get();
+    }
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+    static JSModuleRecord* create(ExecState*, VM&, Structure*, const Identifier&, const SourceCode&, const VariableEnvironment&, const VariableEnvironment&);
+
+    void link(ExecState*);
+    JS_EXPORT_PRIVATE JSValue evaluate(ExecState*);
+
+    const SourceCode& sourceCode() const { return m_sourceCode; }
+    const VariableEnvironment& declaredVariables() const { return m_declaredVariables; }
+    const VariableEnvironment& lexicalVariables() const { return m_lexicalVariables; }
+
+    ModuleProgramExecutable* moduleProgramExecutable() const { return m_moduleProgramExecutable.get(); }
+
+private:
+    JSModuleRecord(VM&, Structure*, const Identifier&, const SourceCode&, const VariableEnvironment&, const VariableEnvironment&);
+
+    void finishCreation(ExecState*, VM&);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static void destroy(JSCell*);
+
+    void instantiateDeclarations(ExecState*, ModuleProgramExecutable*);
+
+    SourceCode m_sourceCode;
+    VariableEnvironment m_declaredVariables;
+    VariableEnvironment m_lexicalVariables;
+    WriteBarrier<ModuleProgramExecutable> m_moduleProgramExecutable;
+};
+
+} // namespace JSC
diff --git a/runtime/JSNativeStdFunction.cpp b/runtime/JSNativeStdFunction.cpp
new file mode 100644
index 0000000..5d56d9b
--- /dev/null
+++ b/runtime/JSNativeStdFunction.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSNativeStdFunction.h"
+
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSFunctionInlines.h"
+#include "JSObject.h"
+#include "NativeStdFunctionCell.h"
+#include "VM.h"
+
+namespace JSC {
+
+const ClassInfo JSNativeStdFunction::s_info = { "Function", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSNativeStdFunction) };
+
+JSNativeStdFunction::JSNativeStdFunction(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    : Base(vm, globalObject, structure)
+{
+}
+
+void JSNativeStdFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSNativeStdFunction* thisObject = jsCast<JSNativeStdFunction*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_functionCell);
+}
+
+void JSNativeStdFunction::finishCreation(VM& vm, NativeExecutable* executable, int length, const String& name, NativeStdFunctionCell* functionCell)
+{
+    Base::finishCreation(vm, executable, length, name);
+    ASSERT(inherits(info()));
+    m_functionCell.set(vm, this, functionCell);
+}
+
+static EncodedJSValue JSC_HOST_CALL runStdFunction(ExecState* state)
+{
+    JSNativeStdFunction* function = jsCast<JSNativeStdFunction*>(state->jsCallee());
+    ASSERT(function);
+    return function->nativeStdFunctionCell()->function()(state);
+}
+
+JSNativeStdFunction* JSNativeStdFunction::create(VM& vm, JSGlobalObject* globalObject, int length, const String& name, NativeStdFunction&& nativeStdFunction, Intrinsic intrinsic, NativeFunction nativeConstructor)
+{
+    NativeExecutable* executable = vm.getHostFunction(runStdFunction, intrinsic, nativeConstructor, nullptr, name);
+    NativeStdFunctionCell* functionCell = NativeStdFunctionCell::create(vm, WTFMove(nativeStdFunction));
+    Structure* structure = globalObject->nativeStdFunctionStructure();
+    JSNativeStdFunction* function = new (NotNull, allocateCell<JSNativeStdFunction>(vm.heap)) JSNativeStdFunction(vm, globalObject, structure);
+    function->finishCreation(vm, executable, length, name, functionCell);
+    return function;
+}
+
+} // namespace JSC
diff --git a/runtime/JSNativeStdFunction.h b/runtime/JSNativeStdFunction.h
new file mode 100644
index 0000000..ef0daff
--- /dev/null
+++ b/runtime/JSNativeStdFunction.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSFunction.h"
+
+namespace JSC {
+
+class JSGlobalObject;
+class NativeStdFunctionCell;
+
+typedef std::function<EncodedJSValue (ExecState*)> NativeStdFunction;
+
+class JSNativeStdFunction : public JSFunction {
+public:
+    typedef JSFunction Base;
+
+    const static unsigned StructureFlags = Base::StructureFlags;
+
+    DECLARE_EXPORT_INFO;
+
+    JS_EXPORT_PRIVATE static JSNativeStdFunction* create(VM&, JSGlobalObject*, int length, const String& name, NativeStdFunction&&, Intrinsic = NoIntrinsic, NativeFunction nativeConstructor = callHostFunctionAsConstructor);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info());
+    }
+
+    NativeStdFunctionCell* nativeStdFunctionCell() { return m_functionCell.get(); }
+
+protected:
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    void finishCreation(VM&, NativeExecutable*, int length, const String& name, NativeStdFunctionCell*);
+
+private:
+    JSNativeStdFunction(VM&, JSGlobalObject*, Structure*);
+
+    WriteBarrier<NativeStdFunctionCell> m_functionCell;
+};
+
+} // namespace JSC
diff --git a/runtime/JSONObject.cpp b/runtime/JSONObject.cpp
new file mode 100644
index 0000000..2957ae2
--- /dev/null
+++ b/runtime/JSONObject.cpp
@@ -0,0 +1,871 @@
+/*
+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSONObject.h"
+
+#include "ArrayConstructor.h"
+#include "BooleanObject.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSArray.h"
+#include "JSGlobalObject.h"
+#include "LiteralParser.h"
+#include "Local.h"
+#include "LocalScope.h"
+#include "Lookup.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+#include "PropertyNameArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSONObject);
+
+EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState*);
+EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState*);
+
+}
+
+#include "JSONObject.lut.h"
+
+namespace JSC {
+
+JSONObject::JSONObject(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void JSONObject::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "JSON"), DontEnum | ReadOnly);
+}
+
+// PropertyNameForFunctionCall objects must be on the stack, since the JSValue that they create is not marked.
+class PropertyNameForFunctionCall {
+public:
+    PropertyNameForFunctionCall(const Identifier&);
+    PropertyNameForFunctionCall(unsigned);
+
+    JSValue value(ExecState*) const;
+
+private:
+    const Identifier* m_identifier;
+    unsigned m_number;
+    mutable JSValue m_value;
+};
+
+class Stringifier {
+    WTF_MAKE_NONCOPYABLE(Stringifier);
+public:
+    Stringifier(ExecState*, const Local<Unknown>& replacer, const Local<Unknown>& space);
+    Local<Unknown> stringify(Handle<Unknown>);
+
+    void visitAggregate(SlotVisitor&);
+
+private:
+    class Holder {
+    public:
+        enum RootHolderTag { RootHolder };
+        Holder(VM&, ExecState*, JSObject*);
+        Holder(RootHolderTag, VM&, JSObject*);
+
+        JSObject* object() const { return m_object.get(); }
+        bool isArray() const { return m_isArray; }
+
+        bool appendNextProperty(Stringifier&, StringBuilder&);
+
+    private:
+        Local<JSObject> m_object;
+        const bool m_isArray;
+        const bool m_isJSArray;
+        unsigned m_index;
+        unsigned m_size;
+        RefPtr<PropertyNameArrayData> m_propertyNames;
+    };
+
+    friend class Holder;
+
+    JSValue toJSON(JSValue, const PropertyNameForFunctionCall&);
+    JSValue toJSONImpl(JSValue value, JSValue toJSONFunction, const PropertyNameForFunctionCall&);
+
+    enum StringifyResult { StringifyFailed, StringifySucceeded, StringifyFailedDueToUndefinedOrSymbolValue };
+    StringifyResult appendStringifiedValue(StringBuilder&, JSValue, const Holder&, const PropertyNameForFunctionCall&);
+
+    bool willIndent() const;
+    void indent();
+    void unindent();
+    void startNewLine(StringBuilder&) const;
+
+    ExecState* const m_exec;
+    const Local<Unknown> m_replacer;
+    bool m_usingArrayReplacer;
+    PropertyNameArray m_arrayReplacerPropertyNames;
+    CallType m_replacerCallType;
+    CallData m_replacerCallData;
+    String m_gap;
+
+    Vector<Holder, 16, UnsafeVectorOverflow> m_holderStack;
+    String m_repeatedGap;
+    String m_indent;
+};
+
+// ------------------------------ helper functions --------------------------------
+
+static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
+{
+    if (!value.isObject())
+        return value;
+    JSObject* object = asObject(value);
+    if (object->inherits(NumberObject::info()))
+        return jsNumber(object->toNumber(exec));
+    if (object->inherits(StringObject::info()))
+        return object->toString(exec);
+    if (object->inherits(BooleanObject::info()))
+        return object->toPrimitive(exec);
+
+    // Do not unwrap SymbolObject to Symbol. It is not performed in the spec.
+    // http://www.ecma-international.org/ecma-262/6.0/#sec-serializejsonproperty
+    return value;
+}
+
+static inline String gap(ExecState* exec, JSValue space)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    const unsigned maxGapLength = 10;
+    space = unwrapBoxedPrimitive(exec, space);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    // If the space value is a number, create a gap string with that number of spaces.
+    if (space.isNumber()) {
+        double spaceCount = space.asNumber();
+        int count;
+        if (spaceCount > maxGapLength)
+            count = maxGapLength;
+        else if (!(spaceCount > 0))
+            count = 0;
+        else
+            count = static_cast<int>(spaceCount);
+        UChar spaces[maxGapLength];
+        for (int i = 0; i < count; ++i)
+            spaces[i] = ' ';
+        return String(spaces, count);
+    }
+
+    // If the space value is a string, use it as the gap string, otherwise use no gap string.
+    String spaces = space.getString(exec);
+    if (spaces.length() > maxGapLength) {
+        spaces = spaces.substringSharingImpl(0, maxGapLength);
+    }
+    return spaces;
+}
+
+// ------------------------------ PropertyNameForFunctionCall --------------------------------
+
+inline PropertyNameForFunctionCall::PropertyNameForFunctionCall(const Identifier& identifier)
+    : m_identifier(&identifier)
+{
+}
+
+inline PropertyNameForFunctionCall::PropertyNameForFunctionCall(unsigned number)
+    : m_identifier(0)
+    , m_number(number)
+{
+}
+
+JSValue PropertyNameForFunctionCall::value(ExecState* exec) const
+{
+    if (!m_value) {
+        if (m_identifier)
+            m_value = jsString(exec, m_identifier->string());
+        else {
+            VM& vm = exec->vm();
+            if (m_number <= 9)
+                return vm.smallStrings.singleCharacterString(m_number + '0');
+            m_value = jsNontrivialString(&vm, vm.numericStrings.add(m_number));
+        }
+    }
+    return m_value;
+}
+
+// ------------------------------ Stringifier --------------------------------
+
+Stringifier::Stringifier(ExecState* exec, const Local<Unknown>& replacer, const Local<Unknown>& space)
+    : m_exec(exec)
+    , m_replacer(replacer)
+    , m_usingArrayReplacer(false)
+    , m_arrayReplacerPropertyNames(exec, PropertyNameMode::Strings)
+    , m_replacerCallType(CallType::None)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    m_gap = gap(exec, space.get());
+    if (UNLIKELY(scope.exception()))
+        return;
+
+    if (!m_replacer.isObject())
+        return;
+
+    if (m_replacer.asObject()->inherits(JSArray::info())) {
+        m_usingArrayReplacer = true;
+        Handle<JSObject> array = m_replacer.asObject();
+        unsigned length = array->get(exec, vm.propertyNames->length).toUInt32(exec);
+        if (UNLIKELY(scope.exception()))
+            return;
+        for (unsigned i = 0; i < length; ++i) {
+            JSValue name = array->get(exec, i);
+            if (UNLIKELY(scope.exception()))
+                break;
+
+            if (name.isObject()) {
+                if (!asObject(name)->inherits(NumberObject::info()) && !asObject(name)->inherits(StringObject::info()))
+                    continue;
+            } else if (!name.isNumber() && !name.isString())
+                continue;
+
+            m_arrayReplacerPropertyNames.add(name.toString(exec)->toIdentifier(exec));
+        }
+        return;
+    }
+
+    m_replacerCallType = m_replacer.asObject()->methodTable()->getCallData(m_replacer.asObject().get(), m_replacerCallData);
+}
+
+Local<Unknown> Stringifier::stringify(Handle<Unknown> value)
+{
+    VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* object = constructEmptyObject(m_exec);
+    RETURN_IF_EXCEPTION(scope, Local<Unknown>(vm, jsNull()));
+
+    PropertyNameForFunctionCall emptyPropertyName(vm.propertyNames->emptyIdentifier);
+    object->putDirect(vm, vm.propertyNames->emptyIdentifier, value.get());
+
+    StringBuilder result;
+    Holder root(Holder::RootHolder, vm, object);
+    auto stringifyResult = appendStringifiedValue(result, value.get(), root, emptyPropertyName);
+    ASSERT(!scope.exception() || (stringifyResult != StringifySucceeded));
+    if (UNLIKELY(stringifyResult != StringifySucceeded))
+        return Local<Unknown>(vm, jsUndefined());
+
+    scope.release();
+    return Local<Unknown>(vm, jsString(m_exec, result.toString()));
+}
+
+ALWAYS_INLINE JSValue Stringifier::toJSON(JSValue value, const PropertyNameForFunctionCall& propertyName)
+{
+    VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ASSERT(!scope.exception());
+    if (!value.isObject())
+        return value;
+    
+    JSObject* object = asObject(value);
+    PropertySlot slot(object, PropertySlot::InternalMethodType::Get);
+    bool hasProperty = object->getPropertySlot(m_exec, vm.propertyNames->toJSON, slot);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (!hasProperty)
+        return value;
+
+    JSValue toJSONFunction = slot.getValue(m_exec, vm.propertyNames->toJSON);
+    RETURN_IF_EXCEPTION(scope, { });
+    scope.release();
+    return toJSONImpl(value, toJSONFunction, propertyName);
+}
+
+JSValue Stringifier::toJSONImpl(JSValue value, JSValue toJSONFunction, const PropertyNameForFunctionCall& propertyName)
+{
+    CallType callType;
+    CallData callData;
+    if (!toJSONFunction.isCallable(callType, callData))
+        return value;
+
+    MarkedArgumentBuffer args;
+    args.append(propertyName.value(m_exec));
+    return call(m_exec, asObject(toJSONFunction), callType, callData, value, args);
+}
+
+Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder& builder, JSValue value, const Holder& holder, const PropertyNameForFunctionCall& propertyName)
+{
+    VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // Call the toJSON function.
+    value = toJSON(value, propertyName);
+    RETURN_IF_EXCEPTION(scope, StringifyFailed);
+
+    // Call the replacer function.
+    if (m_replacerCallType != CallType::None) {
+        MarkedArgumentBuffer args;
+        args.append(propertyName.value(m_exec));
+        args.append(value);
+        value = call(m_exec, m_replacer.get(), m_replacerCallType, m_replacerCallData, holder.object(), args);
+        RETURN_IF_EXCEPTION(scope, StringifyFailed);
+    }
+
+    if ((value.isUndefined() || value.isSymbol()) && !holder.isArray())
+        return StringifyFailedDueToUndefinedOrSymbolValue;
+
+    if (value.isNull()) {
+        builder.appendLiteral("null");
+        return StringifySucceeded;
+    }
+
+    value = unwrapBoxedPrimitive(m_exec, value);
+
+    RETURN_IF_EXCEPTION(scope, StringifyFailed);
+
+    if (value.isBoolean()) {
+        if (value.isTrue())
+            builder.appendLiteral("true");
+        else
+            builder.appendLiteral("false");
+        return StringifySucceeded;
+    }
+
+    if (value.isString()) {
+        builder.appendQuotedJSONString(asString(value)->value(m_exec));
+        return StringifySucceeded;
+    }
+
+    if (value.isNumber()) {
+        if (value.isInt32())
+            builder.appendNumber(value.asInt32());
+        else {
+            double number = value.asNumber();
+            if (!std::isfinite(number))
+                builder.appendLiteral("null");
+            else
+                builder.appendECMAScriptNumber(number);
+        }
+        return StringifySucceeded;
+    }
+
+    if (!value.isObject())
+        return StringifyFailed;
+
+    JSObject* object = asObject(value);
+
+    CallData callData;
+    if (object->methodTable()->getCallData(object, callData) != CallType::None) {
+        if (holder.isArray()) {
+            builder.appendLiteral("null");
+            return StringifySucceeded;
+        }
+        return StringifyFailedDueToUndefinedOrSymbolValue;
+    }
+
+    // Handle cycle detection, and put the holder on the stack.
+    for (unsigned i = 0; i < m_holderStack.size(); i++) {
+        if (m_holderStack[i].object() == object) {
+            throwTypeError(m_exec, scope, ASCIILiteral("JSON.stringify cannot serialize cyclic structures."));
+            return StringifyFailed;
+        }
+    }
+
+    bool holderStackWasEmpty = m_holderStack.isEmpty();
+    m_holderStack.append(Holder(vm, m_exec, object));
+    RETURN_IF_EXCEPTION(scope, StringifyFailed);
+    if (!holderStackWasEmpty)
+        return StringifySucceeded;
+
+    do {
+        while (m_holderStack.last().appendNextProperty(*this, builder))
+            RETURN_IF_EXCEPTION(scope, StringifyFailed);
+        RETURN_IF_EXCEPTION(scope, StringifyFailed);
+        m_holderStack.removeLast();
+    } while (!m_holderStack.isEmpty());
+    return StringifySucceeded;
+}
+
+inline bool Stringifier::willIndent() const
+{
+    return !m_gap.isEmpty();
+}
+
+inline void Stringifier::indent()
+{
+    // Use a single shared string, m_repeatedGap, so we don't keep allocating new ones as we indent and unindent.
+    unsigned newSize = m_indent.length() + m_gap.length();
+    if (newSize > m_repeatedGap.length())
+        m_repeatedGap = makeString(m_repeatedGap, m_gap);
+    ASSERT(newSize <= m_repeatedGap.length());
+    m_indent = m_repeatedGap.substringSharingImpl(0, newSize);
+}
+
+inline void Stringifier::unindent()
+{
+    ASSERT(m_indent.length() >= m_gap.length());
+    m_indent = m_repeatedGap.substringSharingImpl(0, m_indent.length() - m_gap.length());
+}
+
+inline void Stringifier::startNewLine(StringBuilder& builder) const
+{
+    if (m_gap.isEmpty())
+        return;
+    builder.append('\n');
+    builder.append(m_indent);
+}
+
+inline Stringifier::Holder::Holder(VM& vm, ExecState* exec, JSObject* object)
+    : m_object(vm, object)
+    , m_isArray(JSC::isArray(exec, object))
+    , m_isJSArray(m_isArray && isJSArray(object))
+    , m_index(0)
+#ifndef NDEBUG
+    , m_size(0)
+#endif
+{
+}
+
+inline Stringifier::Holder::Holder(RootHolderTag, VM& vm, JSObject* object)
+    : m_object(vm, object)
+    , m_isArray(false)
+    , m_isJSArray(false)
+    , m_index(0)
+#ifndef NDEBUG
+    , m_size(0)
+#endif
+{
+}
+
+bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBuilder& builder)
+{
+    ASSERT(m_index <= m_size);
+
+    ExecState* exec = stringifier.m_exec;
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // First time through, initialize.
+    if (!m_index) {
+        if (m_isArray) {
+            if (m_isJSArray)
+                m_size = asArray(m_object.get())->length();
+            else {
+                JSValue value = m_object->get(exec, vm.propertyNames->length);
+                RETURN_IF_EXCEPTION(scope, false);
+                m_size = value.toUInt32(exec);
+                RETURN_IF_EXCEPTION(scope, false);
+            }
+            builder.append('[');
+        } else {
+            if (stringifier.m_usingArrayReplacer)
+                m_propertyNames = stringifier.m_arrayReplacerPropertyNames.data();
+            else {
+                PropertyNameArray objectPropertyNames(exec, PropertyNameMode::Strings);
+                m_object->methodTable()->getOwnPropertyNames(m_object.get(), exec, objectPropertyNames, EnumerationMode());
+                RETURN_IF_EXCEPTION(scope, false);
+                m_propertyNames = objectPropertyNames.releaseData();
+            }
+            m_size = m_propertyNames->propertyNameVector().size();
+            builder.append('{');
+        }
+        stringifier.indent();
+    }
+
+    // Last time through, finish up and return false.
+    if (m_index == m_size) {
+        stringifier.unindent();
+        if (m_size && builder[builder.length() - 1] != '{')
+            stringifier.startNewLine(builder);
+        builder.append(m_isArray ? ']' : '}');
+        return false;
+    }
+
+    // Handle a single element of the array or object.
+    unsigned index = m_index++;
+    unsigned rollBackPoint = 0;
+    StringifyResult stringifyResult;
+    if (m_isArray) {
+        // Get the value.
+        JSValue value;
+        if (m_isJSArray && asArray(m_object.get())->canGetIndexQuickly(index))
+            value = asArray(m_object.get())->getIndexQuickly(index);
+        else {
+            PropertySlot slot(m_object.get(), PropertySlot::InternalMethodType::Get);
+            if (m_object->methodTable()->getOwnPropertySlotByIndex(m_object.get(), exec, index, slot))
+                value = slot.getValue(exec, index);
+            else
+                value = jsUndefined();
+            RETURN_IF_EXCEPTION(scope, false);
+        }
+
+        // Append the separator string.
+        if (index)
+            builder.append(',');
+        stringifier.startNewLine(builder);
+
+        // Append the stringified value.
+        stringifyResult = stringifier.appendStringifiedValue(builder, value, *this, index);
+        ASSERT(stringifyResult != StringifyFailedDueToUndefinedOrSymbolValue);
+    } else {
+        // Get the value.
+        PropertySlot slot(m_object.get(), PropertySlot::InternalMethodType::Get);
+        Identifier& propertyName = m_propertyNames->propertyNameVector()[index];
+        if (!m_object->methodTable()->getOwnPropertySlot(m_object.get(), exec, propertyName, slot))
+            return true;
+        JSValue value = slot.getValue(exec, propertyName);
+        RETURN_IF_EXCEPTION(scope, false);
+
+        rollBackPoint = builder.length();
+
+        // Append the separator string.
+        if (builder[rollBackPoint - 1] != '{')
+            builder.append(',');
+        stringifier.startNewLine(builder);
+
+        // Append the property name.
+        builder.appendQuotedJSONString(propertyName.string());
+        builder.append(':');
+        if (stringifier.willIndent())
+            builder.append(' ');
+
+        // Append the stringified value.
+        stringifyResult = stringifier.appendStringifiedValue(builder, value, *this, propertyName);
+    }
+    RETURN_IF_EXCEPTION(scope, false);
+
+    // From this point on, no access to the this pointer or to any members, because the
+    // Holder object may have moved if the call to stringify pushed a new Holder onto
+    // m_holderStack.
+
+    switch (stringifyResult) {
+        case StringifyFailed:
+            builder.appendLiteral("null");
+            break;
+        case StringifySucceeded:
+            break;
+        case StringifyFailedDueToUndefinedOrSymbolValue:
+            // This only occurs when get an undefined value or a symbol value for
+            // an object property. In this case we don't want the separator and
+            // property name that we already appended, so roll back.
+            builder.resize(rollBackPoint);
+            break;
+    }
+
+    return true;
+}
+
+// ------------------------------ JSONObject --------------------------------
+
+const ClassInfo JSONObject::s_info = { "JSON", &JSNonFinalObject::s_info, &jsonTable, CREATE_METHOD_TABLE(JSONObject) };
+
+/* Source for JSONObject.lut.h
+@begin jsonTable
+  parse         JSONProtoFuncParse             DontEnum|Function 2
+  stringify     JSONProtoFuncStringify         DontEnum|Function 3
+@end
+*/
+
+// ECMA 15.8
+
+class Walker {
+public:
+    Walker(ExecState* exec, Handle<JSObject> function, CallType callType, CallData callData)
+        : m_exec(exec)
+        , m_function(exec->vm(), function)
+        , m_callType(callType)
+        , m_callData(callData)
+    {
+    }
+    JSValue walk(JSValue unfiltered);
+private:
+    JSValue callReviver(JSObject* thisObj, JSValue property, JSValue unfiltered)
+    {
+        MarkedArgumentBuffer args;
+        args.append(property);
+        args.append(unfiltered);
+        return call(m_exec, m_function.get(), m_callType, m_callData, thisObj, args);
+    }
+
+    friend class Holder;
+
+    ExecState* m_exec;
+    Local<JSObject> m_function;
+    CallType m_callType;
+    CallData m_callData;
+};
+
+// We clamp recursion well beyond anything reasonable.
+static const unsigned maximumFilterRecursion = 40000;
+enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember, 
+                                 ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
+NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
+{
+    VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Vector<PropertyNameArray, 16, UnsafeVectorOverflow> propertyStack;
+    Vector<uint32_t, 16, UnsafeVectorOverflow> indexStack;
+    LocalStack<JSObject, 16> objectStack(vm);
+    LocalStack<JSArray, 16> arrayStack(vm);
+    Vector<unsigned, 16, UnsafeVectorOverflow> arrayLengthStack;
+    
+    Vector<WalkerState, 16, UnsafeVectorOverflow> stateStack;
+    WalkerState state = StateUnknown;
+    JSValue inValue = unfiltered;
+    JSValue outValue = jsNull();
+    
+    while (1) {
+        switch (state) {
+            arrayStartState:
+            case ArrayStartState: {
+                ASSERT(inValue.isObject());
+                ASSERT(isJSArray(asObject(inValue)) || asObject(inValue)->inherits(JSArray::info()));
+                if (objectStack.size() + arrayStack.size() > maximumFilterRecursion)
+                    return throwStackOverflowError(m_exec, scope);
+
+                JSArray* array = asArray(inValue);
+                arrayStack.push(array);
+                arrayLengthStack.append(array->length());
+                indexStack.append(0);
+            }
+            arrayStartVisitMember:
+            FALLTHROUGH;
+            case ArrayStartVisitMember: {
+                JSArray* array = arrayStack.peek();
+                uint32_t index = indexStack.last();
+                unsigned arrayLength = arrayLengthStack.last();
+                if (index == arrayLength) {
+                    outValue = array;
+                    arrayStack.pop();
+                    arrayLengthStack.removeLast();
+                    indexStack.removeLast();
+                    break;
+                }
+                if (isJSArray(array) && array->canGetIndexQuickly(index))
+                    inValue = array->getIndexQuickly(index);
+                else {
+                    PropertySlot slot(array, PropertySlot::InternalMethodType::Get);
+                    if (array->methodTable(vm)->getOwnPropertySlotByIndex(array, m_exec, index, slot))
+                        inValue = slot.getValue(m_exec, index);
+                    else
+                        inValue = jsUndefined();
+                    RETURN_IF_EXCEPTION(scope, { });
+                }
+                    
+                if (inValue.isObject()) {
+                    stateStack.append(ArrayEndVisitMember);
+                    goto stateUnknown;
+                } else
+                    outValue = inValue;
+                FALLTHROUGH;
+            }
+            case ArrayEndVisitMember: {
+                JSArray* array = arrayStack.peek();
+                JSValue filteredValue = callReviver(array, jsString(m_exec, String::number(indexStack.last())), outValue);
+                RETURN_IF_EXCEPTION(scope, { });
+                if (filteredValue.isUndefined())
+                    array->methodTable(vm)->deletePropertyByIndex(array, m_exec, indexStack.last());
+                else
+                    array->putDirectIndex(m_exec, indexStack.last(), filteredValue, 0, PutDirectIndexShouldNotThrow);
+                RETURN_IF_EXCEPTION(scope, { });
+                indexStack.last()++;
+                goto arrayStartVisitMember;
+            }
+            objectStartState:
+            case ObjectStartState: {
+                ASSERT(inValue.isObject());
+                ASSERT(!isJSArray(asObject(inValue)) && !asObject(inValue)->inherits(JSArray::info()));
+                if (objectStack.size() + arrayStack.size() > maximumFilterRecursion)
+                    return throwStackOverflowError(m_exec, scope);
+
+                JSObject* object = asObject(inValue);
+                objectStack.push(object);
+                indexStack.append(0);
+                propertyStack.append(PropertyNameArray(m_exec, PropertyNameMode::Strings));
+                object->methodTable(vm)->getOwnPropertyNames(object, m_exec, propertyStack.last(), EnumerationMode());
+                RETURN_IF_EXCEPTION(scope, { });
+            }
+            objectStartVisitMember:
+            FALLTHROUGH;
+            case ObjectStartVisitMember: {
+                JSObject* object = objectStack.peek();
+                uint32_t index = indexStack.last();
+                PropertyNameArray& properties = propertyStack.last();
+                if (index == properties.size()) {
+                    outValue = object;
+                    objectStack.pop();
+                    indexStack.removeLast();
+                    propertyStack.removeLast();
+                    break;
+                }
+                PropertySlot slot(object, PropertySlot::InternalMethodType::Get);
+                if (object->methodTable(vm)->getOwnPropertySlot(object, m_exec, properties[index], slot))
+                    inValue = slot.getValue(m_exec, properties[index]);
+                else
+                    inValue = jsUndefined();
+
+                // The holder may be modified by the reviver function so any lookup may throw
+                RETURN_IF_EXCEPTION(scope, { });
+
+                if (inValue.isObject()) {
+                    stateStack.append(ObjectEndVisitMember);
+                    goto stateUnknown;
+                } else
+                    outValue = inValue;
+                FALLTHROUGH;
+            }
+            case ObjectEndVisitMember: {
+                JSObject* object = objectStack.peek();
+                Identifier prop = propertyStack.last()[indexStack.last()];
+                PutPropertySlot slot(object);
+                JSValue filteredValue = callReviver(object, jsString(m_exec, prop.string()), outValue);
+                RETURN_IF_EXCEPTION(scope, { });
+                if (filteredValue.isUndefined())
+                    object->methodTable(vm)->deleteProperty(object, m_exec, prop);
+                else
+                    object->methodTable(vm)->put(object, m_exec, prop, filteredValue, slot);
+                RETURN_IF_EXCEPTION(scope, { });
+                indexStack.last()++;
+                goto objectStartVisitMember;
+            }
+            stateUnknown:
+            case StateUnknown:
+                if (!inValue.isObject()) {
+                    outValue = inValue;
+                    break;
+                }
+                JSObject* object = asObject(inValue);
+                if (isJSArray(object) || object->inherits(JSArray::info()))
+                    goto arrayStartState;
+                goto objectStartState;
+        }
+        if (stateStack.isEmpty())
+            break;
+
+        state = stateStack.last();
+        stateStack.removeLast();
+    }
+    JSObject* finalHolder = constructEmptyObject(m_exec);
+    PutPropertySlot slot(finalHolder);
+    finalHolder->methodTable(vm)->put(finalHolder, m_exec, vm.propertyNames->emptyIdentifier, outValue, slot);
+    RETURN_IF_EXCEPTION(scope, { });
+    scope.release();
+    return callReviver(finalHolder, jsEmptyString(m_exec), outValue);
+}
+
+// ECMA-262 v5 15.12.2
+EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!exec->argumentCount())
+        return throwVMError(exec, scope, createError(exec, ASCIILiteral("JSON.parse requires at least one parameter")));
+    auto viewWithString = exec->uncheckedArgument(0).toString(exec)->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, { });
+    StringView view = viewWithString.view;
+
+    JSValue unfiltered;
+    LocalScope localScope(vm);
+    if (view.is8Bit()) {
+        LiteralParser<LChar> jsonParser(exec, view.characters8(), view.length(), StrictJSON);
+        unfiltered = jsonParser.tryLiteralParse();
+        ASSERT(!scope.exception() || !unfiltered);
+        if (!unfiltered) {
+            RETURN_IF_EXCEPTION(scope, { });
+            return throwVMError(exec, scope, createSyntaxError(exec, jsonParser.getErrorMessage()));
+        }
+    } else {
+        LiteralParser<UChar> jsonParser(exec, view.characters16(), view.length(), StrictJSON);
+        unfiltered = jsonParser.tryLiteralParse();
+        ASSERT(!scope.exception() || !unfiltered);
+        if (!unfiltered) {
+            RETURN_IF_EXCEPTION(scope, { });
+            return throwVMError(exec, scope, createSyntaxError(exec, jsonParser.getErrorMessage()));
+        }
+    }
+    
+    if (exec->argumentCount() < 2)
+        return JSValue::encode(unfiltered);
+    
+    JSValue function = exec->uncheckedArgument(1);
+    CallData callData;
+    CallType callType = getCallData(function, callData);
+    if (callType == CallType::None)
+        return JSValue::encode(unfiltered);
+    scope.release();
+    return JSValue::encode(Walker(exec, Local<JSObject>(vm, asObject(function)), callType, callData).walk(unfiltered));
+}
+
+// ECMA-262 v5 15.12.3
+EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!exec->argumentCount())
+        return throwVMError(exec, scope, createError(exec, ASCIILiteral("No input to stringify")));
+    LocalScope localScope(vm);
+    Local<Unknown> value(vm, exec->uncheckedArgument(0));
+    Local<Unknown> replacer(vm, exec->argument(1));
+    Local<Unknown> space(vm, exec->argument(2));
+    Stringifier stringifier(exec, replacer, space);
+    RETURN_IF_EXCEPTION(scope, { });
+    scope.release();
+    JSValue result = stringifier.stringify(value).get();
+    return JSValue::encode(result);
+}
+
+JSValue JSONParse(ExecState* exec, const String& json)
+{
+    LocalScope scope(exec->vm());
+
+    if (json.isNull())
+        return JSValue();
+
+    if (json.is8Bit()) {
+        LiteralParser<LChar> jsonParser(exec, json.characters8(), json.length(), StrictJSON);
+        return jsonParser.tryLiteralParse();
+    }
+
+    LiteralParser<UChar> jsonParser(exec, json.characters16(), json.length(), StrictJSON);
+    return jsonParser.tryLiteralParse();
+}
+
+String JSONStringify(ExecState* exec, JSValue value, unsigned indent)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    LocalScope scope(vm);
+    Stringifier stringifier(exec, Local<Unknown>(vm, jsNull()), Local<Unknown>(vm, jsNumber(indent)));
+    RETURN_IF_EXCEPTION(throwScope, { });
+    Local<Unknown> result = stringifier.stringify(Local<Unknown>(vm, value));
+    if (UNLIKELY(throwScope.exception()) || result.isUndefinedOrNull())
+        return String();
+    return result.getString(exec);
+}
+
+} // namespace JSC
diff --git a/runtime/JSONObject.h b/runtime/JSONObject.h
new file mode 100644
index 0000000..6d72aca
--- /dev/null
+++ b/runtime/JSONObject.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSONObject : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static JSONObject* create(VM& vm, Structure* structure)
+    {
+        JSONObject* object = new (NotNull, allocateCell<JSONObject>(vm.heap)) JSONObject(vm, structure);
+        object->finishCreation(vm);
+        return object;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    JSONObject(VM&, Structure*);
+};
+
+JS_EXPORT_PRIVATE JSValue JSONParse(ExecState*, const String&);
+JS_EXPORT_PRIVATE String JSONStringify(ExecState*, JSValue, unsigned indent);
+    
+} // namespace JSC
diff --git a/runtime/JSObject.cpp b/runtime/JSObject.cpp
new file mode 100644
index 0000000..2ab0b94
--- /dev/null
+++ b/runtime/JSObject.cpp
@@ -0,0 +1,3593 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2006, 2008-2009, 2012-2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Eric Seidel (eric@webkit.org)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSObject.h"
+
+#include "ButterflyInlines.h"
+#include "CustomGetterSetter.h"
+#include "DatePrototype.h"
+#include "ErrorConstructor.h"
+#include "Exception.h"
+#include "GetterSetter.h"
+#include "HeapSnapshotBuilder.h"
+#include "IndexingHeaderInlines.h"
+#include "JSCInlines.h"
+#include "JSCustomGetterSetterFunction.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "Lookup.h"
+#include "NativeErrorConstructor.h"
+#include "Nodes.h"
+#include "ObjectPrototype.h"
+#include "PropertyDescriptor.h"
+#include "PropertyNameArray.h"
+#include "PrototypeMapInlines.h"
+#include "ProxyObject.h"
+#include "SlotVisitorInlines.h"
+#include "TypeError.h"
+#include <math.h>
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+// We keep track of the size of the last array after it was grown. We use this
+// as a simple heuristic for as the value to grow the next array from size 0.
+// This value is capped by the constant FIRST_VECTOR_GROW defined in
+// ArrayConventions.h.
+static unsigned lastArraySize = 0;
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSObject);
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSFinalObject);
+
+const char* const NonExtensibleObjectPropertyDefineError = "Attempting to define property on object that is not extensible.";
+const char* const ReadonlyPropertyWriteError = "Attempted to assign to readonly property.";
+const char* const ReadonlyPropertyChangeError = "Attempting to change value of a readonly property.";
+const char* const UnableToDeletePropertyError = "Unable to delete property.";
+const char* const UnconfigurablePropertyChangeAccessMechanismError = "Attempting to change access mechanism for an unconfigurable property.";
+const char* const UnconfigurablePropertyChangeConfigurabilityError = "Attempting to change configurable attribute of unconfigurable property.";
+const char* const UnconfigurablePropertyChangeEnumerabilityError = "Attempting to change enumerable attribute of unconfigurable property.";
+const char* const UnconfigurablePropertyChangeWritabilityError = "Attempting to change writable attribute of unconfigurable property.";
+
+const ClassInfo JSObject::s_info = { "Object", 0, 0, CREATE_METHOD_TABLE(JSObject) };
+
+const ClassInfo JSFinalObject::s_info = { "Object", &Base::s_info, 0, CREATE_METHOD_TABLE(JSFinalObject) };
+
+static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    VM& vm = exec->vm();
+
+    // Add properties from the static hashtables of properties
+    for (; classInfo; classInfo = classInfo->parentClass) {
+        const HashTable* table = classInfo->staticPropHashTable;
+        if (!table)
+            continue;
+
+        for (auto iter = table->begin(); iter != table->end(); ++iter) {
+            if (!(iter->attributes() & DontEnum) || mode.includeDontEnumProperties())
+                propertyNames.add(Identifier::fromString(&vm, iter.key()));
+        }
+    }
+}
+
+ALWAYS_INLINE void JSObject::markAuxiliaryAndVisitOutOfLineProperties(SlotVisitor& visitor, Butterfly* butterfly, Structure* structure, PropertyOffset lastOffset)
+{
+    // We call this when we found everything without races.
+    ASSERT(structure);
+    
+    if (!butterfly)
+        return;
+    
+    bool hasIndexingHeader = structure->hasIndexingHeader(this);
+    size_t preCapacity;
+    if (hasIndexingHeader)
+        preCapacity = butterfly->indexingHeader()->preCapacity(structure);
+    else
+        preCapacity = 0;
+    
+    HeapCell* base = bitwise_cast<HeapCell*>(
+        butterfly->base(preCapacity, Structure::outOfLineCapacity(lastOffset)));
+    
+    ASSERT(Heap::heap(base) == visitor.heap());
+    
+    visitor.markAuxiliary(base);
+    
+    unsigned outOfLineSize = Structure::outOfLineSize(lastOffset);
+    visitor.appendValuesHidden(butterfly->propertyStorage() - outOfLineSize, outOfLineSize);
+}
+
+ALWAYS_INLINE Structure* JSObject::visitButterfly(SlotVisitor& visitor)
+{
+    static const char* raceReason = "JSObject::visitButterfly";
+    Structure* result = visitButterflyImpl(visitor);
+    if (!result)
+        visitor.didRace(this, raceReason);
+    return result;
+}
+
+ALWAYS_INLINE Structure* JSObject::visitButterflyImpl(SlotVisitor& visitor)
+{
+    VM& vm = visitor.vm();
+    
+    Butterfly* butterfly;
+    Structure* structure;
+    PropertyOffset lastOffset;
+    
+    if (visitor.mutatorIsStopped()) {
+        butterfly = this->butterfly();
+        structure = this->structure(vm);
+        lastOffset = structure->lastOffset();
+        
+        markAuxiliaryAndVisitOutOfLineProperties(visitor, butterfly, structure, lastOffset);
+        
+        switch (structure->indexingType()) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            visitor.appendValuesHidden(butterfly->contiguous().data(), butterfly->publicLength());
+            break;
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            visitor.appendValuesHidden(butterfly->arrayStorage()->m_vector, butterfly->arrayStorage()->vectorLength());
+            if (butterfly->arrayStorage()->m_sparseMap)
+                visitor.append(butterfly->arrayStorage()->m_sparseMap);
+            break;
+        default:
+            break;
+        }
+        return structure;
+    }
+    
+    // We want to ensure that we only scan the butterfly if we have an exactly matched structure and an
+    // exactly matched size. The mutator is required to perform the following shenanigans when
+    // reallocating the butterfly with a concurrent collector, with all fencing necessary to ensure
+    // that this executes as if under sequential consistency:
+    //
+    //     object->structure = nuke(object->structure)
+    //     object->butterfly = newButterfly
+    //     structure->m_offset = newLastOffset
+    //     object->structure = newStructure
+    //
+    // It's OK to skip this when reallocating the butterfly in a way that does not affect the m_offset.
+    // We have other protocols in place for that.
+    //
+    // Note that the m_offset can change without the structure changing, but in that case the mutator
+    // will still store null to the structure.
+    //
+    // The collector will ensure that it always sees a matched butterfly/structure by reading the
+    // structure before and after reading the butterfly. For simplicity, let's first consider the case
+    // where the only way to change the outOfLineCapacity is to change the structure. This works
+    // because the mutator performs the following steps sequentially:
+    //
+    //     NukeStructure ChangeButterfly PutNewStructure
+    //
+    // Meanwhile the collector performs the following steps sequentially:
+    //
+    //     ReadStructureEarly ReadButterfly ReadStructureLate
+    //
+    // The collector is allowed to do any of these three things:
+    //
+    // BEFORE: Scan the object with the structure and butterfly *before* the mutator's transition.
+    // AFTER: Scan the object with the structure and butterfly *after* the mutator's transition.
+    // IGNORE: Ignore the butterfly and call didRace to schedule us to be revisted again in the future.
+    //
+    // In other words, the collector will never see any torn structure/butterfly mix. It will
+    // always see the structure/butterfly before the transition or after but not in between.
+    //
+    // We can prove that this is correct by exhaustively considering all interleavings:
+    //
+    // NukeStructure ChangeButterfly PutNewStructure ReadStructureEarly ReadButterfly ReadStructureLate: AFTER, trivially.
+    // NukeStructure ChangeButterfly ReadStructureEarly PutNewStructure ReadButterfly ReadStructureLate: IGNORE, because nuked structure read early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadButterfly PutNewStructure ReadStructureLate: IGNORE, because nuked structure read early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadButterfly ReadStructureLate PutNewStructure: IGNORE, because nuked structure read early
+    // NukeStructure ReadStructureEarly ChangeButterfly PutNewStructure ReadButterfly ReadStructureLate: IGNORE, because nuked structure read early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadButterfly PutNewStructure ReadStructureLate: IGNORE, because nuked structure read early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadButterfly ReadStructureLate PutNewStructure: IGNORE, because nuked structure read early
+    // NukeStructure ReadStructureEarly ReadButterfly ChangeButterfly PutNewStructure ReadStructureLate: IGNORE, because nuked structure read early
+    // NukeStructure ReadStructureEarly ReadButterfly ChangeButterfly ReadStructureLate PutNewStructure: IGNORE, because nuked structure read early
+    // NukeStructure ReadStructureEarly ReadButterfly ReadStructureLate ChangeButterfly PutNewStructure: IGNORE, because nuked structure read early
+    // ReadStructureEarly NukeStructure ChangeButterfly PutNewStructure ReadButterfly ReadStructureLate: IGNORE, because early and late structures don't match
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadButterfly PutNewStructure ReadStructureLate: IGNORE, because early and late structures don't match
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadButterfly ReadStructureLate PutNewStructure: IGNORE, because nuked structure read late
+    // ReadStructureEarly NukeStructure ReadButterfly ChangeButterfly PutNewStructure ReadStructureLate: IGNORE, because early and late structures don't match
+    // ReadStructureEarly NukeStructure ReadButterfly ChangeButterfly ReadStructureLate PutNewStructure: IGNORE, because nuked structure read late
+    // ReadStructureEarly NukeStructure ReadButterfly ReadStructureLate ChangeButterfly PutNewStructure: IGNORE, because nuked structure read late
+    // ReadStructureEarly ReadButterfly NukeStructure ChangeButterfly PutNewStructure ReadStructureLate: IGNORE, because early and late structures don't match
+    // ReadStructureEarly ReadButterfly NukeStructure ChangeButterfly ReadStructureLate PutNewStructure: IGNORE, because nuked structure read late
+    // ReadStructureEarly ReadButterfly NukeStructure ReadStructureLate ChangeButterfly PutNewStructure: IGNORE, because nuked structure read late
+    // ReadStructureEarly ReadButterfly ReadStructureLate NukeStructure ChangeButterfly PutNewStructure: BEFORE, trivially.
+    //
+    // But we additionally have to worry about the size changing. We make this work by requiring that
+    // the collector reads the size early and late as well. Lets consider the interleaving of the
+    // mutator changing the size without changing the structure:
+    //
+    //     NukeStructure ChangeButterfly ChangeLastOffset RestoreStructure
+    //
+    // Meanwhile the collector does:
+    //
+    //     ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate
+    //
+    // The collector can detect races by not only comparing the early structure to the late structure
+    // (which will be the same before and after the algorithm runs) but also by comparing the early and
+    // late lastOffsets.  Note: the IGNORE proofs do not cite all of the reasons why the collector will
+    // ignore the case, since we only need to identify one to say that we're in the ignore case.
+    //
+    // NukeStructure ChangeButterfly ChangeLastOffset RestoreStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate: AFTER, trivially
+    // NukeStructure ChangeButterfly ChangeLastOffset ReadStructureEarly RestoreStructure ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ChangeLastOffset ReadStructureEarly ReadLastOffsetEarly RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ChangeLastOffset ReadStructureEarly ReadLastOffsetEarly ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ChangeLastOffset ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ChangeLastOffset ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ChangeLastOffset RestoreStructure ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ChangeLastOffset ReadLastOffsetEarly RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ChangeLastOffset ReadLastOffsetEarly ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ChangeLastOffset ReadLastOffsetEarly ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ChangeLastOffset ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ChangeLastOffset RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ChangeLastOffset ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ChangeLastOffset ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ChangeLastOffset ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ChangeButterfly ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ChangeLastOffset RestoreStructure ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ChangeLastOffset ReadLastOffsetEarly RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ChangeLastOffset ReadLastOffsetEarly ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ChangeLastOffset ReadLastOffsetEarly ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ChangeLastOffset ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ChangeLastOffset RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ChangeLastOffset ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ChangeLastOffset ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ChangeLastOffset ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ReadButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ReadButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ReadButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ChangeButterfly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ChangeLastOffset RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ChangeLastOffset ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ChangeLastOffset ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ChangeLastOffset ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ReadButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ReadButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ReadButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ReadButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ReadButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ChangeButterfly ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ChangeButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeButterfly ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeButterfly ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeButterfly ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure early
+    // NukeStructure ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeButterfly ChangeLastOffset RestoreStructure: IGNORE, read nuked structure early
+    // ReadStructureEarly NukeStructure ChangeButterfly ChangeLastOffset RestoreStructure ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate: AFTER, the ReadStructureEarly sees the same structure as after and everything else runs after.
+    // ReadStructureEarly NukeStructure ChangeButterfly ChangeLastOffset ReadLastOffsetEarly RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: AFTER, as above and the ReadLastOffsetEarly sees the lastOffset after.
+    // ReadStructureEarly NukeStructure ChangeButterfly ChangeLastOffset ReadLastOffsetEarly ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: AFTER, as above and the ReadButterfly sees the right butterfly after.
+    // ReadStructureEarly NukeStructure ChangeButterfly ChangeLastOffset ReadLastOffsetEarly ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure late
+    // ReadStructureEarly NukeStructure ChangeButterfly ChangeLastOffset ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ChangeLastOffset RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ChangeLastOffset ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ChangeLastOffset ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ChangeLastOffset ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ReadButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ReadButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ReadButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ChangeButterfly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ChangeLastOffset RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ChangeLastOffset ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ChangeLastOffset ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ChangeLastOffset ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ReadButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ReadButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ReadButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ReadButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ReadButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ChangeButterfly ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ChangeButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ChangeButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ChangeButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ChangeButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ChangeButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ChangeButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeButterfly ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeButterfly ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ReadStructureLate ChangeButterfly ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly NukeStructure ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeButterfly ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ChangeLastOffset RestoreStructure ReadButterfly ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ChangeLastOffset ReadButterfly RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ChangeLastOffset ReadButterfly ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ChangeLastOffset ReadButterfly ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ReadButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ReadButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ReadButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ReadButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ReadButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ChangeButterfly ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ChangeButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ChangeButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ChangeButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ChangeButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ChangeButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ChangeButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ReadStructureLate ChangeButterfly ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ReadStructureLate ChangeButterfly ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ReadStructureLate ChangeButterfly ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly NukeStructure ReadButterfly ReadStructureLate ReadLastOffsetLate ChangeButterfly ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ChangeButterfly ChangeLastOffset RestoreStructure ReadStructureLate ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ChangeButterfly ChangeLastOffset ReadStructureLate RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ChangeButterfly ChangeLastOffset ReadStructureLate ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ChangeButterfly ReadStructureLate ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ChangeButterfly ReadStructureLate ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ChangeButterfly ReadStructureLate ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ReadStructureLate ChangeButterfly ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ReadStructureLate ChangeButterfly ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ReadStructureLate ChangeButterfly ReadLastOffsetLate ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly NukeStructure ReadStructureLate ReadLastOffsetLate ChangeButterfly ChangeLastOffset RestoreStructure: IGNORE, read nuked structure late
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate NukeStructure ChangeButterfly ChangeLastOffset RestoreStructure ReadLastOffsetLate: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate NukeStructure ChangeButterfly ChangeLastOffset ReadLastOffsetLate RestoreStructure: IGNORE, read different offsets
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate NukeStructure ChangeButterfly ReadLastOffsetLate ChangeLastOffset RestoreStructure: BEFORE, reads the offset before, everything else happens before
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate NukeStructure ReadLastOffsetLate ChangeButterfly ChangeLastOffset RestoreStructure: BEFORE, reads the offset before, everything else happens before
+    // ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate NukeStructure ChangeButterfly ChangeLastOffset RestoreStructure: BEFORE, trivially
+    //
+    // Whew.
+    //
+    // What the collector is doing is just the "double collect" snapshot from "The Unbounded Single-
+    // Writer Algorithm" from Yehuda Afek et al's "Atomic Snapshots of Shared Memory" in JACM 1993,
+    // also available here:
+    //
+    // http://people.csail.mit.edu/shanir/publications/AADGMS.pdf
+    //
+    // Unlike Afek et al's algorithm, ours does not require extra hacks to force wait-freedom (see
+    // "Observation 2" in the paper). This simplifies the whole algorithm. Instead we are happy with
+    // obstruction-freedom, and like any good obstruction-free algorithm, we ensure progress using
+    // scheduling. We also only collect the butterfly once instead of twice; this optimization seems
+    // to hold up in my proofs above and I'm not sure it's part of Afek et al's algos.
+    //
+    // For more background on this kind of madness, I like this paper; it's where I learned about
+    // both the snapshot algorithm and obstruction-freedom:
+    //
+    // Lunchangco, Moir, Shavit. "Nonblocking k-compare-single-swap." SPAA '03
+    // https://pdfs.semanticscholar.org/343f/7182cde7669ca2a7de3dc01127927f384ef7.pdf
+    
+    StructureID structureID = this->structureID();
+    if (isNuked(structureID))
+        return nullptr;
+    structure = vm.getStructure(structureID);
+    lastOffset = structure->lastOffset();
+    IndexingType indexingType = structure->indexingType();
+    Locker<JSCell> locker(NoLockingNecessary);
+    switch (indexingType) {
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        // We need to hold this lock to protect against changes to the innards of the butterfly
+        // that can happen when the butterfly is used for array storage. We conservatively
+        // assume that a contiguous butterfly may transform into an array storage one, though
+        // this is probably more conservative than necessary.
+        locker = Locker<JSCell>(*this);
+        break;
+    default:
+        break;
+    }
+    WTF::loadLoadFence();
+    butterfly = this->butterfly();
+    if (!butterfly)
+        return structure;
+    WTF::loadLoadFence();
+    if (this->structureID() != structureID)
+        return nullptr;
+    if (structure->lastOffset() != lastOffset)
+        return nullptr;
+    
+    markAuxiliaryAndVisitOutOfLineProperties(visitor, butterfly, structure, lastOffset);
+    
+    ASSERT(indexingType == structure->indexingType());
+    
+    switch (indexingType) {
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        visitor.appendValuesHidden(butterfly->contiguous().data(), butterfly->publicLength());
+        break;
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        visitor.appendValuesHidden(butterfly->arrayStorage()->m_vector, butterfly->arrayStorage()->vectorLength());
+        if (butterfly->arrayStorage()->m_sparseMap)
+            visitor.append(butterfly->arrayStorage()->m_sparseMap);
+        break;
+    default:
+        break;
+    }
+    
+    return structure;
+}
+
+size_t JSObject::estimatedSize(JSCell* cell)
+{
+    JSObject* thisObject = jsCast<JSObject*>(cell);
+    size_t butterflyOutOfLineSize = thisObject->m_butterfly ? thisObject->structure()->outOfLineSize() : 0;
+    return Base::estimatedSize(cell) + butterflyOutOfLineSize;
+}
+
+void JSObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSObject* thisObject = jsCast<JSObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+#if !ASSERT_DISABLED
+    bool wasCheckingForDefaultMarkViolation = visitor.m_isCheckingForDefaultMarkViolation;
+    visitor.m_isCheckingForDefaultMarkViolation = false;
+#endif
+    
+    JSCell::visitChildren(thisObject, visitor);
+    
+    thisObject->visitButterfly(visitor);
+    
+#if !ASSERT_DISABLED
+    visitor.m_isCheckingForDefaultMarkViolation = wasCheckingForDefaultMarkViolation;
+#endif
+}
+
+void JSObject::heapSnapshot(JSCell* cell, HeapSnapshotBuilder& builder)
+{
+    JSObject* thisObject = jsCast<JSObject*>(cell);
+    Base::heapSnapshot(cell, builder);
+
+    Structure* structure = thisObject->structure();
+    for (auto& entry : structure->getPropertiesConcurrently()) {
+        JSValue toValue = thisObject->getDirect(entry.offset);
+        if (toValue && toValue.isCell())
+            builder.appendPropertyNameEdge(thisObject, toValue.asCell(), entry.key);
+    }
+
+    Butterfly* butterfly = thisObject->m_butterfly.get();
+    if (butterfly) {
+        WriteBarrier<Unknown>* data = nullptr;
+        uint32_t count = 0;
+
+        switch (thisObject->indexingType()) {
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            data = butterfly->contiguous().data();
+            count = butterfly->publicLength();
+            break;
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            data = butterfly->arrayStorage()->m_vector;
+            count = butterfly->arrayStorage()->vectorLength();
+            break;
+        default:
+            break;
+        }
+
+        for (uint32_t i = 0; i < count; ++i) {
+            JSValue toValue = data[i].get();
+            if (toValue && toValue.isCell())
+                builder.appendIndexEdge(thisObject, toValue.asCell(), i);
+        }
+    }
+}
+
+void JSFinalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSFinalObject* thisObject = jsCast<JSFinalObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+#if !ASSERT_DISABLED
+    bool wasCheckingForDefaultMarkViolation = visitor.m_isCheckingForDefaultMarkViolation;
+    visitor.m_isCheckingForDefaultMarkViolation = false;
+#endif
+    
+    JSCell::visitChildren(thisObject, visitor);
+    
+    if (Structure* structure = thisObject->visitButterfly(visitor)) {
+        if (unsigned storageSize = structure->inlineSize())
+            visitor.appendValuesHidden(thisObject->inlineStorage(), storageSize);
+    }
+    
+#if !ASSERT_DISABLED
+    visitor.m_isCheckingForDefaultMarkViolation = wasCheckingForDefaultMarkViolation;
+#endif
+}
+
+String JSObject::className(const JSObject* object)
+{
+    const ClassInfo* info = object->classInfo();
+    ASSERT(info);
+    return info->className;
+}
+
+String JSObject::toStringName(const JSObject* object, ExecState*)
+{
+    const ClassInfo* info = object->classInfo();
+    ASSERT(info);
+    return info->methodTable.className(object);
+}
+
+String JSObject::calculatedClassName(JSObject* object)
+{
+    String prototypeFunctionName;
+    auto globalObject = object->globalObject();
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+
+    ExecState* exec = globalObject->globalExec();
+    PropertySlot slot(object->getPrototypeDirect(), PropertySlot::InternalMethodType::VMInquiry);
+    PropertyName constructor(exec->propertyNames().constructor);
+    if (object->getPropertySlot(exec, constructor, slot)) {
+        if (slot.isValue()) {
+            JSValue constructorValue = slot.getValue(exec, constructor);
+            if (constructorValue.isCell()) {
+                if (JSCell* constructorCell = constructorValue.asCell()) {
+                    if (JSObject* ctorObject = constructorCell->getObject()) {
+                        if (JSFunction* constructorFunction = jsDynamicCast<JSFunction*>(ctorObject))
+                            prototypeFunctionName = constructorFunction->calculatedDisplayName(vm);
+                        else if (InternalFunction* constructorFunction = jsDynamicCast<InternalFunction*>(ctorObject))
+                            prototypeFunctionName = constructorFunction->calculatedDisplayName(vm);
+                    }
+                }
+            }
+        }
+    }
+    ASSERT(!scope.exception() || prototypeFunctionName.isNull());
+    if (UNLIKELY(scope.exception()))
+        scope.clearException();
+
+    if (prototypeFunctionName.isNull() || prototypeFunctionName == "Object") {
+        String tableClassName = object->methodTable()->className(object);
+        if (!tableClassName.isNull() && tableClassName != "Object")
+            return tableClassName;
+
+        String classInfoName = object->classInfo()->className;
+        if (!classInfoName.isNull())
+            return classInfoName;
+
+        if (prototypeFunctionName.isNull())
+            return ASCIILiteral("Object");
+    }
+
+    return prototypeFunctionName;
+}
+
+bool JSObject::getOwnPropertySlotByIndex(JSObject* thisObject, ExecState* exec, unsigned i, PropertySlot& slot)
+{
+    // NB. The fact that we're directly consulting our indexed storage implies that it is not
+    // legal for anyone to override getOwnPropertySlot() without also overriding
+    // getOwnPropertySlotByIndex().
+    
+    if (i > MAX_ARRAY_INDEX)
+        return thisObject->methodTable(exec->vm())->getOwnPropertySlot(thisObject, exec, Identifier::from(exec, i), slot);
+    
+    switch (thisObject->indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        break;
+        
+    case ALL_INT32_INDEXING_TYPES:
+    case ALL_CONTIGUOUS_INDEXING_TYPES: {
+        Butterfly* butterfly = thisObject->butterfly();
+        if (i >= butterfly->vectorLength())
+            return false;
+        
+        JSValue value = butterfly->contiguous()[i].get();
+        if (value) {
+            slot.setValue(thisObject, None, value);
+            return true;
+        }
+        
+        return false;
+    }
+        
+    case ALL_DOUBLE_INDEXING_TYPES: {
+        Butterfly* butterfly = thisObject->butterfly();
+        if (i >= butterfly->vectorLength())
+            return false;
+        
+        double value = butterfly->contiguousDouble()[i];
+        if (value == value) {
+            slot.setValue(thisObject, None, JSValue(JSValue::EncodeAsDouble, value));
+            return true;
+        }
+        
+        return false;
+    }
+        
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+        ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
+        if (i >= storage->length())
+            return false;
+        
+        if (i < storage->vectorLength()) {
+            JSValue value = storage->m_vector[i].get();
+            if (value) {
+                slot.setValue(thisObject, None, value);
+                return true;
+            }
+        } else if (SparseArrayValueMap* map = storage->m_sparseMap.get()) {
+            SparseArrayValueMap::iterator it = map->find(i);
+            if (it != map->notFound()) {
+                it->value.get(thisObject, slot);
+                return true;
+            }
+        }
+        break;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    }
+    
+    return false;
+}
+
+// https://tc39.github.io/ecma262/#sec-ordinaryset
+bool ordinarySetSlow(ExecState* exec, JSObject* object, PropertyName propertyName, JSValue value, JSValue receiver, bool shouldThrow)
+{
+    // If we find the receiver is not the same to the object, we fall to this slow path.
+    // Currently, there are 3 candidates.
+    // 1. Reflect.set can alter the receiver with an arbitrary value.
+    // 2. Window Proxy.
+    // 3. ES6 Proxy.
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* current = object;
+    PropertyDescriptor ownDescriptor;
+    while (true) {
+        if (current->type() == ProxyObjectType && propertyName != vm.propertyNames->underscoreProto) {
+            ProxyObject* proxy = jsCast<ProxyObject*>(current);
+            PutPropertySlot slot(receiver, shouldThrow);
+            return proxy->ProxyObject::put(proxy, exec, propertyName, value, slot);
+        }
+
+        // 9.1.9.1-2 Let ownDesc be ? O.[[GetOwnProperty]](P).
+        bool ownDescriptorFound = current->getOwnPropertyDescriptor(exec, propertyName, ownDescriptor);
+        RETURN_IF_EXCEPTION(scope, false);
+
+        if (!ownDescriptorFound) {
+            // 9.1.9.1-3-a Let parent be ? O.[[GetPrototypeOf]]().
+            JSValue prototype = current->getPrototype(vm, exec);
+            RETURN_IF_EXCEPTION(scope, false);
+
+            // 9.1.9.1-3-b If parent is not null, then
+            if (!prototype.isNull()) {
+                // 9.1.9.1-3-b-i Return ? parent.[[Set]](P, V, Receiver).
+                current = asObject(prototype);
+                continue;
+            }
+            // 9.1.9.1-3-c-i Let ownDesc be the PropertyDescriptor{[[Value]]: undefined, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}.
+            ownDescriptor = PropertyDescriptor(jsUndefined(), None);
+        }
+        break;
+    }
+
+    // 9.1.9.1-4 If IsDataDescriptor(ownDesc) is true, then
+    if (ownDescriptor.isDataDescriptor()) {
+        // 9.1.9.1-4-a If ownDesc.[[Writable]] is false, return false.
+        if (!ownDescriptor.writable())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+
+        // 9.1.9.1-4-b If Type(Receiver) is not Object, return false.
+        if (!receiver.isObject())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+
+        // In OrdinarySet, the receiver may not be the same to the object.
+        // So, we perform [[GetOwnProperty]] onto the receiver while we already perform [[GetOwnProperty]] onto the object.
+
+        // 9.1.9.1-4-c Let existingDescriptor be ? Receiver.[[GetOwnProperty]](P).
+        JSObject* receiverObject = asObject(receiver);
+        PropertyDescriptor existingDescriptor;
+        bool existingDescriptorFound = receiverObject->getOwnPropertyDescriptor(exec, propertyName, existingDescriptor);
+        RETURN_IF_EXCEPTION(scope, false);
+
+        // 9.1.9.1-4-d If existingDescriptor is not undefined, then
+        if (existingDescriptorFound) {
+            // 9.1.9.1-4-d-i If IsAccessorDescriptor(existingDescriptor) is true, return false.
+            if (existingDescriptor.isAccessorDescriptor())
+                return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+
+            // 9.1.9.1-4-d-ii If existingDescriptor.[[Writable]] is false, return false.
+            if (!existingDescriptor.writable())
+                return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+
+            // 9.1.9.1-4-d-iii Let valueDesc be the PropertyDescriptor{[[Value]]: V}.
+            PropertyDescriptor valueDescriptor;
+            valueDescriptor.setValue(value);
+
+            // 9.1.9.1-4-d-iv Return ? Receiver.[[DefineOwnProperty]](P, valueDesc).
+            return receiverObject->methodTable(vm)->defineOwnProperty(receiverObject, exec, propertyName, valueDescriptor, shouldThrow);
+        }
+
+        // 9.1.9.1-4-e Else Receiver does not currently have a property P,
+        // 9.1.9.1-4-e-i Return ? CreateDataProperty(Receiver, P, V).
+        return receiverObject->methodTable(vm)->defineOwnProperty(receiverObject, exec, propertyName, PropertyDescriptor(value, None), shouldThrow);
+    }
+
+    // 9.1.9.1-5 Assert: IsAccessorDescriptor(ownDesc) is true.
+    ASSERT(ownDescriptor.isAccessorDescriptor());
+
+    // 9.1.9.1-6 Let setter be ownDesc.[[Set]].
+    // 9.1.9.1-7 If setter is undefined, return false.
+    JSValue setter = ownDescriptor.setter();
+    if (!setter.isObject())
+        return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+
+    // 9.1.9.1-8 Perform ? Call(setter, Receiver, << V >>).
+    JSObject* setterObject = asObject(setter);
+    MarkedArgumentBuffer args;
+    args.append(value);
+
+    CallData callData;
+    CallType callType = setterObject->methodTable(vm)->getCallData(setterObject, callData);
+    call(exec, setterObject, callType, callData, receiver, args);
+
+    // 9.1.9.1-9 Return true.
+    return true;
+}
+
+// ECMA 8.6.2.2
+bool JSObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    return putInline(cell, exec, propertyName, value, slot);
+}
+
+bool JSObject::putInlineSlow(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    ASSERT(!isThisValueAltered(slot, this));
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* obj = this;
+    for (;;) {
+        unsigned attributes;
+        PropertyOffset offset = obj->structure(vm)->get(vm, propertyName, attributes);
+        if (isValidOffset(offset)) {
+            if (attributes & ReadOnly) {
+                ASSERT(structure(vm)->prototypeChainMayInterceptStoreTo(vm, propertyName) || obj == this);
+                return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+            }
+
+            JSValue gs = obj->getDirect(offset);
+            if (gs.isGetterSetter()) {
+                bool result = callSetter(exec, slot.thisValue(), gs, value, slot.isStrictMode() ? StrictMode : NotStrictMode);
+                if (!structure()->isDictionary())
+                    slot.setCacheableSetter(obj, offset);
+                return result;
+            }
+            if (gs.isCustomGetterSetter()) {
+                bool result = callCustomSetter(exec, gs, attributes & CustomAccessor, obj, slot.thisValue(), value);
+                if (attributes & CustomAccessor)
+                    slot.setCustomAccessor(obj, jsCast<CustomGetterSetter*>(gs.asCell())->setter());
+                else
+                    slot.setCustomValue(obj, jsCast<CustomGetterSetter*>(gs.asCell())->setter());
+                return result;
+            }
+            ASSERT(!(attributes & Accessor));
+
+            // If there's an existing property on the object or one of its 
+            // prototypes it should be replaced, so break here.
+            break;
+        }
+        if (!obj->staticPropertiesReified()) {
+            if (obj->classInfo()->hasStaticSetterOrReadonlyProperties()) {
+                if (auto* entry = obj->findPropertyHashEntry(propertyName))
+                    return putEntry(exec, entry, obj, this, propertyName, value, slot);
+            }
+        }
+        if (obj->type() == ProxyObjectType && propertyName != vm.propertyNames->underscoreProto) {
+            // FIXME: We shouldn't unconditionally perform [[Set]] here.
+            // We need to do more because this is observable behavior.
+            // https://bugs.webkit.org/show_bug.cgi?id=155012
+            ProxyObject* proxy = jsCast<ProxyObject*>(obj);
+            return proxy->ProxyObject::put(proxy, exec, propertyName, value, slot);
+        }
+        JSValue prototype = obj->getPrototypeDirect();
+        if (prototype.isNull())
+            break;
+        obj = asObject(prototype);
+    }
+
+    ASSERT(!structure(vm)->prototypeChainMayInterceptStoreTo(vm, propertyName) || obj == this);
+    if (!putDirectInternal<PutModePut>(vm, propertyName, value, 0, slot))
+        return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+    return true;
+}
+
+bool JSObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    JSObject* thisObject = jsCast<JSObject*>(cell);
+    
+    if (propertyName > MAX_ARRAY_INDEX) {
+        PutPropertySlot slot(cell, shouldThrow);
+        return thisObject->methodTable()->put(thisObject, exec, Identifier::from(exec, propertyName), value, slot);
+    }
+    
+    switch (thisObject->indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+        break;
+        
+    case ALL_UNDECIDED_INDEXING_TYPES: {
+        thisObject->convertUndecidedForValue(exec->vm(), value);
+        // Reloop.
+        return putByIndex(cell, exec, propertyName, value, shouldThrow);
+    }
+        
+    case ALL_INT32_INDEXING_TYPES: {
+        if (!value.isInt32()) {
+            thisObject->convertInt32ForValue(exec->vm(), value);
+            return putByIndex(cell, exec, propertyName, value, shouldThrow);
+        }
+        FALLTHROUGH;
+    }
+        
+    case ALL_CONTIGUOUS_INDEXING_TYPES: {
+        Butterfly* butterfly = thisObject->butterfly();
+        if (propertyName >= butterfly->vectorLength())
+            break;
+        butterfly->contiguous()[propertyName].set(exec->vm(), thisObject, value);
+        if (propertyName >= butterfly->publicLength())
+            butterfly->setPublicLength(propertyName + 1);
+        return true;
+    }
+        
+    case ALL_DOUBLE_INDEXING_TYPES: {
+        if (!value.isNumber()) {
+            thisObject->convertDoubleToContiguous(exec->vm());
+            // Reloop.
+            return putByIndex(cell, exec, propertyName, value, shouldThrow);
+        }
+        double valueAsDouble = value.asNumber();
+        if (valueAsDouble != valueAsDouble) {
+            thisObject->convertDoubleToContiguous(exec->vm());
+            // Reloop.
+            return putByIndex(cell, exec, propertyName, value, shouldThrow);
+        }
+        Butterfly* butterfly = thisObject->butterfly();
+        if (propertyName >= butterfly->vectorLength())
+            break;
+        butterfly->contiguousDouble()[propertyName] = valueAsDouble;
+        if (propertyName >= butterfly->publicLength())
+            butterfly->setPublicLength(propertyName + 1);
+        return true;
+    }
+        
+    case NonArrayWithArrayStorage:
+    case ArrayWithArrayStorage: {
+        ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
+        
+        if (propertyName >= storage->vectorLength())
+            break;
+        
+        WriteBarrier<Unknown>& valueSlot = storage->m_vector[propertyName];
+        unsigned length = storage->length();
+        
+        // Update length & m_numValuesInVector as necessary.
+        if (propertyName >= length) {
+            length = propertyName + 1;
+            storage->setLength(length);
+            ++storage->m_numValuesInVector;
+        } else if (!valueSlot)
+            ++storage->m_numValuesInVector;
+        
+        valueSlot.set(exec->vm(), thisObject, value);
+        return true;
+    }
+        
+    case NonArrayWithSlowPutArrayStorage:
+    case ArrayWithSlowPutArrayStorage: {
+        ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
+        
+        if (propertyName >= storage->vectorLength())
+            break;
+        
+        WriteBarrier<Unknown>& valueSlot = storage->m_vector[propertyName];
+        unsigned length = storage->length();
+        
+        // Update length & m_numValuesInVector as necessary.
+        if (propertyName >= length) {
+            bool putResult = false;
+            if (thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult))
+                return putResult;
+            length = propertyName + 1;
+            storage->setLength(length);
+            ++storage->m_numValuesInVector;
+        } else if (!valueSlot) {
+            bool putResult = false;
+            if (thisObject->attemptToInterceptPutByIndexOnHole(exec, propertyName, value, shouldThrow, putResult))
+                return putResult;
+            ++storage->m_numValuesInVector;
+        }
+        
+        valueSlot.set(exec->vm(), thisObject, value);
+        return true;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    
+    return thisObject->putByIndexBeyondVectorLength(exec, propertyName, value, shouldThrow);
+}
+
+ArrayStorage* JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(VM& vm, ArrayStorage* storage)
+{
+    SparseArrayValueMap* map = storage->m_sparseMap.get();
+
+    if (!map)
+        map = allocateSparseIndexMap(vm);
+
+    if (map->sparseMode())
+        return storage;
+
+    map->setSparseMode();
+
+    unsigned usedVectorLength = std::min(storage->length(), storage->vectorLength());
+    for (unsigned i = 0; i < usedVectorLength; ++i) {
+        JSValue value = storage->m_vector[i].get();
+        // This will always be a new entry in the map, so no need to check we can write,
+        // and attributes are default so no need to set them.
+        if (value)
+            map->add(this, i).iterator->value.set(vm, map, value);
+    }
+
+    DeferGC deferGC(vm.heap);
+    Butterfly* newButterfly = storage->butterfly()->resizeArray(vm, this, structure(vm), 0, ArrayStorage::sizeFor(0));
+    RELEASE_ASSERT(newButterfly);
+    newButterfly->arrayStorage()->m_indexBias = 0;
+    newButterfly->arrayStorage()->setVectorLength(0);
+    newButterfly->arrayStorage()->m_sparseMap.set(vm, this, map);
+    setButterfly(vm, newButterfly);
+    
+    return newButterfly->arrayStorage();
+}
+
+void JSObject::enterDictionaryIndexingMode(VM& vm)
+{
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+    case ALL_UNDECIDED_INDEXING_TYPES:
+    case ALL_INT32_INDEXING_TYPES:
+    case ALL_DOUBLE_INDEXING_TYPES:
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        // NOTE: this is horribly inefficient, as it will perform two conversions. We could optimize
+        // this case if we ever cared. Note that ensureArrayStorage() can return null if the object
+        // doesn't support traditional indexed properties. At the time of writing, this just affects
+        // typed arrays.
+        if (ArrayStorage* storage = ensureArrayStorageSlow(vm))
+            enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, storage);
+        break;
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get()->arrayStorage());
+        break;
+        
+    default:
+        break;
+    }
+}
+
+void JSObject::notifyPresenceOfIndexedAccessors(VM& vm)
+{
+    if (mayInterceptIndexedAccesses())
+        return;
+    
+    setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), NonPropertyTransition::AddIndexedAccessors));
+    
+    if (!vm.prototypeMap.isPrototype(this))
+        return;
+    
+    globalObject(vm)->haveABadTime(vm);
+}
+
+Butterfly* JSObject::createInitialIndexedStorage(VM& vm, unsigned length)
+{
+    ASSERT(length < MAX_ARRAY_INDEX);
+    IndexingType oldType = indexingType();
+    ASSERT_UNUSED(oldType, !hasIndexedProperties(oldType));
+    ASSERT(!structure()->needsSlowPutIndexing());
+    ASSERT(!indexingShouldBeSparse());
+    Structure* structure = this->structure(vm);
+    unsigned propertyCapacity = structure->outOfLineCapacity();
+    unsigned vectorLength = Butterfly::optimalContiguousVectorLength(propertyCapacity, length);
+    Butterfly* newButterfly = Butterfly::createOrGrowArrayRight(
+        m_butterfly.get(), vm, this, structure, propertyCapacity, false, 0,
+        sizeof(EncodedJSValue) * vectorLength);
+    newButterfly->setPublicLength(length);
+    newButterfly->setVectorLength(vectorLength);
+    return newButterfly;
+}
+
+Butterfly* JSObject::createInitialUndecided(VM& vm, unsigned length)
+{
+    DeferGC deferGC(vm.heap);
+    Butterfly* newButterfly = createInitialIndexedStorage(vm, length);
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, NonPropertyTransition::AllocateUndecided);
+    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
+    setStructure(vm, newStructure);
+    return newButterfly;
+}
+
+ContiguousJSValues JSObject::createInitialInt32(VM& vm, unsigned length)
+{
+    DeferGC deferGC(vm.heap);
+    Butterfly* newButterfly = createInitialIndexedStorage(vm, length);
+    for (unsigned i = newButterfly->vectorLength(); i--;)
+        newButterfly->contiguousInt32()[i].setWithoutWriteBarrier(JSValue());
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, NonPropertyTransition::AllocateInt32);
+    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
+    setStructure(vm, newStructure);
+    return newButterfly->contiguousInt32();
+}
+
+ContiguousDoubles JSObject::createInitialDouble(VM& vm, unsigned length)
+{
+    DeferGC deferGC(vm.heap);
+    Butterfly* newButterfly = createInitialIndexedStorage(vm, length);
+    for (unsigned i = newButterfly->vectorLength(); i--;)
+        newButterfly->contiguousDouble()[i] = PNaN;
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, NonPropertyTransition::AllocateDouble);
+    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
+    setStructure(vm, newStructure);
+    return newButterfly->contiguousDouble();
+}
+
+ContiguousJSValues JSObject::createInitialContiguous(VM& vm, unsigned length)
+{
+    DeferGC deferGC(vm.heap);
+    Butterfly* newButterfly = createInitialIndexedStorage(vm, length);
+    for (unsigned i = newButterfly->vectorLength(); i--;)
+        newButterfly->contiguous()[i].setWithoutWriteBarrier(JSValue());
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, NonPropertyTransition::AllocateContiguous);
+    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
+    setStructure(vm, newStructure);
+    return newButterfly->contiguous();
+}
+
+Butterfly* JSObject::createArrayStorageButterfly(VM& vm, JSCell* intendedOwner, Structure* structure, unsigned length, unsigned vectorLength, Butterfly* oldButterfly)
+{
+    Butterfly* newButterfly = Butterfly::createOrGrowArrayRight(
+        oldButterfly, vm, intendedOwner, structure, structure->outOfLineCapacity(), false, 0,
+        ArrayStorage::sizeFor(vectorLength));
+    RELEASE_ASSERT(newButterfly);
+
+    ArrayStorage* result = newButterfly->arrayStorage();
+    result->setLength(length);
+    result->setVectorLength(vectorLength);
+    result->m_sparseMap.clear();
+    result->m_numValuesInVector = 0;
+    result->m_indexBias = 0;
+    for (size_t i = vectorLength; i--;)
+        result->m_vector[i].setWithoutWriteBarrier(JSValue());
+
+    return newButterfly;
+}
+
+ArrayStorage* JSObject::createArrayStorage(VM& vm, unsigned length, unsigned vectorLength)
+{
+    DeferGC deferGC(vm.heap);
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    IndexingType oldType = indexingType();
+    ASSERT_UNUSED(oldType, !hasIndexedProperties(oldType));
+
+    Butterfly* newButterfly = createArrayStorageButterfly(vm, this, oldStructure, length, vectorLength, m_butterfly.get());
+    ArrayStorage* result = newButterfly->arrayStorage();
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, oldStructure->suggestedArrayStorageTransition());
+    nukeStructureAndSetButterfly(vm, oldStructureID, newButterfly);
+    setStructure(vm, newStructure);
+    return result;
+}
+
+ArrayStorage* JSObject::createInitialArrayStorage(VM& vm)
+{
+    return createArrayStorage(
+        vm, 0, ArrayStorage::optimalVectorLength(0, structure(vm)->outOfLineCapacity(), 0));
+}
+
+ContiguousJSValues JSObject::convertUndecidedToInt32(VM& vm)
+{
+    ASSERT(hasUndecided(indexingType()));
+
+    Butterfly* butterfly = m_butterfly.get();
+    for (unsigned i = butterfly->vectorLength(); i--;)
+        butterfly->contiguousInt32()[i].setWithoutWriteBarrier(JSValue());
+
+    setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), NonPropertyTransition::AllocateInt32));
+    return m_butterfly.get()->contiguousInt32();
+}
+
+ContiguousDoubles JSObject::convertUndecidedToDouble(VM& vm)
+{
+    ASSERT(hasUndecided(indexingType()));
+
+    Butterfly* butterfly = m_butterfly.get();
+    for (unsigned i = butterfly->vectorLength(); i--;)
+        butterfly->contiguousDouble()[i] = PNaN;
+    
+    setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), NonPropertyTransition::AllocateDouble));
+    return m_butterfly.get()->contiguousDouble();
+}
+
+ContiguousJSValues JSObject::convertUndecidedToContiguous(VM& vm)
+{
+    ASSERT(hasUndecided(indexingType()));
+
+    Butterfly* butterfly = m_butterfly.get();
+    for (unsigned i = butterfly->vectorLength(); i--;)
+        butterfly->contiguous()[i].setWithoutWriteBarrier(JSValue());
+
+    WTF::storeStoreFence();
+    setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), NonPropertyTransition::AllocateContiguous));
+    return m_butterfly.get()->contiguous();
+}
+
+ArrayStorage* JSObject::constructConvertedArrayStorageWithoutCopyingElements(VM& vm, unsigned neededLength)
+{
+    Structure* structure = this->structure(vm);
+    unsigned publicLength = m_butterfly.get()->publicLength();
+    unsigned propertyCapacity = structure->outOfLineCapacity();
+    unsigned propertySize = structure->outOfLineSize();
+    
+    Butterfly* newButterfly = Butterfly::createUninitialized(
+        vm, this, 0, propertyCapacity, true, ArrayStorage::sizeFor(neededLength));
+    
+    memcpy(
+        newButterfly->propertyStorage() - propertySize,
+        m_butterfly.get()->propertyStorage() - propertySize,
+        propertySize * sizeof(EncodedJSValue));
+    
+    ArrayStorage* newStorage = newButterfly->arrayStorage();
+    newStorage->setVectorLength(neededLength);
+    newStorage->setLength(publicLength);
+    newStorage->m_sparseMap.clear();
+    newStorage->m_indexBias = 0;
+    newStorage->m_numValuesInVector = 0;
+    
+    return newStorage;
+}
+
+ArrayStorage* JSObject::convertUndecidedToArrayStorage(VM& vm, NonPropertyTransition transition)
+{
+    DeferGC deferGC(vm.heap);
+    ASSERT(hasUndecided(indexingType()));
+
+    unsigned vectorLength = m_butterfly.get()->vectorLength();
+    ArrayStorage* storage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
+    
+    for (unsigned i = vectorLength; i--;)
+        storage->m_vector[i].setWithoutWriteBarrier(JSValue());
+    
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, transition);
+    nukeStructureAndSetButterfly(vm, oldStructureID, storage->butterfly());
+    setStructure(vm, newStructure);
+    return storage;
+}
+
+ArrayStorage* JSObject::convertUndecidedToArrayStorage(VM& vm)
+{
+    return convertUndecidedToArrayStorage(vm, structure(vm)->suggestedArrayStorageTransition());
+}
+
+ContiguousDoubles JSObject::convertInt32ToDouble(VM& vm)
+{
+    ASSERT(hasInt32(indexingType()));
+
+    Butterfly* butterfly = m_butterfly.get();
+    for (unsigned i = butterfly->vectorLength(); i--;) {
+        WriteBarrier<Unknown>* current = &butterfly->contiguousInt32()[i];
+        double* currentAsDouble = bitwise_cast<double*>(current);
+        JSValue v = current->get();
+        // NOTE: Since this may be used during initialization, v could be garbage. If it's garbage,
+        // that means it will be overwritten later.
+        if (!v.isInt32()) {
+            *currentAsDouble = PNaN;
+            continue;
+        }
+        *currentAsDouble = v.asInt32();
+    }
+    
+    setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), NonPropertyTransition::AllocateDouble));
+    return m_butterfly.get()->contiguousDouble();
+}
+
+ContiguousJSValues JSObject::convertInt32ToContiguous(VM& vm)
+{
+    ASSERT(hasInt32(indexingType()));
+    
+    setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), NonPropertyTransition::AllocateContiguous));
+    return m_butterfly.get()->contiguous();
+}
+
+ArrayStorage* JSObject::convertInt32ToArrayStorage(VM& vm, NonPropertyTransition transition)
+{
+    DeferGC deferGC(vm.heap);
+    ASSERT(hasInt32(indexingType()));
+
+    unsigned vectorLength = m_butterfly.get()->vectorLength();
+    ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
+    Butterfly* butterfly = m_butterfly.get();
+    for (unsigned i = 0; i < vectorLength; i++) {
+        JSValue v = butterfly->contiguous()[i].get();
+        newStorage->m_vector[i].setWithoutWriteBarrier(v);
+        if (v)
+            newStorage->m_numValuesInVector++;
+    }
+    
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, transition);
+    nukeStructureAndSetButterfly(vm, oldStructureID, newStorage->butterfly());
+    setStructure(vm, newStructure);
+    return newStorage;
+}
+
+ArrayStorage* JSObject::convertInt32ToArrayStorage(VM& vm)
+{
+    return convertInt32ToArrayStorage(vm, structure(vm)->suggestedArrayStorageTransition());
+}
+
+ContiguousJSValues JSObject::convertDoubleToContiguous(VM& vm)
+{
+    ASSERT(hasDouble(indexingType()));
+
+    Butterfly* butterfly = m_butterfly.get();
+    for (unsigned i = butterfly->vectorLength(); i--;) {
+        double* current = &butterfly->contiguousDouble()[i];
+        WriteBarrier<Unknown>* currentAsValue = bitwise_cast<WriteBarrier<Unknown>*>(current);
+        double value = *current;
+        if (value != value) {
+            currentAsValue->clear();
+            continue;
+        }
+        JSValue v = JSValue(JSValue::EncodeAsDouble, value);
+        currentAsValue->setWithoutWriteBarrier(v);
+    }
+    
+    WTF::storeStoreFence();
+    setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), NonPropertyTransition::AllocateContiguous));
+    return m_butterfly.get()->contiguous();
+}
+
+ArrayStorage* JSObject::convertDoubleToArrayStorage(VM& vm, NonPropertyTransition transition)
+{
+    DeferGC deferGC(vm.heap);
+    ASSERT(hasDouble(indexingType()));
+
+    unsigned vectorLength = m_butterfly.get()->vectorLength();
+    ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
+    Butterfly* butterfly = m_butterfly.get();
+    for (unsigned i = 0; i < vectorLength; i++) {
+        double value = butterfly->contiguousDouble()[i];
+        newStorage->m_vector[i].setWithoutWriteBarrier(JSValue(JSValue::EncodeAsDouble, value));
+        if (value == value)
+            newStorage->m_numValuesInVector++;
+    }
+    
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, transition);
+    nukeStructureAndSetButterfly(vm, oldStructureID, newStorage->butterfly());
+    setStructure(vm, newStructure);
+    return newStorage;
+}
+
+ArrayStorage* JSObject::convertDoubleToArrayStorage(VM& vm)
+{
+    return convertDoubleToArrayStorage(vm, structure(vm)->suggestedArrayStorageTransition());
+}
+
+ArrayStorage* JSObject::convertContiguousToArrayStorage(VM& vm, NonPropertyTransition transition)
+{
+    DeferGC deferGC(vm.heap);
+    ASSERT(hasContiguous(indexingType()));
+
+    unsigned vectorLength = m_butterfly.get()->vectorLength();
+    ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
+    Butterfly* butterfly = m_butterfly.get();
+    for (unsigned i = 0; i < vectorLength; i++) {
+        JSValue v = butterfly->contiguous()[i].get();
+        newStorage->m_vector[i].setWithoutWriteBarrier(v);
+        if (v)
+            newStorage->m_numValuesInVector++;
+    }
+    
+    Structure* newStructure = Structure::nonPropertyTransition(vm, structure(vm), transition);
+
+    // This has a crazy race with the garbage collector. When changing the butterfly and structure,
+    // the mutator always sets the structure last. The collector will always read the structure
+    // first. We probably have to follow that convention here as well. This means that the collector
+    // will sometimes see the new butterfly (the one with ArrayStorage) with the only structure (the
+    // one that says that the butterfly is Contiguous). When scanning Contiguous, the collector will
+    // mark word at addresses greater than or equal to the butterfly pointer, up to the publicLength
+    // in the butterfly. But an ArrayStorage has some non-pointer header data at low positive
+    // offsets from the butterfly - so when this race happens, the collector will surely crash
+    // because it will fail to decode two consecutive int32s as if it was a JSValue.
+    //
+    // Fortunately, we have the JSCell lock for this purpose!
+    
+    if (vm.heap.mutatorShouldBeFenced()) {
+        auto locker = holdLock(*this);
+        setStructureIDDirectly(nuke(structureID()));
+        WTF::storeStoreFence();
+        m_butterfly.set(vm, this, newStorage->butterfly());
+        WTF::storeStoreFence();
+        setStructure(vm, newStructure);
+    } else {
+        m_butterfly.set(vm, this, newStorage->butterfly());
+        setStructure(vm, newStructure);
+    }
+    
+    return newStorage;
+}
+
+ArrayStorage* JSObject::convertContiguousToArrayStorage(VM& vm)
+{
+    return convertContiguousToArrayStorage(vm, structure(vm)->suggestedArrayStorageTransition());
+}
+
+void JSObject::convertUndecidedForValue(VM& vm, JSValue value)
+{
+    IndexingType type = indexingTypeForValue(value);
+    if (type == Int32Shape) {
+        convertUndecidedToInt32(vm);
+        return;
+    }
+    
+    if (type == DoubleShape) {
+        convertUndecidedToDouble(vm);
+        return;
+    }
+
+    ASSERT(type == ContiguousShape);
+    convertUndecidedToContiguous(vm);
+}
+
+void JSObject::createInitialForValueAndSet(VM& vm, unsigned index, JSValue value)
+{
+    if (value.isInt32()) {
+        createInitialInt32(vm, index + 1)[index].set(vm, this, value);
+        return;
+    }
+    
+    if (value.isDouble()) {
+        double doubleValue = value.asNumber();
+        if (doubleValue == doubleValue) {
+            createInitialDouble(vm, index + 1)[index] = doubleValue;
+            return;
+        }
+    }
+    
+    createInitialContiguous(vm, index + 1)[index].set(vm, this, value);
+}
+
+void JSObject::convertInt32ForValue(VM& vm, JSValue value)
+{
+    ASSERT(!value.isInt32());
+    
+    if (value.isDouble() && !std::isnan(value.asDouble())) {
+        convertInt32ToDouble(vm);
+        return;
+    }
+    
+    convertInt32ToContiguous(vm);
+}
+
+void JSObject::setIndexQuicklyToUndecided(VM& vm, unsigned index, JSValue value)
+{
+    ASSERT(index < m_butterfly.get()->publicLength());
+    ASSERT(index < m_butterfly.get()->vectorLength());
+    convertUndecidedForValue(vm, value);
+    setIndexQuickly(vm, index, value);
+}
+
+void JSObject::convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(VM& vm, unsigned index, JSValue value)
+{
+    ASSERT(!value.isInt32());
+    convertInt32ForValue(vm, value);
+    setIndexQuickly(vm, index, value);
+}
+
+void JSObject::convertDoubleToContiguousWhilePerformingSetIndex(VM& vm, unsigned index, JSValue value)
+{
+    ASSERT(!value.isNumber() || value.asNumber() != value.asNumber());
+    convertDoubleToContiguous(vm);
+    setIndexQuickly(vm, index, value);
+}
+
+ContiguousJSValues JSObject::ensureInt32Slow(VM& vm)
+{
+    ASSERT(inherits(info()));
+    
+    if (structure(vm)->hijacksIndexingHeader())
+        return ContiguousJSValues();
+    
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+        if (UNLIKELY(indexingShouldBeSparse() || structure(vm)->needsSlowPutIndexing()))
+            return ContiguousJSValues();
+        return createInitialInt32(vm, 0);
+        
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        return convertUndecidedToInt32(vm);
+        
+    case ALL_DOUBLE_INDEXING_TYPES:
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        return ContiguousJSValues();
+        
+    default:
+        CRASH();
+        return ContiguousJSValues();
+    }
+}
+
+ContiguousDoubles JSObject::ensureDoubleSlow(VM& vm)
+{
+    ASSERT(inherits(info()));
+    
+    if (structure(vm)->hijacksIndexingHeader())
+        return ContiguousDoubles();
+    
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+        if (UNLIKELY(indexingShouldBeSparse() || structure(vm)->needsSlowPutIndexing()))
+            return ContiguousDoubles();
+        return createInitialDouble(vm, 0);
+        
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        return convertUndecidedToDouble(vm);
+        
+    case ALL_INT32_INDEXING_TYPES:
+        return convertInt32ToDouble(vm);
+        
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        return ContiguousDoubles();
+        
+    default:
+        CRASH();
+        return ContiguousDoubles();
+    }
+}
+
+ContiguousJSValues JSObject::ensureContiguousSlow(VM& vm)
+{
+    ASSERT(inherits(info()));
+    
+    if (structure(vm)->hijacksIndexingHeader())
+        return ContiguousJSValues();
+    
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+        if (UNLIKELY(indexingShouldBeSparse() || structure(vm)->needsSlowPutIndexing()))
+            return ContiguousJSValues();
+        return createInitialContiguous(vm, 0);
+        
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        return convertUndecidedToContiguous(vm);
+        
+    case ALL_INT32_INDEXING_TYPES:
+        return convertInt32ToContiguous(vm);
+        
+    case ALL_DOUBLE_INDEXING_TYPES:
+        return convertDoubleToContiguous(vm);
+        
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        return ContiguousJSValues();
+        
+    default:
+        CRASH();
+        return ContiguousJSValues();
+    }
+}
+
+ArrayStorage* JSObject::ensureArrayStorageSlow(VM& vm)
+{
+    ASSERT(inherits(info()));
+
+    if (structure(vm)->hijacksIndexingHeader())
+        return nullptr;
+    
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+        if (UNLIKELY(indexingShouldBeSparse()))
+            return ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm);
+        return createInitialArrayStorage(vm);
+        
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        ASSERT(!indexingShouldBeSparse());
+        ASSERT(!structure(vm)->needsSlowPutIndexing());
+        return convertUndecidedToArrayStorage(vm);
+        
+    case ALL_INT32_INDEXING_TYPES:
+        ASSERT(!indexingShouldBeSparse());
+        ASSERT(!structure(vm)->needsSlowPutIndexing());
+        return convertInt32ToArrayStorage(vm);
+        
+    case ALL_DOUBLE_INDEXING_TYPES:
+        ASSERT(!indexingShouldBeSparse());
+        ASSERT(!structure(vm)->needsSlowPutIndexing());
+        return convertDoubleToArrayStorage(vm);
+        
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        ASSERT(!indexingShouldBeSparse());
+        ASSERT(!structure(vm)->needsSlowPutIndexing());
+        return convertContiguousToArrayStorage(vm);
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+ArrayStorage* JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode(VM& vm)
+{
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES: {
+        createArrayStorage(vm, 0, 0);
+        SparseArrayValueMap* map = allocateSparseIndexMap(vm);
+        map->setSparseMode();
+        return arrayStorage();
+    }
+        
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, convertUndecidedToArrayStorage(vm));
+        
+    case ALL_INT32_INDEXING_TYPES:
+        return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, convertInt32ToArrayStorage(vm));
+        
+    case ALL_DOUBLE_INDEXING_TYPES:
+        return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, convertDoubleToArrayStorage(vm));
+        
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, convertContiguousToArrayStorage(vm));
+        
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get()->arrayStorage());
+        
+    default:
+        CRASH();
+        return 0;
+    }
+}
+
+void JSObject::switchToSlowPutArrayStorage(VM& vm)
+{
+    switch (indexingType()) {
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        convertUndecidedToArrayStorage(vm, NonPropertyTransition::AllocateSlowPutArrayStorage);
+        break;
+        
+    case ALL_INT32_INDEXING_TYPES:
+        convertInt32ToArrayStorage(vm, NonPropertyTransition::AllocateSlowPutArrayStorage);
+        break;
+        
+    case ALL_DOUBLE_INDEXING_TYPES:
+        convertDoubleToArrayStorage(vm, NonPropertyTransition::AllocateSlowPutArrayStorage);
+        break;
+        
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        convertContiguousToArrayStorage(vm, NonPropertyTransition::AllocateSlowPutArrayStorage);
+        break;
+        
+    case NonArrayWithArrayStorage:
+    case ArrayWithArrayStorage: {
+        Structure* newStructure = Structure::nonPropertyTransition(vm, structure(vm), NonPropertyTransition::SwitchToSlowPutArrayStorage);
+        setStructure(vm, newStructure);
+        break;
+    }
+        
+    default:
+        CRASH();
+        break;
+    }
+}
+
+void JSObject::setPrototypeDirect(VM& vm, JSValue prototype)
+{
+    ASSERT(prototype);
+    if (prototype.isObject())
+        vm.prototypeMap.addPrototype(asObject(prototype));
+    
+    Structure* newStructure = Structure::changePrototypeTransition(vm, structure(vm), prototype);
+    setStructure(vm, newStructure);
+    
+    if (!newStructure->anyObjectInChainMayInterceptIndexedAccesses())
+        return;
+    
+    if (vm.prototypeMap.isPrototype(this)) {
+        newStructure->globalObject()->haveABadTime(vm);
+        return;
+    }
+    
+    if (!hasIndexedProperties(indexingType()))
+        return;
+    
+    if (shouldUseSlowPut(indexingType()))
+        return;
+    
+    switchToSlowPutArrayStorage(vm);
+}
+
+bool JSObject::setPrototypeWithCycleCheck(VM& vm, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ASSERT(methodTable(vm)->toThis(this, exec, NotStrictMode) == this);
+
+    if (this->getPrototypeDirect() == prototype)
+        return true;
+
+    if (this->structure(vm)->isImmutablePrototypeExoticObject())
+        return typeError(exec, scope, shouldThrowIfCantSet, ASCIILiteral("Cannot set prototype of immutable prototype object"));
+
+    bool isExtensible = this->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!isExtensible)
+        return typeError(exec, scope, shouldThrowIfCantSet, ASCIILiteral(ReadonlyPropertyWriteError));
+
+    JSValue nextPrototype = prototype;
+    while (nextPrototype && nextPrototype.isObject()) {
+        if (nextPrototype == this)
+            return typeError(exec, scope, shouldThrowIfCantSet, ASCIILiteral("cyclic __proto__ value"));
+        // FIXME: The specification currently says we should check if the [[GetPrototypeOf]] internal method of nextPrototype
+        // is not the ordinary object internal method. However, we currently restrict this to Proxy objects as it would allow
+        // for cycles with certain HTML objects (WindowProxy, Location) otherwise.
+        // https://bugs.webkit.org/show_bug.cgi?id=161534
+        if (UNLIKELY(asObject(nextPrototype)->type() == ProxyObjectType))
+            break; // We're done. Set the prototype.
+        nextPrototype = asObject(nextPrototype)->getPrototypeDirect();
+    }
+    setPrototypeDirect(vm, prototype);
+    return true;
+}
+
+bool JSObject::setPrototype(JSObject* object, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
+{
+    return object->setPrototypeWithCycleCheck(exec->vm(), exec, prototype, shouldThrowIfCantSet);
+}
+
+JSValue JSObject::getPrototype(JSObject* object, ExecState*)
+{
+    return object->getPrototypeDirect();
+}
+
+bool JSObject::setPrototype(VM& vm, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
+{
+    return methodTable(vm)->setPrototype(this, exec, prototype, shouldThrowIfCantSet);
+}
+
+bool JSObject::putGetter(ExecState* exec, PropertyName propertyName, JSValue getter, unsigned attributes)
+{
+    PropertyDescriptor descriptor;
+    descriptor.setGetter(getter);
+
+    ASSERT(attributes & Accessor);
+    if (!(attributes & ReadOnly))
+        descriptor.setConfigurable(true);
+    if (!(attributes & DontEnum))
+        descriptor.setEnumerable(true);
+
+    return defineOwnProperty(this, exec, propertyName, descriptor, false);
+}
+
+bool JSObject::putSetter(ExecState* exec, PropertyName propertyName, JSValue setter, unsigned attributes)
+{
+    PropertyDescriptor descriptor;
+    descriptor.setSetter(setter);
+
+    ASSERT(attributes & Accessor);
+    if (!(attributes & ReadOnly))
+        descriptor.setConfigurable(true);
+    if (!(attributes & DontEnum))
+        descriptor.setEnumerable(true);
+
+    return defineOwnProperty(this, exec, propertyName, descriptor, false);
+}
+
+bool JSObject::putDirectAccessor(ExecState* exec, PropertyName propertyName, JSValue value, unsigned attributes)
+{
+    ASSERT(value.isGetterSetter() && (attributes & Accessor));
+
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return putDirectIndex(exec, index.value(), value, attributes, PutDirectIndexLikePutDirect);
+
+    return putDirectNonIndexAccessor(exec->vm(), propertyName, value, attributes);
+}
+
+bool JSObject::putDirectCustomAccessor(VM& vm, PropertyName propertyName, JSValue value, unsigned attributes)
+{
+    ASSERT(!parseIndex(propertyName));
+
+    PutPropertySlot slot(this);
+    bool result = putDirectInternal<PutModeDefineOwnProperty>(vm, propertyName, value, attributes, slot);
+
+    ASSERT(slot.type() == PutPropertySlot::NewProperty);
+
+    Structure* structure = this->structure(vm);
+    if (attributes & ReadOnly)
+        structure->setContainsReadOnlyProperties();
+    structure->setHasCustomGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames->underscoreProto);
+    return result;
+}
+
+bool JSObject::putDirectNonIndexAccessor(VM& vm, PropertyName propertyName, JSValue value, unsigned attributes)
+{
+    PutPropertySlot slot(this);
+    bool result = putDirectInternal<PutModeDefineOwnProperty>(vm, propertyName, value, attributes, slot);
+
+    Structure* structure = this->structure(vm);
+    if (attributes & ReadOnly)
+        structure->setContainsReadOnlyProperties();
+
+    structure->setHasGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames->underscoreProto);
+    return result;
+}
+
+// HasProperty(O, P) from Section 7.3.10 of the spec.
+// http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasproperty
+bool JSObject::hasProperty(ExecState* exec, PropertyName propertyName) const
+{
+    return hasPropertyGeneric(exec, propertyName, PropertySlot::InternalMethodType::HasProperty);
+}
+
+bool JSObject::hasProperty(ExecState* exec, unsigned propertyName) const
+{
+    return hasPropertyGeneric(exec, propertyName, PropertySlot::InternalMethodType::HasProperty);
+}
+
+bool JSObject::hasPropertyGeneric(ExecState* exec, PropertyName propertyName, PropertySlot::InternalMethodType internalMethodType) const
+{
+    PropertySlot slot(this, internalMethodType);
+    return const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot);
+}
+
+bool JSObject::hasPropertyGeneric(ExecState* exec, unsigned propertyName, PropertySlot::InternalMethodType internalMethodType) const
+{
+    PropertySlot slot(this, internalMethodType);
+    return const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot);
+}
+
+// ECMA 8.6.2.5
+bool JSObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    JSObject* thisObject = jsCast<JSObject*>(cell);
+    VM& vm = exec->vm();
+    
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return thisObject->methodTable(vm)->deletePropertyByIndex(thisObject, exec, index.value());
+
+    unsigned attributes;
+
+    if (!thisObject->staticPropertiesReified()) {
+        if (auto* entry = thisObject->findPropertyHashEntry(propertyName)) {
+            // If the static table contains a non-configurable (DontDelete) property then we can return early;
+            // if there is a property in the storage array it too must be non-configurable (the language does
+            // not allow repacement of a non-configurable property with a configurable one).
+            if (entry->attributes() & DontDelete && vm.deletePropertyMode() != VM::DeletePropertyMode::IgnoreConfigurable) {
+                ASSERT(!isValidOffset(thisObject->structure(vm)->get(vm, propertyName, attributes)) || attributes & DontDelete);
+                return false;
+            }
+            thisObject->reifyAllStaticProperties(exec);
+        }
+    }
+
+    Structure* structure = thisObject->structure(vm);
+
+    bool propertyIsPresent = isValidOffset(structure->get(vm, propertyName, attributes));
+    if (propertyIsPresent) {
+        if (attributes & DontDelete && vm.deletePropertyMode() != VM::DeletePropertyMode::IgnoreConfigurable)
+            return false;
+
+        PropertyOffset offset;
+        if (structure->isUncacheableDictionary())
+            offset = structure->removePropertyWithoutTransition(vm, propertyName, [] (const ConcurrentJSLocker&, PropertyOffset) { });
+        else
+            thisObject->setStructure(vm, Structure::removePropertyTransition(vm, structure, propertyName, offset));
+
+        if (offset != invalidOffset)
+            thisObject->putDirectUndefined(offset);
+    }
+
+    return true;
+}
+
+bool JSObject::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned i)
+{
+    JSObject* thisObject = jsCast<JSObject*>(cell);
+    
+    if (i > MAX_ARRAY_INDEX)
+        return thisObject->methodTable(exec->vm())->deleteProperty(thisObject, exec, Identifier::from(exec, i));
+    
+    switch (thisObject->indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        return true;
+        
+    case ALL_INT32_INDEXING_TYPES:
+    case ALL_CONTIGUOUS_INDEXING_TYPES: {
+        Butterfly* butterfly = thisObject->butterfly();
+        if (i >= butterfly->vectorLength())
+            return true;
+        butterfly->contiguous()[i].clear();
+        return true;
+    }
+        
+    case ALL_DOUBLE_INDEXING_TYPES: {
+        Butterfly* butterfly = thisObject->butterfly();
+        if (i >= butterfly->vectorLength())
+            return true;
+        butterfly->contiguousDouble()[i] = PNaN;
+        return true;
+    }
+        
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+        ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
+        
+        if (i < storage->vectorLength()) {
+            WriteBarrier<Unknown>& valueSlot = storage->m_vector[i];
+            if (valueSlot) {
+                valueSlot.clear();
+                --storage->m_numValuesInVector;
+            }
+        } else if (SparseArrayValueMap* map = storage->m_sparseMap.get()) {
+            SparseArrayValueMap::iterator it = map->find(i);
+            if (it != map->notFound()) {
+                if (it->value.attributes & DontDelete)
+                    return false;
+                map->remove(it);
+            }
+        }
+        
+        return true;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
+enum class TypeHintMode { TakesHint, DoesNotTakeHint };
+
+template<TypeHintMode mode = TypeHintMode::DoesNotTakeHint>
+static ALWAYS_INLINE JSValue callToPrimitiveFunction(ExecState* exec, const JSObject* object, PropertyName propertyName, PreferredPrimitiveType hint)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue function = object->get(exec, propertyName);
+    RETURN_IF_EXCEPTION(scope, scope.exception());
+    if (function.isUndefined() && mode == TypeHintMode::TakesHint)
+        return JSValue();
+    CallData callData;
+    CallType callType = getCallData(function, callData);
+    if (callType == CallType::None)
+        return scope.exception();
+
+    MarkedArgumentBuffer callArgs;
+    if (mode == TypeHintMode::TakesHint) {
+        JSString* hintString = nullptr;
+        switch (hint) {
+        case NoPreference:
+            hintString = vm.smallStrings.defaultString();
+            break;
+        case PreferNumber:
+            hintString = vm.smallStrings.numberString();
+            break;
+        case PreferString:
+            hintString = vm.smallStrings.stringString();
+            break;
+        }
+        callArgs.append(hintString);
+    }
+
+    JSValue result = call(exec, function, callType, callData, const_cast<JSObject*>(object), callArgs);
+    RETURN_IF_EXCEPTION(scope, scope.exception());
+    ASSERT(!result.isGetterSetter());
+    if (result.isObject())
+        return mode == TypeHintMode::DoesNotTakeHint ? JSValue() : throwTypeError(exec, scope, ASCIILiteral("Symbol.toPrimitive returned an object"));
+    return result;
+}
+
+// ECMA 7.1.1
+JSValue JSObject::ordinaryToPrimitive(ExecState* exec, PreferredPrimitiveType hint) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // Make sure that whatever default value methods there are on object's prototype chain are
+    // being watched.
+    this->structure()->startWatchingInternalPropertiesIfNecessaryForEntireChain(vm);
+
+    JSValue value;
+    if (hint == PreferString) {
+        value = callToPrimitiveFunction(exec, this, exec->propertyNames().toString, hint);
+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
+        if (value)
+            return value;
+        value = callToPrimitiveFunction(exec, this, exec->propertyNames().valueOf, hint);
+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
+        if (value)
+            return value;
+    } else {
+        value = callToPrimitiveFunction(exec, this, exec->propertyNames().valueOf, hint);
+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
+        if (value)
+            return value;
+        value = callToPrimitiveFunction(exec, this, exec->propertyNames().toString, hint);
+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
+        if (value)
+            return value;
+    }
+
+    ASSERT(!scope.exception());
+
+    return throwTypeError(exec, scope, ASCIILiteral("No default value"));
+}
+
+JSValue JSObject::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType hint)
+{
+    return object->ordinaryToPrimitive(exec, hint);
+}
+
+JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+{
+    JSValue value = callToPrimitiveFunction<TypeHintMode::TakesHint>(exec, this, exec->propertyNames().toPrimitiveSymbol, preferredType);
+    if (value)
+        return value;
+
+    return this->methodTable(exec->vm())->defaultValue(this, exec, preferredType);
+}
+
+bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result) const
+{
+    result = toPrimitive(exec, PreferNumber);
+    number = result.toNumber(exec);
+    return !result.isString();
+}
+
+bool JSObject::getOwnStaticPropertySlot(VM& vm, PropertyName propertyName, PropertySlot& slot)
+{
+    for (auto* info = classInfo(); info; info = info->parentClass) {
+        if (auto* table = info->staticPropHashTable) {
+            if (getStaticPropertySlotFromTable(vm, *table, this, propertyName, slot))
+                return true;
+        }
+    }
+    return false;
+}
+
+const HashTableValue* JSObject::findPropertyHashEntry(PropertyName propertyName) const
+{
+    for (const ClassInfo* info = classInfo(); info; info = info->parentClass) {
+        if (const HashTable* propHashTable = info->staticPropHashTable) {
+            if (const HashTableValue* entry = propHashTable->entry(propertyName))
+                return entry;
+        }
+    }
+    return 0;
+}
+
+bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue hasInstanceValue)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+
+    if (!hasInstanceValue.isUndefinedOrNull() && hasInstanceValue != exec->lexicalGlobalObject()->functionProtoHasInstanceSymbolFunction()) {
+        CallData callData;
+        CallType callType = JSC::getCallData(hasInstanceValue, callData);
+        if (callType == CallType::None) {
+            throwException(exec, scope, createInvalidInstanceofParameterErrorhasInstanceValueNotFunction(exec, this));
+            return false;
+        }
+
+        MarkedArgumentBuffer args;
+        args.append(value);
+        JSValue result = call(exec, hasInstanceValue, callType, callData, this, args);
+        return result.toBoolean(exec);
+    }
+
+    TypeInfo info = structure(vm)->typeInfo();
+    if (info.implementsDefaultHasInstance())
+        return defaultHasInstance(exec, value, get(exec, exec->propertyNames().prototype));
+    if (info.implementsHasInstance())
+        return methodTable(vm)->customHasInstance(this, exec, value);
+    throwException(exec, scope, createInvalidInstanceofParameterErrorNotFunction(exec, this));
+    return false;
+}
+
+bool JSObject::hasInstance(ExecState* exec, JSValue value)
+{
+    JSValue hasInstanceValue = get(exec, exec->propertyNames().hasInstanceSymbol);
+
+    return hasInstance(exec, value, hasInstanceValue);
+}
+
+bool JSObject::defaultHasInstance(ExecState* exec, JSValue value, JSValue proto)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!value.isObject())
+        return false;
+
+    if (!proto.isObject()) {
+        throwTypeError(exec, scope, ASCIILiteral("instanceof called on an object with an invalid prototype property."));
+        return false;
+    }
+
+    JSObject* object = asObject(value);
+    while (true) {
+        JSValue objectValue = object->getPrototype(vm, exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (!objectValue.isObject())
+            return false;
+        object = asObject(objectValue);
+        if (proto == object)
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+EncodedJSValue JSC_HOST_CALL objectPrivateFuncInstanceOf(ExecState* exec)
+{
+    JSValue value = exec->uncheckedArgument(0);
+    JSValue proto = exec->uncheckedArgument(1);
+
+    return JSValue::encode(jsBoolean(JSObject::defaultHasInstance(exec, value, proto)));
+}
+
+void JSObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    object->methodTable(vm)->getOwnPropertyNames(object, exec, propertyNames, mode);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    JSValue nextProto = object->getPrototype(vm, exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (nextProto.isNull())
+        return;
+
+    JSObject* prototype = asObject(nextProto);
+    while(1) {
+        if (prototype->structure(vm)->typeInfo().overridesGetPropertyNames()) {
+            prototype->methodTable(vm)->getPropertyNames(prototype, exec, propertyNames, mode);
+            break;
+        }
+        prototype->methodTable(vm)->getOwnPropertyNames(prototype, exec, propertyNames, mode);
+        RETURN_IF_EXCEPTION(scope, void());
+        nextProto = prototype->getPrototype(vm, exec);
+        RETURN_IF_EXCEPTION(scope, void());
+        if (nextProto.isNull())
+            break;
+        prototype = asObject(nextProto);
+    }
+}
+
+void JSObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (!mode.includeJSObjectProperties()) {
+        // We still have to get non-indexed properties from any subclasses of JSObject that have them.
+        object->methodTable(exec->vm())->getOwnNonIndexPropertyNames(object, exec, propertyNames, mode);
+        return;
+    }
+
+    if (propertyNames.includeStringProperties()) {
+        // Add numeric properties first. That appears to be the accepted convention.
+        // FIXME: Filling PropertyNameArray with an identifier for every integer
+        // is incredibly inefficient for large arrays. We need a different approach,
+        // which almost certainly means a different structure for PropertyNameArray.
+        switch (object->indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_UNDECIDED_INDEXING_TYPES:
+            break;
+            
+        case ALL_INT32_INDEXING_TYPES:
+        case ALL_CONTIGUOUS_INDEXING_TYPES: {
+            Butterfly* butterfly = object->butterfly();
+            unsigned usedLength = butterfly->publicLength();
+            for (unsigned i = 0; i < usedLength; ++i) {
+                if (!butterfly->contiguous()[i])
+                    continue;
+                propertyNames.add(i);
+            }
+            break;
+        }
+            
+        case ALL_DOUBLE_INDEXING_TYPES: {
+            Butterfly* butterfly = object->butterfly();
+            unsigned usedLength = butterfly->publicLength();
+            for (unsigned i = 0; i < usedLength; ++i) {
+                double value = butterfly->contiguousDouble()[i];
+                if (value != value)
+                    continue;
+                propertyNames.add(i);
+            }
+            break;
+        }
+            
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+            ArrayStorage* storage = object->m_butterfly.get()->arrayStorage();
+            
+            unsigned usedVectorLength = std::min(storage->length(), storage->vectorLength());
+            for (unsigned i = 0; i < usedVectorLength; ++i) {
+                if (storage->m_vector[i])
+                    propertyNames.add(i);
+            }
+            
+            if (SparseArrayValueMap* map = storage->m_sparseMap.get()) {
+                Vector<unsigned, 0, UnsafeVectorOverflow> keys;
+                keys.reserveInitialCapacity(map->size());
+                
+                SparseArrayValueMap::const_iterator end = map->end();
+                for (SparseArrayValueMap::const_iterator it = map->begin(); it != end; ++it) {
+                    if (mode.includeDontEnumProperties() || !(it->value.attributes & DontEnum))
+                        keys.uncheckedAppend(static_cast<unsigned>(it->key));
+                }
+                
+                std::sort(keys.begin(), keys.end());
+                for (unsigned i = 0; i < keys.size(); ++i)
+                    propertyNames.add(keys[i]);
+            }
+            break;
+        }
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    object->methodTable(exec->vm())->getOwnNonIndexPropertyNames(object, exec, propertyNames, mode);
+}
+
+void JSObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (!object->staticPropertiesReified())
+        getClassPropertyNames(exec, object->classInfo(), propertyNames, mode);
+
+    if (!mode.includeJSObjectProperties())
+        return;
+    
+    VM& vm = exec->vm();
+    object->structure(vm)->getPropertyNamesFromStructure(vm, propertyNames, mode);
+}
+
+double JSObject::toNumber(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue primitive = toPrimitive(exec, PreferNumber);
+    RETURN_IF_EXCEPTION(scope, 0.0); // should be picked up soon in Nodes.cpp
+    return primitive.toNumber(exec);
+}
+
+JSString* JSObject::toString(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue primitive = toPrimitive(exec, PreferString);
+    RETURN_IF_EXCEPTION(scope, jsEmptyString(exec));
+    return primitive.toString(exec);
+}
+
+JSValue JSObject::toThis(JSCell* cell, ExecState*, ECMAMode)
+{
+    return jsCast<JSObject*>(cell);
+}
+
+void JSObject::seal(VM& vm)
+{
+    if (isSealed(vm))
+        return;
+    enterDictionaryIndexingMode(vm);
+    setStructure(vm, Structure::sealTransition(vm, structure(vm)));
+}
+
+void JSObject::freeze(VM& vm)
+{
+    if (isFrozen(vm))
+        return;
+    enterDictionaryIndexingMode(vm);
+    setStructure(vm, Structure::freezeTransition(vm, structure(vm)));
+}
+
+bool JSObject::preventExtensions(JSObject* object, ExecState* exec)
+{
+    if (!object->isStructureExtensible()) {
+        // We've already set the internal [[PreventExtensions]] field to false.
+        // We don't call the methodTable isExtensible here because it's not defined
+        // that way in the specification. We are just doing an optimization here.
+        return true;
+    }
+
+    VM& vm = exec->vm();
+    object->enterDictionaryIndexingMode(vm);
+    object->setStructure(vm, Structure::preventExtensionsTransition(vm, object->structure(vm)));
+    return true;
+}
+
+bool JSObject::isExtensible(JSObject* obj, ExecState*)
+{
+    return obj->isExtensibleImpl();
+}
+
+bool JSObject::isExtensible(ExecState* exec)
+{ 
+    VM& vm = exec->vm();
+    return methodTable(vm)->isExtensible(this, exec);
+}
+
+void JSObject::reifyAllStaticProperties(ExecState* exec)
+{
+    ASSERT(!staticPropertiesReified());
+    VM& vm = exec->vm();
+
+    // If this object's ClassInfo has no static properties, then nothing to reify!
+    // We can safely set the flag to avoid the expensive check again in the future.
+    if (!TypeInfo::hasStaticPropertyTable(inlineTypeFlags())) {
+        structure(vm)->setStaticPropertiesReified(true);
+        return;
+    }
+
+    if (!structure(vm)->isDictionary())
+        setStructure(vm, Structure::toCacheableDictionaryTransition(vm, structure(vm)));
+
+    for (const ClassInfo* info = classInfo(); info; info = info->parentClass) {
+        const HashTable* hashTable = info->staticPropHashTable;
+        if (!hashTable)
+            continue;
+
+        for (auto& value : *hashTable) {
+            unsigned attributes;
+            auto key = Identifier::fromString(&vm, value.m_key);
+            PropertyOffset offset = getDirectOffset(vm, key, attributes);
+            if (!isValidOffset(offset))
+                reifyStaticProperty(vm, key, value, *this);
+        }
+    }
+
+    structure(vm)->setStaticPropertiesReified(true);
+}
+
+NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue getterSetter, unsigned attributes, PropertyOffset offset)
+{
+    if (structure()->isUncacheableDictionary()) {
+        slot.setGetterSlot(this, attributes, jsCast<GetterSetter*>(getterSetter));
+        return;
+    }
+
+    // This access is cacheable because Structure requires an attributeChangedTransition
+    // if this property stops being an accessor.
+    slot.setCacheableGetterSlot(this, attributes, jsCast<GetterSetter*>(getterSetter), offset);
+}
+
+bool JSObject::putIndexedDescriptor(ExecState* exec, SparseArrayEntry* entryInMap, const PropertyDescriptor& descriptor, PropertyDescriptor& oldDescriptor)
+{
+    VM& vm = exec->vm();
+    auto map = m_butterfly.get()->arrayStorage()->m_sparseMap.get();
+
+    if (descriptor.isDataDescriptor()) {
+        if (descriptor.value())
+            entryInMap->set(vm, map, descriptor.value());
+        else if (oldDescriptor.isAccessorDescriptor())
+            entryInMap->set(vm, map, jsUndefined());
+        entryInMap->attributes = descriptor.attributesOverridingCurrent(oldDescriptor) & ~Accessor;
+        return true;
+    }
+
+    if (descriptor.isAccessorDescriptor()) {
+        JSObject* getter = 0;
+        if (descriptor.getterPresent())
+            getter = descriptor.getterObject();
+        else if (oldDescriptor.isAccessorDescriptor())
+            getter = oldDescriptor.getterObject();
+        JSObject* setter = 0;
+        if (descriptor.setterPresent())
+            setter = descriptor.setterObject();
+        else if (oldDescriptor.isAccessorDescriptor())
+            setter = oldDescriptor.setterObject();
+
+        GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
+        if (getter)
+            accessor->setGetter(vm, exec->lexicalGlobalObject(), getter);
+        if (setter)
+            accessor->setSetter(vm, exec->lexicalGlobalObject(), setter);
+
+        entryInMap->set(vm, map, accessor);
+        entryInMap->attributes = descriptor.attributesOverridingCurrent(oldDescriptor) & ~ReadOnly;
+        return true;
+    }
+
+    ASSERT(descriptor.isGenericDescriptor());
+    entryInMap->attributes = descriptor.attributesOverridingCurrent(oldDescriptor);
+    return true;
+}
+
+// Defined in ES5.1 8.12.9
+bool JSObject::defineOwnIndexedProperty(ExecState* exec, unsigned index, const PropertyDescriptor& descriptor, bool throwException)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT(index <= MAX_ARRAY_INDEX);
+
+    if (!inSparseIndexingMode()) {
+        // Fast case: we're putting a regular property to a regular array
+        // FIXME: this will pessimistically assume that if attributes are missing then they'll default to false
+        // however if the property currently exists missing attributes will override from their current 'true'
+        // state (i.e. defineOwnProperty could be used to set a value without needing to entering 'SparseMode').
+        if (!descriptor.attributes() && descriptor.value()) {
+            ASSERT(!descriptor.isAccessorDescriptor());
+            return putDirectIndex(exec, index, descriptor.value(), 0, throwException ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
+        }
+        
+        ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm);
+    }
+
+    if (descriptor.attributes() & (ReadOnly | Accessor))
+        notifyPresenceOfIndexedAccessors(vm);
+
+    SparseArrayValueMap* map = m_butterfly.get()->arrayStorage()->m_sparseMap.get();
+    RELEASE_ASSERT(map);
+    
+    // 1. Let current be the result of calling the [[GetOwnProperty]] internal method of O with property name P.
+    SparseArrayValueMap::AddResult result = map->add(this, index);
+    SparseArrayEntry* entryInMap = &result.iterator->value;
+
+    // 2. Let extensible be the value of the [[Extensible]] internal property of O.
+    // 3. If current is undefined and extensible is false, then Reject.
+    // 4. If current is undefined and extensible is true, then
+    if (result.isNewEntry) {
+        if (!isStructureExtensible()) {
+            map->remove(result.iterator);
+            return typeError(exec, scope, throwException, ASCIILiteral(NonExtensibleObjectPropertyDefineError));
+        }
+
+        // 4.a. If IsGenericDescriptor(Desc) or IsDataDescriptor(Desc) is true, then create an own data property
+        // named P of object O whose [[Value]], [[Writable]], [[Enumerable]] and [[Configurable]] attribute values
+        // are described by Desc. If the value of an attribute field of Desc is absent, the attribute of the newly
+        // created property is set to its default value.
+        // 4.b. Else, Desc must be an accessor Property Descriptor so, create an own accessor property named P of
+        // object O whose [[Get]], [[Set]], [[Enumerable]] and [[Configurable]] attribute values are described by
+        // Desc. If the value of an attribute field of Desc is absent, the attribute of the newly created property
+        // is set to its default value.
+        // 4.c. Return true.
+
+        PropertyDescriptor defaults;
+        entryInMap->setWithoutWriteBarrier(jsUndefined());
+        entryInMap->attributes = DontDelete | DontEnum | ReadOnly;
+        entryInMap->get(defaults);
+
+        putIndexedDescriptor(exec, entryInMap, descriptor, defaults);
+        Butterfly* butterfly = m_butterfly.get();
+        if (index >= butterfly->arrayStorage()->length())
+            butterfly->arrayStorage()->setLength(index + 1);
+        return true;
+    }
+
+    // 5. Return true, if every field in Desc is absent.
+    // 6. Return true, if every field in Desc also occurs in current and the value of every field in Desc is the same value as the corresponding field in current when compared using the SameValue algorithm (9.12).
+    PropertyDescriptor current;
+    entryInMap->get(current);
+    if (descriptor.isEmpty() || descriptor.equalTo(exec, current))
+        return true;
+
+    // 7. If the [[Configurable]] field of current is false then
+    if (!current.configurable()) {
+        // 7.a. Reject, if the [[Configurable]] field of Desc is true.
+        if (descriptor.configurablePresent() && descriptor.configurable())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeConfigurabilityError));
+        // 7.b. Reject, if the [[Enumerable]] field of Desc is present and the [[Enumerable]] fields of current and Desc are the Boolean negation of each other.
+        if (descriptor.enumerablePresent() && current.enumerable() != descriptor.enumerable())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeEnumerabilityError));
+    }
+
+    // 8. If IsGenericDescriptor(Desc) is true, then no further validation is required.
+    if (!descriptor.isGenericDescriptor()) {
+        // 9. Else, if IsDataDescriptor(current) and IsDataDescriptor(Desc) have different results, then
+        if (current.isDataDescriptor() != descriptor.isDataDescriptor()) {
+            // 9.a. Reject, if the [[Configurable]] field of current is false.
+            if (!current.configurable())
+                return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+            // 9.b. If IsDataDescriptor(current) is true, then convert the property named P of object O from a
+            // data property to an accessor property. Preserve the existing values of the converted property's
+            // [[Configurable]] and [[Enumerable]] attributes and set the rest of the property's attributes to
+            // their default values.
+            // 9.c. Else, convert the property named P of object O from an accessor property to a data property.
+            // Preserve the existing values of the converted property's [[Configurable]] and [[Enumerable]]
+            // attributes and set the rest of the property's attributes to their default values.
+        } else if (current.isDataDescriptor() && descriptor.isDataDescriptor()) {
+            // 10. Else, if IsDataDescriptor(current) and IsDataDescriptor(Desc) are both true, then
+            // 10.a. If the [[Configurable]] field of current is false, then
+            if (!current.configurable() && !current.writable()) {
+                // 10.a.i. Reject, if the [[Writable]] field of current is false and the [[Writable]] field of Desc is true.
+                if (descriptor.writable())
+                    return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeWritabilityError));
+                // 10.a.ii. If the [[Writable]] field of current is false, then
+                // 10.a.ii.1. Reject, if the [[Value]] field of Desc is present and SameValue(Desc.[[Value]], current.[[Value]]) is false.
+                if (descriptor.value() && !sameValue(exec, descriptor.value(), current.value()))
+                    return typeError(exec, scope, throwException, ASCIILiteral(ReadonlyPropertyChangeError));
+            }
+            // 10.b. else, the [[Configurable]] field of current is true, so any change is acceptable.
+        } else {
+            ASSERT(current.isAccessorDescriptor() && current.getterPresent() && current.setterPresent());
+            // 11. Else, IsAccessorDescriptor(current) and IsAccessorDescriptor(Desc) are both true so, if the [[Configurable]] field of current is false, then
+            if (!current.configurable()) {
+                // 11.i. Reject, if the [[Set]] field of Desc is present and SameValue(Desc.[[Set]], current.[[Set]]) is false.
+                if (descriptor.setterPresent() && descriptor.setter() != current.setter())
+                    return typeError(exec, scope, throwException, ASCIILiteral("Attempting to change the setter of an unconfigurable property."));
+                // 11.ii. Reject, if the [[Get]] field of Desc is present and SameValue(Desc.[[Get]], current.[[Get]]) is false.
+                if (descriptor.getterPresent() && descriptor.getter() != current.getter())
+                    return typeError(exec, scope, throwException, ASCIILiteral("Attempting to change the getter of an unconfigurable property."));
+            }
+        }
+    }
+
+    // 12. For each attribute field of Desc that is present, set the correspondingly named attribute of the property named P of object O to the value of the field.
+    putIndexedDescriptor(exec, entryInMap, descriptor, current);
+    // 13. Return true.
+    return true;
+}
+
+SparseArrayValueMap* JSObject::allocateSparseIndexMap(VM& vm)
+{
+    SparseArrayValueMap* result = SparseArrayValueMap::create(vm);
+    arrayStorage()->m_sparseMap.set(vm, this, result);
+    return result;
+}
+
+void JSObject::deallocateSparseIndexMap()
+{
+    if (ArrayStorage* arrayStorage = arrayStorageOrNull())
+        arrayStorage->m_sparseMap.clear();
+}
+
+bool JSObject::attemptToInterceptPutByIndexOnHoleForPrototype(ExecState* exec, JSValue thisValue, unsigned i, JSValue value, bool shouldThrow, bool& putResult)
+{
+    for (JSObject* current = this; ;) {
+        // This has the same behavior with respect to prototypes as JSObject::put(). It only
+        // allows a prototype to intercept a put if (a) the prototype declares the property
+        // we're after rather than intercepting it via an override of JSObject::put(), and
+        // (b) that property is declared as ReadOnly or Accessor.
+        
+        ArrayStorage* storage = current->arrayStorageOrNull();
+        if (storage && storage->m_sparseMap) {
+            SparseArrayValueMap::iterator iter = storage->m_sparseMap->find(i);
+            if (iter != storage->m_sparseMap->notFound() && (iter->value.attributes & (Accessor | ReadOnly))) {
+                putResult = iter->value.put(exec, thisValue, storage->m_sparseMap.get(), value, shouldThrow);
+                return true;
+            }
+        }
+
+        if (current->type() == ProxyObjectType) {
+            ProxyObject* proxy = jsCast<ProxyObject*>(current);
+            putResult = proxy->putByIndexCommon(exec, thisValue, i, value, shouldThrow);
+            return true;
+        }
+        
+        JSValue prototypeValue = current->getPrototypeDirect();
+        if (prototypeValue.isNull())
+            return false;
+        
+        current = asObject(prototypeValue);
+    }
+}
+
+bool JSObject::attemptToInterceptPutByIndexOnHole(ExecState* exec, unsigned i, JSValue value, bool shouldThrow, bool& putResult)
+{
+    JSValue prototypeValue = getPrototypeDirect();
+    if (prototypeValue.isNull())
+        return false;
+    
+    return asObject(prototypeValue)->attemptToInterceptPutByIndexOnHoleForPrototype(exec, this, i, value, shouldThrow, putResult);
+}
+
+template<IndexingType indexingShape>
+bool JSObject::putByIndexBeyondVectorLengthWithoutAttributes(ExecState* exec, unsigned i, JSValue value)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT((indexingType() & IndexingShapeMask) == indexingShape);
+    ASSERT(!indexingShouldBeSparse());
+
+    Butterfly* butterfly = m_butterfly.get();
+    
+    // For us to get here, the index is either greater than the public length, or greater than
+    // or equal to the vector length.
+    ASSERT(i >= butterfly->vectorLength());
+    
+    if (i > MAX_STORAGE_VECTOR_INDEX
+        || (i >= MIN_SPARSE_ARRAY_INDEX && !isDenseEnoughForVector(i, countElements<indexingShape>(butterfly)))
+        || indexIsSufficientlyBeyondLengthForSparseMap(i, butterfly->vectorLength())) {
+        ASSERT(i <= MAX_ARRAY_INDEX);
+        ensureArrayStorageSlow(vm);
+        SparseArrayValueMap* map = allocateSparseIndexMap(vm);
+        bool result = map->putEntry(exec, this, i, value, false);
+        ASSERT(i >= arrayStorage()->length());
+        arrayStorage()->setLength(i + 1);
+        return result;
+    }
+
+    if (!ensureLength(vm, i + 1)) {
+        throwOutOfMemoryError(exec, scope);
+        return false;
+    }
+    butterfly = m_butterfly.get();
+
+    RELEASE_ASSERT(i < butterfly->vectorLength());
+    switch (indexingShape) {
+    case Int32Shape:
+        ASSERT(value.isInt32());
+        butterfly->contiguousInt32()[i].setWithoutWriteBarrier(value);
+        return true;
+        
+    case DoubleShape: {
+        ASSERT(value.isNumber());
+        double valueAsDouble = value.asNumber();
+        ASSERT(valueAsDouble == valueAsDouble);
+        butterfly->contiguousDouble()[i] = valueAsDouble;
+        return true;
+    }
+        
+    case ContiguousShape:
+        butterfly->contiguous()[i].set(vm, this, value);
+        return true;
+        
+    default:
+        CRASH();
+        return false;
+    }
+}
+
+// Explicit instantiations needed by JSArray.cpp.
+template bool JSObject::putByIndexBeyondVectorLengthWithoutAttributes<Int32Shape>(ExecState*, unsigned, JSValue);
+template bool JSObject::putByIndexBeyondVectorLengthWithoutAttributes<DoubleShape>(ExecState*, unsigned, JSValue);
+template bool JSObject::putByIndexBeyondVectorLengthWithoutAttributes<ContiguousShape>(ExecState*, unsigned, JSValue);
+
+bool JSObject::putByIndexBeyondVectorLengthWithArrayStorage(ExecState* exec, unsigned i, JSValue value, bool shouldThrow, ArrayStorage* storage)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // i should be a valid array index that is outside of the current vector.
+    ASSERT(i <= MAX_ARRAY_INDEX);
+    ASSERT(i >= storage->vectorLength());
+    
+    SparseArrayValueMap* map = storage->m_sparseMap.get();
+    
+    // First, handle cases where we don't currently have a sparse map.
+    if (LIKELY(!map)) {
+        // If the array is not extensible, we should have entered dictionary mode, and created the sparse map.
+        ASSERT(isStructureExtensible());
+    
+        // Update m_length if necessary.
+        if (i >= storage->length())
+            storage->setLength(i + 1);
+
+        // Check that it is sensible to still be using a vector, and then try to grow the vector.
+        if (LIKELY(!indexIsSufficientlyBeyondLengthForSparseMap(i, storage->vectorLength()) 
+            && isDenseEnoughForVector(i, storage->m_numValuesInVector)
+            && increaseVectorLength(vm, i + 1))) {
+            // success! - reread m_storage since it has likely been reallocated, and store to the vector.
+            storage = arrayStorage();
+            storage->m_vector[i].set(vm, this, value);
+            ++storage->m_numValuesInVector;
+            return true;
+        }
+        // We don't want to, or can't use a vector to hold this property - allocate a sparse map & add the value.
+        map = allocateSparseIndexMap(vm);
+        return map->putEntry(exec, this, i, value, shouldThrow);
+    }
+
+    // Update m_length if necessary.
+    unsigned length = storage->length();
+    if (i >= length) {
+        // Prohibit growing the array if length is not writable.
+        if (map->lengthIsReadOnly() || !isStructureExtensible())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+        length = i + 1;
+        storage->setLength(length);
+    }
+
+    // We are currently using a map - check whether we still want to be doing so.
+    // We will continue  to use a sparse map if SparseMode is set, a vector would be too sparse, or if allocation fails.
+    unsigned numValuesInArray = storage->m_numValuesInVector + map->size();
+    if (map->sparseMode() || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(vm, length))
+        return map->putEntry(exec, this, i, value, shouldThrow);
+
+    // Reread m_storage after increaseVectorLength, update m_numValuesInVector.
+    storage = arrayStorage();
+    storage->m_numValuesInVector = numValuesInArray;
+
+    // Copy all values from the map into the vector, and delete the map.
+    WriteBarrier<Unknown>* vector = storage->m_vector;
+    SparseArrayValueMap::const_iterator end = map->end();
+    for (SparseArrayValueMap::const_iterator it = map->begin(); it != end; ++it)
+        vector[it->key].set(vm, this, it->value.getNonSparseMode());
+    deallocateSparseIndexMap();
+
+    // Store the new property into the vector.
+    WriteBarrier<Unknown>& valueSlot = vector[i];
+    if (!valueSlot)
+        ++storage->m_numValuesInVector;
+    valueSlot.set(vm, this, value);
+    return true;
+}
+
+bool JSObject::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+
+    // i should be a valid array index that is outside of the current vector.
+    ASSERT(i <= MAX_ARRAY_INDEX);
+    
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES: {
+        if (indexingShouldBeSparse()) {
+            return putByIndexBeyondVectorLengthWithArrayStorage(
+                exec, i, value, shouldThrow,
+                ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
+        }
+        if (indexIsSufficientlyBeyondLengthForSparseMap(i, 0) || i >= MIN_SPARSE_ARRAY_INDEX) {
+            return putByIndexBeyondVectorLengthWithArrayStorage(
+                exec, i, value, shouldThrow, createArrayStorage(vm, 0, 0));
+        }
+        if (structure(vm)->needsSlowPutIndexing()) {
+            // Convert the indexing type to the SlowPutArrayStorage and retry.
+            createArrayStorage(vm, i + 1, getNewVectorLength(0, 0, 0, i + 1));
+            return putByIndex(this, exec, i, value, shouldThrow);
+        }
+        
+        createInitialForValueAndSet(vm, i, value);
+        return true;
+    }
+        
+    case ALL_UNDECIDED_INDEXING_TYPES: {
+        CRASH();
+        break;
+    }
+        
+    case ALL_INT32_INDEXING_TYPES:
+        return putByIndexBeyondVectorLengthWithoutAttributes<Int32Shape>(exec, i, value);
+        
+    case ALL_DOUBLE_INDEXING_TYPES:
+        return putByIndexBeyondVectorLengthWithoutAttributes<DoubleShape>(exec, i, value);
+        
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        return putByIndexBeyondVectorLengthWithoutAttributes<ContiguousShape>(exec, i, value);
+        
+    case NonArrayWithSlowPutArrayStorage:
+    case ArrayWithSlowPutArrayStorage: {
+        // No own property present in the vector, but there might be in the sparse map!
+        SparseArrayValueMap* map = arrayStorage()->m_sparseMap.get();
+        bool putResult = false;
+        if (!(map && map->contains(i)) && attemptToInterceptPutByIndexOnHole(exec, i, value, shouldThrow, putResult))
+            return putResult;
+        FALLTHROUGH;
+    }
+
+    case NonArrayWithArrayStorage:
+    case ArrayWithArrayStorage:
+        return putByIndexBeyondVectorLengthWithArrayStorage(exec, i, value, shouldThrow, arrayStorage());
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    return false;
+}
+
+bool JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage(ExecState* exec, unsigned i, JSValue value, unsigned attributes, PutDirectIndexMode mode, ArrayStorage* storage)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    // i should be a valid array index that is outside of the current vector.
+    ASSERT(hasAnyArrayStorage(indexingType()));
+    ASSERT(arrayStorage() == storage);
+    ASSERT(i >= storage->vectorLength() || attributes);
+    ASSERT(i <= MAX_ARRAY_INDEX);
+
+    SparseArrayValueMap* map = storage->m_sparseMap.get();
+
+    // First, handle cases where we don't currently have a sparse map.
+    if (LIKELY(!map)) {
+        // If the array is not extensible, we should have entered dictionary mode, and created the spare map.
+        ASSERT(isStructureExtensible());
+    
+        // Update m_length if necessary.
+        if (i >= storage->length())
+            storage->setLength(i + 1);
+
+        // Check that it is sensible to still be using a vector, and then try to grow the vector.
+        if (LIKELY(
+                !attributes
+                && (isDenseEnoughForVector(i, storage->m_numValuesInVector))
+                && !indexIsSufficientlyBeyondLengthForSparseMap(i, storage->vectorLength()))
+                && increaseVectorLength(vm, i + 1)) {
+            // success! - reread m_storage since it has likely been reallocated, and store to the vector.
+            storage = arrayStorage();
+            storage->m_vector[i].set(vm, this, value);
+            ++storage->m_numValuesInVector;
+            return true;
+        }
+        // We don't want to, or can't use a vector to hold this property - allocate a sparse map & add the value.
+        map = allocateSparseIndexMap(vm);
+        return map->putDirect(exec, this, i, value, attributes, mode);
+    }
+
+    // Update m_length if necessary.
+    unsigned length = storage->length();
+    if (i >= length) {
+        if (mode != PutDirectIndexLikePutDirect) {
+            // Prohibit growing the array if length is not writable.
+            if (map->lengthIsReadOnly())
+                return typeError(exec, scope, mode == PutDirectIndexShouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+            if (!isStructureExtensible())
+                return typeError(exec, scope, mode == PutDirectIndexShouldThrow, ASCIILiteral(NonExtensibleObjectPropertyDefineError));
+        }
+        length = i + 1;
+        storage->setLength(length);
+    }
+
+    // We are currently using a map - check whether we still want to be doing so.
+    // We will continue  to use a sparse map if SparseMode is set, a vector would be too sparse, or if allocation fails.
+    unsigned numValuesInArray = storage->m_numValuesInVector + map->size();
+    if (map->sparseMode() || attributes || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(vm, length))
+        return map->putDirect(exec, this, i, value, attributes, mode);
+
+    // Reread m_storage after increaseVectorLength, update m_numValuesInVector.
+    storage = arrayStorage();
+    storage->m_numValuesInVector = numValuesInArray;
+
+    // Copy all values from the map into the vector, and delete the map.
+    WriteBarrier<Unknown>* vector = storage->m_vector;
+    SparseArrayValueMap::const_iterator end = map->end();
+    for (SparseArrayValueMap::const_iterator it = map->begin(); it != end; ++it)
+        vector[it->key].set(vm, this, it->value.getNonSparseMode());
+    deallocateSparseIndexMap();
+
+    // Store the new property into the vector.
+    WriteBarrier<Unknown>& valueSlot = vector[i];
+    if (!valueSlot)
+        ++storage->m_numValuesInVector;
+    valueSlot.set(vm, this, value);
+    return true;
+}
+
+bool JSObject::putDirectIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, unsigned attributes, PutDirectIndexMode mode)
+{
+    VM& vm = exec->vm();
+
+    // i should be a valid array index that is outside of the current vector.
+    ASSERT(i <= MAX_ARRAY_INDEX);
+    
+    if (attributes & (ReadOnly | Accessor))
+        notifyPresenceOfIndexedAccessors(vm);
+    
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES: {
+        if (indexingShouldBeSparse() || attributes) {
+            return putDirectIndexBeyondVectorLengthWithArrayStorage(
+                exec, i, value, attributes, mode,
+                ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
+        }
+        if (i >= MIN_SPARSE_ARRAY_INDEX) {
+            return putDirectIndexBeyondVectorLengthWithArrayStorage(
+                exec, i, value, attributes, mode, createArrayStorage(vm, 0, 0));
+        }
+        if (structure(vm)->needsSlowPutIndexing()) {
+            ArrayStorage* storage = createArrayStorage(vm, i + 1, getNewVectorLength(0, 0, 0, i + 1));
+            storage->m_vector[i].set(vm, this, value);
+            storage->m_numValuesInVector++;
+            return true;
+        }
+        
+        createInitialForValueAndSet(vm, i, value);
+        return true;
+    }
+        
+    case ALL_UNDECIDED_INDEXING_TYPES: {
+        convertUndecidedForValue(exec->vm(), value);
+        // Reloop.
+        return putDirectIndex(exec, i, value, attributes, mode);
+    }
+        
+    case ALL_INT32_INDEXING_TYPES: {
+        if (attributes) {
+            if (i < m_butterfly.get()->vectorLength())
+                return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
+            return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertInt32ToArrayStorage(vm));
+        }
+        if (!value.isInt32()) {
+            convertInt32ForValue(vm, value);
+            return putDirectIndexBeyondVectorLength(exec, i, value, attributes, mode);
+        }
+        putByIndexBeyondVectorLengthWithoutAttributes<Int32Shape>(exec, i, value);
+        return true;
+    }
+        
+    case ALL_DOUBLE_INDEXING_TYPES: {
+        if (attributes) {
+            if (i < m_butterfly.get()->vectorLength())
+                return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
+            return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertDoubleToArrayStorage(vm));
+        }
+        if (!value.isNumber()) {
+            convertDoubleToContiguous(vm);
+            return putDirectIndexBeyondVectorLength(exec, i, value, attributes, mode);
+        }
+        double valueAsDouble = value.asNumber();
+        if (valueAsDouble != valueAsDouble) {
+            convertDoubleToContiguous(vm);
+            return putDirectIndexBeyondVectorLength(exec, i, value, attributes, mode);
+        }
+        putByIndexBeyondVectorLengthWithoutAttributes<DoubleShape>(exec, i, value);
+        return true;
+    }
+        
+    case ALL_CONTIGUOUS_INDEXING_TYPES: {
+        if (attributes) {
+            if (i < m_butterfly.get()->vectorLength())
+                return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
+            return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertContiguousToArrayStorage(vm));
+        }
+        putByIndexBeyondVectorLengthWithoutAttributes<ContiguousShape>(exec, i, value);
+        return true;
+    }
+
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+        if (attributes) {
+            if (i < m_butterfly.get()->vectorLength())
+                return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
+        }
+        return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, arrayStorage());
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
+bool JSObject::putDirectNativeIntrinsicGetter(VM& vm, JSGlobalObject* globalObject, Identifier name, NativeFunction nativeFunction, Intrinsic intrinsic, unsigned attributes)
+{
+    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
+    JSFunction* function = JSFunction::create(vm, globalObject, 0, makeString("get ", name.string()), nativeFunction, intrinsic);
+    accessor->setGetter(vm, globalObject, function);
+    return putDirectNonIndexAccessor(vm, name, accessor, attributes);
+}
+
+bool JSObject::putDirectNativeFunction(VM& vm, JSGlobalObject* globalObject, const PropertyName& propertyName, unsigned functionLength, NativeFunction nativeFunction, Intrinsic intrinsic, unsigned attributes)
+{
+    StringImpl* name = propertyName.publicName();
+    if (!name)
+        name = vm.propertyNames->anonymous.impl();
+    ASSERT(name);
+
+    JSFunction* function = JSFunction::create(vm, globalObject, functionLength, name, nativeFunction, intrinsic);
+    return putDirect(vm, propertyName, function, attributes);
+}
+
+bool JSObject::putDirectNativeFunction(VM& vm, JSGlobalObject* globalObject, const PropertyName& propertyName, unsigned functionLength, NativeFunction nativeFunction, Intrinsic intrinsic, const DOMJIT::Signature* signature, unsigned attributes)
+{
+    StringImpl* name = propertyName.publicName();
+    if (!name)
+        name = vm.propertyNames->anonymous.impl();
+    ASSERT(name);
+
+    JSFunction* function = JSFunction::create(vm, globalObject, functionLength, name, nativeFunction, intrinsic, callHostFunctionAsConstructor, signature);
+    return putDirect(vm, propertyName, function, attributes);
+}
+
+JSFunction* JSObject::putDirectBuiltinFunction(VM& vm, JSGlobalObject* globalObject, const PropertyName& propertyName, FunctionExecutable* functionExecutable, unsigned attributes)
+{
+    StringImpl* name = propertyName.publicName();
+    if (!name)
+        name = vm.propertyNames->anonymous.impl();
+    ASSERT(name);
+    JSFunction* function = JSFunction::createBuiltinFunction(vm, static_cast<FunctionExecutable*>(functionExecutable), globalObject);
+    putDirect(vm, propertyName, function, attributes);
+    return function;
+}
+
+JSFunction* JSObject::putDirectBuiltinFunctionWithoutTransition(VM& vm, JSGlobalObject* globalObject, const PropertyName& propertyName, FunctionExecutable* functionExecutable, unsigned attributes)
+{
+    JSFunction* function = JSFunction::createBuiltinFunction(vm, static_cast<FunctionExecutable*>(functionExecutable), globalObject);
+    putDirectWithoutTransition(vm, propertyName, function, attributes);
+    return function;
+}
+
+void JSObject::putDirectNativeFunctionWithoutTransition(VM& vm, JSGlobalObject* globalObject, const PropertyName& propertyName, unsigned functionLength, NativeFunction nativeFunction, Intrinsic intrinsic, unsigned attributes)
+{
+    StringImpl* name = propertyName.publicName();
+    if (!name)
+        name = vm.propertyNames->anonymous.impl();
+    ASSERT(name);
+    JSFunction* function = JSFunction::create(vm, globalObject, functionLength, name, nativeFunction, intrinsic);
+    putDirectWithoutTransition(vm, propertyName, function, attributes);
+}
+
+// NOTE: This method is for ArrayStorage vectors.
+ALWAYS_INLINE unsigned JSObject::getNewVectorLength(unsigned indexBias, unsigned currentVectorLength, unsigned currentLength, unsigned desiredLength)
+{
+    ASSERT(desiredLength <= MAX_STORAGE_VECTOR_LENGTH);
+
+    unsigned increasedLength;
+    unsigned maxInitLength = std::min(currentLength, 100000U);
+
+    if (desiredLength < maxInitLength)
+        increasedLength = maxInitLength;
+    else if (!currentVectorLength)
+        increasedLength = std::max(desiredLength, lastArraySize);
+    else {
+        increasedLength = timesThreePlusOneDividedByTwo(desiredLength);
+    }
+
+    ASSERT(increasedLength >= desiredLength);
+
+    lastArraySize = std::min(increasedLength, FIRST_ARRAY_STORAGE_VECTOR_GROW);
+
+    return ArrayStorage::optimalVectorLength(
+        indexBias, structure()->outOfLineCapacity(),
+        std::min(increasedLength, MAX_STORAGE_VECTOR_LENGTH));
+}
+
+ALWAYS_INLINE unsigned JSObject::getNewVectorLength(unsigned desiredLength)
+{
+    unsigned indexBias = 0;
+    unsigned vectorLength = 0;
+    unsigned length = 0;
+    
+    if (hasIndexedProperties(indexingType())) {
+        if (ArrayStorage* storage = arrayStorageOrNull())
+            indexBias = storage->m_indexBias;
+        vectorLength = m_butterfly.get()->vectorLength();
+        length = m_butterfly.get()->publicLength();
+    }
+
+    return getNewVectorLength(indexBias, vectorLength, length, desiredLength);
+}
+
+template<IndexingType indexingShape>
+unsigned JSObject::countElements(Butterfly* butterfly)
+{
+    unsigned numValues = 0;
+    for (unsigned i = butterfly->publicLength(); i--;) {
+        switch (indexingShape) {
+        case Int32Shape:
+        case ContiguousShape:
+            if (butterfly->contiguous()[i])
+                numValues++;
+            break;
+            
+        case DoubleShape: {
+            double value = butterfly->contiguousDouble()[i];
+            if (value == value)
+                numValues++;
+            break;
+        }
+            
+        default:
+            CRASH();
+        }
+    }
+    return numValues;
+}
+
+unsigned JSObject::countElements()
+{
+    switch (indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        return 0;
+        
+    case ALL_INT32_INDEXING_TYPES:
+        return countElements<Int32Shape>(butterfly());
+        
+    case ALL_DOUBLE_INDEXING_TYPES:
+        return countElements<DoubleShape>(butterfly());
+        
+    case ALL_CONTIGUOUS_INDEXING_TYPES:
+        return countElements<ContiguousShape>(butterfly());
+        
+    default:
+        CRASH();
+        return 0;
+    }
+}
+
+bool JSObject::increaseVectorLength(VM& vm, unsigned newLength)
+{
+    ArrayStorage* storage = arrayStorage();
+    
+    unsigned vectorLength = storage->vectorLength();
+    unsigned availableVectorLength = storage->availableVectorLength(structure(vm), vectorLength); 
+    if (availableVectorLength >= newLength) {
+        // The cell was already big enough for the desired length!
+        for (unsigned i = vectorLength; i < availableVectorLength; ++i)
+            storage->m_vector[i].clear();
+        storage->setVectorLength(availableVectorLength);
+        return true;
+    }
+    
+    // This function leaves the array in an internally inconsistent state, because it does not move any values from sparse value map
+    // to the vector. Callers have to account for that, because they can do it more efficiently.
+    if (newLength > MAX_STORAGE_VECTOR_LENGTH)
+        return false;
+
+    if (newLength >= MIN_SPARSE_ARRAY_INDEX
+        && !isDenseEnoughForVector(newLength, storage->m_numValuesInVector))
+        return false;
+
+    unsigned indexBias = storage->m_indexBias;
+    ASSERT(newLength > vectorLength);
+    unsigned newVectorLength = getNewVectorLength(newLength);
+
+    // Fast case - there is no precapacity. In these cases a realloc makes sense.
+    Structure* structure = this->structure(vm);
+    if (LIKELY(!indexBias)) {
+        DeferGC deferGC(vm.heap);
+        Butterfly* newButterfly = storage->butterfly()->growArrayRight(
+            vm, this, structure, structure->outOfLineCapacity(), true,
+            ArrayStorage::sizeFor(vectorLength), ArrayStorage::sizeFor(newVectorLength));
+        if (!newButterfly)
+            return false;
+        for (unsigned i = vectorLength; i < newVectorLength; ++i)
+            newButterfly->arrayStorage()->m_vector[i].clear();
+        newButterfly->arrayStorage()->setVectorLength(newVectorLength);
+        setButterfly(vm, newButterfly);
+        return true;
+    }
+    
+    // Remove some, but not all of the precapacity. Atomic decay, & capped to not overflow array length.
+    DeferGC deferGC(vm.heap);
+    unsigned newIndexBias = std::min(indexBias >> 1, MAX_STORAGE_VECTOR_LENGTH - newVectorLength);
+    Butterfly* newButterfly = storage->butterfly()->resizeArray(
+        vm, this,
+        structure->outOfLineCapacity(), true, ArrayStorage::sizeFor(vectorLength),
+        newIndexBias, true, ArrayStorage::sizeFor(newVectorLength));
+    if (!newButterfly)
+        return false;
+    for (unsigned i = vectorLength; i < newVectorLength; ++i)
+        newButterfly->arrayStorage()->m_vector[i].clear();
+    newButterfly->arrayStorage()->setVectorLength(newVectorLength);
+    newButterfly->arrayStorage()->m_indexBias = newIndexBias;
+    setButterfly(vm, newButterfly);
+    return true;
+}
+
+bool JSObject::ensureLengthSlow(VM& vm, unsigned length)
+{
+    Butterfly* butterfly = m_butterfly.get();
+    
+    ASSERT(length < MAX_ARRAY_INDEX);
+    ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
+    ASSERT(length > butterfly->vectorLength());
+    
+    unsigned oldVectorLength = butterfly->vectorLength();
+    unsigned newVectorLength;
+    
+    Structure* structure = this->structure(vm);
+    unsigned propertyCapacity = structure->outOfLineCapacity();
+    
+    unsigned availableOldLength =
+        Butterfly::availableContiguousVectorLength(propertyCapacity, oldVectorLength);
+    Butterfly* newButterfly = nullptr;
+    if (availableOldLength >= length) {
+        // This is the case where someone else selected a vector length that caused internal
+        // fragmentation. If we did our jobs right, this would never happen. But I bet we will mess
+        // this up, so this defense should stay.
+        newVectorLength = availableOldLength;
+    } else {
+        newVectorLength = Butterfly::optimalContiguousVectorLength(
+            propertyCapacity, std::min(length << 1, MAX_STORAGE_VECTOR_LENGTH));
+        butterfly = butterfly->growArrayRight(
+            vm, this, structure, propertyCapacity, true,
+            oldVectorLength * sizeof(EncodedJSValue),
+            newVectorLength * sizeof(EncodedJSValue));
+        if (!butterfly)
+            return false;
+        newButterfly = butterfly;
+    }
+
+    if (hasDouble(indexingType())) {
+        for (unsigned i = oldVectorLength; i < newVectorLength; ++i)
+            butterfly->indexingPayload<double>()[i] = PNaN;
+    } else {
+        for (unsigned i = oldVectorLength; i < newVectorLength; ++i)
+            butterfly->indexingPayload<WriteBarrier<Unknown>>()[i].clear();
+    }
+
+    if (newButterfly) {
+        butterfly->setVectorLength(newVectorLength);
+        WTF::storeStoreFence();
+        m_butterfly.set(vm, this, newButterfly);
+    } else {
+        WTF::storeStoreFence();
+        butterfly->setVectorLength(newVectorLength);
+    }
+
+    return true;
+}
+
+void JSObject::reallocateAndShrinkButterfly(VM& vm, unsigned length)
+{
+    ASSERT(length < MAX_ARRAY_INDEX);
+    ASSERT(length < MAX_STORAGE_VECTOR_LENGTH);
+    ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
+    ASSERT(m_butterfly.get()->vectorLength() > length);
+    ASSERT(!m_butterfly.get()->indexingHeader()->preCapacity(structure()));
+
+    DeferGC deferGC(vm.heap);
+    Butterfly* newButterfly = m_butterfly.get()->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length));
+    newButterfly->setVectorLength(length);
+    newButterfly->setPublicLength(length);
+    WTF::storeStoreFence();
+    m_butterfly.set(vm, this, newButterfly);
+}
+
+Butterfly* JSObject::allocateMoreOutOfLineStorage(VM& vm, size_t oldSize, size_t newSize)
+{
+    ASSERT(newSize > oldSize);
+
+    // It's important that this function not rely on structure(), for the property
+    // capacity, since we might have already mutated the structure in-place.
+
+    return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(), vm, this, structure(vm), oldSize, newSize);
+}
+
+static JSCustomGetterSetterFunction* getCustomGetterSetterFunctionForGetterSetter(ExecState* exec, PropertyName propertyName, CustomGetterSetter* getterSetter, JSCustomGetterSetterFunction::Type type)
+{
+    auto key = std::make_pair(getterSetter, (int)type);
+    JSCustomGetterSetterFunction* customGetterSetterFunction = exec->vm().customGetterSetterFunctionMap.get(key);
+    if (!customGetterSetterFunction) {
+        customGetterSetterFunction = JSCustomGetterSetterFunction::create(exec->vm(), exec->lexicalGlobalObject(), getterSetter, type, propertyName.publicName());
+        exec->vm().customGetterSetterFunctionMap.set(key, customGetterSetterFunction);
+    }
+    return customGetterSetterFunction;
+}
+
+bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
+{
+    JSC::PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
+    if (!methodTable(exec->vm())->getOwnPropertySlot(this, exec, propertyName, slot))
+        return false;
+
+    // DebuggerScope::getOwnPropertySlot() (and possibly others) may return attributes from the prototype chain
+    // but getOwnPropertyDescriptor() should only work for 'own' properties so we exit early if we detect that
+    // the property is not an own property.
+    if (slot.slotBase() != this && slot.slotBase()) {
+        JSProxy* jsProxy = jsDynamicCast<JSProxy*>(this);
+        if (!jsProxy || jsProxy->target() != slot.slotBase()) {
+            // Try ProxyObject.
+            ProxyObject* proxyObject = jsDynamicCast<ProxyObject*>(this);
+            if (!proxyObject || proxyObject->target() != slot.slotBase())
+                return false;
+        }
+    }
+
+    if (slot.isAccessor())
+        descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());
+    else if (slot.attributes() & CustomAccessor) {
+        descriptor.setCustomDescriptor(slot.attributes());
+
+        JSObject* thisObject = this;
+        if (auto* proxy = jsDynamicCast<JSProxy*>(this))
+            thisObject = proxy->target();
+
+        CustomGetterSetter* getterSetter;
+        if (slot.isCustomAccessor())
+            getterSetter = slot.customGetterSetter();
+        else {
+            JSValue maybeGetterSetter = thisObject->getDirect(exec->vm(), propertyName);
+            if (!maybeGetterSetter) {
+                thisObject->reifyAllStaticProperties(exec);
+                maybeGetterSetter = thisObject->getDirect(exec->vm(), propertyName);
+            }
+
+            ASSERT(maybeGetterSetter);
+            getterSetter = jsDynamicCast<CustomGetterSetter*>(maybeGetterSetter);
+        }
+        ASSERT(getterSetter);
+        if (!getterSetter)
+            return false;
+
+        if (getterSetter->getter())
+            descriptor.setGetter(getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, getterSetter, JSCustomGetterSetterFunction::Type::Getter));
+        if (getterSetter->setter())
+            descriptor.setSetter(getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, getterSetter, JSCustomGetterSetterFunction::Type::Setter));
+    } else
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), slot.attributes());
+    return true;
+}
+
+static bool putDescriptor(ExecState* exec, JSObject* target, PropertyName propertyName, const PropertyDescriptor& descriptor, unsigned attributes, const PropertyDescriptor& oldDescriptor)
+{
+    VM& vm = exec->vm();
+    if (descriptor.isGenericDescriptor() || descriptor.isDataDescriptor()) {
+        if (descriptor.isGenericDescriptor() && oldDescriptor.isAccessorDescriptor()) {
+            GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
+            if (oldDescriptor.getterPresent())
+                accessor->setGetter(vm, exec->lexicalGlobalObject(), oldDescriptor.getterObject());
+            if (oldDescriptor.setterPresent())
+                accessor->setSetter(vm, exec->lexicalGlobalObject(), oldDescriptor.setterObject());
+            target->putDirectAccessor(exec, propertyName, accessor, attributes | Accessor);
+            return true;
+        }
+        JSValue newValue = jsUndefined();
+        if (descriptor.value())
+            newValue = descriptor.value();
+        else if (oldDescriptor.value())
+            newValue = oldDescriptor.value();
+        target->putDirect(vm, propertyName, newValue, attributes & ~Accessor);
+        if (attributes & ReadOnly)
+            target->structure(vm)->setContainsReadOnlyProperties();
+        return true;
+    }
+    attributes &= ~ReadOnly;
+    GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
+
+    if (descriptor.getterPresent())
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), descriptor.getterObject());
+    else if (oldDescriptor.getterPresent())
+        accessor->setGetter(vm, exec->lexicalGlobalObject(), oldDescriptor.getterObject());
+    if (descriptor.setterPresent())
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), descriptor.setterObject());
+    else if (oldDescriptor.setterPresent())
+        accessor->setSetter(vm, exec->lexicalGlobalObject(), oldDescriptor.setterObject());
+
+    target->putDirectAccessor(exec, propertyName, accessor, attributes | Accessor);
+    return true;
+}
+
+bool JSObject::putDirectMayBeIndex(ExecState* exec, PropertyName propertyName, JSValue value)
+{
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return putDirectIndex(exec, index.value(), value);
+    return putDirect(exec->vm(), propertyName, value);
+}
+
+// 9.1.6.3 of the spec
+// http://www.ecma-international.org/ecma-262/6.0/index.html#sec-validateandapplypropertydescriptor
+bool validateAndApplyPropertyDescriptor(ExecState* exec, JSObject* object, PropertyName propertyName, bool isExtensible,
+    const PropertyDescriptor& descriptor, bool isCurrentDefined, const PropertyDescriptor& current, bool throwException)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // If we have a new property we can just put it on normally
+    // Step 2.
+    if (!isCurrentDefined) {
+        // unless extensions are prevented!
+        // Step 2.a
+        if (!isExtensible)
+            return typeError(exec, scope, throwException, ASCIILiteral(NonExtensibleObjectPropertyDefineError));
+        if (!object)
+            return true;
+        // Step 2.c/d
+        PropertyDescriptor oldDescriptor;
+        oldDescriptor.setValue(jsUndefined());
+        // FIXME: spec says to always return true here.
+        return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributes(), oldDescriptor);
+    }
+    // Step 3.
+    if (descriptor.isEmpty())
+        return true;
+    // Step 4.
+    if (current.equalTo(exec, descriptor))
+        return true;
+
+    // Step 5.
+    // Filter out invalid changes
+    if (!current.configurable()) {
+        if (descriptor.configurable())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeConfigurabilityError));
+        if (descriptor.enumerablePresent() && descriptor.enumerable() != current.enumerable())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeEnumerabilityError));
+    }
+    
+    // Step 6.
+    // A generic descriptor is simply changing the attributes of an existing property
+    if (descriptor.isGenericDescriptor()) {
+        if (!current.attributesEqual(descriptor) && object) {
+            object->methodTable(vm)->deleteProperty(object, exec, propertyName);
+            return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
+        }
+        return true;
+    }
+    
+    // Step 7.
+    // Changing between a normal property or an accessor property
+    if (descriptor.isDataDescriptor() != current.isDataDescriptor()) {
+        if (!current.configurable())
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+
+        if (!object)
+            return true;
+
+        object->methodTable(vm)->deleteProperty(object, exec, propertyName);
+        return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
+    }
+
+    // Step 8.
+    // Changing the value and attributes of an existing property
+    if (descriptor.isDataDescriptor()) {
+        if (!current.configurable()) {
+            if (!current.writable() && descriptor.writable())
+                return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeWritabilityError));
+            if (!current.writable()) {
+                if (descriptor.value() && !sameValue(exec, current.value(), descriptor.value()))
+                    return typeError(exec, scope, throwException, ASCIILiteral(ReadonlyPropertyChangeError));
+            }
+        }
+        if (current.attributesEqual(descriptor) && !descriptor.value())
+            return true;
+        if (!object)
+            return true;
+        object->methodTable(vm)->deleteProperty(object, exec, propertyName);
+        return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
+    }
+
+    // Step 9.
+    // Changing the accessor functions of an existing accessor property
+    ASSERT(descriptor.isAccessorDescriptor());
+    if (!current.configurable()) {
+        if (descriptor.setterPresent() && !(current.setterPresent() && JSValue::strictEqual(exec, current.setter(), descriptor.setter())))
+            return typeError(exec, scope, throwException, ASCIILiteral("Attempting to change the setter of an unconfigurable property."));
+        if (descriptor.getterPresent() && !(current.getterPresent() && JSValue::strictEqual(exec, current.getter(), descriptor.getter())))
+            return typeError(exec, scope, throwException, ASCIILiteral("Attempting to change the getter of an unconfigurable property."));
+        if (current.attributes() & CustomAccessor)
+            return typeError(exec, scope, throwException, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+    }
+
+    // Step 10/11.
+    if (!object)
+        return true;
+    JSValue accessor = object->getDirect(vm, propertyName);
+    if (!accessor)
+        return false;
+    GetterSetter* getterSetter;
+    bool getterSetterChanged = false;
+    if (accessor.isCustomGetterSetter()) {
+        getterSetter = GetterSetter::create(vm, exec->lexicalGlobalObject());
+        auto* customGetterSetter = jsCast<CustomGetterSetter*>(accessor);
+        if (customGetterSetter->setter())
+            getterSetter->setSetter(vm, exec->lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Setter));
+        if (customGetterSetter->getter())
+            getterSetter->setGetter(vm, exec->lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Getter));
+    } else {
+        ASSERT(accessor.isGetterSetter());
+        getterSetter = asGetterSetter(accessor);
+    }
+    if (descriptor.setterPresent()) {
+        getterSetter = getterSetter->withSetter(vm, exec->lexicalGlobalObject(), descriptor.setterObject());
+        getterSetterChanged = true;
+    }
+    if (descriptor.getterPresent()) {
+        getterSetter = getterSetter->withGetter(vm, exec->lexicalGlobalObject(), descriptor.getterObject());
+        getterSetterChanged = true;
+    }
+    if (current.attributesEqual(descriptor) && !getterSetterChanged)
+        return true;
+    object->methodTable(vm)->deleteProperty(object, exec, propertyName);
+    unsigned attrs = descriptor.attributesOverridingCurrent(current);
+    object->putDirectAccessor(exec, propertyName, getterSetter, attrs | Accessor);
+    return true;
+}
+
+bool JSObject::defineOwnNonIndexProperty(ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool throwException)
+{
+    VM& vm  = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    // Track on the globaldata that we're in define property.
+    // Currently DefineOwnProperty uses delete to remove properties when they are being replaced
+    // (particularly when changing attributes), however delete won't allow non-configurable (i.e.
+    // DontDelete) properties to be deleted. For now, we can use this flag to make this work.
+    VM::DeletePropertyModeScope scope(vm, VM::DeletePropertyMode::IgnoreConfigurable);
+    PropertyDescriptor current;
+    bool isCurrentDefined = getOwnPropertyDescriptor(exec, propertyName, current);
+    bool isExtensible = this->isExtensible(exec);
+    RETURN_IF_EXCEPTION(throwScope, false);
+    return validateAndApplyPropertyDescriptor(exec, this, propertyName, isExtensible, descriptor, isCurrentDefined, current, throwException);
+}
+
+bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool throwException)
+{
+    // If it's an array index, then use the indexed property storage.
+    if (std::optional<uint32_t> index = parseIndex(propertyName)) {
+        // c. Let succeeded be the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing P, Desc, and false as arguments.
+        // d. Reject if succeeded is false.
+        // e. If index >= oldLen
+        // e.i. Set oldLenDesc.[[Value]] to index + 1.
+        // e.ii. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", oldLenDesc, and false as arguments. This call will always return true.
+        // f. Return true.
+        return object->defineOwnIndexedProperty(exec, index.value(), descriptor, throwException);
+    }
+    
+    return object->defineOwnNonIndexProperty(exec, propertyName, descriptor, throwException);
+}
+
+void JSObject::convertToDictionary(VM& vm)
+{
+    DeferredStructureTransitionWatchpointFire deferredWatchpointFire;
+    setStructure(
+        vm, Structure::toCacheableDictionaryTransition(vm, structure(vm), &deferredWatchpointFire));
+}
+
+void JSObject::shiftButterflyAfterFlattening(const GCSafeConcurrentJSLocker&, VM& vm, Structure* structure, size_t outOfLineCapacityAfter)
+{
+    // This could interleave visitChildren because some old structure could have been a non
+    // dictionary structure. We have to be crazy careful. But, we are guaranteed to be holding
+    // the structure's lock right now, and that helps a bit.
+    
+    Butterfly* oldButterfly = this->butterfly();
+    size_t preCapacity;
+    size_t indexingPayloadSizeInBytes;
+    bool hasIndexingHeader = this->hasIndexingHeader();
+    if (UNLIKELY(hasIndexingHeader)) {
+        preCapacity = oldButterfly->indexingHeader()->preCapacity(structure);
+        indexingPayloadSizeInBytes = oldButterfly->indexingHeader()->indexingPayloadSizeInBytes(structure);
+    } else {
+        preCapacity = 0;
+        indexingPayloadSizeInBytes = 0;
+    }
+
+    Butterfly* newButterfly = Butterfly::createUninitialized(vm, this, preCapacity, outOfLineCapacityAfter, hasIndexingHeader, indexingPayloadSizeInBytes);
+
+    // No need to copy the precapacity.
+    void* currentBase = oldButterfly->base(0, outOfLineCapacityAfter);
+    void* newBase = newButterfly->base(0, outOfLineCapacityAfter);
+
+    memcpy(newBase, currentBase, Butterfly::totalSize(0, outOfLineCapacityAfter, hasIndexingHeader, indexingPayloadSizeInBytes));
+    
+    setButterfly(vm, newButterfly);
+}
+
+uint32_t JSObject::getEnumerableLength(ExecState* exec, JSObject* object)
+{
+    VM& vm = exec->vm();
+    Structure* structure = object->structure(vm);
+    if (structure->holesMustForwardToPrototype(vm))
+        return 0;
+    switch (object->indexingType()) {
+    case ALL_BLANK_INDEXING_TYPES:
+    case ALL_UNDECIDED_INDEXING_TYPES:
+        return 0;
+        
+    case ALL_INT32_INDEXING_TYPES:
+    case ALL_CONTIGUOUS_INDEXING_TYPES: {
+        Butterfly* butterfly = object->butterfly();
+        unsigned usedLength = butterfly->publicLength();
+        for (unsigned i = 0; i < usedLength; ++i) {
+            if (!butterfly->contiguous()[i])
+                return 0;
+        }
+        return usedLength;
+    }
+        
+    case ALL_DOUBLE_INDEXING_TYPES: {
+        Butterfly* butterfly = object->butterfly();
+        unsigned usedLength = butterfly->publicLength();
+        for (unsigned i = 0; i < usedLength; ++i) {
+            double value = butterfly->contiguousDouble()[i];
+            if (value != value)
+                return 0;
+        }
+        return usedLength;
+    }
+        
+    case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+        ArrayStorage* storage = object->m_butterfly.get()->arrayStorage();
+        if (storage->m_sparseMap.get())
+            return 0;
+        
+        unsigned usedVectorLength = std::min(storage->length(), storage->vectorLength());
+        for (unsigned i = 0; i < usedVectorLength; ++i) {
+            if (!storage->m_vector[i])
+                return 0;
+        }
+        return usedVectorLength;
+    }
+        
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+void JSObject::getStructurePropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    VM& vm = exec->vm();
+    object->structure(vm)->getPropertyNamesFromStructure(vm, propertyNames, mode);
+}
+
+void JSObject::getGenericPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    object->methodTable(vm)->getOwnPropertyNames(object, exec, propertyNames, EnumerationMode(mode, JSObjectPropertiesMode::Exclude));
+    RETURN_IF_EXCEPTION(scope, void());
+
+    JSValue nextProto = object->getPrototype(vm, exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    if (nextProto.isNull())
+        return;
+
+    JSObject* prototype = asObject(nextProto);
+    while (true) {
+        if (prototype->structure(vm)->typeInfo().overridesGetPropertyNames()) {
+            prototype->methodTable(vm)->getPropertyNames(prototype, exec, propertyNames, mode);
+            break;
+        }
+        prototype->methodTable(vm)->getOwnPropertyNames(prototype, exec, propertyNames, mode);
+        RETURN_IF_EXCEPTION(scope, void());
+        nextProto = prototype->getPrototype(vm, exec);
+        RETURN_IF_EXCEPTION(scope, void());
+        if (nextProto.isNull())
+            break;
+        prototype = asObject(nextProto);
+    }
+}
+
+// Implements GetMethod(O, P) in section 7.3.9 of the spec.
+// http://www.ecma-international.org/ecma-262/6.0/index.html#sec-getmethod
+JSValue JSObject::getMethod(ExecState* exec, CallData& callData, CallType& callType, const Identifier& ident, const String& errorMessage)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue method = get(exec, ident);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    if (!method.isCell()) {
+        if (method.isUndefinedOrNull())
+            return jsUndefined();
+
+        throwVMTypeError(exec, scope, errorMessage);
+        return jsUndefined();
+    }
+
+    callType = method.asCell()->methodTable()->getCallData(method.asCell(), callData);
+    if (callType == CallType::None) {
+        throwVMTypeError(exec, scope, errorMessage);
+        return jsUndefined();
+    }
+
+    return method;
+}
+
+} // namespace JSC
diff --git a/runtime/JSObject.h b/runtime/JSObject.h
new file mode 100644
index 0000000..da5810a
--- /dev/null
+++ b/runtime/JSObject.h
@@ -0,0 +1,1584 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "ArgList.h"
+#include "ArrayConventions.h"
+#include "ArrayStorage.h"
+#include "AuxiliaryBarrier.h"
+#include "Butterfly.h"
+#include "CPU.h"
+#include "CallFrame.h"
+#include "ClassInfo.h"
+#include "CommonIdentifiers.h"
+#include "CustomGetterSetter.h"
+#include "DeferGC.h"
+#include "Heap.h"
+#include "IndexingHeaderInlines.h"
+#include "JSCell.h"
+#include "PropertySlot.h"
+#include "PropertyStorage.h"
+#include "PutDirectIndexMode.h"
+#include "PutPropertySlot.h"
+#include "RuntimeType.h"
+#include "Structure.h"
+#include "VM.h"
+#include "JSString.h"
+#include "SparseArrayValueMap.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+namespace DOMJIT {
+class Signature;
+}
+
+inline JSCell* getJSFunction(JSValue value)
+{
+    if (value.isCell() && (value.asCell()->type() == JSFunctionType))
+        return value.asCell();
+    return 0;
+}
+
+class GetterSetter;
+class InternalFunction;
+class JSFunction;
+class LLIntOffsetsExtractor;
+class MarkedBlock;
+class PropertyDescriptor;
+class PropertyNameArray;
+class Structure;
+class ThrowScope;
+struct HashTable;
+struct HashTableValue;
+
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&, const String&);
+extern JS_EXPORTDATA const char* const NonExtensibleObjectPropertyDefineError;
+extern JS_EXPORTDATA const char* const ReadonlyPropertyWriteError;
+extern JS_EXPORTDATA const char* const ReadonlyPropertyChangeError;
+extern JS_EXPORTDATA const char* const UnableToDeletePropertyError;
+extern JS_EXPORTDATA const char* const UnconfigurablePropertyChangeAccessMechanismError;
+extern JS_EXPORTDATA const char* const UnconfigurablePropertyChangeConfigurabilityError;
+extern JS_EXPORTDATA const char* const UnconfigurablePropertyChangeEnumerabilityError;
+extern JS_EXPORTDATA const char* const UnconfigurablePropertyChangeWritabilityError;
+
+COMPILE_ASSERT(None < FirstInternalAttribute, None_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(ReadOnly < FirstInternalAttribute, ReadOnly_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(DontEnum < FirstInternalAttribute, DontEnum_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(DontDelete < FirstInternalAttribute, DontDelete_is_below_FirstInternalAttribute);
+COMPILE_ASSERT(Accessor < FirstInternalAttribute, Accessor_is_below_FirstInternalAttribute);
+
+class JSFinalObject;
+
+class JSObject : public JSCell {
+    friend class BatchedTransitionOptimizer;
+    friend class JIT;
+    friend class JSCell;
+    friend class JSFinalObject;
+    friend class MarkedBlock;
+    JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(VM&, const HashTableValue*, JSObject*, PropertyName, PropertySlot&);
+
+    enum PutMode {
+        PutModePut,
+        PutModeDefineOwnProperty,
+    };
+
+public:
+    typedef JSCell Base;
+
+    // This is a super dangerous method for JITs. Sometimes the JITs will want to create either a
+    // JSFinalObject or a JSArray. This is the method that will do that.
+    static JSObject* createRawObject(ExecState* exec, Structure* structure, Butterfly* = nullptr);
+
+    JS_EXPORT_PRIVATE static size_t estimatedSize(JSCell*);
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+    JS_EXPORT_PRIVATE static void heapSnapshot(JSCell*, HeapSnapshotBuilder&);
+
+    JS_EXPORT_PRIVATE static String className(const JSObject*);
+    JS_EXPORT_PRIVATE static String calculatedClassName(JSObject*);
+
+    // This function is what Object.prototype.toString() will use to get the name of
+    // an object when using Symbol.toStringTag fails. For the most part there is no
+    // difference between this and className(). The main use case is for new JS language
+    // objects to set the default tag to "Object".
+    JS_EXPORT_PRIVATE static String toStringName(const JSObject*, ExecState*);
+
+    // This is the fully virtual [[GetPrototypeOf]] internal function defined
+    // in the ECMAScript 6 specification. Use this when doing a [[GetPrototypeOf]] 
+    // operation as dictated in the specification.
+    JSValue getPrototype(VM&, ExecState*);
+    JS_EXPORT_PRIVATE static JSValue getPrototype(JSObject*, ExecState*);
+    // This gets the prototype directly off of the structure. This does not do
+    // dynamic dispatch on the getPrototype method table method. It is not valid 
+    // to use this when performing a [[GetPrototypeOf]] operation in the specification.
+    // It is valid to use though when you know that you want to directly get it
+    // without consulting the method table. This is akin to getting the [[Prototype]]
+    // internal field directly as described in the specification.
+    JSValue getPrototypeDirect() const;
+
+    // This sets the prototype without checking for cycles and without
+    // doing dynamic dispatch on [[SetPrototypeOf]] operation in the specification.
+    // It is not valid to use this when performing a [[SetPrototypeOf]] operation in
+    // the specification. It is valid to use though when you know that you want to directly
+    // set it without consulting the method table and when you definitely won't
+    // introduce a cycle in the prototype chain. This is akin to setting the
+    // [[Prototype]] internal field directly as described in the specification.
+    JS_EXPORT_PRIVATE void setPrototypeDirect(VM&, JSValue prototype);
+private:
+    // This is OrdinarySetPrototypeOf in the specification. Section 9.1.2.1
+    // https://tc39.github.io/ecma262/#sec-ordinarysetprototypeof
+    JS_EXPORT_PRIVATE bool setPrototypeWithCycleCheck(VM&, ExecState*, JSValue prototype, bool shouldThrowIfCantSet);
+public:
+    // This is the fully virtual [[SetPrototypeOf]] internal function defined
+    // in the ECMAScript 6 specification. Use this when doing a [[SetPrototypeOf]] 
+    // operation as dictated in the specification.
+    bool setPrototype(VM&, ExecState*, JSValue prototype, bool shouldThrowIfCantSet = false);
+    JS_EXPORT_PRIVATE static bool setPrototype(JSObject*, ExecState*, JSValue prototype, bool shouldThrowIfCantSet);
+        
+    bool mayInterceptIndexedAccesses()
+    {
+        return structure()->mayInterceptIndexedAccesses();
+    }
+        
+    JSValue get(ExecState*, PropertyName) const;
+    JSValue get(ExecState*, unsigned propertyName) const;
+
+    bool getPropertySlot(ExecState*, PropertyName, PropertySlot&);
+    bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+    template<typename CallbackWhenNoException> typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type getPropertySlot(ExecState*, PropertyName, CallbackWhenNoException) const;
+    template<typename CallbackWhenNoException> typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type getPropertySlot(ExecState*, PropertyName, PropertySlot&, CallbackWhenNoException) const;
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
+
+    // The key difference between this and getOwnPropertySlot is that getOwnPropertySlot
+    // currently returns incorrect results for the DOM window (with non-own properties)
+    // being returned. Once this is fixed we should migrate code & remove this method.
+    JS_EXPORT_PRIVATE bool getOwnPropertyDescriptor(ExecState*, PropertyName, PropertyDescriptor&);
+
+    unsigned getArrayLength() const
+    {
+        if (!hasIndexedProperties(indexingType()))
+            return 0;
+        return m_butterfly.get()->publicLength();
+    }
+        
+    unsigned getVectorLength()
+    {
+        if (!hasIndexedProperties(indexingType()))
+            return 0;
+        return m_butterfly.get()->vectorLength();
+    }
+    
+    static bool putInline(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    
+    JS_EXPORT_PRIVATE static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    // putByIndex assumes that the receiver is this JSCell object.
+    JS_EXPORT_PRIVATE static bool putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+        
+    ALWAYS_INLINE bool putByIndexInline(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+    {
+        if (canSetIndexQuickly(propertyName)) {
+            setIndexQuickly(exec->vm(), propertyName, value);
+            return true;
+        }
+        return methodTable(exec->vm())->putByIndex(this, exec, propertyName, value, shouldThrow);
+    }
+        
+    // This is similar to the putDirect* methods:
+    //  - the prototype chain is not consulted
+    //  - accessors are not called.
+    //  - it will ignore extensibility and read-only properties if PutDirectIndexLikePutDirect is passed as the mode (the default).
+    // This method creates a property with attributes writable, enumerable and configurable all set to true.
+    bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value, unsigned attributes, PutDirectIndexMode mode)
+    {
+        if (!attributes && canSetIndexQuicklyForPutDirect(propertyName)) {
+            setIndexQuickly(exec->vm(), propertyName, value);
+            return true;
+        }
+        return putDirectIndexBeyondVectorLength(exec, propertyName, value, attributes, mode);
+    }
+    bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value)
+    {
+        return putDirectIndex(exec, propertyName, value, 0, PutDirectIndexLikePutDirect);
+    }
+
+    // A non-throwing version of putDirect and putDirectIndex.
+    JS_EXPORT_PRIVATE bool putDirectMayBeIndex(ExecState*, PropertyName, JSValue);
+        
+    bool hasIndexingHeader() const
+    {
+        return structure()->hasIndexingHeader(this);
+    }
+    
+    bool canGetIndexQuickly(unsigned i)
+    {
+        Butterfly* butterfly = m_butterfly.get();
+        switch (indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_UNDECIDED_INDEXING_TYPES:
+            return false;
+        case ALL_INT32_INDEXING_TYPES:
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return i < butterfly->vectorLength() && butterfly->contiguous()[i];
+        case ALL_DOUBLE_INDEXING_TYPES: {
+            if (i >= butterfly->vectorLength())
+                return false;
+            double value = butterfly->contiguousDouble()[i];
+            if (value != value)
+                return false;
+            return true;
+        }
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return i < butterfly->arrayStorage()->vectorLength() && butterfly->arrayStorage()->m_vector[i];
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+        
+    JSValue getIndexQuickly(unsigned i)
+    {
+        Butterfly* butterfly = m_butterfly.get();
+        switch (indexingType()) {
+        case ALL_INT32_INDEXING_TYPES:
+            return jsNumber(butterfly->contiguous()[i].get().asInt32());
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return butterfly->contiguous()[i].get();
+        case ALL_DOUBLE_INDEXING_TYPES:
+            return JSValue(JSValue::EncodeAsDouble, butterfly->contiguousDouble()[i]);
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return butterfly->arrayStorage()->m_vector[i].get();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return JSValue();
+        }
+    }
+        
+    JSValue tryGetIndexQuickly(unsigned i) const
+    {
+        Butterfly* butterfly = m_butterfly.get();
+        switch (indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_UNDECIDED_INDEXING_TYPES:
+            break;
+        case ALL_INT32_INDEXING_TYPES:
+            if (i < butterfly->publicLength()) {
+                JSValue result = butterfly->contiguous()[i].get();
+                ASSERT(result.isInt32() || !result);
+                return result;
+            }
+            break;
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            if (i < butterfly->publicLength())
+                return butterfly->contiguous()[i].get();
+            break;
+        case ALL_DOUBLE_INDEXING_TYPES: {
+            if (i >= butterfly->publicLength())
+                break;
+            double result = butterfly->contiguousDouble()[i];
+            if (result != result)
+                break;
+            return JSValue(JSValue::EncodeAsDouble, result);
+        }
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            if (i < butterfly->arrayStorage()->vectorLength())
+                return butterfly->arrayStorage()->m_vector[i].get();
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        return JSValue();
+    }
+        
+    JSValue getDirectIndex(ExecState* exec, unsigned i)
+    {
+        if (JSValue result = tryGetIndexQuickly(i))
+            return result;
+        PropertySlot slot(this, PropertySlot::InternalMethodType::Get);
+        if (methodTable(exec->vm())->getOwnPropertySlotByIndex(this, exec, i, slot))
+            return slot.getValue(exec, i);
+        return JSValue();
+    }
+        
+    JSValue getIndex(ExecState* exec, unsigned i) const
+    {
+        if (JSValue result = tryGetIndexQuickly(i))
+            return result;
+        return get(exec, i);
+    }
+        
+    bool canSetIndexQuickly(unsigned i)
+    {
+        Butterfly* butterfly = m_butterfly.get();
+        switch (indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_UNDECIDED_INDEXING_TYPES:
+            return false;
+        case ALL_INT32_INDEXING_TYPES:
+        case ALL_DOUBLE_INDEXING_TYPES:
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+        case NonArrayWithArrayStorage:
+        case ArrayWithArrayStorage:
+            return i < butterfly->vectorLength();
+        case NonArrayWithSlowPutArrayStorage:
+        case ArrayWithSlowPutArrayStorage:
+            return i < butterfly->arrayStorage()->vectorLength()
+                && !!butterfly->arrayStorage()->m_vector[i];
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+        
+    bool canSetIndexQuicklyForPutDirect(unsigned i)
+    {
+        switch (indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_UNDECIDED_INDEXING_TYPES:
+            return false;
+        case ALL_INT32_INDEXING_TYPES:
+        case ALL_DOUBLE_INDEXING_TYPES:
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return i < m_butterfly.get()->vectorLength();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+        
+    void setIndexQuickly(VM& vm, unsigned i, JSValue v)
+    {
+        Butterfly* butterfly = m_butterfly.get();
+        switch (indexingType()) {
+        case ALL_INT32_INDEXING_TYPES: {
+            ASSERT(i < butterfly->vectorLength());
+            if (!v.isInt32()) {
+                convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(vm, i, v);
+                return;
+            }
+            FALLTHROUGH;
+        }
+        case ALL_CONTIGUOUS_INDEXING_TYPES: {
+            ASSERT(i < butterfly->vectorLength());
+            butterfly->contiguous()[i].set(vm, this, v);
+            if (i >= butterfly->publicLength())
+                butterfly->setPublicLength(i + 1);
+            break;
+        }
+        case ALL_DOUBLE_INDEXING_TYPES: {
+            ASSERT(i < butterfly->vectorLength());
+            if (!v.isNumber()) {
+                convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);
+                return;
+            }
+            double value = v.asNumber();
+            if (value != value) {
+                convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);
+                return;
+            }
+            butterfly->contiguousDouble()[i] = value;
+            if (i >= butterfly->publicLength())
+                butterfly->setPublicLength(i + 1);
+            break;
+        }
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+            ArrayStorage* storage = butterfly->arrayStorage();
+            WriteBarrier<Unknown>& x = storage->m_vector[i];
+            JSValue old = x.get();
+            x.set(vm, this, v);
+            if (!old) {
+                ++storage->m_numValuesInVector;
+                if (i >= storage->length())
+                    storage->setLength(i + 1);
+            }
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void initializeIndex(VM& vm, unsigned i, JSValue v)
+    {
+        initializeIndex(vm, i, v, indexingType());
+    }
+
+    // NOTE: Clients of this method may call it more than once for any index, and this is supposed
+    // to work.
+    ALWAYS_INLINE void initializeIndex(VM& vm, unsigned i, JSValue v, IndexingType indexingType)
+    {
+        Butterfly* butterfly = m_butterfly.get();
+        switch (indexingType) {
+        case ALL_UNDECIDED_INDEXING_TYPES: {
+            setIndexQuicklyToUndecided(vm, i, v);
+            break;
+        }
+        case ALL_INT32_INDEXING_TYPES: {
+            ASSERT(i < butterfly->publicLength());
+            ASSERT(i < butterfly->vectorLength());
+            if (!v.isInt32()) {
+                convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(vm, i, v);
+                break;
+            }
+            FALLTHROUGH;
+        }
+        case ALL_CONTIGUOUS_INDEXING_TYPES: {
+            ASSERT(i < butterfly->publicLength());
+            ASSERT(i < butterfly->vectorLength());
+            butterfly->contiguous()[i].set(vm, this, v);
+            break;
+        }
+        case ALL_DOUBLE_INDEXING_TYPES: {
+            ASSERT(i < butterfly->publicLength());
+            ASSERT(i < butterfly->vectorLength());
+            if (!v.isNumber()) {
+                convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);
+                return;
+            }
+            double value = v.asNumber();
+            if (value != value) {
+                convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);
+                return;
+            }
+            butterfly->contiguousDouble()[i] = value;
+            break;
+        }
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+            ArrayStorage* storage = butterfly->arrayStorage();
+            ASSERT(i < storage->length());
+            ASSERT(i < storage->m_numValuesInVector);
+            storage->m_vector[i].set(vm, this, v);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+        
+    void initializeIndexWithoutBarrier(unsigned i, JSValue v)
+    {
+        initializeIndexWithoutBarrier(i, v, indexingType());
+    }
+
+    // This version of initializeIndex is for cases where you know that you will not need any
+    // barriers. This implies not having any data format conversions.
+    ALWAYS_INLINE void initializeIndexWithoutBarrier(unsigned i, JSValue v, IndexingType indexingType)
+    {
+        Butterfly* butterfly = m_butterfly.get();
+        switch (indexingType) {
+        case ALL_UNDECIDED_INDEXING_TYPES: {
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        case ALL_INT32_INDEXING_TYPES: {
+            ASSERT(i < butterfly->publicLength());
+            ASSERT(i < butterfly->vectorLength());
+            RELEASE_ASSERT(v.isInt32());
+            FALLTHROUGH;
+        }
+        case ALL_CONTIGUOUS_INDEXING_TYPES: {
+            ASSERT(i < butterfly->publicLength());
+            ASSERT(i < butterfly->vectorLength());
+            butterfly->contiguous()[i].setWithoutWriteBarrier(v);
+            break;
+        }
+        case ALL_DOUBLE_INDEXING_TYPES: {
+            ASSERT(i < butterfly->publicLength());
+            ASSERT(i < butterfly->vectorLength());
+            RELEASE_ASSERT(v.isNumber());
+            double value = v.asNumber();
+            RELEASE_ASSERT(value == value);
+            butterfly->contiguousDouble()[i] = value;
+            break;
+        }
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
+            ArrayStorage* storage = butterfly->arrayStorage();
+            ASSERT(i < storage->length());
+            ASSERT(i < storage->m_numValuesInVector);
+            storage->m_vector[i].setWithoutWriteBarrier(v);
+            break;
+        }
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+        
+    bool hasSparseMap()
+    {
+        switch (indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_UNDECIDED_INDEXING_TYPES:
+        case ALL_INT32_INDEXING_TYPES:
+        case ALL_DOUBLE_INDEXING_TYPES:
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return false;
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return !!m_butterfly.get()->arrayStorage()->m_sparseMap;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+        
+    bool inSparseIndexingMode()
+    {
+        switch (indexingType()) {
+        case ALL_BLANK_INDEXING_TYPES:
+        case ALL_UNDECIDED_INDEXING_TYPES:
+        case ALL_INT32_INDEXING_TYPES:
+        case ALL_DOUBLE_INDEXING_TYPES:
+        case ALL_CONTIGUOUS_INDEXING_TYPES:
+            return false;
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly.get()->arrayStorage()->inSparseMode();
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+        
+    void enterDictionaryIndexingMode(VM&);
+
+    // putDirect is effectively an unchecked vesion of 'defineOwnProperty':
+    //  - the prototype chain is not consulted
+    //  - accessors are not called.
+    //  - attributes will be respected (after the call the property will exist with the given attributes)
+    //  - the property name is assumed to not be an index.
+    bool putDirect(VM&, PropertyName, JSValue, unsigned attributes = 0);
+    bool putDirect(VM&, PropertyName, JSValue, PutPropertySlot&);
+    void putDirectWithoutTransition(VM&, PropertyName, JSValue, unsigned attributes = 0);
+    bool putDirectNonIndexAccessor(VM&, PropertyName, JSValue, unsigned attributes);
+    bool putDirectAccessor(ExecState*, PropertyName, JSValue, unsigned attributes);
+    JS_EXPORT_PRIVATE bool putDirectCustomAccessor(VM&, PropertyName, JSValue, unsigned attributes);
+
+    bool putGetter(ExecState*, PropertyName, JSValue, unsigned attributes);
+    bool putSetter(ExecState*, PropertyName, JSValue, unsigned attributes);
+
+    JS_EXPORT_PRIVATE bool hasProperty(ExecState*, PropertyName) const;
+    JS_EXPORT_PRIVATE bool hasProperty(ExecState*, unsigned propertyName) const;
+    bool hasPropertyGeneric(ExecState*, PropertyName, PropertySlot::InternalMethodType) const;
+    bool hasPropertyGeneric(ExecState*, unsigned propertyName, PropertySlot::InternalMethodType) const;
+    bool hasOwnProperty(ExecState*, PropertyName, PropertySlot&) const;
+    bool hasOwnProperty(ExecState*, PropertyName) const;
+    bool hasOwnProperty(ExecState*, unsigned) const;
+
+    JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
+
+    JS_EXPORT_PRIVATE static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
+    JSValue ordinaryToPrimitive(ExecState*, PreferredPrimitiveType) const;
+
+    JS_EXPORT_PRIVATE bool hasInstance(ExecState*, JSValue value, JSValue hasInstanceValue);
+    JS_EXPORT_PRIVATE bool hasInstance(ExecState*, JSValue);
+    static bool defaultHasInstance(ExecState*, JSValue, JSValue prototypeProperty);
+
+    JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+    JS_EXPORT_PRIVATE static uint32_t getEnumerableLength(ExecState*, JSObject*);
+    JS_EXPORT_PRIVATE static void getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+
+    JS_EXPORT_PRIVATE JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+    bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
+    JS_EXPORT_PRIVATE double toNumber(ExecState*) const;
+    JS_EXPORT_PRIVATE JSString* toString(ExecState*) const;
+
+    JS_EXPORT_PRIVATE static JSValue toThis(JSCell*, ExecState*, ECMAMode);
+
+    // This get function only looks at the property map.
+    JSValue getDirect(VM& vm, PropertyName propertyName) const
+    {
+        Structure* structure = this->structure(vm);
+        PropertyOffset offset = structure->get(vm, propertyName);
+        checkOffset(offset, structure->inlineCapacity());
+        return offset != invalidOffset ? getDirect(offset) : JSValue();
+    }
+    
+    JSValue getDirect(VM& vm, PropertyName propertyName, unsigned& attributes) const
+    {
+        Structure* structure = this->structure(vm);
+        PropertyOffset offset = structure->get(vm, propertyName, attributes);
+        checkOffset(offset, structure->inlineCapacity());
+        return offset != invalidOffset ? getDirect(offset) : JSValue();
+    }
+
+    PropertyOffset getDirectOffset(VM& vm, PropertyName propertyName)
+    {
+        Structure* structure = this->structure(vm);
+        PropertyOffset offset = structure->get(vm, propertyName);
+        checkOffset(offset, structure->inlineCapacity());
+        return offset;
+    }
+
+    PropertyOffset getDirectOffset(VM& vm, PropertyName propertyName, unsigned& attributes)
+    {
+        Structure* structure = this->structure(vm);
+        PropertyOffset offset = structure->get(vm, propertyName, attributes);
+        checkOffset(offset, structure->inlineCapacity());
+        return offset;
+    }
+
+    bool hasInlineStorage() const { return structure()->hasInlineStorage(); }
+    ConstPropertyStorage inlineStorageUnsafe() const
+    {
+        return bitwise_cast<ConstPropertyStorage>(this + 1);
+    }
+    PropertyStorage inlineStorageUnsafe()
+    {
+        return bitwise_cast<PropertyStorage>(this + 1);
+    }
+    ConstPropertyStorage inlineStorage() const
+    {
+        ASSERT(hasInlineStorage());
+        return inlineStorageUnsafe();
+    }
+    PropertyStorage inlineStorage()
+    {
+        ASSERT(hasInlineStorage());
+        return inlineStorageUnsafe();
+    }
+        
+    const Butterfly* butterfly() const { return m_butterfly.get(); }
+    Butterfly* butterfly() { return m_butterfly.get(); }
+        
+    ConstPropertyStorage outOfLineStorage() const { return m_butterfly.get()->propertyStorage(); }
+    PropertyStorage outOfLineStorage() { return m_butterfly.get()->propertyStorage(); }
+
+    const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const
+    {
+        if (isInlineOffset(offset))
+            return &inlineStorage()[offsetInInlineStorage(offset)];
+        return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];
+    }
+
+    WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset)
+    {
+        if (isInlineOffset(offset))
+            return &inlineStorage()[offsetInInlineStorage(offset)];
+        return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];
+    }
+
+    void transitionTo(VM&, Structure*);
+
+    bool hasCustomProperties() { return structure()->didTransition(); }
+    bool hasGetterSetterProperties() { return structure()->hasGetterSetterProperties(); }
+    bool hasCustomGetterSetterProperties() { return structure()->hasCustomGetterSetterProperties(); }
+
+    // putOwnDataProperty has 'put' like semantics, however this method:
+    //  - assumes the object contains no own getter/setter properties.
+    //  - provides no special handling for __proto__
+    //  - does not walk the prototype chain (to check for accessors or non-writable properties).
+    // This is used by JSLexicalEnvironment.
+    bool putOwnDataProperty(VM&, PropertyName, JSValue, PutPropertySlot&);
+    bool putOwnDataPropertyMayBeIndex(ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    // Fast access to known property offsets.
+    JSValue getDirect(PropertyOffset offset) const { return locationForOffset(offset)->get(); }
+    void putDirect(VM& vm, PropertyOffset offset, JSValue value) { locationForOffset(offset)->set(vm, this, value); }
+    void putDirectWithoutBarrier(PropertyOffset offset, JSValue value) { locationForOffset(offset)->setWithoutWriteBarrier(value); }
+    void putDirectUndefined(PropertyOffset offset) { locationForOffset(offset)->setUndefined(); }
+
+    JS_EXPORT_PRIVATE bool putDirectNativeIntrinsicGetter(VM&, JSGlobalObject*, Identifier, NativeFunction, Intrinsic, unsigned attributes);
+    JS_EXPORT_PRIVATE bool putDirectNativeFunction(VM&, JSGlobalObject*, const PropertyName&, unsigned functionLength, NativeFunction, Intrinsic, unsigned attributes);
+    JS_EXPORT_PRIVATE bool putDirectNativeFunction(VM&, JSGlobalObject*, const PropertyName&, unsigned functionLength, NativeFunction, Intrinsic, const DOMJIT::Signature*, unsigned attributes);
+    JS_EXPORT_PRIVATE JSFunction* putDirectBuiltinFunction(VM&, JSGlobalObject*, const PropertyName&, FunctionExecutable*, unsigned attributes);
+    JSFunction* putDirectBuiltinFunctionWithoutTransition(VM&, JSGlobalObject*, const PropertyName&, FunctionExecutable*, unsigned attributes);
+    JS_EXPORT_PRIVATE void putDirectNativeFunctionWithoutTransition(VM&, JSGlobalObject*, const PropertyName&, unsigned functionLength, NativeFunction, Intrinsic, unsigned attributes);
+
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+    bool isEnvironmentRecord() const;
+    bool isGlobalObject() const;
+    bool isJSLexicalEnvironment() const;
+    bool isGlobalLexicalEnvironment() const;
+    bool isStrictEvalActivation() const;
+    bool isWithScope() const;
+
+    bool isErrorInstance() const;
+
+    JS_EXPORT_PRIVATE void seal(VM&);
+    JS_EXPORT_PRIVATE void freeze(VM&);
+    JS_EXPORT_PRIVATE static bool preventExtensions(JSObject*, ExecState*);
+    JS_EXPORT_PRIVATE static bool isExtensible(JSObject*, ExecState*);
+    bool isSealed(VM& vm) { return structure(vm)->isSealed(vm); }
+    bool isFrozen(VM& vm) { return structure(vm)->isFrozen(vm); }
+private:
+    ALWAYS_INLINE bool isExtensibleImpl() { return isStructureExtensible(); }
+public:
+    // You should only call isStructureExtensible() when:
+    // - Performing this check in a way that isn't described in the specification 
+    //   as calling the virtual [[IsExtensible]] trap.
+    // - When you're guaranteed that object->methodTable()->isExtensible isn't
+    //   overridden.
+    ALWAYS_INLINE bool isStructureExtensible() { return structure()->isStructureExtensible(); }
+    // You should call this when performing [[IsExtensible]] trap in a place
+    // that is described in the specification. This performs the fully virtual
+    // [[IsExtensible]] trap.
+    bool isExtensible(ExecState*);
+    bool indexingShouldBeSparse()
+    {
+        return !isStructureExtensible()
+            || structure()->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero();
+    }
+
+    bool staticPropertiesReified() { return structure()->staticPropertiesReified(); }
+    void reifyAllStaticProperties(ExecState*);
+
+    JS_EXPORT_PRIVATE Butterfly* allocateMoreOutOfLineStorage(VM&, size_t oldSize, size_t newSize);
+
+    // Call this when you do not need to change the structure.
+    void setButterfly(VM&, Butterfly*);
+    
+    // Call this if you do need to change the structure, or if you changed something about a structure
+    // in-place.
+    void nukeStructureAndSetButterfly(VM&, StructureID, Butterfly*);
+    
+    void setStructure(VM&, Structure*);
+
+    JS_EXPORT_PRIVATE void convertToDictionary(VM&);
+
+    void flattenDictionaryObject(VM& vm)
+    {
+        structure(vm)->flattenDictionaryStructure(vm, this);
+    }
+    void shiftButterflyAfterFlattening(const GCSafeConcurrentJSLocker&, VM&, Structure* structure, size_t outOfLineCapacityAfter);
+
+    JSGlobalObject* globalObject() const
+    {
+        ASSERT(structure()->globalObject());
+        ASSERT(!isGlobalObject() || ((JSObject*)structure()->globalObject()) == this);
+        return structure()->globalObject();
+    }
+        
+    JSGlobalObject* globalObject(VM& vm) const
+    {
+        ASSERT(structure(vm)->globalObject());
+        ASSERT(!isGlobalObject() || ((JSObject*)structure()->globalObject()) == this);
+        return structure(vm)->globalObject();
+    }
+        
+    void switchToSlowPutArrayStorage(VM&);
+        
+    // The receiver is the prototype in this case. The following:
+    //
+    // asObject(foo->structure()->storedPrototype())->attemptToInterceptPutByIndexOnHoleForPrototype(...)
+    //
+    // is equivalent to:
+    //
+    // foo->attemptToInterceptPutByIndexOnHole(...);
+    bool attemptToInterceptPutByIndexOnHoleForPrototype(ExecState*, JSValue thisValue, unsigned propertyName, JSValue, bool shouldThrow, bool& putResult);
+        
+    // Returns 0 if int32 storage cannot be created - either because
+    // indexing should be sparse, we're having a bad time, or because
+    // we already have a more general form of storage (double,
+    // contiguous, array storage).
+    ContiguousJSValues ensureInt32(VM& vm)
+    {
+        if (LIKELY(hasInt32(indexingType())))
+            return m_butterfly.get()->contiguousInt32();
+            
+        return ensureInt32Slow(vm);
+    }
+        
+    // Returns 0 if double storage cannot be created - either because
+    // indexing should be sparse, we're having a bad time, or because
+    // we already have a more general form of storage (contiguous,
+    // or array storage).
+    ContiguousDoubles ensureDouble(VM& vm)
+    {
+        if (LIKELY(hasDouble(indexingType())))
+            return m_butterfly.get()->contiguousDouble();
+            
+        return ensureDoubleSlow(vm);
+    }
+        
+    // Returns 0 if contiguous storage cannot be created - either because
+    // indexing should be sparse or because we're having a bad time.
+    ContiguousJSValues ensureContiguous(VM& vm)
+    {
+        if (LIKELY(hasContiguous(indexingType())))
+            return m_butterfly.get()->contiguous();
+            
+        return ensureContiguousSlow(vm);
+    }
+
+    // Ensure that the object is in a mode where it has array storage. Use
+    // this if you're about to perform actions that would have required the
+    // object to be converted to have array storage, if it didn't have it
+    // already.
+    ArrayStorage* ensureArrayStorage(VM& vm)
+    {
+        if (LIKELY(hasAnyArrayStorage(indexingType())))
+            return m_butterfly.get()->arrayStorage();
+
+        return ensureArrayStorageSlow(vm);
+    }
+        
+    static size_t offsetOfInlineStorage();
+        
+    static ptrdiff_t butterflyOffset()
+    {
+        return OBJECT_OFFSETOF(JSObject, m_butterfly);
+    }
+        
+    void* butterflyAddress()
+    {
+        return &m_butterfly;
+    }
+
+    JS_EXPORT_PRIVATE JSValue getMethod(ExecState*, CallData&, CallType&, const Identifier&, const String& errorMessage);
+
+    DECLARE_EXPORT_INFO;
+
+protected:
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        ASSERT(inherits(info()));
+        ASSERT(getPrototypeDirect().isNull() || Heap::heap(this) == Heap::heap(getPrototypeDirect()));
+        ASSERT(structure()->isObject());
+        ASSERT(classInfo());
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    // To instantiate objects you likely want JSFinalObject, below.
+    // To create derived types you likely want JSNonFinalObject, below.
+    JSObject(VM&, Structure*, Butterfly* = 0);
+    
+    // Visits the butterfly unless there is a race. Returns the structure if there was no race.
+    Structure* visitButterfly(SlotVisitor&);
+    
+    Structure* visitButterflyImpl(SlotVisitor&);
+    
+    void markAuxiliaryAndVisitOutOfLineProperties(SlotVisitor&, Butterfly*, Structure*, PropertyOffset lastOffset);
+
+    // Call this if you know that the object is in a mode where it has array
+    // storage. This will assert otherwise.
+    ArrayStorage* arrayStorage()
+    {
+        ASSERT(hasAnyArrayStorage(indexingType()));
+        return m_butterfly.get()->arrayStorage();
+    }
+        
+    // Call this if you want to predicate some actions on whether or not the
+    // object is in a mode where it has array storage.
+    ArrayStorage* arrayStorageOrNull()
+    {
+        switch (indexingType()) {
+        case ALL_ARRAY_STORAGE_INDEXING_TYPES:
+            return m_butterfly.get()->arrayStorage();
+                
+        default:
+            return 0;
+        }
+    }
+        
+    size_t butterflyTotalSize();
+    size_t butterflyPreCapacity();
+
+    Butterfly* createInitialUndecided(VM&, unsigned length);
+    ContiguousJSValues createInitialInt32(VM&, unsigned length);
+    ContiguousDoubles createInitialDouble(VM&, unsigned length);
+    ContiguousJSValues createInitialContiguous(VM&, unsigned length);
+        
+    void convertUndecidedForValue(VM&, JSValue);
+    void createInitialForValueAndSet(VM&, unsigned index, JSValue);
+    void convertInt32ForValue(VM&, JSValue);
+        
+    static Butterfly* createArrayStorageButterfly(VM&, JSCell* intendedOwner, Structure*, unsigned length, unsigned vectorLength, Butterfly* oldButterfly = nullptr);
+    ArrayStorage* createArrayStorage(VM&, unsigned length, unsigned vectorLength);
+    ArrayStorage* createInitialArrayStorage(VM&);
+        
+    ContiguousJSValues convertUndecidedToInt32(VM&);
+    ContiguousDoubles convertUndecidedToDouble(VM&);
+    ContiguousJSValues convertUndecidedToContiguous(VM&);
+    ArrayStorage* convertUndecidedToArrayStorage(VM&, NonPropertyTransition);
+    ArrayStorage* convertUndecidedToArrayStorage(VM&);
+        
+    ContiguousDoubles convertInt32ToDouble(VM&);
+    ContiguousJSValues convertInt32ToContiguous(VM&);
+    ArrayStorage* convertInt32ToArrayStorage(VM&, NonPropertyTransition);
+    ArrayStorage* convertInt32ToArrayStorage(VM&);
+    
+    ContiguousJSValues convertDoubleToContiguous(VM&);
+    ArrayStorage* convertDoubleToArrayStorage(VM&, NonPropertyTransition);
+    ArrayStorage* convertDoubleToArrayStorage(VM&);
+        
+    ArrayStorage* convertContiguousToArrayStorage(VM&, NonPropertyTransition);
+    ArrayStorage* convertContiguousToArrayStorage(VM&);
+
+        
+    ArrayStorage* ensureArrayStorageExistsAndEnterDictionaryIndexingMode(VM&);
+        
+    bool defineOwnNonIndexProperty(ExecState*, PropertyName, const PropertyDescriptor&, bool throwException);
+
+    template<IndexingType indexingShape>
+    bool putByIndexBeyondVectorLengthWithoutAttributes(ExecState*, unsigned propertyName, JSValue);
+    bool putByIndexBeyondVectorLengthWithArrayStorage(ExecState*, unsigned propertyName, JSValue, bool shouldThrow, ArrayStorage*);
+
+    bool increaseVectorLength(VM&, unsigned newLength);
+    void deallocateSparseIndexMap();
+    bool defineOwnIndexedProperty(ExecState*, unsigned, const PropertyDescriptor&, bool throwException);
+    SparseArrayValueMap* allocateSparseIndexMap(VM&);
+        
+    void notifyPresenceOfIndexedAccessors(VM&);
+        
+    bool attemptToInterceptPutByIndexOnHole(ExecState*, unsigned index, JSValue, bool shouldThrow, bool& putResult);
+        
+    // Call this if you want setIndexQuickly to succeed and you're sure that
+    // the array is contiguous.
+    bool WARN_UNUSED_RETURN ensureLength(VM& vm, unsigned length)
+    {
+        ASSERT(length < MAX_ARRAY_INDEX);
+        ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
+
+        bool result = true;
+        if (m_butterfly.get()->vectorLength() < length)
+            result = ensureLengthSlow(vm, length);
+            
+        if (m_butterfly.get()->publicLength() < length)
+            m_butterfly.get()->setPublicLength(length);
+        return result;
+    }
+        
+    // Call this if you want to shrink the butterfly backing store, and you're
+    // sure that the array is contiguous.
+    void reallocateAndShrinkButterfly(VM&, unsigned length);
+    
+    template<IndexingType indexingShape>
+    unsigned countElements(Butterfly*);
+        
+    // This is relevant to undecided, int32, double, and contiguous.
+    unsigned countElements();
+        
+private:
+    friend class LLIntOffsetsExtractor;
+        
+    // Nobody should ever ask any of these questions on something already known to be a JSObject.
+    using JSCell::isAPIValueWrapper;
+    using JSCell::isGetterSetter;
+    void getObject();
+    void getString(ExecState* exec);
+    void isObject();
+    void isString();
+        
+    Butterfly* createInitialIndexedStorage(VM&, unsigned length);
+        
+    ArrayStorage* enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(VM&, ArrayStorage*);
+        
+    template<PutMode>
+    bool putDirectInternal(VM&, PropertyName, JSValue, unsigned attr, PutPropertySlot&);
+    bool canPerformFastPutInline(ExecState* exec, VM&, PropertyName);
+
+    JS_EXPORT_PRIVATE NEVER_INLINE bool putInlineSlow(ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    bool getNonIndexPropertySlot(ExecState*, PropertyName, PropertySlot&);
+    bool getOwnNonIndexPropertySlot(VM&, Structure*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE void fillGetterPropertySlot(PropertySlot&, JSValue, unsigned, PropertyOffset);
+    void fillCustomGetterPropertySlot(PropertySlot&, JSValue, unsigned, Structure*);
+
+    JS_EXPORT_PRIVATE bool getOwnStaticPropertySlot(VM&, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE const HashTableValue* findPropertyHashEntry(PropertyName) const;
+        
+    bool putIndexedDescriptor(ExecState*, SparseArrayEntry*, const PropertyDescriptor&, PropertyDescriptor& old);
+        
+    bool putByIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    bool putDirectIndexBeyondVectorLengthWithArrayStorage(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode, ArrayStorage*);
+    JS_EXPORT_PRIVATE bool putDirectIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, unsigned attributes, PutDirectIndexMode);
+        
+    unsigned getNewVectorLength(unsigned indexBias, unsigned currentVectorLength, unsigned currentLength, unsigned desiredLength);
+    unsigned getNewVectorLength(unsigned desiredLength);
+
+    ArrayStorage* constructConvertedArrayStorageWithoutCopyingElements(VM&, unsigned neededLength);
+        
+    JS_EXPORT_PRIVATE void setIndexQuicklyToUndecided(VM&, unsigned index, JSValue);
+    JS_EXPORT_PRIVATE void convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(VM&, unsigned index, JSValue);
+    JS_EXPORT_PRIVATE void convertDoubleToContiguousWhilePerformingSetIndex(VM&, unsigned index, JSValue);
+        
+    bool ensureLengthSlow(VM&, unsigned length);
+        
+    ContiguousJSValues ensureInt32Slow(VM&);
+    ContiguousDoubles ensureDoubleSlow(VM&);
+    ContiguousJSValues ensureContiguousSlow(VM&);
+    JS_EXPORT_PRIVATE ArrayStorage* ensureArrayStorageSlow(VM&);
+
+    PropertyOffset prepareToPutDirectWithoutTransition(VM&, PropertyName, unsigned attributes, StructureID, Structure*);
+
+protected:
+    AuxiliaryBarrier<Butterfly*> m_butterfly;
+#if USE(JSVALUE32_64)
+private:
+    uint32_t m_padding;
+#endif
+};
+
+// JSNonFinalObject is a type of JSObject that has some internal storage,
+// but also preserves some space in the collector cell for additional
+// data members in derived types.
+class JSNonFinalObject : public JSObject {
+    friend class JSObject;
+
+public:
+    typedef JSObject Base;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    explicit JSNonFinalObject(VM& vm, Structure* structure, Butterfly* butterfly = 0)
+        : JSObject(vm, structure, butterfly)
+    {
+    }
+
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        ASSERT(!this->structure()->hasInlineStorage());
+        ASSERT(classInfo());
+    }
+};
+
+class JSFinalObject;
+
+// JSFinalObject is a type of JSObject that contains sufficent internal
+// storage to fully make use of the colloctor cell containing it.
+class JSFinalObject : public JSObject {
+    friend class JSObject;
+
+public:
+    typedef JSObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        return sizeof(JSObject) + inlineCapacity * sizeof(WriteBarrierBase<Unknown>);
+    }
+
+    static inline const TypeInfo typeInfo() { return TypeInfo(FinalObjectType, StructureFlags); }
+    static const IndexingType defaultIndexingType = NonArray;
+        
+    static const unsigned defaultSize = 64;
+    static inline unsigned defaultInlineCapacity()
+    {
+        return (defaultSize - allocationSize(0)) / sizeof(WriteBarrier<Unknown>);
+    }
+
+    static const unsigned maxSize = 512;
+    static inline unsigned maxInlineCapacity()
+    {
+        return (maxSize - allocationSize(0)) / sizeof(WriteBarrier<Unknown>);
+    }
+
+    static JSFinalObject* create(ExecState*, Structure*, Butterfly* = nullptr);
+    static JSFinalObject* create(VM&, Structure*);
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, unsigned inlineCapacity)
+    {
+        return Structure::create(vm, globalObject, prototype, typeInfo(), info(), defaultIndexingType, inlineCapacity);
+    }
+
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+
+    DECLARE_EXPORT_INFO;
+
+protected:
+    void visitChildrenCommon(SlotVisitor&);
+        
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        ASSERT(structure()->totalStorageCapacity() == structure()->inlineCapacity());
+        ASSERT(classInfo());
+    }
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    explicit JSFinalObject(VM& vm, Structure* structure, Butterfly* butterfly = nullptr)
+        : JSObject(vm, structure, butterfly)
+    {
+        memset(inlineStorageUnsafe(), 0, structure->inlineCapacity() * sizeof(EncodedJSValue));
+    }
+};
+
+JS_EXPORT_PRIVATE EncodedJSValue JSC_HOST_CALL objectPrivateFuncInstanceOf(ExecState*);
+
+inline JSObject* JSObject::createRawObject(
+    ExecState* exec, Structure* structure, Butterfly* butterfly)
+{
+    JSObject* finalObject = new (
+        NotNull, 
+        allocateCell<JSFinalObject>(
+            *exec->heap(),
+            JSFinalObject::allocationSize(structure->inlineCapacity())
+        )
+    ) JSObject(exec->vm(), structure, butterfly);
+    finalObject->finishCreation(exec->vm());
+    return finalObject;
+}
+
+inline JSFinalObject* JSFinalObject::create(
+    ExecState* exec, Structure* structure, Butterfly* butterfly)
+{
+    JSFinalObject* finalObject = new (
+        NotNull, 
+        allocateCell<JSFinalObject>(
+            *exec->heap(),
+            allocationSize(structure->inlineCapacity())
+        )
+    ) JSFinalObject(exec->vm(), structure, butterfly);
+    finalObject->finishCreation(exec->vm());
+    return finalObject;
+}
+
+inline JSFinalObject* JSFinalObject::create(VM& vm, Structure* structure)
+{
+    JSFinalObject* finalObject = new (NotNull, allocateCell<JSFinalObject>(vm.heap, allocationSize(structure->inlineCapacity()))) JSFinalObject(vm, structure);
+    finalObject->finishCreation(vm);
+    return finalObject;
+}
+
+inline bool isJSFinalObject(JSCell* cell)
+{
+    return cell->type() == FinalObjectType;
+}
+
+inline bool isJSFinalObject(JSValue value)
+{
+    return value.isCell() && isJSFinalObject(value.asCell());
+}
+
+inline size_t JSObject::offsetOfInlineStorage()
+{
+    return sizeof(JSObject);
+}
+
+inline bool JSObject::isGlobalObject() const
+{
+    return type() == GlobalObjectType;
+}
+
+inline bool JSObject::isJSLexicalEnvironment() const
+{
+    return type() == LexicalEnvironmentType || type() == ModuleEnvironmentType;
+}
+
+inline bool JSObject::isGlobalLexicalEnvironment() const
+{
+    return type() == GlobalLexicalEnvironmentType;
+}
+
+inline bool JSObject::isStrictEvalActivation() const
+{
+    return type() == StrictEvalActivationType;
+}
+
+inline bool JSObject::isEnvironmentRecord() const
+{
+    bool result = GlobalObjectType <= type() && type() <= StrictEvalActivationType;
+    ASSERT((isGlobalObject() || isJSLexicalEnvironment() || isGlobalLexicalEnvironment() || isStrictEvalActivation()) == result);
+    return result;
+}
+
+inline bool JSObject::isErrorInstance() const
+{
+    return type() == ErrorInstanceType;
+}
+
+inline bool JSObject::isWithScope() const
+{
+    return type() == WithScopeType;
+}
+
+inline void JSObject::setStructure(VM& vm, Structure* structure)
+{
+    ASSERT(structure);
+    ASSERT(!m_butterfly == !(structure->outOfLineCapacity() || structure->hasIndexingHeader(this)));
+    JSCell::setStructure(vm, structure);
+}
+
+inline void JSObject::setButterfly(VM& vm, Butterfly* butterfly)
+{
+    if (isX86() || vm.heap.mutatorShouldBeFenced()) {
+        WTF::storeStoreFence();
+        m_butterfly.set(vm, this, butterfly);
+        WTF::storeStoreFence();
+        return;
+    }
+    
+    m_butterfly.set(vm, this, butterfly);
+}
+
+inline void JSObject::nukeStructureAndSetButterfly(VM& vm, StructureID oldStructureID, Butterfly* butterfly)
+{
+    if (isX86() || vm.heap.mutatorShouldBeFenced()) {
+        setStructureIDDirectly(nuke(oldStructureID));
+        WTF::storeStoreFence();
+        m_butterfly.set(vm, this, butterfly);
+        WTF::storeStoreFence();
+        return;
+    }
+    
+    m_butterfly.set(vm, this, butterfly);
+}
+
+inline CallType getCallData(JSValue value, CallData& callData)
+{
+    CallType result = value.isCell() ? value.asCell()->methodTable()->getCallData(value.asCell(), callData) : CallType::None;
+    ASSERT(result == CallType::None || value.isValidCallee());
+    return result;
+}
+
+inline ConstructType getConstructData(JSValue value, ConstructData& constructData)
+{
+    ConstructType result = value.isCell() ? value.asCell()->methodTable()->getConstructData(value.asCell(), constructData) : ConstructType::None;
+    ASSERT(result == ConstructType::None || value.isValidCallee());
+    return result;
+}
+
+inline JSObject* asObject(JSCell* cell)
+{
+    ASSERT(cell->isObject());
+    return jsCast<JSObject*>(cell);
+}
+
+inline JSObject* asObject(JSValue value)
+{
+    return asObject(value.asCell());
+}
+
+inline JSObject::JSObject(VM& vm, Structure* structure, Butterfly* butterfly)
+    : JSCell(vm, structure)
+    , m_butterfly(vm, this, butterfly)
+{
+}
+
+inline JSValue JSObject::getPrototypeDirect() const
+{
+    return structure()->storedPrototype();
+}
+
+inline JSValue JSObject::getPrototype(VM& vm, ExecState* exec)
+{
+    auto getPrototypeMethod = methodTable(vm)->getPrototype;
+    MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
+    if (LIKELY(getPrototypeMethod == defaultGetPrototype))
+        return getPrototypeDirect();
+    return getPrototypeMethod(this, exec);
+}
+
+// It is safe to call this method with a PropertyName that is actually an index,
+// but if so will always return false (doesn't search index storage).
+ALWAYS_INLINE bool JSObject::getOwnNonIndexPropertySlot(VM& vm, Structure* structure, PropertyName propertyName, PropertySlot& slot)
+{
+    unsigned attributes;
+    PropertyOffset offset = structure->get(vm, propertyName, attributes);
+    if (!isValidOffset(offset)) {
+        if (!TypeInfo::hasStaticPropertyTable(inlineTypeFlags()))
+            return false;
+        return getOwnStaticPropertySlot(vm, propertyName, slot);
+    }
+    
+    // getPropertySlot relies on this method never returning index properties!
+    ASSERT(!parseIndex(propertyName));
+
+    JSValue value = getDirect(offset);
+    if (value.isCell()) {
+        ASSERT(value);
+        JSCell* cell = value.asCell();
+        JSType type = cell->type();
+        switch (type) {
+        case GetterSetterType:
+            fillGetterPropertySlot(slot, value, attributes, offset);
+            return true;
+        case CustomGetterSetterType:
+            fillCustomGetterPropertySlot(slot, value, attributes, structure);
+            return true;
+        default:
+            break;
+        }
+    }
+    
+    slot.setValue(this, attributes, value, offset);
+    return true;
+}
+
+ALWAYS_INLINE void JSObject::fillCustomGetterPropertySlot(PropertySlot& slot, JSValue customGetterSetter, unsigned attributes, Structure* structure)
+{
+    if (structure->isUncacheableDictionary()) {
+        slot.setCustom(this, attributes, jsCast<CustomGetterSetter*>(customGetterSetter)->getter());
+        return;
+    }
+
+    // This access is cacheable because Structure requires an attributeChangedTransition
+    // if this property stops being an accessor.
+    slot.setCacheableCustom(this, attributes, jsCast<CustomGetterSetter*>(customGetterSetter)->getter(), jsCast<CustomGetterSetter*>(customGetterSetter)->domJIT());
+}
+
+// It may seem crazy to inline a function this large, especially a virtual function,
+// but it makes a big difference to property lookup that derived classes can inline their
+// base class call to this.
+ALWAYS_INLINE bool JSObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    Structure* structure = object->structure(vm);
+    if (object->getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
+        return true;
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return getOwnPropertySlotByIndex(object, exec, index.value(), slot);
+    return false;
+}
+
+// It may seem crazy to inline a function this large but it makes a big difference
+// since this is function very hot in variable lookup
+ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto& structureIDTable = vm.heap.structureIDTable();
+    JSObject* object = this;
+    while (true) {
+        if (UNLIKELY(TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()))) {
+            // If propertyName is an index then we may have missed it (as this loop is using
+            // getOwnNonIndexPropertySlot), so we cannot safely call the overridden getOwnPropertySlot
+            // (lest we return a property from a prototype that is shadowed). Check now for an index,
+            // if so we need to start afresh from this object.
+            if (std::optional<uint32_t> index = parseIndex(propertyName))
+                return getPropertySlot(exec, index.value(), slot);
+            // Safe to continue searching from current position; call getNonIndexPropertySlot to avoid
+            // parsing the int again.
+            return object->getNonIndexPropertySlot(exec, propertyName, slot);
+        }
+        ASSERT(object->type() != ProxyObjectType);
+        Structure* structure = structureIDTable.get(object->structureID());
+        if (object->getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
+            return true;
+        JSValue prototype = structure->storedPrototype();
+        if (!prototype.isObject())
+            break;
+        object = asObject(prototype);
+    }
+
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return getPropertySlot(exec, index.value(), slot);
+    return false;
+}
+
+inline JSValue JSObject::get(ExecState* exec, PropertyName propertyName) const
+{
+    PropertySlot slot(this, PropertySlot::InternalMethodType::Get);
+    if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
+        return slot.getValue(exec, propertyName);
+    
+    return jsUndefined();
+}
+
+inline JSValue JSObject::get(ExecState* exec, unsigned propertyName) const
+{
+    PropertySlot slot(this, PropertySlot::InternalMethodType::Get);
+    if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
+        return slot.getValue(exec, propertyName);
+
+    return jsUndefined();
+}
+
+inline bool JSObject::putOwnDataProperty(VM& vm, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+    ASSERT(!structure()->hasGetterSetterProperties());
+    ASSERT(!structure()->hasCustomGetterSetterProperties());
+
+    return putDirectInternal<PutModePut>(vm, propertyName, value, 0, slot);
+}
+
+inline bool JSObject::putOwnDataPropertyMayBeIndex(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+    ASSERT(!structure()->hasGetterSetterProperties());
+    ASSERT(!structure()->hasCustomGetterSetterProperties());
+
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return putDirectIndex(exec, index.value(), value, 0, PutDirectIndexLikePutDirect);
+
+    return putDirectInternal<PutModePut>(exec->vm(), propertyName, value, 0, slot);
+}
+
+inline bool JSObject::putDirect(VM& vm, PropertyName propertyName, JSValue value, unsigned attributes)
+{
+    ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
+    ASSERT(!value.isCustomGetterSetter());
+    PutPropertySlot slot(this);
+    return putDirectInternal<PutModeDefineOwnProperty>(vm, propertyName, value, attributes, slot);
+}
+
+inline bool JSObject::putDirect(VM& vm, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    ASSERT(!value.isGetterSetter());
+    ASSERT(!value.isCustomGetterSetter());
+    return putDirectInternal<PutModeDefineOwnProperty>(vm, propertyName, value, 0, slot);
+}
+
+ALWAYS_INLINE JSObject* Register::object() const
+{
+    return asObject(jsValue());
+}
+
+ALWAYS_INLINE Register& Register::operator=(JSObject* object)
+{
+    u.value = JSValue::encode(JSValue(object));
+    return *this;
+}
+
+inline size_t offsetInButterfly(PropertyOffset offset)
+{
+    return offsetInOutOfLineStorage(offset) + Butterfly::indexOfPropertyStorage();
+}
+
+inline size_t JSObject::butterflyPreCapacity()
+{
+    if (UNLIKELY(hasIndexingHeader()))
+        return butterfly()->indexingHeader()->preCapacity(structure());
+    return 0;
+}
+
+inline size_t JSObject::butterflyTotalSize()
+{
+    Structure* structure = this->structure();
+    Butterfly* butterfly = this->butterfly();
+    size_t preCapacity;
+    size_t indexingPayloadSizeInBytes;
+    bool hasIndexingHeader = this->hasIndexingHeader();
+
+    if (UNLIKELY(hasIndexingHeader)) {
+        preCapacity = butterfly->indexingHeader()->preCapacity(structure);
+        indexingPayloadSizeInBytes = butterfly->indexingHeader()->indexingPayloadSizeInBytes(structure);
+    } else {
+        preCapacity = 0;
+        indexingPayloadSizeInBytes = 0;
+    }
+
+    return Butterfly::totalSize(preCapacity, structure->outOfLineCapacity(), hasIndexingHeader, indexingPayloadSizeInBytes);
+}
+
+inline int indexRelativeToBase(PropertyOffset offset)
+{
+    if (isOutOfLineOffset(offset))
+        return offsetInOutOfLineStorage(offset) + Butterfly::indexOfPropertyStorage();
+    ASSERT(!(JSObject::offsetOfInlineStorage() % sizeof(EncodedJSValue)));
+    return JSObject::offsetOfInlineStorage() / sizeof(EncodedJSValue) + offsetInInlineStorage(offset);
+}
+
+inline int offsetRelativeToBase(PropertyOffset offset)
+{
+    if (isOutOfLineOffset(offset))
+        return offsetInOutOfLineStorage(offset) * sizeof(EncodedJSValue) + Butterfly::offsetOfPropertyStorage();
+    return JSObject::offsetOfInlineStorage() + offsetInInlineStorage(offset) * sizeof(EncodedJSValue);
+}
+
+// Returns the maximum offset (away from zero) a load instruction will encode.
+inline size_t maxOffsetRelativeToBase(PropertyOffset offset)
+{
+    ptrdiff_t addressOffset = offsetRelativeToBase(offset);
+#if USE(JSVALUE32_64)
+    if (addressOffset >= 0)
+        return static_cast<size_t>(addressOffset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag);
+#endif
+    return static_cast<size_t>(addressOffset);
+}
+
+COMPILE_ASSERT(!(sizeof(JSObject) % sizeof(WriteBarrierBase<Unknown>)), JSObject_inline_storage_has_correct_alignment);
+
+template<unsigned charactersCount>
+ALWAYS_INLINE Identifier makeIdentifier(VM& vm, const char (&characters)[charactersCount])
+{
+    return Identifier::fromString(&vm, characters);
+}
+
+ALWAYS_INLINE Identifier makeIdentifier(VM& vm, const char* name)
+{
+    return Identifier::fromString(&vm, name);
+}
+
+ALWAYS_INLINE Identifier makeIdentifier(VM&, const Identifier& name)
+{
+    return name;
+}
+
+bool validateAndApplyPropertyDescriptor(ExecState*, JSObject*, PropertyName, bool isExtensible,
+    const PropertyDescriptor& descriptor, bool isCurrentDefined, const PropertyDescriptor& current, bool throwException);
+
+JS_EXPORT_PRIVATE NEVER_INLINE bool ordinarySetSlow(ExecState*, JSObject*, PropertyName, JSValue, JSValue receiver, bool shouldThrow);
+
+// Helper for defining native functions, if you're not using a static hash table.
+// Use this macro from within finishCreation() methods in prototypes. This assumes
+// you've defined variables called exec, globalObject, and vm, and they
+// have the expected meanings.
+#define JSC_NATIVE_INTRINSIC_FUNCTION(jsName, cppName, attributes, length, intrinsic) \
+    putDirectNativeFunction(\
+        vm, globalObject, makeIdentifier(vm, (jsName)), (length), cppName, \
+        (intrinsic), (attributes))
+
+#define JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(jsName, cppName, attributes, length, intrinsic) \
+    putDirectNativeFunctionWithoutTransition(\
+        vm, globalObject, makeIdentifier(vm, (jsName)), (length), cppName, \
+        (intrinsic), (attributes))
+
+// As above, but this assumes that the function you're defining doesn't have an
+// intrinsic.
+#define JSC_NATIVE_FUNCTION(jsName, cppName, attributes, length) \
+    JSC_NATIVE_INTRINSIC_FUNCTION(jsName, cppName, (attributes), (length), NoIntrinsic)
+
+#define JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(jsName, cppName, attributes, length) \
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(jsName, cppName, (attributes), (length), NoIntrinsic)
+
+// Identical helpers but for builtins. Note that currently, we don't support builtins that are
+// also intrinsics, but we probably will do that eventually.
+#define JSC_BUILTIN_FUNCTION(jsName, generatorName, attributes) \
+    putDirectBuiltinFunction(\
+        vm, globalObject, makeIdentifier(vm, (jsName)), (generatorName)(vm), (attributes))
+
+#define JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(jsName, generatorName, attributes) \
+    putDirectBuiltinFunctionWithoutTransition(\
+        vm, globalObject, makeIdentifier(vm, (jsName)), (generatorName)(vm), (attributes))
+
+// Helper for defining native getters on properties.
+#define JSC_NATIVE_INTRINSIC_GETTER(jsName, cppName, attributes, intrinsic)  \
+    putDirectNativeIntrinsicGetter(\
+        vm, globalObject, makeIdentifier(vm, (jsName)), (cppName), \
+        (intrinsic), ((attributes) | Accessor))
+
+#define JSC_NATIVE_GETTER(jsName, cppName, attributes) \
+    JSC_NATIVE_INTRINSIC_GETTER((jsName), (cppName), (attributes), NoIntrinsic)
+
+
+} // namespace JSC
diff --git a/runtime/JSObjectInlines.h b/runtime/JSObjectInlines.h
new file mode 100644
index 0000000..2cb9dde
--- /dev/null
+++ b/runtime/JSObjectInlines.h
@@ -0,0 +1,363 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Eric Seidel (eric@webkit.org)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "AuxiliaryBarrierInlines.h"
+#include "Error.h"
+#include "JSObject.h"
+#include "Lookup.h"
+
+namespace JSC {
+
+// Section 7.3.17 of the spec.
+template <typename AddFunction> // Add function should have a type like: (JSValue, RuntimeType) -> bool
+void createListFromArrayLike(ExecState* exec, JSValue arrayLikeValue, RuntimeTypeMask legalTypesFilter, const String& errorMessage, AddFunction addFunction)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    Vector<JSValue> result;
+    JSValue lengthProperty = arrayLikeValue.get(exec, vm.propertyNames->length);
+    RETURN_IF_EXCEPTION(scope, void());
+    double lengthAsDouble = lengthProperty.toLength(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+    RELEASE_ASSERT(lengthAsDouble >= 0.0 && lengthAsDouble == std::trunc(lengthAsDouble));
+    uint64_t length = static_cast<uint64_t>(lengthAsDouble);
+    for (uint64_t index = 0; index < length; index++) {
+        JSValue next = arrayLikeValue.get(exec, index);
+        RETURN_IF_EXCEPTION(scope, void());
+        
+        RuntimeType type = runtimeTypeForValue(next);
+        if (!(type & legalTypesFilter)) {
+            throwTypeError(exec, scope, errorMessage);
+            return;
+        }
+        
+        bool exitEarly = addFunction(next, type);
+        if (exitEarly)
+            return;
+    }
+}
+
+ALWAYS_INLINE bool JSObject::canPerformFastPutInline(ExecState* exec, VM& vm, PropertyName propertyName)
+{
+    if (UNLIKELY(propertyName == exec->propertyNames().underscoreProto))
+        return false;
+
+    // Check if there are any setters or getters in the prototype chain
+    JSValue prototype;
+    JSObject* obj = this;
+    while (true) {
+        if (obj->structure(vm)->hasReadOnlyOrGetterSetterPropertiesExcludingProto() || obj->type() == ProxyObjectType)
+            return false;
+
+        prototype = obj->getPrototypeDirect();
+        if (prototype.isNull())
+            return true;
+
+        obj = asObject(prototype);
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+template<typename CallbackWhenNoException>
+ALWAYS_INLINE typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type JSObject::getPropertySlot(ExecState* exec, PropertyName propertyName, CallbackWhenNoException callback) const
+{
+    PropertySlot slot(this, PropertySlot::InternalMethodType::Get);
+    return getPropertySlot(exec, propertyName, slot, callback);
+}
+
+template<typename CallbackWhenNoException>
+ALWAYS_INLINE typename std::result_of<CallbackWhenNoException(bool, PropertySlot&)>::type JSObject::getPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot, CallbackWhenNoException callback) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    bool found = const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot);
+    RETURN_IF_EXCEPTION(scope, { });
+    return callback(found, slot);
+}
+
+ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    auto& structureIDTable = vm.heap.structureIDTable();
+    JSObject* object = this;
+    MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
+    while (true) {
+        Structure* structure = structureIDTable.get(object->structureID());
+        if (structure->classInfo()->methodTable.getOwnPropertySlotByIndex(object, exec, propertyName, slot))
+            return true;
+        RETURN_IF_EXCEPTION(scope, false);
+        JSValue prototype;
+        if (LIKELY(structure->classInfo()->methodTable.getPrototype == defaultGetPrototype || slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry))
+            prototype = structure->storedPrototype();
+        else {
+            prototype = object->getPrototype(vm, exec);
+            RETURN_IF_EXCEPTION(scope, false);
+        }
+        if (!prototype.isObject())
+            return false;
+        object = asObject(prototype);
+    }
+}
+
+ALWAYS_INLINE bool JSObject::getNonIndexPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    // This method only supports non-index PropertyNames.
+    ASSERT(!parseIndex(propertyName));
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    auto& structureIDTable = vm.heap.structureIDTable();
+    JSObject* object = this;
+    MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
+    while (true) {
+        Structure* structure = structureIDTable.get(object->structureID());
+        if (LIKELY(!TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()))) {
+            if (object->getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
+                return true;
+        } else {
+            if (structure->classInfo()->methodTable.getOwnPropertySlot(object, exec, propertyName, slot))
+                return true;
+            RETURN_IF_EXCEPTION(scope, false);
+        }
+        JSValue prototype;
+        if (LIKELY(structure->classInfo()->methodTable.getPrototype == defaultGetPrototype || slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry))
+            prototype = structure->storedPrototype();
+        else {
+            prototype = object->getPrototype(vm, exec);
+            RETURN_IF_EXCEPTION(scope, false);
+        }
+        if (!prototype.isObject())
+            return false;
+        object = asObject(prototype);
+    }
+}
+
+inline void JSObject::putDirectWithoutTransition(VM& vm, PropertyName propertyName, JSValue value, unsigned attributes)
+{
+    ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
+    ASSERT(!value.isCustomGetterSetter());
+    StructureID structureID = this->structureID();
+    Structure* structure = vm.heap.structureIDTable().get(structureID);
+    PropertyOffset offset = prepareToPutDirectWithoutTransition(vm, propertyName, attributes, structureID, structure);
+    bool shouldOptimize = false;
+    structure->willStoreValueForNewTransition(vm, propertyName, value, shouldOptimize);
+    putDirect(vm, offset, value);
+    if (attributes & ReadOnly)
+        structure->setContainsReadOnlyProperties();
+}
+
+ALWAYS_INLINE PropertyOffset JSObject::prepareToPutDirectWithoutTransition(VM& vm, PropertyName propertyName, unsigned attributes, StructureID structureID, Structure* structure)
+{
+    unsigned oldOutOfLineCapacity = structure->outOfLineCapacity();
+    PropertyOffset result;
+    structure->addPropertyWithoutTransition(
+        vm, propertyName, attributes,
+        [&] (const GCSafeConcurrentJSLocker&, PropertyOffset offset, PropertyOffset newLastOffset) {
+            unsigned newOutOfLineCapacity = Structure::outOfLineCapacity(newLastOffset);
+            if (newOutOfLineCapacity != oldOutOfLineCapacity) {
+                Butterfly* butterfly = allocateMoreOutOfLineStorage(vm, oldOutOfLineCapacity, newOutOfLineCapacity);
+                nukeStructureAndSetButterfly(vm, structureID, butterfly);
+                structure->setLastOffset(newLastOffset);
+                WTF::storeStoreFence();
+                setStructureIDDirectly(structureID);
+            } else
+                structure->setLastOffset(newLastOffset);
+            result = offset;
+        });
+    return result;
+}
+
+// ECMA 8.6.2.2
+ALWAYS_INLINE bool JSObject::putInline(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* thisObject = jsCast<JSObject*>(cell);
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject)))
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+
+    // Try indexed put first. This is required for correctness, since loads on property names that appear like
+    // valid indices will never look in the named property storage.
+    if (std::optional<uint32_t> index = parseIndex(propertyName))
+        return putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode());
+
+    if (thisObject->canPerformFastPutInline(exec, vm, propertyName)) {
+        ASSERT(!thisObject->structure(vm)->prototypeChainMayInterceptStoreTo(vm, propertyName));
+        if (!thisObject->putDirectInternal<PutModePut>(vm, propertyName, value, 0, slot))
+            return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+        return true;
+    }
+
+    return thisObject->putInlineSlow(exec, propertyName, value, slot);
+}
+
+// HasOwnProperty(O, P) from section 7.3.11 in the spec.
+// http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasownproperty
+ALWAYS_INLINE bool JSObject::hasOwnProperty(ExecState* exec, PropertyName propertyName, PropertySlot& slot) const
+{
+    ASSERT(slot.internalMethodType() == PropertySlot::InternalMethodType::GetOwnProperty);
+    if (LIKELY(const_cast<JSObject*>(this)->methodTable(exec->vm())->getOwnPropertySlot == JSObject::getOwnPropertySlot))
+        return JSObject::getOwnPropertySlot(const_cast<JSObject*>(this), exec, propertyName, slot);
+    return const_cast<JSObject*>(this)->methodTable(exec->vm())->getOwnPropertySlot(const_cast<JSObject*>(this), exec, propertyName, slot);
+}
+
+ALWAYS_INLINE bool JSObject::hasOwnProperty(ExecState* exec, PropertyName propertyName) const
+{
+    PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
+    return hasOwnProperty(exec, propertyName, slot);
+}
+
+ALWAYS_INLINE bool JSObject::hasOwnProperty(ExecState* exec, unsigned propertyName) const
+{
+    PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
+    return const_cast<JSObject*>(this)->methodTable(exec->vm())->getOwnPropertySlotByIndex(const_cast<JSObject*>(this), exec, propertyName, slot);
+}
+
+template<JSObject::PutMode mode>
+ALWAYS_INLINE bool JSObject::putDirectInternal(VM& vm, PropertyName propertyName, JSValue value, unsigned attributes, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(value.isGetterSetter() == !!(attributes & Accessor));
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+    ASSERT(!parseIndex(propertyName));
+
+    StructureID structureID = this->structureID();
+    Structure* structure = vm.heap.structureIDTable().get(structureID);
+    if (structure->isDictionary()) {
+        ASSERT(!structure->hasInferredTypes());
+        
+        unsigned currentAttributes;
+        PropertyOffset offset = structure->get(vm, propertyName, currentAttributes);
+        if (offset != invalidOffset) {
+            if ((mode == PutModePut) && currentAttributes & ReadOnly)
+                return false;
+
+            putDirect(vm, offset, value);
+            structure->didReplaceProperty(offset);
+            slot.setExistingProperty(this, offset);
+
+            if ((attributes & Accessor) != (currentAttributes & Accessor) || (attributes & CustomAccessor) != (currentAttributes & CustomAccessor)) {
+                ASSERT(!(attributes & ReadOnly));
+                setStructure(vm, Structure::attributeChangeTransition(vm, structure, propertyName, attributes));
+            }
+            return true;
+        }
+
+        if ((mode == PutModePut) && !isStructureExtensible())
+            return false;
+
+        offset = prepareToPutDirectWithoutTransition(vm, propertyName, attributes, structureID, structure);
+        validateOffset(offset);
+        putDirect(vm, offset, value);
+        slot.setNewProperty(this, offset);
+        if (attributes & ReadOnly)
+            this->structure()->setContainsReadOnlyProperties();
+        return true;
+    }
+
+    PropertyOffset offset;
+    size_t currentCapacity = this->structure()->outOfLineCapacity();
+    Structure* newStructure = Structure::addPropertyTransitionToExistingStructure(
+        structure, propertyName, attributes, offset);
+    if (newStructure) {
+        newStructure->willStoreValueForExistingTransition(
+            vm, propertyName, value, slot.context() == PutPropertySlot::PutById);
+        
+        Butterfly* newButterfly = butterfly();
+        if (currentCapacity != newStructure->outOfLineCapacity()) {
+            ASSERT(newStructure != this->structure());
+            newButterfly = allocateMoreOutOfLineStorage(vm, currentCapacity, newStructure->outOfLineCapacity());
+            nukeStructureAndSetButterfly(vm, structureID, newButterfly);
+        }
+
+        validateOffset(offset);
+        ASSERT(newStructure->isValidOffset(offset));
+        putDirect(vm, offset, value);
+        setStructure(vm, newStructure);
+        slot.setNewProperty(this, offset);
+        return true;
+    }
+
+    unsigned currentAttributes;
+    bool hasInferredType;
+    offset = structure->get(vm, propertyName, currentAttributes, hasInferredType);
+    if (offset != invalidOffset) {
+        if ((mode == PutModePut) && currentAttributes & ReadOnly)
+            return false;
+
+        structure->didReplaceProperty(offset);
+        if (UNLIKELY(hasInferredType)) {
+            structure->willStoreValueForReplace(
+                vm, propertyName, value, slot.context() == PutPropertySlot::PutById);
+        }
+
+        slot.setExistingProperty(this, offset);
+        putDirect(vm, offset, value);
+
+        if ((attributes & Accessor) != (currentAttributes & Accessor) || (attributes & CustomAccessor) != (currentAttributes & CustomAccessor)) {
+            ASSERT(!(attributes & ReadOnly));
+            setStructure(vm, Structure::attributeChangeTransition(vm, structure, propertyName, attributes));
+        }
+        return true;
+    }
+
+    if ((mode == PutModePut) && !isStructureExtensible())
+        return false;
+
+    // We want the structure transition watchpoint to fire after this object has switched
+    // structure. This allows adaptive watchpoints to observe if the new structure is the one
+    // we want.
+    DeferredStructureTransitionWatchpointFire deferredWatchpointFire;
+    
+    newStructure = Structure::addNewPropertyTransition(
+        vm, structure, propertyName, attributes, offset, slot.context(), &deferredWatchpointFire);
+    newStructure->willStoreValueForNewTransition(
+        vm, propertyName, value, slot.context() == PutPropertySlot::PutById);
+    
+    validateOffset(offset);
+    ASSERT(newStructure->isValidOffset(offset));
+    size_t oldCapacity = structure->outOfLineCapacity();
+    size_t newCapacity = newStructure->outOfLineCapacity();
+    ASSERT(oldCapacity <= newCapacity);
+    if (oldCapacity != newCapacity) {
+        Butterfly* newButterfly = allocateMoreOutOfLineStorage(vm, oldCapacity, newCapacity);
+        nukeStructureAndSetButterfly(vm, structureID, newButterfly);
+    }
+    putDirect(vm, offset, value);
+    setStructure(vm, newStructure);
+    slot.setNewProperty(this, offset);
+    if (attributes & ReadOnly)
+        newStructure->setContainsReadOnlyProperties();
+    return true;
+}
+
+} // namespace JSC
diff --git a/runtime/JSPromise.cpp b/runtime/JSPromise.cpp
new file mode 100644
index 0000000..958d45b
--- /dev/null
+++ b/runtime/JSPromise.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSPromise.h"
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSPromiseConstructor.h"
+#include "Microtask.h"
+
+namespace JSC {
+
+const ClassInfo JSPromise::s_info = { "Promise", &Base::s_info, 0, CREATE_METHOD_TABLE(JSPromise) };
+
+JSPromise* JSPromise::create(VM& vm, Structure* structure)
+{
+    JSPromise* promise = new (NotNull, allocateCell<JSPromise>(vm.heap)) JSPromise(vm, structure);
+    promise->finishCreation(vm);
+    return promise;
+}
+
+Structure* JSPromise::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSPromise::JSPromise(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void JSPromise::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    putDirect(vm, vm.propertyNames->builtinNames().promiseStatePrivateName(), jsNumber(static_cast<unsigned>(Status::Pending)));
+    putDirect(vm, vm.propertyNames->builtinNames().promiseReactionsPrivateName(), jsUndefined());
+    putDirect(vm, vm.propertyNames->builtinNames().promiseResultPrivateName(), jsUndefined());
+}
+
+void JSPromise::initialize(ExecState* exec, JSGlobalObject* globalObject, JSValue executor)
+{
+    JSFunction* initializePromise = globalObject->initializePromiseFunction();
+    CallData callData;
+    CallType callType = JSC::getCallData(initializePromise, callData);
+    ASSERT(callType != CallType::None);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(executor);
+    call(exec, initializePromise, callType, callData, this, arguments);
+}
+
+auto JSPromise::status(VM& vm) const -> Status
+{
+    JSValue value = getDirect(vm, vm.propertyNames->builtinNames().promiseStatePrivateName());
+    ASSERT(value.isUInt32());
+    return static_cast<Status>(value.asUInt32());
+}
+
+JSValue JSPromise::result(VM& vm) const
+{
+    return getDirect(vm, vm.propertyNames->builtinNames().promiseResultPrivateName());
+}
+
+} // namespace JSC
diff --git a/runtime/JSPromise.h b/runtime/JSPromise.h
new file mode 100644
index 0000000..639f650
--- /dev/null
+++ b/runtime/JSPromise.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSPromise : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static JSPromise* create(VM&, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_EXPORT_INFO;
+
+    enum class Status : unsigned {
+        Pending = 1,
+        Fulfilled,
+        Rejected
+    };
+
+    Status status(VM&) const;
+    JSValue result(VM&) const;
+
+    // Initialize the promise with the executor.
+    // This may raise a JS exception.
+    void initialize(ExecState*, JSGlobalObject*, JSValue executor);
+
+protected:
+    JSPromise(VM&, Structure*);
+    void finishCreation(VM&);
+};
+
+} // namespace JSC
diff --git a/runtime/JSPromiseConstructor.cpp b/runtime/JSPromiseConstructor.cpp
new file mode 100644
index 0000000..a97d99d
--- /dev/null
+++ b/runtime/JSPromiseConstructor.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSPromiseConstructor.h"
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "Exception.h"
+#include "GetterSetter.h"
+#include "IteratorOperations.h"
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSPromise.h"
+#include "JSPromisePrototype.h"
+#include "Lookup.h"
+#include "NumberObject.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSPromiseConstructor);
+
+}
+
+#include "JSPromiseConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo JSPromiseConstructor::s_info = { "Function", &Base::s_info, &promiseConstructorTable, CREATE_METHOD_TABLE(JSPromiseConstructor) };
+
+/* Source for JSPromiseConstructor.lut.h
+@begin promiseConstructorTable
+  resolve         JSBuiltin             DontEnum|Function 1
+  reject          JSBuiltin             DontEnum|Function 1
+  race            JSBuiltin             DontEnum|Function 1
+  all             JSBuiltin             DontEnum|Function 1
+@end
+*/
+
+JSPromiseConstructor* JSPromiseConstructor::create(VM& vm, Structure* structure, JSPromisePrototype* promisePrototype, GetterSetter* speciesSymbol)
+{
+    JSPromiseConstructor* constructor = new (NotNull, allocateCell<JSPromiseConstructor>(vm.heap)) JSPromiseConstructor(vm, structure);
+    constructor->finishCreation(vm, promisePrototype, speciesSymbol);
+    constructor->addOwnInternalSlots(vm, structure->globalObject());
+    return constructor;
+}
+
+Structure* JSPromiseConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSPromiseConstructor::JSPromiseConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void JSPromiseConstructor::finishCreation(VM& vm, JSPromisePrototype* promisePrototype, GetterSetter* speciesSymbol)
+{
+    Base::finishCreation(vm, ASCIILiteral("Promise"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, promisePrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), DontEnum | ReadOnly);
+    putDirectNonIndexAccessor(vm, vm.propertyNames->speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);
+}
+
+void JSPromiseConstructor::addOwnInternalSlots(VM& vm, JSGlobalObject* globalObject)
+{
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().resolvePrivateName(), promiseConstructorResolveCodeGenerator, DontEnum | DontDelete | ReadOnly);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().rejectPrivateName(), promiseConstructorRejectCodeGenerator, DontEnum | DontDelete | ReadOnly);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructPromise(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSGlobalObject* globalObject = exec->jsCallee()->globalObject();
+
+    JSValue newTarget = exec->newTarget();
+    if (newTarget.isUndefined())
+        return throwVMTypeError(exec, scope);
+
+    Structure* promiseStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->promiseStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSPromise* promise = JSPromise::create(vm, promiseStructure);
+    promise->initialize(exec, globalObject, exec->argument(0));
+
+    return JSValue::encode(promise);
+}
+
+static EncodedJSValue JSC_HOST_CALL callPromise(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "Promise"));
+}
+
+ConstructType JSPromiseConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructPromise;
+    return ConstructType::Host;
+}
+
+CallType JSPromiseConstructor::getCallData(JSCell*, CallData& callData)
+{
+    // FIXME: This is workaround. Since JSC does not expose @isConstructor to JS builtins,
+    // we use typeof function === "function" now. And since typeof constructorWithoutCallability
+    // returns "object", we need to define [[Call]] for now.
+    // https://bugs.webkit.org/show_bug.cgi?id=144093
+    callData.native.function = callPromise;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/JSPromiseConstructor.h b/runtime/JSPromiseConstructor.h
new file mode 100644
index 0000000..0beca04
--- /dev/null
+++ b/runtime/JSPromiseConstructor.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class JSPromise;
+class JSPromisePrototype;
+class GetterSetter;
+
+class JSPromiseConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static JSPromiseConstructor* create(VM&, Structure*, JSPromisePrototype*, GetterSetter* speciesSymbol);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    JSPromiseConstructor(VM&, Structure*);
+    void finishCreation(VM&, JSPromisePrototype*, GetterSetter*);
+
+private:
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+
+    void addOwnInternalSlots(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSPromiseDeferred.cpp b/runtime/JSPromiseDeferred.cpp
new file mode 100644
index 0000000..d456917
--- /dev/null
+++ b/runtime/JSPromiseDeferred.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSPromiseDeferred.h"
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "Exception.h"
+#include "JSCInlines.h"
+#include "JSObjectInlines.h"
+#include "JSPromise.h"
+#include "JSPromiseConstructor.h"
+
+namespace JSC {
+
+const ClassInfo JSPromiseDeferred::s_info = { "JSPromiseDeferred", 0, 0, CREATE_METHOD_TABLE(JSPromiseDeferred) };
+
+JSValue newPromiseCapability(ExecState* exec, JSGlobalObject* globalObject, JSPromiseConstructor* promiseConstructor)
+{
+    JSFunction* newPromiseCapabilityFunction = globalObject->newPromiseCapabilityFunction();
+    CallData callData;
+    CallType callType = JSC::getCallData(newPromiseCapabilityFunction, callData);
+    ASSERT(callType != CallType::None);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(promiseConstructor);
+    return call(exec, newPromiseCapabilityFunction, callType, callData, jsUndefined(), arguments);
+}
+
+
+JSPromiseDeferred* JSPromiseDeferred::create(ExecState* exec, JSGlobalObject* globalObject)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue deferred = newPromiseCapability(exec, globalObject, globalObject->promiseConstructor());
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    JSValue promise = deferred.get(exec, vm.propertyNames->builtinNames().promisePrivateName());
+    ASSERT(promise.inherits(JSPromise::info()));
+    JSValue resolve = deferred.get(exec, vm.propertyNames->builtinNames().resolvePrivateName());
+    JSValue reject = deferred.get(exec, vm.propertyNames->builtinNames().rejectPrivateName());
+
+    return JSPromiseDeferred::create(vm, jsCast<JSPromise*>(promise), resolve, reject);
+}
+
+JSPromiseDeferred* JSPromiseDeferred::create(VM& vm, JSObject* promise, JSValue resolve, JSValue reject)
+{
+    JSPromiseDeferred* deferred = new (NotNull, allocateCell<JSPromiseDeferred>(vm.heap)) JSPromiseDeferred(vm);
+    deferred->finishCreation(vm, promise, resolve, reject);
+    return deferred;
+}
+
+JSPromiseDeferred::JSPromiseDeferred(VM& vm)
+    : JSPromiseDeferred(vm, vm.promiseDeferredStructure.get())
+{
+}
+
+JSPromiseDeferred::JSPromiseDeferred(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+static inline void callFunction(ExecState* exec, JSValue function, JSValue value)
+{
+    CallData callData;
+    CallType callType = getCallData(function, callData);
+    ASSERT(callType != CallType::None);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(value);
+
+    call(exec, function, callType, callData, jsUndefined(), arguments);
+}
+
+void JSPromiseDeferred::resolve(ExecState* exec, JSValue value)
+{
+    callFunction(exec, m_resolve.get(), value);
+}
+
+void JSPromiseDeferred::reject(ExecState* exec, JSValue reason)
+{
+    callFunction(exec, m_reject.get(), reason);
+}
+
+void JSPromiseDeferred::finishCreation(VM& vm, JSObject* promise, JSValue resolve, JSValue reject)
+{
+    Base::finishCreation(vm);
+    m_promise.set(vm, this, promise);
+    m_resolve.set(vm, this, resolve);
+    m_reject.set(vm, this, reject);
+}
+
+void JSPromiseDeferred::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSPromiseDeferred* thisObject = jsCast<JSPromiseDeferred*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_promise);
+    visitor.append(thisObject->m_resolve);
+    visitor.append(thisObject->m_reject);
+}
+
+} // namespace JSC
diff --git a/runtime/JSPromiseDeferred.h b/runtime/JSPromiseDeferred.h
new file mode 100644
index 0000000..cf7693a
--- /dev/null
+++ b/runtime/JSPromiseDeferred.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "Structure.h"
+
+namespace JSC {
+
+class JSPromiseConstructor;
+
+class JSPromiseDeferred : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    JS_EXPORT_PRIVATE static JSPromiseDeferred* create(ExecState*, JSGlobalObject*);
+    JS_EXPORT_PRIVATE static JSPromiseDeferred* create(VM&, JSObject* promise, JSValue resolve, JSValue reject);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    JSObject* promise() const { return m_promise.get(); }
+    JSValue resolve() const { return m_resolve.get(); }
+    JSValue reject() const { return m_reject.get(); }
+
+    JS_EXPORT_PRIVATE void resolve(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE void reject(ExecState*, JSValue);
+
+protected:
+    JSPromiseDeferred(VM&, Structure*);
+    void finishCreation(VM&, JSObject*, JSValue, JSValue);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    JSPromiseDeferred(VM&);
+
+    WriteBarrier<JSObject> m_promise;
+    WriteBarrier<Unknown> m_resolve;
+    WriteBarrier<Unknown> m_reject;
+};
+
+JSValue newPromiseCapability(ExecState*, JSGlobalObject*, JSPromiseConstructor*);
+
+} // namespace JSC
diff --git a/runtime/JSPromisePrototype.cpp b/runtime/JSPromisePrototype.cpp
new file mode 100644
index 0000000..d66dde9
--- /dev/null
+++ b/runtime/JSPromisePrototype.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSPromisePrototype.h"
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSPromise.h"
+#include "Microtask.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSPromisePrototype);
+
+}
+
+#include "JSPromisePrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo JSPromisePrototype::s_info = { "PromisePrototype", &Base::s_info, &promisePrototypeTable, CREATE_METHOD_TABLE(JSPromisePrototype) };
+
+/* Source for JSPromisePrototype.lut.h
+@begin promisePrototypeTable
+  then         JSBuiltin            DontEnum|Function 2
+  catch        JSBuiltin            DontEnum|Function 1
+@end
+*/
+
+JSPromisePrototype* JSPromisePrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    JSPromisePrototype* object = new (NotNull, allocateCell<JSPromisePrototype>(vm.heap)) JSPromisePrototype(vm, structure);
+    object->finishCreation(vm, structure);
+    object->addOwnInternalSlots(vm, structure->globalObject());
+    return object;
+}
+
+Structure* JSPromisePrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSPromisePrototype::JSPromisePrototype(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void JSPromisePrototype::finishCreation(VM& vm, Structure*)
+{
+    Base::finishCreation(vm);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Promise"), DontEnum | ReadOnly);
+}
+
+void JSPromisePrototype::addOwnInternalSlots(VM& vm, JSGlobalObject* globalObject)
+{
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().thenPrivateName(), promisePrototypeThenCodeGenerator, DontEnum | DontDelete | ReadOnly);
+}
+
+} // namespace JSC
diff --git a/runtime/JSPromisePrototype.h b/runtime/JSPromisePrototype.h
new file mode 100644
index 0000000..9b9fda8
--- /dev/null
+++ b/runtime/JSPromisePrototype.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSPromisePrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static JSPromisePrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, Structure*);
+    JSPromisePrototype(VM&, Structure*);
+
+private:
+    void addOwnInternalSlots(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSPropertyNameEnumerator.cpp b/runtime/JSPropertyNameEnumerator.cpp
new file mode 100644
index 0000000..a11afa8
--- /dev/null
+++ b/runtime/JSPropertyNameEnumerator.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSPropertyNameEnumerator.h"
+
+#include "JSCInlines.h"
+#include "LockDuringMarking.h"
+#include "StrongInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSPropertyNameEnumerator::s_info = { "JSPropertyNameEnumerator", 0, 0, CREATE_METHOD_TABLE(JSPropertyNameEnumerator) };
+
+JSPropertyNameEnumerator* JSPropertyNameEnumerator::create(VM& vm)
+{
+    if (!vm.emptyPropertyNameEnumerator.get()) {
+        PropertyNameArray propertyNames(&vm, PropertyNameMode::Strings);
+        vm.emptyPropertyNameEnumerator = Strong<JSCell>(vm, create(vm, 0, 0, 0, propertyNames));
+    }
+    return jsCast<JSPropertyNameEnumerator*>(vm.emptyPropertyNameEnumerator.get());
+}
+
+JSPropertyNameEnumerator* JSPropertyNameEnumerator::create(VM& vm, Structure* structure, uint32_t indexedLength, uint32_t numberStructureProperties, PropertyNameArray& propertyNames)
+{
+    StructureID structureID = structure ? structure->id() : 0;
+    uint32_t inlineCapacity = structure ? structure->inlineCapacity() : 0;
+    JSPropertyNameEnumerator* enumerator = new (NotNull, 
+        allocateCell<JSPropertyNameEnumerator>(vm.heap)) JSPropertyNameEnumerator(vm, structureID, inlineCapacity);
+    enumerator->finishCreation(vm, indexedLength, numberStructureProperties, propertyNames.data());
+    return enumerator;
+}
+
+JSPropertyNameEnumerator::JSPropertyNameEnumerator(VM& vm, StructureID structureID, uint32_t inlineCapacity)
+    : JSCell(vm, vm.propertyNameEnumeratorStructure.get())
+    , m_cachedStructureID(structureID)
+    , m_cachedInlineCapacity(inlineCapacity)
+{
+}
+
+void JSPropertyNameEnumerator::finishCreation(VM& vm, uint32_t indexedLength, uint32_t endStructurePropertyIndex, PassRefPtr<PropertyNameArrayData> idents)
+{
+    Base::finishCreation(vm);
+
+    RefPtr<PropertyNameArrayData> identifiers = idents;
+    PropertyNameArrayData::PropertyNameVector& vector = identifiers->propertyNameVector();
+
+    m_indexedLength = indexedLength;
+    m_endStructurePropertyIndex = endStructurePropertyIndex;
+    m_endGenericPropertyIndex = vector.size();
+
+    {
+        auto locker = lockDuringMarking(vm.heap, *this);
+        m_propertyNames.resizeToFit(vector.size());
+    }
+    for (unsigned i = 0; i < vector.size(); ++i) {
+        const Identifier& identifier = vector[i];
+        m_propertyNames[i].set(vm, this, jsString(&vm, identifier.string()));
+    }
+}
+
+void JSPropertyNameEnumerator::destroy(JSCell* cell)
+{
+    static_cast<JSPropertyNameEnumerator*>(cell)->JSPropertyNameEnumerator::~JSPropertyNameEnumerator();
+}
+
+void JSPropertyNameEnumerator::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    Base::visitChildren(cell, visitor);
+    JSPropertyNameEnumerator* thisObject = jsCast<JSPropertyNameEnumerator*>(cell);
+    auto locker = holdLock(*thisObject);
+    for (unsigned i = 0; i < thisObject->m_propertyNames.size(); ++i)
+        visitor.append(thisObject->m_propertyNames[i]);
+    visitor.append(thisObject->m_prototypeChain);
+}
+
+} // namespace JSC
diff --git a/runtime/JSPropertyNameEnumerator.h b/runtime/JSPropertyNameEnumerator.h
new file mode 100644
index 0000000..3356143
--- /dev/null
+++ b/runtime/JSPropertyNameEnumerator.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "Operations.h"
+#include "PropertyNameArray.h"
+#include "Structure.h"
+
+namespace JSC {
+
+class JSPropertyNameEnumerator final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static JSPropertyNameEnumerator* create(VM&);
+    static JSPropertyNameEnumerator* create(VM&, Structure*, uint32_t, uint32_t, PropertyNameArray&);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    JSString* propertyNameAtIndex(uint32_t index) const
+    {
+        if (index >= m_propertyNames.size())
+            return nullptr;
+        return m_propertyNames[index].get();
+    }
+
+    StructureChain* cachedPrototypeChain() const { return m_prototypeChain.get(); }
+    void setCachedPrototypeChain(VM& vm, StructureChain* prototypeChain) { return m_prototypeChain.set(vm, this, prototypeChain); }
+
+    Structure* cachedStructure(VM& vm) const
+    {
+        if (!m_cachedStructureID)
+            return nullptr;
+        return vm.heap.structureIDTable().get(m_cachedStructureID);
+    }
+    StructureID cachedStructureID() const { return m_cachedStructureID; }
+    uint32_t indexedLength() const { return m_indexedLength; }
+    uint32_t endStructurePropertyIndex() const { return m_endStructurePropertyIndex; }
+    uint32_t endGenericPropertyIndex() const { return m_endGenericPropertyIndex; }
+    uint32_t cachedInlineCapacity() const { return m_cachedInlineCapacity; }
+    static ptrdiff_t cachedStructureIDOffset() { return OBJECT_OFFSETOF(JSPropertyNameEnumerator, m_cachedStructureID); }
+    static ptrdiff_t indexedLengthOffset() { return OBJECT_OFFSETOF(JSPropertyNameEnumerator, m_indexedLength); }
+    static ptrdiff_t endStructurePropertyIndexOffset() { return OBJECT_OFFSETOF(JSPropertyNameEnumerator, m_endStructurePropertyIndex); }
+    static ptrdiff_t endGenericPropertyIndexOffset() { return OBJECT_OFFSETOF(JSPropertyNameEnumerator, m_endGenericPropertyIndex); }
+    static ptrdiff_t cachedInlineCapacityOffset() { return OBJECT_OFFSETOF(JSPropertyNameEnumerator, m_cachedInlineCapacity); }
+    static ptrdiff_t cachedPropertyNamesVectorOffset()
+    {
+        return OBJECT_OFFSETOF(JSPropertyNameEnumerator, m_propertyNames) + Vector<WriteBarrier<JSString>>::dataMemoryOffset();
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    JSPropertyNameEnumerator(VM&, StructureID, uint32_t);
+    void finishCreation(VM&, uint32_t, uint32_t, PassRefPtr<PropertyNameArrayData>);
+
+    Vector<WriteBarrier<JSString>> m_propertyNames;
+    StructureID m_cachedStructureID;
+    WriteBarrier<StructureChain> m_prototypeChain;
+    uint32_t m_indexedLength;
+    uint32_t m_endStructurePropertyIndex;
+    uint32_t m_endGenericPropertyIndex;
+    uint32_t m_cachedInlineCapacity;
+};
+
+inline JSPropertyNameEnumerator* propertyNameEnumerator(ExecState* exec, JSObject* base)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    uint32_t indexedLength = base->methodTable(vm)->getEnumerableLength(exec, base);
+
+    JSPropertyNameEnumerator* enumerator = nullptr;
+
+    Structure* structure = base->structure(vm);
+    if (!indexedLength
+        && (enumerator = structure->cachedPropertyNameEnumerator())
+        && enumerator->cachedPrototypeChain() == structure->prototypeChain(exec))
+        return enumerator;
+
+    uint32_t numberStructureProperties = 0;
+
+    PropertyNameArray propertyNames(exec, PropertyNameMode::Strings);
+
+    if (structure->canAccessPropertiesQuicklyForEnumeration() && indexedLength == base->getArrayLength()) {
+        base->methodTable(vm)->getStructurePropertyNames(base, exec, propertyNames, EnumerationMode());
+        ASSERT(!scope.exception());
+
+        numberStructureProperties = propertyNames.size();
+
+        base->methodTable(vm)->getGenericPropertyNames(base, exec, propertyNames, EnumerationMode());
+        ASSERT(!scope.exception());
+    } else {
+        // Generic property names vector contains all indexed property names.
+        // So disable indexed property enumeration phase by setting |indexedLength| to 0.
+        indexedLength = 0;
+        base->methodTable(vm)->getPropertyNames(base, exec, propertyNames, EnumerationMode());
+        RETURN_IF_EXCEPTION(scope, nullptr);
+    }
+
+    ASSERT(propertyNames.size() < UINT32_MAX);
+
+    normalizePrototypeChain(exec, structure);
+
+    enumerator = JSPropertyNameEnumerator::create(vm, structure, indexedLength, numberStructureProperties, propertyNames);
+    enumerator->setCachedPrototypeChain(vm, structure->prototypeChain(exec));
+    if (!indexedLength && structure->canCachePropertyNameEnumerator())
+        structure->setCachedPropertyNameEnumerator(vm, enumerator);
+    return enumerator;
+}
+
+} // namespace JSC
diff --git a/runtime/JSPropertyNameIterator.cpp b/runtime/JSPropertyNameIterator.cpp
new file mode 100644
index 0000000..d637884
--- /dev/null
+++ b/runtime/JSPropertyNameIterator.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2015-2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSPropertyNameIterator.h"
+
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSPropertyNameEnumerator.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL propertyNameIteratorFuncNext(ExecState*);
+
+const ClassInfo JSPropertyNameIterator::s_info = { "PropertyName Iterator", &Base::s_info, 0, CREATE_METHOD_TABLE(JSPropertyNameIterator) };
+
+JSPropertyNameIterator::JSPropertyNameIterator(VM& vm, Structure* structure, JSObject* object, JSPropertyNameEnumerator* enumerator)
+    : Base(vm, structure)
+    , m_iteratedObject(vm, this, object)
+    , m_propertyNameEnumerator(vm, this, enumerator)
+    , m_enumerationPhase(EnumerationPhase::IndexedNames)
+    , m_cursor(0)
+{
+}
+
+JSPropertyNameIterator* JSPropertyNameIterator::clone(ExecState* exec)
+{
+    auto iterator = JSPropertyNameIterator::create(exec, exec->jsCallee()->globalObject()->propertyNameIteratorStructure(), m_iteratedObject.get(), m_propertyNameEnumerator.get());
+    iterator->m_enumerationPhase = m_enumerationPhase;
+    iterator->m_cursor = m_cursor;
+    return iterator;
+}
+
+JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, Structure* structure, JSObject* iteratedObject)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSPropertyNameEnumerator* enumerator = propertyNameEnumerator(exec, iteratedObject);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    return JSPropertyNameIterator::create(exec, structure, iteratedObject, enumerator);
+}
+
+JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, Structure* structure, JSObject* iteratedObject, JSPropertyNameEnumerator* enumerator)
+{
+    VM& vm = exec->vm();
+    JSPropertyNameIterator* instance = new (NotNull, allocateCell<JSPropertyNameIterator>(vm.heap)) JSPropertyNameIterator(vm, structure, iteratedObject, enumerator);
+    instance->finishCreation(vm, structure->globalObject());
+    return instance;
+}
+
+void JSPropertyNameIterator::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    JSC_NATIVE_FUNCTION(vm.propertyNames->next, propertyNameIteratorFuncNext, DontEnum, 0);
+}
+
+void JSPropertyNameIterator::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSPropertyNameIterator* thisObject = jsCast<JSPropertyNameIterator*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_iteratedObject);
+    visitor.append(thisObject->m_propertyNameEnumerator);
+}
+
+bool JSPropertyNameIterator::next(ExecState* exec, JSValue& output)
+{
+    if (m_enumerationPhase == EnumerationPhase::IndexedNames) {
+        for (; m_cursor < m_propertyNameEnumerator->indexedLength();) {
+            uint32_t index = m_cursor++;
+            if (m_iteratedObject->hasProperty(exec, index)) {
+                output = jsString(exec, Identifier::from(exec, index).string());
+                return true;
+            }
+        }
+        m_cursor = 0;
+        m_enumerationPhase = EnumerationPhase::StructureNames;
+    }
+
+    if (m_enumerationPhase == EnumerationPhase::StructureNames) {
+        for (; m_cursor < m_propertyNameEnumerator->endStructurePropertyIndex();) {
+            uint32_t index = m_cursor++;
+            JSString* propertyName = m_propertyNameEnumerator->propertyNameAtIndex(index);
+            ASSERT(propertyName);
+            if (m_iteratedObject->structure(exec->vm())->id() == m_propertyNameEnumerator->cachedStructureID()) {
+                output = propertyName;
+                return true;
+            }
+
+            if (m_iteratedObject->hasProperty(exec, propertyName->toIdentifier(exec))) {
+                output = propertyName;
+                return true;
+            }
+        }
+        ASSERT(m_cursor >= m_propertyNameEnumerator->endStructurePropertyIndex());
+        // Use the same m_cursor in the GenericNames phase.
+        m_enumerationPhase = EnumerationPhase::GenericNames;
+    }
+
+    if (m_enumerationPhase == EnumerationPhase::GenericNames) {
+        for (; m_cursor < m_propertyNameEnumerator->endGenericPropertyIndex();) {
+            uint32_t index = m_cursor++;
+            JSString* propertyName = m_propertyNameEnumerator->propertyNameAtIndex(index);
+            ASSERT(propertyName);
+            if (m_iteratedObject->hasProperty(exec, propertyName->toIdentifier(exec))) {
+                output = propertyName;
+                return true;
+            }
+        }
+        m_enumerationPhase = EnumerationPhase::Done;
+    }
+
+    return false;
+}
+
+// ------------------------------ PropertyNameIterator Functions ----------------------------
+
+EncodedJSValue JSC_HOST_CALL propertyNameIteratorFuncNext(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSPropertyNameIterator* iterator = jsDynamicCast<JSPropertyNameIterator*>(exec->thisValue());
+    if (!iterator)
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Cannot call PropertyNameIterator.next() on a non-PropertyNameIterator object")));
+
+    JSValue result;
+    if (iterator->next(exec, result))
+        return JSValue::encode(createIteratorResultObject(exec, result, false));
+    return JSValue::encode(createIteratorResultObject(exec, jsUndefined(), true));
+}
+
+} // namespace JSC
diff --git a/runtime/JSPropertyNameIterator.h b/runtime/JSPropertyNameIterator.h
new file mode 100644
index 0000000..b558ff0
--- /dev/null
+++ b/runtime/JSPropertyNameIterator.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2015 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "JSPropertyNameEnumerator.h"
+
+namespace JSC {
+
+class JSPropertyNameIterator : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    enum class EnumerationPhase : uint32_t {
+        IndexedNames,
+        StructureNames,
+        GenericNames,
+        Done
+    };
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static JSPropertyNameIterator* create(ExecState*, Structure*, JSObject*);
+
+    JSPropertyNameIterator* clone(ExecState*);
+    bool next(ExecState*, JSValue&);
+
+    JSValue iteratedValue() const { return m_iteratedObject.get(); }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    JSPropertyNameIterator(VM&, Structure*, JSObject*, JSPropertyNameEnumerator*);
+
+    void finishCreation(VM&, JSGlobalObject*);
+
+    static JSPropertyNameIterator* create(ExecState*, Structure*, JSObject*, JSPropertyNameEnumerator*);
+
+    WriteBarrier<JSObject> m_iteratedObject;
+    WriteBarrier<JSPropertyNameEnumerator> m_propertyNameEnumerator;
+    EnumerationPhase m_enumerationPhase;
+    uint32_t m_cursor;
+};
+
+} // namespace JSC
diff --git a/runtime/JSProxy.cpp b/runtime/JSProxy.cpp
new file mode 100644
index 0000000..39fea10
--- /dev/null
+++ b/runtime/JSProxy.cpp
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2011-2012, 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSProxy.h"
+
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+#include "PrototypeMapInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSProxy);
+
+const ClassInfo JSProxy::s_info = { "JSProxy", &Base::s_info, 0, CREATE_METHOD_TABLE(JSProxy) };
+
+void JSProxy::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_target);
+}
+
+void JSProxy::setTarget(VM& vm, JSGlobalObject* globalObject)
+{
+    ASSERT_ARG(globalObject, globalObject);
+    JSGlobalObject* previousGlobalObject = jsCast<JSGlobalObject*>(m_target.get());
+
+    m_target.set(vm, this, globalObject);
+    setPrototypeDirect(vm, globalObject->getPrototypeDirect());
+
+    PrototypeMap& prototypeMap = vm.prototypeMap;
+    if (!prototypeMap.isPrototype(this))
+        return;
+
+    // previousGlobalObject cannot be null because in order for this JSProxy to be used as a prototype
+    // of an object, we must have previously called setTarget() and associated it with a JSGlobalObject.
+    RELEASE_ASSERT(previousGlobalObject);
+
+    // This is slow but constant time. We think it's very rare for a proxy
+    // to be a prototype, and reasonably rare to retarget a proxy,
+    // so slow constant time is OK.
+    for (size_t i = 0; i <= JSFinalObject::maxInlineCapacity(); ++i)
+        prototypeMap.clearEmptyObjectStructureForPrototype(previousGlobalObject, this, i);
+}
+
+String JSProxy::className(const JSObject* object)
+{
+    const JSProxy* thisObject = jsCast<const JSProxy*>(object);
+    return thisObject->target()->methodTable()->className(thisObject->target());
+}
+
+bool JSProxy::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    return thisObject->target()->methodTable(exec->vm())->getOwnPropertySlot(thisObject->target(), exec, propertyName, slot);
+}
+
+bool JSProxy::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    return thisObject->target()->methodTable(exec->vm())->getOwnPropertySlotByIndex(thisObject->target(), exec, propertyName, slot);
+}
+
+bool JSProxy::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(cell);
+    return thisObject->target()->methodTable(exec->vm())->put(thisObject->target(), exec, propertyName, value, slot);
+}
+
+bool JSProxy::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(cell);
+    return thisObject->target()->methodTable(exec->vm())->putByIndex(thisObject->target(), exec, propertyName, value, shouldThrow);
+}
+
+bool JSProxy::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    return thisObject->target()->methodTable(exec->vm())->defineOwnProperty(thisObject->target(), exec, propertyName, descriptor, shouldThrow);
+}
+
+bool JSProxy::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(cell);
+    return thisObject->target()->methodTable(exec->vm())->deleteProperty(thisObject->target(), exec, propertyName);
+}
+
+bool JSProxy::preventExtensions(JSObject* object, ExecState* exec)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    return thisObject->target()->methodTable(exec->vm())->preventExtensions(thisObject->target(), exec);
+}
+
+bool JSProxy::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned propertyName)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(cell);
+    return thisObject->target()->methodTable(exec->vm())->deletePropertyByIndex(thisObject->target(), exec, propertyName);
+}
+
+void JSProxy::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    thisObject->target()->methodTable(exec->vm())->getPropertyNames(thisObject->target(), exec, propertyNames, mode);
+}
+
+uint32_t JSProxy::getEnumerableLength(ExecState* exec, JSObject* object)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    return thisObject->target()->methodTable(exec->vm())->getEnumerableLength(exec, thisObject->target());
+}
+
+void JSProxy::getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    // Skip the structure loop, since it is invalid for proxies.
+}
+
+void JSProxy::getGenericPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    // Get *all* of the property names, not just the generic ones, since we skipped the structure
+    // ones above.
+    thisObject->target()->methodTable(exec->vm())->getPropertyNames(thisObject->target(), exec, propertyNames, mode);
+}
+
+void JSProxy::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    thisObject->target()->methodTable(exec->vm())->getOwnPropertyNames(thisObject->target(), exec, propertyNames, mode);
+}
+
+bool JSProxy::setPrototype(JSObject*, ExecState* exec, JSValue, bool shouldThrowIfCantSet)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+
+    return typeError(exec, scope, shouldThrowIfCantSet, ASCIILiteral("Cannot set prototype of this object"));
+}
+
+JSValue JSProxy::getPrototype(JSObject* object, ExecState* exec)
+{
+    JSProxy* thisObject = jsCast<JSProxy*>(object);
+    return thisObject->target()->methodTable(exec->vm())->getPrototype(thisObject->target(), exec);
+}
+
+} // namespace JSC
diff --git a/runtime/JSProxy.h b/runtime/JSProxy.h
new file mode 100644
index 0000000..b79a7b2
--- /dev/null
+++ b/runtime/JSProxy.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSDestructibleObject.h"
+
+namespace JSC {
+
+class JSProxy : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;
+
+    static JSProxy* create(VM& vm, Structure* structure, JSObject* target)
+    {
+        JSProxy* proxy = new (NotNull, allocateCell<JSProxy>(vm.heap)) JSProxy(vm, structure);
+        proxy->finishCreation(vm, target);
+        return proxy;
+    }
+
+    static JSProxy* create(VM& vm, Structure* structure)
+    {
+        JSProxy* proxy = new (NotNull, allocateCell<JSProxy>(vm.heap)) JSProxy(vm, structure);
+        proxy->finishCreation(vm);
+        return proxy;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, JSType proxyType)
+    {
+        ASSERT(proxyType == ImpureProxyType || proxyType == PureForwardingProxyType);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(proxyType, StructureFlags), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    JSObject* target() const { return m_target.get(); }
+    static ptrdiff_t targetOffset() { return OBJECT_OFFSETOF(JSProxy, m_target); }
+
+    JS_EXPORT_PRIVATE void setTarget(VM&, JSGlobalObject*);
+
+protected:
+    JSProxy(VM& vm, Structure* structure)
+        : JSDestructibleObject(vm, structure)
+    {
+    }
+
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+    }
+
+    void finishCreation(VM& vm, JSObject* target)
+    {
+        Base::finishCreation(vm);
+        m_target.set(vm, this, target);
+    }
+
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+
+    JS_EXPORT_PRIVATE static String className(const JSObject*);
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned, PropertySlot&);
+    JS_EXPORT_PRIVATE static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    JS_EXPORT_PRIVATE static bool putByIndex(JSCell*, ExecState*, unsigned, JSValue, bool shouldThrow);
+    JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned);
+    JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static uint32_t getEnumerableLength(ExecState*, JSObject*);
+    JS_EXPORT_PRIVATE static void getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    JS_EXPORT_PRIVATE static bool setPrototype(JSObject*, ExecState*, JSValue, bool shouldThrowIfCantSet);
+    JS_EXPORT_PRIVATE static JSValue getPrototype(JSObject*, ExecState*);
+    JS_EXPORT_PRIVATE static bool preventExtensions(JSObject*, ExecState*);
+
+private:
+    WriteBarrier<JSObject> m_target;
+};
+
+} // namespace JSC
diff --git a/runtime/JSScope.cpp b/runtime/JSScope.cpp
new file mode 100644
index 0000000..adda2b4
--- /dev/null
+++ b/runtime/JSScope.cpp
@@ -0,0 +1,361 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSScope.h"
+
+#include "AbstractModuleRecord.h"
+#include "Exception.h"
+#include "JSGlobalObject.h"
+#include "JSLexicalEnvironment.h"
+#include "JSModuleEnvironment.h"
+#include "JSWithScope.h"
+#include "JSCInlines.h"
+#include "VariableEnvironment.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSScope);
+
+void JSScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSScope* thisObject = jsCast<JSScope*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_next);
+}
+
+// Returns true if we found enough information to terminate optimization.
+static inline bool abstractAccess(ExecState* exec, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, size_t depth, bool& needsVarInjectionChecks, ResolveOp& op, InitializationMode initializationMode)
+{
+    if (scope->isJSLexicalEnvironment()) {
+        JSLexicalEnvironment* lexicalEnvironment = jsCast<JSLexicalEnvironment*>(scope);
+        if (ident == exec->propertyNames().arguments) {
+            // We know the property will be at this lexical environment scope, but we don't know how to cache it.
+            op = ResolveOp(Dynamic, 0, 0, 0, 0, 0);
+            return true;
+        }
+
+        SymbolTable* symbolTable = lexicalEnvironment->symbolTable();
+        {
+            ConcurrentJSLocker locker(symbolTable->m_lock);
+            auto iter = symbolTable->find(locker, ident.impl());
+            if (iter != symbolTable->end(locker)) {
+                SymbolTableEntry& entry = iter->value;
+                ASSERT(!entry.isNull());
+                if (entry.isReadOnly() && getOrPut == Put) {
+                    // We know the property will be at this lexical environment scope, but we don't know how to cache it.
+                    op = ResolveOp(Dynamic, 0, 0, 0, 0, 0);
+                    return true;
+                }
+
+                op = ResolveOp(makeType(ClosureVar, needsVarInjectionChecks), depth, 0, lexicalEnvironment, entry.watchpointSet(), entry.scopeOffset().offset());
+                return true;
+            }
+        }
+
+        if (scope->type() == ModuleEnvironmentType) {
+            JSModuleEnvironment* moduleEnvironment = jsCast<JSModuleEnvironment*>(scope);
+            AbstractModuleRecord* moduleRecord = moduleEnvironment->moduleRecord();
+            AbstractModuleRecord::Resolution resolution = moduleRecord->resolveImport(exec, ident);
+            if (resolution.type == AbstractModuleRecord::Resolution::Type::Resolved) {
+                AbstractModuleRecord* importedRecord = resolution.moduleRecord;
+                JSModuleEnvironment* importedEnvironment = importedRecord->moduleEnvironment();
+                SymbolTable* symbolTable = importedEnvironment->symbolTable();
+                ConcurrentJSLocker locker(symbolTable->m_lock);
+                auto iter = symbolTable->find(locker, resolution.localName.impl());
+                ASSERT(iter != symbolTable->end(locker));
+                SymbolTableEntry& entry = iter->value;
+                ASSERT(!entry.isNull());
+                op = ResolveOp(makeType(ModuleVar, needsVarInjectionChecks), depth, 0, importedEnvironment, entry.watchpointSet(), entry.scopeOffset().offset(), resolution.localName.impl());
+                return true;
+            }
+        }
+
+        if (symbolTable->usesNonStrictEval())
+            needsVarInjectionChecks = true;
+        return false;
+    }
+
+    if (scope->isGlobalLexicalEnvironment()) {
+        JSGlobalLexicalEnvironment* globalLexicalEnvironment = jsCast<JSGlobalLexicalEnvironment*>(scope);
+        SymbolTable* symbolTable = globalLexicalEnvironment->symbolTable();
+        ConcurrentJSLocker locker(symbolTable->m_lock);
+        auto iter = symbolTable->find(locker, ident.impl());
+        if (iter != symbolTable->end(locker)) {
+            SymbolTableEntry& entry = iter->value;
+            ASSERT(!entry.isNull());
+            if (getOrPut == Put && entry.isReadOnly() && !isInitialization(initializationMode)) {
+                // We know the property will be at global lexical environment, but we don't know how to cache it.
+                op = ResolveOp(Dynamic, 0, 0, 0, 0, 0);
+                return true;
+            }
+
+            // We can force const Initialization to always go down the fast path. It is provably impossible to construct
+            // a program that needs a var injection check here. You can convince yourself of this as follows:
+            // Any other let/const/class would be a duplicate of this in the global scope, so we would never get here in that situation.
+            // Also, if we had an eval in the global scope that defined a const, it would also be a duplicate of this const, and so it would
+            // also throw an error. Therefore, we're *the only* thing that can assign to this "const" slot for the first (and only) time. Also, 
+            // we will never have a Dynamic ResolveType here because if we were inside a "with" statement, that would mean the "const" definition 
+            // isn't a global, it would be a local to the "with" block. 
+            // We still need to make the slow path correct for when we need to fire a watchpoint.
+            ResolveType resolveType = initializationMode == InitializationMode::ConstInitialization ? GlobalLexicalVar : makeType(GlobalLexicalVar, needsVarInjectionChecks);
+            op = ResolveOp(
+                resolveType, depth, 0, 0, entry.watchpointSet(),
+                reinterpret_cast<uintptr_t>(globalLexicalEnvironment->variableAt(entry.scopeOffset()).slot()));
+            return true;
+        }
+
+        return false;
+    }
+
+    if (scope->isGlobalObject()) {
+        JSGlobalObject* globalObject = jsCast<JSGlobalObject*>(scope);
+        {
+            SymbolTable* symbolTable = globalObject->symbolTable();
+            ConcurrentJSLocker locker(symbolTable->m_lock);
+            auto iter = symbolTable->find(locker, ident.impl());
+            if (iter != symbolTable->end(locker)) {
+                SymbolTableEntry& entry = iter->value;
+                ASSERT(!entry.isNull());
+                if (getOrPut == Put && entry.isReadOnly()) {
+                    // We know the property will be at global scope, but we don't know how to cache it.
+                    op = ResolveOp(Dynamic, 0, 0, 0, 0, 0);
+                    return true;
+                }
+
+                op = ResolveOp(
+                    makeType(GlobalVar, needsVarInjectionChecks), depth, 0, 0, entry.watchpointSet(),
+                    reinterpret_cast<uintptr_t>(globalObject->variableAt(entry.scopeOffset()).slot()));
+                return true;
+            }
+        }
+
+        PropertySlot slot(globalObject, PropertySlot::InternalMethodType::VMInquiry);
+        bool hasOwnProperty = globalObject->getOwnPropertySlot(globalObject, exec, ident, slot);
+        if (!hasOwnProperty) {
+            op = ResolveOp(makeType(UnresolvedProperty, needsVarInjectionChecks), 0, 0, 0, 0, 0);
+            return true;
+        }
+
+        if (!slot.isCacheableValue()
+            || !globalObject->structure()->propertyAccessesAreCacheable()
+            || (globalObject->structure()->hasReadOnlyOrGetterSetterPropertiesExcludingProto() && getOrPut == Put)) {
+            // We know the property will be at global scope, but we don't know how to cache it.
+            ASSERT(!scope->next());
+            op = ResolveOp(makeType(GlobalProperty, needsVarInjectionChecks), 0, 0, 0, 0, 0);
+            return true;
+        }
+
+        
+        WatchpointState state = globalObject->structure()->ensurePropertyReplacementWatchpointSet(exec->vm(), slot.cachedOffset())->state();
+        if (state == IsWatched && getOrPut == Put) {
+            // The field exists, but because the replacement watchpoint is still intact. This is
+            // kind of dangerous. We have two options:
+            // 1) Invalidate the watchpoint set. That would work, but it's possible that this code
+            //    path never executes - in which case this would be unwise.
+            // 2) Have the invalidation happen at run-time. All we have to do is leave the code
+            //    uncached. The only downside is slightly more work when this does execute.
+            // We go with option (2) here because it seems less evil.
+            op = ResolveOp(makeType(GlobalProperty, needsVarInjectionChecks), depth, 0, 0, 0, 0);
+        } else
+            op = ResolveOp(makeType(GlobalProperty, needsVarInjectionChecks), depth, globalObject->structure(), 0, 0, slot.cachedOffset());
+        return true;
+    }
+
+    op = ResolveOp(Dynamic, 0, 0, 0, 0, 0);
+    return true;
+}
+
+JSObject* JSScope::objectAtScope(JSScope* scope)
+{
+    JSObject* object = scope;
+    if (object->type() == WithScopeType)
+        return jsCast<JSWithScope*>(object)->object();
+
+    return object;
+}
+
+// When an exception occurs, the result of isUnscopable becomes false.
+static inline bool isUnscopable(ExecState* exec, JSScope* scope, JSObject* object, const Identifier& ident)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    if (scope->type() != WithScopeType)
+        return false;
+
+    JSValue unscopables = object->get(exec, exec->propertyNames().unscopablesSymbol);
+    RETURN_IF_EXCEPTION(throwScope, false);
+    if (!unscopables.isObject())
+        return false;
+    JSValue blocked = jsCast<JSObject*>(unscopables)->get(exec, ident);
+    RETURN_IF_EXCEPTION(throwScope, false);
+
+    return blocked.toBoolean(exec);
+}
+
+JSObject* JSScope::resolve(ExecState* exec, JSScope* scope, const Identifier& ident)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    ScopeChainIterator end = scope->end();
+    ScopeChainIterator it = scope->begin();
+    while (1) {
+        JSScope* scope = it.scope();
+        JSObject* object = it.get();
+
+        // Global scope.
+        if (++it == end) {
+            JSScope* globalScopeExtension = scope->globalObject(vm)->globalScopeExtension();
+            if (UNLIKELY(globalScopeExtension)) {
+                bool hasProperty = object->hasProperty(exec, ident);
+                RETURN_IF_EXCEPTION(throwScope, nullptr);
+                if (hasProperty)
+                    return object;
+                JSObject* extensionScopeObject = JSScope::objectAtScope(globalScopeExtension);
+                hasProperty = extensionScopeObject->hasProperty(exec, ident);
+                RETURN_IF_EXCEPTION(throwScope, nullptr);
+                if (hasProperty)
+                    return extensionScopeObject;
+            }
+            return object;
+        }
+
+        bool hasProperty = object->hasProperty(exec, ident);
+        RETURN_IF_EXCEPTION(throwScope, nullptr);
+        if (hasProperty) {
+            bool unscopable = isUnscopable(exec, scope, object, ident);
+            ASSERT(!throwScope.exception() || !unscopable);
+            if (!unscopable)
+                return object;
+        }
+    }
+}
+
+ResolveOp JSScope::abstractResolve(ExecState* exec, size_t depthOffset, JSScope* scope, const Identifier& ident, GetOrPut getOrPut, ResolveType unlinkedType, InitializationMode initializationMode)
+{
+    ResolveOp op(Dynamic, 0, 0, 0, 0, 0);
+    if (unlinkedType == Dynamic)
+        return op;
+
+    bool needsVarInjectionChecks = JSC::needsVarInjectionChecks(unlinkedType);
+    size_t depth = depthOffset;
+    for (; scope; scope = scope->next()) {
+        if (abstractAccess(exec, scope, ident, getOrPut, depth, needsVarInjectionChecks, op, initializationMode))
+            break;
+        ++depth;
+    }
+
+    return op;
+}
+
+void JSScope::collectClosureVariablesUnderTDZ(JSScope* scope, VariableEnvironment& result)
+{
+    for (; scope; scope = scope->next()) {
+        if (!scope->isLexicalScope() && !scope->isCatchScope())
+            continue;
+
+        if (scope->isModuleScope()) {
+            AbstractModuleRecord* moduleRecord = jsCast<JSModuleEnvironment*>(scope)->moduleRecord();
+            for (const auto& pair : moduleRecord->importEntries())
+                result.add(pair.key);
+        }
+
+        SymbolTable* symbolTable = jsCast<JSSymbolTableObject*>(scope)->symbolTable();
+        ASSERT(symbolTable->scopeType() == SymbolTable::ScopeType::LexicalScope || symbolTable->scopeType() == SymbolTable::ScopeType::CatchScope);
+        ConcurrentJSLocker locker(symbolTable->m_lock);
+        for (auto end = symbolTable->end(locker), iter = symbolTable->begin(locker); iter != end; ++iter)
+            result.add(iter->key);
+    }
+}
+
+bool JSScope::isVarScope()
+{
+    if (type() != LexicalEnvironmentType)
+        return false;
+    return jsCast<JSLexicalEnvironment*>(this)->symbolTable()->scopeType() == SymbolTable::ScopeType::VarScope;
+}
+
+bool JSScope::isLexicalScope()
+{
+    if (!isJSLexicalEnvironment())
+        return false;
+    return jsCast<JSLexicalEnvironment*>(this)->symbolTable()->scopeType() == SymbolTable::ScopeType::LexicalScope;
+}
+
+bool JSScope::isModuleScope()
+{
+    return type() == ModuleEnvironmentType;
+}
+
+bool JSScope::isCatchScope()
+{
+    if (type() != LexicalEnvironmentType)
+        return false;
+    return jsCast<JSLexicalEnvironment*>(this)->symbolTable()->scopeType() == SymbolTable::ScopeType::CatchScope;
+}
+
+bool JSScope::isFunctionNameScopeObject()
+{
+    if (type() != LexicalEnvironmentType)
+        return false;
+    return jsCast<JSLexicalEnvironment*>(this)->symbolTable()->scopeType() == SymbolTable::ScopeType::FunctionNameScope;
+}
+
+bool JSScope::isNestedLexicalScope()
+{
+    if (!isJSLexicalEnvironment())
+        return false;
+    return jsCast<JSLexicalEnvironment*>(this)->symbolTable()->isNestedLexicalScope();
+}
+
+JSScope* JSScope::constantScopeForCodeBlock(ResolveType type, CodeBlock* codeBlock)
+{
+    switch (type) {
+    case GlobalProperty:
+    case GlobalVar:
+    case GlobalPropertyWithVarInjectionChecks:
+    case GlobalVarWithVarInjectionChecks:
+        return codeBlock->globalObject();
+    case GlobalLexicalVarWithVarInjectionChecks:
+    case GlobalLexicalVar:
+        return codeBlock->globalObject()->globalLexicalEnvironment();
+    default:
+        return nullptr;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+SymbolTable* JSScope::symbolTable()
+{
+    if (JSSymbolTableObject* symbolTableObject = jsDynamicCast<JSSymbolTableObject*>(this))
+        return symbolTableObject->symbolTable();
+
+    return nullptr;
+}
+
+} // namespace JSC
diff --git a/runtime/JSScope.h b/runtime/JSScope.h
new file mode 100644
index 0000000..243f763
--- /dev/null
+++ b/runtime/JSScope.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GetPutInfo.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class ScopeChainIterator;
+class SymbolTable;
+class VariableEnvironment;
+class WatchpointSet;
+
+class JSScope : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    friend class LLIntOffsetsExtractor;
+    static size_t offsetOfNext();
+
+    static JSObject* objectAtScope(JSScope*);
+
+    static JSObject* resolve(ExecState*, JSScope*, const Identifier&);
+    static ResolveOp abstractResolve(ExecState*, size_t depthOffset, JSScope*, const Identifier&, GetOrPut, ResolveType, InitializationMode);
+
+    static bool hasConstantScope(ResolveType);
+    static JSScope* constantScopeForCodeBlock(ResolveType, CodeBlock*);
+
+    static void collectClosureVariablesUnderTDZ(JSScope*, VariableEnvironment& result);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    bool isVarScope();
+    bool isLexicalScope();
+    bool isModuleScope();
+    bool isCatchScope();
+    bool isFunctionNameScopeObject();
+
+    bool isNestedLexicalScope();
+
+    ScopeChainIterator begin();
+    ScopeChainIterator end();
+    JSScope* next();
+
+    JSGlobalObject* globalObject();
+    JSGlobalObject* globalObject(VM&);
+    JSObject* globalThis();
+
+    SymbolTable* symbolTable();
+
+protected:
+    JSScope(VM&, Structure*, JSScope* next);
+
+private:
+    WriteBarrier<JSScope> m_next;
+};
+
+inline JSScope::JSScope(VM& vm, Structure* structure, JSScope* next)
+    : Base(vm, structure)
+    , m_next(vm, this, next, WriteBarrier<JSScope>::MayBeNull)
+{
+}
+
+class ScopeChainIterator {
+public:
+    ScopeChainIterator(JSScope* node)
+        : m_node(node)
+    {
+    }
+
+    JSObject* get() const { return JSScope::objectAtScope(m_node); }
+    JSObject* operator->() const { return JSScope::objectAtScope(m_node); }
+    JSScope* scope() const { return m_node; }
+
+    ScopeChainIterator& operator++() { m_node = m_node->next(); return *this; }
+
+    // postfix ++ intentionally omitted
+
+    bool operator==(const ScopeChainIterator& other) const { return m_node == other.m_node; }
+    bool operator!=(const ScopeChainIterator& other) const { return m_node != other.m_node; }
+
+private:
+    JSScope* m_node;
+};
+
+inline ScopeChainIterator JSScope::begin()
+{
+    return ScopeChainIterator(this); 
+}
+
+inline ScopeChainIterator JSScope::end()
+{ 
+    return ScopeChainIterator(0); 
+}
+
+inline JSScope* JSScope::next()
+{ 
+    return m_next.get();
+}
+
+inline JSGlobalObject* JSScope::globalObject()
+{ 
+    return structure()->globalObject();
+}
+
+inline JSGlobalObject* JSScope::globalObject(VM& vm)
+{ 
+    return structure(vm)->globalObject();
+}
+
+inline Register& Register::operator=(JSScope* scope)
+{
+    *this = JSValue(scope);
+    return *this;
+}
+
+inline JSScope* Register::scope() const
+{
+    return jsCast<JSScope*>(unboxedCell());
+}
+
+inline JSGlobalObject* ExecState::lexicalGlobalObject() const
+{
+    return jsCallee()->globalObject();
+}
+
+inline size_t JSScope::offsetOfNext()
+{
+    return OBJECT_OFFSETOF(JSScope, m_next);
+}
+
+} // namespace JSC
diff --git a/runtime/JSSegmentedVariableObject.cpp b/runtime/JSSegmentedVariableObject.cpp
new file mode 100644
index 0000000..f371f32
--- /dev/null
+++ b/runtime/JSSegmentedVariableObject.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2012, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSSegmentedVariableObject.h"
+
+#include "HeapSnapshotBuilder.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+ScopeOffset JSSegmentedVariableObject::findVariableIndex(void* variableAddress)
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    for (unsigned i = m_variables.size(); i--;) {
+        if (&m_variables[i] != variableAddress)
+            continue;
+        return ScopeOffset(i);
+    }
+    CRASH();
+    return ScopeOffset();
+}
+
+ScopeOffset JSSegmentedVariableObject::addVariables(unsigned numberOfVariablesToAdd, JSValue initialValue)
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    size_t oldSize = m_variables.size();
+    m_variables.grow(oldSize + numberOfVariablesToAdd);
+    
+    for (size_t i = numberOfVariablesToAdd; i--;)
+        m_variables[oldSize + i].setWithoutWriteBarrier(initialValue);
+    
+    return ScopeOffset(oldSize);
+}
+
+void JSSegmentedVariableObject::visitChildren(JSCell* cell, SlotVisitor& slotVisitor)
+{
+    JSSegmentedVariableObject* thisObject = jsCast<JSSegmentedVariableObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, slotVisitor);
+    
+    // FIXME: We could avoid locking here if SegmentedVector was lock-free. It could be made lock-free
+    // relatively easily.
+    auto locker = holdLock(thisObject->m_lock);
+    for (unsigned i = thisObject->m_variables.size(); i--;)
+        slotVisitor.appendHidden(thisObject->m_variables[i]);
+}
+
+void JSSegmentedVariableObject::heapSnapshot(JSCell* cell, HeapSnapshotBuilder& builder)
+{
+    JSSegmentedVariableObject* thisObject = jsCast<JSSegmentedVariableObject*>(cell);
+    Base::heapSnapshot(cell, builder);
+
+    ConcurrentJSLocker locker(thisObject->symbolTable()->m_lock);
+    SymbolTable::Map::iterator end = thisObject->symbolTable()->end(locker);
+    for (SymbolTable::Map::iterator it = thisObject->symbolTable()->begin(locker); it != end; ++it) {
+        SymbolTableEntry::Fast entry = it->value;
+        ASSERT(!entry.isNull());
+        ScopeOffset offset = entry.scopeOffset();
+        if (!thisObject->isValidScopeOffset(offset))
+            continue;
+
+        JSValue toValue = thisObject->variableAt(offset).get();
+        if (toValue && toValue.isCell())
+            builder.appendVariableNameEdge(thisObject, toValue.asCell(), it->key.get());
+    }
+}
+
+} // namespace JSC
+
diff --git a/runtime/JSSegmentedVariableObject.h b/runtime/JSSegmentedVariableObject.h
new file mode 100644
index 0000000..212f957
--- /dev/null
+++ b/runtime/JSSegmentedVariableObject.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2012, 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "JSObject.h"
+#include "JSSymbolTableObject.h"
+#include "SymbolTable.h"
+#include <wtf/SegmentedVector.h>
+
+namespace JSC {
+
+class LLIntOffsetsExtractor;
+
+// This is a mostly drop-in replacement for JSEnvironmentRecord, except that it preserves
+// the invariant that after a variable is created, its address in memory will not change
+// so long as the JSSegmentedVariableObject is alive. This allows optimizations based
+// on getting the address of the variable and remembering it. As well, unlike a
+// JSEnvironmentRecord, this will manage the memory for the registers itself and neither
+// requires nor allows for the subclasses to manage that memory. Finally,
+// JSSegmentedVariableObject has its own GC tracing functionality, since it knows the
+// exact dimensions of the variables array at all times.
+
+// Except for JSGlobalObject, subclasses of this don't call the destructor and leak memory.
+
+class JSSegmentedVariableObject : public JSSymbolTableObject {
+    friend class JIT;
+    friend class LLIntOffsetsExtractor;
+
+public:
+    typedef JSSymbolTableObject Base;
+
+    bool isValidScopeOffset(ScopeOffset offset)
+    {
+        return !!offset && offset.offset() < m_variables.size();
+    }
+
+    // This is not thread-safe, since m_variables is a segmented vector, and its spine can resize with
+    // malloc/free if new variables - unrelated to the one you are accessing - are added. You can get
+    // around this by grabbing m_lock, or finding some other way to get to the variable pointer (global
+    // variable access bytecode instructions will have a direct pointer already).
+    WriteBarrier<Unknown>& variableAt(ScopeOffset offset) { return m_variables[offset.offset()]; }
+    
+    // This is a slow method call, which searches the register bank to find the index
+    // given a pointer. It will CRASH() if it does not find the register. Only use this
+    // in debug code (like bytecode dumping).
+    JS_EXPORT_PRIVATE ScopeOffset findVariableIndex(void*);
+    
+    WriteBarrier<Unknown>* assertVariableIsInThisObject(WriteBarrier<Unknown>* variablePointer)
+    {
+        if (!ASSERT_DISABLED)
+            findVariableIndex(variablePointer);
+        return variablePointer;
+    }
+    
+    // Adds numberOfRegistersToAdd registers, initializes them to Undefined, and returns
+    // the index of the first one added.
+    JS_EXPORT_PRIVATE ScopeOffset addVariables(unsigned numberOfVariablesToAdd, JSValue);
+    
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+    JS_EXPORT_PRIVATE static void heapSnapshot(JSCell*, HeapSnapshotBuilder&);
+    
+protected:
+    JSSegmentedVariableObject(VM& vm, Structure* structure, JSScope* scope)
+        : JSSymbolTableObject(vm, structure, scope)
+    {
+    }
+
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        setSymbolTable(vm, SymbolTable::create(vm));
+    }
+    
+private:
+    // FIXME: This needs a destructor, which can only be added using custom subspace.
+    
+    SegmentedVector<WriteBarrier<Unknown>, 16> m_variables;
+    ConcurrentJSLock m_lock;
+};
+
+} // namespace JSC
diff --git a/runtime/JSSet.cpp b/runtime/JSSet.cpp
new file mode 100644
index 0000000..76761b2
--- /dev/null
+++ b/runtime/JSSet.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSSet.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSSet::s_info = { "Set", &Base::s_info, 0, CREATE_METHOD_TABLE(JSSet) };
+
+String JSSet::toStringName(const JSObject*, ExecState*)
+{
+    return ASCIILiteral("Object");
+}
+
+}
diff --git a/runtime/JSSet.h b/runtime/JSSet.h
new file mode 100644
index 0000000..e356a7a
--- /dev/null
+++ b/runtime/JSSet.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "MapBase.h"
+
+namespace JSC {
+
+class JSSetIterator;
+
+class JSSet : public MapBase<HashMapBucket<HashMapBucketDataKey>> {
+    typedef MapBase<HashMapBucket<HashMapBucketDataKey>> Base;
+public:
+
+    friend class JSSetIterator;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSSetType, StructureFlags), info());
+    }
+
+    static JSSet* create(ExecState* exec, VM& vm, Structure* structure)
+    {
+        JSSet* instance = new (NotNull, allocateCell<JSSet>(vm.heap)) JSSet(vm, structure);
+        instance->finishCreation(exec, vm);
+        return instance;
+    }
+
+    ALWAYS_INLINE void add(ExecState* exec, JSValue key)
+    {
+        m_map->add(exec, key);
+    }
+
+private:
+    JSSet(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    static String toStringName(const JSObject*, ExecState*);
+};
+
+} // namespace JSC
diff --git a/runtime/JSSetIterator.cpp b/runtime/JSSetIterator.cpp
new file mode 100644
index 0000000..9782779
--- /dev/null
+++ b/runtime/JSSetIterator.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSSetIterator.h"
+
+#include "JSCInlines.h"
+#include "JSSet.h"
+
+namespace JSC {
+
+const ClassInfo JSSetIterator::s_info = { "Set Iterator", &Base::s_info, 0, CREATE_METHOD_TABLE(JSSetIterator) };
+
+void JSSetIterator::finishCreation(VM& vm, JSSet* iteratedObject)
+{
+    Base::finishCreation(vm);
+    m_set.set(vm, this, iteratedObject);
+    setIterator(vm, m_set->impl()->head());
+}
+
+void JSSetIterator::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSSetIterator* thisObject = jsCast<JSSetIterator*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_set);
+    visitor.append(thisObject->m_iter);
+}
+
+JSValue JSSetIterator::createPair(CallFrame* callFrame, JSValue key, JSValue value)
+{
+    MarkedArgumentBuffer args;
+    args.append(key);
+    args.append(value);
+    JSGlobalObject* globalObject = callFrame->jsCallee()->globalObject();
+    return constructArray(callFrame, 0, globalObject, args);
+}
+
+JSSetIterator* JSSetIterator::clone(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto clone = JSSetIterator::create(vm, exec->jsCallee()->globalObject()->setIteratorStructure(), m_set.get(), m_kind);
+    clone->setIterator(vm, m_iter.get());
+    return clone;
+}
+
+}
diff --git a/runtime/JSSetIterator.h b/runtime/JSSetIterator.h
new file mode 100644
index 0000000..41fc57f
--- /dev/null
+++ b/runtime/JSSetIterator.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "IterationKind.h"
+#include "JSObject.h"
+#include "JSSet.h"
+
+namespace JSC {
+
+class JSSetIterator : public JSNonFinalObject {
+    typedef HashMapBucket<HashMapBucketDataKey> HashMapBucketType;
+public:
+    typedef JSNonFinalObject Base;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static JSSetIterator* create(VM& vm, Structure* structure, JSSet* iteratedObject, IterationKind kind)
+    {
+        JSSetIterator* instance = new (NotNull, allocateCell<JSSetIterator>(vm.heap)) JSSetIterator(vm, structure, iteratedObject, kind);
+        instance->finishCreation(vm, iteratedObject);
+        return instance;
+    }
+
+    ALWAYS_INLINE HashMapBucketType* advanceIter(ExecState* exec)
+    {
+        HashMapBucketType* prev = m_iter.get();
+        if (!prev)
+            return nullptr;
+        HashMapBucketType* bucket = m_iter->next();
+        while (bucket && bucket->deleted()) {
+            prev = bucket;
+            bucket = bucket->next();
+        }
+        if (!bucket) {
+            setIterator(exec->vm(), nullptr);
+            return nullptr;
+        }
+        setIterator(exec->vm(), bucket); // We keep m_iter on the last value since the first thing we do in this function is call next().
+        return bucket;
+    }
+
+    bool next(ExecState* exec, JSValue& value)
+    {
+        HashMapBucketType* bucket = advanceIter(exec);
+        if (!bucket)
+            return false;
+
+        if (m_kind == IterateValue || m_kind == IterateKey)
+            value = bucket->key();
+        else
+            value = createPair(exec, bucket->key(), bucket->key());
+        return true;
+    }
+
+    IterationKind kind() const { return m_kind; }
+    JSValue iteratedValue() const { return m_set.get(); }
+    JSSetIterator* clone(ExecState*);
+
+private:
+    JSSetIterator(VM& vm, Structure* structure, JSSet*, IterationKind kind)
+        : Base(vm, structure)
+        , m_kind(kind)
+    {
+    }
+
+    void setIterator(VM& vm, HashMapBucketType* bucket)
+    {
+        m_iter.setMayBeNull(vm, this, bucket); 
+    }
+
+    JS_EXPORT_PRIVATE void finishCreation(VM&, JSSet*);
+    JS_EXPORT_PRIVATE JSValue createPair(CallFrame*, JSValue, JSValue);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<JSSet> m_set;
+    WriteBarrier<HashMapBucketType> m_iter;
+    IterationKind m_kind;
+};
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSSetIterator);
+
+} // namespace JSC
diff --git a/runtime/JSString.cpp b/runtime/JSString.cpp
new file mode 100644
index 0000000..6b7d94a
--- /dev/null
+++ b/runtime/JSString.cpp
@@ -0,0 +1,452 @@
+/*
+ *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2004, 2007-2008, 2015-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSString.h"
+
+#include "JSGlobalObject.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "StringObject.h"
+#include "StringPrototype.h"
+#include "StrongInlines.h"
+
+namespace JSC {
+    
+const ClassInfo JSString::s_info = { "string", 0, 0, CREATE_METHOD_TABLE(JSString) };
+
+Structure* JSString::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+{
+    return Structure::create(vm, globalObject, proto, TypeInfo(StringType, StructureFlags), info());
+}
+
+void JSRopeString::RopeBuilder::expand()
+{
+    ASSERT(m_index == JSRopeString::s_maxInternalRopeLength);
+    JSString* jsString = m_jsString;
+    RELEASE_ASSERT(jsString);
+    m_jsString = jsStringBuilder(&m_vm);
+    m_index = 0;
+    append(jsString);
+}
+
+void JSString::destroy(JSCell* cell)
+{
+    static_cast<JSString*>(cell)->JSString::~JSString();
+}
+
+void JSString::dumpToStream(const JSCell* cell, PrintStream& out)
+{
+    const JSString* thisObject = jsCast<const JSString*>(cell);
+    out.printf("<%p, %s, [%u], ", thisObject, thisObject->className(), thisObject->length());
+    if (thisObject->isRope())
+        out.printf("[rope]");
+    else {
+        WTF::StringImpl* ourImpl = thisObject->m_value.impl();
+        if (ourImpl->is8Bit())
+            out.printf("[8 %p]", ourImpl->characters8());
+        else
+            out.printf("[16 %p]", ourImpl->characters16());
+    }
+    out.printf(">");
+}
+
+bool JSString::equalSlowCase(ExecState* exec, JSString* other) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    String str1 = value(exec);
+    String str2 = other->value(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    return WTF::equal(*str1.impl(), *str2.impl());
+}
+
+size_t JSString::estimatedSize(JSCell* cell)
+{
+    JSString* thisObject = asString(cell);
+    if (thisObject->isRope())
+        return Base::estimatedSize(cell);
+    return Base::estimatedSize(cell) + thisObject->m_value.impl()->costDuringGC();
+}
+
+void JSString::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSString* thisObject = asString(cell);
+    Base::visitChildren(thisObject, visitor);
+    
+    if (thisObject->isRope())
+        static_cast<JSRopeString*>(thisObject)->visitFibers(visitor);
+    if (StringImpl* impl = thisObject->m_value.impl())
+        visitor.reportExtraMemoryVisited(impl->costDuringGC());
+}
+
+void JSRopeString::visitFibers(SlotVisitor& visitor)
+{
+    if (isSubstring()) {
+        visitor.append(substringBase());
+        return;
+    }
+    for (size_t i = 0; i < s_maxInternalRopeLength && fiber(i); ++i)
+        visitor.append(fiber(i));
+}
+
+static const unsigned maxLengthForOnStackResolve = 2048;
+
+void JSRopeString::resolveRopeInternal8(LChar* buffer) const
+{
+    if (isSubstring()) {
+        StringImpl::copyChars(
+            buffer, substringBase()->m_value.characters8() + substringOffset(), length());
+        return;
+    }
+    
+    resolveRopeInternal8NoSubstring(buffer);
+}
+
+void JSRopeString::resolveRopeInternal8NoSubstring(LChar* buffer) const
+{
+    for (size_t i = 0; i < s_maxInternalRopeLength && fiber(i); ++i) {
+        if (fiber(i)->isRope()) {
+            resolveRopeSlowCase8(buffer);
+            return;
+        }
+    }
+
+    LChar* position = buffer;
+    for (size_t i = 0; i < s_maxInternalRopeLength && fiber(i); ++i) {
+        const StringImpl& fiberString = *fiber(i)->m_value.impl();
+        unsigned length = fiberString.length();
+        StringImpl::copyChars(position, fiberString.characters8(), length);
+        position += length;
+    }
+    ASSERT((buffer + length()) == position);
+}
+
+void JSRopeString::resolveRopeInternal16(UChar* buffer) const
+{
+    if (isSubstring()) {
+        StringImpl::copyChars(
+            buffer, substringBase()->m_value.characters16() + substringOffset(), length());
+        return;
+    }
+    
+    resolveRopeInternal16NoSubstring(buffer);
+}
+
+void JSRopeString::resolveRopeInternal16NoSubstring(UChar* buffer) const
+{
+    for (size_t i = 0; i < s_maxInternalRopeLength && fiber(i); ++i) {
+        if (fiber(i)->isRope()) {
+            resolveRopeSlowCase(buffer);
+            return;
+        }
+    }
+
+    UChar* position = buffer;
+    for (size_t i = 0; i < s_maxInternalRopeLength && fiber(i); ++i) {
+        const StringImpl& fiberString = *fiber(i)->m_value.impl();
+        unsigned length = fiberString.length();
+        if (fiberString.is8Bit())
+            StringImpl::copyChars(position, fiberString.characters8(), length);
+        else
+            StringImpl::copyChars(position, fiberString.characters16(), length);
+        position += length;
+    }
+    ASSERT((buffer + length()) == position);
+}
+
+void JSRopeString::resolveRopeToAtomicString(ExecState* exec) const
+{
+    if (length() > maxLengthForOnStackResolve) {
+        resolveRope(exec);
+        m_value = AtomicString(m_value);
+        setIs8Bit(m_value.impl()->is8Bit());
+        return;
+    }
+
+    if (is8Bit()) {
+        LChar buffer[maxLengthForOnStackResolve];
+        resolveRopeInternal8(buffer);
+        m_value = AtomicString(buffer, length());
+        setIs8Bit(m_value.impl()->is8Bit());
+    } else {
+        UChar buffer[maxLengthForOnStackResolve];
+        resolveRopeInternal16(buffer);
+        m_value = AtomicString(buffer, length());
+        setIs8Bit(m_value.impl()->is8Bit());
+    }
+
+    clearFibers();
+
+    // If we resolved a string that didn't previously exist, notify the heap that we've grown.
+    if (m_value.impl()->hasOneRef())
+        Heap::heap(this)->reportExtraMemoryAllocated(m_value.impl()->cost());
+}
+
+void JSRopeString::clearFibers() const
+{
+    for (size_t i = 0; i < s_maxInternalRopeLength; ++i)
+        u[i].number = 0;
+}
+
+RefPtr<AtomicStringImpl> JSRopeString::resolveRopeToExistingAtomicString(ExecState* exec) const
+{
+    if (length() > maxLengthForOnStackResolve) {
+        resolveRope(exec);
+        if (RefPtr<AtomicStringImpl> existingAtomicString = AtomicStringImpl::lookUp(m_value.impl())) {
+            m_value = *existingAtomicString;
+            setIs8Bit(m_value.impl()->is8Bit());
+            clearFibers();
+            return existingAtomicString;
+        }
+        return nullptr;
+    }
+    
+    if (is8Bit()) {
+        LChar buffer[maxLengthForOnStackResolve];
+        resolveRopeInternal8(buffer);
+        if (RefPtr<AtomicStringImpl> existingAtomicString = AtomicStringImpl::lookUp(buffer, length())) {
+            m_value = *existingAtomicString;
+            setIs8Bit(m_value.impl()->is8Bit());
+            clearFibers();
+            return existingAtomicString;
+        }
+    } else {
+        UChar buffer[maxLengthForOnStackResolve];
+        resolveRopeInternal16(buffer);
+        if (RefPtr<AtomicStringImpl> existingAtomicString = AtomicStringImpl::lookUp(buffer, length())) {
+            m_value = *existingAtomicString;
+            setIs8Bit(m_value.impl()->is8Bit());
+            clearFibers();
+            return existingAtomicString;
+        }
+    }
+
+    return nullptr;
+}
+
+void JSRopeString::resolveRope(ExecState* exec) const
+{
+    ASSERT(isRope());
+    
+    if (isSubstring()) {
+        ASSERT(!substringBase()->isRope());
+        m_value = substringBase()->m_value.substringSharingImpl(substringOffset(), length());
+        substringBase().clear();
+        return;
+    }
+    
+    if (is8Bit()) {
+        LChar* buffer;
+        if (auto newImpl = StringImpl::tryCreateUninitialized(length(), buffer)) {
+            Heap::heap(this)->reportExtraMemoryAllocated(newImpl->cost());
+            m_value = WTFMove(newImpl);
+        } else {
+            outOfMemory(exec);
+            return;
+        }
+        resolveRopeInternal8NoSubstring(buffer);
+        clearFibers();
+        ASSERT(!isRope());
+        return;
+    }
+
+    UChar* buffer;
+    if (auto newImpl = StringImpl::tryCreateUninitialized(length(), buffer)) {
+        Heap::heap(this)->reportExtraMemoryAllocated(newImpl->cost());
+        m_value = WTFMove(newImpl);
+    } else {
+        outOfMemory(exec);
+        return;
+    }
+
+    resolveRopeInternal16NoSubstring(buffer);
+    clearFibers();
+    ASSERT(!isRope());
+}
+
+// Overview: These functions convert a JSString from holding a string in rope form
+// down to a simple String representation. It does so by building up the string
+// backwards, since we want to avoid recursion, we expect that the tree structure
+// representing the rope is likely imbalanced with more nodes down the left side
+// (since appending to the string is likely more common) - and as such resolving
+// in this fashion should minimize work queue size.  (If we built the queue forwards
+// we would likely have to place all of the constituent StringImpls into the
+// Vector before performing any concatenation, but by working backwards we likely
+// only fill the queue with the number of substrings at any given level in a
+// rope-of-ropes.)    
+void JSRopeString::resolveRopeSlowCase8(LChar* buffer) const
+{
+    LChar* position = buffer + length(); // We will be working backwards over the rope.
+    Vector<JSString*, 32, UnsafeVectorOverflow> workQueue; // Putting strings into a Vector is only OK because there are no GC points in this method.
+    
+    for (size_t i = 0; i < s_maxInternalRopeLength && fiber(i); ++i)
+        workQueue.append(fiber(i).get());
+
+    while (!workQueue.isEmpty()) {
+        JSString* currentFiber = workQueue.last();
+        workQueue.removeLast();
+
+        const LChar* characters;
+        
+        if (currentFiber->isRope()) {
+            JSRopeString* currentFiberAsRope = static_cast<JSRopeString*>(currentFiber);
+            if (!currentFiberAsRope->isSubstring()) {
+                for (size_t i = 0; i < s_maxInternalRopeLength && currentFiberAsRope->fiber(i); ++i)
+                    workQueue.append(currentFiberAsRope->fiber(i).get());
+                continue;
+            }
+            ASSERT(!currentFiberAsRope->substringBase()->isRope());
+            characters =
+                currentFiberAsRope->substringBase()->m_value.characters8() +
+                currentFiberAsRope->substringOffset();
+        } else
+            characters = currentFiber->m_value.characters8();
+        
+        unsigned length = currentFiber->length();
+        position -= length;
+        StringImpl::copyChars(position, characters, length);
+    }
+
+    ASSERT(buffer == position);
+}
+
+void JSRopeString::resolveRopeSlowCase(UChar* buffer) const
+{
+    UChar* position = buffer + length(); // We will be working backwards over the rope.
+    Vector<JSString*, 32, UnsafeVectorOverflow> workQueue; // These strings are kept alive by the parent rope, so using a Vector is OK.
+
+    for (size_t i = 0; i < s_maxInternalRopeLength && fiber(i); ++i)
+        workQueue.append(fiber(i).get());
+
+    while (!workQueue.isEmpty()) {
+        JSString* currentFiber = workQueue.last();
+        workQueue.removeLast();
+
+        if (currentFiber->isRope()) {
+            JSRopeString* currentFiberAsRope = static_cast<JSRopeString*>(currentFiber);
+            if (currentFiberAsRope->isSubstring()) {
+                ASSERT(!currentFiberAsRope->substringBase()->isRope());
+                StringImpl* string = static_cast<StringImpl*>(
+                    currentFiberAsRope->substringBase()->m_value.impl());
+                unsigned offset = currentFiberAsRope->substringOffset();
+                unsigned length = currentFiberAsRope->length();
+                position -= length;
+                if (string->is8Bit())
+                    StringImpl::copyChars(position, string->characters8() + offset, length);
+                else
+                    StringImpl::copyChars(position, string->characters16() + offset, length);
+                continue;
+            }
+            for (size_t i = 0; i < s_maxInternalRopeLength && currentFiberAsRope->fiber(i); ++i)
+                workQueue.append(currentFiberAsRope->fiber(i).get());
+            continue;
+        }
+
+        StringImpl* string = static_cast<StringImpl*>(currentFiber->m_value.impl());
+        unsigned length = string->length();
+        position -= length;
+        if (string->is8Bit())
+            StringImpl::copyChars(position, string->characters8(), length);
+        else
+            StringImpl::copyChars(position, string->characters16(), length);
+    }
+
+    ASSERT(buffer == position);
+}
+
+void JSRopeString::outOfMemory(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    clearFibers();
+    ASSERT(isRope());
+    ASSERT(m_value.isNull());
+    if (exec)
+        throwOutOfMemoryError(exec, scope);
+}
+
+JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
+{
+    return const_cast<JSString*>(this);
+}
+
+bool JSString::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result) const
+{
+    result = this;
+    number = jsToNumber(unsafeView(*exec));
+    return false;
+}
+
+double JSString::toNumber(ExecState* exec) const
+{
+    return jsToNumber(unsafeView(*exec));
+}
+
+inline StringObject* StringObject::create(VM& vm, JSGlobalObject* globalObject, JSString* string)
+{
+    StringObject* object = new (NotNull, allocateCell<StringObject>(vm.heap)) StringObject(vm, globalObject->stringObjectStructure());
+    object->finishCreation(vm, string);
+    return object;
+}
+
+JSObject* JSString::toObject(ExecState* exec, JSGlobalObject* globalObject) const
+{
+    return StringObject::create(exec->vm(), globalObject, const_cast<JSString*>(this));
+}
+
+JSValue JSString::toThis(JSCell* cell, ExecState* exec, ECMAMode ecmaMode)
+{
+    if (ecmaMode == StrictMode)
+        return cell;
+    return StringObject::create(exec->vm(), exec->lexicalGlobalObject(), asString(cell));
+}
+
+bool JSString::getStringPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        descriptor.setDescriptor(jsNumber(length()), DontEnum | DontDelete | ReadOnly);
+        return true;
+    }
+    
+    std::optional<uint32_t> index = parseIndex(propertyName);
+    if (index && index.value() < length()) {
+        descriptor.setDescriptor(getIndex(exec, index.value()), DontDelete | ReadOnly);
+        return true;
+    }
+    
+    return false;
+}
+
+JSString* jsStringWithCacheSlowCase(VM& vm, StringImpl& stringImpl)
+{
+    if (JSString* string = vm.stringCache.get(&stringImpl))
+        return string;
+
+    JSString* string = jsString(&vm, String(stringImpl));
+    vm.lastCachedString.set(vm, string);
+    return string;
+}
+
+} // namespace JSC
diff --git a/runtime/JSString.h b/runtime/JSString.h
new file mode 100644
index 0000000..bcb5405
--- /dev/null
+++ b/runtime/JSString.h
@@ -0,0 +1,788 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "CommonIdentifiers.h"
+#include "Identifier.h"
+#include "PropertyDescriptor.h"
+#include "PropertySlot.h"
+#include "Structure.h"
+#include <array>
+#include <wtf/text/StringView.h>
+
+namespace JSC {
+
+class JSString;
+class JSRopeString;
+class LLIntOffsetsExtractor;
+
+JSString* jsEmptyString(VM*);
+JSString* jsEmptyString(ExecState*);
+JSString* jsString(VM*, const String&); // returns empty string if passed null string
+JSString* jsString(ExecState*, const String&); // returns empty string if passed null string
+
+JSString* jsSingleCharacterString(VM*, UChar);
+JSString* jsSingleCharacterString(ExecState*, UChar);
+JSString* jsSubstring(VM*, const String&, unsigned offset, unsigned length);
+JSString* jsSubstring(ExecState*, const String&, unsigned offset, unsigned length);
+
+// Non-trivial strings are two or more characters long.
+// These functions are faster than just calling jsString.
+JSString* jsNontrivialString(VM*, const String&);
+JSString* jsNontrivialString(ExecState*, const String&);
+JSString* jsNontrivialString(ExecState*, String&&);
+
+// Should be used for strings that are owned by an object that will
+// likely outlive the JSValue this makes, such as the parse tree or a
+// DOM object that contains a String
+JSString* jsOwnedString(VM*, const String&);
+JSString* jsOwnedString(ExecState*, const String&);
+
+JSRopeString* jsStringBuilder(VM*);
+
+bool isJSString(JSCell*);
+bool isJSString(JSValue);
+JSString* asString(JSValue);
+
+struct StringViewWithUnderlyingString {
+    StringView view;
+    String underlyingString;
+};
+
+class JSString : public JSCell {
+public:
+    friend class JIT;
+    friend class VM;
+    friend class SpecializedThunkJIT;
+    friend class JSRopeString;
+    friend class MarkStack;
+    friend class SlotVisitor;
+    friend struct ThunkHelpers;
+
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | StructureIsImmortal | OverridesToThis;
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+    
+    // We specialize the string subspace to get the fastest possible sweep. This wouldn't be
+    // necessary if JSString didn't have a destructor.
+    template<typename>
+    static Subspace* subspaceFor(VM& vm)
+    {
+        return &vm.stringSpace;
+    }
+    
+    static const unsigned MaxLength = std::numeric_limits<int32_t>::max();
+    
+private:
+    JSString(VM& vm, PassRefPtr<StringImpl> value)
+        : JSCell(vm, vm.stringStructure.get())
+        , m_flags(0)
+        , m_value(RefPtr<StringImpl>(value))
+    {
+    }
+
+    JSString(VM& vm)
+        : JSCell(vm, vm.stringStructure.get())
+        , m_flags(0)
+    {
+    }
+
+    void finishCreation(VM& vm, size_t length)
+    {
+        ASSERT(!m_value.isNull());
+        Base::finishCreation(vm);
+        setLength(length);
+        setIs8Bit(m_value.impl()->is8Bit());
+    }
+
+    void finishCreation(VM& vm, size_t length, size_t cost)
+    {
+        ASSERT(!m_value.isNull());
+        Base::finishCreation(vm);
+        setLength(length);
+        setIs8Bit(m_value.impl()->is8Bit());
+        Heap::heap(this)->reportExtraMemoryAllocated(cost);
+    }
+
+protected:
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        setLength(0);
+        setIs8Bit(true);
+    }
+
+public:
+    static JSString* create(VM& vm, PassRefPtr<StringImpl> value)
+    {
+        ASSERT(value);
+        unsigned length = value->length();
+        size_t cost = value->cost();
+        JSString* newString = new (NotNull, allocateCell<JSString>(vm.heap)) JSString(vm, value);
+        newString->finishCreation(vm, length, cost);
+        return newString;
+    }
+    static JSString* createHasOtherOwner(VM& vm, PassRefPtr<StringImpl> value)
+    {
+        ASSERT(value);
+        size_t length = value->length();
+        JSString* newString = new (NotNull, allocateCell<JSString>(vm.heap)) JSString(vm, value);
+        newString->finishCreation(vm, length);
+        return newString;
+    }
+
+    Identifier toIdentifier(ExecState*) const;
+    AtomicString toAtomicString(ExecState*) const;
+    RefPtr<AtomicStringImpl> toExistingAtomicString(ExecState*) const;
+
+    StringViewWithUnderlyingString viewWithUnderlyingString(ExecState&) const;
+
+    inline bool equal(ExecState*, JSString* other) const;
+    const String& value(ExecState*) const;
+    const String& tryGetValue() const;
+    const StringImpl* tryGetValueImpl() const;
+    ALWAYS_INLINE unsigned length() const { return m_length; }
+    ALWAYS_INLINE static bool isValidLength(size_t length)
+    {
+        // While length is of type unsigned, the runtime and compilers are all
+        // expecting that m_length is a positive value <= INT_MAX.
+        // FIXME: Look into making the max length UINT_MAX to match StringImpl's max length.
+        // https://bugs.webkit.org/show_bug.cgi?id=163955
+        return length <= std::numeric_limits<int32_t>::max();
+    }
+
+    JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+    bool toBoolean() const { return !!length(); }
+    bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
+    JSObject* toObject(ExecState*, JSGlobalObject*) const;
+    double toNumber(ExecState*) const;
+
+    bool getStringPropertySlot(ExecState*, PropertyName, PropertySlot&);
+    bool getStringPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
+    bool getStringPropertyDescriptor(ExecState*, PropertyName, PropertyDescriptor&);
+
+    bool canGetIndex(unsigned i) { return i < length(); }
+    JSString* getIndex(ExecState*, unsigned);
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    static size_t offsetOfLength() { return OBJECT_OFFSETOF(JSString, m_length); }
+    static size_t offsetOfFlags() { return OBJECT_OFFSETOF(JSString, m_flags); }
+    static size_t offsetOfValue() { return OBJECT_OFFSETOF(JSString, m_value); }
+
+    DECLARE_EXPORT_INFO;
+
+    static void dumpToStream(const JSCell*, PrintStream&);
+    static size_t estimatedSize(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    enum {
+        Is8Bit = 1u
+    };
+
+protected:
+    friend class JSValue;
+
+    JS_EXPORT_PRIVATE bool equalSlowCase(ExecState*, JSString* other) const;
+    bool isRope() const { return m_value.isNull(); }
+    bool isSubstring() const;
+    bool is8Bit() const { return m_flags & Is8Bit; }
+    void setIs8Bit(bool flag) const
+    {
+        if (flag)
+            m_flags |= Is8Bit;
+        else
+            m_flags &= ~Is8Bit;
+    }
+
+    ALWAYS_INLINE void setLength(unsigned length)
+    {
+        RELEASE_ASSERT(isValidLength(length));
+        m_length = length;
+    }
+
+private:
+    mutable unsigned m_flags;
+
+    // A string is represented either by a String or a rope of fibers.
+    unsigned m_length;
+    mutable String m_value;
+
+    friend class LLIntOffsetsExtractor;
+
+    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
+
+    String& string() { ASSERT(!isRope()); return m_value; }
+    StringView unsafeView(ExecState&) const;
+
+    friend JSString* jsString(ExecState*, JSString*, JSString*);
+    friend JSString* jsSubstring(ExecState*, JSString*, unsigned offset, unsigned length);
+};
+
+// NOTE: This class cannot override JSString's destructor. JSString's destructor is called directly
+// from JSStringSubspace::
+class JSRopeString final : public JSString {
+    friend class JSString;
+
+    friend JSRopeString* jsStringBuilder(VM*);
+
+public:
+    class RopeBuilder {
+    public:
+        RopeBuilder(VM& vm)
+            : m_vm(vm)
+            , m_jsString(jsStringBuilder(&vm))
+            , m_index(0)
+        {
+        }
+
+        bool append(JSString* jsString)
+        {
+            if (m_index == JSRopeString::s_maxInternalRopeLength)
+                expand();
+            if (static_cast<int32_t>(m_jsString->length() + jsString->length()) < 0) {
+                m_jsString = nullptr;
+                return false;
+            }
+            m_jsString->append(m_vm, m_index++, jsString);
+            return true;
+        }
+
+        JSRopeString* release()
+        {
+            RELEASE_ASSERT(m_jsString);
+            JSRopeString* tmp = m_jsString;
+            m_jsString = 0;
+            return tmp;
+        }
+
+        unsigned length() const { return m_jsString->length(); }
+
+    private:
+        void expand();
+
+        VM& m_vm;
+        JSRopeString* m_jsString;
+        size_t m_index;
+    };
+
+private:
+    ALWAYS_INLINE JSRopeString(VM& vm)
+        : JSString(vm)
+    {
+    }
+
+    void finishCreation(VM& vm, JSString* s1, JSString* s2)
+    {
+        Base::finishCreation(vm);
+        ASSERT(!sumOverflows<int32_t>(s1->length(), s2->length()));
+        setLength(s1->length() + s2->length());
+        setIs8Bit(s1->is8Bit() && s2->is8Bit());
+        setIsSubstring(false);
+        fiber(0).set(vm, this, s1);
+        fiber(1).set(vm, this, s2);
+        fiber(2).clear();
+    }
+
+    void finishCreation(VM& vm, JSString* s1, JSString* s2, JSString* s3)
+    {
+        Base::finishCreation(vm);
+        ASSERT(!sumOverflows<int32_t>(s1->length(), s2->length(), s3->length()));
+        setLength(s1->length() + s2->length() + s3->length());
+        setIs8Bit(s1->is8Bit() && s2->is8Bit() &&  s3->is8Bit());
+        setIsSubstring(false);
+        fiber(0).set(vm, this, s1);
+        fiber(1).set(vm, this, s2);
+        fiber(2).set(vm, this, s3);
+    }
+
+    void finishCreation(VM& vm, ExecState* exec, JSString* base, unsigned offset, unsigned length)
+    {
+        Base::finishCreation(vm);
+        RELEASE_ASSERT(!sumOverflows<int32_t>(offset, length));
+        RELEASE_ASSERT(offset + length <= base->length());
+        setLength(length);
+        setIs8Bit(base->is8Bit());
+        setIsSubstring(true);
+        if (base->isSubstring()) {
+            JSRopeString* baseRope = jsCast<JSRopeString*>(base);
+            substringBase().set(vm, this, baseRope->substringBase().get());
+            substringOffset() = baseRope->substringOffset() + offset;
+        } else {
+            substringBase().set(vm, this, base);
+            substringOffset() = offset;
+
+            // For now, let's not allow substrings with a rope base.
+            // Resolve non-substring rope bases so we don't have to deal with it.
+            // FIXME: Evaluate if this would be worth adding more branches.
+            if (base->isRope())
+                jsCast<JSRopeString*>(base)->resolveRope(exec);
+        }
+    }
+
+    ALWAYS_INLINE void finishCreationSubstringOfResolved(VM& vm, JSString* base, unsigned offset, unsigned length)
+    {
+        Base::finishCreation(vm);
+        RELEASE_ASSERT(!sumOverflows<int32_t>(offset, length));
+        RELEASE_ASSERT(offset + length <= base->length());
+        setLength(length);
+        setIs8Bit(base->is8Bit());
+        setIsSubstring(true);
+        substringBase().set(vm, this, base);
+        substringOffset() = offset;
+    }
+
+    void finishCreation(VM& vm)
+    {
+        JSString::finishCreation(vm);
+        setIsSubstring(false);
+        fiber(0).clear();
+        fiber(1).clear();
+        fiber(2).clear();
+    }
+
+    void append(VM& vm, size_t index, JSString* jsString)
+    {
+        fiber(index).set(vm, this, jsString);
+        setLength(length() + jsString->length());
+        setIs8Bit(is8Bit() && jsString->is8Bit());
+    }
+
+    static JSRopeString* createNull(VM& vm)
+    {
+        JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
+        newString->finishCreation(vm);
+        return newString;
+    }
+
+public:
+    static JSString* create(VM& vm, ExecState* exec, JSString* base, unsigned offset, unsigned length)
+    {
+        JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
+        newString->finishCreation(vm, exec, base, offset, length);
+        return newString;
+    }
+
+    ALWAYS_INLINE static JSString* createSubstringOfResolved(VM& vm, GCDeferralContext* deferralContext, JSString* base, unsigned offset, unsigned length)
+    {
+        JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap, deferralContext)) JSRopeString(vm);
+        newString->finishCreationSubstringOfResolved(vm, base, offset, length);
+        return newString;
+    }
+
+    ALWAYS_INLINE static JSString* createSubstringOfResolved(VM& vm, JSString* base, unsigned offset, unsigned length)
+    {
+        return createSubstringOfResolved(vm, nullptr, base, offset, length);
+    }
+
+    void visitFibers(SlotVisitor&);
+
+    static ptrdiff_t offsetOfFibers() { return OBJECT_OFFSETOF(JSRopeString, u); }
+
+    static const unsigned s_maxInternalRopeLength = 3;
+
+private:
+    static JSString* create(VM& vm, JSString* s1, JSString* s2)
+    {
+        JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
+        newString->finishCreation(vm, s1, s2);
+        return newString;
+    }
+    static JSString* create(VM& vm, JSString* s1, JSString* s2, JSString* s3)
+    {
+        JSRopeString* newString = new (NotNull, allocateCell<JSRopeString>(vm.heap)) JSRopeString(vm);
+        newString->finishCreation(vm, s1, s2, s3);
+        return newString;
+    }
+
+    friend JSValue jsStringFromRegisterArray(ExecState*, Register*, unsigned);
+    friend JSValue jsStringFromArguments(ExecState*, JSValue);
+
+    JS_EXPORT_PRIVATE void resolveRope(ExecState*) const;
+    JS_EXPORT_PRIVATE void resolveRopeToAtomicString(ExecState*) const;
+    JS_EXPORT_PRIVATE RefPtr<AtomicStringImpl> resolveRopeToExistingAtomicString(ExecState*) const;
+    void resolveRopeSlowCase8(LChar*) const;
+    void resolveRopeSlowCase(UChar*) const;
+    void outOfMemory(ExecState*) const;
+    void resolveRopeInternal8(LChar*) const;
+    void resolveRopeInternal8NoSubstring(LChar*) const;
+    void resolveRopeInternal16(UChar*) const;
+    void resolveRopeInternal16NoSubstring(UChar*) const;
+    void clearFibers() const;
+    StringView unsafeView(ExecState&) const;
+    StringViewWithUnderlyingString viewWithUnderlyingString(ExecState&) const;
+
+    WriteBarrierBase<JSString>& fiber(unsigned i) const
+    {
+        ASSERT(!isSubstring());
+        ASSERT(i < s_maxInternalRopeLength);
+        return u[i].string;
+    }
+
+    WriteBarrierBase<JSString>& substringBase() const
+    {
+        return u[1].string;
+    }
+
+    uintptr_t& substringOffset() const
+    {
+        return u[2].number;
+    }
+
+    static uintptr_t notSubstringSentinel()
+    {
+        return 0;
+    }
+
+    static uintptr_t substringSentinel()
+    {
+        return 1;
+    }
+
+    bool isSubstring() const
+    {
+        return u[0].number == substringSentinel();
+    }
+
+    void setIsSubstring(bool isSubstring)
+    {
+        u[0].number = isSubstring ? substringSentinel() : notSubstringSentinel();
+    }
+
+    mutable union {
+        uintptr_t number;
+        WriteBarrierBase<JSString> string;
+    } u[s_maxInternalRopeLength];
+
+
+    friend JSString* jsString(ExecState*, JSString*, JSString*);
+    friend JSString* jsString(ExecState*, JSString*, JSString*, JSString*);
+    friend JSString* jsString(ExecState*, const String&, const String&, const String&);
+};
+
+JS_EXPORT_PRIVATE JSString* jsStringWithCacheSlowCase(VM&, StringImpl&);
+
+inline const StringImpl* JSString::tryGetValueImpl() const
+{
+    return m_value.impl();
+}
+
+inline JSString* asString(JSValue value)
+{
+    ASSERT(value.asCell()->isString());
+    return jsCast<JSString*>(value.asCell());
+}
+
+// This MUST NOT GC.
+inline JSString* jsEmptyString(VM* vm)
+{
+    return vm->smallStrings.emptyString();
+}
+
+ALWAYS_INLINE JSString* jsSingleCharacterString(VM* vm, UChar c)
+{
+    if (c <= maxSingleCharacterString)
+        return vm->smallStrings.singleCharacterString(c);
+    return JSString::create(*vm, String(&c, 1).impl());
+}
+
+inline JSString* jsNontrivialString(VM* vm, const String& s)
+{
+    ASSERT(s.length() > 1);
+    return JSString::create(*vm, s.impl());
+}
+
+inline JSString* jsNontrivialString(VM* vm, String&& s)
+{
+    ASSERT(s.length() > 1);
+    return JSString::create(*vm, s.releaseImpl());
+}
+
+ALWAYS_INLINE Identifier JSString::toIdentifier(ExecState* exec) const
+{
+    return Identifier::fromString(exec, toAtomicString(exec));
+}
+
+ALWAYS_INLINE AtomicString JSString::toAtomicString(ExecState* exec) const
+{
+    if (isRope())
+        static_cast<const JSRopeString*>(this)->resolveRopeToAtomicString(exec);
+    return AtomicString(m_value);
+}
+
+ALWAYS_INLINE RefPtr<AtomicStringImpl> JSString::toExistingAtomicString(ExecState* exec) const
+{
+    if (isRope())
+        return static_cast<const JSRopeString*>(this)->resolveRopeToExistingAtomicString(exec);
+    if (m_value.impl()->isAtomic())
+        return static_cast<AtomicStringImpl*>(m_value.impl());
+    return AtomicStringImpl::lookUp(m_value.impl());
+}
+
+inline const String& JSString::value(ExecState* exec) const
+{
+    if (isRope())
+        static_cast<const JSRopeString*>(this)->resolveRope(exec);
+    return m_value;
+}
+
+inline const String& JSString::tryGetValue() const
+{
+    if (isRope())
+        static_cast<const JSRopeString*>(this)->resolveRope(0);
+    return m_value;
+}
+
+inline JSString* JSString::getIndex(ExecState* exec, unsigned i)
+{
+    ASSERT(canGetIndex(i));
+    return jsSingleCharacterString(exec, unsafeView(*exec)[i]);
+}
+
+inline JSString* jsString(VM* vm, const String& s)
+{
+    int size = s.length();
+    if (!size)
+        return vm->smallStrings.emptyString();
+    if (size == 1) {
+        UChar c = s.characterAt(0);
+        if (c <= maxSingleCharacterString)
+            return vm->smallStrings.singleCharacterString(c);
+    }
+    return JSString::create(*vm, s.impl());
+}
+
+inline JSString* jsSubstring(VM& vm, ExecState* exec, JSString* s, unsigned offset, unsigned length)
+{
+    ASSERT(offset <= static_cast<unsigned>(s->length()));
+    ASSERT(length <= static_cast<unsigned>(s->length()));
+    ASSERT(offset + length <= static_cast<unsigned>(s->length()));
+    if (!length)
+        return vm.smallStrings.emptyString();
+    if (!offset && length == s->length())
+        return s;
+    return JSRopeString::create(vm, exec, s, offset, length);
+}
+
+inline JSString* jsSubstringOfResolved(VM& vm, GCDeferralContext* deferralContext, JSString* s, unsigned offset, unsigned length)
+{
+    ASSERT(offset <= static_cast<unsigned>(s->length()));
+    ASSERT(length <= static_cast<unsigned>(s->length()));
+    ASSERT(offset + length <= static_cast<unsigned>(s->length()));
+    if (!length)
+        return vm.smallStrings.emptyString();
+    if (!offset && length == s->length())
+        return s;
+    return JSRopeString::createSubstringOfResolved(vm, deferralContext, s, offset, length);
+}
+
+inline JSString* jsSubstringOfResolved(VM& vm, JSString* s, unsigned offset, unsigned length)
+{
+    return jsSubstringOfResolved(vm, nullptr, s, offset, length);
+}
+
+inline JSString* jsSubstring(ExecState* exec, JSString* s, unsigned offset, unsigned length)
+{
+    return jsSubstring(exec->vm(), exec, s, offset, length);
+}
+
+inline JSString* jsSubstring(VM* vm, const String& s, unsigned offset, unsigned length)
+{
+    ASSERT(offset <= static_cast<unsigned>(s.length()));
+    ASSERT(length <= static_cast<unsigned>(s.length()));
+    ASSERT(offset + length <= static_cast<unsigned>(s.length()));
+    if (!length)
+        return vm->smallStrings.emptyString();
+    if (length == 1) {
+        UChar c = s.characterAt(offset);
+        if (c <= maxSingleCharacterString)
+            return vm->smallStrings.singleCharacterString(c);
+    }
+    return JSString::createHasOtherOwner(*vm, StringImpl::createSubstringSharingImpl(*s.impl(), offset, length));
+}
+
+inline JSString* jsOwnedString(VM* vm, const String& s)
+{
+    int size = s.length();
+    if (!size)
+        return vm->smallStrings.emptyString();
+    if (size == 1) {
+        UChar c = s.characterAt(0);
+        if (c <= maxSingleCharacterString)
+            return vm->smallStrings.singleCharacterString(c);
+    }
+    return JSString::createHasOtherOwner(*vm, s.impl());
+}
+
+inline JSRopeString* jsStringBuilder(VM* vm)
+{
+    return JSRopeString::createNull(*vm);
+}
+
+inline JSString* jsEmptyString(ExecState* exec) { return jsEmptyString(&exec->vm()); }
+inline JSString* jsString(ExecState* exec, const String& s) { return jsString(&exec->vm(), s); }
+inline JSString* jsSingleCharacterString(ExecState* exec, UChar c) { return jsSingleCharacterString(&exec->vm(), c); }
+inline JSString* jsSubstring(ExecState* exec, const String& s, unsigned offset, unsigned length) { return jsSubstring(&exec->vm(), s, offset, length); }
+inline JSString* jsNontrivialString(ExecState* exec, const String& s) { return jsNontrivialString(&exec->vm(), s); }
+inline JSString* jsNontrivialString(ExecState* exec, String&& s) { return jsNontrivialString(&exec->vm(), WTFMove(s)); }
+inline JSString* jsOwnedString(ExecState* exec, const String& s) { return jsOwnedString(&exec->vm(), s); }
+
+ALWAYS_INLINE JSString* jsStringWithCache(ExecState* exec, const String& s)
+{
+    VM& vm = exec->vm();
+    StringImpl* stringImpl = s.impl();
+    if (!stringImpl || !stringImpl->length())
+        return jsEmptyString(&vm);
+
+    if (stringImpl->length() == 1) {
+        UChar singleCharacter = (*stringImpl)[0u];
+        if (singleCharacter <= maxSingleCharacterString)
+            return vm.smallStrings.singleCharacterString(static_cast<unsigned char>(singleCharacter));
+    }
+
+    if (JSString* lastCachedString = vm.lastCachedString.get()) {
+        if (lastCachedString->tryGetValueImpl() == stringImpl)
+            return lastCachedString;
+    }
+
+    return jsStringWithCacheSlowCase(vm, *stringImpl);
+}
+
+ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    if (propertyName == exec->propertyNames().length) {
+        slot.setValue(this, DontEnum | DontDelete | ReadOnly, jsNumber(length()));
+        return true;
+    }
+
+    std::optional<uint32_t> index = parseIndex(propertyName);
+    if (index && index.value() < length()) {
+        slot.setValue(this, DontDelete | ReadOnly, getIndex(exec, index.value()));
+        return true;
+    }
+
+    return false;
+}
+
+ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < length()) {
+        slot.setValue(this, DontDelete | ReadOnly, getIndex(exec, propertyName));
+        return true;
+    }
+
+    return false;
+}
+
+inline bool isJSString(JSCell* cell)
+{
+    return cell->type() == StringType;
+}
+
+inline bool isJSString(JSValue v)
+{
+    return v.isCell() && isJSString(v.asCell());
+}
+
+ALWAYS_INLINE StringView JSRopeString::unsafeView(ExecState& state) const
+{
+    if (isSubstring()) {
+        if (is8Bit())
+            return StringView(substringBase()->m_value.characters8() + substringOffset(), length());
+        return StringView(substringBase()->m_value.characters16() + substringOffset(), length());
+    }
+    resolveRope(&state);
+    return m_value;
+}
+
+ALWAYS_INLINE StringViewWithUnderlyingString JSRopeString::viewWithUnderlyingString(ExecState& state) const
+{
+    if (isSubstring()) {
+        auto& base = substringBase()->m_value;
+        if (is8Bit())
+            return { { base.characters8() + substringOffset(), length() }, base };
+        return { { base.characters16() + substringOffset(), length() }, base };
+    }
+    resolveRope(&state);
+    return { m_value, m_value };
+}
+
+ALWAYS_INLINE StringView JSString::unsafeView(ExecState& state) const
+{
+    if (isRope())
+        return static_cast<const JSRopeString*>(this)->unsafeView(state);
+    return m_value;
+}
+
+ALWAYS_INLINE StringViewWithUnderlyingString JSString::viewWithUnderlyingString(ExecState& state) const
+{
+    if (isRope())
+        return static_cast<const JSRopeString&>(*this).viewWithUnderlyingString(state);
+    return { m_value, m_value };
+}
+
+inline bool JSString::isSubstring() const
+{
+    return isRope() && static_cast<const JSRopeString*>(this)->isSubstring();
+}
+
+// --- JSValue inlines ----------------------------
+
+inline bool JSValue::toBoolean(ExecState* exec) const
+{
+    if (isInt32())
+        return asInt32();
+    if (isDouble())
+        return asDouble() > 0.0 || asDouble() < 0.0; // false for NaN
+    if (isCell())
+        return asCell()->toBoolean(exec);
+    return isTrue(); // false, null, and undefined all convert to false.
+}
+
+inline JSString* JSValue::toString(ExecState* exec) const
+{
+    if (isString())
+        return asString(asCell());
+    bool returnEmptyStringOnError = true;
+    return toStringSlowCase(exec, returnEmptyStringOnError);
+}
+
+inline JSString* JSValue::toStringOrNull(ExecState* exec) const
+{
+    if (isString())
+        return asString(asCell());
+    bool returnEmptyStringOnError = false;
+    return toStringSlowCase(exec, returnEmptyStringOnError);
+}
+
+inline String JSValue::toWTFString(ExecState* exec) const
+{
+    if (isString())
+        return static_cast<JSString*>(asCell())->value(exec);
+    return toWTFStringSlowCase(exec);
+}
+
+} // namespace JSC
diff --git a/runtime/JSStringBuilder.h b/runtime/JSStringBuilder.h
new file mode 100644
index 0000000..88ad6dd
--- /dev/null
+++ b/runtime/JSStringBuilder.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ExceptionHelpers.h"
+#include "JSString.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+// FIXME: Should move the last few callers over from this to WTF::StringBuilder.
+class JSStringBuilder {
+public:
+    JSStringBuilder()
+        : m_okay(true)
+        , m_is8Bit(true)
+    {
+    }
+
+    void append(LChar character)
+    {
+        if (m_is8Bit) {
+            m_okay &= buffer8.tryAppend(&character, 1);
+            return;
+        }
+        UChar upconvertedCharacter = character;
+        m_okay &= buffer16.tryAppend(&upconvertedCharacter, 1);
+    }
+
+    void append(UChar character)
+    {
+        if (m_is8Bit) {
+            if (character < 0x100) {
+                LChar narrowedCharacter = character;
+                m_okay &= buffer8.tryAppend(&narrowedCharacter, 1);
+                return;
+            }
+            upConvert();
+        }
+        m_okay &= buffer16.tryAppend(&character, 1);
+    }
+
+    void append(const char* str)
+    {
+        append(reinterpret_cast<const LChar*>(str), strlen(str));
+    }
+
+    JSValue build(ExecState* exec)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        if (!m_okay)
+            return throwOutOfMemoryError(exec, scope);
+        if (m_is8Bit) {
+            buffer8.shrinkToFit();
+            if (!buffer8.data())
+                return throwOutOfMemoryError(exec, scope);
+            return jsString(exec, String::adopt(WTFMove(buffer8)));
+        }
+        buffer16.shrinkToFit();
+        if (!buffer16.data())
+            return throwOutOfMemoryError(exec, scope);
+        return jsString(exec, String::adopt(WTFMove(buffer16)));
+    }
+
+private:
+    void append(const LChar* characters, size_t length)
+    {
+        if (m_is8Bit) {
+            m_okay &= buffer8.tryAppend(characters, length);
+            return;
+        }
+        // FIXME: There must be a more efficient way of doing this.
+        m_okay &= buffer16.tryReserveCapacity(buffer16.size() + length);
+        for (size_t i = 0; i < length; i++) {
+            UChar upconvertedCharacter = characters[i];
+            m_okay &= buffer16.tryAppend(&upconvertedCharacter, 1);
+        }
+    }
+
+    void upConvert()
+    {
+        ASSERT(m_is8Bit);
+        size_t len = buffer8.size();
+
+        for (size_t i = 0; i < len; i++)
+            buffer16.append(buffer8[i]);
+
+        buffer8.clear();
+        m_is8Bit = false;
+    }
+
+    Vector<LChar, 64, UnsafeVectorOverflow> buffer8;
+    Vector<UChar, 64, UnsafeVectorOverflow> buffer16;
+    bool m_okay;
+    bool m_is8Bit;
+};
+
+template<typename StringType>
+inline JSValue jsMakeNontrivialString(ExecState* exec, StringType&& string)
+{
+    return jsNontrivialString(exec, std::forward<StringType>(string));
+}
+
+template<typename StringType, typename... StringTypes>
+inline JSValue jsMakeNontrivialString(ExecState* exec, const StringType& string, const StringTypes&... strings)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    String result = tryMakeString(string, strings...);
+    if (UNLIKELY(!result || !JSString::isValidLength(result.length())))
+        return throwOutOfMemoryError(exec, scope);
+    return jsNontrivialString(exec, WTFMove(result));
+}
+
+} // namespace JSC
diff --git a/runtime/JSStringInlines.h b/runtime/JSStringInlines.h
new file mode 100644
index 0000000..bf21c4d
--- /dev/null
+++ b/runtime/JSStringInlines.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSString.h"
+
+namespace JSC {
+    
+bool JSString::equal(ExecState* exec, JSString* other) const
+{
+    if (isRope() || other->isRope())
+        return equalSlowCase(exec, other);
+    return WTF::equal(*m_value.impl(), *other->m_value.impl());
+}
+
+} // namespace JSC
diff --git a/runtime/JSStringIterator.cpp b/runtime/JSStringIterator.cpp
new file mode 100644
index 0000000..2a16fdf
--- /dev/null
+++ b/runtime/JSStringIterator.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSStringIterator.h"
+
+#include "BuiltinNames.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSStringIterator::s_info = { "String Iterator", &Base::s_info, 0, CREATE_METHOD_TABLE(JSStringIterator) };
+
+void JSStringIterator::finishCreation(VM& vm, JSGlobalObject*, JSString* iteratedString)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirect(vm, vm.propertyNames->builtinNames().iteratedStringPrivateName(), iteratedString);
+    putDirect(vm, vm.propertyNames->builtinNames().stringIteratorNextIndexPrivateName(), jsNumber(0));
+}
+
+JSValue JSStringIterator::iteratedValue(ExecState* exec) const
+{
+    return getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().iteratedStringPrivateName());
+}
+
+JSStringIterator* JSStringIterator::clone(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSValue iteratedString = getDirect(vm, vm.propertyNames->builtinNames().iteratedStringPrivateName());
+    JSValue nextIndex = getDirect(vm, vm.propertyNames->builtinNames().stringIteratorNextIndexPrivateName());
+
+    auto clone = JSStringIterator::create(exec, exec->jsCallee()->globalObject()->stringIteratorStructure(), asString(iteratedString));
+    clone->putDirect(vm, vm.propertyNames->builtinNames().stringIteratorNextIndexPrivateName(), nextIndex);
+    return clone;
+}
+
+} // namespace JSC
diff --git a/runtime/JSStringIterator.h b/runtime/JSStringIterator.h
new file mode 100644
index 0000000..64a2b3a
--- /dev/null
+++ b/runtime/JSStringIterator.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSStringIterator : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static JSStringIterator* create(ExecState* exec, Structure* structure, JSString* iteratedString)
+    {
+        VM& vm = exec->vm();
+        JSStringIterator* instance = new (NotNull, allocateCell<JSStringIterator>(vm.heap)) JSStringIterator(vm, structure);
+        instance->finishCreation(vm, structure->globalObject(), iteratedString);
+        return instance;
+    }
+
+    JSValue iteratedValue(ExecState*) const;
+    JSStringIterator* clone(ExecState*);
+
+private:
+    JSStringIterator(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    void finishCreation(VM&, JSGlobalObject*, JSString* iteratedString);
+};
+
+} // namespace JSC
diff --git a/runtime/JSStringJoiner.cpp b/runtime/JSStringJoiner.cpp
new file mode 100644
index 0000000..ea930b5
--- /dev/null
+++ b/runtime/JSStringJoiner.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSStringJoiner.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+JSStringJoiner::~JSStringJoiner()
+{
+}
+
+template<typename CharacterType>
+static inline void appendStringToData(CharacterType*& data, StringView string)
+{
+    string.getCharactersWithUpconvert(data);
+    data += string.length();
+}
+
+template<typename CharacterType>
+static inline String joinStrings(const Vector<StringViewWithUnderlyingString>& strings, StringView separator, unsigned joinedLength)
+{
+    ASSERT(joinedLength);
+
+    CharacterType* data;
+    String result = StringImpl::tryCreateUninitialized(joinedLength, data);
+    if (UNLIKELY(result.isNull()))
+        return result;
+
+    appendStringToData(data, strings[0].view);
+
+    unsigned size = strings.size();
+
+    switch (separator.length()) {
+    case 0:
+        for (unsigned i = 1; i < size; ++i)
+            appendStringToData(data, strings[i].view);
+        break;
+    case 1: {
+        CharacterType separatorCharacter = separator[0];
+        for (unsigned i = 1; i < size; ++i) {
+            *data++ = separatorCharacter;
+            appendStringToData(data, strings[i].view);
+        }
+        break;
+    }
+    default:
+        for (unsigned i = 1; i < size; ++i) {
+            appendStringToData(data, separator);
+            appendStringToData(data, strings[i].view);
+        }
+    }
+    ASSERT(data == result.characters<CharacterType>() + joinedLength);
+
+    return result;
+}
+
+inline unsigned JSStringJoiner::joinedLength(ExecState& state) const
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    unsigned numberOfStrings = m_strings.size();
+    if (!numberOfStrings)
+        return 0;
+
+    Checked<int32_t, RecordOverflow> separatorLength = m_separator.length();
+    Checked<int32_t, RecordOverflow> totalSeparatorsLength = separatorLength * (numberOfStrings - 1);
+    Checked<int32_t, RecordOverflow> totalLength = totalSeparatorsLength + m_accumulatedStringsLength;
+
+    int32_t result;
+    if (totalLength.safeGet(result) == CheckedState::DidOverflow) {
+        throwOutOfMemoryError(&state, scope);
+        return 0;
+    }
+    return result;
+}
+
+JSValue JSStringJoiner::join(ExecState& state)
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    ASSERT(m_strings.size() <= m_strings.capacity());
+
+    unsigned length = joinedLength(state);
+    RETURN_IF_EXCEPTION(scope, JSValue());
+
+    if (!length)
+        return jsEmptyString(&state);
+
+    String result;
+    if (m_isAll8Bit)
+        result = joinStrings<LChar>(m_strings, m_separator, length);
+    else
+        result = joinStrings<UChar>(m_strings, m_separator, length);
+
+    if (result.isNull())
+        return throwOutOfMemoryError(&state, scope);
+
+    return jsString(&state, WTFMove(result));
+}
+
+}
diff --git a/runtime/JSStringJoiner.h b/runtime/JSStringJoiner.h
new file mode 100644
index 0000000..34ace14
--- /dev/null
+++ b/runtime/JSStringJoiner.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ExceptionHelpers.h"
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+class JSStringJoiner {
+public:
+    JSStringJoiner(ExecState&, LChar separator, unsigned stringCount);
+    JSStringJoiner(ExecState&, StringView separator, unsigned stringCount);
+    ~JSStringJoiner();
+
+    void append(ExecState&, JSValue);
+    bool appendWithoutSideEffects(ExecState&, JSValue);
+    void appendEmptyString();
+
+    JSValue join(ExecState&);
+
+private:
+    void append(StringViewWithUnderlyingString&&);
+    void append8Bit(const String&);
+    void appendLiteral(const Identifier&);
+    unsigned joinedLength(ExecState&) const;
+
+    LChar m_singleCharacterSeparator;
+    StringView m_separator;
+    Vector<StringViewWithUnderlyingString> m_strings;
+    Checked<unsigned, RecordOverflow> m_accumulatedStringsLength;
+    bool m_isAll8Bit { true };
+};
+
+inline JSStringJoiner::JSStringJoiner(ExecState& state, StringView separator, unsigned stringCount)
+    : m_separator(separator)
+    , m_isAll8Bit(m_separator.is8Bit())
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!m_strings.tryReserveCapacity(stringCount)))
+        throwOutOfMemoryError(&state, scope);
+}
+
+inline JSStringJoiner::JSStringJoiner(ExecState& state, LChar separator, unsigned stringCount)
+    : m_singleCharacterSeparator(separator)
+    , m_separator { &m_singleCharacterSeparator, 1 }
+{
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!m_strings.tryReserveCapacity(stringCount)))
+        throwOutOfMemoryError(&state, scope);
+}
+
+ALWAYS_INLINE void JSStringJoiner::append(StringViewWithUnderlyingString&& string)
+{
+    m_accumulatedStringsLength += string.view.length();
+    m_isAll8Bit = m_isAll8Bit && string.view.is8Bit();
+    m_strings.uncheckedAppend(WTFMove(string));
+}
+
+ALWAYS_INLINE void JSStringJoiner::append8Bit(const String& string)
+{
+    ASSERT(string.is8Bit());
+    m_accumulatedStringsLength += string.length();
+    m_strings.uncheckedAppend({ string, string });
+}
+
+ALWAYS_INLINE void JSStringJoiner::appendLiteral(const Identifier& literal)
+{
+    m_accumulatedStringsLength += literal.length();
+    ASSERT(literal.string().is8Bit());
+    m_strings.uncheckedAppend({ literal.string(), { } });
+}
+
+ALWAYS_INLINE void JSStringJoiner::appendEmptyString()
+{
+    m_strings.uncheckedAppend({ { }, { } });
+}
+
+ALWAYS_INLINE bool JSStringJoiner::appendWithoutSideEffects(ExecState& state, JSValue value)
+{
+    // The following code differs from using the result of JSValue::toString in the following ways:
+    // 1) It's inlined more than JSValue::toString is.
+    // 2) It includes conversion to WTF::String in a way that avoids allocating copies of substrings.
+    // 3) It doesn't create a JSString for numbers, true, or false.
+    // 4) It turns undefined and null into the empty string instead of "undefined" and "null".
+    // 5) It uses optimized code paths for all the cases known to be 8-bit and for the empty string.
+    // If we might make an effectful calls, return false. Otherwise return true.
+
+    if (value.isCell()) {
+        JSString* jsString;
+        if (!value.asCell()->isString())
+            return false;
+        jsString = asString(value);
+        append(jsString->viewWithUnderlyingString(state));
+        return true;
+    }
+
+    if (value.isInt32()) {
+        append8Bit(state.vm().numericStrings.add(value.asInt32()));
+        return true;
+    }
+    if (value.isDouble()) {
+        append8Bit(state.vm().numericStrings.add(value.asDouble()));
+        return true;
+    }
+    if (value.isTrue()) {
+        append8Bit(state.vm().propertyNames->trueKeyword.string());
+        return true;
+    }
+    if (value.isFalse()) {
+        append8Bit(state.vm().propertyNames->falseKeyword.string());
+        return true;
+    }
+    ASSERT(value.isUndefinedOrNull());
+    appendEmptyString();
+    return true;
+}
+
+ALWAYS_INLINE void JSStringJoiner::append(ExecState& state, JSValue value)
+{
+    if (!appendWithoutSideEffects(state, value)) {
+        JSString* jsString = value.toString(&state);
+        append(jsString->viewWithUnderlyingString(state));
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/JSStringSubspace.cpp b/runtime/JSStringSubspace.cpp
new file mode 100644
index 0000000..40130c4
--- /dev/null
+++ b/runtime/JSStringSubspace.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSStringSubspace.h"
+
+#include "MarkedBlockInlines.h"
+#include "JSCInlines.h"
+#include "SubspaceInlines.h"
+
+namespace JSC {
+
+namespace {
+
+struct DestroyFunc {
+    ALWAYS_INLINE void operator()(VM&, JSCell* cell) const
+    {
+        static_cast<JSString*>(cell)->JSString::~JSString();
+    }
+};
+
+} // anonymous namespace
+
+JSStringSubspace::JSStringSubspace(CString name, Heap& heap)
+    : Subspace(name, heap, AllocatorAttributes(NeedsDestruction, HeapCell::JSCell))
+{
+}
+
+JSStringSubspace::~JSStringSubspace()
+{
+}
+
+FreeList JSStringSubspace::finishSweep(MarkedBlock::Handle& handle, MarkedBlock::Handle::SweepMode sweepMode)
+{
+    return handle.finishSweepKnowingSubspace(sweepMode, DestroyFunc());
+}
+
+void JSStringSubspace::destroy(VM& vm, JSCell* cell)
+{
+    DestroyFunc()(vm, cell);
+}
+
+} // namespace JSC
+
diff --git a/runtime/JSStringSubspace.h b/runtime/JSStringSubspace.h
new file mode 100644
index 0000000..6accea0
--- /dev/null
+++ b/runtime/JSStringSubspace.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Subspace.h"
+
+namespace JSC {
+
+class JSStringSubspace : public Subspace {
+public:
+    JS_EXPORT_PRIVATE JSStringSubspace(CString name, Heap&);
+    JS_EXPORT_PRIVATE virtual ~JSStringSubspace();
+    
+    FreeList finishSweep(MarkedBlock::Handle&, MarkedBlock::Handle::SweepMode) override;
+    void destroy(VM&, JSCell*) override;
+};
+
+} // namespace JSC
+
diff --git a/runtime/JSSymbolTableObject.cpp b/runtime/JSSymbolTableObject.cpp
new file mode 100644
index 0000000..f1041fb
--- /dev/null
+++ b/runtime/JSSymbolTableObject.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSSymbolTableObject.h"
+
+#include "JSCInlines.h"
+#include "PropertyNameArray.h"
+
+namespace JSC {
+
+const ClassInfo JSSymbolTableObject::s_info = { "SymbolTableObject", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSSymbolTableObject) };
+
+void JSSymbolTableObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSSymbolTableObject* thisObject = jsCast<JSSymbolTableObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_symbolTable);
+}
+
+bool JSSymbolTableObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    JSSymbolTableObject* thisObject = jsCast<JSSymbolTableObject*>(cell);
+    if (thisObject->symbolTable()->contains(propertyName.uid()))
+        return false;
+
+    return Base::deleteProperty(thisObject, exec, propertyName);
+}
+
+void JSSymbolTableObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    JSSymbolTableObject* thisObject = jsCast<JSSymbolTableObject*>(object);
+    {
+        ConcurrentJSLocker locker(thisObject->symbolTable()->m_lock);
+        SymbolTable::Map::iterator end = thisObject->symbolTable()->end(locker);
+        for (SymbolTable::Map::iterator it = thisObject->symbolTable()->begin(locker); it != end; ++it) {
+            if (!(it->value.getAttributes() & DontEnum) || mode.includeDontEnumProperties()) {
+                if (it->key->isSymbol() && !propertyNames.includeSymbolProperties())
+                    continue;
+                propertyNames.add(Identifier::fromUid(exec, it->key.get()));
+            }
+        }
+    }
+
+    Base::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);
+}
+
+} // namespace JSC
diff --git a/runtime/JSSymbolTableObject.h b/runtime/JSSymbolTableObject.h
new file mode 100644
index 0000000..366b5a0
--- /dev/null
+++ b/runtime/JSSymbolTableObject.h
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2012, 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSScope.h"
+#include "PropertyDescriptor.h"
+#include "SymbolTable.h"
+#include "ThrowScope.h"
+#include "VariableWriteFireDetail.h"
+
+namespace JSC {
+
+class JSSymbolTableObject : public JSScope {
+public:
+    typedef JSScope Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetPropertyNames;
+    
+    SymbolTable* symbolTable() const { return m_symbolTable.get(); }
+    
+    JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    
+    static ptrdiff_t offsetOfSymbolTable() { return OBJECT_OFFSETOF(JSSymbolTableObject, m_symbolTable); }
+
+    DECLARE_EXPORT_INFO;
+
+protected:
+    JSSymbolTableObject(VM& vm, Structure* structure, JSScope* scope)
+        : Base(vm, structure, scope)
+    {
+    }
+    
+    JSSymbolTableObject(VM& vm, Structure* structure, JSScope* scope, SymbolTable* symbolTable)
+        : Base(vm, structure, scope)
+    {
+        ASSERT(symbolTable);
+        setSymbolTable(vm, symbolTable);
+    }
+    
+    void setSymbolTable(VM& vm, SymbolTable* symbolTable)
+    {
+        ASSERT(!m_symbolTable);
+        symbolTable->singletonScope()->notifyWrite(vm, this, "Allocated a scope");
+        m_symbolTable.set(vm, this, symbolTable);
+    }
+    
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+private:
+    WriteBarrier<SymbolTable> m_symbolTable;
+};
+
+template<typename SymbolTableObjectType>
+inline bool symbolTableGet(
+    SymbolTableObjectType* object, PropertyName propertyName, PropertySlot& slot)
+{
+    SymbolTable& symbolTable = *object->symbolTable();
+    ConcurrentJSLocker locker(symbolTable.m_lock);
+    SymbolTable::Map::iterator iter = symbolTable.find(locker, propertyName.uid());
+    if (iter == symbolTable.end(locker))
+        return false;
+    SymbolTableEntry::Fast entry = iter->value;
+    ASSERT(!entry.isNull());
+
+    ScopeOffset offset = entry.scopeOffset();
+    // Defend against the inspector asking for a var after it has been optimized out.
+    if (!object->isValidScopeOffset(offset))
+        return false;
+
+    slot.setValue(object, entry.getAttributes() | DontDelete, object->variableAt(offset).get());
+    return true;
+}
+
+template<typename SymbolTableObjectType>
+inline bool symbolTableGet(
+    SymbolTableObjectType* object, PropertyName propertyName, PropertyDescriptor& descriptor)
+{
+    SymbolTable& symbolTable = *object->symbolTable();
+    ConcurrentJSLocker locker(symbolTable.m_lock);
+    SymbolTable::Map::iterator iter = symbolTable.find(locker, propertyName.uid());
+    if (iter == symbolTable.end(locker))
+        return false;
+    SymbolTableEntry::Fast entry = iter->value;
+    ASSERT(!entry.isNull());
+
+    ScopeOffset offset = entry.scopeOffset();
+    // Defend against the inspector asking for a var after it has been optimized out.
+    if (!object->isValidScopeOffset(offset))
+        return false;
+
+    descriptor.setDescriptor(object->variableAt(offset).get(), entry.getAttributes() | DontDelete);
+    return true;
+}
+
+template<typename SymbolTableObjectType>
+inline bool symbolTableGet(
+    SymbolTableObjectType* object, PropertyName propertyName, PropertySlot& slot,
+    bool& slotIsWriteable)
+{
+    SymbolTable& symbolTable = *object->symbolTable();
+    ConcurrentJSLocker locker(symbolTable.m_lock);
+    SymbolTable::Map::iterator iter = symbolTable.find(locker, propertyName.uid());
+    if (iter == symbolTable.end(locker))
+        return false;
+    SymbolTableEntry::Fast entry = iter->value;
+    ASSERT(!entry.isNull());
+
+    ScopeOffset offset = entry.scopeOffset();
+    // Defend against the inspector asking for a var after it has been optimized out.
+    if (!object->isValidScopeOffset(offset))
+        return false;
+
+    slot.setValue(object, entry.getAttributes() | DontDelete, object->variableAt(offset).get());
+    slotIsWriteable = !entry.isReadOnly();
+    return true;
+}
+
+template<typename SymbolTableObjectType>
+ALWAYS_INLINE void symbolTablePutTouchWatchpointSet(VM& vm, SymbolTableObjectType* object, PropertyName propertyName, JSValue value, WriteBarrierBase<Unknown>* reg, WatchpointSet* set)
+{
+    reg->set(vm, object, value);
+    if (set)
+        VariableWriteFireDetail::touch(vm, set, object, propertyName);
+}
+
+template<typename SymbolTableObjectType>
+ALWAYS_INLINE void symbolTablePutInvalidateWatchpointSet(VM& vm, SymbolTableObjectType* object, PropertyName propertyName, JSValue value, WriteBarrierBase<Unknown>* reg, WatchpointSet* set)
+{
+    reg->set(vm, object, value);
+    if (set)
+        set->invalidate(vm, VariableWriteFireDetail(object, propertyName)); // Don't mess around - if we had found this statically, we would have invalidated it.
+}
+
+enum class SymbolTablePutMode {
+    Touch,
+    Invalidate
+};
+
+template<SymbolTablePutMode symbolTablePutMode, typename SymbolTableObjectType>
+inline bool symbolTablePut(SymbolTableObjectType* object, ExecState* exec, PropertyName propertyName, JSValue value, bool shouldThrowReadOnlyError, bool ignoreReadOnlyErrors, bool& putResult)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    WatchpointSet* set = nullptr;
+    WriteBarrierBase<Unknown>* reg;
+    {
+        SymbolTable& symbolTable = *object->symbolTable();
+        // FIXME: This is very suspicious. We shouldn't need a GC-safe lock here.
+        // https://bugs.webkit.org/show_bug.cgi?id=134601
+        GCSafeConcurrentJSLocker locker(symbolTable.m_lock, vm.heap);
+        SymbolTable::Map::iterator iter = symbolTable.find(locker, propertyName.uid());
+        if (iter == symbolTable.end(locker))
+            return false;
+        bool wasFat;
+        SymbolTableEntry::Fast fastEntry = iter->value.getFast(wasFat);
+        ASSERT(!fastEntry.isNull());
+        if (fastEntry.isReadOnly() && !ignoreReadOnlyErrors) {
+            if (shouldThrowReadOnlyError)
+                throwTypeError(exec, scope, ASCIILiteral(ReadonlyPropertyWriteError));
+            putResult = false;
+            return true;
+        }
+
+        ScopeOffset offset = fastEntry.scopeOffset();
+
+        // Defend against the inspector asking for a var after it has been optimized out.
+        if (!object->isValidScopeOffset(offset))
+            return false;
+
+        set = iter->value.watchpointSet();
+        reg = &object->variableAt(offset);
+    }
+    // I'd prefer we not hold lock while executing barriers, since I prefer to reserve
+    // the right for barriers to be able to trigger GC. And I don't want to hold VM
+    // locks while GC'ing.
+    if (symbolTablePutMode == SymbolTablePutMode::Invalidate)
+        symbolTablePutInvalidateWatchpointSet(vm, object, propertyName, value, reg, set);
+    else
+        symbolTablePutTouchWatchpointSet(vm, object, propertyName, value, reg, set);
+    putResult = true;
+    return true;
+}
+
+template<typename SymbolTableObjectType>
+inline bool symbolTablePutTouchWatchpointSet(
+    SymbolTableObjectType* object, ExecState* exec, PropertyName propertyName, JSValue value,
+    bool shouldThrowReadOnlyError, bool ignoreReadOnlyErrors, bool& putResult)
+{
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(object));
+    return symbolTablePut<SymbolTablePutMode::Touch>(object, exec, propertyName, value, shouldThrowReadOnlyError, ignoreReadOnlyErrors, putResult);
+}
+
+template<typename SymbolTableObjectType>
+inline bool symbolTablePutInvalidateWatchpointSet(
+    SymbolTableObjectType* object, ExecState* exec, PropertyName propertyName, JSValue value,
+    bool shouldThrowReadOnlyError, bool ignoreReadOnlyErrors, bool& putResult)
+{
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(object));
+    return symbolTablePut<SymbolTablePutMode::Invalidate>(object, exec, propertyName, value, shouldThrowReadOnlyError, ignoreReadOnlyErrors, putResult);
+}
+
+} // namespace JSC
diff --git a/runtime/JSTemplateRegistryKey.cpp b/runtime/JSTemplateRegistryKey.cpp
new file mode 100644
index 0000000..2f98ab1
--- /dev/null
+++ b/runtime/JSTemplateRegistryKey.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSTemplateRegistryKey.h"
+
+#include "JSCInlines.h"
+#include "VM.h"
+
+namespace JSC {
+
+const ClassInfo JSTemplateRegistryKey::s_info = { "TemplateRegistryKey", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSTemplateRegistryKey) };
+
+
+JSTemplateRegistryKey::JSTemplateRegistryKey(VM& vm, Ref<TemplateRegistryKey>&& templateRegistryKey)
+    : Base(vm, vm.templateRegistryKeyStructure.get())
+    , m_templateRegistryKey(WTFMove(templateRegistryKey))
+{
+}
+
+JSTemplateRegistryKey* JSTemplateRegistryKey::create(VM& vm, Ref<TemplateRegistryKey>&& templateRegistryKey)
+{
+    JSTemplateRegistryKey* result = new (NotNull, allocateCell<JSTemplateRegistryKey>(vm.heap)) JSTemplateRegistryKey(vm, WTFMove(templateRegistryKey));
+    result->finishCreation(vm);
+    return result;
+}
+
+void JSTemplateRegistryKey::destroy(JSCell* cell)
+{
+    static_cast<JSTemplateRegistryKey*>(cell)->JSTemplateRegistryKey::~JSTemplateRegistryKey();
+}
+
+} // namespace JSC
diff --git a/runtime/JSTemplateRegistryKey.h b/runtime/JSTemplateRegistryKey.h
new file mode 100644
index 0000000..a843651
--- /dev/null
+++ b/runtime/JSTemplateRegistryKey.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSDestructibleObject.h"
+#include "Structure.h"
+#include "TemplateRegistryKey.h"
+
+namespace JSC {
+
+class JSTemplateRegistryKey final : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static JSTemplateRegistryKey* create(VM&, Ref<TemplateRegistryKey>&&);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+    const TemplateRegistryKey& templateRegistryKey() const { return m_templateRegistryKey.get(); }
+
+protected:
+    static void destroy(JSCell*);
+
+private:
+    JSTemplateRegistryKey(VM&, Ref<TemplateRegistryKey>&&);
+
+    Ref<TemplateRegistryKey> m_templateRegistryKey;
+};
+
+} // namespace JSC
diff --git a/runtime/JSType.h b/runtime/JSType.h
new file mode 100644
index 0000000..05202f3
--- /dev/null
+++ b/runtime/JSType.h
@@ -0,0 +1,103 @@
+/*
+ *  Copyright (C) 2006-2011, 2015-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum JSType : uint8_t {
+    UnspecifiedType,
+    UndefinedType,
+    BooleanType,
+    NumberType,
+    NullType,
+
+    // The CellType value must come before any JSType that is a JSCell.
+    CellType,
+    StringType,
+    SymbolType,
+
+    CustomGetterSetterType,
+    APIValueWrapperType,
+
+    EvalExecutableType,
+    ProgramExecutableType,
+    ModuleProgramExecutableType,
+    FunctionExecutableType,
+    WebAssemblyExecutableType,
+
+    UnlinkedFunctionExecutableType,
+    UnlinkedProgramCodeBlockType,
+    UnlinkedModuleProgramCodeBlockType,
+    UnlinkedEvalCodeBlockType,
+    UnlinkedFunctionCodeBlockType,
+
+    JSFixedArrayType,
+
+    // The ObjectType value must come before any JSType that is a subclass of JSObject.
+    ObjectType,
+    FinalObjectType,
+    JSCalleeType,
+    JSFunctionType,
+    NumberObjectType,
+    ErrorInstanceType,
+    PureForwardingProxyType,
+    ImpureProxyType,
+    WithScopeType,
+    DirectArgumentsType,
+    ScopedArgumentsType,
+
+    ArrayType,
+    DerivedArrayType,
+
+    Int8ArrayType,
+    Int16ArrayType,
+    Int32ArrayType,
+    Uint8ArrayType,
+    Uint8ClampedArrayType,
+    Uint16ArrayType,
+    Uint32ArrayType,
+    Float32ArrayType,
+    Float64ArrayType,
+    DataViewType,
+
+    GetterSetterType,
+
+    // Start environment record types.
+    GlobalObjectType,
+    LexicalEnvironmentType,
+    GlobalLexicalEnvironmentType,
+    ModuleEnvironmentType,
+    StrictEvalActivationType,
+    // End environment record types.
+
+    RegExpObjectType,
+    ProxyObjectType,
+    JSMapType,
+    JSSetType,
+
+    LastJSCObjectType = JSSetType,
+    MaxJSType = 0b11111111,
+};
+
+static_assert(sizeof(JSType) == sizeof(uint8_t), "sizeof(JSType) is one byte.");
+static_assert(LastJSCObjectType < 128, "The highest bit is reserved for embedder's extension.");
+
+} // namespace JSC
diff --git a/runtime/JSTypeInfo.h b/runtime/JSTypeInfo.h
new file mode 100644
index 0000000..16ed4be
--- /dev/null
+++ b/runtime/JSTypeInfo.h
@@ -0,0 +1,121 @@
+// -*- mode: c++; c-basic-offset: 4 -*-
+/*
+ * Copyright (C) 2008, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+// This file would be called TypeInfo.h, but that conflicts with <typeinfo.h>
+// in the STL on systems without case-sensitive file systems. 
+
+#include "JSType.h"
+
+namespace JSC {
+
+class LLIntOffsetsExtractor;
+
+static const unsigned MasqueradesAsUndefined = 1; // WebCore uses MasqueradesAsUndefined to make document.all undetectable.
+static const unsigned ImplementsDefaultHasInstance = 1 << 1;
+static const unsigned TypeOfShouldCallGetCallData = 1 << 2; // Need this flag if you override getCallData() and you want typeof to use this to determine if it should say "function". Currently we always set this flag when we override getCallData().
+static const unsigned OverridesGetOwnPropertySlot = 1 << 3;
+static const unsigned StructureIsImmortal = 1 << 5;
+static const unsigned OverridesToThis = 1 << 6; // If this is false then this returns something other than 'this'. Non-object cells that are visible to JS have this set as do some exotic objects.
+static const unsigned HasStaticPropertyTable = 1 << 7;
+
+static const unsigned ImplementsHasInstance = 1 << 8;
+static const unsigned OverridesGetPropertyNames = 1 << 9;
+static const unsigned ProhibitsPropertyCaching = 1 << 10;
+static const unsigned GetOwnPropertySlotIsImpure = 1 << 11;
+static const unsigned NewImpurePropertyFiresWatchpoints = 1 << 12;
+static const unsigned IsImmutablePrototypeExoticObject = 1 << 13;
+static const unsigned GetOwnPropertySlotIsImpureForPropertyAbsence = 1 << 14;
+static const unsigned InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero = 1 << 15;
+
+class TypeInfo {
+public:
+    typedef uint8_t InlineTypeFlags;
+    typedef uint16_t OutOfLineTypeFlags;
+
+    TypeInfo(JSType type, unsigned flags = 0)
+        : TypeInfo(type, flags & 0xff, flags >> 8)
+    {
+        ASSERT(!(flags >> 24));
+    }
+
+    TypeInfo(JSType type, InlineTypeFlags inlineTypeFlags, OutOfLineTypeFlags outOfLineTypeFlags)
+        : m_type(type)
+        , m_flags(inlineTypeFlags)
+        , m_flags2(outOfLineTypeFlags)
+    {
+    }
+
+    JSType type() const { return static_cast<JSType>(m_type); }
+    bool isObject() const { return isObject(type()); }
+    static bool isObject(JSType type) { return type >= ObjectType; }
+    bool isFinalObject() const { return type() == FinalObjectType; }
+    bool isNumberObject() const { return type() == NumberObjectType; }
+
+    unsigned flags() const { return (static_cast<unsigned>(m_flags2) << 8) | static_cast<unsigned>(m_flags); }
+    bool masqueradesAsUndefined() const { return isSetOnFlags1(MasqueradesAsUndefined); }
+    bool implementsHasInstance() const { return isSetOnFlags2(ImplementsHasInstance); }
+    bool implementsDefaultHasInstance() const { return isSetOnFlags1(ImplementsDefaultHasInstance); }
+    bool typeOfShouldCallGetCallData() const { return isSetOnFlags1(TypeOfShouldCallGetCallData); }
+    bool overridesGetOwnPropertySlot() const { return overridesGetOwnPropertySlot(inlineTypeFlags()); }
+    static bool overridesGetOwnPropertySlot(InlineTypeFlags flags) { return flags & OverridesGetOwnPropertySlot; }
+    static bool hasStaticPropertyTable(InlineTypeFlags flags) { return flags & HasStaticPropertyTable; }
+    bool structureIsImmortal() const { return isSetOnFlags1(StructureIsImmortal); }
+    bool overridesToThis() const { return isSetOnFlags1(OverridesToThis); }
+    bool overridesGetPropertyNames() const { return isSetOnFlags2(OverridesGetPropertyNames); }
+    bool prohibitsPropertyCaching() const { return isSetOnFlags2(ProhibitsPropertyCaching); }
+    bool getOwnPropertySlotIsImpure() const { return isSetOnFlags2(GetOwnPropertySlotIsImpure); }
+    bool getOwnPropertySlotIsImpureForPropertyAbsence() const { return isSetOnFlags2(GetOwnPropertySlotIsImpureForPropertyAbsence); }
+    bool newImpurePropertyFiresWatchpoints() const { return isSetOnFlags2(NewImpurePropertyFiresWatchpoints); }
+    bool isImmutablePrototypeExoticObject() const { return isSetOnFlags2(IsImmutablePrototypeExoticObject); }
+    bool interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero() const { return isSetOnFlags2(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero); }
+
+    static ptrdiff_t flagsOffset()
+    {
+        return OBJECT_OFFSETOF(TypeInfo, m_flags);
+    }
+
+    static ptrdiff_t typeOffset()
+    {
+        return OBJECT_OFFSETOF(TypeInfo, m_type);
+    }
+
+    InlineTypeFlags inlineTypeFlags() const { return m_flags; }
+    OutOfLineTypeFlags outOfLineTypeFlags() const { return m_flags2; }
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    bool isSetOnFlags1(unsigned flag) const { ASSERT(flag <= (1 << 7)); return m_flags & flag; }
+    bool isSetOnFlags2(unsigned flag) const { ASSERT(flag >= (1 << 8)); return m_flags2 & (flag >> 8); }
+
+    uint8_t m_type;
+    uint8_t m_flags;
+    uint16_t m_flags2;
+};
+
+} // namespace JSC
diff --git a/runtime/JSTypedArrayConstructors.cpp b/runtime/JSTypedArrayConstructors.cpp
new file mode 100644
index 0000000..f42f317
--- /dev/null
+++ b/runtime/JSTypedArrayConstructors.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSTypedArrayConstructors.h"
+
+#include "JSGenericTypedArrayViewConstructorInlines.h"
+#include "JSGenericTypedArrayViewInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+#define MAKE_S_INFO(type) \
+    template<> const ClassInfo JS##type##Constructor::s_info = {"Function", &JS##type##Constructor::Base::s_info, 0, CREATE_METHOD_TABLE(JS##type##Constructor)}
+
+MAKE_S_INFO(Int8Array);
+MAKE_S_INFO(Int16Array);
+MAKE_S_INFO(Int32Array);
+MAKE_S_INFO(Uint8Array);
+MAKE_S_INFO(Uint8ClampedArray);
+MAKE_S_INFO(Uint16Array);
+MAKE_S_INFO(Uint32Array);
+MAKE_S_INFO(Float32Array);
+MAKE_S_INFO(Float64Array);
+MAKE_S_INFO(DataView);
+
+} // namespace JSC
+
diff --git a/runtime/JSTypedArrayConstructors.h b/runtime/JSTypedArrayConstructors.h
new file mode 100644
index 0000000..91eaae6
--- /dev/null
+++ b/runtime/JSTypedArrayConstructors.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSDataView.h"
+#include "JSGenericTypedArrayViewConstructor.h"
+#include "JSTypedArrays.h"
+
+namespace JSC {
+
+typedef JSGenericTypedArrayViewConstructor<JSInt8Array> JSInt8ArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSInt16Array> JSInt16ArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSInt32Array> JSInt32ArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSUint8Array> JSUint8ArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSUint8ClampedArray> JSUint8ClampedArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSUint16Array> JSUint16ArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSUint32Array> JSUint32ArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSFloat32Array> JSFloat32ArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSFloat64Array> JSFloat64ArrayConstructor;
+typedef JSGenericTypedArrayViewConstructor<JSDataView> JSDataViewConstructor;
+
+} // namespace JSC
diff --git a/runtime/JSTypedArrayPrototypes.cpp b/runtime/JSTypedArrayPrototypes.cpp
new file mode 100644
index 0000000..d9282ea
--- /dev/null
+++ b/runtime/JSTypedArrayPrototypes.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSTypedArrayPrototypes.h"
+
+#include "JSGenericTypedArrayViewPrototypeInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSTypedArrayViewPrototype::s_info = {"Prototype", &JSTypedArrayViewPrototype::Base::s_info, 0,
+    CREATE_METHOD_TABLE(JSTypedArrayViewPrototype)};
+
+#define MAKE_S_INFO(type) \
+    template<> const ClassInfo JS##type##Prototype::s_info = {#type "Prototype", &JS##type##Prototype::Base::s_info, 0, CREATE_METHOD_TABLE(JS##type##Prototype)}
+
+MAKE_S_INFO(Int8Array);
+MAKE_S_INFO(Int16Array);
+MAKE_S_INFO(Int32Array);
+MAKE_S_INFO(Uint8Array);
+MAKE_S_INFO(Uint8ClampedArray);
+MAKE_S_INFO(Uint16Array);
+MAKE_S_INFO(Uint32Array);
+MAKE_S_INFO(Float32Array);
+MAKE_S_INFO(Float64Array);
+
+} // namespace JSC
+
diff --git a/runtime/JSTypedArrayPrototypes.h b/runtime/JSTypedArrayPrototypes.h
new file mode 100644
index 0000000..856c087
--- /dev/null
+++ b/runtime/JSTypedArrayPrototypes.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSGenericTypedArrayViewPrototype.h"
+#include "JSTypedArrayViewPrototype.h"
+#include "JSTypedArrays.h"
+
+namespace JSC {
+
+typedef JSGenericTypedArrayViewPrototype<JSInt8Array> JSInt8ArrayPrototype;
+typedef JSGenericTypedArrayViewPrototype<JSInt16Array> JSInt16ArrayPrototype;
+typedef JSGenericTypedArrayViewPrototype<JSInt32Array> JSInt32ArrayPrototype;
+typedef JSGenericTypedArrayViewPrototype<JSUint8Array> JSUint8ArrayPrototype;
+typedef JSGenericTypedArrayViewPrototype<JSUint8ClampedArray> JSUint8ClampedArrayPrototype;
+typedef JSGenericTypedArrayViewPrototype<JSUint16Array> JSUint16ArrayPrototype;
+typedef JSGenericTypedArrayViewPrototype<JSUint32Array> JSUint32ArrayPrototype;
+typedef JSGenericTypedArrayViewPrototype<JSFloat32Array> JSFloat32ArrayPrototype;
+typedef JSGenericTypedArrayViewPrototype<JSFloat64Array> JSFloat64ArrayPrototype;
+
+} // namespace JSC
diff --git a/runtime/JSTypedArrayViewConstructor.cpp b/runtime/JSTypedArrayViewConstructor.cpp
new file mode 100644
index 0000000..bfae59e
--- /dev/null
+++ b/runtime/JSTypedArrayViewConstructor.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSTypedArrayViewConstructor.h"
+
+#include "CallFrame.h"
+#include "Error.h"
+#include "GetterSetter.h"
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSGenericTypedArrayViewConstructorInlines.h"
+#include "JSTypedArrayViewPrototype.h"
+#include "JSTypedArrays.h"
+
+namespace JSC {
+
+JSTypedArrayViewConstructor::JSTypedArrayViewConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+const ClassInfo JSTypedArrayViewConstructor::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(JSTypedArrayViewConstructor) };
+
+void JSTypedArrayViewConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, JSTypedArrayViewPrototype* prototype, GetterSetter* speciesSymbol)
+{
+    Base::finishCreation(vm, "TypedArray");
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontEnum | ReadOnly);
+    putDirectNonIndexAccessor(vm, vm.propertyNames->speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);
+
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->of, typedArrayConstructorOfCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->from, typedArrayConstructorFromCodeGenerator, DontEnum);
+}
+
+Structure* JSTypedArrayViewConstructor::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+
+
+static EncodedJSValue JSC_HOST_CALL constructTypedArrayView(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope, ASCIILiteral("%TypedArray% should not be called directly"));
+}
+
+ConstructType JSTypedArrayViewConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructTypedArrayView;
+    return ConstructType::Host;
+}
+
+CallType JSTypedArrayViewConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = constructTypedArrayView;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/JSTypedArrayViewConstructor.h b/runtime/JSTypedArrayViewConstructor.h
new file mode 100644
index 0000000..d7817e2
--- /dev/null
+++ b/runtime/JSTypedArrayViewConstructor.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class JSTypedArrayViewPrototype;
+class GetterSetter;
+
+class JSTypedArrayViewConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+protected:
+    JSTypedArrayViewConstructor(VM&, Structure*);
+    void finishCreation(VM&, JSGlobalObject*, JSTypedArrayViewPrototype*, GetterSetter* speciesSymbol);
+
+public:
+    static JSTypedArrayViewConstructor* create(VM& vm, JSGlobalObject* globalObject, Structure* structure, JSTypedArrayViewPrototype* prototype, GetterSetter* speciesSymbol)
+    {
+        JSTypedArrayViewConstructor* result = new (NotNull, allocateCell<JSTypedArrayViewConstructor>(vm.heap)) JSTypedArrayViewConstructor(vm, structure);
+        result->finishCreation(vm, globalObject, prototype, speciesSymbol);
+        return result;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+protected:
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+    
+} // namespace JSC
diff --git a/runtime/JSTypedArrayViewPrototype.cpp b/runtime/JSTypedArrayViewPrototype.cpp
new file mode 100644
index 0000000..bcc4386
--- /dev/null
+++ b/runtime/JSTypedArrayViewPrototype.cpp
@@ -0,0 +1,355 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSTypedArrayViewPrototype.h"
+
+#include "BuiltinNames.h"
+#include "CallFrame.h"
+#include "GetterSetter.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGenericTypedArrayViewPrototypeFunctions.h"
+#include "JSObjectInlines.h"
+#include "TypedArrayAdaptors.h"
+
+namespace JSC {
+
+#define CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(functionName) do {                           \
+    switch (thisValue.getObject()->classInfo()->typedArrayStorageType) {                        \
+    case TypeUint8Clamped:                                                                      \
+        return functionName<JSUint8ClampedArray>(vm, exec);                                     \
+    case TypeInt32:                                                                             \
+        return functionName<JSInt32Array>(vm, exec);                                            \
+    case TypeUint32:                                                                            \
+        return functionName<JSUint32Array>(vm, exec);                                           \
+    case TypeFloat64:                                                                           \
+        return functionName<JSFloat64Array>(vm, exec);                                          \
+    case TypeFloat32:                                                                           \
+        return functionName<JSFloat32Array>(vm, exec);                                          \
+    case TypeInt8:                                                                              \
+        return functionName<JSInt8Array>(vm, exec);                                             \
+    case TypeUint8:                                                                             \
+        return functionName<JSUint8Array>(vm, exec);                                            \
+    case TypeInt16:                                                                             \
+        return functionName<JSInt16Array>(vm, exec);                                            \
+    case TypeUint16:                                                                            \
+        return functionName<JSUint16Array>(vm, exec);                                           \
+    case NotTypedArray:                                                                         \
+    case TypeDataView:                                                                          \
+        return throwVMTypeError(exec, scope,                                                    \
+            ASCIILiteral("Receiver should be a typed array view"));                             \
+    }                                                                                           \
+    RELEASE_ASSERT_NOT_REACHED();                                                               \
+} while (false)
+
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncIsTypedArrayView(ExecState* exec)
+{
+    JSValue value = exec->uncheckedArgument(0);
+    return JSValue::encode(jsBoolean(value.isCell() && isTypedView(value.asCell()->classInfo()->typedArrayStorageType)));
+}
+
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncLength(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue argument = exec->argument(0);
+    if (!argument.isCell() || !isTypedView(argument.asCell()->classInfo()->typedArrayStorageType))
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view"));
+
+    JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(argument);
+
+    if (thisObject->isNeutered())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Underlying ArrayBuffer has been detached from the view"));
+
+    return JSValue::encode(jsNumber(thisObject->length()));
+}
+
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncGetOriginalConstructor(ExecState* exec)
+{
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    TypedArrayType type = exec->uncheckedArgument(0).getObject()->classInfo()->typedArrayStorageType;
+    ASSERT(isTypedView(type));
+    return JSValue::encode(globalObject->typedArrayConstructor(type));
+}
+
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncSort(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->argument(0);
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewPrivateFuncSort);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncSet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (UNLIKELY(!thisValue.isObject()))
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncSet);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncCopyWithin(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncCopyWithin);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncIncludes(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMError(exec, scope, createTypeError(exec, "Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncIncludes);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncLastIndexOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncLastIndexOf);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncIndexOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncIndexOf);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncJoin(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncJoin);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncBuffer(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncBuffer);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncLength(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncLength);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncByteLength(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncByteLength);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncByteOffset(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncByteOffset);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncReverse(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncReverse);
+}
+
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncSubarrayCreate(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewPrivateFuncSubarrayCreate);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncSlice(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
+    CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncSlice);
+}
+
+static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncToStringTag(ExecState* exec)
+{
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return JSValue::encode(jsUndefined());
+
+    VM& vm = exec->vm();
+    switch (thisValue.getObject()->classInfo()->typedArrayStorageType) {
+    case TypeUint8Clamped:
+        return JSValue::encode(jsString(&vm, "Uint8ClampedArray"));
+    case TypeInt32:
+        return JSValue::encode(jsString(&vm, "Int32Array"));
+    case TypeUint32:
+        return JSValue::encode(jsString(&vm, "Uint32Array"));
+    case TypeFloat64:
+        return JSValue::encode(jsString(&vm, "Float64Array"));
+    case TypeFloat32:
+        return JSValue::encode(jsString(&vm, "Float32Array"));
+    case TypeInt8:
+        return JSValue::encode(jsString(&vm, "Int8Array"));
+    case TypeUint8:
+        return JSValue::encode(jsString(&vm, "Uint8Array"));
+    case TypeInt16:
+        return JSValue::encode(jsString(&vm, "Int16Array"));
+    case TypeUint16:
+        return JSValue::encode(jsString(&vm, "Uint16Array"));
+    case NotTypedArray:
+    case TypeDataView:
+        return JSValue::encode(jsUndefined());
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+
+#undef CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION
+
+JSTypedArrayViewPrototype::JSTypedArrayViewPrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void JSTypedArrayViewPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+
+    ASSERT(inherits(info()));
+
+    putDirectWithoutTransition(vm, vm.propertyNames->toString, globalObject->arrayProtoToStringFunction(), DontEnum);
+
+    JSC_NATIVE_GETTER(vm.propertyNames->buffer, typedArrayViewProtoGetterFuncBuffer, DontEnum | ReadOnly);
+    JSC_NATIVE_INTRINSIC_GETTER(vm.propertyNames->byteLength, typedArrayViewProtoGetterFuncByteLength, DontEnum | ReadOnly, TypedArrayByteLengthIntrinsic);
+    JSC_NATIVE_INTRINSIC_GETTER(vm.propertyNames->byteOffset, typedArrayViewProtoGetterFuncByteOffset, DontEnum | ReadOnly, TypedArrayByteOffsetIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("copyWithin", typedArrayViewProtoFuncCopyWithin, DontEnum, 2);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("every", typedArrayPrototypeEveryCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("filter", typedArrayPrototypeFilterCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("sort", typedArrayPrototypeSortCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().entriesPublicName(), typedArrayPrototypeEntriesCodeGenerator, DontEnum);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("includes", typedArrayViewProtoFuncIncludes, DontEnum, 1);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("fill", typedArrayPrototypeFillCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("find", typedArrayPrototypeFindCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("findIndex", typedArrayPrototypeFindIndexCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->forEach, typedArrayPrototypeForEachCodeGenerator, DontEnum);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("indexOf", typedArrayViewProtoFuncIndexOf, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->join, typedArrayViewProtoFuncJoin, DontEnum, 1);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().keysPublicName(), typedArrayPrototypeKeysCodeGenerator, DontEnum);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("lastIndexOf", typedArrayViewProtoFuncLastIndexOf, DontEnum, 1);
+    JSC_NATIVE_INTRINSIC_GETTER(vm.propertyNames->length, typedArrayViewProtoGetterFuncLength, DontEnum | ReadOnly, TypedArrayLengthIntrinsic);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("map", typedArrayPrototypeMapCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("reduce", typedArrayPrototypeReduceCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("reduceRight", typedArrayPrototypeReduceRightCodeGenerator, DontEnum);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("reverse", typedArrayViewProtoFuncReverse, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->set, typedArrayViewProtoFuncSet, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->slice, typedArrayViewProtoFuncSlice, DontEnum, 2);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("some", typedArrayPrototypeSomeCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->subarray, typedArrayPrototypeSubarrayCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->toLocaleString, typedArrayPrototypeToLocaleStringCodeGenerator, DontEnum);
+
+    JSFunction* toStringTagFunction = JSFunction::create(vm, globalObject, 0, ASCIILiteral("get [Symbol.toStringTag]"), typedArrayViewProtoGetterFuncToStringTag, NoIntrinsic);
+    GetterSetter* toStringTagAccessor = GetterSetter::create(vm, globalObject);
+    toStringTagAccessor->setGetter(vm, globalObject, toStringTagFunction);
+    putDirectNonIndexAccessor(vm, vm.propertyNames->toStringTagSymbol, toStringTagAccessor, DontEnum | ReadOnly | Accessor);
+
+    JSFunction* valuesFunction = JSFunction::createBuiltinFunction(vm, typedArrayPrototypeValuesCodeGenerator(vm), globalObject);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPublicName(), valuesFunction, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->iteratorSymbol, valuesFunction, DontEnum);
+
+}
+
+JSTypedArrayViewPrototype* JSTypedArrayViewPrototype::create(
+    VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    JSTypedArrayViewPrototype* prototype =
+        new (NotNull, allocateCell<JSTypedArrayViewPrototype>(vm.heap))
+        JSTypedArrayViewPrototype(vm, structure);
+    prototype->finishCreation(vm, globalObject);
+    return prototype;
+}
+
+Structure* JSTypedArrayViewPrototype::createStructure(
+    VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+} // namespace JSC
diff --git a/runtime/JSTypedArrayViewPrototype.h b/runtime/JSTypedArrayViewPrototype.h
new file mode 100644
index 0000000..abb155f
--- /dev/null
+++ b/runtime/JSTypedArrayViewPrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSTypedArrayViewPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+protected:
+    JSTypedArrayViewPrototype(VM&, Structure*);
+    void finishCreation(VM&, JSGlobalObject*);
+
+public:
+    static JSTypedArrayViewPrototype* create(VM&, JSGlobalObject*, Structure*);
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+};
+
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncIsTypedArrayView(ExecState*);
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncSort(ExecState*);
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncLength(ExecState*);
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncGetOriginalConstructor(ExecState*);
+EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncSubarrayCreate(ExecState*);
+    
+} // namespace JSC
diff --git a/runtime/JSTypedArrays.cpp b/runtime/JSTypedArrays.cpp
new file mode 100644
index 0000000..b88d9f4
--- /dev/null
+++ b/runtime/JSTypedArrays.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSTypedArrays.h"
+
+#include "GenericTypedArrayViewInlines.h"
+#include "JSGenericTypedArrayViewInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+#define MAKE_S_INFO(type) \
+    template<> const ClassInfo JS##type##Array::s_info = { \
+        #type "Array", &JS##type##Array::Base::s_info, 0, \
+        CREATE_METHOD_TABLE(JS##type##Array) \
+    }; \
+    const ClassInfo* get##type##ArrayClassInfo() { return &JS##type##Array::s_info; }
+
+MAKE_S_INFO(Int8);
+MAKE_S_INFO(Int16);
+MAKE_S_INFO(Int32);
+MAKE_S_INFO(Uint8);
+MAKE_S_INFO(Uint8Clamped);
+MAKE_S_INFO(Uint16);
+MAKE_S_INFO(Uint32);
+MAKE_S_INFO(Float32);
+MAKE_S_INFO(Float64);
+
+JSUint8Array* createUint8TypedArray(ExecState* exec, Structure* structure, RefPtr<ArrayBuffer>&& passedBuffer, unsigned byteOffset, unsigned length)
+{
+    return JSUint8Array::create(exec, structure, std::forward<RefPtr<ArrayBuffer>>(passedBuffer), byteOffset, length);
+}
+
+
+} // namespace JSC
+
diff --git a/runtime/JSTypedArrays.h b/runtime/JSTypedArrays.h
new file mode 100644
index 0000000..59ecbdc
--- /dev/null
+++ b/runtime/JSTypedArrays.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSGenericTypedArrayView.h"
+#include "TypedArrayAdaptors.h"
+#include "TypedArrays.h"
+
+namespace JSC {
+
+typedef JSGenericTypedArrayView<Int8Adaptor> JSInt8Array;
+typedef JSGenericTypedArrayView<Int16Adaptor> JSInt16Array;
+typedef JSGenericTypedArrayView<Int32Adaptor> JSInt32Array;
+typedef JSGenericTypedArrayView<Uint8Adaptor> JSUint8Array;
+typedef JSGenericTypedArrayView<Uint8ClampedAdaptor> JSUint8ClampedArray;
+typedef JSGenericTypedArrayView<Uint16Adaptor> JSUint16Array;
+typedef JSGenericTypedArrayView<Uint32Adaptor> JSUint32Array;
+typedef JSGenericTypedArrayView<Float32Adaptor> JSFloat32Array;
+typedef JSGenericTypedArrayView<Float64Adaptor> JSFloat64Array;
+
+JS_EXPORT_PRIVATE JSUint8Array* createUint8TypedArray(ExecState*, Structure*, RefPtr<ArrayBuffer>&&, unsigned byteOffset, unsigned length);
+
+} // namespace JSC
diff --git a/runtime/JSUint16Array.h b/runtime/JSUint16Array.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSUint16Array.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSUint32Array.h b/runtime/JSUint32Array.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSUint32Array.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSUint8Array.h b/runtime/JSUint8Array.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSUint8Array.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSUint8ClampedArray.h b/runtime/JSUint8ClampedArray.h
new file mode 100644
index 0000000..c13543e
--- /dev/null
+++ b/runtime/JSUint8ClampedArray.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSTypedArrays.h"
diff --git a/runtime/JSWeakMap.cpp b/runtime/JSWeakMap.cpp
new file mode 100644
index 0000000..8a2b30d
--- /dev/null
+++ b/runtime/JSWeakMap.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWeakMap.h"
+
+#include "JSCInlines.h"
+#include "WeakMapData.h"
+
+namespace JSC {
+
+const ClassInfo JSWeakMap::s_info = { "WeakMap", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWeakMap) };
+
+void JSWeakMap::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    m_weakMapData.set(vm, this, WeakMapData::create(vm));
+}
+
+void JSWeakMap::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    Base::visitChildren(cell, visitor);
+    JSWeakMap* thisObj = jsCast<JSWeakMap*>(cell);
+    visitor.append(thisObj->m_weakMapData);
+}
+
+String JSWeakMap::toStringName(const JSObject*, ExecState*)
+{
+    return ASCIILiteral("Object");
+}
+
+}
diff --git a/runtime/JSWeakMap.h b/runtime/JSWeakMap.h
new file mode 100644
index 0000000..1733d96
--- /dev/null
+++ b/runtime/JSWeakMap.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class WeakMapData;
+
+class JSWeakMap : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static JSWeakMap* create(VM& vm, Structure* structure)
+    {
+        JSWeakMap* instance = new (NotNull, allocateCell<JSWeakMap>(vm.heap)) JSWeakMap(vm, structure);
+        instance->finishCreation(vm);
+        return instance;
+    }
+
+    static JSWeakMap* create(ExecState* exec, Structure* structure)
+    {
+        return create(exec->vm(), structure);
+    }
+
+    WeakMapData* weakMapData() { return m_weakMapData.get(); }
+
+    JSValue get(CallFrame*, JSObject*);
+    bool has(CallFrame*, JSObject*);
+    bool remove(CallFrame*, JSObject*);
+
+    void set(CallFrame*, JSObject*, JSValue);
+    void clear(CallFrame*);
+
+private:
+    JSWeakMap(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    void finishCreation(VM&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static String toStringName(const JSObject*, ExecState*);
+
+    WriteBarrier<WeakMapData> m_weakMapData;
+};
+
+} // namespace JSC
diff --git a/runtime/JSWeakSet.cpp b/runtime/JSWeakSet.cpp
new file mode 100644
index 0000000..afc4ce6
--- /dev/null
+++ b/runtime/JSWeakSet.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2015-2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWeakSet.h"
+
+#include "JSCInlines.h"
+#include "WeakMapData.h"
+
+namespace JSC {
+
+const ClassInfo JSWeakSet::s_info = { "WeakSet", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWeakSet) };
+
+void JSWeakSet::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    m_weakMapData.set(vm, this, WeakMapData::create(vm));
+}
+
+void JSWeakSet::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    Base::visitChildren(cell, visitor);
+    JSWeakSet* thisObj = jsCast<JSWeakSet*>(cell);
+    visitor.append(thisObj->m_weakMapData);
+}
+
+String JSWeakSet::toStringName(const JSC::JSObject*, ExecState*)
+{
+    return ASCIILiteral("Object");
+}
+
+}
diff --git a/runtime/JSWeakSet.h b/runtime/JSWeakSet.h
new file mode 100644
index 0000000..0154798
--- /dev/null
+++ b/runtime/JSWeakSet.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2015 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class WeakMapData;
+
+class JSWeakSet : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static JSWeakSet* create(VM& vm, Structure* structure)
+    {
+        JSWeakSet* instance = new (NotNull, allocateCell<JSWeakSet>(vm.heap)) JSWeakSet(vm, structure);
+        instance->finishCreation(vm);
+        return instance;
+    }
+
+    static JSWeakSet* create(ExecState* exec, Structure* structure)
+    {
+        return create(exec->vm(), structure);
+    }
+
+    WeakMapData* weakMapData() { return m_weakMapData.get(); }
+
+    JSValue get(CallFrame*, JSObject*);
+    bool has(CallFrame*, JSObject*);
+    bool remove(CallFrame*, JSObject*);
+
+    void set(CallFrame*, JSObject*, JSValue);
+    void clear(CallFrame*);
+
+private:
+    JSWeakSet(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    void finishCreation(VM&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    static String toStringName(const JSObject*, ExecState*);
+
+    WriteBarrier<WeakMapData> m_weakMapData;
+};
+
+} // namespace JSC
diff --git a/runtime/JSWithScope.cpp b/runtime/JSWithScope.cpp
new file mode 100644
index 0000000..50eff92
--- /dev/null
+++ b/runtime/JSWithScope.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWithScope.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSWithScope::s_info = { "WithScope", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWithScope) };
+
+JSWithScope* JSWithScope::create(
+    VM& vm, JSGlobalObject* globalObject, JSObject* object, JSScope* next)
+{
+    Structure* structure = globalObject->withScopeStructure();
+    JSWithScope* withScope = new (NotNull, allocateCell<JSWithScope>(vm.heap)) JSWithScope(vm, structure, object, next);
+    withScope->finishCreation(vm);
+    return withScope;
+}
+
+void JSWithScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSWithScope* thisObject = jsCast<JSWithScope*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_object);
+}
+
+Structure* JSWithScope::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+{
+    return Structure::create(vm, globalObject, proto, TypeInfo(WithScopeType, StructureFlags), info());
+}
+
+JSWithScope::JSWithScope(VM& vm, Structure* structure, JSObject* object, JSScope* next)
+    : Base(vm, structure, next)
+    , m_object(vm, this, object)
+{
+}
+
+} // namespace JSC
diff --git a/runtime/JSWithScope.h b/runtime/JSWithScope.h
new file mode 100644
index 0000000..39e09e3
--- /dev/null
+++ b/runtime/JSWithScope.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSGlobalObject.h"
+
+namespace JSC {
+
+class JSWithScope : public JSScope {
+public:
+    typedef JSScope Base;
+
+    JS_EXPORT_PRIVATE static JSWithScope* create(VM&, JSGlobalObject*, JSObject*, JSScope* next);
+
+    JSObject* object() { return m_object.get(); }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue proto);
+
+    DECLARE_EXPORT_INFO;
+
+private:
+    JSWithScope(VM&, Structure*, JSObject*, JSScope* next);
+
+    WriteBarrier<JSObject> m_object;
+};
+
+} // namespace JSC
diff --git a/runtime/JSWrapperObject.cpp b/runtime/JSWrapperObject.cpp
new file mode 100644
index 0000000..c69161c
--- /dev/null
+++ b/runtime/JSWrapperObject.cpp
@@ -0,0 +1,39 @@
+/*
+ *  Copyright (C) 2006 Maks Orlovich
+ *  Copyright (C) 2006, 2009, 2012 Apple, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "JSWrapperObject.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSWrapperObject);
+
+void JSWrapperObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSWrapperObject* thisObject = jsCast<JSWrapperObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    JSObject::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_internalValue);
+}
+
+} // namespace JSC
diff --git a/runtime/JSWrapperObject.h b/runtime/JSWrapperObject.h
new file mode 100644
index 0000000..7bc8b0b
--- /dev/null
+++ b/runtime/JSWrapperObject.h
@@ -0,0 +1,84 @@
+/*
+ *  Copyright (C) 2006 Maks Orlovich
+ *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "JSDestructibleObject.h"
+
+namespace JSC {
+
+// This class is used as a base for classes such as String,
+// Number, Boolean and Date which are wrappers for primitive types.
+class JSWrapperObject : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
+        return sizeof(JSWrapperObject);
+    }
+
+    JSValue internalValue() const;
+    void setInternalValue(VM&, JSValue);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    { 
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static ptrdiff_t internalValueOffset() { return OBJECT_OFFSETOF(JSWrapperObject, m_internalValue); }
+    static ptrdiff_t internalValueCellOffset()
+    {
+#if USE(JSVALUE64)
+        return internalValueOffset();
+#else
+        return internalValueOffset() + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload);
+#endif
+    }
+
+protected:
+    explicit JSWrapperObject(VM&, Structure*);
+
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    WriteBarrier<Unknown> m_internalValue;
+};
+
+inline JSWrapperObject::JSWrapperObject(VM& vm, Structure* structure)
+    : JSDestructibleObject(vm, structure)
+{
+}
+
+inline JSValue JSWrapperObject::internalValue() const
+{
+    return m_internalValue.get();
+}
+
+inline void JSWrapperObject::setInternalValue(VM& vm, JSValue value)
+{
+    ASSERT(value);
+    ASSERT(!value.isObject());
+    m_internalValue.set(vm, this, value);
+}
+
+} // namespace JSC
diff --git a/runtime/LazyClassStructure.cpp b/runtime/LazyClassStructure.cpp
new file mode 100644
index 0000000..1e601f9
--- /dev/null
+++ b/runtime/LazyClassStructure.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LazyClassStructure.h"
+
+#include "JSCInlines.h"
+#include "LazyPropertyInlines.h"
+
+namespace JSC {
+
+LazyClassStructure::Initializer::Initializer(VM& vm, JSGlobalObject* global, LazyClassStructure& classStructure, const StructureInitializer& structureInit)
+    : vm(vm)
+    , global(global)
+    , classStructure(classStructure)
+    , structureInit(structureInit)
+{
+}
+
+void LazyClassStructure::Initializer::setPrototype(JSObject* prototype)
+{
+    RELEASE_ASSERT(!this->prototype);
+    RELEASE_ASSERT(!structure);
+    RELEASE_ASSERT(!constructor);
+    
+    this->prototype = prototype;
+}
+
+void LazyClassStructure::Initializer::setStructure(Structure* structure)
+{
+    RELEASE_ASSERT(!this->structure);
+    RELEASE_ASSERT(!constructor);
+
+    this->structure = structure;
+    structureInit.set(structure);
+    
+    if (!prototype)
+        prototype = structure->storedPrototypeObject();
+}
+
+void LazyClassStructure::Initializer::setConstructor(PropertyName propertyName, JSObject* constructor)
+{
+    RELEASE_ASSERT(structure);
+    RELEASE_ASSERT(prototype);
+    RELEASE_ASSERT(!this->constructor);
+    
+    this->constructor = constructor;
+
+    prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, constructor, DontEnum);
+    if (!propertyName.isNull())
+        global->putDirect(vm, propertyName, constructor, DontEnum);
+    classStructure.m_constructor.set(vm, global, constructor);
+}
+
+void LazyClassStructure::Initializer::setConstructor(JSObject* constructor)
+{
+    String name;
+    if (InternalFunction* internalFunction = jsDynamicCast<InternalFunction*>(constructor))
+        name = internalFunction->name();
+    else if (JSFunction* function = jsDynamicCast<JSFunction*>(constructor))
+        name = function->name(vm);
+    else
+        RELEASE_ASSERT_NOT_REACHED();
+    
+    setConstructor(Identifier::fromString(&vm, name), constructor);
+}
+
+void LazyClassStructure::visit(SlotVisitor& visitor)
+{
+    m_structure.visit(visitor);
+    visitor.append(m_constructor);
+}
+
+void LazyClassStructure::dump(PrintStream& out) const
+{
+    out.print("<structure = ", m_structure, ", constructor = ", RawPointer(m_constructor.get()), ">");
+}
+
+} // namespace JSC
+
diff --git a/runtime/LazyClassStructure.h b/runtime/LazyClassStructure.h
new file mode 100644
index 0000000..b02dec7
--- /dev/null
+++ b/runtime/LazyClassStructure.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "LazyProperty.h"
+#include "Structure.h"
+
+namespace JSC {
+
+class JSGlobalObject;
+class VM;
+
+class LazyClassStructure {
+    typedef LazyProperty<JSGlobalObject, Structure>::Initializer StructureInitializer;
+    
+public:
+    struct Initializer {
+        Initializer(VM&, JSGlobalObject*, LazyClassStructure&, const StructureInitializer&);
+        
+        // This should be called first or not at all.
+        void setPrototype(JSObject* prototype);
+        
+        // If this is called after setPrototype() then it just sets the structure. If this is
+        // called first then it sets the prototype by extracting it from the structure.
+        void setStructure(Structure*);
+        
+        // Call this last. It's expected that the constructor is initialized to point to the
+        // prototype already. This will automatically set prototype.constructor=constructor.
+        // This will also stuff the constructor into the global object at the given property.
+        // Note that the variant that does not take a property name attempts to deduce it by
+        // casting constructor to either JSFunction or InternalFunction. Also, you can pass
+        // nullptr for the property name, in which case we don't assign the property to the
+        // global object.
+        void setConstructor(PropertyName, JSObject* constructor);
+        void setConstructor(JSObject* constructor);
+        
+        VM& vm;
+        JSGlobalObject* global;
+        LazyClassStructure& classStructure;
+        const StructureInitializer& structureInit;
+        
+        // It's expected that you set these using the set methods above.
+        JSObject* prototype { nullptr };
+        Structure* structure { nullptr };
+        JSObject* constructor { nullptr };
+    };
+    
+    LazyClassStructure()
+    {
+    }
+    
+    template<typename Callback>
+    void initLater(const Callback&);
+    
+    Structure* get(const JSGlobalObject* global) const
+    {
+        ASSERT(!isCompilationThread());
+        return m_structure.get(global);
+    }
+    
+    JSObject* prototype(const JSGlobalObject* global) const
+    {
+        ASSERT(!isCompilationThread());
+        return get(global)->storedPrototypeObject();
+    }
+
+    // Almost as an afterthought, we also support getting the original constructor. This turns
+    // out to be important for ES6 support.
+    JSObject* constructor(const JSGlobalObject* global) const
+    {
+        ASSERT(!isCompilationThread());
+        m_structure.get(global);
+        return m_constructor.get();
+    }
+    
+    Structure* getConcurrently() const
+    {
+        return m_structure.getConcurrently();
+    }
+    
+    JSObject* prototypeConcurrently() const
+    {
+        if (Structure* structure = getConcurrently())
+            return structure->storedPrototypeObject();
+        return nullptr;
+    }
+    
+    JSObject* constructorConcurrently() const
+    {
+        return m_constructor.get();
+    }
+    
+    void visit(SlotVisitor&);
+    
+    void dump(PrintStream&) const;
+
+private:
+    LazyProperty<JSGlobalObject, Structure> m_structure;
+    WriteBarrier<JSObject> m_constructor;
+};
+
+} // namespace JSC
diff --git a/runtime/LazyClassStructureInlines.h b/runtime/LazyClassStructureInlines.h
new file mode 100644
index 0000000..2e444c2
--- /dev/null
+++ b/runtime/LazyClassStructureInlines.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "LazyClassStructure.h"
+#include "LazyPropertyInlines.h"
+
+namespace JSC {
+
+template<typename Callback>
+void LazyClassStructure::initLater(const Callback&)
+{
+    m_structure.initLater(
+        [] (const StructureInitializer& structureInit) {
+            ptrdiff_t offset = OBJECT_OFFSETOF(LazyClassStructure, m_structure);
+            LazyClassStructure* thisStructure = bitwise_cast<LazyClassStructure*>(
+                bitwise_cast<char*>(&structureInit.property) - offset);
+            Initializer init(structureInit.vm, structureInit.owner, *thisStructure, structureInit);
+            callStatelessLambda<void, Callback>(init);
+        });
+}
+
+} // namespace JSC
diff --git a/runtime/LazyProperty.h b/runtime/LazyProperty.h
new file mode 100644
index 0000000..169f202
--- /dev/null
+++ b/runtime/LazyProperty.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "VM.h"
+
+namespace JSC {
+
+class JSCell;
+class SlotVisitor;
+class VM;
+
+// Note that if all you're doing is calling LazyProperty::get(), it's completely safe to bitcast
+// this LazyProperty<JSCell, JSCell>.
+template<typename OwnerType, typename ElementType>
+class LazyProperty {
+public:
+    struct Initializer {
+        Initializer(OwnerType* owner, LazyProperty& property)
+            : vm(*Heap::heap(owner)->vm())
+            , owner(owner)
+            , property(property)
+        {
+        }
+        
+        void set(ElementType* value) const;
+
+        VM& vm;
+        OwnerType* owner;
+        LazyProperty& property;
+    };
+
+private:
+    typedef ElementType* (*FuncType)(const Initializer&);
+
+public:
+    LazyProperty()
+    {
+    }
+
+    // Tell the property to run the given callback next time someone tries to get the value
+    // using get(). The passed callback must be stateless. For example:
+    //
+    //     property.initLater(
+    //         [] (const LazyProperty<Foo, Bar>::Initializer& init) {
+    //             init.set(...things...);
+    //         });
+    //
+    // This method is always inlineable and should always compile to a store of a constant
+    // pointer no matter how complicated the callback is.
+    template<typename Func>
+    void initLater(const Func&);
+
+    // This lazily initializes the property. Note that this gracefully supports recursive calls.
+    // If this gets called while the property is being initialized, it will simply return null.
+    ElementType* get(const OwnerType* owner) const
+    {
+        ASSERT(!isCompilationThread());
+        if (UNLIKELY(m_pointer & lazyTag)) {
+            FuncType func = *bitwise_cast<FuncType*>(m_pointer & ~(lazyTag | initializingTag));
+            return func(Initializer(const_cast<OwnerType*>(owner), *const_cast<LazyProperty*>(this)));
+        }
+        return bitwise_cast<ElementType*>(m_pointer);
+    }
+    
+    ElementType* getConcurrently() const
+    {
+        uintptr_t pointer = m_pointer;
+        if (pointer & lazyTag)
+            return nullptr;
+        return bitwise_cast<ElementType*>(pointer);
+    }
+    
+    void setMayBeNull(VM&, const OwnerType* owner, ElementType*);
+    void set(VM&, const OwnerType* owner, ElementType*);
+    
+    void visit(SlotVisitor&);
+    
+    void dump(PrintStream&) const;
+    
+private:
+    template<typename Func>
+    static ElementType* callFunc(const Initializer&);
+    
+    static const uintptr_t lazyTag = 1;
+    static const uintptr_t initializingTag = 2;
+    
+    uintptr_t m_pointer { 0 };
+};
+
+// It's valid to bitcast any LazyProperty to LazyCellProperty if you're just going to call get()
+// or getConcurrently().
+typedef LazyProperty<JSCell, JSCell> LazyCellProperty;
+
+} // namespace JSC
diff --git a/runtime/LazyPropertyInlines.h b/runtime/LazyPropertyInlines.h
new file mode 100644
index 0000000..599d843
--- /dev/null
+++ b/runtime/LazyPropertyInlines.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Heap.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+template<typename OwnerType, typename ElementType>
+void LazyProperty<OwnerType, ElementType>::Initializer::set(ElementType* value) const
+{
+    property.set(vm, owner, value);
+}
+
+template<typename OwnerType, typename ElementType>
+template<typename Func>
+void LazyProperty<OwnerType, ElementType>::initLater(const Func&)
+{
+    RELEASE_ASSERT(isStatelessLambda<Func>());
+    // Logically we just want to stuff the function pointer into m_pointer, but then we'd be sad
+    // because a function pointer is not guaranteed to be a multiple of anything. The tag bits
+    // may be used for things. We address this problem by indirecting through a global const
+    // variable. The "theFunc" variable is guaranteed to be native-aligned, i.e. at least a
+    // multiple of 4.
+    static const FuncType theFunc = callFunc<Func>;
+    m_pointer = lazyTag | bitwise_cast<uintptr_t>(&theFunc);
+}
+
+template<typename OwnerType, typename ElementType>
+void LazyProperty<OwnerType, ElementType>::setMayBeNull(VM& vm, const OwnerType* owner, ElementType* value)
+{
+    vm.heap.writeBarrier(owner, value);
+    m_pointer = bitwise_cast<uintptr_t>(value);
+    RELEASE_ASSERT(!(m_pointer & lazyTag));
+}
+
+template<typename OwnerType, typename ElementType>
+void LazyProperty<OwnerType, ElementType>::set(VM& vm, const OwnerType* owner, ElementType* value)
+{
+    RELEASE_ASSERT(value);
+    setMayBeNull(vm, owner, value);
+}
+
+template<typename OwnerType, typename ElementType>
+void LazyProperty<OwnerType, ElementType>::visit(SlotVisitor& visitor)
+{
+    if (m_pointer && !(m_pointer & lazyTag))
+        visitor.appendUnbarriered(bitwise_cast<ElementType*>(m_pointer));
+}
+
+template<typename OwnerType, typename ElementType>
+void LazyProperty<OwnerType, ElementType>::dump(PrintStream& out) const
+{
+    if (!m_pointer) {
+        out.print("<null>");
+        return;
+    }
+    if (m_pointer & lazyTag) {
+        out.print("Lazy:", RawPointer(bitwise_cast<void*>(m_pointer & ~lazyTag)));
+        if (m_pointer & initializingTag)
+            out.print("(Initializing)");
+        return;
+    }
+    out.print(RawPointer(bitwise_cast<void*>(m_pointer)));
+}
+
+template<typename OwnerType, typename ElementType>
+template<typename Func>
+ElementType* LazyProperty<OwnerType, ElementType>::callFunc(const Initializer& initializer)
+{
+    if (initializer.property.m_pointer & initializingTag)
+        return nullptr;
+    initializer.property.m_pointer |= initializingTag;
+    callStatelessLambda<void, Func>(initializer);
+    RELEASE_ASSERT(!(initializer.property.m_pointer & lazyTag));
+    RELEASE_ASSERT(!(initializer.property.m_pointer & initializingTag));
+    return bitwise_cast<ElementType*>(initializer.property.m_pointer);
+}
+
+} // namespace JSC
diff --git a/runtime/LiteralParser.cpp b/runtime/LiteralParser.cpp
new file mode 100644
index 0000000..5993b32
--- /dev/null
+++ b/runtime/LiteralParser.cpp
@@ -0,0 +1,876 @@
+/*
+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Mathias Bynens (mathias@qiwi.be)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LiteralParser.h"
+
+#include "ButterflyInlines.h"
+#include "CodeBlock.h"
+#include "JSArray.h"
+#include "JSString.h"
+#include "Lexer.h"
+#include "ObjectConstructor.h"
+#include "JSCInlines.h"
+#include "StrongInlines.h"
+#include <wtf/ASCIICType.h>
+#include <wtf/dtoa.h>
+
+namespace JSC {
+
+template <typename CharType>
+static ALWAYS_INLINE bool isJSONWhiteSpace(const CharType& c)
+{
+    // The JSON RFC 4627 defines a list of allowed characters to be considered
+    // insignificant white space: http://www.ietf.org/rfc/rfc4627.txt (2. JSON Grammar).
+    return c == ' ' || c == 0x9 || c == 0xA || c == 0xD;
+}
+
+template <typename CharType>
+bool LiteralParser<CharType>::tryJSONPParse(Vector<JSONPData>& results, bool needsFullSourceInfo)
+{
+    if (m_lexer.next() != TokIdentifier)
+        return false;
+    do {
+        Vector<JSONPPathEntry> path;
+        // Unguarded next to start off the lexer
+        Identifier name = Identifier::fromString(&m_exec->vm(), m_lexer.currentToken()->start, m_lexer.currentToken()->end - m_lexer.currentToken()->start);
+        JSONPPathEntry entry;
+        if (name == m_exec->vm().propertyNames->varKeyword) {
+            if (m_lexer.next() != TokIdentifier)
+                return false;
+            entry.m_type = JSONPPathEntryTypeDeclare;
+            entry.m_pathEntryName = Identifier::fromString(&m_exec->vm(), m_lexer.currentToken()->start, m_lexer.currentToken()->end - m_lexer.currentToken()->start);
+            path.append(entry);
+        } else {
+            entry.m_type = JSONPPathEntryTypeDot;
+            entry.m_pathEntryName = Identifier::fromString(&m_exec->vm(), m_lexer.currentToken()->start, m_lexer.currentToken()->end - m_lexer.currentToken()->start);
+            path.append(entry);
+        }
+        if (isLexerKeyword(entry.m_pathEntryName))
+            return false;
+        TokenType tokenType = m_lexer.next();
+        if (entry.m_type == JSONPPathEntryTypeDeclare && tokenType != TokAssign)
+            return false;
+        while (tokenType != TokAssign) {
+            switch (tokenType) {
+            case TokLBracket: {
+                entry.m_type = JSONPPathEntryTypeLookup;
+                if (m_lexer.next() != TokNumber)
+                    return false;
+                double doubleIndex = m_lexer.currentToken()->numberToken;
+                int index = (int)doubleIndex;
+                if (index != doubleIndex || index < 0)
+                    return false;
+                entry.m_pathIndex = index;
+                if (m_lexer.next() != TokRBracket)
+                    return false;
+                break;
+            }
+            case TokDot: {
+                entry.m_type = JSONPPathEntryTypeDot;
+                if (m_lexer.next() != TokIdentifier)
+                    return false;
+                entry.m_pathEntryName = Identifier::fromString(&m_exec->vm(), m_lexer.currentToken()->start, m_lexer.currentToken()->end - m_lexer.currentToken()->start);
+                break;
+            }
+            case TokLParen: {
+                if (path.last().m_type != JSONPPathEntryTypeDot || needsFullSourceInfo)
+                    return false;
+                path.last().m_type = JSONPPathEntryTypeCall;
+                entry = path.last();
+                goto startJSON;
+            }
+            default:
+                return false;
+            }
+            path.append(entry);
+            tokenType = m_lexer.next();
+        }
+    startJSON:
+        m_lexer.next();
+        results.append(JSONPData());
+        results.last().m_value.set(m_exec->vm(), parse(StartParseExpression));
+        if (!results.last().m_value)
+            return false;
+        results.last().m_path.swap(path);
+        if (entry.m_type == JSONPPathEntryTypeCall) {
+            if (m_lexer.currentToken()->type != TokRParen)
+                return false;
+            m_lexer.next();
+        }
+        if (m_lexer.currentToken()->type != TokSemi)
+            break;
+        m_lexer.next();
+    } while (m_lexer.currentToken()->type == TokIdentifier);
+    return m_lexer.currentToken()->type == TokEnd;
+}
+    
+template <typename CharType>
+ALWAYS_INLINE const Identifier LiteralParser<CharType>::makeIdentifier(const LChar* characters, size_t length)
+{
+    if (!length)
+        return m_exec->vm().propertyNames->emptyIdentifier;
+    if (characters[0] >= MaximumCachableCharacter)
+        return Identifier::fromString(&m_exec->vm(), characters, length);
+
+    if (length == 1) {
+        if (!m_shortIdentifiers[characters[0]].isNull())
+            return m_shortIdentifiers[characters[0]];
+        m_shortIdentifiers[characters[0]] = Identifier::fromString(&m_exec->vm(), characters, length);
+        return m_shortIdentifiers[characters[0]];
+    }
+    if (!m_recentIdentifiers[characters[0]].isNull() && Identifier::equal(m_recentIdentifiers[characters[0]].impl(), characters, length))
+        return m_recentIdentifiers[characters[0]];
+    m_recentIdentifiers[characters[0]] = Identifier::fromString(&m_exec->vm(), characters, length);
+    return m_recentIdentifiers[characters[0]];
+}
+
+template <typename CharType>
+ALWAYS_INLINE const Identifier LiteralParser<CharType>::makeIdentifier(const UChar* characters, size_t length)
+{
+    if (!length)
+        return m_exec->vm().propertyNames->emptyIdentifier;
+    if (characters[0] >= MaximumCachableCharacter)
+        return Identifier::fromString(&m_exec->vm(), characters, length);
+
+    if (length == 1) {
+        if (!m_shortIdentifiers[characters[0]].isNull())
+            return m_shortIdentifiers[characters[0]];
+        m_shortIdentifiers[characters[0]] = Identifier::fromString(&m_exec->vm(), characters, length);
+        return m_shortIdentifiers[characters[0]];
+    }
+    if (!m_recentIdentifiers[characters[0]].isNull() && Identifier::equal(m_recentIdentifiers[characters[0]].impl(), characters, length))
+        return m_recentIdentifiers[characters[0]];
+    m_recentIdentifiers[characters[0]] = Identifier::fromString(&m_exec->vm(), characters, length);
+    return m_recentIdentifiers[characters[0]];
+}
+
+template <typename CharType>
+template <ParserMode mode> TokenType LiteralParser<CharType>::Lexer::lex(LiteralParserToken<CharType>& token)
+{
+#if !ASSERT_DISABLED
+    m_currentTokenID++;
+#endif
+
+    while (m_ptr < m_end && isJSONWhiteSpace(*m_ptr))
+        ++m_ptr;
+
+    ASSERT(m_ptr <= m_end);
+    if (m_ptr >= m_end) {
+        token.type = TokEnd;
+        token.start = token.end = m_ptr;
+        return TokEnd;
+    }
+    token.type = TokError;
+    token.start = m_ptr;
+    switch (*m_ptr) {
+        case '[':
+            token.type = TokLBracket;
+            token.end = ++m_ptr;
+            return TokLBracket;
+        case ']':
+            token.type = TokRBracket;
+            token.end = ++m_ptr;
+            return TokRBracket;
+        case '(':
+            token.type = TokLParen;
+            token.end = ++m_ptr;
+            return TokLParen;
+        case ')':
+            token.type = TokRParen;
+            token.end = ++m_ptr;
+            return TokRParen;
+        case '{':
+            token.type = TokLBrace;
+            token.end = ++m_ptr;
+            return TokLBrace;
+        case '}':
+            token.type = TokRBrace;
+            token.end = ++m_ptr;
+            return TokRBrace;
+        case ',':
+            token.type = TokComma;
+            token.end = ++m_ptr;
+            return TokComma;
+        case ':':
+            token.type = TokColon;
+            token.end = ++m_ptr;
+            return TokColon;
+        case '"':
+            return lexString<mode, '"'>(token);
+        case 't':
+            if (m_end - m_ptr >= 4 && m_ptr[1] == 'r' && m_ptr[2] == 'u' && m_ptr[3] == 'e') {
+                m_ptr += 4;
+                token.type = TokTrue;
+                token.end = m_ptr;
+                return TokTrue;
+            }
+            break;
+        case 'f':
+            if (m_end - m_ptr >= 5 && m_ptr[1] == 'a' && m_ptr[2] == 'l' && m_ptr[3] == 's' && m_ptr[4] == 'e') {
+                m_ptr += 5;
+                token.type = TokFalse;
+                token.end = m_ptr;
+                return TokFalse;
+            }
+            break;
+        case 'n':
+            if (m_end - m_ptr >= 4 && m_ptr[1] == 'u' && m_ptr[2] == 'l' && m_ptr[3] == 'l') {
+                m_ptr += 4;
+                token.type = TokNull;
+                token.end = m_ptr;
+                return TokNull;
+            }
+            break;
+        case '-':
+        case '0':
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            return lexNumber(token);
+    }
+    if (m_ptr < m_end) {
+        if (*m_ptr == '.') {
+            token.type = TokDot;
+            token.end = ++m_ptr;
+            return TokDot;
+        }
+        if (*m_ptr == '=') {
+            token.type = TokAssign;
+            token.end = ++m_ptr;
+            return TokAssign;
+        }
+        if (*m_ptr == ';') {
+            token.type = TokSemi;
+            token.end = ++m_ptr;
+            return TokAssign;
+        }
+        if (isASCIIAlpha(*m_ptr) || *m_ptr == '_' || *m_ptr == '$')
+            return lexIdentifier(token);
+        if (*m_ptr == '\'') {
+            if (mode == StrictJSON) {
+                m_lexErrorMessage = ASCIILiteral("Single quotes (\') are not allowed in JSON");
+                return TokError;
+            }
+            return lexString<mode, '\''>(token);
+        }
+    }
+    m_lexErrorMessage = String::format("Unrecognized token '%c'", *m_ptr);
+    return TokError;
+}
+
+template <>
+ALWAYS_INLINE TokenType LiteralParser<LChar>::Lexer::lexIdentifier(LiteralParserToken<LChar>& token)
+{
+    while (m_ptr < m_end && (isASCIIAlphanumeric(*m_ptr) || *m_ptr == '_' || *m_ptr == '$'))
+        m_ptr++;
+    token.stringIs8Bit = 1;
+    token.stringToken8 = token.start;
+    token.stringLength = m_ptr - token.start;
+    token.type = TokIdentifier;
+    token.end = m_ptr;
+    return TokIdentifier;
+}
+
+template <>
+ALWAYS_INLINE TokenType LiteralParser<UChar>::Lexer::lexIdentifier(LiteralParserToken<UChar>& token)
+{
+    while (m_ptr < m_end && (isASCIIAlphanumeric(*m_ptr) || *m_ptr == '_' || *m_ptr == '$' || *m_ptr == 0x200C || *m_ptr == 0x200D))
+        m_ptr++;
+    token.stringIs8Bit = 0;
+    token.stringToken16 = token.start;
+    token.stringLength = m_ptr - token.start;
+    token.type = TokIdentifier;
+    token.end = m_ptr;
+    return TokIdentifier;
+}
+
+template <typename CharType>
+TokenType LiteralParser<CharType>::Lexer::next()
+{
+    if (m_mode == NonStrictJSON)
+        return lex<NonStrictJSON>(m_currentToken);
+    if (m_mode == JSONP)
+        return lex<JSONP>(m_currentToken);
+    return lex<StrictJSON>(m_currentToken);
+}
+
+template <>
+ALWAYS_INLINE void setParserTokenString<LChar>(LiteralParserToken<LChar>& token, const LChar* string)
+{
+    token.stringIs8Bit = 1;
+    token.stringToken8 = string;
+}
+
+template <>
+ALWAYS_INLINE void setParserTokenString<UChar>(LiteralParserToken<UChar>& token, const UChar* string)
+{
+    token.stringIs8Bit = 0;
+    token.stringToken16 = string;
+}
+
+template <ParserMode mode, typename CharType, LChar terminator> static ALWAYS_INLINE bool isSafeStringCharacter(LChar c)
+{
+    return (c >= ' ' && c != '\\' && c != terminator) || (c == '\t' && mode != StrictJSON);
+}
+
+template <ParserMode mode, typename CharType, UChar terminator> static ALWAYS_INLINE bool isSafeStringCharacter(UChar c)
+{
+    return (c >= ' ' && (mode == StrictJSON || c <= 0xff) && c != '\\' && c != terminator) || (c == '\t' && mode != StrictJSON);
+}
+
+template <typename CharType>
+template <ParserMode mode, char terminator> ALWAYS_INLINE TokenType LiteralParser<CharType>::Lexer::lexString(LiteralParserToken<CharType>& token)
+{
+    ++m_ptr;
+    const CharType* runStart = m_ptr;
+    while (m_ptr < m_end && isSafeStringCharacter<mode, CharType, terminator>(*m_ptr))
+        ++m_ptr;
+    if (LIKELY(m_ptr < m_end && *m_ptr == terminator)) {
+        setParserTokenString<CharType>(token, runStart);
+        token.stringLength = m_ptr - runStart;
+        token.type = TokString;
+        token.end = ++m_ptr;
+        return TokString;
+    }
+    return lexStringSlow<mode, terminator>(token, runStart);
+}
+
+template <typename CharType>
+template <ParserMode mode, char terminator> TokenType LiteralParser<CharType>::Lexer::lexStringSlow(LiteralParserToken<CharType>& token, const CharType* runStart)
+{
+    m_builder.clear();
+    goto slowPathBegin;
+    do {
+        runStart = m_ptr;
+        while (m_ptr < m_end && isSafeStringCharacter<mode, CharType, terminator>(*m_ptr))
+            ++m_ptr;
+        if (!m_builder.isEmpty())
+            m_builder.append(runStart, m_ptr - runStart);
+
+slowPathBegin:
+        if ((mode != NonStrictJSON) && m_ptr < m_end && *m_ptr == '\\') {
+            if (m_builder.isEmpty() && runStart < m_ptr)
+                m_builder.append(runStart, m_ptr - runStart);
+            ++m_ptr;
+            if (m_ptr >= m_end) {
+                m_lexErrorMessage = ASCIILiteral("Unterminated string");
+                return TokError;
+            }
+            switch (*m_ptr) {
+                case '"':
+                    m_builder.append('"');
+                    m_ptr++;
+                    break;
+                case '\\':
+                    m_builder.append('\\');
+                    m_ptr++;
+                    break;
+                case '/':
+                    m_builder.append('/');
+                    m_ptr++;
+                    break;
+                case 'b':
+                    m_builder.append('\b');
+                    m_ptr++;
+                    break;
+                case 'f':
+                    m_builder.append('\f');
+                    m_ptr++;
+                    break;
+                case 'n':
+                    m_builder.append('\n');
+                    m_ptr++;
+                    break;
+                case 'r':
+                    m_builder.append('\r');
+                    m_ptr++;
+                    break;
+                case 't':
+                    m_builder.append('\t');
+                    m_ptr++;
+                    break;
+
+                case 'u':
+                    if ((m_end - m_ptr) < 5) { 
+                        m_lexErrorMessage = ASCIILiteral("\\u must be followed by 4 hex digits");
+                        return TokError;
+                    } // uNNNN == 5 characters
+                    for (int i = 1; i < 5; i++) {
+                        if (!isASCIIHexDigit(m_ptr[i])) {
+                            m_lexErrorMessage = String::format("\"\\%s\" is not a valid unicode escape", String(m_ptr, 5).ascii().data());
+                            return TokError;
+                        }
+                    }
+                    m_builder.append(JSC::Lexer<CharType>::convertUnicode(m_ptr[1], m_ptr[2], m_ptr[3], m_ptr[4]));
+                    m_ptr += 5;
+                    break;
+
+                default:
+                    if (*m_ptr == '\'' && mode != StrictJSON) {
+                        m_builder.append('\'');
+                        m_ptr++;
+                        break;
+                    }
+                    m_lexErrorMessage = String::format("Invalid escape character %c", *m_ptr);
+                    return TokError;
+            }
+        }
+    } while ((mode != NonStrictJSON) && m_ptr != runStart && (m_ptr < m_end) && *m_ptr != terminator);
+
+    if (m_ptr >= m_end || *m_ptr != terminator) {
+        m_lexErrorMessage = ASCIILiteral("Unterminated string");
+        return TokError;
+    }
+
+    if (m_builder.isEmpty()) {
+        setParserTokenString<CharType>(token, runStart);
+        token.stringLength = m_ptr - runStart;
+    } else {
+        if (m_builder.is8Bit()) {
+            token.stringIs8Bit = 1;
+            token.stringToken8 = m_builder.characters8();
+        } else {
+            token.stringIs8Bit = 0;
+            token.stringToken16 = m_builder.characters16();
+        }
+        token.stringLength = m_builder.length();
+    }
+    token.type = TokString;
+    token.end = ++m_ptr;
+    return TokString;
+}
+
+template <typename CharType>
+TokenType LiteralParser<CharType>::Lexer::lexNumber(LiteralParserToken<CharType>& token)
+{
+    // ES5 and json.org define numbers as
+    // number
+    //     int
+    //     int frac? exp?
+    //
+    // int
+    //     -? 0
+    //     -? digit1-9 digits?
+    //
+    // digits
+    //     digit digits?
+    //
+    // -?(0 | [1-9][0-9]*) ('.' [0-9]+)? ([eE][+-]? [0-9]+)?
+
+    if (m_ptr < m_end && *m_ptr == '-') // -?
+        ++m_ptr;
+    
+    // (0 | [1-9][0-9]*)
+    if (m_ptr < m_end && *m_ptr == '0') // 0
+        ++m_ptr;
+    else if (m_ptr < m_end && *m_ptr >= '1' && *m_ptr <= '9') { // [1-9]
+        ++m_ptr;
+        // [0-9]*
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    } else {
+        m_lexErrorMessage = ASCIILiteral("Invalid number");
+        return TokError;
+    }
+
+    // ('.' [0-9]+)?
+    const int NumberOfDigitsForSafeInt32 = 9;  // The numbers from -99999999 to 999999999 are always in range of Int32.
+    if (m_ptr < m_end && *m_ptr == '.') {
+        ++m_ptr;
+        // [0-9]+
+        if (m_ptr >= m_end || !isASCIIDigit(*m_ptr)) {
+            m_lexErrorMessage = ASCIILiteral("Invalid digits after decimal point");
+            return TokError;
+        }
+
+        ++m_ptr;
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    } else if (m_ptr < m_end && (*m_ptr != 'e' && *m_ptr != 'E') && (m_ptr - token.start) <= NumberOfDigitsForSafeInt32) {
+        int32_t result = 0;
+        token.type = TokNumber;
+        token.end = m_ptr;
+        const CharType* digit = token.start;
+        bool negative = false;
+        if (*digit == '-') {
+            negative = true;
+            digit++;
+        }
+        
+        ASSERT((m_ptr - digit) <= NumberOfDigitsForSafeInt32);
+        while (digit < m_ptr)
+            result = result * 10 + (*digit++) - '0';
+
+        if (!negative)
+            token.numberToken = result;
+        else {
+            if (!result)
+                token.numberToken = -0.0;
+            else
+                token.numberToken = -result;
+        }
+        return TokNumber;
+    }
+
+    //  ([eE][+-]? [0-9]+)?
+    if (m_ptr < m_end && (*m_ptr == 'e' || *m_ptr == 'E')) { // [eE]
+        ++m_ptr;
+
+        // [-+]?
+        if (m_ptr < m_end && (*m_ptr == '-' || *m_ptr == '+'))
+            ++m_ptr;
+
+        // [0-9]+
+        if (m_ptr >= m_end || !isASCIIDigit(*m_ptr)) {
+            m_lexErrorMessage = ASCIILiteral("Exponent symbols should be followed by an optional '+' or '-' and then by at least one number");
+            return TokError;
+        }
+        
+        ++m_ptr;
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    }
+    
+    token.type = TokNumber;
+    token.end = m_ptr;
+    size_t parsedLength;
+    token.numberToken = parseDouble(token.start, token.end - token.start, parsedLength);
+    return TokNumber;
+}
+
+template <typename CharType>
+JSValue LiteralParser<CharType>::parse(ParserState initialState)
+{
+    VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ParserState state = initialState;
+    MarkedArgumentBuffer objectStack;
+    JSValue lastValue;
+    Vector<ParserState, 16, UnsafeVectorOverflow> stateStack;
+    Vector<Identifier, 16, UnsafeVectorOverflow> identifierStack;
+    HashSet<JSObject*> visitedUnderscoreProto;
+    while (1) {
+        switch(state) {
+            startParseArray:
+            case StartParseArray: {
+                JSArray* array = constructEmptyArray(m_exec, 0);
+                RETURN_IF_EXCEPTION(scope, JSValue());
+                objectStack.append(array);
+            }
+            doParseArrayStartExpression:
+            FALLTHROUGH;
+            case DoParseArrayStartExpression: {
+                TokenType lastToken = m_lexer.currentToken()->type;
+                if (m_lexer.next() == TokRBracket) {
+                    if (lastToken == TokComma) {
+                        m_parseErrorMessage = ASCIILiteral("Unexpected comma at the end of array expression");
+                        return JSValue();
+                    }
+                    m_lexer.next();
+                    lastValue = objectStack.last();
+                    objectStack.removeLast();
+                    break;
+                }
+
+                stateStack.append(DoParseArrayEndExpression);
+                goto startParseExpression;
+            }
+            case DoParseArrayEndExpression: {
+                JSArray* array = asArray(objectStack.last());
+                array->putDirectIndex(m_exec, array->length(), lastValue);
+                
+                if (m_lexer.currentToken()->type == TokComma)
+                    goto doParseArrayStartExpression;
+
+                if (m_lexer.currentToken()->type != TokRBracket) {
+                    m_parseErrorMessage = ASCIILiteral("Expected ']'");
+                    return JSValue();
+                }
+                
+                m_lexer.next();
+                lastValue = objectStack.last();
+                objectStack.removeLast();
+                break;
+            }
+            startParseObject:
+            case StartParseObject: {
+                JSObject* object = constructEmptyObject(m_exec);
+                objectStack.append(object);
+
+                TokenType type = m_lexer.next();
+                if (type == TokString || (m_mode != StrictJSON && type == TokIdentifier)) {
+                    typename Lexer::LiteralParserTokenPtr identifierToken = m_lexer.currentToken();
+                    if (identifierToken->stringIs8Bit)
+                        identifierStack.append(makeIdentifier(identifierToken->stringToken8, identifierToken->stringLength));
+                    else
+                        identifierStack.append(makeIdentifier(identifierToken->stringToken16, identifierToken->stringLength));
+
+                    // Check for colon
+                    if (m_lexer.next() != TokColon) {
+                        m_parseErrorMessage = ASCIILiteral("Expected ':' before value in object property definition");
+                        return JSValue();
+                    }
+                    
+                    m_lexer.next();
+                    stateStack.append(DoParseObjectEndExpression);
+                    goto startParseExpression;
+                }
+                if (type != TokRBrace)  {
+                    m_parseErrorMessage = ASCIILiteral("Expected '}'");
+                    return JSValue();
+                }
+                m_lexer.next();
+                lastValue = objectStack.last();
+                objectStack.removeLast();
+                break;
+            }
+            doParseObjectStartExpression:
+            case DoParseObjectStartExpression: {
+                TokenType type = m_lexer.next();
+                if (type != TokString && (m_mode == StrictJSON || type != TokIdentifier)) {
+                    m_parseErrorMessage = ASCIILiteral("Property name must be a string literal");
+                    return JSValue();
+                }
+                typename Lexer::LiteralParserTokenPtr identifierToken = m_lexer.currentToken();
+                if (identifierToken->stringIs8Bit)
+                    identifierStack.append(makeIdentifier(identifierToken->stringToken8, identifierToken->stringLength));
+                else
+                    identifierStack.append(makeIdentifier(identifierToken->stringToken16, identifierToken->stringLength));
+
+                // Check for colon
+                if (m_lexer.next() != TokColon) {
+                    m_parseErrorMessage = ASCIILiteral("Expected ':'");
+                    return JSValue();
+                }
+
+                m_lexer.next();
+                stateStack.append(DoParseObjectEndExpression);
+                goto startParseExpression;
+            }
+            case DoParseObjectEndExpression:
+            {
+                JSObject* object = asObject(objectStack.last());
+                PropertyName ident = identifierStack.last();
+                if (m_mode != StrictJSON && ident == vm.propertyNames->underscoreProto) {
+                    if (!visitedUnderscoreProto.add(object).isNewEntry) {
+                        m_parseErrorMessage = ASCIILiteral("Attempted to redefine __proto__ property");
+                        return JSValue();
+                    }
+                    CodeBlock* codeBlock = m_exec->codeBlock();
+                    PutPropertySlot slot(object, codeBlock ? codeBlock->isStrictMode() : false);
+                    objectStack.last().put(m_exec, ident, lastValue, slot);
+                } else {
+                    if (std::optional<uint32_t> index = parseIndex(ident))
+                        object->putDirectIndex(m_exec, index.value(), lastValue);
+                    else
+                        object->putDirect(vm, ident, lastValue);
+                }
+                identifierStack.removeLast();
+                if (m_lexer.currentToken()->type == TokComma)
+                    goto doParseObjectStartExpression;
+                if (m_lexer.currentToken()->type != TokRBrace) {
+                    m_parseErrorMessage = ASCIILiteral("Expected '}'");
+                    return JSValue();
+                }
+                m_lexer.next();
+                lastValue = objectStack.last();
+                objectStack.removeLast();
+                break;
+            }
+            startParseExpression:
+            case StartParseExpression: {
+                switch (m_lexer.currentToken()->type) {
+                    case TokLBracket:
+                        goto startParseArray;
+                    case TokLBrace:
+                        goto startParseObject;
+                    case TokString: {
+                        typename Lexer::LiteralParserTokenPtr stringToken = m_lexer.currentToken();
+                        if (stringToken->stringIs8Bit)
+                            lastValue = jsString(m_exec, makeIdentifier(stringToken->stringToken8, stringToken->stringLength).string());
+                        else
+                            lastValue = jsString(m_exec, makeIdentifier(stringToken->stringToken16, stringToken->stringLength).string());
+                        m_lexer.next();
+                        break;
+                    }
+                    case TokNumber: {
+                        typename Lexer::LiteralParserTokenPtr numberToken = m_lexer.currentToken();
+                        lastValue = jsNumber(numberToken->numberToken);
+                        m_lexer.next();
+                        break;
+                    }
+                    case TokNull:
+                        m_lexer.next();
+                        lastValue = jsNull();
+                        break;
+
+                    case TokTrue:
+                        m_lexer.next();
+                        lastValue = jsBoolean(true);
+                        break;
+
+                    case TokFalse:
+                        m_lexer.next();
+                        lastValue = jsBoolean(false);
+                        break;
+                    case TokRBracket:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ']'");
+                        return JSValue();
+                    case TokRBrace:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '}'");
+                        return JSValue();
+                    case TokIdentifier: {
+                        typename Lexer::LiteralParserTokenPtr token = m_lexer.currentToken();
+                        if (token->stringIs8Bit)
+                            m_parseErrorMessage = String::format("Unexpected identifier \"%s\"", String(token->stringToken8, token->stringLength).ascii().data());
+                        else
+                            m_parseErrorMessage = String::format("Unexpected identifier \"%s\"", String(token->stringToken16, token->stringLength).ascii().data());
+                        return JSValue();
+                    }
+                    case TokColon:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ':'");
+                        return JSValue();
+                    case TokLParen:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '('");
+                        return JSValue();
+                    case TokRParen:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ')'");
+                        return JSValue();
+                    case TokComma:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ','");
+                        return JSValue();
+                    case TokDot:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '.'");
+                        return JSValue();
+                    case TokAssign:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '='");
+                        return JSValue();
+                    case TokSemi:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ';'");
+                        return JSValue();
+                    case TokEnd:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected EOF");
+                        return JSValue();
+                    case TokError:
+                    default:
+                        // Error
+                        m_parseErrorMessage = ASCIILiteral("Could not parse value expression");
+                        return JSValue();
+                }
+                break;
+            }
+            case StartParseStatement: {
+                switch (m_lexer.currentToken()->type) {
+                    case TokLBracket:
+                    case TokNumber:
+                    case TokString:
+                        goto startParseExpression;
+
+                    case TokLParen: {
+                        m_lexer.next();
+                        stateStack.append(StartParseStatementEndStatement);
+                        goto startParseExpression;
+                    }
+                    case TokRBracket:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ']'");
+                        return JSValue();
+                    case TokLBrace:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '{'");
+                        return JSValue();
+                    case TokRBrace:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '}'");
+                        return JSValue();
+                    case TokIdentifier:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected identifier");
+                        return JSValue();
+                    case TokColon:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ':'");
+                        return JSValue();
+                    case TokRParen:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ')'");
+                        return JSValue();
+                    case TokComma:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ','");
+                        return JSValue();
+                    case TokTrue:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token 'true'");
+                        return JSValue();
+                    case TokFalse:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token 'false'");
+                        return JSValue();
+                    case TokNull:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token 'null'");
+                        return JSValue();
+                    case TokEnd:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected EOF");
+                        return JSValue();
+                    case TokDot:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '.'");
+                        return JSValue();
+                    case TokAssign:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '='");
+                        return JSValue();
+                    case TokSemi:
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ';'");
+                        return JSValue();
+                    case TokError:
+                    default:
+                        m_parseErrorMessage = ASCIILiteral("Could not parse statement");
+                        return JSValue();
+                }
+            }
+            case StartParseStatementEndStatement: {
+                ASSERT(stateStack.isEmpty());
+                if (m_lexer.currentToken()->type != TokRParen)
+                    return JSValue();
+                if (m_lexer.next() == TokEnd)
+                    return lastValue;
+                m_parseErrorMessage = ASCIILiteral("Unexpected content at end of JSON literal");
+                return JSValue();
+            }
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+        }
+        if (stateStack.isEmpty())
+            return lastValue;
+        state = stateStack.last();
+        stateStack.removeLast();
+        continue;
+    }
+}
+
+// Instantiate the two flavors of LiteralParser we need instead of putting most of this file in LiteralParser.h
+template class LiteralParser<LChar>;
+template class LiteralParser<UChar>;
+
+}
diff --git a/runtime/LiteralParser.h b/runtime/LiteralParser.h
new file mode 100644
index 0000000..8dc142c
--- /dev/null
+++ b/runtime/LiteralParser.h
@@ -0,0 +1,205 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include "JSCJSValue.h"
+#include "JSGlobalObjectFunctions.h"
+#include <array>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+typedef enum { StrictJSON, NonStrictJSON, JSONP } ParserMode;
+
+enum JSONPPathEntryType {
+    JSONPPathEntryTypeDeclare, // var pathEntryName = JSON
+    JSONPPathEntryTypeDot, // <prior entries>.pathEntryName = JSON
+    JSONPPathEntryTypeLookup, // <prior entries>[pathIndex] = JSON
+    JSONPPathEntryTypeCall // <prior entries>(JSON)
+};
+
+enum ParserState { StartParseObject, StartParseArray, StartParseExpression, 
+                   StartParseStatement, StartParseStatementEndStatement, 
+                   DoParseObjectStartExpression, DoParseObjectEndExpression,
+                   DoParseArrayStartExpression, DoParseArrayEndExpression };
+enum TokenType { TokLBracket, TokRBracket, TokLBrace, TokRBrace, 
+                 TokString, TokIdentifier, TokNumber, TokColon, 
+                 TokLParen, TokRParen, TokComma, TokTrue, TokFalse,
+                 TokNull, TokEnd, TokDot, TokAssign, TokSemi, TokError };
+    
+struct JSONPPathEntry {
+    JSONPPathEntryType m_type;
+    Identifier m_pathEntryName;
+    int m_pathIndex;
+};
+
+struct JSONPData {
+    Vector<JSONPPathEntry> m_path;
+    Strong<Unknown> m_value;
+};
+
+template <typename CharType>
+struct LiteralParserToken {
+private:
+WTF_MAKE_NONCOPYABLE(LiteralParserToken<CharType>);
+
+public:
+    LiteralParserToken() = default;
+
+    TokenType type;
+    const CharType* start;
+    const CharType* end;
+    union {
+        double numberToken;
+        struct {
+            union {
+                const LChar* stringToken8;
+                const UChar* stringToken16;
+            };
+            unsigned stringIs8Bit : 1;
+            unsigned stringLength : 31;
+        };
+    };
+};
+
+template <typename CharType>
+ALWAYS_INLINE void setParserTokenString(LiteralParserToken<CharType>&, const CharType* string);
+
+template <typename CharType>
+class LiteralParser {
+public:
+    LiteralParser(ExecState* exec, const CharType* characters, unsigned length, ParserMode mode)
+        : m_exec(exec)
+        , m_lexer(characters, length, mode)
+        , m_mode(mode)
+    {
+    }
+    
+    String getErrorMessage()
+    { 
+        if (!m_lexer.getErrorMessage().isEmpty())
+            return String::format("JSON Parse error: %s", m_lexer.getErrorMessage().ascii().data());
+        if (!m_parseErrorMessage.isEmpty())
+            return String::format("JSON Parse error: %s", m_parseErrorMessage.ascii().data());
+        return ASCIILiteral("JSON Parse error: Unable to parse JSON string");
+    }
+    
+    JSValue tryLiteralParse()
+    {
+        m_lexer.next();
+        JSValue result = parse(m_mode == StrictJSON ? StartParseExpression : StartParseStatement);
+        if (m_lexer.currentToken()->type == TokSemi)
+            m_lexer.next();
+        if (m_lexer.currentToken()->type != TokEnd)
+            return JSValue();
+        return result;
+    }
+    
+    bool tryJSONPParse(Vector<JSONPData>&, bool needsFullSourceInfo);
+
+private:
+    class Lexer {
+    public:
+        Lexer(const CharType* characters, unsigned length, ParserMode mode)
+            : m_mode(mode)
+            , m_ptr(characters)
+            , m_end(characters + length)
+        {
+        }
+        
+        TokenType next();
+        
+#if ASSERT_DISABLED
+        typedef const LiteralParserToken<CharType>* LiteralParserTokenPtr;
+
+        LiteralParserTokenPtr currentToken()
+        {
+            return &m_currentToken;
+        }
+#else
+        class LiteralParserTokenPtr;
+        friend class LiteralParserTokenPtr;
+        class LiteralParserTokenPtr {
+        public:
+            LiteralParserTokenPtr(Lexer& lexer)
+                : m_lexer(lexer)
+                , m_tokenID(lexer.m_currentTokenID)
+            {
+            }
+
+            ALWAYS_INLINE const LiteralParserToken<CharType>* operator->() const
+            {
+                ASSERT(m_tokenID == m_lexer.m_currentTokenID);
+                return &m_lexer.m_currentToken;
+            }
+
+        private:
+            Lexer& m_lexer;
+            unsigned m_tokenID;
+        };
+
+        LiteralParserTokenPtr currentToken()
+        {
+            return LiteralParserTokenPtr(*this);
+        }
+#endif
+        
+        String getErrorMessage() { return m_lexErrorMessage; }
+        
+    private:
+        String m_lexErrorMessage;
+        template <ParserMode mode> TokenType lex(LiteralParserToken<CharType>&);
+        ALWAYS_INLINE TokenType lexIdentifier(LiteralParserToken<CharType>&);
+        template <ParserMode mode, char terminator> ALWAYS_INLINE TokenType lexString(LiteralParserToken<CharType>&);
+        template <ParserMode mode, char terminator> TokenType lexStringSlow(LiteralParserToken<CharType>&, const CharType* runStart);
+        ALWAYS_INLINE TokenType lexNumber(LiteralParserToken<CharType>&);
+        LiteralParserToken<CharType> m_currentToken;
+        ParserMode m_mode;
+        const CharType* m_ptr;
+        const CharType* m_end;
+        StringBuilder m_builder;
+#if !ASSERT_DISABLED
+        unsigned m_currentTokenID { 0 };
+#endif
+    };
+    
+    class StackGuard;
+    JSValue parse(ParserState);
+
+    ExecState* m_exec;
+    typename LiteralParser<CharType>::Lexer m_lexer;
+    ParserMode m_mode;
+    String m_parseErrorMessage;
+    static unsigned const MaximumCachableCharacter = 128;
+    std::array<Identifier, MaximumCachableCharacter> m_shortIdentifiers;
+    std::array<Identifier, MaximumCachableCharacter> m_recentIdentifiers;
+    ALWAYS_INLINE const Identifier makeIdentifier(const LChar* characters, size_t length);
+    ALWAYS_INLINE const Identifier makeIdentifier(const UChar* characters, size_t length);
+};
+
+} // namespace JSC
diff --git a/runtime/Lookup.cpp b/runtime/Lookup.cpp
new file mode 100644
index 0000000..f40740e
--- /dev/null
+++ b/runtime/Lookup.cpp
@@ -0,0 +1,74 @@
+/*
+ *  Copyright (C) 2008, 2012, 2015-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "Lookup.h"
+
+#include "GetterSetter.h"
+#include "JSFunction.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+void reifyStaticAccessor(VM& vm, const HashTableValue& value, JSObject& thisObject, PropertyName propertyName)
+{
+    JSGlobalObject* globalObject = thisObject.globalObject();
+    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
+    if (value.accessorGetter()) {
+        String getterName = tryMakeString(ASCIILiteral("get "), String(*propertyName.publicName()));
+        if (!getterName)
+            return;
+        accessor->setGetter(vm, globalObject, value.attributes() & Builtin
+            ? JSFunction::createBuiltinFunction(vm, value.builtinAccessorGetterGenerator()(vm), globalObject, getterName)
+            : JSFunction::create(vm, globalObject, 0, getterName, value.accessorGetter()));
+    }
+    thisObject.putDirectNonIndexAccessor(vm, propertyName, accessor, attributesForStructure(value.attributes()));
+}
+
+bool setUpStaticFunctionSlot(VM& vm, const HashTableValue* entry, JSObject* thisObject, PropertyName propertyName, PropertySlot& slot)
+{
+    ASSERT(thisObject->globalObject());
+    ASSERT(entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty);
+    unsigned attributes;
+    bool isAccessor = entry->attributes() & Accessor;
+    PropertyOffset offset = thisObject->getDirectOffset(vm, propertyName, attributes);
+
+    if (!isValidOffset(offset)) {
+        // If a property is ever deleted from an object with a static table, then we reify
+        // all static functions at that time - after this we shouldn't be re-adding anything.
+        if (thisObject->staticPropertiesReified())
+            return false;
+
+        reifyStaticProperty(vm, propertyName, *entry, *thisObject);
+
+        offset = thisObject->getDirectOffset(vm, propertyName, attributes);
+        if (!isValidOffset(offset)) {
+            dataLog("Static hashtable initialiation for ", propertyName, " did not produce a property.\n");
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    if (isAccessor)
+        slot.setCacheableGetterSlot(thisObject, attributes, jsCast<GetterSetter*>(thisObject->getDirect(offset)), offset);
+    else
+        slot.setValue(thisObject, attributes, thisObject->getDirect(offset), offset);
+    return true;
+}
+
+} // namespace JSC
diff --git a/runtime/Lookup.h b/runtime/Lookup.h
new file mode 100644
index 0000000..d707686
--- /dev/null
+++ b/runtime/Lookup.h
@@ -0,0 +1,390 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2006, 2007, 2008, 2009, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "BatchedTransitionOptimizer.h"
+#include "CallFrame.h"
+#include "CustomGetterSetter.h"
+#include "DOMJITGetterSetter.h"
+#include "DOMJITSignature.h"
+#include "Identifier.h"
+#include "IdentifierInlines.h"
+#include "Intrinsic.h"
+#include "JSGlobalObject.h"
+#include "LazyProperty.h"
+#include "PropertySlot.h"
+#include "PutPropertySlot.h"
+#include "TypeError.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+struct CompactHashIndex {
+    const int16_t value;
+    const int16_t next;
+};
+
+// FIXME: There is no reason this get function can't be simpler.
+// ie. typedef JSValue (*GetFunction)(ExecState*, JSObject* baseObject)
+typedef PropertySlot::GetValueFunc GetFunction;
+typedef PutPropertySlot::PutValueFunc PutFunction;
+typedef FunctionExecutable* (*BuiltinGenerator)(VM&);
+typedef JSValue (*LazyPropertyCallback)(VM&, JSObject*);
+typedef DOMJIT::GetterSetter* (*DOMJITGetterSetterGenerator)(void);
+
+// Hash table generated by the create_hash_table script.
+struct HashTableValue {
+    const char* m_key; // property name
+    unsigned m_attributes; // JSObject attributes
+    Intrinsic m_intrinsic;
+    union ValueStorage {
+        constexpr ValueStorage(intptr_t value1, intptr_t value2)
+            : value1(value1)
+            , value2(value2)
+        { }
+        constexpr ValueStorage(long long constant)
+            : constant(constant)
+        { }
+
+        struct {
+            intptr_t value1;
+            intptr_t value2;
+        };
+        long long constant;
+    } m_values;
+
+    unsigned attributes() const { return m_attributes; }
+
+    Intrinsic intrinsic() const { ASSERT(m_attributes & Function); return m_intrinsic; }
+    BuiltinGenerator builtinGenerator() const { ASSERT(m_attributes & Builtin); return reinterpret_cast<BuiltinGenerator>(m_values.value1); }
+    NativeFunction function() const { ASSERT(m_attributes & Function); return reinterpret_cast<NativeFunction>(m_values.value1); }
+    unsigned char functionLength() const
+    {
+        ASSERT(m_attributes & Function);
+        if (m_attributes & DOMJITFunction)
+            return signature()->argumentCount;
+        return static_cast<unsigned char>(m_values.value2);
+    }
+
+    GetFunction propertyGetter() const { ASSERT(!(m_attributes & BuiltinOrFunctionOrAccessorOrLazyPropertyOrConstant)); return reinterpret_cast<GetFunction>(m_values.value1); }
+    PutFunction propertyPutter() const { ASSERT(!(m_attributes & BuiltinOrFunctionOrAccessorOrLazyPropertyOrConstant)); return reinterpret_cast<PutFunction>(m_values.value2); }
+
+    DOMJIT::GetterSetter* domJIT() const { ASSERT(m_attributes & DOMJITAttribute); return reinterpret_cast<DOMJITGetterSetterGenerator>(m_values.value1)(); }
+    const DOMJIT::Signature* signature() const { ASSERT(m_attributes & DOMJITFunction); return reinterpret_cast<const DOMJIT::Signature*>(m_values.value2); }
+
+    NativeFunction accessorGetter() const { ASSERT(m_attributes & Accessor); return reinterpret_cast<NativeFunction>(m_values.value1); }
+    NativeFunction accessorSetter() const { ASSERT(m_attributes & Accessor); return reinterpret_cast<NativeFunction>(m_values.value2); }
+    BuiltinGenerator builtinAccessorGetterGenerator() const;
+    BuiltinGenerator builtinAccessorSetterGenerator() const;
+
+    long long constantInteger() const { ASSERT(m_attributes & ConstantInteger); return m_values.constant; }
+
+    intptr_t lexerValue() const { ASSERT(!m_attributes); return m_values.value1; }
+    
+    ptrdiff_t lazyCellPropertyOffset() const { ASSERT(m_attributes & CellProperty); return m_values.value1; }
+    ptrdiff_t lazyClassStructureOffset() const { ASSERT(m_attributes & ClassStructure); return m_values.value1; }
+    LazyPropertyCallback lazyPropertyCallback() const { ASSERT(m_attributes & PropertyCallback); return reinterpret_cast<LazyPropertyCallback>(m_values.value1); }
+};
+
+struct HashTable {
+    int numberOfValues;
+    int indexMask;
+    bool hasSetterOrReadonlyProperties;
+
+    const HashTableValue* values; // Fixed values generated by script.
+    const CompactHashIndex* index;
+
+    // Find an entry in the table, and return the entry.
+    ALWAYS_INLINE const HashTableValue* entry(PropertyName propertyName) const
+    {
+        if (propertyName.isSymbol())
+            return nullptr;
+
+        auto uid = propertyName.uid();
+        if (!uid)
+            return nullptr;
+
+        int indexEntry = IdentifierRepHash::hash(uid) & indexMask;
+        int valueIndex = index[indexEntry].value;
+        if (valueIndex == -1)
+            return nullptr;
+
+        while (true) {
+            if (WTF::equal(uid, values[valueIndex].m_key))
+                return &values[valueIndex];
+
+            indexEntry = index[indexEntry].next;
+            if (indexEntry == -1)
+                return nullptr;
+            valueIndex = index[indexEntry].value;
+            ASSERT(valueIndex != -1);
+        };
+    }
+
+    class ConstIterator {
+    public:
+        ConstIterator(const HashTable* table, int position)
+            : m_table(table)
+            , m_position(position)
+        {
+            skipInvalidKeys();
+        }
+
+        const HashTableValue* value() const
+        {
+            return &m_table->values[m_position];
+        }
+
+        const HashTableValue& operator*() const { return *value(); }
+
+        const char* key() const
+        {
+            return m_table->values[m_position].m_key;
+        }
+
+        const HashTableValue* operator->() const
+        {
+            return value();
+        }
+
+        bool operator!=(const ConstIterator& other) const
+        {
+            ASSERT(m_table == other.m_table);
+            return m_position != other.m_position;
+        }
+
+        ConstIterator& operator++()
+        {
+            ASSERT(m_position < m_table->numberOfValues);
+            ++m_position;
+            skipInvalidKeys();
+            return *this;
+        }
+
+    private:
+        void skipInvalidKeys()
+        {
+            ASSERT(m_position <= m_table->numberOfValues);
+            while (m_position < m_table->numberOfValues && !m_table->values[m_position].m_key)
+                ++m_position;
+            ASSERT(m_position <= m_table->numberOfValues);
+        }
+
+        const HashTable* m_table;
+        int m_position;
+    };
+
+    ConstIterator begin() const
+    {
+        return ConstIterator(this, 0);
+    }
+    ConstIterator end() const
+    {
+        return ConstIterator(this, numberOfValues);
+    }
+};
+
+JS_EXPORT_PRIVATE bool setUpStaticFunctionSlot(VM&, const HashTableValue*, JSObject* thisObject, PropertyName, PropertySlot&);
+JS_EXPORT_PRIVATE void reifyStaticAccessor(VM&, const HashTableValue&, JSObject& thisObject, PropertyName);
+
+inline BuiltinGenerator HashTableValue::builtinAccessorGetterGenerator() const
+{
+    ASSERT(m_attributes & Accessor);
+    ASSERT(m_attributes & Builtin);
+    return reinterpret_cast<BuiltinGenerator>(m_values.value1);
+}
+
+inline BuiltinGenerator HashTableValue::builtinAccessorSetterGenerator() const
+{
+    ASSERT(m_attributes & Accessor);
+    ASSERT(m_attributes & Builtin);
+    return reinterpret_cast<BuiltinGenerator>(m_values.value2);
+}
+
+inline bool getStaticPropertySlotFromTable(VM& vm, const HashTable& table, JSObject* thisObject, PropertyName propertyName, PropertySlot& slot)
+{
+    if (thisObject->staticPropertiesReified())
+        return false;
+
+    auto* entry = table.entry(propertyName);
+    if (!entry)
+        return false;
+
+    if (entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty)
+        return setUpStaticFunctionSlot(vm, entry, thisObject, propertyName, slot);
+
+    if (entry->attributes() & ConstantInteger) {
+        slot.setValue(thisObject, attributesForStructure(entry->attributes()), jsNumber(entry->constantInteger()));
+        return true;
+    }
+
+    if (entry->attributes() & DOMJITAttribute) {
+        DOMJIT::GetterSetter* domJIT = entry->domJIT();
+        slot.setCacheableCustom(thisObject, attributesForStructure(entry->attributes()), domJIT->getter(), domJIT);
+        return true;
+    }
+
+    slot.setCacheableCustom(thisObject, attributesForStructure(entry->attributes()), entry->propertyGetter());
+    return true;
+}
+
+inline bool replaceStaticPropertySlot(VM& vm, JSObject* thisObject, PropertyName propertyName, JSValue value)
+{
+    if (!thisObject->putDirect(vm, propertyName, value))
+        return false;
+
+    if (!thisObject->staticPropertiesReified())
+        thisObject->JSObject::setStructure(vm, Structure::attributeChangeTransition(vm, thisObject->structure(), propertyName, 0));
+
+    return true;
+}
+
+// 'base' means the object holding the property (possibly in the prototype chain of the object put was called on).
+// 'thisValue' is the object that put is being applied to (in the case of a proxy, the proxy target).
+// 'slot.thisValue()' is the object the put was originally performed on (in the case of a proxy, the proxy itself).
+inline bool putEntry(ExecState* exec, const HashTableValue* entry, JSObject* base, JSObject* thisValue, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (entry->attributes() & BuiltinOrFunctionOrLazyProperty) {
+        if (!(entry->attributes() & ReadOnly)) {
+            // If this is a function or lazy property put then we just do the put because
+            // logically the object already had the property, so this is just a replace.
+            if (JSObject* thisObject = jsDynamicCast<JSObject*>(thisValue))
+                thisObject->putDirect(vm, propertyName, value);
+            return true;
+        }
+        return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+    }
+
+    if (entry->attributes() & Accessor)
+        return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+
+    if (!(entry->attributes() & ReadOnly)) {
+        ASSERT_WITH_MESSAGE(!(entry->attributes() & DOMJITAttribute), "DOMJITAttribute supports readonly attributes currently.");
+        bool isAccessor = entry->attributes() & CustomAccessor;
+        JSValue updateThisValue = entry->attributes() & CustomAccessor ? slot.thisValue() : JSValue(base);
+        bool result = callCustomSetter(exec, entry->propertyPutter(), isAccessor, updateThisValue, value);
+        if (isAccessor)
+            slot.setCustomAccessor(base, entry->propertyPutter());
+        else
+            slot.setCustomValue(base, entry->propertyPutter());
+        return result;
+    }
+
+    return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+}
+
+/**
+ * This one is for "put".
+ * It looks up a hash entry for the property to be set.  If an entry
+ * is found it sets the value and returns true, else it returns false.
+ */
+inline bool lookupPut(ExecState* exec, PropertyName propertyName, JSObject* base, JSValue value, const HashTable& table, PutPropertySlot& slot, bool& putResult)
+{
+    const HashTableValue* entry = table.entry(propertyName);
+
+    if (!entry)
+        return false;
+
+    putResult = putEntry(exec, entry, base, base, propertyName, value, slot);
+    return true;
+}
+
+inline void reifyStaticProperty(VM& vm, const PropertyName& propertyName, const HashTableValue& value, JSObject& thisObj)
+{
+    if (value.attributes() & Builtin) {
+        if (value.attributes() & Accessor)
+            reifyStaticAccessor(vm, value, thisObj, propertyName);
+        else
+            thisObj.putDirectBuiltinFunction(vm, thisObj.globalObject(), propertyName, value.builtinGenerator()(vm), attributesForStructure(value.attributes()));
+        return;
+    }
+
+    if (value.attributes() & Function) {
+        if (value.attributes() & DOMJITFunction) {
+            thisObj.putDirectNativeFunction(
+                vm, thisObj.globalObject(), propertyName, value.functionLength(),
+                value.function(), value.intrinsic(), value.signature(), attributesForStructure(value.attributes()));
+            return;
+        }
+        thisObj.putDirectNativeFunction(
+            vm, thisObj.globalObject(), propertyName, value.functionLength(),
+            value.function(), value.intrinsic(), attributesForStructure(value.attributes()));
+        return;
+    }
+
+    if (value.attributes() & ConstantInteger) {
+        thisObj.putDirect(vm, propertyName, jsNumber(value.constantInteger()), attributesForStructure(value.attributes()));
+        return;
+    }
+
+    if (value.attributes() & Accessor) {
+        reifyStaticAccessor(vm, value, thisObj, propertyName);
+        return;
+    }
+    
+    if (value.attributes() & CellProperty) {
+        LazyCellProperty* property = bitwise_cast<LazyCellProperty*>(
+            bitwise_cast<char*>(&thisObj) + value.lazyCellPropertyOffset());
+        JSCell* result = property->get(&thisObj);
+        thisObj.putDirect(vm, propertyName, result, attributesForStructure(value.attributes()));
+        return;
+    }
+    
+    if (value.attributes() & ClassStructure) {
+        LazyClassStructure* structure = bitwise_cast<LazyClassStructure*>(
+            bitwise_cast<char*>(&thisObj) + value.lazyClassStructureOffset());
+        structure->get(jsCast<JSGlobalObject*>(&thisObj));
+        return;
+    }
+    
+    if (value.attributes() & PropertyCallback) {
+        JSValue result = value.lazyPropertyCallback()(vm, &thisObj);
+        thisObj.putDirect(vm, propertyName, result, attributesForStructure(value.attributes()));
+        return;
+    }
+
+    if (value.attributes() & DOMJITAttribute) {
+        DOMJIT::GetterSetter* domJIT = value.domJIT();
+        CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, domJIT->getter(), domJIT->setter(), domJIT);
+        thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
+        return;
+    }
+
+    CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter());
+    thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
+}
+
+template<unsigned numberOfValues>
+inline void reifyStaticProperties(VM& vm, const HashTableValue (&values)[numberOfValues], JSObject& thisObj)
+{
+    BatchedTransitionOptimizer transitionOptimizer(vm, &thisObj);
+    for (auto& value : values) {
+        if (!value.m_key)
+            continue;
+        auto key = Identifier::fromString(&vm, reinterpret_cast<const LChar*>(value.m_key), strlen(value.m_key));
+        reifyStaticProperty(vm, key, value, thisObj);
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/MapBase.cpp b/runtime/MapBase.cpp
new file mode 100644
index 0000000..6527f8c
--- /dev/null
+++ b/runtime/MapBase.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MapBase.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+template <typename HashMapBucketType>
+void MapBase<HashMapBucketType>::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    MapBase* thisObject = static_cast<MapBase*>(cell);
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_map);
+}
+
+template <typename HashMapBucketType>
+size_t MapBase<HashMapBucketType>::estimatedSize(JSCell* cell)
+{
+    return Base::estimatedSize(cell) + static_cast<MapBase*>(cell)->m_map->approximateSize();
+}
+
+template class MapBase<HashMapBucket<HashMapBucketDataKeyValue>>;
+template class MapBase<HashMapBucket<HashMapBucketDataKey>>;
+
+} // namespace JSC
diff --git a/runtime/MapBase.h b/runtime/MapBase.h
new file mode 100644
index 0000000..7d5c12e
--- /dev/null
+++ b/runtime/MapBase.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "HashMapImpl.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+template <typename HashMapBucketType>
+class MapBase : public JSNonFinalObject {
+    typedef HashMapImpl<HashMapBucketType> HashMapImplType;
+    typedef JSNonFinalObject Base;
+public:
+
+    typedef HashMapBucketType BucketType;
+
+    ALWAYS_INLINE size_t size(ExecState*)
+    {
+        return m_map->size();
+    }
+
+    ALWAYS_INLINE bool has(ExecState* exec, JSValue key)
+    {
+        return m_map->has(exec, key);
+    }
+
+    ALWAYS_INLINE void clear(ExecState* exec)
+    {
+        m_map->clear(exec);
+    }
+
+    ALWAYS_INLINE bool remove(ExecState* exec, JSValue key)
+    {
+        return m_map->remove(exec, key);
+    }
+
+    ALWAYS_INLINE HashMapBucketType** findBucket(ExecState* exec, JSValue key, uint32_t hash)
+    {
+        return m_map->findBucket(exec, key, hash);
+    }
+
+    static ptrdiff_t offsetOfHashMapImpl()
+    {
+        return OBJECT_OFFSETOF(MapBase<HashMapBucketType>, m_map);
+    }
+
+    ALWAYS_INLINE HashMapImplType* impl() { return m_map.get(); }
+
+    void finishCreation(ExecState* exec, VM& vm)
+    {
+        Base::finishCreation(vm);
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        HashMapImplType* impl = HashMapImplType::create(exec, vm);
+        RETURN_IF_EXCEPTION(scope, void());
+        m_map.set(vm, this, impl);
+    }
+
+protected:
+    MapBase(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    static size_t estimatedSize(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<HashMapImplType> m_map;
+};
+
+} // namespace JSC
diff --git a/runtime/MapConstructor.cpp b/runtime/MapConstructor.cpp
new file mode 100644
index 0000000..997964c
--- /dev/null
+++ b/runtime/MapConstructor.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MapConstructor.h"
+
+#include "Error.h"
+#include "GetterSetter.h"
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSMap.h"
+#include "JSObjectInlines.h"
+#include "MapPrototype.h"
+
+namespace JSC {
+
+const ClassInfo MapConstructor::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(MapConstructor) };
+
+void MapConstructor::finishCreation(VM& vm, MapPrototype* mapPrototype, GetterSetter* speciesSymbol)
+{
+    Base::finishCreation(vm, mapPrototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, mapPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontEnum | ReadOnly);
+    putDirectNonIndexAccessor(vm, vm.propertyNames->speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);
+}
+
+static EncodedJSValue JSC_HOST_CALL callMap(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "Map"));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructMap(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = asInternalFunction(exec->jsCallee())->globalObject();
+    Structure* mapStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->mapStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSMap* map = JSMap::create(exec, vm, mapStructure);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSValue iterable = exec->argument(0);
+    if (iterable.isUndefinedOrNull())
+        return JSValue::encode(map);
+
+    JSValue adderFunction = map->JSObject::get(exec, exec->propertyNames().set);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    CallData adderFunctionCallData;
+    CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
+    if (adderFunctionCallType == CallType::None)
+        return JSValue::encode(throwTypeError(exec, scope));
+
+    scope.release();
+    forEachInIterable(exec, iterable, [&](VM& vm, ExecState* exec, JSValue nextItem) {
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        if (!nextItem.isObject()) {
+            throwTypeError(exec, scope);
+            return;
+        }
+
+        JSValue key = nextItem.get(exec, static_cast<unsigned>(0));
+        RETURN_IF_EXCEPTION(scope, void());
+
+        JSValue value = nextItem.get(exec, static_cast<unsigned>(1));
+        RETURN_IF_EXCEPTION(scope, void());
+
+        MarkedArgumentBuffer arguments;
+        arguments.append(key);
+        arguments.append(value);
+        scope.release();
+        call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, map, arguments);
+    });
+
+    return JSValue::encode(map);
+}
+
+ConstructType MapConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructMap;
+    return ConstructType::Host;
+}
+
+CallType MapConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callMap;
+    return CallType::Host;
+}
+
+}
diff --git a/runtime/MapConstructor.h b/runtime/MapConstructor.h
new file mode 100644
index 0000000..99ff93b
--- /dev/null
+++ b/runtime/MapConstructor.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class MapPrototype;
+class GetterSetter;
+
+class MapConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static MapConstructor* create(VM& vm, Structure* structure, MapPrototype* mapPrototype, GetterSetter* speciesSymbol)
+    {
+        MapConstructor* constructor = new (NotNull, allocateCell<MapConstructor>(vm.heap)) MapConstructor(vm, structure);
+        constructor->finishCreation(vm, mapPrototype, speciesSymbol);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    MapConstructor(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, MapPrototype*, GetterSetter* speciesSymbol);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/MapIteratorPrototype.cpp b/runtime/MapIteratorPrototype.cpp
new file mode 100644
index 0000000..13fdc44
--- /dev/null
+++ b/runtime/MapIteratorPrototype.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MapIteratorPrototype.h"
+
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSMapIterator.h"
+
+namespace JSC {
+
+const ClassInfo MapIteratorPrototype::s_info = { "Map Iterator", &Base::s_info, 0, CREATE_METHOD_TABLE(MapIteratorPrototype) };
+
+static EncodedJSValue JSC_HOST_CALL MapIteratorPrototypeFuncNext(ExecState*);
+
+void MapIteratorPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->next, MapIteratorPrototypeFuncNext, DontEnum, 0);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Map Iterator"), DontEnum | ReadOnly);
+}
+
+EncodedJSValue JSC_HOST_CALL MapIteratorPrototypeFuncNext(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSMapIterator* iterator = jsDynamicCast<JSMapIterator*>(callFrame->thisValue());
+    if (!iterator)
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot call MapIterator.next() on a non-MapIterator object")));
+
+    JSValue result;
+    if (iterator->next(callFrame, result)) {
+        scope.release();
+        return JSValue::encode(createIteratorResultObject(callFrame, result, false));
+    }
+    scope.release();
+    return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true));
+}
+
+
+}
diff --git a/runtime/MapIteratorPrototype.h b/runtime/MapIteratorPrototype.h
new file mode 100644
index 0000000..7577c01
--- /dev/null
+++ b/runtime/MapIteratorPrototype.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class MapIteratorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static MapIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        MapIteratorPrototype* prototype = new (NotNull, allocateCell<MapIteratorPrototype>(vm.heap)) MapIteratorPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    MapIteratorPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/MapPrototype.cpp b/runtime/MapPrototype.cpp
new file mode 100644
index 0000000..cab6608
--- /dev/null
+++ b/runtime/MapPrototype.cpp
@@ -0,0 +1,211 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MapPrototype.h"
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSMap.h"
+#include "JSMapIterator.h"
+#include "Lookup.h"
+
+#include "MapPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo MapPrototype::s_info = { "Map", &Base::s_info, &mapPrototypeTable, CREATE_METHOD_TABLE(MapPrototype) };
+
+/* Source for MapPrototype.lut.h
+@begin mapPrototypeTable
+  forEach   JSBuiltin  DontEnum|Function 0
+@end
+*/
+
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncClear(ExecState*);
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncDelete(ExecState*);
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncGet(ExecState*);
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncHas(ExecState*);
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncSet(ExecState*);
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncKeys(ExecState*);
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncValues(ExecState*);
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncEntries(ExecState*);
+
+static EncodedJSValue JSC_HOST_CALL mapProtoFuncSize(ExecState*);
+    
+void MapPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, mapProtoFuncClear, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, mapProtoFuncDelete, DontEnum, 1);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, mapProtoFuncGet, DontEnum, 1, JSMapGetIntrinsic);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, mapProtoFuncHas, DontEnum, 1, JSMapHasIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->set, mapProtoFuncSet, DontEnum, 2);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().keysPublicName(), mapProtoFuncKeys, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().valuesPublicName(), mapProtoFuncValues, DontEnum, 0);
+
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrivateName(), mapProtoFuncGet, DontEnum, 1, JSMapGetIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().setPrivateName(), mapProtoFuncSet, DontEnum, 2);
+
+    JSFunction* entries = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().entriesPublicName().string(), mapProtoFuncEntries);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().entriesPublicName(), entries, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->iteratorSymbol, entries, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Map"), DontEnum | ReadOnly);
+
+    JSC_NATIVE_GETTER(vm.propertyNames->size, mapProtoFuncSize, DontEnum | Accessor);
+}
+
+ALWAYS_INLINE static JSMap* getMap(CallFrame* callFrame, JSValue thisValue)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (UNLIKELY(!thisValue.isCell())) {
+        throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue));
+        return nullptr;
+    }
+
+    if (LIKELY(thisValue.asCell()->type() == JSMapType))
+        return jsCast<JSMap*>(thisValue);
+    throwTypeError(callFrame, scope, ASCIILiteral("Map operation called on non-Map object"));
+    return nullptr;
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncClear(CallFrame* callFrame)
+{
+    JSMap* map = getMap(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    map->clear(callFrame);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncDelete(CallFrame* callFrame)
+{
+    JSMap* map = getMap(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(jsBoolean(map->remove(callFrame, callFrame->argument(0))));
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncGet(CallFrame* callFrame)
+{
+    JSMap* map = getMap(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(map->get(callFrame, callFrame->argument(0)));
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncHas(CallFrame* callFrame)
+{
+    JSMap* map = getMap(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(jsBoolean(map->has(callFrame, callFrame->argument(0))));
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncSet(CallFrame* callFrame)
+{
+    JSValue thisValue = callFrame->thisValue();
+    JSMap* map = getMap(callFrame, thisValue);
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    map->set(callFrame, callFrame->argument(0), callFrame->argument(1));
+    return JSValue::encode(thisValue);
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncSize(CallFrame* callFrame)
+{
+    JSMap* map = getMap(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(jsNumber(map->size(callFrame)));
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncValues(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSMap* thisObj = jsDynamicCast<JSMap*>(callFrame->thisValue());
+    if (!thisObj)
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Map value iterator for a non-Map object.")));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame->jsCallee()->globalObject()->mapIteratorStructure(), thisObj, IterateValue));
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncEntries(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSMap* thisObj = jsDynamicCast<JSMap*>(callFrame->thisValue());
+    if (!thisObj)
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Map entry iterator for a non-Map object.")));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame->jsCallee()->globalObject()->mapIteratorStructure(), thisObj, IterateKeyValue));
+}
+
+EncodedJSValue JSC_HOST_CALL mapProtoFuncKeys(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSMap* thisObj = jsDynamicCast<JSMap*>(callFrame->thisValue());
+    if (!thisObj)
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Map key iterator for a non-Map object.")));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame->jsCallee()->globalObject()->mapIteratorStructure(), thisObj, IterateKey));
+}
+
+EncodedJSValue JSC_HOST_CALL privateFuncMapIterator(ExecState* exec)
+{
+    ASSERT(jsDynamicCast<JSMap*>(exec->uncheckedArgument(0)));
+    JSMap* map = jsCast<JSMap*>(exec->uncheckedArgument(0));
+    return JSValue::encode(JSMapIterator::create(exec->vm(), exec->jsCallee()->globalObject()->mapIteratorStructure(), map, IterateKeyValue));
+}
+
+EncodedJSValue JSC_HOST_CALL privateFuncMapIteratorNext(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ASSERT(jsDynamicCast<JSMapIterator*>(exec->thisValue()));
+    JSMapIterator* iterator = jsCast<JSMapIterator*>(exec->thisValue());
+    JSValue key, value;
+    if (iterator->nextKeyValue(exec, key, value)) {
+        JSArray* resultArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
+        resultArray->putDirectIndex(exec, 0, key);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        scope.release();
+        resultArray->putDirectIndex(exec, 1, value);
+        return JSValue::encode(jsBoolean(false));
+    }
+    return JSValue::encode(jsBoolean(true));
+}
+
+}
diff --git a/runtime/MapPrototype.h b/runtime/MapPrototype.h
new file mode 100644
index 0000000..8bde833
--- /dev/null
+++ b/runtime/MapPrototype.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class MapPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
+
+    static MapPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        MapPrototype* prototype = new (NotNull, allocateCell<MapPrototype>(vm.heap)) MapPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    MapPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+EncodedJSValue JSC_HOST_CALL privateFuncMapIterator(ExecState*);
+EncodedJSValue JSC_HOST_CALL privateFuncMapIteratorNext(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/MatchResult.cpp b/runtime/MatchResult.cpp
new file mode 100644
index 0000000..cc52b31
--- /dev/null
+++ b/runtime/MatchResult.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "MatchResult.h"
+
+namespace JSC {
+
+void MatchResult::dump(PrintStream& out) const
+{
+    if (start == WTF::notFound)
+        out.print("notFound");
+    else
+        out.print(start, "...", end);
+}
+
+} // namespace JSC
+
diff --git a/runtime/MatchResult.h b/runtime/MatchResult.h
new file mode 100644
index 0000000..7129137
--- /dev/null
+++ b/runtime/MatchResult.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+#include <wtf/Vector.h> // for notFound
+
+namespace JSC {
+
+typedef uint64_t EncodedMatchResult;
+
+struct MatchResult {
+    MatchResult()
+        : start(WTF::notFound)
+        , end(0)
+    {
+    }
+    
+    ALWAYS_INLINE MatchResult(size_t start, size_t end)
+        : start(start)
+        , end(end)
+    {
+    }
+
+    explicit ALWAYS_INLINE MatchResult(EncodedMatchResult encoded)
+    {
+        union u {
+            uint64_t encoded;
+            struct s {
+                size_t start;
+                size_t end;
+            } split;
+        } value;
+        value.encoded = encoded;
+        start = value.split.start;
+        end = value.split.end;
+    }
+
+    ALWAYS_INLINE static MatchResult failed()
+    {
+        return MatchResult();
+    }
+
+    ALWAYS_INLINE explicit operator bool() const
+    {
+        return start != WTF::notFound;
+    }
+
+    ALWAYS_INLINE bool empty()
+    {
+        return start == end;
+    }
+    
+    void dump(PrintStream&) const;
+
+    size_t start;
+    size_t end;
+};
+
+} // namespace JSC
diff --git a/runtime/MathCommon.cpp b/runtime/MathCommon.cpp
new file mode 100644
index 0000000..6f11975
--- /dev/null
+++ b/runtime/MathCommon.cpp
@@ -0,0 +1,519 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MathCommon.h"
+
+#include "PureNaN.h"
+
+namespace JSC {
+
+#if PLATFORM(IOS) && CPU(ARM_THUMB2)
+
+// The following code is taken from netlib.org:
+//   http://www.netlib.org/fdlibm/fdlibm.h
+//   http://www.netlib.org/fdlibm/e_pow.c
+//   http://www.netlib.org/fdlibm/s_scalbn.c
+//
+// And was originally distributed under the following license:
+
+/*
+ * ====================================================
+ * Copyright (C) 1993 by Sun Microsystems, Inc. All rights reserved.
+ *
+ * Developed at SunSoft, a Sun Microsystems, Inc. business.
+ * Permission to use, copy, modify, and distribute this
+ * software is freely granted, provided that this notice
+ * is preserved.
+ * ====================================================
+ */
+/*
+ * ====================================================
+ * Copyright (C) 2004 by Sun Microsystems, Inc. All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this
+ * software is freely granted, provided that this notice
+ * is preserved.
+ * ====================================================
+ */
+
+/* __ieee754_pow(x,y) return x**y
+ *
+ *              n
+ * Method:  Let x =  2   * (1+f)
+ *    1. Compute and return log2(x) in two pieces:
+ *        log2(x) = w1 + w2,
+ *       where w1 has 53-24 = 29 bit trailing zeros.
+ *    2. Perform y*log2(x) = n+y' by simulating muti-precision
+ *       arithmetic, where |y'|<=0.5.
+ *    3. Return x**y = 2**n*exp(y'*log2)
+ *
+ * Special cases:
+ *    1.  (anything) ** 0  is 1
+ *    2.  (anything) ** 1  is itself
+ *    3.  (anything) ** NAN is NAN
+ *    4.  NAN ** (anything except 0) is NAN
+ *    5.  +-(|x| > 1) **  +INF is +INF
+ *    6.  +-(|x| > 1) **  -INF is +0
+ *    7.  +-(|x| < 1) **  +INF is +0
+ *    8.  +-(|x| < 1) **  -INF is +INF
+ *    9.  +-1         ** +-INF is NAN
+ *    10. +0 ** (+anything except 0, NAN)               is +0
+ *    11. -0 ** (+anything except 0, NAN, odd integer)  is +0
+ *    12. +0 ** (-anything except 0, NAN)               is +INF
+ *    13. -0 ** (-anything except 0, NAN, odd integer)  is +INF
+ *    14. -0 ** (odd integer) = -( +0 ** (odd integer) )
+ *    15. +INF ** (+anything except 0,NAN) is +INF
+ *    16. +INF ** (-anything except 0,NAN) is +0
+ *    17. -INF ** (anything)  = -0 ** (-anything)
+ *    18. (-anything) ** (integer) is (-1)**(integer)*(+anything**integer)
+ *    19. (-anything except 0 and inf) ** (non-integer) is NAN
+ *
+ * Accuracy:
+ *    pow(x,y) returns x**y nearly rounded. In particular
+ *            pow(integer,integer)
+ *    always returns the correct integer provided it is
+ *    representable.
+ *
+ * Constants :
+ * The hexadecimal values are the intended ones for the following
+ * constants. The decimal values may be used, provided that the
+ * compiler will convert from decimal to binary accurately enough
+ * to produce the hexadecimal values shown.
+ */
+
+#define __HI(x) *(1+(int*)&x)
+#define __LO(x) *(int*)&x
+
+static const double
+bp[] = {1.0, 1.5,},
+dp_h[] = { 0.0, 5.84962487220764160156e-01,}, /* 0x3FE2B803, 0x40000000 */
+dp_l[] = { 0.0, 1.35003920212974897128e-08,}, /* 0x3E4CFDEB, 0x43CFD006 */
+zero    =  0.0,
+one    =  1.0,
+two    =  2.0,
+two53    =  9007199254740992.0,    /* 0x43400000, 0x00000000 */
+huge    =  1.0e300,
+tiny    =  1.0e-300,
+/* for scalbn */
+two54   =  1.80143985094819840000e+16, /* 0x43500000, 0x00000000 */
+twom54  =  5.55111512312578270212e-17, /* 0x3C900000, 0x00000000 */
+/* poly coefs for (3/2)*(log(x)-2s-2/3*s**3 */
+L1  =  5.99999999999994648725e-01, /* 0x3FE33333, 0x33333303 */
+L2  =  4.28571428578550184252e-01, /* 0x3FDB6DB6, 0xDB6FABFF */
+L3  =  3.33333329818377432918e-01, /* 0x3FD55555, 0x518F264D */
+L4  =  2.72728123808534006489e-01, /* 0x3FD17460, 0xA91D4101 */
+L5  =  2.30660745775561754067e-01, /* 0x3FCD864A, 0x93C9DB65 */
+L6  =  2.06975017800338417784e-01, /* 0x3FCA7E28, 0x4A454EEF */
+P1   =  1.66666666666666019037e-01, /* 0x3FC55555, 0x5555553E */
+P2   = -2.77777777770155933842e-03, /* 0xBF66C16C, 0x16BEBD93 */
+P3   =  6.61375632143793436117e-05, /* 0x3F11566A, 0xAF25DE2C */
+P4   = -1.65339022054652515390e-06, /* 0xBEBBBD41, 0xC5D26BF1 */
+P5   =  4.13813679705723846039e-08, /* 0x3E663769, 0x72BEA4D0 */
+lg2  =  6.93147180559945286227e-01, /* 0x3FE62E42, 0xFEFA39EF */
+lg2_h  =  6.93147182464599609375e-01, /* 0x3FE62E43, 0x00000000 */
+lg2_l  = -1.90465429995776804525e-09, /* 0xBE205C61, 0x0CA86C39 */
+ovt =  8.0085662595372944372e-0017, /* -(1024-log2(ovfl+.5ulp)) */
+cp    =  9.61796693925975554329e-01, /* 0x3FEEC709, 0xDC3A03FD =2/(3ln2) */
+cp_h  =  9.61796700954437255859e-01, /* 0x3FEEC709, 0xE0000000 =(float)cp */
+cp_l  = -7.02846165095275826516e-09, /* 0xBE3E2FE0, 0x145B01F5 =tail of cp_h*/
+ivln2    =  1.44269504088896338700e+00, /* 0x3FF71547, 0x652B82FE =1/ln2 */
+ivln2_h  =  1.44269502162933349609e+00, /* 0x3FF71547, 0x60000000 =24b 1/ln2*/
+ivln2_l  =  1.92596299112661746887e-08; /* 0x3E54AE0B, 0xF85DDF44 =1/ln2 tail*/
+
+inline double fdlibmScalbn (double x, int n)
+{
+    int  k,hx,lx;
+    hx = __HI(x);
+    lx = __LO(x);
+    k = (hx&0x7ff00000)>>20;        /* extract exponent */
+    if (k==0) {                /* 0 or subnormal x */
+        if ((lx|(hx&0x7fffffff))==0) return x; /* +-0 */
+        x *= two54;
+        hx = __HI(x);
+        k = ((hx&0x7ff00000)>>20) - 54;
+        if (n< -50000) return tiny*x;     /*underflow*/
+    }
+    if (k==0x7ff) return x+x;        /* NaN or Inf */
+    k = k+n;
+    if (k >  0x7fe) return huge*copysign(huge,x); /* overflow  */
+    if (k > 0)                 /* normal result */
+    {__HI(x) = (hx&0x800fffff)|(k<<20); return x;}
+    if (k <= -54) {
+        if (n > 50000)     /* in case integer overflow in n+k */
+            return huge*copysign(huge,x);    /*overflow*/
+        else return tiny*copysign(tiny,x);     /*underflow*/
+    }
+    k += 54;                /* subnormal result */
+    __HI(x) = (hx&0x800fffff)|(k<<20);
+    return x*twom54;
+}
+
+static double fdlibmPow(double x, double y)
+{
+    double z,ax,z_h,z_l,p_h,p_l;
+    double y1,t1,t2,r,s,t,u,v,w;
+    int i0,i1,i,j,k,yisint,n;
+    int hx,hy,ix,iy;
+    unsigned lx,ly;
+
+    i0 = ((*(int*)&one)>>29)^1; i1=1-i0;
+    hx = __HI(x); lx = __LO(x);
+    hy = __HI(y); ly = __LO(y);
+    ix = hx&0x7fffffff;  iy = hy&0x7fffffff;
+
+    /* y==zero: x**0 = 1 */
+    if((iy|ly)==0) return one;
+
+    /* +-NaN return x+y */
+    if(ix > 0x7ff00000 || ((ix==0x7ff00000)&&(lx!=0)) ||
+       iy > 0x7ff00000 || ((iy==0x7ff00000)&&(ly!=0)))
+        return x+y;
+
+    /* determine if y is an odd int when x < 0
+     * yisint = 0    ... y is not an integer
+     * yisint = 1    ... y is an odd int
+     * yisint = 2    ... y is an even int
+     */
+    yisint  = 0;
+    if(hx<0) {
+        if(iy>=0x43400000) yisint = 2; /* even integer y */
+        else if(iy>=0x3ff00000) {
+            k = (iy>>20)-0x3ff;       /* exponent */
+            if(k>20) {
+                j = ly>>(52-k);
+                if(static_cast<unsigned>(j<<(52-k))==ly) yisint = 2-(j&1);
+            } else if(ly==0) {
+                j = iy>>(20-k);
+                if((j<<(20-k))==iy) yisint = 2-(j&1);
+            }
+        }
+    }
+
+    /* special value of y */
+    if(ly==0) {
+        if (iy==0x7ff00000) {    /* y is +-inf */
+            if(((ix-0x3ff00000)|lx)==0)
+                return  y - y;    /* inf**+-1 is NaN */
+            else if (ix >= 0x3ff00000)/* (|x|>1)**+-inf = inf,0 */
+                return (hy>=0)? y: zero;
+            else            /* (|x|<1)**-,+inf = inf,0 */
+                return (hy<0)?-y: zero;
+        }
+        if(iy==0x3ff00000) {    /* y is  +-1 */
+            if(hy<0) return one/x; else return x;
+        }
+        if(hy==0x40000000) return x*x; /* y is  2 */
+        if(hy==0x3fe00000) {    /* y is  0.5 */
+            if(hx>=0)    /* x >= +0 */
+                return sqrt(x);
+        }
+    }
+
+    ax   = fabs(x);
+    /* special value of x */
+    if(lx==0) {
+        if(ix==0x7ff00000||ix==0||ix==0x3ff00000){
+            z = ax;            /*x is +-0,+-inf,+-1*/
+            if(hy<0) z = one/z;    /* z = (1/|x|) */
+            if(hx<0) {
+                if(((ix-0x3ff00000)|yisint)==0) {
+                    z = (z-z)/(z-z); /* (-1)**non-int is NaN */
+                } else if(yisint==1)
+                    z = -z;        /* (x<0)**odd = -(|x|**odd) */
+            }
+            return z;
+        }
+    }
+
+    n = (hx>>31)+1;
+
+    /* (x<0)**(non-int) is NaN */
+    if((n|yisint)==0) return (x-x)/(x-x);
+
+    s = one; /* s (sign of result -ve**odd) = -1 else = 1 */
+    if((n|(yisint-1))==0) s = -one;/* (-ve)**(odd int) */
+
+    /* |y| is huge */
+    if(iy>0x41e00000) { /* if |y| > 2**31 */
+        if(iy>0x43f00000){    /* if |y| > 2**64, must o/uflow */
+            if(ix<=0x3fefffff) return (hy<0)? huge*huge:tiny*tiny;
+            if(ix>=0x3ff00000) return (hy>0)? huge*huge:tiny*tiny;
+        }
+        /* over/underflow if x is not close to one */
+        if(ix<0x3fefffff) return (hy<0)? s*huge*huge:s*tiny*tiny;
+        if(ix>0x3ff00000) return (hy>0)? s*huge*huge:s*tiny*tiny;
+        /* now |1-x| is tiny <= 2**-20, suffice to compute
+         log(x) by x-x^2/2+x^3/3-x^4/4 */
+        t = ax-one;        /* t has 20 trailing zeros */
+        w = (t*t)*(0.5-t*(0.3333333333333333333333-t*0.25));
+        u = ivln2_h*t;    /* ivln2_h has 21 sig. bits */
+        v = t*ivln2_l-w*ivln2;
+        t1 = u+v;
+        __LO(t1) = 0;
+        t2 = v-(t1-u);
+    } else {
+        double ss,s2,s_h,s_l,t_h,t_l;
+        n = 0;
+        /* take care subnormal number */
+        if(ix<0x00100000)
+        {ax *= two53; n -= 53; ix = __HI(ax); }
+        n  += ((ix)>>20)-0x3ff;
+        j  = ix&0x000fffff;
+        /* determine interval */
+        ix = j|0x3ff00000;        /* normalize ix */
+        if(j<=0x3988E) k=0;        /* |x|<sqrt(3/2) */
+        else if(j<0xBB67A) k=1;    /* |x|<sqrt(3)   */
+        else {k=0;n+=1;ix -= 0x00100000;}
+        __HI(ax) = ix;
+
+        /* compute ss = s_h+s_l = (x-1)/(x+1) or (x-1.5)/(x+1.5) */
+        u = ax-bp[k];        /* bp[0]=1.0, bp[1]=1.5 */
+        v = one/(ax+bp[k]);
+        ss = u*v;
+        s_h = ss;
+        __LO(s_h) = 0;
+        /* t_h=ax+bp[k] High */
+        t_h = zero;
+        __HI(t_h)=((ix>>1)|0x20000000)+0x00080000+(k<<18);
+        t_l = ax - (t_h-bp[k]);
+        s_l = v*((u-s_h*t_h)-s_h*t_l);
+        /* compute log(ax) */
+        s2 = ss*ss;
+        r = s2*s2*(L1+s2*(L2+s2*(L3+s2*(L4+s2*(L5+s2*L6)))));
+        r += s_l*(s_h+ss);
+        s2  = s_h*s_h;
+        t_h = 3.0+s2+r;
+        __LO(t_h) = 0;
+        t_l = r-((t_h-3.0)-s2);
+        /* u+v = ss*(1+...) */
+        u = s_h*t_h;
+        v = s_l*t_h+t_l*ss;
+        /* 2/(3log2)*(ss+...) */
+        p_h = u+v;
+        __LO(p_h) = 0;
+        p_l = v-(p_h-u);
+        z_h = cp_h*p_h;        /* cp_h+cp_l = 2/(3*log2) */
+        z_l = cp_l*p_h+p_l*cp+dp_l[k];
+        /* log2(ax) = (ss+..)*2/(3*log2) = n + dp_h + z_h + z_l */
+        t = (double)n;
+        t1 = (((z_h+z_l)+dp_h[k])+t);
+        __LO(t1) = 0;
+        t2 = z_l-(((t1-t)-dp_h[k])-z_h);
+    }
+
+    /* split up y into y1+y2 and compute (y1+y2)*(t1+t2) */
+    y1  = y;
+    __LO(y1) = 0;
+    p_l = (y-y1)*t1+y*t2;
+    p_h = y1*t1;
+    z = p_l+p_h;
+    j = __HI(z);
+    i = __LO(z);
+    if (j>=0x40900000) {                /* z >= 1024 */
+        if(((j-0x40900000)|i)!=0)            /* if z > 1024 */
+            return s*huge*huge;            /* overflow */
+        else {
+            if(p_l+ovt>z-p_h) return s*huge*huge;    /* overflow */
+        }
+    } else if((j&0x7fffffff)>=0x4090cc00 ) {    /* z <= -1075 */
+        if(((j-0xc090cc00)|i)!=0)         /* z < -1075 */
+            return s*tiny*tiny;        /* underflow */
+        else {
+            if(p_l<=z-p_h) return s*tiny*tiny;    /* underflow */
+        }
+    }
+    /*
+     * compute 2**(p_h+p_l)
+     */
+    i = j&0x7fffffff;
+    k = (i>>20)-0x3ff;
+    n = 0;
+    if(i>0x3fe00000) {        /* if |z| > 0.5, set n = [z+0.5] */
+        n = j+(0x00100000>>(k+1));
+        k = ((n&0x7fffffff)>>20)-0x3ff;    /* new k for n */
+        t = zero;
+        __HI(t) = (n&~(0x000fffff>>k));
+        n = ((n&0x000fffff)|0x00100000)>>(20-k);
+        if(j<0) n = -n;
+        p_h -= t;
+    }
+    t = p_l+p_h;
+    __LO(t) = 0;
+    u = t*lg2_h;
+    v = (p_l-(t-p_h))*lg2+t*lg2_l;
+    z = u+v;
+    w = v-(z-u);
+    t  = z*z;
+    t1  = z - t*(P1+t*(P2+t*(P3+t*(P4+t*P5))));
+    r  = (z*t1)/(t1-two)-(w+z*w);
+    z  = one-(r-z);
+    j  = __HI(z);
+    j += (n<<20);
+    if((j>>20)<=0) z = fdlibmScalbn(z,n);    /* subnormal output */
+    else __HI(z) += (n<<20);
+    return s*z;
+}
+
+static ALWAYS_INLINE bool isDenormal(double x)
+{
+    static const uint64_t signbit = 0x8000000000000000ULL;
+    static const uint64_t minNormal = 0x0001000000000000ULL;
+    return (bitwise_cast<uint64_t>(x) & ~signbit) - 1 < minNormal - 1;
+}
+
+static ALWAYS_INLINE bool isEdgeCase(double x)
+{
+    static const uint64_t signbit = 0x8000000000000000ULL;
+    static const uint64_t infinity = 0x7fffffffffffffffULL;
+    return (bitwise_cast<uint64_t>(x) & ~signbit) - 1 >= infinity - 1;
+}
+
+static ALWAYS_INLINE double mathPowInternal(double x, double y)
+{
+    if (!isDenormal(x) && !isDenormal(y)) {
+        double libmResult = std::pow(x, y);
+        if (libmResult || isEdgeCase(x) || isEdgeCase(y))
+            return libmResult;
+    }
+    return fdlibmPow(x, y);
+}
+
+#else
+
+ALWAYS_INLINE double mathPowInternal(double x, double y)
+{
+    return pow(x, y);
+}
+
+#endif
+
+double JIT_OPERATION operationMathPow(double x, double y)
+{
+    if (std::isnan(y))
+        return PNaN;
+    double absoluteBase = fabs(x);
+    if (absoluteBase == 1 && std::isinf(y))
+        return PNaN;
+
+    if (y == 0.5) {
+        if (!absoluteBase)
+            return 0;
+        if (absoluteBase == std::numeric_limits<double>::infinity())
+            return std::numeric_limits<double>::infinity();
+        return sqrt(x);
+    }
+
+    if (y == -0.5) {
+        if (!absoluteBase)
+            return std::numeric_limits<double>::infinity();
+        if (absoluteBase == std::numeric_limits<double>::infinity())
+            return 0.;
+        return 1. / sqrt(x);
+    }
+
+    int32_t yAsInt = y;
+    if (static_cast<double>(yAsInt) == y && yAsInt >= 0 && yAsInt <= maxExponentForIntegerMathPow) {
+        // If the exponent is a small positive int32 integer, we do a fast exponentiation
+
+        // Do not use x87 values for accumulation. x87 values has 80bit precision.
+        // The result produced by x87's 80bit double precision differs from the one calculated with SSE2 in DFG.
+        // Using volatile double is workaround for this problem. By specifying volatile, we expect that `result` and `xd`
+        // are stored in the stack. And at that time, we expect that they are rounded by fst/fstp[1, 2].
+        // [1]: https://gcc.gnu.org/wiki/x87note
+        // [2]: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=323
+#if !CPU(X86) || (defined(__SSE2_MATH__) && defined(__SSE2__))
+        typedef double DoubleValue;
+#else
+        typedef volatile double DoubleValue;
+#endif
+        DoubleValue result = 1;
+        DoubleValue xd = x;
+        while (yAsInt) {
+            if (yAsInt & 1)
+                result *= xd;
+            xd *= xd;
+            yAsInt >>= 1;
+        }
+        return result;
+    }
+    return mathPowInternal(x, y);
+}
+
+int32_t JIT_OPERATION operationToInt32(double value)
+{
+    return JSC::toInt32(value);
+}
+
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+static inline bool isStrictInt32(double value)
+{
+    int32_t valueAsInt32 = static_cast<int32_t>(value);
+    if (value != valueAsInt32)
+        return false;
+
+    if (!valueAsInt32) {
+        if (std::signbit(value))
+            return false;
+    }
+    return true;
+}
+#endif
+
+extern "C" {
+double jsRound(double value)
+{
+    double integer = ceil(value);
+    return integer - (integer - value > 0.5);
+}
+
+#if CALLING_CONVENTION_IS_STDCALL || CPU(ARM_THUMB2)
+double jsMod(double x, double y)
+{
+#if HAVE(ARM_IDIV_INSTRUCTIONS)
+    // fmod() does not have exact results for integer on ARMv7.
+    // When DFG/FTL use IDIV, the result of op_mod can change if we use fmod().
+    //
+    // We implement here the same algorithm and conditions as the upper tier to keep
+    // a stable result when tiering up.
+    if (y) {
+        if (isStrictInt32(x) && isStrictInt32(y)) {
+            int32_t xAsInt32 = static_cast<int32_t>(x);
+            int32_t yAsInt32 = static_cast<int32_t>(y);
+            int32_t quotient = xAsInt32 / yAsInt32;
+            if (!productOverflows<int32_t>(quotient, yAsInt32)) {
+                int32_t remainder = xAsInt32 - (quotient * yAsInt32);
+                if (remainder || xAsInt32 >= 0)
+                    return remainder;
+            }
+        }
+    }
+#endif
+    return fmod(x, y);
+}
+#endif
+} // extern "C"
+
+} // namespace JSC
diff --git a/runtime/MathCommon.h b/runtime/MathCommon.h
new file mode 100644
index 0000000..6325786
--- /dev/null
+++ b/runtime/MathCommon.h
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <cmath>
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+const int32_t maxExponentForIntegerMathPow = 1000;
+double JIT_OPERATION operationMathPow(double x, double y) WTF_INTERNAL;
+int32_t JIT_OPERATION operationToInt32(double) WTF_INTERNAL;
+
+inline constexpr double maxSafeInteger()
+{
+    // 2 ^ 53 - 1
+    return 9007199254740991.0;
+}
+
+inline constexpr double minSafeInteger()
+{
+    // -(2 ^ 53 - 1)
+    return -9007199254740991.0;
+}
+
+inline int clz32(uint32_t number)
+{
+#if COMPILER(GCC_OR_CLANG)
+    int zeroCount = 32;
+    if (number)
+        zeroCount = __builtin_clz(number);
+    return zeroCount;
+#else
+    int zeroCount = 0;
+    for (int i = 31; i >= 0; i--) {
+        if (!(number >> i))
+            zeroCount++;
+        else
+            break;
+    }
+    return zeroCount;
+#endif
+}
+
+// This in the ToInt32 operation is defined in section 9.5 of the ECMA-262 spec.
+// Note that this operation is identical to ToUInt32 other than to interpretation
+// of the resulting bit-pattern (as such this method is also called to implement
+// ToUInt32).
+//
+// The operation can be described as round towards zero, then select the 32 least
+// bits of the resulting value in 2s-complement representation.
+ALWAYS_INLINE int32_t toInt32(double number)
+{
+    int64_t bits = WTF::bitwise_cast<int64_t>(number);
+    int32_t exp = (static_cast<int32_t>(bits >> 52) & 0x7ff) - 0x3ff;
+
+    // If exponent < 0 there will be no bits to the left of the decimal point
+    // after rounding; if the exponent is > 83 then no bits of precision can be
+    // left in the low 32-bit range of the result (IEEE-754 doubles have 52 bits
+    // of fractional precision).
+    // Note this case handles 0, -0, and all infinite, NaN, & denormal value.
+    if (exp < 0 || exp > 83)
+        return 0;
+
+    // Select the appropriate 32-bits from the floating point mantissa. If the
+    // exponent is 52 then the bits we need to select are already aligned to the
+    // lowest bits of the 64-bit integer representation of the number, no need
+    // to shift. If the exponent is greater than 52 we need to shift the value
+    // left by (exp - 52), if the value is less than 52 we need to shift right
+    // accordingly.
+    int32_t result = (exp > 52)
+        ? static_cast<int32_t>(bits << (exp - 52))
+        : static_cast<int32_t>(bits >> (52 - exp));
+
+    // IEEE-754 double precision values are stored omitting an implicit 1 before
+    // the decimal point; we need to reinsert this now. We may also the shifted
+    // invalid bits into the result that are not a part of the mantissa (the sign
+    // and exponent bits from the floatingpoint representation); mask these out.
+    if (exp < 32) {
+        int32_t missingOne = 1 << exp;
+        result &= missingOne - 1;
+        result += missingOne;
+    }
+
+    // If the input value was negative (we could test either 'number' or 'bits',
+    // but testing 'bits' is likely faster) invert the result appropriately.
+    return bits < 0 ? -result : result;
+}
+
+// This implements ToUInt32, defined in ECMA-262 9.6.
+inline uint32_t toUInt32(double number)
+{
+    // As commented in the spec, the operation of ToInt32 and ToUint32 only differ
+    // in how the result is interpreted; see NOTEs in sections 9.5 and 9.6.
+    return toInt32(number);
+}
+
+inline std::optional<double> safeReciprocalForDivByConst(double constant)
+{
+    // No "weird" numbers (NaN, Denormal, etc).
+    if (!constant || !std::isnormal(constant))
+        return std::nullopt;
+
+    int exponent;
+    if (std::frexp(constant, &exponent) != 0.5)
+        return std::nullopt;
+
+    // Note that frexp() returns the value divided by two
+    // so we to offset this exponent by one.
+    exponent -= 1;
+
+    // A double exponent is between -1022 and 1023.
+    // Nothing we can do to invert 1023.
+    if (exponent == 1023)
+        return std::nullopt;
+
+    double reciprocal = std::ldexp(1, -exponent);
+    ASSERT(std::isnormal(reciprocal));
+    ASSERT(1. / constant == reciprocal);
+    ASSERT(constant == 1. / reciprocal);
+    ASSERT(1. == constant * reciprocal);
+
+    return reciprocal;
+}
+
+extern "C" {
+double JIT_OPERATION jsRound(double value) REFERENCED_FROM_ASM WTF_INTERNAL;
+
+// On Windows we need to wrap fmod; on other platforms we can call it directly.
+// On ARMv7 we assert that all function pointers have to low bit set (point to thumb code).
+#if CALLING_CONVENTION_IS_STDCALL || CPU(ARM_THUMB2)
+double JIT_OPERATION jsMod(double x, double y) REFERENCED_FROM_ASM WTF_INTERNAL;
+#else
+#define jsMod fmod
+#endif
+}
+
+} // namespace JSC
diff --git a/runtime/MathObject.cpp b/runtime/MathObject.cpp
new file mode 100644
index 0000000..c810b94
--- /dev/null
+++ b/runtime/MathObject.cpp
@@ -0,0 +1,373 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007-2008, 2013, 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "MathObject.h"
+
+#include "JSCInlines.h"
+#include "MathCommon.h"
+#include "ObjectPrototype.h"
+#include <time.h>
+#include <wtf/Assertions.h>
+#include <wtf/MathExtras.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(MathObject);
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncACos(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncACosh(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncASin(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncASinh(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncATan(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncATanh(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncCbrt(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncClz32(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncCos(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncCosh(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncExp(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncExpm1(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncFround(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncHypot(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncLog(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncLog1p(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncLog10(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncLog2(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncMax(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncMin(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncPow(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncRound(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncSign(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncSin(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncSinh(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncTan(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncTanh(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncIMul(ExecState*);
+
+const ClassInfo MathObject::s_info = { "Math", &Base::s_info, 0, CREATE_METHOD_TABLE(MathObject) };
+
+MathObject::MathObject(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void MathObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "E"), jsNumber(exp(1.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "LN2"), jsNumber(log(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "LN10"), jsNumber(log(10.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "LOG2E"), jsNumber(1.0 / log(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "LOG10E"), jsNumber(0.4342944819032518), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "PI"), jsNumber(piDouble), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "SQRT1_2"), jsNumber(sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "SQRT2"), jsNumber(sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Math"), DontEnum | ReadOnly);
+
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "abs"), 1, mathProtoFuncAbs, AbsIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "acos"), 1, mathProtoFuncACos, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "asin"), 1, mathProtoFuncASin, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "atan"), 1, mathProtoFuncATan, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "acosh"), 1, mathProtoFuncACosh, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "asinh"), 1, mathProtoFuncASinh, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "atanh"), 1, mathProtoFuncATanh, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "atan2"), 2, mathProtoFuncATan2, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "cbrt"), 1, mathProtoFuncCbrt, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "ceil"), 1, mathProtoFuncCeil, CeilIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "clz32"), 1, mathProtoFuncClz32, Clz32Intrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "cos"), 1, mathProtoFuncCos, CosIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "cosh"), 1, mathProtoFuncCosh, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "exp"), 1, mathProtoFuncExp, ExpIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "expm1"), 1, mathProtoFuncExpm1, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "floor"), 1, mathProtoFuncFloor, FloorIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "fround"), 1, mathProtoFuncFround, FRoundIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "hypot"), 2, mathProtoFuncHypot, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "log"), 1, mathProtoFuncLog, LogIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "log10"), 1, mathProtoFuncLog10, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "log1p"), 1, mathProtoFuncLog1p, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "log2"), 1, mathProtoFuncLog2, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "max"), 2, mathProtoFuncMax, MaxIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "min"), 2, mathProtoFuncMin, MinIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "pow"), 2, mathProtoFuncPow, PowIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "random"), 0, mathProtoFuncRandom, RandomIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "round"), 1, mathProtoFuncRound, RoundIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "sign"), 1, mathProtoFuncSign, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "sin"), 1, mathProtoFuncSin, SinIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "sinh"), 1, mathProtoFuncSinh, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "sqrt"), 1, mathProtoFuncSqrt, SqrtIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "tan"), 1, mathProtoFuncTan, TanIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "tanh"), 1, mathProtoFuncTanh, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "trunc"), 1, mathProtoFuncTrunc, TruncIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&vm, "imul"), 2, mathProtoFuncIMul, IMulIntrinsic, DontEnum);
+}
+
+// ------------------------------ Functions --------------------------------
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec)
+{
+    return JSValue::encode(jsNumber(fabs(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(acos(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(asin(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(atan(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec)
+{
+    double arg0 = exec->argument(0).toNumber(exec);
+    double arg1 = exec->argument(1).toNumber(exec);
+    return JSValue::encode(jsDoubleNumber(atan2(arg0, arg1)));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec)
+{
+    return JSValue::encode(jsNumber(ceil(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncClz32(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    uint32_t value = exec->argument(0).toUInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(JSValue(clz32(value)));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(cos(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(exp(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec)
+{
+    return JSValue::encode(jsNumber(floor(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncHypot(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    unsigned argsCount = exec->argumentCount();
+    double max = 0;
+    Vector<double, 8> args;
+    args.reserveInitialCapacity(argsCount);
+    for (unsigned i = 0; i < argsCount; ++i) {
+        args.uncheckedAppend(exec->uncheckedArgument(i).toNumber(exec));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (std::isinf(args[i]))
+            return JSValue::encode(jsDoubleNumber(+std::numeric_limits<double>::infinity()));
+        max = std::max(fabs(args[i]), max);
+    }
+    if (!max)
+        max = 1;
+    // Kahan summation algorithm significantly reduces the numerical error in the total obtained.
+    double sum = 0;
+    double compensation = 0;
+    for (double argument : args) {
+        double scaledArgument = argument / max;
+        double summand = scaledArgument * scaledArgument - compensation;
+        double preliminary = sum + summand;
+        compensation = (preliminary - sum) - summand;
+        sum = preliminary;
+    }
+    return JSValue::encode(jsDoubleNumber(sqrt(sum) * max));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(log(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec)
+{
+    unsigned argsCount = exec->argumentCount();
+    double result = -std::numeric_limits<double>::infinity();
+    for (unsigned k = 0; k < argsCount; ++k) {
+        double val = exec->uncheckedArgument(k).toNumber(exec);
+        if (std::isnan(val)) {
+            result = PNaN;
+        } else if (val > result || (!val && !result && !std::signbit(val)))
+            result = val;
+    }
+    return JSValue::encode(jsNumber(result));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncMin(ExecState* exec)
+{
+    unsigned argsCount = exec->argumentCount();
+    double result = +std::numeric_limits<double>::infinity();
+    for (unsigned k = 0; k < argsCount; ++k) {
+        double val = exec->uncheckedArgument(k).toNumber(exec);
+        if (std::isnan(val)) {
+            result = PNaN;
+        } else if (val < result || (!val && !result && std::signbit(val)))
+            result = val;
+    }
+    return JSValue::encode(jsNumber(result));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec)
+{
+    // ECMA 15.8.2.1.13
+
+    double arg = exec->argument(0).toNumber(exec);
+    double arg2 = exec->argument(1).toNumber(exec);
+
+    return JSValue::encode(JSValue(operationMathPow(arg, arg2)));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(exec->lexicalGlobalObject()->weakRandomNumber()));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec)
+{
+    return JSValue::encode(jsNumber(jsRound(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncSign(ExecState* exec)
+{
+    double arg = exec->argument(0).toNumber(exec);
+    if (std::isnan(arg))
+        return JSValue::encode(jsNaN());
+    if (!arg)
+        return JSValue::encode(std::signbit(arg) ? jsNumber(-0.0) : jsNumber(0));
+    return JSValue::encode(jsNumber(std::signbit(arg) ? -1 : 1));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(sin(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(sqrt(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(tan(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncIMul(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    int32_t left = exec->argument(0).toInt32(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    int32_t right = exec->argument(1).toInt32(exec);
+    return JSValue::encode(jsNumber(left * right));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncACosh(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(acosh(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncASinh(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(asinh(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncATanh(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(atanh(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncCbrt(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(cbrt(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncCosh(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(cosh(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncExpm1(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(expm1(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncFround(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(static_cast<float>(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncLog1p(ExecState* exec)
+{
+    double value = exec->argument(0).toNumber(exec);
+    if (value == 0)
+        return JSValue::encode(jsDoubleNumber(value));
+    return JSValue::encode(jsDoubleNumber(log1p(value)));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncLog10(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(log10(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncLog2(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(log2(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncSinh(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(sinh(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncTanh(ExecState* exec)
+{
+    return JSValue::encode(jsDoubleNumber(tanh(exec->argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncTrunc(ExecState*exec)
+{
+    return JSValue::encode(jsNumber(exec->argument(0).toIntegerPreserveNaN(exec)));
+}
+
+} // namespace JSC
diff --git a/runtime/MathObject.h b/runtime/MathObject.h
new file mode 100644
index 0000000..486dac4
--- /dev/null
+++ b/runtime/MathObject.h
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class MathObject : public JSNonFinalObject {
+private:
+    MathObject(VM&, Structure*);
+
+public:
+    typedef JSNonFinalObject Base;
+
+    static MathObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        MathObject* object = new (NotNull, allocateCell<MathObject>(vm.heap)) MathObject(vm, structure);
+        object->finishCreation(vm, globalObject);
+        return object;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+EncodedJSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState*);
+EncodedJSValue JSC_HOST_CALL mathProtoFuncTrunc(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/MemoryStatistics.cpp b/runtime/MemoryStatistics.cpp
new file mode 100644
index 0000000..8aa9a75
--- /dev/null
+++ b/runtime/MemoryStatistics.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MemoryStatistics.h"
+
+#include "ExecutableAllocator.h"
+#include "VM.h"
+
+namespace JSC {
+
+GlobalMemoryStatistics globalMemoryStatistics() 
+{
+    GlobalMemoryStatistics stats;
+
+    stats.stackBytes = VM::committedStackByteCount();
+#if ENABLE(ASSEMBLER)
+    stats.JITBytes = ExecutableAllocator::committedByteCount();
+#endif
+
+    return stats;
+}
+
+}
+
+
diff --git a/runtime/MemoryStatistics.h b/runtime/MemoryStatistics.h
new file mode 100644
index 0000000..a55d538
--- /dev/null
+++ b/runtime/MemoryStatistics.h
@@ -0,0 +1,41 @@
+/* 
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Heap.h"
+
+class VM;
+
+namespace JSC {
+
+struct GlobalMemoryStatistics {
+    size_t stackBytes;
+    size_t JITBytes = 0;
+};
+
+JS_EXPORT_PRIVATE GlobalMemoryStatistics globalMemoryStatistics();
+
+} // namespace JSC
diff --git a/runtime/Microtask.h b/runtime/Microtask.h
new file mode 100644
index 0000000..9c4f274
--- /dev/null
+++ b/runtime/Microtask.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+class ExecState;
+
+class Microtask : public RefCounted<Microtask> {
+public:
+    virtual ~Microtask()
+    {
+    }
+
+    virtual void run(ExecState*) = 0;
+};
+
+} // namespace JSC
diff --git a/runtime/ModuleLoaderPrototype.cpp b/runtime/ModuleLoaderPrototype.cpp
new file mode 100644
index 0000000..f36fd48
--- /dev/null
+++ b/runtime/ModuleLoaderPrototype.cpp
@@ -0,0 +1,227 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ModuleLoaderPrototype.h"
+
+#include "BuiltinNames.h"
+#include "CodeProfiling.h"
+#include "Error.h"
+#include "Exception.h"
+#include "JSCInlines.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSInternalPromise.h"
+#include "JSInternalPromiseDeferred.h"
+#include "JSMap.h"
+#include "JSModuleEnvironment.h"
+#include "JSModuleLoader.h"
+#include "JSModuleRecord.h"
+#include "ModuleAnalyzer.h"
+#include "Nodes.h"
+#include "Parser.h"
+#include "ParserError.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeParseModule(ExecState*);
+static EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeRequestedModules(ExecState*);
+static EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeEvaluate(ExecState*);
+static EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeModuleDeclarationInstantiation(ExecState*);
+static EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeResolve(ExecState*);
+static EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeFetch(ExecState*);
+static EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeInstantiate(ExecState*);
+
+}
+
+#include "ModuleLoaderPrototype.lut.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ModuleLoaderPrototype);
+
+const ClassInfo ModuleLoaderPrototype::s_info = { "ModuleLoader", &Base::s_info, &moduleLoaderPrototypeTable, CREATE_METHOD_TABLE(ModuleLoaderPrototype) };
+
+/* Source for ModuleLoaderPrototype.lut.h
+@begin moduleLoaderPrototypeTable
+    ensureRegistered               JSBuiltin                                           DontEnum|Function 1
+    forceFulfillPromise            JSBuiltin                                           DontEnum|Function 2
+    fulfillFetch                   JSBuiltin                                           DontEnum|Function 2
+    fulfillInstantiate             JSBuiltin                                           DontEnum|Function 2
+    commitInstantiated             JSBuiltin                                           DontEnum|Function 3
+    instantiation                  JSBuiltin                                           DontEnum|Function 3
+    requestFetch                   JSBuiltin                                           DontEnum|Function 2
+    requestInstantiate             JSBuiltin                                           DontEnum|Function 2
+    requestSatisfy                 JSBuiltin                                           DontEnum|Function 2
+    requestInstantiateAll          JSBuiltin                                           DontEnum|Function 2
+    requestLink                    JSBuiltin                                           DontEnum|Function 2
+    requestReady                   JSBuiltin                                           DontEnum|Function 2
+    link                           JSBuiltin                                           DontEnum|Function 2
+    moduleDeclarationInstantiation moduleLoaderPrototypeModuleDeclarationInstantiation DontEnum|Function 2
+    moduleEvaluation               JSBuiltin                                           DontEnum|Function 2
+    evaluate                       moduleLoaderPrototypeEvaluate                       DontEnum|Function 3
+    provide                        JSBuiltin                                           DontEnum|Function 3
+    loadAndEvaluateModule          JSBuiltin                                           DontEnum|Function 3
+    loadModule                     JSBuiltin                                           DontEnum|Function 3
+    linkAndEvaluateModule          JSBuiltin                                           DontEnum|Function 2
+    parseModule                    moduleLoaderPrototypeParseModule                    DontEnum|Function 2
+    requestedModules               moduleLoaderPrototypeRequestedModules               DontEnum|Function 1
+    resolve                        moduleLoaderPrototypeResolve                        DontEnum|Function 2
+    fetch                          moduleLoaderPrototypeFetch                          DontEnum|Function 2
+    instantiate                    moduleLoaderPrototypeInstantiate                    DontEnum|Function 3
+@end
+*/
+
+ModuleLoaderPrototype::ModuleLoaderPrototype(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+// ------------------------------ Functions --------------------------------
+
+EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeParseModule(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    const Identifier moduleKey = exec->argument(0).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    String source = exec->argument(1).toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    SourceCode sourceCode = makeSource(source, moduleKey.impl(), TextPosition(), SourceProviderSourceType::Module);
+
+    CodeProfiling profile(sourceCode);
+
+    ParserError error;
+    std::unique_ptr<ModuleProgramNode> moduleProgramNode = parse<ModuleProgramNode>(
+        &vm, sourceCode, Identifier(), JSParserBuiltinMode::NotBuiltin,
+        JSParserStrictMode::Strict, JSParserScriptMode::Module, SourceParseMode::ModuleAnalyzeMode, SuperBinding::NotNeeded, error);
+
+    if (error.isValid()) {
+        throwVMError(exec, scope, error.toErrorObject(exec->lexicalGlobalObject(), sourceCode));
+        return JSValue::encode(jsUndefined());
+    }
+    ASSERT(moduleProgramNode);
+
+    ModuleAnalyzer moduleAnalyzer(exec, moduleKey, sourceCode, moduleProgramNode->varDeclarations(), moduleProgramNode->lexicalVariables());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSModuleRecord* moduleRecord = moduleAnalyzer.analyze(*moduleProgramNode);
+
+    return JSValue::encode(moduleRecord);
+}
+
+EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeRequestedModules(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSModuleRecord* moduleRecord = jsDynamicCast<JSModuleRecord*>(exec->argument(0));
+    if (!moduleRecord) {
+        scope.release();
+        return JSValue::encode(constructEmptyArray(exec, nullptr));
+    }
+
+    JSArray* result = constructEmptyArray(exec, nullptr, moduleRecord->requestedModules().size());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    size_t i = 0;
+    for (auto& key : moduleRecord->requestedModules()) {
+        result->putDirectIndex(exec, i++, jsString(exec, key.get()));
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeModuleDeclarationInstantiation(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSModuleRecord* moduleRecord = jsDynamicCast<JSModuleRecord*>(exec->argument(0));
+    if (!moduleRecord)
+        return JSValue::encode(jsUndefined());
+
+    if (Options::dumpModuleLoadingState())
+        dataLog("Loader [link] ", moduleRecord->moduleKey(), "\n");
+
+    moduleRecord->link(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    return JSValue::encode(jsUndefined());
+}
+
+// ------------------------------ Hook Functions ---------------------------
+
+EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeResolve(ExecState* exec)
+{
+    // Hook point, Loader.resolve.
+    // https://whatwg.github.io/loader/#browser-resolve
+    // Take the name and resolve it to the unique identifier for the resource location.
+    // For example, take the "jquery" and return the URL for the resource.
+    JSModuleLoader* loader = jsDynamicCast<JSModuleLoader*>(exec->thisValue());
+    if (!loader)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(loader->resolve(exec, exec->argument(0), exec->argument(1), exec->argument(2)));
+}
+
+EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeFetch(ExecState* exec)
+{
+    // Hook point, Loader.fetch
+    // https://whatwg.github.io/loader/#browser-fetch
+    // Take the key and fetch the resource actually.
+    // For example, JavaScriptCore shell can provide the hook fetching the resource
+    // from the local file system.
+    JSModuleLoader* loader = jsDynamicCast<JSModuleLoader*>(exec->thisValue());
+    if (!loader)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(loader->fetch(exec, exec->argument(0), exec->argument(1)));
+}
+
+EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeInstantiate(ExecState* exec)
+{
+    // Hook point, Loader.instantiate
+    // https://whatwg.github.io/loader/#browser-instantiate
+    // Take the key and the fetched source code, and instantiate the module record
+    // by parsing the module source code.
+    // It has the chance to provide the optional module instance that is different from
+    // the ordinary one.
+    JSModuleLoader* loader = jsDynamicCast<JSModuleLoader*>(exec->thisValue());
+    if (!loader)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(loader->instantiate(exec, exec->argument(0), exec->argument(1), exec->argument(2)));
+}
+
+// ------------------- Additional Hook Functions ---------------------------
+
+EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeEvaluate(ExecState* exec)
+{
+    // To instrument and retrieve the errors raised from the module execution,
+    // we inserted the hook point here.
+
+    JSModuleLoader* loader = jsDynamicCast<JSModuleLoader*>(exec->thisValue());
+    if (!loader)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(loader->evaluate(exec, exec->argument(0), exec->argument(1), exec->argument(2)));
+}
+
+} // namespace JSC
diff --git a/runtime/ModuleLoaderPrototype.h b/runtime/ModuleLoaderPrototype.h
new file mode 100644
index 0000000..9f93eac
--- /dev/null
+++ b/runtime/ModuleLoaderPrototype.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class JSInternalPromise;
+
+class ModuleLoaderPrototype : public JSNonFinalObject {
+private:
+    ModuleLoaderPrototype(VM&, Structure*);
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static ModuleLoaderPrototype* create(VM& vm, JSGlobalObject*, Structure* structure)
+    {
+        ModuleLoaderPrototype* object = new (NotNull, allocateCell<ModuleLoaderPrototype>(vm.heap)) ModuleLoaderPrototype(vm, structure);
+        object->finishCreation(vm);
+        return object;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+};
+
+} // namespace JSC
diff --git a/runtime/ModuleProgramExecutable.cpp b/runtime/ModuleProgramExecutable.cpp
new file mode 100644
index 0000000..4fa1936
--- /dev/null
+++ b/runtime/ModuleProgramExecutable.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009, 2010, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "BatchedTransitionOptimizer.h"
+#include "CodeBlock.h"
+#include "CodeCache.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "LLIntEntrypoint.h"
+#include "ModuleProgramCodeBlock.h"
+#include "Parser.h"
+#include "TypeProfiler.h"
+#include "VMInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+const ClassInfo ModuleProgramExecutable::s_info = { "ModuleProgramExecutable", &ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(ModuleProgramExecutable) };
+
+ModuleProgramExecutable::ModuleProgramExecutable(ExecState* exec, const SourceCode& source)
+    : ScriptExecutable(exec->vm().moduleProgramExecutableStructure.get(), exec->vm(), source, false, DerivedContextType::None, false, EvalContextType::None, NoIntrinsic)
+{
+    ASSERT(source.provider()->sourceType() == SourceProviderSourceType::Module);
+    m_typeProfilingStartOffset = 0;
+    m_typeProfilingEndOffset = source.length() - 1;
+    if (exec->vm().typeProfiler() || exec->vm().controlFlowProfiler())
+        exec->vm().functionHasExecutedCache()->insertUnexecutedRange(sourceID(), m_typeProfilingStartOffset, m_typeProfilingEndOffset);
+}
+
+ModuleProgramExecutable* ModuleProgramExecutable::create(ExecState* exec, const SourceCode& source)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    ModuleProgramExecutable* executable = new (NotNull, allocateCell<ModuleProgramExecutable>(*exec->heap())) ModuleProgramExecutable(exec, source);
+    executable->finishCreation(exec->vm());
+
+    ParserError error;
+    DebuggerMode debuggerMode = globalObject->hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
+    UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCode = vm.codeCache()->getUnlinkedModuleProgramCodeBlock(
+        vm, executable, executable->source(), debuggerMode, error);
+
+    if (globalObject->hasDebugger())
+        globalObject->debugger()->sourceParsed(exec, executable->source().provider(), error.line(), error.message());
+
+    if (error.isValid()) {
+        throwVMError(exec, scope, error.toErrorObject(globalObject, executable->source()));
+        return nullptr;
+    }
+
+    executable->m_unlinkedModuleProgramCodeBlock.set(exec->vm(), executable, unlinkedModuleProgramCode);
+
+    executable->m_moduleEnvironmentSymbolTable.set(exec->vm(), executable, jsCast<SymbolTable*>(unlinkedModuleProgramCode->constantRegister(unlinkedModuleProgramCode->moduleEnvironmentSymbolTableConstantRegisterOffset()).get())->cloneScopePart(exec->vm()));
+
+    return executable;
+}
+
+void ModuleProgramExecutable::destroy(JSCell* cell)
+{
+    static_cast<ModuleProgramExecutable*>(cell)->ModuleProgramExecutable::~ModuleProgramExecutable();
+}
+
+void ModuleProgramExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    ModuleProgramExecutable* thisObject = jsCast<ModuleProgramExecutable*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    ScriptExecutable::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_unlinkedModuleProgramCodeBlock);
+    visitor.append(thisObject->m_moduleEnvironmentSymbolTable);
+    if (ModuleProgramCodeBlock* moduleProgramCodeBlock = thisObject->m_moduleProgramCodeBlock.get())
+        moduleProgramCodeBlock->visitWeakly(visitor);
+}
+
+} // namespace JSC
diff --git a/runtime/ModuleProgramExecutable.h b/runtime/ModuleProgramExecutable.h
new file mode 100644
index 0000000..0c834e0
--- /dev/null
+++ b/runtime/ModuleProgramExecutable.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009, 2010, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ScriptExecutable.h"
+
+namespace JSC {
+
+class ModuleProgramExecutable final : public ScriptExecutable {
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef ScriptExecutable Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static ModuleProgramExecutable* create(ExecState*, const SourceCode&);
+
+    static void destroy(JSCell*);
+
+    ModuleProgramCodeBlock* codeBlock()
+    {
+        return m_moduleProgramCodeBlock.get();
+    }
+
+    PassRefPtr<JITCode> generatedJITCode()
+    {
+        return generatedJITCodeForCall();
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(ModuleProgramExecutableType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+    ExecutableInfo executableInfo() const { return ExecutableInfo(usesEval(), isStrictMode(), false, false, ConstructorKind::None, JSParserScriptMode::Module, SuperBinding::NotNeeded, SourceParseMode::ModuleEvaluateMode, derivedContextType(), isArrowFunctionContext(), false, EvalContextType::None); }
+
+    UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock() { return m_unlinkedModuleProgramCodeBlock.get(); }
+
+    SymbolTable* moduleEnvironmentSymbolTable() { return m_moduleEnvironmentSymbolTable.get(); }
+
+private:
+    friend class ExecutableBase;
+    friend class ScriptExecutable;
+
+    ModuleProgramExecutable(ExecState*, const SourceCode&);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<UnlinkedModuleProgramCodeBlock> m_unlinkedModuleProgramCodeBlock;
+    WriteBarrier<SymbolTable> m_moduleEnvironmentSymbolTable;
+    WriteBarrier<ModuleProgramCodeBlock> m_moduleProgramCodeBlock;
+};
+
+} // namespace JSC
diff --git a/runtime/NativeErrorConstructor.cpp b/runtime/NativeErrorConstructor.cpp
new file mode 100644
index 0000000..0055ef9
--- /dev/null
+++ b/runtime/NativeErrorConstructor.cpp
@@ -0,0 +1,95 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "NativeErrorConstructor.h"
+
+#include "ErrorInstance.h"
+#include "Interpreter.h"
+#include "JSFunction.h"
+#include "JSString.h"
+#include "NativeErrorPrototype.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(NativeErrorConstructor);
+
+const ClassInfo NativeErrorConstructor::s_info = { "Function", &InternalFunction::s_info, 0, CREATE_METHOD_TABLE(NativeErrorConstructor) };
+
+NativeErrorConstructor::NativeErrorConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void NativeErrorConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, Structure* prototypeStructure, const String& name)
+{
+    Base::finishCreation(vm, name);
+    ASSERT(inherits(info()));
+    
+    NativeErrorPrototype* prototype = NativeErrorPrototype::create(vm, prototypeStructure, name, this);
+    
+    putDirect(vm, vm.propertyNames->length, jsNumber(1), DontEnum | ReadOnly);
+    putDirect(vm, vm.propertyNames->prototype, prototype, DontDelete | ReadOnly | DontEnum);
+    m_errorStructure.set(vm, this, ErrorInstance::createStructure(vm, globalObject, prototype));
+    ASSERT(m_errorStructure);
+    ASSERT(m_errorStructure->isObject());
+}
+
+void NativeErrorConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    NativeErrorConstructor* thisObject = jsCast<NativeErrorConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_errorStructure);
+}
+
+EncodedJSValue JSC_HOST_CALL Interpreter::constructWithNativeErrorConstructor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue message = exec->argument(0);
+    Structure* errorStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), jsCast<NativeErrorConstructor*>(exec->jsCallee())->errorStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    ASSERT(errorStructure);
+    scope.release();
+    return JSValue::encode(ErrorInstance::create(exec, errorStructure, message, nullptr, TypeNothing, false));
+}
+
+ConstructType NativeErrorConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = Interpreter::constructWithNativeErrorConstructor;
+    return ConstructType::Host;
+}
+    
+EncodedJSValue JSC_HOST_CALL Interpreter::callNativeErrorConstructor(ExecState* exec)
+{
+    JSValue message = exec->argument(0);
+    Structure* errorStructure = static_cast<NativeErrorConstructor*>(exec->jsCallee())->errorStructure();
+    return JSValue::encode(ErrorInstance::create(exec, errorStructure, message, nullptr, TypeNothing, false));
+}
+
+CallType NativeErrorConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = Interpreter::callNativeErrorConstructor;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/NativeErrorConstructor.h b/runtime/NativeErrorConstructor.h
new file mode 100644
index 0000000..16e772d
--- /dev/null
+++ b/runtime/NativeErrorConstructor.h
@@ -0,0 +1,64 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+#include "NativeErrorPrototype.h"
+
+namespace JSC {
+
+class ErrorInstance;
+class FunctionPrototype;
+class NativeErrorPrototype;
+
+class NativeErrorConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static NativeErrorConstructor* create(VM& vm, JSGlobalObject* globalObject, Structure* structure, Structure* prototypeStructure, const String& name)
+    {
+        NativeErrorConstructor* constructor = new (NotNull, allocateCell<NativeErrorConstructor>(vm.heap)) NativeErrorConstructor(vm, structure);
+        constructor->finishCreation(vm, globalObject, prototypeStructure, name);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    Structure* errorStructure() { return m_errorStructure.get(); }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*, Structure* prototypeStructure, const String& name);
+
+private:
+    NativeErrorConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<Structure> m_errorStructure;
+};
+
+} // namespace JSC
diff --git a/runtime/NativeErrorPrototype.cpp b/runtime/NativeErrorPrototype.cpp
new file mode 100644
index 0000000..dc8245d
--- /dev/null
+++ b/runtime/NativeErrorPrototype.cpp
@@ -0,0 +1,44 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "NativeErrorPrototype.h"
+
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "NativeErrorConstructor.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+NativeErrorPrototype::NativeErrorPrototype(VM& vm, Structure* structure)
+    : ErrorPrototype(vm, structure)
+{
+}
+
+void NativeErrorPrototype::finishCreation(VM& vm, const WTF::String& nameAndMessage, NativeErrorConstructor* constructor)
+{
+    Base::finishCreation(vm);
+    putDirect(vm, vm.propertyNames->name, jsString(&vm, nameAndMessage), DontEnum);
+    putDirect(vm, vm.propertyNames->message, jsEmptyString(&vm), DontEnum);
+    putDirect(vm, vm.propertyNames->constructor, constructor, DontEnum);
+}
+
+} // namespace JSC
diff --git a/runtime/NativeErrorPrototype.h b/runtime/NativeErrorPrototype.h
new file mode 100644
index 0000000..79f2aa1
--- /dev/null
+++ b/runtime/NativeErrorPrototype.h
@@ -0,0 +1,47 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "ErrorPrototype.h"
+
+namespace JSC {
+
+class NativeErrorConstructor;
+
+class NativeErrorPrototype : public ErrorPrototype {
+private:
+    NativeErrorPrototype(VM&, Structure*);
+
+public:
+    typedef ErrorPrototype Base;
+
+    static NativeErrorPrototype* create(VM& vm, Structure* structure, const String& name, NativeErrorConstructor* constructor)
+    {
+        NativeErrorPrototype* prototype = new (NotNull, allocateCell<NativeErrorPrototype>(vm.heap)) NativeErrorPrototype(vm, structure);
+        prototype->finishCreation(vm, name, constructor);
+        return prototype;
+    }
+
+protected:
+    void finishCreation(VM&, const String& nameAndMessage, NativeErrorConstructor*);
+};
+
+} // namespace JSC
diff --git a/runtime/NativeExecutable.cpp b/runtime/NativeExecutable.cpp
new file mode 100644
index 0000000..b7dad2a
--- /dev/null
+++ b/runtime/NativeExecutable.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009, 2010, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "BatchedTransitionOptimizer.h"
+#include "CodeBlock.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "LLIntEntrypoint.h"
+#include "Parser.h"
+#include "TypeProfiler.h"
+#include "VMInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+const ClassInfo NativeExecutable::s_info = { "NativeExecutable", &ExecutableBase::s_info, 0, CREATE_METHOD_TABLE(NativeExecutable) };
+
+NativeExecutable* NativeExecutable::create(VM& vm, PassRefPtr<JITCode> callThunk, NativeFunction function, PassRefPtr<JITCode> constructThunk, NativeFunction constructor, Intrinsic intrinsic, const DOMJIT::Signature* signature, const String& name)
+{
+    NativeExecutable* executable;
+    executable = new (NotNull, allocateCell<NativeExecutable>(vm.heap)) NativeExecutable(vm, function, constructor, intrinsic, signature);
+    executable->finishCreation(vm, callThunk, constructThunk, name);
+    return executable;
+}
+
+void NativeExecutable::destroy(JSCell* cell)
+{
+    static_cast<NativeExecutable*>(cell)->NativeExecutable::~NativeExecutable();
+}
+
+Structure* NativeExecutable::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+{
+    return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info());
+}
+
+void NativeExecutable::finishCreation(VM& vm, PassRefPtr<JITCode> callThunk, PassRefPtr<JITCode> constructThunk, const String& name)
+{
+    Base::finishCreation(vm);
+    m_jitCodeForCall = callThunk;
+    m_jitCodeForConstruct = constructThunk;
+    m_jitCodeForCallWithArityCheck = m_jitCodeForCall->addressForCall(MustCheckArity);
+    m_jitCodeForConstructWithArityCheck = m_jitCodeForConstruct->addressForCall(MustCheckArity);
+    m_name = name;
+}
+
+NativeExecutable::NativeExecutable(VM& vm, NativeFunction function, NativeFunction constructor, Intrinsic intrinsic, const DOMJIT::Signature* signature)
+    : ExecutableBase(vm, vm.nativeExecutableStructure.get(), NUM_PARAMETERS_IS_HOST, intrinsic)
+    , m_function(function)
+    , m_constructor(constructor)
+    , m_signature(signature)
+{
+}
+
+CodeBlockHash NativeExecutable::hashFor(CodeSpecializationKind kind) const
+{
+    if (kind == CodeForCall)
+        return CodeBlockHash(static_cast<unsigned>(bitwise_cast<size_t>(m_function)));
+    
+    RELEASE_ASSERT(kind == CodeForConstruct);
+    return CodeBlockHash(static_cast<unsigned>(bitwise_cast<size_t>(m_constructor)));
+}
+
+} // namespace JSC
diff --git a/runtime/NativeExecutable.h b/runtime/NativeExecutable.h
new file mode 100644
index 0000000..e4d3e04
--- /dev/null
+++ b/runtime/NativeExecutable.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009, 2010, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ExecutableBase.h"
+
+namespace JSC {
+namespace DOMJIT {
+class Signature;
+}
+
+class NativeExecutable final : public ExecutableBase {
+    friend class JIT;
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef ExecutableBase Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static NativeExecutable* create(VM&, PassRefPtr<JITCode> callThunk, NativeFunction function, PassRefPtr<JITCode> constructThunk, NativeFunction constructor, Intrinsic, const DOMJIT::Signature*, const String& name);
+
+    static void destroy(JSCell*);
+
+    CodeBlockHash hashFor(CodeSpecializationKind) const;
+
+    NativeFunction function() { return m_function; }
+    NativeFunction constructor() { return m_constructor; }
+        
+    NativeFunction nativeFunctionFor(CodeSpecializationKind kind)
+    {
+        if (kind == CodeForCall)
+            return function();
+        ASSERT(kind == CodeForConstruct);
+        return constructor();
+    }
+        
+    static ptrdiff_t offsetOfNativeFunctionFor(CodeSpecializationKind kind)
+    {
+        if (kind == CodeForCall)
+            return OBJECT_OFFSETOF(NativeExecutable, m_function);
+        ASSERT(kind == CodeForConstruct);
+        return OBJECT_OFFSETOF(NativeExecutable, m_constructor);
+    }
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue proto);
+        
+    DECLARE_INFO;
+
+    const String& name() const { return m_name; }
+    const DOMJIT::Signature* signature() const { return m_signature; }
+
+    const DOMJIT::Signature* signatureFor(CodeSpecializationKind kind) const
+    {
+        if (isCall(kind))
+            return signature();
+        return nullptr;
+    }
+
+protected:
+    void finishCreation(VM&, PassRefPtr<JITCode> callThunk, PassRefPtr<JITCode> constructThunk, const String& name);
+
+private:
+    friend class ExecutableBase;
+
+    NativeExecutable(VM&, NativeFunction function, NativeFunction constructor, Intrinsic, const DOMJIT::Signature*);
+
+    NativeFunction m_function;
+    NativeFunction m_constructor;
+    const DOMJIT::Signature* m_signature;
+
+    String m_name;
+};
+
+} // namespace JSC
diff --git a/runtime/NativeStdFunctionCell.cpp b/runtime/NativeStdFunctionCell.cpp
new file mode 100644
index 0000000..1c03266
--- /dev/null
+++ b/runtime/NativeStdFunctionCell.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NativeStdFunctionCell.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo NativeStdFunctionCell::s_info = { "NativeStdFunctionCell", nullptr, nullptr, CREATE_METHOD_TABLE(NativeStdFunctionCell) };
+
+NativeStdFunctionCell* NativeStdFunctionCell::create(VM& vm, NativeStdFunction&& function)
+{
+    NativeStdFunctionCell* nativeFunction = new (NotNull, allocateCell<NativeStdFunctionCell>(vm.heap)) NativeStdFunctionCell(vm, WTFMove(function));
+    nativeFunction->finishCreation(vm);
+    return nativeFunction;
+}
+
+
+NativeStdFunctionCell::NativeStdFunctionCell(VM& vm, NativeStdFunction&& function)
+    : Base(vm, vm.nativeStdFunctionCellStructure.get())
+    , m_function(WTFMove(function))
+{
+}
+
+void NativeStdFunctionCell::destroy(JSCell* cell)
+{
+    NativeStdFunctionCell* nativeFunction = static_cast<NativeStdFunctionCell*>(cell);
+    nativeFunction->NativeStdFunctionCell::~NativeStdFunctionCell();
+}
+
+}
diff --git a/runtime/NativeStdFunctionCell.h b/runtime/NativeStdFunctionCell.h
new file mode 100644
index 0000000..0d3a10e
--- /dev/null
+++ b/runtime/NativeStdFunctionCell.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "JSNativeStdFunction.h"
+
+namespace JSC {
+
+class NativeStdFunctionCell : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+    static const bool needsDestruction = true;
+
+    static NativeStdFunctionCell* create(VM&, NativeStdFunction&&);
+
+    static void destroy(JSCell*);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+    const NativeStdFunction& function() const { return m_function; }
+
+private:
+    NativeStdFunctionCell(VM&, NativeStdFunction&&);
+
+    NativeStdFunction m_function;
+};
+
+} // namespace JSC
diff --git a/runtime/NullGetterFunction.cpp b/runtime/NullGetterFunction.cpp
new file mode 100644
index 0000000..1f79762
--- /dev/null
+++ b/runtime/NullGetterFunction.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NullGetterFunction.h"
+
+#include "JSCJSValueInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo NullGetterFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(NullGetterFunction) };
+
+static EncodedJSValue JSC_HOST_CALL callReturnUndefined(ExecState*)
+{
+    return JSValue::encode(jsUndefined());
+}
+
+CallType NullGetterFunction::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callReturnUndefined;
+    return CallType::Host;
+}
+
+ConstructType NullGetterFunction::getConstructData(JSCell*, ConstructData&)
+{
+    return ConstructType::None;
+}
+
+}
diff --git a/runtime/NullGetterFunction.h b/runtime/NullGetterFunction.h
new file mode 100644
index 0000000..6339773
--- /dev/null
+++ b/runtime/NullGetterFunction.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class NullGetterFunction : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static NullGetterFunction* create(VM& vm, Structure* structure)
+    {
+        NullGetterFunction* function = new (NotNull, allocateCell< NullGetterFunction>(vm.heap))  NullGetterFunction(vm, structure);
+        function->finishCreation(vm, String());
+        return function;
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    NullGetterFunction(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/NullSetterFunction.cpp b/runtime/NullSetterFunction.cpp
new file mode 100644
index 0000000..977286e
--- /dev/null
+++ b/runtime/NullSetterFunction.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "NullSetterFunction.h"
+
+#include "CodeBlock.h"
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSCJSValueInlines.h"
+#include "StackVisitor.h"
+
+namespace JSC {
+
+const ClassInfo NullSetterFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(NullSetterFunction) };
+
+
+class GetCallerStrictnessFunctor {
+public:
+    GetCallerStrictnessFunctor()
+        : m_iterations(0)
+        , m_callerIsStrict(false)
+    {
+    }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        ++m_iterations;
+        if (m_iterations < 2)
+            return StackVisitor::Continue;
+
+        CodeBlock* codeBlock = visitor->codeBlock();
+        m_callerIsStrict = codeBlock && codeBlock->isStrictMode();
+        return StackVisitor::Done;
+    }
+
+    bool callerIsStrict() const { return m_callerIsStrict; }
+
+private:
+    mutable int m_iterations;
+    mutable bool m_callerIsStrict;
+};
+
+static bool callerIsStrict(ExecState* exec)
+{
+    GetCallerStrictnessFunctor iter;
+    exec->iterate(iter);
+    return iter.callerIsStrict();
+}
+
+static EncodedJSValue JSC_HOST_CALL callReturnUndefined(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (callerIsStrict(exec))
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Setting a property that has only a getter")));
+    return JSValue::encode(jsUndefined());
+}
+
+CallType NullSetterFunction::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callReturnUndefined;
+    return CallType::Host;
+}
+
+ConstructType NullSetterFunction::getConstructData(JSCell*, ConstructData&)
+{
+    return ConstructType::None;
+}
+
+}
diff --git a/runtime/NullSetterFunction.h b/runtime/NullSetterFunction.h
new file mode 100644
index 0000000..7c4d964
--- /dev/null
+++ b/runtime/NullSetterFunction.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class NullSetterFunction : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static NullSetterFunction* create(VM& vm, Structure* structure)
+    {
+        NullSetterFunction* function = new (NotNull, allocateCell< NullSetterFunction>(vm.heap))  NullSetterFunction(vm, structure);
+        function->finishCreation(vm, String());
+        return function;
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    NullSetterFunction(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/NumberConstructor.cpp b/runtime/NumberConstructor.cpp
new file mode 100644
index 0000000..8ad9ec0
--- /dev/null
+++ b/runtime/NumberConstructor.cpp
@@ -0,0 +1,150 @@
+/*
+ *  Copyright (C) 1999-2000,2003 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007, 2008, 2011, 2015-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ *
+ */
+
+#include "config.h"
+#include "NumberConstructor.h"
+
+#include "Lookup.h"
+#include "NumberObject.h"
+#include "NumberPrototype.h"
+#include "JSCInlines.h"
+#include "JSGlobalObjectFunctions.h"
+#include "StructureInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsInteger(ExecState*);
+static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsSafeInteger(ExecState*);
+
+} // namespace JSC
+
+#include "NumberConstructor.lut.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(NumberConstructor);
+
+const ClassInfo NumberConstructor::s_info = { "Function", &InternalFunction::s_info, &numberConstructorTable, CREATE_METHOD_TABLE(NumberConstructor) };
+
+/* Source for NumberConstructor.lut.h
+@begin numberConstructorTable
+  isFinite       JSBuiltin                           DontEnum|Function 1
+  isInteger      numberConstructorFuncIsInteger      DontEnum|Function 1
+  isNaN          JSBuiltin                           DontEnum|Function 1
+  isSafeInteger  numberConstructorFuncIsSafeInteger  DontEnum|Function 1
+  parseFloat     globalFuncParseFloat                DontEnum|Function 1
+@end
+*/
+
+NumberConstructor::NumberConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void NumberConstructor::finishCreation(VM& vm, NumberPrototype* numberPrototype)
+{
+    Base::finishCreation(vm, NumberPrototype::info()->className);
+    ASSERT(inherits(info()));
+
+    // Number.Prototype
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, numberPrototype, DontEnum | DontDelete | ReadOnly);
+
+    // no. of arguments for constructor
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "EPSILON"), jsDoubleNumber(std::numeric_limits<double>::epsilon()), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "MAX_VALUE"), jsDoubleNumber(1.7976931348623157E+308), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "MIN_VALUE"), jsDoubleNumber(5E-324), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "MAX_SAFE_INTEGER"), jsDoubleNumber(maxSafeInteger()), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "MIN_SAFE_INTEGER"), jsDoubleNumber(minSafeInteger()), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "NEGATIVE_INFINITY"), jsDoubleNumber(-std::numeric_limits<double>::infinity()), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "POSITIVE_INFINITY"), jsDoubleNumber(std::numeric_limits<double>::infinity()), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "NaN"), jsNaN(), DontDelete | DontEnum | ReadOnly);
+
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, "parseInt"), numberPrototype->globalObject()->parseIntFunction(), DontEnum);
+}
+
+// ECMA 15.7.1
+static EncodedJSValue JSC_HOST_CALL constructWithNumberConstructor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    double n = exec->argumentCount() ? exec->uncheckedArgument(0).toNumber(exec) : 0;
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    Structure* structure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), exec->lexicalGlobalObject()->numberObjectStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    NumberObject* object = NumberObject::create(vm, structure);
+    object->setInternalValue(vm, jsNumber(n));
+    return JSValue::encode(object);
+}
+
+ConstructType NumberConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWithNumberConstructor;
+    return ConstructType::Host;
+}
+
+// ECMA 15.7.2
+static EncodedJSValue JSC_HOST_CALL callNumberConstructor(ExecState* exec)
+{
+    return JSValue::encode(jsNumber(!exec->argumentCount() ? 0 : exec->uncheckedArgument(0).toNumber(exec)));
+}
+
+CallType NumberConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callNumberConstructor;
+    return CallType::Host;
+}
+
+// ECMA-262 20.1.2.3
+static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsInteger(ExecState* exec)
+{
+    JSValue argument = exec->argument(0);
+    bool isInteger;
+    if (argument.isInt32())
+        isInteger = true;
+    else if (!argument.isDouble())
+        isInteger = false;
+    else {
+        double number = argument.asDouble();
+        isInteger = std::isfinite(number) && trunc(number) == number;
+    }
+    return JSValue::encode(jsBoolean(isInteger));
+}
+
+// ECMA-262 20.1.2.5
+static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsSafeInteger(ExecState* exec)
+{
+    JSValue argument = exec->argument(0);
+    bool isInteger;
+    if (argument.isInt32())
+        isInteger = true;
+    else if (!argument.isDouble())
+        isInteger = false;
+    else {
+        double number = argument.asDouble();
+        isInteger = trunc(number) == number && std::abs(number) <= 9007199254740991.0;
+    }
+    return JSValue::encode(jsBoolean(isInteger));
+}
+
+} // namespace JSC
diff --git a/runtime/NumberConstructor.h b/runtime/NumberConstructor.h
new file mode 100644
index 0000000..51e4fa3
--- /dev/null
+++ b/runtime/NumberConstructor.h
@@ -0,0 +1,58 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class NumberPrototype;
+class GetterSetter;
+
+class NumberConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | ImplementsHasInstance | HasStaticPropertyTable;
+
+    static NumberConstructor* create(VM& vm, Structure* structure, NumberPrototype* numberPrototype, GetterSetter*)
+    {
+        NumberConstructor* constructor = new (NotNull, allocateCell<NumberConstructor>(vm.heap)) NumberConstructor(vm, structure);
+        constructor->finishCreation(vm, numberPrototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) 
+    { 
+        return Structure::create(vm, globalObject, proto, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+protected:
+    void finishCreation(VM&, NumberPrototype*);
+
+private:
+    NumberConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/NumberObject.cpp b/runtime/NumberObject.cpp
new file mode 100644
index 0000000..31350cc
--- /dev/null
+++ b/runtime/NumberObject.cpp
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (C) 1999-2000,2003 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ *
+ */
+
+#include "config.h"
+#include "NumberObject.h"
+
+#include "JSGlobalObject.h"
+#include "NumberPrototype.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(NumberObject);
+
+const ClassInfo NumberObject::s_info = { "Number", &JSWrapperObject::s_info, 0, CREATE_METHOD_TABLE(NumberObject) };
+
+NumberObject::NumberObject(VM& vm, Structure* structure)
+    : JSWrapperObject(vm, structure)
+{
+}
+
+void NumberObject::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+NumberObject* constructNumber(ExecState* exec, JSGlobalObject* globalObject, JSValue number)
+{
+    NumberObject* object = NumberObject::create(exec->vm(), globalObject->numberObjectStructure());
+    object->setInternalValue(exec->vm(), number);
+    return object;
+}
+
+} // namespace JSC
diff --git a/runtime/NumberObject.h b/runtime/NumberObject.h
new file mode 100644
index 0000000..9779fcb
--- /dev/null
+++ b/runtime/NumberObject.h
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSWrapperObject.h"
+
+namespace JSC {
+
+class NumberObject : public JSWrapperObject {
+protected:
+    NumberObject(VM&, Structure*);
+    void finishCreation(VM&);
+
+public:
+    typedef JSWrapperObject Base;
+
+    static NumberObject* create(VM& vm, Structure* structure)
+    {
+        NumberObject* number = new (NotNull, allocateCell<NumberObject>(vm.heap)) NumberObject(vm, structure);
+        number->finishCreation(vm);
+        return number;
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(NumberObjectType, StructureFlags), info());
+    }
+};
+
+JS_EXPORT_PRIVATE NumberObject* constructNumber(ExecState*, JSGlobalObject*, JSValue);
+
+} // namespace JSC
diff --git a/runtime/NumberPrototype.cpp b/runtime/NumberPrototype.cpp
new file mode 100644
index 0000000..dc96ee4
--- /dev/null
+++ b/runtime/NumberPrototype.cpp
@@ -0,0 +1,546 @@
+/*
+ *  Copyright (C) 1999-2000,2003 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007, 2008, 2011 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ *
+ */
+
+#include "config.h"
+#include "NumberPrototype.h"
+
+#include "BigInteger.h"
+#include "Error.h"
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "Uint16WithFraction.h"
+#include <wtf/dtoa.h>
+#include <wtf/Assertions.h>
+#include <wtf/MathExtras.h>
+#include <wtf/dtoa/double-conversion.h>
+
+using namespace WTF::double_conversion;
+
+// To avoid conflict with WTF::StringBuilder.
+typedef WTF::double_conversion::StringBuilder DoubleConversionStringBuilder;
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL numberProtoFuncToString(ExecState*);
+static EncodedJSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState*);
+static EncodedJSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState*);
+static EncodedJSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState*);
+static EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*);
+
+}
+
+#include "NumberPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo NumberPrototype::s_info = { "Number", &NumberObject::s_info, &numberPrototypeTable, CREATE_METHOD_TABLE(NumberPrototype) };
+
+/* Source for NumberPrototype.lut.h
+@begin numberPrototypeTable
+  toString          numberProtoFuncToString         DontEnum|Function 1
+  toLocaleString    numberProtoFuncToLocaleString   DontEnum|Function 0
+  valueOf           numberProtoFuncValueOf          DontEnum|Function 0
+  toFixed           numberProtoFuncToFixed          DontEnum|Function 1
+  toExponential     numberProtoFuncToExponential    DontEnum|Function 1
+  toPrecision       numberProtoFuncToPrecision      DontEnum|Function 1
+@end
+*/
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(NumberPrototype);
+
+NumberPrototype::NumberPrototype(VM& vm, Structure* structure)
+    : NumberObject(vm, structure)
+{
+}
+
+void NumberPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    setInternalValue(vm, jsNumber(0));
+
+#if ENABLE(INTL)
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("toLocaleString", numberPrototypeToLocaleStringCodeGenerator, DontEnum);
+#else
+    UNUSED_PARAM(globalObject);
+#endif // ENABLE(INTL)
+
+    ASSERT(inherits(info()));
+}
+
+// ------------------------------ Functions ---------------------------
+
+static ALWAYS_INLINE bool toThisNumber(JSValue thisValue, double& x)
+{
+    if (thisValue.isInt32()) {
+        x = thisValue.asInt32();
+        return true;
+    }
+
+    if (thisValue.isDouble()) {
+        x = thisValue.asDouble();
+        return true;
+    }
+    
+    if (thisValue.isCell() && thisValue.asCell()->type() == NumberObjectType) {
+        x = static_cast<const NumberObject*>(thisValue.asCell())->internalValue().asNumber();
+        return true;
+    }
+
+    return false;
+}
+
+static ALWAYS_INLINE bool getIntegerArgumentInRange(ExecState* exec, int low, int high, int& result, bool& isUndefined)
+{
+    result = 0;
+    isUndefined = false;
+
+    JSValue argument0 = exec->argument(0);
+    if (argument0.isUndefined()) {
+        isUndefined = true;
+        return true;
+    }
+
+    double asDouble = argument0.toInteger(exec);
+    if (asDouble < low || asDouble > high)
+        return false;
+
+    result = static_cast<int>(asDouble);
+    return true;
+}
+
+// The largest finite floating point number is 1.mantissa * 2^(0x7fe-0x3ff).
+// Since 2^N in binary is a one bit followed by N zero bits. 1 * 2^3ff requires
+// at most 1024 characters to the left of a decimal point, in base 2 (1025 if
+// we include a minus sign). For the fraction, a value with an exponent of 0
+// has up to 52 bits to the right of the decimal point. Each decrement of the
+// exponent down to a minimum of -0x3fe adds an additional digit to the length
+// of the fraction. As such the maximum fraction size is 1075 (1076 including
+// a point). We pick a buffer size such that can simply place the point in the
+// center of the buffer, and are guaranteed to have enough space in each direction
+// fo any number of digits an IEEE number may require to represent.
+typedef char RadixBuffer[2180];
+
+// Mapping from integers 0..35 to digit identifying this value, for radix 2..36.
+static const char radixDigits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+
+static char* toStringWithRadix(RadixBuffer& buffer, double number, unsigned radix)
+{
+    ASSERT(std::isfinite(number));
+    ASSERT(radix >= 2 && radix <= 36);
+
+    // Position the decimal point at the center of the string, set
+    // the startOfResultString pointer to point at the decimal point.
+    char* decimalPoint = buffer + sizeof(buffer) / 2;
+    char* startOfResultString = decimalPoint;
+
+    // Extract the sign.
+    bool isNegative = number < 0;
+    if (std::signbit(number))
+        number = -number;
+    double integerPart = floor(number);
+
+    // We use this to test for odd values in odd radix bases.
+    // Where the base is even, (e.g. 10), to determine whether a value is even we need only
+    // consider the least significant digit. For example, 124 in base 10 is even, because '4'
+    // is even. if the radix is odd, then the radix raised to an integer power is also odd.
+    // E.g. in base 5, 124 represents (1 * 125 + 2 * 25 + 4 * 5). Since each digit in the value
+    // is multiplied by an odd number, the result is even if the sum of all digits is even.
+    //
+    // For the integer portion of the result, we only need test whether the integer value is
+    // even or odd. For each digit of the fraction added, we should invert our idea of whether
+    // the number is odd if the new digit is odd.
+    //
+    // Also initialize digit to this value; for even radix values we only need track whether
+    // the last individual digit was odd.
+    bool integerPartIsOdd = integerPart <= static_cast<double>(0x1FFFFFFFFFFFFFull) && static_cast<int64_t>(integerPart) & 1;
+    ASSERT(integerPartIsOdd == static_cast<bool>(fmod(integerPart, 2)));
+    bool isOddInOddRadix = integerPartIsOdd;
+    uint32_t digit = integerPartIsOdd;
+
+    // Check if the value has a fractional part to convert.
+    double fractionPart = number - integerPart;
+    if (fractionPart) {
+        // Write the decimal point now.
+        *decimalPoint = '.';
+
+        // Higher precision representation of the fractional part.
+        Uint16WithFraction fraction(fractionPart);
+
+        bool needsRoundingUp = false;
+        char* endOfResultString = decimalPoint + 1;
+
+        // Calculate the delta from the current number to the next & previous possible IEEE numbers.
+        double nextNumber = nextafter(number, std::numeric_limits<double>::infinity());
+        double lastNumber = nextafter(number, -std::numeric_limits<double>::infinity());
+        ASSERT(std::isfinite(nextNumber) && !std::signbit(nextNumber));
+        ASSERT(std::isfinite(lastNumber) && !std::signbit(lastNumber));
+        double deltaNextDouble = nextNumber - number;
+        double deltaLastDouble = number - lastNumber;
+        ASSERT(std::isfinite(deltaNextDouble) && !std::signbit(deltaNextDouble));
+        ASSERT(std::isfinite(deltaLastDouble) && !std::signbit(deltaLastDouble));
+
+        // We track the delta from the current value to the next, to track how many digits of the
+        // fraction we need to write. For example, if the value we are converting is precisely
+        // 1.2345, so far we have written the digits "1.23" to a string leaving a remainder of
+        // 0.45, and we want to determine whether we can round off, or whether we need to keep
+        // appending digits ('4'). We can stop adding digits provided that then next possible
+        // lower IEEE value is further from 1.23 than the remainder we'd be rounding off (0.45),
+        // which is to say, less than 1.2255. Put another way, the delta between the prior
+        // possible value and this number must be more than 2x the remainder we'd be rounding off
+        // (or more simply half the delta between numbers must be greater than the remainder).
+        //
+        // Similarly we need track the delta to the next possible value, to dertermine whether
+        // to round up. In almost all cases (other than at exponent boundaries) the deltas to
+        // prior and subsequent values are identical, so we don't need track then separately.
+        if (deltaNextDouble != deltaLastDouble) {
+            // Since the deltas are different track them separately. Pre-multiply by 0.5.
+            Uint16WithFraction halfDeltaNext(deltaNextDouble, 1);
+            Uint16WithFraction halfDeltaLast(deltaLastDouble, 1);
+
+            while (true) {
+                // examine the remainder to determine whether we should be considering rounding
+                // up or down. If remainder is precisely 0.5 rounding is to even.
+                int dComparePoint5 = fraction.comparePoint5();
+                if (dComparePoint5 > 0 || (!dComparePoint5 && (radix & 1 ? isOddInOddRadix : digit & 1))) {
+                    // Check for rounding up; are we closer to the value we'd round off to than
+                    // the next IEEE value would be?
+                    if (fraction.sumGreaterThanOne(halfDeltaNext)) {
+                        needsRoundingUp = true;
+                        break;
+                    }
+                } else {
+                    // Check for rounding down; are we closer to the value we'd round off to than
+                    // the prior IEEE value would be?
+                    if (fraction < halfDeltaLast)
+                        break;
+                }
+
+                ASSERT(endOfResultString < (buffer + sizeof(buffer) - 1));
+                // Write a digit to the string.
+                fraction *= radix;
+                digit = fraction.floorAndSubtract();
+                *endOfResultString++ = radixDigits[digit];
+                // Keep track whether the portion written is currently even, if the radix is odd.
+                if (digit & 1)
+                    isOddInOddRadix = !isOddInOddRadix;
+
+                // Shift the fractions by radix.
+                halfDeltaNext *= radix;
+                halfDeltaLast *= radix;
+            }
+        } else {
+            // This code is identical to that above, except since deltaNextDouble != deltaLastDouble
+            // we don't need to track these two values separately.
+            Uint16WithFraction halfDelta(deltaNextDouble, 1);
+
+            while (true) {
+                int dComparePoint5 = fraction.comparePoint5();
+                if (dComparePoint5 > 0 || (!dComparePoint5 && (radix & 1 ? isOddInOddRadix : digit & 1))) {
+                    if (fraction.sumGreaterThanOne(halfDelta)) {
+                        needsRoundingUp = true;
+                        break;
+                    }
+                } else if (fraction < halfDelta)
+                    break;
+
+                ASSERT(endOfResultString < (buffer + sizeof(buffer) - 1));
+                fraction *= radix;
+                digit = fraction.floorAndSubtract();
+                if (digit & 1)
+                    isOddInOddRadix = !isOddInOddRadix;
+                *endOfResultString++ = radixDigits[digit];
+
+                halfDelta *= radix;
+            }
+        }
+
+        // Check if the fraction needs rounding off (flag set in the loop writing digits, above).
+        if (needsRoundingUp) {
+            // Whilst the last digit is the maximum in the current radix, remove it.
+            // e.g. rounding up the last digit in "12.3999" is the same as rounding up the
+            // last digit in "12.3" - both round up to "12.4".
+            while (endOfResultString[-1] == radixDigits[radix - 1])
+                --endOfResultString;
+
+            // Radix digits are sequential in ascii/unicode, except for '9' and 'a'.
+            // E.g. the first 'if' case handles rounding 67.89 to 67.8a in base 16.
+            // The 'else if' case handles rounding of all other digits.
+            if (endOfResultString[-1] == '9')
+                endOfResultString[-1] = 'a';
+            else if (endOfResultString[-1] != '.')
+                ++endOfResultString[-1];
+            else {
+                // One other possibility - there may be no digits to round up in the fraction
+                // (or all may be been rounded off already), in which case we may need to
+                // round into the integer portion of the number. Remove the decimal point.
+                --endOfResultString;
+                // In order to get here there must have been a non-zero fraction, in which case
+                // there must be at least one bit of the value's mantissa not in use in the
+                // integer part of the number. As such, adding to the integer part should not
+                // be able to lose precision.
+                ASSERT((integerPart + 1) - integerPart == 1);
+                ++integerPart;
+            }
+        } else {
+            // We only need to check for trailing zeros if the value does not get rounded up.
+            while (endOfResultString[-1] == '0')
+                --endOfResultString;
+        }
+
+        *endOfResultString = '\0';
+        ASSERT(endOfResultString < buffer + sizeof(buffer));
+    } else
+        *decimalPoint = '\0';
+
+    BigInteger units(integerPart);
+
+    // Always loop at least once, to emit at least '0'.
+    do {
+        ASSERT(buffer < startOfResultString);
+
+        // Read a single digit and write it to the front of the string.
+        // Divide by radix to remove one digit from the value.
+        digit = units.divide(radix);
+        *--startOfResultString = radixDigits[digit];
+    } while (!!units);
+
+    // If the number is negative, prepend '-'.
+    if (isNegative)
+        *--startOfResultString = '-';
+    ASSERT(buffer <= startOfResultString);
+
+    return startOfResultString;
+}
+
+static String toStringWithRadix(int32_t number, unsigned radix)
+{
+    LChar buf[1 + 32]; // Worst case is radix == 2, which gives us 32 digits + sign.
+    LChar* end = buf + WTF_ARRAY_LENGTH(buf);
+    LChar* p = end;
+
+    bool negative = false;
+    uint32_t positiveNumber = number;
+    if (number < 0) {
+        negative = true;
+        positiveNumber = -number;
+    }
+
+    while (positiveNumber) {
+        uint32_t index = positiveNumber % radix;
+        ASSERT(index < sizeof(radixDigits));
+        *--p = static_cast<LChar>(radixDigits[index]);
+        positiveNumber /= radix;
+    }
+    if (negative)
+        *--p = '-';
+
+    return String(p, static_cast<unsigned>(end - p));
+}
+
+// toExponential converts a number to a string, always formatting as an expoential.
+// This method takes an optional argument specifying a number of *decimal places*
+// to round the significand to (or, put another way, this method optionally rounds
+// to argument-plus-one significant figures).
+EncodedJSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    double x;
+    if (!toThisNumber(exec->thisValue(), x))
+        return throwVMTypeError(exec, scope);
+
+    // Get the argument. 
+    int decimalPlacesInExponent;
+    bool isUndefined;
+    if (!getIntegerArgumentInRange(exec, 0, 20, decimalPlacesInExponent, isUndefined))
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("toExponential() argument must be between 0 and 20")));
+
+    // Handle NaN and Infinity.
+    if (!std::isfinite(x))
+        return JSValue::encode(jsNontrivialString(exec, String::numberToStringECMAScript(x)));
+
+    // Round if the argument is not undefined, always format as exponential.
+    char buffer[WTF::NumberToStringBufferLength];
+    DoubleConversionStringBuilder builder(buffer, WTF::NumberToStringBufferLength);
+    const DoubleToStringConverter& converter = DoubleToStringConverter::EcmaScriptConverter();
+    builder.Reset();
+    isUndefined
+        ? converter.ToExponential(x, -1, &builder)
+        : converter.ToExponential(x, decimalPlacesInExponent, &builder);
+    return JSValue::encode(jsString(exec, String(builder.Finalize())));
+}
+
+// toFixed converts a number to a string, always formatting as an a decimal fraction.
+// This method takes an argument specifying a number of decimal places to round the
+// significand to. However when converting large values (1e+21 and above) this
+// method will instead fallback to calling ToString. 
+EncodedJSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    double x;
+    if (!toThisNumber(exec->thisValue(), x))
+        return throwVMTypeError(exec, scope);
+
+    // Get the argument. 
+    int decimalPlaces;
+    bool isUndefined; // This is ignored; undefined treated as 0.
+    if (!getIntegerArgumentInRange(exec, 0, 20, decimalPlaces, isUndefined))
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("toFixed() argument must be between 0 and 20")));
+
+    // 15.7.4.5.7 states "If x >= 10^21, then let m = ToString(x)"
+    // This also covers Ininity, and structure the check so that NaN
+    // values are also handled by numberToString
+    if (!(fabs(x) < 1e+21))
+        return JSValue::encode(jsString(exec, String::numberToStringECMAScript(x)));
+
+    // The check above will return false for NaN or Infinity, these will be
+    // handled by numberToString.
+    ASSERT(std::isfinite(x));
+
+    NumberToStringBuffer buffer;
+    return JSValue::encode(jsString(exec, String(numberToFixedWidthString(x, decimalPlaces, buffer))));
+}
+
+// toPrecision converts a number to a string, takeing an argument specifying a
+// number of significant figures to round the significand to. For positive
+// exponent, all values that can be represented using a decimal fraction will
+// be, e.g. when rounding to 3 s.f. any value up to 999 will be formated as a
+// decimal, whilst 1000 is converted to the exponential representation 1.00e+3.
+// For negative exponents values >= 1e-6 are formated as decimal fractions,
+// with smaller values converted to exponential representation.
+EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    double x;
+    if (!toThisNumber(exec->thisValue(), x))
+        return throwVMTypeError(exec, scope);
+
+    // Get the argument. 
+    int significantFigures;
+    bool isUndefined;
+    if (!getIntegerArgumentInRange(exec, 1, 21, significantFigures, isUndefined))
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("toPrecision() argument must be between 1 and 21")));
+
+    // To precision called with no argument is treated as ToString.
+    if (isUndefined)
+        return JSValue::encode(jsString(exec, String::numberToStringECMAScript(x)));
+
+    // Handle NaN and Infinity.
+    if (!std::isfinite(x))
+        return JSValue::encode(jsNontrivialString(exec, String::numberToStringECMAScript(x)));
+
+    NumberToStringBuffer buffer;
+    return JSValue::encode(jsString(exec, String(numberToFixedPrecisionString(x, significantFigures, buffer))));
+}
+
+static inline int32_t extractRadixFromArgs(ExecState* exec)
+{
+    JSValue radixValue = exec->argument(0);
+    int32_t radix;
+    if (radixValue.isInt32())
+        radix = radixValue.asInt32();
+    else if (radixValue.isUndefined())
+        radix = 10;
+    else
+        radix = static_cast<int32_t>(radixValue.toInteger(exec)); // nan -> 0
+
+    return radix;
+}
+
+static inline EncodedJSValue integerValueToString(ExecState* exec, int32_t radix, int32_t value)
+{
+    // A negative value casted to unsigned would be bigger than 36 (the max radix).
+    if (static_cast<unsigned>(value) < static_cast<unsigned>(radix)) {
+        ASSERT(value <= 36);
+        ASSERT(value >= 0);
+        VM* vm = &exec->vm();
+        return JSValue::encode(vm->smallStrings.singleCharacterString(radixDigits[value]));
+    }
+
+    if (radix == 10) {
+        VM* vm = &exec->vm();
+        return JSValue::encode(jsString(vm, vm->numericStrings.add(value)));
+    }
+
+    return JSValue::encode(jsString(exec, toStringWithRadix(value, radix)));
+
+}
+
+EncodedJSValue JSC_HOST_CALL numberProtoFuncToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    double doubleValue;
+    if (!toThisNumber(exec->thisValue(), doubleValue))
+        return throwVMTypeError(exec, scope);
+
+    int32_t radix = extractRadixFromArgs(exec);
+    if (radix < 2 || radix > 36)
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("toString() radix argument must be between 2 and 36")));
+
+    int32_t integerValue = static_cast<int32_t>(doubleValue);
+    if (integerValue == doubleValue)
+        return integerValueToString(exec, radix, integerValue);
+
+    if (radix == 10)
+        return JSValue::encode(jsString(&vm, vm.numericStrings.add(doubleValue)));
+
+    if (!std::isfinite(doubleValue))
+        return JSValue::encode(jsNontrivialString(exec, String::numberToStringECMAScript(doubleValue)));
+
+    RadixBuffer s;
+    return JSValue::encode(jsString(exec, toStringWithRadix(s, doubleValue, radix)));
+}
+
+EncodedJSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    double x;
+    if (!toThisNumber(exec->thisValue(), x))
+        return throwVMTypeError(exec, scope);
+
+    return JSValue::encode(jsNumber(x).toString(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    double x;
+    JSValue thisValue = exec->thisValue();
+    if (!toThisNumber(thisValue, x))
+        return throwVMTypeError(exec, scope, WTF::makeString("thisNumberValue called on incompatible ", asString(jsTypeStringForValue(exec, thisValue))->value(exec)));
+    return JSValue::encode(jsNumber(x));
+}
+
+} // namespace JSC
diff --git a/runtime/NumberPrototype.h b/runtime/NumberPrototype.h
new file mode 100644
index 0000000..102a214
--- /dev/null
+++ b/runtime/NumberPrototype.h
@@ -0,0 +1,55 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2011 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "NumberObject.h"
+
+namespace JSC {
+
+class NumberPrototype : public NumberObject {
+public:
+    typedef NumberObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static NumberPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        NumberPrototype* prototype = new (NotNull, allocateCell<NumberPrototype>(vm.heap)) NumberPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(NumberObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+
+private:
+    NumberPrototype(VM&, Structure*);
+};
+
+EncodedJSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/NumericStrings.h b/runtime/NumericStrings.h
new file mode 100644
index 0000000..86c5c38
--- /dev/null
+++ b/runtime/NumericStrings.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <array>
+#include <wtf/HashFunctions.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class NumericStrings {
+public:
+    ALWAYS_INLINE const String& add(double d)
+    {
+        CacheEntry<double>& entry = lookup(d);
+        if (d == entry.key && !entry.value.isNull())
+            return entry.value;
+        entry.key = d;
+        entry.value = String::numberToStringECMAScript(d);
+        return entry.value;
+    }
+
+    ALWAYS_INLINE const String& add(int i)
+    {
+        if (static_cast<unsigned>(i) < cacheSize)
+            return lookupSmallString(static_cast<unsigned>(i));
+        CacheEntry<int>& entry = lookup(i);
+        if (i == entry.key && !entry.value.isNull())
+            return entry.value;
+        entry.key = i;
+        entry.value = String::number(i);
+        return entry.value;
+    }
+
+    ALWAYS_INLINE const String& add(unsigned i)
+    {
+        if (i < cacheSize)
+            return lookupSmallString(static_cast<unsigned>(i));
+        CacheEntry<unsigned>& entry = lookup(i);
+        if (i == entry.key && !entry.value.isNull())
+            return entry.value;
+        entry.key = i;
+        entry.value = String::number(i);
+        return entry.value;
+    }
+private:
+    static const size_t cacheSize = 64;
+
+    template<typename T>
+    struct CacheEntry {
+        T key;
+        String value;
+    };
+
+    CacheEntry<double>& lookup(double d) { return doubleCache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
+    CacheEntry<int>& lookup(int i) { return intCache[WTF::IntHash<int>::hash(i) & (cacheSize - 1)]; }
+    CacheEntry<unsigned>& lookup(unsigned i) { return unsignedCache[WTF::IntHash<unsigned>::hash(i) & (cacheSize - 1)]; }
+    ALWAYS_INLINE const String& lookupSmallString(unsigned i)
+    {
+        ASSERT(i < cacheSize);
+        if (smallIntCache[i].isNull())
+            smallIntCache[i] = String::number(i);
+        return smallIntCache[i];
+    }
+
+    std::array<CacheEntry<double>, cacheSize> doubleCache;
+    std::array<CacheEntry<int>, cacheSize> intCache;
+    std::array<CacheEntry<unsigned>, cacheSize> unsignedCache;
+    std::array<String, cacheSize> smallIntCache;
+};
+
+} // namespace JSC
diff --git a/runtime/ObjectConstructor.cpp b/runtime/ObjectConstructor.cpp
new file mode 100644
index 0000000..065c469
--- /dev/null
+++ b/runtime/ObjectConstructor.cpp
@@ -0,0 +1,778 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "ObjectConstructor.h"
+
+#include "BuiltinNames.h"
+#include "ButterflyInlines.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSGlobalObjectFunctions.h"
+#include "Lookup.h"
+#include "ObjectPrototype.h"
+#include "PropertyDescriptor.h"
+#include "PropertyNameArray.h"
+#include "StackVisitor.h"
+#include "Symbol.h"
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorSetPrototypeOf(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorSeal(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorFreeze(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorPreventExtensions(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorIsSealed(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorIsExtensible(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorIs(ExecState*);
+
+}
+
+#include "ObjectConstructor.lut.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ObjectConstructor);
+
+const ClassInfo ObjectConstructor::s_info = { "Function", &InternalFunction::s_info, &objectConstructorTable, CREATE_METHOD_TABLE(ObjectConstructor) };
+
+/* Source for ObjectConstructor.lut.h
+@begin objectConstructorTable
+  getPrototypeOf            objectConstructorGetPrototypeOf             DontEnum|Function 1
+  setPrototypeOf            objectConstructorSetPrototypeOf             DontEnum|Function 2
+  getOwnPropertyDescriptor  objectConstructorGetOwnPropertyDescriptor   DontEnum|Function 2
+  getOwnPropertyDescriptors objectConstructorGetOwnPropertyDescriptors  DontEnum|Function 1
+  getOwnPropertyNames       objectConstructorGetOwnPropertyNames        DontEnum|Function 1
+  getOwnPropertySymbols     objectConstructorGetOwnPropertySymbols      DontEnum|Function 1
+  keys                      objectConstructorKeys                       DontEnum|Function 1
+  defineProperty            objectConstructorDefineProperty             DontEnum|Function 3
+  defineProperties          objectConstructorDefineProperties           DontEnum|Function 2
+  create                    objectConstructorCreate                     DontEnum|Function 2
+  seal                      objectConstructorSeal                       DontEnum|Function 1
+  freeze                    objectConstructorFreeze                     DontEnum|Function 1
+  preventExtensions         objectConstructorPreventExtensions          DontEnum|Function 1
+  isSealed                  objectConstructorIsSealed                   DontEnum|Function 1
+  isFrozen                  objectConstructorIsFrozen                   DontEnum|Function 1
+  isExtensible              objectConstructorIsExtensible               DontEnum|Function 1
+  is                        objectConstructorIs                         DontEnum|Function 2
+  assign                    JSBuiltin                                   DontEnum|Function 2
+  values                    JSBuiltin                                   DontEnum|Function 1
+  entries                   JSBuiltin                                   DontEnum|Function 1
+@end
+*/
+
+ObjectConstructor::ObjectConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void ObjectConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, ObjectPrototype* objectPrototype)
+{
+    Base::finishCreation(vm, objectPrototype->classInfo()->className);
+    // ECMA 15.2.3.1
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
+    // no. of arguments for constructor
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().createPrivateName(), objectConstructorCreate, DontEnum, 2);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().definePropertyPrivateName(), objectConstructorDefineProperty, DontEnum, 3);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getPrototypeOfPrivateName(), objectConstructorGetPrototypeOf, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getOwnPropertyNamesPrivateName(), objectConstructorGetOwnPropertyNames, DontEnum, 1);
+}
+
+// ES 19.1.1.1 Object([value])
+static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, JSValue newTarget)
+{
+    ObjectConstructor* objectConstructor = jsCast<ObjectConstructor*>(exec->jsCallee());
+    JSGlobalObject* globalObject = objectConstructor->globalObject();
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // We need to check newTarget condition in this caller side instead of InternalFunction::createSubclassStructure side.
+    // Since if we found this condition is met, we should not fall into the type conversion in the step 3.
+
+    // 1. If NewTarget is neither undefined nor the active function, then
+    if (newTarget && newTarget != objectConstructor) {
+        // a. Return ? OrdinaryCreateFromConstructor(NewTarget, "%ObjectPrototype%").
+        Structure* objectStructure = InternalFunction::createSubclassStructure(exec, newTarget, globalObject->objectStructureForObjectConstructor());
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        return constructEmptyObject(exec, objectStructure);
+    }
+
+    // 2. If value is null, undefined or not supplied, return ObjectCreate(%ObjectPrototype%).
+    ArgList args(exec);
+    JSValue arg = args.at(0);
+    if (arg.isUndefinedOrNull())
+        return constructEmptyObject(exec, globalObject->objectStructureForObjectConstructor());
+
+    // 3. Return ToObject(value).
+    scope.release();
+    return arg.toObject(exec, globalObject);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructWithObjectConstructor(ExecState* exec)
+{
+    return JSValue::encode(constructObject(exec, exec->newTarget()));
+}
+
+ConstructType ObjectConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWithObjectConstructor;
+    return ConstructType::Host;
+}
+
+static EncodedJSValue JSC_HOST_CALL callObjectConstructor(ExecState* exec)
+{
+    return JSValue::encode(constructObject(exec, JSValue()));
+}
+
+CallType ObjectConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callObjectConstructor;
+    return CallType::Host;
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* object = exec->argument(0).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(object->getPrototype(vm, exec));
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorSetPrototypeOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue objectValue = exec->argument(0);
+    if (objectValue.isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Cannot set prototype of undefined or null"));
+
+    JSValue protoValue = exec->argument(1);
+    if (!protoValue.isObject() && !protoValue.isNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Prototype value can only be an object or null"));
+
+    JSObject* object = objectValue.toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    bool shouldThrowIfCantSet = true;
+    bool didSetPrototype = object->setPrototype(vm, exec, protoValue, shouldThrowIfCantSet);
+    ASSERT_UNUSED(didSetPrototype, scope.exception() || didSetPrototype);
+    return JSValue::encode(objectValue);
+}
+
+JSValue objectConstructorGetOwnPropertyDescriptor(ExecState* exec, JSObject* object, const Identifier& propertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    PropertyDescriptor descriptor;
+    if (!object->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        scope.release();
+        return jsUndefined();
+    }
+    RETURN_IF_EXCEPTION(scope, { });
+
+    JSObject* result = constructObjectFromPropertyDescriptor(exec, descriptor);
+    ASSERT(!!scope.exception() == !result);
+    if (!result)
+        return jsUndefined();
+    return result;
+}
+
+JSValue objectConstructorGetOwnPropertyDescriptors(ExecState* exec, JSObject* object)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    PropertyNameArray properties(exec, PropertyNameMode::StringsAndSymbols);
+    object->methodTable(vm)->getOwnPropertyNames(object, exec, properties, EnumerationMode(DontEnumPropertiesMode::Include));
+    RETURN_IF_EXCEPTION(scope, { });
+
+    JSObject* descriptors = constructEmptyObject(exec);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    for (auto& propertyName : properties) {
+        PropertyDescriptor descriptor;
+        bool didGetDescriptor = object->getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        RETURN_IF_EXCEPTION(scope, { });
+
+        if (!didGetDescriptor)
+            continue;
+
+        JSObject* fromDescriptor = constructObjectFromPropertyDescriptor(exec, descriptor);
+        ASSERT(!!scope.exception() == !fromDescriptor);
+        if (!fromDescriptor)
+            return jsUndefined();
+
+        PutPropertySlot slot(descriptors);
+        descriptors->putOwnDataPropertyMayBeIndex(exec, propertyName, fromDescriptor, slot);
+        ASSERT(!scope.exception());
+    }
+
+    return descriptors;
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* object = exec->argument(0).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    auto propertyName = exec->argument(1).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(objectConstructorGetOwnPropertyDescriptor(exec, object, propertyName));
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptors(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* object = exec->argument(0).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(objectConstructorGetOwnPropertyDescriptors(exec, object));
+}
+
+// FIXME: Use the enumeration cache.
+EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* object = exec->argument(0).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(ownPropertyKeys(exec, object, PropertyNameMode::Strings, DontEnumPropertiesMode::Include));
+}
+
+// FIXME: Use the enumeration cache.
+EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertySymbols(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* object = exec->argument(0).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(ownPropertyKeys(exec, object, PropertyNameMode::Symbols, DontEnumPropertiesMode::Include));
+}
+
+// FIXME: Use the enumeration cache.
+EncodedJSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* object = exec->argument(0).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(ownPropertyKeys(exec, object, PropertyNameMode::Strings, DontEnumPropertiesMode::Exclude));
+}
+
+EncodedJSValue JSC_HOST_CALL ownEnumerablePropertyKeys(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* object = exec->argument(0).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(ownPropertyKeys(exec, object, PropertyNameMode::StringsAndSymbols, DontEnumPropertiesMode::Exclude));
+}
+
+// ES6 6.2.4.5 ToPropertyDescriptor
+// https://tc39.github.io/ecma262/#sec-topropertydescriptor
+bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor& desc)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!in.isObject()) {
+        throwTypeError(exec, scope, ASCIILiteral("Property description must be an object."));
+        return false;
+    }
+    JSObject* description = asObject(in);
+
+    bool hasProperty = description->hasProperty(exec, vm.propertyNames->enumerable);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (hasProperty) {
+        JSValue value = description->get(exec, vm.propertyNames->enumerable);
+        RETURN_IF_EXCEPTION(scope, false);
+        desc.setEnumerable(value.toBoolean(exec));
+    } else
+        RETURN_IF_EXCEPTION(scope, false);
+
+    hasProperty = description->hasProperty(exec, vm.propertyNames->configurable);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (hasProperty) {
+        JSValue value = description->get(exec, vm.propertyNames->configurable);
+        RETURN_IF_EXCEPTION(scope, false);
+        desc.setConfigurable(value.toBoolean(exec));
+    } else
+        RETURN_IF_EXCEPTION(scope, false);
+
+    JSValue value;
+    hasProperty = description->hasProperty(exec, vm.propertyNames->value);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (hasProperty) {
+        JSValue value = description->get(exec, vm.propertyNames->value);
+        RETURN_IF_EXCEPTION(scope, false);
+        desc.setValue(value);
+    } else
+        RETURN_IF_EXCEPTION(scope, false);
+
+    hasProperty = description->hasProperty(exec, vm.propertyNames->writable);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (hasProperty) {
+        JSValue value = description->get(exec, vm.propertyNames->writable);
+        RETURN_IF_EXCEPTION(scope, false);
+        desc.setWritable(value.toBoolean(exec));
+    } else
+        RETURN_IF_EXCEPTION(scope, false);
+
+    hasProperty = description->hasProperty(exec, vm.propertyNames->get);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (hasProperty) {
+        JSValue get = description->get(exec, vm.propertyNames->get);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (!get.isUndefined()) {
+            CallData callData;
+            if (getCallData(get, callData) == CallType::None) {
+                throwTypeError(exec, scope, ASCIILiteral("Getter must be a function."));
+                return false;
+            }
+        }
+        desc.setGetter(get);
+    } else
+        RETURN_IF_EXCEPTION(scope, false);
+
+    hasProperty = description->hasProperty(exec, vm.propertyNames->set);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (hasProperty) {
+        JSValue set = description->get(exec, vm.propertyNames->set);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (!set.isUndefined()) {
+            CallData callData;
+            if (getCallData(set, callData) == CallType::None) {
+                throwTypeError(exec, scope, ASCIILiteral("Setter must be a function."));
+                return false;
+            }
+        }
+        desc.setSetter(set);
+    } else
+        RETURN_IF_EXCEPTION(scope, false);
+
+    if (!desc.isAccessorDescriptor())
+        return true;
+
+    if (desc.value()) {
+        throwTypeError(exec, scope, ASCIILiteral("Invalid property.  'value' present on property with getter or setter."));
+        return false;
+    }
+
+    if (desc.writablePresent()) {
+        throwTypeError(exec, scope, ASCIILiteral("Invalid property.  'writable' present on property with getter or setter."));
+        return false;
+    }
+    return true;
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!exec->argument(0).isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Properties can only be defined on Objects."));
+    JSObject* obj = asObject(exec->argument(0));
+    auto propertyName = exec->argument(1).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    PropertyDescriptor descriptor;
+    auto success = toPropertyDescriptor(exec, exec->argument(2), descriptor);
+    ASSERT(!scope.exception() == success);
+    if (!success)
+        return JSValue::encode(jsNull());
+    ASSERT((descriptor.attributes() & Accessor) || (!descriptor.isAccessorDescriptor()));
+    ASSERT(!scope.exception());
+    obj->methodTable(vm)->defineOwnProperty(obj, exec, propertyName, descriptor, true);
+    scope.release();
+    return JSValue::encode(obj);
+}
+
+static JSValue defineProperties(ExecState* exec, JSObject* object, JSObject* properties)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    PropertyNameArray propertyNames(exec, PropertyNameMode::StringsAndSymbols);
+    asObject(properties)->methodTable(vm)->getOwnPropertyNames(asObject(properties), exec, propertyNames, EnumerationMode(DontEnumPropertiesMode::Exclude));
+    RETURN_IF_EXCEPTION(scope, { });
+    size_t numProperties = propertyNames.size();
+    Vector<PropertyDescriptor> descriptors;
+    MarkedArgumentBuffer markBuffer;
+    for (size_t i = 0; i < numProperties; i++) {
+        JSValue prop = properties->get(exec, propertyNames[i]);
+        RETURN_IF_EXCEPTION(scope, { });
+        PropertyDescriptor descriptor;
+        bool success = toPropertyDescriptor(exec, prop, descriptor);
+        ASSERT(!scope.exception() || !success);
+        if (UNLIKELY(!success))
+            return jsNull();
+        descriptors.append(descriptor);
+        // Ensure we mark all the values that we're accumulating
+        if (descriptor.isDataDescriptor() && descriptor.value())
+            markBuffer.append(descriptor.value());
+        if (descriptor.isAccessorDescriptor()) {
+            if (descriptor.getter())
+                markBuffer.append(descriptor.getter());
+            if (descriptor.setter())
+                markBuffer.append(descriptor.setter());
+        }
+    }
+    for (size_t i = 0; i < numProperties; i++) {
+        Identifier propertyName = propertyNames[i];
+        if (vm.propertyNames->isPrivateName(propertyName))
+            continue;
+        object->methodTable(vm)->defineOwnProperty(object, exec, propertyName, descriptors[i], true);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+    return object;
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!exec->argument(0).isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Properties can only be defined on Objects."));
+    JSObject* targetObj = asObject(exec->argument(0));
+    JSObject* props = exec->argument(1).toObject(exec);
+    ASSERT(!!scope.exception() == !props);
+    if (UNLIKELY(!props))
+        return encodedJSValue();
+    scope.release();
+    return JSValue::encode(defineProperties(exec, targetObj, props));
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue proto = exec->argument(0);
+    if (!proto.isObject() && !proto.isNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Object prototype may only be an Object or null."));
+    JSObject* newObject = proto.isObject()
+        ? constructEmptyObject(exec, asObject(proto))
+        : constructEmptyObject(exec, exec->lexicalGlobalObject()->nullPrototypeObjectStructure());
+    if (exec->argument(1).isUndefined())
+        return JSValue::encode(newObject);
+    if (!exec->argument(1).isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Property descriptor list must be an Object."));
+    scope.release();
+    return JSValue::encode(defineProperties(exec, newObject, asObject(exec->argument(1))));
+}
+
+enum class IntegrityLevel {
+    Sealed,
+    Frozen
+};
+
+template<IntegrityLevel level>
+bool setIntegrityLevel(ExecState* exec, VM& vm, JSObject* object)
+{
+    // See https://tc39.github.io/ecma262/#sec-setintegritylevel.
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    bool success = object->methodTable(vm)->preventExtensions(object, exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (UNLIKELY(!success))
+        return false;
+
+    PropertyNameArray properties(exec, PropertyNameMode::StringsAndSymbols);
+    object->methodTable(vm)->getOwnPropertyNames(object, exec, properties, EnumerationMode(DontEnumPropertiesMode::Include));
+    RETURN_IF_EXCEPTION(scope, false);
+
+    PropertyNameArray::const_iterator end = properties.end();
+    for (PropertyNameArray::const_iterator iter = properties.begin(); iter != end; ++iter) {
+        Identifier propertyName = *iter;
+        if (vm.propertyNames->isPrivateName(propertyName))
+            continue;
+
+        PropertyDescriptor desc;
+        if (level == IntegrityLevel::Sealed)
+            desc.setConfigurable(false);
+        else {
+            bool hasPropertyDescriptor = object->getOwnPropertyDescriptor(exec, propertyName, desc);
+            RETURN_IF_EXCEPTION(scope, false);
+            if (!hasPropertyDescriptor)
+                continue;
+
+            if (desc.isDataDescriptor())
+                desc.setWritable(false);
+
+            desc.setConfigurable(false);
+        }
+
+        object->methodTable(vm)->defineOwnProperty(object, exec, propertyName, desc, true);
+        RETURN_IF_EXCEPTION(scope, false);
+    }
+    return true;
+}
+    
+EncodedJSValue JSC_HOST_CALL objectConstructorSeal(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. If Type(O) is not Object, return O.
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return JSValue::encode(obj);
+    JSObject* object = asObject(obj);
+
+    if (isJSFinalObject(object)) {
+        object->seal(vm);
+        return JSValue::encode(obj);
+    }
+
+    bool success = setIntegrityLevel<IntegrityLevel::Sealed>(exec, vm, object);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (UNLIKELY(!success)) {
+        throwTypeError(exec, scope, ASCIILiteral("Unable to prevent extension in Object.seal"));
+        return encodedJSValue();
+    }
+
+    return JSValue::encode(obj);
+}
+
+JSObject* objectConstructorFreeze(ExecState* exec, JSObject* object)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (isJSFinalObject(object) && !hasIndexedProperties(object->indexingType())) {
+        object->freeze(vm);
+        return object;
+    }
+
+    bool success = setIntegrityLevel<IntegrityLevel::Frozen>(exec, vm, object);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (!success)
+        return throwTypeError(exec, scope, ASCIILiteral("Unable to prevent extension in Object.freeze"));
+    return object;
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorFreeze(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    // 1. If Type(O) is not Object, return O.
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return JSValue::encode(obj);
+    JSObject* result = objectConstructorFreeze(exec, asObject(obj));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorPreventExtensions(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    JSValue argument = exec->argument(0);
+    if (!argument.isObject())
+        return JSValue::encode(argument);
+    JSObject* object = asObject(argument);
+    object->methodTable(vm)->preventExtensions(object, exec);
+    return JSValue::encode(object);
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorIsSealed(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. If Type(O) is not Object, return true.
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return JSValue::encode(jsBoolean(true));
+    JSObject* object = asObject(obj);
+
+    if (isJSFinalObject(object))
+        return JSValue::encode(jsBoolean(object->isSealed(vm)));
+
+    // 2. For each named own property name P of O,
+    PropertyNameArray properties(exec, PropertyNameMode::StringsAndSymbols);
+    object->methodTable(vm)->getOwnPropertyNames(object, exec, properties, EnumerationMode(DontEnumPropertiesMode::Include));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    PropertyNameArray::const_iterator end = properties.end();
+    for (PropertyNameArray::const_iterator iter = properties.begin(); iter != end; ++iter) {
+        Identifier propertyName = *iter;
+        if (vm.propertyNames->isPrivateName(propertyName))
+            continue;
+        // a. Let desc be the result of calling the [[GetOwnProperty]] internal method of O with P.
+        PropertyDescriptor desc;
+        if (!object->getOwnPropertyDescriptor(exec, propertyName, desc))
+            continue;
+        // b. If desc.[[Configurable]] is true, then return false.
+        if (desc.configurable())
+            return JSValue::encode(jsBoolean(false));
+    }
+
+    // 3. If the [[Extensible]] internal property of O is false, then return true.
+    // 4. Otherwise, return false.
+    bool isExtensible = object->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsBoolean(!isExtensible));
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. If Type(O) is not Object, return true.
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return JSValue::encode(jsBoolean(true));
+    JSObject* object = asObject(obj);
+
+    if (isJSFinalObject(object))
+        return JSValue::encode(jsBoolean(object->isFrozen(vm)));
+
+    // 2. For each named own property name P of O,
+    PropertyNameArray properties(exec, PropertyNameMode::StringsAndSymbols);
+    object->methodTable(vm)->getOwnPropertyNames(object, exec, properties, EnumerationMode(DontEnumPropertiesMode::Include));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    PropertyNameArray::const_iterator end = properties.end();
+    for (PropertyNameArray::const_iterator iter = properties.begin(); iter != end; ++iter) {
+        Identifier propertyName = *iter;
+        if (vm.propertyNames->isPrivateName(propertyName))
+            continue;
+        // a. Let desc be the result of calling the [[GetOwnProperty]] internal method of O with P.
+        PropertyDescriptor desc;
+        if (!object->getOwnPropertyDescriptor(exec, propertyName, desc))
+            continue;
+        // b. If IsDataDescriptor(desc) is true then
+        // i. If desc.[[Writable]] is true, return false. c. If desc.[[Configurable]] is true, then return false.
+        if ((desc.isDataDescriptor() && desc.writable()) || desc.configurable())
+            return JSValue::encode(jsBoolean(false));
+    }
+
+    // 3. If the [[Extensible]] internal property of O is false, then return true.
+    // 4. Otherwise, return false.
+    bool isExtensible = object->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsBoolean(!isExtensible));
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorIsExtensible(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue obj = exec->argument(0);
+    if (!obj.isObject())
+        return JSValue::encode(jsBoolean(false));
+    JSObject* object = asObject(obj);
+    bool isExtensible = object->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsBoolean(isExtensible));
+}
+
+EncodedJSValue JSC_HOST_CALL objectConstructorIs(ExecState* exec)
+{
+    return JSValue::encode(jsBoolean(sameValue(exec, exec->argument(0), exec->argument(1))));
+}
+
+// FIXME: Use the enumeration cache.
+JSArray* ownPropertyKeys(ExecState* exec, JSObject* object, PropertyNameMode propertyNameMode, DontEnumPropertiesMode dontEnumPropertiesMode)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    PropertyNameArray properties(exec, propertyNameMode);
+    object->methodTable(vm)->getOwnPropertyNames(object, exec, properties, EnumerationMode(dontEnumPropertiesMode));
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    JSArray* keys = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    switch (propertyNameMode) {
+    case PropertyNameMode::Strings: {
+        size_t numProperties = properties.size();
+        for (size_t i = 0; i < numProperties; i++) {
+            const auto& identifier = properties[i];
+            ASSERT(!identifier.isSymbol());
+            keys->push(exec, jsOwnedString(exec, identifier.string()));
+            RETURN_IF_EXCEPTION(scope, nullptr);
+        }
+        break;
+    }
+
+    case PropertyNameMode::Symbols: {
+        size_t numProperties = properties.size();
+        for (size_t i = 0; i < numProperties; i++) {
+            const auto& identifier = properties[i];
+            ASSERT(identifier.isSymbol());
+            if (!vm.propertyNames->isPrivateName(identifier)) {
+                keys->push(exec, Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl())));
+                RETURN_IF_EXCEPTION(scope, nullptr);
+            }
+        }
+        break;
+    }
+
+    case PropertyNameMode::StringsAndSymbols: {
+        Vector<Identifier, 16> propertySymbols;
+        size_t numProperties = properties.size();
+        for (size_t i = 0; i < numProperties; i++) {
+            const auto& identifier = properties[i];
+            if (identifier.isSymbol()) {
+                if (!vm.propertyNames->isPrivateName(identifier))
+                    propertySymbols.append(identifier);
+            } else {
+                keys->push(exec, jsOwnedString(exec, identifier.string()));
+                RETURN_IF_EXCEPTION(scope, nullptr);
+            }
+        }
+
+        // To ensure the order defined in the spec (9.1.12), we append symbols at the last elements of keys.
+        for (const auto& identifier : propertySymbols) {
+            keys->push(exec, Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl())));
+            RETURN_IF_EXCEPTION(scope, nullptr);
+        }
+
+        break;
+    }
+    }
+
+    return keys;
+}
+
+} // namespace JSC
diff --git a/runtime/ObjectConstructor.h b/runtime/ObjectConstructor.h
new file mode 100644
index 0000000..fc52790
--- /dev/null
+++ b/runtime/ObjectConstructor.h
@@ -0,0 +1,128 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2016-2017 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+#include "JSGlobalObject.h"
+#include "ObjectPrototype.h"
+
+namespace JSC {
+
+EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptors(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertySymbols(ExecState*);
+EncodedJSValue JSC_HOST_CALL objectConstructorKeys(ExecState*);
+EncodedJSValue JSC_HOST_CALL ownEnumerablePropertyKeys(ExecState*);
+
+class ObjectPrototype;
+
+class ObjectConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static ObjectConstructor* create(VM& vm, JSGlobalObject* globalObject, Structure* structure, ObjectPrototype* objectPrototype)
+    {
+        ObjectConstructor* constructor = new (NotNull, allocateCell<ObjectConstructor>(vm.heap)) ObjectConstructor(vm, structure);
+        constructor->finishCreation(vm, globalObject, objectPrototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*, ObjectPrototype*);
+
+private:
+    ObjectConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+inline JSObject* constructEmptyObject(ExecState* exec, Structure* structure)
+{
+    return JSFinalObject::create(exec, structure);
+}
+
+inline JSObject* constructEmptyObject(ExecState* exec, JSObject* prototype, unsigned inlineCapacity)
+{
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    PrototypeMap& prototypeMap = globalObject->vm().prototypeMap;
+    Structure* structure = prototypeMap.emptyObjectStructureForPrototype(globalObject, prototype, inlineCapacity);
+    return constructEmptyObject(exec, structure);
+}
+
+inline JSObject* constructEmptyObject(ExecState* exec, JSObject* prototype)
+{
+    return constructEmptyObject(exec, prototype, JSFinalObject::defaultInlineCapacity());
+}
+
+inline JSObject* constructEmptyObject(ExecState* exec)
+{
+    return constructEmptyObject(exec, exec->lexicalGlobalObject()->objectStructureForObjectConstructor());
+}
+
+inline JSObject* constructObject(ExecState* exec, JSGlobalObject* globalObject, JSValue arg)
+{
+    if (arg.isUndefinedOrNull())
+        return constructEmptyObject(exec, globalObject->objectPrototype());
+    return arg.toObject(exec, globalObject);
+}
+
+// Section 6.2.4.4 of the ES6 specification.
+// https://tc39.github.io/ecma262/#sec-frompropertydescriptor
+inline JSObject* constructObjectFromPropertyDescriptor(ExecState* exec, const PropertyDescriptor& descriptor)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSObject* description = constructEmptyObject(exec);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    if (!descriptor.isAccessorDescriptor()) {
+        description->putDirect(vm, vm.propertyNames->value, descriptor.value() ? descriptor.value() : jsUndefined(), 0);
+        description->putDirect(vm, vm.propertyNames->writable, jsBoolean(descriptor.writable()), 0);
+    } else {
+        ASSERT(descriptor.getter() || descriptor.setter());
+        if (descriptor.getter())
+            description->putDirect(vm, vm.propertyNames->get, descriptor.getter(), 0);
+        if (descriptor.setter())
+            description->putDirect(vm, vm.propertyNames->set, descriptor.setter(), 0);
+    }
+    
+    description->putDirect(vm, vm.propertyNames->enumerable, jsBoolean(descriptor.enumerable()), 0);
+    description->putDirect(vm, vm.propertyNames->configurable, jsBoolean(descriptor.configurable()), 0);
+
+    return description;
+}
+
+
+JS_EXPORT_PRIVATE JSObject* objectConstructorFreeze(ExecState*, JSObject*);
+JSValue objectConstructorGetOwnPropertyDescriptor(ExecState*, JSObject*, const Identifier&);
+JSValue objectConstructorGetOwnPropertyDescriptors(ExecState*, JSObject*);
+JSArray* ownPropertyKeys(ExecState*, JSObject*, PropertyNameMode, DontEnumPropertiesMode);
+bool toPropertyDescriptor(ExecState*, JSValue, PropertyDescriptor&);
+
+} // namespace JSC
diff --git a/runtime/ObjectPrototype.cpp b/runtime/ObjectPrototype.cpp
new file mode 100644
index 0000000..18a1f7d
--- /dev/null
+++ b/runtime/ObjectPrototype.cpp
@@ -0,0 +1,350 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2011, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "ObjectPrototype.h"
+
+#include "Error.h"
+#include "GetterSetter.h"
+#include "HasOwnPropertyCache.h"
+#include "JSFunction.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+#include "PropertySlot.h"
+#include "StructureInlines.h"
+#include "StructureRareDataInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncValueOf(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncHasOwnProperty(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncIsPrototypeOf(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncLookupGetter(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState*);
+static EncodedJSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState*);
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ObjectPrototype);
+
+const ClassInfo ObjectPrototype::s_info = { "Object", &JSNonFinalObject::s_info, 0, CREATE_METHOD_TABLE(ObjectPrototype) };
+
+ObjectPrototype::ObjectPrototype(VM& vm, Structure* stucture)
+    : JSNonFinalObject(vm, stucture)
+{
+}
+
+void ObjectPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+    
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->toString, objectProtoFuncToString, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->toLocaleString, objectProtoFuncToLocaleString, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->valueOf, objectProtoFuncValueOf, DontEnum, 0);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->hasOwnProperty, objectProtoFuncHasOwnProperty, DontEnum, 1, HasOwnPropertyIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->isPrototypeOf, objectProtoFuncIsPrototypeOf, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->__defineGetter__, objectProtoFuncDefineGetter, DontEnum, 2);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->__defineSetter__, objectProtoFuncDefineSetter, DontEnum, 2);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->__lookupGetter__, objectProtoFuncLookupGetter, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->__lookupSetter__, objectProtoFuncLookupSetter, DontEnum, 1);
+}
+
+ObjectPrototype* ObjectPrototype::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    ObjectPrototype* prototype = new (NotNull, allocateCell<ObjectPrototype>(vm.heap)) ObjectPrototype(vm, structure);
+    prototype->finishCreation(vm, globalObject);
+    return prototype;
+}
+
+// ------------------------------ Functions --------------------------------
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncValueOf(ExecState* exec)
+{
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    JSObject* valueObj = thisValue.toObject(exec);
+    if (UNLIKELY(!valueObj))
+        return encodedJSValue();
+    return JSValue::encode(valueObj);
+}
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncHasOwnProperty(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    auto propertyName = exec->argument(0).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSObject* thisObject = thisValue.toObject(exec);
+    ASSERT(!!scope.exception() == !thisObject);
+    if (UNLIKELY(!thisObject))
+        return encodedJSValue();
+
+    Structure* structure = thisObject->structure(vm);
+    HasOwnPropertyCache* hasOwnPropertyCache = vm.ensureHasOwnPropertyCache();
+    if (std::optional<bool> result = hasOwnPropertyCache->get(structure, propertyName)) {
+        ASSERT(*result == thisObject->hasOwnProperty(exec, propertyName));
+        ASSERT(!scope.exception());
+        return JSValue::encode(jsBoolean(*result));
+    }
+
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
+    bool result = thisObject->hasOwnProperty(exec, propertyName, slot);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    hasOwnPropertyCache->tryAdd(vm, slot, thisObject, propertyName, result);
+    return JSValue::encode(jsBoolean(result));
+}
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncIsPrototypeOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    JSObject* thisObj = thisValue.toObject(exec);
+    ASSERT(!!scope.exception() == !thisObj);
+    if (UNLIKELY(!thisObj))
+        return encodedJSValue();
+
+    if (!exec->argument(0).isObject())
+        return JSValue::encode(jsBoolean(false));
+
+    JSValue v = asObject(exec->argument(0))->getPrototype(vm, exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    while (true) {
+        if (!v.isObject())
+            return JSValue::encode(jsBoolean(false));
+        if (v == thisObj)
+            return JSValue::encode(jsBoolean(true));
+        v = asObject(v)->getPrototype(vm, exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+}
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue get = exec->argument(1);
+    CallData callData;
+    if (getCallData(get, callData) == CallType::None)
+        return throwVMTypeError(exec, scope, ASCIILiteral("invalid getter usage"));
+
+    auto propertyName = exec->argument(0).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    PropertyDescriptor descriptor;
+    descriptor.setGetter(get);
+    descriptor.setEnumerable(true);
+    descriptor.setConfigurable(true);
+
+    bool shouldThrow = true;
+    scope.release();
+    thisObject->methodTable(vm)->defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue set = exec->argument(1);
+    CallData callData;
+    if (getCallData(set, callData) == CallType::None)
+        return throwVMTypeError(exec, scope, ASCIILiteral("invalid setter usage"));
+
+    auto propertyName = exec->argument(0).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    PropertyDescriptor descriptor;
+    descriptor.setSetter(set);
+    descriptor.setEnumerable(true);
+    descriptor.setConfigurable(true);
+
+    bool shouldThrow = true;
+    scope.release();
+    thisObject->methodTable(vm)->defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncLookupGetter(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    auto propertyName = exec->argument(0).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
+    bool hasProperty = thisObject->getPropertySlot(exec, propertyName, slot);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (hasProperty) {
+        if (slot.isAccessor()) {
+            GetterSetter* getterSetter = slot.getterSetter();
+            return getterSetter->isGetterNull() ? JSValue::encode(jsUndefined()) : JSValue::encode(getterSetter->getter());
+        }
+        if (slot.attributes() & CustomAccessor) {
+            PropertyDescriptor descriptor;
+            ASSERT(slot.slotBase());
+            if (slot.slotBase()->getOwnPropertyDescriptor(exec, propertyName, descriptor))
+                return descriptor.getterPresent() ? JSValue::encode(descriptor.getter()) : JSValue::encode(jsUndefined());
+        }
+    }
+
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    auto propertyName = exec->argument(0).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    PropertySlot slot(thisObject, PropertySlot::InternalMethodType::GetOwnProperty);
+    bool hasProperty = thisObject->getPropertySlot(exec, propertyName, slot);
+    ASSERT(!scope.exception() || !hasProperty);
+    if (hasProperty) {
+        if (slot.isAccessor()) {
+            GetterSetter* getterSetter = slot.getterSetter();
+            return getterSetter->isSetterNull() ? JSValue::encode(jsUndefined()) : JSValue::encode(getterSetter->setter());
+        }
+        if (slot.attributes() & CustomAccessor) {
+            PropertyDescriptor descriptor;
+            ASSERT(slot.slotBase());
+            if (slot.slotBase()->getOwnPropertyDescriptor(exec, propertyName, descriptor))
+                return descriptor.setterPresent() ? JSValue::encode(descriptor.setter()) : JSValue::encode(jsUndefined());
+        }
+    }
+
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    auto propertyName = exec->argument(0).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    PropertyDescriptor descriptor;
+    bool enumerable = thisObject->getOwnPropertyDescriptor(exec, propertyName, descriptor) && descriptor.enumerable();
+    return JSValue::encode(jsBoolean(enumerable));
+}
+
+// 15.2.4.3 Object.prototype.toLocaleString()
+EncodedJSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. Let O be the result of calling ToObject passing the this value as the argument.
+    JSObject* object = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 2. Let toString be the result of calling the [[Get]] internal method of O passing "toString" as the argument.
+    JSValue toString = object->get(exec, vm.propertyNames->toString);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 3. If IsCallable(toString) is false, throw a TypeError exception.
+    CallData callData;
+    CallType callType = getCallData(toString, callData);
+    if (callType == CallType::None)
+        return JSValue::encode(jsUndefined());
+
+    // 4. Return the result of calling the [[Call]] internal method of toString passing O as the this value and no arguments.
+    scope.release();
+    return JSValue::encode(call(exec, toString, callType, callData, object, exec->emptyList()));
+}
+
+EncodedJSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    if (thisValue.isUndefinedOrNull())
+        return JSValue::encode(thisValue.isUndefined() ? vm.smallStrings.undefinedObjectString() : vm.smallStrings.nullObjectString());
+    JSObject* thisObject = thisValue.toObject(exec);
+    ASSERT(!!scope.exception() == !thisObject);
+    if (!thisObject)
+        return JSValue::encode(jsUndefined());
+
+    auto result = thisObject->structure(vm)->objectToStringValue();
+    if (result)
+        return JSValue::encode(result);
+
+    PropertyName toStringTagSymbol = vm.propertyNames->toStringTagSymbol;
+    scope.release();
+    return JSValue::encode(thisObject->getPropertySlot(exec, toStringTagSymbol, [&] (bool found, PropertySlot& toStringTagSlot) -> JSValue {
+        if (found) {
+            JSValue stringTag = toStringTagSlot.getValue(exec, toStringTagSymbol);
+            RETURN_IF_EXCEPTION(scope, { });
+            if (stringTag.isString()) {
+                JSRopeString::RopeBuilder ropeBuilder(vm);
+                ropeBuilder.append(vm.smallStrings.objectStringStart());
+                ropeBuilder.append(asString(stringTag));
+                ropeBuilder.append(vm.smallStrings.singleCharacterString(']'));
+                JSString* result = ropeBuilder.release();
+
+                thisObject->structure(vm)->setObjectToStringValue(exec, vm, result, toStringTagSlot);
+                return result;
+            }
+        }
+
+        String tag = thisObject->methodTable(vm)->toStringName(thisObject, exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        String newString = tryMakeString("[object ", WTFMove(tag), "]");
+        if (!newString)
+            return throwOutOfMemoryError(exec, scope);
+
+        auto result = jsNontrivialString(&vm, newString);
+        thisObject->structure(vm)->setObjectToStringValue(exec, vm, result, toStringTagSlot);
+        return result;
+    }));
+}
+
+} // namespace JSC
diff --git a/runtime/ObjectPrototype.h b/runtime/ObjectPrototype.h
new file mode 100644
index 0000000..ec10462
--- /dev/null
+++ b/runtime/ObjectPrototype.h
@@ -0,0 +1,50 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2008, 2011 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class ObjectPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | IsImmutablePrototypeExoticObject;
+
+    static ObjectPrototype* create(VM&, JSGlobalObject*, Structure*);
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+
+private:
+    ObjectPrototype(VM&, Structure*);
+};
+
+JS_EXPORT_PRIVATE EncodedJSValue JSC_HOST_CALL objectProtoFuncToString(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/Operations.cpp b/runtime/Operations.cpp
new file mode 100644
index 0000000..c41dc30
--- /dev/null
+++ b/runtime/Operations.cpp
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Operations.h"
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
+{
+    return equalSlowCaseInline(exec, v1, v2);
+}
+
+bool JSValue::strictEqualSlowCase(ExecState* exec, JSValue v1, JSValue v2)
+{
+    return strictEqualSlowCaseInline(exec, v1, v2);
+}
+
+NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
+{
+    // exception for the Date exception in defaultValue()
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue p1 = v1.toPrimitive(callFrame);
+    RETURN_IF_EXCEPTION(scope, { });
+    JSValue p2 = v2.toPrimitive(callFrame);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    if (p1.isString()) {
+        JSString* p2String = p2.toString(callFrame);
+        RETURN_IF_EXCEPTION(scope, { });
+        scope.release();
+        return jsString(callFrame, asString(p1), p2String);
+    }
+
+    if (p2.isString()) {
+        JSString* p1String = p1.toString(callFrame);
+        RETURN_IF_EXCEPTION(scope, { });
+        scope.release();
+        return jsString(callFrame, p1String, asString(p2));
+    }
+
+    double p1Number = p1.toNumber(callFrame);
+    RETURN_IF_EXCEPTION(scope, { });
+    scope.release();
+    return jsNumber(p1Number + p2.toNumber(callFrame));
+}
+
+JSValue jsTypeStringForValue(VM& vm, JSGlobalObject* globalObject, JSValue v)
+{
+    if (v.isUndefined())
+        return vm.smallStrings.undefinedString();
+    if (v.isBoolean())
+        return vm.smallStrings.booleanString();
+    if (v.isNumber())
+        return vm.smallStrings.numberString();
+    if (v.isString())
+        return vm.smallStrings.stringString();
+    if (v.isSymbol())
+        return vm.smallStrings.symbolString();
+    if (v.isObject()) {
+        JSObject* object = asObject(v);
+        // Return "undefined" for objects that should be treated
+        // as null when doing comparisons.
+        if (object->structure(vm)->masqueradesAsUndefined(globalObject))
+            return vm.smallStrings.undefinedString();
+        if (object->type() == JSFunctionType)
+            return vm.smallStrings.functionString();
+        if (object->inlineTypeFlags() & TypeOfShouldCallGetCallData) {
+            CallData callData;
+            JSObject* object = asObject(v);
+            if (object->methodTable(vm)->getCallData(object, callData) != CallType::None)
+                return vm.smallStrings.functionString();
+        }
+    }
+    return vm.smallStrings.objectString();
+}
+
+JSValue jsTypeStringForValue(CallFrame* callFrame, JSValue v)
+{
+    return jsTypeStringForValue(callFrame->vm(), callFrame->lexicalGlobalObject(), v);
+}
+
+bool jsIsObjectTypeOrNull(CallFrame* callFrame, JSValue v)
+{
+    VM& vm = callFrame->vm();
+    if (!v.isCell())
+        return v.isNull();
+
+    JSType type = v.asCell()->type();
+    if (type == StringType || type == SymbolType)
+        return false;
+    if (type >= ObjectType) {
+        if (asObject(v)->structure(vm)->masqueradesAsUndefined(callFrame->lexicalGlobalObject()))
+            return false;
+        CallData callData;
+        JSObject* object = asObject(v);
+        if (object->methodTable(vm)->getCallData(object, callData) != CallType::None)
+            return false;
+    }
+    return true;
+}
+
+bool jsIsFunctionType(JSValue v)
+{
+    if (v.isObject()) {
+        CallData callData;
+        JSObject* object = asObject(v);
+        if (object->methodTable()->getCallData(object, callData) != CallType::None)
+            return true;
+    }
+    return false;
+}
+
+size_t normalizePrototypeChain(CallFrame* callFrame, Structure* structure)
+{
+    VM& vm = callFrame->vm();
+    size_t count = 0;
+    while (1) {
+        if (structure->isProxy())
+            return InvalidPrototypeChain;
+        JSValue v = structure->prototypeForLookup(callFrame);
+        if (v.isNull())
+            return count;
+
+        JSCell* base = v.asCell();
+        structure = base->structure(vm);
+        if (structure->isDictionary()) {
+            if (structure->hasBeenFlattenedBefore())
+                return InvalidPrototypeChain;
+            structure->flattenDictionaryStructure(vm, asObject(base));
+        }
+
+        ++count;
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/Operations.h b/runtime/Operations.h
new file mode 100644
index 0000000..29bacfa
--- /dev/null
+++ b/runtime/Operations.h
@@ -0,0 +1,273 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2002, 2005-2009, 2013-2014, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "ExceptionHelpers.h"
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+#define InvalidPrototypeChain (std::numeric_limits<size_t>::max())
+
+NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
+JSValue jsTypeStringForValue(CallFrame*, JSValue);
+JSValue jsTypeStringForValue(VM&, JSGlobalObject*, JSValue);
+bool jsIsObjectTypeOrNull(CallFrame*, JSValue);
+bool jsIsFunctionType(JSValue);
+size_t normalizePrototypeChain(CallFrame*, Structure*);
+
+ALWAYS_INLINE JSString* jsString(ExecState* exec, JSString* s1, JSString* s2)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    int32_t length1 = s1->length();
+    if (!length1)
+        return s2;
+    int32_t length2 = s2->length();
+    if (!length2)
+        return s1;
+    if (sumOverflows<int32_t>(length1, length2)) {
+        throwOutOfMemoryError(exec, scope);
+        return nullptr;
+    }
+
+    return JSRopeString::create(vm, s1, s2);
+}
+
+ALWAYS_INLINE JSString* jsString(ExecState* exec, JSString* s1, JSString* s2, JSString* s3)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    int32_t length1 = s1->length();
+    if (!length1) {
+        scope.release();
+        return jsString(exec, s2, s3);
+    }
+    int32_t length2 = s2->length();
+    if (!length2) {
+        scope.release();
+        return jsString(exec, s1, s3);
+    }
+    int32_t length3 = s3->length();
+    if (!length3) {
+        scope.release();
+        return jsString(exec, s1, s2);
+    }
+
+    if (sumOverflows<int32_t>(length1, length2, length3)) {
+        throwOutOfMemoryError(exec, scope);
+        return nullptr;
+    }
+    return JSRopeString::create(vm, s1, s2, s3);
+}
+
+ALWAYS_INLINE JSString* jsString(ExecState* exec, const String& u1, const String& u2, const String& u3)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    int32_t length1 = u1.length();
+    int32_t length2 = u2.length();
+    int32_t length3 = u3.length();
+    
+    if (length1 < 0 || length2 < 0 || length3 < 0) {
+        throwOutOfMemoryError(exec, scope);
+        return nullptr;
+    }
+    
+    if (!length1) {
+        scope.release();
+        return jsString(exec, jsString(vm, u2), jsString(vm, u3));
+    }
+    if (!length2) {
+        scope.release();
+        return jsString(exec, jsString(vm, u1), jsString(vm, u3));
+    }
+    if (!length3) {
+        scope.release();
+        return jsString(exec, jsString(vm, u1), jsString(vm, u2));
+    }
+
+    if (sumOverflows<int32_t>(length1, length2, length3)) {
+        throwOutOfMemoryError(exec, scope);
+        return nullptr;
+    }
+
+    return JSRopeString::create(*vm, jsString(vm, u1), jsString(vm, u2), jsString(vm, u3));
+}
+
+ALWAYS_INLINE JSValue jsStringFromRegisterArray(ExecState* exec, Register* strings, unsigned count)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    JSRopeString::RopeBuilder ropeBuilder(*vm);
+
+    for (unsigned i = 0; i < count; ++i) {
+        JSValue v = strings[-static_cast<int>(i)].jsValue();
+        JSString* string = v.toString(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        if (!ropeBuilder.append(string))
+            return throwOutOfMemoryError(exec, scope);
+    }
+
+    return ropeBuilder.release();
+}
+
+ALWAYS_INLINE JSValue jsStringFromArguments(ExecState* exec, JSValue thisValue)
+{
+    VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+    JSRopeString::RopeBuilder ropeBuilder(*vm);
+    JSString* str = thisValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, { });
+    ropeBuilder.append(str);
+
+    for (unsigned i = 0; i < exec->argumentCount(); ++i) {
+        JSValue v = exec->argument(i);
+        JSString* str = v.toString(exec);
+        RETURN_IF_EXCEPTION(scope, { });
+        if (UNLIKELY(!ropeBuilder.append(str)))
+            return throwOutOfMemoryError(exec, scope);
+    }
+
+    return ropeBuilder.release();
+}
+
+// See ES5 11.8.1/11.8.2/11.8.5 for definition of leftFirst, this value ensures correct
+// evaluation ordering for argument conversions for '<' and '>'. For '<' pass the value
+// true, for leftFirst, for '>' pass the value false (and reverse operand order).
+template<bool leftFirst>
+ALWAYS_INLINE bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (v1.isInt32() && v2.isInt32())
+        return v1.asInt32() < v2.asInt32();
+
+    if (v1.isNumber() && v2.isNumber())
+        return v1.asNumber() < v2.asNumber();
+
+    if (isJSString(v1) && isJSString(v2))
+        return codePointCompareLessThan(asString(v1)->value(callFrame), asString(v2)->value(callFrame));
+
+    double n1;
+    double n2;
+    JSValue p1;
+    JSValue p2;
+    bool wasNotString1;
+    bool wasNotString2;
+    if (leftFirst) {
+        wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
+        RETURN_IF_EXCEPTION(scope, false);
+        wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
+    } else {
+        wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
+        RETURN_IF_EXCEPTION(scope, false);
+        wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
+    }
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (wasNotString1 | wasNotString2)
+        return n1 < n2;
+    return codePointCompareLessThan(asString(p1)->value(callFrame), asString(p2)->value(callFrame));
+}
+
+// See ES5 11.8.3/11.8.4/11.8.5 for definition of leftFirst, this value ensures correct
+// evaluation ordering for argument conversions for '<=' and '=>'. For '<=' pass the
+// value true, for leftFirst, for '=>' pass the value false (and reverse operand order).
+template<bool leftFirst>
+ALWAYS_INLINE bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (v1.isInt32() && v2.isInt32())
+        return v1.asInt32() <= v2.asInt32();
+
+    if (v1.isNumber() && v2.isNumber())
+        return v1.asNumber() <= v2.asNumber();
+
+    if (isJSString(v1) && isJSString(v2))
+        return !codePointCompareLessThan(asString(v2)->value(callFrame), asString(v1)->value(callFrame));
+
+    double n1;
+    double n2;
+    JSValue p1;
+    JSValue p2;
+    bool wasNotString1;
+    bool wasNotString2;
+    if (leftFirst) {
+        wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
+        RETURN_IF_EXCEPTION(scope, false);
+        wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
+    } else {
+        wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
+        RETURN_IF_EXCEPTION(scope, false);
+        wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
+    }
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (wasNotString1 | wasNotString2)
+        return n1 <= n2;
+    return !codePointCompareLessThan(asString(p2)->value(callFrame), asString(p1)->value(callFrame));
+}
+
+// Fast-path choices here are based on frequency data from SunSpider:
+//    <times> Add case: <t1> <t2>
+//    ---------------------------
+//    5626160 Add case: 3 3 (of these, 3637690 are for immediate values)
+//    247412  Add case: 5 5
+//    20900   Add case: 5 6
+//    13962   Add case: 5 3
+//    4000    Add case: 3 5
+
+ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
+{
+    if (v1.isNumber() && v2.isNumber())
+        return jsNumber(v1.asNumber() + v2.asNumber());
+        
+    if (v1.isString() && !v2.isObject())
+        return jsString(callFrame, asString(v1), v2.toString(callFrame));
+
+    // All other cases are pretty uncommon
+    return jsAddSlowCase(callFrame, v1, v2);
+}
+
+inline bool scribbleFreeCells()
+{
+    return !ASSERT_DISABLED || Options::scribbleFreeCells();
+}
+
+inline void scribble(void* base, size_t size)
+{
+    for (size_t i = size / sizeof(EncodedJSValue); i--;) {
+        // Use a 16-byte aligned value to ensure that it passes the cell check.
+        static_cast<EncodedJSValue*>(base)[i] = JSValue::encode(
+            bitwise_cast<JSCell*>(static_cast<intptr_t>(0xbadbeef0)));
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/Options.cpp b/runtime/Options.cpp
new file mode 100644
index 0000000..9f4c2e3
--- /dev/null
+++ b/runtime/Options.cpp
@@ -0,0 +1,870 @@
+/*
+ * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Options.h"
+
+#include "LLIntCommon.h"
+#include "LLIntData.h"
+#include "SigillCrashAnalyzer.h"
+#include <algorithm>
+#include <limits>
+#include <math.h>
+#include <mutex>
+#include <stdlib.h>
+#include <string.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/Compiler.h>
+#include <wtf/DataLog.h>
+#include <wtf/NumberOfCores.h>
+#include <wtf/SplitTest.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/StringExtras.h>
+#include <wtf/text/StringBuilder.h>
+
+#if PLATFORM(COCOA)
+#include <crt_externs.h>
+#endif
+
+#if OS(WINDOWS)
+#include "MacroAssemblerX86.h"
+#endif
+
+#define USE_OPTIONS_FILE 0
+#define OPTIONS_FILENAME "/tmp/jsc.options"
+
+namespace JSC {
+
+namespace {
+#ifdef NDEBUG
+bool restrictedOptionsEnabled = false;
+#else
+bool restrictedOptionsEnabled = true;
+#endif
+}
+
+void Options::enableRestrictedOptions(bool enableOrNot)
+{
+    restrictedOptionsEnabled = enableOrNot;
+}
+    
+static bool parse(const char* string, bool& value)
+{
+    if (!strcasecmp(string, "true") || !strcasecmp(string, "yes") || !strcmp(string, "1")) {
+        value = true;
+        return true;
+    }
+    if (!strcasecmp(string, "false") || !strcasecmp(string, "no") || !strcmp(string, "0")) {
+        value = false;
+        return true;
+    }
+    return false;
+}
+
+static bool parse(const char* string, int32_t& value)
+{
+    return sscanf(string, "%d", &value) == 1;
+}
+
+static bool parse(const char* string, unsigned& value)
+{
+    return sscanf(string, "%u", &value) == 1;
+}
+
+static bool parse(const char* string, double& value)
+{
+    return sscanf(string, "%lf", &value) == 1;
+}
+
+static bool parse(const char* string, OptionRange& value)
+{
+    return value.init(string);
+}
+
+static bool parse(const char* string, const char*& value)
+{
+    if (!strlen(string))
+        string = nullptr;
+    value = string;
+    return true;
+}
+
+static bool parse(const char* string, GCLogging::Level& value)
+{
+    if (!strcasecmp(string, "none") || !strcasecmp(string, "no") || !strcasecmp(string, "false") || !strcmp(string, "0")) {
+        value = GCLogging::None;
+        return true;
+    }
+
+    if (!strcasecmp(string, "basic") || !strcasecmp(string, "yes") || !strcasecmp(string, "true") || !strcmp(string, "1")) {
+        value = GCLogging::Basic;
+        return true;
+    }
+
+    if (!strcasecmp(string, "verbose") || !strcmp(string, "2")) {
+        value = GCLogging::Verbose;
+        return true;
+    }
+
+    return false;
+}
+
+bool Options::isAvailable(Options::ID id, Options::Availability availability)
+{
+    if (availability == Availability::Restricted)
+        return restrictedOptionsEnabled;
+    ASSERT(availability == Availability::Configurable);
+    
+    UNUSED_PARAM(id);
+#if ENABLE(LLINT_STATS)
+    if (id == reportLLIntStatsID || id == llintStatsFileID)
+        return true;
+#endif
+#if !defined(NDEBUG)
+    if (id == maxSingleAllocationSizeID)
+        return true;
+#endif
+#if OS(DARWIN)
+    if (id == useSigillCrashAnalyzerID)
+        return true;
+#endif
+    return false;
+}
+
+template<typename T>
+bool overrideOptionWithHeuristic(T& variable, Options::ID id, const char* name, Options::Availability availability)
+{
+    bool available = (availability == Options::Availability::Normal)
+        || Options::isAvailable(id, availability);
+
+    const char* stringValue = getenv(name);
+    if (!stringValue)
+        return false;
+    
+    if (available && parse(stringValue, variable))
+        return true;
+    
+    fprintf(stderr, "WARNING: failed to parse %s=%s\n", name, stringValue);
+    return false;
+}
+
+bool Options::overrideAliasedOptionWithHeuristic(const char* name)
+{
+    const char* stringValue = getenv(name);
+    if (!stringValue)
+        return false;
+
+    String aliasedOption;
+    aliasedOption = String(&name[4]) + "=" + stringValue;
+    if (Options::setOption(aliasedOption.utf8().data()))
+        return true;
+
+    fprintf(stderr, "WARNING: failed to parse %s=%s\n", name, stringValue);
+    return false;
+}
+
+static unsigned computeNumberOfWorkerThreads(int maxNumberOfWorkerThreads, int minimum = 1)
+{
+    int cpusToUse = std::min(WTF::numberOfProcessorCores(), maxNumberOfWorkerThreads);
+
+    // Be paranoid, it is the OS we're dealing with, after all.
+    ASSERT(cpusToUse >= 1);
+    return std::max(cpusToUse, minimum);
+}
+
+static int32_t computePriorityDeltaOfWorkerThreads(int32_t twoCorePriorityDelta, int32_t multiCorePriorityDelta)
+{
+    if (WTF::numberOfProcessorCores() <= 2)
+        return twoCorePriorityDelta;
+
+    return multiCorePriorityDelta;
+}
+
+static unsigned computeNumberOfGCMarkers(unsigned maxNumberOfGCMarkers)
+{
+    return computeNumberOfWorkerThreads(maxNumberOfGCMarkers);
+}
+
+const char* const OptionRange::s_nullRangeStr = "<null>";
+
+bool OptionRange::init(const char* rangeString)
+{
+    // rangeString should be in the form of [!]<low>[:<high>]
+    // where low and high are unsigned
+
+    bool invert = false;
+
+    if (!rangeString) {
+        m_state = InitError;
+        return false;
+    }
+
+    if (!strcmp(rangeString, s_nullRangeStr)) {
+        m_state = Uninitialized;
+        return true;
+    }
+    
+    m_rangeString = rangeString;
+
+    if (*rangeString == '!') {
+        invert = true;
+        rangeString++;
+    }
+
+    int scanResult = sscanf(rangeString, " %u:%u", &m_lowLimit, &m_highLimit);
+
+    if (!scanResult || scanResult == EOF) {
+        m_state = InitError;
+        return false;
+    }
+
+    if (scanResult == 1)
+        m_highLimit = m_lowLimit;
+
+    if (m_lowLimit > m_highLimit) {
+        m_state = InitError;
+        return false;
+    }
+
+    m_state = invert ? Inverted : Normal;
+
+    return true;
+}
+
+bool OptionRange::isInRange(unsigned count)
+{
+    if (m_state < Normal)
+        return true;
+
+    if ((m_lowLimit <= count) && (count <= m_highLimit))
+        return m_state == Normal ? true : false;
+
+    return m_state == Normal ? false : true;
+}
+
+void OptionRange::dump(PrintStream& out) const
+{
+    out.print(m_rangeString);
+}
+
+Options::Entry Options::s_options[Options::numberOfOptions];
+Options::Entry Options::s_defaultOptions[Options::numberOfOptions];
+
+// Realize the names for each of the options:
+const Options::EntryInfo Options::s_optionsInfo[Options::numberOfOptions] = {
+#define FOR_EACH_OPTION(type_, name_, defaultValue_, availability_, description_) \
+    { #name_, description_, Options::Type::type_##Type, Availability::availability_ },
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+};
+
+static void scaleJITPolicy()
+{
+    auto& scaleFactor = Options::jitPolicyScale();
+    if (scaleFactor > 1.0)
+        scaleFactor = 1.0;
+    else if (scaleFactor < 0.0)
+        scaleFactor = 0.0;
+
+    struct OptionToScale {
+        Options::ID id;
+        int32_t minVal;
+    };
+
+    static const OptionToScale optionsToScale[] = {
+        { Options::thresholdForJITAfterWarmUpID, 0 },
+        { Options::thresholdForJITSoonID, 0 },
+        { Options::thresholdForOptimizeAfterWarmUpID, 1 },
+        { Options::thresholdForOptimizeAfterLongWarmUpID, 1 },
+        { Options::thresholdForOptimizeSoonID, 1 },
+        { Options::thresholdForFTLOptimizeSoonID, 2 },
+        { Options::thresholdForFTLOptimizeAfterWarmUpID, 2 }
+    };
+
+    const int numberOfOptionsToScale = sizeof(optionsToScale) / sizeof(OptionToScale);
+    for (int i = 0; i < numberOfOptionsToScale; i++) {
+        Option option(optionsToScale[i].id);
+        ASSERT(option.type() == Options::Type::int32Type);
+        option.int32Val() *= scaleFactor;
+        option.int32Val() = std::max(option.int32Val(), optionsToScale[i].minVal);
+    }
+}
+
+static void overrideDefaults()
+{
+    if (WTF::numberOfProcessorCores() < 4) {
+        Options::maximumMutatorUtilization() = 0.6;
+        Options::concurrentGCMaxHeadroom() = 1.4;
+        Options::concurrentGCPeriodMS() = 10;
+    } else
+        Options::useStochasticMutatorScheduler() = true;
+
+    if (Options::useConcurrentGCSplitTesting()) {
+        if (Options::useConcurrentGC()) {
+            // Run an A/B split test on concurrent GC: if it was going to be on,
+            // turn it off with some probability. Do this deterministically per
+            // unique user identifier so that crashes don't skew statistics, and
+            // do it in a manner which can be reconstructed from a crash trace.
+            std::optional<bool> enableExperiment = SplitTest::singleton().enableBooleanExperiment();
+            Options::useConcurrentGC() = enableExperiment.value_or(true);
+        }
+    }
+}
+
+static void recomputeDependentOptions()
+{
+#if !defined(NDEBUG)
+    Options::validateDFGExceptionHandling() = true;
+#endif
+#if !ENABLE(JIT)
+    Options::useLLInt() = true;
+    Options::useJIT() = false;
+    Options::useDFGJIT() = false;
+    Options::useFTLJIT() = false;
+    Options::useDOMJIT() = false;
+#endif
+#if !ENABLE(YARR_JIT)
+    Options::useRegExpJIT() = false;
+#endif
+#if !ENABLE(CONCURRENT_JS)
+    Options::useConcurrentJIT() = false;
+#endif
+#if !ENABLE(DFG_JIT)
+    Options::useDFGJIT() = false;
+    Options::useFTLJIT() = false;
+#endif
+#if !ENABLE(FTL_JIT)
+    Options::useFTLJIT() = false;
+#endif
+    
+#if !CPU(X86_64) && !CPU(ARM64)
+    Options::useConcurrentGC() = false;
+#endif
+    
+#if OS(WINDOWS) && CPU(X86) 
+    // Disable JIT on Windows if SSE2 is not present 
+    if (!MacroAssemblerX86::supportsFloatingPoint())
+        Options::useJIT() = false;
+#endif
+    if (Options::dumpDisassembly()
+        || Options::dumpDFGDisassembly()
+        || Options::dumpFTLDisassembly()
+        || Options::dumpBytecodeAtDFGTime()
+        || Options::dumpGraphAtEachPhase()
+        || Options::dumpDFGGraphAtEachPhase()
+        || Options::dumpDFGFTLGraphAtEachPhase()
+        || Options::dumpB3GraphAtEachPhase()
+        || Options::dumpAirGraphAtEachPhase()
+        || Options::verboseCompilation()
+        || Options::verboseFTLCompilation()
+        || Options::logCompilationChanges()
+        || Options::validateGraph()
+        || Options::validateGraphAtEachPhase()
+        || Options::verboseOSR()
+        || Options::verboseCompilationQueue()
+        || Options::reportCompileTimes()
+        || Options::reportBaselineCompileTimes()
+        || Options::reportDFGCompileTimes()
+        || Options::reportFTLCompileTimes()
+        || Options::reportDFGPhaseTimes()
+        || Options::verboseCFA()
+        || Options::verboseFTLFailure())
+        Options::alwaysComputeHash() = true;
+    
+    if (!Options::useConcurrentGC())
+        Options::collectContinuously() = false;
+
+    if (Option(Options::jitPolicyScaleID).isOverridden())
+        scaleJITPolicy();
+    
+    if (Options::forceEagerCompilation()) {
+        Options::thresholdForJITAfterWarmUp() = 10;
+        Options::thresholdForJITSoon() = 10;
+        Options::thresholdForOptimizeAfterWarmUp() = 20;
+        Options::thresholdForOptimizeAfterLongWarmUp() = 20;
+        Options::thresholdForOptimizeSoon() = 20;
+        Options::thresholdForFTLOptimizeAfterWarmUp() = 20;
+        Options::thresholdForFTLOptimizeSoon() = 20;
+        Options::maximumEvalCacheableSourceLength() = 150000;
+        Options::useConcurrentJIT() = false;
+    }
+    if (Options::useMaximalFlushInsertionPhase()) {
+        Options::useOSREntryToDFG() = false;
+        Options::useOSREntryToFTL() = false;
+    }
+    
+#if PLATFORM(IOS) && !PLATFORM(IOS_SIMULATOR) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 100000
+    // Override globally for now. Longer term we'll just make the default
+    // be to have this option enabled, and have platforms that don't support
+    // it just silently use a single mapping.
+    Options::useSeparatedWXHeap() = true;
+#endif
+
+    if (Options::alwaysUseShadowChicken())
+        Options::maximumInliningDepth() = 1;
+
+    // Compute the maximum value of the reoptimization retry counter. This is simply
+    // the largest value at which we don't overflow the execute counter, when using it
+    // to left-shift the execution counter by this amount. Currently the value ends
+    // up being 18, so this loop is not so terrible; it probably takes up ~100 cycles
+    // total on a 32-bit processor.
+    Options::reoptimizationRetryCounterMax() = 0;
+    while ((static_cast<int64_t>(Options::thresholdForOptimizeAfterLongWarmUp()) << (Options::reoptimizationRetryCounterMax() + 1)) <= static_cast<int64_t>(std::numeric_limits<int32_t>::max()))
+        Options::reoptimizationRetryCounterMax()++;
+
+    ASSERT((static_cast<int64_t>(Options::thresholdForOptimizeAfterLongWarmUp()) << Options::reoptimizationRetryCounterMax()) > 0);
+    ASSERT((static_cast<int64_t>(Options::thresholdForOptimizeAfterLongWarmUp()) << Options::reoptimizationRetryCounterMax()) <= static_cast<int64_t>(std::numeric_limits<int32_t>::max()));
+
+#if ENABLE(LLINT_STATS)
+    LLInt::Data::loadStats();
+#endif
+#if !defined(NDEBUG)
+    if (Options::maxSingleAllocationSize())
+        fastSetMaxSingleAllocationSize(Options::maxSingleAllocationSize());
+    else
+        fastSetMaxSingleAllocationSize(std::numeric_limits<size_t>::max());
+#endif
+    if (Options::useSigillCrashAnalyzer())
+        enableSigillCrashAnalyzer();
+}
+
+void Options::initialize()
+{
+    static std::once_flag initializeOptionsOnceFlag;
+    
+    std::call_once(
+        initializeOptionsOnceFlag,
+        [] {
+            // Initialize each of the options with their default values:
+#define FOR_EACH_OPTION(type_, name_, defaultValue_, availability_, description_) \
+            name_() = defaultValue_;                                    \
+            name_##Default() = defaultValue_;
+            JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+
+            overrideDefaults();
+                
+            // Allow environment vars to override options if applicable.
+            // The evn var should be the name of the option prefixed with
+            // "JSC_".
+#if PLATFORM(COCOA)
+            bool hasBadOptions = false;
+            for (char** envp = *_NSGetEnviron(); *envp; envp++) {
+                const char* env = *envp;
+                if (!strncmp("JSC_", env, 4)) {
+                    if (!Options::setOption(&env[4])) {
+                        dataLog("ERROR: invalid option: ", *envp, "\n");
+                        hasBadOptions = true;
+                    }
+                }
+            }
+            if (hasBadOptions && Options::validateOptions())
+                CRASH();
+#else // PLATFORM(COCOA)
+#define FOR_EACH_OPTION(type_, name_, defaultValue_, availability_, description_) \
+            overrideOptionWithHeuristic(name_(), name_##ID, "JSC_" #name_, Availability::availability_);
+            JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+#endif // PLATFORM(COCOA)
+
+#define FOR_EACH_OPTION(aliasedName_, unaliasedName_, equivalence_) \
+            overrideAliasedOptionWithHeuristic("JSC_" #aliasedName_);
+            JSC_ALIASED_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+
+#if 0
+                ; // Deconfuse editors that do auto indentation
+#endif
+    
+#if USE(OPTIONS_FILE)
+            {
+                const char* filename = OPTIONS_FILENAME;
+                FILE* optionsFile = fopen(filename, "r");
+                if (!optionsFile) {
+                    dataLogF("Failed to open file %s. Did you add the file-read-data entitlement to WebProcess.sb?\n", filename);
+                    return;
+                }
+                
+                StringBuilder builder;
+                char* line;
+                char buffer[BUFSIZ];
+                while ((line = fgets(buffer, sizeof(buffer), optionsFile)))
+                    builder.append(buffer);
+                
+                const char* optionsStr = builder.toString().utf8().data();
+                dataLogF("Setting options: %s\n", optionsStr);
+                setOptions(optionsStr);
+                
+                int result = fclose(optionsFile);
+                if (result)
+                    dataLogF("Failed to close file %s: %s\n", filename, strerror(errno));
+            }
+#endif
+
+            recomputeDependentOptions();
+
+            // Do range checks where needed and make corrections to the options:
+            ASSERT(Options::thresholdForOptimizeAfterLongWarmUp() >= Options::thresholdForOptimizeAfterWarmUp());
+            ASSERT(Options::thresholdForOptimizeAfterWarmUp() >= Options::thresholdForOptimizeSoon());
+            ASSERT(Options::thresholdForOptimizeAfterWarmUp() >= 0);
+
+            dumpOptionsIfNeeded();
+            ensureOptionsAreCoherent();
+        });
+}
+
+void Options::dumpOptionsIfNeeded()
+{
+    if (Options::dumpOptions()) {
+        DumpLevel level = static_cast<DumpLevel>(Options::dumpOptions());
+        if (level > DumpLevel::Verbose)
+            level = DumpLevel::Verbose;
+            
+        const char* title = nullptr;
+        switch (level) {
+        case DumpLevel::None:
+            break;
+        case DumpLevel::Overridden:
+            title = "Overridden JSC options:";
+            break;
+        case DumpLevel::All:
+            title = "All JSC options:";
+            break;
+        case DumpLevel::Verbose:
+            title = "All JSC options with descriptions:";
+            break;
+        }
+
+        StringBuilder builder;
+        dumpAllOptions(builder, level, title, nullptr, "   ", "\n", DumpDefaults);
+        dataLog(builder.toString());
+    }
+}
+
+bool Options::setOptions(const char* optionsStr)
+{
+    Vector<char*> options;
+
+    size_t length = strlen(optionsStr);
+    char* optionsStrCopy = WTF::fastStrDup(optionsStr);
+    char* end = optionsStrCopy + length;
+    char* p = optionsStrCopy;
+
+    while (p < end) {
+        // Skip white space.
+        while (p < end && isASCIISpace(*p))
+            p++;
+        if (p == end)
+            break;
+
+        char* optionStart = p;
+        p = strstr(p, "=");
+        if (!p) {
+            dataLogF("'=' not found in option string: %p\n", optionStart);
+            return false;
+        }
+        p++;
+
+        char* valueBegin = p;
+        bool hasStringValue = false;
+        const int minStringLength = 2; // The min is an empty string i.e. 2 double quotes.
+        if ((p + minStringLength < end) && (*p == '"')) {
+            p = strstr(p + 1, "\"");
+            if (!p) {
+                dataLogF("Missing trailing '\"' in option string: %p\n", optionStart);
+                return false; // End of string not found.
+            }
+            hasStringValue = true;
+        }
+
+        // Find next white space.
+        while (p < end && !isASCIISpace(*p))
+            p++;
+        if (!p)
+            p = end; // No more " " separator. Hence, this is the last arg.
+
+        // If we have a well-formed string value, strip the quotes.
+        if (hasStringValue) {
+            char* valueEnd = p;
+            ASSERT((*valueBegin == '"') && ((valueEnd - valueBegin) >= minStringLength) && (valueEnd[-1] == '"'));
+            memmove(valueBegin, valueBegin + 1, valueEnd - valueBegin - minStringLength);
+            valueEnd[-minStringLength] = '\0';
+        }
+
+        // Strip leading -- if present.
+        if ((p -  optionStart > 2) && optionStart[0] == '-' && optionStart[1] == '-')
+            optionStart += 2;
+
+        *p++ = '\0';
+        options.append(optionStart);
+    }
+
+    bool success = true;
+    for (auto& option : options) {
+        bool optionSuccess = setOption(option);
+        if (!optionSuccess) {
+            dataLogF("Failed to set option : %s\n", option);
+            success = false;
+        }
+    }
+
+    dumpOptionsIfNeeded();
+    return success;
+}
+
+// Parses a single command line option in the format "<optionName>=<value>"
+// (no spaces allowed) and set the specified option if appropriate.
+bool Options::setOptionWithoutAlias(const char* arg)
+{
+    // arg should look like this:
+    //   <jscOptionName>=<appropriate value>
+    const char* equalStr = strchr(arg, '=');
+    if (!equalStr)
+        return false;
+
+    const char* valueStr = equalStr + 1;
+
+    // For each option, check if the specify arg is a match. If so, set the arg
+    // if the value makes sense. Otherwise, move on to checking the next option.
+#define FOR_EACH_OPTION(type_, name_, defaultValue_, availability_, description_) \
+    if (strlen(#name_) == static_cast<size_t>(equalStr - arg)      \
+        && !strncmp(arg, #name_, equalStr - arg)) {                \
+        if (Availability::availability_ != Availability::Normal     \
+            && !isAvailable(name_##ID, Availability::availability_)) \
+            return false;                                          \
+        type_ value;                                               \
+        value = (defaultValue_);                                   \
+        bool success = parse(valueStr, value);                     \
+        if (success) {                                             \
+            name_() = value;                                       \
+            recomputeDependentOptions();                           \
+            return true;                                           \
+        }                                                          \
+        return false;                                              \
+    }
+
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+
+    return false; // No option matched.
+}
+
+static bool invertBoolOptionValue(const char* valueStr, const char*& invertedValueStr)
+{
+    bool boolValue;
+    if (!parse(valueStr, boolValue))
+        return false;
+    invertedValueStr = boolValue ? "false" : "true";
+    return true;
+}
+
+
+bool Options::setAliasedOption(const char* arg)
+{
+    // arg should look like this:
+    //   <jscOptionName>=<appropriate value>
+    const char* equalStr = strchr(arg, '=');
+    if (!equalStr)
+        return false;
+
+#if COMPILER(CLANG)
+#if __has_warning("-Wtautological-compare")
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wtautological-compare"
+#endif
+#endif
+
+    // For each option, check if the specify arg is a match. If so, set the arg
+    // if the value makes sense. Otherwise, move on to checking the next option.
+#define FOR_EACH_OPTION(aliasedName_, unaliasedName_, equivalence) \
+    if (strlen(#aliasedName_) == static_cast<size_t>(equalStr - arg)    \
+        && !strncmp(arg, #aliasedName_, equalStr - arg)) {              \
+        String unaliasedOption(#unaliasedName_);                        \
+        if (equivalence == SameOption)                                  \
+            unaliasedOption = unaliasedOption + equalStr;               \
+        else {                                                          \
+            ASSERT(equivalence == InvertedOption);                      \
+            const char* invertedValueStr = nullptr;                     \
+            if (!invertBoolOptionValue(equalStr + 1, invertedValueStr)) \
+                return false;                                           \
+            unaliasedOption = unaliasedOption + "=" + invertedValueStr; \
+        }                                                               \
+        return setOptionWithoutAlias(unaliasedOption.utf8().data());   \
+    }
+
+    JSC_ALIASED_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+
+#if COMPILER(CLANG)
+#if __has_warning("-Wtautological-compare")
+#pragma clang diagnostic pop
+#endif
+#endif
+
+    return false; // No option matched.
+}
+
+bool Options::setOption(const char* arg)
+{
+    bool success = setOptionWithoutAlias(arg);
+    if (success)
+        return true;
+    return setAliasedOption(arg);
+}
+
+
+void Options::dumpAllOptions(StringBuilder& builder, DumpLevel level, const char* title,
+    const char* separator, const char* optionHeader, const char* optionFooter, DumpDefaultsOption dumpDefaultsOption)
+{
+    if (title) {
+        builder.append(title);
+        builder.append('\n');
+    }
+
+    for (int id = 0; id < numberOfOptions; id++) {
+        if (separator && id)
+            builder.append(separator);
+        dumpOption(builder, level, static_cast<ID>(id), optionHeader, optionFooter, dumpDefaultsOption);
+    }
+}
+
+void Options::dumpAllOptionsInALine(StringBuilder& builder)
+{
+    dumpAllOptions(builder, DumpLevel::All, nullptr, " ", nullptr, nullptr, DontDumpDefaults);
+}
+
+void Options::dumpAllOptions(FILE* stream, DumpLevel level, const char* title)
+{
+    StringBuilder builder;
+    dumpAllOptions(builder, level, title, nullptr, "   ", "\n", DumpDefaults);
+    fprintf(stream, "%s", builder.toString().utf8().data());
+}
+
+void Options::dumpOption(StringBuilder& builder, DumpLevel level, Options::ID id,
+    const char* header, const char* footer, DumpDefaultsOption dumpDefaultsOption)
+{
+    if (id >= numberOfOptions)
+        return; // Illegal option.
+
+    Option option(id);
+    Availability availability = option.availability();
+    if (availability != Availability::Normal && !isAvailable(id, availability))
+        return;
+
+    bool wasOverridden = option.isOverridden();
+    bool needsDescription = (level == DumpLevel::Verbose && option.description());
+
+    if (level == DumpLevel::Overridden && !wasOverridden)
+        return;
+
+    if (header)
+        builder.append(header);
+    builder.append(option.name());
+    builder.append('=');
+    option.dump(builder);
+
+    if (wasOverridden && (dumpDefaultsOption == DumpDefaults)) {
+        builder.appendLiteral(" (default: ");
+        option.defaultOption().dump(builder);
+        builder.appendLiteral(")");
+    }
+
+    if (needsDescription) {
+        builder.appendLiteral("   ... ");
+        builder.append(option.description());
+    }
+
+    builder.append(footer);
+}
+
+void Options::ensureOptionsAreCoherent()
+{
+    bool coherent = true;
+    if (!(useLLInt() || useJIT())) {
+        coherent = false;
+        dataLog("INCOHERENT OPTIONS: at least one of useLLInt or useJIT must be true\n");
+    }
+    if (!coherent)
+        CRASH();
+}
+
+void Option::dump(StringBuilder& builder) const
+{
+    switch (type()) {
+    case Options::Type::boolType:
+        builder.append(m_entry.boolVal ? "true" : "false");
+        break;
+    case Options::Type::unsignedType:
+        builder.appendNumber(m_entry.unsignedVal);
+        break;
+    case Options::Type::doubleType:
+        builder.appendNumber(m_entry.doubleVal);
+        break;
+    case Options::Type::int32Type:
+        builder.appendNumber(m_entry.int32Val);
+        break;
+    case Options::Type::optionRangeType:
+        builder.append(m_entry.optionRangeVal.rangeString());
+        break;
+    case Options::Type::optionStringType: {
+        const char* option = m_entry.optionStringVal;
+        if (!option)
+            option = "";
+        builder.append('"');
+        builder.append(option);
+        builder.append('"');
+        break;
+    }
+    case Options::Type::gcLogLevelType: {
+        builder.append(GCLogging::levelAsString(m_entry.gcLogLevelVal));
+        break;
+    }
+    }
+}
+
+bool Option::operator==(const Option& other) const
+{
+    switch (type()) {
+    case Options::Type::boolType:
+        return m_entry.boolVal == other.m_entry.boolVal;
+    case Options::Type::unsignedType:
+        return m_entry.unsignedVal == other.m_entry.unsignedVal;
+    case Options::Type::doubleType:
+        return (m_entry.doubleVal == other.m_entry.doubleVal) || (std::isnan(m_entry.doubleVal) && std::isnan(other.m_entry.doubleVal));
+    case Options::Type::int32Type:
+        return m_entry.int32Val == other.m_entry.int32Val;
+    case Options::Type::optionRangeType:
+        return m_entry.optionRangeVal.rangeString() == other.m_entry.optionRangeVal.rangeString();
+    case Options::Type::optionStringType:
+        return (m_entry.optionStringVal == other.m_entry.optionStringVal)
+            || (m_entry.optionStringVal && other.m_entry.optionStringVal && !strcmp(m_entry.optionStringVal, other.m_entry.optionStringVal));
+    case Options::Type::gcLogLevelType:
+        return m_entry.gcLogLevelVal == other.m_entry.gcLogLevelVal;
+    }
+    return false;
+}
+
+} // namespace JSC
+
diff --git a/runtime/Options.h b/runtime/Options.h
new file mode 100644
index 0000000..7c264ba
--- /dev/null
+++ b/runtime/Options.h
@@ -0,0 +1,676 @@
+/*
+ * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GCLogging.h"
+#include "JSExportMacros.h"
+#include <stdint.h>
+#include <stdio.h>
+#include <wtf/PrintStream.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WTF {
+class StringBuilder;
+}
+using WTF::StringBuilder;
+
+namespace JSC {
+
+// How do JSC VM options work?
+// ===========================
+// The JSC_OPTIONS() macro below defines a list of all JSC options in use,
+// along with their types and default values. The options values are actually
+// realized as an array of Options::Entry elements.
+//
+//     Options::initialize() will initialize the array of options values with
+// the defaults specified in JSC_OPTIONS() below. After that, the values can
+// be programmatically read and written to using an accessor method with the
+// same name as the option. For example, the option "useJIT" can be read and
+// set like so:
+//
+//     bool jitIsOn = Options::useJIT();  // Get the option value.
+//     Options::useJIT() = false;         // Sets the option value.
+//
+//     If you want to tweak any of these values programmatically for testing
+// purposes, you can do so in Options::initialize() after the default values
+// are set.
+//
+//     Alternatively, you can override the default values by specifying
+// environment variables of the form: JSC_<name of JSC option>.
+//
+// Note: Options::initialize() tries to ensure some sanity on the option values
+// which are set by doing some range checks, and value corrections. These
+// checks are done after the option values are set. If you alter the option
+// values after the sanity checks (for your own testing), then you're liable to
+// ensure that the new values set are sane and reasonable for your own run.
+
+class OptionRange {
+private:
+    enum RangeState { Uninitialized, InitError, Normal, Inverted };
+public:
+    OptionRange& operator= (const int& rhs)
+    { // Only needed for initialization
+        if (!rhs) {
+            m_state = Uninitialized;
+            m_rangeString = 0;
+            m_lowLimit = 0;
+            m_highLimit = 0;
+        }
+        return *this;
+    }
+
+    bool init(const char*);
+    bool isInRange(unsigned);
+    const char* rangeString() const { return (m_state > InitError) ? m_rangeString : s_nullRangeStr; }
+    
+    void dump(PrintStream& out) const;
+
+private:
+    static const char* const s_nullRangeStr;
+
+    RangeState m_state;
+    const char* m_rangeString;
+    unsigned m_lowLimit;
+    unsigned m_highLimit;
+};
+
+typedef OptionRange optionRange;
+typedef const char* optionString;
+
+#define JSC_OPTIONS(v) \
+    v(bool, validateOptions, false, Normal, "crashes if mis-typed JSC options were passed to the VM") \
+    v(unsigned, dumpOptions, 0, Normal, "dumps JSC options (0 = None, 1 = Overridden only, 2 = All, 3 = Verbose)") \
+    \
+    v(bool, useLLInt,  true, Normal, "allows the LLINT to be used if true") \
+    v(bool, useJIT,    true, Normal, "allows the baseline JIT to be used if true") \
+    v(bool, useDFGJIT, true, Normal, "allows the DFG JIT to be used if true") \
+    v(bool, useRegExpJIT, true, Normal, "allows the RegExp JIT to be used if true") \
+    v(bool, useDOMJIT, true, Normal, "allows the DOMJIT to be used if true") \
+    \
+    v(bool, reportMustSucceedExecutableAllocations, false, Normal, nullptr) \
+    \
+    v(unsigned, maxPerThreadStackUsage, 4 * MB, Normal, "Max allowed stack usage by the VM") \
+    v(unsigned, softReservedZoneSize, 128 * KB, Normal, "A buffer greater than reservedZoneSize that reserves space for stringifying exceptions.") \
+    v(unsigned, reservedZoneSize, 64 * KB, Normal, "The amount of stack space we guarantee to our clients (and to interal VM code that does not call out to clients).") \
+    \
+    v(bool, crashIfCantAllocateJITMemory, false, Normal, nullptr) \
+    v(unsigned, jitMemoryReservationSize, 0, Normal, "Set this number to change the executable allocation size in ExecutableAllocatorFixedVMPool. (In bytes.)") \
+    v(bool, useSeparatedWXHeap, false, Normal, nullptr) \
+    \
+    v(bool, forceCodeBlockLiveness, false, Normal, nullptr) \
+    v(bool, forceICFailure, false, Normal, nullptr) \
+    \
+    v(unsigned, repatchCountForCoolDown, 8, Normal, nullptr) \
+    v(unsigned, initialCoolDownCount, 20, Normal, nullptr) \
+    v(unsigned, repatchBufferingCountdown, 8, Normal, nullptr) \
+    \
+    v(bool, dumpGeneratedBytecodes, false, Normal, nullptr) \
+    v(bool, dumpBytecodeLivenessResults, false, Normal, nullptr) \
+    v(bool, validateBytecode, false, Normal, nullptr) \
+    v(bool, forceDebuggerBytecodeGeneration, false, Normal, nullptr) \
+    \
+    v(bool, useFunctionDotArguments, true, Normal, nullptr) \
+    v(bool, useTailCalls, true, Normal, nullptr) \
+    v(bool, alwaysUseShadowChicken, false, Normal, nullptr) \
+    v(unsigned, shadowChickenLogSize, 1000, Normal, nullptr) \
+    v(unsigned, shadowChickenMaxTailDeletedFramesSize, 128, Normal, nullptr) \
+    \
+    /* dumpDisassembly implies dumpDFGDisassembly. */ \
+    v(bool, dumpDisassembly, false, Normal, "dumps disassembly of all JIT compiled code upon compilation") \
+    v(bool, asyncDisassembly, false, Normal, nullptr) \
+    v(bool, dumpDFGDisassembly, false, Normal, "dumps disassembly of DFG function upon compilation") \
+    v(bool, dumpFTLDisassembly, false, Normal, "dumps disassembly of FTL function upon compilation") \
+    v(bool, dumpAllDFGNodes, false, Normal, nullptr) \
+    v(optionRange, bytecodeRangeToJITCompile, 0, Normal, "bytecode size range to allow compilation on, e.g. 1:100") \
+    v(optionRange, bytecodeRangeToDFGCompile, 0, Normal, "bytecode size range to allow DFG compilation on, e.g. 1:100") \
+    v(optionRange, bytecodeRangeToFTLCompile, 0, Normal, "bytecode size range to allow FTL compilation on, e.g. 1:100") \
+    v(optionString, jitWhitelist, nullptr, Normal, "file with list of function signatures to allow compilation on") \
+    v(optionString, dfgWhitelist, nullptr, Normal, "file with list of function signatures to allow DFG compilation on") \
+    v(bool, dumpSourceAtDFGTime, false, Normal, "dumps source code of JS function being DFG compiled") \
+    v(bool, dumpBytecodeAtDFGTime, false, Normal, "dumps bytecode of JS function being DFG compiled") \
+    v(bool, dumpGraphAfterParsing, false, Normal, nullptr) \
+    v(bool, dumpGraphAtEachPhase, false, Normal, nullptr) \
+    v(bool, dumpDFGGraphAtEachPhase, false, Normal, "dumps the DFG graph at each phase of DFG compilation (note this excludes DFG graphs during FTL compilation)") \
+    v(bool, dumpDFGFTLGraphAtEachPhase, false, Normal, "dumps the DFG graph at each phase of DFG compilation when compiling FTL code") \
+    v(bool, dumpB3GraphAtEachPhase, false, Normal, "dumps the B3 graph at each phase of compilation") \
+    v(bool, dumpAirGraphAtEachPhase, false, Normal, "dumps the Air graph at each phase of compilation") \
+    v(bool, verboseDFGByteCodeParsing, false, Normal, nullptr) \
+    v(bool, safepointBeforeEachPhase, true, Normal, nullptr) \
+    v(bool, verboseCompilation, false, Normal, nullptr) \
+    v(bool, verboseFTLCompilation, false, Normal, nullptr) \
+    v(bool, logCompilationChanges, false, Normal, nullptr) \
+    v(bool, printEachOSRExit, false, Normal, nullptr) \
+    v(bool, validateGraph, false, Normal, nullptr) \
+    v(bool, validateGraphAtEachPhase, false, Normal, nullptr) \
+    v(bool, verboseValidationFailure, false, Normal, nullptr) \
+    v(bool, verboseOSR, false, Normal, nullptr) \
+    v(bool, verboseFTLOSRExit, false, Normal, nullptr) \
+    v(bool, verboseCallLink, false, Normal, nullptr) \
+    v(bool, verboseCompilationQueue, false, Normal, nullptr) \
+    v(bool, reportCompileTimes, false, Normal, "dumps JS function signature and the time it took to compile in all tiers") \
+    v(bool, reportBaselineCompileTimes, false, Normal, "dumps JS function signature and the time it took to BaselineJIT compile") \
+    v(bool, reportDFGCompileTimes, false, Normal, "dumps JS function signature and the time it took to DFG and FTL compile") \
+    v(bool, reportFTLCompileTimes, false, Normal, "dumps JS function signature and the time it took to FTL compile") \
+    v(bool, reportDFGPhaseTimes, false, Normal, "dumps JS function name and the time is took for each DFG phase") \
+    v(bool, reportTotalCompileTimes, false, Normal, nullptr) \
+    v(bool, verboseExitProfile, false, Normal, nullptr) \
+    v(bool, verboseCFA, false, Normal, nullptr) \
+    v(bool, verboseFTLToJSThunk, false, Normal, nullptr) \
+    v(bool, verboseFTLFailure, false, Normal, nullptr) \
+    v(bool, alwaysComputeHash, false, Normal, nullptr) \
+    v(bool, testTheFTL, false, Normal, nullptr) \
+    v(bool, verboseSanitizeStack, false, Normal, nullptr) \
+    v(bool, useGenerationalGC, true, Normal, nullptr) \
+    v(bool, useConcurrentBarriers, true, Normal, nullptr) \
+    v(bool, useConcurrentGC, true, Normal, nullptr) \
+    v(bool, collectContinuously, false, Normal, nullptr) \
+    v(double, collectContinuouslyPeriodMS, 1, Normal, nullptr) \
+    v(bool, forceFencedBarrier, false, Normal, nullptr) \
+    v(bool, verboseVisitRace, false, Normal, nullptr) \
+    v(bool, optimizeParallelSlotVisitorsForStoppedMutator, false, Normal, nullptr) \
+    v(unsigned, largeHeapSize, 32 * 1024 * 1024, Normal, nullptr) \
+    v(unsigned, smallHeapSize, 1 * 1024 * 1024, Normal, nullptr) \
+    v(double, smallHeapRAMFraction, 0.25, Normal, nullptr) \
+    v(double, smallHeapGrowthFactor, 2, Normal, nullptr) \
+    v(double, mediumHeapRAMFraction, 0.5, Normal, nullptr) \
+    v(double, mediumHeapGrowthFactor, 1.5, Normal, nullptr) \
+    v(double, largeHeapGrowthFactor, 1.24, Normal, nullptr) \
+    v(double, minimumMutatorUtilization, 0, Normal, nullptr) \
+    v(double, maximumMutatorUtilization, 0.7, Normal, nullptr) \
+    v(double, concurrentGCMaxHeadroom, 1.5, Normal, nullptr) \
+    v(double, concurrentGCPeriodMS, 2, Normal, nullptr) \
+    v(bool, useStochasticMutatorScheduler, false, Normal, nullptr) \
+    v(double, minimumGCPauseMS, 0.3, Normal, nullptr) \
+    v(double, gcPauseScale, 0.3, Normal, nullptr) \
+    v(bool, scribbleFreeCells, false, Normal, nullptr) \
+    v(double, sizeClassProgression, 1.4, Normal, nullptr) \
+    v(unsigned, largeAllocationCutoff, 100000, Normal, nullptr) \
+    v(bool, dumpSizeClasses, false, Normal, nullptr) \
+    v(bool, useBumpAllocator, true, Normal, nullptr) \
+    v(bool, stealEmptyBlocksFromOtherAllocators, true, Normal, nullptr) \
+    v(bool, eagerlyUpdateTopCallFrame, false, Normal, nullptr) \
+    \
+    v(bool, useOSREntryToDFG, true, Normal, nullptr) \
+    v(bool, useOSREntryToFTL, true, Normal, nullptr) \
+    \
+    v(bool, useFTLJIT, true, Normal, "allows the FTL JIT to be used if true") \
+    v(bool, useFTLTBAA, true, Normal, nullptr) \
+    v(bool, validateFTLOSRExitLiveness, false, Normal, nullptr) \
+    v(bool, b3AlwaysFailsBeforeCompile, false, Normal, nullptr) \
+    v(bool, b3AlwaysFailsBeforeLink, false, Normal, nullptr) \
+    v(bool, ftlCrashes, false, Normal, nullptr) /* fool-proof way of checking that you ended up in the FTL. ;-) */\
+    v(bool, clobberAllRegsInFTLICSlowPath, !ASSERT_DISABLED, Normal, nullptr) \
+    v(bool, useAccessInlining, true, Normal, nullptr) \
+    v(unsigned, maxAccessVariantListSize, 8, Normal, nullptr) \
+    v(unsigned, megamorphicLoadCost, 999, Normal, nullptr) /* This used to be 10, but we're temporarily testing what happens when the feature is disabled. */\
+    v(bool, usePolyvariantDevirtualization, true, Normal, nullptr) \
+    v(bool, usePolymorphicAccessInlining, true, Normal, nullptr) \
+    v(bool, usePolymorphicCallInlining, true, Normal, nullptr) \
+    v(bool, usePolymorphicCallInliningForNonStubStatus, false, Normal, nullptr) \
+    v(unsigned, maxPolymorphicCallVariantListSize, 15, Normal, nullptr) \
+    v(unsigned, maxPolymorphicCallVariantListSizeForTopTier, 5, Normal, nullptr) \
+    v(unsigned, maxPolymorphicCallVariantListSizeForWebAssemblyToJS, 5, Normal, nullptr) \
+    v(unsigned, maxPolymorphicCallVariantsForInlining, 5, Normal, nullptr) \
+    v(unsigned, frequentCallThreshold, 2, Normal, nullptr) \
+    v(double, minimumCallToKnownRate, 0.51, Normal, nullptr) \
+    v(bool, createPreHeaders, true, Normal, nullptr) \
+    v(bool, useMovHintRemoval, true, Normal, nullptr) \
+    v(bool, usePutStackSinking, true, Normal, nullptr) \
+    v(bool, useObjectAllocationSinking, true, Normal, nullptr) \
+    v(bool, logExecutableAllocation, false, Normal, nullptr) \
+    \
+    v(bool, useConcurrentJIT, true, Normal, "allows the DFG / FTL compilation in threads other than the executing JS thread") \
+    v(unsigned, numberOfDFGCompilerThreads, computeNumberOfWorkerThreads(2, 2) - 1, Normal, nullptr) \
+    v(unsigned, numberOfFTLCompilerThreads, computeNumberOfWorkerThreads(8, 2) - 1, Normal, nullptr) \
+    v(int32, priorityDeltaOfDFGCompilerThreads, computePriorityDeltaOfWorkerThreads(-1, 0), Normal, nullptr) \
+    v(int32, priorityDeltaOfFTLCompilerThreads, computePriorityDeltaOfWorkerThreads(-2, 0), Normal, nullptr) \
+    \
+    v(bool, useProfiler, false, Normal, nullptr) \
+    v(bool, disassembleBaselineForProfiler, true, Normal, nullptr) \
+    \
+    v(bool, useArchitectureSpecificOptimizations, true, Normal, nullptr) \
+    \
+    v(bool, breakOnThrow, false, Normal, nullptr) \
+    \
+    v(unsigned, maximumOptimizationCandidateInstructionCount, 100000, Normal, nullptr) \
+    \
+    v(unsigned, maximumFunctionForCallInlineCandidateInstructionCount, 180, Normal, nullptr) \
+    v(unsigned, maximumFunctionForClosureCallInlineCandidateInstructionCount, 100, Normal, nullptr) \
+    v(unsigned, maximumFunctionForConstructInlineCandidateInstructionCount, 100, Normal, nullptr) \
+    \
+    v(unsigned, maximumFTLCandidateInstructionCount, 20000, Normal, nullptr) \
+    \
+    /* Depth of inline stack, so 1 = no inlining, 2 = one level, etc. */ \
+    v(unsigned, maximumInliningDepth, 5, Normal, "maximum allowed inlining depth.  Depth of 1 means no inlining") \
+    v(unsigned, maximumInliningRecursion, 2, Normal, nullptr) \
+    \
+    /* Maximum size of a caller for enabling inlining. This is purely to protect us */\
+    /* from super long compiles that take a lot of memory. */\
+    v(unsigned, maximumInliningCallerSize, 10000, Normal, nullptr) \
+    \
+    v(unsigned, maximumVarargsForInlining, 100, Normal, nullptr) \
+    \
+    v(bool, usePolyvariantCallInlining, true, Normal, nullptr) \
+    v(bool, usePolyvariantByIdInlining, true, Normal, nullptr) \
+    \
+    v(bool, useMaximalFlushInsertionPhase, false, Normal, "Setting to true allows the DFG's MaximalFlushInsertionPhase to run.") \
+    \
+    v(unsigned, maximumBinaryStringSwitchCaseLength, 50, Normal, nullptr) \
+    v(unsigned, maximumBinaryStringSwitchTotalLength, 2000, Normal, nullptr) \
+    \
+    v(double, jitPolicyScale, 1.0, Normal, "scale JIT thresholds to this specified ratio between 0.0 (compile ASAP) and 1.0 (compile like normal).") \
+    v(bool, forceEagerCompilation, false, Normal, nullptr) \
+    v(int32, thresholdForJITAfterWarmUp, 500, Normal, nullptr) \
+    v(int32, thresholdForJITSoon, 100, Normal, nullptr) \
+    \
+    v(int32, thresholdForOptimizeAfterWarmUp, 1000, Normal, nullptr) \
+    v(int32, thresholdForOptimizeAfterLongWarmUp, 1000, Normal, nullptr) \
+    v(int32, thresholdForOptimizeSoon, 1000, Normal, nullptr) \
+    v(int32, executionCounterIncrementForLoop, 1, Normal, nullptr) \
+    v(int32, executionCounterIncrementForEntry, 15, Normal, nullptr) \
+    \
+    v(int32, thresholdForFTLOptimizeAfterWarmUp, 100000, Normal, nullptr) \
+    v(int32, thresholdForFTLOptimizeSoon, 1000, Normal, nullptr) \
+    v(int32, ftlTierUpCounterIncrementForLoop, 1, Normal, nullptr) \
+    v(int32, ftlTierUpCounterIncrementForReturn, 15, Normal, nullptr) \
+    v(unsigned, ftlOSREntryFailureCountForReoptimization, 15, Normal, nullptr) \
+    v(unsigned, ftlOSREntryRetryThreshold, 100, Normal, nullptr) \
+    \
+    v(int32, evalThresholdMultiplier, 10, Normal, nullptr) \
+    v(unsigned, maximumEvalCacheableSourceLength, 256, Normal, nullptr) \
+    \
+    v(bool, randomizeExecutionCountsBetweenCheckpoints, false, Normal, nullptr) \
+    v(int32, maximumExecutionCountsBetweenCheckpointsForBaseline, 1000, Normal, nullptr) \
+    v(int32, maximumExecutionCountsBetweenCheckpointsForUpperTiers, 50000, Normal, nullptr) \
+    \
+    v(unsigned, likelyToTakeSlowCaseMinimumCount, 20, Normal, nullptr) \
+    v(unsigned, couldTakeSlowCaseMinimumCount, 10, Normal, nullptr) \
+    \
+    v(unsigned, osrExitCountForReoptimization, 100, Normal, nullptr) \
+    v(unsigned, osrExitCountForReoptimizationFromLoop, 5, Normal, nullptr) \
+    \
+    v(unsigned, reoptimizationRetryCounterMax, 0, Normal, nullptr)  \
+    \
+    v(unsigned, minimumOptimizationDelay, 1, Normal, nullptr) \
+    v(unsigned, maximumOptimizationDelay, 5, Normal, nullptr) \
+    v(double, desiredProfileLivenessRate, 0.75, Normal, nullptr) \
+    v(double, desiredProfileFullnessRate, 0.35, Normal, nullptr) \
+    \
+    v(double, doubleVoteRatioForDoubleFormat, 2, Normal, nullptr) \
+    v(double, structureCheckVoteRatioForHoisting, 1, Normal, nullptr) \
+    v(double, checkArrayVoteRatioForHoisting, 1, Normal, nullptr) \
+    \
+    v(unsigned, maximumDirectCallStackSize, 200, Normal, nullptr) \
+    \
+    v(unsigned, minimumNumberOfScansBetweenRebalance, 100, Normal, nullptr) \
+    v(unsigned, numberOfGCMarkers, computeNumberOfGCMarkers(8), Normal, nullptr) \
+    v(unsigned, opaqueRootMergeThreshold, 1000, Normal, nullptr) \
+    v(double, minHeapUtilization, 0.8, Normal, nullptr) \
+    v(double, minMarkedBlockUtilization, 0.9, Normal, nullptr) \
+    v(unsigned, slowPathAllocsBetweenGCs, 0, Normal, "force a GC on every Nth slow path alloc, where N is specified by this option") \
+    \
+    v(double, percentCPUPerMBForFullTimer, 0.0003125, Normal, nullptr) \
+    v(double, percentCPUPerMBForEdenTimer, 0.0025, Normal, nullptr) \
+    v(double, collectionTimerMaxPercentCPU, 0.05, Normal, nullptr) \
+    \
+    v(bool, forceWeakRandomSeed, false, Normal, nullptr) \
+    v(unsigned, forcedWeakRandomSeed, 0, Normal, nullptr) \
+    \
+    v(bool, useZombieMode, false, Normal, "debugging option to scribble over dead objects with 0xdeadbeef") \
+    v(bool, useImmortalObjects, false, Normal, "debugging option to keep all objects alive forever") \
+    v(bool, dumpObjectStatistics, false, Normal, nullptr) \
+    v(unsigned, maxSingleAllocationSize, 0, Configurable, "debugging option to limit individual allocations to a max size (0 = limit not set, N = limit size in bytes)") \
+    \
+    v(gcLogLevel, logGC, GCLogging::None, Normal, "debugging option to log GC activity (0 = None, 1 = Basic, 2 = Verbose)") \
+    v(bool, useGC, true, Normal, nullptr) \
+    v(bool, gcAtEnd, false, Normal, "If true, the jsc CLI will do a GC before exiting") \
+    v(bool, forceGCSlowPaths, false, Normal, "If true, we will force all JIT fast allocations down their slow paths.")\
+    v(unsigned, gcMaxHeapSize, 0, Normal, nullptr) \
+    v(unsigned, forceRAMSize, 0, Normal, nullptr) \
+    v(bool, recordGCPauseTimes, false, Normal, nullptr) \
+    v(bool, logHeapStatisticsAtExit, false, Normal, nullptr) \
+    v(bool, forceCodeBlockToJettisonDueToOldAge, false, Normal, "If true, this means that anytime we can jettison a CodeBlock due to old age, we do.") \
+    v(bool, useEagerCodeBlockJettisonTiming, false, Normal, "If true, the time slices for jettisoning a CodeBlock due to old age are shrunk significantly.") \
+    \
+    v(bool, useTypeProfiler, false, Normal, nullptr) \
+    v(bool, useControlFlowProfiler, false, Normal, nullptr) \
+    \
+    v(bool, useSamplingProfiler, false, Normal, nullptr) \
+    v(unsigned, sampleInterval, 1000, Normal, "Time between stack traces in microseconds.") \
+    v(bool, collectSamplingProfilerDataForJSCShell, false, Normal, "This corresponds to the JSC shell's --sample option.") \
+    v(optionString, samplingProfilerPath, nullptr, Normal, "The path to the directory to write sampiling profiler output to. This probably will not work with WK2 unless the path is in the whitelist.") \
+    \
+    v(bool, alwaysGeneratePCToCodeOriginMap, false, Normal, "This will make sure we always generate a PCToCodeOriginMap for JITed code.") \
+    \
+    v(bool, verifyHeap, false, Normal, nullptr) \
+    v(unsigned, numberOfGCCyclesToRecordForVerification, 3, Normal, nullptr) \
+    \
+    v(bool, useExceptionFuzz, false, Normal, nullptr) \
+    v(unsigned, fireExceptionFuzzAt, 0, Normal, nullptr) \
+    v(bool, validateDFGExceptionHandling, false, Normal, "Causes the DFG to emit code validating exception handling for each node that can exit") /* This is true by default on Debug builds */\
+    v(bool, dumpSimulatedThrows, false, Normal, "Dumps the call stack at each simulated throw for exception scope verification") \
+    v(bool, validateExceptionChecks, false, Normal, "Verifies that needed exception checks are performed.") \
+    \
+    v(bool, useExecutableAllocationFuzz, false, Normal, nullptr) \
+    v(unsigned, fireExecutableAllocationFuzzAt, 0, Normal, nullptr) \
+    v(unsigned, fireExecutableAllocationFuzzAtOrAfter, 0, Normal, nullptr) \
+    v(bool, verboseExecutableAllocationFuzz, false, Normal, nullptr) \
+    \
+    v(bool, useOSRExitFuzz, false, Normal, nullptr) \
+    v(unsigned, fireOSRExitFuzzAtStatic, 0, Normal, nullptr) \
+    v(unsigned, fireOSRExitFuzzAt, 0, Normal, nullptr) \
+    v(unsigned, fireOSRExitFuzzAtOrAfter, 0, Normal, nullptr) \
+    \
+    v(bool, logB3PhaseTimes, false, Normal, nullptr) \
+    v(double, rareBlockPenalty, 0.001, Normal, nullptr) \
+    v(bool, airSpillsEverything, false, Normal, nullptr) \
+    v(bool, logAirRegisterPressure, false, Normal, nullptr) \
+    v(unsigned, maxB3TailDupBlockSize, 3, Normal, nullptr) \
+    v(unsigned, maxB3TailDupBlockSuccessors, 3, Normal, nullptr) \
+    \
+    v(bool, useDollarVM, false, Restricted, "installs the $vm debugging tool in global objects") \
+    v(optionString, functionOverrides, nullptr, Restricted, "file with debugging overrides for function bodies") \
+    v(bool, useSigillCrashAnalyzer, false, Configurable, "logs data about SIGILL crashes") \
+    \
+    v(unsigned, watchdog, 0, Normal, "watchdog timeout (0 = Disabled, N = a timeout period of N milliseconds)") \
+    \
+    v(bool, useICStats, false, Normal, nullptr) \
+    \
+    v(unsigned, prototypeHitCountForLLIntCaching, 2, Normal, "Number of prototype property hits before caching a prototype in the LLInt. A count of 0 means never cache.") \
+    \
+    v(bool, dumpModuleRecord, false, Normal, nullptr) \
+    v(bool, dumpModuleLoadingState, false, Normal, nullptr) \
+    v(bool, exposeInternalModuleLoader, false, Normal, "expose the internal module loader object to the global space for debugging") \
+    \
+    v(bool, dumpAirAsJSBeforeAllocateStack, false, Normal, nullptr) \
+    v(bool, dumpAirAfterAllocateStack, false, Normal, nullptr) \
+    \
+    v(bool, useSuperSampler, false, Normal, nullptr) \
+    \
+    v(bool, reportLLIntStats, false, Configurable, "Reports LLInt statistics") \
+    v(optionString, llintStatsFile, nullptr, Configurable, "File to collect LLInt statistics in") \
+    \
+    v(bool, useSourceProviderCache, true, Normal, "If false, the parser will not use the source provider cache. It's good to verify everything works when this is false. Because the cache is so successful, it can mask bugs.") \
+    v(bool, useCodeCache, true, Normal, "If false, the unlinked byte code cache will not be used.") \
+    \
+    v(bool, useWebAssembly, false, Normal, "Expose the WebAssembly global object.") \
+    \
+    v(bool, useConcurrentGCSplitTesting, false, Normal, "If true, A/B split testing will be performed on the concurrent GC, yielding a 50% chance that concurrent GC is disabled.") \
+
+enum OptionEquivalence {
+    SameOption,
+    InvertedOption,
+};
+
+#define JSC_ALIASED_OPTIONS(v) \
+    v(enableFunctionDotArguments, useFunctionDotArguments, SameOption) \
+    v(enableTailCalls, useTailCalls, SameOption) \
+    v(showDisassembly, dumpDisassembly, SameOption) \
+    v(showDFGDisassembly, dumpDFGDisassembly, SameOption) \
+    v(showFTLDisassembly, dumpFTLDisassembly, SameOption) \
+    v(showAllDFGNodes, dumpAllDFGNodes, SameOption) \
+    v(alwaysDoFullCollection, useGenerationalGC, InvertedOption) \
+    v(enableOSREntryToDFG, useOSREntryToDFG, SameOption) \
+    v(enableOSREntryToFTL, useOSREntryToFTL, SameOption) \
+    v(enableAccessInlining, useAccessInlining, SameOption) \
+    v(enablePolyvariantDevirtualization, usePolyvariantDevirtualization, SameOption) \
+    v(enablePolymorphicAccessInlining, usePolymorphicAccessInlining, SameOption) \
+    v(enablePolymorphicCallInlining, usePolymorphicCallInlining, SameOption) \
+    v(enableMovHintRemoval, useMovHintRemoval, SameOption) \
+    v(enableObjectAllocationSinking, useObjectAllocationSinking, SameOption) \
+    v(enableConcurrentJIT, useConcurrentJIT, SameOption) \
+    v(enableProfiler, useProfiler, SameOption) \
+    v(enableArchitectureSpecificOptimizations, useArchitectureSpecificOptimizations, SameOption) \
+    v(enablePolyvariantCallInlining, usePolyvariantCallInlining, SameOption) \
+    v(enablePolyvariantByIdInlining, usePolyvariantByIdInlining, SameOption) \
+    v(enableMaximalFlushInsertionPhase, useMaximalFlushInsertionPhase, SameOption) \
+    v(objectsAreImmortal, useImmortalObjects, SameOption) \
+    v(showObjectStatistics, dumpObjectStatistics, SameOption) \
+    v(disableGC, useGC, InvertedOption) \
+    v(enableTypeProfiler, useTypeProfiler, SameOption) \
+    v(enableControlFlowProfiler, useControlFlowProfiler, SameOption) \
+    v(enableExceptionFuzz, useExceptionFuzz, SameOption) \
+    v(enableExecutableAllocationFuzz, useExecutableAllocationFuzz, SameOption) \
+    v(enableOSRExitFuzz, useOSRExitFuzz, SameOption) \
+    v(enableDollarVM, useDollarVM, SameOption) \
+    v(enableWebAssembly, useWebAssembly, SameOption) \
+
+class Options {
+public:
+    enum class DumpLevel {
+        None = 0,
+        Overridden,
+        All,
+        Verbose
+    };
+
+    enum class Availability {
+        Normal = 0,
+        Restricted,
+        Configurable
+    };
+
+    // This typedef is to allow us to eliminate the '_' in the field name in
+    // union inside Entry. This is needed to keep the style checker happy.
+    typedef int32_t int32;
+
+    // Declare the option IDs:
+    enum ID {
+#define FOR_EACH_OPTION(type_, name_, defaultValue_, availability_, description_) \
+        name_##ID,
+        JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+        numberOfOptions
+    };
+
+    enum class Type {
+        boolType,
+        unsignedType,
+        doubleType,
+        int32Type,
+        optionRangeType,
+        optionStringType,
+        gcLogLevelType,
+    };
+
+    JS_EXPORT_PRIVATE static void initialize();
+
+    // Parses a string of options where each option is of the format "--<optionName>=<value>"
+    // and are separated by a space. The leading "--" is optional and will be ignored.
+    JS_EXPORT_PRIVATE static bool setOptions(const char* optionsList);
+
+    // Parses a single command line option in the format "<optionName>=<value>"
+    // (no spaces allowed) and set the specified option if appropriate.
+    JS_EXPORT_PRIVATE static bool setOption(const char* arg);
+
+    JS_EXPORT_PRIVATE static void dumpAllOptions(FILE*, DumpLevel, const char* title = nullptr);
+    JS_EXPORT_PRIVATE static void dumpAllOptionsInALine(StringBuilder&);
+
+    JS_EXPORT_PRIVATE static void ensureOptionsAreCoherent();
+
+    JS_EXPORT_PRIVATE static void enableRestrictedOptions(bool enableOrNot);
+
+    // Declare accessors for each option:
+#define FOR_EACH_OPTION(type_, name_, defaultValue_, availability_, description_) \
+    ALWAYS_INLINE static type_& name_() { return s_options[name_##ID].type_##Val; } \
+    ALWAYS_INLINE static type_& name_##Default() { return s_defaultOptions[name_##ID].type_##Val; }
+
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+
+    static bool isAvailable(ID, Availability);
+
+private:
+    // For storing for an option value:
+    union Entry {
+        bool boolVal;
+        unsigned unsignedVal;
+        double doubleVal;
+        int32 int32Val;
+        OptionRange optionRangeVal;
+        const char* optionStringVal;
+        GCLogging::Level gcLogLevelVal;
+    };
+
+    // For storing constant meta data about each option:
+    struct EntryInfo {
+        const char* name;
+        const char* description;
+        Type type;
+        Availability availability;
+    };
+
+    Options();
+
+    enum DumpDefaultsOption {
+        DontDumpDefaults,
+        DumpDefaults
+    };
+    static void dumpOptionsIfNeeded();
+    static void dumpAllOptions(StringBuilder&, DumpLevel, const char* title,
+        const char* separator, const char* optionHeader, const char* optionFooter, DumpDefaultsOption);
+    static void dumpOption(StringBuilder&, DumpLevel, ID,
+        const char* optionHeader, const char* optionFooter, DumpDefaultsOption);
+
+    static bool setOptionWithoutAlias(const char* arg);
+    static bool setAliasedOption(const char* arg);
+    static bool overrideAliasedOptionWithHeuristic(const char* name);
+
+    // Declare the singleton instance of the options store:
+    JS_EXPORTDATA static Entry s_options[numberOfOptions];
+    static Entry s_defaultOptions[numberOfOptions];
+    static const EntryInfo s_optionsInfo[numberOfOptions];
+
+    friend class Option;
+};
+
+class Option {
+public:
+    Option(Options::ID id)
+        : m_id(id)
+        , m_entry(Options::s_options[m_id])
+    {
+    }
+    
+    void dump(StringBuilder&) const;
+
+    bool operator==(const Option& other) const;
+    bool operator!=(const Option& other) const { return !(*this == other); }
+    
+    Options::ID id() const { return m_id; }
+    const char* name() const;
+    const char* description() const;
+    Options::Type type() const;
+    Options::Availability availability() const;
+    bool isOverridden() const;
+    const Option defaultOption() const;
+    
+    bool& boolVal();
+    unsigned& unsignedVal();
+    double& doubleVal();
+    int32_t& int32Val();
+    OptionRange optionRangeVal();
+    const char* optionStringVal();
+    GCLogging::Level& gcLogLevelVal();
+    
+private:
+    // Only used for constructing default Options.
+    Option(Options::ID id, Options::Entry& entry)
+        : m_id(id)
+        , m_entry(entry)
+    {
+    }
+    
+    Options::ID m_id;
+    Options::Entry& m_entry;
+};
+
+inline const char* Option::name() const
+{
+    return Options::s_optionsInfo[m_id].name;
+}
+
+inline const char* Option::description() const
+{
+    return Options::s_optionsInfo[m_id].description;
+}
+
+inline Options::Type Option::type() const
+{
+    return Options::s_optionsInfo[m_id].type;
+}
+
+inline Options::Availability Option::availability() const
+{
+    return Options::s_optionsInfo[m_id].availability;
+}
+
+inline bool Option::isOverridden() const
+{
+    return *this != defaultOption();
+}
+
+inline const Option Option::defaultOption() const
+{
+    return Option(m_id, Options::s_defaultOptions[m_id]);
+}
+
+inline bool& Option::boolVal()
+{
+    return m_entry.boolVal;
+}
+
+inline unsigned& Option::unsignedVal()
+{
+    return m_entry.unsignedVal;
+}
+
+inline double& Option::doubleVal()
+{
+    return m_entry.doubleVal;
+}
+
+inline int32_t& Option::int32Val()
+{
+    return m_entry.int32Val;
+}
+
+inline OptionRange Option::optionRangeVal()
+{
+    return m_entry.optionRangeVal;
+}
+
+inline const char* Option::optionStringVal()
+{
+    return m_entry.optionStringVal;
+}
+
+inline GCLogging::Level& Option::gcLogLevelVal()
+{
+    return m_entry.gcLogLevelVal;
+}
+
+} // namespace JSC
diff --git a/runtime/PrivateName.h b/runtime/PrivateName.h
new file mode 100644
index 0000000..4b86dec
--- /dev/null
+++ b/runtime/PrivateName.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/text/SymbolImpl.h>
+
+namespace JSC {
+
+class PrivateName {
+public:
+    PrivateName()
+        : m_uid(SymbolImpl::createNullSymbol())
+    {
+    }
+
+    explicit PrivateName(SymbolImpl& uid)
+        : m_uid(uid)
+    {
+    }
+
+    enum DescriptionTag { Description };
+    explicit PrivateName(DescriptionTag, const String& description)
+        : m_uid(SymbolImpl::create(*description.impl()))
+    {
+    }
+
+    PrivateName(const PrivateName& privateName)
+        : m_uid(privateName.m_uid.copyRef())
+    {
+    }
+
+    PrivateName(PrivateName&&) = default;
+
+    SymbolImpl& uid() const { return const_cast<SymbolImpl&>(m_uid.get()); }
+
+    bool operator==(const PrivateName& other) const { return &uid() == &other.uid(); }
+    bool operator!=(const PrivateName& other) const { return &uid() != &other.uid(); }
+
+private:
+    Ref<SymbolImpl> m_uid;
+};
+
+} // namespace JSC
diff --git a/runtime/ProgramExecutable.cpp b/runtime/ProgramExecutable.cpp
new file mode 100644
index 0000000..6a4f94a
--- /dev/null
+++ b/runtime/ProgramExecutable.cpp
@@ -0,0 +1,211 @@
+/*
+ * Copyright (C) 2009, 2010, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "BatchedTransitionOptimizer.h"
+#include "CodeBlock.h"
+#include "CodeCache.h"
+#include "Debugger.h"
+#include "Exception.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "LLIntEntrypoint.h"
+#include "Parser.h"
+#include "ProgramCodeBlock.h"
+#include "TypeProfiler.h"
+#include "VMInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+const ClassInfo ProgramExecutable::s_info = { "ProgramExecutable", &ScriptExecutable::s_info, 0, CREATE_METHOD_TABLE(ProgramExecutable) };
+
+ProgramExecutable::ProgramExecutable(ExecState* exec, const SourceCode& source)
+    : ScriptExecutable(exec->vm().programExecutableStructure.get(), exec->vm(), source, false, DerivedContextType::None, false, EvalContextType::None, NoIntrinsic)
+{
+    ASSERT(source.provider()->sourceType() == SourceProviderSourceType::Program);
+    m_typeProfilingStartOffset = 0;
+    m_typeProfilingEndOffset = source.length() - 1;
+    if (exec->vm().typeProfiler() || exec->vm().controlFlowProfiler())
+        exec->vm().functionHasExecutedCache()->insertUnexecutedRange(sourceID(), m_typeProfilingStartOffset, m_typeProfilingEndOffset);
+}
+
+void ProgramExecutable::destroy(JSCell* cell)
+{
+    static_cast<ProgramExecutable*>(cell)->ProgramExecutable::~ProgramExecutable();
+}
+
+JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
+{
+    ParserError error;
+    VM* vm = &exec->vm();
+    JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
+    std::unique_ptr<ProgramNode> programNode = parse<ProgramNode>(
+        vm, m_source, Identifier(), JSParserBuiltinMode::NotBuiltin,
+        JSParserStrictMode::NotStrict, JSParserScriptMode::Classic, SourceParseMode::ProgramMode, SuperBinding::NotNeeded, error);
+    if (programNode)
+        return 0;
+    ASSERT(error.isValid());
+    return error.toErrorObject(lexicalGlobalObject, m_source);
+}
+
+JSObject* ProgramExecutable::initializeGlobalProperties(VM& vm, CallFrame* callFrame, JSScope* scope)
+{
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    RELEASE_ASSERT(scope);
+    JSGlobalObject* globalObject = scope->globalObject();
+    RELEASE_ASSERT(globalObject);
+    ASSERT(&globalObject->vm() == &vm);
+
+    ParserError error;
+    JSParserStrictMode strictMode = isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
+    DebuggerMode debuggerMode = globalObject->hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
+
+    UnlinkedProgramCodeBlock* unlinkedCodeBlock = vm.codeCache()->getUnlinkedProgramCodeBlock(
+        vm, this, source(), strictMode, debuggerMode, error);
+
+    if (globalObject->hasDebugger())
+        globalObject->debugger()->sourceParsed(callFrame, source().provider(), error.line(), error.message());
+
+    if (error.isValid())
+        return error.toErrorObject(globalObject, source());
+
+    JSValue nextPrototype = globalObject->getPrototypeDirect();
+    while (nextPrototype && nextPrototype.isObject()) {
+        if (UNLIKELY(asObject(nextPrototype)->type() == ProxyObjectType)) {
+            ExecState* exec = globalObject->globalExec();
+            return createTypeError(exec, ASCIILiteral("Proxy is not allowed in the global prototype chain."));
+        }
+        nextPrototype = asObject(nextPrototype)->getPrototypeDirect();
+    }
+    
+    JSGlobalLexicalEnvironment* globalLexicalEnvironment = globalObject->globalLexicalEnvironment();
+    const VariableEnvironment& variableDeclarations = unlinkedCodeBlock->variableDeclarations();
+    const VariableEnvironment& lexicalDeclarations = unlinkedCodeBlock->lexicalDeclarations();
+    // The ES6 spec says that no vars/global properties/let/const can be duplicated in the global scope.
+    // This carried out section 15.1.8 of the ES6 spec: http://www.ecma-international.org/ecma-262/6.0/index.html#sec-globaldeclarationinstantiation
+    {
+        ExecState* exec = globalObject->globalExec();
+        // Check for intersection of "var" and "let"/"const"/"class"
+        for (auto& entry : lexicalDeclarations) {
+            if (variableDeclarations.contains(entry.key))
+                return createSyntaxError(exec, makeString("Can't create duplicate variable: '", String(entry.key.get()), "'"));
+        }
+
+        // Check if any new "let"/"const"/"class" will shadow any pre-existing global property names, or "var"/"let"/"const" variables.
+        // It's an error to introduce a shadow.
+        for (auto& entry : lexicalDeclarations) {
+            bool hasProperty = globalObject->hasProperty(exec, entry.key.get());
+            RETURN_IF_EXCEPTION(throwScope, throwScope.exception());
+            if (hasProperty) {
+                // The ES6 spec says that just RestrictedGlobalProperty can't be shadowed
+                // This carried out section 8.1.1.4.14 of the ES6 spec: http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasrestrictedglobalproperty
+                PropertyDescriptor descriptor;
+                globalObject->getOwnPropertyDescriptor(exec, entry.key.get(), descriptor);
+                
+                if (descriptor.value() != jsUndefined() && !descriptor.configurable())
+                    return createSyntaxError(exec, makeString("Can't create duplicate variable that shadows a global property: '", String(entry.key.get()), "'"));
+            }
+
+            hasProperty = globalLexicalEnvironment->hasProperty(exec, entry.key.get());
+            RETURN_IF_EXCEPTION(throwScope, throwScope.exception());
+            if (hasProperty) {
+                if (UNLIKELY(entry.value.isConst() && !vm.globalConstRedeclarationShouldThrow() && !isStrictMode())) {
+                    // We only allow "const" duplicate declarations under this setting.
+                    // For example, we don't "let" variables to be overridden by "const" variables.
+                    if (globalLexicalEnvironment->isConstVariable(entry.key.get()))
+                        continue;
+                }
+                return createSyntaxError(exec, makeString("Can't create duplicate variable: '", String(entry.key.get()), "'"));
+            }
+        }
+
+        // Check if any new "var"s will shadow any previous "let"/"const"/"class" names.
+        // It's an error to introduce a shadow.
+        if (!globalLexicalEnvironment->isEmpty()) {
+            for (auto& entry : variableDeclarations) {
+                bool hasProperty = globalLexicalEnvironment->hasProperty(exec, entry.key.get());
+                RETURN_IF_EXCEPTION(throwScope, throwScope.exception());
+                if (hasProperty)
+                    return createSyntaxError(exec, makeString("Can't create duplicate variable: '", String(entry.key.get()), "'"));
+            }
+        }
+    }
+
+
+    m_unlinkedProgramCodeBlock.set(vm, this, unlinkedCodeBlock);
+
+    BatchedTransitionOptimizer optimizer(vm, globalObject);
+
+    for (size_t i = 0, numberOfFunctions = unlinkedCodeBlock->numberOfFunctionDecls(); i < numberOfFunctions; ++i) {
+        UnlinkedFunctionExecutable* unlinkedFunctionExecutable = unlinkedCodeBlock->functionDecl(i);
+        ASSERT(!unlinkedFunctionExecutable->name().isEmpty());
+        globalObject->addFunction(callFrame, unlinkedFunctionExecutable->name());
+        if (vm.typeProfiler() || vm.controlFlowProfiler()) {
+            vm.functionHasExecutedCache()->insertUnexecutedRange(sourceID(), 
+                unlinkedFunctionExecutable->typeProfilingStartOffset(), 
+                unlinkedFunctionExecutable->typeProfilingEndOffset());
+        }
+    }
+
+    for (auto& entry : variableDeclarations) {
+        ASSERT(entry.value.isVar());
+        globalObject->addVar(callFrame, Identifier::fromUid(&vm, entry.key.get()));
+        ASSERT(!throwScope.exception());
+    }
+
+    {
+        JSGlobalLexicalEnvironment* globalLexicalEnvironment = jsCast<JSGlobalLexicalEnvironment*>(globalObject->globalScope());
+        SymbolTable* symbolTable = globalLexicalEnvironment->symbolTable();
+        ConcurrentJSLocker locker(symbolTable->m_lock);
+        for (auto& entry : lexicalDeclarations) {
+            if (UNLIKELY(entry.value.isConst() && !vm.globalConstRedeclarationShouldThrow() && !isStrictMode())) {
+                if (symbolTable->contains(locker, entry.key.get()))
+                    continue;
+            }
+            ScopeOffset offset = symbolTable->takeNextScopeOffset(locker);
+            SymbolTableEntry newEntry(VarOffset(offset), entry.value.isConst() ? ReadOnly : 0);
+            newEntry.prepareToWatch();
+            symbolTable->add(locker, entry.key.get(), newEntry);
+            
+            ScopeOffset offsetForAssert = globalLexicalEnvironment->addVariables(1, jsTDZValue());
+            RELEASE_ASSERT(offsetForAssert == offset);
+        }
+    }
+    return nullptr;
+}
+
+void ProgramExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    ProgramExecutable* thisObject = jsCast<ProgramExecutable*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    ScriptExecutable::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_unlinkedProgramCodeBlock);
+    if (ProgramCodeBlock* programCodeBlock = thisObject->m_programCodeBlock.get())
+        programCodeBlock->visitWeakly(visitor);
+}
+
+} // namespace JSC
diff --git a/runtime/ProgramExecutable.h b/runtime/ProgramExecutable.h
new file mode 100644
index 0000000..85ec4b5
--- /dev/null
+++ b/runtime/ProgramExecutable.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009, 2010, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ScriptExecutable.h"
+
+namespace JSC {
+
+class ProgramExecutable final : public ScriptExecutable {
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef ScriptExecutable Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static ProgramExecutable* create(ExecState* exec, const SourceCode& source)
+    {
+        ProgramExecutable* executable = new (NotNull, allocateCell<ProgramExecutable>(*exec->heap())) ProgramExecutable(exec, source);
+        executable->finishCreation(exec->vm());
+        return executable;
+    }
+
+    JSObject* initializeGlobalProperties(VM&, CallFrame*, JSScope*);
+
+    static void destroy(JSCell*);
+
+    ProgramCodeBlock* codeBlock()
+    {
+        return m_programCodeBlock.get();
+    }
+
+    JSObject* checkSyntax(ExecState*);
+
+    PassRefPtr<JITCode> generatedJITCode()
+    {
+        return generatedJITCodeForCall();
+    }
+        
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(vm, globalObject, proto, TypeInfo(ProgramExecutableType, StructureFlags), info());
+    }
+        
+    DECLARE_INFO;
+
+    ExecutableInfo executableInfo() const { return ExecutableInfo(usesEval(), isStrictMode(), false, false, ConstructorKind::None, JSParserScriptMode::Classic, SuperBinding::NotNeeded, SourceParseMode::ProgramMode, derivedContextType(), isArrowFunctionContext(), false, EvalContextType::None); }
+
+private:
+    friend class ExecutableBase;
+    friend class ScriptExecutable;
+
+    ProgramExecutable(ExecState*, const SourceCode&);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<UnlinkedProgramCodeBlock> m_unlinkedProgramCodeBlock;
+    WriteBarrier<ProgramCodeBlock> m_programCodeBlock;
+};
+
+} // namespace JSC
diff --git a/runtime/PropertyDescriptor.cpp b/runtime/PropertyDescriptor.cpp
new file mode 100644
index 0000000..16a3ffb
--- /dev/null
+++ b/runtime/PropertyDescriptor.cpp
@@ -0,0 +1,237 @@
+/*
+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+
+#include "PropertyDescriptor.h"
+
+#include "GetterSetter.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+unsigned PropertyDescriptor::defaultAttributes = DontDelete | DontEnum | ReadOnly;
+
+bool PropertyDescriptor::writable() const
+{
+    ASSERT(!isAccessorDescriptor());
+    return !(m_attributes & ReadOnly);
+}
+
+bool PropertyDescriptor::enumerable() const
+{
+    return !(m_attributes & DontEnum);
+}
+
+bool PropertyDescriptor::configurable() const
+{
+    return !(m_attributes & DontDelete);
+}
+
+bool PropertyDescriptor::isDataDescriptor() const
+{
+    return m_value || (m_seenAttributes & WritablePresent);
+}
+
+bool PropertyDescriptor::isGenericDescriptor() const
+{
+    return !isAccessorDescriptor() && !isDataDescriptor();
+}
+
+bool PropertyDescriptor::isAccessorDescriptor() const
+{
+    return m_getter || m_setter;
+}
+
+void PropertyDescriptor::setUndefined()
+{
+    m_value = jsUndefined();
+    m_attributes = ReadOnly | DontDelete | DontEnum;
+}
+
+GetterSetter* PropertyDescriptor::slowGetterSetter(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    GetterSetter* getterSetter = GetterSetter::create(vm, globalObject);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    if (m_getter && !m_getter.isUndefined())
+        getterSetter->setGetter(vm, globalObject, jsCast<JSObject*>(m_getter));
+    if (m_setter && !m_setter.isUndefined())
+        getterSetter->setSetter(vm, globalObject, jsCast<JSObject*>(m_setter));
+
+    return getterSetter;
+}
+
+JSValue PropertyDescriptor::getter() const
+{
+    ASSERT(isAccessorDescriptor());
+    return m_getter;
+}
+
+JSValue PropertyDescriptor::setter() const
+{
+    ASSERT(isAccessorDescriptor());
+    return m_setter;
+}
+
+JSObject* PropertyDescriptor::getterObject() const
+{
+    ASSERT(isAccessorDescriptor() && getterPresent());
+    return m_getter.isObject() ? asObject(m_getter) : 0;
+}
+
+JSObject* PropertyDescriptor::setterObject() const
+{
+    ASSERT(isAccessorDescriptor() && setterPresent());
+    return m_setter.isObject() ? asObject(m_setter) : 0;
+}
+
+void PropertyDescriptor::setDescriptor(JSValue value, unsigned attributes)
+{
+    ASSERT(value);
+
+    m_attributes = attributes;
+    if (value.isGetterSetter()) {
+        m_attributes &= ~ReadOnly; // FIXME: we should be able to ASSERT this!
+
+        GetterSetter* accessor = asGetterSetter(value);
+        m_getter = !accessor->isGetterNull() ? accessor->getter() : jsUndefined();
+        m_setter = !accessor->isSetterNull() ? accessor->setter() : jsUndefined();
+        m_seenAttributes = EnumerablePresent | ConfigurablePresent;
+    } else {
+        m_value = value;
+        m_seenAttributes = EnumerablePresent | ConfigurablePresent | WritablePresent;
+    }
+}
+
+void PropertyDescriptor::setCustomDescriptor(unsigned attributes)
+{
+    m_attributes = attributes | Accessor | CustomAccessor;
+    m_attributes &= ~ReadOnly;
+    m_seenAttributes = EnumerablePresent | ConfigurablePresent;
+    setGetter(jsUndefined());
+    setSetter(jsUndefined());
+    m_value = JSValue();
+}
+
+void PropertyDescriptor::setAccessorDescriptor(GetterSetter* accessor, unsigned attributes)
+{
+    ASSERT(attributes & Accessor);
+    attributes &= ~ReadOnly; // FIXME: we should be able to ASSERT this!
+
+    m_attributes = attributes;
+    m_getter = !accessor->isGetterNull() ? accessor->getter() : jsUndefined();
+    m_setter = !accessor->isSetterNull() ? accessor->setter() : jsUndefined();
+    m_seenAttributes = EnumerablePresent | ConfigurablePresent;
+}
+
+void PropertyDescriptor::setWritable(bool writable)
+{
+    if (writable)
+        m_attributes &= ~ReadOnly;
+    else
+        m_attributes |= ReadOnly;
+    m_seenAttributes |= WritablePresent;
+}
+
+void PropertyDescriptor::setEnumerable(bool enumerable)
+{
+    if (enumerable)
+        m_attributes &= ~DontEnum;
+    else
+        m_attributes |= DontEnum;
+    m_seenAttributes |= EnumerablePresent;
+}
+
+void PropertyDescriptor::setConfigurable(bool configurable)
+{
+    if (configurable)
+        m_attributes &= ~DontDelete;
+    else
+        m_attributes |= DontDelete;
+    m_seenAttributes |= ConfigurablePresent;
+}
+
+void PropertyDescriptor::setSetter(JSValue setter)
+{
+    m_setter = setter;
+    m_attributes |= Accessor;
+    m_attributes &= ~ReadOnly;
+}
+
+void PropertyDescriptor::setGetter(JSValue getter)
+{
+    m_getter = getter;
+    m_attributes |= Accessor;
+    m_attributes &= ~ReadOnly;
+}
+
+bool PropertyDescriptor::equalTo(ExecState* exec, const PropertyDescriptor& other) const
+{
+    if (other.m_value.isEmpty() != m_value.isEmpty()
+        || other.m_getter.isEmpty() != m_getter.isEmpty()
+        || other.m_setter.isEmpty() != m_setter.isEmpty())
+        return false;
+    return (!m_value || sameValue(exec, other.m_value, m_value))
+        && (!m_getter || JSValue::strictEqual(exec, other.m_getter, m_getter))
+        && (!m_setter || JSValue::strictEqual(exec, other.m_setter, m_setter))
+        && attributesEqual(other);
+}
+
+bool PropertyDescriptor::attributesEqual(const PropertyDescriptor& other) const
+{
+    unsigned mismatch = other.m_attributes ^ m_attributes;
+    unsigned sharedSeen = other.m_seenAttributes & m_seenAttributes;
+    if (sharedSeen & WritablePresent && mismatch & ReadOnly)
+        return false;
+    if (sharedSeen & ConfigurablePresent && mismatch & DontDelete)
+        return false;
+    if (sharedSeen & EnumerablePresent && mismatch & DontEnum)
+        return false;
+    return true;
+}
+
+unsigned PropertyDescriptor::attributesOverridingCurrent(const PropertyDescriptor& current) const
+{
+    unsigned currentAttributes = current.m_attributes;
+    if (isDataDescriptor() && current.isAccessorDescriptor())
+        currentAttributes |= ReadOnly;
+    unsigned overrideMask = 0;
+    if (writablePresent())
+        overrideMask |= ReadOnly;
+    if (enumerablePresent())
+        overrideMask |= DontEnum;
+    if (configurablePresent())
+        overrideMask |= DontDelete;
+    if (isAccessorDescriptor())
+        overrideMask |= Accessor;
+    return (m_attributes & overrideMask) | (currentAttributes & ~overrideMask & ~CustomAccessor);
+}
+
+}
diff --git a/runtime/PropertyDescriptor.h b/runtime/PropertyDescriptor.h
new file mode 100644
index 0000000..eb461d3
--- /dev/null
+++ b/runtime/PropertyDescriptor.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DefinePropertyAttributes.h"
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+class GetterSetter;
+
+class PropertyDescriptor {
+public:
+    PropertyDescriptor()
+        : m_attributes(defaultAttributes)
+        , m_seenAttributes(0)
+    {
+    }
+    PropertyDescriptor(JSValue value, unsigned attributes)
+        : m_value(value)
+        , m_attributes(attributes)
+        , m_seenAttributes(EnumerablePresent | ConfigurablePresent | WritablePresent)
+    {
+        ASSERT(m_value);
+        ASSERT(!m_value.isGetterSetter());
+        ASSERT(!m_value.isCustomGetterSetter());
+    }
+    JS_EXPORT_PRIVATE bool writable() const;
+    JS_EXPORT_PRIVATE bool enumerable() const;
+    JS_EXPORT_PRIVATE bool configurable() const;
+    JS_EXPORT_PRIVATE bool isDataDescriptor() const;
+    bool isGenericDescriptor() const;
+    JS_EXPORT_PRIVATE bool isAccessorDescriptor() const;
+    unsigned attributes() const { return m_attributes; }
+    JSValue value() const { return m_value; }
+    GetterSetter* slowGetterSetter(ExecState*); // Be aware that this will lazily allocate a GetterSetter object. It's much better to use getter() and setter() individually if possible.
+    JS_EXPORT_PRIVATE JSValue getter() const;
+    JS_EXPORT_PRIVATE JSValue setter() const;
+    JSObject* getterObject() const;
+    JSObject* setterObject() const;
+    JS_EXPORT_PRIVATE void setUndefined();
+    JS_EXPORT_PRIVATE void setDescriptor(JSValue, unsigned attributes);
+    JS_EXPORT_PRIVATE void setCustomDescriptor(unsigned attributes);
+    JS_EXPORT_PRIVATE void setAccessorDescriptor(GetterSetter* accessor, unsigned attributes);
+    JS_EXPORT_PRIVATE void setWritable(bool);
+    JS_EXPORT_PRIVATE void setEnumerable(bool);
+    JS_EXPORT_PRIVATE void setConfigurable(bool);
+    void setValue(JSValue value) { m_value = value; }
+    JS_EXPORT_PRIVATE void setSetter(JSValue);
+    JS_EXPORT_PRIVATE void setGetter(JSValue);
+    bool isEmpty() const { return !(m_value || m_getter || m_setter || m_seenAttributes); }
+    bool writablePresent() const { return m_seenAttributes & WritablePresent; }
+    bool enumerablePresent() const { return m_seenAttributes & EnumerablePresent; }
+    bool configurablePresent() const { return m_seenAttributes & ConfigurablePresent; }
+    bool setterPresent() const { return !!m_setter; }
+    bool getterPresent() const { return !!m_getter; }
+    bool equalTo(ExecState*, const PropertyDescriptor& other) const;
+    bool attributesEqual(const PropertyDescriptor& other) const;
+    unsigned attributesOverridingCurrent(const PropertyDescriptor& current) const;
+
+private:
+    JS_EXPORTDATA static unsigned defaultAttributes;
+    bool operator==(const PropertyDescriptor&) { return false; }
+    enum { WritablePresent = 1, EnumerablePresent = 2, ConfigurablePresent = 4};
+    // May be a getter/setter
+    JSValue m_value;
+    JSValue m_getter;
+    JSValue m_setter;
+    unsigned m_attributes;
+    unsigned m_seenAttributes;
+};
+
+inline PropertyDescriptor toPropertyDescriptor(JSValue value, JSValue getter, JSValue setter, DefinePropertyAttributes attributes)
+{
+    // We assume that validation is already done.
+    PropertyDescriptor desc;
+
+    if (std::optional<bool> enumerable = attributes.enumerable())
+        desc.setEnumerable(enumerable.value());
+
+    if (std::optional<bool> configurable = attributes.configurable())
+        desc.setConfigurable(configurable.value());
+
+    if (attributes.hasValue())
+        desc.setValue(value);
+
+    if (std::optional<bool> writable = attributes.writable())
+        desc.setWritable(writable.value());
+
+    if (attributes.hasGet())
+        desc.setGetter(getter);
+
+    if (attributes.hasSet())
+        desc.setSetter(setter);
+
+    return desc;
+}
+
+}
diff --git a/runtime/PropertyMapHashTable.h b/runtime/PropertyMapHashTable.h
new file mode 100644
index 0000000..5f85ce4
--- /dev/null
+++ b/runtime/PropertyMapHashTable.h
@@ -0,0 +1,560 @@
+/*
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2014 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "JSExportMacros.h"
+#include "PropertyOffset.h"
+#include "Structure.h"
+#include "WriteBarrier.h"
+#include <wtf/HashTable.h>
+#include <wtf/MathExtras.h>
+#include <wtf/Vector.h>
+#include <wtf/text/AtomicStringImpl.h>
+
+
+#define DUMP_PROPERTYMAP_STATS 0
+#define DUMP_PROPERTYMAP_COLLISIONS 0
+
+#define PROPERTY_MAP_DELETED_ENTRY_KEY ((UniquedStringImpl*)1)
+
+namespace JSC {
+
+#if DUMP_PROPERTYMAP_STATS
+
+struct PropertyMapHashTableStats {
+    std::atomic<unsigned> numFinds;
+    std::atomic<unsigned> numCollisions;
+    std::atomic<unsigned> numLookups;
+    std::atomic<unsigned> numLookupProbing;
+    std::atomic<unsigned> numAdds;
+    std::atomic<unsigned> numRemoves;
+    std::atomic<unsigned> numRehashes;
+    std::atomic<unsigned> numReinserts;
+};
+
+JS_EXPORTDATA extern PropertyMapHashTableStats* propertyMapHashTableStats;
+
+#endif
+
+inline bool isPowerOf2(unsigned v)
+{
+    return hasOneBitSet(v);
+}
+
+inline unsigned nextPowerOf2(unsigned v)
+{
+    // Taken from http://www.cs.utk.edu/~vose/c-stuff/bithacks.html
+    // Devised by Sean Anderson, Sepember 14, 2001
+
+    v--;
+    v |= v >> 1;
+    v |= v >> 2;
+    v |= v >> 4;
+    v |= v >> 8;
+    v |= v >> 16;
+    v++;
+
+    return v;
+}
+
+class PropertyTable final : public JSCell {
+
+    // This is the implementation for 'iterator' and 'const_iterator',
+    // used for iterating over the table in insertion order.
+    template<typename T>
+    class ordered_iterator {
+    public:
+        ordered_iterator<T>& operator++()
+        {
+            m_valuePtr = skipDeletedEntries(m_valuePtr + 1);
+            return *this;
+        }
+
+        bool operator==(const ordered_iterator<T>& other)
+        {
+            return m_valuePtr == other.m_valuePtr;
+        }
+
+        bool operator!=(const ordered_iterator<T>& other)
+        {
+            return m_valuePtr != other.m_valuePtr;
+        }
+
+        T& operator*()
+        {
+            return *m_valuePtr;
+        }
+
+        T* operator->()
+        {
+            return m_valuePtr;
+        }
+
+        ordered_iterator(T* valuePtr)
+            : m_valuePtr(valuePtr)
+        {
+        }
+
+    private:
+        T* m_valuePtr;
+    };
+
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    typedef UniquedStringImpl* KeyType;
+    typedef PropertyMapEntry ValueType;
+
+    // The in order iterator provides overloaded * and -> to access the Value at the current position.
+    typedef ordered_iterator<ValueType> iterator;
+    typedef ordered_iterator<const ValueType> const_iterator;
+
+    // The find_iterator is a pair of a pointer to a Value* an the entry in the index.
+    // If 'find' does not find an entry then iter.first will be 0, and iter.second will
+    // give the point in m_index where an entry should be inserted.
+    typedef std::pair<ValueType*, unsigned> find_iterator;
+
+    // Constructor is passed an initial capacity, a PropertyTable to copy, or both.
+    static PropertyTable* create(VM&, unsigned initialCapacity);
+    static PropertyTable* clone(VM&, const PropertyTable&);
+    static PropertyTable* clone(VM&, unsigned initialCapacity, const PropertyTable&);
+    ~PropertyTable();
+
+    // Ordered iteration methods.
+    iterator begin();
+    iterator end();
+    const_iterator begin() const;
+    const_iterator end() const;
+
+    // Find a value in the table.
+    find_iterator find(const KeyType&);
+    ValueType* get(const KeyType&);
+    // Add a value to the table
+    enum EffectOnPropertyOffset { PropertyOffsetMayChange, PropertyOffsetMustNotChange };
+    std::pair<find_iterator, bool> add(const ValueType& entry, PropertyOffset&, EffectOnPropertyOffset);
+    // Remove a value from the table.
+    void remove(const find_iterator& iter);
+    void remove(const KeyType& key);
+
+    // Returns the number of values in the hashtable.
+    unsigned size() const;
+
+    // Checks if there are any values in the hashtable.
+    bool isEmpty() const;
+
+    // Number of slots in the property storage array in use, included deletedOffsets.
+    unsigned propertyStorageSize() const;
+
+    // Used to maintain a list of unused entries in the property storage.
+    void clearDeletedOffsets();
+    bool hasDeletedOffset();
+    PropertyOffset getDeletedOffset();
+    void addDeletedOffset(PropertyOffset);
+    
+    PropertyOffset nextOffset(PropertyOffset inlineCapacity);
+
+    // Copy this PropertyTable, ensuring the copy has at least the capacity provided.
+    PropertyTable* copy(VM&, unsigned newCapacity);
+
+#ifndef NDEBUG
+    size_t sizeInMemory();
+    void checkConsistency();
+#endif
+    
+    static ptrdiff_t offsetOfIndexSize() { return OBJECT_OFFSETOF(PropertyTable, m_indexSize); }
+    static ptrdiff_t offsetOfIndexMask() { return OBJECT_OFFSETOF(PropertyTable, m_indexMask); }
+    static ptrdiff_t offsetOfIndex() { return OBJECT_OFFSETOF(PropertyTable, m_index); }
+
+    static const unsigned EmptyEntryIndex = 0;
+
+private:
+    PropertyTable(VM&, unsigned initialCapacity);
+    PropertyTable(VM&, const PropertyTable&);
+    PropertyTable(VM&, unsigned initialCapacity, const PropertyTable&);
+
+    PropertyTable(const PropertyTable&);
+    // Used to insert a value known not to be in the table, and where we know capacity to be available.
+    void reinsert(const ValueType& entry);
+
+    // Rehash the table.  Used to grow, or to recover deleted slots.
+    void rehash(unsigned newCapacity);
+
+    // The capacity of the table of values is half of the size of the index.
+    unsigned tableCapacity() const;
+
+    // We keep an extra deleted slot after the array to make iteration work,
+    // and to use for deleted values. Index values into the array are 1-based,
+    // so this is tableCapacity() + 1.
+    // For example, if m_tableSize is 16, then tableCapacity() is 8 - but the
+    // values array is actually 9 long (the 9th used for the deleted value/
+    // iteration guard).  The 8 valid entries are numbered 1..8, so the
+    // deleted index is 9 (0 being reserved for empty).
+    unsigned deletedEntryIndex() const;
+
+    // Used in iterator creation/progression.
+    template<typename T>
+    static T* skipDeletedEntries(T* valuePtr);
+
+    // The table of values lies after the hash index.
+    ValueType* table();
+    const ValueType* table() const;
+
+    // total number of  used entries in the values array - by either valid entries, or deleted ones.
+    unsigned usedCount() const;
+
+    // The size in bytes of data needed for by the table.
+    size_t dataSize();
+
+    // Calculates the appropriate table size (rounds up to a power of two).
+    static unsigned sizeForCapacity(unsigned capacity);
+
+    // Check if capacity is available.
+    bool canInsert();
+
+    unsigned m_indexSize;
+    unsigned m_indexMask;
+    unsigned* m_index;
+    unsigned m_keyCount;
+    unsigned m_deletedCount;
+    std::unique_ptr<Vector<PropertyOffset>> m_deletedOffsets;
+
+    static const unsigned MinimumTableSize = 16;
+};
+
+inline PropertyTable::iterator PropertyTable::begin()
+{
+    return iterator(skipDeletedEntries(table()));
+}
+
+inline PropertyTable::iterator PropertyTable::end()
+{
+    return iterator(table() + usedCount());
+}
+
+inline PropertyTable::const_iterator PropertyTable::begin() const
+{
+    return const_iterator(skipDeletedEntries(table()));
+}
+
+inline PropertyTable::const_iterator PropertyTable::end() const
+{
+    return const_iterator(table() + usedCount());
+}
+
+inline PropertyTable::find_iterator PropertyTable::find(const KeyType& key)
+{
+    ASSERT(key);
+    ASSERT(key->isAtomic() || key->isSymbol());
+    unsigned hash = IdentifierRepHash::hash(key);
+
+#if DUMP_PROPERTYMAP_STATS
+    ++propertyMapHashTableStats->numFinds;
+#endif
+
+    while (true) {
+        unsigned entryIndex = m_index[hash & m_indexMask];
+        if (entryIndex == EmptyEntryIndex)
+            return std::make_pair((ValueType*)0, hash & m_indexMask);
+        if (key == table()[entryIndex - 1].key)
+            return std::make_pair(&table()[entryIndex - 1], hash & m_indexMask);
+
+#if DUMP_PROPERTYMAP_STATS
+        ++propertyMapHashTableStats->numCollisions;
+#endif
+
+#if DUMP_PROPERTYMAP_COLLISIONS
+        dataLog("PropertyTable collision for ", key, " (", hash, ")\n");
+        dataLog("Collided with ", table()[entryIndex - 1].key, "(", IdentifierRepHash::hash(table()[entryIndex - 1].key), ")\n");
+#endif
+
+        hash++;
+    }
+}
+
+inline PropertyTable::ValueType* PropertyTable::get(const KeyType& key)
+{
+    ASSERT(key);
+    ASSERT(key->isAtomic() || key->isSymbol());
+
+    if (!m_keyCount)
+        return nullptr;
+
+    unsigned hash = IdentifierRepHash::hash(key);
+
+#if DUMP_PROPERTYMAP_STATS
+    ++propertyMapHashTableStats->numLookups;
+#endif
+
+    while (true) {
+        unsigned entryIndex = m_index[hash & m_indexMask];
+        if (entryIndex == EmptyEntryIndex)
+            return nullptr;
+        if (key == table()[entryIndex - 1].key)
+            return &table()[entryIndex - 1];
+
+#if DUMP_PROPERTYMAP_STATS
+        ++propertyMapHashTableStats->numLookupProbing;
+#endif
+
+        hash++;
+    }
+}
+
+inline std::pair<PropertyTable::find_iterator, bool> PropertyTable::add(const ValueType& entry, PropertyOffset& offset, EffectOnPropertyOffset offsetEffect)
+{
+    // Look for a value with a matching key already in the array.
+    find_iterator iter = find(entry.key);
+    if (iter.first) {
+        RELEASE_ASSERT(iter.first->offset <= offset);
+        return std::make_pair(iter, false);
+    }
+
+#if DUMP_PROPERTYMAP_STATS
+    ++propertyMapHashTableStats->numAdds;
+#endif
+
+    // Ref the key
+    entry.key->ref();
+
+    // ensure capacity is available.
+    if (!canInsert()) {
+        rehash(m_keyCount + 1);
+        iter = find(entry.key);
+        ASSERT(!iter.first);
+    }
+
+    // Allocate a slot in the hashtable, and set the index to reference this.
+    unsigned entryIndex = usedCount() + 1;
+    m_index[iter.second] = entryIndex;
+    iter.first = &table()[entryIndex - 1];
+    *iter.first = entry;
+
+    ++m_keyCount;
+    
+    if (offsetEffect == PropertyOffsetMayChange)
+        offset = std::max(offset, entry.offset);
+    else
+        RELEASE_ASSERT(offset >= entry.offset);
+    
+    return std::make_pair(iter, true);
+}
+
+inline void PropertyTable::remove(const find_iterator& iter)
+{
+    // Removing a key that doesn't exist does nothing!
+    if (!iter.first)
+        return;
+
+#if DUMP_PROPERTYMAP_STATS
+    ++propertyMapHashTableStats->numRemoves;
+#endif
+
+    // Replace this one element with the deleted sentinel. Also clear out
+    // the entry so we can iterate all the entries as needed.
+    m_index[iter.second] = deletedEntryIndex();
+    iter.first->key->deref();
+    iter.first->key = PROPERTY_MAP_DELETED_ENTRY_KEY;
+
+    ASSERT(m_keyCount >= 1);
+    --m_keyCount;
+    ++m_deletedCount;
+
+    if (m_deletedCount * 4 >= m_indexSize)
+        rehash(m_keyCount);
+}
+
+inline void PropertyTable::remove(const KeyType& key)
+{
+    remove(find(key));
+}
+
+// returns the number of values in the hashtable.
+inline unsigned PropertyTable::size() const
+{
+    return m_keyCount;
+}
+
+inline bool PropertyTable::isEmpty() const
+{
+    return !m_keyCount;
+}
+
+inline unsigned PropertyTable::propertyStorageSize() const
+{
+    return size() + (m_deletedOffsets ? m_deletedOffsets->size() : 0);
+}
+
+inline void PropertyTable::clearDeletedOffsets()
+{
+    m_deletedOffsets = nullptr;
+}
+
+inline bool PropertyTable::hasDeletedOffset()
+{
+    return m_deletedOffsets && !m_deletedOffsets->isEmpty();
+}
+
+inline PropertyOffset PropertyTable::getDeletedOffset()
+{
+    PropertyOffset offset = m_deletedOffsets->last();
+    m_deletedOffsets->removeLast();
+    return offset;
+}
+
+inline void PropertyTable::addDeletedOffset(PropertyOffset offset)
+{
+    if (!m_deletedOffsets)
+        m_deletedOffsets = std::make_unique<Vector<PropertyOffset>>();
+    m_deletedOffsets->append(offset);
+}
+
+inline PropertyOffset PropertyTable::nextOffset(PropertyOffset inlineCapacity)
+{
+    if (hasDeletedOffset())
+        return getDeletedOffset();
+
+    return offsetForPropertyNumber(size(), inlineCapacity);
+}
+
+inline PropertyTable* PropertyTable::copy(VM& vm, unsigned newCapacity)
+{
+    ASSERT(newCapacity >= m_keyCount);
+
+    // Fast case; if the new table will be the same m_indexSize as this one, we can memcpy it,
+    // save rehashing all keys.
+    if (sizeForCapacity(newCapacity) == m_indexSize)
+        return PropertyTable::clone(vm, *this);
+    return PropertyTable::clone(vm, newCapacity, *this);
+}
+
+#ifndef NDEBUG
+inline size_t PropertyTable::sizeInMemory()
+{
+    size_t result = sizeof(PropertyTable) + dataSize();
+    if (m_deletedOffsets)
+        result += (m_deletedOffsets->capacity() * sizeof(PropertyOffset));
+    return result;
+}
+#endif
+
+inline void PropertyTable::reinsert(const ValueType& entry)
+{
+#if DUMP_PROPERTYMAP_STATS
+    ++propertyMapHashTableStats->numReinserts;
+#endif
+
+    // Used to insert a value known not to be in the table, and where
+    // we know capacity to be available.
+    ASSERT(canInsert());
+    find_iterator iter = find(entry.key);
+    ASSERT(!iter.first);
+
+    unsigned entryIndex = usedCount() + 1;
+    m_index[iter.second] = entryIndex;
+    table()[entryIndex - 1] = entry;
+
+    ++m_keyCount;
+}
+
+inline void PropertyTable::rehash(unsigned newCapacity)
+{
+#if DUMP_PROPERTYMAP_STATS
+    ++propertyMapHashTableStats->numRehashes;
+#endif
+
+    unsigned* oldEntryIndices = m_index;
+    iterator iter = this->begin();
+    iterator end = this->end();
+
+    m_indexSize = sizeForCapacity(newCapacity);
+    m_indexMask = m_indexSize - 1;
+    m_keyCount = 0;
+    m_deletedCount = 0;
+    m_index = static_cast<unsigned*>(fastZeroedMalloc(dataSize()));
+
+    for (; iter != end; ++iter) {
+        ASSERT(canInsert());
+        reinsert(*iter);
+    }
+
+    fastFree(oldEntryIndices);
+}
+
+inline unsigned PropertyTable::tableCapacity() const { return m_indexSize >> 1; }
+
+inline unsigned PropertyTable::deletedEntryIndex() const { return tableCapacity() + 1; }
+
+template<typename T>
+inline T* PropertyTable::skipDeletedEntries(T* valuePtr)
+{
+    while (valuePtr->key == PROPERTY_MAP_DELETED_ENTRY_KEY)
+        ++valuePtr;
+    return valuePtr;
+}
+
+inline PropertyTable::ValueType* PropertyTable::table()
+{
+    // The table of values lies after the hash index.
+    return reinterpret_cast<ValueType*>(m_index + m_indexSize);
+}
+
+inline const PropertyTable::ValueType* PropertyTable::table() const
+{
+    // The table of values lies after the hash index.
+    return reinterpret_cast<const ValueType*>(m_index + m_indexSize);
+}
+
+inline unsigned PropertyTable::usedCount() const
+{
+    // Total number of  used entries in the values array - by either valid entries, or deleted ones.
+    return m_keyCount + m_deletedCount;
+}
+
+inline size_t PropertyTable::dataSize()
+{
+    // The size in bytes of data needed for by the table.
+    return m_indexSize * sizeof(unsigned) + ((tableCapacity()) + 1) * sizeof(ValueType);
+}
+
+inline unsigned PropertyTable::sizeForCapacity(unsigned capacity)
+{
+    if (capacity < MinimumTableSize / 2)
+        return MinimumTableSize;
+    return nextPowerOf2(capacity + 1) * 2;
+}
+
+inline bool PropertyTable::canInsert()
+{
+    return usedCount() < tableCapacity();
+}
+
+} // namespace JSC
diff --git a/runtime/PropertyName.h b/runtime/PropertyName.h
new file mode 100644
index 0000000..d1d4d19
--- /dev/null
+++ b/runtime/PropertyName.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Identifier.h"
+#include "PrivateName.h"
+#include <wtf/Optional.h>
+
+namespace JSC {
+
+class PropertyName {
+public:
+    PropertyName(UniquedStringImpl* propertyName)
+        : m_impl(propertyName)
+    {
+    }
+
+    PropertyName(const Identifier& propertyName)
+        : PropertyName(propertyName.impl())
+    {
+    }
+
+    PropertyName(const PrivateName& propertyName)
+        : m_impl(&propertyName.uid())
+    {
+        ASSERT(m_impl);
+        ASSERT(m_impl->isSymbol());
+    }
+
+    bool isNull() const { return !m_impl; }
+
+    bool isSymbol()
+    {
+        return m_impl && m_impl->isSymbol();
+    }
+
+    UniquedStringImpl* uid() const
+    {
+        return m_impl;
+    }
+
+    AtomicStringImpl* publicName() const
+    {
+        return (!m_impl || m_impl->isSymbol()) ? nullptr : static_cast<AtomicStringImpl*>(m_impl);
+    }
+
+    void dump(PrintStream& out) const
+    {
+        if (m_impl)
+            out.print(m_impl);
+        else
+            out.print("<null property name>");
+    }
+
+private:
+    UniquedStringImpl* m_impl;
+};
+
+inline bool operator==(PropertyName a, const Identifier& b)
+{
+    return a.uid() == b.impl();
+}
+
+inline bool operator==(const Identifier& a, PropertyName b)
+{
+    return a.impl() == b.uid();
+}
+
+inline bool operator==(PropertyName a, PropertyName b)
+{
+    return a.uid() == b.uid();
+}
+
+inline bool operator==(PropertyName a, const char* b)
+{
+    return equal(a.uid(), b);
+}
+
+inline bool operator!=(PropertyName a, const Identifier& b)
+{
+    return a.uid() != b.impl();
+}
+
+inline bool operator!=(const Identifier& a, PropertyName b)
+{
+    return a.impl() != b.uid();
+}
+
+inline bool operator!=(PropertyName a, PropertyName b)
+{
+    return a.uid() != b.uid();
+}
+
+ALWAYS_INLINE std::optional<uint32_t> parseIndex(PropertyName propertyName)
+{
+    auto uid = propertyName.uid();
+    if (!uid)
+        return std::nullopt;
+    if (uid->isSymbol())
+        return std::nullopt;
+    return parseIndex(*uid);
+}
+
+} // namespace JSC
diff --git a/runtime/PropertyNameArray.h b/runtime/PropertyNameArray.h
new file mode 100644
index 0000000..8d1f286
--- /dev/null
+++ b/runtime/PropertyNameArray.h
@@ -0,0 +1,153 @@
+/*
+ *  Copyright (C) 2006, 2008, 2012 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "Identifier.h"
+#include <wtf/HashSet.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+// FIXME: Rename to PropertyNameArray.
+class PropertyNameArrayData : public RefCounted<PropertyNameArrayData> {
+public:
+    typedef Vector<Identifier, 20> PropertyNameVector;
+
+    static Ref<PropertyNameArrayData> create() { return adoptRef(*new PropertyNameArrayData); }
+
+    PropertyNameVector& propertyNameVector() { return m_propertyNameVector; }
+
+private:
+    PropertyNameArrayData()
+    {
+    }
+
+    PropertyNameVector m_propertyNameVector;
+};
+
+// FIXME: Rename to PropertyNameArrayBuilder.
+class PropertyNameArray {
+public:
+    PropertyNameArray(VM* vm, PropertyNameMode mode)
+        : m_data(PropertyNameArrayData::create())
+        , m_vm(vm)
+        , m_mode(mode)
+    {
+    }
+
+    PropertyNameArray(ExecState* exec, PropertyNameMode mode)
+        : PropertyNameArray(&exec->vm(), mode)
+    {
+    }
+
+    VM* vm() { return m_vm; }
+
+    void add(uint32_t index)
+    {
+        add(Identifier::from(m_vm, index));
+    }
+
+    void add(const Identifier&);
+    void add(UniquedStringImpl*);
+    void addUnchecked(UniquedStringImpl*);
+
+    Identifier& operator[](unsigned i) { return m_data->propertyNameVector()[i]; }
+    const Identifier& operator[](unsigned i) const { return m_data->propertyNameVector()[i]; }
+
+    void setData(PassRefPtr<PropertyNameArrayData> data) { m_data = data; }
+    PropertyNameArrayData* data() { return m_data.get(); }
+    PassRefPtr<PropertyNameArrayData> releaseData() { return WTFMove(m_data); }
+
+    // FIXME: Remove these functions.
+    bool canAddKnownUniqueForStructure() const { return m_data->propertyNameVector().isEmpty(); }
+    typedef PropertyNameArrayData::PropertyNameVector::const_iterator const_iterator;
+    size_t size() const { return m_data->propertyNameVector().size(); }
+    const_iterator begin() const { return m_data->propertyNameVector().begin(); }
+    const_iterator end() const { return m_data->propertyNameVector().end(); }
+
+    PropertyNameMode mode() const { return m_mode; }
+    bool includeSymbolProperties() const;
+    bool includeStringProperties() const;
+
+private:
+    bool isUidMatchedToTypeMode(UniquedStringImpl* identifier);
+
+    RefPtr<PropertyNameArrayData> m_data;
+    HashSet<UniquedStringImpl*> m_set;
+    VM* m_vm;
+    PropertyNameMode m_mode;
+};
+
+ALWAYS_INLINE void PropertyNameArray::add(const Identifier& identifier)
+{
+    add(identifier.impl());
+}
+
+ALWAYS_INLINE void PropertyNameArray::addUnchecked(UniquedStringImpl* identifier)
+{
+    if (!isUidMatchedToTypeMode(identifier))
+        return;
+    m_data->propertyNameVector().append(Identifier::fromUid(m_vm, identifier));
+}
+
+ALWAYS_INLINE void PropertyNameArray::add(UniquedStringImpl* identifier)
+{
+    static const unsigned setThreshold = 20;
+
+    ASSERT(identifier);
+
+    if (!isUidMatchedToTypeMode(identifier))
+        return;
+
+    if (size() < setThreshold) {
+        if (m_data->propertyNameVector().contains(identifier))
+            return;
+    } else {
+        if (m_set.isEmpty()) {
+            for (Identifier& name : m_data->propertyNameVector())
+                m_set.add(name.impl());
+        }
+        if (!m_set.add(identifier).isNewEntry)
+            return;
+    }
+
+    addUnchecked(identifier);
+}
+
+ALWAYS_INLINE bool PropertyNameArray::isUidMatchedToTypeMode(UniquedStringImpl* identifier)
+{
+    if (identifier->isSymbol())
+        return includeSymbolProperties();
+    return includeStringProperties();
+}
+
+ALWAYS_INLINE bool PropertyNameArray::includeSymbolProperties() const
+{
+    return static_cast<std::underlying_type<PropertyNameMode>::type>(m_mode) & static_cast<std::underlying_type<PropertyNameMode>::type>(PropertyNameMode::Symbols);
+}
+
+ALWAYS_INLINE bool PropertyNameArray::includeStringProperties() const
+{
+    return static_cast<std::underlying_type<PropertyNameMode>::type>(m_mode) & static_cast<std::underlying_type<PropertyNameMode>::type>(PropertyNameMode::Strings);
+}
+
+} // namespace JSC
diff --git a/runtime/PropertyOffset.h b/runtime/PropertyOffset.h
new file mode 100644
index 0000000..c32d37f
--- /dev/null
+++ b/runtime/PropertyOffset.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+typedef int PropertyOffset;
+
+static const PropertyOffset invalidOffset = -1;
+static const PropertyOffset firstOutOfLineOffset = 100;
+
+// Declare all of the functions because they tend to do forward calls.
+inline void checkOffset(PropertyOffset);
+inline void checkOffset(PropertyOffset, int inlineCapacity);
+inline void validateOffset(PropertyOffset);
+inline void validateOffset(PropertyOffset, int inlineCapacity);
+inline bool isValidOffset(PropertyOffset);
+inline bool isInlineOffset(PropertyOffset);
+inline bool isOutOfLineOffset(PropertyOffset);
+inline size_t offsetInInlineStorage(PropertyOffset);
+inline size_t offsetInOutOfLineStorage(PropertyOffset);
+inline size_t offsetInRespectiveStorage(PropertyOffset);
+inline size_t numberOfOutOfLineSlotsForLastOffset(PropertyOffset);
+inline size_t numberOfSlotsForLastOffset(PropertyOffset, int inlineCapacity);
+
+inline void checkOffset(PropertyOffset offset)
+{
+    UNUSED_PARAM(offset);
+    ASSERT(offset >= invalidOffset);
+}
+
+inline void checkOffset(PropertyOffset offset, int inlineCapacity)
+{
+    UNUSED_PARAM(offset);
+    UNUSED_PARAM(inlineCapacity);
+    ASSERT(offset >= invalidOffset);
+    ASSERT(offset == invalidOffset
+        || offset < inlineCapacity
+        || isOutOfLineOffset(offset));
+}
+
+inline void validateOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    ASSERT(isValidOffset(offset));
+}
+
+inline void validateOffset(PropertyOffset offset, int inlineCapacity)
+{
+    checkOffset(offset, inlineCapacity);
+    ASSERT(isValidOffset(offset));
+}
+
+inline bool isValidOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    return offset != invalidOffset;
+}
+
+inline bool isInlineOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    return offset < firstOutOfLineOffset;
+}
+
+inline bool isOutOfLineOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    return !isInlineOffset(offset);
+}
+
+inline size_t offsetInInlineStorage(PropertyOffset offset)
+{
+    validateOffset(offset);
+    ASSERT(isInlineOffset(offset));
+    return offset;
+}
+
+inline size_t offsetInOutOfLineStorage(PropertyOffset offset)
+{
+    validateOffset(offset);
+    ASSERT(isOutOfLineOffset(offset));
+    return -static_cast<ptrdiff_t>(offset - firstOutOfLineOffset) - 1;
+}
+
+inline size_t offsetInRespectiveStorage(PropertyOffset offset)
+{
+    if (isInlineOffset(offset))
+        return offsetInInlineStorage(offset);
+    return offsetInOutOfLineStorage(offset);
+}
+
+inline size_t numberOfOutOfLineSlotsForLastOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    if (offset < firstOutOfLineOffset)
+        return 0;
+    return offset - firstOutOfLineOffset + 1;
+}
+
+inline size_t numberOfSlotsForLastOffset(PropertyOffset offset, int inlineCapacity)
+{
+    checkOffset(offset, inlineCapacity);
+    if (offset < inlineCapacity)
+        return offset + 1;
+    return inlineCapacity + numberOfOutOfLineSlotsForLastOffset(offset);
+}
+
+inline PropertyOffset offsetForPropertyNumber(int propertyNumber, int inlineCapacity)
+{
+    PropertyOffset offset = propertyNumber;
+    if (offset >= inlineCapacity) {
+        offset += firstOutOfLineOffset;
+        offset -= inlineCapacity;
+    }
+    return offset;
+}
+
+} // namespace JSC
diff --git a/runtime/PropertySlot.cpp b/runtime/PropertySlot.cpp
new file mode 100644
index 0000000..e900a68
--- /dev/null
+++ b/runtime/PropertySlot.cpp
@@ -0,0 +1,68 @@
+/*
+ *  Copyright (C) 2005, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "PropertySlot.h"
+
+#include "GetterSetter.h"
+#include "JSCJSValueInlines.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+JSValue PropertySlot::functionGetter(ExecState* exec) const
+{
+    ASSERT(m_thisValue);
+    return callGetter(exec, m_thisValue, m_data.getter.getterSetter);
+}
+
+JSValue PropertySlot::customGetter(ExecState* exec, PropertyName propertyName) const
+{
+    // FIXME: Remove this differences in custom values and custom accessors.
+    // https://bugs.webkit.org/show_bug.cgi?id=158014
+    JSValue thisValue = m_attributes & CustomAccessor ? m_thisValue : JSValue(slotBase());
+    return JSValue::decode(m_data.custom.getValue(exec, JSValue::encode(thisValue), propertyName));
+}
+
+JSValue PropertySlot::customAccessorGetter(ExecState* exec, PropertyName propertyName) const
+{
+    if (!m_data.customAccessor.getterSetter->getter())
+        return jsUndefined();
+    return JSValue::decode(m_data.customAccessor.getterSetter->getter()(exec, JSValue::encode(m_thisValue), propertyName));
+}
+
+JSValue PropertySlot::getPureResult() const
+{
+    JSValue result;
+    if (isTaintedByOpaqueObject())
+        result = jsNull();
+    else if (isCacheableValue())
+        result = JSValue::decode(m_data.value);
+    else if (isCacheableGetter())
+        result = getterSetter();
+    else if (isUnset())
+        result = jsUndefined();
+    else
+        result = jsNull();
+    
+    return result;
+}
+
+} // namespace JSC
diff --git a/runtime/PropertySlot.h b/runtime/PropertySlot.h
new file mode 100644
index 0000000..387e31b
--- /dev/null
+++ b/runtime/PropertySlot.h
@@ -0,0 +1,355 @@
+/*
+ *  Copyright (C) 2005, 2007, 2008, 2015-2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "PropertyName.h"
+#include "PropertyOffset.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+namespace DOMJIT {
+class GetterSetter;
+}
+class ExecState;
+class GetterSetter;
+class JSObject;
+
+// ECMA 262-3 8.6.1
+// Property attributes
+enum Attribute {
+    None              = 0,
+    ReadOnly          = 1 << 1,  // property can be only read, not written
+    DontEnum          = 1 << 2,  // property doesn't appear in (for .. in ..)
+    DontDelete        = 1 << 3,  // property can't be deleted
+    Accessor          = 1 << 4,  // property is a getter/setter
+    CustomAccessor    = 1 << 5,
+
+    // Things that are used by static hashtables are not in the attributes byte in PropertyMapEntry.
+    Function          = 1 << 8,  // property is a function - only used by static hashtables
+    Builtin           = 1 << 9,  // property is a builtin function - only used by static hashtables
+    ConstantInteger   = 1 << 10, // property is a constant integer - only used by static hashtables
+    CellProperty      = 1 << 11, // property is a lazy property - only used by static hashtables
+    ClassStructure    = 1 << 12, // property is a lazy class structure - only used by static hashtables
+    PropertyCallback  = 1 << 13, // property that is a lazy property callback - only used by static hashtables
+    DOMJITAttribute   = 1 << 14, // property is a DOM JIT attribute - only used by static hashtables
+    DOMJITFunction    = 1 << 15, // property is a DOM JIT function - only used by static hashtables
+    BuiltinOrFunction = Builtin | Function, // helper only used by static hashtables
+    BuiltinOrFunctionOrLazyProperty = Builtin | Function | CellProperty | ClassStructure | PropertyCallback, // helper only used by static hashtables
+    BuiltinOrFunctionOrAccessorOrLazyProperty = Builtin | Function | Accessor | CellProperty | ClassStructure | PropertyCallback, // helper only used by static hashtables
+    BuiltinOrFunctionOrAccessorOrLazyPropertyOrConstant = Builtin | Function | Accessor | CellProperty | ClassStructure | PropertyCallback | ConstantInteger // helper only used by static hashtables
+};
+
+enum CacheabilityType : uint8_t {
+    CachingDisallowed,
+    CachingAllowed
+};
+
+inline unsigned attributesForStructure(unsigned attributes)
+{
+    // The attributes that are used just for the static hashtable are at bit 8 and higher.
+    return static_cast<uint8_t>(attributes);
+}
+
+class PropertySlot {
+    enum PropertyType : uint8_t {
+        TypeUnset,
+        TypeValue,
+        TypeGetter,
+        TypeCustom,
+        TypeCustomAccessor,
+    };
+
+public:
+    enum class InternalMethodType : uint8_t {
+        Get, // [[Get]] internal method in the spec.
+        HasProperty, // [[HasProperty]] internal method in the spec.
+        GetOwnProperty, // [[GetOwnProperty]] internal method in the spec.
+        VMInquiry, // Our VM is just poking around. When this is the InternalMethodType, getOwnPropertySlot is not allowed to do user observable actions.
+    };
+
+    explicit PropertySlot(const JSValue thisValue, InternalMethodType internalMethodType)
+        : m_offset(invalidOffset)
+        , m_thisValue(thisValue)
+        , m_slotBase(nullptr)
+        , m_watchpointSet(nullptr)
+        , m_cacheability(CachingAllowed)
+        , m_propertyType(TypeUnset)
+        , m_internalMethodType(internalMethodType)
+        , m_isTaintedByOpaqueObject(false)
+    {
+    }
+
+    // FIXME: Remove this slotBase / receiver behavior difference in custom values and custom accessors.
+    // https://bugs.webkit.org/show_bug.cgi?id=158014
+    typedef EncodedJSValue (*GetValueFunc)(ExecState*, EncodedJSValue thisValue, PropertyName);
+
+    JSValue getValue(ExecState*, PropertyName) const;
+    JSValue getValue(ExecState*, unsigned propertyName) const;
+    JSValue getPureResult() const;
+
+    bool isCacheable() const { return m_cacheability == CachingAllowed && m_offset != invalidOffset; }
+    bool isUnset() const { return m_propertyType == TypeUnset; }
+    bool isValue() const { return m_propertyType == TypeValue; }
+    bool isAccessor() const { return m_propertyType == TypeGetter; }
+    bool isCustom() const { return m_propertyType == TypeCustom; }
+    bool isCustomAccessor() const { return m_propertyType == TypeCustomAccessor; }
+    bool isCacheableValue() const { return isCacheable() && isValue(); }
+    bool isCacheableGetter() const { return isCacheable() && isAccessor(); }
+    bool isCacheableCustom() const { return isCacheable() && isCustom(); }
+    void setIsTaintedByOpaqueObject() { m_isTaintedByOpaqueObject = true; }
+    bool isTaintedByOpaqueObject() const { return m_isTaintedByOpaqueObject; }
+
+    InternalMethodType internalMethodType() const { return m_internalMethodType; }
+
+    void disableCaching()
+    {
+        m_cacheability = CachingDisallowed;
+    }
+
+    unsigned attributes() const { return m_attributes; }
+
+    PropertyOffset cachedOffset() const
+    {
+        ASSERT(isCacheable());
+        return m_offset;
+    }
+
+    GetterSetter* getterSetter() const
+    {
+        ASSERT(isAccessor());
+        return m_data.getter.getterSetter;
+    }
+
+    GetValueFunc customGetter() const
+    {
+        ASSERT(isCacheableCustom());
+        return m_data.custom.getValue;
+    }
+
+    CustomGetterSetter* customGetterSetter() const
+    {
+        ASSERT(isCustomAccessor());
+        return m_data.customAccessor.getterSetter;
+    }
+
+    JSObject* slotBase() const
+    {
+        return m_slotBase;
+    }
+
+    WatchpointSet* watchpointSet() const
+    {
+        return m_watchpointSet;
+    }
+
+    DOMJIT::GetterSetter* domJIT() const
+    {
+        return m_domJIT;
+    }
+
+    void setValue(JSObject* slotBase, unsigned attributes, JSValue value)
+    {
+        ASSERT(attributes == attributesForStructure(attributes));
+        
+        m_data.value = JSValue::encode(value);
+        m_attributes = attributes;
+
+        ASSERT(slotBase);
+        m_slotBase = slotBase;
+        m_propertyType = TypeValue;
+        m_offset = invalidOffset;
+    }
+    
+    void setValue(JSObject* slotBase, unsigned attributes, JSValue value, PropertyOffset offset)
+    {
+        ASSERT(attributes == attributesForStructure(attributes));
+        
+        ASSERT(value);
+        m_data.value = JSValue::encode(value);
+        m_attributes = attributes;
+
+        ASSERT(slotBase);
+        m_slotBase = slotBase;
+        m_propertyType = TypeValue;
+        m_offset = offset;
+    }
+
+    void setValue(JSString*, unsigned attributes, JSValue value)
+    {
+        ASSERT(attributes == attributesForStructure(attributes));
+        
+        ASSERT(value);
+        m_data.value = JSValue::encode(value);
+        m_attributes = attributes;
+
+        m_slotBase = 0;
+        m_propertyType = TypeValue;
+        m_offset = invalidOffset;
+    }
+
+    void setCustom(JSObject* slotBase, unsigned attributes, GetValueFunc getValue)
+    {
+        ASSERT(attributes == attributesForStructure(attributes));
+        
+        ASSERT(getValue);
+        m_data.custom.getValue = getValue;
+        m_attributes = attributes;
+
+        ASSERT(slotBase);
+        m_slotBase = slotBase;
+        m_propertyType = TypeCustom;
+        m_offset = invalidOffset;
+    }
+    
+    void setCacheableCustom(JSObject* slotBase, unsigned attributes, GetValueFunc getValue, DOMJIT::GetterSetter* domJIT = nullptr)
+    {
+        ASSERT(attributes == attributesForStructure(attributes));
+        
+        ASSERT(getValue);
+        m_data.custom.getValue = getValue;
+        m_attributes = attributes;
+
+        ASSERT(slotBase);
+        m_slotBase = slotBase;
+        m_propertyType = TypeCustom;
+        m_offset = !invalidOffset;
+        m_domJIT = domJIT;
+    }
+
+    void setCustomGetterSetter(JSObject* slotBase, unsigned attributes, CustomGetterSetter* getterSetter)
+    {
+        ASSERT(attributes == attributesForStructure(attributes));
+
+        ASSERT(getterSetter);
+        m_data.customAccessor.getterSetter = getterSetter;
+        m_attributes = attributes;
+
+        ASSERT(slotBase);
+        m_slotBase = slotBase;
+        m_propertyType = TypeCustomAccessor;
+        m_offset = invalidOffset;
+    }
+
+    void setGetterSlot(JSObject* slotBase, unsigned attributes, GetterSetter* getterSetter)
+    {
+        ASSERT(attributes == attributesForStructure(attributes));
+        
+        ASSERT(getterSetter);
+        m_data.getter.getterSetter = getterSetter;
+        m_attributes = attributes;
+
+        ASSERT(slotBase);
+        m_slotBase = slotBase;
+        m_propertyType = TypeGetter;
+        m_offset = invalidOffset;
+    }
+
+    void setCacheableGetterSlot(JSObject* slotBase, unsigned attributes, GetterSetter* getterSetter, PropertyOffset offset)
+    {
+        ASSERT(attributes == attributesForStructure(attributes));
+        
+        ASSERT(getterSetter);
+        m_data.getter.getterSetter = getterSetter;
+        m_attributes = attributes;
+
+        ASSERT(slotBase);
+        m_slotBase = slotBase;
+        m_propertyType = TypeGetter;
+        m_offset = offset;
+    }
+
+    JSValue thisValue() const
+    {
+        return m_thisValue;
+    }
+
+    void setThisValue(JSValue thisValue)
+    {
+        m_thisValue = thisValue;
+    }
+
+    void setUndefined()
+    {
+        m_data.value = JSValue::encode(jsUndefined());
+        m_attributes = ReadOnly | DontDelete | DontEnum;
+
+        m_slotBase = 0;
+        m_propertyType = TypeValue;
+        m_offset = invalidOffset;
+    }
+
+    void setWatchpointSet(WatchpointSet& set)
+    {
+        m_watchpointSet = &set;
+    }
+
+private:
+    JS_EXPORT_PRIVATE JSValue functionGetter(ExecState*) const;
+    JS_EXPORT_PRIVATE JSValue customGetter(ExecState*, PropertyName) const;
+    JS_EXPORT_PRIVATE JSValue customAccessorGetter(ExecState*, PropertyName) const;
+
+    unsigned m_attributes;
+    union {
+        EncodedJSValue value;
+        struct {
+            GetterSetter* getterSetter;
+        } getter;
+        struct {
+            GetValueFunc getValue;
+        } custom;
+        struct {
+            CustomGetterSetter* getterSetter;
+        } customAccessor;
+    } m_data;
+
+    PropertyOffset m_offset;
+    JSValue m_thisValue;
+    JSObject* m_slotBase;
+    WatchpointSet* m_watchpointSet;
+    CacheabilityType m_cacheability;
+    PropertyType m_propertyType;
+    InternalMethodType m_internalMethodType;
+    DOMJIT::GetterSetter* m_domJIT { nullptr };
+    bool m_isTaintedByOpaqueObject;
+};
+
+ALWAYS_INLINE JSValue PropertySlot::getValue(ExecState* exec, PropertyName propertyName) const
+{
+    if (m_propertyType == TypeValue)
+        return JSValue::decode(m_data.value);
+    if (m_propertyType == TypeGetter)
+        return functionGetter(exec);
+    if (m_propertyType == TypeCustomAccessor)
+        return customAccessorGetter(exec, propertyName);
+    return customGetter(exec, propertyName);
+}
+
+ALWAYS_INLINE JSValue PropertySlot::getValue(ExecState* exec, unsigned propertyName) const
+{
+    if (m_propertyType == TypeValue)
+        return JSValue::decode(m_data.value);
+    if (m_propertyType == TypeGetter)
+        return functionGetter(exec);
+    return customGetter(exec, Identifier::from(exec, propertyName));
+}
+
+} // namespace JSC
diff --git a/runtime/PropertyStorage.h b/runtime/PropertyStorage.h
new file mode 100644
index 0000000..7efa52b
--- /dev/null
+++ b/runtime/PropertyStorage.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "WriteBarrier.h"
+
+namespace JSC {
+
+typedef WriteBarrierBase<Unknown>* PropertyStorage;
+typedef const WriteBarrierBase<Unknown>* ConstPropertyStorage;
+
+} // namespace JSC
diff --git a/runtime/PropertyTable.cpp b/runtime/PropertyTable.cpp
new file mode 100644
index 0000000..35aac5a
--- /dev/null
+++ b/runtime/PropertyTable.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PropertyMapHashTable.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo PropertyTable::s_info = { "PropertyTable", 0, 0, CREATE_METHOD_TABLE(PropertyTable) };
+
+PropertyTable* PropertyTable::create(VM& vm, unsigned initialCapacity)
+{
+    PropertyTable* table = new (NotNull, allocateCell<PropertyTable>(vm.heap)) PropertyTable(vm, initialCapacity);
+    table->finishCreation(vm);
+    return table;
+}
+
+PropertyTable* PropertyTable::clone(VM& vm, const PropertyTable& other)
+{
+    PropertyTable* table = new (NotNull, allocateCell<PropertyTable>(vm.heap)) PropertyTable(vm, other);
+    table->finishCreation(vm);
+    return table;
+}
+
+PropertyTable* PropertyTable::clone(VM& vm, unsigned initialCapacity, const PropertyTable& other)
+{
+    PropertyTable* table = new (NotNull, allocateCell<PropertyTable>(vm.heap)) PropertyTable(vm, initialCapacity, other);
+    table->finishCreation(vm);
+    return table;
+}
+
+PropertyTable::PropertyTable(VM& vm, unsigned initialCapacity)
+    : JSCell(vm, vm.propertyTableStructure.get())
+    , m_indexSize(sizeForCapacity(initialCapacity))
+    , m_indexMask(m_indexSize - 1)
+    , m_index(static_cast<unsigned*>(fastZeroedMalloc(dataSize())))
+    , m_keyCount(0)
+    , m_deletedCount(0)
+{
+    ASSERT(isPowerOf2(m_indexSize));
+}
+
+PropertyTable::PropertyTable(VM& vm, const PropertyTable& other)
+    : JSCell(vm, vm.propertyTableStructure.get())
+    , m_indexSize(other.m_indexSize)
+    , m_indexMask(other.m_indexMask)
+    , m_index(static_cast<unsigned*>(fastMalloc(dataSize())))
+    , m_keyCount(other.m_keyCount)
+    , m_deletedCount(other.m_deletedCount)
+{
+    ASSERT(isPowerOf2(m_indexSize));
+
+    memcpy(m_index, other.m_index, dataSize());
+
+    iterator end = this->end();
+    for (iterator iter = begin(); iter != end; ++iter)
+        iter->key->ref();
+
+    // Copy the m_deletedOffsets vector.
+    Vector<PropertyOffset>* otherDeletedOffsets = other.m_deletedOffsets.get();
+    if (otherDeletedOffsets)
+        m_deletedOffsets = std::make_unique<Vector<PropertyOffset>>(*otherDeletedOffsets);
+}
+
+PropertyTable::PropertyTable(VM& vm, unsigned initialCapacity, const PropertyTable& other)
+    : JSCell(vm, vm.propertyTableStructure.get())
+    , m_indexSize(sizeForCapacity(initialCapacity))
+    , m_indexMask(m_indexSize - 1)
+    , m_index(static_cast<unsigned*>(fastZeroedMalloc(dataSize())))
+    , m_keyCount(0)
+    , m_deletedCount(0)
+{
+    ASSERT(isPowerOf2(m_indexSize));
+    ASSERT(initialCapacity >= other.m_keyCount);
+
+    const_iterator end = other.end();
+    for (const_iterator iter = other.begin(); iter != end; ++iter) {
+        ASSERT(canInsert());
+        reinsert(*iter);
+        iter->key->ref();
+    }
+
+    // Copy the m_deletedOffsets vector.
+    Vector<PropertyOffset>* otherDeletedOffsets = other.m_deletedOffsets.get();
+    if (otherDeletedOffsets)
+        m_deletedOffsets = std::make_unique<Vector<PropertyOffset>>(*otherDeletedOffsets);
+}
+
+void PropertyTable::destroy(JSCell* cell)
+{
+    static_cast<PropertyTable*>(cell)->PropertyTable::~PropertyTable();
+}
+
+PropertyTable::~PropertyTable()
+{
+    iterator end = this->end();
+    for (iterator iter = begin(); iter != end; ++iter)
+        iter->key->deref();
+
+    fastFree(m_index);
+}
+
+} // namespace JSC
+
diff --git a/runtime/Protect.h b/runtime/Protect.h
new file mode 100644
index 0000000..5a47b3a
--- /dev/null
+++ b/runtime/Protect.h
@@ -0,0 +1,62 @@
+/*
+ *  Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#pragma once
+
+#include "Heap.h"
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+inline void gcProtect(JSCell* val) 
+{
+    Heap::heap(val)->protect(val);
+}
+
+inline void gcUnprotect(JSCell* val)
+{
+    Heap::heap(val)->unprotect(val);
+}
+
+inline void gcProtectNullTolerant(JSCell* val) 
+{
+    if (val) 
+        gcProtect(val);
+}
+
+inline void gcUnprotectNullTolerant(JSCell* val) 
+{
+    if (val) 
+        gcUnprotect(val);
+}
+
+inline void gcProtect(JSValue value)
+{
+    if (value && value.isCell())
+        gcProtect(value.asCell());
+}
+
+inline void gcUnprotect(JSValue value)
+{
+    if (value && value.isCell())
+        gcUnprotect(value.asCell());
+}
+
+} // namespace JSC
diff --git a/runtime/PrototypeMap.cpp b/runtime/PrototypeMap.cpp
new file mode 100644
index 0000000..67c3d5d
--- /dev/null
+++ b/runtime/PrototypeMap.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2013, 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PrototypeMap.h"
+
+#include "IndexingType.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+#include "PrototypeMapInlines.h"
+
+namespace JSC {
+
+void PrototypeMap::addPrototype(JSObject* object)
+{
+    m_prototypes.set(object, object);
+
+    // Note that this method makes the somewhat odd decision to not check if this
+    // object currently has indexed accessors. We could do that check here, and if
+    // indexed accessors were found, we could tell the global object to have a bad
+    // time. But we avoid this, to allow the following to be always fast:
+    //
+    // 1) Create an object.
+    // 2) Give it a setter or read-only property that happens to have a numeric name.
+    // 3) Allocate objects that use this object as a prototype.
+    //
+    // This avoids anyone having a bad time. Even if the instance objects end up
+    // having indexed storage, the creation of indexed storage leads to a prototype
+    // chain walk that detects the presence of indexed setters and then does the
+    // right thing. As a result, having a bad time only happens if you add an
+    // indexed setter (or getter, or read-only field) to an object that is already
+    // used as a prototype.
+}
+
+inline Structure* PrototypeMap::createEmptyStructure(JSGlobalObject* globalObject, JSObject* prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
+{
+    auto key = std::make_pair(prototype, std::make_pair(inlineCapacity, std::make_pair(classInfo, globalObject)));
+    if (Structure* structure = m_structures.get(key)) {
+        ASSERT(isPrototype(prototype));
+        return structure;
+    }
+
+    addPrototype(prototype);
+    Structure* structure = Structure::create(
+        globalObject->vm(), globalObject, prototype, typeInfo, classInfo, indexingType, inlineCapacity);
+    m_structures.set(key, Weak<Structure>(structure));
+    return structure;
+}
+
+Structure* PrototypeMap::emptyStructureForPrototypeFromBaseStructure(JSGlobalObject* globalObject, JSObject* prototype, Structure* baseStructure)
+{
+    // We currently do not have inline capacity static analysis for subclasses and all internal function constructors have a default inline capacity of 0.
+    IndexingType indexingType = baseStructure->indexingType();
+    if (prototype->structure()->anyObjectInChainMayInterceptIndexedAccesses() && hasIndexedProperties(indexingType))
+        indexingType = (indexingType & ~IndexingShapeMask) | SlowPutArrayStorageShape;
+
+    return createEmptyStructure(globalObject, prototype, baseStructure->typeInfo(), baseStructure->classInfo(), indexingType, 0);
+}
+
+Structure* PrototypeMap::emptyObjectStructureForPrototype(JSGlobalObject* globalObject, JSObject* prototype, unsigned inlineCapacity)
+{
+    return createEmptyStructure(globalObject, prototype, JSFinalObject::typeInfo(), JSFinalObject::info(), JSFinalObject::defaultIndexingType, inlineCapacity);
+}
+
+void PrototypeMap::clearEmptyObjectStructureForPrototype(JSGlobalObject* globalObject, JSObject* object, unsigned inlineCapacity)
+{
+    m_structures.remove(std::make_pair(object, std::make_pair(inlineCapacity, std::make_pair(JSFinalObject::info(), globalObject))));
+}
+
+} // namespace JSC
diff --git a/runtime/PrototypeMap.h b/runtime/PrototypeMap.h
new file mode 100644
index 0000000..de448af
--- /dev/null
+++ b/runtime/PrototypeMap.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2013, 2016-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "IndexingType.h"
+#include "JSTypeInfo.h"
+#include "WeakGCMap.h"
+#include <wtf/TriState.h>
+
+namespace JSC {
+
+class JSGlobalObject;
+class JSObject;
+class Structure;
+class VM;
+
+// Tracks the canonical structure an object should be allocated with when inheriting from a given prototype.
+class PrototypeMap {
+public:
+    explicit PrototypeMap(VM& vm)
+        : m_prototypes(vm)
+        , m_structures(vm)
+    {
+    }
+
+    JS_EXPORT_PRIVATE Structure* emptyObjectStructureForPrototype(JSGlobalObject*, JSObject*, unsigned inlineCapacity);
+    JS_EXPORT_PRIVATE Structure* emptyStructureForPrototypeFromBaseStructure(JSGlobalObject*, JSObject*, Structure*);
+    void clearEmptyObjectStructureForPrototype(JSGlobalObject*, JSObject*, unsigned inlineCapacity);
+    JS_EXPORT_PRIVATE void addPrototype(JSObject*);
+    inline TriState isPrototype(JSObject*) const; // Returns a conservative estimate.
+
+private:
+    Structure* createEmptyStructure(JSGlobalObject*, JSObject* prototype, const TypeInfo&, const ClassInfo*, IndexingType, unsigned inlineCapacity);
+
+    WeakGCMap<JSObject*, JSObject> m_prototypes;
+    // FIXME: make the key a struct.
+    typedef WeakGCMap<std::pair<JSObject*, std::pair<unsigned, std::pair<const ClassInfo*, JSGlobalObject*>>>, Structure> StructureMap;
+    StructureMap m_structures;
+};
+
+} // namespace JSC
diff --git a/runtime/PrototypeMapInlines.h b/runtime/PrototypeMapInlines.h
new file mode 100644
index 0000000..0777668
--- /dev/null
+++ b/runtime/PrototypeMapInlines.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "PrototypeMap.h"
+#include "WeakGCMapInlines.h"
+
+namespace JSC {
+
+inline TriState PrototypeMap::isPrototype(JSObject* object) const
+{
+    if (!m_prototypes.contains(object))
+        return FalseTriState;
+
+    // We know that 'object' was used as a prototype at one time, so be
+    // conservative and say that it might still be so. (It would be expensive
+    // to find out for sure, and we don't know of any cases where being precise
+    // would improve performance.)
+    return MixedTriState;
+}
+
+} // namespace JSC
+
diff --git a/runtime/ProxyConstructor.cpp b/runtime/ProxyConstructor.cpp
new file mode 100644
index 0000000..7336e79
--- /dev/null
+++ b/runtime/ProxyConstructor.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyConstructor.h"
+
+#include "Error.h"
+#include "IdentifierInlines.h"
+#include "JSCInlines.h"
+#include "ObjectConstructor.h"
+#include "ObjectPrototype.h"
+#include "ProxyObject.h"
+#include "ProxyRevoke.h"
+#include "StructureInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ProxyConstructor);
+
+const ClassInfo ProxyConstructor::s_info = { "Proxy", &Base::s_info, 0, CREATE_METHOD_TABLE(ProxyConstructor) };
+
+ProxyConstructor* ProxyConstructor::create(VM& vm, Structure* structure)
+{
+    ProxyConstructor* constructor = new (NotNull, allocateCell<ProxyConstructor>(vm.heap)) ProxyConstructor(vm, structure);
+    constructor->finishCreation(vm, "Proxy", structure->globalObject());
+    return constructor;
+}
+
+ProxyConstructor::ProxyConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+static EncodedJSValue JSC_HOST_CALL makeRevocableProxy(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (exec->argumentCount() < 2)
+        return throwVMTypeError(exec, scope, ASCIILiteral("Proxy.revocable needs to be called with two arguments: the target and the handler"));
+
+    ArgList args(exec);
+    JSValue target = args.at(0);
+    JSValue handler = args.at(1);
+    ProxyObject* proxy = ProxyObject::create(exec, exec->lexicalGlobalObject(), target, handler);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    ProxyRevoke* revoke = ProxyRevoke::create(vm, exec->lexicalGlobalObject()->proxyRevokeStructure(), proxy);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSObject* result = constructEmptyObject(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    result->putDirect(vm, makeIdentifier(vm, "proxy"), proxy, None);
+    result->putDirect(vm, makeIdentifier(vm, "revoke"), revoke, None);
+
+    return JSValue::encode(result);
+}
+
+static EncodedJSValue JSC_HOST_CALL proxyRevocableConstructorThrowError(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    return throwVMTypeError(exec, scope, ASCIILiteral("Proxy.revocable cannot be constructed. It can only be called"));
+}
+
+void ProxyConstructor::finishCreation(VM& vm, const char* name, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm, name);
+
+    putDirect(vm, vm.propertyNames->length, jsNumber(2), DontEnum | ReadOnly);
+    putDirect(vm, makeIdentifier(vm, "revocable"), JSFunction::create(vm, globalObject, 2, ASCIILiteral("revocable"), makeRevocableProxy, NoIntrinsic, proxyRevocableConstructorThrowError));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructProxyObject(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    if (exec->newTarget().isUndefined())
+        return throwVMTypeError(exec, scope, ASCIILiteral("new.target of Proxy construct should not be undefined"));
+
+    ArgList args(exec);
+    JSValue target = args.at(0);
+    JSValue handler = args.at(1);
+    scope.release();
+    return JSValue::encode(ProxyObject::create(exec, exec->lexicalGlobalObject(), target, handler));
+}
+
+ConstructType ProxyConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructProxyObject;
+    return ConstructType::Host;
+}
+
+static EncodedJSValue JSC_HOST_CALL callProxy(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "Proxy"));
+}
+
+CallType ProxyConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callProxy;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/ProxyConstructor.h b/runtime/ProxyConstructor.h
new file mode 100644
index 0000000..48f53c8
--- /dev/null
+++ b/runtime/ProxyConstructor.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class ProxyConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static ProxyConstructor* create(VM&, Structure*);
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    { 
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+    void finishCreation(VM&, const char* name, JSGlobalObject*);
+
+private:
+    ProxyConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+
+    static EncodedJSValue getGetter(ExecState*, EncodedJSValue thisValue, PropertyName);
+};
+
+} // namespace JSC
diff --git a/runtime/ProxyObject.cpp b/runtime/ProxyObject.cpp
new file mode 100644
index 0000000..aab1319
--- /dev/null
+++ b/runtime/ProxyObject.cpp
@@ -0,0 +1,1164 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyObject.h"
+
+#include "ArrayConstructor.h"
+#include "Error.h"
+#include "IdentifierInlines.h"
+#include "JSCInlines.h"
+#include "JSObjectInlines.h"
+#include "ObjectConstructor.h"
+#include "SlotVisitorInlines.h"
+#include "StructureInlines.h"
+#include "VMInlines.h"
+
+// Note that this file is compile with -fno-optimize-sibling-calls because we rely on the machine stack
+// growing larger for throwing OOM errors for when we have an effectively cyclic prototype chain.
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ProxyObject);
+
+const ClassInfo ProxyObject::s_info = { "ProxyObject", &Base::s_info, 0, CREATE_METHOD_TABLE(ProxyObject) };
+
+ProxyObject::ProxyObject(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+String ProxyObject::toStringName(const JSObject* object, ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    const ProxyObject* proxy = jsCast<const ProxyObject*>(object);
+    while (proxy) {
+        const JSObject* target = proxy->target();
+        if (isArray(exec, target))
+            return target->classInfo()->methodTable.toStringName(target, exec);
+        if (UNLIKELY(scope.exception()))
+            break;
+
+        proxy = jsDynamicCast<const ProxyObject*>(target);
+    }
+    return ASCIILiteral("Object");
+}
+
+Structure* ProxyObject::structureForTarget(JSGlobalObject* globalObject, JSValue target)
+{
+    if (!target.isObject())
+        return globalObject->proxyObjectStructure();
+
+    JSObject* targetAsObject = jsCast<JSObject*>(target);
+    CallData ignoredCallData;
+    VM& vm = globalObject->vm();
+    bool isCallable = targetAsObject->methodTable(vm)->getCallData(targetAsObject, ignoredCallData) != CallType::None;
+    return isCallable ? globalObject->callableProxyObjectStructure() : globalObject->proxyObjectStructure();
+}
+
+void ProxyObject::finishCreation(VM& vm, ExecState* exec, JSValue target, JSValue handler)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Base::finishCreation(vm);
+    if (!target.isObject()) {
+        throwTypeError(exec, scope, ASCIILiteral("A Proxy's 'target' should be an Object"));
+        return;
+    }
+    if (ProxyObject* targetAsProxy = jsDynamicCast<ProxyObject*>(target)) {
+        if (targetAsProxy->handler().isNull()) {
+            throwTypeError(exec, scope, ASCIILiteral("If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked"));
+            return;
+        }
+    }
+    if (!handler.isObject()) {
+        throwTypeError(exec, scope, ASCIILiteral("A Proxy's 'handler' should be an Object"));
+        return;
+    }
+
+    JSObject* targetAsObject = jsCast<JSObject*>(target);
+
+    CallData ignoredCallData;
+    m_isCallable = targetAsObject->methodTable(vm)->getCallData(targetAsObject, ignoredCallData) != CallType::None;
+    if (m_isCallable) {
+        TypeInfo info = structure(vm)->typeInfo();
+        RELEASE_ASSERT(info.implementsHasInstance() && info.implementsDefaultHasInstance());
+    }
+
+    ConstructData ignoredConstructData;
+    m_isConstructible = jsCast<JSObject*>(target)->methodTable(vm)->getConstructData(jsCast<JSObject*>(target), ignoredConstructData) != ConstructType::None;
+
+    m_target.set(vm, this, targetAsObject);
+    m_handler.set(vm, this, handler);
+}
+
+static const char* s_proxyAlreadyRevokedErrorMessage = "Proxy has already been revoked. No more operations are allowed to be performed on it";
+
+static JSValue performProxyGet(ExecState* exec, ProxyObject* proxyObject, JSValue receiver, PropertyName propertyName)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return { };
+    }
+
+    JSObject* target = proxyObject->target();
+
+    auto performDefaultGet = [&] {
+        return target->get(exec, propertyName);
+    };
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultGet();
+    }
+
+    JSValue handlerValue = proxyObject->handler();
+    if (handlerValue.isNull())
+        return throwTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue getHandler = handler->getMethod(exec, callData, callType, vm.propertyNames->get, ASCIILiteral("'get' property of a Proxy's handler object should be callable"));
+    RETURN_IF_EXCEPTION(scope, { });
+
+    if (getHandler.isUndefined()) {
+        scope.release();
+        return performDefaultGet();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    arguments.append(receiver);
+    JSValue trapResult = call(exec, getHandler, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    PropertyDescriptor descriptor;
+    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
+            if (!sameValue(exec, descriptor.value(), trapResult))
+                return throwTypeError(exec, scope, ASCIILiteral("Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property"));
+        } else if (descriptor.isAccessorDescriptor() && !descriptor.configurable() && descriptor.getter().isUndefined()) {
+            if (!trapResult.isUndefined())
+                return throwTypeError(exec, scope, ASCIILiteral("Proxy handler's 'get' result of a non-configurable accessor property without a getter should be undefined"));
+        }
+    }
+
+    RETURN_IF_EXCEPTION(scope, { });
+
+    return trapResult;
+}
+
+bool ProxyObject::performGet(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue result = performProxyGet(exec, this, slot.thisValue(), propertyName);
+    RETURN_IF_EXCEPTION(scope, false);
+    unsigned ignoredAttributes = 0;
+    slot.setValue(this, ignoredAttributes, result);
+    return true;
+}
+
+bool ProxyObject::performInternalMethodGetOwnProperty(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+    JSObject* target = this->target();
+
+    auto performDefaultGetOwnProperty = [&] {
+        return target->methodTable(vm)->getOwnPropertySlot(target, exec, propertyName, slot);
+    };
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultGetOwnProperty();
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue getOwnPropertyDescriptorMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "getOwnPropertyDescriptor"), ASCIILiteral("'getOwnPropertyDescriptor' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    if (getOwnPropertyDescriptorMethod.isUndefined()) {
+        scope.release();
+        return performDefaultGetOwnProperty();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    JSValue trapResult = call(exec, getOwnPropertyDescriptorMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!trapResult.isUndefined() && !trapResult.isObject()) {
+        throwVMTypeError(exec, scope, ASCIILiteral("result of 'getOwnPropertyDescriptor' call should either be an Object or undefined"));
+        return false;
+    }
+
+    PropertyDescriptor targetPropertyDescriptor;
+    bool isTargetPropertyDescriptorDefined = target->getOwnPropertyDescriptor(exec, propertyName, targetPropertyDescriptor);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (trapResult.isUndefined()) {
+        if (!isTargetPropertyDescriptorDefined)
+            return false;
+        if (!targetPropertyDescriptor.configurable()) {
+            throwVMTypeError(exec, scope, ASCIILiteral("When the result of 'getOwnPropertyDescriptor' is undefined the target must be configurable"));
+            return false;
+        }
+        // FIXME: this doesn't work if 'target' is another Proxy. We don't have isExtensible implemented in a way that fits w/ Proxys.
+        // https://bugs.webkit.org/show_bug.cgi?id=154375
+        bool isExtensible = target->isExtensible(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (!isExtensible) {
+            // FIXME: Come up with a test for this error. I'm not sure how to because
+            // Object.seal(o) will make all fields [[Configurable]] false.
+            // https://bugs.webkit.org/show_bug.cgi?id=154376
+            throwVMTypeError(exec, scope, ASCIILiteral("When 'getOwnPropertyDescriptor' returns undefined, the 'target' of a Proxy should be extensible"));
+            return false;
+        }
+
+        return false;
+    }
+
+    bool isExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    PropertyDescriptor trapResultAsDescriptor;
+    toPropertyDescriptor(exec, trapResult, trapResultAsDescriptor);
+    RETURN_IF_EXCEPTION(scope, false);
+    bool throwException = false;
+    bool valid = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, isExtensible,
+        trapResultAsDescriptor, isTargetPropertyDescriptorDefined, targetPropertyDescriptor, throwException);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (!valid) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Result from 'getOwnPropertyDescriptor' fails the IsCompatiblePropertyDescriptor test"));
+        return false;
+    }
+
+    if (!trapResultAsDescriptor.configurable()) {
+        if (!isTargetPropertyDescriptorDefined || targetPropertyDescriptor.configurable()) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Result from 'getOwnPropertyDescriptor' can't be non-configurable when the 'target' doesn't have it as an own property or if it is a configurable own property on 'target'"));
+            return false;
+        }
+    }
+
+    if (trapResultAsDescriptor.isAccessorDescriptor()) {
+        GetterSetter* getterSetter = trapResultAsDescriptor.slowGetterSetter(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        slot.setGetterSlot(this, trapResultAsDescriptor.attributes(), getterSetter);
+    } else if (trapResultAsDescriptor.isDataDescriptor() && !trapResultAsDescriptor.value().isEmpty())
+        slot.setValue(this, trapResultAsDescriptor.attributes(), trapResultAsDescriptor.value());
+    else
+        slot.setValue(this, trapResultAsDescriptor.attributes(), jsUndefined()); // We use undefined because it's the default value in object properties.
+
+    return true;
+}
+
+bool ProxyObject::performHasProperty(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+    JSObject* target = this->target();
+    slot.setValue(this, None, jsUndefined()); // Nobody should rely on our value, but be safe and protect against any bad actors reading our value.
+
+    auto performDefaultHasProperty = [&] {
+        return target->methodTable(vm)->getOwnPropertySlot(target, exec, propertyName, slot);
+    };
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultHasProperty();
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue hasMethod = handler->getMethod(exec, callData, callType, vm.propertyNames->has, ASCIILiteral("'has' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    if (hasMethod.isUndefined()) {
+        scope.release();
+        return performDefaultHasProperty();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    JSValue trapResult = call(exec, hasMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!trapResultAsBool) {
+        PropertyDescriptor descriptor;
+        bool isPropertyDescriptorDefined = target->getOwnPropertyDescriptor(exec, propertyName, descriptor); 
+        RETURN_IF_EXCEPTION(scope, false);
+        if (isPropertyDescriptorDefined) {
+            if (!descriptor.configurable()) {
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'has' must return 'true' for non-configurable properties"));
+                return false;
+            }
+            bool isExtensible = target->isExtensible(exec);
+            RETURN_IF_EXCEPTION(scope, false);
+            if (!isExtensible) {
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'has' must return 'true' for a non-extensible 'target' object with a configurable property"));
+                return false;
+            }
+        }
+    }
+
+    return trapResultAsBool;
+}
+
+bool ProxyObject::getOwnPropertySlotCommon(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+    slot.disableCaching();
+    slot.setIsTaintedByOpaqueObject();
+    switch (slot.internalMethodType()) {
+    case PropertySlot::InternalMethodType::Get:
+        scope.release();
+        return performGet(exec, propertyName, slot);
+    case PropertySlot::InternalMethodType::GetOwnProperty:
+        scope.release();
+        return performInternalMethodGetOwnProperty(exec, propertyName, slot);
+    case PropertySlot::InternalMethodType::HasProperty:
+        scope.release();
+        return performHasProperty(exec, propertyName, slot);
+    default:
+        return false;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool ProxyObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    return thisObject->getOwnPropertySlotCommon(exec, propertyName, slot);
+}
+
+bool ProxyObject::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    Identifier ident = Identifier::from(exec, propertyName); 
+    return thisObject->getOwnPropertySlotCommon(exec, ident.impl(), slot);
+}
+
+template <typename PerformDefaultPutFunction>
+bool ProxyObject::performPut(ExecState* exec, JSValue putValue, JSValue thisValue, PropertyName propertyName, PerformDefaultPutFunction performDefaultPut)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultPut();
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue setMethod = handler->getMethod(exec, callData, callType, vm.propertyNames->set, ASCIILiteral("'set' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    JSObject* target = this->target();
+    if (setMethod.isUndefined()) {
+        scope.release();
+        return performDefaultPut();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    arguments.append(putValue);
+    arguments.append(thisValue);
+    JSValue trapResult = call(exec, setMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (!trapResultAsBool)
+        return false;
+
+    PropertyDescriptor descriptor;
+    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
+            if (!sameValue(exec, descriptor.value(), putValue)) {
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'"));
+                return false;
+            }
+        } else if (descriptor.isAccessorDescriptor() && !descriptor.configurable() && descriptor.setter().isUndefined()) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'set' method on a non-configurable accessor property without a setter should return false"));
+            return false;
+        }
+    }
+    return true;
+}
+
+bool ProxyObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    slot.disableCaching();
+
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    auto performDefaultPut = [&] () {
+        JSObject* target = jsCast<JSObject*>(thisObject->target());
+        return target->methodTable(vm)->put(target, exec, propertyName, value, slot);
+    };
+    return thisObject->performPut(exec, value, slot.thisValue(), propertyName, performDefaultPut);
+}
+
+bool ProxyObject::putByIndexCommon(ExecState* exec, JSValue thisValue, unsigned propertyName, JSValue putValue, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    Identifier ident = Identifier::from(exec, propertyName);
+    RETURN_IF_EXCEPTION(scope, false);
+    auto performDefaultPut = [&] () {
+        JSObject* target = this->target();
+        bool isStrictMode = shouldThrow;
+        PutPropertySlot slot(thisValue, isStrictMode); // We must preserve the "this" target of the putByIndex.
+        return target->methodTable(vm)->put(target, exec, ident.impl(), putValue, slot);
+    };
+    scope.release();
+    return performPut(exec, putValue, thisValue, ident.impl(), performDefaultPut);
+}
+
+bool ProxyObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    return thisObject->putByIndexCommon(exec, thisObject, propertyName, value, shouldThrow);
+}
+
+static EncodedJSValue JSC_HOST_CALL performProxyCall(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return encodedJSValue();
+    }
+    ProxyObject* proxy = jsCast<ProxyObject*>(exec->jsCallee());
+    JSValue handlerValue = proxy->handler();
+    if (handlerValue.isNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue applyMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "apply"), ASCIILiteral("'apply' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSObject* target = proxy->target();
+    if (applyMethod.isUndefined()) {
+        CallData callData;
+        CallType callType = target->methodTable(vm)->getCallData(target, callData);
+        RELEASE_ASSERT(callType != CallType::None);
+        scope.release();
+        return JSValue::encode(call(exec, target, callType, callData, exec->thisValue(), ArgList(exec)));
+    }
+
+    JSArray* argArray = constructArray(exec, static_cast<ArrayAllocationProfile*>(nullptr), ArgList(exec));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(exec->thisValue());
+    arguments.append(argArray);
+    scope.release();
+    return JSValue::encode(call(exec, applyMethod, callType, callData, handler, arguments));
+}
+
+CallType ProxyObject::getCallData(JSCell* cell, CallData& callData)
+{
+    ProxyObject* proxy = jsCast<ProxyObject*>(cell);
+    if (!proxy->m_isCallable) {
+        callData.js.functionExecutable = nullptr;
+        callData.js.scope = nullptr;
+        return CallType::None;
+    }
+
+    callData.native.function = performProxyCall;
+    return CallType::Host;
+}
+
+static EncodedJSValue JSC_HOST_CALL performProxyConstruct(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return encodedJSValue();
+    }
+    ProxyObject* proxy = jsCast<ProxyObject*>(exec->jsCallee());
+    JSValue handlerValue = proxy->handler();
+    if (handlerValue.isNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue constructMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "construct"), ASCIILiteral("'construct' property of a Proxy's handler should be constructible"));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSObject* target = proxy->target();
+    if (constructMethod.isUndefined()) {
+        ConstructData constructData;
+        ConstructType constructType = target->methodTable(vm)->getConstructData(target, constructData);
+        RELEASE_ASSERT(constructType != ConstructType::None);
+        scope.release();
+        return JSValue::encode(construct(exec, target, constructType, constructData, ArgList(exec), exec->newTarget()));
+    }
+
+    JSArray* argArray = constructArray(exec, static_cast<ArrayAllocationProfile*>(nullptr), ArgList(exec));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(argArray);
+    arguments.append(exec->newTarget());
+    JSValue result = call(exec, constructMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (!result.isObject())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Result from Proxy handler's 'construct' method should be an object"));
+    return JSValue::encode(result);
+}
+
+ConstructType ProxyObject::getConstructData(JSCell* cell, ConstructData& constructData)
+{
+    ProxyObject* proxy = jsCast<ProxyObject*>(cell);
+    if (!proxy->m_isConstructible) {
+        constructData.js.functionExecutable = nullptr;
+        constructData.js.scope = nullptr;
+        return ConstructType::None;
+    }
+
+    constructData.native.function = performProxyConstruct;
+    return ConstructType::Host;
+}
+
+template <typename DefaultDeleteFunction>
+bool ProxyObject::performDelete(ExecState* exec, PropertyName propertyName, DefaultDeleteFunction performDefaultDelete)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid()))) {
+        scope.release();
+        return performDefaultDelete();
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue deletePropertyMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "deleteProperty"), ASCIILiteral("'deleteProperty' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    JSObject* target = this->target();
+    if (deletePropertyMethod.isUndefined()) {
+        scope.release();
+        return performDefaultDelete();
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    JSValue trapResult = call(exec, deletePropertyMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!trapResultAsBool)
+        return false;
+
+    PropertyDescriptor descriptor;
+    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+        if (!descriptor.configurable()) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable"));
+            return false;
+        }
+    }
+
+    RETURN_IF_EXCEPTION(scope, false);
+
+    return true;
+}
+
+bool ProxyObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    auto performDefaultDelete = [&] () -> bool {
+        JSObject* target = thisObject->target();
+        return target->methodTable(exec->vm())->deleteProperty(target, exec, propertyName);
+    };
+    return thisObject->performDelete(exec, propertyName, performDefaultDelete);
+}
+
+bool ProxyObject::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned propertyName)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    Identifier ident = Identifier::from(exec, propertyName); 
+    auto performDefaultDelete = [&] () -> bool {
+        JSObject* target = thisObject->target();
+        return target->methodTable(exec->vm())->deletePropertyByIndex(target, exec, propertyName);
+    };
+    return thisObject->performDelete(exec, ident.impl(), performDefaultDelete);
+}
+
+bool ProxyObject::performPreventExtensions(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue preventExtensionsMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "preventExtensions"), ASCIILiteral("'preventExtensions' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+    JSObject* target = this->target();
+    if (preventExtensionsMethod.isUndefined()) {
+        scope.release();
+        return target->methodTable(vm)->preventExtensions(target, exec);
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    JSValue trapResult = call(exec, preventExtensionsMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (trapResultAsBool) {
+        bool targetIsExtensible = target->isExtensible(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        if (targetIsExtensible) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'preventExtensions' trap returned true even though its target is extensible. It should have returned false"));
+            return false;
+        }
+    }
+
+    return trapResultAsBool;
+}
+
+bool ProxyObject::preventExtensions(JSObject* object, ExecState* exec)
+{
+    return jsCast<ProxyObject*>(object)->performPreventExtensions(exec);
+}
+
+bool ProxyObject::performIsExtensible(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue isExtensibleMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "isExtensible"), ASCIILiteral("'isExtensible' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+
+    JSObject* target = this->target();
+    if (isExtensibleMethod.isUndefined()) {
+        scope.release();
+        return target->isExtensible(exec);
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    JSValue trapResult = call(exec, isExtensibleMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool isTargetExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (trapResultAsBool != isTargetExtensible) {
+        if (isTargetExtensible) {
+            ASSERT(!trapResultAsBool);
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy object's 'isExtensible' trap returned false when the target is extensible. It should have returned true"));
+        } else {
+            ASSERT(!isTargetExtensible);
+            ASSERT(trapResultAsBool);
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy object's 'isExtensible' trap returned true when the target is non-extensible. It should have returned false"));
+        }
+    }
+    
+    return trapResultAsBool;
+}
+
+bool ProxyObject::isExtensible(JSObject* object, ExecState* exec)
+{
+    return jsCast<ProxyObject*>(object)->performIsExtensible(exec);
+}
+
+bool ProxyObject::performDefineOwnProperty(ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    JSObject* target = this->target();
+    auto performDefaultDefineOwnProperty = [&] {
+        scope.release();
+        return target->methodTable(vm)->defineOwnProperty(target, exec, propertyName, descriptor, shouldThrow);
+    };
+
+    if (vm.propertyNames->isPrivateName(Identifier::fromUid(&vm, propertyName.uid())))
+        return performDefaultDefineOwnProperty();
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue definePropertyMethod = handler->getMethod(exec, callData, callType, vm.propertyNames->defineProperty, ASCIILiteral("'defineProperty' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (definePropertyMethod.isUndefined())
+        return performDefaultDefineOwnProperty();
+
+    JSObject* descriptorObject = constructObjectFromPropertyDescriptor(exec, descriptor);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
+    arguments.append(descriptorObject);
+    JSValue trapResult = call(exec, definePropertyMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    if (!trapResultAsBool)
+        return false;
+
+    PropertyDescriptor targetDescriptor;
+    bool isTargetDescriptorDefined = target->getOwnPropertyDescriptor(exec, propertyName, targetDescriptor);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool targetIsExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    bool settingConfigurableToFalse = descriptor.configurablePresent() && !descriptor.configurable();
+
+    if (!isTargetDescriptorDefined) {
+        if (!targetIsExtensible) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap returned true even though getOwnPropertyDescriptor of the Proxy's target returned undefined and the target is non-extensible"));
+            return false;
+        }
+        if (settingConfigurableToFalse) {
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap returned true for a non-configurable field even though getOwnPropertyDescriptor of the Proxy's target returned undefined"));
+            return false;
+        }
+
+        return true;
+    } 
+
+    ASSERT(isTargetDescriptorDefined);
+    bool isCurrentDefined = isTargetDescriptorDefined;
+    const PropertyDescriptor& current = targetDescriptor;
+    bool throwException = false;
+    bool isCompatibleDescriptor = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, targetIsExtensible, descriptor, isCurrentDefined, current, throwException);
+    RETURN_IF_EXCEPTION(scope, false);    
+    if (!isCompatibleDescriptor) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap did not define a property on its target that is compatible with the trap's input descriptor"));
+        return false;
+    }
+    if (settingConfigurableToFalse && targetDescriptor.configurable()) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap did not define a non-configurable property on its target even though the input descriptor to the trap said it must do so"));
+        return false;
+    }
+    
+    return true;
+}
+
+bool ProxyObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    return thisObject->performDefineOwnProperty(exec, propertyName, descriptor, shouldThrow);
+}
+
+void ProxyObject::performGetOwnPropertyNames(ExecState* exec, PropertyNameArray& trapResult, EnumerationMode enumerationMode)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return;
+    }
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue ownKeysMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "ownKeys"), ASCIILiteral("'ownKeys' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, void());
+    JSObject* target = this->target();
+    if (ownKeysMethod.isUndefined()) {
+        scope.release();
+        target->methodTable(vm)->getOwnPropertyNames(target, exec, trapResult, enumerationMode);
+        return;
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    JSValue arrayLikeObject = call(exec, ownKeysMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    PropertyNameMode propertyNameMode = trapResult.mode();
+    RuntimeTypeMask resultFilter = 0;
+    switch (propertyNameMode) {
+    case PropertyNameMode::Symbols:
+        resultFilter = TypeSymbol;
+        break;
+    case PropertyNameMode::Strings:
+        resultFilter = TypeString;
+        break;
+    case PropertyNameMode::StringsAndSymbols:
+        resultFilter = TypeSymbol | TypeString;
+        break;
+    }
+    ASSERT(resultFilter);
+    RuntimeTypeMask dontThrowAnExceptionTypeFilter = TypeString | TypeSymbol;
+    HashSet<UniquedStringImpl*> uncheckedResultKeys;
+
+    auto addPropName = [&] (JSValue value, RuntimeType type) -> bool {
+        static const bool doExitEarly = true;
+        static const bool dontExitEarly = false;
+
+        if (!(type & resultFilter))
+            return dontExitEarly;
+
+        Identifier ident = value.toPropertyKey(exec);
+        RETURN_IF_EXCEPTION(scope, doExitEarly);
+
+        uncheckedResultKeys.add(ident.impl());
+        trapResult.addUnchecked(ident.impl());
+        return dontExitEarly;
+    };
+
+    createListFromArrayLike(exec, arrayLikeObject, dontThrowAnExceptionTypeFilter, ASCIILiteral("Proxy handler's 'ownKeys' method must return an array-like object containing only Strings and Symbols"), addPropName);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    bool targetIsExensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, void());
+
+    PropertyNameArray targetKeys(&vm, propertyNameMode);
+    target->methodTable(vm)->getOwnPropertyNames(target, exec, targetKeys, enumerationMode);
+    RETURN_IF_EXCEPTION(scope, void());
+    Vector<UniquedStringImpl*> targetConfigurableKeys;
+    Vector<UniquedStringImpl*> targetNonConfigurableKeys;
+    for (const Identifier& ident : targetKeys) {
+        PropertyDescriptor descriptor;
+        bool isPropertyDefined = target->getOwnPropertyDescriptor(exec, ident.impl(), descriptor); 
+        RETURN_IF_EXCEPTION(scope, void());
+        if (isPropertyDefined && !descriptor.configurable())
+            targetNonConfigurableKeys.append(ident.impl());
+        else
+            targetConfigurableKeys.append(ident.impl());
+    }
+
+    enum ContainedIn { IsContainedIn, IsNotContainedIn };
+    auto removeIfContainedInUncheckedResultKeys = [&] (UniquedStringImpl* impl) -> ContainedIn {
+        auto iter = uncheckedResultKeys.find(impl);
+        if (iter == uncheckedResultKeys.end())
+            return IsNotContainedIn;
+
+        uncheckedResultKeys.remove(iter);
+        return IsContainedIn;
+    };
+
+    for (UniquedStringImpl* impl : targetNonConfigurableKeys) {
+        if (removeIfContainedInUncheckedResultKeys(impl) == IsNotContainedIn) {
+            throwVMTypeError(exec, scope, makeString("Proxy object's 'target' has the non-configurable property '", String(impl), "' that was not in the result from the 'ownKeys' trap"));
+            return;
+        }
+    }
+
+    if (targetIsExensible)
+        return;
+
+    for (UniquedStringImpl* impl : targetConfigurableKeys) {
+        if (removeIfContainedInUncheckedResultKeys(impl) == IsNotContainedIn) {
+            throwVMTypeError(exec, scope, makeString("Proxy object's non-extensible 'target' has configurable property '", String(impl), "' that was not in the result from the 'ownKeys' trap"));
+            return;
+        }
+    }
+
+    if (uncheckedResultKeys.size()) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'ownKeys' method returned a key that was not present in its non-extensible target"));
+        return;
+    }
+}
+
+void ProxyObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNameArray, EnumerationMode enumerationMode)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(object);
+    thisObject->performGetOwnPropertyNames(exec, propertyNameArray, enumerationMode);
+}
+
+void ProxyObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNameArray, EnumerationMode enumerationMode)
+{
+    JSObject::getPropertyNames(object, exec, propertyNameArray, enumerationMode);
+}
+
+void ProxyObject::getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ProxyObject::getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    // We should always go down the getOwnPropertyNames path.
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+void ProxyObject::getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool ProxyObject::performSetPrototype(ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
+{
+    ASSERT(prototype.isObject() || prototype.isNull());
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return false;
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return false;
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue setPrototypeOfMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "setPrototypeOf"), ASCIILiteral("'setPrototypeOf' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, false);
+
+    JSObject* target = this->target();
+    if (setPrototypeOfMethod.isUndefined()) {
+        scope.release();
+        return target->setPrototype(vm, exec, prototype, shouldThrowIfCantSet);
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    arguments.append(prototype);
+    JSValue trapResult = call(exec, setPrototypeOfMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, false);
+
+    bool trapResultAsBool = trapResult.toBoolean(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    
+    if (!trapResultAsBool) {
+        if (shouldThrowIfCantSet)
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'setPrototypeOf' returned false indicating it could not set the prototype value. The operation was expected to succeed"));
+        return false;
+    }
+
+    bool targetIsExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (targetIsExtensible)
+        return true;
+
+    JSValue targetPrototype = target->getPrototype(vm, exec);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (!sameValue(exec, prototype, targetPrototype)) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'setPrototypeOf' trap returned true when its target is non-extensible and the new prototype value is not the same as the current prototype value. It should have returned false"));
+        return false;
+    }
+
+    return true;
+}
+
+bool ProxyObject::setPrototype(JSObject* object, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
+{
+    return jsCast<ProxyObject*>(object)->performSetPrototype(exec, prototype, shouldThrowIfCantSet);
+}
+
+JSValue ProxyObject::performGetPrototype(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
+        return { };
+    }
+
+    JSValue handlerValue = this->handler();
+    if (handlerValue.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return { };
+    }
+
+    JSObject* handler = jsCast<JSObject*>(handlerValue);
+    CallData callData;
+    CallType callType;
+    JSValue getPrototypeOfMethod = handler->getMethod(exec, callData, callType, makeIdentifier(vm, "getPrototypeOf"), ASCIILiteral("'getPrototypeOf' property of a Proxy's handler should be callable"));
+    RETURN_IF_EXCEPTION(scope, { });
+
+    JSObject* target = this->target();
+    if (getPrototypeOfMethod.isUndefined()) {
+        scope.release();
+        return target->getPrototype(vm, exec);
+    }
+
+    MarkedArgumentBuffer arguments;
+    arguments.append(target);
+    JSValue trapResult = call(exec, getPrototypeOfMethod, callType, callData, handler, arguments);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    if (!trapResult.isObject() && !trapResult.isNull()) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'getPrototypeOf' trap should either return an object or null"));
+        return { };
+    }
+
+    bool targetIsExtensible = target->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, { });
+    if (targetIsExtensible)
+        return trapResult;
+
+    JSValue targetPrototype = target->getPrototype(vm, exec);
+    RETURN_IF_EXCEPTION(scope, { });
+    if (!sameValue(exec, targetPrototype, trapResult)) {
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'getPrototypeOf' trap for a non-extensible target should return the same value as the target's prototype"));
+        return { };
+    }
+
+    return trapResult;
+}
+
+JSValue ProxyObject::getPrototype(JSObject* object, ExecState* exec)
+{
+    return jsCast<ProxyObject*>(object)->performGetPrototype(exec);
+}
+
+void ProxyObject::revoke(VM& vm)
+{ 
+    // This should only ever be called once and we should strictly transition from Object to null.
+    RELEASE_ASSERT(!m_handler.get().isNull() && m_handler.get().isObject());
+    m_handler.set(vm, this, jsNull());
+}
+
+bool ProxyObject::isRevoked() const
+{
+    return handler().isNull();
+}
+
+void ProxyObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    ProxyObject* thisObject = jsCast<ProxyObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_target);
+    visitor.append(thisObject->m_handler);
+}
+
+} // namespace JSC
diff --git a/runtime/ProxyObject.h b/runtime/ProxyObject.h
new file mode 100644
index 0000000..dc2eae1
--- /dev/null
+++ b/runtime/ProxyObject.h
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSGlobalObject.h"
+#include "JSObject.h"
+#include "RuntimeType.h"
+
+namespace JSC {
+
+class ProxyObject : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    const static unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | TypeOfShouldCallGetCallData | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames | ProhibitsPropertyCaching;
+
+    static ProxyObject* create(ExecState* exec, JSGlobalObject* globalObject, JSValue target, JSValue handler)
+    {
+        VM& vm = exec->vm();
+        ProxyObject* proxy = new (NotNull, allocateCell<ProxyObject>(vm.heap)) ProxyObject(vm, ProxyObject::structureForTarget(globalObject, target));
+        proxy->finishCreation(vm, exec, target, handler);
+        return proxy;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, bool isCallable)
+    {
+        unsigned flags = StructureFlags;
+        if (isCallable)
+            flags |= (ImplementsHasInstance | ImplementsDefaultHasInstance);
+        Structure* result = Structure::create(vm, globalObject, prototype, TypeInfo(ProxyObjectType, flags), info(), NonArray | MayHaveIndexedAccessors);
+        result->setIsQuickPropertyAccessAllowedForEnumeration(false);
+        RELEASE_ASSERT(!result->canAccessPropertiesQuicklyForEnumeration());
+        RELEASE_ASSERT(!result->canCachePropertyNameEnumerator());
+        return result;
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    JSObject* target() const { return m_target.get(); }
+    JSValue handler() const { return m_handler.get(); }
+
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    static bool putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+    bool putByIndexCommon(ExecState*, JSValue thisValue, unsigned propertyName, JSValue putValue, bool shouldThrow);
+    JSValue performGetPrototype(ExecState*);
+    void revoke(VM&);
+    bool isRevoked() const;
+
+private:
+    ProxyObject(VM&, Structure*);
+    void finishCreation(VM&, ExecState*, JSValue target, JSValue handler);
+    static Structure* structureForTarget(JSGlobalObject*, JSValue target);
+
+    static String toStringName(const JSObject*, ExecState*);
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
+    static CallType getCallData(JSCell*, CallData&);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
+    static bool preventExtensions(JSObject*, ExecState*);
+    static bool isExtensible(JSObject*, ExecState*);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_CRASH void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_CRASH void getStructurePropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static NO_RETURN_DUE_TO_CRASH void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    static bool setPrototype(JSObject*, ExecState*, JSValue prototype, bool shouldThrowIfCantSet);
+    static JSValue getPrototype(JSObject*, ExecState*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    bool getOwnPropertySlotCommon(ExecState*, PropertyName, PropertySlot&);
+    bool performInternalMethodGetOwnProperty(ExecState*, PropertyName, PropertySlot&);
+    bool performGet(ExecState*, PropertyName, PropertySlot&);
+    bool performHasProperty(ExecState*, PropertyName, PropertySlot&);
+    template <typename DefaultDeleteFunction>
+    bool performDelete(ExecState*, PropertyName, DefaultDeleteFunction);
+    template <typename PerformDefaultPutFunction>
+    bool performPut(ExecState*, JSValue putValue, JSValue thisValue, PropertyName, PerformDefaultPutFunction);
+    bool performPreventExtensions(ExecState*);
+    bool performIsExtensible(ExecState*);
+    bool performDefineOwnProperty(ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+    void performGetOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode);
+    bool performSetPrototype(ExecState*, JSValue prototype, bool shouldThrowIfCantSet);
+
+    WriteBarrier<JSObject> m_target;
+    WriteBarrier<Unknown> m_handler;
+    bool m_isCallable : 1;
+    bool m_isConstructible : 1;
+};
+
+} // namespace JSC
diff --git a/runtime/ProxyRevoke.cpp b/runtime/ProxyRevoke.cpp
new file mode 100644
index 0000000..da6faa3
--- /dev/null
+++ b/runtime/ProxyRevoke.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyRevoke.h"
+
+#include "JSCInlines.h"
+#include "ProxyObject.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ProxyRevoke);
+
+const ClassInfo ProxyRevoke::s_info = { "ProxyRevoke", &Base::s_info, 0, CREATE_METHOD_TABLE(ProxyRevoke) };
+
+ProxyRevoke* ProxyRevoke::create(VM& vm, Structure* structure, ProxyObject* proxy)
+{
+    ProxyRevoke* revoke = new (NotNull, allocateCell<ProxyRevoke>(vm.heap)) ProxyRevoke(vm, structure);
+    revoke->finishCreation(vm, "revoke", proxy);
+    return revoke;
+}
+
+ProxyRevoke::ProxyRevoke(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void ProxyRevoke::finishCreation(VM& vm, const char* name, ProxyObject* proxy)
+{
+    Base::finishCreation(vm, String(name));
+    m_proxy.set(vm, this, proxy);
+
+    putDirect(vm, vm.propertyNames->length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
+}
+
+static EncodedJSValue JSC_HOST_CALL performProxyRevoke(ExecState* exec)
+{
+    ProxyRevoke* proxyRevoke = jsCast<ProxyRevoke*>(exec->jsCallee());
+    JSValue proxyValue = proxyRevoke->proxy();
+    if (proxyValue.isNull())
+        return JSValue::encode(jsUndefined());
+
+    ProxyObject* proxy = jsCast<ProxyObject*>(proxyValue);
+    VM& vm = exec->vm();
+    proxy->revoke(vm);
+    proxyRevoke->setProxyToNull(vm);
+    return JSValue::encode(jsUndefined());
+}
+
+CallType ProxyRevoke::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = performProxyRevoke;
+    return CallType::Host;
+}
+
+void ProxyRevoke::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    ProxyRevoke* thisObject = jsCast<ProxyRevoke*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_proxy);
+}
+
+} // namespace JSC
diff --git a/runtime/ProxyRevoke.h b/runtime/ProxyRevoke.h
new file mode 100644
index 0000000..e028a7d
--- /dev/null
+++ b/runtime/ProxyRevoke.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class ProxyObject;
+
+class ProxyRevoke : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static ProxyRevoke* create(VM&, Structure*, ProxyObject*);
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    { 
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+    void finishCreation(VM&, const char* name, ProxyObject*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    JSValue proxy() { return m_proxy.get(); }
+    void setProxyToNull(VM& vm) { return m_proxy.set(vm, this, jsNull()); }
+
+private:
+    ProxyRevoke(VM&, Structure*);
+    static CallType getCallData(JSCell*, CallData&);
+
+    WriteBarrier<Unknown> m_proxy;
+};
+
+} // namespace JSC
diff --git a/runtime/PureNaN.h b/runtime/PureNaN.h
new file mode 100644
index 0000000..85adc0c
--- /dev/null
+++ b/runtime/PureNaN.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/Assertions.h>
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+// NaN (not-a-number) double values are central to how JavaScriptCore encodes JavaScript
+// values (JSValues).  All values, including integers and non-numeric values, are always
+// encoded using the IEEE 754 binary double format.  Non-double values are encoded using
+// a NaN with the sign bit set.  The 51-bit payload is then used for encoding the actual
+// value - be it an integer or a pointer to an object, or something else. But we only
+// make use of the low 49 bits and the top 15 bits being all set to 1 is the indicator
+// that a value is not a double. Top 15 bits being set to 1 also indicate a signed
+// signaling NaN with some additional NaN payload bits.
+//
+// Our use of NaN encoding means that we have to be careful with how we use NaNs for
+// ordinary doubles. For example, it would be wrong to ever use a NaN that has the top
+// 15 bits set, as that would look like a non-double value to JSC.
+//
+// We can trust that on all of the hardware/OS combinations that we care about,
+// NaN-producing math operations never produce a NaN that looks like a tagged value. But
+// if we're ever in a situation where we worry about it, we can use purifyNaN() to get a
+// NaN that doesn't look like a tagged non-double value. The JavaScript language doesn't
+// distinguish between different flavors of NaN and there is no way to detect what kind
+// of NaN you have - hence so long as all double NaNs are purified then our tagging
+// scheme remains sound.
+//
+// It's worth noting that there are cases, like sin(), that will almost produce a NaN
+// that breaks us. sin(-inf) returns 0xfff8000000000000. This doesn't break us because
+// not all of the top 15 bits are set. But it's very close. Hence our assumptions about
+// NaN are just about the most aggressive assumptions we could possibly make without
+// having to call purifyNaN() in surprising places.
+//
+// For naming purposes, we say that a NaN is "pure" if it is safe to tag, in the sense
+// that doing so would result in a tagged value that would pass the "are you a double"
+// test. We say that a NaN is "impure" if attempting to tag it would result in a value
+// that would look like something other than a double.
+
+// Returns some kind of pure NaN.
+inline double pureNaN()
+{
+    // Be sure that we return exactly the kind of NaN that is safe. We engineer the bits
+    // ourselves to ensure that it's !isImpureNaN(). FWIW, this is what
+    // numeric_limits<double>::quiet_NaN() returns on Mac/X86_64. But AFAICT there is
+    // no guarantee that quiet_NaN would return a pureNaN on all platforms. For example,
+    // the docs appear to imply that quiet_NaN could even return a double with the
+    // signaling bit set on hardware that doesn't do signaling. That would probably
+    // never happen, but it's healthy to be paranoid.
+    return bitwise_cast<double>(0x7ff8000000000000ll);
+}
+
+#define PNaN (pureNaN())
+
+inline bool isImpureNaN(double value)
+{
+    // Tests if the double value would break JSVALUE64 encoding, which is the most
+    // aggressive kind of encoding that we currently use.
+    return bitwise_cast<uint64_t>(value) >= 0xfffe000000000000llu;
+}
+
+// If the given value is NaN then return a NaN that is known to be pure.
+inline double purifyNaN(double value)
+{
+    if (value != value)
+        return PNaN;
+    return value;
+}   
+
+} // namespace JSC
diff --git a/runtime/PutDirectIndexMode.h b/runtime/PutDirectIndexMode.h
new file mode 100644
index 0000000..606c962
--- /dev/null
+++ b/runtime/PutDirectIndexMode.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum PutDirectIndexMode { PutDirectIndexLikePutDirect, PutDirectIndexShouldNotThrow, PutDirectIndexShouldThrow };
+
+} // namespace JSC
diff --git a/runtime/PutPropertySlot.h b/runtime/PutPropertySlot.h
new file mode 100644
index 0000000..69c35d9
--- /dev/null
+++ b/runtime/PutPropertySlot.h
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2008-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "PropertySlot.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+    
+class JSObject;
+class JSFunction;
+    
+class PutPropertySlot {
+public:
+    enum Type { Uncachable, ExistingProperty, NewProperty, SetterProperty, CustomValue, CustomAccessor };
+    enum Context { UnknownContext, PutById, PutByIdEval };
+    typedef bool (*PutValueFunc)(ExecState*, EncodedJSValue thisObject, EncodedJSValue value);
+
+    PutPropertySlot(JSValue thisValue, bool isStrictMode = false, Context context = UnknownContext, bool isInitialization = false)
+        : m_type(Uncachable)
+        , m_base(0)
+        , m_thisValue(thisValue)
+        , m_offset(invalidOffset)
+        , m_isStrictMode(isStrictMode)
+        , m_isInitialization(isInitialization)
+        , m_context(context)
+        , m_cacheability(CachingAllowed)
+        , m_putFunction(nullptr)
+    {
+    }
+
+    void setExistingProperty(JSObject* base, PropertyOffset offset)
+    {
+        m_type = ExistingProperty;
+        m_base = base;
+        m_offset = offset;
+    }
+
+    void setNewProperty(JSObject* base, PropertyOffset offset)
+    {
+        m_type = NewProperty;
+        m_base = base;
+        m_offset = offset;
+    }
+
+    void setCustomValue(JSObject* base, PutValueFunc function)
+    {
+        m_type = CustomValue;
+        m_base = base;
+        m_putFunction = function;
+    }
+
+    void setCustomAccessor(JSObject* base, PutValueFunc function)
+    {
+        m_type = CustomAccessor;
+        m_base = base;
+        m_putFunction = function;
+    }
+
+    void setCacheableSetter(JSObject* base, PropertyOffset offset)
+    {
+        m_type = SetterProperty;
+        m_base = base;
+        m_offset = offset;
+    }
+
+    void setThisValue(JSValue thisValue)
+    {
+        m_thisValue = thisValue;
+    }
+
+    void setStrictMode(bool value)
+    {
+        m_isStrictMode = value;
+    }
+
+    PutValueFunc customSetter() const
+    {
+        ASSERT(isCacheableCustom());
+        return m_putFunction;
+    }
+
+    Context context() const { return static_cast<Context>(m_context); }
+
+    Type type() const { return m_type; }
+    JSObject* base() const { return m_base; }
+    JSValue thisValue() const { return m_thisValue; }
+
+    bool isStrictMode() const { return m_isStrictMode; }
+    bool isCacheablePut() const { return isCacheable() && (m_type == NewProperty || m_type == ExistingProperty); }
+    bool isCacheableSetter() const { return isCacheable() && m_type == SetterProperty; }
+    bool isCacheableCustom() const { return isCacheable() && (m_type == CustomValue || m_type == CustomAccessor); }
+    bool isCustomAccessor() const { return isCacheable() && m_type == CustomAccessor; }
+    bool isInitialization() const { return m_isInitialization; }
+
+    PropertyOffset cachedOffset() const
+    {
+        return m_offset;
+    }
+
+    void disableCaching()
+    {
+        m_cacheability = CachingDisallowed;
+    }
+
+private:
+    bool isCacheable() const { return m_cacheability == CachingAllowed; }
+
+    Type m_type;
+    JSObject* m_base;
+    JSValue m_thisValue;
+    PropertyOffset m_offset;
+    bool m_isStrictMode;
+    bool m_isInitialization;
+    uint8_t m_context;
+    CacheabilityType m_cacheability;
+    PutValueFunc m_putFunction;
+};
+
+} // namespace JSC
diff --git a/runtime/ReflectObject.cpp b/runtime/ReflectObject.cpp
new file mode 100644
index 0000000..ad43111
--- /dev/null
+++ b/runtime/ReflectObject.cpp
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ReflectObject.h"
+
+#include "BuiltinNames.h"
+#include "JSCInlines.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSPropertyNameIterator.h"
+#include "Lookup.h"
+#include "ObjectConstructor.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL reflectObjectConstruct(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectDefineProperty(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectEnumerate(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectGet(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectGetOwnPropertyDescriptor(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectGetPrototypeOf(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectIsExtensible(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectOwnKeys(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectPreventExtensions(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectSet(ExecState*);
+static EncodedJSValue JSC_HOST_CALL reflectObjectSetPrototypeOf(ExecState*);
+
+}
+
+#include "ReflectObject.lut.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ReflectObject);
+
+const ClassInfo ReflectObject::s_info = { "Object", &Base::s_info, &reflectObjectTable, CREATE_METHOD_TABLE(ReflectObject) };
+
+/* Source for ReflectObject.lut.h
+@begin reflectObjectTable
+    apply                    JSBuiltin                             DontEnum|Function 3
+    construct                reflectObjectConstruct                DontEnum|Function 2
+    defineProperty           reflectObjectDefineProperty           DontEnum|Function 3
+    deleteProperty           JSBuiltin                             DontEnum|Function 2
+    enumerate                reflectObjectEnumerate                DontEnum|Function 1
+    get                      reflectObjectGet                      DontEnum|Function 2
+    getOwnPropertyDescriptor reflectObjectGetOwnPropertyDescriptor DontEnum|Function 2
+    getPrototypeOf           reflectObjectGetPrototypeOf           DontEnum|Function 1
+    has                      JSBuiltin                             DontEnum|Function 2
+    isExtensible             reflectObjectIsExtensible             DontEnum|Function 1
+    ownKeys                  reflectObjectOwnKeys                  DontEnum|Function 1
+    preventExtensions        reflectObjectPreventExtensions        DontEnum|Function 1
+    set                      reflectObjectSet                      DontEnum|Function 3
+    setPrototypeOf           reflectObjectSetPrototypeOf           DontEnum|Function 2
+@end
+*/
+
+ReflectObject::ReflectObject(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void ReflectObject::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().ownKeysPrivateName(), reflectObjectOwnKeys, DontEnum | DontDelete | ReadOnly, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().getOwnPropertyDescriptorPrivateName(), reflectObjectGetOwnPropertyDescriptor, DontEnum | DontDelete | ReadOnly, 2);
+}
+
+// ------------------------------ Functions --------------------------------
+
+// https://tc39.github.io/ecma262/#sec-reflect.construct
+EncodedJSValue JSC_HOST_CALL reflectObjectConstruct(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.construct requires the first argument be a constructor")));
+
+    ConstructData constructData;
+    ConstructType constructType;
+    if (!target.isConstructor(constructType, constructData))
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.construct requires the first argument be a constructor")));
+
+    JSValue newTarget = target;
+    if (exec->argumentCount() >= 3) {
+        newTarget = exec->argument(2);
+        if (!newTarget.isConstructor())
+            return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.construct requires the third argument be a constructor if present")));
+    }
+
+    MarkedArgumentBuffer arguments;
+    JSObject* argumentsObject = jsDynamicCast<JSObject*>(exec->argument(1));
+    if (!argumentsObject)
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.construct requires the second argument be an object")));
+
+    createListFromArrayLike(exec, argumentsObject, RuntimeTypeMaskAllTypes, ASCIILiteral("This error must not be raised"), [&] (JSValue value, RuntimeType) -> bool {
+        arguments.append(value);
+        return false;
+    });
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    scope.release();
+    return JSValue::encode(construct(exec, target, constructType, constructData, arguments, newTarget));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.defineproperty
+EncodedJSValue JSC_HOST_CALL reflectObjectDefineProperty(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.defineProperty requires the first argument be an object")));
+    auto propertyName = exec->argument(1).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    PropertyDescriptor descriptor;
+    bool success = toPropertyDescriptor(exec, exec->argument(2), descriptor);
+    ASSERT(!scope.exception() == success);
+    if (UNLIKELY(!success))
+        return encodedJSValue();
+    ASSERT((descriptor.attributes() & Accessor) || (!descriptor.isAccessorDescriptor()));
+    ASSERT(!scope.exception());
+
+    // Reflect.defineProperty should not throw an error when the defineOwnProperty operation fails.
+    bool shouldThrow = false;
+    JSObject* targetObject = asObject(target);
+    scope.release();
+    return JSValue::encode(jsBoolean(targetObject->methodTable(vm)->defineOwnProperty(targetObject, exec, propertyName, descriptor, shouldThrow)));
+}
+
+// FIXME: Reflect.enumerate is removed in ECMA 2016 draft.
+// http://www.ecma-international.org/ecma-262/6.0/#sec-reflect.enumerate
+EncodedJSValue JSC_HOST_CALL reflectObjectEnumerate(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.enumerate requires the first argument be an object")));
+    scope.release();
+    return JSValue::encode(JSPropertyNameIterator::create(exec, exec->lexicalGlobalObject()->propertyNameIteratorStructure(), asObject(target)));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.get
+EncodedJSValue JSC_HOST_CALL reflectObjectGet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.get requires the first argument be an object")));
+
+    const Identifier propertyName = exec->argument(1).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue receiver = target;
+    if (exec->argumentCount() >= 3)
+        receiver = exec->argument(2);
+
+    PropertySlot slot(receiver, PropertySlot::InternalMethodType::Get);
+    scope.release();
+    return JSValue::encode(target.get(exec, propertyName, slot));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.getownpropertydescriptor
+EncodedJSValue JSC_HOST_CALL reflectObjectGetOwnPropertyDescriptor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.getOwnPropertyDescriptor requires the first argument be an object")));
+
+    auto key = exec->argument(1).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    scope.release();
+    return JSValue::encode(objectConstructorGetOwnPropertyDescriptor(exec, asObject(target), key));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.getprototypeof
+EncodedJSValue JSC_HOST_CALL reflectObjectGetPrototypeOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.getPrototypeOf requires the first argument be an object")));
+    scope.release();
+    return JSValue::encode(asObject(target)->getPrototype(vm, exec));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.isextensible
+EncodedJSValue JSC_HOST_CALL reflectObjectIsExtensible(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.isExtensible requires the first argument be an object")));
+
+    bool isExtensible = asObject(target)->isExtensible(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsBoolean(isExtensible));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.ownkeys
+EncodedJSValue JSC_HOST_CALL reflectObjectOwnKeys(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.ownKeys requires the first argument be an object")));
+    scope.release();
+    return JSValue::encode(ownPropertyKeys(exec, jsCast<JSObject*>(target), PropertyNameMode::StringsAndSymbols, DontEnumPropertiesMode::Include));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.preventextensions
+EncodedJSValue JSC_HOST_CALL reflectObjectPreventExtensions(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.preventExtensions requires the first argument be an object")));
+    JSObject* object = asObject(target);
+    bool result = object->methodTable(vm)->preventExtensions(object, exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsBoolean(result));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.set
+EncodedJSValue JSC_HOST_CALL reflectObjectSet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.set requires the first argument be an object")));
+    JSObject* targetObject = asObject(target);
+
+    auto propertyName = exec->argument(1).toPropertyKey(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue receiver = target;
+    if (exec->argumentCount() >= 4)
+        receiver = exec->argument(3);
+
+    // Do not raise any readonly errors that happen in strict mode.
+    bool shouldThrowIfCantSet = false;
+    PutPropertySlot slot(receiver, shouldThrowIfCantSet);
+    scope.release();
+    return JSValue::encode(jsBoolean(targetObject->methodTable(vm)->put(targetObject, exec, propertyName, exec->argument(2), slot)));
+}
+
+// https://tc39.github.io/ecma262/#sec-reflect.setprototypeof
+EncodedJSValue JSC_HOST_CALL reflectObjectSetPrototypeOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.setPrototypeOf requires the first argument be an object")));
+    JSValue proto = exec->argument(1);
+    if (!proto.isObject() && !proto.isNull())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.setPrototypeOf requires the second argument be either an object or null")));
+
+    JSObject* object = asObject(target);
+
+    bool shouldThrowIfCantSet = false;
+    bool didSetPrototype = object->setPrototype(vm, exec, proto, shouldThrowIfCantSet);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsBoolean(didSetPrototype));
+}
+
+} // namespace JSC
diff --git a/runtime/ReflectObject.h b/runtime/ReflectObject.h
new file mode 100644
index 0000000..a55ab18
--- /dev/null
+++ b/runtime/ReflectObject.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class ReflectObject : public JSNonFinalObject {
+private:
+    ReflectObject(VM&, Structure*);
+
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static ReflectObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        ReflectObject* object = new (NotNull, allocateCell<ReflectObject>(vm.heap)) ReflectObject(vm, structure);
+        object->finishCreation(vm, globalObject);
+        return object;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/RegExp.cpp b/runtime/RegExp.cpp
new file mode 100644
index 0000000..a372360
--- /dev/null
+++ b/runtime/RegExp.cpp
@@ -0,0 +1,478 @@
+/*
+ *  Copyright (C) 1999-2001, 2004 Harri Porten (porten@kde.org)
+ *  Copyright (c) 2007, 2008, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Torch Mobile, Inc.
+ *  Copyright (C) 2010 Peter Varga (pvarga@inf.u-szeged.hu), University of Szeged
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "RegExp.h"
+
+#include "Lexer.h"
+#include "JSCInlines.h"
+#include "RegExpCache.h"
+#include "RegExpInlines.h"
+#include "Yarr.h"
+#include "YarrJIT.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+const ClassInfo RegExp::s_info = { "RegExp", 0, 0, CREATE_METHOD_TABLE(RegExp) };
+
+RegExpFlags regExpFlags(const String& string)
+{
+    RegExpFlags flags = NoFlags;
+
+    for (unsigned i = 0; i < string.length(); ++i) {
+        switch (string[i]) {
+        case 'g':
+            if (flags & FlagGlobal)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagGlobal);
+            break;
+
+        case 'i':
+            if (flags & FlagIgnoreCase)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagIgnoreCase);
+            break;
+
+        case 'm':
+            if (flags & FlagMultiline)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagMultiline);
+            break;
+
+        case 'u':
+            if (flags & FlagUnicode)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagUnicode);
+            break;
+                
+        case 'y':
+            if (flags & FlagSticky)
+                return InvalidFlags;
+            flags = static_cast<RegExpFlags>(flags | FlagSticky);
+            break;
+
+        default:
+            return InvalidFlags;
+        }
+    }
+
+    return flags;
+}
+
+#if REGEXP_FUNC_TEST_DATA_GEN
+const char* const RegExpFunctionalTestCollector::s_fileName = "/tmp/RegExpTestsData";
+RegExpFunctionalTestCollector* RegExpFunctionalTestCollector::s_instance = 0;
+
+RegExpFunctionalTestCollector* RegExpFunctionalTestCollector::get()
+{
+    if (!s_instance)
+        s_instance = new RegExpFunctionalTestCollector();
+
+    return s_instance;
+}
+
+void RegExpFunctionalTestCollector::outputOneTest(RegExp* regExp, const String& s, int startOffset, int* ovector, int result)
+{
+    if ((!m_lastRegExp) || (m_lastRegExp != regExp)) {
+        m_lastRegExp = regExp;
+        fputc('/', m_file);
+        outputEscapedString(regExp->pattern(), true);
+        fputc('/', m_file);
+        if (regExp->global())
+            fputc('g', m_file);
+        if (regExp->ignoreCase())
+            fputc('i', m_file);
+        if (regExp->multiline())
+            fputc('m', m_file);
+        if (regExp->sticky())
+            fputc('y', m_file);
+        if (regExp->unicode())
+            fputc('u', m_file);
+        fprintf(m_file, "\n");
+    }
+
+    fprintf(m_file, " \"");
+    outputEscapedString(s);
+    fprintf(m_file, "\", %d, %d, (", startOffset, result);
+    for (unsigned i = 0; i <= regExp->numSubpatterns(); i++) {
+        int subpatternBegin = ovector[i * 2];
+        int subpatternEnd = ovector[i * 2 + 1];
+        if (subpatternBegin == -1)
+            subpatternEnd = -1;
+        fprintf(m_file, "%d, %d", subpatternBegin, subpatternEnd);
+        if (i < regExp->numSubpatterns())
+            fputs(", ", m_file);
+    }
+
+    fprintf(m_file, ")\n");
+    fflush(m_file);
+}
+
+RegExpFunctionalTestCollector::RegExpFunctionalTestCollector()
+{
+    m_file = fopen(s_fileName, "r+");
+    if  (!m_file)
+        m_file = fopen(s_fileName, "w+");
+
+    fseek(m_file, 0L, SEEK_END);
+}
+
+RegExpFunctionalTestCollector::~RegExpFunctionalTestCollector()
+{
+    fclose(m_file);
+    s_instance = 0;
+}
+
+void RegExpFunctionalTestCollector::outputEscapedString(const String& s, bool escapeSlash)
+{
+    int len = s.length();
+    
+    for (int i = 0; i < len; ++i) {
+        UChar c = s[i];
+
+        switch (c) {
+        case '\0':
+            fputs("\\0", m_file);
+            break;
+        case '\a':
+            fputs("\\a", m_file);
+            break;
+        case '\b':
+            fputs("\\b", m_file);
+            break;
+        case '\f':
+            fputs("\\f", m_file);
+            break;
+        case '\n':
+            fputs("\\n", m_file);
+            break;
+        case '\r':
+            fputs("\\r", m_file);
+            break;
+        case '\t':
+            fputs("\\t", m_file);
+            break;
+        case '\v':
+            fputs("\\v", m_file);
+            break;
+        case '/':
+            if (escapeSlash)
+                fputs("\\/", m_file);
+            else
+                fputs("/", m_file);
+            break;
+        case '\"':
+            fputs("\\\"", m_file);
+            break;
+        case '\\':
+            fputs("\\\\", m_file);
+            break;
+        case '\?':
+            fputs("\?", m_file);
+            break;
+        default:
+            if (c > 0x7f)
+                fprintf(m_file, "\\u%04x", c);
+            else 
+                fputc(c, m_file);
+            break;
+        }
+    }
+}
+#endif
+
+RegExp::RegExp(VM& vm, const String& patternString, RegExpFlags flags)
+    : JSCell(vm, vm.regExpStructure.get())
+    , m_state(NotCompiled)
+    , m_patternString(patternString)
+    , m_flags(flags)
+    , m_constructionError(0)
+    , m_numSubpatterns(0)
+#if ENABLE(REGEXP_TRACING)
+    , m_rtMatchOnlyTotalSubjectStringLen(0.0)
+    , m_rtMatchTotalSubjectStringLen(0.0)
+    , m_rtMatchOnlyCallCount(0)
+    , m_rtMatchOnlyFoundCount(0)
+    , m_rtMatchCallCount(0)
+    , m_rtMatchFoundCount(0)
+#endif
+{
+}
+
+void RegExp::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    Yarr::YarrPattern pattern(m_patternString, m_flags, &m_constructionError, vm.stackLimit());
+    if (!isValid())
+        m_state = ParseError;
+    else
+        m_numSubpatterns = pattern.m_numSubpatterns;
+}
+
+void RegExp::destroy(JSCell* cell)
+{
+    RegExp* thisObject = static_cast<RegExp*>(cell);
+#if REGEXP_FUNC_TEST_DATA_GEN
+    RegExpFunctionalTestCollector::get()->clearRegExp(this);
+#endif
+    thisObject->RegExp::~RegExp();
+}
+
+size_t RegExp::estimatedSize(JSCell* cell)
+{
+    RegExp* thisObject = static_cast<RegExp*>(cell);
+    size_t regexDataSize = thisObject->m_regExpBytecode ? thisObject->m_regExpBytecode->estimatedSizeInBytes() : 0;
+#if ENABLE(YARR_JIT)
+    regexDataSize += thisObject->m_regExpJITCode.size();
+#endif
+    return Base::estimatedSize(cell) + regexDataSize;
+}
+
+RegExp* RegExp::createWithoutCaching(VM& vm, const String& patternString, RegExpFlags flags)
+{
+    RegExp* regExp = new (NotNull, allocateCell<RegExp>(vm.heap)) RegExp(vm, patternString, flags);
+    regExp->finishCreation(vm);
+    return regExp;
+}
+
+RegExp* RegExp::create(VM& vm, const String& patternString, RegExpFlags flags)
+{
+    return vm.regExpCache()->lookupOrCreate(patternString, flags);
+}
+
+void RegExp::compile(VM* vm, Yarr::YarrCharSize charSize)
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    Yarr::YarrPattern pattern(m_patternString, m_flags, &m_constructionError, vm->stackLimit());
+    if (m_constructionError) {
+        RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+        m_state = ParseError;
+        return;
+#endif
+    }
+    ASSERT(m_numSubpatterns == pattern.m_numSubpatterns);
+
+    if (!hasCode()) {
+        ASSERT(m_state == NotCompiled);
+        vm->regExpCache()->addToStrongCache(this);
+        m_state = ByteCode;
+    }
+
+#if ENABLE(YARR_JIT)
+    if (!pattern.m_containsBackreferences && !pattern.containsUnsignedLengthPattern() && !unicode() && vm->canUseRegExpJIT()) {
+        Yarr::jitCompile(pattern, charSize, vm, m_regExpJITCode);
+        if (!m_regExpJITCode.isFallBack()) {
+            m_state = JITCode;
+            return;
+        }
+    }
+#else
+    UNUSED_PARAM(charSize);
+#endif
+
+    m_state = ByteCode;
+    m_regExpBytecode = Yarr::byteCompile(pattern, &vm->m_regExpAllocator, &vm->m_regExpAllocatorLock);
+}
+
+int RegExp::match(VM& vm, const String& s, unsigned startOffset, Vector<int>& ovector)
+{
+    return matchInline(vm, s, startOffset, ovector);
+}
+
+bool RegExp::matchConcurrently(
+    VM& vm, const String& s, unsigned startOffset, int& position, Vector<int>& ovector)
+{
+    ConcurrentJSLocker locker(m_lock);
+
+    if (!hasCodeFor(s.is8Bit() ? Yarr::Char8 : Yarr::Char16))
+        return false;
+
+    position = match(vm, s, startOffset, ovector);
+    return true;
+}
+
+void RegExp::compileMatchOnly(VM* vm, Yarr::YarrCharSize charSize)
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    Yarr::YarrPattern pattern(m_patternString, m_flags, &m_constructionError, vm->stackLimit());
+    if (m_constructionError) {
+        RELEASE_ASSERT_NOT_REACHED();
+#if COMPILER_QUIRK(CONSIDERS_UNREACHABLE_CODE)
+        m_state = ParseError;
+        return;
+#endif
+    }
+    ASSERT(m_numSubpatterns == pattern.m_numSubpatterns);
+
+    if (!hasCode()) {
+        ASSERT(m_state == NotCompiled);
+        vm->regExpCache()->addToStrongCache(this);
+        m_state = ByteCode;
+    }
+
+#if ENABLE(YARR_JIT)
+    if (!pattern.m_containsBackreferences && !pattern.containsUnsignedLengthPattern() && !unicode() && vm->canUseRegExpJIT()) {
+        Yarr::jitCompile(pattern, charSize, vm, m_regExpJITCode, Yarr::MatchOnly);
+        if (!m_regExpJITCode.isFallBack()) {
+            m_state = JITCode;
+            return;
+        }
+    }
+#else
+    UNUSED_PARAM(charSize);
+#endif
+
+    m_state = ByteCode;
+    m_regExpBytecode = Yarr::byteCompile(pattern, &vm->m_regExpAllocator, &vm->m_regExpAllocatorLock);
+}
+
+MatchResult RegExp::match(VM& vm, const String& s, unsigned startOffset)
+{
+    return matchInline(vm, s, startOffset);
+}
+
+bool RegExp::matchConcurrently(VM& vm, const String& s, unsigned startOffset, MatchResult& result)
+{
+    ConcurrentJSLocker locker(m_lock);
+
+    if (!hasMatchOnlyCodeFor(s.is8Bit() ? Yarr::Char8 : Yarr::Char16))
+        return false;
+
+    result = match(vm, s, startOffset);
+    return true;
+}
+
+void RegExp::deleteCode()
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    if (!hasCode())
+        return;
+    m_state = NotCompiled;
+#if ENABLE(YARR_JIT)
+    m_regExpJITCode.clear();
+#endif
+    m_regExpBytecode = nullptr;
+}
+
+#if ENABLE(YARR_JIT_DEBUG)
+void RegExp::matchCompareWithInterpreter(const String& s, int startOffset, int* offsetVector, int jitResult)
+{
+    int offsetVectorSize = (m_numSubpatterns + 1) * 2;
+    Vector<int> interpreterOvector;
+    interpreterOvector.resize(offsetVectorSize);
+    int* interpreterOffsetVector = interpreterOvector.data();
+    int interpreterResult = 0;
+    int differences = 0;
+
+    // Initialize interpreterOffsetVector with the return value (index 0) and the 
+    // first subpattern start indicies (even index values) set to -1.
+    // No need to init the subpattern end indicies.
+    for (unsigned j = 0, i = 0; i < m_numSubpatterns + 1; j += 2, i++)
+        interpreterOffsetVector[j] = -1;
+
+    interpreterResult = Yarr::interpret(m_regExpBytecode.get(), s, startOffset, interpreterOffsetVector);
+
+    if (jitResult != interpreterResult)
+        differences++;
+
+    for (unsigned j = 2, i = 0; i < m_numSubpatterns; j +=2, i++)
+        if ((offsetVector[j] != interpreterOffsetVector[j])
+            || ((offsetVector[j] >= 0) && (offsetVector[j+1] != interpreterOffsetVector[j+1])))
+            differences++;
+
+    if (differences) {
+        dataLogF("RegExp Discrepency for /%s/\n    string input ", pattern().utf8().data());
+        unsigned segmentLen = s.length() - static_cast<unsigned>(startOffset);
+
+        dataLogF((segmentLen < 150) ? "\"%s\"\n" : "\"%148s...\"\n", s.utf8().data() + startOffset);
+
+        if (jitResult != interpreterResult) {
+            dataLogF("    JIT result = %d, blah interpreted result = %d\n", jitResult, interpreterResult);
+            differences--;
+        } else {
+            dataLogF("    Correct result = %d\n", jitResult);
+        }
+
+        if (differences) {
+            for (unsigned j = 2, i = 0; i < m_numSubpatterns; j +=2, i++) {
+                if (offsetVector[j] != interpreterOffsetVector[j])
+                    dataLogF("    JIT offset[%d] = %d, interpreted offset[%d] = %d\n", j, offsetVector[j], j, interpreterOffsetVector[j]);
+                if ((offsetVector[j] >= 0) && (offsetVector[j+1] != interpreterOffsetVector[j+1]))
+                    dataLogF("    JIT offset[%d] = %d, interpreted offset[%d] = %d\n", j+1, offsetVector[j+1], j+1, interpreterOffsetVector[j+1]);
+            }
+        }
+    }
+}
+#endif
+
+#if ENABLE(REGEXP_TRACING)
+    void RegExp::printTraceData()
+    {
+        char formattedPattern[41];
+        char rawPattern[41];
+
+        strncpy(rawPattern, pattern().utf8().data(), 40);
+        rawPattern[40]= '\0';
+
+        int pattLen = strlen(rawPattern);
+
+        snprintf(formattedPattern, 41, (pattLen <= 38) ? "/%.38s/" : "/%.36s...", rawPattern);
+
+#if ENABLE(YARR_JIT)
+        Yarr::YarrCodeBlock& codeBlock = m_regExpJITCode;
+
+        const size_t jitAddrSize = 20;
+        char jit8BitMatchOnlyAddr[jitAddrSize];
+        char jit16BitMatchOnlyAddr[jitAddrSize];
+        char jit8BitMatchAddr[jitAddrSize];
+        char jit16BitMatchAddr[jitAddrSize];
+        if (m_state == ByteCode) {
+            snprintf(jit8BitMatchOnlyAddr, jitAddrSize, "fallback    ");
+            snprintf(jit16BitMatchOnlyAddr, jitAddrSize, "----      ");
+            snprintf(jit8BitMatchAddr, jitAddrSize, "fallback    ");
+            snprintf(jit16BitMatchAddr, jitAddrSize, "----      ");
+        } else {
+            snprintf(jit8BitMatchOnlyAddr, jitAddrSize, "0x%014lx", reinterpret_cast<unsigned long int>(codeBlock.get8BitMatchOnlyAddr()));
+            snprintf(jit16BitMatchOnlyAddr, jitAddrSize, "0x%014lx", reinterpret_cast<unsigned long int>(codeBlock.get16BitMatchOnlyAddr()));
+            snprintf(jit8BitMatchAddr, jitAddrSize, "0x%014lx", reinterpret_cast<unsigned long int>(codeBlock.get8BitMatchAddr()));
+            snprintf(jit16BitMatchAddr, jitAddrSize, "0x%014lx", reinterpret_cast<unsigned long int>(codeBlock.get16BitMatchAddr()));
+        }
+#else
+        const char* jit8BitMatchOnlyAddr = "JIT Off";
+        const char* jit16BitMatchOnlyAddr = "";
+        const char* jit8BitMatchAddr = "JIT Off";
+        const char* jit16BitMatchAddr = "";
+#endif
+        unsigned averageMatchOnlyStringLen = (unsigned)(m_rtMatchOnlyTotalSubjectStringLen / m_rtMatchOnlyCallCount);
+        unsigned averageMatchStringLen = (unsigned)(m_rtMatchTotalSubjectStringLen / m_rtMatchCallCount);
+
+        printf("%-40.40s %16.16s %16.16s %10d %10d %10u\n", formattedPattern, jit8BitMatchOnlyAddr, jit16BitMatchOnlyAddr, m_rtMatchOnlyCallCount, m_rtMatchOnlyFoundCount, averageMatchOnlyStringLen);
+        printf("                                         %16.16s %16.16s %10d %10d %10u\n", jit8BitMatchAddr, jit16BitMatchAddr, m_rtMatchCallCount, m_rtMatchFoundCount, averageMatchStringLen);
+    }
+#endif
+
+} // namespace JSC
diff --git a/runtime/RegExp.h b/runtime/RegExp.h
new file mode 100644
index 0000000..bbe93f5
--- /dev/null
+++ b/runtime/RegExp.h
@@ -0,0 +1,153 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007, 2008, 2009, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "ExecutableAllocator.h"
+#include "MatchResult.h"
+#include "RegExpKey.h"
+#include "Structure.h"
+#include "yarr/Yarr.h"
+#include <wtf/Forward.h>
+#include <wtf/text/WTFString.h>
+
+#if ENABLE(YARR_JIT)
+#include "yarr/YarrJIT.h"
+#endif
+
+namespace JSC {
+
+struct RegExpRepresentation;
+class VM;
+
+JS_EXPORT_PRIVATE RegExpFlags regExpFlags(const String&);
+
+class RegExp final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    JS_EXPORT_PRIVATE static RegExp* create(VM&, const String& pattern, RegExpFlags);
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+    static size_t estimatedSize(JSCell*);
+
+    bool global() const { return m_flags & FlagGlobal; }
+    bool ignoreCase() const { return m_flags & FlagIgnoreCase; }
+    bool multiline() const { return m_flags & FlagMultiline; }
+    bool sticky() const { return m_flags & FlagSticky; }
+    bool globalOrSticky() const { return global() || sticky(); }
+    bool unicode() const { return m_flags & FlagUnicode; }
+
+    const String& pattern() const { return m_patternString; }
+
+    bool isValid() const { return !m_constructionError && m_flags != InvalidFlags; }
+    const char* errorMessage() const { return m_constructionError; }
+
+    JS_EXPORT_PRIVATE int match(VM&, const String&, unsigned startOffset, Vector<int>& ovector);
+
+    // Returns false if we couldn't run the regular expression for any reason.
+    bool matchConcurrently(VM&, const String&, unsigned startOffset, int& position, Vector<int>& ovector);
+    
+    JS_EXPORT_PRIVATE MatchResult match(VM&, const String&, unsigned startOffset);
+
+    bool matchConcurrently(VM&, const String&, unsigned startOffset, MatchResult&);
+
+    // Call these versions of the match functions if you're desperate for performance.
+    template<typename VectorType>
+    int matchInline(VM&, const String&, unsigned startOffset, VectorType& ovector);
+    MatchResult matchInline(VM&, const String&, unsigned startOffset);
+    
+    unsigned numSubpatterns() const { return m_numSubpatterns; }
+
+    bool hasCode()
+    {
+        return m_state != NotCompiled;
+    }
+
+    bool hasCodeFor(Yarr::YarrCharSize);
+    bool hasMatchOnlyCodeFor(Yarr::YarrCharSize);
+
+    void deleteCode();
+
+#if ENABLE(REGEXP_TRACING)
+    void printTraceData();
+#endif
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+    RegExpKey key() { return RegExpKey(m_flags, m_patternString); }
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    friend class RegExpCache;
+    RegExp(VM&, const String&, RegExpFlags);
+
+    static RegExp* createWithoutCaching(VM&, const String&, RegExpFlags);
+
+    enum RegExpState {
+        ParseError,
+        JITCode,
+        ByteCode,
+        NotCompiled
+    };
+
+    RegExpState m_state;
+
+    void compile(VM*, Yarr::YarrCharSize);
+    void compileIfNecessary(VM&, Yarr::YarrCharSize);
+
+    void compileMatchOnly(VM*, Yarr::YarrCharSize);
+    void compileIfNecessaryMatchOnly(VM&, Yarr::YarrCharSize);
+
+#if ENABLE(YARR_JIT_DEBUG)
+    void matchCompareWithInterpreter(const String&, int startOffset, int* offsetVector, int jitResult);
+#endif
+
+    String m_patternString;
+    RegExpFlags m_flags;
+    const char* m_constructionError;
+    unsigned m_numSubpatterns;
+#if ENABLE(REGEXP_TRACING)
+    double m_rtMatchOnlyTotalSubjectStringLen;
+    double m_rtMatchTotalSubjectStringLen;
+    unsigned m_rtMatchOnlyCallCount;
+    unsigned m_rtMatchOnlyFoundCount;
+    unsigned m_rtMatchCallCount;
+    unsigned m_rtMatchFoundCount;
+#endif
+    ConcurrentJSLock m_lock;
+
+#if ENABLE(YARR_JIT)
+    Yarr::YarrCodeBlock m_regExpJITCode;
+#endif
+    std::unique_ptr<Yarr::BytecodePattern> m_regExpBytecode;
+};
+
+} // namespace JSC
diff --git a/runtime/RegExpCache.cpp b/runtime/RegExpCache.cpp
new file mode 100644
index 0000000..8f4660a
--- /dev/null
+++ b/runtime/RegExpCache.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2010 University of Szeged
+ * Copyright (C) 2010 Renata Hodovan (hodovan@inf.u-szeged.hu)
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RegExpCache.h"
+
+#include "JSCInlines.h"
+#include "RegExpObject.h"
+#include "StrongInlines.h"
+
+namespace JSC {
+
+RegExp* RegExpCache::lookupOrCreate(const String& patternString, RegExpFlags flags)
+{
+    RegExpKey key(flags, patternString);
+    if (RegExp* regExp = m_weakCache.get(key))
+        return regExp;
+
+    RegExp* regExp = RegExp::createWithoutCaching(*m_vm, patternString, flags);
+#if ENABLE(REGEXP_TRACING)
+    m_vm->addRegExpToTrace(regExp);
+#endif
+
+    weakAdd(m_weakCache, key, Weak<RegExp>(regExp, this));
+    return regExp;
+}
+
+RegExpCache::RegExpCache(VM* vm)
+    : m_nextEntryInStrongCache(0)
+    , m_vm(vm)
+{
+}
+
+void RegExpCache::finalize(Handle<Unknown> handle, void*)
+{
+    RegExp* regExp = static_cast<RegExp*>(handle.get().asCell());
+    weakRemove(m_weakCache, regExp->key(), regExp);
+}
+
+void RegExpCache::addToStrongCache(RegExp* regExp)
+{
+    String pattern = regExp->pattern();
+    if (pattern.length() > maxStrongCacheablePatternLength)
+        return;
+    m_strongCache[m_nextEntryInStrongCache].set(*m_vm, regExp);
+    m_nextEntryInStrongCache++;
+    if (m_nextEntryInStrongCache == maxStrongCacheableEntries)
+        m_nextEntryInStrongCache = 0;
+}
+
+void RegExpCache::deleteAllCode()
+{
+    for (int i = 0; i < maxStrongCacheableEntries; i++)
+        m_strongCache[i].clear();
+    m_nextEntryInStrongCache = 0;
+
+    RegExpCacheMap::iterator end = m_weakCache.end();
+    for (RegExpCacheMap::iterator it = m_weakCache.begin(); it != end; ++it) {
+        RegExp* regExp = it->value.get();
+        if (!regExp) // Skip zombies.
+            continue;
+        regExp->deleteCode();
+    }
+}
+
+}
diff --git a/runtime/RegExpCache.h b/runtime/RegExpCache.h
new file mode 100644
index 0000000..4ae95f0
--- /dev/null
+++ b/runtime/RegExpCache.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 University of Szeged
+ * Copyright (C) 2010 Renata Hodovan (hodovan@inf.u-szeged.hu)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "RegExp.h"
+#include "RegExpKey.h"
+#include "Strong.h"
+#include "Weak.h"
+#include <array>
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class RegExpCache : private WeakHandleOwner {
+    WTF_MAKE_FAST_ALLOCATED;
+
+    friend class RegExp;
+    typedef HashMap<RegExpKey, Weak<RegExp>> RegExpCacheMap;
+
+public:
+    RegExpCache(VM* vm);
+    void deleteAllCode();
+
+private:
+    
+    static const unsigned maxStrongCacheablePatternLength = 256;
+
+    static const int maxStrongCacheableEntries = 32;
+
+    void finalize(Handle<Unknown>, void* context) override;
+
+    RegExp* lookupOrCreate(const WTF::String& patternString, RegExpFlags);
+    void addToStrongCache(RegExp*);
+    RegExpCacheMap m_weakCache; // Holds all regular expressions currently live.
+    int m_nextEntryInStrongCache;
+    std::array<Strong<RegExp>, maxStrongCacheableEntries> m_strongCache; // Holds a select few regular expressions that have compiled and executed
+    VM* m_vm;
+};
+
+} // namespace JSC
diff --git a/runtime/RegExpCachedResult.cpp b/runtime/RegExpCachedResult.cpp
new file mode 100644
index 0000000..7dbaf05
--- /dev/null
+++ b/runtime/RegExpCachedResult.cpp
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegExpCachedResult.h"
+
+#include "JSCInlines.h"
+#include "RegExpMatchesArray.h"
+
+namespace JSC {
+
+void RegExpCachedResult::visitChildren(SlotVisitor& visitor)
+{
+    visitor.append(m_lastInput);
+    visitor.append(m_lastRegExp);
+    if (m_reified) {
+        visitor.append(m_reifiedInput);
+        visitor.append(m_reifiedResult);
+        visitor.append(m_reifiedLeftContext);
+        visitor.append(m_reifiedRightContext);
+    }
+}
+
+JSArray* RegExpCachedResult::lastResult(ExecState* exec, JSObject* owner)
+{
+    if (!m_reified) {
+        m_reifiedInput.set(exec->vm(), owner, m_lastInput.get());
+        if (m_result)
+            m_reifiedResult.setWithoutWriteBarrier(createRegExpMatchesArray(exec, exec->lexicalGlobalObject(), m_lastInput.get(), m_lastRegExp.get(), m_result.start));
+        else
+            m_reifiedResult.setWithoutWriteBarrier(createEmptyRegExpMatchesArray(exec->lexicalGlobalObject(), m_lastInput.get(), m_lastRegExp.get()));
+        m_reifiedLeftContext.clear();
+        m_reifiedRightContext.clear();
+        m_reified = true;
+        exec->vm().heap.writeBarrier(owner);
+    }
+    return m_reifiedResult.get();
+}
+
+JSString* RegExpCachedResult::leftContext(ExecState* exec, JSObject* owner)
+{
+    // Make sure we're reified.
+    lastResult(exec, owner);
+    if (!m_reifiedLeftContext)
+        m_reifiedLeftContext.set(exec->vm(), owner, m_result.start ? jsSubstring(exec, m_reifiedInput.get(), 0, m_result.start) : jsEmptyString(exec));
+    return m_reifiedLeftContext.get();
+}
+
+JSString* RegExpCachedResult::rightContext(ExecState* exec, JSObject* owner)
+{
+    // Make sure we're reified.
+    lastResult(exec, owner);
+    if (!m_reifiedRightContext) {
+        unsigned length = m_reifiedInput->length();
+        m_reifiedRightContext.set(exec->vm(), owner, m_result.end != length ? jsSubstring(exec, m_reifiedInput.get(), m_result.end, length - m_result.end) : jsEmptyString(exec));
+    }
+    return m_reifiedRightContext.get();
+}
+
+void RegExpCachedResult::setInput(ExecState* exec, JSObject* owner, JSString* input)
+{
+    // Make sure we're reified, otherwise m_reifiedInput will be ignored.
+    lastResult(exec, owner);
+    ASSERT(m_reified);
+    m_reifiedInput.set(exec->vm(), owner, input);
+}
+
+} // namespace JSC
diff --git a/runtime/RegExpCachedResult.h b/runtime/RegExpCachedResult.h
new file mode 100644
index 0000000..40cc064
--- /dev/null
+++ b/runtime/RegExpCachedResult.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "RegExpObject.h"
+
+namespace JSC {
+
+class JSArray;
+class JSString;
+
+// RegExpCachedResult is used to track the cached results of the last
+// match, stores on the RegExp constructor (e.g. $&, $_, $1, $2 ...).
+// These values will be lazily generated on demand, so the cached result
+// may be in a lazy or reified state. A lazy state is indicated by a
+// value of m_result indicating a successful match, and a reified state
+// is indicated by setting m_result to MatchResult::failed().
+// Following a successful match, m_result, m_lastInput and m_lastRegExp
+// can be used to reify the results from the match, following reification
+// m_reifiedResult and m_reifiedInput hold the cached results.
+class RegExpCachedResult {
+public:
+    RegExpCachedResult(VM& vm, JSObject* owner, RegExp* emptyRegExp)
+        : m_result(0, 0)
+        , m_reified(false)
+    {
+        m_lastInput.set(vm, owner, jsEmptyString(&vm));
+        m_lastRegExp.set(vm, owner, emptyRegExp);
+    }
+
+    ALWAYS_INLINE void record(VM& vm, JSObject* owner, RegExp* regExp, JSString* input, MatchResult result)
+    {
+        vm.heap.writeBarrier(owner);
+        m_lastRegExp.setWithoutWriteBarrier(regExp);
+        m_lastInput.setWithoutWriteBarrier(input);
+        m_result = result;
+        m_reified = false;
+    }
+
+    JSArray* lastResult(ExecState*, JSObject* owner);
+    void setInput(ExecState*, JSObject* owner, JSString*);
+
+    JSString* leftContext(ExecState*, JSObject* owner);
+    JSString* rightContext(ExecState*, JSObject* owner);
+
+    JSString* input()
+    {
+        return m_reified ? m_reifiedInput.get() : m_lastInput.get();
+    }
+
+    void visitChildren(SlotVisitor&);
+
+    static ptrdiff_t offsetOfLastRegExp() { return OBJECT_OFFSETOF(RegExpCachedResult, m_lastRegExp); }
+    static ptrdiff_t offsetOfLastInput() { return OBJECT_OFFSETOF(RegExpCachedResult, m_lastInput); }
+    static ptrdiff_t offsetOfResult() { return OBJECT_OFFSETOF(RegExpCachedResult, m_result); }
+    static ptrdiff_t offsetOfReified() { return OBJECT_OFFSETOF(RegExpCachedResult, m_reified); }
+
+private:
+    MatchResult m_result;
+    bool m_reified;
+    WriteBarrier<JSString> m_lastInput;
+    WriteBarrier<RegExp> m_lastRegExp;
+    WriteBarrier<JSArray> m_reifiedResult;
+    WriteBarrier<JSString> m_reifiedInput;
+    WriteBarrier<JSString> m_reifiedLeftContext;
+    WriteBarrier<JSString> m_reifiedRightContext;
+};
+
+} // namespace JSC
diff --git a/runtime/RegExpConstructor.cpp b/runtime/RegExpConstructor.cpp
new file mode 100644
index 0000000..b886cfc
--- /dev/null
+++ b/runtime/RegExpConstructor.cpp
@@ -0,0 +1,333 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007-2008, 2016 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "RegExpConstructor.h"
+
+#include "Error.h"
+#include "GetterSetter.h"
+#include "JSCInlines.h"
+#include "RegExpPrototype.h"
+#include "StructureInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue regExpConstructorInput(ExecState*, EncodedJSValue, PropertyName);
+static EncodedJSValue regExpConstructorMultiline(ExecState*, EncodedJSValue, PropertyName);
+static EncodedJSValue regExpConstructorLastMatch(ExecState*, EncodedJSValue, PropertyName);
+static EncodedJSValue regExpConstructorLastParen(ExecState*, EncodedJSValue, PropertyName);
+static EncodedJSValue regExpConstructorLeftContext(ExecState*, EncodedJSValue, PropertyName);
+static EncodedJSValue regExpConstructorRightContext(ExecState*, EncodedJSValue, PropertyName);
+template<int N>
+static EncodedJSValue regExpConstructorDollar(ExecState*, EncodedJSValue, PropertyName);
+
+static bool setRegExpConstructorInput(ExecState*, EncodedJSValue, EncodedJSValue);
+static bool setRegExpConstructorMultiline(ExecState*, EncodedJSValue, EncodedJSValue);
+
+} // namespace JSC
+
+#include "RegExpConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo RegExpConstructor::s_info = { "Function", &InternalFunction::s_info, &regExpConstructorTable, CREATE_METHOD_TABLE(RegExpConstructor) };
+
+/* Source for RegExpConstructor.lut.h
+@begin regExpConstructorTable
+    input           regExpConstructorInput          None
+    $_              regExpConstructorInput          DontEnum
+    multiline       regExpConstructorMultiline      None
+    $*              regExpConstructorMultiline      DontEnum
+    lastMatch       regExpConstructorLastMatch      DontDelete|ReadOnly
+    $&              regExpConstructorLastMatch      DontDelete|ReadOnly|DontEnum
+    lastParen       regExpConstructorLastParen      DontDelete|ReadOnly
+    $+              regExpConstructorLastParen      DontDelete|ReadOnly|DontEnum
+    leftContext     regExpConstructorLeftContext    DontDelete|ReadOnly
+    $`              regExpConstructorLeftContext    DontDelete|ReadOnly|DontEnum
+    rightContext    regExpConstructorRightContext   DontDelete|ReadOnly
+    $'              regExpConstructorRightContext   DontDelete|ReadOnly|DontEnum
+    $1              regExpConstructorDollar<1>      DontDelete|ReadOnly
+    $2              regExpConstructorDollar<2>      DontDelete|ReadOnly
+    $3              regExpConstructorDollar<3>      DontDelete|ReadOnly
+    $4              regExpConstructorDollar<4>      DontDelete|ReadOnly
+    $5              regExpConstructorDollar<5>      DontDelete|ReadOnly
+    $6              regExpConstructorDollar<6>      DontDelete|ReadOnly
+    $7              regExpConstructorDollar<7>      DontDelete|ReadOnly
+    $8              regExpConstructorDollar<8>      DontDelete|ReadOnly
+    $9              regExpConstructorDollar<9>      DontDelete|ReadOnly
+@end
+*/
+
+RegExpConstructor::RegExpConstructor(VM& vm, Structure* structure, RegExpPrototype* regExpPrototype)
+    : InternalFunction(vm, structure)
+    , m_cachedResult(vm, this, regExpPrototype->emptyRegExp())
+    , m_multiline(false)
+{
+}
+
+void RegExpConstructor::finishCreation(VM& vm, RegExpPrototype* regExpPrototype, GetterSetter* speciesSymbol)
+{
+    Base::finishCreation(vm, ASCIILiteral("RegExp"));
+    ASSERT(inherits(info()));
+
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, regExpPrototype, DontEnum | DontDelete | ReadOnly);
+
+    // no. of arguments for constructor
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
+
+    putDirectNonIndexAccessor(vm, vm.propertyNames->speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);
+}
+
+void RegExpConstructor::destroy(JSCell* cell)
+{
+    static_cast<RegExpConstructor*>(cell)->RegExpConstructor::~RegExpConstructor();
+}
+
+void RegExpConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    RegExpConstructor* thisObject = jsCast<RegExpConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    thisObject->m_cachedResult.visitChildren(visitor);
+}
+
+JSValue RegExpConstructor::getBackref(ExecState* exec, unsigned i)
+{
+    JSArray* array = m_cachedResult.lastResult(exec, this);
+
+    if (i < array->length()) {
+        JSValue result = JSValue(array).get(exec, i);
+        ASSERT(result.isString() || result.isUndefined());
+        if (!result.isUndefined())
+            return result;
+    }
+    return jsEmptyString(exec);
+}
+
+JSValue RegExpConstructor::getLastParen(ExecState* exec)
+{
+    JSArray* array = m_cachedResult.lastResult(exec, this);
+    unsigned length = array->length();
+    if (length > 1) {
+        JSValue result = JSValue(array).get(exec, length - 1);
+        ASSERT(result.isString() || result.isUndefined());
+        if (!result.isUndefined())
+            return result;
+    }
+    return jsEmptyString(exec);
+}
+
+JSValue RegExpConstructor::getLeftContext(ExecState* exec)
+{
+    return m_cachedResult.leftContext(exec, this);
+}
+
+JSValue RegExpConstructor::getRightContext(ExecState* exec)
+{
+    return m_cachedResult.rightContext(exec, this);
+}
+
+template<int N>
+EncodedJSValue regExpConstructorDollar(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+{
+    return JSValue::encode(asRegExpConstructor(JSValue::decode(thisValue))->getBackref(exec, N));
+}
+
+EncodedJSValue regExpConstructorInput(ExecState*, EncodedJSValue thisValue, PropertyName)
+{
+    return JSValue::encode(asRegExpConstructor(JSValue::decode(thisValue))->input());
+}
+
+EncodedJSValue regExpConstructorMultiline(ExecState*, EncodedJSValue thisValue, PropertyName)
+{
+    return JSValue::encode(jsBoolean(asRegExpConstructor(JSValue::decode(thisValue))->multiline()));
+}
+
+EncodedJSValue regExpConstructorLastMatch(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+{
+    return JSValue::encode(asRegExpConstructor(JSValue::decode(thisValue))->getBackref(exec, 0));
+}
+
+EncodedJSValue regExpConstructorLastParen(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+{
+    return JSValue::encode(asRegExpConstructor(JSValue::decode(thisValue))->getLastParen(exec));
+}
+
+EncodedJSValue regExpConstructorLeftContext(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+{
+    return JSValue::encode(asRegExpConstructor(JSValue::decode(thisValue))->getLeftContext(exec));
+}
+
+EncodedJSValue regExpConstructorRightContext(ExecState* exec, EncodedJSValue thisValue, PropertyName)
+{
+    return JSValue::encode(asRegExpConstructor(JSValue::decode(thisValue))->getRightContext(exec));
+}
+
+bool setRegExpConstructorInput(ExecState* exec, EncodedJSValue thisValue, EncodedJSValue value)
+{
+    if (auto constructor = jsDynamicCast<RegExpConstructor*>(JSValue::decode(thisValue))) {
+        constructor->setInput(exec, JSValue::decode(value).toString(exec));
+        return true;
+    }
+    return false;
+}
+
+bool setRegExpConstructorMultiline(ExecState* exec, EncodedJSValue thisValue, EncodedJSValue value)
+{
+    if (auto constructor = jsDynamicCast<RegExpConstructor*>(JSValue::decode(thisValue))) {
+        constructor->setMultiline(JSValue::decode(value).toBoolean(exec));
+        return true;
+    }
+    return false;
+}
+
+inline Structure* getRegExpStructure(ExecState* exec, JSGlobalObject* globalObject, JSValue newTarget)
+{
+    Structure* structure = globalObject->regExpStructure();
+    if (newTarget != jsUndefined())
+        structure = InternalFunction::createSubclassStructure(exec, newTarget, structure);
+    return structure;
+}
+
+inline RegExpFlags toFlags(ExecState* exec, JSValue flags)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (flags.isUndefined())
+        return NoFlags;
+    JSString* flagsString = flags.toStringOrNull(exec);
+    ASSERT(!!scope.exception() == !flagsString);
+    if (UNLIKELY(!flagsString))
+        return InvalidFlags;
+
+    RegExpFlags result = regExpFlags(flagsString->value(exec));
+    RETURN_IF_EXCEPTION(scope, InvalidFlags);
+    if (result == InvalidFlags)
+        throwSyntaxError(exec, scope, ASCIILiteral("Invalid flags supplied to RegExp constructor."));
+    return result;
+}
+
+static JSObject* regExpCreate(ExecState* exec, JSGlobalObject* globalObject, JSValue newTarget, JSValue patternArg, JSValue flagsArg)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String pattern = patternArg.isUndefined() ? emptyString() : patternArg.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    RegExpFlags flags = toFlags(exec, flagsArg);
+    ASSERT(!!scope.exception() == (flags == InvalidFlags));
+    if (UNLIKELY(flags == InvalidFlags))
+        return nullptr;
+
+    RegExp* regExp = RegExp::create(vm, pattern, flags);
+    if (!regExp->isValid())
+        return throwException(exec, scope, createSyntaxError(exec, regExp->errorMessage()));
+
+    Structure* structure = getRegExpStructure(exec, globalObject, newTarget);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    return RegExpObject::create(vm, structure, regExp);
+}
+
+JSObject* constructRegExp(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args,  JSObject* callee, JSValue newTarget)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue patternArg = args.at(0);
+    JSValue flagsArg = args.at(1);
+
+    bool isPatternRegExp = patternArg.inherits(RegExpObject::info());
+    bool constructAsRegexp = isRegExp(vm, exec, patternArg);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    if (newTarget.isUndefined() && constructAsRegexp && flagsArg.isUndefined()) {
+        JSValue constructor = patternArg.get(exec, vm.propertyNames->constructor);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        if (callee == constructor) {
+            // We know that patternArg is a object otherwise constructAsRegexp would be false.
+            return patternArg.getObject();
+        }
+    }
+
+    if (isPatternRegExp) {
+        RegExp* regExp = jsCast<RegExpObject*>(patternArg)->regExp();
+        Structure* structure = getRegExpStructure(exec, globalObject, newTarget);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+
+        if (!flagsArg.isUndefined()) {
+            RegExpFlags flags = toFlags(exec, flagsArg);
+            ASSERT(!!scope.exception() == (flags == InvalidFlags));
+            if (flags == InvalidFlags)
+                return nullptr;
+            regExp = RegExp::create(vm, regExp->pattern(), flags);
+        }
+
+        return RegExpObject::create(vm, structure, regExp);
+    }
+
+    if (constructAsRegexp) {
+        JSValue pattern = patternArg.get(exec, vm.propertyNames->source);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        if (flagsArg.isUndefined()) {
+            flagsArg = patternArg.get(exec, vm.propertyNames->flags);
+            RETURN_IF_EXCEPTION(scope, nullptr);
+        }
+        patternArg = pattern;
+    }
+
+    scope.release();
+    return regExpCreate(exec, globalObject, newTarget, patternArg, flagsArg);
+}
+
+EncodedJSValue JSC_HOST_CALL esSpecRegExpCreate(ExecState* exec)
+{
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    JSValue patternArg = exec->argument(0);
+    JSValue flagsArg = exec->argument(1);
+    return JSValue::encode(regExpCreate(exec, globalObject, jsUndefined(), patternArg, flagsArg));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructWithRegExpConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructRegExp(exec, asInternalFunction(exec->jsCallee())->globalObject(), args, exec->jsCallee(), exec->newTarget()));
+}
+
+ConstructType RegExpConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWithRegExpConstructor;
+    return ConstructType::Host;
+}
+
+static EncodedJSValue JSC_HOST_CALL callRegExpConstructor(ExecState* exec)
+{
+    ArgList args(exec);
+    return JSValue::encode(constructRegExp(exec, asInternalFunction(exec->jsCallee())->globalObject(), args, exec->jsCallee()));
+}
+
+CallType RegExpConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callRegExpConstructor;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/RegExpConstructor.h b/runtime/RegExpConstructor.h
new file mode 100644
index 0000000..5bd638b
--- /dev/null
+++ b/runtime/RegExpConstructor.h
@@ -0,0 +1,150 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007-2008, 2016 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+#include "RegExp.h"
+#include "RegExpCachedResult.h"
+#include "RegExpObject.h"
+
+namespace JSC {
+
+class RegExpPrototype;
+class GetterSetter;
+
+class RegExpConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static RegExpConstructor* create(VM& vm, Structure* structure, RegExpPrototype* regExpPrototype, GetterSetter* species)
+    {
+        RegExpConstructor* constructor = new (NotNull, allocateCell<RegExpConstructor>(vm.heap)) RegExpConstructor(vm, structure, regExpPrototype);
+        constructor->finishCreation(vm, regExpPrototype, species);
+        return constructor;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+    MatchResult performMatch(VM&, RegExp*, JSString*, const String&, int startOffset, int** ovector);
+    MatchResult performMatch(VM&, RegExp*, JSString*, const String&, int startOffset);
+    void recordMatch(VM&, RegExp*, JSString*, const MatchResult&);
+
+    void setMultiline(bool multiline) { m_multiline = multiline; }
+    bool multiline() const { return m_multiline; }
+
+    JSValue getBackref(ExecState*, unsigned);
+    JSValue getLastParen(ExecState*);
+    JSValue getLeftContext(ExecState*);
+    JSValue getRightContext(ExecState*);
+
+    void setInput(ExecState* exec, JSString* string) { m_cachedResult.setInput(exec, this, string); }
+    JSString* input() { return m_cachedResult.input(); }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    static ptrdiff_t offsetOfCachedResult() { return OBJECT_OFFSETOF(RegExpConstructor, m_cachedResult); }
+
+protected:
+    void finishCreation(VM&, RegExpPrototype*, GetterSetter* species);
+
+private:
+    RegExpConstructor(VM&, Structure*, RegExpPrototype*);
+    static void destroy(JSCell*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+
+    RegExpCachedResult m_cachedResult;
+    bool m_multiline;
+    Vector<int> m_ovector;
+};
+
+RegExpConstructor* asRegExpConstructor(JSValue);
+
+JSObject* constructRegExp(ExecState*, JSGlobalObject*, const ArgList&, JSObject* callee = nullptr, JSValue newTarget = jsUndefined());
+
+inline RegExpConstructor* asRegExpConstructor(JSValue value)
+{
+    ASSERT(asObject(value)->inherits(RegExpConstructor::info()));
+    return static_cast<RegExpConstructor*>(asObject(value));
+}
+
+/* 
+   To facilitate result caching, exec(), test(), match(), search(), and replace() dipatch regular
+   expression matching through the performMatch function. We use cached results to calculate, 
+   e.g., RegExp.lastMatch and RegExp.leftParen.
+*/
+ALWAYS_INLINE MatchResult RegExpConstructor::performMatch(VM& vm, RegExp* regExp, JSString* string, const String& input, int startOffset, int** ovector)
+{
+    int position = regExp->match(vm, input, startOffset, m_ovector);
+
+    if (ovector)
+        *ovector = m_ovector.data();
+
+    if (position == -1)
+        return MatchResult::failed();
+
+    ASSERT(!m_ovector.isEmpty());
+    ASSERT(m_ovector[0] == position);
+    ASSERT(m_ovector[1] >= position);
+    size_t end = m_ovector[1];
+
+    m_cachedResult.record(vm, this, regExp, string, MatchResult(position, end));
+
+    return MatchResult(position, end);
+}
+ALWAYS_INLINE MatchResult RegExpConstructor::performMatch(VM& vm, RegExp* regExp, JSString* string, const String& input, int startOffset)
+{
+    MatchResult result = regExp->match(vm, input, startOffset);
+    if (result)
+        m_cachedResult.record(vm, this, regExp, string, result);
+    return result;
+}
+
+ALWAYS_INLINE void RegExpConstructor::recordMatch(VM& vm, RegExp* regExp, JSString* string, const MatchResult& result)
+{
+    ASSERT(result);
+    m_cachedResult.record(vm, this, regExp, string, result);
+}
+
+ALWAYS_INLINE bool isRegExp(VM& vm, ExecState* exec, JSValue value)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (!value.isObject())
+        return false;
+
+    JSObject* object = asObject(value);
+    JSValue matchValue = object->get(exec, vm.propertyNames->matchSymbol);
+    RETURN_IF_EXCEPTION(scope, false);
+    if (!matchValue.isUndefined())
+        return matchValue.toBoolean(exec);
+
+    return object->inherits(RegExpObject::info());
+}
+
+EncodedJSValue JSC_HOST_CALL esSpecRegExpCreate(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/RegExpInlines.h b/runtime/RegExpInlines.h
new file mode 100644
index 0000000..f8059d7
--- /dev/null
+++ b/runtime/RegExpInlines.h
@@ -0,0 +1,234 @@
+/*
+ *  Copyright (C) 1999-2001, 2004 Harri Porten (porten@kde.org)
+ *  Copyright (c) 2007, 2008, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Torch Mobile, Inc.
+ *  Copyright (C) 2010 Peter Varga (pvarga@inf.u-szeged.hu), University of Szeged
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "RegExp.h"
+#include "JSCInlines.h"
+#include "Yarr.h"
+#include "YarrInterpreter.h"
+#include "YarrJIT.h"
+
+#define REGEXP_FUNC_TEST_DATA_GEN 0
+
+#if REGEXP_FUNC_TEST_DATA_GEN
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#endif
+
+namespace JSC {
+
+#if REGEXP_FUNC_TEST_DATA_GEN
+class RegExpFunctionalTestCollector {
+    // This class is not thread safe.
+protected:
+    static const char* const s_fileName;
+
+public:
+    static RegExpFunctionalTestCollector* get();
+
+    ~RegExpFunctionalTestCollector();
+
+    void outputOneTest(RegExp*, String, int, int*, int);
+    void clearRegExp(RegExp* regExp)
+    {
+        if (regExp == m_lastRegExp)
+            m_lastRegExp = 0;
+    }
+
+private:
+    RegExpFunctionalTestCollector();
+
+    void outputEscapedString(const String&, bool escapeSlash = false);
+
+    static RegExpFunctionalTestCollector* s_instance;
+    FILE* m_file;
+    RegExp* m_lastRegExp;
+};
+#endif // REGEXP_FUNC_TEST_DATA_GEN
+
+ALWAYS_INLINE bool RegExp::hasCodeFor(Yarr::YarrCharSize charSize)
+{
+    if (hasCode()) {
+#if ENABLE(YARR_JIT)
+        if (m_state != JITCode)
+            return true;
+        if ((charSize == Yarr::Char8) && (m_regExpJITCode.has8BitCode()))
+            return true;
+        if ((charSize == Yarr::Char16) && (m_regExpJITCode.has16BitCode()))
+            return true;
+#else
+        UNUSED_PARAM(charSize);
+        return true;
+#endif
+    }
+    return false;
+}
+
+ALWAYS_INLINE void RegExp::compileIfNecessary(VM& vm, Yarr::YarrCharSize charSize)
+{
+    if (hasCodeFor(charSize))
+        return;
+
+    compile(&vm, charSize);
+}
+
+template<typename VectorType>
+ALWAYS_INLINE int RegExp::matchInline(VM& vm, const String& s, unsigned startOffset, VectorType& ovector)
+{
+#if ENABLE(REGEXP_TRACING)
+    m_rtMatchCallCount++;
+    m_rtMatchTotalSubjectStringLen += (double)(s.length() - startOffset);
+#endif
+
+    ASSERT(m_state != ParseError);
+    compileIfNecessary(vm, s.is8Bit() ? Yarr::Char8 : Yarr::Char16);
+
+    int offsetVectorSize = (m_numSubpatterns + 1) * 2;
+    ovector.resize(offsetVectorSize);
+    int* offsetVector = ovector.data();
+
+    int result;
+#if ENABLE(YARR_JIT)
+    if (m_state == JITCode) {
+        if (s.is8Bit())
+            result = m_regExpJITCode.execute(s.characters8(), startOffset, s.length(), offsetVector).start;
+        else
+            result = m_regExpJITCode.execute(s.characters16(), startOffset, s.length(), offsetVector).start;
+#if ENABLE(YARR_JIT_DEBUG)
+        matchCompareWithInterpreter(s, startOffset, offsetVector, result);
+#endif
+    } else
+#endif
+        result = Yarr::interpret(m_regExpBytecode.get(), s, startOffset, reinterpret_cast<unsigned*>(offsetVector));
+
+    // FIXME: The YARR engine should handle unsigned or size_t length matches.
+    // The YARR Interpreter is "unsigned" clean, while the YARR JIT hasn't been addressed.
+    // The offset vector handling needs to change as well.
+    // Right now we convert a match where the offsets overflowed into match failure.
+    // There are two places in WebCore that call the interpreter directly that need to
+    // have their offsets changed to int as well. They are yarr/RegularExpression.cpp
+    // and inspector/ContentSearchUtilities.cpp
+    if (s.length() > INT_MAX) {
+        bool overflowed = false;
+
+        if (result < -1)
+            overflowed = true;
+
+        for (unsigned i = 0; i <= m_numSubpatterns; i++) {
+            if ((offsetVector[i*2] < -1) || ((offsetVector[i*2] >= 0) && (offsetVector[i*2+1] < -1))) {
+                overflowed = true;
+                offsetVector[i*2] = -1;
+                offsetVector[i*2+1] = -1;
+            }
+        }
+
+        if (overflowed)
+            result = -1;
+    }
+
+    ASSERT(result >= -1);
+
+#if REGEXP_FUNC_TEST_DATA_GEN
+    RegExpFunctionalTestCollector::get()->outputOneTest(this, s, startOffset, offsetVector, result);
+#endif
+
+#if ENABLE(REGEXP_TRACING)
+    if (result != -1)
+        m_rtMatchFoundCount++;
+#endif
+
+    return result;
+}
+
+ALWAYS_INLINE bool RegExp::hasMatchOnlyCodeFor(Yarr::YarrCharSize charSize)
+{
+    if (hasCode()) {
+#if ENABLE(YARR_JIT)
+        if (m_state != JITCode)
+            return true;
+        if ((charSize == Yarr::Char8) && (m_regExpJITCode.has8BitCodeMatchOnly()))
+            return true;
+        if ((charSize == Yarr::Char16) && (m_regExpJITCode.has16BitCodeMatchOnly()))
+            return true;
+#else
+        UNUSED_PARAM(charSize);
+        return true;
+#endif
+    }
+
+    return false;
+}
+
+ALWAYS_INLINE void RegExp::compileIfNecessaryMatchOnly(VM& vm, Yarr::YarrCharSize charSize)
+{
+    if (hasMatchOnlyCodeFor(charSize))
+        return;
+
+    compileMatchOnly(&vm, charSize);
+}
+
+ALWAYS_INLINE MatchResult RegExp::matchInline(VM& vm, const String& s, unsigned startOffset)
+{
+#if ENABLE(REGEXP_TRACING)
+    m_rtMatchOnlyCallCount++;
+    m_rtMatchOnlyTotalSubjectStringLen += (double)(s.length() - startOffset);
+#endif
+
+    ASSERT(m_state != ParseError);
+    compileIfNecessaryMatchOnly(vm, s.is8Bit() ? Yarr::Char8 : Yarr::Char16);
+
+#if ENABLE(YARR_JIT)
+    if (m_state == JITCode) {
+        MatchResult result = s.is8Bit() ?
+            m_regExpJITCode.execute(s.characters8(), startOffset, s.length()) :
+            m_regExpJITCode.execute(s.characters16(), startOffset, s.length());
+#if ENABLE(REGEXP_TRACING)
+        if (!result)
+            m_rtMatchOnlyFoundCount++;
+#endif
+        return result;
+    }
+#endif
+
+    int offsetVectorSize = (m_numSubpatterns + 1) * 2;
+    int* offsetVector;
+    Vector<int, 32> nonReturnedOvector;
+    nonReturnedOvector.resize(offsetVectorSize);
+    offsetVector = nonReturnedOvector.data();
+    int r = Yarr::interpret(m_regExpBytecode.get(), s, startOffset, reinterpret_cast<unsigned*>(offsetVector));
+#if REGEXP_FUNC_TEST_DATA_GEN
+    RegExpFunctionalTestCollector::get()->outputOneTest(this, s, startOffset, offsetVector, result);
+#endif
+
+    if (r >= 0) {
+#if ENABLE(REGEXP_TRACING)
+        m_rtMatchOnlyFoundCount++;
+#endif
+        return MatchResult(r, reinterpret_cast<unsigned*>(offsetVector)[1]);
+    }
+
+    return MatchResult::failed();
+}
+
+} // namespace JSC
diff --git a/runtime/RegExpKey.h b/runtime/RegExpKey.h
new file mode 100644
index 0000000..fd5f30e
--- /dev/null
+++ b/runtime/RegExpKey.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2010 University of Szeged
+ * Copyright (C) 2010 Renata Hodovan (hodovan@inf.u-szeged.hu)
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+enum RegExpFlags {
+    NoFlags = 0,
+    FlagGlobal = 1,
+    FlagIgnoreCase = 2,
+    FlagMultiline = 4,
+    FlagSticky = 8,
+    FlagUnicode = 16,
+    InvalidFlags = 32,
+    DeletedValueFlags = -1
+};
+
+struct RegExpKey {
+    RegExpFlags flagsValue;
+    RefPtr<StringImpl> pattern;
+
+    RegExpKey()
+        : flagsValue(NoFlags)
+    {
+    }
+
+    RegExpKey(RegExpFlags flags)
+        : flagsValue(flags)
+    {
+    }
+
+    RegExpKey(RegExpFlags flags, const String& pattern)
+        : flagsValue(flags)
+        , pattern(pattern.impl())
+    {
+    }
+
+    RegExpKey(RegExpFlags flags, const PassRefPtr<StringImpl> pattern)
+        : flagsValue(flags)
+        , pattern(pattern)
+    {
+    }
+
+    RegExpKey(RegExpFlags flags, const RefPtr<StringImpl>& pattern)
+        : flagsValue(flags)
+        , pattern(pattern)
+    {
+    }
+
+    friend inline bool operator==(const RegExpKey& a, const RegExpKey& b);
+
+    struct Hash {
+        static unsigned hash(const RegExpKey& key) { return key.pattern->hash(); }
+        static bool equal(const RegExpKey& a, const RegExpKey& b) { return a == b; }
+        static const bool safeToCompareToEmptyOrDeleted = false;
+    };
+};
+
+inline bool operator==(const RegExpKey& a, const RegExpKey& b)
+{
+    if (a.flagsValue != b.flagsValue)
+        return false;
+    if (!a.pattern)
+        return !b.pattern;
+    if (!b.pattern)
+        return false;
+    return equal(a.pattern.get(), b.pattern.get());
+}
+
+} // namespace JSC
+
+namespace WTF {
+template<typename T> struct DefaultHash;
+
+template<> struct DefaultHash<JSC::RegExpKey> {
+    typedef JSC::RegExpKey::Hash Hash;
+};
+
+template<> struct HashTraits<JSC::RegExpKey> : GenericHashTraits<JSC::RegExpKey> {
+    static const bool emptyValueIsZero = true;
+    static void constructDeletedValue(JSC::RegExpKey& slot) { slot.flagsValue = JSC::DeletedValueFlags; }
+    static bool isDeletedValue(const JSC::RegExpKey& value) { return value.flagsValue == JSC::DeletedValueFlags; }
+};
+} // namespace WTF
diff --git a/runtime/RegExpMatchesArray.cpp b/runtime/RegExpMatchesArray.cpp
new file mode 100644
index 0000000..163c726
--- /dev/null
+++ b/runtime/RegExpMatchesArray.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegExpMatchesArray.h"
+
+namespace JSC {
+
+JSArray* createEmptyRegExpMatchesArray(JSGlobalObject* globalObject, JSString* input, RegExp* regExp)
+{
+    VM& vm = globalObject->vm();
+    JSArray* array;
+
+    // FIXME: This should handle array allocation errors gracefully.
+    // https://bugs.webkit.org/show_bug.cgi?id=155144
+    
+    GCDeferralContext deferralContext(vm.heap);
+    
+    if (UNLIKELY(globalObject->isHavingABadTime())) {
+        array = JSArray::tryCreateUninitialized(vm, &deferralContext, globalObject->regExpMatchesArrayStructure(), regExp->numSubpatterns() + 1);
+        
+        array->initializeIndexWithoutBarrier(0, jsEmptyString(&vm));
+        
+        if (unsigned numSubpatterns = regExp->numSubpatterns()) {
+            for (unsigned i = 1; i <= numSubpatterns; ++i)
+                array->initializeIndexWithoutBarrier(i, jsUndefined());
+        }
+    } else {
+        array = tryCreateUninitializedRegExpMatchesArray(vm, &deferralContext, globalObject->regExpMatchesArrayStructure(), regExp->numSubpatterns() + 1);
+        RELEASE_ASSERT(array);
+        
+        array->initializeIndexWithoutBarrier(0, jsEmptyString(&vm), ArrayWithContiguous);
+        
+        if (unsigned numSubpatterns = regExp->numSubpatterns()) {
+            for (unsigned i = 1; i <= numSubpatterns; ++i)
+                array->initializeIndexWithoutBarrier(i, jsUndefined(), ArrayWithContiguous);
+        }
+    }
+
+    array->putDirectWithoutBarrier(RegExpMatchesArrayIndexPropertyOffset, jsNumber(-1));
+    array->putDirectWithoutBarrier(RegExpMatchesArrayInputPropertyOffset, input);
+    return array;
+}
+
+static Structure* createStructureImpl(VM& vm, JSGlobalObject* globalObject, IndexingType indexingType)
+{
+    Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType);
+    PropertyOffset offset;
+    structure = Structure::addPropertyTransition(vm, structure, vm.propertyNames->index, 0, offset);
+    ASSERT(offset == RegExpMatchesArrayIndexPropertyOffset);
+    structure = Structure::addPropertyTransition(vm, structure, vm.propertyNames->input, 0, offset);
+    ASSERT(offset == RegExpMatchesArrayInputPropertyOffset);
+    return structure;
+}
+
+Structure* createRegExpMatchesArrayStructure(VM& vm, JSGlobalObject* globalObject)
+{
+    return createStructureImpl(vm, globalObject, ArrayWithContiguous);
+}
+
+Structure* createRegExpMatchesArraySlowPutStructure(VM& vm, JSGlobalObject* globalObject)
+{
+    return createStructureImpl(vm, globalObject, ArrayWithSlowPutArrayStorage);
+}
+
+} // namespace JSC
diff --git a/runtime/RegExpMatchesArray.h b/runtime/RegExpMatchesArray.h
new file mode 100644
index 0000000..8465fbf
--- /dev/null
+++ b/runtime/RegExpMatchesArray.h
@@ -0,0 +1,130 @@
+/*
+ *  Copyright (C) 2008-2017 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "ButterflyInlines.h"
+#include "GCDeferralContextInlines.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "RegExpInlines.h"
+#include "RegExpObject.h"
+
+namespace JSC {
+
+static const PropertyOffset RegExpMatchesArrayIndexPropertyOffset = 100;
+static const PropertyOffset RegExpMatchesArrayInputPropertyOffset = 101;
+
+ALWAYS_INLINE JSArray* tryCreateUninitializedRegExpMatchesArray(VM& vm, GCDeferralContext* deferralContext, Structure* structure, unsigned initialLength)
+{
+    unsigned vectorLength = initialLength;
+    if (vectorLength > MAX_STORAGE_VECTOR_LENGTH)
+        return 0;
+
+    void* temp = vm.auxiliarySpace.tryAllocate(deferralContext, Butterfly::totalSize(0, structure->outOfLineCapacity(), true, vectorLength * sizeof(EncodedJSValue)));
+    if (!temp)
+        return nullptr;
+    Butterfly* butterfly = Butterfly::fromBase(temp, 0, structure->outOfLineCapacity());
+    butterfly->setVectorLength(vectorLength);
+    butterfly->setPublicLength(initialLength);
+    
+    for (unsigned i = initialLength; i < vectorLength; ++i)
+        butterfly->contiguous()[i].clear();
+    
+    return JSArray::createWithButterfly(vm, deferralContext, structure, butterfly);
+}
+
+ALWAYS_INLINE JSArray* createRegExpMatchesArray(
+    VM& vm, JSGlobalObject* globalObject, JSString* input, const String& inputValue,
+    RegExp* regExp, unsigned startOffset, MatchResult& result)
+{
+    Vector<int, 32> subpatternResults;
+    int position = regExp->matchInline(vm, inputValue, startOffset, subpatternResults);
+    if (position == -1) {
+        result = MatchResult::failed();
+        return nullptr;
+    }
+
+    result.start = position;
+    result.end = subpatternResults[1];
+    
+    JSArray* array;
+
+    // FIXME: This should handle array allocation errors gracefully.
+    // https://bugs.webkit.org/show_bug.cgi?id=155144
+    
+    auto setProperties = [&] () {
+        array->putDirect(vm, RegExpMatchesArrayIndexPropertyOffset, jsNumber(result.start));
+        array->putDirect(vm, RegExpMatchesArrayInputPropertyOffset, input);
+    };
+    
+    unsigned numSubpatterns = regExp->numSubpatterns();
+    
+    GCDeferralContext deferralContext(vm.heap);
+    
+    if (UNLIKELY(globalObject->isHavingABadTime())) {
+        array = JSArray::tryCreateUninitialized(vm, &deferralContext, globalObject->regExpMatchesArrayStructure(), numSubpatterns + 1);
+        
+        setProperties();
+        
+        array->initializeIndexWithoutBarrier(0, jsSubstringOfResolved(vm, &deferralContext, input, result.start, result.end - result.start));
+        
+        for (unsigned i = 1; i <= numSubpatterns; ++i) {
+            int start = subpatternResults[2 * i];
+            JSValue value;
+            if (start >= 0)
+                value = JSRopeString::createSubstringOfResolved(vm, &deferralContext, input, start, subpatternResults[2 * i + 1] - start);
+            else
+                value = jsUndefined();
+            array->initializeIndexWithoutBarrier(i, value);
+        }
+    } else {
+        array = tryCreateUninitializedRegExpMatchesArray(vm, &deferralContext, globalObject->regExpMatchesArrayStructure(), numSubpatterns + 1);
+        RELEASE_ASSERT(array);
+        
+        setProperties();
+        
+        // Now the object is safe to scan by GC.
+
+        array->initializeIndexWithoutBarrier(0, jsSubstringOfResolved(vm, &deferralContext, input, result.start, result.end - result.start), ArrayWithContiguous);
+        
+        for (unsigned i = 1; i <= numSubpatterns; ++i) {
+            int start = subpatternResults[2 * i];
+            JSValue value;
+            if (start >= 0)
+                value = JSRopeString::createSubstringOfResolved(vm, &deferralContext, input, start, subpatternResults[2 * i + 1] - start);
+            else
+                value = jsUndefined();
+            array->initializeIndexWithoutBarrier(i, value, ArrayWithContiguous);
+        }
+    }
+    return array;
+}
+
+inline JSArray* createRegExpMatchesArray(ExecState* exec, JSGlobalObject* globalObject, JSString* string, RegExp* regExp, unsigned startOffset)
+{
+    MatchResult ignoredResult;
+    return createRegExpMatchesArray(globalObject->vm(), globalObject, string, string->value(exec), regExp, startOffset, ignoredResult);
+}
+JSArray* createEmptyRegExpMatchesArray(JSGlobalObject*, JSString*, RegExp*);
+Structure* createRegExpMatchesArrayStructure(VM&, JSGlobalObject*);
+Structure* createRegExpMatchesArraySlowPutStructure(VM&, JSGlobalObject*);
+
+} // namespace JSC
diff --git a/runtime/RegExpObject.cpp b/runtime/RegExpObject.cpp
new file mode 100644
index 0000000..28b4498
--- /dev/null
+++ b/runtime/RegExpObject.cpp
@@ -0,0 +1,275 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007-2008, 2012, 2016 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "RegExpObject.h"
+
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSArray.h"
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "Lookup.h"
+#include "JSCInlines.h"
+#include "RegExpConstructor.h"
+#include "RegExpObjectInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(RegExpObject);
+
+const ClassInfo RegExpObject::s_info = { "RegExp", &Base::s_info, nullptr, CREATE_METHOD_TABLE(RegExpObject) };
+
+RegExpObject::RegExpObject(VM& vm, Structure* structure, RegExp* regExp)
+    : JSNonFinalObject(vm, structure)
+    , m_regExp(vm, this, regExp)
+    , m_lastIndexIsWritable(true)
+{
+    m_lastIndex.setWithoutWriteBarrier(jsNumber(0));
+}
+
+void RegExpObject::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+void RegExpObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    RegExpObject* thisObject = jsCast<RegExpObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_regExp);
+    visitor.append(thisObject->m_lastIndex);
+}
+
+bool RegExpObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    if (propertyName == exec->propertyNames().lastIndex) {
+        RegExpObject* regExp = asRegExpObject(object);
+        unsigned attributes = regExp->m_lastIndexIsWritable ? DontDelete | DontEnum : DontDelete | DontEnum | ReadOnly;
+        slot.setValue(regExp, attributes, regExp->getLastIndex());
+        return true;
+    }
+    return Base::getOwnPropertySlot(object, exec, propertyName, slot);
+}
+
+bool RegExpObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    if (propertyName == exec->propertyNames().lastIndex)
+        return false;
+    return Base::deleteProperty(cell, exec, propertyName);
+}
+
+void RegExpObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode.includeDontEnumProperties())
+        propertyNames.add(exec->propertyNames().lastIndex);
+    Base::getOwnNonIndexPropertyNames(object, exec, propertyNames, mode);
+}
+
+void RegExpObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode.includeDontEnumProperties())
+        propertyNames.add(exec->propertyNames().lastIndex);
+    Base::getPropertyNames(object, exec, propertyNames, mode);
+}
+
+void RegExpObject::getGenericPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    if (mode.includeDontEnumProperties())
+        propertyNames.add(exec->propertyNames().lastIndex);
+    Base::getGenericPropertyNames(object, exec, propertyNames, mode);
+}
+
+bool RegExpObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (propertyName == vm.propertyNames->lastIndex) {
+        RegExpObject* regExp = asRegExpObject(object);
+        if (descriptor.configurablePresent() && descriptor.configurable())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral(UnconfigurablePropertyChangeConfigurabilityError));
+        if (descriptor.enumerablePresent() && descriptor.enumerable())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral(UnconfigurablePropertyChangeEnumerabilityError));
+        if (descriptor.isAccessorDescriptor())
+            return typeError(exec, scope, shouldThrow, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+        if (!regExp->m_lastIndexIsWritable) {
+            if (descriptor.writablePresent() && descriptor.writable())
+                return typeError(exec, scope, shouldThrow, ASCIILiteral(UnconfigurablePropertyChangeWritabilityError));
+            if (!sameValue(exec, regExp->getLastIndex(), descriptor.value()))
+                return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyChangeError));
+            return true;
+        }
+        if (descriptor.value()) {
+            regExp->setLastIndex(exec, descriptor.value(), false);
+            RETURN_IF_EXCEPTION(scope, false);
+        }
+        if (descriptor.writablePresent() && !descriptor.writable())
+            regExp->m_lastIndexIsWritable = false;
+        return true;
+    }
+
+    scope.release();
+    return Base::defineOwnProperty(object, exec, propertyName, descriptor, shouldThrow);
+}
+
+static bool regExpObjectSetLastIndexStrict(ExecState* exec, EncodedJSValue thisValue, EncodedJSValue value)
+{
+    return asRegExpObject(JSValue::decode(thisValue))->setLastIndex(exec, JSValue::decode(value), true);
+}
+
+static bool regExpObjectSetLastIndexNonStrict(ExecState* exec, EncodedJSValue thisValue, EncodedJSValue value)
+{
+    return asRegExpObject(JSValue::decode(thisValue))->setLastIndex(exec, JSValue::decode(value), false);
+}
+
+bool RegExpObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    RegExpObject* thisObject = jsCast<RegExpObject*>(cell);
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject)))
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+
+    if (propertyName == exec->propertyNames().lastIndex) {
+        bool result = asRegExpObject(cell)->setLastIndex(exec, value, slot.isStrictMode());
+        slot.setCustomValue(asRegExpObject(cell), slot.isStrictMode()
+            ? regExpObjectSetLastIndexStrict
+            : regExpObjectSetLastIndexNonStrict);
+        return result;
+    }
+    return Base::put(cell, exec, propertyName, value, slot);
+}
+
+JSValue RegExpObject::exec(ExecState* exec, JSGlobalObject* globalObject, JSString* string)
+{
+    return execInline(exec, globalObject, string);
+}
+
+// Shared implementation used by test and exec.
+MatchResult RegExpObject::match(ExecState* exec, JSGlobalObject* globalObject, JSString* string)
+{
+    return matchInline(exec, globalObject, string);
+}
+
+template<typename FixEndFunc>
+JSValue collectMatches(VM& vm, ExecState* exec, JSString* string, const String& s, RegExpConstructor* constructor, RegExp* regExp, const FixEndFunc& fixEnd)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    MatchResult result = constructor->performMatch(vm, regExp, string, s, 0);
+    if (!result)
+        return jsNull();
+    
+    static unsigned maxSizeForDirectPath = 100000;
+    
+    JSArray* array = constructEmptyArray(exec, nullptr);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    bool hasException = false;
+    auto iterate = [&] () {
+        size_t end = result.end;
+        size_t length = end - result.start;
+        array->push(exec, JSRopeString::createSubstringOfResolved(vm, string, result.start, length));
+        if (UNLIKELY(scope.exception())) {
+            hasException = true;
+            return;
+        }
+        if (!length)
+            end = fixEnd(end);
+        result = constructor->performMatch(vm, regExp, string, s, end);
+    };
+    
+    do {
+        if (array->length() >= maxSizeForDirectPath) {
+            // First do a throw-away match to see how many matches we'll get.
+            unsigned matchCount = 0;
+            MatchResult savedResult = result;
+            do {
+                if (array->length() + matchCount >= MAX_STORAGE_VECTOR_LENGTH) {
+                    throwOutOfMemoryError(exec, scope);
+                    return jsUndefined();
+                }
+                
+                size_t end = result.end;
+                matchCount++;
+                if (result.empty())
+                    end = fixEnd(end);
+                
+                // Using RegExpConstructor::performMatch() instead of calling RegExp::match()
+                // directly is a surprising but profitable choice: it means that when we do OOM, we
+                // will leave the cached result in the state it ought to have had just before the
+                // OOM! On the other hand, if this loop concludes that the result is small enough,
+                // then the iterate() loop below will overwrite the cached result anyway.
+                result = constructor->performMatch(vm, regExp, string, s, end);
+            } while (result);
+            
+            // OK, we have a sensible number of matches. Now we can create them for reals.
+            result = savedResult;
+            do {
+                iterate();
+                ASSERT(!!scope.exception() == hasException);
+                if (UNLIKELY(hasException))
+                    return { };
+            } while (result);
+            
+            return array;
+        }
+        
+        iterate();
+    } while (result);
+    
+    return array;
+}
+
+JSValue RegExpObject::matchGlobal(ExecState* exec, JSGlobalObject* globalObject, JSString* string)
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    RegExp* regExp = this->regExp();
+
+    ASSERT(regExp->global());
+
+    setLastIndex(exec, 0);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    String s = string->value(exec);
+    RegExpConstructor* regExpConstructor = globalObject->regExpConstructor();
+    
+    if (regExp->unicode()) {
+        unsigned stringLength = s.length();
+        scope.release();
+        return collectMatches(
+            vm, exec, string, s, regExpConstructor, regExp,
+            [&] (size_t end) -> size_t {
+                return advanceStringUnicode(s, stringLength, end);
+            });
+    }
+
+    scope.release();
+    return collectMatches(
+        vm, exec, string, s, regExpConstructor, regExp,
+        [&] (size_t end) -> size_t {
+            return end + 1;
+        });
+}
+
+} // namespace JSC
diff --git a/runtime/RegExpObject.h b/runtime/RegExpObject.h
new file mode 100644
index 0000000..e8ec036
--- /dev/null
+++ b/runtime/RegExpObject.h
@@ -0,0 +1,131 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007-2008, 2012, 2016 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "RegExp.h"
+#include "ThrowScope.h"
+#include "TypeError.h"
+
+namespace JSC {
+    
+class RegExpObject : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
+
+    static RegExpObject* create(VM& vm, Structure* structure, RegExp* regExp)
+    {
+        RegExpObject* object = new (NotNull, allocateCell<RegExpObject>(vm.heap)) RegExpObject(vm, structure, regExp);
+        object->finishCreation(vm);
+        return object;
+    }
+
+    void setRegExp(VM& vm, RegExp* r) { m_regExp.set(vm, this, r); }
+    RegExp* regExp() const { return m_regExp.get(); }
+
+    bool setLastIndex(ExecState* exec, size_t lastIndex)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        if (LIKELY(m_lastIndexIsWritable)) {
+            m_lastIndex.setWithoutWriteBarrier(jsNumber(lastIndex));
+            return true;
+        }
+        throwTypeError(exec, scope, ASCIILiteral(ReadonlyPropertyWriteError));
+        return false;
+    }
+    bool setLastIndex(ExecState* exec, JSValue lastIndex, bool shouldThrow)
+    {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        if (LIKELY(m_lastIndexIsWritable)) {
+            m_lastIndex.set(vm, this, lastIndex);
+            return true;
+        }
+
+        return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+    }
+    JSValue getLastIndex() const
+    {
+        return m_lastIndex.get();
+    }
+
+    bool test(ExecState* exec, JSGlobalObject* globalObject, JSString* string) { return !!match(exec, globalObject, string); }
+    bool testInline(ExecState* exec, JSGlobalObject* globalObject, JSString* string) { return !!matchInline(exec, globalObject, string); }
+    JSValue exec(ExecState*, JSGlobalObject*, JSString*);
+    JSValue execInline(ExecState*, JSGlobalObject*, JSString*);
+    MatchResult match(ExecState*, JSGlobalObject*, JSString*);
+    JSValue matchGlobal(ExecState*, JSGlobalObject*, JSString*);
+
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(RegExpObjectType, StructureFlags), info());
+    }
+
+    static ptrdiff_t offsetOfLastIndex()
+    {
+        return OBJECT_OFFSETOF(RegExpObject, m_lastIndex);
+    }
+
+    static ptrdiff_t offsetOfLastIndexIsWritable()
+    {
+        return OBJECT_OFFSETOF(RegExpObject, m_lastIndexIsWritable);
+    }
+
+    static unsigned advanceStringUnicode(String, unsigned length, unsigned currentIndex);
+
+protected:
+    JS_EXPORT_PRIVATE RegExpObject(VM&, Structure*, RegExp*);
+    JS_EXPORT_PRIVATE void finishCreation(VM&);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static void getOwnNonIndexPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static void getGenericPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+private:
+    MatchResult matchInline(ExecState*, JSGlobalObject*, JSString*);
+
+    WriteBarrier<RegExp> m_regExp;
+    WriteBarrier<Unknown> m_lastIndex;
+    bool m_lastIndexIsWritable;
+};
+
+RegExpObject* asRegExpObject(JSValue);
+
+inline RegExpObject* asRegExpObject(JSValue value)
+{
+    ASSERT(asObject(value)->inherits(RegExpObject::info()));
+    return static_cast<RegExpObject*>(asObject(value));
+}
+
+} // namespace JSC
diff --git a/runtime/RegExpObjectInlines.h b/runtime/RegExpObjectInlines.h
new file mode 100644
index 0000000..296bd15
--- /dev/null
+++ b/runtime/RegExpObjectInlines.h
@@ -0,0 +1,143 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007, 2008, 2012, 2016 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "ButterflyInlines.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSArray.h"
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+#include "RegExpConstructor.h"
+#include "RegExpMatchesArray.h"
+#include "RegExpObject.h"
+
+namespace JSC {
+
+ALWAYS_INLINE unsigned getRegExpObjectLastIndexAsUnsigned(
+    ExecState* exec, RegExpObject* regExpObject, const String& input)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue jsLastIndex = regExpObject->getLastIndex();
+    unsigned lastIndex;
+    if (LIKELY(jsLastIndex.isUInt32())) {
+        lastIndex = jsLastIndex.asUInt32();
+        if (lastIndex > input.length()) {
+            scope.release();
+            regExpObject->setLastIndex(exec, 0);
+            return UINT_MAX;
+        }
+    } else {
+        double doubleLastIndex = jsLastIndex.toInteger(exec);
+        RETURN_IF_EXCEPTION(scope, UINT_MAX);
+        if (doubleLastIndex < 0 || doubleLastIndex > input.length()) {
+            scope.release();
+            regExpObject->setLastIndex(exec, 0);
+            return UINT_MAX;
+        }
+        lastIndex = static_cast<unsigned>(doubleLastIndex);
+    }
+    return lastIndex;
+}
+
+JSValue RegExpObject::execInline(ExecState* exec, JSGlobalObject* globalObject, JSString* string)
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    RegExp* regExp = this->regExp();
+    RegExpConstructor* regExpConstructor = globalObject->regExpConstructor();
+    String input = string->value(exec);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    bool globalOrSticky = regExp->globalOrSticky();
+
+    unsigned lastIndex;
+    if (globalOrSticky) {
+        lastIndex = getRegExpObjectLastIndexAsUnsigned(exec, this, input);
+        ASSERT(!scope.exception() || lastIndex == UINT_MAX);
+        if (lastIndex == UINT_MAX)
+            return jsNull();
+    } else
+        lastIndex = 0;
+    
+    MatchResult result;
+    JSArray* array =
+        createRegExpMatchesArray(vm, globalObject, string, input, regExp, lastIndex, result);
+    if (!array) {
+        scope.release();
+        if (globalOrSticky)
+            setLastIndex(exec, 0);
+        return jsNull();
+    }
+
+    if (globalOrSticky)
+        setLastIndex(exec, result.end);
+    RETURN_IF_EXCEPTION(scope, { });
+    regExpConstructor->recordMatch(vm, regExp, string, result);
+    return array;
+}
+
+// Shared implementation used by test and exec.
+MatchResult RegExpObject::matchInline(
+    ExecState* exec, JSGlobalObject* globalObject, JSString* string)
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    RegExp* regExp = this->regExp();
+    RegExpConstructor* regExpConstructor = globalObject->regExpConstructor();
+    String input = string->value(exec);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    if (!regExp->global() && !regExp->sticky())
+        return regExpConstructor->performMatch(vm, regExp, string, input, 0);
+
+    unsigned lastIndex = getRegExpObjectLastIndexAsUnsigned(exec, this, input);
+    ASSERT(!scope.exception() || (lastIndex == UINT_MAX));
+    if (lastIndex == UINT_MAX)
+        return MatchResult::failed();
+    
+    MatchResult result = regExpConstructor->performMatch(vm, regExp, string, input, lastIndex);
+    scope.release();
+    setLastIndex(exec, result.end);
+    return result;
+}
+
+unsigned RegExpObject::advanceStringUnicode(String s, unsigned length, unsigned currentIndex)
+{
+    if (currentIndex + 1 >= length)
+        return currentIndex + 1;
+
+    UChar first = s[currentIndex];
+    if (first < 0xD800 || first > 0xDBFF)
+        return currentIndex + 1;
+
+    UChar second = s[currentIndex + 1];
+    if (second < 0xDC00 || second > 0xDFFF)
+        return currentIndex + 1;
+
+    return currentIndex + 2;
+}
+
+} // namespace JSC
diff --git a/runtime/RegExpPrototype.cpp b/runtime/RegExpPrototype.cpp
new file mode 100644
index 0000000..f7816b1
--- /dev/null
+++ b/runtime/RegExpPrototype.cpp
@@ -0,0 +1,721 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007-2008, 2016 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "RegExpPrototype.h"
+
+#include "ArrayPrototype.h"
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "JSArray.h"
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSFunction.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "JSStringBuilder.h"
+#include "Lexer.h"
+#include "ObjectPrototype.h"
+#include "RegExp.h"
+#include "RegExpCache.h"
+#include "RegExpConstructor.h"
+#include "RegExpObject.h"
+#include "StringObject.h"
+#include "StringRecursionChecker.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoGetterGlobal(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoGetterIgnoreCase(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoGetterMultiline(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoGetterSticky(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoGetterUnicode(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoGetterSource(ExecState*);
+static EncodedJSValue JSC_HOST_CALL regExpProtoGetterFlags(ExecState*);
+
+const ClassInfo RegExpPrototype::s_info = { "Object", &Base::s_info, 0, CREATE_METHOD_TABLE(RegExpPrototype) };
+
+RegExpPrototype::RegExpPrototype(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+void RegExpPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->compile, regExpProtoFuncCompile, DontEnum, 2);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->exec, regExpProtoFuncExec, DontEnum, 1, RegExpExecIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->toString, regExpProtoFuncToString, DontEnum, 0);
+    JSC_NATIVE_GETTER(vm.propertyNames->global, regExpProtoGetterGlobal, DontEnum | Accessor);
+    JSC_NATIVE_GETTER(vm.propertyNames->ignoreCase, regExpProtoGetterIgnoreCase, DontEnum | Accessor);
+    JSC_NATIVE_GETTER(vm.propertyNames->multiline, regExpProtoGetterMultiline, DontEnum | Accessor);
+    JSC_NATIVE_GETTER(vm.propertyNames->sticky, regExpProtoGetterSticky, DontEnum | Accessor);
+    JSC_NATIVE_GETTER(vm.propertyNames->unicode, regExpProtoGetterUnicode, DontEnum | Accessor);
+    JSC_NATIVE_GETTER(vm.propertyNames->source, regExpProtoGetterSource, DontEnum | Accessor);
+    JSC_NATIVE_GETTER(vm.propertyNames->flags, regExpProtoGetterFlags, DontEnum | Accessor);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->matchSymbol, regExpPrototypeMatchCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->replaceSymbol, regExpPrototypeReplaceCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->searchSymbol, regExpPrototypeSearchCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->splitSymbol, regExpPrototypeSplitCodeGenerator, DontEnum);
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->test, regExpPrototypeTestCodeGenerator, DontEnum);
+
+    m_emptyRegExp.set(vm, this, RegExp::create(vm, "", NoFlags));
+}
+
+void RegExpPrototype::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    RegExpPrototype* thisObject = jsCast<RegExpPrototype*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    
+    visitor.append(thisObject->m_emptyRegExp);
+}
+
+// ------------------------------ Functions ---------------------------
+
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncTestFast(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(RegExpObject::info()))
+        return throwVMTypeError(exec, scope);
+    JSString* string = exec->argument(0).toStringOrNull(exec);
+    ASSERT(!!scope.exception() == !string);
+    if (!string)
+        return JSValue::encode(jsUndefined());
+    scope.release();
+    return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->test(exec, exec->lexicalGlobalObject(), string)));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(RegExpObject::info()))
+        return throwVMTypeError(exec, scope, "Builtin RegExp exec can only be called on a RegExp object");
+    JSString* string = exec->argument(0).toStringOrNull(exec);
+    ASSERT(!!scope.exception() == !string);
+    if (!string)
+        return JSValue::encode(jsUndefined());
+    scope.release();
+    return JSValue::encode(asRegExpObject(thisValue)->exec(exec, exec->lexicalGlobalObject(), string));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncMatchFast(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(RegExpObject::info()))
+        return throwVMTypeError(exec, scope);
+    JSString* string = exec->argument(0).toStringOrNull(exec);
+    ASSERT(!!scope.exception() == !string);
+    if (!string)
+        return encodedJSValue();
+    if (!asRegExpObject(thisValue)->regExp()->global()) {
+        scope.release();
+        return JSValue::encode(asRegExpObject(thisValue)->exec(exec, exec->lexicalGlobalObject(), string));
+    }
+    scope.release();
+    return JSValue::encode(asRegExpObject(thisValue)->matchGlobal(exec, exec->lexicalGlobalObject(), string));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.inherits(RegExpObject::info()))
+        return throwVMTypeError(exec, scope);
+
+    RegExp* regExp;
+    JSValue arg0 = exec->argument(0);
+    JSValue arg1 = exec->argument(1);
+    
+    if (arg0.inherits(RegExpObject::info())) {
+        if (!arg1.isUndefined())
+            return throwVMTypeError(exec, scope, ASCIILiteral("Cannot supply flags when constructing one RegExp from another."));
+        regExp = asRegExpObject(arg0)->regExp();
+    } else {
+        String pattern = arg0.isUndefined() ? emptyString() : arg0.toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+        RegExpFlags flags = NoFlags;
+        if (!arg1.isUndefined()) {
+            flags = regExpFlags(arg1.toWTFString(exec));
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            if (flags == InvalidFlags)
+                return throwVMError(exec, scope, createSyntaxError(exec, ASCIILiteral("Invalid flags supplied to RegExp constructor.")));
+        }
+        regExp = RegExp::create(vm, pattern, flags);
+    }
+
+    if (!regExp->isValid())
+        return throwVMError(exec, scope, createSyntaxError(exec, regExp->errorMessage()));
+
+    asRegExpObject(thisValue)->setRegExp(vm, regExp);
+    scope.release();
+    asRegExpObject(thisValue)->setLastIndex(exec, 0);
+    return JSValue::encode(thisValue);
+}
+
+typedef std::array<char, 5 + 1> FlagsString; // 5 different flags and a null character terminator.
+
+static inline FlagsString flagsString(ExecState* exec, JSObject* regexp)
+{
+    FlagsString string;
+    string[0] = 0;
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue globalValue = regexp->get(exec, vm.propertyNames->global);
+    RETURN_IF_EXCEPTION(scope, string);
+    JSValue ignoreCaseValue = regexp->get(exec, vm.propertyNames->ignoreCase);
+    RETURN_IF_EXCEPTION(scope, string);
+    JSValue multilineValue = regexp->get(exec, vm.propertyNames->multiline);
+    RETURN_IF_EXCEPTION(scope, string);
+    JSValue unicodeValue = regexp->get(exec, vm.propertyNames->unicode);
+    RETURN_IF_EXCEPTION(scope, string);
+    JSValue stickyValue = regexp->get(exec, vm.propertyNames->sticky);
+    RETURN_IF_EXCEPTION(scope, string);
+
+    unsigned index = 0;
+    if (globalValue.toBoolean(exec))
+        string[index++] = 'g';
+    if (ignoreCaseValue.toBoolean(exec))
+        string[index++] = 'i';
+    if (multilineValue.toBoolean(exec))
+        string[index++] = 'm';
+    if (unicodeValue.toBoolean(exec))
+        string[index++] = 'u';
+    if (stickyValue.toBoolean(exec))
+        string[index++] = 'y';
+    ASSERT(index < string.size());
+    string[index] = 0;
+    return string;
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope);
+
+    JSObject* thisObject = asObject(thisValue);
+
+    StringRecursionChecker checker(exec, thisObject);
+    ASSERT(!scope.exception() || checker.earlyReturnValue());
+    if (JSValue earlyReturnValue = checker.earlyReturnValue())
+        return JSValue::encode(earlyReturnValue);
+
+    JSValue sourceValue = thisObject->get(exec, vm.propertyNames->source);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    String source = sourceValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue flagsValue = thisObject->get(exec, vm.propertyNames->flags);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    String flags = flagsValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, '/', source, '/', flags));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoGetterGlobal(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
+        if (thisValue.inherits(RegExpPrototype::info()))
+            return JSValue::encode(jsUndefined());
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.global getter can only be called on a RegExp object"));
+    }
+
+    return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->global()));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoGetterIgnoreCase(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
+        if (thisValue.inherits(RegExpPrototype::info()))
+            return JSValue::encode(jsUndefined());
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.ignoreCase getter can only be called on a RegExp object"));
+    }
+
+    return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->ignoreCase()));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoGetterMultiline(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
+        if (thisValue.inherits(RegExpPrototype::info()))
+            return JSValue::encode(jsUndefined());
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.multiline getter can only be called on a RegExp object"));
+    }
+
+    return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->multiline()));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoGetterSticky(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
+        if (thisValue.inherits(RegExpPrototype::info()))
+            return JSValue::encode(jsUndefined());
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.sticky getter can only be called on a RegExp object"));
+    }
+    
+    return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->sticky()));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoGetterUnicode(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
+        if (thisValue.inherits(RegExpPrototype::info()))
+            return JSValue::encode(jsUndefined());
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.unicode getter can only be called on a RegExp object"));
+    }
+    
+    return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->unicode()));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoGetterFlags(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (UNLIKELY(!thisValue.isObject()))
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.flags getter can only be called on an object"));
+
+    auto flags = flagsString(exec, asObject(thisValue));
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    return JSValue::encode(jsString(exec, flags.data()));
+}
+
+template <typename CharacterType>
+static inline void appendLineTerminatorEscape(StringBuilder&, CharacterType);
+
+template <>
+inline void appendLineTerminatorEscape<LChar>(StringBuilder& builder, LChar lineTerminator)
+{
+    if (lineTerminator == '\n')
+        builder.append('n');
+    else
+        builder.append('r');
+}
+
+template <>
+inline void appendLineTerminatorEscape<UChar>(StringBuilder& builder, UChar lineTerminator)
+{
+    if (lineTerminator == '\n')
+        builder.append('n');
+    else if (lineTerminator == '\r')
+        builder.append('r');
+    else if (lineTerminator == 0x2028)
+        builder.appendLiteral("u2028");
+    else
+        builder.appendLiteral("u2029");
+}
+
+template <typename CharacterType>
+static inline JSValue regExpProtoGetterSourceInternal(ExecState* exec, const String& pattern, const CharacterType* characters, unsigned length)
+{
+    bool previousCharacterWasBackslash = false;
+    bool inBrackets = false;
+    bool shouldEscape = false;
+
+    // 15.10.6.4 specifies that RegExp.prototype.toString must return '/' + source + '/',
+    // and also states that the result must be a valid RegularExpressionLiteral. '//' is
+    // not a valid RegularExpressionLiteral (since it is a single line comment), and hence
+    // source cannot ever validly be "". If the source is empty, return a different Pattern
+    // that would match the same thing.
+    if (!length)
+        return jsNontrivialString(exec, ASCIILiteral("(?:)"));
+
+    // early return for strings that don't contain a forwards slash and LineTerminator
+    for (unsigned i = 0; i < length; ++i) {
+        CharacterType ch = characters[i];
+        if (!previousCharacterWasBackslash) {
+            if (inBrackets) {
+                if (ch == ']')
+                    inBrackets = false;
+            } else {
+                if (ch == '/') {
+                    shouldEscape = true;
+                    break;
+                }
+                if (ch == '[')
+                    inBrackets = true;
+            }
+        }
+
+        if (Lexer<CharacterType>::isLineTerminator(ch)) {
+            shouldEscape = true;
+            break;
+        }
+
+        if (previousCharacterWasBackslash)
+            previousCharacterWasBackslash = false;
+        else
+            previousCharacterWasBackslash = ch == '\\';
+    }
+
+    if (!shouldEscape)
+        return jsString(exec, pattern);
+
+    previousCharacterWasBackslash = false;
+    inBrackets = false;
+    StringBuilder result;
+    for (unsigned i = 0; i < length; ++i) {
+        CharacterType ch = characters[i];
+        if (!previousCharacterWasBackslash) {
+            if (inBrackets) {
+                if (ch == ']')
+                    inBrackets = false;
+            } else {
+                if (ch == '/')
+                    result.append('\\');
+                else if (ch == '[')
+                    inBrackets = true;
+            }
+        }
+
+        // escape LineTerminator
+        if (Lexer<CharacterType>::isLineTerminator(ch)) {
+            if (!previousCharacterWasBackslash)
+                result.append('\\');
+
+            appendLineTerminatorEscape<CharacterType>(result, ch);
+        } else
+            result.append(ch);
+
+        if (previousCharacterWasBackslash)
+            previousCharacterWasBackslash = false;
+        else
+            previousCharacterWasBackslash = ch == '\\';
+    }
+
+    return jsString(exec, result.toString());
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoGetterSource(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
+        if (thisValue.inherits(RegExpPrototype::info()))
+            return JSValue::encode(jsString(exec, ASCIILiteral("(?:)")));
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.source getter can only be called on a RegExp object"));
+    }
+
+    String pattern = asRegExpObject(thisValue)->regExp()->pattern();
+    if (pattern.is8Bit())
+        return JSValue::encode(regExpProtoGetterSourceInternal(exec, pattern, pattern.characters8(), pattern.length()));
+    return JSValue::encode(regExpProtoGetterSourceInternal(exec, pattern, pattern.characters16(), pattern.length()));
+}
+
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncSearchFast(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    RegExp* regExp = asRegExpObject(thisValue)->regExp();
+
+    JSString* string = exec->uncheckedArgument(0).toString(exec);
+    String s = string->value(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
+    MatchResult result = regExpConstructor->performMatch(vm, regExp, string, s, 0);
+    return JSValue::encode(result ? jsNumber(result.start) : jsNumber(-1));
+}
+
+static inline unsigned advanceStringIndex(String str, unsigned strSize, unsigned index, bool isUnicode)
+{
+    if (!isUnicode)
+        return ++index;
+    return RegExpObject::advanceStringUnicode(str, strSize, index);
+}
+
+enum SplitControl {
+    ContinueSplit,
+    AbortSplit
+};
+
+template<typename ControlFunc, typename PushFunc>
+void genericSplit(
+    VM& vm, RegExp* regexp, const String& input, unsigned inputSize, unsigned& position,
+    unsigned& matchPosition, bool regExpIsSticky, bool regExpIsUnicode,
+    const ControlFunc& control, const PushFunc& push)
+{
+    Vector<int> ovector;
+        
+    while (matchPosition < inputSize) {
+        if (control() == AbortSplit)
+            return;
+        
+        ovector.resize(0);
+        
+        // a. Perform ? Set(splitter, "lastIndex", q, true).
+        // b. Let z be ? RegExpExec(splitter, S).
+        int mpos = regexp->match(vm, input, matchPosition, ovector);
+
+        // c. If z is null, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (mpos < 0) {
+            if (!regExpIsSticky)
+                break;
+            matchPosition = advanceStringIndex(input, inputSize, matchPosition, regExpIsUnicode);
+            continue;
+        }
+        if (static_cast<unsigned>(mpos) >= inputSize) {
+            // The spec redoes the RegExpExec starting at the next character of the input.
+            // But in our case, mpos < 0 means that the native regexp already searched all permutations
+            // and know that we won't be able to find a match for the separator even if we redo the
+            // RegExpExec starting at the next character of the input. So, just bail.
+            break;
+        }
+
+        // d. Else, z is not null
+        //    i. Let e be ? ToLength(? Get(splitter, "lastIndex")).
+        //   ii. Let e be min(e, size).
+        matchPosition = mpos;
+        unsigned matchEnd = ovector[1];
+
+        //  iii. If e = p, let q be AdvanceStringIndex(S, q, unicodeMatching).
+        if (matchEnd == position) {
+            matchPosition = advanceStringIndex(input, inputSize, matchPosition, regExpIsUnicode);
+            continue;
+        }
+        // if matchEnd == 0 then position should also be zero and thus matchEnd should equal position.
+        ASSERT(matchEnd);
+
+        //   iv. Else e != p,
+        unsigned numberOfCaptures = regexp->numSubpatterns();
+        
+        // 1. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through q (exclusive).
+        // 2. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+        if (push(true, position, matchPosition - position) == AbortSplit)
+            return;
+        
+        // 5. Let p be e.
+        position = matchEnd;
+        
+        // 6. Let numberOfCaptures be ? ToLength(? Get(z, "length")).
+        // 7. Let numberOfCaptures be max(numberOfCaptures-1, 0).
+        // 8. Let i be 1.
+        // 9. Repeat, while i <= numberOfCaptures,
+        for (unsigned i = 1; i <= numberOfCaptures; ++i) {
+            // a. Let nextCapture be ? Get(z, ! ToString(i)).
+            // b. Perform ! CreateDataProperty(A, ! ToString(lengthA), nextCapture).
+            int sub = ovector[i * 2];
+            if (push(sub >= 0, sub, ovector[i * 2 + 1] - sub) == AbortSplit)
+                return;
+        }
+        
+        // 10. Let q be p.
+        matchPosition = position;
+    }
+}
+
+// ES 21.2.5.11 RegExp.prototype[@@split](string, limit)
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncSplitFast(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. [handled by JS builtin] Let rx be the this value.
+    // 2. [handled by JS builtin] If Type(rx) is not Object, throw a TypeError exception.
+    JSValue thisValue = exec->thisValue();
+    RegExp* regexp = asRegExpObject(thisValue)->regExp();
+
+    // 3. [handled by JS builtin] Let S be ? ToString(string).
+    JSString* inputString = exec->argument(0).toString(exec);
+    String input = inputString->value(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    ASSERT(!input.isNull());
+
+    // 4. [handled by JS builtin] Let C be ? SpeciesConstructor(rx, %RegExp%).
+    // 5. [handled by JS builtin] Let flags be ? ToString(? Get(rx, "flags")).
+    // 6. [handled by JS builtin] If flags contains "u", let unicodeMatching be true.
+    // 7. [handled by JS builtin] Else, let unicodeMatching be false.
+    // 8. [handled by JS builtin] If flags contains "y", let newFlags be flags.
+    // 9. [handled by JS builtin] Else, let newFlags be the string that is the concatenation of flags and "y".
+    // 10. [handled by JS builtin] Let splitter be ? Construct(C, « rx, newFlags »).
+
+    // 11. Let A be ArrayCreate(0).
+    // 12. Let lengthA be 0.
+    JSArray* result = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    unsigned resultLength = 0;
+
+    // 13. If limit is undefined, let lim be 2^32-1; else let lim be ? ToUint32(limit).
+    JSValue limitValue = exec->argument(1);
+    unsigned limit = limitValue.isUndefined() ? 0xFFFFFFFFu : limitValue.toUInt32(exec);
+
+    // 14. Let size be the number of elements in S.
+    unsigned inputSize = input.length();
+
+    // 15. Let p = 0.
+    unsigned position = 0;
+
+    // 16. If lim == 0, return A.
+    if (!limit)
+        return JSValue::encode(result);
+
+    // 17. If size == 0, then
+    if (input.isEmpty()) {
+        // a. Let z be ? RegExpExec(splitter, S).
+        // b. If z is not null, return A.
+        // c. Perform ! CreateDataProperty(A, "0", S).
+        // d. Return A.
+        if (!regexp->match(vm, input, 0)) {
+            result->putDirectIndex(exec, 0, inputString);
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        }
+        return JSValue::encode(result);
+    }
+
+    // 18. Let q = p.
+    unsigned matchPosition = position;
+    // 19. Repeat, while q < size
+    bool regExpIsSticky = regexp->sticky();
+    bool regExpIsUnicode = regexp->unicode();
+    
+    unsigned maxSizeForDirectPath = 100000;
+    
+    genericSplit(
+        vm, regexp, input, inputSize, position, matchPosition, regExpIsSticky, regExpIsUnicode,
+        [&] () -> SplitControl {
+            if (resultLength >= maxSizeForDirectPath)
+                return AbortSplit;
+            return ContinueSplit;
+        },
+        [&] (bool isDefined, unsigned start, unsigned length) -> SplitControl {
+            result->putDirectIndex(exec, resultLength++, isDefined ? JSRopeString::createSubstringOfResolved(vm, inputString, start, length) : jsUndefined());
+            RETURN_IF_EXCEPTION(scope, AbortSplit);
+            if (resultLength >= limit)
+                return AbortSplit;
+            return ContinueSplit;
+        });
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (resultLength >= limit)
+        return JSValue::encode(result);
+    if (resultLength < maxSizeForDirectPath) {
+        // 20. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through size (exclusive).
+        // 21. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+        scope.release();
+        result->putDirectIndex(exec, resultLength, JSRopeString::createSubstringOfResolved(vm, inputString, position, inputSize - position));
+        
+        // 22. Return A.
+        return JSValue::encode(result);
+    }
+    
+    // Now do a dry run to see how big things get. Give up if they get absurd.
+    unsigned savedPosition = position;
+    unsigned savedMatchPosition = matchPosition;
+    unsigned dryRunCount = 0;
+    genericSplit(
+        vm, regexp, input, inputSize, position, matchPosition, regExpIsSticky, regExpIsUnicode,
+        [&] () -> SplitControl {
+            if (resultLength + dryRunCount >= MAX_STORAGE_VECTOR_LENGTH)
+                return AbortSplit;
+            return ContinueSplit;
+        },
+        [&] (bool, unsigned, unsigned) -> SplitControl {
+            dryRunCount++;
+            if (resultLength + dryRunCount >= limit)
+                return AbortSplit;
+            return ContinueSplit;
+        });
+    
+    if (resultLength + dryRunCount >= MAX_STORAGE_VECTOR_LENGTH) {
+        throwOutOfMemoryError(exec, scope);
+        return encodedJSValue();
+    }
+    
+    // OK, we know that if we finish the split, we won't have to OOM.
+    position = savedPosition;
+    matchPosition = savedMatchPosition;
+    
+    genericSplit(
+        vm, regexp, input, inputSize, position, matchPosition, regExpIsSticky, regExpIsUnicode,
+        [&] () -> SplitControl {
+            return ContinueSplit;
+        },
+        [&] (bool isDefined, unsigned start, unsigned length) -> SplitControl {
+            result->putDirectIndex(exec, resultLength++, isDefined ? JSRopeString::createSubstringOfResolved(vm, inputString, start, length) : jsUndefined());
+            RETURN_IF_EXCEPTION(scope, AbortSplit);
+            if (resultLength >= limit)
+                return AbortSplit;
+            return ContinueSplit;
+        });
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (resultLength >= limit)
+        return JSValue::encode(result);
+    
+    // 20. Let T be a String value equal to the substring of S consisting of the elements at indices p (inclusive) through size (exclusive).
+    // 21. Perform ! CreateDataProperty(A, ! ToString(lengthA), T).
+    scope.release();
+    result->putDirectIndex(exec, resultLength, JSRopeString::createSubstringOfResolved(vm, inputString, position, inputSize - position));
+    // 22. Return A.
+    return JSValue::encode(result);
+}
+
+} // namespace JSC
diff --git a/runtime/RegExpPrototype.h b/runtime/RegExpPrototype.h
new file mode 100644
index 0000000..e78c1a3
--- /dev/null
+++ b/runtime/RegExpPrototype.h
@@ -0,0 +1,65 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2007-2008, 2016 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSObject.h"
+#include "RegExp.h"
+
+namespace JSC {
+
+class RegExpPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static RegExpPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        RegExpPrototype* prototype = new (NotNull, allocateCell<RegExpPrototype>(vm.heap)) RegExpPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+
+    RegExp* emptyRegExp() const { return m_emptyRegExp.get(); }
+
+protected:
+    RegExpPrototype(VM&, Structure*);
+
+private:
+    void finishCreation(VM&, JSGlobalObject*);
+
+    WriteBarrier<RegExp> m_emptyRegExp;
+};
+
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncMatchFast(ExecState*);
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncSearchFast(ExecState*);
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncSplitFast(ExecState*);
+EncodedJSValue JSC_HOST_CALL regExpProtoFuncTestFast(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/RuntimeFlags.h b/runtime/RuntimeFlags.h
new file mode 100644
index 0000000..a423ea9
--- /dev/null
+++ b/runtime/RuntimeFlags.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <initializer_list>
+
+namespace JSC {
+
+// macro(name, isEnabledFlag)
+#define JSC_RUNTIME_FLAG(macro)
+
+class RuntimeFlags {
+private:
+    enum RuntimeFlagShiftValue : unsigned {
+#define JSC_DECLARE_RUNTIME_FLAG_SHIFT_VALUE(name, isEnabledFlag) shiftValueFor##name,
+        JSC_RUNTIME_FLAG(JSC_DECLARE_RUNTIME_FLAG_SHIFT_VALUE)
+#undef JSC_DECLARE_RUNTIME_FLAG_SHIFT_VALUE
+    };
+
+public:
+    enum RuntimeFlag : unsigned {
+#define JSC_DECLARE_RUNTIME_FLAG(name, isEnabledFlag) name = 1u << (shiftValueFor##name),
+        JSC_RUNTIME_FLAG(JSC_DECLARE_RUNTIME_FLAG)
+#undef JSC_DECLARE_RUNTIME_FLAG
+    };
+
+#define JSC_DECLARE_RUNTIME_FLAG_ACCESSOR(name, isEnabledFlag) \
+    void set##name(bool value)\
+    {\
+        if (value)\
+            m_flags |= name;\
+        else\
+            m_flags &= (~name);\
+    }\
+    bool is##name() const\
+    {\
+        return m_flags & name;\
+    }
+    JSC_RUNTIME_FLAG(JSC_DECLARE_RUNTIME_FLAG_ACCESSOR)
+#undef JSC_DECLARE_RUNTIME_FLAG_ACCESSOR
+
+    RuntimeFlags()
+        : RuntimeFlags(0u)
+    {
+    }
+
+    RuntimeFlags(std::initializer_list<RuntimeFlag> initializerList)
+        : RuntimeFlags()
+    {
+        for (RuntimeFlag flag : initializerList)
+            m_flags |= flag;
+    }
+
+    explicit RuntimeFlags(unsigned flags)
+        : m_flags(flags)
+    {
+    }
+
+    static RuntimeFlags createAllEnabled()
+    {
+        return RuntimeFlags(
+#define JSC_USE_RUNTIME_FLAG(name, isEnabledFlag) ((isEnabledFlag) ? name : 0u) |
+            JSC_RUNTIME_FLAG(JSC_USE_RUNTIME_FLAG)
+#undef JSC_USE_RUNTIME_FLAG
+            0u
+        );
+    }
+
+private:
+    unsigned m_flags;
+};
+
+} // namespace JSC
diff --git a/runtime/RuntimeType.cpp b/runtime/RuntimeType.cpp
new file mode 100644
index 0000000..dfd8cc9
--- /dev/null
+++ b/runtime/RuntimeType.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ * Copyright (C) Saam Barati <saambarati1@gmail.com>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+#include "RuntimeType.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+RuntimeType runtimeTypeForValue(JSValue value)
+{
+    if (UNLIKELY(!value))
+        return TypeNothing;
+
+    if (value.isUndefined())
+        return TypeUndefined;
+    if (value.isNull())
+        return TypeNull;
+    if (value.isAnyInt())
+        return TypeAnyInt;
+    if (value.isNumber())
+        return TypeNumber;
+    if (value.isString())
+        return TypeString;
+    if (value.isBoolean())
+        return TypeBoolean;
+    if (value.isObject())
+        return TypeObject;
+    if (value.isFunction())
+        return TypeFunction;
+    if (value.isSymbol())
+        return TypeSymbol;
+
+    return TypeNothing;
+}
+
+String runtimeTypeAsString(RuntimeType type)
+{
+    if (type == TypeUndefined)
+        return ASCIILiteral("Undefined");
+    if (type == TypeNull)
+        return ASCIILiteral("Null");
+    if (type == TypeAnyInt)
+        return ASCIILiteral("Integer");
+    if (type == TypeNumber)
+        return ASCIILiteral("Number");
+    if (type == TypeString)
+        return ASCIILiteral("String");
+    if (type == TypeObject)
+        return ASCIILiteral("Object");
+    if (type == TypeBoolean)
+        return ASCIILiteral("Boolean");
+    if (type == TypeFunction)
+        return ASCIILiteral("Function");
+    if (type == TypeNothing)
+        return ASCIILiteral("(Nothing)");
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return emptyString();
+}
+
+} // namespace JSC
diff --git a/runtime/RuntimeType.h b/runtime/RuntimeType.h
new file mode 100644
index 0000000..82f395f
--- /dev/null
+++ b/runtime/RuntimeType.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) Saam Barati <saambarati1@gmail.com>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+enum RuntimeType : uint16_t {
+    TypeNothing            = 0x0,
+    TypeFunction           = 0x1,
+    TypeUndefined          = 0x2,
+    TypeNull               = 0x4,
+    TypeBoolean            = 0x8,
+    TypeAnyInt             = 0x10,
+    TypeNumber             = 0x20,
+    TypeString             = 0x40,
+    TypeObject             = 0x80,
+    TypeSymbol             = 0x100
+};
+
+typedef uint16_t RuntimeTypeMask;
+
+static const RuntimeTypeMask RuntimeTypeMaskAllTypes = TypeFunction | TypeUndefined | TypeNull | TypeBoolean | TypeAnyInt | TypeNumber | TypeString | TypeObject | TypeSymbol;
+
+class JSValue;
+RuntimeType runtimeTypeForValue(JSValue);
+String runtimeTypeAsString(RuntimeType);
+
+ALWAYS_INLINE bool runtimeTypeIsPrimitive(RuntimeTypeMask type)
+{
+    return type & ~(TypeFunction | TypeObject);
+}
+
+} // namespace JSC
diff --git a/runtime/SamplingCounter.cpp b/runtime/SamplingCounter.cpp
new file mode 100644
index 0000000..b5564b4
--- /dev/null
+++ b/runtime/SamplingCounter.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SamplingCounter.h"
+
+namespace JSC {
+
+void AbstractSamplingCounter::dump()
+{
+#if ENABLE(SAMPLING_COUNTERS)
+    if (s_abstractSamplingCounterChain != &s_abstractSamplingCounterChainEnd) {
+        dataLogF("\nSampling Counter Values:\n");
+        for (AbstractSamplingCounter* currCounter = s_abstractSamplingCounterChain; (currCounter != &s_abstractSamplingCounterChainEnd); currCounter = currCounter->m_next)
+            dataLogF("\t%s\t: %lld\n", currCounter->m_name, currCounter->m_counter);
+        dataLogF("\n\n");
+    }
+    s_completed = true;
+#endif
+}
+
+AbstractSamplingCounter AbstractSamplingCounter::s_abstractSamplingCounterChainEnd;
+AbstractSamplingCounter* AbstractSamplingCounter::s_abstractSamplingCounterChain = &s_abstractSamplingCounterChainEnd;
+bool AbstractSamplingCounter::s_completed = false;
+
+} // namespace JSC
+
diff --git a/runtime/SamplingCounter.h b/runtime/SamplingCounter.h
new file mode 100644
index 0000000..f7ad7d3
--- /dev/null
+++ b/runtime/SamplingCounter.h
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+// AbstractSamplingCounter:
+//
+// Implements a named set of counters, printed on exit if ENABLE(SAMPLING_COUNTERS).
+// See subclasses below, SamplingCounter, GlobalSamplingCounter and DeletableSamplingCounter.
+class AbstractSamplingCounter {
+    friend class DeletableSamplingCounter;
+public:
+    void count(uint32_t count = 1)
+    {
+        m_counter += count;
+    }
+
+    JS_EXPORT_PRIVATE static void dump();
+
+    int64_t* addressOfCounter() { return &m_counter; }
+
+protected:
+    // Effectively the contructor, however called lazily in the case of GlobalSamplingCounter.
+    void init(const char* name)
+    {
+        m_counter = 0;
+        m_name = name;
+
+        // Set m_next to point to the head of the chain, and inform whatever is
+        // currently at the head that this node will now hold the pointer to it.
+        m_next = s_abstractSamplingCounterChain;
+        s_abstractSamplingCounterChain->m_referer = &m_next;
+        // Add this node to the head of the list.
+        s_abstractSamplingCounterChain = this;
+        m_referer = &s_abstractSamplingCounterChain;
+    }
+
+    int64_t m_counter;
+    const char* m_name;
+    AbstractSamplingCounter* m_next;
+    // This is a pointer to the pointer to this node in the chain; used to
+    // allow fast linked list deletion.
+    AbstractSamplingCounter** m_referer;
+    // Null object used to detect end of static chain.
+    static AbstractSamplingCounter s_abstractSamplingCounterChainEnd;
+    JS_EXPORTDATA static AbstractSamplingCounter* s_abstractSamplingCounterChain;
+    static bool s_completed;
+};
+
+#if ENABLE(SAMPLING_COUNTERS)
+// SamplingCounter:
+//
+// This class is suitable and (hopefully!) convenient for cases where a counter is
+// required within the scope of a single function. It can be instantiated as a
+// static variable since it contains a constructor but not a destructor (static
+// variables in WebKit cannot have destructors).
+//
+// For example:
+//
+// void someFunction()
+// {
+//     static SamplingCounter countMe("This is my counter. There are many like it, but this one is mine.");
+//     countMe.count();
+//     // ...
+// }
+//
+class SamplingCounter : public AbstractSamplingCounter {
+public:
+    SamplingCounter(const char* name) { init(name); }
+};
+
+// GlobalSamplingCounter:
+//
+// This class is suitable for use where a counter is to be declared globally,
+// since it contains neither a constructor nor destructor. Instead, ensure
+// that 'name()' is called to provide the counter with a name (and also to
+// allow it to be printed out on exit).
+//
+// GlobalSamplingCounter globalCounter;
+//
+// void firstFunction()
+// {
+//     // Put this within a function that is definitely called!
+//     // (Or alternatively alongside all calls to 'count()').
+//     globalCounter.name("I Name You Destroyer.");
+//     globalCounter.count();
+//     // ...
+// }
+//
+// void secondFunction()
+// {
+//     globalCounter.count();
+//     // ...
+// }
+//
+class GlobalSamplingCounter : public AbstractSamplingCounter {
+public:
+    void name(const char* name)
+    {
+        // Global objects should be mapped in zero filled memory, so this should
+        // be a safe (albeit not necessarily threadsafe) check for 'first call'.
+        if (!m_next)
+            init(name);
+    }
+};
+
+// DeletableSamplingCounter:
+//
+// The above classes (SamplingCounter, GlobalSamplingCounter), are intended for
+// use within a global or static scope, and as such cannot have a destructor.
+// This means there is no convenient way for them to remove themselves from the
+// static list of counters, and should an instance of either class be freed
+// before 'dump()' has walked over the list it will potentially walk over an
+// invalid pointer.
+//
+// This class is intended for use where the counter may possibly be deleted before
+// the program exits. Should this occur, the counter will print it's value to
+// stderr, and remove itself from the static list. Example:
+//
+// DeletableSamplingCounter* counter = new DeletableSamplingCounter("The Counter With No Name");
+// counter->count();
+// delete counter;
+//
+class DeletableSamplingCounter : public AbstractSamplingCounter {
+public:
+    DeletableSamplingCounter(const char* name) { init(name); }
+
+    ~DeletableSamplingCounter()
+    {
+        if (!s_completed)
+            dataFile("DeletableSamplingCounter \"%s\" deleted early (with count %lld)\n", m_name, m_counter);
+        // Our m_referer pointer should know where the pointer to this node is,
+        // and m_next should know that this node is the previous node in the list.
+        ASSERT(*m_referer == this);
+        ASSERT(m_next->m_referer == &m_next);
+        // Remove this node from the list, and inform m_next that we have done so.
+        m_next->m_referer = m_referer;
+        *m_referer = m_next;
+    }
+};
+#endif
+
+} // namespace JSC
diff --git a/runtime/SamplingProfiler.cpp b/runtime/SamplingProfiler.cpp
new file mode 100644
index 0000000..7034dc6
--- /dev/null
+++ b/runtime/SamplingProfiler.cpp
@@ -0,0 +1,943 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SamplingProfiler.h"
+
+#if ENABLE(SAMPLING_PROFILER)
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "CodeBlockSet.h"
+#include "HeapIterationScope.h"
+#include "HeapUtil.h"
+#include "InlineCallFrame.h"
+#include "Interpreter.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "LLIntPCRanges.h"
+#include "MarkedBlock.h"
+#include "MarkedBlockSet.h"
+#include "MarkedSpaceInlines.h"
+#include "NativeExecutable.h"
+#include "PCToCodeOriginMap.h"
+#include "SlotVisitor.h"
+#include "VM.h"
+#include <wtf/HashSet.h>
+#include <wtf/RandomNumber.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+static double sNumTotalStackTraces = 0;
+static double sNumTotalWalks = 0;
+static double sNumFailedWalks = 0;
+static const uint32_t sNumWalkReportingFrequency = 50;
+static const double sWalkErrorPercentage = .05;
+static const bool sReportStatsOnlyWhenTheyreAboveThreshold = false;
+static const bool sReportStats = false;
+
+using FrameType = SamplingProfiler::FrameType;
+using UnprocessedStackFrame = SamplingProfiler::UnprocessedStackFrame;
+
+ALWAYS_INLINE static void reportStats()
+{
+    if (sReportStats && sNumTotalWalks && static_cast<uint64_t>(sNumTotalWalks) % sNumWalkReportingFrequency == 0) {
+        if (!sReportStatsOnlyWhenTheyreAboveThreshold || (sNumFailedWalks / sNumTotalWalks > sWalkErrorPercentage)) {
+            dataLogF("Num total walks: %llu. Failed walks percent: %lf\n",
+                static_cast<unsigned long long>(sNumTotalWalks), sNumFailedWalks / sNumTotalWalks);
+        }
+    }
+}
+
+class FrameWalker {
+public:
+    FrameWalker(ExecState* callFrame, VM& vm, const LockHolder& codeBlockSetLocker, const LockHolder& machineThreadsLocker)
+        : m_vm(vm)
+        , m_callFrame(callFrame)
+        , m_vmEntryFrame(vm.topVMEntryFrame)
+        , m_codeBlockSetLocker(codeBlockSetLocker)
+        , m_machineThreadsLocker(machineThreadsLocker)
+    {
+    }
+
+    SUPPRESS_ASAN
+    size_t walk(Vector<UnprocessedStackFrame>& stackTrace, bool& didRunOutOfSpace)
+    {
+        if (sReportStats)
+            sNumTotalWalks++;
+        resetAtMachineFrame();
+        size_t maxStackTraceSize = stackTrace.size();
+        while (!isAtTop() && !m_bailingOut && m_depth < maxStackTraceSize) {
+            CallSiteIndex callSiteIndex;
+            JSValue unsafeCallee = m_callFrame->unsafeCallee();
+            CodeBlock* codeBlock = m_callFrame->unsafeCodeBlock();
+            if (codeBlock) {
+                ASSERT(isValidCodeBlock(codeBlock));
+                callSiteIndex = m_callFrame->unsafeCallSiteIndex();
+            }
+            stackTrace[m_depth] = UnprocessedStackFrame(codeBlock, JSValue::encode(unsafeCallee), callSiteIndex);
+            m_depth++;
+            advanceToParentFrame();
+            resetAtMachineFrame();
+        }
+        didRunOutOfSpace = m_depth >= maxStackTraceSize && !isAtTop();
+        reportStats();
+        return m_depth;
+    }
+
+    bool wasValidWalk() const
+    {
+        return !m_bailingOut;
+    }
+
+private:
+
+    SUPPRESS_ASAN
+    void advanceToParentFrame()
+    {
+        m_callFrame = m_callFrame->unsafeCallerFrame(m_vmEntryFrame);
+    }
+
+    bool isAtTop() const
+    {
+        return !m_callFrame;
+    }
+
+    SUPPRESS_ASAN
+    void resetAtMachineFrame()
+    {
+        if (isAtTop())
+            return;
+
+        if (!isValidFramePointer(m_callFrame)) {
+            // Guard against pausing the process at weird program points.
+            m_bailingOut = true;
+            if (sReportStats)
+                sNumFailedWalks++;
+            return;
+        }
+
+        CodeBlock* codeBlock = m_callFrame->unsafeCodeBlock();
+        if (!codeBlock)
+            return;
+
+        if (!isValidCodeBlock(codeBlock)) {
+            m_bailingOut = true;
+            if (sReportStats)
+                sNumFailedWalks++;
+            return;
+        }
+    }
+
+    bool isValidFramePointer(ExecState* exec)
+    {
+        uint8_t* fpCast = bitwise_cast<uint8_t*>(exec);
+        for (MachineThreads::Thread* thread = m_vm.heap.machineThreads().threadsListHead(m_machineThreadsLocker); thread; thread = thread->next) {
+            uint8_t* stackBase = static_cast<uint8_t*>(thread->stackBase);
+            uint8_t* stackLimit = static_cast<uint8_t*>(thread->stackEnd);
+            RELEASE_ASSERT(stackBase);
+            RELEASE_ASSERT(stackLimit);
+            if (fpCast <= stackBase && fpCast >= stackLimit)
+                return true;
+        }
+        return false;
+    }
+
+    bool isValidCodeBlock(CodeBlock* codeBlock)
+    {
+        if (!codeBlock)
+            return false;
+        bool result = m_vm.heap.codeBlockSet().contains(m_codeBlockSetLocker, codeBlock);
+        return result;
+    }
+
+    VM& m_vm;
+    ExecState* m_callFrame;
+    VMEntryFrame* m_vmEntryFrame;
+    const LockHolder& m_codeBlockSetLocker;
+    const LockHolder& m_machineThreadsLocker;
+    bool m_bailingOut { false };
+    size_t m_depth { 0 };
+};
+
+SamplingProfiler::SamplingProfiler(VM& vm, RefPtr<Stopwatch>&& stopwatch)
+    : m_vm(vm)
+    , m_stopwatch(WTFMove(stopwatch))
+    , m_timingInterval(std::chrono::microseconds(Options::sampleInterval()))
+    , m_threadIdentifier(0)
+    , m_jscExecutionThread(nullptr)
+    , m_isPaused(false)
+    , m_isShutDown(false)
+{
+    if (sReportStats) {
+        sNumTotalWalks = 0;
+        sNumFailedWalks = 0;
+    }
+
+    m_currentFrames.grow(256);
+}
+
+SamplingProfiler::~SamplingProfiler()
+{
+}
+
+void SamplingProfiler::createThreadIfNecessary(const LockHolder&)
+{
+    ASSERT(m_lock.isLocked());
+
+    if (m_threadIdentifier)
+        return;
+
+    RefPtr<SamplingProfiler> profiler = this;
+    m_threadIdentifier = createThread("jsc.sampling-profiler.thread", [profiler] {
+        profiler->timerLoop();
+    });
+}
+
+void SamplingProfiler::timerLoop()
+{
+    while (true) {
+        std::chrono::microseconds stackTraceProcessingTime = std::chrono::microseconds(0);
+        {
+            LockHolder locker(m_lock);
+            if (UNLIKELY(m_isShutDown))
+                return;
+
+            if (!m_isPaused && m_jscExecutionThread)
+                takeSample(locker, stackTraceProcessingTime);
+
+            m_lastTime = m_stopwatch->elapsedTime();
+        }
+
+        // Read section 6.2 of this paper for more elaboration of why we add a random
+        // fluctuation here. The main idea is to prevent our timer from being in sync
+        // with some system process such as a scheduled context switch.
+        // http://plv.colorado.edu/papers/mytkowicz-pldi10.pdf
+        double randomSignedNumber = (randomNumber() * 2.0) - 1.0; // A random number between [-1, 1).
+        std::chrono::microseconds randomFluctuation = std::chrono::microseconds(static_cast<uint64_t>(randomSignedNumber * static_cast<double>(m_timingInterval.count()) * 0.20l));
+        std::this_thread::sleep_for(m_timingInterval - std::min(m_timingInterval, stackTraceProcessingTime) + randomFluctuation);
+    }
+}
+
+void SamplingProfiler::takeSample(const LockHolder&, std::chrono::microseconds& stackTraceProcessingTime)
+{
+    ASSERT(m_lock.isLocked());
+    if (m_vm.entryScope) {
+        double nowTime = m_stopwatch->elapsedTime();
+
+        LockHolder machineThreadsLocker(m_vm.heap.machineThreads().getLock());
+        LockHolder codeBlockSetLocker(m_vm.heap.codeBlockSet().getLock());
+        LockHolder executableAllocatorLocker(m_vm.executableAllocator.getLock());
+
+        bool didSuspend = m_jscExecutionThread->suspend();
+        if (didSuspend) {
+            // While the JSC thread is suspended, we can't do things like malloc because the JSC thread
+            // may be holding the malloc lock.
+            ExecState* callFrame;
+            void* machinePC;
+            bool topFrameIsLLInt = false;
+            void* llintPC;
+            {
+                MachineThreads::Thread::Registers registers;
+                m_jscExecutionThread->getRegisters(registers);
+                callFrame = static_cast<ExecState*>(registers.framePointer());
+                machinePC = registers.instructionPointer();
+                llintPC = registers.llintPC();
+                m_jscExecutionThread->freeRegisters(registers);
+            }
+            // FIXME: Lets have a way of detecting when we're parsing code.
+            // https://bugs.webkit.org/show_bug.cgi?id=152761
+            if (m_vm.executableAllocator.isValidExecutableMemory(executableAllocatorLocker, machinePC)) {
+                if (m_vm.isExecutingInRegExpJIT) {
+                    // FIXME: We're executing a regexp. Lets gather more intersting data.
+                    // https://bugs.webkit.org/show_bug.cgi?id=152729
+                    callFrame = m_vm.topCallFrame; // We need to do this or else we'd fail our backtrace validation b/c this isn't a JS frame.
+                }
+            } else if (LLInt::isLLIntPC(machinePC)) {
+                topFrameIsLLInt = true;
+                // We're okay to take a normal stack trace when the PC
+                // is in LLInt code.
+            } else {
+                // We resort to topCallFrame to see if we can get anything
+                // useful. We usually get here when we're executing C code.
+                callFrame = m_vm.topCallFrame;
+            }
+
+            size_t walkSize;
+            bool wasValidWalk;
+            bool didRunOutOfVectorSpace;
+            {
+                FrameWalker walker(callFrame, m_vm, codeBlockSetLocker, machineThreadsLocker);
+                walkSize = walker.walk(m_currentFrames, didRunOutOfVectorSpace);
+                wasValidWalk = walker.wasValidWalk();
+            }
+
+            m_jscExecutionThread->resume();
+
+            auto startTime = std::chrono::steady_clock::now();
+            // We can now use data structures that malloc, and do other interesting things, again.
+
+            // FIXME: It'd be interesting to take data about the program's state when
+            // we fail to take a stack trace: https://bugs.webkit.org/show_bug.cgi?id=152758
+            if (wasValidWalk && walkSize) {
+                if (sReportStats)
+                    sNumTotalStackTraces++;
+                Vector<UnprocessedStackFrame> stackTrace;
+                stackTrace.reserveInitialCapacity(walkSize);
+                for (size_t i = 0; i < walkSize; i++) {
+                    UnprocessedStackFrame frame = m_currentFrames[i];
+                    stackTrace.uncheckedAppend(frame);
+                }
+
+                m_unprocessedStackTraces.append(UnprocessedStackTrace { nowTime, machinePC, topFrameIsLLInt, llintPC, WTFMove(stackTrace) });
+
+                if (didRunOutOfVectorSpace)
+                    m_currentFrames.grow(m_currentFrames.size() * 1.25);
+            }
+
+            auto endTime = std::chrono::steady_clock::now();
+            stackTraceProcessingTime = std::chrono::duration_cast<std::chrono::microseconds>(endTime - startTime);
+        }
+    }
+}
+
+static ALWAYS_INLINE unsigned tryGetBytecodeIndex(unsigned llintPC, CodeBlock* codeBlock, bool& isValid)
+{
+#if ENABLE(DFG_JIT)
+    RELEASE_ASSERT(!codeBlock->hasCodeOrigins());
+#endif
+
+#if USE(JSVALUE64)
+    unsigned bytecodeIndex = llintPC;
+    if (bytecodeIndex < codeBlock->instructionCount()) {
+        isValid = true;
+        return bytecodeIndex;
+    }
+    isValid = false;
+    return 0;
+#else
+    Instruction* instruction = bitwise_cast<Instruction*>(llintPC);
+    if (instruction >= codeBlock->instructions().begin() && instruction < codeBlock->instructions().begin() + codeBlock->instructionCount()) {
+        isValid = true;
+        unsigned bytecodeIndex = instruction - codeBlock->instructions().begin();
+        return bytecodeIndex;
+    }
+    isValid = false;
+    return 0;
+#endif
+}
+
+void SamplingProfiler::processUnverifiedStackTraces()
+{
+    // This function needs to be called from the JSC execution thread.
+    RELEASE_ASSERT(m_lock.isLocked());
+
+    TinyBloomFilter filter = m_vm.heap.objectSpace().blocks().filter();
+
+    for (UnprocessedStackTrace& unprocessedStackTrace : m_unprocessedStackTraces) {
+        m_stackTraces.append(StackTrace());
+        StackTrace& stackTrace = m_stackTraces.last();
+        stackTrace.timestamp = unprocessedStackTrace.timestamp;
+
+        auto appendCodeBlock = [&] (CodeBlock* codeBlock, unsigned bytecodeIndex) {
+            stackTrace.frames.append(StackFrame(codeBlock->ownerExecutable()));
+            m_liveCellPointers.add(codeBlock->ownerExecutable());
+
+            if (bytecodeIndex < codeBlock->instructionCount()) {
+                int divot;
+                int startOffset;
+                int endOffset;
+                codeBlock->expressionRangeForBytecodeOffset(bytecodeIndex, divot, startOffset, endOffset,
+                    stackTrace.frames.last().lineNumber, stackTrace.frames.last().columnNumber);
+                stackTrace.frames.last().bytecodeIndex = bytecodeIndex;
+            }
+            if (Options::collectSamplingProfilerDataForJSCShell()) {
+                stackTrace.frames.last().codeBlockHash = codeBlock->hash();
+                stackTrace.frames.last().jitType = codeBlock->jitType();
+            }
+        };
+
+        auto appendEmptyFrame = [&] {
+            stackTrace.frames.append(StackFrame());
+        };
+
+        auto storeCalleeIntoTopFrame = [&] (EncodedJSValue encodedCallee) {
+            // Set the callee if it's a valid GC object.
+            JSValue callee = JSValue::decode(encodedCallee);
+            StackFrame& stackFrame = stackTrace.frames.last();
+            bool alreadyHasExecutable = !!stackFrame.executable;
+            if (!HeapUtil::isValueGCObject(m_vm.heap, filter, callee)) {
+                if (!alreadyHasExecutable)
+                    stackFrame.frameType = FrameType::Unknown;
+                return;
+            }
+
+            JSCell* calleeCell = callee.asCell();
+            auto setFallbackFrameType = [&] {
+                ASSERT(!alreadyHasExecutable);
+                FrameType result = FrameType::Unknown;
+                CallData callData;
+                CallType callType;
+                callType = getCallData(calleeCell, callData);
+                if (callType == CallType::Host)
+                    result = FrameType::Host;
+
+                stackFrame.frameType = result;
+            };
+
+            auto addCallee = [&] (JSObject* callee) {
+                stackFrame.callee = callee;
+                m_liveCellPointers.add(callee);
+            };
+
+            if (calleeCell->type() != JSFunctionType) {
+                if (JSObject* object = jsDynamicCast<JSObject*>(calleeCell))
+                    addCallee(object);
+
+                if (!alreadyHasExecutable)
+                    setFallbackFrameType();
+
+                return;
+            }
+
+            addCallee(jsCast<JSFunction*>(calleeCell));
+
+            if (alreadyHasExecutable)
+                return;
+
+            ExecutableBase* executable = jsCast<JSFunction*>(calleeCell)->executable();
+            if (!executable) {
+                setFallbackFrameType();
+                return;
+            }
+
+            RELEASE_ASSERT(HeapUtil::isPointerGCObjectJSCell(m_vm.heap, filter, executable));
+            stackFrame.frameType = FrameType::Executable;
+            stackFrame.executable = executable;
+            m_liveCellPointers.add(executable);
+        };
+
+
+        // Prepend the top-most inlined frame if needed and gather
+        // location information about where the top frame is executing.
+        size_t startIndex = 0;
+        if (unprocessedStackTrace.frames.size() && !!unprocessedStackTrace.frames[0].verifiedCodeBlock) {
+            CodeBlock* topCodeBlock = unprocessedStackTrace.frames[0].verifiedCodeBlock;
+            if (unprocessedStackTrace.topFrameIsLLInt) {
+                // We reuse LLInt CodeBlocks for the baseline JIT, so we need to check for both jit types.
+                // This might also be false for various reasons (known and unknown), even though
+                // it's super unlikely. One reason that this can be false is when we throw from a DFG frame,
+                // and we end up having to unwind past a VMEntryFrame, we will end up executing
+                // inside the LLInt's handleUncaughtException. So we just protect against this
+                // by ignoring it.
+                unsigned bytecodeIndex = 0;
+                if (topCodeBlock->jitType() == JITCode::InterpreterThunk || topCodeBlock->jitType() == JITCode::BaselineJIT) {
+                    bool isValidPC;
+                    unsigned bits;
+#if USE(JSVALUE64)
+                    bits = static_cast<unsigned>(bitwise_cast<uintptr_t>(unprocessedStackTrace.llintPC));
+#else
+                    bits = bitwise_cast<unsigned>(unprocessedStackTrace.llintPC);
+#endif
+                    bytecodeIndex = tryGetBytecodeIndex(bits, topCodeBlock, isValidPC);
+
+                    UNUSED_PARAM(isValidPC); // FIXME: do something with this info for the web inspector: https://bugs.webkit.org/show_bug.cgi?id=153455
+
+                    appendCodeBlock(topCodeBlock, bytecodeIndex);
+                    storeCalleeIntoTopFrame(unprocessedStackTrace.frames[0].unverifiedCallee);
+                    startIndex = 1;
+                }
+            } else if (std::optional<CodeOrigin> codeOrigin = topCodeBlock->findPC(unprocessedStackTrace.topPC)) {
+                codeOrigin->walkUpInlineStack([&] (const CodeOrigin& codeOrigin) {
+                    appendCodeBlock(codeOrigin.inlineCallFrame ? codeOrigin.inlineCallFrame->baselineCodeBlock.get() : topCodeBlock, codeOrigin.bytecodeIndex);
+                });
+                storeCalleeIntoTopFrame(unprocessedStackTrace.frames[0].unverifiedCallee);
+                startIndex = 1;
+            }
+        }
+
+        for (size_t i = startIndex; i < unprocessedStackTrace.frames.size(); i++) {
+            UnprocessedStackFrame& unprocessedStackFrame = unprocessedStackTrace.frames[i];
+            if (CodeBlock* codeBlock = unprocessedStackFrame.verifiedCodeBlock) {
+                CallSiteIndex callSiteIndex = unprocessedStackFrame.callSiteIndex;
+
+                auto appendCodeBlockNoInlining = [&] {
+                    bool isValidPC;
+                    appendCodeBlock(codeBlock, tryGetBytecodeIndex(callSiteIndex.bits(), codeBlock, isValidPC));
+                };
+
+#if ENABLE(DFG_JIT)
+                if (codeBlock->hasCodeOrigins()) {
+                    if (codeBlock->canGetCodeOrigin(callSiteIndex)) {
+                        codeBlock->codeOrigin(callSiteIndex).walkUpInlineStack([&] (const CodeOrigin& codeOrigin) {
+                            appendCodeBlock(codeOrigin.inlineCallFrame ? codeOrigin.inlineCallFrame->baselineCodeBlock.get() : codeBlock, codeOrigin.bytecodeIndex);
+                        });
+                    } else
+                        appendCodeBlock(codeBlock, std::numeric_limits<unsigned>::max());
+                } else
+                    appendCodeBlockNoInlining();
+#else
+                appendCodeBlockNoInlining();
+#endif
+            } else
+                appendEmptyFrame();
+
+            // Note that this is okay to do if we walked the inline stack because
+            // the machine frame will be at the top of the processed stack trace.
+            storeCalleeIntoTopFrame(unprocessedStackFrame.unverifiedCallee);
+        }
+    }
+
+    m_unprocessedStackTraces.clear();
+}
+
+void SamplingProfiler::visit(SlotVisitor& slotVisitor)
+{
+    RELEASE_ASSERT(m_lock.isLocked());
+    for (JSCell* cell : m_liveCellPointers)
+        slotVisitor.appendUnbarriered(cell);
+}
+
+void SamplingProfiler::shutdown()
+{
+    LockHolder locker(m_lock);
+    m_isShutDown = true;
+}
+
+void SamplingProfiler::start()
+{
+    LockHolder locker(m_lock);
+    start(locker);
+}
+
+void SamplingProfiler::start(const LockHolder& locker)
+{
+    ASSERT(m_lock.isLocked());
+    m_isPaused = false;
+    createThreadIfNecessary(locker);
+}
+
+void SamplingProfiler::pause(const LockHolder&)
+{
+    ASSERT(m_lock.isLocked());
+    m_isPaused = true;
+    reportStats();
+}
+
+void SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread(const LockHolder&)
+{
+    ASSERT(m_lock.isLocked());
+    m_jscExecutionThread = m_vm.heap.machineThreads().machineThreadForCurrentThread();
+}
+
+void SamplingProfiler::noticeCurrentThreadAsJSCExecutionThread()
+{
+    LockHolder locker(m_lock);
+    noticeCurrentThreadAsJSCExecutionThread(locker);
+}
+
+void SamplingProfiler::noticeJSLockAcquisition()
+{
+    LockHolder locker(m_lock);
+    noticeCurrentThreadAsJSCExecutionThread(locker);
+}
+
+void SamplingProfiler::noticeVMEntry()
+{
+    LockHolder locker(m_lock);
+    ASSERT(m_vm.entryScope);
+    noticeCurrentThreadAsJSCExecutionThread(locker);
+    m_lastTime = m_stopwatch->elapsedTime();
+    createThreadIfNecessary(locker);
+}
+
+void SamplingProfiler::clearData(const LockHolder&)
+{
+    ASSERT(m_lock.isLocked());
+    m_stackTraces.clear();
+    m_liveCellPointers.clear();
+    m_unprocessedStackTraces.clear();
+}
+
+String SamplingProfiler::StackFrame::nameFromCallee(VM& vm)
+{
+    if (!callee)
+        return String();
+
+    auto scope = DECLARE_CATCH_SCOPE(vm);
+    ExecState* exec = callee->globalObject()->globalExec();
+    auto getPropertyIfPureOperation = [&] (const Identifier& ident) -> String {
+        PropertySlot slot(callee, PropertySlot::InternalMethodType::VMInquiry);
+        PropertyName propertyName(ident);
+        bool hasProperty = callee->getPropertySlot(exec, propertyName, slot);
+        ASSERT_UNUSED(scope, !scope.exception());
+        if (hasProperty) {
+            if (slot.isValue()) {
+                JSValue nameValue = slot.getValue(exec, propertyName);
+                if (isJSString(nameValue))
+                    return asString(nameValue)->tryGetValue();
+            }
+        }
+        return String();
+    };
+
+    String name = getPropertyIfPureOperation(vm.propertyNames->displayName);
+    if (!name.isEmpty())
+        return name;
+
+    return getPropertyIfPureOperation(vm.propertyNames->name);
+}
+
+String SamplingProfiler::StackFrame::displayName(VM& vm)
+{
+    {
+        String name = nameFromCallee(vm);
+        if (!name.isEmpty())
+            return name;
+    }
+
+    if (frameType == FrameType::Unknown)
+        return ASCIILiteral("(unknown)");
+    if (frameType == FrameType::Host)
+        return ASCIILiteral("(host)");
+
+    if (executable->isHostFunction())
+        return static_cast<NativeExecutable*>(executable)->name();
+
+    if (executable->isFunctionExecutable())
+        return static_cast<FunctionExecutable*>(executable)->inferredName().string();
+    if (executable->isProgramExecutable() || executable->isEvalExecutable())
+        return ASCIILiteral("(program)");
+    if (executable->isModuleProgramExecutable())
+        return ASCIILiteral("(module)");
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return String();
+}
+
+String SamplingProfiler::StackFrame::displayNameForJSONTests(VM& vm)
+{
+    {
+        String name = nameFromCallee(vm);
+        if (!name.isEmpty())
+            return name;
+    }
+
+    if (frameType == FrameType::Unknown)
+        return ASCIILiteral("(unknown)");
+    if (frameType == FrameType::Host)
+        return ASCIILiteral("(host)");
+
+    if (executable->isHostFunction())
+        return static_cast<NativeExecutable*>(executable)->name();
+
+    if (executable->isFunctionExecutable()) {
+        String result = static_cast<FunctionExecutable*>(executable)->inferredName().string();
+        if (result.isEmpty())
+            return ASCIILiteral("(anonymous function)");
+        return result;
+    }
+    if (executable->isEvalExecutable())
+        return ASCIILiteral("(eval)");
+    if (executable->isProgramExecutable())
+        return ASCIILiteral("(program)");
+    if (executable->isModuleProgramExecutable())
+        return ASCIILiteral("(module)");
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return String();
+}
+
+int SamplingProfiler::StackFrame::functionStartLine()
+{
+    if (frameType == FrameType::Unknown || frameType == FrameType::Host)
+        return -1;
+
+    if (executable->isHostFunction())
+        return -1;
+    return static_cast<ScriptExecutable*>(executable)->firstLine();
+}
+
+unsigned SamplingProfiler::StackFrame::functionStartColumn()
+{
+    if (frameType == FrameType::Unknown || frameType == FrameType::Host)
+        return std::numeric_limits<unsigned>::max();
+
+    if (executable->isHostFunction())
+        return std::numeric_limits<unsigned>::max();
+
+    return static_cast<ScriptExecutable*>(executable)->startColumn();
+}
+
+intptr_t SamplingProfiler::StackFrame::sourceID()
+{
+    if (frameType == FrameType::Unknown || frameType == FrameType::Host)
+        return -1;
+
+    if (executable->isHostFunction())
+        return -1;
+
+    return static_cast<ScriptExecutable*>(executable)->sourceID();
+}
+
+String SamplingProfiler::StackFrame::url()
+{
+    if (frameType == FrameType::Unknown || frameType == FrameType::Host)
+        return emptyString();
+
+    if (executable->isHostFunction())
+        return emptyString();
+
+    String url = static_cast<ScriptExecutable*>(executable)->sourceURL();
+    if (url.isEmpty())
+        return static_cast<ScriptExecutable*>(executable)->source().provider()->sourceURL(); // Fall back to sourceURL directive.
+    return url;
+}
+
+Vector<SamplingProfiler::StackTrace> SamplingProfiler::releaseStackTraces(const LockHolder& locker)
+{
+    ASSERT(m_lock.isLocked());
+    {
+        HeapIterationScope heapIterationScope(m_vm.heap);
+        processUnverifiedStackTraces();
+    }
+
+    Vector<StackTrace> result(WTFMove(m_stackTraces));
+    clearData(locker);
+    return result;
+}
+
+String SamplingProfiler::stackTracesAsJSON()
+{
+    DeferGC deferGC(m_vm.heap);
+    LockHolder locker(m_lock);
+
+    {
+        HeapIterationScope heapIterationScope(m_vm.heap);
+        processUnverifiedStackTraces();
+    }
+
+    StringBuilder json;
+    json.append('[');
+
+    bool loopedOnce = false;
+    auto comma = [&] {
+        if (loopedOnce)
+            json.append(',');
+    };
+    for (StackTrace& stackTrace : m_stackTraces) {
+        comma();
+        json.append('[');
+        loopedOnce = false;
+        for (StackFrame& stackFrame : stackTrace.frames) {
+            comma();
+            json.append('"');
+            json.append(stackFrame.displayNameForJSONTests(m_vm));
+            json.append('"');
+            loopedOnce = true;
+        }
+        json.append(']');
+        loopedOnce = true;
+    }
+
+    json.append(']');
+
+    clearData(locker);
+
+    return json.toString();
+}
+
+void SamplingProfiler::registerForReportAtExit()
+{
+    static StaticLock registrationLock;
+    static HashSet<RefPtr<SamplingProfiler>>* profilesToReport;
+
+    LockHolder holder(registrationLock);
+
+    if (!profilesToReport) {
+        profilesToReport = new HashSet<RefPtr<SamplingProfiler>>();
+        atexit([]() {
+            for (auto profile : *profilesToReport)
+                profile->reportDataToOptionFile();
+        });
+    }
+
+    profilesToReport->add(adoptRef(this));
+    m_needsReportAtExit = true;
+}
+
+void SamplingProfiler::reportDataToOptionFile()
+{
+    if (m_needsReportAtExit) {
+        m_needsReportAtExit = false;
+        const char* path = Options::samplingProfilerPath();
+        StringPrintStream pathOut;
+        pathOut.print(path, "/");
+        pathOut.print("JSCSampilingProfile-", reinterpret_cast<uintptr_t>(this), ".txt");
+        auto out = FilePrintStream::open(pathOut.toCString().data(), "w");
+        reportTopFunctions(*out);
+        reportTopBytecodes(*out);
+    }
+}
+
+void SamplingProfiler::reportTopFunctions()
+{
+    reportTopFunctions(WTF::dataFile());
+}
+
+void SamplingProfiler::reportTopFunctions(PrintStream& out)
+{
+    LockHolder locker(m_lock);
+
+    {
+        HeapIterationScope heapIterationScope(m_vm.heap);
+        processUnverifiedStackTraces();
+    }
+
+
+    HashMap<String, size_t> functionCounts;
+    for (StackTrace& stackTrace : m_stackTraces) {
+        if (!stackTrace.frames.size())
+            continue;
+
+        StackFrame& frame = stackTrace.frames.first();
+        String frameDescription = makeString(frame.displayName(m_vm), ":", String::number(frame.sourceID()));
+        functionCounts.add(frameDescription, 0).iterator->value++;
+    }
+
+    auto takeMax = [&] () -> std::pair<String, size_t> {
+        String maxFrameDescription;
+        size_t maxFrameCount = 0;
+        for (auto entry : functionCounts) {
+            if (entry.value > maxFrameCount) {
+                maxFrameCount = entry.value;
+                maxFrameDescription = entry.key;
+            }
+        }
+        if (!maxFrameDescription.isEmpty())
+            functionCounts.remove(maxFrameDescription);
+        return std::make_pair(maxFrameDescription, maxFrameCount);
+    };
+
+    out.print("\n\nSampling rate: ", m_timingInterval.count(), " microseconds\n");
+    out.print("Hottest functions as <numSamples  'functionName:sourceID'>\n");
+    for (size_t i = 0; i < 40; i++) {
+        auto pair = takeMax();
+        if (pair.first.isEmpty())
+            break;
+        out.printf("%6zu ", pair.second);
+        out.print("   '", pair.first, "'\n");
+    }
+}
+
+void SamplingProfiler::reportTopBytecodes()
+{
+    reportTopBytecodes(WTF::dataFile());
+}
+
+void SamplingProfiler::reportTopBytecodes(PrintStream& out)
+{
+    LockHolder locker(m_lock);
+
+    {
+        HeapIterationScope heapIterationScope(m_vm.heap);
+        processUnverifiedStackTraces();
+    }
+
+    HashMap<String, size_t> bytecodeCounts;
+    for (StackTrace& stackTrace : m_stackTraces) {
+        if (!stackTrace.frames.size())
+            continue;
+
+        StackFrame& frame = stackTrace.frames.first();
+        String bytecodeIndex;
+        String codeBlockHash;
+        if (frame.hasBytecodeIndex())
+            bytecodeIndex = String::number(frame.bytecodeIndex);
+        else
+            bytecodeIndex = "<nil>";
+
+        if (frame.hasCodeBlockHash()) {
+            StringPrintStream stream;
+            frame.codeBlockHash.dump(stream);
+            codeBlockHash = stream.toString();
+        } else
+            codeBlockHash = "<nil>";
+
+        String frameDescription = makeString(frame.displayName(m_vm), "#", codeBlockHash, ":", JITCode::typeName(frame.jitType), ":", bytecodeIndex);
+        bytecodeCounts.add(frameDescription, 0).iterator->value++;
+    }
+
+    auto takeMax = [&] () -> std::pair<String, size_t> {
+        String maxFrameDescription;
+        size_t maxFrameCount = 0;
+        for (auto entry : bytecodeCounts) {
+            if (entry.value > maxFrameCount) {
+                maxFrameCount = entry.value;
+                maxFrameDescription = entry.key;
+            }
+        }
+        if (!maxFrameDescription.isEmpty())
+            bytecodeCounts.remove(maxFrameDescription);
+        return std::make_pair(maxFrameDescription, maxFrameCount);
+    };
+
+    out.print("\n\nSampling rate: ", m_timingInterval.count(), " microseconds\n");
+    out.print("Hottest bytecodes as <numSamples   'functionName#hash:JITType:bytecodeIndex'>\n");
+    for (size_t i = 0; i < 80; i++) {
+        auto pair = takeMax();
+        if (pair.first.isEmpty())
+            break;
+        out.printf("%6zu ", pair.second);
+        out.print("   '", pair.first, "'\n");
+    }
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, SamplingProfiler::FrameType frameType)
+{
+    switch (frameType) {
+    case SamplingProfiler::FrameType::Executable:
+        out.print("Executable");
+        break;
+    case SamplingProfiler::FrameType::Host:
+        out.print("Host");
+        break;
+    case SamplingProfiler::FrameType::Unknown:
+        out.print("Unknown");
+        break;
+    }
+}
+
+} // namespace WTF
+
+#endif // ENABLE(SAMPLING_PROFILER)
diff --git a/runtime/SamplingProfiler.h b/runtime/SamplingProfiler.h
new file mode 100644
index 0000000..c92de6f
--- /dev/null
+++ b/runtime/SamplingProfiler.h
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(SAMPLING_PROFILER)
+
+#include "CallFrame.h"
+#include "CodeBlockHash.h"
+#include "JITCode.h"
+#include "MachineStackMarker.h"
+#include <wtf/HashSet.h>
+#include <wtf/Lock.h>
+#include <wtf/Stopwatch.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class VM;
+class ExecutableBase;
+
+class SamplingProfiler : public ThreadSafeRefCounted<SamplingProfiler> {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+
+    struct UnprocessedStackFrame {
+        UnprocessedStackFrame(CodeBlock* codeBlock, EncodedJSValue callee, CallSiteIndex callSiteIndex)
+            : unverifiedCallee(callee)
+            , verifiedCodeBlock(codeBlock)
+            , callSiteIndex(callSiteIndex)
+        { }
+        UnprocessedStackFrame()
+        {
+            unverifiedCallee = JSValue::encode(JSValue());
+            verifiedCodeBlock = nullptr;
+        }
+
+        EncodedJSValue unverifiedCallee;
+        CodeBlock* verifiedCodeBlock;
+        CallSiteIndex callSiteIndex;
+    };
+
+    enum class FrameType { 
+        Executable,
+        Host,
+        Unknown 
+    };
+
+    struct StackFrame {
+        StackFrame(ExecutableBase* executable)
+            : frameType(FrameType::Executable)
+            , executable(executable)
+        { }
+
+        StackFrame()
+        { }
+
+        FrameType frameType { FrameType::Unknown };
+        ExecutableBase* executable { nullptr };
+        JSObject* callee { nullptr };
+        // These attempt to be expression-level line and column number.
+        unsigned lineNumber { std::numeric_limits<unsigned>::max() };
+        unsigned columnNumber { std::numeric_limits<unsigned>::max() };
+        unsigned bytecodeIndex { std::numeric_limits<unsigned>::max() };
+        CodeBlockHash codeBlockHash;
+        JITCode::JITType jitType { JITCode::None };
+
+        bool hasExpressionInfo() const
+        {
+            return lineNumber != std::numeric_limits<unsigned>::max()
+                && columnNumber != std::numeric_limits<unsigned>::max();
+        }
+
+        bool hasBytecodeIndex() const
+        {
+            return bytecodeIndex != std::numeric_limits<unsigned>::max();
+        }
+
+        bool hasCodeBlockHash() const
+        {
+            return codeBlockHash.isSet();
+        }
+
+        // These are function-level data.
+        String nameFromCallee(VM&);
+        String displayName(VM&);
+        String displayNameForJSONTests(VM&); // Used for JSC stress tests because they want the "(anonymous function)" string for anonymous functions and they want "(eval)" for eval'd code.
+        int functionStartLine();
+        unsigned functionStartColumn();
+        intptr_t sourceID();
+        String url();
+    };
+
+    struct UnprocessedStackTrace {
+        double timestamp;
+        void* topPC;
+        bool topFrameIsLLInt;
+        void* llintPC;
+        Vector<UnprocessedStackFrame> frames;
+    };
+
+    struct StackTrace {
+        double timestamp;
+        Vector<StackFrame> frames;
+        StackTrace()
+        { }
+        StackTrace(StackTrace&& other)
+            : timestamp(other.timestamp)
+            , frames(WTFMove(other.frames))
+        { }
+    };
+
+    SamplingProfiler(VM&, RefPtr<Stopwatch>&&);
+    ~SamplingProfiler();
+    void noticeJSLockAcquisition();
+    void noticeVMEntry();
+    void shutdown();
+    void visit(SlotVisitor&);
+    Lock& getLock() { return m_lock; }
+    void setTimingInterval(std::chrono::microseconds interval) { m_timingInterval = interval; }
+    JS_EXPORT_PRIVATE void start();
+    void start(const LockHolder&);
+    Vector<StackTrace> releaseStackTraces(const LockHolder&);
+    JS_EXPORT_PRIVATE String stackTracesAsJSON();
+    JS_EXPORT_PRIVATE void noticeCurrentThreadAsJSCExecutionThread();
+    void noticeCurrentThreadAsJSCExecutionThread(const LockHolder&);
+    void processUnverifiedStackTraces(); // You should call this only after acquiring the lock.
+    void setStopWatch(const LockHolder&, Ref<Stopwatch>&& stopwatch) { m_stopwatch = WTFMove(stopwatch); }
+    void pause(const LockHolder&);
+    void clearData(const LockHolder&);
+
+    // Used for debugging in the JSC shell/DRT.
+    void registerForReportAtExit();
+    void reportDataToOptionFile();
+    JS_EXPORT_PRIVATE void reportTopFunctions();
+    JS_EXPORT_PRIVATE void reportTopFunctions(PrintStream&);
+    JS_EXPORT_PRIVATE void reportTopBytecodes();
+    JS_EXPORT_PRIVATE void reportTopBytecodes(PrintStream&);
+
+private:
+    void createThreadIfNecessary(const LockHolder&);
+    void timerLoop();
+    void takeSample(const LockHolder&, std::chrono::microseconds& stackTraceProcessingTime);
+
+    VM& m_vm;
+    RefPtr<Stopwatch> m_stopwatch;
+    Vector<StackTrace> m_stackTraces;
+    Vector<UnprocessedStackTrace> m_unprocessedStackTraces;
+    std::chrono::microseconds m_timingInterval;
+    double m_lastTime;
+    Lock m_lock;
+    ThreadIdentifier m_threadIdentifier;
+    MachineThreads::Thread* m_jscExecutionThread;
+    bool m_isPaused;
+    bool m_isShutDown;
+    bool m_needsReportAtExit { false };
+    HashSet<JSCell*> m_liveCellPointers;
+    Vector<UnprocessedStackFrame> m_currentFrames;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::SamplingProfiler::FrameType);
+
+} // namespace WTF
+
+#endif // ENABLE(SAMPLING_PROFILER)
diff --git a/runtime/ScopeOffset.cpp b/runtime/ScopeOffset.cpp
new file mode 100644
index 0000000..1753165
--- /dev/null
+++ b/runtime/ScopeOffset.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScopeOffset.h"
+
+namespace JSC {
+
+void ScopeOffset::dump(PrintStream& out) const
+{
+    if (!*this) {
+        out.print("scopeInvalid");
+        return;
+    }
+    
+    out.print("scope", offset());
+}
+
+} // namespace JSC
+
diff --git a/runtime/ScopeOffset.h b/runtime/ScopeOffset.h
new file mode 100644
index 0000000..3f44173
--- /dev/null
+++ b/runtime/ScopeOffset.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GenericOffset.h"
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+// This is an offset into a scope of some kind. It could be an activation scope or it could be a
+// global object.
+class ScopeOffset : public GenericOffset<ScopeOffset> {
+public:
+    ScopeOffset() { }
+    
+    explicit ScopeOffset(unsigned offset)
+        : GenericOffset(offset)
+    {
+    }
+    
+    void dump(PrintStream&) const;
+};
+
+} // namespace JSC
diff --git a/runtime/ScopedArguments.cpp b/runtime/ScopedArguments.cpp
new file mode 100644
index 0000000..f8eb6ec
--- /dev/null
+++ b/runtime/ScopedArguments.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScopedArguments.h"
+
+#include "GenericArgumentsInlines.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(ScopedArguments);
+
+const ClassInfo ScopedArguments::s_info = { "Arguments", &Base::s_info, 0, CREATE_METHOD_TABLE(ScopedArguments) };
+
+ScopedArguments::ScopedArguments(VM& vm, Structure* structure, unsigned totalLength)
+    : GenericArguments(vm, structure)
+    , m_overrodeThings(false)
+    , m_totalLength(totalLength)
+{
+}
+
+void ScopedArguments::finishCreation(VM& vm, JSFunction* callee, ScopedArgumentsTable* table, JSLexicalEnvironment* scope)
+{
+    Base::finishCreation(vm);
+    m_callee.set(vm, this, callee);
+    m_table.set(vm, this, table);
+    m_scope.set(vm, this, scope);
+}
+
+ScopedArguments* ScopedArguments::createUninitialized(VM& vm, Structure* structure, JSFunction* callee, ScopedArgumentsTable* table, JSLexicalEnvironment* scope, unsigned totalLength)
+{
+    unsigned overflowLength;
+    if (totalLength > table->length())
+        overflowLength = totalLength - table->length();
+    else
+        overflowLength = 0;
+    ScopedArguments* result = new (
+        NotNull,
+        allocateCell<ScopedArguments>(vm.heap, allocationSize(overflowLength)))
+        ScopedArguments(vm, structure, totalLength);
+    result->finishCreation(vm, callee, table, scope);
+    return result;
+}
+
+ScopedArguments* ScopedArguments::create(VM& vm, Structure* structure, JSFunction* callee, ScopedArgumentsTable* table, JSLexicalEnvironment* scope, unsigned totalLength)
+{
+    ScopedArguments* result =
+        createUninitialized(vm, structure, callee, table, scope, totalLength);
+
+    unsigned namedLength = table->length();
+    for (unsigned i = namedLength; i < totalLength; ++i)
+        result->overflowStorage()[i - namedLength].clear();
+    
+    return result;
+}
+
+ScopedArguments* ScopedArguments::createByCopying(ExecState* exec, ScopedArgumentsTable* table, JSLexicalEnvironment* scope)
+{
+    return createByCopyingFrom(
+        exec->vm(), exec->lexicalGlobalObject()->scopedArgumentsStructure(),
+        exec->registers() + CallFrame::argumentOffset(0), exec->argumentCount(),
+        jsCast<JSFunction*>(exec->jsCallee()), table, scope);
+}
+
+ScopedArguments* ScopedArguments::createByCopyingFrom(VM& vm, Structure* structure, Register* argumentsStart, unsigned totalLength, JSFunction* callee, ScopedArgumentsTable* table, JSLexicalEnvironment* scope)
+{
+    ScopedArguments* result =
+        createUninitialized(vm, structure, callee, table, scope, totalLength);
+    
+    unsigned namedLength = table->length();
+    for (unsigned i = namedLength; i < totalLength; ++i)
+        result->overflowStorage()[i - namedLength].set(vm, result, argumentsStart[i].jsValue());
+    
+    return result;
+}
+
+void ScopedArguments::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    ScopedArguments* thisObject = static_cast<ScopedArguments*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(thisObject->m_callee);
+    visitor.append(thisObject->m_table);
+    visitor.append(thisObject->m_scope);
+    
+    if (thisObject->m_totalLength > thisObject->m_table->length()) {
+        visitor.appendValues(
+            thisObject->overflowStorage(), thisObject->m_totalLength - thisObject->m_table->length());
+    }
+}
+
+Structure* ScopedArguments::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ScopedArgumentsType, StructureFlags), info());
+}
+
+void ScopedArguments::overrideThings(VM& vm)
+{
+    RELEASE_ASSERT(!m_overrodeThings);
+    
+    putDirect(vm, vm.propertyNames->length, jsNumber(m_table->length()), DontEnum);
+    putDirect(vm, vm.propertyNames->callee, m_callee.get(), DontEnum);
+    putDirect(vm, vm.propertyNames->iteratorSymbol, globalObject()->arrayProtoValuesFunction(), DontEnum);
+    
+    m_overrodeThings = true;
+}
+
+void ScopedArguments::overrideThingsIfNecessary(VM& vm)
+{
+    if (!m_overrodeThings)
+        overrideThings(vm);
+}
+
+void ScopedArguments::overrideArgument(VM& vm, uint32_t i)
+{
+    ASSERT_WITH_SECURITY_IMPLICATION(i < m_totalLength);
+    unsigned namedLength = m_table->length();
+    if (i < namedLength)
+        m_table.set(vm, this, m_table->set(vm, i, ScopeOffset()));
+    else
+        overflowStorage()[i - namedLength].clear();
+}
+
+void ScopedArguments::copyToArguments(ExecState* exec, VirtualRegister firstElementDest, unsigned offset, unsigned length)
+{
+    GenericArguments::copyToArguments(exec, firstElementDest, offset, length);
+}
+
+} // namespace JSC
+
diff --git a/runtime/ScopedArguments.h b/runtime/ScopedArguments.h
new file mode 100644
index 0000000..8f04624
--- /dev/null
+++ b/runtime/ScopedArguments.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GenericArguments.h"
+#include "JSLexicalEnvironment.h"
+
+namespace JSC {
+
+// This is an Arguments-class object that we create when you say "arguments" inside a function,
+// and one or more of the arguments may be captured in the function's activation. The function
+// will copy its formally declared arguments into the activation and then create this object. This
+// object will store the overflow arguments, if there are any. This object will use the symbol
+// table's ScopedArgumentsTable and the activation, or its overflow storage, to handle all indexed
+// lookups.
+class ScopedArguments : public GenericArguments<ScopedArguments> {
+private:
+    ScopedArguments(VM&, Structure*, unsigned totalLength);
+    void finishCreation(VM&, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*);
+
+public:
+    // Creates an arguments object but leaves it uninitialized. This is dangerous if we GC right
+    // after allocation.
+    static ScopedArguments* createUninitialized(VM&, Structure*, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*, unsigned totalLength);
+    
+    // Creates an arguments object and initializes everything to the empty value. Use this if you
+    // cannot guarantee that you'll immediately initialize all of the elements.
+    static ScopedArguments* create(VM&, Structure*, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*, unsigned totalLength);
+    
+    // Creates an arguments object by copying the arguments from the stack.
+    static ScopedArguments* createByCopying(ExecState*, ScopedArgumentsTable*, JSLexicalEnvironment*);
+    
+    // Creates an arguments object by copying the arguments from a well-defined stack location.
+    static ScopedArguments* createByCopyingFrom(VM&, Structure*, Register* argumentsStart, unsigned totalLength, JSFunction* callee, ScopedArgumentsTable*, JSLexicalEnvironment*);
+    
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+    uint32_t internalLength() const
+    {
+        return m_totalLength;
+    }
+    
+    uint32_t length(ExecState* exec) const
+    {
+        if (UNLIKELY(m_overrodeThings))
+            return get(exec, exec->propertyNames().length).toUInt32(exec);
+        return internalLength();
+    }
+    
+    bool canAccessIndexQuickly(uint32_t i) const
+    {
+        if (i >= m_totalLength)
+            return false;
+        unsigned namedLength = m_table->length();
+        if (i < namedLength)
+            return !!m_table->get(i);
+        return !!overflowStorage()[i - namedLength].get();
+    }
+
+    bool canAccessArgumentIndexQuicklyInDFG(uint32_t i) const
+    {
+        return canAccessIndexQuickly(i);
+    }
+    
+    JSValue getIndexQuickly(uint32_t i) const
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(canAccessIndexQuickly(i));
+        unsigned namedLength = m_table->length();
+        if (i < namedLength)
+            return m_scope->variableAt(m_table->get(i)).get();
+        return overflowStorage()[i - namedLength].get();
+    }
+
+    void setIndexQuickly(VM& vm, uint32_t i, JSValue value)
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(canAccessIndexQuickly(i));
+        unsigned namedLength = m_table->length();
+        if (i < namedLength)
+            m_scope->variableAt(m_table->get(i)).set(vm, m_scope.get(), value);
+        else
+            overflowStorage()[i - namedLength].set(vm, this, value);
+    }
+
+    WriteBarrier<JSFunction>& callee()
+    {
+        return m_callee;
+    }
+    
+    bool overrodeThings() const { return m_overrodeThings; }
+    void overrideThings(VM&);
+    void overrideThingsIfNecessary(VM&);
+    void overrideArgument(VM&, uint32_t index);
+    
+    void copyToArguments(ExecState*, VirtualRegister firstElementDest, unsigned offset, unsigned length);
+
+    DECLARE_INFO;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+    
+    static ptrdiff_t offsetOfOverrodeThings() { return OBJECT_OFFSETOF(ScopedArguments, m_overrodeThings); }
+    static ptrdiff_t offsetOfTotalLength() { return OBJECT_OFFSETOF(ScopedArguments, m_totalLength); }
+    static ptrdiff_t offsetOfTable() { return OBJECT_OFFSETOF(ScopedArguments, m_table); }
+    static ptrdiff_t offsetOfScope() { return OBJECT_OFFSETOF(ScopedArguments, m_scope); }
+    
+    static size_t overflowStorageOffset()
+    {
+        return WTF::roundUpToMultipleOf<sizeof(WriteBarrier<Unknown>)>(sizeof(ScopedArguments));
+    }
+    
+    static size_t allocationSize(unsigned overflowArgumentsLength)
+    {
+        return overflowStorageOffset() + sizeof(WriteBarrier<Unknown>) * overflowArgumentsLength;
+    }
+
+private:
+    WriteBarrier<Unknown>* overflowStorage() const
+    {
+        return bitwise_cast<WriteBarrier<Unknown>*>(
+            bitwise_cast<char*>(this) + overflowStorageOffset());
+    }
+    
+    
+    bool m_overrodeThings; // True if length, callee, and caller are fully materialized in the object.
+    unsigned m_totalLength; // The length of declared plus overflow arguments.
+    WriteBarrier<JSFunction> m_callee;
+    WriteBarrier<ScopedArgumentsTable> m_table;
+    WriteBarrier<JSLexicalEnvironment> m_scope;
+};
+
+} // namespace JSC
diff --git a/runtime/ScopedArgumentsTable.cpp b/runtime/ScopedArgumentsTable.cpp
new file mode 100644
index 0000000..23f536d
--- /dev/null
+++ b/runtime/ScopedArgumentsTable.cpp
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScopedArgumentsTable.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo ScopedArgumentsTable::s_info = { "ScopedArgumentsTable", 0, 0, CREATE_METHOD_TABLE(ScopedArgumentsTable) };
+
+ScopedArgumentsTable::ScopedArgumentsTable(VM& vm)
+    : Base(vm, vm.scopedArgumentsTableStructure.get())
+    , m_length(0)
+    , m_locked(false)
+{
+}
+
+ScopedArgumentsTable::~ScopedArgumentsTable()
+{
+}
+
+void ScopedArgumentsTable::destroy(JSCell* cell)
+{
+    static_cast<ScopedArgumentsTable*>(cell)->ScopedArgumentsTable::~ScopedArgumentsTable();
+}
+
+ScopedArgumentsTable* ScopedArgumentsTable::create(VM& vm)
+{
+    ScopedArgumentsTable* result =
+        new (NotNull, allocateCell<ScopedArgumentsTable>(vm.heap)) ScopedArgumentsTable(vm);
+    result->finishCreation(vm);
+    return result;
+}
+
+ScopedArgumentsTable* ScopedArgumentsTable::create(VM& vm, uint32_t length)
+{
+    ScopedArgumentsTable* result = create(vm);
+    result->m_length = length;
+    result->m_arguments = std::make_unique<ScopeOffset[]>(length);
+    return result;
+}
+
+ScopedArgumentsTable* ScopedArgumentsTable::clone(VM& vm)
+{
+    ScopedArgumentsTable* result = create(vm, m_length);
+    for (unsigned i = m_length; i--;)
+        result->m_arguments[i] = m_arguments[i];
+    return result;
+}
+
+ScopedArgumentsTable* ScopedArgumentsTable::setLength(VM& vm, uint32_t newLength)
+{
+    if (LIKELY(!m_locked)) {
+        std::unique_ptr<ScopeOffset[]> newArguments = std::make_unique<ScopeOffset[]>(newLength);
+        for (unsigned i = std::min(m_length, newLength); i--;)
+            newArguments[i] = m_arguments[i];
+        m_length = newLength;
+        m_arguments = WTFMove(newArguments);
+        return this;
+    }
+    
+    ScopedArgumentsTable* result = create(vm, newLength);
+    for (unsigned i = std::min(m_length, newLength); i--;)
+        result->m_arguments[i] = m_arguments[i];
+    return result;
+}
+
+ScopedArgumentsTable* ScopedArgumentsTable::set(VM& vm, uint32_t i, ScopeOffset value)
+{
+    ScopedArgumentsTable* result;
+    if (UNLIKELY(m_locked))
+        result = clone(vm);
+    else
+        result = this;
+    result->at(i) = value;
+    return result;
+}
+
+Structure* ScopedArgumentsTable::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+} // namespace JSC
+
diff --git a/runtime/ScopedArgumentsTable.h b/runtime/ScopedArgumentsTable.h
new file mode 100644
index 0000000..f1df980
--- /dev/null
+++ b/runtime/ScopedArgumentsTable.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "ScopeOffset.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+// This class's only job is to hold onto the list of ScopeOffsets for each argument that a
+// function has. Most of the time, the BytecodeGenerator will create one of these and it will
+// never be modified subsequently. There is a rare case where a ScopedArguments object is created
+// and aliases one of these and then decides to modify it; in that case we do copy-on-write. This
+// makes sense because such modifications are so uncommon. You'd have to do something crazy like
+// "delete arguments[i]" or some variant of defineOwnProperty.
+class ScopedArgumentsTable final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+    
+private:
+    ScopedArgumentsTable(VM&);
+    ~ScopedArgumentsTable();
+
+public:
+    static ScopedArgumentsTable* create(VM&);
+    static ScopedArgumentsTable* create(VM&, uint32_t length);
+    
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    ScopedArgumentsTable* clone(VM&);
+    
+    uint32_t length() const { return m_length; }
+    ScopedArgumentsTable* setLength(VM&, uint32_t newLength);
+    
+    ScopeOffset get(uint32_t i) const
+    {
+        return const_cast<ScopedArgumentsTable*>(this)->at(i);
+    }
+    
+    void lock()
+    {
+        m_locked = true;
+    }
+    
+    ScopedArgumentsTable* set(VM&, uint32_t index, ScopeOffset);
+    
+    DECLARE_INFO;
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    static ptrdiff_t offsetOfLength() { return OBJECT_OFFSETOF(ScopedArgumentsTable, m_length); }
+    static ptrdiff_t offsetOfArguments() { return OBJECT_OFFSETOF(ScopedArgumentsTable, m_arguments); }
+
+private:
+    ScopeOffset& at(uint32_t i)
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(i < m_length);
+        return m_arguments[i];
+    }
+    
+    uint32_t m_length;
+    bool m_locked; // Being locked means that there are multiple references to this object and none of them expect to see the others' modifications. This means that modifications need to make a copy first.
+    std::unique_ptr<ScopeOffset[]> m_arguments;
+};
+
+} // namespace JSC
diff --git a/runtime/ScriptExecutable.cpp b/runtime/ScriptExecutable.cpp
new file mode 100644
index 0000000..4c701ca
--- /dev/null
+++ b/runtime/ScriptExecutable.cpp
@@ -0,0 +1,333 @@
+/*
+ * Copyright (C) 2009, 2010, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "BatchedTransitionOptimizer.h"
+#include "CodeBlock.h"
+#include "Debugger.h"
+#include "EvalCodeBlock.h"
+#include "FunctionCodeBlock.h"
+#include "JIT.h"
+#include "JSCInlines.h"
+#include "LLIntEntrypoint.h"
+#include "ModuleProgramCodeBlock.h"
+#include "Parser.h"
+#include "ProgramCodeBlock.h"
+#include "TypeProfiler.h"
+#include "VMInlines.h"
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+const ClassInfo ScriptExecutable::s_info = { "ScriptExecutable", &ExecutableBase::s_info, 0, CREATE_METHOD_TABLE(ScriptExecutable) };
+
+ScriptExecutable::ScriptExecutable(Structure* structure, VM& vm, const SourceCode& source, bool isInStrictContext, DerivedContextType derivedContextType, bool isInArrowFunctionContext, EvalContextType evalContextType, Intrinsic intrinsic)
+    : ExecutableBase(vm, structure, NUM_PARAMETERS_NOT_COMPILED, intrinsic)
+    , m_features(isInStrictContext ? StrictModeFeature : 0)
+    , m_didTryToEnterInLoop(false)
+    , m_hasCapturedVariables(false)
+    , m_neverInline(false)
+    , m_neverOptimize(false)
+    , m_neverFTLOptimize(false)
+    , m_isArrowFunctionContext(isInArrowFunctionContext)
+    , m_canUseOSRExitFuzzing(true)
+    , m_derivedContextType(static_cast<unsigned>(derivedContextType))
+    , m_evalContextType(static_cast<unsigned>(evalContextType))
+    , m_overrideLineNumber(-1)
+    , m_lastLine(-1)
+    , m_endColumn(UINT_MAX)
+    , m_typeProfilingStartOffset(UINT_MAX)
+    , m_typeProfilingEndOffset(UINT_MAX)
+    , m_source(source)
+{
+}
+
+void ScriptExecutable::destroy(JSCell* cell)
+{
+    static_cast<ScriptExecutable*>(cell)->ScriptExecutable::~ScriptExecutable();
+}
+
+void ScriptExecutable::installCode(CodeBlock* codeBlock)
+{
+    installCode(*codeBlock->vm(), codeBlock, codeBlock->codeType(), codeBlock->specializationKind());
+}
+
+void ScriptExecutable::installCode(VM& vm, CodeBlock* genericCodeBlock, CodeType codeType, CodeSpecializationKind kind)
+{
+    if (genericCodeBlock)
+        CODEBLOCK_LOG_EVENT(genericCodeBlock, "installCode", ());
+    
+    CodeBlock* oldCodeBlock = nullptr;
+    
+    switch (codeType) {
+    case GlobalCode: {
+        ProgramExecutable* executable = jsCast<ProgramExecutable*>(this);
+        ProgramCodeBlock* codeBlock = static_cast<ProgramCodeBlock*>(genericCodeBlock);
+        
+        ASSERT(kind == CodeForCall);
+        
+        oldCodeBlock = executable->m_programCodeBlock.get();
+        executable->m_programCodeBlock.setMayBeNull(vm, this, codeBlock);
+        break;
+    }
+
+    case ModuleCode: {
+        ModuleProgramExecutable* executable = jsCast<ModuleProgramExecutable*>(this);
+        ModuleProgramCodeBlock* codeBlock = static_cast<ModuleProgramCodeBlock*>(genericCodeBlock);
+
+        ASSERT(kind == CodeForCall);
+
+        oldCodeBlock = executable->m_moduleProgramCodeBlock.get();
+        executable->m_moduleProgramCodeBlock.setMayBeNull(vm, this, codeBlock);
+        break;
+    }
+
+    case EvalCode: {
+        EvalExecutable* executable = jsCast<EvalExecutable*>(this);
+        EvalCodeBlock* codeBlock = static_cast<EvalCodeBlock*>(genericCodeBlock);
+        
+        ASSERT(kind == CodeForCall);
+        
+        oldCodeBlock = executable->m_evalCodeBlock.get();
+        executable->m_evalCodeBlock.setMayBeNull(vm, this, codeBlock);
+        break;
+    }
+        
+    case FunctionCode: {
+        FunctionExecutable* executable = jsCast<FunctionExecutable*>(this);
+        FunctionCodeBlock* codeBlock = static_cast<FunctionCodeBlock*>(genericCodeBlock);
+        
+        switch (kind) {
+        case CodeForCall:
+            oldCodeBlock = executable->m_codeBlockForCall.get();
+            executable->m_codeBlockForCall.setMayBeNull(vm, this, codeBlock);
+            break;
+        case CodeForConstruct:
+            oldCodeBlock = executable->m_codeBlockForConstruct.get();
+            executable->m_codeBlockForConstruct.setMayBeNull(vm, this, codeBlock);
+            break;
+        }
+        break;
+    }
+    }
+
+    switch (kind) {
+    case CodeForCall:
+        m_jitCodeForCall = genericCodeBlock ? genericCodeBlock->jitCode() : nullptr;
+        m_jitCodeForCallWithArityCheck = MacroAssemblerCodePtr();
+        m_numParametersForCall = genericCodeBlock ? genericCodeBlock->numParameters() : NUM_PARAMETERS_NOT_COMPILED;
+        break;
+    case CodeForConstruct:
+        m_jitCodeForConstruct = genericCodeBlock ? genericCodeBlock->jitCode() : nullptr;
+        m_jitCodeForConstructWithArityCheck = MacroAssemblerCodePtr();
+        m_numParametersForConstruct = genericCodeBlock ? genericCodeBlock->numParameters() : NUM_PARAMETERS_NOT_COMPILED;
+        break;
+    }
+
+    if (genericCodeBlock) {
+        RELEASE_ASSERT(genericCodeBlock->ownerExecutable() == this);
+        RELEASE_ASSERT(JITCode::isExecutableScript(genericCodeBlock->jitType()));
+        
+        if (Options::verboseOSR())
+            dataLog("Installing ", *genericCodeBlock, "\n");
+        
+        if (vm.m_perBytecodeProfiler)
+            vm.m_perBytecodeProfiler->ensureBytecodesFor(genericCodeBlock);
+        
+        if (Debugger* debugger = genericCodeBlock->globalObject()->debugger())
+            debugger->registerCodeBlock(genericCodeBlock);
+    }
+
+    if (oldCodeBlock)
+        oldCodeBlock->unlinkIncomingCalls();
+
+    vm.heap.writeBarrier(this);
+}
+
+CodeBlock* ScriptExecutable::newCodeBlockFor(
+    CodeSpecializationKind kind, JSFunction* function, JSScope* scope, JSObject*& exception)
+{
+    VM* vm = scope->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(*vm);
+
+    ASSERT(vm->heap.isDeferred());
+    ASSERT(endColumn() != UINT_MAX);
+
+    if (classInfo() == EvalExecutable::info()) {
+        EvalExecutable* executable = jsCast<EvalExecutable*>(this);
+        RELEASE_ASSERT(kind == CodeForCall);
+        RELEASE_ASSERT(!executable->m_evalCodeBlock);
+        RELEASE_ASSERT(!function);
+        return EvalCodeBlock::create(vm,
+            executable, executable->m_unlinkedEvalCodeBlock.get(), scope,
+            executable->source().provider());
+    }
+    
+    if (classInfo() == ProgramExecutable::info()) {
+        ProgramExecutable* executable = jsCast<ProgramExecutable*>(this);
+        RELEASE_ASSERT(kind == CodeForCall);
+        RELEASE_ASSERT(!executable->m_programCodeBlock);
+        RELEASE_ASSERT(!function);
+        return ProgramCodeBlock::create(vm,
+            executable, executable->m_unlinkedProgramCodeBlock.get(), scope,
+            executable->source().provider(), startColumn());
+    }
+
+    if (classInfo() == ModuleProgramExecutable::info()) {
+        ModuleProgramExecutable* executable = jsCast<ModuleProgramExecutable*>(this);
+        RELEASE_ASSERT(kind == CodeForCall);
+        RELEASE_ASSERT(!executable->m_moduleProgramCodeBlock);
+        RELEASE_ASSERT(!function);
+        return ModuleProgramCodeBlock::create(vm,
+            executable, executable->m_unlinkedModuleProgramCodeBlock.get(), scope,
+            executable->source().provider(), startColumn());
+    }
+
+    RELEASE_ASSERT(classInfo() == FunctionExecutable::info());
+    RELEASE_ASSERT(function);
+    FunctionExecutable* executable = jsCast<FunctionExecutable*>(this);
+    RELEASE_ASSERT(!executable->codeBlockFor(kind));
+    JSGlobalObject* globalObject = scope->globalObject();
+    ParserError error;
+    DebuggerMode debuggerMode = globalObject->hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
+    UnlinkedFunctionCodeBlock* unlinkedCodeBlock = 
+        executable->m_unlinkedExecutable->unlinkedCodeBlockFor(
+            *vm, executable->m_source, kind, debuggerMode, error, 
+            executable->parseMode());
+    recordParse(
+        executable->m_unlinkedExecutable->features(), 
+        executable->m_unlinkedExecutable->hasCapturedVariables(),
+        lastLine(), endColumn()); 
+    if (!unlinkedCodeBlock) {
+        exception = throwException(
+            globalObject->globalExec(), throwScope,
+            error.toErrorObject(globalObject, executable->m_source));
+        return nullptr;
+    }
+
+    return FunctionCodeBlock::create(vm, executable, unlinkedCodeBlock, scope, 
+        source().provider(), source().startOffset(), startColumn());
+}
+
+CodeBlock* ScriptExecutable::newReplacementCodeBlockFor(
+    CodeSpecializationKind kind)
+{
+    if (classInfo() == EvalExecutable::info()) {
+        RELEASE_ASSERT(kind == CodeForCall);
+        EvalExecutable* executable = jsCast<EvalExecutable*>(this);
+        EvalCodeBlock* baseline = static_cast<EvalCodeBlock*>(
+            executable->m_evalCodeBlock->baselineVersion());
+        EvalCodeBlock* result = EvalCodeBlock::create(vm(),
+            CodeBlock::CopyParsedBlock, *baseline);
+        result->setAlternative(*vm(), baseline);
+        return result;
+    }
+    
+    if (classInfo() == ProgramExecutable::info()) {
+        RELEASE_ASSERT(kind == CodeForCall);
+        ProgramExecutable* executable = jsCast<ProgramExecutable*>(this);
+        ProgramCodeBlock* baseline = static_cast<ProgramCodeBlock*>(
+            executable->m_programCodeBlock->baselineVersion());
+        ProgramCodeBlock* result = ProgramCodeBlock::create(vm(),
+            CodeBlock::CopyParsedBlock, *baseline);
+        result->setAlternative(*vm(), baseline);
+        return result;
+    }
+
+    if (classInfo() == ModuleProgramExecutable::info()) {
+        RELEASE_ASSERT(kind == CodeForCall);
+        ModuleProgramExecutable* executable = jsCast<ModuleProgramExecutable*>(this);
+        ModuleProgramCodeBlock* baseline = static_cast<ModuleProgramCodeBlock*>(
+            executable->m_moduleProgramCodeBlock->baselineVersion());
+        ModuleProgramCodeBlock* result = ModuleProgramCodeBlock::create(vm(),
+            CodeBlock::CopyParsedBlock, *baseline);
+        result->setAlternative(*vm(), baseline);
+        return result;
+    }
+
+    RELEASE_ASSERT(classInfo() == FunctionExecutable::info());
+    FunctionExecutable* executable = jsCast<FunctionExecutable*>(this);
+    FunctionCodeBlock* baseline = static_cast<FunctionCodeBlock*>(
+        executable->codeBlockFor(kind)->baselineVersion());
+    FunctionCodeBlock* result = FunctionCodeBlock::create(vm(),
+        CodeBlock::CopyParsedBlock, *baseline);
+    result->setAlternative(*vm(), baseline);
+    return result;
+}
+
+static void setupLLInt(VM& vm, CodeBlock* codeBlock)
+{
+    LLInt::setEntrypoint(vm, codeBlock);
+}
+
+static void setupJIT(VM& vm, CodeBlock* codeBlock)
+{
+#if ENABLE(JIT)
+    CompilationResult result = JIT::compile(&vm, codeBlock, JITCompilationMustSucceed);
+    RELEASE_ASSERT(result == CompilationSuccessful);
+#else
+    UNUSED_PARAM(vm);
+    UNUSED_PARAM(codeBlock);
+    UNREACHABLE_FOR_PLATFORM();
+#endif
+}
+
+JSObject* ScriptExecutable::prepareForExecutionImpl(
+    VM& vm, JSFunction* function, JSScope* scope, CodeSpecializationKind kind, CodeBlock*& resultCodeBlock)
+{
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    DeferGCForAWhile deferGC(vm.heap);
+
+    if (vm.getAndClearFailNextNewCodeBlock()) {
+        auto& state = *scope->globalObject()->globalExec();
+        return throwException(&state, throwScope, createError(&state, ASCIILiteral("Forced Failure")));
+    }
+
+    JSObject* exception = nullptr;
+    CodeBlock* codeBlock = newCodeBlockFor(kind, function, scope, exception);
+    resultCodeBlock = codeBlock;
+    ASSERT(!!throwScope.exception() == !codeBlock);
+    if (UNLIKELY(!codeBlock))
+        return exception;
+    
+    if (Options::validateBytecode())
+        codeBlock->validate();
+    
+    if (Options::useLLInt())
+        setupLLInt(vm, codeBlock);
+    else
+        setupJIT(vm, codeBlock);
+    
+    installCode(vm, codeBlock, codeBlock->codeType(), codeBlock->specializationKind());
+    return nullptr;
+}
+
+CodeBlockHash ScriptExecutable::hashFor(CodeSpecializationKind kind) const
+{
+    return CodeBlockHash(source(), kind);
+}
+
+} // namespace JSC
diff --git a/runtime/ScriptExecutable.h b/runtime/ScriptExecutable.h
new file mode 100644
index 0000000..0526190
--- /dev/null
+++ b/runtime/ScriptExecutable.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2009, 2010, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ExecutableBase.h"
+
+namespace JSC {
+
+class ScriptExecutable : public ExecutableBase {
+public:
+    typedef ExecutableBase Base;
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static void destroy(JSCell*);
+        
+    CodeBlockHash hashFor(CodeSpecializationKind) const;
+
+    const SourceCode& source() const { return m_source; }
+    intptr_t sourceID() const { return m_source.providerID(); }
+    const String& sourceURL() const { return m_source.provider()->url(); }
+    int firstLine() const { return m_source.firstLine().oneBasedInt(); }
+    void setOverrideLineNumber(int overrideLineNumber) { m_overrideLineNumber = overrideLineNumber; }
+    bool hasOverrideLineNumber() const { return m_overrideLineNumber != -1; }
+    int overrideLineNumber() const { return m_overrideLineNumber; }
+    int lastLine() const { return m_lastLine; }
+    unsigned startColumn() const { return m_source.startColumn().oneBasedInt(); }
+    unsigned endColumn() const { return m_endColumn; }
+    unsigned typeProfilingStartOffset() const { return m_typeProfilingStartOffset; }
+    unsigned typeProfilingEndOffset() const { return m_typeProfilingEndOffset; }
+
+    bool usesEval() const { return m_features & EvalFeature; }
+    bool usesArguments() const { return m_features & ArgumentsFeature; }
+    bool isArrowFunctionContext() const { return m_isArrowFunctionContext; }
+    bool isStrictMode() const { return m_features & StrictModeFeature; }
+    DerivedContextType derivedContextType() const { return static_cast<DerivedContextType>(m_derivedContextType); }
+    EvalContextType evalContextType() const { return static_cast<EvalContextType>(m_evalContextType); }
+
+    ECMAMode ecmaMode() const { return isStrictMode() ? StrictMode : NotStrictMode; }
+        
+    void setNeverInline(bool value) { m_neverInline = value; }
+    void setNeverOptimize(bool value) { m_neverOptimize = value; }
+    void setNeverFTLOptimize(bool value) { m_neverFTLOptimize = value; }
+    void setDidTryToEnterInLoop(bool value) { m_didTryToEnterInLoop = value; }
+    void setCanUseOSRExitFuzzing(bool value) { m_canUseOSRExitFuzzing = value; }
+    bool neverInline() const { return m_neverInline; }
+    bool neverOptimize() const { return m_neverOptimize; }
+    bool neverFTLOptimize() const { return m_neverFTLOptimize; }
+    bool didTryToEnterInLoop() const { return m_didTryToEnterInLoop; }
+    bool isInliningCandidate() const { return !neverInline(); }
+    bool isOkToOptimize() const { return !neverOptimize(); }
+    bool canUseOSRExitFuzzing() const { return m_canUseOSRExitFuzzing; }
+    
+    bool* addressOfDidTryToEnterInLoop() { return &m_didTryToEnterInLoop; }
+
+    CodeFeatures features() const { return m_features; }
+        
+    DECLARE_EXPORT_INFO;
+
+    void recordParse(CodeFeatures features, bool hasCapturedVariables, int lastLine, unsigned endColumn)
+    {
+        m_features = features;
+        m_hasCapturedVariables = hasCapturedVariables;
+        m_lastLine = lastLine;
+        ASSERT(endColumn != UINT_MAX);
+        m_endColumn = endColumn;
+    }
+
+    void installCode(CodeBlock*);
+    void installCode(VM&, CodeBlock*, CodeType, CodeSpecializationKind);
+    CodeBlock* newCodeBlockFor(CodeSpecializationKind, JSFunction*, JSScope*, JSObject*& exception);
+    CodeBlock* newReplacementCodeBlockFor(CodeSpecializationKind);
+
+    // This function has an interesting GC story. Callers of this function are asking us to create a CodeBlock
+    // that is not jettisoned before this function returns. Callers are essentially asking for a strong reference
+    // to the CodeBlock. Because the Executable may be allocating the CodeBlock, we require callers to pass in
+    // their CodeBlock*& reference because it's safe for CodeBlock to be jettisoned if Executable is the only thing
+    // to point to it. This forces callers to have a CodeBlock* in a register or on the stack that will be marked
+    // by conservative GC if a GC happens after we create the CodeBlock.
+    template <typename ExecutableType>
+    JSObject* prepareForExecution(VM&, JSFunction*, JSScope*, CodeSpecializationKind, CodeBlock*& resultCodeBlock);
+
+private:
+    friend class ExecutableBase;
+    JSObject* prepareForExecutionImpl(VM&, JSFunction*, JSScope*, CodeSpecializationKind, CodeBlock*&);
+
+protected:
+    ScriptExecutable(Structure*, VM&, const SourceCode&, bool isInStrictContext, DerivedContextType, bool isInArrowFunctionContext, EvalContextType, Intrinsic);
+
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        vm.heap.addExecutable(this); // Balanced by Heap::deleteUnmarkedCompiledCode().
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+        if (SamplingTool* sampler = vm.interpreter->sampler())
+            sampler->notifyOfScope(vm, this);
+#endif
+    }
+
+    CodeFeatures m_features;
+    bool m_didTryToEnterInLoop;
+    bool m_hasCapturedVariables : 1;
+    bool m_neverInline : 1;
+    bool m_neverOptimize : 1;
+    bool m_neverFTLOptimize : 1;
+    bool m_isArrowFunctionContext : 1;
+    bool m_canUseOSRExitFuzzing : 1;
+    unsigned m_derivedContextType : 2; // DerivedContextType
+    unsigned m_evalContextType : 2; // EvalContextType
+
+    int m_overrideLineNumber;
+    int m_lastLine;
+    unsigned m_endColumn;
+    unsigned m_typeProfilingStartOffset;
+    unsigned m_typeProfilingEndOffset;
+    SourceCode m_source;
+};
+
+} // namespace JSC
diff --git a/runtime/SetConstructor.cpp b/runtime/SetConstructor.cpp
new file mode 100644
index 0000000..f341ee5
--- /dev/null
+++ b/runtime/SetConstructor.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SetConstructor.h"
+
+#include "Error.h"
+#include "GetterSetter.h"
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSObjectInlines.h"
+#include "JSSet.h"
+#include "SetPrototype.h"
+
+namespace JSC {
+
+const ClassInfo SetConstructor::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(SetConstructor) };
+
+void SetConstructor::finishCreation(VM& vm, SetPrototype* setPrototype, GetterSetter* speciesSymbol)
+{
+    Base::finishCreation(vm, setPrototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, setPrototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontEnum | ReadOnly);
+    putDirectNonIndexAccessor(vm, vm.propertyNames->speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);
+}
+
+static EncodedJSValue JSC_HOST_CALL callSet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "Set"));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructSet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = asInternalFunction(exec->jsCallee())->globalObject();
+    Structure* setStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->setStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSSet* set = JSSet::create(exec, vm, setStructure);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSValue iterable = exec->argument(0);
+    if (iterable.isUndefinedOrNull())
+        return JSValue::encode(set);
+
+    JSValue adderFunction = set->get(exec, vm.propertyNames->add);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    CallData adderFunctionCallData;
+    CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
+    if (UNLIKELY(adderFunctionCallType == CallType::None))
+        return JSValue::encode(throwTypeError(exec, scope));
+
+    scope.release();
+    forEachInIterable(exec, iterable, [&](VM&, ExecState* exec, JSValue nextValue) {
+        MarkedArgumentBuffer arguments;
+        arguments.append(nextValue);
+        call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, set, arguments);
+    });
+
+    return JSValue::encode(set);
+}
+
+ConstructType SetConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructSet;
+    return ConstructType::Host;
+}
+
+CallType SetConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callSet;
+    return CallType::Host;
+}
+
+}
diff --git a/runtime/SetConstructor.h b/runtime/SetConstructor.h
new file mode 100644
index 0000000..33d5a30
--- /dev/null
+++ b/runtime/SetConstructor.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class SetPrototype;
+class GetterSetter;
+
+class SetConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static SetConstructor* create(VM& vm, Structure* structure, SetPrototype* setPrototype, GetterSetter* speciesSymbol)
+    {
+        SetConstructor* constructor = new (NotNull, allocateCell<SetConstructor>(vm.heap)) SetConstructor(vm, structure);
+        constructor->finishCreation(vm, setPrototype, speciesSymbol);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    SetConstructor(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, SetPrototype*, GetterSetter* speciesSymbol);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/SetIteratorPrototype.cpp b/runtime/SetIteratorPrototype.cpp
new file mode 100644
index 0000000..ccbbb0e
--- /dev/null
+++ b/runtime/SetIteratorPrototype.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SetIteratorPrototype.h"
+
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSSetIterator.h"
+
+namespace JSC {
+
+const ClassInfo SetIteratorPrototype::s_info = { "Set Iterator", &Base::s_info, 0, CREATE_METHOD_TABLE(SetIteratorPrototype) };
+
+static EncodedJSValue JSC_HOST_CALL SetIteratorPrototypeFuncNext(ExecState*);
+
+void SetIteratorPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->next, SetIteratorPrototypeFuncNext, DontEnum, 0);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Set Iterator"), DontEnum | ReadOnly);
+}
+
+EncodedJSValue JSC_HOST_CALL SetIteratorPrototypeFuncNext(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue result;
+    JSSetIterator* iterator = jsDynamicCast<JSSetIterator*>(callFrame->thisValue());
+    if (!iterator)
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot call SetIterator.next() on a non-SetIterator object")));
+
+    if (iterator->next(callFrame, result)) {
+        scope.release();
+        return JSValue::encode(createIteratorResultObject(callFrame, result, false));
+    }
+    scope.release();
+    return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true));
+}
+
+}
diff --git a/runtime/SetIteratorPrototype.h b/runtime/SetIteratorPrototype.h
new file mode 100644
index 0000000..27bfa2e
--- /dev/null
+++ b/runtime/SetIteratorPrototype.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class SetIteratorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static SetIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        SetIteratorPrototype* prototype = new (NotNull, allocateCell<SetIteratorPrototype>(vm.heap)) SetIteratorPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    SetIteratorPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/SetPrototype.cpp b/runtime/SetPrototype.cpp
new file mode 100644
index 0000000..600a21e
--- /dev/null
+++ b/runtime/SetPrototype.cpp
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SetPrototype.h"
+
+#include "BuiltinNames.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSSet.h"
+#include "JSSetIterator.h"
+#include "Lookup.h"
+
+#include "SetPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo SetPrototype::s_info = { "Set", &Base::s_info, &setPrototypeTable, CREATE_METHOD_TABLE(SetPrototype) };
+
+/* Source for SetIteratorPrototype.lut.h
+@begin setPrototypeTable
+  forEach   JSBuiltin  DontEnum|Function 0
+@end
+*/
+
+static EncodedJSValue JSC_HOST_CALL setProtoFuncAdd(ExecState*);
+static EncodedJSValue JSC_HOST_CALL setProtoFuncClear(ExecState*);
+static EncodedJSValue JSC_HOST_CALL setProtoFuncDelete(ExecState*);
+static EncodedJSValue JSC_HOST_CALL setProtoFuncHas(ExecState*);
+static EncodedJSValue JSC_HOST_CALL setProtoFuncValues(ExecState*);
+static EncodedJSValue JSC_HOST_CALL setProtoFuncEntries(ExecState*);
+
+
+static EncodedJSValue JSC_HOST_CALL setProtoFuncSize(ExecState*);
+
+void SetPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->add, setProtoFuncAdd, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->clear, setProtoFuncClear, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, setProtoFuncDelete, DontEnum, 1);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, setProtoFuncHas, DontEnum, 1, JSSetHasIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().entriesPublicName(), setProtoFuncEntries, DontEnum, 0);
+
+    JSFunction* values = JSFunction::create(vm, globalObject, 0, vm.propertyNames->builtinNames().valuesPublicName().string(), setProtoFuncValues);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().valuesPublicName(), values, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().keysPublicName(), values, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->iteratorSymbol, values, DontEnum);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Set"), DontEnum | ReadOnly);
+
+    JSC_NATIVE_GETTER(vm.propertyNames->size, setProtoFuncSize, DontEnum | Accessor);
+}
+
+ALWAYS_INLINE static JSSet* getSet(CallFrame* callFrame, JSValue thisValue)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (UNLIKELY(!thisValue.isCell())) {
+        throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue));
+        return nullptr;
+    }
+    if (LIKELY(thisValue.asCell()->type() == JSSetType))
+        return jsCast<JSSet*>(thisValue);
+    throwTypeError(callFrame, scope, ASCIILiteral("Set operation called on non-Set object"));
+    return nullptr;
+}
+
+EncodedJSValue JSC_HOST_CALL setProtoFuncAdd(CallFrame* callFrame)
+{
+    JSValue thisValue = callFrame->thisValue();
+    JSSet* set = getSet(callFrame, thisValue);
+    if (!set)
+        return JSValue::encode(jsUndefined());
+    set->add(callFrame, callFrame->argument(0));
+    return JSValue::encode(thisValue);
+}
+
+EncodedJSValue JSC_HOST_CALL setProtoFuncClear(CallFrame* callFrame)
+{
+    JSSet* set = getSet(callFrame, callFrame->thisValue());
+    if (!set)
+        return JSValue::encode(jsUndefined());
+    set->clear(callFrame);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL setProtoFuncDelete(CallFrame* callFrame)
+{
+    JSSet* set = getSet(callFrame, callFrame->thisValue());
+    if (!set)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(jsBoolean(set->remove(callFrame, callFrame->argument(0))));
+}
+
+EncodedJSValue JSC_HOST_CALL setProtoFuncHas(CallFrame* callFrame)
+{
+    JSSet* set = getSet(callFrame, callFrame->thisValue());
+    if (!set)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(jsBoolean(set->has(callFrame, callFrame->argument(0))));
+}
+
+EncodedJSValue JSC_HOST_CALL setProtoFuncSize(CallFrame* callFrame)
+{
+    JSSet* set = getSet(callFrame, callFrame->thisValue());
+    if (!set)
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(jsNumber(set->size(callFrame)));
+}
+    
+EncodedJSValue JSC_HOST_CALL setProtoFuncValues(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSSet* thisObj = jsDynamicCast<JSSet*>(callFrame->thisValue());
+    if (!thisObj)
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Set value iterator for a non-Set object.")));
+    return JSValue::encode(JSSetIterator::create(vm, callFrame->jsCallee()->globalObject()->setIteratorStructure(), thisObj, IterateValue));
+}
+
+EncodedJSValue JSC_HOST_CALL setProtoFuncEntries(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSSet* thisObj = jsDynamicCast<JSSet*>(callFrame->thisValue());
+    if (!thisObj)
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Set entry iterator for a non-Set object.")));
+    return JSValue::encode(JSSetIterator::create(vm, callFrame->jsCallee()->globalObject()->setIteratorStructure(), thisObj, IterateKeyValue));
+}
+
+EncodedJSValue JSC_HOST_CALL privateFuncSetIterator(ExecState* exec)
+{
+    ASSERT(jsDynamicCast<JSSet*>(exec->uncheckedArgument(0)));
+    JSSet* set = jsCast<JSSet*>(exec->uncheckedArgument(0));
+    return JSValue::encode(JSSetIterator::create(exec->vm(), exec->jsCallee()->globalObject()->setIteratorStructure(), set, IterateKey));
+}
+
+EncodedJSValue JSC_HOST_CALL privateFuncSetIteratorNext(ExecState* exec)
+{
+    ASSERT(jsDynamicCast<JSSetIterator*>(exec->thisValue()));
+    JSSetIterator* iterator = jsCast<JSSetIterator*>(exec->thisValue());
+    JSValue result;
+    if (iterator->next(exec, result)) {
+        JSArray* resultArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
+        resultArray->putDirectIndex(exec, 0, result);
+        return JSValue::encode(jsBoolean(false));
+    }
+    return JSValue::encode(jsBoolean(true));
+}
+
+}
diff --git a/runtime/SetPrototype.h b/runtime/SetPrototype.h
new file mode 100644
index 0000000..3d453b6
--- /dev/null
+++ b/runtime/SetPrototype.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class SetPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
+
+    static SetPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        SetPrototype* prototype = new (NotNull, allocateCell<SetPrototype>(vm.heap)) SetPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    SetPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+EncodedJSValue JSC_HOST_CALL privateFuncSetIterator(ExecState*);
+EncodedJSValue JSC_HOST_CALL privateFuncSetIteratorNext(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/SimpleTypedArrayController.cpp b/runtime/SimpleTypedArrayController.cpp
new file mode 100644
index 0000000..a25028c
--- /dev/null
+++ b/runtime/SimpleTypedArrayController.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SimpleTypedArrayController.h"
+
+#include "ArrayBuffer.h"
+#include "JSArrayBuffer.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+SimpleTypedArrayController::SimpleTypedArrayController() { }
+SimpleTypedArrayController::~SimpleTypedArrayController() { }
+
+JSArrayBuffer* SimpleTypedArrayController::toJS(
+    ExecState* exec, JSGlobalObject* globalObject, ArrayBuffer* native)
+{
+    if (JSArrayBuffer* buffer = native->m_wrapper.get())
+        return buffer;
+
+    // The JSArrayBuffer::create function will register the wrapper in finishCreation.
+    JSArrayBuffer* result = JSArrayBuffer::create(
+        exec->vm(), globalObject->arrayBufferStructure(native->sharingMode()), native);
+    return result;
+}
+
+void SimpleTypedArrayController::registerWrapper(JSGlobalObject*, ArrayBuffer* native, JSArrayBuffer* wrapper)
+{
+    ASSERT(!native->m_wrapper);
+    native->m_wrapper = Weak<JSArrayBuffer>(wrapper, &m_owner);
+}
+
+bool SimpleTypedArrayController::isAtomicsWaitAllowedOnCurrentThread()
+{
+    return true;
+}
+
+bool SimpleTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handle, void*, JSC::SlotVisitor& visitor)
+{
+    auto& wrapper = *JSC::jsCast<JSC::JSArrayBuffer*>(handle.slot()->asCell());
+    return visitor.containsOpaqueRoot(wrapper.impl());
+}
+
+void SimpleTypedArrayController::JSArrayBufferOwner::finalize(JSC::Handle<JSC::Unknown>, void*) { }
+
+} // namespace JSC
+
diff --git a/runtime/SimpleTypedArrayController.h b/runtime/SimpleTypedArrayController.h
new file mode 100644
index 0000000..d2b03c2
--- /dev/null
+++ b/runtime/SimpleTypedArrayController.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Handle.h"
+#include "TypedArrayController.h"
+#include "WeakHandleOwner.h"
+
+namespace JSC {
+
+// The default controller used for managing the relationship between
+// array buffers and their wrappers in JavaScriptCore. This isn't what
+// WebCore uses, but it is what JSC uses when running standalone. This
+// is pretty simple:
+//
+// - If the JSArrayBuffer is live, then the ArrayBuffer stays alive.
+//
+// - If there is a JSArrayBufferView that is holding an ArrayBuffer
+//   then any existing wrapper for that ArrayBuffer will be kept
+//   alive.
+//
+// - If you ask an ArrayBuffer for a JSArrayBuffer after one had
+//   already been created and it didn't die, then you get the same
+//   one.
+
+class SimpleTypedArrayController : public TypedArrayController {
+public:
+    SimpleTypedArrayController();
+    virtual ~SimpleTypedArrayController();
+    
+    JSArrayBuffer* toJS(ExecState*, JSGlobalObject*, ArrayBuffer*) override;
+    void registerWrapper(JSGlobalObject*, ArrayBuffer*, JSArrayBuffer*) override;
+    bool isAtomicsWaitAllowedOnCurrentThread() override;
+
+private:
+    class JSArrayBufferOwner : public WeakHandleOwner {
+    public:
+        bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, SlotVisitor&) override;
+        void finalize(JSC::Handle<JSC::Unknown>, void* context) override;
+    };
+
+    JSArrayBufferOwner m_owner;
+};
+
+} // namespace JSC
diff --git a/runtime/SlowPathReturnType.h b/runtime/SlowPathReturnType.h
new file mode 100644
index 0000000..4cc59a8
--- /dev/null
+++ b/runtime/SlowPathReturnType.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+#if USE(JSVALUE64)
+// According to C++ rules, a type used for the return signature of function with C linkage (i.e.
+// 'extern "C"') needs to be POD; hence putting any constructors into it could cause either compiler
+// warnings, or worse, a change in the ABI used to return these types.
+struct SlowPathReturnType {
+    void* a;
+    void* b;
+};
+
+inline SlowPathReturnType encodeResult(void* a, void* b)
+{
+    SlowPathReturnType result;
+    result.a = a;
+    result.b = b;
+    return result;
+}
+
+inline void decodeResult(SlowPathReturnType result, void*& a, void*& b)
+{
+    a = result.a;
+    b = result.b;
+}
+
+#else // USE(JSVALUE32_64)
+typedef int64_t SlowPathReturnType;
+
+typedef union {
+    struct {
+        void* a;
+        void* b;
+    } pair;
+    int64_t i;
+} SlowPathReturnTypeEncoding;
+
+inline SlowPathReturnType encodeResult(void* a, void* b)
+{
+    SlowPathReturnTypeEncoding u;
+    u.pair.a = a;
+    u.pair.b = b;
+    return u.i;
+}
+
+inline void decodeResult(SlowPathReturnType result, void*& a, void*& b)
+{
+    SlowPathReturnTypeEncoding u;
+    u.i = result;
+    a = u.pair.a;
+    b = u.pair.b;
+}
+#endif // USE(JSVALUE32_64)
+
+} // namespace JSC
diff --git a/runtime/SmallStrings.cpp b/runtime/SmallStrings.cpp
new file mode 100644
index 0000000..cac5d69
--- /dev/null
+++ b/runtime/SmallStrings.cpp
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2008, 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SmallStrings.h"
+
+#include "JSGlobalObject.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/text/StringImpl.h>
+
+namespace JSC {
+
+class SmallStringsStorage {
+    WTF_MAKE_NONCOPYABLE(SmallStringsStorage); WTF_MAKE_FAST_ALLOCATED;
+public:
+    SmallStringsStorage();
+
+    StringImpl* rep(unsigned char character)
+    {
+        return m_reps[character].get();
+    }
+
+private:
+    static const unsigned singleCharacterStringCount = maxSingleCharacterString + 1;
+
+    RefPtr<StringImpl> m_reps[singleCharacterStringCount];
+};
+
+SmallStringsStorage::SmallStringsStorage()
+{
+    LChar* characterBuffer = 0;
+    auto baseString = StringImpl::createUninitialized(singleCharacterStringCount, characterBuffer);
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i) {
+        characterBuffer[i] = i;
+        m_reps[i] = AtomicStringImpl::add(StringImpl::createSubstringSharingImpl(baseString.get(), i, 1).ptr());
+    }
+}
+
+SmallStrings::SmallStrings()
+    : m_emptyString(0)
+#define JSC_COMMON_STRINGS_ATTRIBUTE_INITIALIZE(name) , m_##name(0)
+    JSC_COMMON_STRINGS_EACH_NAME(JSC_COMMON_STRINGS_ATTRIBUTE_INITIALIZE)
+#undef JSC_COMMON_STRINGS_ATTRIBUTE_INITIALIZE
+    , m_objectStringStart(nullptr)
+    , m_nullObjectString(nullptr)
+    , m_undefinedObjectString(nullptr)
+    , m_needsToBeVisited(true)
+{
+    COMPILE_ASSERT(singleCharacterStringCount == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
+
+    for (unsigned i = 0; i < singleCharacterStringCount; ++i)
+        m_singleCharacterStrings[i] = 0;
+}
+
+void SmallStrings::initializeCommonStrings(VM& vm)
+{
+    createEmptyString(&vm);
+    for (unsigned i = 0; i <= maxSingleCharacterString; ++i)
+        createSingleCharacterString(&vm, i);
+#define JSC_COMMON_STRINGS_ATTRIBUTE_INITIALIZE(name) initialize(&vm, m_##name, #name);
+    JSC_COMMON_STRINGS_EACH_NAME(JSC_COMMON_STRINGS_ATTRIBUTE_INITIALIZE)
+#undef JSC_COMMON_STRINGS_ATTRIBUTE_INITIALIZE
+    initialize(&vm, m_objectStringStart, "[object ");
+    initialize(&vm, m_nullObjectString, "[object Null]");
+    initialize(&vm, m_undefinedObjectString, "[object Undefined]");
+}
+
+void SmallStrings::visitStrongReferences(SlotVisitor& visitor)
+{
+    m_needsToBeVisited = false;
+    visitor.appendUnbarriered(m_emptyString);
+    for (unsigned i = 0; i <= maxSingleCharacterString; ++i)
+        visitor.appendUnbarriered(m_singleCharacterStrings[i]);
+#define JSC_COMMON_STRINGS_ATTRIBUTE_VISIT(name) visitor.appendUnbarriered(m_##name);
+    JSC_COMMON_STRINGS_EACH_NAME(JSC_COMMON_STRINGS_ATTRIBUTE_VISIT)
+#undef JSC_COMMON_STRINGS_ATTRIBUTE_VISIT
+    visitor.appendUnbarriered(m_objectStringStart);
+    visitor.appendUnbarriered(m_nullObjectString);
+    visitor.appendUnbarriered(m_undefinedObjectString);
+}
+
+SmallStrings::~SmallStrings()
+{
+}
+
+void SmallStrings::createEmptyString(VM* vm)
+{
+    ASSERT(!m_emptyString);
+    m_emptyString = JSString::createHasOtherOwner(*vm, StringImpl::empty());
+    ASSERT(m_needsToBeVisited);
+}
+
+void SmallStrings::createSingleCharacterString(VM* vm, unsigned char character)
+{
+    if (!m_storage)
+        m_storage = std::make_unique<SmallStringsStorage>();
+    ASSERT(!m_singleCharacterStrings[character]);
+    m_singleCharacterStrings[character] = JSString::createHasOtherOwner(*vm, PassRefPtr<StringImpl>(m_storage->rep(character)));
+    ASSERT(m_needsToBeVisited);
+}
+
+StringImpl* SmallStrings::singleCharacterStringRep(unsigned char character)
+{
+    if (!m_storage)
+        m_storage = std::make_unique<SmallStringsStorage>();
+    return m_storage->rep(character);
+}
+
+void SmallStrings::initialize(VM* vm, JSString*& string, const char* value)
+{
+    string = JSString::create(*vm, Identifier::fromString(vm, value).impl());
+    ASSERT(m_needsToBeVisited);
+}
+
+} // namespace JSC
diff --git a/runtime/SmallStrings.h b/runtime/SmallStrings.h
new file mode 100644
index 0000000..263b427
--- /dev/null
+++ b/runtime/SmallStrings.h
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2008-2009, 2015-2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "TypeofType.h"
+#include "WriteBarrier.h"
+#include <wtf/Noncopyable.h>
+
+#define JSC_COMMON_STRINGS_EACH_NAME(macro) \
+    macro(default) \
+    macro(boolean) \
+    macro(false) \
+    macro(function) \
+    macro(number) \
+    macro(null) \
+    macro(object) \
+    macro(undefined) \
+    macro(string) \
+    macro(symbol) \
+    macro(true)
+
+namespace WTF {
+class StringImpl;
+}
+
+namespace JSC {
+
+class VM;
+class JSString;
+class SmallStringsStorage;
+class SlotVisitor;
+
+static const unsigned maxSingleCharacterString = 0xFF;
+
+class SmallStrings {
+    WTF_MAKE_NONCOPYABLE(SmallStrings);
+public:
+    SmallStrings();
+    ~SmallStrings();
+
+    JSString* emptyString()
+    {
+        return m_emptyString;
+    }
+
+    JSString* singleCharacterString(unsigned char character)
+    {
+        return m_singleCharacterStrings[character];
+    }
+
+    JS_EXPORT_PRIVATE WTF::StringImpl* singleCharacterStringRep(unsigned char character);
+
+    JSString** singleCharacterStrings() { return &m_singleCharacterStrings[0]; }
+
+    void initializeCommonStrings(VM&);
+    void visitStrongReferences(SlotVisitor&);
+
+#define JSC_COMMON_STRINGS_ACCESSOR_DEFINITION(name) \
+    JSString* name##String() const                   \
+    {                                                \
+        return m_##name;                             \
+    }
+    JSC_COMMON_STRINGS_EACH_NAME(JSC_COMMON_STRINGS_ACCESSOR_DEFINITION)
+#undef JSC_COMMON_STRINGS_ACCESSOR_DEFINITION
+    
+    JSString* typeString(TypeofType type) const
+    {
+        switch (type) {
+        case TypeofType::Undefined:
+            return undefinedString();
+        case TypeofType::Boolean:
+            return booleanString();
+        case TypeofType::Number:
+            return numberString();
+        case TypeofType::String:
+            return stringString();
+        case TypeofType::Symbol:
+            return symbolString();
+        case TypeofType::Object:
+            return objectString();
+        case TypeofType::Function:
+            return functionString();
+        }
+        
+        RELEASE_ASSERT_NOT_REACHED();
+        return nullptr;
+    }
+
+    JSString* objectStringStart() const { return m_objectStringStart; }
+    JSString* nullObjectString() const { return m_nullObjectString; }
+    JSString* undefinedObjectString() const { return m_undefinedObjectString; }
+
+    bool needsToBeVisited(CollectionScope scope) const
+    {
+        if (scope == CollectionScope::Full)
+            return true;
+        return m_needsToBeVisited;
+    }
+
+private:
+    static const unsigned singleCharacterStringCount = maxSingleCharacterString + 1;
+
+    void createEmptyString(VM*);
+    void createSingleCharacterString(VM*, unsigned char);
+
+    void initialize(VM*, JSString*&, const char* value);
+
+    JSString* m_emptyString;
+#define JSC_COMMON_STRINGS_ATTRIBUTE_DECLARATION(name) JSString* m_##name;
+    JSC_COMMON_STRINGS_EACH_NAME(JSC_COMMON_STRINGS_ATTRIBUTE_DECLARATION)
+#undef JSC_COMMON_STRINGS_ATTRIBUTE_DECLARATION
+    JSString* m_objectStringStart;
+    JSString* m_nullObjectString;
+    JSString* m_undefinedObjectString;
+    JSString* m_singleCharacterStrings[singleCharacterStringCount];
+    std::unique_ptr<SmallStringsStorage> m_storage;
+    bool m_needsToBeVisited;
+};
+
+} // namespace JSC
diff --git a/runtime/SparseArrayValueMap.cpp b/runtime/SparseArrayValueMap.cpp
new file mode 100644
index 0000000..daa56ad
--- /dev/null
+++ b/runtime/SparseArrayValueMap.cpp
@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SparseArrayValueMap.h"
+
+#include "ClassInfo.h"
+#include "GetterSetter.h"
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "PropertySlot.h"
+#include "SlotVisitor.h"
+#include "Structure.h"
+#include "TypeError.h"
+
+namespace JSC {
+
+const ClassInfo SparseArrayValueMap::s_info = { "SparseArrayValueMap", 0, 0, CREATE_METHOD_TABLE(SparseArrayValueMap) };
+
+SparseArrayValueMap::SparseArrayValueMap(VM& vm)
+    : Base(vm, vm.sparseArrayValueMapStructure.get())
+    , m_flags(Normal)
+    , m_reportedCapacity(0)
+{
+}
+
+SparseArrayValueMap::~SparseArrayValueMap()
+{
+}
+
+void SparseArrayValueMap::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+SparseArrayValueMap* SparseArrayValueMap::create(VM& vm)
+{
+    SparseArrayValueMap* result = new (NotNull, allocateCell<SparseArrayValueMap>(vm.heap)) SparseArrayValueMap(vm);
+    result->finishCreation(vm);
+    return result;
+}
+
+void SparseArrayValueMap::destroy(JSCell* cell)
+{
+    static_cast<SparseArrayValueMap*>(cell)->SparseArrayValueMap::~SparseArrayValueMap();
+}
+
+Structure* SparseArrayValueMap::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+SparseArrayValueMap::AddResult SparseArrayValueMap::add(JSObject* array, unsigned i)
+{
+    AddResult result;
+    size_t capacity;
+    {
+        auto locker = holdLock(*this);
+        SparseArrayEntry entry;
+        entry.setWithoutWriteBarrier(jsUndefined());
+        
+        result = m_map.add(i, entry);
+        capacity = m_map.capacity();
+    }
+    if (capacity != m_reportedCapacity) {
+        // FIXME: Adopt reportExtraMemoryVisited, and switch to reportExtraMemoryAllocated.
+        // https://bugs.webkit.org/show_bug.cgi?id=142595
+        Heap::heap(array)->deprecatedReportExtraMemory((capacity - m_reportedCapacity) * (sizeof(unsigned) + sizeof(WriteBarrier<Unknown>)));
+        m_reportedCapacity = capacity;
+    }
+    return result;
+}
+
+void SparseArrayValueMap::remove(iterator it)
+{
+    auto locker = holdLock(*this);
+    m_map.remove(it);
+}
+
+void SparseArrayValueMap::remove(unsigned i)
+{
+    auto locker = holdLock(*this);
+    m_map.remove(i);
+}
+
+bool SparseArrayValueMap::putEntry(ExecState* exec, JSObject* array, unsigned i, JSValue value, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ASSERT(value);
+    
+    AddResult result = add(array, i);
+    SparseArrayEntry& entry = result.iterator->value;
+
+    // To save a separate find & add, we first always add to the sparse map.
+    // In the uncommon case that this is a new property, and the array is not
+    // extensible, this is not the right thing to have done - so remove again.
+    if (result.isNewEntry && !array->isStructureExtensible()) {
+        remove(result.iterator);
+        return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+    }
+    
+    scope.release();
+    return entry.put(exec, array, this, value, shouldThrow);
+}
+
+bool SparseArrayValueMap::putDirect(ExecState* exec, JSObject* array, unsigned i, JSValue value, unsigned attributes, PutDirectIndexMode mode)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ASSERT(value);
+    
+    bool shouldThrow = (mode == PutDirectIndexShouldThrow);
+
+    AddResult result = add(array, i);
+    SparseArrayEntry& entry = result.iterator->value;
+
+    // To save a separate find & add, we first always add to the sparse map.
+    // In the uncommon case that this is a new property, and the array is not
+    // extensible, this is not the right thing to have done - so remove again.
+    if (mode != PutDirectIndexLikePutDirect && result.isNewEntry && !array->isStructureExtensible()) {
+        remove(result.iterator);
+        return typeError(exec, scope, shouldThrow, ASCIILiteral(NonExtensibleObjectPropertyDefineError));
+    }
+
+    if (entry.attributes & ReadOnly)
+        return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+
+    entry.attributes = attributes;
+    entry.set(vm, this, value);
+    return true;
+}
+
+void SparseArrayEntry::get(JSObject* thisObject, PropertySlot& slot) const
+{
+    JSValue value = Base::get();
+    ASSERT(value);
+
+    if (LIKELY(!value.isGetterSetter())) {
+        slot.setValue(thisObject, attributes, value);
+        return;
+    }
+
+    slot.setGetterSlot(thisObject, attributes, jsCast<GetterSetter*>(value));
+}
+
+void SparseArrayEntry::get(PropertyDescriptor& descriptor) const
+{
+    descriptor.setDescriptor(Base::get(), attributes);
+}
+
+bool SparseArrayEntry::put(ExecState* exec, JSValue thisValue, SparseArrayValueMap* map, JSValue value, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!(attributes & Accessor)) {
+        if (attributes & ReadOnly)
+            return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+
+        set(vm, map, value);
+        return true;
+    }
+
+    scope.release();
+    return callSetter(exec, thisValue, Base::get(), value, shouldThrow ? StrictMode : NotStrictMode);
+}
+
+JSValue SparseArrayEntry::getNonSparseMode() const
+{
+    ASSERT(!attributes);
+    return Base::get();
+}
+
+void SparseArrayValueMap::visitChildren(JSCell* thisObject, SlotVisitor& visitor)
+{
+    Base::visitChildren(thisObject, visitor);
+    
+    SparseArrayValueMap* thisMap = jsCast<SparseArrayValueMap*>(thisObject);
+    auto locker = holdLock(*thisMap);
+    iterator end = thisMap->m_map.end();
+    for (iterator it = thisMap->m_map.begin(); it != end; ++it)
+        visitor.append(it->value);
+}
+
+} // namespace JSC
+
diff --git a/runtime/SparseArrayValueMap.h b/runtime/SparseArrayValueMap.h
new file mode 100644
index 0000000..1c7dcb2
--- /dev/null
+++ b/runtime/SparseArrayValueMap.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "JSTypeInfo.h"
+#include "PropertyDescriptor.h"
+#include "PutDirectIndexMode.h"
+#include "WriteBarrier.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+class SparseArrayValueMap;
+
+struct SparseArrayEntry : public WriteBarrier<Unknown> {
+    typedef WriteBarrier<Unknown> Base;
+
+    SparseArrayEntry() : attributes(0) { }
+
+    void get(JSObject*, PropertySlot&) const;
+    void get(PropertyDescriptor&) const;
+    bool put(ExecState*, JSValue thisValue, SparseArrayValueMap*, JSValue, bool shouldThrow);
+    JSValue getNonSparseMode() const;
+
+    unsigned attributes;
+};
+
+class SparseArrayValueMap final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+    
+private:
+    typedef HashMap<uint64_t, SparseArrayEntry, WTF::IntHash<uint64_t>, WTF::UnsignedWithZeroKeyHashTraits<uint64_t>> Map;
+
+    enum Flags {
+        Normal = 0,
+        SparseMode = 1,
+        LengthIsReadOnly = 2,
+    };
+
+    SparseArrayValueMap(VM&);
+    ~SparseArrayValueMap();
+    
+    void finishCreation(VM&);
+
+public:
+    DECLARE_EXPORT_INFO;
+    
+    typedef Map::iterator iterator;
+    typedef Map::const_iterator const_iterator;
+    typedef Map::AddResult AddResult;
+
+    static SparseArrayValueMap* create(VM&);
+    
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+    
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    bool sparseMode()
+    {
+        return m_flags & SparseMode;
+    }
+
+    void setSparseMode()
+    {
+        m_flags = static_cast<Flags>(m_flags | SparseMode);
+    }
+
+    bool lengthIsReadOnly()
+    {
+        return m_flags & LengthIsReadOnly;
+    }
+
+    void setLengthIsReadOnly()
+    {
+        m_flags = static_cast<Flags>(m_flags | LengthIsReadOnly);
+    }
+
+    // These methods may mutate the contents of the map
+    bool putEntry(ExecState*, JSObject*, unsigned, JSValue, bool shouldThrow);
+    bool putDirect(ExecState*, JSObject*, unsigned, JSValue, unsigned attributes, PutDirectIndexMode);
+    AddResult add(JSObject*, unsigned);
+    iterator find(unsigned i) { return m_map.find(i); }
+    // This should ASSERT the remove is valid (check the result of the find).
+    void remove(iterator it);
+    void remove(unsigned i);
+
+    // These methods do not mutate the contents of the map.
+    iterator notFound() { return m_map.end(); }
+    bool isEmpty() const { return m_map.isEmpty(); }
+    bool contains(unsigned i) const { return m_map.contains(i); }
+    size_t size() const { return m_map.size(); }
+    // Only allow const begin/end iteration.
+    const_iterator begin() const { return m_map.begin(); }
+    const_iterator end() const { return m_map.end(); }
+
+private:
+    Map m_map;
+    Flags m_flags;
+    size_t m_reportedCapacity;
+};
+
+} // namespace JSC
diff --git a/runtime/StackAlignment.h b/runtime/StackAlignment.h
new file mode 100644
index 0000000..00c90a1
--- /dev/null
+++ b/runtime/StackAlignment.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+// NB. Different platforms may have different requirements here. But 16 bytes is very common.
+inline unsigned stackAlignmentBytes() { return 16; }
+
+inline unsigned stackAlignmentRegisters()
+{
+    return stackAlignmentBytes() / sizeof(EncodedJSValue);
+}
+
+// Align argument count taking into account the CallFrameHeaderSize may be
+// an "unaligned" count of registers.
+inline unsigned roundArgumentCountToAlignFrame(unsigned argumentCount)
+{
+    return WTF::roundUpToMultipleOf(stackAlignmentRegisters(), argumentCount + CallFrame::headerSizeInRegisters) - CallFrame::headerSizeInRegisters;
+}
+
+// Align local register count to make the last local end on a stack aligned address given the
+// CallFrame is at an address that is stack aligned minus CallerFrameAndPC::sizeInRegisters
+inline unsigned roundLocalRegisterCountForFramePointerOffset(unsigned localRegisterCount)
+{
+    return WTF::roundUpToMultipleOf(stackAlignmentRegisters(), localRegisterCount + CallerFrameAndPC::sizeInRegisters) - CallerFrameAndPC::sizeInRegisters;
+}
+
+inline unsigned logStackAlignmentRegisters()
+{
+    return WTF::fastLog2(stackAlignmentRegisters());
+}
+
+} // namespace JSC
diff --git a/runtime/StackFrame.cpp b/runtime/StackFrame.cpp
new file mode 100644
index 0000000..0a81ae7
--- /dev/null
+++ b/runtime/StackFrame.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StackFrame.h"
+
+#include "CodeBlock.h"
+#include "DebuggerPrimitives.h"
+#include "JSCInlines.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+intptr_t StackFrame::sourceID() const
+{
+    if (!m_codeBlock)
+        return noSourceID;
+    return m_codeBlock->ownerScriptExecutable()->sourceID();
+}
+
+String StackFrame::sourceURL() const
+{
+    if (!m_codeBlock) {
+        if (m_callee && m_callee->isAnyWasmCallee())
+            return ASCIILiteral("[wasm code]");
+        return ASCIILiteral("[native code]");
+    }
+
+    String sourceURL = m_codeBlock->ownerScriptExecutable()->sourceURL();
+    if (!sourceURL.isNull())
+        return sourceURL;
+    return emptyString();
+}
+
+String StackFrame::functionName(VM& vm) const
+{
+    if (m_codeBlock) {
+        switch (m_codeBlock->codeType()) {
+        case EvalCode:
+            return ASCIILiteral("eval code");
+        case ModuleCode:
+            return ASCIILiteral("module code");
+        case FunctionCode:
+            break;
+        case GlobalCode:
+            return ASCIILiteral("global code");
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    String name;
+    if (m_callee) {
+        if (m_callee->isObject())
+            name = getCalculatedDisplayName(vm, jsCast<JSObject*>(m_callee.get())).impl();
+        else if (m_callee->isAnyWasmCallee())
+            return ASCIILiteral("<wasm>");
+    }
+    return name.isNull() ? emptyString() : name;
+}
+
+void StackFrame::computeLineAndColumn(unsigned& line, unsigned& column) const
+{
+    if (!m_codeBlock) {
+        line = 0;
+        column = 0;
+        return;
+    }
+
+    int divot = 0;
+    int unusedStartOffset = 0;
+    int unusedEndOffset = 0;
+    m_codeBlock->expressionRangeForBytecodeOffset(m_bytecodeOffset, divot, unusedStartOffset, unusedEndOffset, line, column);
+
+    ScriptExecutable* executable = m_codeBlock->ownerScriptExecutable();
+    if (executable->hasOverrideLineNumber())
+        line = executable->overrideLineNumber();
+}
+
+String StackFrame::toString(VM& vm) const
+{
+    StringBuilder traceBuild;
+    String functionName = this->functionName(vm);
+    String sourceURL = this->sourceURL();
+    traceBuild.append(functionName);
+    if (!sourceURL.isEmpty()) {
+        if (!functionName.isEmpty())
+            traceBuild.append('@');
+        traceBuild.append(sourceURL);
+        if (hasLineAndColumnInfo()) {
+            unsigned line;
+            unsigned column;
+            computeLineAndColumn(line, column);
+
+            traceBuild.append(':');
+            traceBuild.appendNumber(line);
+            traceBuild.append(':');
+            traceBuild.appendNumber(column);
+        }
+    }
+    return traceBuild.toString().impl();
+}
+
+} // namespace JSC
+
diff --git a/runtime/StackFrame.h b/runtime/StackFrame.h
new file mode 100644
index 0000000..e2ee93a
--- /dev/null
+++ b/runtime/StackFrame.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Strong.h"
+#include <limits.h>
+
+namespace JSC {
+
+class CodeBlock;
+class JSObject;
+
+class StackFrame {
+public:
+    StackFrame(VM& vm, JSCell* callee)
+        : m_callee(vm, callee)
+    { }
+
+    StackFrame(VM& vm, JSCell* callee, CodeBlock* codeBlock, unsigned bytecodeOffset)
+        : m_callee(vm, callee)
+        , m_codeBlock(vm, codeBlock)
+        , m_bytecodeOffset(bytecodeOffset)
+    { }
+
+    bool hasLineAndColumnInfo() const { return !!m_codeBlock; }
+    
+    void computeLineAndColumn(unsigned& line, unsigned& column) const;
+    String functionName(VM&) const;
+    intptr_t sourceID() const;
+    String sourceURL() const;
+    String toString(VM&) const;
+
+    bool hasBytecodeOffset() const { return m_bytecodeOffset != UINT_MAX; }
+    unsigned bytecodeOffset()
+    {
+        ASSERT(m_bytecodeOffset != UINT_MAX);
+        return m_bytecodeOffset;
+    }
+
+
+private:
+    Strong<JSCell> m_callee { };
+    Strong<CodeBlock> m_codeBlock { };
+    unsigned m_bytecodeOffset { UINT_MAX };
+    
+};
+
+} // namespace JSC
+
diff --git a/runtime/StrictEvalActivation.cpp b/runtime/StrictEvalActivation.cpp
new file mode 100644
index 0000000..4260e10
--- /dev/null
+++ b/runtime/StrictEvalActivation.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StrictEvalActivation.h"
+
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(StrictEvalActivation);
+
+const ClassInfo StrictEvalActivation::s_info = { "Object", &Base::s_info, 0, CREATE_METHOD_TABLE(StrictEvalActivation) };
+
+StrictEvalActivation::StrictEvalActivation(ExecState* exec, JSScope* currentScope)
+    : Base(
+        exec->vm(),
+        exec->lexicalGlobalObject()->strictEvalActivationStructure(),
+        currentScope
+    )
+{
+}
+
+bool StrictEvalActivation::deleteProperty(JSCell*, ExecState*, PropertyName)
+{
+    return false;
+}
+
+JSValue StrictEvalActivation::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
+{
+    if (ecmaMode == StrictMode)
+        return jsUndefined();
+    return exec->globalThisValue();
+}
+
+}
diff --git a/runtime/StrictEvalActivation.h b/runtime/StrictEvalActivation.h
new file mode 100644
index 0000000..d800e96
--- /dev/null
+++ b/runtime/StrictEvalActivation.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSScope.h"
+
+namespace JSC {
+
+class StrictEvalActivation : public JSScope {
+public:
+    typedef JSScope Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesToThis;
+
+    static StrictEvalActivation* create(ExecState* exec, JSScope* currentScope)
+    {
+        StrictEvalActivation* lexicalEnvironment = new (NotNull, allocateCell<StrictEvalActivation>(*exec->heap())) StrictEvalActivation(exec, currentScope);
+        lexicalEnvironment->finishCreation(exec->vm());
+        return lexicalEnvironment;
+    }
+
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static JSValue toThis(JSCell*, ExecState*, ECMAMode);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(StrictEvalActivationType, StructureFlags), info());
+    }
+    
+    DECLARE_INFO;
+
+private:
+    StrictEvalActivation(ExecState*, JSScope*);
+};
+
+} // namespace JSC
diff --git a/runtime/StringConstructor.cpp b/runtime/StringConstructor.cpp
new file mode 100644
index 0000000..ae267b0
--- /dev/null
+++ b/runtime/StringConstructor.cpp
@@ -0,0 +1,163 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "StringConstructor.h"
+
+#include "Error.h"
+#include "JITCode.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+#include "StringPrototype.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL stringFromCharCode(ExecState*);
+static EncodedJSValue JSC_HOST_CALL stringFromCodePoint(ExecState*);
+
+}
+
+#include "StringConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo StringConstructor::s_info = { "Function", &InternalFunction::s_info, &stringConstructorTable, CREATE_METHOD_TABLE(StringConstructor) };
+
+/* Source for StringConstructor.lut.h
+@begin stringConstructorTable
+  fromCharCode          stringFromCharCode         DontEnum|Function 1
+  fromCodePoint         stringFromCodePoint        DontEnum|Function 1
+  raw                   JSBuiltin                  DontEnum|Function 1
+@end
+*/
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(StringConstructor);
+
+StringConstructor::StringConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+void StringConstructor::finishCreation(VM& vm, StringPrototype* stringPrototype)
+{
+    Base::finishCreation(vm, stringPrototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, stringPrototype, ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+}
+
+// ------------------------------ Functions --------------------------------
+
+static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec)
+{
+    unsigned length = exec->argumentCount();
+    UChar* buf;
+    auto impl = StringImpl::createUninitialized(length, buf);
+    for (unsigned i = 0; i < length; ++i)
+        buf[i] = static_cast<UChar>(exec->uncheckedArgument(i).toUInt32(exec));
+    return jsString(exec, WTFMove(impl));
+}
+
+static EncodedJSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec)
+{
+    if (LIKELY(exec->argumentCount() == 1))
+        return JSValue::encode(jsSingleCharacterString(exec, exec->uncheckedArgument(0).toUInt32(exec)));
+    return JSValue::encode(stringFromCharCodeSlowCase(exec));
+}
+
+JSCell* JSC_HOST_CALL stringFromCharCode(ExecState* exec, int32_t arg)
+{
+    return jsSingleCharacterString(exec, arg);
+}
+
+static EncodedJSValue JSC_HOST_CALL stringFromCodePoint(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    unsigned length = exec->argumentCount();
+    StringBuilder builder;
+    builder.reserveCapacity(length);
+
+    for (unsigned i = 0; i < length; ++i) {
+        double codePointAsDouble = exec->uncheckedArgument(i).toNumber(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+        uint32_t codePoint = static_cast<uint32_t>(codePointAsDouble);
+
+        if (codePoint != codePointAsDouble || codePoint > UCHAR_MAX_VALUE)
+            return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Arguments contain a value that is out of range of code points")));
+
+        if (U_IS_BMP(codePoint))
+            builder.append(static_cast<UChar>(codePoint));
+        else {
+            builder.append(U16_LEAD(codePoint));
+            builder.append(U16_TRAIL(codePoint));
+        }
+    }
+
+    scope.release();
+    return JSValue::encode(jsString(exec, builder.toString()));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructWithStringConstructor(ExecState* exec)
+{
+    JSGlobalObject* globalObject = asInternalFunction(exec->jsCallee())->globalObject();
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    Structure* structure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->stringObjectStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    if (!exec->argumentCount())
+        return JSValue::encode(StringObject::create(vm, structure));
+    JSString* str = exec->uncheckedArgument(0).toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(StringObject::create(vm, structure, str));
+}
+
+ConstructType StringConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWithStringConstructor;
+    return ConstructType::Host;
+}
+
+JSCell* stringConstructor(ExecState* exec, JSValue argument)
+{
+    if (argument.isSymbol())
+        return jsNontrivialString(exec, asSymbol(argument)->descriptiveString());
+    return argument.toString(exec);
+}
+
+static EncodedJSValue JSC_HOST_CALL callStringConstructor(ExecState* exec)
+{
+    if (!exec->argumentCount())
+        return JSValue::encode(jsEmptyString(exec));
+    return JSValue::encode(stringConstructor(exec, exec->uncheckedArgument(0)));
+}
+
+CallType StringConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callStringConstructor;
+    return CallType::Host;
+}
+
+} // namespace JSC
diff --git a/runtime/StringConstructor.h b/runtime/StringConstructor.h
new file mode 100644
index 0000000..1bd1e21
--- /dev/null
+++ b/runtime/StringConstructor.h
@@ -0,0 +1,59 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class StringPrototype;
+class GetterSetter;
+
+class StringConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static StringConstructor* create(VM& vm, Structure* structure, StringPrototype* stringPrototype, GetterSetter*)
+    {
+        StringConstructor* constructor = new (NotNull, allocateCell<StringConstructor>(vm.heap)) StringConstructor(vm, structure);
+        constructor->finishCreation(vm, stringPrototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    StringConstructor(VM&, Structure*);
+    void finishCreation(VM&, StringPrototype*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+JSCell* JSC_HOST_CALL stringFromCharCode(ExecState*, int32_t);
+JSCell* stringConstructor(ExecState*, JSValue);
+
+} // namespace JSC
diff --git a/runtime/StringIteratorPrototype.cpp b/runtime/StringIteratorPrototype.cpp
new file mode 100644
index 0000000..f2e6edd
--- /dev/null
+++ b/runtime/StringIteratorPrototype.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StringIteratorPrototype.h"
+
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSStringIterator.h"
+#include "ObjectConstructor.h"
+
+#include "StringIteratorPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo StringIteratorPrototype::s_info = { "String Iterator", &Base::s_info, &stringIteratorPrototypeTable, CREATE_METHOD_TABLE(StringIteratorPrototype) };
+
+/* Source for StringIteratorPrototype.lut.h
+@begin stringIteratorPrototypeTable
+  next      JSBuiltin    DontEnum|Function 0
+@end
+*/
+
+void StringIteratorPrototype::finishCreation(VM& vm, JSGlobalObject*)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "String Iterator"), DontEnum | ReadOnly);
+    vm.prototypeMap.addPrototype(this);
+}
+
+} // namespace JSC
diff --git a/runtime/StringIteratorPrototype.h b/runtime/StringIteratorPrototype.h
new file mode 100644
index 0000000..da6eca6
--- /dev/null
+++ b/runtime/StringIteratorPrototype.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class StringIteratorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static StringIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        StringIteratorPrototype* prototype = new (NotNull, allocateCell<StringIteratorPrototype>(vm.heap)) StringIteratorPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    StringIteratorPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/StringObject.cpp b/runtime/StringObject.cpp
new file mode 100644
index 0000000..e6d6547
--- /dev/null
+++ b/runtime/StringObject.cpp
@@ -0,0 +1,172 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "StringObject.h"
+
+#include "Error.h"
+#include "JSGlobalObject.h"
+#include "JSCInlines.h"
+#include "PropertyNameArray.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(StringObject);
+
+const ClassInfo StringObject::s_info = { "String", &JSWrapperObject::s_info, 0, CREATE_METHOD_TABLE(StringObject) };
+
+StringObject::StringObject(VM& vm, Structure* structure)
+    : JSWrapperObject(vm, structure)
+{
+}
+
+void StringObject::finishCreation(VM& vm, JSString* string)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    setInternalValue(vm, string);
+}
+
+bool StringObject::getOwnPropertySlot(JSObject* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+    StringObject* thisObject = jsCast<StringObject*>(cell);
+    if (thisObject->internalValue()->getStringPropertySlot(exec, propertyName, slot))
+        return true;
+    return JSObject::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+}
+    
+bool StringObject::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    StringObject* thisObject = jsCast<StringObject*>(object);
+    if (thisObject->internalValue()->getStringPropertySlot(exec, propertyName, slot))
+        return true;    
+    return JSObject::getOwnPropertySlot(thisObject, exec, Identifier::from(exec, propertyName), slot);
+}
+
+bool StringObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    StringObject* thisObject = jsCast<StringObject*>(cell);
+
+    if (UNLIKELY(isThisValueAltered(slot, thisObject))) {
+        scope.release();
+        return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+    }
+
+    if (propertyName == vm.propertyNames->length)
+        return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
+    if (std::optional<uint32_t> index = parseIndex(propertyName)) {
+        scope.release();
+        return putByIndex(cell, exec, index.value(), value, slot.isStrictMode());
+    }
+    scope.release();
+    return JSObject::put(cell, exec, propertyName, value, slot);
+}
+
+bool StringObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    StringObject* thisObject = jsCast<StringObject*>(cell);
+    if (thisObject->internalValue()->canGetIndex(propertyName))
+        return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyWriteError));
+    scope.release();
+    return JSObject::putByIndex(cell, exec, propertyName, value, shouldThrow);
+}
+
+static bool isStringOwnProperty(ExecState* exec, StringObject* object, PropertyName propertyName)
+{
+    if (propertyName == exec->propertyNames().length)
+        return true;
+    if (std::optional<uint32_t> index = parseIndex(propertyName)) {
+        if (object->internalValue()->canGetIndex(index.value()))
+            return true;
+    }
+    return false;
+}
+
+bool StringObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool throwException)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    StringObject* thisObject = jsCast<StringObject*>(object);
+
+    if (isStringOwnProperty(exec, thisObject, propertyName)) {
+        // The current PropertyDescriptor is always
+        // PropertyDescriptor{[[Value]]: value, [[Writable]]: false, [[Enumerable]]: true, [[Configurable]]: false}.
+        // This ensures that any property descriptor cannot change the existing one.
+        // Here, simply return the result of validateAndApplyPropertyDescriptor.
+        // https://tc39.github.io/ecma262/#sec-string-exotic-objects-getownproperty-p
+        PropertyDescriptor current;
+        bool isCurrentDefined = thisObject->getOwnPropertyDescriptor(exec, propertyName, current);
+        ASSERT(isCurrentDefined);
+        bool isExtensible = thisObject->isExtensible(exec);
+        RETURN_IF_EXCEPTION(scope, false);
+        scope.release();
+        return validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, isExtensible, descriptor, isCurrentDefined, current, throwException);
+    }
+
+    scope.release();
+    return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+}
+
+bool StringObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    StringObject* thisObject = jsCast<StringObject*>(cell);
+    if (propertyName == exec->propertyNames().length)
+        return false;
+    std::optional<uint32_t> index = parseIndex(propertyName);
+    if (index && thisObject->internalValue()->canGetIndex(index.value()))
+        return false;
+    return JSObject::deleteProperty(thisObject, exec, propertyName);
+}
+
+bool StringObject::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned i)
+{
+    StringObject* thisObject = jsCast<StringObject*>(cell);
+    if (thisObject->internalValue()->canGetIndex(i))
+        return false;
+    return JSObject::deletePropertyByIndex(thisObject, exec, i);
+}
+
+void StringObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    StringObject* thisObject = jsCast<StringObject*>(object);
+    if (propertyNames.includeStringProperties()) {
+        int size = thisObject->internalValue()->length();
+        for (int i = 0; i < size; ++i)
+            propertyNames.add(Identifier::from(exec, i));
+    }
+    if (mode.includeDontEnumProperties())
+        propertyNames.add(exec->propertyNames().length);
+    return JSObject::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
+}
+
+StringObject* constructString(VM& vm, JSGlobalObject* globalObject, JSValue string)
+{
+    StringObject* object = StringObject::create(vm, globalObject->stringObjectStructure());
+    object->setInternalValue(vm, string);
+    return object;
+}
+
+} // namespace JSC
diff --git a/runtime/StringObject.h b/runtime/StringObject.h
new file mode 100644
index 0000000..2efd7eb
--- /dev/null
+++ b/runtime/StringObject.h
@@ -0,0 +1,112 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007-2008, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSWrapperObject.h"
+#include "JSString.h"
+
+namespace JSC {
+
+class StringObject : public JSWrapperObject {
+public:
+    typedef JSWrapperObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
+
+    static StringObject* create(VM& vm, Structure* structure)
+    {
+        JSString* string = jsEmptyString(&vm);
+        StringObject* object = new (NotNull, allocateCell<StringObject>(vm.heap)) StringObject(vm, structure);
+        object->finishCreation(vm, string);
+        return object;
+    }
+    static StringObject* create(VM& vm, Structure* structure, JSString* string)
+    {
+        StringObject* object = new (NotNull, allocateCell<StringObject>(vm.heap)) StringObject(vm, structure);
+        object->finishCreation(vm, string);
+        return object;
+    }
+    static StringObject* create(VM&, JSGlobalObject*, JSString*);
+
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSObject*, ExecState*, unsigned propertyName, PropertySlot&);
+
+    JS_EXPORT_PRIVATE static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+    JS_EXPORT_PRIVATE static bool putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+
+    JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    JS_EXPORT_PRIVATE static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
+    JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+    JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+    DECLARE_EXPORT_INFO;
+
+    JSString* internalValue() const { return asString(JSWrapperObject::internalValue());}
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    JS_EXPORT_PRIVATE void finishCreation(VM&, JSString*);
+    JS_EXPORT_PRIVATE StringObject(VM&, Structure*);
+};
+
+StringObject* asStringObject(JSValue);
+
+inline StringObject* asStringObject(JSValue value)
+{
+    ASSERT(asObject(value)->inherits(StringObject::info()));
+    return static_cast<StringObject*>(asObject(value));
+}
+
+JS_EXPORT_PRIVATE StringObject* constructString(VM&, JSGlobalObject*, JSValue);
+
+// Helper for producing a JSString for 'string', where 'string' was been produced by
+// calling ToString on 'originalValue'. In cases where 'originalValue' already was a
+// string primitive we can just use this, otherwise we need to allocate a new JSString.
+// FIXME: Basically any use of this is bad. toString() returns a JSString* so we don't need to
+// pass around the originalValue; we could just pass around the JSString*. Then you don't need
+// this function. You just use the JSString* that toString() returned.
+static inline JSString* jsStringWithReuse(ExecState* exec, JSValue originalValue, const String& string)
+{
+    if (originalValue.isString()) {
+        ASSERT(asString(originalValue)->value(exec) == string);
+        return asString(originalValue);
+    }
+    return jsString(exec, string);
+}
+
+// Helper that tries to use the JSString substring sharing mechanism if 'originalValue' is a JSString.
+// FIXME: Basically any use of this is bad. toString() returns a JSString* so we don't need to
+// pass around the originalValue; we could just pass around the JSString*. And since we've
+// resolved it, we know that we can just allocate the substring cell directly.
+// https://bugs.webkit.org/show_bug.cgi?id=158140
+static inline JSString* jsSubstring(ExecState* exec, JSValue originalValue, const String& string, unsigned offset, unsigned length)
+{
+    if (originalValue.isString()) {
+        ASSERT(asString(originalValue)->value(exec) == string);
+        return jsSubstring(exec, asString(originalValue), offset, length);
+    }
+    return jsSubstring(exec, string, offset, length);
+}
+
+} // namespace JSC
diff --git a/runtime/StringPrototype.cpp b/runtime/StringPrototype.cpp
new file mode 100644
index 0000000..6c4ebf2
--- /dev/null
+++ b/runtime/StringPrototype.cpp
@@ -0,0 +1,2098 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004-2017 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Torch Mobile, Inc.
+ *  Copyright (C) 2015 Jordan Harband (ljharb@gmail.com)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "StringPrototype.h"
+
+#include "BuiltinNames.h"
+#include "ButterflyInlines.h"
+#include "CachedCall.h"
+#include "Error.h"
+#include "IntlObject.h"
+#include "JSArray.h"
+#include "JSCBuiltins.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSStringBuilder.h"
+#include "JSStringIterator.h"
+#include "Lookup.h"
+#include "ObjectPrototype.h"
+#include "PropertyNameArray.h"
+#include "RegExpCache.h"
+#include "RegExpConstructor.h"
+#include "RegExpObject.h"
+#include "SuperSampler.h"
+#include <algorithm>
+#include <unicode/uconfig.h>
+#include <unicode/unorm.h>
+#include <unicode/ustring.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/MathExtras.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringView.h>
+#include <wtf/unicode/Collator.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(StringPrototype);
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToString(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncCodePointAt(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncReplaceUsingRegExp(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncReplaceUsingStringSearch(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToLocaleLowerCase(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToLocaleUpperCase(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncBig(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncBold(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSub(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSup(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncLink(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncTrim(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncTrimLeft(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncStartsWith(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncEndsWith(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncIncludes(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncNormalize(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncIterator(ExecState*);
+
+}
+
+#include "StringPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo StringPrototype::s_info = { "String", &StringObject::s_info, &stringPrototypeTable, CREATE_METHOD_TABLE(StringPrototype) };
+
+/* Source for StringConstructor.lut.h
+@begin stringPrototypeTable
+    match     JSBuiltin    DontEnum|Function 1
+    padStart  JSBuiltin    DontEnum|Function 1
+    padEnd    JSBuiltin    DontEnum|Function 1
+    repeat    JSBuiltin    DontEnum|Function 1
+    replace   JSBuiltin    DontEnum|Function 2
+    search    JSBuiltin    DontEnum|Function 1
+    split     JSBuiltin    DontEnum|Function 1
+@end
+*/
+
+// ECMA 15.5.4
+StringPrototype::StringPrototype(VM& vm, Structure* structure)
+    : StringObject(vm, structure)
+{
+}
+
+void StringPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject, JSString* nameAndMessage)
+{
+    Base::finishCreation(vm, nameAndMessage);
+    ASSERT(inherits(info()));
+
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->toString, stringProtoFuncToString, DontEnum, 0, StringPrototypeValueOfIntrinsic);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->valueOf, stringProtoFuncToString, DontEnum, 0, StringPrototypeValueOfIntrinsic);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION("charAt", stringProtoFuncCharAt, DontEnum, 1, CharAtIntrinsic);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION("charCodeAt", stringProtoFuncCharCodeAt, DontEnum, 1, CharCodeAtIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("codePointAt", stringProtoFuncCodePointAt, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("concat", stringProtoFuncConcat, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("indexOf", stringProtoFuncIndexOf, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("lastIndexOf", stringProtoFuncLastIndexOf, DontEnum, 1);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().replaceUsingRegExpPrivateName(), stringProtoFuncReplaceUsingRegExp, DontEnum, 2, StringPrototypeReplaceRegExpIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().replaceUsingStringSearchPrivateName(), stringProtoFuncReplaceUsingStringSearch, DontEnum, 2);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("slice", stringProtoFuncSlice, DontEnum, 2);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("substr", stringProtoFuncSubstr, DontEnum, 2);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("substring", stringProtoFuncSubstring, DontEnum, 2);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION("toLowerCase", stringProtoFuncToLowerCase, DontEnum, 0, ToLowerCaseIntrinsic);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("toUpperCase", stringProtoFuncToUpperCase, DontEnum, 0);
+#if ENABLE(INTL)
+    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION("localeCompare", stringPrototypeLocaleCompareCodeGenerator, DontEnum);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("toLocaleLowerCase", stringProtoFuncToLocaleLowerCase, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("toLocaleUpperCase", stringProtoFuncToLocaleUpperCase, DontEnum, 0);
+#else
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("localeCompare", stringProtoFuncLocaleCompare, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("toLocaleLowerCase", stringProtoFuncToLowerCase, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("toLocaleUpperCase", stringProtoFuncToUpperCase, DontEnum, 0);
+#endif
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("big", stringProtoFuncBig, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("small", stringProtoFuncSmall, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("blink", stringProtoFuncBlink, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("bold", stringProtoFuncBold, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("fixed", stringProtoFuncFixed, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("italics", stringProtoFuncItalics, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("strike", stringProtoFuncStrike, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("sub", stringProtoFuncSub, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("sup", stringProtoFuncSup, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("fontcolor", stringProtoFuncFontcolor, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("fontsize", stringProtoFuncFontsize, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("anchor", stringProtoFuncAnchor, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("link", stringProtoFuncLink, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("trim", stringProtoFuncTrim, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("trimLeft", stringProtoFuncTrimLeft, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("trimRight", stringProtoFuncTrimRight, DontEnum, 0);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("startsWith", stringProtoFuncStartsWith, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("endsWith", stringProtoFuncEndsWith, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("includes", stringProtoFuncIncludes, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("normalize", stringProtoFuncNormalize, DontEnum, 0);
+    JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().charCodeAtPrivateName(), stringProtoFuncCharCodeAt, DontEnum, 1, CharCodeAtIntrinsic);
+
+    JSFunction* iteratorFunction = JSFunction::create(vm, globalObject, 0, ASCIILiteral("[Symbol.iterator]"), stringProtoFuncIterator, NoIntrinsic);
+    putDirectWithoutTransition(vm, vm.propertyNames->iteratorSymbol, iteratorFunction, DontEnum);
+
+    // The constructor will be added later, after StringConstructor has been built
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
+}
+
+StringPrototype* StringPrototype::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    JSString* empty = jsEmptyString(&vm);
+    StringPrototype* prototype = new (NotNull, allocateCell<StringPrototype>(vm.heap)) StringPrototype(vm, structure);
+    prototype->finishCreation(vm, globalObject, empty);
+    return prototype;
+}
+
+// ------------------------------ Functions --------------------------
+
+static NEVER_INLINE String substituteBackreferencesSlow(StringView replacement, StringView source, const int* ovector, RegExp* reg, size_t i)
+{
+    StringBuilder substitutedReplacement;
+    int offset = 0;
+    do {
+        if (i + 1 == replacement.length())
+            break;
+
+        UChar ref = replacement[i + 1];
+        if (ref == '$') {
+            // "$$" -> "$"
+            ++i;
+            substitutedReplacement.append(replacement.substring(offset, i - offset));
+            offset = i + 1;
+            continue;
+        }
+
+        int backrefStart;
+        int backrefLength;
+        int advance = 0;
+        if (ref == '&') {
+            backrefStart = ovector[0];
+            backrefLength = ovector[1] - backrefStart;
+        } else if (ref == '`') {
+            backrefStart = 0;
+            backrefLength = ovector[0];
+        } else if (ref == '\'') {
+            backrefStart = ovector[1];
+            backrefLength = source.length() - backrefStart;
+        } else if (reg && isASCIIDigit(ref)) {
+            // 1- and 2-digit back references are allowed
+            unsigned backrefIndex = ref - '0';
+            if (backrefIndex > reg->numSubpatterns())
+                continue;
+            if (replacement.length() > i + 2) {
+                ref = replacement[i + 2];
+                if (isASCIIDigit(ref)) {
+                    backrefIndex = 10 * backrefIndex + ref - '0';
+                    if (backrefIndex > reg->numSubpatterns())
+                        backrefIndex = backrefIndex / 10;   // Fall back to the 1-digit reference
+                    else
+                        advance = 1;
+                }
+            }
+            if (!backrefIndex)
+                continue;
+            backrefStart = ovector[2 * backrefIndex];
+            backrefLength = ovector[2 * backrefIndex + 1] - backrefStart;
+        } else
+            continue;
+
+        if (i - offset)
+            substitutedReplacement.append(replacement.substring(offset, i - offset));
+        i += 1 + advance;
+        offset = i + 1;
+        if (backrefStart >= 0)
+            substitutedReplacement.append(source.substring(backrefStart, backrefLength));
+    } while ((i = replacement.find('$', i + 1)) != notFound);
+
+    if (replacement.length() - offset)
+        substitutedReplacement.append(replacement.substring(offset));
+
+    return substitutedReplacement.toString();
+}
+
+inline String substituteBackreferencesInline(const String& replacement, StringView source, const int* ovector, RegExp* reg)
+{
+    size_t i = replacement.find('$');
+    if (UNLIKELY(i != notFound))
+        return substituteBackreferencesSlow(replacement, source, ovector, reg, i);
+
+    return replacement;
+}
+
+String substituteBackreferences(const String& replacement, StringView source, const int* ovector, RegExp* reg)
+{
+    return substituteBackreferencesInline(replacement, source, ovector, reg);
+}
+
+struct StringRange {
+    StringRange(int pos, int len)
+        : position(pos)
+        , length(len)
+    {
+    }
+
+    StringRange()
+    {
+    }
+
+    int position;
+    int length;
+};
+
+static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourceVal, const String& source, const StringRange* substringRanges, int rangeCount)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (rangeCount == 1) {
+        int sourceSize = source.length();
+        int position = substringRanges[0].position;
+        int length = substringRanges[0].length;
+        if (position <= 0 && length >= sourceSize)
+            return sourceVal;
+        // We could call String::substringSharingImpl(), but this would result in redundant checks.
+        scope.release();
+        return jsString(exec, StringImpl::createSubstringSharingImpl(*source.impl(), std::max(0, position), std::min(sourceSize, length)));
+    }
+
+    int totalLength = 0;
+    for (int i = 0; i < rangeCount; i++)
+        totalLength += substringRanges[i].length;
+
+    if (!totalLength)
+        return jsEmptyString(exec);
+
+    if (source.is8Bit()) {
+        LChar* buffer;
+        const LChar* sourceData = source.characters8();
+        auto impl = StringImpl::tryCreateUninitialized(totalLength, buffer);
+        if (!impl)
+            return throwOutOfMemoryError(exec, scope);
+
+        int bufferPos = 0;
+        for (int i = 0; i < rangeCount; i++) {
+            if (int srcLen = substringRanges[i].length) {
+                StringImpl::copyChars(buffer + bufferPos, sourceData + substringRanges[i].position, srcLen);
+                bufferPos += srcLen;
+            }
+        }
+
+        scope.release();
+        return jsString(exec, WTFMove(impl));
+    }
+
+    UChar* buffer;
+    const UChar* sourceData = source.characters16();
+
+    auto impl = StringImpl::tryCreateUninitialized(totalLength, buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec, scope);
+
+    int bufferPos = 0;
+    for (int i = 0; i < rangeCount; i++) {
+        if (int srcLen = substringRanges[i].length) {
+            StringImpl::copyChars(buffer + bufferPos, sourceData + substringRanges[i].position, srcLen);
+            bufferPos += srcLen;
+        }
+    }
+
+    scope.release();
+    return jsString(exec, WTFMove(impl));
+}
+
+static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const String& source, const StringRange* substringRanges, int rangeCount, const String* separators, int separatorCount)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (rangeCount == 1 && separatorCount == 0) {
+        int sourceSize = source.length();
+        int position = substringRanges[0].position;
+        int length = substringRanges[0].length;
+        if (position <= 0 && length >= sourceSize)
+            return sourceVal;
+        // We could call String::substringSharingImpl(), but this would result in redundant checks.
+        scope.release();
+        return jsString(exec, StringImpl::createSubstringSharingImpl(*source.impl(), std::max(0, position), std::min(sourceSize, length)));
+    }
+
+    Checked<int, RecordOverflow> totalLength = 0;
+    bool allSeparators8Bit = true;
+    for (int i = 0; i < rangeCount; i++)
+        totalLength += substringRanges[i].length;
+    for (int i = 0; i < separatorCount; i++) {
+        totalLength += separators[i].length();
+        if (separators[i].length() && !separators[i].is8Bit())
+            allSeparators8Bit = false;
+    }
+    if (totalLength.hasOverflowed())
+        return throwOutOfMemoryError(exec, scope);
+
+    if (!totalLength)
+        return jsEmptyString(exec);
+
+    if (source.is8Bit() && allSeparators8Bit) {
+        LChar* buffer;
+        const LChar* sourceData = source.characters8();
+
+        auto impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);
+        if (!impl)
+            return throwOutOfMemoryError(exec, scope);
+
+        int maxCount = std::max(rangeCount, separatorCount);
+        int bufferPos = 0;
+        for (int i = 0; i < maxCount; i++) {
+            if (i < rangeCount) {
+                if (int srcLen = substringRanges[i].length) {
+                    StringImpl::copyChars(buffer + bufferPos, sourceData + substringRanges[i].position, srcLen);
+                    bufferPos += srcLen;
+                }
+            }
+            if (i < separatorCount) {
+                if (int sepLen = separators[i].length()) {
+                    StringImpl::copyChars(buffer + bufferPos, separators[i].characters8(), sepLen);
+                    bufferPos += sepLen;
+                }
+            }
+        }        
+
+        scope.release();
+        return jsString(exec, WTFMove(impl));
+    }
+
+    UChar* buffer;
+    auto impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec, scope);
+
+    int maxCount = std::max(rangeCount, separatorCount);
+    int bufferPos = 0;
+    for (int i = 0; i < maxCount; i++) {
+        if (i < rangeCount) {
+            if (int srcLen = substringRanges[i].length) {
+                if (source.is8Bit())
+                    StringImpl::copyChars(buffer + bufferPos, source.characters8() + substringRanges[i].position, srcLen);
+                else
+                    StringImpl::copyChars(buffer + bufferPos, source.characters16() + substringRanges[i].position, srcLen);
+                bufferPos += srcLen;
+            }
+        }
+        if (i < separatorCount) {
+            if (int sepLen = separators[i].length()) {
+                if (separators[i].is8Bit())
+                    StringImpl::copyChars(buffer + bufferPos, separators[i].characters8(), sepLen);
+                else
+                    StringImpl::copyChars(buffer + bufferPos, separators[i].characters16(), sepLen);
+                bufferPos += sepLen;
+            }
+        }
+    }
+
+    scope.release();
+    return jsString(exec, WTFMove(impl));
+}
+
+#define OUT_OF_MEMORY(exec__, scope__) \
+    do { \
+        throwOutOfMemoryError(exec__, scope__); \
+        return encodedJSValue(); \
+    } while (false)
+
+static ALWAYS_INLINE EncodedJSValue removeUsingRegExpSearch(VM& vm, ExecState* exec, JSString* string, const String& source, RegExp* regExp)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    SuperSamplerScope superSamplerScope(false);
+    
+    size_t lastIndex = 0;
+    unsigned startPosition = 0;
+
+    Vector<StringRange, 16> sourceRanges;
+    RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
+    unsigned sourceLen = source.length();
+
+    while (true) {
+        MatchResult result = regExpConstructor->performMatch(vm, regExp, string, source, startPosition);
+        if (!result)
+            break;
+
+        if (lastIndex < result.start) {
+            if (UNLIKELY(!sourceRanges.tryConstructAndAppend(lastIndex, result.start - lastIndex)))
+                OUT_OF_MEMORY(exec, scope);
+        }
+        lastIndex = result.end;
+        startPosition = lastIndex;
+
+        // special case of empty match
+        if (result.empty()) {
+            startPosition++;
+            if (startPosition > sourceLen)
+                break;
+        }
+    }
+
+    if (!lastIndex)
+        return JSValue::encode(string);
+
+    if (static_cast<unsigned>(lastIndex) < sourceLen) {
+        if (UNLIKELY(!sourceRanges.tryConstructAndAppend(lastIndex, sourceLen - lastIndex)))
+            OUT_OF_MEMORY(exec, scope);
+    }
+    scope.release();
+    return JSValue::encode(jsSpliceSubstrings(exec, string, source, sourceRanges.data(), sourceRanges.size()));
+}
+
+static ALWAYS_INLINE EncodedJSValue replaceUsingRegExpSearch(
+    VM& vm, ExecState* exec, JSString* string, JSValue searchValue, CallData& callData,
+    CallType callType, String& replacementString, JSValue replaceValue)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    const String& source = string->value(exec);
+    unsigned sourceLen = source.length();
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    RegExpObject* regExpObject = asRegExpObject(searchValue);
+    RegExp* regExp = regExpObject->regExp();
+    bool global = regExp->global();
+
+    if (global) {
+        // ES5.1 15.5.4.10 step 8.a.
+        regExpObject->setLastIndex(exec, 0);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+        if (callType == CallType::None && !replacementString.length()) {
+            scope.release();
+            return removeUsingRegExpSearch(vm, exec, string, source, regExp);
+        }
+    }
+
+    // FIXME: This is wrong because we may be called directly from the FTL.
+    // https://bugs.webkit.org/show_bug.cgi?id=154874
+    RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
+
+    size_t lastIndex = 0;
+    unsigned startPosition = 0;
+
+    Vector<StringRange, 16> sourceRanges;
+    Vector<String, 16> replacements;
+
+    // This is either a loop (if global is set) or a one-way (if not).
+    if (global && callType == CallType::JS) {
+        // regExp->numSubpatterns() + 1 for pattern args, + 2 for match start and string
+        int argCount = regExp->numSubpatterns() + 1 + 2;
+        JSFunction* func = jsCast<JSFunction*>(replaceValue);
+        CachedCall cachedCall(exec, func, argCount);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (source.is8Bit()) {
+            while (true) {
+                int* ovector;
+                MatchResult result = regExpConstructor->performMatch(vm, regExp, string, source, startPosition, &ovector);
+                if (!result)
+                    break;
+
+                if (UNLIKELY(!sourceRanges.tryConstructAndAppend(lastIndex, result.start - lastIndex)))
+                    OUT_OF_MEMORY(exec, scope);
+
+                unsigned i = 0;
+                cachedCall.clearArguments();
+                for (; i < regExp->numSubpatterns() + 1; ++i) {
+                    int matchStart = ovector[i * 2];
+                    int matchLen = ovector[i * 2 + 1] - matchStart;
+
+                    if (matchStart < 0)
+                        cachedCall.appendArgument(jsUndefined());
+                    else
+                        cachedCall.appendArgument(jsSubstring(&vm, source, matchStart, matchLen));
+                }
+
+                cachedCall.appendArgument(jsNumber(result.start));
+                cachedCall.appendArgument(string);
+
+                cachedCall.setThis(jsUndefined());
+                JSValue jsResult = cachedCall.call();
+                replacements.append(jsResult.toWTFString(exec));
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+                lastIndex = result.end;
+                startPosition = lastIndex;
+
+                // special case of empty match
+                if (result.empty()) {
+                    startPosition++;
+                    if (startPosition > sourceLen)
+                        break;
+                }
+            }
+        } else {
+            while (true) {
+                int* ovector;
+                MatchResult result = regExpConstructor->performMatch(vm, regExp, string, source, startPosition, &ovector);
+                if (!result)
+                    break;
+
+                if (UNLIKELY(!sourceRanges.tryConstructAndAppend(lastIndex, result.start - lastIndex)))
+                    OUT_OF_MEMORY(exec, scope);
+
+                unsigned i = 0;
+                cachedCall.clearArguments();
+                for (; i < regExp->numSubpatterns() + 1; ++i) {
+                    int matchStart = ovector[i * 2];
+                    int matchLen = ovector[i * 2 + 1] - matchStart;
+
+                    if (matchStart < 0)
+                        cachedCall.appendArgument(jsUndefined());
+                    else
+                        cachedCall.appendArgument(jsSubstring(&vm, source, matchStart, matchLen));
+                }
+
+                cachedCall.appendArgument(jsNumber(result.start));
+                cachedCall.appendArgument(string);
+
+                cachedCall.setThis(jsUndefined());
+                JSValue jsResult = cachedCall.call();
+                replacements.append(jsResult.toWTFString(exec));
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+                lastIndex = result.end;
+                startPosition = lastIndex;
+
+                // special case of empty match
+                if (result.empty()) {
+                    startPosition++;
+                    if (startPosition > sourceLen)
+                        break;
+                }
+            }
+        }
+    } else {
+        do {
+            int* ovector;
+            MatchResult result = regExpConstructor->performMatch(vm, regExp, string, source, startPosition, &ovector);
+            if (!result)
+                break;
+
+            if (callType != CallType::None) {
+                if (UNLIKELY(!sourceRanges.tryConstructAndAppend(lastIndex, result.start - lastIndex)))
+                    OUT_OF_MEMORY(exec, scope);
+
+                MarkedArgumentBuffer args;
+
+                for (unsigned i = 0; i < regExp->numSubpatterns() + 1; ++i) {
+                    int matchStart = ovector[i * 2];
+                    int matchLen = ovector[i * 2 + 1] - matchStart;
+
+                    if (matchStart < 0)
+                        args.append(jsUndefined());
+                    else
+                        args.append(jsSubstring(exec, source, matchStart, matchLen));
+                }
+
+                args.append(jsNumber(result.start));
+                args.append(string);
+
+                JSValue replacement = call(exec, replaceValue, callType, callData, jsUndefined(), args);
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+                String replacementString = replacement.toWTFString(exec);
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+                replacements.append(replacementString);
+                RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            } else {
+                int replLen = replacementString.length();
+                if (lastIndex < result.start || replLen) {
+                    if (UNLIKELY(!sourceRanges.tryConstructAndAppend(lastIndex, result.start - lastIndex)))
+                        OUT_OF_MEMORY(exec, scope);
+
+                    if (replLen)
+                        replacements.append(substituteBackreferences(replacementString, source, ovector, regExp));
+                    else
+                        replacements.append(String());
+                }
+            }
+
+            lastIndex = result.end;
+            startPosition = lastIndex;
+
+            // special case of empty match
+            if (result.empty()) {
+                startPosition++;
+                if (startPosition > sourceLen)
+                    break;
+            }
+        } while (global);
+    }
+
+    if (!lastIndex && replacements.isEmpty())
+        return JSValue::encode(string);
+
+    if (static_cast<unsigned>(lastIndex) < sourceLen) {
+        if (UNLIKELY(!sourceRanges.tryConstructAndAppend(lastIndex, sourceLen - lastIndex)))
+            OUT_OF_MEMORY(exec, scope);
+    }
+    scope.release();
+    return JSValue::encode(jsSpliceSubstringsWithSeparators(exec, string, source, sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size()));
+}
+
+EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceRegExpEmptyStr(
+    ExecState* exec, JSString* thisValue, RegExpObject* searchValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    RegExp* regExp = searchValue->regExp();
+    if (regExp->global()) {
+        // ES5.1 15.5.4.10 step 8.a.
+        searchValue->setLastIndex(exec, 0);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        scope.release();
+        return removeUsingRegExpSearch(vm, exec, thisValue, thisValue->value(exec), regExp);
+    }
+
+    CallData callData;
+    String replacementString = emptyString();
+    scope.release();
+    return replaceUsingRegExpSearch(
+        vm, exec, thisValue, searchValue, callData, CallType::None, replacementString, JSValue());
+}
+
+EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceRegExpString(
+    ExecState* exec, JSString* thisValue, RegExpObject* searchValue, JSString* replaceString)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    CallData callData;
+    String replacementString = replaceString->value(exec);
+    return replaceUsingRegExpSearch(
+        vm, exec, thisValue, searchValue, callData, CallType::None, replacementString, replaceString);
+}
+
+static ALWAYS_INLINE EncodedJSValue replaceUsingRegExpSearch(VM& vm, ExecState* exec, JSString* string, JSValue searchValue, JSValue replaceValue)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    String replacementString;
+    CallData callData;
+    CallType callType = getCallData(replaceValue, callData);
+    if (callType == CallType::None) {
+        replacementString = replaceValue.toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    scope.release();
+    return replaceUsingRegExpSearch(
+        vm, exec, string, searchValue, callData, callType, replacementString, replaceValue);
+}
+
+static ALWAYS_INLINE EncodedJSValue replaceUsingStringSearch(VM& vm, ExecState* exec, JSString* jsString, JSValue searchValue, JSValue replaceValue)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    const String& string = jsString->value(exec);
+    String searchString = searchValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    size_t matchStart = string.find(searchString);
+
+    if (matchStart == notFound)
+        return JSValue::encode(jsString);
+
+    CallData callData;
+    CallType callType = getCallData(replaceValue, callData);
+    if (callType != CallType::None) {
+        MarkedArgumentBuffer args;
+        args.append(jsSubstring(exec, string, matchStart, searchString.impl()->length()));
+        args.append(jsNumber(matchStart));
+        args.append(jsString);
+        replaceValue = call(exec, replaceValue, callType, callData, jsUndefined(), args);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    String replaceString = replaceValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    StringImpl* stringImpl = string.impl();
+    String leftPart(StringImpl::createSubstringSharingImpl(*stringImpl, 0, matchStart));
+
+    size_t matchEnd = matchStart + searchString.impl()->length();
+    int ovector[2] = { static_cast<int>(matchStart),  static_cast<int>(matchEnd)};
+    String middlePart = substituteBackreferences(replaceString, string, ovector, 0);
+
+    size_t leftLength = stringImpl->length() - matchEnd;
+    String rightPart(StringImpl::createSubstringSharingImpl(*stringImpl, matchEnd, leftLength));
+    scope.release();
+    return JSValue::encode(JSC::jsString(exec, leftPart, middlePart, rightPart));
+}
+
+static inline bool checkObjectCoercible(JSValue thisValue)
+{
+    if (thisValue.isString())
+        return true;
+
+    if (thisValue.isUndefinedOrNull())
+        return false;
+
+    if (thisValue.isObject() && asObject(thisValue)->isEnvironmentRecord())
+        return false;
+
+    return true;
+}
+
+template <typename CharacterType>
+static inline JSString* repeatCharacter(ExecState& exec, CharacterType character, unsigned repeatCount)
+{
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    CharacterType* buffer = nullptr;
+    auto impl = StringImpl::tryCreateUninitialized(repeatCount, buffer);
+    if (!impl) {
+        throwOutOfMemoryError(&exec, scope);
+        return nullptr;
+    }
+
+    std::fill_n(buffer, repeatCount, character);
+
+    scope.release();
+    return jsString(&exec, WTFMove(impl));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncRepeatCharacter(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // For a string which length is single, instead of creating ropes,
+    // allocating a sequential buffer and fill with the repeated string for efficiency.
+    ASSERT(exec->argumentCount() == 2);
+
+    ASSERT(exec->uncheckedArgument(0).isString());
+    JSString* string = asString(exec->uncheckedArgument(0));
+    ASSERT(string->length() == 1);
+
+    JSValue repeatCountValue = exec->uncheckedArgument(1);
+    RELEASE_ASSERT(repeatCountValue.isNumber());
+    int32_t repeatCount;
+    double value = repeatCountValue.asNumber();
+    if (value > JSString::MaxLength)
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
+    repeatCount = static_cast<int32_t>(value);
+    ASSERT(repeatCount >= 0);
+    ASSERT(!repeatCountValue.isDouble() || repeatCountValue.asDouble() == repeatCount);
+
+    auto viewWithString = string->viewWithUnderlyingString(*exec);
+    StringView view = viewWithString.view;
+    ASSERT(view.length() == 1 && !scope.exception());
+    UChar character = view[0];
+    scope.release();
+    if (!(character & ~0xff))
+        return JSValue::encode(repeatCharacter(*exec, static_cast<LChar>(character), repeatCount));
+    return JSValue::encode(repeatCharacter(*exec, character, repeatCount));
+}
+
+ALWAYS_INLINE EncodedJSValue replace(
+    VM& vm, ExecState* exec, JSString* string, JSValue searchValue, JSValue replaceValue)
+{
+    if (searchValue.inherits(RegExpObject::info()))
+        return replaceUsingRegExpSearch(vm, exec, string, searchValue, replaceValue);
+    return replaceUsingStringSearch(vm, exec, string, searchValue, replaceValue);
+}
+
+ALWAYS_INLINE EncodedJSValue replace(
+    VM& vm, ExecState* exec, JSValue thisValue, JSValue searchValue, JSValue replaceValue)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    JSString* string = thisValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return replace(vm, exec, string, searchValue, replaceValue);
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncReplaceUsingRegExp(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSString* string = exec->thisValue().toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue searchValue = exec->argument(0);
+    if (!searchValue.inherits(RegExpObject::info()))
+        return JSValue::encode(jsUndefined());
+
+    scope.release();
+    return replaceUsingRegExpSearch(vm, exec, string, searchValue, exec->argument(1));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncReplaceUsingStringSearch(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSString* string = exec->thisValue().toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    scope.release();
+    return replaceUsingStringSearch(vm, exec, string, exec->argument(0), exec->argument(1));
+}
+
+EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceGeneric(
+    ExecState* exec, EncodedJSValue thisValue, EncodedJSValue searchValue,
+    EncodedJSValue replaceValue)
+{
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
+    
+    return replace(
+        vm, exec, JSValue::decode(thisValue), JSValue::decode(searchValue),
+        JSValue::decode(replaceValue));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    // Also used for valueOf.
+
+    if (thisValue.isString())
+        return JSValue::encode(thisValue);
+
+    if (thisValue.inherits(StringObject::info()))
+        return JSValue::encode(asStringObject(thisValue)->internalValue());
+
+    return throwVMTypeError(exec, scope);
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    auto viewWithString = thisValue.toString(exec)->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    StringView view = viewWithString.view;
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSValue a0 = exec->argument(0);
+    if (a0.isUInt32()) {
+        uint32_t i = a0.asUInt32();
+        if (i < view.length())
+            return JSValue::encode(jsSingleCharacterString(exec, view[i]));
+        return JSValue::encode(jsEmptyString(exec));
+    }
+    double dpos = a0.toInteger(exec);
+    if (dpos >= 0 && dpos < view.length())
+        return JSValue::encode(jsSingleCharacterString(exec, view[static_cast<unsigned>(dpos)]));
+    return JSValue::encode(jsEmptyString(exec));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    auto viewWithString = thisValue.toString(exec)->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    StringView view = viewWithString.view;
+    JSValue a0 = exec->argument(0);
+    if (a0.isUInt32()) {
+        uint32_t i = a0.asUInt32();
+        if (i < view.length())
+            return JSValue::encode(jsNumber(view[i]));
+        return JSValue::encode(jsNaN());
+    }
+    double dpos = a0.toInteger(exec);
+    if (dpos >= 0 && dpos < view.length())
+        return JSValue::encode(jsNumber(view[static_cast<int>(dpos)]));
+    return JSValue::encode(jsNaN());
+}
+
+static inline UChar32 codePointAt(const String& string, unsigned position, unsigned length)
+{
+    RELEASE_ASSERT(position < length);
+    if (string.is8Bit())
+        return string.characters8()[position];
+    UChar32 character;
+    U16_NEXT(string.characters16(), position, length, character);
+    return character;
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncCodePointAt(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+
+    String string = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    unsigned length = string.length();
+
+    JSValue argument0 = exec->argument(0);
+    if (argument0.isUInt32()) {
+        unsigned position = argument0.asUInt32();
+        if (position < length)
+            return JSValue::encode(jsNumber(codePointAt(string, position, length)));
+        return JSValue::encode(jsUndefined());
+    }
+
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    double doublePosition = argument0.toInteger(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (doublePosition >= 0 && doublePosition < length)
+        return JSValue::encode(jsNumber(codePointAt(string, static_cast<unsigned>(doublePosition), length)));
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (thisValue.isString() && exec->argumentCount() == 1) {
+        JSString* str = exec->uncheckedArgument(0).toString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        scope.release();
+        return JSValue::encode(jsString(exec, asString(thisValue), str));
+    }
+
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    scope.release();
+    return JSValue::encode(jsStringFromArguments(exec, thisValue));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+
+    JSValue a0 = exec->argument(0);
+    JSValue a1 = exec->argument(1);
+
+    JSString* thisJSString = thisValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSString* otherJSString = a0.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    unsigned pos = 0;
+    if (!a1.isUndefined()) {
+        int len = thisJSString->length();
+        RELEASE_ASSERT(len >= 0);
+        if (a1.isUInt32())
+            pos = std::min<uint32_t>(a1.asUInt32(), len);
+        else {
+            double dpos = a1.toInteger(exec);
+            if (dpos < 0)
+                dpos = 0;
+            else if (dpos > len)
+                dpos = len;
+            pos = static_cast<unsigned>(dpos);
+        }
+    }
+
+    if (thisJSString->length() < otherJSString->length() + pos)
+        return JSValue::encode(jsNumber(-1));
+
+    auto thisViewWithString = thisJSString->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    auto otherViewWithString = otherJSString->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    size_t result = thisViewWithString.view.find(otherViewWithString.view, pos);
+    if (result == notFound)
+        return JSValue::encode(jsNumber(-1));
+    return JSValue::encode(jsNumber(result));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+
+    JSValue a0 = exec->argument(0);
+    JSValue a1 = exec->argument(1);
+
+    JSString* thisJSString = thisValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    unsigned len = thisJSString->length();
+    JSString* otherJSString = a0.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    double dpos = a1.toIntegerPreserveNaN(exec);
+    unsigned startPosition;
+    if (dpos < 0)
+        startPosition = 0;
+    else if (!(dpos <= len)) // true for NaN
+        startPosition = len;
+    else
+        startPosition = static_cast<unsigned>(dpos);
+
+    if (len < otherJSString->length())
+        return JSValue::encode(jsNumber(-1));
+
+    String thisString = thisJSString->value(exec);
+    String otherString = otherJSString->value(exec);
+    size_t result;
+    if (!startPosition)
+        result = thisString.startsWith(otherString) ? 0 : notFound;
+    else
+        result = thisString.reverseFind(otherString, startPosition);
+    if (result == notFound)
+        return JSValue::encode(jsNumber(-1));
+    return JSValue::encode(jsNumber(result));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    int len = s.length();
+    RELEASE_ASSERT(len >= 0);
+
+    JSValue a0 = exec->argument(0);
+    JSValue a1 = exec->argument(1);
+
+    // The arg processing is very much like ArrayProtoFunc::Slice
+    double start = a0.toInteger(exec);
+    double end = a1.isUndefined() ? len : a1.toInteger(exec);
+    double from = start < 0 ? len + start : start;
+    double to = end < 0 ? len + end : end;
+    if (to > from && to > 0 && from < len) {
+        if (from < 0)
+            from = 0;
+        if (to > len)
+            to = len;
+        return JSValue::encode(jsSubstring(exec, s, static_cast<unsigned>(from), static_cast<unsigned>(to) - static_cast<unsigned>(from)));
+    }
+
+    return JSValue::encode(jsEmptyString(exec));
+}
+
+// Return true in case of early return (resultLength got to limitLength).
+template<typename CharacterType>
+static ALWAYS_INLINE bool splitStringByOneCharacterImpl(ExecState* exec, JSArray* result, JSValue originalValue, const String& input, StringImpl* string, UChar separatorCharacter, size_t& position, unsigned& resultLength, unsigned limitLength)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 12. Let q = p.
+    size_t matchPosition;
+    const CharacterType* characters = string->characters<CharacterType>();
+    // 13. Repeat, while q != s
+    //   a. Call SplitMatch(S, q, R) and let z be its MatchResult result.
+    //   b. If z is failure, then let q = q+1.
+    //   c. Else, z is not failure
+    while ((matchPosition = WTF::find(characters, string->length(), separatorCharacter, position)) != notFound) {
+        // 1. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
+        //    through q (exclusive).
+        // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
+        //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
+        result->putDirectIndex(exec, resultLength, jsSubstring(exec, originalValue, input, position, matchPosition - position));
+        RETURN_IF_EXCEPTION(scope, false);
+        // 3. Increment lengthA by 1.
+        // 4. If lengthA == lim, return A.
+        if (++resultLength == limitLength)
+            return true;
+
+        // 5. Let p = e.
+        // 8. Let q = p.
+        position = matchPosition + 1;
+    }
+    return false;
+}
+
+// ES 21.1.3.17 String.prototype.split(separator, limit)
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSplitFast(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue thisValue = exec->thisValue();
+    ASSERT(checkObjectCoercible(thisValue));
+
+    // 3. Let S be the result of calling ToString, giving it the this value as its argument.
+    // 7. Let s be the number of characters in S.
+    String input = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    ASSERT(!input.isNull());
+
+    // 4. Let A be a new array created as if by the expression new Array()
+    //    where Array is the standard built-in constructor with that name.
+    JSArray* result = constructEmptyArray(exec, 0);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 5. Let lengthA be 0.
+    unsigned resultLength = 0;
+
+    // 6. If limit is undefined, let lim = 2^32-1; else let lim = ToUint32(limit).
+    JSValue limitValue = exec->uncheckedArgument(1);
+    unsigned limit = limitValue.isUndefined() ? 0xFFFFFFFFu : limitValue.toUInt32(exec);
+
+    // 8. Let p = 0.
+    size_t position = 0;
+
+    // 9. If separator is a RegExp object (its [[Class]] is "RegExp"), let R = separator;
+    //    otherwise let R = ToString(separator).
+    JSValue separatorValue = exec->uncheckedArgument(0);
+    String separator = separatorValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 10. If lim == 0, return A.
+    if (!limit)
+        return JSValue::encode(result);
+
+    // 11. If separator is undefined, then
+    if (separatorValue.isUndefined()) {
+        // a. Call the [[DefineOwnProperty]] internal method of A with arguments "0",
+        scope.release();
+        result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
+        // b. Return A.
+        return JSValue::encode(result);
+    }
+
+    // 12. If s == 0, then
+    if (input.isEmpty()) {
+        // a. Let z be SplitMatch(S, 0, R) where S is input, R is separator.
+        // b. If z is not false, return A.
+        // c. Call CreateDataProperty(A, "0", S).
+        // d. Return A.
+        if (!separator.isEmpty()) {
+            scope.release();
+            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
+        }
+        return JSValue::encode(result);
+    }
+
+    // Optimized case for splitting on the empty string.
+    if (separator.isEmpty()) {
+        limit = std::min(limit, input.length());
+        // Zero limt/input length handled in steps 9/11 respectively, above.
+        ASSERT(limit);
+
+        do {
+            result->putDirectIndex(exec, position, jsSingleCharacterString(exec, input[position]));
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        } while (++position < limit);
+
+        return JSValue::encode(result);
+    }
+
+    // 3 cases:
+    // -separator length == 1, 8 bits
+    // -separator length == 1, 16 bits
+    // -separator length > 1
+    StringImpl* stringImpl = input.impl();
+    StringImpl* separatorImpl = separator.impl();
+    size_t separatorLength = separatorImpl->length();
+
+    if (separatorLength == 1) {
+        UChar separatorCharacter;
+        if (separatorImpl->is8Bit())
+            separatorCharacter = separatorImpl->characters8()[0];
+        else
+            separatorCharacter = separatorImpl->characters16()[0];
+
+        if (stringImpl->is8Bit()) {
+            if (splitStringByOneCharacterImpl<LChar>(exec, result, thisValue, input, stringImpl, separatorCharacter, position, resultLength, limit)) {
+                scope.release();
+                return JSValue::encode(result);
+            }
+        } else {
+            if (splitStringByOneCharacterImpl<UChar>(exec, result, thisValue, input, stringImpl, separatorCharacter, position, resultLength, limit)) {
+                scope.release();
+                return JSValue::encode(result);
+            }
+        }
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    } else {
+        // 13. Let q = p.
+        size_t matchPosition;
+        // 14. Repeat, while q != s
+        //   a. let e be SplitMatch(S, q, R).
+        //   b. If e is failure, then let q = q+1.
+        //   c. Else, e is an integer index <= s.
+        while ((matchPosition = stringImpl->find(separatorImpl, position)) != notFound) {
+            // 1. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
+            //    through q (exclusive).
+            // 2. Call CreateDataProperty(A, ToString(lengthA), T).
+            result->putDirectIndex(exec, resultLength, jsSubstring(exec, thisValue, input, position, matchPosition - position));
+            RETURN_IF_EXCEPTION(scope, encodedJSValue());
+            // 3. Increment lengthA by 1.
+            // 4. If lengthA == lim, return A.
+            if (++resultLength == limit)
+                return JSValue::encode(result);
+
+            // 5. Let p = e.
+            // 6. Let q = p.
+            position = matchPosition + separator.length();
+        }
+    }
+
+    // 15. Let T be a String value equal to the substring of S consisting of the characters at positions p (inclusive)
+    //     through s (exclusive).
+    // 16. Call CreateDataProperty(A, ToString(lengthA), T).
+    scope.release();
+    result->putDirectIndex(exec, resultLength++, jsSubstring(exec, thisValue, input, position, input.length() - position));
+
+    // 17. Return A.
+    return JSValue::encode(result);
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    unsigned len;
+    JSString* jsString = 0;
+    String uString;
+    if (thisValue.isString()) {
+        jsString = asString(thisValue);
+        len = jsString->length();
+    } else {
+        uString = thisValue.toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        len = uString.length();
+    }
+
+    JSValue a0 = exec->argument(0);
+    JSValue a1 = exec->argument(1);
+
+    double start = a0.toInteger(exec);
+    double length = a1.isUndefined() ? len : a1.toInteger(exec);
+    if (start >= len || length <= 0)
+        return JSValue::encode(jsEmptyString(exec));
+    if (start < 0) {
+        start += len;
+        if (start < 0)
+            start = 0;
+    }
+    if (start + length > len)
+        length = len - start;
+    unsigned substringStart = static_cast<unsigned>(start);
+    unsigned substringLength = static_cast<unsigned>(length);
+    if (jsString)
+        return JSValue::encode(jsSubstring(exec, jsString, substringStart, substringLength));
+    return JSValue::encode(jsSubstring(exec, uString, substringStart, substringLength));
+}
+
+EncodedJSValue JSC_HOST_CALL builtinStringSubstrInternal(ExecState* exec)
+{
+    // @substrInternal should not have any observable side effects (e.g. it should not call
+    // GetMethod(..., @@toPrimitive) on the thisValue).
+
+    // It is ok to use the default stringProtoFuncSubstr as the implementation of
+    // @substrInternal because @substrInternal will only be called by builtins, which will
+    // guarantee that we only pass it a string thisValue. As a result, stringProtoFuncSubstr
+    // will not need to call toString() on the thisValue, and there will be no observable
+    // side-effects.
+    ASSERT(exec->thisValue().isString());
+    return stringProtoFuncSubstr(exec);
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+
+    JSString* jsString = thisValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+    JSValue a1 = exec->argument(1);
+    int len = jsString->length();
+    RELEASE_ASSERT(len >= 0);
+
+    double start = a0.toNumber(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    double end;
+    if (!(start >= 0)) // check for negative values or NaN
+        start = 0;
+    else if (start > len)
+        start = len;
+    if (a1.isUndefined())
+        end = len;
+    else { 
+        end = a1.toNumber(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        if (!(end >= 0)) // check for negative values or NaN
+            end = 0;
+        else if (end > len)
+            end = len;
+    }
+    if (start > end) {
+        double temp = end;
+        end = start;
+        start = temp;
+    }
+    unsigned substringStart = static_cast<unsigned>(start);
+    unsigned substringLength = static_cast<unsigned>(end) - substringStart;
+    return JSValue::encode(jsSubstring(exec, jsString, substringStart, substringLength));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    JSString* sVal = thisValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    const String& s = sVal->value(exec);
+    String lowercasedString = s.convertToLowercaseWithoutLocale();
+    if (lowercasedString.impl() == s.impl())
+        return JSValue::encode(sVal);
+    scope.release();
+    return JSValue::encode(jsString(exec, lowercasedString));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    JSString* sVal = thisValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    const String& s = sVal->value(exec);
+    String uppercasedString = s.convertToUppercaseWithoutLocale();
+    if (uppercasedString.impl() == s.impl())
+        return JSValue::encode(sVal);
+    scope.release();
+    return JSValue::encode(jsString(exec, uppercasedString));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+    String str = a0.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(jsNumber(Collator().collate(s, str)));
+}
+
+#if ENABLE(INTL)
+static EncodedJSValue toLocaleCase(ExecState* state, int32_t (*convertCase)(UChar*, int32_t, const UChar*, int32_t, const char*, UErrorCode*))
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    // 1. Let O be RequireObjectCoercible(this value).
+    JSValue thisValue = state->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(state, scope);
+
+    // 2. Let S be ToString(O).
+    JSString* sVal = thisValue.toString(state);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    const String& s = sVal->value(state);
+
+    // 3. ReturnIfAbrupt(S).
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // Optimization for empty strings.
+    if (s.isEmpty())
+        return JSValue::encode(sVal);
+
+    // 4. Let requestedLocales be CanonicalizeLocaleList(locales).
+    Vector<String> requestedLocales = canonicalizeLocaleList(*state, state->argument(0));
+
+    // 5. ReturnIfAbrupt(requestedLocales).
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    // 6. Let len be the number of elements in requestedLocales.
+    size_t len = requestedLocales.size();
+
+    // 7. If len > 0, then
+    // a. Let requestedLocale be the first element of requestedLocales.
+    // 8. Else
+    // a. Let requestedLocale be DefaultLocale().
+    String requestedLocale = len > 0 ? requestedLocales.first() : defaultLocale(*state);
+
+    // 9. Let noExtensionsLocale be the String value that is requestedLocale with all Unicode locale extension sequences (6.2.1) removed.
+    String noExtensionsLocale = removeUnicodeLocaleExtension(requestedLocale);
+
+    // 10. Let availableLocales be a List with the language tags of the languages for which the Unicode character database contains language sensitive case mappings.
+    // Note 1: As of Unicode 5.1, the availableLocales list contains the elements "az", "lt", and "tr".
+    const HashSet<String> availableLocales({ ASCIILiteral("az"), ASCIILiteral("lt"), ASCIILiteral("tr") });
+
+    // 11. Let locale be BestAvailableLocale(availableLocales, noExtensionsLocale).
+    String locale = bestAvailableLocale(availableLocales, noExtensionsLocale);
+
+    // 12. If locale is undefined, let locale be "und".
+    if (locale.isNull())
+        locale = ASCIILiteral("und");
+
+    CString utf8LocaleBuffer = locale.utf8();
+    const StringView view(s);
+    const int32_t viewLength = view.length();
+
+    // Delegate the following steps to icu u_strToLower or u_strToUpper.
+    // 13. Let cpList be a List containing in order the code points of S as defined in ES2015, 6.1.4, starting at the first element of S.
+    // 14. For each code point c in cpList, if the Unicode Character Database provides a lower(/upper) case equivalent of c that is either language insensitive or for the language locale, then replace c in cpList with that/those equivalent code point(s).
+    // 15. Let cuList be a new List.
+    // 16. For each code point c in cpList, in order, append to cuList the elements of the UTF-16 Encoding (defined in ES2015, 6.1.4) of c.
+    // 17. Let L be a String whose elements are, in order, the elements of cuList.
+
+    // Most strings lower/upper case will be the same size as original, so try that first.
+    UErrorCode error(U_ZERO_ERROR);
+    Vector<UChar> buffer(viewLength);
+    String lower;
+    const int32_t resultLength = convertCase(buffer.data(), viewLength, view.upconvertedCharacters(), viewLength, utf8LocaleBuffer.data(), &error);
+    if (U_SUCCESS(error))
+        lower = String(buffer.data(), resultLength);
+    else if (error == U_BUFFER_OVERFLOW_ERROR) {
+        // Converted case needs more space than original. Try again.
+        UErrorCode error(U_ZERO_ERROR);
+        Vector<UChar> buffer(resultLength);
+        convertCase(buffer.data(), resultLength, view.upconvertedCharacters(), viewLength, utf8LocaleBuffer.data(), &error);
+        if (U_FAILURE(error))
+            return throwVMTypeError(state, scope, u_errorName(error));
+        lower = String(buffer.data(), resultLength);
+    } else
+        return throwVMTypeError(state, scope, u_errorName(error));
+
+    // 18. Return L.
+    scope.release();
+    return JSValue::encode(jsString(state, lower));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToLocaleLowerCase(ExecState* state)
+{
+    // 13.1.2 String.prototype.toLocaleLowerCase ([locales])
+    // http://ecma-international.org/publications/standards/Ecma-402.htm
+    return toLocaleCase(state, u_strToLower);
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncToLocaleUpperCase(ExecState* state)
+{
+    // 13.1.3 String.prototype.toLocaleUpperCase ([locales])
+    // http://ecma-international.org/publications/standards/Ecma-402.htm
+    // This function interprets a string value as a sequence of code points, as described in ES2015, 6.1.4. This function behaves in exactly the same way as String.prototype.toLocaleLowerCase, except that characters are mapped to their uppercase equivalents as specified in the Unicode character database.
+    return toLocaleCase(state, u_strToUpper);
+}
+#endif // ENABLE(INTL)
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<big>", s, "</big>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<small>", s, "</small>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<blink>", s, "</blink>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<b>", s, "</b>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<tt>", s, "</tt>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<i>", s, "</i>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<strike>", s, "</strike>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<sub>", s, "</sub>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<sup>", s, "</sup>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+    String color = a0.toWTFString(exec);
+    color.replaceWithLiteral('"', "&quot;");
+
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<font color=\"", color, "\">", s, "</font>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+
+    uint32_t smallInteger;
+    if (a0.getUInt32(smallInteger) && smallInteger <= 9) {
+        unsigned stringSize = s.length();
+        unsigned bufferSize = 22 + stringSize;
+        // FIXME: Should we have an 8-bit version of this code path too? Or maybe only an 8-bit version?
+        UChar* buffer;
+        auto impl = StringImpl::tryCreateUninitialized(bufferSize, buffer);
+        if (!impl)
+            return JSValue::encode(jsUndefined());
+        buffer[0] = '<';
+        buffer[1] = 'f';
+        buffer[2] = 'o';
+        buffer[3] = 'n';
+        buffer[4] = 't';
+        buffer[5] = ' ';
+        buffer[6] = 's';
+        buffer[7] = 'i';
+        buffer[8] = 'z';
+        buffer[9] = 'e';
+        buffer[10] = '=';
+        buffer[11] = '"';
+        buffer[12] = '0' + smallInteger;
+        buffer[13] = '"';
+        buffer[14] = '>';
+        StringView(s).getCharactersWithUpconvert(&buffer[15]);
+        buffer[15 + stringSize] = '<';
+        buffer[16 + stringSize] = '/';
+        buffer[17 + stringSize] = 'f';
+        buffer[18 + stringSize] = 'o';
+        buffer[19 + stringSize] = 'n';
+        buffer[20 + stringSize] = 't';
+        buffer[21 + stringSize] = '>';
+        return JSValue::encode(jsNontrivialString(exec, WTFMove(impl)));
+    }
+
+    String fontSize = a0.toWTFString(exec);
+    fontSize.replaceWithLiteral('"', "&quot;");
+
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<font size=\"", fontSize, "\">", s, "</font>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+    String anchor = a0.toWTFString(exec);
+    anchor.replaceWithLiteral('"', "&quot;");
+
+    scope.release();
+    return JSValue::encode(jsMakeNontrivialString(exec, "<a name=\"", anchor, "\">", s, "</a>"));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    String s = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+    String linkText = a0.toWTFString(exec);
+    linkText.replaceWithLiteral('"', "&quot;");
+
+    unsigned linkTextSize = linkText.length();
+    unsigned stringSize = s.length();
+    unsigned bufferSize = 15 + linkTextSize + stringSize;
+    // FIXME: Should we have an 8-bit version of this code path too? Or maybe only an 8-bit version?
+    UChar* buffer;
+    auto impl = StringImpl::tryCreateUninitialized(bufferSize, buffer);
+    if (!impl)
+        return JSValue::encode(jsUndefined());
+    buffer[0] = '<';
+    buffer[1] = 'a';
+    buffer[2] = ' ';
+    buffer[3] = 'h';
+    buffer[4] = 'r';
+    buffer[5] = 'e';
+    buffer[6] = 'f';
+    buffer[7] = '=';
+    buffer[8] = '"';
+    StringView(linkText).getCharactersWithUpconvert(&buffer[9]);
+    buffer[9 + linkTextSize] = '"';
+    buffer[10 + linkTextSize] = '>';
+    StringView(s).getCharactersWithUpconvert(&buffer[11 + linkTextSize]);
+    buffer[11 + linkTextSize + stringSize] = '<';
+    buffer[12 + linkTextSize + stringSize] = '/';
+    buffer[13 + linkTextSize + stringSize] = 'a';
+    buffer[14 + linkTextSize + stringSize] = '>';
+    return JSValue::encode(jsNontrivialString(exec, WTFMove(impl)));
+}
+
+enum {
+    TrimLeft = 1,
+    TrimRight = 2
+};
+
+static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!checkObjectCoercible(thisValue))
+        return throwTypeError(exec, scope);
+    String str = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, { });
+
+    unsigned left = 0;
+    if (trimKind & TrimLeft) {
+        while (left < str.length() && isStrWhiteSpace(str[left]))
+            left++;
+    }
+    unsigned right = str.length();
+    if (trimKind & TrimRight) {
+        while (right > left && isStrWhiteSpace(str[right - 1]))
+            right--;
+    }
+
+    // Don't gc allocate a new string if we don't have to.
+    if (left == 0 && right == str.length() && thisValue.isString())
+        return thisValue;
+
+    scope.release();
+    return jsString(exec, str.substringSharingImpl(left, right - left));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncTrim(ExecState* exec)
+{
+    JSValue thisValue = exec->thisValue();
+    return JSValue::encode(trimString(exec, thisValue, TrimLeft | TrimRight));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncTrimLeft(ExecState* exec)
+{
+    JSValue thisValue = exec->thisValue();
+    return JSValue::encode(trimString(exec, thisValue, TrimLeft));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState* exec)
+{
+    JSValue thisValue = exec->thisValue();
+    return JSValue::encode(trimString(exec, thisValue, TrimRight));
+}
+
+static inline unsigned clampAndTruncateToUnsigned(double value, unsigned min, unsigned max)
+{
+    if (value < min)
+        return min;
+    if (value > max)
+        return max;
+    return static_cast<unsigned>(value);
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncStartsWith(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+
+    String stringToSearchIn = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+    bool isRegularExpression = isRegExp(vm, exec, a0);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (isRegularExpression)
+        return throwVMTypeError(exec, scope, "Argument to String.prototype.startsWith cannot be a RegExp");
+
+    String searchString = a0.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue positionArg = exec->argument(1);
+    unsigned start = 0;
+    if (positionArg.isInt32())
+        start = std::max(0, positionArg.asInt32());
+    else {
+        unsigned length = stringToSearchIn.length();
+        start = clampAndTruncateToUnsigned(positionArg.toInteger(exec), 0, length);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    return JSValue::encode(jsBoolean(stringToSearchIn.hasInfixStartingAt(searchString, start)));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncEndsWith(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+
+    String stringToSearchIn = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+    bool isRegularExpression = isRegExp(vm, exec, a0);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (isRegularExpression)
+        return throwVMTypeError(exec, scope, "Argument to String.prototype.endsWith cannot be a RegExp");
+
+    String searchString = a0.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    unsigned length = stringToSearchIn.length();
+
+    JSValue endPositionArg = exec->argument(1);
+    unsigned end = length;
+    if (endPositionArg.isInt32())
+        end = std::max(0, endPositionArg.asInt32());
+    else if (!endPositionArg.isUndefined()) {
+        end = clampAndTruncateToUnsigned(endPositionArg.toInteger(exec), 0, length);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    return JSValue::encode(jsBoolean(stringToSearchIn.hasInfixEndingAt(searchString, std::min(end, length))));
+}
+
+static EncodedJSValue JSC_HOST_CALL stringIncludesImpl(VM& vm, ExecState* exec, String stringToSearchIn, String searchString, JSValue positionArg)
+{
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    unsigned start = 0;
+    if (positionArg.isInt32())
+        start = std::max(0, positionArg.asInt32());
+    else {
+        unsigned length = stringToSearchIn.length();
+        start = clampAndTruncateToUnsigned(positionArg.toInteger(exec), 0, length);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
+    return JSValue::encode(jsBoolean(stringToSearchIn.contains(searchString, true, start)));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncIncludes(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+
+    String stringToSearchIn = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->argument(0);
+    bool isRegularExpression = isRegExp(vm, exec, a0);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    if (isRegularExpression)
+        return throwVMTypeError(exec, scope, "Argument to String.prototype.includes cannot be a RegExp");
+
+    String searchString = a0.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue positionArg = exec->argument(1);
+
+    scope.release();
+    return stringIncludesImpl(vm, exec, stringToSearchIn, searchString, positionArg);
+}
+
+EncodedJSValue JSC_HOST_CALL builtinStringIncludesInternal(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    ASSERT(checkObjectCoercible(thisValue));
+
+    String stringToSearchIn = thisValue.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue a0 = exec->uncheckedArgument(0);
+    String searchString = a0.toWTFString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    JSValue positionArg = exec->argument(1);
+
+    scope.release();
+    return stringIncludesImpl(vm, exec, stringToSearchIn, searchString, positionArg);
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncIterator(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    JSString* string = thisValue.toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    return JSValue::encode(JSStringIterator::create(exec, exec->jsCallee()->globalObject()->stringIteratorStructure(), string));
+}
+
+static JSValue normalize(ExecState* exec, const UChar* source, size_t sourceLength, UNormalizationMode form)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    UErrorCode status = U_ZERO_ERROR;
+    int32_t normalizedStringLength = unorm_normalize(source, sourceLength, form, 0, nullptr, 0, &status);
+
+    if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR) {
+        // The behavior is not specified when normalize fails.
+        // Now we throw a type erorr since it seems that the contents of the string are invalid.
+        return throwTypeError(exec, scope);
+    }
+
+    UChar* buffer = nullptr;
+    auto impl = StringImpl::tryCreateUninitialized(normalizedStringLength, buffer);
+    if (!impl)
+        return throwOutOfMemoryError(exec, scope);
+
+    status = U_ZERO_ERROR;
+    unorm_normalize(source, sourceLength, form, 0, buffer, normalizedStringLength, &status);
+    if (U_FAILURE(status))
+        return throwTypeError(exec, scope);
+
+    scope.release();
+    return jsString(exec, WTFMove(impl));
+}
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncNormalize(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (!checkObjectCoercible(thisValue))
+        return throwVMTypeError(exec, scope);
+    auto viewWithString = thisValue.toString(exec)->viewWithUnderlyingString(*exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    StringView view = viewWithString.view;
+
+    UNormalizationMode form = UNORM_NFC;
+    // Verify that the argument is provided and is not undefined.
+    if (!exec->argument(0).isUndefined()) {
+        String formString = exec->uncheckedArgument(0).toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+        if (formString == "NFC")
+            form = UNORM_NFC;
+        else if (formString == "NFD")
+            form = UNORM_NFD;
+        else if (formString == "NFKC")
+            form = UNORM_NFKC;
+        else if (formString == "NFKD")
+            form = UNORM_NFKD;
+        else
+            return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("argument does not match any normalization form")));
+    }
+
+    scope.release();
+    return JSValue::encode(normalize(exec, view.upconvertedCharacters(), view.length(), form));
+}
+
+} // namespace JSC
diff --git a/runtime/StringPrototype.h b/runtime/StringPrototype.h
new file mode 100644
index 0000000..88a1d02
--- /dev/null
+++ b/runtime/StringPrototype.h
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007-2008, 2013, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JITOperations.h"
+#include "StringObject.h"
+
+namespace JSC {
+
+class ObjectPrototype;
+class RegExp;
+class RegExpObject;
+
+class StringPrototype : public StringObject {
+private:
+    StringPrototype(VM&, Structure*);
+
+public:
+    typedef StringObject Base;
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
+
+    static StringPrototype* create(VM&, JSGlobalObject*, Structure*);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*, JSString*);
+};
+
+EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceGeneric(
+    ExecState*, EncodedJSValue thisValue, EncodedJSValue searchValue, EncodedJSValue replaceValue);
+
+EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceRegExpEmptyStr(
+    ExecState*, JSString* thisValue, RegExpObject* searchValue);
+
+EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceRegExpString(
+    ExecState*, JSString* thisValue, RegExpObject* searchValue, JSString* replaceValue);
+
+String substituteBackreferences(const String& replacement, StringView source, const int* ovector, RegExp* reg);
+
+EncodedJSValue JSC_HOST_CALL stringProtoFuncRepeatCharacter(ExecState*);
+EncodedJSValue JSC_HOST_CALL stringProtoFuncSplitFast(ExecState*);
+
+EncodedJSValue JSC_HOST_CALL builtinStringSubstrInternal(ExecState*);
+EncodedJSValue JSC_HOST_CALL builtinStringIncludesInternal(ExecState*);
+
+} // namespace JSC
diff --git a/runtime/StringRecursionChecker.cpp b/runtime/StringRecursionChecker.cpp
new file mode 100644
index 0000000..33e45a6
--- /dev/null
+++ b/runtime/StringRecursionChecker.cpp
@@ -0,0 +1,41 @@
+/*
+ *  Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include "StringRecursionChecker.h"
+
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+JSValue StringRecursionChecker::throwStackOverflowError()
+{
+    VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSC::throwStackOverflowError(m_exec, scope);
+}
+
+JSValue StringRecursionChecker::emptyString()
+{
+    return jsEmptyString(m_exec);
+}
+
+}
diff --git a/runtime/StringRecursionChecker.h b/runtime/StringRecursionChecker.h
new file mode 100644
index 0000000..463b79e
--- /dev/null
+++ b/runtime/StringRecursionChecker.h
@@ -0,0 +1,94 @@
+/*
+ *  Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "Interpreter.h"
+#include "VMInlines.h"
+#include <wtf/StackStats.h>
+
+namespace JSC {
+
+class StringRecursionChecker {
+    WTF_MAKE_NONCOPYABLE(StringRecursionChecker);
+
+public:
+    StringRecursionChecker(ExecState*, JSObject* thisObject);
+    ~StringRecursionChecker();
+
+    JSValue earlyReturnValue() const; // 0 if everything is OK, value to return for failure cases
+
+private:
+    JSValue throwStackOverflowError();
+    JSValue emptyString();
+    JSValue performCheck();
+
+    ExecState* m_exec;
+    JSObject* m_thisObject;
+    JSValue m_earlyReturnValue;
+
+    StackStats::CheckPoint stackCheckpoint;
+};
+
+inline JSValue StringRecursionChecker::performCheck()
+{
+    VM& vm = m_exec->vm();
+    if (UNLIKELY(!vm.isSafeToRecurseSoft()))
+        return throwStackOverflowError();
+
+    bool alreadyVisited = false;
+    if (!vm.stringRecursionCheckFirstObject)
+        vm.stringRecursionCheckFirstObject = m_thisObject;
+    else if (vm.stringRecursionCheckFirstObject == m_thisObject)
+        alreadyVisited = true;
+    else
+        alreadyVisited = !vm.stringRecursionCheckVisitedObjects.add(m_thisObject).isNewEntry;
+
+    if (alreadyVisited)
+        return emptyString(); // Return empty string to avoid infinite recursion.
+    return JSValue(); // Indicate success.
+}
+
+inline StringRecursionChecker::StringRecursionChecker(ExecState* exec, JSObject* thisObject)
+    : m_exec(exec)
+    , m_thisObject(thisObject)
+    , m_earlyReturnValue(performCheck())
+{
+}
+
+inline JSValue StringRecursionChecker::earlyReturnValue() const
+{
+    return m_earlyReturnValue;
+}
+
+inline StringRecursionChecker::~StringRecursionChecker()
+{
+    if (m_earlyReturnValue)
+        return;
+
+    VM& vm = m_exec->vm();
+    if (vm.stringRecursionCheckFirstObject == m_thisObject)
+        vm.stringRecursionCheckFirstObject = nullptr;
+    else {
+        ASSERT(vm.stringRecursionCheckVisitedObjects.contains(m_thisObject));
+        vm.stringRecursionCheckVisitedObjects.remove(m_thisObject);
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/Structure.cpp b/runtime/Structure.cpp
new file mode 100644
index 0000000..072c3bb
--- /dev/null
+++ b/runtime/Structure.cpp
@@ -0,0 +1,1307 @@
+/*
+ * Copyright (C) 2008, 2009, 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Structure.h"
+
+#include "CodeBlock.h"
+#include "DumpContext.h"
+#include "JSCInlines.h"
+#include "JSObject.h"
+#include "JSPropertyNameEnumerator.h"
+#include "Lookup.h"
+#include "PropertyMapHashTable.h"
+#include "PropertyNameArray.h"
+#include "StructureChain.h"
+#include "StructureRareDataInlines.h"
+#include "WeakGCMapInlines.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/ProcessID.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Threading.h>
+
+#define DUMP_STRUCTURE_ID_STATISTICS 0
+
+using namespace std;
+using namespace WTF;
+
+namespace JSC {
+
+#if DUMP_STRUCTURE_ID_STATISTICS
+static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
+#endif
+
+class SingleSlotTransitionWeakOwner final : public WeakHandleOwner {
+    void finalize(Handle<Unknown>, void* context) override
+    {
+        StructureTransitionTable* table = reinterpret_cast<StructureTransitionTable*>(context);
+        ASSERT(table->isUsingSingleSlot());
+        WeakSet::deallocate(table->weakImpl());
+        table->m_data = StructureTransitionTable::UsingSingleSlotFlag;
+    }
+};
+
+static SingleSlotTransitionWeakOwner& singleSlotTransitionWeakOwner()
+{
+    static NeverDestroyed<SingleSlotTransitionWeakOwner> owner;
+    return owner;
+}
+
+inline Structure* StructureTransitionTable::singleTransition() const
+{
+    ASSERT(isUsingSingleSlot());
+    if (WeakImpl* impl = this->weakImpl()) {
+        if (impl->state() == WeakImpl::Live)
+            return jsCast<Structure*>(impl->jsValue().asCell());
+    }
+    return nullptr;
+}
+
+inline void StructureTransitionTable::setSingleTransition(Structure* structure)
+{
+    ASSERT(isUsingSingleSlot());
+    if (WeakImpl* impl = this->weakImpl())
+        WeakSet::deallocate(impl);
+    WeakImpl* impl = WeakSet::allocate(structure, &singleSlotTransitionWeakOwner(), this);
+    m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
+}
+
+bool StructureTransitionTable::contains(UniquedStringImpl* rep, unsigned attributes) const
+{
+    if (isUsingSingleSlot()) {
+        Structure* transition = singleTransition();
+        return transition && transition->m_nameInPrevious == rep && transition->attributesInPrevious() == attributes;
+    }
+    return map()->get(std::make_pair(rep, attributes));
+}
+
+Structure* StructureTransitionTable::get(UniquedStringImpl* rep, unsigned attributes) const
+{
+    if (isUsingSingleSlot()) {
+        Structure* transition = singleTransition();
+        return (transition && transition->m_nameInPrevious == rep && transition->attributesInPrevious() == attributes) ? transition : 0;
+    }
+    return map()->get(std::make_pair(rep, attributes));
+}
+
+void StructureTransitionTable::add(VM& vm, Structure* structure)
+{
+    if (isUsingSingleSlot()) {
+        Structure* existingTransition = singleTransition();
+
+        // This handles the first transition being added.
+        if (!existingTransition) {
+            setSingleTransition(structure);
+            return;
+        }
+
+        // This handles the second transition being added
+        // (or the first transition being despecified!)
+        setMap(new TransitionMap(vm));
+        add(vm, existingTransition);
+    }
+
+    // Add the structure to the map.
+
+    // Newer versions of the STL have an std::make_pair function that takes rvalue references.
+    // When either of the parameters are bitfields, the C++ compiler will try to bind them as lvalues, which is invalid. To work around this, use unary "+" to make the parameter an rvalue.
+    // See https://bugs.webkit.org/show_bug.cgi?id=59261 for more details
+    map()->set(std::make_pair(structure->m_nameInPrevious.get(), +structure->attributesInPrevious()), structure);
+}
+
+void Structure::dumpStatistics()
+{
+#if DUMP_STRUCTURE_ID_STATISTICS
+    unsigned numberLeaf = 0;
+    unsigned numberUsingSingleSlot = 0;
+    unsigned numberSingletons = 0;
+    unsigned numberWithPropertyMaps = 0;
+    unsigned totalPropertyMapsSize = 0;
+
+    HashSet<Structure*>::const_iterator end = liveStructureSet.end();
+    for (HashSet<Structure*>::const_iterator it = liveStructureSet.begin(); it != end; ++it) {
+        Structure* structure = *it;
+
+        switch (structure->m_transitionTable.size()) {
+            case 0:
+                ++numberLeaf;
+                if (!structure->previousID())
+                    ++numberSingletons;
+                break;
+
+            case 1:
+                ++numberUsingSingleSlot;
+                break;
+        }
+
+        if (PropertyTable* table = structure->propertyTableOrNull()) {
+            ++numberWithPropertyMaps;
+            totalPropertyMapsSize += table->sizeInMemory();
+        }
+    }
+
+    dataLogF("Number of live Structures: %d\n", liveStructureSet.size());
+    dataLogF("Number of Structures using the single item optimization for transition map: %d\n", numberUsingSingleSlot);
+    dataLogF("Number of Structures that are leaf nodes: %d\n", numberLeaf);
+    dataLogF("Number of Structures that singletons: %d\n", numberSingletons);
+    dataLogF("Number of Structures with PropertyMaps: %d\n", numberWithPropertyMaps);
+
+    dataLogF("Size of a single Structures: %d\n", static_cast<unsigned>(sizeof(Structure)));
+    dataLogF("Size of sum of all property maps: %d\n", totalPropertyMapsSize);
+    dataLogF("Size of average of all property maps: %f\n", static_cast<double>(totalPropertyMapsSize) / static_cast<double>(liveStructureSet.size()));
+#else
+    dataLogF("Dumping Structure statistics is not enabled.\n");
+#endif
+}
+
+Structure::Structure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
+    : JSCell(vm, vm.structureStructure.get())
+    , m_blob(vm.heap.structureIDTable().allocateID(this), indexingType, typeInfo)
+    , m_outOfLineTypeFlags(typeInfo.outOfLineTypeFlags())
+    , m_globalObject(vm, this, globalObject, WriteBarrier<JSGlobalObject>::MayBeNull)
+    , m_prototype(vm, this, prototype)
+    , m_classInfo(classInfo)
+    , m_transitionWatchpointSet(IsWatched)
+    , m_offset(invalidOffset)
+    , m_inlineCapacity(inlineCapacity)
+    , m_bitField(0)
+{
+    setDictionaryKind(NoneDictionaryKind);
+    setIsPinnedPropertyTable(false);
+    setHasGetterSetterProperties(classInfo->hasStaticSetterOrReadonlyProperties());
+    setHasCustomGetterSetterProperties(false);
+    setHasReadOnlyOrGetterSetterPropertiesExcludingProto(classInfo->hasStaticSetterOrReadonlyProperties());
+    setIsQuickPropertyAccessAllowedForEnumeration(true);
+    setAttributesInPrevious(0);
+    setDidPreventExtensions(false);
+    setDidTransition(false);
+    setStaticPropertiesReified(false);
+    setTransitionWatchpointIsLikelyToBeFired(false);
+    setHasBeenDictionary(false);
+    setIsAddingPropertyForTransition(false);
+ 
+    ASSERT(inlineCapacity <= JSFinalObject::maxInlineCapacity());
+    ASSERT(static_cast<PropertyOffset>(inlineCapacity) < firstOutOfLineOffset);
+    ASSERT(!hasRareData());
+    ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() || !m_classInfo->hasStaticSetterOrReadonlyProperties());
+    ASSERT(hasGetterSetterProperties() || !m_classInfo->hasStaticSetterOrReadonlyProperties());
+}
+
+const ClassInfo Structure::s_info = { "Structure", 0, 0, CREATE_METHOD_TABLE(Structure) };
+
+Structure::Structure(VM& vm)
+    : JSCell(CreatingEarlyCell)
+    , m_prototype(vm, this, jsNull())
+    , m_classInfo(info())
+    , m_transitionWatchpointSet(IsWatched)
+    , m_offset(invalidOffset)
+    , m_inlineCapacity(0)
+    , m_bitField(0)
+{
+    setDictionaryKind(NoneDictionaryKind);
+    setIsPinnedPropertyTable(false);
+    setHasGetterSetterProperties(m_classInfo->hasStaticSetterOrReadonlyProperties());
+    setHasCustomGetterSetterProperties(false);
+    setHasReadOnlyOrGetterSetterPropertiesExcludingProto(m_classInfo->hasStaticSetterOrReadonlyProperties());
+    setIsQuickPropertyAccessAllowedForEnumeration(true);
+    setAttributesInPrevious(0);
+    setDidPreventExtensions(false);
+    setDidTransition(false);
+    setStaticPropertiesReified(false);
+    setTransitionWatchpointIsLikelyToBeFired(false);
+    setHasBeenDictionary(false);
+    setIsAddingPropertyForTransition(false);
+ 
+    TypeInfo typeInfo = TypeInfo(CellType, StructureFlags);
+    m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), 0, typeInfo);
+    m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();
+
+    ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() || !m_classInfo->hasStaticSetterOrReadonlyProperties());
+    ASSERT(hasGetterSetterProperties() || !m_classInfo->hasStaticSetterOrReadonlyProperties());
+}
+
+Structure::Structure(VM& vm, Structure* previous, DeferredStructureTransitionWatchpointFire* deferred)
+    : JSCell(vm, vm.structureStructure.get())
+    , m_prototype(vm, this, previous->storedPrototype())
+    , m_classInfo(previous->m_classInfo)
+    , m_transitionWatchpointSet(IsWatched)
+    , m_offset(invalidOffset)
+    , m_inlineCapacity(previous->m_inlineCapacity)
+    , m_bitField(0)
+{
+    setDictionaryKind(previous->dictionaryKind());
+    setIsPinnedPropertyTable(previous->hasBeenFlattenedBefore());
+    setHasGetterSetterProperties(previous->hasGetterSetterProperties());
+    setHasCustomGetterSetterProperties(previous->hasCustomGetterSetterProperties());
+    setHasReadOnlyOrGetterSetterPropertiesExcludingProto(previous->hasReadOnlyOrGetterSetterPropertiesExcludingProto());
+    setIsQuickPropertyAccessAllowedForEnumeration(previous->isQuickPropertyAccessAllowedForEnumeration());
+    setAttributesInPrevious(0);
+    setDidPreventExtensions(previous->didPreventExtensions());
+    setDidTransition(true);
+    setStaticPropertiesReified(previous->staticPropertiesReified());
+    setHasBeenDictionary(previous->hasBeenDictionary());
+    setIsAddingPropertyForTransition(false);
+ 
+    TypeInfo typeInfo = previous->typeInfo();
+    m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), previous->indexingTypeIncludingHistory(), typeInfo);
+    m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();
+
+    ASSERT(!previous->typeInfo().structureIsImmortal());
+    setPreviousID(vm, previous);
+
+    previous->didTransitionFromThisStructure(deferred);
+    
+    // Copy this bit now, in case previous was being watched.
+    setTransitionWatchpointIsLikelyToBeFired(previous->transitionWatchpointIsLikelyToBeFired());
+
+    if (previous->m_globalObject)
+        m_globalObject.set(vm, this, previous->m_globalObject.get());
+    ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() || !m_classInfo->hasStaticSetterOrReadonlyProperties());
+    ASSERT(hasGetterSetterProperties() || !m_classInfo->hasStaticSetterOrReadonlyProperties());
+}
+
+Structure::~Structure()
+{
+    if (typeInfo().structureIsImmortal())
+        return;
+    Heap::heap(this)->structureIDTable().deallocateID(this, m_blob.structureID());
+}
+
+void Structure::destroy(JSCell* cell)
+{
+    static_cast<Structure*>(cell)->Structure::~Structure();
+}
+
+void Structure::findStructuresAndMapForMaterialization(Vector<Structure*, 8>& structures, Structure*& structure, PropertyTable*& table)
+{
+    ASSERT(structures.isEmpty());
+    table = 0;
+
+    for (structure = this; structure; structure = structure->previousID()) {
+        structure->m_lock.lock();
+        
+        table = structure->propertyTableOrNull();
+        if (table) {
+            // Leave the structure locked, so that the caller can do things to it atomically
+            // before it loses its property table.
+            return;
+        }
+        
+        structures.append(structure);
+        structure->m_lock.unlock();
+    }
+    
+    ASSERT(!structure);
+    ASSERT(!table);
+}
+
+PropertyTable* Structure::materializePropertyTable(VM& vm, bool setPropertyTable)
+{
+    ASSERT(structure()->classInfo() == info());
+    ASSERT(!isAddingPropertyForTransition());
+    
+    DeferGC deferGC(vm.heap);
+    
+    Vector<Structure*, 8> structures;
+    Structure* structure;
+    PropertyTable* table;
+    
+    findStructuresAndMapForMaterialization(structures, structure, table);
+    
+    unsigned capacity = numberOfSlotsForLastOffset(m_offset, m_inlineCapacity);
+    if (table) {
+        table = table->copy(vm, capacity);
+        structure->m_lock.unlock();
+    } else
+        table = PropertyTable::create(vm, capacity);
+    
+    // Must hold the lock on this structure, since we will be modifying this structure's
+    // property map. We don't want getConcurrently() to see the property map in a half-baked
+    // state.
+    GCSafeConcurrentJSLocker locker(m_lock, vm.heap);
+    if (setPropertyTable)
+        this->setPropertyTable(vm, table);
+
+    InferredTypeTable* typeTable = m_inferredTypeTable.get();
+
+    for (size_t i = structures.size(); i--;) {
+        structure = structures[i];
+        if (!structure->m_nameInPrevious)
+            continue;
+        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious());
+        if (typeTable && typeTable->get(structure->m_nameInPrevious.get()))
+            entry.hasInferredType = true;
+        table->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
+    }
+    
+    checkOffsetConsistency(
+        table,
+        [&] () {
+            dataLog("Detected in materializePropertyTable.\n");
+            dataLog("Found structure = ", RawPointer(structure), "\n");
+            dataLog("structures = ");
+            CommaPrinter comma;
+            for (Structure* structure : structures)
+                dataLog(comma, RawPointer(structure));
+            dataLog("\n");
+        });
+    
+    return table;
+}
+
+Structure* Structure::addPropertyTransitionToExistingStructureImpl(Structure* structure, UniquedStringImpl* uid, unsigned attributes, PropertyOffset& offset)
+{
+    ASSERT(!structure->isDictionary());
+    ASSERT(structure->isObject());
+
+    if (Structure* existingTransition = structure->m_transitionTable.get(uid, attributes)) {
+        validateOffset(existingTransition->m_offset, existingTransition->inlineCapacity());
+        offset = existingTransition->m_offset;
+        return existingTransition;
+    }
+
+    return 0;
+}
+
+Structure* Structure::addPropertyTransitionToExistingStructure(Structure* structure, PropertyName propertyName, unsigned attributes, PropertyOffset& offset)
+{
+    ASSERT(!isCompilationThread());
+    return addPropertyTransitionToExistingStructureImpl(structure, propertyName.uid(), attributes, offset);
+}
+
+Structure* Structure::addPropertyTransitionToExistingStructureConcurrently(Structure* structure, UniquedStringImpl* uid, unsigned attributes, PropertyOffset& offset)
+{
+    ConcurrentJSLocker locker(structure->m_lock);
+    return addPropertyTransitionToExistingStructureImpl(structure, uid, attributes, offset);
+}
+
+bool Structure::anyObjectInChainMayInterceptIndexedAccesses() const
+{
+    for (const Structure* current = this; ;) {
+        if (current->mayInterceptIndexedAccesses())
+            return true;
+        
+        JSValue prototype = current->storedPrototype();
+        if (prototype.isNull())
+            return false;
+        
+        current = asObject(prototype)->structure();
+    }
+}
+
+bool Structure::holesMustForwardToPrototype(VM& vm) const
+{
+    if (this->mayInterceptIndexedAccesses())
+        return true;
+
+    JSValue prototype = this->storedPrototype();
+    if (!prototype.isObject())
+        return false;
+    JSObject* object = asObject(prototype);
+
+    while (true) {
+        Structure& structure = *object->structure(vm);
+        if (hasIndexedProperties(object->indexingType()) || structure.mayInterceptIndexedAccesses())
+            return true;
+        prototype = structure.storedPrototype();
+        if (!prototype.isObject())
+            return false;
+        object = asObject(prototype);
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool Structure::needsSlowPutIndexing() const
+{
+    return anyObjectInChainMayInterceptIndexedAccesses()
+        || globalObject()->isHavingABadTime();
+}
+
+NonPropertyTransition Structure::suggestedArrayStorageTransition() const
+{
+    if (needsSlowPutIndexing())
+        return NonPropertyTransition::AllocateSlowPutArrayStorage;
+    
+    return NonPropertyTransition::AllocateArrayStorage;
+}
+
+Structure* Structure::addPropertyTransition(VM& vm, Structure* structure, PropertyName propertyName, unsigned attributes, PropertyOffset& offset)
+{
+    Structure* newStructure = addPropertyTransitionToExistingStructure(
+        structure, propertyName, attributes, offset);
+    if (newStructure)
+        return newStructure;
+
+    return addNewPropertyTransition(
+        vm, structure, propertyName, attributes, offset, PutPropertySlot::UnknownContext);
+}
+
+Structure* Structure::addNewPropertyTransition(VM& vm, Structure* structure, PropertyName propertyName, unsigned attributes, PropertyOffset& offset, PutPropertySlot::Context context, DeferredStructureTransitionWatchpointFire* deferred)
+{
+    ASSERT(!structure->isDictionary());
+    ASSERT(structure->isObject());
+    ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, offset));
+    
+    int maxTransitionLength;
+    if (context == PutPropertySlot::PutById)
+        maxTransitionLength = s_maxTransitionLengthForNonEvalPutById;
+    else
+        maxTransitionLength = s_maxTransitionLength;
+    if (structure->transitionCount() > maxTransitionLength) {
+        Structure* transition = toCacheableDictionaryTransition(vm, structure, deferred);
+        ASSERT(structure != transition);
+        offset = transition->add(vm, propertyName, attributes);
+        return transition;
+    }
+    
+    Structure* transition = create(vm, structure, deferred);
+
+    transition->m_cachedPrototypeChain.setMayBeNull(vm, transition, structure->m_cachedPrototypeChain.get());
+    
+    // While we are adding the property, rematerializing the property table is super weird: we already
+    // have a m_nameInPrevious and attributesInPrevious but the m_offset is still wrong. If the
+    // materialization algorithm runs, it'll build a property table that already has the property but
+    // at a bogus offset. Rather than try to teach the materialization code how to create a table under
+    // those conditions, we just tell the GC not to blow the table away during this period of time.
+    // Holding the lock ensures that we either do this before the GC starts scanning the structure, in
+    // which case the GC will not blow the table away, or we do it after the GC already ran in which
+    // case all is well.  If it wasn't for the lock, the GC would have TOCTOU: if could read
+    // isAddingPropertyForTransition before we set it to true, and then blow the table away after.
+    {
+        ConcurrentJSLocker locker(transition->m_lock);
+        transition->setIsAddingPropertyForTransition(true);
+    }
+    
+    transition->m_nameInPrevious = propertyName.uid();
+    transition->setAttributesInPrevious(attributes);
+    transition->setPropertyTable(vm, structure->takePropertyTableOrCloneIfPinned(vm));
+    transition->m_offset = structure->m_offset;
+    transition->m_inferredTypeTable.setMayBeNull(vm, transition, structure->m_inferredTypeTable.get());
+
+    offset = transition->add(vm, propertyName, attributes);
+
+    // Now that everything is fine with the new structure's bookkeeping, the GC is free to blow the
+    // table away if it wants. We can now rebuild it fine.
+    WTF::storeStoreFence();
+    transition->setIsAddingPropertyForTransition(false);
+
+    checkOffset(transition->m_offset, transition->inlineCapacity());
+    {
+        ConcurrentJSLocker locker(structure->m_lock);
+        structure->m_transitionTable.add(vm, transition);
+    }
+    transition->checkOffsetConsistency();
+    structure->checkOffsetConsistency();
+    return transition;
+}
+
+Structure* Structure::removePropertyTransition(VM& vm, Structure* structure, PropertyName propertyName, PropertyOffset& offset)
+{
+    // NOTE: There are some good reasons why this goes directly to uncacheable dictionary rather than
+    // caching the removal. We can fix all of these things, but we must remember to do so, if we ever try
+    // to optimize this case.
+    //
+    // - Cached transitions usually steal the property table, and assume that this is possible because they
+    //   can just rebuild the table by looking at past transitions. That code assumes that the table only
+    //   grew and never shrank. To support removals, we'd have to change the property table materialization
+    //   code to handle deletions. Also, we have logic to get the list of properties on a structure that
+    //   lacks a property table by just looking back through the set of transitions since the last
+    //   structure that had a pinned table. That logic would also have to be changed to handle cached
+    //   removals.
+    //
+    // - InferredTypeTable assumes that removal has never happened. This is important since if we could
+    //   remove a property and then re-add it later, then the "absence means top" optimization wouldn't
+    //   work anymore, unless removal also either poisoned type inference (by doing something equivalent to
+    //   hasBeenDictionary) or by strongly marking the entry as Top by ensuring that it is not absent, but
+    //   instead, has a null entry.
+    
+    ASSERT(!structure->isUncacheableDictionary());
+
+    Structure* transition = toUncacheableDictionaryTransition(vm, structure);
+
+    offset = transition->remove(propertyName);
+
+    transition->checkOffsetConsistency();
+    return transition;
+}
+
+Structure* Structure::changePrototypeTransition(VM& vm, Structure* structure, JSValue prototype)
+{
+    DeferGC deferGC(vm.heap);
+    Structure* transition = create(vm, structure);
+
+    transition->m_prototype.set(vm, transition, prototype);
+
+    PropertyTable* table = structure->copyPropertyTableForPinning(vm);
+    transition->pin(holdLock(transition->m_lock), vm, table);
+    transition->m_offset = structure->m_offset;
+    
+    transition->checkOffsetConsistency();
+    return transition;
+}
+
+Structure* Structure::attributeChangeTransition(VM& vm, Structure* structure, PropertyName propertyName, unsigned attributes)
+{
+    if (!structure->isUncacheableDictionary()) {
+        Structure* transition = create(vm, structure);
+
+        PropertyTable* table = structure->copyPropertyTableForPinning(vm);
+        transition->pin(holdLock(transition->m_lock), vm, table);
+        transition->m_offset = structure->m_offset;
+        
+        structure = transition;
+    }
+
+    PropertyMapEntry* entry = structure->ensurePropertyTable(vm)->get(propertyName.uid());
+    ASSERT(entry);
+    entry->attributes = attributes;
+
+    structure->checkOffsetConsistency();
+    return structure;
+}
+
+Structure* Structure::toDictionaryTransition(VM& vm, Structure* structure, DictionaryKind kind, DeferredStructureTransitionWatchpointFire* deferred)
+{
+    ASSERT(!structure->isUncacheableDictionary());
+    DeferGC deferGC(vm.heap);
+    
+    Structure* transition = create(vm, structure, deferred);
+
+    PropertyTable* table = structure->copyPropertyTableForPinning(vm);
+    transition->pin(holdLock(transition->m_lock), vm, table);
+    transition->m_offset = structure->m_offset;
+    transition->setDictionaryKind(kind);
+    transition->setHasBeenDictionary(true);
+    
+    transition->checkOffsetConsistency();
+    return transition;
+}
+
+Structure* Structure::toCacheableDictionaryTransition(VM& vm, Structure* structure, DeferredStructureTransitionWatchpointFire* deferred)
+{
+    return toDictionaryTransition(vm, structure, CachedDictionaryKind, deferred);
+}
+
+Structure* Structure::toUncacheableDictionaryTransition(VM& vm, Structure* structure)
+{
+    return toDictionaryTransition(vm, structure, UncachedDictionaryKind);
+}
+
+Structure* Structure::sealTransition(VM& vm, Structure* structure)
+{
+    return nonPropertyTransition(vm, structure, NonPropertyTransition::Seal);
+}
+
+Structure* Structure::freezeTransition(VM& vm, Structure* structure)
+{
+    return nonPropertyTransition(vm, structure, NonPropertyTransition::Freeze);
+}
+
+Structure* Structure::preventExtensionsTransition(VM& vm, Structure* structure)
+{
+    return nonPropertyTransition(vm, structure, NonPropertyTransition::PreventExtensions);
+}
+
+PropertyTable* Structure::takePropertyTableOrCloneIfPinned(VM& vm)
+{
+    // This must always return a property table. It can't return null.
+    PropertyTable* result = propertyTableOrNull();
+    if (result) {
+        if (isPinnedPropertyTable())
+            return result->copy(vm, result->size() + 1);
+        ConcurrentJSLocker locker(m_lock);
+        setPropertyTable(vm, nullptr);
+        return result;
+    }
+    bool setPropertyTable = false;
+    return materializePropertyTable(vm, setPropertyTable);
+}
+
+Structure* Structure::nonPropertyTransition(VM& vm, Structure* structure, NonPropertyTransition transitionKind)
+{
+    unsigned attributes = toAttributes(transitionKind);
+    IndexingType indexingTypeIncludingHistory = newIndexingType(structure->indexingTypeIncludingHistory(), transitionKind);
+    
+    if (changesIndexingType(transitionKind)) {
+        if (JSGlobalObject* globalObject = structure->m_globalObject.get()) {
+            if (globalObject->isOriginalArrayStructure(structure)) {
+                Structure* result = globalObject->originalArrayStructureForIndexingType(indexingTypeIncludingHistory);
+                if (result->indexingTypeIncludingHistory() == indexingTypeIncludingHistory) {
+                    structure->didTransitionFromThisStructure();
+                    return result;
+                }
+            }
+        }
+    }
+    
+    Structure* existingTransition;
+    if (!structure->isDictionary() && (existingTransition = structure->m_transitionTable.get(0, attributes))) {
+        ASSERT(existingTransition->attributesInPrevious() == attributes);
+        ASSERT(existingTransition->indexingTypeIncludingHistory() == indexingTypeIncludingHistory);
+        return existingTransition;
+    }
+    
+    DeferGC deferGC(vm.heap);
+    
+    Structure* transition = create(vm, structure);
+    transition->setAttributesInPrevious(attributes);
+    transition->m_blob.setIndexingTypeIncludingHistory(indexingTypeIncludingHistory);
+    
+    if (preventsExtensions(transitionKind))
+        transition->setDidPreventExtensions(true);
+    
+    if (setsDontDeleteOnAllProperties(transitionKind)
+        || setsReadOnlyOnNonAccessorProperties(transitionKind)) {
+        // We pin the property table on transitions that do wholesale editing of the property
+        // table, since our logic for walking the property transition chain to rematerialize the
+        // table doesn't know how to take into account such wholesale edits.
+
+        PropertyTable* table = structure->copyPropertyTableForPinning(vm);
+        transition->pinForCaching(holdLock(transition->m_lock), vm, table);
+        transition->m_offset = structure->m_offset;
+        
+        table = transition->propertyTableOrNull();
+        RELEASE_ASSERT(table);
+        for (auto& entry : *table) {
+            if (setsDontDeleteOnAllProperties(transitionKind))
+                entry.attributes |= DontDelete;
+            if (setsReadOnlyOnNonAccessorProperties(transitionKind) && !(entry.attributes & Accessor))
+                entry.attributes |= ReadOnly;
+        }
+    } else {
+        transition->setPropertyTable(vm, structure->takePropertyTableOrCloneIfPinned(vm));
+        transition->m_offset = structure->m_offset;
+        checkOffset(transition->m_offset, transition->inlineCapacity());
+    }
+    
+    if (setsReadOnlyOnNonAccessorProperties(transitionKind)
+        && !transition->propertyTableOrNull()->isEmpty())
+        transition->setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
+    
+    if (structure->isDictionary()) {
+        PropertyTable* table = transition->ensurePropertyTable(vm);
+        transition->pin(holdLock(transition->m_lock), vm, table);
+    } else {
+        auto locker = holdLock(structure->m_lock);
+        structure->m_transitionTable.add(vm, transition);
+    }
+
+    transition->checkOffsetConsistency();
+    return transition;
+}
+
+// In future we may want to cache this property.
+bool Structure::isSealed(VM& vm)
+{
+    if (isStructureExtensible())
+        return false;
+
+    PropertyTable* table = ensurePropertyTableIfNotEmpty(vm);
+    if (!table)
+        return true;
+    
+    PropertyTable::iterator end = table->end();
+    for (PropertyTable::iterator iter = table->begin(); iter != end; ++iter) {
+        if ((iter->attributes & DontDelete) != DontDelete)
+            return false;
+    }
+    return true;
+}
+
+// In future we may want to cache this property.
+bool Structure::isFrozen(VM& vm)
+{
+    if (isStructureExtensible())
+        return false;
+
+    PropertyTable* table = ensurePropertyTableIfNotEmpty(vm);
+    if (!table)
+        return true;
+    
+    PropertyTable::iterator end = table->end();
+    for (PropertyTable::iterator iter = table->begin(); iter != end; ++iter) {
+        if (!(iter->attributes & DontDelete))
+            return false;
+        if (!(iter->attributes & (ReadOnly | Accessor)))
+            return false;
+    }
+    return true;
+}
+
+Structure* Structure::flattenDictionaryStructure(VM& vm, JSObject* object)
+{
+    checkOffsetConsistency();
+    ASSERT(isDictionary());
+    
+    GCSafeConcurrentJSLocker locker(m_lock, vm.heap);
+    
+    object->setStructureIDDirectly(nuke(id()));
+    WTF::storeStoreFence();
+
+    size_t beforeOutOfLineCapacity = this->outOfLineCapacity();
+    if (isUncacheableDictionary()) {
+        PropertyTable* table = propertyTableOrNull();
+        ASSERT(table);
+
+        size_t propertyCount = table->size();
+
+        // Holds our values compacted by insertion order.
+        Vector<JSValue> values(propertyCount);
+
+        // Copies out our values from their hashed locations, compacting property table offsets as we go.
+        unsigned i = 0;
+        PropertyTable::iterator end = table->end();
+        m_offset = invalidOffset;
+        for (PropertyTable::iterator iter = table->begin(); iter != end; ++iter, ++i) {
+            values[i] = object->getDirect(iter->offset);
+            m_offset = iter->offset = offsetForPropertyNumber(i, m_inlineCapacity);
+        }
+        
+        // Copies in our values to their compacted locations.
+        for (unsigned i = 0; i < propertyCount; i++)
+            object->putDirect(vm, offsetForPropertyNumber(i, m_inlineCapacity), values[i]);
+
+        table->clearDeletedOffsets();
+        checkOffsetConsistency();
+    }
+
+    setDictionaryKind(NoneDictionaryKind);
+    setHasBeenFlattenedBefore(true);
+
+    size_t afterOutOfLineCapacity = this->outOfLineCapacity();
+
+    if (object->butterfly() && beforeOutOfLineCapacity != afterOutOfLineCapacity) {
+        ASSERT(beforeOutOfLineCapacity > afterOutOfLineCapacity);
+        // If the object had a Butterfly but after flattening/compacting we no longer have need of it,
+        // we need to zero it out because the collector depends on the Structure to know the size for copying.
+        if (!afterOutOfLineCapacity && !this->hasIndexingHeader(object))
+            object->setButterfly(vm, nullptr);
+        // If the object was down-sized to the point where the base of the Butterfly is no longer within the 
+        // first CopiedBlock::blockSize bytes, we'll get the wrong answer if we try to mask the base back to 
+        // the CopiedBlock header. To prevent this case we need to memmove the Butterfly down.
+        else
+            object->shiftButterflyAfterFlattening(locker, vm, this, afterOutOfLineCapacity);
+    }
+    
+    WTF::storeStoreFence();
+    object->setStructureIDDirectly(id());
+
+    // FIXME: This is probably no longer needed since we have a stronger mechanism
+    // for detecting races and rescanning an object.
+    // https://bugs.webkit.org/show_bug.cgi?id=166989
+    vm.heap.writeBarrier(object);
+
+    return this;
+}
+
+void Structure::pin(const AbstractLocker&, VM& vm, PropertyTable* table)
+{
+    setIsPinnedPropertyTable(true);
+    setPropertyTable(vm, table);
+    clearPreviousID();
+    m_nameInPrevious = nullptr;
+}
+
+void Structure::pinForCaching(const AbstractLocker&, VM& vm, PropertyTable* table)
+{
+    setIsPinnedPropertyTable(true);
+    setPropertyTable(vm, table);
+    m_nameInPrevious = nullptr;
+}
+
+void Structure::allocateRareData(VM& vm)
+{
+    ASSERT(!hasRareData());
+    StructureRareData* rareData = StructureRareData::create(vm, previousID());
+    WTF::storeStoreFence();
+    m_previousOrRareData.set(vm, this, rareData);
+    ASSERT(hasRareData());
+}
+
+WatchpointSet* Structure::ensurePropertyReplacementWatchpointSet(VM& vm, PropertyOffset offset)
+{
+    ASSERT(!isUncacheableDictionary());
+
+    // In some places it's convenient to call this with an invalid offset. So, we do the check here.
+    if (!isValidOffset(offset))
+        return nullptr;
+    
+    if (!hasRareData())
+        allocateRareData(vm);
+    ConcurrentJSLocker locker(m_lock);
+    StructureRareData* rareData = this->rareData();
+    if (!rareData->m_replacementWatchpointSets) {
+        rareData->m_replacementWatchpointSets =
+            std::make_unique<StructureRareData::PropertyWatchpointMap>();
+        WTF::storeStoreFence();
+    }
+    auto result = rareData->m_replacementWatchpointSets->add(offset, nullptr);
+    if (result.isNewEntry)
+        result.iterator->value = adoptRef(new WatchpointSet(IsWatched));
+    return result.iterator->value.get();
+}
+
+void Structure::startWatchingPropertyForReplacements(VM& vm, PropertyName propertyName)
+{
+    ASSERT(!isUncacheableDictionary());
+    
+    startWatchingPropertyForReplacements(vm, get(vm, propertyName));
+}
+
+void Structure::didCachePropertyReplacement(VM& vm, PropertyOffset offset)
+{
+    ensurePropertyReplacementWatchpointSet(vm, offset)->fireAll(vm, "Did cache property replacement");
+}
+
+void Structure::startWatchingInternalProperties(VM& vm)
+{
+    if (!isUncacheableDictionary()) {
+        startWatchingPropertyForReplacements(vm, vm.propertyNames->toString);
+        startWatchingPropertyForReplacements(vm, vm.propertyNames->valueOf);
+    }
+    setDidWatchInternalProperties(true);
+}
+
+void Structure::willStoreValueSlow(
+    VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize,
+    InferredTypeTable::StoredPropertyAge age)
+{
+    ASSERT(!isCompilationThread());
+    ASSERT(structure()->classInfo() == info());
+    ASSERT(!hasBeenDictionary());
+
+    // Create the inferred type table before doing anything else, so that we don't GC after we have already
+    // grabbed a pointer into the property map.
+    InferredTypeTable* table = m_inferredTypeTable.get();
+    if (!table) {
+        table = InferredTypeTable::create(vm);
+        WTF::storeStoreFence();
+        m_inferredTypeTable.set(vm, this, table);
+    }
+
+    // This only works if we've got a property table.
+    PropertyTable* propertyTable = ensurePropertyTable(vm);
+    
+    // We must be calling this after having created the given property or confirmed that it was present
+    // already, so the property must be present.
+    PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
+    ASSERT(entry);
+    
+    if (shouldOptimize)
+        entry->hasInferredType = table->willStoreValue(vm, propertyName, value, age);
+    else {
+        table->makeTop(vm, propertyName, age);
+        entry->hasInferredType = false;
+    }
+}
+
+#if DUMP_PROPERTYMAP_STATS
+
+PropertyMapHashTableStats* propertyMapHashTableStats = 0;
+
+struct PropertyMapStatisticsExitLogger {
+    PropertyMapStatisticsExitLogger();
+    ~PropertyMapStatisticsExitLogger();
+};
+
+DEFINE_GLOBAL_FOR_LOGGING(PropertyMapStatisticsExitLogger, logger, );
+
+PropertyMapStatisticsExitLogger::PropertyMapStatisticsExitLogger()
+{
+    propertyMapHashTableStats = adoptPtr(new PropertyMapHashTableStats()).leakPtr();
+}
+
+PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger()
+{
+    unsigned finds = propertyMapHashTableStats->numFinds;
+    unsigned collisions = propertyMapHashTableStats->numCollisions;
+    dataLogF("\nJSC::PropertyMap statistics for process %d\n\n", getCurrentProcessID());
+    dataLogF("%d finds\n", finds);
+    dataLogF("%d collisions (%.1f%%)\n", collisions, 100.0 * collisions / finds);
+    dataLogF("%d lookups\n", propertyMapHashTableStats->numLookups.load());
+    dataLogF("%d lookup probings\n", propertyMapHashTableStats->numLookupProbing.load());
+    dataLogF("%d adds\n", propertyMapHashTableStats->numAdds.load());
+    dataLogF("%d removes\n", propertyMapHashTableStats->numRemoves.load());
+    dataLogF("%d rehashes\n", propertyMapHashTableStats->numRehashes.load());
+    dataLogF("%d reinserts\n", propertyMapHashTableStats->numReinserts.load());
+}
+
+#endif
+
+PropertyTable* Structure::copyPropertyTableForPinning(VM& vm)
+{
+    if (PropertyTable* table = propertyTableOrNull())
+        return PropertyTable::clone(vm, *table);
+    bool setPropertyTable = false;
+    return materializePropertyTable(vm, setPropertyTable);
+}
+
+PropertyOffset Structure::getConcurrently(UniquedStringImpl* uid, unsigned& attributes)
+{
+    PropertyOffset result = invalidOffset;
+    
+    forEachPropertyConcurrently(
+        [&] (const PropertyMapEntry& candidate) -> bool {
+            if (candidate.key != uid)
+                return true;
+            
+            result = candidate.offset;
+            attributes = candidate.attributes;
+            return false;
+        });
+    
+    return result;
+}
+
+Vector<PropertyMapEntry> Structure::getPropertiesConcurrently()
+{
+    Vector<PropertyMapEntry> result;
+
+    forEachPropertyConcurrently(
+        [&] (const PropertyMapEntry& entry) -> bool {
+            result.append(entry);
+            return true;
+        });
+    
+    return result;
+}
+
+PropertyOffset Structure::add(VM& vm, PropertyName propertyName, unsigned attributes)
+{
+    return add<ShouldPin::No>(
+        vm, propertyName, attributes,
+        [this] (const GCSafeConcurrentJSLocker&, PropertyOffset, PropertyOffset newLastOffset) {
+            setLastOffset(newLastOffset);
+        });
+}
+
+PropertyOffset Structure::remove(PropertyName propertyName)
+{
+    return remove(propertyName, [] (const ConcurrentJSLocker&, PropertyOffset) { });
+}
+
+void Structure::getPropertyNamesFromStructure(VM& vm, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    PropertyTable* table = ensurePropertyTableIfNotEmpty(vm);
+    if (!table)
+        return;
+    
+    bool knownUnique = propertyNames.canAddKnownUniqueForStructure();
+    
+    PropertyTable::iterator end = table->end();
+    for (PropertyTable::iterator iter = table->begin(); iter != end; ++iter) {
+        ASSERT(!isQuickPropertyAccessAllowedForEnumeration() || !(iter->attributes & DontEnum));
+        ASSERT(!isQuickPropertyAccessAllowedForEnumeration() || !iter->key->isSymbol());
+        if (!(iter->attributes & DontEnum) || mode.includeDontEnumProperties()) {
+            if (iter->key->isSymbol() && !propertyNames.includeSymbolProperties())
+                continue;
+            if (knownUnique)
+                propertyNames.addUnchecked(iter->key);
+            else
+                propertyNames.add(iter->key);
+        }
+    }
+}
+
+void StructureFireDetail::dump(PrintStream& out) const
+{
+    out.print("Structure transition from ", *m_structure);
+}
+
+DeferredStructureTransitionWatchpointFire::DeferredStructureTransitionWatchpointFire()
+    : m_structure(nullptr)
+{
+}
+
+DeferredStructureTransitionWatchpointFire::~DeferredStructureTransitionWatchpointFire()
+{
+    if (m_structure)
+        m_structure->transitionWatchpointSet().fireAll(*m_structure->vm(), StructureFireDetail(m_structure));
+}
+
+void DeferredStructureTransitionWatchpointFire::add(const Structure* structure)
+{
+    RELEASE_ASSERT(!m_structure);
+    RELEASE_ASSERT(structure);
+    m_structure = structure;
+}
+
+void Structure::didTransitionFromThisStructure(DeferredStructureTransitionWatchpointFire* deferred) const
+{
+    // If the structure is being watched, and this is the kind of structure that the DFG would
+    // like to watch, then make sure to note for all future versions of this structure that it's
+    // unwise to watch it.
+    if (m_transitionWatchpointSet.isBeingWatched())
+        const_cast<Structure*>(this)->setTransitionWatchpointIsLikelyToBeFired(true);
+    
+    if (deferred)
+        deferred->add(this);
+    else
+        m_transitionWatchpointSet.fireAll(*vm(), StructureFireDetail(this));
+}
+
+JSValue Structure::prototypeForLookup(CodeBlock* codeBlock) const
+{
+    return prototypeForLookup(codeBlock->globalObject());
+}
+
+void Structure::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    Structure* thisObject = jsCast<Structure*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    JSCell::visitChildren(thisObject, visitor);
+    
+    ConcurrentJSLocker locker(thisObject->m_lock);
+    
+    visitor.append(thisObject->m_globalObject);
+    if (!thisObject->isObject())
+        thisObject->m_cachedPrototypeChain.clear();
+    else {
+        visitor.append(thisObject->m_prototype);
+        visitor.append(thisObject->m_cachedPrototypeChain);
+    }
+    visitor.append(thisObject->m_previousOrRareData);
+
+    if (thisObject->isPinnedPropertyTable() || thisObject->isAddingPropertyForTransition()) {
+        // NOTE: This can interleave in pin(), in which case it may see a null property table.
+        // That's fine, because then the barrier will fire and we will scan this again.
+        visitor.append(thisObject->m_propertyTableUnsafe);
+    } else if (visitor.isBuildingHeapSnapshot())
+        visitor.append(thisObject->m_propertyTableUnsafe);
+    else if (thisObject->m_propertyTableUnsafe)
+        thisObject->m_propertyTableUnsafe.clear();
+
+    visitor.append(thisObject->m_inferredTypeTable);
+}
+
+bool Structure::isCheapDuringGC()
+{
+    // FIXME: We could make this even safer by returning false if this structure's property table
+    // has any large property names.
+    // https://bugs.webkit.org/show_bug.cgi?id=157334
+    
+    return (!m_globalObject || Heap::isMarkedConcurrently(m_globalObject.get()))
+        && (!storedPrototypeObject() || Heap::isMarkedConcurrently(storedPrototypeObject()));
+}
+
+bool Structure::markIfCheap(SlotVisitor& visitor)
+{
+    if (!isCheapDuringGC())
+        return Heap::isMarkedConcurrently(this);
+    
+    visitor.appendUnbarriered(this);
+    return true;
+}
+
+bool Structure::prototypeChainMayInterceptStoreTo(VM& vm, PropertyName propertyName)
+{
+    if (parseIndex(propertyName))
+        return anyObjectInChainMayInterceptIndexedAccesses();
+    
+    for (Structure* current = this; ;) {
+        JSValue prototype = current->storedPrototype();
+        if (prototype.isNull())
+            return false;
+        
+        current = prototype.asCell()->structure(vm);
+        
+        unsigned attributes;
+        PropertyOffset offset = current->get(vm, propertyName, attributes);
+        if (!JSC::isValidOffset(offset))
+            continue;
+        
+        if (attributes & (ReadOnly | Accessor))
+            return true;
+        
+        return false;
+    }
+}
+
+PassRefPtr<StructureShape> Structure::toStructureShape(JSValue value)
+{
+    RefPtr<StructureShape> baseShape = StructureShape::create();
+    RefPtr<StructureShape> curShape = baseShape;
+    Structure* curStructure = this;
+    JSValue curValue = value;
+    while (curStructure) {
+        curStructure->forEachPropertyConcurrently(
+            [&] (const PropertyMapEntry& entry) -> bool {
+                curShape->addProperty(*entry.key);
+                return true;
+            });
+
+        if (JSObject* curObject = curValue.getObject())
+            curShape->setConstructorName(JSObject::calculatedClassName(curObject));
+        else
+            curShape->setConstructorName(curStructure->classInfo()->className);
+
+        if (curStructure->isDictionary())
+            curShape->enterDictionaryMode();
+
+        curShape->markAsFinal();
+
+        if (curStructure->storedPrototypeStructure()) {
+            auto newShape = StructureShape::create();
+            curShape->setProto(newShape.ptr());
+            curShape = WTFMove(newShape);
+            curValue = curStructure->storedPrototype();
+        }
+
+        curStructure = curStructure->storedPrototypeStructure();
+    }
+    
+    return WTFMove(baseShape);
+}
+
+bool Structure::canUseForAllocationsOf(Structure* other)
+{
+    return inlineCapacity() == other->inlineCapacity()
+        && storedPrototype() == other->storedPrototype()
+        && objectInitializationBlob() == other->objectInitializationBlob();
+}
+
+void Structure::dump(PrintStream& out) const
+{
+    out.print(RawPointer(this), ":[", classInfo()->className, ", {");
+    
+    CommaPrinter comma;
+    
+    const_cast<Structure*>(this)->forEachPropertyConcurrently(
+        [&] (const PropertyMapEntry& entry) -> bool {
+            out.print(comma, entry.key, ":", static_cast<int>(entry.offset));
+            return true;
+        });
+    
+    out.print("}, ", IndexingTypeDump(indexingType()));
+    
+    if (m_prototype.get().isCell())
+        out.print(", Proto:", RawPointer(m_prototype.get().asCell()));
+
+    switch (dictionaryKind()) {
+    case NoneDictionaryKind:
+        if (hasBeenDictionary())
+            out.print(", Has been dictionary");
+        break;
+    case CachedDictionaryKind:
+        out.print(", Dictionary");
+        break;
+    case UncachedDictionaryKind:
+        out.print(", UncacheableDictionary");
+        break;
+    }
+
+    if (transitionWatchpointSetIsStillValid())
+        out.print(", Leaf");
+    else if (transitionWatchpointIsLikelyToBeFired())
+        out.print(", Shady leaf");
+    
+    out.print("]");
+}
+
+void Structure::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+    if (context)
+        context->structures.dumpBrief(this, out);
+    else
+        dump(out);
+}
+
+void Structure::dumpBrief(PrintStream& out, const CString& string) const
+{
+    out.print("%", string, ":", classInfo()->className);
+}
+
+void Structure::dumpContextHeader(PrintStream& out)
+{
+    out.print("Structures:");
+}
+
+bool ClassInfo::hasStaticSetterOrReadonlyProperties() const
+{
+    for (const ClassInfo* ci = this; ci; ci = ci->parentClass) {
+        if (const HashTable* table = ci->staticPropHashTable) {
+            if (table->hasSetterOrReadonlyProperties)
+                return true;
+        }
+    }
+    return false;
+}
+
+void Structure::setCachedPropertyNameEnumerator(VM& vm, JSPropertyNameEnumerator* enumerator)
+{
+    ASSERT(!isDictionary());
+    if (!hasRareData())
+        allocateRareData(vm);
+    rareData()->setCachedPropertyNameEnumerator(vm, enumerator);
+}
+
+JSPropertyNameEnumerator* Structure::cachedPropertyNameEnumerator() const
+{
+    if (!hasRareData())
+        return nullptr;
+    return rareData()->cachedPropertyNameEnumerator();
+}
+
+bool Structure::canCachePropertyNameEnumerator() const
+{
+    if (isDictionary())
+        return false;
+
+    if (hasIndexedProperties(indexingType()))
+        return false;
+
+    if (typeInfo().overridesGetPropertyNames())
+        return false;
+
+    StructureChain* structureChain = m_cachedPrototypeChain.get();
+    ASSERT(structureChain);
+    WriteBarrier<Structure>* structure = structureChain->head();
+    while (true) {
+        if (!structure->get())
+            break;
+        if (structure->get()->typeInfo().overridesGetPropertyNames())
+            return false;
+        structure++;
+    }
+    
+    return true;
+}
+    
+bool Structure::canAccessPropertiesQuicklyForEnumeration() const
+{
+    if (!isQuickPropertyAccessAllowedForEnumeration())
+        return false;
+    if (hasGetterSetterProperties())
+        return false;
+    if (isUncacheableDictionary())
+        return false;
+    return true;
+}
+
+} // namespace JSC
diff --git a/runtime/Structure.h b/runtime/Structure.h
new file mode 100644
index 0000000..c17a343
--- /dev/null
+++ b/runtime/Structure.h
@@ -0,0 +1,796 @@
+/*
+ * Copyright (C) 2008, 2009, 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ClassInfo.h"
+#include "ConcurrentJSLock.h"
+#include "IndexingType.h"
+#include "InferredTypeTable.h"
+#include "JSCJSValue.h"
+#include "JSCell.h"
+#include "JSType.h"
+#include "PropertyName.h"
+#include "PropertyNameArray.h"
+#include "PropertyOffset.h"
+#include "Protect.h"
+#include "PutPropertySlot.h"
+#include "StructureIDBlob.h"
+#include "StructureRareData.h"
+#include "StructureRareDataInlines.h"
+#include "StructureTransitionTable.h"
+#include "JSTypeInfo.h"
+#include "Watchpoint.h"
+#include "Weak.h"
+#include "WriteBarrierInlines.h"
+#include <wtf/CompilationThread.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/PrintStream.h>
+
+namespace WTF {
+
+class UniquedStringImpl;
+
+} // namespace WTF
+
+namespace JSC {
+
+class DeferGC;
+class LLIntOffsetsExtractor;
+class PropertyNameArray;
+class PropertyNameArrayData;
+class PropertyTable;
+class StructureChain;
+class StructureShape;
+class SlotVisitor;
+class JSString;
+struct DumpContext;
+
+// The out-of-line property storage capacity to use when first allocating out-of-line
+// storage. Note that all objects start out without having any out-of-line storage;
+// this comes into play only on the first property store that exhausts inline storage.
+static const unsigned initialOutOfLineCapacity = 4;
+
+// The factor by which to grow out-of-line storage when it is exhausted, after the
+// initial allocation.
+static const unsigned outOfLineGrowthFactor = 2;
+
+struct PropertyMapEntry {
+    UniquedStringImpl* key;
+    PropertyOffset offset;
+    uint8_t attributes;
+    bool hasInferredType; // This caches whether or not a property has an inferred type in the inferred type table, and is used for a fast check in JSObject::putDirectInternal().
+
+    PropertyMapEntry()
+        : key(nullptr)
+        , offset(invalidOffset)
+        , attributes(0)
+        , hasInferredType(false)
+    {
+    }
+    
+    PropertyMapEntry(UniquedStringImpl* key, PropertyOffset offset, unsigned attributes)
+        : key(key)
+        , offset(offset)
+        , attributes(attributes)
+        , hasInferredType(false)
+    {
+        ASSERT(this->attributes == attributes);
+    }
+};
+
+class StructureFireDetail : public FireDetail {
+public:
+    StructureFireDetail(const Structure* structure)
+        : m_structure(structure)
+    {
+    }
+    
+    void dump(PrintStream& out) const override;
+
+private:
+    const Structure* m_structure;
+};
+
+class DeferredStructureTransitionWatchpointFire {
+    WTF_MAKE_NONCOPYABLE(DeferredStructureTransitionWatchpointFire);
+public:
+    JS_EXPORT_PRIVATE DeferredStructureTransitionWatchpointFire();
+    JS_EXPORT_PRIVATE ~DeferredStructureTransitionWatchpointFire();
+    
+    void add(const Structure*);
+    
+private:
+    const Structure* m_structure;
+};
+
+class Structure final : public JSCell {
+public:
+    friend class StructureTransitionTable;
+
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+    
+    static Structure* create(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType = NonArray, unsigned inlineCapacity = 0);
+
+    ~Structure();
+
+protected:
+    void finishCreation(VM& vm)
+    {
+        Base::finishCreation(vm);
+        ASSERT(m_prototype);
+        ASSERT(m_prototype.isObject() || m_prototype.isNull());
+    }
+
+    void finishCreation(VM& vm, CreatingEarlyCellTag)
+    {
+        Base::finishCreation(vm, this, CreatingEarlyCell);
+        ASSERT(m_prototype);
+        ASSERT(m_prototype.isNull());
+        ASSERT(!vm.structureStructure);
+    }
+
+public:
+    StructureID id() const { return m_blob.structureID(); }
+    int32_t objectInitializationBlob() const { return m_blob.blobExcludingStructureID(); }
+    int64_t idBlob() const { return m_blob.blob(); }
+
+    bool isProxy() const
+    {
+        JSType type = m_blob.type();
+        return type == ImpureProxyType || type == PureForwardingProxyType;
+    }
+
+    static void dumpStatistics();
+
+    JS_EXPORT_PRIVATE static Structure* addPropertyTransition(VM&, Structure*, PropertyName, unsigned attributes, PropertyOffset&);
+    JS_EXPORT_PRIVATE static Structure* addNewPropertyTransition(VM&, Structure*, PropertyName, unsigned attributes, PropertyOffset&, PutPropertySlot::Context = PutPropertySlot::UnknownContext, DeferredStructureTransitionWatchpointFire* = nullptr);
+    static Structure* addPropertyTransitionToExistingStructureConcurrently(Structure*, UniquedStringImpl* uid, unsigned attributes, PropertyOffset&);
+    JS_EXPORT_PRIVATE static Structure* addPropertyTransitionToExistingStructure(Structure*, PropertyName, unsigned attributes, PropertyOffset&);
+    static Structure* removePropertyTransition(VM&, Structure*, PropertyName, PropertyOffset&);
+    JS_EXPORT_PRIVATE static Structure* changePrototypeTransition(VM&, Structure*, JSValue prototype);
+    JS_EXPORT_PRIVATE static Structure* attributeChangeTransition(VM&, Structure*, PropertyName, unsigned attributes);
+    JS_EXPORT_PRIVATE static Structure* toCacheableDictionaryTransition(VM&, Structure*, DeferredStructureTransitionWatchpointFire* = nullptr);
+    static Structure* toUncacheableDictionaryTransition(VM&, Structure*);
+    JS_EXPORT_PRIVATE static Structure* sealTransition(VM&, Structure*);
+    JS_EXPORT_PRIVATE static Structure* freezeTransition(VM&, Structure*);
+    static Structure* preventExtensionsTransition(VM&, Structure*);
+    JS_EXPORT_PRIVATE static Structure* nonPropertyTransition(VM&, Structure*, NonPropertyTransition);
+
+    JS_EXPORT_PRIVATE bool isSealed(VM&);
+    JS_EXPORT_PRIVATE bool isFrozen(VM&);
+    bool isStructureExtensible() const { return !didPreventExtensions(); }
+
+    JS_EXPORT_PRIVATE Structure* flattenDictionaryStructure(VM&, JSObject*);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    // Versions that take a func will call it after making the change but while still holding
+    // the lock. The callback is not called if there is no change being made, like if you call
+    // removePropertyWithoutTransition() and the property is not found.
+    template<typename Func>
+    PropertyOffset addPropertyWithoutTransition(VM&, PropertyName, unsigned attributes, const Func&);
+    template<typename Func>
+    PropertyOffset removePropertyWithoutTransition(VM&, PropertyName, const Func&);
+    void setPrototypeWithoutTransition(VM& vm, JSValue prototype) { m_prototype.set(vm, this, prototype); }
+        
+    bool isDictionary() const { return dictionaryKind() != NoneDictionaryKind; }
+    bool isUncacheableDictionary() const { return dictionaryKind() == UncachedDictionaryKind; }
+  
+    bool propertyAccessesAreCacheable()
+    {
+        return dictionaryKind() != UncachedDictionaryKind
+            && !typeInfo().prohibitsPropertyCaching()
+            && !(typeInfo().getOwnPropertySlotIsImpure() && !typeInfo().newImpurePropertyFiresWatchpoints());
+    }
+
+    bool propertyAccessesAreCacheableForAbsence()
+    {
+        return !typeInfo().getOwnPropertySlotIsImpureForPropertyAbsence();
+    }
+    
+    bool needImpurePropertyWatchpoint()
+    {
+        return propertyAccessesAreCacheable()
+            && typeInfo().getOwnPropertySlotIsImpure()
+            && typeInfo().newImpurePropertyFiresWatchpoints();
+    }
+
+    bool isImmutablePrototypeExoticObject()
+    {
+        return typeInfo().isImmutablePrototypeExoticObject();
+    }
+
+    // We use SlowPath in GetByIdStatus for structures that may get new impure properties later to prevent
+    // DFG from inlining property accesses since structures don't transition when a new impure property appears.
+    bool takesSlowPathInDFGForImpureProperty()
+    {
+        return typeInfo().getOwnPropertySlotIsImpure();
+    }
+    
+    // Type accessors.
+    TypeInfo typeInfo() const { ASSERT(structure()->classInfo() == info()); return m_blob.typeInfo(m_outOfLineTypeFlags); }
+    bool isObject() const { return typeInfo().isObject(); }
+
+    IndexingType indexingType() const { return m_blob.indexingTypeIncludingHistory() & AllArrayTypes; }
+    IndexingType indexingTypeIncludingHistory() const { return m_blob.indexingTypeIncludingHistory(); }
+        
+    bool mayInterceptIndexedAccesses() const
+    {
+        return !!(indexingTypeIncludingHistory() & MayHaveIndexedAccessors);
+    }
+        
+    JS_EXPORT_PRIVATE bool anyObjectInChainMayInterceptIndexedAccesses() const;
+    bool holesMustForwardToPrototype(VM&) const;
+        
+    bool needsSlowPutIndexing() const;
+    NonPropertyTransition suggestedArrayStorageTransition() const;
+        
+    JSGlobalObject* globalObject() const { return m_globalObject.get(); }
+
+    // NOTE: This method should only be called during the creation of structures, since the global
+    // object of a structure is presumed to be immutable in a bunch of places.
+    void setGlobalObject(VM& vm, JSGlobalObject* globalObject) { m_globalObject.set(vm, this, globalObject); }
+        
+    JSValue storedPrototype() const { return m_prototype.get(); }
+    JSObject* storedPrototypeObject() const;
+    Structure* storedPrototypeStructure() const;
+    JSValue prototypeForLookup(ExecState*) const;
+    JSValue prototypeForLookup(JSGlobalObject*) const;
+    JSValue prototypeForLookup(CodeBlock*) const;
+    StructureChain* prototypeChain(VM&, JSGlobalObject*) const;
+    StructureChain* prototypeChain(ExecState*) const;
+    static void visitChildren(JSCell*, SlotVisitor&);
+    
+    // A Structure is cheap to mark during GC if doing so would only add a small and bounded amount
+    // to our heap footprint. For example, if the structure refers to a global object that is not
+    // yet marked, then as far as we know, the decision to mark this Structure would lead to a large
+    // increase in footprint because no other object refers to that global object. This method
+    // returns true if all user-controlled (and hence unbounded in size) objects referenced from the
+    // Structure are already marked.
+    bool isCheapDuringGC();
+    
+    // Returns true if this structure is now marked.
+    bool markIfCheap(SlotVisitor&);
+        
+    // Will just the prototype chain intercept this property access?
+    JS_EXPORT_PRIVATE bool prototypeChainMayInterceptStoreTo(VM&, PropertyName);
+    
+    bool hasRareData() const
+    {
+        return isRareData(m_previousOrRareData.get());
+    }
+    
+    Structure* previousID() const
+    {
+        ASSERT(structure()->classInfo() == info());
+        // This is so written because it's used concurrently. We only load from m_previousOrRareData
+        // once, and this load is guaranteed atomic.
+        JSCell* cell = m_previousOrRareData.get();
+        if (isRareData(cell))
+            return static_cast<StructureRareData*>(cell)->previousID();
+        return static_cast<Structure*>(cell);
+    }
+    bool transitivelyTransitionedFrom(Structure* structureToFind);
+    
+    PropertyOffset lastOffset() const { return m_offset; }
+    
+    void setLastOffset(PropertyOffset offset) { m_offset = offset; }
+
+    static unsigned outOfLineCapacity(PropertyOffset lastOffset)
+    {
+        unsigned outOfLineSize = Structure::outOfLineSize(lastOffset);
+
+        // This algorithm completely determines the out-of-line property storage growth algorithm.
+        // The JSObject code will only trigger a resize if the value returned by this algorithm
+        // changed between the new and old structure. So, it's important to keep this simple because
+        // it's on a fast path.
+        
+        if (!outOfLineSize)
+            return 0;
+
+        if (outOfLineSize <= initialOutOfLineCapacity)
+            return initialOutOfLineCapacity;
+
+        ASSERT(outOfLineSize > initialOutOfLineCapacity);
+        COMPILE_ASSERT(outOfLineGrowthFactor == 2, outOfLineGrowthFactor_is_two);
+        return WTF::roundUpToPowerOfTwo(outOfLineSize);
+    }
+    
+    static unsigned outOfLineSize(PropertyOffset lastOffset)
+    {
+        return numberOfOutOfLineSlotsForLastOffset(lastOffset);
+    }
+
+    unsigned outOfLineCapacity() const
+    {
+        return outOfLineCapacity(m_offset);
+    }
+    unsigned outOfLineSize() const
+    {
+        return outOfLineSize(m_offset);
+    }
+    bool hasInlineStorage() const
+    {
+        return !!m_inlineCapacity;
+    }
+    unsigned inlineCapacity() const
+    {
+        return m_inlineCapacity;
+    }
+    unsigned inlineSize() const
+    {
+        return std::min<unsigned>(m_offset + 1, m_inlineCapacity);
+    }
+    unsigned totalStorageSize() const
+    {
+        return numberOfSlotsForLastOffset(m_offset, m_inlineCapacity);
+    }
+    unsigned totalStorageCapacity() const
+    {
+        ASSERT(structure()->classInfo() == info());
+        return outOfLineCapacity() + inlineCapacity();
+    }
+
+    bool isValidOffset(PropertyOffset offset) const
+    {
+        return JSC::isValidOffset(offset)
+            && offset <= m_offset
+            && (offset < m_inlineCapacity || offset >= firstOutOfLineOffset);
+    }
+
+    bool hijacksIndexingHeader() const
+    {
+        return isTypedView(m_classInfo->typedArrayStorageType);
+    }
+    
+    bool couldHaveIndexingHeader() const
+    {
+        return hasIndexedProperties(indexingType())
+            || hijacksIndexingHeader();
+    }
+    
+    bool hasIndexingHeader(const JSCell*) const;
+    
+    bool masqueradesAsUndefined(JSGlobalObject* lexicalGlobalObject);
+
+    PropertyOffset get(VM&, PropertyName);
+    PropertyOffset get(VM&, PropertyName, unsigned& attributes);
+    PropertyOffset get(VM&, PropertyName, unsigned& attributes, bool& hasInferredType);
+
+    // This is a somewhat internalish method. It will call your functor while possibly holding the
+    // Structure's lock. There is no guarantee whether the lock is held or not in any particular
+    // call. So, you have to assume the worst. Also, the functor returns true if it wishes for you
+    // to continue or false if it's done.
+    template<typename Functor>
+    void forEachPropertyConcurrently(const Functor&);
+    
+    PropertyOffset getConcurrently(UniquedStringImpl* uid);
+    PropertyOffset getConcurrently(UniquedStringImpl* uid, unsigned& attributes);
+    
+    Vector<PropertyMapEntry> getPropertiesConcurrently();
+    
+    void setHasGetterSetterPropertiesWithProtoCheck(bool is__proto__)
+    {
+        setHasGetterSetterProperties(true);
+        if (!is__proto__)
+            setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
+    }
+    
+    void setContainsReadOnlyProperties() { setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true); }
+    
+    void setHasCustomGetterSetterPropertiesWithProtoCheck(bool is__proto__)
+    {
+        setHasCustomGetterSetterProperties(true);
+        if (!is__proto__)
+            setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
+    }
+    
+    bool isEmpty() const
+    {
+        ASSERT(checkOffsetConsistency());
+        return !JSC::isValidOffset(m_offset);
+    }
+
+    void setCachedPropertyNameEnumerator(VM&, JSPropertyNameEnumerator*);
+    JSPropertyNameEnumerator* cachedPropertyNameEnumerator() const;
+    bool canCachePropertyNameEnumerator() const;
+    bool canAccessPropertiesQuicklyForEnumeration() const;
+
+    void getPropertyNamesFromStructure(VM&, PropertyNameArray&, EnumerationMode);
+
+    JSString* objectToStringValue()
+    {
+        if (!hasRareData())
+            return 0;
+        return rareData()->objectToStringValue();
+    }
+
+    void setObjectToStringValue(ExecState*, VM&, JSString* value, PropertySlot toStringTagSymbolSlot);
+
+    const ClassInfo* classInfo() const { return m_classInfo; }
+
+    static ptrdiff_t structureIDOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_blob) + StructureIDBlob::structureIDOffset();
+    }
+
+    static ptrdiff_t prototypeOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_prototype);
+    }
+
+    static ptrdiff_t globalObjectOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_globalObject);
+    }
+
+    static ptrdiff_t classInfoOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_classInfo);
+    }
+        
+    static ptrdiff_t indexingTypeIncludingHistoryOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_blob) + StructureIDBlob::indexingTypeIncludingHistoryOffset();
+    }
+    
+    static ptrdiff_t propertyTableUnsafeOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_propertyTableUnsafe);
+    }
+
+    static ptrdiff_t inlineCapacityOffset()
+    {
+        return OBJECT_OFFSETOF(Structure, m_inlineCapacity);
+    }
+
+    static Structure* createStructure(VM&);
+        
+    bool transitionWatchpointSetHasBeenInvalidated() const
+    {
+        return m_transitionWatchpointSet.hasBeenInvalidated();
+    }
+        
+    bool transitionWatchpointSetIsStillValid() const
+    {
+        return m_transitionWatchpointSet.isStillValid();
+    }
+    
+    bool dfgShouldWatchIfPossible() const
+    {
+        // FIXME: We would like to not watch things that are unprofitable to watch, like
+        // dictionaries. Unfortunately, we can't do such things: a dictionary could get flattened,
+        // in which case it will start to appear watchable and so the DFG will think that it is
+        // watching it. We should come up with a comprehensive story for not watching things that
+        // aren't profitable to watch.
+        // https://bugs.webkit.org/show_bug.cgi?id=133625
+        
+        // - We don't watch Structures that either decided not to be watched, or whose predecessors
+        //   decided not to be watched. This happens when a transition is fired while being watched.
+        if (transitionWatchpointIsLikelyToBeFired())
+            return false;
+
+        // - Don't watch Structures that had been dictionaries.
+        if (hasBeenDictionary())
+            return false;
+        
+        return true;
+    }
+    
+    bool dfgShouldWatch() const
+    {
+        return dfgShouldWatchIfPossible() && transitionWatchpointSetIsStillValid();
+    }
+        
+    void addTransitionWatchpoint(Watchpoint* watchpoint) const
+    {
+        ASSERT(transitionWatchpointSetIsStillValid());
+        m_transitionWatchpointSet.add(watchpoint);
+    }
+    
+    void didTransitionFromThisStructure(DeferredStructureTransitionWatchpointFire* = nullptr) const;
+    
+    InlineWatchpointSet& transitionWatchpointSet() const
+    {
+        return m_transitionWatchpointSet;
+    }
+    
+    WatchpointSet* ensurePropertyReplacementWatchpointSet(VM&, PropertyOffset);
+    void startWatchingPropertyForReplacements(VM& vm, PropertyOffset offset)
+    {
+        ensurePropertyReplacementWatchpointSet(vm, offset);
+    }
+    void startWatchingPropertyForReplacements(VM&, PropertyName);
+    WatchpointSet* propertyReplacementWatchpointSet(PropertyOffset);
+    void didReplaceProperty(PropertyOffset);
+    void didCachePropertyReplacement(VM&, PropertyOffset);
+    
+    void startWatchingInternalPropertiesIfNecessary(VM& vm)
+    {
+        if (LIKELY(didWatchInternalProperties()))
+            return;
+        startWatchingInternalProperties(vm);
+    }
+    
+    void startWatchingInternalPropertiesIfNecessaryForEntireChain(VM& vm)
+    {
+        for (Structure* structure = this; structure; structure = structure->storedPrototypeStructure())
+            structure->startWatchingInternalPropertiesIfNecessary(vm);
+    }
+
+    bool hasInferredTypes() const
+    {
+        return !!m_inferredTypeTable;
+    }
+
+    InferredType* inferredTypeFor(UniquedStringImpl* uid)
+    {
+        if (InferredTypeTable* table = m_inferredTypeTable.get())
+            return table->get(uid);
+        return nullptr;
+    }
+
+    InferredType::Descriptor inferredTypeDescriptorFor(UniquedStringImpl* uid)
+    {
+        if (InferredType* result = inferredTypeFor(uid))
+            return result->descriptor();
+        return InferredType::Top;
+    }
+
+    // Call this when we know that this is a brand new property. Note that it's not enough for the
+    // property to be brand new to some object. It has to be brand new to the Structure.
+    ALWAYS_INLINE void willStoreValueForNewTransition(
+        VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
+    {
+        if (hasBeenDictionary() || (!shouldOptimize && !m_inferredTypeTable))
+            return;
+        willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::NewProperty);
+    }
+
+    // Call this when we know that this is a new property for the object, but not new for the
+    // structure. Therefore, under the InferredTypeTable's rules, absence of the property from the
+    // table means Top rather than Bottom.
+    ALWAYS_INLINE void willStoreValueForExistingTransition(
+        VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
+    {
+        if (hasBeenDictionary() || !m_inferredTypeTable)
+            return;
+        willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::NewProperty);
+    }
+
+    // Call this when we know that the inferred type table exists and has an entry for this property.
+    ALWAYS_INLINE void willStoreValueForReplace(
+        VM& vm, PropertyName propertyName, JSValue value, bool shouldOptimize)
+    {
+        if (hasBeenDictionary())
+            return;
+        willStoreValueSlow(vm, propertyName, value, shouldOptimize, InferredTypeTable::OldProperty);
+    }
+
+    PassRefPtr<StructureShape> toStructureShape(JSValue);
+    
+    // Determines if the two structures match enough that this one could be used for allocations
+    // of the other one.
+    bool canUseForAllocationsOf(Structure*);
+    
+    void dump(PrintStream&) const;
+    void dumpInContext(PrintStream&, DumpContext*) const;
+    void dumpBrief(PrintStream&, const CString&) const;
+    
+    static void dumpContextHeader(PrintStream&);
+    
+    ConcurrentJSLock& lock() { return m_lock; }
+    
+    DECLARE_EXPORT_INFO;
+
+private:
+    typedef enum { 
+        NoneDictionaryKind = 0,
+        CachedDictionaryKind = 1,
+        UncachedDictionaryKind = 2
+    } DictionaryKind;
+
+public:
+#define DEFINE_BITFIELD(type, lowerName, upperName, width, offset) \
+    static const uint32_t s_##lowerName##Shift = offset;\
+    static const uint32_t s_##lowerName##Mask = ((1 << (width - 1)) | ((1 << (width - 1)) - 1));\
+    type lowerName() const { return static_cast<type>((m_bitField >> offset) & s_##lowerName##Mask); }\
+    void set##upperName(type newValue) \
+    {\
+        m_bitField &= ~(s_##lowerName##Mask << offset);\
+        m_bitField |= (newValue & s_##lowerName##Mask) << offset;\
+    }
+
+    DEFINE_BITFIELD(DictionaryKind, dictionaryKind, DictionaryKind, 2, 0);
+    DEFINE_BITFIELD(bool, isPinnedPropertyTable, IsPinnedPropertyTable, 1, 2);
+    DEFINE_BITFIELD(bool, hasGetterSetterProperties, HasGetterSetterProperties, 1, 3);
+    DEFINE_BITFIELD(bool, hasReadOnlyOrGetterSetterPropertiesExcludingProto, HasReadOnlyOrGetterSetterPropertiesExcludingProto, 1, 4);
+    DEFINE_BITFIELD(bool, isQuickPropertyAccessAllowedForEnumeration, IsQuickPropertyAccessAllowedForEnumeration, 1, 5);
+    DEFINE_BITFIELD(unsigned, attributesInPrevious, AttributesInPrevious, 14, 6);
+    DEFINE_BITFIELD(bool, didPreventExtensions, DidPreventExtensions, 1, 20);
+    DEFINE_BITFIELD(bool, didTransition, DidTransition, 1, 21);
+    DEFINE_BITFIELD(bool, staticPropertiesReified, StaticPropertiesReified, 1, 22);
+    DEFINE_BITFIELD(bool, hasBeenFlattenedBefore, HasBeenFlattenedBefore, 1, 23);
+    DEFINE_BITFIELD(bool, hasCustomGetterSetterProperties, HasCustomGetterSetterProperties, 1, 24);
+    DEFINE_BITFIELD(bool, didWatchInternalProperties, DidWatchInternalProperties, 1, 25);
+    DEFINE_BITFIELD(bool, transitionWatchpointIsLikelyToBeFired, TransitionWatchpointIsLikelyToBeFired, 1, 26);
+    DEFINE_BITFIELD(bool, hasBeenDictionary, HasBeenDictionary, 1, 27);
+    DEFINE_BITFIELD(bool, isAddingPropertyForTransition, IsAddingPropertyForTransition, 1, 28);
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    JS_EXPORT_PRIVATE Structure(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType, unsigned inlineCapacity);
+    Structure(VM&);
+    Structure(VM&, Structure*, DeferredStructureTransitionWatchpointFire*);
+
+    static Structure* create(VM&, Structure*, DeferredStructureTransitionWatchpointFire* = nullptr);
+    
+    static Structure* addPropertyTransitionToExistingStructureImpl(Structure*, UniquedStringImpl* uid, unsigned attributes, PropertyOffset&);
+
+    // This will return the structure that has a usable property table, that property table,
+    // and the list of structures that we visited before we got to it. If it returns a
+    // non-null structure, it will also lock the structure that it returns; it is your job
+    // to unlock it.
+    void findStructuresAndMapForMaterialization(Vector<Structure*, 8>& structures, Structure*&, PropertyTable*&);
+    
+    static Structure* toDictionaryTransition(VM&, Structure*, DictionaryKind, DeferredStructureTransitionWatchpointFire* = nullptr);
+
+    enum class ShouldPin { No, Yes };
+    template<ShouldPin, typename Func>
+    PropertyOffset add(VM&, PropertyName, unsigned attributes, const Func&);
+    PropertyOffset add(VM&, PropertyName, unsigned attributes);
+    template<typename Func>
+    PropertyOffset remove(PropertyName, const Func&);
+    PropertyOffset remove(PropertyName);
+
+    void checkConsistency();
+
+    // This may grab the lock, or not. Do not call when holding the Structure's lock.
+    PropertyTable* ensurePropertyTableIfNotEmpty(VM& vm)
+    {
+        if (PropertyTable* result = m_propertyTableUnsafe.get())
+            return result;
+        if (!previousID())
+            return nullptr;
+        return materializePropertyTable(vm);
+    }
+    
+    // This may grab the lock, or not. Do not call when holding the Structure's lock.
+    PropertyTable* ensurePropertyTable(VM& vm)
+    {
+        if (PropertyTable* result = m_propertyTableUnsafe.get())
+            return result;
+        return materializePropertyTable(vm);
+    }
+    
+    PropertyTable* propertyTableOrNull() const
+    {
+        return m_propertyTableUnsafe.get();
+    }
+    
+    // This will grab the lock. Do not call when holding the Structure's lock.
+    JS_EXPORT_PRIVATE PropertyTable* materializePropertyTable(VM&, bool setPropertyTable = true);
+    
+    void setPropertyTable(VM& vm, PropertyTable* table);
+    
+    PropertyTable* takePropertyTableOrCloneIfPinned(VM&);
+    PropertyTable* copyPropertyTableForPinning(VM&);
+
+    void setPreviousID(VM& vm, Structure* structure)
+    {
+        if (hasRareData())
+            rareData()->setPreviousID(vm, structure);
+        else
+            m_previousOrRareData.set(vm, this, structure);
+    }
+
+    void clearPreviousID()
+    {
+        if (hasRareData())
+            rareData()->clearPreviousID();
+        else
+            m_previousOrRareData.clear();
+    }
+
+    int transitionCount() const
+    {
+        // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
+        return numberOfSlotsForLastOffset(m_offset, m_inlineCapacity);
+    }
+
+    bool isValid(JSGlobalObject*, StructureChain* cachedPrototypeChain) const;
+    bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
+
+    // You have to hold the structure lock to do these.
+    JS_EXPORT_PRIVATE void pin(const AbstractLocker&, VM&, PropertyTable*);
+    void pinForCaching(const AbstractLocker&, VM&, PropertyTable*);
+    
+    bool isRareData(JSCell* cell) const
+    {
+        return cell && cell->structureID() != structureID();
+    }
+
+    StructureRareData* rareData() const
+    {
+        ASSERT(hasRareData());
+        return static_cast<StructureRareData*>(m_previousOrRareData.get());
+    }
+
+    template<typename DetailsFunc>
+    bool checkOffsetConsistency(PropertyTable*, const DetailsFunc&) const;
+    bool checkOffsetConsistency() const;
+
+    JS_EXPORT_PRIVATE void allocateRareData(VM&);
+    
+    void startWatchingInternalProperties(VM&);
+
+    JS_EXPORT_PRIVATE void willStoreValueSlow(
+        VM&, PropertyName, JSValue, bool, InferredTypeTable::StoredPropertyAge);
+
+    static const int s_maxTransitionLength = 64;
+    static const int s_maxTransitionLengthForNonEvalPutById = 512;
+
+    // These need to be properly aligned at the beginning of the 'Structure'
+    // part of the object.
+    StructureIDBlob m_blob;
+    TypeInfo::OutOfLineTypeFlags m_outOfLineTypeFlags;
+
+    WriteBarrier<JSGlobalObject> m_globalObject;
+    WriteBarrier<Unknown> m_prototype;
+    mutable WriteBarrier<StructureChain> m_cachedPrototypeChain;
+
+    WriteBarrier<JSCell> m_previousOrRareData;
+
+    RefPtr<UniquedStringImpl> m_nameInPrevious;
+
+    const ClassInfo* m_classInfo;
+
+    StructureTransitionTable m_transitionTable;
+
+    // Should be accessed through ensurePropertyTable(). During GC, it may be set to 0 by another thread.
+    // During a Heap Snapshot GC we avoid clearing the table so it is safe to use.
+    WriteBarrier<PropertyTable> m_propertyTableUnsafe;
+
+    WriteBarrier<InferredTypeTable> m_inferredTypeTable;
+
+    mutable InlineWatchpointSet m_transitionWatchpointSet;
+
+    COMPILE_ASSERT(firstOutOfLineOffset < 256, firstOutOfLineOffset_fits);
+
+    // m_offset does not account for anonymous slots
+    PropertyOffset m_offset;
+
+    uint8_t m_inlineCapacity;
+    
+    ConcurrentJSLock m_lock;
+    
+    uint32_t m_bitField;
+};
+
+} // namespace JSC
diff --git a/runtime/StructureChain.cpp b/runtime/StructureChain.cpp
new file mode 100644
index 0000000..eebfe20
--- /dev/null
+++ b/runtime/StructureChain.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "StructureChain.h"
+
+#include "JSObject.h"
+#include "JSCInlines.h"
+#include "Structure.h"
+
+namespace JSC {
+    
+const ClassInfo StructureChain::s_info = { "StructureChain", 0, 0, CREATE_METHOD_TABLE(StructureChain) };
+
+StructureChain::StructureChain(VM& vm, Structure* structure)
+    : JSCell(vm, structure)
+{
+}
+
+void StructureChain::destroy(JSCell* cell)
+{
+    static_cast<StructureChain*>(cell)->StructureChain::~StructureChain();
+}
+
+void StructureChain::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    StructureChain* thisObject = jsCast<StructureChain*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    if (WriteBarrier<Structure>* vector = thisObject->m_vector.get()) {
+        size_t i = 0;
+        while (vector[i])
+            visitor.append(vector[i++]);
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/StructureChain.h b/runtime/StructureChain.h
new file mode 100644
index 0000000..04eb1c0
--- /dev/null
+++ b/runtime/StructureChain.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "JSObject.h"
+#include "Structure.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+class LLIntOffsetsExtractor;
+class Structure;
+
+class StructureChain final : public JSCell {
+    friend class JIT;
+
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static StructureChain* create(VM& vm, Structure* head)
+    { 
+        StructureChain* chain = new (NotNull, allocateCell<StructureChain>(vm.heap)) StructureChain(vm, vm.structureChainStructure.get());
+        chain->finishCreation(vm, head);
+        return chain;
+    }
+    WriteBarrier<Structure>* head() { return m_vector.get(); }
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    DECLARE_INFO;
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+protected:
+    void finishCreation(VM& vm, Structure* head)
+    {
+        Base::finishCreation(vm);
+        size_t size = 0;
+        for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
+            ++size;
+
+        std::unique_ptr<WriteBarrier<Structure>[]> vector = std::make_unique<WriteBarrier<Structure>[]>(size + 1);
+
+        size_t i = 0;
+        for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
+            vector[i++].set(vm, this, current);
+        
+        vm.heap.mutatorFence();
+        m_vector = WTFMove(vector);
+    }
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    StructureChain(VM&, Structure*);
+    std::unique_ptr<WriteBarrier<Structure>[]> m_vector;
+};
+
+} // namespace JSC
diff --git a/runtime/StructureIDBlob.h b/runtime/StructureIDBlob.h
new file mode 100644
index 0000000..51564ca
--- /dev/null
+++ b/runtime/StructureIDBlob.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CellState.h"
+#include "IndexingType.h"
+#include "JSTypeInfo.h"
+#include "StructureIDTable.h"
+
+namespace JSC {
+
+class StructureIDBlob {
+    friend class LLIntOffsetsExtractor;
+public:
+    StructureIDBlob()
+    {
+        u.doubleWord = 0xbbadbeef;
+    }
+
+    StructureIDBlob(StructureID structureID, IndexingType indexingTypeIncludingHistory, const TypeInfo& typeInfo)
+    {
+        u.fields.structureID = structureID;
+        u.fields.indexingTypeIncludingHistory = indexingTypeIncludingHistory;
+        u.fields.type = typeInfo.type();
+        u.fields.inlineTypeFlags = typeInfo.inlineTypeFlags();
+        u.fields.defaultCellState = CellState::DefinitelyWhite;
+    }
+
+    void operator=(const StructureIDBlob& other) { u.doubleWord = other.u.doubleWord; }
+    
+    StructureID structureID() const { return u.fields.structureID; }
+    IndexingType indexingTypeIncludingHistory() const { return u.fields.indexingTypeIncludingHistory; }
+    void setIndexingTypeIncludingHistory(IndexingType indexingTypeIncludingHistory) { u.fields.indexingTypeIncludingHistory = indexingTypeIncludingHistory; }
+    JSType type() const { return u.fields.type; }
+    TypeInfo::InlineTypeFlags inlineTypeFlags() const { return u.fields.inlineTypeFlags; }
+    
+    TypeInfo typeInfo(TypeInfo::OutOfLineTypeFlags outOfLineTypeFlags) const { return TypeInfo(type(), inlineTypeFlags(), outOfLineTypeFlags); }
+    
+    int32_t blobExcludingStructureID() const { return u.words.word2; }
+    int64_t blob() const { return u.doubleWord; }
+    
+    static ptrdiff_t structureIDOffset()
+    {
+        return OBJECT_OFFSETOF(StructureIDBlob, u.fields.structureID);
+    }
+
+    static ptrdiff_t indexingTypeIncludingHistoryOffset()
+    {
+        return OBJECT_OFFSETOF(StructureIDBlob, u.fields.indexingTypeIncludingHistory);
+    }
+
+private:
+    union {
+        struct {
+            StructureID structureID;
+            IndexingType indexingTypeIncludingHistory;
+            JSType type;
+            TypeInfo::InlineTypeFlags inlineTypeFlags;
+            CellState defaultCellState;
+        } fields;
+        struct {
+            int32_t word1;
+            int32_t word2;
+        } words;
+        int64_t doubleWord;
+    } u;
+};
+
+} // namespace JSC
diff --git a/runtime/StructureIDTable.cpp b/runtime/StructureIDTable.cpp
new file mode 100644
index 0000000..a2025af
--- /dev/null
+++ b/runtime/StructureIDTable.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StructureIDTable.h"
+
+#include <limits.h>
+#include <wtf/Atomics.h>
+
+namespace JSC {
+
+StructureIDTable::StructureIDTable()
+    : m_firstFreeOffset(0)
+    , m_table(std::make_unique<StructureOrOffset[]>(s_initialSize))
+    , m_size(0)
+    , m_capacity(s_initialSize)
+{
+    // We pre-allocate the first offset so that the null Structure
+    // can still be represented as the StructureID '0'.
+    allocateID(0);
+}
+
+void StructureIDTable::resize(size_t newCapacity)
+{
+    // Create the new table.
+    auto newTable = std::make_unique<StructureOrOffset[]>(newCapacity);
+
+    // Copy the contents of the old table to the new table.
+    memcpy(newTable.get(), table(), m_capacity * sizeof(StructureOrOffset));
+
+    // Store fence to make sure we've copied everything before doing the swap.
+    WTF::storeStoreFence();
+
+    // Swap the old and new tables.
+    swap(m_table, newTable);
+
+    // Put the old table (now labeled as new) into the list of old tables.
+    m_oldTables.append(WTFMove(newTable));
+
+    // Update the capacity.
+    m_capacity = newCapacity;
+}
+
+void StructureIDTable::flushOldTables()
+{
+    m_oldTables.clear();
+}
+
+StructureID StructureIDTable::allocateID(Structure* structure)
+{
+#if USE(JSVALUE64)
+    if (!m_firstFreeOffset) {
+        RELEASE_ASSERT(m_capacity <= UINT_MAX);
+        if (m_size == m_capacity)
+            resize(m_capacity * 2);
+        ASSERT(m_size < m_capacity);
+
+        StructureOrOffset newEntry;
+        newEntry.structure = structure;
+
+        if (m_size == s_unusedID) {
+            m_size++;
+            return allocateID(structure);
+        }
+
+        StructureID result = m_size;
+        table()[result] = newEntry;
+        m_size++;
+        ASSERT(!isNuked(result));
+        return result;
+    }
+
+    ASSERT(m_firstFreeOffset != s_unusedID);
+
+    StructureID result = m_firstFreeOffset;
+    m_firstFreeOffset = table()[m_firstFreeOffset].offset;
+    table()[result].structure = structure;
+    ASSERT(!isNuked(result));
+    return result;
+#else
+    ASSERT(!isNuked(structure));
+    return structure;
+#endif
+}
+
+void StructureIDTable::deallocateID(Structure* structure, StructureID structureID)
+{
+#if USE(JSVALUE64)
+    ASSERT(structureID != s_unusedID);
+    RELEASE_ASSERT(table()[structureID].structure == structure);
+    table()[structureID].offset = m_firstFreeOffset;
+    m_firstFreeOffset = structureID;
+#else
+    UNUSED_PARAM(structure);
+    UNUSED_PARAM(structureID);
+#endif
+}
+
+} // namespace JSC
diff --git a/runtime/StructureIDTable.h b/runtime/StructureIDTable.h
new file mode 100644
index 0000000..a2c58df
--- /dev/null
+++ b/runtime/StructureIDTable.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "UnusedPointer.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class Structure;
+
+#if USE(JSVALUE64)
+typedef uint32_t StructureID;
+
+inline StructureID nukedStructureIDBit()
+{
+    return 0x80000000u;
+}
+
+inline StructureID nuke(StructureID id)
+{
+    return id | nukedStructureIDBit();
+}
+
+inline bool isNuked(StructureID id)
+{
+    return !!(id & nukedStructureIDBit());
+}
+
+inline StructureID decontaminate(StructureID id)
+{
+    return id & ~nukedStructureIDBit();
+}
+#else
+typedef Structure* StructureID;
+
+inline StructureID nukedStructureIDBit()
+{
+    return bitwise_cast<StructureID>(static_cast<uintptr_t>(1));
+}
+
+inline StructureID nuke(StructureID id)
+{
+    return bitwise_cast<StructureID>(bitwise_cast<uintptr_t>(id) | bitwise_cast<uintptr_t>(nukedStructureIDBit()));
+}
+
+inline bool isNuked(StructureID id)
+{
+    return !!(bitwise_cast<uintptr_t>(id) & bitwise_cast<uintptr_t>(nukedStructureIDBit()));
+}
+
+inline StructureID decontaminate(StructureID id)
+{
+    return bitwise_cast<StructureID>(bitwise_cast<uintptr_t>(id) & ~bitwise_cast<uintptr_t>(nukedStructureIDBit()));
+}
+#endif
+
+class StructureIDTable {
+    friend class LLIntOffsetsExtractor;
+public:
+    StructureIDTable();
+
+    void** base() { return reinterpret_cast<void**>(&m_table); }
+
+    Structure* get(StructureID);
+    void deallocateID(Structure*, StructureID);
+    StructureID allocateID(Structure*);
+
+    void flushOldTables();
+    
+    size_t size() const { return m_size; }
+
+private:
+    void resize(size_t newCapacity);
+
+    union StructureOrOffset {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        Structure* structure;
+        StructureID offset;
+    };
+
+    StructureOrOffset* table() const { return m_table.get(); }
+    
+    static const size_t s_initialSize = 256;
+
+    Vector<std::unique_ptr<StructureOrOffset[]>> m_oldTables;
+
+    uint32_t m_firstFreeOffset;
+    std::unique_ptr<StructureOrOffset[]> m_table;
+
+    size_t m_size;
+    size_t m_capacity;
+
+#if USE(JSVALUE64)
+    static const StructureID s_unusedID = unusedPointer;
+#endif
+};
+
+inline Structure* StructureIDTable::get(StructureID structureID)
+{
+#if USE(JSVALUE64)
+    ASSERT_WITH_SECURITY_IMPLICATION(structureID);
+    ASSERT_WITH_SECURITY_IMPLICATION(!isNuked(structureID));
+    ASSERT_WITH_SECURITY_IMPLICATION(structureID < m_capacity);
+    return table()[structureID].structure;
+#else
+    return structureID;
+#endif
+}
+
+} // namespace JSC
diff --git a/runtime/StructureInlines.h b/runtime/StructureInlines.h
new file mode 100644
index 0000000..c83113c
--- /dev/null
+++ b/runtime/StructureInlines.h
@@ -0,0 +1,408 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSArrayBufferView.h"
+#include "JSCJSValueInlines.h"
+#include "JSGlobalObject.h"
+#include "PropertyMapHashTable.h"
+#include "Structure.h"
+#include "StructureChain.h"
+
+namespace JSC {
+
+inline Structure* Structure::create(VM& vm, JSGlobalObject* globalObject, JSValue prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
+{
+    ASSERT(vm.structureStructure);
+    ASSERT(classInfo);
+    Structure* structure = new (NotNull, allocateCell<Structure>(vm.heap)) Structure(vm, globalObject, prototype, typeInfo, classInfo, indexingType, inlineCapacity);
+    structure->finishCreation(vm);
+    return structure;
+}
+
+inline Structure* Structure::createStructure(VM& vm)
+{
+    ASSERT(!vm.structureStructure);
+    Structure* structure = new (NotNull, allocateCell<Structure>(vm.heap)) Structure(vm);
+    structure->finishCreation(vm, CreatingEarlyCell);
+    return structure;
+}
+
+inline Structure* Structure::create(VM& vm, Structure* structure, DeferredStructureTransitionWatchpointFire* deferred)
+{
+    ASSERT(vm.structureStructure);
+    Structure* newStructure = new (NotNull, allocateCell<Structure>(vm.heap)) Structure(vm, structure, deferred);
+    newStructure->finishCreation(vm);
+    return newStructure;
+}
+
+inline JSObject* Structure::storedPrototypeObject() const
+{
+    JSValue value = m_prototype.get();
+    if (value.isNull())
+        return nullptr;
+    return asObject(value);
+}
+
+inline Structure* Structure::storedPrototypeStructure() const
+{
+    JSObject* object = storedPrototypeObject();
+    if (!object)
+        return nullptr;
+    return object->structure();
+}
+
+ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName)
+{
+    unsigned attributes;
+    bool hasInferredType;
+    return get(vm, propertyName, attributes, hasInferredType);
+}
+    
+ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes)
+{
+    bool hasInferredType;
+    return get(vm, propertyName, attributes, hasInferredType);
+}
+
+ALWAYS_INLINE PropertyOffset Structure::get(VM& vm, PropertyName propertyName, unsigned& attributes, bool& hasInferredType)
+{
+    ASSERT(!isCompilationThread());
+    ASSERT(structure()->classInfo() == info());
+
+    PropertyTable* propertyTable = ensurePropertyTableIfNotEmpty(vm);
+    if (!propertyTable)
+        return invalidOffset;
+
+    PropertyMapEntry* entry = propertyTable->get(propertyName.uid());
+    if (!entry)
+        return invalidOffset;
+
+    attributes = entry->attributes;
+    hasInferredType = entry->hasInferredType;
+    return entry->offset;
+}
+
+template<typename Functor>
+void Structure::forEachPropertyConcurrently(const Functor& functor)
+{
+    Vector<Structure*, 8> structures;
+    Structure* structure;
+    PropertyTable* table;
+    
+    findStructuresAndMapForMaterialization(structures, structure, table);
+    
+    if (table) {
+        for (auto& entry : *table) {
+            if (!functor(entry)) {
+                structure->m_lock.unlock();
+                return;
+            }
+        }
+        structure->m_lock.unlock();
+    }
+    
+    for (unsigned i = structures.size(); i--;) {
+        structure = structures[i];
+        if (!structure->m_nameInPrevious)
+            continue;
+        
+        if (!functor(PropertyMapEntry(structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious())))
+            return;
+    }
+}
+
+inline PropertyOffset Structure::getConcurrently(UniquedStringImpl* uid)
+{
+    unsigned attributesIgnored;
+    return getConcurrently(uid, attributesIgnored);
+}
+
+inline bool Structure::hasIndexingHeader(const JSCell* cell) const
+{
+    if (hasIndexedProperties(indexingType()))
+        return true;
+    
+    if (!isTypedView(typedArrayTypeForType(m_blob.type())))
+        return false;
+    
+    return jsCast<const JSArrayBufferView*>(cell)->mode() == WastefulTypedArray;
+}
+
+inline bool Structure::masqueradesAsUndefined(JSGlobalObject* lexicalGlobalObject)
+{
+    return typeInfo().masqueradesAsUndefined() && globalObject() == lexicalGlobalObject;
+}
+
+inline bool Structure::transitivelyTransitionedFrom(Structure* structureToFind)
+{
+    for (Structure* current = this; current; current = current->previousID()) {
+        if (current == structureToFind)
+            return true;
+    }
+    return false;
+}
+
+inline JSValue Structure::prototypeForLookup(JSGlobalObject* globalObject) const
+{
+    if (isObject())
+        return m_prototype.get();
+    if (typeInfo().type() == SymbolType)
+        return globalObject->symbolPrototype();
+
+    ASSERT(typeInfo().type() == StringType);
+    return globalObject->stringPrototype();
+}
+
+inline JSValue Structure::prototypeForLookup(ExecState* exec) const
+{
+    return prototypeForLookup(exec->lexicalGlobalObject());
+}
+
+inline StructureChain* Structure::prototypeChain(VM& vm, JSGlobalObject* globalObject) const
+{
+    // We cache our prototype chain so our clients can share it.
+    if (!isValid(globalObject, m_cachedPrototypeChain.get())) {
+        JSValue prototype = prototypeForLookup(globalObject);
+        m_cachedPrototypeChain.set(vm, this, StructureChain::create(vm, prototype.isNull() ? 0 : asObject(prototype)->structure()));
+    }
+    return m_cachedPrototypeChain.get();
+}
+
+inline StructureChain* Structure::prototypeChain(ExecState* exec) const
+{
+    return prototypeChain(exec->vm(), exec->lexicalGlobalObject());
+}
+
+inline bool Structure::isValid(JSGlobalObject* globalObject, StructureChain* cachedPrototypeChain) const
+{
+    if (!cachedPrototypeChain)
+        return false;
+
+    JSValue prototype = prototypeForLookup(globalObject);
+    WriteBarrier<Structure>* cachedStructure = cachedPrototypeChain->head();
+    while (*cachedStructure && !prototype.isNull()) {
+        if (asObject(prototype)->structure() != cachedStructure->get())
+            return false;
+        ++cachedStructure;
+        prototype = asObject(prototype)->getPrototypeDirect();
+    }
+    return prototype.isNull() && !*cachedStructure;
+}
+
+inline bool Structure::isValid(ExecState* exec, StructureChain* cachedPrototypeChain) const
+{
+    return isValid(exec->lexicalGlobalObject(), cachedPrototypeChain);
+}
+
+inline void Structure::didReplaceProperty(PropertyOffset offset)
+{
+    if (LIKELY(!hasRareData()))
+        return;
+    StructureRareData::PropertyWatchpointMap* map = rareData()->m_replacementWatchpointSets.get();
+    if (LIKELY(!map))
+        return;
+    WatchpointSet* set = map->get(offset);
+    if (LIKELY(!set))
+        return;
+    set->fireAll(*vm(), "Property did get replaced");
+}
+
+inline WatchpointSet* Structure::propertyReplacementWatchpointSet(PropertyOffset offset)
+{
+    ConcurrentJSLocker locker(m_lock);
+    if (!hasRareData())
+        return nullptr;
+    WTF::loadLoadFence();
+    StructureRareData::PropertyWatchpointMap* map = rareData()->m_replacementWatchpointSets.get();
+    if (!map)
+        return nullptr;
+    return map->get(offset);
+}
+
+template<typename DetailsFunc>
+ALWAYS_INLINE bool Structure::checkOffsetConsistency(PropertyTable* propertyTable, const DetailsFunc& detailsFunc) const
+{
+    // We cannot reliably assert things about the property table in the concurrent
+    // compilation thread. It is possible for the table to be stolen and then have
+    // things added to it, which leads to the offsets being all messed up. We could
+    // get around this by grabbing a lock here, but I think that would be overkill.
+    if (isCompilationThread())
+        return true;
+    
+    unsigned totalSize = propertyTable->propertyStorageSize();
+    unsigned inlineOverflowAccordingToTotalSize = totalSize < m_inlineCapacity ? 0 : totalSize - m_inlineCapacity;
+
+    auto fail = [&] (const char* description) {
+        dataLog("Detected offset inconsistency: ", description, "!\n");
+        dataLog("this = ", RawPointer(this), "\n");
+        dataLog("m_offset = ", m_offset, "\n");
+        dataLog("m_inlineCapacity = ", m_inlineCapacity, "\n");
+        dataLog("propertyTable = ", RawPointer(propertyTable), "\n");
+        dataLog("numberOfSlotsForLastOffset = ", numberOfSlotsForLastOffset(m_offset, m_inlineCapacity), "\n");
+        dataLog("totalSize = ", totalSize, "\n");
+        dataLog("inlineOverflowAccordingToTotalSize = ", inlineOverflowAccordingToTotalSize, "\n");
+        dataLog("numberOfOutOfLineSlotsForLastOffset = ", numberOfOutOfLineSlotsForLastOffset(m_offset), "\n");
+        detailsFunc();
+        UNREACHABLE_FOR_PLATFORM();
+    };
+    
+    if (numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) != totalSize)
+        fail("numberOfSlotsForLastOffset doesn't match totalSize");
+    if (inlineOverflowAccordingToTotalSize != numberOfOutOfLineSlotsForLastOffset(m_offset))
+        fail("inlineOverflowAccordingToTotalSize doesn't match numberOfOutOfLineSlotsForLastOffset");
+
+    return true;
+}
+
+ALWAYS_INLINE bool Structure::checkOffsetConsistency() const
+{
+    PropertyTable* propertyTable = propertyTableOrNull();
+
+    if (!propertyTable) {
+        ASSERT(!isPinnedPropertyTable());
+        return true;
+    }
+
+    // We cannot reliably assert things about the property table in the concurrent
+    // compilation thread. It is possible for the table to be stolen and then have
+    // things added to it, which leads to the offsets being all messed up. We could
+    // get around this by grabbing a lock here, but I think that would be overkill.
+    if (isCompilationThread())
+        return true;
+
+    return checkOffsetConsistency(propertyTable, [] () { });
+}
+
+inline void Structure::checkConsistency()
+{
+    checkOffsetConsistency();
+}
+
+inline size_t nextOutOfLineStorageCapacity(size_t currentCapacity)
+{
+    if (!currentCapacity)
+        return initialOutOfLineCapacity;
+    return currentCapacity * outOfLineGrowthFactor;
+}
+
+inline void Structure::setObjectToStringValue(ExecState* exec, VM& vm, JSString* value, PropertySlot toStringTagSymbolSlot)
+{
+    if (!hasRareData())
+        allocateRareData(vm);
+    rareData()->setObjectToStringValue(exec, vm, this, value, toStringTagSymbolSlot);
+}
+
+template<Structure::ShouldPin shouldPin, typename Func>
+inline PropertyOffset Structure::add(VM& vm, PropertyName propertyName, unsigned attributes, const Func& func)
+{
+    PropertyTable* table = ensurePropertyTable(vm);
+
+    GCSafeConcurrentJSLocker locker(m_lock, vm.heap);
+
+    switch (shouldPin) {
+    case ShouldPin::Yes:
+        pin(locker, vm, table);
+        break;
+    case ShouldPin::No:
+        setPropertyTable(vm, table);
+        break;
+    }
+    
+    ASSERT(!JSC::isValidOffset(get(vm, propertyName)));
+
+    checkConsistency();
+    if (attributes & DontEnum || propertyName.isSymbol())
+        setIsQuickPropertyAccessAllowedForEnumeration(false);
+
+    auto rep = propertyName.uid();
+
+    PropertyOffset newOffset = table->nextOffset(m_inlineCapacity);
+    
+    PropertyOffset newLastOffset = m_offset;
+    table->add(PropertyMapEntry(rep, newOffset, attributes), newLastOffset, PropertyTable::PropertyOffsetMayChange);
+    
+    func(locker, newOffset, newLastOffset);
+    
+    ASSERT(m_offset == newLastOffset);
+
+    checkConsistency();
+    return newOffset;
+}
+
+template<typename Func>
+inline PropertyOffset Structure::remove(PropertyName propertyName, const Func& func)
+{
+    ConcurrentJSLocker locker(m_lock);
+    
+    checkConsistency();
+
+    auto rep = propertyName.uid();
+    
+    // We ONLY remove from uncacheable dictionaries, which will have a pinned property table.
+    // The only way for them not to have a table is if they are empty.
+    PropertyTable* table = propertyTableOrNull();
+
+    if (!table)
+        return invalidOffset;
+
+    PropertyTable::find_iterator position = table->find(rep);
+    if (!position.first)
+        return invalidOffset;
+    
+    PropertyOffset offset = position.first->offset;
+
+    table->remove(position);
+    table->addDeletedOffset(offset);
+
+    checkConsistency();
+
+    func(locker, offset);
+    return offset;
+}
+
+template<typename Func>
+inline PropertyOffset Structure::addPropertyWithoutTransition(VM& vm, PropertyName propertyName, unsigned attributes, const Func& func)
+{
+    return add<ShouldPin::Yes>(vm, propertyName, attributes, func);
+}
+
+template<typename Func>
+inline PropertyOffset Structure::removePropertyWithoutTransition(VM&, PropertyName propertyName, const Func& func)
+{
+    ASSERT(isUncacheableDictionary());
+    ASSERT(isPinnedPropertyTable());
+    ASSERT(propertyTableOrNull());
+    
+    return remove(propertyName, func);
+}
+
+inline void Structure::setPropertyTable(VM& vm, PropertyTable* table)
+{
+    m_propertyTableUnsafe.setMayBeNull(vm, this, table);
+}
+    
+} // namespace JSC
diff --git a/runtime/StructureRareData.cpp b/runtime/StructureRareData.cpp
new file mode 100644
index 0000000..bc75e14
--- /dev/null
+++ b/runtime/StructureRareData.cpp
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StructureRareData.h"
+
+#include "AdaptiveInferredPropertyValueWatchpointBase.h"
+#include "JSPropertyNameEnumerator.h"
+#include "JSString.h"
+#include "JSCInlines.h"
+#include "ObjectPropertyConditionSet.h"
+
+namespace JSC {
+
+const ClassInfo StructureRareData::s_info = { "StructureRareData", 0, 0, CREATE_METHOD_TABLE(StructureRareData) };
+
+Structure* StructureRareData::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+StructureRareData* StructureRareData::create(VM& vm, Structure* previous)
+{
+    StructureRareData* rareData = new (NotNull, allocateCell<StructureRareData>(vm.heap)) StructureRareData(vm, previous);
+    rareData->finishCreation(vm);
+    return rareData;
+}
+
+void StructureRareData::destroy(JSCell* cell)
+{
+    static_cast<StructureRareData*>(cell)->StructureRareData::~StructureRareData();
+}
+
+StructureRareData::StructureRareData(VM& vm, Structure* previous)
+    : JSCell(vm, vm.structureRareDataStructure.get())
+    , m_giveUpOnObjectToStringValueCache(false)
+{
+    if (previous)
+        m_previous.set(vm, this, previous);
+}
+
+void StructureRareData::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    StructureRareData* thisObject = jsCast<StructureRareData*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    JSCell::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_previous);
+    visitor.append(thisObject->m_objectToStringValue);
+    visitor.append(thisObject->m_cachedPropertyNameEnumerator);
+}
+
+JSPropertyNameEnumerator* StructureRareData::cachedPropertyNameEnumerator() const
+{
+    return m_cachedPropertyNameEnumerator.get();
+}
+
+void StructureRareData::setCachedPropertyNameEnumerator(VM& vm, JSPropertyNameEnumerator* enumerator)
+{
+    m_cachedPropertyNameEnumerator.set(vm, this, enumerator);
+}
+
+// ----------- Object.prototype.toString() helper watchpoint classes -----------
+
+class ObjectToStringAdaptiveInferredPropertyValueWatchpoint : public AdaptiveInferredPropertyValueWatchpointBase {
+public:
+    typedef AdaptiveInferredPropertyValueWatchpointBase Base;
+    ObjectToStringAdaptiveInferredPropertyValueWatchpoint(const ObjectPropertyCondition&, StructureRareData*);
+
+private:
+    void handleFire(const FireDetail&) override;
+
+    StructureRareData* m_structureRareData;
+};
+
+class ObjectToStringAdaptiveStructureWatchpoint : public Watchpoint {
+public:
+    ObjectToStringAdaptiveStructureWatchpoint(const ObjectPropertyCondition&, StructureRareData*);
+
+    void install();
+
+protected:
+    void fireInternal(const FireDetail&) override;
+    
+private:
+    ObjectPropertyCondition m_key;
+    StructureRareData* m_structureRareData;
+};
+
+void StructureRareData::setObjectToStringValue(ExecState* exec, VM& vm, Structure* ownStructure, JSString* value, PropertySlot toStringTagSymbolSlot)
+{
+    if (m_giveUpOnObjectToStringValueCache)
+        return;
+
+    ObjectPropertyConditionSet conditionSet;
+    if (toStringTagSymbolSlot.isValue()) {
+        // We don't handle the own property case of Symbol.toStringTag because we would never know if a new
+        // object transitioning to the same structure had the same value stored in Symbol.toStringTag.
+        // Additionally, this is a super unlikely case anyway.
+        if (!toStringTagSymbolSlot.isCacheable() || toStringTagSymbolSlot.slotBase()->structure(vm) == ownStructure)
+            return;
+
+
+        // This will not create a condition for the current structure but that is good because we know the Symbol.toStringTag
+        // is not on the ownStructure so we will transisition if one is added and this cache will no longer be used.
+        conditionSet = generateConditionsForPrototypePropertyHit(vm, this, exec, ownStructure, toStringTagSymbolSlot.slotBase(), vm.propertyNames->toStringTagSymbol.impl());
+        ASSERT(!conditionSet.isValid() || conditionSet.hasOneSlotBaseCondition());
+    } else if (toStringTagSymbolSlot.isUnset())
+        conditionSet = generateConditionsForPropertyMiss(vm, this, exec, ownStructure, vm.propertyNames->toStringTagSymbol.impl());
+    else
+        return;
+
+    if (!conditionSet.isValid()) {
+        m_giveUpOnObjectToStringValueCache = true;
+        return;
+    }
+
+    ObjectPropertyCondition equivCondition;
+    for (const ObjectPropertyCondition& condition : conditionSet) {
+        if (condition.condition().kind() == PropertyCondition::Presence) {
+            ASSERT(isValidOffset(condition.offset()));
+            condition.object()->structure(vm)->startWatchingPropertyForReplacements(vm, condition.offset());
+            equivCondition = condition.attemptToMakeEquivalenceWithoutBarrier();
+
+            // The equivalence condition won't be watchable if we have already seen a replacement.
+            if (!equivCondition.isWatchable()) {
+                m_giveUpOnObjectToStringValueCache = true;
+                return;
+            }
+        } else if (!condition.isWatchable()) {
+            m_giveUpOnObjectToStringValueCache = true;
+            return;
+        }
+    }
+
+    ASSERT(conditionSet.structuresEnsureValidity());
+    for (ObjectPropertyCondition condition : conditionSet) {
+        if (condition.condition().kind() == PropertyCondition::Presence) {
+            m_objectToStringAdaptiveInferredValueWatchpoint = std::make_unique<ObjectToStringAdaptiveInferredPropertyValueWatchpoint>(equivCondition, this);
+            m_objectToStringAdaptiveInferredValueWatchpoint->install();
+        } else
+            m_objectToStringAdaptiveWatchpointSet.add(condition, this)->install();
+    }
+
+    m_objectToStringValue.set(vm, this, value);
+}
+
+inline void StructureRareData::clearObjectToStringValue()
+{
+    m_objectToStringAdaptiveWatchpointSet.clear();
+    m_objectToStringAdaptiveInferredValueWatchpoint.reset();
+    m_objectToStringValue.clear();
+}
+
+// ------------- Methods for Object.prototype.toString() helper watchpoint classes --------------
+
+ObjectToStringAdaptiveStructureWatchpoint::ObjectToStringAdaptiveStructureWatchpoint(const ObjectPropertyCondition& key, StructureRareData* structureRareData)
+    : m_key(key)
+    , m_structureRareData(structureRareData)
+{
+    RELEASE_ASSERT(key.watchingRequiresStructureTransitionWatchpoint());
+    RELEASE_ASSERT(!key.watchingRequiresReplacementWatchpoint());
+}
+
+void ObjectToStringAdaptiveStructureWatchpoint::install()
+{
+    RELEASE_ASSERT(m_key.isWatchable());
+
+    m_key.object()->structure()->addTransitionWatchpoint(this);
+}
+
+void ObjectToStringAdaptiveStructureWatchpoint::fireInternal(const FireDetail& detail)
+{
+    if (m_key.isWatchable(PropertyCondition::EnsureWatchability)) {
+        install();
+        return;
+    }
+
+    StringPrintStream out;
+    out.print("ObjectToStringValue Adaptation of ", m_key, " failed: ", detail);
+
+    StringFireDetail stringDetail(out.toCString().data());
+
+    m_structureRareData->clearObjectToStringValue();
+}
+
+ObjectToStringAdaptiveInferredPropertyValueWatchpoint::ObjectToStringAdaptiveInferredPropertyValueWatchpoint(const ObjectPropertyCondition& key, StructureRareData* structureRareData)
+    : Base(key)
+    , m_structureRareData(structureRareData)
+{
+}
+
+void ObjectToStringAdaptiveInferredPropertyValueWatchpoint::handleFire(const FireDetail& detail)
+{
+    StringPrintStream out;
+    out.print("Adaptation of ", key(), " failed: ", detail);
+    
+    StringFireDetail stringDetail(out.toCString().data());
+    
+    m_structureRareData->clearObjectToStringValue();
+}
+
+} // namespace JSC
diff --git a/runtime/StructureRareData.h b/runtime/StructureRareData.h
new file mode 100644
index 0000000..6fcab37
--- /dev/null
+++ b/runtime/StructureRareData.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ClassInfo.h"
+#include "JSCell.h"
+#include "JSTypeInfo.h"
+#include "PropertyOffset.h"
+#include "PropertySlot.h"
+
+namespace JSC {
+
+class JSPropertyNameEnumerator;
+class Structure;
+class ObjectToStringAdaptiveStructureWatchpoint;
+class ObjectToStringAdaptiveInferredPropertyValueWatchpoint;
+
+class StructureRareData final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static StructureRareData* create(VM&, Structure*);
+
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
+
+    Structure* previousID() const;
+    void setPreviousID(VM&, Structure*);
+    void clearPreviousID();
+
+    JSString* objectToStringValue() const;
+    void setObjectToStringValue(ExecState*, VM&, Structure* baseStructure, JSString* value, PropertySlot toStringTagSymbolSlot);
+
+    JSPropertyNameEnumerator* cachedPropertyNameEnumerator() const;
+    void setCachedPropertyNameEnumerator(VM&, JSPropertyNameEnumerator*);
+
+    DECLARE_EXPORT_INFO;
+
+private:
+    friend class Structure;
+    friend class ObjectToStringAdaptiveStructureWatchpoint;
+    friend class ObjectToStringAdaptiveInferredPropertyValueWatchpoint;
+
+    void clearObjectToStringValue();
+
+    StructureRareData(VM&, Structure*);
+
+    WriteBarrier<Structure> m_previous;
+    WriteBarrier<JSString> m_objectToStringValue;
+    WriteBarrier<JSPropertyNameEnumerator> m_cachedPropertyNameEnumerator;
+    
+    typedef HashMap<PropertyOffset, RefPtr<WatchpointSet>, WTF::IntHash<PropertyOffset>, WTF::UnsignedWithZeroKeyHashTraits<PropertyOffset>> PropertyWatchpointMap;
+    std::unique_ptr<PropertyWatchpointMap> m_replacementWatchpointSets;
+    Bag<ObjectToStringAdaptiveStructureWatchpoint> m_objectToStringAdaptiveWatchpointSet;
+    std::unique_ptr<ObjectToStringAdaptiveInferredPropertyValueWatchpoint> m_objectToStringAdaptiveInferredValueWatchpoint;
+    bool m_giveUpOnObjectToStringValueCache;
+};
+
+} // namespace JSC
diff --git a/runtime/StructureRareDataInlines.h b/runtime/StructureRareDataInlines.h
new file mode 100644
index 0000000..e4e2496
--- /dev/null
+++ b/runtime/StructureRareDataInlines.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSString.h"
+#include "StructureRareData.h"
+
+namespace JSC {
+
+inline Structure* StructureRareData::previousID() const
+{
+    return m_previous.get();
+}
+
+inline void StructureRareData::setPreviousID(VM& vm, Structure* structure)
+{
+    m_previous.set(vm, this, structure);
+}
+
+inline void StructureRareData::clearPreviousID()
+{
+    m_previous.clear();
+}
+
+inline JSString* StructureRareData::objectToStringValue() const
+{
+    return m_objectToStringValue.get();
+}
+
+} // namespace JSC
diff --git a/runtime/StructureTransitionTable.h b/runtime/StructureTransitionTable.h
new file mode 100644
index 0000000..3c0e813
--- /dev/null
+++ b/runtime/StructureTransitionTable.h
@@ -0,0 +1,226 @@
+/*
+ * Copyright (C) 2008, 2009, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "IndexingType.h"
+#include "WeakGCMap.h"
+#include <wtf/HashFunctions.h>
+#include <wtf/text/UniquedStringImpl.h>
+
+namespace JSC {
+
+class JSCell;
+class Structure;
+
+static const unsigned FirstInternalAttribute = 1 << 6; // Use for transitions that don't have to do with property additions.
+
+// Support for attributes used to indicate transitions not related to properties.
+// If any of these are used, the string portion of the key should be 0.
+enum class NonPropertyTransition : unsigned {
+    AllocateUndecided,
+    AllocateInt32,
+    AllocateDouble,
+    AllocateContiguous,
+    AllocateArrayStorage,
+    AllocateSlowPutArrayStorage,
+    SwitchToSlowPutArrayStorage,
+    AddIndexedAccessors,
+    PreventExtensions,
+    Seal,
+    Freeze
+};
+
+inline unsigned toAttributes(NonPropertyTransition transition)
+{
+    return static_cast<unsigned>(transition) + FirstInternalAttribute;
+}
+
+inline bool changesIndexingType(NonPropertyTransition transition)
+{
+    switch (transition) {
+    case NonPropertyTransition::AllocateUndecided:
+    case NonPropertyTransition::AllocateInt32:
+    case NonPropertyTransition::AllocateDouble:
+    case NonPropertyTransition::AllocateContiguous:
+    case NonPropertyTransition::AllocateArrayStorage:
+    case NonPropertyTransition::AllocateSlowPutArrayStorage:
+    case NonPropertyTransition::SwitchToSlowPutArrayStorage:
+    case NonPropertyTransition::AddIndexedAccessors:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline IndexingType newIndexingType(IndexingType oldType, NonPropertyTransition transition)
+{
+    switch (transition) {
+    case NonPropertyTransition::AllocateUndecided:
+        ASSERT(!hasIndexedProperties(oldType));
+        return oldType | UndecidedShape;
+    case NonPropertyTransition::AllocateInt32:
+        ASSERT(!hasIndexedProperties(oldType) || hasUndecided(oldType));
+        return (oldType & ~IndexingShapeMask) | Int32Shape;
+    case NonPropertyTransition::AllocateDouble:
+        ASSERT(!hasIndexedProperties(oldType) || hasUndecided(oldType) || hasInt32(oldType));
+        return (oldType & ~IndexingShapeMask) | DoubleShape;
+    case NonPropertyTransition::AllocateContiguous:
+        ASSERT(!hasIndexedProperties(oldType) || hasUndecided(oldType) || hasInt32(oldType) || hasDouble(oldType));
+        return (oldType & ~IndexingShapeMask) | ContiguousShape;
+    case NonPropertyTransition::AllocateArrayStorage:
+        ASSERT(!hasIndexedProperties(oldType) || hasUndecided(oldType) || hasInt32(oldType) || hasDouble(oldType) || hasContiguous(oldType));
+        return (oldType & ~IndexingShapeMask) | ArrayStorageShape;
+    case NonPropertyTransition::AllocateSlowPutArrayStorage:
+        ASSERT(!hasIndexedProperties(oldType) || hasUndecided(oldType) || hasInt32(oldType) || hasDouble(oldType) || hasContiguous(oldType) || hasContiguous(oldType));
+        return (oldType & ~IndexingShapeMask) | SlowPutArrayStorageShape;
+    case NonPropertyTransition::SwitchToSlowPutArrayStorage:
+        ASSERT(hasArrayStorage(oldType));
+        return (oldType & ~IndexingShapeMask) | SlowPutArrayStorageShape;
+    case NonPropertyTransition::AddIndexedAccessors:
+        return oldType | MayHaveIndexedAccessors;
+    default:
+        return oldType;
+    }
+}
+
+inline bool preventsExtensions(NonPropertyTransition transition)
+{
+    switch (transition) {
+    case NonPropertyTransition::PreventExtensions:
+    case NonPropertyTransition::Seal:
+    case NonPropertyTransition::Freeze:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool setsDontDeleteOnAllProperties(NonPropertyTransition transition)
+{
+    switch (transition) {
+    case NonPropertyTransition::Seal:
+    case NonPropertyTransition::Freeze:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool setsReadOnlyOnNonAccessorProperties(NonPropertyTransition transition)
+{
+    switch (transition) {
+    case NonPropertyTransition::Freeze:
+        return true;
+    default:
+        return false;
+    }
+}
+
+class StructureTransitionTable {
+    static const intptr_t UsingSingleSlotFlag = 1;
+
+    
+    struct Hash {
+        typedef std::pair<UniquedStringImpl*, unsigned> Key;
+        
+        static unsigned hash(const Key& p)
+        {
+            return PtrHash<UniquedStringImpl*>::hash(p.first) + p.second;
+        }
+
+        static bool equal(const Key& a, const Key& b)
+        {
+            return a == b;
+        }
+
+        static const bool safeToCompareToEmptyOrDeleted = true;
+    };
+
+    typedef WeakGCMap<Hash::Key, Structure, Hash> TransitionMap;
+
+public:
+    StructureTransitionTable()
+        : m_data(UsingSingleSlotFlag)
+    {
+    }
+
+    ~StructureTransitionTable()
+    {
+        if (!isUsingSingleSlot()) {
+            delete map();
+            return;
+        }
+
+        WeakImpl* impl = this->weakImpl();
+        if (!impl)
+            return;
+        WeakSet::deallocate(impl);
+    }
+
+    void add(VM&, Structure*);
+    bool contains(UniquedStringImpl*, unsigned attributes) const;
+    Structure* get(UniquedStringImpl*, unsigned attributes) const;
+
+private:
+    friend class SingleSlotTransitionWeakOwner;
+
+    bool isUsingSingleSlot() const
+    {
+        return m_data & UsingSingleSlotFlag;
+    }
+
+    TransitionMap* map() const
+    {
+        ASSERT(!isUsingSingleSlot());
+        return reinterpret_cast<TransitionMap*>(m_data);
+    }
+
+    WeakImpl* weakImpl() const
+    {
+        ASSERT(isUsingSingleSlot());
+        return reinterpret_cast<WeakImpl*>(m_data & ~UsingSingleSlotFlag);
+    }
+
+    void setMap(TransitionMap* map)
+    {
+        ASSERT(isUsingSingleSlot());
+        
+        if (WeakImpl* impl = this->weakImpl())
+            WeakSet::deallocate(impl);
+
+        // This implicitly clears the flag that indicates we're using a single transition
+        m_data = reinterpret_cast<intptr_t>(map);
+
+        ASSERT(!isUsingSingleSlot());
+    }
+
+    Structure* singleTransition() const;
+    void setSingleTransition(Structure*);
+
+    intptr_t m_data;
+};
+
+} // namespace JSC
diff --git a/runtime/Symbol.cpp b/runtime/Symbol.cpp
new file mode 100644
index 0000000..5c35b81
--- /dev/null
+++ b/runtime/Symbol.cpp
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Symbol.h"
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "SymbolObject.h"
+
+namespace JSC {
+
+const ClassInfo Symbol::s_info = { "symbol", nullptr, nullptr, CREATE_METHOD_TABLE(Symbol) };
+
+Symbol::Symbol(VM& vm)
+    : Base(vm, vm.symbolStructure.get())
+    , m_privateName()
+{
+}
+
+Symbol::Symbol(VM& vm, const String& string)
+    : Base(vm, vm.symbolStructure.get())
+    , m_privateName(PrivateName::Description, string)
+{
+}
+
+Symbol::Symbol(VM& vm, SymbolImpl& uid)
+    : Base(vm, vm.symbolStructure.get())
+    , m_privateName(uid)
+{
+}
+
+void Symbol::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    vm.symbolImplToSymbolMap.set(&m_privateName.uid(), this);
+}
+
+inline SymbolObject* SymbolObject::create(VM& vm, JSGlobalObject* globalObject, Symbol* symbol)
+{
+    SymbolObject* object = new (NotNull, allocateCell<SymbolObject>(vm.heap)) SymbolObject(vm, globalObject->symbolObjectStructure());
+    object->finishCreation(vm, symbol);
+    return object;
+}
+
+JSValue Symbol::toPrimitive(ExecState*, PreferredPrimitiveType) const
+{
+    return const_cast<Symbol*>(this);
+}
+
+bool Symbol::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result) const
+{
+    result = this;
+    number = toNumber(exec);
+    return true;
+}
+
+JSObject* Symbol::toObject(ExecState* exec, JSGlobalObject* globalObject) const
+{
+    return SymbolObject::create(exec->vm(), globalObject, const_cast<Symbol*>(this));
+}
+
+double Symbol::toNumber(ExecState* exec) const
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    throwTypeError(exec, scope, ASCIILiteral("Cannot convert a symbol to a number"));
+    return 0.0;
+}
+
+void Symbol::destroy(JSCell* cell)
+{
+    static_cast<Symbol*>(cell)->Symbol::~Symbol();
+}
+
+String Symbol::descriptiveString() const
+{
+    return makeString("Symbol(", String(privateName().uid()), ')');
+}
+
+Symbol* Symbol::create(VM& vm)
+{
+    Symbol* symbol = new (NotNull, allocateCell<Symbol>(vm.heap)) Symbol(vm);
+    symbol->finishCreation(vm);
+    return symbol;
+}
+
+Symbol* Symbol::create(ExecState* exec, JSString* description)
+{
+    VM& vm = exec->vm();
+    String desc = description->value(exec);
+    Symbol* symbol = new (NotNull, allocateCell<Symbol>(vm.heap)) Symbol(vm, desc);
+    symbol->finishCreation(vm);
+    return symbol;
+}
+
+Symbol* Symbol::create(VM& vm, SymbolImpl& uid)
+{
+    if (Symbol* symbol = vm.symbolImplToSymbolMap.get(&uid))
+        return symbol;
+
+    Symbol* symbol = new (NotNull, allocateCell<Symbol>(vm.heap)) Symbol(vm, uid);
+    symbol->finishCreation(vm);
+    return symbol;
+}
+
+} // namespace JSC
diff --git a/runtime/Symbol.h b/runtime/Symbol.h
new file mode 100644
index 0000000..7503bb8
--- /dev/null
+++ b/runtime/Symbol.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSString.h"
+#include "PrivateName.h"
+
+namespace JSC {
+
+class Symbol final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal | OverridesToThis;
+
+    DECLARE_EXPORT_INFO;
+
+    static const bool needsDestruction = true;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(SymbolType, StructureFlags), info());
+    }
+
+    static Symbol* create(VM&);
+    static Symbol* create(ExecState*, JSString* description);
+    JS_EXPORT_PRIVATE static Symbol* create(VM&, SymbolImpl& uid);
+
+    const PrivateName& privateName() const { return m_privateName; }
+    String descriptiveString() const;
+
+    JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+    bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
+    JSObject* toObject(ExecState*, JSGlobalObject*) const;
+    double toNumber(ExecState*) const;
+
+    static ptrdiff_t offsetOfSymbolImpl()
+    {
+        // PrivateName is just a Ref<SymbolImpl> which can just be used as a SymbolImpl*.
+        return OBJECT_OFFSETOF(Symbol, m_privateName);
+    }
+
+protected:
+    static void destroy(JSCell*);
+
+    Symbol(VM&);
+    Symbol(VM&, const String&);
+    Symbol(VM&, SymbolImpl& uid);
+
+    void finishCreation(VM&);
+
+    PrivateName m_privateName;
+};
+
+Symbol* asSymbol(JSValue);
+
+inline Symbol* asSymbol(JSValue value)
+{
+    ASSERT(value.asCell()->isSymbol());
+    return jsCast<Symbol*>(value.asCell());
+}
+
+} // namespace JSC
diff --git a/runtime/SymbolConstructor.cpp b/runtime/SymbolConstructor.cpp
new file mode 100644
index 0000000..beade31
--- /dev/null
+++ b/runtime/SymbolConstructor.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SymbolConstructor.h"
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "Symbol.h"
+#include "SymbolPrototype.h"
+#include <wtf/text/SymbolRegistry.h>
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL symbolConstructorFor(ExecState*);
+static EncodedJSValue JSC_HOST_CALL symbolConstructorKeyFor(ExecState*);
+
+}
+
+#include "SymbolConstructor.lut.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(SymbolConstructor);
+
+const ClassInfo SymbolConstructor::s_info = { "Function", &Base::s_info, &symbolConstructorTable, CREATE_METHOD_TABLE(SymbolConstructor) };
+
+/* Source for SymbolConstructor.lut.h
+@begin symbolConstructorTable
+  for       symbolConstructorFor       DontEnum|Function 1
+  keyFor    symbolConstructorKeyFor    DontEnum|Function 1
+@end
+*/
+
+SymbolConstructor::SymbolConstructor(VM& vm, Structure* structure)
+    : InternalFunction(vm, structure)
+{
+}
+
+#define INITIALIZE_WELL_KNOWN_SYMBOLS(name) \
+    putDirectWithoutTransition(vm, Identifier::fromString(&vm, #name), Symbol::create(vm, static_cast<SymbolImpl&>(*vm.propertyNames->name##Symbol.impl())), DontEnum | DontDelete | ReadOnly);
+
+void SymbolConstructor::finishCreation(VM& vm, SymbolPrototype* prototype)
+{
+    Base::finishCreation(vm, prototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
+
+    JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_WELL_KNOWN_SYMBOLS)
+}
+
+// ------------------------------ Functions ---------------------------
+
+static EncodedJSValue JSC_HOST_CALL callSymbol(ExecState* exec)
+{
+    JSValue description = exec->argument(0);
+    if (description.isUndefined())
+        return JSValue::encode(Symbol::create(exec->vm()));
+    return JSValue::encode(Symbol::create(exec, description.toString(exec)));
+}
+
+ConstructType SymbolConstructor::getConstructData(JSCell*, ConstructData&)
+{
+    return ConstructType::None;
+}
+
+CallType SymbolConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callSymbol;
+    return CallType::Host;
+}
+
+EncodedJSValue JSC_HOST_CALL symbolConstructorFor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSString* stringKey = exec->argument(0).toString(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    String string = stringKey->value(exec);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    return JSValue::encode(Symbol::create(exec->vm(), exec->vm().symbolRegistry().symbolForKey(string)));
+}
+
+const char* const SymbolKeyForTypeError = "Symbol.keyFor requires that the first argument be a symbol";
+
+EncodedJSValue JSC_HOST_CALL symbolConstructorKeyFor(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue symbolValue = exec->argument(0);
+    if (!symbolValue.isSymbol())
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(SymbolKeyForTypeError)));
+
+    SymbolImpl& uid = asSymbol(symbolValue)->privateName().uid();
+    if (!uid.symbolRegistry())
+        return JSValue::encode(jsUndefined());
+
+    ASSERT(uid.symbolRegistry() == &vm.symbolRegistry());
+    return JSValue::encode(jsString(exec, vm.symbolRegistry().keyForSymbol(uid)));
+}
+
+} // namespace JSC
diff --git a/runtime/SymbolConstructor.h b/runtime/SymbolConstructor.h
new file mode 100644
index 0000000..13b0dba
--- /dev/null
+++ b/runtime/SymbolConstructor.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+#include "Symbol.h"
+
+namespace JSC {
+
+class SymbolPrototype;
+class GetterSetter;
+
+class SymbolConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
+
+    static SymbolConstructor* create(VM& vm, Structure* structure, SymbolPrototype* prototype, GetterSetter*)
+    {
+        SymbolConstructor* constructor = new (NotNull, allocateCell<SymbolConstructor>(vm.heap)) SymbolConstructor(vm, structure);
+        constructor->finishCreation(vm, prototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM&, SymbolPrototype*);
+
+private:
+    SymbolConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/SymbolObject.cpp b/runtime/SymbolObject.cpp
new file mode 100644
index 0000000..d9d238c
--- /dev/null
+++ b/runtime/SymbolObject.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SymbolObject.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(SymbolObject);
+
+const ClassInfo SymbolObject::s_info = { "Symbol", &JSWrapperObject::s_info, nullptr, CREATE_METHOD_TABLE(SymbolObject) };
+
+SymbolObject::SymbolObject(VM& vm, Structure* structure)
+    : JSWrapperObject(vm, structure)
+{
+}
+
+void SymbolObject::finishCreation(VM& vm, Symbol* symbol)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    setInternalValue(vm, symbol);
+}
+
+String SymbolObject::toStringName(const JSObject*, ExecState*)
+{
+    return ASCIILiteral("Object");
+}
+
+JSValue SymbolObject::defaultValue(const JSObject* object, ExecState*, PreferredPrimitiveType)
+{
+    const SymbolObject* symbolObject = jsCast<const SymbolObject*>(object);
+    return symbolObject->internalValue();
+}
+
+} // namespace JSC
diff --git a/runtime/SymbolObject.h b/runtime/SymbolObject.h
new file mode 100644
index 0000000..c5e67a6
--- /dev/null
+++ b/runtime/SymbolObject.h
@@ -0,0 +1,66 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#pragma once
+
+#include "JSWrapperObject.h"
+#include "Symbol.h"
+
+namespace JSC {
+
+class SymbolObject : public JSWrapperObject {
+public:
+    typedef JSWrapperObject Base;
+
+    static SymbolObject* create(VM& vm, Structure* structure)
+    {
+        Symbol* symbol = Symbol::create(vm);
+        SymbolObject* object = new (NotNull, allocateCell<SymbolObject>(vm.heap)) SymbolObject(vm, structure);
+        object->finishCreation(vm, symbol);
+        return object;
+    }
+    static SymbolObject* create(VM& vm, Structure* structure, Symbol* symbol)
+    {
+        SymbolObject* object = new (NotNull, allocateCell<SymbolObject>(vm.heap)) SymbolObject(vm, structure);
+        object->finishCreation(vm, symbol);
+        return object;
+    }
+    static SymbolObject* create(VM&, JSGlobalObject*, Symbol*);
+
+    DECLARE_EXPORT_INFO;
+
+    Symbol* internalValue() const { return asSymbol(JSWrapperObject::internalValue()); }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
+
+    static String toStringName(const JSObject*, ExecState*);
+
+protected:
+    JS_EXPORT_PRIVATE void finishCreation(VM&, Symbol*);
+    JS_EXPORT_PRIVATE SymbolObject(VM&, Structure*);
+};
+
+} // namespace JSC
diff --git a/runtime/SymbolPrototype.cpp b/runtime/SymbolPrototype.cpp
new file mode 100644
index 0000000..0f022a3
--- /dev/null
+++ b/runtime/SymbolPrototype.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SymbolPrototype.h"
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSString.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL symbolProtoFuncToString(ExecState*);
+static EncodedJSValue JSC_HOST_CALL symbolProtoFuncValueOf(ExecState*);
+
+}
+
+#include "SymbolPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo SymbolPrototype::s_info = { "Symbol", &Base::s_info, &symbolPrototypeTable, CREATE_METHOD_TABLE(SymbolPrototype) };
+
+/* Source for SymbolPrototype.lut.h
+@begin symbolPrototypeTable
+  toString          symbolProtoFuncToString         DontEnum|Function 0
+  valueOf           symbolProtoFuncValueOf          DontEnum|Function 0
+@end
+*/
+
+SymbolPrototype::SymbolPrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void SymbolPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "Symbol"), DontEnum | ReadOnly);
+    ASSERT(inherits(info()));
+
+    JSC_NATIVE_FUNCTION(vm.propertyNames->toPrimitiveSymbol, symbolProtoFuncValueOf, DontEnum | ReadOnly, 1);
+}
+
+// ------------------------------ Functions ---------------------------
+
+static const char* SymbolToStringTypeError = "Symbol.prototype.toString requires that |this| be a symbol or a symbol object";
+static const char* SymbolValueOfTypeError = "Symbol.prototype.valueOf requires that |this| be a symbol or a symbol object";
+
+EncodedJSValue JSC_HOST_CALL symbolProtoFuncToString(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    Symbol* symbol = nullptr;
+    if (thisValue.isSymbol())
+        symbol = asSymbol(thisValue);
+    else {
+        if (!thisValue.isObject())
+            return throwVMTypeError(exec, scope, SymbolToStringTypeError);
+        JSObject* thisObject = asObject(thisValue);
+        if (!thisObject->inherits(SymbolObject::info()))
+            return throwVMTypeError(exec, scope, SymbolToStringTypeError);
+        symbol = asSymbol(jsCast<SymbolObject*>(thisObject)->internalValue());
+    }
+
+    return JSValue::encode(jsNontrivialString(exec, symbol->descriptiveString()));
+}
+
+EncodedJSValue JSC_HOST_CALL symbolProtoFuncValueOf(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue thisValue = exec->thisValue();
+    if (thisValue.isSymbol())
+        return JSValue::encode(thisValue);
+
+    if (!thisValue.isObject())
+        return throwVMTypeError(exec, scope, SymbolValueOfTypeError);
+
+    JSObject* thisObject = asObject(thisValue);
+    if (!thisObject->inherits(SymbolObject::info()))
+        return throwVMTypeError(exec, scope, SymbolValueOfTypeError);
+
+    return JSValue::encode(jsCast<SymbolObject*>(thisObject)->internalValue());
+}
+
+} // namespace JSC
diff --git a/runtime/SymbolPrototype.h b/runtime/SymbolPrototype.h
new file mode 100644
index 0000000..4755d31
--- /dev/null
+++ b/runtime/SymbolPrototype.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Symbol.h"
+#include "SymbolObject.h"
+
+namespace JSC {
+
+// In the ES6 spec, Symbol.prototype object is an ordinary JS object, not one of the symbol wrapper object instance.
+class SymbolPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static SymbolPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        SymbolPrototype* prototype = new (NotNull, allocateCell<SymbolPrototype>(vm.heap)) SymbolPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+protected:
+    SymbolPrototype(VM&, Structure*);
+    void finishCreation(VM&, JSGlobalObject*);
+};
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(SymbolPrototype);
+
+} // namespace JSC
diff --git a/runtime/SymbolTable.cpp b/runtime/SymbolTable.cpp
new file mode 100644
index 0000000..55c6dd2
--- /dev/null
+++ b/runtime/SymbolTable.cpp
@@ -0,0 +1,283 @@
+/*
+ * Copyright (C) 2012, 2014, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SymbolTable.h"
+
+#include "JSDestructibleObject.h"
+#include "JSCInlines.h"
+#include "SlotVisitorInlines.h"
+#include "TypeProfiler.h"
+
+namespace JSC {
+
+const ClassInfo SymbolTable::s_info = { "SymbolTable", 0, 0, CREATE_METHOD_TABLE(SymbolTable) };
+
+SymbolTableEntry& SymbolTableEntry::copySlow(const SymbolTableEntry& other)
+{
+    ASSERT(other.isFat());
+    FatEntry* newFatEntry = new FatEntry(*other.fatEntry());
+    freeFatEntry();
+    m_bits = bitwise_cast<intptr_t>(newFatEntry);
+    return *this;
+}
+
+void SymbolTable::destroy(JSCell* cell)
+{
+    SymbolTable* thisObject = static_cast<SymbolTable*>(cell);
+    thisObject->SymbolTable::~SymbolTable();
+}
+
+void SymbolTableEntry::freeFatEntrySlow()
+{
+    ASSERT(isFat());
+    delete fatEntry();
+}
+
+void SymbolTableEntry::prepareToWatch()
+{
+    if (!isWatchable())
+        return;
+    FatEntry* entry = inflate();
+    if (entry->m_watchpoints)
+        return;
+    entry->m_watchpoints = adoptRef(new WatchpointSet(ClearWatchpoint));
+}
+
+void SymbolTableEntry::addWatchpoint(Watchpoint* watchpoint)
+{
+    fatEntry()->m_watchpoints->add(watchpoint);
+}
+
+SymbolTableEntry::FatEntry* SymbolTableEntry::inflateSlow()
+{
+    FatEntry* entry = new FatEntry(m_bits);
+    m_bits = bitwise_cast<intptr_t>(entry);
+    return entry;
+}
+
+SymbolTable::SymbolTable(VM& vm)
+    : JSCell(vm, vm.symbolTableStructure.get())
+    , m_usesNonStrictEval(false)
+    , m_nestedLexicalScope(false)
+    , m_scopeType(VarScope)
+{
+}
+
+SymbolTable::~SymbolTable() { }
+
+void SymbolTable::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    m_singletonScope.set(vm, this, InferredValue::create(vm));
+}
+
+void SymbolTable::visitChildren(JSCell* thisCell, SlotVisitor& visitor)
+{
+    SymbolTable* thisSymbolTable = jsCast<SymbolTable*>(thisCell);
+    
+    visitor.append(thisSymbolTable->m_arguments);
+    visitor.append(thisSymbolTable->m_singletonScope);
+    
+    if (thisSymbolTable->m_rareData)
+        visitor.append(thisSymbolTable->m_rareData->m_codeBlock);
+    
+    // Save some memory. This is O(n) to rebuild and we do so on the fly.
+    ConcurrentJSLocker locker(thisSymbolTable->m_lock);
+    thisSymbolTable->m_localToEntry = nullptr;
+}
+
+const SymbolTable::LocalToEntryVec& SymbolTable::localToEntry(const ConcurrentJSLocker&)
+{
+    if (UNLIKELY(!m_localToEntry)) {
+        unsigned size = 0;
+        for (auto& entry : m_map) {
+            VarOffset offset = entry.value.varOffset();
+            if (offset.isScope())
+                size = std::max(size, offset.scopeOffset().offset() + 1);
+        }
+    
+        m_localToEntry = std::make_unique<LocalToEntryVec>(size, nullptr);
+        for (auto& entry : m_map) {
+            VarOffset offset = entry.value.varOffset();
+            if (offset.isScope())
+                m_localToEntry->at(offset.scopeOffset().offset()) = &entry.value;
+        }
+    }
+    
+    return *m_localToEntry;
+}
+
+SymbolTableEntry* SymbolTable::entryFor(const ConcurrentJSLocker& locker, ScopeOffset offset)
+{
+    auto& toEntryVector = localToEntry(locker);
+    if (offset.offset() >= toEntryVector.size())
+        return nullptr;
+    return toEntryVector[offset.offset()];
+}
+
+SymbolTable* SymbolTable::cloneScopePart(VM& vm)
+{
+    SymbolTable* result = SymbolTable::create(vm);
+    
+    result->m_usesNonStrictEval = m_usesNonStrictEval;
+    result->m_nestedLexicalScope = m_nestedLexicalScope;
+    result->m_scopeType = m_scopeType;
+
+    for (auto iter = m_map.begin(), end = m_map.end(); iter != end; ++iter) {
+        if (!iter->value.varOffset().isScope())
+            continue;
+        result->m_map.add(
+            iter->key,
+            SymbolTableEntry(iter->value.varOffset(), iter->value.getAttributes()));
+    }
+    
+    result->m_maxScopeOffset = m_maxScopeOffset;
+    
+    if (ScopedArgumentsTable* arguments = this->arguments())
+        result->m_arguments.set(vm, result, arguments);
+    
+    if (m_rareData) {
+        result->m_rareData = std::make_unique<SymbolTableRareData>();
+
+        {
+            auto iter = m_rareData->m_uniqueIDMap.begin();
+            auto end = m_rareData->m_uniqueIDMap.end();
+            for (; iter != end; ++iter)
+                result->m_rareData->m_uniqueIDMap.set(iter->key, iter->value);
+        }
+
+        {
+            auto iter = m_rareData->m_offsetToVariableMap.begin();
+            auto end = m_rareData->m_offsetToVariableMap.end();
+            for (; iter != end; ++iter)
+                result->m_rareData->m_offsetToVariableMap.set(iter->key, iter->value);
+        }
+
+        {
+            auto iter = m_rareData->m_uniqueTypeSetMap.begin();
+            auto end = m_rareData->m_uniqueTypeSetMap.end();
+            for (; iter != end; ++iter)
+                result->m_rareData->m_uniqueTypeSetMap.set(iter->key, iter->value);
+        }
+    }
+    
+    return result;
+}
+
+void SymbolTable::prepareForTypeProfiling(const ConcurrentJSLocker&)
+{
+    if (m_rareData)
+        return;
+
+    m_rareData = std::make_unique<SymbolTableRareData>();
+
+    for (auto iter = m_map.begin(), end = m_map.end(); iter != end; ++iter) {
+        m_rareData->m_uniqueIDMap.set(iter->key, TypeProfilerNeedsUniqueIDGeneration);
+        m_rareData->m_offsetToVariableMap.set(iter->value.varOffset(), iter->key);
+    }
+}
+
+CodeBlock* SymbolTable::rareDataCodeBlock()
+{
+    if (!m_rareData)
+        return nullptr;
+
+    return m_rareData->m_codeBlock.get();
+}
+
+void SymbolTable::setRareDataCodeBlock(CodeBlock* codeBlock)
+{
+    if (!m_rareData)
+        m_rareData = std::make_unique<SymbolTableRareData>();
+
+    ASSERT(!m_rareData->m_codeBlock);
+    m_rareData->m_codeBlock.set(*codeBlock->vm(), this, codeBlock);
+}
+
+GlobalVariableID SymbolTable::uniqueIDForVariable(const ConcurrentJSLocker&, UniquedStringImpl* key, VM& vm)
+{
+    RELEASE_ASSERT(m_rareData);
+
+    auto iter = m_rareData->m_uniqueIDMap.find(key);
+    auto end = m_rareData->m_uniqueIDMap.end();
+    if (iter == end)
+        return TypeProfilerNoGlobalIDExists;
+
+    GlobalVariableID id = iter->value;
+    if (id == TypeProfilerNeedsUniqueIDGeneration) {
+        id = vm.typeProfiler()->getNextUniqueVariableID();
+        m_rareData->m_uniqueIDMap.set(key, id);
+        m_rareData->m_uniqueTypeSetMap.set(key, TypeSet::create()); // Make a new global typeset for this corresponding ID.
+    }
+
+    return id;
+}
+
+GlobalVariableID SymbolTable::uniqueIDForOffset(const ConcurrentJSLocker& locker, VarOffset offset, VM& vm)
+{
+    RELEASE_ASSERT(m_rareData);
+
+    auto iter = m_rareData->m_offsetToVariableMap.find(offset);
+    auto end = m_rareData->m_offsetToVariableMap.end();
+    if (iter == end)
+        return TypeProfilerNoGlobalIDExists;
+
+    return uniqueIDForVariable(locker, iter->value.get(), vm);
+}
+
+RefPtr<TypeSet> SymbolTable::globalTypeSetForOffset(const ConcurrentJSLocker& locker, VarOffset offset, VM& vm)
+{
+    RELEASE_ASSERT(m_rareData);
+
+    uniqueIDForOffset(locker, offset, vm); // Lazily create the TypeSet if necessary.
+
+    auto iter = m_rareData->m_offsetToVariableMap.find(offset);
+    auto end = m_rareData->m_offsetToVariableMap.end();
+    if (iter == end)
+        return nullptr;
+
+    return globalTypeSetForVariable(locker, iter->value.get(), vm);
+}
+
+RefPtr<TypeSet> SymbolTable::globalTypeSetForVariable(const ConcurrentJSLocker& locker, UniquedStringImpl* key, VM& vm)
+{
+    RELEASE_ASSERT(m_rareData);
+
+    uniqueIDForVariable(locker, key, vm); // Lazily create the TypeSet if necessary.
+
+    auto iter = m_rareData->m_uniqueTypeSetMap.find(key);
+    auto end = m_rareData->m_uniqueTypeSetMap.end();
+    if (iter == end)
+        return nullptr;
+
+    return iter->value;
+}
+
+} // namespace JSC
+
diff --git a/runtime/SymbolTable.h b/runtime/SymbolTable.h
new file mode 100644
index 0000000..3183664
--- /dev/null
+++ b/runtime/SymbolTable.h
@@ -0,0 +1,721 @@
+/*
+ * Copyright (C) 2007, 2008, 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "ConstantMode.h"
+#include "InferredValue.h"
+#include "JSObject.h"
+#include "ScopedArgumentsTable.h"
+#include "TypeLocation.h"
+#include "VarOffset.h"
+#include "Watchpoint.h"
+#include <memory>
+#include <wtf/HashTraits.h>
+#include <wtf/text/UniquedStringImpl.h>
+
+namespace JSC {
+
+class SymbolTable;
+
+static ALWAYS_INLINE int missingSymbolMarker() { return std::numeric_limits<int>::max(); }
+
+// The bit twiddling in this class assumes that every register index is a
+// reasonably small positive or negative number, and therefore has its high
+// four bits all set or all unset.
+
+// In addition to implementing semantics-mandated variable attributes and
+// implementation-mandated variable indexing, this class also implements
+// watchpoints to be used for JIT optimizations. Because watchpoints are
+// meant to be relatively rare, this class optimizes heavily for the case
+// that they are not being used. To that end, this class uses the thin-fat
+// idiom: either it is thin, in which case it contains an in-place encoded
+// word that consists of attributes, the index, and a bit saying that it is
+// thin; or it is fat, in which case it contains a pointer to a malloc'd
+// data structure and a bit saying that it is fat. The malloc'd data
+// structure will be malloced a second time upon copy, to preserve the
+// property that in-place edits to SymbolTableEntry do not manifest in any
+// copies. However, the malloc'd FatEntry data structure contains a ref-
+// counted pointer to a shared WatchpointSet. Thus, in-place edits of the
+// WatchpointSet will manifest in all copies. Here's a picture:
+//
+// SymbolTableEntry --> FatEntry --> WatchpointSet
+//
+// If you make a copy of a SymbolTableEntry, you will have:
+//
+// original: SymbolTableEntry --> FatEntry --> WatchpointSet
+// copy:     SymbolTableEntry --> FatEntry -----^
+
+struct SymbolTableEntry {
+private:
+    static VarOffset varOffsetFromBits(intptr_t bits)
+    {
+        VarKind kind;
+        intptr_t kindBits = bits & KindBitsMask;
+        if (kindBits <= UnwatchableScopeKindBits)
+            kind = VarKind::Scope;
+        else if (kindBits == StackKindBits)
+            kind = VarKind::Stack;
+        else
+            kind = VarKind::DirectArgument;
+        return VarOffset::assemble(kind, static_cast<int>(bits >> FlagBits));
+    }
+    
+    static ScopeOffset scopeOffsetFromBits(intptr_t bits)
+    {
+        ASSERT((bits & KindBitsMask) <= UnwatchableScopeKindBits);
+        return ScopeOffset(static_cast<int>(bits >> FlagBits));
+    }
+
+public:
+    
+    // Use the SymbolTableEntry::Fast class, either via implicit cast or by calling
+    // getFast(), when you (1) only care about isNull(), getIndex(), and isReadOnly(),
+    // and (2) you are in a hot path where you need to minimize the number of times
+    // that you branch on isFat() when getting the bits().
+    class Fast {
+    public:
+        Fast()
+            : m_bits(SlimFlag)
+        {
+        }
+        
+        ALWAYS_INLINE Fast(const SymbolTableEntry& entry)
+            : m_bits(entry.bits())
+        {
+        }
+    
+        bool isNull() const
+        {
+            return !(m_bits & ~SlimFlag);
+        }
+
+        VarOffset varOffset() const
+        {
+            return varOffsetFromBits(m_bits);
+        }
+        
+        // Asserts if the offset is anything but a scope offset. This structures the assertions
+        // in a way that may result in better code, even in release, than doing
+        // varOffset().scopeOffset().
+        ScopeOffset scopeOffset() const
+        {
+            return scopeOffsetFromBits(m_bits);
+        }
+        
+        bool isReadOnly() const
+        {
+            return m_bits & ReadOnlyFlag;
+        }
+        
+        bool isDontEnum() const
+        {
+            return m_bits & DontEnumFlag;
+        }
+        
+        unsigned getAttributes() const
+        {
+            unsigned attributes = 0;
+            if (isReadOnly())
+                attributes |= ReadOnly;
+            if (isDontEnum())
+                attributes |= DontEnum;
+            return attributes;
+        }
+
+        bool isFat() const
+        {
+            return !(m_bits & SlimFlag);
+        }
+        
+    private:
+        friend struct SymbolTableEntry;
+        intptr_t m_bits;
+    };
+
+    SymbolTableEntry()
+        : m_bits(SlimFlag)
+    {
+    }
+
+    SymbolTableEntry(VarOffset offset)
+        : m_bits(SlimFlag)
+    {
+        ASSERT(isValidVarOffset(offset));
+        pack(offset, true, false, false);
+    }
+
+    SymbolTableEntry(VarOffset offset, unsigned attributes)
+        : m_bits(SlimFlag)
+    {
+        ASSERT(isValidVarOffset(offset));
+        pack(offset, true, attributes & ReadOnly, attributes & DontEnum);
+    }
+    
+    ~SymbolTableEntry()
+    {
+        freeFatEntry();
+    }
+    
+    SymbolTableEntry(const SymbolTableEntry& other)
+        : m_bits(SlimFlag)
+    {
+        *this = other;
+    }
+    
+    SymbolTableEntry& operator=(const SymbolTableEntry& other)
+    {
+        if (UNLIKELY(other.isFat()))
+            return copySlow(other);
+        freeFatEntry();
+        m_bits = other.m_bits;
+        return *this;
+    }
+    
+    SymbolTableEntry(SymbolTableEntry&& other)
+        : m_bits(SlimFlag)
+    {
+        swap(other);
+    }
+
+    SymbolTableEntry& operator=(SymbolTableEntry&& other)
+    {
+        swap(other);
+        return *this;
+    }
+
+    void swap(SymbolTableEntry& other)
+    {
+        std::swap(m_bits, other.m_bits);
+    }
+
+    bool isNull() const
+    {
+        return !(bits() & ~SlimFlag);
+    }
+
+    VarOffset varOffset() const
+    {
+        return varOffsetFromBits(bits());
+    }
+    
+    bool isWatchable() const
+    {
+        return (m_bits & KindBitsMask) == ScopeKindBits;
+    }
+    
+    // Asserts if the offset is anything but a scope offset. This structures the assertions
+    // in a way that may result in better code, even in release, than doing
+    // varOffset().scopeOffset().
+    ScopeOffset scopeOffset() const
+    {
+        return scopeOffsetFromBits(bits());
+    }
+    
+    ALWAYS_INLINE Fast getFast() const
+    {
+        return Fast(*this);
+    }
+    
+    ALWAYS_INLINE Fast getFast(bool& wasFat) const
+    {
+        Fast result;
+        wasFat = isFat();
+        if (wasFat)
+            result.m_bits = fatEntry()->m_bits | SlimFlag;
+        else
+            result.m_bits = m_bits;
+        return result;
+    }
+    
+    unsigned getAttributes() const
+    {
+        return getFast().getAttributes();
+    }
+    
+    void setAttributes(unsigned attributes)
+    {
+        pack(varOffset(), isWatchable(), attributes & ReadOnly, attributes & DontEnum);
+    }
+
+    bool isReadOnly() const
+    {
+        return bits() & ReadOnlyFlag;
+    }
+    
+    ConstantMode constantMode() const
+    {
+        return modeForIsConstant(isReadOnly());
+    }
+    
+    bool isDontEnum() const
+    {
+        return bits() & DontEnumFlag;
+    }
+    
+    void disableWatching(VM& vm)
+    {
+        if (WatchpointSet* set = watchpointSet())
+            set->invalidate(vm, "Disabling watching in symbol table");
+        if (varOffset().isScope())
+            pack(varOffset(), false, isReadOnly(), isDontEnum());
+    }
+    
+    void prepareToWatch();
+    
+    void addWatchpoint(Watchpoint*);
+    
+    // This watchpoint set is initialized clear, and goes through the following state transitions:
+    // 
+    // First write to this var, in any scope that has this symbol table: Clear->IsWatched.
+    //
+    // Second write to this var, in any scope that has this symbol table: IsWatched->IsInvalidated.
+    //
+    // We ensure that we touch the set (i.e. trigger its state transition) after we do the write. This
+    // means that if you're in the compiler thread, and you:
+    //
+    // 1) Observe that the set IsWatched and commit to adding your watchpoint.
+    // 2) Load a value from any scope that has this watchpoint set.
+    //
+    // Then you can be sure that that value is either going to be the correct value for that var forever,
+    // or the watchpoint set will invalidate and you'll get fired.
+    //
+    // It's possible to write a program that first creates multiple scopes with the same var, and then
+    // initializes that var in just one of them. This means that a compilation could constant-fold to one
+    // of the scopes that still has an undefined value for this variable. That's fine, because at that
+    // point any write to any of the instances of that variable would fire the watchpoint.
+    WatchpointSet* watchpointSet()
+    {
+        if (!isFat())
+            return 0;
+        return fatEntry()->m_watchpoints.get();
+    }
+    
+private:
+    static const intptr_t SlimFlag = 0x1;
+    static const intptr_t ReadOnlyFlag = 0x2;
+    static const intptr_t DontEnumFlag = 0x4;
+    static const intptr_t NotNullFlag = 0x8;
+    static const intptr_t KindBitsMask = 0x30;
+    static const intptr_t ScopeKindBits = 0x00;
+    static const intptr_t UnwatchableScopeKindBits = 0x10;
+    static const intptr_t StackKindBits = 0x20;
+    static const intptr_t DirectArgumentKindBits = 0x30;
+    static const intptr_t FlagBits = 6;
+    
+    class FatEntry {
+        WTF_MAKE_FAST_ALLOCATED;
+    public:
+        FatEntry(intptr_t bits)
+            : m_bits(bits & ~SlimFlag)
+        {
+        }
+        
+        intptr_t m_bits; // always has FatFlag set and exactly matches what the bits would have been if this wasn't fat.
+        
+        RefPtr<WatchpointSet> m_watchpoints;
+    };
+    
+    SymbolTableEntry& copySlow(const SymbolTableEntry&);
+    JS_EXPORT_PRIVATE void notifyWriteSlow(VM&, JSValue, const FireDetail&);
+    
+    bool isFat() const
+    {
+        return !(m_bits & SlimFlag);
+    }
+    
+    const FatEntry* fatEntry() const
+    {
+        ASSERT(isFat());
+        return bitwise_cast<const FatEntry*>(m_bits);
+    }
+    
+    FatEntry* fatEntry()
+    {
+        ASSERT(isFat());
+        return bitwise_cast<FatEntry*>(m_bits);
+    }
+    
+    FatEntry* inflate()
+    {
+        if (LIKELY(isFat()))
+            return fatEntry();
+        return inflateSlow();
+    }
+    
+    FatEntry* inflateSlow();
+    
+    ALWAYS_INLINE intptr_t bits() const
+    {
+        if (isFat())
+            return fatEntry()->m_bits;
+        return m_bits;
+    }
+    
+    ALWAYS_INLINE intptr_t& bits()
+    {
+        if (isFat())
+            return fatEntry()->m_bits;
+        return m_bits;
+    }
+    
+    void freeFatEntry()
+    {
+        if (LIKELY(!isFat()))
+            return;
+        freeFatEntrySlow();
+    }
+
+    JS_EXPORT_PRIVATE void freeFatEntrySlow();
+
+    void pack(VarOffset offset, bool isWatchable, bool readOnly, bool dontEnum)
+    {
+        ASSERT(!isFat());
+        intptr_t& bitsRef = bits();
+        bitsRef =
+            (static_cast<intptr_t>(offset.rawOffset()) << FlagBits) | NotNullFlag | SlimFlag;
+        if (readOnly)
+            bitsRef |= ReadOnlyFlag;
+        if (dontEnum)
+            bitsRef |= DontEnumFlag;
+        switch (offset.kind()) {
+        case VarKind::Scope:
+            if (isWatchable)
+                bitsRef |= ScopeKindBits;
+            else
+                bitsRef |= UnwatchableScopeKindBits;
+            break;
+        case VarKind::Stack:
+            bitsRef |= StackKindBits;
+            break;
+        case VarKind::DirectArgument:
+            bitsRef |= DirectArgumentKindBits;
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+    
+    static bool isValidVarOffset(VarOffset offset)
+    {
+        return ((static_cast<intptr_t>(offset.rawOffset()) << FlagBits) >> FlagBits) == static_cast<intptr_t>(offset.rawOffset());
+    }
+
+    intptr_t m_bits;
+};
+
+struct SymbolTableIndexHashTraits : HashTraits<SymbolTableEntry> {
+    static const bool needsDestruction = true;
+};
+
+class SymbolTable final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    typedef HashMap<RefPtr<UniquedStringImpl>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, SymbolTableIndexHashTraits> Map;
+    typedef HashMap<RefPtr<UniquedStringImpl>, GlobalVariableID, IdentifierRepHash> UniqueIDMap;
+    typedef HashMap<RefPtr<UniquedStringImpl>, RefPtr<TypeSet>, IdentifierRepHash> UniqueTypeSetMap;
+    typedef HashMap<VarOffset, RefPtr<UniquedStringImpl>> OffsetToVariableMap;
+    typedef Vector<SymbolTableEntry*> LocalToEntryVec;
+
+    static SymbolTable* create(VM& vm)
+    {
+        SymbolTable* symbolTable = new (NotNull, allocateCell<SymbolTable>(vm.heap)) SymbolTable(vm);
+        symbolTable->finishCreation(vm);
+        return symbolTable;
+    }
+    
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    // You must hold the lock until after you're done with the iterator.
+    Map::iterator find(const ConcurrentJSLocker&, UniquedStringImpl* key)
+    {
+        return m_map.find(key);
+    }
+    
+    Map::iterator find(const GCSafeConcurrentJSLocker&, UniquedStringImpl* key)
+    {
+        return m_map.find(key);
+    }
+    
+    SymbolTableEntry get(const ConcurrentJSLocker&, UniquedStringImpl* key)
+    {
+        return m_map.get(key);
+    }
+    
+    SymbolTableEntry get(UniquedStringImpl* key)
+    {
+        ConcurrentJSLocker locker(m_lock);
+        return get(locker, key);
+    }
+    
+    SymbolTableEntry inlineGet(const ConcurrentJSLocker&, UniquedStringImpl* key)
+    {
+        return m_map.inlineGet(key);
+    }
+    
+    SymbolTableEntry inlineGet(UniquedStringImpl* key)
+    {
+        ConcurrentJSLocker locker(m_lock);
+        return inlineGet(locker, key);
+    }
+    
+    Map::iterator begin(const ConcurrentJSLocker&)
+    {
+        return m_map.begin();
+    }
+    
+    Map::iterator end(const ConcurrentJSLocker&)
+    {
+        return m_map.end();
+    }
+    
+    Map::iterator end(const GCSafeConcurrentJSLocker&)
+    {
+        return m_map.end();
+    }
+    
+    size_t size(const ConcurrentJSLocker&) const
+    {
+        return m_map.size();
+    }
+    
+    size_t size() const
+    {
+        ConcurrentJSLocker locker(m_lock);
+        return size(locker);
+    }
+    
+    ScopeOffset maxScopeOffset() const
+    {
+        return m_maxScopeOffset;
+    }
+    
+    void didUseScopeOffset(ScopeOffset offset)
+    {
+        if (!m_maxScopeOffset || m_maxScopeOffset < offset)
+            m_maxScopeOffset = offset;
+    }
+    
+    void didUseVarOffset(VarOffset offset)
+    {
+        if (offset.isScope())
+            didUseScopeOffset(offset.scopeOffset());
+    }
+    
+    unsigned scopeSize() const
+    {
+        ScopeOffset maxScopeOffset = this->maxScopeOffset();
+        
+        // Do some calculation that relies on invalid scope offset plus one being zero.
+        unsigned fastResult = maxScopeOffset.offsetUnchecked() + 1;
+        
+        // Assert that this works.
+        ASSERT(fastResult == (!maxScopeOffset ? 0 : maxScopeOffset.offset() + 1));
+        
+        return fastResult;
+    }
+    
+    ScopeOffset nextScopeOffset() const
+    {
+        return ScopeOffset(scopeSize());
+    }
+    
+    ScopeOffset takeNextScopeOffset(const ConcurrentJSLocker&)
+    {
+        ScopeOffset result = nextScopeOffset();
+        m_maxScopeOffset = result;
+        return result;
+    }
+    
+    ScopeOffset takeNextScopeOffset()
+    {
+        ConcurrentJSLocker locker(m_lock);
+        return takeNextScopeOffset(locker);
+    }
+    
+    template<typename Entry>
+    void add(const ConcurrentJSLocker&, UniquedStringImpl* key, Entry&& entry)
+    {
+        RELEASE_ASSERT(!m_localToEntry);
+        didUseVarOffset(entry.varOffset());
+        Map::AddResult result = m_map.add(key, std::forward<Entry>(entry));
+        ASSERT_UNUSED(result, result.isNewEntry);
+    }
+    
+    template<typename Entry>
+    void add(UniquedStringImpl* key, Entry&& entry)
+    {
+        ConcurrentJSLocker locker(m_lock);
+        add(locker, key, std::forward<Entry>(entry));
+    }
+    
+    template<typename Entry>
+    void set(const ConcurrentJSLocker&, UniquedStringImpl* key, Entry&& entry)
+    {
+        RELEASE_ASSERT(!m_localToEntry);
+        didUseVarOffset(entry.varOffset());
+        m_map.set(key, std::forward<Entry>(entry));
+    }
+    
+    template<typename Entry>
+    void set(UniquedStringImpl* key, Entry&& entry)
+    {
+        ConcurrentJSLocker locker(m_lock);
+        set(locker, key, std::forward<Entry>(entry));
+    }
+    
+    bool contains(const ConcurrentJSLocker&, UniquedStringImpl* key)
+    {
+        return m_map.contains(key);
+    }
+    
+    bool contains(UniquedStringImpl* key)
+    {
+        ConcurrentJSLocker locker(m_lock);
+        return contains(locker, key);
+    }
+    
+    // The principle behind ScopedArgumentsTable modifications is that we will create one and
+    // leave it unlocked - thereby allowing in-place changes - until someone asks for a pointer to
+    // the table. Then, we will lock it. Then both our future changes and their future changes
+    // will first have to make a copy. This discipline means that usually when we create a
+    // ScopedArguments object, we don't have to make a copy of the ScopedArgumentsTable - instead
+    // we just take a reference to one that we already have.
+    
+    uint32_t argumentsLength() const
+    {
+        if (!m_arguments)
+            return 0;
+        return m_arguments->length();
+    }
+    
+    void setArgumentsLength(VM& vm, uint32_t length)
+    {
+        if (UNLIKELY(!m_arguments))
+            m_arguments.set(vm, this, ScopedArgumentsTable::create(vm));
+        m_arguments.set(vm, this, m_arguments->setLength(vm, length));
+    }
+    
+    ScopeOffset argumentOffset(uint32_t i) const
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(m_arguments);
+        return m_arguments->get(i);
+    }
+    
+    void setArgumentOffset(VM& vm, uint32_t i, ScopeOffset offset)
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(m_arguments);
+        m_arguments.set(vm, this, m_arguments->set(vm, i, offset));
+    }
+    
+    ScopedArgumentsTable* arguments() const
+    {
+        if (!m_arguments)
+            return nullptr;
+        m_arguments->lock();
+        return m_arguments.get();
+    }
+    
+    const LocalToEntryVec& localToEntry(const ConcurrentJSLocker&);
+    SymbolTableEntry* entryFor(const ConcurrentJSLocker&, ScopeOffset);
+    
+    GlobalVariableID uniqueIDForVariable(const ConcurrentJSLocker&, UniquedStringImpl* key, VM&);
+    GlobalVariableID uniqueIDForOffset(const ConcurrentJSLocker&, VarOffset, VM&);
+    RefPtr<TypeSet> globalTypeSetForOffset(const ConcurrentJSLocker&, VarOffset, VM&);
+    RefPtr<TypeSet> globalTypeSetForVariable(const ConcurrentJSLocker&, UniquedStringImpl* key, VM&);
+
+    bool usesNonStrictEval() const { return m_usesNonStrictEval; }
+    void setUsesNonStrictEval(bool usesNonStrictEval) { m_usesNonStrictEval = usesNonStrictEval; }
+
+    bool isNestedLexicalScope() const { return m_nestedLexicalScope; }
+    void markIsNestedLexicalScope() { ASSERT(scopeType() == LexicalScope); m_nestedLexicalScope = true; }
+
+    enum ScopeType {
+        VarScope,
+        GlobalLexicalScope,
+        LexicalScope,
+        CatchScope,
+        FunctionNameScope
+    };
+    void setScopeType(ScopeType type) { m_scopeType = type; }
+    ScopeType scopeType() const { return static_cast<ScopeType>(m_scopeType); }
+
+    SymbolTable* cloneScopePart(VM&);
+
+    void prepareForTypeProfiling(const ConcurrentJSLocker&);
+
+    CodeBlock* rareDataCodeBlock();
+    void setRareDataCodeBlock(CodeBlock*);
+    
+    InferredValue* singletonScope() { return m_singletonScope.get(); }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    DECLARE_EXPORT_INFO;
+
+private:
+    JS_EXPORT_PRIVATE SymbolTable(VM&);
+    ~SymbolTable();
+    
+    JS_EXPORT_PRIVATE void finishCreation(VM&);
+
+    Map m_map;
+    ScopeOffset m_maxScopeOffset;
+    
+    struct SymbolTableRareData {
+        UniqueIDMap m_uniqueIDMap;
+        OffsetToVariableMap m_offsetToVariableMap;
+        UniqueTypeSetMap m_uniqueTypeSetMap;
+        WriteBarrier<CodeBlock> m_codeBlock;
+    };
+    std::unique_ptr<SymbolTableRareData> m_rareData;
+
+    bool m_usesNonStrictEval : 1;
+    bool m_nestedLexicalScope : 1; // Non-function LexicalScope.
+    unsigned m_scopeType : 3; // ScopeType
+    
+    WriteBarrier<ScopedArgumentsTable> m_arguments;
+    WriteBarrier<InferredValue> m_singletonScope;
+    
+    std::unique_ptr<LocalToEntryVec> m_localToEntry;
+
+public:
+    mutable ConcurrentJSLock m_lock;
+};
+
+} // namespace JSC
diff --git a/runtime/TemplateRegistry.cpp b/runtime/TemplateRegistry.cpp
new file mode 100644
index 0000000..54ae07d
--- /dev/null
+++ b/runtime/TemplateRegistry.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TemplateRegistry.h"
+
+#include "BuiltinNames.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSTemplateRegistryKey.h"
+#include "ObjectConstructor.h"
+#include "TemplateRegistryKey.h"
+#include "WeakGCMapInlines.h"
+
+namespace JSC {
+
+TemplateRegistry::TemplateRegistry(VM& vm)
+    : m_templateMap(vm)
+{
+}
+
+JSArray* TemplateRegistry::getTemplateObject(ExecState* exec, JSTemplateRegistryKey* templateKeyObject)
+{
+    auto& templateKey = templateKeyObject->templateRegistryKey();
+    JSArray* cached = m_templateMap.get(&templateKey);
+    if (cached)
+        return cached;
+
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    unsigned count = templateKey.cookedStrings().size();
+    JSArray* templateObject = constructEmptyArray(exec, nullptr, count);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    JSArray* rawObject = constructEmptyArray(exec, nullptr, count);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+
+    for (unsigned index = 0; index < count; ++index) {
+        templateObject->putDirectIndex(exec, index, jsString(exec, templateKey.cookedStrings()[index]), ReadOnly | DontDelete, PutDirectIndexLikePutDirect);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+        rawObject->putDirectIndex(exec, index, jsString(exec, templateKey.rawStrings()[index]), ReadOnly | DontDelete, PutDirectIndexLikePutDirect);
+        RETURN_IF_EXCEPTION(scope, nullptr);
+    }
+
+    objectConstructorFreeze(exec, rawObject);
+    ASSERT(!scope.exception());
+
+    templateObject->putDirect(vm, vm.propertyNames->raw, rawObject, ReadOnly | DontEnum | DontDelete);
+
+    // Template JSArray hold the reference to JSTemplateRegistryKey to make TemplateRegistryKey pointer live until this JSArray is collected.
+    // TemplateRegistryKey pointer is used for TemplateRegistry's key.
+    templateObject->putDirect(vm, vm.propertyNames->builtinNames().templateRegistryKeyPrivateName(), templateKeyObject, ReadOnly | DontEnum | DontDelete);
+
+    objectConstructorFreeze(exec, templateObject);
+    ASSERT(!scope.exception());
+
+    m_templateMap.set(&templateKey, templateObject);
+
+    return templateObject;
+}
+
+
+} // namespace JSC
diff --git a/runtime/TemplateRegistry.h b/runtime/TemplateRegistry.h
new file mode 100644
index 0000000..e130904
--- /dev/null
+++ b/runtime/TemplateRegistry.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSArray.h"
+#include "WeakGCMap.h"
+#include <limits>
+
+namespace JSC {
+
+class JSTemplateRegistryKey;
+class TemplateRegistryKey;
+
+class TemplateRegistry {
+public:
+    TemplateRegistry(VM&);
+
+    JSArray* getTemplateObject(ExecState*, JSTemplateRegistryKey*);
+
+private:
+    WeakGCMap<const TemplateRegistryKey*, JSArray> m_templateMap;
+};
+
+} // namespace JSC
diff --git a/runtime/TemplateRegistryKey.cpp b/runtime/TemplateRegistryKey.cpp
new file mode 100644
index 0000000..9629f1b
--- /dev/null
+++ b/runtime/TemplateRegistryKey.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TemplateRegistryKey.h"
+
+#include "TemplateRegistryKeyTable.h"
+
+namespace JSC {
+
+TemplateRegistryKey::~TemplateRegistryKey()
+{
+    if (m_table)
+        m_table->unregister(*this);
+}
+
+} // namespace JSC
diff --git a/runtime/TemplateRegistryKey.h b/runtime/TemplateRegistryKey.h
new file mode 100644
index 0000000..126ac11
--- /dev/null
+++ b/runtime/TemplateRegistryKey.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <limits>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class TemplateRegistryKeyTable;
+
+class TemplateRegistryKey : public RefCounted<TemplateRegistryKey> {
+public:
+    friend class TemplateRegistryKeyTable;
+    typedef Vector<String, 4> StringVector;
+
+    enum DeletedValueTag { DeletedValue };
+    TemplateRegistryKey(DeletedValueTag);
+    enum EmptyValueTag { EmptyValue };
+    TemplateRegistryKey(EmptyValueTag);
+
+    bool isDeletedValue() const { return m_rawStrings.isEmpty() && m_hash == std::numeric_limits<unsigned>::max(); }
+
+    bool isEmptyValue() const { return m_rawStrings.isEmpty() && !m_hash; }
+
+    unsigned hash() const { return m_hash; }
+
+    const StringVector& rawStrings() const { return m_rawStrings; }
+    const StringVector& cookedStrings() const { return m_cookedStrings; }
+
+    bool operator==(const TemplateRegistryKey& other) const { return m_hash == other.m_hash && m_rawStrings == other.m_rawStrings; }
+    bool operator!=(const TemplateRegistryKey& other) const { return m_hash != other.m_hash || m_rawStrings != other.m_rawStrings; }
+
+    struct Hasher {
+        static unsigned hash(const TemplateRegistryKey& key) { return key.hash(); }
+        static bool equal(const TemplateRegistryKey& a, const TemplateRegistryKey& b) { return a == b; }
+        static const bool safeToCompareToEmptyOrDeleted = false;
+    };
+
+    static unsigned calculateHash(const StringVector& rawStrings);
+    ~TemplateRegistryKey();
+
+private:
+    static Ref<TemplateRegistryKey> create(const StringVector& rawStrings, const StringVector& cookedStrings)
+    {
+        return adoptRef(*new TemplateRegistryKey(rawStrings, cookedStrings));
+    }
+
+    TemplateRegistryKey(const StringVector& rawStrings, const StringVector& cookedStrings);
+
+    TemplateRegistryKeyTable* m_table { nullptr };
+    StringVector m_rawStrings;
+    StringVector m_cookedStrings;
+    unsigned m_hash { 0 };
+};
+
+inline TemplateRegistryKey::TemplateRegistryKey(const StringVector& rawStrings, const StringVector& cookedStrings)
+    : m_rawStrings(rawStrings)
+    , m_cookedStrings(cookedStrings)
+    , m_hash(calculateHash(rawStrings))
+{
+}
+
+inline TemplateRegistryKey::TemplateRegistryKey(DeletedValueTag)
+    : m_hash(std::numeric_limits<unsigned>::max())
+{
+}
+
+inline TemplateRegistryKey::TemplateRegistryKey(EmptyValueTag)
+    : m_hash(0)
+{
+}
+
+inline unsigned TemplateRegistryKey::calculateHash(const StringVector& rawStrings)
+{
+    StringHasher hasher;
+    for (const String& string : rawStrings) {
+        if (string.is8Bit())
+            hasher.addCharacters(string.characters8(), string.length());
+        else
+            hasher.addCharacters(string.characters16(), string.length());
+    }
+    return hasher.hash();
+}
+
+} // namespace JSC
+
+namespace WTF {
+template<typename T> struct DefaultHash;
+
+template<> struct DefaultHash<JSC::TemplateRegistryKey> {
+    typedef JSC::TemplateRegistryKey::Hasher Hash;
+};
+
+template<> struct HashTraits<JSC::TemplateRegistryKey> : CustomHashTraits<JSC::TemplateRegistryKey> {
+};
+
+} // namespace WTF
diff --git a/runtime/TemplateRegistryKeyTable.cpp b/runtime/TemplateRegistryKeyTable.cpp
new file mode 100644
index 0000000..725a52a
--- /dev/null
+++ b/runtime/TemplateRegistryKeyTable.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TemplateRegistryKeyTable.h"
+
+#include "TemplateRegistryKey.h"
+
+namespace JSC {
+
+struct TemplateRegistryKeyTranslator {
+    static unsigned hash(TemplateRegistryKey* generator) { return generator->hash(); }
+    static inline bool equal(TemplateRegistryKey* key, TemplateRegistryKey* generator) { return *key == *generator; }
+    static void translate(TemplateRegistryKey*& location, TemplateRegistryKey* generator, unsigned) { location = generator; }
+};
+
+TemplateRegistryKeyTable::~TemplateRegistryKeyTable()
+{
+    for (auto& key : m_atomicTable)
+        key->m_table = nullptr;
+}
+
+Ref<TemplateRegistryKey> TemplateRegistryKeyTable::createKey(const TemplateRegistryKey::StringVector& rawStrings, const TemplateRegistryKey::StringVector& cookedStrings)
+{
+    auto key = TemplateRegistryKey::create(rawStrings, cookedStrings);
+    auto addResult = m_atomicTable.add<TemplateRegistryKeyTranslator>(key.ptr());
+    if (addResult.isNewEntry)
+        (*addResult.iterator)->m_table = this;
+
+    return **addResult.iterator;
+}
+
+void TemplateRegistryKeyTable::unregister(TemplateRegistryKey& key)
+{
+    ASSERT(key.m_table == this);
+    auto iterator = m_atomicTable.find(&key);
+    ASSERT_WITH_MESSAGE(iterator != m_atomicTable.end(), "The TemplateRegistryKey being removed is registered in the other TemplateRegistryKeyTable.");
+    m_atomicTable.remove(iterator);
+
+}
+
+} // namespace JSC
diff --git a/runtime/TemplateRegistryKeyTable.h b/runtime/TemplateRegistryKeyTable.h
new file mode 100644
index 0000000..9b10402
--- /dev/null
+++ b/runtime/TemplateRegistryKeyTable.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "TemplateRegistryKey.h"
+#include <wtf/Forward.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class TemplateRegistryKeyTable {
+    WTF_MAKE_NONCOPYABLE(TemplateRegistryKeyTable);
+public:
+    using StringVector = Vector<String, 4>;
+
+    TemplateRegistryKeyTable() = default;
+
+    Ref<TemplateRegistryKey> createKey(const StringVector& rawStrings, const StringVector& cookedStrings);
+
+    void unregister(TemplateRegistryKey&);
+
+    ~TemplateRegistryKeyTable();
+
+private:
+    struct KeyHash {
+        static unsigned hash(const TemplateRegistryKey* key) { return key->hash(); }
+        static bool equal(const TemplateRegistryKey* a, const TemplateRegistryKey* b) { return *a == *b; }
+        static const bool safeToCompareToEmptyOrDeleted = false;
+    };
+
+    HashSet<TemplateRegistryKey*, KeyHash> m_atomicTable;
+};
+
+} // namespace JSC
diff --git a/runtime/TestRunnerUtils.cpp b/runtime/TestRunnerUtils.cpp
new file mode 100644
index 0000000..628cd9b
--- /dev/null
+++ b/runtime/TestRunnerUtils.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2013-2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TestRunnerUtils.h"
+
+#include "CodeBlock.h"
+#include "FunctionCodeBlock.h"
+#include "HeapStatistics.h"
+#include "JSCInlines.h"
+#include "LLIntData.h"
+
+namespace JSC {
+
+FunctionExecutable* getExecutableForFunction(JSValue theFunctionValue)
+{
+    JSFunction* theFunction = jsDynamicCast<JSFunction*>(theFunctionValue);
+    if (!theFunction)
+        return 0;
+    
+    FunctionExecutable* executable = jsDynamicCast<FunctionExecutable*>(
+        theFunction->executable());
+    return executable;
+}
+
+CodeBlock* getSomeBaselineCodeBlockForFunction(JSValue theFunctionValue)
+{
+    FunctionExecutable* executable = getExecutableForFunction(theFunctionValue);
+    if (!executable)
+        return 0;
+    
+    CodeBlock* baselineCodeBlock = executable->baselineCodeBlockFor(CodeForCall);
+    
+    if (!baselineCodeBlock)
+        baselineCodeBlock = executable->baselineCodeBlockFor(CodeForConstruct);
+    
+    return baselineCodeBlock;
+}
+
+JSValue numberOfDFGCompiles(JSValue theFunctionValue)
+{
+    bool pretendToHaveManyCompiles = false;
+#if ENABLE(DFG_JIT)
+    if (!Options::useJIT() || !Options::useDFGJIT())
+        pretendToHaveManyCompiles = true;
+#else
+    pretendToHaveManyCompiles = true;
+#endif
+
+    if (CodeBlock* baselineCodeBlock = getSomeBaselineCodeBlockForFunction(theFunctionValue)) {
+        if (pretendToHaveManyCompiles)
+            return jsNumber(1000000.0);
+        return jsNumber(baselineCodeBlock->numberOfDFGCompiles());
+    }
+    
+    return jsNumber(0);
+}
+
+JSValue setNeverInline(JSValue theFunctionValue)
+{
+    if (FunctionExecutable* executable = getExecutableForFunction(theFunctionValue))
+        executable->setNeverInline(true);
+    
+    return jsUndefined();
+}
+
+JSValue setNeverOptimize(JSValue theFunctionValue)
+{
+    if (FunctionExecutable* executable = getExecutableForFunction(theFunctionValue))
+        executable->setNeverOptimize(true);
+    
+    return jsUndefined();
+}
+
+JSValue optimizeNextInvocation(JSValue theFunctionValue)
+{
+#if ENABLE(JIT)
+    if (CodeBlock* baselineCodeBlock = getSomeBaselineCodeBlockForFunction(theFunctionValue))
+        baselineCodeBlock->optimizeNextInvocation();
+#else
+    UNUSED_PARAM(theFunctionValue);
+#endif
+
+    return jsUndefined();
+}
+
+JSValue failNextNewCodeBlock(ExecState* exec)
+{
+    exec->vm().setFailNextNewCodeBlock();
+
+    return jsUndefined();
+}
+
+JSValue numberOfDFGCompiles(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+    return numberOfDFGCompiles(exec->uncheckedArgument(0));
+}
+
+JSValue setNeverInline(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+    return setNeverInline(exec->uncheckedArgument(0));
+}
+
+JSValue setNeverOptimize(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+    return setNeverOptimize(exec->uncheckedArgument(0));
+}
+
+JSValue setCannotUseOSRExitFuzzing(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+
+    JSValue theFunctionValue = exec->uncheckedArgument(0);
+    if (FunctionExecutable* executable = getExecutableForFunction(theFunctionValue))
+        executable->setCanUseOSRExitFuzzing(false);
+
+    return jsUndefined();
+}
+
+JSValue optimizeNextInvocation(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return jsUndefined();
+    return optimizeNextInvocation(exec->uncheckedArgument(0));
+}
+
+// This is a hook called at the bitter end of some of our tests.
+void finalizeStatsAtEndOfTesting()
+{
+    if (Options::logHeapStatisticsAtExit())
+        HeapStatistics::reportSuccess();
+    if (Options::reportLLIntStats())
+        LLInt::Data::finalizeStats();
+}
+
+} // namespace JSC
+
diff --git a/runtime/TestRunnerUtils.h b/runtime/TestRunnerUtils.h
new file mode 100644
index 0000000..321ae4e
--- /dev/null
+++ b/runtime/TestRunnerUtils.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+class CodeBlock;
+class FunctionExecutable;
+
+JS_EXPORT_PRIVATE FunctionExecutable* getExecutableForFunction(JSValue theFunctionValue);
+JS_EXPORT_PRIVATE CodeBlock* getSomeBaselineCodeBlockForFunction(JSValue theFunctionValue);
+
+JS_EXPORT_PRIVATE JSValue numberOfDFGCompiles(JSValue function);
+JS_EXPORT_PRIVATE JSValue setNeverInline(JSValue function);
+JS_EXPORT_PRIVATE JSValue setNeverOptimize(JSValue function);
+JS_EXPORT_PRIVATE JSValue optimizeNextInvocation(JSValue function);
+
+JS_EXPORT_PRIVATE JSValue failNextNewCodeBlock(ExecState*);
+JS_EXPORT_PRIVATE JSValue numberOfDFGCompiles(ExecState*);
+JS_EXPORT_PRIVATE JSValue setNeverInline(ExecState*);
+JS_EXPORT_PRIVATE JSValue setNeverOptimize(ExecState*);
+JS_EXPORT_PRIVATE JSValue setCannotUseOSRExitFuzzing(ExecState*);
+JS_EXPORT_PRIVATE JSValue optimizeNextInvocation(ExecState*);
+
+JS_EXPORT_PRIVATE unsigned numberOfExceptionFuzzChecks();
+JS_EXPORT_PRIVATE unsigned numberOfExecutableAllocationFuzzChecks();
+JS_EXPORT_PRIVATE unsigned numberOfStaticOSRExitFuzzChecks();
+JS_EXPORT_PRIVATE unsigned numberOfOSRExitFuzzChecks();
+
+JS_EXPORT_PRIVATE void finalizeStatsAtEndOfTesting();
+
+} // namespace JSC
diff --git a/runtime/ThrowScope.cpp b/runtime/ThrowScope.cpp
new file mode 100644
index 0000000..06163ba
--- /dev/null
+++ b/runtime/ThrowScope.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ThrowScope.h"
+
+#include "Exception.h"
+#include "JSCInlines.h"
+#include "VM.h"
+
+namespace JSC {
+    
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+
+ThrowScope::ThrowScope(VM& vm, ExceptionEventLocation location)
+    : ExceptionScope(vm, location)
+{
+    m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);
+}
+
+ThrowScope::~ThrowScope()
+{
+    RELEASE_ASSERT(m_vm.m_topExceptionScope);
+
+    if (!m_isReleased)
+        m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);
+    else {
+        // If we released the scope, that means we're letting our callers do the
+        // exception check. However, because our caller may be a LLInt or JIT
+        // function (which always checks for exceptions but won't clear the
+        // m_needExceptionCheck bit), we should clear m_needExceptionCheck here
+        // and let code below decide if we need to simulate a re-throw.
+        m_vm.m_needExceptionCheck = false;
+    }
+
+    bool willBeHandleByLLIntOrJIT = false;
+    void* previousScope = m_previousScope;
+    void* topVMEntryFrame = m_vm.topVMEntryFrame;
+
+    // If the topVMEntryFrame was pushed on the stack after the previousScope was instantiated,
+    // then this throwScope will be returning to LLINT or JIT code that always do an exception
+    // check. In that case, skip the simulated throw because the LLInt and JIT will be
+    // checking for the exception their own way instead of calling ThrowScope::exception().
+    if (topVMEntryFrame && previousScope > topVMEntryFrame)
+        willBeHandleByLLIntOrJIT = true;
+    
+    if (!willBeHandleByLLIntOrJIT)
+        simulateThrow();
+}
+
+void ThrowScope::throwException(ExecState* exec, Exception* exception)
+{
+    if (m_vm.exception() && m_vm.exception() != exception)
+        m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);
+    
+    m_vm.throwException(exec, exception);
+}
+
+JSValue ThrowScope::throwException(ExecState* exec, JSValue error)
+{
+    if (!error.isCell() || !jsDynamicCast<Exception*>(error.asCell()))
+        m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);
+    
+    return m_vm.throwException(exec, error);
+}
+
+JSObject* ThrowScope::throwException(ExecState* exec, JSObject* obj)
+{
+    if (!jsDynamicCast<Exception*>(obj))
+        m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);
+    
+    return m_vm.throwException(exec, obj);
+}
+
+void ThrowScope::simulateThrow()
+{
+    RELEASE_ASSERT(m_vm.m_topExceptionScope);
+    m_vm.m_simulatedThrowPointLocation = m_location;
+    m_vm.m_simulatedThrowPointRecursionDepth = m_recursionDepth;
+    m_vm.m_needExceptionCheck = true;
+
+    if (Options::dumpSimulatedThrows()) {
+        dataLog("Simulated throw from this scope: ", m_location, "\n");
+        dataLog("    (ExceptionScope::m_recursionDepth was ", m_recursionDepth, ")\n");
+        WTFReportBacktrace();
+    }
+}
+
+#endif // ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    
+} // namespace JSC
diff --git a/runtime/ThrowScope.h b/runtime/ThrowScope.h
new file mode 100644
index 0000000..7cd787f
--- /dev/null
+++ b/runtime/ThrowScope.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ExceptionScope.h"
+
+namespace JSC {
+
+class ExecState;
+class JSObject;
+
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+
+// If a function can throw a JS exception, it should declare a ThrowScope at the
+// top of the function (as early as possible) using the DECLARE_THROW_SCOPE macro.
+// Declaring a ThrowScope in a function means that the function may throw an
+// exception that its caller will have to handle.
+
+class ThrowScope : public ExceptionScope {
+public:
+    JS_EXPORT_PRIVATE ThrowScope(VM&, ExceptionEventLocation);
+    JS_EXPORT_PRIVATE ~ThrowScope();
+
+    ThrowScope(const ThrowScope&) = delete;
+    ThrowScope(ThrowScope&&) = default;
+
+    JS_EXPORT_PRIVATE void throwException(ExecState*, Exception*);
+    JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
+
+    void release() { m_isReleased = true; }
+
+    JS_EXPORT_PRIVATE void printIfNeedCheck(const char* functionName, const char* file, unsigned line);
+
+private:
+    void simulateThrow();
+
+    bool m_isReleased { false };
+};
+
+#define DECLARE_THROW_SCOPE(vm__) \
+    JSC::ThrowScope((vm__), JSC::ExceptionEventLocation(__FUNCTION__, __FILE__, __LINE__))
+
+#define throwScopePrintIfNeedCheck(scope__) \
+    scope__.printIfNeedCheck(__FUNCTION__, __FILE__, __LINE__)
+
+#else // not ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+
+class ThrowScope : public ExceptionScope {
+public:
+    ALWAYS_INLINE ThrowScope(VM& vm)
+        : ExceptionScope(vm)
+    { }
+    ThrowScope(const ThrowScope&) = delete;
+    ThrowScope(ThrowScope&&) = default;
+
+    ALWAYS_INLINE void throwException(ExecState* exec, Exception* exception) { m_vm.throwException(exec, exception); }
+    ALWAYS_INLINE JSValue throwException(ExecState* exec, JSValue value) { return m_vm.throwException(exec, value); }
+    ALWAYS_INLINE JSObject* throwException(ExecState* exec, JSObject* obj) { return m_vm.throwException(exec, obj); }
+
+    ALWAYS_INLINE void release() { }
+};
+
+#define DECLARE_THROW_SCOPE(vm__) \
+    JSC::ThrowScope((vm__))
+
+#endif // ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+
+ALWAYS_INLINE void throwException(ExecState* exec, ThrowScope& scope, Exception* exception)
+{
+    scope.throwException(exec, exception);
+}
+
+ALWAYS_INLINE JSValue throwException(ExecState* exec, ThrowScope& scope, JSValue value)
+{
+    return scope.throwException(exec, value);
+}
+
+ALWAYS_INLINE JSObject* throwException(ExecState* exec, ThrowScope& scope, JSObject* obj)
+{
+    return scope.throwException(exec, obj);
+}
+
+} // namespace JSC
diff --git a/runtime/ToNativeFromValue.h b/runtime/ToNativeFromValue.h
new file mode 100644
index 0000000..fd61843
--- /dev/null
+++ b/runtime/ToNativeFromValue.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+template<typename Adaptor>
+typename Adaptor::Type toNativeFromValue(JSValue value)
+{
+    if (value.isInt32())
+        return Adaptor::toNativeFromInt32(value.asInt32());
+    return Adaptor::toNativeFromDouble(value.asDouble());
+}
+
+template<typename Adaptor>
+typename Adaptor::Type toNativeFromValue(ExecState* exec, JSValue value)
+{
+    if (value.isInt32())
+        return Adaptor::toNativeFromInt32(value.asInt32());
+    if (value.isNumber())
+        return Adaptor::toNativeFromDouble(value.asDouble());
+    return Adaptor::toNativeFromDouble(value.toNumber(exec));
+}
+
+template<typename Adaptor>
+std::optional<typename Adaptor::Type> toNativeFromValueWithoutCoercion(JSValue value)
+{
+    if (!value.isNumber())
+        return std::nullopt;
+    if (value.isInt32())
+        return Adaptor::toNativeFromInt32WithoutCoercion(value.asInt32());
+    return Adaptor::toNativeFromDoubleWithoutCoercion(value.asDouble());
+}
+
+} // namespace JSC
diff --git a/runtime/TypeError.h b/runtime/TypeError.h
new file mode 100644
index 0000000..85a795e
--- /dev/null
+++ b/runtime/TypeError.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "CallFrame.h"
+#include "Error.h"
+
+namespace JSC {
+
+inline bool typeError(ExecState* exec, ThrowScope& scope, bool throwException, ASCIILiteral message)
+{
+    if (throwException)
+        throwTypeError(exec, scope, message);
+    return false;
+}
+
+} // namespace JSC
diff --git a/runtime/TypeLocationCache.cpp b/runtime/TypeLocationCache.cpp
new file mode 100644
index 0000000..4c8069a
--- /dev/null
+++ b/runtime/TypeLocationCache.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+#include "TypeLocationCache.h"
+
+#include "TypeProfiler.h"
+#include "VM.h"
+
+namespace JSC {
+
+std::pair<TypeLocation*, bool> TypeLocationCache::getTypeLocation(GlobalVariableID globalVariableID, intptr_t sourceID, unsigned start, unsigned end, PassRefPtr<TypeSet> globalTypeSet, VM* vm)
+{
+    LocationKey key;
+    key.m_globalVariableID = globalVariableID;
+    key.m_sourceID = sourceID;
+    key.m_start = start;
+    key.m_end = end;
+
+    bool isNewLocation = false;
+    if (m_locationMap.find(key) == m_locationMap.end()) {
+        ASSERT(vm->typeProfiler());
+        TypeLocation* location = vm->typeProfiler()->nextTypeLocation();
+        location->m_globalVariableID = globalVariableID;
+        location->m_sourceID = sourceID;
+        location->m_divotStart = start;
+        location->m_divotEnd = end;
+        location->m_globalTypeSet = globalTypeSet;
+
+        m_locationMap[key] = location;
+        isNewLocation = true;
+    }
+
+    TypeLocation* location = m_locationMap.find(key)->second;
+    return std::pair<TypeLocation*, bool>(location, isNewLocation);
+}
+
+} // namespace JSC
diff --git a/runtime/TypeLocationCache.h b/runtime/TypeLocationCache.h
new file mode 100644
index 0000000..8e6545d
--- /dev/null
+++ b/runtime/TypeLocationCache.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "TypeLocation.h"
+#include <unordered_map>
+#include <wtf/HashMethod.h>
+
+namespace JSC {
+
+class VM;
+
+class TypeLocationCache {
+public:
+    struct LocationKey {
+        LocationKey() {}
+        bool operator==(const LocationKey& other) const 
+        {
+            return m_globalVariableID == other.m_globalVariableID
+                && m_sourceID == other.m_sourceID
+                && m_start == other.m_start
+                && m_end == other.m_end;
+        }
+
+        unsigned hash() const
+        {
+            return m_globalVariableID + m_sourceID + m_start + m_end;
+        }
+
+        GlobalVariableID m_globalVariableID;
+        intptr_t m_sourceID;
+        unsigned m_start;
+        unsigned m_end;
+    };
+
+    std::pair<TypeLocation*, bool> getTypeLocation(GlobalVariableID, intptr_t, unsigned start, unsigned end, PassRefPtr<TypeSet>, VM*);
+private:     
+    typedef std::unordered_map<LocationKey, TypeLocation*, HashMethod<LocationKey>> LocationMap;
+    LocationMap m_locationMap;
+};
+
+} // namespace JSC
diff --git a/runtime/TypeProfiler.cpp b/runtime/TypeProfiler.cpp
new file mode 100644
index 0000000..ab97492
--- /dev/null
+++ b/runtime/TypeProfiler.cpp
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TypeProfiler.h"
+
+#include "InspectorProtocolObjects.h"
+#include "TypeLocation.h"
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC {
+
+static const bool verbose = false;
+
+TypeProfiler::TypeProfiler()
+    : m_nextUniqueVariableID(1)
+{ 
+}
+
+void TypeProfiler::logTypesForTypeLocation(TypeLocation* location, VM& vm)
+{
+    TypeProfilerSearchDescriptor descriptor = location->m_globalVariableID == TypeProfilerReturnStatement ? TypeProfilerSearchDescriptorFunctionReturn : TypeProfilerSearchDescriptorNormal;
+
+    dataLogF("[Start, End]::[%u, %u]\n", location->m_divotStart, location->m_divotEnd);
+
+    if (findLocation(location->m_divotStart, location->m_sourceID, descriptor, vm))
+        dataLog("\t\t[Entry IS in System]\n");
+    else
+        dataLog("\t\t[Entry IS NOT in system]\n");
+
+    dataLog("\t\t", location->m_globalVariableID == TypeProfilerReturnStatement ? "[Return Statement]" : "[Normal Statement]", "\n");
+
+    dataLog("\t\t#Local#\n\t\t", location->m_instructionTypeSet->dumpTypes().replace("\n", "\n\t\t"), "\n");
+    if (location->m_globalTypeSet)
+        dataLog("\t\t#Global#\n\t\t", location->m_globalTypeSet->dumpTypes().replace("\n", "\n\t\t"), "\n");
+}
+
+void TypeProfiler::insertNewLocation(TypeLocation* location)
+{
+    if (verbose)
+        dataLogF("Registering location:: divotStart:%u, divotEnd:%u\n", location->m_divotStart, location->m_divotEnd);
+
+    if (!m_bucketMap.contains(location->m_sourceID)) {
+        Vector<TypeLocation*> bucket;
+        m_bucketMap.set(location->m_sourceID, bucket);
+    }
+
+    Vector<TypeLocation*>& bucket = m_bucketMap.find(location->m_sourceID)->value;
+    bucket.append(location);
+}
+
+String TypeProfiler::typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptor descriptor, unsigned offset, intptr_t sourceID, VM& vm)
+{
+    // This returns a JSON string representing an Object with the following properties:
+    //     globalTypeSet: 'JSON<TypeSet> | null'
+    //     instructionTypeSet: 'JSON<TypeSet>'
+
+    TypeLocation* location = findLocation(offset, sourceID, descriptor, vm);
+    ASSERT(location);
+
+    StringBuilder json;  
+
+    json.append('{');
+
+    json.appendLiteral("\"globalTypeSet\":");
+    if (location->m_globalTypeSet && location->m_globalVariableID != TypeProfilerNoGlobalIDExists)
+        json.append(location->m_globalTypeSet->toJSONString());
+    else
+        json.appendLiteral("null");
+    json.append(',');
+
+    json.appendLiteral("\"instructionTypeSet\":");
+    json.append(location->m_instructionTypeSet->toJSONString());
+    json.append(',');
+
+    json.appendLiteral("\"isOverflown\":");
+    if (location->m_instructionTypeSet->isOverflown() || (location->m_globalTypeSet && location->m_globalTypeSet->isOverflown()))
+        json.appendLiteral("true");
+    else
+        json.appendLiteral("false");
+
+    json.append('}');
+    
+    return json.toString();
+}
+
+TypeLocation* TypeProfiler::findLocation(unsigned divot, intptr_t sourceID, TypeProfilerSearchDescriptor descriptor, VM& vm)
+{
+    QueryKey queryKey(sourceID, divot, descriptor);
+    auto iter = m_queryCache.find(queryKey);
+    if (iter != m_queryCache.end())
+        return iter->value;
+
+    if (!vm.functionHasExecutedCache()->hasExecutedAtOffset(sourceID, divot))
+        return nullptr;
+
+    if (!m_bucketMap.contains(sourceID))
+        return nullptr;
+
+    Vector<TypeLocation*>& bucket = m_bucketMap.find(sourceID)->value;
+    TypeLocation* bestMatch = nullptr;
+    unsigned distance = UINT_MAX; // Because assignments may be nested, make sure we find the closest enclosing assignment to this character offset.
+    for (size_t i = 0, size = bucket.size(); i < size; i++) {
+        TypeLocation* location = bucket.at(i);
+        // We found the type location that correlates to the convergence of all return statements in a function.
+        // This text offset is the offset of the opening brace in a function declaration.
+        if (descriptor == TypeProfilerSearchDescriptorFunctionReturn && location->m_globalVariableID == TypeProfilerReturnStatement && location->m_divotForFunctionOffsetIfReturnStatement == divot)
+            return location;
+
+        if (descriptor != TypeProfilerSearchDescriptorFunctionReturn && location->m_globalVariableID != TypeProfilerReturnStatement && location->m_divotStart <= divot && divot <= location->m_divotEnd && location->m_divotEnd - location->m_divotStart <= distance) {
+            distance = location->m_divotEnd - location->m_divotStart;
+            bestMatch = location;
+        }
+    }
+
+    if (bestMatch)
+        m_queryCache.set(queryKey, bestMatch);
+    // FIXME: BestMatch should never be null past this point. This doesn't hold currently because we ignore var assignments when code contains eval/With (VarInjection). 
+    // https://bugs.webkit.org/show_bug.cgi?id=135184
+    return bestMatch;
+}
+
+TypeLocation* TypeProfiler::nextTypeLocation() 
+{ 
+    return m_typeLocationInfo.add(); 
+}
+
+void TypeProfiler::invalidateTypeSetCache()
+{
+    for (Bag<TypeLocation>::iterator iter = m_typeLocationInfo.begin(); !!iter; ++iter) {
+        TypeLocation* location = *iter;
+        location->m_instructionTypeSet->invalidateCache();
+        if (location->m_globalTypeSet)
+            location->m_globalTypeSet->invalidateCache();
+    }
+}
+
+void TypeProfiler::dumpTypeProfilerData(VM& vm)
+{
+    for (Bag<TypeLocation>::iterator iter = m_typeLocationInfo.begin(); !!iter; ++iter) {
+        TypeLocation* location = *iter;
+        logTypesForTypeLocation(location, vm);
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/TypeProfiler.h b/runtime/TypeProfiler.h
new file mode 100644
index 0000000..dc8ce4a
--- /dev/null
+++ b/runtime/TypeProfiler.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CodeBlock.h"
+#include "TypeLocation.h"
+#include "TypeLocationCache.h"
+#include <wtf/Bag.h>
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace Inspector { namespace Protocol  { namespace Runtime {
+class TypeDescription;
+}}}
+
+namespace JSC {
+
+enum TypeProfilerSearchDescriptor {
+    TypeProfilerSearchDescriptorNormal = 1,
+    TypeProfilerSearchDescriptorFunctionReturn = 2
+};
+
+struct QueryKey {
+    QueryKey()
+        : m_sourceID(0)
+        , m_divot(0)
+        , m_searchDescriptor(TypeProfilerSearchDescriptorFunctionReturn)
+    { }
+
+    QueryKey(intptr_t sourceID, unsigned divot, TypeProfilerSearchDescriptor searchDescriptor)
+        : m_sourceID(sourceID)
+        , m_divot(divot)
+        , m_searchDescriptor(searchDescriptor)
+    { }
+
+    QueryKey(WTF::HashTableDeletedValueType)
+        : m_sourceID(INTPTR_MAX)
+        , m_divot(UINT_MAX)
+        , m_searchDescriptor(TypeProfilerSearchDescriptorFunctionReturn)
+    { }
+
+    bool isHashTableDeletedValue() const 
+    { 
+        return m_sourceID == INTPTR_MAX 
+            && m_divot == UINT_MAX
+            && m_searchDescriptor == TypeProfilerSearchDescriptorFunctionReturn;
+    }
+
+    bool operator==(const QueryKey& other) const
+    {
+        return m_sourceID == other.m_sourceID 
+            && m_divot == other.m_divot
+            && m_searchDescriptor == other.m_searchDescriptor;
+    }
+
+    unsigned hash() const 
+    { 
+        unsigned hash = m_sourceID + m_divot * m_searchDescriptor;
+        return hash;
+    }
+
+    intptr_t m_sourceID;
+    unsigned m_divot;
+    TypeProfilerSearchDescriptor m_searchDescriptor;
+};
+
+struct QueryKeyHash {
+    static unsigned hash(const QueryKey& key) { return key.hash(); }
+    static bool equal(const QueryKey& a, const QueryKey& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::QueryKey> {
+    typedef JSC::QueryKeyHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::QueryKey> : SimpleClassHashTraits<JSC::QueryKey> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
+
+namespace JSC {
+
+class VM;
+
+class TypeProfiler {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    TypeProfiler();
+    void logTypesForTypeLocation(TypeLocation*, VM&);
+    JS_EXPORT_PRIVATE String typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptor, unsigned offset, intptr_t sourceID, VM&);
+    void insertNewLocation(TypeLocation*);
+    TypeLocationCache* typeLocationCache() { return &m_typeLocationCache; }
+    TypeLocation* findLocation(unsigned divot, intptr_t sourceID, TypeProfilerSearchDescriptor, VM&);
+    GlobalVariableID getNextUniqueVariableID() { return m_nextUniqueVariableID++; }
+    TypeLocation* nextTypeLocation();
+    void invalidateTypeSetCache();
+    void dumpTypeProfilerData(VM&);
+    
+private:
+    typedef HashMap<intptr_t, Vector<TypeLocation*>> SourceIDToLocationBucketMap;
+    SourceIDToLocationBucketMap m_bucketMap;
+    TypeLocationCache m_typeLocationCache;
+    typedef HashMap<QueryKey, TypeLocation*> TypeLocationQueryCache;
+    TypeLocationQueryCache m_queryCache;
+    GlobalVariableID m_nextUniqueVariableID;
+    Bag<TypeLocation> m_typeLocationInfo;
+};
+
+} // namespace JSC
diff --git a/runtime/TypeProfilerLog.cpp b/runtime/TypeProfilerLog.cpp
new file mode 100644
index 0000000..6d98335
--- /dev/null
+++ b/runtime/TypeProfilerLog.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TypeProfilerLog.h"
+
+#include "JSCInlines.h"
+#include "SlotVisitor.h"
+#include "TypeLocation.h"
+#include <wtf/CurrentTime.h>
+
+
+namespace JSC {
+
+static const bool verbose = false;
+
+void TypeProfilerLog::initializeLog()
+{
+    ASSERT(!m_logStartPtr);
+    m_logSize = 50000;
+    m_logStartPtr = new LogEntry[m_logSize];
+    m_currentLogEntryPtr = m_logStartPtr;
+    m_logEndPtr = m_logStartPtr + m_logSize;
+}
+
+TypeProfilerLog::~TypeProfilerLog()
+{
+    delete[] m_logStartPtr;
+}
+
+void TypeProfilerLog::processLogEntries(const String& reason)
+{
+    double before = 0;
+    if (verbose) {
+        dataLog("Process caller:'", reason, "'");
+        before = currentTimeMS();
+    }
+
+    LogEntry* entry = m_logStartPtr;
+    HashMap<Structure*, RefPtr<StructureShape>> seenShapes;
+    while (entry != m_currentLogEntryPtr) {
+        StructureID id = entry->structureID;
+        RefPtr<StructureShape> shape; 
+        JSValue value = entry->value;
+        Structure* structure = nullptr;
+        if (id) {
+            structure = Heap::heap(value.asCell())->structureIDTable().get(id); 
+            auto iter = seenShapes.find(structure);
+            if (iter == seenShapes.end()) {
+                shape = structure->toStructureShape(value);
+                seenShapes.set(structure, shape);
+            } else
+                shape = iter->value;
+        }
+
+        RuntimeType type = runtimeTypeForValue(value);
+        TypeLocation* location = entry->location;
+        location->m_lastSeenType = type;
+        if (location->m_globalTypeSet)
+            location->m_globalTypeSet->addTypeInformation(type, shape, structure);
+        location->m_instructionTypeSet->addTypeInformation(type, shape, structure);
+
+        entry++;
+    }
+
+    // Note that we don't update this cursor until we're done processing the log.
+    // This allows us to have a sane story in case we have to mark the log
+    // while processing through it. We won't be iterating over the log while
+    // marking it, but we may be in the middle of iterating over when the mutator
+    // pauses and causes the collector to mark the log.
+    m_currentLogEntryPtr = m_logStartPtr;
+
+    if (verbose) {
+        double after = currentTimeMS();
+        dataLogF(" Processing the log took: '%f' ms\n", after - before);
+    }
+}
+
+void TypeProfilerLog::visit(SlotVisitor& visitor)
+{
+    for (LogEntry* entry = m_logStartPtr; entry != m_currentLogEntryPtr; ++entry) {
+        visitor.appendUnbarriered(entry->value);
+        if (StructureID id = entry->structureID) {
+            Structure* structure = visitor.heap()->structureIDTable().get(id); 
+            visitor.appendUnbarriered(structure);
+        }
+    }
+}
+
+} // namespace JSC
diff --git a/runtime/TypeProfilerLog.h b/runtime/TypeProfilerLog.h
new file mode 100644
index 0000000..01f6ae6
--- /dev/null
+++ b/runtime/TypeProfilerLog.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "Structure.h"
+#include "TypeProfiler.h"
+
+namespace JSC {
+
+class TypeLocation;
+
+class TypeProfilerLog {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    struct LogEntry {
+    public:
+        friend class LLIntOffsetsExtractor;
+
+        JSValue value;
+        TypeLocation* location; 
+        StructureID structureID;
+
+        static ptrdiff_t structureIDOffset() { return OBJECT_OFFSETOF(LogEntry, structureID); }
+        static ptrdiff_t valueOffset() { return OBJECT_OFFSETOF(LogEntry, value); }
+        static ptrdiff_t locationOffset() { return OBJECT_OFFSETOF(LogEntry, location); }
+    };
+
+
+    TypeProfilerLog()
+        : m_logStartPtr(0)
+    {
+        initializeLog();
+    }
+
+    ~TypeProfilerLog();
+
+    JS_EXPORT_PRIVATE void processLogEntries(const String&);
+    LogEntry* logEndPtr() const { return m_logEndPtr; }
+
+    void visit(SlotVisitor&);
+
+    static ptrdiff_t logStartOffset() { return OBJECT_OFFSETOF(TypeProfilerLog, m_logStartPtr); }
+    static ptrdiff_t currentLogEntryOffset() { return OBJECT_OFFSETOF(TypeProfilerLog, m_currentLogEntryPtr); }
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    void initializeLog();
+
+    unsigned m_logSize;
+    LogEntry* m_logStartPtr;
+    LogEntry* m_currentLogEntryPtr;
+    LogEntry* m_logEndPtr;
+};
+
+} // namespace JSC
diff --git a/runtime/TypeSet.cpp b/runtime/TypeSet.cpp
new file mode 100644
index 0000000..1f638c0
--- /dev/null
+++ b/runtime/TypeSet.cpp
@@ -0,0 +1,592 @@
+/*
+ * Copyright (C) 2014, 2015 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TypeSet.h"
+
+#include "InspectorProtocolObjects.h"
+#include "JSCInlines.h"
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+TypeSet::TypeSet()
+    : m_isOverflown(false)
+    , m_seenTypes(TypeNothing)
+{
+}
+
+void TypeSet::addTypeInformation(RuntimeType type, PassRefPtr<StructureShape> prpNewShape, Structure* structure) 
+{
+    RefPtr<StructureShape> newShape = prpNewShape;
+    m_seenTypes = m_seenTypes | type;
+
+    if (structure && newShape && !runtimeTypeIsPrimitive(type)) {
+        if (!m_structureSet.contains(structure)) {
+            {
+                ConcurrentJSLocker locker(m_lock);
+                m_structureSet.add(structure);
+            }
+            // Make one more pass making sure that: 
+            // - We don't have two instances of the same shape. (Same shapes may have different Structures).
+            // - We don't have two shapes that share the same prototype chain. If these shapes share the same 
+            //   prototype chain, they will be merged into one shape.
+            bool found = false;
+            String hash = newShape->propertyHash();
+            for (size_t i = 0; i < m_structureHistory.size(); i++) {
+                RefPtr<StructureShape>& seenShape = m_structureHistory.at(i);
+                if (seenShape->propertyHash() == hash) {
+                    found = true;
+                    break;
+                } 
+                if (seenShape->hasSamePrototypeChain(newShape)) {
+                    seenShape = StructureShape::merge(seenShape, newShape);
+                    found = true;
+                    break;
+                }
+            }
+
+            if (!found) {
+                if (m_structureHistory.size() < 100)
+                    m_structureHistory.append(newShape);
+                else if (!m_isOverflown)
+                    m_isOverflown = true;
+            }
+        }
+    }
+}
+
+void TypeSet::invalidateCache()
+{
+    ConcurrentJSLocker locker(m_lock);
+    auto keepMarkedStructuresFilter = [] (Structure* structure) -> bool { return Heap::isMarked(structure); };
+    m_structureSet.genericFilter(keepMarkedStructuresFilter);
+}
+
+String TypeSet::dumpTypes() const
+{
+    if (m_seenTypes == TypeNothing)
+        return ASCIILiteral("(Unreached Statement)");
+
+    StringBuilder seen;
+
+    if (m_seenTypes & TypeFunction)
+        seen.appendLiteral("Function ");
+    if (m_seenTypes & TypeUndefined)
+        seen.appendLiteral("Undefined ");
+    if (m_seenTypes & TypeNull)
+        seen.appendLiteral("Null ");
+    if (m_seenTypes & TypeBoolean)
+        seen.appendLiteral("Boolean ");
+    if (m_seenTypes & TypeAnyInt)
+        seen.appendLiteral("AnyInt ");
+    if (m_seenTypes & TypeNumber)
+        seen.appendLiteral("Number ");
+    if (m_seenTypes & TypeString)
+        seen.appendLiteral("String ");
+    if (m_seenTypes & TypeObject)
+        seen.appendLiteral("Object ");
+    if (m_seenTypes & TypeSymbol)
+        seen.appendLiteral("Symbol ");
+
+    for (size_t i = 0; i < m_structureHistory.size(); i++) {
+        RefPtr<StructureShape> shape = m_structureHistory.at(i);
+        seen.append(shape->m_constructorName);
+        seen.append(' ');
+    }
+
+    if (m_structureHistory.size()) 
+        seen.appendLiteral("\nStructures:[ ");
+    for (size_t i = 0; i < m_structureHistory.size(); i++) {
+        seen.append(m_structureHistory.at(i)->stringRepresentation());
+        seen.append(' ');
+    }
+    if (m_structureHistory.size())
+        seen.append(']');
+
+    if (m_structureHistory.size()) {
+        seen.appendLiteral("\nLeast Common Ancestor: ");
+        seen.append(leastCommonAncestor());
+    }
+
+    return seen.toString();
+}
+
+bool TypeSet::doesTypeConformTo(RuntimeTypeMask test) const
+{
+    // This function checks if our seen types conform  to the types described by the test bitstring. (i.e we haven't seen more types than test).
+    // We are <= to those types if ANDing with the bitstring doesn't zero out any of our bits.
+
+    // For example:
+
+    // 0b0110 (seen)
+    // 0b1111 (test)
+    // ------ (AND)
+    // 0b0110 == seen
+
+    // 0b0110 (seen)
+    // 0b0010 (test)
+    // ------ (AND)
+    // 0b0010 != seen
+
+    return m_seenTypes != TypeNothing && (m_seenTypes & test) == m_seenTypes;
+}
+
+String TypeSet::displayName() const
+{
+    if (m_seenTypes == TypeNothing)
+        return emptyString();
+
+    if (m_structureHistory.size() && doesTypeConformTo(TypeObject | TypeNull | TypeUndefined)) {
+        String ctorName = leastCommonAncestor(); 
+
+        if (doesTypeConformTo(TypeObject))
+            return ctorName;
+        if (doesTypeConformTo(TypeObject | TypeNull | TypeUndefined))
+            return ctorName + '?';
+    }
+
+    // The order of these checks are important. For example, if a value is only a function, it conforms to TypeFunction, but it also conforms to TypeFunction | TypeNull.
+    // Therefore, more specific types must be checked first.
+
+    if (doesTypeConformTo(TypeFunction))
+        return ASCIILiteral("Function");
+    if (doesTypeConformTo(TypeUndefined))
+        return ASCIILiteral("Undefined");
+    if (doesTypeConformTo(TypeNull))
+        return ASCIILiteral("Null");
+    if (doesTypeConformTo(TypeBoolean))
+        return ASCIILiteral("Boolean");
+    if (doesTypeConformTo(TypeAnyInt))
+        return ASCIILiteral("Integer");
+    if (doesTypeConformTo(TypeNumber | TypeAnyInt))
+        return ASCIILiteral("Number");
+    if (doesTypeConformTo(TypeString))
+        return ASCIILiteral("String");
+    if (doesTypeConformTo(TypeSymbol))
+        return ASCIILiteral("Symbol");
+
+    if (doesTypeConformTo(TypeNull | TypeUndefined))
+        return ASCIILiteral("(?)");
+
+    if (doesTypeConformTo(TypeFunction | TypeNull | TypeUndefined))
+        return ASCIILiteral("Function?");
+    if (doesTypeConformTo(TypeBoolean | TypeNull | TypeUndefined))
+        return ASCIILiteral("Boolean?");
+    if (doesTypeConformTo(TypeAnyInt | TypeNull | TypeUndefined))
+        return ASCIILiteral("Integer?");
+    if (doesTypeConformTo(TypeNumber | TypeAnyInt | TypeNull | TypeUndefined))
+        return ASCIILiteral("Number?");
+    if (doesTypeConformTo(TypeString | TypeNull | TypeUndefined))
+        return ASCIILiteral("String?");
+    if (doesTypeConformTo(TypeSymbol | TypeNull | TypeUndefined))
+        return ASCIILiteral("Symbol?");
+   
+    if (doesTypeConformTo(TypeObject | TypeFunction | TypeString))
+        return ASCIILiteral("Object");
+    if (doesTypeConformTo(TypeObject | TypeFunction | TypeString | TypeNull | TypeUndefined))
+        return ASCIILiteral("Object?");
+
+    return ASCIILiteral("(many)");
+}
+
+String TypeSet::leastCommonAncestor() const
+{
+    return StructureShape::leastCommonAncestor(m_structureHistory);
+}
+
+Ref<Inspector::Protocol::Array<Inspector::Protocol::Runtime::StructureDescription>> TypeSet::allStructureRepresentations() const
+{
+    auto description = Inspector::Protocol::Array<Inspector::Protocol::Runtime::StructureDescription>::create();
+
+    for (size_t i = 0; i < m_structureHistory.size(); i++)
+        description->addItem(m_structureHistory.at(i)->inspectorRepresentation());
+
+    return description;
+}
+
+Ref<Inspector::Protocol::Runtime::TypeSet> TypeSet::inspectorTypeSet() const
+{
+    return Inspector::Protocol::Runtime::TypeSet::create()
+        .setIsFunction((m_seenTypes & TypeFunction) != TypeNothing)
+        .setIsUndefined((m_seenTypes & TypeUndefined) != TypeNothing)
+        .setIsNull((m_seenTypes & TypeNull) != TypeNothing)
+        .setIsBoolean((m_seenTypes & TypeBoolean) != TypeNothing)
+        .setIsInteger((m_seenTypes & TypeAnyInt) != TypeNothing)
+        .setIsNumber((m_seenTypes & TypeNumber) != TypeNothing)
+        .setIsString((m_seenTypes & TypeString) != TypeNothing)
+        .setIsObject((m_seenTypes & TypeObject) != TypeNothing)
+        .setIsSymbol((m_seenTypes & TypeSymbol) != TypeNothing)
+        .release();
+}
+
+String TypeSet::toJSONString() const
+{
+    // This returns a JSON string representing an Object with the following properties:
+    //     displayTypeName: 'String'
+    //     primitiveTypeNames: 'Array<String>'
+    //     structures: 'Array<JSON<StructureShape>>'
+
+    StringBuilder json;
+    json.append('{');
+
+    json.appendLiteral("\"displayTypeName\":");
+    json.append('"');
+    json.append(displayName());
+    json.append('"');
+    json.append(',');
+
+    json.appendLiteral("\"primitiveTypeNames\":");
+    json.append('[');
+    bool hasAnItem = false;
+    if (m_seenTypes & TypeUndefined) {
+        hasAnItem = true;
+        json.appendLiteral("\"Undefined\"");
+    }
+    if (m_seenTypes & TypeNull) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+        json.appendLiteral("\"Null\"");
+    }
+    if (m_seenTypes & TypeBoolean) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+        json.appendLiteral("\"Boolean\"");
+    }
+    if (m_seenTypes & TypeAnyInt) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+        json.appendLiteral("\"Integer\"");
+    }
+    if (m_seenTypes & TypeNumber) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+        json.appendLiteral("\"Number\"");
+    }
+    if (m_seenTypes & TypeString) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+        json.appendLiteral("\"String\"");
+    }
+    if (m_seenTypes & TypeSymbol) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+        json.appendLiteral("\"Symbol\"");
+    }
+    json.append(']');
+
+    json.append(',');
+
+    json.appendLiteral("\"structures\":");
+    json.append('[');
+    hasAnItem = false;
+    for (size_t i = 0; i < m_structureHistory.size(); i++) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+        json.append(m_structureHistory[i]->toJSONString());
+    }
+    json.append(']');
+
+    json.append('}');
+    return json.toString();
+}
+
+StructureShape::StructureShape()
+    : m_proto(nullptr)
+    , m_propertyHash(nullptr)
+    , m_final(false)
+    , m_isInDictionaryMode(false)
+{
+}
+
+void StructureShape::markAsFinal()
+{
+    ASSERT(!m_final);
+    m_final = true;
+}
+
+void StructureShape::addProperty(UniquedStringImpl& uid)
+{
+    ASSERT(!m_final);
+    m_fields.add(&uid);
+}
+
+String StructureShape::propertyHash()
+{
+    ASSERT(m_final);
+    if (m_propertyHash)
+        return *m_propertyHash;
+
+    StringBuilder builder;
+    builder.append(':');
+    builder.append(m_constructorName);
+    builder.append(':');
+    for (auto& key : m_fields) {
+        String property = key.get();
+        property.replace(":", "\\:"); // Ensure that hash({"foo:", "bar"}) != hash({"foo", ":bar"}) because we're using colons as a separator and colons are legal characters in field names in JS.
+        builder.append(property);
+    }
+
+    if (m_proto) {
+        builder.append(':');
+        builder.appendLiteral("__proto__");
+        builder.append(m_proto->propertyHash());
+    }
+
+    m_propertyHash = std::make_unique<String>(builder.toString());
+    return *m_propertyHash;
+}
+
+String StructureShape::leastCommonAncestor(const Vector<RefPtr<StructureShape>> shapes)
+{
+    if (!shapes.size())
+        return emptyString();
+
+    RefPtr<StructureShape> origin = shapes.at(0);
+    for (size_t i = 1; i < shapes.size(); i++) {
+        bool foundLUB = false;
+        while (!foundLUB) {
+            RefPtr<StructureShape> check = shapes.at(i);
+            String curCtorName = origin->m_constructorName;
+            while (check) {
+                if (check->m_constructorName == curCtorName) {
+                    foundLUB = true;
+                    break;
+                }
+                check = check->m_proto;
+            }
+            if (!foundLUB) {
+                origin = origin->m_proto;
+                // This is unlikely to happen, because we usually bottom out at "Object", but there are some sets of Objects
+                // that may cause this behavior. We fall back to "Object" because it's our version of Top.
+                if (!origin)
+                    return ASCIILiteral("Object");
+            }
+        }
+
+        if (origin->m_constructorName == "Object")
+            break;
+    }
+
+    return origin->m_constructorName;
+}
+
+String StructureShape::stringRepresentation()
+{
+    StringBuilder representation;
+    RefPtr<StructureShape> curShape = this;
+
+    representation.append('{');
+    while (curShape) {
+        for (auto it = curShape->m_fields.begin(), end = curShape->m_fields.end(); it != end; ++it) {
+            String prop((*it).get());
+            representation.append(prop);
+            representation.appendLiteral(", ");
+        }
+
+        if (curShape->m_proto) {
+            representation.appendLiteral("__proto__ [");
+            representation.append(curShape->m_proto->m_constructorName);
+            representation.appendLiteral("], ");
+        }
+
+        curShape = curShape->m_proto;
+    }
+
+    if (representation.length() >= 3)
+        representation.resize(representation.length() - 2);
+
+    representation.append('}');
+
+    return representation.toString();
+}
+
+String StructureShape::toJSONString() const
+{
+    // This returns a JSON string representing an Object with the following properties:
+    //     constructorName: 'String'
+    //     fields: 'Array<String>'
+    //     optionalFields: 'Array<String>'
+    //     proto: 'JSON<StructureShape> | null'
+
+    StringBuilder json;
+    json.append('{');
+
+    json.appendLiteral("\"constructorName\":");
+    json.append('"');
+    json.append(m_constructorName);
+    json.append('"');
+    json.append(',');
+
+    json.appendLiteral("\"isInDictionaryMode\":");
+    if (m_isInDictionaryMode)
+        json.appendLiteral("true");
+    else
+        json.appendLiteral("false");
+    json.append(',');
+
+    json.appendLiteral("\"fields\":");
+    json.append('[');
+    bool hasAnItem = false;
+    for (auto it = m_fields.begin(), end = m_fields.end(); it != end; ++it) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+
+        String fieldName((*it).get());
+        json.append('"');
+        json.append(fieldName);
+        json.append('"');
+    }
+    json.append(']');
+    json.append(',');
+
+    json.appendLiteral("\"optionalFields\":");
+    json.append('[');
+    hasAnItem = false;
+    for (auto it = m_optionalFields.begin(), end = m_optionalFields.end(); it != end; ++it) {
+        if (hasAnItem)
+            json.append(',');
+        hasAnItem = true;
+
+        String fieldName((*it).get());
+        json.append('"');
+        json.append(fieldName);
+        json.append('"');
+    }
+    json.append(']');
+    json.append(',');
+
+    json.appendLiteral("\"proto\":");
+    if (m_proto)
+        json.append(m_proto->toJSONString());
+    else
+        json.appendLiteral("null");
+
+    json.append('}');
+
+    return json.toString();
+}
+
+Ref<Inspector::Protocol::Runtime::StructureDescription> StructureShape::inspectorRepresentation()
+{
+    auto base = Inspector::Protocol::Runtime::StructureDescription::create().release();
+    Ref<Inspector::Protocol::Runtime::StructureDescription> currentObject = base.copyRef();
+    RefPtr<StructureShape> currentShape(this);
+
+    while (currentShape) {
+        auto fields = Inspector::Protocol::Array<String>::create();
+        auto optionalFields = Inspector::Protocol::Array<String>::create();
+        for (auto field : currentShape->m_fields)
+            fields->addItem(field.get());
+        for (auto field : currentShape->m_optionalFields)
+            optionalFields->addItem(field.get());
+
+        currentObject->setFields(&fields.get());
+        currentObject->setOptionalFields(&optionalFields.get());
+        currentObject->setConstructorName(currentShape->m_constructorName);
+        currentObject->setIsImprecise(currentShape->m_isInDictionaryMode);
+
+        if (currentShape->m_proto) {
+            auto nextObject = Inspector::Protocol::Runtime::StructureDescription::create().release();
+            currentObject->setPrototypeStructure(&nextObject.get());
+            currentObject = WTFMove(nextObject);
+        }
+
+        currentShape = currentShape->m_proto;
+    }
+
+    return base;
+}
+
+bool StructureShape::hasSamePrototypeChain(PassRefPtr<StructureShape> prpOther)
+{
+    RefPtr<StructureShape> self = this;
+    RefPtr<StructureShape> other = prpOther;
+    while (self && other) {
+        if (self->m_constructorName != other->m_constructorName)
+            return false;
+        self = self->m_proto;
+        other = other->m_proto;
+    }
+
+    return !self && !other;
+}
+
+PassRefPtr<StructureShape> StructureShape::merge(const PassRefPtr<StructureShape> prpA, const PassRefPtr<StructureShape> prpB)
+{
+    RefPtr<StructureShape> a = prpA;
+    RefPtr<StructureShape> b = prpB;
+    ASSERT(a->hasSamePrototypeChain(b));
+
+    auto merged = StructureShape::create();
+    for (auto field : a->m_fields) {
+        if (b->m_fields.contains(field))
+            merged->m_fields.add(field);
+        else
+            merged->m_optionalFields.add(field);
+    }
+
+    for (auto field : b->m_fields) {
+        if (!merged->m_fields.contains(field)) {
+            auto addResult = merged->m_optionalFields.add(field);
+            ASSERT_UNUSED(addResult, addResult.isNewEntry);
+        }
+    }
+
+    for (auto field : a->m_optionalFields)
+        merged->m_optionalFields.add(field);
+    for (auto field : b->m_optionalFields)
+        merged->m_optionalFields.add(field);
+
+    ASSERT(a->m_constructorName == b->m_constructorName);
+    merged->setConstructorName(a->m_constructorName);
+
+    if (a->m_proto) {
+        RELEASE_ASSERT(b->m_proto);
+        merged->setProto(StructureShape::merge(a->m_proto, b->m_proto));
+    }
+
+    merged->markAsFinal();
+
+    return WTFMove(merged);
+}
+
+void StructureShape::enterDictionaryMode()
+{
+    m_isInDictionaryMode = true;
+}
+
+} // namespace JSC
diff --git a/runtime/TypeSet.h b/runtime/TypeSet.h
new file mode 100644
index 0000000..22f178d
--- /dev/null
+++ b/runtime/TypeSet.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2008, 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "RuntimeType.h"
+#include "StructureSet.h"
+#include <wtf/HashSet.h>
+#include <wtf/RefCounted.h>
+#include <wtf/ThreadSafeRefCounted.h>
+#include <wtf/text/WTFString.h>
+#include <wtf/Vector.h>
+
+namespace Inspector {
+namespace Protocol  {
+template<typename T> class Array;
+
+namespace Runtime {
+class StructureDescription;
+class TypeSet;
+}
+
+}
+}
+
+namespace JSC {
+
+class StructureShape : public RefCounted<StructureShape> {
+    friend class TypeSet;
+
+public:
+    StructureShape();
+
+    static Ref<StructureShape> create() { return adoptRef(*new StructureShape); }
+    String propertyHash();
+    void markAsFinal();
+    void addProperty(UniquedStringImpl&);
+    String stringRepresentation();
+    String toJSONString() const;
+    Ref<Inspector::Protocol::Runtime::StructureDescription> inspectorRepresentation();
+    void setConstructorName(String name) { m_constructorName = (name.isEmpty() ? ASCIILiteral("Object") : name); }
+    String constructorName() { return m_constructorName; }
+    void setProto(PassRefPtr<StructureShape> shape) { m_proto = shape; }
+    void enterDictionaryMode();
+
+private:
+    static String leastCommonAncestor(const Vector<RefPtr<StructureShape>>);
+    static PassRefPtr<StructureShape> merge(const PassRefPtr<StructureShape>, const PassRefPtr<StructureShape>);
+    bool hasSamePrototypeChain(PassRefPtr<StructureShape>);
+
+    HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> m_fields;
+    HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> m_optionalFields;
+    RefPtr<StructureShape> m_proto;
+    std::unique_ptr<String> m_propertyHash;
+    String m_constructorName;
+    bool m_final;
+    bool m_isInDictionaryMode;
+};
+
+class TypeSet : public ThreadSafeRefCounted<TypeSet> {
+
+public:
+    static Ref<TypeSet> create() { return adoptRef(*new TypeSet); }
+    TypeSet();
+    void addTypeInformation(RuntimeType, PassRefPtr<StructureShape>, Structure*);
+    void invalidateCache();
+    String dumpTypes() const;
+    String displayName() const;
+    Ref<Inspector::Protocol::Array<Inspector::Protocol::Runtime::StructureDescription>> allStructureRepresentations() const;
+    String toJSONString() const;
+    bool isOverflown() const { return m_isOverflown; }
+    String leastCommonAncestor() const;
+    Ref<Inspector::Protocol::Runtime::TypeSet> inspectorTypeSet() const;
+    bool isEmpty() const { return m_seenTypes == TypeNothing; }
+    bool doesTypeConformTo(RuntimeTypeMask test) const;
+    RuntimeTypeMask seenTypes() const { return m_seenTypes; }
+    StructureSet structureSet(const ConcurrentJSLocker&) const { return m_structureSet; }
+
+    ConcurrentJSLock m_lock;
+private:
+    bool m_isOverflown;
+    RuntimeTypeMask m_seenTypes;
+    Vector<RefPtr<StructureShape>> m_structureHistory;
+    StructureSet m_structureSet;
+};
+
+} // namespace JSC
diff --git a/runtime/TypedArrayAdaptors.h b/runtime/TypedArrayAdaptors.h
new file mode 100644
index 0000000..0af71f4
--- /dev/null
+++ b/runtime/TypedArrayAdaptors.h
@@ -0,0 +1,286 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSCJSValue.h"
+#include "MathCommon.h"
+#include "TypedArrayType.h"
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+template<
+    typename TypeArg, typename ViewTypeArg, typename JSViewTypeArg,
+    TypedArrayType typeValueArg>
+struct IntegralTypedArrayAdaptor {
+    typedef TypeArg Type;
+    typedef ViewTypeArg ViewType;
+    typedef JSViewTypeArg JSViewType;
+    static const TypedArrayType typeValue = typeValueArg;
+    constexpr static const TypeArg minValue = std::numeric_limits<TypeArg>::lowest();
+    constexpr static const TypeArg maxValue = std::numeric_limits<TypeArg>::max();
+
+    static JSValue toJSValue(Type value)
+    {
+        return jsNumber(value);
+    }
+    
+    static double toDouble(Type value)
+    {
+        return static_cast<double>(value);
+    }
+    
+    static Type toNativeFromInt32(int32_t value)
+    {
+        return static_cast<Type>(value);
+    }
+    
+    static Type toNativeFromUint32(uint32_t value)
+    {
+        return static_cast<Type>(value);
+    }
+    
+    static Type toNativeFromDouble(double value)
+    {
+        int32_t result = static_cast<int32_t>(value);
+        if (static_cast<double>(result) != value)
+            result = toInt32(value);
+        return static_cast<Type>(result);
+    }
+    
+    template<typename OtherAdaptor>
+    static typename OtherAdaptor::Type convertTo(Type value)
+    {
+        if (typeValue == TypeUint32)
+            return OtherAdaptor::toNativeFromUint32(value);
+        return OtherAdaptor::toNativeFromInt32(value);
+    }
+
+    static std::optional<Type> toNativeFromInt32WithoutCoercion(int32_t value)
+    {
+        if ((value >= 0 && static_cast<uint32_t>(value) > static_cast<uint32_t>(maxValue)) || value < static_cast<int32_t>(minValue))
+            return std::nullopt;
+        return static_cast<Type>(value);
+    }
+
+    static std::optional<Type> toNativeFromUint32WithoutCoercion(uint32_t value)
+    {
+        if (value > static_cast<uint32_t>(maxValue))
+            return std::nullopt;
+
+        return static_cast<Type>(value);
+    }
+
+    static std::optional<Type> toNativeFromDoubleWithoutCoercion(double value)
+    {
+        Type integer = static_cast<Type>(value);
+        if (static_cast<double>(integer) != value)
+            return std::nullopt;
+
+        if (value < 0)
+            return toNativeFromInt32WithoutCoercion(static_cast<int32_t>(value));
+        
+        return toNativeFromUint32WithoutCoercion(static_cast<uint32_t>(value));
+    }
+};
+
+template<
+    typename TypeArg, typename ViewTypeArg, typename JSViewTypeArg,
+    TypedArrayType typeValueArg>
+struct FloatTypedArrayAdaptor {
+    typedef TypeArg Type;
+    typedef ViewTypeArg ViewType;
+    typedef JSViewTypeArg JSViewType;
+    static const TypedArrayType typeValue = typeValueArg;
+    constexpr static const TypeArg minValue = std::numeric_limits<TypeArg>::lowest();
+    constexpr static const TypeArg maxValue = std::numeric_limits<TypeArg>::max();
+
+    static JSValue toJSValue(Type value)
+    {
+        return jsDoubleNumber(purifyNaN(value));
+    }
+
+    static double toDouble(Type value)
+    {
+        return static_cast<double>(value);
+    }
+
+    static Type toNativeFromInt32(int32_t value)
+    {
+        return static_cast<Type>(value);
+    }
+
+    static Type toNativeFromUint32(uint32_t value)
+    {
+        return static_cast<Type>(value);
+    }
+
+    static Type toNativeFromDouble(double value)
+    {
+        return static_cast<Type>(value);
+    }
+
+    template<typename OtherAdaptor>
+    static typename OtherAdaptor::Type convertTo(Type value)
+    {
+        return OtherAdaptor::toNativeFromDouble(value);
+    }
+
+    static std::optional<Type> toNativeFromInt32WithoutCoercion(int32_t value)
+    {
+        return static_cast<Type>(value);
+    }
+
+    static std::optional<Type> toNativeFromDoubleWithoutCoercion(double value)
+    {
+        if (std::isnan(value) || std::isinf(value))
+            return static_cast<Type>(value);
+
+        Type valueResult = static_cast<Type>(value);
+
+        if (static_cast<double>(valueResult) != value)
+            return std::nullopt;
+
+        if (value < minValue || value > maxValue)
+            return std::nullopt;
+
+        return valueResult;
+    }
+};
+
+struct Int8Adaptor;
+struct Int16Adaptor;
+struct Int32Adaptor;
+struct Uint8Adaptor;
+struct Uint8ClampedAdaptor;
+struct Uint16Adaptor;
+struct Uint32Adaptor;
+struct Float32Adaptor;
+struct Float64Adaptor;
+
+template<typename Adaptor> class GenericTypedArrayView;
+typedef GenericTypedArrayView<Int8Adaptor> Int8Array;
+typedef GenericTypedArrayView<Int16Adaptor> Int16Array;
+typedef GenericTypedArrayView<Int32Adaptor> Int32Array;
+typedef GenericTypedArrayView<Uint8Adaptor> Uint8Array;
+typedef GenericTypedArrayView<Uint8ClampedAdaptor> Uint8ClampedArray;
+typedef GenericTypedArrayView<Uint16Adaptor> Uint16Array;
+typedef GenericTypedArrayView<Uint32Adaptor> Uint32Array;
+typedef GenericTypedArrayView<Float32Adaptor> Float32Array;
+typedef GenericTypedArrayView<Float64Adaptor> Float64Array;
+
+template<typename Adaptor> class JSGenericTypedArrayView;
+typedef JSGenericTypedArrayView<Int8Adaptor> JSInt8Array;
+typedef JSGenericTypedArrayView<Int16Adaptor> JSInt16Array;
+typedef JSGenericTypedArrayView<Int32Adaptor> JSInt32Array;
+typedef JSGenericTypedArrayView<Uint8Adaptor> JSUint8Array;
+typedef JSGenericTypedArrayView<Uint8ClampedAdaptor> JSUint8ClampedArray;
+typedef JSGenericTypedArrayView<Uint16Adaptor> JSUint16Array;
+typedef JSGenericTypedArrayView<Uint32Adaptor> JSUint32Array;
+typedef JSGenericTypedArrayView<Float32Adaptor> JSFloat32Array;
+typedef JSGenericTypedArrayView<Float64Adaptor> JSFloat64Array;
+
+struct Int8Adaptor : IntegralTypedArrayAdaptor<int8_t, Int8Array, JSInt8Array, TypeInt8> { };
+struct Int16Adaptor : IntegralTypedArrayAdaptor<int16_t, Int16Array, JSInt16Array, TypeInt16> { };
+struct Int32Adaptor : IntegralTypedArrayAdaptor<int32_t, Int32Array, JSInt32Array, TypeInt32> { };
+struct Uint8Adaptor : IntegralTypedArrayAdaptor<uint8_t, Uint8Array, JSUint8Array, TypeUint8> { };
+struct Uint16Adaptor : IntegralTypedArrayAdaptor<uint16_t, Uint16Array, JSUint16Array, TypeUint16> { };
+struct Uint32Adaptor : IntegralTypedArrayAdaptor<uint32_t, Uint32Array, JSUint32Array, TypeUint32> { };
+struct Float32Adaptor : FloatTypedArrayAdaptor<float, Float32Array, JSFloat32Array, TypeFloat32> { };
+struct Float64Adaptor : FloatTypedArrayAdaptor<double, Float64Array, JSFloat64Array, TypeFloat64> { };
+
+struct Uint8ClampedAdaptor {
+    typedef uint8_t Type;
+    typedef Uint8ClampedArray ViewType;
+    typedef JSUint8ClampedArray JSViewType;
+    static const TypedArrayType typeValue = TypeUint8Clamped;
+    constexpr static const uint8_t minValue = std::numeric_limits<uint8_t>::lowest();
+    constexpr static const uint8_t maxValue = std::numeric_limits<uint8_t>::max();
+
+    static JSValue toJSValue(uint8_t value)
+    {
+        return jsNumber(value);
+    }
+
+    static double toDouble(uint8_t value)
+    {
+        return static_cast<double>(value);
+    }
+
+    static Type toNativeFromInt32(int32_t value)
+    {
+        return clamp(value);
+    }
+
+    static Type toNativeFromUint32(uint32_t value)
+    {
+        return std::min(static_cast<uint32_t>(255), value);
+    }
+
+    static Type toNativeFromDouble(double value)
+    {
+        if (std::isnan(value) || value < 0)
+            return 0;
+        if (value > 255)
+            return 255;
+        return static_cast<uint8_t>(lrint(value));
+    }
+
+    template<typename OtherAdaptor>
+    static typename OtherAdaptor::Type convertTo(uint8_t value)
+    {
+        return OtherAdaptor::toNativeFromInt32(value);
+    }
+    
+    static std::optional<Type> toNativeFromInt32WithoutCoercion(int32_t value)
+    {
+        if (value > maxValue || value < minValue)
+            return std::nullopt;
+
+        return static_cast<Type>(value);
+    }
+
+    static std::optional<Type> toNativeFromDoubleWithoutCoercion(double value)
+    {
+        uint8_t integer = static_cast<uint8_t>(value);
+        if (static_cast<double>(integer) != value)
+            return std::nullopt;
+
+        return integer;
+    }
+
+private:
+    static uint8_t clamp(int32_t value)
+    {
+        if (value < 0)
+            return 0;
+        if (value > 255)
+            return 255;
+        return static_cast<uint8_t>(value);
+    }
+};
+
+} // namespace JSC
diff --git a/runtime/TypedArrayBase.h b/runtime/TypedArrayBase.h
new file mode 100644
index 0000000..8a68761
--- /dev/null
+++ b/runtime/TypedArrayBase.h
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ArrayBuffer.h"
+#include "ArrayBufferView.h"
+
+namespace JSC {
+
+template <typename T>
+class TypedArrayBase : public ArrayBufferView {
+public:
+    T* data() const { return static_cast<T*>(baseAddress()); }
+
+    bool set(TypedArrayBase<T>* array, unsigned offset)
+    {
+        return setImpl(array, offset * sizeof(T));
+    }
+
+    bool setRange(const T* data, size_t dataLength, unsigned offset)
+    {
+        return setRangeImpl(reinterpret_cast<const char*>(data), dataLength * sizeof(T), offset * sizeof(T));
+    }
+
+    bool zeroRange(unsigned offset, size_t length)
+    {
+        return zeroRangeImpl(offset * sizeof(T), length * sizeof(T));
+    }
+
+    // Overridden from ArrayBufferView. This must be public because of
+    // rules about inheritance of members in template classes, and
+    // because it is accessed via pointers to subclasses.
+    unsigned length() const
+    {
+        return m_length;
+    }
+
+    virtual unsigned byteLength() const
+    {
+        return m_length * sizeof(T);
+    }
+
+    // Invoked by the indexed getter. Does not perform range checks; caller
+    // is responsible for doing so and returning undefined as necessary.
+    T item(unsigned index) const
+    {
+        ASSERT_WITH_SECURITY_IMPLICATION(index < TypedArrayBase<T>::m_length);
+        return TypedArrayBase<T>::data()[index];
+    }
+
+    bool checkInboundData(unsigned offset, unsigned pos) const
+    {
+        return (offset <= m_length
+            && offset + pos <= m_length
+            // check overflow
+            && offset + pos >= offset);
+    }
+
+protected:
+    TypedArrayBase(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+        : ArrayBufferView(buffer, byteOffset)
+        , m_length(length)
+    {
+    }
+
+    template <class Subclass>
+    static PassRefPtr<Subclass> create(unsigned length)
+    {
+        RefPtr<ArrayBuffer> buffer = ArrayBuffer::create(length, sizeof(T));
+        if (!buffer.get())
+            return 0;
+        return create<Subclass>(buffer.release(), 0, length);
+    }
+
+    template <class Subclass>
+    static PassRefPtr<Subclass> create(const T* array, unsigned length)
+    {
+        RefPtr<Subclass> a = create<Subclass>(length);
+        if (a)
+            for (unsigned i = 0; i < length; ++i)
+                a->set(i, array[i]);
+        return a.release();
+    }
+
+    template <class Subclass>
+    static RefPtr<Subclass> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
+    {
+        RefPtr<ArrayBuffer> buf(buffer);
+        if (!verifySubRange<T>(buf, byteOffset, length))
+            return nullptr;
+
+        return adoptRef(new Subclass(buf.release(), byteOffset, length));
+    }
+
+    template <class Subclass>
+    static RefPtr<Subclass> createUninitialized(unsigned length)
+    {
+        RefPtr<ArrayBuffer> buffer = ArrayBuffer::createUninitialized(length, sizeof(T));
+        if (!buffer.get())
+            return nullptr;
+        return create<Subclass>(buffer.release(), 0, length);
+    }
+
+    template <class Subclass>
+    RefPtr<Subclass> subarrayImpl(int start, int end) const
+    {
+        unsigned offset, length;
+        calculateOffsetAndLength(start, end, m_length, &offset, &length);
+        clampOffsetAndNumElements<T>(buffer(), m_byteOffset, &offset, &length);
+        return create<Subclass>(buffer(), offset, length);
+    }
+
+    virtual void neuter()
+    {
+        ArrayBufferView::neuter();
+        m_length = 0;
+    }
+
+    // We do not want to have to access this via a virtual function in subclasses,
+    // which is why it is protected rather than private.
+    unsigned m_length;
+};
+
+} // namespace JSC
+
+using JSC::TypedArrayBase;
diff --git a/runtime/TypedArrayController.cpp b/runtime/TypedArrayController.cpp
new file mode 100644
index 0000000..e20b6cd
--- /dev/null
+++ b/runtime/TypedArrayController.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TypedArrayController.h"
+
+namespace JSC {
+
+TypedArrayController::TypedArrayController() { }
+TypedArrayController::~TypedArrayController() { }
+
+} // namespace JSC
+
diff --git a/runtime/TypedArrayController.h b/runtime/TypedArrayController.h
new file mode 100644
index 0000000..64d3f55
--- /dev/null
+++ b/runtime/TypedArrayController.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+class ArrayBuffer;
+class ExecState;
+class JSArrayBuffer;
+class JSGlobalObject;
+
+class TypedArrayController : public RefCounted<TypedArrayController> {
+public:
+    JS_EXPORT_PRIVATE TypedArrayController();
+    JS_EXPORT_PRIVATE virtual ~TypedArrayController();
+    
+    virtual JSArrayBuffer* toJS(ExecState*, JSGlobalObject*, ArrayBuffer*) = 0;
+    virtual void registerWrapper(JSGlobalObject*, ArrayBuffer*, JSArrayBuffer*) = 0;
+    virtual bool isAtomicsWaitAllowedOnCurrentThread() = 0;
+};
+
+} // namespace JSC
diff --git a/runtime/TypedArrayInlines.h b/runtime/TypedArrayInlines.h
new file mode 100644
index 0000000..ea78c07
--- /dev/null
+++ b/runtime/TypedArrayInlines.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GCIncomingRefCountedInlines.h"
+#include "GenericTypedArrayViewInlines.h"
+#include "JSArrayBufferViewInlines.h"
+#include "JSGenericTypedArrayViewInlines.h"
+#include "JSGenericTypedArrayViewPrototypeInlines.h"
diff --git a/runtime/TypedArrayType.cpp b/runtime/TypedArrayType.cpp
new file mode 100644
index 0000000..60875a2
--- /dev/null
+++ b/runtime/TypedArrayType.cpp
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TypedArrayType.h"
+
+#include "JSDataView.h"
+#include "JSTypedArrayConstructors.h"
+#include "JSTypedArrays.h"
+
+namespace JSC {
+
+JSType typeForTypedArrayType(TypedArrayType type)
+{
+    switch (type) {
+    case NotTypedArray:
+        RELEASE_ASSERT_NOT_REACHED();
+        return UnspecifiedType;
+    case TypeInt8:
+        return Int8ArrayType;
+    case TypeUint8:
+        return Uint8ArrayType;
+    case TypeUint8Clamped:
+        return Uint8ClampedArrayType;
+    case TypeInt16:
+        return Int16ArrayType;
+    case TypeUint16:
+        return Uint16ArrayType;
+    case TypeInt32:
+        return Int32ArrayType;
+    case TypeUint32:
+        return Uint32ArrayType;
+    case TypeFloat32:
+        return Float32ArrayType;
+    case TypeFloat64:
+        return Float64ArrayType;
+    case TypeDataView:
+        return DataViewType;
+
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return UnspecifiedType;
+    }
+}
+
+const ClassInfo* constructorClassInfoForType(TypedArrayType type)
+{
+    switch (type) {
+    case NotTypedArray:
+        return 0;
+    case TypeInt8:
+        return JSInt8ArrayConstructor::info();
+    case TypeUint8:
+        return JSUint8ArrayConstructor::info();
+    case TypeUint8Clamped:
+        return JSUint8ClampedArrayConstructor::info();
+    case TypeInt16:
+        return JSInt16ArrayConstructor::info();
+    case TypeUint16:
+        return JSUint16ArrayConstructor::info();
+    case TypeInt32:
+        return JSInt32ArrayConstructor::info();
+    case TypeUint32:
+        return JSUint32ArrayConstructor::info();
+    case TypeFloat32:
+        return JSFloat32ArrayConstructor::info();
+    case TypeFloat64:
+        return JSFloat64ArrayConstructor::info();
+    case TypeDataView:
+        return JSDataViewConstructor::info();
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, TypedArrayType type)
+{
+    switch (type) {
+    case NotTypedArray:
+        out.print("NotTypedArray");
+        return;
+    case TypeInt8:
+        out.print("TypeInt8");
+        return;
+    case TypeInt16:
+        out.print("TypeInt16");
+        return;
+    case TypeInt32:
+        out.print("TypeInt32");
+        return;
+    case TypeUint8:
+        out.print("TypeUint8");
+        return;
+    case TypeUint8Clamped:
+        out.print("TypeUint8Clamped");
+        return;
+    case TypeUint16:
+        out.print("TypeUint16");
+        return;
+    case TypeUint32:
+        out.print("TypeUint32");
+        return;
+    case TypeFloat32:
+        out.print("TypeFloat32");
+        return;
+    case TypeFloat64:
+        out.print("TypeFloat64");
+        return;
+    case TypeDataView:
+        out.print("TypeDataView");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/runtime/TypedArrayType.h b/runtime/TypedArrayType.h
new file mode 100644
index 0000000..eab7c21
--- /dev/null
+++ b/runtime/TypedArrayType.h
@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSType.h"
+#include <wtf/Optional.h>
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+struct ClassInfo;
+
+#define FOR_EACH_TYPED_ARRAY_TYPE(macro) \
+    macro(Int8) \
+    macro(Uint8) \
+    macro(Uint8Clamped) \
+    macro(Int16) \
+    macro(Uint16) \
+    macro(Int32) \
+    macro(Uint32) \
+    macro(Float32) \
+    macro(Float64) \
+    macro(DataView)
+
+#define FOR_EACH_TYPED_ARRAY_TYPE_EXCLUDING_DATA_VIEW(macro) \
+    macro(Int8) \
+    macro(Uint8) \
+    macro(Uint8Clamped) \
+    macro(Int16) \
+    macro(Uint16) \
+    macro(Int32) \
+    macro(Uint32) \
+    macro(Float32) \
+    macro(Float64)
+
+enum TypedArrayType {
+    NotTypedArray,
+#define DECLARE_TYPED_ARRAY_TYPE(name) Type ## name,
+    FOR_EACH_TYPED_ARRAY_TYPE(DECLARE_TYPED_ARRAY_TYPE)
+#undef DECLARE_TYPED_ARRAY_TYPE
+};
+
+#define NUMBER_OF_TYPED_ARRAY_TYPES TypeDataView
+
+inline unsigned toIndex(TypedArrayType type)
+{
+    return static_cast<unsigned>(type) - 1;
+}
+
+inline TypedArrayType indexToTypedArrayType(unsigned index)
+{
+    TypedArrayType result = static_cast<TypedArrayType>(index + 1);
+    ASSERT(result >= TypeInt8 && result <= TypeDataView);
+    return result;
+}
+
+inline bool isTypedView(TypedArrayType type)
+{
+    switch (type) {
+    case NotTypedArray:
+    case TypeDataView:
+        return false;
+    default:
+        return true;
+    }
+}
+
+inline unsigned logElementSize(TypedArrayType type)
+{
+    switch (type) {
+    case NotTypedArray:
+        break;
+    case TypeInt8:
+    case TypeUint8:
+    case TypeUint8Clamped:
+    case TypeDataView:
+        return 0;
+    case TypeInt16:
+    case TypeUint16:
+        return 1;
+    case TypeInt32:
+    case TypeUint32:
+    case TypeFloat32:
+        return 2;
+    case TypeFloat64:
+        return 3;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+inline size_t elementSize(TypedArrayType type)
+{
+    return static_cast<size_t>(1) << logElementSize(type);
+}
+
+const ClassInfo* constructorClassInfoForType(TypedArrayType);
+JSType typeForTypedArrayType(TypedArrayType);
+
+inline TypedArrayType typedArrayTypeForType(JSType type)
+{
+    switch (type) {
+    case Int8ArrayType:
+        return TypeInt8;
+    case Int16ArrayType:
+        return TypeInt16;
+    case Int32ArrayType:
+        return TypeInt32;
+    case Uint8ArrayType:
+        return TypeUint8;
+    case Uint8ClampedArrayType:
+        return TypeUint8Clamped;
+    case Uint16ArrayType:
+        return TypeUint16;
+    case Uint32ArrayType:
+        return TypeUint32;
+    case Float32ArrayType:
+        return TypeFloat32;
+    case Float64ArrayType:
+        return TypeFloat64;
+    default:
+        return NotTypedArray;
+    }
+}
+
+inline bool isInt(TypedArrayType type)
+{
+    switch (type) {
+    case TypeInt8:
+    case TypeUint8:
+    case TypeUint8Clamped:
+    case TypeInt16:
+    case TypeUint16:
+    case TypeInt32:
+    case TypeUint32:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool isFloat(TypedArrayType type)
+{
+    switch (type) {
+    case TypeFloat32:
+    case TypeFloat64:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool isSigned(TypedArrayType type)
+{
+    switch (type) {
+    case TypeInt8:
+    case TypeInt16:
+    case TypeInt32:
+    case TypeFloat32:
+    case TypeFloat64:
+        return true;
+    default:
+        return false;
+    }
+}
+
+inline bool isClamped(TypedArrayType type)
+{
+    return type == TypeUint8Clamped;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::TypedArrayType);
+
+} // namespace WTF
diff --git a/runtime/TypedArrays.h b/runtime/TypedArrays.h
new file mode 100644
index 0000000..8fe9b36
--- /dev/null
+++ b/runtime/TypedArrays.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "GenericTypedArrayView.h"
+#include "TypedArrayAdaptors.h"
+
+namespace JSC {
+
+typedef GenericTypedArrayView<Int8Adaptor> Int8Array;
+typedef GenericTypedArrayView<Int16Adaptor> Int16Array;
+typedef GenericTypedArrayView<Int32Adaptor> Int32Array;
+typedef GenericTypedArrayView<Uint8Adaptor> Uint8Array;
+typedef GenericTypedArrayView<Uint8ClampedAdaptor> Uint8ClampedArray;
+typedef GenericTypedArrayView<Uint16Adaptor> Uint16Array;
+typedef GenericTypedArrayView<Uint32Adaptor> Uint32Array;
+typedef GenericTypedArrayView<Float32Adaptor> Float32Array;
+typedef GenericTypedArrayView<Float64Adaptor> Float64Array;
+
+} // namespace JSC
diff --git a/runtime/TypeofType.cpp b/runtime/TypeofType.cpp
new file mode 100644
index 0000000..db162b7
--- /dev/null
+++ b/runtime/TypeofType.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TypeofType.h"
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, TypeofType type)
+{
+    switch (type) {
+    case TypeofType::Undefined:
+        out.print("undefined");
+        return;
+    case TypeofType::Boolean:
+        out.print("boolean");
+        return;
+    case TypeofType::Number:
+        out.print("number");
+        return;
+    case TypeofType::String:
+        out.print("string");
+        return;
+    case TypeofType::Symbol:
+        out.print("symbol");
+        return;
+    case TypeofType::Object:
+        out.print("object");
+        return;
+    case TypeofType::Function:
+        out.print("function");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/runtime/TypeofType.h b/runtime/TypeofType.h
new file mode 100644
index 0000000..332fa81
--- /dev/null
+++ b/runtime/TypeofType.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum class TypeofType {
+    Undefined,
+    Boolean,
+    Number,
+    String,
+    Symbol,
+    Object,
+    Function    
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream& out, JSC::TypeofType);
+
+} // namespace WTF
diff --git a/runtime/Uint16Array.h b/runtime/Uint16Array.h
new file mode 100644
index 0000000..115cb35
--- /dev/null
+++ b/runtime/Uint16Array.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Uint16Array;
diff --git a/runtime/Uint16WithFraction.h b/runtime/Uint16WithFraction.h
new file mode 100644
index 0000000..a5d8e12
--- /dev/null
+++ b/runtime/Uint16WithFraction.h
@@ -0,0 +1,266 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+// Would be nice if this was a static const member, but the OS X linker
+// seems to want a symbol in the binary in that case...
+#define oneGreaterThanMaxUInt16 0x10000
+
+// A uint16_t with an infinite precision fraction. Upon overflowing
+// the uint16_t range, this class will clamp to oneGreaterThanMaxUInt16.
+// This is used in converting the fraction part of a number to a string.
+class Uint16WithFraction {
+public:
+    explicit Uint16WithFraction(double number, uint16_t divideByExponent = 0)
+    {
+        ASSERT(number && std::isfinite(number) && !std::signbit(number));
+
+        // Check for values out of uint16_t range.
+        if (number >= oneGreaterThanMaxUInt16) {
+            m_values.append(oneGreaterThanMaxUInt16);
+            m_leadingZeros = 0;
+            return;
+        }
+
+        // Append the units to m_values.
+        double integerPart = floor(number);
+        m_values.append(static_cast<uint32_t>(integerPart));
+
+        bool sign;
+        int32_t exponent;
+        uint64_t mantissa;
+        decomposeDouble(number - integerPart, sign, exponent, mantissa);
+        ASSERT(!sign && exponent < 0);
+        exponent -= divideByExponent;
+
+        int32_t zeroBits = -exponent;
+        --zeroBits;
+
+        // Append the append words for to m_values.
+        while (zeroBits >= 32) {
+            m_values.append(0);
+            zeroBits -= 32;
+        }
+
+        // Left align the 53 bits of the mantissa within 96 bits.
+        uint32_t values[3];
+        values[0] = static_cast<uint32_t>(mantissa >> 21);
+        values[1] = static_cast<uint32_t>(mantissa << 11);
+        values[2] = 0;
+        // Shift based on the remainder of the exponent.
+        if (zeroBits) {
+            values[2] = values[1] << (32 - zeroBits);
+            values[1] = (values[1] >> zeroBits) | (values[0] << (32 - zeroBits));
+            values[0] = (values[0] >> zeroBits);
+        }
+        m_values.append(values[0]);
+        m_values.append(values[1]);
+        m_values.append(values[2]);
+
+        // Canonicalize; remove any trailing zeros.
+        while (m_values.size() > 1 && !m_values.last())
+            m_values.removeLast();
+
+        // Count the number of leading zero, this is useful in optimizing multiplies.
+        m_leadingZeros = 0;
+        while (m_leadingZeros < m_values.size() && !m_values[m_leadingZeros])
+            ++m_leadingZeros;
+    }
+
+    Uint16WithFraction& operator*=(uint16_t multiplier)
+    {
+        ASSERT(checkConsistency());
+
+        // iteratate backwards over the fraction until we reach the leading zeros,
+        // passing the carry from one calculation into the next.
+        uint64_t accumulator = 0;
+        for (size_t i = m_values.size(); i > m_leadingZeros; ) {
+            --i;
+            accumulator += static_cast<uint64_t>(m_values[i]) * static_cast<uint64_t>(multiplier);
+            m_values[i] = static_cast<uint32_t>(accumulator);
+            accumulator >>= 32;
+        }
+
+        if (!m_leadingZeros) {
+            // With a multiplicand and multiplier in the uint16_t range, this cannot carry
+            // (even allowing for the infinity value).
+            ASSERT(!accumulator);
+            // Check for overflow & clamp to 'infinity'.
+            if (m_values[0] >= oneGreaterThanMaxUInt16) {
+                m_values.shrink(1);
+                m_values[0] = oneGreaterThanMaxUInt16;
+                m_leadingZeros = 0;
+                return *this;
+            }
+        } else if (accumulator) {
+            // Check for carry from the last multiply, if so overwrite last leading zero.
+            m_values[--m_leadingZeros] = static_cast<uint32_t>(accumulator);
+            // The limited range of the multiplier should mean that even if we carry into
+            // the units, we don't need to check for overflow of the uint16_t range.
+            ASSERT(m_values[0] < oneGreaterThanMaxUInt16);
+        }
+
+        // Multiplication by an even value may introduce trailing zeros; if so, clean them
+        // up. (Keeping the value in a normalized form makes some of the comparison operations
+        // more efficient).
+        while (m_values.size() > 1 && !m_values.last())
+            m_values.removeLast();
+        ASSERT(checkConsistency());
+        return *this;
+    }
+
+    bool operator<(const Uint16WithFraction& other)
+    {
+        ASSERT(checkConsistency());
+        ASSERT(other.checkConsistency());
+
+        // Iterate over the common lengths of arrays.
+        size_t minSize = std::min(m_values.size(), other.m_values.size());
+        for (size_t index = 0; index < minSize; ++index) {
+            // If we find a value that is not equal, compare and return.
+            uint32_t fromThis = m_values[index];
+            uint32_t fromOther = other.m_values[index];
+            if (fromThis != fromOther)
+                return fromThis < fromOther;
+        }
+        // If these numbers have the same lengths, they are equal,
+        // otherwise which ever number has a longer fraction in larger.
+        return other.m_values.size() > minSize;
+    }
+
+    // Return the floor (non-fractional portion) of the number, clearing this to zero,
+    // leaving the fractional part unchanged.
+    uint32_t floorAndSubtract()
+    {
+        // 'floor' is simple the integer portion of the value.
+        uint32_t floor = m_values[0];
+
+        // If floor is non-zero, 
+        if (floor) {
+            m_values[0] = 0;
+            m_leadingZeros = 1;
+            while (m_leadingZeros < m_values.size() && !m_values[m_leadingZeros])
+                ++m_leadingZeros;
+        }
+
+        return floor;
+    }
+
+    // Compare this value to 0.5, returns -1 for less than, 0 for equal, 1 for greater.
+    int comparePoint5()
+    {
+        ASSERT(checkConsistency());
+        // If units != 0, this is greater than 0.5.
+        if (m_values[0])
+            return 1;
+        // If size == 1 this value is 0, hence < 0.5.
+        if (m_values.size() == 1)
+            return -1;
+        // Compare to 0.5.
+        if (m_values[1] > 0x80000000ul)
+            return 1;
+        if (m_values[1] < 0x80000000ul)
+            return -1;
+        // Check for more words - since normalized numbers have no trailing zeros, if
+        // there are more that two digits we can assume at least one more is non-zero,
+        // and hence the value is > 0.5.
+        return m_values.size() > 2 ? 1 : 0;
+    }
+
+    // Return true if the sum of this plus addend would be greater than 1.
+    bool sumGreaterThanOne(const Uint16WithFraction& addend) 
+    {
+        ASSERT(checkConsistency());
+        ASSERT(addend.checkConsistency());
+
+        // First, sum the units. If the result is greater than one, return true.
+        // If equal to one, return true if either number has a fractional part.
+        uint32_t sum = m_values[0] + addend.m_values[0];
+        if (sum)
+            return sum > 1 || std::max(m_values.size(), addend.m_values.size()) > 1;
+
+        // We could still produce a result greater than zero if addition of the next
+        // word from the fraction were to carry, leaving a result > 0.
+
+        // Iterate over the common lengths of arrays.
+        size_t minSize = std::min(m_values.size(), addend.m_values.size());
+        for (size_t index = 1; index < minSize; ++index) {
+            // Sum the next word from this & the addend.
+            uint32_t fromThis = m_values[index];
+            uint32_t fromAddend = addend.m_values[index];
+            sum = fromThis + fromAddend;
+
+            // Check for overflow. If so, check whether the remaining result is non-zero,
+            // or if there are any further words in the fraction.
+            if (sum < fromThis)
+                return sum || (index + 1) < std::max(m_values.size(), addend.m_values.size());
+
+            // If the sum is uint32_t max, then we would carry a 1 if addition of the next
+            // digits in the number were to overflow.
+            if (sum != 0xFFFFFFFF)
+                return false;
+        }
+        return false;
+    }
+
+private:
+    bool checkConsistency() const
+    {
+        // All values should have at least one value.
+        return (m_values.size())
+            // The units value must be a uint16_t, or the value is the overflow value.
+            && (m_values[0] < oneGreaterThanMaxUInt16 || (m_values[0] == oneGreaterThanMaxUInt16 && m_values.size() == 1))
+            // There should be no trailing zeros (unless this value is zero!).
+            && (m_values.last() || m_values.size() == 1);
+    }
+
+    // The internal storage of the number. This vector is always at least one entry in size,
+    // with the first entry holding the portion of the number greater than zero. The first
+    // value always hold a value in the uint16_t range, or holds the value oneGreaterThanMaxUInt16 to
+    // indicate the value has overflowed to >= 0x10000. If the units value is oneGreaterThanMaxUInt16,
+    // there can be no fraction (size must be 1).
+    //
+    // Subsequent values in the array represent portions of the fractional part of this number.
+    // The total value of the number is the sum of (m_values[i] / pow(2^32, i)), for each i
+    // in the array. The vector should contain no trailing zeros, except for the value '0',
+    // represented by a vector contianing a single zero value. These constraints are checked
+    // by 'checkConsistency()', above.
+    //
+    // The inline capacity of the vector is set to be able to contain any IEEE double (1 for
+    // the units column, 32 for zeros introduced due to an exponent up to -3FE, and 2 for
+    // bits taken from the mantissa).
+    Vector<uint32_t, 36> m_values;
+
+    // Cache a count of the number of leading zeros in m_values. We can use this to optimize
+    // methods that would otherwise need visit all words in the vector, e.g. multiplication.
+    size_t m_leadingZeros;
+};
+
+} // namespace JSC
diff --git a/runtime/Uint32Array.h b/runtime/Uint32Array.h
new file mode 100644
index 0000000..354ffb6
--- /dev/null
+++ b/runtime/Uint32Array.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Uint32Array;
diff --git a/runtime/Uint8Array.h b/runtime/Uint8Array.h
new file mode 100644
index 0000000..34250f7
--- /dev/null
+++ b/runtime/Uint8Array.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Uint8Array;
diff --git a/runtime/Uint8ClampedArray.h b/runtime/Uint8ClampedArray.h
new file mode 100644
index 0000000..e8fb63a
--- /dev/null
+++ b/runtime/Uint8ClampedArray.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "TypedArrays.h"
+
+using JSC::Uint8ClampedArray;
diff --git a/runtime/VM.cpp b/runtime/VM.cpp
new file mode 100644
index 0000000..2843a3e
--- /dev/null
+++ b/runtime/VM.cpp
@@ -0,0 +1,936 @@
+/*
+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "VM.h"
+
+#include "ArgList.h"
+#include "ArrayBufferNeuteringWatchpoint.h"
+#include "BuiltinExecutables.h"
+#include "BytecodeIntrinsicRegistry.h"
+#include "CodeBlock.h"
+#include "CodeCache.h"
+#include "CommonIdentifiers.h"
+#include "CommonSlowPaths.h"
+#include "CustomGetterSetter.h"
+#include "DFGLongLivedState.h"
+#include "DFGWorklist.h"
+#include "Disassembler.h"
+#include "ErrorInstance.h"
+#include "EvalCodeBlock.h"
+#include "Exception.h"
+#include "FTLThunks.h"
+#include "FunctionCodeBlock.h"
+#include "FunctionConstructor.h"
+#include "GCActivityCallback.h"
+#include "GetterSetter.h"
+#include "HasOwnPropertyCache.h"
+#include "Heap.h"
+#include "HeapIterationScope.h"
+#include "HeapProfiler.h"
+#include "HostCallReturnValue.h"
+#include "Identifier.h"
+#include "IncrementalSweeper.h"
+#include "InferredTypeTable.h"
+#include "Interpreter.h"
+#include "JITCode.h"
+#include "JITWorklist.h"
+#include "JSAPIValueWrapper.h"
+#include "JSArray.h"
+#include "JSCInlines.h"
+#include "JSFixedArray.h"
+#include "JSFunction.h"
+#include "JSGlobalObjectFunctions.h"
+#include "JSInternalPromiseDeferred.h"
+#include "JSLock.h"
+#include "JSMap.h"
+#include "JSPromiseDeferred.h"
+#include "JSPropertyNameEnumerator.h"
+#include "JSTemplateRegistryKey.h"
+#include "JSWebAssembly.h"
+#include "JSWithScope.h"
+#include "LLIntData.h"
+#include "Lexer.h"
+#include "Lookup.h"
+#include "ModuleProgramCodeBlock.h"
+#include "NativeStdFunctionCell.h"
+#include "Nodes.h"
+#include "Parser.h"
+#include "ProfilerDatabase.h"
+#include "ProgramCodeBlock.h"
+#include "PropertyMapHashTable.h"
+#include "RegExpCache.h"
+#include "RegExpObject.h"
+#include "RegisterAtOffsetList.h"
+#include "RuntimeType.h"
+#include "SamplingProfiler.h"
+#include "ShadowChicken.h"
+#include "SimpleTypedArrayController.h"
+#include "SourceProviderCache.h"
+#include "StackVisitor.h"
+#include "StrictEvalActivation.h"
+#include "StrongInlines.h"
+#include "StructureInlines.h"
+#include "TypeProfiler.h"
+#include "TypeProfilerLog.h"
+#include "UnlinkedCodeBlock.h"
+#include "VMEntryScope.h"
+#include "VMInspector.h"
+#include "Watchdog.h"
+#include "WeakGCMapInlines.h"
+#include "WeakMapData.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/ProcessID.h>
+#include <wtf/SimpleStats.h>
+#include <wtf/StringPrintStream.h>
+#include <wtf/Threading.h>
+#include <wtf/WTFThreadData.h>
+#include <wtf/text/AtomicStringTable.h>
+#include <wtf/text/SymbolRegistry.h>
+
+#if !ENABLE(JIT)
+#include "CLoopStack.h"
+#include "CLoopStackInlines.h"
+#endif
+
+#if ENABLE(DFG_JIT)
+#include "ConservativeRoots.h"
+#endif
+
+#if ENABLE(REGEXP_TRACING)
+#include "RegExp.h"
+#endif
+
+#if USE(CF)
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
+using namespace WTF;
+
+namespace JSC {
+
+// Note: Platform.h will enforce that ENABLE(ASSEMBLER) is true if either
+// ENABLE(JIT) or ENABLE(YARR_JIT) or both are enabled. The code below
+// just checks for ENABLE(JIT) or ENABLE(YARR_JIT) with this premise in mind.
+
+#if ENABLE(ASSEMBLER)
+static bool enableAssembler(ExecutableAllocator& executableAllocator)
+{
+    if (!Options::useJIT() && !Options::useRegExpJIT())
+        return false;
+
+    if (!executableAllocator.isValid()) {
+        if (Options::crashIfCantAllocateJITMemory())
+            CRASH();
+        return false;
+    }
+
+#if USE(CF) || OS(UNIX)
+    char* canUseJITString = getenv("JavaScriptCoreUseJIT");
+    return !canUseJITString || atoi(canUseJITString);
+#else
+    return true;
+#endif
+}
+#endif // ENABLE(!ASSEMBLER)
+
+VM::VM(VMType vmType, HeapType heapType)
+    : m_apiLock(adoptRef(new JSLock(this)))
+#if ENABLE(ASSEMBLER)
+    , executableAllocator(*this)
+#endif
+    , heap(this, heapType)
+    , auxiliarySpace("Auxiliary", heap, AllocatorAttributes(DoesNotNeedDestruction, HeapCell::Auxiliary))
+    , cellSpace("JSCell", heap, AllocatorAttributes(DoesNotNeedDestruction, HeapCell::JSCell))
+    , destructibleCellSpace("Destructible JSCell", heap, AllocatorAttributes(NeedsDestruction, HeapCell::JSCell))
+    , stringSpace("JSString", heap)
+    , destructibleObjectSpace("JSDestructibleObject", heap)
+    , vmType(vmType)
+    , clientData(0)
+    , topVMEntryFrame(nullptr)
+    , topCallFrame(CallFrame::noCaller())
+    , topJSWebAssemblyInstance(nullptr)
+    , m_atomicStringTable(vmType == Default ? wtfThreadData().atomicStringTable() : new AtomicStringTable)
+    , propertyNames(nullptr)
+    , emptyList(new ArgList)
+    , machineCodeBytesPerBytecodeWordForBaselineJIT(std::make_unique<SimpleStats>())
+    , customGetterSetterFunctionMap(*this)
+    , stringCache(*this)
+    , symbolImplToSymbolMap(*this)
+    , prototypeMap(*this)
+    , interpreter(0)
+    , jsArrayClassInfo(JSArray::info())
+    , jsFinalObjectClassInfo(JSFinalObject::info())
+    , sizeOfLastScratchBuffer(0)
+    , entryScope(0)
+    , m_regExpCache(new RegExpCache(this))
+#if ENABLE(REGEXP_TRACING)
+    , m_rtTraceList(new RTTraceList())
+#endif
+#if ENABLE(ASSEMBLER)
+    , m_canUseAssembler(enableAssembler(executableAllocator))
+#endif
+#if ENABLE(JIT)
+    , m_canUseJIT(m_canUseAssembler && Options::useJIT())
+#endif
+#if ENABLE(YARR_JIT)
+    , m_canUseRegExpJIT(m_canUseAssembler && Options::useRegExpJIT())
+#endif
+#if ENABLE(GC_VALIDATION)
+    , m_initializingObjectClass(0)
+#endif
+    , m_stackPointerAtVMEntry(0)
+    , m_codeCache(std::make_unique<CodeCache>())
+    , m_builtinExecutables(std::make_unique<BuiltinExecutables>(*this))
+    , m_typeProfilerEnabledCount(0)
+    , m_controlFlowProfilerEnabledCount(0)
+    , m_shadowChicken(std::make_unique<ShadowChicken>())
+{
+    interpreter = new Interpreter(*this);
+    StackBounds stack = wtfThreadData().stack();
+    updateSoftReservedZoneSize(Options::softReservedZoneSize());
+    setLastStackTop(stack.origin());
+
+    // Need to be careful to keep everything consistent here
+    JSLockHolder lock(this);
+    AtomicStringTable* existingEntryAtomicStringTable = wtfThreadData().setCurrentAtomicStringTable(m_atomicStringTable);
+    propertyNames = new CommonIdentifiers(this);
+    structureStructure.set(*this, Structure::createStructure(*this));
+    structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
+    terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
+    stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
+    propertyNameEnumeratorStructure.set(*this, JSPropertyNameEnumerator::createStructure(*this, 0, jsNull()));
+    customGetterSetterStructure.set(*this, CustomGetterSetter::createStructure(*this, 0, jsNull()));
+    scopedArgumentsTableStructure.set(*this, ScopedArgumentsTable::createStructure(*this, 0, jsNull()));
+    apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, 0, jsNull()));
+    JSScopeStructure.set(*this, JSScope::createStructure(*this, 0, jsNull()));
+    executableStructure.set(*this, ExecutableBase::createStructure(*this, 0, jsNull()));
+    nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, 0, jsNull()));
+    evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, 0, jsNull()));
+    programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, 0, jsNull()));
+    functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, 0, jsNull()));
+#if ENABLE(WEBASSEMBLY)
+    webAssemblyCalleeStructure.set(*this, JSWebAssemblyCallee::createStructure(*this, 0, jsNull()));
+    webAssemblyToJSCalleeStructure.set(*this, WebAssemblyToJSCallee::createStructure(*this, 0, jsNull()));
+    webAssemblyToJSCallee.set(*this, WebAssemblyToJSCallee::create(*this, webAssemblyToJSCalleeStructure.get()));
+#endif
+    moduleProgramExecutableStructure.set(*this, ModuleProgramExecutable::createStructure(*this, 0, jsNull()));
+    regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
+    symbolStructure.set(*this, Symbol::createStructure(*this, 0, jsNull()));
+    symbolTableStructure.set(*this, SymbolTable::createStructure(*this, 0, jsNull()));
+    fixedArrayStructure.set(*this, JSFixedArray::createStructure(*this, 0, jsNull()));
+    structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
+    sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
+    templateRegistryKeyStructure.set(*this, JSTemplateRegistryKey::createStructure(*this, 0, jsNull()));
+    arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpoint::createStructure(*this));
+    unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
+    unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
+    unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
+    unlinkedFunctionCodeBlockStructure.set(*this, UnlinkedFunctionCodeBlock::createStructure(*this, 0, jsNull()));
+    unlinkedModuleProgramCodeBlockStructure.set(*this, UnlinkedModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
+    propertyTableStructure.set(*this, PropertyTable::createStructure(*this, 0, jsNull()));
+    weakMapDataStructure.set(*this, WeakMapData::createStructure(*this, 0, jsNull()));
+    inferredValueStructure.set(*this, InferredValue::createStructure(*this, 0, jsNull()));
+    inferredTypeStructure.set(*this, InferredType::createStructure(*this, 0, jsNull()));
+    inferredTypeTableStructure.set(*this, InferredTypeTable::createStructure(*this, 0, jsNull()));
+    functionRareDataStructure.set(*this, FunctionRareData::createStructure(*this, 0, jsNull()));
+    exceptionStructure.set(*this, Exception::createStructure(*this, 0, jsNull()));
+    promiseDeferredStructure.set(*this, JSPromiseDeferred::createStructure(*this, 0, jsNull()));
+    internalPromiseDeferredStructure.set(*this, JSInternalPromiseDeferred::createStructure(*this, 0, jsNull()));
+    programCodeBlockStructure.set(*this, ProgramCodeBlock::createStructure(*this, 0, jsNull()));
+    moduleProgramCodeBlockStructure.set(*this, ModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
+    evalCodeBlockStructure.set(*this, EvalCodeBlock::createStructure(*this, 0, jsNull()));
+    functionCodeBlockStructure.set(*this, FunctionCodeBlock::createStructure(*this, 0, jsNull()));
+    hashMapBucketSetStructure.set(*this, HashMapBucket<HashMapBucketDataKey>::createStructure(*this, 0, jsNull()));
+    hashMapBucketMapStructure.set(*this, HashMapBucket<HashMapBucketDataKeyValue>::createStructure(*this, 0, jsNull()));
+    hashMapImplSetStructure.set(*this, HashMapImpl<HashMapBucket<HashMapBucketDataKey>>::createStructure(*this, 0, jsNull()));
+    hashMapImplMapStructure.set(*this, HashMapImpl<HashMapBucket<HashMapBucketDataKeyValue>>::createStructure(*this, 0, jsNull()));
+
+    iterationTerminator.set(*this, JSFinalObject::create(*this, JSFinalObject::createStructure(*this, 0, jsNull(), 1)));
+    nativeStdFunctionCellStructure.set(*this, NativeStdFunctionCell::createStructure(*this, 0, jsNull()));
+    smallStrings.initializeCommonStrings(*this);
+
+    wtfThreadData().setCurrentAtomicStringTable(existingEntryAtomicStringTable);
+
+#if ENABLE(JIT)
+    jitStubs = std::make_unique<JITThunks>();
+    allCalleeSaveRegisterOffsets = std::make_unique<RegisterAtOffsetList>(RegisterSet::vmCalleeSaveRegisters(), RegisterAtOffsetList::ZeroBased);
+#endif
+    arityCheckData = std::make_unique<CommonSlowPaths::ArityCheckData>();
+
+#if ENABLE(FTL_JIT)
+    ftlThunks = std::make_unique<FTL::Thunks>();
+#endif // ENABLE(FTL_JIT)
+    
+    interpreter->initialize();
+    
+#if ENABLE(JIT)
+    initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
+#endif
+
+    heap.notifyIsSafeToCollect();
+    
+    LLInt::Data::performAssertions(*this);
+    
+    if (Options::useProfiler()) {
+        m_perBytecodeProfiler = std::make_unique<Profiler::Database>(*this);
+
+        StringPrintStream pathOut;
+        const char* profilerPath = getenv("JSC_PROFILER_PATH");
+        if (profilerPath)
+            pathOut.print(profilerPath, "/");
+        pathOut.print("JSCProfile-", getCurrentProcessID(), "-", m_perBytecodeProfiler->databaseID(), ".json");
+        m_perBytecodeProfiler->registerToSaveAtExit(pathOut.toCString().data());
+    }
+
+    callFrameForCatch = nullptr;
+
+#if ENABLE(DFG_JIT)
+    if (canUseJIT())
+        dfgState = std::make_unique<DFG::LongLivedState>();
+#endif
+    
+    // Initialize this last, as a free way of asserting that VM initialization itself
+    // won't use this.
+    m_typedArrayController = adoptRef(new SimpleTypedArrayController());
+
+    m_bytecodeIntrinsicRegistry = std::make_unique<BytecodeIntrinsicRegistry>(*this);
+
+    if (Options::useTypeProfiler())
+        enableTypeProfiler();
+    if (Options::useControlFlowProfiler())
+        enableControlFlowProfiler();
+#if ENABLE(SAMPLING_PROFILER)
+    if (Options::useSamplingProfiler()) {
+        setShouldBuildPCToCodeOriginMapping();
+        Ref<Stopwatch> stopwatch = Stopwatch::create();
+        stopwatch->start();
+        m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
+        if (Options::samplingProfilerPath())
+            m_samplingProfiler->registerForReportAtExit();
+        m_samplingProfiler->start();
+    }
+#endif // ENABLE(SAMPLING_PROFILER)
+
+    if (Options::alwaysGeneratePCToCodeOriginMap())
+        setShouldBuildPCToCodeOriginMapping();
+
+    if (Options::watchdog()) {
+        std::chrono::milliseconds timeoutMillis(Options::watchdog());
+        Watchdog& watchdog = ensureWatchdog();
+        watchdog.setTimeLimit(timeoutMillis);
+    }
+
+    VMInspector::instance().add(this);
+}
+
+VM::~VM()
+{
+    VMInspector::instance().remove(this);
+
+    // Never GC, ever again.
+    heap.incrementDeferralDepth();
+
+#if ENABLE(SAMPLING_PROFILER)
+    if (m_samplingProfiler) {
+        m_samplingProfiler->reportDataToOptionFile();
+        m_samplingProfiler->shutdown();
+    }
+#endif // ENABLE(SAMPLING_PROFILER)
+    
+#if ENABLE(JIT)
+    JITWorklist::instance()->completeAllForVM(*this);
+#endif // ENABLE(JIT)
+
+#if ENABLE(DFG_JIT)
+    // Make sure concurrent compilations are done, but don't install them, since there is
+    // no point to doing so.
+    for (unsigned i = DFG::numberOfWorklists(); i--;) {
+        if (DFG::Worklist* worklist = DFG::existingWorklistForIndexOrNull(i)) {
+            worklist->removeNonCompilingPlansForVM(*this);
+            worklist->waitUntilAllPlansForVMAreReady(*this);
+            worklist->removeAllReadyPlansForVM(*this);
+        }
+    }
+#endif // ENABLE(DFG_JIT)
+    
+    waitForAsynchronousDisassembly();
+    
+    // Clear this first to ensure that nobody tries to remove themselves from it.
+    m_perBytecodeProfiler = nullptr;
+
+    ASSERT(m_apiLock->currentThreadIsHoldingLock());
+    m_apiLock->willDestroyVM(this);
+    heap.lastChanceToFinalize();
+
+    delete interpreter;
+#ifndef NDEBUG
+    interpreter = reinterpret_cast<Interpreter*>(0xbbadbeef);
+#endif
+
+    delete emptyList;
+
+    delete propertyNames;
+    if (vmType != Default)
+        delete m_atomicStringTable;
+
+    delete clientData;
+    delete m_regExpCache;
+#if ENABLE(REGEXP_TRACING)
+    delete m_rtTraceList;
+#endif
+
+#if ENABLE(DFG_JIT)
+    for (unsigned i = 0; i < scratchBuffers.size(); ++i)
+        fastFree(scratchBuffers[i]);
+#endif
+}
+
+void VM::setLastStackTop(void* lastStackTop)
+{ 
+    m_lastStackTop = lastStackTop;
+}
+
+Ref<VM> VM::createContextGroup(HeapType heapType)
+{
+    return adoptRef(*new VM(APIContextGroup, heapType));
+}
+
+Ref<VM> VM::create(HeapType heapType)
+{
+    return adoptRef(*new VM(Default, heapType));
+}
+
+Ref<VM> VM::createLeaked(HeapType heapType)
+{
+    return create(heapType);
+}
+
+bool VM::sharedInstanceExists()
+{
+    return sharedInstanceInternal();
+}
+
+VM& VM::sharedInstance()
+{
+    GlobalJSLock globalLock;
+    VM*& instance = sharedInstanceInternal();
+    if (!instance)
+        instance = adoptRef(new VM(APIShared, SmallHeap)).leakRef();
+    return *instance;
+}
+
+VM*& VM::sharedInstanceInternal()
+{
+    static VM* sharedInstance;
+    return sharedInstance;
+}
+
+Watchdog& VM::ensureWatchdog()
+{
+    if (!m_watchdog) {
+        m_watchdog = adoptRef(new Watchdog());
+        
+        // The LLINT peeks into the Watchdog object directly. In order to do that,
+        // the LLINT assumes that the internal shape of a std::unique_ptr is the
+        // same as a plain C++ pointer, and loads the address of Watchdog from it.
+        RELEASE_ASSERT(*reinterpret_cast<Watchdog**>(&m_watchdog) == m_watchdog.get());
+
+        // And if we've previously compiled any functions, we need to revert
+        // them because they don't have the needed polling checks for the watchdog
+        // yet.
+        deleteAllCode(PreventCollectionAndDeleteAllCode);
+    }
+    return *m_watchdog;
+}
+
+HeapProfiler& VM::ensureHeapProfiler()
+{
+    if (!m_heapProfiler)
+        m_heapProfiler = std::make_unique<HeapProfiler>(*this);
+    return *m_heapProfiler;
+}
+
+#if ENABLE(SAMPLING_PROFILER)
+SamplingProfiler& VM::ensureSamplingProfiler(RefPtr<Stopwatch>&& stopwatch)
+{
+    if (!m_samplingProfiler)
+        m_samplingProfiler = adoptRef(new SamplingProfiler(*this, WTFMove(stopwatch)));
+    return *m_samplingProfiler;
+}
+#endif // ENABLE(SAMPLING_PROFILER)
+
+#if ENABLE(JIT)
+static ThunkGenerator thunkGeneratorForIntrinsic(Intrinsic intrinsic)
+{
+    switch (intrinsic) {
+    case CharCodeAtIntrinsic:
+        return charCodeAtThunkGenerator;
+    case CharAtIntrinsic:
+        return charAtThunkGenerator;
+    case Clz32Intrinsic:
+        return clz32ThunkGenerator;
+    case FromCharCodeIntrinsic:
+        return fromCharCodeThunkGenerator;
+    case SqrtIntrinsic:
+        return sqrtThunkGenerator;
+    case AbsIntrinsic:
+        return absThunkGenerator;
+    case FloorIntrinsic:
+        return floorThunkGenerator;
+    case CeilIntrinsic:
+        return ceilThunkGenerator;
+    case TruncIntrinsic:
+        return truncThunkGenerator;
+    case RoundIntrinsic:
+        return roundThunkGenerator;
+    case ExpIntrinsic:
+        return expThunkGenerator;
+    case LogIntrinsic:
+        return logThunkGenerator;
+    case IMulIntrinsic:
+        return imulThunkGenerator;
+    case RandomIntrinsic:
+        return randomThunkGenerator;
+    case BoundThisNoArgsFunctionCallIntrinsic:
+        return boundThisNoArgsFunctionCallGenerator;
+    default:
+        return nullptr;
+    }
+}
+
+#endif // ENABLE(JIT)
+
+NativeExecutable* VM::getHostFunction(NativeFunction function, NativeFunction constructor, const String& name)
+{
+    return getHostFunction(function, NoIntrinsic, constructor, nullptr, name);
+}
+
+NativeExecutable* VM::getHostFunction(NativeFunction function, Intrinsic intrinsic, NativeFunction constructor, const DOMJIT::Signature* signature, const String& name)
+{
+#if ENABLE(JIT)
+    if (canUseJIT()) {
+        return jitStubs->hostFunctionStub(
+            this, function, constructor,
+            intrinsic != NoIntrinsic ? thunkGeneratorForIntrinsic(intrinsic) : 0,
+            intrinsic, signature, name);
+    }
+#else // ENABLE(JIT)
+    UNUSED_PARAM(intrinsic);
+#endif // ENABLE(JIT)
+    return NativeExecutable::create(*this,
+        adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_call_trampoline), JITCode::HostCallThunk)), function,
+        adoptRef(new NativeJITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_native_construct_trampoline), JITCode::HostCallThunk)), constructor,
+        NoIntrinsic, signature, name);
+}
+
+VM::ClientData::~ClientData()
+{
+}
+
+void VM::resetDateCache()
+{
+    localTimeOffsetCache.reset();
+    cachedDateString = String();
+    cachedDateStringValue = std::numeric_limits<double>::quiet_NaN();
+    dateInstanceCache.reset();
+}
+
+void VM::whenIdle(std::function<void()> callback)
+{
+    if (!entryScope) {
+        callback();
+        return;
+    }
+
+    entryScope->addDidPopListener(callback);
+}
+
+void VM::deleteAllLinkedCode(DeleteAllCodeEffort effort)
+{
+    whenIdle([=] () {
+        heap.deleteAllCodeBlocks(effort);
+    });
+}
+
+void VM::deleteAllCode(DeleteAllCodeEffort effort)
+{
+    whenIdle([=] () {
+        m_codeCache->clear();
+        m_regExpCache->deleteAllCode();
+        heap.deleteAllCodeBlocks(effort);
+        heap.deleteAllUnlinkedCodeBlocks(effort);
+        heap.reportAbandonedObjectGraph();
+    });
+}
+
+SourceProviderCache* VM::addSourceProviderCache(SourceProvider* sourceProvider)
+{
+    auto addResult = sourceProviderCacheMap.add(sourceProvider, nullptr);
+    if (addResult.isNewEntry)
+        addResult.iterator->value = adoptRef(new SourceProviderCache);
+    return addResult.iterator->value.get();
+}
+
+void VM::clearSourceProviderCaches()
+{
+    sourceProviderCacheMap.clear();
+}
+
+void VM::throwException(ExecState* exec, Exception* exception)
+{
+    if (Options::breakOnThrow()) {
+        dataLog("In call frame ", RawPointer(exec), " for code block ", *exec->codeBlock(), "\n");
+        CRASH();
+    }
+
+    ASSERT(exec == topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec());
+
+    interpreter->notifyDebuggerOfExceptionToBeThrown(exec, exception);
+
+    setException(exception);
+}
+
+JSValue VM::throwException(ExecState* exec, JSValue thrownValue)
+{
+    Exception* exception = jsDynamicCast<Exception*>(thrownValue);
+    if (!exception)
+        exception = Exception::create(*this, thrownValue);
+
+    throwException(exec, exception);
+    return JSValue(exception);
+}
+
+JSObject* VM::throwException(ExecState* exec, JSObject* error)
+{
+    return asObject(throwException(exec, JSValue(error)));
+}
+
+void VM::setStackPointerAtVMEntry(void* sp)
+{
+    m_stackPointerAtVMEntry = sp;
+    updateStackLimits();
+}
+
+size_t VM::updateSoftReservedZoneSize(size_t softReservedZoneSize)
+{
+    size_t oldSoftReservedZoneSize = m_currentSoftReservedZoneSize;
+    m_currentSoftReservedZoneSize = softReservedZoneSize;
+#if !ENABLE(JIT)
+    interpreter->cloopStack().setSoftReservedZoneSize(softReservedZoneSize);
+#endif
+
+    updateStackLimits();
+
+    return oldSoftReservedZoneSize;
+}
+
+#if PLATFORM(WIN)
+// On Windows the reserved stack space consists of committed memory, a guard page, and uncommitted memory,
+// where the guard page is a barrier between committed and uncommitted memory.
+// When data from the guard page is read or written, the guard page is moved, and memory is committed.
+// This is how the system grows the stack.
+// When using the C stack on Windows we need to precommit the needed stack space.
+// Otherwise we might crash later if we access uncommitted stack memory.
+// This can happen if we allocate stack space larger than the page guard size (4K).
+// The system does not get the chance to move the guard page, and commit more memory,
+// and we crash if uncommitted memory is accessed.
+// The MSVC compiler fixes this by inserting a call to the _chkstk() function,
+// when needed, see http://support.microsoft.com/kb/100775.
+// By touching every page up to the stack limit with a dummy operation,
+// we force the system to move the guard page, and commit memory.
+
+static void preCommitStackMemory(void* stackLimit)
+{
+    const int pageSize = 4096;
+    for (volatile char* p = reinterpret_cast<char*>(&stackLimit); p > stackLimit; p -= pageSize) {
+        char ch = *p;
+        *p = ch;
+    }
+}
+#endif
+
+inline void VM::updateStackLimits()
+{
+#if PLATFORM(WIN)
+    void* lastSoftStackLimit = m_softStackLimit;
+#endif
+
+    size_t reservedZoneSize = Options::reservedZoneSize();
+    if (m_stackPointerAtVMEntry) {
+        ASSERT(wtfThreadData().stack().isGrowingDownward());
+        char* startOfStack = reinterpret_cast<char*>(m_stackPointerAtVMEntry);
+        m_softStackLimit = wtfThreadData().stack().recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), m_currentSoftReservedZoneSize);
+        m_stackLimit = wtfThreadData().stack().recursionLimit(startOfStack, Options::maxPerThreadStackUsage(), reservedZoneSize);
+    } else {
+        m_softStackLimit = wtfThreadData().stack().recursionLimit(m_currentSoftReservedZoneSize);
+        m_stackLimit = wtfThreadData().stack().recursionLimit(reservedZoneSize);
+    }
+
+#if PLATFORM(WIN)
+    // We only need to precommit stack memory dictated by the VM::m_softStackLimit limit.
+    // This is because VM::m_softStackLimit applies to stack usage by LLINT asm or JIT
+    // generated code which can allocate stack space that the C++ compiler does not know
+    // about. As such, we have to precommit that stack memory manually.
+    //
+    // In contrast, we do not need to worry about VM::m_stackLimit because that limit is
+    // used exclusively by C++ code, and the C++ compiler will automatically commit the
+    // needed stack pages.
+    if (lastSoftStackLimit != m_softStackLimit)
+        preCommitStackMemory(m_softStackLimit);
+#endif
+}
+
+#if ENABLE(DFG_JIT)
+void VM::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
+{
+    for (size_t i = 0; i < scratchBuffers.size(); i++) {
+        ScratchBuffer* scratchBuffer = scratchBuffers[i];
+        if (scratchBuffer->activeLength()) {
+            void* bufferStart = scratchBuffer->dataBuffer();
+            conservativeRoots.add(bufferStart, static_cast<void*>(static_cast<char*>(bufferStart) + scratchBuffer->activeLength()));
+        }
+    }
+}
+#endif
+
+void logSanitizeStack(VM* vm)
+{
+    if (Options::verboseSanitizeStack() && vm->topCallFrame) {
+        int dummy;
+        dataLog(
+            "Sanitizing stack with top call frame at ", RawPointer(vm->topCallFrame),
+            ", current stack pointer at ", RawPointer(&dummy), ", in ",
+            pointerDump(vm->topCallFrame->codeBlock()), " and last code origin = ",
+            vm->topCallFrame->codeOrigin(), "\n");
+    }
+}
+
+#if ENABLE(REGEXP_TRACING)
+void VM::addRegExpToTrace(RegExp* regExp)
+{
+    gcProtect(regExp);
+    m_rtTraceList->add(regExp);
+}
+
+void VM::dumpRegExpTrace()
+{
+    // The first RegExp object is ignored.  It is create by the RegExpPrototype ctor and not used.
+    RTTraceList::iterator iter = ++m_rtTraceList->begin();
+    
+    if (iter != m_rtTraceList->end()) {
+        dataLogF("\nRegExp Tracing\n");
+        dataLogF("Regular Expression                              8 Bit          16 Bit        match()    Matches    Average\n");
+        dataLogF(" <Match only / Match>                         JIT Addr      JIT Address       calls      found   String len\n");
+        dataLogF("----------------------------------------+----------------+----------------+----------+----------+-----------\n");
+    
+        unsigned reCount = 0;
+    
+        for (; iter != m_rtTraceList->end(); ++iter, ++reCount) {
+            (*iter)->printTraceData();
+            gcUnprotect(*iter);
+        }
+
+        dataLogF("%d Regular Expressions\n", reCount);
+    }
+    
+    m_rtTraceList->clear();
+}
+#else
+void VM::dumpRegExpTrace()
+{
+}
+#endif
+
+WatchpointSet* VM::ensureWatchpointSetForImpureProperty(const Identifier& propertyName)
+{
+    auto result = m_impurePropertyWatchpointSets.add(propertyName.string(), nullptr);
+    if (result.isNewEntry)
+        result.iterator->value = adoptRef(new WatchpointSet(IsWatched));
+    return result.iterator->value.get();
+}
+
+void VM::registerWatchpointForImpureProperty(const Identifier& propertyName, Watchpoint* watchpoint)
+{
+    ensureWatchpointSetForImpureProperty(propertyName)->add(watchpoint);
+}
+
+void VM::addImpureProperty(const String& propertyName)
+{
+    if (RefPtr<WatchpointSet> watchpointSet = m_impurePropertyWatchpointSets.take(propertyName))
+        watchpointSet->fireAll(*this, "Impure property added");
+}
+
+static bool enableProfilerWithRespectToCount(unsigned& counter, std::function<void()> doEnableWork)
+{
+    bool needsToRecompile = false;
+    if (!counter) {
+        doEnableWork();
+        needsToRecompile = true;
+    }
+    counter++;
+
+    return needsToRecompile;
+}
+
+static bool disableProfilerWithRespectToCount(unsigned& counter, std::function<void()> doDisableWork)
+{
+    RELEASE_ASSERT(counter > 0);
+    bool needsToRecompile = false;
+    counter--;
+    if (!counter) {
+        doDisableWork();
+        needsToRecompile = true;
+    }
+
+    return needsToRecompile;
+}
+
+bool VM::enableTypeProfiler()
+{
+    auto enableTypeProfiler = [this] () {
+        this->m_typeProfiler = std::make_unique<TypeProfiler>();
+        this->m_typeProfilerLog = std::make_unique<TypeProfilerLog>();
+    };
+
+    return enableProfilerWithRespectToCount(m_typeProfilerEnabledCount, enableTypeProfiler);
+}
+
+bool VM::disableTypeProfiler()
+{
+    auto disableTypeProfiler = [this] () {
+        this->m_typeProfiler.reset(nullptr);
+        this->m_typeProfilerLog.reset(nullptr);
+    };
+
+    return disableProfilerWithRespectToCount(m_typeProfilerEnabledCount, disableTypeProfiler);
+}
+
+bool VM::enableControlFlowProfiler()
+{
+    auto enableControlFlowProfiler = [this] () {
+        this->m_controlFlowProfiler = std::make_unique<ControlFlowProfiler>();
+    };
+
+    return enableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, enableControlFlowProfiler);
+}
+
+bool VM::disableControlFlowProfiler()
+{
+    auto disableControlFlowProfiler = [this] () {
+        this->m_controlFlowProfiler.reset(nullptr);
+    };
+
+    return disableProfilerWithRespectToCount(m_controlFlowProfilerEnabledCount, disableControlFlowProfiler);
+}
+
+void VM::dumpTypeProfilerData()
+{
+    if (!typeProfiler())
+        return;
+
+    typeProfilerLog()->processLogEntries(ASCIILiteral("VM Dump Types"));
+    typeProfiler()->dumpTypeProfilerData(*this);
+}
+
+void VM::queueMicrotask(JSGlobalObject* globalObject, PassRefPtr<Microtask> task)
+{
+    m_microtaskQueue.append(std::make_unique<QueuedTask>(*this, globalObject, task));
+}
+
+void VM::drainMicrotasks()
+{
+    while (!m_microtaskQueue.isEmpty())
+        m_microtaskQueue.takeFirst()->run();
+}
+
+void QueuedTask::run()
+{
+    m_microtask->run(m_globalObject->globalExec());
+}
+
+void sanitizeStackForVM(VM* vm)
+{
+    logSanitizeStack(vm);
+#if !ENABLE(JIT)
+    vm->interpreter->cloopStack().sanitizeStack();
+#else
+    sanitizeStackForVMImpl(vm);
+#endif
+}
+
+size_t VM::committedStackByteCount()
+{
+#if ENABLE(JIT)
+    // When using the C stack, we don't know how many stack pages are actually
+    // committed. So, we use the current stack usage as an estimate.
+    ASSERT(wtfThreadData().stack().isGrowingDownward());
+    int8_t* current = reinterpret_cast<int8_t*>(&current);
+    int8_t* high = reinterpret_cast<int8_t*>(wtfThreadData().stack().origin());
+    return high - current;
+#else
+    return CLoopStack::committedByteCount();
+#endif
+}
+
+#if !ENABLE(JIT)
+bool VM::ensureStackCapacityForCLoop(Register* newTopOfStack)
+{
+    return interpreter->cloopStack().ensureCapacityFor(newTopOfStack);
+}
+
+bool VM::isSafeToRecurseSoftCLoop() const
+{
+    return interpreter->cloopStack().isSafeToRecurse();
+}
+#endif // !ENABLE(JIT)
+
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+void VM::verifyExceptionCheckNeedIsSatisfied(unsigned recursionDepth, ExceptionEventLocation& location)
+{
+    if (!Options::validateExceptionChecks())
+        return;
+
+    if (UNLIKELY(m_needExceptionCheck)) {
+        auto throwDepth = m_simulatedThrowPointRecursionDepth;
+        auto& throwLocation = m_simulatedThrowPointLocation;
+
+        dataLog(
+            "ERROR: Unchecked JS exception:\n"
+            "    This scope can throw a JS exception: ", throwLocation, "\n"
+            "        (ExceptionScope::m_recursionDepth was ", throwDepth, ")\n"
+            "    But the exception was unchecked as of this scope: ", location, "\n"
+            "        (ExceptionScope::m_recursionDepth was ", recursionDepth, ")\n"
+            "\n");
+
+        RELEASE_ASSERT(!m_needExceptionCheck);
+    }
+}
+#endif
+
+} // namespace JSC
diff --git a/runtime/VM.h b/runtime/VM.h
new file mode 100644
index 0000000..ffd4c9e
--- /dev/null
+++ b/runtime/VM.h
@@ -0,0 +1,805 @@
+/*
+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "CallData.h"
+#include "ConcurrentJSLock.h"
+#include "ControlFlowProfiler.h"
+#include "DateInstanceCache.h"
+#include "DeleteAllCodeEffort.h"
+#include "ExceptionEventLocation.h"
+#include "ExecutableAllocator.h"
+#include "FunctionHasExecutedCache.h"
+#include "Heap.h"
+#include "Intrinsic.h"
+#include "JITThunks.h"
+#include "JSCJSValue.h"
+#include "JSDestructibleObjectSubspace.h"
+#include "JSLock.h"
+#include "JSStringSubspace.h"
+#include "MacroAssemblerCodeRef.h"
+#include "Microtask.h"
+#include "NumericStrings.h"
+#include "PrivateName.h"
+#include "PrototypeMap.h"
+#include "SmallStrings.h"
+#include "SourceCode.h"
+#include "Strong.h"
+#include "Subspace.h"
+#include "TemplateRegistryKeyTable.h"
+#include "ThunkGenerators.h"
+#include "VMEntryRecord.h"
+#include "Watchpoint.h"
+#include <wtf/Bag.h>
+#include <wtf/BumpPointerAllocator.h>
+#include <wtf/DateMath.h>
+#include <wtf/Deque.h>
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/StackBounds.h>
+#include <wtf/Stopwatch.h>
+#include <wtf/ThreadSafeRefCounted.h>
+#include <wtf/ThreadSpecific.h>
+#include <wtf/WTFThreadData.h>
+#include <wtf/text/SymbolRegistry.h>
+#include <wtf/text/WTFString.h>
+#if ENABLE(REGEXP_TRACING)
+#include <wtf/ListHashSet.h>
+#endif
+
+namespace WTF {
+class SimpleStats;
+} // namespace WTF
+using WTF::SimpleStats;
+
+namespace JSC {
+
+class BuiltinExecutables;
+class BytecodeIntrinsicRegistry;
+class CodeBlock;
+class CodeCache;
+class CommonIdentifiers;
+class CustomGetterSetter;
+class ExecState;
+class Exception;
+class ExceptionScope;
+class HandleStack;
+class TypeProfiler;
+class TypeProfilerLog;
+class HasOwnPropertyCache;
+class HeapProfiler;
+class Identifier;
+class Interpreter;
+class JSCustomGetterSetterFunction;
+class JSGlobalObject;
+class JSObject;
+class JSWebAssemblyInstance;
+class LLIntOffsetsExtractor;
+class NativeExecutable;
+class RegExpCache;
+class Register;
+class RegisterAtOffsetList;
+#if ENABLE(SAMPLING_PROFILER)
+class SamplingProfiler;
+#endif
+class ShadowChicken;
+class ScriptExecutable;
+class SourceProvider;
+class SourceProviderCache;
+class StackFrame;
+class Structure;
+#if ENABLE(REGEXP_TRACING)
+class RegExp;
+#endif
+class Symbol;
+class TypedArrayController;
+class UnlinkedCodeBlock;
+class UnlinkedEvalCodeBlock;
+class UnlinkedFunctionExecutable;
+class UnlinkedProgramCodeBlock;
+class UnlinkedModuleProgramCodeBlock;
+class VirtualRegister;
+class VMEntryScope;
+class Watchdog;
+class Watchpoint;
+class WatchpointSet;
+
+#if ENABLE(DFG_JIT)
+namespace DFG {
+class LongLivedState;
+}
+#endif // ENABLE(DFG_JIT)
+#if ENABLE(FTL_JIT)
+namespace FTL {
+class Thunks;
+}
+#endif // ENABLE(FTL_JIT)
+namespace CommonSlowPaths {
+struct ArityCheckData;
+}
+namespace Profiler {
+class Database;
+}
+namespace DOMJIT {
+class Signature;
+}
+
+struct HashTable;
+struct Instruction;
+
+struct LocalTimeOffsetCache {
+    LocalTimeOffsetCache()
+        : start(0.0)
+        , end(-1.0)
+        , increment(0.0)
+        , timeType(WTF::UTCTime)
+    {
+    }
+
+    void reset()
+    {
+        offset = LocalTimeOffset();
+        start = 0.0;
+        end = -1.0;
+        increment = 0.0;
+        timeType = WTF::UTCTime;
+    }
+
+    LocalTimeOffset offset;
+    double start;
+    double end;
+    double increment;
+    WTF::TimeType timeType;
+};
+
+class QueuedTask {
+    WTF_MAKE_NONCOPYABLE(QueuedTask);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    void run();
+
+    QueuedTask(VM& vm, JSGlobalObject* globalObject, PassRefPtr<Microtask> microtask)
+        : m_globalObject(vm, globalObject)
+        , m_microtask(microtask)
+    {
+    }
+
+private:
+    Strong<JSGlobalObject> m_globalObject;
+    RefPtr<Microtask> m_microtask;
+};
+
+class ConservativeRoots;
+
+#if COMPILER(MSVC)
+#pragma warning(push)
+#pragma warning(disable: 4200) // Disable "zero-sized array in struct/union" warning
+#endif
+struct ScratchBuffer {
+    ScratchBuffer()
+    {
+        u.m_activeLength = 0;
+    }
+
+    static ScratchBuffer* create(size_t size)
+    {
+        ScratchBuffer* result = new (fastMalloc(ScratchBuffer::allocationSize(size))) ScratchBuffer;
+
+        return result;
+    }
+
+    static size_t allocationSize(size_t bufferSize) { return sizeof(ScratchBuffer) + bufferSize; }
+    void setActiveLength(size_t activeLength) { u.m_activeLength = activeLength; }
+    size_t activeLength() const { return u.m_activeLength; };
+    size_t* activeLengthPtr() { return &u.m_activeLength; };
+    void* dataBuffer() { return m_buffer; }
+
+    union {
+        size_t m_activeLength;
+        double pad; // Make sure m_buffer is double aligned.
+    } u;
+#if CPU(MIPS) && (defined WTF_MIPS_ARCH_REV && WTF_MIPS_ARCH_REV == 2)
+    void* m_buffer[0] __attribute__((aligned(8)));
+#else
+    void* m_buffer[0];
+#endif
+};
+#if COMPILER(MSVC)
+#pragma warning(pop)
+#endif
+
+class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
+public:
+    // WebCore has a one-to-one mapping of threads to VMs;
+    // either create() or createLeaked() should only be called once
+    // on a thread, this is the 'default' VM (it uses the
+    // thread's default string uniquing table from wtfThreadData).
+    // API contexts created using the new context group aware interface
+    // create APIContextGroup objects which require less locking of JSC
+    // than the old singleton APIShared VM created for use by
+    // the original API.
+    enum VMType { Default, APIContextGroup, APIShared };
+
+    struct ClientData {
+        JS_EXPORT_PRIVATE virtual ~ClientData() = 0;
+    };
+
+    bool isSharedInstance() { return vmType == APIShared; }
+    bool usingAPI() { return vmType != Default; }
+    JS_EXPORT_PRIVATE static bool sharedInstanceExists();
+    JS_EXPORT_PRIVATE static VM& sharedInstance();
+
+    JS_EXPORT_PRIVATE static Ref<VM> create(HeapType = SmallHeap);
+    JS_EXPORT_PRIVATE static Ref<VM> createLeaked(HeapType = SmallHeap);
+    static Ref<VM> createContextGroup(HeapType = SmallHeap);
+    JS_EXPORT_PRIVATE ~VM();
+
+    JS_EXPORT_PRIVATE Watchdog& ensureWatchdog();
+    Watchdog* watchdog() { return m_watchdog.get(); }
+
+    HeapProfiler* heapProfiler() const { return m_heapProfiler.get(); }
+    JS_EXPORT_PRIVATE HeapProfiler& ensureHeapProfiler();
+
+#if ENABLE(SAMPLING_PROFILER)
+    SamplingProfiler* samplingProfiler() { return m_samplingProfiler.get(); }
+    JS_EXPORT_PRIVATE SamplingProfiler& ensureSamplingProfiler(RefPtr<Stopwatch>&&);
+#endif
+
+private:
+    RefPtr<JSLock> m_apiLock;
+
+public:
+#if ENABLE(ASSEMBLER)
+    // executableAllocator should be destructed after the heap, as the heap can call executableAllocator
+    // in its destructor.
+    ExecutableAllocator executableAllocator;
+#endif
+
+    // The heap should be just after executableAllocator and before other members to ensure that it's
+    // destructed after all the objects that reference it.
+    Heap heap;
+    
+    Subspace auxiliarySpace;
+    
+    // Whenever possible, use subspaceFor<CellType>(vm) to get one of these subspaces.
+    Subspace cellSpace;
+    Subspace destructibleCellSpace;
+    JSStringSubspace stringSpace;
+    JSDestructibleObjectSubspace destructibleObjectSpace;
+
+#if ENABLE(DFG_JIT)
+    std::unique_ptr<DFG::LongLivedState> dfgState;
+#endif // ENABLE(DFG_JIT)
+
+    VMType vmType;
+    ClientData* clientData;
+    VMEntryFrame* topVMEntryFrame;
+    // NOTE: When throwing an exception while rolling back the call frame, this may be equal to
+    // topVMEntryFrame.
+    // FIXME: This should be a void*, because it might not point to a CallFrame.
+    // https://bugs.webkit.org/show_bug.cgi?id=160441
+    ExecState* topCallFrame;
+    JSWebAssemblyInstance* topJSWebAssemblyInstance;
+    void* topWasmMemoryPointer;
+    uint32_t topWasmMemorySize;
+    Strong<Structure> structureStructure;
+    Strong<Structure> structureRareDataStructure;
+    Strong<Structure> terminatedExecutionErrorStructure;
+    Strong<Structure> stringStructure;
+    Strong<Structure> propertyNameIteratorStructure;
+    Strong<Structure> propertyNameEnumeratorStructure;
+    Strong<Structure> customGetterSetterStructure;
+    Strong<Structure> scopedArgumentsTableStructure;
+    Strong<Structure> apiWrapperStructure;
+    Strong<Structure> JSScopeStructure;
+    Strong<Structure> executableStructure;
+    Strong<Structure> nativeExecutableStructure;
+    Strong<Structure> evalExecutableStructure;
+    Strong<Structure> programExecutableStructure;
+    Strong<Structure> functionExecutableStructure;
+#if ENABLE(WEBASSEMBLY)
+    Strong<Structure> webAssemblyCalleeStructure;
+    Strong<Structure> webAssemblyToJSCalleeStructure;
+    Strong<JSCell> webAssemblyToJSCallee;
+#endif
+    Strong<Structure> moduleProgramExecutableStructure;
+    Strong<Structure> regExpStructure;
+    Strong<Structure> symbolStructure;
+    Strong<Structure> symbolTableStructure;
+    Strong<Structure> fixedArrayStructure;
+    Strong<Structure> structureChainStructure;
+    Strong<Structure> sparseArrayValueMapStructure;
+    Strong<Structure> templateRegistryKeyStructure;
+    Strong<Structure> arrayBufferNeuteringWatchpointStructure;
+    Strong<Structure> unlinkedFunctionExecutableStructure;
+    Strong<Structure> unlinkedProgramCodeBlockStructure;
+    Strong<Structure> unlinkedEvalCodeBlockStructure;
+    Strong<Structure> unlinkedFunctionCodeBlockStructure;
+    Strong<Structure> unlinkedModuleProgramCodeBlockStructure;
+    Strong<Structure> propertyTableStructure;
+    Strong<Structure> weakMapDataStructure;
+    Strong<Structure> inferredValueStructure;
+    Strong<Structure> inferredTypeStructure;
+    Strong<Structure> inferredTypeTableStructure;
+    Strong<Structure> functionRareDataStructure;
+    Strong<Structure> exceptionStructure;
+    Strong<Structure> promiseDeferredStructure;
+    Strong<Structure> internalPromiseDeferredStructure;
+    Strong<Structure> nativeStdFunctionCellStructure;
+    Strong<Structure> programCodeBlockStructure;
+    Strong<Structure> moduleProgramCodeBlockStructure;
+    Strong<Structure> evalCodeBlockStructure;
+    Strong<Structure> functionCodeBlockStructure;
+    Strong<Structure> hashMapBucketSetStructure;
+    Strong<Structure> hashMapBucketMapStructure;
+    Strong<Structure> hashMapImplSetStructure;
+    Strong<Structure> hashMapImplMapStructure;
+
+    Strong<JSCell> iterationTerminator;
+    Strong<JSCell> emptyPropertyNameEnumerator;
+
+    JSCell* currentlyDestructingCallbackObject;
+    const ClassInfo* currentlyDestructingCallbackObjectClassInfo;
+
+    AtomicStringTable* m_atomicStringTable;
+    WTF::SymbolRegistry m_symbolRegistry;
+    TemplateRegistryKeyTable m_templateRegistryKeytable;
+    CommonIdentifiers* propertyNames;
+    const ArgList* emptyList;
+    SmallStrings smallStrings;
+    NumericStrings numericStrings;
+    DateInstanceCache dateInstanceCache;
+    std::unique_ptr<SimpleStats> machineCodeBytesPerBytecodeWordForBaselineJIT;
+    WeakGCMap<std::pair<CustomGetterSetter*, int>, JSCustomGetterSetterFunction> customGetterSetterFunctionMap;
+    WeakGCMap<StringImpl*, JSString, PtrHash<StringImpl*>> stringCache;
+    Strong<JSString> lastCachedString;
+
+    AtomicStringTable* atomicStringTable() const { return m_atomicStringTable; }
+    WTF::SymbolRegistry& symbolRegistry() { return m_symbolRegistry; }
+
+    TemplateRegistryKeyTable& templateRegistryKeyTable() { return m_templateRegistryKeytable; }
+
+    WeakGCMap<SymbolImpl*, Symbol, PtrHash<SymbolImpl*>> symbolImplToSymbolMap;
+
+    enum class DeletePropertyMode {
+        // Default behaviour of deleteProperty, matching the spec.
+        Default,
+        // This setting causes deleteProperty to force deletion of all
+        // properties including those that are non-configurable (DontDelete).
+        IgnoreConfigurable
+    };
+
+    DeletePropertyMode deletePropertyMode()
+    {
+        return m_deletePropertyMode;
+    }
+
+    class DeletePropertyModeScope {
+    public:
+        DeletePropertyModeScope(VM& vm, DeletePropertyMode mode)
+            : m_vm(vm)
+            , m_previousMode(vm.m_deletePropertyMode)
+        {
+            m_vm.m_deletePropertyMode = mode;
+        }
+
+        ~DeletePropertyModeScope()
+        {
+            m_vm.m_deletePropertyMode = m_previousMode;
+        }
+
+    private:
+        VM& m_vm;
+        DeletePropertyMode m_previousMode;
+    };
+
+#if ENABLE(JIT)
+    bool canUseJIT() { return m_canUseJIT; }
+#else
+    bool canUseJIT() { return false; } // interpreter only
+#endif
+
+#if ENABLE(YARR_JIT)
+    bool canUseRegExpJIT() { return m_canUseRegExpJIT; }
+#else
+    bool canUseRegExpJIT() { return false; } // interpreter only
+#endif
+
+    SourceProviderCache* addSourceProviderCache(SourceProvider*);
+    void clearSourceProviderCaches();
+
+    PrototypeMap prototypeMap;
+
+    typedef HashMap<RefPtr<SourceProvider>, RefPtr<SourceProviderCache>> SourceProviderCacheMap;
+    SourceProviderCacheMap sourceProviderCacheMap;
+    Interpreter* interpreter;
+#if ENABLE(JIT)
+    std::unique_ptr<JITThunks> jitStubs;
+    MacroAssemblerCodeRef getCTIStub(ThunkGenerator generator)
+    {
+        return jitStubs->ctiStub(this, generator);
+    }
+    
+    std::unique_ptr<RegisterAtOffsetList> allCalleeSaveRegisterOffsets;
+    
+    RegisterAtOffsetList* getAllCalleeSaveRegisterOffsets() { return allCalleeSaveRegisterOffsets.get(); }
+
+#endif // ENABLE(JIT)
+    std::unique_ptr<CommonSlowPaths::ArityCheckData> arityCheckData;
+#if ENABLE(FTL_JIT)
+    std::unique_ptr<FTL::Thunks> ftlThunks;
+#endif
+    NativeExecutable* getHostFunction(NativeFunction, NativeFunction constructor, const String& name);
+    NativeExecutable* getHostFunction(NativeFunction, Intrinsic, NativeFunction constructor, const DOMJIT::Signature*, const String& name);
+
+    static ptrdiff_t exceptionOffset()
+    {
+        return OBJECT_OFFSETOF(VM, m_exception);
+    }
+
+    static ptrdiff_t callFrameForCatchOffset()
+    {
+        return OBJECT_OFFSETOF(VM, callFrameForCatch);
+    }
+
+    static ptrdiff_t targetMachinePCForThrowOffset()
+    {
+        return OBJECT_OFFSETOF(VM, targetMachinePCForThrow);
+    }
+
+    void restorePreviousException(Exception* exception) { setException(exception); }
+
+    void clearLastException() { m_lastException = nullptr; }
+
+    ExecState** addressOfCallFrameForCatch() { return &callFrameForCatch; }
+
+    JSCell** addressOfException() { return reinterpret_cast<JSCell**>(&m_exception); }
+
+    Exception* lastException() const { return m_lastException; }
+    JSCell** addressOfLastException() { return reinterpret_cast<JSCell**>(&m_lastException); }
+
+    void setFailNextNewCodeBlock() { m_failNextNewCodeBlock = true; }
+    bool getAndClearFailNextNewCodeBlock()
+    {
+        bool result = m_failNextNewCodeBlock;
+        m_failNextNewCodeBlock = false;
+        return result;
+    }
+    
+    ALWAYS_INLINE Structure* getStructure(StructureID id)
+    {
+        return heap.structureIDTable().get(decontaminate(id));
+    }
+    
+    void* stackPointerAtVMEntry() const { return m_stackPointerAtVMEntry; }
+    void setStackPointerAtVMEntry(void*);
+
+    size_t softReservedZoneSize() const { return m_currentSoftReservedZoneSize; }
+    size_t updateSoftReservedZoneSize(size_t softReservedZoneSize);
+    
+    static size_t committedStackByteCount();
+    inline bool ensureStackCapacityFor(Register* newTopOfStack);
+
+    void* stackLimit() { return m_stackLimit; }
+    void* softStackLimit() { return m_softStackLimit; }
+    void** addressOfSoftStackLimit() { return &m_softStackLimit; }
+#if !ENABLE(JIT)
+    void* cloopStackLimit() { return m_cloopStackLimit; }
+    void setCLoopStackLimit(void* limit) { m_cloopStackLimit = limit; }
+#endif
+
+    inline bool isSafeToRecurseSoft() const;
+    bool isSafeToRecurse() const
+    {
+        return isSafeToRecurse(m_stackLimit);
+    }
+
+    void* lastStackTop() { return m_lastStackTop; }
+    void setLastStackTop(void*);
+
+    const ClassInfo* const jsArrayClassInfo;
+    const ClassInfo* const jsFinalObjectClassInfo;
+
+    JSValue hostCallReturnValue;
+    unsigned varargsLength;
+    ExecState* newCallFrameReturnValue;
+    ExecState* callFrameForCatch;
+    void* targetMachinePCForThrow;
+    Instruction* targetInterpreterPCForThrow;
+    uint32_t osrExitIndex;
+    void* osrExitJumpDestination;
+    Vector<ScratchBuffer*> scratchBuffers;
+    size_t sizeOfLastScratchBuffer;
+
+    bool isExecutingInRegExpJIT { false };
+
+    ScratchBuffer* scratchBufferForSize(size_t size)
+    {
+        if (!size)
+            return 0;
+
+        if (size > sizeOfLastScratchBuffer) {
+            // Protect against a N^2 memory usage pathology by ensuring
+            // that at worst, we get a geometric series, meaning that the
+            // total memory usage is somewhere around
+            // max(scratch buffer size) * 4.
+            sizeOfLastScratchBuffer = size * 2;
+
+            ScratchBuffer* newBuffer = ScratchBuffer::create(sizeOfLastScratchBuffer);
+            RELEASE_ASSERT(newBuffer);
+            scratchBuffers.append(newBuffer);
+        }
+
+        ScratchBuffer* result = scratchBuffers.last();
+        result->setActiveLength(0);
+        return result;
+    }
+
+    EncodedJSValue* exceptionFuzzingBuffer(size_t size)
+    {
+        ASSERT(Options::useExceptionFuzz());
+        if (!m_exceptionFuzzBuffer)
+            m_exceptionFuzzBuffer = MallocPtr<EncodedJSValue>::malloc(size);
+        return m_exceptionFuzzBuffer.get();
+    }
+
+    void gatherConservativeRoots(ConservativeRoots&);
+
+    VMEntryScope* entryScope;
+
+    JSObject* stringRecursionCheckFirstObject { nullptr };
+    HashSet<JSObject*> stringRecursionCheckVisitedObjects;
+
+    LocalTimeOffsetCache localTimeOffsetCache;
+
+    String cachedDateString;
+    double cachedDateStringValue;
+
+    std::unique_ptr<Profiler::Database> m_perBytecodeProfiler;
+    RefPtr<TypedArrayController> m_typedArrayController;
+    RegExpCache* m_regExpCache;
+    BumpPointerAllocator m_regExpAllocator;
+    ConcurrentJSLock m_regExpAllocatorLock;
+
+    std::unique_ptr<HasOwnPropertyCache> m_hasOwnPropertyCache;
+    ALWAYS_INLINE HasOwnPropertyCache* hasOwnPropertyCache() { return m_hasOwnPropertyCache.get(); }
+    HasOwnPropertyCache* ensureHasOwnPropertyCache();
+
+#if ENABLE(REGEXP_TRACING)
+    typedef ListHashSet<RegExp*> RTTraceList;
+    RTTraceList* m_rtTraceList;
+#endif
+
+    bool hasExclusiveThread() const { return m_apiLock->hasExclusiveThread(); }
+    std::thread::id exclusiveThread() const { return m_apiLock->exclusiveThread(); }
+    void setExclusiveThread(std::thread::id threadId) { m_apiLock->setExclusiveThread(threadId); }
+
+    JS_EXPORT_PRIVATE void resetDateCache();
+
+    RegExpCache* regExpCache() { return m_regExpCache; }
+#if ENABLE(REGEXP_TRACING)
+    void addRegExpToTrace(RegExp*);
+#endif
+    JS_EXPORT_PRIVATE void dumpRegExpTrace();
+
+    bool isCollectorBusyOnCurrentThread() { return heap.isCurrentThreadBusy(); }
+
+#if ENABLE(GC_VALIDATION)
+    bool isInitializingObject() const; 
+    void setInitializingObjectClass(const ClassInfo*);
+#endif
+
+    bool currentThreadIsHoldingAPILock() const { return m_apiLock->currentThreadIsHoldingLock(); }
+
+    JSLock& apiLock() { return *m_apiLock; }
+    CodeCache* codeCache() { return m_codeCache.get(); }
+
+    JS_EXPORT_PRIVATE void whenIdle(std::function<void()>);
+
+    JS_EXPORT_PRIVATE void deleteAllCode(DeleteAllCodeEffort);
+    JS_EXPORT_PRIVATE void deleteAllLinkedCode(DeleteAllCodeEffort);
+
+    WatchpointSet* ensureWatchpointSetForImpureProperty(const Identifier&);
+    void registerWatchpointForImpureProperty(const Identifier&, Watchpoint*);
+    
+    // FIXME: Use AtomicString once it got merged with Identifier.
+    JS_EXPORT_PRIVATE void addImpureProperty(const String&);
+
+    BuiltinExecutables* builtinExecutables() { return m_builtinExecutables.get(); }
+
+    bool enableTypeProfiler();
+    bool disableTypeProfiler();
+    TypeProfilerLog* typeProfilerLog() { return m_typeProfilerLog.get(); }
+    TypeProfiler* typeProfiler() { return m_typeProfiler.get(); }
+    JS_EXPORT_PRIVATE void dumpTypeProfilerData();
+
+    FunctionHasExecutedCache* functionHasExecutedCache() { return &m_functionHasExecutedCache; }
+
+    ControlFlowProfiler* controlFlowProfiler() { return m_controlFlowProfiler.get(); }
+    bool enableControlFlowProfiler();
+    bool disableControlFlowProfiler();
+
+    JS_EXPORT_PRIVATE void queueMicrotask(JSGlobalObject*, PassRefPtr<Microtask>);
+    JS_EXPORT_PRIVATE void drainMicrotasks();
+    void setGlobalConstRedeclarationShouldThrow(bool globalConstRedeclarationThrow) { m_globalConstRedeclarationShouldThrow = globalConstRedeclarationThrow; }
+    ALWAYS_INLINE bool globalConstRedeclarationShouldThrow() const { return m_globalConstRedeclarationShouldThrow; }
+
+    inline bool shouldTriggerTermination(ExecState*);
+
+    void setShouldBuildPCToCodeOriginMapping() { m_shouldBuildPCToCodeOriginMapping = true; }
+    bool shouldBuilderPCToCodeOriginMapping() const { return m_shouldBuildPCToCodeOriginMapping; }
+
+    BytecodeIntrinsicRegistry& bytecodeIntrinsicRegistry() { return *m_bytecodeIntrinsicRegistry; }
+    
+    ShadowChicken& shadowChicken() { return *m_shadowChicken; }
+    
+    template<typename Func>
+    void logEvent(CodeBlock*, const char* summary, const Func& func);
+
+private:
+    friend class LLIntOffsetsExtractor;
+
+    VM(VMType, HeapType);
+    static VM*& sharedInstanceInternal();
+    void createNativeThunk();
+
+    void updateStackLimits();
+
+    bool isSafeToRecurse(void* stackLimit) const
+    {
+        ASSERT(wtfThreadData().stack().isGrowingDownward());
+        void* curr = reinterpret_cast<void*>(&curr);
+        return curr >= stackLimit;
+    }
+
+    void setException(Exception* exception)
+    {
+        m_exception = exception;
+        m_lastException = exception;
+    }
+    Exception* exception() const
+    {
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+        m_needExceptionCheck = false;
+#endif
+        return m_exception;
+    }
+    void clearException()
+    {
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+        m_needExceptionCheck = false;
+#endif
+        m_exception = nullptr;
+    }
+
+#if !ENABLE(JIT)    
+    bool ensureStackCapacityForCLoop(Register* newTopOfStack);
+    bool isSafeToRecurseSoftCLoop() const;
+#endif // !ENABLE(JIT)
+
+    JS_EXPORT_PRIVATE void throwException(ExecState*, Exception*);
+    JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
+
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    void verifyExceptionCheckNeedIsSatisfied(unsigned depth, ExceptionEventLocation&);
+#endif
+
+#if ENABLE(ASSEMBLER)
+    bool m_canUseAssembler;
+#endif
+#if ENABLE(JIT)
+    bool m_canUseJIT;
+#endif
+#if ENABLE(YARR_JIT)
+    bool m_canUseRegExpJIT;
+#endif
+#if ENABLE(GC_VALIDATION)
+    const ClassInfo* m_initializingObjectClass;
+#endif
+
+    void* m_stackPointerAtVMEntry;
+    size_t m_currentSoftReservedZoneSize;
+    void* m_stackLimit { nullptr };
+    void* m_softStackLimit { nullptr };
+#if !ENABLE(JIT)
+    void* m_cloopStackLimit { nullptr };
+#endif
+    void* m_lastStackTop;
+
+    Exception* m_exception { nullptr };
+    Exception* m_lastException { nullptr };
+#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
+    ExceptionScope* m_topExceptionScope { nullptr };
+    ExceptionEventLocation m_simulatedThrowPointLocation;
+    unsigned m_simulatedThrowPointRecursionDepth { 0 };
+    mutable bool m_needExceptionCheck { false };
+#endif
+
+    bool m_failNextNewCodeBlock { false };
+    DeletePropertyMode m_deletePropertyMode { DeletePropertyMode::Default };
+    bool m_globalConstRedeclarationShouldThrow { true };
+    bool m_shouldBuildPCToCodeOriginMapping { false };
+    std::unique_ptr<CodeCache> m_codeCache;
+    std::unique_ptr<BuiltinExecutables> m_builtinExecutables;
+    HashMap<String, RefPtr<WatchpointSet>> m_impurePropertyWatchpointSets;
+    std::unique_ptr<TypeProfiler> m_typeProfiler;
+    std::unique_ptr<TypeProfilerLog> m_typeProfilerLog;
+    unsigned m_typeProfilerEnabledCount;
+    FunctionHasExecutedCache m_functionHasExecutedCache;
+    std::unique_ptr<ControlFlowProfiler> m_controlFlowProfiler;
+    unsigned m_controlFlowProfilerEnabledCount;
+    Deque<std::unique_ptr<QueuedTask>> m_microtaskQueue;
+    MallocPtr<EncodedJSValue> m_exceptionFuzzBuffer;
+    RefPtr<Watchdog> m_watchdog;
+    std::unique_ptr<HeapProfiler> m_heapProfiler;
+#if ENABLE(SAMPLING_PROFILER)
+    RefPtr<SamplingProfiler> m_samplingProfiler;
+#endif
+    std::unique_ptr<ShadowChicken> m_shadowChicken;
+    std::unique_ptr<BytecodeIntrinsicRegistry> m_bytecodeIntrinsicRegistry;
+
+    VM* m_prev; // Required by DoublyLinkedListNode.
+    VM* m_next; // Required by DoublyLinkedListNode.
+
+    // Friends for exception checking purpose only.
+    friend class Heap;
+    friend class CatchScope;
+    friend class ExceptionScope;
+    friend class ThrowScope;
+    friend class WTF::DoublyLinkedListNode<VM>;
+};
+
+#if ENABLE(GC_VALIDATION)
+inline bool VM::isInitializingObject() const
+{
+    return !!m_initializingObjectClass;
+}
+
+inline void VM::setInitializingObjectClass(const ClassInfo* initializingObjectClass)
+{
+    m_initializingObjectClass = initializingObjectClass;
+}
+#endif
+
+inline Heap* WeakSet::heap() const
+{
+    return &m_vm->heap;
+}
+
+#if ENABLE(JIT)
+extern "C" void sanitizeStackForVMImpl(VM*);
+#endif
+
+void sanitizeStackForVM(VM*);
+void logSanitizeStack(VM*);
+
+} // namespace JSC
diff --git a/runtime/VMEntryScope.cpp b/runtime/VMEntryScope.cpp
new file mode 100644
index 0000000..e1e708c
--- /dev/null
+++ b/runtime/VMEntryScope.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "VMEntryScope.h"
+
+#include "Options.h"
+#include "SamplingProfiler.h"
+#include "VM.h"
+#include "Watchdog.h"
+#include <wtf/StackBounds.h>
+#include <wtf/SystemTracing.h>
+
+namespace JSC {
+
+VMEntryScope::VMEntryScope(VM& vm, JSGlobalObject* globalObject)
+    : m_vm(vm)
+    , m_globalObject(globalObject)
+{
+    ASSERT(wtfThreadData().stack().isGrowingDownward());
+    if (!vm.entryScope) {
+        vm.entryScope = this;
+
+        // Reset the date cache between JS invocations to force the VM to
+        // observe time zone changes.
+        vm.resetDateCache();
+
+        if (vm.watchdog())
+            vm.watchdog()->enteredVM();
+
+#if ENABLE(SAMPLING_PROFILER)
+        if (SamplingProfiler* samplingProfiler = vm.samplingProfiler())
+            samplingProfiler->noticeVMEntry();
+#endif
+        TracePoint(VMEntryScopeStart);
+    }
+
+    vm.clearLastException();
+}
+
+void VMEntryScope::addDidPopListener(std::function<void ()> listener)
+{
+    m_didPopListeners.append(listener);
+}
+
+VMEntryScope::~VMEntryScope()
+{
+    if (m_vm.entryScope != this)
+        return;
+
+    TracePoint(VMEntryScopeEnd);
+
+    if (m_vm.watchdog())
+        m_vm.watchdog()->exitedVM();
+
+    m_vm.entryScope = nullptr;
+
+    for (auto& listener : m_didPopListeners)
+        listener();
+}
+
+} // namespace JSC
diff --git a/runtime/VMEntryScope.h b/runtime/VMEntryScope.h
new file mode 100644
index 0000000..d37fad6
--- /dev/null
+++ b/runtime/VMEntryScope.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/StackBounds.h>
+#include <wtf/StackStats.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JSGlobalObject;
+class VM;
+
+class VMEntryScope {
+public:
+    JS_EXPORT_PRIVATE VMEntryScope(VM&, JSGlobalObject*);
+    JS_EXPORT_PRIVATE ~VMEntryScope();
+
+    VM& vm() const { return m_vm; }
+    JSGlobalObject* globalObject() const { return m_globalObject; }
+
+    void addDidPopListener(std::function<void ()>);
+
+private:
+    VM& m_vm;
+    JSGlobalObject* m_globalObject;
+    Vector<std::function<void ()>> m_didPopListeners;
+};
+
+} // namespace JSC
diff --git a/runtime/VMInlines.h b/runtime/VMInlines.h
new file mode 100644
index 0000000..4001e2d
--- /dev/null
+++ b/runtime/VMInlines.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "ProfilerDatabase.h"
+#include "VM.h"
+#include "Watchdog.h"
+
+namespace JSC {
+    
+bool VM::ensureStackCapacityFor(Register* newTopOfStack)
+{
+#if ENABLE(JIT)
+    ASSERT(wtfThreadData().stack().isGrowingDownward());
+    return newTopOfStack >= m_softStackLimit;
+#else
+    return ensureStackCapacityForCLoop(newTopOfStack);
+#endif
+    
+}
+
+bool VM::isSafeToRecurseSoft() const
+{
+    bool safe = isSafeToRecurse(m_softStackLimit);
+#if !ENABLE(JIT)
+    safe = safe && isSafeToRecurseSoftCLoop();
+#endif
+    return safe;
+}
+
+bool VM::shouldTriggerTermination(ExecState* exec)
+{
+    if (!watchdog())
+        return false;
+    return watchdog()->shouldTerminate(exec);
+}
+
+template<typename Func>
+void VM::logEvent(CodeBlock* codeBlock, const char* summary, const Func& func)
+{
+    if (LIKELY(!m_perBytecodeProfiler))
+        return;
+    
+    m_perBytecodeProfiler->logEvent(codeBlock, summary, func());
+}
+
+} // namespace JSC
diff --git a/runtime/VarOffset.cpp b/runtime/VarOffset.cpp
new file mode 100644
index 0000000..e0d65e5
--- /dev/null
+++ b/runtime/VarOffset.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "VarOffset.h"
+
+namespace JSC {
+
+void VarOffset::dump(PrintStream& out) const
+{
+    switch (m_kind) {
+    case VarKind::Invalid:
+        out.print("invalid");
+        return;
+    case VarKind::Scope:
+        out.print(scopeOffset());
+        return;
+    case VarKind::Stack:
+        out.print(stackOffset());
+        return;
+    case VarKind::DirectArgument:
+        out.print(capturedArgumentsOffset());
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, VarKind varKind)
+{
+    switch (varKind) {
+    case VarKind::Invalid:
+        out.print("Invalid");
+        return;
+    case VarKind::Scope:
+        out.print("Scope");
+        return;
+    case VarKind::Stack:
+        out.print("Stack");
+        return;
+    case VarKind::DirectArgument:
+        out.print("DirectArgument");
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
diff --git a/runtime/VarOffset.h b/runtime/VarOffset.h
new file mode 100644
index 0000000..68db390
--- /dev/null
+++ b/runtime/VarOffset.h
@@ -0,0 +1,243 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "DirectArgumentsOffset.h"
+#include "ScopeOffset.h"
+#include "VirtualRegister.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+enum class VarKind : uint8_t {
+    Invalid,
+    Scope,
+    Stack,
+    DirectArgument
+};
+
+class VarOffset {
+public:
+    VarOffset()
+        : m_kind(VarKind::Invalid)
+        , m_offset(UINT_MAX)
+    {
+    }
+    
+    VarOffset(WTF::HashTableDeletedValueType)
+        : m_kind(VarKind::Invalid)
+        , m_offset(0)
+    {
+    }
+    
+    explicit VarOffset(VirtualRegister stackOffset)
+    {
+        if (!stackOffset.isValid()) {
+            m_kind = VarKind::Invalid;
+            m_offset = UINT_MAX;
+        } else {
+            m_kind = VarKind::Stack;
+            m_offset = stackOffset.offset();
+        }
+    }
+    
+    explicit VarOffset(ScopeOffset scopeOffset)
+    {
+        if (!scopeOffset) {
+            m_kind = VarKind::Invalid;
+            m_offset = UINT_MAX;
+        } else {
+            m_kind = VarKind::Scope;
+            m_offset = scopeOffset.offset();
+        }
+    }
+    
+    explicit VarOffset(DirectArgumentsOffset capturedArgumentsOffset)
+    {
+        if (!capturedArgumentsOffset) {
+            m_kind = VarKind::Invalid;
+            m_offset = UINT_MAX;
+        } else {
+            m_kind = VarKind::DirectArgument;
+            m_offset = capturedArgumentsOffset.offset();
+        }
+    }
+    
+    static VarOffset assemble(VarKind kind, unsigned offset)
+    {
+        VarOffset result;
+        result.m_kind = kind;
+        result.m_offset = offset;
+        result.checkSanity();
+        return result;
+    }
+    
+    bool isValid() const
+    {
+        return m_kind != VarKind::Invalid;
+    }
+    
+    bool operator!() const
+    {
+        return !isValid();
+    }
+    
+    VarKind kind() const { return m_kind; }
+    
+    bool isStack() const
+    {
+        return m_kind == VarKind::Stack;
+    }
+    
+    bool isScope() const
+    {
+        return m_kind == VarKind::Scope;
+    }
+    
+    bool isDirectArgument() const
+    {
+        return m_kind == VarKind::DirectArgument;
+    }
+    
+    VirtualRegister stackOffsetUnchecked() const
+    {
+        if (!isStack())
+            return VirtualRegister();
+        return VirtualRegister(m_offset);
+    }
+    
+    ScopeOffset scopeOffsetUnchecked() const
+    {
+        if (!isScope())
+            return ScopeOffset();
+        return ScopeOffset(m_offset);
+    }
+    
+    DirectArgumentsOffset capturedArgumentsOffsetUnchecked() const
+    {
+        if (!isDirectArgument())
+            return DirectArgumentsOffset();
+        return DirectArgumentsOffset(m_offset);
+    }
+    
+    VirtualRegister stackOffset() const
+    {
+        ASSERT(isStack());
+        return VirtualRegister(m_offset);
+    }
+    
+    ScopeOffset scopeOffset() const
+    {
+        ASSERT(isScope());
+        return ScopeOffset(m_offset);
+    }
+    
+    DirectArgumentsOffset capturedArgumentsOffset() const
+    {
+        ASSERT(isDirectArgument());
+        return DirectArgumentsOffset(m_offset);
+    }
+    
+    unsigned rawOffset() const
+    {
+        ASSERT(isValid());
+        return m_offset;
+    }
+    
+    void checkSanity() const
+    {
+        if (ASSERT_DISABLED)
+            return;
+        
+        switch (m_kind) {
+        case VarKind::Invalid:
+            ASSERT(m_offset == UINT_MAX);
+            return;
+        case VarKind::Scope:
+            ASSERT(scopeOffset());
+            return;
+        case VarKind::Stack:
+            ASSERT(stackOffset().isValid());
+            return;
+        case VarKind::DirectArgument:
+            ASSERT(capturedArgumentsOffset());
+            return;
+        }
+        
+        ASSERT_NOT_REACHED();
+    }
+    
+    bool operator==(const VarOffset& other) const
+    {
+        return m_kind == other.m_kind
+            && m_offset == other.m_offset;
+    }
+    
+    bool operator!=(const VarOffset& other) const
+    {
+        return !(*this == other);
+    }
+    
+    unsigned hash() const
+    {
+        return WTF::IntHash<unsigned>::hash((static_cast<unsigned>(m_kind) << 20) + m_offset);
+    }
+    
+    bool isHashTableDeletedValue() const
+    {
+        return m_kind == VarKind::Invalid && !m_offset;
+    }
+    
+    void dump(PrintStream&) const;
+    
+private:
+    VarKind m_kind;
+    unsigned m_offset;
+};
+
+struct VarOffsetHash {
+    static unsigned hash(const VarOffset& key) { return key.hash(); }
+    static bool equal(const VarOffset& a, const VarOffset& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::VarKind);
+
+template<typename T> struct DefaultHash;
+template<> struct DefaultHash<JSC::VarOffset> {
+    typedef JSC::VarOffsetHash Hash;
+};
+
+template<typename T> struct HashTraits;
+template<> struct HashTraits<JSC::VarOffset> : SimpleClassHashTraits<JSC::VarOffset> {
+    static const bool emptyValueIsZero = false;
+};
+
+} // namespace WTF
diff --git a/runtime/Watchdog.cpp b/runtime/Watchdog.cpp
new file mode 100644
index 0000000..f6004e6
--- /dev/null
+++ b/runtime/Watchdog.cpp
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Watchdog.h"
+
+#include "CallFrame.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+const std::chrono::microseconds Watchdog::noTimeLimit = std::chrono::microseconds::max();
+
+static std::chrono::microseconds currentWallClockTime()
+{
+    auto steadyTimeSinceEpoch = std::chrono::steady_clock::now().time_since_epoch();
+    return std::chrono::duration_cast<std::chrono::microseconds>(steadyTimeSinceEpoch);
+}
+
+Watchdog::Watchdog()
+    : m_timerDidFire(false)
+    , m_timeLimit(noTimeLimit)
+    , m_cpuDeadline(noTimeLimit)
+    , m_wallClockDeadline(noTimeLimit)
+    , m_callback(0)
+    , m_callbackData1(0)
+    , m_callbackData2(0)
+    , m_timerQueue(WorkQueue::create("jsc.watchdog.queue", WorkQueue::Type::Serial, WorkQueue::QOS::Utility))
+{
+}
+
+void Watchdog::setTimeLimit(std::chrono::microseconds limit,
+    ShouldTerminateCallback callback, void* data1, void* data2)
+{
+    LockHolder locker(m_lock);
+
+    m_timeLimit = limit;
+    m_callback = callback;
+    m_callbackData1 = data1;
+    m_callbackData2 = data2;
+
+    if (m_hasEnteredVM && hasTimeLimit())
+        startTimer(locker, m_timeLimit);
+}
+
+JS_EXPORT_PRIVATE void Watchdog::terminateSoon()
+{
+    LockHolder locker(m_lock);
+
+    m_timeLimit = std::chrono::microseconds(0);
+    m_cpuDeadline = std::chrono::microseconds(0);
+    m_wallClockDeadline = std::chrono::microseconds(0);
+    m_timerDidFire = true;
+}
+
+bool Watchdog::shouldTerminateSlow(ExecState* exec)
+{
+    {
+        LockHolder locker(m_lock);
+
+        ASSERT(m_timerDidFire);
+        m_timerDidFire = false;
+
+        if (currentWallClockTime() < m_wallClockDeadline)
+            return false; // Just a stale timer firing. Nothing to do.
+
+        // Set m_wallClockDeadline to noTimeLimit here so that we can reject all future
+        // spurious wakes.
+        m_wallClockDeadline = noTimeLimit;
+
+        auto cpuTime = currentCPUTime();
+        if (cpuTime < m_cpuDeadline) {
+            auto remainingCPUTime = m_cpuDeadline - cpuTime;
+            startTimer(locker, remainingCPUTime);
+            return false;
+        }
+    }
+
+    // Note: we should not be holding the lock while calling the callbacks. The callbacks may
+    // call setTimeLimit() which will try to lock as well.
+
+    // If m_callback is not set, then we terminate by default.
+    // Else, we let m_callback decide if we should terminate or not.
+    bool needsTermination = !m_callback
+        || m_callback(exec, m_callbackData1, m_callbackData2);
+    if (needsTermination)
+        return true;
+
+    {
+        LockHolder locker(m_lock);
+
+        // If we get here, then the callback above did not want to terminate execution. As a
+        // result, the callback may have done one of the following:
+        //   1. cleared the time limit (i.e. watchdog is disabled),
+        //   2. set a new time limit via Watchdog::setTimeLimit(), or
+        //   3. did nothing (i.e. allow another cycle of the current time limit).
+        //
+        // In the case of 1, we don't have to do anything.
+        // In the case of 2, Watchdog::setTimeLimit() would already have started the timer.
+        // In the case of 3, we need to re-start the timer here.
+
+        ASSERT(m_hasEnteredVM);
+        bool callbackAlreadyStartedTimer = (m_cpuDeadline != noTimeLimit);
+        if (hasTimeLimit() && !callbackAlreadyStartedTimer)
+            startTimer(locker, m_timeLimit);
+    }
+    return false;
+}
+
+bool Watchdog::hasTimeLimit()
+{
+    return (m_timeLimit != noTimeLimit);
+}
+
+void Watchdog::enteredVM()
+{
+    m_hasEnteredVM = true;
+    if (hasTimeLimit()) {
+        LockHolder locker(m_lock);
+        startTimer(locker, m_timeLimit);
+    }
+}
+
+void Watchdog::exitedVM()
+{
+    ASSERT(m_hasEnteredVM);
+    LockHolder locker(m_lock);
+    stopTimer(locker);
+    m_hasEnteredVM = false;
+}
+
+void Watchdog::startTimer(LockHolder&, std::chrono::microseconds timeLimit)
+{
+    ASSERT(m_hasEnteredVM);
+    ASSERT(hasTimeLimit());
+    ASSERT(timeLimit <= m_timeLimit);
+
+    m_cpuDeadline = currentCPUTime() + timeLimit;
+    auto wallClockTime = currentWallClockTime();
+    auto wallClockDeadline = wallClockTime + timeLimit;
+
+    if ((wallClockTime < m_wallClockDeadline)
+        && (m_wallClockDeadline <= wallClockDeadline))
+        return; // Wait for the current active timer to expire before starting a new one.
+
+    // Else, the current active timer won't fire soon enough. So, start a new timer.
+    this->ref(); // m_timerHandler will deref to match later.
+    m_wallClockDeadline = wallClockDeadline;
+
+    m_timerQueue->dispatchAfter(std::chrono::nanoseconds(timeLimit), [this] {
+        {
+            LockHolder locker(m_lock);
+            m_timerDidFire = true;
+        }
+        deref();
+    });
+}
+
+void Watchdog::stopTimer(LockHolder&)
+{
+    m_cpuDeadline = noTimeLimit;
+}
+
+} // namespace JSC
diff --git a/runtime/Watchdog.h b/runtime/Watchdog.h
new file mode 100644
index 0000000..6e863a0
--- /dev/null
+++ b/runtime/Watchdog.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/Lock.h>
+#include <wtf/Ref.h>
+#include <wtf/ThreadSafeRefCounted.h>
+#include <wtf/WorkQueue.h>
+
+namespace JSC {
+
+class ExecState;
+class VM;
+
+class Watchdog : public WTF::ThreadSafeRefCounted<Watchdog> {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    class Scope;
+
+    Watchdog();
+
+    typedef bool (*ShouldTerminateCallback)(ExecState*, void* data1, void* data2);
+    void setTimeLimit(std::chrono::microseconds limit, ShouldTerminateCallback = 0, void* data1 = 0, void* data2 = 0);
+    JS_EXPORT_PRIVATE void terminateSoon();
+
+    bool shouldTerminate(ExecState* exec)
+    {
+        if (!m_timerDidFire)
+            return false;
+        return shouldTerminateSlow(exec);
+    }
+
+    bool hasTimeLimit();
+    void enteredVM();
+    void exitedVM();
+
+    void* timerDidFireAddress() { return &m_timerDidFire; }
+
+    static const std::chrono::microseconds noTimeLimit;
+
+private:
+    void startTimer(LockHolder&, std::chrono::microseconds timeLimit);
+    void stopTimer(LockHolder&);
+
+    bool shouldTerminateSlow(ExecState*);
+
+    // m_timerDidFire indicates whether the timer fired. The Watchdog
+    // still needs to check if the allowed CPU time has elapsed. If so, then
+    // the Watchdog fires and m_didFire will be set.
+    // NOTE: m_timerDidFire is only set by the platform specific timer
+    // (probably from another thread) but is only cleared in the script thread.
+    bool m_timerDidFire;
+
+    std::chrono::microseconds m_timeLimit;
+
+    std::chrono::microseconds m_cpuDeadline;
+    std::chrono::microseconds m_wallClockDeadline;
+
+    // Writes to m_timerDidFire and m_timeLimit, and Reads+Writes to m_cpuDeadline and m_wallClockDeadline
+    // must be guarded by this lock.
+    Lock m_lock;
+
+    bool m_hasEnteredVM { false };
+
+    ShouldTerminateCallback m_callback;
+    void* m_callbackData1;
+    void* m_callbackData2;
+
+    Ref<WorkQueue> m_timerQueue;
+
+    friend class LLIntOffsetsExtractor;
+};
+
+} // namespace JSC
diff --git a/runtime/WeakGCMap.h b/runtime/WeakGCMap.h
new file mode 100644
index 0000000..6f99fc0
--- /dev/null
+++ b/runtime/WeakGCMap.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2009, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Weak.h"
+#include <wtf/HashMap.h>
+
+namespace JSC {
+
+// A HashMap with Weak<JSCell> values, which automatically removes values once they're garbage collected.
+
+template<typename KeyArg, typename ValueArg, typename HashArg = typename DefaultHash<KeyArg>::Hash,
+    typename KeyTraitsArg = HashTraits<KeyArg>>
+class WeakGCMap {
+    WTF_MAKE_FAST_ALLOCATED;
+    typedef Weak<ValueArg> ValueType;
+    typedef HashMap<KeyArg, ValueType, HashArg, KeyTraitsArg> HashMapType;
+
+public:
+    typedef typename HashMapType::KeyType KeyType;
+    typedef typename HashMapType::AddResult AddResult;
+    typedef typename HashMapType::iterator iterator;
+    typedef typename HashMapType::const_iterator const_iterator;
+
+    explicit WeakGCMap(VM&);
+    ~WeakGCMap();
+
+    ValueArg* get(const KeyType& key) const
+    {
+        return m_map.get(key);
+    }
+
+    AddResult set(const KeyType& key, ValueType value)
+    {
+        return m_map.set(key, WTFMove(value));
+    }
+
+    bool remove(const KeyType& key)
+    {
+        return m_map.remove(key);
+    }
+
+    void clear()
+    {
+        m_map.clear();
+    }
+
+    bool isEmpty() const
+    {
+        const_iterator it = m_map.begin();
+        const_iterator end = m_map.end();
+        while (it != end) {
+            if (it->value)
+                return true;
+        }
+        return false;
+    }
+
+    inline iterator find(const KeyType& key);
+
+    inline const_iterator find(const KeyType& key) const;
+
+    template<typename Functor>
+    void forEach(Functor functor)
+    {
+        for (auto& pair : m_map) {
+            if (pair.value)
+                functor(pair.key, pair.value.get());
+        }
+    }
+
+    inline bool contains(const KeyType& key) const;
+
+    void pruneStaleEntries();
+
+private:
+    HashMapType m_map;
+    VM& m_vm;
+};
+
+} // namespace JSC
diff --git a/runtime/WeakGCMapInlines.h b/runtime/WeakGCMapInlines.h
new file mode 100644
index 0000000..76c1a5d
--- /dev/null
+++ b/runtime/WeakGCMapInlines.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "HeapInlines.h"
+#include "WeakGCMap.h"
+#include "WeakInlines.h"
+
+namespace JSC {
+
+template<typename KeyArg, typename ValueArg, typename HashArg, typename KeyTraitsArg>
+inline WeakGCMap<KeyArg, ValueArg, HashArg, KeyTraitsArg>::WeakGCMap(VM& vm)
+    : m_vm(vm)
+{
+    vm.heap.registerWeakGCMap(this, [this]() {
+        pruneStaleEntries();
+    });
+}
+
+template<typename KeyArg, typename ValueArg, typename HashArg, typename KeyTraitsArg>
+inline WeakGCMap<KeyArg, ValueArg, HashArg, KeyTraitsArg>::~WeakGCMap()
+{
+    m_vm.heap.unregisterWeakGCMap(this);
+}
+
+template<typename KeyArg, typename ValueArg, typename HashArg, typename KeyTraitsArg>
+inline typename WeakGCMap<KeyArg, ValueArg, HashArg, KeyTraitsArg>::iterator WeakGCMap<KeyArg, ValueArg, HashArg, KeyTraitsArg>::find(const KeyType& key)
+{
+    iterator it = m_map.find(key);
+    iterator end = m_map.end();
+    if (it != end && !it->value) // Found a zombie value.
+        return end;
+    return it;
+}
+
+template<typename KeyArg, typename ValueArg, typename HashArg, typename KeyTraitsArg>
+inline typename WeakGCMap<KeyArg, ValueArg, HashArg, KeyTraitsArg>::const_iterator WeakGCMap<KeyArg, ValueArg, HashArg, KeyTraitsArg>::find(const KeyType& key) const
+{
+    return const_cast<WeakGCMap*>(this)->find(key);
+}
+
+template<typename KeyArg, typename ValueArg, typename HashArg, typename KeyTraitsArg>
+inline bool WeakGCMap<KeyArg, ValueArg, HashArg, KeyTraitsArg>::contains(const KeyType& key) const
+{
+    return find(key) != m_map.end();
+}
+
+template<typename KeyArg, typename ValueArg, typename HashArg, typename KeyTraitsArg>
+NEVER_INLINE void WeakGCMap<KeyArg, ValueArg, HashArg, KeyTraitsArg>::pruneStaleEntries()
+{
+    m_map.removeIf([](typename HashMapType::KeyValuePairType& entry) {
+        return !entry.value;
+    });
+}
+
+} // namespace JSC
diff --git a/runtime/WeakMapConstructor.cpp b/runtime/WeakMapConstructor.cpp
new file mode 100644
index 0000000..850e618
--- /dev/null
+++ b/runtime/WeakMapConstructor.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WeakMapConstructor.h"
+
+#include "Error.h"
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSObjectInlines.h"
+#include "JSWeakMap.h"
+#include "WeakMapPrototype.h"
+
+namespace JSC {
+
+const ClassInfo WeakMapConstructor::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(WeakMapConstructor) };
+
+void WeakMapConstructor::finishCreation(VM& vm, WeakMapPrototype* prototype)
+{
+    Base::finishCreation(vm, prototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontEnum | ReadOnly);
+}
+
+static EncodedJSValue JSC_HOST_CALL callWeakMap(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "WeakMap"));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructWeakMap(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = asInternalFunction(exec->jsCallee())->globalObject();
+    Structure* weakMapStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->weakMapStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSWeakMap* weakMap = JSWeakMap::create(exec, weakMapStructure);
+    JSValue iterable = exec->argument(0);
+    if (iterable.isUndefinedOrNull())
+        return JSValue::encode(weakMap);
+
+    JSValue adderFunction = weakMap->JSObject::get(exec, vm.propertyNames->set);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    CallData adderFunctionCallData;
+    CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
+    if (adderFunctionCallType == CallType::None)
+        return JSValue::encode(throwTypeError(exec, scope));
+
+    scope.release();
+    forEachInIterable(exec, iterable, [&](VM& vm, ExecState* exec, JSValue nextItem) {
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        if (!nextItem.isObject()) {
+            throwTypeError(exec, scope);
+            return;
+        }
+
+        JSValue key = nextItem.get(exec, static_cast<unsigned>(0));
+        RETURN_IF_EXCEPTION(scope, void());
+
+        JSValue value = nextItem.get(exec, static_cast<unsigned>(1));
+        RETURN_IF_EXCEPTION(scope, void());
+
+        MarkedArgumentBuffer arguments;
+        arguments.append(key);
+        arguments.append(value);
+        scope.release();
+        call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, weakMap, arguments);
+    });
+
+    return JSValue::encode(weakMap);
+}
+
+ConstructType WeakMapConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWeakMap;
+    return ConstructType::Host;
+}
+
+CallType WeakMapConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callWeakMap;
+    return CallType::Host;
+}
+
+}
diff --git a/runtime/WeakMapConstructor.h b/runtime/WeakMapConstructor.h
new file mode 100644
index 0000000..59f2caa
--- /dev/null
+++ b/runtime/WeakMapConstructor.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class WeakMapPrototype;
+class GetterSetter;
+
+class WeakMapConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static WeakMapConstructor* create(VM& vm, Structure* structure, WeakMapPrototype* prototype, GetterSetter*)
+    {
+        WeakMapConstructor* constructor = new (NotNull, allocateCell<WeakMapConstructor>(vm.heap)) WeakMapConstructor(vm, structure);
+        constructor->finishCreation(vm, prototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    WeakMapConstructor(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, WeakMapPrototype*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/WeakMapData.cpp b/runtime/WeakMapData.cpp
new file mode 100644
index 0000000..eba831e
--- /dev/null
+++ b/runtime/WeakMapData.cpp
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WeakMapData.h"
+
+#include "ExceptionHelpers.h"
+#include "JSCInlines.h"
+
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+const ClassInfo WeakMapData::s_info = { "WeakMapData", 0, 0, CREATE_METHOD_TABLE(WeakMapData) };
+
+WeakMapData::WeakMapData(VM& vm)
+    : Base(vm, vm.weakMapDataStructure.get())
+    , m_deadKeyCleaner(this)
+{
+}
+
+void WeakMapData::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+void WeakMapData::destroy(JSCell* cell)
+{
+    static_cast<WeakMapData*>(cell)->~WeakMapData();
+}
+
+size_t WeakMapData::estimatedSize(JSCell* cell)
+{
+    WeakMapData* thisObj = jsCast<WeakMapData*>(cell);
+    return Base::estimatedSize(cell) + (thisObj->m_map.capacity() * (sizeof(JSObject*) + sizeof(WriteBarrier<Unknown>)));
+}
+
+void WeakMapData::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    Base::visitChildren(cell, visitor);
+    WeakMapData* thisObj = jsCast<WeakMapData*>(cell);
+    visitor.addUnconditionalFinalizer(&thisObj->m_deadKeyCleaner);
+    visitor.addWeakReferenceHarvester(&thisObj->m_deadKeyCleaner);
+
+    // Rough approximation of the external storage needed for the hashtable.
+    // This isn't exact, but it is close enough, and proportional to the actual
+    // external memory usage.
+    visitor.reportExtraMemoryVisited(thisObj->m_map.capacity() * (sizeof(JSObject*) + sizeof(WriteBarrier<Unknown>)));
+}
+
+void WeakMapData::set(VM& vm, JSObject* key, JSValue value)
+{
+    // Here we force the write barrier on the key.
+    auto result = m_map.add(WriteBarrier<JSObject>(vm, this, key).get(), WriteBarrier<Unknown>());
+    result.iterator->value.set(vm, this, value);
+}
+
+JSValue WeakMapData::get(JSObject* key)
+{
+    auto iter = m_map.find(key);
+    if (iter == m_map.end())
+        return jsUndefined();
+    return iter->value.get();
+}
+
+bool WeakMapData::remove(JSObject* key)
+{
+    auto iter = m_map.find(key);
+    if (iter == m_map.end())
+        return false;
+
+    m_map.remove(iter);
+    return true;
+}
+
+bool WeakMapData::contains(JSObject* key)
+{
+    return m_map.contains(key);
+}
+
+void WeakMapData::clear()
+{
+    m_map.clear();
+}
+
+void WeakMapData::DeadKeyCleaner::visitWeakReferences(SlotVisitor& visitor)
+{
+    m_liveKeyCount = 0;
+    for (auto it = m_target->m_map.begin(), end = m_target->m_map.end(); it != end; ++it) {
+        if (!Heap::isMarked(it->key))
+            continue;
+        m_liveKeyCount++;
+        visitor.append(it->value);
+    }
+    RELEASE_ASSERT(m_liveKeyCount <= m_target->m_map.size());
+}
+
+void WeakMapData::DeadKeyCleaner::finalizeUnconditionally()
+{
+    if (m_liveKeyCount > m_target->m_map.size() / 2) {
+        RELEASE_ASSERT(m_liveKeyCount <= m_target->m_map.size());
+        int deadCount = m_target->m_map.size() - m_liveKeyCount;
+        if (!deadCount)
+            return;
+        Vector<JSObject*> deadEntries;
+        deadEntries.reserveCapacity(deadCount);
+        for (auto it = m_target->m_map.begin(), end = m_target->m_map.end(); it != end; ++it) {
+            if (Heap::isMarked(it->key))
+                continue;
+            deadEntries.uncheckedAppend(it->key);
+        }
+        for (size_t i = 0; i < deadEntries.size(); i++)
+            m_target->m_map.remove(deadEntries[i]);
+    } else {
+        MapType newMap;
+        for (auto it = m_target->m_map.begin(), end = m_target->m_map.end(); it != end; ++it) {
+            if (!Heap::isMarked(it->key))
+                continue;
+            newMap.add(it->key, it->value);
+        }
+        m_target->m_map.swap(newMap);
+    }
+}
+
+}
diff --git a/runtime/WeakMapData.h b/runtime/WeakMapData.h
new file mode 100644
index 0000000..6a4d4f8
--- /dev/null
+++ b/runtime/WeakMapData.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSCell.h"
+#include "Structure.h"
+#include <wtf/HashFunctions.h>
+#include <wtf/HashMap.h>
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+class WeakMapData final : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static WeakMapData* create(VM& vm)
+    {
+        WeakMapData* weakMapData = new (NotNull, allocateCell<WeakMapData>(vm.heap)) WeakMapData(vm);
+        weakMapData->finishCreation(vm);
+        return weakMapData;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    static const bool needsDestruction = true;
+
+    void set(VM&, JSObject*, JSValue);
+    JSValue get(JSObject*);
+    bool remove(JSObject*);
+    bool contains(JSObject*);
+    void clear();
+
+    DECLARE_INFO;
+
+    typedef HashMap<JSObject*, WriteBarrier<Unknown>> MapType;
+    MapType::const_iterator begin() const { return m_map.begin(); }
+    MapType::const_iterator end() const { return m_map.end(); }
+
+    int size() const { return m_map.size(); }
+
+private:
+    WeakMapData(VM&);
+    static void destroy(JSCell*);
+    static size_t estimatedSize(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    void finishCreation(VM&);
+
+    class DeadKeyCleaner : public UnconditionalFinalizer, public WeakReferenceHarvester {
+    public:
+        DeadKeyCleaner(WeakMapData* target)
+            : m_target(target)
+        {
+        }
+    private:
+        void visitWeakReferences(SlotVisitor&) override;
+        void finalizeUnconditionally() override;
+        unsigned m_liveKeyCount;
+        WeakMapData* m_target;
+    };
+    DeadKeyCleaner m_deadKeyCleaner;
+    MapType m_map;
+};
+
+} // namespace JSC
diff --git a/runtime/WeakMapPrototype.cpp b/runtime/WeakMapPrototype.cpp
new file mode 100644
index 0000000..efb0959
--- /dev/null
+++ b/runtime/WeakMapPrototype.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WeakMapPrototype.h"
+
+#include "JSCInlines.h"
+#include "JSWeakMap.h"
+#include "WeakMapData.h"
+
+namespace JSC {
+
+const ClassInfo WeakMapPrototype::s_info = { "WeakMap", &Base::s_info, 0, CREATE_METHOD_TABLE(WeakMapPrototype) };
+
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapDelete(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapGet(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapHas(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapSet(ExecState*);
+
+void WeakMapPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, protoFuncWeakMapDelete, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->get, protoFuncWeakMapGet, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, protoFuncWeakMapHas, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->set, protoFuncWeakMapSet, DontEnum, 2);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WeakMap"), DontEnum | ReadOnly);
+}
+
+static WeakMapData* getWeakMapData(CallFrame* callFrame, JSValue value)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!value.isObject()) {
+        throwTypeError(callFrame, scope, WTF::ASCIILiteral("Called WeakMap function on non-object"));
+        return nullptr;
+    }
+
+    if (JSWeakMap* weakMap = jsDynamicCast<JSWeakMap*>(value))
+        return weakMap->weakMapData();
+
+    throwTypeError(callFrame, scope, WTF::ASCIILiteral("Called WeakMap function on a non-WeakMap object"));
+    return nullptr;
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapDelete(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    return JSValue::encode(jsBoolean(key.isObject() && map->remove(asObject(key))));
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapGet(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    if (!key.isObject())
+        return JSValue::encode(jsUndefined());
+    return JSValue::encode(map->get(asObject(key)));
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapHas(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    return JSValue::encode(jsBoolean(key.isObject() && map->contains(asObject(key))));
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapSet(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    ASSERT(!!scope.exception() == !map);
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    if (!key.isObject())
+        return JSValue::encode(throwTypeError(callFrame, scope, WTF::ASCIILiteral("Attempted to set a non-object key in a WeakMap")));
+    map->set(vm, asObject(key), callFrame->argument(1));
+    return JSValue::encode(callFrame->thisValue());
+}
+
+}
diff --git a/runtime/WeakMapPrototype.h b/runtime/WeakMapPrototype.h
new file mode 100644
index 0000000..371e3ab
--- /dev/null
+++ b/runtime/WeakMapPrototype.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class WeakMapPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static WeakMapPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        WeakMapPrototype* prototype = new (NotNull, allocateCell<WeakMapPrototype>(vm.heap)) WeakMapPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    WeakMapPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/WeakSetConstructor.cpp b/runtime/WeakSetConstructor.cpp
new file mode 100644
index 0000000..6bafe7c
--- /dev/null
+++ b/runtime/WeakSetConstructor.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2015-2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WeakSetConstructor.h"
+
+#include "Error.h"
+#include "IteratorOperations.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSObjectInlines.h"
+#include "JSWeakSet.h"
+#include "WeakSetPrototype.h"
+
+namespace JSC {
+
+const ClassInfo WeakSetConstructor::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(WeakSetConstructor) };
+
+void WeakSetConstructor::finishCreation(VM& vm, WeakSetPrototype* prototype)
+{
+    Base::finishCreation(vm, prototype->classInfo()->className);
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), DontEnum | ReadOnly);
+}
+
+static EncodedJSValue JSC_HOST_CALL callWeakSet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "WeakSet"));
+}
+
+static EncodedJSValue JSC_HOST_CALL constructWeakSet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSGlobalObject* globalObject = asInternalFunction(exec->jsCallee())->globalObject();
+    Structure* weakSetStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->weakSetStructure());
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    JSWeakSet* weakSet = JSWeakSet::create(exec, weakSetStructure);
+    JSValue iterable = exec->argument(0);
+    if (iterable.isUndefinedOrNull())
+        return JSValue::encode(weakSet);
+
+    JSValue adderFunction = weakSet->JSObject::get(exec, vm.propertyNames->add);
+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
+
+    CallData adderFunctionCallData;
+    CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
+    if (adderFunctionCallType == CallType::None)
+        return JSValue::encode(throwTypeError(exec, scope));
+
+    scope.release();
+    forEachInIterable(exec, iterable, [&](VM&, ExecState* exec, JSValue nextValue) {
+        MarkedArgumentBuffer arguments;
+        arguments.append(nextValue);
+        call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, weakSet, arguments);
+    });
+
+    return JSValue::encode(weakSet);
+}
+
+ConstructType WeakSetConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWeakSet;
+    return ConstructType::Host;
+}
+
+CallType WeakSetConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callWeakSet;
+    return CallType::Host;
+}
+
+}
diff --git a/runtime/WeakSetConstructor.h b/runtime/WeakSetConstructor.h
new file mode 100644
index 0000000..693c10b
--- /dev/null
+++ b/runtime/WeakSetConstructor.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2015 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class WeakSetPrototype;
+class GetterSetter;
+
+class WeakSetConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static WeakSetConstructor* create(VM& vm, Structure* structure, WeakSetPrototype* prototype, GetterSetter*)
+    {
+        WeakSetConstructor* constructor = new (NotNull, allocateCell<WeakSetConstructor>(vm.heap)) WeakSetConstructor(vm, structure);
+        constructor->finishCreation(vm, prototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    WeakSetConstructor(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, WeakSetPrototype*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
diff --git a/runtime/WeakSetPrototype.cpp b/runtime/WeakSetPrototype.cpp
new file mode 100644
index 0000000..05abf44
--- /dev/null
+++ b/runtime/WeakSetPrototype.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2015-2016 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WeakSetPrototype.h"
+
+#include "JSCInlines.h"
+#include "JSWeakSet.h"
+#include "WeakMapData.h"
+
+namespace JSC {
+
+const ClassInfo WeakSetPrototype::s_info = { "WeakSet", &Base::s_info, 0, CREATE_METHOD_TABLE(WeakSetPrototype) };
+
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakSetDelete(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakSetHas(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakSetAdd(ExecState*);
+
+void WeakSetPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deleteKeyword, protoFuncWeakSetDelete, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->has, protoFuncWeakSetHas, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->add, protoFuncWeakSetAdd, DontEnum, 1);
+
+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WeakSet"), DontEnum | ReadOnly);
+}
+
+static WeakMapData* getWeakMapData(CallFrame* callFrame, JSValue value)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (!value.isObject()) {
+        throwTypeError(callFrame, scope, WTF::ASCIILiteral("Called WeakSet function on non-object"));
+        return nullptr;
+    }
+
+    if (JSWeakSet* weakSet = jsDynamicCast<JSWeakSet*>(value))
+        return weakSet->weakMapData();
+
+    throwTypeError(callFrame, scope, WTF::ASCIILiteral("Called WeakSet function on a non-WeakSet object"));
+    return nullptr;
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakSetDelete(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    return JSValue::encode(jsBoolean(key.isObject() && map->remove(asObject(key))));
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakSetHas(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    return JSValue::encode(jsBoolean(key.isObject() && map->contains(asObject(key))));
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakSetAdd(CallFrame* callFrame)
+{
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    ASSERT(!!scope.exception() == !map);
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    if (!key.isObject())
+        return JSValue::encode(throwTypeError(callFrame, scope, WTF::ASCIILiteral("Attempted to add a non-object key to a WeakSet")));
+    map->set(vm, asObject(key), jsUndefined());
+    return JSValue::encode(callFrame->thisValue());
+}
+
+}
diff --git a/runtime/WeakSetPrototype.h b/runtime/WeakSetPrototype.h
new file mode 100644
index 0000000..0a9f3c1
--- /dev/null
+++ b/runtime/WeakSetPrototype.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2015 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class WeakSetPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static WeakSetPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        WeakSetPrototype* prototype = new (NotNull, allocateCell<WeakSetPrototype>(vm.heap)) WeakSetPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    WeakSetPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    void finishCreation(VM&, JSGlobalObject*);
+};
+
+} // namespace JSC
diff --git a/runtime/WriteBarrier.h b/runtime/WriteBarrier.h
new file mode 100644
index 0000000..26b3957
--- /dev/null
+++ b/runtime/WriteBarrier.h
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "GCAssertions.h"
+#include "HandleTypes.h"
+#include "Heap.h"
+#include "SamplingCounter.h"
+
+namespace JSC {
+
+namespace DFG {
+class DesiredWriteBarrier;
+}
+
+class JSCell;
+class VM;
+class JSGlobalObject;
+
+template<class T> class WriteBarrierBase;
+template<> class WriteBarrierBase<JSValue>;
+
+JS_EXPORT_PRIVATE void slowValidateCell(JSCell*);
+JS_EXPORT_PRIVATE void slowValidateCell(JSGlobalObject*);
+    
+#if ENABLE(GC_VALIDATION)
+template<class T> inline void validateCell(T cell)
+{
+    ASSERT_GC_OBJECT_INHERITS(cell, std::remove_pointer<T>::type::info());
+}
+
+template<> inline void validateCell<JSCell*>(JSCell* cell)
+{
+    slowValidateCell(cell);
+}
+
+template<> inline void validateCell<JSGlobalObject*>(JSGlobalObject* globalObject)
+{
+    slowValidateCell(globalObject);
+}
+#else
+template<class T> inline void validateCell(T)
+{
+}
+#endif
+
+// We have a separate base class with no constructors for use in Unions.
+template <typename T> class WriteBarrierBase {
+public:
+    void set(VM&, const JSCell* owner, T* value);
+    
+    // This is meant to be used like operator=, but is called copyFrom instead, in
+    // order to kindly inform the C++ compiler that its advice is not appreciated.
+    void copyFrom(const WriteBarrierBase<T>& other)
+    {
+        m_cell = other.m_cell;
+    }
+
+    void setMayBeNull(VM&, const JSCell* owner, T* value);
+
+    // Should only be used by JSCell during early initialisation
+    // when some basic types aren't yet completely instantiated
+    void setEarlyValue(VM&, const JSCell* owner, T* value);
+    
+    T* get() const
+    {
+        // Copy m_cell to a local to avoid multiple-read issues. (See <http://webkit.org/b/110854>)
+        JSCell* cell = m_cell;
+        if (cell)
+            validateCell(cell);
+        return reinterpret_cast<T*>(static_cast<void*>(cell));
+    }
+
+    T* operator*() const
+    {
+        ASSERT(m_cell);
+        validateCell<T>(static_cast<T*>(m_cell));
+        return static_cast<T*>(m_cell);
+    }
+
+    T* operator->() const
+    {
+        ASSERT(m_cell);
+        validateCell(static_cast<T*>(m_cell));
+        return static_cast<T*>(m_cell);
+    }
+
+    void clear() { m_cell = 0; }
+    
+    T** slot() { return reinterpret_cast<T**>(&m_cell); }
+    
+    explicit operator bool() const { return m_cell; }
+    
+    bool operator!() const { return !m_cell; }
+
+    void setWithoutWriteBarrier(T* value)
+    {
+#if ENABLE(WRITE_BARRIER_PROFILING)
+        WriteBarrierCounters::usesWithoutBarrierFromCpp.count();
+#endif
+        this->m_cell = reinterpret_cast<JSCell*>(value);
+    }
+
+    T* unvalidatedGet() const { return reinterpret_cast<T*>(static_cast<void*>(m_cell)); }
+
+private:
+    JSCell* m_cell;
+};
+
+template <> class WriteBarrierBase<Unknown> {
+public:
+    void set(VM&, const JSCell* owner, JSValue);
+    void setWithoutWriteBarrier(JSValue value)
+    {
+        m_value = JSValue::encode(value);
+    }
+
+    JSValue get() const
+    {
+        return JSValue::decode(m_value);
+    }
+    void clear() { m_value = JSValue::encode(JSValue()); }
+    void setUndefined() { m_value = JSValue::encode(jsUndefined()); }
+    void setStartingValue(JSValue value) { m_value = JSValue::encode(value); }
+    bool isNumber() const { return get().isNumber(); }
+    bool isObject() const { return get().isObject(); }
+    bool isNull() const { return get().isNull(); }
+    bool isGetterSetter() const { return get().isGetterSetter(); }
+    bool isCustomGetterSetter() const { return get().isCustomGetterSetter(); }
+    
+    JSValue* slot() const
+    { 
+        return bitwise_cast<JSValue*>(&m_value);
+    }
+    
+    int32_t* tagPointer() { return &bitwise_cast<EncodedValueDescriptor*>(&m_value)->asBits.tag; }
+    int32_t* payloadPointer() { return &bitwise_cast<EncodedValueDescriptor*>(&m_value)->asBits.payload; }
+    
+    explicit operator bool() const { return !!get(); }
+    bool operator!() const { return !get(); } 
+    
+private:
+    EncodedJSValue m_value;
+};
+
+template <typename T> class WriteBarrier : public WriteBarrierBase<T> {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    WriteBarrier()
+    {
+        this->setWithoutWriteBarrier(0);
+    }
+
+    WriteBarrier(VM& vm, const JSCell* owner, T* value)
+    {
+        this->set(vm, owner, value);
+    }
+
+    WriteBarrier(DFG::DesiredWriteBarrier&, T* value)
+    {
+        ASSERT(isCompilationThread());
+        this->setWithoutWriteBarrier(value);
+    }
+
+    enum MayBeNullTag { MayBeNull };
+    WriteBarrier(VM& vm, const JSCell* owner, T* value, MayBeNullTag)
+    {
+        this->setMayBeNull(vm, owner, value);
+    }
+};
+
+enum UndefinedWriteBarrierTagType { UndefinedWriteBarrierTag };
+template <> class WriteBarrier<Unknown> : public WriteBarrierBase<Unknown> {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    WriteBarrier()
+    {
+        this->setWithoutWriteBarrier(JSValue());
+    }
+    WriteBarrier(UndefinedWriteBarrierTagType)
+    {
+        this->setWithoutWriteBarrier(jsUndefined());
+    }
+
+    WriteBarrier(VM& vm, const JSCell* owner, JSValue value)
+    {
+        this->set(vm, owner, value);
+    }
+
+    WriteBarrier(DFG::DesiredWriteBarrier&, JSValue value)
+    {
+        ASSERT(isCompilationThread());
+        this->setWithoutWriteBarrier(value);
+    }
+};
+
+template <typename U, typename V> inline bool operator==(const WriteBarrierBase<U>& lhs, const WriteBarrierBase<V>& rhs)
+{
+    return lhs.get() == rhs.get();
+}
+
+} // namespace JSC
diff --git a/runtime/WriteBarrierInlines.h b/runtime/WriteBarrierInlines.h
new file mode 100644
index 0000000..4bd2dd6
--- /dev/null
+++ b/runtime/WriteBarrierInlines.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "VM.h"
+#include "WriteBarrier.h"
+
+namespace JSC {
+
+template <typename T>
+inline void WriteBarrierBase<T>::set(VM& vm, const JSCell* owner, T* value)
+{
+    ASSERT(value);
+    ASSERT(!Options::useConcurrentJIT() || !isCompilationThread());
+    validateCell(value);
+    setEarlyValue(vm, owner, value);
+}
+
+template <typename T>
+inline void WriteBarrierBase<T>::setMayBeNull(VM& vm, const JSCell* owner, T* value)
+{
+    if (value)
+        validateCell(value);
+    setEarlyValue(vm, owner, value);
+}
+
+template <typename T>
+inline void WriteBarrierBase<T>::setEarlyValue(VM& vm, const JSCell* owner, T* value)
+{
+    this->m_cell = reinterpret_cast<JSCell*>(value);
+    vm.heap.writeBarrier(owner, this->m_cell);
+}
+
+inline void WriteBarrierBase<Unknown>::set(VM& vm, const JSCell* owner, JSValue value)
+{
+    ASSERT(!Options::useConcurrentJIT() || !isCompilationThread());
+    m_value = JSValue::encode(value);
+    vm.heap.writeBarrier(owner, value);
+}
+
+} // namespace JSC 
diff --git a/shell/CMakeLists.txt b/shell/CMakeLists.txt
new file mode 100644
index 0000000..49152bc
--- /dev/null
+++ b/shell/CMakeLists.txt
@@ -0,0 +1,58 @@
+set(JSC_SOURCES
+    ../jsc.cpp
+)
+
+set(JSC_LIBRARIES
+    ${CMAKE_DL_LIBS}
+    JavaScriptCore${DEBUG_SUFFIX}
+    WTF${DEBUG_SUFFIX}
+)
+
+if (WTF_OS_MAC_OS_X)
+    list(APPEND JSC_LIBRARIES edit)
+endif ()
+
+if ("${JavaScriptCore_LIBRARY_TYPE}" MATCHES "STATIC")
+    add_definitions(-DSTATICALLY_LINKED_WITH_JavaScriptCore)
+endif ()
+
+WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
+
+WEBKIT_WRAP_SOURCELIST(${JSC_SOURCES})
+include_directories(./ ${JavaScriptCore_INCLUDE_DIRECTORIES})
+include_directories(SYSTEM ${JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES})
+add_executable(jsc ${JSC_SOURCES})
+target_link_libraries(jsc ${JSC_LIBRARIES})
+
+if (JSC_OUTPUT_NAME)
+    set_target_properties(jsc PROPERTIES OUTPUT_NAME ${JSC_OUTPUT_NAME})
+endif ()
+
+if (JSC_LINK_FLAGS)
+    ADD_TARGET_PROPERTIES(jsc LINK_FLAGS "${JSC_LINK_FLAGS}")
+endif ()
+
+if (SHOULD_INSTALL_JS_SHELL)
+    install(TARGETS jsc DESTINATION "${LIBEXEC_INSTALL_DIR}")
+endif ()
+
+if (TARGET jscLib)
+    add_dependencies(jsc jscLib)
+endif ()
+
+if (NOT WIN32)
+    set(TESTB3_SOURCES
+        ../b3/testb3.cpp
+    )
+
+    set(TESTAIR_SOURCES
+        ../b3/air/testair.cpp
+    )
+
+    add_executable(testb3 ${TESTB3_SOURCES})
+    target_link_libraries(testb3 ${JSC_LIBRARIES})
+
+    add_executable(testair ${TESTAIR_SOURCES})
+    target_link_libraries(testair ${JSC_LIBRARIES})
+
+endif ()
diff --git a/shell/DLLLauncherMain.cpp b/shell/DLLLauncherMain.cpp
new file mode 100644
index 0000000..b883a32
--- /dev/null
+++ b/shell/DLLLauncherMain.cpp
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This file contains code for a launcher executable for WebKit apps. When compiled into foo.exe, it
+// will set PATH so that Apple Application Support DLLs can be found, then will load foo.dll and
+// call its dllLauncherEntryPoint function, which should be declared like so:
+//     extern "C" __declspec(dllexport) int WINAPI dllLauncherEntryPoint(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPTSTR lpstCmdLine, int nCmdShow);
+// If USE_CONSOLE_ENTRY_POINT is defined, this function will be called instead:
+//     extern "C" __declspec(dllexport) int WINAPI dllLauncherEntryPoint(int argc, const char* argv[]);
+
+#include <shlwapi.h>
+#include <string>
+#include <vector>
+#include <windows.h>
+
+using namespace std;
+
+#if defined _M_IX86
+#define PROCESSORARCHITECTURE "x86"
+#elif defined _M_IA64
+#define PROCESSORARCHITECTURE "ia64"
+#elif defined _M_X64
+#define PROCESSORARCHITECTURE "amd64"
+#else
+#define PROCESSORARCHITECTURE "*"
+#endif
+
+#pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='" PROCESSORARCHITECTURE "' publicKeyToken='6595b64144ccf1df' language='*'\"")
+#if defined(_MSC_VER) && (_MSC_VER >= 1600) && !defined(WIN_CAIRO)
+#pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.VC80.CRT' version='8.0.50727.6195' processorArchitecture='" PROCESSORARCHITECTURE "' publicKeyToken='1fc8b3b9a1e18e3b' language='*'\"")
+#endif
+
+static void enableTerminationOnHeapCorruption()
+{
+    HEAP_INFORMATION_CLASS heapEnableTerminationOnCorruption = static_cast<HEAP_INFORMATION_CLASS>(1);
+    HeapSetInformation(0, heapEnableTerminationOnCorruption, 0, 0);
+}
+
+static wstring getStringValue(HKEY key, const wstring& valueName)
+{
+    DWORD type = 0;
+    DWORD bufferSize = 0;
+    if (::RegQueryValueExW(key, valueName.c_str(), 0, &type, 0, &bufferSize) != ERROR_SUCCESS || type != REG_SZ)
+        return wstring();
+
+    vector<wchar_t> buffer(bufferSize / sizeof(wchar_t));
+    if (::RegQueryValueExW(key, valueName.c_str(), 0, &type, reinterpret_cast<LPBYTE>(&buffer[0]), &bufferSize) != ERROR_SUCCESS)
+        return wstring();
+
+    return &buffer[0];
+}
+
+static wstring applePathFromRegistry(const wstring& key, const wstring& value)
+{
+    HKEY applePathKey = 0;
+    if (::RegOpenKeyExW(HKEY_LOCAL_MACHINE, key.c_str(), 0, KEY_READ, &applePathKey) != ERROR_SUCCESS)
+        return wstring();
+    wstring path = getStringValue(applePathKey, value);
+    ::RegCloseKey(applePathKey);
+    return path;
+}
+
+static wstring appleApplicationSupportDirectory()
+{
+    return applePathFromRegistry(L"SOFTWARE\\Apple Inc.\\Apple Application Support", L"InstallDir");
+}
+
+static wstring copyEnvironmentVariable(const wstring& variable)
+{
+    DWORD length = ::GetEnvironmentVariableW(variable.c_str(), 0, 0);
+    if (!length)
+        return wstring();
+    vector<wchar_t> buffer(length);
+    if (!GetEnvironmentVariable(variable.c_str(), &buffer[0], buffer.size()) || !buffer[0])
+        return wstring();
+    return &buffer[0];
+}
+
+static bool prependPath(const wstring& directoryToPrepend)
+{
+    wstring pathVariable = L"PATH";
+    wstring oldPath = copyEnvironmentVariable(pathVariable);
+    wstring newPath = directoryToPrepend + L';' + oldPath;
+    return ::SetEnvironmentVariableW(pathVariable.c_str(), newPath.c_str());
+}
+
+static int fatalError(const wstring& programName, const wstring& message)
+{
+    wstring caption = programName + L" can't open.";
+    ::MessageBoxW(0, message.c_str(), caption.c_str(), MB_ICONERROR);
+    return 1;
+}
+
+static bool directoryExists(const wstring& path)
+{
+    DWORD attrib = ::GetFileAttributes(path.c_str());
+
+    return ((attrib != INVALID_FILE_ATTRIBUTES) && (attrib & FILE_ATTRIBUTE_DIRECTORY));
+}
+
+static bool modifyPath(const wstring& programName)
+{
+#ifdef WIN_CAIRO
+
+#if defined(_M_X64)
+    wstring pathWinCairo = copyEnvironmentVariable(L"WEBKIT_LIBRARIES") + L"\\bin64";
+#else
+    wstring pathWinCairo = copyEnvironmentVariable(L"WEBKIT_LIBRARIES") + L"\\bin32";
+#endif
+    prependPath(pathWinCairo);
+    return true;
+
+#else
+
+    const wstring& pathPrefix = appleApplicationSupportDirectory();
+
+    if (!directoryExists(pathPrefix)) {
+        fatalError(programName, L"Failed to determine path to AAS directory.");
+        return false;
+    }
+
+    if (prependPath(pathPrefix))
+        return true;
+
+    fatalError(programName, L"Failed to modify PATH environment variable.");
+    return false;
+#endif
+}
+
+static wstring getLastErrorString(HRESULT hr)
+{
+    static const DWORD kFlags = FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS;
+    static const size_t bufSize = 4096;
+
+    wchar_t errorMessage[bufSize];
+    DWORD len = ::FormatMessageW(kFlags, 0, hr, 0, errorMessage, bufSize, 0);
+    if (len >= bufSize)
+        len = bufSize - 1;
+
+    errorMessage[len] = 0;
+
+    return errorMessage;
+}
+
+#if USE_CONSOLE_ENTRY_POINT
+int main(int argc, const char* argv[])
+#else
+int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpstrCmdLine, int nCmdShow)
+#endif
+{
+    enableTerminationOnHeapCorruption();
+
+    // Get the path of our executable.
+    wchar_t exePath[MAX_PATH];
+    if (!::GetModuleFileNameW(0, exePath, _countof(exePath)))
+        return fatalError(L"Unknown Program", L"Failed to determine name of executable: " + getLastErrorString(::GetLastError()));
+
+    ::PathRemoveExtensionW(exePath);
+
+    wstring programName = ::PathFindFileNameW(exePath);
+
+    if (!modifyPath(programName))
+        return 1;
+
+    // Load our corresponding DLL.
+    wstring dllName = programName + L"Lib.dll";
+    if (!::PathRemoveFileSpecW(exePath))
+        return fatalError(programName, L"::PathRemoveFileSpecW failed: " + getLastErrorString(::GetLastError()));
+    if (!::PathAppendW(exePath, dllName.c_str()))
+        return fatalError(programName, L"::PathAppendW failed: " + getLastErrorString(::GetLastError()));
+    HMODULE module = ::LoadLibraryW(exePath);
+    if (!module)
+        return fatalError(programName, L"::LoadLibraryW failed: \npath=" + wstring(exePath) + L"\n" + getLastErrorString(::GetLastError()));
+
+#if USE_CONSOLE_ENTRY_POINT
+    typedef int (WINAPI*EntryPoint)(int, const char*[]);
+#if defined _M_AMD64 || defined _WIN64
+    const char* entryPointName = "dllLauncherEntryPoint";
+#else
+    const char* entryPointName = "_dllLauncherEntryPoint@8";
+#endif
+#else
+    typedef int (WINAPI*EntryPoint)(HINSTANCE, HINSTANCE, LPWSTR, int);
+#if defined _M_AMD64 || defined _WIN64
+    const char* entryPointName = "dllLauncherEntryPoint";
+#else
+    const char* entryPointName = "_dllLauncherEntryPoint@16";
+#endif
+#endif
+
+    EntryPoint entryPoint = reinterpret_cast<EntryPoint>(::GetProcAddress(module, entryPointName));
+    if (!entryPoint)
+        return fatalError(programName, L"Failed to find dllLauncherEntryPoint function: " + getLastErrorString(::GetLastError()));
+
+#if USE_CONSOLE_ENTRY_POINT
+    return entryPoint(argc, argv);
+#else
+    return entryPoint(hInstance, hPrevInstance, lpstrCmdLine, nCmdShow);
+#endif
+}
diff --git a/shell/PlatformEfl.cmake b/shell/PlatformEfl.cmake
new file mode 100644
index 0000000..f20fb21
--- /dev/null
+++ b/shell/PlatformEfl.cmake
@@ -0,0 +1,4 @@
+list(APPEND JSC_LIBRARIES
+    ${ECORE_LIBRARIES}
+    ${GLIB_LIBRARIES}
+)
diff --git a/shell/PlatformGTK.cmake b/shell/PlatformGTK.cmake
new file mode 100644
index 0000000..623183a
--- /dev/null
+++ b/shell/PlatformGTK.cmake
@@ -0,0 +1,3 @@
+list(APPEND JSC_LIBRARIES
+    ${GLIB_LIBRARIES}
+)
diff --git a/shell/PlatformWin.cmake b/shell/PlatformWin.cmake
new file mode 100644
index 0000000..c5d445d
--- /dev/null
+++ b/shell/PlatformWin.cmake
@@ -0,0 +1,56 @@
+include_directories(./ ${JavaScriptCore_INCLUDE_DIRECTORIES})
+include_directories(SYSTEM ${JavaScriptCore_SYSTEM_INCLUDE_DIRECTORIES})
+add_library(jscLib SHARED ${JSC_SOURCES})
+
+list(APPEND JSC_LIBRARIES
+    Winmm
+)
+
+target_link_libraries(jscLib ${JSC_LIBRARIES})
+
+if (${WTF_PLATFORM_WIN_CAIRO})
+    add_definitions(-DWIN_CAIRO)
+endif ()
+
+set(JSC_SOURCES ${JAVASCRIPTCORE_DIR}/shell/DLLLauncherMain.cpp)
+set(JSC_LIBRARIES shlwapi)
+add_definitions(-DUSE_CONSOLE_ENTRY_POINT)
+
+set(JSC_OUTPUT_NAME "jsc${DEBUG_SUFFIX}")
+
+add_library(testRegExpLib SHARED ../testRegExp.cpp)
+add_executable(testRegExp ${JSC_SOURCES})
+set_target_properties(testRegExp PROPERTIES OUTPUT_NAME "testRegExp${DEBUG_SUFFIX}")
+target_link_libraries(testRegExp shlwapi)
+add_dependencies(testRegExp testRegExpLib)
+target_link_libraries(testRegExpLib JavaScriptCore)
+
+add_library(testapiLib SHARED
+    ../API/tests/CompareAndSwapTest.cpp
+    ../API/tests/CustomGlobalObjectClassTest.c
+    ../API/tests/ExecutionTimeLimitTest.cpp
+    ../API/tests/FunctionOverridesTest.cpp
+    ../API/tests/GlobalContextWithFinalizerTest.cpp
+    ../API/tests/JSONParseTest.cpp
+    ../API/tests/PingPongStackOverflowTest.cpp
+    ../API/tests/testapi.c
+    ../API/tests/TypedArrayCTest.cpp
+)
+set_source_files_properties(../API/tests/CustomGlobalObjectClassTest.c PROPERTIES COMPILE_FLAGS "/TP /MT")
+set_source_files_properties(../API/tests/testapi.c PROPERTIES COMPILE_FLAGS "/TP /MT")
+add_executable(testapi ${JSC_SOURCES})
+set_target_properties(testapi PROPERTIES OUTPUT_NAME "testapi${DEBUG_SUFFIX}")
+target_link_libraries(testapi shlwapi)
+add_dependencies(testapi testapiLib)
+target_link_libraries(testapiLib JavaScriptCore)
+
+file(COPY
+    "${JAVASCRIPTCORE_DIR}/API/tests/testapi.js"
+    DESTINATION
+    ${CMAKE_RUNTIME_OUTPUT_DIRECTORY}
+)
+file(COPY
+    "${JAVASCRIPTCORE_DIR}/API/tests/testapi-function-overrides.js"
+    DESTINATION
+    ${CMAKE_RUNTIME_OUTPUT_DIRECTORY}
+)
diff --git a/testRegExp.cpp b/testRegExp.cpp
new file mode 100644
index 0000000..6d6f280
--- /dev/null
+++ b/testRegExp.cpp
@@ -0,0 +1,536 @@
+/*
+ *  Copyright (C) 2011, 2015 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "RegExp.h"
+
+#include <wtf/CurrentTime.h>
+#include "InitializeThreading.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <wtf/text/StringBuilder.h>
+
+#if !OS(WINDOWS)
+#include <unistd.h>
+#endif
+
+#if HAVE(SYS_TIME_H)
+#include <sys/time.h>
+#endif
+
+#if COMPILER(MSVC)
+#include <crtdbg.h>
+#include <mmsystem.h>
+#include <windows.h>
+#endif
+
+const int MaxLineLength = 100 * 1024;
+
+using namespace JSC;
+using namespace WTF;
+
+struct CommandLine {
+    CommandLine()
+        : interactive(false)
+        , verbose(false)
+    {
+    }
+
+    bool interactive;
+    bool verbose;
+    Vector<String> arguments;
+    Vector<String> files;
+};
+
+class StopWatch {
+public:
+    void start();
+    void stop();
+    long getElapsedMS(); // call stop() first
+
+private:
+    double m_startTime;
+    double m_stopTime;
+};
+
+void StopWatch::start()
+{
+    m_startTime = monotonicallyIncreasingTime();
+}
+
+void StopWatch::stop()
+{
+    m_stopTime = monotonicallyIncreasingTime();
+}
+
+long StopWatch::getElapsedMS()
+{
+    return static_cast<long>((m_stopTime - m_startTime) * 1000);
+}
+
+struct RegExpTest {
+    RegExpTest()
+        : offset(0)
+        , result(0)
+    {
+    }
+
+    String subject;
+    int offset;
+    int result;
+    Vector<int, 32> expectVector;
+};
+
+class GlobalObject : public JSGlobalObject {
+private:
+    GlobalObject(VM&, Structure*, const Vector<String>& arguments);
+
+public:
+    typedef JSGlobalObject Base;
+
+    static GlobalObject* create(VM& vm, Structure* structure, const Vector<String>& arguments)
+    {
+        GlobalObject* globalObject = new (NotNull, allocateCell<GlobalObject>(vm.heap)) GlobalObject(vm, structure, arguments);
+        vm.heap.addFinalizer(globalObject, destroy);
+        return globalObject;
+    }
+
+    DECLARE_INFO;
+
+    static const bool needsDestructor = false;
+
+    static Structure* createStructure(VM& vm, JSValue prototype)
+    {
+        return Structure::create(vm, 0, prototype, TypeInfo(GlobalObjectType, StructureFlags), info());
+    }
+
+protected:
+    void finishCreation(VM& vm, const Vector<String>& arguments)
+    {
+        Base::finishCreation(vm);
+        UNUSED_PARAM(arguments);
+    }
+};
+
+const ClassInfo GlobalObject::s_info = { "global", &JSGlobalObject::s_info, nullptr, CREATE_METHOD_TABLE(GlobalObject) };
+
+GlobalObject::GlobalObject(VM& vm, Structure* structure, const Vector<String>& arguments)
+    : JSGlobalObject(vm, structure)
+{
+    finishCreation(vm, arguments);
+}
+
+// Use SEH for Release builds only to get rid of the crash report dialog
+// (luckily the same tests fail in Release and Debug builds so far). Need to
+// be in a separate main function because the realMain function requires object
+// unwinding.
+
+#if COMPILER(MSVC) && !defined(_DEBUG)
+#define TRY       __try {
+#define EXCEPT(x) } __except (EXCEPTION_EXECUTE_HANDLER) { x; }
+#else
+#define TRY
+#define EXCEPT(x)
+#endif
+
+int realMain(int argc, char** argv);
+
+int main(int argc, char** argv)
+{
+#if OS(WINDOWS)
+    // Cygwin calls ::SetErrorMode(SEM_FAILCRITICALERRORS), which we will inherit. This is bad for
+    // testing/debugging, as it causes the post-mortem debugger not to be invoked. We reset the
+    // error mode here to work around Cygwin's behavior. See <http://webkit.org/b/55222>.
+    ::SetErrorMode(0);
+
+#if defined(_DEBUG)
+    _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
+    _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
+    _CrtSetReportFile(_CRT_ERROR, _CRTDBG_FILE_STDERR);
+    _CrtSetReportMode(_CRT_ERROR, _CRTDBG_MODE_FILE);
+    _CrtSetReportFile(_CRT_ASSERT, _CRTDBG_FILE_STDERR);
+    _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
+#endif
+
+    timeBeginPeriod(1);
+#endif
+
+    // Initialize JSC before getting VM.
+    JSC::initializeThreading();
+
+    // We can't use destructors in the following code because it uses Windows
+    // Structured Exception Handling
+    int res = 0;
+    TRY
+        res = realMain(argc, argv);
+    EXCEPT(res = 3)
+    return res;
+}
+
+static bool testOneRegExp(VM& vm, RegExp* regexp, RegExpTest* regExpTest, bool verbose, unsigned int lineNumber)
+{
+    bool result = true;
+    Vector<int> outVector;
+    outVector.resize(regExpTest->expectVector.size());
+    int matchResult = regexp->match(vm, regExpTest->subject, regExpTest->offset, outVector);
+
+    if (matchResult != regExpTest->result) {
+        result = false;
+        if (verbose)
+            printf("Line %d: results mismatch - expected %d got %d\n", lineNumber, regExpTest->result, matchResult);
+    } else if (matchResult != -1) {
+        if (outVector.size() != regExpTest->expectVector.size()) {
+            result = false;
+            if (verbose) {
+#if OS(WINDOWS)
+                printf("Line %d: output vector size mismatch - expected %Iu got %Iu\n", lineNumber, regExpTest->expectVector.size(), outVector.size());
+#else
+                printf("Line %d: output vector size mismatch - expected %zu got %zu\n", lineNumber, regExpTest->expectVector.size(), outVector.size());
+#endif
+            }
+        } else if (outVector.size() % 2) {
+            result = false;
+            if (verbose) {
+#if OS(WINDOWS)
+                printf("Line %d: output vector size is odd (%Iu), should be even\n", lineNumber, outVector.size());
+#else
+                printf("Line %d: output vector size is odd (%zu), should be even\n", lineNumber, outVector.size());
+#endif
+            }
+        } else {
+            // Check in pairs since the first value of the pair could be -1 in which case the second doesn't matter.
+            size_t pairCount = outVector.size() / 2;
+            for (size_t i = 0; i < pairCount; ++i) {
+                size_t startIndex = i*2;
+                if (outVector[startIndex] != regExpTest->expectVector[startIndex]) {
+                    result = false;
+                    if (verbose) {
+#if OS(WINDOWS)
+                        printf("Line %d: output vector mismatch at index %Iu - expected %d got %d\n", lineNumber, startIndex, regExpTest->expectVector[startIndex], outVector[startIndex]);
+#else
+                        printf("Line %d: output vector mismatch at index %zu - expected %d got %d\n", lineNumber, startIndex, regExpTest->expectVector[startIndex], outVector[startIndex]);
+#endif
+                    }
+                }
+                if ((i > 0) && (regExpTest->expectVector[startIndex] != -1) && (outVector[startIndex+1] != regExpTest->expectVector[startIndex+1])) {
+                    result = false;
+                    if (verbose) {
+#if OS(WINDOWS)
+                        printf("Line %d: output vector mismatch at index %Iu - expected %d got %d\n", lineNumber, startIndex + 1, regExpTest->expectVector[startIndex + 1], outVector[startIndex + 1]);
+#else
+                        printf("Line %d: output vector mismatch at index %zu - expected %d got %d\n", lineNumber, startIndex + 1, regExpTest->expectVector[startIndex + 1], outVector[startIndex + 1]);
+#endif
+                    }
+                }
+            }
+        }
+    }
+
+    return result;
+}
+
+static int scanString(char* buffer, int bufferLength, StringBuilder& builder, char termChar)
+{
+    bool escape = false;
+    
+    for (int i = 0; i < bufferLength; ++i) {
+        UChar c = buffer[i];
+        
+        if (escape) {
+            switch (c) {
+            case '0':
+                c = '\0';
+                break;
+            case 'a':
+                c = '\a';
+                break;
+            case 'b':
+                c = '\b';
+                break;
+            case 'f':
+                c = '\f';
+                break;
+            case 'n':
+                c = '\n';
+                break;
+            case 'r':
+                c = '\r';
+                break;
+            case 't':
+                c = '\t';
+                break;
+            case 'v':
+                c = '\v';
+                break;
+            case '\\':
+                c = '\\';
+                break;
+            case '?':
+                c = '\?';
+                break;
+            case 'u':
+                if ((i + 4) >= bufferLength)
+                    return -1;
+                unsigned int charValue;
+                if (sscanf(buffer+i+1, "%04x", &charValue) != 1)
+                    return -1;
+                c = static_cast<UChar>(charValue);
+                i += 4;
+                break;
+            }
+            
+            builder.append(c);
+            escape = false;
+        } else {
+            if (c == termChar)
+                return i;
+
+            if (c == '\\')
+                escape = true;
+            else
+                builder.append(c);
+        }
+    }
+
+    return -1;
+}
+
+static RegExp* parseRegExpLine(VM& vm, char* line, int lineLength)
+{
+    StringBuilder pattern;
+    
+    if (line[0] != '/')
+        return 0;
+
+    int i = scanString(line + 1, lineLength - 1, pattern, '/') + 1;
+
+    if ((i >= lineLength) || (line[i] != '/'))
+        return 0;
+
+    ++i;
+
+    RegExp* r = RegExp::create(vm, pattern.toString(), regExpFlags(line + i));
+    if (r->isValid())
+        return r;
+    return nullptr;
+}
+
+static RegExpTest* parseTestLine(char* line, int lineLength)
+{
+    StringBuilder subjectString;
+    
+    if ((line[0] != ' ') || (line[1] != '"'))
+        return 0;
+
+    int i = scanString(line + 2, lineLength - 2, subjectString, '"') + 2;
+
+    if ((i >= (lineLength - 2)) || (line[i] != '"') || (line[i+1] != ',') || (line[i+2] != ' '))
+        return 0;
+
+    i += 3;
+    
+    int offset;
+    
+    if (sscanf(line + i, "%d, ", &offset) != 1)
+        return 0;
+
+    while (line[i] && line[i] != ' ')
+        ++i;
+
+    ++i;
+    
+    int matchResult;
+    
+    if (sscanf(line + i, "%d, ", &matchResult) != 1)
+        return 0;
+    
+    while (line[i] && line[i] != ' ')
+        ++i;
+    
+    ++i;
+    
+    if (line[i++] != '(')
+        return 0;
+
+    int start, end;
+    
+    RegExpTest* result = new RegExpTest();
+    
+    result->subject = subjectString.toString();
+    result->offset = offset;
+    result->result = matchResult;
+
+    while (line[i] && line[i] != ')') {
+        if (sscanf(line + i, "%d, %d", &start, &end) != 2) {
+            delete result;
+            return 0;
+        }
+
+        result->expectVector.append(start);
+        result->expectVector.append(end);
+
+        while (line[i] && (line[i] != ',') && (line[i] != ')'))
+            i++;
+        i++;
+        while (line[i] && (line[i] != ',') && (line[i] != ')'))
+            i++;
+
+        if (line[i] == ')')
+            break;
+        if (!line[i] || (line[i] != ',')) {
+            delete result;
+            return 0;
+        }
+        i++;
+    }
+
+    return result;
+}
+
+static bool runFromFiles(GlobalObject* globalObject, const Vector<String>& files, bool verbose)
+{
+    String script;
+    String fileName;
+    Vector<char> scriptBuffer;
+    unsigned tests = 0;
+    unsigned failures = 0;
+    char* lineBuffer = new char[MaxLineLength + 1];
+
+    VM& vm = globalObject->vm();
+
+    bool success = true;
+    for (size_t i = 0; i < files.size(); i++) {
+        FILE* testCasesFile = fopen(files[i].utf8().data(), "rb");
+
+        if (!testCasesFile) {
+            printf("Unable to open test data file \"%s\"\n", files[i].utf8().data());
+            continue;
+        }
+            
+        RegExp* regexp = 0;
+        size_t lineLength = 0;
+        char* linePtr = 0;
+        unsigned int lineNumber = 0;
+
+        while ((linePtr = fgets(&lineBuffer[0], MaxLineLength, testCasesFile))) {
+            lineLength = strlen(linePtr);
+            if (linePtr[lineLength - 1] == '\n') {
+                linePtr[lineLength - 1] = '\0';
+                --lineLength;
+            }
+            ++lineNumber;
+
+            if (linePtr[0] == '#')
+                continue;
+
+            if (linePtr[0] == '/') {
+                regexp = parseRegExpLine(vm, linePtr, lineLength);
+            } else if (linePtr[0] == ' ') {
+                RegExpTest* regExpTest = parseTestLine(linePtr, lineLength);
+                
+                if (regexp && regExpTest) {
+                    ++tests;
+                    if (!testOneRegExp(vm, regexp, regExpTest, verbose, lineNumber)) {
+                        failures++;
+                        printf("Failure on line %u\n", lineNumber);
+                    }
+                }
+                
+                if (regExpTest)
+                    delete regExpTest;
+            } else if (linePtr[0] == '-') {
+                tests++;
+                regexp = 0; // Reset the live regexp to avoid confusing other subsequent tests
+                bool successfullyParsed = parseRegExpLine(vm, linePtr + 1, lineLength - 1);
+                if (successfullyParsed) {
+                    failures++;
+                    fprintf(stderr, "Failure on line %u. '%s' is not a valid regexp\n", lineNumber, linePtr + 1);
+                }
+            }
+        }
+        
+        fclose(testCasesFile);
+    }
+
+    if (failures)
+        printf("%u tests run, %u failures\n", tests, failures);
+    else
+        printf("%u tests passed\n", tests);
+
+    delete[] lineBuffer;
+
+#if ENABLE(REGEXP_TRACING)
+    vm.dumpRegExpTrace();
+#endif
+    return success;
+}
+
+#define RUNNING_FROM_XCODE 0
+
+static NO_RETURN void printUsageStatement(bool help = false)
+{
+    fprintf(stderr, "Usage: regexp_test [options] file\n");
+    fprintf(stderr, "  -h|--help  Prints this help message\n");
+    fprintf(stderr, "  -v|--verbose  Verbose output\n");
+
+    exit(help ? EXIT_SUCCESS : EXIT_FAILURE);
+}
+
+static void parseArguments(int argc, char** argv, CommandLine& options)
+{
+    int i = 1;
+    for (; i < argc; ++i) {
+        const char* arg = argv[i];
+        if (!strcmp(arg, "-h") || !strcmp(arg, "--help"))
+            printUsageStatement(true);
+        if (!strcmp(arg, "-v") || !strcmp(arg, "--verbose"))
+            options.verbose = true;
+        else
+            options.files.append(argv[i]);
+    }
+
+    for (; i < argc; ++i)
+        options.arguments.append(argv[i]);
+}
+
+int realMain(int argc, char** argv)
+{
+    VM* vm = &VM::create(LargeHeap).leakRef();
+    JSLockHolder locker(vm);
+
+    CommandLine options;
+    parseArguments(argc, argv, options);
+
+    GlobalObject* globalObject = GlobalObject::create(*vm, GlobalObject::createStructure(*vm, jsNull()), options.arguments);
+    bool success = runFromFiles(globalObject, options.files, options.verbose);
+
+    return success ? 0 : 3;
+}
+
+#if OS(WINDOWS)
+extern "C" __declspec(dllexport) int WINAPI dllLauncherEntryPoint(int argc, const char* argv[])
+{
+    return main(argc, const_cast<char**>(argv));
+}
+#endif
diff --git a/tested-symbols.symlst b/tested-symbols.symlst
new file mode 100644
index 0000000..16319d1
--- /dev/null
+++ b/tested-symbols.symlst
@@ -0,0 +1,87 @@
+__ZN3JSC15globalFuncIsNaNEPNS_9ExecStateE
+__ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSCL16mathProtoFuncCosEPNS_9ExecStateE
+__ZN3JSCL16mathProtoFuncSinEPNS_9ExecStateE
+__ZN3JSCL16mathProtoFuncTanEPNS_9ExecStateE
+__ZN3JSCL17mathProtoFuncACosEPNS_9ExecStateE
+__ZN3JSCL17mathProtoFuncASinEPNS_9ExecStateE
+__ZN3JSCL17mathProtoFuncATanEPNS_9ExecStateE
+__ZN3JSCL17mathProtoFuncCbrtEPNS_9ExecStateE
+__ZN3JSCL17mathProtoFuncCoshEPNS_9ExecStateE
+__ZN3JSCL17mathProtoFuncLog2EPNS_9ExecStateE
+__ZN3JSCL17mathProtoFuncSinhEPNS_9ExecStateE
+__ZN3JSCL17mathProtoFuncTanhEPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncACoshEPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncASinhEPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncATan2EPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncATanhEPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncExpm1EPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncExpm1EPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncHypotEPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncLog10EPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncLog1pEPNS_9ExecStateE
+__ZN3JSCL18mathProtoFuncTruncEPNS_9ExecStateE
+__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateE
+__ZN3JSCL19dateProtoFuncGetDayEPNS_9ExecStateE
+__ZN3JSCL19mathProtoFuncRandomEPNS_9ExecStateE
+__ZN3JSCL20dateProtoFuncGetDateEPNS_9ExecStateE
+__ZN3JSCL20dateProtoFuncGetTimeEPNS_9ExecStateE
+__ZN3JSCL20dateProtoFuncGetYearEPNS_9ExecStateE
+__ZN3JSCL20dateProtoFuncSetDateEPNS_9ExecStateE
+__ZN3JSCL20stringProtoFuncSliceEPNS_9ExecStateE
+__ZN3JSCL21dateProtoFuncGetHoursEPNS_9ExecStateE
+__ZN3JSCL21dateProtoFuncGetMonthEPNS_9ExecStateE
+__ZN3JSCL21dateProtoFuncToStringEPNS_9ExecStateE
+__ZN3JSCL22JSONProtoFuncStringifyEPNS_9ExecStateE
+__ZN3JSCL22dateProtoFuncGetUTCDayEPNS_9ExecStateE
+__ZN3JSCL23dateProtoFuncGetMinutesEPNS_9ExecStateE
+__ZN3JSCL23dateProtoFuncGetSecondsEPNS_9ExecStateE
+__ZN3JSCL23dateProtoFuncGetUTCDateEPNS_9ExecStateE
+__ZN3JSCL23objectConstructorFreezeEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncGetFullYearEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncGetUTCHoursEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncGetUTCMonthEPNS_9ExecStateE
+__ZN3JSCL24dateProtoFuncToUTCStringEPNS_9ExecStateE
+__ZN3JSCL25dataViewProtoFuncGetUint8EPNS_9ExecStateE
+__ZN3JSCL25dataViewProtoFuncSetUint8EPNS_9ExecStateE
+__ZN3JSCL25dateProtoFuncToDateStringEPNS_9ExecStateE
+__ZN3JSCL25dateProtoFuncToTimeStringEPNS_9ExecStateE
+__ZN3JSCL25objectConstructorIsFrozenEPNS_9ExecStateE
+__ZN3JSCL26dateProtoFuncGetUTCMinutesEPNS_9ExecStateE
+__ZN3JSCL26dateProtoFuncGetUTCSecondsEPNS_9ExecStateE
+__ZN3JSCL26stringProtoFuncToLowerCaseEPNS_9ExecStateE
+__ZN3JSCL26stringProtoFuncToUpperCaseEPNS_9ExecStateE
+__ZN3JSCL27dateProtoFuncGetUTCFullYearEPNS_9ExecStateE
+__ZN3JSCL28dateProtoFuncGetMilliSecondsEPNS_9ExecStateE
+__ZN3JSCL30dateProtoFuncGetTimezoneOffsetEPNS_9ExecStateE
+__ZN3JSCL31dateProtoFuncGetUTCMillisecondsEPNS_9ExecStateE
+__ZN3JSCL31dateProtoFuncToLocaleDateStringEPNS_9ExecStateE
+__ZN3JSCL34objectConstructorPreventExtensionsEPNS_9ExecStateE
+__ZN3JSCL36objectConstructorGetOwnPropertyNamesEPNS_9ExecStateE
+__ZN3JSCL9dateParseEPNS_9ExecStateE
+__ZN3JSC9ExecState13dataViewTableERNS_2VME
+__ZN3JSC13dataViewTableE
+__ZN3JSC19JSDataViewPrototype15createStructureERNS_2VMEPNS_14JSGlobalObjectENS_7JSValueE
+__ZN3JSC1teENS_12PropertyNameERNS_12PropertySlotE
+__ZN3JSC19JSDataViewPrototype6createERNS_2VMEPNS_9StructureE
+__ZN3JSC19JSDataViewPrototype6s_infoE
+__ZN3JSC19JSDataViewPrototypeC1ERNS_2VMEPNS_9Structu1getStaticFunctionSlotINS_8JSObjectEEEbPNS_9ExecStateERKNS_9HashTableEPS1_NS_12PropertyNameERNS_12PropertyS_9ExecStateE
+__ZN3JSC7getDataINS_12Uint8AdaptorEEExPNS_9ExecStateE
+__ZN3JSC7getDataI64AdaptorEEExPNS_9ExecStateE
+__ZN3JSC7setDataINS_11Int8AdaptorEEExPNS_9ExecStateE
+__ZN3JSC7setDataINS_12Int16AdaptorEEExPNS_9ExecStateE
+__ZN3JSC7setDataINS_12Int32AdaptorEEExPNS_9ExecStateE
+__ZNS_13Uint16AdaptorEEExPNS_9ExecStateE
+__ZN3JSC7setDataINS_13Uint32AdaptorEEExPNS_9ExecStateE
+__ZN3JSC7setDataINS_14Float32AdaptorEEExPNS_9ExecStateE
+__ZN3JSC7setDataINS_14Float64AdaptorEEExPNStaViewTableIndexE
+__ZN3JSCL19dataViewTableValuesE
+__ZN3JSCL24dataViewProtoFuncGetInt8EPNS_9ExecStateE
+__ZN3JSCL24dataViewProtoFuncSetInt8EPNS_9ExecStateE
+__ZN3JSCL25dataViewProtoFuncGetInt16EPNZN3JSCL25dataViewProtoFuncGetUint8EPNS_9ExecStateE
+__ZN3JSCL25dataViewProtoFuncSetInt16EPNS_9ExecStateE
+__ZN3JSCL25dataViewProtoFuncSetInt32EPNS_9ExecStateE
+__ZN3JSCL25dataViewProtoFuncSetUintteE
+__ZN3JSCL27dataViewProtoFuncSetFloat32EPNS_9ExecStateE
+__ZN3JSCL27dataViewProtoFuncSetFloat64EPNS_9ExecStateE
+__ZN3JSCL18dataViewTableIndexE
diff --git a/tools/CodeProfile.cpp b/tools/CodeProfile.cpp
new file mode 100644
index 0000000..c8d580a
--- /dev/null
+++ b/tools/CodeProfile.cpp
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CodeProfile.h"
+
+#include "CodeBlock.h"
+#include "CodeProfiling.h"
+#include "LinkBuffer.h"
+#include "ProfileTreeNode.h"
+#include <wtf/text/WTFString.h>
+
+#if OS(DARWIN)
+#include <cxxabi.h>
+#include <dlfcn.h>
+#include <execinfo.h>
+#endif
+
+namespace JSC {
+
+// Map from CodeType enum to a corresponding name.
+const char* CodeProfile::s_codeTypeNames[CodeProfile::NumberOfCodeTypes] = {
+    "[[EngineCode]]",
+    "[[GlobalThunk]]",
+    "[[RegExpCode]]",
+    "[[DFGJIT]]",
+    "[[BaselineOnly]]",
+    "[[BaselineProfile]]",
+    "[[BaselineOSR]]",
+    "[[EngineFrame]]"
+};
+
+// Helper function, find the symbol name for a pc in JSC.
+static const char* symbolName(void* address)
+{
+#if OS(DARWIN)
+    Dl_info info;
+    if (!dladdr(address, &info) || !info.dli_sname)
+        return "<unknown>";
+
+    const char* mangledName = info.dli_sname;
+    const char* cxaDemangled = abi::__cxa_demangle(mangledName, 0, 0, 0);
+    return cxaDemangled ? cxaDemangled : mangledName;
+#else
+    UNUSED_PARAM(address);
+    return "<unknown>";
+#endif
+}
+
+// Helper function, truncate traces to prune the output & make very verbose mode a little more readable.
+static bool truncateTrace(const char* symbolName)
+{
+    return !strcmp(symbolName, "JSC::BytecodeGenerator::generate()")
+        || !strcmp(symbolName, "JSC::Parser<JSC::Lexer<unsigned char>>::parseInner()")
+        || !strcmp(symbolName, "WTF::fastMalloc(unsigned long)")
+        || !strcmp(symbolName, "WTF::calculateUTCOffset()")
+        || !strcmp(symbolName, "JSC::DFG::ByteCodeParser::parseCodeBlock()");
+        
+}
+
+// Each trace consists of a sequence of zero or more 'EngineFrame' entries,
+// followed by a sample in JIT code, or one or more 'EngineFrame' entries,
+// followed by a 'EngineCode' terminator.
+void CodeProfile::sample(void* pc, void** framePointer)
+{
+    // Disallow traces containing only a 'EngineCode' terminator, without any 'EngineFrame' frames.
+    if (!framePointer)
+        return;
+
+    while (framePointer) {
+        CodeType type;
+
+#if ENABLE(JIT)
+        // Determine if this sample fell in JIT code, and if so, from which JIT & why.
+        void* ownerUID = CodeProfiling::getOwnerUIDForPC(pc);
+
+        if (!ownerUID)
+            type = EngineFrame;
+        else if (ownerUID == GLOBAL_THUNK_ID)
+            type = GlobalThunk;
+        else if (ownerUID == REGEXP_CODE_ID)
+            type = RegExpCode;
+        else {
+            CodeBlock* codeBlock = static_cast<CodeBlock*>(ownerUID);
+            if (codeBlock->jitType() == JITCode::DFGJIT)
+                type = DFGJIT;
+            else if (!canCompile(codeBlock->capabilityLevelState()))
+                type = BaselineOnly;
+            else if (codeBlock->replacement())
+                type = BaselineOSR;
+            else
+                type = BaselineProfile;
+        }
+#else
+        type = EngineFrame;
+#endif
+
+        // A sample in JIT code terminates the trace.
+        m_samples.append(CodeRecord(pc, type));
+        if (type != EngineFrame)
+            return;
+
+#if OS(DARWIN) && CPU(X86_64)
+        // Walk up the stack.
+        pc = framePointer[1];
+        framePointer = reinterpret_cast<void**>(*framePointer);
+#elif OS(LINUX) && CPU(X86)
+        // Don't unwind the stack as some dependent third party libraries
+        // may be compiled with -fomit-frame-pointer.
+        framePointer = 0;
+#else
+        // This platform is not yet supported!
+        RELEASE_ASSERT_NOT_REACHED();
+#endif
+    }
+
+    // If we get here, we walked the entire stack without finding any frames of JIT code.
+    m_samples.append(CodeRecord(0, EngineCode));
+}
+
+void CodeProfile::report()
+{
+    dataLogF("<CodeProfiling %s:%d>\n", m_file.data(), m_lineNumber);
+
+    // How many frames of C-code to print - 0, if not verbose, 1 if verbose, up to 1024 if very verbose.
+    unsigned recursionLimit = CodeProfiling::beVeryVerbose() ? 1024 : CodeProfiling::beVerbose();
+
+    ProfileTreeNode profile;
+
+    // Walk through the sample buffer.
+    size_t trace = 0;
+    while (trace < m_samples.size()) {
+
+        // All traces are zero or more 'EngineFrame's, followed by a non-'EngineFrame'.
+        // Scan to find the last sample in the trace.
+        size_t lastInTrace = trace;
+        while (m_samples[lastInTrace].type == EngineFrame)
+            ++lastInTrace;
+
+        // We use the last sample type to look up a name (used as a bucket in the profiler).
+        ProfileTreeNode* callbacks = profile.sampleChild(s_codeTypeNames[m_samples[lastInTrace].type]);
+
+        // If there are any samples in C-code, add up to recursionLimit of them into the profile tree.
+        size_t lastEngineFrame = lastInTrace;
+        for (unsigned count = 0; lastEngineFrame > trace && count < recursionLimit; ++count) {
+            --lastEngineFrame;
+            ASSERT(m_samples[lastEngineFrame].type == EngineFrame);
+            const char* name = symbolName(m_samples[lastEngineFrame].pc);
+            callbacks = callbacks->sampleChild(name);
+            if (truncateTrace(name))
+                break;
+        }
+
+        // Move on to the next trace.
+        trace = lastInTrace + 1;
+        ASSERT(trace <= m_samples.size());
+    }
+
+    // Output the profile tree.
+    dataLogF("Total samples: %lld\n", static_cast<long long>(profile.childCount()));
+    profile.dump();
+    
+    for (size_t i = 0 ; i < m_children.size(); ++i)
+        m_children[i]->report();
+
+    dataLogF("</CodeProfiling %s:%d>\n", m_file.data(), m_lineNumber);
+}
+
+}
diff --git a/tools/CodeProfile.h b/tools/CodeProfile.h
new file mode 100644
index 0000000..4fa357d
--- /dev/null
+++ b/tools/CodeProfile.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "SourceCode.h"
+#include "TieredMMapArray.h"
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+class CodeProfile {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    CodeProfile(const SourceCode& source, CodeProfile* parent)
+        : m_file(source.provider()->url().utf8())
+        , m_lineNumber(source.firstLine().oneBasedInt())
+        , m_parent(parent)
+    {
+        if (parent)
+            parent->addChild(std::unique_ptr<CodeProfile>(this));
+    }
+
+    void sample(void* pc, void** framePointer);
+    void report();
+
+    CodeProfile* parent()
+    {
+        return m_parent;
+    }
+    
+    void addChild(std::unique_ptr<CodeProfile> child)
+    {
+        m_children.append(WTFMove(child));
+    }
+
+private:
+    enum CodeType {
+        EngineCode,
+        GlobalThunk,
+        RegExpCode,
+        DFGJIT,
+        BaselineOnly,
+        BaselineProfile,
+        BaselineOSR,
+        EngineFrame,
+        NumberOfCodeTypes
+    };
+    struct CodeRecord {
+        CodeRecord(void* pc, CodeType type)
+            : pc(pc)
+            , type(type)
+        {
+        }
+        void* pc;
+        CodeType type;
+    };
+
+    CString m_file;
+    unsigned m_lineNumber;
+    CodeProfile* m_parent;
+    Vector<std::unique_ptr<CodeProfile>> m_children;
+    TieredMMapArray<CodeRecord> m_samples;
+
+    static const char* s_codeTypeNames[NumberOfCodeTypes];
+};
+
+} // namespace JSC
diff --git a/tools/CodeProfiling.cpp b/tools/CodeProfiling.cpp
new file mode 100644
index 0000000..302b5f9
--- /dev/null
+++ b/tools/CodeProfiling.cpp
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CodeProfiling.h"
+
+#include "CodeProfile.h"
+#include <wtf/MetaAllocator.h>
+
+#if HAVE(SIGNAL_H)
+#include <signal.h>
+#endif
+
+#if OS(LINUX) || OS(DARWIN)
+#include <sys/time.h>
+#endif
+
+namespace JSC {
+
+volatile CodeProfile* CodeProfiling::s_profileStack = 0;
+CodeProfiling::Mode CodeProfiling::s_mode = CodeProfiling::Disabled;
+WTF::MetaAllocatorTracker* CodeProfiling::s_tracker = 0;
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wmissing-noreturn"
+#endif
+
+#if (OS(DARWIN) && !PLATFORM(EFL) && !PLATFORM(GTK) && CPU(X86_64)) || (OS(LINUX) && CPU(X86))
+// Helper function to start & stop the timer.
+// Presently we're using the wall-clock timer, since this seems to give the best results.
+static void setProfileTimer(unsigned usec)
+{
+    itimerval timer;
+    timer.it_value.tv_sec = 0;
+    timer.it_value.tv_usec = usec;
+    timer.it_interval.tv_sec = 0;
+    timer.it_interval.tv_usec = usec;
+    setitimer(ITIMER_REAL, &timer, 0);
+}
+#endif
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
+
+#if OS(DARWIN) && !PLATFORM(EFL) && !PLATFORM(GTK) && CPU(X86_64)
+static void profilingTimer(int, siginfo_t*, void* uap)
+{
+    mcontext_t context = static_cast<ucontext_t*>(uap)->uc_mcontext;
+    CodeProfiling::sample(reinterpret_cast<void*>(context->__ss.__rip),
+                          reinterpret_cast<void**>(context->__ss.__rbp));
+}
+#elif OS(LINUX) && CPU(X86)
+static void profilingTimer(int, siginfo_t*, void* uap)
+{
+    mcontext_t context = static_cast<ucontext_t*>(uap)->uc_mcontext;
+    CodeProfiling::sample(reinterpret_cast<void*>(context.gregs[REG_EIP]),
+                          reinterpret_cast<void**>(context.gregs[REG_EBP]));
+}
+#endif
+
+// Callback triggered when the timer is fired.
+void CodeProfiling::sample(void* pc, void** framePointer)
+{
+    CodeProfile* profileStack = const_cast<CodeProfile*>(s_profileStack);
+    if (profileStack)
+        profileStack->sample(pc, framePointer);
+}
+
+void CodeProfiling::notifyAllocator(WTF::MetaAllocator* allocator)
+{
+    // Check for JSC_CODE_PROFILING.
+    const char* codeProfilingMode = getenv("JSC_CODE_PROFILING");
+    if (!codeProfilingMode)
+        return;
+
+    // Check for a valid mode, currently "1", "2", or "3".
+    if (!codeProfilingMode[0] || codeProfilingMode[1])
+        return;
+    switch (*codeProfilingMode) {
+    case '1':
+        s_mode = Enabled;
+        break;
+    case '2':
+        s_mode = Verbose;
+        break;
+    case '3':
+        s_mode = VeryVerbose;
+        break;
+    default:
+        return;
+    }
+
+    ASSERT(enabled());
+    ASSERT(!s_tracker);
+    s_tracker = new WTF::MetaAllocatorTracker();
+    allocator->trackAllocations(s_tracker);
+}
+
+void* CodeProfiling::getOwnerUIDForPC(void* address)
+{
+    if (!s_tracker)
+        return 0;
+    WTF::MetaAllocatorHandle* handle = s_tracker->find(address);
+    if (!handle)
+        return 0;
+    return handle->ownerUID();
+}
+
+void CodeProfiling::begin(const SourceCode& source)
+{
+    // Push a new CodeProfile onto the stack for each script encountered.
+    CodeProfile* profileStack = const_cast<CodeProfile*>(s_profileStack);
+    bool alreadyProfiling = profileStack;
+    s_profileStack = profileStack = new CodeProfile(source, profileStack);
+
+    // Is the profiler already running - if so, the timer will already be set up.
+    if (alreadyProfiling)
+        return;
+
+#if (OS(DARWIN) && !PLATFORM(EFL) && !PLATFORM(GTK) && CPU(X86_64)) || (OS(LINUX) && CPU(X86))
+    // Regsiter a signal handler & itimer.
+    struct sigaction action;
+    action.sa_sigaction = reinterpret_cast<void (*)(int, siginfo_t *, void *)>(profilingTimer);
+    sigfillset(&action.sa_mask);
+    action.sa_flags = SA_SIGINFO;
+    sigaction(SIGALRM, &action, 0);
+    setProfileTimer(100);
+#endif
+}
+
+void CodeProfiling::end()
+{
+    // Pop the current profiler off the stack.
+    CodeProfile* current = const_cast<CodeProfile*>(s_profileStack);
+    ASSERT(current);
+    s_profileStack = current->parent();
+
+    // Is this the outermost script being profiled? - if not, just return.
+    // We perform all output of profiles recursively from the outermost script,
+    // to minimize profiling overhead from skewing results.
+    if (s_profileStack)
+        return;
+
+#if (OS(DARWIN) && !PLATFORM(EFL) && !PLATFORM(GTK) && CPU(X86_64)) || (OS(LINUX) && CPU(X86))
+    // Stop profiling
+    setProfileTimer(0);
+#endif
+
+    current->report();
+    delete current;
+}
+
+}
diff --git a/tools/CodeProfiling.h b/tools/CodeProfiling.h
new file mode 100644
index 0000000..311fcda
--- /dev/null
+++ b/tools/CodeProfiling.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace WTF {
+
+class MetaAllocator;
+class MetaAllocatorTracker;
+
+}
+
+namespace JSC {
+
+class CodeProfile;
+class SourceCode;
+
+class CodeProfiling {
+    enum Mode {
+        Disabled,
+        Enabled,
+        Verbose,
+        VeryVerbose
+    };
+
+public:
+    CodeProfiling(const SourceCode& source)
+        : m_active(enabled())
+    {
+        if (m_active)
+            begin(source);
+    }
+
+    ~CodeProfiling()
+    {
+        if (m_active)
+            end();
+    }
+
+    static bool enabled() { return s_mode != Disabled; }
+    static bool beVerbose() { return s_mode >= Verbose; }
+    static bool beVeryVerbose() { return s_mode >= VeryVerbose; }
+
+    static void notifyAllocator(WTF::MetaAllocator*);
+    static void* getOwnerUIDForPC(void*);
+    static void sample(void* pc, void** framePointer);
+
+private:
+    void begin(const SourceCode&);
+    void end();
+
+    bool m_active;
+
+    static Mode s_mode;
+    static WTF::MetaAllocatorTracker* s_tracker;
+    static volatile CodeProfile* s_profileStack;
+};
+
+} // namespace JSC
diff --git a/tools/FunctionOverrides.cpp b/tools/FunctionOverrides.cpp
new file mode 100644
index 0000000..6e96136
--- /dev/null
+++ b/tools/FunctionOverrides.cpp
@@ -0,0 +1,266 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FunctionOverrides.h"
+
+#include <stdio.h>
+#include <string.h>
+#include <wtf/DataLog.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringHash.h>
+
+namespace JSC {
+
+/*
+  The overrides file defines function bodies that we will want to override with
+  a replacement for debugging purposes. The overrides file may contain
+  'override' and 'with' clauses like these:
+
+     // Example 1: function foo1(a)
+     override !@#$%{ print("In foo1"); }!@#$%
+     with abc{
+         print("I am overridden");
+     }abc
+
+     // Example 2: function foo2(a)
+     override %%%{
+         print("foo2's body has a string with }%% in it.");
+         // Because }%% appears in the function body here, we cannot use
+         // %% or % as the delimiter. %%% is ok though.
+     }%%%
+     with %%%{
+         print("Overridden foo2");
+     }%%%
+
+  1. Comments are lines starting with //.  All comments will be ignored.
+
+  2. An 'override' clause is used to specify the original function body we
+     want to override. The with clause is used to specify the overriding
+     function body.
+
+     An 'override' clause must be followed immediately by a 'with' clause.
+
+  3. An 'override' clause must be of the form:
+         override <delimiter>{...function body...}<delimiter>
+
+     The override keyword must be at the start of the line.
+
+     <delimiter> may be any string of any ASCII characters (except for '{',
+     '}', and whitespace characters) as long as the pattern of "}<delimiter>"
+     does not appear in the function body e.g. the override clause of Example 2
+     above illustrates this.
+
+     The start and end <delimiter> must be identical.
+
+     The space between the override keyword and the start <delimiter> is
+     required.
+
+     All characters between the pair of delimiters will be considered to
+     be part of the function body string. This allows us to also work
+     with script source that are multi-lined i.e. newlines are allowed.
+     
+  4. A 'with' clause is identical in form to an 'override' clause except that
+     it uses the 'with' keyword instead of the 'override' keyword.
+ */
+
+FunctionOverrides& FunctionOverrides::overrides()
+{
+    static LazyNeverDestroyed<FunctionOverrides> overrides;
+    static std::once_flag initializeListFlag;
+    std::call_once(initializeListFlag, [] {
+        const char* overridesFileName = Options::functionOverrides();
+        overrides.construct(overridesFileName);
+    });
+    return overrides;
+}
+    
+FunctionOverrides::FunctionOverrides(const char* overridesFileName)
+{
+    parseOverridesInFile(overridesFileName);
+}
+
+void FunctionOverrides::reinstallOverrides()
+{
+    FunctionOverrides& overrides = FunctionOverrides::overrides();
+    const char* overridesFileName = Options::functionOverrides();
+    overrides.clear();
+    overrides.parseOverridesInFile(overridesFileName);
+}
+
+static void initializeOverrideInfo(const SourceCode& origCode, const String& newBody, FunctionOverrides::OverrideInfo& info)
+{
+    String origProviderStr = origCode.provider()->source().toString();
+    unsigned origStart = origCode.startOffset();
+    unsigned origFunctionStart = origProviderStr.reverseFind("function", origStart);
+    unsigned origBraceStart = origProviderStr.find("{", origStart);
+    unsigned headerLength = origBraceStart - origFunctionStart;
+    String origHeader = origProviderStr.substring(origFunctionStart, headerLength);
+
+    String newProviderStr;
+    newProviderStr.append(origHeader);
+    newProviderStr.append(newBody);
+
+    auto newProvider = StringSourceProvider::create(newProviderStr, "<overridden>");
+
+    info.firstLine = 1;
+    info.lineCount = 1; // Faking it. This doesn't really matter for now.
+    info.startColumn = 1;
+    info.endColumn = 1; // Faking it. This doesn't really matter for now.
+    info.parametersStartOffset = newProviderStr.find("(");
+    info.typeProfilingStartOffset = newProviderStr.find("{");
+    info.typeProfilingEndOffset = newProviderStr.length() - 1;
+
+    info.sourceCode =
+        SourceCode(WTFMove(newProvider), info.parametersStartOffset, info.typeProfilingEndOffset + 1, 1, 1);
+}
+    
+bool FunctionOverrides::initializeOverrideFor(const SourceCode& origCode, FunctionOverrides::OverrideInfo& result)
+{
+    ASSERT(Options::functionOverrides());
+    FunctionOverrides& overrides = FunctionOverrides::overrides();
+
+    String sourceString = origCode.view().toString();
+    size_t sourceBodyStart = sourceString.find('{');
+    if (sourceBodyStart == notFound)
+        return false;
+    String sourceBodyString = sourceString.substring(sourceBodyStart);
+
+    auto it = overrides.m_entries.find(sourceBodyString);
+    if (it == overrides.m_entries.end())
+        return false;
+
+    initializeOverrideInfo(origCode, it->value, result);
+    return true;
+}
+
+#define SYNTAX_ERROR "SYNTAX ERROR"
+#define IO_ERROR "IO ERROR"
+#define FAIL_WITH_ERROR(error, errorMessageInBrackets) \
+    do { \
+        dataLog("functionOverrides ", error, ": "); \
+        dataLog errorMessageInBrackets; \
+        exit(EXIT_FAILURE); \
+    } while (false)
+
+static bool hasDisallowedCharacters(const char* str, size_t length)
+{
+    while (length--) {
+        char c = *str++;
+        // '{' is also disallowed, but we don't need to check for it because
+        // parseClause() searches for '{' as the end of the start delimiter.
+        // As a result, the parsed delimiter string will never include '{'.
+        if (c == '}' || isASCIISpace(c))
+            return true;
+    }
+    return false;
+}
+
+static String parseClause(const char* keyword, size_t keywordLength, FILE* file, const char* line, char* buffer, size_t bufferSize)
+{
+    const char* keywordPos = strstr(line, keyword);
+    if (!keywordPos)
+        FAIL_WITH_ERROR(SYNTAX_ERROR, ("Expecting '", keyword, "' clause:\n", line, "\n"));
+    if (keywordPos != line)
+        FAIL_WITH_ERROR(SYNTAX_ERROR, ("Cannot have any characters before '", keyword, "':\n", line, "\n"));
+    if (line[keywordLength] != ' ')
+        FAIL_WITH_ERROR(SYNTAX_ERROR, ("'", keyword, "' must be followed by a ' ':\n", line, "\n"));
+
+    const char* delimiterStart = &line[keywordLength + 1];
+    const char* delimiterEnd = strstr(delimiterStart, "{");
+    if (!delimiterEnd)
+        FAIL_WITH_ERROR(SYNTAX_ERROR, ("Missing { after '", keyword, "' clause start delimiter:\n", line, "\n"));
+    
+    size_t delimiterLength = delimiterEnd - delimiterStart;
+    String delimiter(delimiterStart, delimiterLength);
+
+    if (hasDisallowedCharacters(delimiterStart, delimiterLength))
+        FAIL_WITH_ERROR(SYNTAX_ERROR, ("Delimiter '", delimiter, "' cannot have '{', '}', or whitespace:\n", line, "\n"));
+    
+    String terminatorString;
+    terminatorString.append("}");
+    terminatorString.append(delimiter);
+
+    CString terminatorCString = terminatorString.ascii();
+    const char* terminator = terminatorCString.data();
+    line = delimiterEnd; // Start from the {.
+
+    StringBuilder builder;
+    do {
+        const char* p = strstr(line, terminator);
+        if (p) {
+            if (p[strlen(terminator)] != '\n')
+                FAIL_WITH_ERROR(SYNTAX_ERROR, ("Unexpected characters after '", keyword, "' clause end delimiter '", delimiter, "':\n", line, "\n"));
+
+            builder.append(line, p - line + 1);
+            return builder.toString();
+        }
+        builder.append(line);
+
+    } while ((line = fgets(buffer, bufferSize, file)));
+
+    FAIL_WITH_ERROR(SYNTAX_ERROR, ("'", keyword, "' clause end delimiter '", delimiter, "' not found:\n", builder.toString(), "\n", "Are you missing a '}' before the delimiter?\n"));
+}
+
+void FunctionOverrides::parseOverridesInFile(const char* fileName)
+{
+    if (!fileName)
+        return;
+    
+    FILE* file = fopen(fileName, "r");
+    if (!file)
+        FAIL_WITH_ERROR(IO_ERROR, ("Failed to open file ", fileName, ". Did you add the file-read-data entitlement to WebProcess.sb?\n"));
+
+    char* line;
+    char buffer[BUFSIZ];
+    while ((line = fgets(buffer, sizeof(buffer), file))) {
+        if (strstr(line, "//") == line)
+            continue;
+
+        if (line[0] == '\n' || line[0] == '\0')
+            continue;
+
+        size_t keywordLength;
+        
+        keywordLength = sizeof("override") - 1;
+        String keyStr = parseClause("override", keywordLength, file, line, buffer, sizeof(buffer));
+
+        line = fgets(buffer, sizeof(buffer), file);
+
+        keywordLength = sizeof("with") - 1;
+        String valueStr = parseClause("with", keywordLength, file, line, buffer, sizeof(buffer));
+
+        m_entries.add(keyStr, valueStr);
+    }
+    
+    int result = fclose(file);
+    if (result)
+        dataLogF("Failed to close file %s: %s\n", fileName, strerror(errno));
+}
+    
+} // namespace JSC
+
diff --git a/tools/FunctionOverrides.h b/tools/FunctionOverrides.h
new file mode 100644
index 0000000..3e5de19
--- /dev/null
+++ b/tools/FunctionOverrides.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Options.h"
+#include "SourceCode.h"
+#include <wtf/HashMap.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class ScriptExecutable;
+
+class FunctionOverrides {
+public:
+    struct OverrideInfo {
+        SourceCode sourceCode;
+        unsigned firstLine;
+        unsigned lineCount;
+        unsigned startColumn;
+        unsigned endColumn;
+        unsigned parametersStartOffset;
+        unsigned typeProfilingStartOffset;
+        unsigned typeProfilingEndOffset;
+    };
+
+    static FunctionOverrides& overrides();
+    FunctionOverrides(const char* functionOverridesFileName);
+
+    static bool initializeOverrideFor(const SourceCode& origCode, OverrideInfo& result);
+
+    JS_EXPORT_PRIVATE static void reinstallOverrides();
+
+private:
+    void parseOverridesInFile(const char* fileName);
+    void clear() { m_entries.clear(); }
+
+    HashMap<String, String> m_entries;
+};
+
+} // namespace JSC
diff --git a/tools/FunctionWhitelist.cpp b/tools/FunctionWhitelist.cpp
new file mode 100644
index 0000000..c1ea360
--- /dev/null
+++ b/tools/FunctionWhitelist.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FunctionWhitelist.h"
+
+#if ENABLE(JIT)
+
+#include "CodeBlock.h"
+#include "Options.h"
+#include <stdio.h>
+#include <string.h>
+
+namespace JSC {
+
+FunctionWhitelist::FunctionWhitelist(const char* filename)
+{
+    if (!filename)
+        return;
+
+    FILE* f = fopen(filename, "r");
+    if (!f) {
+        dataLogF("Failed to open file %s. Did you add the file-read-data entitlement to WebProcess.sb?\n", filename); 
+        return;
+    }
+
+    m_hasActiveWhitelist = true;
+
+    char* line;
+    char buffer[BUFSIZ];
+    while ((line = fgets(buffer, sizeof(buffer), f))) {
+        if (strstr(line, "//") == line)
+            continue;
+
+        // Get rid of newlines at the ends of the strings.
+        size_t length = strlen(line);
+        if (line[length - 1] == '\n') {
+            line[length - 1] = '\0';
+            length--;
+        }
+
+        // Skip empty lines.
+        if (!length)
+            continue;
+        
+        m_entries.add(String(line, length));
+    }
+
+    int result = fclose(f);
+    if (result)
+        dataLogF("Failed to close file %s: %s\n", filename, strerror(errno));
+}
+
+bool FunctionWhitelist::contains(CodeBlock* codeBlock) const
+{
+    ASSERT(!isCompilationThread());
+    if (!m_hasActiveWhitelist)
+        return true;
+
+    if (m_entries.isEmpty())
+        return false;
+
+    String name = String::fromUTF8(codeBlock->inferredName());
+    if (m_entries.contains(name))
+        return true;
+
+    String hash = String::fromUTF8(codeBlock->hashAsStringIfPossible());
+    if (m_entries.contains(hash))
+        return true;
+
+    return m_entries.contains(name + '#' + hash);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/tools/FunctionWhitelist.h b/tools/FunctionWhitelist.h
new file mode 100644
index 0000000..b5e6e4f
--- /dev/null
+++ b/tools/FunctionWhitelist.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/HashSet.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC { 
+
+class CodeBlock;
+
+class FunctionWhitelist {
+public:
+    explicit FunctionWhitelist(const char*);
+
+    bool contains(CodeBlock*) const;
+
+private:
+    HashSet<String> m_entries;
+    bool m_hasActiveWhitelist { false };
+};
+
+} // namespace JSC
diff --git a/tools/JSDollarVM.cpp b/tools/JSDollarVM.cpp
new file mode 100644
index 0000000..ae38973
--- /dev/null
+++ b/tools/JSDollarVM.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDollarVM.h"
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSDollarVM::s_info = { "DollarVM", &Base::s_info, 0, CREATE_METHOD_TABLE(JSDollarVM) };
+
+} // namespace JSC
diff --git a/tools/JSDollarVM.h b/tools/JSDollarVM.h
new file mode 100644
index 0000000..2267577
--- /dev/null
+++ b/tools/JSDollarVM.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+    
+class JSDollarVM : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    
+    DECLARE_EXPORT_INFO;
+    
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+    
+    static JSDollarVM* create(VM& vm, Structure* structure)
+    {
+        JSDollarVM* instance = new (NotNull, allocateCell<JSDollarVM>(vm.heap)) JSDollarVM(vm, structure);
+        instance->finishCreation(vm);
+        return instance;
+    }
+    
+private:
+    JSDollarVM(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+};
+
+} // namespace JSC
diff --git a/tools/JSDollarVMPrototype.cpp b/tools/JSDollarVMPrototype.cpp
new file mode 100644
index 0000000..b8364b8
--- /dev/null
+++ b/tools/JSDollarVMPrototype.cpp
@@ -0,0 +1,476 @@
+/*
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDollarVMPrototype.h"
+
+#include "CodeBlock.h"
+#include "FunctionCodeBlock.h"
+#include "Heap.h"
+#include "HeapIterationScope.h"
+#include "JSCInlines.h"
+#include "JSFunction.h"
+#include "MarkedSpaceInlines.h"
+#include "StackVisitor.h"
+#include <wtf/DataLog.h>
+#include <wtf/StringPrintStream.h>
+
+namespace JSC {
+
+const ClassInfo JSDollarVMPrototype::s_info = { "DollarVMPrototype", &Base::s_info, 0, CREATE_METHOD_TABLE(JSDollarVMPrototype) };
+    
+    
+bool JSDollarVMPrototype::currentThreadOwnsJSLock(ExecState* exec)
+{
+    return exec->vm().apiLock().currentThreadIsHoldingLock();
+}
+
+static bool ensureCurrentThreadOwnsJSLock(ExecState* exec)
+{
+    if (JSDollarVMPrototype::currentThreadOwnsJSLock(exec))
+        return true;
+    dataLog("ERROR: current thread does not own the JSLock\n");
+    return false;
+}
+
+void JSDollarVMPrototype::addFunction(VM& vm, JSGlobalObject* globalObject, const char* name, NativeFunction function, unsigned arguments)
+{
+    Identifier identifier = Identifier::fromString(&vm, name);
+    putDirect(vm, identifier, JSFunction::create(vm, globalObject, arguments, identifier.string(), function));
+}
+
+static EncodedJSValue JSC_HOST_CALL functionCrash(ExecState*)
+{
+    CRASH();
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL functionDFGTrue(ExecState*)
+{
+    return JSValue::encode(jsBoolean(false));
+}
+
+class CallerFrameJITTypeFunctor {
+public:
+    CallerFrameJITTypeFunctor()
+        : m_currentFrame(0)
+        , m_jitType(JITCode::None)
+    {
+    }
+
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        if (m_currentFrame++ > 1) {
+            m_jitType = visitor->codeBlock()->jitType();
+            return StackVisitor::Done;
+        }
+        return StackVisitor::Continue;
+    }
+    
+    JITCode::JITType jitType() { return m_jitType; }
+
+private:
+    mutable unsigned m_currentFrame;
+    mutable JITCode::JITType m_jitType;
+};
+
+static EncodedJSValue JSC_HOST_CALL functionLLintTrue(ExecState* exec)
+{
+    if (!exec)
+        return JSValue::encode(jsUndefined());
+    CallerFrameJITTypeFunctor functor;
+    exec->iterate(functor);
+    return JSValue::encode(jsBoolean(functor.jitType() == JITCode::InterpreterThunk));
+}
+
+static EncodedJSValue JSC_HOST_CALL functionJITTrue(ExecState* exec)
+{
+    if (!exec)
+        return JSValue::encode(jsUndefined());
+    CallerFrameJITTypeFunctor functor;
+    exec->iterate(functor);
+    return JSValue::encode(jsBoolean(functor.jitType() == JITCode::BaselineJIT));
+}
+
+void JSDollarVMPrototype::gc(ExecState* exec)
+{
+    if (!ensureCurrentThreadOwnsJSLock(exec))
+        return;
+    exec->heap()->collectAllGarbage();
+}
+    
+static EncodedJSValue JSC_HOST_CALL functionGC(ExecState* exec)
+{
+    JSDollarVMPrototype::gc(exec);
+    return JSValue::encode(jsUndefined());
+}
+
+void JSDollarVMPrototype::edenGC(ExecState* exec)
+{
+    if (!ensureCurrentThreadOwnsJSLock(exec))
+        return;
+    exec->heap()->collectSync(CollectionScope::Eden);
+}
+
+static EncodedJSValue JSC_HOST_CALL functionEdenGC(ExecState* exec)
+{
+    JSDollarVMPrototype::edenGC(exec);
+    return JSValue::encode(jsUndefined());
+}
+
+bool JSDollarVMPrototype::isInHeap(Heap* heap, void* ptr)
+{
+    return isInObjectSpace(heap, ptr) || isInStorageSpace(heap, ptr);
+}
+
+bool JSDollarVMPrototype::isInObjectSpace(Heap* heap, void* ptr)
+{
+    MarkedBlock* candidate = MarkedBlock::blockFor(ptr);
+    if (heap->objectSpace().blocks().set().contains(candidate))
+        return true;
+    for (LargeAllocation* allocation : heap->objectSpace().largeAllocations()) {
+        if (allocation->contains(ptr))
+            return true;
+    }
+    return false;
+}
+
+bool JSDollarVMPrototype::isInStorageSpace(Heap*, void*)
+{
+    // FIXME: Do something with this.
+    // https://bugs.webkit.org/show_bug.cgi?id=161753
+    return false;
+}
+
+struct CellAddressCheckFunctor : MarkedBlock::CountFunctor {
+    CellAddressCheckFunctor(JSCell* candidate)
+        : candidate(candidate)
+    {
+    }
+
+    IterationStatus operator()(HeapCell* cell, HeapCell::Kind) const
+    {
+        if (cell == candidate) {
+            found = true;
+            return IterationStatus::Done;
+        }
+        return IterationStatus::Continue;
+    }
+
+    JSCell* candidate;
+    mutable bool found { false };
+};
+
+bool JSDollarVMPrototype::isValidCell(Heap* heap, JSCell* candidate)
+{
+    HeapIterationScope iterationScope(*heap);
+    CellAddressCheckFunctor functor(candidate);
+    heap->objectSpace().forEachLiveCell(iterationScope, functor);
+    return functor.found;
+}
+
+bool JSDollarVMPrototype::isValidCodeBlock(ExecState* exec, CodeBlock* candidate)
+{
+    if (!ensureCurrentThreadOwnsJSLock(exec))
+        return false;
+    
+    struct CodeBlockValidationFunctor {
+        CodeBlockValidationFunctor(CodeBlock* candidate)
+            : candidate(candidate)
+        {
+        }
+        
+        bool operator()(CodeBlock* codeBlock) const
+        {
+            if (codeBlock == candidate)
+                found = true;
+            return found;
+        }
+        
+        CodeBlock* candidate;
+        mutable bool found { false };
+    };
+    
+    VM& vm = exec->vm();
+    CodeBlockValidationFunctor functor(candidate);
+    vm.heap.forEachCodeBlock(functor);
+    return functor.found;
+}
+
+CodeBlock* JSDollarVMPrototype::codeBlockForFrame(CallFrame* topCallFrame, unsigned frameNumber)
+{
+    if (!ensureCurrentThreadOwnsJSLock(topCallFrame))
+        return nullptr;
+    
+    if (!topCallFrame)
+        return nullptr;
+    
+    struct FetchCodeBlockFunctor {
+    public:
+        FetchCodeBlockFunctor(unsigned targetFrameNumber)
+            : targetFrame(targetFrameNumber)
+        {
+        }
+        
+        StackVisitor::Status operator()(StackVisitor& visitor) const
+        {
+            currentFrame++;
+            if (currentFrame == targetFrame) {
+                codeBlock = visitor->codeBlock();
+                return StackVisitor::Done;
+            }
+            return StackVisitor::Continue;
+        }
+        
+        unsigned targetFrame;
+        mutable unsigned currentFrame { 0 };
+        mutable CodeBlock* codeBlock { nullptr };
+    };
+    
+    FetchCodeBlockFunctor functor(frameNumber);
+    topCallFrame->iterate(functor);
+    return functor.codeBlock;
+}
+
+static EncodedJSValue JSC_HOST_CALL functionCodeBlockForFrame(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return JSValue::encode(jsUndefined());
+
+    JSValue value = exec->uncheckedArgument(0);
+    if (!value.isUInt32())
+        return JSValue::encode(jsUndefined());
+
+    // We need to inc the frame number because the caller would consider
+    // its own frame as frame 0. Hence, we need discount the frame for this
+    // function.
+    unsigned frameNumber = value.asUInt32() + 1;
+    CodeBlock* codeBlock = JSDollarVMPrototype::codeBlockForFrame(exec, frameNumber);
+    // Though CodeBlock is a JSCell, it is not safe to return it directly back to JS code
+    // as it is an internal type that the JS code cannot handle. Hence, we first encode the
+    // CodeBlock* as a double token (which is safe for JS code to handle) before returning it.
+    return JSValue::encode(JSValue(bitwise_cast<double>(static_cast<uint64_t>(reinterpret_cast<uintptr_t>(codeBlock)))));
+}
+
+static CodeBlock* codeBlockFromArg(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return nullptr;
+
+    JSValue value = exec->uncheckedArgument(0);
+    CodeBlock* candidateCodeBlock = nullptr;
+    if (value.isCell()) {
+        JSFunction* func = jsDynamicCast<JSFunction*>(value.asCell());
+        if (func) {
+            if (func->isHostFunction())
+                candidateCodeBlock = nullptr;
+            else
+                candidateCodeBlock = func->jsExecutable()->eitherCodeBlock();
+        }
+    } else if (value.isDouble()) {
+        // If the value is a double, it may be an encoded CodeBlock* that came from
+        // $vm.codeBlockForFrame(). We'll treat it as a candidate codeBlock and check if it's
+        // valid below before using.
+        candidateCodeBlock = reinterpret_cast<CodeBlock*>(bitwise_cast<uint64_t>(value.asDouble()));
+    }
+
+    if (candidateCodeBlock && JSDollarVMPrototype::isValidCodeBlock(exec, candidateCodeBlock))
+        return candidateCodeBlock;
+
+    if (candidateCodeBlock)
+        dataLog("Invalid codeBlock: ", RawPointer(candidateCodeBlock), " ", value, "\n");
+    else
+        dataLog("Invalid codeBlock: ", value, "\n");
+    return nullptr;
+}
+
+static EncodedJSValue JSC_HOST_CALL functionCodeBlockFor(ExecState* exec)
+{
+    CodeBlock* codeBlock = codeBlockFromArg(exec);
+    WTF::StringPrintStream stream;
+    if (codeBlock) {
+        stream.print(*codeBlock);
+        return JSValue::encode(jsString(exec, stream.toString()));
+    }
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL functionPrintSourceFor(ExecState* exec)
+{
+    CodeBlock* codeBlock = codeBlockFromArg(exec);
+    if (codeBlock)
+        codeBlock->dumpSource();
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL functionPrintByteCodeFor(ExecState* exec)
+{
+    CodeBlock* codeBlock = codeBlockFromArg(exec);
+    if (codeBlock)
+        codeBlock->dumpBytecode();
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL functionPrint(ExecState* exec)
+{
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    for (unsigned i = 0; i < exec->argumentCount(); ++i) {
+        String argStr = exec->uncheckedArgument(i).toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        dataLog(argStr);
+    }
+    return JSValue::encode(jsUndefined());
+}
+
+class PrintFrameFunctor {
+public:
+    enum Action {
+        PrintOne,
+        PrintAll
+    };
+    
+    PrintFrameFunctor(Action action, unsigned framesToSkip)
+        : m_action(action)
+        , m_framesToSkip(framesToSkip)
+    {
+    }
+    
+    StackVisitor::Status operator()(StackVisitor& visitor) const
+    {
+        m_currentFrame++;
+        if (m_currentFrame > m_framesToSkip) {
+            visitor->dump(WTF::dataFile(), Indenter(2), [&] (PrintStream& out) {
+                out.print("[", (m_currentFrame - m_framesToSkip - 1), "] ");
+            });
+        }
+        if (m_action == PrintOne && m_currentFrame > m_framesToSkip)
+            return StackVisitor::Done;
+        return StackVisitor::Continue;
+    }
+    
+private:
+    Action m_action;
+    unsigned m_framesToSkip;
+    mutable unsigned m_currentFrame { 0 };
+};
+
+static void printCallFrame(CallFrame* callFrame, unsigned framesToSkip)
+{
+    if (!ensureCurrentThreadOwnsJSLock(callFrame))
+        return;
+    PrintFrameFunctor functor(PrintFrameFunctor::PrintOne, framesToSkip);
+    callFrame->iterate(functor);
+}
+
+void JSDollarVMPrototype::printCallFrame(CallFrame* callFrame)
+{
+    JSC::printCallFrame(callFrame, 0);
+}
+
+static void printStack(CallFrame* topCallFrame, unsigned framesToSkip)
+{
+    if (!ensureCurrentThreadOwnsJSLock(topCallFrame))
+        return;
+    if (!topCallFrame)
+        return;
+    PrintFrameFunctor functor(PrintFrameFunctor::PrintAll, framesToSkip);
+    topCallFrame->iterate(functor);
+}
+
+void JSDollarVMPrototype::printStack(CallFrame* topCallFrame)
+{
+    JSC::printStack(topCallFrame, 0);
+}
+
+static EncodedJSValue JSC_HOST_CALL functionPrintCallFrame(ExecState* exec)
+{
+    // When the callers call this function, they are expecting to print their
+    // own frame. So skip 1 for this frame.
+    printCallFrame(exec, 1);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL functionPrintStack(ExecState* exec)
+{
+    // When the callers call this function, they are expecting to print the
+    // stack starting their own frame. So skip 1 for this frame.
+    printStack(exec, 1);
+    return JSValue::encode(jsUndefined());
+}
+
+void JSDollarVMPrototype::printValue(JSValue value)
+{
+    dataLog(value);
+}
+
+static EncodedJSValue JSC_HOST_CALL functionValue(ExecState* exec)
+{
+    WTF::StringPrintStream stream;
+    for (unsigned i = 0; i < exec->argumentCount(); ++i) {
+        if (i)
+            stream.print(", ");
+        stream.print(exec->uncheckedArgument(i));
+    }
+    
+    return JSValue::encode(jsString(exec, stream.toString()));
+}
+
+#if !PLATFORM(WIN)
+static EncodedJSValue JSC_HOST_CALL functionGetPID(ExecState*)
+{
+    return JSValue::encode(jsNumber(getpid()));
+}
+#endif
+
+void JSDollarVMPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    
+    addFunction(vm, globalObject, "crash", functionCrash, 0);
+    
+    putDirectNativeFunction(vm, globalObject, Identifier::fromString(&vm, "dfgTrue"), 0, functionDFGTrue, DFGTrueIntrinsic, DontEnum);
+    
+    addFunction(vm, globalObject, "llintTrue", functionLLintTrue, 0);
+    addFunction(vm, globalObject, "jitTrue", functionJITTrue, 0);
+    
+    addFunction(vm, globalObject, "gc", functionGC, 0);
+    addFunction(vm, globalObject, "edenGC", functionEdenGC, 0);
+    
+    addFunction(vm, globalObject, "codeBlockFor", functionCodeBlockFor, 1);
+    addFunction(vm, globalObject, "codeBlockForFrame", functionCodeBlockForFrame, 1);
+    addFunction(vm, globalObject, "printSourceFor", functionPrintSourceFor, 1);
+    addFunction(vm, globalObject, "printByteCodeFor", functionPrintByteCodeFor, 1);
+    
+    addFunction(vm, globalObject, "print", functionPrint, 1);
+    addFunction(vm, globalObject, "printCallFrame", functionPrintCallFrame, 0);
+    addFunction(vm, globalObject, "printStack", functionPrintStack, 0);
+
+    addFunction(vm, globalObject, "value", functionValue, 1);
+#if !PLATFORM(WIN)
+    addFunction(vm, globalObject, "getpid", functionGetPID, 0);
+#endif
+}
+
+} // namespace JSC
diff --git a/tools/JSDollarVMPrototype.h b/tools/JSDollarVMPrototype.h
new file mode 100644
index 0000000..788e267
--- /dev/null
+++ b/tools/JSDollarVMPrototype.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class Heap;
+
+class JSDollarVMPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    DECLARE_INFO;
+
+    static JSDollarVMPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    {
+        JSDollarVMPrototype* prototype = new (NotNull, allocateCell<JSDollarVMPrototype>(vm.heap)) JSDollarVMPrototype(vm, structure);
+        prototype->finishCreation(vm, globalObject);
+        return prototype;
+    }
+    
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    // The following are exported because they are designed to be callable from
+    // lldb. The JS versions are implemented on top of these.
+    
+    JS_EXPORT_PRIVATE static bool currentThreadOwnsJSLock(ExecState*);
+    JS_EXPORT_PRIVATE static void gc(ExecState*);
+    JS_EXPORT_PRIVATE static void edenGC(ExecState*);
+    JS_EXPORT_PRIVATE static bool isInHeap(Heap*, void*);
+    JS_EXPORT_PRIVATE static bool isInObjectSpace(Heap*, void*);
+    JS_EXPORT_PRIVATE static bool isInStorageSpace(Heap*, void*);
+    JS_EXPORT_PRIVATE static bool isValidCell(Heap*, JSCell*);
+    JS_EXPORT_PRIVATE static bool isValidCodeBlock(ExecState*, CodeBlock*);
+    JS_EXPORT_PRIVATE static CodeBlock* codeBlockForFrame(CallFrame* topCallFrame, unsigned frameNumber);
+    JS_EXPORT_PRIVATE static void printCallFrame(CallFrame*);
+    JS_EXPORT_PRIVATE static void printStack(CallFrame* topCallFrame);
+    JS_EXPORT_PRIVATE static void printValue(JSValue);
+
+private:
+    JSDollarVMPrototype(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    void finishCreation(VM&, JSGlobalObject*);
+    void addFunction(VM&, JSGlobalObject*, const char* name, NativeFunction, unsigned arguments);
+};
+
+} // namespace JSC
diff --git a/tools/ProfileTreeNode.h b/tools/ProfileTreeNode.h
new file mode 100644
index 0000000..18fea77
--- /dev/null
+++ b/tools/ProfileTreeNode.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+namespace JSC {
+
+class ProfileTreeNode {
+    typedef HashMap<String, ProfileTreeNode> Map;
+    typedef Map::KeyValuePairType MapEntry;
+
+public:
+    ProfileTreeNode()
+        : m_count(0)
+        , m_children(0)
+    {
+    }
+
+    ~ProfileTreeNode()
+    {
+        delete m_children;
+    }
+
+    ProfileTreeNode* sampleChild(const char* name)
+    {
+        if (!m_children)
+            m_children = new Map();
+    
+        ProfileTreeNode newEntry;
+        Map::AddResult result = m_children->add(String(name), newEntry);
+        ProfileTreeNode* childInMap = &result.iterator->value;
+        ++childInMap->m_count;
+        return childInMap;
+    }
+
+    void dump()
+    {
+        dumpInternal(0);
+    }
+
+    uint64_t count()
+    {
+        return m_count;
+    }
+
+    uint64_t childCount()
+    {
+        if (!m_children)
+            return 0;
+        uint64_t childCount = 0;
+        for (Map::iterator it = m_children->begin(); it != m_children->end(); ++it)
+            childCount += it->value.count();
+        return childCount;
+    }
+    
+private:
+    void dumpInternal(unsigned indent)
+    {
+        if (!m_children)
+            return;
+
+        // Copy pointers to all children into a vector, and sort the vector by sample count.
+        Vector<MapEntry*> entries;
+        for (Map::iterator it = m_children->begin(); it != m_children->end(); ++it)
+            entries.append(&*it);
+        qsort(entries.begin(), entries.size(), sizeof(MapEntry*), compareEntries);
+
+        // Iterate over the children in sample-frequency order.
+        for (size_t e = 0; e < entries.size(); ++e) {
+            MapEntry* entry = entries[e];
+
+            // Print the number of samples, the name of this node, and the number of samples that are stack-top
+            // in this node (samples directly within this node, excluding samples in children.
+            for (unsigned i = 0; i < indent; ++i)
+                dataLogF("    ");
+            dataLogF("% 8lld: %s (%lld stack top)\n",
+                static_cast<long long>(entry->value.count()),
+                entry->key.utf8().data(),
+                static_cast<long long>(entry->value.count() - entry->value.childCount()));
+
+            // Recursively dump the child nodes.
+            entry->value.dumpInternal(indent + 1);
+        }
+    }
+
+    static int compareEntries(const void* a, const void* b)
+    {
+        uint64_t da = (*static_cast<MapEntry* const *>(a))->value.count();
+        uint64_t db = (*static_cast<MapEntry* const *>(b))->value.count();
+        return (da < db) - (da > db);
+    }
+
+    uint64_t m_count;
+    Map* m_children;
+};
+
+} // namespace JSC
diff --git a/tools/SigillCrashAnalyzer.cpp b/tools/SigillCrashAnalyzer.cpp
new file mode 100644
index 0000000..d2d9d89
--- /dev/null
+++ b/tools/SigillCrashAnalyzer.cpp
@@ -0,0 +1,353 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SigillCrashAnalyzer.h"
+
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "VMInspector.h"
+#include <mutex>
+#include <wtf/StdLibExtras.h>
+
+#if USE(ARM64_DISASSEMBLER)
+#include "A64DOpcode.h"
+#endif
+
+#if HAVE(SIGNAL_H)
+#include <signal.h>
+#endif
+
+namespace JSC {
+
+struct SignalContext;
+
+class SigillCrashAnalyzer {
+public:
+    static SigillCrashAnalyzer& instance();
+    void analyze(SignalContext&);
+
+private:
+    SigillCrashAnalyzer() { }
+    void dumpCodeBlock(CodeBlock*, void* machinePC);
+
+#if USE(ARM64_DISASSEMBLER)
+    A64DOpcode m_arm64Opcode;
+#endif
+};
+
+#if OS(DARWIN)
+
+#if USE(OS_LOG)
+
+#define log(format, ...) \
+    os_log_info(OS_LOG_DEFAULT, format, ##__VA_ARGS__)
+
+#else // USE(OS_LOG)
+
+#define log(format, ...) \
+    dataLogF(format, ##__VA_ARGS__)
+    
+#endif // USE(OS_LOG)
+
+#if CPU(X86_64)
+struct SignalContext {
+    SignalContext(mcontext_t& mcontext)
+        : mcontext(mcontext)
+        , machinePC(reinterpret_cast<void*>(mcontext->__ss.__rip))
+        , stackPointer(reinterpret_cast<void*>(mcontext->__ss.__rsp))
+        , framePointer(reinterpret_cast<CallFrame*>(mcontext->__ss.__rbp))
+    { }
+
+    void dump()
+    {
+#define FOR_EACH_REGISTER(v) \
+        v(rax) \
+        v(rbx) \
+        v(rcx) \
+        v(rdx) \
+        v(rdi) \
+        v(rsi) \
+        v(rbp) \
+        v(rsp) \
+        v(r8) \
+        v(r9) \
+        v(r10) \
+        v(r11) \
+        v(r12) \
+        v(r13) \
+        v(r14) \
+        v(r15) \
+        v(rip) \
+        v(rflags) \
+        v(cs) \
+        v(fs) \
+        v(gs)
+
+#define DUMP_REGISTER(__reg) \
+        log("Register " #__reg ": %p", reinterpret_cast<void*>(mcontext->__ss.__##__reg));
+        FOR_EACH_REGISTER(DUMP_REGISTER)
+#undef FOR_EACH_REGISTER
+    }
+
+    mcontext_t& mcontext;
+    void* machinePC;
+    void* stackPointer;
+    void* framePointer;
+};
+
+#elif CPU(ARM64)
+
+struct SignalContext {
+    SignalContext(mcontext_t& mcontext)
+        : mcontext(mcontext)
+        , machinePC(reinterpret_cast<void*>(mcontext->__ss.__pc))
+        , stackPointer(reinterpret_cast<void*>(mcontext->__ss.__sp))
+        , framePointer(reinterpret_cast<CallFrame*>(mcontext->__ss.__fp))
+    { }
+
+    void dump()
+    {
+        int i;
+        for (i = 0; i < 28; i += 4) {
+            log("x%d: %016llx x%d: %016llx x%d: %016llx x%d: %016llx",
+                i, mcontext->__ss.__x[i],
+                i+1, mcontext->__ss.__x[i+1],
+                i+2, mcontext->__ss.__x[i+2],
+                i+3, mcontext->__ss.__x[i+3]);
+        }
+        ASSERT(i < 29);
+        log("x%d: %016llx fp: %016llx lr: %016llx",
+            i, mcontext->__ss.__x[i], mcontext->__ss.__fp, mcontext->__ss.__lr);
+        log("sp: %016llx pc: %016llx cpsr: %08x",
+            mcontext->__ss.__sp, mcontext->__ss.__pc, mcontext->__ss.__cpsr);
+    }
+
+    mcontext_t& mcontext;
+    void* machinePC;
+    void* stackPointer;
+    void* framePointer;
+};
+
+#else
+
+struct SignalContext {
+    SignalContext(mcontext_t&) { }
+    
+    void dump() { }
+    
+    void* machinePC;
+    void* stackPointer;
+    void* framePointer;
+};
+    
+#endif
+
+struct sigaction oldSigIllAction;
+
+static void handleCrash(int, siginfo_t*, void* uap)
+{
+    sigaction(SIGILL, &oldSigIllAction, nullptr);
+
+    SignalContext context(static_cast<ucontext_t*>(uap)->uc_mcontext);
+    SigillCrashAnalyzer& analyzer = SigillCrashAnalyzer::instance();
+    analyzer.analyze(context);
+}
+
+static void installCrashHandler()
+{
+#if CPU(X86_64) || CPU(ARM64)
+    struct sigaction action;
+    action.sa_sigaction = reinterpret_cast<void (*)(int, siginfo_t *, void *)>(handleCrash);
+    sigfillset(&action.sa_mask);
+    action.sa_flags = SA_SIGINFO;
+    sigaction(SIGILL, &action, &oldSigIllAction);
+#else
+    UNUSED_PARAM(handleCrash);
+#endif
+}
+
+#else // OS(DARWIN)
+
+#define log(format, ...) do { } while (false)
+    
+struct SignalContext {
+    SignalContext() { }
+
+    void dump() { }
+
+    void* machinePC;
+    void* stackPointer;
+    void* framePointer;
+};
+
+static void installCrashHandler()
+{
+    // Do nothing. Not supported for this platform.
+}
+
+#endif // OS(DARWIN)
+
+SigillCrashAnalyzer& SigillCrashAnalyzer::instance()
+{
+    static SigillCrashAnalyzer* analyzer;
+    static std::once_flag once;
+    std::call_once(once, [] {
+        installCrashHandler();
+        analyzer = new SigillCrashAnalyzer;
+    });
+    return *analyzer;
+}
+
+void enableSigillCrashAnalyzer()
+{
+    // Just instantiating the SigillCrashAnalyzer will enable it.
+    SigillCrashAnalyzer::instance();
+}
+
+void SigillCrashAnalyzer::analyze(SignalContext& context)
+{
+    log("BEGIN SIGILL analysis");
+
+    [&] () {
+        // First, dump the signal context info so that we'll at least have the same info
+        // that the default crash handler would given us in case this crash analyzer
+        // itself crashes.
+        context.dump();
+
+        VMInspector& inspector = VMInspector::instance();
+
+        // Use a timeout period of 2 seconds. The client is about to crash, and we don't
+        // want to turn the crash into a hang by re-trying the lock for too long.
+        auto expectedLockToken = inspector.lock(Seconds(2));
+        if (!expectedLockToken) {
+            ASSERT(expectedLockToken.error() == VMInspector::Error::TimedOut);
+            log("ERROR: Unable to analyze SIGILL. Timed out while waiting to iterate VMs.");
+            return;
+        }
+        auto lockToken = expectedLockToken.value();
+
+        void* pc = context.machinePC;
+        auto isInJITMemory = inspector.isValidExecutableMemory(lockToken, pc);
+        if (!isInJITMemory) {
+            log("ERROR: Timed out: not able to determine if pc %p is in valid JIT executable memory", pc);
+            return;
+        }
+        if (!isInJITMemory.value()) {
+            log("pc %p is NOT in valid JIT executable memory", pc);
+            return;
+        }
+        log("pc %p is in valid JIT executable memory", pc);
+
+#if CPU(ARM64)
+        size_t pcAsSize = reinterpret_cast<size_t>(pc);
+        if (pcAsSize != roundUpToMultipleOf<sizeof(uint32_t)>(pcAsSize)) {
+            log("pc %p is NOT properly aligned", pc);
+            return;
+        }
+
+        // We know it's safe to read the word at the PC because we're handling a SIGILL.
+        // Otherwise, we would have crashed with a SIGBUS instead.
+        uint32_t wordAtPC = *reinterpret_cast<uint32_t*>(pc);
+        log("instruction bits at pc %p is: 0x%08x", pc, wordAtPC);
+#endif
+
+        auto expectedCodeBlock = inspector.codeBlockForMachinePC(lockToken, pc);
+        if (!expectedCodeBlock) {
+            if (expectedCodeBlock.error() == VMInspector::Error::TimedOut)
+                log("ERROR: Timed out: not able to determine if pc %p is in a valid CodeBlock", pc);
+            else
+                log("The current thread does not own any VM JSLock");
+            return;
+        }
+        CodeBlock* codeBlock = expectedCodeBlock.value();
+        if (!codeBlock) {
+            log("machine PC %p does not belong to any CodeBlock in the currently entered VM", pc);
+            return;
+        }
+
+        log("pc %p belongs to CodeBlock %p of type %s", pc, codeBlock, JITCode::typeName(codeBlock->jitType()));
+
+        dumpCodeBlock(codeBlock, pc);
+    } ();
+
+    log("END SIGILL analysis");
+}
+
+void SigillCrashAnalyzer::dumpCodeBlock(CodeBlock* codeBlock, void* machinePC)
+{
+#if CPU(ARM64)
+    JITCode* jitCode = codeBlock->jitCode().get();
+
+    // Dump the raw bits of the code.
+    uint32_t* start = reinterpret_cast<uint32_t*>(jitCode->start());
+    uint32_t* end = reinterpret_cast<uint32_t*>(jitCode->end());
+    log("JITCode %p [%p-%p]:", jitCode, start, end);
+    if (start < end) {
+        uint32_t* p = start;
+        while (p + 8 <= end) {
+            log("[%p-%p]: %08x %08x %08x %08x %08x %08x %08x %08x", p, p+7, p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
+            p += 8;
+        }
+        if (p + 7 <= end)
+            log("[%p-%p]: %08x %08x %08x %08x %08x %08x %08x", p, p+6, p[0], p[1], p[2], p[3], p[4], p[5], p[6]);
+        else if (p + 6 <= end)
+            log("[%p-%p]: %08x %08x %08x %08x %08x %08x", p, p+5, p[0], p[1], p[2], p[3], p[4], p[5]);
+        else if (p + 5 <= end)
+            log("[%p-%p]: %08x %08x %08x %08x %08x", p, p+4, p[0], p[1], p[2], p[3], p[4]);
+        else if (p + 4 <= end)
+            log("[%p-%p]: %08x %08x %08x %08x", p, p+3, p[0], p[1], p[2], p[3]);
+        if (p + 3 <= end)
+            log("[%p-%p]: %08x %08x %08x", p, p+2, p[0], p[1], p[2]);
+        else if (p + 2 <= end)
+            log("[%p-%p]: %08x %08x", p, p+1, p[0], p[1]);
+        else if (p + 1 <= end)
+            log("[%p-%p]: %08x", p, p, p[0]);
+    }
+
+    // Dump the disassembly of the code.
+    log("Disassembly:");
+    uint32_t* currentPC = reinterpret_cast<uint32_t*>(jitCode->executableAddress());
+    size_t byteCount = jitCode->size();
+    while (byteCount) {
+        char pcString[24];
+        if (currentPC == machinePC) {
+            snprintf(pcString, sizeof(pcString), "* 0x%lx", reinterpret_cast<unsigned long>(currentPC));
+            log("%20s: %s    <=========================", pcString, m_arm64Opcode.disassemble(currentPC));
+        } else {
+            snprintf(pcString, sizeof(pcString), "0x%lx", reinterpret_cast<unsigned long>(currentPC));
+            log("%20s: %s", pcString, m_arm64Opcode.disassemble(currentPC));
+        }
+        currentPC++;
+        byteCount -= sizeof(uint32_t);
+    }
+#else
+    UNUSED_PARAM(codeBlock);
+    UNUSED_PARAM(machinePC);
+    // Not implemented yet.
+#endif
+}
+
+} // namespace JSC
diff --git a/tools/SigillCrashAnalyzer.h b/tools/SigillCrashAnalyzer.h
new file mode 100644
index 0000000..a36b82f
--- /dev/null
+++ b/tools/SigillCrashAnalyzer.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+// Enables the SIGILL crash analyzer. This is a one way trip. There's no going back.
+void enableSigillCrashAnalyzer();
+
+} // namespace JSC
diff --git a/tools/TieredMMapArray.h b/tools/TieredMMapArray.h
new file mode 100644
index 0000000..1418292
--- /dev/null
+++ b/tools/TieredMMapArray.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/OSAllocator.h>
+
+namespace JSC {
+
+// This class implements a simple array class that can be grown by appending items to the end.
+// This class is implemented purely in terms of system allocations, with no malloc/free, so that
+// it can safely be used from a secondary thread whilst the main thrad is paused (potentially
+// holding the fast malloc heap lock).
+template<typename T>
+class TieredMMapArray {
+    static const size_t entriesPerBlock = 4096;
+
+public:
+    TieredMMapArray()
+        : m_directoryCount(4096)
+        , m_directory(static_cast<T**>(OSAllocator::reserveAndCommit(m_directoryCount * sizeof(T*))))
+        , m_size(0)
+    {
+        for (size_t block = 0; block < m_directoryCount; ++block)
+            m_directory[block] = 0;
+    }
+
+    ~TieredMMapArray()
+    {
+        size_t usedCount = (m_size + (entriesPerBlock - 1)) / entriesPerBlock;
+        ASSERT(usedCount == m_directoryCount || !m_directory[usedCount]);
+
+        for (size_t block = 0; block < usedCount; ++block) {
+            ASSERT(m_directory[block]);
+            OSAllocator::decommitAndRelease(m_directory[block], entriesPerBlock * sizeof(T));
+        }
+
+        OSAllocator::decommitAndRelease(m_directory, m_directoryCount * sizeof(T*));
+    }
+
+    T& operator[](size_t index)
+    {
+        ASSERT(index < m_size);
+        size_t block = index / entriesPerBlock;
+        size_t offset = index % entriesPerBlock;
+
+        ASSERT(m_directory[block]);
+        return m_directory[block][offset];
+    }
+
+    void append(const T& value)
+    {
+        // Check if the array is completely full, if so create more capacity in the directory.
+        if (m_size == m_directoryCount * entriesPerBlock) {
+            // Reallocate the directory.
+            size_t oldDirectorySize = m_directoryCount * sizeof(T*);
+            size_t newDirectorySize = oldDirectorySize * 2;
+            RELEASE_ASSERT(newDirectorySize < oldDirectorySize);
+            m_directory = OSAllocator::reallocateCommitted(m_directory, oldDirectorySize, newDirectorySize);
+
+            // 
+            size_t newDirectoryCount = m_directoryCount * 2;
+            for (size_t block = m_directoryCount; block < newDirectoryCount; ++block)
+                m_directory[block] = 0;
+            m_directoryCount = newDirectoryCount;
+        }
+
+        size_t index = m_size;
+        size_t block = index / entriesPerBlock;
+        size_t offset = index % entriesPerBlock;
+
+        if (!offset) {
+            ASSERT(!m_directory[block]);
+            m_directory[block] = static_cast<T*>(OSAllocator::reserveAndCommit(entriesPerBlock * sizeof(T)));
+        }
+
+        ASSERT(m_directory[block]);
+        ++m_size;
+        m_directory[block][offset] = value;
+    }
+
+    size_t size() const { return m_size; }
+
+private:
+    size_t m_directoryCount;
+    T** m_directory;
+    size_t m_size;
+};
+
+} // namespace JSC
diff --git a/tools/VMInspector.cpp b/tools/VMInspector.cpp
new file mode 100644
index 0000000..b760bd9
--- /dev/null
+++ b/tools/VMInspector.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "VMInspector.h"
+
+#include "CodeBlock.h"
+#include "CodeBlockSet.h"
+#include "HeapInlines.h"
+#include <mutex>
+#include <wtf/Expected.h>
+
+#if !OS(WINDOWS)
+#include <unistd.h>
+#endif
+
+namespace JSC {
+
+VMInspector& VMInspector::instance()
+{
+    static VMInspector* manager;
+    static std::once_flag once;
+    std::call_once(once, [] {
+        manager = new VMInspector();
+    });
+    return *manager;
+}
+
+void VMInspector::add(VM* vm)
+{
+    auto locker = holdLock(m_lock);
+    m_list.append(vm);
+}
+
+void VMInspector::remove(VM* vm)
+{
+    auto locker = holdLock(m_lock);
+    m_list.remove(vm);
+}
+
+auto VMInspector::lock(Seconds timeout) -> Expected<LockToken, Error>
+{
+    // This function may be called from a signal handler (e.g. via visit()). Hence,
+    // it should only use APIs that are safe to call from signal handlers. This is
+    // why we use unistd.h's sleep() instead of its alternatives.
+
+    // We'll be doing sleep(1) between tries below. Hence, sleepPerRetry is 1.
+    unsigned maxRetries = (timeout < Seconds::infinity()) ? timeout.value() : UINT_MAX;
+
+    bool locked = m_lock.tryLock();
+    unsigned tryCount = 0;
+    while (!locked && tryCount < maxRetries) {
+        // We want the version of sleep from unistd.h. Cast to disambiguate.
+#if !OS(WINDOWS)
+        (static_cast<unsigned (*)(unsigned)>(sleep))(1);
+#endif
+        locked = m_lock.tryLock();
+    }
+
+    if (!locked)
+        return makeUnexpected(Error::TimedOut);
+    return LockToken::LockedValue;
+}
+
+#if ENABLE(JIT)
+static bool ensureIsSafeToLock(Lock& lock)
+{
+    unsigned maxRetries = 2;
+    unsigned tryCount = 0;
+    while (tryCount <= maxRetries) {
+        bool success = lock.tryLock();
+        if (success) {
+            lock.unlock();
+            return true;
+        }
+        tryCount++;
+    }
+    return false;
+};
+#endif // ENABLE(JIT)
+
+auto VMInspector::isValidExecutableMemory(VMInspector::LockToken, void* machinePC) -> Expected<bool, Error>
+{
+#if ENABLE(JIT)
+    bool found = false;
+    bool hasTimeout = false;
+    iterate([&] (VM& vm) -> FunctorStatus {
+        auto allocator = vm.executableAllocator;
+        auto& lock = allocator.getLock();
+
+        bool isSafeToLock = ensureIsSafeToLock(lock);
+        if (!isSafeToLock) {
+            hasTimeout = true;
+            return FunctorStatus::Continue; // Skip this VM.
+        }
+
+        LockHolder executableAllocatorLocker(lock);
+        if (allocator.isValidExecutableMemory(executableAllocatorLocker, machinePC)) {
+            found = true;
+            return FunctorStatus::Done;
+        }
+        return FunctorStatus::Continue;
+    });
+
+    if (!found && hasTimeout)
+        return makeUnexpected(Error::TimedOut);
+    return found;
+#else
+    UNUSED_PARAM(machinePC);
+    return false;
+#endif
+}
+
+auto VMInspector::codeBlockForMachinePC(VMInspector::LockToken, void* machinePC) -> Expected<CodeBlock*, Error>
+{
+#if ENABLE(JIT)
+    CodeBlock* codeBlock = nullptr;
+    bool hasTimeout = false;
+    iterate([&] (VM& vm) {
+        if (!vm.apiLock().currentThreadIsHoldingLock())
+            return FunctorStatus::Continue;
+
+        // It is safe to call Heap::forEachCodeBlockIgnoringJITPlans here because:
+        // 1. CodeBlocks are added to the CodeBlockSet from the main thread before
+        //    they are handed to the JIT plans. Those codeBlocks will have a null jitCode,
+        //    but we check for that in our lambda functor.
+        // 2. CodeBlockSet::iterate() will acquire the CodeBlockSet lock before iterating.
+        //    This ensures that a CodeBlock won't be GCed while we're iterating.
+        // 3. We do a tryLock on the CodeBlockSet's lock first to ensure that it is
+        //    safe for the current thread to lock it before calling
+        //    Heap::forEachCodeBlockIgnoringJITPlans(). Hence, there's no risk of
+        //    re-entering the lock and deadlocking on it.
+
+        auto& lock = vm.heap.codeBlockSet().getLock();
+        bool isSafeToLock = ensureIsSafeToLock(lock);
+        if (!isSafeToLock) {
+            hasTimeout = true;
+            return FunctorStatus::Continue; // Skip this VM.
+        }
+
+        vm.heap.forEachCodeBlockIgnoringJITPlans([&] (CodeBlock* cb) {
+            JITCode* jitCode = cb->jitCode().get();
+            if (!jitCode) {
+                // If the codeBlock is a replacement codeBlock which is in the process of being
+                // compiled, its jitCode will be null, and we can disregard it as a match for
+                // the machinePC we're searching for.
+                return false;
+            }
+
+            if (!JITCode::isJIT(jitCode->jitType()))
+                return false;
+
+            if (jitCode->contains(machinePC)) {
+                codeBlock = cb;
+                return true;
+            }
+            return false;
+        });
+        if (codeBlock)
+            return FunctorStatus::Done;
+        return FunctorStatus::Continue;
+    });
+
+    if (!codeBlock && hasTimeout)
+        return makeUnexpected(Error::TimedOut);
+    return codeBlock;
+#else
+    UNUSED_PARAM(machinePC);
+    return nullptr;
+#endif
+}
+
+} // namespace JSC
diff --git a/tools/VMInspector.h b/tools/VMInspector.h
new file mode 100644
index 0000000..9209149
--- /dev/null
+++ b/tools/VMInspector.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "VM.h"
+#include <wtf/DoublyLinkedList.h>
+#include <wtf/Expected.h>
+#include <wtf/Lock.h>
+
+namespace JSC {
+
+class VMInspector {
+public:
+    enum class Error {
+        None,
+        TimedOut
+    };
+
+    enum class LockToken { LockedValue };
+
+    static VMInspector& instance();
+
+    void add(VM*);
+    void remove(VM*);
+
+    Expected<LockToken, Error> lock(Seconds timeout = Seconds::infinity());
+
+    Expected<bool, Error> isValidExecutableMemory(LockToken, void*);
+    Expected<CodeBlock*, Error> codeBlockForMachinePC(LockToken, void*);
+
+private:
+    enum class FunctorStatus {
+        Continue,
+        Done
+    };
+    template <typename Functor> void iterate(const Functor& functor)
+    {
+        for (VM* vm = m_list.head(); vm; vm = vm->next()) {
+            FunctorStatus status = functor(*vm);
+            if (status == FunctorStatus::Done)
+                return;
+        }
+    }
+
+    Lock m_lock;
+    DoublyLinkedList<VM> m_list;
+};
+
+} // namespace JSC
diff --git a/ucd/CaseFolding.txt b/ucd/CaseFolding.txt
new file mode 100644
index 0000000..0197a6c
--- /dev/null
+++ b/ucd/CaseFolding.txt
@@ -0,0 +1,1414 @@
+# CaseFolding-8.0.0.txt
+# Date: 2015-01-13, 18:16:36 GMT [MD]
+#
+# Unicode Character Database
+# Copyright (c) 1991-2015 Unicode, Inc.
+# For terms of use, see http://www.unicode.org/terms_of_use.html
+# For documentation, see http://www.unicode.org/reports/tr44/
+#
+# Case Folding Properties
+#
+# This file is a supplement to the UnicodeData file.
+# It provides a case folding mapping generated from the Unicode Character Database.
+# If all characters are mapped according to the full mapping below, then
+# case differences (according to UnicodeData.txt and SpecialCasing.txt)
+# are eliminated.
+#
+# The data supports both implementations that require simple case foldings
+# (where string lengths don't change), and implementations that allow full case folding
+# (where string lengths may grow). Note that where they can be supported, the
+# full case foldings are superior: for example, they allow "MASSE" and "Maße" to match.
+#
+# All code points not listed in this file map to themselves.
+#
+# NOTE: case folding does not preserve normalization formats!
+#
+# For information on case folding, including how to have case folding 
+# preserve normalization formats, see Section 3.13 Default Case Algorithms in
+# The Unicode Standard.
+#
+# ================================================================================
+# Format
+# ================================================================================
+# The entries in this file are in the following machine-readable format:
+#
+# <code>; <status>; <mapping>; # <name>
+#
+# The status field is:
+# C: common case folding, common mappings shared by both simple and full mappings.
+# F: full case folding, mappings that cause strings to grow in length. Multiple characters are separated by spaces.
+# S: simple case folding, mappings to single characters where different from F.
+# T: special case for uppercase I and dotted uppercase I
+#    - For non-Turkic languages, this mapping is normally not used.
+#    - For Turkic languages (tr, az), this mapping can be used instead of the normal mapping for these characters.
+#      Note that the Turkic mappings do not maintain canonical equivalence without additional processing.
+#      See the discussions of case mapping in the Unicode Standard for more information.
+#
+# Usage:
+#  A. To do a simple case folding, use the mappings with status C + S.
+#  B. To do a full case folding, use the mappings with status C + F.
+#
+#    The mappings with status T can be used or omitted depending on the desired case-folding
+#    behavior. (The default option is to exclude them.)
+#
+# =================================================================
+
+# Property: Case_Folding
+
+#  All code points not explicitly listed for Case_Folding
+#  have the value C for the status field, and the code point itself for the mapping field.
+
+# =================================================================
+0041; C; 0061; # LATIN CAPITAL LETTER A
+0042; C; 0062; # LATIN CAPITAL LETTER B
+0043; C; 0063; # LATIN CAPITAL LETTER C
+0044; C; 0064; # LATIN CAPITAL LETTER D
+0045; C; 0065; # LATIN CAPITAL LETTER E
+0046; C; 0066; # LATIN CAPITAL LETTER F
+0047; C; 0067; # LATIN CAPITAL LETTER G
+0048; C; 0068; # LATIN CAPITAL LETTER H
+0049; C; 0069; # LATIN CAPITAL LETTER I
+0049; T; 0131; # LATIN CAPITAL LETTER I
+004A; C; 006A; # LATIN CAPITAL LETTER J
+004B; C; 006B; # LATIN CAPITAL LETTER K
+004C; C; 006C; # LATIN CAPITAL LETTER L
+004D; C; 006D; # LATIN CAPITAL LETTER M
+004E; C; 006E; # LATIN CAPITAL LETTER N
+004F; C; 006F; # LATIN CAPITAL LETTER O
+0050; C; 0070; # LATIN CAPITAL LETTER P
+0051; C; 0071; # LATIN CAPITAL LETTER Q
+0052; C; 0072; # LATIN CAPITAL LETTER R
+0053; C; 0073; # LATIN CAPITAL LETTER S
+0054; C; 0074; # LATIN CAPITAL LETTER T
+0055; C; 0075; # LATIN CAPITAL LETTER U
+0056; C; 0076; # LATIN CAPITAL LETTER V
+0057; C; 0077; # LATIN CAPITAL LETTER W
+0058; C; 0078; # LATIN CAPITAL LETTER X
+0059; C; 0079; # LATIN CAPITAL LETTER Y
+005A; C; 007A; # LATIN CAPITAL LETTER Z
+00B5; C; 03BC; # MICRO SIGN
+00C0; C; 00E0; # LATIN CAPITAL LETTER A WITH GRAVE
+00C1; C; 00E1; # LATIN CAPITAL LETTER A WITH ACUTE
+00C2; C; 00E2; # LATIN CAPITAL LETTER A WITH CIRCUMFLEX
+00C3; C; 00E3; # LATIN CAPITAL LETTER A WITH TILDE
+00C4; C; 00E4; # LATIN CAPITAL LETTER A WITH DIAERESIS
+00C5; C; 00E5; # LATIN CAPITAL LETTER A WITH RING ABOVE
+00C6; C; 00E6; # LATIN CAPITAL LETTER AE
+00C7; C; 00E7; # LATIN CAPITAL LETTER C WITH CEDILLA
+00C8; C; 00E8; # LATIN CAPITAL LETTER E WITH GRAVE
+00C9; C; 00E9; # LATIN CAPITAL LETTER E WITH ACUTE
+00CA; C; 00EA; # LATIN CAPITAL LETTER E WITH CIRCUMFLEX
+00CB; C; 00EB; # LATIN CAPITAL LETTER E WITH DIAERESIS
+00CC; C; 00EC; # LATIN CAPITAL LETTER I WITH GRAVE
+00CD; C; 00ED; # LATIN CAPITAL LETTER I WITH ACUTE
+00CE; C; 00EE; # LATIN CAPITAL LETTER I WITH CIRCUMFLEX
+00CF; C; 00EF; # LATIN CAPITAL LETTER I WITH DIAERESIS
+00D0; C; 00F0; # LATIN CAPITAL LETTER ETH
+00D1; C; 00F1; # LATIN CAPITAL LETTER N WITH TILDE
+00D2; C; 00F2; # LATIN CAPITAL LETTER O WITH GRAVE
+00D3; C; 00F3; # LATIN CAPITAL LETTER O WITH ACUTE
+00D4; C; 00F4; # LATIN CAPITAL LETTER O WITH CIRCUMFLEX
+00D5; C; 00F5; # LATIN CAPITAL LETTER O WITH TILDE
+00D6; C; 00F6; # LATIN CAPITAL LETTER O WITH DIAERESIS
+00D8; C; 00F8; # LATIN CAPITAL LETTER O WITH STROKE
+00D9; C; 00F9; # LATIN CAPITAL LETTER U WITH GRAVE
+00DA; C; 00FA; # LATIN CAPITAL LETTER U WITH ACUTE
+00DB; C; 00FB; # LATIN CAPITAL LETTER U WITH CIRCUMFLEX
+00DC; C; 00FC; # LATIN CAPITAL LETTER U WITH DIAERESIS
+00DD; C; 00FD; # LATIN CAPITAL LETTER Y WITH ACUTE
+00DE; C; 00FE; # LATIN CAPITAL LETTER THORN
+00DF; F; 0073 0073; # LATIN SMALL LETTER SHARP S
+0100; C; 0101; # LATIN CAPITAL LETTER A WITH MACRON
+0102; C; 0103; # LATIN CAPITAL LETTER A WITH BREVE
+0104; C; 0105; # LATIN CAPITAL LETTER A WITH OGONEK
+0106; C; 0107; # LATIN CAPITAL LETTER C WITH ACUTE
+0108; C; 0109; # LATIN CAPITAL LETTER C WITH CIRCUMFLEX
+010A; C; 010B; # LATIN CAPITAL LETTER C WITH DOT ABOVE
+010C; C; 010D; # LATIN CAPITAL LETTER C WITH CARON
+010E; C; 010F; # LATIN CAPITAL LETTER D WITH CARON
+0110; C; 0111; # LATIN CAPITAL LETTER D WITH STROKE
+0112; C; 0113; # LATIN CAPITAL LETTER E WITH MACRON
+0114; C; 0115; # LATIN CAPITAL LETTER E WITH BREVE
+0116; C; 0117; # LATIN CAPITAL LETTER E WITH DOT ABOVE
+0118; C; 0119; # LATIN CAPITAL LETTER E WITH OGONEK
+011A; C; 011B; # LATIN CAPITAL LETTER E WITH CARON
+011C; C; 011D; # LATIN CAPITAL LETTER G WITH CIRCUMFLEX
+011E; C; 011F; # LATIN CAPITAL LETTER G WITH BREVE
+0120; C; 0121; # LATIN CAPITAL LETTER G WITH DOT ABOVE
+0122; C; 0123; # LATIN CAPITAL LETTER G WITH CEDILLA
+0124; C; 0125; # LATIN CAPITAL LETTER H WITH CIRCUMFLEX
+0126; C; 0127; # LATIN CAPITAL LETTER H WITH STROKE
+0128; C; 0129; # LATIN CAPITAL LETTER I WITH TILDE
+012A; C; 012B; # LATIN CAPITAL LETTER I WITH MACRON
+012C; C; 012D; # LATIN CAPITAL LETTER I WITH BREVE
+012E; C; 012F; # LATIN CAPITAL LETTER I WITH OGONEK
+0130; F; 0069 0307; # LATIN CAPITAL LETTER I WITH DOT ABOVE
+0130; T; 0069; # LATIN CAPITAL LETTER I WITH DOT ABOVE
+0132; C; 0133; # LATIN CAPITAL LIGATURE IJ
+0134; C; 0135; # LATIN CAPITAL LETTER J WITH CIRCUMFLEX
+0136; C; 0137; # LATIN CAPITAL LETTER K WITH CEDILLA
+0139; C; 013A; # LATIN CAPITAL LETTER L WITH ACUTE
+013B; C; 013C; # LATIN CAPITAL LETTER L WITH CEDILLA
+013D; C; 013E; # LATIN CAPITAL LETTER L WITH CARON
+013F; C; 0140; # LATIN CAPITAL LETTER L WITH MIDDLE DOT
+0141; C; 0142; # LATIN CAPITAL LETTER L WITH STROKE
+0143; C; 0144; # LATIN CAPITAL LETTER N WITH ACUTE
+0145; C; 0146; # LATIN CAPITAL LETTER N WITH CEDILLA
+0147; C; 0148; # LATIN CAPITAL LETTER N WITH CARON
+0149; F; 02BC 006E; # LATIN SMALL LETTER N PRECEDED BY APOSTROPHE
+014A; C; 014B; # LATIN CAPITAL LETTER ENG
+014C; C; 014D; # LATIN CAPITAL LETTER O WITH MACRON
+014E; C; 014F; # LATIN CAPITAL LETTER O WITH BREVE
+0150; C; 0151; # LATIN CAPITAL LETTER O WITH DOUBLE ACUTE
+0152; C; 0153; # LATIN CAPITAL LIGATURE OE
+0154; C; 0155; # LATIN CAPITAL LETTER R WITH ACUTE
+0156; C; 0157; # LATIN CAPITAL LETTER R WITH CEDILLA
+0158; C; 0159; # LATIN CAPITAL LETTER R WITH CARON
+015A; C; 015B; # LATIN CAPITAL LETTER S WITH ACUTE
+015C; C; 015D; # LATIN CAPITAL LETTER S WITH CIRCUMFLEX
+015E; C; 015F; # LATIN CAPITAL LETTER S WITH CEDILLA
+0160; C; 0161; # LATIN CAPITAL LETTER S WITH CARON
+0162; C; 0163; # LATIN CAPITAL LETTER T WITH CEDILLA
+0164; C; 0165; # LATIN CAPITAL LETTER T WITH CARON
+0166; C; 0167; # LATIN CAPITAL LETTER T WITH STROKE
+0168; C; 0169; # LATIN CAPITAL LETTER U WITH TILDE
+016A; C; 016B; # LATIN CAPITAL LETTER U WITH MACRON
+016C; C; 016D; # LATIN CAPITAL LETTER U WITH BREVE
+016E; C; 016F; # LATIN CAPITAL LETTER U WITH RING ABOVE
+0170; C; 0171; # LATIN CAPITAL LETTER U WITH DOUBLE ACUTE
+0172; C; 0173; # LATIN CAPITAL LETTER U WITH OGONEK
+0174; C; 0175; # LATIN CAPITAL LETTER W WITH CIRCUMFLEX
+0176; C; 0177; # LATIN CAPITAL LETTER Y WITH CIRCUMFLEX
+0178; C; 00FF; # LATIN CAPITAL LETTER Y WITH DIAERESIS
+0179; C; 017A; # LATIN CAPITAL LETTER Z WITH ACUTE
+017B; C; 017C; # LATIN CAPITAL LETTER Z WITH DOT ABOVE
+017D; C; 017E; # LATIN CAPITAL LETTER Z WITH CARON
+017F; C; 0073; # LATIN SMALL LETTER LONG S
+0181; C; 0253; # LATIN CAPITAL LETTER B WITH HOOK
+0182; C; 0183; # LATIN CAPITAL LETTER B WITH TOPBAR
+0184; C; 0185; # LATIN CAPITAL LETTER TONE SIX
+0186; C; 0254; # LATIN CAPITAL LETTER OPEN O
+0187; C; 0188; # LATIN CAPITAL LETTER C WITH HOOK
+0189; C; 0256; # LATIN CAPITAL LETTER AFRICAN D
+018A; C; 0257; # LATIN CAPITAL LETTER D WITH HOOK
+018B; C; 018C; # LATIN CAPITAL LETTER D WITH TOPBAR
+018E; C; 01DD; # LATIN CAPITAL LETTER REVERSED E
+018F; C; 0259; # LATIN CAPITAL LETTER SCHWA
+0190; C; 025B; # LATIN CAPITAL LETTER OPEN E
+0191; C; 0192; # LATIN CAPITAL LETTER F WITH HOOK
+0193; C; 0260; # LATIN CAPITAL LETTER G WITH HOOK
+0194; C; 0263; # LATIN CAPITAL LETTER GAMMA
+0196; C; 0269; # LATIN CAPITAL LETTER IOTA
+0197; C; 0268; # LATIN CAPITAL LETTER I WITH STROKE
+0198; C; 0199; # LATIN CAPITAL LETTER K WITH HOOK
+019C; C; 026F; # LATIN CAPITAL LETTER TURNED M
+019D; C; 0272; # LATIN CAPITAL LETTER N WITH LEFT HOOK
+019F; C; 0275; # LATIN CAPITAL LETTER O WITH MIDDLE TILDE
+01A0; C; 01A1; # LATIN CAPITAL LETTER O WITH HORN
+01A2; C; 01A3; # LATIN CAPITAL LETTER OI
+01A4; C; 01A5; # LATIN CAPITAL LETTER P WITH HOOK
+01A6; C; 0280; # LATIN LETTER YR
+01A7; C; 01A8; # LATIN CAPITAL LETTER TONE TWO
+01A9; C; 0283; # LATIN CAPITAL LETTER ESH
+01AC; C; 01AD; # LATIN CAPITAL LETTER T WITH HOOK
+01AE; C; 0288; # LATIN CAPITAL LETTER T WITH RETROFLEX HOOK
+01AF; C; 01B0; # LATIN CAPITAL LETTER U WITH HORN
+01B1; C; 028A; # LATIN CAPITAL LETTER UPSILON
+01B2; C; 028B; # LATIN CAPITAL LETTER V WITH HOOK
+01B3; C; 01B4; # LATIN CAPITAL LETTER Y WITH HOOK
+01B5; C; 01B6; # LATIN CAPITAL LETTER Z WITH STROKE
+01B7; C; 0292; # LATIN CAPITAL LETTER EZH
+01B8; C; 01B9; # LATIN CAPITAL LETTER EZH REVERSED
+01BC; C; 01BD; # LATIN CAPITAL LETTER TONE FIVE
+01C4; C; 01C6; # LATIN CAPITAL LETTER DZ WITH CARON
+01C5; C; 01C6; # LATIN CAPITAL LETTER D WITH SMALL LETTER Z WITH CARON
+01C7; C; 01C9; # LATIN CAPITAL LETTER LJ
+01C8; C; 01C9; # LATIN CAPITAL LETTER L WITH SMALL LETTER J
+01CA; C; 01CC; # LATIN CAPITAL LETTER NJ
+01CB; C; 01CC; # LATIN CAPITAL LETTER N WITH SMALL LETTER J
+01CD; C; 01CE; # LATIN CAPITAL LETTER A WITH CARON
+01CF; C; 01D0; # LATIN CAPITAL LETTER I WITH CARON
+01D1; C; 01D2; # LATIN CAPITAL LETTER O WITH CARON
+01D3; C; 01D4; # LATIN CAPITAL LETTER U WITH CARON
+01D5; C; 01D6; # LATIN CAPITAL LETTER U WITH DIAERESIS AND MACRON
+01D7; C; 01D8; # LATIN CAPITAL LETTER U WITH DIAERESIS AND ACUTE
+01D9; C; 01DA; # LATIN CAPITAL LETTER U WITH DIAERESIS AND CARON
+01DB; C; 01DC; # LATIN CAPITAL LETTER U WITH DIAERESIS AND GRAVE
+01DE; C; 01DF; # LATIN CAPITAL LETTER A WITH DIAERESIS AND MACRON
+01E0; C; 01E1; # LATIN CAPITAL LETTER A WITH DOT ABOVE AND MACRON
+01E2; C; 01E3; # LATIN CAPITAL LETTER AE WITH MACRON
+01E4; C; 01E5; # LATIN CAPITAL LETTER G WITH STROKE
+01E6; C; 01E7; # LATIN CAPITAL LETTER G WITH CARON
+01E8; C; 01E9; # LATIN CAPITAL LETTER K WITH CARON
+01EA; C; 01EB; # LATIN CAPITAL LETTER O WITH OGONEK
+01EC; C; 01ED; # LATIN CAPITAL LETTER O WITH OGONEK AND MACRON
+01EE; C; 01EF; # LATIN CAPITAL LETTER EZH WITH CARON
+01F0; F; 006A 030C; # LATIN SMALL LETTER J WITH CARON
+01F1; C; 01F3; # LATIN CAPITAL LETTER DZ
+01F2; C; 01F3; # LATIN CAPITAL LETTER D WITH SMALL LETTER Z
+01F4; C; 01F5; # LATIN CAPITAL LETTER G WITH ACUTE
+01F6; C; 0195; # LATIN CAPITAL LETTER HWAIR
+01F7; C; 01BF; # LATIN CAPITAL LETTER WYNN
+01F8; C; 01F9; # LATIN CAPITAL LETTER N WITH GRAVE
+01FA; C; 01FB; # LATIN CAPITAL LETTER A WITH RING ABOVE AND ACUTE
+01FC; C; 01FD; # LATIN CAPITAL LETTER AE WITH ACUTE
+01FE; C; 01FF; # LATIN CAPITAL LETTER O WITH STROKE AND ACUTE
+0200; C; 0201; # LATIN CAPITAL LETTER A WITH DOUBLE GRAVE
+0202; C; 0203; # LATIN CAPITAL LETTER A WITH INVERTED BREVE
+0204; C; 0205; # LATIN CAPITAL LETTER E WITH DOUBLE GRAVE
+0206; C; 0207; # LATIN CAPITAL LETTER E WITH INVERTED BREVE
+0208; C; 0209; # LATIN CAPITAL LETTER I WITH DOUBLE GRAVE
+020A; C; 020B; # LATIN CAPITAL LETTER I WITH INVERTED BREVE
+020C; C; 020D; # LATIN CAPITAL LETTER O WITH DOUBLE GRAVE
+020E; C; 020F; # LATIN CAPITAL LETTER O WITH INVERTED BREVE
+0210; C; 0211; # LATIN CAPITAL LETTER R WITH DOUBLE GRAVE
+0212; C; 0213; # LATIN CAPITAL LETTER R WITH INVERTED BREVE
+0214; C; 0215; # LATIN CAPITAL LETTER U WITH DOUBLE GRAVE
+0216; C; 0217; # LATIN CAPITAL LETTER U WITH INVERTED BREVE
+0218; C; 0219; # LATIN CAPITAL LETTER S WITH COMMA BELOW
+021A; C; 021B; # LATIN CAPITAL LETTER T WITH COMMA BELOW
+021C; C; 021D; # LATIN CAPITAL LETTER YOGH
+021E; C; 021F; # LATIN CAPITAL LETTER H WITH CARON
+0220; C; 019E; # LATIN CAPITAL LETTER N WITH LONG RIGHT LEG
+0222; C; 0223; # LATIN CAPITAL LETTER OU
+0224; C; 0225; # LATIN CAPITAL LETTER Z WITH HOOK
+0226; C; 0227; # LATIN CAPITAL LETTER A WITH DOT ABOVE
+0228; C; 0229; # LATIN CAPITAL LETTER E WITH CEDILLA
+022A; C; 022B; # LATIN CAPITAL LETTER O WITH DIAERESIS AND MACRON
+022C; C; 022D; # LATIN CAPITAL LETTER O WITH TILDE AND MACRON
+022E; C; 022F; # LATIN CAPITAL LETTER O WITH DOT ABOVE
+0230; C; 0231; # LATIN CAPITAL LETTER O WITH DOT ABOVE AND MACRON
+0232; C; 0233; # LATIN CAPITAL LETTER Y WITH MACRON
+023A; C; 2C65; # LATIN CAPITAL LETTER A WITH STROKE
+023B; C; 023C; # LATIN CAPITAL LETTER C WITH STROKE
+023D; C; 019A; # LATIN CAPITAL LETTER L WITH BAR
+023E; C; 2C66; # LATIN CAPITAL LETTER T WITH DIAGONAL STROKE
+0241; C; 0242; # LATIN CAPITAL LETTER GLOTTAL STOP
+0243; C; 0180; # LATIN CAPITAL LETTER B WITH STROKE
+0244; C; 0289; # LATIN CAPITAL LETTER U BAR
+0245; C; 028C; # LATIN CAPITAL LETTER TURNED V
+0246; C; 0247; # LATIN CAPITAL LETTER E WITH STROKE
+0248; C; 0249; # LATIN CAPITAL LETTER J WITH STROKE
+024A; C; 024B; # LATIN CAPITAL LETTER SMALL Q WITH HOOK TAIL
+024C; C; 024D; # LATIN CAPITAL LETTER R WITH STROKE
+024E; C; 024F; # LATIN CAPITAL LETTER Y WITH STROKE
+0345; C; 03B9; # COMBINING GREEK YPOGEGRAMMENI
+0370; C; 0371; # GREEK CAPITAL LETTER HETA
+0372; C; 0373; # GREEK CAPITAL LETTER ARCHAIC SAMPI
+0376; C; 0377; # GREEK CAPITAL LETTER PAMPHYLIAN DIGAMMA
+037F; C; 03F3; # GREEK CAPITAL LETTER YOT
+0386; C; 03AC; # GREEK CAPITAL LETTER ALPHA WITH TONOS
+0388; C; 03AD; # GREEK CAPITAL LETTER EPSILON WITH TONOS
+0389; C; 03AE; # GREEK CAPITAL LETTER ETA WITH TONOS
+038A; C; 03AF; # GREEK CAPITAL LETTER IOTA WITH TONOS
+038C; C; 03CC; # GREEK CAPITAL LETTER OMICRON WITH TONOS
+038E; C; 03CD; # GREEK CAPITAL LETTER UPSILON WITH TONOS
+038F; C; 03CE; # GREEK CAPITAL LETTER OMEGA WITH TONOS
+0390; F; 03B9 0308 0301; # GREEK SMALL LETTER IOTA WITH DIALYTIKA AND TONOS
+0391; C; 03B1; # GREEK CAPITAL LETTER ALPHA
+0392; C; 03B2; # GREEK CAPITAL LETTER BETA
+0393; C; 03B3; # GREEK CAPITAL LETTER GAMMA
+0394; C; 03B4; # GREEK CAPITAL LETTER DELTA
+0395; C; 03B5; # GREEK CAPITAL LETTER EPSILON
+0396; C; 03B6; # GREEK CAPITAL LETTER ZETA
+0397; C; 03B7; # GREEK CAPITAL LETTER ETA
+0398; C; 03B8; # GREEK CAPITAL LETTER THETA
+0399; C; 03B9; # GREEK CAPITAL LETTER IOTA
+039A; C; 03BA; # GREEK CAPITAL LETTER KAPPA
+039B; C; 03BB; # GREEK CAPITAL LETTER LAMDA
+039C; C; 03BC; # GREEK CAPITAL LETTER MU
+039D; C; 03BD; # GREEK CAPITAL LETTER NU
+039E; C; 03BE; # GREEK CAPITAL LETTER XI
+039F; C; 03BF; # GREEK CAPITAL LETTER OMICRON
+03A0; C; 03C0; # GREEK CAPITAL LETTER PI
+03A1; C; 03C1; # GREEK CAPITAL LETTER RHO
+03A3; C; 03C3; # GREEK CAPITAL LETTER SIGMA
+03A4; C; 03C4; # GREEK CAPITAL LETTER TAU
+03A5; C; 03C5; # GREEK CAPITAL LETTER UPSILON
+03A6; C; 03C6; # GREEK CAPITAL LETTER PHI
+03A7; C; 03C7; # GREEK CAPITAL LETTER CHI
+03A8; C; 03C8; # GREEK CAPITAL LETTER PSI
+03A9; C; 03C9; # GREEK CAPITAL LETTER OMEGA
+03AA; C; 03CA; # GREEK CAPITAL LETTER IOTA WITH DIALYTIKA
+03AB; C; 03CB; # GREEK CAPITAL LETTER UPSILON WITH DIALYTIKA
+03B0; F; 03C5 0308 0301; # GREEK SMALL LETTER UPSILON WITH DIALYTIKA AND TONOS
+03C2; C; 03C3; # GREEK SMALL LETTER FINAL SIGMA
+03CF; C; 03D7; # GREEK CAPITAL KAI SYMBOL
+03D0; C; 03B2; # GREEK BETA SYMBOL
+03D1; C; 03B8; # GREEK THETA SYMBOL
+03D5; C; 03C6; # GREEK PHI SYMBOL
+03D6; C; 03C0; # GREEK PI SYMBOL
+03D8; C; 03D9; # GREEK LETTER ARCHAIC KOPPA
+03DA; C; 03DB; # GREEK LETTER STIGMA
+03DC; C; 03DD; # GREEK LETTER DIGAMMA
+03DE; C; 03DF; # GREEK LETTER KOPPA
+03E0; C; 03E1; # GREEK LETTER SAMPI
+03E2; C; 03E3; # COPTIC CAPITAL LETTER SHEI
+03E4; C; 03E5; # COPTIC CAPITAL LETTER FEI
+03E6; C; 03E7; # COPTIC CAPITAL LETTER KHEI
+03E8; C; 03E9; # COPTIC CAPITAL LETTER HORI
+03EA; C; 03EB; # COPTIC CAPITAL LETTER GANGIA
+03EC; C; 03ED; # COPTIC CAPITAL LETTER SHIMA
+03EE; C; 03EF; # COPTIC CAPITAL LETTER DEI
+03F0; C; 03BA; # GREEK KAPPA SYMBOL
+03F1; C; 03C1; # GREEK RHO SYMBOL
+03F4; C; 03B8; # GREEK CAPITAL THETA SYMBOL
+03F5; C; 03B5; # GREEK LUNATE EPSILON SYMBOL
+03F7; C; 03F8; # GREEK CAPITAL LETTER SHO
+03F9; C; 03F2; # GREEK CAPITAL LUNATE SIGMA SYMBOL
+03FA; C; 03FB; # GREEK CAPITAL LETTER SAN
+03FD; C; 037B; # GREEK CAPITAL REVERSED LUNATE SIGMA SYMBOL
+03FE; C; 037C; # GREEK CAPITAL DOTTED LUNATE SIGMA SYMBOL
+03FF; C; 037D; # GREEK CAPITAL REVERSED DOTTED LUNATE SIGMA SYMBOL
+0400; C; 0450; # CYRILLIC CAPITAL LETTER IE WITH GRAVE
+0401; C; 0451; # CYRILLIC CAPITAL LETTER IO
+0402; C; 0452; # CYRILLIC CAPITAL LETTER DJE
+0403; C; 0453; # CYRILLIC CAPITAL LETTER GJE
+0404; C; 0454; # CYRILLIC CAPITAL LETTER UKRAINIAN IE
+0405; C; 0455; # CYRILLIC CAPITAL LETTER DZE
+0406; C; 0456; # CYRILLIC CAPITAL LETTER BYELORUSSIAN-UKRAINIAN I
+0407; C; 0457; # CYRILLIC CAPITAL LETTER YI
+0408; C; 0458; # CYRILLIC CAPITAL LETTER JE
+0409; C; 0459; # CYRILLIC CAPITAL LETTER LJE
+040A; C; 045A; # CYRILLIC CAPITAL LETTER NJE
+040B; C; 045B; # CYRILLIC CAPITAL LETTER TSHE
+040C; C; 045C; # CYRILLIC CAPITAL LETTER KJE
+040D; C; 045D; # CYRILLIC CAPITAL LETTER I WITH GRAVE
+040E; C; 045E; # CYRILLIC CAPITAL LETTER SHORT U
+040F; C; 045F; # CYRILLIC CAPITAL LETTER DZHE
+0410; C; 0430; # CYRILLIC CAPITAL LETTER A
+0411; C; 0431; # CYRILLIC CAPITAL LETTER BE
+0412; C; 0432; # CYRILLIC CAPITAL LETTER VE
+0413; C; 0433; # CYRILLIC CAPITAL LETTER GHE
+0414; C; 0434; # CYRILLIC CAPITAL LETTER DE
+0415; C; 0435; # CYRILLIC CAPITAL LETTER IE
+0416; C; 0436; # CYRILLIC CAPITAL LETTER ZHE
+0417; C; 0437; # CYRILLIC CAPITAL LETTER ZE
+0418; C; 0438; # CYRILLIC CAPITAL LETTER I
+0419; C; 0439; # CYRILLIC CAPITAL LETTER SHORT I
+041A; C; 043A; # CYRILLIC CAPITAL LETTER KA
+041B; C; 043B; # CYRILLIC CAPITAL LETTER EL
+041C; C; 043C; # CYRILLIC CAPITAL LETTER EM
+041D; C; 043D; # CYRILLIC CAPITAL LETTER EN
+041E; C; 043E; # CYRILLIC CAPITAL LETTER O
+041F; C; 043F; # CYRILLIC CAPITAL LETTER PE
+0420; C; 0440; # CYRILLIC CAPITAL LETTER ER
+0421; C; 0441; # CYRILLIC CAPITAL LETTER ES
+0422; C; 0442; # CYRILLIC CAPITAL LETTER TE
+0423; C; 0443; # CYRILLIC CAPITAL LETTER U
+0424; C; 0444; # CYRILLIC CAPITAL LETTER EF
+0425; C; 0445; # CYRILLIC CAPITAL LETTER HA
+0426; C; 0446; # CYRILLIC CAPITAL LETTER TSE
+0427; C; 0447; # CYRILLIC CAPITAL LETTER CHE
+0428; C; 0448; # CYRILLIC CAPITAL LETTER SHA
+0429; C; 0449; # CYRILLIC CAPITAL LETTER SHCHA
+042A; C; 044A; # CYRILLIC CAPITAL LETTER HARD SIGN
+042B; C; 044B; # CYRILLIC CAPITAL LETTER YERU
+042C; C; 044C; # CYRILLIC CAPITAL LETTER SOFT SIGN
+042D; C; 044D; # CYRILLIC CAPITAL LETTER E
+042E; C; 044E; # CYRILLIC CAPITAL LETTER YU
+042F; C; 044F; # CYRILLIC CAPITAL LETTER YA
+0460; C; 0461; # CYRILLIC CAPITAL LETTER OMEGA
+0462; C; 0463; # CYRILLIC CAPITAL LETTER YAT
+0464; C; 0465; # CYRILLIC CAPITAL LETTER IOTIFIED E
+0466; C; 0467; # CYRILLIC CAPITAL LETTER LITTLE YUS
+0468; C; 0469; # CYRILLIC CAPITAL LETTER IOTIFIED LITTLE YUS
+046A; C; 046B; # CYRILLIC CAPITAL LETTER BIG YUS
+046C; C; 046D; # CYRILLIC CAPITAL LETTER IOTIFIED BIG YUS
+046E; C; 046F; # CYRILLIC CAPITAL LETTER KSI
+0470; C; 0471; # CYRILLIC CAPITAL LETTER PSI
+0472; C; 0473; # CYRILLIC CAPITAL LETTER FITA
+0474; C; 0475; # CYRILLIC CAPITAL LETTER IZHITSA
+0476; C; 0477; # CYRILLIC CAPITAL LETTER IZHITSA WITH DOUBLE GRAVE ACCENT
+0478; C; 0479; # CYRILLIC CAPITAL LETTER UK
+047A; C; 047B; # CYRILLIC CAPITAL LETTER ROUND OMEGA
+047C; C; 047D; # CYRILLIC CAPITAL LETTER OMEGA WITH TITLO
+047E; C; 047F; # CYRILLIC CAPITAL LETTER OT
+0480; C; 0481; # CYRILLIC CAPITAL LETTER KOPPA
+048A; C; 048B; # CYRILLIC CAPITAL LETTER SHORT I WITH TAIL
+048C; C; 048D; # CYRILLIC CAPITAL LETTER SEMISOFT SIGN
+048E; C; 048F; # CYRILLIC CAPITAL LETTER ER WITH TICK
+0490; C; 0491; # CYRILLIC CAPITAL LETTER GHE WITH UPTURN
+0492; C; 0493; # CYRILLIC CAPITAL LETTER GHE WITH STROKE
+0494; C; 0495; # CYRILLIC CAPITAL LETTER GHE WITH MIDDLE HOOK
+0496; C; 0497; # CYRILLIC CAPITAL LETTER ZHE WITH DESCENDER
+0498; C; 0499; # CYRILLIC CAPITAL LETTER ZE WITH DESCENDER
+049A; C; 049B; # CYRILLIC CAPITAL LETTER KA WITH DESCENDER
+049C; C; 049D; # CYRILLIC CAPITAL LETTER KA WITH VERTICAL STROKE
+049E; C; 049F; # CYRILLIC CAPITAL LETTER KA WITH STROKE
+04A0; C; 04A1; # CYRILLIC CAPITAL LETTER BASHKIR KA
+04A2; C; 04A3; # CYRILLIC CAPITAL LETTER EN WITH DESCENDER
+04A4; C; 04A5; # CYRILLIC CAPITAL LIGATURE EN GHE
+04A6; C; 04A7; # CYRILLIC CAPITAL LETTER PE WITH MIDDLE HOOK
+04A8; C; 04A9; # CYRILLIC CAPITAL LETTER ABKHASIAN HA
+04AA; C; 04AB; # CYRILLIC CAPITAL LETTER ES WITH DESCENDER
+04AC; C; 04AD; # CYRILLIC CAPITAL LETTER TE WITH DESCENDER
+04AE; C; 04AF; # CYRILLIC CAPITAL LETTER STRAIGHT U
+04B0; C; 04B1; # CYRILLIC CAPITAL LETTER STRAIGHT U WITH STROKE
+04B2; C; 04B3; # CYRILLIC CAPITAL LETTER HA WITH DESCENDER
+04B4; C; 04B5; # CYRILLIC CAPITAL LIGATURE TE TSE
+04B6; C; 04B7; # CYRILLIC CAPITAL LETTER CHE WITH DESCENDER
+04B8; C; 04B9; # CYRILLIC CAPITAL LETTER CHE WITH VERTICAL STROKE
+04BA; C; 04BB; # CYRILLIC CAPITAL LETTER SHHA
+04BC; C; 04BD; # CYRILLIC CAPITAL LETTER ABKHASIAN CHE
+04BE; C; 04BF; # CYRILLIC CAPITAL LETTER ABKHASIAN CHE WITH DESCENDER
+04C0; C; 04CF; # CYRILLIC LETTER PALOCHKA
+04C1; C; 04C2; # CYRILLIC CAPITAL LETTER ZHE WITH BREVE
+04C3; C; 04C4; # CYRILLIC CAPITAL LETTER KA WITH HOOK
+04C5; C; 04C6; # CYRILLIC CAPITAL LETTER EL WITH TAIL
+04C7; C; 04C8; # CYRILLIC CAPITAL LETTER EN WITH HOOK
+04C9; C; 04CA; # CYRILLIC CAPITAL LETTER EN WITH TAIL
+04CB; C; 04CC; # CYRILLIC CAPITAL LETTER KHAKASSIAN CHE
+04CD; C; 04CE; # CYRILLIC CAPITAL LETTER EM WITH TAIL
+04D0; C; 04D1; # CYRILLIC CAPITAL LETTER A WITH BREVE
+04D2; C; 04D3; # CYRILLIC CAPITAL LETTER A WITH DIAERESIS
+04D4; C; 04D5; # CYRILLIC CAPITAL LIGATURE A IE
+04D6; C; 04D7; # CYRILLIC CAPITAL LETTER IE WITH BREVE
+04D8; C; 04D9; # CYRILLIC CAPITAL LETTER SCHWA
+04DA; C; 04DB; # CYRILLIC CAPITAL LETTER SCHWA WITH DIAERESIS
+04DC; C; 04DD; # CYRILLIC CAPITAL LETTER ZHE WITH DIAERESIS
+04DE; C; 04DF; # CYRILLIC CAPITAL LETTER ZE WITH DIAERESIS
+04E0; C; 04E1; # CYRILLIC CAPITAL LETTER ABKHASIAN DZE
+04E2; C; 04E3; # CYRILLIC CAPITAL LETTER I WITH MACRON
+04E4; C; 04E5; # CYRILLIC CAPITAL LETTER I WITH DIAERESIS
+04E6; C; 04E7; # CYRILLIC CAPITAL LETTER O WITH DIAERESIS
+04E8; C; 04E9; # CYRILLIC CAPITAL LETTER BARRED O
+04EA; C; 04EB; # CYRILLIC CAPITAL LETTER BARRED O WITH DIAERESIS
+04EC; C; 04ED; # CYRILLIC CAPITAL LETTER E WITH DIAERESIS
+04EE; C; 04EF; # CYRILLIC CAPITAL LETTER U WITH MACRON
+04F0; C; 04F1; # CYRILLIC CAPITAL LETTER U WITH DIAERESIS
+04F2; C; 04F3; # CYRILLIC CAPITAL LETTER U WITH DOUBLE ACUTE
+04F4; C; 04F5; # CYRILLIC CAPITAL LETTER CHE WITH DIAERESIS
+04F6; C; 04F7; # CYRILLIC CAPITAL LETTER GHE WITH DESCENDER
+04F8; C; 04F9; # CYRILLIC CAPITAL LETTER YERU WITH DIAERESIS
+04FA; C; 04FB; # CYRILLIC CAPITAL LETTER GHE WITH STROKE AND HOOK
+04FC; C; 04FD; # CYRILLIC CAPITAL LETTER HA WITH HOOK
+04FE; C; 04FF; # CYRILLIC CAPITAL LETTER HA WITH STROKE
+0500; C; 0501; # CYRILLIC CAPITAL LETTER KOMI DE
+0502; C; 0503; # CYRILLIC CAPITAL LETTER KOMI DJE
+0504; C; 0505; # CYRILLIC CAPITAL LETTER KOMI ZJE
+0506; C; 0507; # CYRILLIC CAPITAL LETTER KOMI DZJE
+0508; C; 0509; # CYRILLIC CAPITAL LETTER KOMI LJE
+050A; C; 050B; # CYRILLIC CAPITAL LETTER KOMI NJE
+050C; C; 050D; # CYRILLIC CAPITAL LETTER KOMI SJE
+050E; C; 050F; # CYRILLIC CAPITAL LETTER KOMI TJE
+0510; C; 0511; # CYRILLIC CAPITAL LETTER REVERSED ZE
+0512; C; 0513; # CYRILLIC CAPITAL LETTER EL WITH HOOK
+0514; C; 0515; # CYRILLIC CAPITAL LETTER LHA
+0516; C; 0517; # CYRILLIC CAPITAL LETTER RHA
+0518; C; 0519; # CYRILLIC CAPITAL LETTER YAE
+051A; C; 051B; # CYRILLIC CAPITAL LETTER QA
+051C; C; 051D; # CYRILLIC CAPITAL LETTER WE
+051E; C; 051F; # CYRILLIC CAPITAL LETTER ALEUT KA
+0520; C; 0521; # CYRILLIC CAPITAL LETTER EL WITH MIDDLE HOOK
+0522; C; 0523; # CYRILLIC CAPITAL LETTER EN WITH MIDDLE HOOK
+0524; C; 0525; # CYRILLIC CAPITAL LETTER PE WITH DESCENDER
+0526; C; 0527; # CYRILLIC CAPITAL LETTER SHHA WITH DESCENDER
+0528; C; 0529; # CYRILLIC CAPITAL LETTER EN WITH LEFT HOOK
+052A; C; 052B; # CYRILLIC CAPITAL LETTER DZZHE
+052C; C; 052D; # CYRILLIC CAPITAL LETTER DCHE
+052E; C; 052F; # CYRILLIC CAPITAL LETTER EL WITH DESCENDER
+0531; C; 0561; # ARMENIAN CAPITAL LETTER AYB
+0532; C; 0562; # ARMENIAN CAPITAL LETTER BEN
+0533; C; 0563; # ARMENIAN CAPITAL LETTER GIM
+0534; C; 0564; # ARMENIAN CAPITAL LETTER DA
+0535; C; 0565; # ARMENIAN CAPITAL LETTER ECH
+0536; C; 0566; # ARMENIAN CAPITAL LETTER ZA
+0537; C; 0567; # ARMENIAN CAPITAL LETTER EH
+0538; C; 0568; # ARMENIAN CAPITAL LETTER ET
+0539; C; 0569; # ARMENIAN CAPITAL LETTER TO
+053A; C; 056A; # ARMENIAN CAPITAL LETTER ZHE
+053B; C; 056B; # ARMENIAN CAPITAL LETTER INI
+053C; C; 056C; # ARMENIAN CAPITAL LETTER LIWN
+053D; C; 056D; # ARMENIAN CAPITAL LETTER XEH
+053E; C; 056E; # ARMENIAN CAPITAL LETTER CA
+053F; C; 056F; # ARMENIAN CAPITAL LETTER KEN
+0540; C; 0570; # ARMENIAN CAPITAL LETTER HO
+0541; C; 0571; # ARMENIAN CAPITAL LETTER JA
+0542; C; 0572; # ARMENIAN CAPITAL LETTER GHAD
+0543; C; 0573; # ARMENIAN CAPITAL LETTER CHEH
+0544; C; 0574; # ARMENIAN CAPITAL LETTER MEN
+0545; C; 0575; # ARMENIAN CAPITAL LETTER YI
+0546; C; 0576; # ARMENIAN CAPITAL LETTER NOW
+0547; C; 0577; # ARMENIAN CAPITAL LETTER SHA
+0548; C; 0578; # ARMENIAN CAPITAL LETTER VO
+0549; C; 0579; # ARMENIAN CAPITAL LETTER CHA
+054A; C; 057A; # ARMENIAN CAPITAL LETTER PEH
+054B; C; 057B; # ARMENIAN CAPITAL LETTER JHEH
+054C; C; 057C; # ARMENIAN CAPITAL LETTER RA
+054D; C; 057D; # ARMENIAN CAPITAL LETTER SEH
+054E; C; 057E; # ARMENIAN CAPITAL LETTER VEW
+054F; C; 057F; # ARMENIAN CAPITAL LETTER TIWN
+0550; C; 0580; # ARMENIAN CAPITAL LETTER REH
+0551; C; 0581; # ARMENIAN CAPITAL LETTER CO
+0552; C; 0582; # ARMENIAN CAPITAL LETTER YIWN
+0553; C; 0583; # ARMENIAN CAPITAL LETTER PIWR
+0554; C; 0584; # ARMENIAN CAPITAL LETTER KEH
+0555; C; 0585; # ARMENIAN CAPITAL LETTER OH
+0556; C; 0586; # ARMENIAN CAPITAL LETTER FEH
+0587; F; 0565 0582; # ARMENIAN SMALL LIGATURE ECH YIWN
+10A0; C; 2D00; # GEORGIAN CAPITAL LETTER AN
+10A1; C; 2D01; # GEORGIAN CAPITAL LETTER BAN
+10A2; C; 2D02; # GEORGIAN CAPITAL LETTER GAN
+10A3; C; 2D03; # GEORGIAN CAPITAL LETTER DON
+10A4; C; 2D04; # GEORGIAN CAPITAL LETTER EN
+10A5; C; 2D05; # GEORGIAN CAPITAL LETTER VIN
+10A6; C; 2D06; # GEORGIAN CAPITAL LETTER ZEN
+10A7; C; 2D07; # GEORGIAN CAPITAL LETTER TAN
+10A8; C; 2D08; # GEORGIAN CAPITAL LETTER IN
+10A9; C; 2D09; # GEORGIAN CAPITAL LETTER KAN
+10AA; C; 2D0A; # GEORGIAN CAPITAL LETTER LAS
+10AB; C; 2D0B; # GEORGIAN CAPITAL LETTER MAN
+10AC; C; 2D0C; # GEORGIAN CAPITAL LETTER NAR
+10AD; C; 2D0D; # GEORGIAN CAPITAL LETTER ON
+10AE; C; 2D0E; # GEORGIAN CAPITAL LETTER PAR
+10AF; C; 2D0F; # GEORGIAN CAPITAL LETTER ZHAR
+10B0; C; 2D10; # GEORGIAN CAPITAL LETTER RAE
+10B1; C; 2D11; # GEORGIAN CAPITAL LETTER SAN
+10B2; C; 2D12; # GEORGIAN CAPITAL LETTER TAR
+10B3; C; 2D13; # GEORGIAN CAPITAL LETTER UN
+10B4; C; 2D14; # GEORGIAN CAPITAL LETTER PHAR
+10B5; C; 2D15; # GEORGIAN CAPITAL LETTER KHAR
+10B6; C; 2D16; # GEORGIAN CAPITAL LETTER GHAN
+10B7; C; 2D17; # GEORGIAN CAPITAL LETTER QAR
+10B8; C; 2D18; # GEORGIAN CAPITAL LETTER SHIN
+10B9; C; 2D19; # GEORGIAN CAPITAL LETTER CHIN
+10BA; C; 2D1A; # GEORGIAN CAPITAL LETTER CAN
+10BB; C; 2D1B; # GEORGIAN CAPITAL LETTER JIL
+10BC; C; 2D1C; # GEORGIAN CAPITAL LETTER CIL
+10BD; C; 2D1D; # GEORGIAN CAPITAL LETTER CHAR
+10BE; C; 2D1E; # GEORGIAN CAPITAL LETTER XAN
+10BF; C; 2D1F; # GEORGIAN CAPITAL LETTER JHAN
+10C0; C; 2D20; # GEORGIAN CAPITAL LETTER HAE
+10C1; C; 2D21; # GEORGIAN CAPITAL LETTER HE
+10C2; C; 2D22; # GEORGIAN CAPITAL LETTER HIE
+10C3; C; 2D23; # GEORGIAN CAPITAL LETTER WE
+10C4; C; 2D24; # GEORGIAN CAPITAL LETTER HAR
+10C5; C; 2D25; # GEORGIAN CAPITAL LETTER HOE
+10C7; C; 2D27; # GEORGIAN CAPITAL LETTER YN
+10CD; C; 2D2D; # GEORGIAN CAPITAL LETTER AEN
+13F8; C; 13F0; # CHEROKEE SMALL LETTER YE
+13F9; C; 13F1; # CHEROKEE SMALL LETTER YI
+13FA; C; 13F2; # CHEROKEE SMALL LETTER YO
+13FB; C; 13F3; # CHEROKEE SMALL LETTER YU
+13FC; C; 13F4; # CHEROKEE SMALL LETTER YV
+13FD; C; 13F5; # CHEROKEE SMALL LETTER MV
+1E00; C; 1E01; # LATIN CAPITAL LETTER A WITH RING BELOW
+1E02; C; 1E03; # LATIN CAPITAL LETTER B WITH DOT ABOVE
+1E04; C; 1E05; # LATIN CAPITAL LETTER B WITH DOT BELOW
+1E06; C; 1E07; # LATIN CAPITAL LETTER B WITH LINE BELOW
+1E08; C; 1E09; # LATIN CAPITAL LETTER C WITH CEDILLA AND ACUTE
+1E0A; C; 1E0B; # LATIN CAPITAL LETTER D WITH DOT ABOVE
+1E0C; C; 1E0D; # LATIN CAPITAL LETTER D WITH DOT BELOW
+1E0E; C; 1E0F; # LATIN CAPITAL LETTER D WITH LINE BELOW
+1E10; C; 1E11; # LATIN CAPITAL LETTER D WITH CEDILLA
+1E12; C; 1E13; # LATIN CAPITAL LETTER D WITH CIRCUMFLEX BELOW
+1E14; C; 1E15; # LATIN CAPITAL LETTER E WITH MACRON AND GRAVE
+1E16; C; 1E17; # LATIN CAPITAL LETTER E WITH MACRON AND ACUTE
+1E18; C; 1E19; # LATIN CAPITAL LETTER E WITH CIRCUMFLEX BELOW
+1E1A; C; 1E1B; # LATIN CAPITAL LETTER E WITH TILDE BELOW
+1E1C; C; 1E1D; # LATIN CAPITAL LETTER E WITH CEDILLA AND BREVE
+1E1E; C; 1E1F; # LATIN CAPITAL LETTER F WITH DOT ABOVE
+1E20; C; 1E21; # LATIN CAPITAL LETTER G WITH MACRON
+1E22; C; 1E23; # LATIN CAPITAL LETTER H WITH DOT ABOVE
+1E24; C; 1E25; # LATIN CAPITAL LETTER H WITH DOT BELOW
+1E26; C; 1E27; # LATIN CAPITAL LETTER H WITH DIAERESIS
+1E28; C; 1E29; # LATIN CAPITAL LETTER H WITH CEDILLA
+1E2A; C; 1E2B; # LATIN CAPITAL LETTER H WITH BREVE BELOW
+1E2C; C; 1E2D; # LATIN CAPITAL LETTER I WITH TILDE BELOW
+1E2E; C; 1E2F; # LATIN CAPITAL LETTER I WITH DIAERESIS AND ACUTE
+1E30; C; 1E31; # LATIN CAPITAL LETTER K WITH ACUTE
+1E32; C; 1E33; # LATIN CAPITAL LETTER K WITH DOT BELOW
+1E34; C; 1E35; # LATIN CAPITAL LETTER K WITH LINE BELOW
+1E36; C; 1E37; # LATIN CAPITAL LETTER L WITH DOT BELOW
+1E38; C; 1E39; # LATIN CAPITAL LETTER L WITH DOT BELOW AND MACRON
+1E3A; C; 1E3B; # LATIN CAPITAL LETTER L WITH LINE BELOW
+1E3C; C; 1E3D; # LATIN CAPITAL LETTER L WITH CIRCUMFLEX BELOW
+1E3E; C; 1E3F; # LATIN CAPITAL LETTER M WITH ACUTE
+1E40; C; 1E41; # LATIN CAPITAL LETTER M WITH DOT ABOVE
+1E42; C; 1E43; # LATIN CAPITAL LETTER M WITH DOT BELOW
+1E44; C; 1E45; # LATIN CAPITAL LETTER N WITH DOT ABOVE
+1E46; C; 1E47; # LATIN CAPITAL LETTER N WITH DOT BELOW
+1E48; C; 1E49; # LATIN CAPITAL LETTER N WITH LINE BELOW
+1E4A; C; 1E4B; # LATIN CAPITAL LETTER N WITH CIRCUMFLEX BELOW
+1E4C; C; 1E4D; # LATIN CAPITAL LETTER O WITH TILDE AND ACUTE
+1E4E; C; 1E4F; # LATIN CAPITAL LETTER O WITH TILDE AND DIAERESIS
+1E50; C; 1E51; # LATIN CAPITAL LETTER O WITH MACRON AND GRAVE
+1E52; C; 1E53; # LATIN CAPITAL LETTER O WITH MACRON AND ACUTE
+1E54; C; 1E55; # LATIN CAPITAL LETTER P WITH ACUTE
+1E56; C; 1E57; # LATIN CAPITAL LETTER P WITH DOT ABOVE
+1E58; C; 1E59; # LATIN CAPITAL LETTER R WITH DOT ABOVE
+1E5A; C; 1E5B; # LATIN CAPITAL LETTER R WITH DOT BELOW
+1E5C; C; 1E5D; # LATIN CAPITAL LETTER R WITH DOT BELOW AND MACRON
+1E5E; C; 1E5F; # LATIN CAPITAL LETTER R WITH LINE BELOW
+1E60; C; 1E61; # LATIN CAPITAL LETTER S WITH DOT ABOVE
+1E62; C; 1E63; # LATIN CAPITAL LETTER S WITH DOT BELOW
+1E64; C; 1E65; # LATIN CAPITAL LETTER S WITH ACUTE AND DOT ABOVE
+1E66; C; 1E67; # LATIN CAPITAL LETTER S WITH CARON AND DOT ABOVE
+1E68; C; 1E69; # LATIN CAPITAL LETTER S WITH DOT BELOW AND DOT ABOVE
+1E6A; C; 1E6B; # LATIN CAPITAL LETTER T WITH DOT ABOVE
+1E6C; C; 1E6D; # LATIN CAPITAL LETTER T WITH DOT BELOW
+1E6E; C; 1E6F; # LATIN CAPITAL LETTER T WITH LINE BELOW
+1E70; C; 1E71; # LATIN CAPITAL LETTER T WITH CIRCUMFLEX BELOW
+1E72; C; 1E73; # LATIN CAPITAL LETTER U WITH DIAERESIS BELOW
+1E74; C; 1E75; # LATIN CAPITAL LETTER U WITH TILDE BELOW
+1E76; C; 1E77; # LATIN CAPITAL LETTER U WITH CIRCUMFLEX BELOW
+1E78; C; 1E79; # LATIN CAPITAL LETTER U WITH TILDE AND ACUTE
+1E7A; C; 1E7B; # LATIN CAPITAL LETTER U WITH MACRON AND DIAERESIS
+1E7C; C; 1E7D; # LATIN CAPITAL LETTER V WITH TILDE
+1E7E; C; 1E7F; # LATIN CAPITAL LETTER V WITH DOT BELOW
+1E80; C; 1E81; # LATIN CAPITAL LETTER W WITH GRAVE
+1E82; C; 1E83; # LATIN CAPITAL LETTER W WITH ACUTE
+1E84; C; 1E85; # LATIN CAPITAL LETTER W WITH DIAERESIS
+1E86; C; 1E87; # LATIN CAPITAL LETTER W WITH DOT ABOVE
+1E88; C; 1E89; # LATIN CAPITAL LETTER W WITH DOT BELOW
+1E8A; C; 1E8B; # LATIN CAPITAL LETTER X WITH DOT ABOVE
+1E8C; C; 1E8D; # LATIN CAPITAL LETTER X WITH DIAERESIS
+1E8E; C; 1E8F; # LATIN CAPITAL LETTER Y WITH DOT ABOVE
+1E90; C; 1E91; # LATIN CAPITAL LETTER Z WITH CIRCUMFLEX
+1E92; C; 1E93; # LATIN CAPITAL LETTER Z WITH DOT BELOW
+1E94; C; 1E95; # LATIN CAPITAL LETTER Z WITH LINE BELOW
+1E96; F; 0068 0331; # LATIN SMALL LETTER H WITH LINE BELOW
+1E97; F; 0074 0308; # LATIN SMALL LETTER T WITH DIAERESIS
+1E98; F; 0077 030A; # LATIN SMALL LETTER W WITH RING ABOVE
+1E99; F; 0079 030A; # LATIN SMALL LETTER Y WITH RING ABOVE
+1E9A; F; 0061 02BE; # LATIN SMALL LETTER A WITH RIGHT HALF RING
+1E9B; C; 1E61; # LATIN SMALL LETTER LONG S WITH DOT ABOVE
+1E9E; F; 0073 0073; # LATIN CAPITAL LETTER SHARP S
+1E9E; S; 00DF; # LATIN CAPITAL LETTER SHARP S
+1EA0; C; 1EA1; # LATIN CAPITAL LETTER A WITH DOT BELOW
+1EA2; C; 1EA3; # LATIN CAPITAL LETTER A WITH HOOK ABOVE
+1EA4; C; 1EA5; # LATIN CAPITAL LETTER A WITH CIRCUMFLEX AND ACUTE
+1EA6; C; 1EA7; # LATIN CAPITAL LETTER A WITH CIRCUMFLEX AND GRAVE
+1EA8; C; 1EA9; # LATIN CAPITAL LETTER A WITH CIRCUMFLEX AND HOOK ABOVE
+1EAA; C; 1EAB; # LATIN CAPITAL LETTER A WITH CIRCUMFLEX AND TILDE
+1EAC; C; 1EAD; # LATIN CAPITAL LETTER A WITH CIRCUMFLEX AND DOT BELOW
+1EAE; C; 1EAF; # LATIN CAPITAL LETTER A WITH BREVE AND ACUTE
+1EB0; C; 1EB1; # LATIN CAPITAL LETTER A WITH BREVE AND GRAVE
+1EB2; C; 1EB3; # LATIN CAPITAL LETTER A WITH BREVE AND HOOK ABOVE
+1EB4; C; 1EB5; # LATIN CAPITAL LETTER A WITH BREVE AND TILDE
+1EB6; C; 1EB7; # LATIN CAPITAL LETTER A WITH BREVE AND DOT BELOW
+1EB8; C; 1EB9; # LATIN CAPITAL LETTER E WITH DOT BELOW
+1EBA; C; 1EBB; # LATIN CAPITAL LETTER E WITH HOOK ABOVE
+1EBC; C; 1EBD; # LATIN CAPITAL LETTER E WITH TILDE
+1EBE; C; 1EBF; # LATIN CAPITAL LETTER E WITH CIRCUMFLEX AND ACUTE
+1EC0; C; 1EC1; # LATIN CAPITAL LETTER E WITH CIRCUMFLEX AND GRAVE
+1EC2; C; 1EC3; # LATIN CAPITAL LETTER E WITH CIRCUMFLEX AND HOOK ABOVE
+1EC4; C; 1EC5; # LATIN CAPITAL LETTER E WITH CIRCUMFLEX AND TILDE
+1EC6; C; 1EC7; # LATIN CAPITAL LETTER E WITH CIRCUMFLEX AND DOT BELOW
+1EC8; C; 1EC9; # LATIN CAPITAL LETTER I WITH HOOK ABOVE
+1ECA; C; 1ECB; # LATIN CAPITAL LETTER I WITH DOT BELOW
+1ECC; C; 1ECD; # LATIN CAPITAL LETTER O WITH DOT BELOW
+1ECE; C; 1ECF; # LATIN CAPITAL LETTER O WITH HOOK ABOVE
+1ED0; C; 1ED1; # LATIN CAPITAL LETTER O WITH CIRCUMFLEX AND ACUTE
+1ED2; C; 1ED3; # LATIN CAPITAL LETTER O WITH CIRCUMFLEX AND GRAVE
+1ED4; C; 1ED5; # LATIN CAPITAL LETTER O WITH CIRCUMFLEX AND HOOK ABOVE
+1ED6; C; 1ED7; # LATIN CAPITAL LETTER O WITH CIRCUMFLEX AND TILDE
+1ED8; C; 1ED9; # LATIN CAPITAL LETTER O WITH CIRCUMFLEX AND DOT BELOW
+1EDA; C; 1EDB; # LATIN CAPITAL LETTER O WITH HORN AND ACUTE
+1EDC; C; 1EDD; # LATIN CAPITAL LETTER O WITH HORN AND GRAVE
+1EDE; C; 1EDF; # LATIN CAPITAL LETTER O WITH HORN AND HOOK ABOVE
+1EE0; C; 1EE1; # LATIN CAPITAL LETTER O WITH HORN AND TILDE
+1EE2; C; 1EE3; # LATIN CAPITAL LETTER O WITH HORN AND DOT BELOW
+1EE4; C; 1EE5; # LATIN CAPITAL LETTER U WITH DOT BELOW
+1EE6; C; 1EE7; # LATIN CAPITAL LETTER U WITH HOOK ABOVE
+1EE8; C; 1EE9; # LATIN CAPITAL LETTER U WITH HORN AND ACUTE
+1EEA; C; 1EEB; # LATIN CAPITAL LETTER U WITH HORN AND GRAVE
+1EEC; C; 1EED; # LATIN CAPITAL LETTER U WITH HORN AND HOOK ABOVE
+1EEE; C; 1EEF; # LATIN CAPITAL LETTER U WITH HORN AND TILDE
+1EF0; C; 1EF1; # LATIN CAPITAL LETTER U WITH HORN AND DOT BELOW
+1EF2; C; 1EF3; # LATIN CAPITAL LETTER Y WITH GRAVE
+1EF4; C; 1EF5; # LATIN CAPITAL LETTER Y WITH DOT BELOW
+1EF6; C; 1EF7; # LATIN CAPITAL LETTER Y WITH HOOK ABOVE
+1EF8; C; 1EF9; # LATIN CAPITAL LETTER Y WITH TILDE
+1EFA; C; 1EFB; # LATIN CAPITAL LETTER MIDDLE-WELSH LL
+1EFC; C; 1EFD; # LATIN CAPITAL LETTER MIDDLE-WELSH V
+1EFE; C; 1EFF; # LATIN CAPITAL LETTER Y WITH LOOP
+1F08; C; 1F00; # GREEK CAPITAL LETTER ALPHA WITH PSILI
+1F09; C; 1F01; # GREEK CAPITAL LETTER ALPHA WITH DASIA
+1F0A; C; 1F02; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND VARIA
+1F0B; C; 1F03; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND VARIA
+1F0C; C; 1F04; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND OXIA
+1F0D; C; 1F05; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND OXIA
+1F0E; C; 1F06; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND PERISPOMENI
+1F0F; C; 1F07; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND PERISPOMENI
+1F18; C; 1F10; # GREEK CAPITAL LETTER EPSILON WITH PSILI
+1F19; C; 1F11; # GREEK CAPITAL LETTER EPSILON WITH DASIA
+1F1A; C; 1F12; # GREEK CAPITAL LETTER EPSILON WITH PSILI AND VARIA
+1F1B; C; 1F13; # GREEK CAPITAL LETTER EPSILON WITH DASIA AND VARIA
+1F1C; C; 1F14; # GREEK CAPITAL LETTER EPSILON WITH PSILI AND OXIA
+1F1D; C; 1F15; # GREEK CAPITAL LETTER EPSILON WITH DASIA AND OXIA
+1F28; C; 1F20; # GREEK CAPITAL LETTER ETA WITH PSILI
+1F29; C; 1F21; # GREEK CAPITAL LETTER ETA WITH DASIA
+1F2A; C; 1F22; # GREEK CAPITAL LETTER ETA WITH PSILI AND VARIA
+1F2B; C; 1F23; # GREEK CAPITAL LETTER ETA WITH DASIA AND VARIA
+1F2C; C; 1F24; # GREEK CAPITAL LETTER ETA WITH PSILI AND OXIA
+1F2D; C; 1F25; # GREEK CAPITAL LETTER ETA WITH DASIA AND OXIA
+1F2E; C; 1F26; # GREEK CAPITAL LETTER ETA WITH PSILI AND PERISPOMENI
+1F2F; C; 1F27; # GREEK CAPITAL LETTER ETA WITH DASIA AND PERISPOMENI
+1F38; C; 1F30; # GREEK CAPITAL LETTER IOTA WITH PSILI
+1F39; C; 1F31; # GREEK CAPITAL LETTER IOTA WITH DASIA
+1F3A; C; 1F32; # GREEK CAPITAL LETTER IOTA WITH PSILI AND VARIA
+1F3B; C; 1F33; # GREEK CAPITAL LETTER IOTA WITH DASIA AND VARIA
+1F3C; C; 1F34; # GREEK CAPITAL LETTER IOTA WITH PSILI AND OXIA
+1F3D; C; 1F35; # GREEK CAPITAL LETTER IOTA WITH DASIA AND OXIA
+1F3E; C; 1F36; # GREEK CAPITAL LETTER IOTA WITH PSILI AND PERISPOMENI
+1F3F; C; 1F37; # GREEK CAPITAL LETTER IOTA WITH DASIA AND PERISPOMENI
+1F48; C; 1F40; # GREEK CAPITAL LETTER OMICRON WITH PSILI
+1F49; C; 1F41; # GREEK CAPITAL LETTER OMICRON WITH DASIA
+1F4A; C; 1F42; # GREEK CAPITAL LETTER OMICRON WITH PSILI AND VARIA
+1F4B; C; 1F43; # GREEK CAPITAL LETTER OMICRON WITH DASIA AND VARIA
+1F4C; C; 1F44; # GREEK CAPITAL LETTER OMICRON WITH PSILI AND OXIA
+1F4D; C; 1F45; # GREEK CAPITAL LETTER OMICRON WITH DASIA AND OXIA
+1F50; F; 03C5 0313; # GREEK SMALL LETTER UPSILON WITH PSILI
+1F52; F; 03C5 0313 0300; # GREEK SMALL LETTER UPSILON WITH PSILI AND VARIA
+1F54; F; 03C5 0313 0301; # GREEK SMALL LETTER UPSILON WITH PSILI AND OXIA
+1F56; F; 03C5 0313 0342; # GREEK SMALL LETTER UPSILON WITH PSILI AND PERISPOMENI
+1F59; C; 1F51; # GREEK CAPITAL LETTER UPSILON WITH DASIA
+1F5B; C; 1F53; # GREEK CAPITAL LETTER UPSILON WITH DASIA AND VARIA
+1F5D; C; 1F55; # GREEK CAPITAL LETTER UPSILON WITH DASIA AND OXIA
+1F5F; C; 1F57; # GREEK CAPITAL LETTER UPSILON WITH DASIA AND PERISPOMENI
+1F68; C; 1F60; # GREEK CAPITAL LETTER OMEGA WITH PSILI
+1F69; C; 1F61; # GREEK CAPITAL LETTER OMEGA WITH DASIA
+1F6A; C; 1F62; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND VARIA
+1F6B; C; 1F63; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND VARIA
+1F6C; C; 1F64; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND OXIA
+1F6D; C; 1F65; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND OXIA
+1F6E; C; 1F66; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND PERISPOMENI
+1F6F; C; 1F67; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND PERISPOMENI
+1F80; F; 1F00 03B9; # GREEK SMALL LETTER ALPHA WITH PSILI AND YPOGEGRAMMENI
+1F81; F; 1F01 03B9; # GREEK SMALL LETTER ALPHA WITH DASIA AND YPOGEGRAMMENI
+1F82; F; 1F02 03B9; # GREEK SMALL LETTER ALPHA WITH PSILI AND VARIA AND YPOGEGRAMMENI
+1F83; F; 1F03 03B9; # GREEK SMALL LETTER ALPHA WITH DASIA AND VARIA AND YPOGEGRAMMENI
+1F84; F; 1F04 03B9; # GREEK SMALL LETTER ALPHA WITH PSILI AND OXIA AND YPOGEGRAMMENI
+1F85; F; 1F05 03B9; # GREEK SMALL LETTER ALPHA WITH DASIA AND OXIA AND YPOGEGRAMMENI
+1F86; F; 1F06 03B9; # GREEK SMALL LETTER ALPHA WITH PSILI AND PERISPOMENI AND YPOGEGRAMMENI
+1F87; F; 1F07 03B9; # GREEK SMALL LETTER ALPHA WITH DASIA AND PERISPOMENI AND YPOGEGRAMMENI
+1F88; F; 1F00 03B9; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND PROSGEGRAMMENI
+1F88; S; 1F80; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND PROSGEGRAMMENI
+1F89; F; 1F01 03B9; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND PROSGEGRAMMENI
+1F89; S; 1F81; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND PROSGEGRAMMENI
+1F8A; F; 1F02 03B9; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND VARIA AND PROSGEGRAMMENI
+1F8A; S; 1F82; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND VARIA AND PROSGEGRAMMENI
+1F8B; F; 1F03 03B9; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND VARIA AND PROSGEGRAMMENI
+1F8B; S; 1F83; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND VARIA AND PROSGEGRAMMENI
+1F8C; F; 1F04 03B9; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND OXIA AND PROSGEGRAMMENI
+1F8C; S; 1F84; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND OXIA AND PROSGEGRAMMENI
+1F8D; F; 1F05 03B9; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND OXIA AND PROSGEGRAMMENI
+1F8D; S; 1F85; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND OXIA AND PROSGEGRAMMENI
+1F8E; F; 1F06 03B9; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND PERISPOMENI AND PROSGEGRAMMENI
+1F8E; S; 1F86; # GREEK CAPITAL LETTER ALPHA WITH PSILI AND PERISPOMENI AND PROSGEGRAMMENI
+1F8F; F; 1F07 03B9; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND PERISPOMENI AND PROSGEGRAMMENI
+1F8F; S; 1F87; # GREEK CAPITAL LETTER ALPHA WITH DASIA AND PERISPOMENI AND PROSGEGRAMMENI
+1F90; F; 1F20 03B9; # GREEK SMALL LETTER ETA WITH PSILI AND YPOGEGRAMMENI
+1F91; F; 1F21 03B9; # GREEK SMALL LETTER ETA WITH DASIA AND YPOGEGRAMMENI
+1F92; F; 1F22 03B9; # GREEK SMALL LETTER ETA WITH PSILI AND VARIA AND YPOGEGRAMMENI
+1F93; F; 1F23 03B9; # GREEK SMALL LETTER ETA WITH DASIA AND VARIA AND YPOGEGRAMMENI
+1F94; F; 1F24 03B9; # GREEK SMALL LETTER ETA WITH PSILI AND OXIA AND YPOGEGRAMMENI
+1F95; F; 1F25 03B9; # GREEK SMALL LETTER ETA WITH DASIA AND OXIA AND YPOGEGRAMMENI
+1F96; F; 1F26 03B9; # GREEK SMALL LETTER ETA WITH PSILI AND PERISPOMENI AND YPOGEGRAMMENI
+1F97; F; 1F27 03B9; # GREEK SMALL LETTER ETA WITH DASIA AND PERISPOMENI AND YPOGEGRAMMENI
+1F98; F; 1F20 03B9; # GREEK CAPITAL LETTER ETA WITH PSILI AND PROSGEGRAMMENI
+1F98; S; 1F90; # GREEK CAPITAL LETTER ETA WITH PSILI AND PROSGEGRAMMENI
+1F99; F; 1F21 03B9; # GREEK CAPITAL LETTER ETA WITH DASIA AND PROSGEGRAMMENI
+1F99; S; 1F91; # GREEK CAPITAL LETTER ETA WITH DASIA AND PROSGEGRAMMENI
+1F9A; F; 1F22 03B9; # GREEK CAPITAL LETTER ETA WITH PSILI AND VARIA AND PROSGEGRAMMENI
+1F9A; S; 1F92; # GREEK CAPITAL LETTER ETA WITH PSILI AND VARIA AND PROSGEGRAMMENI
+1F9B; F; 1F23 03B9; # GREEK CAPITAL LETTER ETA WITH DASIA AND VARIA AND PROSGEGRAMMENI
+1F9B; S; 1F93; # GREEK CAPITAL LETTER ETA WITH DASIA AND VARIA AND PROSGEGRAMMENI
+1F9C; F; 1F24 03B9; # GREEK CAPITAL LETTER ETA WITH PSILI AND OXIA AND PROSGEGRAMMENI
+1F9C; S; 1F94; # GREEK CAPITAL LETTER ETA WITH PSILI AND OXIA AND PROSGEGRAMMENI
+1F9D; F; 1F25 03B9; # GREEK CAPITAL LETTER ETA WITH DASIA AND OXIA AND PROSGEGRAMMENI
+1F9D; S; 1F95; # GREEK CAPITAL LETTER ETA WITH DASIA AND OXIA AND PROSGEGRAMMENI
+1F9E; F; 1F26 03B9; # GREEK CAPITAL LETTER ETA WITH PSILI AND PERISPOMENI AND PROSGEGRAMMENI
+1F9E; S; 1F96; # GREEK CAPITAL LETTER ETA WITH PSILI AND PERISPOMENI AND PROSGEGRAMMENI
+1F9F; F; 1F27 03B9; # GREEK CAPITAL LETTER ETA WITH DASIA AND PERISPOMENI AND PROSGEGRAMMENI
+1F9F; S; 1F97; # GREEK CAPITAL LETTER ETA WITH DASIA AND PERISPOMENI AND PROSGEGRAMMENI
+1FA0; F; 1F60 03B9; # GREEK SMALL LETTER OMEGA WITH PSILI AND YPOGEGRAMMENI
+1FA1; F; 1F61 03B9; # GREEK SMALL LETTER OMEGA WITH DASIA AND YPOGEGRAMMENI
+1FA2; F; 1F62 03B9; # GREEK SMALL LETTER OMEGA WITH PSILI AND VARIA AND YPOGEGRAMMENI
+1FA3; F; 1F63 03B9; # GREEK SMALL LETTER OMEGA WITH DASIA AND VARIA AND YPOGEGRAMMENI
+1FA4; F; 1F64 03B9; # GREEK SMALL LETTER OMEGA WITH PSILI AND OXIA AND YPOGEGRAMMENI
+1FA5; F; 1F65 03B9; # GREEK SMALL LETTER OMEGA WITH DASIA AND OXIA AND YPOGEGRAMMENI
+1FA6; F; 1F66 03B9; # GREEK SMALL LETTER OMEGA WITH PSILI AND PERISPOMENI AND YPOGEGRAMMENI
+1FA7; F; 1F67 03B9; # GREEK SMALL LETTER OMEGA WITH DASIA AND PERISPOMENI AND YPOGEGRAMMENI
+1FA8; F; 1F60 03B9; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND PROSGEGRAMMENI
+1FA8; S; 1FA0; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND PROSGEGRAMMENI
+1FA9; F; 1F61 03B9; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND PROSGEGRAMMENI
+1FA9; S; 1FA1; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND PROSGEGRAMMENI
+1FAA; F; 1F62 03B9; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND VARIA AND PROSGEGRAMMENI
+1FAA; S; 1FA2; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND VARIA AND PROSGEGRAMMENI
+1FAB; F; 1F63 03B9; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND VARIA AND PROSGEGRAMMENI
+1FAB; S; 1FA3; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND VARIA AND PROSGEGRAMMENI
+1FAC; F; 1F64 03B9; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND OXIA AND PROSGEGRAMMENI
+1FAC; S; 1FA4; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND OXIA AND PROSGEGRAMMENI
+1FAD; F; 1F65 03B9; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND OXIA AND PROSGEGRAMMENI
+1FAD; S; 1FA5; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND OXIA AND PROSGEGRAMMENI
+1FAE; F; 1F66 03B9; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND PERISPOMENI AND PROSGEGRAMMENI
+1FAE; S; 1FA6; # GREEK CAPITAL LETTER OMEGA WITH PSILI AND PERISPOMENI AND PROSGEGRAMMENI
+1FAF; F; 1F67 03B9; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND PERISPOMENI AND PROSGEGRAMMENI
+1FAF; S; 1FA7; # GREEK CAPITAL LETTER OMEGA WITH DASIA AND PERISPOMENI AND PROSGEGRAMMENI
+1FB2; F; 1F70 03B9; # GREEK SMALL LETTER ALPHA WITH VARIA AND YPOGEGRAMMENI
+1FB3; F; 03B1 03B9; # GREEK SMALL LETTER ALPHA WITH YPOGEGRAMMENI
+1FB4; F; 03AC 03B9; # GREEK SMALL LETTER ALPHA WITH OXIA AND YPOGEGRAMMENI
+1FB6; F; 03B1 0342; # GREEK SMALL LETTER ALPHA WITH PERISPOMENI
+1FB7; F; 03B1 0342 03B9; # GREEK SMALL LETTER ALPHA WITH PERISPOMENI AND YPOGEGRAMMENI
+1FB8; C; 1FB0; # GREEK CAPITAL LETTER ALPHA WITH VRACHY
+1FB9; C; 1FB1; # GREEK CAPITAL LETTER ALPHA WITH MACRON
+1FBA; C; 1F70; # GREEK CAPITAL LETTER ALPHA WITH VARIA
+1FBB; C; 1F71; # GREEK CAPITAL LETTER ALPHA WITH OXIA
+1FBC; F; 03B1 03B9; # GREEK CAPITAL LETTER ALPHA WITH PROSGEGRAMMENI
+1FBC; S; 1FB3; # GREEK CAPITAL LETTER ALPHA WITH PROSGEGRAMMENI
+1FBE; C; 03B9; # GREEK PROSGEGRAMMENI
+1FC2; F; 1F74 03B9; # GREEK SMALL LETTER ETA WITH VARIA AND YPOGEGRAMMENI
+1FC3; F; 03B7 03B9; # GREEK SMALL LETTER ETA WITH YPOGEGRAMMENI
+1FC4; F; 03AE 03B9; # GREEK SMALL LETTER ETA WITH OXIA AND YPOGEGRAMMENI
+1FC6; F; 03B7 0342; # GREEK SMALL LETTER ETA WITH PERISPOMENI
+1FC7; F; 03B7 0342 03B9; # GREEK SMALL LETTER ETA WITH PERISPOMENI AND YPOGEGRAMMENI
+1FC8; C; 1F72; # GREEK CAPITAL LETTER EPSILON WITH VARIA
+1FC9; C; 1F73; # GREEK CAPITAL LETTER EPSILON WITH OXIA
+1FCA; C; 1F74; # GREEK CAPITAL LETTER ETA WITH VARIA
+1FCB; C; 1F75; # GREEK CAPITAL LETTER ETA WITH OXIA
+1FCC; F; 03B7 03B9; # GREEK CAPITAL LETTER ETA WITH PROSGEGRAMMENI
+1FCC; S; 1FC3; # GREEK CAPITAL LETTER ETA WITH PROSGEGRAMMENI
+1FD2; F; 03B9 0308 0300; # GREEK SMALL LETTER IOTA WITH DIALYTIKA AND VARIA
+1FD3; F; 03B9 0308 0301; # GREEK SMALL LETTER IOTA WITH DIALYTIKA AND OXIA
+1FD6; F; 03B9 0342; # GREEK SMALL LETTER IOTA WITH PERISPOMENI
+1FD7; F; 03B9 0308 0342; # GREEK SMALL LETTER IOTA WITH DIALYTIKA AND PERISPOMENI
+1FD8; C; 1FD0; # GREEK CAPITAL LETTER IOTA WITH VRACHY
+1FD9; C; 1FD1; # GREEK CAPITAL LETTER IOTA WITH MACRON
+1FDA; C; 1F76; # GREEK CAPITAL LETTER IOTA WITH VARIA
+1FDB; C; 1F77; # GREEK CAPITAL LETTER IOTA WITH OXIA
+1FE2; F; 03C5 0308 0300; # GREEK SMALL LETTER UPSILON WITH DIALYTIKA AND VARIA
+1FE3; F; 03C5 0308 0301; # GREEK SMALL LETTER UPSILON WITH DIALYTIKA AND OXIA
+1FE4; F; 03C1 0313; # GREEK SMALL LETTER RHO WITH PSILI
+1FE6; F; 03C5 0342; # GREEK SMALL LETTER UPSILON WITH PERISPOMENI
+1FE7; F; 03C5 0308 0342; # GREEK SMALL LETTER UPSILON WITH DIALYTIKA AND PERISPOMENI
+1FE8; C; 1FE0; # GREEK CAPITAL LETTER UPSILON WITH VRACHY
+1FE9; C; 1FE1; # GREEK CAPITAL LETTER UPSILON WITH MACRON
+1FEA; C; 1F7A; # GREEK CAPITAL LETTER UPSILON WITH VARIA
+1FEB; C; 1F7B; # GREEK CAPITAL LETTER UPSILON WITH OXIA
+1FEC; C; 1FE5; # GREEK CAPITAL LETTER RHO WITH DASIA
+1FF2; F; 1F7C 03B9; # GREEK SMALL LETTER OMEGA WITH VARIA AND YPOGEGRAMMENI
+1FF3; F; 03C9 03B9; # GREEK SMALL LETTER OMEGA WITH YPOGEGRAMMENI
+1FF4; F; 03CE 03B9; # GREEK SMALL LETTER OMEGA WITH OXIA AND YPOGEGRAMMENI
+1FF6; F; 03C9 0342; # GREEK SMALL LETTER OMEGA WITH PERISPOMENI
+1FF7; F; 03C9 0342 03B9; # GREEK SMALL LETTER OMEGA WITH PERISPOMENI AND YPOGEGRAMMENI
+1FF8; C; 1F78; # GREEK CAPITAL LETTER OMICRON WITH VARIA
+1FF9; C; 1F79; # GREEK CAPITAL LETTER OMICRON WITH OXIA
+1FFA; C; 1F7C; # GREEK CAPITAL LETTER OMEGA WITH VARIA
+1FFB; C; 1F7D; # GREEK CAPITAL LETTER OMEGA WITH OXIA
+1FFC; F; 03C9 03B9; # GREEK CAPITAL LETTER OMEGA WITH PROSGEGRAMMENI
+1FFC; S; 1FF3; # GREEK CAPITAL LETTER OMEGA WITH PROSGEGRAMMENI
+2126; C; 03C9; # OHM SIGN
+212A; C; 006B; # KELVIN SIGN
+212B; C; 00E5; # ANGSTROM SIGN
+2132; C; 214E; # TURNED CAPITAL F
+2160; C; 2170; # ROMAN NUMERAL ONE
+2161; C; 2171; # ROMAN NUMERAL TWO
+2162; C; 2172; # ROMAN NUMERAL THREE
+2163; C; 2173; # ROMAN NUMERAL FOUR
+2164; C; 2174; # ROMAN NUMERAL FIVE
+2165; C; 2175; # ROMAN NUMERAL SIX
+2166; C; 2176; # ROMAN NUMERAL SEVEN
+2167; C; 2177; # ROMAN NUMERAL EIGHT
+2168; C; 2178; # ROMAN NUMERAL NINE
+2169; C; 2179; # ROMAN NUMERAL TEN
+216A; C; 217A; # ROMAN NUMERAL ELEVEN
+216B; C; 217B; # ROMAN NUMERAL TWELVE
+216C; C; 217C; # ROMAN NUMERAL FIFTY
+216D; C; 217D; # ROMAN NUMERAL ONE HUNDRED
+216E; C; 217E; # ROMAN NUMERAL FIVE HUNDRED
+216F; C; 217F; # ROMAN NUMERAL ONE THOUSAND
+2183; C; 2184; # ROMAN NUMERAL REVERSED ONE HUNDRED
+24B6; C; 24D0; # CIRCLED LATIN CAPITAL LETTER A
+24B7; C; 24D1; # CIRCLED LATIN CAPITAL LETTER B
+24B8; C; 24D2; # CIRCLED LATIN CAPITAL LETTER C
+24B9; C; 24D3; # CIRCLED LATIN CAPITAL LETTER D
+24BA; C; 24D4; # CIRCLED LATIN CAPITAL LETTER E
+24BB; C; 24D5; # CIRCLED LATIN CAPITAL LETTER F
+24BC; C; 24D6; # CIRCLED LATIN CAPITAL LETTER G
+24BD; C; 24D7; # CIRCLED LATIN CAPITAL LETTER H
+24BE; C; 24D8; # CIRCLED LATIN CAPITAL LETTER I
+24BF; C; 24D9; # CIRCLED LATIN CAPITAL LETTER J
+24C0; C; 24DA; # CIRCLED LATIN CAPITAL LETTER K
+24C1; C; 24DB; # CIRCLED LATIN CAPITAL LETTER L
+24C2; C; 24DC; # CIRCLED LATIN CAPITAL LETTER M
+24C3; C; 24DD; # CIRCLED LATIN CAPITAL LETTER N
+24C4; C; 24DE; # CIRCLED LATIN CAPITAL LETTER O
+24C5; C; 24DF; # CIRCLED LATIN CAPITAL LETTER P
+24C6; C; 24E0; # CIRCLED LATIN CAPITAL LETTER Q
+24C7; C; 24E1; # CIRCLED LATIN CAPITAL LETTER R
+24C8; C; 24E2; # CIRCLED LATIN CAPITAL LETTER S
+24C9; C; 24E3; # CIRCLED LATIN CAPITAL LETTER T
+24CA; C; 24E4; # CIRCLED LATIN CAPITAL LETTER U
+24CB; C; 24E5; # CIRCLED LATIN CAPITAL LETTER V
+24CC; C; 24E6; # CIRCLED LATIN CAPITAL LETTER W
+24CD; C; 24E7; # CIRCLED LATIN CAPITAL LETTER X
+24CE; C; 24E8; # CIRCLED LATIN CAPITAL LETTER Y
+24CF; C; 24E9; # CIRCLED LATIN CAPITAL LETTER Z
+2C00; C; 2C30; # GLAGOLITIC CAPITAL LETTER AZU
+2C01; C; 2C31; # GLAGOLITIC CAPITAL LETTER BUKY
+2C02; C; 2C32; # GLAGOLITIC CAPITAL LETTER VEDE
+2C03; C; 2C33; # GLAGOLITIC CAPITAL LETTER GLAGOLI
+2C04; C; 2C34; # GLAGOLITIC CAPITAL LETTER DOBRO
+2C05; C; 2C35; # GLAGOLITIC CAPITAL LETTER YESTU
+2C06; C; 2C36; # GLAGOLITIC CAPITAL LETTER ZHIVETE
+2C07; C; 2C37; # GLAGOLITIC CAPITAL LETTER DZELO
+2C08; C; 2C38; # GLAGOLITIC CAPITAL LETTER ZEMLJA
+2C09; C; 2C39; # GLAGOLITIC CAPITAL LETTER IZHE
+2C0A; C; 2C3A; # GLAGOLITIC CAPITAL LETTER INITIAL IZHE
+2C0B; C; 2C3B; # GLAGOLITIC CAPITAL LETTER I
+2C0C; C; 2C3C; # GLAGOLITIC CAPITAL LETTER DJERVI
+2C0D; C; 2C3D; # GLAGOLITIC CAPITAL LETTER KAKO
+2C0E; C; 2C3E; # GLAGOLITIC CAPITAL LETTER LJUDIJE
+2C0F; C; 2C3F; # GLAGOLITIC CAPITAL LETTER MYSLITE
+2C10; C; 2C40; # GLAGOLITIC CAPITAL LETTER NASHI
+2C11; C; 2C41; # GLAGOLITIC CAPITAL LETTER ONU
+2C12; C; 2C42; # GLAGOLITIC CAPITAL LETTER POKOJI
+2C13; C; 2C43; # GLAGOLITIC CAPITAL LETTER RITSI
+2C14; C; 2C44; # GLAGOLITIC CAPITAL LETTER SLOVO
+2C15; C; 2C45; # GLAGOLITIC CAPITAL LETTER TVRIDO
+2C16; C; 2C46; # GLAGOLITIC CAPITAL LETTER UKU
+2C17; C; 2C47; # GLAGOLITIC CAPITAL LETTER FRITU
+2C18; C; 2C48; # GLAGOLITIC CAPITAL LETTER HERU
+2C19; C; 2C49; # GLAGOLITIC CAPITAL LETTER OTU
+2C1A; C; 2C4A; # GLAGOLITIC CAPITAL LETTER PE
+2C1B; C; 2C4B; # GLAGOLITIC CAPITAL LETTER SHTA
+2C1C; C; 2C4C; # GLAGOLITIC CAPITAL LETTER TSI
+2C1D; C; 2C4D; # GLAGOLITIC CAPITAL LETTER CHRIVI
+2C1E; C; 2C4E; # GLAGOLITIC CAPITAL LETTER SHA
+2C1F; C; 2C4F; # GLAGOLITIC CAPITAL LETTER YERU
+2C20; C; 2C50; # GLAGOLITIC CAPITAL LETTER YERI
+2C21; C; 2C51; # GLAGOLITIC CAPITAL LETTER YATI
+2C22; C; 2C52; # GLAGOLITIC CAPITAL LETTER SPIDERY HA
+2C23; C; 2C53; # GLAGOLITIC CAPITAL LETTER YU
+2C24; C; 2C54; # GLAGOLITIC CAPITAL LETTER SMALL YUS
+2C25; C; 2C55; # GLAGOLITIC CAPITAL LETTER SMALL YUS WITH TAIL
+2C26; C; 2C56; # GLAGOLITIC CAPITAL LETTER YO
+2C27; C; 2C57; # GLAGOLITIC CAPITAL LETTER IOTATED SMALL YUS
+2C28; C; 2C58; # GLAGOLITIC CAPITAL LETTER BIG YUS
+2C29; C; 2C59; # GLAGOLITIC CAPITAL LETTER IOTATED BIG YUS
+2C2A; C; 2C5A; # GLAGOLITIC CAPITAL LETTER FITA
+2C2B; C; 2C5B; # GLAGOLITIC CAPITAL LETTER IZHITSA
+2C2C; C; 2C5C; # GLAGOLITIC CAPITAL LETTER SHTAPIC
+2C2D; C; 2C5D; # GLAGOLITIC CAPITAL LETTER TROKUTASTI A
+2C2E; C; 2C5E; # GLAGOLITIC CAPITAL LETTER LATINATE MYSLITE
+2C60; C; 2C61; # LATIN CAPITAL LETTER L WITH DOUBLE BAR
+2C62; C; 026B; # LATIN CAPITAL LETTER L WITH MIDDLE TILDE
+2C63; C; 1D7D; # LATIN CAPITAL LETTER P WITH STROKE
+2C64; C; 027D; # LATIN CAPITAL LETTER R WITH TAIL
+2C67; C; 2C68; # LATIN CAPITAL LETTER H WITH DESCENDER
+2C69; C; 2C6A; # LATIN CAPITAL LETTER K WITH DESCENDER
+2C6B; C; 2C6C; # LATIN CAPITAL LETTER Z WITH DESCENDER
+2C6D; C; 0251; # LATIN CAPITAL LETTER ALPHA
+2C6E; C; 0271; # LATIN CAPITAL LETTER M WITH HOOK
+2C6F; C; 0250; # LATIN CAPITAL LETTER TURNED A
+2C70; C; 0252; # LATIN CAPITAL LETTER TURNED ALPHA
+2C72; C; 2C73; # LATIN CAPITAL LETTER W WITH HOOK
+2C75; C; 2C76; # LATIN CAPITAL LETTER HALF H
+2C7E; C; 023F; # LATIN CAPITAL LETTER S WITH SWASH TAIL
+2C7F; C; 0240; # LATIN CAPITAL LETTER Z WITH SWASH TAIL
+2C80; C; 2C81; # COPTIC CAPITAL LETTER ALFA
+2C82; C; 2C83; # COPTIC CAPITAL LETTER VIDA
+2C84; C; 2C85; # COPTIC CAPITAL LETTER GAMMA
+2C86; C; 2C87; # COPTIC CAPITAL LETTER DALDA
+2C88; C; 2C89; # COPTIC CAPITAL LETTER EIE
+2C8A; C; 2C8B; # COPTIC CAPITAL LETTER SOU
+2C8C; C; 2C8D; # COPTIC CAPITAL LETTER ZATA
+2C8E; C; 2C8F; # COPTIC CAPITAL LETTER HATE
+2C90; C; 2C91; # COPTIC CAPITAL LETTER THETHE
+2C92; C; 2C93; # COPTIC CAPITAL LETTER IAUDA
+2C94; C; 2C95; # COPTIC CAPITAL LETTER KAPA
+2C96; C; 2C97; # COPTIC CAPITAL LETTER LAULA
+2C98; C; 2C99; # COPTIC CAPITAL LETTER MI
+2C9A; C; 2C9B; # COPTIC CAPITAL LETTER NI
+2C9C; C; 2C9D; # COPTIC CAPITAL LETTER KSI
+2C9E; C; 2C9F; # COPTIC CAPITAL LETTER O
+2CA0; C; 2CA1; # COPTIC CAPITAL LETTER PI
+2CA2; C; 2CA3; # COPTIC CAPITAL LETTER RO
+2CA4; C; 2CA5; # COPTIC CAPITAL LETTER SIMA
+2CA6; C; 2CA7; # COPTIC CAPITAL LETTER TAU
+2CA8; C; 2CA9; # COPTIC CAPITAL LETTER UA
+2CAA; C; 2CAB; # COPTIC CAPITAL LETTER FI
+2CAC; C; 2CAD; # COPTIC CAPITAL LETTER KHI
+2CAE; C; 2CAF; # COPTIC CAPITAL LETTER PSI
+2CB0; C; 2CB1; # COPTIC CAPITAL LETTER OOU
+2CB2; C; 2CB3; # COPTIC CAPITAL LETTER DIALECT-P ALEF
+2CB4; C; 2CB5; # COPTIC CAPITAL LETTER OLD COPTIC AIN
+2CB6; C; 2CB7; # COPTIC CAPITAL LETTER CRYPTOGRAMMIC EIE
+2CB8; C; 2CB9; # COPTIC CAPITAL LETTER DIALECT-P KAPA
+2CBA; C; 2CBB; # COPTIC CAPITAL LETTER DIALECT-P NI
+2CBC; C; 2CBD; # COPTIC CAPITAL LETTER CRYPTOGRAMMIC NI
+2CBE; C; 2CBF; # COPTIC CAPITAL LETTER OLD COPTIC OOU
+2CC0; C; 2CC1; # COPTIC CAPITAL LETTER SAMPI
+2CC2; C; 2CC3; # COPTIC CAPITAL LETTER CROSSED SHEI
+2CC4; C; 2CC5; # COPTIC CAPITAL LETTER OLD COPTIC SHEI
+2CC6; C; 2CC7; # COPTIC CAPITAL LETTER OLD COPTIC ESH
+2CC8; C; 2CC9; # COPTIC CAPITAL LETTER AKHMIMIC KHEI
+2CCA; C; 2CCB; # COPTIC CAPITAL LETTER DIALECT-P HORI
+2CCC; C; 2CCD; # COPTIC CAPITAL LETTER OLD COPTIC HORI
+2CCE; C; 2CCF; # COPTIC CAPITAL LETTER OLD COPTIC HA
+2CD0; C; 2CD1; # COPTIC CAPITAL LETTER L-SHAPED HA
+2CD2; C; 2CD3; # COPTIC CAPITAL LETTER OLD COPTIC HEI
+2CD4; C; 2CD5; # COPTIC CAPITAL LETTER OLD COPTIC HAT
+2CD6; C; 2CD7; # COPTIC CAPITAL LETTER OLD COPTIC GANGIA
+2CD8; C; 2CD9; # COPTIC CAPITAL LETTER OLD COPTIC DJA
+2CDA; C; 2CDB; # COPTIC CAPITAL LETTER OLD COPTIC SHIMA
+2CDC; C; 2CDD; # COPTIC CAPITAL LETTER OLD NUBIAN SHIMA
+2CDE; C; 2CDF; # COPTIC CAPITAL LETTER OLD NUBIAN NGI
+2CE0; C; 2CE1; # COPTIC CAPITAL LETTER OLD NUBIAN NYI
+2CE2; C; 2CE3; # COPTIC CAPITAL LETTER OLD NUBIAN WAU
+2CEB; C; 2CEC; # COPTIC CAPITAL LETTER CRYPTOGRAMMIC SHEI
+2CED; C; 2CEE; # COPTIC CAPITAL LETTER CRYPTOGRAMMIC GANGIA
+2CF2; C; 2CF3; # COPTIC CAPITAL LETTER BOHAIRIC KHEI
+A640; C; A641; # CYRILLIC CAPITAL LETTER ZEMLYA
+A642; C; A643; # CYRILLIC CAPITAL LETTER DZELO
+A644; C; A645; # CYRILLIC CAPITAL LETTER REVERSED DZE
+A646; C; A647; # CYRILLIC CAPITAL LETTER IOTA
+A648; C; A649; # CYRILLIC CAPITAL LETTER DJERV
+A64A; C; A64B; # CYRILLIC CAPITAL LETTER MONOGRAPH UK
+A64C; C; A64D; # CYRILLIC CAPITAL LETTER BROAD OMEGA
+A64E; C; A64F; # CYRILLIC CAPITAL LETTER NEUTRAL YER
+A650; C; A651; # CYRILLIC CAPITAL LETTER YERU WITH BACK YER
+A652; C; A653; # CYRILLIC CAPITAL LETTER IOTIFIED YAT
+A654; C; A655; # CYRILLIC CAPITAL LETTER REVERSED YU
+A656; C; A657; # CYRILLIC CAPITAL LETTER IOTIFIED A
+A658; C; A659; # CYRILLIC CAPITAL LETTER CLOSED LITTLE YUS
+A65A; C; A65B; # CYRILLIC CAPITAL LETTER BLENDED YUS
+A65C; C; A65D; # CYRILLIC CAPITAL LETTER IOTIFIED CLOSED LITTLE YUS
+A65E; C; A65F; # CYRILLIC CAPITAL LETTER YN
+A660; C; A661; # CYRILLIC CAPITAL LETTER REVERSED TSE
+A662; C; A663; # CYRILLIC CAPITAL LETTER SOFT DE
+A664; C; A665; # CYRILLIC CAPITAL LETTER SOFT EL
+A666; C; A667; # CYRILLIC CAPITAL LETTER SOFT EM
+A668; C; A669; # CYRILLIC CAPITAL LETTER MONOCULAR O
+A66A; C; A66B; # CYRILLIC CAPITAL LETTER BINOCULAR O
+A66C; C; A66D; # CYRILLIC CAPITAL LETTER DOUBLE MONOCULAR O
+A680; C; A681; # CYRILLIC CAPITAL LETTER DWE
+A682; C; A683; # CYRILLIC CAPITAL LETTER DZWE
+A684; C; A685; # CYRILLIC CAPITAL LETTER ZHWE
+A686; C; A687; # CYRILLIC CAPITAL LETTER CCHE
+A688; C; A689; # CYRILLIC CAPITAL LETTER DZZE
+A68A; C; A68B; # CYRILLIC CAPITAL LETTER TE WITH MIDDLE HOOK
+A68C; C; A68D; # CYRILLIC CAPITAL LETTER TWE
+A68E; C; A68F; # CYRILLIC CAPITAL LETTER TSWE
+A690; C; A691; # CYRILLIC CAPITAL LETTER TSSE
+A692; C; A693; # CYRILLIC CAPITAL LETTER TCHE
+A694; C; A695; # CYRILLIC CAPITAL LETTER HWE
+A696; C; A697; # CYRILLIC CAPITAL LETTER SHWE
+A698; C; A699; # CYRILLIC CAPITAL LETTER DOUBLE O
+A69A; C; A69B; # CYRILLIC CAPITAL LETTER CROSSED O
+A722; C; A723; # LATIN CAPITAL LETTER EGYPTOLOGICAL ALEF
+A724; C; A725; # LATIN CAPITAL LETTER EGYPTOLOGICAL AIN
+A726; C; A727; # LATIN CAPITAL LETTER HENG
+A728; C; A729; # LATIN CAPITAL LETTER TZ
+A72A; C; A72B; # LATIN CAPITAL LETTER TRESILLO
+A72C; C; A72D; # LATIN CAPITAL LETTER CUATRILLO
+A72E; C; A72F; # LATIN CAPITAL LETTER CUATRILLO WITH COMMA
+A732; C; A733; # LATIN CAPITAL LETTER AA
+A734; C; A735; # LATIN CAPITAL LETTER AO
+A736; C; A737; # LATIN CAPITAL LETTER AU
+A738; C; A739; # LATIN CAPITAL LETTER AV
+A73A; C; A73B; # LATIN CAPITAL LETTER AV WITH HORIZONTAL BAR
+A73C; C; A73D; # LATIN CAPITAL LETTER AY
+A73E; C; A73F; # LATIN CAPITAL LETTER REVERSED C WITH DOT
+A740; C; A741; # LATIN CAPITAL LETTER K WITH STROKE
+A742; C; A743; # LATIN CAPITAL LETTER K WITH DIAGONAL STROKE
+A744; C; A745; # LATIN CAPITAL LETTER K WITH STROKE AND DIAGONAL STROKE
+A746; C; A747; # LATIN CAPITAL LETTER BROKEN L
+A748; C; A749; # LATIN CAPITAL LETTER L WITH HIGH STROKE
+A74A; C; A74B; # LATIN CAPITAL LETTER O WITH LONG STROKE OVERLAY
+A74C; C; A74D; # LATIN CAPITAL LETTER O WITH LOOP
+A74E; C; A74F; # LATIN CAPITAL LETTER OO
+A750; C; A751; # LATIN CAPITAL LETTER P WITH STROKE THROUGH DESCENDER
+A752; C; A753; # LATIN CAPITAL LETTER P WITH FLOURISH
+A754; C; A755; # LATIN CAPITAL LETTER P WITH SQUIRREL TAIL
+A756; C; A757; # LATIN CAPITAL LETTER Q WITH STROKE THROUGH DESCENDER
+A758; C; A759; # LATIN CAPITAL LETTER Q WITH DIAGONAL STROKE
+A75A; C; A75B; # LATIN CAPITAL LETTER R ROTUNDA
+A75C; C; A75D; # LATIN CAPITAL LETTER RUM ROTUNDA
+A75E; C; A75F; # LATIN CAPITAL LETTER V WITH DIAGONAL STROKE
+A760; C; A761; # LATIN CAPITAL LETTER VY
+A762; C; A763; # LATIN CAPITAL LETTER VISIGOTHIC Z
+A764; C; A765; # LATIN CAPITAL LETTER THORN WITH STROKE
+A766; C; A767; # LATIN CAPITAL LETTER THORN WITH STROKE THROUGH DESCENDER
+A768; C; A769; # LATIN CAPITAL LETTER VEND
+A76A; C; A76B; # LATIN CAPITAL LETTER ET
+A76C; C; A76D; # LATIN CAPITAL LETTER IS
+A76E; C; A76F; # LATIN CAPITAL LETTER CON
+A779; C; A77A; # LATIN CAPITAL LETTER INSULAR D
+A77B; C; A77C; # LATIN CAPITAL LETTER INSULAR F
+A77D; C; 1D79; # LATIN CAPITAL LETTER INSULAR G
+A77E; C; A77F; # LATIN CAPITAL LETTER TURNED INSULAR G
+A780; C; A781; # LATIN CAPITAL LETTER TURNED L
+A782; C; A783; # LATIN CAPITAL LETTER INSULAR R
+A784; C; A785; # LATIN CAPITAL LETTER INSULAR S
+A786; C; A787; # LATIN CAPITAL LETTER INSULAR T
+A78B; C; A78C; # LATIN CAPITAL LETTER SALTILLO
+A78D; C; 0265; # LATIN CAPITAL LETTER TURNED H
+A790; C; A791; # LATIN CAPITAL LETTER N WITH DESCENDER
+A792; C; A793; # LATIN CAPITAL LETTER C WITH BAR
+A796; C; A797; # LATIN CAPITAL LETTER B WITH FLOURISH
+A798; C; A799; # LATIN CAPITAL LETTER F WITH STROKE
+A79A; C; A79B; # LATIN CAPITAL LETTER VOLAPUK AE
+A79C; C; A79D; # LATIN CAPITAL LETTER VOLAPUK OE
+A79E; C; A79F; # LATIN CAPITAL LETTER VOLAPUK UE
+A7A0; C; A7A1; # LATIN CAPITAL LETTER G WITH OBLIQUE STROKE
+A7A2; C; A7A3; # LATIN CAPITAL LETTER K WITH OBLIQUE STROKE
+A7A4; C; A7A5; # LATIN CAPITAL LETTER N WITH OBLIQUE STROKE
+A7A6; C; A7A7; # LATIN CAPITAL LETTER R WITH OBLIQUE STROKE
+A7A8; C; A7A9; # LATIN CAPITAL LETTER S WITH OBLIQUE STROKE
+A7AA; C; 0266; # LATIN CAPITAL LETTER H WITH HOOK
+A7AB; C; 025C; # LATIN CAPITAL LETTER REVERSED OPEN E
+A7AC; C; 0261; # LATIN CAPITAL LETTER SCRIPT G
+A7AD; C; 026C; # LATIN CAPITAL LETTER L WITH BELT
+A7B0; C; 029E; # LATIN CAPITAL LETTER TURNED K
+A7B1; C; 0287; # LATIN CAPITAL LETTER TURNED T
+A7B2; C; 029D; # LATIN CAPITAL LETTER J WITH CROSSED-TAIL
+A7B3; C; AB53; # LATIN CAPITAL LETTER CHI
+A7B4; C; A7B5; # LATIN CAPITAL LETTER BETA
+A7B6; C; A7B7; # LATIN CAPITAL LETTER OMEGA
+AB70; C; 13A0; # CHEROKEE SMALL LETTER A
+AB71; C; 13A1; # CHEROKEE SMALL LETTER E
+AB72; C; 13A2; # CHEROKEE SMALL LETTER I
+AB73; C; 13A3; # CHEROKEE SMALL LETTER O
+AB74; C; 13A4; # CHEROKEE SMALL LETTER U
+AB75; C; 13A5; # CHEROKEE SMALL LETTER V
+AB76; C; 13A6; # CHEROKEE SMALL LETTER GA
+AB77; C; 13A7; # CHEROKEE SMALL LETTER KA
+AB78; C; 13A8; # CHEROKEE SMALL LETTER GE
+AB79; C; 13A9; # CHEROKEE SMALL LETTER GI
+AB7A; C; 13AA; # CHEROKEE SMALL LETTER GO
+AB7B; C; 13AB; # CHEROKEE SMALL LETTER GU
+AB7C; C; 13AC; # CHEROKEE SMALL LETTER GV
+AB7D; C; 13AD; # CHEROKEE SMALL LETTER HA
+AB7E; C; 13AE; # CHEROKEE SMALL LETTER HE
+AB7F; C; 13AF; # CHEROKEE SMALL LETTER HI
+AB80; C; 13B0; # CHEROKEE SMALL LETTER HO
+AB81; C; 13B1; # CHEROKEE SMALL LETTER HU
+AB82; C; 13B2; # CHEROKEE SMALL LETTER HV
+AB83; C; 13B3; # CHEROKEE SMALL LETTER LA
+AB84; C; 13B4; # CHEROKEE SMALL LETTER LE
+AB85; C; 13B5; # CHEROKEE SMALL LETTER LI
+AB86; C; 13B6; # CHEROKEE SMALL LETTER LO
+AB87; C; 13B7; # CHEROKEE SMALL LETTER LU
+AB88; C; 13B8; # CHEROKEE SMALL LETTER LV
+AB89; C; 13B9; # CHEROKEE SMALL LETTER MA
+AB8A; C; 13BA; # CHEROKEE SMALL LETTER ME
+AB8B; C; 13BB; # CHEROKEE SMALL LETTER MI
+AB8C; C; 13BC; # CHEROKEE SMALL LETTER MO
+AB8D; C; 13BD; # CHEROKEE SMALL LETTER MU
+AB8E; C; 13BE; # CHEROKEE SMALL LETTER NA
+AB8F; C; 13BF; # CHEROKEE SMALL LETTER HNA
+AB90; C; 13C0; # CHEROKEE SMALL LETTER NAH
+AB91; C; 13C1; # CHEROKEE SMALL LETTER NE
+AB92; C; 13C2; # CHEROKEE SMALL LETTER NI
+AB93; C; 13C3; # CHEROKEE SMALL LETTER NO
+AB94; C; 13C4; # CHEROKEE SMALL LETTER NU
+AB95; C; 13C5; # CHEROKEE SMALL LETTER NV
+AB96; C; 13C6; # CHEROKEE SMALL LETTER QUA
+AB97; C; 13C7; # CHEROKEE SMALL LETTER QUE
+AB98; C; 13C8; # CHEROKEE SMALL LETTER QUI
+AB99; C; 13C9; # CHEROKEE SMALL LETTER QUO
+AB9A; C; 13CA; # CHEROKEE SMALL LETTER QUU
+AB9B; C; 13CB; # CHEROKEE SMALL LETTER QUV
+AB9C; C; 13CC; # CHEROKEE SMALL LETTER SA
+AB9D; C; 13CD; # CHEROKEE SMALL LETTER S
+AB9E; C; 13CE; # CHEROKEE SMALL LETTER SE
+AB9F; C; 13CF; # CHEROKEE SMALL LETTER SI
+ABA0; C; 13D0; # CHEROKEE SMALL LETTER SO
+ABA1; C; 13D1; # CHEROKEE SMALL LETTER SU
+ABA2; C; 13D2; # CHEROKEE SMALL LETTER SV
+ABA3; C; 13D3; # CHEROKEE SMALL LETTER DA
+ABA4; C; 13D4; # CHEROKEE SMALL LETTER TA
+ABA5; C; 13D5; # CHEROKEE SMALL LETTER DE
+ABA6; C; 13D6; # CHEROKEE SMALL LETTER TE
+ABA7; C; 13D7; # CHEROKEE SMALL LETTER DI
+ABA8; C; 13D8; # CHEROKEE SMALL LETTER TI
+ABA9; C; 13D9; # CHEROKEE SMALL LETTER DO
+ABAA; C; 13DA; # CHEROKEE SMALL LETTER DU
+ABAB; C; 13DB; # CHEROKEE SMALL LETTER DV
+ABAC; C; 13DC; # CHEROKEE SMALL LETTER DLA
+ABAD; C; 13DD; # CHEROKEE SMALL LETTER TLA
+ABAE; C; 13DE; # CHEROKEE SMALL LETTER TLE
+ABAF; C; 13DF; # CHEROKEE SMALL LETTER TLI
+ABB0; C; 13E0; # CHEROKEE SMALL LETTER TLO
+ABB1; C; 13E1; # CHEROKEE SMALL LETTER TLU
+ABB2; C; 13E2; # CHEROKEE SMALL LETTER TLV
+ABB3; C; 13E3; # CHEROKEE SMALL LETTER TSA
+ABB4; C; 13E4; # CHEROKEE SMALL LETTER TSE
+ABB5; C; 13E5; # CHEROKEE SMALL LETTER TSI
+ABB6; C; 13E6; # CHEROKEE SMALL LETTER TSO
+ABB7; C; 13E7; # CHEROKEE SMALL LETTER TSU
+ABB8; C; 13E8; # CHEROKEE SMALL LETTER TSV
+ABB9; C; 13E9; # CHEROKEE SMALL LETTER WA
+ABBA; C; 13EA; # CHEROKEE SMALL LETTER WE
+ABBB; C; 13EB; # CHEROKEE SMALL LETTER WI
+ABBC; C; 13EC; # CHEROKEE SMALL LETTER WO
+ABBD; C; 13ED; # CHEROKEE SMALL LETTER WU
+ABBE; C; 13EE; # CHEROKEE SMALL LETTER WV
+ABBF; C; 13EF; # CHEROKEE SMALL LETTER YA
+FB00; F; 0066 0066; # LATIN SMALL LIGATURE FF
+FB01; F; 0066 0069; # LATIN SMALL LIGATURE FI
+FB02; F; 0066 006C; # LATIN SMALL LIGATURE FL
+FB03; F; 0066 0066 0069; # LATIN SMALL LIGATURE FFI
+FB04; F; 0066 0066 006C; # LATIN SMALL LIGATURE FFL
+FB05; F; 0073 0074; # LATIN SMALL LIGATURE LONG S T
+FB06; F; 0073 0074; # LATIN SMALL LIGATURE ST
+FB13; F; 0574 0576; # ARMENIAN SMALL LIGATURE MEN NOW
+FB14; F; 0574 0565; # ARMENIAN SMALL LIGATURE MEN ECH
+FB15; F; 0574 056B; # ARMENIAN SMALL LIGATURE MEN INI
+FB16; F; 057E 0576; # ARMENIAN SMALL LIGATURE VEW NOW
+FB17; F; 0574 056D; # ARMENIAN SMALL LIGATURE MEN XEH
+FF21; C; FF41; # FULLWIDTH LATIN CAPITAL LETTER A
+FF22; C; FF42; # FULLWIDTH LATIN CAPITAL LETTER B
+FF23; C; FF43; # FULLWIDTH LATIN CAPITAL LETTER C
+FF24; C; FF44; # FULLWIDTH LATIN CAPITAL LETTER D
+FF25; C; FF45; # FULLWIDTH LATIN CAPITAL LETTER E
+FF26; C; FF46; # FULLWIDTH LATIN CAPITAL LETTER F
+FF27; C; FF47; # FULLWIDTH LATIN CAPITAL LETTER G
+FF28; C; FF48; # FULLWIDTH LATIN CAPITAL LETTER H
+FF29; C; FF49; # FULLWIDTH LATIN CAPITAL LETTER I
+FF2A; C; FF4A; # FULLWIDTH LATIN CAPITAL LETTER J
+FF2B; C; FF4B; # FULLWIDTH LATIN CAPITAL LETTER K
+FF2C; C; FF4C; # FULLWIDTH LATIN CAPITAL LETTER L
+FF2D; C; FF4D; # FULLWIDTH LATIN CAPITAL LETTER M
+FF2E; C; FF4E; # FULLWIDTH LATIN CAPITAL LETTER N
+FF2F; C; FF4F; # FULLWIDTH LATIN CAPITAL LETTER O
+FF30; C; FF50; # FULLWIDTH LATIN CAPITAL LETTER P
+FF31; C; FF51; # FULLWIDTH LATIN CAPITAL LETTER Q
+FF32; C; FF52; # FULLWIDTH LATIN CAPITAL LETTER R
+FF33; C; FF53; # FULLWIDTH LATIN CAPITAL LETTER S
+FF34; C; FF54; # FULLWIDTH LATIN CAPITAL LETTER T
+FF35; C; FF55; # FULLWIDTH LATIN CAPITAL LETTER U
+FF36; C; FF56; # FULLWIDTH LATIN CAPITAL LETTER V
+FF37; C; FF57; # FULLWIDTH LATIN CAPITAL LETTER W
+FF38; C; FF58; # FULLWIDTH LATIN CAPITAL LETTER X
+FF39; C; FF59; # FULLWIDTH LATIN CAPITAL LETTER Y
+FF3A; C; FF5A; # FULLWIDTH LATIN CAPITAL LETTER Z
+10400; C; 10428; # DESERET CAPITAL LETTER LONG I
+10401; C; 10429; # DESERET CAPITAL LETTER LONG E
+10402; C; 1042A; # DESERET CAPITAL LETTER LONG A
+10403; C; 1042B; # DESERET CAPITAL LETTER LONG AH
+10404; C; 1042C; # DESERET CAPITAL LETTER LONG O
+10405; C; 1042D; # DESERET CAPITAL LETTER LONG OO
+10406; C; 1042E; # DESERET CAPITAL LETTER SHORT I
+10407; C; 1042F; # DESERET CAPITAL LETTER SHORT E
+10408; C; 10430; # DESERET CAPITAL LETTER SHORT A
+10409; C; 10431; # DESERET CAPITAL LETTER SHORT AH
+1040A; C; 10432; # DESERET CAPITAL LETTER SHORT O
+1040B; C; 10433; # DESERET CAPITAL LETTER SHORT OO
+1040C; C; 10434; # DESERET CAPITAL LETTER AY
+1040D; C; 10435; # DESERET CAPITAL LETTER OW
+1040E; C; 10436; # DESERET CAPITAL LETTER WU
+1040F; C; 10437; # DESERET CAPITAL LETTER YEE
+10410; C; 10438; # DESERET CAPITAL LETTER H
+10411; C; 10439; # DESERET CAPITAL LETTER PEE
+10412; C; 1043A; # DESERET CAPITAL LETTER BEE
+10413; C; 1043B; # DESERET CAPITAL LETTER TEE
+10414; C; 1043C; # DESERET CAPITAL LETTER DEE
+10415; C; 1043D; # DESERET CAPITAL LETTER CHEE
+10416; C; 1043E; # DESERET CAPITAL LETTER JEE
+10417; C; 1043F; # DESERET CAPITAL LETTER KAY
+10418; C; 10440; # DESERET CAPITAL LETTER GAY
+10419; C; 10441; # DESERET CAPITAL LETTER EF
+1041A; C; 10442; # DESERET CAPITAL LETTER VEE
+1041B; C; 10443; # DESERET CAPITAL LETTER ETH
+1041C; C; 10444; # DESERET CAPITAL LETTER THEE
+1041D; C; 10445; # DESERET CAPITAL LETTER ES
+1041E; C; 10446; # DESERET CAPITAL LETTER ZEE
+1041F; C; 10447; # DESERET CAPITAL LETTER ESH
+10420; C; 10448; # DESERET CAPITAL LETTER ZHEE
+10421; C; 10449; # DESERET CAPITAL LETTER ER
+10422; C; 1044A; # DESERET CAPITAL LETTER EL
+10423; C; 1044B; # DESERET CAPITAL LETTER EM
+10424; C; 1044C; # DESERET CAPITAL LETTER EN
+10425; C; 1044D; # DESERET CAPITAL LETTER ENG
+10426; C; 1044E; # DESERET CAPITAL LETTER OI
+10427; C; 1044F; # DESERET CAPITAL LETTER EW
+10C80; C; 10CC0; # OLD HUNGARIAN CAPITAL LETTER A
+10C81; C; 10CC1; # OLD HUNGARIAN CAPITAL LETTER AA
+10C82; C; 10CC2; # OLD HUNGARIAN CAPITAL LETTER EB
+10C83; C; 10CC3; # OLD HUNGARIAN CAPITAL LETTER AMB
+10C84; C; 10CC4; # OLD HUNGARIAN CAPITAL LETTER EC
+10C85; C; 10CC5; # OLD HUNGARIAN CAPITAL LETTER ENC
+10C86; C; 10CC6; # OLD HUNGARIAN CAPITAL LETTER ECS
+10C87; C; 10CC7; # OLD HUNGARIAN CAPITAL LETTER ED
+10C88; C; 10CC8; # OLD HUNGARIAN CAPITAL LETTER AND
+10C89; C; 10CC9; # OLD HUNGARIAN CAPITAL LETTER E
+10C8A; C; 10CCA; # OLD HUNGARIAN CAPITAL LETTER CLOSE E
+10C8B; C; 10CCB; # OLD HUNGARIAN CAPITAL LETTER EE
+10C8C; C; 10CCC; # OLD HUNGARIAN CAPITAL LETTER EF
+10C8D; C; 10CCD; # OLD HUNGARIAN CAPITAL LETTER EG
+10C8E; C; 10CCE; # OLD HUNGARIAN CAPITAL LETTER EGY
+10C8F; C; 10CCF; # OLD HUNGARIAN CAPITAL LETTER EH
+10C90; C; 10CD0; # OLD HUNGARIAN CAPITAL LETTER I
+10C91; C; 10CD1; # OLD HUNGARIAN CAPITAL LETTER II
+10C92; C; 10CD2; # OLD HUNGARIAN CAPITAL LETTER EJ
+10C93; C; 10CD3; # OLD HUNGARIAN CAPITAL LETTER EK
+10C94; C; 10CD4; # OLD HUNGARIAN CAPITAL LETTER AK
+10C95; C; 10CD5; # OLD HUNGARIAN CAPITAL LETTER UNK
+10C96; C; 10CD6; # OLD HUNGARIAN CAPITAL LETTER EL
+10C97; C; 10CD7; # OLD HUNGARIAN CAPITAL LETTER ELY
+10C98; C; 10CD8; # OLD HUNGARIAN CAPITAL LETTER EM
+10C99; C; 10CD9; # OLD HUNGARIAN CAPITAL LETTER EN
+10C9A; C; 10CDA; # OLD HUNGARIAN CAPITAL LETTER ENY
+10C9B; C; 10CDB; # OLD HUNGARIAN CAPITAL LETTER O
+10C9C; C; 10CDC; # OLD HUNGARIAN CAPITAL LETTER OO
+10C9D; C; 10CDD; # OLD HUNGARIAN CAPITAL LETTER NIKOLSBURG OE
+10C9E; C; 10CDE; # OLD HUNGARIAN CAPITAL LETTER RUDIMENTA OE
+10C9F; C; 10CDF; # OLD HUNGARIAN CAPITAL LETTER OEE
+10CA0; C; 10CE0; # OLD HUNGARIAN CAPITAL LETTER EP
+10CA1; C; 10CE1; # OLD HUNGARIAN CAPITAL LETTER EMP
+10CA2; C; 10CE2; # OLD HUNGARIAN CAPITAL LETTER ER
+10CA3; C; 10CE3; # OLD HUNGARIAN CAPITAL LETTER SHORT ER
+10CA4; C; 10CE4; # OLD HUNGARIAN CAPITAL LETTER ES
+10CA5; C; 10CE5; # OLD HUNGARIAN CAPITAL LETTER ESZ
+10CA6; C; 10CE6; # OLD HUNGARIAN CAPITAL LETTER ET
+10CA7; C; 10CE7; # OLD HUNGARIAN CAPITAL LETTER ENT
+10CA8; C; 10CE8; # OLD HUNGARIAN CAPITAL LETTER ETY
+10CA9; C; 10CE9; # OLD HUNGARIAN CAPITAL LETTER ECH
+10CAA; C; 10CEA; # OLD HUNGARIAN CAPITAL LETTER U
+10CAB; C; 10CEB; # OLD HUNGARIAN CAPITAL LETTER UU
+10CAC; C; 10CEC; # OLD HUNGARIAN CAPITAL LETTER NIKOLSBURG UE
+10CAD; C; 10CED; # OLD HUNGARIAN CAPITAL LETTER RUDIMENTA UE
+10CAE; C; 10CEE; # OLD HUNGARIAN CAPITAL LETTER EV
+10CAF; C; 10CEF; # OLD HUNGARIAN CAPITAL LETTER EZ
+10CB0; C; 10CF0; # OLD HUNGARIAN CAPITAL LETTER EZS
+10CB1; C; 10CF1; # OLD HUNGARIAN CAPITAL LETTER ENT-SHAPED SIGN
+10CB2; C; 10CF2; # OLD HUNGARIAN CAPITAL LETTER US
+118A0; C; 118C0; # WARANG CITI CAPITAL LETTER NGAA
+118A1; C; 118C1; # WARANG CITI CAPITAL LETTER A
+118A2; C; 118C2; # WARANG CITI CAPITAL LETTER WI
+118A3; C; 118C3; # WARANG CITI CAPITAL LETTER YU
+118A4; C; 118C4; # WARANG CITI CAPITAL LETTER YA
+118A5; C; 118C5; # WARANG CITI CAPITAL LETTER YO
+118A6; C; 118C6; # WARANG CITI CAPITAL LETTER II
+118A7; C; 118C7; # WARANG CITI CAPITAL LETTER UU
+118A8; C; 118C8; # WARANG CITI CAPITAL LETTER E
+118A9; C; 118C9; # WARANG CITI CAPITAL LETTER O
+118AA; C; 118CA; # WARANG CITI CAPITAL LETTER ANG
+118AB; C; 118CB; # WARANG CITI CAPITAL LETTER GA
+118AC; C; 118CC; # WARANG CITI CAPITAL LETTER KO
+118AD; C; 118CD; # WARANG CITI CAPITAL LETTER ENY
+118AE; C; 118CE; # WARANG CITI CAPITAL LETTER YUJ
+118AF; C; 118CF; # WARANG CITI CAPITAL LETTER UC
+118B0; C; 118D0; # WARANG CITI CAPITAL LETTER ENN
+118B1; C; 118D1; # WARANG CITI CAPITAL LETTER ODD
+118B2; C; 118D2; # WARANG CITI CAPITAL LETTER TTE
+118B3; C; 118D3; # WARANG CITI CAPITAL LETTER NUNG
+118B4; C; 118D4; # WARANG CITI CAPITAL LETTER DA
+118B5; C; 118D5; # WARANG CITI CAPITAL LETTER AT
+118B6; C; 118D6; # WARANG CITI CAPITAL LETTER AM
+118B7; C; 118D7; # WARANG CITI CAPITAL LETTER BU
+118B8; C; 118D8; # WARANG CITI CAPITAL LETTER PU
+118B9; C; 118D9; # WARANG CITI CAPITAL LETTER HIYO
+118BA; C; 118DA; # WARANG CITI CAPITAL LETTER HOLO
+118BB; C; 118DB; # WARANG CITI CAPITAL LETTER HORR
+118BC; C; 118DC; # WARANG CITI CAPITAL LETTER HAR
+118BD; C; 118DD; # WARANG CITI CAPITAL LETTER SSUU
+118BE; C; 118DE; # WARANG CITI CAPITAL LETTER SII
+118BF; C; 118DF; # WARANG CITI CAPITAL LETTER VIYO
+#
+# EOF
diff --git a/wasm/JSWebAssembly.cpp b/wasm/JSWebAssembly.cpp
new file mode 100644
index 0000000..7a3d7ac
--- /dev/null
+++ b/wasm/JSWebAssembly.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebAssembly.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(JSWebAssembly);
+
+const ClassInfo JSWebAssembly::s_info = { "WebAssembly", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWebAssembly) };
+
+JSWebAssembly* JSWebAssembly::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    auto* object = new (NotNull, allocateCell<JSWebAssembly>(vm.heap)) JSWebAssembly(vm, structure);
+    object->finishCreation(vm, globalObject);
+    return object;
+}
+
+Structure* JSWebAssembly::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void JSWebAssembly::finishCreation(VM& vm, JSGlobalObject*)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+JSWebAssembly::JSWebAssembly(VM& vm, Structure* structure)
+    : JSNonFinalObject(vm, structure)
+{
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/JSWebAssembly.h b/wasm/JSWebAssembly.h
new file mode 100644
index 0000000..996afda
--- /dev/null
+++ b/wasm/JSWebAssembly.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSObject.h"
+#include "js/JSWebAssemblyCallee.h"
+#include "js/JSWebAssemblyCompileError.h"
+#include "js/JSWebAssemblyInstance.h"
+#include "js/JSWebAssemblyMemory.h"
+#include "js/JSWebAssemblyModule.h"
+#include "js/JSWebAssemblyRuntimeError.h"
+#include "js/JSWebAssemblyTable.h"
+#include "js/WebAssemblyCompileErrorConstructor.h"
+#include "js/WebAssemblyCompileErrorPrototype.h"
+#include "js/WebAssemblyFunction.h"
+#include "js/WebAssemblyInstanceConstructor.h"
+#include "js/WebAssemblyInstancePrototype.h"
+#include "js/WebAssemblyMemoryConstructor.h"
+#include "js/WebAssemblyMemoryPrototype.h"
+#include "js/WebAssemblyModuleConstructor.h"
+#include "js/WebAssemblyModulePrototype.h"
+#include "js/WebAssemblyModuleRecord.h"
+#include "js/WebAssemblyPrototype.h"
+#include "js/WebAssemblyRuntimeErrorConstructor.h"
+#include "js/WebAssemblyRuntimeErrorPrototype.h"
+#include "js/WebAssemblyTableConstructor.h"
+#include "js/WebAssemblyTablePrototype.h"
+#include "js/WebAssemblyToJSCallee.h"
+
+namespace JSC {
+
+class JSWebAssembly : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static JSWebAssembly* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+
+private:
+    JSWebAssembly(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmB3IRGenerator.cpp b/wasm/WasmB3IRGenerator.cpp
new file mode 100644
index 0000000..9f58d13
--- /dev/null
+++ b/wasm/WasmB3IRGenerator.cpp
@@ -0,0 +1,1304 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WasmB3IRGenerator.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "B3BasicBlockInlines.h"
+#include "B3CCallValue.h"
+#include "B3Compile.h"
+#include "B3ConstPtrValue.h"
+#include "B3FixSSA.h"
+#include "B3Generate.h"
+#include "B3StackmapGenerationParams.h"
+#include "B3SwitchValue.h"
+#include "B3Validate.h"
+#include "B3ValueInlines.h"
+#include "B3Variable.h"
+#include "B3VariableValue.h"
+#include "B3WasmAddressValue.h"
+#include "B3WasmBoundsCheckValue.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyInstance.h"
+#include "JSWebAssemblyModule.h"
+#include "JSWebAssemblyRuntimeError.h"
+#include "VirtualRegister.h"
+#include "WasmCallingConvention.h"
+#include "WasmExceptionType.h"
+#include "WasmFunctionParser.h"
+#include "WasmMemory.h"
+#include <wtf/Optional.h>
+
+void dumpProcedure(void* ptr)
+{
+    JSC::B3::Procedure* proc = static_cast<JSC::B3::Procedure*>(ptr);
+    proc->dump(WTF::dataFile());
+}
+
+namespace JSC { namespace Wasm {
+
+using namespace B3;
+
+namespace {
+const bool verbose = false;
+}
+
+class B3IRGenerator {
+public:
+    struct ControlData {
+        ControlData(Procedure& proc, Type signature, BlockType type, BasicBlock* continuation, BasicBlock* special = nullptr)
+            : blockType(type)
+            , continuation(continuation)
+            , special(special)
+        {
+            if (signature != Void)
+                result.append(proc.addVariable(toB3Type(signature)));
+        }
+
+        ControlData()
+        {
+        }
+
+        void dump(PrintStream& out) const
+        {
+            switch (type()) {
+            case BlockType::If:
+                out.print("If:    ");
+                break;
+            case BlockType::Block:
+                out.print("Block: ");
+                break;
+            case BlockType::Loop:
+                out.print("Loop:  ");
+                break;
+            }
+            out.print("Continuation: ", *continuation, ", Special: ");
+            if (special)
+                out.print(*special);
+            else
+                out.print("None");
+        }
+
+        BlockType type() const { return blockType; }
+
+        bool hasNonVoidSignature() const { return result.size(); }
+
+        BasicBlock* targetBlockForBranch()
+        {
+            if (type() == BlockType::Loop)
+                return special;
+            return continuation;
+        }
+
+        void convertIfToBlock()
+        {
+            ASSERT(type() == BlockType::If);
+            blockType = BlockType::Block;
+            special = nullptr;
+        }
+
+    private:
+        friend class B3IRGenerator;
+        BlockType blockType;
+        BasicBlock* continuation;
+        BasicBlock* special;
+        Vector<Variable*, 1> result;
+    };
+
+    typedef Value* ExpressionType;
+    typedef ControlData ControlType;
+    typedef Vector<ExpressionType, 1> ExpressionList;
+    typedef Vector<Variable*, 1> ResultList;
+    typedef FunctionParser<B3IRGenerator>::ControlEntry ControlEntry;
+
+    static constexpr ExpressionType emptyExpression = nullptr;
+
+    typedef String ErrorType;
+    typedef UnexpectedType<ErrorType> UnexpectedResult;
+    typedef Expected<std::unique_ptr<WasmInternalFunction>, ErrorType> Result;
+    typedef Expected<void, ErrorType> PartialResult;
+    template <typename ...Args>
+    NEVER_INLINE UnexpectedResult WARN_UNUSED_RETURN fail(Args... args) const
+    {
+        using namespace FailureHelper; // See ADL comment in WasmParser.h.
+        return UnexpectedResult(makeString(ASCIILiteral("WebAssembly.Module failed compiling: "), makeString(args)...));
+    }
+#define WASM_COMPILE_FAIL_IF(condition, ...) do { \
+        if (UNLIKELY(condition))                  \
+            return fail(__VA_ARGS__);             \
+    } while (0)
+
+    B3IRGenerator(VM&, const ModuleInformation&, Procedure&, WasmInternalFunction*, Vector<UnlinkedWasmToWasmCall>&, const ImmutableFunctionIndexSpace&);
+
+    PartialResult WARN_UNUSED_RETURN addArguments(const Vector<Type>&);
+    PartialResult WARN_UNUSED_RETURN addLocal(Type, uint32_t);
+    ExpressionType addConstant(Type, uint64_t);
+
+    // Locals
+    PartialResult WARN_UNUSED_RETURN getLocal(uint32_t index, ExpressionType& result);
+    PartialResult WARN_UNUSED_RETURN setLocal(uint32_t index, ExpressionType value);
+
+    // Globals
+    PartialResult WARN_UNUSED_RETURN getGlobal(uint32_t index, ExpressionType& result);
+    PartialResult WARN_UNUSED_RETURN setGlobal(uint32_t index, ExpressionType value);
+
+    // Memory
+    PartialResult WARN_UNUSED_RETURN load(LoadOpType, ExpressionType pointer, ExpressionType& result, uint32_t offset);
+    PartialResult WARN_UNUSED_RETURN store(StoreOpType, ExpressionType pointer, ExpressionType value, uint32_t offset);
+
+    // Basic operators
+    template<OpType>
+    PartialResult WARN_UNUSED_RETURN addOp(ExpressionType arg, ExpressionType& result);
+    template<OpType>
+    PartialResult WARN_UNUSED_RETURN addOp(ExpressionType left, ExpressionType right, ExpressionType& result);
+    PartialResult WARN_UNUSED_RETURN addSelect(ExpressionType condition, ExpressionType nonZero, ExpressionType zero, ExpressionType& result);
+
+    // Control flow
+    ControlData WARN_UNUSED_RETURN addBlock(Type signature);
+    ControlData WARN_UNUSED_RETURN addLoop(Type signature);
+    PartialResult WARN_UNUSED_RETURN addIf(ExpressionType condition, Type signature, ControlData& result);
+    PartialResult WARN_UNUSED_RETURN addElse(ControlData&, const ExpressionList&);
+    PartialResult WARN_UNUSED_RETURN addElseToUnreachable(ControlData&);
+
+    PartialResult WARN_UNUSED_RETURN addReturn(const ExpressionList& returnValues);
+    PartialResult WARN_UNUSED_RETURN addBranch(ControlData&, ExpressionType condition, const ExpressionList& returnValues);
+    PartialResult WARN_UNUSED_RETURN addSwitch(ExpressionType condition, const Vector<ControlData*>& targets, ControlData& defaultTargets, const ExpressionList& expressionStack);
+    PartialResult WARN_UNUSED_RETURN endBlock(ControlEntry&, ExpressionList& expressionStack);
+    PartialResult WARN_UNUSED_RETURN addEndToUnreachable(ControlEntry&);
+
+    // Calls
+    PartialResult WARN_UNUSED_RETURN addCall(uint32_t calleeIndex, const Signature*, Vector<ExpressionType>& args, ExpressionType& result);
+    PartialResult WARN_UNUSED_RETURN addCallIndirect(const Signature*, Vector<ExpressionType>& args, ExpressionType& result);
+    PartialResult WARN_UNUSED_RETURN addUnreachable();
+
+    void dump(const Vector<ControlEntry>& controlStack, const ExpressionList& expressionStack);
+
+    void emitExceptionCheck(CCallHelpers&, ExceptionType);
+
+private:
+    ExpressionType emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOp);
+    ExpressionType emitLoadOp(LoadOpType, Origin, ExpressionType pointer, uint32_t offset);
+    void emitStoreOp(StoreOpType, Origin, ExpressionType pointer, ExpressionType value, uint32_t offset);
+
+    void unify(Variable* target, const ExpressionType source);
+    void unifyValuesWithBlock(const ExpressionList& resultStack, ResultList& stack);
+    Value* zeroForType(Type);
+
+    VM& m_vm;
+    const ImmutableFunctionIndexSpace& m_functionIndexSpace;
+    const ModuleInformation& m_info;
+    Procedure& m_proc;
+    BasicBlock* m_currentBlock;
+    Vector<Variable*> m_locals;
+    Vector<UnlinkedWasmToWasmCall>& m_unlinkedWasmToWasmCalls; // List each call site and the function index whose address it should be patched with.
+    GPRReg m_memoryBaseGPR;
+    GPRReg m_memorySizeGPR;
+    Value* m_zeroValues[numTypes];
+    Value* m_instanceValue;
+};
+
+B3IRGenerator::B3IRGenerator(VM& vm, const ModuleInformation& info, Procedure& procedure, WasmInternalFunction* compilation, Vector<UnlinkedWasmToWasmCall>& unlinkedWasmToWasmCalls, const ImmutableFunctionIndexSpace& functionIndexSpace)
+    : m_vm(vm)
+    , m_functionIndexSpace(functionIndexSpace)
+    , m_info(info)
+    , m_proc(procedure)
+    , m_unlinkedWasmToWasmCalls(unlinkedWasmToWasmCalls)
+{
+    m_currentBlock = m_proc.addBlock();
+
+    for (unsigned i = 0; i < numTypes; ++i) {
+        switch (B3::Type b3Type = toB3Type(linearizedToType(i))) {
+        case B3::Int32:
+        case B3::Int64:
+        case B3::Float:
+        case B3::Double:
+            m_zeroValues[i] = m_currentBlock->appendIntConstant(m_proc, Origin(), b3Type, 0);
+            break;
+        case B3::Void:
+            m_zeroValues[i] = nullptr;
+            break;
+        }
+    }
+
+    if (!!info.memory) {
+        m_memoryBaseGPR = info.memory.pinnedRegisters().baseMemoryPointer;
+        m_proc.pinRegister(m_memoryBaseGPR);
+        ASSERT(!info.memory.pinnedRegisters().sizeRegisters[0].sizeOffset);
+        m_memorySizeGPR = info.memory.pinnedRegisters().sizeRegisters[0].sizeRegister;
+        for (const PinnedSizeRegisterInfo& regInfo : info.memory.pinnedRegisters().sizeRegisters)
+            m_proc.pinRegister(regInfo.sizeRegister);
+
+        m_proc.setWasmBoundsCheckGenerator([=] (CCallHelpers& jit, GPRReg pinnedGPR, unsigned) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+            ASSERT_UNUSED(pinnedGPR, m_memorySizeGPR == pinnedGPR);
+            this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsMemoryAccess);
+        });
+
+        B3::PatchpointValue* foo = m_currentBlock->appendNew<B3::PatchpointValue>(m_proc, B3::Void, Origin());
+        foo->setGenerator(
+            [=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+            });
+    }
+
+    wasmCallingConvention().setupFrameInPrologue(&compilation->wasmCalleeMoveLocation, m_proc, Origin(), m_currentBlock);
+
+    m_instanceValue = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), Origin(),
+        m_currentBlock->appendNew<ConstPtrValue>(m_proc, Origin(), &m_vm.topJSWebAssemblyInstance));
+}
+
+void B3IRGenerator::emitExceptionCheck(CCallHelpers& jit, ExceptionType type)
+{
+    jit.move(CCallHelpers::TrustedImm32(static_cast<uint32_t>(type)), GPRInfo::argumentGPR1);
+    auto jumpToExceptionStub = jit.jump();
+
+    VM* vm = &m_vm;
+    jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+        linkBuffer.link(jumpToExceptionStub, CodeLocationLabel(vm->getCTIStub(throwExceptionFromWasmThunkGenerator).code()));
+    });
+}
+
+Value* B3IRGenerator::zeroForType(Type type)
+{
+    ASSERT(type != Void);
+    Value* zeroValue = m_zeroValues[linearizeType(type)];
+    ASSERT(zeroValue);
+    return zeroValue;
+}
+
+auto B3IRGenerator::addLocal(Type type, uint32_t count) -> PartialResult
+{
+    WASM_COMPILE_FAIL_IF(!m_locals.tryReserveCapacity(m_locals.size() + count), "can't allocate memory for ", m_locals.size() + count, " locals");
+
+    for (uint32_t i = 0; i < count; ++i) {
+        Variable* local = m_proc.addVariable(toB3Type(type));
+        m_locals.uncheckedAppend(local);
+        m_currentBlock->appendNew<VariableValue>(m_proc, Set, Origin(), local, zeroForType(type));
+    }
+    return { };
+}
+
+auto B3IRGenerator::addArguments(const Vector<Type>& types) -> PartialResult
+{
+    ASSERT(!m_locals.size());
+    WASM_COMPILE_FAIL_IF(!m_locals.tryReserveCapacity(types.size()), "can't allocate memory for ", types.size(), " arguments");
+
+    m_locals.grow(types.size());
+    wasmCallingConvention().loadArguments(types, m_proc, m_currentBlock, Origin(),
+        [&] (ExpressionType argument, unsigned i) {
+            Variable* argumentVariable = m_proc.addVariable(argument->type());
+            m_locals[i] = argumentVariable;
+            m_currentBlock->appendNew<VariableValue>(m_proc, Set, Origin(), argumentVariable, argument);
+        });
+    return { };
+}
+
+auto B3IRGenerator::getLocal(uint32_t index, ExpressionType& result) -> PartialResult
+{
+    ASSERT(m_locals[index]);
+    result = m_currentBlock->appendNew<VariableValue>(m_proc, B3::Get, Origin(), m_locals[index]);
+    return { };
+}
+
+auto B3IRGenerator::addUnreachable() -> PartialResult
+{
+    B3::PatchpointValue* unreachable = m_currentBlock->appendNew<B3::PatchpointValue>(m_proc, B3::Void, Origin());
+    unreachable->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
+        jit.breakpoint();
+    });
+    unreachable->effects.terminal = true;
+    return { };
+}
+
+auto B3IRGenerator::setLocal(uint32_t index, ExpressionType value) -> PartialResult
+{
+    ASSERT(m_locals[index]);
+    m_currentBlock->appendNew<VariableValue>(m_proc, B3::Set, Origin(), m_locals[index], value);
+    return { };
+}
+
+auto B3IRGenerator::getGlobal(uint32_t index, ExpressionType& result) -> PartialResult
+{
+    Value* globalsArray = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), Origin(), m_instanceValue, JSWebAssemblyInstance::offsetOfGlobals());
+    result = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, toB3Type(m_info.globals[index].type), Origin(), globalsArray, index * sizeof(Register));
+    return { };
+}
+
+auto B3IRGenerator::setGlobal(uint32_t index, ExpressionType value) -> PartialResult
+{
+    ASSERT(toB3Type(m_info.globals[index].type) == value->type());
+    Value* globalsArray = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), Origin(), m_instanceValue, JSWebAssemblyInstance::offsetOfGlobals());
+    m_currentBlock->appendNew<MemoryValue>(m_proc, Store, Origin(), value, globalsArray, index * sizeof(Register));
+    return { };
+}
+
+inline Value* B3IRGenerator::emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOperation)
+{
+    ASSERT(m_memoryBaseGPR && m_memorySizeGPR);
+    ASSERT(sizeOfOperation + offset > offset);
+    m_currentBlock->appendNew<WasmBoundsCheckValue>(m_proc, Origin(), pointer, m_memorySizeGPR, sizeOfOperation + offset - 1);
+    pointer = m_currentBlock->appendNew<Value>(m_proc, ZExt32, Origin(), pointer);
+    return m_currentBlock->appendNew<WasmAddressValue>(m_proc, Origin(), pointer, m_memoryBaseGPR);
+}
+
+inline uint32_t sizeOfLoadOp(LoadOpType op)
+{
+    switch (op) {
+    case LoadOpType::I32Load8S:
+    case LoadOpType::I32Load8U:
+    case LoadOpType::I64Load8S:
+    case LoadOpType::I64Load8U:
+        return 1;
+    case LoadOpType::I32Load16S:
+    case LoadOpType::I64Load16S:
+    case LoadOpType::I32Load16U:
+    case LoadOpType::I64Load16U:
+        return 2;
+    case LoadOpType::I32Load:
+    case LoadOpType::I64Load32S:
+    case LoadOpType::I64Load32U:
+    case LoadOpType::F32Load:
+        return 4;
+    case LoadOpType::I64Load:
+    case LoadOpType::F64Load:
+        return 8;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+inline Value* B3IRGenerator::emitLoadOp(LoadOpType op, Origin origin, ExpressionType pointer, uint32_t offset)
+{
+    switch (op) {
+    case LoadOpType::I32Load8S: {
+        return m_currentBlock->appendNew<MemoryValue>(m_proc, Load8S, origin, pointer, offset);
+    }
+
+    case LoadOpType::I64Load8S: {
+        Value* value = m_currentBlock->appendNew<MemoryValue>(m_proc, Load8S, origin, pointer, offset);
+        return m_currentBlock->appendNew<Value>(m_proc, SExt32, origin, value);
+    }
+
+    case LoadOpType::I32Load8U: {
+        return m_currentBlock->appendNew<MemoryValue>(m_proc, Load8Z, origin, pointer, offset);
+    }
+
+    case LoadOpType::I64Load8U: {
+        Value* value = m_currentBlock->appendNew<MemoryValue>(m_proc, Load8Z, origin, pointer, offset);
+        return m_currentBlock->appendNew<Value>(m_proc, ZExt32, origin, value);
+    }
+
+    case LoadOpType::I32Load16S: {
+        return m_currentBlock->appendNew<MemoryValue>(m_proc, Load16S, origin, pointer, offset);
+    }
+    case LoadOpType::I64Load16S: {
+        Value* value = m_currentBlock->appendNew<MemoryValue>(m_proc, Load16S, origin, pointer, offset);
+        return m_currentBlock->appendNew<Value>(m_proc, SExt32, origin, value);
+    }
+
+    case LoadOpType::I32Load: {
+        return m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Int32, origin, pointer);
+    }
+
+    case LoadOpType::I64Load32U: {
+        Value* value = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Int32, origin, pointer);
+        return m_currentBlock->appendNew<Value>(m_proc, ZExt32, origin, value);
+    }
+
+    case LoadOpType::I64Load32S: {
+        Value* value = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Int32, origin, pointer);
+        return m_currentBlock->appendNew<Value>(m_proc, SExt32, origin, value);
+    }
+
+    case LoadOpType::I64Load: {
+        return m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Int64, origin, pointer);
+    }
+
+    case LoadOpType::F32Load: {
+        return m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Float, origin, pointer);
+    }
+
+    case LoadOpType::F64Load: {
+        return m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Double, origin, pointer);
+    }
+
+    // FIXME: B3 doesn't support Load16Z yet. We should lower to that value when
+    // it's added. https://bugs.webkit.org/show_bug.cgi?id=165884
+    case LoadOpType::I32Load16U: {
+        Value* value = m_currentBlock->appendNew<MemoryValue>(m_proc, Load16S, origin, pointer, offset);
+        return m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(), value,
+                m_currentBlock->appendNew<Const32Value>(m_proc, Origin(), 0x0000ffff));
+    }
+    case LoadOpType::I64Load16U: {
+        Value* value = m_currentBlock->appendNew<MemoryValue>(m_proc, Load16S, origin, pointer, offset);
+        Value* partialResult = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(), value,
+                m_currentBlock->appendNew<Const32Value>(m_proc, Origin(), 0x0000ffff));
+
+        return m_currentBlock->appendNew<Value>(m_proc, ZExt32, Origin(), partialResult);
+    }
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+auto B3IRGenerator::load(LoadOpType op, ExpressionType pointer, ExpressionType& result, uint32_t offset) -> PartialResult
+{
+    ASSERT(pointer->type() == Int32);
+
+    result = emitLoadOp(op, Origin(), emitCheckAndPreparePointer(pointer, offset, sizeOfLoadOp(op)), offset);
+    return { };
+}
+
+inline uint32_t sizeOfStoreOp(StoreOpType op)
+{
+    switch (op) {
+    case StoreOpType::I32Store8:
+    case StoreOpType::I64Store8:
+        return 1;
+    case StoreOpType::I32Store16:
+    case StoreOpType::I64Store16:
+        return 2;
+    case StoreOpType::I32Store:
+    case StoreOpType::I64Store32:
+    case StoreOpType::F32Store:
+        return 4;
+    case StoreOpType::I64Store:
+    case StoreOpType::F64Store:
+        return 8;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+
+inline void B3IRGenerator::emitStoreOp(StoreOpType op, Origin origin, ExpressionType pointer, ExpressionType value, uint32_t offset)
+{
+    switch (op) {
+    case StoreOpType::I64Store8:
+        value = m_currentBlock->appendNew<Value>(m_proc, Trunc, origin, value);
+        FALLTHROUGH;
+
+    case StoreOpType::I32Store8:
+        m_currentBlock->appendNew<MemoryValue>(m_proc, Store8, origin, value, pointer, offset);
+        return;
+
+    case StoreOpType::I64Store16:
+        value = m_currentBlock->appendNew<Value>(m_proc, Trunc, origin, value);
+        FALLTHROUGH;
+
+    case StoreOpType::I32Store16:
+        m_currentBlock->appendNew<MemoryValue>(m_proc, Store16, origin, value, pointer, offset);
+        return;
+
+    case StoreOpType::I64Store32:
+        value = m_currentBlock->appendNew<Value>(m_proc, Trunc, origin, value);
+        FALLTHROUGH;
+
+    case StoreOpType::I64Store:
+    case StoreOpType::I32Store:
+    case StoreOpType::F32Store:
+    case StoreOpType::F64Store:
+        m_currentBlock->appendNew<MemoryValue>(m_proc, Store, origin, value, pointer, offset);
+        return;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+auto B3IRGenerator::store(StoreOpType op, ExpressionType pointer, ExpressionType value, uint32_t offset) -> PartialResult
+{
+    ASSERT(pointer->type() == Int32);
+
+    emitStoreOp(op, Origin(), emitCheckAndPreparePointer(pointer, offset, sizeOfStoreOp(op)), value, offset);
+    return { };
+}
+
+auto B3IRGenerator::addSelect(ExpressionType condition, ExpressionType nonZero, ExpressionType zero, ExpressionType& result) -> PartialResult
+{
+    result = m_currentBlock->appendNew<Value>(m_proc, B3::Select, Origin(), condition, nonZero, zero);
+    return { };
+}
+
+B3IRGenerator::ExpressionType B3IRGenerator::addConstant(Type type, uint64_t value)
+{
+    switch (type) {
+    case Wasm::I32:
+        return m_currentBlock->appendNew<Const32Value>(m_proc, Origin(), static_cast<int32_t>(value));
+    case Wasm::I64:
+        return m_currentBlock->appendNew<Const64Value>(m_proc, Origin(), value);
+    case Wasm::F32:
+        return m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), bitwise_cast<float>(static_cast<int32_t>(value)));
+    case Wasm::F64:
+        return m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), bitwise_cast<double>(value));
+    case Wasm::Void:
+    case Wasm::Func:
+    case Wasm::Anyfunc:
+        break;
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+
+B3IRGenerator::ControlData B3IRGenerator::addBlock(Type signature)
+{
+    return ControlData(m_proc, signature, BlockType::Block, m_proc.addBlock());
+}
+
+B3IRGenerator::ControlData B3IRGenerator::addLoop(Type signature)
+{
+    BasicBlock* body = m_proc.addBlock();
+    BasicBlock* continuation = m_proc.addBlock();
+    m_currentBlock->appendNewControlValue(m_proc, Jump, Origin(), body);
+    body->addPredecessor(m_currentBlock);
+    m_currentBlock = body;
+    return ControlData(m_proc, signature, BlockType::Loop, continuation, body);
+}
+
+auto B3IRGenerator::addIf(ExpressionType condition, Type signature, ControlType& result) -> PartialResult
+{
+    // FIXME: This needs to do some kind of stack passing.
+
+    BasicBlock* taken = m_proc.addBlock();
+    BasicBlock* notTaken = m_proc.addBlock();
+    BasicBlock* continuation = m_proc.addBlock();
+
+    m_currentBlock->appendNew<Value>(m_proc, B3::Branch, Origin(), condition);
+    m_currentBlock->setSuccessors(FrequentedBlock(taken), FrequentedBlock(notTaken));
+    taken->addPredecessor(m_currentBlock);
+    notTaken->addPredecessor(m_currentBlock);
+
+    m_currentBlock = taken;
+    result = ControlData(m_proc, signature, BlockType::If, continuation, notTaken);
+    return { };
+}
+
+auto B3IRGenerator::addElse(ControlData& data, const ExpressionList& currentStack) -> PartialResult
+{
+    unifyValuesWithBlock(currentStack, data.result);
+    m_currentBlock->appendNewControlValue(m_proc, Jump, Origin(), data.continuation);
+    return addElseToUnreachable(data);
+}
+
+auto B3IRGenerator::addElseToUnreachable(ControlData& data) -> PartialResult
+{
+    ASSERT(data.type() == BlockType::If);
+    m_currentBlock = data.special;
+    data.convertIfToBlock();
+    return { };
+}
+
+auto B3IRGenerator::addReturn(const ExpressionList& returnValues) -> PartialResult
+{
+    ASSERT(returnValues.size() <= 1);
+    if (returnValues.size())
+        m_currentBlock->appendNewControlValue(m_proc, B3::Return, Origin(), returnValues[0]);
+    else
+        m_currentBlock->appendNewControlValue(m_proc, B3::Return, Origin());
+    return { };
+}
+
+auto B3IRGenerator::addBranch(ControlData& data, ExpressionType condition, const ExpressionList& returnValues) -> PartialResult
+{
+    if (data.type() != BlockType::Loop)
+        unifyValuesWithBlock(returnValues, data.result);
+
+    BasicBlock* target = data.targetBlockForBranch();
+    if (condition) {
+        BasicBlock* continuation = m_proc.addBlock();
+        m_currentBlock->appendNew<Value>(m_proc, B3::Branch, Origin(), condition);
+        m_currentBlock->setSuccessors(FrequentedBlock(target), FrequentedBlock(continuation));
+        target->addPredecessor(m_currentBlock);
+        continuation->addPredecessor(m_currentBlock);
+        m_currentBlock = continuation;
+    } else {
+        m_currentBlock->appendNewControlValue(m_proc, Jump, Origin(), FrequentedBlock(target));
+        target->addPredecessor(m_currentBlock);
+    }
+
+    return { };
+}
+
+auto B3IRGenerator::addSwitch(ExpressionType condition, const Vector<ControlData*>& targets, ControlData& defaultTarget, const ExpressionList& expressionStack) -> PartialResult
+{
+    for (size_t i = 0; i < targets.size(); ++i)
+        unifyValuesWithBlock(expressionStack, targets[i]->result);
+    unifyValuesWithBlock(expressionStack, defaultTarget.result);
+
+    SwitchValue* switchValue = m_currentBlock->appendNew<SwitchValue>(m_proc, Origin(), condition);
+    switchValue->setFallThrough(FrequentedBlock(defaultTarget.targetBlockForBranch()));
+    for (size_t i = 0; i < targets.size(); ++i)
+        switchValue->appendCase(SwitchCase(i, FrequentedBlock(targets[i]->targetBlockForBranch())));
+
+    return { };
+}
+
+auto B3IRGenerator::endBlock(ControlEntry& entry, ExpressionList& expressionStack) -> PartialResult
+{
+    ControlData& data = entry.controlData;
+
+    unifyValuesWithBlock(expressionStack, data.result);
+    m_currentBlock->appendNewControlValue(m_proc, Jump, Origin(), data.continuation);
+    data.continuation->addPredecessor(m_currentBlock);
+
+    return addEndToUnreachable(entry);
+}
+
+
+auto B3IRGenerator::addEndToUnreachable(ControlEntry& entry) -> PartialResult
+{
+    ControlData& data = entry.controlData;
+    m_currentBlock = data.continuation;
+
+    if (data.type() == BlockType::If) {
+        data.special->appendNewControlValue(m_proc, Jump, Origin(), m_currentBlock);
+        m_currentBlock->addPredecessor(data.special);
+    }
+
+    for (Variable* result : data.result)
+        entry.enclosedExpressionStack.append(m_currentBlock->appendNew<VariableValue>(m_proc, B3::Get, Origin(), result));
+
+    return { };
+}
+
+auto B3IRGenerator::addCall(uint32_t functionIndex, const Signature* signature, Vector<ExpressionType>& args, ExpressionType& result) -> PartialResult
+{
+    ASSERT(signature->arguments.size() == args.size());
+
+    Type returnType = signature->returnType;
+
+    result = wasmCallingConvention().setupCall(m_proc, m_currentBlock, Origin(), args, toB3Type(returnType),
+        [&] (PatchpointValue* patchpoint) {
+            patchpoint->effects.writesPinned = true;
+            patchpoint->effects.readsPinned = true;
+
+            patchpoint->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
+                AllowMacroScratchRegisterUsage allowScratch(jit);
+
+                CCallHelpers::Call call = jit.call();
+
+                jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                    m_unlinkedWasmToWasmCalls.append({ linkBuffer.locationOf(call), functionIndex });
+                });
+            });
+        });
+    return { };
+}
+
+auto B3IRGenerator::addCallIndirect(const Signature* signature, Vector<ExpressionType>& args, ExpressionType& result) -> PartialResult
+{
+    ExpressionType calleeIndex = args.takeLast();
+    ASSERT(signature->arguments.size() == args.size());
+
+    ExpressionType callableFunctionBuffer;
+    ExpressionType callableFunctionBufferSize;
+    {
+        ExpressionType table = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), Origin(),
+            m_instanceValue, JSWebAssemblyInstance::offsetOfTable());
+        callableFunctionBuffer = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), Origin(),
+            table, JSWebAssemblyTable::offsetOfFunctions());
+        callableFunctionBufferSize = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, Int32, Origin(),
+            table, JSWebAssemblyTable::offsetOfSize());
+    }
+
+    // Check the index we are looking for is valid.
+    {
+        CheckValue* check = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(),
+            m_currentBlock->appendNew<Value>(m_proc, AboveEqual, Origin(), calleeIndex, callableFunctionBufferSize));
+
+        check->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
+            this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsCallIndirect);
+        });
+    }
+
+    // Compute the offset in the table index space we are looking for.
+    ExpressionType offset = m_currentBlock->appendNew<Value>(m_proc, Mul, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, ZExt32, Origin(), calleeIndex),
+        m_currentBlock->appendIntConstant(m_proc, Origin(), pointerType(), sizeof(CallableFunction)));
+    ExpressionType callableFunction = m_currentBlock->appendNew<Value>(m_proc, Add, Origin(), callableFunctionBuffer, offset);
+
+    // Check that the CallableFunction is initialized. We trap if it isn't. A null Signature* indicates it's not initialized.
+    ExpressionType calleeSignature = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), Origin(), callableFunction, OBJECT_OFFSETOF(CallableFunction, signature));
+    {
+        CheckValue* check = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(),
+            m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), 
+                calleeSignature, 
+                m_currentBlock->appendNew<ConstPtrValue>(m_proc, Origin(), 0)));
+
+        check->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
+            this->emitExceptionCheck(jit, ExceptionType::NullTableEntry);
+        });
+    }
+
+    // Check the signature matches the value we expect.
+    {
+        ExpressionType expectedSignature = m_currentBlock->appendNew<ConstPtrValue>(m_proc, Origin(), signature);
+        CheckValue* check = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(),
+            m_currentBlock->appendNew<Value>(m_proc, NotEqual, Origin(), calleeSignature, expectedSignature));
+
+        check->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
+            this->emitExceptionCheck(jit, ExceptionType::BadSignature);
+        });
+    }
+
+    ExpressionType calleeCode = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), Origin(), callableFunction, OBJECT_OFFSETOF(CallableFunction, code));
+
+    Type returnType = signature->returnType;
+    result = wasmCallingConvention().setupCall(m_proc, m_currentBlock, Origin(), args, toB3Type(returnType),
+        [&] (PatchpointValue* patchpoint) {
+            patchpoint->effects.writesPinned = true;
+            patchpoint->effects.readsPinned = true;
+
+            patchpoint->append(calleeCode, ValueRep::SomeRegister);
+
+            patchpoint->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
+                jit.call(params[returnType == Void ? 0 : 1].gpr());
+            });
+        });
+
+    return { };
+}
+
+void B3IRGenerator::unify(Variable* variable, ExpressionType source)
+{
+    m_currentBlock->appendNew<VariableValue>(m_proc, Set, Origin(), variable, source);
+}
+
+void B3IRGenerator::unifyValuesWithBlock(const ExpressionList& resultStack, ResultList& result)
+{
+    ASSERT(result.size() <= resultStack.size());
+
+    for (size_t i = 0; i < result.size(); ++i)
+        unify(result[result.size() - 1 - i], resultStack[resultStack.size() - 1 - i]);
+}
+
+static void dumpExpressionStack(const CommaPrinter& comma, const B3IRGenerator::ExpressionList& expressionStack)
+{
+    dataLogLn(comma, "ExpressionStack:");
+    for (const auto& expression : expressionStack)
+        dataLogLn(comma, *expression);
+}
+
+void B3IRGenerator::dump(const Vector<ControlEntry>& controlStack, const ExpressionList& expressionStack)
+{
+    dataLogLn("Processing Graph:");
+    dataLog(m_proc);
+    dataLogLn("With current block:", *m_currentBlock);
+    dataLogLn("Control stack:");
+    for (auto& data : controlStack) {
+        dataLogLn("  ", data.controlData);
+        if (data.enclosedExpressionStack.size()) {
+            CommaPrinter comma("    ", "  with ");
+            dumpExpressionStack(comma, data.enclosedExpressionStack);
+        }
+    }
+
+    CommaPrinter comma("  ", "");
+    dumpExpressionStack(comma, expressionStack);
+    dataLogLn("\n");
+}
+
+static std::unique_ptr<B3::Compilation> createJSToWasmWrapper(VM& vm, WasmInternalFunction& function, const Signature* signature, MacroAssemblerCodePtr mainFunction, const MemoryInformation& memory)
+{
+    Procedure proc;
+    BasicBlock* block = proc.addBlock();
+
+    Origin origin;
+
+    jscCallingConvention().setupFrameInPrologue(&function.jsToWasmCalleeMoveLocation, proc, origin, block);
+
+    if (!ASSERT_DISABLED) {
+        // This should be guaranteed by our JS wrapper that handles calls to us.
+        // Just prevent against crazy when ASSERT is enabled.
+        Value* framePointer = block->appendNew<B3::Value>(proc, B3::FramePointer, origin);
+        Value* offSetOfArgumentCount = block->appendNew<Const64Value>(proc, origin, CallFrameSlot::argumentCount * sizeof(Register));
+        Value* argumentCount = block->appendNew<MemoryValue>(proc, Load, Int32, origin,
+            block->appendNew<Value>(proc, Add, origin, framePointer, offSetOfArgumentCount));
+
+        Value* expectedArgumentCount = block->appendNew<Const32Value>(proc, origin, signature->arguments.size());
+
+        CheckValue* argumentCountCheck = block->appendNew<CheckValue>(proc, Check, origin,
+            block->appendNew<Value>(proc, Above, origin, expectedArgumentCount, argumentCount));
+
+        argumentCountCheck->setGenerator([] (CCallHelpers& jit, const StackmapGenerationParams&) {
+            jit.breakpoint();
+        });
+    }
+
+    // Move memory values to the approriate places, if needed.
+    Value* baseMemory = nullptr;
+    Vector<Value*> sizes;
+    if (!!memory) {
+        baseMemory = block->appendNew<MemoryValue>(proc, Load, Int64, Origin(),
+            block->appendNew<ConstPtrValue>(proc, Origin(), &vm.topWasmMemoryPointer));
+        Value* size = block->appendNew<MemoryValue>(proc, Load, Int32, Origin(),
+            block->appendNew<ConstPtrValue>(proc, Origin(), &vm.topWasmMemorySize));
+        sizes.reserveCapacity(memory.pinnedRegisters().sizeRegisters.size());
+        for (auto info : memory.pinnedRegisters().sizeRegisters) {
+            sizes.append(block->appendNew<Value>(proc, Sub, origin, size,
+                block->appendNew<Const32Value>(proc, origin, info.sizeOffset)));
+        }
+    }
+
+    // Get our arguments.
+    Vector<Value*> arguments;
+    jscCallingConvention().loadArguments(signature->arguments, proc, block, origin, [&] (Value* argument, unsigned) {
+        arguments.append(argument);
+    });
+
+    // Move the arguments into place.
+    Value* result = wasmCallingConvention().setupCall(proc, block, origin, arguments, toB3Type(signature->returnType), [&] (PatchpointValue* patchpoint) {
+        if (!!memory) {
+            ASSERT(sizes.size() == memory.pinnedRegisters().sizeRegisters.size());
+            patchpoint->append(ConstrainedValue(baseMemory, ValueRep::reg(memory.pinnedRegisters().baseMemoryPointer)));
+            for (unsigned i = 0; i < sizes.size(); ++i)
+                patchpoint->append(ConstrainedValue(sizes[i], ValueRep::reg(memory.pinnedRegisters().sizeRegisters[i].sizeRegister)));
+        }
+
+        patchpoint->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
+            AllowMacroScratchRegisterUsage allowScratch(jit);
+
+            CCallHelpers::Call call = jit.call();
+            jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                linkBuffer.link(call, FunctionPtr(mainFunction.executableAddress()));
+            });
+        });
+    });
+
+    // Return the result, if needed.
+    switch (signature->returnType) {
+    case Wasm::Void:
+        block->appendNewControlValue(proc, B3::Return, origin);
+        break;
+    case Wasm::F32:
+    case Wasm::F64:
+        result = block->appendNew<Value>(proc, BitwiseCast, origin, result);
+        FALLTHROUGH;
+    case Wasm::I32:
+    case Wasm::I64:
+        block->appendNewControlValue(proc, B3::Return, origin, result);
+        break;
+    case Wasm::Func:
+    case Wasm::Anyfunc:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+    auto jsEntrypoint = std::make_unique<Compilation>(B3::compile(vm, proc));
+    function.jsToWasmEntrypoint.calleeSaveRegisters = proc.calleeSaveRegisters();
+    return jsEntrypoint;
+}
+
+Expected<std::unique_ptr<WasmInternalFunction>, String> parseAndCompile(VM& vm, const uint8_t* functionStart, size_t functionLength, const Signature* signature, Vector<UnlinkedWasmToWasmCall>& unlinkedWasmToWasmCalls, const ImmutableFunctionIndexSpace& functionIndexSpace, const ModuleInformation& info, unsigned optLevel)
+{
+    auto result = std::make_unique<WasmInternalFunction>();
+
+    Procedure procedure;
+    B3IRGenerator context(vm, info, procedure, result.get(), unlinkedWasmToWasmCalls, functionIndexSpace);
+    FunctionParser<B3IRGenerator> parser(context, functionStart, functionLength, signature, functionIndexSpace, info);
+    WASM_FAIL_IF_HELPER_FAILS(parser.parse());
+
+    procedure.resetReachability();
+    validate(procedure, "After parsing:\n");
+
+    if (verbose)
+        dataLog("Pre SSA: ", procedure);
+    fixSSA(procedure);
+    if (verbose)
+        dataLog("Post SSA: ", procedure);
+
+    result->wasmEntrypoint.compilation = std::make_unique<B3::Compilation>(B3::compile(vm, procedure, optLevel));
+    result->wasmEntrypoint.calleeSaveRegisters = procedure.calleeSaveRegisters();
+
+    result->jsToWasmEntrypoint.compilation = createJSToWasmWrapper(vm, *result, signature, result->wasmEntrypoint.compilation->code(), info.memory);
+    return WTFMove(result);
+}
+
+// Custom wasm ops. These are the ones too messy to do in wasm.json.
+
+template<>
+auto B3IRGenerator::addOp<OpType::I32Ctz>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int32, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.countTrailingZeros32(params[1].gpr(), params[0].gpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I64Ctz>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int64, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.countTrailingZeros64(params[1].gpr(), params[0].gpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I32Popcnt>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    // FIXME: This should use the popcnt instruction if SSE4 is available but we don't have code to detect SSE4 yet.
+    // see: https://bugs.webkit.org/show_bug.cgi?id=165363
+    uint32_t (*popcount)(int32_t) = [] (int32_t value) -> uint32_t { return __builtin_popcount(value); };
+    Value* funcAddress = m_currentBlock->appendNew<ConstPtrValue>(m_proc, Origin(), bitwise_cast<void*>(popcount));
+    result = m_currentBlock->appendNew<CCallValue>(m_proc, Int32, Origin(), Effects::none(), funcAddress, arg);
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I64Popcnt>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    // FIXME: This should use the popcnt instruction if SSE4 is available but we don't have code to detect SSE4 yet.
+    // see: https://bugs.webkit.org/show_bug.cgi?id=165363
+    uint64_t (*popcount)(int64_t) = [] (int64_t value) -> uint64_t { return __builtin_popcountll(value); };
+    Value* funcAddress = m_currentBlock->appendNew<ConstPtrValue>(m_proc, Origin(), bitwise_cast<void*>(popcount));
+    result = m_currentBlock->appendNew<CCallValue>(m_proc, Int64, Origin(), Effects::none(), funcAddress, arg);
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<F64ConvertUI64>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Double, Origin());
+    if (isX86())
+        patchpoint->numGPScratchRegisters = 1;
+    patchpoint->append(ConstrainedValue(arg, ValueRep::SomeRegister));
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        AllowMacroScratchRegisterUsage allowScratch(jit);
+#if CPU(X86_64)
+        jit.convertUInt64ToDouble(params[1].gpr(), params[0].fpr(), params.gpScratch(0));
+#else
+        jit.convertUInt64ToDouble(params[1].gpr(), params[0].fpr());
+#endif
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::F32ConvertUI64>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Float, Origin());
+    if (isX86())
+        patchpoint->numGPScratchRegisters = 1;
+    patchpoint->append(ConstrainedValue(arg, ValueRep::SomeRegister));
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        AllowMacroScratchRegisterUsage allowScratch(jit);
+#if CPU(X86_64)
+        jit.convertUInt64ToFloat(params[1].gpr(), params[0].fpr(), params.gpScratch(0));
+#else
+        jit.convertUInt64ToFloat(params[1].gpr(), params[0].fpr());
+#endif
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::F64Nearest>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Double, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.roundTowardNearestIntDouble(params[1].fpr(), params[0].fpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::F32Nearest>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Float, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.roundTowardNearestIntFloat(params[1].fpr(), params[0].fpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::F64Trunc>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Double, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.roundTowardZeroDouble(params[1].fpr(), params[0].fpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::F32Trunc>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Float, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.roundTowardZeroFloat(params[1].fpr(), params[0].fpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I32TruncSF64>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    Value* max = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), -static_cast<double>(std::numeric_limits<int32_t>::min()));
+    Value* min = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), static_cast<double>(std::numeric_limits<int32_t>::min()));
+    Value* outOfBounds = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, LessThan, Origin(), arg, max),
+        m_currentBlock->appendNew<Value>(m_proc, GreaterEqual, Origin(), arg, min));
+    outOfBounds = m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), outOfBounds, zeroForType(I32));
+    CheckValue* trap = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(), outOfBounds);
+    trap->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTrunc);
+    });
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int32, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.truncateDoubleToInt32(params[1].fpr(), params[0].gpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I32TruncSF32>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    Value* max = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), -static_cast<float>(std::numeric_limits<int32_t>::min()));
+    Value* min = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), static_cast<float>(std::numeric_limits<int32_t>::min()));
+    Value* outOfBounds = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, LessThan, Origin(), arg, max),
+        m_currentBlock->appendNew<Value>(m_proc, GreaterEqual, Origin(), arg, min));
+    outOfBounds = m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), outOfBounds, zeroForType(I32));
+    CheckValue* trap = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(), outOfBounds);
+    trap->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTrunc);
+    });
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int32, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.truncateFloatToInt32(params[1].fpr(), params[0].gpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+
+template<>
+auto B3IRGenerator::addOp<OpType::I32TruncUF64>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    Value* max = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), static_cast<double>(std::numeric_limits<int32_t>::min()) * -2.0);
+    Value* min = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), -1.0);
+    Value* outOfBounds = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, LessThan, Origin(), arg, max),
+        m_currentBlock->appendNew<Value>(m_proc, GreaterThan, Origin(), arg, min));
+    outOfBounds = m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), outOfBounds, zeroForType(I32));
+    CheckValue* trap = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(), outOfBounds);
+    trap->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTrunc);
+    });
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int32, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.truncateDoubleToUint32(params[1].fpr(), params[0].gpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I32TruncUF32>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    Value* max = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), static_cast<float>(std::numeric_limits<int32_t>::min()) * -2.0);
+    Value* min = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), -1.0);
+    Value* outOfBounds = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, LessThan, Origin(), arg, max),
+        m_currentBlock->appendNew<Value>(m_proc, GreaterThan, Origin(), arg, min));
+    outOfBounds = m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), outOfBounds, zeroForType(I32));
+    CheckValue* trap = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(), outOfBounds);
+    trap->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTrunc);
+    });
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int32, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.truncateFloatToUint32(params[1].fpr(), params[0].gpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I64TruncSF64>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    Value* max = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), -static_cast<double>(std::numeric_limits<int64_t>::min()));
+    Value* min = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), static_cast<double>(std::numeric_limits<int64_t>::min()));
+    Value* outOfBounds = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, LessThan, Origin(), arg, max),
+        m_currentBlock->appendNew<Value>(m_proc, GreaterEqual, Origin(), arg, min));
+    outOfBounds = m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), outOfBounds, zeroForType(I32));
+    CheckValue* trap = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(), outOfBounds);
+    trap->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTrunc);
+    });
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int64, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.truncateDoubleToInt64(params[1].fpr(), params[0].gpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I64TruncUF64>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    Value* max = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), static_cast<double>(std::numeric_limits<int64_t>::min()) * -2.0);
+    Value* min = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), -1.0);
+    Value* outOfBounds = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, LessThan, Origin(), arg, max),
+        m_currentBlock->appendNew<Value>(m_proc, GreaterThan, Origin(), arg, min));
+    outOfBounds = m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), outOfBounds, zeroForType(I32));
+    CheckValue* trap = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(), outOfBounds);
+    trap->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTrunc);
+    });
+
+    Value* constant;
+    if (isX86()) {
+        // Since x86 doesn't have an instruction to convert floating points to unsigned integers, we at least try to do the smart thing if
+        // the numbers are would be positive anyway as a signed integer. Since we cannot materialize constants into fprs we have b3 do it
+        // so we can pool them if needed.
+        constant = m_currentBlock->appendNew<ConstDoubleValue>(m_proc, Origin(), static_cast<double>(std::numeric_limits<uint64_t>::max() - std::numeric_limits<int64_t>::max()));
+    }
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int64, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    if (isX86()) {
+        patchpoint->append(constant, ValueRep::SomeRegister);
+        patchpoint->numFPScratchRegisters = 1;
+    }
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        AllowMacroScratchRegisterUsage allowScratch(jit);
+        FPRReg scratch = InvalidFPRReg;
+        FPRReg constant = InvalidFPRReg;
+        if (isX86()) {
+            scratch = params.fpScratch(0);
+            constant = params[2].fpr();
+        }
+        jit.truncateDoubleToUint64(params[1].fpr(), params[0].gpr(), scratch, constant);
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I64TruncSF32>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    Value* max = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), -static_cast<float>(std::numeric_limits<int64_t>::min()));
+    Value* min = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), static_cast<float>(std::numeric_limits<int64_t>::min()));
+    Value* outOfBounds = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, LessThan, Origin(), arg, max),
+        m_currentBlock->appendNew<Value>(m_proc, GreaterEqual, Origin(), arg, min));
+    outOfBounds = m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), outOfBounds, zeroForType(I32));
+    CheckValue* trap = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(), outOfBounds);
+    trap->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTrunc);
+    });
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int64, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        jit.truncateFloatToInt64(params[1].fpr(), params[0].gpr());
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+template<>
+auto B3IRGenerator::addOp<OpType::I64TruncUF32>(ExpressionType arg, ExpressionType& result) -> PartialResult
+{
+    Value* max = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), static_cast<float>(std::numeric_limits<int64_t>::min()) * -2.0);
+    Value* min = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), -1.0);
+    Value* outOfBounds = m_currentBlock->appendNew<Value>(m_proc, BitAnd, Origin(),
+        m_currentBlock->appendNew<Value>(m_proc, LessThan, Origin(), arg, max),
+        m_currentBlock->appendNew<Value>(m_proc, GreaterThan, Origin(), arg, min));
+    outOfBounds = m_currentBlock->appendNew<Value>(m_proc, Equal, Origin(), outOfBounds, zeroForType(I32));
+    CheckValue* trap = m_currentBlock->appendNew<CheckValue>(m_proc, Check, Origin(), outOfBounds);
+    trap->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTrunc);
+    });
+
+    Value* constant;
+    if (isX86()) {
+        // Since x86 doesn't have an instruction to convert floating points to unsigned integers, we at least try to do the smart thing if
+        // the numbers are would be positive anyway as a signed integer. Since we cannot materialize constants into fprs we have b3 do it
+        // so we can pool them if needed.
+        constant = m_currentBlock->appendNew<ConstFloatValue>(m_proc, Origin(), static_cast<float>(std::numeric_limits<uint64_t>::max() - std::numeric_limits<int64_t>::max()));
+    }
+    PatchpointValue* patchpoint = m_currentBlock->appendNew<PatchpointValue>(m_proc, Int64, Origin());
+    patchpoint->append(arg, ValueRep::SomeRegister);
+    if (isX86()) {
+        patchpoint->append(constant, ValueRep::SomeRegister);
+        patchpoint->numFPScratchRegisters = 1;
+    }
+    patchpoint->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
+        AllowMacroScratchRegisterUsage allowScratch(jit);
+        FPRReg scratch = InvalidFPRReg;
+        FPRReg constant = InvalidFPRReg;
+        if (isX86()) {
+            scratch = params.fpScratch(0);
+            constant = params[2].fpr();
+        }
+        jit.truncateFloatToUint64(params[1].fpr(), params[0].gpr(), scratch, constant);
+    });
+    patchpoint->effects = Effects::none();
+    result = patchpoint;
+    return { };
+}
+
+} } // namespace JSC::Wasm
+
+#include "WasmB3IRGeneratorInlines.h"
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmB3IRGenerator.h b/wasm/WasmB3IRGenerator.h
new file mode 100644
index 0000000..dfe6a46
--- /dev/null
+++ b/wasm/WasmB3IRGenerator.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "B3Compilation.h"
+#include "VM.h"
+#include "WasmFormat.h"
+#include <wtf/Expected.h>
+
+extern "C" void dumpProcedure(void*);
+
+namespace JSC { namespace Wasm {
+
+class MemoryInformation;
+
+Expected<std::unique_ptr<WasmInternalFunction>, String> parseAndCompile(VM&, const uint8_t*, size_t, const Signature*, Vector<UnlinkedWasmToWasmCall>&, const ImmutableFunctionIndexSpace&, const ModuleInformation&, unsigned optLevel = 1);
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmBinding.cpp b/wasm/WasmBinding.cpp
new file mode 100644
index 0000000..33064dc
--- /dev/null
+++ b/wasm/WasmBinding.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WasmBinding.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "AssemblyHelpers.h"
+#include "JSCJSValueInlines.h"
+#include "JSWebAssemblyInstance.h"
+#include "LinkBuffer.h"
+#include "WasmCallingConvention.h"
+
+namespace JSC { namespace Wasm {
+
+WasmToJSStub importStubGenerator(VM* vm, Bag<CallLinkInfo>& callLinkInfos, Signature* signature, unsigned importIndex)
+{
+    const WasmCallingConvention& wasmCC = wasmCallingConvention();
+    const JSCCallingConvention& jsCC = jscCallingConvention();
+    unsigned argCount = signature->arguments.size();
+    typedef AssemblyHelpers JIT;
+    JIT jit(vm, nullptr);
+
+    // Below, we assume that the JS calling convention is always on the stack.
+    ASSERT(!jsCC.m_gprArgs.size());
+    ASSERT(!jsCC.m_fprArgs.size());
+
+    jit.emitFunctionPrologue();
+    jit.store64(JIT::TrustedImm32(0), JIT::Address(GPRInfo::callFrameRegister, CallFrameSlot::codeBlock * static_cast<int>(sizeof(Register)))); // FIXME Stop using 0 as codeBlocks. https://bugs.webkit.org/show_bug.cgi?id=165321
+    jit.storePtr(JIT::TrustedImmPtr(vm->webAssemblyToJSCallee.get()), JIT::Address(GPRInfo::callFrameRegister, CallFrameSlot::callee * static_cast<int>(sizeof(Register))));
+
+    // Here we assume that the JS calling convention saves at least all the wasm callee saved. We therefore don't need to save and restore more registers since the wasm callee already took care of this.
+    RegisterSet missingCalleeSaves = wasmCC.m_calleeSaveRegisters;
+    missingCalleeSaves.exclude(jsCC.m_calleeSaveRegisters);
+    ASSERT(missingCalleeSaves.isEmpty());
+
+    // FIXME perform a stack check before updating SP. https://bugs.webkit.org/show_bug.cgi?id=165546
+
+    unsigned numberOfParameters = argCount + 1; // There is a "this" argument.
+    unsigned numberOfRegsForCall = CallFrame::headerSizeInRegisters + numberOfParameters;
+    unsigned numberOfBytesForCall = numberOfRegsForCall * sizeof(Register) - sizeof(CallerFrameAndPC);
+    const unsigned stackOffset = WTF::roundUpToMultipleOf(stackAlignmentBytes(), numberOfBytesForCall);
+    jit.subPtr(MacroAssembler::TrustedImm32(stackOffset), MacroAssembler::stackPointerRegister);
+    JIT::Address calleeFrame = CCallHelpers::Address(MacroAssembler::stackPointerRegister, -static_cast<ptrdiff_t>(sizeof(CallerFrameAndPC)));
+
+    // FIXME make this a loop which switches on Signature if there are many arguments on the stack. It'll otherwise be huge for huge signatures. https://bugs.webkit.org/show_bug.cgi?id=165547
+    unsigned marshalledGPRs = 0;
+    unsigned marshalledFPRs = 0;
+    unsigned calleeFrameOffset = CallFrameSlot::firstArgument * static_cast<int>(sizeof(Register));
+    unsigned frOffset = CallFrameSlot::firstArgument * static_cast<int>(sizeof(Register));
+    for (unsigned argNum = 0; argNum < argCount; ++argNum) {
+        Type argType = signature->arguments[argNum];
+        switch (argType) {
+        case Void:
+        case Func:
+        case Anyfunc:
+        case I64:
+            // FIXME: Figure out the correct behavior here. I suspect we want such a stub to throw an exception immediately
+            // if called. https://bugs.webkit.org/show_bug.cgi?id=165991
+            jit.breakpoint();
+            break;
+        case I32: {
+            GPRReg gprReg;
+            if (marshalledGPRs < wasmCC.m_gprArgs.size())
+                gprReg = wasmCC.m_gprArgs[marshalledGPRs].gpr();
+            else {
+                // We've already spilled all arguments, these registers are available as scratch.
+                gprReg = GPRInfo::argumentGPR0;
+                jit.load64(JIT::Address(GPRInfo::callFrameRegister, frOffset), gprReg);
+                frOffset += sizeof(Register);
+            }
+            ++marshalledGPRs;
+            jit.boxInt32(gprReg, JSValueRegs(gprReg), DoNotHaveTagRegisters);
+            jit.store64(gprReg, calleeFrame.withOffset(calleeFrameOffset));
+            calleeFrameOffset += sizeof(Register);
+            break;
+        }
+        case F32: {
+            FPRReg fprReg;
+            if (marshalledFPRs < wasmCC.m_fprArgs.size())
+                fprReg = wasmCC.m_fprArgs[marshalledFPRs].fpr();
+            else {
+                // We've already spilled all arguments, these registers are available as scratch.
+                fprReg = FPRInfo::argumentFPR0;
+                jit.loadFloat(JIT::Address(GPRInfo::callFrameRegister, frOffset), fprReg);
+                frOffset += sizeof(Register);
+            }
+            jit.convertFloatToDouble(fprReg, fprReg);
+            jit.purifyNaN(fprReg);
+            jit.storeDouble(fprReg, calleeFrame.withOffset(calleeFrameOffset));
+            calleeFrameOffset += sizeof(Register);
+            ++marshalledFPRs;
+            break;
+        }
+        case F64: {
+            FPRReg fprReg;
+            if (marshalledFPRs < wasmCC.m_fprArgs.size())
+                fprReg = wasmCC.m_fprArgs[marshalledFPRs].fpr();
+            else {
+                // We've already spilled all arguments, these registers are available as scratch.
+                fprReg = FPRInfo::argumentFPR0;
+                jit.loadDouble(JIT::Address(GPRInfo::callFrameRegister, frOffset), fprReg);
+                frOffset += sizeof(Register);
+            }
+            jit.purifyNaN(fprReg);
+            jit.storeDouble(fprReg, calleeFrame.withOffset(calleeFrameOffset));
+            calleeFrameOffset += sizeof(Register);
+            ++marshalledFPRs;
+            break;
+        }
+        }
+    }
+
+    GPRReg importJSCellGPRReg = GPRInfo::regT0; // Callee needs to be in regT0 for slow path below.
+    ASSERT(!wasmCC.m_calleeSaveRegisters.get(importJSCellGPRReg));
+
+    // Each JS -> wasm entry sets the WebAssembly.Instance whose export is being called. We're calling out of this Instance, and can therefore figure out the import being called.
+    jit.loadPtr(&vm->topJSWebAssemblyInstance, importJSCellGPRReg);
+    jit.loadPtr(JIT::Address(importJSCellGPRReg, JSWebAssemblyInstance::offsetOfImportFunction(importIndex)), importJSCellGPRReg);
+
+    uint64_t thisArgument = ValueUndefined; // FIXME what does the WebAssembly spec say this should be? https://bugs.webkit.org/show_bug.cgi?id=165471
+    jit.store64(importJSCellGPRReg, calleeFrame.withOffset(CallFrameSlot::callee * static_cast<int>(sizeof(Register))));
+    jit.store32(JIT::TrustedImm32(numberOfParameters), calleeFrame.withOffset(CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset));
+    jit.store64(JIT::TrustedImm64(thisArgument), calleeFrame.withOffset(CallFrameSlot::thisArgument * static_cast<int>(sizeof(Register))));
+
+    // FIXME Tail call if the wasm return type is void and no registers were spilled. https://bugs.webkit.org/show_bug.cgi?id=165488
+
+    CallLinkInfo* callLinkInfo = callLinkInfos.add();
+    callLinkInfo->setUpCall(CallLinkInfo::Call, CodeOrigin(), importJSCellGPRReg);
+    JIT::DataLabelPtr targetToCheck;
+    JIT::TrustedImmPtr initialRightValue(0);
+    JIT::Jump slowPath = jit.branchPtrWithPatch(MacroAssembler::NotEqual, importJSCellGPRReg, targetToCheck, initialRightValue);
+    JIT::Call fastCall = jit.nearCall();
+    JIT::Jump done = jit.jump();
+    slowPath.link(&jit);
+    // Callee needs to be in regT0 here.
+    jit.move(MacroAssembler::TrustedImmPtr(callLinkInfo), GPRInfo::regT2); // Link info needs to be in regT2.
+    JIT::Call slowCall = jit.nearCall();
+    done.link(&jit);
+
+    switch (signature->returnType) {
+    case Void:
+        // Discard.
+        break;
+    case Func:
+    case Anyfunc:
+        // For the JavaScript embedding, imports with these types in their signature return are a WebAssembly.Module validation error.
+        RELEASE_ASSERT_NOT_REACHED();
+        break;
+    case I32: {
+        jit.move(JIT::TrustedImm64(TagTypeNumber), GPRInfo::returnValueGPR2);
+        JIT::Jump checkJSInt32 = jit.branch64(JIT::AboveOrEqual, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.move64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        jit.truncateDoubleToInt32(FPRInfo::returnValueFPR, GPRInfo::returnValueGPR);
+        JIT::Jump checkJSNumber = jit.branchTest64(JIT::NonZero, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.abortWithReason(AHIsNotJSNumber); // FIXME Coerce when the values aren't what we expect, instead of aborting. https://bugs.webkit.org/show_bug.cgi?id=165480
+        checkJSInt32.link(&jit);
+        jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
+        checkJSNumber.link(&jit);
+        break;
+    }
+    case I64: {
+        jit.move(JIT::TrustedImm64(TagTypeNumber), GPRInfo::returnValueGPR2);
+        JIT::Jump checkJSInt32 = jit.branch64(JIT::AboveOrEqual, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.move64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        jit.truncateDoubleToInt64(FPRInfo::returnValueFPR, GPRInfo::returnValueGPR);
+        JIT::Jump checkJSNumber = jit.branchTest64(JIT::NonZero, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.abortWithReason(AHIsNotJSNumber); // FIXME Coerce when the values aren't what we expect, instead of aborting. https://bugs.webkit.org/show_bug.cgi?id=165480
+        checkJSInt32.link(&jit);
+        jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
+        checkJSNumber.link(&jit);
+        break;
+    }
+    case F32: {
+        jit.move(JIT::TrustedImm64(TagTypeNumber), GPRInfo::returnValueGPR2);
+        jit.move64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        jit.convertDoubleToFloat(FPRInfo::returnValueFPR, FPRInfo::returnValueFPR);
+        JIT::Jump checkJSInt32 = jit.branch64(JIT::AboveOrEqual, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        JIT::Jump checkJSNumber = jit.branchTest64(JIT::NonZero, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.abortWithReason(AHIsNotJSNumber); // FIXME Coerce when the values aren't what we expect, instead of aborting. https://bugs.webkit.org/show_bug.cgi?id=165480
+        checkJSInt32.link(&jit);
+        jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
+        jit.convertInt64ToFloat(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        checkJSNumber.link(&jit);
+        break;
+    }
+    case F64: {
+        jit.move(JIT::TrustedImm64(TagTypeNumber), GPRInfo::returnValueGPR2);
+        jit.move64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        JIT::Jump checkJSInt32 = jit.branch64(JIT::AboveOrEqual, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        JIT::Jump checkJSNumber = jit.branchTest64(JIT::NonZero, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
+        jit.abortWithReason(AHIsNotJSNumber); // FIXME Coerce when the values aren't what we expect, instead of aborting. https://bugs.webkit.org/show_bug.cgi?id=165480
+        checkJSInt32.link(&jit);
+        jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
+        jit.convertInt64ToDouble(GPRInfo::returnValueGPR, FPRInfo::returnValueFPR);
+        checkJSNumber.link(&jit);
+        break;
+    }
+    }
+
+    jit.emitFunctionEpilogue();
+    jit.ret();
+
+    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    patchBuffer.link(slowCall, FunctionPtr(vm->getCTIStub(linkCallThunkGenerator).code().executableAddress()));
+    CodeLocationLabel callReturnLocation(patchBuffer.locationOfNearCall(slowCall));
+    CodeLocationLabel hotPathBegin(patchBuffer.locationOf(targetToCheck));
+    CodeLocationNearCall hotPathOther = patchBuffer.locationOfNearCall(fastCall);
+    callLinkInfo->setCallLocations(callReturnLocation, hotPathBegin, hotPathOther);
+    return FINALIZE_CODE(patchBuffer, ("WebAssembly import[%i] stub for signature %p", importIndex, signature));
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmBinding.h b/wasm/WasmBinding.h
new file mode 100644
index 0000000..9fe3fdb
--- /dev/null
+++ b/wasm/WasmBinding.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "B3Compilation.h"
+#include "VM.h"
+#include "WasmFormat.h"
+#include <wtf/Bag.h>
+
+namespace JSC {
+
+class CallLinkInfo;
+
+namespace Wasm {
+
+WasmToJSStub importStubGenerator(VM*, Bag<CallLinkInfo>&, Signature*, unsigned);
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmCallingConvention.cpp b/wasm/WasmCallingConvention.cpp
new file mode 100644
index 0000000..9f6ac67
--- /dev/null
+++ b/wasm/WasmCallingConvention.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WasmCallingConvention.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include <wtf/NeverDestroyed.h>
+
+namespace JSC { namespace Wasm {
+
+const JSCCallingConvention& jscCallingConvention()
+{
+    static LazyNeverDestroyed<JSCCallingConvention> staticJSCCallingConvention;
+    static std::once_flag staticJSCCallingConventionFlag;
+    std::call_once(staticJSCCallingConventionFlag, [] () {
+        staticJSCCallingConvention.construct(Vector<Reg>(), Vector<Reg>(), RegisterSet::calleeSaveRegisters());
+    });
+
+    return staticJSCCallingConvention;
+}
+
+const WasmCallingConvention& wasmCallingConvention()
+{
+    static LazyNeverDestroyed<JSCCallingConvention> staticWasmCallingConvention;
+    static std::once_flag staticWasmCallingConventionFlag;
+    std::call_once(staticWasmCallingConventionFlag, [] () {
+        Vector<Reg> gprArgumentRegisters(GPRInfo::numberOfArgumentRegisters);
+        for (unsigned i = 0; i < GPRInfo::numberOfArgumentRegisters; ++i)
+            gprArgumentRegisters[i] = GPRInfo::toArgumentRegister(i);
+
+        Vector<Reg> fprArgumentRegisters(FPRInfo::numberOfArgumentRegisters);
+        for (unsigned i = 0; i < FPRInfo::numberOfArgumentRegisters; ++i)
+            fprArgumentRegisters[i] = FPRInfo::toArgumentRegister(i);
+
+        staticWasmCallingConvention.construct(WTFMove(gprArgumentRegisters), WTFMove(fprArgumentRegisters), RegisterSet::calleeSaveRegisters());
+    });
+
+    return staticWasmCallingConvention;
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(B3_JIT)
diff --git a/wasm/WasmCallingConvention.h b/wasm/WasmCallingConvention.h
new file mode 100644
index 0000000..b735937
--- /dev/null
+++ b/wasm/WasmCallingConvention.h
@@ -0,0 +1,205 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "AllowMacroScratchRegisterUsage.h"
+#include "B3ArgumentRegValue.h"
+#include "B3BasicBlock.h"
+#include "B3Const64Value.h"
+#include "B3ConstrainedValue.h"
+#include "B3MemoryValue.h"
+#include "B3PatchpointValue.h"
+#include "B3Procedure.h"
+#include "B3StackmapGenerationParams.h"
+#include "CallFrame.h"
+#include "LinkBuffer.h"
+#include "RegisterSet.h"
+#include "WasmFormat.h"
+
+namespace JSC { namespace Wasm {
+
+typedef unsigned (*NextOffset)(unsigned currentOffset, B3::Type type);
+
+template<unsigned headerSize, NextOffset updateOffset>
+class CallingConvention {
+public:
+    CallingConvention(Vector<Reg>&& gprArgs, Vector<Reg>&& fprArgs, RegisterSet&& calleeSaveRegisters)
+        : m_gprArgs(gprArgs)
+        , m_fprArgs(fprArgs)
+        , m_calleeSaveRegisters(calleeSaveRegisters)
+    {
+    }
+
+private:
+    B3::ValueRep marshallArgumentImpl(Vector<Reg> regArgs, B3::Type type, size_t& count, size_t& stackOffset) const
+    {
+        if (count < regArgs.size())
+            return B3::ValueRep::reg(regArgs[count++]);
+
+        count++;
+        B3::ValueRep result = B3::ValueRep::stackArgument(stackOffset);
+        stackOffset = updateOffset(stackOffset, type);
+        return result;
+    }
+
+    B3::ValueRep marshallArgument(B3::Type type, size_t& gpArgumentCount, size_t& fpArgumentCount, size_t& stackOffset) const
+    {
+        switch (type) {
+        case B3::Int32:
+        case B3::Int64:
+            return marshallArgumentImpl(m_gprArgs, type, gpArgumentCount, stackOffset);
+        case B3::Float:
+        case B3::Double:
+            return marshallArgumentImpl(m_fprArgs, type, fpArgumentCount, stackOffset);
+        case B3::Void:
+            break;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+
+public:
+    void setupFrameInPrologue(CodeLocationDataLabelPtr* calleeMoveLocation, B3::Procedure& proc, B3::Origin origin, B3::BasicBlock* block) const
+    {
+        static_assert(CallFrameSlot::callee * sizeof(Register) < headerSize, "We rely on this here for now.");
+        static_assert(CallFrameSlot::codeBlock * sizeof(Register) < headerSize, "We rely on this here for now.");
+
+        B3::PatchpointValue* getCalleePatchpoint = block->appendNew<B3::PatchpointValue>(proc, B3::Int64, origin);
+        getCalleePatchpoint->resultConstraint = B3::ValueRep::SomeRegister;
+        getCalleePatchpoint->effects = B3::Effects::none();
+        getCalleePatchpoint->setGenerator(
+            [=] (CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
+                GPRReg result = params[0].gpr();
+                MacroAssembler::DataLabelPtr moveLocation = jit.moveWithPatch(MacroAssembler::TrustedImmPtr(nullptr), result);
+                jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
+                    *calleeMoveLocation = linkBuffer.locationOf(moveLocation);
+                });
+            });
+
+        B3::Value* framePointer = block->appendNew<B3::Value>(proc, B3::FramePointer, origin);
+        B3::Value* offsetOfCallee = block->appendNew<B3::Const64Value>(proc, origin, CallFrameSlot::callee * sizeof(Register));
+        block->appendNew<B3::MemoryValue>(proc, B3::Store, origin,
+            getCalleePatchpoint,
+            block->appendNew<B3::Value>(proc, B3::Add, origin, framePointer, offsetOfCallee));
+
+        // FIXME: We shouldn't have to store zero into the CodeBlock* spot in the call frame,
+        // but there are places that interpret non-null CodeBlock slot to mean a valid CodeBlock.
+        // When doing unwinding, we'll need to verify that the entire runtime is OK with a non-null
+        // CodeBlock not implying that the CodeBlock is valid.
+        // https://bugs.webkit.org/show_bug.cgi?id=165321
+        B3::Value* offsetOfCodeBlock = block->appendNew<B3::Const64Value>(proc, origin, CallFrameSlot::codeBlock * sizeof(Register));
+        block->appendNew<B3::MemoryValue>(proc, B3::Store, origin,
+            block->appendNew<B3::Const64Value>(proc, origin, 0),
+            block->appendNew<B3::Value>(proc, B3::Add, origin, framePointer, offsetOfCodeBlock));
+    }
+
+    template<typename Functor>
+    void loadArguments(const Vector<Type>& argumentTypes, B3::Procedure& proc, B3::BasicBlock* block, B3::Origin origin, const Functor& functor) const
+    {
+        B3::Value* framePointer = block->appendNew<B3::Value>(proc, B3::FramePointer, origin);
+
+        size_t gpArgumentCount = 0;
+        size_t fpArgumentCount = 0;
+        size_t stackOffset = headerSize;
+
+        for (size_t i = 0; i < argumentTypes.size(); ++i) {
+            B3::Type type = toB3Type(argumentTypes[i]);
+            B3::Value* argument;
+            B3::ValueRep rep = marshallArgument(type, gpArgumentCount, fpArgumentCount, stackOffset);
+            if (rep.isReg()) {
+                argument = block->appendNew<B3::ArgumentRegValue>(proc, origin, rep.reg());
+                if (type == B3::Int32 || type == B3::Float)
+                    argument = block->appendNew<B3::Value>(proc, B3::Trunc, origin, argument);
+            } else {
+                ASSERT(rep.isStackArgument());
+                B3::Value* address = block->appendNew<B3::Value>(proc, B3::Add, origin, framePointer,
+                    block->appendNew<B3::Const64Value>(proc, origin, rep.offsetFromSP()));
+                argument = block->appendNew<B3::MemoryValue>(proc, B3::Load, type, origin, address);
+            }
+            functor(argument, i);
+        }
+    }
+
+    // It's expected that the pachpointFunctor sets the generator for the call operation.
+    template<typename Functor>
+    B3::Value* setupCall(B3::Procedure& proc, B3::BasicBlock* block, B3::Origin origin, const Vector<B3::Value*>& arguments, B3::Type returnType, const Functor& patchpointFunctor) const
+    {
+        size_t gpArgumentCount = 0;
+        size_t fpArgumentCount = 0;
+        size_t stackOffset = headerSize - sizeof(CallerFrameAndPC);
+
+        Vector<B3::ConstrainedValue> constrainedArguments;
+        for (B3::Value* argument : arguments) {
+            B3::ValueRep rep = marshallArgument(argument->type(), gpArgumentCount, fpArgumentCount, stackOffset);
+            constrainedArguments.append(B3::ConstrainedValue(argument, rep));
+        }
+
+        proc.requestCallArgAreaSizeInBytes(WTF::roundUpToMultipleOf(stackAlignmentBytes(), stackOffset));
+
+        B3::PatchpointValue* patchpoint = block->appendNew<B3::PatchpointValue>(proc, returnType, origin);
+        patchpoint->clobberEarly(RegisterSet::macroScratchRegisters());
+        patchpoint->clobberLate(RegisterSet::volatileRegistersForJSCall());
+        patchpointFunctor(patchpoint);
+        patchpoint->appendVector(constrainedArguments);
+
+        switch (returnType) {
+        case B3::Void:
+            return nullptr;
+        case B3::Float:
+        case B3::Double:
+            patchpoint->resultConstraint = B3::ValueRep::reg(FPRInfo::returnValueFPR);
+            break;
+        case B3::Int32:
+        case B3::Int64:
+            patchpoint->resultConstraint = B3::ValueRep::reg(GPRInfo::returnValueGPR);
+            break;
+        }
+        return patchpoint;
+    }
+
+    const Vector<Reg> m_gprArgs;
+    const Vector<Reg> m_fprArgs;
+    const RegisterSet m_calleeSaveRegisters;
+    const RegisterSet m_callerSaveRegisters;
+};
+
+inline unsigned nextJSCOffset(unsigned currentOffset, B3::Type)
+{
+    return currentOffset + sizeof(Register);
+}
+
+constexpr unsigned jscHeaderSize = ExecState::headerSizeInRegisters * sizeof(Register);
+typedef CallingConvention<jscHeaderSize, nextJSCOffset> JSCCallingConvention;
+
+typedef JSCCallingConvention WasmCallingConvention;
+
+const JSCCallingConvention& jscCallingConvention();
+const WasmCallingConvention& wasmCallingConvention();
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmExceptionType.h b/wasm/WasmExceptionType.h
new file mode 100644
index 0000000..c5979c0
--- /dev/null
+++ b/wasm/WasmExceptionType.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+namespace JSC {
+
+namespace Wasm {
+
+#define FOR_EACH_EXCEPTION(macro) \
+    macro(OutOfBoundsMemoryAccess,  "Out of bounds memory access") \
+    macro(OutOfBoundsCallIndirect, "Out of bounds call_indirect") \
+    macro(NullTableEntry,  "call_indirect to a null table entry") \
+    macro(BadSignature, "call_indirect to a signature that does not match") \
+    macro(OutOfBoundsTrunc, "Out of bounds Trunc operation") \
+
+enum class ExceptionType : uint32_t {
+#define MAKE_ENUM(enumName, error) enumName,
+    FOR_EACH_EXCEPTION(MAKE_ENUM)
+#undef MAKE_ENUM
+};
+
+ALWAYS_INLINE const char* errorMessageForExceptionType(ExceptionType type)
+{
+    switch (type) {
+#define SWITCH_CASE(enumName, error) \
+    case ExceptionType::enumName: return error;
+
+    FOR_EACH_EXCEPTION(SWITCH_CASE)
+#undef SWITCH_CASE
+    }
+    ASSERT_NOT_REACHED();
+    return "";
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmFormat.cpp b/wasm/WasmFormat.cpp
new file mode 100644
index 0000000..e420b83
--- /dev/null
+++ b/wasm/WasmFormat.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WasmFormat.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "WasmMemory.h"
+
+namespace JSC { namespace Wasm {
+
+JS_EXPORT_PRIVATE ModuleInformation::~ModuleInformation() { }
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmFormat.h b/wasm/WasmFormat.h
new file mode 100644
index 0000000..e49a891
--- /dev/null
+++ b/wasm/WasmFormat.h
@@ -0,0 +1,271 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "B3Compilation.h"
+#include "B3Type.h"
+#include "CodeLocation.h"
+#include "Identifier.h"
+#include "MacroAssemblerCodeRef.h"
+#include "RegisterAtOffsetList.h"
+#include "WasmMemoryInformation.h"
+#include "WasmOps.h"
+#include "WasmPageCount.h"
+#include <memory>
+#include <wtf/FastMalloc.h>
+#include <wtf/Optional.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JSFunction;
+
+namespace Wasm {
+
+inline bool isValueType(Type type)
+{
+    switch (type) {
+    case I32:
+    case I64:
+    case F32:
+    case F64:
+        return true;
+    default:
+        break;
+    }
+    return false;
+}
+    
+enum class ExternalKind : uint8_t {
+    // FIXME auto-generate this. https://bugs.webkit.org/show_bug.cgi?id=165231
+    Function = 0,
+    Table = 1,
+    Memory = 2,
+    Global = 3,
+};
+
+template<typename Int>
+static bool isValidExternalKind(Int val)
+{
+    switch (val) {
+    case static_cast<Int>(ExternalKind::Function):
+    case static_cast<Int>(ExternalKind::Table):
+    case static_cast<Int>(ExternalKind::Memory):
+    case static_cast<Int>(ExternalKind::Global):
+        return true;
+    default:
+        return false;
+    }
+}
+
+static_assert(static_cast<int>(ExternalKind::Function) == 0, "Wasm needs Function to have the value 0");
+static_assert(static_cast<int>(ExternalKind::Table)    == 1, "Wasm needs Table to have the value 1");
+static_assert(static_cast<int>(ExternalKind::Memory)   == 2, "Wasm needs Memory to have the value 2");
+static_assert(static_cast<int>(ExternalKind::Global)   == 3, "Wasm needs Global to have the value 3");
+
+static inline const char* makeString(ExternalKind kind)
+{
+    switch (kind) {
+    case ExternalKind::Function: return "Function";
+    case ExternalKind::Table: return "Table";
+    case ExternalKind::Memory: return "Memory";
+    case ExternalKind::Global: return "Global";
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return "?";
+}
+
+struct Signature {
+    Type returnType;
+    Vector<Type> arguments;
+};
+
+struct Import {
+    Identifier module;
+    Identifier field;
+    ExternalKind kind;
+    unsigned kindIndex; // Index in the vector of the corresponding kind.
+};
+
+struct Export {
+    Identifier field;
+    ExternalKind kind;
+    unsigned kindIndex; // Index in the vector of the corresponding kind.
+};
+
+struct Global {
+    enum Mutability : uint8_t {
+        // FIXME auto-generate this. https://bugs.webkit.org/show_bug.cgi?id=165231
+        Mutable = 1,
+        Immutable = 0
+    };
+
+    enum InitializationType {
+        IsImport,
+        FromGlobalImport,
+        FromExpression
+    };
+
+    Mutability mutability;
+    Type type;
+    InitializationType initializationType { IsImport };
+    uint64_t initialBitsOrImportNumber { 0 };
+};
+
+struct FunctionLocationInBinary {
+    size_t start;
+    size_t end;
+};
+
+struct Segment {
+    uint32_t offset;
+    uint32_t sizeInBytes;
+    // Bytes are allocated at the end.
+    static Segment* make(uint32_t offset, uint32_t sizeInBytes)
+    {
+        auto allocated = tryFastCalloc(sizeof(Segment) + sizeInBytes, 1);
+        Segment* segment;
+        if (!allocated.getValue(segment))
+            return nullptr;
+        segment->offset = offset;
+        segment->sizeInBytes = sizeInBytes;
+        return segment;
+    }
+    static void destroy(Segment *segment)
+    {
+        fastFree(segment);
+    }
+    uint8_t& byte(uint32_t pos)
+    {
+        ASSERT(pos < sizeInBytes);
+        return *reinterpret_cast<uint8_t*>(reinterpret_cast<char*>(this) + sizeof(offset) + sizeof(sizeInBytes) + pos);
+    }
+    typedef std::unique_ptr<Segment, decltype(&Segment::destroy)> Ptr;
+    static Ptr makePtr(Segment* segment)
+    {
+        return Ptr(segment, &Segment::destroy);
+    }
+};
+
+struct Element {
+    uint32_t offset;
+    Vector<uint32_t> functionIndices;
+};
+
+class TableInformation {
+public:
+    TableInformation()
+    {
+        ASSERT(!*this);
+    }
+
+    TableInformation(uint32_t initial, std::optional<uint32_t> maximum, bool isImport)
+        : m_initial(initial)
+        , m_maximum(maximum)
+        , m_isImport(isImport)
+        , m_isValid(true)
+    {
+        ASSERT(*this);
+    }
+
+    explicit operator bool() const { return m_isValid; }
+    bool isImport() const { return m_isImport; }
+    uint32_t initial() const { return m_initial; }
+    std::optional<uint32_t> maximum() const { return m_maximum; }
+
+private:
+    uint32_t m_initial;
+    std::optional<uint32_t> m_maximum;
+    bool m_isImport { false };
+    bool m_isValid { false };
+};
+
+struct ModuleInformation {
+    Vector<Signature> signatures;
+    Vector<Import> imports;
+    Vector<Signature*> importFunctions;
+    Vector<Signature*> internalFunctionSignatures;
+    MemoryInformation memory;
+    Vector<Export> exports;
+    std::optional<uint32_t> startFunctionIndexSpace;
+    Vector<Segment::Ptr> data;
+    Vector<Element> elements;
+    TableInformation tableInformation;
+    Vector<Global> globals;
+    unsigned firstInternalGlobal { 0 };
+
+    ~ModuleInformation();
+};
+
+struct UnlinkedWasmToWasmCall {
+    CodeLocationCall callLocation;
+    size_t functionIndex;
+};
+
+struct Entrypoint {
+    std::unique_ptr<B3::Compilation> compilation;
+    RegisterAtOffsetList calleeSaveRegisters;
+};
+
+struct WasmInternalFunction {
+    CodeLocationDataLabelPtr wasmCalleeMoveLocation;
+    CodeLocationDataLabelPtr jsToWasmCalleeMoveLocation;
+
+    Entrypoint wasmEntrypoint;
+    Entrypoint jsToWasmEntrypoint;
+};
+
+typedef MacroAssemblerCodeRef WasmToJSStub;
+
+// WebAssembly direct calls and call_indirect use indices into "function index space". This space starts with all imports, and then all internal functions.
+// CallableFunction and FunctionIndexSpace are only meant as fast lookup tables for these opcodes, and do not own code.
+struct CallableFunction {
+    CallableFunction() = default;
+
+    CallableFunction(Signature* signature, void* code = nullptr)
+        : signature(signature)
+        , code(code)
+    {
+    }
+
+    // FIXME pack this inside a (uniqued) integer (for correctness the parser should unique Signatures),
+    // and then pack that integer into the code pointer. https://bugs.webkit.org/show_bug.cgi?id=165511
+    Signature* signature { nullptr }; 
+    void* code { nullptr };
+};
+typedef Vector<CallableFunction> FunctionIndexSpace;
+
+
+struct ImmutableFunctionIndexSpace {
+    MallocPtr<CallableFunction> buffer;
+    size_t size;
+};
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmFunctionParser.h b/wasm/WasmFunctionParser.h
new file mode 100644
index 0000000..e61e337
--- /dev/null
+++ b/wasm/WasmFunctionParser.h
@@ -0,0 +1,602 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "WasmParser.h"
+#include <wtf/DataLog.h>
+
+namespace JSC { namespace Wasm {
+
+enum class BlockType {
+    If,
+    Block,
+    Loop
+};
+
+template<typename Context>
+class FunctionParser : public Parser<void> {
+public:
+    typedef typename Context::ExpressionType ExpressionType;
+    typedef typename Context::ControlType ControlType;
+    typedef typename Context::ExpressionList ExpressionList;
+
+    FunctionParser(Context&, const uint8_t* functionStart, size_t functionLength, const Signature*, const ImmutableFunctionIndexSpace&, const ModuleInformation&);
+
+    Result WARN_UNUSED_RETURN parse();
+
+    struct ControlEntry {
+        ExpressionList enclosedExpressionStack;
+        ControlType controlData;
+    };
+
+private:
+    static const bool verbose = false;
+
+    PartialResult WARN_UNUSED_RETURN parseBody();
+    PartialResult WARN_UNUSED_RETURN parseExpression(OpType);
+    PartialResult WARN_UNUSED_RETURN parseUnreachableExpression(OpType);
+    PartialResult WARN_UNUSED_RETURN addReturn();
+    PartialResult WARN_UNUSED_RETURN unifyControl(Vector<ExpressionType>&, unsigned level);
+
+#define WASM_TRY_POP_EXPRESSION_STACK_INTO(result, what) do {                               \
+        WASM_PARSER_FAIL_IF(m_expressionStack.isEmpty(), "can't pop empty stack in " what); \
+        result = m_expressionStack.takeLast();                                              \
+    } while (0)
+
+    template<OpType>
+    PartialResult WARN_UNUSED_RETURN unaryCase();
+
+    template<OpType>
+    PartialResult WARN_UNUSED_RETURN binaryCase();
+
+#define WASM_TRY_ADD_TO_CONTEXT(add_expression) WASM_FAIL_IF_HELPER_FAILS(m_context.add_expression)
+
+    // FIXME add a macro as above for WASM_TRY_APPEND_TO_CONTROL_STACK https://bugs.webkit.org/show_bug.cgi?id=165862
+
+    Context& m_context;
+    ExpressionList m_expressionStack;
+    Vector<ControlEntry> m_controlStack;
+    const Signature* m_signature;
+    const ImmutableFunctionIndexSpace& m_functionIndexSpace;
+    const ModuleInformation& m_info;
+    unsigned m_unreachableBlocks { 0 };
+};
+
+template<typename Context>
+FunctionParser<Context>::FunctionParser(Context& context, const uint8_t* functionStart, size_t functionLength, const Signature* signature, const ImmutableFunctionIndexSpace& functionIndexSpace, const ModuleInformation& info)
+    : Parser(functionStart, functionLength)
+    , m_context(context)
+    , m_signature(signature)
+    , m_functionIndexSpace(functionIndexSpace)
+    , m_info(info)
+{
+    if (verbose)
+        dataLogLn("Parsing function starting at: ", (uintptr_t)functionStart, " of length: ", functionLength);
+}
+
+template<typename Context>
+auto FunctionParser<Context>::parse() -> Result
+{
+    uint32_t localCount;
+
+    WASM_PARSER_FAIL_IF(!m_context.addArguments(m_signature->arguments), "can't add ", m_signature->arguments.size(), " arguments to Function");
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(localCount), "can't get local count");
+    WASM_PARSER_FAIL_IF(localCount == std::numeric_limits<uint32_t>::max(), "Function section's local count is too big ", localCount);
+
+    for (uint32_t i = 0; i < localCount; ++i) {
+        uint32_t numberOfLocals;
+        Type typeOfLocal;
+
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(numberOfLocals), "can't get Function's number of locals in group ", i);
+        WASM_PARSER_FAIL_IF(numberOfLocals == std::numeric_limits<uint32_t>::max(), "Function section's ", i, "th local group count is too big ", numberOfLocals);
+        WASM_PARSER_FAIL_IF(!parseValueType(typeOfLocal), "can't get Function local's type in group ", i);
+        WASM_PARSER_FAIL_IF(!m_context.addLocal(typeOfLocal, numberOfLocals), "can't add ", numberOfLocals, " Function locals from group ", i);
+    }
+
+    WASM_FAIL_IF_HELPER_FAILS(parseBody());
+
+    return { };
+}
+
+template<typename Context>
+auto FunctionParser<Context>::parseBody() -> PartialResult
+{
+    while (true) {
+        uint8_t op;
+        WASM_PARSER_FAIL_IF(!parseUInt8(op), "can't decode opcode");
+        WASM_PARSER_FAIL_IF(!isValidOpType(op), "invalid opcode ", op);
+
+        if (verbose) {
+            dataLogLn("processing op (", m_unreachableBlocks, "): ",  RawPointer(reinterpret_cast<void*>(op)), ", ", makeString(static_cast<OpType>(op)), " at offset: ", RawPointer(reinterpret_cast<void*>(m_offset)));
+            m_context.dump(m_controlStack, m_expressionStack);
+        }
+
+        if (op == End && !m_controlStack.size()) {
+            if (m_unreachableBlocks)
+                return { };
+            return addReturn();
+        }
+
+        if (m_unreachableBlocks)
+            WASM_FAIL_IF_HELPER_FAILS(parseUnreachableExpression(static_cast<OpType>(op)));
+        else
+            WASM_FAIL_IF_HELPER_FAILS(parseExpression(static_cast<OpType>(op)));
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+template<typename Context>
+auto FunctionParser<Context>::addReturn() -> PartialResult
+{
+    ExpressionList returnValues;
+    if (m_signature->returnType != Void) {
+        ExpressionType returnValue;
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(returnValue, "return");
+        returnValues.append(returnValue);
+    }
+
+    m_unreachableBlocks = 1;
+    WASM_TRY_ADD_TO_CONTEXT(addReturn(returnValues));
+    return { };
+}
+
+template<typename Context>
+template<OpType op>
+auto FunctionParser<Context>::binaryCase() -> PartialResult
+{
+    ExpressionType right;
+    ExpressionType left;
+    ExpressionType result;
+
+    WASM_TRY_POP_EXPRESSION_STACK_INTO(right, "binary right");
+    WASM_TRY_POP_EXPRESSION_STACK_INTO(left, "binary left");
+    WASM_TRY_ADD_TO_CONTEXT(template addOp<op>(left, right, result));
+
+    m_expressionStack.append(result);
+    return { };
+}
+
+template<typename Context>
+template<OpType op>
+auto FunctionParser<Context>::unaryCase() -> PartialResult
+{
+    ExpressionType value;
+    ExpressionType result;
+
+    WASM_TRY_POP_EXPRESSION_STACK_INTO(value, "unary");
+    WASM_TRY_ADD_TO_CONTEXT(template addOp<op>(value, result));
+
+    m_expressionStack.append(result);
+    return { };
+}
+
+template<typename Context>
+auto FunctionParser<Context>::parseExpression(OpType op) -> PartialResult
+{
+    switch (op) {
+#define CREATE_CASE(name, id, b3op, inc) case OpType::name: return binaryCase<OpType::name>();
+    FOR_EACH_WASM_BINARY_OP(CREATE_CASE)
+#undef CREATE_CASE
+
+#define CREATE_CASE(name, id, b3op, inc) case OpType::name: return unaryCase<OpType::name>();
+    FOR_EACH_WASM_UNARY_OP(CREATE_CASE)
+#undef CREATE_CASE
+
+    case Select: {
+        ExpressionType condition;
+        ExpressionType zero;
+        ExpressionType nonZero;
+
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(condition, "select condition");
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(zero, "select zero");
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(nonZero, "select non-zero");
+
+        ExpressionType result;
+        WASM_TRY_ADD_TO_CONTEXT(addSelect(condition, nonZero, zero, result));
+
+        m_expressionStack.append(result);
+        return { };
+    }
+
+#define CREATE_CASE(name, id, b3op, inc) case OpType::name:
+    FOR_EACH_WASM_MEMORY_LOAD_OP(CREATE_CASE) {
+        uint32_t alignment;
+        uint32_t offset;
+        ExpressionType pointer;
+        ExpressionType result;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(alignment), "can't get load alignment");
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(offset), "can't get load offset");
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(pointer, "load pointer");
+        WASM_TRY_ADD_TO_CONTEXT(load(static_cast<LoadOpType>(op), pointer, result, offset));
+        m_expressionStack.append(result);
+        return { };
+    }
+
+    FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE) {
+        uint32_t alignment;
+        uint32_t offset;
+        ExpressionType value;
+        ExpressionType pointer;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(alignment), "can't get store alignment");
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(offset), "can't get store offset");
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(value, "store value");
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(pointer, "store pointer");
+        WASM_TRY_ADD_TO_CONTEXT(store(static_cast<StoreOpType>(op), pointer, value, offset));
+        return { };
+    }
+#undef CREATE_CASE
+
+    case F32Const: {
+        uint32_t constant;
+        WASM_PARSER_FAIL_IF(!parseUInt32(constant), "can't parse 32-bit floating-point constant");
+        m_expressionStack.append(m_context.addConstant(F32, constant));
+        return { };
+    }
+
+    case I32Const: {
+        int32_t constant;
+        WASM_PARSER_FAIL_IF(!parseVarInt32(constant), "can't parse 32-bit constant");
+        m_expressionStack.append(m_context.addConstant(I32, constant));
+        return { };
+    }
+
+    case F64Const: {
+        uint64_t constant;
+        WASM_PARSER_FAIL_IF(!parseUInt64(constant), "can't parse 64-bit floating-point constant");
+        m_expressionStack.append(m_context.addConstant(F64, constant));
+        return { };
+    }
+
+    case I64Const: {
+        int64_t constant;
+        WASM_PARSER_FAIL_IF(!parseVarInt64(constant), "can't parse 64-bit constant");
+        m_expressionStack.append(m_context.addConstant(I64, constant));
+        return { };
+    }
+
+    case GetLocal: {
+        uint32_t index;
+        ExpressionType result;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get index for get_local");
+        WASM_PARSER_FAIL_IF(!m_context.getLocal(index, result), "can't get_local at index", index);
+        m_expressionStack.append(result);
+        return { };
+    }
+
+    case SetLocal: {
+        uint32_t index;
+        ExpressionType value;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get index for set_local");
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(value, "set_local");
+        WASM_TRY_ADD_TO_CONTEXT(setLocal(index, value));
+        return { };
+    }
+
+    case TeeLocal: {
+        uint32_t index;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get index for tee_local");
+        WASM_PARSER_FAIL_IF(m_expressionStack.isEmpty(), "can't tee_local on empty expression stack");
+        WASM_TRY_ADD_TO_CONTEXT(setLocal(index, m_expressionStack.last()));
+        return { };
+    }
+
+    case GetGlobal: {
+        uint32_t index;
+        ExpressionType result;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get get_global's index");
+        WASM_TRY_ADD_TO_CONTEXT(getGlobal(index, result));
+        m_expressionStack.append(result);
+        return { };
+    }
+
+    case SetGlobal: {
+        uint32_t index;
+        ExpressionType value;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get set_global's index");
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(value, "set_global value");
+        WASM_TRY_ADD_TO_CONTEXT(setGlobal(index, value));
+        return m_context.setGlobal(index, value);
+    }
+
+    case Call: {
+        uint32_t functionIndex;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(functionIndex), "can't parse call's function index");
+        WASM_PARSER_FAIL_IF(functionIndex >= m_functionIndexSpace.size, "call function index ", functionIndex, " exceeds function index space ", m_functionIndexSpace.size);
+
+        const Signature* calleeSignature = m_functionIndexSpace.buffer.get()[functionIndex].signature;
+        WASM_PARSER_FAIL_IF(calleeSignature->arguments.size() > m_expressionStack.size(), "call function index ", functionIndex, " has ", calleeSignature->arguments.size(), " arguments, but the expression stack currently holds ", m_expressionStack.size(), " values");
+
+        size_t firstArgumentIndex = m_expressionStack.size() - calleeSignature->arguments.size();
+        Vector<ExpressionType> args;
+        WASM_PARSER_FAIL_IF(!args.tryReserveCapacity(calleeSignature->arguments.size()), "can't allocate enough memory for call's ", calleeSignature->arguments.size(), " arguments");
+        for (size_t i = firstArgumentIndex; i < m_expressionStack.size(); ++i)
+            args.uncheckedAppend(m_expressionStack[i]);
+        m_expressionStack.shrink(firstArgumentIndex);
+
+        ExpressionType result = Context::emptyExpression;
+        WASM_TRY_ADD_TO_CONTEXT(addCall(functionIndex, calleeSignature, args, result));
+
+        if (result != Context::emptyExpression)
+            m_expressionStack.append(result);
+
+            return { };
+    }
+
+    case CallIndirect: {
+        uint32_t signatureIndex;
+        uint8_t reserved;
+        WASM_PARSER_FAIL_IF(!m_info.tableInformation, "call_indirect is only valid when a table is defined or imported");
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(signatureIndex), "can't get call_indirect's signature index");
+        WASM_PARSER_FAIL_IF(!parseVarUInt1(reserved), "can't get call_indirect's reserved byte");
+        WASM_PARSER_FAIL_IF(reserved, "call_indirect's 'reserved' varuint1 must be 0x0");
+        WASM_PARSER_FAIL_IF(m_info.signatures.size() <= signatureIndex, "call_indirect's signature index ", signatureIndex, " exceeds known signatures ", m_info.signatures.size());
+
+        const Signature* calleeSignature = &m_info.signatures[signatureIndex];
+        size_t argumentCount = calleeSignature->arguments.size() + 1; // Add the callee's index.
+        WASM_PARSER_FAIL_IF(argumentCount > m_expressionStack.size(), "call_indirect expects ", argumentCount, " arguments, but the expression stack currently holds ", m_expressionStack.size(), " values");
+
+        Vector<ExpressionType> args;
+        WASM_PARSER_FAIL_IF(!args.tryReserveCapacity(argumentCount), "can't allocate enough memory for ", argumentCount, " call_indirect arguments");
+        size_t firstArgumentIndex = m_expressionStack.size() - argumentCount;
+        for (size_t i = firstArgumentIndex; i < m_expressionStack.size(); ++i)
+            args.uncheckedAppend(m_expressionStack[i]);
+        m_expressionStack.shrink(firstArgumentIndex);
+
+        ExpressionType result = Context::emptyExpression;
+        WASM_TRY_ADD_TO_CONTEXT(addCallIndirect(calleeSignature, args, result));
+
+        if (result != Context::emptyExpression)
+            m_expressionStack.append(result);
+
+        return { };
+    }
+
+    case Block: {
+        Type inlineSignature;
+        WASM_PARSER_FAIL_IF(!parseResultType(inlineSignature), "can't get block's inline signature");
+        m_controlStack.append({ WTFMove(m_expressionStack), m_context.addBlock(inlineSignature) });
+        m_expressionStack = ExpressionList();
+        return { };
+    }
+
+    case Loop: {
+        Type inlineSignature;
+        WASM_PARSER_FAIL_IF(!parseResultType(inlineSignature), "can't get loop's inline signature");
+        m_controlStack.append({ WTFMove(m_expressionStack), m_context.addLoop(inlineSignature) });
+        m_expressionStack = ExpressionList();
+        return { };
+    }
+
+    case If: {
+        Type inlineSignature;
+        ExpressionType condition;
+        ControlType control;
+        WASM_PARSER_FAIL_IF(!parseResultType(inlineSignature), "can't get if's inline signature");
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(condition, "if condition");
+        WASM_TRY_ADD_TO_CONTEXT(addIf(condition, inlineSignature, control));
+        m_controlStack.append({ WTFMove(m_expressionStack), control });
+        m_expressionStack = ExpressionList();
+        return { };
+    }
+
+    case Else: {
+        WASM_PARSER_FAIL_IF(m_controlStack.isEmpty(), "can't use else block at the top-level of a function");
+        WASM_TRY_ADD_TO_CONTEXT(addElse(m_controlStack.last().controlData, m_expressionStack));
+        m_expressionStack.shrink(0);
+        return { };
+    }
+
+    case Br:
+    case BrIf: {
+        uint32_t target;
+        ExpressionType condition = Context::emptyExpression;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(target), "can't get br / br_if's target");
+        WASM_PARSER_FAIL_IF(target >= m_controlStack.size(), "br / br_if's target ", target, " exceeds control stack size ", m_controlStack.size());
+        if (op == BrIf)
+            WASM_TRY_POP_EXPRESSION_STACK_INTO(condition, "br / br_if condition");
+        else
+            m_unreachableBlocks = 1;
+
+        ControlType& data = m_controlStack[m_controlStack.size() - 1 - target].controlData;
+
+        WASM_TRY_ADD_TO_CONTEXT(addBranch(data, condition, m_expressionStack));
+        return { };
+    }
+
+    case BrTable: {
+        uint32_t numberOfTargets;
+        ExpressionType condition;
+        uint32_t defaultTarget;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(numberOfTargets), "can't get the number of targets for br_table");
+        WASM_PARSER_FAIL_IF(numberOfTargets == std::numeric_limits<uint32_t>::max(), "br_table's number of targets is too big ", numberOfTargets);
+
+        Vector<ControlType*> targets;
+        WASM_PARSER_FAIL_IF(!targets.tryReserveCapacity(numberOfTargets), "can't allocate memory for ", numberOfTargets, " br_table targets");
+        for (uint32_t i = 0; i < numberOfTargets; ++i) {
+            uint32_t target;
+            WASM_PARSER_FAIL_IF(!parseVarUInt32(target), "can't get ", i, "th target for br_table");
+            WASM_PARSER_FAIL_IF(target >= m_controlStack.size(), "br_table's ", i, "th target ", target, " exceeds control stack size ", m_controlStack.size());
+            targets.uncheckedAppend(&m_controlStack[m_controlStack.size() - 1 - target].controlData);
+        }
+
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(defaultTarget), "can't get default target for br_table");
+        WASM_PARSER_FAIL_IF(defaultTarget >= m_controlStack.size(), "br_table's default target ", defaultTarget, " exceeds control stack size ", m_controlStack.size());
+        WASM_TRY_POP_EXPRESSION_STACK_INTO(condition, "br_table condition");
+        WASM_TRY_ADD_TO_CONTEXT(addSwitch(condition, targets, m_controlStack[m_controlStack.size() - 1 - defaultTarget].controlData, m_expressionStack));
+
+        m_unreachableBlocks = 1;
+        return { };
+    }
+
+    case Return: {
+        return addReturn();
+    }
+
+    case End: {
+        ControlEntry data = m_controlStack.takeLast();
+        // FIXME: This is a little weird in that it will modify the expressionStack for the result of the block.
+        // That's a little too effectful for me but I don't have a better API right now.
+        // see: https://bugs.webkit.org/show_bug.cgi?id=164353
+        WASM_TRY_ADD_TO_CONTEXT(endBlock(data, m_expressionStack));
+        m_expressionStack.swap(data.enclosedExpressionStack);
+        return { };
+    }
+
+    case Unreachable: {
+        WASM_TRY_ADD_TO_CONTEXT(addUnreachable());
+        m_unreachableBlocks = 1;
+        return { };
+    }
+
+    case Drop: {
+        WASM_PARSER_FAIL_IF(!m_expressionStack.size(), "can't drop on empty stack");
+        m_expressionStack.takeLast();
+        return { };
+    }
+
+    case Nop: {
+        return { };
+    }
+
+    case GrowMemory:
+        return fail("not yet implemented: grow_memory"); // FIXME: Not yet implemented.
+
+    case CurrentMemory:
+        return fail("not yet implemented: current_memory"); // FIXME: Not yet implemented.
+
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+// FIXME: We should try to use the same decoder function for both unreachable and reachable code. https://bugs.webkit.org/show_bug.cgi?id=165965
+template<typename Context>
+auto FunctionParser<Context>::parseUnreachableExpression(OpType op) -> PartialResult
+{
+    ASSERT(m_unreachableBlocks);
+#define CREATE_CASE(name, id, b3op, inc) case OpType::name:
+    switch (op) {
+    case Else: {
+        if (m_unreachableBlocks > 1)
+            return { };
+
+        ControlEntry& data = m_controlStack.last();
+        m_unreachableBlocks = 0;
+        WASM_TRY_ADD_TO_CONTEXT(addElseToUnreachable(data.controlData));
+        m_expressionStack.shrink(0);
+        return { };
+    }
+
+    case End: {
+        if (m_unreachableBlocks == 1) {
+            ControlEntry data = m_controlStack.takeLast();
+            WASM_TRY_ADD_TO_CONTEXT(addEndToUnreachable(data));
+            m_expressionStack.swap(data.enclosedExpressionStack);
+        }
+        m_unreachableBlocks--;
+        return { };
+    }
+
+    case Loop:
+    case If:
+    case Block: {
+        m_unreachableBlocks++;
+        Type unused;
+        WASM_PARSER_FAIL_IF(!parseResultType(unused), "can't get inline type for ", op, " in unreachable context");
+        return { };
+    }
+
+    case BrTable: {
+        uint32_t numberOfTargets;
+        uint32_t unused;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(numberOfTargets), "can't get the number of targets for br_table in unreachable context");
+        WASM_PARSER_FAIL_IF(numberOfTargets == std::numeric_limits<uint32_t>::max(), "br_table's number of targets is too big ", numberOfTargets);
+
+        for (uint32_t i = 0; i < numberOfTargets; ++i)
+            WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get ", i, "th target for br_table in unreachable context");
+
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get default target for br_table in unreachable context");
+        return { };
+    }
+
+    case CallIndirect: {
+        uint32_t unused;
+        uint8_t unused2;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get call_indirect's signature index in unreachable context");
+        WASM_PARSER_FAIL_IF(!parseVarUInt1(unused2), "can't get call_indirect's reserved byte in unreachable context");
+        return { };
+    }
+
+    // two immediate cases
+    FOR_EACH_WASM_MEMORY_LOAD_OP(CREATE_CASE)
+    FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE) {
+        uint32_t unused;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get first immediate for ", op, " in unreachable context");
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get second immediate for ", op, " in unreachable context");
+        return { };
+    }
+
+    // one immediate cases
+    case F32Const:
+    case I32Const:
+    case F64Const:
+    case I64Const:
+    case SetLocal:
+    case GetLocal:
+    case TeeLocal:
+    case GetGlobal:
+    case SetGlobal:
+    case Br:
+    case BrIf:
+    case Call: {
+        uint32_t unused;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get immediate for ", op, " in unreachable context");
+        return { };
+    }
+
+    // no immediate cases
+    FOR_EACH_WASM_BINARY_OP(CREATE_CASE)
+    FOR_EACH_WASM_UNARY_OP(CREATE_CASE)
+    case Unreachable:
+    case Nop:
+    case Return:
+    case Select:
+    case Drop:
+    case GrowMemory:
+    case CurrentMemory: {
+        return { };
+    }
+    }
+#undef CREATE_CASE
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmMemory.cpp b/wasm/WasmMemory.cpp
new file mode 100644
index 0000000..f19ece0
--- /dev/null
+++ b/wasm/WasmMemory.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WasmMemory.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+namespace JSC { namespace Wasm {
+
+Memory::Memory(PageCount initial, PageCount maximum)
+    : m_mode(Mode::BoundsChecking)
+    , m_size(initial.bytes())
+    , m_capacity(maximum ? maximum.bytes() : PageCount::max().bytes())
+    , m_initial(initial)
+    , m_maximum(maximum)
+    // FIXME: If we add signal based bounds checking then we need extra space for overflow on load.
+    // see: https://bugs.webkit.org/show_bug.cgi?id=162693
+{
+    RELEASE_ASSERT(!maximum || maximum >= initial); // This should be guaranteed by our caller.
+
+    m_mappedCapacity = m_capacity;
+    // FIXME: It would be nice if we had a VM tag for wasm memory. https://bugs.webkit.org/show_bug.cgi?id=163600
+    void* result = mmap(nullptr, m_mappedCapacity, PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);
+    if (result == MAP_FAILED) {
+        // Try again with a different number.
+        m_mappedCapacity = m_size;
+        result = mmap(nullptr, m_mappedCapacity, PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);
+        if (result == MAP_FAILED)
+            return;
+    }
+
+    ASSERT(m_size <= m_mappedCapacity);
+    if (mprotect(result, m_size, PROT_READ | PROT_WRITE)) {
+        munmap(result, m_mappedCapacity);
+        return;
+    }
+
+    m_memory = result;
+}
+
+} // namespace JSC
+
+} // namespace Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmMemory.h b/wasm/WasmMemory.h
new file mode 100644
index 0000000..b411f34
--- /dev/null
+++ b/wasm/WasmMemory.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "WasmCallingConvention.h"
+#include "WasmPageCount.h"
+
+#include <wtf/Vector.h>
+
+namespace JSC { namespace Wasm {
+
+class Memory {
+    WTF_MAKE_NONCOPYABLE(Memory);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+
+    // FIXME: We should support other modes. see: https://bugs.webkit.org/show_bug.cgi?id=162693
+    enum class Mode {
+        BoundsChecking
+    };
+
+    JS_EXPORT_PRIVATE Memory(PageCount initial, PageCount maximum);
+
+    ~Memory()
+    {
+        if (m_memory)
+            munmap(m_memory, m_mappedCapacity);
+    }
+
+    bool isValid() const { return !!m_memory; }
+
+    void* memory() const { return m_memory; }
+    uint32_t size() const { return m_size; }
+
+    Mode mode() const { return m_mode; }
+
+    PageCount initial() const { return m_initial; }
+    PageCount maximum() const { return m_maximum; }
+
+    bool grow(uint32_t newSize)
+    {
+        ASSERT(m_memory);
+        if (newSize > m_capacity)
+            return false;
+
+        return !mprotect(m_memory, newSize, PROT_READ | PROT_WRITE);
+    }
+
+    static ptrdiff_t offsetOfSize() { return OBJECT_OFFSETOF(Memory, m_size); }
+
+    
+private:
+    void* m_memory { nullptr };
+    Mode m_mode;
+    uint32_t m_size { 0 };
+    uint32_t m_capacity { 0 };
+    PageCount m_initial;
+    PageCount m_maximum;
+    uint64_t m_mappedCapacity { 0 };
+};
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMLY)
diff --git a/wasm/WasmMemoryInformation.cpp b/wasm/WasmMemoryInformation.cpp
new file mode 100644
index 0000000..2e1d30a
--- /dev/null
+++ b/wasm/WasmMemoryInformation.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WasmMemoryInformation.h"
+
+#include "WasmCallingConvention.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+namespace JSC { namespace Wasm {
+
+MemoryInformation::MemoryInformation(PageCount initial, PageCount maximum,  const Vector<unsigned>& pinnedSizeRegisters, bool isImport)
+    : m_initial(initial)
+    , m_maximum(maximum)
+    , m_isImport(isImport)
+{
+    RELEASE_ASSERT(!!m_initial);
+    RELEASE_ASSERT(!m_maximum || m_maximum >= m_initial);
+    ASSERT(!!*this);
+
+    unsigned remainingPinnedRegisters = pinnedSizeRegisters.size() + 1;
+    jscCallingConvention().m_calleeSaveRegisters.forEach([&] (Reg reg) {
+        GPRReg gpr = reg.gpr();
+        if (!remainingPinnedRegisters || RegisterSet::stackRegisters().get(reg))
+            return;
+        if (remainingPinnedRegisters == 1) {
+            m_pinnedRegisters.baseMemoryPointer = gpr;
+            remainingPinnedRegisters--;
+        } else
+            m_pinnedRegisters.sizeRegisters.append({ gpr, pinnedSizeRegisters[--remainingPinnedRegisters - 1] });
+    });
+
+    ASSERT(!remainingPinnedRegisters);
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmMemoryInformation.h b/wasm/WasmMemoryInformation.h
new file mode 100644
index 0000000..ee63d9e
--- /dev/null
+++ b/wasm/WasmMemoryInformation.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "GPRInfo.h"
+#include "WasmPageCount.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace Wasm {
+
+struct PinnedSizeRegisterInfo {
+    GPRReg sizeRegister;
+    unsigned sizeOffset;
+};
+
+// FIXME: We should support more than one memory size register. Right now we take a vector with only one
+// entry. Specifically an entry where the sizeOffset == 0. If we have more than one size register,
+// we can have one for each load size class. see: https://bugs.webkit.org/show_bug.cgi?id=162952
+struct PinnedRegisterInfo {
+    Vector<PinnedSizeRegisterInfo> sizeRegisters;
+    GPRReg baseMemoryPointer;
+};
+
+class MemoryInformation {
+public:
+    MemoryInformation()
+    {
+        ASSERT(!*this);
+    }
+
+    MemoryInformation(PageCount initial, PageCount maximum, const Vector<unsigned>& pinnedSizeRegisters, bool isImport);
+
+    const PinnedRegisterInfo& pinnedRegisters() const { return m_pinnedRegisters; }
+    PageCount initial() const { return m_initial; }
+    PageCount maximum() const { return m_maximum; }
+    bool isImport() const { return m_isImport; }
+
+    explicit operator bool() const { return !!m_initial; }
+
+private:
+    PageCount m_initial { };
+    PageCount m_maximum { };
+    PinnedRegisterInfo m_pinnedRegisters { };
+    bool m_isImport { false };
+};
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WASM)
diff --git a/wasm/WasmModuleParser.cpp b/wasm/WasmModuleParser.cpp
new file mode 100644
index 0000000..f4f76b0
--- /dev/null
+++ b/wasm/WasmModuleParser.cpp
@@ -0,0 +1,611 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WasmModuleParser.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "IdentifierInlines.h"
+#include "JSWebAssemblyTable.h"
+#include "WasmFormat.h"
+#include "WasmMemoryInformation.h"
+#include "WasmOps.h"
+#include "WasmSections.h"
+
+#include <sys/mman.h>
+
+namespace JSC { namespace Wasm {
+
+auto ModuleParser::parse() -> Result
+{
+    m_result.module = std::make_unique<ModuleInformation>();
+    const size_t minSize = 8;
+    uint32_t versionNumber;
+
+    WASM_PARSER_FAIL_IF(length() < minSize, "expected a module of at least ", minSize, " bytes");
+    WASM_PARSER_FAIL_IF(!consumeCharacter(0) || !consumeString("asm"), "modules doesn't start with '\\0asm'");
+    WASM_PARSER_FAIL_IF(!parseUInt32(versionNumber), "can't parse version number");
+    WASM_PARSER_FAIL_IF(versionNumber != expectedVersionNumber, "unexpected version number ", versionNumber, " expected ", expectedVersionNumber);
+
+    Section previousSection = Section::Unknown;
+    while (m_offset < length()) {
+        uint8_t sectionByte;
+
+        WASM_PARSER_FAIL_IF(!parseUInt7(sectionByte), "can't get section byte");
+
+        Section section = Section::Unknown;
+        if (sectionByte) {
+            if (isValidSection(sectionByte))
+                section = static_cast<Section>(sectionByte);
+        }
+
+        uint32_t sectionLength;
+        WASM_PARSER_FAIL_IF(!validateOrder(previousSection, section), "invalid section order, ", previousSection, " followed by ", section);
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(sectionLength), "can't get ", section, " section's length");
+        WASM_PARSER_FAIL_IF(sectionLength > length() - m_offset, section, "section of size ", sectionLength, " would overflow Module's size");
+
+        auto end = m_offset + sectionLength;
+
+        switch (section) {
+#define WASM_SECTION_PARSE(NAME, ID, DESCRIPTION)                   \
+        case Section::NAME: {                                       \
+            WASM_FAIL_IF_HELPER_FAILS(parse ## NAME());             \
+            break;                                                  \
+        }
+        FOR_EACH_WASM_SECTION(WASM_SECTION_PARSE)
+#undef WASM_SECTION_PARSE
+
+        case Section::Unknown: {
+            // Ignore section's name LEB and bytes: they're already included in sectionLength.
+            m_offset += sectionLength;
+            break;
+        }
+        }
+
+        WASM_PARSER_FAIL_IF(end != m_offset, "parsing ended before the end of ", section, " section");
+
+        previousSection = section;
+    }
+
+    return WTFMove(m_result);
+}
+
+auto ModuleParser::parseType() -> PartialResult
+{
+    uint32_t count;
+
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(count), "can't get Type section's count");
+    WASM_PARSER_FAIL_IF(count == std::numeric_limits<uint32_t>::max(), "Type section's count is too big ", count);
+    WASM_PARSER_FAIL_IF(!m_result.module->signatures.tryReserveCapacity(count), "can't allocate enough memory for Type section's ", count, " entries");
+
+    for (uint32_t i = 0; i < count; ++i) {
+        int8_t type;
+        uint32_t argumentCount;
+        Vector<Type> argumentTypes;
+
+        WASM_PARSER_FAIL_IF(!parseInt7(type), "can't get ", i, "th Type's type");
+        WASM_PARSER_FAIL_IF(type != Func, i, "th Type is non-Func ", type);
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(argumentCount), "can't get ", i, "th Type's argument count");
+        WASM_PARSER_FAIL_IF(argumentCount == std::numeric_limits<uint32_t>::max(), i, "th argument count is too big ", argumentCount);
+        WASM_PARSER_FAIL_IF(!argumentTypes.tryReserveCapacity(argumentCount), "can't allocate enough memory for Type section's ", i, "th ", argumentCount, " arguments");
+
+        for (unsigned i = 0; i < argumentCount; ++i) {
+            Type argumentType;
+            WASM_PARSER_FAIL_IF(!parseResultType(argumentType), "can't get ", i, "th argument Type");
+            argumentTypes.uncheckedAppend(argumentType);
+        }
+
+        uint8_t returnCount;
+        WASM_PARSER_FAIL_IF(!parseVarUInt1(returnCount), "can't get ", i, "th Type's return count");
+        Type returnType;
+
+        if (returnCount) {
+            Type value;
+            WASM_PARSER_FAIL_IF(!parseValueType(value), "can't get ", i, "th Type's return value");
+            returnType = static_cast<Type>(value);
+        } else
+            returnType = Type::Void;
+
+        m_result.module->signatures.uncheckedAppend({ returnType, WTFMove(argumentTypes) });
+    }
+    return { };
+}
+
+auto ModuleParser::parseImport() -> PartialResult
+{
+    uint32_t importCount;
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(importCount), "can't get Import section's count");
+    WASM_PARSER_FAIL_IF(importCount == std::numeric_limits<uint32_t>::max(), "Import section's count is too big ", importCount);
+    WASM_PARSER_FAIL_IF(!m_result.module->globals.tryReserveCapacity(importCount), "can't allocate enough memory for ", importCount, " globals"); // FIXME this over-allocates when we fix the FIXMEs below.
+    WASM_PARSER_FAIL_IF(!m_result.module->imports.tryReserveCapacity(importCount), "can't allocate enough memory for ", importCount, " imports"); // FIXME this over-allocates when we fix the FIXMEs below.
+    WASM_PARSER_FAIL_IF(!m_result.module->importFunctions.tryReserveCapacity(importCount), "can't allocate enough memory for ", importCount, " import functions"); // FIXME this over-allocates when we fix the FIXMEs below.
+    WASM_PARSER_FAIL_IF(!m_result.functionIndexSpace.tryReserveCapacity(importCount), "can't allocate enough memory for ", importCount, " functions in the index space"); // FIXME this over-allocates when we fix the FIXMEs below. We'll allocate some more here when we know how many functions to expect.
+
+    for (uint32_t importNumber = 0; importNumber < importCount; ++importNumber) {
+        Import imp;
+        uint32_t moduleLen;
+        uint32_t fieldLen;
+        String moduleString;
+        String fieldString;
+
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(moduleLen), "can't get ", importNumber, "th Import's module name length");
+        WASM_PARSER_FAIL_IF(!consumeUTF8String(moduleString, moduleLen), "can't get ", importNumber, "th Import's module name of length ", moduleLen);
+        imp.module = Identifier::fromString(m_vm, moduleString);
+
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(fieldLen), "can't get ", importNumber, "th Import's field name length in module '", moduleString, "'");
+        WASM_PARSER_FAIL_IF(!consumeUTF8String(fieldString, fieldLen), "can't get ", importNumber, "th Import's field name of length ", moduleLen, " in module '", moduleString, "'");
+        imp.field = Identifier::fromString(m_vm, fieldString);
+
+        WASM_PARSER_FAIL_IF(!parseExternalKind(imp.kind), "can't get ", importNumber, "th Import's kind in module '", moduleString, "' field '", fieldString, "'");
+        switch (imp.kind) {
+        case ExternalKind::Function: {
+            uint32_t functionSignatureIndex;
+            WASM_PARSER_FAIL_IF(!parseVarUInt32(functionSignatureIndex), "can't get ", importNumber, "th Import's function signature in module '", moduleString, "' field '", fieldString, "'");
+            WASM_PARSER_FAIL_IF(functionSignatureIndex >= m_result.module->signatures.size(), "invalid function signature for ", importNumber, "th Import, ", functionSignatureIndex, " is out of range of ", m_result.module->signatures.size(), " in module '", moduleString, "' field '", fieldString, "'");
+            imp.kindIndex = m_result.module->importFunctions.size();
+            Signature* signature = &m_result.module->signatures[functionSignatureIndex];
+            m_result.module->importFunctions.uncheckedAppend(signature);
+            m_result.functionIndexSpace.uncheckedAppend(signature);
+            break;
+        }
+        case ExternalKind::Table: {
+            bool isImport = true;
+            PartialResult result = parseTableHelper(isImport);
+            if (UNLIKELY(!result))
+                return result.getUnexpected();
+            break;
+        }
+        case ExternalKind::Memory: {
+            bool isImport = true;
+            PartialResult result = parseMemoryHelper(isImport);
+            if (UNLIKELY(!result))
+                return result.getUnexpected();
+            break;
+        }
+        case ExternalKind::Global: {
+            Global global;
+            WASM_FAIL_IF_HELPER_FAILS(parseGlobalType(global));
+            WASM_PARSER_FAIL_IF(global.mutability == Global::Mutable, "Mutable Globals aren't supported");
+
+            imp.kindIndex = m_result.module->globals.size();
+            m_result.module->globals.uncheckedAppend(WTFMove(global));
+            break;
+        }
+        }
+
+        m_result.module->imports.uncheckedAppend(imp);
+    }
+
+    m_result.module->firstInternalGlobal = m_result.module->globals.size();
+    return { };
+}
+
+auto ModuleParser::parseFunction() -> PartialResult
+{
+    uint32_t count;
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(count), "can't get Function section's count");
+    WASM_PARSER_FAIL_IF(count == std::numeric_limits<uint32_t>::max(), "Function section's count is too big ", count);
+    WASM_PARSER_FAIL_IF(!m_result.module->internalFunctionSignatures.tryReserveCapacity(count), "can't allocate enough memory for ", count, " Function signatures");
+    WASM_PARSER_FAIL_IF(!m_result.functionLocationInBinary.tryReserveCapacity(count), "can't allocate enough memory for ", count, "Function locations");
+    WASM_PARSER_FAIL_IF(!m_result.functionIndexSpace.tryReserveCapacity(m_result.functionIndexSpace.size() + count), "can't allocate enough memory for ", count, " more functions in the function index space");
+
+    for (uint32_t i = 0; i < count; ++i) {
+        uint32_t typeNumber;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(typeNumber), "can't get ", i, "th Function's type number");
+        WASM_PARSER_FAIL_IF(typeNumber >= m_result.module->signatures.size(), i, "th Function type number is invalid ", typeNumber);
+
+        Signature* signature = &m_result.module->signatures[typeNumber];
+        // The Code section fixes up start and end.
+        size_t start = 0;
+        size_t end = 0;
+        m_result.module->internalFunctionSignatures.uncheckedAppend(signature);
+        m_result.functionLocationInBinary.uncheckedAppend({ start, end });
+        m_result.functionIndexSpace.uncheckedAppend(signature);
+    }
+
+    return { };
+}
+
+auto ModuleParser::parseResizableLimits(uint32_t& initial, std::optional<uint32_t>& maximum) -> PartialResult
+{
+    ASSERT(!maximum);
+
+    uint8_t flags;
+    WASM_PARSER_FAIL_IF(!parseVarUInt1(flags), "can't parse resizable limits flags");
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(initial), "can't parse resizable limits initial page count");
+
+    if (flags) {
+        uint32_t maximumInt;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(maximumInt), "can't parse resizable limits maximum page count");
+        WASM_PARSER_FAIL_IF(initial > maximumInt, "resizable limits has a initial page count of ", initial, " which is greater than its maximum ", maximumInt);
+        maximum = maximumInt;
+    }
+
+    return { };
+}
+
+auto ModuleParser::parseTableHelper(bool isImport) -> PartialResult
+{
+    WASM_PARSER_FAIL_IF(m_hasTable, "Table section cannot exist if an Import has a table");
+
+    m_hasTable = true;
+
+    int8_t type;
+    WASM_PARSER_FAIL_IF(!parseInt7(type), "can't parse Table type");
+    WASM_PARSER_FAIL_IF(type != Wasm::Anyfunc, "Table type should be anyfunc, got ", type);
+
+    uint32_t initial;
+    std::optional<uint32_t> maximum;
+    PartialResult limits = parseResizableLimits(initial, maximum);
+    if (UNLIKELY(!limits))
+        return limits.getUnexpected();
+    WASM_PARSER_FAIL_IF(!JSWebAssemblyTable::isValidSize(initial), "Table's initial page count of ", initial, " is invalid");
+
+    ASSERT(!maximum || *maximum >= initial);
+
+    m_result.module->tableInformation = TableInformation(initial, maximum, isImport);
+
+    return { };
+}
+
+auto ModuleParser::parseTable() -> PartialResult
+{
+    uint32_t count;
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(count), "can't get Table's count");
+    WASM_PARSER_FAIL_IF(count != 1, "Table count of ", count, " is invalid, only 1 is allowed for now");
+
+    bool isImport = false;
+    PartialResult result = parseTableHelper(isImport);
+    if (UNLIKELY(!result))
+        return result.getUnexpected();
+
+    return { };
+}
+
+auto ModuleParser::parseMemoryHelper(bool isImport) -> PartialResult
+{
+    WASM_PARSER_FAIL_IF(m_result.module->memory, "Memory section cannot exist if an Import has a memory");
+
+    PageCount initialPageCount;
+    PageCount maximumPageCount;
+    {
+        uint32_t initial;
+        std::optional<uint32_t> maximum;
+        PartialResult limits = parseResizableLimits(initial, maximum);
+        if (UNLIKELY(!limits))
+            return limits.getUnexpected();
+        ASSERT(!maximum || *maximum >= initial);
+        WASM_PARSER_FAIL_IF(!PageCount::isValid(initial), "Memory's initial page count of ", initial, " is invalid");
+
+        initialPageCount = PageCount(initial);
+
+        if (maximum) {
+            WASM_PARSER_FAIL_IF(!PageCount::isValid(*maximum), "Memory's maximum page count of ", *maximum, " is invalid");
+            maximumPageCount = PageCount(*maximum);
+        }
+    }
+    ASSERT(initialPageCount);
+    ASSERT(!maximumPageCount || maximumPageCount >= initialPageCount);
+
+    Vector<unsigned> pinnedSizes = { 0 };
+    m_result.module->memory = MemoryInformation(initialPageCount, maximumPageCount, pinnedSizes, isImport);
+    return { };
+}
+
+auto ModuleParser::parseMemory() -> PartialResult
+{
+    uint8_t count;
+    WASM_PARSER_FAIL_IF(!parseVarUInt1(count), "can't parse Memory section's count");
+
+    if (!count)
+        return { };
+
+    WASM_PARSER_FAIL_IF(count != 1, "Memory section has more than one memory, WebAssembly currently only allows zero or one");
+
+    bool isImport = false;
+    return parseMemoryHelper(isImport);
+}
+
+auto ModuleParser::parseGlobal() -> PartialResult
+{
+    uint32_t globalCount;
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(globalCount), "can't get Global section's count");
+    WASM_PARSER_FAIL_IF(!m_result.module->globals.tryReserveCapacity(globalCount + m_result.module->firstInternalGlobal), "can't allocate memory for ", globalCount + m_result.module->firstInternalGlobal, " globals");
+
+    for (uint32_t globalIndex = 0; globalIndex < globalCount; ++globalIndex) {
+        Global global;
+        uint8_t initOpcode;
+
+        WASM_FAIL_IF_HELPER_FAILS(parseGlobalType(global));
+        WASM_FAIL_IF_HELPER_FAILS(parseInitExpr(initOpcode, global.initialBitsOrImportNumber));
+
+        global.initializationType = Global::FromExpression;
+        Type typeForInitOpcode;
+        switch (initOpcode) {
+        case I32Const:
+            typeForInitOpcode = I32;
+            break;
+        case I64Const:
+            typeForInitOpcode = I64;
+            break;
+        case F32Const:
+            typeForInitOpcode = F32;
+            break;
+        case F64Const:
+            typeForInitOpcode = F64;
+            break;
+        case GetGlobal:
+            WASM_PARSER_FAIL_IF(global.initialBitsOrImportNumber >= m_result.module->firstInternalGlobal, globalIndex, "th Global uses get_global ", global.initialBitsOrImportNumber, " which exceeds the first internal global ", m_result.module->firstInternalGlobal);
+            typeForInitOpcode = m_result.module->globals[global.initialBitsOrImportNumber].type;
+            global.initializationType = Global::FromGlobalImport;
+            break;
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        WASM_PARSER_FAIL_IF(typeForInitOpcode != global.type, "Global init_expr opcode of type ", typeForInitOpcode, " doesn't match global's type ", global.type);
+
+        m_result.module->globals.uncheckedAppend(WTFMove(global));
+    }
+
+    return { };
+}
+
+auto ModuleParser::parseExport() -> PartialResult
+{
+    uint32_t exportCount;
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(exportCount), "can't get Export section's count");
+    WASM_PARSER_FAIL_IF(exportCount == std::numeric_limits<uint32_t>::max(), "Export section's count is too big ", exportCount);
+    WASM_PARSER_FAIL_IF(!m_result.module->exports.tryReserveCapacity(exportCount), "can't allocate enough memory for ", exportCount, " exports");
+
+    for (uint32_t exportNumber = 0; exportNumber < exportCount; ++exportNumber) {
+        Export exp;
+        uint32_t fieldLen;
+        String fieldString;
+
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(fieldLen), "can't get ", exportNumber, "th Export's field name length");
+        WASM_PARSER_FAIL_IF(!consumeUTF8String(fieldString, fieldLen), "can't get ", exportNumber, "th Export's field name of length ", fieldLen);
+        exp.field = Identifier::fromString(m_vm, fieldString);
+
+        WASM_PARSER_FAIL_IF(!parseExternalKind(exp.kind), "can't get ", exportNumber, "th Export's kind, named '", fieldString, "'");
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(exp.kindIndex), "can't get ", exportNumber, "th Export's kind index, named '", fieldString, "'");
+        switch (exp.kind) {
+        case ExternalKind::Function: {
+            WASM_PARSER_FAIL_IF(exp.kindIndex >= m_result.functionIndexSpace.size(), exportNumber, "th Export has invalid function number ", exp.kindIndex, " it exceeds the function index space ", m_result.functionIndexSpace.size(), ", named '", fieldString, "'");
+            break;
+        }
+        case ExternalKind::Table: {
+            WASM_PARSER_FAIL_IF(!m_hasTable, "can't export a non-existent Table");
+            WASM_PARSER_FAIL_IF(exp.kindIndex, "can't export Table ", exp.kindIndex, " only zero-index Table is currently supported");
+            break;
+        }
+        case ExternalKind::Memory: {
+            WASM_PARSER_FAIL_IF(!m_result.module->memory, "can't export a non-existent Memory");
+            WASM_PARSER_FAIL_IF(exp.kindIndex, "can't export Memory ", exp.kindIndex, " only one Table is currently supported");
+            break;
+        }
+        case ExternalKind::Global: {
+            WASM_PARSER_FAIL_IF(exp.kindIndex >= m_result.module->globals.size(), exportNumber, "th Export has invalid global number ", exp.kindIndex, " it exceeds the globals count ", m_result.module->globals.size(), ", named '", fieldString, "'");
+            WASM_PARSER_FAIL_IF(m_result.module->globals[exp.kindIndex].mutability != Global::Immutable, exportNumber, "th Export isn't immutable, named '", fieldString, "'");
+            break;
+        }
+        }
+
+        m_result.module->exports.uncheckedAppend(exp);
+    }
+
+    return { };
+}
+
+auto ModuleParser::parseStart() -> PartialResult
+{
+    uint32_t startFunctionIndex;
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(startFunctionIndex), "can't get Start index");
+    WASM_PARSER_FAIL_IF(startFunctionIndex >= m_result.functionIndexSpace.size(), "Start index ", startFunctionIndex, " exceeds function index space ", m_result.functionIndexSpace.size());
+    Signature* signature = m_result.functionIndexSpace[startFunctionIndex].signature;
+    WASM_PARSER_FAIL_IF(!signature->arguments.isEmpty(), "Start function can't have arguments");
+    WASM_PARSER_FAIL_IF(signature->returnType != Void, "Start function can't return a value");
+    m_result.module->startFunctionIndexSpace = startFunctionIndex;
+    return { };
+}
+
+auto ModuleParser::parseElement() -> PartialResult
+{
+    WASM_PARSER_FAIL_IF(!m_hasTable, "Element section expects a Table to be present");
+
+    uint32_t elementCount;
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(elementCount), "can't get Element section's count");
+    WASM_PARSER_FAIL_IF(elementCount == std::numeric_limits<uint32_t>::max(), "Element section's count is too big ", elementCount);
+    WASM_PARSER_FAIL_IF(!m_result.module->elements.tryReserveCapacity(elementCount), "can't allocate memory for ", elementCount, " Elements");
+    for (unsigned elementNum = 0; elementNum < elementCount; ++elementNum) {
+        uint32_t tableIndex;
+        uint64_t offset;
+        uint8_t initOpcode;
+        uint32_t indexCount;
+
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(tableIndex), "can't get ", elementNum, "th Element table index");
+        WASM_PARSER_FAIL_IF(tableIndex, "Element section can only have one Table for now");
+        WASM_FAIL_IF_HELPER_FAILS(parseInitExpr(initOpcode, offset));
+        WASM_PARSER_FAIL_IF(initOpcode != OpType::I32Const, "Element section doesn't support non-i32 init_expr opcode for now, got ", initOpcode);
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(indexCount), "can't get ", elementNum, "th index count for Element section");
+        WASM_PARSER_FAIL_IF(indexCount == std::numeric_limits<uint32_t>::max(), "Element section's ", elementNum, "th index count is too big ", indexCount);
+
+        ASSERT(!!m_result.module->tableInformation);
+        if (std::optional<uint32_t> maximum = m_result.module->tableInformation.maximum()) {
+            // FIXME: should indexCount being zero be a validation error?
+            // https://bugs.webkit.org/show_bug.cgi?id=165826
+            if (indexCount) {
+                // FIXME: right now, provably out of bounds writes are validation errors.
+                // Should they be though?
+                // https://bugs.webkit.org/show_bug.cgi?id=165827
+                uint64_t lastWrittenIndex = static_cast<uint64_t>(indexCount) + static_cast<uint64_t>(offset) - 1;
+                WASM_PARSER_FAIL_IF(lastWrittenIndex >= static_cast<uint64_t>(*maximum), "Element section's ", elementNum, "th element writes to index ", lastWrittenIndex, " which exceeds the maximum ", *maximum);
+            }
+        }
+
+        Element element;
+        WASM_PARSER_FAIL_IF(!element.functionIndices.tryReserveCapacity(indexCount), "can't allocate memory for ", indexCount, " Element indices");
+
+        element.offset = offset;
+
+        for (unsigned index = 0; index < indexCount; ++index) {
+            uint32_t functionIndex;
+            WASM_PARSER_FAIL_IF(!parseVarUInt32(functionIndex), "can't get Element section's ", elementNum, "th element's ", index, "th index");
+            WASM_PARSER_FAIL_IF(functionIndex >= m_result.functionIndexSpace.size(), "Element section's ", elementNum, "th element's ", index, "th index is ", functionIndex, " which exceeds the function index space size of ", m_result.functionIndexSpace.size());
+
+            element.functionIndices.uncheckedAppend(functionIndex);
+        }
+
+        m_result.module->elements.uncheckedAppend(WTFMove(element));
+    }
+
+    return { };
+}
+
+auto ModuleParser::parseCode() -> PartialResult
+{
+    uint32_t count;
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(count), "can't get Code section's count");
+    WASM_PARSER_FAIL_IF(count == std::numeric_limits<uint32_t>::max(), "Code section's count is too big ", count);
+    WASM_PARSER_FAIL_IF(count != m_result.functionLocationInBinary.size(), "Code section count ", count, " exceeds the declared number of functions ", m_result.functionLocationInBinary.size());
+
+    for (uint32_t i = 0; i < count; ++i) {
+        uint32_t functionSize;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(functionSize), "can't get ", i, "th Code function's size");
+        WASM_PARSER_FAIL_IF(functionSize > length(), "Code function's size ", functionSize, " exceeds the module's size ", length());
+        WASM_PARSER_FAIL_IF(functionSize > length() - m_offset, "Code function's size ", functionSize, " exceeds the module's remaining size", length() - m_offset);
+
+        m_result.functionLocationInBinary[i].start = m_offset;
+        m_result.functionLocationInBinary[i].end = m_offset + functionSize;
+        m_offset = m_result.functionLocationInBinary[i].end;
+    }
+
+    return { };
+}
+
+auto ModuleParser::parseInitExpr(uint8_t& opcode, uint64_t& bitsOrImportNumber) -> PartialResult
+{
+    WASM_PARSER_FAIL_IF(!parseUInt8(opcode), "can't get init_expr's opcode");
+
+    switch (opcode) {
+    case I32Const: {
+        int32_t constant;
+        WASM_PARSER_FAIL_IF(!parseVarInt32(constant), "can't get constant value for init_expr's i32.const");
+        bitsOrImportNumber = static_cast<uint64_t>(constant);
+        break;
+    }
+
+    case I64Const: {
+        int64_t constant;
+        WASM_PARSER_FAIL_IF(!parseVarInt64(constant), "can't get constant value for init_expr's i64.const");
+        bitsOrImportNumber = constant;
+        break;
+    }
+
+    case F32Const: {
+        uint32_t constant;
+        WASM_PARSER_FAIL_IF(!parseUInt32(constant), "can't get constant value for init_expr's f32.const");
+        bitsOrImportNumber = constant;
+        break;
+    }
+
+    case F64Const: {
+        uint64_t constant;
+        WASM_PARSER_FAIL_IF(!parseUInt64(constant), "can't get constant value for init_expr's f64.const");
+        bitsOrImportNumber = constant;
+        break;
+    }
+
+    case GetGlobal: {
+        uint32_t index;
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get get_global's index");
+        WASM_PARSER_FAIL_IF(index >= m_result.module->imports.size(), "get_global's index ", index, " exceeds the number of imports ", m_result.module->imports.size());
+        const Import& import = m_result.module->imports[index];
+        WASM_PARSER_FAIL_IF(m_result.module->imports[index].kind != ExternalKind::Global, "get_global's import kind is ", m_result.module->imports[index].kind, " should be global");
+        WASM_PARSER_FAIL_IF(import.kindIndex >= m_result.module->firstInternalGlobal, "get_global import kind index ", import.kindIndex, " exceeds the first internal global ", m_result.module->firstInternalGlobal);
+
+        ASSERT(m_result.module->globals[import.kindIndex].mutability == Global::Immutable);
+
+        bitsOrImportNumber = index;
+        break;
+    }
+
+    default:
+        WASM_PARSER_FAIL_IF(false, "unknown init_expr opcode ", opcode);
+    }
+
+    uint8_t endOpcode;
+    WASM_PARSER_FAIL_IF(!parseUInt8(endOpcode), "can't get init_expr's end opcode");
+    WASM_PARSER_FAIL_IF(endOpcode != OpType::End, "init_expr should end with end, ended with ", endOpcode);
+
+    return { };
+}
+
+auto ModuleParser::parseGlobalType(Global& global) -> PartialResult
+{
+    uint8_t mutability;
+    WASM_PARSER_FAIL_IF(!parseValueType(global.type), "can't get Global's value type");
+    WASM_PARSER_FAIL_IF(!parseVarUInt1(mutability), "can't get Global type's mutability");
+    global.mutability = static_cast<Global::Mutability>(mutability);
+    return { };
+}
+
+auto ModuleParser::parseData() -> PartialResult
+{
+    uint32_t segmentCount;
+    WASM_PARSER_FAIL_IF(!m_result.module->memory, "Data section cannot exist without a Memory section or Import");
+    WASM_PARSER_FAIL_IF(!parseVarUInt32(segmentCount), "can't get Data section's count");
+    WASM_PARSER_FAIL_IF(segmentCount == std::numeric_limits<uint32_t>::max(), "Data section's count is too big ", segmentCount);
+    WASM_PARSER_FAIL_IF(!m_result.module->data.tryReserveCapacity(segmentCount), "can't allocate enough memory for Data section's ", segmentCount, " segments");
+
+    for (uint32_t segmentNumber = 0; segmentNumber < segmentCount; ++segmentNumber) {
+        uint32_t index;
+        uint64_t offset;
+        uint8_t initOpcode;
+        uint32_t dataByteLength;
+
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get ", segmentNumber, "th Data segment's index");
+        WASM_PARSER_FAIL_IF(index, segmentNumber, "th Data segment has non-zero index ", index);
+        WASM_FAIL_IF_HELPER_FAILS(parseInitExpr(initOpcode, offset));
+        WASM_PARSER_FAIL_IF(initOpcode != OpType::I32Const, segmentNumber, "th Data segment has opcode ", initOpcode, " expected i32.const");
+        WASM_PARSER_FAIL_IF(!parseVarUInt32(dataByteLength), "can't get ", segmentNumber, "th Data segment's data byte length");
+        WASM_PARSER_FAIL_IF(dataByteLength == std::numeric_limits<uint32_t>::max(), segmentNumber, "th Data segment's data byte length is too big ", dataByteLength);
+
+        Segment* segment = Segment::make(offset, dataByteLength);
+        WASM_PARSER_FAIL_IF(!segment, "can't allocate enough memory for ", segmentNumber, "th Data segment of size ", dataByteLength);
+        m_result.module->data.uncheckedAppend(Segment::makePtr(segment));
+        for (uint32_t dataByte = 0; dataByte < dataByteLength; ++dataByte) {
+            uint8_t byte;
+            WASM_PARSER_FAIL_IF(!parseUInt8(byte), "can't get ", dataByte, "th data byte from ", segmentNumber, "th Data segment");
+            segment->byte(dataByte) = byte;
+        }
+    }
+    return { };
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmModuleParser.h b/wasm/WasmModuleParser.h
new file mode 100644
index 0000000..6a2436e
--- /dev/null
+++ b/wasm/WasmModuleParser.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "WasmFormat.h"
+#include "WasmOps.h"
+#include "WasmParser.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace Wasm {
+
+struct ModuleParserResult {
+    std::unique_ptr<ModuleInformation> module;
+    FunctionIndexSpace functionIndexSpace;
+    Vector<FunctionLocationInBinary> functionLocationInBinary;
+};
+
+class ModuleParser : public Parser<ModuleParserResult> {
+public:
+
+    ModuleParser(VM* vm, const uint8_t* sourceBuffer, size_t sourceLength)
+        : Parser(sourceBuffer, sourceLength)
+        , m_vm(vm)
+    {
+    }
+    ModuleParser(VM* vm, const Vector<uint8_t>& sourceBuffer)
+        : ModuleParser(vm, sourceBuffer.data(), sourceBuffer.size())
+    {
+    }
+
+    Result WARN_UNUSED_RETURN parse();
+
+private:
+
+#define WASM_SECTION_DECLARE_PARSER(NAME, ID, DESCRIPTION) PartialResult WARN_UNUSED_RETURN parse ## NAME();
+    FOR_EACH_WASM_SECTION(WASM_SECTION_DECLARE_PARSER)
+#undef WASM_SECTION_DECLARE_PARSER
+
+    PartialResult WARN_UNUSED_RETURN parseGlobalType(Global&);
+    PartialResult WARN_UNUSED_RETURN parseMemoryHelper(bool isImport);
+    PartialResult WARN_UNUSED_RETURN parseTableHelper(bool isImport);
+    PartialResult WARN_UNUSED_RETURN parseResizableLimits(uint32_t& initial, std::optional<uint32_t>& maximum);
+    PartialResult WARN_UNUSED_RETURN parseInitExpr(uint8_t&, uint64_t&);
+
+    VM* m_vm;
+    ModuleParserResult m_result;
+    bool m_hasTable { false };
+};
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmPageCount.h b/wasm/WasmPageCount.h
new file mode 100644
index 0000000..6a0668f
--- /dev/null
+++ b/wasm/WasmPageCount.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+namespace JSC { namespace Wasm {
+
+class PageCount {
+
+public:
+    PageCount()
+        : m_pageCount(UINT_MAX)
+    {
+        static_assert(maxPageCount < UINT_MAX, "We rely on this here.");
+    }
+
+    PageCount(uint32_t pageCount)
+        : m_pageCount(pageCount)
+    { }
+
+    size_t bytes() { return m_pageCount * pageSize; }
+
+    static bool isValid(uint32_t pageCount)
+    {
+        return pageCount <= maxPageCount;
+    }
+
+    static PageCount max()
+    {
+        return PageCount(maxPageCount);
+    }
+
+    explicit operator bool() const
+    {
+        return m_pageCount != UINT_MAX;
+    }
+
+    bool operator<(const PageCount& other) const { return m_pageCount < other.m_pageCount; }
+    bool operator>(const PageCount& other) const { return m_pageCount > other.m_pageCount; }
+    bool operator>=(const PageCount& other) const { return m_pageCount >= other.m_pageCount; }
+
+private:
+    static constexpr uint32_t pageSize = 64 * KB;
+    static constexpr uint32_t maxPageCount = static_cast<uint32_t>((1ull << 32) / pageSize);
+
+    uint32_t m_pageCount;
+};
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WASM)
diff --git a/wasm/WasmParser.h b/wasm/WasmParser.h
new file mode 100644
index 0000000..d6ae8c5
--- /dev/null
+++ b/wasm/WasmParser.h
@@ -0,0 +1,272 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "B3Compilation.h"
+#include "B3Procedure.h"
+#include "WasmFormat.h"
+#include "WasmOps.h"
+#include "WasmSections.h"
+#include <type_traits>
+#include <wtf/Expected.h>
+#include <wtf/LEBDecoder.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC { namespace Wasm {
+
+namespace FailureHelper {
+// FIXME We should move this to makeString. It's in its own namespace to enable C++ Argument Dependent Lookup à la std::swap: user code can deblare its own "boxFailure" and the fail() helper will find it.
+static inline auto makeString(const char *failure) { return ASCIILiteral(failure); }
+template <typename Int, typename = typename std::enable_if<std::is_integral<Int>::value>::type>
+static inline auto makeString(Int failure) { return String::number(failure); }
+}
+
+template<typename SuccessType>
+class Parser {
+public:
+    typedef String ErrorType;
+    typedef UnexpectedType<ErrorType> UnexpectedResult;
+    typedef Expected<void, ErrorType> PartialResult;
+    typedef Expected<SuccessType, ErrorType> Result;
+
+protected:
+    Parser(const uint8_t*, size_t);
+
+    bool WARN_UNUSED_RETURN consumeCharacter(char);
+    bool WARN_UNUSED_RETURN consumeString(const char*);
+    bool WARN_UNUSED_RETURN consumeUTF8String(String&, size_t);
+
+    bool WARN_UNUSED_RETURN parseVarUInt1(uint8_t&);
+    bool WARN_UNUSED_RETURN parseInt7(int8_t&);
+    bool WARN_UNUSED_RETURN parseUInt7(uint8_t&);
+    bool WARN_UNUSED_RETURN parseUInt8(uint8_t&);
+    bool WARN_UNUSED_RETURN parseUInt32(uint32_t&);
+    bool WARN_UNUSED_RETURN parseUInt64(uint64_t&);
+    bool WARN_UNUSED_RETURN parseVarUInt32(uint32_t&);
+    bool WARN_UNUSED_RETURN parseVarUInt64(uint64_t&);
+
+    bool WARN_UNUSED_RETURN parseVarInt32(int32_t&);
+    bool WARN_UNUSED_RETURN parseVarInt64(int64_t&);
+
+    bool WARN_UNUSED_RETURN parseResultType(Type&);
+    bool WARN_UNUSED_RETURN parseValueType(Type&);
+    bool WARN_UNUSED_RETURN parseExternalKind(ExternalKind&);
+
+    const uint8_t* source() const { return m_source; }
+    size_t length() const { return m_sourceLength; }
+
+    size_t m_offset = 0;
+
+    template <typename ...Args>
+    NEVER_INLINE UnexpectedResult WARN_UNUSED_RETURN fail(Args... args) const
+    {
+        using namespace FailureHelper; // See ADL comment in namespace above.
+        return UnexpectedResult(makeString(ASCIILiteral("WebAssembly.Module doesn't parse at byte "), String::number(m_offset), ASCIILiteral(" / "), String::number(m_sourceLength), ASCIILiteral(": "), makeString(args)...));
+    }
+#define WASM_PARSER_FAIL_IF(condition, ...) do { \
+    if (UNLIKELY(condition))                     \
+        return fail(__VA_ARGS__);                \
+    } while (0)
+
+#define WASM_FAIL_IF_HELPER_FAILS(helper) do {   \
+        auto helperResult = helper;              \
+        if (UNLIKELY(!helperResult))             \
+            return helperResult.getUnexpected(); \
+    } while (0)
+
+private:
+    const uint8_t* m_source;
+    size_t m_sourceLength;
+};
+
+template<typename SuccessType>
+ALWAYS_INLINE Parser<SuccessType>::Parser(const uint8_t* sourceBuffer, size_t sourceLength)
+    : m_source(sourceBuffer)
+    , m_sourceLength(sourceLength)
+{
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::consumeCharacter(char c)
+{
+    if (m_offset >= length())
+        return false;
+    if (c == source()[m_offset]) {
+        m_offset++;
+        return true;
+    }
+    return false;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::consumeString(const char* str)
+{
+    unsigned start = m_offset;
+    if (m_offset >= length())
+        return false;
+    for (size_t i = 0; str[i]; i++) {
+        if (!consumeCharacter(str[i])) {
+            m_offset = start;
+            return false;
+        }
+    }
+    return true;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::consumeUTF8String(String& result, size_t stringLength)
+{
+    if (stringLength == 0) {
+        result = emptyString();
+        return true;
+    }
+    if (length() < stringLength || m_offset > length() - stringLength)
+        return false;
+    result = String::fromUTF8(static_cast<const LChar*>(&source()[m_offset]), stringLength);
+    m_offset += stringLength;
+    if (result.isEmpty())
+        return false;
+    return true;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseVarUInt32(uint32_t& result)
+{
+    return WTF::LEBDecoder::decodeUInt32(m_source, m_sourceLength, m_offset, result);
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseVarUInt64(uint64_t& result)
+{
+    return WTF::LEBDecoder::decodeUInt64(m_source, m_sourceLength, m_offset, result);
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseVarInt32(int32_t& result)
+{
+    return WTF::LEBDecoder::decodeInt32(m_source, m_sourceLength, m_offset, result);
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseVarInt64(int64_t& result)
+{
+    return WTF::LEBDecoder::decodeInt64(m_source, m_sourceLength, m_offset, result);
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseUInt32(uint32_t& result)
+{
+    if (length() < 4 || m_offset > length() - 4)
+        return false;
+    result = *reinterpret_cast<const uint32_t*>(source() + m_offset);
+    m_offset += 4;
+    return true;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseUInt64(uint64_t& result)
+{
+    if (length() < 8 || m_offset > length() - 8)
+        return false;
+    result = *reinterpret_cast<const uint64_t*>(source() + m_offset);
+    m_offset += 8;
+    return true;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseUInt8(uint8_t& result)
+{
+    if (m_offset >= length())
+        return false;
+    result = source()[m_offset++];
+    return true;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseInt7(int8_t& result)
+{
+    if (m_offset >= length())
+        return false;
+    uint8_t v = source()[m_offset++];
+    result = (v & 0x40) ? WTF::bitwise_cast<int8_t>(uint8_t(v | 0x80)) : v;
+    return (v & 0x80) == 0;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseUInt7(uint8_t& result)
+{
+    if (m_offset >= length())
+        return false;
+    result = source()[m_offset++];
+    return result < 0x80;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseVarUInt1(uint8_t& result)
+{
+    uint32_t temp;
+    if (!parseVarUInt32(temp))
+        return false;
+    result = static_cast<uint8_t>(temp);
+    return temp <= 1;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseResultType(Type& result)
+{
+    int8_t value;
+    if (!parseInt7(value))
+        return false;
+    if (!isValidType(value))
+        return false;
+    result = static_cast<Type>(value);
+    return true;
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseValueType(Type& result)
+{
+    return parseResultType(result) && isValueType(result);
+}
+
+template<typename SuccessType>
+ALWAYS_INLINE bool Parser<SuccessType>::parseExternalKind(ExternalKind& result)
+{
+    uint8_t value;
+    if (!parseUInt7(value))
+        return false;
+    if (!isValidExternalKind(value))
+        return false;
+    result = static_cast<ExternalKind>(value);
+    return true;
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmPlan.cpp b/wasm/WasmPlan.cpp
new file mode 100644
index 0000000..1c0e019
--- /dev/null
+++ b/wasm/WasmPlan.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WasmPlan.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "B3Compilation.h"
+#include "JSCInlines.h"
+#include "JSGlobalObject.h"
+#include "JSWebAssemblyCallee.h"
+#include "WasmB3IRGenerator.h"
+#include "WasmBinding.h"
+#include "WasmCallingConvention.h"
+#include "WasmMemory.h"
+#include "WasmModuleParser.h"
+#include "WasmValidate.h"
+#include <wtf/DataLog.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC { namespace Wasm {
+
+static const bool verbose = false;
+    
+Plan::Plan(VM* vm, Vector<uint8_t> source)
+    : Plan(vm, source.data(), source.size())
+{
+}
+
+Plan::Plan(VM* vm, const uint8_t* source, size_t sourceLength)
+    : m_vm(vm)
+    , m_source(source)
+    , m_sourceLength(sourceLength)
+{
+}
+
+void Plan::run()
+{
+    {
+        ModuleParser moduleParser(m_vm, m_source, m_sourceLength);
+        auto parseResult = moduleParser.parse();
+        if (!parseResult) {
+            m_errorMessage = parseResult.error();
+            return; // FIXME return an Expected.
+        }
+        m_moduleInformation = WTFMove(parseResult->module);
+        m_functionLocationInBinary = WTFMove(parseResult->functionLocationInBinary);
+        m_functionIndexSpace.size = parseResult->functionIndexSpace.size();
+        m_functionIndexSpace.buffer = parseResult->functionIndexSpace.releaseBuffer();
+    }
+
+    auto tryReserveCapacity = [this] (auto& vector, size_t size, const char* what) {
+        if (UNLIKELY(!vector.tryReserveCapacity(size))) {
+            StringBuilder builder;
+            builder.appendLiteral("Failed allocating enough space for ");
+            builder.appendNumber(size);
+            builder.append(what);
+            m_errorMessage = builder.toString();
+            return false;
+        }
+        return true;
+    };
+    Vector<Vector<UnlinkedWasmToWasmCall>> unlinkedWasmToWasmCalls;
+    if (!tryReserveCapacity(m_wasmToJSStubs, m_moduleInformation->importFunctions.size(), " WebAssembly to JavaScript stubs")
+        || !tryReserveCapacity(unlinkedWasmToWasmCalls, m_functionLocationInBinary.size(), " unlinked WebAssembly to WebAssembly calls")
+        || !tryReserveCapacity(m_wasmInternalFunctions, m_functionLocationInBinary.size(), " WebAssembly functions"))
+        return;
+
+    for (unsigned importIndex = 0; importIndex < m_moduleInformation->imports.size(); ++importIndex) {
+        Import* import = &m_moduleInformation->imports[importIndex];
+        if (import->kind != ExternalKind::Function)
+            continue;
+        unsigned importFunctionIndex = m_wasmToJSStubs.size();
+        if (verbose)
+            dataLogLn("Processing import function number ", importFunctionIndex, ": ", import->module, ": ", import->field);
+        Signature* signature = m_moduleInformation->importFunctions.at(import->kindIndex);
+        m_wasmToJSStubs.uncheckedAppend(importStubGenerator(m_vm, m_callLinkInfos, signature, importFunctionIndex));
+        m_functionIndexSpace.buffer.get()[importFunctionIndex].code = m_wasmToJSStubs[importFunctionIndex].code().executableAddress();
+    }
+
+    for (unsigned functionIndex = 0; functionIndex < m_functionLocationInBinary.size(); ++functionIndex) {
+        if (verbose)
+            dataLogLn("Processing function starting at: ", m_functionLocationInBinary[functionIndex].start, " and ending at: ", m_functionLocationInBinary[functionIndex].end);
+        const uint8_t* functionStart = m_source + m_functionLocationInBinary[functionIndex].start;
+        size_t functionLength = m_functionLocationInBinary[functionIndex].end - m_functionLocationInBinary[functionIndex].start;
+        ASSERT(functionLength <= m_sourceLength);
+        Signature* signature = m_moduleInformation->internalFunctionSignatures[functionIndex];
+        unsigned functionIndexSpace = m_wasmToJSStubs.size() + functionIndex;
+        ASSERT(m_functionIndexSpace.buffer.get()[functionIndexSpace].signature == signature);
+
+        auto validateResult = validateFunction(functionStart, functionLength, signature, m_functionIndexSpace, *m_moduleInformation);
+        if (!validateResult) {
+            if (verbose) {
+                for (unsigned i = 0; i < functionLength; ++i)
+                    dataLog(RawPointer(reinterpret_cast<void*>(functionStart[i])), ", ");
+                dataLogLn();
+            }
+            m_errorMessage = validateResult.error(); // FIXME make this an Expected.
+            return;
+        }
+
+        unlinkedWasmToWasmCalls.uncheckedAppend(Vector<UnlinkedWasmToWasmCall>());
+        auto parseAndCompileResult = parseAndCompile(*m_vm, functionStart, functionLength, signature, unlinkedWasmToWasmCalls.at(functionIndex), m_functionIndexSpace, *m_moduleInformation);
+        if (UNLIKELY(!parseAndCompileResult)) {
+            m_errorMessage = parseAndCompileResult.error();
+            return; // FIXME make this an Expected.
+        }
+        m_wasmInternalFunctions.uncheckedAppend(WTFMove(*parseAndCompileResult));
+        m_functionIndexSpace.buffer.get()[functionIndexSpace].code = m_wasmInternalFunctions[functionIndex]->wasmEntrypoint.compilation->code().executableAddress();
+    }
+
+    // Patch the call sites for each WebAssembly function.
+    for (auto& unlinked : unlinkedWasmToWasmCalls) {
+        for (auto& call : unlinked)
+            MacroAssembler::repatchCall(call.callLocation, CodeLocationLabel(m_functionIndexSpace.buffer.get()[call.functionIndex].code));
+    }
+
+    m_failed = false;
+}
+
+void Plan::initializeCallees(JSGlobalObject* globalObject, std::function<void(unsigned, JSWebAssemblyCallee*, JSWebAssemblyCallee*)> callback)
+{
+    ASSERT(!failed());
+    for (unsigned internalFunctionIndex = 0; internalFunctionIndex < m_wasmInternalFunctions.size(); ++internalFunctionIndex) {
+        WasmInternalFunction* function = m_wasmInternalFunctions[internalFunctionIndex].get();
+
+        JSWebAssemblyCallee* jsEntrypointCallee = JSWebAssemblyCallee::create(globalObject->vm(), WTFMove(function->jsToWasmEntrypoint));
+        MacroAssembler::repatchPointer(function->jsToWasmCalleeMoveLocation, jsEntrypointCallee);
+
+        JSWebAssemblyCallee* wasmEntrypointCallee = JSWebAssemblyCallee::create(globalObject->vm(), WTFMove(function->wasmEntrypoint));
+        MacroAssembler::repatchPointer(function->wasmCalleeMoveLocation, wasmEntrypointCallee);
+
+        callback(internalFunctionIndex, jsEntrypointCallee, wasmEntrypointCallee);
+    }
+}
+
+Plan::~Plan() { }
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmPlan.h b/wasm/WasmPlan.h
new file mode 100644
index 0000000..2aedebd
--- /dev/null
+++ b/wasm/WasmPlan.h
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "CompilationResult.h"
+#include "VM.h"
+#include "WasmFormat.h"
+#include <wtf/Bag.h>
+#include <wtf/ThreadSafeRefCounted.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class CallLinkInfo;
+class JSGlobalObject;
+class JSWebAssemblyCallee;
+
+namespace Wasm {
+
+class Plan {
+public:
+    JS_EXPORT_PRIVATE Plan(VM*, Vector<uint8_t>);
+    JS_EXPORT_PRIVATE Plan(VM*, const uint8_t*, size_t);
+    JS_EXPORT_PRIVATE ~Plan();
+
+    JS_EXPORT_PRIVATE void run();
+
+    JS_EXPORT_PRIVATE void initializeCallees(JSGlobalObject*, std::function<void(unsigned, JSWebAssemblyCallee*, JSWebAssemblyCallee*)>);
+
+    bool WARN_UNUSED_RETURN failed() const { return m_failed; }
+    const String& errorMessage() const
+    {
+        RELEASE_ASSERT(failed());
+        return m_errorMessage;
+    }
+
+    Vector<Export>& exports() const
+    {
+        RELEASE_ASSERT(!failed());
+        return m_moduleInformation->exports;
+    }
+
+    size_t internalFunctionCount() const
+    {
+        RELEASE_ASSERT(!failed());
+        return m_wasmInternalFunctions.size();
+    }
+
+    std::unique_ptr<ModuleInformation>&& takeModuleInformation()
+    {
+        RELEASE_ASSERT(!failed());
+        return WTFMove(m_moduleInformation);
+    }
+
+    Bag<CallLinkInfo>&& takeCallLinkInfos()
+    {
+        RELEASE_ASSERT(!failed());
+        return WTFMove(m_callLinkInfos);
+    }
+
+    Vector<WasmToJSStub>&& takeWasmToJSStubs()
+    {
+        RELEASE_ASSERT(!failed());
+        return WTFMove(m_wasmToJSStubs);
+    }
+
+    ImmutableFunctionIndexSpace&& takeFunctionIndexSpace()
+    {
+        RELEASE_ASSERT(!failed());
+        return WTFMove(m_functionIndexSpace);
+    }
+
+private:
+    std::unique_ptr<ModuleInformation> m_moduleInformation;
+    Vector<FunctionLocationInBinary> m_functionLocationInBinary;
+    Bag<CallLinkInfo> m_callLinkInfos;
+    Vector<WasmToJSStub> m_wasmToJSStubs;
+    Vector<std::unique_ptr<WasmInternalFunction>> m_wasmInternalFunctions;
+    ImmutableFunctionIndexSpace m_functionIndexSpace;
+
+    VM* m_vm;
+    const uint8_t* m_source;
+    const size_t m_sourceLength;
+    bool m_failed { true };
+    String m_errorMessage;
+};
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmSections.h b/wasm/WasmSections.h
new file mode 100644
index 0000000..5ee7bcc
--- /dev/null
+++ b/wasm/WasmSections.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+namespace JSC { namespace Wasm {
+
+#define FOR_EACH_WASM_SECTION(macro) \
+    macro(Type,     1, "Function signature declarations") \
+    macro(Import,   2, "Import declarations") \
+    macro(Function, 3, "Function declarations") \
+    macro(Table,    4, "Indirect function table and other tables") \
+    macro(Memory,   5, "Memory attributes") \
+    macro(Global,   6, "Global declarations") \
+    macro(Export,   7, "Exports") \
+    macro(Start,    8, "Start function declaration") \
+    macro(Element,  9, "Elements section") \
+    macro(Code,    10, "Function bodies (code)") \
+    macro(Data,    11, "Data segments")
+
+enum class Section : uint8_t {
+#define DEFINE_WASM_SECTION_ENUM(NAME, ID, DESCRIPTION) NAME = ID,
+    FOR_EACH_WASM_SECTION(DEFINE_WASM_SECTION_ENUM)
+#undef DEFINE_WASM_SECTION_ENUM
+    Unknown
+};
+
+template<typename Int>
+static inline bool isValidSection(Int section)
+{
+    switch (section) {
+#define VALIDATE_SECTION(NAME, ID, DESCRIPTION) case static_cast<Int>(Section::NAME): return true;
+        FOR_EACH_WASM_SECTION(VALIDATE_SECTION)
+#undef VALIDATE_SECTION
+    default:
+        return false;
+    }
+}
+
+static inline bool validateOrder(Section previous, Section next)
+{
+    if (previous == Section::Unknown)
+        return true;
+    return static_cast<uint8_t>(previous) < static_cast<uint8_t>(next);
+}
+
+static inline const char* makeString(Section section)
+{
+    switch (section) {
+#define STRINGIFY_SECTION_NAME(NAME, ID, DESCRIPTION) case Section::NAME: return #NAME;
+        FOR_EACH_WASM_SECTION(STRINGIFY_SECTION_NAME)
+#undef STRINGIFY_SECTION_NAME
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+        return "?";
+    }
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmValidate.cpp b/wasm/WasmValidate.cpp
new file mode 100644
index 0000000..0a129a9
--- /dev/null
+++ b/wasm/WasmValidate.cpp
@@ -0,0 +1,366 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WasmValidate.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "WasmFunctionParser.h"
+#include <wtf/CommaPrinter.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace JSC { namespace Wasm {
+
+class Validate {
+public:
+    class ControlData {
+    public:
+        ControlData(BlockType type, Type signature)
+            : m_blockType(type)
+            , m_signature(signature)
+        {
+        }
+
+        ControlData()
+        {
+        }
+
+        void dump(PrintStream& out) const
+        {
+            switch (type()) {
+            case BlockType::If:
+                out.print("If:    ");
+                break;
+            case BlockType::Block:
+                out.print("Block: ");
+                break;
+            case BlockType::Loop:
+                out.print("Loop:  ");
+                break;
+            }
+        }
+
+        bool hasNonVoidSignature() const { return m_signature != Void; }
+
+        BlockType type() const { return m_blockType; }
+        Type signature() const { return m_signature; }
+    private:
+        BlockType m_blockType;
+        Type m_signature;
+    };
+    typedef String ErrorType;
+    typedef UnexpectedType<ErrorType> UnexpectedResult;
+    typedef Expected<void, ErrorType> Result;
+    typedef Type ExpressionType;
+    typedef ControlData ControlType;
+    typedef Vector<ExpressionType, 1> ExpressionList;
+    typedef FunctionParser<Validate>::ControlEntry ControlEntry;
+
+    static const ExpressionType emptyExpression = Void;
+
+    template <typename ...Args>
+    NEVER_INLINE UnexpectedResult WARN_UNUSED_RETURN fail(Args... args) const
+    {
+        using namespace FailureHelper; // See ADL comment in WasmParser.h.
+        return UnexpectedResult(makeString(ASCIILiteral("WebAssembly.Module doesn't validate: "), makeString(args)...));
+    }
+#define WASM_VALIDATOR_FAIL_IF(condition, ...) do { \
+        if (UNLIKELY(condition))                    \
+        return fail(__VA_ARGS__);                   \
+    } while (0)
+
+    Result WARN_UNUSED_RETURN addArguments(const Vector<Type>&);
+    Result WARN_UNUSED_RETURN addLocal(Type, uint32_t);
+    ExpressionType addConstant(Type type, uint64_t) { return type; }
+
+    // Locals
+    Result WARN_UNUSED_RETURN getLocal(uint32_t index, ExpressionType& result);
+    Result WARN_UNUSED_RETURN setLocal(uint32_t index, ExpressionType value);
+
+    // Globals
+    Result WARN_UNUSED_RETURN getGlobal(uint32_t index, ExpressionType& result);
+    Result WARN_UNUSED_RETURN setGlobal(uint32_t index, ExpressionType value);
+
+    // Memory
+    Result WARN_UNUSED_RETURN load(LoadOpType, ExpressionType pointer, ExpressionType& result, uint32_t offset);
+    Result WARN_UNUSED_RETURN store(StoreOpType, ExpressionType pointer, ExpressionType value, uint32_t offset);
+
+    // Basic operators
+    template<OpType>
+    Result WARN_UNUSED_RETURN addOp(ExpressionType arg, ExpressionType& result);
+    template<OpType>
+    Result WARN_UNUSED_RETURN addOp(ExpressionType left, ExpressionType right, ExpressionType& result);
+    Result WARN_UNUSED_RETURN addSelect(ExpressionType condition, ExpressionType nonZero, ExpressionType zero, ExpressionType& result);
+
+    // Control flow
+    ControlData WARN_UNUSED_RETURN addBlock(Type signature);
+    ControlData WARN_UNUSED_RETURN addLoop(Type signature);
+    Result WARN_UNUSED_RETURN addIf(ExpressionType condition, Type signature, ControlData& result);
+    Result WARN_UNUSED_RETURN addElse(ControlData&, const ExpressionList&);
+    Result WARN_UNUSED_RETURN addElseToUnreachable(ControlData&);
+
+    Result WARN_UNUSED_RETURN addReturn(const ExpressionList& returnValues);
+    Result WARN_UNUSED_RETURN addBranch(ControlData&, ExpressionType condition, const ExpressionList& expressionStack);
+    Result WARN_UNUSED_RETURN addSwitch(ExpressionType condition, const Vector<ControlData*>& targets, ControlData& defaultTarget, const ExpressionList& expressionStack);
+    Result WARN_UNUSED_RETURN endBlock(ControlEntry&, ExpressionList& expressionStack);
+    Result WARN_UNUSED_RETURN addEndToUnreachable(ControlEntry&);
+
+    Result WARN_UNUSED_RETURN addUnreachable() { return { }; }
+
+    // Calls
+    Result WARN_UNUSED_RETURN addCall(unsigned calleeIndex, const Signature*, const Vector<ExpressionType>& args, ExpressionType& result);
+    Result WARN_UNUSED_RETURN addCallIndirect(const Signature*, const Vector<ExpressionType>& args, ExpressionType& result);
+
+    bool hasMemory() const { return !!m_module.memory; }
+
+    Validate(ExpressionType returnType, const ModuleInformation& module)
+        : m_returnType(returnType)
+        , m_module(module)
+    {
+    }
+
+    void dump(const Vector<ControlEntry>&, const ExpressionList&);
+
+private:
+    Result unify(Type, Type);
+    Result unify(const ExpressionList&, const ControlData&);
+
+    Result checkBranchTarget(ControlData& target, const ExpressionList& expressionStack);
+
+    ExpressionType m_returnType;
+    Vector<Type> m_locals;
+    const ModuleInformation& m_module;
+};
+
+auto Validate::addArguments(const Vector<Type>& args) -> Result
+{
+    for (Type arg : args)
+        WASM_FAIL_IF_HELPER_FAILS(addLocal(arg, 1));
+    return { };
+}
+
+auto Validate::addLocal(Type type, uint32_t count) -> Result
+{
+    size_t size = m_locals.size() + count;
+    WASM_VALIDATOR_FAIL_IF(!m_locals.tryReserveCapacity(size), "can't allocate memory for ", size, " locals");
+
+    for (uint32_t i = 0; i < count; ++i)
+        m_locals.uncheckedAppend(type);
+    return { };
+}
+
+auto Validate::getLocal(uint32_t index, ExpressionType& result) -> Result
+{
+    WASM_VALIDATOR_FAIL_IF(index >= m_locals.size(), "attempt to use unknown local ", index, " last one is ", m_locals.size());
+    result = m_locals[index];
+    return { };
+}
+
+auto Validate::setLocal(uint32_t index, ExpressionType value) -> Result
+{
+    ExpressionType localType;
+    WASM_FAIL_IF_HELPER_FAILS(getLocal(index, localType));
+    WASM_VALIDATOR_FAIL_IF(localType != value, "set_local to type ", value, " expected ", localType);
+    return { };
+}
+
+auto Validate::getGlobal(uint32_t index, ExpressionType& result) -> Result
+{
+    WASM_VALIDATOR_FAIL_IF(index >= m_module.globals.size(), "get_global ", index, " of unknown global, limit is ", m_module.globals.size());
+    result = m_module.globals[index].type;
+    ASSERT(isValueType(result));
+    return { };
+}
+
+auto Validate::setGlobal(uint32_t index, ExpressionType value) -> Result
+{
+    WASM_VALIDATOR_FAIL_IF(index >= m_module.globals.size(), "set_global ", index, " of unknown global, limit is ", m_module.globals.size());
+    WASM_VALIDATOR_FAIL_IF(m_module.globals[index].mutability == Global::Immutable, "set_global ", index, " is immutable");
+
+    ExpressionType globalType = m_module.globals[index].type;
+    ASSERT(isValueType(globalType));
+    WASM_VALIDATOR_FAIL_IF(globalType != value, "set_global ", index, " with type ", globalType, " with a variable of type ", value);
+    return { };
+}
+
+Validate::ControlType Validate::addBlock(Type signature)
+{
+    return ControlData(BlockType::Block, signature);
+}
+
+Validate::ControlType Validate::addLoop(Type signature)
+{
+    return ControlData(BlockType::Loop, signature);
+}
+
+auto Validate::addSelect(ExpressionType condition, ExpressionType nonZero, ExpressionType zero, ExpressionType& result) -> Result
+{
+    WASM_VALIDATOR_FAIL_IF(condition != I32, "select condition must be i32, got ", condition);
+    WASM_VALIDATOR_FAIL_IF(nonZero != zero, "select result types must match, got ", nonZero, " and ", zero);
+    result = zero;
+    return { };
+}
+
+auto Validate::addIf(ExpressionType condition, Type signature, ControlType& result) -> Result
+{
+    WASM_VALIDATOR_FAIL_IF(condition != I32, "if condition must be i32, got ", condition);
+    result = ControlData(BlockType::If, signature);
+    return { };
+}
+
+auto Validate::addElse(ControlType& current, const ExpressionList& values) -> Result
+{
+    WASM_FAIL_IF_HELPER_FAILS(unify(values, current));
+    return addElseToUnreachable(current);
+}
+
+auto Validate::addElseToUnreachable(ControlType& current) -> Result
+{
+    WASM_VALIDATOR_FAIL_IF(current.type() != BlockType::If, "else block isn't associated to an if");
+    current = ControlData(BlockType::Block, current.signature());
+    return { };
+}
+
+auto Validate::addReturn(const ExpressionList& returnValues) -> Result
+{
+    if (m_returnType == Void)
+        return { };
+    ASSERT(returnValues.size() == 1);
+    WASM_VALIDATOR_FAIL_IF(m_returnType != returnValues[0], "return type ", returnValues[0], " doesn't match function's return type ", m_returnType);
+    return { };
+}
+
+auto Validate::checkBranchTarget(ControlType& target, const ExpressionList& expressionStack) -> Result
+    {
+        if (target.type() == BlockType::Loop)
+            return { };
+
+        if (target.signature() == Void)
+            return { };
+
+        WASM_VALIDATOR_FAIL_IF(expressionStack.isEmpty(), "branch to block on empty expression stack");
+        WASM_VALIDATOR_FAIL_IF(target.signature() != expressionStack.last(), "branch's stack type doesn't match block's type");
+
+        return { };
+    }
+
+auto Validate::addBranch(ControlType& target, ExpressionType condition, const ExpressionList& stack) -> Result
+{
+    // Void means this is an unconditional branch.
+    WASM_VALIDATOR_FAIL_IF(condition != Void && condition != I32, "conditional branch with non-i32 condition ", condition);
+    return checkBranchTarget(target, stack);
+}
+
+auto Validate::addSwitch(ExpressionType condition, const Vector<ControlData*>& targets, ControlData& defaultTarget, const ExpressionList& expressionStack) -> Result
+{
+    WASM_VALIDATOR_FAIL_IF(condition != I32, "br_table with non-i32 condition ", condition);
+
+    for (auto target : targets)
+        WASM_VALIDATOR_FAIL_IF(defaultTarget.signature() != target->signature(), "br_table target type mismatch");
+
+    return checkBranchTarget(defaultTarget, expressionStack);
+}
+
+auto Validate::endBlock(ControlEntry& entry, ExpressionList& stack) -> Result
+{
+    ControlData& block = entry.controlData;
+    if (block.signature() == Void)
+        return { };
+
+    WASM_VALIDATOR_FAIL_IF(block.type() == BlockType::If, "If-block had a non-void result type: ", block.signature(), " but had no else-block");
+    WASM_VALIDATOR_FAIL_IF(stack.isEmpty(), "typed block falls through on empty stack");
+    WASM_VALIDATOR_FAIL_IF(block.signature() != stack.last(), "block fallthrough doesn't match its declared type");
+
+    entry.enclosedExpressionStack.append(block.signature());
+    return { };
+}
+
+auto Validate::addEndToUnreachable(ControlEntry& entry) -> Result
+{
+    auto block = entry.controlData;
+    if (block.signature() != Void) {
+        WASM_VALIDATOR_FAIL_IF(block.type() == BlockType::If, "If-block had a non-void result type: ", block.signature(), " but had no else-block");
+        entry.enclosedExpressionStack.append(block.signature());
+    }
+    return { };
+}
+
+auto Validate::addCall(unsigned, const Signature* signature, const Vector<ExpressionType>& args, ExpressionType& result) -> Result
+{
+    WASM_VALIDATOR_FAIL_IF(signature->arguments.size() != args.size(), "arity mismatch in call, got ", args.size(), " arguments, expected ", signature->arguments.size());
+
+    for (unsigned i = 0; i < args.size(); ++i)
+        WASM_VALIDATOR_FAIL_IF(args[i] != signature->arguments[i], "argument type mismatch in call, got ", args[i], ", expected ", signature->arguments[i]);
+
+    result = signature->returnType;
+    return { };
+}
+
+auto Validate::addCallIndirect(const Signature* signature, const Vector<ExpressionType>& args, ExpressionType& result) -> Result
+{
+    const auto argumentCount = signature->arguments.size();
+    WASM_VALIDATOR_FAIL_IF(argumentCount != args.size() - 1, "arity mismatch in call_indirect, got ", args.size() - 1, " arguments, expected ", argumentCount);
+
+    for (unsigned i = 0; i < argumentCount; ++i)
+        WASM_VALIDATOR_FAIL_IF(args[i] != signature->arguments[i], "argument type mismatch in call_indirect, got ", args[i], ", expected ", signature->arguments[i]);
+
+    WASM_VALIDATOR_FAIL_IF(args.last() != I32, "non-i32 call_indirect index ", args.last());
+
+    result = signature->returnType;
+    return { };
+}
+
+auto Validate::unify(const ExpressionList& values, const ControlType& block) -> Result
+{
+    ASSERT(values.size() <= 1);
+    if (block.signature() == Void)
+        return { };
+
+    WASM_VALIDATOR_FAIL_IF(values.isEmpty(), "non-void block ends with an empty stack");
+    WASM_VALIDATOR_FAIL_IF(values[0] != block.signature(), "control flow returns with unexpected type");
+
+    return { };
+}
+
+void Validate::dump(const Vector<ControlEntry>&, const ExpressionList&)
+{
+    // If you need this then you should fix the validator's error messages instead...
+    // Think of this as penance for the sin of bad error messages.
+}
+
+Expected<void, String> validateFunction(const uint8_t* source, size_t length, const Signature* signature, const ImmutableFunctionIndexSpace& functionIndexSpace, const ModuleInformation& module)
+{
+    Validate context(signature->returnType, module);
+    FunctionParser<Validate> validator(context, source, length, signature, functionIndexSpace, module);
+    WASM_FAIL_IF_HELPER_FAILS(validator.parse());
+    return { };
+}
+
+} } // namespace JSC::Wasm
+
+#include "WasmValidateInlines.h"
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/WasmValidate.h b/wasm/WasmValidate.h
new file mode 100644
index 0000000..1f00417
--- /dev/null
+++ b/wasm/WasmValidate.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "WasmFormat.h"
+#include <wtf/Expected.h>
+
+namespace JSC { namespace Wasm {
+
+Expected<void, String> validateFunction(const uint8_t*, size_t, const Signature*, const ImmutableFunctionIndexSpace&, const ModuleInformation&);
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/generateWasm.py b/wasm/generateWasm.py
new file mode 100755
index 0000000..6e1ddc2
--- /dev/null
+++ b/wasm/generateWasm.py
@@ -0,0 +1,96 @@
+#! /usr/bin/python
+
+# Copyright (C) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# This tool has a couple of helpful macros to process Wasm files from the wasm.json.
+
+import json
+import re
+
+class Wasm:
+    def __init__(self, scriptName, jsonPath):
+        wasmFile = open(jsonPath, "r")
+        wasm = json.load(open(jsonPath, "r"))
+        wasmFile.close()
+        for pre in wasm["preamble"]:
+            if pre["name"] == "version":
+                self.expectedVersionNumber = str(pre["value"])
+        self.preamble = wasm["preamble"]
+        self.types = wasm["type"]
+        self.opcodes = wasm["opcode"]
+        self.header = """/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// DO NO EDIT! - This file was generated by """ + scriptName
+
+    def opcodeIterator(self, filter, ret=None):
+        # We need to do this because python is dumb and won't let me use self in the lambda, which is ridiculous.
+        if ret == None:
+            ret = lambda op: {"name": op, "opcode": self.opcodes[op]}
+        for op in self.opcodes.iterkeys():
+            if filter(self.opcodes[op]):
+                yield ret(op)
+
+    def toCpp(self, name):
+        camelCase = re.sub(r'([^a-z0-9].)', lambda c: c.group(0)[1].upper(), name)
+        CamelCase = camelCase[:1].upper() + camelCase[1:]
+        return CamelCase
+
+
+def isNormal(op):
+    return op["category"] == "arithmetic" or op["category"] == "comparison" or op["category"] == "conversion"
+
+
+def isUnary(op):
+    return isNormal(op) and len(op["parameter"]) == 1
+
+
+def isBinary(op):
+    return isNormal(op) and len(op["parameter"]) == 2
+
+
+def isSimple(op):
+    return "b3op" in op
diff --git a/wasm/generateWasmB3IRGeneratorInlinesHeader.py b/wasm/generateWasmB3IRGeneratorInlinesHeader.py
new file mode 100755
index 0000000..596d859
--- /dev/null
+++ b/wasm/generateWasmB3IRGeneratorInlinesHeader.py
@@ -0,0 +1,218 @@
+#!/usr/bin/env python
+
+# Copyright (C) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:n
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# This tool has a couple of helpful macros to process Wasm files from the wasm.json.
+
+from generateWasm import *
+import optparse
+import sys
+import re
+
+parser = optparse.OptionParser(usage="usage: %prog <wasm.json> <WasmOps.h>")
+(options, args) = parser.parse_args(sys.argv[0:])
+if len(args) != 3:
+    parser.error(parser.usage)
+
+wasm = Wasm(args[0], args[1])
+opcodes = wasm.opcodes
+wasmB3IRGeneratorHFile = open(args[2], "w")
+
+opcodeRegex = re.compile('([a-zA-Z0-9]+)')
+argumentRegex = re.compile('(\@[0-9]+)')
+decimalRegex = re.compile('([-]?[0-9]+)')
+whitespaceRegex = re.compile('\s+')
+commaRegex = re.compile('(,)')
+oparenRegex = re.compile('(\()')
+cparenRegex = re.compile('(\))')
+
+
+class Source:
+    def __init__(self, contents, offset=0):
+        self.contents = contents
+        self.offset = offset
+
+
+def read(regex, source):
+    match = regex.match(source.contents, source.offset)
+    if not match:
+        return None
+    source.offset = match.end()
+    return match.group()
+
+
+def lex(source):
+    result = []
+    while source.offset != len(source.contents):
+        read(whitespaceRegex, source)
+        opcode = read(opcodeRegex, source)
+        if opcode:
+            result.append(opcode)
+            continue
+
+        argument = read(argumentRegex, source)
+        if argument:
+            result.append(argument)
+            continue
+
+        number = read(decimalRegex, source)
+        if number:
+            result.append(int(number))
+            continue
+
+        oparen = read(oparenRegex, source)
+        if oparen:
+            result.append(oparen)
+            continue
+
+        cparen = read(cparenRegex, source)
+        if cparen:
+            result.append(cparen)
+            continue
+
+        comma = read(commaRegex, source)
+        if comma:
+            # Skip commas
+            continue
+
+        raise Exception("Lexing Error: could not lex token from: " + source.contents + " at offset: " + str(source.offset) + " (" + source.contents[source.offset:] + "). With tokens: [" + ", ".join(result) + "]")
+    return result
+
+
+class CodeGenerator:
+    def __init__(self, tokens):
+        self.tokens = tokens
+        self.index = 0
+        self.code = []
+
+    def advance(self):
+        self.index += 1
+
+    def token(self):
+        return self.tokens[self.index]
+
+    def parseError(self, string):
+        raise Exception("Parse error " + string)
+
+    def consume(self, string):
+        if self.token() != string:
+            self.parseError("Expected " + string + " but got " + self.token())
+        self.advance()
+
+    def generateParameters(self):
+        self.advance()
+        params = []
+        tokens = self.tokens
+        while self.index < len(tokens):
+            if self.token() == ")":
+                self.advance()
+                return params
+            params.append(self.generateOpcode())
+        self.parseError("Parsing arguments fell off end")
+
+    def generateOpcode(self):
+        result = None
+        if self.token() == "i32" or self.token() == "i64":
+            type = "Int32"
+            if self.token() == "i64":
+                type = "Int64"
+            self.advance()
+            self.consume("(")
+            self.code.append(generateConstCode(self.index, self.token(), type))
+            result = temp(self.index)
+            self.advance()
+            self.consume(")")
+        elif argumentRegex.match(self.token()):
+            result = "arg" + self.token()[1:]
+            self.advance()
+        else:
+            op = self.token()
+            index = self.index
+            self.advance()
+            params = self.generateParameters()
+            self.code.append(generateB3OpCode(index, op, params))
+            result = temp(index)
+
+        return result
+
+    def generate(self, wasmOp):
+        if len(self.tokens) == 1:
+            params = ["arg" + str(param) for param in range(len(wasmOp["parameter"]))]
+            return "    result = m_currentBlock->appendNew<Value>(m_proc, B3::" + self.token() + ", Origin(), " + ", ".join(params) + ")"
+        result = self.generateOpcode()
+        self.code.append("result = " + result)
+        return "    " + "    \n".join(self.code)
+
+
+def temp(index):
+    return "temp" + str(index)
+
+
+def generateB3OpCode(index, op, params):
+    return "Value* " + temp(index) + " = m_currentBlock->appendNew<Value>(m_proc, B3::" + op + ", Origin(), " + ", ".join(params) + ");"
+
+
+def generateConstCode(index, value, type):
+    return "Value* " + temp(index) + " = m_currentBlock->appendIntConstant(m_proc, Origin(), B3::" + type + ", " + value + ");"
+
+
+def generateB3Code(wasmOp, source):
+    tokens = lex(Source(source))
+    parser = CodeGenerator(tokens)
+    return parser.generate(wasmOp)
+
+
+def generateSimpleCode(op):
+    opcode = op["opcode"]
+    b3op = opcode["b3op"]
+    args = ["ExpressionType arg" + str(param) for param in range(len(opcode["parameter"]))]
+    args.append("ExpressionType& result")
+    return """
+template<> auto B3IRGenerator::addOp<OpType::""" + wasm.toCpp(op["name"]) + ">(" + ", ".join(args) + """) -> PartialResult
+{
+""" + generateB3Code(opcode, b3op) + """;
+    return { };
+}
+"""
+
+
+definitions = [generateSimpleCode(op) for op in wasm.opcodeIterator(lambda op: isSimple(op) and (isBinary(op) or isUnary(op)))]
+contents = wasm.header + """
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+namespace JSC { namespace Wasm {
+
+""" + "".join(definitions) + """
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
+
+"""
+
+wasmB3IRGeneratorHFile.write(contents)
+wasmB3IRGeneratorHFile.close()
diff --git a/wasm/generateWasmOpsHeader.py b/wasm/generateWasmOpsHeader.py
new file mode 100755
index 0000000..de8aa2c
--- /dev/null
+++ b/wasm/generateWasmOpsHeader.py
@@ -0,0 +1,285 @@
+#! /usr/bin/python
+
+# Copyright (C) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# This tool has a couple of helpful macros to process Wasm files from the wasm.json.
+
+from generateWasm import *
+import optparse
+import sys
+
+parser = optparse.OptionParser(usage="usage: %prog <wasm.json> <WasmOps.h>")
+(options, args) = parser.parse_args(sys.argv[0:])
+if len(args) != 3:
+    parser.error(parser.usage)
+
+wasm = Wasm(args[0], args[1])
+types = wasm.types
+opcodes = wasm.opcodes
+wasmOpsHFile = open(args[2], "w")
+
+
+def cppMacro(wasmOpcode, value, b3, inc):
+    return " \\\n    macro(" + wasm.toCpp(wasmOpcode) + ", " + hex(int(value)) + ", " + b3 + ", " + str(inc) + ")"
+
+
+def typeMacroizer():
+    inc = 0
+    for ty in wasm.types:
+        yield cppMacro(ty, wasm.types[ty]["value"], wasm.types[ty]["b3type"], inc)
+        inc += 1
+
+type_definitions = ["#define FOR_EACH_WASM_TYPE(macro)"]
+type_definitions.extend([t for t in typeMacroizer()])
+type_definitions = "".join(type_definitions)
+
+
+def opcodeMacroizer(filter):
+    inc = 0
+    for op in wasm.opcodeIterator(filter):
+        b3op = "Oops"
+        if isSimple(op["opcode"]):
+            b3op = op["opcode"]["b3op"]
+        yield cppMacro(op["name"], op["opcode"]["value"], b3op, inc)
+        inc += 1
+
+defines = ["#define FOR_EACH_WASM_SPECIAL_OP(macro)"]
+defines.extend([op for op in opcodeMacroizer(lambda op: not (isUnary(op) or isBinary(op) or op["category"] == "control" or op["category"] == "memory"))])
+defines.append("\n\n#define FOR_EACH_WASM_CONTROL_FLOW_OP(macro)")
+defines.extend([op for op in opcodeMacroizer(lambda op: op["category"] == "control")])
+defines.append("\n\n#define FOR_EACH_WASM_SIMPLE_UNARY_OP(macro)")
+defines.extend([op for op in opcodeMacroizer(lambda op: isUnary(op) and isSimple(op))])
+defines.append("\n\n#define FOR_EACH_WASM_UNARY_OP(macro) \\\n    FOR_EACH_WASM_SIMPLE_UNARY_OP(macro)")
+defines.extend([op for op in opcodeMacroizer(lambda op: isUnary(op) and not (isSimple(op)))])
+defines.append("\n\n#define FOR_EACH_WASM_SIMPLE_BINARY_OP(macro)")
+defines.extend([op for op in opcodeMacroizer(lambda op: isBinary(op) and isSimple(op))])
+defines.append("\n\n#define FOR_EACH_WASM_BINARY_OP(macro) \\\n    FOR_EACH_WASM_SIMPLE_BINARY_OP(macro)")
+defines.extend([op for op in opcodeMacroizer(lambda op: isBinary(op) and not (isSimple(op)))])
+defines.append("\n\n#define FOR_EACH_WASM_MEMORY_LOAD_OP(macro)")
+defines.extend([op for op in opcodeMacroizer(lambda op: (op["category"] == "memory" and len(op["return"]) == 1))])
+defines.append("\n\n#define FOR_EACH_WASM_MEMORY_STORE_OP(macro)")
+defines.extend([op for op in opcodeMacroizer(lambda op: (op["category"] == "memory" and len(op["return"]) == 0))])
+defines.append("\n\n")
+
+defines = "".join(defines)
+
+opValueSet = set([op for op in wasm.opcodeIterator(lambda op: True, lambda op: opcodes[op]["value"])])
+maxOpValue = max(opValueSet)
+
+
+# Luckily, python does floor division rather than trunc division so this works.
+def ceilDiv(a, b):
+    return -(-a // b)
+
+
+def bitSet():
+    v = ""
+    for i in range(ceilDiv(maxOpValue, 8)):
+        entry = 0
+        for j in range(8):
+            if i * 8 + j in opValueSet:
+                entry |= 1 << j
+        v += (", " if i else "") + hex(entry)
+    return v
+
+validOps = bitSet()
+
+contents = wasm.header + """
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include <cstdint>
+
+namespace JSC { namespace Wasm {
+
+static constexpr unsigned expectedVersionNumber = """ + wasm.expectedVersionNumber + """;
+
+static constexpr unsigned numTypes = """ + str(len(types)) + """;
+
+""" + type_definitions + """
+#define CREATE_ENUM_VALUE(name, id, b3type, inc) name = id,
+enum Type : int8_t {
+    FOR_EACH_WASM_TYPE(CREATE_ENUM_VALUE)
+};
+#undef CREATE_ENUM_VALUE
+
+#define CREATE_CASE(name, id, b3type, inc) case id: return true;
+template <typename Int>
+inline bool isValidType(Int i)
+{
+    switch (i) {
+    default: return false;
+    FOR_EACH_WASM_TYPE(CREATE_CASE)
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+#undef CREATE_CASE
+
+#define CREATE_CASE(name, id, b3type, inc) case name: return b3type;
+inline B3::Type toB3Type(Type type)
+{
+    switch (type) {
+    FOR_EACH_WASM_TYPE(CREATE_CASE)
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return B3::Void;
+}
+#undef CREATE_CASE
+
+#define CREATE_CASE(name, id, b3type, inc) case name: return #name;
+inline const char* makeString(Type type)
+{
+    switch (type) {
+    FOR_EACH_WASM_TYPE(CREATE_CASE)
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+#undef CREATE_CASE
+
+#define CREATE_CASE(name, id, b3type, inc) case id: return inc;
+inline int linearizeType(Type type)
+{
+    switch (type) {
+    FOR_EACH_WASM_TYPE(CREATE_CASE)
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+#undef CREATE_CASE
+
+#define CREATE_CASE(name, id, b3type, inc) case inc: return name;
+inline Type linearizedToType(int i)
+{
+    switch (i) {
+    FOR_EACH_WASM_TYPE(CREATE_CASE)
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return Void;
+}
+#undef CREATE_CASE
+
+
+""" + defines + """
+#define FOR_EACH_WASM_OP(macro) \\
+    FOR_EACH_WASM_SPECIAL_OP(macro) \\
+    FOR_EACH_WASM_CONTROL_FLOW_OP(macro) \\
+    FOR_EACH_WASM_UNARY_OP(macro) \\
+    FOR_EACH_WASM_BINARY_OP(macro) \\
+    FOR_EACH_WASM_MEMORY_LOAD_OP(macro) \\
+    FOR_EACH_WASM_MEMORY_STORE_OP(macro)
+
+#define CREATE_ENUM_VALUE(name, id, b3op, inc) name = id,
+
+enum OpType : uint8_t {
+    FOR_EACH_WASM_OP(CREATE_ENUM_VALUE)
+};
+
+template<typename Int>
+inline bool isValidOpType(Int i)
+{
+    // Bitset of valid ops.
+    static const uint8_t valid[] = { """ + validOps + """ };
+    return 0 <= i && i <= """ + str(maxOpValue) + """ && (valid[i / 8] & (1 << (i % 8)));
+}
+
+enum class BinaryOpType : uint8_t {
+    FOR_EACH_WASM_BINARY_OP(CREATE_ENUM_VALUE)
+};
+
+enum class UnaryOpType : uint8_t {
+    FOR_EACH_WASM_UNARY_OP(CREATE_ENUM_VALUE)
+};
+
+enum class LoadOpType : uint8_t {
+    FOR_EACH_WASM_MEMORY_LOAD_OP(CREATE_ENUM_VALUE)
+};
+
+enum class StoreOpType : uint8_t {
+    FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_ENUM_VALUE)
+};
+
+#undef CREATE_ENUM_VALUE
+
+inline bool isControlOp(OpType op)
+{
+    switch (op) {
+#define CREATE_CASE(name, id, b3op, inc) case OpType::name:
+    FOR_EACH_WASM_CONTROL_FLOW_OP(CREATE_CASE)
+        return true;
+#undef CREATE_CASE
+    default:
+        break;
+    }
+    return false;
+}
+
+inline bool isSimple(UnaryOpType op)
+{
+    switch (op) {
+#define CREATE_CASE(name, id, b3op, inc) case UnaryOpType::name:
+    FOR_EACH_WASM_SIMPLE_UNARY_OP(CREATE_CASE)
+        return true;
+#undef CREATE_CASE
+    default:
+        break;
+    }
+    return false;
+}
+
+inline bool isSimple(BinaryOpType op)
+{
+    switch (op) {
+#define CREATE_CASE(name, id, b3op, inc) case BinaryOpType::name:
+    FOR_EACH_WASM_SIMPLE_BINARY_OP(CREATE_CASE)
+        return true;
+#undef CREATE_CASE
+    default:
+        break;
+    }
+    return false;
+}
+
+#define CREATE_CASE(name, id, b3type, inc) case name: return #name;
+inline const char* makeString(OpType op)
+{
+    switch (op) {
+    FOR_EACH_WASM_OP(CREATE_CASE)
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return nullptr;
+}
+#undef CREATE_CASE
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
+
+"""
+
+wasmOpsHFile.write(contents)
+wasmOpsHFile.close()
diff --git a/wasm/generateWasmValidateInlinesHeader.py b/wasm/generateWasmValidateInlinesHeader.py
new file mode 100755
index 0000000..52b66b1
--- /dev/null
+++ b/wasm/generateWasmValidateInlinesHeader.py
@@ -0,0 +1,159 @@
+#!/usr/bin/env python
+
+# Copyright (C) 2016 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# This tool has a couple of helpful macros to process Wasm files from the wasm.json.
+
+from generateWasm import *
+import optparse
+import sys
+
+parser = optparse.OptionParser(usage="usage: %prog <wasm.json> <WasmOps.h>")
+(options, args) = parser.parse_args(sys.argv[0:])
+if len(args) != 3:
+    parser.error(parser.usage)
+
+wasm = Wasm(args[0], args[1])
+opcodes = wasm.opcodes
+wasmValidateInlinesHFile = open(args[2], "w")
+
+
+def cppType(name):
+    result = {
+        "bool": "I32",
+        "addr": "I32",
+        "i32": "I32",
+        "i64": "I64",
+        "f32": "F32",
+        "f64": "F64",
+    }.get(name, None)
+    if result == None:
+        raise ValueError("Unknown type name: " + name)
+    return result
+
+
+def toCpp(name):
+    return wasm.toCpp(name)
+
+
+def unaryMacro(name):
+    op = opcodes[name]
+    return """
+template<> auto Validate::addOp<OpType::""" + toCpp(name) + """>(ExpressionType value, ExpressionType& result) -> Result
+{
+    if (UNLIKELY(value != """ + cppType(op["parameter"][0]) + """))
+        return UnexpectedType<Result::ErrorType>("validation failed: """ + name + """ value type mismatch");
+
+    result = """ + cppType(op["return"][0]) + """;
+    return { };
+}
+"""
+
+
+def binaryMacro(name):
+    op = opcodes[name]
+    return """
+template<> auto Validate::addOp<OpType::""" + toCpp(name) + """>(ExpressionType left, ExpressionType right, ExpressionType& result) -> Result
+{
+    if (UNLIKELY(left != """ + cppType(op["parameter"][0]) + """))
+        return UnexpectedType<Result::ErrorType>("validation failed: """ + name + """ left value type mismatch");
+
+    if (UNLIKELY(right != """ + cppType(op["parameter"][1]) + """))
+        return UnexpectedType<Result::ErrorType>("validation failed: """ + name + """ right value type mismatch");
+
+    result = """ + cppType(op["return"][0]) + """;
+    return { };
+}
+"""
+
+def loadMacro(name):
+    op = opcodes[name]
+    return """
+    case LoadOpType::""" + toCpp(name) + """: {
+        if (UNLIKELY(pointer != """ + cppType(op["parameter"][0]) + """))
+            return UnexpectedType<Result::ErrorType>("validation failed: """ + name + """ pointer type mismatch");
+
+        result = """ + cppType(op["return"][0]) + """;
+        return { };
+    }"""
+
+
+def storeMacro(name):
+    op = opcodes[name]
+    return """
+    case StoreOpType::""" + toCpp(name) + """: {
+        if (UNLIKELY(pointer != """ + cppType(op["parameter"][0]) + """))
+            return UnexpectedType<Result::ErrorType>("validation failed: """ + name + """ pointer type mismatch");
+
+        if (UNLIKELY(value != """ + cppType(op["parameter"][1]) + """))
+            return UnexpectedType<Result::ErrorType>("validation failed: """ + name + """ value type mismatch");
+
+        return { };
+    }"""
+
+
+unarySpecializations = "".join([op for op in wasm.opcodeIterator(isUnary, unaryMacro)])
+binarySpecializations = "".join([op for op in wasm.opcodeIterator(isBinary, binaryMacro)])
+loadCases = "".join([op for op in wasm.opcodeIterator(lambda op: op["category"] == "memory" and len(op["return"]) == 1, loadMacro)])
+storeCases = "".join([op for op in wasm.opcodeIterator(lambda op: op["category"] == "memory" and len(op["return"]) == 0, storeMacro)])
+
+contents = wasm.header + """
+// This file is intended to be inlined by WasmValidate.cpp only! It should not be included elsewhere.
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+namespace JSC { namespace Wasm {
+
+""" + unarySpecializations + binarySpecializations + """
+
+auto Validate::load(LoadOpType op, ExpressionType pointer, ExpressionType& result, uint32_t) -> Result
+{
+    if (UNLIKELY(!hasMemory()))
+        return UnexpectedType<Result::ErrorType>("validation failed: load instruction without memory");
+
+    switch (op) {
+""" + loadCases + """
+    }
+}
+
+auto Validate::store(StoreOpType op, ExpressionType pointer, ExpressionType value, uint32_t) -> Result
+{
+    if (UNLIKELY(!hasMemory()))
+        return UnexpectedType<Result::ErrorType>("validation failed: store instruction without memory");
+
+    switch (op) {
+""" + storeCases + """
+    }
+}
+
+} } // namespace JSC::Wasm
+
+#endif // ENABLE(WEBASSEMBLY)
+
+"""
+
+wasmValidateInlinesHFile.write(contents)
+wasmValidateInlinesHFile.close()
diff --git a/wasm/js/JSWebAssemblyCallee.cpp b/wasm/js/JSWebAssemblyCallee.cpp
new file mode 100644
index 0000000..c27712a
--- /dev/null
+++ b/wasm/js/JSWebAssemblyCallee.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebAssemblyCallee.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo JSWebAssemblyCallee::s_info = { "WebAssemblyCallee", nullptr, 0, CREATE_METHOD_TABLE(JSWebAssemblyCallee) };
+
+JSWebAssemblyCallee::JSWebAssemblyCallee(VM& vm)
+    : Base(vm, vm.webAssemblyCalleeStructure.get())
+{ }
+
+void JSWebAssemblyCallee::finishCreation(VM& vm, Wasm::Entrypoint&& entrypoint)
+{
+    Base::finishCreation(vm);
+
+    m_entrypoint = WTFMove(entrypoint);
+}
+
+void JSWebAssemblyCallee::destroy(JSCell* cell)
+{
+    JSWebAssemblyCallee* thisObject = static_cast<JSWebAssemblyCallee*>(cell);
+    thisObject->JSWebAssemblyCallee::~JSWebAssemblyCallee();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyCallee.h b/wasm/js/JSWebAssemblyCallee.h
new file mode 100644
index 0000000..b8777da
--- /dev/null
+++ b/wasm/js/JSWebAssemblyCallee.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCell.h"
+#include "RegisterAtOffsetList.h"
+#include "Structure.h"
+#include "WasmFormat.h"
+
+namespace JSC {
+
+class JSWebAssemblyCallee : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static JSWebAssemblyCallee* create(VM& vm, Wasm::Entrypoint&& entrypoint)
+    {
+        JSWebAssemblyCallee* callee = new (NotNull, allocateCell<JSWebAssemblyCallee>(vm.heap)) JSWebAssemblyCallee(vm);
+        callee->finishCreation(vm, WTFMove(entrypoint));
+        return callee;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) 
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+    }
+
+    DECLARE_EXPORT_INFO;
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+    void* entrypoint() { return m_entrypoint.compilation->code().executableAddress(); }
+
+    RegisterAtOffsetList* calleeSaveRegisters() { return &m_entrypoint.calleeSaveRegisters; }
+
+private:
+    void finishCreation(VM&, Wasm::Entrypoint&&);
+    JSWebAssemblyCallee(VM&);
+
+    Wasm::Entrypoint m_entrypoint;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyCompileError.cpp b/wasm/js/JSWebAssemblyCompileError.cpp
new file mode 100644
index 0000000..3bf57ab
--- /dev/null
+++ b/wasm/js/JSWebAssemblyCompileError.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebAssemblyCompileError.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+JSWebAssemblyCompileError* JSWebAssemblyCompileError::create(ExecState* state, Structure* structure, const String& message, bool useCurrentFrame)
+{
+    auto& vm = state->vm();
+    auto* instance = new (NotNull, allocateCell<JSWebAssemblyCompileError>(vm.heap)) JSWebAssemblyCompileError(vm, structure);
+    instance->finishCreation(state, vm, message, useCurrentFrame);
+    return instance;
+}
+
+JSWebAssemblyCompileError::JSWebAssemblyCompileError(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+const ClassInfo JSWebAssemblyCompileError::s_info = { "WebAssembly.CompileError", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWebAssemblyCompileError) };
+
+    
+JSObject* createWebAssemblyCompileError(ExecState* exec, const String& message)
+{
+    ASSERT(!message.isEmpty());
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    return ErrorInstance::create(exec, globalObject->vm(), globalObject->WebAssemblyCompileErrorStructure(), message, defaultSourceAppender, TypeNothing, true);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyCompileError.h b/wasm/js/JSWebAssemblyCompileError.h
new file mode 100644
index 0000000..6f05f3e
--- /dev/null
+++ b/wasm/js/JSWebAssemblyCompileError.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "ErrorInstance.h"
+
+namespace JSC {
+
+class JSWebAssemblyCompileError : public ErrorInstance {
+public:
+    typedef ErrorInstance Base;
+
+    static JSWebAssemblyCompileError* create(ExecState*, Structure*, const String&, bool);
+    static JSWebAssemblyCompileError* create(ExecState* exec, Structure* structure, JSValue message, bool useCurrentFrame)
+    {
+        return create(exec, structure, message.isUndefined() ? String() : message.toWTFString(exec), useCurrentFrame);
+    }
+
+    DECLARE_INFO;
+
+protected:
+    JSWebAssemblyCompileError(VM&, Structure*);
+};
+
+JSObject* createWebAssemblyCompileError(ExecState*, const String&);
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyHelpers.h b/wasm/js/JSWebAssemblyHelpers.h
new file mode 100644
index 0000000..2527878
--- /dev/null
+++ b/wasm/js/JSWebAssemblyHelpers.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCJSValue.h"
+
+namespace JSC {
+
+ALWAYS_INLINE uint32_t toNonWrappingUint32(ExecState* exec, JSValue value)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    double doubleValue = value.toInteger(exec);
+    RETURN_IF_EXCEPTION(throwScope, { });
+    if (doubleValue < 0 || doubleValue > UINT_MAX) {
+        throwException(exec, throwScope,
+            createRangeError(exec, ASCIILiteral("Expect an integer argument in the range: [0, 2^32 - 1]")));
+        return { };
+    }
+
+    return static_cast<uint32_t>(doubleValue);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyInstance.cpp b/wasm/js/JSWebAssemblyInstance.cpp
new file mode 100644
index 0000000..180f570
--- /dev/null
+++ b/wasm/js/JSWebAssemblyInstance.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebAssemblyInstance.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "AbstractModuleRecord.h"
+#include "JSCInlines.h"
+#include "JSModuleEnvironment.h"
+#include "JSModuleNamespaceObject.h"
+#include "JSWebAssemblyMemory.h"
+#include "JSWebAssemblyModule.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+JSWebAssemblyInstance* JSWebAssemblyInstance::create(VM& vm, Structure* structure, JSWebAssemblyModule* module, JSModuleNamespaceObject* moduleNamespaceObject)
+{
+    // FIXME: These objects could be pretty big we should try to throw OOM here.
+    auto* instance = new (NotNull, allocateCell<JSWebAssemblyInstance>(vm.heap, allocationSize(module->moduleInformation().importFunctions.size()))) JSWebAssemblyInstance(vm, structure, module->moduleInformation().importFunctions.size());
+    instance->finishCreation(vm, module, moduleNamespaceObject);
+    return instance;
+}
+
+Structure* JSWebAssemblyInstance::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSWebAssemblyInstance::JSWebAssemblyInstance(VM& vm, Structure* structure, unsigned numImportFunctions)
+    : Base(vm, structure)
+    , m_numImportFunctions(numImportFunctions)
+{
+    memset(importFunctions(), 0, m_numImportFunctions * sizeof(WriteBarrier<JSCell>));
+}
+
+void JSWebAssemblyInstance::finishCreation(VM& vm, JSWebAssemblyModule* module, JSModuleNamespaceObject* moduleNamespaceObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+
+    const size_t extraMemorySize = module->moduleInformation().globals.size() * sizeof(Register);
+    m_globals = MallocPtr<uint64_t>::malloc(extraMemorySize);
+    heap()->reportExtraMemoryAllocated(extraMemorySize);
+
+    m_module.set(vm, this, module);
+    m_moduleNamespaceObject.set(vm, this, moduleNamespaceObject);
+    putDirect(vm, Identifier::fromString(&vm, "exports"), moduleNamespaceObject, None);
+}
+
+void JSWebAssemblyInstance::destroy(JSCell* cell)
+{
+    static_cast<JSWebAssemblyInstance*>(cell)->JSWebAssemblyInstance::~JSWebAssemblyInstance();
+}
+
+void JSWebAssemblyInstance::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    auto* thisObject = jsCast<JSWebAssemblyInstance*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_module);
+    visitor.append(thisObject->m_moduleNamespaceObject);
+    visitor.append(thisObject->m_memory);
+    visitor.append(thisObject->m_table);
+    visitor.reportExtraMemoryVisited(thisObject->module()->moduleInformation().globals.size());
+    for (unsigned i = 0; i < thisObject->m_numImportFunctions; ++i)
+        visitor.append(*thisObject->importFunction(i));
+}
+
+const ClassInfo JSWebAssemblyInstance::s_info = { "WebAssembly.Instance", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWebAssemblyInstance) };
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyInstance.h b/wasm/js/JSWebAssemblyInstance.h
new file mode 100644
index 0000000..f34b052
--- /dev/null
+++ b/wasm/js/JSWebAssemblyInstance.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+#include "JSWebAssemblyMemory.h"
+#include "JSWebAssemblyTable.h"
+
+namespace JSC {
+
+class JSModuleNamespaceObject;
+class JSWebAssemblyModule;
+
+class JSWebAssemblyInstance : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+
+    static JSWebAssemblyInstance* create(VM&, Structure*, JSWebAssemblyModule*, JSModuleNamespaceObject*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    JSWebAssemblyModule* module()
+    {
+        ASSERT(m_module);
+        return m_module.get();
+    }
+
+    WriteBarrier<JSCell>* importFunction(unsigned idx)
+    {
+        RELEASE_ASSERT(idx < m_numImportFunctions);
+        return &importFunctions()[idx];
+    }
+
+    WriteBarrier<JSCell>* importFunctions()
+    {
+        return bitwise_cast<WriteBarrier<JSCell>*>(bitwise_cast<char*>(this) + offsetOfImportFunctions());
+    }
+
+    void setImportFunction(VM& vm, JSCell* value, unsigned idx)
+    {
+        importFunction(idx)->set(vm, this, value);
+    }
+
+    JSWebAssemblyMemory* memory() { return m_memory.get(); }
+    void setMemory(VM& vm, JSWebAssemblyMemory* memory) { m_memory.set(vm, this, memory); }
+
+    JSWebAssemblyTable* table() { return m_table.get(); }
+    void setTable(VM& vm, JSWebAssemblyTable* table) { m_table.set(vm, this, table); }
+
+    int32_t loadI32Global(unsigned i) const { return m_globals.get()[i]; }
+    int64_t loadI64Global(unsigned i) const { return m_globals.get()[i]; }
+    float loadF32Global(unsigned i) const { return bitwise_cast<float>(loadI32Global(i)); }
+    double loadF64Global(unsigned i) const { return bitwise_cast<double>(loadI64Global(i)); }
+    void setGlobal(unsigned i, int64_t bits) { m_globals.get()[i] = bits; }
+
+    static size_t offsetOfImportFunction(unsigned idx)
+    {
+        return offsetOfImportFunctions() + sizeof(WriteBarrier<JSCell>) * idx;
+    }
+
+    static ptrdiff_t offsetOfTable() { return OBJECT_OFFSETOF(JSWebAssemblyInstance, m_table); }
+    static ptrdiff_t offsetOfGlobals() { return OBJECT_OFFSETOF(JSWebAssemblyInstance, m_globals); }
+
+protected:
+    JSWebAssemblyInstance(VM&, Structure*, unsigned numImportFunctions);
+    void finishCreation(VM&, JSWebAssemblyModule*, JSModuleNamespaceObject*);
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    static size_t offsetOfImportFunctions()
+    {
+        return WTF::roundUpToMultipleOf<sizeof(WriteBarrier<JSCell>)>(sizeof(JSWebAssemblyInstance));
+    }
+
+    static size_t allocationSize(unsigned numImportFunctions)
+    {
+        return offsetOfImportFunctions() + sizeof(WriteBarrier<JSCell>) * numImportFunctions;
+    }
+
+private:
+    WriteBarrier<JSWebAssemblyModule> m_module;
+    WriteBarrier<JSModuleNamespaceObject> m_moduleNamespaceObject;
+    WriteBarrier<JSWebAssemblyMemory> m_memory;
+    WriteBarrier<JSWebAssemblyTable> m_table;
+    MallocPtr<uint64_t> m_globals;
+    unsigned m_numImportFunctions;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyMemory.cpp b/wasm/js/JSWebAssemblyMemory.cpp
new file mode 100644
index 0000000..bc449a8
--- /dev/null
+++ b/wasm/js/JSWebAssemblyMemory.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebAssemblyMemory.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCInlines.h"
+
+#include "JSArrayBuffer.h"
+#include "ArrayBuffer.h"
+
+namespace JSC {
+
+const ClassInfo JSWebAssemblyMemory::s_info = { "WebAssembly.Memory", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWebAssemblyMemory) };
+
+JSWebAssemblyMemory* JSWebAssemblyMemory::create(VM& vm, Structure* structure, std::unique_ptr<Wasm::Memory>&& memory)
+{
+    auto* instance = new (NotNull, allocateCell<JSWebAssemblyMemory>(vm.heap)) JSWebAssemblyMemory(vm, structure, WTFMove(memory));
+    instance->finishCreation(vm);
+    return instance;
+}
+
+Structure* JSWebAssemblyMemory::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSWebAssemblyMemory::JSWebAssemblyMemory(VM& vm, Structure* structure, std::unique_ptr<Wasm::Memory>&& memory)
+    : Base(vm, structure)
+    , m_memory(WTFMove(memory))
+{
+}
+
+JSArrayBuffer* JSWebAssemblyMemory::buffer(VM& vm, JSGlobalObject* globalObject)
+{
+    if (m_bufferWrapper)
+        return m_bufferWrapper.get();
+
+    auto destructor = [] (void*) {
+        // We don't need to do anything here to destroy the memory.
+        // The ArrayBuffer backing the JSArrayBuffer is only owned by us,
+        // so we guarantee its lifecylce.
+    };
+    m_buffer = ArrayBuffer::createFromBytes(memory()->memory(), memory()->size(), WTFMove(destructor));
+    m_bufferWrapper.set(vm, this, JSArrayBuffer::create(vm, globalObject->m_arrayBufferStructure.get(), m_buffer.get()));
+    RELEASE_ASSERT(m_bufferWrapper);
+    return m_bufferWrapper.get();
+}
+
+void JSWebAssemblyMemory::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+void JSWebAssemblyMemory::destroy(JSCell* cell)
+{
+    static_cast<JSWebAssemblyMemory*>(cell)->JSWebAssemblyMemory::~JSWebAssemblyMemory();
+}
+
+void JSWebAssemblyMemory::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    auto* thisObject = jsCast<JSWebAssemblyMemory*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_bufferWrapper);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyMemory.h b/wasm/js/JSWebAssemblyMemory.h
new file mode 100644
index 0000000..1d43c95
--- /dev/null
+++ b/wasm/js/JSWebAssemblyMemory.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+#include "WasmMemory.h"
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+
+class ArrayBuffer;
+class JSArrayBuffer;
+
+class JSWebAssemblyMemory : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static JSWebAssemblyMemory* create(VM&, Structure*, std::unique_ptr<Wasm::Memory>&&);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    Wasm::Memory* memory() { return m_memory.get(); }
+    JSArrayBuffer* buffer(VM& vm, JSGlobalObject*);
+
+protected:
+    JSWebAssemblyMemory(VM&, Structure*, std::unique_ptr<Wasm::Memory>&&);
+    void finishCreation(VM&);
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    std::unique_ptr<Wasm::Memory> m_memory;
+    WriteBarrier<JSArrayBuffer> m_bufferWrapper;
+    RefPtr<ArrayBuffer> m_buffer;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyModule.cpp b/wasm/js/JSWebAssemblyModule.cpp
new file mode 100644
index 0000000..d6524c5
--- /dev/null
+++ b/wasm/js/JSWebAssemblyModule.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebAssemblyModule.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCInlines.h"
+#include "JSWebAssemblyCallee.h"
+#include "WasmFormat.h"
+#include "WasmMemory.h"
+#include <wtf/StdLibExtras.h>
+
+namespace JSC {
+
+const ClassInfo JSWebAssemblyModule::s_info = { "WebAssembly.Module", &Base::s_info, nullptr, CREATE_METHOD_TABLE(JSWebAssemblyModule) };
+
+JSWebAssemblyModule* JSWebAssemblyModule::create(VM& vm, Structure* structure, std::unique_ptr<Wasm::ModuleInformation>&& moduleInformation, Bag<CallLinkInfo>&& callLinkInfos, Vector<Wasm::WasmToJSStub>&& wasmToJSStubs, Wasm::ImmutableFunctionIndexSpace&& functionIndexSpace, SymbolTable* exportSymbolTable, unsigned calleeCount)
+{
+    auto* instance = new (NotNull, allocateCell<JSWebAssemblyModule>(vm.heap, allocationSize(calleeCount))) JSWebAssemblyModule(vm, structure, std::forward<std::unique_ptr<Wasm::ModuleInformation>>(moduleInformation), std::forward<Bag<CallLinkInfo>>(callLinkInfos), std::forward<Vector<Wasm::WasmToJSStub>>(wasmToJSStubs), std::forward<Wasm::ImmutableFunctionIndexSpace>(functionIndexSpace), calleeCount);
+    instance->finishCreation(vm, exportSymbolTable);
+    return instance;
+}
+
+Structure* JSWebAssemblyModule::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSWebAssemblyModule::JSWebAssemblyModule(VM& vm, Structure* structure, std::unique_ptr<Wasm::ModuleInformation>&& moduleInformation, Bag<CallLinkInfo>&& callLinkInfos, Vector<Wasm::WasmToJSStub>&& wasmToJSStubs, Wasm::ImmutableFunctionIndexSpace&& functionIndexSpace, unsigned calleeCount)
+    : Base(vm, structure)
+    , m_moduleInformation(WTFMove(moduleInformation))
+    , m_callLinkInfos(WTFMove(callLinkInfos))
+    , m_wasmToJSStubs(WTFMove(wasmToJSStubs))
+    , m_functionIndexSpace(WTFMove(functionIndexSpace))
+    , m_calleeCount(calleeCount)
+{
+    memset(callees(), 0, m_calleeCount * sizeof(WriteBarrier<JSWebAssemblyCallee>) * 2);
+}
+
+void JSWebAssemblyModule::finishCreation(VM& vm, SymbolTable* exportSymbolTable)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    m_exportSymbolTable.set(vm, this, exportSymbolTable);
+}
+
+void JSWebAssemblyModule::destroy(JSCell* cell)
+{
+    static_cast<JSWebAssemblyModule*>(cell)->JSWebAssemblyModule::~JSWebAssemblyModule();
+}
+
+void JSWebAssemblyModule::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSWebAssemblyModule* thisObject = jsCast<JSWebAssemblyModule*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_exportSymbolTable);
+    for (unsigned i = 0; i < thisObject->m_calleeCount * 2; i++)
+        visitor.append(thisObject->callees()[i]);
+
+    visitor.addUnconditionalFinalizer(&thisObject->m_unconditionalFinalizer);
+}
+
+void JSWebAssemblyModule::UnconditionalFinalizer::finalizeUnconditionally()
+{
+    JSWebAssemblyModule* thisObject = bitwise_cast<JSWebAssemblyModule*>(
+        bitwise_cast<char*>(this) - OBJECT_OFFSETOF(JSWebAssemblyModule, m_unconditionalFinalizer));
+    for (auto iter = thisObject->m_callLinkInfos.begin(); !!iter; ++iter)
+        (*iter)->visitWeak(*thisObject->vm());
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyModule.h b/wasm/js/JSWebAssemblyModule.h
new file mode 100644
index 0000000..cc1257b
--- /dev/null
+++ b/wasm/js/JSWebAssemblyModule.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+#include "JSWebAssemblyCallee.h"
+#include "UnconditionalFinalizer.h"
+#include "WasmFormat.h"
+#include <wtf/Bag.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class SymbolTable;
+
+class JSWebAssemblyModule : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static JSWebAssemblyModule* create(VM&, Structure*, std::unique_ptr<Wasm::ModuleInformation>&&, Bag<CallLinkInfo>&&, Vector<Wasm::WasmToJSStub>&&, Wasm::ImmutableFunctionIndexSpace&&, SymbolTable*, unsigned);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    const Wasm::ModuleInformation& moduleInformation() const { return *m_moduleInformation.get(); }
+    SymbolTable* exportSymbolTable() const { return m_exportSymbolTable.get(); }
+    Wasm::Signature* signatureForFunctionIndexSpace(unsigned functionIndexSpace) const { ASSERT(functionIndexSpace < m_functionIndexSpace.size); return m_functionIndexSpace.buffer.get()[functionIndexSpace].signature; }
+    unsigned importCount() const { return m_wasmToJSStubs.size(); }
+
+    JSWebAssemblyCallee* jsEntrypointCalleeFromFunctionIndexSpace(unsigned functionIndexSpace)
+    {
+        RELEASE_ASSERT(functionIndexSpace >= importCount());
+        unsigned calleeIndex = functionIndexSpace - importCount();
+        RELEASE_ASSERT(calleeIndex < m_calleeCount);
+        return callees()[calleeIndex].get();
+    }
+
+    JSWebAssemblyCallee* wasmEntrypointCalleeFromFunctionIndexSpace(unsigned functionIndexSpace)
+    {
+        RELEASE_ASSERT(functionIndexSpace >= importCount());
+        unsigned calleeIndex = functionIndexSpace - importCount();
+        RELEASE_ASSERT(calleeIndex < m_calleeCount);
+        return callees()[calleeIndex + m_calleeCount].get();
+    }
+
+    void setJSEntrypointCallee(VM& vm, unsigned calleeIndex, JSWebAssemblyCallee* callee)
+    {
+        RELEASE_ASSERT(calleeIndex < m_calleeCount);
+        callees()[calleeIndex].set(vm, this, callee);
+    }
+
+    void setWasmEntrypointCallee(VM& vm, unsigned calleeIndex, JSWebAssemblyCallee* callee)
+    {
+        RELEASE_ASSERT(calleeIndex < m_calleeCount);
+        callees()[calleeIndex + m_calleeCount].set(vm, this, callee);
+    }
+
+    WriteBarrier<JSWebAssemblyCallee>* callees()
+    {
+        return bitwise_cast<WriteBarrier<JSWebAssemblyCallee>*>(bitwise_cast<char*>(this) + offsetOfCallees());
+    }
+
+    static ptrdiff_t offsetOfFunctionIndexSpace() { return OBJECT_OFFSETOF(JSWebAssemblyModule, m_functionIndexSpace); }
+
+protected:
+    JSWebAssemblyModule(VM&, Structure*, std::unique_ptr<Wasm::ModuleInformation>&&, Bag<CallLinkInfo>&&, Vector<Wasm::WasmToJSStub>&&, Wasm::ImmutableFunctionIndexSpace&&, unsigned calleeCount);
+    void finishCreation(VM&, SymbolTable*);
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+private:
+    static size_t offsetOfCallees()
+    {
+        return WTF::roundUpToMultipleOf<sizeof(WriteBarrier<JSWebAssemblyCallee>)>(sizeof(JSWebAssemblyModule));
+    }
+
+    static size_t allocationSize(unsigned numCallees)
+    {
+        return offsetOfCallees() + sizeof(WriteBarrier<JSWebAssemblyCallee>) * numCallees * 2;
+    }
+
+    class UnconditionalFinalizer : public JSC::UnconditionalFinalizer { 
+        void finalizeUnconditionally() override;
+    };
+
+    UnconditionalFinalizer m_unconditionalFinalizer;
+    std::unique_ptr<Wasm::ModuleInformation> m_moduleInformation;
+    Bag<CallLinkInfo> m_callLinkInfos;
+    WriteBarrier<SymbolTable> m_exportSymbolTable;
+    Vector<Wasm::WasmToJSStub> m_wasmToJSStubs;
+    const Wasm::ImmutableFunctionIndexSpace m_functionIndexSpace;
+    unsigned m_calleeCount;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyRuntimeError.cpp b/wasm/js/JSWebAssemblyRuntimeError.cpp
new file mode 100644
index 0000000..3121efb
--- /dev/null
+++ b/wasm/js/JSWebAssemblyRuntimeError.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebAssemblyRuntimeError.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+JSWebAssemblyRuntimeError* JSWebAssemblyRuntimeError::create(ExecState* state, Structure* structure, const String& message, bool useCurrentFrame)
+{
+    auto& vm = state->vm();
+    auto* instance = new (NotNull, allocateCell<JSWebAssemblyRuntimeError>(vm.heap)) JSWebAssemblyRuntimeError(vm, structure);
+    instance->finishCreation(state, vm, message, useCurrentFrame);
+    return instance;
+}
+
+JSWebAssemblyRuntimeError::JSWebAssemblyRuntimeError(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+const ClassInfo JSWebAssemblyRuntimeError::s_info = { "WebAssembly.RuntimeError", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWebAssemblyRuntimeError) };
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyRuntimeError.h b/wasm/js/JSWebAssemblyRuntimeError.h
new file mode 100644
index 0000000..3c7879e
--- /dev/null
+++ b/wasm/js/JSWebAssemblyRuntimeError.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "ErrorInstance.h"
+
+namespace JSC {
+
+class JSWebAssemblyRuntimeError : public ErrorInstance {
+public:
+    typedef ErrorInstance Base;
+
+    static JSWebAssemblyRuntimeError* create(ExecState*, Structure*, const String&, bool useCurrentFrame = true);
+    static JSWebAssemblyRuntimeError* create(ExecState* exec, Structure* structure, JSValue message, bool useCurrentFrame)
+    {
+        return create(exec, structure, message.isUndefined() ? String() : message.toWTFString(exec), useCurrentFrame);
+    }
+
+    DECLARE_INFO;
+
+protected:
+    JSWebAssemblyRuntimeError(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyTable.cpp b/wasm/js/JSWebAssemblyTable.cpp
new file mode 100644
index 0000000..684b144
--- /dev/null
+++ b/wasm/js/JSWebAssemblyTable.cpp
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebAssemblyTable.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCInlines.h"
+#include "WasmFormat.h"
+
+namespace JSC {
+
+const ClassInfo JSWebAssemblyTable::s_info = { "WebAssembly.Table", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWebAssemblyTable) };
+
+JSWebAssemblyTable* JSWebAssemblyTable::create(ExecState* exec, VM& vm, Structure* structure, uint32_t initial, std::optional<uint32_t> maximum)
+{
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    if (!isValidSize(initial)) {
+        throwException(exec, throwScope, createOutOfMemoryError(exec));
+        return nullptr;
+    }
+
+    auto* instance = new (NotNull, allocateCell<JSWebAssemblyTable>(vm.heap)) JSWebAssemblyTable(vm, structure, initial, maximum);
+    instance->finishCreation(vm);
+    return instance;
+}
+
+Structure* JSWebAssemblyTable::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+JSWebAssemblyTable::JSWebAssemblyTable(VM& vm, Structure* structure, uint32_t initial, std::optional<uint32_t> maximum)
+    : Base(vm, structure)
+{
+    m_size = initial;
+    ASSERT(isValidSize(m_size));
+    m_maximum = maximum;
+    ASSERT(!m_maximum || *m_maximum >= m_size);
+
+    // FIXME: It might be worth trying to pre-allocate maximum here. The spec recommends doing so.
+    // But for now, we're not doing that.
+    m_functions = MallocPtr<Wasm::CallableFunction>::malloc(sizeof(Wasm::CallableFunction) * static_cast<size_t>(m_size));
+    m_jsFunctions = MallocPtr<WriteBarrier<WebAssemblyFunction>>::malloc(sizeof(WriteBarrier<WebAssemblyFunction>) * static_cast<size_t>(m_size));
+    for (uint32_t i = 0; i < m_size; ++i) {
+        new (&m_functions.get()[i]) Wasm::CallableFunction();
+        ASSERT(!m_functions.get()[i].signature); // We rely on this in compiled code.
+        new (&m_jsFunctions.get()[i]) WriteBarrier<WebAssemblyFunction>();
+    }
+}
+
+void JSWebAssemblyTable::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+}
+
+void JSWebAssemblyTable::destroy(JSCell* cell)
+{
+    static_cast<JSWebAssemblyTable*>(cell)->JSWebAssemblyTable::~JSWebAssemblyTable();
+}
+
+void JSWebAssemblyTable::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSWebAssemblyTable* thisObject = jsCast<JSWebAssemblyTable*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+
+    Base::visitChildren(thisObject, visitor);
+
+    for (unsigned i = 0; i < thisObject->m_size; ++i)
+        visitor.append(thisObject->m_jsFunctions.get()[i]);
+}
+
+bool JSWebAssemblyTable::grow(uint32_t newSize)
+{
+    if (newSize < m_size)
+        return false;
+    if (newSize == m_size)
+        return true;
+    if (maximum() && newSize > *maximum())
+        return false;
+    if (!isValidSize(newSize))
+        return false;
+
+    m_functions.realloc(sizeof(Wasm::CallableFunction) * static_cast<size_t>(newSize));
+    m_jsFunctions.realloc(sizeof(WriteBarrier<WebAssemblyFunction>) * static_cast<size_t>(newSize));
+
+    for (uint32_t i = m_size; i < newSize; ++i) {
+        new (&m_functions.get()[i]) Wasm::CallableFunction();
+        new (&m_jsFunctions.get()[i]) WriteBarrier<WebAssemblyFunction>();
+    }
+    m_size = newSize;
+    return true;
+}
+
+void JSWebAssemblyTable::clearFunction(uint32_t index)
+{
+    RELEASE_ASSERT(index < m_size);
+    m_jsFunctions.get()[index] = WriteBarrier<WebAssemblyFunction>();
+    m_functions.get()[index] = Wasm::CallableFunction();
+    ASSERT(!m_functions.get()[index].signature); // We rely on this in compiled code.
+}
+
+void JSWebAssemblyTable::setFunction(VM& vm, uint32_t index, WebAssemblyFunction* function)
+{
+    RELEASE_ASSERT(index < m_size);
+    m_jsFunctions.get()[index].set(vm, this, function);
+    m_functions.get()[index] = Wasm::CallableFunction(function->signature(), function->wasmEntrypoint());
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/JSWebAssemblyTable.h b/wasm/js/JSWebAssemblyTable.h
new file mode 100644
index 0000000..468a027
--- /dev/null
+++ b/wasm/js/JSWebAssemblyTable.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+#include "WebAssemblyFunction.h"
+#include <wtf/MallocPtr.h>
+
+namespace JSC {
+
+namespace Wasm {
+struct CallableFunction;
+}
+
+class JSWebAssemblyTable : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static JSWebAssemblyTable* create(ExecState*, VM&, Structure*, uint32_t initial, std::optional<uint32_t> maximum);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+    std::optional<uint32_t> maximum() const { return m_maximum; }
+    uint32_t size() const { return m_size; }
+    bool grow(uint32_t newSize) WARN_UNUSED_RETURN;
+    WebAssemblyFunction* getFunction(uint32_t index)
+    {
+        RELEASE_ASSERT(index < m_size);
+        return m_jsFunctions.get()[index].get();
+    }
+    void clearFunction(uint32_t index);
+    void setFunction(VM&, uint32_t index, WebAssemblyFunction*);
+
+    static ptrdiff_t offsetOfSize() { return OBJECT_OFFSETOF(JSWebAssemblyTable, m_size); }
+    static ptrdiff_t offsetOfFunctions() { return OBJECT_OFFSETOF(JSWebAssemblyTable, m_functions); }
+
+    static bool isValidSize(uint32_t size)
+    {
+        // This tops out at ~384 MB worth of data in this class.
+        return size < (1 << 24);
+    }
+
+private:
+    JSWebAssemblyTable(VM&, Structure*, uint32_t initial, std::optional<uint32_t> maximum);
+    void finishCreation(VM&);
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    MallocPtr<Wasm::CallableFunction> m_functions;
+    MallocPtr<WriteBarrier<WebAssemblyFunction>> m_jsFunctions;
+    std::optional<uint32_t> m_maximum;
+    uint32_t m_size;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyCompileErrorConstructor.cpp b/wasm/js/WebAssemblyCompileErrorConstructor.cpp
new file mode 100644
index 0000000..0a0a2ab
--- /dev/null
+++ b/wasm/js/WebAssemblyCompileErrorConstructor.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyCompileErrorConstructor.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyCompileError.h"
+#include "WebAssemblyCompileErrorPrototype.h"
+
+#include "WebAssemblyCompileErrorConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyCompileErrorConstructor::s_info = { "Function", &Base::s_info, &constructorTableWebAssemblyCompileError, CREATE_METHOD_TABLE(WebAssemblyCompileErrorConstructor) };
+
+/* Source for WebAssemblyCompileErrorConstructor.lut.h
+ @begin constructorTableWebAssemblyCompileError
+ @end
+ */
+
+static EncodedJSValue JSC_HOST_CALL constructJSWebAssemblyCompileError(ExecState* state)
+{
+    auto& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue message = state->argument(0);
+    auto* structure = InternalFunction::createSubclassStructure(state, state->newTarget(), asInternalFunction(state->jsCallee())->globalObject()->WebAssemblyCompileErrorStructure());
+    RETURN_IF_EXCEPTION(scope, { });
+    return JSValue::encode(JSWebAssemblyCompileError::create(state, structure, message, false));
+}
+
+static EncodedJSValue JSC_HOST_CALL callJSWebAssemblyCompileError(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(state, scope, "WebAssembly.CompileError"));
+}
+
+WebAssemblyCompileErrorConstructor* WebAssemblyCompileErrorConstructor::create(VM& vm, Structure* structure, WebAssemblyCompileErrorPrototype* thisPrototype)
+{
+    auto* constructor = new (NotNull, allocateCell<WebAssemblyCompileErrorConstructor>(vm.heap)) WebAssemblyCompileErrorConstructor(vm, structure);
+    constructor->finishCreation(vm, thisPrototype);
+    return constructor;
+}
+
+Structure* WebAssemblyCompileErrorConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyCompileErrorConstructor::finishCreation(VM& vm, WebAssemblyCompileErrorPrototype* prototype)
+{
+    Base::finishCreation(vm, ASCIILiteral("CompileError"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+}
+
+WebAssemblyCompileErrorConstructor::WebAssemblyCompileErrorConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+ConstructType WebAssemblyCompileErrorConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructJSWebAssemblyCompileError;
+    return ConstructType::Host;
+}
+
+CallType WebAssemblyCompileErrorConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callJSWebAssemblyCompileError;
+    return CallType::Host;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyCompileErrorConstructor.h b/wasm/js/WebAssemblyCompileErrorConstructor.h
new file mode 100644
index 0000000..34a0e78
--- /dev/null
+++ b/wasm/js/WebAssemblyCompileErrorConstructor.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "InternalFunction.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyCompileErrorPrototype;
+
+class WebAssemblyCompileErrorConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyCompileErrorConstructor* create(VM&, Structure*, WebAssemblyCompileErrorPrototype*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, WebAssemblyCompileErrorPrototype*);
+
+private:
+    WebAssemblyCompileErrorConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyCompileErrorPrototype.cpp b/wasm/js/WebAssemblyCompileErrorPrototype.cpp
new file mode 100644
index 0000000..0522e1f
--- /dev/null
+++ b/wasm/js/WebAssemblyCompileErrorPrototype.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyCompileErrorPrototype.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+
+#include "WebAssemblyCompileErrorPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyCompileErrorPrototype::s_info = { "WebAssembly.CompileError.prototype", &Base::s_info, &prototypeTableWebAssemblyCompileError, CREATE_METHOD_TABLE(WebAssemblyCompileErrorPrototype) };
+
+/* Source for WebAssemblyCompileErrorPrototype.lut.h
+ @begin prototypeTableWebAssemblyCompileError
+ @end
+ */
+
+WebAssemblyCompileErrorPrototype* WebAssemblyCompileErrorPrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    auto* object = new (NotNull, allocateCell<WebAssemblyCompileErrorPrototype>(vm.heap)) WebAssemblyCompileErrorPrototype(vm, structure);
+    object->finishCreation(vm);
+    return object;
+}
+
+Structure* WebAssemblyCompileErrorPrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyCompileErrorPrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+WebAssemblyCompileErrorPrototype::WebAssemblyCompileErrorPrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyCompileErrorPrototype.h b/wasm/js/WebAssemblyCompileErrorPrototype.h
new file mode 100644
index 0000000..d329651
--- /dev/null
+++ b/wasm/js/WebAssemblyCompileErrorPrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyCompileErrorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyCompileErrorPrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    WebAssemblyCompileErrorPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyFunction.cpp b/wasm/js/WebAssemblyFunction.cpp
new file mode 100644
index 0000000..677c01a
--- /dev/null
+++ b/wasm/js/WebAssemblyFunction.cpp
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyFunction.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "B3Compilation.h"
+#include "JSCInlines.h"
+#include "JSFunctionInlines.h"
+#include "JSObject.h"
+#include "JSWebAssemblyCallee.h"
+#include "JSWebAssemblyInstance.h"
+#include "JSWebAssemblyMemory.h"
+#include "LLIntThunks.h"
+#include "ProtoCallFrame.h"
+#include "VM.h"
+#include "WasmFormat.h"
+#include "WasmMemory.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyFunction::s_info = { "WebAssemblyFunction", &Base::s_info, nullptr, CREATE_METHOD_TABLE(WebAssemblyFunction) };
+
+static EncodedJSValue JSC_HOST_CALL callWebAssemblyFunction(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    WebAssemblyFunction* wasmFunction = jsDynamicCast<WebAssemblyFunction*>(exec->jsCallee());
+    if (!wasmFunction)
+        return JSValue::encode(throwException(exec, scope, createTypeError(exec, "expected a WebAssembly function", defaultSourceAppender, runtimeTypeForValue(exec->jsCallee()))));
+    const Wasm::Signature* signature = wasmFunction->signature();
+
+    // FIXME is this the right behavior? https://bugs.webkit.org/show_bug.cgi?id=164876
+    if (exec->argumentCount() != signature->arguments.size())
+        return JSValue::encode(throwException(exec, scope, createNotEnoughArgumentsError(exec, defaultSourceAppender)));
+
+    // FIXME is this boxing correct? https://bugs.webkit.org/show_bug.cgi?id=164876
+    Vector<JSValue> boxedArgs;
+    for (unsigned argIndex = 0; argIndex < exec->argumentCount(); ++argIndex) {
+        JSValue arg = exec->uncheckedArgument(argIndex);
+        switch (signature->arguments[argIndex]) {
+        case Wasm::I32:
+            arg = JSValue::decode(arg.toInt32(exec));
+            break;
+        case Wasm::F32:
+            arg = JSValue::decode(bitwise_cast<uint32_t>(arg.toFloat(exec)));
+            break;
+        case Wasm::F64:
+            arg = JSValue::decode(bitwise_cast<uint64_t>(arg.toNumber(exec)));
+            break;
+        case Wasm::Void:
+        case Wasm::I64:
+        case Wasm::Func:
+        case Wasm::Anyfunc:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+        RETURN_IF_EXCEPTION(scope, { });
+        boxedArgs.append(arg);
+    }
+
+    JSValue firstArgument = JSValue();
+    int argCount = 1;
+    JSValue* remainingArgs = nullptr;
+    if (boxedArgs.size()) {
+        remainingArgs = boxedArgs.data();
+        firstArgument = *remainingArgs;
+        remainingArgs++;
+        argCount = boxedArgs.size();
+    }
+
+    // Note: we specifically use the WebAssemblyFunction as the callee to begin with in the ProtoCallFrame.
+    // The reason for this is that calling into the llint may stack overflow, and the stack overflow
+    // handler might read the global object from the callee. The JSWebAssemblyCallee doesn't have a
+    // global object, but the WebAssemblyFunction does.
+    ProtoCallFrame protoCallFrame;
+    protoCallFrame.init(nullptr, wasmFunction, firstArgument, argCount, remainingArgs);
+
+    return wasmFunction->call(vm, &protoCallFrame);
+}
+
+EncodedJSValue WebAssemblyFunction::call(VM& vm, ProtoCallFrame* protoCallFrame)
+{
+    // Setup the memory that the entrance loads.
+    if (JSWebAssemblyMemory* memory = instance()->memory()) {
+        Wasm::Memory* wasmMemory = memory->memory();
+        vm.topWasmMemoryPointer = wasmMemory->memory();
+        vm.topWasmMemorySize = wasmMemory->size();
+    } else {
+        vm.topWasmMemoryPointer = nullptr;
+        vm.topWasmMemorySize = 0;
+    }
+
+    JSWebAssemblyInstance* prevJSWebAssemblyInstance = vm.topJSWebAssemblyInstance;
+    vm.topJSWebAssemblyInstance = instance();
+    ASSERT(instance());
+    EncodedJSValue rawResult = vmEntryToWasm(m_jsEntrypoint->entrypoint(), &vm, protoCallFrame);
+    vm.topJSWebAssemblyInstance = prevJSWebAssemblyInstance;
+
+    // FIXME is this correct? https://bugs.webkit.org/show_bug.cgi?id=164876
+    switch (signature()->returnType) {
+    case Wasm::Void:
+        return JSValue::encode(jsUndefined());
+    case Wasm::I32:
+        return JSValue::encode(JSValue(static_cast<int32_t>(rawResult)));
+    case Wasm::F32:
+        return JSValue::encode(JSValue(bitwise_cast<float>(static_cast<int32_t>(rawResult))));
+    case Wasm::F64:
+        return JSValue::encode(JSValue(bitwise_cast<double>(rawResult)));
+    case Wasm::I64:
+    case Wasm::Func:
+    case Wasm::Anyfunc:
+        break;
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return EncodedJSValue();
+}
+
+WebAssemblyFunction* WebAssemblyFunction::create(VM& vm, JSGlobalObject* globalObject, unsigned length, const String& name, JSWebAssemblyInstance* instance, JSWebAssemblyCallee* jsEntrypoint, JSWebAssemblyCallee* wasmEntrypoint, Wasm::Signature* signature)
+{
+    NativeExecutable* executable = vm.getHostFunction(callWebAssemblyFunction, NoIntrinsic, callHostFunctionAsConstructor, nullptr, name);
+    Structure* structure = globalObject->webAssemblyFunctionStructure();
+    WebAssemblyFunction* function = new (NotNull, allocateCell<WebAssemblyFunction>(vm.heap)) WebAssemblyFunction(vm, globalObject, structure);
+    function->finishCreation(vm, executable, length, name, instance, jsEntrypoint, wasmEntrypoint, signature);
+    return function;
+}
+
+Structure* WebAssemblyFunction::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    ASSERT(globalObject);
+    return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info());
+}
+
+WebAssemblyFunction::WebAssemblyFunction(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+    : Base(vm, globalObject, structure)
+{
+}
+
+void WebAssemblyFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    WebAssemblyFunction* thisObject = jsCast<WebAssemblyFunction*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_instance);
+    visitor.append(thisObject->m_jsEntrypoint);
+    visitor.append(thisObject->m_wasmEntrypoint);
+}
+
+void WebAssemblyFunction::finishCreation(VM& vm, NativeExecutable* executable, unsigned length, const String& name, JSWebAssemblyInstance* instance, JSWebAssemblyCallee* jsEntrypoint, JSWebAssemblyCallee* wasmEntrypoint, Wasm::Signature* signature)
+{
+    Base::finishCreation(vm, executable, length, name);
+    ASSERT(inherits(info()));
+    m_instance.set(vm, this, instance);
+    ASSERT(jsEntrypoint != wasmEntrypoint);
+    m_jsEntrypoint.set(vm, this, jsEntrypoint);
+    m_wasmEntrypoint.set(vm, this, wasmEntrypoint);
+    m_signature = signature;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyFunction.h b/wasm/js/WebAssemblyFunction.h
new file mode 100644
index 0000000..70d1a65
--- /dev/null
+++ b/wasm/js/WebAssemblyFunction.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSFunction.h"
+#include "JSWebAssemblyCallee.h"
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+
+class JSGlobalObject;
+struct ProtoCallFrame;
+class WebAssemblyInstance;
+
+namespace B3 {
+class Compilation;
+}
+
+namespace Wasm {
+struct Signature;
+}
+
+class WebAssemblyFunction : public JSFunction {
+public:
+    typedef JSFunction Base;
+
+    const static unsigned StructureFlags = Base::StructureFlags;
+
+    DECLARE_EXPORT_INFO;
+
+    JS_EXPORT_PRIVATE static WebAssemblyFunction* create(VM&, JSGlobalObject*, unsigned, const String&, JSWebAssemblyInstance*, JSWebAssemblyCallee* jsEntrypoint, JSWebAssemblyCallee* wasmEntrypoint, Wasm::Signature*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    JSWebAssemblyInstance* instance() const { return m_instance.get(); }
+    Wasm::Signature* signature()
+    { 
+        ASSERT(m_signature);
+        return m_signature;
+    }
+    EncodedJSValue call(VM&, ProtoCallFrame*);
+    void* wasmEntrypoint() { return m_wasmEntrypoint->entrypoint(); }
+
+protected:
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    void finishCreation(VM&, NativeExecutable*, unsigned length, const String& name, JSWebAssemblyInstance*, JSWebAssemblyCallee* jsEntrypoint, JSWebAssemblyCallee* wasmEntrypoint, Wasm::Signature*);
+
+private:
+    WebAssemblyFunction(VM&, JSGlobalObject*, Structure*);
+
+    WriteBarrier<JSWebAssemblyInstance> m_instance;
+    WriteBarrier<JSWebAssemblyCallee> m_jsEntrypoint;
+    WriteBarrier<JSWebAssemblyCallee> m_wasmEntrypoint;
+    Wasm::Signature* m_signature;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyFunctionCell.cpp b/wasm/js/WebAssemblyFunctionCell.cpp
new file mode 100644
index 0000000..e69de29
diff --git a/wasm/js/WebAssemblyFunctionCell.h b/wasm/js/WebAssemblyFunctionCell.h
new file mode 100644
index 0000000..e69de29
diff --git a/wasm/js/WebAssemblyInstanceConstructor.cpp b/wasm/js/WebAssemblyInstanceConstructor.cpp
new file mode 100644
index 0000000..9d95926
--- /dev/null
+++ b/wasm/js/WebAssemblyInstanceConstructor.cpp
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyInstanceConstructor.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+#include "JSModuleEnvironment.h"
+#include "JSModuleNamespaceObject.h"
+#include "JSWebAssemblyInstance.h"
+#include "JSWebAssemblyMemory.h"
+#include "JSWebAssemblyModule.h"
+#include "WebAssemblyFunction.h"
+#include "WebAssemblyInstancePrototype.h"
+#include "WebAssemblyModuleRecord.h"
+
+#include "WebAssemblyInstanceConstructor.lut.h"
+
+namespace JSC {
+
+static const bool verbose = false;
+
+const ClassInfo WebAssemblyInstanceConstructor::s_info = { "Function", &Base::s_info, &constructorTableWebAssemblyInstance, CREATE_METHOD_TABLE(WebAssemblyInstanceConstructor) };
+
+/* Source for WebAssemblyInstanceConstructor.lut.h
+ @begin constructorTableWebAssemblyInstance
+ @end
+ */
+
+static EncodedJSValue JSC_HOST_CALL constructJSWebAssemblyInstance(ExecState* exec)
+{
+    auto& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    auto* globalObject = exec->lexicalGlobalObject();
+
+    // If moduleObject is not a WebAssembly.Module instance, a TypeError is thrown.
+    JSWebAssemblyModule* jsModule = jsDynamicCast<JSWebAssemblyModule*>(exec->argument(0));
+    if (!jsModule)
+        return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("first argument to WebAssembly.Instance must be a WebAssembly.Module"), defaultSourceAppender, runtimeTypeForValue(exec->argument(0)))));
+    const Wasm::ModuleInformation& moduleInformation = jsModule->moduleInformation();
+
+    // If the importObject parameter is not undefined and Type(importObject) is not Object, a TypeError is thrown.
+    JSValue importArgument = exec->argument(1);
+    JSObject* importObject = importArgument.getObject();
+    if (!importArgument.isUndefined() && !importObject)
+        return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("second argument to WebAssembly.Instance must be undefined or an Object"), defaultSourceAppender, runtimeTypeForValue(importArgument))));
+
+    // If the list of module.imports is not empty and Type(importObject) is not Object, a TypeError is thrown.
+    if (moduleInformation.imports.size() && !importObject)
+        return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("second argument to WebAssembly.Instance must be Object because the WebAssembly.Module has imports"), defaultSourceAppender, runtimeTypeForValue(importArgument))));
+
+    Identifier moduleKey = Identifier::fromUid(PrivateName(PrivateName::Description, "WebAssemblyInstance"));
+    WebAssemblyModuleRecord* moduleRecord = WebAssemblyModuleRecord::create(exec, vm, globalObject->webAssemblyModuleRecordStructure(), moduleKey, moduleInformation);
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    Structure* instanceStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->WebAssemblyInstanceStructure());
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    JSWebAssemblyInstance* instance = JSWebAssemblyInstance::create(vm, instanceStructure, jsModule, moduleRecord->getModuleNamespace(exec));
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    // Let funcs, memories and tables be initially-empty lists of callable JavaScript objects, WebAssembly.Memory objects and WebAssembly.Table objects, respectively.
+    // Let imports be an initially-empty list of external values.
+    unsigned numImportFunctions = 0;
+    unsigned numImportGlobals = 0;
+
+    bool hasMemoryImport = false;
+    bool hasTableImport = false;
+    // For each import i in module.imports:
+    for (auto& import : moduleInformation.imports) {
+        // 1. Let o be the resultant value of performing Get(importObject, i.module_name).
+        JSValue importModuleValue = importObject->get(exec, import.module);
+        RETURN_IF_EXCEPTION(throwScope, { });
+        // 2. If Type(o) is not Object, throw a TypeError.
+        if (!importModuleValue.isObject())
+            return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("import must be an object"), defaultSourceAppender, runtimeTypeForValue(importModuleValue))));
+
+        // 3. Let v be the value of performing Get(o, i.item_name)
+        JSObject* object = jsCast<JSObject*>(importModuleValue);
+        JSValue value = object->get(exec, import.field);
+        RETURN_IF_EXCEPTION(throwScope, { });
+
+        switch (import.kind) {
+        case Wasm::ExternalKind::Function: {
+            // 4. If i is a function import:
+            // i. If IsCallable(v) is false, throw a TypeError.
+            if (!value.isFunction())
+                return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("import function must be callable"), defaultSourceAppender, runtimeTypeForValue(value))));
+            JSCell* cell = value.asCell();
+            // ii. If v is an Exported Function Exotic Object:
+            if (WebAssemblyFunction* importedExports = jsDynamicCast<WebAssemblyFunction*>(object)) {
+                // FIXME handle Function Exotic Object properly. https://bugs.webkit.org/show_bug.cgi?id=165282
+                // a. If the signature of v does not match the signature of i, throw a TypeError.
+                // b. Let closure be v.[[Closure]].
+                RELEASE_ASSERT_NOT_REACHED();
+                UNUSED_PARAM(importedExports);
+                break;
+            }
+            // iii. Otherwise:
+            // a. Let closure be a new host function of the given signature which calls v by coercing WebAssembly arguments to JavaScript arguments via ToJSValue and returns the result, if any, by coercing via ToWebAssemblyValue.
+            // Note: done as part of Plan compilation.
+            // iv. Append v to funcs.
+            instance->setImportFunction(vm, cell, numImportFunctions++);
+            // v. Append closure to imports.
+            break;
+        }
+        case Wasm::ExternalKind::Table: {
+            RELEASE_ASSERT(!hasTableImport); // This should be guaranteed by a validation failure.
+            // 7. Otherwise (i is a table import):
+            hasTableImport = true;
+            JSWebAssemblyTable* table = jsDynamicCast<JSWebAssemblyTable*>(value);
+            // i. If v is not a WebAssembly.Table object, throw a TypeError.
+            if (!table)
+                return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("Table import is not an instance of WebAssembly.Table"))));
+
+            uint32_t expectedInitial = moduleInformation.tableInformation.initial();
+            uint32_t actualInitial = table->size();
+            if (actualInitial < expectedInitial)
+                return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("Table import provided an 'initial' that is too small"))));
+
+            if (std::optional<uint32_t> expectedMaximum = moduleInformation.tableInformation.maximum()) {
+                std::optional<uint32_t> actualMaximum = table->maximum();
+                if (!actualMaximum) {
+                    return JSValue::encode(
+                        throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("Table import does not have a 'maximum' but the module requires that it does"))));
+                }
+                if (*actualMaximum > *expectedMaximum) {
+                    return JSValue::encode(
+                        throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("Imported Table's 'maximum' is larger than the module's expected 'maximum'"))));
+                }
+            }
+
+            // ii. Append v to tables.
+            // iii. Append v.[[Table]] to imports.
+            instance->setTable(vm, table);
+            break;
+        }
+        case Wasm::ExternalKind::Memory: {
+            // 6. If i is a memory import:
+            RELEASE_ASSERT(!hasMemoryImport); // This should be guaranteed by a validation failure.
+            RELEASE_ASSERT(moduleInformation.memory);
+            hasMemoryImport = true;
+            JSWebAssemblyMemory* memory = jsDynamicCast<JSWebAssemblyMemory*>(value);
+            // i. If v is not a WebAssembly.Memory object, throw a TypeError.
+            if (!memory)
+                return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("Memory import is not an instance of WebAssembly.Memory"))));
+
+            Wasm::PageCount expectedInitial = moduleInformation.memory.initial();
+            Wasm::PageCount actualInitial = memory->memory()->initial();
+            if (actualInitial < expectedInitial)
+                return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("Memory import provided an 'initial' that is too small"))));
+
+            if (Wasm::PageCount expectedMaximum = moduleInformation.memory.maximum()) {
+                Wasm::PageCount actualMaximum = memory->memory()->maximum();
+                if (!actualMaximum) {
+                    return JSValue::encode(
+                        throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("Memory import did not have a 'maximum' but the module requires that it does"))));
+                }
+
+                if (actualMaximum > expectedMaximum) {
+                    return JSValue::encode(
+                        throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("Memory imports 'maximum' is larger than the module's expected 'maximum"))));
+                }
+            }
+            // ii. Append v to memories.
+            // iii. Append v.[[Memory]] to imports.
+            instance->setMemory(vm, memory);
+            break;
+        }
+        case Wasm::ExternalKind::Global: {
+            // 5. If i is a global import:
+            // i. If i is not an immutable global, throw a TypeError.
+            ASSERT(moduleInformation.globals[import.kindIndex].mutability == Wasm::Global::Immutable);
+            // ii. If Type(v) is not Number, throw a TypeError.
+            if (!value.isNumber())
+                return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("imported global must be a number"), defaultSourceAppender, runtimeTypeForValue(value))));
+            // iii. Append ToWebAssemblyValue(v) to imports.
+            switch (moduleInformation.globals[import.kindIndex].type) {
+            case Wasm::I32:
+                instance->setGlobal(numImportGlobals++, value.toInt32(exec));
+                break;
+            case Wasm::F32:
+                instance->setGlobal(numImportGlobals++, bitwise_cast<uint32_t>(value.toFloat(exec)));
+                break;
+            case Wasm::F64:
+                instance->setGlobal(numImportGlobals++, bitwise_cast<uint64_t>(value.asNumber()));
+                break;
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+            ASSERT(!throwScope.exception());
+            break;
+        }
+        }
+    }
+
+    {
+        if (!!moduleInformation.memory && moduleInformation.memory.isImport()) {
+            // We should either have a Memory import or we should have thrown an exception.
+            RELEASE_ASSERT(hasMemoryImport);
+        }
+
+        if (moduleInformation.memory && !hasMemoryImport) {
+            RELEASE_ASSERT(!moduleInformation.memory.isImport());
+            // We create a memory when it's a memory definition.
+            std::unique_ptr<Wasm::Memory> memory = std::make_unique<Wasm::Memory>(moduleInformation.memory.initial(), moduleInformation.memory.maximum());
+            if (!memory->isValid())
+                return JSValue::encode(throwException(exec, throwScope, createOutOfMemoryError(exec)));
+            instance->setMemory(vm,
+               JSWebAssemblyMemory::create(vm, exec->lexicalGlobalObject()->WebAssemblyMemoryStructure(), WTFMove(memory)));
+        }
+    }
+
+    {
+        if (!!moduleInformation.tableInformation && moduleInformation.tableInformation.isImport()) {
+            // We should either have a Table import or we should have thrown an exception.
+            RELEASE_ASSERT(hasTableImport);
+        }
+
+        if (!!moduleInformation.tableInformation && !hasTableImport) {
+            RELEASE_ASSERT(!moduleInformation.tableInformation.isImport());
+            // We create a Table when it's a Table definition.
+            JSWebAssemblyTable* table = JSWebAssemblyTable::create(exec, vm, exec->lexicalGlobalObject()->WebAssemblyTableStructure(),
+                moduleInformation.tableInformation.initial(), moduleInformation.tableInformation.maximum());
+            // We should always be able to allocate a JSWebAssemblyTable we've defined.
+            // If it's defined to be too large, we should have thrown a validation error.
+            ASSERT(!throwScope.exception());
+            ASSERT(table); 
+            instance->setTable(vm, table);
+        }
+    }
+
+    // Globals
+    {
+        ASSERT(numImportGlobals == moduleInformation.firstInternalGlobal);
+        for (size_t globalIndex = numImportGlobals; globalIndex < moduleInformation.globals.size(); ++globalIndex) {
+            const auto& global = moduleInformation.globals[globalIndex];
+            ASSERT(global.initializationType != Wasm::Global::IsImport);
+            if (global.initializationType == Wasm::Global::FromGlobalImport) {
+                ASSERT(global.initialBitsOrImportNumber < numImportGlobals);
+                instance->setGlobal(globalIndex, instance->loadI64Global(global.initialBitsOrImportNumber));
+            } else
+                instance->setGlobal(globalIndex, global.initialBitsOrImportNumber);
+        }
+    }
+
+    moduleRecord->link(exec, instance);
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    if (verbose)
+        moduleRecord->dump();
+    JSValue startResult = moduleRecord->evaluate(exec);
+    UNUSED_PARAM(startResult);
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    return JSValue::encode(instance);
+}
+
+static EncodedJSValue JSC_HOST_CALL callJSWebAssemblyInstance(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(state, scope, "WebAssembly.Instance"));
+}
+
+WebAssemblyInstanceConstructor* WebAssemblyInstanceConstructor::create(VM& vm, Structure* structure, WebAssemblyInstancePrototype* thisPrototype)
+{
+    auto* constructor = new (NotNull, allocateCell<WebAssemblyInstanceConstructor>(vm.heap)) WebAssemblyInstanceConstructor(vm, structure);
+    constructor->finishCreation(vm, thisPrototype);
+    return constructor;
+}
+
+Structure* WebAssemblyInstanceConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyInstanceConstructor::finishCreation(VM& vm, WebAssemblyInstancePrototype* prototype)
+{
+    Base::finishCreation(vm, ASCIILiteral("Instance"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+}
+
+WebAssemblyInstanceConstructor::WebAssemblyInstanceConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+ConstructType WebAssemblyInstanceConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructJSWebAssemblyInstance;
+    return ConstructType::Host;
+}
+
+CallType WebAssemblyInstanceConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callJSWebAssemblyInstance;
+    return CallType::Host;
+}
+
+void WebAssemblyInstanceConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    auto* thisObject = jsCast<WebAssemblyInstanceConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
+
diff --git a/wasm/js/WebAssemblyInstanceConstructor.h b/wasm/js/WebAssemblyInstanceConstructor.h
new file mode 100644
index 0000000..2e857cf
--- /dev/null
+++ b/wasm/js/WebAssemblyInstanceConstructor.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "InternalFunction.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyInstancePrototype;
+
+class WebAssemblyInstanceConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyInstanceConstructor* create(VM&, Structure*, WebAssemblyInstancePrototype*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, WebAssemblyInstancePrototype*);
+
+private:
+    WebAssemblyInstanceConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyInstancePrototype.cpp b/wasm/js/WebAssemblyInstancePrototype.cpp
new file mode 100644
index 0000000..4777a61
--- /dev/null
+++ b/wasm/js/WebAssemblyInstancePrototype.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyInstancePrototype.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+
+#include "WebAssemblyInstancePrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyInstancePrototype::s_info = { "WebAssembly.Instance.prototype", &Base::s_info, &prototypeTableWebAssemblyInstance, CREATE_METHOD_TABLE(WebAssemblyInstancePrototype) };
+
+/* Source for WebAssemblyInstancePrototype.lut.h
+ @begin prototypeTableWebAssemblyInstance
+ @end
+ */
+
+WebAssemblyInstancePrototype* WebAssemblyInstancePrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    auto* object = new (NotNull, allocateCell<WebAssemblyInstancePrototype>(vm.heap)) WebAssemblyInstancePrototype(vm, structure);
+    object->finishCreation(vm);
+    return object;
+}
+
+Structure* WebAssemblyInstancePrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyInstancePrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+WebAssemblyInstancePrototype::WebAssemblyInstancePrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyInstancePrototype.h b/wasm/js/WebAssemblyInstancePrototype.h
new file mode 100644
index 0000000..ebdbe98
--- /dev/null
+++ b/wasm/js/WebAssemblyInstancePrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyInstancePrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyInstancePrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    WebAssemblyInstancePrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyMemoryConstructor.cpp b/wasm/js/WebAssemblyMemoryConstructor.cpp
new file mode 100644
index 0000000..f4b4103
--- /dev/null
+++ b/wasm/js/WebAssemblyMemoryConstructor.cpp
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyMemoryConstructor.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyHelpers.h"
+#include "JSWebAssemblyMemory.h"
+#include "WasmMemory.h"
+#include "WasmPageCount.h"
+#include "WebAssemblyMemoryPrototype.h"
+#include <wtf/Optional.h>
+
+#include "WebAssemblyMemoryConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyMemoryConstructor::s_info = { "Function", &Base::s_info, &constructorTableWebAssemblyMemory, CREATE_METHOD_TABLE(WebAssemblyMemoryConstructor) };
+
+/* Source for WebAssemblyMemoryConstructor.lut.h
+ @begin constructorTableWebAssemblyMemory
+ @end
+ */
+
+static EncodedJSValue JSC_HOST_CALL constructJSWebAssemblyMemory(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    if (exec->argumentCount() != 1)
+        return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("WebAssembly.Memory expects exactly one argument"))));
+
+    JSObject* memoryDescriptor;
+    {
+        JSValue argument = exec->argument(0);
+        if (!argument.isObject())
+            return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("WebAssembly.Memory expects its first argument to be an object"))));
+        memoryDescriptor = jsCast<JSObject*>(argument);
+    }
+
+    Wasm::PageCount initialPageCount;
+    {
+        Identifier initial = Identifier::fromString(&vm, "initial");
+        JSValue minSizeValue = memoryDescriptor->get(exec, initial);
+        RETURN_IF_EXCEPTION(throwScope, { });
+        uint32_t size = toNonWrappingUint32(exec, minSizeValue);
+        RETURN_IF_EXCEPTION(throwScope, { });
+        if (!Wasm::PageCount::isValid(size))
+            return JSValue::encode(throwException(exec, throwScope, createRangeError(exec, ASCIILiteral("WebAssembly.Memory 'initial' page count is too large"))));
+        initialPageCount = Wasm::PageCount(size);
+    }
+
+    Wasm::PageCount maximumPageCount;
+    {
+        Identifier maximum = Identifier::fromString(&vm, "maximum");
+        bool hasProperty = memoryDescriptor->hasProperty(exec, maximum);
+        RETURN_IF_EXCEPTION(throwScope, { });
+        if (hasProperty) {
+            JSValue maxSizeValue = memoryDescriptor->get(exec, maximum);
+            RETURN_IF_EXCEPTION(throwScope, { });
+            uint32_t size = toNonWrappingUint32(exec, maxSizeValue);
+            RETURN_IF_EXCEPTION(throwScope, { });
+            if (!Wasm::PageCount::isValid(size))
+                return JSValue::encode(throwException(exec, throwScope, createRangeError(exec, ASCIILiteral("WebAssembly.Memory 'maximum' page count is too large"))));
+            maximumPageCount = Wasm::PageCount(size);
+
+            if (initialPageCount > maximumPageCount) {
+                return JSValue::encode(throwException(exec, throwScope,
+                    createRangeError(exec, ASCIILiteral("'maximum' page count must be than greater than or equal to the 'initial' page count"))));
+            }
+        }
+    }
+
+    std::unique_ptr<Wasm::Memory> memory = std::make_unique<Wasm::Memory>(initialPageCount, maximumPageCount);
+    if (!memory->isValid())
+        return JSValue::encode(throwException(exec, throwScope, createOutOfMemoryError(exec)));
+
+    return JSValue::encode(JSWebAssemblyMemory::create(vm, exec->lexicalGlobalObject()->WebAssemblyMemoryStructure(), WTFMove(memory)));
+}
+
+static EncodedJSValue JSC_HOST_CALL callJSWebAssemblyMemory(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(state, throwScope, "WebAssembly.Memory"));
+}
+
+WebAssemblyMemoryConstructor* WebAssemblyMemoryConstructor::create(VM& vm, Structure* structure, WebAssemblyMemoryPrototype* thisPrototype)
+{
+    auto* constructor = new (NotNull, allocateCell<WebAssemblyMemoryConstructor>(vm.heap)) WebAssemblyMemoryConstructor(vm, structure);
+    constructor->finishCreation(vm, thisPrototype);
+    return constructor;
+}
+
+Structure* WebAssemblyMemoryConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyMemoryConstructor::finishCreation(VM& vm, WebAssemblyMemoryPrototype* prototype)
+{
+    Base::finishCreation(vm, ASCIILiteral("Memory"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+}
+
+WebAssemblyMemoryConstructor::WebAssemblyMemoryConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+ConstructType WebAssemblyMemoryConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructJSWebAssemblyMemory;
+    return ConstructType::Host;
+}
+
+CallType WebAssemblyMemoryConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callJSWebAssemblyMemory;
+    return CallType::Host;
+}
+
+void WebAssemblyMemoryConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    auto* thisObject = jsCast<WebAssemblyMemoryConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
+
diff --git a/wasm/js/WebAssemblyMemoryConstructor.h b/wasm/js/WebAssemblyMemoryConstructor.h
new file mode 100644
index 0000000..4660693
--- /dev/null
+++ b/wasm/js/WebAssemblyMemoryConstructor.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "InternalFunction.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyMemoryPrototype;
+
+class WebAssemblyMemoryConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyMemoryConstructor* create(VM&, Structure*, WebAssemblyMemoryPrototype*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, WebAssemblyMemoryPrototype*);
+
+private:
+    WebAssemblyMemoryConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyMemoryPrototype.cpp b/wasm/js/WebAssemblyMemoryPrototype.cpp
new file mode 100644
index 0000000..803824b
--- /dev/null
+++ b/wasm/js/WebAssemblyMemoryPrototype.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyMemoryPrototype.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSArrayBuffer.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyMemory.h"
+
+#include "WebAssemblyMemoryPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyMemoryPrototype::s_info = { "WebAssembly.Memory.prototype", &Base::s_info, &prototypeTableWebAssemblyMemory, CREATE_METHOD_TABLE(WebAssemblyMemoryPrototype) };
+
+/* Source for WebAssemblyMemoryPrototype.lut.h
+ @begin prototypeTableWebAssemblyMemory
+ @end
+ */
+
+static EncodedJSValue JSC_HOST_CALL webAssemblyMemoryProtoFuncBuffer(ExecState*);
+
+EncodedJSValue JSC_HOST_CALL webAssemblyMemoryProtoFuncBuffer(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    JSWebAssemblyMemory* memory = jsDynamicCast<JSWebAssemblyMemory*>(exec->thisValue()); 
+    if (!memory) {
+        return JSValue::encode(throwException(exec, throwScope, 
+                    createTypeError(exec, ASCIILiteral("WebAssembly.Memory.prototype.buffer getter called with non WebAssembly.Memory |this| value"))));
+    }
+    return JSValue::encode(memory->buffer(exec->vm(), exec->lexicalGlobalObject()));
+}
+
+WebAssemblyMemoryPrototype* WebAssemblyMemoryPrototype::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    auto* object = new (NotNull, allocateCell<WebAssemblyMemoryPrototype>(vm.heap)) WebAssemblyMemoryPrototype(vm, structure);
+    object->finishCreation(vm, globalObject);
+    return object;
+}
+
+Structure* WebAssemblyMemoryPrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyMemoryPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    JSC_NATIVE_GETTER("buffer", webAssemblyMemoryProtoFuncBuffer, DontEnum | Accessor);
+}
+
+WebAssemblyMemoryPrototype::WebAssemblyMemoryPrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyMemoryPrototype.h b/wasm/js/WebAssemblyMemoryPrototype.h
new file mode 100644
index 0000000..f061fcd
--- /dev/null
+++ b/wasm/js/WebAssemblyMemoryPrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyMemoryPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyMemoryPrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+
+private:
+    WebAssemblyMemoryPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyModuleConstructor.cpp b/wasm/js/WebAssemblyModuleConstructor.cpp
new file mode 100644
index 0000000..de8f4a3
--- /dev/null
+++ b/wasm/js/WebAssemblyModuleConstructor.cpp
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyModuleConstructor.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "ExceptionHelpers.h"
+#include "FunctionPrototype.h"
+#include "JSArrayBuffer.h"
+#include "JSCInlines.h"
+#include "JSTypedArrays.h"
+#include "JSWebAssemblyCallee.h"
+#include "JSWebAssemblyCompileError.h"
+#include "JSWebAssemblyModule.h"
+#include "SymbolTable.h"
+#include "WasmPlan.h"
+#include "WebAssemblyModulePrototype.h"
+#include <wtf/StdLibExtras.h>
+
+#include "WebAssemblyModuleConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyModuleConstructor::s_info = { "Function", &Base::s_info, &constructorTableWebAssemblyModule, CREATE_METHOD_TABLE(WebAssemblyModuleConstructor) };
+
+/* Source for WebAssemblyModuleConstructor.lut.h
+ @begin constructorTableWebAssemblyModule
+ @end
+ */
+
+static EncodedJSValue JSC_HOST_CALL constructJSWebAssemblyModule(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue val = state->argument(0);
+
+    // If the given bytes argument is not a BufferSource, a TypeError exception is thrown.
+    JSArrayBuffer* arrayBuffer = val.getObject() ? jsDynamicCast<JSArrayBuffer*>(val.getObject()) : nullptr;
+    JSArrayBufferView* arrayBufferView = val.getObject() ? jsDynamicCast<JSArrayBufferView*>(val.getObject()) : nullptr;
+    if (!(arrayBuffer || arrayBufferView))
+        return JSValue::encode(throwException(state, scope, createTypeError(state, ASCIILiteral("first argument to WebAssembly.Module must be an ArrayBufferView or an ArrayBuffer"), defaultSourceAppender, runtimeTypeForValue(val))));
+
+    if (arrayBufferView ? arrayBufferView->isNeutered() : arrayBuffer->impl()->isNeutered())
+        return JSValue::encode(throwException(state, scope, createTypeError(state, ASCIILiteral("underlying TypedArray has been detatched from the ArrayBuffer"), defaultSourceAppender, runtimeTypeForValue(val))));
+
+    size_t byteOffset = arrayBufferView ? arrayBufferView->byteOffset() : 0;
+    size_t byteSize = arrayBufferView ? arrayBufferView->length() : arrayBuffer->impl()->byteLength();
+    const auto* base = arrayBufferView ? static_cast<uint8_t*>(arrayBufferView->vector()) : static_cast<uint8_t*>(arrayBuffer->impl()->data());
+
+    Wasm::Plan plan(&vm, base + byteOffset, byteSize);
+    // On failure, a new WebAssembly.CompileError is thrown.
+    plan.run();
+    if (plan.failed())
+        return JSValue::encode(throwException(state, scope, createWebAssemblyCompileError(state, plan.errorMessage())));
+
+    // On success, a new WebAssembly.Module object is returned with [[Module]] set to the validated Ast.module.
+    auto* structure = InternalFunction::createSubclassStructure(state, state->newTarget(), asInternalFunction(state->jsCallee())->globalObject()->WebAssemblyModuleStructure());
+    RETURN_IF_EXCEPTION(scope, { });
+
+    // The export symbol table is the same for all Instances of a Module.
+    SymbolTable* exportSymbolTable = SymbolTable::create(vm);
+    for (auto& exp : plan.exports()) {
+        auto offset = exportSymbolTable->takeNextScopeOffset(NoLockingNecessary);
+        exportSymbolTable->set(NoLockingNecessary, exp.field.impl(), SymbolTableEntry(VarOffset(offset)));
+    }
+
+    // Only wasm-internal functions have a callee, stubs to JS do not.
+    unsigned calleeCount = plan.internalFunctionCount();
+    JSWebAssemblyModule* result = JSWebAssemblyModule::create(vm, structure, plan.takeModuleInformation(), plan.takeCallLinkInfos(), plan.takeWasmToJSStubs(), plan.takeFunctionIndexSpace(), exportSymbolTable, calleeCount);
+    plan.initializeCallees(state->jsCallee()->globalObject(), 
+        [&] (unsigned calleeIndex, JSWebAssemblyCallee* jsEntrypointCallee, JSWebAssemblyCallee* wasmEntrypointCallee) {
+            result->setJSEntrypointCallee(vm, calleeIndex, jsEntrypointCallee);
+            result->setWasmEntrypointCallee(vm, calleeIndex, wasmEntrypointCallee);
+        });
+    return JSValue::encode(result);
+}
+
+static EncodedJSValue JSC_HOST_CALL callJSWebAssemblyModule(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(state, scope, "WebAssembly.Module"));
+}
+
+WebAssemblyModuleConstructor* WebAssemblyModuleConstructor::create(VM& vm, Structure* structure, WebAssemblyModulePrototype* thisPrototype)
+{
+    auto* constructor = new (NotNull, allocateCell<WebAssemblyModuleConstructor>(vm.heap)) WebAssemblyModuleConstructor(vm, structure);
+    constructor->finishCreation(vm, thisPrototype);
+    return constructor;
+}
+
+Structure* WebAssemblyModuleConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyModuleConstructor::finishCreation(VM& vm, WebAssemblyModulePrototype* prototype)
+{
+    Base::finishCreation(vm, ASCIILiteral("Module"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+}
+
+WebAssemblyModuleConstructor::WebAssemblyModuleConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+ConstructType WebAssemblyModuleConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructJSWebAssemblyModule;
+    return ConstructType::Host;
+}
+
+CallType WebAssemblyModuleConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callJSWebAssemblyModule;
+    return CallType::Host;
+}
+
+void WebAssemblyModuleConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    auto* thisObject = jsCast<WebAssemblyModuleConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
+
diff --git a/wasm/js/WebAssemblyModuleConstructor.h b/wasm/js/WebAssemblyModuleConstructor.h
new file mode 100644
index 0000000..e45f1a1
--- /dev/null
+++ b/wasm/js/WebAssemblyModuleConstructor.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "InternalFunction.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyModulePrototype;
+
+class WebAssemblyModuleConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyModuleConstructor* create(VM&, Structure*, WebAssemblyModulePrototype*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, WebAssemblyModulePrototype*);
+
+private:
+    WebAssemblyModuleConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyModulePrototype.cpp b/wasm/js/WebAssemblyModulePrototype.cpp
new file mode 100644
index 0000000..2bb2b5e
--- /dev/null
+++ b/wasm/js/WebAssemblyModulePrototype.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyModulePrototype.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+
+#include "WebAssemblyModulePrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyModulePrototype::s_info = { "WebAssembly.Module.prototype", &Base::s_info, &prototypeTableWebAssemblyModule, CREATE_METHOD_TABLE(WebAssemblyModulePrototype) };
+
+/* Source for WebAssemblyModulePrototype.lut.h
+ @begin prototypeTableWebAssemblyModule
+ @end
+ */
+
+WebAssemblyModulePrototype* WebAssemblyModulePrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    auto* object = new (NotNull, allocateCell<WebAssemblyModulePrototype>(vm.heap)) WebAssemblyModulePrototype(vm, structure);
+    object->finishCreation(vm);
+    return object;
+}
+
+Structure* WebAssemblyModulePrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyModulePrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+WebAssemblyModulePrototype::WebAssemblyModulePrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyModulePrototype.h b/wasm/js/WebAssemblyModulePrototype.h
new file mode 100644
index 0000000..d5b6279
--- /dev/null
+++ b/wasm/js/WebAssemblyModulePrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyModulePrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyModulePrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    WebAssemblyModulePrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyModuleRecord.cpp b/wasm/js/WebAssemblyModuleRecord.cpp
new file mode 100644
index 0000000..8b79029
--- /dev/null
+++ b/wasm/js/WebAssemblyModuleRecord.cpp
@@ -0,0 +1,285 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyModuleRecord.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "Error.h"
+#include "JSCInlines.h"
+#include "JSLexicalEnvironment.h"
+#include "JSModuleEnvironment.h"
+#include "JSWebAssemblyInstance.h"
+#include "JSWebAssemblyModule.h"
+#include "ProtoCallFrame.h"
+#include "WasmFormat.h"
+#include "WebAssemblyFunction.h"
+#include <limits>
+
+namespace JSC {
+
+const ClassInfo WebAssemblyModuleRecord::s_info = { "WebAssemblyModuleRecord", &Base::s_info, nullptr, CREATE_METHOD_TABLE(WebAssemblyModuleRecord) };
+
+Structure* WebAssemblyModuleRecord::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+WebAssemblyModuleRecord* WebAssemblyModuleRecord::create(ExecState* exec, VM& vm, Structure* structure, const Identifier& moduleKey, const Wasm::ModuleInformation& moduleInformation)
+{
+    WebAssemblyModuleRecord* instance = new (NotNull, allocateCell<WebAssemblyModuleRecord>(vm.heap)) WebAssemblyModuleRecord(vm, structure, moduleKey);
+    instance->finishCreation(exec, vm, moduleInformation);
+    return instance;
+}
+
+WebAssemblyModuleRecord::WebAssemblyModuleRecord(VM& vm, Structure* structure, const Identifier& moduleKey)
+    : Base(vm, structure, moduleKey)
+{
+}
+
+void WebAssemblyModuleRecord::destroy(JSCell* cell)
+{
+    WebAssemblyModuleRecord* thisObject = static_cast<WebAssemblyModuleRecord*>(cell);
+    thisObject->WebAssemblyModuleRecord::~WebAssemblyModuleRecord();
+}
+
+void WebAssemblyModuleRecord::finishCreation(ExecState* exec, VM& vm, const Wasm::ModuleInformation& moduleInformation)
+{
+    Base::finishCreation(exec, vm);
+    ASSERT(inherits(info()));
+    for (const auto& exp : moduleInformation.exports)
+        addExportEntry(ExportEntry::createLocal(exp.field, exp.field));
+}
+
+void WebAssemblyModuleRecord::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    WebAssemblyModuleRecord* thisObject = jsCast<WebAssemblyModuleRecord*>(cell);
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(thisObject->m_instance);
+    visitor.append(thisObject->m_startFunction);
+}
+
+void WebAssemblyModuleRecord::link(ExecState* state, JSWebAssemblyInstance* instance)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(scope);
+    auto* globalObject = state->lexicalGlobalObject();
+
+    JSWebAssemblyModule* module = instance->module();
+    const Wasm::ModuleInformation& moduleInformation = module->moduleInformation();
+
+    bool hasStart = !!moduleInformation.startFunctionIndexSpace;
+    auto startFunctionIndexSpace = moduleInformation.startFunctionIndexSpace.value_or(0);
+
+    SymbolTable* exportSymbolTable = module->exportSymbolTable();
+    unsigned importCount = module->importCount();
+
+    // FIXME wire up the imports. https://bugs.webkit.org/show_bug.cgi?id=165118
+
+    // Let exports be a list of (string, JS value) pairs that is mapped from each external value e in instance.exports as follows:
+    JSModuleEnvironment* moduleEnvironment = JSModuleEnvironment::create(vm, globalObject, nullptr, exportSymbolTable, JSValue(), this);
+    for (const auto& exp : moduleInformation.exports) {
+        JSValue exportedValue;
+        switch (exp.kind) {
+        case Wasm::ExternalKind::Function: {
+            // 1. If e is a closure c:
+            //   i. If there is an Exported Function Exotic Object func in funcs whose func.[[Closure]] equals c, then return func.
+            //   ii. (Note: At most one wrapper is created for any closure, so func is unique, even if there are multiple occurrances in the list. Moreover, if the item was an import that is already an Exported Function Exotic Object, then the original function object will be found. For imports that are regular JS functions, a new wrapper will be created.)
+            if (exp.kindIndex < importCount) {
+                // FIXME Implement re-exporting an import. https://bugs.webkit.org/show_bug.cgi?id=165510
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+            //   iii. Otherwise:
+            //     a. Let func be an Exported Function Exotic Object created from c.
+            //     b. Append func to funcs.
+            //     c. Return func.
+            JSWebAssemblyCallee* jsEntrypointCallee = module->jsEntrypointCalleeFromFunctionIndexSpace(exp.kindIndex);
+            JSWebAssemblyCallee* wasmEntrypointCallee = module->wasmEntrypointCalleeFromFunctionIndexSpace(exp.kindIndex);
+            Wasm::Signature* signature = module->signatureForFunctionIndexSpace(exp.kindIndex);
+            WebAssemblyFunction* function = WebAssemblyFunction::create(vm, globalObject, signature->arguments.size(), exp.field.string(), instance, jsEntrypointCallee, wasmEntrypointCallee, signature);
+            exportedValue = function;
+            if (hasStart && startFunctionIndexSpace == exp.kindIndex)
+                m_startFunction.set(vm, this, function);
+            break;
+        }
+        case Wasm::ExternalKind::Table: {
+            // This should be guaranteed by module verification.
+            RELEASE_ASSERT(instance->table()); 
+            ASSERT(exp.kindIndex == 0);
+
+            exportedValue = instance->table();
+            break;
+        }
+        case Wasm::ExternalKind::Memory: {
+            // This should be guaranteed by module verification.
+            RELEASE_ASSERT(instance->memory()); 
+            ASSERT(exp.kindIndex == 0);
+
+            exportedValue = instance->memory();
+            break;
+        }
+        case Wasm::ExternalKind::Global: {
+            // Assert: the global is immutable by MVP validation constraint.
+            const Wasm::Global& global = moduleInformation.globals[exp.kindIndex];
+            ASSERT(global.mutability == Wasm::Global::Immutable);
+            // Return ToJSValue(v).
+            switch (global.type) {
+            case Wasm::I32:
+                exportedValue = JSValue(instance->loadI32Global(exp.kindIndex));
+                break;
+
+            case Wasm::F32:
+                exportedValue = JSValue(instance->loadF32Global(exp.kindIndex));
+                break;
+
+            case Wasm::F64:
+                exportedValue = JSValue(instance->loadF64Global(exp.kindIndex));
+                break;
+
+            default:
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+            break;
+        }
+        }
+
+        bool shouldThrowReadOnlyError = false;
+        bool ignoreReadOnlyErrors = true;
+        bool putResult = false;
+        symbolTablePutTouchWatchpointSet(moduleEnvironment, state, exp.field, exportedValue, shouldThrowReadOnlyError, ignoreReadOnlyErrors, putResult);
+        RELEASE_ASSERT(putResult);
+    }
+
+    if (hasStart) {
+        Wasm::Signature* signature = module->signatureForFunctionIndexSpace(startFunctionIndexSpace);
+        // The start function must not take any arguments or return anything. This is enforced by the parser.
+        ASSERT(!signature->arguments.size());
+        ASSERT(signature->returnType == Wasm::Void);
+        // FIXME can start call imports / tables? This assumes not. https://github.com/WebAssembly/design/issues/896
+        if (!m_startFunction.get()) {
+            // The start function wasn't added above. It must be a purely internal function.
+            JSWebAssemblyCallee* jsEntrypointCallee = module->jsEntrypointCalleeFromFunctionIndexSpace(startFunctionIndexSpace);
+            JSWebAssemblyCallee* wasmEntrypointCallee = module->wasmEntrypointCalleeFromFunctionIndexSpace(startFunctionIndexSpace);
+            WebAssemblyFunction* function = WebAssemblyFunction::create(vm, globalObject, signature->arguments.size(), "start", instance, jsEntrypointCallee, wasmEntrypointCallee, signature);
+            m_startFunction.set(vm, this, function);
+        }
+    }
+
+    RELEASE_ASSERT(!m_instance);
+    m_instance.set(vm, this, instance);
+    m_moduleEnvironment.set(vm, this, moduleEnvironment);
+}
+
+template <typename Scope, typename N, typename ...Args>
+NEVER_INLINE static JSValue dataSegmentFail(ExecState* state, Scope& scope, N memorySize, N segmentSize, N offset, Args... args)
+{
+    return throwException(state, scope, createRangeError(state, makeString(ASCIILiteral("Invalid data segment initialization: segment of "), String::number(segmentSize), ASCIILiteral(" bytes memory of "), String::number(memorySize), ASCIILiteral(" bytes, at offset "), String::number(offset), args...)));
+}
+
+JSValue WebAssemblyModuleRecord::evaluate(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    {
+        JSWebAssemblyModule* module = m_instance->module();
+        const Wasm::ModuleInformation& moduleInformation = module->moduleInformation();
+        JSWebAssemblyTable* table = m_instance->table();
+        for (const Wasm::Element& element : moduleInformation.elements) {
+            // It should be a validation error to have any elements without a table.
+            // Also, it could be that a table wasn't imported, or that the table
+            // imported wasn't compatible. However, those should error out before
+            // getting here.
+            ASSERT(!!table);
+            if (!element.functionIndices.size())
+                continue;
+
+            uint32_t tableIndex = element.offset;
+            uint64_t lastWrittenIndex = static_cast<uint64_t>(tableIndex) + static_cast<uint64_t>(element.functionIndices.size()) - 1;
+            if (lastWrittenIndex >= table->size())
+                return JSValue::decode(throwVMRangeError(state, scope, ASCIILiteral("Element is trying to set an out of bounds table index")));
+
+            for (uint32_t i = 0; i < element.functionIndices.size(); ++i) {
+                // FIXME: This essentially means we're exporting an import.
+                // We need a story here. We need to create a WebAssemblyFunction
+                // for the import.
+                // https://bugs.webkit.org/show_bug.cgi?id=165510
+                uint32_t functionIndex = element.functionIndices[i];
+                if (functionIndex < module->importCount()) {
+                    return JSValue::decode(
+                        throwVMRangeError(state, scope, ASCIILiteral("Element is setting the table value with an import. This is not yet implemented. FIXME.")));
+                }
+
+                JSWebAssemblyCallee* jsEntrypointCallee = module->jsEntrypointCalleeFromFunctionIndexSpace(functionIndex);
+                JSWebAssemblyCallee* wasmEntrypointCallee = module->wasmEntrypointCalleeFromFunctionIndexSpace(functionIndex);
+                Wasm::Signature* signature = module->signatureForFunctionIndexSpace(functionIndex);
+                // FIXME: Say we export local function "foo" at funciton index 0.
+                // What if we also set it to the table an Element w/ index 0.
+                // Does (new Instance(...)).exports.foo === table.get(0)?
+                // https://bugs.webkit.org/show_bug.cgi?id=165825
+                WebAssemblyFunction* function = WebAssemblyFunction::create(
+                    vm, m_instance->globalObject(), signature->arguments.size(), String(), m_instance.get(), jsEntrypointCallee, wasmEntrypointCallee, signature);
+
+                table->setFunction(vm, tableIndex, function);
+                ++tableIndex;
+            }
+        }
+    }
+
+    {
+        const Vector<Wasm::Segment::Ptr>& data = m_instance->module()->moduleInformation().data;
+        JSWebAssemblyMemory* jsMemory = m_instance->memory();
+        if (!data.isEmpty()) {
+            RELEASE_ASSERT(jsMemory); // It is a validation error for a Data section to exist without a Memory section or import.
+            uint8_t* memory = reinterpret_cast<uint8_t*>(jsMemory->memory()->memory());
+            RELEASE_ASSERT(memory);
+            auto sizeInBytes = jsMemory->memory()->size();
+            for (auto& segment : data) {
+                if (segment->sizeInBytes) {
+                    if (UNLIKELY(sizeInBytes < segment->sizeInBytes))
+                        return dataSegmentFail(state, scope, sizeInBytes, segment->sizeInBytes, segment->offset, ASCIILiteral(", segment is too big"));
+                    if (UNLIKELY(segment->offset > sizeInBytes - segment->sizeInBytes))
+                        return dataSegmentFail(state, scope, sizeInBytes, segment->sizeInBytes, segment->offset, ASCIILiteral(", segment writes outside of memory"));
+                    memcpy(memory + segment->offset, &segment->byte(0), segment->sizeInBytes);
+                }
+            }
+        }
+    }
+
+    if (WebAssemblyFunction* startFunction = m_startFunction.get()) {
+        ProtoCallFrame protoCallFrame;
+        protoCallFrame.init(nullptr, startFunction, JSValue(), 1, nullptr);
+        startFunction->call(vm, &protoCallFrame);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
+
+    return jsUndefined();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyModuleRecord.h b/wasm/js/WebAssemblyModuleRecord.h
new file mode 100644
index 0000000..4e70e79
--- /dev/null
+++ b/wasm/js/WebAssemblyModuleRecord.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "AbstractModuleRecord.h"
+#include "WasmFormat.h"
+
+namespace JSC {
+
+class JSWebAssemblyInstance;
+class WebAssemblyFunction;
+
+// Based on the WebAssembly.Instance specification
+// https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-constructor
+class WebAssemblyModuleRecord : public AbstractModuleRecord {
+    friend class LLIntOffsetsExtractor;
+public:
+    typedef AbstractModuleRecord Base;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+    static WebAssemblyModuleRecord* create(ExecState*, VM&, Structure*, const Identifier&, const Wasm::ModuleInformation&);
+
+    void link(ExecState*, JSWebAssemblyInstance*);
+    JS_EXPORT_PRIVATE JSValue evaluate(ExecState*);
+
+private:
+    WebAssemblyModuleRecord(VM&, Structure*, const Identifier&);
+
+    void finishCreation(ExecState*, VM&, const Wasm::ModuleInformation&);
+    static void destroy(JSCell*);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<JSWebAssemblyInstance> m_instance;
+    WriteBarrier<WebAssemblyFunction> m_startFunction;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyPrototype.cpp b/wasm/js/WebAssemblyPrototype.cpp
new file mode 100644
index 0000000..2d4e004
--- /dev/null
+++ b/wasm/js/WebAssemblyPrototype.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyPrototype.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+static EncodedJSValue JSC_HOST_CALL webAssemblyFunctionValidate(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwException(state, scope, createError(state, ASCIILiteral("WebAssembly doesn't yet implement the validate function property"))));
+}
+
+static EncodedJSValue JSC_HOST_CALL webAssemblyFunctionCompile(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwException(state, scope, createError(state, ASCIILiteral("WebAssembly doesn't yet implement the compile function property"))));
+}
+
+}
+
+#include "WebAssemblyPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyPrototype::s_info = { "WebAssembly.prototype", &Base::s_info, &prototypeTableWebAssembly, CREATE_METHOD_TABLE(WebAssemblyPrototype) };
+
+/* Source for WebAssemblyPrototype.lut.h
+ @begin prototypeTableWebAssembly
+ validate webAssemblyFunctionValidate  DontEnum|Function 1
+ compile  webAssemblyFunctionCompile   DontEnum|Function 1
+ @end
+ */
+
+WebAssemblyPrototype* WebAssemblyPrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    auto* object = new (NotNull, allocateCell<WebAssemblyPrototype>(vm.heap)) WebAssemblyPrototype(vm, structure);
+    object->finishCreation(vm);
+    return object;
+}
+
+Structure* WebAssemblyPrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyPrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+WebAssemblyPrototype::WebAssemblyPrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyPrototype.h b/wasm/js/WebAssemblyPrototype.h
new file mode 100644
index 0000000..287d5a5
--- /dev/null
+++ b/wasm/js/WebAssemblyPrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyPrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    WebAssemblyPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp b/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp
new file mode 100644
index 0000000..7ef102e
--- /dev/null
+++ b/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyRuntimeErrorConstructor.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyRuntimeError.h"
+#include "WebAssemblyRuntimeErrorPrototype.h"
+
+#include "WebAssemblyRuntimeErrorConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyRuntimeErrorConstructor::s_info = { "Function", &Base::s_info, &constructorTableWebAssemblyRuntimeError, CREATE_METHOD_TABLE(WebAssemblyRuntimeErrorConstructor) };
+
+/* Source for WebAssemblyRuntimeErrorConstructor.lut.h
+ @begin constructorTableWebAssemblyRuntimeError
+ @end
+ */
+
+static EncodedJSValue JSC_HOST_CALL constructJSWebAssemblyRuntimeError(ExecState* state)
+{
+    auto& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSValue message = state->argument(0);
+    auto* structure = InternalFunction::createSubclassStructure(state, state->newTarget(), asInternalFunction(state->jsCallee())->globalObject()->WebAssemblyRuntimeErrorStructure());
+    RETURN_IF_EXCEPTION(scope, { });
+    return JSValue::encode(JSWebAssemblyRuntimeError::create(state, structure, message, false));
+}
+
+static EncodedJSValue JSC_HOST_CALL callJSWebAssemblyRuntimeError(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(state, scope, "WebAssembly.RuntimeError"));
+}
+
+WebAssemblyRuntimeErrorConstructor* WebAssemblyRuntimeErrorConstructor::create(VM& vm, Structure* structure, WebAssemblyRuntimeErrorPrototype* thisPrototype)
+{
+    auto* constructor = new (NotNull, allocateCell<WebAssemblyRuntimeErrorConstructor>(vm.heap)) WebAssemblyRuntimeErrorConstructor(vm, structure);
+    constructor->finishCreation(vm, thisPrototype);
+    return constructor;
+}
+
+Structure* WebAssemblyRuntimeErrorConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyRuntimeErrorConstructor::finishCreation(VM& vm, WebAssemblyRuntimeErrorPrototype* prototype)
+{
+    Base::finishCreation(vm, ASCIILiteral("RuntimeError"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, ReadOnly | DontEnum | DontDelete);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+}
+
+WebAssemblyRuntimeErrorConstructor::WebAssemblyRuntimeErrorConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+ConstructType WebAssemblyRuntimeErrorConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructJSWebAssemblyRuntimeError;
+    return ConstructType::Host;
+}
+
+CallType WebAssemblyRuntimeErrorConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callJSWebAssemblyRuntimeError;
+    return CallType::Host;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyRuntimeErrorConstructor.h b/wasm/js/WebAssemblyRuntimeErrorConstructor.h
new file mode 100644
index 0000000..77fb6e4
--- /dev/null
+++ b/wasm/js/WebAssemblyRuntimeErrorConstructor.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "InternalFunction.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyRuntimeErrorPrototype;
+
+class WebAssemblyRuntimeErrorConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyRuntimeErrorConstructor* create(VM&, Structure*, WebAssemblyRuntimeErrorPrototype*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, WebAssemblyRuntimeErrorPrototype*);
+
+private:
+    WebAssemblyRuntimeErrorConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyRuntimeErrorPrototype.cpp b/wasm/js/WebAssemblyRuntimeErrorPrototype.cpp
new file mode 100644
index 0000000..b374dbd
--- /dev/null
+++ b/wasm/js/WebAssemblyRuntimeErrorPrototype.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyRuntimeErrorPrototype.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+
+#include "WebAssemblyRuntimeErrorPrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyRuntimeErrorPrototype::s_info = { "WebAssembly.RuntimeError.prototype", &Base::s_info, &prototypeTableWebAssemblyRuntimeError, CREATE_METHOD_TABLE(WebAssemblyRuntimeErrorPrototype) };
+
+/* Source for WebAssemblyRuntimeErrorPrototype.lut.h
+ @begin prototypeTableWebAssemblyRuntimeError
+ @end
+ */
+
+WebAssemblyRuntimeErrorPrototype* WebAssemblyRuntimeErrorPrototype::create(VM& vm, JSGlobalObject*, Structure* structure)
+{
+    auto* object = new (NotNull, allocateCell<WebAssemblyRuntimeErrorPrototype>(vm.heap)) WebAssemblyRuntimeErrorPrototype(vm, structure);
+    object->finishCreation(vm);
+    return object;
+}
+
+Structure* WebAssemblyRuntimeErrorPrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyRuntimeErrorPrototype::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+WebAssemblyRuntimeErrorPrototype::WebAssemblyRuntimeErrorPrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyRuntimeErrorPrototype.h b/wasm/js/WebAssemblyRuntimeErrorPrototype.h
new file mode 100644
index 0000000..2077fa9
--- /dev/null
+++ b/wasm/js/WebAssemblyRuntimeErrorPrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyRuntimeErrorPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyRuntimeErrorPrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&);
+
+private:
+    WebAssemblyRuntimeErrorPrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyTableConstructor.cpp b/wasm/js/WebAssemblyTableConstructor.cpp
new file mode 100644
index 0000000..a9ac152
--- /dev/null
+++ b/wasm/js/WebAssemblyTableConstructor.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyTableConstructor.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyHelpers.h"
+#include "JSWebAssemblyTable.h"
+#include "WebAssemblyTablePrototype.h"
+
+#include "WebAssemblyTableConstructor.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyTableConstructor::s_info = { "Function", &Base::s_info, &constructorTableWebAssemblyTable, CREATE_METHOD_TABLE(WebAssemblyTableConstructor) };
+
+/* Source for WebAssemblyTableConstructor.lut.h
+ @begin constructorTableWebAssemblyTable
+ @end
+ */
+
+static EncodedJSValue JSC_HOST_CALL constructJSWebAssemblyTable(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    JSObject* memoryDescriptor;
+    {
+        JSValue argument = exec->argument(0);
+        if (!argument.isObject())
+            return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("WebAssembly.Table expects its first argument to be an object"))));
+        memoryDescriptor = jsCast<JSObject*>(argument);
+    }
+
+    {
+        Identifier elementIdent = Identifier::fromString(&vm, "element");
+        JSValue elementValue = memoryDescriptor->get(exec, elementIdent);
+        RETURN_IF_EXCEPTION(throwScope, { });
+        String elementString = elementValue.toWTFString(exec);
+        RETURN_IF_EXCEPTION(throwScope, { });
+        if (elementString != "anyfunc")
+            return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral("WebAssembly.Table expects its 'element' field to be the string 'anyfunc'"))));
+    }
+
+    Identifier initialIdent = Identifier::fromString(&vm, "initial");
+    JSValue initialSizeValue = memoryDescriptor->get(exec, initialIdent);
+    RETURN_IF_EXCEPTION(throwScope, { });
+    uint32_t initial = toNonWrappingUint32(exec, initialSizeValue);
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    std::optional<uint32_t> maximum;
+    Identifier maximumIdent = Identifier::fromString(&vm, "maximum");
+    bool hasProperty = memoryDescriptor->hasProperty(exec, maximumIdent);
+    RETURN_IF_EXCEPTION(throwScope, { });
+    if (hasProperty) {
+        JSValue maxSizeValue = memoryDescriptor->get(exec, maximumIdent);
+        RETURN_IF_EXCEPTION(throwScope, { });
+        maximum = toNonWrappingUint32(exec, maxSizeValue);
+        RETURN_IF_EXCEPTION(throwScope, { });
+
+        if (initial > *maximum) {
+            return JSValue::encode(throwException(exec, throwScope,
+                createRangeError(exec, ASCIILiteral("'maximum' property must be greater than or equal to the 'initial' property"))));
+        }
+    }
+
+    throwScope.release();
+    return JSValue::encode(JSWebAssemblyTable::create(exec, vm, exec->lexicalGlobalObject()->WebAssemblyTableStructure(), initial, maximum));
+}
+
+static EncodedJSValue JSC_HOST_CALL callJSWebAssemblyTable(ExecState* state)
+{
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(state, scope, "WebAssembly.Table"));
+}
+
+WebAssemblyTableConstructor* WebAssemblyTableConstructor::create(VM& vm, Structure* structure, WebAssemblyTablePrototype* thisPrototype)
+{
+    auto* constructor = new (NotNull, allocateCell<WebAssemblyTableConstructor>(vm.heap)) WebAssemblyTableConstructor(vm, structure);
+    constructor->finishCreation(vm, thisPrototype);
+    return constructor;
+}
+
+Structure* WebAssemblyTableConstructor::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyTableConstructor::finishCreation(VM& vm, WebAssemblyTablePrototype* prototype)
+{
+    Base::finishCreation(vm, ASCIILiteral("Table"));
+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
+}
+
+WebAssemblyTableConstructor::WebAssemblyTableConstructor(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+ConstructType WebAssemblyTableConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructJSWebAssemblyTable;
+    return ConstructType::Host;
+}
+
+CallType WebAssemblyTableConstructor::getCallData(JSCell*, CallData& callData)
+{
+    callData.native.function = callJSWebAssemblyTable;
+    return CallType::Host;
+}
+
+void WebAssemblyTableConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    auto* thisObject = jsCast<WebAssemblyTableConstructor*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
+
diff --git a/wasm/js/WebAssemblyTableConstructor.h b/wasm/js/WebAssemblyTableConstructor.h
new file mode 100644
index 0000000..a61c7ac
--- /dev/null
+++ b/wasm/js/WebAssemblyTableConstructor.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "InternalFunction.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyTablePrototype;
+
+class WebAssemblyTableConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyTableConstructor* create(VM&, Structure*, WebAssemblyTablePrototype*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, WebAssemblyTablePrototype*);
+
+private:
+    WebAssemblyTableConstructor(VM&, Structure*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+    static void visitChildren(JSCell*, SlotVisitor&);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyTablePrototype.cpp b/wasm/js/WebAssemblyTablePrototype.cpp
new file mode 100644
index 0000000..3b1a064
--- /dev/null
+++ b/wasm/js/WebAssemblyTablePrototype.cpp
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyTablePrototype.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "FunctionPrototype.h"
+#include "JSCInlines.h"
+#include "JSWebAssemblyHelpers.h"
+#include "JSWebAssemblyTable.h"
+
+#include "WebAssemblyTablePrototype.lut.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyTablePrototype::s_info = { "WebAssembly.Table.prototype", &Base::s_info, &prototypeTableWebAssemblyTable, CREATE_METHOD_TABLE(WebAssemblyTablePrototype) };
+
+/* Source for WebAssemblyTablePrototype.lut.h
+ @begin prototypeTableWebAssemblyTable
+ @end
+ */
+
+static ALWAYS_INLINE JSWebAssemblyTable* getTable(ExecState* exec, VM& vm, JSValue v)
+{
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    JSWebAssemblyTable* result = jsDynamicCast<JSWebAssemblyTable*>(v);
+    if (!result) {
+        throwException(exec, throwScope, 
+            createTypeError(exec, ASCIILiteral("expected |this| value to be an instance of WebAssembly.Table")));
+        return nullptr;
+    }
+    return result;
+}
+
+EncodedJSValue JSC_HOST_CALL webAssemblyTableProtoFuncLength(ExecState*);
+EncodedJSValue JSC_HOST_CALL webAssemblyTableProtoFuncGrow(ExecState*);
+EncodedJSValue JSC_HOST_CALL webAssemblyTableProtoFuncGet(ExecState*);
+EncodedJSValue JSC_HOST_CALL webAssemblyTableProtoFuncSet(ExecState*);
+
+EncodedJSValue JSC_HOST_CALL webAssemblyTableProtoFuncLength(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    JSWebAssemblyTable* table = getTable(exec, vm, exec->thisValue());
+    RETURN_IF_EXCEPTION(throwScope, { });
+    return JSValue::encode(jsNumber(table->size()));
+}
+
+EncodedJSValue JSC_HOST_CALL webAssemblyTableProtoFuncGrow(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    JSWebAssemblyTable* table = getTable(exec, vm, exec->thisValue());
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    uint32_t index = toNonWrappingUint32(exec, exec->argument(0));
+    RETURN_IF_EXCEPTION(throwScope, { });
+    if (!table->grow(index)) {
+        throwException(exec, throwScope,
+            createTypeError(exec, ASCIILiteral("WebAssembly.Table.prototype.grow could not grow the table")));
+        return { };
+    }
+
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL webAssemblyTableProtoFuncGet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    JSWebAssemblyTable* table = getTable(exec, vm, exec->thisValue());
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    uint32_t index = toNonWrappingUint32(exec, exec->argument(0));
+    RETURN_IF_EXCEPTION(throwScope, { });
+    if (index >= table->size()) {
+        throwException(exec, throwScope,
+            createRangeError(exec, ASCIILiteral("WebAssembly.Table.prototype.get expects an integer less than the size of the table")));
+        return { };
+    }
+
+    if (WebAssemblyFunction* result = table->getFunction(index))
+        return JSValue::encode(result);
+    return JSValue::encode(jsNull());
+}
+
+EncodedJSValue JSC_HOST_CALL webAssemblyTableProtoFuncSet(ExecState* exec)
+{
+    VM& vm = exec->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    JSWebAssemblyTable* table = getTable(exec, vm, exec->thisValue());
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    JSValue value = exec->argument(1);
+    WebAssemblyFunction* function = jsDynamicCast<WebAssemblyFunction*>(value);
+    if (!value.isNull() && !function) {
+        throwException(exec, throwScope,
+            createTypeError(exec, ASCIILiteral("WebAssembly.Table.prototype.set expects the second argument to be null or an instance of WebAssembly.Function")));
+        return { };
+    }
+
+    uint32_t index = toNonWrappingUint32(exec, exec->argument(0));
+    RETURN_IF_EXCEPTION(throwScope, { });
+
+    if (index >= table->size()) {
+        throwException(exec, throwScope,
+            createRangeError(exec, ASCIILiteral("WebAssembly.Table.prototype.set expects an integer less than the size of the table")));
+        return { };
+    }
+
+    if (value.isNull())
+        table->clearFunction(index);
+    else {
+        ASSERT(!!function);
+        table->setFunction(vm, index, function);
+    }
+    
+    return JSValue::encode(jsUndefined());
+}
+
+WebAssemblyTablePrototype* WebAssemblyTablePrototype::create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
+{
+    auto* object = new (NotNull, allocateCell<WebAssemblyTablePrototype>(vm.heap)) WebAssemblyTablePrototype(vm, structure);
+    object->finishCreation(vm, globalObject);
+    return object;
+}
+
+Structure* WebAssemblyTablePrototype::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+}
+
+void WebAssemblyTablePrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+
+    JSC_NATIVE_GETTER("length", webAssemblyTableProtoFuncLength, DontEnum | Accessor);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("grow", webAssemblyTableProtoFuncGrow, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("get", webAssemblyTableProtoFuncGet, DontEnum, 1);
+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION("set", webAssemblyTableProtoFuncSet, DontEnum, 2);
+}
+
+WebAssemblyTablePrototype::WebAssemblyTablePrototype(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyTablePrototype.h b/wasm/js/WebAssemblyTablePrototype.h
new file mode 100644
index 0000000..5e04505
--- /dev/null
+++ b/wasm/js/WebAssemblyTablePrototype.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSDestructibleObject.h"
+#include "JSObject.h"
+
+namespace JSC {
+
+class WebAssemblyTablePrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
+
+    static WebAssemblyTablePrototype* create(VM&, JSGlobalObject*, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_INFO;
+
+protected:
+    void finishCreation(VM&, JSGlobalObject*);
+
+private:
+    WebAssemblyTablePrototype(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyToJSCallee.cpp b/wasm/js/WebAssemblyToJSCallee.cpp
new file mode 100644
index 0000000..4e891a0
--- /dev/null
+++ b/wasm/js/WebAssemblyToJSCallee.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebAssemblyToJSCallee.h"
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCInlines.h"
+
+namespace JSC {
+
+const ClassInfo WebAssemblyToJSCallee::s_info = { "WebAssemblyToJSCallee", nullptr, 0, CREATE_METHOD_TABLE(WebAssemblyToJSCallee) };
+
+WebAssemblyToJSCallee* WebAssemblyToJSCallee::create(VM& vm, Structure* structure)
+{
+    WebAssemblyToJSCallee* callee = new (NotNull, allocateCell<WebAssemblyToJSCallee>(vm.heap)) WebAssemblyToJSCallee(vm, structure);
+    callee->finishCreation(vm);
+    return callee;
+}
+
+Structure* WebAssemblyToJSCallee::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+{
+    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
+}
+
+WebAssemblyToJSCallee::WebAssemblyToJSCallee(VM& vm, Structure* structure)
+    : Base(vm, structure)
+{
+}
+
+void WebAssemblyToJSCallee::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+void WebAssemblyToJSCallee::destroy(JSCell* cell)
+{
+    WebAssemblyToJSCallee* thisObject = static_cast<WebAssemblyToJSCallee*>(cell);
+    thisObject->WebAssemblyToJSCallee::~WebAssemblyToJSCallee();
+}
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/js/WebAssemblyToJSCallee.h b/wasm/js/WebAssemblyToJSCallee.h
new file mode 100644
index 0000000..496c885
--- /dev/null
+++ b/wasm/js/WebAssemblyToJSCallee.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEBASSEMBLY)
+
+#include "JSCell.h"
+
+namespace JSC {
+
+class WebAssemblyToJSCallee : public JSCell {
+public:
+    typedef JSCell Base;
+    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
+
+    static WebAssemblyToJSCallee* create(VM&, Structure*);
+    static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
+
+    DECLARE_EXPORT_INFO;
+    static const bool needsDestruction = true;
+    static void destroy(JSCell*);
+
+private:
+    void finishCreation(VM&);
+    WebAssemblyToJSCallee(VM&, Structure*);
+};
+
+} // namespace JSC
+
+#endif // ENABLE(WEBASSEMBLY)
diff --git a/wasm/wasm.json b/wasm/wasm.json
new file mode 100644
index 0000000..b18bee5
--- /dev/null
+++ b/wasm/wasm.json
@@ -0,0 +1,217 @@
+{
+    "comments": ["This file describes the WebAssembly ISA.",
+                 "Scripts in this folder auto-generate C++ code for JavaScriptCore as well as the testing DSL which WebKit's WebAssembly tests use."
+                ],
+    "preamble": [
+        { "name": "magic number", "type": "uint32", "value": 1836278016, "description": "NULL character followed by 'asm'" },
+        { "name": "version",      "type": "uint32", "value":         13, "description": "Version number, will be reset to 1 for MVP" }
+    ],
+    "type" : {
+        "i32":     { "type": "varint7", "value":  -1, "b3type": "B3::Int32" },
+        "i64":     { "type": "varint7", "value":  -2, "b3type": "B3::Int64" },
+        "f32":     { "type": "varint7", "value":  -3, "b3type": "B3::Float" },
+        "f64":     { "type": "varint7", "value":  -4, "b3type": "B3::Double" },
+        "anyfunc": { "type": "varint7", "value": -16, "b3type": "B3::Void" },
+        "func":    { "type": "varint7", "value": -32, "b3type": "B3::Void" },
+        "void":    { "type": "varint7", "value": -64, "b3type": "B3::Void" }
+    },
+    "value_type": ["i32", "i64", "f32", "f64"],
+    "block_type": ["i32", "i64", "f32", "f64", "void"],
+    "elem_type": ["anyfunc"],
+    "external_kind": {
+        "Function": { "type": "uint8", "value": 0 },
+        "Table":    { "type": "uint8", "value": 1 },
+        "Memory":   { "type": "uint8", "value": 2 },
+        "Global":   { "type": "uint8", "value": 3 }
+    },
+    "section" : {
+        "Type":     { "type": "varuint7", "value":  1, "description": "Function signature declarations" },
+        "Import":   { "type": "varuint7", "value":  2, "description": "Import declarations" },
+        "Function": { "type": "varuint7", "value":  3, "description": "Function declarations" },
+        "Table":    { "type": "varuint7", "value":  4, "description": "Indirect function table and other tables" },
+        "Memory":   { "type": "varuint7", "value":  5, "description": "Memory attributes" },
+        "Global":   { "type": "varuint7", "value":  6, "description": "Global declarations" },
+        "Export":   { "type": "varuint7", "value":  7, "description": "Exports" },
+        "Start":    { "type": "varuint7", "value":  8, "description": "Start function declaration" },
+        "Element":  { "type": "varuint7", "value":  9, "description": "Elements section" },
+        "Code":     { "type": "varuint7", "value": 10, "description": "Function bodies (code)" },
+        "Data":     { "type": "varuint7", "value": 11, "description": "Data segments" }
+    },
+    "opcode": {
+        "unreachable":         { "category": "control",    "value":   0, "return": [],           "parameter": [],                      "immediate": [],                                                                                         "description": "trap immediately" },
+        "block":               { "category": "control",    "value":   2, "return": ["control"],  "parameter": [],                      "immediate": [{"name": "sig", "type": "block_type"}],                                                    "description": "begin a sequence of expressions, yielding 0 or 1 values" },
+        "loop":                { "category": "control",    "value":   3, "return": ["control"],  "parameter": [],                      "immediate": [{"name": "sig", "type": "block_type"}],                                                    "description": "begin a block which can also form control flow loops" },
+        "if":                  { "category": "control",    "value":   4, "return": ["control"],  "parameter": ["bool"],                "immediate": [{"name": "sig", "type": "block_type"}],                                                    "description": "begin if expression" },
+        "else":                { "category": "control",    "value":   5, "return": ["control"],  "parameter": [],                      "immediate": [],                                                                                         "description": "begin else expression of if" },
+        "select":              { "category": "control",    "value":  27, "return": ["prev"],     "parameter": ["any", "prev", "bool"], "immediate": [],                                                                                         "description": "select one of two values based on condition" },
+        "br":                  { "category": "control",    "value":  12, "return": [],           "parameter": [],                      "immediate": [{"name": "relative_depth", "type": "varuint32"}],                                          "description": "break that targets an outer nested block" },
+        "br_if":               { "category": "control",    "value":  13, "return": [],           "parameter": [],                      "immediate": [{"name": "relative_depth", "type": "varuint32"}],                                          "description": "conditional break that targets an outer nested block" },
+        "br_table":            { "category": "control",    "value":  14, "return": [],           "parameter": [],                      "immediate": [{"name": "target_count",   "type": "varuint32",                                            "description": "number of entries in the target_table"},
+                                                                                                                                                     {"name": "target_table",   "type": "varuint32*",                                           "description": "target entries that indicate an outer block or loop to which to break"},
+                                                                                                                                                     {"name": "default_target", "type": "varuint32",                                            "description": "an outer block or loop to which to break in the default case"}],
+                                                                                                                                                                                                                                                "description": "branch table control flow construct" },
+        "return":              { "category": "control",    "value":  15, "return": [],           "parameter": [],                       "immediate": [],                                                                                         "description": "return zero or one value from this function" },
+        "drop":                { "category": "control",    "value":  26, "return": [],           "parameter": ["any"],                  "immediate": [],                                                                                         "description": "ignore value" },
+        "nop":                 { "category": "control",    "value":   1, "return": [],           "parameter": [],                       "immediate": [],                                                                                         "description": "no operation" },
+        "end":                 { "category": "control",    "value":  11, "return": [],           "parameter": [],                       "immediate": [],                                                                                         "description": "end a block, loop, or if" },
+        "i32.const":           { "category": "special",    "value":  65, "return": ["i32"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "varint32"}],                                           "description": "a constant value interpreted as i32" },
+        "i64.const":           { "category": "special",    "value":  66, "return": ["i64"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "varint64"}],                                           "description": "a constant value interpreted as i64" },
+        "f64.const":           { "category": "special",    "value":  68, "return": ["f64"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "double"}],                                             "description": "a constant value interpreted as f64" },
+        "f32.const":           { "category": "special",    "value":  67, "return": ["f32"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "float"}],                                             "description": "a constant value interpreted as f32" },
+        "get_local":           { "category": "special",    "value":  32, "return": ["any"],    "parameter": [],                       "immediate": [{"name": "local_index",    "type": "varuint32"}],                                          "description": "read a local variable or parameter" },
+        "set_local":           { "category": "special",    "value":  33, "return": [],           "parameter": ["any"],                "immediate": [{"name": "local_index",    "type": "varuint32"}],                                          "description": "write a local variable or parameter" },
+        "tee_local":           { "category": "special",    "value":  34, "return": ["any"],     "parameter": ["any"],                  "immediate": [{"name": "local_index",    "type": "varuint32"}],                                          "description": "write a local variable or parameter and return the same value" },
+        "get_global":          { "category": "special",    "value":  35, "return": ["any"],   "parameter": [],                       "immediate": [{"name": "global_index",   "type": "varuint32"}],                                          "description": "read a global variable" },
+        "set_global":          { "category": "special",    "value":  36, "return": [],         "parameter": ["any"],               "immediate": [{"name": "global_index",   "type": "varuint32"}],                                          "description": "write a global variable" },
+        "call":                { "category": "call",       "value":  16, "return": ["call"],     "parameter": ["call"],                 "immediate": [{"name": "function_index", "type": "varuint32"}],                                          "description": "call a function by its index" },
+        "call_indirect":       { "category": "call",       "value":  17, "return": ["call"],     "parameter": ["call"],                 "immediate": [{"name": "type_index",     "type": "varuint32"}, {"name": "reserved",     "type": "varuint1"}], "description": "call a function indirect with an expected signature" },
+        "i32.load8_s":         { "category": "memory",     "value":  44, "return": ["i32"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i32.load8_u":         { "category": "memory",     "value":  45, "return": ["i32"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i32.load16_s":        { "category": "memory",     "value":  46, "return": ["i32"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i32.load16_u":        { "category": "memory",     "value":  47, "return": ["i32"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i64.load8_s":         { "category": "memory",     "value":  48, "return": ["i64"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i64.load8_u":         { "category": "memory",     "value":  49, "return": ["i64"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i64.load16_s":        { "category": "memory",     "value":  50, "return": ["i64"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i64.load16_u":        { "category": "memory",     "value":  51, "return": ["i64"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i64.load32_s":        { "category": "memory",     "value":  52, "return": ["i64"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i64.load32_u":        { "category": "memory",     "value":  53, "return": ["i64"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i32.load":            { "category": "memory",     "value":  40, "return": ["i32"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i64.load":            { "category": "memory",     "value":  41, "return": ["i64"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "f32.load":            { "category": "memory",     "value":  42, "return": ["f32"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "f64.load":            { "category": "memory",     "value":  43, "return": ["f64"],      "parameter": ["addr"],                 "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
+        "i32.store8":          { "category": "memory",     "value":  58, "return": [],           "parameter": ["addr", "i32"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "i32.store16":         { "category": "memory",     "value":  59, "return": [],           "parameter": ["addr", "i32"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "i64.store8":          { "category": "memory",     "value":  60, "return": [],           "parameter": ["addr", "i64"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "i64.store16":         { "category": "memory",     "value":  61, "return": [],           "parameter": ["addr", "i64"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "i64.store32":         { "category": "memory",     "value":  62, "return": [],           "parameter": ["addr", "i64"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "i32.store":           { "category": "memory",     "value":  54, "return": [],           "parameter": ["addr", "i32"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "i64.store":           { "category": "memory",     "value":  55, "return": [],           "parameter": ["addr", "i64"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "f32.store":           { "category": "memory",     "value":  56, "return": [],           "parameter": ["addr", "f32"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "f64.store":           { "category": "memory",     "value":  57, "return": [],           "parameter": ["addr", "f64"],          "immediate": [{"name": "flags",          "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "store to memory" },
+        "current_memory":      { "category": "operation",  "value":  63, "return": ["size"],     "parameter": [],                       "immediate": [],                                                                                         "description": "query the size of memory" },
+        "grow_memory":         { "category": "operation",  "value":  64, "return": ["size"],     "parameter": ["size"],                 "immediate": [],                                                                                         "description": "grow the size of memory" },
+        "i32.add":             { "category": "arithmetic", "value": 106, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Add"          },
+        "i32.sub":             { "category": "arithmetic", "value": 107, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Sub"          },
+        "i32.mul":             { "category": "arithmetic", "value": 108, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Mul"          },
+        "i32.div_s":           { "category": "arithmetic", "value": 109, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Div"          },
+        "i32.div_u":           { "category": "arithmetic", "value": 110, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "UDiv"         },
+        "i32.rem_s":           { "category": "arithmetic", "value": 111, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Mod"          },
+        "i32.rem_u":           { "category": "arithmetic", "value": 112, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "UMod"         },
+        "i32.and":             { "category": "arithmetic", "value": 113, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "BitAnd"       },
+        "i32.or":              { "category": "arithmetic", "value": 114, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "BitOr"        },
+        "i32.xor":             { "category": "arithmetic", "value": 115, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "BitXor"       },
+        "i32.shl":             { "category": "arithmetic", "value": 116, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Shl"          },
+        "i32.shr_u":           { "category": "arithmetic", "value": 118, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "ZShr"         },
+        "i32.shr_s":           { "category": "arithmetic", "value": 117, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "SShr"         },
+        "i32.rotr":            { "category": "arithmetic", "value": 120, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "RotR"         },
+        "i32.rotl":            { "category": "arithmetic", "value": 119, "return": ["i32"],      "parameter": ["i32", "i32"],           "immediate": [], "b3op": "RotL"         },
+        "i32.eq":              { "category": "comparison", "value":  70, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Equal"        },
+        "i32.ne":              { "category": "comparison", "value":  71, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "NotEqual"     },
+        "i32.lt_s":            { "category": "comparison", "value":  72, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "LessThan"     },
+        "i32.le_s":            { "category": "comparison", "value":  76, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "LessEqual"    },
+        "i32.lt_u":            { "category": "comparison", "value":  73, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Below"        },
+        "i32.le_u":            { "category": "comparison", "value":  77, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "BelowEqual"   },
+        "i32.gt_s":            { "category": "comparison", "value":  74, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "GreaterThan"  },
+        "i32.ge_s":            { "category": "comparison", "value":  78, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "GreaterEqual" },
+        "i32.gt_u":            { "category": "comparison", "value":  75, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "Above"        },
+        "i32.ge_u":            { "category": "comparison", "value":  79, "return": ["bool"],     "parameter": ["i32", "i32"],           "immediate": [], "b3op": "AboveEqual"   },
+        "i32.clz":             { "category": "arithmetic", "value": 103, "return": ["i32"],      "parameter": ["i32"],                  "immediate": [], "b3op": "Clz"          },
+        "i32.ctz":             { "category": "arithmetic", "value": 104, "return": ["i32"],      "parameter": ["i32"],                  "immediate": []                         },
+        "i32.popcnt":          { "category": "arithmetic", "value": 105, "return": ["i32"],      "parameter": ["i32"],                  "immediate": []                         },
+        "i32.eqz":             { "category": "comparison", "value":  69, "return": ["bool"],     "parameter": ["i32"],                  "immediate": [], "b3op": "Equal(i32(0), @0)" },
+        "i64.add":             { "category": "arithmetic", "value": 124, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Add"          },
+        "i64.sub":             { "category": "arithmetic", "value": 125, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Sub"          },
+        "i64.mul":             { "category": "arithmetic", "value": 126, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Mul"          },
+        "i64.div_s":           { "category": "arithmetic", "value": 127, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Div"          },
+        "i64.div_u":           { "category": "arithmetic", "value": 128, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "UDiv"         },
+        "i64.rem_s":           { "category": "arithmetic", "value": 129, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Mod"          },
+        "i64.rem_u":           { "category": "arithmetic", "value": 130, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "UDiv"         },
+        "i64.and":             { "category": "arithmetic", "value": 131, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "BitAnd"       },
+        "i64.or":              { "category": "arithmetic", "value": 132, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "BitOr"        },
+        "i64.xor":             { "category": "arithmetic", "value": 133, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "BitXor"       },
+        "i64.shl":             { "category": "arithmetic", "value": 134, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Shl(@0, Trunc(@1))" },
+        "i64.shr_u":           { "category": "arithmetic", "value": 136, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "ZShr(@0, Trunc(@1))" },
+        "i64.shr_s":           { "category": "arithmetic", "value": 135, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "SShr(@0, Trunc(@1))" },
+        "i64.rotr":            { "category": "arithmetic", "value": 138, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "RotR(@0, Trunc(@1))" },
+        "i64.rotl":            { "category": "arithmetic", "value": 137, "return": ["i64"],      "parameter": ["i64", "i64"],           "immediate": [], "b3op": "RotL(@0, Trunc(@1))" },
+        "i64.eq":              { "category": "comparison", "value":  81, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Equal"        },
+        "i64.ne":              { "category": "comparison", "value":  82, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "NotEqual"     },
+        "i64.lt_s":            { "category": "comparison", "value":  83, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "LessThan"     },
+        "i64.le_s":            { "category": "comparison", "value":  87, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "LessEqual"    },
+        "i64.lt_u":            { "category": "comparison", "value":  84, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Below"        },
+        "i64.le_u":            { "category": "comparison", "value":  88, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "BelowEqual"   },
+        "i64.gt_s":            { "category": "comparison", "value":  85, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "GreaterThan"  },
+        "i64.ge_s":            { "category": "comparison", "value":  89, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "GreaterEqual" },
+        "i64.gt_u":            { "category": "comparison", "value":  86, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "Above"        },
+        "i64.ge_u":            { "category": "comparison", "value":  90, "return": ["bool"],     "parameter": ["i64", "i64"],           "immediate": [], "b3op": "AboveEqual"   },
+        "i64.clz":             { "category": "arithmetic", "value": 121, "return": ["i64"],      "parameter": ["i64"],                  "immediate": [], "b3op": "Clz"          },
+        "i64.ctz":             { "category": "arithmetic", "value": 122, "return": ["i64"],      "parameter": ["i64"],                  "immediate": []                         },
+        "i64.popcnt":          { "category": "arithmetic", "value": 123, "return": ["i64"],      "parameter": ["i64"],                  "immediate": []                         },
+        "i64.eqz":             { "category": "comparison", "value":  80, "return": ["bool"],     "parameter": ["i64"],                  "immediate": [], "b3op": "Equal(i64(0), @0)" },
+        "f32.add":             { "category": "arithmetic", "value": 146, "return": ["f32"],      "parameter": ["f32", "f32"],           "immediate": [], "b3op": "Add"          },
+        "f32.sub":             { "category": "arithmetic", "value": 147, "return": ["f32"],      "parameter": ["f32", "f32"],           "immediate": [], "b3op": "Sub"          },
+        "f32.mul":             { "category": "arithmetic", "value": 148, "return": ["f32"],      "parameter": ["f32", "f32"],           "immediate": [], "b3op": "Mul"          },
+        "f32.div":             { "category": "arithmetic", "value": 149, "return": ["f32"],      "parameter": ["f32", "f32"],           "immediate": [], "b3op": "Div"          },
+        "f32.min":             { "category": "arithmetic", "value": 150, "return": ["f32"],      "parameter": ["f32", "f32"],           "immediate": [], "b3op": "Select(LessThan(@0, @1), @0, @1)" },
+        "f32.max":             { "category": "arithmetic", "value": 151, "return": ["f32"],      "parameter": ["f32", "f32"],           "immediate": [], "b3op": "Select(LessThan(@0, @1), @1, @0)" },
+        "f32.abs":             { "category": "arithmetic", "value": 139, "return": ["f32"],      "parameter": ["f32"],                  "immediate": [], "b3op": "Abs"          },
+        "f32.neg":             { "category": "arithmetic", "value": 140, "return": ["f32"],      "parameter": ["f32"],                  "immediate": [], "b3op": "Neg"          },
+        "f32.copysign":        { "category": "arithmetic", "value": 152, "return": ["f32"],      "parameter": ["f32", "f32"],           "immediate": [], "b3op": "BitwiseCast(BitOr(BitAnd(BitwiseCast(@1), i32(0x80000000)), BitAnd(BitwiseCast(@0), i32(0x7fffffff))))" },
+        "f32.ceil":            { "category": "arithmetic", "value": 141, "return": ["f32"],      "parameter": ["f32"],                  "immediate": [], "b3op": "Ceil"         },
+        "f32.floor":           { "category": "arithmetic", "value": 142, "return": ["f32"],      "parameter": ["f32"],                  "immediate": [], "b3op": "Floor"        },
+        "f32.trunc":           { "category": "arithmetic", "value": 143, "return": ["f32"],      "parameter": ["f32"],                  "immediate": []                         },
+        "f32.nearest":         { "category": "arithmetic", "value": 144, "return": ["f32"],      "parameter": ["f32"],                  "immediate": []                         },
+        "f32.sqrt":            { "category": "arithmetic", "value": 145, "return": ["f32"],      "parameter": ["f32"],                  "immediate": [], "b3op": "Sqrt"         },
+        "f32.eq":              { "category": "comparison", "value":  91, "return": ["bool"],     "parameter": ["f32", "f32"],           "immediate": [], "b3op": "Equal"        },
+        "f32.ne":              { "category": "comparison", "value":  92, "return": ["bool"],     "parameter": ["f32", "f32"],           "immediate": [], "b3op": "NotEqual"     },
+        "f32.lt":              { "category": "comparison", "value":  93, "return": ["bool"],     "parameter": ["f32", "f32"],           "immediate": [], "b3op": "LessThan"     },
+        "f32.le":              { "category": "comparison", "value":  95, "return": ["bool"],     "parameter": ["f32", "f32"],           "immediate": [], "b3op": "LessEqual"    },
+        "f32.gt":              { "category": "comparison", "value":  94, "return": ["bool"],     "parameter": ["f32", "f32"],           "immediate": [], "b3op": "GreaterThan"  },
+        "f32.ge":              { "category": "comparison", "value":  96, "return": ["bool"],     "parameter": ["f32", "f32"],           "immediate": [], "b3op": "GreaterEqual" },
+        "f64.add":             { "category": "arithmetic", "value": 160, "return": ["f64"],      "parameter": ["f64", "f64"],           "immediate": [], "b3op": "Add"          },
+        "f64.sub":             { "category": "arithmetic", "value": 161, "return": ["f64"],      "parameter": ["f64", "f64"],           "immediate": [], "b3op": "Sub"          },
+        "f64.mul":             { "category": "arithmetic", "value": 162, "return": ["f64"],      "parameter": ["f64", "f64"],           "immediate": [], "b3op": "Mul"          },
+        "f64.div":             { "category": "arithmetic", "value": 163, "return": ["f64"],      "parameter": ["f64", "f64"],           "immediate": [], "b3op": "Div"          },
+        "f64.min":             { "category": "arithmetic", "value": 164, "return": ["f64"],      "parameter": ["f64", "f64"],           "immediate": [], "b3op": "Select(LessThan(@0, @1), @0, @1)" },
+        "f64.max":             { "category": "arithmetic", "value": 165, "return": ["f64"],      "parameter": ["f64", "f64"],           "immediate": [], "b3op": "Select(LessThan(@0, @1), @1, @0)" },
+        "f64.abs":             { "category": "arithmetic", "value": 153, "return": ["f64"],      "parameter": ["f64"],                  "immediate": [], "b3op": "Abs"          },
+        "f64.neg":             { "category": "arithmetic", "value": 154, "return": ["f64"],      "parameter": ["f64"],                  "immediate": [], "b3op": "Neg"          },
+        "f64.copysign":        { "category": "arithmetic", "value": 166, "return": ["f64"],      "parameter": ["f64", "f64"],           "immediate": [], "b3op": "BitwiseCast(BitOr(BitAnd(BitwiseCast(@1), i64(0x8000000000000000)), BitAnd(BitwiseCast(@0), i64(0x7fffffffffffffff))))" },
+        "f64.ceil":            { "category": "arithmetic", "value": 155, "return": ["f64"],      "parameter": ["f64"],                  "immediate": [], "b3op": "Ceil"         },
+        "f64.floor":           { "category": "arithmetic", "value": 156, "return": ["f64"],      "parameter": ["f64"],                  "immediate": [], "b3op": "Floor"        },
+        "f64.trunc":           { "category": "arithmetic", "value": 157, "return": ["f64"],      "parameter": ["f64"],                  "immediate": []                         },
+        "f64.nearest":         { "category": "arithmetic", "value": 158, "return": ["f64"],      "parameter": ["f64"],                  "immediate": []                         },
+        "f64.sqrt":            { "category": "arithmetic", "value": 159, "return": ["f64"],      "parameter": ["f64"],                  "immediate": [], "b3op": "Sqrt"         },
+        "f64.eq":              { "category": "comparison", "value":  97, "return": ["bool"],     "parameter": ["f64", "f64"],           "immediate": [], "b3op": "Equal"        },
+        "f64.ne":              { "category": "comparison", "value":  98, "return": ["bool"],     "parameter": ["f64", "f64"],           "immediate": [], "b3op": "NotEqual"     },
+        "f64.lt":              { "category": "comparison", "value":  99, "return": ["bool"],     "parameter": ["f64", "f64"],           "immediate": [], "b3op": "LessThan"     },
+        "f64.le":              { "category": "comparison", "value": 101, "return": ["bool"],     "parameter": ["f64", "f64"],           "immediate": [], "b3op": "LessEqual"    },
+        "f64.gt":              { "category": "comparison", "value": 100, "return": ["bool"],     "parameter": ["f64", "f64"],           "immediate": [], "b3op": "GreaterThan"  },
+        "f64.ge":              { "category": "comparison", "value": 102, "return": ["bool"],     "parameter": ["f64", "f64"],           "immediate": [], "b3op": "GreaterEqual" },
+        "i32.trunc_s/f32":     { "category": "conversion", "value": 168, "return": ["i32"],      "parameter": ["f32"],                  "immediate": []                         },
+        "i32.trunc_s/f64":     { "category": "conversion", "value": 170, "return": ["i32"],      "parameter": ["f64"],                  "immediate": []                         },
+        "i32.trunc_u/f32":     { "category": "conversion", "value": 169, "return": ["i32"],      "parameter": ["f32"],                  "immediate": []                         },
+        "i32.trunc_u/f64":     { "category": "conversion", "value": 171, "return": ["i32"],      "parameter": ["f64"],                  "immediate": []                         },
+        "i32.wrap/i64":        { "category": "conversion", "value": 167, "return": ["i32"],      "parameter": ["i64"],                  "immediate": [], "b3op": "Trunc"        },
+        "i64.trunc_s/f32":     { "category": "conversion", "value": 174, "return": ["i64"],      "parameter": ["f32"],                  "immediate": []                         },
+        "i64.trunc_s/f64":     { "category": "conversion", "value": 176, "return": ["i64"],      "parameter": ["f64"],                  "immediate": []                         },
+        "i64.trunc_u/f32":     { "category": "conversion", "value": 175, "return": ["i64"],      "parameter": ["f32"],                  "immediate": []                         },
+        "i64.trunc_u/f64":     { "category": "conversion", "value": 177, "return": ["i64"],      "parameter": ["f64"],                  "immediate": []                         },
+        "i64.extend_s/i32":    { "category": "conversion", "value": 172, "return": ["i64"],      "parameter": ["i32"],                  "immediate": [], "b3op": "SExt32"       },
+        "i64.extend_u/i32":    { "category": "conversion", "value": 173, "return": ["i64"],      "parameter": ["i32"],                  "immediate": [], "b3op": "ZExt32"       },
+        "f32.convert_s/i32":   { "category": "conversion", "value": 178, "return": ["f32"],      "parameter": ["i32"],                  "immediate": [], "b3op": "IToF"         },
+        "f32.convert_u/i32":   { "category": "conversion", "value": 179, "return": ["f32"],      "parameter": ["i32"],                  "immediate": [], "b3op": "IToF(ZExt32(@0))" },
+        "f32.convert_s/i64":   { "category": "conversion", "value": 180, "return": ["f32"],      "parameter": ["i64"],                  "immediate": [], "b3op": "IToF"         },
+        "f32.convert_u/i64":   { "category": "conversion", "value": 181, "return": ["f32"],      "parameter": ["i64"],                  "immediate": []                         },
+        "f32.demote/f64":      { "category": "conversion", "value": 182, "return": ["f32"],      "parameter": ["f64"],                  "immediate": [], "b3op": "DoubleToFloat"},
+        "f32.reinterpret/i32": { "category": "conversion", "value": 190, "return": ["f32"],      "parameter": ["i32"],                  "immediate": [], "b3op": "BitwiseCast"  },
+        "f64.convert_s/i32":   { "category": "conversion", "value": 183, "return": ["f64"],      "parameter": ["i32"],                  "immediate": [], "b3op": "IToD"         },
+        "f64.convert_u/i32":   { "category": "conversion", "value": 184, "return": ["f64"],      "parameter": ["i32"],                  "immediate": [], "b3op": "IToD(ZExt32(@0))" },
+        "f64.convert_s/i64":   { "category": "conversion", "value": 185, "return": ["f64"],      "parameter": ["i64"],                  "immediate": [], "b3op": "IToD"         },
+        "f64.convert_u/i64":   { "category": "conversion", "value": 186, "return": ["f64"],      "parameter": ["i64"],                  "immediate": []                         },
+        "f64.promote/f32":     { "category": "conversion", "value": 187, "return": ["f64"],      "parameter": ["f32"],                  "immediate": [], "b3op": "FloatToDouble"},
+        "f64.reinterpret/i64": { "category": "conversion", "value": 191, "return": ["f64"],      "parameter": ["i64"],                  "immediate": [], "b3op": "BitwiseCast"  },
+        "i32.reinterpret/f32": { "category": "conversion", "value": 188, "return": ["i32"],      "parameter": ["f32"],                  "immediate": [], "b3op": "BitwiseCast"  },
+        "i64.reinterpret/f64": { "category": "conversion", "value": 189, "return": ["i64"],      "parameter": ["f64"],                  "immediate": [], "b3op": "BitwiseCast"  }
+    }
+}
diff --git a/yarr/RegularExpression.cpp b/yarr/RegularExpression.cpp
new file mode 100644
index 0000000..d87d603
--- /dev/null
+++ b/yarr/RegularExpression.cpp
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Collabora Ltd.
+ * Copyright (C) 2011 Peter Varga (pvarga@webkit.org), University of Szeged
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RegularExpression.h"
+
+#include "Yarr.h"
+#include "YarrInterpreter.h"
+#include <wtf/Assertions.h>
+#include <wtf/BumpPointerAllocator.h>
+
+namespace JSC { namespace Yarr {
+
+class RegularExpression::Private : public RefCounted<RegularExpression::Private> {
+public:
+    static Ref<Private> create(const String& pattern, TextCaseSensitivity caseSensitivity, MultilineMode multilineMode)
+    {
+        return adoptRef(*new Private(pattern, caseSensitivity, multilineMode));
+    }
+
+    int lastMatchLength;
+
+    unsigned m_numSubpatterns;
+    std::unique_ptr<JSC::Yarr::BytecodePattern> m_regExpByteCode;
+
+private:
+    Private(const String& pattern, TextCaseSensitivity caseSensitivity, MultilineMode multilineMode)
+        : lastMatchLength(-1)
+        , m_regExpByteCode(compile(pattern, caseSensitivity, multilineMode))
+        , m_constructionError(nullptr)
+    {
+    }
+
+    std::unique_ptr<JSC::Yarr::BytecodePattern> compile(const String& patternString, TextCaseSensitivity caseSensitivity, MultilineMode multilineMode)
+    {
+        RegExpFlags flags = NoFlags;
+
+        if (caseSensitivity == TextCaseInsensitive)
+            flags = static_cast<RegExpFlags>(flags | FlagIgnoreCase);
+
+        if (multilineMode == MultilineEnabled)
+            flags = static_cast<RegExpFlags>(flags | FlagMultiline);
+
+        JSC::Yarr::YarrPattern pattern(patternString, flags, &m_constructionError);
+        if (m_constructionError) {
+            LOG_ERROR("RegularExpression: YARR compile failed with '%s'", m_constructionError);
+            return nullptr;
+        }
+
+        m_numSubpatterns = pattern.m_numSubpatterns;
+
+        return JSC::Yarr::byteCompile(pattern, &m_regexAllocator);
+    }
+
+    BumpPointerAllocator m_regexAllocator;
+    const char* m_constructionError;
+};
+
+RegularExpression::RegularExpression(const String& pattern, TextCaseSensitivity caseSensitivity, MultilineMode multilineMode)
+    : d(Private::create(pattern, caseSensitivity, multilineMode))
+{
+}
+
+RegularExpression::RegularExpression(const RegularExpression& re)
+    : d(re.d)
+{
+}
+
+RegularExpression::~RegularExpression()
+{
+}
+
+RegularExpression& RegularExpression::operator=(const RegularExpression& re)
+{
+    d = re.d;
+    return *this;
+}
+
+int RegularExpression::match(const String& str, int startFrom, int* matchLength) const
+{
+    if (!d->m_regExpByteCode)
+        return -1;
+
+    if (str.isNull())
+        return -1;
+
+    int offsetVectorSize = (d->m_numSubpatterns + 1) * 2;
+    unsigned* offsetVector;
+    Vector<unsigned, 32> nonReturnedOvector;
+
+    nonReturnedOvector.resize(offsetVectorSize);
+    offsetVector = nonReturnedOvector.data();
+
+    ASSERT(offsetVector);
+    for (unsigned j = 0, i = 0; i < d->m_numSubpatterns + 1; j += 2, i++)
+        offsetVector[j] = JSC::Yarr::offsetNoMatch;
+
+    unsigned result;
+    if (str.length() <= INT_MAX)
+        result = JSC::Yarr::interpret(d->m_regExpByteCode.get(), str, startFrom, offsetVector);
+    else {
+        // This code can't handle unsigned offsets. Limit our processing to strings with offsets that
+        // can be represented as ints.
+        result = JSC::Yarr::offsetNoMatch;
+    }
+
+    if (result == JSC::Yarr::offsetNoMatch) {
+        d->lastMatchLength = -1;
+        return -1;
+    }
+
+    // 1 means 1 match; 0 means more than one match. First match is recorded in offsetVector.
+    d->lastMatchLength = offsetVector[1] - offsetVector[0];
+    if (matchLength)
+        *matchLength = d->lastMatchLength;
+    return offsetVector[0];
+}
+
+int RegularExpression::searchRev(const String& str) const
+{
+    // FIXME: This could be faster if it actually searched backwards.
+    // Instead, it just searches forwards, multiple times until it finds the last match.
+
+    int start = 0;
+    int pos;
+    int lastPos = -1;
+    int lastMatchLength = -1;
+    do {
+        int matchLength;
+        pos = match(str, start, &matchLength);
+        if (pos >= 0) {
+            if (pos + matchLength > lastPos + lastMatchLength) {
+                // replace last match if this one is later and not a subset of the last match
+                lastPos = pos;
+                lastMatchLength = matchLength;
+            }
+            start = pos + 1;
+        }
+    } while (pos != -1);
+    d->lastMatchLength = lastMatchLength;
+    return lastPos;
+}
+
+int RegularExpression::matchedLength() const
+{
+    return d->lastMatchLength;
+}
+
+void replace(String& string, const RegularExpression& target, const String& replacement)
+{
+    int index = 0;
+    while (index < static_cast<int>(string.length())) {
+        int matchLength;
+        index = target.match(string, index, &matchLength);
+        if (index < 0)
+            break;
+        string.replace(index, matchLength, replacement);
+        index += replacement.length();
+        if (!matchLength)
+            break; // Avoid infinite loop on 0-length matches, e.g. [a-z]*
+    }
+}
+
+bool RegularExpression::isValid() const
+{
+    return d->m_regExpByteCode.get();
+}
+
+} } // namespace JSC::Yarr
diff --git a/yarr/RegularExpression.h b/yarr/RegularExpression.h
new file mode 100644
index 0000000..2842774
--- /dev/null
+++ b/yarr/RegularExpression.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <wtf/text/WTFString.h>
+
+namespace JSC { namespace Yarr {
+
+enum MultilineMode {
+    MultilineDisabled,
+    MultilineEnabled
+};
+
+class JS_EXPORT_PRIVATE RegularExpression {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    RegularExpression(const String&, TextCaseSensitivity, MultilineMode = MultilineDisabled);
+    ~RegularExpression();
+
+    RegularExpression(const RegularExpression&);
+    RegularExpression& operator=(const RegularExpression&);
+
+    int match(const String&, int startFrom = 0, int* matchLength = 0) const;
+    int searchRev(const String&) const;
+
+    int matchedLength() const;
+    bool isValid() const;
+
+private:
+    class Private;
+    RefPtr<Private> d;
+};
+
+void JS_EXPORT_PRIVATE replace(String&, const RegularExpression&, const String&);
+
+} } // namespace JSC::Yarr
diff --git a/yarr/Yarr.h b/yarr/Yarr.h
new file mode 100644
index 0000000..8e5a3e6
--- /dev/null
+++ b/yarr/Yarr.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Peter Varga (pvarga@inf.u-szeged.hu), University of Szeged
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "YarrPattern.h"
+
+namespace JSC { namespace Yarr {
+
+#define YarrStackSpaceForBackTrackInfoPatternCharacter 2 // Only for !fixed quantifiers.
+#define YarrStackSpaceForBackTrackInfoCharacterClass 2 // Only for !fixed quantifiers.
+#define YarrStackSpaceForBackTrackInfoBackReference 2
+#define YarrStackSpaceForBackTrackInfoAlternative 1 // One per alternative.
+#define YarrStackSpaceForBackTrackInfoParentheticalAssertion 1
+#define YarrStackSpaceForBackTrackInfoParenthesesOnce 1 // Only for !fixed quantifiers.
+#define YarrStackSpaceForBackTrackInfoParenthesesTerminal 1
+#define YarrStackSpaceForBackTrackInfoParentheses 2
+
+static const unsigned quantifyInfinite = UINT_MAX;
+static const unsigned offsetNoMatch = std::numeric_limits<unsigned>::max();
+
+// The below limit restricts the number of "recursive" match calls in order to
+// avoid spending exponential time on complex regular expressions.
+static const unsigned matchLimit = 1000000;
+
+enum JSRegExpResult {
+    JSRegExpMatch = 1,
+    JSRegExpNoMatch = 0,
+    JSRegExpErrorNoMatch = -1,
+    JSRegExpErrorHitLimit = -2,
+    JSRegExpErrorNoMemory = -3,
+    JSRegExpErrorInternal = -4
+};
+
+enum YarrCharSize {
+    Char8,
+    Char16
+};
+
+struct BytecodePattern;
+
+} } // namespace JSC::Yarr
diff --git a/yarr/YarrCanonicalize.h b/yarr/YarrCanonicalize.h
new file mode 100644
index 0000000..fb5e023
--- /dev/null
+++ b/yarr/YarrCanonicalize.h
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include <unicode/utypes.h>
+
+namespace JSC { namespace Yarr {
+
+// This set of data provides information for each UCS2 code point as to the set of code points
+// that it should match under the ES6 case insensitive RegExp matching rules, specified in 21.2.2.8.2.
+// The non-Unicode tables are autogenerated using YarrCanonicalize.js into YarrCanonicalize.cpp.
+// The Unicode tables are autogenerated using the python script generateYarrCanonicalizeUnicode
+// which creates YarrCanonicalizeUnicode.cpp.
+enum UCS2CanonicalizationType {
+    CanonicalizeUnique,               // No canonically equal values, e.g. 0x0.
+    CanonicalizeSet,                  // Value indicates a set in characterSetInfo.
+    CanonicalizeRangeLo,              // Value is positive delta to pair, E.g. 0x41 has value 0x20, -> 0x61.
+    CanonicalizeRangeHi,              // Value is positive delta to pair, E.g. 0x61 has value 0x20, -> 0x41.
+    CanonicalizeAlternatingAligned,   // Aligned consequtive pair, e.g. 0x1f4,0x1f5.
+    CanonicalizeAlternatingUnaligned, // Unaligned consequtive pair, e.g. 0x241,0x242.
+};
+struct CanonicalizationRange {
+    UChar32 begin;
+    UChar32 end;
+    UChar32 value;
+    UCS2CanonicalizationType type;
+};
+
+extern const size_t UCS2_CANONICALIZATION_RANGES;
+extern const UChar32* const ucs2CharacterSetInfo[];
+extern const CanonicalizationRange ucs2RangeInfo[];
+
+extern const size_t UNICODE_CANONICALIZATION_RANGES;
+extern const UChar32* const unicodeCharacterSetInfo[];
+extern const CanonicalizationRange unicodeRangeInfo[];
+
+enum class CanonicalMode { UCS2, Unicode };
+
+inline const UChar32* canonicalCharacterSetInfo(unsigned index, CanonicalMode canonicalMode)
+{
+    const UChar32* const* rangeInfo = canonicalMode == CanonicalMode::UCS2 ? ucs2CharacterSetInfo : unicodeCharacterSetInfo;
+    return rangeInfo[index];
+}
+
+// This searches in log2 time over ~400-600 entries, so should typically result in 9 compares.
+inline const CanonicalizationRange* canonicalRangeInfoFor(UChar32 ch, CanonicalMode canonicalMode = CanonicalMode::UCS2)
+{
+    const CanonicalizationRange* info = canonicalMode == CanonicalMode::UCS2 ? ucs2RangeInfo : unicodeRangeInfo;
+    size_t entries = canonicalMode == CanonicalMode::UCS2 ? UCS2_CANONICALIZATION_RANGES : UNICODE_CANONICALIZATION_RANGES;
+
+    while (true) {
+        size_t candidate = entries >> 1;
+        const CanonicalizationRange* candidateInfo = info + candidate;
+        if (ch < candidateInfo->begin)
+            entries = candidate;
+        else if (ch <= candidateInfo->end)
+            return candidateInfo;
+        else {
+            info = candidateInfo + 1;
+            entries -= (candidate + 1);
+        }
+    }
+}
+
+// Should only be called for characters that have one canonically matching value.
+inline UChar32 getCanonicalPair(const CanonicalizationRange* info, UChar32 ch)
+{
+    ASSERT(ch >= info->begin && ch <= info->end);
+    switch (info->type) {
+    case CanonicalizeRangeLo:
+        return ch + info->value;
+    case CanonicalizeRangeHi:
+        return ch - info->value;
+    case CanonicalizeAlternatingAligned:
+        return ch ^ 1;
+    case CanonicalizeAlternatingUnaligned:
+        return ((ch - 1) ^ 1) + 1;
+    default:
+        RELEASE_ASSERT_NOT_REACHED();
+    }
+    RELEASE_ASSERT_NOT_REACHED();
+    return 0;
+}
+
+// Returns true if no other UCS2 codepoint can match this value.
+inline bool isCanonicallyUnique(UChar32 ch, CanonicalMode canonicalMode = CanonicalMode::UCS2)
+{
+    return canonicalRangeInfoFor(ch, canonicalMode)->type == CanonicalizeUnique;
+}
+
+// Returns true if values are equal, under the canonicalization rules.
+inline bool areCanonicallyEquivalent(UChar32 a, UChar32 b, CanonicalMode canonicalMode = CanonicalMode::UCS2)
+{
+    const CanonicalizationRange* info = canonicalRangeInfoFor(a, canonicalMode);
+    switch (info->type) {
+    case CanonicalizeUnique:
+        return a == b;
+    case CanonicalizeSet: {
+        for (const UChar32* set = canonicalCharacterSetInfo(info->value, canonicalMode); (a = *set); ++set) {
+            if (a == b)
+                return true;
+        }
+        return false;
+    }
+    case CanonicalizeRangeLo:
+        return (a == b) || (a + info->value == b);
+    case CanonicalizeRangeHi:
+        return (a == b) || (a - info->value == b);
+    case CanonicalizeAlternatingAligned:
+        return (a | 1) == (b | 1);
+    case CanonicalizeAlternatingUnaligned:
+        return ((a - 1) | 1) == ((b - 1) | 1);
+    }
+
+    RELEASE_ASSERT_NOT_REACHED();
+    return false;
+}
+
+} } // JSC::Yarr
diff --git a/yarr/YarrCanonicalizeUCS2.cpp b/yarr/YarrCanonicalizeUCS2.cpp
new file mode 100644
index 0000000..d91c771
--- /dev/null
+++ b/yarr/YarrCanonicalizeUCS2.cpp
@@ -0,0 +1,464 @@
+/*
+ * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// DO NOT EDIT! - this file autogenerated by YarrCanonicalize.js
+
+#include "config.h"
+#include "YarrCanonicalize.h"
+
+namespace JSC { namespace Yarr {
+
+const UChar32 ucs2CharacterSet0[] = { 0x01c4, 0x01c5, 0x01c6, 0 };
+const UChar32 ucs2CharacterSet1[] = { 0x01c7, 0x01c8, 0x01c9, 0 };
+const UChar32 ucs2CharacterSet2[] = { 0x01ca, 0x01cb, 0x01cc, 0 };
+const UChar32 ucs2CharacterSet3[] = { 0x01f1, 0x01f2, 0x01f3, 0 };
+const UChar32 ucs2CharacterSet4[] = { 0x0392, 0x03b2, 0x03d0, 0 };
+const UChar32 ucs2CharacterSet5[] = { 0x0395, 0x03b5, 0x03f5, 0 };
+const UChar32 ucs2CharacterSet6[] = { 0x0398, 0x03b8, 0x03d1, 0 };
+const UChar32 ucs2CharacterSet7[] = { 0x0345, 0x0399, 0x03b9, 0x1fbe, 0 };
+const UChar32 ucs2CharacterSet8[] = { 0x039a, 0x03ba, 0x03f0, 0 };
+const UChar32 ucs2CharacterSet9[] = { 0x00b5, 0x039c, 0x03bc, 0 };
+const UChar32 ucs2CharacterSet10[] = { 0x03a0, 0x03c0, 0x03d6, 0 };
+const UChar32 ucs2CharacterSet11[] = { 0x03a1, 0x03c1, 0x03f1, 0 };
+const UChar32 ucs2CharacterSet12[] = { 0x03a3, 0x03c2, 0x03c3, 0 };
+const UChar32 ucs2CharacterSet13[] = { 0x03a6, 0x03c6, 0x03d5, 0 };
+const UChar32 ucs2CharacterSet14[] = { 0x1e60, 0x1e61, 0x1e9b, 0 };
+
+static const size_t UCS2_CANONICALIZATION_SETS = 15;
+const UChar32* const ucs2CharacterSetInfo[UCS2_CANONICALIZATION_SETS] = {
+    ucs2CharacterSet0,
+    ucs2CharacterSet1,
+    ucs2CharacterSet2,
+    ucs2CharacterSet3,
+    ucs2CharacterSet4,
+    ucs2CharacterSet5,
+    ucs2CharacterSet6,
+    ucs2CharacterSet7,
+    ucs2CharacterSet8,
+    ucs2CharacterSet9,
+    ucs2CharacterSet10,
+    ucs2CharacterSet11,
+    ucs2CharacterSet12,
+    ucs2CharacterSet13,
+    ucs2CharacterSet14,
+};
+
+const size_t UCS2_CANONICALIZATION_RANGES = 391;
+const CanonicalizationRange ucs2RangeInfo[UCS2_CANONICALIZATION_RANGES] = {
+    { 0x0000, 0x0040, 0x0000, CanonicalizeUnique },
+    { 0x0041, 0x005a, 0x0020, CanonicalizeRangeLo },
+    { 0x005b, 0x0060, 0x0000, CanonicalizeUnique },
+    { 0x0061, 0x007a, 0x0020, CanonicalizeRangeHi },
+    { 0x007b, 0x00b4, 0x0000, CanonicalizeUnique },
+    { 0x00b5, 0x00b5, 0x0009, CanonicalizeSet },
+    { 0x00b6, 0x00bf, 0x0000, CanonicalizeUnique },
+    { 0x00c0, 0x00d6, 0x0020, CanonicalizeRangeLo },
+    { 0x00d7, 0x00d7, 0x0000, CanonicalizeUnique },
+    { 0x00d8, 0x00de, 0x0020, CanonicalizeRangeLo },
+    { 0x00df, 0x00df, 0x0000, CanonicalizeUnique },
+    { 0x00e0, 0x00f6, 0x0020, CanonicalizeRangeHi },
+    { 0x00f7, 0x00f7, 0x0000, CanonicalizeUnique },
+    { 0x00f8, 0x00fe, 0x0020, CanonicalizeRangeHi },
+    { 0x00ff, 0x00ff, 0x0079, CanonicalizeRangeLo },
+    { 0x0100, 0x012f, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0130, 0x0131, 0x0000, CanonicalizeUnique },
+    { 0x0132, 0x0137, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0138, 0x0138, 0x0000, CanonicalizeUnique },
+    { 0x0139, 0x0148, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x0149, 0x0149, 0x0000, CanonicalizeUnique },
+    { 0x014a, 0x0177, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0178, 0x0178, 0x0079, CanonicalizeRangeHi },
+    { 0x0179, 0x017e, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x017f, 0x017f, 0x0000, CanonicalizeUnique },
+    { 0x0180, 0x0180, 0x00c3, CanonicalizeRangeLo },
+    { 0x0181, 0x0181, 0x00d2, CanonicalizeRangeLo },
+    { 0x0182, 0x0185, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0186, 0x0186, 0x00ce, CanonicalizeRangeLo },
+    { 0x0187, 0x0188, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x0189, 0x018a, 0x00cd, CanonicalizeRangeLo },
+    { 0x018b, 0x018c, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x018d, 0x018d, 0x0000, CanonicalizeUnique },
+    { 0x018e, 0x018e, 0x004f, CanonicalizeRangeLo },
+    { 0x018f, 0x018f, 0x00ca, CanonicalizeRangeLo },
+    { 0x0190, 0x0190, 0x00cb, CanonicalizeRangeLo },
+    { 0x0191, 0x0192, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x0193, 0x0193, 0x00cd, CanonicalizeRangeLo },
+    { 0x0194, 0x0194, 0x00cf, CanonicalizeRangeLo },
+    { 0x0195, 0x0195, 0x0061, CanonicalizeRangeLo },
+    { 0x0196, 0x0196, 0x00d3, CanonicalizeRangeLo },
+    { 0x0197, 0x0197, 0x00d1, CanonicalizeRangeLo },
+    { 0x0198, 0x0199, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x019a, 0x019a, 0x00a3, CanonicalizeRangeLo },
+    { 0x019b, 0x019b, 0x0000, CanonicalizeUnique },
+    { 0x019c, 0x019c, 0x00d3, CanonicalizeRangeLo },
+    { 0x019d, 0x019d, 0x00d5, CanonicalizeRangeLo },
+    { 0x019e, 0x019e, 0x0082, CanonicalizeRangeLo },
+    { 0x019f, 0x019f, 0x00d6, CanonicalizeRangeLo },
+    { 0x01a0, 0x01a5, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x01a6, 0x01a6, 0x00da, CanonicalizeRangeLo },
+    { 0x01a7, 0x01a8, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x01a9, 0x01a9, 0x00da, CanonicalizeRangeLo },
+    { 0x01aa, 0x01ab, 0x0000, CanonicalizeUnique },
+    { 0x01ac, 0x01ad, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x01ae, 0x01ae, 0x00da, CanonicalizeRangeLo },
+    { 0x01af, 0x01b0, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x01b1, 0x01b2, 0x00d9, CanonicalizeRangeLo },
+    { 0x01b3, 0x01b6, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x01b7, 0x01b7, 0x00db, CanonicalizeRangeLo },
+    { 0x01b8, 0x01b9, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x01ba, 0x01bb, 0x0000, CanonicalizeUnique },
+    { 0x01bc, 0x01bd, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x01be, 0x01be, 0x0000, CanonicalizeUnique },
+    { 0x01bf, 0x01bf, 0x0038, CanonicalizeRangeLo },
+    { 0x01c0, 0x01c3, 0x0000, CanonicalizeUnique },
+    { 0x01c4, 0x01c6, 0x0000, CanonicalizeSet },
+    { 0x01c7, 0x01c9, 0x0001, CanonicalizeSet },
+    { 0x01ca, 0x01cc, 0x0002, CanonicalizeSet },
+    { 0x01cd, 0x01dc, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x01dd, 0x01dd, 0x004f, CanonicalizeRangeHi },
+    { 0x01de, 0x01ef, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x01f0, 0x01f0, 0x0000, CanonicalizeUnique },
+    { 0x01f1, 0x01f3, 0x0003, CanonicalizeSet },
+    { 0x01f4, 0x01f5, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x01f6, 0x01f6, 0x0061, CanonicalizeRangeHi },
+    { 0x01f7, 0x01f7, 0x0038, CanonicalizeRangeHi },
+    { 0x01f8, 0x021f, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0220, 0x0220, 0x0082, CanonicalizeRangeHi },
+    { 0x0221, 0x0221, 0x0000, CanonicalizeUnique },
+    { 0x0222, 0x0233, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0234, 0x0239, 0x0000, CanonicalizeUnique },
+    { 0x023a, 0x023a, 0x2a2b, CanonicalizeRangeLo },
+    { 0x023b, 0x023c, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x023d, 0x023d, 0x00a3, CanonicalizeRangeHi },
+    { 0x023e, 0x023e, 0x2a28, CanonicalizeRangeLo },
+    { 0x023f, 0x0240, 0x2a3f, CanonicalizeRangeLo },
+    { 0x0241, 0x0242, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x0243, 0x0243, 0x00c3, CanonicalizeRangeHi },
+    { 0x0244, 0x0244, 0x0045, CanonicalizeRangeLo },
+    { 0x0245, 0x0245, 0x0047, CanonicalizeRangeLo },
+    { 0x0246, 0x024f, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0250, 0x0250, 0x2a1f, CanonicalizeRangeLo },
+    { 0x0251, 0x0251, 0x2a1c, CanonicalizeRangeLo },
+    { 0x0252, 0x0252, 0x2a1e, CanonicalizeRangeLo },
+    { 0x0253, 0x0253, 0x00d2, CanonicalizeRangeHi },
+    { 0x0254, 0x0254, 0x00ce, CanonicalizeRangeHi },
+    { 0x0255, 0x0255, 0x0000, CanonicalizeUnique },
+    { 0x0256, 0x0257, 0x00cd, CanonicalizeRangeHi },
+    { 0x0258, 0x0258, 0x0000, CanonicalizeUnique },
+    { 0x0259, 0x0259, 0x00ca, CanonicalizeRangeHi },
+    { 0x025a, 0x025a, 0x0000, CanonicalizeUnique },
+    { 0x025b, 0x025b, 0x00cb, CanonicalizeRangeHi },
+    { 0x025c, 0x025c, 0xa54f, CanonicalizeRangeLo },
+    { 0x025d, 0x025f, 0x0000, CanonicalizeUnique },
+    { 0x0260, 0x0260, 0x00cd, CanonicalizeRangeHi },
+    { 0x0261, 0x0261, 0xa54b, CanonicalizeRangeLo },
+    { 0x0262, 0x0262, 0x0000, CanonicalizeUnique },
+    { 0x0263, 0x0263, 0x00cf, CanonicalizeRangeHi },
+    { 0x0264, 0x0264, 0x0000, CanonicalizeUnique },
+    { 0x0265, 0x0265, 0xa528, CanonicalizeRangeLo },
+    { 0x0266, 0x0266, 0xa544, CanonicalizeRangeLo },
+    { 0x0267, 0x0267, 0x0000, CanonicalizeUnique },
+    { 0x0268, 0x0268, 0x00d1, CanonicalizeRangeHi },
+    { 0x0269, 0x0269, 0x00d3, CanonicalizeRangeHi },
+    { 0x026a, 0x026a, 0x0000, CanonicalizeUnique },
+    { 0x026b, 0x026b, 0x29f7, CanonicalizeRangeLo },
+    { 0x026c, 0x026c, 0xa541, CanonicalizeRangeLo },
+    { 0x026d, 0x026e, 0x0000, CanonicalizeUnique },
+    { 0x026f, 0x026f, 0x00d3, CanonicalizeRangeHi },
+    { 0x0270, 0x0270, 0x0000, CanonicalizeUnique },
+    { 0x0271, 0x0271, 0x29fd, CanonicalizeRangeLo },
+    { 0x0272, 0x0272, 0x00d5, CanonicalizeRangeHi },
+    { 0x0273, 0x0274, 0x0000, CanonicalizeUnique },
+    { 0x0275, 0x0275, 0x00d6, CanonicalizeRangeHi },
+    { 0x0276, 0x027c, 0x0000, CanonicalizeUnique },
+    { 0x027d, 0x027d, 0x29e7, CanonicalizeRangeLo },
+    { 0x027e, 0x027f, 0x0000, CanonicalizeUnique },
+    { 0x0280, 0x0280, 0x00da, CanonicalizeRangeHi },
+    { 0x0281, 0x0282, 0x0000, CanonicalizeUnique },
+    { 0x0283, 0x0283, 0x00da, CanonicalizeRangeHi },
+    { 0x0284, 0x0286, 0x0000, CanonicalizeUnique },
+    { 0x0287, 0x0287, 0xa52a, CanonicalizeRangeLo },
+    { 0x0288, 0x0288, 0x00da, CanonicalizeRangeHi },
+    { 0x0289, 0x0289, 0x0045, CanonicalizeRangeHi },
+    { 0x028a, 0x028b, 0x00d9, CanonicalizeRangeHi },
+    { 0x028c, 0x028c, 0x0047, CanonicalizeRangeHi },
+    { 0x028d, 0x0291, 0x0000, CanonicalizeUnique },
+    { 0x0292, 0x0292, 0x00db, CanonicalizeRangeHi },
+    { 0x0293, 0x029d, 0x0000, CanonicalizeUnique },
+    { 0x029e, 0x029e, 0xa512, CanonicalizeRangeLo },
+    { 0x029f, 0x0344, 0x0000, CanonicalizeUnique },
+    { 0x0345, 0x0345, 0x0007, CanonicalizeSet },
+    { 0x0346, 0x036f, 0x0000, CanonicalizeUnique },
+    { 0x0370, 0x0373, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0374, 0x0375, 0x0000, CanonicalizeUnique },
+    { 0x0376, 0x0377, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0378, 0x037a, 0x0000, CanonicalizeUnique },
+    { 0x037b, 0x037d, 0x0082, CanonicalizeRangeLo },
+    { 0x037e, 0x037e, 0x0000, CanonicalizeUnique },
+    { 0x037f, 0x037f, 0x0074, CanonicalizeRangeLo },
+    { 0x0380, 0x0385, 0x0000, CanonicalizeUnique },
+    { 0x0386, 0x0386, 0x0026, CanonicalizeRangeLo },
+    { 0x0387, 0x0387, 0x0000, CanonicalizeUnique },
+    { 0x0388, 0x038a, 0x0025, CanonicalizeRangeLo },
+    { 0x038b, 0x038b, 0x0000, CanonicalizeUnique },
+    { 0x038c, 0x038c, 0x0040, CanonicalizeRangeLo },
+    { 0x038d, 0x038d, 0x0000, CanonicalizeUnique },
+    { 0x038e, 0x038f, 0x003f, CanonicalizeRangeLo },
+    { 0x0390, 0x0390, 0x0000, CanonicalizeUnique },
+    { 0x0391, 0x0391, 0x0020, CanonicalizeRangeLo },
+    { 0x0392, 0x0392, 0x0004, CanonicalizeSet },
+    { 0x0393, 0x0394, 0x0020, CanonicalizeRangeLo },
+    { 0x0395, 0x0395, 0x0005, CanonicalizeSet },
+    { 0x0396, 0x0397, 0x0020, CanonicalizeRangeLo },
+    { 0x0398, 0x0398, 0x0006, CanonicalizeSet },
+    { 0x0399, 0x0399, 0x0007, CanonicalizeSet },
+    { 0x039a, 0x039a, 0x0008, CanonicalizeSet },
+    { 0x039b, 0x039b, 0x0020, CanonicalizeRangeLo },
+    { 0x039c, 0x039c, 0x0009, CanonicalizeSet },
+    { 0x039d, 0x039f, 0x0020, CanonicalizeRangeLo },
+    { 0x03a0, 0x03a0, 0x000a, CanonicalizeSet },
+    { 0x03a1, 0x03a1, 0x000b, CanonicalizeSet },
+    { 0x03a2, 0x03a2, 0x0000, CanonicalizeUnique },
+    { 0x03a3, 0x03a3, 0x000c, CanonicalizeSet },
+    { 0x03a4, 0x03a5, 0x0020, CanonicalizeRangeLo },
+    { 0x03a6, 0x03a6, 0x000d, CanonicalizeSet },
+    { 0x03a7, 0x03ab, 0x0020, CanonicalizeRangeLo },
+    { 0x03ac, 0x03ac, 0x0026, CanonicalizeRangeHi },
+    { 0x03ad, 0x03af, 0x0025, CanonicalizeRangeHi },
+    { 0x03b0, 0x03b0, 0x0000, CanonicalizeUnique },
+    { 0x03b1, 0x03b1, 0x0020, CanonicalizeRangeHi },
+    { 0x03b2, 0x03b2, 0x0004, CanonicalizeSet },
+    { 0x03b3, 0x03b4, 0x0020, CanonicalizeRangeHi },
+    { 0x03b5, 0x03b5, 0x0005, CanonicalizeSet },
+    { 0x03b6, 0x03b7, 0x0020, CanonicalizeRangeHi },
+    { 0x03b8, 0x03b8, 0x0006, CanonicalizeSet },
+    { 0x03b9, 0x03b9, 0x0007, CanonicalizeSet },
+    { 0x03ba, 0x03ba, 0x0008, CanonicalizeSet },
+    { 0x03bb, 0x03bb, 0x0020, CanonicalizeRangeHi },
+    { 0x03bc, 0x03bc, 0x0009, CanonicalizeSet },
+    { 0x03bd, 0x03bf, 0x0020, CanonicalizeRangeHi },
+    { 0x03c0, 0x03c0, 0x000a, CanonicalizeSet },
+    { 0x03c1, 0x03c1, 0x000b, CanonicalizeSet },
+    { 0x03c2, 0x03c3, 0x000c, CanonicalizeSet },
+    { 0x03c4, 0x03c5, 0x0020, CanonicalizeRangeHi },
+    { 0x03c6, 0x03c6, 0x000d, CanonicalizeSet },
+    { 0x03c7, 0x03cb, 0x0020, CanonicalizeRangeHi },
+    { 0x03cc, 0x03cc, 0x0040, CanonicalizeRangeHi },
+    { 0x03cd, 0x03ce, 0x003f, CanonicalizeRangeHi },
+    { 0x03cf, 0x03cf, 0x0008, CanonicalizeRangeLo },
+    { 0x03d0, 0x03d0, 0x0004, CanonicalizeSet },
+    { 0x03d1, 0x03d1, 0x0006, CanonicalizeSet },
+    { 0x03d2, 0x03d4, 0x0000, CanonicalizeUnique },
+    { 0x03d5, 0x03d5, 0x000d, CanonicalizeSet },
+    { 0x03d6, 0x03d6, 0x000a, CanonicalizeSet },
+    { 0x03d7, 0x03d7, 0x0008, CanonicalizeRangeHi },
+    { 0x03d8, 0x03ef, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x03f0, 0x03f0, 0x0008, CanonicalizeSet },
+    { 0x03f1, 0x03f1, 0x000b, CanonicalizeSet },
+    { 0x03f2, 0x03f2, 0x0007, CanonicalizeRangeLo },
+    { 0x03f3, 0x03f3, 0x0074, CanonicalizeRangeHi },
+    { 0x03f4, 0x03f4, 0x0000, CanonicalizeUnique },
+    { 0x03f5, 0x03f5, 0x0005, CanonicalizeSet },
+    { 0x03f6, 0x03f6, 0x0000, CanonicalizeUnique },
+    { 0x03f7, 0x03f8, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x03f9, 0x03f9, 0x0007, CanonicalizeRangeHi },
+    { 0x03fa, 0x03fb, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x03fc, 0x03fc, 0x0000, CanonicalizeUnique },
+    { 0x03fd, 0x03ff, 0x0082, CanonicalizeRangeHi },
+    { 0x0400, 0x040f, 0x0050, CanonicalizeRangeLo },
+    { 0x0410, 0x042f, 0x0020, CanonicalizeRangeLo },
+    { 0x0430, 0x044f, 0x0020, CanonicalizeRangeHi },
+    { 0x0450, 0x045f, 0x0050, CanonicalizeRangeHi },
+    { 0x0460, 0x0481, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0482, 0x0489, 0x0000, CanonicalizeUnique },
+    { 0x048a, 0x04bf, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x04c0, 0x04c0, 0x000f, CanonicalizeRangeLo },
+    { 0x04c1, 0x04ce, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x04cf, 0x04cf, 0x000f, CanonicalizeRangeHi },
+    { 0x04d0, 0x052f, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x0530, 0x0530, 0x0000, CanonicalizeUnique },
+    { 0x0531, 0x0556, 0x0030, CanonicalizeRangeLo },
+    { 0x0557, 0x0560, 0x0000, CanonicalizeUnique },
+    { 0x0561, 0x0586, 0x0030, CanonicalizeRangeHi },
+    { 0x0587, 0x109f, 0x0000, CanonicalizeUnique },
+    { 0x10a0, 0x10c5, 0x1c60, CanonicalizeRangeLo },
+    { 0x10c6, 0x10c6, 0x0000, CanonicalizeUnique },
+    { 0x10c7, 0x10c7, 0x1c60, CanonicalizeRangeLo },
+    { 0x10c8, 0x10cc, 0x0000, CanonicalizeUnique },
+    { 0x10cd, 0x10cd, 0x1c60, CanonicalizeRangeLo },
+    { 0x10ce, 0x1d78, 0x0000, CanonicalizeUnique },
+    { 0x1d79, 0x1d79, 0x8a04, CanonicalizeRangeLo },
+    { 0x1d7a, 0x1d7c, 0x0000, CanonicalizeUnique },
+    { 0x1d7d, 0x1d7d, 0x0ee6, CanonicalizeRangeLo },
+    { 0x1d7e, 0x1dff, 0x0000, CanonicalizeUnique },
+    { 0x1e00, 0x1e5f, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x1e60, 0x1e61, 0x000e, CanonicalizeSet },
+    { 0x1e62, 0x1e95, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x1e96, 0x1e9a, 0x0000, CanonicalizeUnique },
+    { 0x1e9b, 0x1e9b, 0x000e, CanonicalizeSet },
+    { 0x1e9c, 0x1e9f, 0x0000, CanonicalizeUnique },
+    { 0x1ea0, 0x1eff, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x1f00, 0x1f07, 0x0008, CanonicalizeRangeLo },
+    { 0x1f08, 0x1f0f, 0x0008, CanonicalizeRangeHi },
+    { 0x1f10, 0x1f15, 0x0008, CanonicalizeRangeLo },
+    { 0x1f16, 0x1f17, 0x0000, CanonicalizeUnique },
+    { 0x1f18, 0x1f1d, 0x0008, CanonicalizeRangeHi },
+    { 0x1f1e, 0x1f1f, 0x0000, CanonicalizeUnique },
+    { 0x1f20, 0x1f27, 0x0008, CanonicalizeRangeLo },
+    { 0x1f28, 0x1f2f, 0x0008, CanonicalizeRangeHi },
+    { 0x1f30, 0x1f37, 0x0008, CanonicalizeRangeLo },
+    { 0x1f38, 0x1f3f, 0x0008, CanonicalizeRangeHi },
+    { 0x1f40, 0x1f45, 0x0008, CanonicalizeRangeLo },
+    { 0x1f46, 0x1f47, 0x0000, CanonicalizeUnique },
+    { 0x1f48, 0x1f4d, 0x0008, CanonicalizeRangeHi },
+    { 0x1f4e, 0x1f50, 0x0000, CanonicalizeUnique },
+    { 0x1f51, 0x1f51, 0x0008, CanonicalizeRangeLo },
+    { 0x1f52, 0x1f52, 0x0000, CanonicalizeUnique },
+    { 0x1f53, 0x1f53, 0x0008, CanonicalizeRangeLo },
+    { 0x1f54, 0x1f54, 0x0000, CanonicalizeUnique },
+    { 0x1f55, 0x1f55, 0x0008, CanonicalizeRangeLo },
+    { 0x1f56, 0x1f56, 0x0000, CanonicalizeUnique },
+    { 0x1f57, 0x1f57, 0x0008, CanonicalizeRangeLo },
+    { 0x1f58, 0x1f58, 0x0000, CanonicalizeUnique },
+    { 0x1f59, 0x1f59, 0x0008, CanonicalizeRangeHi },
+    { 0x1f5a, 0x1f5a, 0x0000, CanonicalizeUnique },
+    { 0x1f5b, 0x1f5b, 0x0008, CanonicalizeRangeHi },
+    { 0x1f5c, 0x1f5c, 0x0000, CanonicalizeUnique },
+    { 0x1f5d, 0x1f5d, 0x0008, CanonicalizeRangeHi },
+    { 0x1f5e, 0x1f5e, 0x0000, CanonicalizeUnique },
+    { 0x1f5f, 0x1f5f, 0x0008, CanonicalizeRangeHi },
+    { 0x1f60, 0x1f67, 0x0008, CanonicalizeRangeLo },
+    { 0x1f68, 0x1f6f, 0x0008, CanonicalizeRangeHi },
+    { 0x1f70, 0x1f71, 0x004a, CanonicalizeRangeLo },
+    { 0x1f72, 0x1f75, 0x0056, CanonicalizeRangeLo },
+    { 0x1f76, 0x1f77, 0x0064, CanonicalizeRangeLo },
+    { 0x1f78, 0x1f79, 0x0080, CanonicalizeRangeLo },
+    { 0x1f7a, 0x1f7b, 0x0070, CanonicalizeRangeLo },
+    { 0x1f7c, 0x1f7d, 0x007e, CanonicalizeRangeLo },
+    { 0x1f7e, 0x1faf, 0x0000, CanonicalizeUnique },
+    { 0x1fb0, 0x1fb1, 0x0008, CanonicalizeRangeLo },
+    { 0x1fb2, 0x1fb7, 0x0000, CanonicalizeUnique },
+    { 0x1fb8, 0x1fb9, 0x0008, CanonicalizeRangeHi },
+    { 0x1fba, 0x1fbb, 0x004a, CanonicalizeRangeHi },
+    { 0x1fbc, 0x1fbd, 0x0000, CanonicalizeUnique },
+    { 0x1fbe, 0x1fbe, 0x0007, CanonicalizeSet },
+    { 0x1fbf, 0x1fc7, 0x0000, CanonicalizeUnique },
+    { 0x1fc8, 0x1fcb, 0x0056, CanonicalizeRangeHi },
+    { 0x1fcc, 0x1fcf, 0x0000, CanonicalizeUnique },
+    { 0x1fd0, 0x1fd1, 0x0008, CanonicalizeRangeLo },
+    { 0x1fd2, 0x1fd7, 0x0000, CanonicalizeUnique },
+    { 0x1fd8, 0x1fd9, 0x0008, CanonicalizeRangeHi },
+    { 0x1fda, 0x1fdb, 0x0064, CanonicalizeRangeHi },
+    { 0x1fdc, 0x1fdf, 0x0000, CanonicalizeUnique },
+    { 0x1fe0, 0x1fe1, 0x0008, CanonicalizeRangeLo },
+    { 0x1fe2, 0x1fe4, 0x0000, CanonicalizeUnique },
+    { 0x1fe5, 0x1fe5, 0x0007, CanonicalizeRangeLo },
+    { 0x1fe6, 0x1fe7, 0x0000, CanonicalizeUnique },
+    { 0x1fe8, 0x1fe9, 0x0008, CanonicalizeRangeHi },
+    { 0x1fea, 0x1feb, 0x0070, CanonicalizeRangeHi },
+    { 0x1fec, 0x1fec, 0x0007, CanonicalizeRangeHi },
+    { 0x1fed, 0x1ff7, 0x0000, CanonicalizeUnique },
+    { 0x1ff8, 0x1ff9, 0x0080, CanonicalizeRangeHi },
+    { 0x1ffa, 0x1ffb, 0x007e, CanonicalizeRangeHi },
+    { 0x1ffc, 0x2131, 0x0000, CanonicalizeUnique },
+    { 0x2132, 0x2132, 0x001c, CanonicalizeRangeLo },
+    { 0x2133, 0x214d, 0x0000, CanonicalizeUnique },
+    { 0x214e, 0x214e, 0x001c, CanonicalizeRangeHi },
+    { 0x214f, 0x215f, 0x0000, CanonicalizeUnique },
+    { 0x2160, 0x216f, 0x0010, CanonicalizeRangeLo },
+    { 0x2170, 0x217f, 0x0010, CanonicalizeRangeHi },
+    { 0x2180, 0x2182, 0x0000, CanonicalizeUnique },
+    { 0x2183, 0x2184, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x2185, 0x24b5, 0x0000, CanonicalizeUnique },
+    { 0x24b6, 0x24cf, 0x001a, CanonicalizeRangeLo },
+    { 0x24d0, 0x24e9, 0x001a, CanonicalizeRangeHi },
+    { 0x24ea, 0x2bff, 0x0000, CanonicalizeUnique },
+    { 0x2c00, 0x2c2e, 0x0030, CanonicalizeRangeLo },
+    { 0x2c2f, 0x2c2f, 0x0000, CanonicalizeUnique },
+    { 0x2c30, 0x2c5e, 0x0030, CanonicalizeRangeHi },
+    { 0x2c5f, 0x2c5f, 0x0000, CanonicalizeUnique },
+    { 0x2c60, 0x2c61, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x2c62, 0x2c62, 0x29f7, CanonicalizeRangeHi },
+    { 0x2c63, 0x2c63, 0x0ee6, CanonicalizeRangeHi },
+    { 0x2c64, 0x2c64, 0x29e7, CanonicalizeRangeHi },
+    { 0x2c65, 0x2c65, 0x2a2b, CanonicalizeRangeHi },
+    { 0x2c66, 0x2c66, 0x2a28, CanonicalizeRangeHi },
+    { 0x2c67, 0x2c6c, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x2c6d, 0x2c6d, 0x2a1c, CanonicalizeRangeHi },
+    { 0x2c6e, 0x2c6e, 0x29fd, CanonicalizeRangeHi },
+    { 0x2c6f, 0x2c6f, 0x2a1f, CanonicalizeRangeHi },
+    { 0x2c70, 0x2c70, 0x2a1e, CanonicalizeRangeHi },
+    { 0x2c71, 0x2c71, 0x0000, CanonicalizeUnique },
+    { 0x2c72, 0x2c73, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x2c74, 0x2c74, 0x0000, CanonicalizeUnique },
+    { 0x2c75, 0x2c76, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x2c77, 0x2c7d, 0x0000, CanonicalizeUnique },
+    { 0x2c7e, 0x2c7f, 0x2a3f, CanonicalizeRangeHi },
+    { 0x2c80, 0x2ce3, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x2ce4, 0x2cea, 0x0000, CanonicalizeUnique },
+    { 0x2ceb, 0x2cee, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0x2cef, 0x2cf1, 0x0000, CanonicalizeUnique },
+    { 0x2cf2, 0x2cf3, 0x0000, CanonicalizeAlternatingAligned },
+    { 0x2cf4, 0x2cff, 0x0000, CanonicalizeUnique },
+    { 0x2d00, 0x2d25, 0x1c60, CanonicalizeRangeHi },
+    { 0x2d26, 0x2d26, 0x0000, CanonicalizeUnique },
+    { 0x2d27, 0x2d27, 0x1c60, CanonicalizeRangeHi },
+    { 0x2d28, 0x2d2c, 0x0000, CanonicalizeUnique },
+    { 0x2d2d, 0x2d2d, 0x1c60, CanonicalizeRangeHi },
+    { 0x2d2e, 0xa63f, 0x0000, CanonicalizeUnique },
+    { 0xa640, 0xa66d, 0x0000, CanonicalizeAlternatingAligned },
+    { 0xa66e, 0xa67f, 0x0000, CanonicalizeUnique },
+    { 0xa680, 0xa69b, 0x0000, CanonicalizeAlternatingAligned },
+    { 0xa69c, 0xa721, 0x0000, CanonicalizeUnique },
+    { 0xa722, 0xa72f, 0x0000, CanonicalizeAlternatingAligned },
+    { 0xa730, 0xa731, 0x0000, CanonicalizeUnique },
+    { 0xa732, 0xa76f, 0x0000, CanonicalizeAlternatingAligned },
+    { 0xa770, 0xa778, 0x0000, CanonicalizeUnique },
+    { 0xa779, 0xa77c, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0xa77d, 0xa77d, 0x8a04, CanonicalizeRangeHi },
+    { 0xa77e, 0xa787, 0x0000, CanonicalizeAlternatingAligned },
+    { 0xa788, 0xa78a, 0x0000, CanonicalizeUnique },
+    { 0xa78b, 0xa78c, 0x0000, CanonicalizeAlternatingUnaligned },
+    { 0xa78d, 0xa78d, 0xa528, CanonicalizeRangeHi },
+    { 0xa78e, 0xa78f, 0x0000, CanonicalizeUnique },
+    { 0xa790, 0xa793, 0x0000, CanonicalizeAlternatingAligned },
+    { 0xa794, 0xa795, 0x0000, CanonicalizeUnique },
+    { 0xa796, 0xa7a9, 0x0000, CanonicalizeAlternatingAligned },
+    { 0xa7aa, 0xa7aa, 0xa544, CanonicalizeRangeHi },
+    { 0xa7ab, 0xa7ab, 0xa54f, CanonicalizeRangeHi },
+    { 0xa7ac, 0xa7ac, 0xa54b, CanonicalizeRangeHi },
+    { 0xa7ad, 0xa7ad, 0xa541, CanonicalizeRangeHi },
+    { 0xa7ae, 0xa7af, 0x0000, CanonicalizeUnique },
+    { 0xa7b0, 0xa7b0, 0xa512, CanonicalizeRangeHi },
+    { 0xa7b1, 0xa7b1, 0xa52a, CanonicalizeRangeHi },
+    { 0xa7b2, 0xff20, 0x0000, CanonicalizeUnique },
+    { 0xff21, 0xff3a, 0x0020, CanonicalizeRangeLo },
+    { 0xff3b, 0xff40, 0x0000, CanonicalizeUnique },
+    { 0xff41, 0xff5a, 0x0020, CanonicalizeRangeHi },
+    { 0xff5b, 0xffff, 0x0000, CanonicalizeUnique },
+};
+
+} } // JSC::Yarr
+
diff --git a/yarr/YarrCanonicalizeUCS2.js b/yarr/YarrCanonicalizeUCS2.js
new file mode 100644
index 0000000..dc578cf
--- /dev/null
+++ b/yarr/YarrCanonicalizeUCS2.js
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+function printHeader()
+{
+    var copyright = (
+                     "/*"                                                                            + "\n" +
+                     " * Copyright (C) 2012-2013, 2015-2016 Apple Inc. All rights reserved."         + "\n" +
+                     " *"                                                                            + "\n" +
+                     " * Redistribution and use in source and binary forms, with or without"         + "\n" +
+                     " * modification, are permitted provided that the following conditions"         + "\n" +
+                     " * are met:"                                                                   + "\n" +
+                     " * 1. Redistributions of source code must retain the above copyright"          + "\n" +
+                     " *    notice, this list of conditions and the following disclaimer."           + "\n" +
+                     " * 2. Redistributions in binary form must reproduce the above copyright"       + "\n" +
+                     " *    notice, this list of conditions and the following disclaimer in the"     + "\n" +
+                     " *    documentation and/or other materials provided with the distribution."    + "\n" +
+                     " *"                                                                            + "\n" +
+                     " * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY"                  + "\n" +
+                     " * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE"          + "\n" +
+                     " * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR"         + "\n" +
+                     " * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR"                   + "\n" +
+                     " * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,"      + "\n" +
+                     " * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,"        + "\n" +
+                     " * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR"         + "\n" +
+                     " * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY"        + "\n" +
+                     " * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT"               + "\n" +
+                     " * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE"      + "\n" +
+                     " * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. "      + "\n" +
+                     " */");
+    
+    print(copyright);
+    print();
+    print("// DO NOT EDIT! - this file autogenerated by YarrCanonicalize.js");
+    print();
+    print('#include "config.h"');
+    print('#include "YarrCanonicalize.h"');
+    print();
+    print("namespace JSC { namespace Yarr {");
+    print();
+}
+
+function printFooter()
+{
+    print("} } // JSC::Yarr");
+    print();
+}
+
+// Helper function to convert a number to a fixed width hex representation of a UChar32.
+function hex(x)
+{
+    var s = Number(x).toString(16);
+    while (s.length < 4)
+        s = 0 + s;
+    return "0x" + s;
+}
+
+// See ES 6.0, 21.2.2.8.2 Steps 3
+function canonicalize(ch)
+{
+    var u = String.fromCharCode(ch).toUpperCase();
+    if (u.length > 1)
+        return ch;
+    var cu = u.charCodeAt(0);
+    if (ch >= 128 && cu < 128)
+        return ch;
+    return cu;
+}
+
+var MAX_UCS2 = 0xFFFF;
+
+function createUCS2CanonicalGroups()
+{
+    var groupedCanonically = [];
+    // Pass 1: populate groupedCanonically - this is mapping from canonicalized
+    // values back to the set of character code that canonicalize to them.
+    for (var i = 0; i <= MAX_UCS2; ++i) {
+        var ch = canonicalize(i);
+        if (!groupedCanonically[ch])
+            groupedCanonically[ch] = [];
+        groupedCanonically[ch].push(i);
+    }
+
+    return groupedCanonically;
+}
+
+function createTables(prefix, maxValue, canonicalGroups)
+{
+    var prefixLower = prefix.toLowerCase();
+    var prefixUpper = prefix.toUpperCase();
+    var typeInfo = [];
+    var characterSetInfo = [];
+    // Pass 2: populate typeInfo & characterSetInfo. For every character calculate
+    // a typeInfo value, described by the types above, and a value payload.
+    for (cu in canonicalGroups) {
+        // The set of characters that canonicalize to cu
+        var characters = canonicalGroups[cu];
+
+        // If there is only one, it is unique.
+        if (characters.length == 1) {
+            typeInfo[characters[0]] = "CanonicalizeUnique:0";
+            continue;
+        }
+
+        // Sort the array.
+        characters.sort(function(x,y){return x-y;});
+
+        // If there are more than two characters, create an entry in characterSetInfo.
+        if (characters.length > 2) {
+            for (i in characters)
+                typeInfo[characters[i]] = "CanonicalizeSet:" + characterSetInfo.length;
+            characterSetInfo.push(characters);
+
+            continue;
+        }
+
+        // We have a pair, mark alternating ranges, otherwise track whether this is the low or high partner.
+        var lo = characters[0];
+        var hi = characters[1];
+        var delta = hi - lo;
+        if (delta == 1) {
+            var type = lo & 1 ? "CanonicalizeAlternatingUnaligned:0" : "CanonicalizeAlternatingAligned:0";
+            typeInfo[lo] = type;
+            typeInfo[hi] = type;
+        } else {
+            typeInfo[lo] = "CanonicalizeRangeLo:" + delta;
+            typeInfo[hi] = "CanonicalizeRangeHi:" + delta;
+        }
+    }
+
+    var rangeInfo = [];
+    // Pass 3: coallesce types into ranges.
+    for (var end = 0; end <= maxValue; ++end) {
+        var begin = end;
+        var type = typeInfo[end];
+        while (end < maxValue && typeInfo[end + 1] == type)
+            ++end;
+        rangeInfo.push({begin:begin, end:end, type:type});
+    }
+
+    for (i in characterSetInfo) {
+        var characters = ""
+        var set = characterSetInfo[i];
+        for (var j in set)
+            characters += hex(set[j]) + ", ";
+        print("const UChar32 " + prefixLower + "CharacterSet" + i + "[] = { " + characters + "0 };");
+    }
+    print();
+    print("static const size_t " + prefixUpper + "_CANONICALIZATION_SETS = " + characterSetInfo.length + ";");
+    print("const UChar32* const " + prefixLower + "CharacterSetInfo[" + prefixUpper + "_CANONICALIZATION_SETS] = {");
+    for (i in characterSetInfo)
+    print("    " + prefixLower + "CharacterSet" + i + ",");
+    print("};");
+    print();
+    print("const size_t " + prefixUpper + "_CANONICALIZATION_RANGES = " + rangeInfo.length + ";");
+    print("const CanonicalizationRange " + prefixLower + "RangeInfo[" + prefixUpper + "_CANONICALIZATION_RANGES] = {");
+    for (i in rangeInfo) {
+        var info = rangeInfo[i];
+        var typeAndValue = info.type.split(':');
+        print("    { " + hex(info.begin) + ", " + hex(info.end) + ", " + hex(typeAndValue[1]) + ", " + typeAndValue[0] + " },");
+    }
+    print("};");
+    print();
+}
+
+printHeader();
+
+createTables("UCS2", MAX_UCS2, createUCS2CanonicalGroups());
+
+printFooter();
+
diff --git a/yarr/YarrInterpreter.cpp b/yarr/YarrInterpreter.cpp
new file mode 100644
index 0000000..10beec8
--- /dev/null
+++ b/yarr/YarrInterpreter.cpp
@@ -0,0 +1,2094 @@
+/*
+ * Copyright (C) 2009, 2013, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Peter Varga (pvarga@inf.u-szeged.hu), University of Szeged
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "YarrInterpreter.h"
+
+#include "SuperSampler.h"
+#include "Yarr.h"
+#include "YarrCanonicalize.h"
+#include <wtf/BumpPointerAllocator.h>
+#include <wtf/DataLog.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+template<typename CharType>
+class Interpreter {
+public:
+    struct ParenthesesDisjunctionContext;
+
+    struct BackTrackInfoPatternCharacter {
+        uintptr_t begin; // Only needed for unicode patterns
+        uintptr_t matchAmount;
+    };
+    struct BackTrackInfoCharacterClass {
+        uintptr_t begin; // Only needed for unicode patterns
+        uintptr_t matchAmount;
+    };
+    struct BackTrackInfoBackReference {
+        uintptr_t begin; // Not really needed for greedy quantifiers.
+        uintptr_t matchAmount; // Not really needed for fixed quantifiers.
+    };
+    struct BackTrackInfoAlternative {
+        uintptr_t offset;
+    };
+    struct BackTrackInfoParentheticalAssertion {
+        uintptr_t begin;
+    };
+    struct BackTrackInfoParenthesesOnce {
+        uintptr_t begin;
+    };
+    struct BackTrackInfoParenthesesTerminal {
+        uintptr_t begin;
+    };
+    struct BackTrackInfoParentheses {
+        uintptr_t matchAmount;
+        ParenthesesDisjunctionContext* lastContext;
+    };
+
+    static inline void appendParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack, ParenthesesDisjunctionContext* context)
+    {
+        context->next = backTrack->lastContext;
+        backTrack->lastContext = context;
+        ++backTrack->matchAmount;
+    }
+
+    static inline void popParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack)
+    {
+        RELEASE_ASSERT(backTrack->matchAmount);
+        RELEASE_ASSERT(backTrack->lastContext);
+        backTrack->lastContext = backTrack->lastContext->next;
+        --backTrack->matchAmount;
+    }
+
+    struct DisjunctionContext
+    {
+        DisjunctionContext()
+            : term(0)
+        {
+        }
+
+        void* operator new(size_t, void* where)
+        {
+            return where;
+        }
+
+        int term;
+        unsigned matchBegin;
+        unsigned matchEnd;
+        uintptr_t frame[1];
+    };
+
+    DisjunctionContext* allocDisjunctionContext(ByteDisjunction* disjunction)
+    {
+        size_t size = sizeof(DisjunctionContext) - sizeof(uintptr_t) + disjunction->m_frameSize * sizeof(uintptr_t);
+        allocatorPool = allocatorPool->ensureCapacity(size);
+        RELEASE_ASSERT(allocatorPool);
+        return new (allocatorPool->alloc(size)) DisjunctionContext();
+    }
+
+    void freeDisjunctionContext(DisjunctionContext* context)
+    {
+        allocatorPool = allocatorPool->dealloc(context);
+    }
+
+    struct ParenthesesDisjunctionContext
+    {
+        ParenthesesDisjunctionContext(unsigned* output, ByteTerm& term)
+            : next(0)
+        {
+            unsigned firstSubpatternId = term.atom.subpatternId;
+            unsigned numNestedSubpatterns = term.atom.parenthesesDisjunction->m_numSubpatterns;
+
+            for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i) {
+                subpatternBackup[i] = output[(firstSubpatternId << 1) + i];
+                output[(firstSubpatternId << 1) + i] = offsetNoMatch;
+            }
+
+            new (getDisjunctionContext(term)) DisjunctionContext();
+        }
+
+        void* operator new(size_t, void* where)
+        {
+            return where;
+        }
+
+        void restoreOutput(unsigned* output, unsigned firstSubpatternId, unsigned numNestedSubpatterns)
+        {
+            for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i)
+                output[(firstSubpatternId << 1) + i] = subpatternBackup[i];
+        }
+
+        DisjunctionContext* getDisjunctionContext(ByteTerm& term)
+        {
+            return reinterpret_cast<DisjunctionContext*>(&(subpatternBackup[term.atom.parenthesesDisjunction->m_numSubpatterns << 1]));
+        }
+
+        ParenthesesDisjunctionContext* next;
+        unsigned subpatternBackup[1];
+    };
+
+    ParenthesesDisjunctionContext* allocParenthesesDisjunctionContext(ByteDisjunction* disjunction, unsigned* output, ByteTerm& term)
+    {
+        size_t size = sizeof(ParenthesesDisjunctionContext) - sizeof(unsigned) + (term.atom.parenthesesDisjunction->m_numSubpatterns << 1) * sizeof(unsigned) + sizeof(DisjunctionContext) - sizeof(uintptr_t) + static_cast<size_t>(disjunction->m_frameSize) * sizeof(uintptr_t);
+        allocatorPool = allocatorPool->ensureCapacity(size);
+        RELEASE_ASSERT(allocatorPool);
+        return new (allocatorPool->alloc(size)) ParenthesesDisjunctionContext(output, term);
+    }
+
+    void freeParenthesesDisjunctionContext(ParenthesesDisjunctionContext* context)
+    {
+        allocatorPool = allocatorPool->dealloc(context);
+    }
+
+    class InputStream {
+    public:
+        InputStream(const CharType* input, unsigned start, unsigned length, bool decodeSurrogatePairs)
+            : input(input)
+            , pos(start)
+            , length(length)
+            , decodeSurrogatePairs(decodeSurrogatePairs)
+        {
+        }
+
+        void next()
+        {
+            ++pos;
+        }
+
+        void rewind(unsigned amount)
+        {
+            ASSERT(pos >= amount);
+            pos -= amount;
+        }
+
+        int read()
+        {
+            ASSERT(pos < length);
+            if (pos < length)
+                return input[pos];
+            return -1;
+        }
+
+        int readPair()
+        {
+            ASSERT(pos + 1 < length);
+            return input[pos] | input[pos + 1] << 16;
+        }
+
+        int readChecked(unsigned negativePositionOffest)
+        {
+            RELEASE_ASSERT(pos >= negativePositionOffest);
+            unsigned p = pos - negativePositionOffest;
+            ASSERT(p < length);
+            int result = input[p];
+            if (U16_IS_LEAD(result) && decodeSurrogatePairs && p + 1 < length && U16_IS_TRAIL(input[p + 1])) {
+                if (atEnd())
+                    return -1;
+                
+                result = U16_GET_SUPPLEMENTARY(result, input[p + 1]);
+                next();
+            }
+            return result;
+        }
+        
+        int readSurrogatePairChecked(unsigned negativePositionOffset)
+        {
+            RELEASE_ASSERT(pos >= negativePositionOffset);
+            unsigned p = pos - negativePositionOffset;
+            ASSERT(p < length);
+            if (p + 1 >= length)
+                return -1;
+
+            int first = input[p];
+            int second = input[p + 1];
+            if (U16_IS_LEAD(first) && U16_IS_TRAIL(second))
+                return U16_GET_SUPPLEMENTARY(first, second);
+
+            return -1;
+        }
+
+        int reread(unsigned from)
+        {
+            ASSERT(from < length);
+            int result = input[from];
+            if (U16_IS_LEAD(result) && decodeSurrogatePairs && from + 1 < length && U16_IS_TRAIL(input[from + 1]))
+                result = U16_GET_SUPPLEMENTARY(result, input[from + 1]);
+            return result;
+        }
+
+        int prev()
+        {
+            ASSERT(!(pos > length));
+            if (pos && length)
+                return input[pos - 1];
+            return -1;
+        }
+
+        unsigned getPos()
+        {
+            return pos;
+        }
+
+        void setPos(unsigned p)
+        {
+            pos = p;
+        }
+
+        bool atStart()
+        {
+            return pos == 0;
+        }
+
+        bool atEnd()
+        {
+            return pos == length;
+        }
+
+        unsigned end()
+        {
+            return length;
+        }
+
+        bool checkInput(unsigned count)
+        {
+            if (((pos + count) <= length) && ((pos + count) >= pos)) {
+                pos += count;
+                return true;
+            }
+            return false;
+        }
+
+        void uncheckInput(unsigned count)
+        {
+            RELEASE_ASSERT(pos >= count);
+            pos -= count;
+        }
+
+        bool atStart(unsigned negativePositionOffset)
+        {
+            return pos == negativePositionOffset;
+        }
+
+        bool atEnd(unsigned negativePositionOffest)
+        {
+            RELEASE_ASSERT(pos >= negativePositionOffest);
+            return (pos - negativePositionOffest) == length;
+        }
+
+        bool isAvailableInput(unsigned offset)
+        {
+            return (((pos + offset) <= length) && ((pos + offset) >= pos));
+        }
+
+    private:
+        const CharType* input;
+        unsigned pos;
+        unsigned length;
+        bool decodeSurrogatePairs;
+    };
+
+    bool testCharacterClass(CharacterClass* characterClass, int ch)
+    {
+        if (!isASCII(ch)) {
+            for (unsigned i = 0; i < characterClass->m_matchesUnicode.size(); ++i)
+                if (ch == characterClass->m_matchesUnicode[i])
+                    return true;
+            for (unsigned i = 0; i < characterClass->m_rangesUnicode.size(); ++i)
+                if ((ch >= characterClass->m_rangesUnicode[i].begin) && (ch <= characterClass->m_rangesUnicode[i].end))
+                    return true;
+        } else {
+            for (unsigned i = 0; i < characterClass->m_matches.size(); ++i)
+                if (ch == characterClass->m_matches[i])
+                    return true;
+            for (unsigned i = 0; i < characterClass->m_ranges.size(); ++i)
+                if ((ch >= characterClass->m_ranges[i].begin) && (ch <= characterClass->m_ranges[i].end))
+                    return true;
+        }
+
+        return false;
+    }
+
+    bool checkCharacter(int testChar, unsigned negativeInputOffset)
+    {
+        return testChar == input.readChecked(negativeInputOffset);
+    }
+
+    bool checkSurrogatePair(int testUnicodeChar, unsigned negativeInputOffset)
+    {
+        return testUnicodeChar == input.readSurrogatePairChecked(negativeInputOffset);
+    }
+
+    bool checkCasedCharacter(int loChar, int hiChar, unsigned negativeInputOffset)
+    {
+        int ch = input.readChecked(negativeInputOffset);
+        return (loChar == ch) || (hiChar == ch);
+    }
+
+    bool checkCharacterClass(CharacterClass* characterClass, bool invert, unsigned negativeInputOffset)
+    {
+        bool match = testCharacterClass(characterClass, input.readChecked(negativeInputOffset));
+        return invert ? !match : match;
+    }
+
+    bool tryConsumeBackReference(int matchBegin, int matchEnd, unsigned negativeInputOffset)
+    {
+        unsigned matchSize = (unsigned)(matchEnd - matchBegin);
+
+        if (!input.checkInput(matchSize))
+            return false;
+
+        for (unsigned i = 0; i < matchSize; ++i) {
+            int oldCh = input.reread(matchBegin + i);
+            int ch;
+            if (!U_IS_BMP(oldCh)) {
+                ch = input.readSurrogatePairChecked(negativeInputOffset + matchSize - i);
+                ++i;
+            } else
+                ch = input.readChecked(negativeInputOffset + matchSize - i);
+
+            if (oldCh == ch)
+                continue;
+
+            if (pattern->ignoreCase()) {
+                // See ES 6.0, 21.2.2.8.2 for the definition of Canonicalize(). For non-Unicode
+                // patterns, Unicode values are never allowed to match against ASCII ones.
+                // For Unicode, we need to check all canonical equivalents of a character.
+                if (!unicode && (isASCII(oldCh) || isASCII(ch))) {
+                    if (toASCIIUpper(oldCh) == toASCIIUpper(ch))
+                        continue;
+                } else if (areCanonicallyEquivalent(oldCh, ch, unicode ? CanonicalMode::Unicode : CanonicalMode::UCS2))
+                    continue;
+            }
+
+            input.uncheckInput(matchSize);
+            return false;
+        }
+
+        return true;
+    }
+
+    bool matchAssertionBOL(ByteTerm& term)
+    {
+        return (input.atStart(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition + 1)));
+    }
+
+    bool matchAssertionEOL(ByteTerm& term)
+    {
+        if (term.inputPosition)
+            return (input.atEnd(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition)));
+
+        return (input.atEnd()) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.read()));
+    }
+
+    bool matchAssertionWordBoundary(ByteTerm& term)
+    {
+        bool prevIsWordchar = !input.atStart(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition + 1));
+        bool readIsWordchar;
+        if (term.inputPosition)
+            readIsWordchar = !input.atEnd(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition));
+        else
+            readIsWordchar = !input.atEnd() && testCharacterClass(pattern->wordcharCharacterClass, input.read());
+
+        bool wordBoundary = prevIsWordchar != readIsWordchar;
+        return term.invert() ? !wordBoundary : wordBoundary;
+    }
+
+    bool backtrackPatternCharacter(ByteTerm& term, DisjunctionContext* context)
+    {
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(U16_LENGTH(term.atom.patternCharacter));
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityMaxCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCharacter(term.atom.patternCharacter, term.inputPosition + 1))
+                    return true;
+            }
+            input.setPos(backTrack->begin);
+            break;
+        }
+
+        return false;
+    }
+
+    bool backtrackPatternCasedCharacter(ByteTerm& term, DisjunctionContext* context)
+    {
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityMaxCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCasedCharacter(term.atom.casedCharacter.lo, term.atom.casedCharacter.hi, term.inputPosition + 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchCharacterClass(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeCharacterClass);
+        BackTrackInfoCharacterClass* backTrack = reinterpret_cast<BackTrackInfoCharacterClass*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            if (unicode) {
+                backTrack->begin = input.getPos();
+                unsigned matchAmount = 0;
+                for (matchAmount = 0; matchAmount < term.atom.quantityMaxCount; ++matchAmount) {
+                    if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - matchAmount)) {
+                        input.setPos(backTrack->begin);
+                        return false;
+                    }
+                }
+
+                return true;
+            }
+
+            for (unsigned matchAmount = 0; matchAmount < term.atom.quantityMaxCount; ++matchAmount) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - matchAmount))
+                    return false;
+            }
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            unsigned position = input.getPos();
+            backTrack->begin = position;
+            unsigned matchAmount = 0;
+            while ((matchAmount < term.atom.quantityMaxCount) && input.checkInput(1)) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + 1)) {
+                    input.setPos(position);
+                    break;
+                }
+                ++matchAmount;
+                position = input.getPos();
+            }
+            backTrack->matchAmount = matchAmount;
+
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            backTrack->begin = input.getPos();
+            backTrack->matchAmount = 0;
+            return true;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool backtrackCharacterClass(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeCharacterClass);
+        BackTrackInfoCharacterClass* backTrack = reinterpret_cast<BackTrackInfoCharacterClass*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            if (unicode)
+                input.setPos(backTrack->begin);
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                if (unicode) {
+                    // Rematch one less match
+                    input.setPos(backTrack->begin);
+                    --backTrack->matchAmount;
+                    for (unsigned matchAmount = 0; (matchAmount < backTrack->matchAmount) && input.checkInput(1); ++matchAmount) {
+                        if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + 1)) {
+                            input.uncheckInput(1);
+                            break;
+                        }
+                    }
+                    return true;
+                }
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityMaxCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + 1))
+                    return true;
+            }
+            input.setPos(backTrack->begin);
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchBackReference(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeBackReference);
+        BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
+
+        unsigned matchBegin = output[(term.atom.subpatternId << 1)];
+        unsigned matchEnd = output[(term.atom.subpatternId << 1) + 1];
+
+        // If the end position of the referenced match hasn't set yet then the backreference in the same parentheses where it references to that.
+        // In this case the result of match is empty string like when it references to a parentheses with zero-width match.
+        // Eg.: /(a\1)/
+        if (matchEnd == offsetNoMatch)
+            return true;
+
+        if (matchBegin == offsetNoMatch)
+            return true;
+
+        ASSERT(matchBegin <= matchEnd);
+
+        if (matchBegin == matchEnd)
+            return true;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            backTrack->begin = input.getPos();
+            for (unsigned matchAmount = 0; matchAmount < term.atom.quantityMaxCount; ++matchAmount) {
+                if (!tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
+                    input.setPos(backTrack->begin);
+                    return false;
+                }
+            }
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            unsigned matchAmount = 0;
+            while ((matchAmount < term.atom.quantityMaxCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition))
+                ++matchAmount;
+            backTrack->matchAmount = matchAmount;
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            backTrack->begin = input.getPos();
+            backTrack->matchAmount = 0;
+            return true;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool backtrackBackReference(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeBackReference);
+        BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
+
+        unsigned matchBegin = output[(term.atom.subpatternId << 1)];
+        unsigned matchEnd = output[(term.atom.subpatternId << 1) + 1];
+
+        if (matchBegin == offsetNoMatch)
+            return false;
+
+        ASSERT(matchBegin <= matchEnd);
+
+        if (matchBegin == matchEnd)
+            return false;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            // for quantityMaxCount == 1, could rewind.
+            input.setPos(backTrack->begin);
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.rewind(matchEnd - matchBegin);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityMaxCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
+                ++backTrack->matchAmount;
+                return true;
+            }
+            input.setPos(backTrack->begin);
+            break;
+        }
+
+        return false;
+    }
+
+    void recordParenthesesMatch(ByteTerm& term, ParenthesesDisjunctionContext* context)
+    {
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = context->getDisjunctionContext(term)->matchBegin - term.inputPosition;
+            output[(subpatternId << 1) + 1] = context->getDisjunctionContext(term)->matchEnd - term.inputPosition;
+        }
+    }
+    void resetMatches(ByteTerm& term, ParenthesesDisjunctionContext* context)
+    {
+        unsigned firstSubpatternId = term.atom.subpatternId;
+        unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
+        context->restoreOutput(output, firstSubpatternId, count);
+    }
+    JSRegExpResult parenthesesDoBacktrack(ByteTerm& term, BackTrackInfoParentheses* backTrack)
+    {
+        while (backTrack->matchAmount) {
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+
+            JSRegExpResult result = matchDisjunction(term.atom.parenthesesDisjunction, context->getDisjunctionContext(term), true);
+            if (result == JSRegExpMatch)
+                return JSRegExpMatch;
+
+            resetMatches(term, context);
+            popParenthesesDisjunctionContext(backTrack);
+            freeParenthesesDisjunctionContext(context);
+
+            if (result != JSRegExpNoMatch)
+                return result;
+        }
+
+        return JSRegExpNoMatch;
+    }
+
+    bool matchParenthesesOnceBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+        ASSERT(term.atom.quantityMaxCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy: {
+            // set this speculatively; if we get to the parens end this will be true.
+            backTrack->begin = input.getPos();
+            break;
+        }
+        case QuantifierNonGreedy: {
+            backTrack->begin = notFound;
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        }
+        case QuantifierFixedCount:
+            break;
+        }
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = input.getPos() - term.inputPosition;
+        }
+
+        return true;
+    }
+
+    bool matchParenthesesOnceEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceEnd);
+        ASSERT(term.atom.quantityMaxCount == 1);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1) + 1] = input.getPos() - term.inputPosition;
+        }
+
+        if (term.atom.quantityType == QuantifierFixedCount)
+            return true;
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+        return backTrack->begin != input.getPos();
+    }
+
+    bool backtrackParenthesesOnceBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+        ASSERT(term.atom.quantityMaxCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = offsetNoMatch;
+            output[(subpatternId << 1) + 1] = offsetNoMatch;
+        }
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy:
+            // if we backtrack to this point, there is another chance - try matching nothing.
+            ASSERT(backTrack->begin != notFound);
+            backTrack->begin = notFound;
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        case QuantifierNonGreedy:
+            ASSERT(backTrack->begin != notFound);
+            FALLTHROUGH;
+        case QuantifierFixedCount:
+            break;
+        }
+
+        return false;
+    }
+
+    bool backtrackParenthesesOnceEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceEnd);
+        ASSERT(term.atom.quantityMaxCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy:
+            if (backTrack->begin == notFound) {
+                context->term -= term.atom.parenthesesWidth;
+                return false;
+            }
+            FALLTHROUGH;
+        case QuantifierNonGreedy:
+            if (backTrack->begin == notFound) {
+                backTrack->begin = input.getPos();
+                if (term.capture()) {
+                    // Technically this access to inputPosition should be accessing the begin term's
+                    // inputPosition, but for repeats other than fixed these values should be
+                    // the same anyway! (We don't pre-check for greedy or non-greedy matches.)
+                    ASSERT((&term - term.atom.parenthesesWidth)->type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+                    ASSERT((&term - term.atom.parenthesesWidth)->inputPosition == term.inputPosition);
+                    unsigned subpatternId = term.atom.subpatternId;
+                    output[subpatternId << 1] = input.getPos() - term.inputPosition;
+                }
+                context->term -= term.atom.parenthesesWidth;
+                return true;
+            }
+            FALLTHROUGH;
+        case QuantifierFixedCount:
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchParenthesesTerminalBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternTerminalBegin);
+        ASSERT(term.atom.quantityType == QuantifierGreedy);
+        ASSERT(term.atom.quantityMaxCount == quantifyInfinite);
+        ASSERT(!term.capture());
+
+        BackTrackInfoParenthesesTerminal* backTrack = reinterpret_cast<BackTrackInfoParenthesesTerminal*>(context->frame + term.frameLocation);
+        backTrack->begin = input.getPos();
+        return true;
+    }
+
+    bool matchParenthesesTerminalEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternTerminalEnd);
+
+        BackTrackInfoParenthesesTerminal* backTrack = reinterpret_cast<BackTrackInfoParenthesesTerminal*>(context->frame + term.frameLocation);
+        // Empty match is a failed match.
+        if (backTrack->begin == input.getPos())
+            return false;
+
+        // Successful match! Okay, what's next? - loop around and try to match more!
+        context->term -= (term.atom.parenthesesWidth + 1);
+        return true;
+    }
+
+    bool backtrackParenthesesTerminalBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternTerminalBegin);
+        ASSERT(term.atom.quantityType == QuantifierGreedy);
+        ASSERT(term.atom.quantityMaxCount == quantifyInfinite);
+        ASSERT(!term.capture());
+
+        // If we backtrack to this point, we have failed to match this iteration of the parens.
+        // Since this is greedy / zero minimum a failed is also accepted as a match!
+        context->term += term.atom.parenthesesWidth;
+        return true;
+    }
+
+    bool backtrackParenthesesTerminalEnd(ByteTerm&, DisjunctionContext*)
+    {
+        // 'Terminal' parentheses are at the end of the regex, and as such a match past end
+        // should always be returned as a successful match - we should never backtrack to here.
+        RELEASE_ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool matchParentheticalAssertionBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionBegin);
+        ASSERT(term.atom.quantityMaxCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        backTrack->begin = input.getPos();
+        return true;
+    }
+
+    bool matchParentheticalAssertionEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionEnd);
+        ASSERT(term.atom.quantityMaxCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        input.setPos(backTrack->begin);
+
+        // We've reached the end of the parens; if they are inverted, this is failure.
+        if (term.invert()) {
+            context->term -= term.atom.parenthesesWidth;
+            return false;
+        }
+
+        return true;
+    }
+
+    bool backtrackParentheticalAssertionBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionBegin);
+        ASSERT(term.atom.quantityMaxCount == 1);
+
+        // We've failed to match parens; if they are inverted, this is win!
+        if (term.invert()) {
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        }
+
+        return false;
+    }
+
+    bool backtrackParentheticalAssertionEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionEnd);
+        ASSERT(term.atom.quantityMaxCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        input.setPos(backTrack->begin);
+
+        context->term -= term.atom.parenthesesWidth;
+        return false;
+    }
+
+    JSRegExpResult matchParentheses(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpattern);
+
+        BackTrackInfoParentheses* backTrack = reinterpret_cast<BackTrackInfoParentheses*>(context->frame + term.frameLocation);
+        ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
+
+        backTrack->matchAmount = 0;
+        backTrack->lastContext = 0;
+
+        ASSERT(term.atom.quantityType != QuantifierFixedCount || term.atom.quantityMinCount == term.atom.quantityMaxCount);
+
+        unsigned minimumMatchCount = term.atom.quantityMinCount;
+        JSRegExpResult fixedMatchResult;
+
+        // Handle fixed matches and the minimum part of a variable length match.
+        if (minimumMatchCount) {
+            // While we haven't yet reached our fixed limit,
+            while (backTrack->matchAmount < minimumMatchCount) {
+                // Try to do a match, and it it succeeds, add it to the list.
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                fixedMatchResult = matchDisjunction(disjunctionBody, context->getDisjunctionContext(term));
+                if (fixedMatchResult == JSRegExpMatch)
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    // The match failed; try to find an alternate point to carry on from.
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    
+                    if (fixedMatchResult != JSRegExpNoMatch)
+                        return fixedMatchResult;
+                    JSRegExpResult backtrackResult = parenthesesDoBacktrack(term, backTrack);
+                    if (backtrackResult != JSRegExpMatch)
+                        return backtrackResult;
+                }
+            }
+
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+            recordParenthesesMatch(term, context);
+        }
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            ASSERT(backTrack->matchAmount == term.atom.quantityMaxCount);
+            return JSRegExpMatch;
+        }
+
+        case QuantifierGreedy: {
+            while (backTrack->matchAmount < term.atom.quantityMaxCount) {
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                JSRegExpResult result = matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term));
+                if (result == JSRegExpMatch)
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+
+                    if (result != JSRegExpNoMatch)
+                        return result;
+
+                    break;
+                }
+            }
+
+            if (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                recordParenthesesMatch(term, context);
+            }
+            return JSRegExpMatch;
+        }
+
+        case QuantifierNonGreedy:
+            return JSRegExpMatch;
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return JSRegExpErrorNoMatch;
+    }
+
+    // Rules for backtracking differ depending on whether this is greedy or non-greedy.
+    //
+    // Greedy matches never should try just adding more - you should already have done
+    // the 'more' cases.  Always backtrack, at least a leetle bit.  However cases where
+    // you backtrack an item off the list needs checking, since we'll never have matched
+    // the one less case.  Tracking forwards, still add as much as possible.
+    //
+    // Non-greedy, we've already done the one less case, so don't match on popping.
+    // We haven't done the one more case, so always try to add that.
+    //
+    JSRegExpResult backtrackParentheses(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpattern);
+
+        BackTrackInfoParentheses* backTrack = reinterpret_cast<BackTrackInfoParentheses*>(context->frame + term.frameLocation);
+        ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            ASSERT(backTrack->matchAmount == term.atom.quantityMaxCount);
+
+            ParenthesesDisjunctionContext* context = 0;
+            JSRegExpResult result = parenthesesDoBacktrack(term, backTrack);
+
+            if (result != JSRegExpMatch)
+                return result;
+
+            // While we haven't yet reached our fixed limit,
+            while (backTrack->matchAmount < term.atom.quantityMaxCount) {
+                // Try to do a match, and it it succeeds, add it to the list.
+                context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                result = matchDisjunction(disjunctionBody, context->getDisjunctionContext(term));
+
+                if (result == JSRegExpMatch)
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    // The match failed; try to find an alternate point to carry on from.
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+
+                    if (result != JSRegExpNoMatch)
+                        return result;
+                    JSRegExpResult backtrackResult = parenthesesDoBacktrack(term, backTrack);
+                    if (backtrackResult != JSRegExpMatch)
+                        return backtrackResult;
+                }
+            }
+
+            ASSERT(backTrack->matchAmount == term.atom.quantityMaxCount);
+            context = backTrack->lastContext;
+            recordParenthesesMatch(term, context);
+            return JSRegExpMatch;
+        }
+
+        case QuantifierGreedy: {
+            if (!backTrack->matchAmount)
+                return JSRegExpNoMatch;
+
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+            JSRegExpResult result = matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term), true);
+            if (result == JSRegExpMatch) {
+                while (backTrack->matchAmount < term.atom.quantityMaxCount) {
+                    ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                    JSRegExpResult parenthesesResult = matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term));
+                    if (parenthesesResult == JSRegExpMatch)
+                        appendParenthesesDisjunctionContext(backTrack, context);
+                    else {
+                        resetMatches(term, context);
+                        freeParenthesesDisjunctionContext(context);
+
+                        if (parenthesesResult != JSRegExpNoMatch)
+                            return parenthesesResult;
+
+                        break;
+                    }
+                }
+            } else {
+                resetMatches(term, context);
+                popParenthesesDisjunctionContext(backTrack);
+                freeParenthesesDisjunctionContext(context);
+
+                if (result != JSRegExpNoMatch)
+                    return result;
+            }
+
+            if (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                recordParenthesesMatch(term, context);
+            }
+            return JSRegExpMatch;
+        }
+
+        case QuantifierNonGreedy: {
+            // If we've not reached the limit, try to add one more match.
+            if (backTrack->matchAmount < term.atom.quantityMaxCount) {
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                JSRegExpResult result = matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term));
+                if (result == JSRegExpMatch) {
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                    recordParenthesesMatch(term, context);
+                    return JSRegExpMatch;
+                }
+
+                resetMatches(term, context);
+                freeParenthesesDisjunctionContext(context);
+
+                if (result != JSRegExpNoMatch)
+                    return result;
+            }
+
+            // Nope - okay backtrack looking for an alternative.
+            while (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                JSRegExpResult result = matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term), true);
+                if (result == JSRegExpMatch) {
+                    // successful backtrack! we're back in the game!
+                    if (backTrack->matchAmount) {
+                        context = backTrack->lastContext;
+                        recordParenthesesMatch(term, context);
+                    }
+                    return JSRegExpMatch;
+                }
+
+                // pop a match off the stack
+                resetMatches(term, context);
+                popParenthesesDisjunctionContext(backTrack);
+                freeParenthesesDisjunctionContext(context);
+
+                if (result != JSRegExpNoMatch)
+                    return result;
+            }
+
+            return JSRegExpNoMatch;
+        }
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return JSRegExpErrorNoMatch;
+    }
+
+    bool matchDotStarEnclosure(ByteTerm& term, DisjunctionContext* context)
+    {
+        UNUSED_PARAM(term);
+        unsigned matchBegin = context->matchBegin;
+
+        if (matchBegin) {
+            for (matchBegin--; true; matchBegin--) {
+                if (testCharacterClass(pattern->newlineCharacterClass, input.reread(matchBegin))) {
+                    ++matchBegin;
+                    break;
+                }
+
+                if (!matchBegin)
+                    break;
+            }
+        }
+
+        unsigned matchEnd = input.getPos();
+
+        for (; (matchEnd != input.end())
+             && (!testCharacterClass(pattern->newlineCharacterClass, input.reread(matchEnd))); matchEnd++) { }
+
+        if (((matchBegin && term.anchors.m_bol)
+             || ((matchEnd != input.end()) && term.anchors.m_eol))
+            && !pattern->multiline())
+            return false;
+
+        context->matchBegin = matchBegin;
+        context->matchEnd = matchEnd;
+        return true;
+    }
+
+#define MATCH_NEXT() { ++context->term; goto matchAgain; }
+#define BACKTRACK() { --context->term; goto backtrack; }
+#define currentTerm() (disjunction->terms[context->term])
+    JSRegExpResult matchDisjunction(ByteDisjunction* disjunction, DisjunctionContext* context, bool btrack = false)
+    {
+        if (!--remainingMatchCount)
+            return JSRegExpErrorHitLimit;
+
+        if (btrack)
+            BACKTRACK();
+
+        context->matchBegin = input.getPos();
+        context->term = 0;
+
+    matchAgain:
+        ASSERT(context->term < static_cast<int>(disjunction->terms.size()));
+
+        switch (currentTerm().type) {
+        case ByteTerm::TypeSubpatternBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeSubpatternEnd:
+            context->matchEnd = input.getPos();
+            return JSRegExpMatch;
+
+        case ByteTerm::TypeBodyAlternativeBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeBodyAlternativeDisjunction:
+        case ByteTerm::TypeBodyAlternativeEnd:
+            context->matchEnd = input.getPos();
+            return JSRegExpMatch;
+
+        case ByteTerm::TypeAlternativeBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeAlternativeDisjunction:
+        case ByteTerm::TypeAlternativeEnd: {
+            int offset = currentTerm().alternative.end;
+            BackTrackInfoAlternative* backTrack = reinterpret_cast<BackTrackInfoAlternative*>(context->frame + currentTerm().frameLocation);
+            backTrack->offset = offset;
+            context->term += offset;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypeAssertionBOL:
+            if (matchAssertionBOL(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeAssertionEOL:
+            if (matchAssertionEOL(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeAssertionWordBoundary:
+            if (matchAssertionWordBoundary(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypePatternCharacterOnce:
+        case ByteTerm::TypePatternCharacterFixed: {
+            if (unicode) {
+                if (!U_IS_BMP(currentTerm().atom.patternCharacter)) {
+                    for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityMaxCount; ++matchAmount) {
+                        if (!checkSurrogatePair(currentTerm().atom.patternCharacter, currentTerm().inputPosition - 2 * matchAmount)) {
+                            BACKTRACK();
+                        }
+                    }
+                    MATCH_NEXT();
+                }
+            }
+            unsigned position = input.getPos(); // May need to back out reading a surrogate pair.
+
+            for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityMaxCount; ++matchAmount) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition - matchAmount)) {
+                    input.setPos(position);
+                    BACKTRACK();
+                }
+            }
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCharacterGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            unsigned matchAmount = 0;
+            unsigned position = input.getPos(); // May need to back out reading a surrogate pair.
+            while ((matchAmount < currentTerm().atom.quantityMaxCount) && input.checkInput(1)) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition + 1)) {
+                    input.setPos(position);
+                    break;
+                }
+                ++matchAmount;
+                position = input.getPos();
+            }
+            backTrack->matchAmount = matchAmount;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCharacterNonGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            backTrack->begin = input.getPos();
+            backTrack->matchAmount = 0;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypePatternCasedCharacterOnce:
+        case ByteTerm::TypePatternCasedCharacterFixed: {
+            if (unicode) {
+                // Case insensitive matching of unicode characters is handled as TypeCharacterClass.
+                ASSERT(U_IS_BMP(currentTerm().atom.patternCharacter));
+
+                unsigned position = input.getPos(); // May need to back out reading a surrogate pair.
+                
+                for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityMaxCount; ++matchAmount) {
+                    if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition - matchAmount)) {
+                        input.setPos(position);
+                        BACKTRACK();
+                    }
+                }
+                MATCH_NEXT();
+            }
+
+            for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityMaxCount; ++matchAmount) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition - matchAmount))
+                    BACKTRACK();
+            }
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCasedCharacterGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+
+            // Case insensitive matching of unicode characters is handled as TypeCharacterClass.
+            ASSERT(!unicode || U_IS_BMP(currentTerm().atom.patternCharacter));
+
+            unsigned matchAmount = 0;
+            while ((matchAmount < currentTerm().atom.quantityMaxCount) && input.checkInput(1)) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition + 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCasedCharacterNonGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+
+            // Case insensitive matching of unicode characters is handled as TypeCharacterClass.
+            ASSERT(!unicode || U_IS_BMP(currentTerm().atom.patternCharacter));
+            
+            backTrack->matchAmount = 0;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypeCharacterClass:
+            if (matchCharacterClass(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeBackReference:
+            if (matchBackReference(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpattern: {
+            JSRegExpResult result = matchParentheses(currentTerm(), context);
+
+            if (result == JSRegExpMatch) {
+                MATCH_NEXT();
+            }  else if (result != JSRegExpNoMatch)
+                return result;
+
+            BACKTRACK();
+        }
+        case ByteTerm::TypeParenthesesSubpatternOnceBegin:
+            if (matchParenthesesOnceBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternOnceEnd:
+            if (matchParenthesesOnceEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternTerminalBegin:
+            if (matchParenthesesTerminalBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternTerminalEnd:
+            if (matchParenthesesTerminalEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionBegin:
+            if (matchParentheticalAssertionBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionEnd:
+            if (matchParentheticalAssertionEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypeCheckInput:
+            if (input.checkInput(currentTerm().checkInputCount))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypeUncheckInput:
+            input.uncheckInput(currentTerm().checkInputCount);
+            MATCH_NEXT();
+                
+        case ByteTerm::TypeDotStarEnclosure:
+            if (matchDotStarEnclosure(currentTerm(), context))
+                return JSRegExpMatch;
+            BACKTRACK();
+        }
+
+        // We should never fall-through to here.
+        RELEASE_ASSERT_NOT_REACHED();
+
+    backtrack:
+        ASSERT(context->term < static_cast<int>(disjunction->terms.size()));
+
+        switch (currentTerm().type) {
+        case ByteTerm::TypeSubpatternBegin:
+            return JSRegExpNoMatch;
+        case ByteTerm::TypeSubpatternEnd:
+            RELEASE_ASSERT_NOT_REACHED();
+
+        case ByteTerm::TypeBodyAlternativeBegin:
+        case ByteTerm::TypeBodyAlternativeDisjunction: {
+            int offset = currentTerm().alternative.next;
+            context->term += offset;
+            if (offset > 0)
+                MATCH_NEXT();
+
+            if (input.atEnd() || pattern->sticky())
+                return JSRegExpNoMatch;
+
+            input.next();
+
+            context->matchBegin = input.getPos();
+
+            if (currentTerm().alternative.onceThrough)
+                context->term += currentTerm().alternative.next;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypeBodyAlternativeEnd:
+            RELEASE_ASSERT_NOT_REACHED();
+
+        case ByteTerm::TypeAlternativeBegin:
+        case ByteTerm::TypeAlternativeDisjunction: {
+            int offset = currentTerm().alternative.next;
+            context->term += offset;
+            if (offset > 0)
+                MATCH_NEXT();
+            BACKTRACK();
+        }
+        case ByteTerm::TypeAlternativeEnd: {
+            // We should never backtrack back into an alternative of the main body of the regex.
+            BackTrackInfoAlternative* backTrack = reinterpret_cast<BackTrackInfoAlternative*>(context->frame + currentTerm().frameLocation);
+            unsigned offset = backTrack->offset;
+            context->term -= offset;
+            BACKTRACK();
+        }
+
+        case ByteTerm::TypeAssertionBOL:
+        case ByteTerm::TypeAssertionEOL:
+        case ByteTerm::TypeAssertionWordBoundary:
+            BACKTRACK();
+
+        case ByteTerm::TypePatternCharacterOnce:
+        case ByteTerm::TypePatternCharacterFixed:
+        case ByteTerm::TypePatternCharacterGreedy:
+        case ByteTerm::TypePatternCharacterNonGreedy:
+            if (backtrackPatternCharacter(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypePatternCasedCharacterOnce:
+        case ByteTerm::TypePatternCasedCharacterFixed:
+        case ByteTerm::TypePatternCasedCharacterGreedy:
+        case ByteTerm::TypePatternCasedCharacterNonGreedy:
+            if (backtrackPatternCasedCharacter(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeCharacterClass:
+            if (backtrackCharacterClass(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeBackReference:
+            if (backtrackBackReference(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpattern: {
+            JSRegExpResult result = backtrackParentheses(currentTerm(), context);
+
+            if (result == JSRegExpMatch) {
+                MATCH_NEXT();
+            } else if (result != JSRegExpNoMatch)
+                return result;
+
+            BACKTRACK();
+        }
+        case ByteTerm::TypeParenthesesSubpatternOnceBegin:
+            if (backtrackParenthesesOnceBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternOnceEnd:
+            if (backtrackParenthesesOnceEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternTerminalBegin:
+            if (backtrackParenthesesTerminalBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternTerminalEnd:
+            if (backtrackParenthesesTerminalEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionBegin:
+            if (backtrackParentheticalAssertionBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionEnd:
+            if (backtrackParentheticalAssertionEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypeCheckInput:
+            input.uncheckInput(currentTerm().checkInputCount);
+            BACKTRACK();
+
+        case ByteTerm::TypeUncheckInput:
+            input.checkInput(currentTerm().checkInputCount);
+            BACKTRACK();
+
+        case ByteTerm::TypeDotStarEnclosure:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+
+        RELEASE_ASSERT_NOT_REACHED();
+        return JSRegExpErrorNoMatch;
+    }
+
+    JSRegExpResult matchNonZeroDisjunction(ByteDisjunction* disjunction, DisjunctionContext* context, bool btrack = false)
+    {
+        JSRegExpResult result = matchDisjunction(disjunction, context, btrack);
+
+        if (result == JSRegExpMatch) {
+            while (context->matchBegin == context->matchEnd) {
+                result = matchDisjunction(disjunction, context, true);
+                if (result != JSRegExpMatch)
+                    return result;
+            }
+            return JSRegExpMatch;
+        }
+
+        return result;
+    }
+
+    unsigned interpret()
+    {
+        if (!input.isAvailableInput(0))
+            return offsetNoMatch;
+
+        if (pattern->m_lock)
+            pattern->m_lock->lock();
+        
+        for (unsigned i = 0; i < pattern->m_body->m_numSubpatterns + 1; ++i)
+            output[i << 1] = offsetNoMatch;
+
+        allocatorPool = pattern->m_allocator->startAllocator();
+        RELEASE_ASSERT(allocatorPool);
+
+        DisjunctionContext* context = allocDisjunctionContext(pattern->m_body.get());
+
+        JSRegExpResult result = matchDisjunction(pattern->m_body.get(), context, false);
+        if (result == JSRegExpMatch) {
+            output[0] = context->matchBegin;
+            output[1] = context->matchEnd;
+        }
+
+        freeDisjunctionContext(context);
+
+        pattern->m_allocator->stopAllocator();
+
+        ASSERT((result == JSRegExpMatch) == (output[0] != offsetNoMatch));
+
+        if (pattern->m_lock)
+            pattern->m_lock->unlock();
+        
+        return output[0];
+    }
+
+    Interpreter(BytecodePattern* pattern, unsigned* output, const CharType* input, unsigned length, unsigned start)
+        : pattern(pattern)
+        , unicode(pattern->unicode())
+        , output(output)
+        , input(input, start, length, pattern->unicode())
+        , allocatorPool(0)
+        , remainingMatchCount(matchLimit)
+    {
+    }
+
+private:
+    BytecodePattern* pattern;
+    bool unicode;
+    unsigned* output;
+    InputStream input;
+    BumpPointerPool* allocatorPool;
+    unsigned remainingMatchCount;
+};
+
+class ByteCompiler {
+    struct ParenthesesStackEntry {
+        unsigned beginTerm;
+        unsigned savedAlternativeIndex;
+        ParenthesesStackEntry(unsigned beginTerm, unsigned savedAlternativeIndex/*, unsigned subpatternId, bool capture = false*/)
+            : beginTerm(beginTerm)
+            , savedAlternativeIndex(savedAlternativeIndex)
+        {
+        }
+    };
+
+public:
+    ByteCompiler(YarrPattern& pattern)
+        : m_pattern(pattern)
+    {
+        m_currentAlternativeIndex = 0;
+    }
+
+    std::unique_ptr<BytecodePattern> compile(BumpPointerAllocator* allocator, ConcurrentJSLock* lock)
+    {
+        regexBegin(m_pattern.m_numSubpatterns, m_pattern.m_body->m_callFrameSize, m_pattern.m_body->m_alternatives[0]->onceThrough());
+        emitDisjunction(m_pattern.m_body);
+        regexEnd();
+
+        return std::make_unique<BytecodePattern>(WTFMove(m_bodyDisjunction), m_allParenthesesInfo, m_pattern, allocator, lock);
+    }
+
+    void checkInput(unsigned count)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
+    }
+
+    void uncheckInput(unsigned count)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm::UncheckInput(count));
+    }
+    
+    void assertionBOL(unsigned inputPosition)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
+    }
+
+    void assertionEOL(unsigned inputPosition)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
+    }
+
+    void assertionWordBoundary(bool invert, unsigned inputPosition)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
+    }
+
+    void atomPatternCharacter(UChar32 ch, unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityMaxCount, QuantifierType quantityType)
+    {
+        if (m_pattern.ignoreCase()) {
+            UChar32 lo = u_tolower(ch);
+            UChar32 hi = u_toupper(ch);
+
+            if (lo != hi) {
+                m_bodyDisjunction->terms.append(ByteTerm(lo, hi, inputPosition, frameLocation, quantityMaxCount, quantityType));
+                return;
+            }
+        }
+
+        m_bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityMaxCount, quantityType));
+    }
+
+    void atomCharacterClass(CharacterClass* characterClass, bool invert, unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityMaxCount, QuantifierType quantityType)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
+
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+    }
+
+    void atomBackReference(unsigned subpatternId, unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityMaxCount, QuantifierType quantityType)
+    {
+        ASSERT(subpatternId);
+
+        m_bodyDisjunction->terms.append(ByteTerm::BackReference(subpatternId, inputPosition));
+
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesOnceBegin(unsigned subpatternId, bool capture, unsigned inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = m_bodyDisjunction->terms.size();
+
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, false, inputPosition));
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, m_currentAlternativeIndex));
+        m_currentAlternativeIndex = beginTerm + 1;
+    }
+
+    void atomParenthesesTerminalBegin(unsigned subpatternId, bool capture, unsigned inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = m_bodyDisjunction->terms.size();
+
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternTerminalBegin, subpatternId, capture, false, inputPosition));
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, m_currentAlternativeIndex));
+        m_currentAlternativeIndex = beginTerm + 1;
+    }
+
+    void atomParenthesesSubpatternBegin(unsigned subpatternId, bool capture, unsigned inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        // Errrk! - this is a little crazy, we initially generate as a TypeParenthesesSubpatternOnceBegin,
+        // then fix this up at the end! - simplifying this should make it much clearer.
+        // https://bugs.webkit.org/show_bug.cgi?id=50136
+
+        int beginTerm = m_bodyDisjunction->terms.size();
+
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, false, inputPosition));
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, m_currentAlternativeIndex));
+        m_currentAlternativeIndex = beginTerm + 1;
+    }
+
+    void atomParentheticalAssertionBegin(unsigned subpatternId, bool invert, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = m_bodyDisjunction->terms.size();
+
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionBegin, subpatternId, false, invert, 0));
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        m_bodyDisjunction->terms[m_bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, m_currentAlternativeIndex));
+        m_currentAlternativeIndex = beginTerm + 1;
+    }
+
+    void atomParentheticalAssertionEnd(unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityMaxCount, QuantifierType quantityType)
+    {
+        unsigned beginTerm = popParenthesesStack();
+        closeAlternative(beginTerm + 1);
+        unsigned endTerm = m_bodyDisjunction->terms.size();
+
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParentheticalAssertionBegin);
+
+        bool invert = m_bodyDisjunction->terms[beginTerm].invert();
+        unsigned subpatternId = m_bodyDisjunction->terms[beginTerm].atom.subpatternId;
+
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionEnd, subpatternId, false, invert, inputPosition));
+        m_bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
+
+        m_bodyDisjunction->terms[beginTerm].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[endTerm].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
+    }
+
+    void assertionDotStarEnclosure(bool bolAnchored, bool eolAnchored)
+    {
+        m_bodyDisjunction->terms.append(ByteTerm::DotStarEnclosure(bolAnchored, eolAnchored));
+    }
+
+    unsigned popParenthesesStack()
+    {
+        ASSERT(m_parenthesesStack.size());
+        int stackEnd = m_parenthesesStack.size() - 1;
+        unsigned beginTerm = m_parenthesesStack[stackEnd].beginTerm;
+        m_currentAlternativeIndex = m_parenthesesStack[stackEnd].savedAlternativeIndex;
+        m_parenthesesStack.shrink(stackEnd);
+
+        ASSERT(beginTerm < m_bodyDisjunction->terms.size());
+        ASSERT(m_currentAlternativeIndex < m_bodyDisjunction->terms.size());
+
+        return beginTerm;
+    }
+
+#ifndef NDEBUG
+    void dumpDisjunction(ByteDisjunction* disjunction)
+    {
+        dataLogF("ByteDisjunction(%p):\n\t", disjunction);
+        for (unsigned i = 0; i < disjunction->terms.size(); ++i)
+            dataLogF("{ %d } ", disjunction->terms[i].type);
+        dataLogF("\n");
+    }
+#endif
+
+    void closeAlternative(int beginTerm)
+    {
+        int origBeginTerm = beginTerm;
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeBegin);
+        int endIndex = m_bodyDisjunction->terms.size();
+
+        unsigned frameLocation = m_bodyDisjunction->terms[beginTerm].frameLocation;
+
+        if (!m_bodyDisjunction->terms[beginTerm].alternative.next)
+            m_bodyDisjunction->terms.remove(beginTerm);
+        else {
+            while (m_bodyDisjunction->terms[beginTerm].alternative.next) {
+                beginTerm += m_bodyDisjunction->terms[beginTerm].alternative.next;
+                ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeDisjunction);
+                m_bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+                m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+            }
+
+            m_bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+            m_bodyDisjunction->terms.append(ByteTerm::AlternativeEnd());
+            m_bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+        }
+    }
+
+    void closeBodyAlternative()
+    {
+        int beginTerm = 0;
+        int origBeginTerm = 0;
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeBegin);
+        int endIndex = m_bodyDisjunction->terms.size();
+
+        unsigned frameLocation = m_bodyDisjunction->terms[beginTerm].frameLocation;
+
+        while (m_bodyDisjunction->terms[beginTerm].alternative.next) {
+            beginTerm += m_bodyDisjunction->terms[beginTerm].alternative.next;
+            ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeDisjunction);
+            m_bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+            m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        }
+
+        m_bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeEnd());
+        m_bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesSubpatternEnd(unsigned lastSubpatternId, unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityMinCount, Checked<unsigned> quantityMaxCount, QuantifierType quantityType, unsigned callFrameSize = 0)
+    {
+        unsigned beginTerm = popParenthesesStack();
+        closeAlternative(beginTerm + 1);
+        unsigned endTerm = m_bodyDisjunction->terms.size();
+
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+
+        ByteTerm& parenthesesBegin = m_bodyDisjunction->terms[beginTerm];
+
+        bool capture = parenthesesBegin.capture();
+        unsigned subpatternId = parenthesesBegin.atom.subpatternId;
+
+        unsigned numSubpatterns = lastSubpatternId - subpatternId + 1;
+        auto parenthesesDisjunction = std::make_unique<ByteDisjunction>(numSubpatterns, callFrameSize);
+
+        unsigned firstTermInParentheses = beginTerm + 1;
+        parenthesesDisjunction->terms.reserveInitialCapacity(endTerm - firstTermInParentheses + 2);
+
+        parenthesesDisjunction->terms.append(ByteTerm::SubpatternBegin());
+        for (unsigned termInParentheses = firstTermInParentheses; termInParentheses < endTerm; ++termInParentheses)
+            parenthesesDisjunction->terms.append(m_bodyDisjunction->terms[termInParentheses]);
+        parenthesesDisjunction->terms.append(ByteTerm::SubpatternEnd());
+
+        m_bodyDisjunction->terms.shrink(beginTerm);
+
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction.get(), capture, inputPosition));
+        m_allParenthesesInfo.append(WTFMove(parenthesesDisjunction));
+
+        m_bodyDisjunction->terms[beginTerm].atom.quantityMinCount = quantityMinCount.unsafeGet();
+        m_bodyDisjunction->terms[beginTerm].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesOnceEnd(unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityMinCount, Checked<unsigned> quantityMaxCount, QuantifierType quantityType)
+    {
+        unsigned beginTerm = popParenthesesStack();
+        closeAlternative(beginTerm + 1);
+        unsigned endTerm = m_bodyDisjunction->terms.size();
+
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+
+        bool capture = m_bodyDisjunction->terms[beginTerm].capture();
+        unsigned subpatternId = m_bodyDisjunction->terms[beginTerm].atom.subpatternId;
+
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceEnd, subpatternId, capture, false, inputPosition));
+        m_bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
+
+        m_bodyDisjunction->terms[beginTerm].atom.quantityMinCount = quantityMinCount.unsafeGet();
+        m_bodyDisjunction->terms[beginTerm].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[endTerm].atom.quantityMinCount = quantityMinCount.unsafeGet();
+        m_bodyDisjunction->terms[endTerm].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
+    }
+
+    void atomParenthesesTerminalEnd(unsigned inputPosition, unsigned frameLocation, Checked<unsigned> quantityMinCount, Checked<unsigned> quantityMaxCount, QuantifierType quantityType)
+    {
+        unsigned beginTerm = popParenthesesStack();
+        closeAlternative(beginTerm + 1);
+        unsigned endTerm = m_bodyDisjunction->terms.size();
+
+        ASSERT(m_bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParenthesesSubpatternTerminalBegin);
+
+        bool capture = m_bodyDisjunction->terms[beginTerm].capture();
+        unsigned subpatternId = m_bodyDisjunction->terms[beginTerm].atom.subpatternId;
+
+        m_bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternTerminalEnd, subpatternId, capture, false, inputPosition));
+        m_bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        m_bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
+
+        m_bodyDisjunction->terms[beginTerm].atom.quantityMinCount = quantityMinCount.unsafeGet();
+        m_bodyDisjunction->terms[beginTerm].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+        m_bodyDisjunction->terms[endTerm].atom.quantityMinCount = quantityMinCount.unsafeGet();
+        m_bodyDisjunction->terms[endTerm].atom.quantityMaxCount = quantityMaxCount.unsafeGet();
+        m_bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
+    }
+
+    void regexBegin(unsigned numSubpatterns, unsigned callFrameSize, bool onceThrough)
+    {
+        m_bodyDisjunction = std::make_unique<ByteDisjunction>(numSubpatterns, callFrameSize);
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeBegin(onceThrough));
+        m_bodyDisjunction->terms[0].frameLocation = 0;
+        m_currentAlternativeIndex = 0;
+    }
+
+    void regexEnd()
+    {
+        closeBodyAlternative();
+    }
+
+    void alternativeBodyDisjunction(bool onceThrough)
+    {
+        int newAlternativeIndex = m_bodyDisjunction->terms.size();
+        m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
+        m_bodyDisjunction->terms.append(ByteTerm::BodyAlternativeDisjunction(onceThrough));
+
+        m_currentAlternativeIndex = newAlternativeIndex;
+    }
+
+    void alternativeDisjunction()
+    {
+        int newAlternativeIndex = m_bodyDisjunction->terms.size();
+        m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
+        m_bodyDisjunction->terms.append(ByteTerm::AlternativeDisjunction());
+
+        m_currentAlternativeIndex = newAlternativeIndex;
+    }
+
+    void emitDisjunction(PatternDisjunction* disjunction, unsigned inputCountAlreadyChecked = 0, unsigned parenthesesInputCountAlreadyChecked = 0)
+    {
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            unsigned currentCountAlreadyChecked = inputCountAlreadyChecked;
+
+            PatternAlternative* alternative = disjunction->m_alternatives[alt].get();
+
+            if (alt) {
+                if (disjunction == m_pattern.m_body)
+                    alternativeBodyDisjunction(alternative->onceThrough());
+                else
+                    alternativeDisjunction();
+            }
+
+            unsigned minimumSize = alternative->m_minimumSize;
+            ASSERT(minimumSize >= parenthesesInputCountAlreadyChecked);
+            unsigned countToCheck = minimumSize - parenthesesInputCountAlreadyChecked;
+
+            if (countToCheck) {
+                checkInput(countToCheck);
+                currentCountAlreadyChecked += countToCheck;
+            }
+
+            for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+                PatternTerm& term = alternative->m_terms[i];
+
+                switch (term.type) {
+                case PatternTerm::TypeAssertionBOL:
+                    assertionBOL(currentCountAlreadyChecked - term.inputPosition);
+                    break;
+
+                case PatternTerm::TypeAssertionEOL:
+                    assertionEOL(currentCountAlreadyChecked - term.inputPosition);
+                    break;
+
+                case PatternTerm::TypeAssertionWordBoundary:
+                    assertionWordBoundary(term.invert(), currentCountAlreadyChecked - term.inputPosition);
+                    break;
+
+                case PatternTerm::TypePatternCharacter:
+                    atomPatternCharacter(term.patternCharacter, currentCountAlreadyChecked - term.inputPosition, term.frameLocation, term.quantityMaxCount, term.quantityType);
+                    break;
+
+                case PatternTerm::TypeCharacterClass:
+                    atomCharacterClass(term.characterClass, term.invert(), currentCountAlreadyChecked- term.inputPosition, term.frameLocation, term.quantityMaxCount, term.quantityType);
+                    break;
+
+                case PatternTerm::TypeBackReference:
+                    atomBackReference(term.backReferenceSubpatternId, currentCountAlreadyChecked - term.inputPosition, term.frameLocation, term.quantityMaxCount, term.quantityType);
+                        break;
+
+                case PatternTerm::TypeForwardReference:
+                    break;
+
+                case PatternTerm::TypeParenthesesSubpattern: {
+                    unsigned disjunctionAlreadyCheckedCount = 0;
+                    if (term.quantityMaxCount == 1 && !term.parentheses.isCopy) {
+                        unsigned alternativeFrameLocation = term.frameLocation;
+                        // For QuantifierFixedCount we pre-check the minimum size; for greedy/non-greedy we reserve a slot in the frame.
+                        if (term.quantityType == QuantifierFixedCount)
+                            disjunctionAlreadyCheckedCount = term.parentheses.disjunction->m_minimumSize;
+                        else
+                            alternativeFrameLocation += YarrStackSpaceForBackTrackInfoParenthesesOnce;
+                        ASSERT(currentCountAlreadyChecked >= term.inputPosition);
+                        unsigned delegateEndInputOffset = currentCountAlreadyChecked - term.inputPosition;
+                        atomParenthesesOnceBegin(term.parentheses.subpatternId, term.capture(), disjunctionAlreadyCheckedCount + delegateEndInputOffset, term.frameLocation, alternativeFrameLocation);
+                        emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, disjunctionAlreadyCheckedCount);
+                        atomParenthesesOnceEnd(delegateEndInputOffset, term.frameLocation, term.quantityMinCount, term.quantityMaxCount, term.quantityType);
+                    } else if (term.parentheses.isTerminal) {
+                        ASSERT(currentCountAlreadyChecked >= term.inputPosition);
+                        unsigned delegateEndInputOffset = currentCountAlreadyChecked - term.inputPosition;
+                        atomParenthesesTerminalBegin(term.parentheses.subpatternId, term.capture(), disjunctionAlreadyCheckedCount + delegateEndInputOffset, term.frameLocation, term.frameLocation + YarrStackSpaceForBackTrackInfoParenthesesOnce);
+                        emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, disjunctionAlreadyCheckedCount);
+                        atomParenthesesTerminalEnd(delegateEndInputOffset, term.frameLocation, term.quantityMinCount, term.quantityMaxCount, term.quantityType);
+                    } else {
+                        ASSERT(currentCountAlreadyChecked >= term.inputPosition);
+                        unsigned delegateEndInputOffset = currentCountAlreadyChecked - term.inputPosition;
+                        atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.capture(), disjunctionAlreadyCheckedCount + delegateEndInputOffset, term.frameLocation, 0);
+                        emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                        atomParenthesesSubpatternEnd(term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityMinCount, term.quantityMaxCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                    }
+                    break;
+                }
+
+                case PatternTerm::TypeParentheticalAssertion: {
+                    unsigned alternativeFrameLocation = term.frameLocation + YarrStackSpaceForBackTrackInfoParentheticalAssertion;
+
+                    ASSERT(currentCountAlreadyChecked >= term.inputPosition);
+                    unsigned positiveInputOffset = currentCountAlreadyChecked - term.inputPosition;
+                    unsigned uncheckAmount = 0;
+                    if (positiveInputOffset > term.parentheses.disjunction->m_minimumSize) {
+                        uncheckAmount = positiveInputOffset - term.parentheses.disjunction->m_minimumSize;
+                        uncheckInput(uncheckAmount);
+                        currentCountAlreadyChecked -= uncheckAmount;
+                    }
+
+                    atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invert(), term.frameLocation, alternativeFrameLocation);
+                    emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, positiveInputOffset - uncheckAmount);
+                    atomParentheticalAssertionEnd(0, term.frameLocation, term.quantityMaxCount, term.quantityType);
+                    if (uncheckAmount) {
+                        checkInput(uncheckAmount);
+                        currentCountAlreadyChecked += uncheckAmount;
+                    }
+                    break;
+                }
+
+                case PatternTerm::TypeDotStarEnclosure:
+                    assertionDotStarEnclosure(term.anchors.bolAnchor, term.anchors.eolAnchor);
+                    break;
+                }
+            }
+        }
+    }
+
+private:
+    YarrPattern& m_pattern;
+    std::unique_ptr<ByteDisjunction> m_bodyDisjunction;
+    unsigned m_currentAlternativeIndex;
+    Vector<ParenthesesStackEntry> m_parenthesesStack;
+    Vector<std::unique_ptr<ByteDisjunction>> m_allParenthesesInfo;
+};
+
+std::unique_ptr<BytecodePattern> byteCompile(YarrPattern& pattern, BumpPointerAllocator* allocator, ConcurrentJSLock* lock)
+{
+    return ByteCompiler(pattern).compile(allocator, lock);
+}
+
+unsigned interpret(BytecodePattern* bytecode, const String& input, unsigned start, unsigned* output)
+{
+    SuperSamplerScope superSamplerScope(false);
+    if (input.is8Bit())
+        return Interpreter<LChar>(bytecode, output, input.characters8(), input.length(), start).interpret();
+    return Interpreter<UChar>(bytecode, output, input.characters16(), input.length(), start).interpret();
+}
+
+unsigned interpret(BytecodePattern* bytecode, const LChar* input, unsigned length, unsigned start, unsigned* output)
+{
+    SuperSamplerScope superSamplerScope(false);
+    return Interpreter<LChar>(bytecode, output, input, length, start).interpret();
+}
+
+unsigned interpret(BytecodePattern* bytecode, const UChar* input, unsigned length, unsigned start, unsigned* output)
+{
+    SuperSamplerScope superSamplerScope(false);
+    return Interpreter<UChar>(bytecode, output, input, length, start).interpret();
+}
+
+// These should be the same for both UChar & LChar.
+COMPILE_ASSERT(sizeof(Interpreter<UChar>::BackTrackInfoPatternCharacter) == (YarrStackSpaceForBackTrackInfoPatternCharacter * sizeof(uintptr_t)), CheckYarrStackSpaceForBackTrackInfoPatternCharacter);
+COMPILE_ASSERT(sizeof(Interpreter<UChar>::BackTrackInfoCharacterClass) == (YarrStackSpaceForBackTrackInfoCharacterClass * sizeof(uintptr_t)), CheckYarrStackSpaceForBackTrackInfoCharacterClass);
+COMPILE_ASSERT(sizeof(Interpreter<UChar>::BackTrackInfoBackReference) == (YarrStackSpaceForBackTrackInfoBackReference * sizeof(uintptr_t)), CheckYarrStackSpaceForBackTrackInfoBackReference);
+COMPILE_ASSERT(sizeof(Interpreter<UChar>::BackTrackInfoAlternative) == (YarrStackSpaceForBackTrackInfoAlternative * sizeof(uintptr_t)), CheckYarrStackSpaceForBackTrackInfoAlternative);
+COMPILE_ASSERT(sizeof(Interpreter<UChar>::BackTrackInfoParentheticalAssertion) == (YarrStackSpaceForBackTrackInfoParentheticalAssertion * sizeof(uintptr_t)), CheckYarrStackSpaceForBackTrackInfoParentheticalAssertion);
+COMPILE_ASSERT(sizeof(Interpreter<UChar>::BackTrackInfoParenthesesOnce) == (YarrStackSpaceForBackTrackInfoParenthesesOnce * sizeof(uintptr_t)), CheckYarrStackSpaceForBackTrackInfoParenthesesOnce);
+COMPILE_ASSERT(sizeof(Interpreter<UChar>::BackTrackInfoParentheses) == (YarrStackSpaceForBackTrackInfoParentheses * sizeof(uintptr_t)), CheckYarrStackSpaceForBackTrackInfoParentheses);
+
+
+} }
diff --git a/yarr/YarrInterpreter.h b/yarr/YarrInterpreter.h
new file mode 100644
index 0000000..43dcb1f
--- /dev/null
+++ b/yarr/YarrInterpreter.h
@@ -0,0 +1,395 @@
+/*
+ * Copyright (C) 2009, 2010-2012, 2014, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "ConcurrentJSLock.h"
+#include "YarrPattern.h"
+
+namespace WTF {
+class BumpPointerAllocator;
+}
+using WTF::BumpPointerAllocator;
+
+namespace JSC { namespace Yarr {
+
+class ByteDisjunction;
+
+struct ByteTerm {
+    enum Type {
+        TypeBodyAlternativeBegin,
+        TypeBodyAlternativeDisjunction,
+        TypeBodyAlternativeEnd,
+        TypeAlternativeBegin,
+        TypeAlternativeDisjunction,
+        TypeAlternativeEnd,
+        TypeSubpatternBegin,
+        TypeSubpatternEnd,
+        TypeAssertionBOL,
+        TypeAssertionEOL,
+        TypeAssertionWordBoundary,
+        TypePatternCharacterOnce,
+        TypePatternCharacterFixed,
+        TypePatternCharacterGreedy,
+        TypePatternCharacterNonGreedy,
+        TypePatternCasedCharacterOnce,
+        TypePatternCasedCharacterFixed,
+        TypePatternCasedCharacterGreedy,
+        TypePatternCasedCharacterNonGreedy,
+        TypeCharacterClass,
+        TypeBackReference,
+        TypeParenthesesSubpattern,
+        TypeParenthesesSubpatternOnceBegin,
+        TypeParenthesesSubpatternOnceEnd,
+        TypeParenthesesSubpatternTerminalBegin,
+        TypeParenthesesSubpatternTerminalEnd,
+        TypeParentheticalAssertionBegin,
+        TypeParentheticalAssertionEnd,
+        TypeCheckInput,
+        TypeUncheckInput,
+        TypeDotStarEnclosure,
+    } type;
+    union {
+        struct {
+            union {
+                UChar32 patternCharacter;
+                struct {
+                    UChar32 lo;
+                    UChar32 hi;
+                } casedCharacter;
+                CharacterClass* characterClass;
+                unsigned subpatternId;
+            };
+            union {
+                ByteDisjunction* parenthesesDisjunction;
+                unsigned parenthesesWidth;
+            };
+            QuantifierType quantityType;
+            unsigned quantityMinCount;
+            unsigned quantityMaxCount;
+        } atom;
+        struct {
+            int next;
+            int end;
+            bool onceThrough;
+        } alternative;
+        struct {
+            bool m_bol : 1;
+            bool m_eol : 1;
+        } anchors;
+        unsigned checkInputCount;
+    };
+    unsigned frameLocation;
+    bool m_capture : 1;
+    bool m_invert : 1;
+    unsigned inputPosition;
+
+    ByteTerm(UChar32 ch, unsigned inputPos, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
+        : frameLocation(frameLocation)
+        , m_capture(false)
+        , m_invert(false)
+    {
+        atom.patternCharacter = ch;
+        atom.quantityType = quantityType;
+        atom.quantityMinCount = quantityCount.unsafeGet();
+        atom.quantityMaxCount = quantityCount.unsafeGet();
+        inputPosition = inputPos;
+
+        switch (quantityType) {
+        case QuantifierFixedCount:
+            type = (quantityCount == 1) ? ByteTerm::TypePatternCharacterOnce : ByteTerm::TypePatternCharacterFixed;
+            break;
+        case QuantifierGreedy:
+            type = ByteTerm::TypePatternCharacterGreedy;
+            break;
+        case QuantifierNonGreedy:
+            type = ByteTerm::TypePatternCharacterNonGreedy;
+            break;
+        }
+    }
+
+    ByteTerm(UChar32 lo, UChar32 hi, unsigned inputPos, unsigned frameLocation, Checked<unsigned> quantityCount, QuantifierType quantityType)
+        : frameLocation(frameLocation)
+        , m_capture(false)
+        , m_invert(false)
+    {
+        switch (quantityType) {
+        case QuantifierFixedCount:
+            type = (quantityCount == 1) ? ByteTerm::TypePatternCasedCharacterOnce : ByteTerm::TypePatternCasedCharacterFixed;
+            break;
+        case QuantifierGreedy:
+            type = ByteTerm::TypePatternCasedCharacterGreedy;
+            break;
+        case QuantifierNonGreedy:
+            type = ByteTerm::TypePatternCasedCharacterNonGreedy;
+            break;
+        }
+
+        atom.casedCharacter.lo = lo;
+        atom.casedCharacter.hi = hi;
+        atom.quantityType = quantityType;
+        atom.quantityMinCount = quantityCount.unsafeGet();
+        atom.quantityMaxCount = quantityCount.unsafeGet();
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(CharacterClass* characterClass, bool invert, unsigned inputPos)
+        : type(ByteTerm::TypeCharacterClass)
+        , m_capture(false)
+        , m_invert(invert)
+    {
+        atom.characterClass = characterClass;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityMinCount = 1;
+        atom.quantityMaxCount = 1;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(Type type, unsigned subpatternId, ByteDisjunction* parenthesesInfo, bool capture, unsigned inputPos)
+        : type(type)
+        , m_capture(capture)
+        , m_invert(false)
+    {
+        atom.subpatternId = subpatternId;
+        atom.parenthesesDisjunction = parenthesesInfo;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityMinCount = 1;
+        atom.quantityMaxCount = 1;
+        inputPosition = inputPos;
+    }
+    
+    ByteTerm(Type type, bool invert = false)
+        : type(type)
+        , m_capture(false)
+        , m_invert(invert)
+    {
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityMinCount = 1;
+        atom.quantityMaxCount = 1;
+    }
+
+    ByteTerm(Type type, unsigned subpatternId, bool capture, bool invert, unsigned inputPos)
+        : type(type)
+        , m_capture(capture)
+        , m_invert(invert)
+    {
+        atom.subpatternId = subpatternId;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityMinCount = 1;
+        atom.quantityMaxCount = 1;
+        inputPosition = inputPos;
+    }
+
+    static ByteTerm BOL(unsigned inputPos)
+    {
+        ByteTerm term(TypeAssertionBOL);
+        term.inputPosition = inputPos;
+        return term;
+    }
+
+    static ByteTerm CheckInput(Checked<unsigned> count)
+    {
+        ByteTerm term(TypeCheckInput);
+        term.checkInputCount = count.unsafeGet();
+        return term;
+    }
+
+    static ByteTerm UncheckInput(Checked<unsigned> count)
+    {
+        ByteTerm term(TypeUncheckInput);
+        term.checkInputCount = count.unsafeGet();
+        return term;
+    }
+    
+    static ByteTerm EOL(unsigned inputPos)
+    {
+        ByteTerm term(TypeAssertionEOL);
+        term.inputPosition = inputPos;
+        return term;
+    }
+
+    static ByteTerm WordBoundary(bool invert, unsigned inputPos)
+    {
+        ByteTerm term(TypeAssertionWordBoundary, invert);
+        term.inputPosition = inputPos;
+        return term;
+    }
+    
+    static ByteTerm BackReference(unsigned subpatternId, unsigned inputPos)
+    {
+        return ByteTerm(TypeBackReference, subpatternId, false, false, inputPos);
+    }
+
+    static ByteTerm BodyAlternativeBegin(bool onceThrough)
+    {
+        ByteTerm term(TypeBodyAlternativeBegin);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        term.alternative.onceThrough = onceThrough;
+        return term;
+    }
+
+    static ByteTerm BodyAlternativeDisjunction(bool onceThrough)
+    {
+        ByteTerm term(TypeBodyAlternativeDisjunction);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        term.alternative.onceThrough = onceThrough;
+        return term;
+    }
+
+    static ByteTerm BodyAlternativeEnd()
+    {
+        ByteTerm term(TypeBodyAlternativeEnd);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        term.alternative.onceThrough = false;
+        return term;
+    }
+
+    static ByteTerm AlternativeBegin()
+    {
+        ByteTerm term(TypeAlternativeBegin);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        term.alternative.onceThrough = false;
+        return term;
+    }
+
+    static ByteTerm AlternativeDisjunction()
+    {
+        ByteTerm term(TypeAlternativeDisjunction);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        term.alternative.onceThrough = false;
+        return term;
+    }
+
+    static ByteTerm AlternativeEnd()
+    {
+        ByteTerm term(TypeAlternativeEnd);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        term.alternative.onceThrough = false;
+        return term;
+    }
+
+    static ByteTerm SubpatternBegin()
+    {
+        return ByteTerm(TypeSubpatternBegin);
+    }
+
+    static ByteTerm SubpatternEnd()
+    {
+        return ByteTerm(TypeSubpatternEnd);
+    }
+    
+    static ByteTerm DotStarEnclosure(bool bolAnchor, bool eolAnchor)
+    {
+        ByteTerm term(TypeDotStarEnclosure);
+        term.anchors.m_bol = bolAnchor;
+        term.anchors.m_eol = eolAnchor;
+        return term;
+    }
+
+    bool invert()
+    {
+        return m_invert;
+    }
+
+    bool capture()
+    {
+        return m_capture;
+    }
+};
+
+class ByteDisjunction {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ByteDisjunction(unsigned numSubpatterns, unsigned frameSize)
+        : m_numSubpatterns(numSubpatterns)
+        , m_frameSize(frameSize)
+    {
+    }
+
+    size_t estimatedSizeInBytes() const { return terms.capacity() * sizeof(ByteTerm); }
+
+    Vector<ByteTerm> terms;
+    unsigned m_numSubpatterns;
+    unsigned m_frameSize;
+};
+
+struct BytecodePattern {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    BytecodePattern(std::unique_ptr<ByteDisjunction> body, Vector<std::unique_ptr<ByteDisjunction>>& parenthesesInfoToAdopt, YarrPattern& pattern, BumpPointerAllocator* allocator, ConcurrentJSLock* lock)
+        : m_body(WTFMove(body))
+        , m_flags(pattern.m_flags)
+        , m_allocator(allocator)
+        , m_lock(lock)
+    {
+        m_body->terms.shrinkToFit();
+
+        newlineCharacterClass = pattern.newlineCharacterClass();
+        if (unicode() && ignoreCase())
+            wordcharCharacterClass = pattern.wordUnicodeIgnoreCaseCharCharacterClass();
+        else
+            wordcharCharacterClass = pattern.wordcharCharacterClass();
+
+        m_allParenthesesInfo.swap(parenthesesInfoToAdopt);
+        m_allParenthesesInfo.shrinkToFit();
+
+        m_userCharacterClasses.swap(pattern.m_userCharacterClasses);
+        m_userCharacterClasses.shrinkToFit();
+    }
+
+    size_t estimatedSizeInBytes() const { return m_body->estimatedSizeInBytes(); }
+    
+    bool ignoreCase() const { return m_flags & FlagIgnoreCase; }
+    bool multiline() const { return m_flags & FlagMultiline; }
+    bool sticky() const { return m_flags & FlagSticky; }
+    bool unicode() const { return m_flags & FlagUnicode; }
+
+    std::unique_ptr<ByteDisjunction> m_body;
+    RegExpFlags m_flags;
+    // Each BytecodePattern is associated with a RegExp, each RegExp is associated
+    // with a VM.  Cache a pointer to out VM's m_regExpAllocator.
+    BumpPointerAllocator* m_allocator;
+    ConcurrentJSLock* m_lock;
+
+    CharacterClass* newlineCharacterClass;
+    CharacterClass* wordcharCharacterClass;
+
+private:
+    Vector<std::unique_ptr<ByteDisjunction>> m_allParenthesesInfo;
+    Vector<std::unique_ptr<CharacterClass>> m_userCharacterClasses;
+};
+
+JS_EXPORT_PRIVATE std::unique_ptr<BytecodePattern> byteCompile(YarrPattern&, BumpPointerAllocator*, ConcurrentJSLock* = nullptr);
+JS_EXPORT_PRIVATE unsigned interpret(BytecodePattern*, const String& input, unsigned start, unsigned* output);
+unsigned interpret(BytecodePattern*, const LChar* input, unsigned length, unsigned start, unsigned* output);
+unsigned interpret(BytecodePattern*, const UChar* input, unsigned length, unsigned start, unsigned* output);
+
+} } // namespace JSC::Yarr
diff --git a/yarr/YarrJIT.cpp b/yarr/YarrJIT.cpp
new file mode 100644
index 0000000..106c984
--- /dev/null
+++ b/yarr/YarrJIT.cpp
@@ -0,0 +1,2756 @@
+/*
+ * Copyright (C) 2009, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "YarrJIT.h"
+
+#include <wtf/ASCIICType.h>
+#include "LinkBuffer.h"
+#include "Options.h"
+#include "Yarr.h"
+#include "YarrCanonicalize.h"
+
+#if ENABLE(YARR_JIT)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+template<YarrJITCompileMode compileMode>
+class YarrGenerator : private MacroAssembler {
+    friend void jitCompile(VM*, YarrCodeBlock& jitObject, const String& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
+
+#if CPU(ARM)
+    static const RegisterID input = ARMRegisters::r0;
+    static const RegisterID index = ARMRegisters::r1;
+    static const RegisterID length = ARMRegisters::r2;
+    static const RegisterID output = ARMRegisters::r3;
+
+    static const RegisterID regT0 = ARMRegisters::r4;
+    static const RegisterID regT1 = ARMRegisters::r5;
+
+    static const RegisterID returnRegister = ARMRegisters::r0;
+    static const RegisterID returnRegister2 = ARMRegisters::r1;
+#elif CPU(ARM64)
+    static const RegisterID input = ARM64Registers::x0;
+    static const RegisterID index = ARM64Registers::x1;
+    static const RegisterID length = ARM64Registers::x2;
+    static const RegisterID output = ARM64Registers::x3;
+
+    static const RegisterID regT0 = ARM64Registers::x4;
+    static const RegisterID regT1 = ARM64Registers::x5;
+
+    static const RegisterID returnRegister = ARM64Registers::x0;
+    static const RegisterID returnRegister2 = ARM64Registers::x1;
+#elif CPU(MIPS)
+    static const RegisterID input = MIPSRegisters::a0;
+    static const RegisterID index = MIPSRegisters::a1;
+    static const RegisterID length = MIPSRegisters::a2;
+    static const RegisterID output = MIPSRegisters::a3;
+
+    static const RegisterID regT0 = MIPSRegisters::t4;
+    static const RegisterID regT1 = MIPSRegisters::t5;
+
+    static const RegisterID returnRegister = MIPSRegisters::v0;
+    static const RegisterID returnRegister2 = MIPSRegisters::v1;
+#elif CPU(SH4)
+    static const RegisterID input = SH4Registers::r4;
+    static const RegisterID index = SH4Registers::r5;
+    static const RegisterID length = SH4Registers::r6;
+    static const RegisterID output = SH4Registers::r7;
+
+    static const RegisterID regT0 = SH4Registers::r0;
+    static const RegisterID regT1 = SH4Registers::r1;
+
+    static const RegisterID returnRegister = SH4Registers::r0;
+    static const RegisterID returnRegister2 = SH4Registers::r1;
+#elif CPU(X86)
+    static const RegisterID input = X86Registers::eax;
+    static const RegisterID index = X86Registers::edx;
+    static const RegisterID length = X86Registers::ecx;
+    static const RegisterID output = X86Registers::edi;
+
+    static const RegisterID regT0 = X86Registers::ebx;
+    static const RegisterID regT1 = X86Registers::esi;
+
+    static const RegisterID returnRegister = X86Registers::eax;
+    static const RegisterID returnRegister2 = X86Registers::edx;
+#elif CPU(X86_64)
+#if !OS(WINDOWS)
+    static const RegisterID input = X86Registers::edi;
+    static const RegisterID index = X86Registers::esi;
+    static const RegisterID length = X86Registers::edx;
+    static const RegisterID output = X86Registers::ecx;
+#else
+    // If the return value doesn't fit in 64bits, its destination is pointed by rcx and the parameters are shifted.
+    // http://msdn.microsoft.com/en-us/library/7572ztz4.aspx
+    COMPILE_ASSERT(sizeof(MatchResult) > sizeof(void*), MatchResult_does_not_fit_in_64bits);
+    static const RegisterID input = X86Registers::edx;
+    static const RegisterID index = X86Registers::r8;
+    static const RegisterID length = X86Registers::r9;
+    static const RegisterID output = X86Registers::r10;
+#endif
+
+    static const RegisterID regT0 = X86Registers::eax;
+    static const RegisterID regT1 = X86Registers::ebx;
+
+    static const RegisterID returnRegister = X86Registers::eax;
+    static const RegisterID returnRegister2 = X86Registers::edx;
+#endif
+
+    void optimizeAlternative(PatternAlternative* alternative)
+    {
+        if (!alternative->m_terms.size())
+            return;
+
+        for (unsigned i = 0; i < alternative->m_terms.size() - 1; ++i) {
+            PatternTerm& term = alternative->m_terms[i];
+            PatternTerm& nextTerm = alternative->m_terms[i + 1];
+
+            if ((term.type == PatternTerm::TypeCharacterClass)
+                && (term.quantityType == QuantifierFixedCount)
+                && (nextTerm.type == PatternTerm::TypePatternCharacter)
+                && (nextTerm.quantityType == QuantifierFixedCount)) {
+                PatternTerm termCopy = term;
+                alternative->m_terms[i] = nextTerm;
+                alternative->m_terms[i + 1] = termCopy;
+            }
+        }
+    }
+
+    void matchCharacterClassRange(RegisterID character, JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar32* matches, unsigned matchCount)
+    {
+        do {
+            // pick which range we're going to generate
+            int which = count >> 1;
+            char lo = ranges[which].begin;
+            char hi = ranges[which].end;
+
+            // check if there are any ranges or matches below lo.  If not, just jl to failure -
+            // if there is anything else to check, check that first, if it falls through jmp to failure.
+            if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
+
+                // generate code for all ranges before this one
+                if (which)
+                    matchCharacterClassRange(character, failures, matchDest, ranges, which, matchIndex, matches, matchCount);
+
+                while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                    matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
+                    ++*matchIndex;
+                }
+                failures.append(jump());
+
+                loOrAbove.link(this);
+            } else if (which) {
+                Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
+
+                matchCharacterClassRange(character, failures, matchDest, ranges, which, matchIndex, matches, matchCount);
+                failures.append(jump());
+
+                loOrAbove.link(this);
+            } else
+                failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
+
+            while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
+                ++*matchIndex;
+
+            matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
+            // fall through to here, the value is above hi.
+
+            // shuffle along & loop around if there are any more matches to handle.
+            unsigned next = which + 1;
+            ranges += next;
+            count -= next;
+        } while (count);
+    }
+
+    void matchCharacterClass(RegisterID character, JumpList& matchDest, const CharacterClass* charClass)
+    {
+        if (charClass->m_table) {
+            ExtendedAddress tableEntry(character, reinterpret_cast<intptr_t>(charClass->m_table));
+            matchDest.append(branchTest8(charClass->m_tableInverted ? Zero : NonZero, tableEntry));
+            return;
+        }
+        Jump unicodeFail;
+        if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size()) {
+            Jump isAscii = branch32(LessThanOrEqual, character, TrustedImm32(0x7f));
+
+            if (charClass->m_matchesUnicode.size()) {
+                for (unsigned i = 0; i < charClass->m_matchesUnicode.size(); ++i) {
+                    UChar32 ch = charClass->m_matchesUnicode[i];
+                    matchDest.append(branch32(Equal, character, Imm32(ch)));
+                }
+            }
+
+            if (charClass->m_rangesUnicode.size()) {
+                for (unsigned i = 0; i < charClass->m_rangesUnicode.size(); ++i) {
+                    UChar32 lo = charClass->m_rangesUnicode[i].begin;
+                    UChar32 hi = charClass->m_rangesUnicode[i].end;
+
+                    Jump below = branch32(LessThan, character, Imm32(lo));
+                    matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
+                    below.link(this);
+                }
+            }
+
+            unicodeFail = jump();
+            isAscii.link(this);
+        }
+
+        if (charClass->m_ranges.size()) {
+            unsigned matchIndex = 0;
+            JumpList failures;
+            matchCharacterClassRange(character, failures, matchDest, charClass->m_ranges.begin(), charClass->m_ranges.size(), &matchIndex, charClass->m_matches.begin(), charClass->m_matches.size());
+            while (matchIndex < charClass->m_matches.size())
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass->m_matches[matchIndex++])));
+
+            failures.link(this);
+        } else if (charClass->m_matches.size()) {
+            // optimization: gather 'a','A' etc back together, can mask & test once.
+            Vector<char> matchesAZaz;
+
+            for (unsigned i = 0; i < charClass->m_matches.size(); ++i) {
+                char ch = charClass->m_matches[i];
+                if (m_pattern.ignoreCase()) {
+                    if (isASCIILower(ch)) {
+                        matchesAZaz.append(ch);
+                        continue;
+                    }
+                    if (isASCIIUpper(ch))
+                        continue;
+                }
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
+            }
+
+            if (unsigned countAZaz = matchesAZaz.size()) {
+                or32(TrustedImm32(32), character);
+                for (unsigned i = 0; i < countAZaz; ++i)
+                    matchDest.append(branch32(Equal, character, TrustedImm32(matchesAZaz[i])));
+            }
+        }
+
+        if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size())
+            unicodeFail.link(this);
+    }
+
+    // Jumps if input not available; will have (incorrectly) incremented already!
+    Jump jumpIfNoAvailableInput(unsigned countToCheck = 0)
+    {
+        if (countToCheck)
+            add32(Imm32(countToCheck), index);
+        return branch32(Above, index, length);
+    }
+
+    Jump jumpIfAvailableInput(unsigned countToCheck)
+    {
+        add32(Imm32(countToCheck), index);
+        return branch32(BelowOrEqual, index, length);
+    }
+
+    Jump checkInput()
+    {
+        return branch32(BelowOrEqual, index, length);
+    }
+
+    Jump atEndOfInput()
+    {
+        return branch32(Equal, index, length);
+    }
+
+    Jump notAtEndOfInput()
+    {
+        return branch32(NotEqual, index, length);
+    }
+
+    BaseIndex negativeOffsetIndexedAddress(Checked<unsigned> negativeCharacterOffset, RegisterID tempReg, RegisterID indexReg = index)
+    {
+        RegisterID base = input;
+
+        // BaseIndex() addressing can take a int32_t offset. Given that we can have a regular
+        // expression that has unsigned character offsets, BaseIndex's signed offset is insufficient
+        // for addressing in extreme cases where we might underflow. Therefore we check to see if
+        // negativeCharacterOffset will underflow directly or after converting for 16 bit characters.
+        // If so, we do our own address calculating by adjusting the base, using the result register
+        // as a temp address register.
+        unsigned maximumNegativeOffsetForCharacterSize = m_charSize == Char8 ? 0x7fffffff : 0x3fffffff;
+        unsigned offsetAdjustAmount = 0x40000000;
+        if (negativeCharacterOffset.unsafeGet() > maximumNegativeOffsetForCharacterSize) {
+            base = tempReg;
+            move(input, base);
+            while (negativeCharacterOffset.unsafeGet() > maximumNegativeOffsetForCharacterSize) {
+                subPtr(TrustedImm32(offsetAdjustAmount), base);
+                if (m_charSize != Char8)
+                    subPtr(TrustedImm32(offsetAdjustAmount), base);
+                negativeCharacterOffset -= offsetAdjustAmount;
+            }
+        }
+
+        Checked<int32_t> characterOffset(-static_cast<int32_t>(negativeCharacterOffset.unsafeGet()));
+
+        if (m_charSize == Char8)
+            return BaseIndex(input, indexReg, TimesOne, (characterOffset * static_cast<int32_t>(sizeof(char))).unsafeGet());
+
+        return BaseIndex(input, indexReg, TimesTwo, (characterOffset * static_cast<int32_t>(sizeof(UChar))).unsafeGet());
+    }
+
+    void readCharacter(Checked<unsigned> negativeCharacterOffset, RegisterID resultReg, RegisterID indexReg = index)
+    {
+        BaseIndex address = negativeOffsetIndexedAddress(negativeCharacterOffset, resultReg, indexReg);
+
+        if (m_charSize == Char8)
+            load8(address, resultReg);
+        else
+            load16Unaligned(address, resultReg);
+    }
+
+    Jump jumpIfCharNotEquals(UChar32 ch, Checked<unsigned> negativeCharacterOffset, RegisterID character)
+    {
+        readCharacter(negativeCharacterOffset, character);
+
+        // For case-insesitive compares, non-ascii characters that have different
+        // upper & lower case representations are converted to a character class.
+        ASSERT(!m_pattern.ignoreCase() || isASCIIAlpha(ch) || isCanonicallyUnique(ch));
+        if (m_pattern.ignoreCase() && isASCIIAlpha(ch)) {
+            or32(TrustedImm32(0x20), character);
+            ch |= 0x20;
+        }
+
+        return branch32(NotEqual, character, Imm32(ch));
+    }
+    
+    void storeToFrame(RegisterID reg, unsigned frameLocation)
+    {
+        poke(reg, frameLocation);
+    }
+
+    void storeToFrame(TrustedImm32 imm, unsigned frameLocation)
+    {
+        poke(imm, frameLocation);
+    }
+
+    DataLabelPtr storeToFrameWithPatch(unsigned frameLocation)
+    {
+        return storePtrWithPatch(TrustedImmPtr(0), Address(stackPointerRegister, frameLocation * sizeof(void*)));
+    }
+
+    void loadFromFrame(unsigned frameLocation, RegisterID reg)
+    {
+        peek(reg, frameLocation);
+    }
+
+    void loadFromFrameAndJump(unsigned frameLocation)
+    {
+        jump(Address(stackPointerRegister, frameLocation * sizeof(void*)));
+    }
+
+    unsigned alignCallFrameSizeInBytes(unsigned callFrameSize)
+    {
+        callFrameSize *= sizeof(void*);
+        if (callFrameSize / sizeof(void*) != m_pattern.m_body->m_callFrameSize)
+            CRASH();
+        callFrameSize = (callFrameSize + 0x3f) & ~0x3f;
+        if (!callFrameSize)
+            CRASH();
+        return callFrameSize;
+    }
+    void initCallFrame()
+    {
+        unsigned callFrameSize = m_pattern.m_body->m_callFrameSize;
+        if (callFrameSize)
+            subPtr(Imm32(alignCallFrameSizeInBytes(callFrameSize)), stackPointerRegister);
+    }
+    void removeCallFrame()
+    {
+        unsigned callFrameSize = m_pattern.m_body->m_callFrameSize;
+        if (callFrameSize)
+            addPtr(Imm32(alignCallFrameSizeInBytes(callFrameSize)), stackPointerRegister);
+    }
+
+    void generateFailReturn()
+    {
+        move(TrustedImmPtr((void*)WTF::notFound), returnRegister);
+        move(TrustedImm32(0), returnRegister2);
+        generateReturn();
+    }
+
+    // Used to record subpatters, should only be called if compileMode is IncludeSubpatterns.
+    void setSubpatternStart(RegisterID reg, unsigned subpattern)
+    {
+        ASSERT(subpattern);
+        // FIXME: should be able to ASSERT(compileMode == IncludeSubpatterns), but then this function is conditionally NORETURN. :-(
+        store32(reg, Address(output, (subpattern << 1) * sizeof(int)));
+    }
+    void setSubpatternEnd(RegisterID reg, unsigned subpattern)
+    {
+        ASSERT(subpattern);
+        // FIXME: should be able to ASSERT(compileMode == IncludeSubpatterns), but then this function is conditionally NORETURN. :-(
+        store32(reg, Address(output, ((subpattern << 1) + 1) * sizeof(int)));
+    }
+    void clearSubpatternStart(unsigned subpattern)
+    {
+        ASSERT(subpattern);
+        // FIXME: should be able to ASSERT(compileMode == IncludeSubpatterns), but then this function is conditionally NORETURN. :-(
+        store32(TrustedImm32(-1), Address(output, (subpattern << 1) * sizeof(int)));
+    }
+
+    // We use one of three different strategies to track the start of the current match,
+    // while matching.
+    // 1) If the pattern has a fixed size, do nothing! - we calculate the value lazily
+    //    at the end of matching. This is irrespective of compileMode, and in this case
+    //    these methods should never be called.
+    // 2) If we're compiling IncludeSubpatterns, 'output' contains a pointer to an output
+    //    vector, store the match start in the output vector.
+    // 3) If we're compiling MatchOnly, 'output' is unused, store the match start directly
+    //    in this register.
+    void setMatchStart(RegisterID reg)
+    {
+        ASSERT(!m_pattern.m_body->m_hasFixedSize);
+        if (compileMode == IncludeSubpatterns)
+            store32(reg, output);
+        else
+            move(reg, output);
+    }
+    void getMatchStart(RegisterID reg)
+    {
+        ASSERT(!m_pattern.m_body->m_hasFixedSize);
+        if (compileMode == IncludeSubpatterns)
+            load32(output, reg);
+        else
+            move(output, reg);
+    }
+
+    enum YarrOpCode {
+        // These nodes wrap body alternatives - those in the main disjunction,
+        // rather than subpatterns or assertions. These are chained together in
+        // a doubly linked list, with a 'begin' node for the first alternative,
+        // a 'next' node for each subsequent alternative, and an 'end' node at
+        // the end. In the case of repeating alternatives, the 'end' node also
+        // has a reference back to 'begin'.
+        OpBodyAlternativeBegin,
+        OpBodyAlternativeNext,
+        OpBodyAlternativeEnd,
+        // Similar to the body alternatives, but used for subpatterns with two
+        // or more alternatives.
+        OpNestedAlternativeBegin,
+        OpNestedAlternativeNext,
+        OpNestedAlternativeEnd,
+        // Used for alternatives in subpatterns where there is only a single
+        // alternative (backtrackingis easier in these cases), or for alternatives
+        // which never need to be backtracked (those in parenthetical assertions,
+        // terminal subpatterns).
+        OpSimpleNestedAlternativeBegin,
+        OpSimpleNestedAlternativeNext,
+        OpSimpleNestedAlternativeEnd,
+        // Used to wrap 'Once' subpattern matches (quantityMaxCount == 1).
+        OpParenthesesSubpatternOnceBegin,
+        OpParenthesesSubpatternOnceEnd,
+        // Used to wrap 'Terminal' subpattern matches (at the end of the regexp).
+        OpParenthesesSubpatternTerminalBegin,
+        OpParenthesesSubpatternTerminalEnd,
+        // Used to wrap parenthetical assertions.
+        OpParentheticalAssertionBegin,
+        OpParentheticalAssertionEnd,
+        // Wraps all simple terms (pattern characters, character classes).
+        OpTerm,
+        // Where an expression contains only 'once through' body alternatives
+        // and no repeating ones, this op is used to return match failure.
+        OpMatchFailed
+    };
+
+    // This structure is used to hold the compiled opcode information,
+    // including reference back to the original PatternTerm/PatternAlternatives,
+    // and JIT compilation data structures.
+    struct YarrOp {
+        explicit YarrOp(PatternTerm* term)
+            : m_op(OpTerm)
+            , m_term(term)
+            , m_isDeadCode(false)
+        {
+        }
+
+        explicit YarrOp(YarrOpCode op)
+            : m_op(op)
+            , m_isDeadCode(false)
+        {
+        }
+
+        // The operation, as a YarrOpCode, and also a reference to the PatternTerm.
+        YarrOpCode m_op;
+        PatternTerm* m_term;
+
+        // For alternatives, this holds the PatternAlternative and doubly linked
+        // references to this alternative's siblings. In the case of the
+        // OpBodyAlternativeEnd node at the end of a section of repeating nodes,
+        // m_nextOp will reference the OpBodyAlternativeBegin node of the first
+        // repeating alternative.
+        PatternAlternative* m_alternative;
+        size_t m_previousOp;
+        size_t m_nextOp;
+
+        // Used to record a set of Jumps out of the generated code, typically
+        // used for jumps out to backtracking code, and a single reentry back
+        // into the code for a node (likely where a backtrack will trigger
+        // rematching).
+        Label m_reentry;
+        JumpList m_jumps;
+
+        // Used for backtracking when the prior alternative did not consume any
+        // characters but matched.
+        Jump m_zeroLengthMatch;
+
+        // This flag is used to null out the second pattern character, when
+        // two are fused to match a pair together.
+        bool m_isDeadCode;
+
+        // Currently used in the case of some of the more complex management of
+        // 'm_checkedOffset', to cache the offset used in this alternative, to avoid
+        // recalculating it.
+        Checked<unsigned> m_checkAdjust;
+
+        // Used by OpNestedAlternativeNext/End to hold the pointer to the
+        // value that will be pushed into the pattern's frame to return to,
+        // upon backtracking back into the disjunction.
+        DataLabelPtr m_returnAddress;
+    };
+
+    // BacktrackingState
+    // This class encapsulates information about the state of code generation
+    // whilst generating the code for backtracking, when a term fails to match.
+    // Upon entry to code generation of the backtracking code for a given node,
+    // the Backtracking state will hold references to all control flow sources
+    // that are outputs in need of further backtracking from the prior node
+    // generated (which is the subsequent operation in the regular expression,
+    // and in the m_ops Vector, since we generated backtracking backwards).
+    // These references to control flow take the form of:
+    //  - A jump list of jumps, to be linked to code that will backtrack them
+    //    further.
+    //  - A set of DataLabelPtr values, to be populated with values to be
+    //    treated effectively as return addresses backtracking into complex
+    //    subpatterns.
+    //  - A flag indicating that the current sequence of generated code up to
+    //    this point requires backtracking.
+    class BacktrackingState {
+    public:
+        BacktrackingState()
+            : m_pendingFallthrough(false)
+        {
+        }
+
+        // Add a jump or jumps, a return address, or set the flag indicating
+        // that the current 'fallthrough' control flow requires backtracking.
+        void append(const Jump& jump)
+        {
+            m_laterFailures.append(jump);
+        }
+        void append(JumpList& jumpList)
+        {
+            m_laterFailures.append(jumpList);
+        }
+        void append(const DataLabelPtr& returnAddress)
+        {
+            m_pendingReturns.append(returnAddress);
+        }
+        void fallthrough()
+        {
+            ASSERT(!m_pendingFallthrough);
+            m_pendingFallthrough = true;
+        }
+
+        // These methods clear the backtracking state, either linking to the
+        // current location, a provided label, or copying the backtracking out
+        // to a JumpList. All actions may require code generation to take place,
+        // and as such are passed a pointer to the assembler.
+        void link(MacroAssembler* assembler)
+        {
+            if (m_pendingReturns.size()) {
+                Label here(assembler);
+                for (unsigned i = 0; i < m_pendingReturns.size(); ++i)
+                    m_backtrackRecords.append(ReturnAddressRecord(m_pendingReturns[i], here));
+                m_pendingReturns.clear();
+            }
+            m_laterFailures.link(assembler);
+            m_laterFailures.clear();
+            m_pendingFallthrough = false;
+        }
+        void linkTo(Label label, MacroAssembler* assembler)
+        {
+            if (m_pendingReturns.size()) {
+                for (unsigned i = 0; i < m_pendingReturns.size(); ++i)
+                    m_backtrackRecords.append(ReturnAddressRecord(m_pendingReturns[i], label));
+                m_pendingReturns.clear();
+            }
+            if (m_pendingFallthrough)
+                assembler->jump(label);
+            m_laterFailures.linkTo(label, assembler);
+            m_laterFailures.clear();
+            m_pendingFallthrough = false;
+        }
+        void takeBacktracksToJumpList(JumpList& jumpList, MacroAssembler* assembler)
+        {
+            if (m_pendingReturns.size()) {
+                Label here(assembler);
+                for (unsigned i = 0; i < m_pendingReturns.size(); ++i)
+                    m_backtrackRecords.append(ReturnAddressRecord(m_pendingReturns[i], here));
+                m_pendingReturns.clear();
+                m_pendingFallthrough = true;
+            }
+            if (m_pendingFallthrough)
+                jumpList.append(assembler->jump());
+            jumpList.append(m_laterFailures);
+            m_laterFailures.clear();
+            m_pendingFallthrough = false;
+        }
+
+        bool isEmpty()
+        {
+            return m_laterFailures.empty() && m_pendingReturns.isEmpty() && !m_pendingFallthrough;
+        }
+
+        // Called at the end of code generation to link all return addresses.
+        void linkDataLabels(LinkBuffer& linkBuffer)
+        {
+            ASSERT(isEmpty());
+            for (unsigned i = 0; i < m_backtrackRecords.size(); ++i)
+                linkBuffer.patch(m_backtrackRecords[i].m_dataLabel, linkBuffer.locationOf(m_backtrackRecords[i].m_backtrackLocation));
+        }
+
+    private:
+        struct ReturnAddressRecord {
+            ReturnAddressRecord(DataLabelPtr dataLabel, Label backtrackLocation)
+                : m_dataLabel(dataLabel)
+                , m_backtrackLocation(backtrackLocation)
+            {
+            }
+
+            DataLabelPtr m_dataLabel;
+            Label m_backtrackLocation;
+        };
+
+        JumpList m_laterFailures;
+        bool m_pendingFallthrough;
+        Vector<DataLabelPtr, 4> m_pendingReturns;
+        Vector<ReturnAddressRecord, 4> m_backtrackRecords;
+    };
+
+    // Generation methods:
+    // ===================
+
+    // This method provides a default implementation of backtracking common
+    // to many terms; terms commonly jump out of the forwards  matching path
+    // on any failed conditions, and add these jumps to the m_jumps list. If
+    // no special handling is required we can often just backtrack to m_jumps.
+    void backtrackTermDefault(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        m_backtrackingState.append(op.m_jumps);
+    }
+
+    void generateAssertionBOL(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        if (m_pattern.multiline()) {
+            const RegisterID character = regT0;
+
+            JumpList matchDest;
+            if (!term->inputPosition)
+                matchDest.append(branch32(Equal, index, Imm32(m_checkedOffset.unsafeGet())));
+
+            readCharacter(m_checkedOffset - term->inputPosition + 1, character);
+            matchCharacterClass(character, matchDest, m_pattern.newlineCharacterClass());
+            op.m_jumps.append(jump());
+
+            matchDest.link(this);
+        } else {
+            // Erk, really should poison out these alternatives early. :-/
+            if (term->inputPosition)
+                op.m_jumps.append(jump());
+            else
+                op.m_jumps.append(branch32(NotEqual, index, Imm32(m_checkedOffset.unsafeGet())));
+        }
+    }
+    void backtrackAssertionBOL(size_t opIndex)
+    {
+        backtrackTermDefault(opIndex);
+    }
+
+    void generateAssertionEOL(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        if (m_pattern.multiline()) {
+            const RegisterID character = regT0;
+
+            JumpList matchDest;
+            if (term->inputPosition == m_checkedOffset.unsafeGet())
+                matchDest.append(atEndOfInput());
+
+            readCharacter(m_checkedOffset - term->inputPosition, character);
+            matchCharacterClass(character, matchDest, m_pattern.newlineCharacterClass());
+            op.m_jumps.append(jump());
+
+            matchDest.link(this);
+        } else {
+            if (term->inputPosition == m_checkedOffset.unsafeGet())
+                op.m_jumps.append(notAtEndOfInput());
+            // Erk, really should poison out these alternatives early. :-/
+            else
+                op.m_jumps.append(jump());
+        }
+    }
+    void backtrackAssertionEOL(size_t opIndex)
+    {
+        backtrackTermDefault(opIndex);
+    }
+
+    // Also falls though on nextIsNotWordChar.
+    void matchAssertionWordchar(size_t opIndex, JumpList& nextIsWordChar, JumpList& nextIsNotWordChar)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID character = regT0;
+
+        if (term->inputPosition == m_checkedOffset.unsafeGet())
+            nextIsNotWordChar.append(atEndOfInput());
+
+        readCharacter(m_checkedOffset - term->inputPosition, character);
+        matchCharacterClass(character, nextIsWordChar, m_pattern.wordcharCharacterClass());
+    }
+
+    void generateAssertionWordBoundary(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID character = regT0;
+
+        Jump atBegin;
+        JumpList matchDest;
+        if (!term->inputPosition)
+            atBegin = branch32(Equal, index, Imm32(m_checkedOffset.unsafeGet()));
+        readCharacter(m_checkedOffset - term->inputPosition + 1, character);
+        matchCharacterClass(character, matchDest, m_pattern.wordcharCharacterClass());
+        if (!term->inputPosition)
+            atBegin.link(this);
+
+        // We fall through to here if the last character was not a wordchar.
+        JumpList nonWordCharThenWordChar;
+        JumpList nonWordCharThenNonWordChar;
+        if (term->invert()) {
+            matchAssertionWordchar(opIndex, nonWordCharThenNonWordChar, nonWordCharThenWordChar);
+            nonWordCharThenWordChar.append(jump());
+        } else {
+            matchAssertionWordchar(opIndex, nonWordCharThenWordChar, nonWordCharThenNonWordChar);
+            nonWordCharThenNonWordChar.append(jump());
+        }
+        op.m_jumps.append(nonWordCharThenNonWordChar);
+
+        // We jump here if the last character was a wordchar.
+        matchDest.link(this);
+        JumpList wordCharThenWordChar;
+        JumpList wordCharThenNonWordChar;
+        if (term->invert()) {
+            matchAssertionWordchar(opIndex, wordCharThenNonWordChar, wordCharThenWordChar);
+            wordCharThenWordChar.append(jump());
+        } else {
+            matchAssertionWordchar(opIndex, wordCharThenWordChar, wordCharThenNonWordChar);
+            // This can fall-though!
+        }
+
+        op.m_jumps.append(wordCharThenWordChar);
+
+        nonWordCharThenWordChar.link(this);
+        wordCharThenNonWordChar.link(this);
+    }
+    void backtrackAssertionWordBoundary(size_t opIndex)
+    {
+        backtrackTermDefault(opIndex);
+    }
+
+    void generatePatternCharacterOnce(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+
+        if (op.m_isDeadCode)
+            return;
+        
+        // m_ops always ends with a OpBodyAlternativeEnd or OpMatchFailed
+        // node, so there must always be at least one more node.
+        ASSERT(opIndex + 1 < m_ops.size());
+        YarrOp* nextOp = &m_ops[opIndex + 1];
+
+        PatternTerm* term = op.m_term;
+        UChar32 ch = term->patternCharacter;
+
+        if ((ch > 0xff) && (m_charSize == Char8)) {
+            // Have a 16 bit pattern character and an 8 bit string - short circuit
+            op.m_jumps.append(jump());
+            return;
+        }
+
+        const RegisterID character = regT0;
+        unsigned maxCharactersAtOnce = m_charSize == Char8 ? 4 : 2;
+        unsigned ignoreCaseMask = 0;
+#if CPU(BIG_ENDIAN)
+        int allCharacters = ch << (m_charSize == Char8 ? 24 : 16);
+#else
+        int allCharacters = ch;
+#endif
+        unsigned numberCharacters;
+        unsigned startTermPosition = term->inputPosition;
+
+        // For case-insesitive compares, non-ascii characters that have different
+        // upper & lower case representations are converted to a character class.
+        ASSERT(!m_pattern.ignoreCase() || isASCIIAlpha(ch) || isCanonicallyUnique(ch));
+
+        if (m_pattern.ignoreCase() && isASCIIAlpha(ch))
+#if CPU(BIG_ENDIAN)
+            ignoreCaseMask |= 32 << (m_charSize == Char8 ? 24 : 16);
+#else
+            ignoreCaseMask |= 32;
+#endif
+
+        for (numberCharacters = 1; numberCharacters < maxCharactersAtOnce && nextOp->m_op == OpTerm; ++numberCharacters, nextOp = &m_ops[opIndex + numberCharacters]) {
+            PatternTerm* nextTerm = nextOp->m_term;
+            
+            if (nextTerm->type != PatternTerm::TypePatternCharacter
+                || nextTerm->quantityType != QuantifierFixedCount
+                || nextTerm->quantityMaxCount != 1
+                || nextTerm->inputPosition != (startTermPosition + numberCharacters))
+                break;
+
+            nextOp->m_isDeadCode = true;
+
+#if CPU(BIG_ENDIAN)
+            int shiftAmount = (m_charSize == Char8 ? 24 : 16) - ((m_charSize == Char8 ? 8 : 16) * numberCharacters);
+#else
+            int shiftAmount = (m_charSize == Char8 ? 8 : 16) * numberCharacters;
+#endif
+
+            UChar32 currentCharacter = nextTerm->patternCharacter;
+
+            if ((currentCharacter > 0xff) && (m_charSize == Char8)) {
+                // Have a 16 bit pattern character and an 8 bit string - short circuit
+                op.m_jumps.append(jump());
+                return;
+            }
+
+            // For case-insesitive compares, non-ascii characters that have different
+            // upper & lower case representations are converted to a character class.
+            ASSERT(!m_pattern.ignoreCase() || isASCIIAlpha(currentCharacter) || isCanonicallyUnique(currentCharacter));
+
+            allCharacters |= (currentCharacter << shiftAmount);
+
+            if ((m_pattern.ignoreCase()) && (isASCIIAlpha(currentCharacter)))
+                ignoreCaseMask |= 32 << shiftAmount;                    
+        }
+
+        if (m_charSize == Char8) {
+            switch (numberCharacters) {
+            case 1:
+                op.m_jumps.append(jumpIfCharNotEquals(ch, m_checkedOffset - startTermPosition, character));
+                return;
+            case 2: {
+                load16Unaligned(negativeOffsetIndexedAddress(m_checkedOffset - startTermPosition, character), character);
+                break;
+            }
+            case 3: {
+                load16Unaligned(negativeOffsetIndexedAddress(m_checkedOffset - startTermPosition, character), character);
+                if (ignoreCaseMask)
+                    or32(Imm32(ignoreCaseMask), character);
+                op.m_jumps.append(branch32(NotEqual, character, Imm32((allCharacters & 0xffff) | ignoreCaseMask)));
+                op.m_jumps.append(jumpIfCharNotEquals(allCharacters >> 16, m_checkedOffset - startTermPosition - 2, character));
+                return;
+            }
+            case 4: {
+                load32WithUnalignedHalfWords(negativeOffsetIndexedAddress(m_checkedOffset- startTermPosition, character), character);
+                break;
+            }
+            }
+        } else {
+            switch (numberCharacters) {
+            case 1:
+                op.m_jumps.append(jumpIfCharNotEquals(ch, m_checkedOffset - term->inputPosition, character));
+                return;
+            case 2:
+                load32WithUnalignedHalfWords(negativeOffsetIndexedAddress(m_checkedOffset- term->inputPosition, character), character);
+                break;
+            }
+        }
+
+        if (ignoreCaseMask)
+            or32(Imm32(ignoreCaseMask), character);
+        op.m_jumps.append(branch32(NotEqual, character, Imm32(allCharacters | ignoreCaseMask)));
+        return;
+    }
+    void backtrackPatternCharacterOnce(size_t opIndex)
+    {
+        backtrackTermDefault(opIndex);
+    }
+
+    void generatePatternCharacterFixed(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+        UChar32 ch = term->patternCharacter;
+
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+
+        move(index, countRegister);
+        sub32(Imm32(term->quantityMaxCount.unsafeGet()), countRegister);
+
+        Label loop(this);
+        readCharacter(m_checkedOffset - term->inputPosition - term->quantityMaxCount, character, countRegister);
+        // For case-insesitive compares, non-ascii characters that have different
+        // upper & lower case representations are converted to a character class.
+        ASSERT(!m_pattern.ignoreCase() || isASCIIAlpha(ch) || isCanonicallyUnique(ch));
+        if (m_pattern.ignoreCase() && isASCIIAlpha(ch)) {
+            or32(TrustedImm32(0x20), character);
+            ch |= 0x20;
+        }
+
+        op.m_jumps.append(branch32(NotEqual, character, Imm32(ch)));
+        add32(TrustedImm32(1), countRegister);
+        branch32(NotEqual, countRegister, index).linkTo(loop, this);
+    }
+    void backtrackPatternCharacterFixed(size_t opIndex)
+    {
+        backtrackTermDefault(opIndex);
+    }
+
+    void generatePatternCharacterGreedy(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+        UChar32 ch = term->patternCharacter;
+
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+
+        move(TrustedImm32(0), countRegister);
+
+        // Unless have a 16 bit pattern character and an 8 bit string - short circuit
+        if (!((ch > 0xff) && (m_charSize == Char8))) {
+            JumpList failures;
+            Label loop(this);
+            failures.append(atEndOfInput());
+            failures.append(jumpIfCharNotEquals(ch, m_checkedOffset - term->inputPosition, character));
+
+            add32(TrustedImm32(1), countRegister);
+            add32(TrustedImm32(1), index);
+            if (term->quantityMaxCount == quantifyInfinite)
+                jump(loop);
+            else
+                branch32(NotEqual, countRegister, Imm32(term->quantityMaxCount.unsafeGet())).linkTo(loop, this);
+
+            failures.link(this);
+        }
+        op.m_reentry = label();
+
+        storeToFrame(countRegister, term->frameLocation);
+    }
+    void backtrackPatternCharacterGreedy(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID countRegister = regT1;
+
+        m_backtrackingState.link(this);
+
+        loadFromFrame(term->frameLocation, countRegister);
+        m_backtrackingState.append(branchTest32(Zero, countRegister));
+        sub32(TrustedImm32(1), countRegister);
+        sub32(TrustedImm32(1), index);
+        jump(op.m_reentry);
+    }
+
+    void generatePatternCharacterNonGreedy(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID countRegister = regT1;
+
+        move(TrustedImm32(0), countRegister);
+        op.m_reentry = label();
+        storeToFrame(countRegister, term->frameLocation);
+    }
+    void backtrackPatternCharacterNonGreedy(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+        UChar32 ch = term->patternCharacter;
+
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+
+        m_backtrackingState.link(this);
+
+        loadFromFrame(term->frameLocation, countRegister);
+
+        // Unless have a 16 bit pattern character and an 8 bit string - short circuit
+        if (!((ch > 0xff) && (m_charSize == Char8))) {
+            JumpList nonGreedyFailures;
+            nonGreedyFailures.append(atEndOfInput());
+            if (term->quantityMaxCount != quantifyInfinite)
+                nonGreedyFailures.append(branch32(Equal, countRegister, Imm32(term->quantityMaxCount.unsafeGet())));
+            nonGreedyFailures.append(jumpIfCharNotEquals(ch, m_checkedOffset - term->inputPosition, character));
+
+            add32(TrustedImm32(1), countRegister);
+            add32(TrustedImm32(1), index);
+
+            jump(op.m_reentry);
+            nonGreedyFailures.link(this);
+        }
+
+        sub32(countRegister, index);
+        m_backtrackingState.fallthrough();
+    }
+
+    void generateCharacterClassOnce(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID character = regT0;
+
+        JumpList matchDest;
+        readCharacter(m_checkedOffset - term->inputPosition, character);
+        matchCharacterClass(character, matchDest, term->characterClass);
+
+        if (term->invert())
+            op.m_jumps.append(matchDest);
+        else {
+            op.m_jumps.append(jump());
+            matchDest.link(this);
+        }
+    }
+    void backtrackCharacterClassOnce(size_t opIndex)
+    {
+        backtrackTermDefault(opIndex);
+    }
+
+    void generateCharacterClassFixed(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+
+        move(index, countRegister);
+        sub32(Imm32(term->quantityMaxCount.unsafeGet()), countRegister);
+
+        Label loop(this);
+        JumpList matchDest;
+        readCharacter(m_checkedOffset - term->inputPosition - term->quantityMaxCount, character, countRegister);
+        matchCharacterClass(character, matchDest, term->characterClass);
+
+        if (term->invert())
+            op.m_jumps.append(matchDest);
+        else {
+            op.m_jumps.append(jump());
+            matchDest.link(this);
+        }
+
+        add32(TrustedImm32(1), countRegister);
+        branch32(NotEqual, countRegister, index).linkTo(loop, this);
+    }
+    void backtrackCharacterClassFixed(size_t opIndex)
+    {
+        backtrackTermDefault(opIndex);
+    }
+
+    void generateCharacterClassGreedy(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+
+        move(TrustedImm32(0), countRegister);
+
+        JumpList failures;
+        Label loop(this);
+        failures.append(atEndOfInput());
+
+        if (term->invert()) {
+            readCharacter(m_checkedOffset - term->inputPosition, character);
+            matchCharacterClass(character, failures, term->characterClass);
+        } else {
+            JumpList matchDest;
+            readCharacter(m_checkedOffset - term->inputPosition, character);
+            matchCharacterClass(character, matchDest, term->characterClass);
+            failures.append(jump());
+            matchDest.link(this);
+        }
+
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
+        if (term->quantityMaxCount != quantifyInfinite) {
+            branch32(NotEqual, countRegister, Imm32(term->quantityMaxCount.unsafeGet())).linkTo(loop, this);
+            failures.append(jump());
+        } else
+            jump(loop);
+
+        failures.link(this);
+        op.m_reentry = label();
+
+        storeToFrame(countRegister, term->frameLocation);
+    }
+    void backtrackCharacterClassGreedy(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID countRegister = regT1;
+
+        m_backtrackingState.link(this);
+
+        loadFromFrame(term->frameLocation, countRegister);
+        m_backtrackingState.append(branchTest32(Zero, countRegister));
+        sub32(TrustedImm32(1), countRegister);
+        sub32(TrustedImm32(1), index);
+        jump(op.m_reentry);
+    }
+
+    void generateCharacterClassNonGreedy(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID countRegister = regT1;
+
+        move(TrustedImm32(0), countRegister);
+        op.m_reentry = label();
+        storeToFrame(countRegister, term->frameLocation);
+    }
+    void backtrackCharacterClassNonGreedy(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+
+        JumpList nonGreedyFailures;
+
+        m_backtrackingState.link(this);
+
+        loadFromFrame(term->frameLocation, countRegister);
+
+        nonGreedyFailures.append(atEndOfInput());
+        nonGreedyFailures.append(branch32(Equal, countRegister, Imm32(term->quantityMaxCount.unsafeGet())));
+
+        JumpList matchDest;
+        readCharacter(m_checkedOffset - term->inputPosition, character);
+        matchCharacterClass(character, matchDest, term->characterClass);
+
+        if (term->invert())
+            nonGreedyFailures.append(matchDest);
+        else {
+            nonGreedyFailures.append(jump());
+            matchDest.link(this);
+        }
+
+        add32(TrustedImm32(1), countRegister);
+        add32(TrustedImm32(1), index);
+
+        jump(op.m_reentry);
+
+        nonGreedyFailures.link(this);
+        sub32(countRegister, index);
+        m_backtrackingState.fallthrough();
+    }
+
+    void generateDotStarEnclosure(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        const RegisterID character = regT0;
+        const RegisterID matchPos = regT1;
+
+        JumpList foundBeginningNewLine;
+        JumpList saveStartIndex;
+        JumpList foundEndingNewLine;
+
+        ASSERT(!m_pattern.m_body->m_hasFixedSize);
+        getMatchStart(matchPos);
+
+        saveStartIndex.append(branchTest32(Zero, matchPos));
+        Label findBOLLoop(this);
+        sub32(TrustedImm32(1), matchPos);
+        if (m_charSize == Char8)
+            load8(BaseIndex(input, matchPos, TimesOne, 0), character);
+        else
+            load16(BaseIndex(input, matchPos, TimesTwo, 0), character);
+        matchCharacterClass(character, foundBeginningNewLine, m_pattern.newlineCharacterClass());
+        branchTest32(NonZero, matchPos).linkTo(findBOLLoop, this);
+        saveStartIndex.append(jump());
+
+        foundBeginningNewLine.link(this);
+        add32(TrustedImm32(1), matchPos); // Advance past newline
+        saveStartIndex.link(this);
+
+        if (!m_pattern.multiline() && term->anchors.bolAnchor)
+            op.m_jumps.append(branchTest32(NonZero, matchPos));
+
+        ASSERT(!m_pattern.m_body->m_hasFixedSize);
+        setMatchStart(matchPos);
+
+        move(index, matchPos);
+
+        Label findEOLLoop(this);        
+        foundEndingNewLine.append(branch32(Equal, matchPos, length));
+        if (m_charSize == Char8)
+            load8(BaseIndex(input, matchPos, TimesOne, 0), character);
+        else
+            load16(BaseIndex(input, matchPos, TimesTwo, 0), character);
+        matchCharacterClass(character, foundEndingNewLine, m_pattern.newlineCharacterClass());
+        add32(TrustedImm32(1), matchPos);
+        jump(findEOLLoop);
+
+        foundEndingNewLine.link(this);
+
+        if (!m_pattern.multiline() && term->anchors.eolAnchor)
+            op.m_jumps.append(branch32(NotEqual, matchPos, length));
+
+        move(matchPos, index);
+    }
+
+    void backtrackDotStarEnclosure(size_t opIndex)
+    {
+        backtrackTermDefault(opIndex);
+    }
+    
+    // Code generation/backtracking for simple terms
+    // (pattern characters, character classes, and assertions).
+    // These methods farm out work to the set of functions above.
+    void generateTerm(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        switch (term->type) {
+        case PatternTerm::TypePatternCharacter:
+            switch (term->quantityType) {
+            case QuantifierFixedCount:
+                if (term->quantityMaxCount == 1)
+                    generatePatternCharacterOnce(opIndex);
+                else
+                    generatePatternCharacterFixed(opIndex);
+                break;
+            case QuantifierGreedy:
+                generatePatternCharacterGreedy(opIndex);
+                break;
+            case QuantifierNonGreedy:
+                generatePatternCharacterNonGreedy(opIndex);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeCharacterClass:
+            switch (term->quantityType) {
+            case QuantifierFixedCount:
+                if (term->quantityMaxCount == 1)
+                    generateCharacterClassOnce(opIndex);
+                else
+                    generateCharacterClassFixed(opIndex);
+                break;
+            case QuantifierGreedy:
+                generateCharacterClassGreedy(opIndex);
+                break;
+            case QuantifierNonGreedy:
+                generateCharacterClassNonGreedy(opIndex);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeAssertionBOL:
+            generateAssertionBOL(opIndex);
+            break;
+
+        case PatternTerm::TypeAssertionEOL:
+            generateAssertionEOL(opIndex);
+            break;
+
+        case PatternTerm::TypeAssertionWordBoundary:
+            generateAssertionWordBoundary(opIndex);
+            break;
+
+        case PatternTerm::TypeForwardReference:
+            break;
+
+        case PatternTerm::TypeParenthesesSubpattern:
+        case PatternTerm::TypeParentheticalAssertion:
+            RELEASE_ASSERT_NOT_REACHED();
+        case PatternTerm::TypeBackReference:
+            m_shouldFallBack = true;
+            break;
+        case PatternTerm::TypeDotStarEnclosure:
+            generateDotStarEnclosure(opIndex);
+            break;
+        }
+    }
+    void backtrackTerm(size_t opIndex)
+    {
+        YarrOp& op = m_ops[opIndex];
+        PatternTerm* term = op.m_term;
+
+        switch (term->type) {
+        case PatternTerm::TypePatternCharacter:
+            switch (term->quantityType) {
+            case QuantifierFixedCount:
+                if (term->quantityMaxCount == 1)
+                    backtrackPatternCharacterOnce(opIndex);
+                else
+                    backtrackPatternCharacterFixed(opIndex);
+                break;
+            case QuantifierGreedy:
+                backtrackPatternCharacterGreedy(opIndex);
+                break;
+            case QuantifierNonGreedy:
+                backtrackPatternCharacterNonGreedy(opIndex);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeCharacterClass:
+            switch (term->quantityType) {
+            case QuantifierFixedCount:
+                if (term->quantityMaxCount == 1)
+                    backtrackCharacterClassOnce(opIndex);
+                else
+                    backtrackCharacterClassFixed(opIndex);
+                break;
+            case QuantifierGreedy:
+                backtrackCharacterClassGreedy(opIndex);
+                break;
+            case QuantifierNonGreedy:
+                backtrackCharacterClassNonGreedy(opIndex);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeAssertionBOL:
+            backtrackAssertionBOL(opIndex);
+            break;
+
+        case PatternTerm::TypeAssertionEOL:
+            backtrackAssertionEOL(opIndex);
+            break;
+
+        case PatternTerm::TypeAssertionWordBoundary:
+            backtrackAssertionWordBoundary(opIndex);
+            break;
+
+        case PatternTerm::TypeForwardReference:
+            break;
+
+        case PatternTerm::TypeParenthesesSubpattern:
+        case PatternTerm::TypeParentheticalAssertion:
+            RELEASE_ASSERT_NOT_REACHED();
+
+        case PatternTerm::TypeDotStarEnclosure:
+            backtrackDotStarEnclosure(opIndex);
+            break;
+
+        case PatternTerm::TypeBackReference:
+            m_shouldFallBack = true;
+            break;
+        }
+    }
+
+    void generate()
+    {
+        // Forwards generate the matching code.
+        ASSERT(m_ops.size());
+        size_t opIndex = 0;
+
+        do {
+            YarrOp& op = m_ops[opIndex];
+            switch (op.m_op) {
+
+            case OpTerm:
+                generateTerm(opIndex);
+                break;
+
+            // OpBodyAlternativeBegin/Next/End
+            //
+            // These nodes wrap the set of alternatives in the body of the regular expression.
+            // There may be either one or two chains of OpBodyAlternative nodes, one representing
+            // the 'once through' sequence of alternatives (if any exist), and one representing
+            // the repeating alternatives (again, if any exist).
+            //
+            // Upon normal entry to the Begin alternative, we will check that input is available.
+            // Reentry to the Begin alternative will take place after the check has taken place,
+            // and will assume that the input position has already been progressed as appropriate.
+            //
+            // Entry to subsequent Next/End alternatives occurs when the prior alternative has
+            // successfully completed a match - return a success state from JIT code.
+            //
+            // Next alternatives allow for reentry optimized to suit backtracking from its
+            // preceding alternative. It expects the input position to still be set to a position
+            // appropriate to its predecessor, and it will only perform an input check if the
+            // predecessor had a minimum size less than its own.
+            //
+            // In the case 'once through' expressions, the End node will also have a reentry
+            // point to jump to when the last alternative fails. Again, this expects the input
+            // position to still reflect that expected by the prior alternative.
+            case OpBodyAlternativeBegin: {
+                PatternAlternative* alternative = op.m_alternative;
+
+                // Upon entry at the head of the set of alternatives, check if input is available
+                // to run the first alternative. (This progresses the input position).
+                op.m_jumps.append(jumpIfNoAvailableInput(alternative->m_minimumSize));
+                // We will reenter after the check, and assume the input position to have been
+                // set as appropriate to this alternative.
+                op.m_reentry = label();
+
+                m_checkedOffset += alternative->m_minimumSize;
+                break;
+            }
+            case OpBodyAlternativeNext:
+            case OpBodyAlternativeEnd: {
+                PatternAlternative* priorAlternative = m_ops[op.m_previousOp].m_alternative;
+                PatternAlternative* alternative = op.m_alternative;
+
+                // If we get here, the prior alternative matched - return success.
+                
+                // Adjust the stack pointer to remove the pattern's frame.
+                removeCallFrame();
+
+                // Load appropriate values into the return register and the first output
+                // slot, and return. In the case of pattern with a fixed size, we will
+                // not have yet set the value in the first 
+                ASSERT(index != returnRegister);
+                if (m_pattern.m_body->m_hasFixedSize) {
+                    move(index, returnRegister);
+                    if (priorAlternative->m_minimumSize)
+                        sub32(Imm32(priorAlternative->m_minimumSize), returnRegister);
+                    if (compileMode == IncludeSubpatterns)
+                        store32(returnRegister, output);
+                } else
+                    getMatchStart(returnRegister);
+                if (compileMode == IncludeSubpatterns)
+                    store32(index, Address(output, 4));
+                move(index, returnRegister2);
+
+                generateReturn();
+
+                // This is the divide between the tail of the prior alternative, above, and
+                // the head of the subsequent alternative, below.
+
+                if (op.m_op == OpBodyAlternativeNext) {
+                    // This is the reentry point for the Next alternative. We expect any code
+                    // that jumps here to do so with the input position matching that of the
+                    // PRIOR alteranative, and we will only check input availability if we
+                    // need to progress it forwards.
+                    op.m_reentry = label();
+                    if (alternative->m_minimumSize > priorAlternative->m_minimumSize) {
+                        add32(Imm32(alternative->m_minimumSize - priorAlternative->m_minimumSize), index);
+                        op.m_jumps.append(jumpIfNoAvailableInput());
+                    } else if (priorAlternative->m_minimumSize > alternative->m_minimumSize)
+                        sub32(Imm32(priorAlternative->m_minimumSize - alternative->m_minimumSize), index);
+                } else if (op.m_nextOp == notFound) {
+                    // This is the reentry point for the End of 'once through' alternatives,
+                    // jumped to when the last alternative fails to match.
+                    op.m_reentry = label();
+                    sub32(Imm32(priorAlternative->m_minimumSize), index);
+                }
+
+                if (op.m_op == OpBodyAlternativeNext)
+                    m_checkedOffset += alternative->m_minimumSize;
+                m_checkedOffset -= priorAlternative->m_minimumSize;
+                break;
+            }
+
+            // OpSimpleNestedAlternativeBegin/Next/End
+            // OpNestedAlternativeBegin/Next/End
+            //
+            // These nodes are used to handle sets of alternatives that are nested within
+            // subpatterns and parenthetical assertions. The 'simple' forms are used where
+            // we do not need to be able to backtrack back into any alternative other than
+            // the last, the normal forms allow backtracking into any alternative.
+            //
+            // Each Begin/Next node is responsible for planting an input check to ensure
+            // sufficient input is available on entry. Next nodes additionally need to
+            // jump to the end - Next nodes use the End node's m_jumps list to hold this
+            // set of jumps.
+            //
+            // In the non-simple forms, successful alternative matches must store a
+            // 'return address' using a DataLabelPtr, used to store the address to jump
+            // to when backtracking, to get to the code for the appropriate alternative.
+            case OpSimpleNestedAlternativeBegin:
+            case OpNestedAlternativeBegin: {
+                PatternTerm* term = op.m_term;
+                PatternAlternative* alternative = op.m_alternative;
+                PatternDisjunction* disjunction = term->parentheses.disjunction;
+
+                // Calculate how much input we need to check for, and if non-zero check.
+                op.m_checkAdjust = Checked<unsigned>(alternative->m_minimumSize);
+                if ((term->quantityType == QuantifierFixedCount) && (term->type != PatternTerm::TypeParentheticalAssertion))
+                    op.m_checkAdjust -= disjunction->m_minimumSize;
+                if (op.m_checkAdjust)
+                    op.m_jumps.append(jumpIfNoAvailableInput(op.m_checkAdjust.unsafeGet()));
+
+                m_checkedOffset += op.m_checkAdjust;
+                break;
+            }
+            case OpSimpleNestedAlternativeNext:
+            case OpNestedAlternativeNext: {
+                PatternTerm* term = op.m_term;
+                PatternAlternative* alternative = op.m_alternative;
+                PatternDisjunction* disjunction = term->parentheses.disjunction;
+
+                // In the non-simple case, store a 'return address' so we can backtrack correctly.
+                if (op.m_op == OpNestedAlternativeNext) {
+                    unsigned parenthesesFrameLocation = term->frameLocation;
+                    unsigned alternativeFrameLocation = parenthesesFrameLocation;
+                    if (term->quantityType != QuantifierFixedCount)
+                        alternativeFrameLocation += YarrStackSpaceForBackTrackInfoParenthesesOnce;
+                    op.m_returnAddress = storeToFrameWithPatch(alternativeFrameLocation);
+                }
+
+                if (term->quantityType != QuantifierFixedCount && !m_ops[op.m_previousOp].m_alternative->m_minimumSize) {
+                    // If the previous alternative matched without consuming characters then
+                    // backtrack to try to match while consumming some input.
+                    op.m_zeroLengthMatch = branch32(Equal, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
+                }
+
+                // If we reach here then the last alternative has matched - jump to the
+                // End node, to skip over any further alternatives.
+                //
+                // FIXME: this is logically O(N^2) (though N can be expected to be very
+                // small). We could avoid this either by adding an extra jump to the JIT
+                // data structures, or by making backtracking code that jumps to Next
+                // alternatives are responsible for checking that input is available (if
+                // we didn't need to plant the input checks, then m_jumps would be free).
+                YarrOp* endOp = &m_ops[op.m_nextOp];
+                while (endOp->m_nextOp != notFound) {
+                    ASSERT(endOp->m_op == OpSimpleNestedAlternativeNext || endOp->m_op == OpNestedAlternativeNext);
+                    endOp = &m_ops[endOp->m_nextOp];
+                }
+                ASSERT(endOp->m_op == OpSimpleNestedAlternativeEnd || endOp->m_op == OpNestedAlternativeEnd);
+                endOp->m_jumps.append(jump());
+
+                // This is the entry point for the next alternative.
+                op.m_reentry = label();
+
+                // Calculate how much input we need to check for, and if non-zero check.
+                op.m_checkAdjust = alternative->m_minimumSize;
+                if ((term->quantityType == QuantifierFixedCount) && (term->type != PatternTerm::TypeParentheticalAssertion))
+                    op.m_checkAdjust -= disjunction->m_minimumSize;
+                if (op.m_checkAdjust)
+                    op.m_jumps.append(jumpIfNoAvailableInput(op.m_checkAdjust.unsafeGet()));
+
+                YarrOp& lastOp = m_ops[op.m_previousOp];
+                m_checkedOffset -= lastOp.m_checkAdjust;
+                m_checkedOffset += op.m_checkAdjust;
+                break;
+            }
+            case OpSimpleNestedAlternativeEnd:
+            case OpNestedAlternativeEnd: {
+                PatternTerm* term = op.m_term;
+
+                // In the non-simple case, store a 'return address' so we can backtrack correctly.
+                if (op.m_op == OpNestedAlternativeEnd) {
+                    unsigned parenthesesFrameLocation = term->frameLocation;
+                    unsigned alternativeFrameLocation = parenthesesFrameLocation;
+                    if (term->quantityType != QuantifierFixedCount)
+                        alternativeFrameLocation += YarrStackSpaceForBackTrackInfoParenthesesOnce;
+                    op.m_returnAddress = storeToFrameWithPatch(alternativeFrameLocation);
+                }
+
+                if (term->quantityType != QuantifierFixedCount && !m_ops[op.m_previousOp].m_alternative->m_minimumSize) {
+                    // If the previous alternative matched without consuming characters then
+                    // backtrack to try to match while consumming some input.
+                    op.m_zeroLengthMatch = branch32(Equal, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
+                }
+
+                // If this set of alternatives contains more than one alternative,
+                // then the Next nodes will have planted jumps to the End, and added
+                // them to this node's m_jumps list.
+                op.m_jumps.link(this);
+                op.m_jumps.clear();
+
+                YarrOp& lastOp = m_ops[op.m_previousOp];
+                m_checkedOffset -= lastOp.m_checkAdjust;
+                break;
+            }
+
+            // OpParenthesesSubpatternOnceBegin/End
+            //
+            // These nodes support (optionally) capturing subpatterns, that have a
+            // quantity count of 1 (this covers fixed once, and ?/?? quantifiers). 
+            case OpParenthesesSubpatternOnceBegin: {
+                PatternTerm* term = op.m_term;
+                unsigned parenthesesFrameLocation = term->frameLocation;
+                const RegisterID indexTemporary = regT0;
+                ASSERT(term->quantityMaxCount == 1);
+
+                // Upon entry to a Greedy quantified set of parenthese store the index.
+                // We'll use this for two purposes:
+                //  - To indicate which iteration we are on of mathing the remainder of
+                //    the expression after the parentheses - the first, including the
+                //    match within the parentheses, or the second having skipped over them.
+                //  - To check for empty matches, which must be rejected.
+                //
+                // At the head of a NonGreedy set of parentheses we'll immediately set the
+                // value on the stack to -1 (indicating a match skipping the subpattern),
+                // and plant a jump to the end. We'll also plant a label to backtrack to
+                // to reenter the subpattern later, with a store to set up index on the
+                // second iteration.
+                //
+                // FIXME: for capturing parens, could use the index in the capture array?
+                if (term->quantityType == QuantifierGreedy)
+                    storeToFrame(index, parenthesesFrameLocation);
+                else if (term->quantityType == QuantifierNonGreedy) {
+                    storeToFrame(TrustedImm32(-1), parenthesesFrameLocation);
+                    op.m_jumps.append(jump());
+                    op.m_reentry = label();
+                    storeToFrame(index, parenthesesFrameLocation);
+                }
+
+                // If the parenthese are capturing, store the starting index value to the
+                // captures array, offsetting as necessary.
+                //
+                // FIXME: could avoid offsetting this value in JIT code, apply
+                // offsets only afterwards, at the point the results array is
+                // being accessed.
+                if (term->capture() && compileMode == IncludeSubpatterns) {
+                    unsigned inputOffset = (m_checkedOffset - term->inputPosition).unsafeGet();
+                    if (term->quantityType == QuantifierFixedCount)
+                        inputOffset += term->parentheses.disjunction->m_minimumSize;
+                    if (inputOffset) {
+                        move(index, indexTemporary);
+                        sub32(Imm32(inputOffset), indexTemporary);
+                        setSubpatternStart(indexTemporary, term->parentheses.subpatternId);
+                    } else
+                        setSubpatternStart(index, term->parentheses.subpatternId);
+                }
+                break;
+            }
+            case OpParenthesesSubpatternOnceEnd: {
+                PatternTerm* term = op.m_term;
+                const RegisterID indexTemporary = regT0;
+                ASSERT(term->quantityMaxCount == 1);
+
+                // Runtime ASSERT to make sure that the nested alternative handled the
+                // "no input consumed" check.
+                if (!ASSERT_DISABLED && term->quantityType != QuantifierFixedCount && !term->parentheses.disjunction->m_minimumSize) {
+                    Jump pastBreakpoint;
+                    pastBreakpoint = branch32(NotEqual, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
+                    abortWithReason(YARRNoInputConsumed);
+                    pastBreakpoint.link(this);
+                }
+
+                // If the parenthese are capturing, store the ending index value to the
+                // captures array, offsetting as necessary.
+                //
+                // FIXME: could avoid offsetting this value in JIT code, apply
+                // offsets only afterwards, at the point the results array is
+                // being accessed.
+                if (term->capture() && compileMode == IncludeSubpatterns) {
+                    unsigned inputOffset = (m_checkedOffset - term->inputPosition).unsafeGet();
+                    if (inputOffset) {
+                        move(index, indexTemporary);
+                        sub32(Imm32(inputOffset), indexTemporary);
+                        setSubpatternEnd(indexTemporary, term->parentheses.subpatternId);
+                    } else
+                        setSubpatternEnd(index, term->parentheses.subpatternId);
+                }
+
+                // If the parentheses are quantified Greedy then add a label to jump back
+                // to if get a failed match from after the parentheses. For NonGreedy
+                // parentheses, link the jump from before the subpattern to here.
+                if (term->quantityType == QuantifierGreedy)
+                    op.m_reentry = label();
+                else if (term->quantityType == QuantifierNonGreedy) {
+                    YarrOp& beginOp = m_ops[op.m_previousOp];
+                    beginOp.m_jumps.link(this);
+                }
+                break;
+            }
+
+            // OpParenthesesSubpatternTerminalBegin/End
+            case OpParenthesesSubpatternTerminalBegin: {
+                PatternTerm* term = op.m_term;
+                ASSERT(term->quantityType == QuantifierGreedy);
+                ASSERT(term->quantityMaxCount == quantifyInfinite);
+                ASSERT(!term->capture());
+
+                // Upon entry set a label to loop back to.
+                op.m_reentry = label();
+
+                // Store the start index of the current match; we need to reject zero
+                // length matches.
+                storeToFrame(index, term->frameLocation);
+                break;
+            }
+            case OpParenthesesSubpatternTerminalEnd: {
+                YarrOp& beginOp = m_ops[op.m_previousOp];
+                if (!ASSERT_DISABLED) {
+                    PatternTerm* term = op.m_term;
+                    
+                    // Runtime ASSERT to make sure that the nested alternative handled the
+                    // "no input consumed" check.
+                    Jump pastBreakpoint;
+                    pastBreakpoint = branch32(NotEqual, index, Address(stackPointerRegister, term->frameLocation * sizeof(void*)));
+                    abortWithReason(YARRNoInputConsumed);
+                    pastBreakpoint.link(this);
+                }
+
+                // We know that the match is non-zero, we can accept it  and
+                // loop back up to the head of the subpattern.
+                jump(beginOp.m_reentry);
+
+                // This is the entry point to jump to when we stop matching - we will
+                // do so once the subpattern cannot match any more.
+                op.m_reentry = label();
+                break;
+            }
+
+            // OpParentheticalAssertionBegin/End
+            case OpParentheticalAssertionBegin: {
+                PatternTerm* term = op.m_term;
+
+                // Store the current index - assertions should not update index, so
+                // we will need to restore it upon a successful match.
+                unsigned parenthesesFrameLocation = term->frameLocation;
+                storeToFrame(index, parenthesesFrameLocation);
+
+                // Check 
+                op.m_checkAdjust = m_checkedOffset - term->inputPosition;
+                if (op.m_checkAdjust)
+                    sub32(Imm32(op.m_checkAdjust.unsafeGet()), index);
+
+                m_checkedOffset -= op.m_checkAdjust;
+                break;
+            }
+            case OpParentheticalAssertionEnd: {
+                PatternTerm* term = op.m_term;
+
+                // Restore the input index value.
+                unsigned parenthesesFrameLocation = term->frameLocation;
+                loadFromFrame(parenthesesFrameLocation, index);
+
+                // If inverted, a successful match of the assertion must be treated
+                // as a failure, so jump to backtracking.
+                if (term->invert()) {
+                    op.m_jumps.append(jump());
+                    op.m_reentry = label();
+                }
+
+                YarrOp& lastOp = m_ops[op.m_previousOp];
+                m_checkedOffset += lastOp.m_checkAdjust;
+                break;
+            }
+
+            case OpMatchFailed:
+                removeCallFrame();
+                generateFailReturn();
+                break;
+            }
+
+            ++opIndex;
+        } while (opIndex < m_ops.size());
+    }
+
+    void backtrack()
+    {
+        // Backwards generate the backtracking code.
+        size_t opIndex = m_ops.size();
+        ASSERT(opIndex);
+
+        do {
+            --opIndex;
+            YarrOp& op = m_ops[opIndex];
+            switch (op.m_op) {
+
+            case OpTerm:
+                backtrackTerm(opIndex);
+                break;
+
+            // OpBodyAlternativeBegin/Next/End
+            //
+            // For each Begin/Next node representing an alternative, we need to decide what to do
+            // in two circumstances:
+            //  - If we backtrack back into this node, from within the alternative.
+            //  - If the input check at the head of the alternative fails (if this exists).
+            //
+            // We treat these two cases differently since in the former case we have slightly
+            // more information - since we are backtracking out of a prior alternative we know
+            // that at least enough input was available to run it. For example, given the regular
+            // expression /a|b/, if we backtrack out of the first alternative (a failed pattern
+            // character match of 'a'), then we need not perform an additional input availability
+            // check before running the second alternative.
+            //
+            // Backtracking required differs for the last alternative, which in the case of the
+            // repeating set of alternatives must loop. The code generated for the last alternative
+            // will also be used to handle all input check failures from any prior alternatives -
+            // these require similar functionality, in seeking the next available alternative for
+            // which there is sufficient input.
+            //
+            // Since backtracking of all other alternatives simply requires us to link backtracks
+            // to the reentry point for the subsequent alternative, we will only be generating any
+            // code when backtracking the last alternative.
+            case OpBodyAlternativeBegin:
+            case OpBodyAlternativeNext: {
+                PatternAlternative* alternative = op.m_alternative;
+
+                if (op.m_op == OpBodyAlternativeNext) {
+                    PatternAlternative* priorAlternative = m_ops[op.m_previousOp].m_alternative;
+                    m_checkedOffset += priorAlternative->m_minimumSize;
+                }
+                m_checkedOffset -= alternative->m_minimumSize;
+
+                // Is this the last alternative? If not, then if we backtrack to this point we just
+                // need to jump to try to match the next alternative.
+                if (m_ops[op.m_nextOp].m_op != OpBodyAlternativeEnd) {
+                    m_backtrackingState.linkTo(m_ops[op.m_nextOp].m_reentry, this);
+                    break;
+                }
+                YarrOp& endOp = m_ops[op.m_nextOp];
+
+                YarrOp* beginOp = &op;
+                while (beginOp->m_op != OpBodyAlternativeBegin) {
+                    ASSERT(beginOp->m_op == OpBodyAlternativeNext);
+                    beginOp = &m_ops[beginOp->m_previousOp];
+                }
+
+                bool onceThrough = endOp.m_nextOp == notFound;
+                
+                JumpList lastStickyAlternativeFailures;
+
+                // First, generate code to handle cases where we backtrack out of an attempted match
+                // of the last alternative. If this is a 'once through' set of alternatives then we
+                // have nothing to do - link this straight through to the End.
+                if (onceThrough)
+                    m_backtrackingState.linkTo(endOp.m_reentry, this);
+                else {
+                    // If we don't need to move the input poistion, and the pattern has a fixed size
+                    // (in which case we omit the store of the start index until the pattern has matched)
+                    // then we can just link the backtrack out of the last alternative straight to the
+                    // head of the first alternative.
+                    if (m_pattern.m_body->m_hasFixedSize
+                        && (alternative->m_minimumSize > beginOp->m_alternative->m_minimumSize)
+                        && (alternative->m_minimumSize - beginOp->m_alternative->m_minimumSize == 1))
+                        m_backtrackingState.linkTo(beginOp->m_reentry, this);
+                    else if (m_pattern.sticky() && m_ops[op.m_nextOp].m_op == OpBodyAlternativeEnd) {
+                        // It is a sticky pattern and the last alternative failed, jump to the end.
+                        m_backtrackingState.takeBacktracksToJumpList(lastStickyAlternativeFailures, this);
+                    } else {
+                        // We need to generate a trampoline of code to execute before looping back
+                        // around to the first alternative.
+                        m_backtrackingState.link(this);
+
+                        // No need to advance and retry for a sticky pattern.
+                        if (!m_pattern.sticky()) {
+                            // If the pattern size is not fixed, then store the start index for use if we match.
+                            if (!m_pattern.m_body->m_hasFixedSize) {
+                                if (alternative->m_minimumSize == 1)
+                                    setMatchStart(index);
+                                else {
+                                    move(index, regT0);
+                                    if (alternative->m_minimumSize)
+                                        sub32(Imm32(alternative->m_minimumSize - 1), regT0);
+                                    else
+                                        add32(TrustedImm32(1), regT0);
+                                    setMatchStart(regT0);
+                                }
+                            }
+
+                            // Generate code to loop. Check whether the last alternative is longer than the
+                            // first (e.g. /a|xy/ or /a|xyz/).
+                            if (alternative->m_minimumSize > beginOp->m_alternative->m_minimumSize) {
+                                // We want to loop, and increment input position. If the delta is 1, it is
+                                // already correctly incremented, if more than one then decrement as appropriate.
+                                unsigned delta = alternative->m_minimumSize - beginOp->m_alternative->m_minimumSize;
+                                ASSERT(delta);
+                                if (delta != 1)
+                                    sub32(Imm32(delta - 1), index);
+                                jump(beginOp->m_reentry);
+                            } else {
+                                // If the first alternative has minimum size 0xFFFFFFFFu, then there cannot
+                                // be sufficent input available to handle this, so just fall through.
+                                unsigned delta = beginOp->m_alternative->m_minimumSize - alternative->m_minimumSize;
+                                if (delta != 0xFFFFFFFFu) {
+                                    // We need to check input because we are incrementing the input.
+                                    add32(Imm32(delta + 1), index);
+                                    checkInput().linkTo(beginOp->m_reentry, this);
+                                }
+                            }
+                        }
+                    }
+                }
+
+                // We can reach this point in the code in two ways:
+                //  - Fallthrough from the code above (a repeating alternative backtracked out of its
+                //    last alternative, and did not have sufficent input to run the first).
+                //  - We will loop back up to the following label when a repeating alternative loops,
+                //    following a failed input check.
+                //
+                // Either way, we have just failed the input check for the first alternative.
+                Label firstInputCheckFailed(this);
+
+                // Generate code to handle input check failures from alternatives except the last.
+                // prevOp is the alternative we're handling a bail out from (initially Begin), and
+                // nextOp is the alternative we will be attempting to reenter into.
+                // 
+                // We will link input check failures from the forwards matching path back to the code
+                // that can handle them.
+                YarrOp* prevOp = beginOp;
+                YarrOp* nextOp = &m_ops[beginOp->m_nextOp];
+                while (nextOp->m_op != OpBodyAlternativeEnd) {
+                    prevOp->m_jumps.link(this);
+
+                    // We only get here if an input check fails, it is only worth checking again
+                    // if the next alternative has a minimum size less than the last.
+                    if (prevOp->m_alternative->m_minimumSize > nextOp->m_alternative->m_minimumSize) {
+                        // FIXME: if we added an extra label to YarrOp, we could avoid needing to
+                        // subtract delta back out, and reduce this code. Should performance test
+                        // the benefit of this.
+                        unsigned delta = prevOp->m_alternative->m_minimumSize - nextOp->m_alternative->m_minimumSize;
+                        sub32(Imm32(delta), index);
+                        Jump fail = jumpIfNoAvailableInput();
+                        add32(Imm32(delta), index);
+                        jump(nextOp->m_reentry);
+                        fail.link(this);
+                    } else if (prevOp->m_alternative->m_minimumSize < nextOp->m_alternative->m_minimumSize)
+                        add32(Imm32(nextOp->m_alternative->m_minimumSize - prevOp->m_alternative->m_minimumSize), index);
+                    prevOp = nextOp;
+                    nextOp = &m_ops[nextOp->m_nextOp];
+                }
+
+                // We fall through to here if there is insufficient input to run the last alternative.
+
+                // If there is insufficient input to run the last alternative, then for 'once through'
+                // alternatives we are done - just jump back up into the forwards matching path at the End.
+                if (onceThrough) {
+                    op.m_jumps.linkTo(endOp.m_reentry, this);
+                    jump(endOp.m_reentry);
+                    break;
+                }
+
+                // For repeating alternatives, link any input check failure from the last alternative to
+                // this point.
+                op.m_jumps.link(this);
+
+                bool needsToUpdateMatchStart = !m_pattern.m_body->m_hasFixedSize;
+
+                // Check for cases where input position is already incremented by 1 for the last
+                // alternative (this is particularly useful where the minimum size of the body
+                // disjunction is 0, e.g. /a*|b/).
+                if (needsToUpdateMatchStart && alternative->m_minimumSize == 1) {
+                    // index is already incremented by 1, so just store it now!
+                    setMatchStart(index);
+                    needsToUpdateMatchStart = false;
+                }
+
+                if (!m_pattern.sticky()) {
+                    // Check whether there is sufficient input to loop. Increment the input position by
+                    // one, and check. Also add in the minimum disjunction size before checking - there
+                    // is no point in looping if we're just going to fail all the input checks around
+                    // the next iteration.
+                    ASSERT(alternative->m_minimumSize >= m_pattern.m_body->m_minimumSize);
+                    if (alternative->m_minimumSize == m_pattern.m_body->m_minimumSize) {
+                        // If the last alternative had the same minimum size as the disjunction,
+                        // just simply increment input pos by 1, no adjustment based on minimum size.
+                        add32(TrustedImm32(1), index);
+                    } else {
+                        // If the minumum for the last alternative was one greater than than that
+                        // for the disjunction, we're already progressed by 1, nothing to do!
+                        unsigned delta = (alternative->m_minimumSize - m_pattern.m_body->m_minimumSize) - 1;
+                        if (delta)
+                            sub32(Imm32(delta), index);
+                    }
+                    Jump matchFailed = jumpIfNoAvailableInput();
+
+                    if (needsToUpdateMatchStart) {
+                        if (!m_pattern.m_body->m_minimumSize)
+                            setMatchStart(index);
+                        else {
+                            move(index, regT0);
+                            sub32(Imm32(m_pattern.m_body->m_minimumSize), regT0);
+                            setMatchStart(regT0);
+                        }
+                    }
+
+                    // Calculate how much more input the first alternative requires than the minimum
+                    // for the body as a whole. If no more is needed then we dont need an additional
+                    // input check here - jump straight back up to the start of the first alternative.
+                    if (beginOp->m_alternative->m_minimumSize == m_pattern.m_body->m_minimumSize)
+                        jump(beginOp->m_reentry);
+                    else {
+                        if (beginOp->m_alternative->m_minimumSize > m_pattern.m_body->m_minimumSize)
+                            add32(Imm32(beginOp->m_alternative->m_minimumSize - m_pattern.m_body->m_minimumSize), index);
+                        else
+                            sub32(Imm32(m_pattern.m_body->m_minimumSize - beginOp->m_alternative->m_minimumSize), index);
+                        checkInput().linkTo(beginOp->m_reentry, this);
+                        jump(firstInputCheckFailed);
+                    }
+
+                    // We jump to here if we iterate to the point that there is insufficient input to
+                    // run any matches, and need to return a failure state from JIT code.
+                    matchFailed.link(this);
+                }
+
+                lastStickyAlternativeFailures.link(this);
+                removeCallFrame();
+                generateFailReturn();
+                break;
+            }
+            case OpBodyAlternativeEnd: {
+                // We should never backtrack back into a body disjunction.
+                ASSERT(m_backtrackingState.isEmpty());
+
+                PatternAlternative* priorAlternative = m_ops[op.m_previousOp].m_alternative;
+                m_checkedOffset += priorAlternative->m_minimumSize;
+                break;
+            }
+
+            // OpSimpleNestedAlternativeBegin/Next/End
+            // OpNestedAlternativeBegin/Next/End
+            //
+            // Generate code for when we backtrack back out of an alternative into
+            // a Begin or Next node, or when the entry input count check fails. If
+            // there are more alternatives we need to jump to the next alternative,
+            // if not we backtrack back out of the current set of parentheses.
+            //
+            // In the case of non-simple nested assertions we need to also link the
+            // 'return address' appropriately to backtrack back out into the correct
+            // alternative.
+            case OpSimpleNestedAlternativeBegin:
+            case OpSimpleNestedAlternativeNext:
+            case OpNestedAlternativeBegin:
+            case OpNestedAlternativeNext: {
+                YarrOp& nextOp = m_ops[op.m_nextOp];
+                bool isBegin = op.m_previousOp == notFound;
+                bool isLastAlternative = nextOp.m_nextOp == notFound;
+                ASSERT(isBegin == (op.m_op == OpSimpleNestedAlternativeBegin || op.m_op == OpNestedAlternativeBegin));
+                ASSERT(isLastAlternative == (nextOp.m_op == OpSimpleNestedAlternativeEnd || nextOp.m_op == OpNestedAlternativeEnd));
+
+                // Treat an input check failure the same as a failed match.
+                m_backtrackingState.append(op.m_jumps);
+
+                // Set the backtracks to jump to the appropriate place. We may need
+                // to link the backtracks in one of three different way depending on
+                // the type of alternative we are dealing with:
+                //  - A single alternative, with no simplings.
+                //  - The last alternative of a set of two or more.
+                //  - An alternative other than the last of a set of two or more.
+                //
+                // In the case of a single alternative on its own, we don't need to
+                // jump anywhere - if the alternative fails to match we can just
+                // continue to backtrack out of the parentheses without jumping.
+                //
+                // In the case of the last alternative in a set of more than one, we
+                // need to jump to return back out to the beginning. We'll do so by
+                // adding a jump to the End node's m_jumps list, and linking this
+                // when we come to generate the Begin node. For alternatives other
+                // than the last, we need to jump to the next alternative.
+                //
+                // If the alternative had adjusted the input position we must link
+                // backtracking to here, correct, and then jump on. If not we can
+                // link the backtracks directly to their destination.
+                if (op.m_checkAdjust) {
+                    // Handle the cases where we need to link the backtracks here.
+                    m_backtrackingState.link(this);
+                    sub32(Imm32(op.m_checkAdjust.unsafeGet()), index);
+                    if (!isLastAlternative) {
+                        // An alternative that is not the last should jump to its successor.
+                        jump(nextOp.m_reentry);
+                    } else if (!isBegin) {
+                        // The last of more than one alternatives must jump back to the beginning.
+                        nextOp.m_jumps.append(jump());
+                    } else {
+                        // A single alternative on its own can fall through.
+                        m_backtrackingState.fallthrough();
+                    }
+                } else {
+                    // Handle the cases where we can link the backtracks directly to their destinations.
+                    if (!isLastAlternative) {
+                        // An alternative that is not the last should jump to its successor.
+                        m_backtrackingState.linkTo(nextOp.m_reentry, this);
+                    } else if (!isBegin) {
+                        // The last of more than one alternatives must jump back to the beginning.
+                        m_backtrackingState.takeBacktracksToJumpList(nextOp.m_jumps, this);
+                    }
+                    // In the case of a single alternative on its own do nothing - it can fall through.
+                }
+
+                // If there is a backtrack jump from a zero length match link it here.
+                if (op.m_zeroLengthMatch.isSet())
+                    m_backtrackingState.append(op.m_zeroLengthMatch);
+
+                // At this point we've handled the backtracking back into this node.
+                // Now link any backtracks that need to jump to here.
+
+                // For non-simple alternatives, link the alternative's 'return address'
+                // so that we backtrack back out into the previous alternative.
+                if (op.m_op == OpNestedAlternativeNext)
+                    m_backtrackingState.append(op.m_returnAddress);
+
+                // If there is more than one alternative, then the last alternative will
+                // have planted a jump to be linked to the end. This jump was added to the
+                // End node's m_jumps list. If we are back at the beginning, link it here.
+                if (isBegin) {
+                    YarrOp* endOp = &m_ops[op.m_nextOp];
+                    while (endOp->m_nextOp != notFound) {
+                        ASSERT(endOp->m_op == OpSimpleNestedAlternativeNext || endOp->m_op == OpNestedAlternativeNext);
+                        endOp = &m_ops[endOp->m_nextOp];
+                    }
+                    ASSERT(endOp->m_op == OpSimpleNestedAlternativeEnd || endOp->m_op == OpNestedAlternativeEnd);
+                    m_backtrackingState.append(endOp->m_jumps);
+                }
+
+                if (!isBegin) {
+                    YarrOp& lastOp = m_ops[op.m_previousOp];
+                    m_checkedOffset += lastOp.m_checkAdjust;
+                }
+                m_checkedOffset -= op.m_checkAdjust;
+                break;
+            }
+            case OpSimpleNestedAlternativeEnd:
+            case OpNestedAlternativeEnd: {
+                PatternTerm* term = op.m_term;
+
+                // If there is a backtrack jump from a zero length match link it here.
+                if (op.m_zeroLengthMatch.isSet())
+                    m_backtrackingState.append(op.m_zeroLengthMatch);
+
+                // If we backtrack into the end of a simple subpattern do nothing;
+                // just continue through into the last alternative. If we backtrack
+                // into the end of a non-simple set of alterntives we need to jump
+                // to the backtracking return address set up during generation.
+                if (op.m_op == OpNestedAlternativeEnd) {
+                    m_backtrackingState.link(this);
+
+                    // Plant a jump to the return address.
+                    unsigned parenthesesFrameLocation = term->frameLocation;
+                    unsigned alternativeFrameLocation = parenthesesFrameLocation;
+                    if (term->quantityType != QuantifierFixedCount)
+                        alternativeFrameLocation += YarrStackSpaceForBackTrackInfoParenthesesOnce;
+                    loadFromFrameAndJump(alternativeFrameLocation);
+
+                    // Link the DataLabelPtr associated with the end of the last
+                    // alternative to this point.
+                    m_backtrackingState.append(op.m_returnAddress);
+                }
+
+                YarrOp& lastOp = m_ops[op.m_previousOp];
+                m_checkedOffset += lastOp.m_checkAdjust;
+                break;
+            }
+
+            // OpParenthesesSubpatternOnceBegin/End
+            //
+            // When we are backtracking back out of a capturing subpattern we need
+            // to clear the start index in the matches output array, to record that
+            // this subpattern has not been captured.
+            //
+            // When backtracking back out of a Greedy quantified subpattern we need
+            // to catch this, and try running the remainder of the alternative after
+            // the subpattern again, skipping the parentheses.
+            //
+            // Upon backtracking back into a quantified set of parentheses we need to
+            // check whether we were currently skipping the subpattern. If not, we
+            // can backtrack into them, if we were we need to either backtrack back
+            // out of the start of the parentheses, or jump back to the forwards
+            // matching start, depending of whether the match is Greedy or NonGreedy.
+            case OpParenthesesSubpatternOnceBegin: {
+                PatternTerm* term = op.m_term;
+                ASSERT(term->quantityMaxCount == 1);
+
+                // We only need to backtrack to thispoint if capturing or greedy.
+                if ((term->capture() && compileMode == IncludeSubpatterns) || term->quantityType == QuantifierGreedy) {
+                    m_backtrackingState.link(this);
+
+                    // If capturing, clear the capture (we only need to reset start).
+                    if (term->capture() && compileMode == IncludeSubpatterns)
+                        clearSubpatternStart(term->parentheses.subpatternId);
+
+                    // If Greedy, jump to the end.
+                    if (term->quantityType == QuantifierGreedy) {
+                        // Clear the flag in the stackframe indicating we ran through the subpattern.
+                        unsigned parenthesesFrameLocation = term->frameLocation;
+                        storeToFrame(TrustedImm32(-1), parenthesesFrameLocation);
+                        // Jump to after the parentheses, skipping the subpattern.
+                        jump(m_ops[op.m_nextOp].m_reentry);
+                        // A backtrack from after the parentheses, when skipping the subpattern,
+                        // will jump back to here.
+                        op.m_jumps.link(this);
+                    }
+
+                    m_backtrackingState.fallthrough();
+                }
+                break;
+            }
+            case OpParenthesesSubpatternOnceEnd: {
+                PatternTerm* term = op.m_term;
+
+                if (term->quantityType != QuantifierFixedCount) {
+                    m_backtrackingState.link(this);
+
+                    // Check whether we should backtrack back into the parentheses, or if we
+                    // are currently in a state where we had skipped over the subpattern
+                    // (in which case the flag value on the stack will be -1).
+                    unsigned parenthesesFrameLocation = term->frameLocation;
+                    Jump hadSkipped = branch32(Equal, Address(stackPointerRegister, parenthesesFrameLocation * sizeof(void*)), TrustedImm32(-1));
+
+                    if (term->quantityType == QuantifierGreedy) {
+                        // For Greedy parentheses, we skip after having already tried going
+                        // through the subpattern, so if we get here we're done.
+                        YarrOp& beginOp = m_ops[op.m_previousOp];
+                        beginOp.m_jumps.append(hadSkipped);
+                    } else {
+                        // For NonGreedy parentheses, we try skipping the subpattern first,
+                        // so if we get here we need to try running through the subpattern
+                        // next. Jump back to the start of the parentheses in the forwards
+                        // matching path.
+                        ASSERT(term->quantityType == QuantifierNonGreedy);
+                        YarrOp& beginOp = m_ops[op.m_previousOp];
+                        hadSkipped.linkTo(beginOp.m_reentry, this);
+                    }
+
+                    m_backtrackingState.fallthrough();
+                }
+
+                m_backtrackingState.append(op.m_jumps);
+                break;
+            }
+
+            // OpParenthesesSubpatternTerminalBegin/End
+            //
+            // Terminal subpatterns will always match - there is nothing after them to
+            // force a backtrack, and they have a minimum count of 0, and as such will
+            // always produce an acceptable result.
+            case OpParenthesesSubpatternTerminalBegin: {
+                // We will backtrack to this point once the subpattern cannot match any
+                // more. Since no match is accepted as a successful match (we are Greedy
+                // quantified with a minimum of zero) jump back to the forwards matching
+                // path at the end.
+                YarrOp& endOp = m_ops[op.m_nextOp];
+                m_backtrackingState.linkTo(endOp.m_reentry, this);
+                break;
+            }
+            case OpParenthesesSubpatternTerminalEnd:
+                // We should never be backtracking to here (hence the 'terminal' in the name).
+                ASSERT(m_backtrackingState.isEmpty());
+                m_backtrackingState.append(op.m_jumps);
+                break;
+
+            // OpParentheticalAssertionBegin/End
+            case OpParentheticalAssertionBegin: {
+                PatternTerm* term = op.m_term;
+                YarrOp& endOp = m_ops[op.m_nextOp];
+
+                // We need to handle the backtracks upon backtracking back out
+                // of a parenthetical assertion if either we need to correct
+                // the input index, or the assertion was inverted.
+                if (op.m_checkAdjust || term->invert()) {
+                     m_backtrackingState.link(this);
+
+                    if (op.m_checkAdjust)
+                        add32(Imm32(op.m_checkAdjust.unsafeGet()), index);
+
+                    // In an inverted assertion failure to match the subpattern
+                    // is treated as a successful match - jump to the end of the
+                    // subpattern. We already have adjusted the input position
+                    // back to that before the assertion, which is correct.
+                    if (term->invert())
+                        jump(endOp.m_reentry);
+
+                    m_backtrackingState.fallthrough();
+                }
+
+                // The End node's jump list will contain any backtracks into
+                // the end of the assertion. Also, if inverted, we will have
+                // added the failure caused by a successful match to this.
+                m_backtrackingState.append(endOp.m_jumps);
+
+                m_checkedOffset += op.m_checkAdjust;
+                break;
+            }
+            case OpParentheticalAssertionEnd: {
+                // FIXME: We should really be clearing any nested subpattern
+                // matches on bailing out from after the pattern. Firefox has
+                // this bug too (presumably because they use YARR!)
+
+                // Never backtrack into an assertion; later failures bail to before the begin.
+                m_backtrackingState.takeBacktracksToJumpList(op.m_jumps, this);
+
+                YarrOp& lastOp = m_ops[op.m_previousOp];
+                m_checkedOffset -= lastOp.m_checkAdjust;
+                break;
+            }
+
+            case OpMatchFailed:
+                break;
+            }
+
+        } while (opIndex);
+    }
+
+    // Compilation methods:
+    // ====================
+
+    // opCompileParenthesesSubpattern
+    // Emits ops for a subpattern (set of parentheses). These consist
+    // of a set of alternatives wrapped in an outer set of nodes for
+    // the parentheses.
+    // Supported types of parentheses are 'Once' (quantityMaxCount == 1)
+    // and 'Terminal' (non-capturing parentheses quantified as greedy
+    // and infinite).
+    // Alternatives will use the 'Simple' set of ops if either the
+    // subpattern is terminal (in which case we will never need to
+    // backtrack), or if the subpattern only contains one alternative.
+    void opCompileParenthesesSubpattern(PatternTerm* term)
+    {
+        YarrOpCode parenthesesBeginOpCode;
+        YarrOpCode parenthesesEndOpCode;
+        YarrOpCode alternativeBeginOpCode = OpSimpleNestedAlternativeBegin;
+        YarrOpCode alternativeNextOpCode = OpSimpleNestedAlternativeNext;
+        YarrOpCode alternativeEndOpCode = OpSimpleNestedAlternativeEnd;
+
+        // We can currently only compile quantity 1 subpatterns that are
+        // not copies. We generate a copy in the case of a range quantifier,
+        // e.g. /(?:x){3,9}/, or /(?:x)+/ (These are effectively expanded to
+        // /(?:x){3,3}(?:x){0,6}/ and /(?:x)(?:x)*/ repectively). The problem
+        // comes where the subpattern is capturing, in which case we would
+        // need to restore the capture from the first subpattern upon a
+        // failure in the second.
+        if (term->quantityMinCount && term->quantityMinCount != term->quantityMaxCount) {
+            m_shouldFallBack = true;
+            return;
+        } if (term->quantityMaxCount == 1 && !term->parentheses.isCopy) {
+            // Select the 'Once' nodes.
+            parenthesesBeginOpCode = OpParenthesesSubpatternOnceBegin;
+            parenthesesEndOpCode = OpParenthesesSubpatternOnceEnd;
+
+            // If there is more than one alternative we cannot use the 'simple' nodes.
+            if (term->parentheses.disjunction->m_alternatives.size() != 1) {
+                alternativeBeginOpCode = OpNestedAlternativeBegin;
+                alternativeNextOpCode = OpNestedAlternativeNext;
+                alternativeEndOpCode = OpNestedAlternativeEnd;
+            }
+        } else if (term->parentheses.isTerminal) {
+            // Select the 'Terminal' nodes.
+            parenthesesBeginOpCode = OpParenthesesSubpatternTerminalBegin;
+            parenthesesEndOpCode = OpParenthesesSubpatternTerminalEnd;
+        } else {
+            // This subpattern is not supported by the JIT.
+            m_shouldFallBack = true;
+            return;
+        }
+
+        size_t parenBegin = m_ops.size();
+        m_ops.append(parenthesesBeginOpCode);
+
+        m_ops.append(alternativeBeginOpCode);
+        m_ops.last().m_previousOp = notFound;
+        m_ops.last().m_term = term;
+        Vector<std::unique_ptr<PatternAlternative>>& alternatives = term->parentheses.disjunction->m_alternatives;
+        for (unsigned i = 0; i < alternatives.size(); ++i) {
+            size_t lastOpIndex = m_ops.size() - 1;
+
+            PatternAlternative* nestedAlternative = alternatives[i].get();
+            opCompileAlternative(nestedAlternative);
+
+            size_t thisOpIndex = m_ops.size();
+            m_ops.append(YarrOp(alternativeNextOpCode));
+
+            YarrOp& lastOp = m_ops[lastOpIndex];
+            YarrOp& thisOp = m_ops[thisOpIndex];
+
+            lastOp.m_alternative = nestedAlternative;
+            lastOp.m_nextOp = thisOpIndex;
+            thisOp.m_previousOp = lastOpIndex;
+            thisOp.m_term = term;
+        }
+        YarrOp& lastOp = m_ops.last();
+        ASSERT(lastOp.m_op == alternativeNextOpCode);
+        lastOp.m_op = alternativeEndOpCode;
+        lastOp.m_alternative = 0;
+        lastOp.m_nextOp = notFound;
+
+        size_t parenEnd = m_ops.size();
+        m_ops.append(parenthesesEndOpCode);
+
+        m_ops[parenBegin].m_term = term;
+        m_ops[parenBegin].m_previousOp = notFound;
+        m_ops[parenBegin].m_nextOp = parenEnd;
+        m_ops[parenEnd].m_term = term;
+        m_ops[parenEnd].m_previousOp = parenBegin;
+        m_ops[parenEnd].m_nextOp = notFound;
+    }
+
+    // opCompileParentheticalAssertion
+    // Emits ops for a parenthetical assertion. These consist of an
+    // OpSimpleNestedAlternativeBegin/Next/End set of nodes wrapping
+    // the alternatives, with these wrapped by an outer pair of
+    // OpParentheticalAssertionBegin/End nodes.
+    // We can always use the OpSimpleNestedAlternative nodes in the
+    // case of parenthetical assertions since these only ever match
+    // once, and will never backtrack back into the assertion.
+    void opCompileParentheticalAssertion(PatternTerm* term)
+    {
+        size_t parenBegin = m_ops.size();
+        m_ops.append(OpParentheticalAssertionBegin);
+
+        m_ops.append(OpSimpleNestedAlternativeBegin);
+        m_ops.last().m_previousOp = notFound;
+        m_ops.last().m_term = term;
+        Vector<std::unique_ptr<PatternAlternative>>& alternatives =  term->parentheses.disjunction->m_alternatives;
+        for (unsigned i = 0; i < alternatives.size(); ++i) {
+            size_t lastOpIndex = m_ops.size() - 1;
+
+            PatternAlternative* nestedAlternative = alternatives[i].get();
+            opCompileAlternative(nestedAlternative);
+
+            size_t thisOpIndex = m_ops.size();
+            m_ops.append(YarrOp(OpSimpleNestedAlternativeNext));
+
+            YarrOp& lastOp = m_ops[lastOpIndex];
+            YarrOp& thisOp = m_ops[thisOpIndex];
+
+            lastOp.m_alternative = nestedAlternative;
+            lastOp.m_nextOp = thisOpIndex;
+            thisOp.m_previousOp = lastOpIndex;
+            thisOp.m_term = term;
+        }
+        YarrOp& lastOp = m_ops.last();
+        ASSERT(lastOp.m_op == OpSimpleNestedAlternativeNext);
+        lastOp.m_op = OpSimpleNestedAlternativeEnd;
+        lastOp.m_alternative = 0;
+        lastOp.m_nextOp = notFound;
+
+        size_t parenEnd = m_ops.size();
+        m_ops.append(OpParentheticalAssertionEnd);
+
+        m_ops[parenBegin].m_term = term;
+        m_ops[parenBegin].m_previousOp = notFound;
+        m_ops[parenBegin].m_nextOp = parenEnd;
+        m_ops[parenEnd].m_term = term;
+        m_ops[parenEnd].m_previousOp = parenBegin;
+        m_ops[parenEnd].m_nextOp = notFound;
+    }
+
+    // opCompileAlternative
+    // Called to emit nodes for all terms in an alternative.
+    void opCompileAlternative(PatternAlternative* alternative)
+    {
+        optimizeAlternative(alternative);
+
+        for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+            PatternTerm* term = &alternative->m_terms[i];
+
+            switch (term->type) {
+            case PatternTerm::TypeParenthesesSubpattern:
+                opCompileParenthesesSubpattern(term);
+                break;
+
+            case PatternTerm::TypeParentheticalAssertion:
+                opCompileParentheticalAssertion(term);
+                break;
+
+            default:
+                m_ops.append(term);
+            }
+        }
+    }
+
+    // opCompileBody
+    // This method compiles the body disjunction of the regular expression.
+    // The body consists of two sets of alternatives - zero or more 'once
+    // through' (BOL anchored) alternatives, followed by zero or more
+    // repeated alternatives.
+    // For each of these two sets of alteratives, if not empty they will be
+    // wrapped in a set of OpBodyAlternativeBegin/Next/End nodes (with the
+    // 'begin' node referencing the first alternative, and 'next' nodes
+    // referencing any further alternatives. The begin/next/end nodes are
+    // linked together in a doubly linked list. In the case of repeating
+    // alternatives, the end node is also linked back to the beginning.
+    // If no repeating alternatives exist, then a OpMatchFailed node exists
+    // to return the failing result.
+    void opCompileBody(PatternDisjunction* disjunction)
+    {
+        Vector<std::unique_ptr<PatternAlternative>>& alternatives = disjunction->m_alternatives;
+        size_t currentAlternativeIndex = 0;
+
+        // Emit the 'once through' alternatives.
+        if (alternatives.size() && alternatives[0]->onceThrough()) {
+            m_ops.append(YarrOp(OpBodyAlternativeBegin));
+            m_ops.last().m_previousOp = notFound;
+
+            do {
+                size_t lastOpIndex = m_ops.size() - 1;
+                PatternAlternative* alternative = alternatives[currentAlternativeIndex].get();
+                opCompileAlternative(alternative);
+
+                size_t thisOpIndex = m_ops.size();
+                m_ops.append(YarrOp(OpBodyAlternativeNext));
+
+                YarrOp& lastOp = m_ops[lastOpIndex];
+                YarrOp& thisOp = m_ops[thisOpIndex];
+
+                lastOp.m_alternative = alternative;
+                lastOp.m_nextOp = thisOpIndex;
+                thisOp.m_previousOp = lastOpIndex;
+                
+                ++currentAlternativeIndex;
+            } while (currentAlternativeIndex < alternatives.size() && alternatives[currentAlternativeIndex]->onceThrough());
+
+            YarrOp& lastOp = m_ops.last();
+
+            ASSERT(lastOp.m_op == OpBodyAlternativeNext);
+            lastOp.m_op = OpBodyAlternativeEnd;
+            lastOp.m_alternative = 0;
+            lastOp.m_nextOp = notFound;
+        }
+
+        if (currentAlternativeIndex == alternatives.size()) {
+            m_ops.append(YarrOp(OpMatchFailed));
+            return;
+        }
+
+        // Emit the repeated alternatives.
+        size_t repeatLoop = m_ops.size();
+        m_ops.append(YarrOp(OpBodyAlternativeBegin));
+        m_ops.last().m_previousOp = notFound;
+        do {
+            size_t lastOpIndex = m_ops.size() - 1;
+            PatternAlternative* alternative = alternatives[currentAlternativeIndex].get();
+            ASSERT(!alternative->onceThrough());
+            opCompileAlternative(alternative);
+
+            size_t thisOpIndex = m_ops.size();
+            m_ops.append(YarrOp(OpBodyAlternativeNext));
+
+            YarrOp& lastOp = m_ops[lastOpIndex];
+            YarrOp& thisOp = m_ops[thisOpIndex];
+
+            lastOp.m_alternative = alternative;
+            lastOp.m_nextOp = thisOpIndex;
+            thisOp.m_previousOp = lastOpIndex;
+            
+            ++currentAlternativeIndex;
+        } while (currentAlternativeIndex < alternatives.size());
+        YarrOp& lastOp = m_ops.last();
+        ASSERT(lastOp.m_op == OpBodyAlternativeNext);
+        lastOp.m_op = OpBodyAlternativeEnd;
+        lastOp.m_alternative = 0;
+        lastOp.m_nextOp = repeatLoop;
+    }
+
+    void generateEnter()
+    {
+#if CPU(X86_64)
+        push(X86Registers::ebp);
+        move(stackPointerRegister, X86Registers::ebp);
+        push(X86Registers::ebx);
+        // The ABI doesn't guarantee the upper bits are zero on unsigned arguments, so clear them ourselves.
+        zeroExtend32ToPtr(index, index);
+        zeroExtend32ToPtr(length, length);
+#if OS(WINDOWS)
+        if (compileMode == IncludeSubpatterns)
+            loadPtr(Address(X86Registers::ebp, 6 * sizeof(void*)), output);
+#endif
+#elif CPU(X86)
+        push(X86Registers::ebp);
+        move(stackPointerRegister, X86Registers::ebp);
+        // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
+        push(X86Registers::ebx);
+        push(X86Registers::edi);
+        push(X86Registers::esi);
+        // load output into edi (2 = saved ebp + return address).
+    #if COMPILER(MSVC)
+        loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), input);
+        loadPtr(Address(X86Registers::ebp, 3 * sizeof(void*)), index);
+        loadPtr(Address(X86Registers::ebp, 4 * sizeof(void*)), length);
+        if (compileMode == IncludeSubpatterns)
+            loadPtr(Address(X86Registers::ebp, 5 * sizeof(void*)), output);
+    #else
+        if (compileMode == IncludeSubpatterns)
+            loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
+    #endif
+#elif CPU(ARM64)
+        // The ABI doesn't guarantee the upper bits are zero on unsigned arguments, so clear them ourselves.
+        zeroExtend32ToPtr(index, index);
+        zeroExtend32ToPtr(length, length);
+#elif CPU(ARM)
+        push(ARMRegisters::r4);
+        push(ARMRegisters::r5);
+        push(ARMRegisters::r6);
+#elif CPU(SH4)
+        push(SH4Registers::r11);
+        push(SH4Registers::r13);
+#elif CPU(MIPS)
+        // Do nothing.
+#endif
+
+        store8(TrustedImm32(1), &m_vm->isExecutingInRegExpJIT);
+    }
+
+    void generateReturn()
+    {
+        store8(TrustedImm32(0), &m_vm->isExecutingInRegExpJIT);
+
+#if CPU(X86_64)
+#if OS(WINDOWS)
+        // Store the return value in the allocated space pointed by rcx.
+        store64(returnRegister, Address(X86Registers::ecx));
+        store64(returnRegister2, Address(X86Registers::ecx, sizeof(void*)));
+        move(X86Registers::ecx, returnRegister);
+#endif
+        pop(X86Registers::ebx);
+        pop(X86Registers::ebp);
+#elif CPU(X86)
+        pop(X86Registers::esi);
+        pop(X86Registers::edi);
+        pop(X86Registers::ebx);
+        pop(X86Registers::ebp);
+#elif CPU(ARM)
+        pop(ARMRegisters::r6);
+        pop(ARMRegisters::r5);
+        pop(ARMRegisters::r4);
+#elif CPU(SH4)
+        pop(SH4Registers::r13);
+        pop(SH4Registers::r11);
+#elif CPU(MIPS)
+        // Do nothing
+#endif
+        ret();
+    }
+
+public:
+    YarrGenerator(VM* vm, YarrPattern& pattern, YarrCharSize charSize)
+        : m_vm(vm)
+        , m_pattern(pattern)
+        , m_charSize(charSize)
+        , m_shouldFallBack(false)
+    {
+    }
+
+    void compile(VM* vm, YarrCodeBlock& jitObject)
+    {
+        generateEnter();
+
+        Jump hasInput = checkInput();
+        generateFailReturn();
+        hasInput.link(this);
+
+        if (compileMode == IncludeSubpatterns) {
+            for (unsigned i = 0; i < m_pattern.m_numSubpatterns + 1; ++i)
+                store32(TrustedImm32(-1), Address(output, (i << 1) * sizeof(int)));
+        }
+
+        if (!m_pattern.m_body->m_hasFixedSize)
+            setMatchStart(index);
+
+        initCallFrame();
+
+        opCompileBody(m_pattern.m_body);
+
+        if (m_shouldFallBack) {
+            jitObject.setFallBack(true);
+            return;
+        }
+
+        generate();
+        backtrack();
+
+        LinkBuffer linkBuffer(*vm, *this, REGEXP_CODE_ID, JITCompilationCanFail);
+        if (linkBuffer.didFailToAllocate()) {
+            jitObject.setFallBack(true);
+            return;
+        }
+
+        m_backtrackingState.linkDataLabels(linkBuffer);
+
+        if (compileMode == MatchOnly) {
+            if (m_charSize == Char8)
+                jitObject.set8BitCodeMatchOnly(FINALIZE_CODE(linkBuffer, ("Match-only 8-bit regular expression")));
+            else
+                jitObject.set16BitCodeMatchOnly(FINALIZE_CODE(linkBuffer, ("Match-only 16-bit regular expression")));
+        } else {
+            if (m_charSize == Char8)
+                jitObject.set8BitCode(FINALIZE_CODE(linkBuffer, ("8-bit regular expression")));
+            else
+                jitObject.set16BitCode(FINALIZE_CODE(linkBuffer, ("16-bit regular expression")));
+        }
+        jitObject.setFallBack(m_shouldFallBack);
+    }
+
+private:
+    VM* m_vm;
+
+    YarrPattern& m_pattern;
+
+    YarrCharSize m_charSize;
+
+    // Used to detect regular expression constructs that are not currently
+    // supported in the JIT; fall back to the interpreter when this is detected.
+    bool m_shouldFallBack;
+
+    // The regular expression expressed as a linear sequence of operations.
+    Vector<YarrOp, 128> m_ops;
+
+    // This records the current input offset being applied due to the current
+    // set of alternatives we are nested within. E.g. when matching the
+    // character 'b' within the regular expression /abc/, we will know that
+    // the minimum size for the alternative is 3, checked upon entry to the
+    // alternative, and that 'b' is at offset 1 from the start, and as such
+    // when matching 'b' we need to apply an offset of -2 to the load.
+    //
+    // FIXME: This should go away. Rather than tracking this value throughout
+    // code generation, we should gather this information up front & store it
+    // on the YarrOp structure.
+    Checked<unsigned> m_checkedOffset;
+
+    // This class records state whilst generating the backtracking path of code.
+    BacktrackingState m_backtrackingState;
+};
+
+void jitCompile(YarrPattern& pattern, YarrCharSize charSize, VM* vm, YarrCodeBlock& jitObject, YarrJITCompileMode mode)
+{
+    if (mode == MatchOnly)
+        YarrGenerator<MatchOnly>(vm, pattern, charSize).compile(vm, jitObject);
+    else
+        YarrGenerator<IncludeSubpatterns>(vm, pattern, charSize).compile(vm, jitObject);
+}
+
+}}
+
+#endif
diff --git a/yarr/YarrJIT.h b/yarr/YarrJIT.h
new file mode 100644
index 0000000..45a6a3d
--- /dev/null
+++ b/yarr/YarrJIT.h
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#if ENABLE(YARR_JIT)
+
+#include "VM.h"
+#include "MacroAssemblerCodeRef.h"
+#include "MatchResult.h"
+#include "Yarr.h"
+#include "YarrPattern.h"
+
+#if CPU(X86) && !COMPILER(MSVC)
+#define YARR_CALL __attribute__ ((regparm (3)))
+#else
+#define YARR_CALL
+#endif
+
+namespace JSC {
+
+class VM;
+class ExecutablePool;
+
+namespace Yarr {
+
+class YarrCodeBlock {
+#if CPU(X86_64) || CPU(ARM64)
+    typedef MatchResult (*YarrJITCode8)(const LChar* input, unsigned start, unsigned length, int* output) YARR_CALL;
+    typedef MatchResult (*YarrJITCode16)(const UChar* input, unsigned start, unsigned length, int* output) YARR_CALL;
+    typedef MatchResult (*YarrJITCodeMatchOnly8)(const LChar* input, unsigned start, unsigned length) YARR_CALL;
+    typedef MatchResult (*YarrJITCodeMatchOnly16)(const UChar* input, unsigned start, unsigned length) YARR_CALL;
+#else
+    typedef EncodedMatchResult (*YarrJITCode8)(const LChar* input, unsigned start, unsigned length, int* output) YARR_CALL;
+    typedef EncodedMatchResult (*YarrJITCode16)(const UChar* input, unsigned start, unsigned length, int* output) YARR_CALL;
+    typedef EncodedMatchResult (*YarrJITCodeMatchOnly8)(const LChar* input, unsigned start, unsigned length) YARR_CALL;
+    typedef EncodedMatchResult (*YarrJITCodeMatchOnly16)(const UChar* input, unsigned start, unsigned length) YARR_CALL;
+#endif
+
+public:
+    YarrCodeBlock()
+        : m_needFallBack(false)
+    {
+    }
+
+    ~YarrCodeBlock()
+    {
+    }
+
+    void setFallBack(bool fallback) { m_needFallBack = fallback; }
+    bool isFallBack() { return m_needFallBack; }
+
+    bool has8BitCode() { return m_ref8.size(); }
+    bool has16BitCode() { return m_ref16.size(); }
+    void set8BitCode(MacroAssemblerCodeRef ref) { m_ref8 = ref; }
+    void set16BitCode(MacroAssemblerCodeRef ref) { m_ref16 = ref; }
+
+    bool has8BitCodeMatchOnly() { return m_matchOnly8.size(); }
+    bool has16BitCodeMatchOnly() { return m_matchOnly16.size(); }
+    void set8BitCodeMatchOnly(MacroAssemblerCodeRef matchOnly) { m_matchOnly8 = matchOnly; }
+    void set16BitCodeMatchOnly(MacroAssemblerCodeRef matchOnly) { m_matchOnly16 = matchOnly; }
+
+    MatchResult execute(const LChar* input, unsigned start, unsigned length, int* output)
+    {
+        ASSERT(has8BitCode());
+        return MatchResult(reinterpret_cast<YarrJITCode8>(m_ref8.code().executableAddress())(input, start, length, output));
+    }
+
+    MatchResult execute(const UChar* input, unsigned start, unsigned length, int* output)
+    {
+        ASSERT(has16BitCode());
+        return MatchResult(reinterpret_cast<YarrJITCode16>(m_ref16.code().executableAddress())(input, start, length, output));
+    }
+
+    MatchResult execute(const LChar* input, unsigned start, unsigned length)
+    {
+        ASSERT(has8BitCodeMatchOnly());
+        return MatchResult(reinterpret_cast<YarrJITCodeMatchOnly8>(m_matchOnly8.code().executableAddress())(input, start, length));
+    }
+
+    MatchResult execute(const UChar* input, unsigned start, unsigned length)
+    {
+        ASSERT(has16BitCodeMatchOnly());
+        return MatchResult(reinterpret_cast<YarrJITCodeMatchOnly16>(m_matchOnly16.code().executableAddress())(input, start, length));
+    }
+
+#if ENABLE(REGEXP_TRACING)
+    void *get8BitMatchOnlyAddr()
+    {
+        if (!has8BitCodeMatchOnly())
+            return 0;
+
+        return m_matchOnly8.code().executableAddress();
+    }
+
+    void *get16BitMatchOnlyAddr()
+    {
+        if (!has16BitCodeMatchOnly())
+            return 0;
+
+        return m_matchOnly16.code().executableAddress();
+    }
+
+    void *get8BitMatchAddr()
+    {
+        if (!has8BitCode())
+            return 0;
+
+        return m_ref8.code().executableAddress();
+    }
+
+    void *get16BitMatchAddr()
+    {
+        if (!has16BitCode())
+            return 0;
+
+        return m_ref16.code().executableAddress();
+    }
+#endif
+
+    size_t size() const
+    {
+        return m_ref8.size() + m_ref16.size() + m_matchOnly8.size() + m_matchOnly16.size();
+    }
+
+    void clear()
+    {
+        m_ref8 = MacroAssemblerCodeRef();
+        m_ref16 = MacroAssemblerCodeRef();
+        m_matchOnly8 = MacroAssemblerCodeRef();
+        m_matchOnly16 = MacroAssemblerCodeRef();
+        m_needFallBack = false;
+    }
+
+private:
+    MacroAssemblerCodeRef m_ref8;
+    MacroAssemblerCodeRef m_ref16;
+    MacroAssemblerCodeRef m_matchOnly8;
+    MacroAssemblerCodeRef m_matchOnly16;
+    bool m_needFallBack;
+};
+
+enum YarrJITCompileMode {
+    MatchOnly,
+    IncludeSubpatterns
+};
+void jitCompile(YarrPattern&, YarrCharSize, VM*, YarrCodeBlock& jitObject, YarrJITCompileMode = IncludeSubpatterns);
+
+} } // namespace JSC::Yarr
+
+#endif
diff --git a/yarr/YarrParser.h b/yarr/YarrParser.h
new file mode 100644
index 0000000..9c09820
--- /dev/null
+++ b/yarr/YarrParser.h
@@ -0,0 +1,957 @@
+/*
+ * Copyright (C) 2009, 2014-2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "Yarr.h"
+#include <wtf/ASCIICType.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC { namespace Yarr {
+
+enum BuiltInCharacterClassID {
+    DigitClassID,
+    SpaceClassID,
+    WordClassID,
+    NewlineClassID,
+};
+
+// The Parser class should not be used directly - only via the Yarr::parse() method.
+template<class Delegate, typename CharType>
+class Parser {
+private:
+    template<class FriendDelegate>
+    friend const char* parse(FriendDelegate&, const String& pattern, bool isUnicode, unsigned backReferenceLimit);
+
+    /*
+     * CharacterClassParserDelegate:
+     *
+     * The class CharacterClassParserDelegate is used in the parsing of character
+     * classes.  This class handles detection of character ranges.  This class
+     * implements enough of the delegate interface such that it can be passed to
+     * parseEscape() as an EscapeDelegate.  This allows parseEscape() to be reused
+     * to perform the parsing of escape characters in character sets.
+     */
+    class CharacterClassParserDelegate {
+    public:
+        CharacterClassParserDelegate(Delegate& delegate, YarrPattern::ErrorCode& err)
+            : m_delegate(delegate)
+            , m_err(err)
+            , m_state(Empty)
+            , m_character(0)
+        {
+        }
+
+        /*
+         * begin():
+         *
+         * Called at beginning of construction.
+         */
+        void begin(bool invert)
+        {
+            m_delegate.atomCharacterClassBegin(invert);
+        }
+
+        /*
+         * atomPatternCharacter():
+         *
+         * This method is called either from parseCharacterClass() (for an unescaped
+         * character in a character class), or from parseEscape(). In the former case
+         * the value true will be passed for the argument 'hyphenIsRange', and in this
+         * mode we will allow a hypen to be treated as indicating a range (i.e. /[a-z]/
+         * is different to /[a\-z]/).
+         */
+        void atomPatternCharacter(UChar32 ch, bool hyphenIsRange = false)
+        {
+            switch (m_state) {
+            case AfterCharacterClass:
+                // Following a builtin character class we need look out for a hyphen.
+                // We're looking for invalid ranges, such as /[\d-x]/ or /[\d-\d]/.
+                // If we see a hyphen following a charater class then unlike usual
+                // we'll report it to the delegate immediately, and put ourself into
+                // a poisoned state. Any following calls to add another character or
+                // character class will result in an error. (A hypen following a
+                // character-class is itself valid, but only  at the end of a regex).
+                if (hyphenIsRange && ch == '-') {
+                    m_delegate.atomCharacterClassAtom('-');
+                    m_state = AfterCharacterClassHyphen;
+                    return;
+                }
+                // Otherwise just fall through - cached character so treat this as Empty.
+                FALLTHROUGH;
+
+            case Empty:
+                m_character = ch;
+                m_state = CachedCharacter;
+                return;
+
+            case CachedCharacter:
+                if (hyphenIsRange && ch == '-')
+                    m_state = CachedCharacterHyphen;
+                else {
+                    m_delegate.atomCharacterClassAtom(m_character);
+                    m_character = ch;
+                }
+                return;
+
+            case CachedCharacterHyphen:
+                if (ch < m_character) {
+                    m_err = YarrPattern::CharacterClassOutOfOrder;
+                    return;
+                }
+                m_delegate.atomCharacterClassRange(m_character, ch);
+                m_state = Empty;
+                return;
+
+                // See coment in atomBuiltInCharacterClass below.
+                // This too is technically an error, per ECMA-262, and again we
+                // we chose to allow this.  Note a subtlely here that while we
+                // diverge from the spec's definition of CharacterRange we do
+                // remain in compliance with the grammar.  For example, consider
+                // the expression /[\d-a-z]/.  We comply with the grammar in
+                // this case by not allowing a-z to be matched as a range.
+            case AfterCharacterClassHyphen:
+                m_delegate.atomCharacterClassAtom(ch);
+                m_state = Empty;
+                return;
+            }
+        }
+
+        /*
+         * atomBuiltInCharacterClass():
+         *
+         * Adds a built-in character class, called by parseEscape().
+         */
+        void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert)
+        {
+            switch (m_state) {
+            case CachedCharacter:
+                // Flush the currently cached character, then fall through.
+                m_delegate.atomCharacterClassAtom(m_character);
+                FALLTHROUGH;
+            case Empty:
+            case AfterCharacterClass:
+                m_state = AfterCharacterClass;
+                m_delegate.atomCharacterClassBuiltIn(classID, invert);
+                return;
+
+                // If we hit either of these cases, we have an invalid range that
+                // looks something like /[x-\d]/ or /[\d-\d]/.
+                // According to ECMA-262 this should be a syntax error, but
+                // empirical testing shows this to break teh webz.  Instead we
+                // comply with to the ECMA-262 grammar, and assume the grammar to
+                // have matched the range correctly, but tweak our interpretation
+                // of CharacterRange.  Effectively we implicitly handle the hyphen
+                // as if it were escaped, e.g. /[\w-_]/ is treated as /[\w\-_]/.
+            case CachedCharacterHyphen:
+                m_delegate.atomCharacterClassAtom(m_character);
+                m_delegate.atomCharacterClassAtom('-');
+                FALLTHROUGH;
+            case AfterCharacterClassHyphen:
+                m_delegate.atomCharacterClassBuiltIn(classID, invert);
+                m_state = Empty;
+                return;
+            }
+        }
+
+        /*
+         * end():
+         *
+         * Called at end of construction.
+         */
+        void end()
+        {
+            if (m_state == CachedCharacter)
+                m_delegate.atomCharacterClassAtom(m_character);
+            else if (m_state == CachedCharacterHyphen) {
+                m_delegate.atomCharacterClassAtom(m_character);
+                m_delegate.atomCharacterClassAtom('-');
+            }
+            m_delegate.atomCharacterClassEnd();
+        }
+
+        // parseEscape() should never call these delegate methods when
+        // invoked with inCharacterClass set.
+        NO_RETURN_DUE_TO_ASSERT void assertionWordBoundary(bool) { RELEASE_ASSERT_NOT_REACHED(); }
+        NO_RETURN_DUE_TO_ASSERT void atomBackReference(unsigned) { RELEASE_ASSERT_NOT_REACHED(); }
+
+    private:
+        Delegate& m_delegate;
+        YarrPattern::ErrorCode& m_err;
+        enum CharacterClassConstructionState {
+            Empty,
+            CachedCharacter,
+            CachedCharacterHyphen,
+            AfterCharacterClass,
+            AfterCharacterClassHyphen,
+        } m_state;
+        UChar32 m_character;
+    };
+
+    Parser(Delegate& delegate, const String& pattern, bool isUnicode, unsigned backReferenceLimit)
+        : m_delegate(delegate)
+        , m_backReferenceLimit(backReferenceLimit)
+        , m_err(YarrPattern::NoError)
+        , m_data(pattern.characters<CharType>())
+        , m_size(pattern.length())
+        , m_index(0)
+        , m_isUnicode(isUnicode)
+        , m_parenthesesNestingDepth(0)
+    {
+    }
+
+    // The handling of IdentityEscapes is different depending on the unicode flag.
+    // For Unicode patterns, IdentityEscapes only include SyntaxCharacters or '/'.
+    // For non-unicode patterns, most any character can be escaped.
+    bool isIdentityEscapeAnError(int ch)
+    {
+        if (m_isUnicode && !strchr("^$\\.*+?()[]{}|/", ch)) {
+            m_err = YarrPattern::InvalidIdentityEscape;
+            return true;
+        }
+
+        return false;
+    }
+
+    /*
+     * parseEscape():
+     *
+     * Helper for parseTokens() AND parseCharacterClass().
+     * Unlike the other parser methods, this function does not report tokens
+     * directly to the member delegate (m_delegate), instead tokens are
+     * emitted to the delegate provided as an argument.  In the case of atom
+     * escapes, parseTokens() will call parseEscape() passing m_delegate as
+     * an argument, and as such the escape will be reported to the delegate.
+     *
+     * However this method may also be used by parseCharacterClass(), in which
+     * case a CharacterClassParserDelegate will be passed as the delegate that
+     * tokens should be added to.  A boolean flag is also provided to indicate
+     * whether that an escape in a CharacterClass is being parsed (some parsing
+     * rules change in this context).
+     *
+     * The boolean value returned by this method indicates whether the token
+     * parsed was an atom (outside of a characted class \b and \B will be
+     * interpreted as assertions).
+     */
+    template<bool inCharacterClass, class EscapeDelegate>
+    bool parseEscape(EscapeDelegate& delegate)
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '\\');
+        consume();
+
+        if (atEndOfPattern()) {
+            m_err = YarrPattern::EscapeUnterminated;
+            return false;
+        }
+
+        switch (peek()) {
+        // Assertions
+        case 'b':
+            consume();
+            if (inCharacterClass) {
+                if (isIdentityEscapeAnError('b'))
+                    break;
+
+                delegate.atomPatternCharacter('\b');
+            } else {
+                delegate.assertionWordBoundary(false);
+                return false;
+            }
+            break;
+        case 'B':
+            consume();
+            if (inCharacterClass) {
+                if (isIdentityEscapeAnError('B'))
+                    break;
+
+                delegate.atomPatternCharacter('B');
+            } else {
+                delegate.assertionWordBoundary(true);
+                return false;
+            }
+            break;
+
+        // CharacterClassEscape
+        case 'd':
+            consume();
+            delegate.atomBuiltInCharacterClass(DigitClassID, false);
+            break;
+        case 's':
+            consume();
+            delegate.atomBuiltInCharacterClass(SpaceClassID, false);
+            break;
+        case 'w':
+            consume();
+            delegate.atomBuiltInCharacterClass(WordClassID, false);
+            break;
+        case 'D':
+            consume();
+            delegate.atomBuiltInCharacterClass(DigitClassID, true);
+            break;
+        case 'S':
+            consume();
+            delegate.atomBuiltInCharacterClass(SpaceClassID, true);
+            break;
+        case 'W':
+            consume();
+            delegate.atomBuiltInCharacterClass(WordClassID, true);
+            break;
+
+        // DecimalEscape
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9': {
+            // To match Firefox, we parse an invalid backreference in the range [1-7] as an octal escape.
+            // First, try to parse this as backreference.
+            if (!inCharacterClass) {
+                ParseState state = saveState();
+
+                unsigned backReference = consumeNumber();
+                if (backReference <= m_backReferenceLimit) {
+                    delegate.atomBackReference(backReference);
+                    break;
+                }
+
+                restoreState(state);
+            }
+            
+            // Not a backreference, and not octal.
+            if (peek() >= '8') {
+                delegate.atomPatternCharacter('\\');
+                break;
+            }
+
+            // Fall-through to handle this as an octal escape.
+            FALLTHROUGH;
+        }
+
+        // Octal escape
+        case '0':
+            delegate.atomPatternCharacter(consumeOctal());
+            break;
+
+        // ControlEscape
+        case 'f':
+            consume();
+            delegate.atomPatternCharacter('\f');
+            break;
+        case 'n':
+            consume();
+            delegate.atomPatternCharacter('\n');
+            break;
+        case 'r':
+            consume();
+            delegate.atomPatternCharacter('\r');
+            break;
+        case 't':
+            consume();
+            delegate.atomPatternCharacter('\t');
+            break;
+        case 'v':
+            consume();
+            delegate.atomPatternCharacter('\v');
+            break;
+
+        // ControlLetter
+        case 'c': {
+            ParseState state = saveState();
+            consume();
+            if (!atEndOfPattern()) {
+                int control = consume();
+
+                // To match Firefox, inside a character class, we also accept numbers and '_' as control characters.
+                if (inCharacterClass ? WTF::isASCIIAlphanumeric(control) || (control == '_') : WTF::isASCIIAlpha(control)) {
+                    delegate.atomPatternCharacter(control & 0x1f);
+                    break;
+                }
+            }
+            restoreState(state);
+            delegate.atomPatternCharacter('\\');
+            break;
+        }
+
+        // HexEscape
+        case 'x': {
+            consume();
+            int x = tryConsumeHex(2);
+            if (x == -1) {
+                if (isIdentityEscapeAnError('x'))
+                    break;
+
+                delegate.atomPatternCharacter('x');
+            } else
+                delegate.atomPatternCharacter(x);
+            break;
+        }
+
+        // UnicodeEscape
+        case 'u': {
+            consume();
+            if (atEndOfPattern()) {
+                if (isIdentityEscapeAnError('u'))
+                    break;
+
+                delegate.atomPatternCharacter('u');
+                break;
+            }
+
+            if (m_isUnicode && peek() == '{') {
+                consume();
+                UChar32 codePoint = 0;
+                do {
+                    if (atEndOfPattern() || !isASCIIHexDigit(peek())) {
+                        m_err = YarrPattern::InvalidUnicodeEscape;
+                        break;
+                    }
+
+                    codePoint = (codePoint << 4) | toASCIIHexValue(consume());
+
+                    if (codePoint > UCHAR_MAX_VALUE)
+                        m_err = YarrPattern::InvalidUnicodeEscape;
+                } while (!atEndOfPattern() && peek() != '}');
+                if (!atEndOfPattern() && peek() == '}')
+                    consume();
+                else if (!m_err)
+                    m_err = YarrPattern::InvalidUnicodeEscape;
+                if (m_err)
+                    return false;
+
+                delegate.atomPatternCharacter(codePoint);
+                break;
+            }
+            int u = tryConsumeHex(4);
+            if (u == -1) {
+                if (isIdentityEscapeAnError('u'))
+                    break;
+
+                delegate.atomPatternCharacter('u');
+            } else {
+                // If we have the first of a surrogate pair, look for the second.
+                if (U16_IS_LEAD(u) && m_isUnicode && (patternRemaining() >= 6) && peek() == '\\') {
+                    ParseState state = saveState();
+                    consume();
+                    
+                    if (tryConsume('u')) {
+                        int surrogate2 = tryConsumeHex(4);
+                        if (U16_IS_TRAIL(surrogate2)) {
+                            u = U16_GET_SUPPLEMENTARY(u, surrogate2);
+                            delegate.atomPatternCharacter(u);
+                            break;
+                        }
+                    }
+
+                    restoreState(state);
+                }
+                delegate.atomPatternCharacter(u);
+            }
+            break;
+        }
+
+        // IdentityEscape
+        default:
+            int ch = peek();
+
+            if (ch == '-' && m_isUnicode && inCharacterClass) {
+                // \- is allowed for ClassEscape with unicode flag.
+                delegate.atomPatternCharacter(consume());
+                break;
+            }
+
+            if (isIdentityEscapeAnError(ch))
+                break;
+
+            delegate.atomPatternCharacter(consume());
+        }
+        
+        return true;
+    }
+
+    UChar32 consumePossibleSurrogatePair()
+    {
+        UChar32 ch = consume();
+        if (U16_IS_LEAD(ch) && m_isUnicode && (patternRemaining() > 0)) {
+            ParseState state = saveState();
+
+            UChar32 surrogate2 = consume();
+            if (U16_IS_TRAIL(surrogate2))
+                ch = U16_GET_SUPPLEMENTARY(ch, surrogate2);
+            else
+                restoreState(state);
+        }
+
+        return ch;
+    }
+
+    /*
+     * parseAtomEscape(), parseCharacterClassEscape():
+     *
+     * These methods alias to parseEscape().
+     */
+    bool parseAtomEscape()
+    {
+        return parseEscape<false>(m_delegate);
+    }
+    void parseCharacterClassEscape(CharacterClassParserDelegate& delegate)
+    {
+        parseEscape<true>(delegate);
+    }
+
+    /*
+     * parseCharacterClass():
+     *
+     * Helper for parseTokens(); calls dirctly and indirectly (via parseCharacterClassEscape)
+     * to an instance of CharacterClassParserDelegate, to describe the character class to the
+     * delegate.
+     */
+    void parseCharacterClass()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '[');
+        consume();
+
+        CharacterClassParserDelegate characterClassConstructor(m_delegate, m_err);
+
+        characterClassConstructor.begin(tryConsume('^'));
+
+        while (!atEndOfPattern()) {
+            switch (peek()) {
+            case ']':
+                consume();
+                characterClassConstructor.end();
+                return;
+
+            case '\\':
+                parseCharacterClassEscape(characterClassConstructor);
+                break;
+
+            default:
+                characterClassConstructor.atomPatternCharacter(consumePossibleSurrogatePair(), true);
+            }
+
+            if (m_err)
+                return;
+        }
+
+        m_err = YarrPattern::CharacterClassUnmatched;
+    }
+
+    /*
+     * parseParenthesesBegin():
+     *
+     * Helper for parseTokens(); checks for parentheses types other than regular capturing subpatterns.
+     */
+    void parseParenthesesBegin()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '(');
+        consume();
+
+        if (tryConsume('?')) {
+            if (atEndOfPattern()) {
+                m_err = YarrPattern::ParenthesesTypeInvalid;
+                return;
+            }
+
+            switch (consume()) {
+            case ':':
+                m_delegate.atomParenthesesSubpatternBegin(false);
+                break;
+            
+            case '=':
+                m_delegate.atomParentheticalAssertionBegin();
+                break;
+
+            case '!':
+                m_delegate.atomParentheticalAssertionBegin(true);
+                break;
+            
+            default:
+                m_err = YarrPattern::ParenthesesTypeInvalid;
+            }
+        } else
+            m_delegate.atomParenthesesSubpatternBegin();
+
+        ++m_parenthesesNestingDepth;
+    }
+
+    /*
+     * parseParenthesesEnd():
+     *
+     * Helper for parseTokens(); checks for parse errors (due to unmatched parentheses).
+     */
+    void parseParenthesesEnd()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == ')');
+        consume();
+
+        if (m_parenthesesNestingDepth > 0)
+            m_delegate.atomParenthesesEnd();
+        else
+            m_err = YarrPattern::ParenthesesUnmatched;
+
+        --m_parenthesesNestingDepth;
+    }
+
+    /*
+     * parseQuantifier():
+     *
+     * Helper for parseTokens(); checks for parse errors and non-greedy quantifiers.
+     */
+    void parseQuantifier(bool lastTokenWasAnAtom, unsigned min, unsigned max)
+    {
+        ASSERT(!m_err);
+        ASSERT(min <= max);
+
+        if (min == UINT_MAX) {
+            m_err = YarrPattern::QuantifierTooLarge;
+            return;
+        }
+
+        if (lastTokenWasAnAtom)
+            m_delegate.quantifyAtom(min, max, !tryConsume('?'));
+        else
+            m_err = YarrPattern::QuantifierWithoutAtom;
+    }
+
+    /*
+     * parseTokens():
+     *
+     * This method loops over the input pattern reporting tokens to the delegate.
+     * The method returns when a parse error is detected, or the end of the pattern
+     * is reached.  One piece of state is tracked around the loop, which is whether
+     * the last token passed to the delegate was an atom (this is necessary to detect
+     * a parse error when a quantifier provided without an atom to quantify).
+     */
+    void parseTokens()
+    {
+        bool lastTokenWasAnAtom = false;
+
+        while (!atEndOfPattern()) {
+            switch (peek()) {
+            case '|':
+                consume();
+                m_delegate.disjunction();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '(':
+                parseParenthesesBegin();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case ')':
+                parseParenthesesEnd();
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '^':
+                consume();
+                m_delegate.assertionBOL();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '$':
+                consume();
+                m_delegate.assertionEOL();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '.':
+                consume();
+                m_delegate.atomBuiltInCharacterClass(NewlineClassID, true);
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '[':
+                parseCharacterClass();
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '\\':
+                lastTokenWasAnAtom = parseAtomEscape();
+                break;
+
+            case '*':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 0, quantifyInfinite);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '+':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 1, quantifyInfinite);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '?':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 0, 1);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '{': {
+                ParseState state = saveState();
+
+                consume();
+                if (peekIsDigit()) {
+                    unsigned min = consumeNumber();
+                    unsigned max = min;
+                    
+                    if (tryConsume(','))
+                        max = peekIsDigit() ? consumeNumber() : quantifyInfinite;
+
+                    if (tryConsume('}')) {
+                        if (min <= max)
+                            parseQuantifier(lastTokenWasAnAtom, min, max);
+                        else
+                            m_err = YarrPattern::QuantifierOutOfOrder;
+                        lastTokenWasAnAtom = false;
+                        break;
+                    }
+                }
+
+                restoreState(state);
+            }
+            // if we did not find a complete quantifer, fall through to the default case.
+            FALLTHROUGH;
+
+            default:
+                m_delegate.atomPatternCharacter(consumePossibleSurrogatePair());
+                lastTokenWasAnAtom = true;
+            }
+
+            if (m_err)
+                return;
+        }
+
+        if (m_parenthesesNestingDepth > 0)
+            m_err = YarrPattern::MissingParentheses;
+    }
+
+    /*
+     * parse():
+     *
+     * This method calls parseTokens() to parse over the input and converts any
+     * error code to a const char* for a result.
+     */
+    const char* parse()
+    {
+        if (m_size > MAX_PATTERN_SIZE)
+            m_err = YarrPattern::PatternTooLarge;
+        else
+            parseTokens();
+        ASSERT(atEndOfPattern() || m_err);
+        
+        return YarrPattern::errorMessage(m_err);
+    }
+
+    // Misc helper functions:
+
+    typedef unsigned ParseState;
+    
+    ParseState saveState()
+    {
+        return m_index;
+    }
+
+    void restoreState(ParseState state)
+    {
+        m_index = state;
+    }
+
+    bool atEndOfPattern()
+    {
+        ASSERT(m_index <= m_size);
+        return m_index == m_size;
+    }
+
+    unsigned patternRemaining()
+    {
+        ASSERT(m_index <= m_size);
+        return m_size - m_index;
+    }
+
+    int peek()
+    {
+        ASSERT(m_index < m_size);
+        return m_data[m_index];
+    }
+
+    bool peekIsDigit()
+    {
+        return !atEndOfPattern() && WTF::isASCIIDigit(peek());
+    }
+
+    unsigned peekDigit()
+    {
+        ASSERT(peekIsDigit());
+        return peek() - '0';
+    }
+
+    int consume()
+    {
+        ASSERT(m_index < m_size);
+        return m_data[m_index++];
+    }
+
+    unsigned consumeDigit()
+    {
+        ASSERT(peekIsDigit());
+        return consume() - '0';
+    }
+
+    unsigned consumeNumber()
+    {
+        unsigned n = consumeDigit();
+        // check for overflow.
+        for (unsigned newValue; peekIsDigit() && ((newValue = n * 10 + peekDigit()) >= n); ) {
+            n = newValue;
+            consume();
+        }
+        return n;
+    }
+
+    unsigned consumeOctal()
+    {
+        ASSERT(WTF::isASCIIOctalDigit(peek()));
+
+        unsigned n = consumeDigit();
+        while (n < 32 && !atEndOfPattern() && WTF::isASCIIOctalDigit(peek()))
+            n = n * 8 + consumeDigit();
+        return n;
+    }
+
+    bool tryConsume(UChar ch)
+    {
+        if (atEndOfPattern() || (m_data[m_index] != ch))
+            return false;
+        ++m_index;
+        return true;
+    }
+
+    int tryConsumeHex(int count)
+    {
+        ParseState state = saveState();
+
+        int n = 0;
+        while (count--) {
+            if (atEndOfPattern() || !WTF::isASCIIHexDigit(peek())) {
+                restoreState(state);
+                return -1;
+            }
+            n = (n << 4) | WTF::toASCIIHexValue(consume());
+        }
+        return n;
+    }
+
+    Delegate& m_delegate;
+    unsigned m_backReferenceLimit;
+    YarrPattern::ErrorCode m_err;
+    const CharType* m_data;
+    unsigned m_size;
+    unsigned m_index;
+    bool m_isUnicode;
+    unsigned m_parenthesesNestingDepth;
+
+    // Derived by empirical testing of compile time in PCRE and WREC.
+    static const unsigned MAX_PATTERN_SIZE = 1024 * 1024;
+};
+
+/*
+ * Yarr::parse():
+ *
+ * The parse method is passed a pattern to be parsed and a delegate upon which
+ * callbacks will be made to record the parsed tokens forming the regex.
+ * Yarr::parse() returns null on success, or a const C string providing an error
+ * message where a parse error occurs.
+ *
+ * The Delegate must implement the following interface:
+ *
+ *    void assertionBOL();
+ *    void assertionEOL();
+ *    void assertionWordBoundary(bool invert);
+ *
+ *    void atomPatternCharacter(UChar32 ch);
+ *    void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert);
+ *    void atomCharacterClassBegin(bool invert)
+ *    void atomCharacterClassAtom(UChar32 ch)
+ *    void atomCharacterClassRange(UChar32 begin, UChar32 end)
+ *    void atomCharacterClassBuiltIn(BuiltInCharacterClassID classID, bool invert)
+ *    void atomCharacterClassEnd()
+ *    void atomParenthesesSubpatternBegin(bool capture = true);
+ *    void atomParentheticalAssertionBegin(bool invert = false);
+ *    void atomParenthesesEnd();
+ *    void atomBackReference(unsigned subpatternId);
+ *
+ *    void quantifyAtom(unsigned min, unsigned max, bool greedy);
+ *
+ *    void disjunction();
+ *
+ * The regular expression is described by a sequence of assertion*() and atom*()
+ * callbacks to the delegate, describing the terms in the regular expression.
+ * Following an atom a quantifyAtom() call may occur to indicate that the previous
+ * atom should be quantified.  In the case of atoms described across multiple
+ * calls (parentheses and character classes) the call to quantifyAtom() will come
+ * after the call to the atom*End() method, never after atom*Begin().
+ *
+ * Character classes may either be described by a single call to
+ * atomBuiltInCharacterClass(), or by a sequence of atomCharacterClass*() calls.
+ * In the latter case, ...Begin() will be called, followed by a sequence of
+ * calls to ...Atom(), ...Range(), and ...BuiltIn(), followed by a call to ...End().
+ *
+ * Sequences of atoms and assertions are broken into alternatives via calls to
+ * disjunction().  Assertions, atoms, and disjunctions emitted between calls to
+ * atomParenthesesBegin() and atomParenthesesEnd() form the body of a subpattern.
+ * atomParenthesesBegin() is passed a subpatternId.  In the case of a regular
+ * capturing subpattern, this will be the subpatternId associated with these
+ * parentheses, and will also by definition be the lowest subpatternId of these
+ * parentheses and of any nested paretheses.  The atomParenthesesEnd() method
+ * is passed the subpatternId of the last capturing subexpression nested within
+ * these paretheses.  In the case of a capturing subpattern with no nested
+ * capturing subpatterns, the same subpatternId will be passed to the begin and
+ * end functions.  In the case of non-capturing subpatterns the subpatternId
+ * passed to the begin method is also the first possible subpatternId that might
+ * be nested within these paretheses.  If a set of non-capturing parentheses does
+ * not contain any capturing subpatterns, then the subpatternId passed to begin
+ * will be greater than the subpatternId passed to end.
+ */
+
+template<class Delegate>
+const char* parse(Delegate& delegate, const String& pattern, bool isUnicode, unsigned backReferenceLimit = quantifyInfinite)
+{
+    if (pattern.is8Bit())
+        return Parser<Delegate, LChar>(delegate, pattern, isUnicode, backReferenceLimit).parse();
+    return Parser<Delegate, UChar>(delegate, pattern, isUnicode, backReferenceLimit).parse();
+}
+
+} } // namespace JSC::Yarr
diff --git a/yarr/YarrPattern.cpp b/yarr/YarrPattern.cpp
new file mode 100644
index 0000000..386b337
--- /dev/null
+++ b/yarr/YarrPattern.cpp
@@ -0,0 +1,977 @@
+/*
+ * Copyright (C) 2009, 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Peter Varga (pvarga@inf.u-szeged.hu), University of Szeged
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "YarrPattern.h"
+
+#include "Yarr.h"
+#include "YarrCanonicalize.h"
+#include "YarrParser.h"
+#include <wtf/Vector.h>
+#include <wtf/WTFThreadData.h>
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+#include "RegExpJitTables.h"
+
+class CharacterClassConstructor {
+public:
+    CharacterClassConstructor(bool isCaseInsensitive, CanonicalMode canonicalMode)
+        : m_isCaseInsensitive(isCaseInsensitive)
+        , m_canonicalMode(canonicalMode)
+    {
+    }
+    
+    void reset()
+    {
+        m_matches.clear();
+        m_ranges.clear();
+        m_matchesUnicode.clear();
+        m_rangesUnicode.clear();
+    }
+
+    void append(const CharacterClass* other)
+    {
+        for (size_t i = 0; i < other->m_matches.size(); ++i)
+            addSorted(m_matches, other->m_matches[i]);
+        for (size_t i = 0; i < other->m_ranges.size(); ++i)
+            addSortedRange(m_ranges, other->m_ranges[i].begin, other->m_ranges[i].end);
+        for (size_t i = 0; i < other->m_matchesUnicode.size(); ++i)
+            addSorted(m_matchesUnicode, other->m_matchesUnicode[i]);
+        for (size_t i = 0; i < other->m_rangesUnicode.size(); ++i)
+            addSortedRange(m_rangesUnicode, other->m_rangesUnicode[i].begin, other->m_rangesUnicode[i].end);
+    }
+
+    void putChar(UChar32 ch)
+    {
+        if (!m_isCaseInsensitive) {
+            addSorted(ch);
+            return;
+        }
+
+        if (m_canonicalMode == CanonicalMode::UCS2 && isASCII(ch)) {
+            // Handle ASCII cases.
+            if (isASCIIAlpha(ch)) {
+                addSorted(m_matches, toASCIIUpper(ch));
+                addSorted(m_matches, toASCIILower(ch));
+            } else
+                addSorted(m_matches, ch);
+            return;
+        }
+
+        // Add multiple matches, if necessary.
+        const CanonicalizationRange* info = canonicalRangeInfoFor(ch, m_canonicalMode);
+        if (info->type == CanonicalizeUnique)
+            addSorted(ch);
+        else
+            putUnicodeIgnoreCase(ch, info);
+    }
+
+    void putUnicodeIgnoreCase(UChar32 ch, const CanonicalizationRange* info)
+    {
+        ASSERT(m_isCaseInsensitive);
+        ASSERT(ch >= info->begin && ch <= info->end);
+        ASSERT(info->type != CanonicalizeUnique);
+        if (info->type == CanonicalizeSet) {
+            for (const UChar32* set = canonicalCharacterSetInfo(info->value, m_canonicalMode); (ch = *set); ++set)
+                addSorted(ch);
+        } else {
+            addSorted(ch);
+            addSorted(getCanonicalPair(info, ch));
+        }
+    }
+
+    void putRange(UChar32 lo, UChar32 hi)
+    {
+        if (isASCII(lo)) {
+            char asciiLo = lo;
+            char asciiHi = std::min(hi, (UChar32)0x7f);
+            addSortedRange(m_ranges, lo, asciiHi);
+            
+            if (m_isCaseInsensitive) {
+                if ((asciiLo <= 'Z') && (asciiHi >= 'A'))
+                    addSortedRange(m_ranges, std::max(asciiLo, 'A')+('a'-'A'), std::min(asciiHi, 'Z')+('a'-'A'));
+                if ((asciiLo <= 'z') && (asciiHi >= 'a'))
+                    addSortedRange(m_ranges, std::max(asciiLo, 'a')+('A'-'a'), std::min(asciiHi, 'z')+('A'-'a'));
+            }
+        }
+        if (isASCII(hi))
+            return;
+
+        lo = std::max(lo, (UChar32)0x80);
+        addSortedRange(m_rangesUnicode, lo, hi);
+        
+        if (!m_isCaseInsensitive)
+            return;
+
+        const CanonicalizationRange* info = canonicalRangeInfoFor(lo, m_canonicalMode);
+        while (true) {
+            // Handle the range [lo .. end]
+            UChar32 end = std::min<UChar32>(info->end, hi);
+
+            switch (info->type) {
+            case CanonicalizeUnique:
+                // Nothing to do - no canonical equivalents.
+                break;
+            case CanonicalizeSet: {
+                UChar ch;
+                for (const UChar32* set = canonicalCharacterSetInfo(info->value, m_canonicalMode); (ch = *set); ++set)
+                    addSorted(m_matchesUnicode, ch);
+                break;
+            }
+            case CanonicalizeRangeLo:
+                addSortedRange(m_rangesUnicode, lo + info->value, end + info->value);
+                break;
+            case CanonicalizeRangeHi:
+                addSortedRange(m_rangesUnicode, lo - info->value, end - info->value);
+                break;
+            case CanonicalizeAlternatingAligned:
+                // Use addSortedRange since there is likely an abutting range to combine with.
+                if (lo & 1)
+                    addSortedRange(m_rangesUnicode, lo - 1, lo - 1);
+                if (!(end & 1))
+                    addSortedRange(m_rangesUnicode, end + 1, end + 1);
+                break;
+            case CanonicalizeAlternatingUnaligned:
+                // Use addSortedRange since there is likely an abutting range to combine with.
+                if (!(lo & 1))
+                    addSortedRange(m_rangesUnicode, lo - 1, lo - 1);
+                if (end & 1)
+                    addSortedRange(m_rangesUnicode, end + 1, end + 1);
+                break;
+            }
+
+            if (hi == end)
+                return;
+
+            ++info;
+            lo = info->begin;
+        };
+
+    }
+
+    std::unique_ptr<CharacterClass> charClass()
+    {
+        auto characterClass = std::make_unique<CharacterClass>();
+
+        characterClass->m_matches.swap(m_matches);
+        characterClass->m_ranges.swap(m_ranges);
+        characterClass->m_matchesUnicode.swap(m_matchesUnicode);
+        characterClass->m_rangesUnicode.swap(m_rangesUnicode);
+
+        return characterClass;
+    }
+
+private:
+    void addSorted(UChar32 ch)
+    {
+        addSorted(isASCII(ch) ? m_matches : m_matchesUnicode, ch);
+    }
+
+    void addSorted(Vector<UChar32>& matches, UChar32 ch)
+    {
+        unsigned pos = 0;
+        unsigned range = matches.size();
+
+        // binary chop, find position to insert char.
+        while (range) {
+            unsigned index = range >> 1;
+
+            int val = matches[pos+index] - ch;
+            if (!val)
+                return;
+            else if (val > 0)
+                range = index;
+            else {
+                pos += (index+1);
+                range -= (index+1);
+            }
+        }
+        
+        if (pos == matches.size())
+            matches.append(ch);
+        else
+            matches.insert(pos, ch);
+    }
+
+    void addSortedRange(Vector<CharacterRange>& ranges, UChar32 lo, UChar32 hi)
+    {
+        unsigned end = ranges.size();
+        
+        // Simple linear scan - I doubt there are that many ranges anyway...
+        // feel free to fix this with something faster (eg binary chop).
+        for (unsigned i = 0; i < end; ++i) {
+            // does the new range fall before the current position in the array
+            if (hi < ranges[i].begin) {
+                // optional optimization: concatenate appending ranges? - may not be worthwhile.
+                if (hi == (ranges[i].begin - 1)) {
+                    ranges[i].begin = lo;
+                    return;
+                }
+                ranges.insert(i, CharacterRange(lo, hi));
+                return;
+            }
+            // Okay, since we didn't hit the last case, the end of the new range is definitely at or after the begining
+            // If the new range start at or before the end of the last range, then the overlap (if it starts one after the
+            // end of the last range they concatenate, which is just as good.
+            if (lo <= (ranges[i].end + 1)) {
+                // found an intersect! we'll replace this entry in the array.
+                ranges[i].begin = std::min(ranges[i].begin, lo);
+                ranges[i].end = std::max(ranges[i].end, hi);
+
+                // now check if the new range can subsume any subsequent ranges.
+                unsigned next = i+1;
+                // each iteration of the loop we will either remove something from the list, or break the loop.
+                while (next < ranges.size()) {
+                    if (ranges[next].begin <= (ranges[i].end + 1)) {
+                        // the next entry now overlaps / concatenates this one.
+                        ranges[i].end = std::max(ranges[i].end, ranges[next].end);
+                        ranges.remove(next);
+                    } else
+                        break;
+                }
+                
+                return;
+            }
+        }
+
+        // CharacterRange comes after all existing ranges.
+        ranges.append(CharacterRange(lo, hi));
+    }
+
+    bool m_isCaseInsensitive;
+    CanonicalMode m_canonicalMode;
+
+    Vector<UChar32> m_matches;
+    Vector<CharacterRange> m_ranges;
+    Vector<UChar32> m_matchesUnicode;
+    Vector<CharacterRange> m_rangesUnicode;
+};
+
+class YarrPatternConstructor {
+public:
+    YarrPatternConstructor(YarrPattern& pattern, void* stackLimit)
+        : m_pattern(pattern)
+        , m_characterClassConstructor(pattern.ignoreCase(), pattern.unicode() ? CanonicalMode::Unicode : CanonicalMode::UCS2)
+        , m_stackLimit(stackLimit)
+        , m_invertParentheticalAssertion(false)
+    {
+        auto body = std::make_unique<PatternDisjunction>();
+        m_pattern.m_body = body.get();
+        m_alternative = body->addNewAlternative();
+        m_pattern.m_disjunctions.append(WTFMove(body));
+    }
+
+    ~YarrPatternConstructor()
+    {
+    }
+
+    void reset()
+    {
+        m_pattern.reset();
+        m_characterClassConstructor.reset();
+
+        auto body = std::make_unique<PatternDisjunction>();
+        m_pattern.m_body = body.get();
+        m_alternative = body->addNewAlternative();
+        m_pattern.m_disjunctions.append(WTFMove(body));
+    }
+    
+    void assertionBOL()
+    {
+        if (!m_alternative->m_terms.size() && !m_invertParentheticalAssertion) {
+            m_alternative->m_startsWithBOL = true;
+            m_alternative->m_containsBOL = true;
+            m_pattern.m_containsBOL = true;
+        }
+        m_alternative->m_terms.append(PatternTerm::BOL());
+    }
+    void assertionEOL()
+    {
+        m_alternative->m_terms.append(PatternTerm::EOL());
+    }
+    void assertionWordBoundary(bool invert)
+    {
+        m_alternative->m_terms.append(PatternTerm::WordBoundary(invert));
+    }
+
+    void atomPatternCharacter(UChar32 ch)
+    {
+        // We handle case-insensitive checking of unicode characters which do have both
+        // cases by handling them as if they were defined using a CharacterClass.
+        if (!m_pattern.ignoreCase() || (isASCII(ch) && !m_pattern.unicode())) {
+            m_alternative->m_terms.append(PatternTerm(ch));
+            return;
+        }
+
+        const CanonicalizationRange* info = canonicalRangeInfoFor(ch, m_pattern.unicode() ? CanonicalMode::Unicode : CanonicalMode::UCS2);
+        if (info->type == CanonicalizeUnique) {
+            m_alternative->m_terms.append(PatternTerm(ch));
+            return;
+        }
+
+        m_characterClassConstructor.putUnicodeIgnoreCase(ch, info);
+        auto newCharacterClass = m_characterClassConstructor.charClass();
+        m_alternative->m_terms.append(PatternTerm(newCharacterClass.get(), false));
+        m_pattern.m_userCharacterClasses.append(WTFMove(newCharacterClass));
+    }
+
+    void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert)
+    {
+        switch (classID) {
+        case DigitClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.digitsCharacterClass(), invert));
+            break;
+        case SpaceClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.spacesCharacterClass(), invert));
+            break;
+        case WordClassID:
+            if (m_pattern.unicode() && m_pattern.ignoreCase())
+                m_alternative->m_terms.append(PatternTerm(m_pattern.wordUnicodeIgnoreCaseCharCharacterClass(), invert));
+            else
+                m_alternative->m_terms.append(PatternTerm(m_pattern.wordcharCharacterClass(), invert));
+            break;
+        case NewlineClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.newlineCharacterClass(), invert));
+            break;
+        }
+    }
+
+    void atomCharacterClassBegin(bool invert = false)
+    {
+        m_invertCharacterClass = invert;
+    }
+
+    void atomCharacterClassAtom(UChar32 ch)
+    {
+        m_characterClassConstructor.putChar(ch);
+    }
+
+    void atomCharacterClassRange(UChar32 begin, UChar32 end)
+    {
+        m_characterClassConstructor.putRange(begin, end);
+    }
+
+    void atomCharacterClassBuiltIn(BuiltInCharacterClassID classID, bool invert)
+    {
+        ASSERT(classID != NewlineClassID);
+
+        switch (classID) {
+        case DigitClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nondigitsCharacterClass() : m_pattern.digitsCharacterClass());
+            break;
+        
+        case SpaceClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nonspacesCharacterClass() : m_pattern.spacesCharacterClass());
+            break;
+        
+        case WordClassID:
+            if (m_pattern.unicode() && m_pattern.ignoreCase())
+                m_characterClassConstructor.append(invert ? m_pattern.nonwordUnicodeIgnoreCaseCharCharacterClass() : m_pattern.wordUnicodeIgnoreCaseCharCharacterClass());
+            else
+                m_characterClassConstructor.append(invert ? m_pattern.nonwordcharCharacterClass() : m_pattern.wordcharCharacterClass());
+            break;
+        
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
+    void atomCharacterClassEnd()
+    {
+        auto newCharacterClass = m_characterClassConstructor.charClass();
+        m_alternative->m_terms.append(PatternTerm(newCharacterClass.get(), m_invertCharacterClass));
+        m_pattern.m_userCharacterClasses.append(WTFMove(newCharacterClass));
+    }
+
+    void atomParenthesesSubpatternBegin(bool capture = true)
+    {
+        unsigned subpatternId = m_pattern.m_numSubpatterns + 1;
+        if (capture)
+            m_pattern.m_numSubpatterns++;
+
+        auto parenthesesDisjunction = std::make_unique<PatternDisjunction>(m_alternative);
+        m_alternative->m_terms.append(PatternTerm(PatternTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction.get(), capture, false));
+        m_alternative = parenthesesDisjunction->addNewAlternative();
+        m_pattern.m_disjunctions.append(WTFMove(parenthesesDisjunction));
+    }
+
+    void atomParentheticalAssertionBegin(bool invert = false)
+    {
+        auto parenthesesDisjunction = std::make_unique<PatternDisjunction>(m_alternative);
+        m_alternative->m_terms.append(PatternTerm(PatternTerm::TypeParentheticalAssertion, m_pattern.m_numSubpatterns + 1, parenthesesDisjunction.get(), false, invert));
+        m_alternative = parenthesesDisjunction->addNewAlternative();
+        m_invertParentheticalAssertion = invert;
+        m_pattern.m_disjunctions.append(WTFMove(parenthesesDisjunction));
+    }
+
+    void atomParenthesesEnd()
+    {
+        ASSERT(m_alternative->m_parent);
+        ASSERT(m_alternative->m_parent->m_parent);
+
+        PatternDisjunction* parenthesesDisjunction = m_alternative->m_parent;
+        m_alternative = m_alternative->m_parent->m_parent;
+
+        PatternTerm& lastTerm = m_alternative->lastTerm();
+
+        unsigned numParenAlternatives = parenthesesDisjunction->m_alternatives.size();
+        unsigned numBOLAnchoredAlts = 0;
+
+        for (unsigned i = 0; i < numParenAlternatives; i++) {
+            // Bubble up BOL flags
+            if (parenthesesDisjunction->m_alternatives[i]->m_startsWithBOL)
+                numBOLAnchoredAlts++;
+        }
+
+        if (numBOLAnchoredAlts) {
+            m_alternative->m_containsBOL = true;
+            // If all the alternatives in parens start with BOL, then so does this one
+            if (numBOLAnchoredAlts == numParenAlternatives)
+                m_alternative->m_startsWithBOL = true;
+        }
+
+        lastTerm.parentheses.lastSubpatternId = m_pattern.m_numSubpatterns;
+        m_invertParentheticalAssertion = false;
+    }
+
+    void atomBackReference(unsigned subpatternId)
+    {
+        ASSERT(subpatternId);
+        m_pattern.m_containsBackreferences = true;
+        m_pattern.m_maxBackReference = std::max(m_pattern.m_maxBackReference, subpatternId);
+
+        if (subpatternId > m_pattern.m_numSubpatterns) {
+            m_alternative->m_terms.append(PatternTerm::ForwardReference());
+            return;
+        }
+
+        PatternAlternative* currentAlternative = m_alternative;
+        ASSERT(currentAlternative);
+
+        // Note to self: if we waited until the AST was baked, we could also remove forwards refs 
+        while ((currentAlternative = currentAlternative->m_parent->m_parent)) {
+            PatternTerm& term = currentAlternative->lastTerm();
+            ASSERT((term.type == PatternTerm::TypeParenthesesSubpattern) || (term.type == PatternTerm::TypeParentheticalAssertion));
+
+            if ((term.type == PatternTerm::TypeParenthesesSubpattern) && term.capture() && (subpatternId == term.parentheses.subpatternId)) {
+                m_alternative->m_terms.append(PatternTerm::ForwardReference());
+                return;
+            }
+        }
+
+        m_alternative->m_terms.append(PatternTerm(subpatternId));
+    }
+
+    // deep copy the argument disjunction.  If filterStartsWithBOL is true, 
+    // skip alternatives with m_startsWithBOL set true.
+    PatternDisjunction* copyDisjunction(PatternDisjunction* disjunction, bool filterStartsWithBOL = false)
+    {
+        std::unique_ptr<PatternDisjunction> newDisjunction;
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            PatternAlternative* alternative = disjunction->m_alternatives[alt].get();
+            if (!filterStartsWithBOL || !alternative->m_startsWithBOL) {
+                if (!newDisjunction) {
+                    newDisjunction = std::make_unique<PatternDisjunction>();
+                    newDisjunction->m_parent = disjunction->m_parent;
+                }
+                PatternAlternative* newAlternative = newDisjunction->addNewAlternative();
+                newAlternative->m_terms.reserveInitialCapacity(alternative->m_terms.size());
+                for (unsigned i = 0; i < alternative->m_terms.size(); ++i)
+                    newAlternative->m_terms.append(copyTerm(alternative->m_terms[i], filterStartsWithBOL));
+            }
+        }
+        
+        if (!newDisjunction)
+            return 0;
+
+        PatternDisjunction* copiedDisjunction = newDisjunction.get();
+        m_pattern.m_disjunctions.append(WTFMove(newDisjunction));
+        return copiedDisjunction;
+    }
+    
+    PatternTerm copyTerm(PatternTerm& term, bool filterStartsWithBOL = false)
+    {
+        if ((term.type != PatternTerm::TypeParenthesesSubpattern) && (term.type != PatternTerm::TypeParentheticalAssertion))
+            return PatternTerm(term);
+        
+        PatternTerm termCopy = term;
+        termCopy.parentheses.disjunction = copyDisjunction(termCopy.parentheses.disjunction, filterStartsWithBOL);
+        m_pattern.m_hasCopiedParenSubexpressions = true;
+        return termCopy;
+    }
+    
+    void quantifyAtom(unsigned min, unsigned max, bool greedy)
+    {
+        ASSERT(min <= max);
+        ASSERT(m_alternative->m_terms.size());
+
+        if (!max) {
+            m_alternative->removeLastTerm();
+            return;
+        }
+
+        PatternTerm& term = m_alternative->lastTerm();
+        ASSERT(term.type > PatternTerm::TypeAssertionWordBoundary);
+        ASSERT(term.quantityMinCount == 1 && term.quantityMaxCount == 1 && term.quantityType == QuantifierFixedCount);
+
+        if (term.type == PatternTerm::TypeParentheticalAssertion) {
+            // If an assertion is quantified with a minimum count of zero, it can simply be removed.
+            // This arises from the RepeatMatcher behaviour in the spec. Matching an assertion never
+            // results in any input being consumed, however the continuation passed to the assertion
+            // (called in steps, 8c and 9 of the RepeatMatcher definition, ES5.1 15.10.2.5) will
+            // reject all zero length matches (see step 2.1). A match from the continuation of the
+            // expression will still be accepted regardless (via steps 8a and 11) - the upshot of all
+            // this is that matches from the assertion are not required, and won't be accepted anyway,
+            // so no need to ever run it.
+            if (!min)
+                m_alternative->removeLastTerm();
+            // We never need to run an assertion more than once. Subsequent interations will be run
+            // with the same start index (since assertions are non-capturing) and the same captures
+            // (per step 4 of RepeatMatcher in ES5.1 15.10.2.5), and as such will always produce the
+            // same result and captures. If the first match succeeds then the subsequent (min - 1)
+            // matches will too. Any additional optional matches will fail (on the same basis as the
+            // minimum zero quantified assertions, above), but this will still result in a match.
+            return;
+        }
+
+        if (min == max)
+            term.quantify(min, max, QuantifierFixedCount);
+        else if (!min || (term.type == PatternTerm::TypeParenthesesSubpattern && m_pattern.m_hasCopiedParenSubexpressions))
+            term.quantify(min, max, greedy ? QuantifierGreedy : QuantifierNonGreedy);
+        else {
+            term.quantify(min, min, QuantifierFixedCount);
+            m_alternative->m_terms.append(copyTerm(term));
+            // NOTE: this term is interesting from an analysis perspective, in that it can be ignored.....
+            m_alternative->lastTerm().quantify((max == quantifyInfinite) ? max : max - min, greedy ? QuantifierGreedy : QuantifierNonGreedy);
+            if (m_alternative->lastTerm().type == PatternTerm::TypeParenthesesSubpattern)
+                m_alternative->lastTerm().parentheses.isCopy = true;
+        }
+    }
+
+    void disjunction()
+    {
+        m_alternative = m_alternative->m_parent->addNewAlternative();
+    }
+
+    YarrPattern::ErrorCode setupAlternativeOffsets(PatternAlternative* alternative, unsigned currentCallFrameSize, unsigned initialInputPosition, unsigned& newCallFrameSize) WARN_UNUSED_RETURN
+    {
+        if (UNLIKELY(!isSafeToRecurse()))
+            return YarrPattern::TooManyDisjunctions;
+
+        YarrPattern::ErrorCode error = YarrPattern::NoError;
+        alternative->m_hasFixedSize = true;
+        Checked<unsigned, RecordOverflow> currentInputPosition = initialInputPosition;
+
+        for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+            PatternTerm& term = alternative->m_terms[i];
+
+            switch (term.type) {
+            case PatternTerm::TypeAssertionBOL:
+            case PatternTerm::TypeAssertionEOL:
+            case PatternTerm::TypeAssertionWordBoundary:
+                term.inputPosition = currentInputPosition.unsafeGet();
+                break;
+
+            case PatternTerm::TypeBackReference:
+                term.inputPosition = currentInputPosition.unsafeGet();
+                term.frameLocation = currentCallFrameSize;
+                currentCallFrameSize += YarrStackSpaceForBackTrackInfoBackReference;
+                alternative->m_hasFixedSize = false;
+                break;
+
+            case PatternTerm::TypeForwardReference:
+                break;
+
+            case PatternTerm::TypePatternCharacter:
+                term.inputPosition = currentInputPosition.unsafeGet();
+                if (term.quantityType != QuantifierFixedCount) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += YarrStackSpaceForBackTrackInfoPatternCharacter;
+                    alternative->m_hasFixedSize = false;
+                } else if (m_pattern.unicode()) {
+                    currentInputPosition += U16_LENGTH(term.patternCharacter) * term.quantityMaxCount;
+                } else
+                    currentInputPosition += term.quantityMaxCount;
+                break;
+
+            case PatternTerm::TypeCharacterClass:
+                term.inputPosition = currentInputPosition.unsafeGet();
+                if (term.quantityType != QuantifierFixedCount) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += YarrStackSpaceForBackTrackInfoCharacterClass;
+                    alternative->m_hasFixedSize = false;
+                } else if (m_pattern.unicode()) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += YarrStackSpaceForBackTrackInfoCharacterClass;
+                    currentInputPosition += term.quantityMaxCount;
+                    alternative->m_hasFixedSize = false;
+                } else
+                    currentInputPosition += term.quantityMaxCount;
+                break;
+
+            case PatternTerm::TypeParenthesesSubpattern:
+                // Note: for fixed once parentheses we will ensure at least the minimum is available; others are on their own.
+                term.frameLocation = currentCallFrameSize;
+                if (term.quantityMaxCount == 1 && !term.parentheses.isCopy) {
+                    if (term.quantityType != QuantifierFixedCount)
+                        currentCallFrameSize += YarrStackSpaceForBackTrackInfoParenthesesOnce;
+                    error = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize, currentInputPosition.unsafeGet(), currentCallFrameSize);
+                    if (error)
+                        return error;
+                    // If quantity is fixed, then pre-check its minimum size.
+                    if (term.quantityType == QuantifierFixedCount)
+                        currentInputPosition += term.parentheses.disjunction->m_minimumSize;
+                    term.inputPosition = currentInputPosition.unsafeGet();
+                } else if (term.parentheses.isTerminal) {
+                    currentCallFrameSize += YarrStackSpaceForBackTrackInfoParenthesesTerminal;
+                    error = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize, currentInputPosition.unsafeGet(), currentCallFrameSize);
+                    if (error)
+                        return error;
+                    term.inputPosition = currentInputPosition.unsafeGet();
+                } else {
+                    term.inputPosition = currentInputPosition.unsafeGet();
+                    unsigned ignoredCallFrameSize;
+                    error = setupDisjunctionOffsets(term.parentheses.disjunction, 0, currentInputPosition.unsafeGet(), ignoredCallFrameSize);
+                    if (error)
+                        return error;
+                    currentCallFrameSize += YarrStackSpaceForBackTrackInfoParentheses;
+                }
+                // Fixed count of 1 could be accepted, if they have a fixed size *AND* if all alternatives are of the same length.
+                alternative->m_hasFixedSize = false;
+                break;
+
+            case PatternTerm::TypeParentheticalAssertion:
+                term.inputPosition = currentInputPosition.unsafeGet();
+                term.frameLocation = currentCallFrameSize;
+                error = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize + YarrStackSpaceForBackTrackInfoParentheticalAssertion, currentInputPosition.unsafeGet(), currentCallFrameSize);
+                if (error)
+                    return error;
+                break;
+
+            case PatternTerm::TypeDotStarEnclosure:
+                alternative->m_hasFixedSize = false;
+                term.inputPosition = initialInputPosition;
+                break;
+            }
+            if (currentInputPosition.hasOverflowed())
+                return YarrPattern::OffsetTooLarge;
+        }
+
+        alternative->m_minimumSize = (currentInputPosition - initialInputPosition).unsafeGet();
+        newCallFrameSize = currentCallFrameSize;
+        return error;
+    }
+
+    YarrPattern::ErrorCode setupDisjunctionOffsets(PatternDisjunction* disjunction, unsigned initialCallFrameSize, unsigned initialInputPosition, unsigned& callFrameSize)
+    {
+        if (UNLIKELY(!isSafeToRecurse()))
+            return YarrPattern::TooManyDisjunctions;
+
+        if ((disjunction != m_pattern.m_body) && (disjunction->m_alternatives.size() > 1))
+            initialCallFrameSize += YarrStackSpaceForBackTrackInfoAlternative;
+
+        unsigned minimumInputSize = UINT_MAX;
+        unsigned maximumCallFrameSize = 0;
+        bool hasFixedSize = true;
+        YarrPattern::ErrorCode error = YarrPattern::NoError;
+
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            PatternAlternative* alternative = disjunction->m_alternatives[alt].get();
+            unsigned currentAlternativeCallFrameSize;
+            error = setupAlternativeOffsets(alternative, initialCallFrameSize, initialInputPosition, currentAlternativeCallFrameSize);
+            if (error)
+                return error;
+            minimumInputSize = std::min(minimumInputSize, alternative->m_minimumSize);
+            maximumCallFrameSize = std::max(maximumCallFrameSize, currentAlternativeCallFrameSize);
+            hasFixedSize &= alternative->m_hasFixedSize;
+            if (alternative->m_minimumSize > INT_MAX)
+                m_pattern.m_containsUnsignedLengthPattern = true;
+        }
+        
+        ASSERT(minimumInputSize != UINT_MAX);
+        ASSERT(maximumCallFrameSize >= initialCallFrameSize);
+
+        disjunction->m_hasFixedSize = hasFixedSize;
+        disjunction->m_minimumSize = minimumInputSize;
+        disjunction->m_callFrameSize = maximumCallFrameSize;
+        callFrameSize = maximumCallFrameSize;
+        return error;
+    }
+
+    const char* setupOffsets()
+    {
+        // FIXME: Yarr should not use the stack to handle subpatterns (rdar://problem/26436314).
+        unsigned ignoredCallFrameSize;
+        YarrPattern::ErrorCode error = setupDisjunctionOffsets(m_pattern.m_body, 0, 0, ignoredCallFrameSize);
+        if (error)
+            return YarrPattern::errorMessage(error);
+        return nullptr;
+    }
+
+    // This optimization identifies sets of parentheses that we will never need to backtrack.
+    // In these cases we do not need to store state from prior iterations.
+    // We can presently avoid backtracking for:
+    //   * where the parens are at the end of the regular expression (last term in any of the
+    //     alternatives of the main body disjunction).
+    //   * where the parens are non-capturing, and quantified unbounded greedy (*).
+    //   * where the parens do not contain any capturing subpatterns.
+    void checkForTerminalParentheses()
+    {
+        // This check is much too crude; should be just checking whether the candidate
+        // node contains nested capturing subpatterns, not the whole expression!
+        if (m_pattern.m_numSubpatterns)
+            return;
+
+        Vector<std::unique_ptr<PatternAlternative>>& alternatives = m_pattern.m_body->m_alternatives;
+        for (size_t i = 0; i < alternatives.size(); ++i) {
+            Vector<PatternTerm>& terms = alternatives[i]->m_terms;
+            if (terms.size()) {
+                PatternTerm& term = terms.last();
+                if (term.type == PatternTerm::TypeParenthesesSubpattern
+                    && term.quantityType == QuantifierGreedy
+                    && term.quantityMinCount == 0
+                    && term.quantityMaxCount == quantifyInfinite
+                    && !term.capture())
+                    term.parentheses.isTerminal = true;
+            }
+        }
+    }
+
+    void optimizeBOL()
+    {
+        // Look for expressions containing beginning of line (^) anchoring and unroll them.
+        // e.g. /^a|^b|c/ becomes /^a|^b|c/ which is executed once followed by /c/ which loops
+        // This code relies on the parsing code tagging alternatives with m_containsBOL and
+        // m_startsWithBOL and rolling those up to containing alternatives.
+        // At this point, this is only valid for non-multiline expressions.
+        PatternDisjunction* disjunction = m_pattern.m_body;
+        
+        if (!m_pattern.m_containsBOL || m_pattern.multiline())
+            return;
+        
+        PatternDisjunction* loopDisjunction = copyDisjunction(disjunction, true);
+
+        // Set alternatives in disjunction to "onceThrough"
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt)
+            disjunction->m_alternatives[alt]->setOnceThrough();
+
+        if (loopDisjunction) {
+            // Move alternatives from loopDisjunction to disjunction
+            for (unsigned alt = 0; alt < loopDisjunction->m_alternatives.size(); ++alt)
+                disjunction->m_alternatives.append(loopDisjunction->m_alternatives[alt].release());
+                
+            loopDisjunction->m_alternatives.clear();
+        }
+    }
+
+    bool containsCapturingTerms(PatternAlternative* alternative, size_t firstTermIndex, size_t endIndex)
+    {
+        Vector<PatternTerm>& terms = alternative->m_terms;
+
+        ASSERT(endIndex <= terms.size());
+        for (size_t termIndex = firstTermIndex; termIndex < endIndex; ++termIndex) {
+            PatternTerm& term = terms[termIndex];
+
+            if (term.m_capture)
+                return true;
+
+            if (term.type == PatternTerm::TypeParenthesesSubpattern) {
+                PatternDisjunction* nestedDisjunction = term.parentheses.disjunction;
+                for (unsigned alt = 0; alt < nestedDisjunction->m_alternatives.size(); ++alt) {
+                    if (containsCapturingTerms(nestedDisjunction->m_alternatives[alt].get(), 0, nestedDisjunction->m_alternatives[alt]->m_terms.size()))
+                        return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    // This optimization identifies alternatives in the form of 
+    // [^].*[?]<expression>.*[$] for expressions that don't have any 
+    // capturing terms. The alternative is changed to <expression> 
+    // followed by processing of the dot stars to find and adjust the 
+    // beginning and the end of the match.
+    void optimizeDotStarWrappedExpressions()
+    {
+        Vector<std::unique_ptr<PatternAlternative>>& alternatives = m_pattern.m_body->m_alternatives;
+        if (alternatives.size() != 1)
+            return;
+
+        PatternAlternative* alternative = alternatives[0].get();
+        Vector<PatternTerm>& terms = alternative->m_terms;
+        if (terms.size() >= 3) {
+            bool startsWithBOL = false;
+            bool endsWithEOL = false;
+            size_t termIndex, firstExpressionTerm;
+
+            termIndex = 0;
+            if (terms[termIndex].type == PatternTerm::TypeAssertionBOL) {
+                startsWithBOL = true;
+                ++termIndex;
+            }
+            
+            PatternTerm& firstNonAnchorTerm = terms[termIndex];
+            if ((firstNonAnchorTerm.type != PatternTerm::TypeCharacterClass) || (firstNonAnchorTerm.characterClass != m_pattern.newlineCharacterClass()) || !((firstNonAnchorTerm.quantityType == QuantifierGreedy) || (firstNonAnchorTerm.quantityType == QuantifierNonGreedy)))
+                return;
+            
+            firstExpressionTerm = termIndex + 1;
+            
+            termIndex = terms.size() - 1;
+            if (terms[termIndex].type == PatternTerm::TypeAssertionEOL) {
+                endsWithEOL = true;
+                --termIndex;
+            }
+            
+            PatternTerm& lastNonAnchorTerm = terms[termIndex];
+            if ((lastNonAnchorTerm.type != PatternTerm::TypeCharacterClass) || (lastNonAnchorTerm.characterClass != m_pattern.newlineCharacterClass()) || (lastNonAnchorTerm.quantityType != QuantifierGreedy))
+                return;
+
+            size_t endIndex = termIndex;
+            if (firstExpressionTerm >= endIndex)
+                return;
+
+            if (!containsCapturingTerms(alternative, firstExpressionTerm, endIndex)) {
+                for (termIndex = terms.size() - 1; termIndex >= endIndex; --termIndex)
+                    terms.remove(termIndex);
+
+                for (termIndex = firstExpressionTerm; termIndex > 0; --termIndex)
+                    terms.remove(termIndex - 1);
+
+                terms.append(PatternTerm(startsWithBOL, endsWithEOL));
+                
+                m_pattern.m_containsBOL = false;
+            }
+        }
+    }
+
+private:
+    bool isSafeToRecurse() const
+    {
+        if (!m_stackLimit)
+            return true;
+        ASSERT(wtfThreadData().stack().isGrowingDownward());
+        int8_t* curr = reinterpret_cast<int8_t*>(&curr);
+        int8_t* limit = reinterpret_cast<int8_t*>(m_stackLimit);
+        return curr >= limit;
+    }
+
+    YarrPattern& m_pattern;
+    PatternAlternative* m_alternative;
+    CharacterClassConstructor m_characterClassConstructor;
+    void* m_stackLimit;
+    bool m_invertCharacterClass;
+    bool m_invertParentheticalAssertion;
+};
+
+const char* YarrPattern::errorMessage(YarrPattern::ErrorCode error)
+{
+#define REGEXP_ERROR_PREFIX "Invalid regular expression: "
+    // The order of this array must match the ErrorCode enum.
+    static const char* errorMessages[NumberOfErrorCodes] = {
+        nullptr, // NoError
+        REGEXP_ERROR_PREFIX "regular expression too large",
+        REGEXP_ERROR_PREFIX "numbers out of order in {} quantifier",
+        REGEXP_ERROR_PREFIX "nothing to repeat",
+        REGEXP_ERROR_PREFIX "number too large in {} quantifier",
+        REGEXP_ERROR_PREFIX "missing )",
+        REGEXP_ERROR_PREFIX "unmatched parentheses",
+        REGEXP_ERROR_PREFIX "unrecognized character after (?",
+        REGEXP_ERROR_PREFIX "missing terminating ] for character class",
+        REGEXP_ERROR_PREFIX "range out of order in character class",
+        REGEXP_ERROR_PREFIX "\\ at end of pattern",
+        REGEXP_ERROR_PREFIX "invalid unicode {} escape",
+        REGEXP_ERROR_PREFIX "invalid escaped character for unicode pattern",
+        REGEXP_ERROR_PREFIX "too many nested disjunctions",
+        REGEXP_ERROR_PREFIX "pattern exceeds string length limits",
+        REGEXP_ERROR_PREFIX "invalid flags"
+    };
+
+    return errorMessages[error];
+}
+
+const char* YarrPattern::compile(const String& patternString, void* stackLimit)
+{
+    YarrPatternConstructor constructor(*this, stackLimit);
+
+    if (m_flags == InvalidFlags)
+        return errorMessage(InvalidRegularExpressionFlags);
+
+    if (const char* error = parse(constructor, patternString, unicode()))
+        return error;
+    
+    // If the pattern contains illegal backreferences reset & reparse.
+    // Quoting Netscape's "What's new in JavaScript 1.2",
+    //      "Note: if the number of left parentheses is less than the number specified
+    //       in \#, the \# is taken as an octal escape as described in the next row."
+    if (containsIllegalBackReference()) {
+        unsigned numSubpatterns = m_numSubpatterns;
+
+        constructor.reset();
+#if !ASSERT_DISABLED
+        const char* error =
+#endif
+            parse(constructor, patternString, unicode(), numSubpatterns);
+
+        ASSERT(!error);
+        ASSERT(numSubpatterns == m_numSubpatterns);
+    }
+
+    constructor.checkForTerminalParentheses();
+    constructor.optimizeDotStarWrappedExpressions();
+    constructor.optimizeBOL();
+        
+    if (const char* error = constructor.setupOffsets())
+        return error;
+
+    return nullptr;
+}
+
+YarrPattern::YarrPattern(const String& pattern, RegExpFlags flags, const char** error, void* stackLimit)
+    : m_containsBackreferences(false)
+    , m_containsBOL(false)
+    , m_containsUnsignedLengthPattern(false)
+    , m_hasCopiedParenSubexpressions(false)
+    , m_flags(flags)
+    , m_numSubpatterns(0)
+    , m_maxBackReference(0)
+    , newlineCached(0)
+    , digitsCached(0)
+    , spacesCached(0)
+    , wordcharCached(0)
+    , wordUnicodeIgnoreCaseCharCached(0)
+    , nondigitsCached(0)
+    , nonspacesCached(0)
+    , nonwordcharCached(0)
+    , nonwordUnicodeIgnoreCasecharCached(0)
+{
+    *error = compile(pattern, stackLimit);
+}
+
+} }
diff --git a/yarr/YarrPattern.h b/yarr/YarrPattern.h
new file mode 100644
index 0000000..2db32d9
--- /dev/null
+++ b/yarr/YarrPattern.h
@@ -0,0 +1,478 @@
+/*
+ * Copyright (C) 2009, 2013-2014, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Peter Varga (pvarga@inf.u-szeged.hu), University of Szeged
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include "RegExpKey.h"
+#include <wtf/CheckedArithmetic.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC { namespace Yarr {
+
+struct PatternDisjunction;
+
+struct CharacterRange {
+    UChar32 begin;
+    UChar32 end;
+
+    CharacterRange(UChar32 begin, UChar32 end)
+        : begin(begin)
+        , end(end)
+    {
+    }
+};
+
+struct CharacterClass {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    // All CharacterClass instances have to have the full set of matches and ranges,
+    // they may have an optional m_table for faster lookups (which must match the
+    // specified matches and ranges)
+    CharacterClass()
+        : m_table(0)
+    {
+    }
+    CharacterClass(const char* table, bool inverted)
+        : m_table(table)
+        , m_tableInverted(inverted)
+    {
+    }
+    Vector<UChar32> m_matches;
+    Vector<CharacterRange> m_ranges;
+    Vector<UChar32> m_matchesUnicode;
+    Vector<CharacterRange> m_rangesUnicode;
+
+    const char* m_table;
+    bool m_tableInverted;
+};
+
+enum QuantifierType {
+    QuantifierFixedCount,
+    QuantifierGreedy,
+    QuantifierNonGreedy,
+};
+
+struct PatternTerm {
+    enum Type {
+        TypeAssertionBOL,
+        TypeAssertionEOL,
+        TypeAssertionWordBoundary,
+        TypePatternCharacter,
+        TypeCharacterClass,
+        TypeBackReference,
+        TypeForwardReference,
+        TypeParenthesesSubpattern,
+        TypeParentheticalAssertion,
+        TypeDotStarEnclosure,
+    } type;
+    bool m_capture :1;
+    bool m_invert :1;
+    union {
+        UChar32 patternCharacter;
+        CharacterClass* characterClass;
+        unsigned backReferenceSubpatternId;
+        struct {
+            PatternDisjunction* disjunction;
+            unsigned subpatternId;
+            unsigned lastSubpatternId;
+            bool isCopy;
+            bool isTerminal;
+        } parentheses;
+        struct {
+            bool bolAnchor : 1;
+            bool eolAnchor : 1;
+        } anchors;
+    };
+    QuantifierType quantityType;
+    Checked<unsigned> quantityMinCount;
+    Checked<unsigned> quantityMaxCount;
+    unsigned inputPosition;
+    unsigned frameLocation;
+
+    PatternTerm(UChar32 ch)
+        : type(PatternTerm::TypePatternCharacter)
+        , m_capture(false)
+        , m_invert(false)
+    {
+        patternCharacter = ch;
+        quantityType = QuantifierFixedCount;
+        quantityMinCount = quantityMaxCount = 1;
+    }
+
+    PatternTerm(CharacterClass* charClass, bool invert)
+        : type(PatternTerm::TypeCharacterClass)
+        , m_capture(false)
+        , m_invert(invert)
+    {
+        characterClass = charClass;
+        quantityType = QuantifierFixedCount;
+        quantityMinCount = quantityMaxCount = 1;
+    }
+
+    PatternTerm(Type type, unsigned subpatternId, PatternDisjunction* disjunction, bool capture = false, bool invert = false)
+        : type(type)
+        , m_capture(capture)
+        , m_invert(invert)
+    {
+        parentheses.disjunction = disjunction;
+        parentheses.subpatternId = subpatternId;
+        parentheses.isCopy = false;
+        parentheses.isTerminal = false;
+        quantityType = QuantifierFixedCount;
+        quantityMinCount = quantityMaxCount = 1;
+    }
+    
+    PatternTerm(Type type, bool invert = false)
+        : type(type)
+        , m_capture(false)
+        , m_invert(invert)
+    {
+        quantityType = QuantifierFixedCount;
+        quantityMinCount = quantityMaxCount = 1;
+    }
+
+    PatternTerm(unsigned spatternId)
+        : type(TypeBackReference)
+        , m_capture(false)
+        , m_invert(false)
+    {
+        backReferenceSubpatternId = spatternId;
+        quantityType = QuantifierFixedCount;
+        quantityMinCount = quantityMaxCount = 1;
+    }
+
+    PatternTerm(bool bolAnchor, bool eolAnchor)
+        : type(TypeDotStarEnclosure)
+        , m_capture(false)
+        , m_invert(false)
+    {
+        anchors.bolAnchor = bolAnchor;
+        anchors.eolAnchor = eolAnchor;
+        quantityType = QuantifierFixedCount;
+        quantityMinCount = quantityMaxCount = 1;
+    }
+    
+    static PatternTerm ForwardReference()
+    {
+        return PatternTerm(TypeForwardReference);
+    }
+
+    static PatternTerm BOL()
+    {
+        return PatternTerm(TypeAssertionBOL);
+    }
+
+    static PatternTerm EOL()
+    {
+        return PatternTerm(TypeAssertionEOL);
+    }
+
+    static PatternTerm WordBoundary(bool invert)
+    {
+        return PatternTerm(TypeAssertionWordBoundary, invert);
+    }
+    
+    bool invert()
+    {
+        return m_invert;
+    }
+
+    bool capture()
+    {
+        return m_capture;
+    }
+    
+    void quantify(unsigned count, QuantifierType type)
+    {
+        quantityMinCount = 0;
+        quantityMaxCount = count;
+        quantityType = type;
+    }
+
+    void quantify(unsigned minCount, unsigned maxCount, QuantifierType type)
+    {
+        // Currently only Parentheses can specify a non-zero min with a different max.
+        ASSERT(this->type == TypeParenthesesSubpattern || !minCount || minCount == maxCount);
+        ASSERT(minCount <= maxCount);
+        quantityMinCount = minCount;
+        quantityMaxCount = maxCount;
+        quantityType = type;
+    }
+};
+
+struct PatternAlternative {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    PatternAlternative(PatternDisjunction* disjunction)
+        : m_parent(disjunction)
+        , m_onceThrough(false)
+        , m_hasFixedSize(false)
+        , m_startsWithBOL(false)
+        , m_containsBOL(false)
+    {
+    }
+
+    PatternTerm& lastTerm()
+    {
+        ASSERT(m_terms.size());
+        return m_terms[m_terms.size() - 1];
+    }
+    
+    void removeLastTerm()
+    {
+        ASSERT(m_terms.size());
+        m_terms.shrink(m_terms.size() - 1);
+    }
+    
+    void setOnceThrough()
+    {
+        m_onceThrough = true;
+    }
+    
+    bool onceThrough()
+    {
+        return m_onceThrough;
+    }
+
+    Vector<PatternTerm> m_terms;
+    PatternDisjunction* m_parent;
+    unsigned m_minimumSize;
+    bool m_onceThrough : 1;
+    bool m_hasFixedSize : 1;
+    bool m_startsWithBOL : 1;
+    bool m_containsBOL : 1;
+};
+
+struct PatternDisjunction {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    PatternDisjunction(PatternAlternative* parent = 0)
+        : m_parent(parent)
+        , m_hasFixedSize(false)
+    {
+    }
+    
+    PatternAlternative* addNewAlternative()
+    {
+        m_alternatives.append(std::make_unique<PatternAlternative>(this));
+        return static_cast<PatternAlternative*>(m_alternatives.last().get());
+    }
+
+    Vector<std::unique_ptr<PatternAlternative>> m_alternatives;
+    PatternAlternative* m_parent;
+    unsigned m_minimumSize;
+    unsigned m_callFrameSize;
+    bool m_hasFixedSize;
+};
+
+// You probably don't want to be calling these functions directly
+// (please to be calling newlineCharacterClass() et al on your
+// friendly neighborhood YarrPattern instance to get nicely
+// cached copies).
+std::unique_ptr<CharacterClass> newlineCreate();
+std::unique_ptr<CharacterClass> digitsCreate();
+std::unique_ptr<CharacterClass> spacesCreate();
+std::unique_ptr<CharacterClass> wordcharCreate();
+std::unique_ptr<CharacterClass> wordUnicodeIgnoreCaseCharCreate();
+std::unique_ptr<CharacterClass> nondigitsCreate();
+std::unique_ptr<CharacterClass> nonspacesCreate();
+std::unique_ptr<CharacterClass> nonwordcharCreate();
+std::unique_ptr<CharacterClass> nonwordUnicodeIgnoreCaseCharCreate();
+
+struct TermChain {
+    TermChain(PatternTerm term)
+        : term(term)
+    {}
+
+    PatternTerm term;
+    Vector<TermChain> hotTerms;
+};
+
+
+struct YarrPattern {
+    JS_EXPORT_PRIVATE YarrPattern(const String& pattern, RegExpFlags, const char** error, void* stackLimit = nullptr);
+
+    enum ErrorCode {
+        NoError,
+        PatternTooLarge,
+        QuantifierOutOfOrder,
+        QuantifierWithoutAtom,
+        QuantifierTooLarge,
+        MissingParentheses,
+        ParenthesesUnmatched,
+        ParenthesesTypeInvalid,
+        CharacterClassUnmatched,
+        CharacterClassOutOfOrder,
+        EscapeUnterminated,
+        InvalidUnicodeEscape,
+        InvalidIdentityEscape,
+        TooManyDisjunctions,
+        OffsetTooLarge,
+        InvalidRegularExpressionFlags,
+        NumberOfErrorCodes
+    };
+    
+    JS_EXPORT_PRIVATE static const char* errorMessage(ErrorCode);
+
+    void reset()
+    {
+        m_numSubpatterns = 0;
+        m_maxBackReference = 0;
+
+        m_containsBackreferences = false;
+        m_containsBOL = false;
+        m_containsUnsignedLengthPattern = false;
+        m_hasCopiedParenSubexpressions = false;
+
+        newlineCached = 0;
+        digitsCached = 0;
+        spacesCached = 0;
+        wordcharCached = 0;
+        wordUnicodeIgnoreCaseCharCached = 0;
+        nondigitsCached = 0;
+        nonspacesCached = 0;
+        nonwordcharCached = 0;
+        nonwordUnicodeIgnoreCasecharCached = 0;
+
+        m_disjunctions.clear();
+        m_userCharacterClasses.clear();
+    }
+
+    bool containsIllegalBackReference()
+    {
+        return m_maxBackReference > m_numSubpatterns;
+    }
+
+    bool containsUnsignedLengthPattern()
+    {
+        return m_containsUnsignedLengthPattern;
+    }
+
+    CharacterClass* newlineCharacterClass()
+    {
+        if (!newlineCached) {
+            m_userCharacterClasses.append(newlineCreate());
+            newlineCached = m_userCharacterClasses.last().get();
+        }
+        return newlineCached;
+    }
+    CharacterClass* digitsCharacterClass()
+    {
+        if (!digitsCached) {
+            m_userCharacterClasses.append(digitsCreate());
+            digitsCached = m_userCharacterClasses.last().get();
+        }
+        return digitsCached;
+    }
+    CharacterClass* spacesCharacterClass()
+    {
+        if (!spacesCached) {
+            m_userCharacterClasses.append(spacesCreate());
+            spacesCached = m_userCharacterClasses.last().get();
+        }
+        return spacesCached;
+    }
+    CharacterClass* wordcharCharacterClass()
+    {
+        if (!wordcharCached) {
+            m_userCharacterClasses.append(wordcharCreate());
+            wordcharCached = m_userCharacterClasses.last().get();
+        }
+        return wordcharCached;
+    }
+    CharacterClass* wordUnicodeIgnoreCaseCharCharacterClass()
+    {
+        if (!wordUnicodeIgnoreCaseCharCached) {
+            m_userCharacterClasses.append(wordUnicodeIgnoreCaseCharCreate());
+            wordUnicodeIgnoreCaseCharCached = m_userCharacterClasses.last().get();
+        }
+        return wordUnicodeIgnoreCaseCharCached;
+    }
+    CharacterClass* nondigitsCharacterClass()
+    {
+        if (!nondigitsCached) {
+            m_userCharacterClasses.append(nondigitsCreate());
+            nondigitsCached = m_userCharacterClasses.last().get();
+        }
+        return nondigitsCached;
+    }
+    CharacterClass* nonspacesCharacterClass()
+    {
+        if (!nonspacesCached) {
+            m_userCharacterClasses.append(nonspacesCreate());
+            nonspacesCached = m_userCharacterClasses.last().get();
+        }
+        return nonspacesCached;
+    }
+    CharacterClass* nonwordcharCharacterClass()
+    {
+        if (!nonwordcharCached) {
+            m_userCharacterClasses.append(nonwordcharCreate());
+            nonwordcharCached = m_userCharacterClasses.last().get();
+        }
+        return nonwordcharCached;
+    }
+    CharacterClass* nonwordUnicodeIgnoreCaseCharCharacterClass()
+    {
+        if (!nonwordUnicodeIgnoreCasecharCached) {
+            m_userCharacterClasses.append(nonwordUnicodeIgnoreCaseCharCreate());
+            nonwordUnicodeIgnoreCasecharCached = m_userCharacterClasses.last().get();
+        }
+        return nonwordUnicodeIgnoreCasecharCached;
+    }
+
+    bool ignoreCase() const { return m_flags & FlagIgnoreCase; }
+    bool multiline() const { return m_flags & FlagMultiline; }
+    bool sticky() const { return m_flags & FlagSticky; }
+    bool unicode() const { return m_flags & FlagUnicode; }
+
+    bool m_containsBackreferences : 1;
+    bool m_containsBOL : 1;
+    bool m_containsUnsignedLengthPattern : 1;
+    bool m_hasCopiedParenSubexpressions : 1;
+    RegExpFlags m_flags;
+    unsigned m_numSubpatterns;
+    unsigned m_maxBackReference;
+    PatternDisjunction* m_body;
+    Vector<std::unique_ptr<PatternDisjunction>, 4> m_disjunctions;
+    Vector<std::unique_ptr<CharacterClass>> m_userCharacterClasses;
+
+private:
+    const char* compile(const String& patternString, void* stackLimit);
+
+    CharacterClass* newlineCached;
+    CharacterClass* digitsCached;
+    CharacterClass* spacesCached;
+    CharacterClass* wordcharCached;
+    CharacterClass* wordUnicodeIgnoreCaseCharCached;
+    CharacterClass* nondigitsCached;
+    CharacterClass* nonspacesCached;
+    CharacterClass* nonwordcharCached;
+    CharacterClass* nonwordUnicodeIgnoreCasecharCached;
+};
+
+} } // namespace JSC::Yarr
diff --git a/yarr/YarrSyntaxChecker.cpp b/yarr/YarrSyntaxChecker.cpp
new file mode 100644
index 0000000..218f451
--- /dev/null
+++ b/yarr/YarrSyntaxChecker.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "YarrSyntaxChecker.h"
+
+#include "YarrParser.h"
+
+namespace JSC { namespace Yarr {
+
+class SyntaxChecker {
+public:
+    void assertionBOL() {}
+    void assertionEOL() {}
+    void assertionWordBoundary(bool) {}
+    void atomPatternCharacter(UChar32) {}
+    void atomBuiltInCharacterClass(BuiltInCharacterClassID, bool) {}
+    void atomCharacterClassBegin(bool = false) {}
+    void atomCharacterClassAtom(UChar) {}
+    void atomCharacterClassRange(UChar, UChar) {}
+    void atomCharacterClassBuiltIn(BuiltInCharacterClassID, bool) {}
+    void atomCharacterClassEnd() {}
+    void atomParenthesesSubpatternBegin(bool = true) {}
+    void atomParentheticalAssertionBegin(bool = false) {}
+    void atomParenthesesEnd() {}
+    void atomBackReference(unsigned) {}
+    void quantifyAtom(unsigned, unsigned, bool) {}
+    void disjunction() {}
+};
+
+const char* checkSyntax(const String& pattern, const String& flags)
+{
+    SyntaxChecker syntaxChecker;
+    return parse(syntaxChecker, pattern, flags.contains('u'));
+}
+
+}} // JSC::Yarr
diff --git a/yarr/YarrSyntaxChecker.h b/yarr/YarrSyntaxChecker.h
new file mode 100644
index 0000000..2e2e9bc
--- /dev/null
+++ b/yarr/YarrSyntaxChecker.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#pragma once
+
+#include <wtf/text/WTFString.h>
+
+namespace JSC { namespace Yarr {
+
+const char* checkSyntax(const String& pattern, const String& flags);
+
+}} // JSC::Yarr